Merge WebKit at r82507: Initial merge by git

Change-Id: I60ce9d780725b58b45e54165733a8ffee23b683e

2843 files changed, 112017 insertions, 29948 deletions

diff --git a/Examples/ChangeLog b/Examples/ChangeLog
index b7c0770..80cf1da 100644
--- a/Examples/ChangeLog
+++ b/Examples/ChangeLog
@@ -1,3 +1,18 @@
+2011-03-17  Jeff Miller  <jeffm@apple.com>
+
+        Use a consistent set of file patterns in the svn:ignore property for all .xcodeproj directories, specifically:
+        
+        *.mode*
+        *.pbxuser
+        *.perspective*
+        project.xcworkspace
+        xcuserdata
+
+        * NetscapeCocoaPlugin/NetscapeCocoaPlugin.xcodeproj: Modified property svn:ignore.
+        * NetscapeCoreAnimationMoviePlugin/NetscapeCoreAnimationMoviePlugin.xcodeproj: Modified property svn:ignore.
+        * NetscapeCoreAnimationPlugin/NetscapeCoreAnimationPlugin.xcodeproj: Modified property svn:ignore.
+        * NetscapeInputMethodPlugin/NetscapeInputMethodPlugin.xcodeproj: Modified property svn:ignore.
+
 2011-01-17  Dan Bernstein  <mitz@apple.com>
 
         Rubber-stamped by Mark Rowe.
diff --git a/LayoutTests/dom/html/level1/core/hc_elementwrongdocumenterr-expected.txt b/LayoutTests/dom/html/level1/core/hc_elementwrongdocumenterr-expected.txt
index 7b6e36d..523b7df 100644
--- a/LayoutTests/dom/html/level1/core/hc_elementwrongdocumenterr-expected.txt
+++ b/LayoutTests/dom/html/level1/core/hc_elementwrongdocumenterr-expected.txt
@@ -1,2 +1,3 @@
-Test:	http://www.w3.org/2001/DOM-Test-Suite/level1/core/hc_elementwrongdocumenterr
-Status:	Success
+Test:	http://www.w3.org/2001/DOM-Test-Suite/level1/core/hc_elementwrongdocumenterr	
+Status:	failure
+Detail:	throw_WRONG_DOCUMENT_ERR: assertTrue failed
diff --git a/LayoutTests/dom/html/level1/core/hc_namednodemapwrongdocumenterr-expected.txt b/LayoutTests/dom/html/level1/core/hc_namednodemapwrongdocumenterr-expected.txt
index 63a88c9..3e453f6 100644
--- a/LayoutTests/dom/html/level1/core/hc_namednodemapwrongdocumenterr-expected.txt
+++ b/LayoutTests/dom/html/level1/core/hc_namednodemapwrongdocumenterr-expected.txt
@@ -1,2 +1,3 @@
-Test:	http://www.w3.org/2001/DOM-Test-Suite/level1/core/hc_namednodemapwrongdocumenterr
-Status:	Success
+Test:	http://www.w3.org/2001/DOM-Test-Suite/level1/core/hc_namednodemapwrongdocumenterr	
+Status:	failure
+Detail:	throw_WRONG_DOCUMENT_ERR: assertTrue failed
diff --git a/LayoutTests/dom/xhtml/level1/core/hc_elementwrongdocumenterr-expected.txt b/LayoutTests/dom/xhtml/level1/core/hc_elementwrongdocumenterr-expected.txt
index 86c1d64..9870840 100644
--- a/LayoutTests/dom/xhtml/level1/core/hc_elementwrongdocumenterr-expected.txt
+++ b/LayoutTests/dom/xhtml/level1/core/hc_elementwrongdocumenterr-expected.txt
@@ -1,2 +1,3 @@
 Test	http://www.w3.org/2001/DOM-Test-Suite/level1/core/hc_elementwrongdocumenterr
-Status	Success
+Status	failure
+Message	throw_WRONG_DOCUMENT_ERR: assertTrue failed
diff --git a/LayoutTests/dom/xhtml/level1/core/hc_namednodemapwrongdocumenterr-expected.txt b/LayoutTests/dom/xhtml/level1/core/hc_namednodemapwrongdocumenterr-expected.txt
index ab021e2..aea8102 100644
--- a/LayoutTests/dom/xhtml/level1/core/hc_namednodemapwrongdocumenterr-expected.txt
+++ b/LayoutTests/dom/xhtml/level1/core/hc_namednodemapwrongdocumenterr-expected.txt
@@ -1,2 +1,3 @@
 Test	http://www.w3.org/2001/DOM-Test-Suite/level1/core/hc_namednodemapwrongdocumenterr
-Status	Success
+Status	failure
+Message	throw_WRONG_DOCUMENT_ERR: assertTrue failed
diff --git a/LayoutTests/fast/dom/Geolocation/page-reload-cancel-permission-requests-expected.txt b/LayoutTests/fast/dom/Geolocation/page-reload-cancel-permission-requests-expected.txt
new file mode 100644
index 0000000..c7f2d2b
--- /dev/null
+++ b/LayoutTests/fast/dom/Geolocation/page-reload-cancel-permission-requests-expected.txt
@@ -0,0 +1,10 @@
+Tests that when a page is reloaded, the frame is properly detached from the Geolocation object to ensure that no permission requests are in progress.
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS numPendingRequests is 0
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
diff --git a/LayoutTests/fast/dom/Geolocation/page-reload-cancel-permission-requests.html b/LayoutTests/fast/dom/Geolocation/page-reload-cancel-permission-requests.html
new file mode 100644
index 0000000..5b6aa5c
--- /dev/null
+++ b/LayoutTests/fast/dom/Geolocation/page-reload-cancel-permission-requests.html
@@ -0,0 +1,13 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">

+<html>

+<head>

+<link rel="stylesheet" href="../../js/resources/js-test-style.css">

+<script src="../../js/resources/js-test-pre.js"></script>

+</head>

+<body>

+<p id="description"></p>

+<div id="console"></div>

+<script src="script-tests/page-reload-cancel-permission-requests.js"></script>

+<script src="../../js/resources/js-test-post.js"></script>

+</body>

+</html>

diff --git a/LayoutTests/fast/dom/Geolocation/resources/page-reload-cancel-permission-requests-inner.html b/LayoutTests/fast/dom/Geolocation/resources/page-reload-cancel-permission-requests-inner.html
new file mode 100644
index 0000000..4a4a715
--- /dev/null
+++ b/LayoutTests/fast/dom/Geolocation/resources/page-reload-cancel-permission-requests-inner.html
@@ -0,0 +1,7 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+  <head>
+  </head>
+  <body onload="window.parent.onIframeReady()">
+  </body>
+</html>
diff --git a/LayoutTests/fast/dom/Geolocation/resources/window-close-popup.html b/LayoutTests/fast/dom/Geolocation/resources/window-close-popup.html
index cfeabae..5370b4c 100644
--- a/LayoutTests/fast/dom/Geolocation/resources/window-close-popup.html
+++ b/LayoutTests/fast/dom/Geolocation/resources/window-close-popup.html
@@ -11,9 +11,7 @@ function loadNext() {
        layoutTestController.setMockGeolocationPosition(mockLatitude, mockLongitude, mockAccuracy);
     }
 
-    navigator.geolocation.watchPosition(
-       function(p) { window.opener.gotPosition(); },
-       function(e) { window.opener.failedToCreateWatch(e); });
+    navigator.geolocation.watchPosition(window.opener.gotPosition);
 }
 </script>
 <body onload="loadNext()"></body>
diff --git a/LayoutTests/fast/dom/Geolocation/script-tests/page-reload-cancel-permission-requests.js b/LayoutTests/fast/dom/Geolocation/script-tests/page-reload-cancel-permission-requests.js
new file mode 100644
index 0000000..7ac291b
--- /dev/null
+++ b/LayoutTests/fast/dom/Geolocation/script-tests/page-reload-cancel-permission-requests.js
@@ -0,0 +1,44 @@
+description("Tests that when a page is reloaded, the frame is properly detached from the Geolocation object " +
+            "to ensure that no permission requests are in progress.");
+
+window.jsTestIsAsync = true;
+
+var numPendingRequests;
+var isReload = false;
+
+if ("#reload" == location.hash)
+    isReload = true;
+
+if (window.layoutTestController) {
+    numPendingRequests = layoutTestController.numberOfPendingGeolocationPermissionRequests();
+    shouldBe('numPendingRequests', '0');
+
+    if (isReload)
+        finishJSTest();
+}
+
+if (!isReload) {
+    // Kick off a position request and then reload the page, this should set up
+    // a permission request. Permission should be undecided at this point, so the
+    // permission request should still be outstanding by page reload.
+
+    function onIframeReady()
+    {
+        // Make request on remote frame's Geolocation object.
+        iframe.contentWindow.navigator.geolocation.getCurrentPosition(
+            function(p) {
+                testFailed('Permission should not be determined for this page: ' + p);
+                finishJSTest();
+            });
+
+        location.hash = '#reload';
+        location.reload();
+    }
+
+    debug("Create IFrame");
+    var iframe = document.createElement('iframe');
+    iframe.src = 'resources/page-reload-cancel-permission-requests-inner.html';
+    document.body.appendChild(iframe);
+}
+
+window.successfullyParsed = true;
diff --git a/LayoutTests/fast/dom/Geolocation/script-tests/window-close-crash.js b/LayoutTests/fast/dom/Geolocation/script-tests/window-close-crash.js
index b27df61..a8f2bda 100644
--- a/LayoutTests/fast/dom/Geolocation/script-tests/window-close-crash.js
+++ b/LayoutTests/fast/dom/Geolocation/script-tests/window-close-crash.js
@@ -28,12 +28,6 @@ function waitForWindowToClose()
     finishJSTest();
 }
 
-function failedToCreateWatch(e)
-{
-    testFailed("Failed to create watch: " + e);
-    finishJSTest();
-}
-
 debug("Main page opening resources/window-close-popup.html");
 otherWindow = window.open("resources/window-close-popup.html");
 
diff --git a/LayoutTests/fast/dom/HTMLFormElement/invalid-form-field-expected.txt b/LayoutTests/fast/dom/HTMLFormElement/invalid-form-field-expected.txt
new file mode 100644
index 0000000..a2dc689
--- /dev/null
+++ b/LayoutTests/fast/dom/HTMLFormElement/invalid-form-field-expected.txt
@@ -0,0 +1,5 @@
+PASS str is 'threw exception'
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
diff --git a/LayoutTests/fast/dom/HTMLFormElement/invalid-form-field.html b/LayoutTests/fast/dom/HTMLFormElement/invalid-form-field.html
new file mode 100644
index 0000000..309ab10
--- /dev/null
+++ b/LayoutTests/fast/dom/HTMLFormElement/invalid-form-field.html
@@ -0,0 +1,45 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script src="../../js/resources/js-test-pre.js"></script>
+</head>
+<body>
+<div id="test">
+    <div id="console"></div>
+</body>
+<script>
+window.jsTestIsAsync = true;
+
+var form, input, str;
+
+window.onload = function()
+{
+    form = document.body.appendChild(document.createElement("form"));
+    form.id = "form";
+  
+    input = document.createElement("input");
+    input.id = "input";
+    input.setAttribute("form", "form");
+    form.elements.namedItem("input");
+  
+    input = null;
+
+    gc();
+    setTimeout(step2, 100);
+}
+
+function step2()
+{
+    try {
+        str = typeof form['input'].form;
+    } catch(e) {
+        str = 'threw exception';
+    }
+    shouldBe("str", "'threw exception'");
+    finishJSTest();
+}
+
+window.successfullyParsed = true;
+</script>
+<script src="../../js/resources/js-test-post.js"></script>
+</html>
diff --git a/LayoutTests/fast/dom/HTMLFormElement/move-option-between-documents-expected.txt b/LayoutTests/fast/dom/HTMLFormElement/move-option-between-documents-expected.txt
new file mode 100644
index 0000000..da58066
--- /dev/null
+++ b/LayoutTests/fast/dom/HTMLFormElement/move-option-between-documents-expected.txt
@@ -0,0 +1,5 @@
+PASS typeof select.options.namedItem('option') is 'undefined'
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
diff --git a/LayoutTests/fast/dom/HTMLFormElement/move-option-between-documents.html b/LayoutTests/fast/dom/HTMLFormElement/move-option-between-documents.html
new file mode 100644
index 0000000..bf8ffd1
--- /dev/null
+++ b/LayoutTests/fast/dom/HTMLFormElement/move-option-between-documents.html
@@ -0,0 +1,45 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script src="../../js/resources/js-test-pre.js"></script>
+</head>
+<body>
+<div id="test">
+    <div id="console"></div>
+</body>
+<script>
+window.jsTestIsAsync = true;
+
+var select, doc1, doc2, str;
+
+window.onload = function()
+{
+    select = document.createElement("select");
+    var option = select.appendChild(document.createElement("option"));
+    option.id = "option";
+
+    doc1 = document.implementation.createHTMLDocument();
+    doc2 = document.implementation.createHTMLDocument();
+
+    doc1.body.appendChild(select);
+    select.options.namedItem("option");
+
+    select.removeChild(option);
+    option = null;
+
+    gc();
+    setTimeout(step2, 100);
+}
+
+function step2()
+{
+    doc1.body.removeChild(select);
+    doc2.body.appendChild(select);
+    shouldBe("typeof select.options.namedItem('option')", "'undefined'");
+    finishJSTest();
+}
+
+window.successfullyParsed = true;
+</script>
+<script src="../../js/resources/js-test-post.js"></script>
+</html>
diff --git a/LayoutTests/fast/dom/HTMLLinkElement/prefetch-beforeload-expected.txt b/LayoutTests/fast/dom/HTMLLinkElement/prefetch-beforeload-expected.txt
new file mode 100644
index 0000000..c7fb018
--- /dev/null
+++ b/LayoutTests/fast/dom/HTMLLinkElement/prefetch-beforeload-expected.txt
@@ -0,0 +1,2 @@
+PASS beforeload called
+This test will only print "PASS" or "FAIL" if link prefetches are enabled, otherwise it will show nothing below.
diff --git a/LayoutTests/fast/dom/HTMLLinkElement/prefetch-beforeload.html b/LayoutTests/fast/dom/HTMLLinkElement/prefetch-beforeload.html
new file mode 100644
index 0000000..27a62af
--- /dev/null
+++ b/LayoutTests/fast/dom/HTMLLinkElement/prefetch-beforeload.html
@@ -0,0 +1,14 @@
+<body>
+<div id="console"></div>
+<script src="../../js/resources/js-test-pre.js"></script>
+<script>
+if (window.layoutTestController) {
+    layoutTestController.dumpAsText();
+}
+</script>
+<html>
+<p>This test will only print "PASS" or "FAIL" if link prefetches are
+enabled, otherwise it will show nothing below.</p>
+<link href="prefetch.link" rel="prefetch" onbeforeload="testPassed('beforeload called');return false" onload="testFailed('onload')" onerror="testFailed('onerror')" />
+</html>
+
diff --git a/LayoutTests/fast/dom/HTMLLinkElement/prefetch-onerror-expected.txt b/LayoutTests/fast/dom/HTMLLinkElement/prefetch-onerror-expected.txt
new file mode 100644
index 0000000..47fc987
--- /dev/null
+++ b/LayoutTests/fast/dom/HTMLLinkElement/prefetch-onerror-expected.txt
@@ -0,0 +1,6 @@
+This tests that onerror events can be attached to link elements with rel=prefetch. Since prefetch links are just there as a performance optimization, the onerror/onload event is their only programatic side-effect.
+
+If it works you should see a message below saying the test has passed.
+
+PASS onerror was called
+
diff --git a/LayoutTests/fast/dom/HTMLLinkElement/prefetch-onerror.html b/LayoutTests/fast/dom/HTMLLinkElement/prefetch-onerror.html
new file mode 100644
index 0000000..07ced9e
--- /dev/null
+++ b/LayoutTests/fast/dom/HTMLLinkElement/prefetch-onerror.html
@@ -0,0 +1,25 @@
+<html>
+<head>
+<script src="../../js/resources/js-test-pre.js"></script>
+<script type="text/javascript">
+function done()
+{
+    testPassed('onerror was called');
+    if (window.layoutTestController)
+        layoutTestController.notifyDone();
+}
+if (window.layoutTestController) {
+    layoutTestController.dumpAsText();
+    layoutTestController.waitUntilDone();
+}
+</script>
+</head>
+<body>
+<p>This tests that onerror events can be attached to link elements with rel=prefetch. Since prefetch links are just there as a performance optimization, the onerror/onload event is their only programatic side-effect.</p>
+<p>If it works you should see a message below saying the test has passed.</p>
+<link href="prefetch-noexisty.link" rel="prefetch" onload="testFailed('onload event should not occur')" onerror="done()">
+<hr>
+<div id="console"></div>
+</body>
+</html>
+
diff --git a/LayoutTests/fast/encoding/dumpAsText/utf-16-no-bom-expected.txt b/LayoutTests/fast/encoding/dumpAsText/utf-16-no-bom-expected.txt
index 4aea68a..15ca8a8 100644
--- a/LayoutTests/fast/encoding/dumpAsText/utf-16-no-bom-expected.txt
+++ b/LayoutTests/fast/encoding/dumpAsText/utf-16-no-bom-expected.txt
@@ -2,4 +2,3 @@ This XML file does not appear to have any style information associated with it.
 <TEST>
 Should be "CYRILLIC SMALL LETTER IO" (like e with diaeresis): Ñ‘
 </TEST>
-
diff --git a/LayoutTests/fast/js/resources/js-constructors-use-correct-global.js b/LayoutTests/fast/js/resources/js-constructors-use-correct-global.js
new file mode 100644
index 0000000..df8cb08
--- /dev/null
+++ b/LayoutTests/fast/js/resources/js-constructors-use-correct-global.js
@@ -0,0 +1,16 @@
+description("Test to ensure that js constructors create objects with the correct constructor");
+
+var otherGlobal = document.getElementsByTagName("iframe")[0].contentWindow;
+var constructors = ["Object", "Function", "Array", "Number", "String", "Boolean", "RegExp", "Date", "Error", "RangeError", "ReferenceError", "SyntaxError", "TypeError", "URIError", "Image"];
+
+for (var i = 0; i < constructors.length; i++) {
+    shouldBeTrue("new otherGlobal." + constructors[i] + "() instanceof otherGlobal." + constructors[i]);
+    try {
+        if ((typeof (otherGlobal[constructors[i]]())) === "object" || (typeof (otherGlobal[constructors[i]]())) === "function")
+            shouldBeTrue("otherGlobal." + constructors[i] + "() instanceof otherGlobal." + constructors[i]);
+    } catch(e) {
+    
+    }
+}
+
+successfullyParsed = true;
diff --git a/LayoutTests/http/tests/appcache/origin-delete-expected.txt b/LayoutTests/http/tests/appcache/origin-delete-expected.txt
new file mode 100644
index 0000000..e91767d
--- /dev/null
+++ b/LayoutTests/http/tests/appcache/origin-delete-expected.txt
@@ -0,0 +1,7 @@
+This test checks that application cache groups correctly become obsolete after application cache is deletion for a specific origin.
+
+PASS - cached iframe-1
+clearing cache for origin
+appcache_status=5
+SUCCESS - cache was made obsolete
+
diff --git a/LayoutTests/http/tests/appcache/origin-delete.html b/LayoutTests/http/tests/appcache/origin-delete.html
new file mode 100644
index 0000000..26c4890
--- /dev/null
+++ b/LayoutTests/http/tests/appcache/origin-delete.html
@@ -0,0 +1,58 @@
+<html>
+<head>
+<script>
+
+// Helpers.
+
+function log(message) {
+    document.getElementById("console").innerHTML += message + "<br>";
+}
+
+// Start and end.
+
+function startTest() {
+    if (window.layoutTestController) {
+        layoutTestController.clearAllApplicationCaches();
+        layoutTestController.dumpApplicationCacheDelegateCallbacks();
+        layoutTestController.dumpAsText();
+        layoutTestController.waitUntilDone();
+    }
+
+    addIFrameWithAppCache();
+}
+
+function finishTest() {
+    if (window.layoutTestController)
+        layoutTestController.notifyDone();
+}
+
+function addIFrameWithAppCache() {
+    var iframe = document.createElement("iframe");
+    iframe.src = "resources/origin-delete-iframe.html";
+    iframe.id = "cachedFrame";
+    document.body.appendChild(iframe);
+    
+    window.onmessage = function(event) {
+        log(event.data);
+        if (event.data === "PASS - cached iframe-1") {
+            log("clearing cache for origin");
+            layoutTestController.clearApplicationCacheForOrigin("http://127.0.0.1:8000");
+            var frame = document.getElementById('cachedFrame');
+            frame.contentWindow.postMessage("appcache_status", "*");
+        } else if (event.data === "appcache_status=5"){
+            log("SUCCESS - cache was made obsolete");
+            finishTest();
+        } else {
+            log("FAIL - received unexpected message " + event.data);
+            finishTest();
+        }
+    };
+}
+</script>
+</head>
+<body onload="startTest()">
+<p>This test checks that application cache groups correctly become obsolete after application cache is deletion for a specific origin.
+</p>
+<pre id="console"></pre>
+</body>
+</html>
diff --git a/LayoutTests/http/tests/appcache/origins-with-appcache-expected.txt b/LayoutTests/http/tests/appcache/origins-with-appcache-expected.txt
new file mode 100644
index 0000000..e3b20f6
--- /dev/null
+++ b/LayoutTests/http/tests/appcache/origins-with-appcache-expected.txt
@@ -0,0 +1,5 @@
+This test verifies that ApplicationCacheStorage can report the set of origins that have an application cache. First, it tests that no origins are reported after all application caches are removed. Then, it loads an iframe that places a PNG into an application cache for the DumpRenderTree origin, and tests that this origin is now reported to have application cache.
+
+Origins with application cache after deletion: 
+Origins with application cache after frame was cached: http_127.0.0.1_8000
+
diff --git a/LayoutTests/http/tests/appcache/origins-with-appcache.html b/LayoutTests/http/tests/appcache/origins-with-appcache.html
new file mode 100644
index 0000000..0730f12
--- /dev/null
+++ b/LayoutTests/http/tests/appcache/origins-with-appcache.html
@@ -0,0 +1,57 @@
+<html>
+<head>
+<script>
+
+// Helpers.
+
+function log(message) {
+    document.getElementById("console").innerHTML += message + "<br>";
+}
+
+function handleMessage(event) {
+    if (event.data === "created_cache") {
+        log("Origins with application cache after frame was cached: " + layoutTestController.originsWithApplicationCache());
+    } else {
+        log("received invalid message from frame '" + event.data + "'");
+    }
+
+    finishTest();
+}
+
+function addIFrameWithCache()
+{
+    var iframe = document.createElement("iframe");
+    iframe.src = "resources/origins-with-appcache-iframe.html";
+    document.body.appendChild(iframe);
+}
+
+// Start and end.
+
+function startTest() {
+    if (window.layoutTestController) {
+        layoutTestController.clearAllApplicationCaches();
+        log("Origins with application cache after deletion: " + layoutTestController.originsWithApplicationCache());
+        layoutTestController.dumpApplicationCacheDelegateCallbacks();
+        layoutTestController.dumpAsText();
+        layoutTestController.waitUntilDone();
+    }
+
+    window.onmessage = handleMessage;
+
+    addIFrameWithCache();
+}
+
+function finishTest() {
+    if (window.layoutTestController)
+        layoutTestController.notifyDone();
+}
+
+</script>
+</head>
+<body onload="startTest()">
+<p>
+This test verifies that ApplicationCacheStorage can report the set of origins that have an application cache. First, it tests that no origins are reported after all application caches are removed. Then, it loads an iframe that places a PNG into an application cache for the DumpRenderTree origin, and tests that this origin is now reported to have application cache.
+</p>
+<pre id="console"></pre>
+</body>
+</html>
diff --git a/LayoutTests/http/tests/appcache/resources/origin-delete-iframe.html b/LayoutTests/http/tests/appcache/resources/origin-delete-iframe.html
new file mode 100644
index 0000000..e2565f7
--- /dev/null
+++ b/LayoutTests/http/tests/appcache/resources/origin-delete-iframe.html
@@ -0,0 +1,20 @@
+<html manifest="origin-delete-iframe.manifest">
+<script>
+// iframe-1 is expected to succeed.
+applicationCache.oncached = function() { parent.postMessage("PASS - cached iframe-1", "*"); };
+applicationCache.onerror = function() { parent.postMessage("FAIL - error caching iframe-1, expected this to succeed", "*"); };
+applicationCache.onnoupdate = function() { parent.postMessage("FAIL - no update iframe-1, all caches should have been deleted before this test", "*"); };
+
+
+function frameMessageReceived(event) {
+    if (event.data === "appcache_status") {
+        parent.postMessage("appcache_status=" + applicationCache.status, "*");
+    } else {
+        parent.postMessage("FAIL - unrecognized message", "*");
+    }
+}
+
+window.addEventListener("message", frameMessageReceived, false);
+
+</script>
+</html>
diff --git a/LayoutTests/http/tests/appcache/resources/origin-delete-iframe.manifest b/LayoutTests/http/tests/appcache/resources/origin-delete-iframe.manifest
new file mode 100644
index 0000000..6b48448
--- /dev/null
+++ b/LayoutTests/http/tests/appcache/resources/origin-delete-iframe.manifest
@@ -0,0 +1,6 @@
+CACHE MANIFEST
+
+# This adds ~13K to the app cache
+
+CACHE:
+abe.png
diff --git a/LayoutTests/http/tests/appcache/resources/origins-with-appcache-iframe.html b/LayoutTests/http/tests/appcache/resources/origins-with-appcache-iframe.html
new file mode 100644
index 0000000..92cf1ff
--- /dev/null
+++ b/LayoutTests/http/tests/appcache/resources/origins-with-appcache-iframe.html
@@ -0,0 +1,9 @@
+<html manifest="origins-with-appcache-iframe.manifest">
+<script>
+// iframe-1 is expected to succeed.
+applicationCache.oncached = function() { parent.postMessage("created_cache", "*"); };
+applicationCache.onerror = function() { parent.postMessage("FAIL - error caching iframe, expected this to succeed", "*"); };
+applicationCache.onnoupdate = function() { parent.postMessage("FAIL - no update iframe, all caches should have been deleted before this test", "*"); };
+
+</script>
+</html>
diff --git a/LayoutTests/http/tests/appcache/resources/origins-with-appcache-iframe.manifest b/LayoutTests/http/tests/appcache/resources/origins-with-appcache-iframe.manifest
new file mode 100644
index 0000000..6b48448
--- /dev/null
+++ b/LayoutTests/http/tests/appcache/resources/origins-with-appcache-iframe.manifest
@@ -0,0 +1,6 @@
+CACHE MANIFEST
+
+# This adds ~13K to the app cache
+
+CACHE:
+abe.png
diff --git a/LayoutTests/storage/domstorage/localstorage/storagetracker/storage-tracker-1-prepare-expected.txt b/LayoutTests/storage/domstorage/localstorage/storagetracker/storage-tracker-1-prepare-expected.txt
new file mode 100644
index 0000000..5cca432
--- /dev/null
+++ b/LayoutTests/storage/domstorage/localstorage/storagetracker/storage-tracker-1-prepare-expected.txt
@@ -0,0 +1,10 @@
+Prepare for StorageTracker tests by ensuring that every origin with local storage is deleted.
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+This test should have no visible output on success.
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
diff --git a/LayoutTests/storage/domstorage/localstorage/storagetracker/storage-tracker-1-prepare.html b/LayoutTests/storage/domstorage/localstorage/storagetracker/storage-tracker-1-prepare.html
new file mode 100644
index 0000000..a0a09ff
--- /dev/null
+++ b/LayoutTests/storage/domstorage/localstorage/storagetracker/storage-tracker-1-prepare.html
@@ -0,0 +1,44 @@
+<html>
+<head>
+<link rel="stylesheet" href="../../../../fast/js/resources/js-test-style.css">
+<script src="../../../../fast/js/resources/js-test-pre.js"></script>
+<script src="../../../../fast/js/resources/js-test-post-function.js"></script>
+</head>
+<body>
+<p id="description"></p>
+<div id="console"></div>
+<script>
+description("Prepare for StorageTracker tests by ensuring that every origin with local storage is deleted.");
+
+if (window.layoutTestController)
+    layoutTestController.waitUntilDone();
+    
+function finishTest() {
+    if (window.layoutTestController)
+        layoutTestController.notifyDone();
+}
+
+function test()
+{
+    if (!window.localStorage) {
+        testFailed("localStorage DOES NOT exist");
+        return;
+    }
+    
+    debug("This test should have no visible output on success.");
+
+    if (layoutTestController.originsWithLocalStorage().length > 0) {
+        layoutTestController.observeStorageTrackerNotifications(1);
+        layoutTestController.deleteAllLocalStorage();
+    } else {
+        finishTest();
+    }
+}
+
+test();	
+
+window.successfullyParsed = true;
+isSuccessfullyParsed();
+</script>
+</body>
+</html>
diff --git a/LayoutTests/storage/domstorage/localstorage/storagetracker/storage-tracker-2-create-expected.txt b/LayoutTests/storage/domstorage/localstorage/storagetracker/storage-tracker-2-create-expected.txt
new file mode 100644
index 0000000..5ae4ee1
--- /dev/null
+++ b/LayoutTests/storage/domstorage/localstorage/storagetracker/storage-tracker-2-create-expected.txt
@@ -0,0 +1,10 @@
+Origin identifier: 'file__0'
+StorageTracker test - write local storage for this origin. Should be called after origins-prepare.html.
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
diff --git a/LayoutTests/storage/domstorage/localstorage/storagetracker/storage-tracker-2-create.html b/LayoutTests/storage/domstorage/localstorage/storagetracker/storage-tracker-2-create.html
new file mode 100644
index 0000000..20f4f3d
--- /dev/null
+++ b/LayoutTests/storage/domstorage/localstorage/storagetracker/storage-tracker-2-create.html
@@ -0,0 +1,47 @@
+<html>
+<head>
+<link rel="stylesheet" href="../../../../fast/js/resources/js-test-style.css">
+<script src="../../../../fast/js/resources/js-test-pre.js"></script>
+<script src="../../../../fast/js/resources/js-test-post-function.js"></script>
+</head>
+<body>
+<p id="description"></p>
+<div id="console"></div>
+<script>
+description("StorageTracker test - write local storage for this origin. Should be called after origins-prepare.html.");
+
+if (window.layoutTestController)
+    layoutTestController.waitUntilDone();
+    
+function finishTest() {
+    if (window.layoutTestController)
+        layoutTestController.notifyDone();
+}
+
+function test()
+{
+    if (!window.localStorage) {
+        testFailed("localStorage DOES NOT exist");
+        return;
+    }
+    
+    if (layoutTestController.originsWithLocalStorage().length > 0) {
+        // An origin already exists so we can exit.
+        testFailed("An origin already existed with local storage.");
+        layoutTestController.notifyDone();
+    } else {
+        layoutTestController.syncLocalStorage();
+        
+        localStorage.someData = 'writeme';
+        // LayoutTestController's notifyDone will be called after the origin change notification comes in.
+        layoutTestController.observeStorageTrackerNotifications(1);
+    }
+}
+
+test();	
+
+window.successfullyParsed = true;
+isSuccessfullyParsed();
+</script>
+</body>
+</html>
diff --git a/LayoutTests/storage/domstorage/localstorage/storagetracker/storage-tracker-3-delete-all-expected.txt b/LayoutTests/storage/domstorage/localstorage/storagetracker/storage-tracker-3-delete-all-expected.txt
new file mode 100644
index 0000000..da480d9
--- /dev/null
+++ b/LayoutTests/storage/domstorage/localstorage/storagetracker/storage-tracker-3-delete-all-expected.txt
@@ -0,0 +1,10 @@
+Test API to view origins that have local storage and to delete local storage by origin.
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS layoutTestController.originsWithLocalStorage().toString() is "file__0"
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
diff --git a/LayoutTests/storage/domstorage/localstorage/storagetracker/storage-tracker-3-delete-all.html b/LayoutTests/storage/domstorage/localstorage/storagetracker/storage-tracker-3-delete-all.html
new file mode 100644
index 0000000..16da440
--- /dev/null
+++ b/LayoutTests/storage/domstorage/localstorage/storagetracker/storage-tracker-3-delete-all.html
@@ -0,0 +1,47 @@
+<html>
+<head>
+<link rel="stylesheet" href="../../../../fast/js/resources/js-test-style.css">
+<script src="../../../../fast/js/resources/js-test-pre.js"></script>
+<script src="../../../../fast/js/resources/js-test-post-function.js"></script>
+</head>
+<body>
+<p id="description"></p>
+<div id="console"></div>
+<script>
+description("Test API to view origins that have local storage and to delete local storage by origin.");
+
+if (window.layoutTestController)
+    layoutTestController.waitUntilDone();
+    
+function finishTest() {
+    if (window.layoutTestController)
+        layoutTestController.notifyDone();
+}
+
+function test()
+{
+    if (!window.localStorage) {
+        testFailed("localStorage DOES NOT exist");
+        return;
+    }
+
+    if (layoutTestController.originsWithLocalStorage().length > 0) {
+        shouldBeEqualToString("layoutTestController.originsWithLocalStorage().toString()", "file__0");
+        // We're just going to delete the existing origin, so we'll get one origin change notification.
+        layoutTestController.observeStorageTrackerNotifications(1);
+        layoutTestController.deleteAllLocalStorage();
+    } else {
+        layoutTestController.notifyDone();
+        testFailed("Ran with no origins with local storage");
+    }
+
+    // At this point, we're guaranteed to have one origin with local storage.
+}
+
+test();	
+
+window.successfullyParsed = true;
+isSuccessfullyParsed();
+</script>
+</body>
+</html>
diff --git a/LayoutTests/storage/domstorage/localstorage/storagetracker/storage-tracker-4-create-expected.txt b/LayoutTests/storage/domstorage/localstorage/storagetracker/storage-tracker-4-create-expected.txt
new file mode 100644
index 0000000..ab6ea2b
--- /dev/null
+++ b/LayoutTests/storage/domstorage/localstorage/storagetracker/storage-tracker-4-create-expected.txt
@@ -0,0 +1,11 @@
+Origin identifier: 'file__0'
+StorageTracker test - write local storage for this origin. Should be called after storage-tracker-3-delete-all.html.
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+This test should have no visible output on success.
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
diff --git a/LayoutTests/storage/domstorage/localstorage/storagetracker/storage-tracker-4-create.html b/LayoutTests/storage/domstorage/localstorage/storagetracker/storage-tracker-4-create.html
new file mode 100644
index 0000000..c066fb4
--- /dev/null
+++ b/LayoutTests/storage/domstorage/localstorage/storagetracker/storage-tracker-4-create.html
@@ -0,0 +1,47 @@
+<html>
+<head>
+<link rel="stylesheet" href="../../../../fast/js/resources/js-test-style.css">
+<script src="../../../../fast/js/resources/js-test-pre.js"></script>
+<script src="../../../../fast/js/resources/js-test-post-function.js"></script>
+</head>
+<body>
+<p id="description"></p>
+<div id="console"></div>
+<script>
+description("StorageTracker test - write local storage for this origin. Should be called after storage-tracker-3-delete-all.html.");
+
+if (window.layoutTestController)
+    layoutTestController.waitUntilDone();
+    
+function finishTest() {
+    if (window.layoutTestController)
+        layoutTestController.notifyDone();
+}
+
+function test()
+{
+    if (!window.localStorage) {
+        testFailed("localStorage DOES NOT exist");
+        return;
+    }
+    
+    debug("This test should have no visible output on success.");
+
+    if (layoutTestController.originsWithLocalStorage().length > 0) {
+        // An origin already exists so we can exit.
+        testFailed("An origin already existed with local storage.");
+        layoutTestController.notifyDone();
+    } else {
+        layoutTestController.syncLocalStorage();
+        localStorage.someOtherData = 'writemeMore';
+        layoutTestController.observeStorageTrackerNotifications(1);
+    }
+}
+
+test();	
+
+window.successfullyParsed = true;
+isSuccessfullyParsed();
+</script>
+</body>
+</html>
diff --git a/LayoutTests/storage/domstorage/localstorage/storagetracker/storage-tracker-5-delete-one-expected.txt b/LayoutTests/storage/domstorage/localstorage/storagetracker/storage-tracker-5-delete-one-expected.txt
new file mode 100644
index 0000000..da480d9
--- /dev/null
+++ b/LayoutTests/storage/domstorage/localstorage/storagetracker/storage-tracker-5-delete-one-expected.txt
@@ -0,0 +1,10 @@
+Test API to view origins that have local storage and to delete local storage by origin.
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS layoutTestController.originsWithLocalStorage().toString() is "file__0"
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
diff --git a/LayoutTests/storage/domstorage/localstorage/storagetracker/storage-tracker-5-delete-one.html b/LayoutTests/storage/domstorage/localstorage/storagetracker/storage-tracker-5-delete-one.html
new file mode 100644
index 0000000..3a61a73
--- /dev/null
+++ b/LayoutTests/storage/domstorage/localstorage/storagetracker/storage-tracker-5-delete-one.html
@@ -0,0 +1,47 @@
+<html>
+<head>
+<link rel="stylesheet" href="../../../../fast/js/resources/js-test-style.css">
+<script src="../../../../fast/js/resources/js-test-pre.js"></script>
+<script src="../../../../fast/js/resources/js-test-post-function.js"></script>
+</head>
+<body>
+<p id="description"></p>
+<div id="console"></div>
+<script>
+description("Test API to view origins that have local storage and to delete local storage by origin.");
+
+if (window.layoutTestController)
+    layoutTestController.waitUntilDone();
+    
+function finishTest() {
+    if (window.layoutTestController)
+        layoutTestController.notifyDone();
+}
+
+function test()
+{
+    if (!window.localStorage) {
+        testFailed("localStorage DOES NOT exist");
+        return;
+    }
+
+    if (layoutTestController.originsWithLocalStorage().length > 0) {
+        shouldBeEqualToString("layoutTestController.originsWithLocalStorage().toString()", "file__0");
+        // We're just going to delete the existing origin, so we'll get one origin change notification.
+        layoutTestController.observeStorageTrackerNotifications(1);
+        // At this point, we're guaranteed to have one origin with local storage.
+        layoutTestController.deleteLocalStorageForOrigin("file://");
+    } else {
+        testFailed("Ran with no origins with local storage.");
+        layoutTestController.notifyDone();
+    }
+
+}
+
+test();	
+
+window.successfullyParsed = true;
+isSuccessfullyParsed();
+</script>
+</body>
+</html>
diff --git a/PerformanceTests/ChangeLog b/PerformanceTests/ChangeLog
index 02bcc1d..34732ab 100644
--- a/PerformanceTests/ChangeLog
+++ b/PerformanceTests/ChangeLog
@@ -1,3 +1,17 @@
+2011-03-25  Leo Yang  <leo.yang@torchmobile.com.cn>
+
+        Reviewed by Dirk Schulze.
+
+        SVG <use> element performance improvement
+        https://bugs.webkit.org/show_bug.cgi?id=57077
+
+        Add a manual test case which is from
+        http://upload.wikimedia.org/wikipedia/commons/4/4e/Sierpinski_carpet_6.svg
+        for svg <use> element performance test.
+
+        * PageLoad/svg/files/Sierpinski_carpet_6.svg: Added.
+        * PageLoad/svg/svg.pltsuite:
+
 2011-02-05  Eric Seidel  <eric@webkit.org>
 
         Reviewed by Adam Barth.
diff --git a/PerformanceTests/PageLoad/svg/files/Sierpinski_carpet_6.svg b/PerformanceTests/PageLoad/svg/files/Sierpinski_carpet_6.svg
new file mode 100644
index 0000000..af583a1
--- /dev/null
+++ b/PerformanceTests/PageLoad/svg/files/Sierpinski_carpet_6.svg
@@ -0,0 +1,62 @@
+<?xml version="1.0" standalone="no"?>
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" version="1.0" width="900" height="900">
+    <defs>
+        <symbol id="s" viewBox="0 0 3 3">
+            <rect fill="#000" width="1" height="1" x="1" y="1"/>
+        </symbol>
+        <symbol id="s1" viewBox="0 0 900 900">
+            <use xlink:href="#s" x="0" y="0" width="900" height="900"/>
+            <use xlink:href="#s" x="0" y="0" width="300" height="300"/>
+            <use xlink:href="#s" x="300" y="0" width="300" height="300"/>
+            <use xlink:href="#s" x="600" y="0" width="300" height="300"/>
+            <use xlink:href="#s" x="0" y="300" width="300" height="300"/>
+            <use xlink:href="#s" x="600" y="300" width="300" height="300"/>
+            <use xlink:href="#s" x="0" y="600" width="300" height="300"/>
+            <use xlink:href="#s" x="300" y="600" width="300" height="300"/>
+            <use xlink:href="#s" x="600" y="600" width="300" height="300"/>
+        </symbol>
+        <symbol id="s2" viewBox="0 0 900 900">
+            <use xlink:href="#s" x="0" y="0" width="900" height="900"/>
+            <use xlink:href="#s1" x="0" y="0" width="300" height="300"/>
+            <use xlink:href="#s1" x="300" y="0" width="300" height="300"/>
+            <use xlink:href="#s1" x="600" y="0" width="300" height="300"/>
+            <use xlink:href="#s1" x="0" y="300" width="300" height="300"/>
+            <use xlink:href="#s1" x="600" y="300" width="300" height="300"/>
+            <use xlink:href="#s1" x="0" y="600" width="300" height="300"/>
+            <use xlink:href="#s1" x="300" y="600" width="300" height="300"/>
+            <use xlink:href="#s1" x="600" y="600" width="300" height="300"/>
+        </symbol>
+        <symbol id="s3" viewBox="0 0 900 900">
+            <use xlink:href="#s" x="0" y="0" width="900" height="900"/>
+            <use xlink:href="#s2" x="0" y="0" width="300" height="300"/>
+            <use xlink:href="#s2" x="300" y="0" width="300" height="300"/>
+            <use xlink:href="#s2" x="600" y="0" width="300" height="300"/>
+            <use xlink:href="#s2" x="0" y="300" width="300" height="300"/>
+            <use xlink:href="#s2" x="600" y="300" width="300" height="300"/>
+            <use xlink:href="#s2" x="0" y="600" width="300" height="300"/>
+            <use xlink:href="#s2" x="300" y="600" width="300" height="300"/>
+            <use xlink:href="#s2" x="600" y="600" width="300" height="300"/>
+        </symbol>
+        <symbol id="s4" viewBox="0 0 900 900">
+            <use xlink:href="#s" x="0" y="0" width="900" height="900"/>
+            <use xlink:href="#s3" x="0" y="0" width="300" height="300"/>
+            <use xlink:href="#s3" x="300" y="0" width="300" height="300"/>
+            <use xlink:href="#s3" x="600" y="0" width="300" height="300"/>
+            <use xlink:href="#s3" x="0" y="300" width="300" height="300"/>
+            <use xlink:href="#s3" x="600" y="300" width="300" height="300"/>
+            <use xlink:href="#s3" x="0" y="600" width="300" height="300"/>
+            <use xlink:href="#s3" x="300" y="600" width="300" height="300"/>
+            <use xlink:href="#s3" x="600" y="600" width="300" height="300"/>
+        </symbol>
+    </defs>
+    <rect width="900" height="900" fill="#fff"/>
+    <use xlink:href="#s" x="0" y="0" width="900" height="900"/>
+    <use xlink:href="#s4" x="0" y="0" width="300" height="300"/>
+    <use xlink:href="#s4" x="300" y="0" width="300" height="300"/>
+    <use xlink:href="#s4" x="600" y="0" width="300" height="300"/>
+    <use xlink:href="#s4" x="0" y="300" width="300" height="300"/>
+    <use xlink:href="#s4" x="600" y="300" width="300" height="300"/>
+    <use xlink:href="#s4" x="0" y="600" width="300" height="300"/>
+    <use xlink:href="#s4" x="300" y="600" width="300" height="300"/>
+    <use xlink:href="#s4" x="600" y="600" width="300" height="300"/>
+</svg>
diff --git a/PerformanceTests/PageLoad/svg/svg.pltsuite b/PerformanceTests/PageLoad/svg/svg.pltsuite
index ca161e8..8242e48 100644
--- a/PerformanceTests/PageLoad/svg/svg.pltsuite
+++ b/PerformanceTests/PageLoad/svg/svg.pltsuite
@@ -17,3 +17,4 @@ file:///WEBKIT_PATH/PerformanceTests/PageLoad/svg/files/hereGear4.svg
 file:///WEBKIT_PATH/PerformanceTests/PageLoad/svg/files/mtsthelens.svg
 file:///WEBKIT_PATH/PerformanceTests/PageLoad/svg/files/world-iso.svg
 file:///WEBKIT_PATH/PerformanceTests/PageLoad/svg/files/worldcup.svg
+file:///WEBKIT_PATH/PerformanceTests/PageLoad/svg/files/Sierpinski_carpet_6.svg
diff --git a/Source/CMakeLists.txt b/Source/CMakeLists.txt
index 13ea13c..d6368c0 100644
--- a/Source/CMakeLists.txt
+++ b/Source/CMakeLists.txt
@@ -23,8 +23,13 @@ INCLUDE(WebKitFeatures)
 # -----------------------------------------------------------------------------
 # Determine which port will be built
 # -----------------------------------------------------------------------------
-SET(ALL_PORTS Efl)
-OPTION(PORT "choose which WebKit port to build (one of ${ALL_PORTS})" "NOPORT")
+SET(ALL_PORTS Efl WinCE)
+SET(PORT "NOPORT" CACHE STRING "choose which WebKit port to build (one of ${ALL_PORTS})")
+
+LIST(FIND ALL_PORTS ${PORT} RET)
+IF (${RET} EQUAL -1)
+    MESSAGE(FATAL_ERROR "Please choose which WebKit port to build (one of ${ALL_PORTS})")
+ENDIF ()
 
 # -----------------------------------------------------------------------------
 # Find common packages (used by all ports)
diff --git a/Source/JavaScriptCore/API/APIShims.h b/Source/JavaScriptCore/API/APIShims.h
index 26db2dc..2e13851 100644
--- a/Source/JavaScriptCore/API/APIShims.h
+++ b/Source/JavaScriptCore/API/APIShims.h
@@ -42,7 +42,7 @@ protected:
         UNUSED_PARAM(registerThread);
 #if ENABLE(JSC_MULTIPLE_THREADS)
         if (registerThread)
-            globalData->heap.machineStackMarker().registerThread();
+            globalData->heap.machineThreads().addCurrentThread();
 #endif
         m_globalData->heap.activityCallback()->synchronize();
         m_globalData->timeoutChecker.start();
diff --git a/Source/JavaScriptCore/API/JSBase.h b/Source/JavaScriptCore/API/JSBase.h
index d962b01..fed54fe 100644
--- a/Source/JavaScriptCore/API/JSBase.h
+++ b/Source/JavaScriptCore/API/JSBase.h
@@ -80,6 +80,11 @@ typedef struct OpaqueJSValue* JSObjectRef;
 #define JS_EXPORT
 #endif /* defined(JS_NO_EXPORT) */
 
+/* JS tests uses WTF but has no config.h, so we need to set the export defines here. */
+#ifndef WTF_EXPORT_PRIVATE
+#define WTF_EXPORT_PRIVATE JS_EXPORT
+#endif
+
 #ifdef __cplusplus
 extern "C" {
 #endif
diff --git a/Source/JavaScriptCore/API/JSCallbackConstructor.h b/Source/JavaScriptCore/API/JSCallbackConstructor.h
index cd307a6..001c416 100644
--- a/Source/JavaScriptCore/API/JSCallbackConstructor.h
+++ b/Source/JavaScriptCore/API/JSCallbackConstructor.h
@@ -39,9 +39,9 @@ public:
     JSObjectCallAsConstructorCallback callback() const { return m_callback; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValue proto) 
+    static PassRefPtr<Structure> createStructure(JSGlobalData& globalData, JSValue proto) 
     {
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
+        return Structure::create(globalData, proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
     }
 
 protected:
diff --git a/Source/JavaScriptCore/API/JSCallbackFunction.h b/Source/JavaScriptCore/API/JSCallbackFunction.h
index d8ae608..11fb95c 100644
--- a/Source/JavaScriptCore/API/JSCallbackFunction.h
+++ b/Source/JavaScriptCore/API/JSCallbackFunction.h
@@ -39,9 +39,9 @@ public:
     
     // InternalFunction mish-mashes constructor and function behavior -- we should 
     // refactor the code so this override isn't necessary
-    static PassRefPtr<Structure> createStructure(JSValue proto) 
+    static PassRefPtr<Structure> createStructure(JSGlobalData& globalData, JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info); 
+        return Structure::create(globalData, proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info); 
     }
 
 private:
diff --git a/Source/JavaScriptCore/API/JSCallbackObject.h b/Source/JavaScriptCore/API/JSCallbackObject.h
index 732cc1d..a0adb44 100644
--- a/Source/JavaScriptCore/API/JSCallbackObject.h
+++ b/Source/JavaScriptCore/API/JSCallbackObject.h
@@ -128,9 +128,9 @@ public:
     JSClassRef classRef() const { return m_callbackObjectData->jsClass; }
     bool inherits(JSClassRef) const;
 
-    static PassRefPtr<Structure> createStructure(JSValue proto) 
+    static PassRefPtr<Structure> createStructure(JSGlobalData& globalData, JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), Base::AnonymousSlotCount, &s_info); 
+        return Structure::create(globalData, proto, TypeInfo(ObjectType, StructureFlags), Base::AnonymousSlotCount, &s_info); 
     }
     
     JSValue getPrivateProperty(const Identifier& propertyName) const
diff --git a/Source/JavaScriptCore/API/JSClassRef.cpp b/Source/JavaScriptCore/API/JSClassRef.cpp
index d953dce..70668bd 100644
--- a/Source/JavaScriptCore/API/JSClassRef.cpp
+++ b/Source/JavaScriptCore/API/JSClassRef.cpp
@@ -84,8 +84,9 @@ OpaqueJSClass::OpaqueJSClass(const JSClassDefinition* definition, OpaqueJSClass*
                 // Use a local variable here to sidestep an RVCT compiler bug.
                 StaticValueEntry* entry = new StaticValueEntry(staticValue->getProperty, staticValue->setProperty, staticValue->attributes);
                 StringImpl* impl = valueName.impl();
-                impl->ref();
-                m_staticValues->add(impl, entry);
+                StaticValueEntry* existingEntry = m_staticValues->get(impl);
+                m_staticValues->set(impl, entry);
+                delete existingEntry;
             }
             ++staticValue;
         }
@@ -99,8 +100,9 @@ OpaqueJSClass::OpaqueJSClass(const JSClassDefinition* definition, OpaqueJSClass*
                 // Use a local variable here to sidestep an RVCT compiler bug.
                 StaticFunctionEntry* entry = new StaticFunctionEntry(staticFunction->callAsFunction, staticFunction->attributes);
                 StringImpl* impl = functionName.impl();
-                impl->ref();
-                m_staticFunctions->add(impl, entry);
+                StaticFunctionEntry* existingEntry = m_staticFunctions->get(impl);
+                m_staticFunctions->set(impl, entry);
+                delete existingEntry;
             }
             ++staticFunction;
         }
diff --git a/Source/JavaScriptCore/API/JSClassRef.h b/Source/JavaScriptCore/API/JSClassRef.h
index 0f4119a..239c5a4 100644
--- a/Source/JavaScriptCore/API/JSClassRef.h
+++ b/Source/JavaScriptCore/API/JSClassRef.h
@@ -85,7 +85,7 @@ public:
     JSC::WeakGCPtr<JSC::JSObject> cachedPrototype;
 };
 
-struct OpaqueJSClass : public ThreadSafeShared<OpaqueJSClass> {
+struct OpaqueJSClass : public ThreadSafeRefCounted<OpaqueJSClass> {
     static PassRefPtr<OpaqueJSClass> create(const JSClassDefinition*);
     static PassRefPtr<OpaqueJSClass> createNoAutomaticPrototype(const JSClassDefinition*);
     ~OpaqueJSClass();
diff --git a/Source/JavaScriptCore/API/JSContextRef.cpp b/Source/JavaScriptCore/API/JSContextRef.cpp
index ccab953..e5c778f 100644
--- a/Source/JavaScriptCore/API/JSContextRef.cpp
+++ b/Source/JavaScriptCore/API/JSContextRef.cpp
@@ -93,11 +93,11 @@ JSGlobalContextRef JSGlobalContextCreateInGroup(JSContextGroupRef group, JSClass
 #endif
 
     if (!globalObjectClass) {
-        JSGlobalObject* globalObject = new (globalData.get()) JSGlobalObject;
+        JSGlobalObject* globalObject = new (globalData.get()) JSGlobalObject(*globalData);
         return JSGlobalContextRetain(toGlobalRef(globalObject->globalExec()));
     }
 
-    JSGlobalObject* globalObject = new (globalData.get()) JSCallbackObject<JSGlobalObject>(globalObjectClass, JSCallbackObject<JSGlobalObject>::createStructure(jsNull()));
+    JSGlobalObject* globalObject = new (globalData.get()) JSCallbackObject<JSGlobalObject>(globalObjectClass, JSCallbackObject<JSGlobalObject>::createStructure(*globalData, jsNull()));
     ExecState* exec = globalObject->globalExec();
     JSValue prototype = globalObjectClass->prototype(exec);
     if (!prototype)
diff --git a/Source/JavaScriptCore/API/JSObjectRef.cpp b/Source/JavaScriptCore/API/JSObjectRef.cpp
index 36ca338..b7030e4 100644
--- a/Source/JavaScriptCore/API/JSObjectRef.cpp
+++ b/Source/JavaScriptCore/API/JSObjectRef.cpp
@@ -124,7 +124,7 @@ JSObjectRef JSObjectMakeFunction(JSContextRef ctx, JSStringRef name, unsigned pa
         args.append(jsString(exec, parameterNames[i]->ustring()));
     args.append(jsString(exec, body->ustring()));
 
-    JSObject* result = constructFunction(exec, args, nameID, sourceURL->ustring(), startingLineNumber);
+    JSObject* result = constructFunction(exec, exec->lexicalGlobalObject(), args, nameID, sourceURL->ustring(), startingLineNumber);
     if (exec->hadException()) {
         if (exception)
             *exception = toRef(exec, exec->exception());
@@ -168,7 +168,7 @@ JSObjectRef JSObjectMakeDate(JSContextRef ctx, size_t argumentCount, const JSVal
     for (size_t i = 0; i < argumentCount; ++i)
         argList.append(toJS(exec, arguments[i]));
 
-    JSObject* result = constructDate(exec, argList);
+    JSObject* result = constructDate(exec, exec->lexicalGlobalObject(), argList);
     if (exec->hadException()) {
         if (exception)
             *exception = toRef(exec, exec->exception());
@@ -207,7 +207,7 @@ JSObjectRef JSObjectMakeRegExp(JSContextRef ctx, size_t argumentCount, const JSV
     for (size_t i = 0; i < argumentCount; ++i)
         argList.append(toJS(exec, arguments[i]));
 
-    JSObject* result = constructRegExp(exec, argList);
+    JSObject* result = constructRegExp(exec, exec->lexicalGlobalObject(),  argList);
     if (exec->hadException()) {
         if (exception)
             *exception = toRef(exec, exec->exception());
diff --git a/Source/JavaScriptCore/API/JSWeakObjectMapRefPrivate.cpp b/Source/JavaScriptCore/API/JSWeakObjectMapRefPrivate.cpp
index bc5e383..54dfda6 100644
--- a/Source/JavaScriptCore/API/JSWeakObjectMapRefPrivate.cpp
+++ b/Source/JavaScriptCore/API/JSWeakObjectMapRefPrivate.cpp
@@ -68,14 +68,11 @@ JSObjectRef JSWeakObjectMapGet(JSContextRef ctx, JSWeakObjectMapRef map, void* k
     return toRef(static_cast<JSObject*>(map->map().get(key)));
 }
 
-bool JSWeakObjectMapClear(JSContextRef ctx, JSWeakObjectMapRef map, void* key, JSObjectRef object)
+// We need to keep this function in the build to keep the nightlies running.
+JS_EXPORT bool JSWeakObjectMapClear(JSContextRef, JSWeakObjectMapRef, void*, JSObjectRef);
+bool JSWeakObjectMapClear(JSContextRef, JSWeakObjectMapRef, void*, JSObjectRef)
 {
-    ExecState* exec = toJS(ctx);
-    APIEntryShim entryShim(exec);
-    JSObject* obj = toJS(object);
-    if (map->map().deprecatedRemove(key, obj))
-        return true;
-    return false;
+    return true;
 }
 
 #ifdef __cplusplus
diff --git a/Source/JavaScriptCore/API/JSWeakObjectMapRefPrivate.h b/Source/JavaScriptCore/API/JSWeakObjectMapRefPrivate.h
index bb3fe96..01e0611 100644
--- a/Source/JavaScriptCore/API/JSWeakObjectMapRefPrivate.h
+++ b/Source/JavaScriptCore/API/JSWeakObjectMapRefPrivate.h
@@ -76,17 +76,6 @@ JS_EXPORT void JSWeakObjectMapSet(JSContextRef ctx, JSWeakObjectMapRef map, void
  */
 JS_EXPORT JSObjectRef JSWeakObjectMapGet(JSContextRef ctx, JSWeakObjectMapRef map, void* key);
 
-/*!
- @function
- @abstract Clears the association between a key and an object in a JSWeakObjectMapRef
- @param ctx The execution context to use.
- @param map The map to clear the key association from.
- @param key The key to use.
- @param object The old object value.
- @result Returns true if the key/object association was present in map, and has been removed.
- */
-JS_EXPORT bool JSWeakObjectMapClear(JSContextRef ctx, JSWeakObjectMapRef map, void* key, JSObjectRef object);
-
 #ifdef __cplusplus
 }
 #endif
diff --git a/Source/JavaScriptCore/API/OpaqueJSString.h b/Source/JavaScriptCore/API/OpaqueJSString.h
index 473c815..69c0962 100644
--- a/Source/JavaScriptCore/API/OpaqueJSString.h
+++ b/Source/JavaScriptCore/API/OpaqueJSString.h
@@ -33,7 +33,7 @@ namespace JSC {
     class JSGlobalData;
 }
 
-struct OpaqueJSString : public ThreadSafeShared<OpaqueJSString> {
+struct OpaqueJSString : public ThreadSafeRefCounted<OpaqueJSString> {
 
     static PassRefPtr<OpaqueJSString> create() // null
     {
@@ -54,7 +54,7 @@ struct OpaqueJSString : public ThreadSafeShared<OpaqueJSString> {
     JSC::Identifier identifier(JSC::JSGlobalData*) const;
 
 private:
-    friend class WTF::ThreadSafeShared<OpaqueJSString>;
+    friend class WTF::ThreadSafeRefCounted<OpaqueJSString>;
 
     OpaqueJSString()
         : m_characters(0)
diff --git a/Source/JavaScriptCore/CMakeLists.txt b/Source/JavaScriptCore/CMakeLists.txt
index 97f100e..247d372 100644
--- a/Source/JavaScriptCore/CMakeLists.txt
+++ b/Source/JavaScriptCore/CMakeLists.txt
@@ -42,6 +42,7 @@ SET(JavaScriptCore_SOURCES
     bytecompiler/NodesCodegen.cpp
 
     collector/handles/HandleHeap.cpp
+    collector/handles/HandleStack.cpp
 
     debugger/Debugger.cpp
     debugger/DebuggerActivation.cpp
diff --git a/Source/JavaScriptCore/ChangeLog b/Source/JavaScriptCore/ChangeLog
index 162f23f..7cc1d15 100644
--- a/Source/JavaScriptCore/ChangeLog
+++ b/Source/JavaScriptCore/ChangeLog
@@ -1,3 +1,3318 @@
+2011-03-30  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Make StructureChain GC allocated
+        https://bugs.webkit.org/show_bug.cgi?id=56695
+
+        Make StructureChain GC allocated, and make the various owners
+        mark it correctly.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        (JSC::CodeBlock::derefStructures):
+        (JSC::CodeBlock::refStructures):
+        (JSC::CodeBlock::markAggregate):
+        * bytecode/Instruction.h:
+        (JSC::PolymorphicAccessStructureList::PolymorphicStubInfo::set):
+        (JSC::PolymorphicAccessStructureList::PolymorphicAccessStructureList):
+        (JSC::PolymorphicAccessStructureList::derefStructures):
+        (JSC::PolymorphicAccessStructureList::markAggregate):
+        (JSC::Instruction::Instruction):
+        * bytecode/StructureStubInfo.cpp:
+        (JSC::StructureStubInfo::deref):
+        (JSC::StructureStubInfo::markAggregate):
+        * bytecode/StructureStubInfo.h:
+        (JSC::StructureStubInfo::initGetByIdChain):
+        (JSC::StructureStubInfo::initPutByIdTransition):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitJumpIfNotFunctionCall):
+        (JSC::BytecodeGenerator::emitJumpIfNotFunctionApply):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_jneq_ptr):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_jneq_ptr):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::privateCompileGetByIdChainList):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::privateCompileGetByIdChainList):
+        * jit/JITStubs.cpp:
+        (JSC::getPolymorphicAccessStructureListSlot):
+        (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/JSCell.h:
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        * runtime/JSGlobalData.h:
+        * runtime/JSGlobalObject.cpp:
+        (JSC::markIfNeeded):
+        * runtime/JSGlobalObject.h:
+        (JSC::Structure::prototypeChain):
+        * runtime/JSObject.h:
+        (JSC::JSObject::markChildrenDirect):
+        * runtime/JSPropertyNameIterator.cpp:
+        (JSC::JSPropertyNameIterator::create):
+        (JSC::JSPropertyNameIterator::get):
+        (JSC::JSPropertyNameIterator::markChildren):
+        * runtime/JSPropertyNameIterator.h:
+        (JSC::JSPropertyNameIterator::setCachedPrototypeChain):
+        * runtime/MarkStack.h:
+        (JSC::MarkStack::append):
+        * runtime/Structure.h:
+        (JSC::Structure::cachedPrototypeChainSlot):
+        * runtime/StructureChain.cpp:
+        (JSC::StructureChain::StructureChain):
+        * runtime/StructureChain.h:
+        (JSC::StructureChain::create):
+        (JSC::StructureChain::createStructure):
+
+2011-03-30  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Update Windows production build logic for new production configurations
+        https://bugs.webkit.org/show_bug.cgi?id=57494
+
+        * JavaScriptCore.vcproj/JavaScriptCore.make:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreProduction.vsprops:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreReleasePGO.vsprops:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreReleasePGOOptimize.vsprops:
+        * JavaScriptCore.vcproj/WTF/WTFProduction.vsprops:
+        * JavaScriptCore.vcproj/WTF/WTFReleasePGO.vsprops:
+        * JavaScriptCore.vcproj/jsc/jscProduction.vsprops:
+        * JavaScriptCore.vcproj/jsc/jscReleasePGO.vsprops:
+        * JavaScriptCore.vcproj/testapi/testapiProduction.vsprops:
+
+2011-03-30  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Rename Windows configuration Release_LTCG to Production for clarity
+        https://bugs.webkit.org/show_bug.cgi?id=57465
+
+        * JavaScriptCore.vcproj/JavaScriptCore.sln:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.vcproj:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreProduction.vsprops: Copied from Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreReleaseLTCG.vsprops.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreReleaseLTCG.vsprops: Removed.
+        * JavaScriptCore.vcproj/JavaScriptCoreSubmit.sln:
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        * JavaScriptCore.vcproj/WTF/WTFProduction.vsprops: Copied from Source/JavaScriptCore/JavaScriptCore.vcproj/WTF/WTFReleaseLTCG.vsprops.
+        * JavaScriptCore.vcproj/WTF/WTFReleaseLTCG.vsprops: Removed.
+        * JavaScriptCore.vcproj/jsc/jsc.vcproj:
+        * JavaScriptCore.vcproj/jsc/jscProduction.vsprops: Copied from Source/JavaScriptCore/JavaScriptCore.vcproj/jsc/jscReleaseLTCG.vsprops.
+        * JavaScriptCore.vcproj/jsc/jscReleaseLTCG.vsprops: Removed.
+        * JavaScriptCore.vcproj/testapi/testapi.vcproj:
+        * JavaScriptCore.vcproj/testapi/testapiProduction.vsprops: Copied from Source/JavaScriptCore/JavaScriptCore.vcproj/testapi/testapiReleaseLTCG.vsprops.
+        * JavaScriptCore.vcproj/testapi/testapiReleaseLTCG.vsprops: Removed.
+
+2011-03-30  Zoltan Herczeg  <zherczeg@inf.u-szeged.hu>
+
+        Reviewed by Maciej Stachowiak.
+
+        Add the NEXT_OPCODE() macro to the DFG-JIT parser
+        https://bugs.webkit.org/show_bug.cgi?id=57322
+
+        In JavaScriptCore we use macros to jump to the next opcode
+        (both in interpreter and JIT). This macro is added to the
+        DFG-JIT parser as well.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parse):
+
+2011-03-29  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin Adler.
+
+        ~25% regression on v8-splay in the SunSpider harness
+        https://bugs.webkit.org/show_bug.cgi?id=56128
+        
+        I'm not sure if this is the root cause of the regression Stephanie
+        measured, but it seems to get us back to previous v8-splay times.
+        
+        SunSpider reports no change. v8-splay says 41% faster.
+
+        * runtime/Heap.cpp:
+        (JSC::Heap::reset): Make marking proportional to 1X the size of the heap,
+        not .5X the size of the heap. When the heap is large, this makes a big
+        difference. (Our old heap growth policy matched this. You can see by
+        looking at resizeBlocks in revisions prior to r77699.)
+
+2011-03-29  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Use per-configuration vsprops in JavaScriptCore to avoid WebKitVSPropsRedirectionDir removal by MSVC IDE
+        https://bugs.webkit.org/show_bug.cgi?id=57350
+        
+        Visual Studio's IDE was removing instances of $(WebKitVSPropsRedirectionDir) from
+        InheritedPropertySheet rules in our vcproj files when the vcproj was edited from within
+        the IDE. To avoid this, add a separate vsprops file for each project configuration that
+        contains the required inherited property sheets.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreDebug.vsprops: Added.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreDebugAll.vsprops: Added.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreDebugCairoCFLite.vsprops: Added.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreRelease.vsprops: Added.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreReleaseCairoCFLite.vsprops: Added.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreReleaseLTCG.vsprops: Added.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreReleasePGO.vsprops: Added.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreReleasePGOOptimize.vsprops: Added.
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        * JavaScriptCore.vcproj/WTF/WTFDebug.vsprops: Added.
+        * JavaScriptCore.vcproj/WTF/WTFDebugAll.vsprops: Added.
+        * JavaScriptCore.vcproj/WTF/WTFDebugCairoCFLite.vsprops: Added.
+        * JavaScriptCore.vcproj/WTF/WTFRelease.vsprops: Added.
+        * JavaScriptCore.vcproj/WTF/WTFReleaseCairoCFLite.vsprops: Added.
+        * JavaScriptCore.vcproj/WTF/WTFReleaseLTCG.vsprops: Added.
+        * JavaScriptCore.vcproj/WTF/WTFReleasePGO.vsprops: Added.
+        * JavaScriptCore.vcproj/jsc/jsc.vcproj:
+        * JavaScriptCore.vcproj/jsc/jscDebug.vsprops: Added.
+        * JavaScriptCore.vcproj/jsc/jscDebugAll.vsprops: Added.
+        * JavaScriptCore.vcproj/jsc/jscDebugCairoCFLite.vsprops: Added.
+        * JavaScriptCore.vcproj/jsc/jscRelease.vsprops: Added.
+        * JavaScriptCore.vcproj/jsc/jscReleaseCairoCFLite.vsprops: Added.
+        * JavaScriptCore.vcproj/jsc/jscReleaseLTCG.vsprops: Added.
+        * JavaScriptCore.vcproj/jsc/jscReleasePGO.vsprops: Added.
+        * JavaScriptCore.vcproj/testapi/testapi.vcproj:
+        * JavaScriptCore.vcproj/testapi/testapiDebug.vsprops: Added.
+        * JavaScriptCore.vcproj/testapi/testapiDebugAll.vsprops: Added.
+        * JavaScriptCore.vcproj/testapi/testapiDebugCairoCFLite.vsprops: Added.
+        * JavaScriptCore.vcproj/testapi/testapiRelease.vsprops: Added.
+        * JavaScriptCore.vcproj/testapi/testapiReleaseCairoCFLite.vsprops: Added.
+        * JavaScriptCore.vcproj/testapi/testapiReleaseLTCG.vsprops: Added.
+
+2011-03-29  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        REGRESSION(r82173): Causes assertion and test failures in run-javascriptcore-tests on Windows (Requested by aroben on #webkit).
+        https://bugs.webkit.org/show_bug.cgi?id=57333
+
+        constructDate now takes the global object explicitly as it may be called
+        by functions other than the constructor itself.
+
+        * API/JSObjectRef.cpp:
+        (JSObjectMakeDate):
+        * runtime/DateConstructor.cpp:
+        (JSC::constructDate):
+        (JSC::constructWithDateConstructor):
+        * runtime/DateConstructor.h:
+
+2011-03-29  Ben Taylor  <bentaylor.solx86@gmail.com>
+
+        Reviewed by Benjamin Poulain.
+
+        https://bugs.webkit.org/show_bug.cgi?id=41953
+
+        Fix compile error on Solaris 10/Sun Studio 12 CC emanating from MathExtras.h
+
+        * wtf/MathExtras.h:
+
+2011-03-29  Ben Taylor  <bentaylor.solx86@gmail.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=57231
+        Add conditional for SUNCC supporting alignment macros
+
+        Compile fix for Solaris 10/Sun Studio 12 CC
+
+        * wtf/Vector.h:
+
+2011-03-29  Ben Taylor  <bentaylor.solx86@gmail.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=57256
+
+        Fix crash on misaligned reads on Solaris 10/Sparc
+
+        * wtf/text/AtomicString.cpp:
+        (WTF::equal):
+
+2011-03-28  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        instanceof Array test fails when using iframes
+        https://bugs.webkit.org/show_bug.cgi?id=17250
+
+        This is a problem with all built in constructors, the use of
+        lexicalGlobalObject rather than the constructors own 
+        global object reference means that a builtin will always use
+        the prototype from the lexical global object rather than that
+        of the constructors origin.
+
+        * API/JSObjectRef.cpp:
+        (JSObjectMakeFunction):
+        (JSObjectMakeRegExp):
+        * JavaScriptCore.exp:
+        * runtime/ArrayConstructor.cpp:
+        (JSC::constructArrayWithSizeQuirk):
+        * runtime/BooleanConstructor.cpp:
+        (JSC::constructBoolean):
+        (JSC::constructBooleanFromImmediateBoolean):
+        * runtime/BooleanConstructor.h:
+        * runtime/DateConstructor.cpp:
+        (JSC::constructDate):
+        * runtime/DateInstance.cpp:
+        * runtime/DateInstance.h:
+        * runtime/ErrorConstructor.cpp:
+        (JSC::constructWithErrorConstructor):
+        (JSC::callErrorConstructor):
+        * runtime/FunctionConstructor.cpp:
+        (JSC::constructWithFunctionConstructor):
+        (JSC::callFunctionConstructor):
+        (JSC::constructFunction):
+        * runtime/FunctionConstructor.h:
+        * runtime/JSCell.cpp:
+        (JSC::JSCell::getOwnPropertySlot):
+        (JSC::JSCell::put):
+        (JSC::JSCell::deleteProperty):
+        (JSC::JSCell::toThisObject):
+        (JSC::JSCell::toObject):
+        * runtime/JSCell.h:
+        (JSC::JSCell::JSValue::toObject):
+        * runtime/JSNotAnObject.cpp:
+        (JSC::JSNotAnObject::toObject):
+        * runtime/JSNotAnObject.h:
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::toObject):
+        * runtime/JSObject.h:
+        * runtime/JSString.cpp:
+        (JSC::StringObject::create):
+        (JSC::JSString::toObject):
+        (JSC::JSString::toThisObject):
+        * runtime/JSString.h:
+        * runtime/JSValue.cpp:
+        (JSC::JSValue::toObjectSlowCase):
+        (JSC::JSValue::toThisObjectSlowCase):
+        (JSC::JSValue::synthesizeObject):
+        * runtime/JSValue.h:
+        * runtime/NumberConstructor.cpp:
+        (JSC::constructWithNumberConstructor):
+        * runtime/NumberObject.cpp:
+        (JSC::constructNumber):
+        * runtime/NumberObject.h:
+        * runtime/ObjectConstructor.cpp:
+        (JSC::constructObject):
+        (JSC::constructWithObjectConstructor):
+        (JSC::callObjectConstructor):
+        * runtime/RegExpConstructor.cpp:
+        (JSC::constructRegExp):
+        (JSC::constructWithRegExpConstructor):
+        (JSC::callRegExpConstructor):
+        * runtime/RegExpConstructor.h:
+        * runtime/StringConstructor.cpp:
+        (JSC::constructWithStringConstructor):
+        * runtime/StringObject.h:
+
+2011-03-28  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        REGRESSION [r78794-r79249] Allocation of memory is slow when number of active objects is large
+        https://bugs.webkit.org/show_bug.cgi?id=56823
+        
+        Partial fix for most of the problem. (TOT still shows a regression, though.)
+
+        * runtime/Heap.cpp:
+        (JSC::Heap::reportExtraMemoryCostSlowCase): Use highWaterMark(), instead of
+        capacity(), since capacity() is O(n) relative to the size of the heap.
+
+        In limited circumstances, capacity() is also worse than highWaterMark()
+        for measuring extra cost relative to heap size, since capacity() only
+        measures the *current* capacity of the heap, but the heap will grow if
+        necessary to attain highWaterMark().
+
+2011-03-28  Oliver Hunt  <oliver@apple.com>
+
+        REGRESSION(r82130): It made all tests crash (Requested by Ossy on #webkit).
+        https://bugs.webkit.org/show_bug.cgi?id=57251
+
+        Build fix, had remnant of another patch in r82130
+
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::privateCompileGetByIdChainList):
+
+2011-03-27  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Add additional immediate types to allow us to distinguish the source of a JIT immediate
+        https://bugs.webkit.org/show_bug.cgi?id=57190
+
+        Allow us to distinguish whether a JIT immediate is a value that we
+        control (TrustedImm32 and TrustedImmPtr) vs. ones that can be controlled
+        or influenced by code we are compiling.  Currently we do nothing with this
+        information -- this change is large and mechanical but would obscure any
+        logic changes that we would have made.
+
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::AbstractMacroAssembler::TrustedImmPtr::TrustedImmPtr):
+        (JSC::AbstractMacroAssembler::ImmPtr::ImmPtr):
+        (JSC::AbstractMacroAssembler::TrustedImm32::TrustedImm32):
+        (JSC::AbstractMacroAssembler::Imm32::Imm32):
+        * assembler/MacroAssembler.h:
+        (JSC::MacroAssembler::pop):
+        (JSC::MacroAssembler::poke):
+        (JSC::MacroAssembler::branchPtr):
+        (JSC::MacroAssembler::branch32):
+        (JSC::MacroAssembler::addPtr):
+        (JSC::MacroAssembler::andPtr):
+        (JSC::MacroAssembler::orPtr):
+        (JSC::MacroAssembler::subPtr):
+        (JSC::MacroAssembler::xorPtr):
+        (JSC::MacroAssembler::setPtr):
+        (JSC::MacroAssembler::storePtr):
+        (JSC::MacroAssembler::branchTestPtr):
+        (JSC::MacroAssembler::branchSubPtr):
+        (JSC::MacroAssembler::branchTest8):
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::add32):
+        (JSC::MacroAssemblerARM::and32):
+        (JSC::MacroAssemblerARM::lshift32):
+        (JSC::MacroAssemblerARM::mul32):
+        (JSC::MacroAssemblerARM::or32):
+        (JSC::MacroAssemblerARM::rshift32):
+        (JSC::MacroAssemblerARM::urshift32):
+        (JSC::MacroAssemblerARM::sub32):
+        (JSC::MacroAssemblerARM::xor32):
+        (JSC::MacroAssemblerARM::store32):
+        (JSC::MacroAssemblerARM::push):
+        (JSC::MacroAssemblerARM::move):
+        (JSC::MacroAssemblerARM::branch8):
+        (JSC::MacroAssemblerARM::branch32):
+        (JSC::MacroAssemblerARM::branch32WithUnalignedHalfWords):
+        (JSC::MacroAssemblerARM::branch16):
+        (JSC::MacroAssemblerARM::branchTest8):
+        (JSC::MacroAssemblerARM::branchTest32):
+        (JSC::MacroAssemblerARM::branchAdd32):
+        (JSC::MacroAssemblerARM::branchMul32):
+        (JSC::MacroAssemblerARM::branchSub32):
+        (JSC::MacroAssemblerARM::set32Compare32):
+        (JSC::MacroAssemblerARM::set8Compare32):
+        (JSC::MacroAssemblerARM::set32Test32):
+        (JSC::MacroAssemblerARM::set32Test8):
+        (JSC::MacroAssemblerARM::moveWithPatch):
+        (JSC::MacroAssemblerARM::branchPtrWithPatch):
+        (JSC::MacroAssemblerARM::storePtrWithPatch):
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::add32):
+        (JSC::MacroAssemblerARMv7::and32):
+        (JSC::MacroAssemblerARMv7::lshift32):
+        (JSC::MacroAssemblerARMv7::mul32):
+        (JSC::MacroAssemblerARMv7::or32):
+        (JSC::MacroAssemblerARMv7::rshift32):
+        (JSC::MacroAssemblerARMv7::urshift32):
+        (JSC::MacroAssemblerARMv7::sub32):
+        (JSC::MacroAssemblerARMv7::xor32):
+        (JSC::MacroAssemblerARMv7::load32):
+        (JSC::MacroAssemblerARMv7::load32WithAddressOffsetPatch):
+        (JSC::MacroAssemblerARMv7::load16):
+        (JSC::MacroAssemblerARMv7::store32WithAddressOffsetPatch):
+        (JSC::MacroAssemblerARMv7::store32):
+        (JSC::MacroAssemblerARMv7::loadDouble):
+        (JSC::MacroAssemblerARMv7::storeDouble):
+        (JSC::MacroAssemblerARMv7::push):
+        (JSC::MacroAssemblerARMv7::move):
+        (JSC::MacroAssemblerARMv7::compare32):
+        (JSC::MacroAssemblerARMv7::test32):
+        (JSC::MacroAssemblerARMv7::branch32):
+        (JSC::MacroAssemblerARMv7::branch32WithUnalignedHalfWords):
+        (JSC::MacroAssemblerARMv7::branch16):
+        (JSC::MacroAssemblerARMv7::branch8):
+        (JSC::MacroAssemblerARMv7::branchTest32):
+        (JSC::MacroAssemblerARMv7::branchTest8):
+        (JSC::MacroAssemblerARMv7::branchAdd32):
+        (JSC::MacroAssemblerARMv7::branchMul32):
+        (JSC::MacroAssemblerARMv7::branchSub32):
+        (JSC::MacroAssemblerARMv7::nearCall):
+        (JSC::MacroAssemblerARMv7::call):
+        (JSC::MacroAssemblerARMv7::set32Compare32):
+        (JSC::MacroAssemblerARMv7::set8Compare32):
+        (JSC::MacroAssemblerARMv7::set32Test32):
+        (JSC::MacroAssemblerARMv7::set32Test8):
+        (JSC::MacroAssemblerARMv7::moveWithPatch):
+        (JSC::MacroAssemblerARMv7::branchPtrWithPatch):
+        (JSC::MacroAssemblerARMv7::storePtrWithPatch):
+        (JSC::MacroAssemblerARMv7::tailRecursiveCall):
+        (JSC::MacroAssemblerARMv7::makeJump):
+        (JSC::MacroAssemblerARMv7::makeBranch):
+        (JSC::MacroAssemblerARMv7::setupArmAddress):
+        (JSC::MacroAssemblerARMv7::makeBaseIndexBase):
+        (JSC::MacroAssemblerARMv7::moveFixedWidthEncoding):
+        * assembler/MacroAssemblerMIPS.h:
+        (JSC::MacroAssemblerMIPS::add32):
+        (JSC::MacroAssemblerMIPS::and32):
+        (JSC::MacroAssemblerMIPS::lshift32):
+        (JSC::MacroAssemblerMIPS::mul32):
+        (JSC::MacroAssemblerMIPS::or32):
+        (JSC::MacroAssemblerMIPS::rshift32):
+        (JSC::MacroAssemblerMIPS::urshift32):
+        (JSC::MacroAssemblerMIPS::sub32):
+        (JSC::MacroAssemblerMIPS::xor32):
+        (JSC::MacroAssemblerMIPS::load32):
+        (JSC::MacroAssemblerMIPS::load32WithAddressOffsetPatch):
+        (JSC::MacroAssemblerMIPS::store32WithAddressOffsetPatch):
+        (JSC::MacroAssemblerMIPS::store32):
+        (JSC::MacroAssemblerMIPS::push):
+        (JSC::MacroAssemblerMIPS::move):
+        (JSC::MacroAssemblerMIPS::branch8):
+        (JSC::MacroAssemblerMIPS::branch32):
+        (JSC::MacroAssemblerMIPS::branch32WithUnalignedHalfWords):
+        (JSC::MacroAssemblerMIPS::branch16):
+        (JSC::MacroAssemblerMIPS::branchTest32):
+        (JSC::MacroAssemblerMIPS::branchTest8):
+        (JSC::MacroAssemblerMIPS::branchAdd32):
+        (JSC::MacroAssemblerMIPS::branchMul32):
+        (JSC::MacroAssemblerMIPS::branchSub32):
+        (JSC::MacroAssemblerMIPS::set8Compare32):
+        (JSC::MacroAssemblerMIPS::set32Compare32):
+        (JSC::MacroAssemblerMIPS::set32Test8):
+        (JSC::MacroAssemblerMIPS::set32Test32):
+        (JSC::MacroAssemblerMIPS::moveWithPatch):
+        (JSC::MacroAssemblerMIPS::branchPtrWithPatch):
+        (JSC::MacroAssemblerMIPS::storePtrWithPatch):
+        (JSC::MacroAssemblerMIPS::tailRecursiveCall):
+        (JSC::MacroAssemblerMIPS::loadDouble):
+        (JSC::MacroAssemblerMIPS::storeDouble):
+        (JSC::MacroAssemblerMIPS::branchTruncateDoubleToInt32):
+        * assembler/MacroAssemblerX86.h:
+        (JSC::MacroAssemblerX86::add32):
+        (JSC::MacroAssemblerX86::addWithCarry32):
+        (JSC::MacroAssemblerX86::and32):
+        (JSC::MacroAssemblerX86::or32):
+        (JSC::MacroAssemblerX86::sub32):
+        (JSC::MacroAssemblerX86::store32):
+        (JSC::MacroAssemblerX86::branch32):
+        (JSC::MacroAssemblerX86::moveWithPatch):
+        (JSC::MacroAssemblerX86::branchPtrWithPatch):
+        (JSC::MacroAssemblerX86::storePtrWithPatch):
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::add32):
+        (JSC::MacroAssemblerX86Common::and32):
+        (JSC::MacroAssemblerX86Common::lshift32):
+        (JSC::MacroAssemblerX86Common::mul32):
+        (JSC::MacroAssemblerX86Common::or32):
+        (JSC::MacroAssemblerX86Common::rshift32):
+        (JSC::MacroAssemblerX86Common::urshift32):
+        (JSC::MacroAssemblerX86Common::sub32):
+        (JSC::MacroAssemblerX86Common::xor32):
+        (JSC::MacroAssemblerX86Common::store32):
+        (JSC::MacroAssemblerX86Common::branchTruncateDoubleToInt32):
+        (JSC::MacroAssemblerX86Common::push):
+        (JSC::MacroAssemblerX86Common::move):
+        (JSC::MacroAssemblerX86Common::branch8):
+        (JSC::MacroAssemblerX86Common::branch32):
+        (JSC::MacroAssemblerX86Common::branch32WithUnalignedHalfWords):
+        (JSC::MacroAssemblerX86Common::branch16):
+        (JSC::MacroAssemblerX86Common::branchTest32):
+        (JSC::MacroAssemblerX86Common::branchTest8):
+        (JSC::MacroAssemblerX86Common::branchAdd32):
+        (JSC::MacroAssemblerX86Common::branchMul32):
+        (JSC::MacroAssemblerX86Common::branchSub32):
+        (JSC::MacroAssemblerX86Common::set8Compare32):
+        (JSC::MacroAssemblerX86Common::set32Compare32):
+        (JSC::MacroAssemblerX86Common::set32Test8):
+        (JSC::MacroAssemblerX86Common::set32Test32):
+        * assembler/MacroAssemblerX86_64.h:
+        (JSC::MacroAssemblerX86_64::add32):
+        (JSC::MacroAssemblerX86_64::and32):
+        (JSC::MacroAssemblerX86_64::or32):
+        (JSC::MacroAssemblerX86_64::sub32):
+        (JSC::MacroAssemblerX86_64::loadDouble):
+        (JSC::MacroAssemblerX86_64::addDouble):
+        (JSC::MacroAssemblerX86_64::convertInt32ToDouble):
+        (JSC::MacroAssemblerX86_64::store32):
+        (JSC::MacroAssemblerX86_64::call):
+        (JSC::MacroAssemblerX86_64::tailRecursiveCall):
+        (JSC::MacroAssemblerX86_64::makeTailRecursiveCall):
+        (JSC::MacroAssemblerX86_64::addPtr):
+        (JSC::MacroAssemblerX86_64::andPtr):
+        (JSC::MacroAssemblerX86_64::orPtr):
+        (JSC::MacroAssemblerX86_64::subPtr):
+        (JSC::MacroAssemblerX86_64::xorPtr):
+        (JSC::MacroAssemblerX86_64::storePtr):
+        (JSC::MacroAssemblerX86_64::setPtr):
+        (JSC::MacroAssemblerX86_64::branchPtr):
+        (JSC::MacroAssemblerX86_64::branchTestPtr):
+        (JSC::MacroAssemblerX86_64::branchSubPtr):
+        (JSC::MacroAssemblerX86_64::moveWithPatch):
+        (JSC::MacroAssemblerX86_64::branchPtrWithPatch):
+        (JSC::MacroAssemblerX86_64::storePtrWithPatch):
+        (JSC::MacroAssemblerX86_64::branchTest8):
+        * dfg/DFGJITCodeGenerator.h:
+        (JSC::DFG::JITCodeGenerator::callOperation):
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::jitAssertIsInt32):
+        (JSC::DFG::JITCompiler::emitCount):
+        * dfg/DFGJITCompiler.h:
+        (JSC::DFG::JITCompiler::emitPutImmediateToCallFrameHeader):
+        * dfg/DFGNonSpeculativeJIT.cpp:
+        (JSC::DFG::NonSpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * jit/JIT.cpp:
+        (JSC::JIT::emitTimeoutCheck):
+        (JSC::JIT::privateCompile):
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_urshift):
+        (JSC::JIT::emitSlow_op_urshift):
+        (JSC::JIT::emit_op_post_inc):
+        (JSC::JIT::emit_op_post_dec):
+        (JSC::JIT::emit_op_pre_inc):
+        (JSC::JIT::emit_op_pre_dec):
+        (JSC::JIT::emit_op_mod):
+        * jit/JITArithmetic32_64.cpp:
+        (JSC::JIT::emit_op_negate):
+        (JSC::JIT::emit_op_jnless):
+        (JSC::JIT::emit_op_jless):
+        (JSC::JIT::emit_op_jlesseq):
+        (JSC::JIT::emit_op_lshift):
+        (JSC::JIT::emitRightShift):
+        (JSC::JIT::emitRightShiftSlowCase):
+        (JSC::JIT::emit_op_bitand):
+        (JSC::JIT::emit_op_bitor):
+        (JSC::JIT::emit_op_bitxor):
+        (JSC::JIT::emit_op_bitnot):
+        (JSC::JIT::emit_op_post_inc):
+        (JSC::JIT::emit_op_post_dec):
+        (JSC::JIT::emitSlow_op_post_dec):
+        (JSC::JIT::emit_op_pre_inc):
+        (JSC::JIT::emit_op_pre_dec):
+        (JSC::JIT::emit_op_add):
+        (JSC::JIT::emitAdd32Constant):
+        (JSC::JIT::emit_op_sub):
+        (JSC::JIT::emitSub32Constant):
+        (JSC::JIT::emitBinaryDoubleOp):
+        (JSC::JIT::emit_op_mul):
+        (JSC::JIT::emitSlow_op_mul):
+        (JSC::JIT::emit_op_div):
+        (JSC::JIT::emit_op_mod):
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCallVarargs):
+        (JSC::JIT::compileOpCall):
+        (JSC::JIT::compileOpCallSlowCase):
+        * jit/JITCall32_64.cpp:
+        (JSC::JIT::compileOpCallVarargs):
+        (JSC::JIT::emit_op_ret_object_or_this):
+        (JSC::JIT::compileOpCall):
+        (JSC::JIT::compileOpCallSlowCase):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitPutCellToCallFrameHeader):
+        (JSC::JIT::emitPutIntToCallFrameHeader):
+        (JSC::JIT::emitPutImmediateToCallFrameHeader):
+        (JSC::JIT::emitLoadCharacterString):
+        (JSC::JIT::restoreArgumentReferenceForTrampoline):
+        (JSC::JIT::checkStructure):
+        (JSC::JIT::setSamplingFlag):
+        (JSC::JIT::clearSamplingFlag):
+        (JSC::JIT::emitCount):
+        (JSC::JIT::sampleInstruction):
+        (JSC::JIT::sampleCodeBlock):
+        (JSC::JIT::emitStoreInt32):
+        (JSC::JIT::emitStoreCell):
+        (JSC::JIT::emitStoreBool):
+        (JSC::JIT::emitJumpSlowCaseIfNotJSCell):
+        (JSC::JIT::emitInitRegister):
+        (JSC::JIT::emitJumpIfJSCell):
+        (JSC::JIT::emitJumpIfNotJSCell):
+        (JSC::JIT::emitJumpIfImmediateInteger):
+        (JSC::JIT::emitJumpIfNotImmediateInteger):
+        (JSC::JIT::emitFastArithDeTagImmediate):
+        (JSC::JIT::emitFastArithDeTagImmediateJumpIfZero):
+        (JSC::JIT::emitFastArithReTagImmediate):
+        (JSC::JIT::emitTagAsBoolImmediate):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        (JSC::JIT::privateCompileCTINativeCall):
+        (JSC::JIT::emit_op_check_has_instance):
+        (JSC::JIT::emit_op_instanceof):
+        (JSC::JIT::emit_op_ret_object_or_this):
+        (JSC::JIT::emit_op_resolve):
+        (JSC::JIT::emit_op_to_primitive):
+        (JSC::JIT::emit_op_resolve_base):
+        (JSC::JIT::emit_op_ensure_property_exists):
+        (JSC::JIT::emit_op_resolve_skip):
+        (JSC::JIT::emit_op_resolve_global):
+        (JSC::JIT::emitSlow_op_resolve_global):
+        (JSC::JIT::emit_op_not):
+        (JSC::JIT::emit_op_jfalse):
+        (JSC::JIT::emit_op_jeq_null):
+        (JSC::JIT::emit_op_jneq_null):
+        (JSC::JIT::emit_op_jneq_ptr):
+        (JSC::JIT::emit_op_jsr):
+        (JSC::JIT::emit_op_resolve_with_base):
+        (JSC::JIT::emit_op_new_func_exp):
+        (JSC::JIT::emit_op_jtrue):
+        (JSC::JIT::emit_op_get_pnames):
+        (JSC::JIT::emit_op_next_pname):
+        (JSC::JIT::emit_op_to_jsnumber):
+        (JSC::JIT::emit_op_push_new_scope):
+        (JSC::JIT::emit_op_catch):
+        (JSC::JIT::emit_op_eq_null):
+        (JSC::JIT::emit_op_neq_null):
+        (JSC::JIT::emit_op_init_lazy_reg):
+        (JSC::JIT::emit_op_convert_this):
+        (JSC::JIT::emit_op_convert_this_strict):
+        (JSC::JIT::emitSlow_op_not):
+        (JSC::JIT::emitSlow_op_neq):
+        (JSC::JIT::emit_op_get_arguments_length):
+        (JSC::JIT::emitSlow_op_get_arguments_length):
+        (JSC::JIT::emit_op_get_argument_by_val):
+        (JSC::JIT::emitSlow_op_resolve_global_dynamic):
+        (JSC::JIT::emit_op_new_regexp):
+        (JSC::JIT::emit_op_load_varargs):
+        (JSC::JIT::emitSlow_op_load_varargs):
+        (JSC::JIT::emit_op_new_func):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        (JSC::JIT::privateCompileCTINativeCall):
+        (JSC::JIT::emit_op_loop_if_lesseq):
+        (JSC::JIT::emit_op_check_has_instance):
+        (JSC::JIT::emit_op_instanceof):
+        (JSC::JIT::emit_op_get_scoped_var):
+        (JSC::JIT::emit_op_put_scoped_var):
+        (JSC::JIT::emit_op_tear_off_activation):
+        (JSC::JIT::emit_op_tear_off_arguments):
+        (JSC::JIT::emit_op_resolve):
+        (JSC::JIT::emit_op_to_primitive):
+        (JSC::JIT::emit_op_resolve_base):
+        (JSC::JIT::emit_op_ensure_property_exists):
+        (JSC::JIT::emit_op_resolve_skip):
+        (JSC::JIT::emit_op_resolve_global):
+        (JSC::JIT::emitSlow_op_resolve_global):
+        (JSC::JIT::emit_op_not):
+        (JSC::JIT::emit_op_jfalse):
+        (JSC::JIT::emit_op_jtrue):
+        (JSC::JIT::emit_op_jeq_null):
+        (JSC::JIT::emit_op_jneq_null):
+        (JSC::JIT::emit_op_jneq_ptr):
+        (JSC::JIT::emit_op_jsr):
+        (JSC::JIT::emit_op_eq):
+        (JSC::JIT::emitSlow_op_eq):
+        (JSC::JIT::emit_op_neq):
+        (JSC::JIT::emitSlow_op_neq):
+        (JSC::JIT::compileOpStrictEq):
+        (JSC::JIT::emit_op_eq_null):
+        (JSC::JIT::emit_op_neq_null):
+        (JSC::JIT::emit_op_resolve_with_base):
+        (JSC::JIT::emit_op_new_func_exp):
+        (JSC::JIT::emit_op_get_pnames):
+        (JSC::JIT::emit_op_next_pname):
+        (JSC::JIT::emit_op_to_jsnumber):
+        (JSC::JIT::emit_op_push_new_scope):
+        (JSC::JIT::emit_op_catch):
+        (JSC::JIT::emit_op_create_activation):
+        (JSC::JIT::emit_op_create_arguments):
+        (JSC::JIT::emit_op_convert_this):
+        (JSC::JIT::emit_op_convert_this_strict):
+        (JSC::JIT::emit_op_get_arguments_length):
+        (JSC::JIT::emitSlow_op_get_arguments_length):
+        (JSC::JIT::emit_op_get_argument_by_val):
+        (JSC::JIT::softModulo):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::stringGetByValStubGenerator):
+        (JSC::JIT::emit_op_get_by_val):
+        (JSC::JIT::emitSlow_op_get_by_val):
+        (JSC::JIT::emit_op_get_by_pname):
+        (JSC::JIT::emit_op_put_by_val):
+        (JSC::JIT::emit_op_put_by_index):
+        (JSC::JIT::emit_op_put_getter):
+        (JSC::JIT::emit_op_put_setter):
+        (JSC::JIT::emit_op_del_by_id):
+        (JSC::JIT::emit_op_get_by_id):
+        (JSC::JIT::emit_op_put_by_id):
+        (JSC::JIT::emit_op_method_check):
+        (JSC::JIT::compileGetByIdHotPath):
+        (JSC::JIT::compileGetByIdSlowCase):
+        (JSC::JIT::emitSlow_op_put_by_id):
+        (JSC::JIT::testPrototype):
+        (JSC::JIT::privateCompilePutByIdTransition):
+        (JSC::JIT::privateCompilePatchGetArrayLength):
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdSelfList):
+        (JSC::JIT::privateCompileGetByIdProtoList):
+        (JSC::JIT::privateCompileGetByIdChainList):
+        (JSC::JIT::privateCompileGetByIdChain):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::emit_op_put_getter):
+        (JSC::JIT::emit_op_put_setter):
+        (JSC::JIT::emit_op_del_by_id):
+        (JSC::JIT::emit_op_get_by_id):
+        (JSC::JIT::emit_op_put_by_id):
+        (JSC::JIT::emit_op_method_check):
+        (JSC::JIT::stringGetByValStubGenerator):
+        (JSC::JIT::emit_op_get_by_val):
+        (JSC::JIT::emitSlow_op_get_by_val):
+        (JSC::JIT::emit_op_put_by_val):
+        (JSC::JIT::compileGetByIdHotPath):
+        (JSC::JIT::compileGetByIdSlowCase):
+        (JSC::JIT::emitSlow_op_put_by_id):
+        (JSC::JIT::testPrototype):
+        (JSC::JIT::privateCompilePutByIdTransition):
+        (JSC::JIT::privateCompilePatchGetArrayLength):
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdSelfList):
+        (JSC::JIT::privateCompileGetByIdProtoList):
+        (JSC::JIT::privateCompileGetByIdChainList):
+        (JSC::JIT::privateCompileGetByIdChain):
+        (JSC::JIT::emit_op_get_by_pname):
+        * jit/JITStubCall.h:
+        (JSC::JITStubCall::addArgument):
+        * jit/JITStubs.cpp:
+        (JSC::getPolymorphicAccessStructureListSlot):
+        (JSC::DEFINE_STUB_FUNCTION):
+        * jit/JSInterfaceJIT.h:
+        (JSC::JSInterfaceJIT::emitJumpIfNotJSCell):
+        (JSC::JSInterfaceJIT::emitLoadInt32):
+        (JSC::JSInterfaceJIT::emitLoadDouble):
+        * jit/SpecializedThunkJIT.h:
+        (JSC::SpecializedThunkJIT::SpecializedThunkJIT):
+        (JSC::SpecializedThunkJIT::loadJSStringArgument):
+        (JSC::SpecializedThunkJIT::tagReturnAsInt32):
+        (JSC::SpecializedThunkJIT::tagReturnAsJSCell):
+        * jit/ThunkGenerators.cpp:
+        (JSC::charToString):
+        (JSC::powThunkGenerator):
+        * yarr/YarrJIT.cpp:
+        (JSC::Yarr::YarrGenerator::matchCharacterClass):
+        (JSC::Yarr::YarrGenerator::storeToFrame):
+        (JSC::Yarr::YarrGenerator::storeToFrameWithPatch):
+        (JSC::Yarr::YarrGenerator::ParenthesesTail::generateCode):
+        (JSC::Yarr::YarrGenerator::generatePatternCharacterSingle):
+        (JSC::Yarr::YarrGenerator::generatePatternCharacterFixed):
+        (JSC::Yarr::YarrGenerator::generatePatternCharacterGreedy):
+        (JSC::Yarr::YarrGenerator::generatePatternCharacterNonGreedy):
+        (JSC::Yarr::YarrGenerator::generateCharacterClassFixed):
+        (JSC::Yarr::YarrGenerator::generateCharacterClassGreedy):
+        (JSC::Yarr::YarrGenerator::generateCharacterClassNonGreedy):
+        (JSC::Yarr::YarrGenerator::generateParenthesesSingle):
+        (JSC::Yarr::YarrGenerator::generateDisjunction):
+
+2011-03-28  Andras Becsi  <abecsi@webkit.org>
+
+        Reviewed by Csaba Osztrogonác.
+
+        [Qt] Fix the linking of jsc with MinGW after r81963.
+
+        * jsc.pro: add -l and remove the lib suffix.
+
+2011-03-27  Ben Taylor  <bentaylor.solx86@gmail.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=57170  Fix last elements
+        in an enum to remove a trailing comma. Sun Studio 12 CC errors out.
+
+        Compile fix only, no actual code change.
+
+        * wtf/MessageQueue.h:
+
+2011-03-25  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Allow defineOwnProperty to work on DOMObjects
+        https://bugs.webkit.org/show_bug.cgi?id=57129
+
+        Fix a couple of places where we uses getter()/setter() rather
+        than [gs]etterPresent().
+
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::defineOwnProperty):
+
+2011-03-25  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Crash when paused at a breakpoint caused by inaccurate Activation records.
+        https://bugs.webkit.org/show_bug.cgi?id=57120
+
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::symbolTableGet):
+        (JSC::JSActivation::symbolTablePut):
+        (JSC::JSActivation::getOwnPropertyNames):
+        (JSC::JSActivation::symbolTablePutWithAttributes):
+
+2011-03-24  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Crash in debugger beneath MarkStack::drain @ me.com, ibm.com
+        https://bugs.webkit.org/show_bug.cgi?id=57080
+        <rdar://problem/8525907>
+
+        The crash was caused by changes in the executable after recompilation.
+
+        The fix is for the activation to copy the data it needs instead of
+        relying on the data in the executable.
+        
+        SunSpider and v8 report no change.
+
+        * runtime/Arguments.h:
+        (JSC::JSActivation::copyRegisters): Use our own data members instead of
+        reading data out of the executable.
+
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::JSActivation): Initialize our data members.
+
+        (JSC::JSActivation::markChildren):
+        (JSC::JSActivation::symbolTableGet):
+        (JSC::JSActivation::symbolTablePut):
+        (JSC::JSActivation::getOwnPropertyNames):
+        (JSC::JSActivation::symbolTablePutWithAttributes):
+        (JSC::JSActivation::isDynamicScope):
+        (JSC::JSActivation::argumentsGetter): Use our own data members instead of
+        reading data out of the executable.
+
+        * runtime/JSActivation.h: Added new data members to track data previously
+        tracked by the executable. Since I've removed the executable pointer,
+        on a 64bit system, I've only made activations bigger by an int.
+
+2011-03-25  David Kilzer  <ddkilzer@apple.com>
+
+        Remove duplicate entry from JavaScriptCore.exp
+
+        JSC::createStackOverflowError(JSC::ExecState*) was originally
+        exported in r60057, then duplicated in r60392.
+
+        * JavaScriptCore.exp: Removed duplicate entry.
+
+2011-03-25  Jarred Nicholls  <jarred@sencha.com>
+
+        Reviewed by Ariya Hidayat.
+
+        [Qt] MSVC Build Error - need to link advapi32.lib for jsc.exe
+        https://bugs.webkit.org/show_bug.cgi?id=56098
+
+        Need to link advapi32.lib for jsc.exe since wtf/OSRandomSource.cpp uses the Win32 Crypto API
+
+        * jsc.pro:
+
+2011-03-24  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Darin Adler.
+
+        Introduce WTF HexNumber.h
+        https://bugs.webkit.org/show_bug.cgi?id=56099
+
+        Introduce a set of functions that ease converting from a bye or a number to a hex string,
+        replacing several of these conversions and String::format("%x") usages all over WebCore.
+
+        * GNUmakefile.am: Add HexNumber.h to build.
+        * JavaScriptCore.exp: Export StringBuilder::reserveCapacity.
+        * JavaScriptCore.gypi: Add HexNumber.h to build.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: Export StringBuilder::reserveCapacity.
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj: Add HexNumber.h to build.
+        * JavaScriptCore.xcodeproj/project.pbxproj: Ditto.
+        * wtf/CMakeLists.txt: Ditto.
+        * wtf/HexNumber.h: Added.
+        (WTF::Internal::hexDigitsForMode): Internal helper.
+        (WTF::appendByteAsHex): Free function, that appends a byte as hex string into a destination.
+        (WTF::placeByteAsHex): Ditto, but places the result using *foo++ = '..' or foo[index++] = '..'
+        (WTF::appendUnsignedAsHex): Free function, that appends a number as hex string into a destination.
+
+2011-03-24  Geoffrey Garen  <ggaren@apple.com>
+
+        Windows build fix take 2: Add new symobl.
+        
+        (I should have used the EWS bots for this!)
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2011-03-24  Geoffrey Garen  <ggaren@apple.com>
+
+        Windows build fix take 1: Removed old symobl.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2011-03-24  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Ensure that all compilation takes place within a dynamic global object scope
+        https://bugs.webkit.org/show_bug.cgi?id=57054
+        <rdar://problem/9083011>        
+
+        Otherwise, entry to the global object scope might throw away the code
+        we just compiled, causing a crash.
+
+        * JavaScriptCore.exp: Updated for signature change.
+
+        * debugger/Debugger.cpp:
+        (JSC::evaluateInGlobalCallFrame):
+        * debugger/DebuggerCallFrame.cpp:
+        (JSC::DebuggerCallFrame::evaluate): Removed explicit compilation calls
+        here because (a) they took place outside a dynamic global object scope
+        and (b) they were redundant.
+
+        * interpreter/CachedCall.h:
+        (JSC::CachedCall::CachedCall): Updated for signature change.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::execute):
+        (JSC::Interpreter::executeCall):
+        (JSC::Interpreter::executeConstruct): Declare our dynamic global object
+        scope earlier, to ensure that compilation takes place within it.
+
+        * runtime/Completion.cpp:
+        (JSC::evaluate): Removed explicit compilation calls here because (a)
+        they took place outside a dynamic global object scope and (b) they were
+        redundant.
+
+        * runtime/Executable.h:
+        (JSC::EvalExecutable::compile):
+        (JSC::ProgramExecutable::compile):
+        (JSC::FunctionExecutable::compileForCall):
+        (JSC::FunctionExecutable::compileForConstruct): Added an ASSERT to
+        verify our new invariant that all compilation takes place within a
+        dynamic global object scope.
+
+        * runtime/JSGlobalObject.cpp:
+        (JSC::DynamicGlobalObjectScope::DynamicGlobalObjectScope):
+        * runtime/JSGlobalObject.h: Changed the signature of DynamicGlobalObjectScope
+        to require a JSGlobalData instead of an ExecState* since it is often
+        easier to provide the former, and the latter was not necessary.
+
+2011-03-24  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        REGRESSION (r79987-r80210): Crash in JSWeakObjectMapClear
+        https://bugs.webkit.org/show_bug.cgi?id=55671
+
+        This is no longer necessary, and it seems that with the new weakmap
+        model it's simply unsafe, so this reduces it to a no-op. 
+
+        * API/JSWeakObjectMapRefPrivate.cpp:
+
+2011-03-24  Ben Taylor  <bentaylor.solx86@gmail.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=20302
+        Correct implementation of signbit on Solaris
+
+        * wtf/MathExtras.h:
+        (signbit):
+
+2011-03-23  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/7959320> Threads that use APIs above the BSD layer must be registered with the Obj-C GC.
+
+        * wtf/ThreadingPthreads.cpp:
+        (WTF::initializeCurrentThreadInternal):
+
+2011-03-23  Mark Rowe  <mrowe@apple.com>
+
+        Stop setting OTHER_OPTIONS in JavaScriptCore's Makefile.
+
+        It's not necessary to pass "-target All" as xcodebuild always builds the
+        first target in the project unless otherwise specified. The presence of
+        that option also breaks "make clean" since that results in both the
+        -target and -alltargets options being passed to xcodebuild.
+
+        * Makefile:
+
+2011-03-23  Pavel Feldman  <pfeldman@chromium.org>
+
+        Not reviewed: bring back Vector::contains that was removed as a part of roll back.
+
+        * wtf/Vector.h:
+        (WTF::::contains):
+
+2011-03-23  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r81686.
+        http://trac.webkit.org/changeset/81686
+        https://bugs.webkit.org/show_bug.cgi?id=56914
+
+        Breaks webkit_tests in Chromium again. (Requested by pfeldman
+        on #webkit).
+
+        * wtf/Vector.h:
+
+2011-03-23  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        JavaScriptCore GYP build should work on a case-sensitive file system
+        https://bugs.webkit.org/show_bug.cgi?id=56911
+
+        The issue is that there are two UString.h headers, one named UString.h
+        and one named ustring.h.  This patch excludes ustring.h from the header
+        map to avoid confusion.  While I was editing this part of the GYP file,
+        I cleaned up the exclude rules to be more modern.
+
+        * gyp/JavaScriptCore.gyp:
+
+2011-03-22  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        REGRESSION (r78382): No scripts appear in the Web Inspector's Scripts
+        panel on Windows, and many inspector regression tests are failing
+        https://bugs.webkit.org/show_bug.cgi?id=54490
+        
+        The bug was caused by two different classes using the same name (Recompiler).
+
+        * debugger/Debugger.cpp:
+        * runtime/JSGlobalData.cpp:
+        (WTF::Recompiler::operator()): Put Recompiler in an anonymous namespace,
+        so our two recompilers' inline functions don't stomp each other at
+        link time.
+
+2011-03-22  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Mark Rowe.
+
+        Remove USE_WK_SCROLLBAR_PAINTER_AND_CONTROLLER.
+        <rdar://problem/8944718> 
+
+        * DerivedSources.make:
+        Remove generation of USE_WK_SCROLLBAR_PAINTER_AND_CONTROLLER.
+
+2011-03-22  Gabor Loki  <loki@webkit.org>
+
+        Reviewed by Csaba Osztrogonác.
+
+        [Qt] Add DFG module to build system (disabled by default).
+        https://bugs.webkit.org/show_bug.cgi?id=56845
+
+        * JavaScriptCore.pri:
+        * JavaScriptCore.pro:
+
+2011-03-22  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Add support to build-webkit for building with gyp-generated project files
+        https://bugs.webkit.org/show_bug.cgi?id=56877
+
+        Found a couple missing Private headers while trying to make WebCore build.
+
+        * JavaScriptCore.gypi:
+
+2011-03-22  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Make it possible to build JavaScriptCore and WebCore gyp builds outside of Source
+        https://bugs.webkit.org/show_bug.cgi?id=56867
+
+        This should make it possible to build the gyp-generated JavaScriptCore.xcodeproj
+        from a JavaScriptCore directory outside of Source.
+
+        * gyp/JavaScriptCore.gyp:
+        * gyp/run-if-exists.sh: Added.
+        * gyp/update-info-plist.sh: Added.
+
+2011-03-22  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Add Profiling Configuration to JavaScriptCore gyp build
+        https://bugs.webkit.org/show_bug.cgi?id=56862
+
+        It appears this is identical to Release, but I suspect
+        there is someone/thing who uses the Profiling target
+        so we're adding it for completeness.
+
+        * gyp/JavaScriptCore.gyp:
+
+2011-03-22  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Remove os_win32_files variable from the GYP build
+        https://bugs.webkit.org/show_bug.cgi?id=56804
+
+        Now that our understanding of GYP is sufficiently advanced, we don't
+        need os_win32_files any more.  (Turns out Eric was right, as he always
+        is.)
+
+        * JavaScriptCore.gypi:
+
+2011-03-22  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        GYP build of JavaScriptCore should be able to link from an empty WebKitBuild directory
+        https://bugs.webkit.org/show_bug.cgi?id=56803
+
+        Previously, we thought we should generate the derived source files in
+        the shared intermediate build products directory, but there are
+        assumptions built into other parts of the Mac build system that the
+        derived source files will be generated in a particular subdirectory of
+        the build products directory.
+
+        This patch is a partial revert of the change that moved the derived
+        source files to the shared intermediate directory.  After this patch,
+        the GYP build can build JavaScriptCore without help from the main
+        normal build system.
+
+        * JavaScriptCore.gypi:
+        * gyp/JavaScriptCore.gyp:
+        * gyp/generate-derived-sources.sh:
+        * gyp/generate-dtrace-header.sh:
+
+2011-03-22  Jay Civelli  <jcivelli@chromium.org>
+
+        Reviewed by David Levin.
+
+        Adding a contains method to Vector.
+        https://bugs.webkit.org/show_bug.cgi?id=55859
+
+        * wtf/Vector.h:
+        (WTF::Vector::contains):
+
+2011-03-22  Gabor Loki  <loki@webkit.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Fix a bunch of typos in DFG.
+        https://bugs.webkit.org/show_bug.cgi?id=56813
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::parse):
+        * dfg/DFGGenerationInfo.h:
+        (JSC::DFG::GenerationInfo::setSpilled):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::dump):
+        * dfg/DFGGraph.h:
+        * dfg/DFGJITCodeGenerator.h:
+        (JSC::DFG::JITCodeGenerator::setupStubArguments):
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::compileFunction):
+        * dfg/DFGJITCompiler.h:
+        * dfg/DFGNode.h:
+        * dfg/DFGNonSpeculativeJIT.h:
+        * dfg/DFGOperations.h:
+        * dfg/DFGRegisterBank.h:
+        (JSC::DFG::RegisterBank::allocate):
+        * dfg/DFGScoreBoard.h:
+        (JSC::DFG::ScoreBoard::~ScoreBoard):
+        (JSC::DFG::ScoreBoard::allocate):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT.h:
+
+2011-03-22  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Production configuration in GYP isn&apos;t set up correctly
+        https://bugs.webkit.org/show_bug.cgi?id=56786
+
+        Update JavaScriptCore.gyp with information mined from
+        JavaScriptCore.xcodeproj.
+
+        * JavaScriptCore.gypi:
+        * gyp/JavaScriptCore.gyp:
+
+2011-03-22  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        REGRESSION(r80096): Number type input unexpectedly rounds fractional values
+        https://bugs.webkit.org/show_bug.cgi?id=56367
+
+        Introduce clampToInteger(unsigned).
+        
+        * wtf/MathExtras.h:
+        (clampToInteger): Added.
+
+2011-03-21  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        GYP build should not have include paths that point within the source tree
+        https://bugs.webkit.org/show_bug.cgi?id=56788
+
+        Turns out we don't need these include paths anymore now that we have
+        header maps working properly.
+
+        * gyp/JavaScriptCore.gyp:
+            - Also, remove jsc.cpp from the excluded list because it's not part
+              of the jsc_files variable instead of the javascriptcore_files
+              variable.
+
+2011-03-21  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Solve the Assertions.cpp / -Wno-missing-format-attribute mystery
+        https://bugs.webkit.org/show_bug.cgi?id=56780
+
+        The reason we couldn't resolve this warning in the GYP build was that
+        the normal build disables this warning specifically for this file.
+        This patch takes the same approach as the previous patch to
+        WebCoreObjCExtras.mm in that it uses a pragma to suppress the warning
+        (rather than a build system configuration).
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+            - Remove the special-case for this file.
+        * gyp/JavaScriptCore.gyp:
+            - Remove the work-around for this issue.
+        * wtf/Assertions.cpp:
+            - Add a pragma disabling this warning for this file.
+
+2011-03-21  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        WebCore GYP build shouldn't crash on startup
+        https://bugs.webkit.org/show_bug.cgi?id=56776
+
+        Debug builds shouldn't define NDEBUG.  This same logic exists in the
+        project.pbxproj file.
+
+        * gyp/JavaScriptCore.gyp:
+
+2011-03-21  Robert Kroeger  <rjkroege@chromium.org>
+
+        Reviewed by Antonio Gomes.
+
+        Flag to enable/disable a GestureReocognizer framework
+
+        https://bugs.webkit.org/show_bug.cgi?id=49345
+
+        * wtf/Platform.h:
+
+2011-03-21  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Add new files to JavaScriptCore.gypi
+        https://bugs.webkit.org/show_bug.cgi?id=56766
+
+        * JavaScriptCore.gypi:
+
+2011-03-21  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r81377.
+        http://trac.webkit.org/changeset/81377
+        https://bugs.webkit.org/show_bug.cgi?id=56765
+
+        WebPageSerializerTest.MultipleFrames is broken (Requested by
+        simonjam on #webkit).
+
+        * wtf/Vector.h:
+
+2011-03-21  Gabor Loki  <loki@webkit.org>
+
+        Reviewed by Csaba Osztrogonác.
+
+        Extend constant pool to be able to store 16 bit instructions with a constant
+        https://bugs.webkit.org/show_bug.cgi?id=46796
+
+        The putShortWithConstantInt function inserts a 16 bit instruction which
+        refers a 32 bits constant or literal. This is a vital function for those
+        target which loads a PC relative value with a 16 bit instruction (like
+        Thumb-2 instruction set and SH4 architecture).
+
+        * assembler/AssemblerBuffer.h:
+        (JSC::AssemblerBuffer::putIntegral):
+        (JSC::AssemblerBuffer::putIntegralUnchecked):
+        * assembler/AssemblerBufferWithConstantPool.h:
+
+2011-03-21  Philippe Normand  <pnormand@igalia.com>
+
+        Unreviewed, GTK distcheck build fix.
+
+        * GNUmakefile.am:
+
+2011-03-20  Bill Budge  <bbudge@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Rename ThreadSafeShared to ThreadSafeRefCounted
+        https://bugs.webkit.org/show_bug.cgi?id=56714
+
+        No new tests. Exposes no new functionality.
+
+        * API/JSClassRef.h:
+        * API/OpaqueJSString.h:
+        * GNUmakefile.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * wtf/Atomics.h:
+        * wtf/CMakeLists.txt:
+        * wtf/CrossThreadRefCounted.h:
+        (WTF::CrossThreadRefCounted::CrossThreadRefCounted):
+        (WTF::::crossThreadCopy):
+        * wtf/ThreadSafeRefCounted.h: Copied from wtf/ThreadSafeShared.h.
+        (WTF::ThreadSafeRefCountedBase::ThreadSafeRefCountedBase):
+        (WTF::ThreadSafeRefCountedBase::ref):
+        (WTF::ThreadSafeRefCountedBase::refCount):
+        (WTF::ThreadSafeRefCountedBase::derefBase):
+        (WTF::ThreadSafeRefCounted::ThreadSafeRefCounted):
+        * wtf/ThreadSafeShared.h: Removed.
+        * wtf/Threading.h:
+
+2011-03-19  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Remove StringImpl::computeHash()
+        https://bugs.webkit.org/show_bug.cgi?id=49894
+
+        Replace remainig StringImpl::computeHash with StringImpl::computeHashStringHasher.
+
+        * wtf/text/AtomicString.cpp:
+        (WTF::CStringTranslator::hash):
+        (WTF::UCharBufferTranslator::hash):
+        (WTF::HashAndCharactersTranslator::hash):
+        * wtf/text/StringImpl.h:
+        (WTF::StringImpl::setHash):
+        (WTF::StringImpl::hash):
+
+2011-03-19  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Rename WTF::StringHasher methods
+        https://bugs.webkit.org/show_bug.cgi?id=53532
+
+        Rename createHash to computeHash and createBlobHash to hashMemory.
+        Also add a using WTF::StringHasher in the header file.
+
+        * profiler/CallIdentifier.h:
+        (JSC::CallIdentifier::Hash::hash):
+        * runtime/Identifier.cpp:
+        (JSC::IdentifierCStringTranslator::hash):
+        (JSC::IdentifierUCharBufferTranslator::hash):
+        * wtf/StringHasher.h:
+        (WTF::StringHasher::computeHash):
+        (WTF::StringHasher::hashMemory):
+        * wtf/text/StringHash.h:
+        (WTF::CaseFoldingHash::hash):
+        * wtf/text/StringImpl.h:
+        (WTF::StringImpl::computeHash):
+        * wtf/unicode/UTF8.cpp:
+        (WTF::Unicode::calculateStringHashAndLengthFromUTF8Internal):
+
+2011-03-18  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        [GTK] JSC crashes in 32bit Release bots after r80743
+        https://bugs.webkit.org/show_bug.cgi?id=56180
+        
+        The crash was caused by referencing GC memory from a GC destructor. This
+        is not safe because destruction time / order is not guaranteed.
+
+        * profiler/ProfileGenerator.cpp:
+        (JSC::ProfileGenerator::create):
+        (JSC::ProfileGenerator::ProfileGenerator):
+        (JSC::ProfileGenerator::willExecute):
+        (JSC::ProfileGenerator::didExecute):
+        * profiler/ProfileGenerator.h:
+        (JSC::ProfileGenerator::origin): Made ExecState* the first argument,
+        to match the rest of this class and JSC.
+        
+        Use a JSGlobalObject* instead of an ExecState* with an indirect reference
+        to a JSGlobalObject* to track our origin. This is simpler and more
+        efficient, and it removes the destruction order dependency that was causing
+        our crash.
+
+        * profiler/Profiler.cpp:
+        (JSC::Profiler::startProfiling): Updated for change to JSGlobalObject*.
+        (JSC::Profiler::stopProfiling): New function for stopping all profiles
+        for a given global object. This is more straight-forward than multiplexing
+        through the old function.
+
+        (JSC::dispatchFunctionToProfiles): Updated for change to JSGlobalObject*.
+        * profiler/Profiler.h: Ditto.
+
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::~JSGlobalObject): Ditto.
+
+2011-03-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        1 Structure leaked beneath JSGlobalData::storeVPtrs()
+        https://bugs.webkit.org/show_bug.cgi?id=56595
+
+        * runtime/Executable.cpp:
+        (JSC::EvalExecutable::EvalExecutable):
+        (JSC::ProgramExecutable::ProgramExecutable):
+        (JSC::FunctionExecutable::FunctionExecutable):
+        * runtime/Executable.h:
+        (JSC::ExecutableBase::ExecutableBase):
+        (JSC::NativeExecutable::NativeExecutable):
+        (JSC::VPtrHackExecutable::VPtrHackExecutable):
+        (JSC::ScriptExecutable::ScriptExecutable): Use a raw pointer instead of
+        PassRefPtr, like JSString does, since JSGlobalData owns the singleton
+        exectuable structure.
+
+2011-03-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        Fixed some string leaks seen on the buildbot
+        https://bugs.webkit.org/show_bug.cgi?id=56619
+
+        * runtime/PropertyMapHashTable.h:
+        (JSC::PropertyTable::~PropertyTable): DEref!
+
+2011-03-17  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Crash in  JSC::MarkStack::drain Under Stress
+        https://bugs.webkit.org/show_bug.cgi?id=56470
+
+        We perform a number of gc allocations while when
+        we are setting up new globals in a piece of global
+        code.  We do this by adding new properties to the
+        symbol table, and then expanding the storage to fit
+        at the end.
+
+        If a GC happens during this time we will report an
+        incorrect size for the global object's symbol table
+        storage.
+
+        This patch corrects this by growing the storage size
+        before we starting adding entries to the symbol table.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::resizeRegisters):
+
+2011-03-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        1 Structure leaked beneath JSGlobalData::storeVPtrs()
+        https://bugs.webkit.org/show_bug.cgi?id=56595
+
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::storeVPtrs): Take local ownership of the Structure
+        we're using, since the Executable is not designed to own the Structure.
+
+2011-03-17  Gavin Barraclough  <barraclough@apple.com>
+
+        Rubber Stamped by Sam Weinig.
+
+        Add missing register-register branchTest8 to MacroAssemblerX86Common/X86Assembler.
+
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::branchTest8):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::testb_rr):
+
+2011-03-17  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Bug 56603 - DFG JIT related cleanup
+        Move node generation out to separate function, move binarySearch algorithm out
+        to StdLibExtras, fix Graph::dump() to print comma between non-node children,
+        even if there are no node children.
+
+        * bytecode/CodeBlock.h:
+        (JSC::getCallReturnOffset):
+        (JSC::CodeBlock::getStubInfo):
+        (JSC::CodeBlock::getCallLinkInfo):
+        (JSC::CodeBlock::getMethodCallLinkInfo):
+        (JSC::CodeBlock::bytecodeOffset):
+            - Move binaryChop to binarySearch in StdLibExtras
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::ByteCodeParser):
+        (JSC::DFG::ByteCodeParser::parse):
+        (JSC::DFG::parse):
+            - Make m_noArithmetic a member, initialize m_currentIndex in the constructor.
+        * dfg/DFGByteCodeParser.h:
+            - Change parse() to not take a start index (always 0).
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::dump):
+            - Fix Graph::dump() to print comma between non-node children, even if there are no node children.
+        * dfg/DFGJITCodeGenerator.h:
+        (JSC::DFG::JITCodeGenerator::JITCodeGenerator):
+            - Initialize m_compileIndex in constructor.
+        * dfg/DFGNonSpeculativeJIT.cpp:
+        (JSC::DFG::NonSpeculativeJIT::compile):
+        * dfg/DFGNonSpeculativeJIT.h:
+            - Spilt out compilation of individual node.
+        * dfg/DFGOperations.cpp:
+        (JSC::DFG::operationConvertThis):
+        * dfg/DFGOperations.h:
+            - Cleanup parameter name.
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT.h:
+            - Spilt out compilation of individual node.
+        * runtime/Executable.cpp:
+        (JSC::tryDFGCompile):
+            - Change parse() to not take a start index (always 0).
+        * wtf/StdLibExtras.h:
+        (WTF::binarySearch):
+            - Move binaryChop to binarySearch in StdLibExtras
+
+2011-03-17  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Fix clang build.
+
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::storeVPtrs):
+
+2011-03-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin Adler.
+
+        1 Structure leaked beneath JSGlobalData::storeVPtrs()
+        https://bugs.webkit.org/show_bug.cgi?id=56595
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::storeVPtrs): Now that we have an executable, we need
+        to explicitly run its destructor.
+
+2011-03-17  Jeff Miller  <jeffm@apple.com>
+
+        Use a consistent set of file patterns in the svn:ignore property for all .xcodeproj directories, specifically:
+        
+        *.mode*
+        *.pbxuser
+        *.perspective*
+        project.xcworkspace
+        xcuserdata
+
+        * JavaScriptCore.xcodeproj: Modified property svn:ignore.
+
+2011-03-17  Gavin Barraclough  <barraclough@apple.com>
+
+        Reverting r81197, breaks JIT + INTERPRETER build.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::hasGlobalResolveInstructionAtBytecodeOffset):
+        (JSC::CodeBlock::hasGlobalResolveInfoAtBytecodeOffset):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::addPropertyAccessInstruction):
+        (JSC::CodeBlock::addGlobalResolveInstruction):
+        (JSC::CodeBlock::addStructureStubInfo):
+        * bytecode/Opcode.h:
+        * bytecode/StructureStubInfo.h:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitResolve):
+        (JSC::BytecodeGenerator::emitResolveWithBase):
+        (JSC::BytecodeGenerator::emitGetById):
+        (JSC::BytecodeGenerator::emitPutById):
+        (JSC::BytecodeGenerator::emitDirectPutById):
+        (JSC::BytecodeGenerator::emitCall):
+        (JSC::BytecodeGenerator::emitConstruct):
+        (JSC::BytecodeGenerator::emitCatch):
+
+2011-03-17  Ben Taylor  <bentaylor.solx86@gmail.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Add a COMPILER(SUNCC) define for Sun Studio 12. 
+        https://bugs.webkit.org/show_bug.cgi?56444
+        derived from patch 1 of 16 originally from https://bugs.webkit.org/show_bug.cgi?id=24932
+
+        * wtf/Platform.h:
+
+2011-03-17  Jay Civelli  <jcivelli@chromium.org>
+
+        Reviewed by David Levin.
+
+        Adding a contains method to Vector.
+        https://bugs.webkit.org/show_bug.cgi?id=55859
+
+        * wtf/Vector.h:
+        (WTF::::operator):
+        (WTF::::contains):
+
+2011-03-17  Patrick Gansterer  <paroga@webkit.org>
+
+        Fix the interpreter build.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute): Added globalData to inheritorID().
+
+2011-03-16  Sam Weinig  <sam@webkit.org>
+
+        Fix the interpreter build.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::resolve):
+        (JSC::Interpreter::resolveSkip):
+        (JSC::Interpreter::resolveGlobal):
+        (JSC::Interpreter::resolveGlobalDynamic):
+        (JSC::Interpreter::resolveBaseAndProperty):
+        (JSC::Interpreter::privateExecute):
+        Remove .get()s.
+
+2011-03-16  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by James Robinson.
+
+        Remove USE(BUILTIN_UTF8_CODEC)
+        https://bugs.webkit.org/show_bug.cgi?id=56508
+
+        We added this recently when we were unsure about the stability of the
+        built-in UTF-8 codec.  However, the codec seems to be stable, so we
+        don't need the macro.
+
+        * wtf/Platform.h:
+
+2011-03-16  Daniel Bates  <dbates@rim.com>
+
+        Reviewed by Darin Adler.
+
+        Make JIT build for ARM Thumb-2 with RVCT
+        https://bugs.webkit.org/show_bug.cgi?id=56440
+
+        Derived from a patch by Dave Tapuska.
+
+        Also, modify the RVCT stub template to indicate that it preserves 8 byte stack alignment.
+
+        * jit/JITStubs.cpp:
+
+2011-03-16  Chao-ying Fu  <fu@mips.com>
+
+        Reviewed by Darin Adler.
+
+        Fix MIPS build with const *void
+        https://bugs.webkit.org/show_bug.cgi?id=56513
+
+        * assembler/MacroAssemblerMIPS.h:
+        (JSC::MacroAssemblerMIPS::load32):
+        (JSC::MacroAssemblerMIPS::store32):
+
+2011-03-16  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Remove unnecessary caller tracking shenanigans from CodeBlock
+        https://bugs.webkit.org/show_bug.cgi?id=56483
+
+        This removes some leftover cruft from when we made CodeBlock
+        mark its callees.  Removing it gives us a 0.7% progression,
+        reducing the overall regression to ~1.3%.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::shrinkToFit):
+        * bytecode/CodeBlock.h:
+        (JSC::CallLinkInfo::CallLinkInfo):
+        * jit/JIT.cpp:
+        (JSC::JIT::linkCall):
+        (JSC::JIT::linkConstruct):
+
+2011-03-15  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Make Structure creation require a JSGlobalData
+        https://bugs.webkit.org/show_bug.cgi?id=56438
+
+        Mechanical change to make Structure::create require JSGlobalData&, and
+        require all users to provide the globalData.
+
+        * API/JSCallbackConstructor.h:
+        (JSC::JSCallbackConstructor::createStructure):
+        * API/JSCallbackFunction.h:
+        (JSC::JSCallbackFunction::createStructure):
+        * API/JSCallbackObject.h:
+        (JSC::JSCallbackObject::createStructure):
+        * API/JSContextRef.cpp:
+        * JavaScriptCore.exp:
+        * debugger/DebuggerActivation.cpp:
+        (JSC::DebuggerActivation::DebuggerActivation):
+        * debugger/DebuggerActivation.h:
+        (JSC::DebuggerActivation::createStructure):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * jsc.cpp:
+        (GlobalObject::GlobalObject):
+        (functionRun):
+        (jscmain):
+        * runtime/Arguments.h:
+        (JSC::Arguments::createStructure):
+        * runtime/ArrayPrototype.h:
+        (JSC::ArrayPrototype::createStructure):
+        * runtime/BooleanObject.h:
+        (JSC::BooleanObject::createStructure):
+        * runtime/DateInstance.h:
+        (JSC::DateInstance::createStructure):
+        * runtime/DatePrototype.h:
+        (JSC::DatePrototype::createStructure):
+        * runtime/ErrorInstance.h:
+        (JSC::ErrorInstance::createStructure):
+        * runtime/Executable.h:
+        (JSC::ExecutableBase::createStructure):
+        (JSC::EvalExecutable::createStructure):
+        (JSC::ProgramExecutable::createStructure):
+        (JSC::FunctionExecutable::createStructure):
+        * runtime/FunctionPrototype.h:
+        (JSC::FunctionPrototype::createStructure):
+        * runtime/GetterSetter.h:
+        (JSC::GetterSetter::createStructure):
+        * runtime/InternalFunction.h:
+        (JSC::InternalFunction::createStructure):
+        * runtime/JSAPIValueWrapper.h:
+        (JSC::JSAPIValueWrapper::createStructure):
+        * runtime/JSActivation.h:
+        (JSC::JSActivation::createStructure):
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::JSArray):
+        * runtime/JSArray.h:
+        (JSC::JSArray::createStructure):
+        * runtime/JSByteArray.cpp:
+        (JSC::JSByteArray::createStructure):
+        * runtime/JSByteArray.h:
+        (JSC::JSByteArray::JSByteArray):
+        * runtime/JSCell.h:
+        (JSC::JSCell::JSCell::createDummyStructure):
+        * runtime/JSFunction.h:
+        (JSC::JSFunction::createStructure):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::storeVPtrs):
+        (JSC::JSGlobalData::JSGlobalData):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::reset):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::JSGlobalObject):
+        (JSC::JSGlobalObject::createStructure):
+        * runtime/JSNotAnObject.h:
+        (JSC::JSNotAnObject::createStructure):
+        * runtime/JSONObject.h:
+        (JSC::JSONObject::createStructure):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::createInheritorID):
+        * runtime/JSObject.h:
+        (JSC::JSObject::createStructure):
+        (JSC::JSNonFinalObject::createStructure):
+        (JSC::JSFinalObject::createStructure):
+        (JSC::createEmptyObjectStructure):
+        (JSC::JSObject::inheritorID):
+        * runtime/JSObjectWithGlobalObject.h:
+        (JSC::JSObjectWithGlobalObject::createStructure):
+        * runtime/JSPropertyNameIterator.h:
+        (JSC::JSPropertyNameIterator::createStructure):
+        * runtime/JSStaticScopeObject.h:
+        (JSC::JSStaticScopeObject::createStructure):
+        * runtime/JSString.h:
+        (JSC::RopeBuilder::createStructure):
+        * runtime/JSVariableObject.h:
+        (JSC::JSVariableObject::createStructure):
+        * runtime/JSWrapperObject.h:
+        (JSC::JSWrapperObject::createStructure):
+        * runtime/JSZombie.h:
+        (JSC::JSZombie::createStructure):
+        * runtime/MathObject.h:
+        (JSC::MathObject::createStructure):
+        * runtime/NativeErrorConstructor.cpp:
+        (JSC::NativeErrorConstructor::NativeErrorConstructor):
+        * runtime/NativeErrorConstructor.h:
+        (JSC::NativeErrorConstructor::createStructure):
+        * runtime/NumberConstructor.h:
+        (JSC::NumberConstructor::createStructure):
+        * runtime/NumberObject.h:
+        (JSC::NumberObject::createStructure):
+        * runtime/ObjectConstructor.h:
+        (JSC::ObjectConstructor::createStructure):
+        * runtime/RegExpConstructor.h:
+        (JSC::RegExpConstructor::createStructure):
+        * runtime/RegExpObject.h:
+        (JSC::RegExpObject::createStructure):
+        * runtime/ScopeChain.h:
+        (JSC::ScopeChainNode::createStructure):
+        * runtime/StringObject.h:
+        (JSC::StringObject::createStructure):
+        * runtime/StringObjectThatMasqueradesAsUndefined.h:
+        (JSC::StringObjectThatMasqueradesAsUndefined::createStructure):
+        * runtime/StringPrototype.h:
+        (JSC::StringPrototype::createStructure):
+        * runtime/Structure.h:
+        (JSC::Structure::create):
+
+2011-03-16  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Some conservative root gathering cleanup
+        https://bugs.webkit.org/show_bug.cgi?id=56447
+        
+        SunSpider says 0.5% - 1.8% faster.
+
+        * interpreter/RegisterFile.cpp:
+        (JSC::RegisterFile::gatherConservativeRoots):
+        * interpreter/RegisterFile.h: New helper function for doing the
+        conservative gathering of the register file. It's still conservative,
+        since the register file may contain uninitialized values, but it's
+        moving-safe, because it only visits values tagged as pointers, so there's
+        no risk of mistaking an integer for a pointer and accidentally changing it.
+
+        * runtime/ConservativeSet.cpp:
+        (JSC::ConservativeRoots::add):
+        * runtime/ConservativeSet.h: Added a single-value add function, used above.
+
+        * runtime/Heap.cpp:
+        (JSC::Heap::markRoots): Separated machine stack conservative roots from
+        register file conservative roots because machine stack roots must be
+        pinned, but register file roots need not be pinned.
+        
+        Adopted new interface for passing the current stack extent to the machine
+        stack root gathering routine. This allows us to exclude marking-related
+        data structures on the stack, and thus avoid double-marking the set of
+        machine roots.
+
+        * runtime/MachineStackMarker.cpp:
+        (JSC::MachineThreads::gatherFromCurrentThread):
+        (JSC::MachineThreads::gatherConservativeRoots):
+        * runtime/MachineStackMarker.h: Added new interface, described above.
+
+        * runtime/MarkedBlock.h:
+        (JSC::MarkedBlock::firstAtom):
+        * wtf/StdLibExtras.h:
+        (WTF::roundUpToMultipleOf): Moved roundUpToMultipleOf so it could be used
+        by MachineStacks.
+
+2011-03-16  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        A little bit of MarkStack cleanup
+        https://bugs.webkit.org/show_bug.cgi?id=56443
+        
+        Moved MarkStack functions into MarkStack.h/.cpp.
+        
+        SunSpider reports no change.
+
+        * runtime/JSArray.h:
+        * runtime/JSCell.h: Moved from here...
+        * runtime/MarkStack.cpp:
+        (JSC::MarkStack::markChildren):
+        (JSC::MarkStack::drain): ...to here. Also, no need to inline drain. It's
+        a huge function, and not called many times.
+
+        * runtime/MarkStack.h:
+        (JSC::MarkStack::~MarkStack): Moved near constructor, per style guide.
+        (JSC::MarkStack::append):
+        (JSC::MarkStack::deprecatedAppend):
+        (JSC::MarkStack::internalAppend): Moved to here.
+
+2011-03-15  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Removed another deprecatedAppend
+        https://bugs.webkit.org/show_bug.cgi?id=56429
+
+        * collector/handles/HandleHeap.cpp:
+        (JSC::HandleHeap::markStrongHandles):
+        * collector/handles/HandleHeap.h: Use HeapRootMarker, since handles are
+        marked directly by the Heap.
+
+        * runtime/Heap.cpp:
+        (JSC::Heap::markRoots): Ditto.
+
+2011-03-15  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Removed some more deprecated / unsafe append
+        https://bugs.webkit.org/show_bug.cgi?id=56428
+
+        * collector/handles/HandleStack.cpp:
+        (JSC::HandleStack::mark):
+        * collector/handles/HandleStack.h: Mark the handle stack using a HeapRoot
+        marker, since it's a heap root.
+        
+        * runtime/ArgList.cpp:
+        (JSC::MarkedArgumentBuffer::markLists):
+        (JSC::MarkedArgumentBuffer::slowAppend):
+        * runtime/ArgList.h: Ditto.
+
+        * runtime/Heap.cpp:
+        (JSC::Heap::markRoots): Added a mark call for marking the handle stack.
+        It seems like Oliver forgot this in his last patch. (!)
+
+        * runtime/MarkStack.h: Removed appendSlots, since it would allow an
+        object to embed JSValues directly instead of using WriteBarrier.
+
+        (JSC::MarkStack::append): Added a private append for a list of values.
+
+        (JSC::HeapRootMarker::mark): Access to the above.
+
+2011-03-15  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Removed a few more deprecatedAppends, and removed HeapRoot<T>
+        https://bugs.webkit.org/show_bug.cgi?id=56422
+        
+        Added HeapRootMarker, a privileged class for marking direct heap roots
+        that are iterated during each garbage collection. This is easier to use
+        and more reliable than HeapRoot<T>, so I've removed HeapRoot<T>.
+
+        * debugger/Debugger.cpp:
+        (JSC::evaluateInGlobalCallFrame):
+        * debugger/DebuggerCallFrame.cpp:
+        (JSC::DebuggerCallFrame::evaluate):
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::exception):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/Completion.cpp:
+        (JSC::evaluate): exception is no longer a HeapRoot<T>, so no need to
+        call .get() on it.
+
+        * runtime/Heap.cpp:
+        (JSC::Heap::markProtectedObjects):
+        (JSC::Heap::markTempSortVectors):
+        (JSC::Heap::markRoots):
+        * runtime/Heap.h: Updated to use HeapRootMarker.
+
+        * runtime/JSCell.h:
+        (JSC::JSCell::MarkStack::append): Added private functions for
+        HeapRootMarker to use.
+
+        * runtime/JSGlobalData.h: exception is no longer a HeapRoot<T>.
+
+        * runtime/MarkStack.h:
+        (JSC::HeapRootMarker::HeapRootMarker):
+        (JSC::HeapRootMarker::mark): Added private functions for
+        HeapRootMarker to use.
+
+        * runtime/SmallStrings.cpp:
+        (JSC::SmallStrings::markChildren): Updated to use HeapRootMarker.
+
+        * runtime/SmallStrings.h:
+        (JSC::SmallStrings::emptyString):
+        (JSC::SmallStrings::singleCharacterString):
+        (JSC::SmallStrings::singleCharacterStrings): Updated to use HeapRootMarker.
+
+        * runtime/WriteBarrier.h: Removed HeapRoot<T>.
+
+2011-03-14  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Made the global object moving-GC-safe
+        https://bugs.webkit.org/show_bug.cgi?id=56348
+        
+        SunSpider reports no change.
+
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::markChildren): Removed a dubious comment that
+        suggested we do not need to visit all our references during GC, since
+        that is not true in a moving GC.
+
+        Re-sorted data members by type, removed one duplicate, and added back
+        the one missing mark I found.
+
+        * runtime/JSGlobalObject.h: Re-sorted data members by type.
+
+2011-03-15  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Introduce Local<T> to allow us to start moving to precise marking of locals
+        https://bugs.webkit.org/show_bug.cgi?id=56394
+
+        Introduce a new handle type, Local<T> and a scoping mechanism
+        LocalScope to allow us to start moving towards precise marking
+        of temporaries and local variables.
+
+        We also start to use the new Local<> type in the JSON stringifier
+        so that we can have some coverage of their behaviour in the initial
+        checkin.
+
+        * GNUmakefile.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.pro:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * collector/handles/Handle.h:
+        (JSC::::asObject):
+        * collector/handles/HandleStack.cpp: Added.
+        (JSC::HandleStack::HandleStack):
+        (JSC::HandleStack::mark):
+        (JSC::HandleStack::grow):
+        * collector/handles/HandleStack.h: Added.
+        (JSC::HandleStack::enterScope):
+        (JSC::HandleStack::zapTo):
+        (JSC::HandleStack::leaveScope):
+        (JSC::HandleStack::push):
+        * collector/handles/Local.h: Added.
+        (JSC::Local::internalSet):
+        (JSC::::Local):
+        (JSC::::operator):
+        (JSC::LocalStack::LocalStack):
+        (JSC::LocalStack::peek):
+        (JSC::LocalStack::pop):
+        (JSC::LocalStack::push):
+        (JSC::LocalStack::isEmpty):
+        (JSC::LocalStack::size):
+        * collector/handles/LocalScope.h: Added.
+        (JSC::LocalScope::LocalScope):
+        (JSC::LocalScope::~LocalScope):
+        (JSC::LocalScope::release):
+        * runtime/Heap.cpp:
+        (JSC::Heap::markRoots):
+        * runtime/Heap.h:
+        (JSC::Heap::allocateLocalHandle):
+        (JSC::Heap::handleStack):
+        * runtime/JSCell.h:
+        (JSC::JSCell::::getString):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        * runtime/JSGlobalData.h:
+        (JSC::JSGlobalData::allocateLocalHandle):
+        * runtime/JSONObject.cpp:
+        (JSC::Stringifier::Stringifier):
+        (JSC::Stringifier::stringify):
+        (JSC::Stringifier::appendStringifiedValue):
+        (JSC::Stringifier::Holder::Holder):
+        (JSC::Walker::Walker):
+        (JSC::Walker::walk):
+        (JSC::JSONProtoFuncParse):
+        (JSC::JSONProtoFuncStringify):
+        (JSC::JSONStringify):
+        * runtime/JSONObject.h:
+        * runtime/MarkStack.h:
+        (JSC::MarkStack::appendValues):
+        (JSC::MarkStack::appendSlots):
+
+2011-03-15  Gavin Barraclough  <barraclough@apple.com>
+
+        Rubber Stamped by Sam Weinig.
+
+        Bug 56420 - Remove ENABLE(JIT) code from ByteCompiler
+        Some methods have unnecessary differences in name/arguments for interpreter/JIT.
+
+        * bytecode/CodeBlock.cpp:
+        * bytecode/CodeBlock.h:
+        (JSC::HandlerInfo::HandlerInfo):
+        (JSC::CodeBlock::addPropertyAccessInfo):
+        (JSC::CodeBlock::addGlobalResolveInfo):
+        (JSC::CodeBlock::addCallLinkInfo):
+        (JSC::CodeBlock::globalResolveInfo):
+        * bytecode/Opcode.h:
+        * bytecode/StructureStubInfo.h:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitResolve):
+        (JSC::BytecodeGenerator::emitResolveWithBase):
+        (JSC::BytecodeGenerator::emitGetById):
+        (JSC::BytecodeGenerator::emitPutById):
+        (JSC::BytecodeGenerator::emitDirectPutById):
+        (JSC::BytecodeGenerator::emitCall):
+        (JSC::BytecodeGenerator::emitConstruct):
+        (JSC::BytecodeGenerator::emitCatch):
+
+2011-03-15  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Fix broken assert in new code.
+
+        * dfg/DFGAliasTracker.h:
+        (JSC::DFG::AliasTracker::recordPutByVal):
+            - recordPutByVal is called for both PutByVal & PutByValAlias.
+
+2011-03-15  Gavin Barraclough  <barraclough@apple.com>
+
+        Rubber stamped by Sam Weinig.
+
+        Removed redundant code from BytecodeGenerator.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        * bytecompiler/BytecodeGenerator.h:
+            - delete uncalled code missed when reparsing was removed.
+
+2011-03-15  Kevin Ollivier  <kevino@theolliviers.com>
+
+        Reviewed by Darin Adler.
+
+        Introduce WTF_USE_EXPORT_MACROS, which will allow us to put shared library import/export
+        info into the headers rather than in export symbol definition files, but disable it on 
+        all platforms initially so we can deal with port build issues one port at a time.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=27551
+
+        * API/JSBase.h:
+        * config.h:
+        * wtf/Assertions.h:
+        * wtf/ExportMacros.h: Added.
+        * wtf/Platform.h:
+
+2011-03-14  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Unreviewed build fix.
+
+        Buildfix when JIT is not enabled after r81079
+        https://bugs.webkit.org/show_bug.cgi?id=56361
+
+        * runtime/Executable.cpp:
+
+2011-03-14  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Made the global object moving-GC-safe
+        https://bugs.webkit.org/show_bug.cgi?id=56348
+        
+        SunSpider reports no change.
+
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::markChildren): Removed a dubious comment that
+        suggested we do not need to visit all our references during GC, since
+        that is not true in a moving GC.
+
+        Re-sorted data members by type, removed one duplicate, and added back
+        the one missing mark I found.
+
+        * runtime/JSGlobalObject.h: Re-sorted data members by type.
+
+2011-03-14  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Made JSWrapperObject and subclasses moving-GC-safe
+        https://bugs.webkit.org/show_bug.cgi?id=56346
+        
+        SunSpider reports no change.
+
+        * runtime/BooleanObject.cpp:
+        (JSC::BooleanObject::BooleanObject):
+        * runtime/DateInstance.cpp:
+        (JSC::DateInstance::DateInstance): No more need for JSGlobalData, since
+        we don't initialize the wrapped value in our constructor.
+
+        * runtime/DateInstance.h: Don't set the OverridesMarkChildren flag because
+        we do not in fact override markChildren.
+
+        * runtime/DatePrototype.h: Declare an anonymous slot, since wrapper object
+        no longer does so for us. Also added an ASSERT to catch a latent bug,
+        where DatePrototype stomped on its base class's anonymous slot. Hard-coded
+        anonymous slots are a plague on our code. This doesn't cause any problems
+        in our existing code since the base class never reads the anonymous slot
+        it declares, but it caused crashes when I tried to start using the slot
+        in an initial version of this patch.
+
+        * runtime/JSWrapperObject.h:
+        (JSC::JSWrapperObject::JSWrapperObject):
+        (JSC::JSWrapperObject::internalValue):
+        (JSC::JSWrapperObject::setInternalValue): Resolved a problem where
+        our internal value was stored in two places: an anonymous slot, and a
+        data member which was not always visited during GC. Now, we only use the
+        data member, and we always visit it. (Instead of relying on certain
+        subclasses to set the OverridesMarkChildren bit, we set it ourselves.)
+
+        * runtime/NumberObject.cpp:
+        (JSC::NumberObject::NumberObject): No more need for JSGlobalData, since
+        we don't initialize the wrapped value in our constructor.
+
+        * runtime/NumberObject.h: Removed meaningless declaration.
+
+        * runtime/StringObject.cpp:
+        (JSC::StringObject::StringObject): No more need for JSGlobalData, since
+        we don't initialize the wrapped value in our constructor.
+
+        * runtime/StringObject.h: Don't set the OverridesMarkChildren flag because
+        we do not in fact override markChildren.
+
+        * runtime/StringPrototype.h: Declare an anonymous slot, since wrapper object
+        no longer does so for us. Also added an ASSERT to catch a latent bug,
+        where DatePrototype stomped on its base class's anonymous slot. Hard-coded
+        anonymous slots are a plague on our code.
+
+2011-03-14  Michael Saboff  <msaboff@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Look-ahead assertions with back references don’t work as expected
+        https://bugs.webkit.org/show_bug.cgi?id=56082
+
+        Changed parentheses assertion processing to temporarily back out the 
+        number of known characters after the assertion while processing the 
+        assertion.  This was done so that assertions don't fail due to 
+        checking the number of required characters as additional to the 
+        rest of the express since assertions don't "consume" input.
+        Added a byte code to uncheck characters to support the change.
+
+        * yarr/YarrInterpreter.cpp:
+        (JSC::Yarr::Interpreter::matchDisjunction):
+        (JSC::Yarr::ByteCompiler::uncheckInput):
+        (JSC::Yarr::ByteCompiler::emitDisjunction):
+        * yarr/YarrInterpreter.h:
+        (JSC::Yarr::ByteTerm::UncheckInput):
+
+2011-03-14  Viatcheslav Ostapenko  <ostapenko.viatcheslav@nokia.com>
+
+        Reviewed by Laszlo Gombos.
+
+        [Qt] Warning that round/roundf functions are already defined when compiled with RVCT 4 on symbian.
+        https://bugs.webkit.org/show_bug.cgi?id=56133
+
+        Add condition to not compile webkit internal math round functions on RVCT compiler versions 
+        from 3.0.0 because they are already defined in compiler math library.
+
+        * wtf/MathExtras.h:
+
+2011-03-14  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoffrey Garen & Oliver Hunt.
+
+        Bug 56284 - Add a dataflow intermediate representation for use in JIT generation.
+
+        The JSC JIT presently generates code directly from the bytecode used by the interpreter.
+        This is not an optimal intermediate representation for JIT code generation, since it does
+        not capture liveness information of values, and provides little opportunity to perform
+        any static analysis for even primitive types. The JIT currently generates two code paths,
+        a fast path handling common cases, and a slower path handling less common operand types.
+        However the slow path jumps back into the fast path, meaning that information arising
+        from the earlier type checks cannot be propagated to later operations.
+
+        This patch adds:
+            * a dataflow intermediate representation capable of describing a single basic block
+              of operations,
+            * a mechanism to convert a simple, single-block bytecode functions to the new IR,
+            * and a JIT code generator capable of generating code from this representation.
+
+        The JIT generates two code paths, with the slower path not reentering the fast path
+        mid-block, allowing speculative optimizations to be made on the hot path, with type
+        information arising from these speculative decisions able to be propagated through the
+        dataflow. Code generation of both speculative and non-speculative paths exploits the type
+        and liveness information represented in the dataflow graph to attempt to avoid redundant
+        boxing and type-checking of values, and to remove unnecessary spills of temporary values
+        to the RegisterFile.
+
+        The dataflow JIT currently can only support a subset of bytecode operations, limited to
+        arithmetic, bit-ops, and basic property access. Functions that cannot be compiled by the
+        dataflow JIT will be run using the existing JIT. The coverage of the dataflow JIT will be
+        expanded to include, control-flow, function calls, and then the long-tail of remaining
+        bytecode instructions. The JIT presently only support JSVALUE64, and as a consequence of
+        this only supports x86-64.
+
+        The status of the dataflow JIT is currently work-in-progress. Limitations of the present
+        JIT code generation may cause performance regressions, particularly:
+            * the policy to only generate arithmetic code on the speculative path using integer
+              instructions, never using floating point.
+            * the policy to only generate arithmetic code on the non-speculative path using
+              floating point instructions, never using integer.
+            * always generating JSValue adds on the non-speculative path as a call out to a
+              C-function, never handling this in JIT code.
+            * always assuming by-Value property accesses on the speculative path to be array
+              accesses.
+            * generating all by-Value property accesses from the non-speculative path as a call
+              out to a C-function.
+            * generating all by-Indentifer property accesses as a call out to a C-function.
+        Due to these regressions, the code is landed in a state where it is disabled in most
+        cases by the ENABLE_DFG_JIT_RESTRICTIONS guard in Platform.h. As these regressions are
+        addressed, the JIT will be allowed to trigger in more cases.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+            - Added new files to Xcode project.
+        * dfg: Added.
+            - Added directory for new code.
+        * dfg/DFGByteCodeParser.cpp: Added.
+        * dfg/DFGByteCodeParser.h: Added.
+            - Contruct a DFG::Graph representation from a bytecode CodeBlock.
+        * dfg/DFGGenerationInfo.h: Added.
+            - Track type & register information for VirtualRegisters during JIT code generation.
+        * dfg/DFGGraph.cpp: Added.
+        * dfg/DFGGraph.h: Added.
+            - Dataflow graph intermediate representation for code generation.
+        * dfg/DFGJITCodeGenerator.cpp: Added.
+        * dfg/DFGJITCodeGenerator.h: Added.
+            - Base class for SpeculativeJIT & NonSpeculativeJIT to share common functionality.
+        * dfg/DFGJITCompiler.cpp: Added.
+        * dfg/DFGJITCompiler.h: Added.
+            - Class responsible for driving code generation of speculativeJIT & non-speculative
+              code paths from the dataflow graph.
+        * dfg/DFGNonSpeculativeJIT.cpp: Added.
+        * dfg/DFGNonSpeculativeJIT.h: Added.
+            - Used to generate the non-speculative code path, this make no assumptions
+              about operand types.
+        * dfg/DFGOperations.cpp: Added.
+        * dfg/DFGOperations.h: Added.
+            - Helper functions called from the JIT generated code.
+        * dfg/DFGRegisterBank.h: Added.
+            - Used to track contents of physical registers during JIT code generation.
+        * dfg/DFGSpeculativeJIT.cpp: Added.
+        * dfg/DFGSpeculativeJIT.h: Added.
+            - Used to generate the speculative code path, this make assumptions about
+              operand types to enable optimization.
+        * runtime/Executable.cpp:
+            - Add code to attempt to use the DFG JIT to compile a function, with fallback
+              to the existing JIT.
+        * wtf/Platform.h:
+            - Added compile guards to enable the DFG JIT.
+
+2011-03-14  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Removed more cases of DeprecatedPtr (exception, SmallStrings)
+        https://bugs.webkit.org/show_bug.cgi?id=56332
+
+        * runtime/Identifier.cpp:
+        (JSC::Identifier::add):
+        (JSC::Identifier::addSlowCase): Use a variable instead of a hard-coded
+        constant, to make this code less brittle.
+
+        * runtime/JSGlobalData.h: Use HeapRoot instead of DeprecatedPtr because
+        this reference is owned and managed directly by the heap.
+
+        * runtime/JSString.cpp:
+        (JSC::JSString::substringFromRope):
+        * runtime/JSString.h:
+        (JSC::jsSingleCharacterString):
+        (JSC::jsSingleCharacterSubstring):
+        (JSC::jsString):
+        (JSC::jsStringWithFinalizer):
+        (JSC::jsSubstring):
+        (JSC::jsOwnedString): Use a variable instead of a hard-coded
+        constant, to make this code less brittle.
+
+        * runtime/SmallStrings.cpp:
+        (JSC::SmallStringsStorage::rep):
+        (JSC::SmallStringsStorage::SmallStringsStorage):
+        (JSC::SmallStrings::SmallStrings):
+        (JSC::SmallStrings::markChildren):
+        (JSC::SmallStrings::clear):
+        (JSC::SmallStrings::count): Use a variable instead of a hard-coded
+        constant, to make this code less brittle.
+
+        * runtime/SmallStrings.h:
+        (JSC::SmallStrings::singleCharacterString): Use HeapRoot instead of
+        DeprecatedPtr because these references are owned and managed directly by
+        the heap.
+        
+        Stop using FixedArray because we only want a very limited set
+        of classes to be able to use HeapRoot. (Replaced with manual ASSERTs.)
+
+        * runtime/WriteBarrier.h:
+        (JSC::operator==):
+        (JSC::WriteBarrier::WriteBarrier):
+        (JSC::HeapRoot::HeapRoot):
+        (JSC::HeapRoot::operator=): Added HeapRoot, which is allowed to set
+        without write barrier because we assume all HeapRoots are scanned during
+        all GC passes.
+
+2011-03-14  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Adam Roben and Gavin Barraclough.
+
+        FileSystemWin.cpp needs listDirectory() implementation
+        https://bugs.webkit.org/show_bug.cgi?id=56331
+        <rdar://problem/9126635>
+        
+        Give StringConcatenate the ability to deal with const UChar*'s as a String type to append.
+
+        * wtf/text/StringConcatenate.h:
+
+2011-03-14  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        <http://webkit.org/b/56304> REGRESSION(r80892): 100,000+ leaks seen on the build bot
+
+        * API/JSClassRef.cpp:
+        (OpaqueJSClass::OpaqueJSClass): Don't leak any existing entry for the given name if
+        the class definition contains duplicates. This also removes what look to be leaks
+        of the StringImpl instances that are used as keys: the HashMap key type is a RefPtr
+        which retains / releases the instances at the appropriate time, so explicitly calling
+        ref is not necessary.
+
+2011-03-14  Oliver Hunt  <oliver@apple.com>
+
+        Fix windows build
+
+        * jit/JSInterfaceJIT.h:
+        (JSC::JSInterfaceJIT::emitLoadInt32):
+        (JSC::JSInterfaceJIT::tagFor):
+        (JSC::JSInterfaceJIT::payloadFor):
+        (JSC::JSInterfaceJIT::intPayloadFor):
+        (JSC::JSInterfaceJIT::intTagFor):
+        (JSC::JSInterfaceJIT::addressFor):
+
+2011-03-11  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Ensure all values are correctly tagged in the registerfile
+        https://bugs.webkit.org/show_bug.cgi?id=56214
+
+        This patch makes sure that all JSCell pointers written to
+        the registerfile are correctly tagged as JSCells, and replaces
+        raw int usage with the immediate representation.
+
+        For performance, register pressure, and general saneness reasons
+        I've added abstractions for reading and writing the tag
+        and payload of integer registers directly for the JSVALUE64
+        encoding.
+
+        * interpreter/Register.h:
+        (JSC::Register::withInt):
+        (JSC::Register::withCallee):
+        (JSC::Register::operator=):
+        (JSC::Register::i):
+        (JSC::Register::activation):
+        (JSC::Register::function):
+        (JSC::Register::propertyNameIterator):
+        (JSC::Register::scopeChain):
+        * jit/JIT.h:
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCallInitializeCallFrame):
+        (JSC::JIT::compileOpCallVarargs):
+        (JSC::JIT::compileOpCall):
+        * jit/JITCall32_64.cpp:
+        (JSC::JIT::compileOpCallInitializeCallFrame):
+        (JSC::JIT::compileOpCallVarargs):
+        (JSC::JIT::compileOpCall):
+        (JSC::JIT::compileOpCallSlowCase):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitPutToCallFrameHeader):
+        (JSC::JIT::emitPutCellToCallFrameHeader):
+        (JSC::JIT::emitPutIntToCallFrameHeader):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::privateCompileCTINativeCall):
+        (JSC::JIT::emit_op_get_pnames):
+        (JSC::JIT::emit_op_next_pname):
+        (JSC::JIT::emit_op_load_varargs):
+        (JSC::JIT::emitSlow_op_load_varargs):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::privateCompileCTINativeCall):
+        (JSC::JIT::emit_op_get_pnames):
+        (JSC::JIT::emit_op_next_pname):
+        * jit/JSInterfaceJIT.h:
+        (JSC::JSInterfaceJIT::intPayloadFor):
+        (JSC::JSInterfaceJIT::intTagFor):
+        * jit/SpecializedThunkJIT.h:
+        (JSC::SpecializedThunkJIT::returnJSValue):
+        (JSC::SpecializedThunkJIT::returnDouble):
+        (JSC::SpecializedThunkJIT::returnInt32):
+        (JSC::SpecializedThunkJIT::returnJSCell):
+
+2011-03-13  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        A few Heap-related renames (sans file moves, which should come next)
+        https://bugs.webkit.org/show_bug.cgi?id=56283
+        
+        ConservativeSet => ConservativeRoots. "Set" was misleading, since items
+        are not uniqued. Also, "Roots" is more specific about what's in the set.
+        
+        MachineStackMarker => MachineThreads. "Threads" is more descriptive of
+        the fact that this class maintains a set of all threads using JSC.
+        "Stack" was misleading, since this class traverses stacks and registers.
+        "Mark" was misleading, since this class doesn't mark anything anymore.
+        
+        registerThread => addCurrentThread. "Current" is more specific.
+        unregisterThread => removeCurrentThread. "Current" is more specific.
+        
+        "currentThreadRegistrar" => threadSpecific. The only point of this data
+        structure is to register a thread-specific destructor with a pointer to
+        this.
+        
+        "mark...Conservatively" => "gather". "Mark" is not true, since these
+        functions don't mark anything. "Conservatively" is redundant, since they
+        take "ConservativeRoots" as an argument.
+
+        * API/APIShims.h:
+        (JSC::APIEntryShimWithoutLock::APIEntryShimWithoutLock):
+        * JavaScriptCore.exp:
+        * runtime/ConservativeSet.cpp:
+        (JSC::ConservativeRoots::grow):
+        (JSC::ConservativeRoots::add):
+        * runtime/ConservativeSet.h:
+        (JSC::ConservativeRoots::ConservativeRoots):
+        (JSC::ConservativeRoots::~ConservativeRoots):
+        (JSC::ConservativeRoots::size):
+        (JSC::ConservativeRoots::roots):
+        * runtime/Heap.cpp:
+        (JSC::Heap::Heap):
+        (JSC::Heap::markRoots):
+        * runtime/Heap.h:
+        (JSC::Heap::machineThreads):
+        * runtime/JSGlobalData.h:
+        (JSC::JSGlobalData::makeUsableFromMultipleThreads):
+        * runtime/MachineStackMarker.cpp:
+        (JSC::MachineThreads::MachineThreads):
+        (JSC::MachineThreads::~MachineThreads):
+        (JSC::MachineThreads::makeUsableFromMultipleThreads):
+        (JSC::MachineThreads::addCurrentThread):
+        (JSC::MachineThreads::removeThread):
+        (JSC::MachineThreads::removeCurrentThread):
+        (JSC::MachineThreads::gatherFromCurrentThreadInternal):
+        (JSC::MachineThreads::gatherFromCurrentThread):
+        (JSC::MachineThreads::gatherFromOtherThread):
+        (JSC::MachineThreads::gatherConservativeRoots):
+        * runtime/MachineStackMarker.h:
+        * runtime/MarkStack.h:
+        (JSC::MarkStack::append):
+
+2011-03-13  David Kilzer  <ddkilzer@apple.com>
+
+        BUILD FIX for armv7 after r80969
+
+        Bug 56270 - The JIT 'friend's many classes in JSC; start unwinding this.
+        <https://bugs.webkit.org/show_bug.cgi?id=56270>
+
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::load32): Made void* address argument
+        const.
+        (JSC::MacroAssemblerARMv7::store32): Ditto.
+
+2011-03-13  Geoffrey Garen  <ggaren@apple.com>
+
+        Not reviewed.
+
+        Try to fix the Mac build.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj: Make sure to forward
+        ConervativeSet.h, since it's now visible when compiling other projects.
+
+2011-03-13  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Removed another case of DeprecatedPtr (ConservativeSet)
+        https://bugs.webkit.org/show_bug.cgi?id=56281
+        
+        The ConservativeSet is an internal data structure used during marking,
+        so direct pointers are fine.
+
+        * runtime/ConservativeSet.cpp:
+        (JSC::ConservativeSet::grow):
+        * runtime/ConservativeSet.h: Added some accessors, for use by MarkStack::append.
+        (JSC::ConservativeSet::~ConservativeSet): Fixed a typo where we calculated
+        the size of the set based on sizeof(DeprecatedPtr<T>*) instead of
+        sizeof(DeprecatedPtr<T>). I'm not sure if this had real-world implications or not.
+        (JSC::ConservativeSet::size):
+        (JSC::ConservativeSet::set): Use direct pointers, as stated above. 
+
+        * runtime/Heap.cpp:
+        (JSC::Heap::markRoots):
+        * runtime/MarkStack.h:
+        (JSC::MarkStack::append): Created a special case of append for
+        ConservativeSet. I didn't want to add back a generic "append JSCell*"
+        function, since other class might start using that wrong. (In the end,
+        this function might go away, since the Heap will want to do something
+        slightly more interesting with the conservative set, but this is OK for
+        now.)
+
+2011-03-13  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Removed another case of DeprecatedPtr (PutPropertySlot)
+        https://bugs.webkit.org/show_bug.cgi?id=56278
+
+        * runtime/PutPropertySlot.h:
+        (JSC::PutPropertySlot::setExistingProperty):
+        (JSC::PutPropertySlot::setNewProperty):
+        (JSC::PutPropertySlot::base): Direct pointer is fine for PutPropertySlot,
+        since it's a stack-allocated temporary.
+
+2011-03-13  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Removed one case of DeprecatedPtr (ScopeChainIterator)
+        https://bugs.webkit.org/show_bug.cgi?id=56277
+
+        * runtime/ScopeChain.h: Direct pointer is fine for ScopeChainIterator,
+        since it's a stack-allocated temporary.
+
+2011-03-13  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Bug 56273 - Add three operand forms to MacroAssember operations.
+
+        Adding for X86(_64) for now, should be rolled out to other backends as necessary.
+        These may allow more efficient code generation in some cases, avoiding the need
+        for unnecessary register-register move instructions.
+
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::AbstractMacroAssembler::Jump::link):
+        (JSC::AbstractMacroAssembler::Jump::linkTo):
+            - marked these methods const.
+        (JSC::AbstractMacroAssembler::Jump::isSet):
+            - add a method to check whether a Jump object has been set to
+              reference an instruction, or is in a null, unset state. 
+        * assembler/MacroAssemblerCodeRef.h:
+        (JSC::FunctionPtr::FunctionPtr):
+            - add non-explicit constructor, for FunctionPtr's to C/C++ functions.
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::and32):
+        (JSC::MacroAssemblerX86Common::lshift32):
+        (JSC::MacroAssemblerX86Common::or32):
+        (JSC::MacroAssemblerX86Common::rshift32):
+        (JSC::MacroAssemblerX86Common::urshift32):
+        (JSC::MacroAssemblerX86Common::xor32):
+        (JSC::MacroAssemblerX86Common::moveDouble):
+        (JSC::MacroAssemblerX86Common::addDouble):
+        (JSC::MacroAssemblerX86Common::divDouble):
+        (JSC::MacroAssemblerX86Common::subDouble):
+        (JSC::MacroAssemblerX86Common::mulDouble):
+        (JSC::MacroAssemblerX86Common::branchTruncateDoubleToInt32):
+        (JSC::MacroAssemblerX86Common::branchTest32):
+        (JSC::MacroAssemblerX86Common::branchTest8):
+        (JSC::MacroAssemblerX86Common::branchAdd32):
+        (JSC::MacroAssemblerX86Common::branchMul32):
+        (JSC::MacroAssemblerX86Common::branchSub32):
+            - add three operand forms of these instructions.
+        * assembler/MacroAssemblerX86_64.h:
+        (JSC::MacroAssemblerX86_64::addDouble):
+        (JSC::MacroAssemblerX86_64::convertInt32ToDouble):
+        (JSC::MacroAssemblerX86_64::loadPtr):
+        (JSC::MacroAssemblerX86_64::branchTestPtr):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::JmpSrc::isSet):
+            - add a method to check whether a JmpSrc object has been set to
+              reference an instruction, or is in a null, unset state. 
+        (JSC::X86Assembler::movsd_rr):
+            - added FP register-register move.
+        (JSC::X86Assembler::linkJump):
+            - Add an assert to check jumps aren't linked more than once.
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitLoadInt32ToDouble):
+            - load integers to the FPU via regsiters on x86-64.
+
+2011-03-13  Gavin Barraclough  <barraclough@apple.com>
+
+        ARM build fix.
+
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::load32):
+
+2011-03-13  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Bug 56270 - The JIT 'friend's many classes in JSC; start unwinding this.
+
+        The JIT need to 'friend' other classes in order to be able to calculate offsets
+        of various properties, or the absolute addresses of members within specific objects,
+        in order to JIT generate code that will access members within the class when run.
+
+        Instead of using friends in these cases, switch to providing specific accessor
+        methods to provide this information.  In the case of offsets, these can be static
+        functions, and in the case of pointers to members within a specific object these can
+        be const methods returning pointers to const values, to prevent clients from
+        modifying values otherwise encapsulated within classes.
+
+        * bytecode/SamplingTool.h:
+        * interpreter/Register.h:
+        * interpreter/RegisterFile.h:
+        * runtime/JSArray.h:
+        * runtime/JSCell.h:
+        * runtime/JSTypeInfo.h:
+        * runtime/JSVariableObject.h:
+        * runtime/Structure.h:
+        * wtf/RefCounted.h:
+            - Change these classes to no longer friend the JIT, add accessors for member offsets.
+        * jit/JIT.cpp:
+        * jit/JITCall32_64.cpp:
+        * jit/JITInlineMethods.h:
+        * jit/JITOpcodes.cpp:
+        * jit/JITOpcodes32_64.cpp:
+        * jit/JITPropertyAccess.cpp:
+        * jit/JITPropertyAccess32_64.cpp:
+            - Change the JIT to use class accessors, rather than taking object ofsets directly.
+        * assembler/AbstractMacroAssembler.h:
+        * assembler/MacroAssemblerX86_64.h:
+        * assembler/X86Assembler.h:
+            - Since the accessors for objects members return const pointers to retain encapsulation,
+              methods generating code with absolute addresses must be able to handle const pointers
+              (the JIT doesn't write to these values, do dies treat the pointer to value as const
+              from within the C++ code of the JIT, if not at runtime!).
+
+2011-03-12  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r80919.
+        http://trac.webkit.org/changeset/80919
+        https://bugs.webkit.org/show_bug.cgi?id=56251
+
+        all windows bots failed to compile this change (Requested by
+        loislo on #webkit).
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/StructureStubInfo.cpp:
+        * interpreter/Register.h:
+        (JSC::Register::withInt):
+        (JSC::Register::withCallee):
+        (JSC::Register::operator=):
+        (JSC::Register::i):
+        (JSC::Register::activation):
+        (JSC::Register::function):
+        (JSC::Register::propertyNameIterator):
+        (JSC::Register::scopeChain):
+        * jit/JIT.h:
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCallInitializeCallFrame):
+        (JSC::JIT::compileOpCallVarargs):
+        (JSC::JIT::compileOpCall):
+        * jit/JITCall32_64.cpp:
+        (JSC::JIT::compileOpCallInitializeCallFrame):
+        (JSC::JIT::compileOpCallVarargs):
+        (JSC::JIT::compileOpCall):
+        (JSC::JIT::compileOpCallSlowCase):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitPutToCallFrameHeader):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::privateCompileCTINativeCall):
+        (JSC::JIT::emit_op_get_pnames):
+        (JSC::JIT::emit_op_next_pname):
+        (JSC::JIT::emit_op_load_varargs):
+        (JSC::JIT::emitSlow_op_load_varargs):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::privateCompileCTINativeCall):
+        (JSC::JIT::emit_op_get_pnames):
+        (JSC::JIT::emit_op_next_pname):
+        * jit/JSInterfaceJIT.h:
+        (JSC::JSInterfaceJIT::payloadFor):
+        * jit/SpecializedThunkJIT.h:
+        (JSC::SpecializedThunkJIT::returnJSValue):
+        (JSC::SpecializedThunkJIT::returnDouble):
+        (JSC::SpecializedThunkJIT::returnInt32):
+        (JSC::SpecializedThunkJIT::returnJSCell):
+        * runtime/ArgList.cpp:
+        * runtime/DateConversion.cpp:
+        * runtime/GCActivityCallbackCF.cpp:
+        * runtime/Identifier.cpp:
+        * runtime/JSActivation.h:
+        (JSC::asActivation):
+        * runtime/JSLock.cpp:
+        * runtime/JSNumberCell.cpp:
+        * runtime/JSObject.h:
+        * runtime/JSPropertyNameIterator.h:
+        * runtime/JSValue.h:
+        * runtime/JSZombie.cpp:
+        * runtime/MarkedBlock.cpp:
+        * runtime/MarkedSpace.cpp:
+        * runtime/PropertyNameArray.cpp:
+        * runtime/ScopeChain.h:
+        (JSC::ExecState::globalThisValue):
+        * wtf/DateMath.cpp:
+
+2011-03-11  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Ensure all values are correctly tagged in the registerfile
+        https://bugs.webkit.org/show_bug.cgi?id=56214
+
+        This patch makes sure that all JSCell pointers written to
+        the registerfile are correctly tagged as JSCells, and replaces
+        raw int usage with the immediate representation.
+
+        For performance, register pressure, and general saneness reasons
+        I've added abstractions for reading and writing the tag
+        and payload of integer registers directly for the JSVALUE64
+        encoding.
+
+        * interpreter/Register.h:
+        (JSC::Register::withInt):
+        (JSC::Register::withCallee):
+        (JSC::Register::operator=):
+        (JSC::Register::i):
+        (JSC::Register::activation):
+        (JSC::Register::function):
+        (JSC::Register::propertyNameIterator):
+        (JSC::Register::scopeChain):
+        * jit/JIT.h:
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCallInitializeCallFrame):
+        (JSC::JIT::compileOpCallVarargs):
+        (JSC::JIT::compileOpCall):
+        * jit/JITCall32_64.cpp:
+        (JSC::JIT::compileOpCallInitializeCallFrame):
+        (JSC::JIT::compileOpCallVarargs):
+        (JSC::JIT::compileOpCall):
+        (JSC::JIT::compileOpCallSlowCase):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitPutToCallFrameHeader):
+        (JSC::JIT::emitPutCellToCallFrameHeader):
+        (JSC::JIT::emitPutIntToCallFrameHeader):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::privateCompileCTINativeCall):
+        (JSC::JIT::emit_op_get_pnames):
+        (JSC::JIT::emit_op_next_pname):
+        (JSC::JIT::emit_op_load_varargs):
+        (JSC::JIT::emitSlow_op_load_varargs):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::privateCompileCTINativeCall):
+        (JSC::JIT::emit_op_get_pnames):
+        (JSC::JIT::emit_op_next_pname):
+        * jit/JSInterfaceJIT.h:
+        (JSC::JSInterfaceJIT::intPayloadFor):
+        (JSC::JSInterfaceJIT::intTagFor):
+        * jit/SpecializedThunkJIT.h:
+        (JSC::SpecializedThunkJIT::returnJSValue):
+        (JSC::SpecializedThunkJIT::returnDouble):
+        (JSC::SpecializedThunkJIT::returnInt32):
+        (JSC::SpecializedThunkJIT::returnJSCell):
+
+2011-03-11  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Introduce project_dir variable and make paths a whole lot saner. Ok, a little bit saner.
+        https://bugs.webkit.org/show_bug.cgi?id=56231
+
+        * JavaScriptCore.gypi: Added project_dir variable.
+        * gyp/JavaScriptCore.gyp: Changed to use project_dir, rather than DEPTH/JavaScriptCore.
+        * gyp/generate-dtrace-header.sh: Changed to use project_dir.
+
+2011-03-11  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Start using derived sources correctly and link minidom with JavaScriptCore gyp project.
+        https://bugs.webkit.org/show_bug.cgi?id=56217
+
+        * gyp/JavaScriptCore.gyp: Added derived source files and passing of shared directory
+            to the scripts.
+        * gyp/generate-derived-sources.sh: Changed to use passed directory.
+        * gyp/generate-dtrace-header.sh: Ditto.
+
+2011-03-11  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        <rdar://problem/8955589> Adopt AVFoundation media back end on Lion.
+
+        No new tests, existing media tests cover this.
+
+        * JavaScriptCore.exp: Export cancelCallOnMainThread
+        * wtf/Platform.h: Define WTF_USE_AVFOUNDATION.
+
+2011-03-11  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Tweak dylib paths and add dtrace header generation action to JavaScriptCore gyp project.
+        https://bugs.webkit.org/show_bug.cgi?id=56207
+
+        * JavaScriptCore.gypi: Added Tracing.d to the sources.
+        * gyp/generate-dtrace-header.sh: Added.
+        * gyp/JavaScriptCore.gyp: Updated dylib paths (now the project can see them),
+            and added DTrace header generating step.
+
+2011-03-10  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Fix allocation of native function with a cached thunk
+        https://bugs.webkit.org/show_bug.cgi?id=56127
+
+        Fix this race condition found while fixing zombies.
+
+        * collector/handles/HandleHeap.cpp:
+        (JSC::HandleHeap::clearWeakPointers):
+        * runtime/Heap.cpp:
+        (JSC::Heap::reset):
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::JSFunction):
+        (JSC::JSFunction::markChildren):
+        * runtime/JSValue.h:
+        (JSC::JSValue::decode):
+        * runtime/JSZombie.cpp:
+        (JSC::JSZombie::leakedZombieStructure):
+        * runtime/JSZombie.h:
+        (JSC::JSZombie::createStructure):
+        * runtime/MarkedBlock.cpp:
+
+2011-03-10  Luiz Agostini  <luiz.agostini@openbossa.org>
+
+        Reviewed by Andreas Kling.
+
+        [Qt] fast/workers/stress-js-execution.html is crashing on Qt bot (intermittently)
+        https://bugs.webkit.org/show_bug.cgi?id=33008
+
+        Defining WTF_USE_PTHREAD_BASED_QT=1 for platforms where QThread uses pthread internally.
+        Symbian is excluded because pthread_kill does not work on it. Mac is excluded because
+        it has its own ways to do JSC threading.
+
+        Defining WTF_USE_PTHREADS inside MachineStackMarker.cpp if USE(PTHREAD_BASED_QT) is true.
+
+        * runtime/MachineStackMarker.cpp:
+        * wtf/Platform.h:
+
+2011-03-10  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 56077 - ES5 conformance issues with RegExp.prototype
+
+        There are three issues causing test failures in sputnik.
+
+        (1) lastIndex should be converted at the point it is used, not the point it is set (this is visible if valueOf is overridden).
+        (2) The 'length' property of the test/exec functions should be 1.
+        (3) If no input is specified, the input to test()/exec() is "undefined" (i.e. ToString(undefined)) - not RegExp.input.
+
+        * runtime/RegExpObject.cpp:
+        (JSC::RegExpObject::markChildren):
+            - Added to mark lastIndex
+        (JSC::regExpObjectLastIndex):
+        (JSC::setRegExpObjectLastIndex):
+            - lastIndex is now stored as a JSValue.
+        (JSC::RegExpObject::match):
+            - Use accessor methods to get/set lastIndex, add fast case for isUInt32 (don't convert to double).
+        * runtime/RegExpObject.h:
+        (JSC::RegExpObject::setLastIndex):
+        (JSC::RegExpObject::setLastIndex):
+            - Set lastIndex, either from a size_t or a JSValue.
+        (JSC::RegExpObject::getLastIndex):
+            - Get lastIndex.
+        (JSC::RegExpObject::RegExpObjectData::RegExpObjectData):
+            - Initialize as a JSValue.
+        * runtime/RegExpPrototype.cpp:
+        (JSC::RegExpPrototype::RegExpPrototype):
+            - Add test/exec properties with length 1.
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncMatch):
+        (JSC::stringProtoFuncSearch):
+            - Do not read RegExp.input if none is provided.
+        * tests/mozilla/js1_2/regexp/RegExp_input.js:
+        * tests/mozilla/js1_2/regexp/RegExp_input_as_array.js:
+            - Update these tests (they relied on non-ES5 behaviour).
+
+2011-03-10  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Rolled back in 80277 and 80280 with event handler layout test failures fixed.
+        https://bugs.webkit.org/show_bug.cgi?id=55653        
+
+        The failures were caused by a last minute typo: assigning to currentEvent
+        instead of m_currentEvent.
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecompiler/BytecodeGenerator.cpp:
+        * jit/JITOpcodes.cpp:
+        * jit/JITOpcodes32_64.cpp:
+        * runtime/Arguments.h:
+        * runtime/JSActivation.cpp:
+        * runtime/JSActivation.h:
+        * runtime/JSCell.h:
+        * runtime/JSGlobalObject.cpp:
+        * runtime/JSGlobalObject.h:
+        * runtime/JSObject.cpp:
+        * runtime/JSStaticScopeObject.cpp:
+        * runtime/JSStaticScopeObject.h:
+        * runtime/JSVariableObject.h:
+        * runtime/MarkedSpace.cpp:
+        * runtime/MarkedSpace.h:
+
+2011-03-09  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        jquery/manipulation.html fails after r80598
+        https://bugs.webkit.org/show_bug.cgi?id=56019
+
+        When linking a call, codeblock now takes ownership of the linked function
+        This removes the need for unlinking, and thus the incorrectness that was
+        showing up in these tests.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::~CodeBlock):
+        (JSC::CodeBlock::markAggregate):
+        * bytecode/CodeBlock.h:
+        (JSC::CallLinkInfo::CallLinkInfo):
+        (JSC::CallLinkInfo::setUnlinked):
+        (JSC::CodeBlock::addCaller):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompile):
+        (JSC::JIT::linkCall):
+        (JSC::JIT::linkConstruct):
+        * jit/JIT.h:
+        * runtime/Executable.cpp:
+        * runtime/Executable.h:
+
+2011-03-09  Daniel Bates  <dbates@rim.com>
+
+        Attempt to fix the WinCE build after changeset 80684 <http://trac.webkit.org/changeset/80684>
+        (Bug #56041<https://bugs.webkit.org/show_bug.cgi?id=56041>).
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute): Substitute variable callFrame for exec in call to createSyntaxError().
+
+2011-03-09  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Bug 56041 - RexExp constructor should only accept flags "gim"
+        Fix for issues introduced in r80667.
+
+        Invalid flags to a RegExp literal are a late syntax error!
+
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::addRegExp):
+            - Pass a PassRefPtr<RegExp>
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::addRegExp):
+        (JSC::BytecodeGenerator::emitNewRegExp):
+        * bytecompiler/BytecodeGenerator.h:
+            - Pass a PassRefPtr<RegExp>
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::RegExpNode::emitBytecode):
+            - Should not be ASSERTing that the flags are valid - this is a late(er) error.
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+            - Need to check for error from RegExp constructor.
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+            - Need to check for error from RegExp constructor.
+        * runtime/RegExp.h:
+        (JSC::RegExp::isValid):
+            - Make isValid check that the regexp was created with valid flags.
+        * runtime/RegExpKey.h:
+            - Since we'll not create RegExp objects with invalid flags, separate out the deleted value.
+
+2011-03-09  Gavin Barraclough  <barraclough@apple.com>
+
+        Windows build fix part 2.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2011-03-09  Gavin Barraclough  <barraclough@apple.com>
+
+        Windows build fix part 1.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2011-03-09  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Bug 56041 - RexExp constructor should only accept flags "gim"
+        We also should be passing the flags around as a bitfield rather than a string,
+        and should not have redundant, incompatible code for converting the string to a bitfield!
+
+        * JavaScriptCore.exp:
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::RegExpNode::emitBytecode):
+            - Need to parse flags string to enum.
+        * runtime/RegExp.cpp:
+        (JSC::regExpFlags):
+        (JSC::RegExp::RegExp):
+        (JSC::RegExp::create):
+            - Add method to parse flags string to enum, change constructor/create args to take enum.
+        * runtime/RegExp.h:
+        (JSC::RegExp::global):
+        (JSC::RegExp::ignoreCase):
+        (JSC::RegExp::multiline):
+            - Change to use new enum values.
+        * runtime/RegExpCache.cpp:
+        (JSC::RegExpCache::lookupOrCreate):
+        (JSC::RegExpCache::create):
+        * runtime/RegExpCache.h:
+            - Changed to use regExpFlags enum instead of int/const UString&.
+        * runtime/RegExpConstructor.cpp:
+        (JSC::constructRegExp):
+            - Add use new enum parsing, check for error.
+        * runtime/RegExpKey.h:
+        (JSC::RegExpKey::RegExpKey):
+        * runtime/RegExpPrototype.cpp:
+        (JSC::RegExpPrototype::RegExpPrototype):
+            - Pass NoFlags value instead of empty string.
+        (JSC::regExpProtoFuncCompile):
+            - Add use new enum parsing, check for error.
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncMatch):
+        (JSC::stringProtoFuncSearch):
+            - Pass NoFlags value instead of empty string.
+
+2011-03-08  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig
+
+        Bug 55994 - Functions on Array.prototype should check length first.
+        These methods are designed to work on generic objects too, and if 'length'
+        is a getter that throws an exception, ensure this is correctly thrown
+        (even if other exceptions would be thrown, too).
+
+        Make the length check the first thing we do.
+        This change shows a progression on SunSpider on my machine, but this is likely bogus.
+
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncToString):
+        (JSC::arrayProtoFuncToLocaleString):
+        (JSC::arrayProtoFuncJoin):
+        (JSC::arrayProtoFuncPop):
+        (JSC::arrayProtoFuncPush):
+        (JSC::arrayProtoFuncReverse):
+        (JSC::arrayProtoFuncShift):
+        (JSC::arrayProtoFuncSlice):
+        (JSC::arrayProtoFuncSort):
+        (JSC::arrayProtoFuncSplice):
+        (JSC::arrayProtoFuncUnShift):
+        (JSC::arrayProtoFuncFilter):
+        (JSC::arrayProtoFuncMap):
+        (JSC::arrayProtoFuncEvery):
+        (JSC::arrayProtoFuncForEach):
+        (JSC::arrayProtoFuncSome):
+        (JSC::arrayProtoFuncReduce):
+        (JSC::arrayProtoFuncReduceRight):
+        (JSC::arrayProtoFuncIndexOf):
+        (JSC::arrayProtoFuncLastIndexOf):
+
+2011-03-07  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Make CodeBlock GC write barrier safe
+        https://bugs.webkit.org/show_bug.cgi?id=55910
+
+        In order to make CodeBlock WriteBarrier safe it was necessary
+        to make it have a single GC owner, and for that reason I have
+        made ExecutableBase a GC allocated object.  This required
+        updating their creation routines as well as all sites that hold
+        a reference to them.  GC objects that held Executable's have been
+        converted to WriteBarriers, and all other sites now use Global<>.
+
+        As an added benefit this gets rid of JSGlobalData's list of
+        GlobalCodeBlocks.
+
+        Perf testing shows a 0.5% progression on v8, vs. a 0.3% regression
+        on SunSpider.  Given none of the tests that show regressions
+        demonstrate a regression on their own, and sampling shows up nothing.
+        I suspect we're just getting one or two additional gc passes at
+        the end of the run.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        (JSC::CodeBlock::CodeBlock):
+        (JSC::EvalCodeCache::markAggregate):
+        (JSC::CodeBlock::markAggregate):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::ownerExecutable):
+        (JSC::CodeBlock::addConstant):
+        (JSC::CodeBlock::constantRegister):
+        (JSC::CodeBlock::getConstant):
+        (JSC::CodeBlock::addFunctionDecl):
+        (JSC::CodeBlock::addFunctionExpr):
+        (JSC::GlobalCodeBlock::GlobalCodeBlock):
+        (JSC::ExecState::r):
+        * bytecode/EvalCodeCache.h:
+        (JSC::EvalCodeCache::get):
+        * bytecode/SamplingTool.h:
+        (JSC::ScriptSampleRecord::ScriptSampleRecord):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::addConstantValue):
+        (JSC::BytecodeGenerator::emitEqualityOp):
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::makeFunction):
+        * debugger/Debugger.cpp:
+        (JSC::evaluateInGlobalCallFrame):
+        * debugger/DebuggerCallFrame.cpp:
+        (JSC::DebuggerCallFrame::evaluate):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::callEval):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitLoadDouble):
+        (JSC::JIT::emitLoadInt32ToDouble):
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::JITThunks):
+        (JSC::JITThunks::hostFunctionStub):
+        (JSC::JITThunks::clearHostFunctionStubs):
+        * jit/JITStubs.h:
+        * runtime/Completion.cpp:
+        (JSC::checkSyntax):
+        (JSC::evaluate):
+        * runtime/Executable.cpp:
+        (JSC::EvalExecutable::EvalExecutable):
+        (JSC::ProgramExecutable::ProgramExecutable):
+        (JSC::FunctionExecutable::FunctionExecutable):
+        (JSC::FunctionExecutable::~FunctionExecutable):
+        (JSC::EvalExecutable::markChildren):
+        (JSC::ProgramExecutable::markChildren):
+        (JSC::FunctionExecutable::markChildren):
+        (JSC::FunctionExecutable::fromGlobalCode):
+        * runtime/Executable.h:
+        (JSC::ExecutableBase::ExecutableBase):
+        (JSC::ExecutableBase::createStructure):
+        (JSC::NativeExecutable::create):
+        (JSC::NativeExecutable::NativeExecutable):
+        (JSC::VPtrHackExecutable::VPtrHackExecutable):
+        (JSC::ScriptExecutable::ScriptExecutable):
+        (JSC::EvalExecutable::create):
+        (JSC::EvalExecutable::createStructure):
+        (JSC::ProgramExecutable::create):
+        (JSC::ProgramExecutable::createStructure):
+        (JSC::FunctionExecutable::create):
+        (JSC::FunctionExecutable::createStructure):
+        * runtime/FunctionConstructor.cpp:
+        (JSC::constructFunction):
+        * runtime/Heap.cpp:
+        (JSC::Heap::destroy):
+        (JSC::Heap::markRoots):
+        * runtime/Heap.h:
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::JSActivation):
+        (JSC::JSActivation::markChildren):
+        * runtime/JSActivation.h:
+        (JSC::JSActivation::JSActivationData::JSActivationData):
+        * runtime/JSCell.h:
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::JSFunction):
+        (JSC::JSFunction::~JSFunction):
+        (JSC::JSFunction::markChildren):
+        * runtime/JSFunction.h:
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::storeVPtrs):
+        (JSC::JSGlobalData::JSGlobalData):
+        (JSC::JSGlobalData::getHostFunction):
+        * runtime/JSGlobalData.h:
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncEval):
+        * runtime/JSObject.cpp:
+        * runtime/JSStaticScopeObject.cpp:
+        (JSC::JSStaticScopeObject::markChildren):
+        * runtime/JSStaticScopeObject.h:
+        (JSC::JSStaticScopeObject::JSStaticScopeObjectData::JSStaticScopeObjectData):
+        (JSC::JSStaticScopeObject::JSStaticScopeObject):
+        * runtime/JSZombie.cpp:
+        (JSC::JSZombie::leakedZombieStructure):
+        * runtime/JSZombie.h:
+        (JSC::JSZombie::createStructure):
+        * runtime/MarkedSpace.h:
+
+2011-03-07  Andy Estes  <aestes@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        REGRESSION (r79060): Timestamp is missing from tweets in twitter.
+        https://bugs.webkit.org/show_bug.cgi?id=55228
+
+        A change to the date parser to handle the case where the year is
+        specified before the time zone inadvertently started accepting strings
+        such as '+0000' as valid years. Those strings actually represent time
+        zones in an offset of hours and minutes from UTC, not years.
+
+        * wtf/DateMath.cpp:
+        (WTF::parseDateFromNullTerminatedCharacters): If the current character
+        in dateString is '+' or '-', do not try to parse the next token as a
+        year.
+
 2011-03-06  Yuta Kitamura  <yutak@chromium.org>
 
         Reviewed by Kent Tamura.
diff --git a/Source/JavaScriptCore/Configurations/Base.xcconfig b/Source/JavaScriptCore/Configurations/Base.xcconfig
index 8d91d70..12d0efd 100644
--- a/Source/JavaScriptCore/Configurations/Base.xcconfig
+++ b/Source/JavaScriptCore/Configurations/Base.xcconfig
@@ -25,7 +25,6 @@ DEBUG_INFORMATION_FORMAT = dwarf;
 GCC_C_LANGUAGE_STANDARD = gnu99;
 GCC_DEBUGGING_SYMBOLS = default;
 GCC_DYNAMIC_NO_PIC = NO;
-GCC_ENABLE_CPP_EXCEPTIONS = NO;
 GCC_ENABLE_CPP_RTTI = NO;
 GCC_ENABLE_OBJC_EXCEPTIONS = YES;
 GCC_ENABLE_OBJC_GC = $(GCC_ENABLE_OBJC_GC_$(REAL_PLATFORM_NAME));
@@ -118,12 +117,23 @@ TARGET_GCC_VERSION_macosx_1050_ = $(TARGET_GCC_VERSION_macosx_1050_$(XCODE_VERSI
 TARGET_GCC_VERSION_macosx_1050_0310 = GCC_42;
 TARGET_GCC_VERSION_macosx_1050_0320 = GCC_42;
 TARGET_GCC_VERSION_macosx_1060 = GCC_42;
-TARGET_GCC_VERSION_macosx_1070 = LLVM_GCC_42;
+TARGET_GCC_VERSION_macosx_1070 = $(TARGET_GCC_VERSION_macosx_1070_$(CONFIGURATION));
+TARGET_GCC_VERSION_macosx_1070_Debug = LLVM_COMPILER;
+TARGET_GCC_VERSION_macosx_1070_Release = LLVM_GCC_42;
+TARGET_GCC_VERSION_macosx_1070_Production = LLVM_GCC_42;
 
 GCC_VERSION = $(GCC_VERSION_$(TARGET_GCC_VERSION));
 GCC_VERSION_GCC_40 = 4.0;
 GCC_VERSION_GCC_42 = 4.2;
 GCC_VERSION_LLVM_GCC_42 = com.apple.compilers.llvmgcc42;
+GCC_VERSION_LLVM_COMPILER = com.apple.compilers.llvm.clang.1_0;
+
+// FIXME: Disable C++ exceptions in the LLVM Compiler once it supports enabling Obj-C exceptions without C++ exceptions.
+GCC_ENABLE_CPP_EXCEPTIONS = $(GCC_ENABLE_CPP_EXCEPTIONS_$(TARGET_GCC_VERSION));
+GCC_ENABLE_CPP_EXCEPTIONS_GCC_40 = NO;
+GCC_ENABLE_CPP_EXCEPTIONS_GCC_42 = NO;
+GCC_ENABLE_CPP_EXCEPTIONS_LLVM_GCC = NO;
+GCC_ENABLE_CPP_EXCEPTIONS_LLVM_COMPILER = YES;
 
 // If the target Mac OS X version does not match the current Mac OS X version then we'll want to build using the target version's SDK.
 SDKROOT = $(SDKROOT_$(MAC_OS_X_VERSION_MAJOR)_$(TARGET_MAC_OS_X_VERSION_MAJOR));
diff --git a/Source/JavaScriptCore/Configurations/Version.xcconfig b/Source/JavaScriptCore/Configurations/Version.xcconfig
index ae9167c..59988e3 100644
--- a/Source/JavaScriptCore/Configurations/Version.xcconfig
+++ b/Source/JavaScriptCore/Configurations/Version.xcconfig
@@ -22,7 +22,7 @@
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 
 MAJOR_VERSION = 534;
-MINOR_VERSION = 24;
+MINOR_VERSION = 27;
 TINY_VERSION = 0;
 FULL_VERSION = $(MAJOR_VERSION).$(MINOR_VERSION);
 
diff --git a/Source/JavaScriptCore/DerivedSources.make b/Source/JavaScriptCore/DerivedSources.make
index 8abb17c..9a8c2cc 100644
--- a/Source/JavaScriptCore/DerivedSources.make
+++ b/Source/JavaScriptCore/DerivedSources.make
@@ -84,7 +84,6 @@ HeaderDetection.h : DerivedSources.make /System/Library/CoreServices/SystemVersi
 	rm -f $@
 	echo "/* This is a generated file. Do not edit. */" > $@
 	if [ -f $(SDKROOT)/System/Library/Frameworks/System.framework/PrivateHeaders/pthread_machdep.h ]; then echo "#define HAVE_PTHREAD_MACHDEP_H 1" >> $@; else echo >> $@; fi
-	if [ -f $(SDKROOT)/System/Library/Frameworks/AppKit.framework/PrivateHeaders/NSScrollerImpPair_Private.h ]; then echo "#define USE_WK_SCROLLBAR_PAINTER_AND_CONTROLLER 1" >> $@; else echo >> $@; fi
 
 else
 
diff --git a/Source/JavaScriptCore/GNUmakefile.am b/Source/JavaScriptCore/GNUmakefile.am
index 977cb18..31e70a0 100644
--- a/Source/JavaScriptCore/GNUmakefile.am
+++ b/Source/JavaScriptCore/GNUmakefile.am
@@ -115,6 +115,10 @@ javascriptcore_sources += \
 	Source/JavaScriptCore/collector/handles/Handle.h \
 	Source/JavaScriptCore/collector/handles/HandleHeap.cpp \
 	Source/JavaScriptCore/collector/handles/HandleHeap.h \
+	Source/JavaScriptCore/collector/handles/HandleStack.cpp \
+	Source/JavaScriptCore/collector/handles/HandleStack.h \
+	Source/JavaScriptCore/collector/handles/Local.h \
+	Source/JavaScriptCore/collector/handles/LocalScope.h \
 	Source/JavaScriptCore/config.h \
 	Source/JavaScriptCore/debugger/DebuggerActivation.cpp \
 	Source/JavaScriptCore/debugger/DebuggerActivation.h \
@@ -468,6 +472,7 @@ javascriptcore_sources += \
 	Source/JavaScriptCore/wtf/HashTable.cpp \
 	Source/JavaScriptCore/wtf/HashTable.h \
 	Source/JavaScriptCore/wtf/HashTraits.h \
+	Source/JavaScriptCore/wtf/HexNumber.h \
 	Source/JavaScriptCore/wtf/ListHashSet.h \
 	Source/JavaScriptCore/wtf/ListRefPtr.h \
 	Source/JavaScriptCore/wtf/Locker.h \
@@ -549,7 +554,7 @@ javascriptcore_sources += \
 	Source/JavaScriptCore/wtf/Threading.h \
 	Source/JavaScriptCore/wtf/ThreadingPrimitives.h \
 	Source/JavaScriptCore/wtf/ThreadingPthreads.cpp \
-	Source/JavaScriptCore/wtf/ThreadSafeShared.h \
+	Source/JavaScriptCore/wtf/ThreadSafeRefCounted.h \
 	Source/JavaScriptCore/wtf/ThreadSpecific.h \
 	Source/JavaScriptCore/wtf/TypeTraits.cpp \
 	Source/JavaScriptCore/wtf/TypeTraits.h \
diff --git a/Source/JavaScriptCore/JavaScriptCore.exp b/Source/JavaScriptCore/JavaScriptCore.exp
index 914c2ac..e2647d1 100644
--- a/Source/JavaScriptCore/JavaScriptCore.exp
+++ b/Source/JavaScriptCore/JavaScriptCore.exp
@@ -1,4 +1,3 @@
-__ZN3JSC22objectConstructorTableE
 _JSCheckScriptSyntax
 _JSClassCreate
 _JSClassRelease
@@ -114,15 +113,15 @@ __ZN3JSC10JSFunction6s_infoE
 __ZN3JSC10throwErrorEPNS_9ExecStateENS_7JSValueE
 __ZN3JSC10throwErrorEPNS_9ExecStateEPNS_8JSObjectE
 __ZN3JSC11JSByteArray13s_defaultInfoE
-__ZN3JSC11JSByteArray15createStructureENS_7JSValueEPKNS_9ClassInfoE
+__ZN3JSC11JSByteArray15createStructureERNS_12JSGlobalDataENS_7JSValueEPKNS_9ClassInfoE
 __ZN3JSC11JSByteArrayC1EPNS_9ExecStateEN3WTF17NonNullPassRefPtrINS_9StructureEEEPNS3_9ByteArrayE
 __ZN3JSC11MarkedSpace21allocateFromSizeClassERNS0_9SizeClassE
 __ZN3JSC11ParserArena5resetEv
 __ZN3JSC11checkSyntaxEPNS_9ExecStateERKNS_10SourceCodeE
 __ZN3JSC11createErrorEPNS_9ExecStateERKNS_7UStringE
+__ZN3JSC11regExpFlagsERKNS_7UStringE
 __ZN3JSC12DateInstance6s_infoE
 __ZN3JSC12DateInstanceC1EPNS_9ExecStateEN3WTF17NonNullPassRefPtrINS_9StructureEEEd
-__ZN3JSC12DateInstanceC1EPNS_9ExecStateEd
 __ZN3JSC12JSGlobalData10ClientDataD2Ev
 __ZN3JSC12JSGlobalData11jsArrayVPtrE
 __ZN3JSC12JSGlobalData12createLeakedENS_15ThreadStackTypeE
@@ -159,11 +158,11 @@ __ZN3JSC14JSGlobalObject12defineGetterEPNS_9ExecStateERKNS_10IdentifierEPNS_8JSO
 __ZN3JSC14JSGlobalObject12defineSetterEPNS_9ExecStateERKNS_10IdentifierEPNS_8JSObjectEj
 __ZN3JSC14JSGlobalObject12markChildrenERNS_9MarkStackE
 __ZN3JSC14JSGlobalObject17putWithAttributesEPNS_9ExecStateERKNS_10IdentifierENS_7JSValueEj
-__ZN3JSC14JSGlobalObject25destroyJSGlobalObjectDataEPv
 __ZN3JSC14JSGlobalObject3putEPNS_9ExecStateERKNS_10IdentifierENS_7JSValueERNS_15PutPropertySlotE  
 __ZN3JSC14JSGlobalObject4initEPNS_8JSObjectE
 __ZN3JSC14JSGlobalObjectD2Ev
 __ZN3JSC14JSGlobalObjectnwEmPNS_12JSGlobalDataE
+__ZN3JSC14MachineThreads16addCurrentThreadEv
 __ZN3JSC14SamplingThread4stopEv
 __ZN3JSC14SamplingThread5startEj
 __ZN3JSC14TimeoutChecker10didTimeOutEPNS_9ExecStateE
@@ -182,10 +181,9 @@ __ZN3JSC16createRangeErrorEPNS_9ExecStateERKNS_7UStringE
 __ZN3JSC16throwSyntaxErrorEPNS_9ExecStateE
 __ZN3JSC17BytecodeGenerator21setDumpsGeneratedCodeEb
 __ZN3JSC17PropertyNameArray3addEPN3WTF10StringImplE
-__ZN3JSC17constructFunctionEPNS_9ExecStateERKNS_7ArgListERKNS_10IdentifierERKNS_7UStringEi
+__ZN3JSC17constructFunctionEPNS_9ExecStateEPNS_14JSGlobalObjectERKNS_7ArgListERKNS_10IdentifierERKNS_7UStringEi
 __ZN3JSC17createSyntaxErrorEPNS_9ExecStateERKNS_7UStringE
 __ZN3JSC18DebuggerActivationC1ERNS_12JSGlobalDataEPNS_8JSObjectE
-__ZN3JSC18MachineStackMarker14registerThreadEv
 __ZN3JSC18PropertyDescriptor11setWritableEb
 __ZN3JSC18PropertyDescriptor12setUndefinedEv
 __ZN3JSC18PropertyDescriptor13setDescriptorENS_7JSValueEj
@@ -201,13 +199,13 @@ __ZN3JSC19initializeThreadingEv
 __ZN3JSC20MarkedArgumentBuffer10slowAppendENS_7JSValueE
 __ZN3JSC20createReferenceErrorEPNS_9ExecStateERKNS_7UStringE
 __ZN3JSC22globalMemoryStatisticsEv
+__ZN3JSC22objectConstructorTableE
 __ZN3JSC23AbstractSamplingCounter4dumpEv
 __ZN3JSC23objectProtoFuncToStringEPNS_9ExecStateE
 __ZN3JSC23setUpStaticFunctionSlotEPNS_9ExecStateEPKNS_9HashEntryEPNS_8JSObjectERKNS_10IdentifierERNS_12PropertySlotE
-__ZN3JSC24DynamicGlobalObjectScopeC1EPNS_9ExecStateEPNS_14JSGlobalObjectE
+__ZN3JSC24DynamicGlobalObjectScopeC1ERNS_12JSGlobalDataEPNS_14JSGlobalObjectE
 __ZN3JSC24JSObjectWithGlobalObjectC2EPNS_14JSGlobalObjectEN3WTF17NonNullPassRefPtrINS_9StructureEEE
 __ZN3JSC24createStackOverflowErrorEPNS_9ExecStateE
-__ZN3JSC24createStackOverflowErrorEPNS_9ExecStateE
 __ZN3JSC25evaluateInGlobalCallFrameERKNS_7UStringERNS_7JSValueEPNS_14JSGlobalObjectE
 __ZN3JSC35createInterruptedExecutionExceptionEPNS_12JSGlobalDataE
 __ZN3JSC3NaNE
@@ -248,7 +246,7 @@ __ZN3JSC6JSLock4lockENS_14JSLockBehaviorE
 __ZN3JSC6JSLock6unlockENS_14JSLockBehaviorE
 __ZN3JSC6JSLock9lockCountEv
 __ZN3JSC6JSLockC1EPNS_9ExecStateE
-__ZN3JSC6RegExp6createEPNS_12JSGlobalDataERKNS_7UStringES5_
+__ZN3JSC6RegExp6createEPNS_12JSGlobalDataERKNS_7UStringENS_11RegExpFlagsE
 __ZN3JSC6RegExpD1Ev
 __ZN3JSC7JSArray12markChildrenERNS_9MarkStackE
 __ZN3JSC7JSArray15setSubclassDataEPv
@@ -287,7 +285,6 @@ __ZN3JSC8JSObject14deletePropertyEPNS_9ExecStateERKNS_10IdentifierE
 __ZN3JSC8JSObject14deletePropertyEPNS_9ExecStateEj
 __ZN3JSC8JSObject15unwrappedObjectEv
 __ZN3JSC8JSObject16getPropertyNamesEPNS_9ExecStateERNS_17PropertyNameArrayENS_15EnumerationModeE
-__ZN3JSC8JSObject17createInheritorIDEv
 __ZN3JSC8JSObject17defineOwnPropertyEPNS_9ExecStateERKNS_10IdentifierERNS_18PropertyDescriptorEb
 __ZN3JSC8JSObject17putDirectFunctionEPNS_9ExecStateEPNS_10JSFunctionEj
 __ZN3JSC8JSObject17putDirectFunctionEPNS_9ExecStateEPNS_16InternalFunctionEj
@@ -387,6 +384,7 @@ __ZN3WTF12createThreadEPFPvS0_ES0_PKc
 __ZN3WTF12detachThreadEj
 __ZN3WTF12isMainThreadEv
 __ZN3WTF12randomNumberEv
+__ZN3WTF13StringBuilder15reserveCapacityEj
 __ZN3WTF13StringBuilder11reifyStringEv
 __ZN3WTF13StringBuilder11shrinkToFitEv
 __ZN3WTF13StringBuilder6appendEPKcj
@@ -431,6 +429,7 @@ __ZN3WTF21RefCountedLeakCounter9incrementEv
 __ZN3WTF21RefCountedLeakCounterC1EPKc
 __ZN3WTF21RefCountedLeakCounterD1Ev
 __ZN3WTF21charactersToIntStrictEPKtmPbi
+__ZN3WTF22cancelCallOnMainThreadEPFvPvES0_
 __ZN3WTF22charactersToUIntStrictEPKtmPbi
 __ZN3WTF23callOnMainThreadAndWaitEPFvPvES0_
 __ZN3WTF23dayInMonthFromDayInYearEib
@@ -446,10 +445,10 @@ __ZN3WTF39initializeMainThreadToProcessMainThreadEv
 __ZN3WTF3MD58addBytesEPKhm
 __ZN3WTF3MD58checksumERNS_6VectorIhLm16EEE
 __ZN3WTF3MD5C1Ev
-__ZN3WTF4dtoaEPcdRbRiRj
 __ZN3WTF4SHA111computeHashERNS_6VectorIhLm20EEE
 __ZN3WTF4SHA18addBytesEPKhm
 __ZN3WTF4SHA1C1Ev
+__ZN3WTF4dtoaEPcdRbRiRj
 __ZN3WTF5Mutex4lockEv
 __ZN3WTF5Mutex6unlockEv
 __ZN3WTF5Mutex7tryLockEv
@@ -535,7 +534,7 @@ __ZNK3JSC6JSCell11toPrimitiveEPNS_9ExecStateENS_22PreferredPrimitiveTypeE
 __ZNK3JSC6JSCell12toThisObjectEPNS_9ExecStateE
 __ZNK3JSC6JSCell14isGetterSetterEv
 __ZNK3JSC6JSCell8toNumberEPNS_9ExecStateE
-__ZNK3JSC6JSCell8toObjectEPNS_9ExecStateE
+__ZNK3JSC6JSCell8toObjectEPNS_9ExecStateEPNS_14JSGlobalObjectE
 __ZNK3JSC6JSCell8toStringEPNS_9ExecStateE
 __ZNK3JSC6JSCell9getStringEPNS_9ExecStateE
 __ZNK3JSC6JSCell9getStringEPNS_9ExecStateERNS_7UStringE
@@ -543,7 +542,7 @@ __ZNK3JSC6JSCell9getUInt32ERj
 __ZNK3JSC6JSCell9toBooleanEPNS_9ExecStateE
 __ZNK3JSC7ArgList8getSliceEiRS0_
 __ZNK3JSC7JSArray12subclassDataEv
-__ZNK3JSC7JSValue16toObjectSlowCaseEPNS_9ExecStateE
+__ZNK3JSC7JSValue16toObjectSlowCaseEPNS_9ExecStateEPNS_14JSGlobalObjectE
 __ZNK3JSC7JSValue19synthesizePrototypeEPNS_9ExecStateE
 __ZNK3JSC7JSValue20toThisObjectSlowCaseEPNS_9ExecStateE
 __ZNK3JSC7JSValue9toIntegerEPNS_9ExecStateE
@@ -556,7 +555,7 @@ __ZNK3JSC8JSObject12defaultValueEPNS_9ExecStateENS_22PreferredPrimitiveTypeE
 __ZNK3JSC8JSObject12toThisObjectEPNS_9ExecStateE
 __ZNK3JSC8JSObject18toStrictThisObjectEPNS_9ExecStateE
 __ZNK3JSC8JSObject8toNumberEPNS_9ExecStateE
-__ZNK3JSC8JSObject8toObjectEPNS_9ExecStateE
+__ZNK3JSC8JSObject8toObjectEPNS_9ExecStateEPNS_14JSGlobalObjectE
 __ZNK3JSC8JSObject8toStringEPNS_9ExecStateE
 __ZNK3JSC8JSObject9classNameEv
 __ZNK3JSC8JSObject9toBooleanEPNS_9ExecStateE
diff --git a/Source/JavaScriptCore/JavaScriptCore.gypi b/Source/JavaScriptCore/JavaScriptCore.gypi
index 292473c..cb93a29 100644
--- a/Source/JavaScriptCore/JavaScriptCore.gypi
+++ b/Source/JavaScriptCore/JavaScriptCore.gypi
@@ -1,5 +1,6 @@
 {
     'variables': {
+        'project_dir': ['.'],
         # These headers are part of JavaScriptCore's public API in the Apple Mac build.
         'javascriptcore_publicheader_files': [
             'API/JSBase.h',
@@ -29,6 +30,9 @@
             'collector/handles/Global.h',
             'collector/handles/Handle.h',
             'collector/handles/HandleHeap.h',
+            'collector/handles/HandleStack.h',
+            'collector/handles/Local.h',
+            'collector/handles/LocalScope.h',
             'config.h',
             'debugger/Debugger.h',
             'debugger/DebuggerActivation.h',
@@ -64,6 +68,7 @@
             'runtime/ExceptionHelpers.h',
             'runtime/FunctionConstructor.h',
             'runtime/FunctionPrototype.h',
+            'runtime/GCActivityCallback.h',
             'runtime/Heap.h',
             'runtime/Identifier.h',
             'runtime/InitializeThreading.h',
@@ -105,7 +110,9 @@
             'runtime/Protect.h',
             'runtime/PutPropertySlot.h',
             'runtime/RegExp.h',
+            'runtime/RegExpKey.h',
             'runtime/RegExpCache.h',
+            'runtime/RegExpObject.h',
             'runtime/RopeImpl.h',
             'runtime/ScopeChain.h',
             'runtime/SmallStrings.h',
@@ -157,6 +164,7 @@
             'wtf/HashSet.h',
             'wtf/HashTable.h',
             'wtf/HashTraits.h',
+            'wtf/HexNumber.h',
             'wtf/ListHashSet.h',
             'wtf/ListRefPtr.h',
             'wtf/Locker.h',
@@ -195,7 +203,7 @@
             'wtf/StdLibExtras.h',
             'wtf/StringExtras.h',
             'wtf/StringHasher.h',
-            'wtf/ThreadSafeShared.h',
+            'wtf/ThreadSafeRefCounted.h',
             'wtf/ThreadSpecific.h',
             'wtf/Threading.h',
             'wtf/ThreadingPrimitives.h',
@@ -303,9 +311,29 @@
             'bytecompiler/NodesCodegen.cpp',
             'bytecompiler/RegisterID.h',
             'collector/handles/HandleHeap.cpp',
+            'collector/handles/HandleStack.cpp',
             'debugger/Debugger.cpp',
             'debugger/DebuggerActivation.cpp',
             'debugger/DebuggerCallFrame.cpp',
+            'dfg/DFGAliasTracker.h',
+            'dfg/DFGByteCodeParser.cpp',
+            'dfg/DFGByteCodeParser.h',
+            'dfg/DFGGenerationInfo.h',
+            'dfg/DFGGraph.cpp',
+            'dfg/DFGGraph.h',
+            'dfg/DFGJITCodeGenerator.cpp',
+            'dfg/DFGJITCodeGenerator.h',
+            'dfg/DFGJITCompiler.cpp',
+            'dfg/DFGJITCompiler.h',
+            'dfg/DFGNode.h',
+            'dfg/DFGNonSpeculativeJIT.cpp',
+            'dfg/DFGNonSpeculativeJIT.h',
+            'dfg/DFGOperations.cpp',
+            'dfg/DFGOperations.h',
+            'dfg/DFGRegisterBank.h',
+            'dfg/DFGScoreBoard.h',
+            'dfg/DFGSpeculativeJIT.cpp',
+            'dfg/DFGSpeculativeJIT.h',
             'icu/unicode/parseerr.h',
             'icu/unicode/platform.h',
             'icu/unicode/putil.h',
@@ -351,6 +379,10 @@
             'jit/JSInterfaceJIT.h',
             'jit/SpecializedThunkJIT.h',
             'jit/ThunkGenerators.cpp',
+            'os-win32/WinMain.cpp',
+            'os-win32/inttypes.h',
+            'os-win32/stdbool.h',
+            'os-win32/stdint.h',
             'parser/ASTBuilder.h',
             'parser/JSParser.cpp',
             'parser/JSParser.h',
@@ -447,7 +479,6 @@
             'runtime/FunctionConstructor.cpp',
             'runtime/FunctionPrototype.cpp',
             'runtime/GCActivityCallback.cpp',
-            'runtime/GCActivityCallback.h',
             'runtime/GCActivityCallbackCF.cpp',
             'runtime/GetterSetter.cpp',
             'runtime/GetterSetter.h',
@@ -517,10 +548,8 @@
             'runtime/RegExpCache.cpp',
             'runtime/RegExpConstructor.cpp',
             'runtime/RegExpConstructor.h',
-            'runtime/RegExpKey.h',
             'runtime/RegExpMatchesArray.h',
             'runtime/RegExpObject.cpp',
-            'runtime/RegExpObject.h',
             'runtime/RegExpPrototype.cpp',
             'runtime/RegExpPrototype.h',
             'runtime/RopeImpl.cpp',
@@ -538,6 +567,7 @@
             'runtime/Structure.cpp',
             'runtime/StructureChain.cpp',
             'runtime/TimeoutChecker.cpp',
+            'runtime/Tracing.d',
             'runtime/Tracing.h',
             'runtime/UString.cpp',
             'runtime/UStringConcatenate.h',
@@ -564,9 +594,9 @@
             'wtf/RandomNumber.cpp',
             'wtf/RandomNumberSeed.h',
             'wtf/RefCountedLeakCounter.cpp',
-            'wtf/SegmentedVector.h',
             'wtf/SHA1.cpp',
             'wtf/SHA1.h',
+            'wtf/SegmentedVector.h',
             'wtf/SizeLimits.cpp',
             'wtf/StackBounds.cpp',
             'wtf/StringExtras.cpp',
@@ -656,13 +686,20 @@
             'yarr/YarrSyntaxChecker.cpp',
             'yarr/YarrSyntaxChecker.h',
         ],
-        # These files are separate from javascriptcore_files so we can use a
-        # header map in the Apple Mac Xcode build.
-        'os_win32_files': [
-            'os-win32/WinMain.cpp',
-            'os-win32/inttypes.h',
-            'os-win32/stdbool.h',
-            'os-win32/stdint.h',
+        'javascriptcore_derived_source_files': [
+            '<(PRODUCT_DIR)/DerivedSources/JavaScriptCore/ArrayPrototype.lut.h',
+            '<(PRODUCT_DIR)/DerivedSources/JavaScriptCore/DatePrototype.lut.h',
+            '<(PRODUCT_DIR)/DerivedSources/JavaScriptCore/HeaderDetection.h',
+            '<(PRODUCT_DIR)/DerivedSources/JavaScriptCore/JSONObject.lut.h',
+            '<(PRODUCT_DIR)/DerivedSources/JavaScriptCore/Lexer.lut.h',
+            '<(PRODUCT_DIR)/DerivedSources/JavaScriptCore/MathObject.lut.h',
+            '<(PRODUCT_DIR)/DerivedSources/JavaScriptCore/NumberConstructor.lut.h',
+            '<(PRODUCT_DIR)/DerivedSources/JavaScriptCore/RegExpConstructor.lut.h',
+            '<(PRODUCT_DIR)/DerivedSources/JavaScriptCore/RegExpJitTables.h',
+            '<(PRODUCT_DIR)/DerivedSources/JavaScriptCore/RegExpObject.lut.h',
+            '<(PRODUCT_DIR)/DerivedSources/JavaScriptCore/StringPrototype.lut.h',
+            '<(PRODUCT_DIR)/DerivedSources/JavaScriptCore/TracingDtrace.h',
+            '<(PRODUCT_DIR)/DerivedSources/JavaScriptCore/ObjectConstructor.lut.h',
         ],
         'minidom_files': [
             'API/tests/JSNode.c',
diff --git a/Source/JavaScriptCore/JavaScriptCore.pri b/Source/JavaScriptCore/JavaScriptCore.pri
index 391c74f..941a708 100644
--- a/Source/JavaScriptCore/JavaScriptCore.pri
+++ b/Source/JavaScriptCore/JavaScriptCore.pri
@@ -26,6 +26,7 @@ JAVASCRIPTCORE_INCLUDEPATH = \
     $$PWD/bytecode \
     $$PWD/bytecompiler \
     $$PWD/collector/handles \
+    $$PWD/dfg \
     $$PWD/debugger \
     $$PWD/interpreter \
     $$PWD/jit \
diff --git a/Source/JavaScriptCore/JavaScriptCore.pro b/Source/JavaScriptCore/JavaScriptCore.pro
index e41f04d..80ad3e8 100644
--- a/Source/JavaScriptCore/JavaScriptCore.pro
+++ b/Source/JavaScriptCore/JavaScriptCore.pro
@@ -69,10 +69,18 @@ SOURCES += \
     bytecode/StructureStubInfo.cpp \
     bytecompiler/BytecodeGenerator.cpp \
     bytecompiler/NodesCodegen.cpp \
+    collector/handles/HandleHeap.cpp \
+    collector/handles/HandleStack.cpp \
     debugger/DebuggerActivation.cpp \
     debugger/DebuggerCallFrame.cpp \
     debugger/Debugger.cpp \
-    collector/handles/HandleHeap.cpp \
+    dfg/DFGByteCodeParser.cpp \
+    dfg/DFGGraph.cpp \
+    dfg/DFGJITCodeGenerator.cpp \
+    dfg/DFGJITCompiler.cpp \
+    dfg/DFGNonSpeculativeJIT.cpp \
+    dfg/DFGOperations.cpp \
+    dfg/DFGSpeculativeJIT.cpp \
     interpreter/CallFrame.cpp \
     interpreter/Interpreter.cpp \
     interpreter/RegisterFile.cpp \
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore.make b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore.make
index 68075f9..b5461e4 100644
--- a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore.make
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore.make
@@ -5,7 +5,6 @@ BUILDSTYLE=Release_PGO
 !ENDIF
 
 install:
-    set PRODUCTION=1
     set WebKitLibrariesDir=$(SRCROOT)\AppleInternal
     set WebKitOutputDir=$(OBJROOT)
 	set ConfigurationBuildDir=$(OBJROOT)\$(BUILDSTYLE)
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore.sln b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore.sln
index a4832ed..0b610e2 100644
--- a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore.sln
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore.sln
@@ -22,7 +22,7 @@ Global
 	GlobalSection(SolutionConfigurationPlatforms) = preSolution
 		Debug_All|Win32 = Debug_All|Win32
 		Debug|Win32 = Debug|Win32
-		Release_LTCG|Win32 = Release_LTCG|Win32
+		Production|Win32 = Production|Win32
 		Release_PGO_Optimize|Win32 = Release_PGO_Optimize|Win32
 		Release_PGO|Win32 = Release_PGO|Win32
 		Release|Win32 = Release|Win32
@@ -32,8 +32,8 @@ Global
 		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Debug_All|Win32.Build.0 = Debug_All|Win32
 		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Debug|Win32.ActiveCfg = Debug|Win32
 		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Debug|Win32.Build.0 = Debug|Win32
-		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Release_LTCG|Win32.ActiveCfg = Release_LTCG|Win32
-		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Release_LTCG|Win32.Build.0 = Release_LTCG|Win32
+		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Production|Win32.ActiveCfg = Production|Win32
+		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Production|Win32.Build.0 = Production|Win32
 		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Release_PGO_Optimize|Win32.ActiveCfg = Release_PGO_Optimize|Win32
 		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Release_PGO_Optimize|Win32.Build.0 = Release_PGO_Optimize|Win32
 		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Release_PGO|Win32.ActiveCfg = Release_PGO|Win32
@@ -44,8 +44,8 @@ Global
 		{C59E5129-B453-49B7-A52B-1E104715F76E}.Debug_All|Win32.Build.0 = Debug_All|Win32
 		{C59E5129-B453-49B7-A52B-1E104715F76E}.Debug|Win32.ActiveCfg = Debug|Win32
 		{C59E5129-B453-49B7-A52B-1E104715F76E}.Debug|Win32.Build.0 = Debug|Win32
-		{C59E5129-B453-49B7-A52B-1E104715F76E}.Release_LTCG|Win32.ActiveCfg = Release_LTCG|Win32
-		{C59E5129-B453-49B7-A52B-1E104715F76E}.Release_LTCG|Win32.Build.0 = Release_LTCG|Win32
+		{C59E5129-B453-49B7-A52B-1E104715F76E}.Production|Win32.ActiveCfg = Production|Win32
+		{C59E5129-B453-49B7-A52B-1E104715F76E}.Production|Win32.Build.0 = Production|Win32
 		{C59E5129-B453-49B7-A52B-1E104715F76E}.Release_PGO_Optimize|Win32.ActiveCfg = Release_PGO|Win32
 		{C59E5129-B453-49B7-A52B-1E104715F76E}.Release_PGO_Optimize|Win32.Build.0 = Release_PGO|Win32
 		{C59E5129-B453-49B7-A52B-1E104715F76E}.Release_PGO|Win32.ActiveCfg = Release_PGO|Win32
@@ -56,8 +56,8 @@ Global
 		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Debug_All|Win32.Build.0 = Debug_All|Win32
 		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Debug|Win32.ActiveCfg = Debug|Win32
 		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Debug|Win32.Build.0 = Debug|Win32
-		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Release_LTCG|Win32.ActiveCfg = Release_LTCG|Win32
-		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Release_LTCG|Win32.Build.0 = Release_LTCG|Win32
+		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Production|Win32.ActiveCfg = Production|Win32
+		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Production|Win32.Build.0 = Production|Win32
 		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Release_PGO_Optimize|Win32.ActiveCfg = Release_PGO|Win32
 		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Release_PGO_Optimize|Win32.Build.0 = Release_PGO|Win32
 		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Release_PGO|Win32.ActiveCfg = Release_PGO|Win32
@@ -68,8 +68,8 @@ Global
 		{DA31DA52-6675-48D4-89E0-333A7144397C}.Debug_All|Win32.Build.0 = Debug_All|Win32
 		{DA31DA52-6675-48D4-89E0-333A7144397C}.Debug|Win32.ActiveCfg = Debug|Win32
 		{DA31DA52-6675-48D4-89E0-333A7144397C}.Debug|Win32.Build.0 = Debug|Win32
-		{DA31DA52-6675-48D4-89E0-333A7144397C}.Release_LTCG|Win32.ActiveCfg = Release_LTCG|Win32
-		{DA31DA52-6675-48D4-89E0-333A7144397C}.Release_LTCG|Win32.Build.0 = Release_LTCG|Win32
+		{DA31DA52-6675-48D4-89E0-333A7144397C}.Production|Win32.ActiveCfg = Production|Win32
+		{DA31DA52-6675-48D4-89E0-333A7144397C}.Production|Win32.Build.0 = Production|Win32
 		{DA31DA52-6675-48D4-89E0-333A7144397C}.Release_PGO_Optimize|Win32.ActiveCfg = Release_PGO|Win32
 		{DA31DA52-6675-48D4-89E0-333A7144397C}.Release_PGO_Optimize|Win32.Build.0 = Release_PGO|Win32
 		{DA31DA52-6675-48D4-89E0-333A7144397C}.Release_PGO|Win32.ActiveCfg = Release_PGO|Win32
@@ -80,8 +80,8 @@ Global
 		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Debug_All|Win32.Build.0 = Debug_All|Win32
 		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Debug|Win32.ActiveCfg = Debug|Win32
 		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Debug|Win32.Build.0 = Debug|Win32
-		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Release_LTCG|Win32.ActiveCfg = Release_LTCG|Win32
-		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Release_LTCG|Win32.Build.0 = Release_LTCG|Win32
+		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Production|Win32.ActiveCfg = Production|Win32
+		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Production|Win32.Build.0 = Production|Win32
 		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Release_PGO_Optimize|Win32.ActiveCfg = Release_PGO|Win32
 		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Release_PGO_Optimize|Win32.Build.0 = Release_PGO|Win32
 		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Release_PGO|Win32.ActiveCfg = Release_PGO|Win32
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def
index 7a8be2a..d7cddf4 100644
--- a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def
@@ -3,11 +3,10 @@ EXPORTS
     ??0CString@WTF@@QAE@PBD@Z
     ??0CString@WTF@@QAE@PBDI@Z
     ??0Collator@WTF@@QAE@PBD@Z
-    ??0DateInstance@JSC@@QAE@PAVExecState@1@N@Z
     ??0DateInstance@JSC@@QAE@PAVExecState@1@V?$NonNullPassRefPtr@VStructure@JSC@@@WTF@@N@Z
     ??0DefaultGCActivityCallback@JSC@@QAE@PAVHeap@1@@Z
     ??0DropAllLocks@JSLock@JSC@@QAE@W4JSLockBehavior@2@@Z
-    ??0DynamicGlobalObjectScope@JSC@@QAE@PAVExecState@1@PAVJSGlobalObject@1@@Z
+    ??0DynamicGlobalObjectScope@JSC@@QAE@AAVJSGlobalData@1@PAVJSGlobalObject@1@@Z
     ??0InternalFunction@JSC@@IAE@PAVJSGlobalData@1@PAVJSGlobalObject@1@V?$NonNullPassRefPtr@VStructure@JSC@@@WTF@@ABVIdentifier@1@@Z
     ??0JSArray@JSC@@QAE@AAVJSGlobalData@1@V?$NonNullPassRefPtr@VStructure@JSC@@@WTF@@ABVArgList@1@@Z  
     ??0JSArray@JSC@@QAE@V?$NonNullPassRefPtr@VStructure@JSC@@@WTF@@@Z
@@ -51,6 +50,7 @@ EXPORTS
     ?add@PropertyNameArray@JSC@@QAEXPAVStringImpl@WTF@@@Z
     ?addBytes@MD5@WTF@@QAEXPBEI@Z
     ?addBytes@SHA1@WTF@@QAEXPBEI@Z
+    ?addCurrentThread@MachineThreads@JSC@@QAEXXZ
     ?addPropertyTransition@Structure@JSC@@SA?AV?$PassRefPtr@VStructure@JSC@@@WTF@@PAV12@ABVIdentifier@2@IPAVJSCell@2@AAI@Z
     ?addPropertyTransitionToExistingStructure@Structure@JSC@@SA?AV?$PassRefPtr@VStructure@JSC@@@WTF@@PAV12@ABVIdentifier@2@IPAVJSCell@2@AAI@Z
     ?addPropertyWithoutTransition@Structure@JSC@@QAEIABVIdentifier@2@IPAVJSCell@2@@Z
@@ -93,23 +93,22 @@ EXPORTS
     ?constructArray@JSC@@YAPAVJSArray@1@PAVExecState@1@ABVArgList@1@@Z
     ?constructEmptyArray@JSC@@YAPAVJSArray@1@PAVExecState@1@@Z
     ?constructEmptyObject@JSC@@YAPAVJSObject@1@PAVExecState@1@@Z
-    ?constructFunction@JSC@@YAPAVJSObject@1@PAVExecState@1@ABVArgList@1@ABVIdentifier@1@ABVUString@1@H@Z
+    ?constructFunction@JSC@@YAPAVJSObject@1@PAVExecState@1@PAVJSGlobalObject@1@ABVArgList@1@ABVIdentifier@1@ABVUString@1@H@Z
     ?convertUTF16ToUTF8@Unicode@WTF@@YA?AW4ConversionResult@12@PAPB_WPB_WPAPADPAD_N@Z
     ?convertUTF8ToUTF16@Unicode@WTF@@YA?AW4ConversionResult@12@PAPBDPBDPAPA_WPA_W_N@Z
     ?create@ByteArray@WTF@@SA?AV?$PassRefPtr@VByteArray@WTF@@@2@I@Z
     ?create@JSGlobalData@JSC@@SA?AV?$PassRefPtr@VJSGlobalData@JSC@@@WTF@@W4ThreadStackType@2@@Z
     ?create@OpaqueJSString@@SA?AV?$PassRefPtr@UOpaqueJSString@@@WTF@@ABVUString@JSC@@@Z
-    ?create@RegExp@JSC@@SA?AV?$PassRefPtr@VRegExp@JSC@@@WTF@@PAVJSGlobalData@2@ABVUString@2@1@Z
+    ?create@RegExp@JSC@@SA?AV?$PassRefPtr@VRegExp@JSC@@@WTF@@PAVJSGlobalData@2@ABVUString@2@W4RegExpFlags@2@@Z
     ?createEmptyString@SmallStrings@JSC@@AAEXPAVJSGlobalData@2@@Z
     ?createError@JSC@@YAPAVJSObject@1@PAVExecState@1@ABVUString@1@@Z
-    ?createInheritorID@JSObject@JSC@@AAEPAVStructure@2@XZ
     ?createInterruptedExecutionException@JSC@@YAPAVJSObject@1@PAVJSGlobalData@1@@Z
     ?createLeaked@JSGlobalData@JSC@@SA?AV?$PassRefPtr@VJSGlobalData@JSC@@@WTF@@W4ThreadStackType@2@@Z
     ?createRangeError@JSC@@YAPAVJSObject@1@PAVExecState@1@ABVUString@1@@Z
     ?createReferenceError@JSC@@YAPAVJSObject@1@PAVExecState@1@ABVUString@1@@Z
     ?createSingleCharacterString@SmallStrings@JSC@@AAEXPAVJSGlobalData@2@E@Z
     ?createStackOverflowError@JSC@@YAPAVJSObject@1@PAVExecState@1@@Z
-    ?createStructure@JSByteArray@JSC@@SA?AV?$PassRefPtr@VStructure@JSC@@@WTF@@VJSValue@2@PBUClassInfo@2@@Z
+    ?createStructure@JSByteArray@JSC@@SA?AV?$PassRefPtr@VStructure@JSC@@@WTF@@AAVJSGlobalData@2@VJSValue@2@PBUClassInfo@2@@Z
     ?createSyntaxError@JSC@@YAPAVJSObject@1@PAVExecState@1@ABVUString@1@@Z
     ?createTable@HashTable@JSC@@ABEXPAVJSGlobalData@2@@Z
     ?createThread@WTF@@YAIP6APAXPAX@Z0@Z
@@ -147,7 +146,6 @@ EXPORTS
     ?despecifyDictionaryFunction@Structure@JSC@@QAEXABVIdentifier@2@@Z
     ?despecifyFunctionTransition@Structure@JSC@@SA?AV?$PassRefPtr@VStructure@JSC@@@WTF@@PAV12@ABVIdentifier@2@@Z
     ?destroy@Heap@JSC@@QAEXXZ
-    ?destroyJSGlobalObjectData@JSGlobalObject@JSC@@CAXPAX@Z
     ?detach@Debugger@JSC@@UAEXPAVJSGlobalObject@2@@Z
     ?detachThread@WTF@@YAXI@Z
     ?didTimeOut@TimeoutChecker@JSC@@QAE_NPAVExecState@2@@Z
@@ -277,8 +275,9 @@ EXPORTS
     ?putWithAttributes@JSObject@JSC@@UAEXPAVJSGlobalData@2@IVJSValue@2@I@Z
     ?randomNumber@WTF@@YANXZ
     ?recompileAllJSFunctions@Debugger@JSC@@QAEXPAVJSGlobalData@2@@Z
-    ?registerThread@MachineStackMarker@JSC@@QAEXXZ
+    ?regExpFlags@JSC@@YA?AW4RegExpFlags@1@ABVUString@1@@Z
     ?reifyString@StringBuilder@WTF@@AAEXXZ
+    ?reserveCapacity@StringBuilder@WTF@@QAEXI@Z
     ?releaseDecommitted@OSAllocator@WTF@@SAXPAXI@Z
     ?releaseStack@MarkStack@JSC@@CAXPAXI@Z
     ?reportExtraMemoryCostSlowCase@Heap@JSC@@AAEXI@Z
@@ -336,10 +335,9 @@ EXPORTS
     ?toNumber@JSCell@JSC@@UBENPAVExecState@2@@Z
     ?toNumber@JSObject@JSC@@UBENPAVExecState@2@@Z
     ?toNumber@JSString@JSC@@EBENPAVExecState@2@@Z
-    ?toObject@JSCell@JSC@@UBEPAVJSObject@2@PAVExecState@2@@Z
-    ?toObject@JSObject@JSC@@UBEPAV12@PAVExecState@2@@Z
-    ?toObject@JSString@JSC@@EBEPAVJSObject@2@PAVExecState@2@@Z
-    ?toObjectSlowCase@JSValue@JSC@@ABEPAVJSObject@2@PAVExecState@2@@Z
+    ?toObject@JSCell@JSC@@UBEPAVJSObject@2@PAVExecState@2@PAVJSGlobalObject@2@@Z
+    ?toObject@JSObject@JSC@@UBEPAV12@PAVExecState@2@PAVJSGlobalObject@2@@Z
+    ?toObjectSlowCase@JSValue@JSC@@ABEPAVJSObject@2@PAVExecState@2@PAVJSGlobalObject@2@@Z
     ?toPrimitive@JSCell@JSC@@UBE?AVJSValue@2@PAVExecState@2@W4PreferredPrimitiveType@2@@Z
     ?toPrimitive@JSString@JSC@@EBE?AVJSValue@2@PAVExecState@2@W4PreferredPrimitiveType@2@@Z
     ?toStrictThisObject@JSObject@JSC@@UBE?AVJSValue@2@PAVExecState@2@@Z
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj
index 34a9902..30b014a 100644
--- a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj
@@ -18,7 +18,7 @@
 		<Configuration
 			Name="Debug|Win32"
 			ConfigurationType="2"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;.\JavaScriptCoreCommon.vsprops;.\JavaScriptCoreCF.vsprops"
+			InheritedPropertySheets=".\JavaScriptCoreDebug.vsprops"
 			CharacterSet="1"
 			>
 			<Tool
@@ -79,7 +79,7 @@
 		<Configuration
 			Name="Release|Win32"
 			ConfigurationType="2"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;.\JavaScriptCoreCommon.vsprops;.\JavaScriptCoreCF.vsprops"
+			InheritedPropertySheets=".\JavaScriptCoreRelease.vsprops"
 			CharacterSet="1"
 			>
 			<Tool
@@ -140,7 +140,7 @@
 		<Configuration
 			Name="Release_PGO|Win32"
 			ConfigurationType="2"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;.\JavaScriptCoreCommon.vsprops;.\JavaScriptCoreCF.vsprops"
+			InheritedPropertySheets=".\JavaScriptCoreReleasePGO.vsprops"
 			CharacterSet="1"
 			WholeProgramOptimization="2"
 			>
@@ -202,7 +202,7 @@
 		<Configuration
 			Name="Debug_Cairo_CFLite|Win32"
 			ConfigurationType="2"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefinesCairo.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug_wincairo.vsprops;.\JavaScriptCoreCommon.vsprops;.\JavaScriptCoreCFLite.vsprops"
+			InheritedPropertySheets=".\JavaScriptCoreDebugCairoCFLite.vsprops"
 			CharacterSet="1"
 			>
 			<Tool
@@ -263,7 +263,7 @@
 		<Configuration
 			Name="Release_Cairo_CFLite|Win32"
 			ConfigurationType="2"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefinesCairo.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\WinCairo.vsprops;.\JavaScriptCoreCommon.vsprops;.\JavaScriptCoreCFLite.vsprops"
+			InheritedPropertySheets=".\JavaScriptCoreReleaseCairoCFLite.vsprops"
 			CharacterSet="1"
 			>
 			<Tool
@@ -324,7 +324,7 @@
 		<Configuration
 			Name="Debug_All|Win32"
 			ConfigurationType="2"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;.\JavaScriptCoreCommon.vsprops;.\JavaScriptCoreCF.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug_all.vsprops"
+			InheritedPropertySheets=".\JavaScriptCoreDebugAll.vsprops"
 			CharacterSet="1"
 			>
 			<Tool
@@ -383,9 +383,9 @@
 			/>
 		</Configuration>
 		<Configuration
-			Name="Release_LTCG|Win32"
+			Name="Production|Win32"
 			ConfigurationType="2"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;.\JavaScriptCoreCommon.vsprops;.\JavaScriptCoreCF.vsprops"
+			InheritedPropertySheets=".\JavaScriptCoreProduction.vsprops"
 			CharacterSet="1"
 			WholeProgramOptimization="1"
 			>
@@ -447,7 +447,7 @@
 		<Configuration
 			Name="Release_PGO_Optimize|Win32"
 			ConfigurationType="2"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;.\JavaScriptCoreCommon.vsprops;.\JavaScriptCoreCF.vsprops;.\JavaScriptCorePGOOptimize.vsprops"
+			InheritedPropertySheets=".\JavaScriptCoreReleasePGOOptimize.vsprops"
 			CharacterSet="1"
 			WholeProgramOptimization="4"
 			>
@@ -1960,6 +1960,22 @@
 					RelativePath="..\..\collector\handles\HandleHeap.h"
 					>
 				</File>
+				<File
+					RelativePath="..\..\collector\handles\HandleStack.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\..\collector\handles\HandleStack.h"
+					>
+				</File>
+				<File
+					RelativePath="..\..\collector\handles\Local.h"
+					>
+				</File>
+				<File
+					RelativePath="..\..\collector\handles\LocalScope.h"
+					>
+				</File>
 			</Filter>
 		</Filter>
 		<File
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreDebug.vsprops b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreDebug.vsprops
new file mode 100644
index 0000000..0afe222
--- /dev/null
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreDebug.vsprops
@@ -0,0 +1,13 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="JavaScriptCoreDebug"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;
+      .\JavaScriptCoreCommon.vsprops;
+      .\JavaScriptCoreCF.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreDebugAll.vsprops b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreDebugAll.vsprops
new file mode 100644
index 0000000..8cd1130
--- /dev/null
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreDebugAll.vsprops
@@ -0,0 +1,14 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="JavaScriptCoreDebugAll"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;
+      .\JavaScriptCoreCommon.vsprops;
+      .\JavaScriptCoreCF.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug_all.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreDebugCairoCFLite.vsprops b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreDebugCairoCFLite.vsprops
new file mode 100644
index 0000000..ea0806d
--- /dev/null
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreDebugCairoCFLite.vsprops
@@ -0,0 +1,14 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="JavaScriptCoreDebugCairoCFLite"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefinesCairo.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug_wincairo.vsprops;
+      .\JavaScriptCoreCommon.vsprops;
+      .\JavaScriptCoreCFLite.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.vcproj b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.vcproj
index 2437071..ebff713 100644
--- a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.vcproj
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.vcproj
@@ -43,7 +43,7 @@
 			/>
 		</Configuration>
 		<Configuration
-			Name="Release_LTCG|Win32"
+			Name="Production|Win32"
 			ConfigurationType="0"
 			InheritedPropertySheets=".\JavaScriptCoreGeneratedCommon.vsprops"
 			>
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreProduction.vsprops b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreProduction.vsprops
new file mode 100644
index 0000000..1d8e82d
--- /dev/null
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreProduction.vsprops
@@ -0,0 +1,14 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="JavaScriptCoreProduction"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\production.vsprops;
+      .\JavaScriptCoreCommon.vsprops;
+      .\JavaScriptCoreCF.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreRelease.vsprops b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreRelease.vsprops
new file mode 100644
index 0000000..e4612c3
--- /dev/null
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreRelease.vsprops
@@ -0,0 +1,13 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="JavaScriptCoreRelease"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
+      .\JavaScriptCoreCommon.vsprops;
+      .\JavaScriptCoreCF.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreReleaseCairoCFLite.vsprops b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreReleaseCairoCFLite.vsprops
new file mode 100644
index 0000000..64699b5
--- /dev/null
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreReleaseCairoCFLite.vsprops
@@ -0,0 +1,14 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="JavaScriptCoreReleaseCairoCFLite"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefinesCairo.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\WinCairo.vsprops;
+      .\JavaScriptCoreCommon.vsprops;
+      .\JavaScriptCoreCFLite.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreReleasePGO.vsprops b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreReleasePGO.vsprops
new file mode 100644
index 0000000..ada0b8e
--- /dev/null
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreReleasePGO.vsprops
@@ -0,0 +1,14 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="JavaScriptCoreReleasePGO"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\production.vsprops;
+      .\JavaScriptCoreCommon.vsprops;
+      .\JavaScriptCoreCF.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreReleasePGOOptimize.vsprops b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreReleasePGOOptimize.vsprops
new file mode 100644
index 0000000..3e207e7
--- /dev/null
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreReleasePGOOptimize.vsprops
@@ -0,0 +1,15 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="JavaScriptCoreReleasePGOOptimize"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\production.vsprops;
+      .\JavaScriptCoreCommon.vsprops;
+      .\JavaScriptCoreCF.vsprops;
+      .\JavaScriptCorePGOOptimize.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCoreSubmit.sln b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCoreSubmit.sln
index 1109c33..1e24f28 100644
--- a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCoreSubmit.sln
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCoreSubmit.sln
@@ -22,7 +22,7 @@ Global
 	GlobalSection(SolutionConfigurationPlatforms) = preSolution
 		Debug_All|Win32 = Debug_All|Win32
 		Debug|Win32 = Debug|Win32
-		Release_LTCG|Win32 = Release_LTCG|Win32
+		Production|Win32 = Production|Win32
 		Release_PGO_Optimize|Win32 = Release_PGO_Optimize|Win32
 		Release_PGO|Win32 = Release_PGO|Win32
 		Release|Win32 = Release|Win32
@@ -32,8 +32,8 @@ Global
 		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Debug_All|Win32.Build.0 = Debug_All|Win32
 		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Debug|Win32.ActiveCfg = Debug|Win32
 		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Debug|Win32.Build.0 = Debug|Win32
-		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Release_LTCG|Win32.ActiveCfg = Release_LTCG|Win32
-		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Release_LTCG|Win32.Build.0 = Release_LTCG|Win32
+		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Production|Win32.ActiveCfg = Production|Win32
+		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Production|Win32.Build.0 = Production|Win32
 		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Release_PGO_Optimize|Win32.ActiveCfg = Release_PGO_Optimize|Win32
 		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Release_PGO_Optimize|Win32.Build.0 = Release_PGO_Optimize|Win32
 		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Release_PGO|Win32.ActiveCfg = Release_PGO|Win32
@@ -44,8 +44,8 @@ Global
 		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Debug_All|Win32.Build.0 = Debug_All|Win32
 		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Debug|Win32.ActiveCfg = Debug|Win32
 		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Debug|Win32.Build.0 = Debug|Win32
-		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Release_LTCG|Win32.ActiveCfg = Release_LTCG|Win32
-		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Release_LTCG|Win32.Build.0 = Release_LTCG|Win32
+		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Production|Win32.ActiveCfg = Production|Win32
+		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Production|Win32.Build.0 = Production|Win32
 		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Release_PGO_Optimize|Win32.ActiveCfg = Release_PGO|Win32
 		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Release_PGO_Optimize|Win32.Build.0 = Release_PGO|Win32
 		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Release_PGO|Win32.ActiveCfg = Release_PGO|Win32
@@ -56,8 +56,8 @@ Global
 		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Debug_All|Win32.Build.0 = Debug_All|Win32
 		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Debug|Win32.ActiveCfg = Debug|Win32
 		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Debug|Win32.Build.0 = Debug|Win32
-		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Release_LTCG|Win32.ActiveCfg = Release_LTCG|Win32
-		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Release_LTCG|Win32.Build.0 = Release_LTCG|Win32
+		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Production|Win32.ActiveCfg = Production|Win32
+		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Production|Win32.Build.0 = Production|Win32
 		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Release_PGO_Optimize|Win32.ActiveCfg = Release_PGO|Win32
 		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Release_PGO_Optimize|Win32.Build.0 = Release_PGO|Win32
 		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Release_PGO|Win32.ActiveCfg = Release_PGO|Win32
@@ -68,8 +68,8 @@ Global
 		{C59E5129-B453-49B7-A52B-1E104715F76E}.Debug_All|Win32.Build.0 = Debug_All|Win32
 		{C59E5129-B453-49B7-A52B-1E104715F76E}.Debug|Win32.ActiveCfg = Debug|Win32
 		{C59E5129-B453-49B7-A52B-1E104715F76E}.Debug|Win32.Build.0 = Debug|Win32
-		{C59E5129-B453-49B7-A52B-1E104715F76E}.Release_LTCG|Win32.ActiveCfg = Release_LTCG|Win32
-		{C59E5129-B453-49B7-A52B-1E104715F76E}.Release_LTCG|Win32.Build.0 = Release_LTCG|Win32
+		{C59E5129-B453-49B7-A52B-1E104715F76E}.Production|Win32.ActiveCfg = Production|Win32
+		{C59E5129-B453-49B7-A52B-1E104715F76E}.Production|Win32.Build.0 = Production|Win32
 		{C59E5129-B453-49B7-A52B-1E104715F76E}.Release_PGO_Optimize|Win32.ActiveCfg = Release_PGO|Win32
 		{C59E5129-B453-49B7-A52B-1E104715F76E}.Release_PGO_Optimize|Win32.Build.0 = Release_PGO|Win32
 		{C59E5129-B453-49B7-A52B-1E104715F76E}.Release_PGO|Win32.ActiveCfg = Release_PGO|Win32
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/WTF/WTF.vcproj b/Source/JavaScriptCore/JavaScriptCore.vcproj/WTF/WTF.vcproj
index 8f0cfcb..aa337b3 100644
--- a/Source/JavaScriptCore/JavaScriptCore.vcproj/WTF/WTF.vcproj
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/WTF/WTF.vcproj
@@ -18,7 +18,7 @@
 		<Configuration
 			Name="Debug|Win32"
 			ConfigurationType="4"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;.\WTFCommon.vsprops"
+			InheritedPropertySheets=".\WTFDebug.vsprops"
 			CharacterSet="1"
 			>
 			<Tool
@@ -70,7 +70,7 @@
 		<Configuration
 			Name="Release|Win32"
 			ConfigurationType="4"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;.\WTFCommon.vsprops"
+			InheritedPropertySheets=".\WTFRelease.vsprops"
 			CharacterSet="1"
 			>
 			<Tool
@@ -122,7 +122,7 @@
 		<Configuration
 			Name="Debug_All|Win32"
 			ConfigurationType="4"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;.\WTFCommon.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug_all.vsprops"
+			InheritedPropertySheets=".\WTFDebugAll.vsprops"
 			CharacterSet="1"
 			>
 			<Tool
@@ -172,9 +172,9 @@
 			/>
 		</Configuration>
 		<Configuration
-			Name="Release_LTCG|Win32"
+			Name="Production|Win32"
 			ConfigurationType="4"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;.\WTFCommon.vsprops"
+			InheritedPropertySheets=".\WTFProduction.vsprops"
 			CharacterSet="1"
 			WholeProgramOptimization="1"
 			>
@@ -227,7 +227,7 @@
 		<Configuration
 			Name="Release_Cairo_CFLite|Win32"
 			ConfigurationType="4"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefinesCairo.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\WinCairo.vsprops;.\WTFCommon.vsprops"
+			InheritedPropertySheets=".\WTFReleaseCairoCFLite.vsprops"
 			CharacterSet="1"
 			>
 			<Tool
@@ -279,7 +279,7 @@
 		<Configuration
 			Name="Debug_Cairo_CFLite|Win32"
 			ConfigurationType="4"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefinesCairo.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug_wincairo.vsprops;.\WTFCommon.vsprops"
+			InheritedPropertySheets=".\WTFDebugCairoCFLite.vsprops"
 			CharacterSet="1"
 			>
 			<Tool
@@ -331,7 +331,7 @@
 		<Configuration
 			Name="Release_PGO|Win32"
 			ConfigurationType="4"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;.\WTFCommon.vsprops"
+			InheritedPropertySheets=".\WTFReleasePGO.vsprops"
 			CharacterSet="1"
 			>
 			<Tool
@@ -632,7 +632,7 @@
 				/>
 			</FileConfiguration>
 			<FileConfiguration
-				Name="Release_LTCG|Win32"
+				Name="Production|Win32"
 				>
 				<Tool
 					Name="VCCLCompilerTool"
@@ -705,6 +705,10 @@
 			>
 		</File>
 		<File
+			RelativePath="..\..\wtf\HexNumber.h"
+			>
+		</File>
+		<File
 			RelativePath="..\..\wtf\ListHashSet.h"
 			>
 		</File>
@@ -965,7 +969,7 @@
 			>
 		</File>
 		<File
-			RelativePath="..\..\wtf\ThreadSafeShared.h"
+			RelativePath="..\..\wtf\ThreadSafeRefCounted.h"
 			>
 		</File>
 		<File
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/WTF/WTFDebug.vsprops b/Source/JavaScriptCore/JavaScriptCore.vcproj/WTF/WTFDebug.vsprops
new file mode 100644
index 0000000..132b5c7
--- /dev/null
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/WTF/WTFDebug.vsprops
@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="WTFDebug"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;
+      .\WTFCommon.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/WTF/WTFDebugAll.vsprops b/Source/JavaScriptCore/JavaScriptCore.vcproj/WTF/WTFDebugAll.vsprops
new file mode 100644
index 0000000..061f2ed
--- /dev/null
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/WTF/WTFDebugAll.vsprops
@@ -0,0 +1,13 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="WTFDebugAll"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;
+      .\WTFCommon.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug_all.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/WTF/WTFDebugCairoCFLite.vsprops b/Source/JavaScriptCore/JavaScriptCore.vcproj/WTF/WTFDebugCairoCFLite.vsprops
new file mode 100644
index 0000000..7965652
--- /dev/null
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/WTF/WTFDebugCairoCFLite.vsprops
@@ -0,0 +1,13 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="WTFDebugCairoCFLite"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefinesCairo.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug_wincairo.vsprops;
+      .\WTFCommon.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/WTF/WTFProduction.vsprops b/Source/JavaScriptCore/JavaScriptCore.vcproj/WTF/WTFProduction.vsprops
new file mode 100644
index 0000000..3de342c
--- /dev/null
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/WTF/WTFProduction.vsprops
@@ -0,0 +1,13 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="WTFProduction"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\production.vsprops;
+      .\WTFCommon.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/WTF/WTFRelease.vsprops b/Source/JavaScriptCore/JavaScriptCore.vcproj/WTF/WTFRelease.vsprops
new file mode 100644
index 0000000..3960f98
--- /dev/null
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/WTF/WTFRelease.vsprops
@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="WTFRelease"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
+      .\WTFCommon.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/WTF/WTFReleaseCairoCFLite.vsprops b/Source/JavaScriptCore/JavaScriptCore.vcproj/WTF/WTFReleaseCairoCFLite.vsprops
new file mode 100644
index 0000000..3267d79
--- /dev/null
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/WTF/WTFReleaseCairoCFLite.vsprops
@@ -0,0 +1,13 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="WTFReleaseCairoCFLite"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefinesCairo.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\WinCairo.vsprops;
+      .\WTFCommon.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/WTF/WTFReleasePGO.vsprops b/Source/JavaScriptCore/JavaScriptCore.vcproj/WTF/WTFReleasePGO.vsprops
new file mode 100644
index 0000000..ac4f8a5
--- /dev/null
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/WTF/WTFReleasePGO.vsprops
@@ -0,0 +1,13 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="WTFReleasePGO"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\production.vsprops;
+      .\WTFCommon.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/jsc/jsc.vcproj b/Source/JavaScriptCore/JavaScriptCore.vcproj/jsc/jsc.vcproj
index ebcfd8e..a650cd2 100644
--- a/Source/JavaScriptCore/JavaScriptCore.vcproj/jsc/jsc.vcproj
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/jsc/jsc.vcproj
@@ -18,7 +18,7 @@
 		<Configuration
 			Name="Debug|Win32"
 			ConfigurationType="1"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;.\jscCommon.vsprops"
+			InheritedPropertySheets=".\jscDebug.vsprops"
 			CharacterSet="1"
 			>
 			<Tool
@@ -79,7 +79,7 @@
 		<Configuration
 			Name="Release|Win32"
 			ConfigurationType="1"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;.\jscCommon.vsprops"
+			InheritedPropertySheets=".\jscRelease.vsprops"
 			CharacterSet="1"
 			>
 			<Tool
@@ -140,7 +140,7 @@
 		<Configuration
 			Name="Debug_Cairo_CFLite|Win32"
 			ConfigurationType="1"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug_wincairo.vsprops;.\jscCommon.vsprops"
+			InheritedPropertySheets=".\jscDebugCairoCFLite.vsprops"
 			CharacterSet="1"
 			>
 			<Tool
@@ -201,7 +201,7 @@
 		<Configuration
 			Name="Debug_All|Win32"
 			ConfigurationType="1"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;.\jscCommon.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug_all.vsprops"
+			InheritedPropertySheets=".\jscDebugAll.vsprops"
 			CharacterSet="1"
 			>
 			<Tool
@@ -260,9 +260,9 @@
 			/>
 		</Configuration>
 		<Configuration
-			Name="Release_LTCG|Win32"
+			Name="Production|Win32"
 			ConfigurationType="1"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;.\jscCommon.vsprops"
+			InheritedPropertySheets=".\jscProduction.vsprops"
 			CharacterSet="1"
 			WholeProgramOptimization="1"
 			>
@@ -324,7 +324,7 @@
 		<Configuration
 			Name="Release_Cairo_CFLite|Win32"
 			ConfigurationType="1"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\WinCairo.vsprops;.\jscCommon.vsprops"
+			InheritedPropertySheets=".\jscReleaseCairoCFLite.vsprops"
 			CharacterSet="1"
 			>
 			<Tool
@@ -385,7 +385,7 @@
 		<Configuration
 			Name="Release_PGO|Win32"
 			ConfigurationType="1"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;.\jscCommon.vsprops"
+			InheritedPropertySheets=".\jscReleasePGO.vsprops"
 			CharacterSet="1"
 			>
 			<Tool
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/jsc/jscDebug.vsprops b/Source/JavaScriptCore/JavaScriptCore.vcproj/jsc/jscDebug.vsprops
new file mode 100644
index 0000000..fa6dc68
--- /dev/null
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/jsc/jscDebug.vsprops
@@ -0,0 +1,11 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="jscDebug"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;
+      .\jscCommon.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/jsc/jscDebugAll.vsprops b/Source/JavaScriptCore/JavaScriptCore.vcproj/jsc/jscDebugAll.vsprops
new file mode 100644
index 0000000..6090c60
--- /dev/null
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/jsc/jscDebugAll.vsprops
@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="jscDebugAll"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;
+      .\jscCommon.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug_all.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/jsc/jscDebugCairoCFLite.vsprops b/Source/JavaScriptCore/JavaScriptCore.vcproj/jsc/jscDebugCairoCFLite.vsprops
new file mode 100644
index 0000000..c1868a8
--- /dev/null
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/jsc/jscDebugCairoCFLite.vsprops
@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="jscDebugCairoCFLite"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug_wincairo.vsprops;
+      .\jscCommon.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/jsc/jscProduction.vsprops b/Source/JavaScriptCore/JavaScriptCore.vcproj/jsc/jscProduction.vsprops
new file mode 100644
index 0000000..408871b
--- /dev/null
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/jsc/jscProduction.vsprops
@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="jscProduction"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\production.vsprops;
+      .\jscCommon.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/jsc/jscRelease.vsprops b/Source/JavaScriptCore/JavaScriptCore.vcproj/jsc/jscRelease.vsprops
new file mode 100644
index 0000000..ba9b288
--- /dev/null
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/jsc/jscRelease.vsprops
@@ -0,0 +1,11 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="jscRelease"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
+      .\jscCommon.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/jsc/jscReleaseCairoCFLite.vsprops b/Source/JavaScriptCore/JavaScriptCore.vcproj/jsc/jscReleaseCairoCFLite.vsprops
new file mode 100644
index 0000000..2104fe4
--- /dev/null
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/jsc/jscReleaseCairoCFLite.vsprops
@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="jscReleaseCairoCFLite"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\WinCairo.vsprops;
+      .\jscCommon.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/jsc/jscReleasePGO.vsprops b/Source/JavaScriptCore/JavaScriptCore.vcproj/jsc/jscReleasePGO.vsprops
new file mode 100644
index 0000000..78f3672
--- /dev/null
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/jsc/jscReleasePGO.vsprops
@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="jscReleasePGO"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\production.vsprops;
+      .\jscCommon.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/testapi/testapi.vcproj b/Source/JavaScriptCore/JavaScriptCore.vcproj/testapi/testapi.vcproj
index 5b18032..1dfdd1e 100644
--- a/Source/JavaScriptCore/JavaScriptCore.vcproj/testapi/testapi.vcproj
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/testapi/testapi.vcproj
@@ -18,7 +18,7 @@
 		<Configuration
 			Name="Debug|Win32"
 			ConfigurationType="1"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;.\testapiCommon.vsprops;..\JavaScriptCore\JavaScriptCoreCF.vsprops"
+			InheritedPropertySheets=".\testapiDebug.vsprops"
 			CharacterSet="1"
 			>
 			<Tool
@@ -79,7 +79,7 @@
 		<Configuration
 			Name="Release|Win32"
 			ConfigurationType="1"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;.\testapiCommon.vsprops;..\JavaScriptCore\JavaScriptCoreCF.vsprops"
+			InheritedPropertySheets=".\testapiRelease.vsprops"
 			CharacterSet="1"
 			>
 			<Tool
@@ -140,7 +140,7 @@
 		<Configuration
 			Name="Debug_Cairo_CFLite|Win32"
 			ConfigurationType="1"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug_wincairo.vsprops;.\testapiCommon.vsprops;..\JavaScriptCore\JavaScriptCoreCFLite.vsprops"
+			InheritedPropertySheets=".\testapiDebugCairoCFLite.vsprops"
 			CharacterSet="1"
 			>
 			<Tool
@@ -201,7 +201,7 @@
 		<Configuration
 			Name="Release_Cairo_CFLite|Win32"
 			ConfigurationType="1"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\WinCairo.vsprops;.\testapiCommon.vsprops;..\JavaScriptCore\JavaScriptCoreCFLite.vsprops"
+			InheritedPropertySheets=".\testapiReleaseCairoCFLite.vsprops"
 			CharacterSet="1"
 			>
 			<Tool
@@ -262,7 +262,7 @@
 		<Configuration
 			Name="Debug_All|Win32"
 			ConfigurationType="1"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;.\testapiCommon.vsprops;..\JavaScriptCore\JavaScriptCoreCF.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug_all.vsprops"
+			InheritedPropertySheets=".\testapiDebugAll.vsprops"
 			CharacterSet="1"
 			>
 			<Tool
@@ -321,9 +321,9 @@
 			/>
 		</Configuration>
 		<Configuration
-			Name="Release_LTCG|Win32"
+			Name="Production|Win32"
 			ConfigurationType="1"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;.\testapiCommon.vsprops;..\JavaScriptCore\JavaScriptCoreCF.vsprops"
+			InheritedPropertySheets=".\testapiProduction.vsprops"
 			CharacterSet="1"
 			WholeProgramOptimization="1"
 			>
@@ -430,7 +430,7 @@
 				/>
 			</FileConfiguration>
 			<FileConfiguration
-				Name="Release_LTCG|Win32"
+				Name="Production|Win32"
 				>
 				<Tool
 					Name="VCCLCompilerTool"
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/testapi/testapiDebug.vsprops b/Source/JavaScriptCore/JavaScriptCore.vcproj/testapi/testapiDebug.vsprops
new file mode 100644
index 0000000..ba5e31d
--- /dev/null
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/testapi/testapiDebug.vsprops
@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="testapiDebug"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;
+      .\testapiCommon.vsprops;
+      ..\JavaScriptCore\JavaScriptCoreCF.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/testapi/testapiDebugAll.vsprops b/Source/JavaScriptCore/JavaScriptCore.vcproj/testapi/testapiDebugAll.vsprops
new file mode 100644
index 0000000..cc139f8
--- /dev/null
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/testapi/testapiDebugAll.vsprops
@@ -0,0 +1,13 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="testapiDebugAll"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;
+      .\testapiCommon.vsprops;
+      ..\JavaScriptCore\JavaScriptCoreCF.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug_all.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/testapi/testapiDebugCairoCFLite.vsprops b/Source/JavaScriptCore/JavaScriptCore.vcproj/testapi/testapiDebugCairoCFLite.vsprops
new file mode 100644
index 0000000..4e1e11f
--- /dev/null
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/testapi/testapiDebugCairoCFLite.vsprops
@@ -0,0 +1,13 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="testapiDebugCairoCFLite"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug_wincairo.vsprops;
+      .\testapiCommon.vsprops;
+      ..\JavaScriptCore\JavaScriptCoreCFLite.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/testapi/testapiProduction.vsprops b/Source/JavaScriptCore/JavaScriptCore.vcproj/testapi/testapiProduction.vsprops
new file mode 100644
index 0000000..03fceab
--- /dev/null
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/testapi/testapiProduction.vsprops
@@ -0,0 +1,13 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="testapiProduction"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\production.vsprops;
+      .\testapiCommon.vsprops;
+      ..\JavaScriptCore\JavaScriptCoreCF.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/testapi/testapiRelease.vsprops b/Source/JavaScriptCore/JavaScriptCore.vcproj/testapi/testapiRelease.vsprops
new file mode 100644
index 0000000..1c041ff
--- /dev/null
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/testapi/testapiRelease.vsprops
@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="testapiRelease"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
+      .\testapiCommon.vsprops;
+      ..\JavaScriptCore\JavaScriptCoreCF.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/testapi/testapiReleaseCairoCFLite.vsprops b/Source/JavaScriptCore/JavaScriptCore.vcproj/testapi/testapiReleaseCairoCFLite.vsprops
new file mode 100644
index 0000000..c025283
--- /dev/null
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/testapi/testapiReleaseCairoCFLite.vsprops
@@ -0,0 +1,13 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="testapiReleaseCairoCFLite"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\WinCairo.vsprops;
+      .\testapiCommon.vsprops;
+      ..\JavaScriptCore\JavaScriptCoreCFLite.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj b/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj
index 9f8d49a..44e108c 100644
--- a/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj
+++ b/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj
@@ -121,6 +121,7 @@
 		14469DEC107EC7E700650446 /* StringObject.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC18C3C20E16EE3300B34460 /* StringObject.cpp */; };
 		14469DED107EC7E700650446 /* StringPrototype.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC18C3C50E16EE3300B34460 /* StringPrototype.cpp */; };
 		14469DEE107EC7E700650446 /* UString.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F692A8850255597D01FF60F7 /* UString.cpp */; };
+		144836E7132DA7BE005BE785 /* ConservativeSet.h in Headers */ = {isa = PBXBuildFile; fileRef = 149DAAF212EB559D0083B12B /* ConservativeSet.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		146AAB380B66A94400E55F16 /* JSStringRefCF.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 146AAB370B66A94400E55F16 /* JSStringRefCF.cpp */; };
 		146B16D812EB5B59001BEC1B /* ConservativeSet.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 146B14DB12EB5B12001BEC1B /* ConservativeSet.cpp */; };
 		146FE51211A710430087AE66 /* JITCall32_64.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 146FE51111A710430087AE66 /* JITCall32_64.cpp */; };
@@ -209,7 +210,8 @@
 		655EB29B10CE2581001A990E /* NodesCodegen.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 655EB29A10CE2581001A990E /* NodesCodegen.cpp */; };
 		65DFC93308EA173A00F7300B /* HashTable.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 65DFC92D08EA173A00F7300B /* HashTable.cpp */; };
 		65E1A3DF122B894500B26097 /* NonCopyingSort.h in Headers */ = {isa = PBXBuildFile; fileRef = 65E1A2F4122B880D00B26097 /* NonCopyingSort.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		65FDE49C0BDD1D4A00E80111 /* Assertions.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 65E217B808E7EECC0023E5F6 /* Assertions.cpp */; settings = {COMPILER_FLAGS = "-Wno-missing-format-attribute"; }; };
+		65FDE49C0BDD1D4A00E80111 /* Assertions.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 65E217B808E7EECC0023E5F6 /* Assertions.cpp */; };
+		7186A6EC13100BA5004479E1 /* HexNumber.h in Headers */ = {isa = PBXBuildFile; fileRef = 7186A6E813100B57004479E1 /* HexNumber.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		76FB9F0F12E851860051A2EB /* SHA1.h in Headers */ = {isa = PBXBuildFile; fileRef = 76FB9F0E12E851860051A2EB /* SHA1.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		76FB9F1112E851960051A2EB /* SHA1.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 76FB9F1012E851960051A2EB /* SHA1.cpp */; };
 		7E4EE7090EBB7963005934AA /* StructureChain.h in Headers */ = {isa = PBXBuildFile; fileRef = 7E4EE7080EBB7963005934AA /* StructureChain.h */; settings = {ATTRIBUTES = (Private, ); }; };
@@ -280,6 +282,25 @@
 		86DB64640F95C6FC00D7D921 /* ExecutableAllocatorFixedVMPool.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 86DB64630F95C6FC00D7D921 /* ExecutableAllocatorFixedVMPool.cpp */; };
 		86E116B10FE75AC800B512BC /* CodeLocation.h in Headers */ = {isa = PBXBuildFile; fileRef = 86E116B00FE75AC800B512BC /* CodeLocation.h */; };
 		86E85539111B9968001AF51E /* JSStringBuilder.h in Headers */ = {isa = PBXBuildFile; fileRef = 86E85538111B9968001AF51E /* JSStringBuilder.h */; };
+		86EC9DC41328DF82002B2AD7 /* DFGByteCodeParser.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 86EC9DB41328DF82002B2AD7 /* DFGByteCodeParser.cpp */; };
+		86EC9DC51328DF82002B2AD7 /* DFGByteCodeParser.h in Headers */ = {isa = PBXBuildFile; fileRef = 86EC9DB51328DF82002B2AD7 /* DFGByteCodeParser.h */; };
+		86EC9DC61328DF82002B2AD7 /* DFGGenerationInfo.h in Headers */ = {isa = PBXBuildFile; fileRef = 86EC9DB61328DF82002B2AD7 /* DFGGenerationInfo.h */; };
+		86EC9DC71328DF82002B2AD7 /* DFGGraph.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 86EC9DB71328DF82002B2AD7 /* DFGGraph.cpp */; };
+		86EC9DC81328DF82002B2AD7 /* DFGGraph.h in Headers */ = {isa = PBXBuildFile; fileRef = 86EC9DB81328DF82002B2AD7 /* DFGGraph.h */; };
+		86EC9DC91328DF82002B2AD7 /* DFGJITCodeGenerator.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 86EC9DB91328DF82002B2AD7 /* DFGJITCodeGenerator.cpp */; };
+		86EC9DCA1328DF82002B2AD7 /* DFGJITCodeGenerator.h in Headers */ = {isa = PBXBuildFile; fileRef = 86EC9DBA1328DF82002B2AD7 /* DFGJITCodeGenerator.h */; };
+		86EC9DCB1328DF82002B2AD7 /* DFGJITCompiler.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 86EC9DBB1328DF82002B2AD7 /* DFGJITCompiler.cpp */; };
+		86EC9DCC1328DF82002B2AD7 /* DFGJITCompiler.h in Headers */ = {isa = PBXBuildFile; fileRef = 86EC9DBC1328DF82002B2AD7 /* DFGJITCompiler.h */; };
+		86EC9DCD1328DF82002B2AD7 /* DFGNonSpeculativeJIT.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 86EC9DBD1328DF82002B2AD7 /* DFGNonSpeculativeJIT.cpp */; };
+		86EC9DCE1328DF82002B2AD7 /* DFGNonSpeculativeJIT.h in Headers */ = {isa = PBXBuildFile; fileRef = 86EC9DBE1328DF82002B2AD7 /* DFGNonSpeculativeJIT.h */; };
+		86EC9DCF1328DF82002B2AD7 /* DFGOperations.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 86EC9DBF1328DF82002B2AD7 /* DFGOperations.cpp */; };
+		86EC9DD01328DF82002B2AD7 /* DFGOperations.h in Headers */ = {isa = PBXBuildFile; fileRef = 86EC9DC01328DF82002B2AD7 /* DFGOperations.h */; };
+		86EC9DD11328DF82002B2AD7 /* DFGRegisterBank.h in Headers */ = {isa = PBXBuildFile; fileRef = 86EC9DC11328DF82002B2AD7 /* DFGRegisterBank.h */; };
+		86EC9DD21328DF82002B2AD7 /* DFGSpeculativeJIT.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 86EC9DC21328DF82002B2AD7 /* DFGSpeculativeJIT.cpp */; };
+		86EC9DD31328DF82002B2AD7 /* DFGSpeculativeJIT.h in Headers */ = {isa = PBXBuildFile; fileRef = 86EC9DC31328DF82002B2AD7 /* DFGSpeculativeJIT.h */; };
+		86ECA3EA132DEF1C002B2AD7 /* DFGNode.h in Headers */ = {isa = PBXBuildFile; fileRef = 86ECA3E9132DEF1C002B2AD7 /* DFGNode.h */; };
+		86ECA3FA132DF25A002B2AD7 /* DFGScoreBoard.h in Headers */ = {isa = PBXBuildFile; fileRef = 86ECA3F9132DF25A002B2AD7 /* DFGScoreBoard.h */; };
+		86ECA4F1132EAA6D002B2AD7 /* DFGAliasTracker.h in Headers */ = {isa = PBXBuildFile; fileRef = 86ECA4F0132EAA6D002B2AD7 /* DFGAliasTracker.h */; };
 		86F38859121130CA007A7CE3 /* AtomicStringHash.h in Headers */ = {isa = PBXBuildFile; fileRef = 86F38858121130CA007A7CE3 /* AtomicStringHash.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		90213E3D123A40C200D422F3 /* MemoryStatistics.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 90213E3B123A40C200D422F3 /* MemoryStatistics.cpp */; };
 		90213E3E123A40C200D422F3 /* MemoryStatistics.h in Headers */ = {isa = PBXBuildFile; fileRef = 90213E3C123A40C200D422F3 /* MemoryStatistics.h */; settings = {ATTRIBUTES = (Private, ); }; };
@@ -355,6 +376,10 @@
 		A74DE1D0120B875600D40D5B /* ARMv7Assembler.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A74DE1CB120B86D600D40D5B /* ARMv7Assembler.cpp */; };
 		A75706DE118A2BCF0057F88F /* JITArithmetic32_64.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A75706DD118A2BCF0057F88F /* JITArithmetic32_64.cpp */; };
 		A766B44F0EE8DCD1009518CA /* ExecutableAllocator.h in Headers */ = {isa = PBXBuildFile; fileRef = A7B48DB50EE74CFC00DCBDB6 /* ExecutableAllocator.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		A76BE39F132EEA7C008F7F0B /* HandleStack.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A76BE1B7132DAC68008F7F0B /* HandleStack.cpp */; };
+		A76BE3A0132EEA7C008F7F0B /* HandleStack.h in Headers */ = {isa = PBXBuildFile; fileRef = A76BE1B8132DAC68008F7F0B /* HandleStack.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		A76BE3A1132EEA7C008F7F0B /* Local.h in Headers */ = {isa = PBXBuildFile; fileRef = A76BE1B5132DABF5008F7F0B /* Local.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		A76BE3A2132EEA7C008F7F0B /* LocalScope.h in Headers */ = {isa = PBXBuildFile; fileRef = A76BE1B6132DAC24008F7F0B /* LocalScope.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		A76C51761182748D00715B05 /* JSInterfaceJIT.h in Headers */ = {isa = PBXBuildFile; fileRef = A76C51741182748D00715B05 /* JSInterfaceJIT.h */; };
 		A7795590101A74D500114E55 /* MarkStack.h in Headers */ = {isa = PBXBuildFile; fileRef = A779558F101A74D500114E55 /* MarkStack.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		A783A0D111A36DCA00563D20 /* JSObjectWithGlobalObject.h in Headers */ = {isa = PBXBuildFile; fileRef = A783A0D011A36DCA00563D20 /* JSObjectWithGlobalObject.h */; settings = {ATTRIBUTES = (Private, ); }; };
@@ -531,7 +556,7 @@
 		BC3135650F302FA3003DFD3A /* DebuggerActivation.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC3135630F302FA3003DFD3A /* DebuggerActivation.cpp */; };
 		BC5F7BBE11823B590052C02C /* Atomics.h in Headers */ = {isa = PBXBuildFile; fileRef = BC5F7BBB11823B590052C02C /* Atomics.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC5F7BBF11823B590052C02C /* ThreadingPrimitives.h in Headers */ = {isa = PBXBuildFile; fileRef = BC5F7BBC11823B590052C02C /* ThreadingPrimitives.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		BC5F7BC011823B590052C02C /* ThreadSafeShared.h in Headers */ = {isa = PBXBuildFile; fileRef = BC5F7BBD11823B590052C02C /* ThreadSafeShared.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		BC5F7BC011823B590052C02C /* ThreadSafeRefCounted.h in Headers */ = {isa = PBXBuildFile; fileRef = BC5F7BBD11823B590052C02C /* ThreadSafeRefCounted.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC6AAAE50E1F426500AD87D8 /* ClassInfo.h in Headers */ = {isa = PBXBuildFile; fileRef = BC6AAAE40E1F426500AD87D8 /* ClassInfo.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC756FC90E2031B200DE7D12 /* JSGlobalObjectFunctions.h in Headers */ = {isa = PBXBuildFile; fileRef = BC756FC70E2031B200DE7D12 /* JSGlobalObjectFunctions.h */; };
 		BC7F8FB90E19D1C3008632C0 /* JSNumberCell.h in Headers */ = {isa = PBXBuildFile; fileRef = BC7F8FB80E19D1C3008632C0 /* JSNumberCell.h */; settings = {ATTRIBUTES = (Private, ); }; };
@@ -850,6 +875,7 @@
 		65EA73620BAE35D1001BB560 /* CommonIdentifiers.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = CommonIdentifiers.cpp; sourceTree = "<group>"; };
 		65EA73630BAE35D1001BB560 /* CommonIdentifiers.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = CommonIdentifiers.h; sourceTree = "<group>"; };
 		704FD35305697E6D003DBED9 /* BooleanObject.h */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.c.h; path = BooleanObject.h; sourceTree = "<group>"; tabWidth = 8; };
+		7186A6E813100B57004479E1 /* HexNumber.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = HexNumber.h; sourceTree = "<group>"; };
 		76FB9F0E12E851860051A2EB /* SHA1.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SHA1.h; sourceTree = "<group>"; };
 		76FB9F1012E851960051A2EB /* SHA1.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SHA1.cpp; sourceTree = "<group>"; };
 		7E2C6C980D31C6B6002D44E2 /* ScopeChainMark.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ScopeChainMark.h; sourceTree = "<group>"; };
@@ -922,6 +948,25 @@
 		86DB64630F95C6FC00D7D921 /* ExecutableAllocatorFixedVMPool.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ExecutableAllocatorFixedVMPool.cpp; sourceTree = "<group>"; };
 		86E116B00FE75AC800B512BC /* CodeLocation.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CodeLocation.h; sourceTree = "<group>"; };
 		86E85538111B9968001AF51E /* JSStringBuilder.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSStringBuilder.h; sourceTree = "<group>"; };
+		86EC9DB41328DF82002B2AD7 /* DFGByteCodeParser.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGByteCodeParser.cpp; path = dfg/DFGByteCodeParser.cpp; sourceTree = "<group>"; };
+		86EC9DB51328DF82002B2AD7 /* DFGByteCodeParser.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGByteCodeParser.h; path = dfg/DFGByteCodeParser.h; sourceTree = "<group>"; };
+		86EC9DB61328DF82002B2AD7 /* DFGGenerationInfo.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGGenerationInfo.h; path = dfg/DFGGenerationInfo.h; sourceTree = "<group>"; };
+		86EC9DB71328DF82002B2AD7 /* DFGGraph.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGGraph.cpp; path = dfg/DFGGraph.cpp; sourceTree = "<group>"; };
+		86EC9DB81328DF82002B2AD7 /* DFGGraph.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGGraph.h; path = dfg/DFGGraph.h; sourceTree = "<group>"; };
+		86EC9DB91328DF82002B2AD7 /* DFGJITCodeGenerator.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGJITCodeGenerator.cpp; path = dfg/DFGJITCodeGenerator.cpp; sourceTree = "<group>"; };
+		86EC9DBA1328DF82002B2AD7 /* DFGJITCodeGenerator.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGJITCodeGenerator.h; path = dfg/DFGJITCodeGenerator.h; sourceTree = "<group>"; };
+		86EC9DBB1328DF82002B2AD7 /* DFGJITCompiler.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGJITCompiler.cpp; path = dfg/DFGJITCompiler.cpp; sourceTree = "<group>"; };
+		86EC9DBC1328DF82002B2AD7 /* DFGJITCompiler.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGJITCompiler.h; path = dfg/DFGJITCompiler.h; sourceTree = "<group>"; };
+		86EC9DBD1328DF82002B2AD7 /* DFGNonSpeculativeJIT.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGNonSpeculativeJIT.cpp; path = dfg/DFGNonSpeculativeJIT.cpp; sourceTree = "<group>"; };
+		86EC9DBE1328DF82002B2AD7 /* DFGNonSpeculativeJIT.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGNonSpeculativeJIT.h; path = dfg/DFGNonSpeculativeJIT.h; sourceTree = "<group>"; };
+		86EC9DBF1328DF82002B2AD7 /* DFGOperations.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGOperations.cpp; path = dfg/DFGOperations.cpp; sourceTree = "<group>"; };
+		86EC9DC01328DF82002B2AD7 /* DFGOperations.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGOperations.h; path = dfg/DFGOperations.h; sourceTree = "<group>"; };
+		86EC9DC11328DF82002B2AD7 /* DFGRegisterBank.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGRegisterBank.h; path = dfg/DFGRegisterBank.h; sourceTree = "<group>"; };
+		86EC9DC21328DF82002B2AD7 /* DFGSpeculativeJIT.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGSpeculativeJIT.cpp; path = dfg/DFGSpeculativeJIT.cpp; sourceTree = "<group>"; };
+		86EC9DC31328DF82002B2AD7 /* DFGSpeculativeJIT.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGSpeculativeJIT.h; path = dfg/DFGSpeculativeJIT.h; sourceTree = "<group>"; };
+		86ECA3E9132DEF1C002B2AD7 /* DFGNode.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGNode.h; path = dfg/DFGNode.h; sourceTree = "<group>"; };
+		86ECA3F9132DF25A002B2AD7 /* DFGScoreBoard.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGScoreBoard.h; path = dfg/DFGScoreBoard.h; sourceTree = "<group>"; };
+		86ECA4F0132EAA6D002B2AD7 /* DFGAliasTracker.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGAliasTracker.h; path = dfg/DFGAliasTracker.h; sourceTree = "<group>"; };
 		86F38858121130CA007A7CE3 /* AtomicStringHash.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = AtomicStringHash.h; path = text/AtomicStringHash.h; sourceTree = "<group>"; };
 		90213E3B123A40C200D422F3 /* MemoryStatistics.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = MemoryStatistics.cpp; sourceTree = "<group>"; };
 		90213E3C123A40C200D422F3 /* MemoryStatistics.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MemoryStatistics.h; sourceTree = "<group>"; };
@@ -1030,6 +1075,10 @@
 		A74B3498102A5F8E0032AB98 /* MarkStack.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = MarkStack.cpp; sourceTree = "<group>"; };
 		A74DE1CB120B86D600D40D5B /* ARMv7Assembler.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ARMv7Assembler.cpp; sourceTree = "<group>"; };
 		A75706DD118A2BCF0057F88F /* JITArithmetic32_64.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JITArithmetic32_64.cpp; sourceTree = "<group>"; };
+		A76BE1B5132DABF5008F7F0B /* Local.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = Local.h; path = collector/handles/Local.h; sourceTree = "<group>"; };
+		A76BE1B6132DAC24008F7F0B /* LocalScope.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = LocalScope.h; path = collector/handles/LocalScope.h; sourceTree = "<group>"; };
+		A76BE1B7132DAC68008F7F0B /* HandleStack.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = HandleStack.cpp; path = collector/handles/HandleStack.cpp; sourceTree = "<group>"; };
+		A76BE1B8132DAC68008F7F0B /* HandleStack.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = HandleStack.h; path = collector/handles/HandleStack.h; sourceTree = "<group>"; };
 		A76C51741182748D00715B05 /* JSInterfaceJIT.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSInterfaceJIT.h; sourceTree = "<group>"; };
 		A779558F101A74D500114E55 /* MarkStack.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MarkStack.h; sourceTree = "<group>"; };
 		A783A0D011A36DCA00563D20 /* JSObjectWithGlobalObject.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSObjectWithGlobalObject.h; sourceTree = "<group>"; };
@@ -1125,7 +1174,7 @@
 		BC337BEA0E1B00CB0076918A /* Error.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = Error.cpp; sourceTree = "<group>"; };
 		BC5F7BBB11823B590052C02C /* Atomics.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = Atomics.h; sourceTree = "<group>"; };
 		BC5F7BBC11823B590052C02C /* ThreadingPrimitives.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ThreadingPrimitives.h; sourceTree = "<group>"; };
-		BC5F7BBD11823B590052C02C /* ThreadSafeShared.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ThreadSafeShared.h; sourceTree = "<group>"; };
+		BC5F7BBD11823B590052C02C /* ThreadSafeRefCounted.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ThreadSafeRefCounted.h; sourceTree = "<group>"; };
 		BC6AAAE40E1F426500AD87D8 /* ClassInfo.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ClassInfo.h; sourceTree = "<group>"; };
 		BC756FC60E2031B200DE7D12 /* JSGlobalObjectFunctions.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSGlobalObjectFunctions.cpp; sourceTree = "<group>"; };
 		BC756FC70E2031B200DE7D12 /* JSGlobalObjectFunctions.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSGlobalObjectFunctions.h; sourceTree = "<group>"; };
@@ -1317,6 +1366,7 @@
 				7E39D81D0EC38EFA003AF11A /* bytecompiler */,
 				A7E4FC8312F8E4A300AF4CF4 /* collector */,
 				1480DB9A0DDC2231003CFDF2 /* debugger */,
+				86EC9DB31328DF44002B2AD7 /* dfg */,
 				1429D77A0ED20D7300B89619 /* interpreter */,
 				1429D92C0ED22D7000B89619 /* jit */,
 				7E39D8370EC3A388003AF11A /* parser */,
@@ -1567,6 +1617,7 @@
 				65DFC92D08EA173A00F7300B /* HashTable.cpp */,
 				65DFC92E08EA173A00F7300B /* HashTable.h */,
 				65DFC92F08EA173A00F7300B /* HashTraits.h */,
+				7186A6E813100B57004479E1 /* HexNumber.h */,
 				657EB7450B708F540063461B /* ListHashSet.h */,
 				148A1626095D16BB00666D0D /* ListRefPtr.h */,
 				E1EE79270D6C964500FEA3BA /* Locker.h */,
@@ -1634,7 +1685,7 @@
 				E1EE79220D6C95CD00FEA3BA /* Threading.h */,
 				BC5F7BBC11823B590052C02C /* ThreadingPrimitives.h */,
 				E1EE793C0D6C9B9200FEA3BA /* ThreadingPthreads.cpp */,
-				BC5F7BBD11823B590052C02C /* ThreadSafeShared.h */,
+				BC5F7BBD11823B590052C02C /* ThreadSafeRefCounted.h */,
 				E1B7C8BD0DA3A3360074B0DC /* ThreadSpecific.h */,
 				0B330C260F38C62300692DE3 /* TypeTraits.cpp */,
 				0B4D7E620F319AC800AD7E58 /* TypeTraits.h */,
@@ -1946,6 +1997,32 @@
 			name = yarr;
 			sourceTree = "<group>";
 		};
+		86EC9DB31328DF44002B2AD7 /* dfg */ = {
+			isa = PBXGroup;
+			children = (
+				86ECA4F0132EAA6D002B2AD7 /* DFGAliasTracker.h */,
+				86EC9DB41328DF82002B2AD7 /* DFGByteCodeParser.cpp */,
+				86EC9DB51328DF82002B2AD7 /* DFGByteCodeParser.h */,
+				86EC9DB61328DF82002B2AD7 /* DFGGenerationInfo.h */,
+				86EC9DB71328DF82002B2AD7 /* DFGGraph.cpp */,
+				86EC9DB81328DF82002B2AD7 /* DFGGraph.h */,
+				86EC9DB91328DF82002B2AD7 /* DFGJITCodeGenerator.cpp */,
+				86EC9DBA1328DF82002B2AD7 /* DFGJITCodeGenerator.h */,
+				86EC9DBB1328DF82002B2AD7 /* DFGJITCompiler.cpp */,
+				86EC9DBC1328DF82002B2AD7 /* DFGJITCompiler.h */,
+				86ECA3E9132DEF1C002B2AD7 /* DFGNode.h */,
+				86EC9DBD1328DF82002B2AD7 /* DFGNonSpeculativeJIT.cpp */,
+				86EC9DBE1328DF82002B2AD7 /* DFGNonSpeculativeJIT.h */,
+				86EC9DBF1328DF82002B2AD7 /* DFGOperations.cpp */,
+				86EC9DC01328DF82002B2AD7 /* DFGOperations.h */,
+				86EC9DC11328DF82002B2AD7 /* DFGRegisterBank.h */,
+				86ECA3F9132DF25A002B2AD7 /* DFGScoreBoard.h */,
+				86EC9DC21328DF82002B2AD7 /* DFGSpeculativeJIT.cpp */,
+				86EC9DC31328DF82002B2AD7 /* DFGSpeculativeJIT.h */,
+			);
+			name = dfg;
+			sourceTree = "<group>";
+		};
 		932FC3C20824BB70005B3C75 /* Resources */ = {
 			isa = PBXGroup;
 			children = (
@@ -2074,6 +2151,10 @@
 				A7E4FC8812F8E4CA00AF4CF4 /* Handle.h */,
 				A7E4FC8912F8E4CA00AF4CF4 /* HandleHeap.cpp */,
 				A7E4FC8A12F8E4CA00AF4CF4 /* HandleHeap.h */,
+				A76BE1B7132DAC68008F7F0B /* HandleStack.cpp */,
+				A76BE1B8132DAC68008F7F0B /* HandleStack.h */,
+				A76BE1B5132DABF5008F7F0B /* Local.h */,
+				A76BE1B6132DAC24008F7F0B /* LocalScope.h */,
 			);
 			name = handles;
 			sourceTree = "<group>";
@@ -2160,6 +2241,7 @@
 				BC18C3F40E16F5CD00B34460 /* Completion.h in Headers */,
 				FDA15C1E12B0305C003A583A /* Complex.h in Headers */,
 				BC18C3F50E16F5CD00B34460 /* config.h in Headers */,
+				144836E7132DA7BE005BE785 /* ConservativeSet.h in Headers */,
 				BC18C3F60E16F5CD00B34460 /* ConstructData.h in Headers */,
 				0BDFFAE00FC6192900D69EF4 /* CrossThreadRefCounted.h in Headers */,
 				86565743115BE3DA00291F40 /* CString.h in Headers */,
@@ -2205,6 +2287,7 @@
 				BC18C40D0E16F5CD00B34460 /* HashTable.h in Headers */,
 				BC18C40E0E16F5CD00B34460 /* HashTraits.h in Headers */,
 				140CDE7112DE97B10013CFC5 /* Heap.h in Headers */,
+				7186A6EC13100BA5004479E1 /* HexNumber.h in Headers */,
 				BC18C40F0E16F5CD00B34460 /* Identifier.h in Headers */,
 				BC18C4100E16F5CD00B34460 /* InitializeThreading.h in Headers */,
 				969A07990ED1D3AE00F1F681 /* Instruction.h in Headers */,
@@ -2401,7 +2484,7 @@
 				18BAB55410DAE066000D945B /* ThreadIdentifierDataPthreads.h in Headers */,
 				BC18C4700E16F5CD00B34460 /* Threading.h in Headers */,
 				BC5F7BBF11823B590052C02C /* ThreadingPrimitives.h in Headers */,
-				BC5F7BC011823B590052C02C /* ThreadSafeShared.h in Headers */,
+				BC5F7BC011823B590052C02C /* ThreadSafeRefCounted.h in Headers */,
 				BC18C4710E16F5CD00B34460 /* ThreadSpecific.h in Headers */,
 				A7386556118697B400540279 /* ThunkGenerators.h in Headers */,
 				14A42E400F4F60EE00599099 /* TimeoutChecker.h in Headers */,
@@ -2449,6 +2532,21 @@
 				A7C40C0A130B057D00D002A1 /* BlockStack.h in Headers */,
 				A7C40C0B130B057D00D002A1 /* SentinelLinkedList.h in Headers */,
 				A7C40C0C130B057D00D002A1 /* SinglyLinkedList.h in Headers */,
+				A76BE3A0132EEA7C008F7F0B /* HandleStack.h in Headers */,
+				A76BE3A1132EEA7C008F7F0B /* Local.h in Headers */,
+				A76BE3A2132EEA7C008F7F0B /* LocalScope.h in Headers */,
+				86EC9DC51328DF82002B2AD7 /* DFGByteCodeParser.h in Headers */,
+				86EC9DC61328DF82002B2AD7 /* DFGGenerationInfo.h in Headers */,
+				86EC9DC81328DF82002B2AD7 /* DFGGraph.h in Headers */,
+				86EC9DCA1328DF82002B2AD7 /* DFGJITCodeGenerator.h in Headers */,
+				86EC9DCC1328DF82002B2AD7 /* DFGJITCompiler.h in Headers */,
+				86EC9DCE1328DF82002B2AD7 /* DFGNonSpeculativeJIT.h in Headers */,
+				86EC9DD01328DF82002B2AD7 /* DFGOperations.h in Headers */,
+				86EC9DD11328DF82002B2AD7 /* DFGRegisterBank.h in Headers */,
+				86EC9DD31328DF82002B2AD7 /* DFGSpeculativeJIT.h in Headers */,
+				86ECA3EA132DEF1C002B2AD7 /* DFGNode.h in Headers */,
+				86ECA3FA132DF25A002B2AD7 /* DFGScoreBoard.h in Headers */,
+				86ECA4F1132EAA6D002B2AD7 /* DFGAliasTracker.h in Headers */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
@@ -2888,6 +2986,14 @@
 				97941A7E1302A098004A3447 /* CryptographicallyRandomNumber.cpp in Sources */,
 				A7E4FC9112F8E4CA00AF4CF4 /* HandleHeap.cpp in Sources */,
 				A7AC25BD1304D146003396DE /* MarkedBlock.cpp in Sources */,
+				A76BE39F132EEA7C008F7F0B /* HandleStack.cpp in Sources */,
+				86EC9DC41328DF82002B2AD7 /* DFGByteCodeParser.cpp in Sources */,
+				86EC9DC71328DF82002B2AD7 /* DFGGraph.cpp in Sources */,
+				86EC9DC91328DF82002B2AD7 /* DFGJITCodeGenerator.cpp in Sources */,
+				86EC9DCB1328DF82002B2AD7 /* DFGJITCompiler.cpp in Sources */,
+				86EC9DCD1328DF82002B2AD7 /* DFGNonSpeculativeJIT.cpp in Sources */,
+				86EC9DCF1328DF82002B2AD7 /* DFGOperations.cpp in Sources */,
+				86EC9DD21328DF82002B2AD7 /* DFGSpeculativeJIT.cpp in Sources */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
diff --git a/Source/JavaScriptCore/Makefile b/Source/JavaScriptCore/Makefile
index b9e2a72..cb4c11a 100644
--- a/Source/JavaScriptCore/Makefile
+++ b/Source/JavaScriptCore/Makefile
@@ -1,2 +1 @@
-OTHER_OPTIONS = -target All
 include ../Makefile.shared
diff --git a/Source/JavaScriptCore/assembler/AbstractMacroAssembler.h b/Source/JavaScriptCore/assembler/AbstractMacroAssembler.h
index 5ebc572..8e81784 100644
--- a/Source/JavaScriptCore/assembler/AbstractMacroAssembler.h
+++ b/Source/JavaScriptCore/assembler/AbstractMacroAssembler.h
@@ -145,21 +145,21 @@ public:
     // Describes an memory operand given by a pointer.  For regular load & store
     // operations an unwrapped void* will be used, rather than using this.
     struct AbsoluteAddress {
-        explicit AbsoluteAddress(void* ptr)
+        explicit AbsoluteAddress(const void* ptr)
             : m_ptr(ptr)
         {
         }
 
-        void* m_ptr;
+        const void* m_ptr;
     };
 
-    // ImmPtr:
+    // TrustedImmPtr:
     //
     // A pointer sized immediate operand to an instruction - this is wrapped
     // in a class requiring explicit construction in order to differentiate
     // from pointers used as absolute addresses to memory operations
-    struct ImmPtr {
-        explicit ImmPtr(const void* value)
+    struct TrustedImmPtr {
+        explicit TrustedImmPtr(const void* value)
             : m_value(value)
         {
         }
@@ -172,14 +172,21 @@ public:
         const void* m_value;
     };
 
-    // Imm32:
+    struct ImmPtr : public TrustedImmPtr {
+        explicit ImmPtr(const void* value)
+            : TrustedImmPtr(value)
+        {
+        }
+    };
+
+    // TrustedImm32:
     //
     // A 32bit immediate operand to an instruction - this is wrapped in a
     // class requiring explicit construction in order to prevent RegisterIDs
     // (which are implemented as an enum) from accidentally being passed as
     // immediate values.
-    struct Imm32 {
-        explicit Imm32(int32_t value)
+    struct TrustedImm32 {
+        explicit TrustedImm32(int32_t value)
             : m_value(value)
 #if CPU(ARM) || CPU(MIPS)
             , m_isPointer(false)
@@ -188,7 +195,7 @@ public:
         }
 
 #if !CPU(X86_64)
-        explicit Imm32(ImmPtr ptr)
+        explicit TrustedImm32(TrustedImmPtr ptr)
             : m_value(ptr.asIntptr())
 #if CPU(ARM) || CPU(MIPS)
             , m_isPointer(true)
@@ -211,6 +218,19 @@ public:
     };
 
 
+    struct Imm32 : public TrustedImm32 {
+        explicit Imm32(int32_t value)
+            : TrustedImm32(value)
+        {
+        }
+#if !CPU(X86_64)
+        explicit Imm32(TrustedImmPtr ptr)
+            : TrustedImm32(ptr)
+        {
+        }
+#endif
+    };
+    
     // Section 2: MacroAssembler code buffer handles
     //
     // The following types are used to reference items in the code buffer
@@ -358,16 +378,18 @@ public:
         {
         }
         
-        void link(AbstractMacroAssembler<AssemblerType>* masm)
+        void link(AbstractMacroAssembler<AssemblerType>* masm) const
         {
             masm->m_assembler.linkJump(m_jmp, masm->m_assembler.label());
         }
         
-        void linkTo(Label label, AbstractMacroAssembler<AssemblerType>* masm)
+        void linkTo(Label label, AbstractMacroAssembler<AssemblerType>* masm) const
         {
             masm->m_assembler.linkJump(m_jmp, label.m_label);
         }
 
+        bool isSet() const { return m_jmp.isSet(); }
+
     private:
         JmpSrc m_jmp;
     };
diff --git a/Source/JavaScriptCore/assembler/AssemblerBuffer.h b/Source/JavaScriptCore/assembler/AssemblerBuffer.h
index 0454a99..a90efc6 100644
--- a/Source/JavaScriptCore/assembler/AssemblerBuffer.h
+++ b/Source/JavaScriptCore/assembler/AssemblerBuffer.h
@@ -114,6 +114,21 @@ namespace JSC {
             putIntUnchecked(value);
         }
 
+        template<typename IntegralType>
+        void putIntegral(IntegralType value)
+        {
+            if (m_size > m_capacity - sizeof(IntegralType))
+                grow();
+            putIntegralUnchecked(value);
+        }
+
+        template<typename IntegralType>
+        void putIntegralUnchecked(IntegralType value)
+        {
+            *reinterpret_cast_ptr<IntegralType*>(&m_buffer[m_size]) = value;
+            m_size += sizeof(IntegralType);
+        }
+
         void* data() const
         {
             return m_buffer;
diff --git a/Source/JavaScriptCore/assembler/AssemblerBufferWithConstantPool.h b/Source/JavaScriptCore/assembler/AssemblerBufferWithConstantPool.h
index 599be14..9a9618f 100644
--- a/Source/JavaScriptCore/assembler/AssemblerBufferWithConstantPool.h
+++ b/Source/JavaScriptCore/assembler/AssemblerBufferWithConstantPool.h
@@ -188,29 +188,14 @@ public:
         return AssemblerBuffer::executableCopy(allocator);
     }
 
-    void putIntWithConstantInt(uint32_t insn, uint32_t constant, bool isReusable = false)
+    void putShortWithConstantInt(uint16_t insn, uint32_t constant, bool isReusable = false)
     {
-        if (!m_numConsts)
-            m_maxDistance = maxPoolSize;
-        flushIfNoSpaceFor(4, 4);
-
-        m_loadOffsets.append(AssemblerBuffer::size());
-        if (isReusable)
-            for (int i = 0; i < m_numConsts; ++i) {
-                if (m_mask[i] == ReusableConst && m_pool[i] == constant) {
-                    AssemblerBuffer::putInt(AssemblerType::patchConstantPoolLoad(insn, i));
-                    correctDeltas(4);
-                    return;
-                }
-            }
-
-        m_pool[m_numConsts] = constant;
-        m_mask[m_numConsts] = static_cast<char>(isReusable ? ReusableConst : UniqueConst);
-
-        AssemblerBuffer::putInt(AssemblerType::patchConstantPoolLoad(insn, m_numConsts));
-        ++m_numConsts;
+        putIntegralWithConstantInt(insn, constant, isReusable);
+    }
 
-        correctDeltas(4, 4);
+    void putIntWithConstantInt(uint32_t insn, uint32_t constant, bool isReusable = false)
+    {
+        putIntegralWithConstantInt(insn, constant, isReusable);
     }
 
     // This flushing mechanism can be called after any unconditional jumps.
@@ -248,6 +233,33 @@ private:
         m_lastConstDelta = constSize;
     }
 
+    template<typename IntegralType>
+    void putIntegralWithConstantInt(IntegralType insn, uint32_t constant, bool isReusable)
+    {
+        if (!m_numConsts)
+            m_maxDistance = maxPoolSize;
+        flushIfNoSpaceFor(sizeof(IntegralType), 4);
+
+        m_loadOffsets.append(AssemblerBuffer::size());
+        if (isReusable) {
+            for (int i = 0; i < m_numConsts; ++i) {
+                if (m_mask[i] == ReusableConst && m_pool[i] == constant) {
+                    putIntegral(static_cast<IntegralType>(AssemblerType::patchConstantPoolLoad(insn, i)));
+                    correctDeltas(sizeof(IntegralType));
+                    return;
+                }
+            }
+        }
+
+        m_pool[m_numConsts] = constant;
+        m_mask[m_numConsts] = static_cast<char>(isReusable ? ReusableConst : UniqueConst);
+
+        putIntegral(static_cast<IntegralType>(AssemblerType::patchConstantPoolLoad(insn, m_numConsts)));
+        ++m_numConsts;
+
+        correctDeltas(sizeof(IntegralType), 4);
+    }
+
     void flushConstantPool(bool useBarrier = true)
     {
         if (m_numConsts == 0)
@@ -259,7 +271,7 @@ private:
 
         // Callback to protect the constant pool from execution
         if (useBarrier)
-            AssemblerBuffer::putInt(AssemblerType::placeConstantPoolBarrier(m_numConsts * sizeof(uint32_t) + alignPool));
+            putIntegral(AssemblerType::placeConstantPoolBarrier(m_numConsts * sizeof(uint32_t) + alignPool));
 
         if (alignPool) {
             if (alignPool & 1)
diff --git a/Source/JavaScriptCore/assembler/MacroAssembler.h b/Source/JavaScriptCore/assembler/MacroAssembler.h
index fa165de..bb19a98 100644
--- a/Source/JavaScriptCore/assembler/MacroAssembler.h
+++ b/Source/JavaScriptCore/assembler/MacroAssembler.h
@@ -74,7 +74,7 @@ public:
     // described in terms of other macro assembly methods.
     void pop()
     {
-        addPtr(Imm32(sizeof(void*)), stackPointerRegister);
+        addPtr(TrustedImm32(sizeof(void*)), stackPointerRegister);
     }
     
     void peek(RegisterID dest, int index = 0)
@@ -87,19 +87,19 @@ public:
         storePtr(src, Address(stackPointerRegister, (index * sizeof(void*))));
     }
 
-    void poke(Imm32 value, int index = 0)
+    void poke(TrustedImm32 value, int index = 0)
     {
         store32(value, Address(stackPointerRegister, (index * sizeof(void*))));
     }
 
-    void poke(ImmPtr imm, int index = 0)
+    void poke(TrustedImmPtr imm, int index = 0)
     {
         storePtr(imm, Address(stackPointerRegister, (index * sizeof(void*))));
     }
 
 
     // Backwards banches, these are currently all implemented using existing forwards branch mechanisms.
-    void branchPtr(Condition cond, RegisterID op1, ImmPtr imm, Label target)
+    void branchPtr(Condition cond, RegisterID op1, TrustedImmPtr imm, Label target)
     {
         branchPtr(cond, op1, imm).linkTo(target, this);
     }
@@ -109,7 +109,7 @@ public:
         branch32(cond, op1, op2).linkTo(target, this);
     }
 
-    void branch32(Condition cond, RegisterID op1, Imm32 imm, Label target)
+    void branch32(Condition cond, RegisterID op1, TrustedImm32 imm, Label target)
     {
         branch32(cond, op1, imm).linkTo(target, this);
     }
@@ -144,17 +144,17 @@ public:
         add32(src, dest);
     }
 
-    void addPtr(Imm32 imm, RegisterID srcDest)
+    void addPtr(TrustedImm32 imm, RegisterID srcDest)
     {
         add32(imm, srcDest);
     }
 
-    void addPtr(ImmPtr imm, RegisterID dest)
+    void addPtr(TrustedImmPtr imm, RegisterID dest)
     {
-        add32(Imm32(imm), dest);
+        add32(TrustedImm32(imm), dest);
     }
 
-    void addPtr(Imm32 imm, RegisterID src, RegisterID dest)
+    void addPtr(TrustedImm32 imm, RegisterID src, RegisterID dest)
     {
         add32(imm, src, dest);
     }
@@ -164,7 +164,7 @@ public:
         and32(src, dest);
     }
 
-    void andPtr(Imm32 imm, RegisterID srcDest)
+    void andPtr(TrustedImm32 imm, RegisterID srcDest)
     {
         and32(imm, srcDest);
     }
@@ -174,12 +174,12 @@ public:
         or32(src, dest);
     }
 
-    void orPtr(ImmPtr imm, RegisterID dest)
+    void orPtr(TrustedImmPtr imm, RegisterID dest)
     {
-        or32(Imm32(imm), dest);
+        or32(TrustedImm32(imm), dest);
     }
 
-    void orPtr(Imm32 imm, RegisterID dest)
+    void orPtr(TrustedImm32 imm, RegisterID dest)
     {
         or32(imm, dest);
     }
@@ -189,14 +189,14 @@ public:
         sub32(src, dest);
     }
     
-    void subPtr(Imm32 imm, RegisterID dest)
+    void subPtr(TrustedImm32 imm, RegisterID dest)
     {
         sub32(imm, dest);
     }
     
-    void subPtr(ImmPtr imm, RegisterID dest)
+    void subPtr(TrustedImmPtr imm, RegisterID dest)
     {
-        sub32(Imm32(imm), dest);
+        sub32(TrustedImm32(imm), dest);
     }
 
     void xorPtr(RegisterID src, RegisterID dest)
@@ -204,7 +204,7 @@ public:
         xor32(src, dest);
     }
 
-    void xorPtr(Imm32 imm, RegisterID srcDest)
+    void xorPtr(TrustedImm32 imm, RegisterID srcDest)
     {
         xor32(imm, srcDest);
     }
@@ -230,7 +230,7 @@ public:
         return load32WithAddressOffsetPatch(address, dest);
     }
 
-    void setPtr(Condition cond, RegisterID left, Imm32 right, RegisterID dest)
+    void setPtr(Condition cond, RegisterID left, TrustedImm32 right, RegisterID dest)
     {
         set32Compare32(cond, left, right, dest);
     }
@@ -250,14 +250,14 @@ public:
         store32(src, address);
     }
 
-    void storePtr(ImmPtr imm, ImplicitAddress address)
+    void storePtr(TrustedImmPtr imm, ImplicitAddress address)
     {
-        store32(Imm32(imm), address);
+        store32(TrustedImm32(imm), address);
     }
 
-    void storePtr(ImmPtr imm, void* address)
+    void storePtr(TrustedImmPtr imm, void* address)
     {
-        store32(Imm32(imm), address);
+        store32(TrustedImm32(imm), address);
     }
 
     DataLabel32 storePtrWithAddressOffsetPatch(RegisterID src, Address address)
@@ -271,9 +271,9 @@ public:
         return branch32(cond, left, right);
     }
 
-    Jump branchPtr(Condition cond, RegisterID left, ImmPtr right)
+    Jump branchPtr(Condition cond, RegisterID left, TrustedImmPtr right)
     {
-        return branch32(cond, left, Imm32(right));
+        return branch32(cond, left, TrustedImm32(right));
     }
 
     Jump branchPtr(Condition cond, RegisterID left, Address right)
@@ -291,14 +291,14 @@ public:
         return branch32(cond, left, right);
     }
 
-    Jump branchPtr(Condition cond, Address left, ImmPtr right)
+    Jump branchPtr(Condition cond, Address left, TrustedImmPtr right)
     {
-        return branch32(cond, left, Imm32(right));
+        return branch32(cond, left, TrustedImm32(right));
     }
 
-    Jump branchPtr(Condition cond, AbsoluteAddress left, ImmPtr right)
+    Jump branchPtr(Condition cond, AbsoluteAddress left, TrustedImmPtr right)
     {
-        return branch32(cond, left, Imm32(right));
+        return branch32(cond, left, TrustedImm32(right));
     }
 
     Jump branchTestPtr(Condition cond, RegisterID reg, RegisterID mask)
@@ -306,17 +306,17 @@ public:
         return branchTest32(cond, reg, mask);
     }
 
-    Jump branchTestPtr(Condition cond, RegisterID reg, Imm32 mask = Imm32(-1))
+    Jump branchTestPtr(Condition cond, RegisterID reg, TrustedImm32 mask = TrustedImm32(-1))
     {
         return branchTest32(cond, reg, mask);
     }
 
-    Jump branchTestPtr(Condition cond, Address address, Imm32 mask = Imm32(-1))
+    Jump branchTestPtr(Condition cond, Address address, TrustedImm32 mask = TrustedImm32(-1))
     {
         return branchTest32(cond, address, mask);
     }
 
-    Jump branchTestPtr(Condition cond, BaseIndex address, Imm32 mask = Imm32(-1))
+    Jump branchTestPtr(Condition cond, BaseIndex address, TrustedImm32 mask = TrustedImm32(-1))
     {
         return branchTest32(cond, address, mask);
     }
@@ -327,12 +327,12 @@ public:
         return branchAdd32(cond, src, dest);
     }
 
-    Jump branchSubPtr(Condition cond, Imm32 imm, RegisterID dest)
+    Jump branchSubPtr(Condition cond, TrustedImm32 imm, RegisterID dest)
     {
         return branchSub32(cond, imm, dest);
     }
     using MacroAssemblerBase::branchTest8;
-    Jump branchTest8(Condition cond, ExtendedAddress address, Imm32 mask = Imm32(-1))
+    Jump branchTest8(Condition cond, ExtendedAddress address, TrustedImm32 mask = TrustedImm32(-1))
     {
         return MacroAssemblerBase::branchTest8(cond, Address(address.base, address.offset), mask);
     }
diff --git a/Source/JavaScriptCore/assembler/MacroAssemblerARM.h b/Source/JavaScriptCore/assembler/MacroAssemblerARM.h
index 66814b5..80f69bf 100644
--- a/Source/JavaScriptCore/assembler/MacroAssemblerARM.h
+++ b/Source/JavaScriptCore/assembler/MacroAssemblerARM.h
@@ -86,14 +86,14 @@ public:
         m_assembler.adds_r(dest, dest, src);
     }
 
-    void add32(Imm32 imm, Address address)
+    void add32(TrustedImm32 imm, Address address)
     {
         load32(address, ARMRegisters::S1);
         add32(imm, ARMRegisters::S1);
         store32(ARMRegisters::S1, address);
     }
 
-    void add32(Imm32 imm, RegisterID dest)
+    void add32(TrustedImm32 imm, RegisterID dest)
     {
         m_assembler.adds_r(dest, dest, m_assembler.getImm(imm.m_value, ARMRegisters::S0));
     }
@@ -109,7 +109,7 @@ public:
         m_assembler.ands_r(dest, dest, src);
     }
 
-    void and32(Imm32 imm, RegisterID dest)
+    void and32(TrustedImm32 imm, RegisterID dest)
     {
         ARMWord w = m_assembler.getImm(imm.m_value, ARMRegisters::S0, true);
         if (w & ARMAssembler::OP2_INV_IMM)
@@ -127,7 +127,7 @@ public:
         m_assembler.movs_r(dest, m_assembler.lsl_r(dest, ARMRegisters::S0));
     }
 
-    void lshift32(Imm32 imm, RegisterID dest)
+    void lshift32(TrustedImm32 imm, RegisterID dest)
     {
         m_assembler.movs_r(dest, m_assembler.lsl(dest, imm.m_value & 0x1f));
     }
@@ -141,7 +141,7 @@ public:
         m_assembler.muls_r(dest, dest, src);
     }
 
-    void mul32(Imm32 imm, RegisterID src, RegisterID dest)
+    void mul32(TrustedImm32 imm, RegisterID src, RegisterID dest)
     {
         move(imm, ARMRegisters::S0);
         m_assembler.muls_r(dest, src, ARMRegisters::S0);
@@ -162,7 +162,7 @@ public:
         m_assembler.orrs_r(dest, dest, src);
     }
 
-    void or32(Imm32 imm, RegisterID dest)
+    void or32(TrustedImm32 imm, RegisterID dest)
     {
         m_assembler.orrs_r(dest, dest, m_assembler.getImm(imm.m_value, ARMRegisters::S0));
     }
@@ -176,7 +176,7 @@ public:
         m_assembler.movs_r(dest, m_assembler.asr_r(dest, ARMRegisters::S0));
     }
 
-    void rshift32(Imm32 imm, RegisterID dest)
+    void rshift32(TrustedImm32 imm, RegisterID dest)
     {
         m_assembler.movs_r(dest, m_assembler.asr(dest, imm.m_value & 0x1f));
     }
@@ -190,7 +190,7 @@ public:
         m_assembler.movs_r(dest, m_assembler.lsr_r(dest, ARMRegisters::S0));
     }
     
-    void urshift32(Imm32 imm, RegisterID dest)
+    void urshift32(TrustedImm32 imm, RegisterID dest)
     {
         m_assembler.movs_r(dest, m_assembler.lsr(dest, imm.m_value & 0x1f));
     }
@@ -200,12 +200,12 @@ public:
         m_assembler.subs_r(dest, dest, src);
     }
 
-    void sub32(Imm32 imm, RegisterID dest)
+    void sub32(TrustedImm32 imm, RegisterID dest)
     {
         m_assembler.subs_r(dest, dest, m_assembler.getImm(imm.m_value, ARMRegisters::S0));
     }
 
-    void sub32(Imm32 imm, Address address)
+    void sub32(TrustedImm32 imm, Address address)
     {
         load32(address, ARMRegisters::S1);
         sub32(imm, ARMRegisters::S1);
@@ -223,7 +223,7 @@ public:
         m_assembler.eors_r(dest, dest, src);
     }
 
-    void xor32(Imm32 imm, RegisterID dest)
+    void xor32(TrustedImm32 imm, RegisterID dest)
     {
         m_assembler.eors_r(dest, dest, m_assembler.getImm(imm.m_value, ARMRegisters::S0));
     }
@@ -303,7 +303,7 @@ public:
         m_assembler.baseIndexTransfer32(false, src, address.base, address.index, static_cast<int>(address.scale), address.offset);
     }
 
-    void store32(Imm32 imm, ImplicitAddress address)
+    void store32(TrustedImm32 imm, ImplicitAddress address)
     {
         if (imm.m_isPointer)
             m_assembler.ldr_un_imm(ARMRegisters::S1, imm.m_value);
@@ -318,7 +318,7 @@ public:
         m_assembler.dtr_u(false, src, ARMRegisters::S0, 0);
     }
 
-    void store32(Imm32 imm, void* address)
+    void store32(TrustedImm32 imm, void* address)
     {
         m_assembler.ldr_un_imm(ARMRegisters::S0, reinterpret_cast<ARMWord>(address));
         if (imm.m_isPointer)
@@ -344,13 +344,13 @@ public:
         push(ARMRegisters::S1);
     }
 
-    void push(Imm32 imm)
+    void push(TrustedImm32 imm)
     {
         move(imm, ARMRegisters::S0);
         push(ARMRegisters::S0);
     }
 
-    void move(Imm32 imm, RegisterID dest)
+    void move(TrustedImm32 imm, RegisterID dest)
     {
         if (imm.m_isPointer)
             m_assembler.ldr_un_imm(dest, imm.m_value);
@@ -363,9 +363,9 @@ public:
         m_assembler.mov_r(dest, src);
     }
 
-    void move(ImmPtr imm, RegisterID dest)
+    void move(TrustedImmPtr imm, RegisterID dest)
     {
-        move(Imm32(imm), dest);
+        move(TrustedImm32(imm), dest);
     }
 
     void swap(RegisterID reg1, RegisterID reg2)
@@ -387,7 +387,7 @@ public:
             move(src, dest);
     }
 
-    Jump branch8(Condition cond, Address left, Imm32 right)
+    Jump branch8(Condition cond, Address left, TrustedImm32 right)
     {
         load8(left, ARMRegisters::S1);
         return branch32(cond, ARMRegisters::S1, right);
@@ -399,7 +399,7 @@ public:
         return Jump(m_assembler.jmp(ARMCondition(cond), useConstantPool));
     }
 
-    Jump branch32(Condition cond, RegisterID left, Imm32 right, int useConstantPool = 0)
+    Jump branch32(Condition cond, RegisterID left, TrustedImm32 right, int useConstantPool = 0)
     {
         if (right.m_isPointer) {
             m_assembler.ldr_un_imm(ARMRegisters::S0, right.m_value);
@@ -426,19 +426,19 @@ public:
         return branch32(cond, ARMRegisters::S1, right);
     }
 
-    Jump branch32(Condition cond, Address left, Imm32 right)
+    Jump branch32(Condition cond, Address left, TrustedImm32 right)
     {
         load32(left, ARMRegisters::S1);
         return branch32(cond, ARMRegisters::S1, right);
     }
 
-    Jump branch32(Condition cond, BaseIndex left, Imm32 right)
+    Jump branch32(Condition cond, BaseIndex left, TrustedImm32 right)
     {
         load32(left, ARMRegisters::S1);
         return branch32(cond, ARMRegisters::S1, right);
     }
 
-    Jump branch32WithUnalignedHalfWords(Condition cond, BaseIndex left, Imm32 right)
+    Jump branch32WithUnalignedHalfWords(Condition cond, BaseIndex left, TrustedImm32 right)
     {
         load32WithUnalignedHalfWords(left, ARMRegisters::S1);
         return branch32(cond, ARMRegisters::S1, right);
@@ -453,7 +453,7 @@ public:
         return jump();
     }
 
-    Jump branch16(Condition cond, BaseIndex left, Imm32 right)
+    Jump branch16(Condition cond, BaseIndex left, TrustedImm32 right)
     {
         load16(left, ARMRegisters::S0);
         move(right, ARMRegisters::S1);
@@ -461,7 +461,7 @@ public:
         return m_assembler.jmp(ARMCondition(cond));
     }
 
-    Jump branchTest8(Condition cond, Address address, Imm32 mask = Imm32(-1))
+    Jump branchTest8(Condition cond, Address address, TrustedImm32 mask = TrustedImm32(-1))
     {
         load8(address, ARMRegisters::S1);
         return branchTest32(cond, ARMRegisters::S1, mask);
@@ -474,7 +474,7 @@ public:
         return Jump(m_assembler.jmp(ARMCondition(cond)));
     }
 
-    Jump branchTest32(Condition cond, RegisterID reg, Imm32 mask = Imm32(-1))
+    Jump branchTest32(Condition cond, RegisterID reg, TrustedImm32 mask = TrustedImm32(-1))
     {
         ASSERT((cond == Zero) || (cond == NonZero));
         ARMWord w = m_assembler.getImm(mask.m_value, ARMRegisters::S0, true);
@@ -485,13 +485,13 @@ public:
         return Jump(m_assembler.jmp(ARMCondition(cond)));
     }
 
-    Jump branchTest32(Condition cond, Address address, Imm32 mask = Imm32(-1))
+    Jump branchTest32(Condition cond, Address address, TrustedImm32 mask = TrustedImm32(-1))
     {
         load32(address, ARMRegisters::S1);
         return branchTest32(cond, ARMRegisters::S1, mask);
     }
 
-    Jump branchTest32(Condition cond, BaseIndex address, Imm32 mask = Imm32(-1))
+    Jump branchTest32(Condition cond, BaseIndex address, TrustedImm32 mask = TrustedImm32(-1))
     {
         load32(address, ARMRegisters::S1);
         return branchTest32(cond, ARMRegisters::S1, mask);
@@ -519,7 +519,7 @@ public:
         return Jump(m_assembler.jmp(ARMCondition(cond)));
     }
 
-    Jump branchAdd32(Condition cond, Imm32 imm, RegisterID dest)
+    Jump branchAdd32(Condition cond, TrustedImm32 imm, RegisterID dest)
     {
         ASSERT((cond == Overflow) || (cond == Signed) || (cond == Zero) || (cond == NonZero));
         add32(imm, dest);
@@ -548,7 +548,7 @@ public:
         return Jump(m_assembler.jmp(ARMCondition(cond)));
     }
 
-    Jump branchMul32(Condition cond, Imm32 imm, RegisterID src, RegisterID dest)
+    Jump branchMul32(Condition cond, TrustedImm32 imm, RegisterID src, RegisterID dest)
     {
         ASSERT((cond == Overflow) || (cond == Signed) || (cond == Zero) || (cond == NonZero));
         if (cond == Overflow) {
@@ -568,7 +568,7 @@ public:
         return Jump(m_assembler.jmp(ARMCondition(cond)));
     }
 
-    Jump branchSub32(Condition cond, Imm32 imm, RegisterID dest)
+    Jump branchSub32(Condition cond, TrustedImm32 imm, RegisterID dest)
     {
         ASSERT((cond == Overflow) || (cond == Signed) || (cond == Zero) || (cond == NonZero));
         sub32(imm, dest);
@@ -628,7 +628,7 @@ public:
         m_assembler.mov_r(dest, ARMAssembler::getOp2(1), ARMCondition(cond));
     }
 
-    void set32Compare32(Condition cond, RegisterID left, Imm32 right, RegisterID dest)
+    void set32Compare32(Condition cond, RegisterID left, TrustedImm32 right, RegisterID dest)
     {
         m_assembler.cmp_r(left, m_assembler.getImm(right.m_value, ARMRegisters::S0));
         m_assembler.mov_r(dest, ARMAssembler::getOp2(0));
@@ -648,13 +648,13 @@ public:
         set32Compare32(cond, ARMRegisters::S1, right, dest);
     }
 
-    void set8Compare32(Condition cond, RegisterID left, Imm32 right, RegisterID dest)
+    void set8Compare32(Condition cond, RegisterID left, TrustedImm32 right, RegisterID dest)
     {
         // ARM doesn't have byte registers
         set32Compare32(cond, left, right, dest);
     }
 
-    void set32Test32(Condition cond, RegisterID reg, Imm32 mask, RegisterID dest)
+    void set32Test32(Condition cond, RegisterID reg, TrustedImm32 mask, RegisterID dest)
     {
         if (mask.m_value == -1)
             m_assembler.cmp_r(0, reg);
@@ -664,24 +664,24 @@ public:
         m_assembler.mov_r(dest, ARMAssembler::getOp2(1), ARMCondition(cond));
     }
 
-    void set32Test32(Condition cond, Address address, Imm32 mask, RegisterID dest)
+    void set32Test32(Condition cond, Address address, TrustedImm32 mask, RegisterID dest)
     {
         load32(address, ARMRegisters::S1);
         set32Test32(cond, ARMRegisters::S1, mask, dest);
     }
 
-    void set32Test8(Condition cond, Address address, Imm32 mask, RegisterID dest)
+    void set32Test8(Condition cond, Address address, TrustedImm32 mask, RegisterID dest)
     {
         load8(address, ARMRegisters::S1);
         set32Test32(cond, ARMRegisters::S1, mask, dest);
     }
 
-    void add32(Imm32 imm, RegisterID src, RegisterID dest)
+    void add32(TrustedImm32 imm, RegisterID src, RegisterID dest)
     {
         m_assembler.add_r(dest, src, m_assembler.getImm(imm.m_value, ARMRegisters::S0));
     }
 
-    void add32(Imm32 imm, AbsoluteAddress address)
+    void add32(TrustedImm32 imm, AbsoluteAddress address)
     {
         m_assembler.ldr_un_imm(ARMRegisters::S1, reinterpret_cast<ARMWord>(address.m_ptr));
         m_assembler.dtr_u(true, ARMRegisters::S1, ARMRegisters::S1, 0);
@@ -690,7 +690,7 @@ public:
         m_assembler.dtr_u(false, ARMRegisters::S1, ARMRegisters::S0, 0);
     }
 
-    void sub32(Imm32 imm, AbsoluteAddress address)
+    void sub32(TrustedImm32 imm, AbsoluteAddress address)
     {
         m_assembler.ldr_un_imm(ARMRegisters::S1, reinterpret_cast<ARMWord>(address.m_ptr));
         m_assembler.dtr_u(true, ARMRegisters::S1, ARMRegisters::S1, 0);
@@ -699,7 +699,7 @@ public:
         m_assembler.dtr_u(false, ARMRegisters::S1, ARMRegisters::S0, 0);
     }
 
-    void load32(void* address, RegisterID dest)
+    void load32(const void* address, RegisterID dest)
     {
         m_assembler.ldr_un_imm(ARMRegisters::S0, reinterpret_cast<ARMWord>(address));
         m_assembler.dtr_u(true, dest, ARMRegisters::S0, 0);
@@ -711,7 +711,7 @@ public:
         return branch32(cond, ARMRegisters::S1, right);
     }
 
-    Jump branch32(Condition cond, AbsoluteAddress left, Imm32 right)
+    Jump branch32(Condition cond, AbsoluteAddress left, TrustedImm32 right)
     {
         load32(left.m_ptr, ARMRegisters::S1);
         return branch32(cond, ARMRegisters::S1, right);
@@ -748,21 +748,21 @@ public:
         return Call::fromTailJump(oldJump);
     }
 
-    DataLabelPtr moveWithPatch(ImmPtr initialValue, RegisterID dest)
+    DataLabelPtr moveWithPatch(TrustedImmPtr initialValue, RegisterID dest)
     {
         DataLabelPtr dataLabel(this);
         m_assembler.ldr_un_imm(dest, reinterpret_cast<ARMWord>(initialValue.m_value));
         return dataLabel;
     }
 
-    Jump branchPtrWithPatch(Condition cond, RegisterID left, DataLabelPtr& dataLabel, ImmPtr initialRightValue = ImmPtr(0))
+    Jump branchPtrWithPatch(Condition cond, RegisterID left, DataLabelPtr& dataLabel, TrustedImmPtr initialRightValue = TrustedImmPtr(0))
     {
         dataLabel = moveWithPatch(initialRightValue, ARMRegisters::S1);
         Jump jump = branch32(cond, left, ARMRegisters::S1, true);
         return jump;
     }
 
-    Jump branchPtrWithPatch(Condition cond, Address left, DataLabelPtr& dataLabel, ImmPtr initialRightValue = ImmPtr(0))
+    Jump branchPtrWithPatch(Condition cond, Address left, DataLabelPtr& dataLabel, TrustedImmPtr initialRightValue = TrustedImmPtr(0))
     {
         load32(left, ARMRegisters::S1);
         dataLabel = moveWithPatch(initialRightValue, ARMRegisters::S0);
@@ -770,7 +770,7 @@ public:
         return jump;
     }
 
-    DataLabelPtr storePtrWithPatch(ImmPtr initialValue, ImplicitAddress address)
+    DataLabelPtr storePtrWithPatch(TrustedImmPtr initialValue, ImplicitAddress address)
     {
         DataLabelPtr dataLabel = moveWithPatch(initialValue, ARMRegisters::S1);
         store32(ARMRegisters::S1, address);
@@ -779,7 +779,7 @@ public:
 
     DataLabelPtr storePtrWithPatch(ImplicitAddress address)
     {
-        return storePtrWithPatch(ImmPtr(0), address);
+        return storePtrWithPatch(TrustedImmPtr(0), address);
     }
 
     // Floating point operators
diff --git a/Source/JavaScriptCore/assembler/MacroAssemblerARMv7.h b/Source/JavaScriptCore/assembler/MacroAssemblerARMv7.h
index 450a34c..84e0a5e 100644
--- a/Source/JavaScriptCore/assembler/MacroAssemblerARMv7.h
+++ b/Source/JavaScriptCore/assembler/MacroAssemblerARMv7.h
@@ -139,7 +139,7 @@ public:
     // Integer arithmetic operations:
     //
     // Operations are typically two operand - operation(source, srcDst)
-    // For many operations the source may be an Imm32, the srcDst operand
+    // For many operations the source may be an TrustedImm32, the srcDst operand
     // may often be a memory location (explictly described using an Address
     // object).
 
@@ -148,12 +148,12 @@ public:
         m_assembler.add(dest, dest, src);
     }
 
-    void add32(Imm32 imm, RegisterID dest)
+    void add32(TrustedImm32 imm, RegisterID dest)
     {
         add32(imm, dest, dest);
     }
 
-    void add32(Imm32 imm, RegisterID src, RegisterID dest)
+    void add32(TrustedImm32 imm, RegisterID src, RegisterID dest)
     {
         ARMThumbImmediate armImm = ARMThumbImmediate::makeUInt12OrEncodedImm(imm.m_value);
         if (armImm.isValid())
@@ -164,7 +164,7 @@ public:
         }
     }
 
-    void add32(Imm32 imm, Address address)
+    void add32(TrustedImm32 imm, Address address)
     {
         load32(address, dataTempRegister);
 
@@ -187,7 +187,7 @@ public:
         add32(dataTempRegister, dest);
     }
 
-    void add32(Imm32 imm, AbsoluteAddress address)
+    void add32(TrustedImm32 imm, AbsoluteAddress address)
     {
         load32(address.m_ptr, dataTempRegister);
 
@@ -209,7 +209,7 @@ public:
         m_assembler.ARM_and(dest, dest, src);
     }
 
-    void and32(Imm32 imm, RegisterID dest)
+    void and32(TrustedImm32 imm, RegisterID dest)
     {
         ARMThumbImmediate armImm = ARMThumbImmediate::makeEncodedImm(imm.m_value);
         if (armImm.isValid())
@@ -235,7 +235,7 @@ public:
         m_assembler.lsl(dest, dest, dataTempRegister);
     }
 
-    void lshift32(Imm32 imm, RegisterID dest)
+    void lshift32(TrustedImm32 imm, RegisterID dest)
     {
         m_assembler.lsl(dest, dest, imm.m_value & 0x1f);
     }
@@ -245,7 +245,7 @@ public:
         m_assembler.smull(dest, dataTempRegister, dest, src);
     }
 
-    void mul32(Imm32 imm, RegisterID src, RegisterID dest)
+    void mul32(TrustedImm32 imm, RegisterID src, RegisterID dest)
     {
         move(imm, dataTempRegister);
         m_assembler.smull(dest, dataTempRegister, src, dataTempRegister);
@@ -266,7 +266,7 @@ public:
         m_assembler.orr(dest, dest, src);
     }
 
-    void or32(Imm32 imm, RegisterID dest)
+    void or32(TrustedImm32 imm, RegisterID dest)
     {
         ARMThumbImmediate armImm = ARMThumbImmediate::makeEncodedImm(imm.m_value);
         if (armImm.isValid())
@@ -287,7 +287,7 @@ public:
         m_assembler.asr(dest, dest, dataTempRegister);
     }
 
-    void rshift32(Imm32 imm, RegisterID dest)
+    void rshift32(TrustedImm32 imm, RegisterID dest)
     {
         m_assembler.asr(dest, dest, imm.m_value & 0x1f);
     }
@@ -302,7 +302,7 @@ public:
         m_assembler.lsr(dest, dest, dataTempRegister);
     }
     
-    void urshift32(Imm32 imm, RegisterID dest)
+    void urshift32(TrustedImm32 imm, RegisterID dest)
     {
         m_assembler.lsr(dest, dest, imm.m_value & 0x1f);
     }
@@ -312,7 +312,7 @@ public:
         m_assembler.sub(dest, dest, src);
     }
 
-    void sub32(Imm32 imm, RegisterID dest)
+    void sub32(TrustedImm32 imm, RegisterID dest)
     {
         ARMThumbImmediate armImm = ARMThumbImmediate::makeUInt12OrEncodedImm(imm.m_value);
         if (armImm.isValid())
@@ -323,7 +323,7 @@ public:
         }
     }
 
-    void sub32(Imm32 imm, Address address)
+    void sub32(TrustedImm32 imm, Address address)
     {
         load32(address, dataTempRegister);
 
@@ -346,7 +346,7 @@ public:
         sub32(dataTempRegister, dest);
     }
 
-    void sub32(Imm32 imm, AbsoluteAddress address)
+    void sub32(TrustedImm32 imm, AbsoluteAddress address)
     {
         load32(address.m_ptr, dataTempRegister);
 
@@ -368,7 +368,7 @@ public:
         m_assembler.eor(dest, dest, src);
     }
 
-    void xor32(Imm32 imm, RegisterID dest)
+    void xor32(TrustedImm32 imm, RegisterID dest)
     {
         ARMThumbImmediate armImm = ARMThumbImmediate::makeEncodedImm(imm.m_value);
         if (armImm.isValid())
@@ -383,7 +383,7 @@ public:
     // Memory access operations:
     //
     // Loads are of the form load(address, destination) and stores of the form
-    // store(source, address).  The source for a store may be an Imm32.  Address
+    // store(source, address).  The source for a store may be an TrustedImm32.  Address
     // operand objects to loads and store will be implicitly constructed if a
     // register is passed.
 
@@ -460,9 +460,9 @@ public:
         load32(setupArmAddress(address), dest);
     }
 
-    void load32(void* address, RegisterID dest)
+    void load32(const void* address, RegisterID dest)
     {
-        move(ImmPtr(address), addressTempRegister);
+        move(TrustedImmPtr(address), addressTempRegister);
         m_assembler.ldr(dest, addressTempRegister, ARMThumbImmediate::makeUInt16(0));
     }
 
@@ -473,7 +473,7 @@ public:
 
     DataLabel32 load32WithAddressOffsetPatch(Address address, RegisterID dest)
     {
-        DataLabel32 label = moveWithPatch(Imm32(address.offset), dataTempRegister);
+        DataLabel32 label = moveWithPatch(TrustedImm32(address.offset), dataTempRegister);
         load32(ArmAddress(address.base, dataTempRegister), dest);
         return label;
     }
@@ -489,14 +489,14 @@ public:
         if (armImm.isValid())
             m_assembler.ldrh(dest, address.base, armImm);
         else {
-            move(Imm32(address.offset), dataTempRegister);
+            move(TrustedImm32(address.offset), dataTempRegister);
             m_assembler.ldrh(dest, address.base, dataTempRegister);
         }
     }
 
     DataLabel32 store32WithAddressOffsetPatch(RegisterID src, Address address)
     {
-        DataLabel32 label = moveWithPatch(Imm32(address.offset), dataTempRegister);
+        DataLabel32 label = moveWithPatch(TrustedImm32(address.offset), dataTempRegister);
         store32(src, ArmAddress(address.base, dataTempRegister));
         return label;
     }
@@ -511,19 +511,19 @@ public:
         store32(src, setupArmAddress(address));
     }
 
-    void store32(Imm32 imm, ImplicitAddress address)
+    void store32(TrustedImm32 imm, ImplicitAddress address)
     {
         move(imm, dataTempRegister);
         store32(dataTempRegister, setupArmAddress(address));
     }
 
-    void store32(RegisterID src, void* address)
+    void store32(RegisterID src, const void* address)
     {
-        move(ImmPtr(address), addressTempRegister);
+        move(TrustedImmPtr(address), addressTempRegister);
         m_assembler.str(src, addressTempRegister, ARMThumbImmediate::makeUInt16(0));
     }
 
-    void store32(Imm32 imm, void* address)
+    void store32(TrustedImm32 imm, const void* address)
     {
         move(imm, dataTempRegister);
         store32(dataTempRegister, address);
@@ -558,7 +558,7 @@ public:
 
         // Arm vfp addresses can be offset by a 9-bit ones-comp immediate, left shifted by 2.
         if ((offset & 3) || (offset > (255 * 4)) || (offset < -(255 * 4))) {
-            add32(Imm32(offset), base, addressTempRegister);
+            add32(TrustedImm32(offset), base, addressTempRegister);
             base = addressTempRegister;
             offset = 0;
         }
@@ -568,7 +568,7 @@ public:
 
     void loadDouble(const void* address, FPRegisterID dest)
     {
-        move(ImmPtr(address), addressTempRegister);
+        move(TrustedImmPtr(address), addressTempRegister);
         m_assembler.vldr(dest, addressTempRegister, 0);
     }
 
@@ -579,7 +579,7 @@ public:
 
         // Arm vfp addresses can be offset by a 9-bit ones-comp immediate, left shifted by 2.
         if ((offset & 3) || (offset > (255 * 4)) || (offset < -(255 * 4))) {
-            add32(Imm32(offset), base, addressTempRegister);
+            add32(TrustedImm32(offset), base, addressTempRegister);
             base = addressTempRegister;
             offset = 0;
         }
@@ -748,7 +748,7 @@ public:
         push(dataTempRegister);
     }
 
-    void push(Imm32 imm)
+    void push(TrustedImm32 imm)
     {
         move(imm, dataTempRegister);
         push(dataTempRegister);
@@ -758,7 +758,7 @@ public:
     //
     // Move values in registers.
 
-    void move(Imm32 imm, RegisterID dest)
+    void move(TrustedImm32 imm, RegisterID dest)
     {
         uint32_t value = imm.m_value;
 
@@ -784,9 +784,9 @@ public:
         m_assembler.mov(dest, src);
     }
 
-    void move(ImmPtr imm, RegisterID dest)
+    void move(TrustedImmPtr imm, RegisterID dest)
     {
-        move(Imm32(imm), dest);
+        move(TrustedImm32(imm), dest);
     }
 
     void swap(RegisterID reg1, RegisterID reg2)
@@ -821,7 +821,7 @@ public:
     // used (representing the names 'below' and 'above').
     //
     // Operands to the comparision are provided in the expected order, e.g.
-    // jle32(reg1, Imm32(5)) will branch if the value held in reg1, when
+    // jle32(reg1, TrustedImm32(5)) will branch if the value held in reg1, when
     // treated as a signed 32bit value, is less than or equal to 5.
     //
     // jz and jnz test whether the first operand is equal to zero, and take
@@ -829,7 +829,7 @@ public:
 private:
 
     // Should we be using TEQ for equal/not-equal?
-    void compare32(RegisterID left, Imm32 right)
+    void compare32(RegisterID left, TrustedImm32 right)
     {
         int32_t imm = right.m_value;
         if (!imm)
@@ -841,13 +841,13 @@ private:
             else if ((armImm = ARMThumbImmediate::makeEncodedImm(-imm)).isValid())
                 m_assembler.cmn(left, armImm);
             else {
-                move(Imm32(imm), dataTempRegister);
+                move(TrustedImm32(imm), dataTempRegister);
                 m_assembler.cmp(left, dataTempRegister);
             }
         }
     }
 
-    void test32(RegisterID reg, Imm32 mask)
+    void test32(RegisterID reg, TrustedImm32 mask)
     {
         int32_t imm = mask.m_value;
 
@@ -871,7 +871,7 @@ public:
         return Jump(makeBranch(cond));
     }
 
-    Jump branch32(Condition cond, RegisterID left, Imm32 right)
+    Jump branch32(Condition cond, RegisterID left, TrustedImm32 right)
     {
         compare32(left, right);
         return Jump(makeBranch(cond));
@@ -889,21 +889,21 @@ public:
         return branch32(cond, dataTempRegister, right);
     }
 
-    Jump branch32(Condition cond, Address left, Imm32 right)
+    Jump branch32(Condition cond, Address left, TrustedImm32 right)
     {
         // use addressTempRegister incase the branch32 we call uses dataTempRegister. :-/
         load32(left, addressTempRegister);
         return branch32(cond, addressTempRegister, right);
     }
 
-    Jump branch32(Condition cond, BaseIndex left, Imm32 right)
+    Jump branch32(Condition cond, BaseIndex left, TrustedImm32 right)
     {
         // use addressTempRegister incase the branch32 we call uses dataTempRegister. :-/
         load32(left, addressTempRegister);
         return branch32(cond, addressTempRegister, right);
     }
 
-    Jump branch32WithUnalignedHalfWords(Condition cond, BaseIndex left, Imm32 right)
+    Jump branch32WithUnalignedHalfWords(Condition cond, BaseIndex left, TrustedImm32 right)
     {
         // use addressTempRegister incase the branch32 we call uses dataTempRegister. :-/
         load32WithUnalignedHalfWords(left, addressTempRegister);
@@ -916,7 +916,7 @@ public:
         return branch32(cond, dataTempRegister, right);
     }
 
-    Jump branch32(Condition cond, AbsoluteAddress left, Imm32 right)
+    Jump branch32(Condition cond, AbsoluteAddress left, TrustedImm32 right)
     {
         // use addressTempRegister incase the branch32 we call uses dataTempRegister. :-/
         load32(left.m_ptr, addressTempRegister);
@@ -931,21 +931,21 @@ public:
         return branch32(cond, dataTempRegister, addressTempRegister);
     }
 
-    Jump branch16(Condition cond, BaseIndex left, Imm32 right)
+    Jump branch16(Condition cond, BaseIndex left, TrustedImm32 right)
     {
         // use addressTempRegister incase the branch32 we call uses dataTempRegister. :-/
         load16(left, addressTempRegister);
         m_assembler.lsl(addressTempRegister, addressTempRegister, 16);
-        return branch32(cond, addressTempRegister, Imm32(right.m_value << 16));
+        return branch32(cond, addressTempRegister, TrustedImm32(right.m_value << 16));
     }
 
-    Jump branch8(Condition cond, RegisterID left, Imm32 right)
+    Jump branch8(Condition cond, RegisterID left, TrustedImm32 right)
     {
         compare32(left, right);
         return Jump(makeBranch(cond));
     }
 
-    Jump branch8(Condition cond, Address left, Imm32 right)
+    Jump branch8(Condition cond, Address left, TrustedImm32 right)
     {
         // use addressTempRegister incase the branch8 we call uses dataTempRegister. :-/
         load8(left, addressTempRegister);
@@ -959,14 +959,14 @@ public:
         return Jump(makeBranch(cond));
     }
 
-    Jump branchTest32(Condition cond, RegisterID reg, Imm32 mask = Imm32(-1))
+    Jump branchTest32(Condition cond, RegisterID reg, TrustedImm32 mask = TrustedImm32(-1))
     {
         ASSERT((cond == Zero) || (cond == NonZero));
         test32(reg, mask);
         return Jump(makeBranch(cond));
     }
 
-    Jump branchTest32(Condition cond, Address address, Imm32 mask = Imm32(-1))
+    Jump branchTest32(Condition cond, Address address, TrustedImm32 mask = TrustedImm32(-1))
     {
         ASSERT((cond == Zero) || (cond == NonZero));
         // use addressTempRegister incase the branchTest32 we call uses dataTempRegister. :-/
@@ -974,7 +974,7 @@ public:
         return branchTest32(cond, addressTempRegister, mask);
     }
 
-    Jump branchTest32(Condition cond, BaseIndex address, Imm32 mask = Imm32(-1))
+    Jump branchTest32(Condition cond, BaseIndex address, TrustedImm32 mask = TrustedImm32(-1))
     {
         ASSERT((cond == Zero) || (cond == NonZero));
         // use addressTempRegister incase the branchTest32 we call uses dataTempRegister. :-/
@@ -982,14 +982,14 @@ public:
         return branchTest32(cond, addressTempRegister, mask);
     }
 
-    Jump branchTest8(Condition cond, RegisterID reg, Imm32 mask = Imm32(-1))
+    Jump branchTest8(Condition cond, RegisterID reg, TrustedImm32 mask = TrustedImm32(-1))
     {
         ASSERT((cond == Zero) || (cond == NonZero));
         test32(reg, mask);
         return Jump(makeBranch(cond));
     }
 
-    Jump branchTest8(Condition cond, Address address, Imm32 mask = Imm32(-1))
+    Jump branchTest8(Condition cond, Address address, TrustedImm32 mask = TrustedImm32(-1))
     {
         ASSERT((cond == Zero) || (cond == NonZero));
         // use addressTempRegister incase the branchTest8 we call uses dataTempRegister. :-/
@@ -1032,7 +1032,7 @@ public:
         return Jump(makeBranch(cond));
     }
 
-    Jump branchAdd32(Condition cond, Imm32 imm, RegisterID dest)
+    Jump branchAdd32(Condition cond, TrustedImm32 imm, RegisterID dest)
     {
         ASSERT((cond == Overflow) || (cond == Signed) || (cond == Zero) || (cond == NonZero));
         ARMThumbImmediate armImm = ARMThumbImmediate::makeEncodedImm(imm.m_value);
@@ -1053,7 +1053,7 @@ public:
         return branch32(NotEqual, addressTempRegister, dataTempRegister);
     }
 
-    Jump branchMul32(Condition cond, Imm32 imm, RegisterID src, RegisterID dest)
+    Jump branchMul32(Condition cond, TrustedImm32 imm, RegisterID src, RegisterID dest)
     {
         ASSERT_UNUSED(cond, cond == Overflow);
         move(imm, dataTempRegister);
@@ -1076,7 +1076,7 @@ public:
         return Jump(makeBranch(cond));
     }
 
-    Jump branchSub32(Condition cond, Imm32 imm, RegisterID dest)
+    Jump branchSub32(Condition cond, TrustedImm32 imm, RegisterID dest)
     {
         ASSERT((cond == Overflow) || (cond == Signed) || (cond == Zero) || (cond == NonZero));
         ARMThumbImmediate armImm = ARMThumbImmediate::makeEncodedImm(imm.m_value);
@@ -1111,13 +1111,13 @@ public:
 
     Call nearCall()
     {
-        moveFixedWidthEncoding(Imm32(0), dataTempRegister);
+        moveFixedWidthEncoding(TrustedImm32(0), dataTempRegister);
         return Call(m_assembler.blx(dataTempRegister, ARMv7Assembler::JumpFixed), Call::LinkableNear);
     }
 
     Call call()
     {
-        moveFixedWidthEncoding(Imm32(0), dataTempRegister);
+        moveFixedWidthEncoding(TrustedImm32(0), dataTempRegister);
         return Call(m_assembler.blx(dataTempRegister, ARMv7Assembler::JumpFixed), Call::Linkable);
     }
 
@@ -1151,7 +1151,7 @@ public:
         set32Compare32(cond, dataTempRegister, right, dest);
     }
 
-    void set32Compare32(Condition cond, RegisterID left, Imm32 right, RegisterID dest)
+    void set32Compare32(Condition cond, RegisterID left, TrustedImm32 right, RegisterID dest)
     {
         compare32(left, right);
         m_assembler.it(armV7Condition(cond), false);
@@ -1169,7 +1169,7 @@ public:
         set32Compare32(cond, left, right, dest);
     }
 
-    void set8Compare32(Condition cond, RegisterID left, Imm32 right, RegisterID dest)
+    void set8Compare32(Condition cond, RegisterID left, TrustedImm32 right, RegisterID dest)
     {
         set32Compare32(cond, left, right, dest);
     }
@@ -1178,7 +1178,7 @@ public:
     // The mask should be optional... paerhaps the argument order should be
     // dest-src, operations always have a dest? ... possibly not true, considering
     // asm ops like test, or pseudo ops like pop().
-    void set32Test32(Condition cond, Address address, Imm32 mask, RegisterID dest)
+    void set32Test32(Condition cond, Address address, TrustedImm32 mask, RegisterID dest)
     {
         load32(address, dataTempRegister);
         test32(dataTempRegister, mask);
@@ -1187,7 +1187,7 @@ public:
         m_assembler.mov(dest, ARMThumbImmediate::makeUInt16(0));
     }
 
-    void set32Test8(Condition cond, Address address, Imm32 mask, RegisterID dest)
+    void set32Test8(Condition cond, Address address, TrustedImm32 mask, RegisterID dest)
     {
         load8(address, dataTempRegister);
         test32(dataTempRegister, mask);
@@ -1196,44 +1196,44 @@ public:
         m_assembler.mov(dest, ARMThumbImmediate::makeUInt16(0));
     }
 
-    DataLabel32 moveWithPatch(Imm32 imm, RegisterID dst)
+    DataLabel32 moveWithPatch(TrustedImm32 imm, RegisterID dst)
     {
         moveFixedWidthEncoding(imm, dst);
         return DataLabel32(this);
     }
 
-    DataLabelPtr moveWithPatch(ImmPtr imm, RegisterID dst)
+    DataLabelPtr moveWithPatch(TrustedImmPtr imm, RegisterID dst)
     {
-        moveFixedWidthEncoding(Imm32(imm), dst);
+        moveFixedWidthEncoding(TrustedImm32(imm), dst);
         return DataLabelPtr(this);
     }
 
-    Jump branchPtrWithPatch(Condition cond, RegisterID left, DataLabelPtr& dataLabel, ImmPtr initialRightValue = ImmPtr(0))
+    Jump branchPtrWithPatch(Condition cond, RegisterID left, DataLabelPtr& dataLabel, TrustedImmPtr initialRightValue = TrustedImmPtr(0))
     {
         dataLabel = moveWithPatch(initialRightValue, dataTempRegister);
         return branch32(cond, left, dataTempRegister);
     }
 
-    Jump branchPtrWithPatch(Condition cond, Address left, DataLabelPtr& dataLabel, ImmPtr initialRightValue = ImmPtr(0))
+    Jump branchPtrWithPatch(Condition cond, Address left, DataLabelPtr& dataLabel, TrustedImmPtr initialRightValue = TrustedImmPtr(0))
     {
         load32(left, addressTempRegister);
         dataLabel = moveWithPatch(initialRightValue, dataTempRegister);
         return branch32(cond, addressTempRegister, dataTempRegister);
     }
 
-    DataLabelPtr storePtrWithPatch(ImmPtr initialValue, ImplicitAddress address)
+    DataLabelPtr storePtrWithPatch(TrustedImmPtr initialValue, ImplicitAddress address)
     {
         DataLabelPtr label = moveWithPatch(initialValue, dataTempRegister);
         store32(dataTempRegister, address);
         return label;
     }
-    DataLabelPtr storePtrWithPatch(ImplicitAddress address) { return storePtrWithPatch(ImmPtr(0), address); }
+    DataLabelPtr storePtrWithPatch(ImplicitAddress address) { return storePtrWithPatch(TrustedImmPtr(0), address); }
 
 
     Call tailRecursiveCall()
     {
         // Like a normal call, but don't link.
-        moveFixedWidthEncoding(Imm32(0), dataTempRegister);
+        moveFixedWidthEncoding(TrustedImm32(0), dataTempRegister);
         return Call(m_assembler.bx(dataTempRegister, ARMv7Assembler::JumpFixed), Call::Linkable);
     }
 
@@ -1257,14 +1257,14 @@ protected:
 
     ARMv7Assembler::JmpSrc makeJump()
     {
-        moveFixedWidthEncoding(Imm32(0), dataTempRegister);
+        moveFixedWidthEncoding(TrustedImm32(0), dataTempRegister);
         return m_assembler.bx(dataTempRegister, inUninterruptedSequence() ? ARMv7Assembler::JumpNoConditionFixedSize : ARMv7Assembler::JumpNoCondition);
     }
 
     ARMv7Assembler::JmpSrc makeBranch(ARMv7Assembler::Condition cond)
     {
         m_assembler.it(cond, true, true);
-        moveFixedWidthEncoding(Imm32(0), dataTempRegister);
+        moveFixedWidthEncoding(TrustedImm32(0), dataTempRegister);
         return m_assembler.bx(dataTempRegister, inUninterruptedSequence() ? ARMv7Assembler::JumpConditionFixedSize : ARMv7Assembler::JumpCondition, cond);
     }
     ARMv7Assembler::JmpSrc makeBranch(Condition cond) { return makeBranch(armV7Condition(cond)); }
@@ -1277,7 +1277,7 @@ protected:
             if (imm.isValid())
                 m_assembler.add(addressTempRegister, address.base, imm);
             else {
-                move(Imm32(address.offset), addressTempRegister);
+                move(TrustedImm32(address.offset), addressTempRegister);
                 m_assembler.add(addressTempRegister, addressTempRegister, address.base);
             }
 
@@ -1291,7 +1291,7 @@ protected:
         if ((address.offset >= -0xff) && (address.offset <= 0xfff))
             return ArmAddress(address.base, address.offset);
 
-        move(Imm32(address.offset), addressTempRegister);
+        move(TrustedImm32(address.offset), addressTempRegister);
         return ArmAddress(address.base, addressTempRegister);
     }
 
@@ -1300,7 +1300,7 @@ protected:
         if ((address.offset >= -0xff) && (address.offset <= 0xfff))
             return ArmAddress(address.base, address.offset);
 
-        move(Imm32(address.offset), addressTempRegister);
+        move(TrustedImm32(address.offset), addressTempRegister);
         return ArmAddress(address.base, addressTempRegister);
     }
 
@@ -1313,14 +1313,14 @@ protected:
         if (imm.isValid())
             m_assembler.add(addressTempRegister, address.base, imm);
         else {
-            move(Imm32(address.offset), addressTempRegister);
+            move(TrustedImm32(address.offset), addressTempRegister);
             m_assembler.add(addressTempRegister, addressTempRegister, address.base);
         }
 
         return addressTempRegister;
     }
 
-    void moveFixedWidthEncoding(Imm32 imm, RegisterID dst)
+    void moveFixedWidthEncoding(TrustedImm32 imm, RegisterID dst)
     {
         uint32_t value = imm.m_value;
         m_assembler.movT3(dst, ARMThumbImmediate::makeUInt16(value & 0xffff));
diff --git a/Source/JavaScriptCore/assembler/MacroAssemblerCodeRef.h b/Source/JavaScriptCore/assembler/MacroAssemblerCodeRef.h
index 543b0fa..2183b22 100644
--- a/Source/JavaScriptCore/assembler/MacroAssemblerCodeRef.h
+++ b/Source/JavaScriptCore/assembler/MacroAssemblerCodeRef.h
@@ -65,15 +65,47 @@ public:
     {
     }
 
+    template<typename returnType>
+    FunctionPtr(returnType(*value)())
+        : m_value((void*)value)
+    {
+        ASSERT_VALID_CODE_POINTER(m_value);
+    }
+
+    template<typename returnType, typename argType1>
+    FunctionPtr(returnType(*value)(argType1))
+        : m_value((void*)value)
+    {
+        ASSERT_VALID_CODE_POINTER(m_value);
+    }
+
+    template<typename returnType, typename argType1, typename argType2>
+    FunctionPtr(returnType(*value)(argType1, argType2))
+        : m_value((void*)value)
+    {
+        ASSERT_VALID_CODE_POINTER(m_value);
+    }
+
+    template<typename returnType, typename argType1, typename argType2, typename argType3>
+    FunctionPtr(returnType(*value)(argType1, argType2, argType3))
+        : m_value((void*)value)
+    {
+        ASSERT_VALID_CODE_POINTER(m_value);
+    }
+
+    template<typename returnType, typename argType1, typename argType2, typename argType3, typename argType4>
+    FunctionPtr(returnType(*value)(argType1, argType2, argType3, argType4))
+        : m_value((void*)value)
+    {
+        ASSERT_VALID_CODE_POINTER(m_value);
+    }
+
     template<typename FunctionType>
     explicit FunctionPtr(FunctionType* value)
-#if COMPILER(RVCT)
-     // RVTC compiler needs C-style cast as it fails with the following error
-     // Error:  #694: reinterpret_cast cannot cast away const or other type qualifiers
-        : m_value((void*)(value))
-#else
-        : m_value(reinterpret_cast<void*>(value))
-#endif
+        // Using a C-ctyle cast here to avoid compiler error on RVTC:
+        // Error:  #694: reinterpret_cast cannot cast away const or other type qualifiers
+        // (I guess on RVTC function pointers have a different constness to GCC/MSVC?)
+        : m_value((void*)value)
     {
         ASSERT_VALID_CODE_POINTER(m_value);
     }
diff --git a/Source/JavaScriptCore/assembler/MacroAssemblerMIPS.h b/Source/JavaScriptCore/assembler/MacroAssemblerMIPS.h
index 4697dfc..1bcec38 100644
--- a/Source/JavaScriptCore/assembler/MacroAssemblerMIPS.h
+++ b/Source/JavaScriptCore/assembler/MacroAssemblerMIPS.h
@@ -95,7 +95,7 @@ public:
     // Integer arithmetic operations:
     //
     // Operations are typically two operand - operation(source, srcDst)
-    // For many operations the source may be an Imm32, the srcDst operand
+    // For many operations the source may be an TrustedImm32, the srcDst operand
     // may often be a memory location (explictly described using an Address
     // object).
 
@@ -104,12 +104,12 @@ public:
         m_assembler.addu(dest, dest, src);
     }
 
-    void add32(Imm32 imm, RegisterID dest)
+    void add32(TrustedImm32 imm, RegisterID dest)
     {
         add32(imm, dest, dest);
     }
 
-    void add32(Imm32 imm, RegisterID src, RegisterID dest)
+    void add32(TrustedImm32 imm, RegisterID src, RegisterID dest)
     {
         if (!imm.m_isPointer && imm.m_value >= -32768 && imm.m_value <= 32767
             && !m_fixedWidth) {
@@ -127,7 +127,7 @@ public:
         }
     }
 
-    void add32(Imm32 imm, Address address)
+    void add32(TrustedImm32 imm, Address address)
     {
         if (address.offset >= -32768 && address.offset <= 32767
             && !m_fixedWidth) {
@@ -207,7 +207,7 @@ public:
         }
     }
 
-    void add32(Imm32 imm, AbsoluteAddress address)
+    void add32(TrustedImm32 imm, AbsoluteAddress address)
     {
         /*
            li   addrTemp, address
@@ -216,7 +216,7 @@ public:
            addu dataTemp, dataTemp, immTemp
            sw   dataTemp, 0(addrTemp)
         */
-        move(ImmPtr(address.m_ptr), addrTempRegister);
+        move(TrustedImmPtr(address.m_ptr), addrTempRegister);
         m_assembler.lw(dataTempRegister, addrTempRegister, 0);
         if (!imm.m_isPointer && imm.m_value >= -32768 && imm.m_value <= 32767
             && !m_fixedWidth)
@@ -233,7 +233,7 @@ public:
         m_assembler.andInsn(dest, dest, src);
     }
 
-    void and32(Imm32 imm, RegisterID dest)
+    void and32(TrustedImm32 imm, RegisterID dest)
     {
         if (!imm.m_isPointer && !imm.m_value && !m_fixedWidth)
             move(MIPSRegisters::zero, dest);
@@ -250,7 +250,7 @@ public:
         }
     }
 
-    void lshift32(Imm32 imm, RegisterID dest)
+    void lshift32(TrustedImm32 imm, RegisterID dest)
     {
         m_assembler.sll(dest, dest, imm.m_value);
     }
@@ -265,7 +265,7 @@ public:
         m_assembler.mul(dest, dest, src);
     }
 
-    void mul32(Imm32 imm, RegisterID src, RegisterID dest)
+    void mul32(TrustedImm32 imm, RegisterID src, RegisterID dest)
     {
         if (!imm.m_isPointer && !imm.m_value && !m_fixedWidth)
             move(MIPSRegisters::zero, dest);
@@ -296,7 +296,7 @@ public:
         m_assembler.orInsn(dest, dest, src);
     }
 
-    void or32(Imm32 imm, RegisterID dest)
+    void or32(TrustedImm32 imm, RegisterID dest)
     {
         if (!imm.m_isPointer && !imm.m_value && !m_fixedWidth)
             return;
@@ -320,7 +320,7 @@ public:
         m_assembler.srav(dest, dest, shiftAmount);
     }
 
-    void rshift32(Imm32 imm, RegisterID dest)
+    void rshift32(TrustedImm32 imm, RegisterID dest)
     {
         m_assembler.sra(dest, dest, imm.m_value);
     }
@@ -330,7 +330,7 @@ public:
         m_assembler.srlv(dest, dest, shiftAmount);
     }
 
-    void urshift32(Imm32 imm, RegisterID dest)
+    void urshift32(TrustedImm32 imm, RegisterID dest)
     {
         m_assembler.srl(dest, dest, imm.m_value);
     }
@@ -340,7 +340,7 @@ public:
         m_assembler.subu(dest, dest, src);
     }
 
-    void sub32(Imm32 imm, RegisterID dest)
+    void sub32(TrustedImm32 imm, RegisterID dest)
     {
         if (!imm.m_isPointer && imm.m_value >= -32767 && imm.m_value <= 32768
             && !m_fixedWidth) {
@@ -358,7 +358,7 @@ public:
         }
     }
 
-    void sub32(Imm32 imm, Address address)
+    void sub32(TrustedImm32 imm, Address address)
     {
         if (address.offset >= -32768 && address.offset <= 32767
             && !m_fixedWidth) {
@@ -413,7 +413,7 @@ public:
         sub32(dataTempRegister, dest);
     }
 
-    void sub32(Imm32 imm, AbsoluteAddress address)
+    void sub32(TrustedImm32 imm, AbsoluteAddress address)
     {
         /*
            li   addrTemp, address
@@ -422,7 +422,7 @@ public:
            subu dataTemp, dataTemp, immTemp
            sw   dataTemp, 0(addrTemp)
         */
-        move(ImmPtr(address.m_ptr), addrTempRegister);
+        move(TrustedImmPtr(address.m_ptr), addrTempRegister);
         m_assembler.lw(dataTempRegister, addrTempRegister, 0);
 
         if (!imm.m_isPointer && imm.m_value >= -32767 && imm.m_value <= 32768
@@ -441,7 +441,7 @@ public:
         m_assembler.xorInsn(dest, dest, src);
     }
 
-    void xor32(Imm32 imm, RegisterID dest)
+    void xor32(TrustedImm32 imm, RegisterID dest)
     {
         /*
             li  immTemp, imm
@@ -459,7 +459,7 @@ public:
     // Memory access operations:
     //
     // Loads are of the form load(address, destination) and stores of the form
-    // store(source, address).  The source for a store may be an Imm32.  Address
+    // store(source, address).  The source for a store may be an TrustedImm32.  Address
     // operand objects to loads and store will be implicitly constructed if a
     // register is passed.
 
@@ -581,13 +581,13 @@ public:
         }
     }
 
-    void load32(void* address, RegisterID dest)
+    void load32(const void* address, RegisterID dest)
     {
         /*
             li  addrTemp, address
             lw  dest, 0(addrTemp)
         */
-        move(ImmPtr(address), addrTempRegister);
+        move(TrustedImmPtr(address), addrTempRegister);
         m_assembler.lw(dest, addrTempRegister, 0);
     }
 
@@ -601,7 +601,7 @@ public:
             lw  dest, 0(addrTemp)
         */
         DataLabel32 dataLabel(this);
-        move(Imm32(address.offset), addrTempRegister);
+        move(TrustedImm32(address.offset), addrTempRegister);
         m_assembler.addu(addrTempRegister, addrTempRegister, address.base);
         m_assembler.lw(dest, addrTempRegister, 0);
         m_fixedWidth = false;
@@ -666,7 +666,7 @@ public:
             sw  src, 0(addrTemp)
         */
         DataLabel32 dataLabel(this);
-        move(Imm32(address.offset), addrTempRegister);
+        move(TrustedImm32(address.offset), addrTempRegister);
         m_assembler.addu(addrTempRegister, addrTempRegister, address.base);
         m_assembler.sw(src, addrTempRegister, 0);
         m_fixedWidth = false;
@@ -719,7 +719,7 @@ public:
         }
     }
 
-    void store32(Imm32 imm, ImplicitAddress address)
+    void store32(TrustedImm32 imm, ImplicitAddress address)
     {
         if (address.offset >= -32768 && address.offset <= 32767
             && !m_fixedWidth) {
@@ -749,17 +749,17 @@ public:
         }
     }
 
-    void store32(RegisterID src, void* address)
+    void store32(RegisterID src, const void* address)
     {
         /*
             li  addrTemp, address
             sw  src, 0(addrTemp)
         */
-        move(ImmPtr(address), addrTempRegister);
+        move(TrustedImmPtr(address), addrTempRegister);
         m_assembler.sw(src, addrTempRegister, 0);
     }
 
-    void store32(Imm32 imm, void* address)
+    void store32(TrustedImm32 imm, const void* address)
     {
         /*
             li  immTemp, imm
@@ -767,11 +767,11 @@ public:
             sw  src, 0(addrTemp)
         */
         if (!imm.m_isPointer && !imm.m_value && !m_fixedWidth) {
-            move(ImmPtr(address), addrTempRegister);
+            move(TrustedImmPtr(address), addrTempRegister);
             m_assembler.sw(MIPSRegisters::zero, addrTempRegister, 0);
         } else {
             move(imm, immTempRegister);
-            move(ImmPtr(address), addrTempRegister);
+            move(TrustedImmPtr(address), addrTempRegister);
             m_assembler.sw(immTempRegister, addrTempRegister, 0);
         }
     }
@@ -831,7 +831,7 @@ public:
         push(dataTempRegister);
     }
 
-    void push(Imm32 imm)
+    void push(TrustedImm32 imm)
     {
         move(imm, immTempRegister);
         push(immTempRegister);
@@ -841,7 +841,7 @@ public:
     //
     // Move values in registers.
 
-    void move(Imm32 imm, RegisterID dest)
+    void move(TrustedImm32 imm, RegisterID dest)
     {
         if (!imm.m_isPointer && !imm.m_value && !m_fixedWidth)
             move(MIPSRegisters::zero, dest);
@@ -858,9 +858,9 @@ public:
             m_assembler.move(dest, src);
     }
 
-    void move(ImmPtr imm, RegisterID dest)
+    void move(TrustedImmPtr imm, RegisterID dest)
     {
-        move(Imm32(imm), dest);
+        move(TrustedImm32(imm), dest);
     }
 
     void swap(RegisterID reg1, RegisterID reg2)
@@ -894,13 +894,13 @@ public:
     // used (representing the names 'below' and 'above').
     //
     // Operands to the comparision are provided in the expected order, e.g.
-    // jle32(reg1, Imm32(5)) will branch if the value held in reg1, when
+    // jle32(reg1, TrustedImm32(5)) will branch if the value held in reg1, when
     // treated as a signed 32bit value, is less than or equal to 5.
     //
     // jz and jnz test whether the first operand is equal to zero, and take
     // an optional second operand of a mask under which to perform the test.
 
-    Jump branch8(Condition cond, Address left, Imm32 right)
+    Jump branch8(Condition cond, Address left, TrustedImm32 right)
     {
         // Make sure the immediate value is unsigned 8 bits.
         ASSERT(!(right.m_value & 0xFFFFFF00));
@@ -985,7 +985,7 @@ public:
         return Jump();
     }
 
-    Jump branch32(Condition cond, RegisterID left, Imm32 right)
+    Jump branch32(Condition cond, RegisterID left, TrustedImm32 right)
     {
         move(right, immTempRegister);
         return branch32(cond, left, immTempRegister);
@@ -1003,14 +1003,14 @@ public:
         return branch32(cond, dataTempRegister, right);
     }
 
-    Jump branch32(Condition cond, Address left, Imm32 right)
+    Jump branch32(Condition cond, Address left, TrustedImm32 right)
     {
         load32(left, dataTempRegister);
         move(right, immTempRegister);
         return branch32(cond, dataTempRegister, immTempRegister);
     }
 
-    Jump branch32(Condition cond, BaseIndex left, Imm32 right)
+    Jump branch32(Condition cond, BaseIndex left, TrustedImm32 right)
     {
         load32(left, dataTempRegister);
         // Be careful that the previous load32() uses immTempRegister.
@@ -1019,7 +1019,7 @@ public:
         return branch32(cond, dataTempRegister, immTempRegister);
     }
 
-    Jump branch32WithUnalignedHalfWords(Condition cond, BaseIndex left, Imm32 right)
+    Jump branch32WithUnalignedHalfWords(Condition cond, BaseIndex left, TrustedImm32 right)
     {
         load32WithUnalignedHalfWords(left, dataTempRegister);
         // Be careful that the previous load32WithUnalignedHalfWords()
@@ -1035,7 +1035,7 @@ public:
         return branch32(cond, dataTempRegister, right);
     }
 
-    Jump branch32(Condition cond, AbsoluteAddress left, Imm32 right)
+    Jump branch32(Condition cond, AbsoluteAddress left, TrustedImm32 right)
     {
         load32(left.m_ptr, dataTempRegister);
         move(right, immTempRegister);
@@ -1048,7 +1048,7 @@ public:
         return branch32(cond, dataTempRegister, right);
     }
 
-    Jump branch16(Condition cond, BaseIndex left, Imm32 right)
+    Jump branch16(Condition cond, BaseIndex left, TrustedImm32 right)
     {
         ASSERT(!(right.m_value & 0xFFFF0000));
         load16(left, dataTempRegister);
@@ -1067,7 +1067,7 @@ public:
         return branchNotEqual(cmpTempRegister, MIPSRegisters::zero);
     }
 
-    Jump branchTest32(Condition cond, RegisterID reg, Imm32 mask = Imm32(-1))
+    Jump branchTest32(Condition cond, RegisterID reg, TrustedImm32 mask = TrustedImm32(-1))
     {
         ASSERT((cond == Zero) || (cond == NonZero));
         if (mask.m_value == -1 && !m_fixedWidth) {
@@ -1079,19 +1079,19 @@ public:
         return branchTest32(cond, reg, immTempRegister);
     }
 
-    Jump branchTest32(Condition cond, Address address, Imm32 mask = Imm32(-1))
+    Jump branchTest32(Condition cond, Address address, TrustedImm32 mask = TrustedImm32(-1))
     {
         load32(address, dataTempRegister);
         return branchTest32(cond, dataTempRegister, mask);
     }
 
-    Jump branchTest32(Condition cond, BaseIndex address, Imm32 mask = Imm32(-1))
+    Jump branchTest32(Condition cond, BaseIndex address, TrustedImm32 mask = TrustedImm32(-1))
     {
         load32(address, dataTempRegister);
         return branchTest32(cond, dataTempRegister, mask);
     }
 
-    Jump branchTest8(Condition cond, Address address, Imm32 mask = Imm32(-1))
+    Jump branchTest8(Condition cond, Address address, TrustedImm32 mask = TrustedImm32(-1))
     {
         load8(address, dataTempRegister);
         return branchTest32(cond, dataTempRegister, mask);
@@ -1174,7 +1174,7 @@ public:
         return Jump();
     }
 
-    Jump branchAdd32(Condition cond, Imm32 imm, RegisterID dest)
+    Jump branchAdd32(Condition cond, TrustedImm32 imm, RegisterID dest)
     {
         move(imm, immTempRegister);
         return branchAdd32(cond, immTempRegister, dest);
@@ -1225,7 +1225,7 @@ public:
         return Jump();
     }
 
-    Jump branchMul32(Condition cond, Imm32 imm, RegisterID src, RegisterID dest)
+    Jump branchMul32(Condition cond, TrustedImm32 imm, RegisterID src, RegisterID dest)
     {
         move(imm, immTempRegister);
         move(src, dest);
@@ -1279,7 +1279,7 @@ public:
         return Jump();
     }
 
-    Jump branchSub32(Condition cond, Imm32 imm, RegisterID dest)
+    Jump branchSub32(Condition cond, TrustedImm32 imm, RegisterID dest)
     {
         move(imm, immTempRegister);
         return branchSub32(cond, immTempRegister, dest);
@@ -1360,7 +1360,7 @@ public:
         set32Compare32(cond, left, right, dest);
     }
 
-    void set8Compare32(Condition cond, RegisterID left, Imm32 right, RegisterID dest)
+    void set8Compare32(Condition cond, RegisterID left, TrustedImm32 right, RegisterID dest)
     {
         move(right, immTempRegister);
         set32Compare32(cond, left, immTempRegister, dest);
@@ -1417,13 +1417,13 @@ public:
         }
     }
 
-    void set32Compare32(Condition cond, RegisterID left, Imm32 right, RegisterID dest)
+    void set32Compare32(Condition cond, RegisterID left, TrustedImm32 right, RegisterID dest)
     {
         move(right, immTempRegister);
         set32Compare32(cond, left, immTempRegister, dest);
     }
 
-    void set32Test8(Condition cond, Address address, Imm32 mask, RegisterID dest)
+    void set32Test8(Condition cond, Address address, TrustedImm32 mask, RegisterID dest)
     {
         ASSERT((cond == Zero) || (cond == NonZero));
         load8(address, dataTempRegister);
@@ -1443,7 +1443,7 @@ public:
         }
     }
 
-    void set32Test32(Condition cond, Address address, Imm32 mask, RegisterID dest)
+    void set32Test32(Condition cond, Address address, TrustedImm32 mask, RegisterID dest)
     {
         ASSERT((cond == Zero) || (cond == NonZero));
         load32(address, dataTempRegister);
@@ -1463,7 +1463,7 @@ public:
         }
     }
 
-    DataLabel32 moveWithPatch(Imm32 imm, RegisterID dest)
+    DataLabel32 moveWithPatch(TrustedImm32 imm, RegisterID dest)
     {
         m_fixedWidth = true;
         DataLabel32 label(this);
@@ -1472,7 +1472,7 @@ public:
         return label;
     }
 
-    DataLabelPtr moveWithPatch(ImmPtr initialValue, RegisterID dest)
+    DataLabelPtr moveWithPatch(TrustedImmPtr initialValue, RegisterID dest)
     {
         m_fixedWidth = true;
         DataLabelPtr label(this);
@@ -1481,7 +1481,7 @@ public:
         return label;
     }
 
-    Jump branchPtrWithPatch(Condition cond, RegisterID left, DataLabelPtr& dataLabel, ImmPtr initialRightValue = ImmPtr(0))
+    Jump branchPtrWithPatch(Condition cond, RegisterID left, DataLabelPtr& dataLabel, TrustedImmPtr initialRightValue = TrustedImmPtr(0))
     {
         m_fixedWidth = true;
         dataLabel = moveWithPatch(initialRightValue, immTempRegister);
@@ -1490,7 +1490,7 @@ public:
         return temp;
     }
 
-    Jump branchPtrWithPatch(Condition cond, Address left, DataLabelPtr& dataLabel, ImmPtr initialRightValue = ImmPtr(0))
+    Jump branchPtrWithPatch(Condition cond, Address left, DataLabelPtr& dataLabel, TrustedImmPtr initialRightValue = TrustedImmPtr(0))
     {
         m_fixedWidth = true;
         load32(left, dataTempRegister);
@@ -1500,7 +1500,7 @@ public:
         return temp;
     }
 
-    DataLabelPtr storePtrWithPatch(ImmPtr initialValue, ImplicitAddress address)
+    DataLabelPtr storePtrWithPatch(TrustedImmPtr initialValue, ImplicitAddress address)
     {
         m_fixedWidth = true;
         DataLabelPtr dataLabel = moveWithPatch(initialValue, dataTempRegister);
@@ -1511,14 +1511,14 @@ public:
 
     DataLabelPtr storePtrWithPatch(ImplicitAddress address)
     {
-        return storePtrWithPatch(ImmPtr(0), address);
+        return storePtrWithPatch(TrustedImmPtr(0), address);
     }
 
     Call tailRecursiveCall()
     {
         // Like a normal call, but don't update the returned address register
         m_fixedWidth = true;
-        move(Imm32(0), MIPSRegisters::t9);
+        move(TrustedImm32(0), MIPSRegisters::t9);
         m_assembler.jr(MIPSRegisters::t9);
         m_assembler.nop();
         m_fixedWidth = false;
@@ -1540,7 +1540,7 @@ public:
             lwc1        dest, 0(addrTemp)
             lwc1        dest+1, 4(addrTemp)
          */
-        move(Imm32(address.offset), addrTempRegister);
+        move(TrustedImm32(address.offset), addrTempRegister);
         m_assembler.addu(addrTempRegister, addrTempRegister, address.base);
         m_assembler.lwc1(dest, addrTempRegister, 0);
         m_assembler.lwc1(FPRegisterID(dest + 1), addrTempRegister, 4);
@@ -1569,7 +1569,7 @@ public:
             lwc1        dest, 0(addrTemp)
             lwc1        dest+1, 4(addrTemp)
          */
-        move(ImmPtr(address), addrTempRegister);
+        move(TrustedImmPtr(address), addrTempRegister);
         m_assembler.lwc1(dest, addrTempRegister, 0);
         m_assembler.lwc1(FPRegisterID(dest + 1), addrTempRegister, 4);
 #else
@@ -1577,7 +1577,7 @@ public:
             li          addrTemp, address
             ldc1        dest, 0(addrTemp)
         */
-        move(ImmPtr(address), addrTempRegister);
+        move(TrustedImmPtr(address), addrTempRegister);
         m_assembler.ldc1(dest, addrTempRegister, 0);
 #endif
     }
@@ -1592,7 +1592,7 @@ public:
             swc1        dest, 0(addrTemp)
             swc1        dest+1, 4(addrTemp)
          */
-        move(Imm32(address.offset), addrTempRegister);
+        move(TrustedImm32(address.offset), addrTempRegister);
         m_assembler.addu(addrTempRegister, addrTempRegister, address.base);
         m_assembler.swc1(src, addrTempRegister, 0);
         m_assembler.swc1(FPRegisterID(src + 1), addrTempRegister, 4);
@@ -1779,7 +1779,7 @@ public:
     {
         m_assembler.truncwd(fpTempRegister, src);
         m_assembler.mfc1(dest, fpTempRegister);
-        return branch32(Equal, dest, Imm32(0x7fffffff));
+        return branch32(Equal, dest, TrustedImm32(0x7fffffff));
     }
 
     // Convert 'src' to an integer, and places the resulting 'dest'.
diff --git a/Source/JavaScriptCore/assembler/MacroAssemblerX86.h b/Source/JavaScriptCore/assembler/MacroAssemblerX86.h
index 92da5f0..b180e2b 100644
--- a/Source/JavaScriptCore/assembler/MacroAssemblerX86.h
+++ b/Source/JavaScriptCore/assembler/MacroAssemblerX86.h
@@ -52,32 +52,32 @@ public:
     using MacroAssemblerX86Common::loadDouble;
     using MacroAssemblerX86Common::convertInt32ToDouble;
 
-    void add32(Imm32 imm, RegisterID src, RegisterID dest)
+    void add32(TrustedImm32 imm, RegisterID src, RegisterID dest)
     {
         m_assembler.leal_mr(imm.m_value, src, dest);
     }
 
-    void add32(Imm32 imm, AbsoluteAddress address)
+    void add32(TrustedImm32 imm, AbsoluteAddress address)
     {
         m_assembler.addl_im(imm.m_value, address.m_ptr);
     }
     
-    void addWithCarry32(Imm32 imm, AbsoluteAddress address)
+    void addWithCarry32(TrustedImm32 imm, AbsoluteAddress address)
     {
         m_assembler.adcl_im(imm.m_value, address.m_ptr);
     }
     
-    void and32(Imm32 imm, AbsoluteAddress address)
+    void and32(TrustedImm32 imm, AbsoluteAddress address)
     {
         m_assembler.andl_im(imm.m_value, address.m_ptr);
     }
     
-    void or32(Imm32 imm, AbsoluteAddress address)
+    void or32(TrustedImm32 imm, AbsoluteAddress address)
     {
         m_assembler.orl_im(imm.m_value, address.m_ptr);
     }
 
-    void sub32(Imm32 imm, AbsoluteAddress address)
+    void sub32(TrustedImm32 imm, AbsoluteAddress address)
     {
         m_assembler.subl_im(imm.m_value, address.m_ptr);
     }
@@ -98,7 +98,7 @@ public:
         m_assembler.cvtsi2sd_mr(src.m_ptr, dest);
     }
 
-    void store32(Imm32 imm, void* address)
+    void store32(TrustedImm32 imm, void* address)
     {
         m_assembler.movl_i32m(imm.m_value, address);
     }
@@ -114,7 +114,7 @@ public:
         return Jump(m_assembler.jCC(x86Condition(cond)));
     }
 
-    Jump branch32(Condition cond, AbsoluteAddress left, Imm32 right)
+    Jump branch32(Condition cond, AbsoluteAddress left, TrustedImm32 right)
     {
         m_assembler.cmpl_im(right.m_value, left.m_ptr);
         return Jump(m_assembler.jCC(x86Condition(cond)));
@@ -136,27 +136,27 @@ public:
     }
 
 
-    DataLabelPtr moveWithPatch(ImmPtr initialValue, RegisterID dest)
+    DataLabelPtr moveWithPatch(TrustedImmPtr initialValue, RegisterID dest)
     {
         m_assembler.movl_i32r(initialValue.asIntptr(), dest);
         return DataLabelPtr(this);
     }
 
-    Jump branchPtrWithPatch(Condition cond, RegisterID left, DataLabelPtr& dataLabel, ImmPtr initialRightValue = ImmPtr(0))
+    Jump branchPtrWithPatch(Condition cond, RegisterID left, DataLabelPtr& dataLabel, TrustedImmPtr initialRightValue = TrustedImmPtr(0))
     {
         m_assembler.cmpl_ir_force32(initialRightValue.asIntptr(), left);
         dataLabel = DataLabelPtr(this);
         return Jump(m_assembler.jCC(x86Condition(cond)));
     }
 
-    Jump branchPtrWithPatch(Condition cond, Address left, DataLabelPtr& dataLabel, ImmPtr initialRightValue = ImmPtr(0))
+    Jump branchPtrWithPatch(Condition cond, Address left, DataLabelPtr& dataLabel, TrustedImmPtr initialRightValue = TrustedImmPtr(0))
     {
         m_assembler.cmpl_im_force32(initialRightValue.asIntptr(), left.offset, left.base);
         dataLabel = DataLabelPtr(this);
         return Jump(m_assembler.jCC(x86Condition(cond)));
     }
 
-    DataLabelPtr storePtrWithPatch(ImmPtr initialValue, ImplicitAddress address)
+    DataLabelPtr storePtrWithPatch(TrustedImmPtr initialValue, ImplicitAddress address)
     {
         m_assembler.movl_i32m(initialValue.asIntptr(), address.offset, address.base);
         return DataLabelPtr(this);
diff --git a/Source/JavaScriptCore/assembler/MacroAssemblerX86Common.h b/Source/JavaScriptCore/assembler/MacroAssemblerX86Common.h
index a02074c..f5829dd 100644
--- a/Source/JavaScriptCore/assembler/MacroAssemblerX86Common.h
+++ b/Source/JavaScriptCore/assembler/MacroAssemblerX86Common.h
@@ -83,7 +83,7 @@ public:
     // Integer arithmetic operations:
     //
     // Operations are typically two operand - operation(source, srcDst)
-    // For many operations the source may be an Imm32, the srcDst operand
+    // For many operations the source may be an TrustedImm32, the srcDst operand
     // may often be a memory location (explictly described using an Address
     // object).
 
@@ -92,12 +92,12 @@ public:
         m_assembler.addl_rr(src, dest);
     }
 
-    void add32(Imm32 imm, Address address)
+    void add32(TrustedImm32 imm, Address address)
     {
         m_assembler.addl_im(imm.m_value, address.offset, address.base);
     }
 
-    void add32(Imm32 imm, RegisterID dest)
+    void add32(TrustedImm32 imm, RegisterID dest)
     {
         m_assembler.addl_ir(imm.m_value, dest);
     }
@@ -117,7 +117,7 @@ public:
         m_assembler.andl_rr(src, dest);
     }
 
-    void and32(Imm32 imm, RegisterID dest)
+    void and32(TrustedImm32 imm, RegisterID dest)
     {
         m_assembler.andl_ir(imm.m_value, dest);
     }
@@ -132,36 +132,64 @@ public:
         m_assembler.andl_mr(src.offset, src.base, dest);
     }
 
-    void and32(Imm32 imm, Address address)
+    void and32(TrustedImm32 imm, Address address)
     {
         m_assembler.andl_im(imm.m_value, address.offset, address.base);
     }
 
-    void lshift32(Imm32 imm, RegisterID dest)
+    void and32(RegisterID op1, RegisterID op2, RegisterID dest)
     {
-        m_assembler.shll_i8r(imm.m_value, dest);
+        if (op1 == op2)
+            zeroExtend32ToPtr(op1, dest);
+        else if (op1 == dest)
+            and32(op2, dest);
+        else {
+            move(op2, dest);
+            and32(op1, dest);
+        }
     }
-    
+
+    void and32(TrustedImm32 imm, RegisterID src, RegisterID dest)
+    {
+        move(src, dest);
+        and32(imm, dest);
+    }
+
     void lshift32(RegisterID shift_amount, RegisterID dest)
     {
-        // On x86 we can only shift by ecx; if asked to shift by another register we'll
-        // need rejig the shift amount into ecx first, and restore the registers afterwards.
-        if (shift_amount != X86Registers::ecx) {
-            swap(shift_amount, X86Registers::ecx);
+        ASSERT(shift_amount != dest);
 
-            // E.g. transform "shll %eax, %eax" -> "xchgl %eax, %ecx; shll %ecx, %ecx; xchgl %eax, %ecx"
-            if (dest == shift_amount)
-                m_assembler.shll_CLr(X86Registers::ecx);
-            // E.g. transform "shll %eax, %ecx" -> "xchgl %eax, %ecx; shll %ecx, %eax; xchgl %eax, %ecx"
-            else if (dest == X86Registers::ecx)
-                m_assembler.shll_CLr(shift_amount);
-            // E.g. transform "shll %eax, %ebx" -> "xchgl %eax, %ecx; shll %ecx, %ebx; xchgl %eax, %ecx"
-            else
-                m_assembler.shll_CLr(dest);
-        
-            swap(shift_amount, X86Registers::ecx);
-        } else
+        if (shift_amount == X86Registers::ecx)
             m_assembler.shll_CLr(dest);
+        else {
+            // On x86 we can only shift by ecx; if asked to shift by another register we'll
+            // need rejig the shift amount into ecx first, and restore the registers afterwards.
+            // If we dest is ecx, then shift the swapped register!
+            swap(shift_amount, X86Registers::ecx);
+            m_assembler.shll_CLr(dest == X86Registers::ecx ? shift_amount : dest);
+            swap(shift_amount, X86Registers::ecx);
+        }
+    }
+
+    void lshift32(RegisterID src, RegisterID shift_amount, RegisterID dest)
+    {
+        ASSERT(shift_amount != dest);
+
+        if (src != dest)
+            move(src, dest);
+        lshift32(shift_amount, dest);
+    }
+
+    void lshift32(TrustedImm32 imm, RegisterID dest)
+    {
+        m_assembler.shll_i8r(imm.m_value, dest);
+    }
+    
+    void lshift32(RegisterID src, TrustedImm32 imm, RegisterID dest)
+    {
+        if (src != dest)
+            move(src, dest);
+        lshift32(imm, dest);
     }
     
     void mul32(RegisterID src, RegisterID dest)
@@ -174,7 +202,7 @@ public:
         m_assembler.imull_mr(src.offset, src.base, dest);
     }
     
-    void mul32(Imm32 imm, RegisterID src, RegisterID dest)
+    void mul32(TrustedImm32 imm, RegisterID src, RegisterID dest)
     {
         m_assembler.imull_i32r(src, imm.m_value, dest);
     }
@@ -204,7 +232,7 @@ public:
         m_assembler.orl_rr(src, dest);
     }
 
-    void or32(Imm32 imm, RegisterID dest)
+    void or32(TrustedImm32 imm, RegisterID dest)
     {
         m_assembler.orl_ir(imm.m_value, dest);
     }
@@ -219,76 +247,114 @@ public:
         m_assembler.orl_mr(src.offset, src.base, dest);
     }
 
-    void or32(Imm32 imm, Address address)
+    void or32(TrustedImm32 imm, Address address)
     {
         m_assembler.orl_im(imm.m_value, address.offset, address.base);
     }
 
+    void or32(RegisterID op1, RegisterID op2, RegisterID dest)
+    {
+        if (op1 == op2)
+            zeroExtend32ToPtr(op1, dest);
+        else if (op1 == dest)
+            or32(op2, dest);
+        else {
+            move(op2, dest);
+            or32(op1, dest);
+        }
+    }
+
+    void or32(TrustedImm32 imm, RegisterID src, RegisterID dest)
+    {
+        move(src, dest);
+        or32(imm, dest);
+    }
+
     void rshift32(RegisterID shift_amount, RegisterID dest)
     {
-        // On x86 we can only shift by ecx; if asked to shift by another register we'll
-        // need rejig the shift amount into ecx first, and restore the registers afterwards.
-        if (shift_amount != X86Registers::ecx) {
-            swap(shift_amount, X86Registers::ecx);
+        ASSERT(shift_amount != dest);
 
-            // E.g. transform "shll %eax, %eax" -> "xchgl %eax, %ecx; shll %ecx, %ecx; xchgl %eax, %ecx"
-            if (dest == shift_amount)
-                m_assembler.sarl_CLr(X86Registers::ecx);
-            // E.g. transform "shll %eax, %ecx" -> "xchgl %eax, %ecx; shll %ecx, %eax; xchgl %eax, %ecx"
-            else if (dest == X86Registers::ecx)
-                m_assembler.sarl_CLr(shift_amount);
-            // E.g. transform "shll %eax, %ebx" -> "xchgl %eax, %ecx; shll %ecx, %ebx; xchgl %eax, %ecx"
-            else
-                m_assembler.sarl_CLr(dest);
-        
-            swap(shift_amount, X86Registers::ecx);
-        } else
+        if (shift_amount == X86Registers::ecx)
             m_assembler.sarl_CLr(dest);
+        else {
+            // On x86 we can only shift by ecx; if asked to shift by another register we'll
+            // need rejig the shift amount into ecx first, and restore the registers afterwards.
+            // If we dest is ecx, then shift the swapped register!
+            swap(shift_amount, X86Registers::ecx);
+            m_assembler.sarl_CLr(dest == X86Registers::ecx ? shift_amount : dest);
+            swap(shift_amount, X86Registers::ecx);
+        }
+    }
+
+    void rshift32(RegisterID src, RegisterID shift_amount, RegisterID dest)
+    {
+        ASSERT(shift_amount != dest);
+
+        if (src != dest)
+            move(src, dest);
+        rshift32(shift_amount, dest);
     }
 
-    void rshift32(Imm32 imm, RegisterID dest)
+    void rshift32(TrustedImm32 imm, RegisterID dest)
     {
         m_assembler.sarl_i8r(imm.m_value, dest);
     }
     
+    void rshift32(RegisterID src, TrustedImm32 imm, RegisterID dest)
+    {
+        if (src != dest)
+            move(src, dest);
+        rshift32(imm, dest);
+    }
+    
     void urshift32(RegisterID shift_amount, RegisterID dest)
     {
-        // On x86 we can only shift by ecx; if asked to shift by another register we'll
-        // need rejig the shift amount into ecx first, and restore the registers afterwards.
-        if (shift_amount != X86Registers::ecx) {
+        ASSERT(shift_amount != dest);
+
+        if (shift_amount == X86Registers::ecx)
+            m_assembler.shrl_CLr(dest);
+        else {
+            // On x86 we can only shift by ecx; if asked to shift by another register we'll
+            // need rejig the shift amount into ecx first, and restore the registers afterwards.
+            // If we dest is ecx, then shift the swapped register!
             swap(shift_amount, X86Registers::ecx);
-            
-            // E.g. transform "shrl %eax, %eax" -> "xchgl %eax, %ecx; shrl %ecx, %ecx; xchgl %eax, %ecx"
-            if (dest == shift_amount)
-                m_assembler.shrl_CLr(X86Registers::ecx);
-            // E.g. transform "shrl %eax, %ecx" -> "xchgl %eax, %ecx; shrl %ecx, %eax; xchgl %eax, %ecx"
-            else if (dest == X86Registers::ecx)
-                m_assembler.shrl_CLr(shift_amount);
-            // E.g. transform "shrl %eax, %ebx" -> "xchgl %eax, %ecx; shrl %ecx, %ebx; xchgl %eax, %ecx"
-            else
-                m_assembler.shrl_CLr(dest);
-            
+            m_assembler.shrl_CLr(dest == X86Registers::ecx ? shift_amount : dest);
             swap(shift_amount, X86Registers::ecx);
-        } else
-            m_assembler.shrl_CLr(dest);
+        }
     }
-    
-    void urshift32(Imm32 imm, RegisterID dest)
+
+    void urshift32(RegisterID src, RegisterID shift_amount, RegisterID dest)
     {
-        m_assembler.shrl_i8r(imm.m_value, dest);
+        ASSERT(shift_amount != dest);
+
+        if (src != dest)
+            move(src, dest);
+        urshift32(shift_amount, dest);
     }
 
+    void urshift32(TrustedImm32 imm, RegisterID dest)
+    {
+        m_assembler.shrl_i8r(imm.m_value, dest);
+    }
+    
+    void urshift32(RegisterID src, TrustedImm32 imm, RegisterID dest)
+    {
+        if (src != dest)
+            move(src, dest);
+        urshift32(imm, dest);
+    }
+    
     void sub32(RegisterID src, RegisterID dest)
     {
         m_assembler.subl_rr(src, dest);
     }
     
-    void sub32(Imm32 imm, RegisterID dest)
+    void sub32(TrustedImm32 imm, RegisterID dest)
     {
         m_assembler.subl_ir(imm.m_value, dest);
     }
     
-    void sub32(Imm32 imm, Address address)
+    void sub32(TrustedImm32 imm, Address address)
     {
         m_assembler.subl_im(imm.m_value, address.offset, address.base);
     }
@@ -309,12 +375,12 @@ public:
         m_assembler.xorl_rr(src, dest);
     }
 
-    void xor32(Imm32 imm, Address dest)
+    void xor32(TrustedImm32 imm, Address dest)
     {
         m_assembler.xorl_im(imm.m_value, dest.offset, dest.base);
     }
 
-    void xor32(Imm32 imm, RegisterID dest)
+    void xor32(TrustedImm32 imm, RegisterID dest)
     {
         m_assembler.xorl_ir(imm.m_value, dest);
     }
@@ -329,6 +395,24 @@ public:
         m_assembler.xorl_mr(src.offset, src.base, dest);
     }
     
+    void xor32(RegisterID op1, RegisterID op2, RegisterID dest)
+    {
+        if (op1 == op2)
+            move(TrustedImm32(0), dest);
+        else if (op1 == dest)
+            xor32(op2, dest);
+        else {
+            move(op2, dest);
+            xor32(op1, dest);
+        }
+    }
+
+    void xor32(TrustedImm32 imm, RegisterID src, RegisterID dest)
+    {
+        move(src, dest);
+        xor32(imm, dest);
+    }
+
     void sqrtDouble(FPRegisterID src, FPRegisterID dst)
     {
         m_assembler.sqrtsd_rr(src, dst);
@@ -337,7 +421,7 @@ public:
     // Memory access operations:
     //
     // Loads are of the form load(address, destination) and stores of the form
-    // store(source, address).  The source for a store may be an Imm32.  Address
+    // store(source, address).  The source for a store may be an TrustedImm32.  Address
     // operand objects to loads and store will be implicitly constructed if a
     // register is passed.
 
@@ -388,7 +472,7 @@ public:
         m_assembler.movl_rm(src, address.offset, address.base, address.index, address.scale);
     }
 
-    void store32(Imm32 imm, ImplicitAddress address)
+    void store32(TrustedImm32 imm, ImplicitAddress address)
     {
         m_assembler.movl_i32m(imm.m_value, address.offset, address.base);
     }
@@ -398,6 +482,13 @@ public:
     //
     // Presently only supports SSE, not x87 floating point.
 
+    void moveDouble(FPRegisterID src, FPRegisterID dest)
+    {
+        ASSERT(isSSE2Present());
+        if (src != dest)
+            m_assembler.movsd_rr(src, dest);
+    }
+
     void loadDouble(ImplicitAddress address, FPRegisterID dest)
     {
         ASSERT(isSSE2Present());
@@ -416,6 +507,17 @@ public:
         m_assembler.addsd_rr(src, dest);
     }
 
+    void addDouble(FPRegisterID op1, FPRegisterID op2, FPRegisterID dest)
+    {
+        ASSERT(isSSE2Present());
+        if (op1 == dest)
+            addDouble(op2, dest);
+        else {
+            moveDouble(op2, dest);
+            addDouble(op1, dest);
+        }
+    }
+
     void addDouble(Address src, FPRegisterID dest)
     {
         ASSERT(isSSE2Present());
@@ -428,6 +530,15 @@ public:
         m_assembler.divsd_rr(src, dest);
     }
 
+    void divDouble(FPRegisterID op1, FPRegisterID op2, FPRegisterID dest)
+    {
+        // B := A / B is invalid.
+        ASSERT(op1 == dest || op2 != dest);
+
+        moveDouble(op1, dest);
+        divDouble(op2, dest);
+    }
+
     void divDouble(Address src, FPRegisterID dest)
     {
         ASSERT(isSSE2Present());
@@ -440,6 +551,15 @@ public:
         m_assembler.subsd_rr(src, dest);
     }
 
+    void subDouble(FPRegisterID op1, FPRegisterID op2, FPRegisterID dest)
+    {
+        // B := A - B is invalid.
+        ASSERT(op1 == dest || op2 != dest);
+
+        moveDouble(op1, dest);
+        subDouble(op2, dest);
+    }
+
     void subDouble(Address src, FPRegisterID dest)
     {
         ASSERT(isSSE2Present());
@@ -452,6 +572,17 @@ public:
         m_assembler.mulsd_rr(src, dest);
     }
 
+    void mulDouble(FPRegisterID op1, FPRegisterID op2, FPRegisterID dest)
+    {
+        ASSERT(isSSE2Present());
+        if (op1 == dest)
+            mulDouble(op2, dest);
+        else {
+            moveDouble(op2, dest);
+            mulDouble(op1, dest);
+        }
+    }
+
     void mulDouble(Address src, FPRegisterID dest)
     {
         ASSERT(isSSE2Present());
@@ -501,11 +632,12 @@ public:
     // If the result is not representable as a 32 bit value, branch.
     // May also branch for some values that are representable in 32 bits
     // (specifically, in this case, INT_MIN).
-    Jump branchTruncateDoubleToInt32(FPRegisterID src, RegisterID dest)
+    enum BranchTruncateType { BranchIfTruncateFailed, BranchIfTruncateSuccessful };
+    Jump branchTruncateDoubleToInt32(FPRegisterID src, RegisterID dest, BranchTruncateType branchType = BranchIfTruncateFailed)
     {
         ASSERT(isSSE2Present());
         m_assembler.cvttsd2si_rr(src, dest);
-        return branch32(Equal, dest, Imm32(0x80000000));
+        return branch32(branchType ? NotEqual : Equal, dest, TrustedImm32(0x80000000));
     }
 
     // Convert 'src' to an integer, and places the resulting 'dest'.
@@ -564,7 +696,7 @@ public:
         m_assembler.push_m(address.offset, address.base);
     }
 
-    void push(Imm32 imm)
+    void push(TrustedImm32 imm)
     {
         m_assembler.push_i32(imm.m_value);
     }
@@ -574,9 +706,9 @@ public:
     //
     // Move values in registers.
 
-    void move(Imm32 imm, RegisterID dest)
+    void move(TrustedImm32 imm, RegisterID dest)
     {
-        // Note: on 64-bit the Imm32 value is zero extended into the register, it
+        // Note: on 64-bit the TrustedImm32 value is zero extended into the register, it
         // may be useful to have a separate version that sign extends the value?
         if (!imm.m_value)
             m_assembler.xorl_rr(dest, dest);
@@ -593,7 +725,7 @@ public:
             m_assembler.movq_rr(src, dest);
     }
 
-    void move(ImmPtr imm, RegisterID dest)
+    void move(TrustedImmPtr imm, RegisterID dest)
     {
         m_assembler.movq_i64r(imm.asIntptr(), dest);
     }
@@ -620,7 +752,7 @@ public:
             m_assembler.movl_rr(src, dest);
     }
 
-    void move(ImmPtr imm, RegisterID dest)
+    void move(TrustedImmPtr imm, RegisterID dest)
     {
         m_assembler.movl_i32r(imm.asIntptr(), dest);
     }
@@ -655,14 +787,14 @@ public:
     // used (representing the names 'below' and 'above').
     //
     // Operands to the comparision are provided in the expected order, e.g.
-    // jle32(reg1, Imm32(5)) will branch if the value held in reg1, when
+    // jle32(reg1, TrustedImm32(5)) will branch if the value held in reg1, when
     // treated as a signed 32bit value, is less than or equal to 5.
     //
     // jz and jnz test whether the first operand is equal to zero, and take
     // an optional second operand of a mask under which to perform the test.
 
 public:
-    Jump branch8(Condition cond, Address left, Imm32 right)
+    Jump branch8(Condition cond, Address left, TrustedImm32 right)
     {
         m_assembler.cmpb_im(right.m_value, left.offset, left.base);
         return Jump(m_assembler.jCC(x86Condition(cond)));
@@ -674,7 +806,7 @@ public:
         return Jump(m_assembler.jCC(x86Condition(cond)));
     }
 
-    Jump branch32(Condition cond, RegisterID left, Imm32 right)
+    Jump branch32(Condition cond, RegisterID left, TrustedImm32 right)
     {
         if (((cond == Equal) || (cond == NotEqual)) && !right.m_value)
             m_assembler.testl_rr(left, left);
@@ -695,19 +827,19 @@ public:
         return Jump(m_assembler.jCC(x86Condition(cond)));
     }
 
-    Jump branch32(Condition cond, Address left, Imm32 right)
+    Jump branch32(Condition cond, Address left, TrustedImm32 right)
     {
         m_assembler.cmpl_im(right.m_value, left.offset, left.base);
         return Jump(m_assembler.jCC(x86Condition(cond)));
     }
 
-    Jump branch32(Condition cond, BaseIndex left, Imm32 right)
+    Jump branch32(Condition cond, BaseIndex left, TrustedImm32 right)
     {
         m_assembler.cmpl_im(right.m_value, left.offset, left.base, left.index, left.scale);
         return Jump(m_assembler.jCC(x86Condition(cond)));
     }
 
-    Jump branch32WithUnalignedHalfWords(Condition cond, BaseIndex left, Imm32 right)
+    Jump branch32WithUnalignedHalfWords(Condition cond, BaseIndex left, TrustedImm32 right)
     {
         return branch32(cond, left, right);
     }
@@ -718,7 +850,7 @@ public:
         return Jump(m_assembler.jCC(x86Condition(cond)));
     }
 
-    Jump branch16(Condition cond, BaseIndex left, Imm32 right)
+    Jump branch16(Condition cond, BaseIndex left, TrustedImm32 right)
     {
         ASSERT(!(right.m_value & 0xFFFF0000));
 
@@ -728,14 +860,14 @@ public:
 
     Jump branchTest32(Condition cond, RegisterID reg, RegisterID mask)
     {
-        ASSERT((cond == Zero) || (cond == NonZero));
+        ASSERT((cond == Zero) || (cond == NonZero) || (cond == Signed));
         m_assembler.testl_rr(reg, mask);
         return Jump(m_assembler.jCC(x86Condition(cond)));
     }
 
-    Jump branchTest32(Condition cond, RegisterID reg, Imm32 mask = Imm32(-1))
+    Jump branchTest32(Condition cond, RegisterID reg, TrustedImm32 mask = TrustedImm32(-1))
     {
-        ASSERT((cond == Zero) || (cond == NonZero));
+        ASSERT((cond == Zero) || (cond == NonZero) || (cond == Signed));
         // if we are only interested in the low seven bits, this can be tested with a testb
         if (mask.m_value == -1)
             m_assembler.testl_rr(reg, reg);
@@ -746,9 +878,9 @@ public:
         return Jump(m_assembler.jCC(x86Condition(cond)));
     }
 
-    Jump branchTest32(Condition cond, Address address, Imm32 mask = Imm32(-1))
+    Jump branchTest32(Condition cond, Address address, TrustedImm32 mask = TrustedImm32(-1))
     {
-        ASSERT((cond == Zero) || (cond == NonZero));
+        ASSERT((cond == Zero) || (cond == NonZero) || (cond == Signed));
         if (mask.m_value == -1)
             m_assembler.cmpl_im(0, address.offset, address.base);
         else
@@ -756,9 +888,9 @@ public:
         return Jump(m_assembler.jCC(x86Condition(cond)));
     }
 
-    Jump branchTest32(Condition cond, BaseIndex address, Imm32 mask = Imm32(-1))
+    Jump branchTest32(Condition cond, BaseIndex address, TrustedImm32 mask = TrustedImm32(-1))
     {
-        ASSERT((cond == Zero) || (cond == NonZero));
+        ASSERT((cond == Zero) || (cond == NonZero) || (cond == Signed));
         if (mask.m_value == -1)
             m_assembler.cmpl_im(0, address.offset, address.base, address.index, address.scale);
         else
@@ -766,9 +898,23 @@ public:
         return Jump(m_assembler.jCC(x86Condition(cond)));
     }
     
-    Jump branchTest8(Condition cond, Address address, Imm32 mask = Imm32(-1))
+    Jump branchTest8(Condition cond, RegisterID reg, TrustedImm32 mask = TrustedImm32(-1))
+    {
+        // Byte in TrustedImm32 is not well defined, so be a little permisive here, but don't accept nonsense values.
+        ASSERT(mask.m_value >= -128 && mask.m_value <= 255);
+        ASSERT((cond == Zero) || (cond == NonZero) || (cond == Signed));
+        if (mask.m_value == -1)
+            m_assembler.testb_rr(reg, reg);
+        else
+            m_assembler.testb_i8r(mask.m_value, reg);
+        return Jump(m_assembler.jCC(x86Condition(cond)));
+    }
+
+    Jump branchTest8(Condition cond, Address address, TrustedImm32 mask = TrustedImm32(-1))
     {
-        ASSERT((cond == Zero) || (cond == NonZero));
+        // Byte in TrustedImm32 is not well defined, so be a little permisive here, but don't accept nonsense values.
+        ASSERT(mask.m_value >= -128 && mask.m_value <= 255);
+        ASSERT((cond == Zero) || (cond == NonZero) || (cond == Signed));
         if (mask.m_value == -1)
             m_assembler.cmpb_im(0, address.offset, address.base);
         else
@@ -776,9 +922,11 @@ public:
         return Jump(m_assembler.jCC(x86Condition(cond)));
     }
     
-    Jump branchTest8(Condition cond, BaseIndex address, Imm32 mask = Imm32(-1))
+    Jump branchTest8(Condition cond, BaseIndex address, TrustedImm32 mask = TrustedImm32(-1))
     {
-        ASSERT((cond == Zero) || (cond == NonZero));
+        // Byte in TrustedImm32 is not well defined, so be a little permisive here, but don't accept nonsense values.
+        ASSERT(mask.m_value >= -128 && mask.m_value <= 255);
+        ASSERT((cond == Zero) || (cond == NonZero) || (cond == Signed));
         if (mask.m_value == -1)
             m_assembler.cmpb_im(0, address.offset, address.base, address.index, address.scale);
         else
@@ -820,14 +968,14 @@ public:
         return Jump(m_assembler.jCC(x86Condition(cond)));
     }
 
-    Jump branchAdd32(Condition cond, Imm32 imm, RegisterID dest)
+    Jump branchAdd32(Condition cond, TrustedImm32 imm, RegisterID dest)
     {
         ASSERT((cond == Overflow) || (cond == Signed) || (cond == Zero) || (cond == NonZero));
         add32(imm, dest);
         return Jump(m_assembler.jCC(x86Condition(cond)));
     }
     
-    Jump branchAdd32(Condition cond, Imm32 src, Address dest)
+    Jump branchAdd32(Condition cond, TrustedImm32 src, Address dest)
     {
         ASSERT((cond == Overflow) || (cond == Zero) || (cond == NonZero));
         add32(src, dest);
@@ -848,6 +996,20 @@ public:
         return Jump(m_assembler.jCC(x86Condition(cond)));
     }
 
+    Jump branchAdd32(Condition cond, RegisterID src1, RegisterID src2, RegisterID dest)
+    {
+        if (src1 == dest)
+            return branchAdd32(cond, src2, dest);
+        move(src2, dest);
+        return branchAdd32(cond, src1, dest);
+    }
+
+    Jump branchAdd32(Condition cond, TrustedImm32 imm, RegisterID src, RegisterID dest)
+    {
+        move(src, dest);
+        return branchAdd32(cond, imm, dest);
+    }
+
     Jump branchMul32(Condition cond, RegisterID src, RegisterID dest)
     {
         ASSERT(cond == Overflow);
@@ -862,13 +1024,21 @@ public:
         return Jump(m_assembler.jCC(x86Condition(cond)));
     }
     
-    Jump branchMul32(Condition cond, Imm32 imm, RegisterID src, RegisterID dest)
+    Jump branchMul32(Condition cond, TrustedImm32 imm, RegisterID src, RegisterID dest)
     {
         ASSERT(cond == Overflow);
         mul32(imm, src, dest);
         return Jump(m_assembler.jCC(x86Condition(cond)));
     }
     
+    Jump branchMul32(Condition cond, RegisterID src1, RegisterID src2, RegisterID dest)
+    {
+        if (src1 == dest)
+            return branchMul32(cond, src2, dest);
+        move(src2, dest);
+        return branchMul32(cond, src1, dest);
+    }
+
     Jump branchSub32(Condition cond, RegisterID src, RegisterID dest)
     {
         ASSERT((cond == Overflow) || (cond == Signed) || (cond == Zero) || (cond == NonZero));
@@ -876,14 +1046,14 @@ public:
         return Jump(m_assembler.jCC(x86Condition(cond)));
     }
     
-    Jump branchSub32(Condition cond, Imm32 imm, RegisterID dest)
+    Jump branchSub32(Condition cond, TrustedImm32 imm, RegisterID dest)
     {
         ASSERT((cond == Overflow) || (cond == Signed) || (cond == Zero) || (cond == NonZero));
         sub32(imm, dest);
         return Jump(m_assembler.jCC(x86Condition(cond)));
     }
 
-    Jump branchSub32(Condition cond, Imm32 imm, Address dest)
+    Jump branchSub32(Condition cond, TrustedImm32 imm, Address dest)
     {
         ASSERT((cond == Overflow) || (cond == Zero) || (cond == NonZero));
         sub32(imm, dest);
@@ -904,6 +1074,15 @@ public:
         return Jump(m_assembler.jCC(x86Condition(cond)));
     }
 
+    Jump branchSub32(Condition cond, RegisterID src1, RegisterID src2, RegisterID dest)
+    {
+        // B := A - B is invalid.
+        ASSERT(src1 == dest || src2 != dest);
+
+        move(src1, dest);
+        return branchSub32(cond, src2, dest);
+    }
+
     Jump branchNeg32(Condition cond, RegisterID srcDest)
     {
         ASSERT((cond == Overflow) || (cond == Zero) || (cond == NonZero));
@@ -958,7 +1137,7 @@ public:
         m_assembler.setCC_r(x86Condition(cond), dest);
     }
 
-    void set8Compare32(Condition cond, RegisterID left, Imm32 right, RegisterID dest)
+    void set8Compare32(Condition cond, RegisterID left, TrustedImm32 right, RegisterID dest)
     {
         if (((cond == Equal) || (cond == NotEqual)) && !right.m_value)
             m_assembler.testl_rr(left, left);
@@ -974,7 +1153,7 @@ public:
         m_assembler.movzbl_rr(dest, dest);
     }
 
-    void set32Compare32(Condition cond, RegisterID left, Imm32 right, RegisterID dest)
+    void set32Compare32(Condition cond, RegisterID left, TrustedImm32 right, RegisterID dest)
     {
         if (((cond == Equal) || (cond == NotEqual)) && !right.m_value)
             m_assembler.testl_rr(left, left);
@@ -989,7 +1168,7 @@ public:
     // dest-src, operations always have a dest? ... possibly not true, considering
     // asm ops like test, or pseudo ops like pop().
 
-    void set32Test8(Condition cond, Address address, Imm32 mask, RegisterID dest)
+    void set32Test8(Condition cond, Address address, TrustedImm32 mask, RegisterID dest)
     {
         if (mask.m_value == -1)
             m_assembler.cmpb_im(0, address.offset, address.base);
@@ -999,7 +1178,7 @@ public:
         m_assembler.movzbl_rr(dest, dest);
     }
 
-    void set32Test32(Condition cond, Address address, Imm32 mask, RegisterID dest)
+    void set32Test32(Condition cond, Address address, TrustedImm32 mask, RegisterID dest)
     {
         if (mask.m_value == -1)
             m_assembler.cmpl_im(0, address.offset, address.base);
diff --git a/Source/JavaScriptCore/assembler/MacroAssemblerX86_64.h b/Source/JavaScriptCore/assembler/MacroAssemblerX86_64.h
index ebbe0bd..bd417aa 100644
--- a/Source/JavaScriptCore/assembler/MacroAssemblerX86_64.h
+++ b/Source/JavaScriptCore/assembler/MacroAssemblerX86_64.h
@@ -48,30 +48,31 @@ public:
     using MacroAssemblerX86Common::load32;
     using MacroAssemblerX86Common::store32;
     using MacroAssemblerX86Common::call;
+    using MacroAssemblerX86Common::addDouble;
     using MacroAssemblerX86Common::loadDouble;
     using MacroAssemblerX86Common::convertInt32ToDouble;
 
-    void add32(Imm32 imm, AbsoluteAddress address)
+    void add32(TrustedImm32 imm, AbsoluteAddress address)
     {
-        move(ImmPtr(address.m_ptr), scratchRegister);
+        move(TrustedImmPtr(address.m_ptr), scratchRegister);
         add32(imm, Address(scratchRegister));
     }
     
-    void and32(Imm32 imm, AbsoluteAddress address)
+    void and32(TrustedImm32 imm, AbsoluteAddress address)
     {
-        move(ImmPtr(address.m_ptr), scratchRegister);
+        move(TrustedImmPtr(address.m_ptr), scratchRegister);
         and32(imm, Address(scratchRegister));
     }
     
-    void or32(Imm32 imm, AbsoluteAddress address)
+    void or32(TrustedImm32 imm, AbsoluteAddress address)
     {
-        move(ImmPtr(address.m_ptr), scratchRegister);
+        move(TrustedImmPtr(address.m_ptr), scratchRegister);
         or32(imm, Address(scratchRegister));
     }
 
-    void sub32(Imm32 imm, AbsoluteAddress address)
+    void sub32(TrustedImm32 imm, AbsoluteAddress address)
     {
-        move(ImmPtr(address.m_ptr), scratchRegister);
+        move(TrustedImmPtr(address.m_ptr), scratchRegister);
         sub32(imm, Address(scratchRegister));
     }
 
@@ -88,17 +89,23 @@ public:
 
     void loadDouble(const void* address, FPRegisterID dest)
     {
-        move(ImmPtr(address), scratchRegister);
+        move(TrustedImmPtr(address), scratchRegister);
         loadDouble(scratchRegister, dest);
     }
 
-    void convertInt32ToDouble(AbsoluteAddress src, FPRegisterID dest)
+    void addDouble(AbsoluteAddress address, FPRegisterID dest)
     {
-        move(Imm32(*static_cast<int32_t*>(src.m_ptr)), scratchRegister);
+        move(TrustedImmPtr(address.m_ptr), scratchRegister);
+        m_assembler.addsd_mr(0, scratchRegister, dest);
+    }
+
+    void convertInt32ToDouble(TrustedImm32 imm, FPRegisterID dest)
+    {
+        move(imm, scratchRegister);
         m_assembler.cvtsi2sd_rr(scratchRegister, dest);
     }
 
-    void store32(Imm32 imm, void* address)
+    void store32(TrustedImm32 imm, void* address)
     {
         move(X86Registers::eax, scratchRegister);
         move(imm, X86Registers::eax);
@@ -108,7 +115,7 @@ public:
 
     Call call()
     {
-        DataLabelPtr label = moveWithPatch(ImmPtr(0), scratchRegister);
+        DataLabelPtr label = moveWithPatch(TrustedImmPtr(0), scratchRegister);
         Call result = Call(m_assembler.call(scratchRegister), Call::Linkable);
         ASSERT(differenceBetween(label, result) == REPTACH_OFFSET_CALL_R11);
         return result;
@@ -116,7 +123,7 @@ public:
 
     Call tailRecursiveCall()
     {
-        DataLabelPtr label = moveWithPatch(ImmPtr(0), scratchRegister);
+        DataLabelPtr label = moveWithPatch(TrustedImmPtr(0), scratchRegister);
         Jump newJump = Jump(m_assembler.jmp_r(scratchRegister));
         ASSERT(differenceBetween(label, newJump) == REPTACH_OFFSET_CALL_R11);
         return Call::fromTailJump(newJump);
@@ -125,7 +132,7 @@ public:
     Call makeTailRecursiveCall(Jump oldJump)
     {
         oldJump.link(this);
-        DataLabelPtr label = moveWithPatch(ImmPtr(0), scratchRegister);
+        DataLabelPtr label = moveWithPatch(TrustedImmPtr(0), scratchRegister);
         Jump newJump = Jump(m_assembler.jmp_r(scratchRegister));
         ASSERT(differenceBetween(label, newJump) == REPTACH_OFFSET_CALL_R11);
         return Call::fromTailJump(newJump);
@@ -137,30 +144,30 @@ public:
         m_assembler.addq_rr(src, dest);
     }
 
-    void addPtr(Imm32 imm, RegisterID srcDest)
+    void addPtr(TrustedImm32 imm, RegisterID srcDest)
     {
         m_assembler.addq_ir(imm.m_value, srcDest);
     }
 
-    void addPtr(ImmPtr imm, RegisterID dest)
+    void addPtr(TrustedImmPtr imm, RegisterID dest)
     {
         move(imm, scratchRegister);
         m_assembler.addq_rr(scratchRegister, dest);
     }
 
-    void addPtr(Imm32 imm, RegisterID src, RegisterID dest)
+    void addPtr(TrustedImm32 imm, RegisterID src, RegisterID dest)
     {
         m_assembler.leaq_mr(imm.m_value, src, dest);
     }
 
-    void addPtr(Imm32 imm, Address address)
+    void addPtr(TrustedImm32 imm, Address address)
     {
         m_assembler.addq_im(imm.m_value, address.offset, address.base);
     }
 
-    void addPtr(Imm32 imm, AbsoluteAddress address)
+    void addPtr(TrustedImm32 imm, AbsoluteAddress address)
     {
-        move(ImmPtr(address.m_ptr), scratchRegister);
+        move(TrustedImmPtr(address.m_ptr), scratchRegister);
         addPtr(imm, Address(scratchRegister));
     }
     
@@ -169,7 +176,7 @@ public:
         m_assembler.andq_rr(src, dest);
     }
 
-    void andPtr(Imm32 imm, RegisterID srcDest)
+    void andPtr(TrustedImm32 imm, RegisterID srcDest)
     {
         m_assembler.andq_ir(imm.m_value, srcDest);
     }
@@ -179,13 +186,13 @@ public:
         m_assembler.orq_rr(src, dest);
     }
 
-    void orPtr(ImmPtr imm, RegisterID dest)
+    void orPtr(TrustedImmPtr imm, RegisterID dest)
     {
         move(imm, scratchRegister);
         m_assembler.orq_rr(scratchRegister, dest);
     }
 
-    void orPtr(Imm32 imm, RegisterID dest)
+    void orPtr(TrustedImm32 imm, RegisterID dest)
     {
         m_assembler.orq_ir(imm.m_value, dest);
     }
@@ -195,12 +202,12 @@ public:
         m_assembler.subq_rr(src, dest);
     }
     
-    void subPtr(Imm32 imm, RegisterID dest)
+    void subPtr(TrustedImm32 imm, RegisterID dest)
     {
         m_assembler.subq_ir(imm.m_value, dest);
     }
     
-    void subPtr(ImmPtr imm, RegisterID dest)
+    void subPtr(TrustedImmPtr imm, RegisterID dest)
     {
         move(imm, scratchRegister);
         m_assembler.subq_rr(scratchRegister, dest);
@@ -211,7 +218,7 @@ public:
         m_assembler.xorq_rr(src, dest);
     }
 
-    void xorPtr(Imm32 imm, RegisterID srcDest)
+    void xorPtr(TrustedImm32 imm, RegisterID srcDest)
     {
         m_assembler.xorq_ir(imm.m_value, srcDest);
     }
@@ -227,7 +234,7 @@ public:
         m_assembler.movq_mr(address.offset, address.base, address.index, address.scale, dest);
     }
 
-    void loadPtr(void* address, RegisterID dest)
+    void loadPtr(const void* address, RegisterID dest)
     {
         if (dest == X86Registers::eax)
             m_assembler.movq_mEAX(address);
@@ -265,7 +272,7 @@ public:
         }
     }
 
-    void storePtr(ImmPtr imm, ImplicitAddress address)
+    void storePtr(TrustedImmPtr imm, ImplicitAddress address)
     {
         move(imm, scratchRegister);
         storePtr(scratchRegister, address);
@@ -287,7 +294,7 @@ public:
         m_assembler.movq_rr(src, dest);
     }
 
-    void setPtr(Condition cond, RegisterID left, Imm32 right, RegisterID dest)
+    void setPtr(Condition cond, RegisterID left, TrustedImm32 right, RegisterID dest)
     {
         if (((cond == Equal) || (cond == NotEqual)) && !right.m_value)
             m_assembler.testq_rr(left, left);
@@ -303,7 +310,7 @@ public:
         return Jump(m_assembler.jCC(x86Condition(cond)));
     }
 
-    Jump branchPtr(Condition cond, RegisterID left, ImmPtr right)
+    Jump branchPtr(Condition cond, RegisterID left, TrustedImmPtr right)
     {
         move(right, scratchRegister);
         return branchPtr(cond, left, scratchRegister);
@@ -317,7 +324,7 @@ public:
 
     Jump branchPtr(Condition cond, AbsoluteAddress left, RegisterID right)
     {
-        move(ImmPtr(left.m_ptr), scratchRegister);
+        move(TrustedImmPtr(left.m_ptr), scratchRegister);
         return branchPtr(cond, Address(scratchRegister), right);
     }
 
@@ -327,7 +334,7 @@ public:
         return Jump(m_assembler.jCC(x86Condition(cond)));
     }
 
-    Jump branchPtr(Condition cond, Address left, ImmPtr right)
+    Jump branchPtr(Condition cond, Address left, TrustedImmPtr right)
     {
         move(right, scratchRegister);
         return branchPtr(cond, left, scratchRegister);
@@ -339,7 +346,7 @@ public:
         return Jump(m_assembler.jCC(x86Condition(cond)));
     }
 
-    Jump branchTestPtr(Condition cond, RegisterID reg, Imm32 mask = Imm32(-1))
+    Jump branchTestPtr(Condition cond, RegisterID reg, TrustedImm32 mask = TrustedImm32(-1))
     {
         // if we are only interested in the low seven bits, this can be tested with a testb
         if (mask.m_value == -1)
@@ -351,7 +358,13 @@ public:
         return Jump(m_assembler.jCC(x86Condition(cond)));
     }
 
-    Jump branchTestPtr(Condition cond, Address address, Imm32 mask = Imm32(-1))
+    Jump branchTestPtr(Condition cond, AbsoluteAddress address, TrustedImm32 mask = TrustedImm32(-1))
+    {
+        loadPtr(address.m_ptr, scratchRegister);
+        return branchTestPtr(cond, scratchRegister, mask);
+    }
+
+    Jump branchTestPtr(Condition cond, Address address, TrustedImm32 mask = TrustedImm32(-1))
     {
         if (mask.m_value == -1)
             m_assembler.cmpq_im(0, address.offset, address.base);
@@ -360,7 +373,7 @@ public:
         return Jump(m_assembler.jCC(x86Condition(cond)));
     }
 
-    Jump branchTestPtr(Condition cond, BaseIndex address, Imm32 mask = Imm32(-1))
+    Jump branchTestPtr(Condition cond, BaseIndex address, TrustedImm32 mask = TrustedImm32(-1))
     {
         if (mask.m_value == -1)
             m_assembler.cmpq_im(0, address.offset, address.base, address.index, address.scale);
@@ -377,32 +390,32 @@ public:
         return Jump(m_assembler.jCC(x86Condition(cond)));
     }
 
-    Jump branchSubPtr(Condition cond, Imm32 imm, RegisterID dest)
+    Jump branchSubPtr(Condition cond, TrustedImm32 imm, RegisterID dest)
     {
         ASSERT((cond == Overflow) || (cond == Zero) || (cond == NonZero));
         subPtr(imm, dest);
         return Jump(m_assembler.jCC(x86Condition(cond)));
     }
 
-    DataLabelPtr moveWithPatch(ImmPtr initialValue, RegisterID dest)
+    DataLabelPtr moveWithPatch(TrustedImmPtr initialValue, RegisterID dest)
     {
         m_assembler.movq_i64r(initialValue.asIntptr(), dest);
         return DataLabelPtr(this);
     }
 
-    Jump branchPtrWithPatch(Condition cond, RegisterID left, DataLabelPtr& dataLabel, ImmPtr initialRightValue = ImmPtr(0))
+    Jump branchPtrWithPatch(Condition cond, RegisterID left, DataLabelPtr& dataLabel, TrustedImmPtr initialRightValue = TrustedImmPtr(0))
     {
         dataLabel = moveWithPatch(initialRightValue, scratchRegister);
         return branchPtr(cond, left, scratchRegister);
     }
 
-    Jump branchPtrWithPatch(Condition cond, Address left, DataLabelPtr& dataLabel, ImmPtr initialRightValue = ImmPtr(0))
+    Jump branchPtrWithPatch(Condition cond, Address left, DataLabelPtr& dataLabel, TrustedImmPtr initialRightValue = TrustedImmPtr(0))
     {
         dataLabel = moveWithPatch(initialRightValue, scratchRegister);
         return branchPtr(cond, left, scratchRegister);
     }
 
-    DataLabelPtr storePtrWithPatch(ImmPtr initialValue, ImplicitAddress address)
+    DataLabelPtr storePtrWithPatch(TrustedImmPtr initialValue, ImplicitAddress address)
     {
         DataLabelPtr label = moveWithPatch(initialValue, scratchRegister);
         storePtr(scratchRegister, address);
@@ -410,9 +423,9 @@ public:
     }
 
     using MacroAssemblerX86Common::branchTest8;
-    Jump branchTest8(Condition cond, ExtendedAddress address, Imm32 mask = Imm32(-1))
+    Jump branchTest8(Condition cond, ExtendedAddress address, TrustedImm32 mask = TrustedImm32(-1))
     {
-        ImmPtr addr(reinterpret_cast<void*>(address.offset));
+        TrustedImmPtr addr(reinterpret_cast<void*>(address.offset));
         MacroAssemblerX86Common::move(addr, scratchRegister);
         return MacroAssemblerX86Common::branchTest8(cond, BaseIndex(scratchRegister, address.base, TimesOne), mask);
     }
diff --git a/Source/JavaScriptCore/assembler/X86Assembler.h b/Source/JavaScriptCore/assembler/X86Assembler.h
index 587d900..4851c1e 100644
--- a/Source/JavaScriptCore/assembler/X86Assembler.h
+++ b/Source/JavaScriptCore/assembler/X86Assembler.h
@@ -131,6 +131,7 @@ private:
         OP_GROUP1_EbIb                  = 0x80,
         OP_GROUP1_EvIz                  = 0x81,
         OP_GROUP1_EvIb                  = 0x83,
+        OP_TEST_EbGb                    = 0x84,
         OP_TEST_EvGv                    = 0x85,
         OP_XCHG_EvGv                    = 0x87,
         OP_MOV_EvGv                     = 0x89,
@@ -228,6 +229,8 @@ public:
         {
         }
 
+        bool isSet() const { return (m_offset != -1); }
+
     private:
         JmpSrc(int offset)
             : m_offset(offset)
@@ -299,7 +302,7 @@ public:
     // Arithmetic operations:
 
 #if !CPU(X86_64)
-    void adcl_im(int imm, void* addr)
+    void adcl_im(int imm, const void* addr)
     {
         if (CAN_SIGN_EXTEND_8_32(imm)) {
             m_formatter.oneByteOp(OP_GROUP1_EvIb, GROUP1_OP_ADC, addr);
@@ -376,7 +379,7 @@ public:
         }
     }
 #else
-    void addl_im(int imm, void* addr)
+    void addl_im(int imm, const void* addr)
     {
         if (CAN_SIGN_EXTEND_8_32(imm)) {
             m_formatter.oneByteOp(OP_GROUP1_EvIb, GROUP1_OP_ADD, addr);
@@ -442,7 +445,7 @@ public:
         }
     }
 #else
-    void andl_im(int imm, void* addr)
+    void andl_im(int imm, const void* addr)
     {
         if (CAN_SIGN_EXTEND_8_32(imm)) {
             m_formatter.oneByteOp(OP_GROUP1_EvIb, GROUP1_OP_AND, addr);
@@ -528,7 +531,7 @@ public:
         }
     }
 #else
-    void orl_im(int imm, void* addr)
+    void orl_im(int imm, const void* addr)
     {
         if (CAN_SIGN_EXTEND_8_32(imm)) {
             m_formatter.oneByteOp(OP_GROUP1_EvIb, GROUP1_OP_OR, addr);
@@ -594,7 +597,7 @@ public:
         }
     }
 #else
-    void subl_im(int imm, void* addr)
+    void subl_im(int imm, const void* addr)
     {
         if (CAN_SIGN_EXTEND_8_32(imm)) {
             m_formatter.oneByteOp(OP_GROUP1_EvIb, GROUP1_OP_SUB, addr);
@@ -867,12 +870,12 @@ public:
         }
     }
 #else
-    void cmpl_rm(RegisterID reg, void* addr)
+    void cmpl_rm(RegisterID reg, const void* addr)
     {
         m_formatter.oneByteOp(OP_CMP_EvGv, reg, addr);
     }
 
-    void cmpl_im(int imm, void* addr)
+    void cmpl_im(int imm, const void* addr)
     {
         if (CAN_SIGN_EXTEND_8_32(imm)) {
             m_formatter.oneByteOp(OP_GROUP1_EvIb, GROUP1_OP_CMP, addr);
@@ -919,7 +922,12 @@ public:
         m_formatter.oneByteOp(OP_GROUP3_EvIz, GROUP3_OP_TEST, base, offset);
         m_formatter.immediate32(imm);
     }
-    
+
+    void testb_rr(RegisterID src, RegisterID dst)
+    {
+        m_formatter.oneByteOp(OP_TEST_EbGb, src, dst);
+    }
+
     void testb_im(int imm, int offset, RegisterID base)
     {
         m_formatter.oneByteOp(OP_GROUP3_EbIb, GROUP3_OP_TEST, base, offset);
@@ -1039,7 +1047,7 @@ public:
         m_formatter.oneByteOp(OP_MOV_EvGv, src, base, index, scale, offset);
     }
     
-    void movl_mEAX(void* addr)
+    void movl_mEAX(const void* addr)
     {
         m_formatter.oneByteOp(OP_MOV_EAXOv);
 #if CPU(X86_64)
@@ -1076,7 +1084,7 @@ public:
         m_formatter.immediate32(imm);
     }
 
-    void movl_EAXm(void* addr)
+    void movl_EAXm(const void* addr)
     {
         m_formatter.oneByteOp(OP_MOV_OvEAX);
 #if CPU(X86_64)
@@ -1107,13 +1115,13 @@ public:
         m_formatter.oneByteOp64(OP_MOV_EvGv, src, base, index, scale, offset);
     }
 
-    void movq_mEAX(void* addr)
+    void movq_mEAX(const void* addr)
     {
         m_formatter.oneByteOp64(OP_MOV_EAXOv);
         m_formatter.immediate64(reinterpret_cast<int64_t>(addr));
     }
 
-    void movq_EAXm(void* addr)
+    void movq_EAXm(const void* addr)
     {
         m_formatter.oneByteOp64(OP_MOV_OvEAX);
         m_formatter.immediate64(reinterpret_cast<int64_t>(addr));
@@ -1153,7 +1161,7 @@ public:
     
     
 #else
-    void movl_rm(RegisterID src, void* addr)
+    void movl_rm(RegisterID src, const void* addr)
     {
         if (src == X86Registers::eax)
             movl_EAXm(addr);
@@ -1161,7 +1169,7 @@ public:
             m_formatter.oneByteOp(OP_MOV_EvGv, src, addr);
     }
     
-    void movl_mr(void* addr, RegisterID dst)
+    void movl_mr(const void* addr, RegisterID dst)
     {
         if (dst == X86Registers::eax)
             movl_mEAX(addr);
@@ -1169,7 +1177,7 @@ public:
             m_formatter.oneByteOp(OP_MOV_GvEv, dst, addr);
     }
 
-    void movl_i32m(int imm, void* addr)
+    void movl_i32m(int imm, const void* addr)
     {
         m_formatter.oneByteOp(OP_GROUP11_EvIz, GROUP11_MOV, addr);
         m_formatter.immediate32(imm);
@@ -1365,7 +1373,7 @@ public:
     }
 
 #if !CPU(X86_64)
-    void cvtsi2sd_mr(void* address, XMMRegisterID dst)
+    void cvtsi2sd_mr(const void* address, XMMRegisterID dst)
     {
         m_formatter.prefix(PRE_SSE_F2);
         m_formatter.twoByteOp(OP2_CVTSI2SD_VsdEd, (RegisterID)dst, address);
@@ -1398,6 +1406,12 @@ public:
     }
 #endif
 
+    void movsd_rr(XMMRegisterID src, XMMRegisterID dst)
+    {
+        m_formatter.prefix(PRE_SSE_F2);
+        m_formatter.twoByteOp(OP2_MOVSD_VsdWsd, (RegisterID)dst, (RegisterID)src);
+    }
+
     void movsd_rm(XMMRegisterID src, int offset, RegisterID base)
     {
         m_formatter.prefix(PRE_SSE_F2);
@@ -1536,6 +1550,7 @@ public:
         ASSERT(to.m_offset != -1);
 
         char* code = reinterpret_cast<char*>(m_formatter.data());
+        ASSERT(!reinterpret_cast<int32_t*>(code + from.m_offset)[-1]);
         setRel32(code + from.m_offset, code + to.m_offset);
     }
     
@@ -1717,7 +1732,7 @@ private:
         }
 
 #if !CPU(X86_64)
-        void oneByteOp(OneByteOpcodeID opcode, int reg, void* address)
+        void oneByteOp(OneByteOpcodeID opcode, int reg, const void* address)
         {
             m_buffer.ensureSpace(maxInstructionSize);
             m_buffer.putByteUnchecked(opcode);
diff --git a/Source/JavaScriptCore/bytecode/CodeBlock.cpp b/Source/JavaScriptCore/bytecode/CodeBlock.cpp
index 2d235df..98bbb3c 100644
--- a/Source/JavaScriptCore/bytecode/CodeBlock.cpp
+++ b/Source/JavaScriptCore/bytecode/CodeBlock.cpp
@@ -364,7 +364,7 @@ void CodeBlock::dump(ExecState* exec) const
         unsigned registerIndex = m_numVars;
         size_t i = 0;
         do {
-            printf("   k%u = %s\n", registerIndex, valueToSourceString(exec, m_constantRegisters[i].jsValue()).utf8().data());
+            printf("   k%u = %s\n", registerIndex, valueToSourceString(exec, m_constantRegisters[i].get()).utf8().data());
             ++i;
             ++registerIndex;
         } while (i < m_constantRegisters.size());
@@ -731,7 +731,7 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
         case op_resolve_global_dynamic: {
             int r0 = (++it)->u.operand;
             int id0 = (++it)->u.operand;
-            JSValue scope = JSValue((++it)->u.jsCell);
+            JSValue scope = JSValue((++it)->u.jsCell.get());
             ++it;
             int depth = (++it)->u.operand;
             printf("[%4d] resolve_global_dynamic\t %s, %s, %s, %d\n", location, registerName(exec, r0).data(), valueToSourceString(exec, scope).utf8().data(), idName(id0, m_identifiers[id0]).data(), depth);
@@ -1360,13 +1360,13 @@ void CodeBlock::dumpStatistics()
 }
 
 CodeBlock::CodeBlock(ScriptExecutable* ownerExecutable, CodeType codeType, JSGlobalObject *globalObject, PassRefPtr<SourceProvider> sourceProvider, unsigned sourceOffset, SymbolTable* symTab, bool isConstructor)
-    : m_globalObject(globalObject)
+    : m_globalObject(globalObject->globalData(), ownerExecutable, globalObject)
     , m_heap(&m_globalObject->globalData().heap)
     , m_numCalleeRegisters(0)
     , m_numVars(0)
     , m_numParameters(0)
     , m_isConstructor(isConstructor)
-    , m_ownerExecutable(ownerExecutable)
+    , m_ownerExecutable(globalObject->globalData(), ownerExecutable, ownerExecutable)
     , m_globalData(0)
 #ifndef NDEBUG
     , m_instructionCount(0)
@@ -1406,12 +1406,6 @@ CodeBlock::~CodeBlock()
     for (size_t size = m_structureStubInfos.size(), i = 0; i < size; ++i)
         m_structureStubInfos[i].deref();
 
-    for (size_t size = m_callLinkInfos.size(), i = 0; i < size; ++i) {
-        CallLinkInfo* callLinkInfo = &m_callLinkInfos[i];
-        if (callLinkInfo->isLinked())
-            callLinkInfo->callee->removeCaller(callLinkInfo);
-    }
-
     for (size_t size = m_methodCallLinkInfos.size(), i = 0; i < size; ++i) {
         if (Structure* structure = m_methodCallLinkInfos[i].cachedStructure) {
             structure->deref();
@@ -1421,10 +1415,6 @@ CodeBlock::~CodeBlock()
         }
     }
 
-#if ENABLE(JIT_OPTIMIZE_CALL)
-    unlinkCallers();
-#endif
-
 #endif // ENABLE(JIT)
 
 #if DUMP_CODE_BLOCK_STATISTICS
@@ -1432,19 +1422,6 @@ CodeBlock::~CodeBlock()
 #endif
 }
 
-#if ENABLE(JIT_OPTIMIZE_CALL)
-void CodeBlock::unlinkCallers()
-{
-    size_t size = m_linkedCallerList.size();
-    for (size_t i = 0; i < size; ++i) {
-        CallLinkInfo* currentCaller = m_linkedCallerList[i];
-        JIT::unlinkCallOrConstruct(currentCaller);
-        currentCaller->setUnlinked();
-    }
-    m_linkedCallerList.clear();
-}
-#endif
-
 void CodeBlock::derefStructures(Instruction* vPC) const
 {
     Interpreter* interpreter = m_globalData->interpreter;
@@ -1460,13 +1437,11 @@ void CodeBlock::derefStructures(Instruction* vPC) const
     }
     if (vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_chain) || vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_getter_chain) || vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_custom_chain)) {
         vPC[4].u.structure->deref();
-        vPC[5].u.structureChain->deref();
         return;
     }
     if (vPC[0].u.opcode == interpreter->getOpcode(op_put_by_id_transition)) {
         vPC[4].u.structure->deref();
         vPC[5].u.structure->deref();
-        vPC[6].u.structureChain->deref();
         return;
     }
     if (vPC[0].u.opcode == interpreter->getOpcode(op_put_by_id_replace)) {
@@ -1509,13 +1484,11 @@ void CodeBlock::refStructures(Instruction* vPC) const
     }
     if (vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_chain) || vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_getter_chain) || vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_custom_chain)) {
         vPC[4].u.structure->ref();
-        vPC[5].u.structureChain->ref();
         return;
     }
     if (vPC[0].u.opcode == interpreter->getOpcode(op_put_by_id_transition)) {
         vPC[4].u.structure->ref();
         vPC[5].u.structure->ref();
-        vPC[6].u.structureChain->ref();
         return;
     }
     if (vPC[0].u.opcode == interpreter->getOpcode(op_put_by_id_replace)) {
@@ -1527,14 +1500,43 @@ void CodeBlock::refStructures(Instruction* vPC) const
     ASSERT(vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id) || vPC[0].u.opcode == interpreter->getOpcode(op_put_by_id) || vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_generic) || vPC[0].u.opcode == interpreter->getOpcode(op_put_by_id_generic));
 }
 
+void EvalCodeCache::markAggregate(MarkStack& markStack)
+{
+    EvalCacheMap::iterator end = m_cacheMap.end();
+    for (EvalCacheMap::iterator ptr = m_cacheMap.begin(); ptr != end; ++ptr)
+        markStack.append(&ptr->second);
+}
+
 void CodeBlock::markAggregate(MarkStack& markStack)
 {
-    for (size_t i = 0; i < m_constantRegisters.size(); ++i)
-        markStack.deprecatedAppend(&m_constantRegisters[i]);
+    markStack.append(&m_globalObject);
+    markStack.append(&m_ownerExecutable);
+    if (m_rareData)
+        m_rareData->m_evalCodeCache.markAggregate(markStack);
+    markStack.appendValues(m_constantRegisters.data(), m_constantRegisters.size());
     for (size_t i = 0; i < m_functionExprs.size(); ++i)
-        m_functionExprs[i]->markAggregate(markStack);
+        markStack.append(&m_functionExprs[i]);
     for (size_t i = 0; i < m_functionDecls.size(); ++i)
-        m_functionDecls[i]->markAggregate(markStack);
+        markStack.append(&m_functionDecls[i]);
+#if ENABLE(JIT_OPTIMIZE_CALL)
+    for (unsigned i = 0; i < numberOfCallLinkInfos(); ++i)
+        if (callLinkInfo(i).isLinked())
+            markStack.append(&callLinkInfo(i).callee);
+#endif
+#if ENABLE(INTERPRETER)
+    Interpreter* interpreter = m_globalData->interpreter;
+    for (size_t size = m_propertyAccessInstructions.size(), i = 0; i < size; ++i) {
+        Instruction* vPC = &m_instructions[m_propertyAccessInstructions[i]];
+        if (vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_chain) || vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_getter_chain) || vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_custom_chain))
+            markStack.append(&vPC[5].u.structureChain);
+        else if (vPC[0].u.opcode == interpreter->getOpcode(op_put_by_id_transition))
+            markStack.append(&vPC[6].u.structureChain);
+    }
+#endif
+#if ENABLE(JIT)
+    for (size_t size = m_structureStubInfos.size(), i = 0; i < size; ++i)
+        m_structureStubInfos[i].markAggregate(markStack);
+#endif
 }
 
 HandlerInfo* CodeBlock::handlerForBytecodeOffset(unsigned bytecodeOffset)
@@ -1671,7 +1673,6 @@ void CodeBlock::shrinkToFit()
     m_structureStubInfos.shrinkToFit();
     m_globalResolveInfos.shrinkToFit();
     m_callLinkInfos.shrinkToFit();
-    m_linkedCallerList.shrinkToFit();
 #endif
 
     m_identifiers.shrinkToFit();
diff --git a/Source/JavaScriptCore/bytecode/CodeBlock.h b/Source/JavaScriptCore/bytecode/CodeBlock.h
index bef4561..25e65f4 100644
--- a/Source/JavaScriptCore/bytecode/CodeBlock.h
+++ b/Source/JavaScriptCore/bytecode/CodeBlock.h
@@ -96,21 +96,17 @@ namespace JSC {
 #if ENABLE(JIT)
     struct CallLinkInfo {
         CallLinkInfo()
-            : callee(0)
-            , position(0)
-            , hasSeenShouldRepatch(0)
+            : hasSeenShouldRepatch(false)
         {
         }
 
         CodeLocationNearCall callReturnLocation;
         CodeLocationDataLabelPtr hotPathBegin;
         CodeLocationNearCall hotPathOther;
-        CodeBlock* ownerCodeBlock;
-        CodeBlock* callee;
-        unsigned position : 31;
-        unsigned hasSeenShouldRepatch : 1;
+        WriteBarrier<JSFunction> callee;
+        bool hasSeenShouldRepatch;
         
-        void setUnlinked() { callee = 0; }
+        void setUnlinked() { callee.clear(); }
         bool isLinked() { return callee; }
 
         bool seenOnce()
@@ -183,7 +179,7 @@ namespace JSC {
         unsigned bytecodeOffset;
     };
 
-    // valueAtPosition helpers for the binaryChop algorithm below.
+    // valueAtPosition helpers for the binarySearch algorithm.
 
     inline void* getStructureStubInfoReturnLocation(StructureStubInfo* structureStubInfo)
     {
@@ -204,42 +200,6 @@ namespace JSC {
     {
         return pc->callReturnOffset;
     }
-
-    // Binary chop algorithm, calls valueAtPosition on pre-sorted elements in array,
-    // compares result with key (KeyTypes should be comparable with '--', '<', '>').
-    // Optimized for cases where the array contains the key, checked by assertions.
-    template<typename ArrayType, typename KeyType, KeyType(*valueAtPosition)(ArrayType*)>
-    inline ArrayType* binaryChop(ArrayType* array, size_t size, KeyType key)
-    {
-        // The array must contain at least one element (pre-condition, array does conatin key).
-        // If the array only contains one element, no need to do the comparison.
-        while (size > 1) {
-            // Pick an element to check, half way through the array, and read the value.
-            int pos = (size - 1) >> 1;
-            KeyType val = valueAtPosition(&array[pos]);
-            
-            // If the key matches, success!
-            if (val == key)
-                return &array[pos];
-            // The item we are looking for is smaller than the item being check; reduce the value of 'size',
-            // chopping off the right hand half of the array.
-            else if (key < val)
-                size = pos;
-            // Discard all values in the left hand half of the array, up to and including the item at pos.
-            else {
-                size -= (pos + 1);
-                array += (pos + 1);
-            }
-
-            // 'size' should never reach zero.
-            ASSERT(size);
-        }
-        
-        // If we reach this point we've chopped down to one element, no need to check it matches
-        ASSERT(size == 1);
-        ASSERT(key == valueAtPosition(&array[0]));
-        return &array[0];
-    }
 #endif
 
     class CodeBlock {
@@ -248,7 +208,7 @@ namespace JSC {
     protected:
         CodeBlock(ScriptExecutable* ownerExecutable, CodeType, JSGlobalObject*, PassRefPtr<SourceProvider>, unsigned sourceOffset, SymbolTable* symbolTable, bool isConstructor);
 
-        DeprecatedPtr<JSGlobalObject> m_globalObject;
+        WriteBarrier<JSGlobalObject> m_globalObject;
         Heap* m_heap;
 
     public:
@@ -257,9 +217,6 @@ namespace JSC {
         void markAggregate(MarkStack&);
         void refStructures(Instruction* vPC) const;
         void derefStructures(Instruction* vPC) const;
-#if ENABLE(JIT_OPTIMIZE_CALL)
-        void unlinkCallers();
-#endif
 
         static void dumpStatistics();
 
@@ -292,38 +249,20 @@ namespace JSC {
         void expressionRangeForBytecodeOffset(unsigned bytecodeOffset, int& divot, int& startOffset, int& endOffset);
 
 #if ENABLE(JIT)
-        void addCaller(CallLinkInfo* caller)
-        {
-            caller->callee = this;
-            caller->position = m_linkedCallerList.size();
-            m_linkedCallerList.append(caller);
-        }
-
-        void removeCaller(CallLinkInfo* caller)
-        {
-            unsigned pos = caller->position;
-            unsigned lastPos = m_linkedCallerList.size() - 1;
-
-            if (pos != lastPos) {
-                m_linkedCallerList[pos] = m_linkedCallerList[lastPos];
-                m_linkedCallerList[pos]->position = pos;
-            }
-            m_linkedCallerList.shrink(lastPos);
-        }
 
         StructureStubInfo& getStubInfo(ReturnAddressPtr returnAddress)
         {
-            return *(binaryChop<StructureStubInfo, void*, getStructureStubInfoReturnLocation>(m_structureStubInfos.begin(), m_structureStubInfos.size(), returnAddress.value()));
+            return *(binarySearch<StructureStubInfo, void*, getStructureStubInfoReturnLocation>(m_structureStubInfos.begin(), m_structureStubInfos.size(), returnAddress.value()));
         }
 
         CallLinkInfo& getCallLinkInfo(ReturnAddressPtr returnAddress)
         {
-            return *(binaryChop<CallLinkInfo, void*, getCallLinkInfoReturnLocation>(m_callLinkInfos.begin(), m_callLinkInfos.size(), returnAddress.value()));
+            return *(binarySearch<CallLinkInfo, void*, getCallLinkInfoReturnLocation>(m_callLinkInfos.begin(), m_callLinkInfos.size(), returnAddress.value()));
         }
 
         MethodCallLinkInfo& getMethodCallLinkInfo(ReturnAddressPtr returnAddress)
         {
-            return *(binaryChop<MethodCallLinkInfo, void*, getMethodCallLinkInfoReturnLocation>(m_methodCallLinkInfos.begin(), m_methodCallLinkInfos.size(), returnAddress.value()));
+            return *(binarySearch<MethodCallLinkInfo, void*, getMethodCallLinkInfoReturnLocation>(m_methodCallLinkInfos.begin(), m_methodCallLinkInfos.size(), returnAddress.value()));
         }
 
         unsigned bytecodeOffset(ReturnAddressPtr returnAddress)
@@ -333,7 +272,7 @@ namespace JSC {
             Vector<CallReturnOffsetToBytecodeOffset>& callIndices = m_rareData->m_callReturnIndexVector;
             if (!callIndices.size())
                 return 1;
-            return binaryChop<CallReturnOffsetToBytecodeOffset, unsigned, getCallReturnOffset>(callIndices.begin(), callIndices.size(), getJITCode().offsetOf(returnAddress.value()))->bytecodeOffset;
+            return binarySearch<CallReturnOffsetToBytecodeOffset, unsigned, getCallReturnOffset>(callIndices.begin(), callIndices.size(), getJITCode().offsetOf(returnAddress.value()))->bytecodeOffset;
         }
 #endif
 #if ENABLE(INTERPRETER)
@@ -359,7 +298,7 @@ namespace JSC {
         ExecutablePool* executablePool() { return getJITCode().getExecutablePool(); }
 #endif
 
-        ScriptExecutable* ownerExecutable() const { return m_ownerExecutable; }
+        ScriptExecutable* ownerExecutable() const { return m_ownerExecutable.get(); }
 
         void setGlobalData(JSGlobalData* globalData) { m_globalData = globalData; }
 
@@ -451,6 +390,8 @@ namespace JSC {
 
         bool hasExpressionInfo() { return m_rareData && m_rareData->m_expressionInfo.size(); }
         bool hasLineInfo() { return m_rareData && m_rareData->m_lineInfo.size(); }
+        //  We only generate exception handling info if the user is debugging
+        // (and may want line number info), or if the function contains exception handler.
         bool needsCallReturnIndices()
         {
             return m_rareData &&
@@ -472,18 +413,34 @@ namespace JSC {
         Identifier& identifier(int index) { return m_identifiers[index]; }
 
         size_t numberOfConstantRegisters() const { return m_constantRegisters.size(); }
-        void addConstantRegister(const Register& r) { return m_constantRegisters.append(r); }
-        Register& constantRegister(int index) { return m_constantRegisters[index - FirstConstantRegisterIndex]; }
+        void addConstant(JSValue v)
+        {
+            m_constantRegisters.append(WriteBarrier<Unknown>());
+            m_constantRegisters.last().set(m_globalObject->globalData(), m_ownerExecutable.get(), v);
+        }
+        WriteBarrier<Unknown>& constantRegister(int index) { return m_constantRegisters[index - FirstConstantRegisterIndex]; }
         ALWAYS_INLINE bool isConstantRegisterIndex(int index) const { return index >= FirstConstantRegisterIndex; }
-        ALWAYS_INLINE JSValue getConstant(int index) const { return m_constantRegisters[index - FirstConstantRegisterIndex].jsValue(); }
+        ALWAYS_INLINE JSValue getConstant(int index) const { return m_constantRegisters[index - FirstConstantRegisterIndex].get(); }
 
-        unsigned addFunctionDecl(NonNullPassRefPtr<FunctionExecutable> n) { unsigned size = m_functionDecls.size(); m_functionDecls.append(n); return size; }
+        unsigned addFunctionDecl(FunctionExecutable* n)
+        {
+            unsigned size = m_functionDecls.size();
+            m_functionDecls.append(WriteBarrier<FunctionExecutable>());
+            m_functionDecls.last().set(m_globalObject->globalData(), m_ownerExecutable.get(), n);
+            return size;
+        }
         FunctionExecutable* functionDecl(int index) { return m_functionDecls[index].get(); }
         int numberOfFunctionDecls() { return m_functionDecls.size(); }
-        unsigned addFunctionExpr(NonNullPassRefPtr<FunctionExecutable> n) { unsigned size = m_functionExprs.size(); m_functionExprs.append(n); return size; }
+        unsigned addFunctionExpr(FunctionExecutable* n)
+        {
+            unsigned size = m_functionExprs.size();
+            m_functionExprs.append(WriteBarrier<FunctionExecutable>());
+            m_functionExprs.last().set(m_globalObject->globalData(), m_ownerExecutable.get(), n);
+            return size;
+        }
         FunctionExecutable* functionExpr(int index) { return m_functionExprs[index].get(); }
 
-        unsigned addRegExp(RegExp* r) { createRareDataIfNecessary(); unsigned size = m_rareData->m_regexps.size(); m_rareData->m_regexps.append(r); return size; }
+        unsigned addRegExp(PassRefPtr<RegExp> r) { createRareDataIfNecessary(); unsigned size = m_rareData->m_regexps.size(); m_rareData->m_regexps.append(r); return size; }
         RegExp* regexp(int index) const { ASSERT(m_rareData); return m_rareData->m_regexps[index].get(); }
 
         JSGlobalObject* globalObject() { return m_globalObject.get(); }
@@ -536,7 +493,7 @@ namespace JSC {
                 m_rareData = adoptPtr(new RareData);
         }
 
-        ScriptExecutable* m_ownerExecutable;
+        WriteBarrier<ScriptExecutable> m_ownerExecutable;
         JSGlobalData* m_globalData;
 
         Vector<Instruction> m_instructions;
@@ -567,16 +524,16 @@ namespace JSC {
         Vector<GlobalResolveInfo> m_globalResolveInfos;
         Vector<CallLinkInfo> m_callLinkInfos;
         Vector<MethodCallLinkInfo> m_methodCallLinkInfos;
-        Vector<CallLinkInfo*> m_linkedCallerList;
 #endif
 
         Vector<unsigned> m_jumpTargets;
 
         // Constant Pool
         Vector<Identifier> m_identifiers;
-        Vector<Register> m_constantRegisters;
-        Vector<RefPtr<FunctionExecutable> > m_functionDecls;
-        Vector<RefPtr<FunctionExecutable> > m_functionExprs;
+        COMPILE_ASSERT(sizeof(Register) == sizeof(WriteBarrier<Unknown>), Register_must_be_same_size_as_WriteBarrier_Unknown);
+        Vector<WriteBarrier<Unknown> > m_constantRegisters;
+        Vector<WriteBarrier<FunctionExecutable> > m_functionDecls;
+        Vector<WriteBarrier<FunctionExecutable> > m_functionExprs;
 
         SymbolTable* m_symbolTable;
 
@@ -617,12 +574,6 @@ namespace JSC {
         GlobalCodeBlock(ScriptExecutable* ownerExecutable, CodeType codeType, JSGlobalObject* globalObject, PassRefPtr<SourceProvider> sourceProvider, unsigned sourceOffset)
             : CodeBlock(ownerExecutable, codeType, globalObject, sourceProvider, sourceOffset, &m_unsharedSymbolTable, false)
         {
-            m_heap->codeBlocks().add(this);
-        }
-
-        ~GlobalCodeBlock()
-        {
-            m_heap->codeBlocks().remove(this);
         }
 
     private:
@@ -680,7 +631,7 @@ namespace JSC {
     {
         CodeBlock* codeBlock = this->codeBlock();
         if (codeBlock->isConstantRegisterIndex(index))
-            return codeBlock->constantRegister(index);
+            return *reinterpret_cast<Register*>(&codeBlock->constantRegister(index));
         return this[index];
     }
 
diff --git a/Source/JavaScriptCore/bytecode/EvalCodeCache.h b/Source/JavaScriptCore/bytecode/EvalCodeCache.h
index edd575f..3e450b1 100644
--- a/Source/JavaScriptCore/bytecode/EvalCodeCache.h
+++ b/Source/JavaScriptCore/bytecode/EvalCodeCache.h
@@ -41,14 +41,16 @@
 
 namespace JSC {
 
+    class MarkStack;
+
     class EvalCodeCache {
     public:
-        PassRefPtr<EvalExecutable> get(ExecState* exec, bool inStrictContext, const UString& evalSource, ScopeChainNode* scopeChain, JSValue& exceptionValue)
+        EvalExecutable* get(ExecState* exec, ScriptExecutable* owner, bool inStrictContext, const UString& evalSource, ScopeChainNode* scopeChain, JSValue& exceptionValue)
         {
-            RefPtr<EvalExecutable> evalExecutable;
+            EvalExecutable* evalExecutable = 0;
 
             if (!inStrictContext && evalSource.length() < maxCacheableSourceLength && (*scopeChain->begin())->isVariableObject())
-                evalExecutable = m_cacheMap.get(evalSource.impl());
+                evalExecutable = m_cacheMap.get(evalSource.impl()).get();
 
             if (!evalExecutable) {
                 evalExecutable = EvalExecutable::create(exec, makeSource(evalSource), inStrictContext);
@@ -57,19 +59,21 @@ namespace JSC {
                     return 0;
 
                 if (!inStrictContext && evalSource.length() < maxCacheableSourceLength && (*scopeChain->begin())->isVariableObject() && m_cacheMap.size() < maxCacheEntries)
-                    m_cacheMap.set(evalSource.impl(), evalExecutable);
+                    m_cacheMap.set(evalSource.impl(), WriteBarrier<EvalExecutable>(exec->globalData(), owner, evalExecutable));
             }
 
-            return evalExecutable.release();
+            return evalExecutable;
         }
 
         bool isEmpty() const { return m_cacheMap.isEmpty(); }
 
+        void markAggregate(MarkStack&);
+
     private:
         static const unsigned maxCacheableSourceLength = 256;
         static const int maxCacheEntries = 64;
 
-        typedef HashMap<RefPtr<StringImpl>, RefPtr<EvalExecutable> > EvalCacheMap;
+        typedef HashMap<RefPtr<StringImpl>, WriteBarrier<EvalExecutable> > EvalCacheMap;
         EvalCacheMap m_cacheMap;
     };
 
diff --git a/Source/JavaScriptCore/bytecode/Instruction.h b/Source/JavaScriptCore/bytecode/Instruction.h
index f077cbf..da0821d 100644
--- a/Source/JavaScriptCore/bytecode/Instruction.h
+++ b/Source/JavaScriptCore/bytecode/Instruction.h
@@ -63,7 +63,7 @@ namespace JSC {
             Structure* base;
             union {
                 Structure* proto;
-                StructureChain* chain;
+                WriteBarrierBase<StructureChain> chain;
             } u;
 
             void set(PolymorphicAccessStructureListStubRoutineType _stubRoutine, Structure* _base)
@@ -82,11 +82,11 @@ namespace JSC {
                 isChain = false;
             }
             
-            void set(PolymorphicAccessStructureListStubRoutineType _stubRoutine, Structure* _base, StructureChain* _chain)
+            void set(JSGlobalData& globalData, JSCell* owner, PolymorphicAccessStructureListStubRoutineType _stubRoutine, Structure* _base, StructureChain* _chain)
             {
                 stubRoutine = _stubRoutine;
                 base = _base;
-                u.chain = _chain;
+                u.chain.set(globalData, owner, _chain);
                 isChain = true;
             }
         } list[POLYMORPHIC_LIST_CACHE_SIZE];
@@ -101,9 +101,9 @@ namespace JSC {
             list[0].set(stubRoutine, firstBase, firstProto);
         }
 
-        PolymorphicAccessStructureList(PolymorphicAccessStructureListStubRoutineType stubRoutine, Structure* firstBase, StructureChain* firstChain)
+        PolymorphicAccessStructureList(JSGlobalData& globalData, JSCell* owner, PolymorphicAccessStructureListStubRoutineType stubRoutine, Structure* firstBase, StructureChain* firstChain)
         {
-            list[0].set(stubRoutine, firstBase, firstChain);
+            list[0].set(globalData, owner, stubRoutine, firstBase, firstChain);
         }
 
         void derefStructures(int count)
@@ -115,13 +115,22 @@ namespace JSC {
                 info.base->deref();
 
                 if (info.u.proto) {
-                    if (info.isChain)
-                        info.u.chain->deref();
-                    else
+                    if (!info.isChain)
                         info.u.proto->deref();
                 }
             }
         }
+
+        void markAggregate(MarkStack& markStack, int count)
+        {
+            for (int i = 0; i < count; ++i) {
+                PolymorphicStubInfo& info = list[i];
+                ASSERT(info.base);
+                
+                if (info.u.proto && info.isChain)
+                    markStack.append(&info.u.chain);
+            }
+        }
     };
 
     struct Instruction {
@@ -130,7 +139,7 @@ namespace JSC {
 #if !ENABLE(COMPUTED_GOTO_INTERPRETER)
             // We have to initialize one of the pointer members to ensure that
             // the entire struct is initialized, when opcode is not a pointer.
-            u.jsCell = 0;
+            u.jsCell.clear();
 #endif
             u.opcode = opcode;
         }
@@ -139,13 +148,21 @@ namespace JSC {
         {
             // We have to initialize one of the pointer members to ensure that
             // the entire struct is initialized in 64-bit.
-            u.jsCell = 0;
+            u.jsCell.clear();
             u.operand = operand;
         }
 
         Instruction(Structure* structure) { u.structure = structure; }
-        Instruction(StructureChain* structureChain) { u.structureChain = structureChain; }
-        Instruction(JSCell* jsCell) { u.jsCell = jsCell; }
+        Instruction(JSGlobalData& globalData, JSCell* owner, StructureChain* structureChain)
+        {
+            u.structureChain.clear();
+            u.structureChain.set(globalData, owner, structureChain);
+        }
+        Instruction(JSGlobalData& globalData, JSCell* owner, JSCell* jsCell)
+        {
+            u.jsCell.clear();
+            u.jsCell.set(globalData, owner, jsCell);
+        }
         Instruction(PolymorphicAccessStructureList* polymorphicStructures) { u.polymorphicStructures = polymorphicStructures; }
         Instruction(PropertySlot::GetValueFunc getterFunc) { u.getterFunc = getterFunc; }
 
@@ -153,8 +170,8 @@ namespace JSC {
             Opcode opcode;
             int operand;
             Structure* structure;
-            StructureChain* structureChain;
-            JSCell* jsCell;
+            WriteBarrierBase<StructureChain> structureChain;
+            WriteBarrierBase<JSCell> jsCell;
             PolymorphicAccessStructureList* polymorphicStructures;
             PropertySlot::GetValueFunc getterFunc;
         } u;
diff --git a/Source/JavaScriptCore/bytecode/SamplingTool.h b/Source/JavaScriptCore/bytecode/SamplingTool.h
index 9ca54da..a0696b1 100644
--- a/Source/JavaScriptCore/bytecode/SamplingTool.h
+++ b/Source/JavaScriptCore/bytecode/SamplingTool.h
@@ -95,8 +95,8 @@ namespace JSC {
     struct Instruction;
 
     struct ScriptSampleRecord {
-        ScriptSampleRecord(ScriptExecutable* executable)
-            : m_executable(executable)
+        ScriptSampleRecord(JSGlobalData& globalData, ScriptExecutable* executable)
+            : m_executable(globalData, executable)
             , m_codeBlock(0)
             , m_sampleCount(0)
             , m_opcodeSampleCount(0)
@@ -113,7 +113,7 @@ namespace JSC {
         
         void sample(CodeBlock*, Instruction*);
 
-        RefPtr<ScriptExecutable> m_executable;
+        Global<ScriptExecutable> m_executable;
         CodeBlock* m_codeBlock;
         int m_sampleCount;
         int m_opcodeSampleCount;
@@ -280,7 +280,6 @@ namespace JSC {
     // Implements a named set of counters, printed on exit if ENABLE(SAMPLING_COUNTERS).
     // See subclasses below, SamplingCounter, GlobalSamplingCounter and DeletableSamplingCounter.
     class AbstractSamplingCounter {
-        friend class JIT;
         friend class DeletableSamplingCounter;
     public:
         void count(uint32_t count = 1)
@@ -290,6 +289,8 @@ namespace JSC {
 
         static void dump();
 
+        int64_t* addressOfCounter() { return &m_counter; }
+
     protected:
         // Effectively the contructor, however called lazily in the case of GlobalSamplingCounter.
         void init(const char* name)
diff --git a/Source/JavaScriptCore/bytecode/StructureStubInfo.cpp b/Source/JavaScriptCore/bytecode/StructureStubInfo.cpp
index 5ec2a3f..4d59ac1 100644
--- a/Source/JavaScriptCore/bytecode/StructureStubInfo.cpp
+++ b/Source/JavaScriptCore/bytecode/StructureStubInfo.cpp
@@ -26,6 +26,7 @@
 #include "config.h"
 #include "StructureStubInfo.h"
 
+#include "JSObject.h"
 #include "ScopeChain.h"
 
 namespace JSC {
@@ -43,7 +44,6 @@ void StructureStubInfo::deref()
         return;
     case access_get_by_id_chain:
         u.getByIdChain.baseObjectStructure->deref();
-        u.getByIdChain.chain->deref();
         return;
     case access_get_by_id_self_list: {
         PolymorphicAccessStructureList* polymorphicStructures = u.getByIdSelfList.structureList;
@@ -60,7 +60,6 @@ void StructureStubInfo::deref()
     case access_put_by_id_transition:
         u.putByIdTransition.previousStructure->deref();
         u.putByIdTransition.structure->deref();
-        u.putByIdTransition.chain->deref();
         return;
     case access_put_by_id_replace:
         u.putByIdReplace.baseObjectStructure->deref();
@@ -77,6 +76,42 @@ void StructureStubInfo::deref()
         ASSERT_NOT_REACHED();
     }
 }
+
+void StructureStubInfo::markAggregate(MarkStack& markStack)
+{
+    switch (accessType) {
+    case access_get_by_id_self:
+        return;
+    case access_get_by_id_proto:
+        return;
+    case access_get_by_id_chain:
+        return;
+    case access_get_by_id_self_list: {
+        PolymorphicAccessStructureList* polymorphicStructures = u.getByIdSelfList.structureList;
+        polymorphicStructures->markAggregate(markStack, u.getByIdSelfList.listSize);
+        return;
+    }
+    case access_get_by_id_proto_list: {
+        PolymorphicAccessStructureList* polymorphicStructures = u.getByIdProtoList.structureList;
+        polymorphicStructures->markAggregate(markStack, u.getByIdProtoList.listSize);
+        return;
+    }
+    case access_put_by_id_transition:
+        return;
+    case access_put_by_id_replace:
+        return;
+    case access_get_by_id:
+    case access_put_by_id:
+    case access_get_by_id_generic:
+    case access_put_by_id_generic:
+    case access_get_array_length:
+    case access_get_string_length:
+        // These instructions don't ref their Structures.
+        return;
+    default:
+        ASSERT_NOT_REACHED();
+    }
+}
 #endif
 
 } // namespace JSC
diff --git a/Source/JavaScriptCore/bytecode/StructureStubInfo.h b/Source/JavaScriptCore/bytecode/StructureStubInfo.h
index 8e2c489..28202f9 100644
--- a/Source/JavaScriptCore/bytecode/StructureStubInfo.h
+++ b/Source/JavaScriptCore/bytecode/StructureStubInfo.h
@@ -85,7 +85,6 @@ namespace JSC {
             baseObjectStructure->ref();
 
             u.getByIdChain.chain = chain;
-            chain->ref();
         }
 
         void initGetByIdSelfList(PolymorphicAccessStructureList* structureList, int listSize)
@@ -117,7 +116,6 @@ namespace JSC {
             structure->ref();
 
             u.putByIdTransition.chain = chain;
-            chain->ref();
         }
 
         void initPutByIdReplace(Structure* baseObjectStructure)
@@ -129,6 +127,7 @@ namespace JSC {
         }
 
         void deref();
+        void markAggregate(MarkStack&);
 
         bool seenOnce()
         {
diff --git a/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp b/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp
index 08f4bd4..5af3420 100644
--- a/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp
+++ b/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp
@@ -224,8 +224,6 @@ BytecodeGenerator::BytecodeGenerator(ProgramNode* programNode, ScopeChainNode* s
 #endif
     , m_stack(m_globalData->stack())
     , m_usesExceptions(false)
-    , m_regeneratingForExceptionInfo(false)
-    , m_codeBlockBeingRegeneratedFrom(0)
     , m_expressionTooDeep(false)
 {
     if (m_shouldEmitDebugHooks)
@@ -250,7 +248,7 @@ BytecodeGenerator::BytecodeGenerator(ProgramNode* programNode, ScopeChainNode* s
     SymbolTable::iterator end = symbolTable->end();
     for (SymbolTable::iterator it = symbolTable->begin(); it != end; ++it)
         registerFor(it->second.getIndex()).setIndex(it->second.getIndex() + m_globalVarStorageOffset);
-        
+
     BatchedTransitionOptimizer optimizer(*m_globalData, globalObject);
 
     const VarStack& varStack = programNode->varStack();
@@ -260,27 +258,49 @@ BytecodeGenerator::BytecodeGenerator(ProgramNode* programNode, ScopeChainNode* s
         // Shift new symbols so they get stored prior to existing symbols.
         m_nextGlobalIndex -= symbolTable->size();
 
-        size_t oldSymbolTableSize = symbolTable->size();
-
+        HashSet<StringImpl*, IdentifierRepHash> newGlobals;
+        Vector<std::pair<int, bool>, 16> functionInfo(functionStack.size());
         for (size_t i = 0; i < functionStack.size(); ++i) {
             FunctionBodyNode* function = functionStack[i];
             globalObject->removeDirect(function->ident()); // Make sure our new function is not shadowed by an old property.
-            emitNewFunction(addGlobalVar(function->ident(), false), function);
+            SymbolTableEntry entry = symbolTable->inlineGet(function->ident().impl());
+            
+            if (entry.isNull())
+                newGlobals.add(function->ident().impl());
+            functionInfo[i] = make_pair(entry.getIndex(), entry.isReadOnly());
         }
-
-        Vector<RegisterID*, 32> newVars;
+        
+        Vector<bool, 16> shouldCreateVar(varStack.size());
         for (size_t i = 0; i < varStack.size(); ++i) {
-            if (globalObject->symbolTableHasProperty(*varStack[i].first) || globalObject->hasProperty(exec, *varStack[i].first))
+            if (newGlobals.contains(varStack[i].first->impl()) || globalObject->hasProperty(exec, *varStack[i].first)) {
+                shouldCreateVar[i] = false;
                 continue;
-            newVars.append(addGlobalVar(*varStack[i].first, varStack[i].second & DeclarationStacks::IsConstant));
+            }
+            shouldCreateVar[i] = true;
+            newGlobals.add(varStack[i].first->impl());
         }
 
-        globalObject->resizeRegisters(oldSymbolTableSize, symbolTable->size());
+        int expectedSize = symbolTable->size() + newGlobals.size();
+        globalObject->resizeRegisters(symbolTable->size(), expectedSize);
+    
+        for (size_t i = 0; i < functionStack.size(); ++i) {
+            FunctionBodyNode* function = functionStack[i];
+            if (functionInfo[i].second)
+                continue;
+            RegisterID* dst = addGlobalVar(function->ident(), false);
+            JSValue value = new (exec) JSFunction(exec, makeFunction(exec, function), scopeChain);
+            globalObject->registerAt(dst->index() - m_globalVarStorageOffset).set(*m_globalData, globalObject, value);
+        }
 
-        preserveLastVar();
+        for (size_t i = 0; i < varStack.size(); ++i) {
+            if (!shouldCreateVar[i])
+                continue;
+            addGlobalVar(*varStack[i].first, varStack[i].second & DeclarationStacks::IsConstant);
+        }
+        if (symbolTable->size() != expectedSize)
+            CRASH();
 
-        for (size_t i = 0; i < newVars.size(); ++i)
-            emitLoad(newVars[i], jsUndefined());
+        preserveLastVar();
     } else {
         for (size_t i = 0; i < functionStack.size(); ++i) {
             FunctionBodyNode* function = functionStack[i];
@@ -325,8 +345,6 @@ BytecodeGenerator::BytecodeGenerator(FunctionBodyNode* functionBody, ScopeChainN
 #endif
     , m_stack(m_globalData->stack())
     , m_usesExceptions(false)
-    , m_regeneratingForExceptionInfo(false)
-    , m_codeBlockBeingRegeneratedFrom(0)
     , m_expressionTooDeep(false)
 {
     if (m_shouldEmitDebugHooks)
@@ -491,8 +509,6 @@ BytecodeGenerator::BytecodeGenerator(EvalNode* evalNode, ScopeChainNode* scopeCh
 #endif
     , m_stack(m_globalData->stack())
     , m_usesExceptions(false)
-    , m_regeneratingForExceptionInfo(false)
-    , m_codeBlockBeingRegeneratedFrom(0)
     , m_expressionTooDeep(false)
 {
     if (m_shouldEmitDebugHooks || m_baseScopeDepth)
@@ -909,7 +925,7 @@ PassRefPtr<Label> BytecodeGenerator::emitJumpIfNotFunctionCall(RegisterID* cond,
 
     emitOpcode(op_jneq_ptr);
     instructions().append(cond->index());
-    instructions().append(m_scopeChain->globalObject->d()->callFunction.get());
+    instructions().append(Instruction(*m_globalData, m_codeBlock->ownerExecutable(), m_scopeChain->globalObject->callFunction()));
     instructions().append(target->bind(begin, instructions().size()));
     return target;
 }
@@ -920,7 +936,7 @@ PassRefPtr<Label> BytecodeGenerator::emitJumpIfNotFunctionApply(RegisterID* cond
 
     emitOpcode(op_jneq_ptr);
     instructions().append(cond->index());
-    instructions().append(m_scopeChain->globalObject->d()->applyFunction.get());
+    instructions().append(Instruction(*m_globalData, m_codeBlock->ownerExecutable(), m_scopeChain->globalObject->applyFunction()));
     instructions().append(target->bind(begin, instructions().size()));
     return target;
 }
@@ -943,14 +959,14 @@ RegisterID* BytecodeGenerator::addConstantValue(JSValue v)
     if (result.second) {
         m_constantPoolRegisters.append(FirstConstantRegisterIndex + m_nextConstantOffset);
         ++m_nextConstantOffset;
-        m_codeBlock->addConstantRegister(JSValue(v));
+        m_codeBlock->addConstant(JSValue(v));
     } else
         index = result.first->second;
 
     return &m_constantPoolRegisters[index];
 }
 
-unsigned BytecodeGenerator::addRegExp(RegExp* r)
+unsigned BytecodeGenerator::addRegExp(PassRefPtr<RegExp> r)
 {
     return m_codeBlock->addRegExp(r);
 }
@@ -1026,8 +1042,8 @@ RegisterID* BytecodeGenerator::emitEqualityOp(OpcodeID opcodeID, RegisterID* dst
         if (src1->index() == dstIndex
             && src1->isTemporary()
             && m_codeBlock->isConstantRegisterIndex(src2->index())
-            && m_codeBlock->constantRegister(src2->index()).jsValue().isString()) {
-            const UString& value = asString(m_codeBlock->constantRegister(src2->index()).jsValue())->tryGetValue();
+            && m_codeBlock->constantRegister(src2->index()).get().isString()) {
+            const UString& value = asString(m_codeBlock->constantRegister(src2->index()).get())->tryGetValue();
             if (value == "undefined") {
                 rewindUnaryOp();
                 emitOpcode(op_is_undefined);
@@ -1201,13 +1217,6 @@ RegisterID* BytecodeGenerator::emitResolve(RegisterID* dst, const Identifier& pr
 
     if (globalObject) {
         bool forceGlobalResolve = false;
-        if (m_regeneratingForExceptionInfo) {
-#if ENABLE(JIT)
-            forceGlobalResolve = m_codeBlockBeingRegeneratedFrom->hasGlobalResolveInfoAtBytecodeOffset(instructions().size());
-#else
-            forceGlobalResolve = m_codeBlockBeingRegeneratedFrom->hasGlobalResolveInstructionAtBytecodeOffset(instructions().size());
-#endif
-        }
 
         if (index != missingSymbolMarker() && !forceGlobalResolve && !requiresDynamicChecks) {
             // Directly index the property lookup across multiple scopes.
@@ -1344,13 +1353,6 @@ RegisterID* BytecodeGenerator::emitResolveWithBase(RegisterID* baseDst, Register
     }
 
     bool forceGlobalResolve = false;
-    if (m_regeneratingForExceptionInfo) {
-#if ENABLE(JIT)
-        forceGlobalResolve = m_codeBlockBeingRegeneratedFrom->hasGlobalResolveInfoAtBytecodeOffset(instructions().size());
-#else
-        forceGlobalResolve = m_codeBlockBeingRegeneratedFrom->hasGlobalResolveInstructionAtBytecodeOffset(instructions().size());
-#endif
-    }
 
     // Global object is the base
     emitLoad(baseDst, JSValue(globalObject));
@@ -1584,7 +1586,7 @@ RegisterID* BytecodeGenerator::emitNewFunctionInternal(RegisterID* dst, unsigned
     return dst;
 }
 
-RegisterID* BytecodeGenerator::emitNewRegExp(RegisterID* dst, RegExp* regExp)
+RegisterID* BytecodeGenerator::emitNewRegExp(RegisterID* dst, PassRefPtr<RegExp> regExp)
 {
     emitOpcode(op_new_regexp);
     instructions().append(dst->index());
diff --git a/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h b/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h
index b3851c7..3a40390 100644
--- a/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h
+++ b/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h
@@ -291,7 +291,7 @@ namespace JSC {
         RegisterID* emitLazyNewFunction(RegisterID* dst, FunctionBodyNode* body);
         RegisterID* emitNewFunctionInternal(RegisterID* dst, unsigned index, bool shouldNullCheck);
         RegisterID* emitNewFunctionExpression(RegisterID* dst, FuncExprNode* func);
-        RegisterID* emitNewRegExp(RegisterID* dst, RegExp* regExp);
+        RegisterID* emitNewRegExp(RegisterID* dst, PassRefPtr<RegExp> regExp);
 
         RegisterID* emitMove(RegisterID* dst, RegisterID* src);
 
@@ -396,12 +396,6 @@ namespace JSC {
 
         CodeType codeType() const { return m_codeType; }
 
-        void setRegeneratingForExceptionInfo(CodeBlock* originalCodeBlock)
-        {
-            m_regeneratingForExceptionInfo = true;
-            m_codeBlockBeingRegeneratedFrom = originalCodeBlock;
-        }
-
         bool shouldEmitProfileHooks() { return m_shouldEmitProfileHooks; }
         
         bool isStrictMode() const { return m_codeBlock->isStrictMode(); }
@@ -481,14 +475,14 @@ namespace JSC {
 
         unsigned addConstant(const Identifier&);
         RegisterID* addConstantValue(JSValue);
-        unsigned addRegExp(RegExp*);
+        unsigned addRegExp(PassRefPtr<RegExp>);
 
-        PassRefPtr<FunctionExecutable> makeFunction(ExecState* exec, FunctionBodyNode* body)
+        FunctionExecutable* makeFunction(ExecState* exec, FunctionBodyNode* body)
         {
             return FunctionExecutable::create(exec, body->ident(), body->source(), body->usesArguments(), body->parameters(), body->isStrictMode(), body->lineNo(), body->lastLine());
         }
 
-        PassRefPtr<FunctionExecutable> makeFunction(JSGlobalData* globalData, FunctionBodyNode* body)
+        FunctionExecutable* makeFunction(JSGlobalData* globalData, FunctionBodyNode* body)
         {
             return FunctionExecutable::create(globalData, body->ident(), body->source(), body->usesArguments(), body->parameters(), body->isStrictMode(), body->lineNo(), body->lastLine());
         }
@@ -577,8 +571,6 @@ namespace JSC {
         StackBounds m_stack;
 
         bool m_usesExceptions;
-        bool m_regeneratingForExceptionInfo;
-        CodeBlock* m_codeBlockBeingRegeneratedFrom;
         bool m_expressionTooDeep;
     };
 
diff --git a/Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp b/Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp
index 2875434..03578cf 100644
--- a/Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp
+++ b/Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp
@@ -125,9 +125,8 @@ RegisterID* RegExpNode::emitBytecode(BytecodeGenerator& generator, RegisterID* d
 {
     if (dst == generator.ignoredResult())
         return 0;
-    RefPtr<RegExp> regExp = generator.globalData()->regExpCache()->lookupOrCreate(m_pattern.ustring(), m_flags.ustring());
-    ASSERT(regExp->isValid());
-    return generator.emitNewRegExp(generator.finalDestination(dst), regExp.get());
+    return generator.emitNewRegExp(generator.finalDestination(dst),
+        generator.globalData()->regExpCache()->lookupOrCreate(m_pattern.ustring(), regExpFlags(m_flags.ustring())));
 }
 
 // ------------------------------ ThisNode -------------------------------------
diff --git a/Source/JavaScriptCore/collector/handles/Handle.h b/Source/JavaScriptCore/collector/handles/Handle.h
index 98c60ec..d4e38c0 100644
--- a/Source/JavaScriptCore/collector/handles/Handle.h
+++ b/Source/JavaScriptCore/collector/handles/Handle.h
@@ -111,10 +111,19 @@ template <typename Base, typename T> struct HandleConverter {
 };
 
 template <typename Base> struct HandleConverter<Base, Unknown> {
+    Handle<JSObject> asObject() const;
+    bool isObject() const { return jsValue().isObject(); }
+    bool getNumber(double number) const { return jsValue().getNumber(number); }
+    UString getString(ExecState*) const;
+    bool isUndefinedOrNull() const { return jsValue().isUndefinedOrNull(); }
+
+private:
+    JSValue jsValue() const { return static_cast<const Base*>(this)->get(); }
 };
 
 template <typename T> class Handle : public HandleBase, public HandleConverter<Handle<T>, T> {
 public:
+    template <typename A, typename B> friend class HandleConverter;
     typedef typename HandleTypes<T>::ExternalType ExternalType;
     template <typename U> Handle(Handle<U> o)
     {
@@ -144,6 +153,11 @@ private:
     }
 };
 
+template <typename Base> Handle<JSObject> HandleConverter<Base, Unknown>::asObject() const
+{
+    return Handle<JSObject>::wrapSlot(static_cast<const Base*>(this)->slot());
+}
+
 template <typename T, typename U> inline bool operator==(const Handle<T>& a, const Handle<U>& b)
 { 
     return a.get() == b.get(); 
diff --git a/Source/JavaScriptCore/collector/handles/HandleHeap.cpp b/Source/JavaScriptCore/collector/handles/HandleHeap.cpp
index 32fa42d..1beb407 100644
--- a/Source/JavaScriptCore/collector/handles/HandleHeap.cpp
+++ b/Source/JavaScriptCore/collector/handles/HandleHeap.cpp
@@ -51,11 +51,11 @@ void HandleHeap::grow()
     }
 }
 
-void HandleHeap::markStrongHandles(MarkStack& markStack)
+void HandleHeap::markStrongHandles(HeapRootMarker& heapRootMarker)
 {
     Node* end = m_strongList.end();
     for (Node* node = m_strongList.begin(); node != end; node = node->next())
-        markStack.deprecatedAppend(node->slot());
+        heapRootMarker.mark(node->slot());
 }
 
 void HandleHeap::updateAfterMark()
@@ -79,7 +79,10 @@ void HandleHeap::clearWeakPointers()
         
         JSCell* cell = value.asCell();
         ASSERT(!cell || cell->structure());
-
+        
+#if ENABLE(JSC_ZOMBIES)
+        ASSERT(!cell->isZombie());
+#endif
         if (Heap::isMarked(cell))
             continue;
         
diff --git a/Source/JavaScriptCore/collector/handles/HandleHeap.h b/Source/JavaScriptCore/collector/handles/HandleHeap.h
index 4bb9b00..ed462d4 100644
--- a/Source/JavaScriptCore/collector/handles/HandleHeap.h
+++ b/Source/JavaScriptCore/collector/handles/HandleHeap.h
@@ -36,7 +36,7 @@ namespace JSC {
 class HandleHeap;
 class JSGlobalData;
 class JSValue;
-class MarkStack;
+class HeapRootMarker;
 
 class Finalizer {
 public:
@@ -56,7 +56,7 @@ public:
     void makeWeak(HandleSlot, Finalizer*, void* context);
     void makeSelfDestroying(HandleSlot, Finalizer*, void* context);
 
-    void markStrongHandles(MarkStack&);
+    void markStrongHandles(HeapRootMarker&);
     void updateAfterMark();
     
     // Should only be called during teardown.
diff --git a/Source/JavaScriptCore/collector/handles/HandleStack.cpp b/Source/JavaScriptCore/collector/handles/HandleStack.cpp
new file mode 100644
index 0000000..1c151af
--- /dev/null
+++ b/Source/JavaScriptCore/collector/handles/HandleStack.cpp
@@ -0,0 +1,63 @@
+/*
+ * Copyright (C) 2010 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#include "HandleStack.h"
+
+#include "MarkStack.h"
+
+namespace JSC {
+
+HandleStack::HandleStack()
+#ifndef NDEBUG
+    : m_scopeDepth(0)
+#endif
+{
+    grow();
+}
+
+void HandleStack::mark(HeapRootMarker& heapRootMarker)
+{
+    const Vector<HandleSlot>& blocks = m_blockStack.blocks();
+    size_t blockLength = m_blockStack.blockLength;
+
+    int end = blocks.size() - 1;
+    for (int i = 0; i < end; ++i) {
+        HandleSlot block = blocks[i];
+        heapRootMarker.mark(block, blockLength);
+    }
+    HandleSlot block = blocks[end];
+    heapRootMarker.mark(block, m_frame.m_next - block);
+}
+
+void HandleStack::grow()
+{
+    HandleSlot block = m_blockStack.grow();
+    m_frame.m_next = block;
+    m_frame.m_end = block + m_blockStack.blockLength;
+}
+
+}
diff --git a/Source/JavaScriptCore/collector/handles/HandleStack.h b/Source/JavaScriptCore/collector/handles/HandleStack.h
new file mode 100644
index 0000000..54e6c60
--- /dev/null
+++ b/Source/JavaScriptCore/collector/handles/HandleStack.h
@@ -0,0 +1,129 @@
+/*
+ * Copyright (C) 2010 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef HandleStack_h
+#define HandleStack_h
+
+#include "Assertions.h"
+#include "BlockStack.h"
+#include "Handle.h"
+
+#include <wtf/UnusedParam.h>
+
+namespace JSC {
+
+class LocalScope;
+class HeapRootMarker;
+
+class HandleStack {
+public:
+    class Frame {
+    public:
+        HandleSlot m_next;
+        HandleSlot m_end;
+    };
+
+    HandleStack();
+    
+    void enterScope(Frame&);
+    void leaveScope(Frame&);
+
+    HandleSlot push();
+
+    void mark(HeapRootMarker&);
+
+private:
+    void grow();
+    void zapTo(Frame&);
+    HandleSlot findFirstAfter(HandleSlot);
+
+#ifndef NDEBUG
+    size_t m_scopeDepth;
+#endif
+    BlockStack<JSValue> m_blockStack;
+    Frame m_frame;
+};
+
+inline void HandleStack::enterScope(Frame& lastFrame)
+{
+#ifndef NDEBUG
+    ++m_scopeDepth;
+#endif
+
+    lastFrame = m_frame;
+}
+
+
+
+inline void HandleStack::zapTo(Frame& lastFrame)
+{
+#ifdef NDEBUG
+    UNUSED_PARAM(lastFrame);
+#else
+    const Vector<HandleSlot>& blocks = m_blockStack.blocks();
+    
+    if (lastFrame.m_end != m_frame.m_end) { // Zapping to a frame in a different block.
+        int i = blocks.size() - 1;
+        for ( ; blocks[i] + m_blockStack.blockLength != lastFrame.m_end; --i) {
+            for (int j = m_blockStack.blockLength - 1; j >= 0; --j)
+                blocks[i][j] = JSValue();
+        }
+        
+        for (HandleSlot it = blocks[i] + m_blockStack.blockLength - 1; it != lastFrame.m_next - 1; --it)
+            *it = JSValue();
+        
+        return;
+    }
+    
+    for (HandleSlot it = m_frame.m_next - 1; it != lastFrame.m_next - 1; --it)
+        *it = JSValue();
+#endif
+}
+
+inline void HandleStack::leaveScope(Frame& lastFrame)
+{
+#ifndef NDEBUG
+    --m_scopeDepth;
+#endif
+
+    zapTo(lastFrame);
+
+    if (lastFrame.m_end != m_frame.m_end) // Popping to a frame in a different block.
+        m_blockStack.shrink(lastFrame.m_end);
+
+    m_frame = lastFrame;
+}
+
+inline HandleSlot HandleStack::push()
+{
+    ASSERT(m_scopeDepth); // Creating a Local outside of a LocalScope is a memory leak.
+    if (m_frame.m_next == m_frame.m_end)
+        grow();
+    return m_frame.m_next++;
+}
+
+}
+
+#endif
diff --git a/Source/JavaScriptCore/collector/handles/Local.h b/Source/JavaScriptCore/collector/handles/Local.h
new file mode 100644
index 0000000..035e9e9
--- /dev/null
+++ b/Source/JavaScriptCore/collector/handles/Local.h
@@ -0,0 +1,157 @@
+/*
+ * Copyright (C) 2010 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef Local_h
+#define Local_h
+
+#include "Handle.h"
+#include "JSGlobalData.h"
+
+/*
+    A Local is a temporary handle whose lifetime is tied to a given LocalScope.
+    Use Locals for local values on the stack. It is an error to create a Local
+    outside of any LocalScope.
+*/
+
+namespace JSC {
+template <typename T> class Local;
+}
+
+namespace WTF {
+
+template<typename T> struct VectorTraits<JSC::Local<T> > {
+    static const bool needsDestruction = false;
+    static const bool needsInitialization = true;
+    static const bool canInitializeWithMemset = false;
+    static const bool canMoveWithMemcpy = true;
+    static const bool canCopyWithMemcpy = false;
+    static const bool canFillWithMemset = false;
+    static const bool canCompareWithMemcmp = true;
+};
+
+}
+
+namespace JSC {
+
+template <typename T> class Local : public Handle<T> {
+    friend class LocalScope;
+public:
+    typedef typename Handle<T>::ExternalType ExternalType;
+    Local(JSGlobalData&, ExternalType = ExternalType());
+    Local(JSGlobalData&, Handle<T>);
+    Local(const Local<T>&); // Adopting constructor. Used to return a Local to a calling function.
+
+    Local& operator=(ExternalType);
+    Local& operator=(Handle<T>);
+    
+    using Handle<T>::slot;
+
+private:
+    Local(HandleSlot, ExternalType); // Used by LocalScope::release() to move a Local to a containing scope.
+    void internalSet(ExternalType value)
+    {
+        JSValue newValue(HandleTypes<T>::toJSValue(value));
+        HandleSlot slot = this->slot();
+        *slot = newValue;
+    }
+};
+
+template <typename T> inline Local<T>::Local(JSGlobalData& globalData, ExternalType value)
+    : Handle<T>(globalData.allocateLocalHandle())
+{
+    internalSet(value);
+}
+
+template <typename T> inline Local<T>::Local(JSGlobalData& globalData, Handle<T> handle)
+    : Handle<T>(globalData.allocateLocalHandle())
+{
+    internalSet(handle.get());
+}
+
+template <typename T> inline Local<T>::Local(const Local<T>& o)
+    : Handle<T>(o.slot())
+{
+    const_cast<Local<T>&>(o).invalidate(); // Prevent accidental sharing.
+}
+
+template <typename T> inline Local<T>::Local(HandleSlot slot, ExternalType value)
+    : Handle<T>(slot, value)
+{
+}
+
+template <typename T> inline Local<T>& Local<T>::operator=(ExternalType value)
+{
+    internalSet(value);
+    return *this;
+}
+
+template <typename T> inline Local<T>& Local<T>::operator=(Handle<T> handle)
+{
+    internalSet(handle.get());
+    return *this;
+}
+
+template <typename T, unsigned inlineCapacity = 0> class LocalStack {
+    typedef typename Handle<T>::ExternalType ExternalType;
+public:
+    LocalStack(JSGlobalData& globalData)
+        : m_globalData(&globalData)
+        , m_count(0)
+    {
+    }
+
+    ExternalType peek() const
+    {
+        ASSERT(m_count > 0);
+        return m_stack[m_count - 1].get();
+    }
+
+    ExternalType pop()
+    {
+        ASSERT(m_count > 0);
+        return m_stack[--m_count].get();
+    }
+
+    void push(ExternalType value)
+    {
+        if (m_count == m_stack.size())
+            m_stack.append(Local<T>(*m_globalData, value));
+        else
+            m_stack[m_count] = value;
+        m_count++;
+    }
+
+    bool isEmpty() const { return !m_count; }
+    unsigned size() const { return m_count; }
+
+private:
+    RefPtr<JSGlobalData> m_globalData;
+    Vector<Local<T>, inlineCapacity> m_stack;
+    unsigned m_count;
+};
+
+}
+
+#endif
diff --git a/Source/WebKit2/PluginProcess/mac/PluginProcessShim.cpp b/Source/JavaScriptCore/collector/handles/LocalScope.h
index 346ead9..cd27b32 100644
--- a/Source/WebKit2/PluginProcess/mac/PluginProcessShim.cpp
+++ b/Source/JavaScriptCore/collector/handles/LocalScope.h
@@ -23,54 +23,56 @@
  * THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#include "PluginProcessShim.h"
+#ifndef LocalScope_h
+#define LocalScope_h
 
-#include <Carbon/Carbon.h>
-#include <stdio.h>
+#include "HandleStack.h"
+#include "Local.h"
 
-#define DYLD_INTERPOSE(_replacement,_replacee) \
-    __attribute__((used)) static struct{ const void* replacement; const void* replacee; } _interpose_##_replacee \
-    __attribute__ ((section ("__DATA,__interpose"))) = { (const void*)(unsigned long)&_replacement, (const void*)(unsigned long)&_replacee };
+namespace JSC {
+/*  
+    A LocalScope is a temporary scope in which Locals are allocated. When a
+    LocalScope goes out of scope, all the Locals created in it are destroyed.
 
-namespace WebKit {
+    LocalScope is similar in concept to NSAutoreleasePool.
+*/
 
-extern "C" void WebKitPluginProcessShimInitialize(const PluginProcessShimCallbacks& callbacks);
+class JSGlobalData;
 
-PluginProcessShimCallbacks pluginProcessShimCallbacks;
+class LocalScope {
+public:
+    explicit LocalScope(JSGlobalData&);
+    ~LocalScope();
+    
+    template <typename T> Local<T> release(Local<T>); // Destroys all other locals in the scope.
+
+private:
+    HandleStack* m_handleStack;
+    HandleStack::Frame m_lastFrame;
+};
 
-__attribute__((visibility("default")))
-void WebKitPluginProcessShimInitialize(const PluginProcessShimCallbacks& callbacks)
+inline LocalScope::LocalScope(JSGlobalData& globalData)
+    : m_handleStack(globalData.heap.handleStack())
 {
-    pluginProcessShimCallbacks = callbacks;
+    m_handleStack->enterScope(m_lastFrame);
 }
 
-#ifndef __LP64__
-static void shimDebugger(void)
+inline LocalScope::~LocalScope()
 {
-    if (!pluginProcessShimCallbacks.shouldCallRealDebugger())
-        return;
-    
-    Debugger();
+    m_handleStack->leaveScope(m_lastFrame);
 }
 
-static UInt32 shimGetCurrentEventButtonState()
+template <typename T> Local<T> LocalScope::release(Local<T> local)
 {
-    return pluginProcessShimCallbacks.getCurrentEventButtonState();
+    typename Local<T>::ExternalType ptr = local.get();
+
+    m_handleStack->leaveScope(m_lastFrame);
+    HandleSlot slot = m_handleStack->push();
+    m_handleStack->enterScope(m_lastFrame);
+
+    return Local<T>(slot, ptr);
 }
 
-static Boolean shimIsWindowActive(WindowRef window)
-{
-    bool result;
-    if (pluginProcessShimCallbacks.isWindowActive(window, result))
-        return result;
-    
-    return IsWindowActive(window);
 }
 
-DYLD_INTERPOSE(shimDebugger, Debugger);
-DYLD_INTERPOSE(shimGetCurrentEventButtonState, GetCurrentEventButtonState);
-DYLD_INTERPOSE(shimIsWindowActive, IsWindowActive);
-    
 #endif
-
-} // namespace WebKit
diff --git a/Source/JavaScriptCore/config.h b/Source/JavaScriptCore/config.h
index 1c14917..ea10e77 100644
--- a/Source/JavaScriptCore/config.h
+++ b/Source/JavaScriptCore/config.h
@@ -29,6 +29,24 @@
 
 #include <wtf/Platform.h>
 
+/* See note in wtf/Platform.h for more info on EXPORT_MACROS. */
+#if USE(EXPORT_MACROS)
+
+#include <wtf/ExportMacros.h>
+
+#if defined(BUILDING_JavaScriptCore) || defined(BUILDING_WTF)
+#define WTF_EXPORT_PRIVATE WTF_EXPORT
+#define JS_EXPORT_PRIVATE WTF_EXPORT
+#else
+#define WTF_EXPORT_PRIVATE WTF_IMPORT
+#define JS_EXPORT_PRIVATE WTF_IMPORT
+#endif
+
+#define JS_EXPORTDATA JS_EXPORT_PRIVATE
+#define JS_EXPORTCLASS JS_EXPORT_PRIVATE
+
+#else /* !USE(EXPORT_MACROS) */
+
 #if !PLATFORM(CHROMIUM) && OS(WINDOWS) && !defined(BUILDING_WX__) && !COMPILER(GCC)
 #if defined(BUILDING_JavaScriptCore) || defined(BUILDING_WTF)
 #define JS_EXPORTDATA __declspec(dllexport)
@@ -41,6 +59,11 @@
 #define JS_EXPORTCLASS
 #endif
 
+#define WTF_EXPORT_PRIVATE JS_EXPORTDATA
+#define JS_EXPORT_PRIVATE JS_EXPORTDATA
+
+#endif /* USE(EXPORT_MACROS) */
+
 #if OS(WINDOWS)
 
 // If we don't define these, they get defined in windef.h. 
diff --git a/Source/JavaScriptCore/debugger/Debugger.cpp b/Source/JavaScriptCore/debugger/Debugger.cpp
index b999446..64f6002 100644
--- a/Source/JavaScriptCore/debugger/Debugger.cpp
+++ b/Source/JavaScriptCore/debugger/Debugger.cpp
@@ -29,7 +29,9 @@
 #include "Parser.h"
 #include "Protect.h"
 
-namespace JSC {
+namespace {
+
+using namespace JSC;
 
 class Recompiler {
 public:
@@ -82,6 +84,10 @@ inline void Recompiler::operator()(JSCell* cell)
         m_sourceProviders.add(executable->source().provider(), exec);
 }
 
+} // namespace
+
+namespace JSC {
+
 Debugger::~Debugger()
 {
     HashSet<JSGlobalObject*>::iterator end = m_globalObjects.end();
@@ -118,16 +124,18 @@ void Debugger::recompileAllJSFunctions(JSGlobalData* globalData)
 JSValue evaluateInGlobalCallFrame(const UString& script, JSValue& exception, JSGlobalObject* globalObject)
 {
     CallFrame* globalCallFrame = globalObject->globalExec();
+    JSGlobalData& globalData = globalObject->globalData();
 
-    RefPtr<EvalExecutable> eval = EvalExecutable::create(globalCallFrame, makeSource(script), false);
-    JSObject* error = eval->compile(globalCallFrame, globalCallFrame->scopeChain());
-    if (error)
-        return error;
+    EvalExecutable* eval = EvalExecutable::create(globalCallFrame, makeSource(script), false);
+    if (!eval) {
+        exception = globalData.exception;
+        globalData.exception = JSValue();
+        return exception;
+    }
 
-    JSGlobalData& globalData = globalObject->globalData();
-    JSValue result = globalData.interpreter->execute(eval.get(), globalCallFrame, globalObject, globalCallFrame->scopeChain());
+    JSValue result = globalData.interpreter->execute(eval, globalCallFrame, globalObject, globalCallFrame->scopeChain());
     if (globalData.exception) {
-        exception = globalData.exception.get();
+        exception = globalData.exception;
         globalData.exception = JSValue();
     }
     ASSERT(result);
diff --git a/Source/JavaScriptCore/debugger/DebuggerActivation.cpp b/Source/JavaScriptCore/debugger/DebuggerActivation.cpp
index 62a2e54..50ba746 100644
--- a/Source/JavaScriptCore/debugger/DebuggerActivation.cpp
+++ b/Source/JavaScriptCore/debugger/DebuggerActivation.cpp
@@ -31,7 +31,7 @@
 namespace JSC {
 
 DebuggerActivation::DebuggerActivation(JSGlobalData& globalData, JSObject* activation)
-    : JSNonFinalObject(DebuggerActivation::createStructure(jsNull()))
+    : JSNonFinalObject(DebuggerActivation::createStructure(globalData, jsNull()))
 {
     ASSERT(activation);
     ASSERT(activation->isActivationObject());
diff --git a/Source/JavaScriptCore/debugger/DebuggerActivation.h b/Source/JavaScriptCore/debugger/DebuggerActivation.h
index 01a4907..f22d2ff 100644
--- a/Source/JavaScriptCore/debugger/DebuggerActivation.h
+++ b/Source/JavaScriptCore/debugger/DebuggerActivation.h
@@ -49,9 +49,9 @@ namespace JSC {
         virtual JSValue lookupGetter(ExecState*, const Identifier& propertyName);
         virtual JSValue lookupSetter(ExecState*, const Identifier& propertyName);
 
-        static PassRefPtr<Structure> createStructure(JSValue prototype) 
+        static PassRefPtr<Structure> createStructure(JSGlobalData& globalData, JSValue prototype) 
         {
-            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info); 
+            return Structure::create(globalData, prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info); 
         }
 
     protected:
diff --git a/Source/JavaScriptCore/debugger/DebuggerCallFrame.cpp b/Source/JavaScriptCore/debugger/DebuggerCallFrame.cpp
index d778bd5..08fba4a 100644
--- a/Source/JavaScriptCore/debugger/DebuggerCallFrame.cpp
+++ b/Source/JavaScriptCore/debugger/DebuggerCallFrame.cpp
@@ -87,16 +87,17 @@ JSValue DebuggerCallFrame::evaluate(const UString& script, JSValue& exception) c
 {
     if (!m_callFrame->codeBlock())
         return JSValue();
-
-    RefPtr<EvalExecutable> eval = EvalExecutable::create(m_callFrame, makeSource(script), m_callFrame->codeBlock()->isStrictMode());
-    JSObject* error = eval->compile(m_callFrame, m_callFrame->scopeChain());
-    if (error)
-        return error;
-
+    
     JSGlobalData& globalData = m_callFrame->globalData();
-    JSValue result = globalData.interpreter->execute(eval.get(), m_callFrame, thisObject(), m_callFrame->scopeChain());
+    EvalExecutable* eval = EvalExecutable::create(m_callFrame, makeSource(script), m_callFrame->codeBlock()->isStrictMode());
+    if (globalData.exception) {
+        exception = globalData.exception;
+        globalData.exception = JSValue();
+    }
+
+    JSValue result = globalData.interpreter->execute(eval, m_callFrame, thisObject(), m_callFrame->scopeChain());
     if (globalData.exception) {
-        exception = globalData.exception.get();
+        exception = globalData.exception;
         globalData.exception = JSValue();
     }
     ASSERT(result);
diff --git a/Source/JavaScriptCore/dfg/DFGAliasTracker.h b/Source/JavaScriptCore/dfg/DFGAliasTracker.h
new file mode 100644
index 0000000..8710169
--- /dev/null
+++ b/Source/JavaScriptCore/dfg/DFGAliasTracker.h
@@ -0,0 +1,121 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef DFGAliasTracker_h
+#define DFGAliasTracker_h
+
+#if ENABLE(DFG_JIT)
+
+#include <dfg/DFGGraph.h>
+#include <wtf/Vector.h>
+
+namespace JSC { namespace DFG {
+
+// === AliasTracker ===
+//
+// This class id used to detect aliasing property accesses, which we may
+// be able to speculatively optimize (for example removing redundant loads
+// where we know a getter will not be called, or optimizing puts to arrays
+// where we know the value being written to in within length and is not a
+// hole value). In time, this should be more than a 1-deep buffer!
+class AliasTracker {
+public:
+    AliasTracker(Graph& graph)
+        : m_graph(graph)
+        , m_candidateAliasGetByVal(NoNode)
+    {
+    }
+
+    NodeIndex lookupGetByVal(NodeIndex base, NodeIndex property)
+    {
+        // Try to detect situations where a GetByVal follows another GetByVal to the same
+        // property; in these cases, we may be able to omit the subsequent get on the
+        // speculative path, where we know conditions hold to make this safe (for example,
+        // on the speculative path we will not have allowed getter access).
+        if (m_candidateAliasGetByVal != NoNode) {
+            Node& possibleAlias = m_graph[m_candidateAliasGetByVal];
+            ASSERT(possibleAlias.op == GetByVal);
+            // This check ensures the accesses alias, provided that the subscript is an
+            // integer index (this is good enough; the speculative path will only generate
+            // optimized accesses to handle integer subscripts).
+            if (possibleAlias.child1 == base && equalIgnoringLaterNumericConversion(possibleAlias.child2, property))
+                return m_candidateAliasGetByVal;
+        }
+        return NoNode;
+    }
+
+    void recordGetByVal(NodeIndex getByVal)
+    {
+        m_candidateAliasGetByVal = getByVal;
+    }
+
+    void recordPutByVal(NodeIndex putByVal)
+    {
+        ASSERT_UNUSED(putByVal, m_graph[putByVal].op == PutByVal || m_graph[putByVal].op == PutByValAlias);
+        m_candidateAliasGetByVal = NoNode;
+    }
+
+    void recordGetById(NodeIndex getById)
+    {
+        ASSERT_UNUSED(getById, m_graph[getById].op == GetById);
+        m_candidateAliasGetByVal = NoNode;
+    }
+
+    void recordPutById(NodeIndex putById)
+    {
+        ASSERT_UNUSED(putById, m_graph[putById].op == PutById);
+        m_candidateAliasGetByVal = NoNode;
+    }
+
+    void recordPutByIdDirect(NodeIndex putByVal)
+    {
+        ASSERT_UNUSED(putByVal, m_graph[putByVal].op == PutByIdDirect);
+        m_candidateAliasGetByVal = NoNode;
+    }
+
+private:
+    // This method returns true for arguments:
+    //   - (X, X)
+    //   - (X, ValueToNumber(X))
+    //   - (X, ValueToInt32(X))
+    //   - (X, NumberToInt32(X))
+    bool equalIgnoringLaterNumericConversion(NodeIndex op1, NodeIndex op2)
+    {
+        if (op1 == op2)
+            return true;
+        Node& node2 = m_graph[op2];
+        return (node2.op == ValueToNumber || node2.op == ValueToInt32 || node2.op == NumberToInt32) && op1 == node2.child1;
+    }
+
+    // The graph, to look up potentially aliasing nodes.
+    Graph& m_graph;
+    // Currently a 1-deep buffer!
+    NodeIndex m_candidateAliasGetByVal;
+};
+
+} } // namespace JSC::DFG
+
+#endif
+#endif
diff --git a/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp b/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp
new file mode 100644
index 0000000..03f5d4f
--- /dev/null
+++ b/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp
@@ -0,0 +1,744 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGByteCodeParser.h"
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGAliasTracker.h"
+#include "DFGScoreBoard.h"
+#include "CodeBlock.h"
+
+namespace JSC { namespace DFG {
+
+// === ByteCodeParser ===
+//
+// This class is used to compile the dataflow graph from a CodeBlock.
+class ByteCodeParser {
+public:
+    ByteCodeParser(JSGlobalData* globalData, CodeBlock* codeBlock, Graph& graph)
+        : m_globalData(globalData)
+        , m_codeBlock(codeBlock)
+        , m_graph(graph)
+        , m_currentIndex(0)
+        , m_noArithmetic(true)
+        , m_constantUndefined(UINT_MAX)
+        , m_constant1(UINT_MAX)
+    {
+        unsigned numberOfConstants = codeBlock->numberOfConstantRegisters();
+        m_constantRecords.grow(numberOfConstants);
+
+        unsigned numberOfParameters = codeBlock->m_numParameters;
+        m_arguments.grow(numberOfParameters);
+        for (unsigned i = 0; i < numberOfParameters; ++i)
+            m_arguments[i] = NoNode;
+
+        unsigned numberOfRegisters = codeBlock->m_numCalleeRegisters;
+        m_calleeRegisters.grow(numberOfRegisters);
+        for (unsigned i = 0; i < numberOfRegisters; ++i)
+            m_calleeRegisters[i] = NoNode;
+    }
+
+    bool parse();
+
+private:
+    // Get/Set the operands/result of a bytecode instruction.
+    NodeIndex get(int operand)
+    {
+        // Is this a constant?
+        if (operand >= FirstConstantRegisterIndex) {
+            unsigned constant = operand - FirstConstantRegisterIndex;
+            ASSERT(constant < m_constantRecords.size());
+            return getJSConstant(constant);
+        }
+
+        // Is this an argument?
+        if (operand < 0) {
+            unsigned argument = operand + m_codeBlock->m_numParameters + RegisterFile::CallFrameHeaderSize;
+            ASSERT(argument < m_arguments.size());
+            return getArgument(argument);
+        }
+
+        // Must be a local or temporary.
+        ASSERT((unsigned)operand < m_calleeRegisters.size());
+        return getRegister((unsigned)operand);
+    }
+    void set(int operand, NodeIndex value)
+    {
+        // Is this an argument?
+        if (operand < 0) {
+            unsigned argument = operand + m_codeBlock->m_numParameters + RegisterFile::CallFrameHeaderSize;
+            ASSERT(argument < m_arguments.size());
+            return setArgument(argument, value);
+        }
+
+        // Must be a local or temporary.
+        ASSERT((unsigned)operand < m_calleeRegisters.size());
+        return setRegister((unsigned)operand, value);
+    }
+
+    // Used in implementing get/set, above, where the operand is a local or temporary.
+    NodeIndex getRegister(unsigned operand)
+    {
+        NodeIndex index = m_calleeRegisters[operand];
+        if (index != NoNode)
+            return index;
+        // We have not yet seen a definition for this value in this block.
+        // For now, since we are only generating single block functions,
+        // this value must be undefined.
+        // For example:
+        //     function f() { var x; return x; }
+        return constantUndefined();
+    }
+    void setRegister(int operand, NodeIndex value)
+    {
+        m_calleeRegisters[operand] = value;
+    }
+
+    // Used in implementing get/set, above, where the operand is an argument.
+    NodeIndex getArgument(unsigned argument)
+    {
+        NodeIndex index = m_arguments[argument];
+        if (index != NoNode)
+            return index;
+        NodeIndex resultIndex = (NodeIndex)m_graph.size();
+        m_graph.append(Node(Argument, m_currentIndex, OpInfo(argument)));
+        return m_arguments[argument] = resultIndex;
+    }
+    void setArgument(int operand, NodeIndex value)
+    {
+        m_arguments[operand] = value;
+    }
+
+    // Get an operand, and perform a ToInt32/ToNumber conversion on it.
+    NodeIndex getToInt32(int operand)
+    {
+        // Avoid wastefully adding a JSConstant node to the graph, only to
+        // replace it with a Int32Constant (which is what would happen if
+        // we called 'toInt32(get(operand))' in this case).
+        if (operand >= FirstConstantRegisterIndex) {
+            JSValue v = m_codeBlock->getConstant(operand);
+            if (v.isInt32())
+                return getInt32Constant(v.asInt32(), operand - FirstConstantRegisterIndex);
+        }
+        return toInt32(get(operand));
+    }
+    NodeIndex getToNumber(int operand)
+    {
+        // Avoid wastefully adding a JSConstant node to the graph, only to
+        // replace it with a DoubleConstant (which is what would happen if
+        // we called 'toNumber(get(operand))' in this case).
+        if (operand >= FirstConstantRegisterIndex) {
+            JSValue v = m_codeBlock->getConstant(operand);
+            if (v.isNumber())
+                return getDoubleConstant(v.uncheckedGetNumber(), operand - FirstConstantRegisterIndex);
+        }
+        return toNumber(get(operand));
+    }
+
+    // Perform an ES5 ToInt32 operation - returns a node of type NodeResultInt32.
+    NodeIndex toInt32(NodeIndex index)
+    {
+        Node& node = m_graph[index];
+
+        if (node.hasInt32Result())
+            return index;
+
+        if (node.hasDoubleResult()) {
+            if (node.op == DoubleConstant)
+                return getInt32Constant(JSC::toInt32(valueOfDoubleConstant(index)), node.constantNumber());
+            // 'NumberToInt32(Int32ToNumber(X))' == X, and 'NumberToInt32(UInt32ToNumber(X)) == X'
+            if (node.op == Int32ToNumber || node.op == UInt32ToNumber)
+                return node.child1;
+
+            // We unique NumberToInt32 nodes in a map to prevent duplicate conversions.
+            pair<UnaryOpMap::iterator, bool> result = m_numberToInt32Nodes.add(index, NoNode);
+            // Either we added a new value, or the existing value in the map is non-zero.
+            ASSERT(result.second == (result.first->second == NoNode));
+            if (result.second)
+                result.first->second = addToGraph(NumberToInt32, index);
+            return result.first->second;
+        }
+
+        // Check for numeric constants boxed as JSValues.
+        if (node.op == JSConstant) {
+            JSValue v = valueOfJSConstant(index);
+            if (v.isInt32())
+                return getInt32Constant(v.asInt32(), node.constantNumber());
+            if (v.isNumber())
+                return getInt32Constant(JSC::toInt32(v.uncheckedGetNumber()), node.constantNumber());
+        }
+
+        return addToGraph(ValueToInt32, index);
+    }
+
+    // Perform an ES5 ToNumber operation - returns a node of type NodeResultDouble.
+    NodeIndex toNumber(NodeIndex index)
+    {
+        Node& node = m_graph[index];
+
+        if (node.hasDoubleResult())
+            return index;
+
+        if (node.hasInt32Result()) {
+            if (node.op == Int32Constant)
+                return getDoubleConstant(valueOfInt32Constant(index), node.constantNumber());
+
+            // We unique Int32ToNumber nodes in a map to prevent duplicate conversions.
+            pair<UnaryOpMap::iterator, bool> result = m_int32ToNumberNodes.add(index, NoNode);
+            // Either we added a new value, or the existing value in the map is non-zero.
+            ASSERT(result.second == (result.first->second == NoNode));
+            if (result.second)
+                result.first->second = addToGraph(Int32ToNumber, index);
+            return result.first->second;
+        }
+
+        if (node.op == JSConstant) {
+            JSValue v = valueOfJSConstant(index);
+            if (v.isNumber())
+                return getDoubleConstant(v.uncheckedGetNumber(), node.constantNumber());
+        }
+
+        return addToGraph(ValueToNumber, index);
+    }
+
+
+    // Used in implementing get, above, where the operand is a constant.
+    NodeIndex getInt32Constant(int32_t value, unsigned constant)
+    {
+        NodeIndex index = m_constantRecords[constant].asInt32;
+        if (index != NoNode)
+            return index;
+        NodeIndex resultIndex = (NodeIndex)m_graph.size();
+        m_graph.append(Node(Int32Constant, m_currentIndex, OpInfo(constant)));
+        m_graph[resultIndex].setInt32Constant(value);
+        m_constantRecords[constant].asInt32 = resultIndex;
+        return resultIndex;
+    }
+    NodeIndex getDoubleConstant(double value, unsigned constant)
+    {
+        NodeIndex index = m_constantRecords[constant].asNumeric;
+        if (index != NoNode)
+            return index;
+        NodeIndex resultIndex = (NodeIndex)m_graph.size();
+        m_graph.append(Node(DoubleConstant, m_currentIndex, OpInfo(constant)));
+        m_graph[resultIndex].setDoubleConstant(value);
+        m_constantRecords[constant].asNumeric = resultIndex;
+        return resultIndex;
+    }
+    NodeIndex getJSConstant(unsigned constant)
+    {
+        NodeIndex index = m_constantRecords[constant].asJSValue;
+        if (index != NoNode)
+            return index;
+
+        NodeIndex resultIndex = (NodeIndex)m_graph.size();
+        m_graph.append(Node(JSConstant, m_currentIndex, OpInfo(constant)));
+        m_constantRecords[constant].asJSValue = resultIndex;
+        return resultIndex;
+    }
+
+    // Helper functions to get/set the this value.
+    NodeIndex getThis()
+    {
+        return getArgument(0);
+    }
+    void setThis(NodeIndex value)
+    {
+        setArgument(0, value);
+    }
+
+    // Convenience methods for checking nodes for constants.
+    bool isInt32Constant(NodeIndex index)
+    {
+        return m_graph[index].op == Int32Constant;
+    }
+    bool isDoubleConstant(NodeIndex index)
+    {
+        return m_graph[index].op == DoubleConstant;
+    }
+    bool isJSConstant(NodeIndex index)
+    {
+        return m_graph[index].op == JSConstant;
+    }
+
+    // Convenience methods for getting constant values.
+    int32_t valueOfInt32Constant(NodeIndex index)
+    {
+        ASSERT(isInt32Constant(index));
+        return m_graph[index].int32Constant();
+    }
+    double valueOfDoubleConstant(NodeIndex index)
+    {
+        ASSERT(isDoubleConstant(index));
+        return m_graph[index].numericConstant();
+    }
+    JSValue valueOfJSConstant(NodeIndex index)
+    {
+        ASSERT(isJSConstant(index));
+        return m_codeBlock->getConstant(FirstConstantRegisterIndex + m_graph[index].constantNumber());
+    }
+
+    // This method returns a JSConstant with the value 'undefined'.
+    NodeIndex constantUndefined()
+    {
+        // Has m_constantUndefined been set up yet?
+        if (m_constantUndefined == UINT_MAX) {
+            // Search the constant pool for undefined, if we find it, we can just reuse this!
+            unsigned numberOfConstants = m_codeBlock->numberOfConstantRegisters();
+            for (m_constantUndefined = 0; m_constantUndefined < numberOfConstants; ++m_constantUndefined) {
+                JSValue testMe = m_codeBlock->getConstant(FirstConstantRegisterIndex + m_constantUndefined);
+                if (testMe.isUndefined())
+                    return getJSConstant(m_constantUndefined);
+            }
+
+            // Add undefined to the CodeBlock's constants, and add a corresponding slot in m_constantRecords.
+            ASSERT(m_constantRecords.size() == numberOfConstants);
+            m_codeBlock->addConstant(jsUndefined());
+            m_constantRecords.append(ConstantRecord());
+            ASSERT(m_constantRecords.size() == m_codeBlock->numberOfConstantRegisters());
+        }
+
+        // m_constantUndefined must refer to an entry in the CodeBlock's constant pool that has the value 'undefined'.
+        ASSERT(m_codeBlock->getConstant(FirstConstantRegisterIndex + m_constantUndefined).isUndefined());
+        return getJSConstant(m_constantUndefined);
+    }
+
+    // This method returns a DoubleConstant with the value 1.
+    NodeIndex one()
+    {
+        // Has m_constant1 been set up yet?
+        if (m_constant1 == UINT_MAX) {
+            // Search the constant pool for the value 1, if we find it, we can just reuse this!
+            unsigned numberOfConstants = m_codeBlock->numberOfConstantRegisters();
+            for (m_constant1 = 0; m_constant1 < numberOfConstants; ++m_constant1) {
+                JSValue testMe = m_codeBlock->getConstant(FirstConstantRegisterIndex + m_constant1);
+                if (testMe.isInt32() && testMe.asInt32() == 1)
+                    return getDoubleConstant(1, m_constant1);
+            }
+
+            // Add the value 1 to the CodeBlock's constants, and add a corresponding slot in m_constantRecords.
+            ASSERT(m_constantRecords.size() == numberOfConstants);
+            m_codeBlock->addConstant(jsNumber(1));
+            m_constantRecords.append(ConstantRecord());
+            ASSERT(m_constantRecords.size() == m_codeBlock->numberOfConstantRegisters());
+        }
+
+        // m_constant1 must refer to an entry in the CodeBlock's constant pool that has the integer value 1.
+        ASSERT(m_codeBlock->getConstant(FirstConstantRegisterIndex + m_constant1).isInt32());
+        ASSERT(m_codeBlock->getConstant(FirstConstantRegisterIndex + m_constant1).asInt32() == 1);
+        return getDoubleConstant(1, m_constant1);
+    }
+
+
+    // These methods create a node and add it to the graph. If nodes of this type are
+    // 'mustGenerate' then the node  will implicitly be ref'ed to ensure generation.
+    NodeIndex addToGraph(NodeType op, NodeIndex child1 = NoNode, NodeIndex child2 = NoNode, NodeIndex child3 = NoNode)
+    {
+        NodeIndex resultIndex = (NodeIndex)m_graph.size();
+        m_graph.append(Node(op, m_currentIndex, child1, child2, child3));
+
+        if (op & NodeMustGenerate)
+            m_graph.ref(resultIndex);
+        return resultIndex;
+    }
+    NodeIndex addToGraph(NodeType op, OpInfo info, NodeIndex child1 = NoNode, NodeIndex child2 = NoNode, NodeIndex child3 = NoNode)
+    {
+        NodeIndex resultIndex = (NodeIndex)m_graph.size();
+        m_graph.append(Node(op, m_currentIndex, info, child1, child2, child3));
+
+        if (op & NodeMustGenerate)
+            m_graph.ref(resultIndex);
+        return resultIndex;
+    }
+
+    JSGlobalData* m_globalData;
+    CodeBlock* m_codeBlock;
+    Graph& m_graph;
+
+    // The bytecode index of the current instruction being generated.
+    unsigned m_currentIndex;
+
+    // FIXME: used to temporarily disable arithmetic, until we fix associated performance regressions.
+    bool m_noArithmetic;
+
+    // We use these values during code generation, and to avoid the need for
+    // special handling we make sure they are available as constants in the
+    // CodeBlock's constant pool. These variables are initialized to
+    // UINT_MAX, and lazily updated to hold an index into the CodeBlock's
+    // constant pool, as necessary.
+    unsigned m_constantUndefined;
+    unsigned m_constant1;
+
+    // A constant in the constant pool may be represented by more than one
+    // node in the graph, depending on the context in which it is being used.
+    struct ConstantRecord {
+        ConstantRecord()
+            : asInt32(NoNode)
+            , asNumeric(NoNode)
+            , asJSValue(NoNode)
+        {
+        }
+
+        NodeIndex asInt32;
+        NodeIndex asNumeric;
+        NodeIndex asJSValue;
+    };
+    Vector <ConstantRecord, 32> m_constantRecords;
+
+    // Track the index of the node whose result is the current value for every
+    // register value in the bytecode - argument, local, and temporary.
+    Vector <NodeIndex, 32> m_arguments;
+    Vector <NodeIndex, 32> m_calleeRegisters;
+
+    // These maps are used to unique ToNumber and ToInt32 operations.
+    typedef HashMap<NodeIndex, NodeIndex> UnaryOpMap;
+    UnaryOpMap m_int32ToNumberNodes;
+    UnaryOpMap m_numberToInt32Nodes;
+};
+
+#define NEXT_OPCODE(name) \
+    m_currentIndex += OPCODE_LENGTH(name); \
+    continue;
+
+bool ByteCodeParser::parse()
+{
+    AliasTracker aliases(m_graph);
+
+    Interpreter* interpreter = m_globalData->interpreter;
+    Instruction* instructionsBegin = m_codeBlock->instructions().begin();
+    while (true) {
+        // Switch on the current bytecode opcode.
+        Instruction* currentInstruction = instructionsBegin + m_currentIndex;
+        switch (interpreter->getOpcodeID(currentInstruction->u.opcode)) {
+
+        // === Function entry opcodes ===
+
+        case op_enter:
+            // This is a no-op for now - may need to initialize locals, if
+            // DCE analysis cannot determine that the values are never read.
+            NEXT_OPCODE(op_enter);
+
+        case op_convert_this: {
+            NodeIndex op1 = getThis();
+            setThis(addToGraph(ConvertThis, op1));
+            NEXT_OPCODE(op_convert_this);
+        }
+
+        // === Bitwise operations ===
+
+        case op_bitand: {
+            NodeIndex op1 = getToInt32(currentInstruction[2].u.operand);
+            NodeIndex op2 = getToInt32(currentInstruction[3].u.operand);
+            set(currentInstruction[1].u.operand, addToGraph(BitAnd, op1, op2));
+            NEXT_OPCODE(op_bitand);
+        }
+
+        case op_bitor: {
+            NodeIndex op1 = getToInt32(currentInstruction[2].u.operand);
+            NodeIndex op2 = getToInt32(currentInstruction[3].u.operand);
+            set(currentInstruction[1].u.operand, addToGraph(BitOr, op1, op2));
+            NEXT_OPCODE(op_bitor);
+        }
+
+        case op_bitxor: {
+            NodeIndex op1 = getToInt32(currentInstruction[2].u.operand);
+            NodeIndex op2 = getToInt32(currentInstruction[3].u.operand);
+            set(currentInstruction[1].u.operand, addToGraph(BitXor, op1, op2));
+            NEXT_OPCODE(op_bitxor);
+        }
+
+        case op_rshift: {
+            NodeIndex op1 = getToInt32(currentInstruction[2].u.operand);
+            NodeIndex op2 = getToInt32(currentInstruction[3].u.operand);
+            NodeIndex result;
+            // Optimize out shifts by zero.
+            if (isInt32Constant(op2) && !(valueOfInt32Constant(op2) & 0x1f))
+                result = op1;
+            else
+                result = addToGraph(BitRShift, op1, op2);
+            set(currentInstruction[1].u.operand, result);
+            NEXT_OPCODE(op_rshift);
+        }
+
+        case op_lshift: {
+            NodeIndex op1 = getToInt32(currentInstruction[2].u.operand);
+            NodeIndex op2 = getToInt32(currentInstruction[3].u.operand);
+            NodeIndex result;
+            // Optimize out shifts by zero.
+            if (isInt32Constant(op2) && !(valueOfInt32Constant(op2) & 0x1f))
+                result = op1;
+            else
+                result = addToGraph(BitLShift, op1, op2);
+            set(currentInstruction[1].u.operand, result);
+            NEXT_OPCODE(op_lshift);
+        }
+
+        case op_urshift: {
+            NodeIndex op1 = getToInt32(currentInstruction[2].u.operand);
+            NodeIndex op2 = getToInt32(currentInstruction[3].u.operand);
+            NodeIndex result;
+            // The result of a zero-extending right shift is treated as an unsigned value.
+            // This means that if the top bit is set, the result is not in the int32 range,
+            // and as such must be stored as a double. If the shift amount is a constant,
+            // we may be able to optimize.
+            if (isInt32Constant(op2)) {
+                // If we know we are shifting by a non-zero amount, then since the operation
+                // zero fills we know the top bit of the result must be zero, and as such the
+                // result must be within the int32 range. Conversely, if this is a shift by
+                // zero, then the result may be changed by the conversion to unsigned, but it
+                // is not necessary to perform the shift!
+                if (valueOfInt32Constant(op2) & 0x1f)
+                    result = addToGraph(BitURShift, op1, op2);
+                else
+                    result = addToGraph(UInt32ToNumber, op1);
+            }  else {
+                // Cannot optimize at this stage; shift & potentially rebox as a double.
+                result = addToGraph(BitURShift, op1, op2);
+                result = addToGraph(UInt32ToNumber, result);
+            }
+            set(currentInstruction[1].u.operand, result);
+            NEXT_OPCODE(op_urshift);
+        }
+
+        // === Increment/Decrement opcodes ===
+
+        case op_pre_inc: {
+            unsigned srcDst = currentInstruction[1].u.operand;
+            NodeIndex op = getToNumber(srcDst);
+            set(srcDst, addToGraph(ArithAdd, op, one()));
+            NEXT_OPCODE(op_pre_inc);
+        }
+
+        case op_post_inc: {
+            unsigned result = currentInstruction[1].u.operand;
+            unsigned srcDst = currentInstruction[2].u.operand;
+            NodeIndex op = getToNumber(srcDst);
+            set(result, op);
+            set(srcDst, addToGraph(ArithAdd, op, one()));
+            NEXT_OPCODE(op_post_inc);
+        }
+
+        case op_pre_dec: {
+            unsigned srcDst = currentInstruction[1].u.operand;
+            NodeIndex op = getToNumber(srcDst);
+            set(srcDst, addToGraph(ArithSub, op, one()));
+            NEXT_OPCODE(op_pre_dec);
+        }
+
+        case op_post_dec: {
+            unsigned result = currentInstruction[1].u.operand;
+            unsigned srcDst = currentInstruction[2].u.operand;
+            NodeIndex op = getToNumber(srcDst);
+            set(result, op);
+            set(srcDst, addToGraph(ArithSub, op, one()));
+            NEXT_OPCODE(op_post_dec);
+        }
+
+        // === Arithmetic operations ===
+
+        case op_add: {
+            m_noArithmetic = false;
+            NodeIndex op1 = get(currentInstruction[2].u.operand);
+            NodeIndex op2 = get(currentInstruction[3].u.operand);
+            // If both operands can statically be determined to the numbers, then this is an arithmetic add.
+            // Otherwise, we must assume this may be performing a concatenation to a string.
+            if (m_graph[op1].hasNumericResult() && m_graph[op2].hasNumericResult())
+                set(currentInstruction[1].u.operand, addToGraph(ArithAdd, toNumber(op1), toNumber(op2)));
+            else
+                set(currentInstruction[1].u.operand, addToGraph(ValueAdd, op1, op2));
+            NEXT_OPCODE(op_add);
+        }
+
+        case op_sub: {
+            m_noArithmetic = false;
+            NodeIndex op1 = getToNumber(currentInstruction[2].u.operand);
+            NodeIndex op2 = getToNumber(currentInstruction[3].u.operand);
+            set(currentInstruction[1].u.operand, addToGraph(ArithSub, op1, op2));
+            NEXT_OPCODE(op_sub);
+        }
+
+        case op_mul: {
+            m_noArithmetic = false;
+            NodeIndex op1 = getToNumber(currentInstruction[2].u.operand);
+            NodeIndex op2 = getToNumber(currentInstruction[3].u.operand);
+            set(currentInstruction[1].u.operand, addToGraph(ArithMul, op1, op2));
+            NEXT_OPCODE(op_mul);
+        }
+
+        case op_mod: {
+            m_noArithmetic = false;
+            NodeIndex op1 = getToNumber(currentInstruction[2].u.operand);
+            NodeIndex op2 = getToNumber(currentInstruction[3].u.operand);
+            set(currentInstruction[1].u.operand, addToGraph(ArithMod, op1, op2));
+            NEXT_OPCODE(op_mod);
+        }
+
+        case op_div: {
+            m_noArithmetic = false;
+            NodeIndex op1 = getToNumber(currentInstruction[2].u.operand);
+            NodeIndex op2 = getToNumber(currentInstruction[3].u.operand);
+            set(currentInstruction[1].u.operand, addToGraph(ArithDiv, op1, op2));
+            NEXT_OPCODE(op_div);
+        }
+
+        // === Misc operations ===
+
+        case op_mov: {
+            NodeIndex op = get(currentInstruction[2].u.operand);
+            set(currentInstruction[1].u.operand, op);
+            NEXT_OPCODE(op_mov);
+        }
+
+        // === Property access operations ===
+
+        case op_get_by_val: {
+            NodeIndex base = get(currentInstruction[2].u.operand);
+            NodeIndex property = get(currentInstruction[3].u.operand);
+
+            NodeIndex getByVal = addToGraph(GetByVal, base, property, aliases.lookupGetByVal(base, property));
+            set(currentInstruction[1].u.operand, getByVal);
+            aliases.recordGetByVal(getByVal);
+
+            NEXT_OPCODE(op_get_by_val);
+        };
+
+        case op_put_by_val: {
+            NodeIndex base = get(currentInstruction[1].u.operand);
+            NodeIndex property = get(currentInstruction[2].u.operand);
+            NodeIndex value = get(currentInstruction[3].u.operand);
+
+            NodeIndex aliasedGet = aliases.lookupGetByVal(base, property);
+            NodeIndex putByVal = addToGraph(aliasedGet != NoNode ? PutByValAlias : PutByVal, base, property, value);
+            aliases.recordPutByVal(putByVal);
+
+            NEXT_OPCODE(op_put_by_val);
+        };
+
+        case op_get_by_id: {
+            NodeIndex base = get(currentInstruction[2].u.operand);
+            unsigned identifier = currentInstruction[3].u.operand;
+
+            NodeIndex getById = addToGraph(GetById, OpInfo(identifier), base);
+            set(currentInstruction[1].u.operand, getById);
+            aliases.recordGetById(getById);
+
+            NEXT_OPCODE(op_get_by_id);
+        }
+
+        case op_put_by_id: {
+            NodeIndex value = get(currentInstruction[3].u.operand);
+            NodeIndex base = get(currentInstruction[1].u.operand);
+            unsigned identifier = currentInstruction[2].u.operand;
+            bool direct = currentInstruction[8].u.operand;
+
+            if (direct) {
+                NodeIndex putByIdDirect = addToGraph(PutByIdDirect, OpInfo(identifier), base, value);
+                aliases.recordPutByIdDirect(putByIdDirect);
+            } else {
+                NodeIndex putById = addToGraph(PutById, OpInfo(identifier), base, value);
+                aliases.recordPutById(putById);
+            }
+
+            NEXT_OPCODE(op_put_by_id);
+        }
+
+        case op_get_global_var: {
+            NodeIndex getGlobalVar = addToGraph(GetGlobalVar, OpInfo(currentInstruction[2].u.operand));
+            set(currentInstruction[1].u.operand, getGlobalVar);
+            NEXT_OPCODE(op_get_global_var);
+        }
+
+        case op_put_global_var: {
+            NodeIndex value = get(currentInstruction[2].u.operand);
+            addToGraph(PutGlobalVar, OpInfo(currentInstruction[1].u.operand), value);
+            NEXT_OPCODE(op_put_global_var);
+        }
+
+        // === Block terminators. ===
+
+        case op_ret: {
+            addToGraph(Return, get(currentInstruction[1].u.operand));
+            m_currentIndex += OPCODE_LENGTH(op_ret);
+#if ENABLE(DFG_JIT_RESTRICTIONS)
+            // FIXME: temporarily disabling the DFG JIT for functions containing arithmetic.
+            return m_noArithmetic;
+#else
+            return true;
+#endif
+        }
+
+        default:
+            // parse failed!
+            return false;
+        }
+    }
+}
+
+bool parse(Graph& graph, JSGlobalData* globalData, CodeBlock* codeBlock)
+{
+    // Call ByteCodeParser::parse to build the dataflow for the basic block at 'startIndex'.
+    ByteCodeParser state(globalData, codeBlock, graph);
+    if (!state.parse())
+        return false;
+
+    // Assign VirtualRegisters.
+    ScoreBoard scoreBoard(graph);
+    Node* nodes = graph.begin();
+    size_t size = graph.size();
+    for (size_t i = 0; i < size; ++i) {
+        Node& node = nodes[i];
+        if (node.refCount) {
+            // First, call use on all of the current node's children, then
+            // allocate a VirtualRegister for this node. We do so in this
+            // order so that if a child is on its last use, and a
+            // VirtualRegister is freed, then it may be reused for node.
+            scoreBoard.use(node.child1);
+            scoreBoard.use(node.child2);
+            scoreBoard.use(node.child3);
+            node.virtualRegister = scoreBoard.allocate();
+            // 'mustGenerate' nodes have their useCount artificially elevated,
+            // call use now to account for this.
+            if (node.mustGenerate())
+                scoreBoard.use(i);
+        }
+    }
+
+    // 'm_numCalleeRegisters' is the number of locals and temporaries allocated
+    // for the function (and checked for on entry). Since we perform a new and
+    // different allocation of temporaries, more registers may now be required.
+    if ((unsigned)codeBlock->m_numCalleeRegisters < scoreBoard.allocatedCount())
+        codeBlock->m_numCalleeRegisters = scoreBoard.allocatedCount();
+
+#if DFG_DEBUG_VERBOSE
+    graph.dump(codeBlock);
+#endif
+    return true;
+}
+
+} } // namespace JSC::DFG
+
+#endif
diff --git a/Source/JavaScriptCore/dfg/DFGByteCodeParser.h b/Source/JavaScriptCore/dfg/DFGByteCodeParser.h
new file mode 100644
index 0000000..d4efe61
--- /dev/null
+++ b/Source/JavaScriptCore/dfg/DFGByteCodeParser.h
@@ -0,0 +1,47 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef DFGByteCodeParser_h
+#define DFGByteCodeParser_h
+
+#if ENABLE(DFG_JIT)
+
+#include <dfg/DFGGraph.h>
+
+namespace JSC {
+
+class CodeBlock;
+class JSGlobalData;
+
+namespace DFG {
+
+// Populate the Graph with a basic block of code from the CodeBlock,
+// starting at the provided bytecode index.
+bool parse(Graph&, JSGlobalData*, CodeBlock*);
+
+} } // namespace JSC::DFG
+
+#endif
+#endif
diff --git a/Source/JavaScriptCore/dfg/DFGGenerationInfo.h b/Source/JavaScriptCore/dfg/DFGGenerationInfo.h
new file mode 100644
index 0000000..b3aa0cd
--- /dev/null
+++ b/Source/JavaScriptCore/dfg/DFGGenerationInfo.h
@@ -0,0 +1,249 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef DFGGenerationInfo_h
+#define DFGGenerationInfo_h
+
+#if ENABLE(DFG_JIT)
+
+#include <dfg/DFGJITCompiler.h>
+
+namespace JSC { namespace DFG {
+
+// === DataFormat ===
+//
+// This enum tracks the current representation in which a value is being held.
+// Values may be unboxed primitives (int32, double, or cell), or boxed as a JSValue.
+// For boxed values, we may know the type of boxing that has taken place.
+// (May also need bool, array, object, string types!)
+enum DataFormat {
+    DataFormatNone = 0,
+    DataFormatInteger = 1,
+    DataFormatDouble = 2,
+    DataFormatCell = 3,
+    DataFormatJS = 8,
+    DataFormatJSInteger = DataFormatJS | DataFormatInteger,
+    DataFormatJSDouble = DataFormatJS | DataFormatDouble,
+    DataFormatJSCell = DataFormatJS | DataFormatCell,
+};
+
+// === GenerationInfo ===
+//
+// This class is used to track the current status of a live values during code generation.
+// Can provide information as to whether a value is in machine registers, and if so which,
+// whether a value has been spilled to the RegsiterFile, and if so may be able to provide
+// details of the format in memory (all values are spilled in a boxed form, but we may be
+// able to track the type of box), and tracks how many outstanding uses of a value remain,
+// so that we know when the value is dead and the machine registers associated with it
+// may be released.
+class GenerationInfo {
+public:
+    GenerationInfo()
+        : m_nodeIndex(NoNode)
+        , m_useCount(0)
+        , m_registerFormat(DataFormatNone)
+        , m_spillFormat(DataFormatNone)
+        , m_canFill(false)
+    {
+    }
+
+    // Used to set the generation info according the the result
+    // of various operations.
+    void initArgument(NodeIndex nodeIndex, uint32_t useCount)
+    {
+        m_nodeIndex = nodeIndex;
+        m_useCount = useCount;
+        m_registerFormat = DataFormatNone;
+        m_spillFormat = DataFormatNone;
+        m_canFill = true;
+    }
+    void initConstant(NodeIndex nodeIndex, uint32_t useCount)
+    {
+        m_nodeIndex = nodeIndex;
+        m_useCount = useCount;
+        m_registerFormat = DataFormatNone;
+        m_spillFormat = DataFormatNone;
+        m_canFill = true;
+    }
+    void initInteger(NodeIndex nodeIndex, uint32_t useCount, GPRReg gpr)
+    {
+        m_nodeIndex = nodeIndex;
+        m_useCount = useCount;
+        m_registerFormat = DataFormatInteger;
+        m_spillFormat = DataFormatNone;
+        m_canFill = false;
+        u.gpr = gpr;
+    }
+    void initJSValue(NodeIndex nodeIndex, uint32_t useCount, GPRReg gpr, DataFormat format = DataFormatJS)
+    {
+        ASSERT(format & DataFormatJS);
+
+        m_nodeIndex = nodeIndex;
+        m_useCount = useCount;
+        m_registerFormat = format;
+        m_spillFormat = DataFormatNone;
+        m_canFill = false;
+        u.gpr = gpr;
+    }
+    void initCell(NodeIndex nodeIndex, uint32_t useCount, GPRReg gpr)
+    {
+        m_nodeIndex = nodeIndex;
+        m_useCount = useCount;
+        m_registerFormat = DataFormatCell;
+        m_spillFormat = DataFormatNone;
+        m_canFill = false;
+        u.gpr = gpr;
+    }
+    void initDouble(NodeIndex nodeIndex, uint32_t useCount, FPRReg fpr)
+    {
+        m_nodeIndex = nodeIndex;
+        m_useCount = useCount;
+        m_registerFormat = DataFormatDouble;
+        m_spillFormat = DataFormatNone;
+        m_canFill = false;
+        u.fpr = fpr;
+    }
+    void initNone(NodeIndex nodeIndex, uint32_t useCount)
+    {
+        m_nodeIndex = nodeIndex;
+        m_useCount = useCount;
+        m_registerFormat = DataFormatNone;
+        m_spillFormat = DataFormatNone;
+        m_canFill = false;
+    }
+
+    // Get the index of the node that produced this value.
+    NodeIndex nodeIndex() { return m_nodeIndex; }
+
+    // Mark the value as having been used (decrement the useCount).
+    // Returns true if this was the last use of the value, and any
+    // associated machine registers may be freed.
+    bool use()
+    {
+        return !--m_useCount;
+    }
+
+    // Used to check the operands of operations to see if they are on
+    // their last use; in some cases it may be safe to reuse the same
+    // machine register for the result of the operation.
+    bool canReuse()
+    {
+        ASSERT(m_useCount);
+        return m_useCount == 1;
+    }
+
+    // Get the format of the value in machine registers (or 'none').
+    DataFormat registerFormat() { return m_registerFormat; }
+    // Get the format of the value as it is spilled in the RegisterFile (or 'none').
+    DataFormat spillFormat() { return m_spillFormat; }
+
+    // Get the machine resister currently holding the value.
+    GPRReg gpr() { ASSERT(m_registerFormat && m_registerFormat != DataFormatDouble); return u.gpr; }
+    FPRReg fpr() { ASSERT(m_registerFormat == DataFormatDouble); return u.fpr; }
+
+    // Check whether a value needs spilling in order to free up any associated machine registers.
+    bool needsSpill()
+    {
+        // This should only be called on values that are currently in a register.
+        ASSERT(m_registerFormat != DataFormatNone);
+        // Constants and arguments do not need spilling, nor do values
+        // that have already been spilled to the RegisterFile.
+        return !m_canFill;
+    }
+
+    // Called when a VirtualRegister is being spilled †o the RegisterFile for the first time.
+    void spill(DataFormat spillFormat)
+    {
+        // We shouldn't be spill values that don't need spilling.
+        ASSERT(!m_canFill);
+        ASSERT(m_spillFormat == DataFormatNone);
+        // We should only be spilling values that are currently in machine registers.
+        ASSERT(m_registerFormat != DataFormatNone);
+        // We only spill values that have been boxed as a JSValue; otherwise the GC
+        // would need a way to distinguish cell pointers from numeric primitives.
+        ASSERT(spillFormat & DataFormatJS);
+
+        m_registerFormat = DataFormatNone;
+        m_spillFormat = spillFormat;
+        m_canFill = true;
+    }
+
+    // Called on values that don't need spilling (constants, arguments,
+    // values that have already been spilled), to mark them as no longer
+    // being in machine registers.
+    void setSpilled()
+    {
+        // Should only be called on values that don't need spilling, and are currently in registers.
+        ASSERT(m_canFill && m_registerFormat != DataFormatNone);
+        m_registerFormat = DataFormatNone;
+    }
+
+    // Record that this value is filled into machine registers,
+    // tracking which registers, and what format the value has.
+    void fillJSValue(GPRReg gpr, DataFormat format = DataFormatJS)
+    {
+        ASSERT(format & DataFormatJS);
+        m_registerFormat = format;
+        u.gpr = gpr;
+    }
+    void fillInteger(GPRReg gpr)
+    {
+        m_registerFormat = DataFormatInteger;
+        u.gpr = gpr;
+    }
+    void fillDouble(FPRReg fpr)
+    {
+        m_registerFormat = DataFormatDouble;
+        u.fpr = fpr;
+    }
+
+#ifndef NDEBUG
+    bool alive()
+    {
+        return m_useCount;
+    }
+#endif
+
+private:
+    // The index of the node whose result is stored in this virtual register.
+    // FIXME: Can we remove this? - this is currently only used when collecting
+    // snapshots of the RegisterBank for SpeculationCheck/EntryLocation. Could
+    // investigate storing NodeIndex as the name in RegsiterBank, instead of
+    // VirtualRegister.
+    NodeIndex m_nodeIndex;
+    uint32_t m_useCount;
+    DataFormat m_registerFormat;
+    DataFormat m_spillFormat;
+    bool m_canFill;
+    union {
+        GPRReg gpr;
+        FPRReg fpr;
+    } u;
+};
+
+} } // namespace JSC::DFG
+
+#endif
+#endif
diff --git a/Source/JavaScriptCore/dfg/DFGGraph.cpp b/Source/JavaScriptCore/dfg/DFGGraph.cpp
new file mode 100644
index 0000000..be3beec
--- /dev/null
+++ b/Source/JavaScriptCore/dfg/DFGGraph.cpp
@@ -0,0 +1,141 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGGraph.h"
+
+#include "CodeBlock.h"
+
+#if ENABLE(DFG_JIT)
+
+namespace JSC { namespace DFG {
+
+#ifndef NDEBUG
+void Graph::dump(CodeBlock* codeBlock)
+{
+    // Creates an array of stringized names.
+#define STRINGIZE_DFG_OP_ENUM(opcode, flags) #opcode ,
+    const char* dfgOpNames[] = {
+        FOR_EACH_DFG_OP(STRINGIZE_DFG_OP_ENUM)
+    };
+#undef STRINGIZE_DFG_OP_ENUM
+
+    Node* nodes = this->begin();
+
+    for (size_t i = 0; i < size(); ++i) {
+        Node& node = nodes[i];
+        NodeType op = node.op;
+
+        unsigned refCount = node.refCount;
+        if (!refCount)
+            continue;
+        bool mustGenerate = node.mustGenerate();
+        if (mustGenerate)
+            --refCount;
+
+        // Example/explanation of dataflow dump output
+        //
+        //   14:   <!2:7>  GetByVal(@3, @13)
+        //   ^1     ^2 ^3     ^4       ^5
+        //
+        // (1) The nodeIndex of this operation.
+        // (2) The reference count. The number printed is the 'real' count,
+        //     not including the 'mustGenerate' ref. If the node is
+        //     'mustGenerate' then the count it prefixed with '!'.
+        // (3) The virtual register slot assigned to this node.
+        // (4) The name of the operation.
+        // (5) The arguments to the operation. The may be of the form:
+        //         @#   - a NodeIndex referencing a prior node in the graph.
+        //         arg# - an argument number.
+        //         $#   - the index in the CodeBlock of a constant { for numeric constants the value is displayed | for integers, in both decimal and hex }.
+        //         id#  - the index in the CodeBlock of an identifier { if codeBlock is passed to dump(), the string representation is displayed }.
+        //         var# - the index of a var on the global object, used by GetGlobalVar/PutGlobalVar operations.
+        printf("% 4d:\t<%c%u:%u>\t%s(", (int)i, mustGenerate ? '!' : ' ', refCount, node.virtualRegister, dfgOpNames[op & NodeIdMask]);
+        if (node.child1 != NoNode)
+            printf("@%u", node.child1);
+        if (node.child2 != NoNode)
+            printf(", @%u", node.child2);
+        if (node.child3 != NoNode)
+            printf(", @%u", node.child3);
+        bool hasPrinted = node.child1 != NoNode;
+
+        if (node.hasVarNumber()) {
+            printf("%svar%u", hasPrinted ? ", " : "", node.varNumber());
+            hasPrinted = true;
+        }
+        if (node.hasIdentifier()) {
+            if (codeBlock)
+                printf("%sid%u{%s}", hasPrinted ? ", " : "", node.identifierNumber(), codeBlock->identifier(node.identifierNumber()).ustring().utf8().data());
+            else
+                printf("%sid%u", hasPrinted ? ", " : "", node.identifierNumber());
+            hasPrinted = true;
+        }
+        if (node.isArgument()) {
+            printf("%sarg%u", hasPrinted ? ", " : "", node.argumentNumber());
+            hasPrinted = true;
+        }
+        if (op == Int32Constant) {
+            printf("%s$%u{%d|0x%08x}", hasPrinted ? ", " : "", node.constantNumber(), node.int32Constant(), node.int32Constant());
+            hasPrinted = true;
+        }
+        if (op == DoubleConstant) {
+            printf("%s$%u{%f})", hasPrinted ? ", " : "", node.constantNumber(), node.numericConstant());
+            hasPrinted = true;
+        }
+        if (op == JSConstant) {
+            printf("%s$%u", hasPrinted ? ", " : "", node.constantNumber());
+            hasPrinted = true;
+        }
+
+        printf(")\n");
+    }
+}
+#endif
+
+// FIXME: Convert this method to be iterative, not recursive.
+void Graph::refChildren(NodeIndex op)
+{
+    Node& node = at(op);
+
+    if (node.child1 == NoNode) {
+        ASSERT(node.child2 == NoNode && node.child3 == NoNode);
+        return;
+    }
+    ref(node.child1);
+
+    if (node.child2 == NoNode) {
+        ASSERT(node.child3 == NoNode);
+        return;
+    }
+    ref(node.child2);
+
+    if (node.child3 == NoNode)
+        return;
+    ref(node.child3);
+}
+
+} } // namespace JSC::DFG
+
+#endif
diff --git a/Source/JavaScriptCore/dfg/DFGGraph.h b/Source/JavaScriptCore/dfg/DFGGraph.h
new file mode 100644
index 0000000..c02110e
--- /dev/null
+++ b/Source/JavaScriptCore/dfg/DFGGraph.h
@@ -0,0 +1,69 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef DFGGraph_h
+#define DFGGraph_h
+
+#if ENABLE(DFG_JIT)
+
+#include <dfg/DFGNode.h>
+#include <wtf/Vector.h>
+
+namespace JSC {
+
+class CodeBlock;
+
+namespace DFG {
+
+// 
+// === Graph ===
+//
+// The dataflow graph is an ordered vector of nodes.
+// The order may be significant for nodes with side-effects (property accesses, value conversions).
+// Nodes that are 'dead' remain in the vector with refCount 0.
+class Graph : public Vector<Node, 64> {
+public:
+    // Mark a node as being referenced.
+    void ref(NodeIndex nodeIndex)
+    {
+        // If the value (before incrementing) was at reCount zero then we need to ref its children.
+        if (!at(nodeIndex).refCount++)
+            refChildren(nodeIndex);
+    }
+
+#ifndef NDEBUG
+    // CodeBlock is optional, but may allow additional information to be dumped (e.g. Identifier names).
+    void dump(CodeBlock* = 0);
+#endif
+
+private:
+    // When a node's refCount goes from 0 to 1, it must (logically) recursively ref all of its children.
+    void refChildren(NodeIndex);
+};
+
+} } // namespace JSC::DFG
+
+#endif
+#endif
diff --git a/Source/JavaScriptCore/dfg/DFGJITCodeGenerator.cpp b/Source/JavaScriptCore/dfg/DFGJITCodeGenerator.cpp
new file mode 100644
index 0000000..b945b5a
--- /dev/null
+++ b/Source/JavaScriptCore/dfg/DFGJITCodeGenerator.cpp
@@ -0,0 +1,563 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGJITCodeGenerator.h"
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGNonSpeculativeJIT.h"
+#include "DFGSpeculativeJIT.h"
+#include "LinkBuffer.h"
+
+namespace JSC { namespace DFG {
+
+GPRReg JITCodeGenerator::fillInteger(NodeIndex nodeIndex, DataFormat& returnFormat)
+{
+    Node& node = m_jit.graph()[nodeIndex];
+    VirtualRegister virtualRegister = node.virtualRegister;
+    GenerationInfo& info = m_generationInfo[virtualRegister];
+
+    if (info.registerFormat() == DataFormatNone) {
+        GPRReg gpr = allocate();
+        JITCompiler::RegisterID reg = JITCompiler::gprToRegisterID(gpr);
+
+        if (node.isConstant()) {
+            m_gprs.retain(gpr, virtualRegister, SpillOrderConstant);
+            if (isInt32Constant(nodeIndex)) {
+                m_jit.move(MacroAssembler::Imm32(valueOfInt32Constant(nodeIndex)), reg);
+                info.fillInteger(gpr);
+                returnFormat = DataFormatInteger;
+                return gpr;
+            }
+            if (isDoubleConstant(nodeIndex)) {
+                JSValue jsValue = jsNumber(valueOfDoubleConstant(nodeIndex));
+                m_jit.move(MacroAssembler::ImmPtr(JSValue::encode(jsValue)), reg);
+            } else {
+                ASSERT(isJSConstant(nodeIndex));
+                JSValue jsValue = valueOfJSConstant(nodeIndex);
+                m_jit.move(MacroAssembler::ImmPtr(JSValue::encode(jsValue)), reg);
+            }
+        } else if (node.isArgument()) {
+            m_gprs.retain(gpr, virtualRegister, SpillOrderArgument);
+            m_jit.loadPtr(m_jit.addressForArgument(m_jit.graph()[nodeIndex].argumentNumber()), reg);
+        } else {
+            ASSERT(info.spillFormat() == DataFormatJS || info.spillFormat() == DataFormatJSInteger);
+            m_gprs.retain(gpr, virtualRegister, SpillOrderSpilled);
+            m_jit.loadPtr(JITCompiler::addressFor(virtualRegister), reg);
+        }
+
+        // Since we statically know that we're filling an integer, and values
+        // in the RegisterFile are boxed, this must be DataFormatJSInteger.
+        // We will check this with a jitAssert below.
+        info.fillJSValue(gpr, DataFormatJSInteger);
+        unlock(gpr);
+    }
+
+    switch (info.registerFormat()) {
+    case DataFormatNone:
+        // Should have filled, above.
+    case DataFormatJSDouble:
+    case DataFormatDouble:
+    case DataFormatJS:
+    case DataFormatCell:
+    case DataFormatJSCell:
+        // Should only be calling this function if we know this operand to be integer.
+        ASSERT_NOT_REACHED();
+
+    case DataFormatJSInteger: {
+        GPRReg gpr = info.gpr();
+        m_gprs.lock(gpr);
+        m_jit.jitAssertIsJSInt32(gpr);
+        returnFormat = DataFormatJSInteger;
+        return gpr;
+    }
+
+    case DataFormatInteger: {
+        GPRReg gpr = info.gpr();
+        m_gprs.lock(gpr);
+        m_jit.jitAssertIsInt32(gpr);
+        returnFormat = DataFormatInteger;
+        return gpr;
+    }
+    }
+
+    ASSERT_NOT_REACHED();
+    return InvalidGPRReg;
+}
+
+FPRReg JITCodeGenerator::fillDouble(NodeIndex nodeIndex)
+{
+    Node& node = m_jit.graph()[nodeIndex];
+    VirtualRegister virtualRegister = node.virtualRegister;
+    GenerationInfo& info = m_generationInfo[virtualRegister];
+
+    if (info.registerFormat() == DataFormatNone) {
+        GPRReg gpr = allocate();
+        JITCompiler::RegisterID reg = JITCompiler::gprToRegisterID(gpr);
+
+        if (node.isConstant()) {
+            if (isInt32Constant(nodeIndex)) {
+                // FIXME: should not be reachable?
+                m_jit.move(MacroAssembler::Imm32(valueOfInt32Constant(nodeIndex)), reg);
+                m_gprs.retain(gpr, virtualRegister, SpillOrderConstant);
+                info.fillInteger(gpr);
+                unlock(gpr);
+            } else if (isDoubleConstant(nodeIndex)) {
+                FPRReg fpr = fprAllocate();
+                m_jit.move(MacroAssembler::ImmPtr(reinterpret_cast<void*>(reinterpretDoubleToIntptr(valueOfDoubleConstant(nodeIndex)))), reg);
+                m_jit.movePtrToDouble(reg, JITCompiler::fprToRegisterID(fpr));
+                unlock(gpr);
+
+                m_fprs.retain(fpr, virtualRegister, SpillOrderDouble);
+                info.fillDouble(fpr);
+                return fpr;
+            } else {
+                // FIXME: should not be reachable?
+                ASSERT(isJSConstant(nodeIndex));
+                JSValue jsValue = valueOfJSConstant(nodeIndex);
+                m_jit.move(MacroAssembler::ImmPtr(JSValue::encode(jsValue)), reg);
+                m_gprs.retain(gpr, virtualRegister, SpillOrderConstant);
+                info.fillJSValue(gpr, DataFormatJS);
+                unlock(gpr);
+            }
+        } else if (node.isArgument()) {
+            m_gprs.retain(gpr, virtualRegister, SpillOrderArgument);
+            m_jit.loadPtr(m_jit.addressForArgument(m_jit.graph()[nodeIndex].argumentNumber()), reg);
+            info.fillJSValue(gpr, DataFormatJS);
+            unlock(gpr);
+        } else {
+            DataFormat spillFormat = info.spillFormat();
+            ASSERT(spillFormat & DataFormatJS);
+            m_gprs.retain(gpr, virtualRegister, SpillOrderSpilled);
+            m_jit.loadPtr(JITCompiler::addressFor(virtualRegister), reg);
+            info.fillJSValue(gpr, m_isSpeculative ? spillFormat : DataFormatJS);
+            unlock(gpr);
+        }
+    }
+
+    switch (info.registerFormat()) {
+    case DataFormatNone:
+        // Should have filled, above.
+    case DataFormatCell:
+    case DataFormatJSCell:
+        // Should only be calling this function if we know this operand to be numeric.
+        ASSERT_NOT_REACHED();
+
+    case DataFormatJS: {
+        GPRReg jsValueGpr = info.gpr();
+        m_gprs.lock(jsValueGpr);
+        FPRReg fpr = fprAllocate();
+        GPRReg tempGpr = allocate(); // FIXME: can we skip this allocation on the last use of the virtual register?
+
+        JITCompiler::RegisterID jsValueReg = JITCompiler::gprToRegisterID(jsValueGpr);
+        JITCompiler::FPRegisterID fpReg = JITCompiler::fprToRegisterID(fpr);
+        JITCompiler::RegisterID tempReg = JITCompiler::gprToRegisterID(tempGpr);
+
+        JITCompiler::Jump isInteger = m_jit.branchPtr(MacroAssembler::AboveOrEqual, jsValueReg, JITCompiler::tagTypeNumberRegister);
+
+        m_jit.jitAssertIsJSDouble(jsValueGpr);
+
+        // First, if we get here we have a double encoded as a JSValue
+        m_jit.move(jsValueReg, tempReg);
+        m_jit.addPtr(JITCompiler::tagTypeNumberRegister, tempReg);
+        m_jit.movePtrToDouble(tempReg, fpReg);
+        JITCompiler::Jump hasUnboxedDouble = m_jit.jump();
+
+        // Finally, handle integers.
+        isInteger.link(&m_jit);
+        m_jit.convertInt32ToDouble(jsValueReg, fpReg);
+        hasUnboxedDouble.link(&m_jit);
+
+        m_gprs.release(jsValueGpr);
+        m_gprs.unlock(jsValueGpr);
+        m_gprs.unlock(tempGpr);
+        m_fprs.retain(fpr, virtualRegister, SpillOrderDouble);
+        info.fillDouble(fpr);
+        return fpr;
+    }
+
+    case DataFormatJSInteger:
+    case DataFormatInteger: {
+        FPRReg fpr = fprAllocate();
+        GPRReg gpr = info.gpr();
+        m_gprs.lock(gpr);
+        JITCompiler::RegisterID reg = JITCompiler::gprToRegisterID(gpr);
+        JITCompiler::FPRegisterID fpReg = JITCompiler::fprToRegisterID(fpr);
+
+        m_jit.convertInt32ToDouble(reg, fpReg);
+
+        m_gprs.release(gpr);
+        m_gprs.unlock(gpr);
+        m_fprs.retain(fpr, virtualRegister, SpillOrderDouble);
+        info.fillDouble(fpr);
+        return fpr;
+    }
+
+    // Unbox the double
+    case DataFormatJSDouble: {
+        GPRReg gpr = info.gpr();
+        FPRReg fpr = unboxDouble(gpr);
+
+        m_gprs.release(gpr);
+        m_fprs.retain(fpr, virtualRegister, SpillOrderDouble);
+
+        info.fillDouble(fpr);
+        return fpr;
+    }
+
+    case DataFormatDouble: {
+        FPRReg fpr = info.fpr();
+        m_fprs.lock(fpr);
+        return fpr;
+    }
+    }
+
+    ASSERT_NOT_REACHED();
+    return InvalidFPRReg;
+}
+
+GPRReg JITCodeGenerator::fillJSValue(NodeIndex nodeIndex)
+{
+    Node& node = m_jit.graph()[nodeIndex];
+    VirtualRegister virtualRegister = node.virtualRegister;
+    GenerationInfo& info = m_generationInfo[virtualRegister];
+
+    switch (info.registerFormat()) {
+    case DataFormatNone: {
+        GPRReg gpr = allocate();
+        JITCompiler::RegisterID reg = JITCompiler::gprToRegisterID(gpr);
+
+        if (node.isConstant()) {
+            if (isInt32Constant(nodeIndex)) {
+                info.fillJSValue(gpr, DataFormatJSInteger);
+                JSValue jsValue = jsNumber(valueOfInt32Constant(nodeIndex));
+                m_jit.move(MacroAssembler::ImmPtr(JSValue::encode(jsValue)), reg);
+            } else if (isDoubleConstant(nodeIndex)) {
+                info.fillJSValue(gpr, DataFormatJSDouble);
+                JSValue jsValue(JSValue::EncodeAsDouble, valueOfDoubleConstant(nodeIndex));
+                m_jit.move(MacroAssembler::ImmPtr(JSValue::encode(jsValue)), reg);
+            } else {
+                ASSERT(isJSConstant(nodeIndex));
+                JSValue jsValue = valueOfJSConstant(nodeIndex);
+                m_jit.move(MacroAssembler::ImmPtr(JSValue::encode(jsValue)), reg);
+                info.fillJSValue(gpr, DataFormatJS);
+            }
+
+            m_gprs.retain(gpr, virtualRegister, SpillOrderConstant);
+        } else if (node.isArgument()) {
+            m_gprs.retain(gpr, virtualRegister, SpillOrderArgument);
+            m_jit.loadPtr(m_jit.addressForArgument(m_jit.graph()[nodeIndex].argumentNumber()), reg);
+            info.fillJSValue(gpr, DataFormatJS);
+        } else {
+            DataFormat spillFormat = info.spillFormat();
+            ASSERT(spillFormat & DataFormatJS);
+            m_gprs.retain(gpr, virtualRegister, SpillOrderSpilled);
+            m_jit.loadPtr(JITCompiler::addressFor(virtualRegister), reg);
+            info.fillJSValue(gpr, m_isSpeculative ? spillFormat : DataFormatJS);
+        }
+        return gpr;
+    }
+
+    case DataFormatInteger: {
+        GPRReg gpr = info.gpr();
+        m_gprs.lock(gpr);
+        m_jit.orPtr(JITCompiler::tagTypeNumberRegister, JITCompiler::gprToRegisterID(gpr));
+        info.fillJSValue(gpr, DataFormatJSInteger);
+        return gpr;
+    }
+
+    case DataFormatDouble: {
+        FPRReg fpr = info.fpr();
+        GPRReg gpr = boxDouble(fpr);
+
+        // Update all info
+        info.fillJSValue(gpr, DataFormatJSDouble);
+        m_fprs.release(fpr);
+        m_gprs.retain(gpr, virtualRegister, SpillOrderJS);
+
+        return gpr;
+    }
+
+    case DataFormatCell:
+        // No retag required on JSVALUE64!
+    case DataFormatJS:
+    case DataFormatJSInteger:
+    case DataFormatJSDouble:
+    case DataFormatJSCell: {
+        GPRReg gpr = info.gpr();
+        m_gprs.lock(gpr);
+        return gpr;
+    }
+    }
+
+    ASSERT_NOT_REACHED();
+    return InvalidGPRReg;
+}
+
+void JITCodeGenerator::useChildren(Node& node)
+{
+    NodeIndex child1 = node.child1;
+    if (child1 == NoNode) {
+        ASSERT(node.child2 == NoNode && node.child3 == NoNode);
+        return;
+    }
+    use(child1);
+
+    NodeIndex child2 = node.child2;
+    if (child2 == NoNode) {
+        ASSERT(node.child3 == NoNode);
+        return;
+    }
+    use(child2);
+
+    NodeIndex child3 = node.child3;
+    if (child3 == NoNode)
+        return;
+    use(child3);
+}
+
+#ifndef NDEBUG
+static const char* dataFormatString(DataFormat format)
+{
+    // These values correspond to the DataFormat enum.
+    const char* strings[] = {
+        "[  ]",
+        "[ i]",
+        "[ d]",
+        "[ c]",
+        "Err!",
+        "Err!",
+        "Err!",
+        "Err!",
+        "[J ]",
+        "[Ji]",
+        "[Jd]",
+        "[Jc]",
+        "Err!",
+        "Err!",
+        "Err!",
+        "Err!",
+    };
+    return strings[format];
+}
+
+void JITCodeGenerator::dump(const char* label)
+{
+    if (label)
+        fprintf(stderr, "<%s>\n", label);
+
+    fprintf(stderr, "  gprs:\n");
+    m_gprs.dump();
+    fprintf(stderr, "  fprs:\n");
+    m_fprs.dump();
+    fprintf(stderr, "  VirtualRegisters:\n");
+    for (unsigned i = 0; i < m_generationInfo.size(); ++i) {
+        GenerationInfo& info = m_generationInfo[i];
+        if (info.alive())
+            fprintf(stderr, "    % 3d:%s%s\n", i, dataFormatString(info.registerFormat()), dataFormatString(info.spillFormat()));
+        else
+            fprintf(stderr, "    % 3d:[__][__]\n", i);
+    }
+    if (label)
+        fprintf(stderr, "</%s>\n", label);
+}
+#endif
+
+
+#if DFG_CONSISTENCY_CHECK
+void JITCodeGenerator::checkConsistency()
+{
+    VirtualRegister grpContents[numberOfGPRs];
+    VirtualRegister frpContents[numberOfFPRs];
+
+    for (unsigned i = 0; i < numberOfGPRs; ++i)
+        grpContents[i] = InvalidVirtualRegister;
+    for (unsigned i = 0; i < numberOfFPRs; ++i)
+        frpContents[i] = InvalidVirtualRegister;
+    for (unsigned i = 0; i < m_generationInfo.size(); ++i) {
+        GenerationInfo& info = m_generationInfo[i];
+        if (!info.alive())
+            continue;
+        switch (info.registerFormat()) {
+        case DataFormatNone:
+            break;
+        case DataFormatInteger:
+        case DataFormatCell:
+        case DataFormatJS:
+        case DataFormatJSInteger:
+        case DataFormatJSDouble:
+        case DataFormatJSCell: {
+            GPRReg gpr = info.gpr();
+            ASSERT(gpr != InvalidGPRReg);
+            grpContents[gpr] = (VirtualRegister)i;
+            break;
+        }
+        case DataFormatDouble: {
+            FPRReg fpr = info.fpr();
+            ASSERT(fpr != InvalidFPRReg);
+            frpContents[fpr] = (VirtualRegister)i;
+            break;
+        }
+        }
+    }
+
+    for (GPRReg i = gpr0; i < numberOfGPRs; next(i)) {
+        if (m_gprs.isLocked(i) || m_gprs.name(i) != grpContents[i]) {
+            dump();
+            CRASH();
+        }
+    }
+    for (FPRReg i = fpr0; i < numberOfFPRs; next(i)) {
+        if (m_fprs.isLocked(i) || m_fprs.name(i) != frpContents[i]) {
+            dump();
+            CRASH();
+        }
+    }
+}
+#endif
+
+GPRTemporary::GPRTemporary(JITCodeGenerator* jit)
+    : m_jit(jit)
+    , m_gpr(InvalidGPRReg)
+{
+    m_gpr = m_jit->allocate();
+}
+
+GPRTemporary::GPRTemporary(JITCodeGenerator* jit, SpeculateIntegerOperand& op1)
+    : m_jit(jit)
+    , m_gpr(InvalidGPRReg)
+{
+    // locking into a register may free for reuse!
+    op1.gpr();
+    if (m_jit->canReuse(op1.index()))
+        m_gpr = m_jit->reuse(op1.gpr());
+    else
+        m_gpr = m_jit->allocate();
+}
+
+GPRTemporary::GPRTemporary(JITCodeGenerator* jit, SpeculateIntegerOperand& op1, SpeculateIntegerOperand& op2)
+    : m_jit(jit)
+    , m_gpr(InvalidGPRReg)
+{
+    // locking into a register may free for reuse!
+    op1.gpr();
+    op2.gpr();
+    if (m_jit->canReuse(op1.index()))
+        m_gpr = m_jit->reuse(op1.gpr());
+    else if (m_jit->canReuse(op2.index()))
+        m_gpr = m_jit->reuse(op2.gpr());
+    else
+        m_gpr = m_jit->allocate();
+}
+
+GPRTemporary::GPRTemporary(JITCodeGenerator* jit, IntegerOperand& op1)
+    : m_jit(jit)
+    , m_gpr(InvalidGPRReg)
+{
+    // locking into a register may free for reuse!
+    op1.gpr();
+    if (m_jit->canReuse(op1.index()))
+        m_gpr = m_jit->reuse(op1.gpr());
+    else
+        m_gpr = m_jit->allocate();
+}
+
+GPRTemporary::GPRTemporary(JITCodeGenerator* jit, IntegerOperand& op1, IntegerOperand& op2)
+    : m_jit(jit)
+    , m_gpr(InvalidGPRReg)
+{
+    // locking into a register may free for reuse!
+    op1.gpr();
+    op2.gpr();
+    if (m_jit->canReuse(op1.index()))
+        m_gpr = m_jit->reuse(op1.gpr());
+    else if (m_jit->canReuse(op2.index()))
+        m_gpr = m_jit->reuse(op2.gpr());
+    else
+        m_gpr = m_jit->allocate();
+}
+
+GPRTemporary::GPRTemporary(JITCodeGenerator* jit, SpeculateCellOperand& op1)
+    : m_jit(jit)
+    , m_gpr(InvalidGPRReg)
+{
+    // locking into a register may free for reuse!
+    op1.gpr();
+    if (m_jit->canReuse(op1.index()))
+        m_gpr = m_jit->reuse(op1.gpr());
+    else
+        m_gpr = m_jit->allocate();
+}
+
+GPRTemporary::GPRTemporary(JITCodeGenerator* jit, JSValueOperand& op1)
+    : m_jit(jit)
+    , m_gpr(InvalidGPRReg)
+{
+    // locking into a register may free for reuse!
+    op1.gpr();
+    if (m_jit->canReuse(op1.index()))
+        m_gpr = m_jit->reuse(op1.gpr());
+    else
+        m_gpr = m_jit->allocate();
+}
+
+FPRTemporary::FPRTemporary(JITCodeGenerator* jit)
+    : m_jit(jit)
+    , m_fpr(InvalidFPRReg)
+{
+    m_fpr = m_jit->fprAllocate();
+}
+
+FPRTemporary::FPRTemporary(JITCodeGenerator* jit, DoubleOperand& op1)
+    : m_jit(jit)
+    , m_fpr(InvalidFPRReg)
+{
+    // locking into a register may free for reuse!
+    op1.fpr();
+    if (m_jit->canReuse(op1.index()))
+        m_fpr = m_jit->reuse(op1.fpr());
+    else
+        m_fpr = m_jit->fprAllocate();
+}
+
+FPRTemporary::FPRTemporary(JITCodeGenerator* jit, DoubleOperand& op1, DoubleOperand& op2)
+    : m_jit(jit)
+    , m_fpr(InvalidFPRReg)
+{
+    // locking into a register may free for reuse!
+    op1.fpr();
+    op2.fpr();
+    if (m_jit->canReuse(op1.index()))
+        m_fpr = m_jit->reuse(op1.fpr());
+    else if (m_jit->canReuse(op2.index()))
+        m_fpr = m_jit->reuse(op2.fpr());
+    else
+        m_fpr = m_jit->fprAllocate();
+}
+
+} } // namespace JSC::DFG
+
+#endif
diff --git a/Source/JavaScriptCore/dfg/DFGJITCodeGenerator.h b/Source/JavaScriptCore/dfg/DFGJITCodeGenerator.h
new file mode 100644
index 0000000..a84cdc6
--- /dev/null
+++ b/Source/JavaScriptCore/dfg/DFGJITCodeGenerator.h
@@ -0,0 +1,955 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef DFGJITCodeGenerator_h
+#define DFGJITCodeGenerator_h
+
+#if ENABLE(DFG_JIT)
+
+#include "CodeBlock.h"
+#include <dfg/DFGGenerationInfo.h>
+#include <dfg/DFGGraph.h>
+#include <dfg/DFGJITCompiler.h>
+#include <dfg/DFGOperations.h>
+#include <dfg/DFGRegisterBank.h>
+
+namespace JSC { namespace DFG {
+
+class SpeculateIntegerOperand;
+class SpeculateStrictInt32Operand;
+class SpeculateCellOperand;
+
+
+// === JITCodeGenerator ===
+//
+// This class provides common infrastructure used by the speculative &
+// non-speculative JITs. Provides common mechanisms for virtual and
+// physical register management, calls out from JIT code to helper
+// functions, etc.
+class JITCodeGenerator {
+protected:
+    typedef MacroAssembler::TrustedImm32 TrustedImm32;
+    typedef MacroAssembler::Imm32 Imm32;
+
+    // These constants are used to set priorities for spill order for
+    // the register allocator.
+    enum SpillOrder {
+        SpillOrderNone,
+        SpillOrderConstant = 1, // no spill, and cheap fill
+        SpillOrderSpilled = 2,  // no spill
+        SpillOrderArgument = 3, // no spill, but we may lose typeinfo
+        SpillOrderJS = 4,       // needs spill
+        SpillOrderCell = 4,     // needs spill
+        SpillOrderInteger = 5,  // needs spill and box
+        SpillOrderDouble = 6,   // needs spill and convert
+        SpillOrderMax
+    };
+
+
+public:
+    GPRReg fillInteger(NodeIndex, DataFormat& returnFormat);
+    FPRReg fillDouble(NodeIndex);
+    GPRReg fillJSValue(NodeIndex);
+
+    // lock and unlock GPR & FPR registers.
+    void lock(GPRReg reg)
+    {
+        m_gprs.lock(reg);
+    }
+    void lock(FPRReg reg)
+    {
+        m_fprs.lock(reg);
+    }
+    void unlock(GPRReg reg)
+    {
+        m_gprs.unlock(reg);
+    }
+    void unlock(FPRReg reg)
+    {
+        m_fprs.unlock(reg);
+    }
+
+    // Used to check whether a child node is on its last use,
+    // and its machine registers may be reused.
+    bool canReuse(NodeIndex nodeIndex)
+    {
+        VirtualRegister virtualRegister = m_jit.graph()[nodeIndex].virtualRegister;
+        GenerationInfo& info = m_generationInfo[virtualRegister];
+        return info.canReuse();
+    }
+    GPRReg reuse(GPRReg reg)
+    {
+        m_gprs.lock(reg);
+        return reg;
+    }
+    FPRReg reuse(FPRReg reg)
+    {
+        m_fprs.lock(reg);
+        return reg;
+    }
+
+    // Allocate a gpr/fpr.
+    GPRReg allocate()
+    {
+        VirtualRegister spillMe;
+        GPRReg gpr = m_gprs.allocate(spillMe);
+        if (spillMe != InvalidVirtualRegister)
+            spill(spillMe);
+        return gpr;
+    }
+    FPRReg fprAllocate()
+    {
+        VirtualRegister spillMe;
+        FPRReg fpr = m_fprs.allocate(spillMe);
+        if (spillMe != InvalidVirtualRegister)
+            spill(spillMe);
+        return fpr;
+    }
+
+    // Check whether a VirtualRegsiter is currently in a machine register.
+    // We use this when filling operands to fill those that are already in
+    // machine registers first (by locking VirtualRegsiters that are already
+    // in machine register before filling those that are not we attempt to
+    // avoid spilling values we will need immediately).
+    bool isFilled(NodeIndex nodeIndex)
+    {
+        VirtualRegister virtualRegister = m_jit.graph()[nodeIndex].virtualRegister;
+        GenerationInfo& info = m_generationInfo[virtualRegister];
+        return info.registerFormat() != DataFormatNone;
+    }
+    bool isFilledDouble(NodeIndex nodeIndex)
+    {
+        VirtualRegister virtualRegister = m_jit.graph()[nodeIndex].virtualRegister;
+        GenerationInfo& info = m_generationInfo[virtualRegister];
+        return info.registerFormat() == DataFormatDouble;
+    }
+
+protected:
+    JITCodeGenerator(JITCompiler& jit, bool isSpeculative)
+        : m_jit(jit)
+        , m_isSpeculative(isSpeculative)
+        , m_compileIndex(0)
+        , m_generationInfo(m_jit.codeBlock()->m_numCalleeRegisters)
+    {
+    }
+
+    // These methods convert between doubles, and doubles boxed and JSValues.
+    GPRReg boxDouble(FPRReg fpr, GPRReg gpr)
+    {
+        JITCompiler::FPRegisterID fpReg = JITCompiler::fprToRegisterID(fpr);
+        JITCompiler::RegisterID reg = JITCompiler::gprToRegisterID(gpr);
+        m_jit.moveDoubleToPtr(fpReg, reg);
+        m_jit.subPtr(JITCompiler::tagTypeNumberRegister, reg);
+        return gpr;
+    }
+    FPRReg unboxDouble(GPRReg gpr, FPRReg fpr)
+    {
+        JITCompiler::RegisterID reg = JITCompiler::gprToRegisterID(gpr);
+        JITCompiler::FPRegisterID fpReg = JITCompiler::fprToRegisterID(fpr);
+        m_jit.addPtr(JITCompiler::tagTypeNumberRegister, reg);
+        m_jit.movePtrToDouble(reg, fpReg);
+        return fpr;
+    }
+    GPRReg boxDouble(FPRReg fpr)
+    {
+        return boxDouble(fpr, allocate());
+    }
+    FPRReg unboxDouble(GPRReg gpr)
+    {
+        return unboxDouble(gpr, fprAllocate());
+    }
+
+    // Called on an operand once it has been consumed by a parent node.
+    void use(NodeIndex nodeIndex)
+    {
+        VirtualRegister virtualRegister = m_jit.graph()[nodeIndex].virtualRegister;
+        GenerationInfo& info = m_generationInfo[virtualRegister];
+
+        // use() returns true when the value becomes dead, and any
+        // associated resources may be freed.
+        if (!info.use())
+            return;
+
+        // Release the associated machine registers.
+        DataFormat registerFormat = info.registerFormat();
+        if (registerFormat == DataFormatDouble)
+            m_fprs.release(info.fpr());
+        else if (registerFormat != DataFormatNone)
+            m_gprs.release(info.gpr());
+    }
+
+    // Spill a VirtualRegister to the RegisterFile.
+    void spill(VirtualRegister spillMe)
+    {
+        GenerationInfo& info = m_generationInfo[spillMe];
+
+        // Check the GenerationInfo to see if this value need writing
+        // to the RegisterFile - if not, mark it as spilled & return.
+        if (!info.needsSpill()) {
+            info.setSpilled();
+            return;
+        }
+
+        DataFormat spillFormat = info.registerFormat();
+        if (spillFormat == DataFormatDouble) {
+            // All values are spilled as JSValues, so box the double via a temporary gpr.
+            GPRReg gpr = boxDouble(info.fpr());
+            m_jit.storePtr(JITCompiler::gprToRegisterID(gpr), JITCompiler::addressFor(spillMe));
+            unlock(gpr);
+            info.spill(DataFormatJSDouble);
+            return;
+        }
+
+        // The following code handles JSValues, int32s, and cells.
+        ASSERT(spillFormat == DataFormatInteger || spillFormat == DataFormatCell || spillFormat & DataFormatJS);
+
+        JITCompiler::RegisterID reg = JITCompiler::gprToRegisterID(info.gpr());
+        // We need to box int32 and cell values ...
+        // but on JSVALUE64 boxing a cell is a no-op!
+        if (spillFormat == DataFormatInteger)
+            m_jit.orPtr(JITCompiler::tagTypeNumberRegister, reg);
+
+        // Spill the value, and record it as spilled in its boxed form.
+        m_jit.storePtr(reg, JITCompiler::addressFor(spillMe));
+        info.spill((DataFormat)(spillFormat | DataFormatJS));
+    }
+
+    // Checks/accessors for constant values.
+    bool isInt32Constant(NodeIndex nodeIndex) { return m_jit.isInt32Constant(nodeIndex); }
+    bool isDoubleConstant(NodeIndex nodeIndex) { return m_jit.isDoubleConstant(nodeIndex); }
+    bool isJSConstant(NodeIndex nodeIndex) { return m_jit.isJSConstant(nodeIndex); }
+    int32_t valueOfInt32Constant(NodeIndex nodeIndex) { return m_jit.valueOfInt32Constant(nodeIndex); }
+    double valueOfDoubleConstant(NodeIndex nodeIndex) { return m_jit.valueOfDoubleConstant(nodeIndex); }
+    JSValue valueOfJSConstant(NodeIndex nodeIndex) { return m_jit.valueOfJSConstant(nodeIndex); }
+
+    Identifier* identifier(unsigned index)
+    {
+        return &m_jit.codeBlock()->identifier(index);
+    }
+
+    // Spill all VirtualRegisters back to the RegisterFile.
+    void flushRegisters()
+    {
+        for (GPRReg gpr = gpr0; gpr < numberOfGPRs; next(gpr)) {
+            VirtualRegister name = m_gprs.name(gpr);
+            if (name != InvalidVirtualRegister) {
+                spill(name);
+                m_gprs.release(gpr);
+            }
+        }
+        for (FPRReg fpr = fpr0; fpr < numberOfFPRs; next(fpr)) {
+            VirtualRegister name = m_fprs.name(fpr);
+            if (name != InvalidVirtualRegister) {
+                spill(name);
+                m_fprs.release(fpr);
+            }
+        }
+    }
+
+#ifndef NDEBUG
+    // Used to ASSERT flushRegisters() has been called prior to
+    // calling out from JIT code to a C helper function.
+    bool isFlushed()
+    {
+        for (GPRReg gpr = gpr0; gpr < numberOfGPRs; next(gpr)) {
+            VirtualRegister name = m_gprs.name(gpr);
+            if (name != InvalidVirtualRegister)
+                return false;
+        }
+        for (FPRReg fpr = fpr0; fpr < numberOfFPRs; next(fpr)) {
+            VirtualRegister name = m_fprs.name(fpr);
+            if (name != InvalidVirtualRegister)
+                return false;
+        }
+        return true;
+    }
+#endif
+
+    // Get the JSValue representation of a constant.
+    JSValue constantAsJSValue(NodeIndex nodeIndex)
+    {
+        Node& node = m_jit.graph()[nodeIndex];
+        if (isInt32Constant(nodeIndex))
+            return jsNumber(node.int32Constant());
+        if (isDoubleConstant(nodeIndex))
+            return JSValue(JSValue::EncodeAsDouble, node.numericConstant());
+        ASSERT(isJSConstant(nodeIndex));
+        return valueOfJSConstant(nodeIndex);
+    }
+    MacroAssembler::ImmPtr constantAsJSValueAsImmPtr(NodeIndex nodeIndex)
+    {
+        return MacroAssembler::ImmPtr(JSValue::encode(constantAsJSValue(nodeIndex)));
+    }
+
+    // Helper functions to enable code sharing in implementations of bit/shift ops.
+    void bitOp(NodeType op, int32_t imm, MacroAssembler::RegisterID op1, MacroAssembler::RegisterID result)
+    {
+        switch (op) {
+        case BitAnd:
+            m_jit.and32(Imm32(imm), op1, result);
+            break;
+        case BitOr:
+            m_jit.or32(Imm32(imm), op1, result);
+            break;
+        case BitXor:
+            m_jit.xor32(Imm32(imm), op1, result);
+            break;
+        default:
+            ASSERT_NOT_REACHED();
+        }
+    }
+    void bitOp(NodeType op, MacroAssembler::RegisterID op1, MacroAssembler::RegisterID op2, MacroAssembler::RegisterID result)
+    {
+        switch (op) {
+        case BitAnd:
+            m_jit.and32(op1, op2, result);
+            break;
+        case BitOr:
+            m_jit.or32(op1, op2, result);
+            break;
+        case BitXor:
+            m_jit.xor32(op1, op2, result);
+            break;
+        default:
+            ASSERT_NOT_REACHED();
+        }
+    }
+    void shiftOp(NodeType op, MacroAssembler::RegisterID op1, int32_t shiftAmount, MacroAssembler::RegisterID result)
+    {
+        switch (op) {
+        case BitRShift:
+            m_jit.rshift32(op1, Imm32(shiftAmount), result);
+            break;
+        case BitLShift:
+            m_jit.lshift32(op1, Imm32(shiftAmount), result);
+            break;
+        case BitURShift:
+            m_jit.urshift32(op1, Imm32(shiftAmount), result);
+            break;
+        default:
+            ASSERT_NOT_REACHED();
+        }
+    }
+    void shiftOp(NodeType op, MacroAssembler::RegisterID op1, MacroAssembler::RegisterID shiftAmount, MacroAssembler::RegisterID result)
+    {
+        switch (op) {
+        case BitRShift:
+            m_jit.rshift32(op1, shiftAmount, result);
+            break;
+        case BitLShift:
+            m_jit.lshift32(op1, shiftAmount, result);
+            break;
+        case BitURShift:
+            m_jit.urshift32(op1, shiftAmount, result);
+            break;
+        default:
+            ASSERT_NOT_REACHED();
+        }
+    }
+
+    // Called once a node has completed code generation but prior to setting
+    // its result, to free up its children. (This must happen prior to setting
+    // the nodes result, since the node may have the same VirtualRegister as
+    // a child, and as such will use the same GeneratioInfo).
+    void useChildren(Node&);
+
+    // These method called to initialize the the GenerationInfo
+    // to describe the result of an operation.
+    void integerResult(GPRReg reg, NodeIndex nodeIndex, DataFormat format = DataFormatInteger)
+    {
+        Node& node = m_jit.graph()[nodeIndex];
+        useChildren(node);
+
+        VirtualRegister virtualRegister = node.virtualRegister;
+        GenerationInfo& info = m_generationInfo[virtualRegister];
+
+        if (format == DataFormatInteger) {
+            m_jit.jitAssertIsInt32(reg);
+            m_gprs.retain(reg, virtualRegister, SpillOrderInteger);
+            info.initInteger(nodeIndex, node.refCount, reg);
+        } else {
+            ASSERT(format == DataFormatJSInteger);
+            m_jit.jitAssertIsJSInt32(reg);
+            m_gprs.retain(reg, virtualRegister, SpillOrderJS);
+            info.initJSValue(nodeIndex, node.refCount, reg, format);
+        }
+    }
+    void noResult(NodeIndex nodeIndex)
+    {
+        Node& node = m_jit.graph()[nodeIndex];
+        useChildren(node);
+
+        VirtualRegister virtualRegister = node.virtualRegister;
+        GenerationInfo& info = m_generationInfo[virtualRegister];
+        info.initNone(nodeIndex, node.refCount);
+    }
+    void cellResult(GPRReg reg, NodeIndex nodeIndex)
+    {
+        Node& node = m_jit.graph()[nodeIndex];
+        useChildren(node);
+
+        VirtualRegister virtualRegister = node.virtualRegister;
+        m_gprs.retain(reg, virtualRegister, SpillOrderCell);
+        GenerationInfo& info = m_generationInfo[virtualRegister];
+        info.initCell(nodeIndex, node.refCount, reg);
+    }
+    void jsValueResult(GPRReg reg, NodeIndex nodeIndex, DataFormat format = DataFormatJS)
+    {
+        if (format == DataFormatJSInteger)
+            m_jit.jitAssertIsJSInt32(reg);
+        
+        Node& node = m_jit.graph()[nodeIndex];
+        useChildren(node);
+
+        VirtualRegister virtualRegister = node.virtualRegister;
+        m_gprs.retain(reg, virtualRegister, SpillOrderJS);
+        GenerationInfo& info = m_generationInfo[virtualRegister];
+        info.initJSValue(nodeIndex, node.refCount, reg, format);
+    }
+    void doubleResult(FPRReg reg, NodeIndex nodeIndex)
+    {
+        Node& node = m_jit.graph()[nodeIndex];
+        useChildren(node);
+
+        VirtualRegister virtualRegister = node.virtualRegister;
+        m_fprs.retain(reg, virtualRegister, SpillOrderDouble);
+        GenerationInfo& info = m_generationInfo[virtualRegister];
+        info.initDouble(nodeIndex, node.refCount, reg);
+    }
+    void initConstantInfo(NodeIndex nodeIndex)
+    {
+        ASSERT(isInt32Constant(nodeIndex) || isDoubleConstant(nodeIndex) || isJSConstant(nodeIndex));
+        Node& node = m_jit.graph()[nodeIndex];
+        m_generationInfo[node.virtualRegister].initConstant(nodeIndex, node.refCount);
+    }
+    void initArgumentInfo(NodeIndex nodeIndex)
+    {
+        Node& node = m_jit.graph()[nodeIndex];
+        m_generationInfo[node.virtualRegister].initArgument(nodeIndex, node.refCount);
+    }
+
+    // These methods used to sort arguments into the correct registers.
+    template<GPRReg destA, GPRReg destB>
+    void setupTwoStubArgs(GPRReg srcA, GPRReg srcB)
+    {
+        // Assuming that srcA != srcB, there are 7 interesting states the registers may be in:
+        // (1) both are already in arg regs, the right way around.
+        // (2) both are already in arg regs, the wrong way around.
+        // (3) neither are currently in arg registers.
+        // (4) srcA in in its correct reg.
+        // (5) srcA in in the incorrect reg.
+        // (6) srcB in in its correct reg.
+        // (7) srcB in in the incorrect reg.
+        //
+        // The trivial approach is to simply emit two moves, to put srcA in place then srcB in
+        // place (the MacroAssembler will omit redundant moves). This apporach will be safe in
+        // cases 1, 3, 4, 5, 6, and in cases where srcA==srcB. The two problem cases are 2
+        // (requires a swap) and 7 (must move srcB first, to avoid trampling.)
+
+        if (srcB != destA) {
+            // Handle the easy cases - two simple moves.
+            m_jit.move(JITCompiler::gprToRegisterID(srcA), JITCompiler::gprToRegisterID(destA));
+            m_jit.move(JITCompiler::gprToRegisterID(srcB), JITCompiler::gprToRegisterID(destB));
+        } else if (srcA != destB) {
+            // Handle the non-swap case - just put srcB in place first.
+            m_jit.move(JITCompiler::gprToRegisterID(srcB), JITCompiler::gprToRegisterID(destB));
+            m_jit.move(JITCompiler::gprToRegisterID(srcA), JITCompiler::gprToRegisterID(destA));
+        } else
+            m_jit.swap(JITCompiler::gprToRegisterID(destB), JITCompiler::gprToRegisterID(destB));
+    }
+    template<FPRReg destA, FPRReg destB>
+    void setupTwoStubArgs(FPRReg srcA, FPRReg srcB)
+    {
+        // Assuming that srcA != srcB, there are 7 interesting states the registers may be in:
+        // (1) both are already in arg regs, the right way around.
+        // (2) both are already in arg regs, the wrong way around.
+        // (3) neither are currently in arg registers.
+        // (4) srcA in in its correct reg.
+        // (5) srcA in in the incorrect reg.
+        // (6) srcB in in its correct reg.
+        // (7) srcB in in the incorrect reg.
+        //
+        // The trivial approach is to simply emit two moves, to put srcA in place then srcB in
+        // place (the MacroAssembler will omit redundant moves). This apporach will be safe in
+        // cases 1, 3, 4, 5, 6, and in cases where srcA==srcB. The two problem cases are 2
+        // (requires a swap) and 7 (must move srcB first, to avoid trampling.)
+
+        if (srcB != destA) {
+            // Handle the easy cases - two simple moves.
+            m_jit.moveDouble(JITCompiler::fprToRegisterID(srcA), JITCompiler::fprToRegisterID(destA));
+            m_jit.moveDouble(JITCompiler::fprToRegisterID(srcB), JITCompiler::fprToRegisterID(destB));
+            return;
+        }
+        
+        if (srcA != destB) {
+            // Handle the non-swap case - just put srcB in place first.
+            m_jit.moveDouble(JITCompiler::fprToRegisterID(srcB), JITCompiler::fprToRegisterID(destB));
+            m_jit.moveDouble(JITCompiler::fprToRegisterID(srcA), JITCompiler::fprToRegisterID(destA));
+            return;
+        }
+
+        ASSERT(srcB == destA && srcA == destB);
+        // Need to swap; pick a temporary register.
+        FPRReg temp;
+        if (destA != JITCompiler::argumentFPR3 && destA != JITCompiler::argumentFPR3)
+            temp = JITCompiler::argumentFPR3;
+        else if (destA != JITCompiler::argumentFPR2 && destA != JITCompiler::argumentFPR2)
+            temp = JITCompiler::argumentFPR2;
+        else {
+            ASSERT(destA != JITCompiler::argumentFPR1 && destA != JITCompiler::argumentFPR1);
+            temp = JITCompiler::argumentFPR1;
+        }
+        m_jit.moveDouble(JITCompiler::fprToRegisterID(destA), JITCompiler::fprToRegisterID(temp));
+        m_jit.moveDouble(JITCompiler::fprToRegisterID(destB), JITCompiler::fprToRegisterID(destA));
+        m_jit.moveDouble(JITCompiler::fprToRegisterID(temp), JITCompiler::fprToRegisterID(destB));
+    }
+    void setupStubArguments(GPRReg arg1, GPRReg arg2)
+    {
+        setupTwoStubArgs<JITCompiler::argumentGPR1, JITCompiler::argumentGPR2>(arg1, arg2);
+    }
+    void setupStubArguments(GPRReg arg1, GPRReg arg2, GPRReg arg3)
+    {
+        // If neither of arg2/arg3 are in our way, then we can move arg1 into place.
+        // Then we can use setupTwoStubArgs to fix arg2/arg3.
+        if (arg2 != JITCompiler::argumentGPR1 && arg3 != JITCompiler::argumentGPR1) {
+            m_jit.move(JITCompiler::gprToRegisterID(arg1), JITCompiler::argumentRegister1);
+            setupTwoStubArgs<JITCompiler::argumentGPR2, JITCompiler::argumentGPR3>(arg2, arg3);
+            return;
+        }
+
+        // If neither of arg1/arg3 are in our way, then we can move arg2 into place.
+        // Then we can use setupTwoStubArgs to fix arg1/arg3.
+        if (arg1 != JITCompiler::argumentGPR2 && arg3 != JITCompiler::argumentGPR2) {
+            m_jit.move(JITCompiler::gprToRegisterID(arg2), JITCompiler::argumentRegister2);
+            setupTwoStubArgs<JITCompiler::argumentGPR1, JITCompiler::argumentGPR3>(arg1, arg3);
+            return;
+        }
+
+        // If neither of arg1/arg2 are in our way, then we can move arg3 into place.
+        // Then we can use setupTwoStubArgs to fix arg1/arg2.
+        if (arg1 != JITCompiler::argumentGPR3 && arg2 != JITCompiler::argumentGPR3) {
+            m_jit.move(JITCompiler::gprToRegisterID(arg3), JITCompiler::argumentRegister3);
+            setupTwoStubArgs<JITCompiler::argumentGPR1, JITCompiler::argumentGPR2>(arg1, arg2);
+            return;
+        }
+
+        // If we get here, we haven't been able to move any of arg1/arg2/arg3.
+        // Since all three are blocked, then all three must already be in the argument register.
+        // But are they in the right ones?
+
+        // First, ensure arg1 is in place.
+        if (arg1 != JITCompiler::argumentGPR1) {
+            m_jit.swap(JITCompiler::gprToRegisterID(arg1), JITCompiler::argumentRegister1);
+
+            // If arg1 wasn't in argumentGPR1, one of arg2/arg3 must be.
+            ASSERT(arg2 == JITCompiler::argumentGPR1 || arg3 == JITCompiler::argumentGPR1);
+            // If arg2 was in argumentGPR1 it no longer is (due to the swap).
+            // Otherwise arg3 must have been. Mark him as moved.
+            if (arg2 == JITCompiler::argumentGPR1)
+                arg2 = arg1;
+            else
+                arg3 = arg1;
+        }
+
+        // Either arg2 & arg3 need swapping, or we're all done.
+        ASSERT((arg2 == JITCompiler::argumentGPR2 || arg3 == JITCompiler::argumentGPR3)
+            || (arg2 == JITCompiler::argumentGPR3 || arg3 == JITCompiler::argumentGPR2));
+
+        if (arg2 != JITCompiler::argumentGPR2)
+            m_jit.swap(JITCompiler::argumentRegister2, JITCompiler::argumentRegister3);
+    }
+
+    // These methods add calls to C++ helper functions.
+    void callOperation(J_DFGOperation_EJP operation, GPRReg result, GPRReg arg1, void* pointer)
+    {
+        ASSERT(isFlushed());
+
+        m_jit.move(JITCompiler::gprToRegisterID(arg1), JITCompiler::argumentRegister1);
+        m_jit.move(JITCompiler::TrustedImmPtr(pointer), JITCompiler::argumentRegister2);
+        m_jit.move(JITCompiler::callFrameRegister, JITCompiler::argumentRegister0);
+
+        appendCallWithExceptionCheck(operation);
+        m_jit.move(JITCompiler::returnValueRegister, JITCompiler::gprToRegisterID(result));
+    }
+    void callOperation(J_DFGOperation_EJI operation, GPRReg result, GPRReg arg1, Identifier* identifier)
+    {
+        callOperation((J_DFGOperation_EJP)operation, result, arg1, identifier);
+    }
+    void callOperation(J_DFGOperation_EJ operation, GPRReg result, GPRReg arg1)
+    {
+        ASSERT(isFlushed());
+
+        m_jit.move(JITCompiler::gprToRegisterID(arg1), JITCompiler::argumentRegister1);
+        m_jit.move(JITCompiler::callFrameRegister, JITCompiler::argumentRegister0);
+
+        appendCallWithExceptionCheck(operation);
+        m_jit.move(JITCompiler::returnValueRegister, JITCompiler::gprToRegisterID(result));
+    }
+    void callOperation(J_DFGOperation_EJJ operation, GPRReg result, GPRReg arg1, GPRReg arg2)
+    {
+        ASSERT(isFlushed());
+
+        setupStubArguments(arg1, arg2);
+        m_jit.move(JITCompiler::callFrameRegister, JITCompiler::argumentRegister0);
+
+        appendCallWithExceptionCheck(operation);
+        m_jit.move(JITCompiler::returnValueRegister, JITCompiler::gprToRegisterID(result));
+    }
+    void callOperation(V_DFGOperation_EJJP operation, GPRReg arg1, GPRReg arg2, void* pointer)
+    {
+        ASSERT(isFlushed());
+
+        setupStubArguments(arg1, arg2);
+        m_jit.move(JITCompiler::TrustedImmPtr(pointer), JITCompiler::argumentRegister3);
+        m_jit.move(JITCompiler::callFrameRegister, JITCompiler::argumentRegister0);
+
+        appendCallWithExceptionCheck(operation);
+    }
+    void callOperation(V_DFGOperation_EJJI operation, GPRReg arg1, GPRReg arg2, Identifier* identifier)
+    {
+        callOperation((V_DFGOperation_EJJP)operation, arg1, arg2, identifier);
+    }
+    void callOperation(V_DFGOperation_EJJJ operation, GPRReg arg1, GPRReg arg2, GPRReg arg3)
+    {
+        ASSERT(isFlushed());
+
+        setupStubArguments(arg1, arg2, arg3);
+        m_jit.move(JITCompiler::callFrameRegister, JITCompiler::argumentRegister0);
+
+        appendCallWithExceptionCheck(operation);
+    }
+    void callOperation(D_DFGOperation_DD operation, FPRReg result, FPRReg arg1, FPRReg arg2)
+    {
+        ASSERT(isFlushed());
+
+        setupTwoStubArgs<JITCompiler::argumentFPR0, JITCompiler::argumentFPR1>(arg1, arg2);
+
+        m_jit.appendCall(operation);
+        m_jit.moveDouble(JITCompiler::fpReturnValueRegister, JITCompiler::fprToRegisterID(result));
+    }
+
+    void appendCallWithExceptionCheck(const FunctionPtr& function)
+    {
+        m_jit.appendCallWithExceptionCheck(function, m_jit.graph()[m_compileIndex].exceptionInfo);
+    }
+
+#ifndef NDEBUG
+    void dump(const char* label = 0);
+#endif
+
+#if DFG_CONSISTENCY_CHECK
+    void checkConsistency();
+#else
+    void checkConsistency() {}
+#endif
+
+    // The JIT, while also provides MacroAssembler functionality.
+    JITCompiler& m_jit;
+    // This flag is used to distinguish speculative and non-speculative
+    // code generation. This is significant when filling spilled values
+    // from the RegisterFile. When spilling we attempt to store information
+    // as to the type of boxed value being stored (int32, double, cell), and
+    // when filling on the speculative path we will retrieve this type info
+    // where available. On the non-speculative path, however, we cannot rely
+    // on the spill format info, since the a value being loaded might have
+    // been spilled by either the speculative or non-speculative paths (where
+    // we entered the non-speculative path on an intervening bail-out), and
+    // the value may have been boxed differently on the two paths.
+    bool m_isSpeculative;
+    // The current node being generated.
+    NodeIndex m_compileIndex;
+    // Virtual and physical register maps.
+    Vector<GenerationInfo, 32> m_generationInfo;
+    RegisterBank<GPRReg, numberOfGPRs, SpillOrder, SpillOrderNone, SpillOrderMax> m_gprs;
+    RegisterBank<FPRReg, numberOfFPRs, SpillOrder, SpillOrderNone, SpillOrderMax> m_fprs;
+};
+
+// === Operand types ===
+//
+// IntegerOperand, DoubleOperand and JSValueOperand.
+//
+// These classes are used to lock the operands to a node into machine
+// registers. These classes implement of pattern of locking a value
+// into register at the point of construction only if it is already in
+// registers, and otherwise loading it lazily at the point it is first
+// used. We do so in order to attempt to avoid spilling one operand
+// in order to make space available for another.
+
+class IntegerOperand {
+public:
+    explicit IntegerOperand(JITCodeGenerator* jit, NodeIndex index)
+        : m_jit(jit)
+        , m_index(index)
+        , m_gprOrInvalid(InvalidGPRReg)
+#ifndef NDEBUG
+        , m_format(DataFormatNone)
+#endif
+    {
+        ASSERT(m_jit);
+        if (jit->isFilled(index))
+            gpr();
+    }
+
+    ~IntegerOperand()
+    {
+        ASSERT(m_gprOrInvalid != InvalidGPRReg);
+        m_jit->unlock(m_gprOrInvalid);
+    }
+
+    NodeIndex index() const
+    {
+        return m_index;
+    }
+
+    GPRReg gpr()
+    {
+        if (m_gprOrInvalid == InvalidGPRReg)
+            m_gprOrInvalid = m_jit->fillInteger(index(), m_format);
+        return m_gprOrInvalid;
+    }
+
+    DataFormat format()
+    {
+        gpr(); // m_format is set when m_gpr is locked.
+        ASSERT(m_format == DataFormatInteger || m_format == DataFormatJSInteger);
+        return m_format;
+    }
+
+    MacroAssembler::RegisterID registerID()
+    {
+        return JITCompiler::gprToRegisterID(gpr());
+    }
+
+private:
+    JITCodeGenerator* m_jit;
+    NodeIndex m_index;
+    GPRReg m_gprOrInvalid;
+    DataFormat m_format;
+};
+
+class DoubleOperand {
+public:
+    explicit DoubleOperand(JITCodeGenerator* jit, NodeIndex index)
+        : m_jit(jit)
+        , m_index(index)
+        , m_fprOrInvalid(InvalidFPRReg)
+    {
+        ASSERT(m_jit);
+        if (jit->isFilledDouble(index))
+            fpr();
+    }
+
+    ~DoubleOperand()
+    {
+        ASSERT(m_fprOrInvalid != InvalidFPRReg);
+        m_jit->unlock(m_fprOrInvalid);
+    }
+
+    NodeIndex index() const
+    {
+        return m_index;
+    }
+
+    FPRReg fpr()
+    {
+        if (m_fprOrInvalid == InvalidFPRReg)
+            m_fprOrInvalid = m_jit->fillDouble(index());
+        return m_fprOrInvalid;
+    }
+
+    MacroAssembler::FPRegisterID registerID()
+    {
+        return JITCompiler::fprToRegisterID(fpr());
+    }
+
+private:
+    JITCodeGenerator* m_jit;
+    NodeIndex m_index;
+    FPRReg m_fprOrInvalid;
+};
+
+class JSValueOperand {
+public:
+    explicit JSValueOperand(JITCodeGenerator* jit, NodeIndex index)
+        : m_jit(jit)
+        , m_index(index)
+        , m_gprOrInvalid(InvalidGPRReg)
+    {
+        ASSERT(m_jit);
+        if (jit->isFilled(index))
+            gpr();
+    }
+
+    ~JSValueOperand()
+    {
+        ASSERT(m_gprOrInvalid != InvalidGPRReg);
+        m_jit->unlock(m_gprOrInvalid);
+    }
+
+    NodeIndex index() const
+    {
+        return m_index;
+    }
+
+    GPRReg gpr()
+    {
+        if (m_gprOrInvalid == InvalidGPRReg)
+            m_gprOrInvalid = m_jit->fillJSValue(index());
+        return m_gprOrInvalid;
+    }
+
+    MacroAssembler::RegisterID registerID()
+    {
+        return JITCompiler::gprToRegisterID(gpr());
+    }
+
+private:
+    JITCodeGenerator* m_jit;
+    NodeIndex m_index;
+    GPRReg m_gprOrInvalid;
+};
+
+
+// === Temporaries ===
+//
+// These classes are used to allocate temporary registers.
+// A mechanism is provided to attempt to reuse the registers
+// currently allocated to child nodes whose value is consumed
+// by, and not live after, this operation.
+
+class GPRTemporary {
+public:
+    GPRTemporary(JITCodeGenerator*);
+    GPRTemporary(JITCodeGenerator*, SpeculateIntegerOperand&);
+    GPRTemporary(JITCodeGenerator*, SpeculateIntegerOperand&, SpeculateIntegerOperand&);
+    GPRTemporary(JITCodeGenerator*, IntegerOperand&);
+    GPRTemporary(JITCodeGenerator*, IntegerOperand&, IntegerOperand&);
+    GPRTemporary(JITCodeGenerator*, SpeculateCellOperand&);
+    GPRTemporary(JITCodeGenerator*, JSValueOperand&);
+
+    ~GPRTemporary()
+    {
+        m_jit->unlock(gpr());
+    }
+
+    GPRReg gpr() const
+    {
+        ASSERT(m_gpr != InvalidGPRReg);
+        return m_gpr;
+    }
+
+    MacroAssembler::RegisterID registerID()
+    {
+        ASSERT(m_gpr != InvalidGPRReg);
+        return JITCompiler::gprToRegisterID(m_gpr);
+    }
+
+protected:
+    GPRTemporary(JITCodeGenerator* jit, GPRReg lockedGPR)
+        : m_jit(jit)
+        , m_gpr(lockedGPR)
+    {
+    }
+
+private:
+    JITCodeGenerator* m_jit;
+    GPRReg m_gpr;
+};
+
+class FPRTemporary {
+public:
+    FPRTemporary(JITCodeGenerator*);
+    FPRTemporary(JITCodeGenerator*, DoubleOperand&);
+    FPRTemporary(JITCodeGenerator*, DoubleOperand&, DoubleOperand&);
+
+    ~FPRTemporary()
+    {
+        m_jit->unlock(fpr());
+    }
+
+    FPRReg fpr() const
+    {
+        ASSERT(m_fpr != InvalidFPRReg);
+        return m_fpr;
+    }
+
+    MacroAssembler::FPRegisterID registerID()
+    {
+        ASSERT(m_fpr != InvalidFPRReg);
+        return JITCompiler::fprToRegisterID(m_fpr);
+    }
+
+protected:
+    FPRTemporary(JITCodeGenerator* jit, FPRReg lockedFPR)
+        : m_jit(jit)
+        , m_fpr(lockedFPR)
+    {
+    }
+
+private:
+    JITCodeGenerator* m_jit;
+    FPRReg m_fpr;
+};
+
+
+// === Results ===
+//
+// These classes lock the result of a call to a C++ helper function.
+
+class GPRResult : public GPRTemporary {
+public:
+    GPRResult(JITCodeGenerator* jit)
+        : GPRTemporary(jit, lockedResult(jit))
+    {
+    }
+
+private:
+    static GPRReg lockedResult(JITCodeGenerator* jit)
+    {
+        jit->lock(JITCompiler::returnValueGPR);
+        return JITCompiler::returnValueGPR;
+    }
+};
+
+class FPRResult : public FPRTemporary {
+public:
+    FPRResult(JITCodeGenerator* jit)
+        : FPRTemporary(jit, lockedResult(jit))
+    {
+    }
+
+private:
+    static FPRReg lockedResult(JITCodeGenerator* jit)
+    {
+        jit->lock(JITCompiler::returnValueFPR);
+        return JITCompiler::returnValueFPR;
+    }
+};
+
+} } // namespace JSC::DFG
+
+#endif
+#endif
+
diff --git a/Source/JavaScriptCore/dfg/DFGJITCompiler.cpp b/Source/JavaScriptCore/dfg/DFGJITCompiler.cpp
new file mode 100644
index 0000000..5c5d5fe
--- /dev/null
+++ b/Source/JavaScriptCore/dfg/DFGJITCompiler.cpp
@@ -0,0 +1,429 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGJITCompiler.h"
+
+#if ENABLE(DFG_JIT)
+
+#include "CodeBlock.h"
+#include "DFGJITCodeGenerator.h"
+#include "DFGNonSpeculativeJIT.h"
+#include "DFGOperations.h"
+#include "DFGRegisterBank.h"
+#include "DFGSpeculativeJIT.h"
+#include "JSGlobalData.h"
+#include "LinkBuffer.h"
+
+namespace JSC { namespace DFG {
+
+// This method used to fill a numeric value to a FPR when linking speculative -> non-speculative.
+void JITCompiler::fillNumericToDouble(NodeIndex nodeIndex, FPRReg fpr, GPRReg temporary)
+{
+    Node& node = graph()[nodeIndex];
+    MacroAssembler::RegisterID tempReg = gprToRegisterID(temporary);
+
+    // Arguments can't be know to be double, would need to have been a ValueToNumber node in the way!
+    ASSERT(!node.isArgument());
+
+    if (node.isConstant()) {
+        ASSERT(node.op == DoubleConstant);
+        move(MacroAssembler::ImmPtr(reinterpret_cast<void*>(reinterpretDoubleToIntptr(valueOfDoubleConstant(nodeIndex)))), tempReg);
+        movePtrToDouble(tempReg, fprToRegisterID(fpr));
+    } else {
+        loadPtr(addressFor(node.virtualRegister), tempReg);
+        Jump isInteger = branchPtr(MacroAssembler::AboveOrEqual, tempReg, tagTypeNumberRegister);
+        jitAssertIsJSDouble(gpr0);
+        addPtr(tagTypeNumberRegister, tempReg);
+        movePtrToDouble(tempReg, fprToRegisterID(fpr));
+        Jump hasUnboxedDouble = jump();
+        isInteger.link(this);
+        convertInt32ToDouble(tempReg, fprToRegisterID(fpr));
+        hasUnboxedDouble.link(this);
+    }
+}
+
+// This method used to fill an integer value to a GPR when linking speculative -> non-speculative.
+void JITCompiler::fillInt32ToInteger(NodeIndex nodeIndex, GPRReg gpr)
+{
+    Node& node = graph()[nodeIndex];
+
+    // Arguments can't be know to be int32, would need to have been a ValueToInt32 node in the way!
+    ASSERT(!node.isArgument());
+
+    if (node.isConstant()) {
+        ASSERT(node.op == Int32Constant);
+        move(MacroAssembler::Imm32(valueOfInt32Constant(nodeIndex)), gprToRegisterID(gpr));
+    } else {
+#if DFG_JIT_ASSERT
+        // Redundant load, just so we can check the tag!
+        loadPtr(addressFor(node.virtualRegister), gprToRegisterID(gpr));
+        jitAssertIsJSInt32(gpr);
+#endif
+        load32(addressFor(node.virtualRegister), gprToRegisterID(gpr));
+    }
+}
+
+// This method used to fill a JSValue to a GPR when linking speculative -> non-speculative.
+void JITCompiler::fillToJS(NodeIndex nodeIndex, GPRReg gpr)
+{
+    Node& node = graph()[nodeIndex];
+
+    if (node.isArgument()) {
+        loadPtr(addressForArgument(node.argumentNumber()), gprToRegisterID(gpr));
+        return;
+    }
+
+    if (node.isConstant()) {
+        if (isInt32Constant(nodeIndex)) {
+            JSValue jsValue = jsNumber(valueOfInt32Constant(nodeIndex));
+            move(MacroAssembler::ImmPtr(JSValue::encode(jsValue)), gprToRegisterID(gpr));
+        } else if (isDoubleConstant(nodeIndex)) {
+            JSValue jsValue(JSValue::EncodeAsDouble, valueOfDoubleConstant(nodeIndex));
+            move(MacroAssembler::ImmPtr(JSValue::encode(jsValue)), gprToRegisterID(gpr));
+        } else {
+            ASSERT(isJSConstant(nodeIndex));
+            JSValue jsValue = valueOfJSConstant(nodeIndex);
+            move(MacroAssembler::ImmPtr(JSValue::encode(jsValue)), gprToRegisterID(gpr));
+        }
+        return;
+    }
+
+    loadPtr(addressFor(node.virtualRegister), gprToRegisterID(gpr));
+}
+
+void JITCompiler::jumpFromSpeculativeToNonSpeculative(const SpeculationCheck& check, const EntryLocation& entry, SpeculationRecovery* recovery)
+{
+    ASSERT(check.m_nodeIndex == entry.m_nodeIndex);
+
+    // Link the jump from the Speculative path to here.
+    check.m_check.link(this);
+
+    // Does this speculation check require any additional recovery to be performed,
+    // to restore any state that has been overwritten before we enter back in to the
+    // non-speculative path.
+    if (recovery) {
+        // The only additional recovery we currently support is for integer add operation
+        ASSERT(recovery->type() == SpeculativeAdd);
+        // Revert the add.
+        sub32(gprToRegisterID(recovery->src()), gprToRegisterID(recovery->dest()));
+    }
+
+    // FIXME: - This is hideously inefficient!
+    // Where a value is live in a register in the speculative path, and is required in a register
+    // on the non-speculative path, we should not need to be spilling it and reloading (we may
+    // need to spill anyway, if the value is marked as spilled on the non-speculative path).
+    // This may also be spilling values that don't need spilling, e.g. are already spilled,
+    // are constants, or are arguments.
+
+    // Spill all GPRs in use by the speculative path.
+    for (GPRReg gpr = gpr0; gpr < numberOfGPRs; next(gpr)) {
+        NodeIndex nodeIndex = check.m_gprInfo[gpr].nodeIndex;
+        if (nodeIndex == NoNode)
+            continue;
+
+        DataFormat dataFormat = check.m_gprInfo[gpr].format;
+        VirtualRegister virtualRegister = graph()[nodeIndex].virtualRegister;
+
+        ASSERT(dataFormat == DataFormatInteger || DataFormatCell || dataFormat & DataFormatJS);
+        if (dataFormat == DataFormatInteger)
+            orPtr(tagTypeNumberRegister, gprToRegisterID(gpr));
+        storePtr(gprToRegisterID(gpr), addressFor(virtualRegister));
+    }
+
+    // Spill all FPRs in use by the speculative path.
+    for (FPRReg fpr = fpr0; fpr < numberOfFPRs; next(fpr)) {
+        NodeIndex nodeIndex = check.m_fprInfo[fpr];
+        if (nodeIndex == NoNode)
+            continue;
+
+        VirtualRegister virtualRegister = graph()[nodeIndex].virtualRegister;
+
+        moveDoubleToPtr(fprToRegisterID(fpr), regT0);
+        subPtr(tagTypeNumberRegister, regT0);
+        storePtr(regT0, addressFor(virtualRegister));
+    }
+
+    // Fill all FPRs in use by the non-speculative path.
+    for (FPRReg fpr = fpr0; fpr < numberOfFPRs; next(fpr)) {
+        NodeIndex nodeIndex = entry.m_fprInfo[fpr];
+        if (nodeIndex == NoNode)
+            continue;
+
+        fillNumericToDouble(nodeIndex, fpr, gpr0);
+    }
+
+    // Fill all GPRs in use by the non-speculative path.
+    for (GPRReg gpr = gpr0; gpr < numberOfGPRs; next(gpr)) {
+        NodeIndex nodeIndex = entry.m_gprInfo[gpr].nodeIndex;
+        if (nodeIndex == NoNode)
+            continue;
+
+        DataFormat dataFormat = entry.m_gprInfo[gpr].format;
+        if (dataFormat == DataFormatInteger)
+            fillInt32ToInteger(nodeIndex, gpr);
+        else {
+            ASSERT(dataFormat & DataFormatJS || dataFormat == DataFormatCell); // Treat cell as JSValue for now!
+            fillToJS(nodeIndex, gpr);
+            // FIXME: For subtypes of DataFormatJS, should jitAssert the subtype?
+        }
+    }
+
+    // Jump into the non-speculative path.
+    jump(entry.m_entry);
+}
+
+void JITCompiler::linkSpeculationChecks(SpeculativeJIT& speculative, NonSpeculativeJIT& nonSpeculative)
+{
+    // Iterators to walk over the set of bail outs & corresponding entry points.
+    SpeculativeJIT::SpeculationCheckVector::Iterator checksIter = speculative.speculationChecks().begin();
+    SpeculativeJIT::SpeculationCheckVector::Iterator checksEnd = speculative.speculationChecks().end();
+    NonSpeculativeJIT::EntryLocationVector::Iterator entriesIter = nonSpeculative.entryLocations().begin();
+    NonSpeculativeJIT::EntryLocationVector::Iterator entriesEnd = nonSpeculative.entryLocations().end();
+
+    // Iterate over the speculation checks.
+    while (checksIter != checksEnd) {
+        // For every bail out from the speculative path, we must have provided an entry point
+        // into the non-speculative one.
+        ASSERT(checksIter->m_nodeIndex == entriesIter->m_nodeIndex);
+
+        // There may be multiple bail outs that map to the same entry point!
+        do {
+            ASSERT(checksIter != checksEnd);
+            ASSERT(entriesIter != entriesEnd);
+
+            // Plant code to link this speculation failure.
+            const SpeculationCheck& check = *checksIter;
+            const EntryLocation& entry = *entriesIter;
+            jumpFromSpeculativeToNonSpeculative(check, entry, speculative.speculationRecovery(check.m_recoveryIndex));
+             ++checksIter;
+        } while (checksIter != checksEnd && checksIter->m_nodeIndex == entriesIter->m_nodeIndex);
+         ++entriesIter;
+    }
+
+    // FIXME: https://bugs.webkit.org/show_bug.cgi?id=56289
+    ASSERT(!(checksIter != checksEnd));
+    ASSERT(!(entriesIter != entriesEnd));
+}
+
+void JITCompiler::compileFunction(JITCode& entry, MacroAssemblerCodePtr& entryWithArityCheck)
+{
+    // === Stage 1 - Function header code generation ===
+    //
+    // This code currently matches the old JIT. In the function header we need to
+    // pop the return address (since we do not allow any recursion on the machine
+    // stack), and perform a fast register file check.
+
+    // This is the main entry point, without performing an arity check.
+    // FIXME: https://bugs.webkit.org/show_bug.cgi?id=56292
+    // We'll need to convert the remaining cti_ style calls (specifically the register file
+    // check) which will be dependent on stack layout. (We'd need to account for this in
+    // both normal return code and when jumping to an exception handler).
+    preserveReturnAddressAfterCall(regT2);
+    emitPutToCallFrameHeader(regT2, RegisterFile::ReturnPC);
+    // If we needed to perform an arity check we will already have moved the return address,
+    // so enter after this.
+    Label fromArityCheck(this);
+
+    // Setup a pointer to the codeblock in the CallFrameHeader.
+    emitPutImmediateToCallFrameHeader(m_codeBlock, RegisterFile::CodeBlock);
+
+    // Plant a check that sufficient space is available in the RegisterFile.
+    // FIXME: https://bugs.webkit.org/show_bug.cgi?id=56291
+    addPtr(Imm32(m_codeBlock->m_numCalleeRegisters * sizeof(Register)), callFrameRegister, regT1);
+    Jump registerFileCheck = branchPtr(Below, AbsoluteAddress(m_globalData->interpreter->registerFile().addressOfEnd()), regT1);
+    // Return here after register file check.
+    Label fromRegisterFileCheck = label();
+
+
+    // === Stage 2 - Function body code generation ===
+    //
+    // We generate the speculative code path, followed by the non-speculative
+    // code for the function. Next we need to link the two together, making
+    // bail-outs from the speculative path jump to the corresponding point on
+    // the non-speculative one (and generating any code necessary to juggle
+    // register values around, rebox values, and ensure spilled, to match the
+    // non-speculative path's requirements).
+
+#if DFG_JIT_BREAK_ON_ENTRY
+    // Handy debug tool!
+    breakpoint();
+#endif
+
+    // First generate the speculative path.
+    SpeculativeJIT speculative(*this);
+    speculative.compile();
+
+    // Next, generate the non-speculative path. We pass this a SpeculationCheckIndexIterator
+    // to allow it to check which nodes in the graph may bail out, and may need to reenter the
+    // non-speculative path.
+    SpeculationCheckIndexIterator checkIterator(speculative);
+    NonSpeculativeJIT nonSpeculative(*this);
+    nonSpeculative.compile(checkIterator);
+
+    // Link the bail-outs from the speculative path to the corresponding entry points into the non-speculative one.
+    linkSpeculationChecks(speculative, nonSpeculative);
+
+
+    // === Stage 3 - Function footer code generation ===
+    //
+    // Generate code to lookup and jump to exception handlers, to perform the slow
+    // register file check (if the fast one in the function header fails), and
+    // generate the entry point with arity check.
+
+    // Iterate over the m_calls vector, checking for exception checks,
+    // and linking them to here.
+    unsigned exceptionCheckCount = 0;
+    for (unsigned i = 0; i < m_calls.size(); ++i) {
+        Jump& exceptionCheck = m_calls[i].m_exceptionCheck;
+        if (exceptionCheck.isSet()) {
+            exceptionCheck.link(this);
+            ++exceptionCheckCount;
+        }
+    }
+    // If any exception checks were linked, generate code to lookup a handler.
+    if (exceptionCheckCount) {
+        // lookupExceptionHandler is passed two arguments, exec (the CallFrame*), and
+        // an identifier for the operation that threw the exception, which we can use
+        // to look up handler information. The identifier we use is the return address
+        // of the call out from JIT code that threw the exception; this is still
+        // available on the stack, just below the stack pointer!
+        move(callFrameRegister, argumentRegister0);
+        peek(argumentRegister1, -1);
+        m_calls.append(CallRecord(call(), lookupExceptionHandler));
+        // lookupExceptionHandler leaves the handler CallFrame* in the returnValueRegister,
+        // and the address of the handler in returnValueRegister2.
+        jump(returnValueRegister2);
+    }
+
+    // Generate the register file check; if the fast check in the function head fails,
+    // we need to call out to a helper function to check whether more space is available.
+    // FIXME: change this from a cti call to a DFG style operation (normal C calling conventions).
+    registerFileCheck.link(this);
+    move(stackPointerRegister, argumentRegister0);
+    poke(callFrameRegister, OBJECT_OFFSETOF(struct JITStackFrame, callFrame) / sizeof(void*));
+    Call callRegisterFileCheck = call();
+    jump(fromRegisterFileCheck);
+
+    // The fast entry point into a function does not check the correct number of arguments
+    // have been passed to the call (we only use the fast entry point where we can statically
+    // determine the correct number of arguments have been passed, or have already checked).
+    // In cases where an arity check is necessary, we enter here.
+    // FIXME: change this from a cti call to a DFG style operation (normal C calling conventions).
+    Label arityCheck = label();
+    preserveReturnAddressAfterCall(regT2);
+    emitPutToCallFrameHeader(regT2, RegisterFile::ReturnPC);
+    branch32(Equal, regT1, Imm32(m_codeBlock->m_numParameters)).linkTo(fromArityCheck, this);
+    move(stackPointerRegister, argumentRegister0);
+    poke(callFrameRegister, OBJECT_OFFSETOF(struct JITStackFrame, callFrame) / sizeof(void*));
+    Call callArityCheck = call();
+    move(regT0, callFrameRegister);
+    jump(fromArityCheck);
+
+
+    // === Stage 4 - Link ===
+    //
+    // Link the code, populate data in CodeBlock data structures.
+
+    LinkBuffer linkBuffer(this, m_globalData->executableAllocator.poolForSize(m_assembler.size()), 0);
+
+    // Link all calls out from the JIT code to their respective functions.
+    for (unsigned i = 0; i < m_calls.size(); ++i)
+        linkBuffer.link(m_calls[i].m_call, m_calls[i].m_function);
+
+    if (m_codeBlock->needsCallReturnIndices()) {
+        m_codeBlock->callReturnIndexVector().reserveCapacity(exceptionCheckCount);
+        for (unsigned i = 0; i < m_calls.size(); ++i) {
+            if (m_calls[i].m_exceptionCheck.isSet()) {
+                unsigned returnAddressOffset = linkBuffer.returnAddressOffset(m_calls[i].m_call);
+                unsigned exceptionInfo = m_calls[i].m_exceptionInfo;
+                m_codeBlock->callReturnIndexVector().append(CallReturnOffsetToBytecodeOffset(returnAddressOffset, exceptionInfo));
+            }
+        }
+    }
+
+    // FIXME: switch the register file check & arity check over to DFGOpertaion style calls, not JIT stubs.
+    linkBuffer.link(callRegisterFileCheck, cti_register_file_check);
+    linkBuffer.link(callArityCheck, m_codeBlock->m_isConstructor ? cti_op_construct_arityCheck : cti_op_call_arityCheck);
+
+    entryWithArityCheck = linkBuffer.locationOf(arityCheck);
+    entry = linkBuffer.finalizeCode();
+}
+
+#if DFG_JIT_ASSERT
+void JITCompiler::jitAssertIsInt32(GPRReg gpr)
+{
+#if CPU(X86_64)
+    Jump checkInt32 = branchPtr(BelowOrEqual, gprToRegisterID(gpr), TrustedImmPtr(reinterpret_cast<void*>(static_cast<uintptr_t>(0xFFFFFFFFu))));
+    breakpoint();
+    checkInt32.link(this);
+#else
+    UNUSED_PARAM(gpr);
+#endif
+}
+
+void JITCompiler::jitAssertIsJSInt32(GPRReg gpr)
+{
+    Jump checkJSInt32 = branchPtr(AboveOrEqual, gprToRegisterID(gpr), tagTypeNumberRegister);
+    breakpoint();
+    checkJSInt32.link(this);
+}
+
+void JITCompiler::jitAssertIsJSNumber(GPRReg gpr)
+{
+    Jump checkJSNumber = branchTestPtr(MacroAssembler::NonZero, gprToRegisterID(gpr), tagTypeNumberRegister);
+    breakpoint();
+    checkJSNumber.link(this);
+}
+
+void JITCompiler::jitAssertIsJSDouble(GPRReg gpr)
+{
+    Jump checkJSInt32 = branchPtr(AboveOrEqual, gprToRegisterID(gpr), tagTypeNumberRegister);
+    Jump checkJSNumber = branchTestPtr(MacroAssembler::NonZero, gprToRegisterID(gpr), tagTypeNumberRegister);
+    checkJSInt32.link(this);
+    breakpoint();
+    checkJSNumber.link(this);
+}
+#endif
+
+#if ENABLE(SAMPLING_COUNTERS) && CPU(X86_64) // Or any other 64-bit platform!
+void JITCompiler::emitCount(AbstractSamplingCounter& counter, uint32_t increment)
+{
+    addPtr(TrustedImm32(increment), AbsoluteAddress(counter.addressOfCounter()));
+}
+#endif
+
+#if ENABLE(SAMPLING_COUNTERS) && CPU(X86) // Or any other little-endian 32-bit platform!
+void JITCompiler::emitCount(AbstractSamplingCounter& counter, uint32_t increment)
+{
+    intptr_t hiWord = reinterpret_cast<intptr_t>(counter.addressOfCounter()) + sizeof(int32_t);
+    add32(TrustedImm32(increment), AbsoluteAddress(counter.addressOfCounter()));
+    addWithCarry32(TrustedImm32(0), AbsoluteAddress(reinterpret_cast<void*>(hiWord)));
+}
+#endif
+
+} } // namespace JSC::DFG
+
+#endif
diff --git a/Source/JavaScriptCore/dfg/DFGJITCompiler.h b/Source/JavaScriptCore/dfg/DFGJITCompiler.h
new file mode 100644
index 0000000..8b68434
--- /dev/null
+++ b/Source/JavaScriptCore/dfg/DFGJITCompiler.h
@@ -0,0 +1,325 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef DFGJITCompiler_h
+#define DFGJITCompiler_h
+
+#if ENABLE(DFG_JIT)
+
+#include <assembler/MacroAssembler.h>
+#include <bytecode/CodeBlock.h>
+#include <dfg/DFGGraph.h>
+#include <jit/JITCode.h>
+
+namespace JSC {
+
+class AbstractSamplingCounter;
+class CodeBlock;
+class JSGlobalData;
+
+namespace DFG {
+
+class JITCodeGenerator;
+class NonSpeculativeJIT;
+class SpeculativeJIT;
+class SpeculationRecovery;
+
+struct EntryLocation;
+struct SpeculationCheck;
+
+// Abstracted sequential numbering of available machine registers (as opposed to MacroAssembler::RegisterID,
+// which are non-sequential, and not abstracted from the register numbering used by the underlying processor).
+enum GPRReg { gpr0, gpr1, gpr2, gpr3, gpr4, gpr5, numberOfGPRs, InvalidGPRReg = 0xFFFFFFFF };
+enum FPRReg { fpr0, fpr1, fpr2, fpr3, fpr4, fpr5, numberOfFPRs, InvalidFPRReg = 0xFFFFFFFF };
+
+// GPRReg/FPRReg are enum types to provide type checking at compile time, use these method to iterate.
+inline GPRReg next(GPRReg& reg)
+{
+    ASSERT(reg < numberOfGPRs);
+    return reg = static_cast<GPRReg>(reg + 1);
+}
+inline FPRReg next(FPRReg& reg)
+{
+    ASSERT(reg < numberOfFPRs);
+    return reg = static_cast<FPRReg>(reg + 1);
+}
+
+// === CallRecord ===
+//
+// A record of a call out from JIT code to a helper function.
+// Every CallRecord contains a reference to the call instruction & the function
+// that it needs to be linked to. Calls that might throw an exception also record
+// the Jump taken on exception (unset if not present), and ExceptionInfo (presently
+// an unsigned, bytecode index) used to recover handler/source info.
+struct CallRecord {
+    // Constructor for a call with no exception handler.
+    CallRecord(MacroAssembler::Call call, FunctionPtr function)
+        : m_call(call)
+        , m_function(function)
+    {
+    }
+
+    // Constructor for a call with an exception handler.
+    CallRecord(MacroAssembler::Call call, FunctionPtr function, MacroAssembler::Jump exceptionCheck, ExceptionInfo exceptionInfo)
+        : m_call(call)
+        , m_function(function)
+        , m_exceptionCheck(exceptionCheck)
+        , m_exceptionInfo(exceptionInfo)
+    {
+    }
+
+    MacroAssembler::Call m_call;
+    FunctionPtr m_function;
+    MacroAssembler::Jump m_exceptionCheck;
+    ExceptionInfo m_exceptionInfo;
+};
+
+// === JITCompiler ===
+//
+// DFG::JITCompiler is responsible for generating JIT code from the dataflow graph.
+// It does so by delegating to the speculative & non-speculative JITs, which
+// generate to a MacroAssembler (which the JITCompiler owns through an inheritance
+// relationship). The JITCompiler holds references to information required during
+// compilation, and also records information used in linking (e.g. a list of all
+// call to be linked).
+class JITCompiler : public MacroAssembler {
+public:
+    JITCompiler(JSGlobalData* globalData, Graph& dfg, CodeBlock* codeBlock)
+        : m_globalData(globalData)
+        , m_graph(dfg)
+        , m_codeBlock(codeBlock)
+    {
+    }
+
+    void compileFunction(JITCode& entry, MacroAssemblerCodePtr& entryWithArityCheck);
+
+    // Accessors for properties.
+    Graph& graph() { return m_graph; }
+    CodeBlock* codeBlock() { return m_codeBlock; }
+    JSGlobalData* globalData() { return m_globalData; }
+
+#if CPU(X86_64)
+    // These registers match the old JIT.
+    static const RegisterID timeoutCheckRegister = X86Registers::r12;
+    static const RegisterID callFrameRegister = X86Registers::r13;
+    static const RegisterID tagTypeNumberRegister = X86Registers::r14;
+    static const RegisterID tagMaskRegister = X86Registers::r15;
+
+    // Temporary registers (these correspond to the temporary GPRReg/FPRReg
+    // registers i.e. regT0 and grp0 refer to the same thing, grp0 being
+    // the abstracted, sequential name, and regT0 being the machine register
+    // number in the instruction set, as provided by the MacroAssembler).
+    static const RegisterID regT0 = X86Registers::eax;
+    static const RegisterID regT1 = X86Registers::edx;
+    static const RegisterID regT2 = X86Registers::ecx;
+    static const RegisterID regT3 = X86Registers::ebx;
+    static const RegisterID regT4 = X86Registers::edi;
+    static const RegisterID regT5 = X86Registers::esi;
+    static const FPRegisterID fpRegT0 = X86Registers::xmm0;
+    static const FPRegisterID fpRegT1 = X86Registers::xmm1;
+    static const FPRegisterID fpRegT2 = X86Registers::xmm2;
+    static const FPRegisterID fpRegT3 = X86Registers::xmm3;
+    static const FPRegisterID fpRegT4 = X86Registers::xmm4;
+    static const FPRegisterID fpRegT5 = X86Registers::xmm5;
+
+    // These constants provide both RegisterID & GPRReg style names for the
+    // general purpose argument & return value register.
+    static const GPRReg argumentGPR0 = gpr4;
+    static const GPRReg argumentGPR1 = gpr5;
+    static const GPRReg argumentGPR2 = gpr1;
+    static const GPRReg argumentGPR3 = gpr2;
+    static const RegisterID argumentRegister0 = regT4;
+    static const RegisterID argumentRegister1 = regT5;
+    static const RegisterID argumentRegister2 = regT1;
+    static const RegisterID argumentRegister3 = regT2;
+    static const GPRReg returnValueGPR = gpr0;
+    static const RegisterID returnValueRegister = regT0;
+    static const RegisterID returnValueRegister2 = regT1;
+
+    // These constants provide both FPRegisterID & FPRReg style names for the
+    // floating point argument & return value register.
+    static const FPRReg argumentFPR0 = fpr0;
+    static const FPRReg argumentFPR1 = fpr1;
+    static const FPRReg argumentFPR2 = fpr2;
+    static const FPRReg argumentFPR3 = fpr3;
+    static const FPRegisterID fpArgumentRegister0 = fpRegT0;
+    static const FPRegisterID fpArgumentRegister1 = fpRegT1;
+    static const FPRegisterID fpArgumentRegister2 = fpRegT2;
+    static const FPRegisterID fpArgumentRegister3 = fpRegT3;
+    static const FPRReg returnValueFPR = fpr0;
+    static const FPRegisterID fpReturnValueRegister = fpRegT0;
+
+
+    void preserveReturnAddressAfterCall(RegisterID reg)
+    {
+        pop(reg);
+    }
+
+    void restoreReturnAddressBeforeReturn(RegisterID reg)
+    {
+        push(reg);
+    }
+
+    void restoreReturnAddressBeforeReturn(Address address)
+    {
+        push(address);
+    }
+
+    void emitGetFromCallFrameHeaderPtr(RegisterFile::CallFrameHeaderEntry entry, RegisterID to)
+    {
+        loadPtr(Address(callFrameRegister, entry * sizeof(Register)), to);
+    }
+    void emitPutToCallFrameHeader(RegisterID from, RegisterFile::CallFrameHeaderEntry entry)
+    {
+        storePtr(from, Address(callFrameRegister, entry * sizeof(Register)));
+    }
+
+    void emitPutImmediateToCallFrameHeader(void* value, RegisterFile::CallFrameHeaderEntry entry)
+    {
+        storePtr(TrustedImmPtr(value), Address(callFrameRegister, entry * sizeof(Register)));
+    }
+#endif
+
+    Address addressForArgument(int32_t argument)
+    {
+        return Address(callFrameRegister, (argument - (m_codeBlock->m_numParameters + RegisterFile::CallFrameHeaderSize)) * sizeof(Register));
+    }
+
+    static Address addressForGlobalVar(RegisterID global, int32_t varNumber)
+    {
+        return Address(global, varNumber * sizeof(Register));
+    }
+
+    static Address addressFor(VirtualRegister virtualRegister)
+    {
+        return Address(callFrameRegister, virtualRegister * sizeof(Register));
+    }
+
+    // These methods provide mapping from sequential register numbering (GPRReg/FPRReg)
+    // to machine register numbering (RegisterID/FPRegisterID).
+    static RegisterID gprToRegisterID(GPRReg reg)
+    {
+        ASSERT(reg < numberOfGPRs);
+        static const RegisterID idForRegister[numberOfGPRs] = { regT0, regT1, regT2, regT3, regT4, regT5 };
+        return idForRegister[reg];
+    }
+    static FPRegisterID fprToRegisterID(FPRReg reg)
+    {
+        ASSERT(reg < numberOfFPRs);
+        static const FPRegisterID idForRegister[numberOfFPRs] = { fpRegT0, fpRegT1, fpRegT2, fpRegT3, fpRegT4, fpRegT5 };
+        return idForRegister[reg];
+    }
+
+    // Add a call out from JIT code, without an exception check.
+    void appendCall(const FunctionPtr& function)
+    {
+        m_calls.append(CallRecord(call(), function));
+        // FIXME: should be able to JIT_ASSERT here that globalData->exception is null on return back to JIT code.
+    }
+
+    // Add a call out from JIT code, with an exception check.
+    void appendCallWithExceptionCheck(const FunctionPtr& function, unsigned exceptionInfo)
+    {
+        Call functionCall = call();
+        Jump exceptionCheck = branchTestPtr(NonZero, AbsoluteAddress(&globalData()->exception));
+        m_calls.append(CallRecord(functionCall, function, exceptionCheck, exceptionInfo));
+    }
+
+    // Helper methods to check nodes for constants.
+    bool isInt32Constant(NodeIndex nodeIndex)
+    {
+        return graph()[nodeIndex].op == Int32Constant;
+    }
+    bool isDoubleConstant(NodeIndex nodeIndex)
+    {
+        return graph()[nodeIndex].op == DoubleConstant;
+    }
+    bool isJSConstant(NodeIndex nodeIndex)
+    {
+        return graph()[nodeIndex].op == JSConstant;
+    }
+
+    // Helper methods get constant values from nodes.
+    int32_t valueOfInt32Constant(NodeIndex nodeIndex)
+    {
+        ASSERT(isInt32Constant(nodeIndex));
+        return graph()[nodeIndex].int32Constant();
+    }
+    double valueOfDoubleConstant(NodeIndex nodeIndex)
+    {
+        ASSERT(isDoubleConstant(nodeIndex));
+        return graph()[nodeIndex].numericConstant();
+    }
+    JSValue valueOfJSConstant(NodeIndex nodeIndex)
+    {
+        ASSERT(isJSConstant(nodeIndex));
+        unsigned constantIndex = graph()[nodeIndex].constantNumber();
+        return codeBlock()->constantRegister(FirstConstantRegisterIndex + constantIndex).get();
+    }
+
+    // These methods JIT generate dynamic, debug-only checks - akin to ASSERTs.
+#if DFG_JIT_ASSERT
+    void jitAssertIsInt32(GPRReg);
+    void jitAssertIsJSInt32(GPRReg);
+    void jitAssertIsJSNumber(GPRReg);
+    void jitAssertIsJSDouble(GPRReg);
+#else
+    void jitAssertIsInt32(GPRReg) {}
+    void jitAssertIsJSInt32(GPRReg) {}
+    void jitAssertIsJSNumber(GPRReg) {}
+    void jitAssertIsJSDouble(GPRReg) {}
+#endif
+
+#if ENABLE(SAMPLING_COUNTERS)
+    // Debug profiling tool.
+    void emitCount(AbstractSamplingCounter&, uint32_t increment = 1);
+#endif
+
+private:
+    // These methods used in linking the speculative & non-speculative paths together.
+    void fillNumericToDouble(NodeIndex, FPRReg, GPRReg temporary);
+    void fillInt32ToInteger(NodeIndex, GPRReg);
+    void fillToJS(NodeIndex, GPRReg);
+    void jumpFromSpeculativeToNonSpeculative(const SpeculationCheck&, const EntryLocation&, SpeculationRecovery*);
+    void linkSpeculationChecks(SpeculativeJIT&, NonSpeculativeJIT&);
+
+    // The globalData, used to access constants such as the vPtrs.
+    JSGlobalData* m_globalData;
+
+    // The dataflow graph currently being generated.
+    Graph& m_graph;
+
+    // The codeBlock currently being generated, used to access information such as constant values, immediates.
+    CodeBlock* m_codeBlock;
+
+    // Vector of calls out from JIT code, including exception handler information.
+    Vector<CallRecord> m_calls;
+};
+
+} } // namespace JSC::DFG
+
+#endif
+#endif
+
diff --git a/Source/JavaScriptCore/dfg/DFGNode.h b/Source/JavaScriptCore/dfg/DFGNode.h
new file mode 100644
index 0000000..11dbf0d
--- /dev/null
+++ b/Source/JavaScriptCore/dfg/DFGNode.h
@@ -0,0 +1,293 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef DFGNode_h
+#define DFGNode_h
+
+#if ENABLE(DFG_JIT)
+
+#include <wtf/Vector.h>
+
+// Emit various logging information for debugging, including dumping the dataflow graphs.
+#define DFG_DEBUG_VERBOSE 0
+// Enable generation of dynamic checks into the instruction stream.
+#define DFG_JIT_ASSERT 0
+// Consistency check contents compiler data structures.
+#define DFG_CONSISTENCY_CHECK 0
+// Emit a breakpoint into the head of every generated function, to aid debugging in GDB.
+#define DFG_JIT_BREAK_ON_ENTRY 0
+
+
+namespace JSC { namespace DFG {
+
+// Type for a virtual register number (spill location).
+// Using an enum to make this type-checked at compile time, to avert programmer errors.
+enum VirtualRegister { InvalidVirtualRegister = -1 };
+COMPILE_ASSERT(sizeof(VirtualRegister) == sizeof(int), VirtualRegister_is_32bit);
+
+// Type for a reference to another node in the graph.
+typedef uint32_t NodeIndex;
+static const NodeIndex NoNode = UINT_MAX;
+
+// Information used to map back from an exception to any handler/source information.
+// (Presently implemented as a bytecode index).
+typedef uint32_t ExceptionInfo;
+
+// Entries in the NodeType enum (below) are composed of an id, a result type (possibly none)
+// and some additional informative flags (must generate, is constant, etc).
+#define NodeIdMask          0xFFF
+#define NodeResultMask     0xF000
+#define NodeMustGenerate  0x10000 // set on nodes that have side effects, and may not trivially be removed by DCE.
+#define NodeIsConstant    0x20000
+
+// These values record the result type of the node (as checked by NodeResultMask, above), 0 for no result.
+#define NodeResultJS      0x1000
+#define NodeResultDouble  0x2000
+#define NodeResultInt32   0x3000
+
+// This macro defines a set of information about all known node types, used to populate NodeId, NodeType below.
+#define FOR_EACH_DFG_OP(macro) \
+    /* Nodes for constants. */\
+    macro(JSConstant, NodeResultJS | NodeIsConstant) \
+    macro(Int32Constant, NodeResultJS | NodeIsConstant) \
+    macro(DoubleConstant, NodeResultJS | NodeIsConstant) \
+    macro(Argument, NodeResultJS) \
+    macro(ConvertThis, NodeResultJS) \
+    \
+    /* Nodes for bitwise operations. */\
+    macro(BitAnd, NodeResultInt32) \
+    macro(BitOr, NodeResultInt32) \
+    macro(BitXor, NodeResultInt32) \
+    macro(BitLShift, NodeResultInt32) \
+    macro(BitRShift, NodeResultInt32) \
+    macro(BitURShift, NodeResultInt32) \
+    /* Bitwise operators call ToInt32 on their operands. */\
+    macro(NumberToInt32, NodeResultInt32) \
+    macro(ValueToInt32, NodeResultInt32 | NodeMustGenerate) \
+    /* Used to box the result of URShift nodes (result has range 0..2^32-1). */\
+    macro(UInt32ToNumber, NodeResultDouble) \
+    \
+    /* Nodes for arithmetic operations. */\
+    macro(ArithAdd, NodeResultDouble) \
+    macro(ArithSub, NodeResultDouble) \
+    macro(ArithMul, NodeResultDouble) \
+    macro(ArithDiv, NodeResultDouble) \
+    macro(ArithMod, NodeResultDouble) \
+    /* Arithmetic operators call ToNumber on their operands. */\
+    macro(Int32ToNumber, NodeResultDouble) \
+    macro(ValueToNumber, NodeResultDouble | NodeMustGenerate) \
+    \
+    /* Add of values may either be arithmetic, or result in string concatenation. */\
+    macro(ValueAdd, NodeResultJS | NodeMustGenerate) \
+    \
+    /* Property access. */\
+    /* PutByValAlias indicates a 'put' aliases a prior write to the same property. */\
+    /* Since a put to 'length' may invalidate optimizations here, */\
+    /* this must be the directly subsequent property put. */\
+    macro(GetByVal, NodeResultJS | NodeMustGenerate) \
+    macro(PutByVal, NodeMustGenerate) \
+    macro(PutByValAlias, NodeMustGenerate) \
+    macro(GetById, NodeResultJS | NodeMustGenerate) \
+    macro(PutById, NodeMustGenerate) \
+    macro(PutByIdDirect, NodeMustGenerate) \
+    macro(GetGlobalVar, NodeResultJS | NodeMustGenerate) \
+    macro(PutGlobalVar, NodeMustGenerate) \
+    \
+    macro(Return, NodeMustGenerate)
+
+// This enum generates a monotonically increasing id for all Node types,
+// and is used by the subsequent enum to fill out the id (as accessed via the NodeIdMask).
+enum NodeId {
+#define DFG_OP_ENUM(opcode, flags) opcode##_id,
+    FOR_EACH_DFG_OP(DFG_OP_ENUM)
+#undef DFG_OP_ENUM
+};
+
+// Entries in this enum describe all Node types.
+// The enum value contains a monotonically increasing id, a result type, and additional flags.
+enum NodeType {
+#define DFG_OP_ENUM(opcode, flags) opcode = opcode##_id | (flags),
+    FOR_EACH_DFG_OP(DFG_OP_ENUM)
+#undef DFG_OP_ENUM
+};
+
+// This type used in passing an immediate argument to Node constructor;
+// distinguishes an immediate value (typically an index into a CodeBlock data structure - 
+// a constant index, argument, or identifier) from a NodeIndex.
+struct OpInfo {
+    explicit OpInfo(unsigned value) : m_value(value) {}
+    unsigned m_value;
+};
+
+// === Node ===
+//
+// Node represents a single operation in the data flow graph.
+struct Node {
+    // Construct a node with up to 3 children, no immediate value.
+    Node(NodeType op, ExceptionInfo exceptionInfo, NodeIndex child1 = NoNode, NodeIndex child2 = NoNode, NodeIndex child3 = NoNode)
+        : op(op)
+        , exceptionInfo(exceptionInfo)
+        , child1(child1)
+        , child2(child2)
+        , child3(child3)
+        , virtualRegister(InvalidVirtualRegister)
+        , refCount(0)
+    {
+    }
+
+    // Construct a node with up to 3 children and an immediate value.
+    Node(NodeType op, ExceptionInfo exceptionInfo, OpInfo imm, NodeIndex child1 = NoNode, NodeIndex child2 = NoNode, NodeIndex child3 = NoNode)
+        : op(op)
+        , exceptionInfo(exceptionInfo)
+        , child1(child1)
+        , child2(child2)
+        , child3(child3)
+        , virtualRegister(InvalidVirtualRegister)
+        , refCount(0)
+        , m_opInfo(imm.m_value)
+    {
+    }
+
+    bool mustGenerate()
+    {
+        return op & NodeMustGenerate;
+    }
+
+    bool isConstant()
+    {
+        return op & NodeIsConstant;
+    }
+
+    unsigned constantNumber()
+    {
+        ASSERT(isConstant());
+        return m_opInfo;
+    }
+
+    bool isArgument()
+    {
+        return op == Argument;
+    }
+
+    unsigned argumentNumber()
+    {
+        ASSERT(isArgument());
+        return m_opInfo;
+    }
+
+    bool hasIdentifier()
+    {
+        return op == GetById || op == PutById || op == PutByIdDirect;
+    }
+
+    unsigned identifierNumber()
+    {
+        ASSERT(hasIdentifier());
+        return m_opInfo;
+    }
+
+    bool hasVarNumber()
+    {
+        return op == GetGlobalVar || op == PutGlobalVar;
+    }
+
+    unsigned varNumber()
+    {
+        ASSERT(hasVarNumber());
+        return m_opInfo;
+    }
+
+    bool hasInt32Result()
+    {
+        return (op & NodeResultMask) == NodeResultInt32;
+    }
+
+    bool hasDoubleResult()
+    {
+        return (op & NodeResultMask) == NodeResultDouble;
+    }
+
+    bool hasJSResult()
+    {
+        return (op & NodeResultMask) == NodeResultJS;
+    }
+
+    // Check for integers or doubles.
+    bool hasNumericResult()
+    {
+        // This check will need updating if more result types are added.
+        ASSERT((hasInt32Result() || hasDoubleResult()) == !hasJSResult());
+        return !hasJSResult();
+    }
+
+    int32_t int32Constant()
+    {
+        ASSERT(op == Int32Constant);
+        return m_constantValue.asInt32;
+    }
+
+    void setInt32Constant(int32_t value)
+    {
+        ASSERT(op == Int32Constant);
+        m_constantValue.asInt32 = value;
+    }
+
+    double numericConstant()
+    {
+        ASSERT(op == DoubleConstant);
+        return m_constantValue.asDouble;
+    }
+
+    void setDoubleConstant(double value)
+    {
+        ASSERT(op == DoubleConstant);
+        m_constantValue.asDouble = value;
+    }
+
+    // This enum value describes the type of the node.
+    NodeType op;
+    // Used to look up exception handling information (currently implemented as a bytecode index).
+    ExceptionInfo exceptionInfo;
+    // References to up to 3 children (0 for no child).
+    NodeIndex child1, child2, child3;
+    // The virtual register number (spill location) associated with this .
+    VirtualRegister virtualRegister;
+    // The number of uses of the result of this operation (+1 for 'must generate' nodes, which have side-effects).
+    unsigned refCount;
+
+private:
+    // An immediate value, accesses type-checked via accessors above.
+    unsigned m_opInfo;
+    // The value of an int32/double constant.
+    union {
+        int32_t asInt32;
+        double asDouble;
+    } m_constantValue;
+};
+
+} } // namespace JSC::DFG
+
+#endif
+#endif
diff --git a/Source/JavaScriptCore/dfg/DFGNonSpeculativeJIT.cpp b/Source/JavaScriptCore/dfg/DFGNonSpeculativeJIT.cpp
new file mode 100644
index 0000000..945c98a
--- /dev/null
+++ b/Source/JavaScriptCore/dfg/DFGNonSpeculativeJIT.cpp
@@ -0,0 +1,585 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGNonSpeculativeJIT.h"
+
+#include "DFGSpeculativeJIT.h"
+
+#if ENABLE(DFG_JIT)
+
+namespace JSC { namespace DFG {
+
+const double twoToThe32 = (double)0x100000000ull;
+
+EntryLocation::EntryLocation(MacroAssembler::Label entry, NonSpeculativeJIT* jit)
+    : m_entry(entry)
+    , m_nodeIndex(jit->m_compileIndex)
+{
+    for (GPRReg gpr = gpr0; gpr < numberOfGPRs; next(gpr)) {
+        VirtualRegister virtualRegister = jit->m_gprs.name(gpr);
+        if (virtualRegister != InvalidVirtualRegister) {
+            GenerationInfo& info =  jit->m_generationInfo[virtualRegister];
+            m_gprInfo[gpr].nodeIndex = info.nodeIndex();
+            m_gprInfo[gpr].format = info.registerFormat();
+        } else
+            m_gprInfo[gpr].nodeIndex = NoNode;
+    }
+    for (FPRReg fpr = fpr0; fpr < numberOfFPRs; next(fpr)) {
+        VirtualRegister virtualRegister = jit->m_fprs.name(fpr);
+        if (virtualRegister != InvalidVirtualRegister) {
+            GenerationInfo& info =  jit->m_generationInfo[virtualRegister];
+            ASSERT(info.registerFormat() == DataFormatDouble);
+            m_fprInfo[fpr] = info.nodeIndex();
+        } else
+            m_fprInfo[fpr] = NoNode;
+    }
+}
+
+void NonSpeculativeJIT::valueToNumber(JSValueOperand& operand, FPRReg fpr)
+{
+    GPRReg jsValueGpr = operand.gpr();
+    GPRReg tempGpr = allocate(); // FIXME: can we skip this allocation on the last use of the virtual register?
+
+    JITCompiler::RegisterID jsValueReg = JITCompiler::gprToRegisterID(jsValueGpr);
+    JITCompiler::FPRegisterID fpReg = JITCompiler::fprToRegisterID(fpr);
+    JITCompiler::RegisterID tempReg = JITCompiler::gprToRegisterID(tempGpr);
+
+    JITCompiler::Jump isInteger = m_jit.branchPtr(MacroAssembler::AboveOrEqual, jsValueReg, JITCompiler::tagTypeNumberRegister);
+    JITCompiler::Jump nonNumeric = m_jit.branchTestPtr(MacroAssembler::Zero, jsValueReg, JITCompiler::tagTypeNumberRegister);
+
+    // First, if we get here we have a double encoded as a JSValue
+    m_jit.move(jsValueReg, tempReg);
+    m_jit.addPtr(JITCompiler::tagTypeNumberRegister, tempReg);
+    m_jit.movePtrToDouble(tempReg, fpReg);
+    JITCompiler::Jump hasUnboxedDouble = m_jit.jump();
+
+    // Next handle cells (& other JS immediates)
+    nonNumeric.link(&m_jit);
+    silentSpillAllRegisters(jsValueGpr);
+    m_jit.move(jsValueReg, JITCompiler::argumentRegister1);
+    m_jit.move(JITCompiler::callFrameRegister, JITCompiler::argumentRegister0);
+    appendCallWithExceptionCheck(dfgConvertJSValueToNumber);
+    m_jit.moveDouble(JITCompiler::fpReturnValueRegister, fpReg);
+    silentFillAllRegisters(fpr);
+    JITCompiler::Jump hasCalledToNumber = m_jit.jump();
+    
+    // Finally, handle integers.
+    isInteger.link(&m_jit);
+    m_jit.convertInt32ToDouble(jsValueReg, fpReg);
+    hasUnboxedDouble.link(&m_jit);
+    hasCalledToNumber.link(&m_jit);
+
+    m_gprs.unlock(tempGpr);
+}
+
+void NonSpeculativeJIT::valueToInt32(JSValueOperand& operand, GPRReg result)
+{
+    GPRReg jsValueGpr = operand.gpr();
+
+    JITCompiler::RegisterID jsValueReg = JITCompiler::gprToRegisterID(jsValueGpr);
+    JITCompiler::RegisterID resultReg = JITCompiler::gprToRegisterID(result);
+
+    JITCompiler::Jump isInteger = m_jit.branchPtr(MacroAssembler::AboveOrEqual, jsValueReg, JITCompiler::tagTypeNumberRegister);
+
+    // First handle non-integers
+    silentSpillAllRegisters(jsValueGpr);
+    m_jit.move(jsValueReg, JITCompiler::argumentRegister1);
+    m_jit.move(JITCompiler::callFrameRegister, JITCompiler::argumentRegister0);
+    appendCallWithExceptionCheck(dfgConvertJSValueToInt32);
+    m_jit.zeroExtend32ToPtr(JITCompiler::returnValueRegister, resultReg);
+    silentFillAllRegisters(result);
+    JITCompiler::Jump hasCalledToInt32 = m_jit.jump();
+    
+    // Then handle integers.
+    isInteger.link(&m_jit);
+    m_jit.zeroExtend32ToPtr(jsValueReg, resultReg);
+    hasCalledToInt32.link(&m_jit);
+}
+
+void NonSpeculativeJIT::numberToInt32(FPRReg fpr, GPRReg gpr)
+{
+    JITCompiler::FPRegisterID fpReg = JITCompiler::fprToRegisterID(fpr);
+    JITCompiler::RegisterID reg = JITCompiler::gprToRegisterID(gpr);
+
+    JITCompiler::Jump truncatedToInteger = m_jit.branchTruncateDoubleToInt32(fpReg, reg, JITCompiler::BranchIfTruncateSuccessful);
+
+    silentSpillAllRegisters(gpr); // don't really care!
+
+    m_jit.moveDouble(fpReg, JITCompiler::fpArgumentRegister0);
+    appendCallWithExceptionCheck(toInt32);
+    m_jit.zeroExtend32ToPtr(JITCompiler::returnValueRegister, reg);
+
+    silentFillAllRegisters(gpr);
+
+    truncatedToInteger.link(&m_jit);
+}
+
+void NonSpeculativeJIT::compile(SpeculationCheckIndexIterator& checkIterator, Node& node)
+{
+    // ...
+    if (checkIterator.hasCheckAtIndex(m_compileIndex))
+        trackEntry(m_jit.label());
+
+    checkConsistency();
+
+    NodeType op = node.op;
+
+    switch (op) {
+    case ConvertThis: {
+        JSValueOperand thisValue(this, node.child1);
+        GPRReg thisGPR = thisValue.gpr();
+        flushRegisters();
+
+        GPRResult result(this);
+        callOperation(operationConvertThis, result.gpr(), thisGPR);
+        cellResult(result.gpr(), m_compileIndex);
+        break;
+    }
+
+    case Int32Constant:
+    case DoubleConstant:
+    case JSConstant:
+        initConstantInfo(m_compileIndex);
+        break;
+    
+    case Argument:
+        initArgumentInfo(m_compileIndex);
+        break;
+
+    case BitAnd:
+    case BitOr:
+    case BitXor:
+        if (isInt32Constant(node.child1)) {
+            IntegerOperand op2(this, node.child2);
+            GPRTemporary result(this, op2);
+
+            bitOp(op, valueOfInt32Constant(node.child1), op2.registerID(), result.registerID());
+
+            integerResult(result.gpr(), m_compileIndex);
+        } else if (isInt32Constant(node.child2)) {
+            IntegerOperand op1(this, node.child1);
+            GPRTemporary result(this, op1);
+
+            bitOp(op, valueOfInt32Constant(node.child2), op1.registerID(), result.registerID());
+
+            integerResult(result.gpr(), m_compileIndex);
+        } else {
+            IntegerOperand op1(this, node.child1);
+            IntegerOperand op2(this, node.child2);
+            GPRTemporary result(this, op1, op2);
+
+            MacroAssembler::RegisterID reg1 = op1.registerID();
+            MacroAssembler::RegisterID reg2 = op2.registerID();
+            bitOp(op, reg1, reg2, result.registerID());
+
+            integerResult(result.gpr(), m_compileIndex);
+        }
+        break;
+
+    case BitRShift:
+    case BitLShift:
+    case BitURShift:
+        if (isInt32Constant(node.child2)) {
+            IntegerOperand op1(this, node.child1);
+            GPRTemporary result(this, op1);
+
+            int shiftAmount = valueOfInt32Constant(node.child2) & 0x1f;
+            // Shifts by zero should have been optimized out of the graph!
+            ASSERT(shiftAmount);
+            shiftOp(op, op1.registerID(), shiftAmount, result.registerID());
+
+            integerResult(result.gpr(), m_compileIndex);
+        } else {
+            // Do not allow shift amount to be used as the result, MacroAssembler does not permit this.
+            IntegerOperand op1(this, node.child1);
+            IntegerOperand op2(this, node.child2);
+            GPRTemporary result(this, op1);
+
+            MacroAssembler::RegisterID reg1 = op1.registerID();
+            MacroAssembler::RegisterID reg2 = op2.registerID();
+            shiftOp(op, reg1, reg2, result.registerID());
+
+            integerResult(result.gpr(), m_compileIndex);
+        }
+        break;
+
+    case UInt32ToNumber: {
+        IntegerOperand op1(this, node.child1);
+        FPRTemporary result(this);
+        m_jit.convertInt32ToDouble(op1.registerID(), result.registerID());
+
+        MacroAssembler::Jump positive = m_jit.branch32(MacroAssembler::GreaterThanOrEqual, op1.registerID(), TrustedImm32(0));
+        m_jit.addDouble(JITCompiler::AbsoluteAddress(&twoToThe32), result.registerID());
+        positive.link(&m_jit);
+
+        doubleResult(result.fpr(), m_compileIndex);
+        break;
+    }
+
+    case Int32ToNumber: {
+        IntegerOperand op1(this, node.child1);
+        FPRTemporary result(this);
+        m_jit.convertInt32ToDouble(op1.registerID(), result.registerID());
+        doubleResult(result.fpr(), m_compileIndex);
+        break;
+    }
+
+    case NumberToInt32:
+    case ValueToInt32: {
+        ASSERT(!isInt32Constant(node.child1));
+        GenerationInfo& operandInfo = m_generationInfo[m_jit.graph()[node.child1].virtualRegister];
+
+        switch (operandInfo.registerFormat()) {
+        case DataFormatInteger: {
+            IntegerOperand op1(this, node.child1);
+            GPRTemporary result(this, op1);
+            m_jit.move(op1.registerID(), result.registerID());
+            integerResult(result.gpr(), m_compileIndex);
+            break;
+        }
+
+        case DataFormatDouble: {
+            DoubleOperand op1(this, node.child1);
+            GPRTemporary result(this);
+            numberToInt32(op1.fpr(), result.gpr());
+            integerResult(result.gpr(), m_compileIndex);
+            break;
+        }
+
+        default: {
+            JSValueOperand op1(this, node.child1);
+            GPRTemporary result(this, op1);
+            op1.gpr(); // force op1 to be filled!
+            result.gpr(); // force result to be allocated!
+            
+            switch (operandInfo.registerFormat()) {
+            case DataFormatNone:
+            case DataFormatInteger:
+            case DataFormatDouble:
+                // The operand has been filled as a JSValue; it cannot be in a !DataFormatJS state.
+                CRASH();
+
+            case DataFormatCell:
+            case DataFormatJS:
+            case DataFormatJSCell: {
+                if (op == NumberToInt32) {
+                    FPRTemporary fpTemp(this);
+                    FPRReg fpr = fpTemp.fpr();
+
+                    JITCompiler::Jump isInteger = m_jit.branchPtr(MacroAssembler::AboveOrEqual, op1.registerID(), JITCompiler::tagTypeNumberRegister);
+
+                    m_jit.move(op1.registerID(), result.registerID());
+                    m_jit.addPtr(JITCompiler::tagTypeNumberRegister, result.registerID());
+                    m_jit.movePtrToDouble(result.registerID(), fpTemp.registerID());
+                    numberToInt32(fpr, result.gpr());
+                    JITCompiler::Jump wasDouble = m_jit.jump();
+                    
+                    isInteger.link(&m_jit);
+                    m_jit.zeroExtend32ToPtr(op1.registerID(), result.registerID());
+
+                    wasDouble.link(&m_jit);
+                } else
+                    valueToInt32(op1, result.gpr());
+                integerResult(result.gpr(), m_compileIndex);
+                break;
+            }
+
+            case DataFormatJSDouble: {
+                FPRTemporary fpTemp(this);
+                m_jit.move(op1.registerID(), result.registerID());
+                m_jit.addPtr(JITCompiler::tagTypeNumberRegister, result.registerID());
+                m_jit.movePtrToDouble(result.registerID(), fpTemp.registerID());
+                numberToInt32(fpTemp.fpr(), result.gpr());
+                integerResult(result.gpr(), m_compileIndex);
+                break;
+            }
+
+            case DataFormatJSInteger: {
+                m_jit.move(op1.registerID(), result.registerID());
+                jsValueResult(result.gpr(), m_compileIndex, DataFormatJSInteger);
+                break;
+            }
+            }
+        }
+
+        }
+        break;
+    }
+
+    case ValueToNumber: {
+        ASSERT(!isInt32Constant(node.child1));
+        ASSERT(!isDoubleConstant(node.child1));
+        GenerationInfo& operandInfo = m_generationInfo[m_jit.graph()[node.child1].virtualRegister];
+        switch (operandInfo.registerFormat()) {
+        case DataFormatNone:
+        case DataFormatCell:
+        case DataFormatJS:
+        case DataFormatJSCell: {
+            JSValueOperand op1(this, node.child1);
+            FPRTemporary result(this);
+            valueToNumber(op1, result.fpr());
+            doubleResult(result.fpr(), m_compileIndex);
+            break;
+        }
+
+        case DataFormatJSDouble:
+        case DataFormatDouble: {
+            DoubleOperand op1(this, node.child1);
+            FPRTemporary result(this, op1);
+            m_jit.moveDouble(op1.registerID(), result.registerID());
+            doubleResult(result.fpr(), m_compileIndex);
+            break;
+        }
+
+        case DataFormatJSInteger:
+        case DataFormatInteger: {
+            IntegerOperand op1(this, node.child1);
+            FPRTemporary result(this);
+            m_jit.convertInt32ToDouble(op1.registerID(), result.registerID());
+            doubleResult(result.fpr(), m_compileIndex);
+            break;
+        }
+        }
+        break;
+    }
+
+    case ValueAdd: {
+        JSValueOperand arg1(this, node.child1);
+        JSValueOperand arg2(this, node.child2);
+        GPRReg arg1GPR = arg1.gpr();
+        GPRReg arg2GPR = arg2.gpr();
+        flushRegisters();
+
+        GPRResult result(this);
+        callOperation(operationValueAdd, result.gpr(), arg1GPR, arg2GPR);
+
+        jsValueResult(result.gpr(), m_compileIndex);
+        break;
+    }
+        
+    case ArithAdd: {
+        DoubleOperand op1(this, node.child1);
+        DoubleOperand op2(this, node.child2);
+        FPRTemporary result(this, op1, op2);
+
+        MacroAssembler::FPRegisterID reg1 = op1.registerID();
+        MacroAssembler::FPRegisterID reg2 = op2.registerID();
+        m_jit.addDouble(reg1, reg2, result.registerID());
+
+        doubleResult(result.fpr(), m_compileIndex);
+        break;
+    }
+
+    case ArithSub: {
+        DoubleOperand op1(this, node.child1);
+        DoubleOperand op2(this, node.child2);
+        FPRTemporary result(this, op1);
+
+        MacroAssembler::FPRegisterID reg1 = op1.registerID();
+        MacroAssembler::FPRegisterID reg2 = op2.registerID();
+        m_jit.subDouble(reg1, reg2, result.registerID());
+
+        doubleResult(result.fpr(), m_compileIndex);
+        break;
+    }
+
+    case ArithMul: {
+        DoubleOperand op1(this, node.child1);
+        DoubleOperand op2(this, node.child2);
+        FPRTemporary result(this, op1, op2);
+
+        MacroAssembler::FPRegisterID reg1 = op1.registerID();
+        MacroAssembler::FPRegisterID reg2 = op2.registerID();
+        m_jit.mulDouble(reg1, reg2, result.registerID());
+
+        doubleResult(result.fpr(), m_compileIndex);
+        break;
+    }
+
+    case ArithDiv: {
+        DoubleOperand op1(this, node.child1);
+        DoubleOperand op2(this, node.child2);
+        FPRTemporary result(this, op1);
+
+        MacroAssembler::FPRegisterID reg1 = op1.registerID();
+        MacroAssembler::FPRegisterID reg2 = op2.registerID();
+        m_jit.divDouble(reg1, reg2, result.registerID());
+
+        doubleResult(result.fpr(), m_compileIndex);
+        break;
+    }
+
+    case ArithMod: {
+        DoubleOperand arg1(this, node.child1);
+        DoubleOperand arg2(this, node.child2);
+        FPRReg arg1FPR = arg1.fpr();
+        FPRReg arg2FPR = arg2.fpr();
+        flushRegisters();
+
+        FPRResult result(this);
+        callOperation(fmod, result.fpr(), arg1FPR, arg2FPR);
+
+        doubleResult(result.fpr(), m_compileIndex);
+        break;
+    }
+
+    case GetByVal: {
+        JSValueOperand arg1(this, node.child1);
+        JSValueOperand arg2(this, node.child2);
+        GPRReg arg1GPR = arg1.gpr();
+        GPRReg arg2GPR = arg2.gpr();
+        flushRegisters();
+
+        GPRResult result(this);
+        callOperation(operationGetByVal, result.gpr(), arg1GPR, arg2GPR);
+
+        jsValueResult(result.gpr(), m_compileIndex);
+        break;
+    }
+
+    case PutByVal:
+    case PutByValAlias: {
+        JSValueOperand arg1(this, node.child1);
+        JSValueOperand arg2(this, node.child2);
+        JSValueOperand arg3(this, node.child3);
+        GPRReg arg1GPR = arg1.gpr();
+        GPRReg arg2GPR = arg2.gpr();
+        GPRReg arg3GPR = arg3.gpr();
+        flushRegisters();
+
+        GPRResult result(this);
+        callOperation(m_jit.codeBlock()->isStrictMode() ? operationPutByValStrict : operationPutByValNonStrict, arg1GPR, arg2GPR, arg3GPR);
+
+        noResult(m_compileIndex);
+        break;
+    }
+
+    case GetById: {
+        JSValueOperand base(this, node.child1);
+        GPRReg baseGPR = base.gpr();
+        flushRegisters();
+
+        GPRResult result(this);
+        callOperation(operationGetById, result.gpr(), baseGPR, identifier(node.identifierNumber()));
+        jsValueResult(result.gpr(), m_compileIndex);
+        break;
+    }
+
+    case PutById: {
+        JSValueOperand base(this, node.child1);
+        JSValueOperand value(this, node.child2);
+        GPRReg valueGPR = value.gpr();
+        GPRReg baseGPR = base.gpr();
+        flushRegisters();
+
+        callOperation(m_jit.codeBlock()->isStrictMode() ? operationPutByIdStrict : operationPutByIdNonStrict, valueGPR, baseGPR, identifier(node.identifierNumber()));
+        noResult(m_compileIndex);
+        break;
+    }
+
+    case PutByIdDirect: {
+        JSValueOperand base(this, node.child1);
+        JSValueOperand value(this, node.child2);
+        GPRReg valueGPR = value.gpr();
+        GPRReg baseGPR = base.gpr();
+        flushRegisters();
+
+        callOperation(m_jit.codeBlock()->isStrictMode() ? operationPutByIdDirectStrict : operationPutByIdDirectNonStrict, valueGPR, baseGPR, identifier(node.identifierNumber()));
+        noResult(m_compileIndex);
+        break;
+    }
+
+    case GetGlobalVar: {
+        GPRTemporary result(this);
+
+        JSVariableObject* globalObject = m_jit.codeBlock()->globalObject();
+        m_jit.loadPtr(globalObject->addressOfRegisters(), result.registerID());
+        m_jit.loadPtr(JITCompiler::addressForGlobalVar(result.registerID(), node.varNumber()), result.registerID());
+
+        jsValueResult(result.gpr(), m_compileIndex);
+        break;
+    }
+
+    case PutGlobalVar: {
+        JSValueOperand value(this, node.child1);
+        GPRTemporary temp(this);
+
+        JSVariableObject* globalObject = m_jit.codeBlock()->globalObject();
+        m_jit.loadPtr(globalObject->addressOfRegisters(), temp.registerID());
+        m_jit.storePtr(value.registerID(), JITCompiler::addressForGlobalVar(temp.registerID(), node.varNumber()));
+
+        noResult(m_compileIndex);
+        break;
+    }
+
+    case Return: {
+        ASSERT(JITCompiler::callFrameRegister != JITCompiler::regT1);
+        ASSERT(JITCompiler::regT1 != JITCompiler::returnValueRegister);
+        ASSERT(JITCompiler::returnValueRegister != JITCompiler::callFrameRegister);
+
+        // Return the result in returnValueRegister.
+        JSValueOperand op1(this, node.child1);
+        m_jit.move(op1.registerID(), JITCompiler::returnValueRegister);
+
+        // Grab the return address.
+        m_jit.emitGetFromCallFrameHeaderPtr(RegisterFile::ReturnPC, JITCompiler::regT1);
+        // Restore our caller's "r".
+        m_jit.emitGetFromCallFrameHeaderPtr(RegisterFile::CallerFrame, JITCompiler::callFrameRegister);
+        // Return.
+        m_jit.restoreReturnAddressBeforeReturn(JITCompiler::regT1);
+        m_jit.ret();
+
+        noResult(m_compileIndex);
+        break;
+    }
+    }
+
+    if (node.mustGenerate())
+        use(m_compileIndex);
+
+    checkConsistency();
+}
+
+void NonSpeculativeJIT::compile(SpeculationCheckIndexIterator& checkIterator)
+{
+    ASSERT(!m_compileIndex);
+    Node* nodes = m_jit.graph().begin();
+
+    for (; m_compileIndex < m_jit.graph().size(); ++m_compileIndex) {
+#if DFG_DEBUG_VERBOSE
+        fprintf(stderr, "index(%d)\n", (int)m_compileIndex);
+#endif
+
+        Node& node = nodes[m_compileIndex];
+        if (!node.refCount)
+            continue;
+        compile(checkIterator, node);
+    }
+}
+
+} } // namespace JSC::DFG
+
+#endif
diff --git a/Source/JavaScriptCore/dfg/DFGNonSpeculativeJIT.h b/Source/JavaScriptCore/dfg/DFGNonSpeculativeJIT.h
new file mode 100644
index 0000000..e140e45
--- /dev/null
+++ b/Source/JavaScriptCore/dfg/DFGNonSpeculativeJIT.h
@@ -0,0 +1,211 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef DFGNonSpeculativeJIT_h
+#define DFGNonSpeculativeJIT_h
+
+#if ENABLE(DFG_JIT)
+
+#include <dfg/DFGJITCodeGenerator.h>
+
+namespace JSC { namespace DFG {
+
+class SpeculationCheckIndexIterator;
+
+// === EntryLocation ===
+//
+// This structure describes an entry point into the non-speculative
+// code path. This is used in linking bail-outs from the speculative path.
+struct EntryLocation {
+    EntryLocation(MacroAssembler::Label, NonSpeculativeJIT*);
+
+    // The node this entry point corresponds to, and the label
+    // marking the start of code for the given node.
+    MacroAssembler::Label m_entry;
+    NodeIndex m_nodeIndex;
+
+    // For every entry point we record a map recording for every
+    // machine register which, if any, values it contains. For
+    // GPR registers we must also record the format of the value.
+    struct RegisterInfo {
+        NodeIndex nodeIndex;
+        DataFormat format;
+    };
+    RegisterInfo m_gprInfo[numberOfGPRs];
+    NodeIndex m_fprInfo[numberOfFPRs];
+};
+
+// === NonSpeculativeJIT ===
+//
+// This class is used to generate code for the non-speculative path.
+// Code generation will take advantage of static information available
+// in the dataflow to perform safe optimizations - for example, avoiding
+// boxing numeric values between arithmetic operations, but will not
+// perform any unsafe optimizations that would render the code unable
+// to produce the correct results for any possible input.
+class NonSpeculativeJIT : public JITCodeGenerator {
+    friend struct EntryLocation;
+public:
+    NonSpeculativeJIT(JITCompiler& jit)
+        : JITCodeGenerator(jit, false)
+    {
+    }
+
+    void compile(SpeculationCheckIndexIterator&);
+
+    typedef SegmentedVector<EntryLocation, 16> EntryLocationVector;
+    EntryLocationVector& entryLocations() { return m_entryLocations; }
+
+private:
+    void compile(SpeculationCheckIndexIterator&, Node&);
+
+    // These methods are used when generating 'unexpected'
+    // calls out from JIT code to C++ helper routines -
+    // they spill all live values to the appropriate
+    // slots in the RegisterFile without changing any state
+    // in the GenerationInfo.
+    void silentSpill(VirtualRegister spillMe, GPRReg canTrample)
+    {
+        GenerationInfo& info = m_generationInfo[spillMe];
+        ASSERT(info.registerFormat() != DataFormatNone);
+        if (info.needsSpill()) {
+            DataFormat spillFormat = info.registerFormat();
+
+            if (spillFormat == DataFormatDouble) {
+                boxDouble(info.fpr(), canTrample);
+                m_jit.storePtr(JITCompiler::gprToRegisterID(canTrample), JITCompiler::addressFor(spillMe));
+            } else {
+                JITCompiler::RegisterID reg = JITCompiler::gprToRegisterID(info.gpr());
+
+                if (spillFormat == DataFormatInteger) {
+                    m_jit.orPtr(JITCompiler::tagTypeNumberRegister, reg);
+                    m_jit.storePtr(reg, JITCompiler::addressFor(spillMe));
+                } else {
+                    ASSERT(spillFormat & DataFormatJS || spillFormat == DataFormatCell);
+                    m_jit.storePtr(reg, JITCompiler::addressFor(spillMe));
+                }
+            }
+        }
+    }
+    void silentFill(VirtualRegister spillMe, GPRReg canTrample)
+    {
+        GenerationInfo& info = m_generationInfo[spillMe];
+        NodeIndex nodeIndex = info.nodeIndex();
+        Node& node = m_jit.graph()[nodeIndex];
+        ASSERT(info.registerFormat() != DataFormatNone);
+        DataFormat spillFormat = info.registerFormat();
+
+        if (node.isConstant()) {
+            JITCompiler::RegisterID reg = JITCompiler::gprToRegisterID(info.gpr());
+            m_jit.move(constantAsJSValueAsImmPtr(nodeIndex), reg);
+        } else if (node.isArgument()) {
+            JITCompiler::RegisterID reg = JITCompiler::gprToRegisterID(info.gpr());
+            m_jit.loadPtr(m_jit.addressForArgument(m_jit.graph()[nodeIndex].argumentNumber()), reg);
+        } else if (spillFormat == DataFormatDouble) {
+            m_jit.loadPtr(JITCompiler::addressFor(spillMe), JITCompiler::gprToRegisterID(canTrample));
+            unboxDouble(canTrample, info.fpr());
+        } else if (spillFormat == DataFormatInteger) {
+            JITCompiler::RegisterID reg = JITCompiler::gprToRegisterID(info.gpr());
+            m_jit.load32(JITCompiler::addressFor(spillMe), reg);
+        } else {
+            ASSERT(spillFormat & DataFormatJS || spillFormat == DataFormatCell);
+            JITCompiler::RegisterID reg = JITCompiler::gprToRegisterID(info.gpr());
+            m_jit.loadPtr(JITCompiler::addressFor(spillMe), reg);
+        }
+    }
+    void silentSpillAllRegisters(GPRReg dontTrample)
+    {
+        GPRReg canTrample = (dontTrample == gpr0) ? gpr1 : gpr0;
+        
+        for (GPRReg gpr = gpr0; gpr < numberOfGPRs; next(gpr)) {
+            VirtualRegister name = m_gprs.name(gpr);
+            if (name != InvalidVirtualRegister)
+                silentSpill(name, canTrample);
+        }
+        for (FPRReg fpr = fpr0; fpr < numberOfFPRs; next(fpr)) {
+            VirtualRegister name = m_fprs.name(fpr);
+            if (name != InvalidVirtualRegister)
+                silentSpill(name, canTrample);
+        }
+    }
+    void silentFillAllRegisters(GPRReg dontTrample)
+    {
+        GPRReg canTrample = (dontTrample == gpr0) ? gpr1 : gpr0;
+        
+        for (FPRReg fpr = fpr0; fpr < numberOfFPRs; next(fpr)) {
+            VirtualRegister name = m_fprs.name(fpr);
+            if (name != InvalidVirtualRegister)
+                silentFill(name, canTrample);
+        }
+        for (GPRReg gpr = gpr0; gpr < numberOfGPRs; next(gpr)) {
+            VirtualRegister name = m_gprs.name(gpr);
+            if (name != InvalidVirtualRegister)
+                silentFill(name, canTrample);
+        }
+    }
+    void silentFillAllRegisters(FPRReg dontTrample)
+    {
+        GPRReg canTrample = gpr0;
+        
+        for (FPRReg fpr = fpr0; fpr < numberOfFPRs; next(fpr)) {
+            VirtualRegister name = m_fprs.name(fpr);
+            if (name != InvalidVirtualRegister) {
+#ifndef NDEBUG
+                ASSERT(fpr != dontTrample);
+#else
+                UNUSED_PARAM(dontTrample);
+#endif
+                silentFill(name, canTrample);
+            }
+        }
+        for (GPRReg gpr = gpr0; gpr < numberOfGPRs; next(gpr)) {
+            VirtualRegister name = m_gprs.name(gpr);
+            if (name != InvalidVirtualRegister)
+                silentFill(name, canTrample);
+        }
+    }
+
+    // These methods are used to plant calls out to C++
+    // helper routines to convert between types.
+    void valueToNumber(JSValueOperand&, FPRReg result);
+    void valueToInt32(JSValueOperand&, GPRReg result);
+    void numberToInt32(FPRReg, GPRReg result);
+
+    // Record an entry location into the non-speculative code path;
+    // for every bail-out on the speculative path we record information
+    // to be able to re-enter into the non-speculative one.
+    void trackEntry(MacroAssembler::Label entry)
+    {
+        m_entryLocations.append(EntryLocation(entry, this));
+    }
+
+    EntryLocationVector m_entryLocations;
+};
+
+} } // namespace JSC::DFG
+
+#endif
+#endif
+
diff --git a/Source/JavaScriptCore/dfg/DFGOperations.cpp b/Source/JavaScriptCore/dfg/DFGOperations.cpp
new file mode 100644
index 0000000..de14415
--- /dev/null
+++ b/Source/JavaScriptCore/dfg/DFGOperations.cpp
@@ -0,0 +1,220 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGOperations.h"
+
+#if ENABLE(DFG_JIT)
+
+#include "CodeBlock.h"
+#include "Interpreter.h"
+#include "JSByteArray.h"
+#include "JSGlobalData.h"
+#include "Operations.h"
+
+namespace JSC { namespace DFG {
+
+EncodedJSValue operationConvertThis(ExecState* exec, EncodedJSValue encodedOp)
+{
+    return JSValue::encode(JSValue::decode(encodedOp).toThisObject(exec));
+}
+
+EncodedJSValue operationValueAdd(ExecState* exec, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2)
+{
+    JSValue op1 = JSValue::decode(encodedOp1);
+    JSValue op2 = JSValue::decode(encodedOp2);
+
+    if (op1.isInt32() && op2.isInt32()) {
+        int64_t result64 = static_cast<int64_t>(op1.asInt32()) + static_cast<int64_t>(op2.asInt32());
+        int32_t result32 = static_cast<int32_t>(result64);
+        if (LIKELY(result32 == result64))
+            return JSValue::encode(jsNumber(result32));
+        return JSValue::encode(jsNumber((double)result64));
+    }
+    
+    double number1;
+    double number2;
+    if (op1.getNumber(number1) && op2.getNumber(number2))
+        return JSValue::encode(jsNumber(number1 + number2));
+
+    return JSValue::encode(jsAddSlowCase(exec, op1, op2));
+}
+
+EncodedJSValue operationGetByVal(ExecState* exec, EncodedJSValue encodedBase, EncodedJSValue encodedProperty)
+{
+    JSValue baseValue = JSValue::decode(encodedBase);
+    JSValue property = JSValue::decode(encodedProperty);
+
+    if (LIKELY(baseValue.isCell())) {
+        JSCell* base = baseValue.asCell();
+
+        if (property.isUInt32()) {
+            JSGlobalData* globalData = &exec->globalData();
+            uint32_t i = property.asUInt32();
+
+            // FIXME: the JIT used to handle these in compiled code!
+            if (isJSArray(globalData, base) && asArray(base)->canGetIndex(i))
+                return JSValue::encode(asArray(base)->getIndex(i));
+
+            // FIXME: the JITstub used to relink this to an optimized form!
+            if (isJSString(globalData, base) && asString(base)->canGetIndex(i))
+                return JSValue::encode(asString(base)->getIndex(exec, i));
+
+            // FIXME: the JITstub used to relink this to an optimized form!
+            if (isJSByteArray(globalData, base) && asByteArray(base)->canAccessIndex(i))
+                return JSValue::encode(asByteArray(base)->getIndex(exec, i));
+
+            return JSValue::encode(baseValue.get(exec, i));
+        }
+
+        if (property.isString()) {
+            Identifier propertyName(exec, asString(property)->value(exec));
+            PropertySlot slot(base);
+            if (base->fastGetOwnPropertySlot(exec, propertyName, slot))
+                return JSValue::encode(slot.getValue(exec, propertyName));
+        }
+    }
+
+    Identifier ident(exec, property.toString(exec));
+    return JSValue::encode(baseValue.get(exec, ident));
+}
+
+EncodedJSValue operationGetById(ExecState* exec, EncodedJSValue encodedBase, Identifier* identifier)
+{
+    JSValue baseValue = JSValue::decode(encodedBase);
+    PropertySlot slot(baseValue);
+    return JSValue::encode(baseValue.get(exec, *identifier, slot));
+}
+
+template<bool strict>
+ALWAYS_INLINE static void operationPutByValInternal(ExecState* exec, EncodedJSValue encodedBase, EncodedJSValue encodedProperty, EncodedJSValue encodedValue)
+{
+    JSGlobalData* globalData = &exec->globalData();
+
+    JSValue baseValue = JSValue::decode(encodedBase);
+    JSValue property = JSValue::decode(encodedProperty);
+    JSValue value = JSValue::decode(encodedValue);
+
+    if (LIKELY(property.isUInt32())) {
+        uint32_t i = property.asUInt32();
+
+        if (isJSArray(globalData, baseValue)) {
+            JSArray* jsArray = asArray(baseValue);
+            if (jsArray->canSetIndex(i)) {
+                jsArray->setIndex(*globalData, i, value);
+                return;
+            }
+
+            jsArray->JSArray::put(exec, i, value);
+            return;
+        }
+
+        if (isJSByteArray(globalData, baseValue) && asByteArray(baseValue)->canAccessIndex(i)) {
+            JSByteArray* jsByteArray = asByteArray(baseValue);
+            // FIXME: the JITstub used to relink this to an optimized form!
+            if (value.isInt32()) {
+                jsByteArray->setIndex(i, value.asInt32());
+                return;
+            }
+
+            double dValue = 0;
+            if (value.getNumber(dValue)) {
+                jsByteArray->setIndex(i, dValue);
+                return;
+            }
+        }
+
+        baseValue.put(exec, i, value);
+        return;
+    }
+
+    // Don't put to an object if toString throws an exception.
+    Identifier ident(exec, property.toString(exec));
+    if (!globalData->exception) {
+        PutPropertySlot slot(strict);
+        baseValue.put(exec, ident, value, slot);
+    }
+}
+
+void operationPutByValStrict(ExecState* exec, EncodedJSValue encodedBase, EncodedJSValue encodedProperty, EncodedJSValue encodedValue)
+{
+    operationPutByValInternal<true>(exec, encodedBase, encodedProperty, encodedValue);
+}
+
+void operationPutByValNonStrict(ExecState* exec, EncodedJSValue encodedBase, EncodedJSValue encodedProperty, EncodedJSValue encodedValue)
+{
+    operationPutByValInternal<false>(exec, encodedBase, encodedProperty, encodedValue);
+}
+
+void operationPutByIdStrict(ExecState* exec, EncodedJSValue encodedValue, EncodedJSValue encodedBase, Identifier* identifier)
+{
+    PutPropertySlot slot(true);
+    JSValue::decode(encodedBase).put(exec, *identifier, JSValue::decode(encodedValue), slot);
+}
+
+void operationPutByIdNonStrict(ExecState* exec, EncodedJSValue encodedValue, EncodedJSValue encodedBase, Identifier* identifier)
+{
+    PutPropertySlot slot(false);
+    JSValue::decode(encodedBase).put(exec, *identifier, JSValue::decode(encodedValue), slot);
+}
+
+void operationPutByIdDirectStrict(ExecState* exec, EncodedJSValue encodedValue, EncodedJSValue encodedBase, Identifier* identifier)
+{
+    PutPropertySlot slot(true);
+    JSValue::decode(encodedBase).putDirect(exec, *identifier, JSValue::decode(encodedValue), slot);
+}
+
+void operationPutByIdDirectNonStrict(ExecState* exec, EncodedJSValue encodedValue, EncodedJSValue encodedBase, Identifier* identifier)
+{
+    PutPropertySlot slot(false);
+    JSValue::decode(encodedBase).putDirect(exec, *identifier, JSValue::decode(encodedValue), slot);
+}
+
+DFGHandler lookupExceptionHandler(ExecState* exec, ReturnAddressPtr faultLocation)
+{
+    JSValue exceptionValue = exec->exception();
+    ASSERT(exceptionValue);
+
+    unsigned vPCIndex = exec->codeBlock()->bytecodeOffset(faultLocation);
+    HandlerInfo* handler = exec->globalData().interpreter->throwException(exec, exceptionValue, vPCIndex);
+
+    void* catchRoutine = handler ? handler->nativeCode.executableAddress() : (void*)ctiOpThrowNotCaught;
+    ASSERT(catchRoutine);
+    return DFGHandler(exec, catchRoutine);
+}
+
+double dfgConvertJSValueToNumber(ExecState* exec, EncodedJSValue value)
+{
+    return JSValue::decode(value).toNumber(exec);
+}
+
+int32_t dfgConvertJSValueToInt32(ExecState* exec, EncodedJSValue value)
+{
+    return JSValue::decode(value).toInt32(exec);
+}
+
+} } // namespace JSC::DFG
+
+#endif
diff --git a/Source/JavaScriptCore/dfg/DFGOperations.h b/Source/JavaScriptCore/dfg/DFGOperations.h
new file mode 100644
index 0000000..18570e2
--- /dev/null
+++ b/Source/JavaScriptCore/dfg/DFGOperations.h
@@ -0,0 +1,83 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef DFGOperations_h
+#define DFGOperations_h
+
+#if ENABLE(DFG_JIT)
+
+#include <dfg/DFGJITCompiler.h>
+
+namespace JSC {
+
+class Identifier;
+
+namespace DFG {
+
+// These typedefs provide typechecking when generating calls out to helper routines;
+// this helps prevent calling a helper routine with the wrong arguments!
+typedef EncodedJSValue (*J_DFGOperation_EJJ)(ExecState*, EncodedJSValue, EncodedJSValue);
+typedef EncodedJSValue (*J_DFGOperation_EJ)(ExecState*, EncodedJSValue);
+typedef EncodedJSValue (*J_DFGOperation_EJP)(ExecState*, EncodedJSValue, void*);
+typedef EncodedJSValue (*J_DFGOperation_EJI)(ExecState*, EncodedJSValue, Identifier*);
+typedef void (*V_DFGOperation_EJJJ)(ExecState*, EncodedJSValue, EncodedJSValue, EncodedJSValue);
+typedef void (*V_DFGOperation_EJJP)(ExecState*, EncodedJSValue, EncodedJSValue, void*);
+typedef void (*V_DFGOperation_EJJI)(ExecState*, EncodedJSValue, EncodedJSValue, Identifier*);
+typedef double (*D_DFGOperation_DD)(double, double);
+
+// These routines are provide callbacks out to C++ implementations of operations too complex to JIT.
+EncodedJSValue operationConvertThis(ExecState*, EncodedJSValue encodedOp1);
+EncodedJSValue operationValueAdd(ExecState*, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2);
+EncodedJSValue operationGetByVal(ExecState*, EncodedJSValue encodedBase, EncodedJSValue encodedProperty);
+EncodedJSValue operationGetById(ExecState*, EncodedJSValue encodedBase, Identifier*);
+void operationPutByValStrict(ExecState*, EncodedJSValue encodedBase, EncodedJSValue encodedProperty, EncodedJSValue encodedValue);
+void operationPutByValNonStrict(ExecState*, EncodedJSValue encodedBase, EncodedJSValue encodedProperty, EncodedJSValue encodedValue);
+void operationPutByIdStrict(ExecState*, EncodedJSValue encodedValue, EncodedJSValue encodedBase, Identifier*);
+void operationPutByIdNonStrict(ExecState*, EncodedJSValue encodedValue, EncodedJSValue encodedBase, Identifier*);
+void operationPutByIdDirectStrict(ExecState*, EncodedJSValue encodedValue, EncodedJSValue encodedBase, Identifier*);
+void operationPutByIdDirectNonStrict(ExecState*, EncodedJSValue encodedValue, EncodedJSValue encodedBase, Identifier*);
+
+// This method is used to lookup an exception hander, keyed by faultLocation, which is
+// the return location from one of the calls out to one of the helper operations above.
+struct DFGHandler {
+    DFGHandler(ExecState* exec, void* handler)
+        : exec(exec)
+        , handler(handler)
+    {
+    }
+
+    ExecState* exec;
+    void* handler;
+};
+DFGHandler lookupExceptionHandler(ExecState*, ReturnAddressPtr faultLocation);
+
+// These operations implement the implicitly called ToInt32 and ToNumber conversions from ES5.
+double dfgConvertJSValueToNumber(ExecState*, EncodedJSValue);
+int32_t dfgConvertJSValueToInt32(ExecState*, EncodedJSValue);
+
+} } // namespace JSC::DFG
+
+#endif
+#endif
diff --git a/Source/JavaScriptCore/dfg/DFGRegisterBank.h b/Source/JavaScriptCore/dfg/DFGRegisterBank.h
new file mode 100644
index 0000000..575e6b7
--- /dev/null
+++ b/Source/JavaScriptCore/dfg/DFGRegisterBank.h
@@ -0,0 +1,253 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef DFGRegisterBank_h
+#define DFGRegisterBank_h
+
+#if ENABLE(DFG_JIT)
+
+#include <dfg/DFGJITCompiler.h>
+
+namespace JSC { namespace DFG {
+
+// === RegisterBank ===
+//
+// This class is used to implement the GPR and FPR register banks.
+// All registers have two pieces of state associated with them:
+// a lock count (used to indicate this register is already in use
+// in code generation of the current node, and cannot be spilled or
+// allocated as a temporary), and VirtualRegister 'name', recording
+// which value (if any) a machine register currently holds.
+// Either or both of these pieces of information may be valid for a
+// given register. A register may be:
+//
+//  - unlocked, and unnamed: Available for allocation.
+//  - locked, but unnamed:   Already allocated as a temporary or
+//                           result for the current node.
+//  - unlocked, but named:   Contains the result of a prior operation,
+//                           not yet in use for this node,
+//  - locked, but named:     Contains the result of a prior operation,
+//                           already allocated as a operand to the
+//                           current operation.
+//
+// For every named register we also record a hint value indicating
+// the order in which registers should be selected to be spilled;
+// registers that can be more cheaply spilled and/or filled should
+// be selected first.
+//
+// Locking register is a strong retention mechanism; a locked register
+// will never be reallocated (this is used to ensure the operands to
+// the current node are in registers). Naming, conversely, in a weak
+// retention mechanism - allocating a register may force a named value
+// to be spilled.
+//
+// All named values must be given a hint that is greater than Min and
+// less than Max.
+template<typename RegID, size_t NUM_REGS, typename SpillHint, SpillHint SpillHintMin, SpillHint SpillHintMax>
+class RegisterBank {
+public:
+    RegisterBank()
+        : m_lastAllocated(NUM_REGS - 1)
+    {
+    }
+
+    // Allocate a register - this function finds an unlocked register,
+    // locks it, and returns it. If any named registers exist, one
+    // of these should be selected to be allocated. If all unlocked
+    // registers are named, then one of the named registers will need
+    // to be spilled. In this case the register selected to be spilled
+    // will be one of the registers that has the lowest 'spillOrder'
+    // cost associated with it.
+    //
+    // This method select the register to be allocated, and calls the
+    // private 'allocateInternal' method to update internal data
+    // structures accordingly.
+    RegID allocate(VirtualRegister &spillMe)
+    {
+        uint32_t currentLowest = NUM_REGS;
+        SpillHint currentSpillOrder = SpillHintMax;
+
+        // Scan through all register, starting at the last allocated & looping around.
+        ASSERT(m_lastAllocated < NUM_REGS);
+
+        // This loop is broken into two halves, looping from the last allocated
+        // register (the register returned last time this method was called) to
+        // the maximum register value, then from 0 to the last allocated.
+        // This implements a simple round-robin like approach to try to reduce
+        // thrash, and minimize time spent scanning locked registers in allocation.
+        // If a unlocked and unnamed register is found return it immediately.
+        // Otherwise, find the first unlocked register with the lowest spillOrder.
+        for (uint32_t i = m_lastAllocated + 1; i < NUM_REGS; ++i) {
+            // (1) If the current register is locked, it is not a candidate.
+            if (m_data[i].lockCount)
+                continue;
+            // (2) If the current register's spill order is 0, pick this! – unassigned registers have spill order 0.
+            SpillHint spillOrder = m_data[i].spillOrder;
+            if (!spillOrder)
+                return allocateInternal(i, spillMe);
+            // If this register is better (has a lower spill order value) than any prior
+            // candidate, then record it.
+            if (spillOrder < currentSpillOrder) {
+                currentSpillOrder = spillOrder;
+                currentLowest = i;
+            }
+        }
+        // Loop over the remaining entries.
+        for (uint32_t i = 0; i <= m_lastAllocated; ++i) {
+            if (m_data[i].lockCount)
+                continue;
+            SpillHint spillOrder = m_data[i].spillOrder;
+            if (!spillOrder)
+                return allocateInternal(i, spillMe);
+            if (spillOrder < currentSpillOrder) {
+                currentSpillOrder = spillOrder;
+                currentLowest = i;
+            }
+        }
+
+        // Deadlock check - this could only occur is all registers are locked!
+        ASSERT(currentLowest != NUM_REGS && currentSpillOrder != SpillHintMax);
+        // There were no available registers; currentLowest will need to be spilled.
+        return allocateInternal(currentLowest, spillMe);
+    }
+
+    // retain/release - these methods are used to associate/disassociate names
+    // with values in registers. retain should only be called on locked registers.
+    void retain(RegID reg, VirtualRegister name, SpillHint spillOrder)
+    {
+        // 'reg' must be a valid, locked register.
+        ASSERT(reg < NUM_REGS);
+        ASSERT(m_data[reg].lockCount);
+        // 'reg' should not currently be named, the new name must be valid.
+        ASSERT(m_data[reg].name == InvalidVirtualRegister);
+        ASSERT(name != InvalidVirtualRegister);
+        // 'reg' should not currently have a spillOrder, the new spill order must be valid.
+        ASSERT(spillOrder && spillOrder < SpillHintMax);
+        ASSERT(m_data[reg].spillOrder == SpillHintMin);
+
+        m_data[reg].name = name;
+        m_data[reg].spillOrder = spillOrder;
+    }
+    void release(RegID reg)
+    {
+        // 'reg' must be a valid register.
+        ASSERT(reg < NUM_REGS);
+        // 'reg' should currently be named.
+        ASSERT(m_data[reg].name != InvalidVirtualRegister);
+        // 'reg' should currently have a valid spill order.
+        ASSERT(m_data[reg].spillOrder > SpillHintMin && m_data[reg].spillOrder < SpillHintMax);
+
+        m_data[reg].name = InvalidVirtualRegister;
+        m_data[reg].spillOrder = SpillHintMin;
+    }
+
+    // lock/unlock register, ensures that they are not spilled.
+    void lock(RegID reg)
+    {
+        ASSERT(reg < NUM_REGS);
+        ++m_data[reg].lockCount;
+        ASSERT(m_data[reg].lockCount);
+    }
+    void unlock(RegID reg)
+    {
+        ASSERT(reg < NUM_REGS);
+        ASSERT(m_data[reg].lockCount);
+        --m_data[reg].lockCount;
+    }
+    bool isLocked(RegID reg)
+    {
+        ASSERT(reg < NUM_REGS);
+        return m_data[reg].lockCount;
+    }
+
+    // Get the name (VirtualRegister) associated with the
+    // given register (or InvalidVirtualRegister for none).
+    VirtualRegister name(RegID reg)
+    {
+        ASSERT(reg < NUM_REGS);
+        return m_data[reg].name;
+    }
+
+#ifndef NDEBUG
+    void dump()
+    {
+        // For each register, print the VirtualRegister 'name'.
+        for (uint32_t i =0; i < NUM_REGS; ++i) {
+            if (m_data[i].name != InvalidVirtualRegister)
+                fprintf(stderr, "[%02d]", m_data[i].name);
+            else
+                fprintf(stderr, "[--]");
+        }
+        fprintf(stderr, "\n");
+    }
+#endif
+
+private:
+    // Used by 'allocate', above, to update inforamtion in the map.
+    RegID allocateInternal(uint32_t i, VirtualRegister &spillMe)
+    {
+        // 'i' must be a valid, unlocked register.
+        ASSERT(i < NUM_REGS && !m_data[i].lockCount);
+
+        // Return the VirtualRegister of the named value currently stored in
+        // the register being returned - or InvalidVirtualRegister if none.
+        spillMe = m_data[i].name;
+
+        // Clear any name/spillOrder currently associated with the register,
+        m_data[i] = MapEntry();
+        m_data[i].lockCount = 1;
+        // Mark the register as locked (with a lock count of 1).
+        m_lastAllocated = i;
+        return (RegID)i;
+    }
+
+    // === MapEntry ===
+    //
+    // This structure provides information for an individual machine register
+    // being managed by the RegisterBank. For each register we track a lock
+    // count, name and spillOrder hint.
+    struct MapEntry {
+        MapEntry()
+            : name(InvalidVirtualRegister)
+            , spillOrder(SpillHintMin)
+            , lockCount(0)
+        {
+        }
+
+        VirtualRegister name;
+        SpillHint spillOrder;
+        uint32_t lockCount;
+    };
+
+    // Holds the current status of all registers.
+    MapEntry m_data[NUM_REGS];
+    // Used to to implement a simple round-robin like allocation scheme.
+    uint32_t m_lastAllocated;
+};
+
+} } // namespace JSC::DFG
+
+#endif
+#endif
diff --git a/Source/JavaScriptCore/dfg/DFGScoreBoard.h b/Source/JavaScriptCore/dfg/DFGScoreBoard.h
new file mode 100644
index 0000000..eefed9e
--- /dev/null
+++ b/Source/JavaScriptCore/dfg/DFGScoreBoard.h
@@ -0,0 +1,127 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef DFGScoreBoard_h
+#define DFGScoreBoard_h
+
+#if ENABLE(DFG_JIT)
+
+#include <dfg/DFGGraph.h>
+#include <wtf/Vector.h>
+
+namespace JSC { namespace DFG {
+
+// === ScoreBoard ===
+//
+// This class is used in performing a virtual register allocation over the graph.
+// VirtualRegisters are allocated to nodes, with a used count for each virtual
+// register tracking the lifespan of the value; after the final use of a node
+// the VirtualRegister associated is freed such that it can be reused for
+// another node.
+class ScoreBoard {
+public:
+    ScoreBoard(Graph& graph)
+        : m_graph(graph)
+    {
+    }
+
+#if DFG_CONSISTENCY_CHECK
+    ~ScoreBoard()
+    {
+        // Every VirtualRegister that was allocated should now be free.
+        ASSERT(m_used.size() == m_free.size());
+        // For every entry in the free list, the use count of the virtual register should be zero.
+        // * By using the virtual register numbers from m_free, we are checking that all values
+        //   in m_free are < m_used.size(), and correspond to an allocated VirtualRegsiter.
+        // * By setting m_used to a non-zero value after checking it, we are checking that all
+        //   entries in m_free are unique (otherwise the second test of m_used will fail).
+        for (size_t i = 0; i < m_free.size(); ++i) {
+            VirtualRegister virtualRegister = m_free[i];
+            ASSERT(!m_used[virtualRegister]);
+            m_used[virtualRegister] = 1;
+        }
+    }
+#endif
+
+    VirtualRegister allocate()
+    {
+        // Do we have any VirtualRegsiters in the free list, that were used by
+        // prior nodes, but are now available?
+        if (!m_free.isEmpty()) {
+            VirtualRegister result = m_free.last();
+            m_free.removeLast();
+            // Use count must have hit zero for it to have been added to the free list!
+            ASSERT(!m_used[result]);
+            return result;
+        }
+
+        // Allocate a new VirtualRegister, and add a corresponding entry to m_used.
+        size_t next = allocatedCount();
+        m_used.append(0);
+        return (VirtualRegister)next;
+    }
+
+    // Increment the usecount for the VirtualRegsiter associated with 'child',
+    // if it reaches the node's refcount, free the VirtualRegsiter.
+    void use(NodeIndex child)
+    {
+        if (child == NoNode)
+            return;
+
+        // Find the virtual register number for this child, increment its use count.
+        Node& node = m_graph[child];
+        VirtualRegister index = node.virtualRegister;
+        if (node.refCount == ++m_used[index]) {
+            // If the use count in the scoreboard reaches the use count for the node,
+            // then this was its last use; the virtual register is now free.
+            // Clear the use count & add to the free list.
+            m_used[index] = 0;
+            m_free.append(index);
+        }
+    }
+
+    unsigned allocatedCount()
+    {
+        // m_used contains an entry for every allocated VirtualRegister.
+        return m_used.size();
+    }
+
+private:
+    // The graph, so we can get refCounts for nodes, to determine when values are dead.
+    Graph& m_graph;
+    // For every virtual register that has been allocated (either currently alive, or in
+    // the free list), we keep a count of the number of remaining uses until it is dead
+    // (0, in the case of entries in the free list). Since there is an entry for every
+    // allocated VirtualRegister, the length of this array conveniently provides the
+    // next available VirtualRegister number.
+    Vector<uint32_t, 64> m_used;
+    // A free list of VirtualRegsiters no longer alive.
+    Vector<VirtualRegister, 64> m_free;
+};
+
+} } // namespace JSC::DFG
+
+#endif
+#endif
diff --git a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
new file mode 100644
index 0000000..95472e1
--- /dev/null
+++ b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
@@ -0,0 +1,663 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGSpeculativeJIT.h"
+
+#if ENABLE(DFG_JIT)
+
+namespace JSC { namespace DFG {
+
+template<bool strict>
+GPRReg SpeculativeJIT::fillSpeculateIntInternal(NodeIndex nodeIndex, DataFormat& returnFormat)
+{
+    Node& node = m_jit.graph()[nodeIndex];
+    VirtualRegister virtualRegister = node.virtualRegister;
+    GenerationInfo& info = m_generationInfo[virtualRegister];
+
+    switch (info.registerFormat()) {
+    case DataFormatNone: {
+        GPRReg gpr = allocate();
+        JITCompiler::RegisterID reg = JITCompiler::gprToRegisterID(gpr);
+
+        if (node.isConstant()) {
+            m_gprs.retain(gpr, virtualRegister, SpillOrderConstant);
+            if (isInt32Constant(nodeIndex)) {
+                m_jit.move(MacroAssembler::Imm32(valueOfInt32Constant(nodeIndex)), reg);
+                info.fillInteger(gpr);
+                returnFormat = DataFormatInteger;
+                return gpr;
+            }
+            m_jit.move(constantAsJSValueAsImmPtr(nodeIndex), reg);
+        } else if (node.isArgument()) {
+            m_gprs.retain(gpr, virtualRegister, SpillOrderArgument);
+            m_jit.loadPtr(m_jit.addressForArgument(m_jit.graph()[nodeIndex].argumentNumber()), reg);
+        } else {
+            DataFormat spillFormat = info.spillFormat();
+            ASSERT(spillFormat & DataFormatJS);
+
+            m_gprs.retain(gpr, virtualRegister, SpillOrderSpilled);
+
+            if (spillFormat == DataFormatJSInteger) {
+                // If we know this was spilled as an integer we can fill without checking.
+                if (strict) {
+                    m_jit.load32(JITCompiler::addressFor(virtualRegister), reg);
+                    info.fillInteger(gpr);
+                    returnFormat = DataFormatInteger;
+                    return gpr;
+                }
+                m_jit.loadPtr(JITCompiler::addressFor(virtualRegister), reg);
+                info.fillJSValue(gpr, DataFormatJSInteger);
+                returnFormat = DataFormatJSInteger;
+                return gpr;
+            }
+            m_jit.loadPtr(JITCompiler::addressFor(virtualRegister), reg);
+        }
+
+        // Fill as JSValue, and fall through.
+        info.fillJSValue(gpr, DataFormatJSInteger);
+        m_gprs.unlock(gpr);
+    }
+
+    case DataFormatJS: {
+        // Check the value is an integer.
+        GPRReg gpr = info.gpr();
+        m_gprs.lock(gpr);
+        JITCompiler::RegisterID reg = JITCompiler::gprToRegisterID(gpr);
+        speculationCheck(m_jit.branchPtr(MacroAssembler::Below, reg, JITCompiler::tagTypeNumberRegister));
+        info.fillJSValue(gpr, DataFormatJSInteger);
+        // If !strict we're done, return.
+        if (!strict) {
+            returnFormat = DataFormatJSInteger;
+            return gpr;
+        }
+        // else fall through & handle as DataFormatJSInteger.
+        m_gprs.unlock(gpr);
+    }
+
+    case DataFormatJSInteger: {
+        // In a strict fill we need to strip off the value tag.
+        if (strict) {
+            GPRReg gpr = info.gpr();
+            GPRReg result;
+            // If the register has already been locked we need to take a copy.
+            // If not, we'll zero extend in place, so mark on the info that this is now type DataFormatInteger, not DataFormatJSInteger.
+            if (m_gprs.isLocked(gpr))
+                result = allocate();
+            else {
+                m_gprs.lock(gpr);
+                info.fillInteger(gpr);
+                result = gpr;
+            }
+            m_jit.zeroExtend32ToPtr(JITCompiler::gprToRegisterID(gpr), JITCompiler::gprToRegisterID(result));
+            returnFormat = DataFormatInteger;
+            return result;
+        }
+
+        GPRReg gpr = info.gpr();
+        m_gprs.lock(gpr);
+        returnFormat = DataFormatJSInteger;
+        return gpr;
+    }
+
+    case DataFormatInteger: {
+        GPRReg gpr = info.gpr();
+        m_gprs.lock(gpr);
+        returnFormat = DataFormatInteger;
+        return gpr;
+    }
+
+    case DataFormatDouble:
+    case DataFormatCell:
+    case DataFormatJSDouble:
+    case DataFormatJSCell: {
+        terminateSpeculativeExecution();
+        returnFormat = DataFormatInteger;
+        return allocate();
+    }
+    }
+
+    ASSERT_NOT_REACHED();
+    return InvalidGPRReg;
+}
+
+SpeculationCheck::SpeculationCheck(MacroAssembler::Jump check, SpeculativeJIT* jit, unsigned recoveryIndex)
+    : m_check(check)
+    , m_nodeIndex(jit->m_compileIndex)
+    , m_recoveryIndex(recoveryIndex)
+{
+    for (GPRReg gpr = gpr0; gpr < numberOfGPRs; next(gpr)) {
+        VirtualRegister virtualRegister = jit->m_gprs.name(gpr);
+        if (virtualRegister != InvalidVirtualRegister) {
+            GenerationInfo& info =  jit->m_generationInfo[virtualRegister];
+            m_gprInfo[gpr].nodeIndex = info.nodeIndex();
+            m_gprInfo[gpr].format = info.registerFormat();
+        } else
+            m_gprInfo[gpr].nodeIndex = NoNode;
+    }
+    for (FPRReg fpr = fpr0; fpr < numberOfFPRs; next(fpr)) {
+        VirtualRegister virtualRegister = jit->m_fprs.name(fpr);
+        if (virtualRegister != InvalidVirtualRegister) {
+            GenerationInfo& info =  jit->m_generationInfo[virtualRegister];
+            ASSERT(info.registerFormat() == DataFormatDouble);
+            m_fprInfo[fpr] = info.nodeIndex();
+        } else
+            m_fprInfo[fpr] = NoNode;
+    }
+}
+
+GPRReg SpeculativeJIT::fillSpeculateInt(NodeIndex nodeIndex, DataFormat& returnFormat)
+{
+    return fillSpeculateIntInternal<false>(nodeIndex, returnFormat);
+}
+
+GPRReg SpeculativeJIT::fillSpeculateIntStrict(NodeIndex nodeIndex)
+{
+    DataFormat mustBeDataFormatInteger;
+    GPRReg result = fillSpeculateIntInternal<true>(nodeIndex, mustBeDataFormatInteger);
+    ASSERT(mustBeDataFormatInteger == DataFormatInteger);
+    return result;
+}
+
+GPRReg SpeculativeJIT::fillSpeculateCell(NodeIndex nodeIndex)
+{
+    Node& node = m_jit.graph()[nodeIndex];
+    VirtualRegister virtualRegister = node.virtualRegister;
+    GenerationInfo& info = m_generationInfo[virtualRegister];
+
+    switch (info.registerFormat()) {
+    case DataFormatNone: {
+        GPRReg gpr = allocate();
+        JITCompiler::RegisterID reg = JITCompiler::gprToRegisterID(gpr);
+
+        if (node.isConstant()) {
+            m_gprs.retain(gpr, virtualRegister, SpillOrderConstant);
+            JSValue jsValue = constantAsJSValue(nodeIndex);
+            if (jsValue.isCell()) {
+                m_jit.move(MacroAssembler::TrustedImmPtr(jsValue.asCell()), reg);
+                info.fillJSValue(gpr, DataFormatJSCell);
+                return gpr;
+            }
+            terminateSpeculativeExecution();
+            return gpr;
+        }
+        if (node.isArgument()) {
+            m_gprs.retain(gpr, virtualRegister, SpillOrderArgument);
+            m_jit.loadPtr(m_jit.addressForArgument(m_jit.graph()[nodeIndex].argumentNumber()), reg);
+            speculationCheck(m_jit.branchTestPtr(MacroAssembler::NonZero, reg, JITCompiler::tagMaskRegister));
+            info.fillJSValue(gpr, DataFormatJSCell);
+            return gpr;
+        }
+        ASSERT(info.spillFormat() & DataFormatJS);
+        m_gprs.retain(gpr, virtualRegister, SpillOrderSpilled);
+        m_jit.loadPtr(JITCompiler::addressFor(virtualRegister), reg);
+
+        if (info.spillFormat() != DataFormatJSCell)
+            speculationCheck(m_jit.branchTestPtr(MacroAssembler::NonZero, reg, JITCompiler::tagMaskRegister));
+        info.fillJSValue(gpr, DataFormatJSCell);
+        return gpr;
+    }
+
+    case DataFormatCell:
+    case DataFormatJSCell: {
+        GPRReg gpr = info.gpr();
+        m_gprs.lock(gpr);
+        return gpr;
+    }
+
+    case DataFormatJS: {
+        GPRReg gpr = info.gpr();
+        m_gprs.lock(gpr);
+        JITCompiler::RegisterID reg = JITCompiler::gprToRegisterID(gpr);
+        speculationCheck(m_jit.branchTestPtr(MacroAssembler::NonZero, reg, JITCompiler::tagMaskRegister));
+        info.fillJSValue(gpr, DataFormatJSCell);
+        return gpr;
+    }
+
+    case DataFormatJSInteger:
+    case DataFormatInteger:
+    case DataFormatJSDouble:
+    case DataFormatDouble: {
+        terminateSpeculativeExecution();
+        return allocate();
+    }
+    }
+
+    ASSERT_NOT_REACHED();
+    return InvalidGPRReg;
+}
+
+bool SpeculativeJIT::compile(Node& node)
+{
+    checkConsistency();
+
+    NodeType op = node.op;
+
+    switch (op) {
+    case Int32Constant:
+    case DoubleConstant:
+    case JSConstant:
+        initConstantInfo(m_compileIndex);
+        break;
+    
+    case Argument:
+        initArgumentInfo(m_compileIndex);
+        break;
+
+    case BitAnd:
+    case BitOr:
+    case BitXor:
+        if (isInt32Constant(node.child1)) {
+            SpeculateIntegerOperand op2(this, node.child2);
+            GPRTemporary result(this, op2);
+
+            bitOp(op, valueOfInt32Constant(node.child1), op2.registerID(), result.registerID());
+
+            integerResult(result.gpr(), m_compileIndex);
+        } else if (isInt32Constant(node.child2)) {
+            SpeculateIntegerOperand op1(this, node.child1);
+            GPRTemporary result(this, op1);
+
+            bitOp(op, valueOfInt32Constant(node.child2), op1.registerID(), result.registerID());
+
+            integerResult(result.gpr(), m_compileIndex);
+        } else {
+            SpeculateIntegerOperand op1(this, node.child1);
+            SpeculateIntegerOperand op2(this, node.child2);
+            GPRTemporary result(this, op1, op2);
+
+            MacroAssembler::RegisterID reg1 = op1.registerID();
+            MacroAssembler::RegisterID reg2 = op2.registerID();
+            bitOp(op, reg1, reg2, result.registerID());
+
+            integerResult(result.gpr(), m_compileIndex);
+        }
+        break;
+
+    case BitRShift:
+    case BitLShift:
+    case BitURShift:
+        if (isInt32Constant(node.child2)) {
+            SpeculateIntegerOperand op1(this, node.child1);
+            GPRTemporary result(this, op1);
+
+            shiftOp(op, op1.registerID(), valueOfInt32Constant(node.child2) & 0x1f, result.registerID());
+
+            integerResult(result.gpr(), m_compileIndex);
+        } else {
+            // Do not allow shift amount to be used as the result, MacroAssembler does not permit this.
+            SpeculateIntegerOperand op1(this, node.child1);
+            SpeculateIntegerOperand op2(this, node.child2);
+            GPRTemporary result(this, op1);
+
+            MacroAssembler::RegisterID reg1 = op1.registerID();
+            MacroAssembler::RegisterID reg2 = op2.registerID();
+            shiftOp(op, reg1, reg2, result.registerID());
+
+            integerResult(result.gpr(), m_compileIndex);
+        }
+        break;
+
+    case UInt32ToNumber: {
+        IntegerOperand op1(this, node.child1);
+        GPRTemporary result(this, op1);
+
+        // Test the operand is positive.
+        speculationCheck(m_jit.branch32(MacroAssembler::LessThan, op1.registerID(), TrustedImm32(0)));
+
+        m_jit.move(op1.registerID(), result.registerID());
+        integerResult(result.gpr(), m_compileIndex, op1.format());
+        break;
+    }
+
+    case NumberToInt32: {
+        SpeculateIntegerOperand op1(this, node.child1);
+        GPRTemporary result(this, op1);
+        m_jit.move(op1.registerID(), result.registerID());
+        integerResult(result.gpr(), m_compileIndex, op1.format());
+        break;
+    }
+
+    case Int32ToNumber: {
+        SpeculateIntegerOperand op1(this, node.child1);
+        GPRTemporary result(this, op1);
+        m_jit.move(op1.registerID(), result.registerID());
+        integerResult(result.gpr(), m_compileIndex, op1.format());
+        break;
+    }
+    case ValueToInt32: {
+        SpeculateIntegerOperand op1(this, node.child1);
+        GPRTemporary result(this, op1);
+        m_jit.move(op1.registerID(), result.registerID());
+        integerResult(result.gpr(), m_compileIndex, op1.format());
+        break;
+    }
+
+    case ValueToNumber: {
+        SpeculateIntegerOperand op1(this, node.child1);
+        GPRTemporary result(this, op1);
+        m_jit.move(op1.registerID(), result.registerID());
+        integerResult(result.gpr(), m_compileIndex, op1.format());
+        break;
+    }
+
+    case ValueAdd:
+    case ArithAdd: {
+        SpeculateIntegerOperand op1(this, node.child1);
+        SpeculateIntegerOperand op2(this, node.child2);
+        GPRTemporary result(this, op1, op2);
+
+        GPRReg gpr1 = op1.gpr();
+        GPRReg gpr2 = op2.gpr();
+        GPRReg gprResult = result.gpr();
+        MacroAssembler::Jump check = m_jit.branchAdd32(MacroAssembler::Overflow, JITCompiler::gprToRegisterID(gpr1), JITCompiler::gprToRegisterID(gpr2), JITCompiler::gprToRegisterID(gprResult));
+
+        if (gpr1 == gprResult)
+            speculationCheck(check, SpeculationRecovery(SpeculativeAdd, gprResult, gpr2));
+        else if (gpr2 == gprResult)
+            speculationCheck(check, SpeculationRecovery(SpeculativeAdd, gprResult, gpr1));
+        else
+            speculationCheck(check);
+
+        integerResult(gprResult, m_compileIndex);
+        break;
+    }
+
+    case ArithSub: {
+        SpeculateIntegerOperand op1(this, node.child1);
+        SpeculateIntegerOperand op2(this, node.child2);
+        GPRTemporary result(this);
+
+        MacroAssembler::RegisterID reg1 = op1.registerID();
+        MacroAssembler::RegisterID reg2 = op2.registerID();
+        speculationCheck(m_jit.branchSub32(MacroAssembler::Overflow, reg1, reg2, result.registerID()));
+
+        integerResult(result.gpr(), m_compileIndex);
+        break;
+    }
+
+    case ArithMul: {
+        SpeculateIntegerOperand op1(this, node.child1);
+        SpeculateIntegerOperand op2(this, node.child2);
+        GPRTemporary result(this);
+
+        MacroAssembler::RegisterID reg1 = op1.registerID();
+        MacroAssembler::RegisterID reg2 = op2.registerID();
+        speculationCheck(m_jit.branchMul32(MacroAssembler::Overflow, reg1, reg2, result.registerID()));
+        speculationCheck(m_jit.branchTest32(MacroAssembler::Zero, result.registerID()));
+
+        integerResult(result.gpr(), m_compileIndex);
+        break;
+    }
+
+    case ArithDiv: {
+        SpeculateIntegerOperand op1(this, node.child1);
+        SpeculateIntegerOperand op2(this, node.child2);
+        GPRTemporary result(this, op1, op2);
+
+        terminateSpeculativeExecution();
+
+        integerResult(result.gpr(), m_compileIndex);
+        break;
+    }
+
+    case ArithMod: {
+        SpeculateIntegerOperand op1(this, node.child1);
+        SpeculateIntegerOperand op2(this, node.child2);
+        GPRTemporary result(this, op1, op2);
+
+        terminateSpeculativeExecution();
+
+        integerResult(result.gpr(), m_compileIndex);
+        break;
+    }
+
+    case GetByVal: {
+        NodeIndex alias = node.child3;
+        if (alias != NoNode) {
+            // FIXME: result should be able to reuse child1, child2. Should have an 'UnusedOperand' type.
+            JSValueOperand aliasedValue(this, node.child3);
+            GPRTemporary result(this, aliasedValue);
+            m_jit.move(aliasedValue.registerID(), result.registerID());
+            jsValueResult(result.gpr(), m_compileIndex);
+            break;
+        }
+
+        SpeculateCellOperand base(this, node.child1);
+        SpeculateStrictInt32Operand property(this, node.child2);
+        GPRTemporary storage(this);
+
+        MacroAssembler::RegisterID baseReg = base.registerID();
+        MacroAssembler::RegisterID propertyReg = property.registerID();
+        MacroAssembler::RegisterID storageReg = storage.registerID();
+
+        // Get the array storage. We haven't yet checked this is a JSArray, so this is only safe if
+        // an access with offset JSArray::storageOffset() is valid for all JSCells!
+        m_jit.loadPtr(MacroAssembler::Address(baseReg, JSArray::storageOffset()), storageReg);
+
+        // Check that base is an array, and that property is contained within m_vector (< m_vectorLength).
+        speculationCheck(m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(baseReg), MacroAssembler::TrustedImmPtr(m_jit.globalData()->jsArrayVPtr)));
+        speculationCheck(m_jit.branch32(MacroAssembler::AboveOrEqual, propertyReg, MacroAssembler::Address(baseReg, JSArray::vectorLengthOffset())));
+
+        // FIXME: In cases where there are subsequent by_val accesses to the same base it might help to cache
+        // the storage pointer - especially if there happens to be another register free right now. If we do so,
+        // then we'll need to allocate a new temporary for result.
+        GPRTemporary& result = storage;
+        m_jit.loadPtr(MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::ScalePtr, OBJECT_OFFSETOF(ArrayStorage, m_vector[0])), result.registerID());
+        speculationCheck(m_jit.branchTestPtr(MacroAssembler::Zero, result.registerID()));
+
+        jsValueResult(result.gpr(), m_compileIndex);
+        break;
+    }
+
+    case PutByVal:
+    case PutByValAlias: {
+        SpeculateStrictInt32Operand property(this, node.child2);
+        GPRTemporary storage(this);
+
+        MacroAssembler::RegisterID propertyReg;
+        MacroAssembler::RegisterID storageReg;
+
+        // This block also defines the scope for base, and all bails to the non-speculative path.
+        // At the end of this scope base will be release, and as such may be reused by for 'value'.
+        //
+        // If we've already read from this location on the speculative pass, then it cannot be beyond array bounds, or a hole.
+        if (op == PutByValAlias) {
+            SpeculateCellOperand base(this, node.child1);
+
+            // Map base & property into registers, allocate a register for storage.
+            propertyReg = property.registerID();
+            storageReg = storage.registerID();
+            MacroAssembler::RegisterID baseReg = base.registerID();
+
+            // Get the array storage.
+            m_jit.loadPtr(MacroAssembler::Address(baseReg, JSArray::storageOffset()), storageReg);
+        } else {
+            SpeculateCellOperand base(this, node.child1);
+
+            // Map base & property into registers, allocate a register for storage.
+            propertyReg = property.registerID();
+            storageReg = storage.registerID();
+            MacroAssembler::RegisterID baseReg = base.registerID();
+
+            // Check that base is an array, and that property is contained within m_vector (< m_vectorLength).
+            speculationCheck(m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(baseReg), MacroAssembler::TrustedImmPtr(m_jit.globalData()->jsArrayVPtr)));
+            speculationCheck(m_jit.branch32(MacroAssembler::AboveOrEqual, propertyReg, MacroAssembler::Address(baseReg, JSArray::vectorLengthOffset())));
+
+            // Get the array storage.
+            m_jit.loadPtr(MacroAssembler::Address(baseReg, JSArray::storageOffset()), storageReg);
+
+            // Check if we're writing to a hole; if so increment m_numValuesInVector.
+            MacroAssembler::Jump notHoleValue = m_jit.branchTestPtr(MacroAssembler::NonZero, MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::ScalePtr, OBJECT_OFFSETOF(ArrayStorage, m_vector[0])));
+            m_jit.add32(TrustedImm32(1), MacroAssembler::Address(storageReg, OBJECT_OFFSETOF(ArrayStorage, m_numValuesInVector)));
+
+            // If we're writing to a hole we might be growing the array; 
+            MacroAssembler::Jump lengthDoesNotNeedUpdate = m_jit.branch32(MacroAssembler::Below, propertyReg, MacroAssembler::Address(storageReg, OBJECT_OFFSETOF(ArrayStorage, m_length)));
+            m_jit.add32(TrustedImm32(1), propertyReg);
+            m_jit.store32(propertyReg, MacroAssembler::Address(storageReg, OBJECT_OFFSETOF(ArrayStorage, m_length)));
+            m_jit.sub32(TrustedImm32(1), propertyReg);
+
+            lengthDoesNotNeedUpdate.link(&m_jit);
+            notHoleValue.link(&m_jit);
+        }
+        // After this point base goes out of scope. This may free the register.
+        // As such, after this point we'd better not have any bails out to the non-speculative path!
+
+        // Store the value to the array.
+        JSValueOperand value(this, node.child3);
+        MacroAssembler::RegisterID valueReg = value.registerID();
+        m_jit.storePtr(valueReg, MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::ScalePtr, OBJECT_OFFSETOF(ArrayStorage, m_vector[0])));
+
+        noResult(m_compileIndex);
+        break;
+    }
+
+    case Return: {
+        ASSERT(JITCompiler::callFrameRegister != JITCompiler::regT1);
+        ASSERT(JITCompiler::regT1 != JITCompiler::returnValueRegister);
+        ASSERT(JITCompiler::returnValueRegister != JITCompiler::callFrameRegister);
+
+        // Return the result in returnValueRegister.
+        JSValueOperand op1(this, node.child1);
+        m_jit.move(op1.registerID(), JITCompiler::returnValueRegister);
+
+        // Grab the return address.
+        m_jit.emitGetFromCallFrameHeaderPtr(RegisterFile::ReturnPC, JITCompiler::regT1);
+        // Restore our caller's "r".
+        m_jit.emitGetFromCallFrameHeaderPtr(RegisterFile::CallerFrame, JITCompiler::callFrameRegister);
+        // Return.
+        m_jit.restoreReturnAddressBeforeReturn(JITCompiler::regT1);
+        m_jit.ret();
+        
+        noResult(m_compileIndex);
+        break;
+    }
+
+    case ConvertThis: {
+        SpeculateCellOperand thisValue(this, node.child1);
+        GPRTemporary temp(this);
+
+        m_jit.loadPtr(JITCompiler::Address(thisValue.registerID(), JSCell::structureOffset()), temp.registerID());
+        speculationCheck(m_jit.branchTest8(JITCompiler::NonZero, JITCompiler::Address(temp.registerID(), Structure::typeInfoFlagsOffset()), JITCompiler::TrustedImm32(NeedsThisConversion)));
+
+        cellResult(thisValue.gpr(), m_compileIndex);
+        break;
+    }
+
+    case GetById: {
+        JSValueOperand base(this, node.child1);
+        GPRReg baseGPR = base.gpr();
+        flushRegisters();
+
+        GPRResult result(this);
+        callOperation(operationGetById, result.gpr(), baseGPR, identifier(node.identifierNumber()));
+        jsValueResult(result.gpr(), m_compileIndex);
+        break;
+    }
+
+    case PutById: {
+        JSValueOperand base(this, node.child1);
+        JSValueOperand value(this, node.child2);
+        GPRReg valueGPR = value.gpr();
+        GPRReg baseGPR = base.gpr();
+        flushRegisters();
+
+        callOperation(m_jit.codeBlock()->isStrictMode() ? operationPutByIdStrict : operationPutByIdNonStrict, valueGPR, baseGPR, identifier(node.identifierNumber()));
+        noResult(m_compileIndex);
+        break;
+    }
+
+    case PutByIdDirect: {
+        JSValueOperand base(this, node.child1);
+        JSValueOperand value(this, node.child2);
+        GPRReg valueGPR = value.gpr();
+        GPRReg baseGPR = base.gpr();
+        flushRegisters();
+
+        callOperation(m_jit.codeBlock()->isStrictMode() ? operationPutByIdDirectStrict : operationPutByIdDirectNonStrict, valueGPR, baseGPR, identifier(node.identifierNumber()));
+        noResult(m_compileIndex);
+        break;
+    }
+
+    case GetGlobalVar: {
+        GPRTemporary result(this);
+
+        JSVariableObject* globalObject = m_jit.codeBlock()->globalObject();
+        m_jit.loadPtr(globalObject->addressOfRegisters(), result.registerID());
+        m_jit.loadPtr(JITCompiler::addressForGlobalVar(result.registerID(), node.varNumber()), result.registerID());
+
+        jsValueResult(result.gpr(), m_compileIndex);
+        break;
+    }
+
+    case PutGlobalVar: {
+        JSValueOperand value(this, node.child1);
+        GPRTemporary temp(this);
+
+        JSVariableObject* globalObject = m_jit.codeBlock()->globalObject();
+        m_jit.loadPtr(globalObject->addressOfRegisters(), temp.registerID());
+        m_jit.storePtr(value.registerID(), JITCompiler::addressForGlobalVar(temp.registerID(), node.varNumber()));
+
+        noResult(m_compileIndex);
+        break;
+    }
+    }
+
+    // Check if generation for the speculative path has failed catastrophically. :-)
+    // In the future, we may want to throw away the code we've generated in this case.
+    // For now, there is no point generating any further code, return immediately.
+    if (m_didTerminate)
+        return false;
+
+    if (node.mustGenerate())
+        use(m_compileIndex);
+
+    checkConsistency();
+
+    return true;
+}
+
+bool SpeculativeJIT::compile()
+{
+    ASSERT(!m_compileIndex);
+    Node* nodes = m_jit.graph().begin();
+
+    for (; m_compileIndex < m_jit.graph().size(); ++m_compileIndex) {
+#if DFG_DEBUG_VERBOSE
+        fprintf(stderr, "index(%d)\n", (int)m_compileIndex);
+#endif
+
+        Node& node = nodes[m_compileIndex];
+        if (!node.refCount)
+            continue;
+        if (!compile(node))
+            return false;
+    }
+    return true;
+}
+
+} } // namespace JSC::DFG
+
+#endif
diff --git a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h
new file mode 100644
index 0000000..93983c6
--- /dev/null
+++ b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h
@@ -0,0 +1,356 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef DFGSpeculativeJIT_h
+#define DFGSpeculativeJIT_h
+
+#if ENABLE(DFG_JIT)
+
+#include <dfg/DFGJITCodeGenerator.h>
+
+namespace JSC { namespace DFG {
+
+class SpeculativeJIT;
+
+// This enum describes the types of additional recovery that
+// may need be performed should a speculation check fail.
+enum SpeculationRecoveryType {
+    SpeculativeAdd
+};
+
+// === SpeculationRecovery ===
+//
+// This class provides additional information that may be associated with a
+// speculation check - for example 
+class SpeculationRecovery {
+public:
+    SpeculationRecovery(SpeculationRecoveryType type, GPRReg dest, GPRReg src)
+        : m_type(type)
+        , m_dest(dest)
+        , m_src(src)
+    {
+    }
+
+    SpeculationRecoveryType type() { return m_type; }
+    GPRReg dest() { return m_dest; }
+    GPRReg src() { return m_src; }
+
+private:
+    // Indicates the type of additional recovery to be performed.
+    SpeculationRecoveryType m_type;
+    // different recovery types may required different additional information here.
+    GPRReg m_dest;
+    GPRReg m_src;
+};
+
+// === SpeculationCheck ===
+//
+// This structure records a bail-out from the speculative path,
+// which will need to be linked in to the non-speculative one.
+struct SpeculationCheck {
+    SpeculationCheck(MacroAssembler::Jump, SpeculativeJIT*, unsigned recoveryIndex = 0);
+
+    // The location of the jump out from the speculative path, 
+    // and the node we were generating code for.
+    MacroAssembler::Jump m_check;
+    NodeIndex m_nodeIndex;
+    // Used to record any additional recovery to be performed; this
+    // value is an index into the SpeculativeJIT's m_speculationRecoveryList
+    // array, offset by 1. (m_recoveryIndex == 0) means no recovery.
+    unsigned m_recoveryIndex;
+
+    struct RegisterInfo {
+        NodeIndex nodeIndex;
+        DataFormat format;
+    };
+    RegisterInfo m_gprInfo[numberOfGPRs];
+    NodeIndex m_fprInfo[numberOfFPRs];
+};
+
+
+// === SpeculativeJIT ===
+//
+// The SpeculativeJIT is used to generate a fast, but potentially
+// incomplete code path for the dataflow. When code generating
+// we may make assumptions about operand types, dynamically check,
+// and bail-out to an alternate code path if these checks fail.
+// Importantly, the speculative code path cannot be reentered once
+// a speculative check has failed. This allows the SpeculativeJIT
+// to propagate type information (including information that has
+// only speculatively been asserted) through the dataflow.
+class SpeculativeJIT : public JITCodeGenerator {
+    friend struct SpeculationCheck;
+public:
+    // The speculation 
+    typedef SegmentedVector<SpeculationCheck, 16> SpeculationCheckVector;
+
+    SpeculativeJIT(JITCompiler& jit)
+        : JITCodeGenerator(jit, true)
+        , m_didTerminate(false)
+    {
+    }
+
+    bool compile();
+
+    // Retrieve the list of bail-outs from the speculative path,
+    // and additional recovery information.
+    SpeculationCheckVector& speculationChecks()
+    {
+        return m_speculationChecks;
+    }
+    SpeculationRecovery* speculationRecovery(size_t index)
+    {
+        // SpeculationCheck::m_recoveryIndex is offset by 1,
+        // 0 means no recovery.
+        return index ? &m_speculationRecoveryList[index - 1] : 0;
+    }
+
+    // Called by the speculative operand types, below, to fill operand to
+    // machine registers, implicitly generating speculation checks as needed.
+    GPRReg fillSpeculateInt(NodeIndex, DataFormat& returnFormat);
+    GPRReg fillSpeculateIntStrict(NodeIndex);
+    GPRReg fillSpeculateCell(NodeIndex);
+
+private:
+    bool compile(Node&);
+
+    // Add a speculation check without additional recovery.
+    void speculationCheck(MacroAssembler::Jump jumpToFail)
+    {
+        m_speculationChecks.append(SpeculationCheck(jumpToFail, this));
+    }
+    // Add a speculation check with additional recovery.
+    void speculationCheck(MacroAssembler::Jump jumpToFail, const SpeculationRecovery& recovery)
+    {
+        m_speculationRecoveryList.append(recovery);
+        m_speculationChecks.append(SpeculationCheck(jumpToFail, this, m_speculationRecoveryList.size()));
+    }
+
+    // Called when we statically determine that a speculation will fail.
+    void terminateSpeculativeExecution()
+    {
+        // FIXME: in cases where we can statically determine we're going to bail out from the speculative
+        // JIT we should probably rewind code generation and only produce the non-speculative path.
+        m_didTerminate = true;
+        speculationCheck(m_jit.jump());
+    }
+
+    template<bool strict>
+    GPRReg fillSpeculateIntInternal(NodeIndex, DataFormat& returnFormat);
+
+    // It is possible, during speculative generation, to reach a situation in which we
+    // can statically determine a speculation will fail (for example, when two nodes
+    // will make conflicting speculations about the same operand). In such cases this
+    // flag is set, indicating no further code generation should take place.
+    bool m_didTerminate;
+    // This vector tracks bail-outs from the speculative path to the non-speculative one.
+    SpeculationCheckVector m_speculationChecks;
+    // Some bail-outs need to record additional information recording specific recovery
+    // to be performed (for example, on detected overflow from an add, we may need to
+    // reverse the addition if an operand is being overwritten).
+    Vector<SpeculationRecovery, 16> m_speculationRecoveryList;
+};
+
+
+// === Speculative Operand types ===
+//
+// SpeculateIntegerOperand, SpeculateStrictInt32Operand and SpeculateCellOperand.
+//
+// These are used to lock the operands to a node into machine registers within the
+// SpeculativeJIT. The classes operate like those provided by the JITCodeGenerator,
+// however these will perform a speculative check for a more restrictive type than
+// we can statically determine the operand to have. If the operand does not have
+// the requested type, a bail-out to the non-speculative path will be taken.
+
+class SpeculateIntegerOperand {
+public:
+    explicit SpeculateIntegerOperand(SpeculativeJIT* jit, NodeIndex index)
+        : m_jit(jit)
+        , m_index(index)
+        , m_gprOrInvalid(InvalidGPRReg)
+#ifndef NDEBUG
+        , m_format(DataFormatNone)
+#endif
+    {
+        ASSERT(m_jit);
+        if (jit->isFilled(index))
+            gpr();
+    }
+
+    ~SpeculateIntegerOperand()
+    {
+        ASSERT(m_gprOrInvalid != InvalidGPRReg);
+        m_jit->unlock(m_gprOrInvalid);
+    }
+
+    NodeIndex index() const
+    {
+        return m_index;
+    }
+
+    GPRReg gpr()
+    {
+        if (m_gprOrInvalid == InvalidGPRReg)
+            m_gprOrInvalid = m_jit->fillSpeculateInt(index(), m_format);
+        return m_gprOrInvalid;
+    }
+
+    DataFormat format()
+    {
+        gpr(); // m_format is set when m_gpr is locked.
+        ASSERT(m_format == DataFormatInteger || m_format == DataFormatJSInteger);
+        return m_format;
+    }
+
+    MacroAssembler::RegisterID registerID()
+    {
+        return JITCompiler::gprToRegisterID(gpr());
+    }
+
+private:
+    SpeculativeJIT* m_jit;
+    NodeIndex m_index;
+    GPRReg m_gprOrInvalid;
+    DataFormat m_format;
+};
+
+class SpeculateStrictInt32Operand {
+public:
+    explicit SpeculateStrictInt32Operand(SpeculativeJIT* jit, NodeIndex index)
+        : m_jit(jit)
+        , m_index(index)
+        , m_gprOrInvalid(InvalidGPRReg)
+    {
+        ASSERT(m_jit);
+        if (jit->isFilled(index))
+            gpr();
+    }
+
+    ~SpeculateStrictInt32Operand()
+    {
+        ASSERT(m_gprOrInvalid != InvalidGPRReg);
+        m_jit->unlock(m_gprOrInvalid);
+    }
+
+    NodeIndex index() const
+    {
+        return m_index;
+    }
+
+    GPRReg gpr()
+    {
+        if (m_gprOrInvalid == InvalidGPRReg)
+            m_gprOrInvalid = m_jit->fillSpeculateIntStrict(index());
+        return m_gprOrInvalid;
+    }
+
+    MacroAssembler::RegisterID registerID()
+    {
+        return JITCompiler::gprToRegisterID(gpr());
+    }
+
+private:
+    SpeculativeJIT* m_jit;
+    NodeIndex m_index;
+    GPRReg m_gprOrInvalid;
+};
+
+class SpeculateCellOperand {
+public:
+    explicit SpeculateCellOperand(SpeculativeJIT* jit, NodeIndex index)
+        : m_jit(jit)
+        , m_index(index)
+        , m_gprOrInvalid(InvalidGPRReg)
+    {
+        ASSERT(m_jit);
+        if (jit->isFilled(index))
+            gpr();
+    }
+
+    ~SpeculateCellOperand()
+    {
+        ASSERT(m_gprOrInvalid != InvalidGPRReg);
+        m_jit->unlock(m_gprOrInvalid);
+    }
+
+    NodeIndex index() const
+    {
+        return m_index;
+    }
+
+    GPRReg gpr()
+    {
+        if (m_gprOrInvalid == InvalidGPRReg)
+            m_gprOrInvalid = m_jit->fillSpeculateCell(index());
+        return m_gprOrInvalid;
+    }
+
+    MacroAssembler::RegisterID registerID()
+    {
+        return JITCompiler::gprToRegisterID(gpr());
+    }
+
+private:
+    SpeculativeJIT* m_jit;
+    NodeIndex m_index;
+    GPRReg m_gprOrInvalid;
+};
+
+
+// === SpeculationCheckIndexIterator ===
+//
+// This class is used by the non-speculative JIT to check which
+// nodes require entry points from the speculative path.
+class SpeculationCheckIndexIterator {
+public:
+    SpeculationCheckIndexIterator(SpeculativeJIT& speculativeJIT)
+        : m_speculationChecks(speculativeJIT.speculationChecks())
+        , m_iter(m_speculationChecks.begin())
+        , m_end(m_speculationChecks.end())
+    {
+    }
+
+    bool hasCheckAtIndex(NodeIndex nodeIndex)
+    {
+        while (m_iter != m_end) {
+            NodeIndex current = m_iter->m_nodeIndex;
+            if (current >= nodeIndex)
+                return current == nodeIndex;
+            ++m_iter;
+        }
+        return false;
+    }
+
+private:
+    SpeculativeJIT::SpeculationCheckVector& m_speculationChecks;
+    SpeculativeJIT::SpeculationCheckVector::Iterator m_iter;
+    SpeculativeJIT::SpeculationCheckVector::Iterator m_end;
+};
+
+} } // namespace JSC::DFG
+
+#endif
+#endif
+
diff --git a/Source/JavaScriptCore/gyp/JavaScriptCore.gyp b/Source/JavaScriptCore/gyp/JavaScriptCore.gyp
index 1e46094..a520344 100644
--- a/Source/JavaScriptCore/gyp/JavaScriptCore.gyp
+++ b/Source/JavaScriptCore/gyp/JavaScriptCore.gyp
@@ -3,30 +3,43 @@
     '../../gyp/common.gypi',
     '../JavaScriptCore.gypi',
   ],
-  'xcode_config_file': '<(DEPTH)/JavaScriptCore/Configurations/DebugRelease.xcconfig',
+  'configurations': {
+    'Production': {
+      'xcode_config_file': '<(project_dir)/Configurations/Base.xcconfig',
+    },
+    'Profiling': {
+      'xcode_config_file': '<(project_dir)/Configurations/DebugRelease.xcconfig',
+      'xcode_settings': {
+        'STRIP_INSTALLED_PRODUCT': 'NO',
+      },
+    },
+    'Release': {
+      'xcode_config_file': '<(project_dir)/Configurations/DebugRelease.xcconfig',
+      'xcode_settings': {
+        'STRIP_INSTALLED_PRODUCT': 'NO',
+      },
+    },
+    'Debug': {
+      'xcode_config_file': '<(project_dir)/Configurations/DebugRelease.xcconfig',
+      'xcode_settings': {
+        'DEAD_CODE_STRIPPING': '$(DEAD_CODE_STRIPPING_debug)',
+        'DEBUG_DEFINES': '$(DEBUG_DEFINES_debug)',
+        'GCC_OPTIMIZATION_LEVEL': '$(GCC_OPTIMIZATION_LEVEL_debug)',
+        'STRIP_INSTALLED_PRODUCT': '$(STRIP_INSTALLED_PRODUCT_debug)',
+      },
+    },
+  },
   'variables': {
-    # FIXME: We should use a header map instead of listing these explicitly.
     'javascriptcore_include_dirs': [
-      '<(DEPTH)', # Some paths in API include JavaScriptCore/
-      '<(DEPTH)/JavaScriptCore',
-      '<(DEPTH)/JavaScriptCore/ForwardingHeaders',
-      '<(DEPTH)/JavaScriptCore/API',
-      '<(DEPTH)/JavaScriptCore/assembler',
-      '<(DEPTH)/JavaScriptCore/collector/handles',
-      '<(DEPTH)/JavaScriptCore/bytecode',
-      '<(DEPTH)/JavaScriptCore/bytecompiler',
-      '<(DEPTH)/JavaScriptCore/debugger',
-      '<(DEPTH)/JavaScriptCore/icu',
-      '<(DEPTH)/JavaScriptCore/interpreter',
-      '<(DEPTH)/JavaScriptCore/jit',
-      '<(DEPTH)/JavaScriptCore/parser',
-      '<(DEPTH)/JavaScriptCore/profiler',
-      '<(DEPTH)/JavaScriptCore/runtime',
-      '<(DEPTH)/JavaScriptCore/wtf',
-      '<(DEPTH)/JavaScriptCore/wtf/unicode',
-      '<(PRODUCT_DIR)/DerivedSources/JavaScriptCore',
+      '<(project_dir)',
+      '<(project_dir)/icu',
     ],
   },
+  'target_defaults': {
+    'configurations': {
+      'Profiling': {},
+    },
+  },
   'targets': [
     {
       'target_name': 'JavaScriptCore',
@@ -37,15 +50,22 @@
       ],
       'include_dirs': [
         '<@(javascriptcore_include_dirs)',
+        '<(PRODUCT_DIR)/DerivedSources/JavaScriptCore',
       ],
+      'configurations': {
+        'Production': {
+          'INSTALL_PATH': '$(BUILT_PRODUCTS_DIR)',
+        },
+      },
       'sources': [
         '<@(javascriptcore_files)',
         '<@(javascriptcore_publicheader_files)',
         '<@(javascriptcore_privateheader_files)',
+        '<@(javascriptcore_derived_source_files)',
         '$(SDKROOT)/System/Library/Frameworks/CoreFoundation.framework',
         '$(SDKROOT)/System/Library/Frameworks/Foundation.framework',
-        'libicucore.dylib',
-        'libobjc.dylib',
+        '/usr/lib/libicucore.dylib',
+        '/usr/lib/libobjc.dylib',
       ],
       'mac_framework_headers': [
         '<@(javascriptcore_publicheader_files)',
@@ -53,47 +73,41 @@
       'mac_framework_private_headers': [
         '<@(javascriptcore_privateheader_files)',
       ],
-      'xcode_config_file': '<(DEPTH)/JavaScriptCore/Configurations/JavaScriptCore.xcconfig',
+      'xcode_config_file': '<(project_dir)/Configurations/JavaScriptCore.xcconfig',
       'sources/': [
-        ['exclude', 'qt'],
-        ['exclude', 'os-win32'],
-        ['exclude', 'wtf/android'],
-        ['exclude', 'wtf/brew'],
-        ['exclude', 'wtf/efl'],
-        ['exclude', 'wtf/gtk'],
-        ['exclude', 'wtf/qt'],
-        ['exclude', 'wtf/haiku'],
-        ['exclude', 'API/tests'],
-        ['exclude', 'wtf/url'],
-        ['exclude', 'wtf/wince'],
-        ['exclude', 'wtf/wx'],
-        ['exclude', 'wtf/unicode/brew'],
-        ['exclude', 'wtf/unicode/wince'],
-        ['exclude', 'wtf/unicode/glib'],
-        ['exclude', 'wtf/unicode/qt4'],
+        ['exclude', 'API/tests/'],
+        ['exclude', 'ForwardingHeaders/'],
+        ['exclude', '(?<!unicode)/icu/'],
+        ['exclude', 'os-win32/'],
+        ['exclude', 'qt/'],
+        ['exclude', 'wtf/(android|brew|efl|gtk|haiku|qt|wince|wx)/'],
+        ['exclude', 'wtf/unicode/brew/'],
+        ['exclude', 'wtf/unicode/glib/'],
+        ['exclude', 'wtf/unicode/qt4/'],
+        ['exclude', 'wtf/unicode/wince/'],
+        ['exclude', 'wtf/url/'],
         ['exclude', '/(gtk|glib|gobject)/.*\\.(cpp|h)$'],
         ['exclude', '(Default|Gtk|Chromium|None|Qt|Win|Wx|Symbian)\\.(cpp|mm|h)$'],
-        ['exclude', 'GCActivityCallback\.cpp'],
-        ['exclude', '.*BSTR.*$'],
-        ['exclude', 'jsc.cpp$'],
+        ['exclude', 'GCActivityCallback\.cpp$'],
+        ['exclude', 'BSTR[^/]*$'],
       ],
       'postbuilds': [
         {
           'postbuild_name': 'Check For Global Initializers',
           'action': [
-            'sh', '<(DEPTH)/gyp/run-if-exists.sh', '<(DEPTH)/../Tools/Scripts/check-for-global-initializers'
+            'sh', '<(project_dir)/gyp/run-if-exists.sh', '<(DEPTH)/../Tools/Scripts/check-for-global-initializers'
           ],
         },
         {
           'postbuild_name': 'Check For Exit Time Destructors',
           'action': [
-            'sh', '<(DEPTH)/gyp/run-if-exists.sh', '<(DEPTH)/../Tools/Scripts/check-for-exit-time-destructors'
+            'sh', '<(project_dir)/gyp/run-if-exists.sh', '<(DEPTH)/../Tools/Scripts/check-for-exit-time-destructors'
           ],
         },
         {
           'postbuild_name': 'Check For Weak VTables and Externals',
           'action': [
-            'sh', '<(DEPTH)/gyp/run-if-exists.sh', '<(DEPTH)/../Tools/Scripts/check-for-weak-vtables-and-externals'
+            'sh', '<(project_dir)/gyp/run-if-exists.sh', '<(DEPTH)/../Tools/Scripts/check-for-weak-vtables-and-externals'
           ],
         },
       ],
@@ -103,29 +117,8 @@
           'xcode_settings': {
             # FIXME: Remove these overrides once JavaScriptCore.xcconfig is
             # used only by this project.
-            'GCC_PREFIX_HEADER': '<(DEPTH)/JavaScriptCore/JavaScriptCorePrefix.h',
-            'INFOPLIST_FILE': '<(DEPTH)/JavaScriptCore/Info.plist',
-            # This setting mirrors the setting in Base.xcconfig, with
-            # one difference noted below.
-            'WARNING_CFLAGS_BASE': [
-              '-Wall',
-              '-Wextra',
-              '-Wcast-qual',
-              '-Wchar-subscripts',
-              '-Wextra-tokens',
-              '-Wformat=2',
-              '-Winit-self',
-              # FIXME: For some reason, -Wmissing-format-attribute causes a
-              # build error in Assertions.cpp in the GYP build but not in the
-              # non-GYP build.
-              # '-Wmissing-format-attribute',
-              '-Wmissing-noreturn',
-              '-Wpacked',
-              '-Wpointer-arith',
-              '-Wredundant-decls',
-              '-Wundef',
-              '-Wwrite-strings',
-            ],
+            'GCC_PREFIX_HEADER': '<(project_dir)/JavaScriptCorePrefix.h',
+            'INFOPLIST_FILE': '<(project_dir)/Info.plist',
           },
         }],
       ],
@@ -133,14 +126,26 @@
     {
       'target_name': 'Derived Sources',
       'type': 'none',
-      'actions': [{
-        'action_name': 'Generate Derived Sources',
-        'inputs': [],
-        'outputs': [],
-        'action': [
-          'sh', 'generate-derived-sources.sh',
-        ],
-      }],
+      'actions': [
+        {
+          'action_name': 'Generate Derived Sources',
+          'inputs': [],
+          'outputs': [
+            '<@(javascriptcore_derived_source_files)',
+          ],
+          'action': [
+            'sh', 'generate-derived-sources.sh'
+          ],
+        },
+        {
+          'action_name': 'Generate DTrace Header',
+          'inputs': [],
+           'outputs': [],
+           'action': [
+             'sh', '<(project_dir)/gyp/generate-dtrace-header.sh', '<(project_dir)'
+            ]
+        }
+      ],
     },
     {
       'target_name': 'Update Version',
@@ -150,7 +155,7 @@
         'inputs': [],
          'outputs': [],
          'action': [
-           'sh', '<(DEPTH)/gyp/update-info-plist.sh', '<(DEPTH)/JavaScriptCore/Info.plist'
+           'sh', '<(project_dir)/gyp/update-info-plist.sh', '<(project_dir)/Info.plist'
           ]
       }],
     },
@@ -206,10 +211,17 @@
       'include_dirs': [
         '<@(javascriptcore_include_dirs)',
       ],
+      'configurations': {
+        'Production': {
+          'xcode_settings': {
+            'INSTALL_PATH': '$(JAVASCRIPTCORE_FRAMEWORKS_DIR)/JavaScriptCore.framework/Resources',
+          },
+        },
+      },
       'sources': [
         '<@(jsc_files)',
         '$(SDKROOT)/System/Library/Frameworks/CoreFoundation.framework',
-        'libedit.dylib',
+        '/usr/lib/libedit.dylib',
       ],
     },
   ], # targets
diff --git a/Source/JavaScriptCore/gyp/generate-dtrace-header.sh b/Source/JavaScriptCore/gyp/generate-dtrace-header.sh
new file mode 100755
index 0000000..a3c31dd
--- /dev/null
+++ b/Source/JavaScriptCore/gyp/generate-dtrace-header.sh
@@ -0,0 +1,9 @@
+#!/bin/sh
+
+TRACING_D="$1/runtime/Tracing.d";
+TRACING_H="$BUILT_PRODUCTS_DIR/DerivedSources/JavaScriptCore/TracingDtrace.h";
+
+if [[ "${HAVE_DTRACE}" = "1" && "${TRACING_D}" -nt "${TRACING_H}" ]]; then
+    dtrace -h -o "${TRACING_H}" -s "${TRACING_D}";
+fi;
+
diff --git a/Source/gyp/run-if-exists.sh b/Source/JavaScriptCore/gyp/run-if-exists.sh
index 242ffc8..242ffc8 100644..100755
--- a/Source/gyp/run-if-exists.sh
+++ b/Source/JavaScriptCore/gyp/run-if-exists.sh
diff --git a/Source/gyp/update-info-plist.sh b/Source/JavaScriptCore/gyp/update-info-plist.sh
index d02ecce..d02ecce 100755
--- a/Source/gyp/update-info-plist.sh
+++ b/Source/JavaScriptCore/gyp/update-info-plist.sh
diff --git a/Source/JavaScriptCore/interpreter/CachedCall.h b/Source/JavaScriptCore/interpreter/CachedCall.h
index 05e9056..04f2210 100644
--- a/Source/JavaScriptCore/interpreter/CachedCall.h
+++ b/Source/JavaScriptCore/interpreter/CachedCall.h
@@ -38,7 +38,7 @@ namespace JSC {
         CachedCall(CallFrame* callFrame, JSFunction* function, int argCount)
             : m_valid(false)
             , m_interpreter(callFrame->interpreter())
-            , m_globalObjectScope(callFrame, function->scope()->globalObject.get())
+            , m_globalObjectScope(callFrame->globalData(), function->scope()->globalObject.get())
         {
             ASSERT(!function->isHostFunction());
             m_closure = m_interpreter->prepareForRepeatCall(function->jsExecutable(), callFrame, function, argCount, function->scope());
diff --git a/Source/JavaScriptCore/interpreter/CallFrame.h b/Source/JavaScriptCore/interpreter/CallFrame.h
index e73e13a..28832e0 100644
--- a/Source/JavaScriptCore/interpreter/CallFrame.h
+++ b/Source/JavaScriptCore/interpreter/CallFrame.h
@@ -65,7 +65,7 @@ namespace JSC  {
         // But they're used in many places in legacy code, so they're not going away any time soon.
 
         void clearException() { globalData().exception = JSValue(); }
-        JSValue exception() const { return globalData().exception.get(); }
+        JSValue exception() const { return globalData().exception; }
         bool hadException() const { return globalData().exception; }
 
         const CommonIdentifiers& propertyNames() const { return *globalData().propertyNames; }
diff --git a/Source/JavaScriptCore/interpreter/Interpreter.cpp b/Source/JavaScriptCore/interpreter/Interpreter.cpp
index b9a9c40..6021279 100644
--- a/Source/JavaScriptCore/interpreter/Interpreter.cpp
+++ b/Source/JavaScriptCore/interpreter/Interpreter.cpp
@@ -106,7 +106,7 @@ NEVER_INLINE bool Interpreter::resolve(CallFrame* callFrame, Instruction* vPC, J
         PropertySlot slot(o);
         if (o->getPropertySlot(callFrame, ident, slot)) {
             JSValue result = slot.getValue(callFrame, ident);
-            exceptionValue = callFrame->globalData().exception.get();
+            exceptionValue = callFrame->globalData().exception;
             if (exceptionValue)
                 return false;
             callFrame->uncheckedR(dst) = JSValue(result);
@@ -145,7 +145,7 @@ NEVER_INLINE bool Interpreter::resolveSkip(CallFrame* callFrame, Instruction* vP
         PropertySlot slot(o);
         if (o->getPropertySlot(callFrame, ident, slot)) {
             JSValue result = slot.getValue(callFrame, ident);
-            exceptionValue = callFrame->globalData().exception.get();
+            exceptionValue = callFrame->globalData().exception;
             if (exceptionValue)
                 return false;
             ASSERT(result);
@@ -186,7 +186,7 @@ NEVER_INLINE bool Interpreter::resolveGlobal(CallFrame* callFrame, Instruction*
             return true;
         }
 
-        exceptionValue = callFrame->globalData().exception.get();
+        exceptionValue = callFrame->globalData().exception;
         if (exceptionValue)
             return false;
         callFrame->uncheckedR(dst) = JSValue(result);
@@ -226,7 +226,7 @@ NEVER_INLINE bool Interpreter::resolveGlobalDynamic(CallFrame* callFrame, Instru
                 PropertySlot slot(o);
                 if (o->getPropertySlot(callFrame, ident, slot)) {
                     JSValue result = slot.getValue(callFrame, ident);
-                    exceptionValue = callFrame->globalData().exception.get();
+                    exceptionValue = callFrame->globalData().exception;
                     if (exceptionValue)
                         return false;
                     ASSERT(result);
@@ -265,7 +265,7 @@ NEVER_INLINE bool Interpreter::resolveGlobalDynamic(CallFrame* callFrame, Instru
             return true;
         }
         
-        exceptionValue = callFrame->globalData().exception.get();
+        exceptionValue = callFrame->globalData().exception;
         if (exceptionValue)
             return false;
         ASSERT(result);
@@ -313,7 +313,7 @@ NEVER_INLINE bool Interpreter::resolveBaseAndProperty(CallFrame* callFrame, Inst
         PropertySlot slot(base);
         if (base->getPropertySlot(callFrame, ident, slot)) {
             JSValue result = slot.getValue(callFrame, ident);
-            exceptionValue = callFrame->globalData().exception.get();
+            exceptionValue = callFrame->globalData().exception;
             if (exceptionValue)
                 return false;
             callFrame->uncheckedR(propDst) = JSValue(result);
@@ -409,13 +409,13 @@ NEVER_INLINE JSValue Interpreter::callEval(CallFrame* callFrame, RegisterFile* r
 
     ScopeChainNode* scopeChain = callFrame->scopeChain();
     JSValue exceptionValue;
-    RefPtr<EvalExecutable> eval = codeBlock->evalCodeCache().get(callFrame, codeBlock->isStrictMode(), programSource, scopeChain, exceptionValue);
+    EvalExecutable* eval = codeBlock->evalCodeCache().get(callFrame, codeBlock->ownerExecutable(), codeBlock->isStrictMode(), programSource, scopeChain, exceptionValue);
 
     ASSERT(!eval == exceptionValue);
     if (UNLIKELY(!eval))
         return throwError(callFrame, exceptionValue);
 
-    return callFrame->globalData().interpreter->execute(eval.get(), callFrame, callFrame->uncheckedR(codeBlock->thisRegister()).jsValue().toThisObject(callFrame), callFrame->registers() - registerFile->start() + registerOffset, scopeChain);
+    return callFrame->globalData().interpreter->execute(eval, callFrame, callFrame->uncheckedR(codeBlock->thisRegister()).jsValue().toThisObject(callFrame), callFrame->registers() - registerFile->start() + registerOffset, scopeChain);
 }
 
 Interpreter::Interpreter(JSGlobalData& globalData)
@@ -738,6 +738,8 @@ JSValue Interpreter::execute(ProgramExecutable* program, CallFrame* callFrame, S
     if (m_reentryDepth >= MaxSmallThreadReentryDepth && m_reentryDepth >= callFrame->globalData().maxReentryDepth)
         return checkedReturn(throwStackOverflowError(callFrame));
 
+    DynamicGlobalObjectScope globalObjectScope(*scopeChain->globalData, scopeChain->globalObject.get());
+
     JSObject* error = program->compile(callFrame, scopeChain);
     if (error)
         return checkedReturn(throwError(callFrame, error));
@@ -757,8 +759,6 @@ JSValue Interpreter::execute(ProgramExecutable* program, CallFrame* callFrame, S
     newCallFrame->init(codeBlock, 0, scopeChain, CallFrame::noCaller(), codeBlock->m_numParameters, 0);
     newCallFrame->uncheckedR(newCallFrame->hostThisRegister()) = JSValue(thisObj);
 
-    DynamicGlobalObjectScope globalObjectScope(callFrame, scopeChain->globalObject.get());
-
     Profiler** profiler = Profiler::enabledProfilerReference();
     if (*profiler)
         (*profiler)->willExecute(callFrame, program->sourceURL(), program->lineNo());
@@ -813,6 +813,8 @@ JSValue Interpreter::executeCall(CallFrame* callFrame, JSObject* function, CallT
     if (callType == CallTypeJS) {
         ScopeChainNode* callDataScopeChain = callData.js.scopeChain;
 
+        DynamicGlobalObjectScope globalObjectScope(*callDataScopeChain->globalData, callDataScopeChain->globalObject.get());
+
         JSObject* compileError = callData.js.functionExecutable->compileForCall(callFrame, callDataScopeChain);
         if (UNLIKELY(!!compileError)) {
             m_registerFile.shrink(oldEnd);
@@ -828,8 +830,6 @@ JSValue Interpreter::executeCall(CallFrame* callFrame, JSObject* function, CallT
 
         newCallFrame->init(newCodeBlock, 0, callDataScopeChain, callFrame->addHostCallFrameFlag(), argCount, function);
 
-        DynamicGlobalObjectScope globalObjectScope(newCallFrame, callDataScopeChain->globalObject.get());
-
         Profiler** profiler = Profiler::enabledProfilerReference();
         if (*profiler)
             (*profiler)->willExecute(callFrame, function);
@@ -860,7 +860,7 @@ JSValue Interpreter::executeCall(CallFrame* callFrame, JSObject* function, CallT
     newCallFrame = CallFrame::create(newCallFrame->registers() + registerOffset);
     newCallFrame->init(0, 0, scopeChain, callFrame->addHostCallFrameFlag(), argCount, function);
 
-    DynamicGlobalObjectScope globalObjectScope(newCallFrame, scopeChain->globalObject.get());
+    DynamicGlobalObjectScope globalObjectScope(*scopeChain->globalData, scopeChain->globalObject.get());
 
     Profiler** profiler = Profiler::enabledProfilerReference();
     if (*profiler)
@@ -902,6 +902,8 @@ JSObject* Interpreter::executeConstruct(CallFrame* callFrame, JSObject* construc
     if (constructType == ConstructTypeJS) {
         ScopeChainNode* constructDataScopeChain = constructData.js.scopeChain;
 
+        DynamicGlobalObjectScope globalObjectScope(*constructDataScopeChain->globalData, constructDataScopeChain->globalObject.get());
+
         JSObject* compileError = constructData.js.functionExecutable->compileForConstruct(callFrame, constructDataScopeChain);
         if (UNLIKELY(!!compileError)) {
             m_registerFile.shrink(oldEnd);
@@ -917,8 +919,6 @@ JSObject* Interpreter::executeConstruct(CallFrame* callFrame, JSObject* construc
 
         newCallFrame->init(newCodeBlock, 0, constructDataScopeChain, callFrame->addHostCallFrameFlag(), argCount, constructor);
 
-        DynamicGlobalObjectScope globalObjectScope(newCallFrame, constructDataScopeChain->globalObject.get());
-
         Profiler** profiler = Profiler::enabledProfilerReference();
         if (*profiler)
             (*profiler)->willExecute(callFrame, constructor);
@@ -952,7 +952,7 @@ JSObject* Interpreter::executeConstruct(CallFrame* callFrame, JSObject* construc
     newCallFrame = CallFrame::create(newCallFrame->registers() + registerOffset);
     newCallFrame->init(0, 0, scopeChain, callFrame->addHostCallFrameFlag(), argCount, constructor);
 
-    DynamicGlobalObjectScope globalObjectScope(newCallFrame, scopeChain->globalObject.get());
+    DynamicGlobalObjectScope globalObjectScope(*scopeChain->globalData, scopeChain->globalObject.get());
 
     Profiler** profiler = Profiler::enabledProfilerReference();
     if (*profiler)
@@ -1066,11 +1066,11 @@ JSValue Interpreter::execute(EvalExecutable* eval, CallFrame* callFrame, JSObjec
 {
     ASSERT(!scopeChain->globalData->exception);
 
+    DynamicGlobalObjectScope globalObjectScope(*scopeChain->globalData, scopeChain->globalObject.get());
+
     if (m_reentryDepth >= MaxSmallThreadReentryDepth && m_reentryDepth >= callFrame->globalData().maxReentryDepth)
         return checkedReturn(throwStackOverflowError(callFrame));
 
-    DynamicGlobalObjectScope globalObjectScope(callFrame, scopeChain->globalObject.get());
-
     JSObject* compileError = eval->compile(callFrame, scopeChain);
     if (UNLIKELY(!!compileError))
         return checkedReturn(throwError(callFrame, compileError));
@@ -1467,8 +1467,8 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
 
 #define CHECK_FOR_EXCEPTION() \
     do { \
-        if (UNLIKELY(globalData->exception.get() != JSValue())) { \
-            exceptionValue = globalData->exception.get(); \
+        if (UNLIKELY(globalData->exception != JSValue())) { \
+            exceptionValue = globalData->exception; \
             goto vm_throw; \
         } \
     } while (0)
@@ -1549,8 +1549,12 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            register dst.
         */
         int dst = vPC[1].u.operand;
-        int regExp = vPC[2].u.operand;
-        callFrame->uncheckedR(dst) = JSValue(new (globalData) RegExpObject(callFrame->lexicalGlobalObject(), callFrame->scopeChain()->globalObject->regExpStructure(), codeBlock->regexp(regExp)));
+        RegExp* regExp = codeBlock->regexp(vPC[2].u.operand);
+        if (!regExp->isValid()) {
+            exceptionValue = createSyntaxError(callFrame, "Invalid flags supplied to RegExp constructor.");
+            goto vm_throw;
+        }
+        callFrame->uncheckedR(dst) = JSValue(new (globalData) RegExpObject(callFrame->lexicalGlobalObject(), callFrame->scopeChain()->globalObject->regExpStructure(), regExp));
 
         vPC += OPCODE_LENGTH(op_new_regexp);
         NEXT_INSTRUCTION();
@@ -3533,10 +3537,9 @@ skip_id_custom_self:
            to ptr, using pointer equality.
          */
         int src = vPC[1].u.operand;
-        JSValue ptr = JSValue(vPC[2].u.jsCell);
         int target = vPC[3].u.operand;
         JSValue srcValue = callFrame->r(src).jsValue();
-        if (srcValue != ptr) {
+        if (srcValue != vPC[2].u.jsCell.get()) {
             vPC += target;
             NEXT_INSTRUCTION();
         }
@@ -3831,7 +3834,7 @@ skip_id_custom_self:
 
         if (thisValue == globalObject && funcVal == globalObject->evalFunction()) {
             JSValue result = callEval(callFrame, registerFile, argv, argCount, registerOffset);
-            if ((exceptionValue = globalData->exception.get()))
+            if ((exceptionValue = globalData->exception))
                 goto vm_throw;
             functionReturnValue = result;
 
@@ -4261,7 +4264,7 @@ skip_id_custom_self:
         Structure* structure;
         JSValue proto = callFrame->r(protoRegister).jsValue();
         if (proto.isObject())
-            structure = asObject(proto)->inheritorID();
+            structure = asObject(proto)->inheritorID(callFrame->globalData());
         else
             structure = constructor->scope()->globalObject->emptyObjectStructure();
         callFrame->uncheckedR(thisRegister) = constructEmptyObject(callFrame, structure);
diff --git a/Source/JavaScriptCore/interpreter/Register.h b/Source/JavaScriptCore/interpreter/Register.h
index 3944642..fb02c12 100644
--- a/Source/JavaScriptCore/interpreter/Register.h
+++ b/Source/JavaScriptCore/interpreter/Register.h
@@ -54,11 +54,10 @@ namespace JSC {
         Register(const JSValue&);
         Register& operator=(const JSValue&);
         JSValue jsValue() const;
+        EncodedJSValue encodedJSValue() const;
         
-        Register& operator=(JSActivation*);
         Register& operator=(CallFrame*);
         Register& operator=(CodeBlock*);
-        Register& operator=(JSPropertyNameIterator*);
         Register& operator=(ScopeChainNode*);
         Register& operator=(Instruction*);
 
@@ -73,29 +72,17 @@ namespace JSC {
 
         static Register withInt(int32_t i)
         {
-            Register r;
-            r.u.i = i;
+            Register r = jsNumber(i);
             return r;
         }
 
-        static Register withCallee(JSObject* callee)
-        {
-            Register r;
-            r.u.function = callee;
-            return r;
-        }
+        static inline Register withCallee(JSObject* callee);
 
     private:
         union {
-            int32_t i;
             EncodedJSValue value;
-
-            JSActivation* activation;
             CallFrame* callFrame;
             CodeBlock* codeBlock;
-            JSObject* function;
-            JSPropertyNameIterator* propertyNameIterator;
-            ScopeChainNode* scopeChain;
             Instruction* vPC;
         } u;
     };
@@ -129,14 +116,13 @@ namespace JSC {
         return JSValue::decode(u.value);
     }
 
-    // Interpreter functions
-
-    ALWAYS_INLINE Register& Register::operator=(JSActivation* activation)
+    ALWAYS_INLINE EncodedJSValue Register::encodedJSValue() const
     {
-        u.activation = activation;
-        return *this;
+        return u.value;
     }
 
+    // Interpreter functions
+
     ALWAYS_INLINE Register& Register::operator=(CallFrame* callFrame)
     {
         u.callFrame = callFrame;
@@ -155,28 +141,11 @@ namespace JSC {
         return *this;
     }
 
-    ALWAYS_INLINE Register& Register::operator=(ScopeChainNode* scopeChain)
-    {
-        u.scopeChain = scopeChain;
-        return *this;
-    }
-
-    ALWAYS_INLINE Register& Register::operator=(JSPropertyNameIterator* propertyNameIterator)
-    {
-        u.propertyNameIterator = propertyNameIterator;
-        return *this;
-    }
-
     ALWAYS_INLINE int32_t Register::i() const
     {
-        return u.i;
+        return jsValue().asInt32();
     }
-    
-    ALWAYS_INLINE JSActivation* Register::activation() const
-    {
-        return u.activation;
-    }
-    
+
     ALWAYS_INLINE CallFrame* Register::callFrame() const
     {
         return u.callFrame;
@@ -186,22 +155,7 @@ namespace JSC {
     {
         return u.codeBlock;
     }
-    
-    ALWAYS_INLINE JSObject* Register::function() const
-    {
-        return u.function;
-    }
-    
-    ALWAYS_INLINE JSPropertyNameIterator* Register::propertyNameIterator() const
-    {
-        return u.propertyNameIterator;
-    }
-    
-    ALWAYS_INLINE ScopeChainNode* Register::scopeChain() const
-    {
-        return u.scopeChain;
-    }
-    
+
     ALWAYS_INLINE Instruction* Register::vPC() const
     {
         return u.vPC;
diff --git a/Source/JavaScriptCore/interpreter/RegisterFile.cpp b/Source/JavaScriptCore/interpreter/RegisterFile.cpp
index 47f0c18..b3a87e5 100644
--- a/Source/JavaScriptCore/interpreter/RegisterFile.cpp
+++ b/Source/JavaScriptCore/interpreter/RegisterFile.cpp
@@ -29,6 +29,7 @@
 #include "config.h"
 #include "RegisterFile.h"
 
+#include "ConservativeSet.h"
 #include "Interpreter.h"
 #include "JSGlobalData.h"
 #include "JSGlobalObject.h"
@@ -51,6 +52,16 @@ RegisterFile::~RegisterFile()
     m_reservation.deallocate();
 }
 
+void RegisterFile::gatherConservativeRoots(ConservativeRoots& conservativeRoots)
+{
+    for (Register* it = start(); it != end(); ++it) {
+        JSValue v = it->jsValue();
+        if (!v.isCell())
+            continue;
+        conservativeRoots.add(v.asCell());
+    }
+}
+
 void RegisterFile::releaseExcessCapacity()
 {
     m_reservation.decommit(m_start, reinterpret_cast<intptr_t>(m_commitEnd) - reinterpret_cast<intptr_t>(m_start));
diff --git a/Source/JavaScriptCore/interpreter/RegisterFile.h b/Source/JavaScriptCore/interpreter/RegisterFile.h
index bb42902..4d04085 100644
--- a/Source/JavaScriptCore/interpreter/RegisterFile.h
+++ b/Source/JavaScriptCore/interpreter/RegisterFile.h
@@ -91,7 +91,6 @@ namespace JSC {
 
     class RegisterFile {
         WTF_MAKE_NONCOPYABLE(RegisterFile);
-        friend class JIT;
     public:
         enum CallFrameHeaderEntry {
             CallFrameHeaderSize = 6,
@@ -114,6 +113,8 @@ namespace JSC {
 
         RegisterFile(JSGlobalData&, size_t capacity = defaultCapacity, size_t maxGlobals = defaultMaxGlobals);
         ~RegisterFile();
+        
+        void gatherConservativeRoots(ConservativeRoots&);
 
         Register* start() const { return m_start; }
         Register* end() const { return m_end; }
@@ -136,6 +137,11 @@ namespace JSC {
 
         static Finalizer* globalObjectCollectedNotifier();
 
+        Register* const * addressOfEnd() const
+        {
+            return &m_end;
+        }
+
     private:
         void releaseExcessCapacity();
         void addToCommittedByteCount(long);
diff --git a/Source/JavaScriptCore/jit/JIT.cpp b/Source/JavaScriptCore/jit/JIT.cpp
index 29e3778..063ae8c 100644
--- a/Source/JavaScriptCore/jit/JIT.cpp
+++ b/Source/JavaScriptCore/jit/JIT.cpp
@@ -92,7 +92,7 @@ JIT::JIT(JSGlobalData* globalData, CodeBlock* codeBlock, void* linkerOffset)
 #if USE(JSVALUE32_64)
 void JIT::emitTimeoutCheck()
 {
-    Jump skipTimeout = branchSub32(NonZero, Imm32(1), timeoutCheckRegister);
+    Jump skipTimeout = branchSub32(NonZero, TrustedImm32(1), timeoutCheckRegister);
     JITStubCall stubCall(this, cti_timeout_check);
     stubCall.addArgument(regT1, regT0); // save last result registers.
     stubCall.call(timeoutCheckRegister);
@@ -102,7 +102,7 @@ void JIT::emitTimeoutCheck()
 #else
 void JIT::emitTimeoutCheck()
 {
-    Jump skipTimeout = branchSub32(NonZero, Imm32(1), timeoutCheckRegister);
+    Jump skipTimeout = branchSub32(NonZero, TrustedImm32(1), timeoutCheckRegister);
     JITStubCall(this, cti_timeout_check).call(timeoutCheckRegister);
     skipTimeout.link(this);
 
@@ -475,7 +475,7 @@ JITCode JIT::privateCompile(CodePtr* functionEntryArityCheck)
         emitPutImmediateToCallFrameHeader(m_codeBlock, RegisterFile::CodeBlock);
 
         addPtr(Imm32(m_codeBlock->m_numCalleeRegisters * sizeof(Register)), callFrameRegister, regT1);
-        registerFileCheck = branchPtr(Below, AbsoluteAddress(&m_globalData->interpreter->registerFile().m_end), regT1);
+        registerFileCheck = branchPtr(Below, AbsoluteAddress(m_globalData->interpreter->registerFile().addressOfEnd()), regT1);
     }
 
     Label functionBody = label();
@@ -497,7 +497,7 @@ JITCode JIT::privateCompile(CodePtr* functionEntryArityCheck)
         arityCheck = label();
         preserveReturnAddressAfterCall(regT2);
         emitPutToCallFrameHeader(regT2, RegisterFile::ReturnPC);
-        branch32(Equal, regT1, Imm32(m_codeBlock->m_numParameters)).linkTo(beginLabel, this);
+        branch32(Equal, regT1, TrustedImm32(m_codeBlock->m_numParameters)).linkTo(beginLabel, this);
         restoreArgumentReference();
 
         JITStubCall(this, m_codeBlock->m_isConstructor ? cti_op_construct_arityCheck : cti_op_call_arityCheck).call(callFrameRegister);
@@ -567,7 +567,6 @@ JITCode JIT::privateCompile(CodePtr* functionEntryArityCheck)
 #if ENABLE(JIT_OPTIMIZE_CALL)
     for (unsigned i = 0; i < m_codeBlock->numberOfCallLinkInfos(); ++i) {
         CallLinkInfo& info = m_codeBlock->callLinkInfo(i);
-        info.ownerCodeBlock = m_codeBlock;
         info.callReturnLocation = patchBuffer.locationOfNearCall(m_callStructureStubCompilationInfo[i].callReturnLocation);
         info.hotPathBegin = patchBuffer.locationOf(m_callStructureStubCompilationInfo[i].hotPathBegin);
         info.hotPathOther = patchBuffer.locationOfNearCall(m_callStructureStubCompilationInfo[i].hotPathOther);
@@ -588,18 +587,6 @@ JITCode JIT::privateCompile(CodePtr* functionEntryArityCheck)
 }
 
 #if ENABLE(JIT_OPTIMIZE_CALL)
-void JIT::unlinkCallOrConstruct(CallLinkInfo* callLinkInfo)
-{
-    // When the JSFunction is deleted the pointer embedded in the instruction stream will no longer be valid
-    // (and, if a new JSFunction happened to be constructed at the same location, we could get a false positive
-    // match).  Reset the check so it no longer matches.
-    RepatchBuffer repatchBuffer(callLinkInfo->ownerCodeBlock);
-#if USE(JSVALUE32_64)
-    repatchBuffer.repatch(callLinkInfo->hotPathBegin, 0);
-#else
-    repatchBuffer.repatch(callLinkInfo->hotPathBegin, JSValue::encode(JSValue()));
-#endif
-}
 
 void JIT::linkCall(JSFunction* callee, CodeBlock* callerCodeBlock, CodeBlock* calleeCodeBlock, JIT::CodePtr code, CallLinkInfo* callLinkInfo, int callerArgCount, JSGlobalData* globalData)
 {
@@ -609,10 +596,7 @@ void JIT::linkCall(JSFunction* callee, CodeBlock* callerCodeBlock, CodeBlock* ca
     // If this is a native call calleeCodeBlock is null so the number of parameters is unimportant
     if (!calleeCodeBlock || (callerArgCount == calleeCodeBlock->m_numParameters)) {
         ASSERT(!callLinkInfo->isLinked());
-    
-        if (calleeCodeBlock)
-            calleeCodeBlock->addCaller(callLinkInfo);
-    
+        callLinkInfo->callee.set(*globalData, callerCodeBlock->ownerExecutable(), callee);
         repatchBuffer.repatch(callLinkInfo->hotPathBegin, callee);
         repatchBuffer.relink(callLinkInfo->hotPathOther, code);
     }
@@ -629,10 +613,7 @@ void JIT::linkConstruct(JSFunction* callee, CodeBlock* callerCodeBlock, CodeBloc
     // If this is a native call calleeCodeBlock is null so the number of parameters is unimportant
     if (!calleeCodeBlock || (callerArgCount == calleeCodeBlock->m_numParameters)) {
         ASSERT(!callLinkInfo->isLinked());
-    
-        if (calleeCodeBlock)
-            calleeCodeBlock->addCaller(callLinkInfo);
-    
+        callLinkInfo->callee.set(*globalData, callerCodeBlock->ownerExecutable(), callee);
         repatchBuffer.repatch(callLinkInfo->hotPathBegin, callee);
         repatchBuffer.relink(callLinkInfo->hotPathOther, code);
     }
diff --git a/Source/JavaScriptCore/jit/JIT.h b/Source/JavaScriptCore/jit/JIT.h
index f98158c..61bd2ab 100644
--- a/Source/JavaScriptCore/jit/JIT.h
+++ b/Source/JavaScriptCore/jit/JIT.h
@@ -245,7 +245,6 @@ namespace JSC {
 
         static void linkCall(JSFunction* callee, CodeBlock* callerCodeBlock, CodeBlock* calleeCodeBlock, CodePtr, CallLinkInfo*, int callerArgCount, JSGlobalData*);
         static void linkConstruct(JSFunction* callee, CodeBlock* callerCodeBlock, CodeBlock* calleeCodeBlock, CodePtr, CallLinkInfo*, int callerArgCount, JSGlobalData*);
-        static void unlinkCallOrConstruct(CallLinkInfo*);
 
     private:
         struct JSRInfo {
@@ -310,7 +309,7 @@ namespace JSC {
         void emitStore(unsigned index, RegisterID tag, RegisterID payload, RegisterID base = callFrameRegister);
         void emitStore(unsigned index, const JSValue constant, RegisterID base = callFrameRegister);
         void emitStoreInt32(unsigned index, RegisterID payload, bool indexIsInt32 = false);
-        void emitStoreInt32(unsigned index, Imm32 payload, bool indexIsInt32 = false);
+        void emitStoreInt32(unsigned index, TrustedImm32 payload, bool indexIsInt32 = false);
         void emitStoreCell(unsigned index, RegisterID payload, bool indexIsCell = false);
         void emitStoreBool(unsigned index, RegisterID tag, bool indexIsBool = false);
         void emitStoreDouble(unsigned index, FPRegisterID value);
@@ -854,6 +853,8 @@ namespace JSC {
         void emitInitRegister(unsigned dst);
 
         void emitPutToCallFrameHeader(RegisterID from, RegisterFile::CallFrameHeaderEntry entry);
+        void emitPutCellToCallFrameHeader(RegisterID from, RegisterFile::CallFrameHeaderEntry);
+        void emitPutIntToCallFrameHeader(RegisterID from, RegisterFile::CallFrameHeaderEntry);
         void emitPutImmediateToCallFrameHeader(void* value, RegisterFile::CallFrameHeaderEntry entry);
         void emitGetFromCallFrameHeaderPtr(RegisterFile::CallFrameHeaderEntry entry, RegisterID to, RegisterID from = callFrameRegister);
         void emitGetFromCallFrameHeader32(RegisterFile::CallFrameHeaderEntry entry, RegisterID to, RegisterID from = callFrameRegister);
diff --git a/Source/JavaScriptCore/jit/JITArithmetic.cpp b/Source/JavaScriptCore/jit/JITArithmetic.cpp
index cd05f51..edf2290 100644
--- a/Source/JavaScriptCore/jit/JITArithmetic.cpp
+++ b/Source/JavaScriptCore/jit/JITArithmetic.cpp
@@ -167,7 +167,7 @@ void JIT::emit_op_urshift(Instruction* currentInstruction)
         // a toUint conversion, which can result in a value we can represent
         // as an immediate int.
         if (shift < 0 || !(shift & 31))
-            addSlowCase(branch32(LessThan, regT0, Imm32(0)));
+            addSlowCase(branch32(LessThan, regT0, TrustedImm32(0)));
         emitFastArithReTagImmediate(regT0, regT0);
         emitPutVirtualRegister(dst, regT0);
         return;
@@ -179,7 +179,7 @@ void JIT::emit_op_urshift(Instruction* currentInstruction)
     emitFastArithImmToInt(regT0);
     emitFastArithImmToInt(regT1);
     urshift32(regT1, regT0);
-    addSlowCase(branch32(LessThan, regT0, Imm32(0)));
+    addSlowCase(branch32(LessThan, regT0, TrustedImm32(0)));
     emitFastArithReTagImmediate(regT0, regT0);
     emitPutVirtualRegister(dst, regT0);
 }
@@ -202,7 +202,7 @@ void JIT::emitSlow_op_urshift(Instruction* currentInstruction, Vector<SlowCaseEn
             if (shift)
                 urshift32(Imm32(shift & 0x1f), regT0);
             if (shift < 0 || !(shift & 31))
-                failures.append(branch32(LessThan, regT0, Imm32(0)));
+                failures.append(branch32(LessThan, regT0, TrustedImm32(0)));
             emitFastArithReTagImmediate(regT0, regT0);
             emitPutVirtualRegister(dst, regT0);
             emitJumpSlowToHot(jump(), OPCODE_LENGTH(op_rshift));
@@ -224,7 +224,7 @@ void JIT::emitSlow_op_urshift(Instruction* currentInstruction, Vector<SlowCaseEn
                 failures.append(emitJumpIfNotImmediateInteger(regT1)); // op2 is not an int
                 emitFastArithImmToInt(regT1);
                 urshift32(regT1, regT0);
-                failures.append(branch32(LessThan, regT0, Imm32(0)));
+                failures.append(branch32(LessThan, regT0, TrustedImm32(0)));
                 emitFastArithReTagImmediate(regT0, regT0);
                 emitPutVirtualRegister(dst, regT0);
                 emitJumpSlowToHot(jump(), OPCODE_LENGTH(op_rshift));
@@ -773,7 +773,7 @@ void JIT::emit_op_post_inc(Instruction* currentInstruction)
     emitGetVirtualRegister(srcDst, regT0);
     move(regT0, regT1);
     emitJumpSlowCaseIfNotImmediateInteger(regT0);
-    addSlowCase(branchAdd32(Overflow, Imm32(1), regT1));
+    addSlowCase(branchAdd32(Overflow, TrustedImm32(1), regT1));
     emitFastArithIntToImmNoCheck(regT1, regT1);
     emitPutVirtualRegister(srcDst, regT1);
     emitPutVirtualRegister(result);
@@ -800,7 +800,7 @@ void JIT::emit_op_post_dec(Instruction* currentInstruction)
     emitGetVirtualRegister(srcDst, regT0);
     move(regT0, regT1);
     emitJumpSlowCaseIfNotImmediateInteger(regT0);
-    addSlowCase(branchSub32(Zero, Imm32(1), regT1));
+    addSlowCase(branchSub32(Zero, TrustedImm32(1), regT1));
     emitFastArithIntToImmNoCheck(regT1, regT1);
     emitPutVirtualRegister(srcDst, regT1);
     emitPutVirtualRegister(result);
@@ -825,7 +825,7 @@ void JIT::emit_op_pre_inc(Instruction* currentInstruction)
 
     emitGetVirtualRegister(srcDst, regT0);
     emitJumpSlowCaseIfNotImmediateInteger(regT0);
-    addSlowCase(branchAdd32(Overflow, Imm32(1), regT0));
+    addSlowCase(branchAdd32(Overflow, TrustedImm32(1), regT0));
     emitFastArithIntToImmNoCheck(regT0, regT0);
     emitPutVirtualRegister(srcDst);
 }
@@ -849,7 +849,7 @@ void JIT::emit_op_pre_dec(Instruction* currentInstruction)
 
     emitGetVirtualRegister(srcDst, regT0);
     emitJumpSlowCaseIfNotImmediateInteger(regT0);
-    addSlowCase(branchSub32(Zero, Imm32(1), regT0));
+    addSlowCase(branchSub32(Zero, TrustedImm32(1), regT0));
     emitFastArithIntToImmNoCheck(regT0, regT0);
     emitPutVirtualRegister(srcDst);
 }
@@ -888,7 +888,7 @@ void JIT::emit_op_mod(Instruction* currentInstruction)
     emitJumpSlowCaseIfNotImmediateInteger(regT0);
     emitJumpSlowCaseIfNotImmediateInteger(regT2);
 
-    addSlowCase(branchPtr(Equal, regT2, ImmPtr(JSValue::encode(jsNumber(0)))));
+    addSlowCase(branchPtr(Equal, regT2, TrustedImmPtr(JSValue::encode(jsNumber(0)))));
     m_assembler.cdq();
     m_assembler.idivl_r(regT2);
     emitFastArithReTagImmediate(regT1, regT0);
diff --git a/Source/JavaScriptCore/jit/JITArithmetic32_64.cpp b/Source/JavaScriptCore/jit/JITArithmetic32_64.cpp
index e0b31f0..6865489 100644
--- a/Source/JavaScriptCore/jit/JITArithmetic32_64.cpp
+++ b/Source/JavaScriptCore/jit/JITArithmetic32_64.cpp
@@ -54,17 +54,17 @@ void JIT::emit_op_negate(Instruction* currentInstruction)
 
     emitLoad(src, regT1, regT0);
 
-    Jump srcNotInt = branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag));
-    addSlowCase(branchTest32(Zero, regT0, Imm32(0x7fffffff)));
+    Jump srcNotInt = branch32(NotEqual, regT1, TrustedImm32(JSValue::Int32Tag));
+    addSlowCase(branchTest32(Zero, regT0, TrustedImm32(0x7fffffff)));
     neg32(regT0);
     emitStoreInt32(dst, regT0, (dst == src));
 
     Jump end = jump();
 
     srcNotInt.link(this);
-    addSlowCase(branch32(Above, regT1, Imm32(JSValue::LowestTag)));
+    addSlowCase(branch32(Above, regT1, TrustedImm32(JSValue::LowestTag)));
 
-    xor32(Imm32(1 << 31), regT1);
+    xor32(TrustedImm32(1 << 31), regT1);
     store32(regT1, tagFor(dst));
     if (dst != src)
         store32(regT0, payloadFor(dst));
@@ -96,7 +96,7 @@ void JIT::emit_op_jnless(Instruction* currentInstruction)
     // Character less.
     if (isOperandConstantImmediateChar(op1)) {
         emitLoad(op2, regT1, regT0);
-        addSlowCase(branch32(NotEqual, regT1, Imm32(JSValue::CellTag)));
+        addSlowCase(branch32(NotEqual, regT1, TrustedImm32(JSValue::CellTag)));
         JumpList failures;
         emitLoadCharacterString(regT0, regT0, failures);
         addSlowCase(failures);
@@ -105,7 +105,7 @@ void JIT::emit_op_jnless(Instruction* currentInstruction)
     }
     if (isOperandConstantImmediateChar(op2)) {
         emitLoad(op1, regT1, regT0);
-        addSlowCase(branch32(NotEqual, regT1, Imm32(JSValue::CellTag)));
+        addSlowCase(branch32(NotEqual, regT1, TrustedImm32(JSValue::CellTag)));
         JumpList failures;
         emitLoadCharacterString(regT0, regT0, failures);
         addSlowCase(failures);
@@ -115,16 +115,16 @@ void JIT::emit_op_jnless(Instruction* currentInstruction)
     if (isOperandConstantImmediateInt(op1)) {
         // Int32 less.
         emitLoad(op2, regT3, regT2);
-        notInt32Op2.append(branch32(NotEqual, regT3, Imm32(JSValue::Int32Tag)));
+        notInt32Op2.append(branch32(NotEqual, regT3, TrustedImm32(JSValue::Int32Tag)));
         addJump(branch32(LessThanOrEqual, regT2, Imm32(getConstantOperand(op1).asInt32())), target);
     } else if (isOperandConstantImmediateInt(op2)) {
         emitLoad(op1, regT1, regT0);
-        notInt32Op1.append(branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag)));
+        notInt32Op1.append(branch32(NotEqual, regT1, TrustedImm32(JSValue::Int32Tag)));
         addJump(branch32(GreaterThanOrEqual, regT0, Imm32(getConstantOperand(op2).asInt32())), target);
     } else {
         emitLoad2(op1, regT1, regT0, op2, regT3, regT2);
-        notInt32Op1.append(branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag)));
-        notInt32Op2.append(branch32(NotEqual, regT3, Imm32(JSValue::Int32Tag)));
+        notInt32Op1.append(branch32(NotEqual, regT1, TrustedImm32(JSValue::Int32Tag)));
+        notInt32Op2.append(branch32(NotEqual, regT3, TrustedImm32(JSValue::Int32Tag)));
         addJump(branch32(GreaterThanOrEqual, regT0, regT2), target);
     }
 
@@ -185,7 +185,7 @@ void JIT::emit_op_jless(Instruction* currentInstruction)
     // Character less.
     if (isOperandConstantImmediateChar(op1)) {
         emitLoad(op2, regT1, regT0);
-        addSlowCase(branch32(NotEqual, regT1, Imm32(JSValue::CellTag)));
+        addSlowCase(branch32(NotEqual, regT1, TrustedImm32(JSValue::CellTag)));
         JumpList failures;
         emitLoadCharacterString(regT0, regT0, failures);
         addSlowCase(failures);
@@ -194,7 +194,7 @@ void JIT::emit_op_jless(Instruction* currentInstruction)
     }
     if (isOperandConstantImmediateChar(op2)) {
         emitLoad(op1, regT1, regT0);
-        addSlowCase(branch32(NotEqual, regT1, Imm32(JSValue::CellTag)));
+        addSlowCase(branch32(NotEqual, regT1, TrustedImm32(JSValue::CellTag)));
         JumpList failures;
         emitLoadCharacterString(regT0, regT0, failures);
         addSlowCase(failures);
@@ -203,16 +203,16 @@ void JIT::emit_op_jless(Instruction* currentInstruction)
     } 
     if (isOperandConstantImmediateInt(op1)) {
         emitLoad(op2, regT3, regT2);
-        notInt32Op2.append(branch32(NotEqual, regT3, Imm32(JSValue::Int32Tag)));
+        notInt32Op2.append(branch32(NotEqual, regT3, TrustedImm32(JSValue::Int32Tag)));
         addJump(branch32(GreaterThan, regT2, Imm32(getConstantOperand(op1).asInt32())), target);
     } else if (isOperandConstantImmediateInt(op2)) {
         emitLoad(op1, regT1, regT0);
-        notInt32Op1.append(branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag)));
+        notInt32Op1.append(branch32(NotEqual, regT1, TrustedImm32(JSValue::Int32Tag)));
         addJump(branch32(LessThan, regT0, Imm32(getConstantOperand(op2).asInt32())), target);
     } else {
         emitLoad2(op1, regT1, regT0, op2, regT3, regT2);
-        notInt32Op1.append(branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag)));
-        notInt32Op2.append(branch32(NotEqual, regT3, Imm32(JSValue::Int32Tag)));
+        notInt32Op1.append(branch32(NotEqual, regT1, TrustedImm32(JSValue::Int32Tag)));
+        notInt32Op2.append(branch32(NotEqual, regT3, TrustedImm32(JSValue::Int32Tag)));
         addJump(branch32(LessThan, regT0, regT2), target);
     }
 
@@ -272,7 +272,7 @@ void JIT::emit_op_jlesseq(Instruction* currentInstruction, bool invert)
     // Character less.
     if (isOperandConstantImmediateChar(op1)) {
         emitLoad(op2, regT1, regT0);
-        addSlowCase(branch32(NotEqual, regT1, Imm32(JSValue::CellTag)));
+        addSlowCase(branch32(NotEqual, regT1, TrustedImm32(JSValue::CellTag)));
         JumpList failures;
         emitLoadCharacterString(regT0, regT0, failures);
         addSlowCase(failures);
@@ -281,7 +281,7 @@ void JIT::emit_op_jlesseq(Instruction* currentInstruction, bool invert)
     }
     if (isOperandConstantImmediateChar(op2)) {
         emitLoad(op1, regT1, regT0);
-        addSlowCase(branch32(NotEqual, regT1, Imm32(JSValue::CellTag)));
+        addSlowCase(branch32(NotEqual, regT1, TrustedImm32(JSValue::CellTag)));
         JumpList failures;
         emitLoadCharacterString(regT0, regT0, failures);
         addSlowCase(failures);
@@ -290,16 +290,16 @@ void JIT::emit_op_jlesseq(Instruction* currentInstruction, bool invert)
     }
     if (isOperandConstantImmediateInt(op1)) {
         emitLoad(op2, regT3, regT2);
-        notInt32Op2.append(branch32(NotEqual, regT3, Imm32(JSValue::Int32Tag)));
+        notInt32Op2.append(branch32(NotEqual, regT3, TrustedImm32(JSValue::Int32Tag)));
         addJump(branch32(invert ? LessThan : GreaterThanOrEqual, regT2, Imm32(getConstantOperand(op1).asInt32())), target);
     } else if (isOperandConstantImmediateInt(op2)) {
         emitLoad(op1, regT1, regT0);
-        notInt32Op1.append(branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag)));
+        notInt32Op1.append(branch32(NotEqual, regT1, TrustedImm32(JSValue::Int32Tag)));
         addJump(branch32(invert ? GreaterThan : LessThanOrEqual, regT0, Imm32(getConstantOperand(op2).asInt32())), target);
     } else {
         emitLoad2(op1, regT1, regT0, op2, regT3, regT2);
-        notInt32Op1.append(branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag)));
-        notInt32Op2.append(branch32(NotEqual, regT3, Imm32(JSValue::Int32Tag)));
+        notInt32Op1.append(branch32(NotEqual, regT1, TrustedImm32(JSValue::Int32Tag)));
+        notInt32Op2.append(branch32(NotEqual, regT3, TrustedImm32(JSValue::Int32Tag)));
         addJump(branch32(invert ? GreaterThan : LessThanOrEqual, regT0, regT2), target);
     }
 
@@ -368,7 +368,7 @@ void JIT::emit_op_lshift(Instruction* currentInstruction)
 
     if (isOperandConstantImmediateInt(op2)) {
         emitLoad(op1, regT1, regT0);
-        addSlowCase(branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag)));
+        addSlowCase(branch32(NotEqual, regT1, TrustedImm32(JSValue::Int32Tag)));
         lshift32(Imm32(getConstantOperand(op2).asInt32()), regT0);
         emitStoreInt32(dst, regT0, dst == op1);
         return;
@@ -376,8 +376,8 @@ void JIT::emit_op_lshift(Instruction* currentInstruction)
 
     emitLoad2(op1, regT1, regT0, op2, regT3, regT2);
     if (!isOperandConstantImmediateInt(op1))
-        addSlowCase(branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag)));
-    addSlowCase(branch32(NotEqual, regT3, Imm32(JSValue::Int32Tag)));
+        addSlowCase(branch32(NotEqual, regT1, TrustedImm32(JSValue::Int32Tag)));
+    addSlowCase(branch32(NotEqual, regT3, TrustedImm32(JSValue::Int32Tag)));
     lshift32(regT2, regT0);
     emitStoreInt32(dst, regT0, dst == op1 || dst == op2);
 }
@@ -410,7 +410,7 @@ void JIT::emitRightShift(Instruction* currentInstruction, bool isUnsigned)
     // shift arguments, so any changes must be updated there as well.
     if (isOperandConstantImmediateInt(op2)) {
         emitLoad(op1, regT1, regT0);
-        addSlowCase(branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag)));
+        addSlowCase(branch32(NotEqual, regT1, TrustedImm32(JSValue::Int32Tag)));
         int shift = getConstantOperand(op2).asInt32();
         if (isUnsigned) {
             if (shift)
@@ -419,7 +419,7 @@ void JIT::emitRightShift(Instruction* currentInstruction, bool isUnsigned)
             // a toUint conversion, which can result in a value we can represent
             // as an immediate int.
             if (shift < 0 || !(shift & 31))
-                addSlowCase(branch32(LessThan, regT0, Imm32(0)));
+                addSlowCase(branch32(LessThan, regT0, TrustedImm32(0)));
         } else if (shift) { // signed right shift by zero is simply toInt conversion
             rshift32(Imm32(shift & 0x1f), regT0);
         }
@@ -429,11 +429,11 @@ void JIT::emitRightShift(Instruction* currentInstruction, bool isUnsigned)
 
     emitLoad2(op1, regT1, regT0, op2, regT3, regT2);
     if (!isOperandConstantImmediateInt(op1))
-        addSlowCase(branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag)));
-    addSlowCase(branch32(NotEqual, regT3, Imm32(JSValue::Int32Tag)));
+        addSlowCase(branch32(NotEqual, regT1, TrustedImm32(JSValue::Int32Tag)));
+    addSlowCase(branch32(NotEqual, regT3, TrustedImm32(JSValue::Int32Tag)));
     if (isUnsigned) {
         urshift32(regT2, regT0);
-        addSlowCase(branch32(LessThan, regT0, Imm32(0)));
+        addSlowCase(branch32(LessThan, regT0, TrustedImm32(0)));
     } else
         rshift32(regT2, regT0);
     emitStoreInt32(dst, regT0, dst == op1 || dst == op2);
@@ -450,14 +450,14 @@ void JIT::emitRightShiftSlowCase(Instruction* currentInstruction, Vector<SlowCas
         linkSlowCase(iter); // int32 check
         if (supportsFloatingPointTruncate()) {
             JumpList failures;
-            failures.append(branch32(AboveOrEqual, regT1, Imm32(JSValue::LowestTag)));
+            failures.append(branch32(AboveOrEqual, regT1, TrustedImm32(JSValue::LowestTag)));
             emitLoadDouble(op1, fpRegT0);
             failures.append(branchTruncateDoubleToInt32(fpRegT0, regT0));
             if (isUnsigned) {
                 if (shift)
                     urshift32(Imm32(shift & 0x1f), regT0);
                 if (shift < 0 || !(shift & 31))
-                    failures.append(branch32(LessThan, regT0, Imm32(0)));
+                    failures.append(branch32(LessThan, regT0, TrustedImm32(0)));
             } else if (shift)
                 rshift32(Imm32(shift & 0x1f), regT0);
             emitStoreInt32(dst, regT0, false);
@@ -472,9 +472,9 @@ void JIT::emitRightShiftSlowCase(Instruction* currentInstruction, Vector<SlowCas
         if (!isOperandConstantImmediateInt(op1)) {
             linkSlowCase(iter); // int32 check -- op1 is not an int
             if (supportsFloatingPointTruncate()) {
-                Jump notDouble = branch32(Above, regT1, Imm32(JSValue::LowestTag)); // op1 is not a double
+                Jump notDouble = branch32(Above, regT1, TrustedImm32(JSValue::LowestTag)); // op1 is not a double
                 emitLoadDouble(op1, fpRegT0);
-                Jump notInt = branch32(NotEqual, regT3, Imm32(JSValue::Int32Tag)); // op2 is not an int
+                Jump notInt = branch32(NotEqual, regT3, TrustedImm32(JSValue::Int32Tag)); // op2 is not an int
                 Jump cantTruncate = branchTruncateDoubleToInt32(fpRegT0, regT0);
                 if (isUnsigned)
                     urshift32(regT2, regT0);
@@ -535,15 +535,15 @@ void JIT::emit_op_bitand(Instruction* currentInstruction)
     int32_t constant;
     if (getOperandConstantImmediateInt(op1, op2, op, constant)) {
         emitLoad(op, regT1, regT0);
-        addSlowCase(branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag)));
+        addSlowCase(branch32(NotEqual, regT1, TrustedImm32(JSValue::Int32Tag)));
         and32(Imm32(constant), regT0);
         emitStoreInt32(dst, regT0, (op == dst));
         return;
     }
 
     emitLoad2(op1, regT1, regT0, op2, regT3, regT2);
-    addSlowCase(branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag)));
-    addSlowCase(branch32(NotEqual, regT3, Imm32(JSValue::Int32Tag)));
+    addSlowCase(branch32(NotEqual, regT1, TrustedImm32(JSValue::Int32Tag)));
+    addSlowCase(branch32(NotEqual, regT3, TrustedImm32(JSValue::Int32Tag)));
     and32(regT2, regT0);
     emitStoreInt32(dst, regT0, (op1 == dst || op2 == dst));
 }
@@ -576,15 +576,15 @@ void JIT::emit_op_bitor(Instruction* currentInstruction)
     int32_t constant;
     if (getOperandConstantImmediateInt(op1, op2, op, constant)) {
         emitLoad(op, regT1, regT0);
-        addSlowCase(branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag)));
+        addSlowCase(branch32(NotEqual, regT1, TrustedImm32(JSValue::Int32Tag)));
         or32(Imm32(constant), regT0);
         emitStoreInt32(dst, regT0, (op == dst));
         return;
     }
 
     emitLoad2(op1, regT1, regT0, op2, regT3, regT2);
-    addSlowCase(branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag)));
-    addSlowCase(branch32(NotEqual, regT3, Imm32(JSValue::Int32Tag)));
+    addSlowCase(branch32(NotEqual, regT1, TrustedImm32(JSValue::Int32Tag)));
+    addSlowCase(branch32(NotEqual, regT3, TrustedImm32(JSValue::Int32Tag)));
     or32(regT2, regT0);
     emitStoreInt32(dst, regT0, (op1 == dst || op2 == dst));
 }
@@ -617,15 +617,15 @@ void JIT::emit_op_bitxor(Instruction* currentInstruction)
     int32_t constant;
     if (getOperandConstantImmediateInt(op1, op2, op, constant)) {
         emitLoad(op, regT1, regT0);
-        addSlowCase(branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag)));
+        addSlowCase(branch32(NotEqual, regT1, TrustedImm32(JSValue::Int32Tag)));
         xor32(Imm32(constant), regT0);
         emitStoreInt32(dst, regT0, (op == dst));
         return;
     }
 
     emitLoad2(op1, regT1, regT0, op2, regT3, regT2);
-    addSlowCase(branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag)));
-    addSlowCase(branch32(NotEqual, regT3, Imm32(JSValue::Int32Tag)));
+    addSlowCase(branch32(NotEqual, regT1, TrustedImm32(JSValue::Int32Tag)));
+    addSlowCase(branch32(NotEqual, regT3, TrustedImm32(JSValue::Int32Tag)));
     xor32(regT2, regT0);
     emitStoreInt32(dst, regT0, (op1 == dst || op2 == dst));
 }
@@ -654,7 +654,7 @@ void JIT::emit_op_bitnot(Instruction* currentInstruction)
     unsigned src = currentInstruction[2].u.operand;
 
     emitLoad(src, regT1, regT0);
-    addSlowCase(branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag)));
+    addSlowCase(branch32(NotEqual, regT1, TrustedImm32(JSValue::Int32Tag)));
 
     not32(regT0);
     emitStoreInt32(dst, regT0, (dst == src));
@@ -679,14 +679,14 @@ void JIT::emit_op_post_inc(Instruction* currentInstruction)
     unsigned srcDst = currentInstruction[2].u.operand;
 
     emitLoad(srcDst, regT1, regT0);
-    addSlowCase(branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag)));
+    addSlowCase(branch32(NotEqual, regT1, TrustedImm32(JSValue::Int32Tag)));
 
     if (dst == srcDst) // x = x++ is a noop for ints.
         return;
 
     emitStoreInt32(dst, regT0);
 
-    addSlowCase(branchAdd32(Overflow, Imm32(1), regT0));
+    addSlowCase(branchAdd32(Overflow, TrustedImm32(1), regT0));
     emitStoreInt32(srcDst, regT0, true);
 }
 
@@ -713,14 +713,14 @@ void JIT::emit_op_post_dec(Instruction* currentInstruction)
     unsigned srcDst = currentInstruction[2].u.operand;
 
     emitLoad(srcDst, regT1, regT0);
-    addSlowCase(branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag)));
+    addSlowCase(branch32(NotEqual, regT1, TrustedImm32(JSValue::Int32Tag)));
 
     if (dst == srcDst) // x = x-- is a noop for ints.
         return;
 
     emitStoreInt32(dst, regT0);
 
-    addSlowCase(branchSub32(Overflow, Imm32(1), regT0));
+    addSlowCase(branchSub32(Overflow, TrustedImm32(1), regT0));
     emitStoreInt32(srcDst, regT0, true);
 }
 
@@ -735,7 +735,7 @@ void JIT::emitSlow_op_post_dec(Instruction* currentInstruction, Vector<SlowCaseE
 
     JITStubCall stubCall(this, cti_op_post_dec);
     stubCall.addArgument(srcDst);
-    stubCall.addArgument(Imm32(srcDst));
+    stubCall.addArgument(TrustedImm32(srcDst));
     stubCall.call(dst);
 }
 
@@ -747,8 +747,8 @@ void JIT::emit_op_pre_inc(Instruction* currentInstruction)
 
     emitLoad(srcDst, regT1, regT0);
 
-    addSlowCase(branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag)));
-    addSlowCase(branchAdd32(Overflow, Imm32(1), regT0));
+    addSlowCase(branch32(NotEqual, regT1, TrustedImm32(JSValue::Int32Tag)));
+    addSlowCase(branchAdd32(Overflow, TrustedImm32(1), regT0));
     emitStoreInt32(srcDst, regT0, true);
 }
 
@@ -772,8 +772,8 @@ void JIT::emit_op_pre_dec(Instruction* currentInstruction)
 
     emitLoad(srcDst, regT1, regT0);
 
-    addSlowCase(branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag)));
-    addSlowCase(branchSub32(Overflow, Imm32(1), regT0));
+    addSlowCase(branch32(NotEqual, regT1, TrustedImm32(JSValue::Int32Tag)));
+    addSlowCase(branchSub32(Overflow, TrustedImm32(1), regT0));
     emitStoreInt32(srcDst, regT0, true);
 }
 
@@ -817,8 +817,8 @@ void JIT::emit_op_add(Instruction* currentInstruction)
     }
 
     emitLoad2(op1, regT1, regT0, op2, regT3, regT2);
-    notInt32Op1.append(branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag)));
-    notInt32Op2.append(branch32(NotEqual, regT3, Imm32(JSValue::Int32Tag)));
+    notInt32Op1.append(branch32(NotEqual, regT1, TrustedImm32(JSValue::Int32Tag)));
+    notInt32Op2.append(branch32(NotEqual, regT3, TrustedImm32(JSValue::Int32Tag)));
 
     // Int32 case.
     addSlowCase(branchAdd32(Overflow, regT2, regT0));
@@ -840,7 +840,7 @@ void JIT::emitAdd32Constant(unsigned dst, unsigned op, int32_t constant, ResultT
 {
     // Int32 case.
     emitLoad(op, regT1, regT0);
-    Jump notInt32 = branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag));
+    Jump notInt32 = branch32(NotEqual, regT1, TrustedImm32(JSValue::Int32Tag));
     addSlowCase(branchAdd32(Overflow, Imm32(constant), regT0));
     emitStoreInt32(dst, regT0, (op == dst));
 
@@ -853,7 +853,7 @@ void JIT::emitAdd32Constant(unsigned dst, unsigned op, int32_t constant, ResultT
 
     notInt32.link(this);
     if (!opType.definitelyIsNumber())
-        addSlowCase(branch32(Above, regT1, Imm32(JSValue::LowestTag)));
+        addSlowCase(branch32(Above, regT1, TrustedImm32(JSValue::LowestTag)));
     move(Imm32(constant), regT2);
     convertInt32ToDouble(regT2, fpRegT0);
     emitLoadDouble(op, fpRegT1);
@@ -926,8 +926,8 @@ void JIT::emit_op_sub(Instruction* currentInstruction)
     }
 
     emitLoad2(op1, regT1, regT0, op2, regT3, regT2);
-    notInt32Op1.append(branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag)));
-    notInt32Op2.append(branch32(NotEqual, regT3, Imm32(JSValue::Int32Tag)));
+    notInt32Op1.append(branch32(NotEqual, regT1, TrustedImm32(JSValue::Int32Tag)));
+    notInt32Op2.append(branch32(NotEqual, regT3, TrustedImm32(JSValue::Int32Tag)));
 
     // Int32 case.
     addSlowCase(branchSub32(Overflow, regT2, regT0));
@@ -949,7 +949,7 @@ void JIT::emitSub32Constant(unsigned dst, unsigned op, int32_t constant, ResultT
 {
     // Int32 case.
     emitLoad(op, regT1, regT0);
-    Jump notInt32 = branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag));
+    Jump notInt32 = branch32(NotEqual, regT1, TrustedImm32(JSValue::Int32Tag));
     addSlowCase(branchSub32(Overflow, Imm32(constant), regT0));
     emitStoreInt32(dst, regT0, (op == dst));
 
@@ -962,7 +962,7 @@ void JIT::emitSub32Constant(unsigned dst, unsigned op, int32_t constant, ResultT
 
     notInt32.link(this);
     if (!opType.definitelyIsNumber())
-        addSlowCase(branch32(Above, regT1, Imm32(JSValue::LowestTag)));
+        addSlowCase(branch32(Above, regT1, TrustedImm32(JSValue::LowestTag)));
     move(Imm32(constant), regT2);
     convertInt32ToDouble(regT2, fpRegT0);
     emitLoadDouble(op, fpRegT1);
@@ -1019,15 +1019,15 @@ void JIT::emitBinaryDoubleOp(OpcodeID opcodeID, unsigned dst, unsigned op1, unsi
 
         // Verify Op1 is double.
         if (!types.first().definitelyIsNumber())
-            addSlowCase(branch32(Above, regT1, Imm32(JSValue::LowestTag)));
+            addSlowCase(branch32(Above, regT1, TrustedImm32(JSValue::LowestTag)));
 
         if (!op2IsInRegisters)
             emitLoad(op2, regT3, regT2);
 
-        Jump doubleOp2 = branch32(Below, regT3, Imm32(JSValue::LowestTag));
+        Jump doubleOp2 = branch32(Below, regT3, TrustedImm32(JSValue::LowestTag));
 
         if (!types.second().definitelyIsNumber())
-            addSlowCase(branch32(NotEqual, regT3, Imm32(JSValue::Int32Tag)));
+            addSlowCase(branch32(NotEqual, regT3, TrustedImm32(JSValue::Int32Tag)));
 
         convertInt32ToDouble(regT2, fpRegT0);
         Jump doTheMath = jump();
@@ -1096,7 +1096,7 @@ void JIT::emitBinaryDoubleOp(OpcodeID opcodeID, unsigned dst, unsigned op1, unsi
 
         // Verify op2 is double.
         if (!types.second().definitelyIsNumber())
-            addSlowCase(branch32(Above, regT3, Imm32(JSValue::LowestTag)));
+            addSlowCase(branch32(Above, regT3, TrustedImm32(JSValue::LowestTag)));
 
         // Do the math.
         switch (opcodeID) {
@@ -1157,8 +1157,8 @@ void JIT::emit_op_mul(Instruction* currentInstruction)
     JumpList notInt32Op2;
 
     emitLoad2(op1, regT1, regT0, op2, regT3, regT2);
-    notInt32Op1.append(branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag)));
-    notInt32Op2.append(branch32(NotEqual, regT3, Imm32(JSValue::Int32Tag)));
+    notInt32Op1.append(branch32(NotEqual, regT1, TrustedImm32(JSValue::Int32Tag)));
+    notInt32Op2.append(branch32(NotEqual, regT3, TrustedImm32(JSValue::Int32Tag)));
 
     // Int32 case.
     move(regT0, regT3);
@@ -1189,7 +1189,7 @@ void JIT::emitSlow_op_mul(Instruction* currentInstruction, Vector<SlowCaseEntry>
     linkSlowCase(iter); // zero result check
 
     Jump negZero = branchOr32(Signed, regT2, regT3);
-    emitStoreInt32(dst, Imm32(0), (op1 == dst || op2 == dst));
+    emitStoreInt32(dst, TrustedImm32(0), (op1 == dst || op2 == dst));
 
     emitJumpSlowToHot(jump(), OPCODE_LENGTH(op_mul));
 
@@ -1240,8 +1240,8 @@ void JIT::emit_op_div(Instruction* currentInstruction)
 
     emitLoad2(op1, regT1, regT0, op2, regT3, regT2);
 
-    notInt32Op1.append(branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag)));
-    notInt32Op2.append(branch32(NotEqual, regT3, Imm32(JSValue::Int32Tag)));
+    notInt32Op1.append(branch32(NotEqual, regT1, TrustedImm32(JSValue::Int32Tag)));
+    notInt32Op2.append(branch32(NotEqual, regT3, TrustedImm32(JSValue::Int32Tag)));
 
     convertInt32ToDouble(regT0, fpRegT0);
     convertInt32ToDouble(regT2, fpRegT1);
@@ -1312,16 +1312,16 @@ void JIT::emit_op_mod(Instruction* currentInstruction)
     if (isOperandConstantImmediateInt(op2) && getConstantOperand(op2).asInt32() != 0) {
         emitLoad(op1, regT1, regT0);
         move(Imm32(getConstantOperand(op2).asInt32()), regT2);
-        addSlowCase(branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag)));
+        addSlowCase(branch32(NotEqual, regT1, TrustedImm32(JSValue::Int32Tag)));
         if (getConstantOperand(op2).asInt32() == -1)
-            addSlowCase(branch32(Equal, regT0, Imm32(0x80000000))); // -2147483648 / -1 => EXC_ARITHMETIC
+            addSlowCase(branch32(Equal, regT0, TrustedImm32(0x80000000))); // -2147483648 / -1 => EXC_ARITHMETIC
     } else {
         emitLoad2(op1, regT1, regT0, op2, regT3, regT2);
-        addSlowCase(branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag)));
-        addSlowCase(branch32(NotEqual, regT3, Imm32(JSValue::Int32Tag)));
+        addSlowCase(branch32(NotEqual, regT1, TrustedImm32(JSValue::Int32Tag)));
+        addSlowCase(branch32(NotEqual, regT3, TrustedImm32(JSValue::Int32Tag)));
 
-        addSlowCase(branch32(Equal, regT0, Imm32(0x80000000))); // -2147483648 / -1 => EXC_ARITHMETIC
-        addSlowCase(branch32(Equal, regT2, Imm32(0))); // divide by 0
+        addSlowCase(branch32(Equal, regT0, TrustedImm32(0x80000000))); // -2147483648 / -1 => EXC_ARITHMETIC
+        addSlowCase(branch32(Equal, regT2, TrustedImm32(0))); // divide by 0
     }
 
     move(regT0, regT3); // Save dividend payload, in case of 0.
@@ -1335,7 +1335,7 @@ void JIT::emit_op_mod(Instruction* currentInstruction)
 
     // If the remainder is zero and the dividend is negative, the result is -0.
     Jump storeResult1 = branchTest32(NonZero, regT1);
-    Jump storeResult2 = branchTest32(Zero, regT3, Imm32(0x80000000)); // not negative
+    Jump storeResult2 = branchTest32(Zero, regT3, TrustedImm32(0x80000000)); // not negative
     emitStore(dst, jsNumber(-0.0));
     Jump end = jump();
 
@@ -1378,10 +1378,10 @@ void JIT::emit_op_mod(Instruction* currentInstruction)
 
 #if ENABLE(JIT_USE_SOFT_MODULO)
     emitLoad2(op1, regT1, regT0, op2, regT3, regT2);
-    addSlowCase(branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag)));
-    addSlowCase(branch32(NotEqual, regT3, Imm32(JSValue::Int32Tag)));
+    addSlowCase(branch32(NotEqual, regT1, TrustedImm32(JSValue::Int32Tag)));
+    addSlowCase(branch32(NotEqual, regT3, TrustedImm32(JSValue::Int32Tag)));
 
-    addSlowCase(branch32(Equal, regT2, Imm32(0)));
+    addSlowCase(branch32(Equal, regT2, TrustedImm32(0)));
 
     emitNakedCall(m_globalData->jitStubs->ctiSoftModulo());
 
diff --git a/Source/JavaScriptCore/jit/JITCall.cpp b/Source/JavaScriptCore/jit/JITCall.cpp
index 524e576..77c2a69 100644
--- a/Source/JavaScriptCore/jit/JITCall.cpp
+++ b/Source/JavaScriptCore/jit/JITCall.cpp
@@ -48,10 +48,11 @@ namespace JSC {
 
 void JIT::compileOpCallInitializeCallFrame()
 {
-    store32(regT1, Address(callFrameRegister, RegisterFile::ArgumentCount * static_cast<int>(sizeof(Register))));
-    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSFunction, m_scopeChain)), regT3); // newScopeChain
-    storePtr(regT0, Address(callFrameRegister, RegisterFile::Callee * static_cast<int>(sizeof(Register))));
-    storePtr(regT3, Address(callFrameRegister, RegisterFile::ScopeChain * static_cast<int>(sizeof(Register))));
+    // regT0 holds callee, regT1 holds argCount
+    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSFunction, m_scopeChain)), regT3); // scopeChain
+    emitPutIntToCallFrameHeader(regT1, RegisterFile::ArgumentCount);
+    emitPutCellToCallFrameHeader(regT0, RegisterFile::Callee);
+    emitPutCellToCallFrameHeader(regT3, RegisterFile::ScopeChain);
 }
 
 void JIT::emit_op_call_put_result(Instruction* instruction)
@@ -67,15 +68,16 @@ void JIT::compileOpCallVarargs(Instruction* instruction)
     int registerOffset = instruction[3].u.operand;
 
     emitGetVirtualRegister(argCountRegister, regT1);
+    emitFastArithImmToInt(regT1);
     emitGetVirtualRegister(callee, regT0);
     addPtr(Imm32(registerOffset), regT1, regT2);
 
     // Check for JSFunctions.
     emitJumpSlowCaseIfNotJSCell(regT0);
-    addSlowCase(branchPtr(NotEqual, Address(regT0), ImmPtr(m_globalData->jsFunctionVPtr)));
+    addSlowCase(branchPtr(NotEqual, Address(regT0), TrustedImmPtr(m_globalData->jsFunctionVPtr)));
 
     // Speculatively roll the callframe, assuming argCount will match the arity.
-    mul32(Imm32(sizeof(Register)), regT2, regT2);
+    mul32(TrustedImm32(sizeof(Register)), regT2, regT2);
     intptr_t offset = (intptr_t)sizeof(Register) * (intptr_t)RegisterFile::CallerFrame;
     addPtr(Imm32((int32_t)offset), regT2, regT3);
     addPtr(callFrameRegister, regT3);
@@ -118,14 +120,14 @@ void JIT::compileOpCall(OpcodeID opcodeID, Instruction* instruction, unsigned)
         stubCall.addArgument(JIT::Imm32(registerOffset));
         stubCall.addArgument(JIT::Imm32(argCount));
         stubCall.call();
-        wasEval = branchPtr(NotEqual, regT0, ImmPtr(JSValue::encode(JSValue())));
+        wasEval = branchPtr(NotEqual, regT0, TrustedImmPtr(JSValue::encode(JSValue())));
     }
 
     emitGetVirtualRegister(callee, regT0);
 
     // Check for JSFunctions.
     emitJumpSlowCaseIfNotJSCell(regT0);
-    addSlowCase(branchPtr(NotEqual, Address(regT0), ImmPtr(m_globalData->jsFunctionVPtr)));
+    addSlowCase(branchPtr(NotEqual, Address(regT0), TrustedImmPtr(m_globalData->jsFunctionVPtr)));
 
     // Speculatively roll the callframe, assuming argCount will match the arity.
     storePtr(callFrameRegister, Address(callFrameRegister, (RegisterFile::CallerFrame + registerOffset) * static_cast<int>(sizeof(Register))));
@@ -175,7 +177,7 @@ void JIT::compileOpCall(OpcodeID opcodeID, Instruction* instruction, unsigned ca
         stubCall.addArgument(JIT::Imm32(registerOffset));
         stubCall.addArgument(JIT::Imm32(argCount));
         stubCall.call();
-        wasEval = branchPtr(NotEqual, regT0, ImmPtr(JSValue::encode(JSValue())));
+        wasEval = branchPtr(NotEqual, regT0, TrustedImmPtr(JSValue::encode(JSValue())));
     }
 
     // This plants a check for a cached JSFunction value, so we can plant a fast link to the callee.
@@ -185,7 +187,7 @@ void JIT::compileOpCall(OpcodeID opcodeID, Instruction* instruction, unsigned ca
 
     BEGIN_UNINTERRUPTED_SEQUENCE(sequenceOpCall);
 
-    Jump jumpToSlow = branchPtrWithPatch(NotEqual, regT0, addressOfLinkedFunctionCheck, ImmPtr(JSValue::encode(JSValue())));
+    Jump jumpToSlow = branchPtrWithPatch(NotEqual, regT0, addressOfLinkedFunctionCheck, TrustedImmPtr(JSValue::encode(JSValue())));
 
     END_UNINTERRUPTED_SEQUENCE(sequenceOpCall);
 
@@ -199,8 +201,9 @@ void JIT::compileOpCall(OpcodeID opcodeID, Instruction* instruction, unsigned ca
     // Note that this omits to set up RegisterFile::CodeBlock, which is set in the callee
 
     loadPtr(Address(regT0, OBJECT_OFFSETOF(JSFunction, m_scopeChain)), regT1); // newScopeChain
-
-    store32(Imm32(argCount), Address(callFrameRegister, (registerOffset + RegisterFile::ArgumentCount) * static_cast<int>(sizeof(Register))));
+    
+    store32(TrustedImm32(Int32Tag), intTagFor(registerOffset + RegisterFile::ArgumentCount));
+    store32(Imm32(argCount), intPayloadFor(registerOffset + RegisterFile::ArgumentCount));
     storePtr(callFrameRegister, Address(callFrameRegister, (registerOffset + RegisterFile::CallerFrame) * static_cast<int>(sizeof(Register))));
     storePtr(regT0, Address(callFrameRegister, (registerOffset + RegisterFile::Callee) * static_cast<int>(sizeof(Register))));
     storePtr(regT1, Address(callFrameRegister, (registerOffset + RegisterFile::ScopeChain) * static_cast<int>(sizeof(Register))));
@@ -224,7 +227,7 @@ void JIT::compileOpCallSlowCase(Instruction* instruction, Vector<SlowCaseEntry>:
 
     // Fast check for JS function.
     Jump callLinkFailNotObject = emitJumpIfNotJSCell(regT0);
-    Jump callLinkFailNotJSFunction = branchPtr(NotEqual, Address(regT0), ImmPtr(m_globalData->jsFunctionVPtr));
+    Jump callLinkFailNotJSFunction = branchPtr(NotEqual, Address(regT0), TrustedImmPtr(m_globalData->jsFunctionVPtr));
 
     // Speculatively roll the callframe, assuming argCount will match the arity.
     storePtr(callFrameRegister, Address(callFrameRegister, (RegisterFile::CallerFrame + registerOffset) * static_cast<int>(sizeof(Register))));
diff --git a/Source/JavaScriptCore/jit/JITCall32_64.cpp b/Source/JavaScriptCore/jit/JITCall32_64.cpp
index ac231a9..9ffa495 100644
--- a/Source/JavaScriptCore/jit/JITCall32_64.cpp
+++ b/Source/JavaScriptCore/jit/JITCall32_64.cpp
@@ -49,10 +49,10 @@ namespace JSC {
 void JIT::compileOpCallInitializeCallFrame()
 {
     // regT0 holds callee, regT1 holds argCount
-    store32(regT1, Address(callFrameRegister, RegisterFile::ArgumentCount * static_cast<int>(sizeof(Register))));
     loadPtr(Address(regT0, OBJECT_OFFSETOF(JSFunction, m_scopeChain)), regT3); // scopeChain
-    storePtr(regT0, Address(callFrameRegister, RegisterFile::Callee * static_cast<int>(sizeof(Register)))); // callee
-    storePtr(regT3, Address(callFrameRegister, RegisterFile::ScopeChain * static_cast<int>(sizeof(Register)))); // scopeChain
+    emitPutIntToCallFrameHeader(regT1, RegisterFile::ArgumentCount);
+    emitPutCellToCallFrameHeader(regT0, RegisterFile::Callee);
+    emitPutCellToCallFrameHeader(regT3, RegisterFile::ScopeChain);
 }
 
 void JIT::emit_op_call_put_result(Instruction* instruction)
@@ -72,12 +72,13 @@ void JIT::compileOpCallVarargs(Instruction* instruction)
     addPtr(Imm32(registerOffset), regT2, regT3); // registerOffset
 
     emitJumpSlowCaseIfNotJSCell(callee, regT1);
-    addSlowCase(branchPtr(NotEqual, Address(regT0), ImmPtr(m_globalData->jsFunctionVPtr)));
+    addSlowCase(branchPtr(NotEqual, Address(regT0), TrustedImmPtr(m_globalData->jsFunctionVPtr)));
 
     // Speculatively roll the callframe, assuming argCount will match the arity.
-    mul32(Imm32(sizeof(Register)), regT3, regT3);
+    mul32(TrustedImm32(sizeof(Register)), regT3, regT3);
     addPtr(callFrameRegister, regT3);
-    storePtr(callFrameRegister, Address(regT3, RegisterFile::CallerFrame * static_cast<int>(sizeof(Register))));
+    store32(TrustedImm32(JSValue::CellTag), tagFor(RegisterFile::CallerFrame, regT3));
+    storePtr(callFrameRegister, payloadFor(RegisterFile::CallerFrame, regT3));
     move(regT3, callFrameRegister);
 
     move(regT2, regT1); // argCount
@@ -121,9 +122,9 @@ void JIT::emit_op_ret_object_or_this(Instruction* currentInstruction)
     unsigned thisReg = currentInstruction[2].u.operand;
 
     emitLoad(result, regT1, regT0);
-    Jump notJSCell = branch32(NotEqual, regT1, Imm32(JSValue::CellTag));
-    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), regT2);
-    Jump notObject = branch8(NotEqual, Address(regT2, OBJECT_OFFSETOF(Structure, m_typeInfo) + OBJECT_OFFSETOF(TypeInfo, m_type)), Imm32(ObjectType));
+    Jump notJSCell = branch32(NotEqual, regT1, TrustedImm32(JSValue::CellTag));
+    loadPtr(Address(regT0, JSCell::structureOffset()), regT2);
+    Jump notObject = branch8(NotEqual, Address(regT2, Structure::typeInfoTypeOffset()), TrustedImm32(ObjectType));
 
     emitGetFromCallFrameHeaderPtr(RegisterFile::ReturnPC, regT2);
     emitGetFromCallFrameHeaderPtr(RegisterFile::CallerFrame, callFrameRegister);
@@ -199,18 +200,19 @@ void JIT::compileOpCall(OpcodeID opcodeID, Instruction* instruction, unsigned)
         stubCall.addArgument(JIT::Imm32(registerOffset));
         stubCall.addArgument(JIT::Imm32(argCount));
         stubCall.call();
-        wasEval = branch32(NotEqual, regT1, Imm32(JSValue::EmptyValueTag));
+        wasEval = branch32(NotEqual, regT1, TrustedImm32(JSValue::EmptyValueTag));
     }
 
     emitLoad(callee, regT1, regT0);
 
     emitJumpSlowCaseIfNotJSCell(callee, regT1);
-    addSlowCase(branchPtr(NotEqual, Address(regT0), ImmPtr(m_globalData->jsFunctionVPtr)));
+    addSlowCase(branchPtr(NotEqual, Address(regT0), TrustedImmPtr(m_globalData->jsFunctionVPtr)));
 
     // Speculatively roll the callframe, assuming argCount will match the arity.
-    storePtr(callFrameRegister, Address(callFrameRegister, (RegisterFile::CallerFrame + registerOffset) * static_cast<int>(sizeof(Register))));
+    store32(TrustedImm32(JSValue::CellTag), tagFor(RegisterFile::CallerFrame + registerOffset, callFrameRegister));
+    storePtr(callFrameRegister, payloadFor(RegisterFile::CallerFrame + registerOffset, callFrameRegister));
     addPtr(Imm32(registerOffset * static_cast<int>(sizeof(Register))), callFrameRegister);
-    move(Imm32(argCount), regT1);
+    move(TrustedImm32(argCount), regT1);
 
     emitNakedCall(opcodeID == op_construct ? m_globalData->jitStubs->ctiVirtualConstruct() : m_globalData->jitStubs->ctiVirtualCall());
 
@@ -255,7 +257,7 @@ void JIT::compileOpCall(OpcodeID opcodeID, Instruction* instruction, unsigned ca
         stubCall.addArgument(JIT::Imm32(registerOffset));
         stubCall.addArgument(JIT::Imm32(argCount));
         stubCall.call();
-        wasEval = branch32(NotEqual, regT1, Imm32(JSValue::EmptyValueTag));
+        wasEval = branch32(NotEqual, regT1, TrustedImm32(JSValue::EmptyValueTag));
     }
 
     emitLoad(callee, regT1, regT0);
@@ -264,7 +266,7 @@ void JIT::compileOpCall(OpcodeID opcodeID, Instruction* instruction, unsigned ca
 
     BEGIN_UNINTERRUPTED_SEQUENCE(sequenceOpCall);
 
-    Jump jumpToSlow = branchPtrWithPatch(NotEqual, regT0, addressOfLinkedFunctionCheck, ImmPtr(0));
+    Jump jumpToSlow = branchPtrWithPatch(NotEqual, regT0, addressOfLinkedFunctionCheck, TrustedImmPtr(0));
 
     END_UNINTERRUPTED_SEQUENCE(sequenceOpCall);
 
@@ -272,7 +274,7 @@ void JIT::compileOpCall(OpcodeID opcodeID, Instruction* instruction, unsigned ca
     ASSERT_JIT_OFFSET(differenceBetween(addressOfLinkedFunctionCheck, jumpToSlow), patchOffsetOpCallCompareToJump);
     m_callStructureStubCompilationInfo[callLinkInfoIndex].hotPathBegin = addressOfLinkedFunctionCheck;
 
-    addSlowCase(branch32(NotEqual, regT1, Imm32(JSValue::CellTag)));
+    addSlowCase(branch32(NotEqual, regT1, TrustedImm32(JSValue::CellTag)));
 
     // The following is the fast case, only used whan a callee can be linked.
 
@@ -280,10 +282,12 @@ void JIT::compileOpCall(OpcodeID opcodeID, Instruction* instruction, unsigned ca
     // Note that this omits to set up RegisterFile::CodeBlock, which is set in the callee
     loadPtr(Address(regT0, OBJECT_OFFSETOF(JSFunction, m_scopeChain)), regT2);
 
-    store32(Imm32(argCount), Address(callFrameRegister, (registerOffset + RegisterFile::ArgumentCount) * static_cast<int>(sizeof(Register))));
-    storePtr(callFrameRegister, Address(callFrameRegister, (registerOffset + RegisterFile::CallerFrame) * static_cast<int>(sizeof(Register))));
+    store32(TrustedImm32(JSValue::Int32Tag), tagFor(registerOffset + RegisterFile::ArgumentCount));
+    store32(Imm32(argCount), payloadFor(registerOffset + RegisterFile::ArgumentCount));
+    storePtr(callFrameRegister, payloadFor(RegisterFile::CallerFrame + registerOffset, callFrameRegister));
     emitStore(registerOffset + RegisterFile::Callee, regT1, regT0);
-    storePtr(regT2, Address(callFrameRegister, (registerOffset + RegisterFile::ScopeChain) * static_cast<int>(sizeof(Register))));
+    store32(TrustedImm32(JSValue::CellTag), tagFor(registerOffset + RegisterFile::ScopeChain));
+    store32(regT2, payloadFor(registerOffset + RegisterFile::ScopeChain));
     addPtr(Imm32(registerOffset * sizeof(Register)), callFrameRegister);
 
     // Call to the callee
@@ -305,11 +309,12 @@ void JIT::compileOpCallSlowCase(Instruction* instruction, Vector<SlowCaseEntry>:
     linkSlowCase(iter);
 
     // Fast check for JS function.
-    Jump callLinkFailNotObject = branch32(NotEqual, regT1, Imm32(JSValue::CellTag));
-    Jump callLinkFailNotJSFunction = branchPtr(NotEqual, Address(regT0), ImmPtr(m_globalData->jsFunctionVPtr));
+    Jump callLinkFailNotObject = branch32(NotEqual, regT1, TrustedImm32(JSValue::CellTag));
+    Jump callLinkFailNotJSFunction = branchPtr(NotEqual, Address(regT0), TrustedImmPtr(m_globalData->jsFunctionVPtr));
 
     // Speculatively roll the callframe, assuming argCount will match the arity.
-    storePtr(callFrameRegister, Address(callFrameRegister, (RegisterFile::CallerFrame + registerOffset) * static_cast<int>(sizeof(Register))));
+    store32(TrustedImm32(JSValue::CellTag), tagFor(RegisterFile::CallerFrame + registerOffset, callFrameRegister));
+    storePtr(callFrameRegister, payloadFor(RegisterFile::CallerFrame + registerOffset, callFrameRegister));
     addPtr(Imm32(registerOffset * static_cast<int>(sizeof(Register))), callFrameRegister);
     move(Imm32(argCount), regT1);
 
diff --git a/Source/JavaScriptCore/jit/JITInlineMethods.h b/Source/JavaScriptCore/jit/JITInlineMethods.h
index 39ca4a5..16c2335 100644
--- a/Source/JavaScriptCore/jit/JITInlineMethods.h
+++ b/Source/JavaScriptCore/jit/JITInlineMethods.h
@@ -52,12 +52,26 @@ ALWAYS_INLINE JSValue JIT::getConstantOperand(unsigned src)
 
 ALWAYS_INLINE void JIT::emitPutToCallFrameHeader(RegisterID from, RegisterFile::CallFrameHeaderEntry entry)
 {
-    storePtr(from, Address(callFrameRegister, entry * sizeof(Register)));
+    storePtr(from, payloadFor(entry, callFrameRegister));
+}
+
+ALWAYS_INLINE void JIT::emitPutCellToCallFrameHeader(RegisterID from, RegisterFile::CallFrameHeaderEntry entry)
+{
+#if USE(JSVALUE32_64)
+    store32(TrustedImm32(JSValue::CellTag), tagFor(entry, callFrameRegister));
+#endif
+    storePtr(from, payloadFor(entry, callFrameRegister));
+}
+
+ALWAYS_INLINE void JIT::emitPutIntToCallFrameHeader(RegisterID from, RegisterFile::CallFrameHeaderEntry entry)
+{
+    store32(TrustedImm32(Int32Tag), intTagFor(entry, callFrameRegister));
+    store32(from, intPayloadFor(entry, callFrameRegister));
 }
 
 ALWAYS_INLINE void JIT::emitPutImmediateToCallFrameHeader(void* value, RegisterFile::CallFrameHeaderEntry entry)
 {
-    storePtr(ImmPtr(value), Address(callFrameRegister, entry * sizeof(Register)));
+    storePtr(TrustedImmPtr(value), Address(callFrameRegister, entry * sizeof(Register)));
 }
 
 ALWAYS_INLINE void JIT::emitGetFromCallFrameHeaderPtr(RegisterFile::CallFrameHeaderEntry entry, RegisterID to, RegisterID from)
@@ -70,9 +84,9 @@ ALWAYS_INLINE void JIT::emitGetFromCallFrameHeaderPtr(RegisterFile::CallFrameHea
 
 ALWAYS_INLINE void JIT::emitLoadCharacterString(RegisterID src, RegisterID dst, JumpList& failures)
 {
-    failures.append(branchPtr(NotEqual, Address(src), ImmPtr(m_globalData->jsStringVPtr)));
+    failures.append(branchPtr(NotEqual, Address(src), TrustedImmPtr(m_globalData->jsStringVPtr)));
     failures.append(branchTest32(NonZero, Address(src, OBJECT_OFFSETOF(JSString, m_fiberCount))));
-    failures.append(branch32(NotEqual, MacroAssembler::Address(src, ThunkHelpers::jsStringLengthOffset()), Imm32(1)));
+    failures.append(branch32(NotEqual, MacroAssembler::Address(src, ThunkHelpers::jsStringLengthOffset()), TrustedImm32(1)));
     loadPtr(MacroAssembler::Address(src, ThunkHelpers::jsStringValueOffset()), dst);
     loadPtr(MacroAssembler::Address(dst, ThunkHelpers::stringImplDataOffset()), dst);
     load16(MacroAssembler::Address(dst, 0), dst);
@@ -200,7 +214,7 @@ ALWAYS_INLINE void JIT::restoreArgumentReferenceForTrampoline()
 {
 #if CPU(X86)
     // Within a trampoline the return address will be on the stack at this point.
-    addPtr(Imm32(sizeof(void*)), stackPointerRegister, firstArgumentRegister);
+    addPtr(TrustedImm32(sizeof(void*)), stackPointerRegister, firstArgumentRegister);
 #elif CPU(ARM)
     move(stackPointerRegister, firstArgumentRegister);
 #endif
@@ -209,7 +223,7 @@ ALWAYS_INLINE void JIT::restoreArgumentReferenceForTrampoline()
 
 ALWAYS_INLINE JIT::Jump JIT::checkStructure(RegisterID reg, Structure* structure)
 {
-    return branchPtr(NotEqual, Address(reg, OBJECT_OFFSETOF(JSCell, m_structure)), ImmPtr(structure));
+    return branchPtr(NotEqual, Address(reg, JSCell::structureOffset()), TrustedImmPtr(structure));
 }
 
 ALWAYS_INLINE void JIT::linkSlowCaseIfNotJSCell(Vector<SlowCaseEntry>::iterator& iter, int vReg)
@@ -254,14 +268,14 @@ ALWAYS_INLINE void JIT::setSamplingFlag(int32_t flag)
 {
     ASSERT(flag >= 1);
     ASSERT(flag <= 32);
-    or32(Imm32(1u << (flag - 1)), AbsoluteAddress(&SamplingFlags::s_flags));
+    or32(TrustedImm32(1u << (flag - 1)), AbsoluteAddress(&SamplingFlags::s_flags));
 }
 
 ALWAYS_INLINE void JIT::clearSamplingFlag(int32_t flag)
 {
     ASSERT(flag >= 1);
     ASSERT(flag <= 32);
-    and32(Imm32(~(1u << (flag - 1))), AbsoluteAddress(&SamplingFlags::s_flags));
+    and32(TrustedImm32(~(1u << (flag - 1))), AbsoluteAddress(&SamplingFlags::s_flags));
 }
 #endif
 
@@ -269,11 +283,11 @@ ALWAYS_INLINE void JIT::clearSamplingFlag(int32_t flag)
 ALWAYS_INLINE void JIT::emitCount(AbstractSamplingCounter& counter, uint32_t count)
 {
 #if CPU(X86_64) // Or any other 64-bit plattform.
-    addPtr(Imm32(count), AbsoluteAddress(&counter.m_counter));
+    addPtr(TrustedImm32(count), AbsoluteAddress(counter.addressOfCounter()));
 #elif CPU(X86) // Or any other little-endian 32-bit plattform.
-    intptr_t hiWord = reinterpret_cast<intptr_t>(&counter.m_counter) + sizeof(int32_t);
-    add32(Imm32(count), AbsoluteAddress(&counter.m_counter));
-    addWithCarry32(Imm32(0), AbsoluteAddress(reinterpret_cast<void*>(hiWord)));
+    intptr_t hiWord = reinterpret_cast<intptr_t>(counter.addressOfCounter()) + sizeof(int32_t);
+    add32(TrustedImm32(count), AbsoluteAddress(counter.addressOfCounter()));
+    addWithCarry32(TrustedImm32(0), AbsoluteAddress(reinterpret_cast<void*>(hiWord)));
 #else
 #error "SAMPLING_FLAGS not implemented on this platform."
 #endif
@@ -284,13 +298,13 @@ ALWAYS_INLINE void JIT::emitCount(AbstractSamplingCounter& counter, uint32_t cou
 #if CPU(X86_64)
 ALWAYS_INLINE void JIT::sampleInstruction(Instruction* instruction, bool inHostFunction)
 {
-    move(ImmPtr(m_interpreter->sampler()->sampleSlot()), X86Registers::ecx);
-    storePtr(ImmPtr(m_interpreter->sampler()->encodeSample(instruction, inHostFunction)), X86Registers::ecx);
+    move(TrustedImmPtr(m_interpreter->sampler()->sampleSlot()), X86Registers::ecx);
+    storePtr(TrustedImmPtr(m_interpreter->sampler()->encodeSample(instruction, inHostFunction)), X86Registers::ecx);
 }
 #else
 ALWAYS_INLINE void JIT::sampleInstruction(Instruction* instruction, bool inHostFunction)
 {
-    storePtr(ImmPtr(m_interpreter->sampler()->encodeSample(instruction, inHostFunction)), m_interpreter->sampler()->sampleSlot());
+    storePtr(TrustedImmPtr(m_interpreter->sampler()->encodeSample(instruction, inHostFunction)), m_interpreter->sampler()->sampleSlot());
 }
 #endif
 #endif
@@ -299,13 +313,13 @@ ALWAYS_INLINE void JIT::sampleInstruction(Instruction* instruction, bool inHostF
 #if CPU(X86_64)
 ALWAYS_INLINE void JIT::sampleCodeBlock(CodeBlock* codeBlock)
 {
-    move(ImmPtr(m_interpreter->sampler()->codeBlockSlot()), X86Registers::ecx);
-    storePtr(ImmPtr(codeBlock), X86Registers::ecx);
+    move(TrustedImmPtr(m_interpreter->sampler()->codeBlockSlot()), X86Registers::ecx);
+    storePtr(TrustedImmPtr(codeBlock), X86Registers::ecx);
 }
 #else
 ALWAYS_INLINE void JIT::sampleCodeBlock(CodeBlock* codeBlock)
 {
-    storePtr(ImmPtr(codeBlock), m_interpreter->sampler()->codeBlockSlot());
+    storePtr(TrustedImmPtr(codeBlock), m_interpreter->sampler()->codeBlockSlot());
 }
 #endif
 #endif
@@ -396,7 +410,7 @@ inline void JIT::emitLoad2(unsigned index1, RegisterID tag1, RegisterID payload1
 inline void JIT::emitLoadDouble(unsigned index, FPRegisterID value)
 {
     if (m_codeBlock->isConstantRegisterIndex(index)) {
-        Register& inConstantPool = m_codeBlock->constantRegister(index);
+        WriteBarrier<Unknown>& inConstantPool = m_codeBlock->constantRegister(index);
         loadDouble(&inConstantPool, value);
     } else
         loadDouble(addressFor(index), value);
@@ -405,7 +419,7 @@ inline void JIT::emitLoadDouble(unsigned index, FPRegisterID value)
 inline void JIT::emitLoadInt32ToDouble(unsigned index, FPRegisterID value)
 {
     if (m_codeBlock->isConstantRegisterIndex(index)) {
-        Register& inConstantPool = m_codeBlock->constantRegister(index);
+        WriteBarrier<Unknown>& inConstantPool = m_codeBlock->constantRegister(index);
         char* bytePointer = reinterpret_cast<char*>(&inConstantPool);
         convertInt32ToDouble(AbsoluteAddress(bytePointer + OBJECT_OFFSETOF(JSValue, u.asBits.payload)), value);
     } else
@@ -422,27 +436,27 @@ inline void JIT::emitStoreInt32(unsigned index, RegisterID payload, bool indexIs
 {
     store32(payload, payloadFor(index, callFrameRegister));
     if (!indexIsInt32)
-        store32(Imm32(JSValue::Int32Tag), tagFor(index, callFrameRegister));
+        store32(TrustedImm32(JSValue::Int32Tag), tagFor(index, callFrameRegister));
 }
 
-inline void JIT::emitStoreInt32(unsigned index, Imm32 payload, bool indexIsInt32)
+inline void JIT::emitStoreInt32(unsigned index, TrustedImm32 payload, bool indexIsInt32)
 {
     store32(payload, payloadFor(index, callFrameRegister));
     if (!indexIsInt32)
-        store32(Imm32(JSValue::Int32Tag), tagFor(index, callFrameRegister));
+        store32(TrustedImm32(JSValue::Int32Tag), tagFor(index, callFrameRegister));
 }
 
 inline void JIT::emitStoreCell(unsigned index, RegisterID payload, bool indexIsCell)
 {
     store32(payload, payloadFor(index, callFrameRegister));
     if (!indexIsCell)
-        store32(Imm32(JSValue::CellTag), tagFor(index, callFrameRegister));
+        store32(TrustedImm32(JSValue::CellTag), tagFor(index, callFrameRegister));
 }
 
 inline void JIT::emitStoreBool(unsigned index, RegisterID tag, bool indexIsBool)
 {
     if (!indexIsBool)
-        store32(Imm32(0), payloadFor(index, callFrameRegister));
+        store32(TrustedImm32(0), payloadFor(index, callFrameRegister));
     store32(tag, tagFor(index, callFrameRegister));
 }
 
@@ -550,7 +564,7 @@ inline void JIT::emitJumpSlowCaseIfNotJSCell(unsigned virtualRegisterIndex, Regi
         if (m_codeBlock->isConstantRegisterIndex(virtualRegisterIndex))
             addSlowCase(jump());
         else
-            addSlowCase(branch32(NotEqual, tag, Imm32(JSValue::CellTag)));
+            addSlowCase(branch32(NotEqual, tag, TrustedImm32(JSValue::CellTag)));
     }
 }
 
@@ -652,7 +666,7 @@ ALWAYS_INLINE void JIT::emitPutVirtualRegister(unsigned dst, RegisterID from)
 
 ALWAYS_INLINE void JIT::emitInitRegister(unsigned dst)
 {
-    storePtr(ImmPtr(JSValue::encode(jsUndefined())), Address(callFrameRegister, dst * sizeof(Register)));
+    storePtr(TrustedImmPtr(JSValue::encode(jsUndefined())), Address(callFrameRegister, dst * sizeof(Register)));
 }
 
 ALWAYS_INLINE JIT::Jump JIT::emitJumpIfJSCell(RegisterID reg)
@@ -660,7 +674,7 @@ ALWAYS_INLINE JIT::Jump JIT::emitJumpIfJSCell(RegisterID reg)
 #if USE(JSVALUE64)
     return branchTestPtr(Zero, reg, tagMaskRegister);
 #else
-    return branchTest32(Zero, reg, Imm32(JSImmediate::TagMask));
+    return branchTest32(Zero, reg, TrustedImm32(JSImmediate::TagMask));
 #endif
 }
 
@@ -681,7 +695,7 @@ ALWAYS_INLINE JIT::Jump JIT::emitJumpIfNotJSCell(RegisterID reg)
 #if USE(JSVALUE64)
     return branchTestPtr(NonZero, reg, tagMaskRegister);
 #else
-    return branchTest32(NonZero, reg, Imm32(JSImmediate::TagMask));
+    return branchTest32(NonZero, reg, TrustedImm32(JSImmediate::TagMask));
 #endif
 }
 
@@ -701,7 +715,7 @@ ALWAYS_INLINE void JIT::emitJumpSlowCaseIfNotJSCell(RegisterID reg, int vReg)
 inline void JIT::emitLoadDouble(unsigned index, FPRegisterID value)
 {
     if (m_codeBlock->isConstantRegisterIndex(index)) {
-        Register& inConstantPool = m_codeBlock->constantRegister(index);
+        WriteBarrier<Unknown>& inConstantPool = m_codeBlock->constantRegister(index);
         loadDouble(&inConstantPool, value);
     } else
         loadDouble(addressFor(index), value);
@@ -710,8 +724,8 @@ inline void JIT::emitLoadDouble(unsigned index, FPRegisterID value)
 inline void JIT::emitLoadInt32ToDouble(unsigned index, FPRegisterID value)
 {
     if (m_codeBlock->isConstantRegisterIndex(index)) {
-        Register& inConstantPool = m_codeBlock->constantRegister(index);
-        convertInt32ToDouble(AbsoluteAddress(&inConstantPool), value);
+        ASSERT(isOperandConstantImmediateInt(index));
+        convertInt32ToDouble(Imm32(getConstantOperand(index).asInt32()), value);
     } else
         convertInt32ToDouble(addressFor(index), value);
 }
@@ -722,7 +736,7 @@ ALWAYS_INLINE JIT::Jump JIT::emitJumpIfImmediateInteger(RegisterID reg)
 #if USE(JSVALUE64)
     return branchPtr(AboveOrEqual, reg, tagTypeNumberRegister);
 #else
-    return branchTest32(NonZero, reg, Imm32(JSImmediate::TagTypeNumber));
+    return branchTest32(NonZero, reg, TrustedImm32(JSImmediate::TagTypeNumber));
 #endif
 }
 
@@ -731,7 +745,7 @@ ALWAYS_INLINE JIT::Jump JIT::emitJumpIfNotImmediateInteger(RegisterID reg)
 #if USE(JSVALUE64)
     return branchPtr(Below, reg, tagTypeNumberRegister);
 #else
-    return branchTest32(Zero, reg, Imm32(JSImmediate::TagTypeNumber));
+    return branchTest32(Zero, reg, TrustedImm32(JSImmediate::TagTypeNumber));
 #endif
 }
 
@@ -760,12 +774,12 @@ ALWAYS_INLINE void JIT::emitJumpSlowCaseIfNotImmediateNumber(RegisterID reg)
 #if USE(JSVALUE32_64)
 ALWAYS_INLINE void JIT::emitFastArithDeTagImmediate(RegisterID reg)
 {
-    subPtr(Imm32(JSImmediate::TagTypeNumber), reg);
+    subPtr(TrustedImm32(JSImmediate::TagTypeNumber), reg);
 }
 
 ALWAYS_INLINE JIT::Jump JIT::emitFastArithDeTagImmediateJumpIfZero(RegisterID reg)
 {
-    return branchSubPtr(Zero, Imm32(JSImmediate::TagTypeNumber), reg);
+    return branchSubPtr(Zero, TrustedImm32(JSImmediate::TagTypeNumber), reg);
 }
 #endif
 
@@ -776,7 +790,7 @@ ALWAYS_INLINE void JIT::emitFastArithReTagImmediate(RegisterID src, RegisterID d
 #else
     if (src != dest)
         move(src, dest);
-    addPtr(Imm32(JSImmediate::TagTypeNumber), dest);
+    addPtr(TrustedImm32(JSImmediate::TagTypeNumber), dest);
 #endif
 }
 
@@ -796,8 +810,8 @@ ALWAYS_INLINE void JIT::emitFastArithIntToImmNoCheck(RegisterID src, RegisterID
 
 ALWAYS_INLINE void JIT::emitTagAsBoolImmediate(RegisterID reg)
 {
-    lshift32(Imm32(JSImmediate::ExtendedPayloadShift), reg);
-    or32(Imm32(static_cast<int32_t>(JSImmediate::FullTagTypeBool)), reg);
+    lshift32(TrustedImm32(JSImmediate::ExtendedPayloadShift), reg);
+    or32(TrustedImm32(static_cast<int32_t>(JSImmediate::FullTagTypeBool)), reg);
 }
 
 #endif // USE(JSVALUE32_64)
diff --git a/Source/JavaScriptCore/jit/JITOpcodes.cpp b/Source/JavaScriptCore/jit/JITOpcodes.cpp
index fc769db..daceea6 100644
--- a/Source/JavaScriptCore/jit/JITOpcodes.cpp
+++ b/Source/JavaScriptCore/jit/JITOpcodes.cpp
@@ -52,12 +52,12 @@ void JIT::privateCompileCTIMachineTrampolines(RefPtr<ExecutablePool>* executable
 
     // Check eax is a string
     Jump string_failureCases1 = emitJumpIfNotJSCell(regT0);
-    Jump string_failureCases2 = branchPtr(NotEqual, Address(regT0), ImmPtr(m_globalData->jsStringVPtr));
+    Jump string_failureCases2 = branchPtr(NotEqual, Address(regT0), TrustedImmPtr(m_globalData->jsStringVPtr));
 
     // Checks out okay! - get the length from the Ustring.
     load32(Address(regT0, OBJECT_OFFSETOF(JSString, m_length)), regT0);
 
-    Jump string_failureCases3 = branch32(Above, regT0, Imm32(JSImmediate::maxImmediateInt));
+    Jump string_failureCases3 = branch32(Above, regT0, TrustedImm32(JSImmediate::maxImmediateInt));
 
     // regT0 contains a 64 bit value (is positive, is zero extended) so we don't need sign extend here.
     emitFastArithIntToImmNoCheck(regT0, regT0);
@@ -102,7 +102,7 @@ void JIT::privateCompileCTIMachineTrampolines(RefPtr<ExecutablePool>* executable
 
     loadPtr(Address(regT0, OBJECT_OFFSETOF(JSFunction, m_executable)), regT2);
 
-    Jump hasCodeBlock3 = branch32(GreaterThanOrEqual, Address(regT2, OBJECT_OFFSETOF(FunctionExecutable, m_numParametersForCall)), Imm32(0));
+    Jump hasCodeBlock3 = branch32(GreaterThanOrEqual, Address(regT2, OBJECT_OFFSETOF(FunctionExecutable, m_numParametersForCall)), TrustedImm32(0));
     preserveReturnAddressAfterCall(regT3);
     restoreArgumentReference();
     Call callCompileCall = call();
@@ -122,7 +122,7 @@ void JIT::privateCompileCTIMachineTrampolines(RefPtr<ExecutablePool>* executable
 
     loadPtr(Address(regT0, OBJECT_OFFSETOF(JSFunction, m_executable)), regT2);
 
-    Jump hasCodeBlock4 = branch32(GreaterThanOrEqual, Address(regT2, OBJECT_OFFSETOF(FunctionExecutable, m_numParametersForConstruct)), Imm32(0));
+    Jump hasCodeBlock4 = branch32(GreaterThanOrEqual, Address(regT2, OBJECT_OFFSETOF(FunctionExecutable, m_numParametersForConstruct)), TrustedImm32(0));
     preserveReturnAddressAfterCall(regT3);
     restoreArgumentReference();
     Call callCompileConstruct = call();
@@ -141,10 +141,10 @@ void JIT::privateCompileCTIMachineTrampolines(RefPtr<ExecutablePool>* executable
     emitGetFromCallFrameHeaderPtr(RegisterFile::ReturnPC, regT1);
     emitGetFromCallFrameHeaderPtr(RegisterFile::CallerFrame, callFrameRegister);
     restoreReturnAddressBeforeReturn(regT1);
-    move(ImmPtr(&globalData->exceptionLocation), regT2);
+    move(TrustedImmPtr(&globalData->exceptionLocation), regT2);
     storePtr(regT1, regT2);
     poke(callFrameRegister, 1 + OBJECT_OFFSETOF(struct JITStackFrame, callFrame) / sizeof(void*));
-    poke(ImmPtr(FunctionPtr(ctiVMThrowTrampoline).value()));
+    poke(TrustedImmPtr(FunctionPtr(ctiVMThrowTrampoline).value()));
     ret();
 
     // NativeCall Trampoline
@@ -199,7 +199,7 @@ JIT::Label JIT::privateCompileCTINativeCall(JSGlobalData* globalData, bool isCon
     // get to its global data.
     emitGetFromCallFrameHeaderPtr(RegisterFile::CallerFrame, regT0);
     emitGetFromCallFrameHeaderPtr(RegisterFile::ScopeChain, regT1, regT0);
-    emitPutToCallFrameHeader(regT1, RegisterFile::ScopeChain);
+    emitPutCellToCallFrameHeader(regT1, RegisterFile::ScopeChain);
 
     peek(regT1);
     emitPutToCallFrameHeader(regT1, RegisterFile::ReturnPC);
@@ -208,21 +208,21 @@ JIT::Label JIT::privateCompileCTINativeCall(JSGlobalData* globalData, bool isCon
     // Host function signature: f(ExecState*);
     move(callFrameRegister, X86Registers::edi);
 
-    subPtr(Imm32(16 - sizeof(void*)), stackPointerRegister); // Align stack after call.
+    subPtr(TrustedImm32(16 - sizeof(void*)), stackPointerRegister); // Align stack after call.
 
     emitGetFromCallFrameHeaderPtr(RegisterFile::Callee, X86Registers::esi);
     loadPtr(Address(X86Registers::esi, OBJECT_OFFSETOF(JSFunction, m_executable)), X86Registers::r9);
     move(regT0, callFrameRegister); // Eagerly restore caller frame register to avoid loading from stack.
     call(Address(X86Registers::r9, executableOffsetToFunction));
 
-    addPtr(Imm32(16 - sizeof(void*)), stackPointerRegister);
+    addPtr(TrustedImm32(16 - sizeof(void*)), stackPointerRegister);
 
 #elif CPU(ARM)
     // Load caller frame's scope chain into this callframe so that whatever we call can
     // get to its global data.
     emitGetFromCallFrameHeaderPtr(RegisterFile::CallerFrame, regT2);
     emitGetFromCallFrameHeaderPtr(RegisterFile::ScopeChain, regT1, regT2);
-    emitPutToCallFrameHeader(regT1, RegisterFile::ScopeChain);
+    emitPutCellToCallFrameHeader(regT1, RegisterFile::ScopeChain);
 
     preserveReturnAddressAfterCall(regT3); // Callee preserved
     emitPutToCallFrameHeader(regT3, RegisterFile::ReturnPC);
@@ -243,7 +243,7 @@ JIT::Label JIT::privateCompileCTINativeCall(JSGlobalData* globalData, bool isCon
     // get to its global data.
     emitGetFromCallFrameHeaderPtr(RegisterFile::CallerFrame, regT0);
     emitGetFromCallFrameHeaderPtr(RegisterFile::ScopeChain, regT1, regT0);
-    emitPutToCallFrameHeader(regT1, RegisterFile::ScopeChain);
+    emitPutCellToCallFrameHeader(regT1, RegisterFile::ScopeChain);
 
     preserveReturnAddressAfterCall(regT3); // Callee preserved
     emitPutToCallFrameHeader(regT3, RegisterFile::ReturnPC);
@@ -253,7 +253,7 @@ JIT::Label JIT::privateCompileCTINativeCall(JSGlobalData* globalData, bool isCon
 
     // Allocate stack space for 16 bytes (8-byte aligned)
     // 16 bytes (unused) for 4 arguments
-    subPtr(Imm32(16), stackPointerRegister);
+    subPtr(TrustedImm32(16), stackPointerRegister);
 
     // Setup arg0
     move(callFrameRegister, MIPSRegisters::a0);
@@ -265,7 +265,7 @@ JIT::Label JIT::privateCompileCTINativeCall(JSGlobalData* globalData, bool isCon
     call(Address(regT2, executableOffsetToFunction));
 
     // Restore stack space
-    addPtr(Imm32(16), stackPointerRegister);
+    addPtr(TrustedImm32(16), stackPointerRegister);
 
     restoreReturnAddressBeforeReturn(regT3);
 
@@ -289,12 +289,12 @@ JIT::Label JIT::privateCompileCTINativeCall(JSGlobalData* globalData, bool isCon
     // Grab the return address.
     preserveReturnAddressAfterCall(regT1);
 
-    move(ImmPtr(&globalData->exceptionLocation), regT2);
+    move(TrustedImmPtr(&globalData->exceptionLocation), regT2);
     storePtr(regT1, regT2);
     poke(callFrameRegister, OBJECT_OFFSETOF(struct JITStackFrame, callFrame) / sizeof(void*));
 
     // Set the return address.
-    move(ImmPtr(FunctionPtr(ctiVMThrowTrampoline).value()), regT1);
+    move(TrustedImmPtr(FunctionPtr(ctiVMThrowTrampoline).value()), regT1);
     restoreReturnAddressBeforeReturn(regT1);
 
     ret();
@@ -378,8 +378,8 @@ void JIT::emit_op_check_has_instance(Instruction* currentInstruction)
     emitJumpSlowCaseIfNotJSCell(regT0, baseVal);
 
     // Check that baseVal 'ImplementsHasInstance'.
-    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), regT0);
-    addSlowCase(branchTest8(Zero, Address(regT0, OBJECT_OFFSETOF(Structure, m_typeInfo.m_flags)), Imm32(ImplementsHasInstance)));
+    loadPtr(Address(regT0, JSCell::structureOffset()), regT0);
+    addSlowCase(branchTest8(Zero, Address(regT0, Structure::typeInfoFlagsOffset()), TrustedImm32(ImplementsHasInstance)));
 }
 
 void JIT::emit_op_instanceof(Instruction* currentInstruction)
@@ -400,29 +400,29 @@ void JIT::emit_op_instanceof(Instruction* currentInstruction)
     emitJumpSlowCaseIfNotJSCell(regT1, proto);
 
     // Check that prototype is an object
-    loadPtr(Address(regT1, OBJECT_OFFSETOF(JSCell, m_structure)), regT3);
-    addSlowCase(branch8(NotEqual, Address(regT3, OBJECT_OFFSETOF(Structure, m_typeInfo.m_type)), Imm32(ObjectType)));
+    loadPtr(Address(regT1, JSCell::structureOffset()), regT3);
+    addSlowCase(branch8(NotEqual, Address(regT3, Structure::typeInfoTypeOffset()), TrustedImm32(ObjectType)));
     
     // Fixme: this check is only needed because the JSC API allows HasInstance to be overridden; we should deprecate this.
     // Check that baseVal 'ImplementsDefaultHasInstance'.
-    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), regT0);
-    addSlowCase(branchTest8(Zero, Address(regT0, OBJECT_OFFSETOF(Structure, m_typeInfo.m_flags)), Imm32(ImplementsDefaultHasInstance)));
+    loadPtr(Address(regT0, JSCell::structureOffset()), regT0);
+    addSlowCase(branchTest8(Zero, Address(regT0, Structure::typeInfoFlagsOffset()), TrustedImm32(ImplementsDefaultHasInstance)));
 
     // Optimistically load the result true, and start looping.
     // Initially, regT1 still contains proto and regT2 still contains value.
     // As we loop regT2 will be updated with its prototype, recursively walking the prototype chain.
-    move(ImmPtr(JSValue::encode(jsBoolean(true))), regT0);
+    move(TrustedImmPtr(JSValue::encode(jsBoolean(true))), regT0);
     Label loop(this);
 
     // Load the prototype of the object in regT2.  If this is equal to regT1 - WIN!
     // Otherwise, check if we've hit null - if we have then drop out of the loop, if not go again.
-    loadPtr(Address(regT2, OBJECT_OFFSETOF(JSCell, m_structure)), regT2);
-    loadPtr(Address(regT2, OBJECT_OFFSETOF(Structure, m_prototype)), regT2);
+    loadPtr(Address(regT2, JSCell::structureOffset()), regT2);
+    loadPtr(Address(regT2, Structure::prototypeOffset()), regT2);
     Jump isInstance = branchPtr(Equal, regT2, regT1);
     emitJumpIfJSCell(regT2).linkTo(loop, this);
 
     // We get here either by dropping out of the loop, or if value was not an Object.  Result is false.
-    move(ImmPtr(JSValue::encode(jsBoolean(false))), regT0);
+    move(TrustedImmPtr(JSValue::encode(jsBoolean(false))), regT0);
 
     // isInstance jumps right down to here, to skip setting the result to false (it has already set true).
     isInstance.link(this);
@@ -452,7 +452,7 @@ void JIT::emit_op_construct(Instruction* currentInstruction)
 void JIT::emit_op_get_global_var(Instruction* currentInstruction)
 {
     JSVariableObject* globalObject = m_codeBlock->globalObject();
-    loadPtr(&globalObject->d->registers, regT0);
+    loadPtr(&globalObject->m_registers, regT0);
     loadPtr(Address(regT0, currentInstruction[2].u.operand * sizeof(Register)), regT0);
     emitPutVirtualRegister(currentInstruction[1].u.operand);
 }
@@ -461,7 +461,7 @@ void JIT::emit_op_put_global_var(Instruction* currentInstruction)
 {
     emitGetVirtualRegister(currentInstruction[2].u.operand, regT1);
     JSVariableObject* globalObject = m_codeBlock->globalObject();
-    loadPtr(&globalObject->d->registers, regT0);
+    loadPtr(&globalObject->m_registers, regT0);
     storePtr(regT1, Address(regT0, currentInstruction[1].u.operand * sizeof(Register)));
 }
 
@@ -483,8 +483,7 @@ void JIT::emit_op_get_scoped_var(Instruction* currentInstruction)
         loadPtr(Address(regT0, OBJECT_OFFSETOF(ScopeChainNode, next)), regT0);
 
     loadPtr(Address(regT0, OBJECT_OFFSETOF(ScopeChainNode, object)), regT0);
-    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSVariableObject, d)), regT0);
-    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSVariableObject::JSVariableObjectData, registers)), regT0);
+    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSVariableObject, m_registers)), regT0);
     loadPtr(Address(regT0, currentInstruction[2].u.operand * sizeof(Register)), regT0);
     emitPutVirtualRegister(currentInstruction[1].u.operand);
 }
@@ -508,8 +507,7 @@ void JIT::emit_op_put_scoped_var(Instruction* currentInstruction)
         loadPtr(Address(regT1, OBJECT_OFFSETOF(ScopeChainNode, next)), regT1);
 
     loadPtr(Address(regT1, OBJECT_OFFSETOF(ScopeChainNode, object)), regT1);
-    loadPtr(Address(regT1, OBJECT_OFFSETOF(JSVariableObject, d)), regT1);
-    loadPtr(Address(regT1, OBJECT_OFFSETOF(JSVariableObject::JSVariableObjectData, registers)), regT1);
+    loadPtr(Address(regT1, OBJECT_OFFSETOF(JSVariableObject, m_registers)), regT1);
     storePtr(regT0, Address(regT1, currentInstruction[1].u.operand * sizeof(Register)));
 }
 
@@ -567,8 +565,8 @@ void JIT::emit_op_ret_object_or_this(Instruction* currentInstruction)
     // Return the result in %eax.
     emitGetVirtualRegister(currentInstruction[1].u.operand, returnValueRegister);
     Jump notJSCell = emitJumpIfNotJSCell(returnValueRegister);
-    loadPtr(Address(returnValueRegister, OBJECT_OFFSETOF(JSCell, m_structure)), regT2);
-    Jump notObject = branch8(NotEqual, Address(regT2, OBJECT_OFFSETOF(Structure, m_typeInfo) + OBJECT_OFFSETOF(TypeInfo, m_type)), Imm32(ObjectType));
+    loadPtr(Address(returnValueRegister, JSCell::structureOffset()), regT2);
+    Jump notObject = branch8(NotEqual, Address(regT2, Structure::typeInfoTypeOffset()), TrustedImm32(ObjectType));
 
     // Grab the return address.
     emitGetFromCallFrameHeaderPtr(RegisterFile::ReturnPC, regT1);
@@ -607,7 +605,7 @@ void JIT::emit_op_new_array(Instruction* currentInstruction)
 void JIT::emit_op_resolve(Instruction* currentInstruction)
 {
     JITStubCall stubCall(this, cti_op_resolve);
-    stubCall.addArgument(ImmPtr(&m_codeBlock->identifier(currentInstruction[2].u.operand)));
+    stubCall.addArgument(TrustedImmPtr(&m_codeBlock->identifier(currentInstruction[2].u.operand)));
     stubCall.call(currentInstruction[1].u.operand);
 }
 
@@ -619,7 +617,7 @@ void JIT::emit_op_to_primitive(Instruction* currentInstruction)
     emitGetVirtualRegister(src, regT0);
     
     Jump isImm = emitJumpIfNotJSCell(regT0);
-    addSlowCase(branchPtr(NotEqual, Address(regT0), ImmPtr(m_globalData->jsStringVPtr)));
+    addSlowCase(branchPtr(NotEqual, Address(regT0), TrustedImmPtr(m_globalData->jsStringVPtr)));
     isImm.link(this);
 
     if (dst != src)
@@ -638,7 +636,7 @@ void JIT::emit_op_strcat(Instruction* currentInstruction)
 void JIT::emit_op_resolve_base(Instruction* currentInstruction)
 {
     JITStubCall stubCall(this, currentInstruction[3].u.operand ? cti_op_resolve_base_strict_put : cti_op_resolve_base);
-    stubCall.addArgument(ImmPtr(&m_codeBlock->identifier(currentInstruction[2].u.operand)));
+    stubCall.addArgument(TrustedImmPtr(&m_codeBlock->identifier(currentInstruction[2].u.operand)));
     stubCall.call(currentInstruction[1].u.operand);
 }
 
@@ -646,14 +644,14 @@ void JIT::emit_op_ensure_property_exists(Instruction* currentInstruction)
 {
     JITStubCall stubCall(this, cti_op_ensure_property_exists);
     stubCall.addArgument(Imm32(currentInstruction[1].u.operand));
-    stubCall.addArgument(ImmPtr(&m_codeBlock->identifier(currentInstruction[2].u.operand)));
+    stubCall.addArgument(TrustedImmPtr(&m_codeBlock->identifier(currentInstruction[2].u.operand)));
     stubCall.call(currentInstruction[1].u.operand);
 }
 
 void JIT::emit_op_resolve_skip(Instruction* currentInstruction)
 {
     JITStubCall stubCall(this, cti_op_resolve_skip);
-    stubCall.addArgument(ImmPtr(&m_codeBlock->identifier(currentInstruction[2].u.operand)));
+    stubCall.addArgument(TrustedImmPtr(&m_codeBlock->identifier(currentInstruction[2].u.operand)));
     stubCall.addArgument(Imm32(currentInstruction[3].u.operand));
     stubCall.call(currentInstruction[1].u.operand);
 }
@@ -667,9 +665,9 @@ void JIT::emit_op_resolve_global(Instruction* currentInstruction, bool)
     void* offsetAddr = &(m_codeBlock->globalResolveInfo(currentIndex).offset);
 
     // Check Structure of global object
-    move(ImmPtr(globalObject), regT0);
+    move(TrustedImmPtr(globalObject), regT0);
     loadPtr(structureAddress, regT1);
-    addSlowCase(branchPtr(NotEqual, regT1, Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)))); // Structures don't match
+    addSlowCase(branchPtr(NotEqual, regT1, Address(regT0, JSCell::structureOffset()))); // Structures don't match
 
     // Load cached property
     // Assume that the global object always uses external storage.
@@ -688,7 +686,7 @@ void JIT::emitSlow_op_resolve_global(Instruction* currentInstruction, Vector<Slo
     
     linkSlowCase(iter);
     JITStubCall stubCall(this, cti_op_resolve_global);
-    stubCall.addArgument(ImmPtr(ident));
+    stubCall.addArgument(TrustedImmPtr(ident));
     stubCall.addArgument(Imm32(currentIndex));
     stubCall.addArgument(regT0);
     stubCall.call(dst);
@@ -697,9 +695,9 @@ void JIT::emitSlow_op_resolve_global(Instruction* currentInstruction, Vector<Slo
 void JIT::emit_op_not(Instruction* currentInstruction)
 {
     emitGetVirtualRegister(currentInstruction[2].u.operand, regT0);
-    xorPtr(Imm32(static_cast<int32_t>(JSImmediate::FullTagTypeBool)), regT0);
-    addSlowCase(branchTestPtr(NonZero, regT0, Imm32(static_cast<int32_t>(~JSImmediate::ExtendedPayloadBitBoolValue))));
-    xorPtr(Imm32(static_cast<int32_t>(JSImmediate::FullTagTypeBool | JSImmediate::ExtendedPayloadBitBoolValue)), regT0);
+    xorPtr(TrustedImm32(static_cast<int32_t>(JSImmediate::FullTagTypeBool)), regT0);
+    addSlowCase(branchTestPtr(NonZero, regT0, TrustedImm32(static_cast<int32_t>(~JSImmediate::ExtendedPayloadBitBoolValue))));
+    xorPtr(TrustedImm32(static_cast<int32_t>(JSImmediate::FullTagTypeBool | JSImmediate::ExtendedPayloadBitBoolValue)), regT0);
     emitPutVirtualRegister(currentInstruction[1].u.operand);
 }
 
@@ -708,11 +706,11 @@ void JIT::emit_op_jfalse(Instruction* currentInstruction)
     unsigned target = currentInstruction[2].u.operand;
     emitGetVirtualRegister(currentInstruction[1].u.operand, regT0);
 
-    addJump(branchPtr(Equal, regT0, ImmPtr(JSValue::encode(jsNumber(0)))), target);
+    addJump(branchPtr(Equal, regT0, TrustedImmPtr(JSValue::encode(jsNumber(0)))), target);
     Jump isNonZero = emitJumpIfImmediateInteger(regT0);
 
-    addJump(branchPtr(Equal, regT0, ImmPtr(JSValue::encode(jsBoolean(false)))), target);
-    addSlowCase(branchPtr(NotEqual, regT0, ImmPtr(JSValue::encode(jsBoolean(true)))));
+    addJump(branchPtr(Equal, regT0, TrustedImmPtr(JSValue::encode(jsBoolean(false)))), target);
+    addSlowCase(branchPtr(NotEqual, regT0, TrustedImmPtr(JSValue::encode(jsBoolean(true)))));
 
     isNonZero.link(this);
     RECORD_JUMP_TARGET(target);
@@ -727,14 +725,14 @@ void JIT::emit_op_jeq_null(Instruction* currentInstruction)
     Jump isImmediate = emitJumpIfNotJSCell(regT0);
 
     // First, handle JSCell cases - check MasqueradesAsUndefined bit on the structure.
-    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), regT2);
-    addJump(branchTest8(NonZero, Address(regT2, OBJECT_OFFSETOF(Structure, m_typeInfo.m_flags)), Imm32(MasqueradesAsUndefined)), target);
+    loadPtr(Address(regT0, JSCell::structureOffset()), regT2);
+    addJump(branchTest8(NonZero, Address(regT2, Structure::typeInfoFlagsOffset()), TrustedImm32(MasqueradesAsUndefined)), target);
     Jump wasNotImmediate = jump();
 
     // Now handle the immediate cases - undefined & null
     isImmediate.link(this);
-    andPtr(Imm32(~JSImmediate::ExtendedTagBitUndefined), regT0);
-    addJump(branchPtr(Equal, regT0, ImmPtr(JSValue::encode(jsNull()))), target);            
+    andPtr(TrustedImm32(~JSImmediate::ExtendedTagBitUndefined), regT0);
+    addJump(branchPtr(Equal, regT0, TrustedImmPtr(JSValue::encode(jsNull()))), target);            
 
     wasNotImmediate.link(this);
     RECORD_JUMP_TARGET(target);
@@ -748,14 +746,14 @@ void JIT::emit_op_jneq_null(Instruction* currentInstruction)
     Jump isImmediate = emitJumpIfNotJSCell(regT0);
 
     // First, handle JSCell cases - check MasqueradesAsUndefined bit on the structure.
-    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), regT2);
-    addJump(branchTest8(Zero, Address(regT2, OBJECT_OFFSETOF(Structure, m_typeInfo.m_flags)), Imm32(MasqueradesAsUndefined)), target);
+    loadPtr(Address(regT0, JSCell::structureOffset()), regT2);
+    addJump(branchTest8(Zero, Address(regT2, Structure::typeInfoFlagsOffset()), TrustedImm32(MasqueradesAsUndefined)), target);
     Jump wasNotImmediate = jump();
 
     // Now handle the immediate cases - undefined & null
     isImmediate.link(this);
-    andPtr(Imm32(~JSImmediate::ExtendedTagBitUndefined), regT0);
-    addJump(branchPtr(NotEqual, regT0, ImmPtr(JSValue::encode(jsNull()))), target);            
+    andPtr(TrustedImm32(~JSImmediate::ExtendedTagBitUndefined), regT0);
+    addJump(branchPtr(NotEqual, regT0, TrustedImmPtr(JSValue::encode(jsNull()))), target);            
 
     wasNotImmediate.link(this);
     RECORD_JUMP_TARGET(target);
@@ -764,11 +762,11 @@ void JIT::emit_op_jneq_null(Instruction* currentInstruction)
 void JIT::emit_op_jneq_ptr(Instruction* currentInstruction)
 {
     unsigned src = currentInstruction[1].u.operand;
-    JSCell* ptr = currentInstruction[2].u.jsCell;
+    JSCell* ptr = currentInstruction[2].u.jsCell.get();
     unsigned target = currentInstruction[3].u.operand;
     
     emitGetVirtualRegister(src, regT0);
-    addJump(branchPtr(NotEqual, regT0, ImmPtr(JSValue::encode(JSValue(ptr)))), target);            
+    addJump(branchPtr(NotEqual, regT0, TrustedImmPtr(JSValue::encode(JSValue(ptr)))), target);            
 
     RECORD_JUMP_TARGET(target);
 }
@@ -777,7 +775,7 @@ void JIT::emit_op_jsr(Instruction* currentInstruction)
 {
     int retAddrDst = currentInstruction[1].u.operand;
     int target = currentInstruction[2].u.operand;
-    DataLabelPtr storeLocation = storePtrWithPatch(ImmPtr(0), Address(callFrameRegister, sizeof(Register) * retAddrDst));
+    DataLabelPtr storeLocation = storePtrWithPatch(TrustedImmPtr(0), Address(callFrameRegister, sizeof(Register) * retAddrDst));
     addJump(jump(), target);
     m_jsrSites.append(JSRInfo(storeLocation, label()));
     killLastResultRegister();
@@ -811,7 +809,7 @@ void JIT::emit_op_bitnot(Instruction* currentInstruction)
 void JIT::emit_op_resolve_with_base(Instruction* currentInstruction)
 {
     JITStubCall stubCall(this, cti_op_resolve_with_base);
-    stubCall.addArgument(ImmPtr(&m_codeBlock->identifier(currentInstruction[3].u.operand)));
+    stubCall.addArgument(TrustedImmPtr(&m_codeBlock->identifier(currentInstruction[3].u.operand)));
     stubCall.addArgument(Imm32(currentInstruction[1].u.operand));
     stubCall.call(currentInstruction[2].u.operand);
 }
@@ -819,7 +817,7 @@ void JIT::emit_op_resolve_with_base(Instruction* currentInstruction)
 void JIT::emit_op_new_func_exp(Instruction* currentInstruction)
 {
     JITStubCall stubCall(this, cti_op_new_func_exp);
-    stubCall.addArgument(ImmPtr(m_codeBlock->functionExpr(currentInstruction[2].u.operand)));
+    stubCall.addArgument(TrustedImmPtr(m_codeBlock->functionExpr(currentInstruction[2].u.operand)));
     stubCall.call(currentInstruction[1].u.operand);
 }
 
@@ -828,11 +826,11 @@ void JIT::emit_op_jtrue(Instruction* currentInstruction)
     unsigned target = currentInstruction[2].u.operand;
     emitGetVirtualRegister(currentInstruction[1].u.operand, regT0);
 
-    Jump isZero = branchPtr(Equal, regT0, ImmPtr(JSValue::encode(jsNumber(0))));
+    Jump isZero = branchPtr(Equal, regT0, TrustedImmPtr(JSValue::encode(jsNumber(0))));
     addJump(emitJumpIfImmediateInteger(regT0), target);
 
-    addJump(branchPtr(Equal, regT0, ImmPtr(JSValue::encode(jsBoolean(true)))), target);
-    addSlowCase(branchPtr(NotEqual, regT0, ImmPtr(JSValue::encode(jsBoolean(false)))));
+    addJump(branchPtr(Equal, regT0, TrustedImmPtr(JSValue::encode(jsBoolean(true)))), target);
+    addSlowCase(branchPtr(NotEqual, regT0, TrustedImmPtr(JSValue::encode(jsBoolean(false)))));
 
     isZero.link(this);
     RECORD_JUMP_TARGET(target);
@@ -893,8 +891,8 @@ void JIT::emit_op_get_pnames(Instruction* currentInstruction)
     if (!m_codeBlock->isKnownNotImmediate(base))
         isNotObject.append(emitJumpIfNotJSCell(regT0));
     if (base != m_codeBlock->thisRegister() || m_codeBlock->isStrictMode()) {
-        loadPtr(Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), regT2);
-        isNotObject.append(branch8(NotEqual, Address(regT2, OBJECT_OFFSETOF(Structure, m_typeInfo.m_type)), Imm32(ObjectType)));
+        loadPtr(Address(regT0, JSCell::structureOffset()), regT2);
+        isNotObject.append(branch8(NotEqual, Address(regT2, Structure::typeInfoTypeOffset()), TrustedImm32(ObjectType)));
     }
 
     // We could inline the case where you have a valid cache, but
@@ -904,14 +902,15 @@ void JIT::emit_op_get_pnames(Instruction* currentInstruction)
     getPnamesStubCall.addArgument(regT0);
     getPnamesStubCall.call(dst);
     load32(Address(regT0, OBJECT_OFFSETOF(JSPropertyNameIterator, m_jsStringsSize)), regT3);
-    store32(Imm32(0), addressFor(i));
-    store32(regT3, addressFor(size));
+    storePtr(tagTypeNumberRegister, payloadFor(i));
+    store32(TrustedImm32(Int32Tag), intTagFor(size));
+    store32(regT3, intPayloadFor(size));
     Jump end = jump();
 
     isNotObject.link(this);
     move(regT0, regT1);
-    and32(Imm32(~JSImmediate::ExtendedTagBitUndefined), regT1);
-    addJump(branch32(Equal, regT1, Imm32(JSImmediate::FullTagTypeNull)), breakTarget);
+    and32(TrustedImm32(~JSImmediate::ExtendedTagBitUndefined), regT1);
+    addJump(branch32(Equal, regT1, TrustedImm32(JSImmediate::FullTagTypeNull)), breakTarget);
 
     JITStubCall toObjectStubCall(this, cti_to_object);
     toObjectStubCall.addArgument(regT0);
@@ -933,8 +932,8 @@ void JIT::emit_op_next_pname(Instruction* currentInstruction)
     JumpList callHasProperty;
 
     Label begin(this);
-    load32(addressFor(i), regT0);
-    Jump end = branch32(Equal, regT0, addressFor(size));
+    load32(intPayloadFor(i), regT0);
+    Jump end = branch32(Equal, regT0, intPayloadFor(size));
 
     // Grab key @ i
     loadPtr(addressFor(it), regT1);
@@ -945,14 +944,14 @@ void JIT::emit_op_next_pname(Instruction* currentInstruction)
     emitPutVirtualRegister(dst, regT2);
 
     // Increment i
-    add32(Imm32(1), regT0);
-    store32(regT0, addressFor(i));
+    add32(TrustedImm32(1), regT0);
+    store32(regT0, intPayloadFor(i));
 
     // Verify that i is valid:
     emitGetVirtualRegister(base, regT0);
 
     // Test base's structure
-    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), regT2);
+    loadPtr(Address(regT0, JSCell::structureOffset()), regT2);
     callHasProperty.append(branchPtr(NotEqual, regT2, Address(Address(regT1, OBJECT_OFFSETOF(JSPropertyNameIterator, m_cachedStructure)))));
 
     // Test base's prototype chain
@@ -961,11 +960,11 @@ void JIT::emit_op_next_pname(Instruction* currentInstruction)
     addJump(branchTestPtr(Zero, Address(regT3)), target);
 
     Label checkPrototype(this);
-    loadPtr(Address(regT2, OBJECT_OFFSETOF(Structure, m_prototype)), regT2);
+    loadPtr(Address(regT2, Structure::prototypeOffset()), regT2);
     callHasProperty.append(emitJumpIfNotJSCell(regT2));
-    loadPtr(Address(regT2, OBJECT_OFFSETOF(JSCell, m_structure)), regT2);
+    loadPtr(Address(regT2, JSCell::structureOffset()), regT2);
     callHasProperty.append(branchPtr(NotEqual, regT2, Address(regT3)));
-    addPtr(Imm32(sizeof(Structure*)), regT3);
+    addPtr(TrustedImm32(sizeof(Structure*)), regT3);
     branchTestPtr(NonZero, Address(regT3)).linkTo(checkPrototype, this);
 
     // Continue loop.
@@ -1040,8 +1039,8 @@ void JIT::emit_op_to_jsnumber(Instruction* currentInstruction)
     Jump wasImmediate = emitJumpIfImmediateInteger(regT0);
 
     emitJumpSlowCaseIfNotJSCell(regT0, srcVReg);
-    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), regT2);
-    addSlowCase(branch8(NotEqual, Address(regT2, OBJECT_OFFSETOF(Structure, m_typeInfo.m_type)), Imm32(NumberType)));
+    loadPtr(Address(regT0, JSCell::structureOffset()), regT2);
+    addSlowCase(branch8(NotEqual, Address(regT2, Structure::typeInfoTypeOffset()), TrustedImm32(NumberType)));
     
     wasImmediate.link(this);
 
@@ -1051,7 +1050,7 @@ void JIT::emit_op_to_jsnumber(Instruction* currentInstruction)
 void JIT::emit_op_push_new_scope(Instruction* currentInstruction)
 {
     JITStubCall stubCall(this, cti_op_push_new_scope);
-    stubCall.addArgument(ImmPtr(&m_codeBlock->identifier(currentInstruction[2].u.operand)));
+    stubCall.addArgument(TrustedImmPtr(&m_codeBlock->identifier(currentInstruction[2].u.operand)));
     stubCall.addArgument(currentInstruction[3].u.operand, regT2);
     stubCall.call(currentInstruction[1].u.operand);
 }
@@ -1062,7 +1061,7 @@ void JIT::emit_op_catch(Instruction* currentInstruction)
     move(regT0, callFrameRegister);
     peek(regT3, OBJECT_OFFSETOF(struct JITStackFrame, globalData) / sizeof(void*));
     loadPtr(Address(regT3, OBJECT_OFFSETOF(JSGlobalData, exception)), regT0);
-    storePtr(ImmPtr(JSValue::encode(JSValue())), Address(regT3, OBJECT_OFFSETOF(JSGlobalData, exception)));
+    storePtr(TrustedImmPtr(JSValue::encode(JSValue())), Address(regT3, OBJECT_OFFSETOF(JSGlobalData, exception)));
     emitPutVirtualRegister(currentInstruction[1].u.operand);
 }
 
@@ -1157,15 +1156,15 @@ void JIT::emit_op_eq_null(Instruction* currentInstruction)
     emitGetVirtualRegister(src1, regT0);
     Jump isImmediate = emitJumpIfNotJSCell(regT0);
 
-    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), regT2);
-    set32Test8(NonZero, Address(regT2, OBJECT_OFFSETOF(Structure, m_typeInfo.m_flags)), Imm32(MasqueradesAsUndefined), regT0);
+    loadPtr(Address(regT0, JSCell::structureOffset()), regT2);
+    set32Test8(NonZero, Address(regT2, Structure::typeInfoFlagsOffset()), TrustedImm32(MasqueradesAsUndefined), regT0);
 
     Jump wasNotImmediate = jump();
 
     isImmediate.link(this);
 
-    andPtr(Imm32(~JSImmediate::ExtendedTagBitUndefined), regT0);
-    setPtr(Equal, regT0, Imm32(JSImmediate::FullTagTypeNull), regT0);
+    andPtr(TrustedImm32(~JSImmediate::ExtendedTagBitUndefined), regT0);
+    setPtr(Equal, regT0, TrustedImm32(JSImmediate::FullTagTypeNull), regT0);
 
     wasNotImmediate.link(this);
 
@@ -1182,15 +1181,15 @@ void JIT::emit_op_neq_null(Instruction* currentInstruction)
     emitGetVirtualRegister(src1, regT0);
     Jump isImmediate = emitJumpIfNotJSCell(regT0);
 
-    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), regT2);
-    set32Test8(Zero, Address(regT2, OBJECT_OFFSETOF(Structure, m_typeInfo.m_flags)), Imm32(MasqueradesAsUndefined), regT0);
+    loadPtr(Address(regT0, JSCell::structureOffset()), regT2);
+    set32Test8(Zero, Address(regT2, Structure::typeInfoFlagsOffset()), TrustedImm32(MasqueradesAsUndefined), regT0);
 
     Jump wasNotImmediate = jump();
 
     isImmediate.link(this);
 
-    andPtr(Imm32(~JSImmediate::ExtendedTagBitUndefined), regT0);
-    setPtr(NotEqual, regT0, Imm32(JSImmediate::FullTagTypeNull), regT0);
+    andPtr(TrustedImm32(~JSImmediate::ExtendedTagBitUndefined), regT0);
+    setPtr(NotEqual, regT0, TrustedImm32(JSImmediate::FullTagTypeNull), regT0);
 
     wasNotImmediate.link(this);
 
@@ -1237,7 +1236,7 @@ void JIT::emit_op_init_lazy_reg(Instruction* currentInstruction)
 {
     unsigned dst = currentInstruction[1].u.operand;
 
-    storePtr(ImmPtr(0), Address(callFrameRegister, sizeof(Register) * dst));
+    storePtr(TrustedImmPtr(0), Address(callFrameRegister, sizeof(Register) * dst));
 }
 
 void JIT::emit_op_convert_this(Instruction* currentInstruction)
@@ -1245,22 +1244,22 @@ void JIT::emit_op_convert_this(Instruction* currentInstruction)
     emitGetVirtualRegister(currentInstruction[1].u.operand, regT0);
 
     emitJumpSlowCaseIfNotJSCell(regT0);
-    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), regT1);
-    addSlowCase(branchTest8(NonZero, Address(regT1, OBJECT_OFFSETOF(Structure, m_typeInfo.m_flags)), Imm32(NeedsThisConversion)));
+    loadPtr(Address(regT0, JSCell::structureOffset()), regT1);
+    addSlowCase(branchTest8(NonZero, Address(regT1, Structure::typeInfoFlagsOffset()), TrustedImm32(NeedsThisConversion)));
 }
 
 void JIT::emit_op_convert_this_strict(Instruction* currentInstruction)
 {
     emitGetVirtualRegister(currentInstruction[1].u.operand, regT0);
     Jump notNull = branchTestPtr(NonZero, regT0);
-    move(ImmPtr(JSValue::encode(jsNull())), regT0);
+    move(TrustedImmPtr(JSValue::encode(jsNull())), regT0);
     emitPutVirtualRegister(currentInstruction[1].u.operand, regT0);
     Jump setThis = jump();
     notNull.link(this);
     Jump isImmediate = emitJumpIfNotJSCell(regT0);
-    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), regT1);
-    Jump notAnObject = branch8(NotEqual, Address(regT1, OBJECT_OFFSETOF(Structure, m_typeInfo.m_type)), Imm32(ObjectType));
-    addSlowCase(branchTest8(NonZero, Address(regT1, OBJECT_OFFSETOF(Structure, m_typeInfo.m_flags)), Imm32(NeedsThisConversion)));
+    loadPtr(Address(regT0, JSCell::structureOffset()), regT1);
+    Jump notAnObject = branch8(NotEqual, Address(regT1, Structure::typeInfoTypeOffset()), TrustedImm32(ObjectType));
+    addSlowCase(branchTest8(NonZero, Address(regT1, Structure::typeInfoFlagsOffset()), TrustedImm32(NeedsThisConversion)));
     isImmediate.link(this);
     notAnObject.link(this);
     setThis.link(this);
@@ -1375,7 +1374,7 @@ void JIT::emitSlow_op_put_by_val(Instruction* currentInstruction, Vector<SlowCas
 void JIT::emitSlow_op_not(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
 {
     linkSlowCase(iter);
-    xorPtr(Imm32(static_cast<int32_t>(JSImmediate::FullTagTypeBool)), regT0);
+    xorPtr(TrustedImm32(static_cast<int32_t>(JSImmediate::FullTagTypeBool)), regT0);
     JITStubCall stubCall(this, cti_op_not);
     stubCall.addArgument(regT0);
     stubCall.call(currentInstruction[1].u.operand);
@@ -1443,7 +1442,7 @@ void JIT::emitSlow_op_neq(Instruction* currentInstruction, Vector<SlowCaseEntry>
     stubCall.addArgument(regT0);
     stubCall.addArgument(regT1);
     stubCall.call();
-    xor32(Imm32(0x1), regT0);
+    xor32(TrustedImm32(0x1), regT0);
     emitTagAsBoolImmediate(regT0);
     emitPutVirtualRegister(currentInstruction[1].u.operand);
 }
@@ -1533,7 +1532,7 @@ void JIT::emit_op_get_arguments_length(Instruction* currentInstruction)
     int argumentsRegister = currentInstruction[2].u.operand;
     addSlowCase(branchTestPtr(NonZero, addressFor(argumentsRegister)));
     emitGetFromCallFrameHeader32(RegisterFile::ArgumentCount, regT0);
-    sub32(Imm32(1), regT0);
+    sub32(TrustedImm32(1), regT0);
     emitFastArithReTagImmediate(regT0, regT0);
     emitPutVirtualRegister(dst, regT0);
 }
@@ -1548,7 +1547,7 @@ void JIT::emitSlow_op_get_arguments_length(Instruction* currentInstruction, Vect
     emitGetVirtualRegister(base, regT0);
     JITStubCall stubCall(this, cti_op_get_by_id_generic);
     stubCall.addArgument(regT0);
-    stubCall.addArgument(ImmPtr(ident));
+    stubCall.addArgument(TrustedImmPtr(ident));
     stubCall.call(dst);
 }
 
@@ -1560,7 +1559,7 @@ void JIT::emit_op_get_argument_by_val(Instruction* currentInstruction)
     addSlowCase(branchTestPtr(NonZero, addressFor(argumentsRegister)));
     emitGetVirtualRegister(property, regT1);
     addSlowCase(emitJumpIfNotImmediateInteger(regT1));
-    add32(Imm32(1), regT1);
+    add32(TrustedImm32(1), regT1);
     // regT1 now contains the integer index of the argument we want, including this
     emitGetFromCallFrameHeader32(RegisterFile::ArgumentCount, regT2);
     addSlowCase(branch32(AboveOrEqual, regT1, regT2));
@@ -1576,7 +1575,7 @@ void JIT::emit_op_get_argument_by_val(Instruction* currentInstruction)
     }
     
     addPtr(Imm32(static_cast<unsigned>(-(RegisterFile::CallFrameHeaderSize + numArgs) * sizeof(Register))), callFrameRegister, regT0);
-    mul32(Imm32(sizeof(Register)), regT2, regT2);
+    mul32(TrustedImm32(sizeof(Register)), regT2, regT2);
     subPtr(regT2, regT0);
     loadPtr(BaseIndex(regT0, regT1, TimesEight, 0), regT0);
     if (numArgs)
@@ -1644,7 +1643,7 @@ void JIT::emitSlow_op_resolve_global_dynamic(Instruction* currentInstruction, Ve
     while (skip--)
         linkSlowCase(iter);
     JITStubCall resolveStubCall(this, cti_op_resolve);
-    resolveStubCall.addArgument(ImmPtr(ident));
+    resolveStubCall.addArgument(TrustedImmPtr(ident));
     resolveStubCall.call(dst);
     emitJumpSlowToHot(jump(), OPCODE_LENGTH(op_resolve_global_dynamic));
     
@@ -1652,7 +1651,7 @@ void JIT::emitSlow_op_resolve_global_dynamic(Instruction* currentInstruction, Ve
     
     linkSlowCase(iter); // We managed to skip all the nodes in the scope chain, but the cache missed.
     JITStubCall stubCall(this, cti_op_resolve_global);
-    stubCall.addArgument(ImmPtr(ident));
+    stubCall.addArgument(TrustedImmPtr(ident));
     stubCall.addArgument(Imm32(currentIndex));
     stubCall.addArgument(regT0);
     stubCall.call(dst);
@@ -1661,7 +1660,7 @@ void JIT::emitSlow_op_resolve_global_dynamic(Instruction* currentInstruction, Ve
 void JIT::emit_op_new_regexp(Instruction* currentInstruction)
 {
     JITStubCall stubCall(this, cti_op_new_regexp);
-    stubCall.addArgument(ImmPtr(m_codeBlock->regexp(currentInstruction[2].u.operand)));
+    stubCall.addArgument(TrustedImmPtr(m_codeBlock->regexp(currentInstruction[2].u.operand)));
     stubCall.call(currentInstruction[1].u.operand);
 }
 
@@ -1685,26 +1684,27 @@ void JIT::emit_op_load_varargs(Instruction* currentInstruction)
     }
 
 #if USE(JSVALUE32_64)
-    addSlowCase(branch32(NotEqual, tagFor(argsOffset), Imm32(JSValue::EmptyValueTag)));
+    addSlowCase(branch32(NotEqual, tagFor(argsOffset), TrustedImm32(JSValue::EmptyValueTag)));
 #else
     addSlowCase(branchTestPtr(NonZero, addressFor(argsOffset)));
 #endif
     // Load arg count into regT0
     emitGetFromCallFrameHeader32(RegisterFile::ArgumentCount, regT0);
-    storePtr(regT0, addressFor(argCountDst));
-    Jump endBranch = branch32(Equal, regT0, Imm32(1));
+    store32(TrustedImm32(Int32Tag), intTagFor(argCountDst));
+    store32(regT0, intPayloadFor(argCountDst));
+    Jump endBranch = branch32(Equal, regT0, TrustedImm32(1));
 
-    mul32(Imm32(sizeof(Register)), regT0, regT3);
-    addPtr(Imm32(static_cast<unsigned>(sizeof(Register) - RegisterFile::CallFrameHeaderSize * sizeof(Register))), callFrameRegister, regT1);
+    mul32(TrustedImm32(sizeof(Register)), regT0, regT3);
+    addPtr(TrustedImm32(static_cast<unsigned>(sizeof(Register) - RegisterFile::CallFrameHeaderSize * sizeof(Register))), callFrameRegister, regT1);
     subPtr(regT3, regT1); // regT1 is now the start of the out of line arguments
     addPtr(Imm32(argsOffset * sizeof(Register)), callFrameRegister, regT2); // regT2 is the target buffer
     
     // Bounds check the registerfile
     addPtr(regT2, regT3);
     addPtr(Imm32((registerOffset - argsOffset) * sizeof(Register)), regT3);
-    addSlowCase(branchPtr(Below, AbsoluteAddress(&m_globalData->interpreter->registerFile().m_end), regT3));
+    addSlowCase(branchPtr(Below, AbsoluteAddress(m_globalData->interpreter->registerFile().addressOfEnd()), regT3));
 
-    sub32(Imm32(1), regT0);
+    sub32(TrustedImm32(1), regT0);
     Label loopStart = label();
     loadPtr(BaseIndex(regT1, regT0, TimesEight, static_cast<unsigned>(0 - 2 * sizeof(Register))), regT3);
     storePtr(regT3, BaseIndex(regT2, regT0, TimesEight, static_cast<unsigned>(0 - sizeof(Register))));
@@ -1712,7 +1712,7 @@ void JIT::emit_op_load_varargs(Instruction* currentInstruction)
     loadPtr(BaseIndex(regT1, regT0, TimesEight, static_cast<unsigned>(sizeof(void*) - 2 * sizeof(Register))), regT3);
     storePtr(regT3, BaseIndex(regT2, regT0, TimesEight, static_cast<unsigned>(sizeof(void*) - sizeof(Register))));
 #endif
-    branchSubPtr(NonZero, Imm32(1), regT0).linkTo(loopStart, this);
+    branchSubPtr(NonZero, TrustedImm32(1), regT0).linkTo(loopStart, this);
     endBranch.link(this);
 }
 
@@ -1729,8 +1729,9 @@ void JIT::emitSlow_op_load_varargs(Instruction* currentInstruction, Vector<SlowC
     JITStubCall stubCall(this, cti_op_load_varargs);
     stubCall.addArgument(Imm32(argsOffset));
     stubCall.call();
-    // Stores a naked int32 in the register file.
-    store32(returnValueRegister, Address(callFrameRegister, argCountDst * sizeof(Register)));
+    
+    store32(TrustedImm32(Int32Tag), intTagFor(argCountDst));
+    store32(returnValueRegister, intPayloadFor(argCountDst));
 }
 
 void JIT::emit_op_new_func(Instruction* currentInstruction)
@@ -1739,13 +1740,13 @@ void JIT::emit_op_new_func(Instruction* currentInstruction)
     int dst = currentInstruction[1].u.operand;
     if (currentInstruction[3].u.operand) {
 #if USE(JSVALUE32_64)
-        lazyJump = branch32(NotEqual, tagFor(dst), Imm32(JSValue::EmptyValueTag));
+        lazyJump = branch32(NotEqual, tagFor(dst), TrustedImm32(JSValue::EmptyValueTag));
 #else
         lazyJump = branchTestPtr(NonZero, addressFor(dst));
 #endif
     }
     JITStubCall stubCall(this, cti_op_new_func);
-    stubCall.addArgument(ImmPtr(m_codeBlock->functionDecl(currentInstruction[2].u.operand)));
+    stubCall.addArgument(TrustedImmPtr(m_codeBlock->functionDecl(currentInstruction[2].u.operand)));
     stubCall.call(currentInstruction[1].u.operand);
     if (currentInstruction[3].u.operand)
         lazyJump.link(this);
diff --git a/Source/JavaScriptCore/jit/JITOpcodes32_64.cpp b/Source/JavaScriptCore/jit/JITOpcodes32_64.cpp
index 0c8402b..bc0b2cb 100644
--- a/Source/JavaScriptCore/jit/JITOpcodes32_64.cpp
+++ b/Source/JavaScriptCore/jit/JITOpcodes32_64.cpp
@@ -52,15 +52,15 @@ void JIT::privateCompileCTIMachineTrampolines(RefPtr<ExecutablePool>* executable
 
     // regT0 holds payload, regT1 holds tag
 
-    Jump string_failureCases1 = branch32(NotEqual, regT1, Imm32(JSValue::CellTag));
-    Jump string_failureCases2 = branchPtr(NotEqual, Address(regT0), ImmPtr(m_globalData->jsStringVPtr));
+    Jump string_failureCases1 = branch32(NotEqual, regT1, TrustedImm32(JSValue::CellTag));
+    Jump string_failureCases2 = branchPtr(NotEqual, Address(regT0), TrustedImmPtr(m_globalData->jsStringVPtr));
 
     // Checks out okay! - get the length from the Ustring.
     load32(Address(regT0, OBJECT_OFFSETOF(JSString, m_length)), regT2);
 
-    Jump string_failureCases3 = branch32(Above, regT2, Imm32(INT_MAX));
+    Jump string_failureCases3 = branch32(Above, regT2, TrustedImm32(INT_MAX));
     move(regT2, regT0);
-    move(Imm32(JSValue::Int32Tag), regT1);
+    move(TrustedImm32(JSValue::Int32Tag), regT1);
 
     ret();
 #endif
@@ -103,7 +103,7 @@ void JIT::privateCompileCTIMachineTrampolines(RefPtr<ExecutablePool>* executable
 
     loadPtr(Address(regT0, OBJECT_OFFSETOF(JSFunction, m_executable)), regT2);
 
-    Jump hasCodeBlock3 = branch32(GreaterThanOrEqual, Address(regT2, OBJECT_OFFSETOF(FunctionExecutable, m_numParametersForCall)), Imm32(0));
+    Jump hasCodeBlock3 = branch32(GreaterThanOrEqual, Address(regT2, OBJECT_OFFSETOF(FunctionExecutable, m_numParametersForCall)), TrustedImm32(0));
     preserveReturnAddressAfterCall(regT3);
     restoreArgumentReference();
     Call callCompileCall = call();
@@ -123,7 +123,7 @@ void JIT::privateCompileCTIMachineTrampolines(RefPtr<ExecutablePool>* executable
 
     loadPtr(Address(regT0, OBJECT_OFFSETOF(JSFunction, m_executable)), regT2);
 
-    Jump hasCodeBlock4 = branch32(GreaterThanOrEqual, Address(regT2, OBJECT_OFFSETOF(FunctionExecutable, m_numParametersForConstruct)), Imm32(0));
+    Jump hasCodeBlock4 = branch32(GreaterThanOrEqual, Address(regT2, OBJECT_OFFSETOF(FunctionExecutable, m_numParametersForConstruct)), TrustedImm32(0));
     preserveReturnAddressAfterCall(regT3);
     restoreArgumentReference();
     Call callCompileCconstruct = call();
@@ -142,10 +142,10 @@ void JIT::privateCompileCTIMachineTrampolines(RefPtr<ExecutablePool>* executable
     emitGetFromCallFrameHeaderPtr(RegisterFile::ReturnPC, regT1);
     emitGetFromCallFrameHeaderPtr(RegisterFile::CallerFrame, callFrameRegister);
     restoreReturnAddressBeforeReturn(regT1);
-    move(ImmPtr(&globalData->exceptionLocation), regT2);
+    move(TrustedImmPtr(&globalData->exceptionLocation), regT2);
     storePtr(regT1, regT2);
     poke(callFrameRegister, 1 + OBJECT_OFFSETOF(struct JITStackFrame, callFrame) / sizeof(void*));
-    poke(ImmPtr(FunctionPtr(ctiVMThrowTrampoline).value()));
+    poke(TrustedImmPtr(FunctionPtr(ctiVMThrowTrampoline).value()));
     ret();
 
     // NativeCall Trampoline
@@ -205,7 +205,7 @@ JIT::Label JIT::privateCompileCTINativeCall(JSGlobalData* globalData, bool isCon
     // get to its global data.
     emitGetFromCallFrameHeaderPtr(RegisterFile::CallerFrame, regT0);
     emitGetFromCallFrameHeaderPtr(RegisterFile::ScopeChain, regT1, regT0);
-    emitPutToCallFrameHeader(regT1, RegisterFile::ScopeChain);
+    emitPutCellToCallFrameHeader(regT1, RegisterFile::ScopeChain);
 
     peek(regT1);
     emitPutToCallFrameHeader(regT1, RegisterFile::ReturnPC);
@@ -214,7 +214,7 @@ JIT::Label JIT::privateCompileCTINativeCall(JSGlobalData* globalData, bool isCon
     // Host function signature: f(ExecState*);
     move(callFrameRegister, X86Registers::ecx);
 
-    subPtr(Imm32(16 - sizeof(void*)), stackPointerRegister); // Align stack after call.
+    subPtr(TrustedImm32(16 - sizeof(void*)), stackPointerRegister); // Align stack after call.
 
     // call the function
     emitGetFromCallFrameHeaderPtr(RegisterFile::Callee, regT1);
@@ -222,14 +222,14 @@ JIT::Label JIT::privateCompileCTINativeCall(JSGlobalData* globalData, bool isCon
     move(regT0, callFrameRegister); // Eagerly restore caller frame register to avoid loading from stack.
     call(Address(regT1, executableOffsetToFunction));
 
-    addPtr(Imm32(16 - sizeof(void*)), stackPointerRegister);
+    addPtr(TrustedImm32(16 - sizeof(void*)), stackPointerRegister);
 
 #elif CPU(ARM)
     // Load caller frame's scope chain into this callframe so that whatever we call can
     // get to its global data.
     emitGetFromCallFrameHeaderPtr(RegisterFile::CallerFrame, regT2);
     emitGetFromCallFrameHeaderPtr(RegisterFile::ScopeChain, regT1, regT2);
-    emitPutToCallFrameHeader(regT1, RegisterFile::ScopeChain);
+    emitPutCellToCallFrameHeader(regT1, RegisterFile::ScopeChain);
 
     preserveReturnAddressAfterCall(regT3); // Callee preserved
     emitPutToCallFrameHeader(regT3, RegisterFile::ReturnPC);
@@ -251,7 +251,7 @@ JIT::Label JIT::privateCompileCTINativeCall(JSGlobalData* globalData, bool isCon
     // get to its global data.
     emitGetFromCallFrameHeaderPtr(RegisterFile::CallerFrame, regT0);
     emitGetFromCallFrameHeaderPtr(RegisterFile::ScopeChain, regT1, regT0);
-    emitPutToCallFrameHeader(regT1, RegisterFile::ScopeChain);
+    emitPutCellToCallFrameHeader(regT1, RegisterFile::ScopeChain);
 
     preserveReturnAddressAfterCall(regT3); // Callee preserved
     emitPutToCallFrameHeader(regT3, RegisterFile::ReturnPC);
@@ -261,7 +261,7 @@ JIT::Label JIT::privateCompileCTINativeCall(JSGlobalData* globalData, bool isCon
 
     // Allocate stack space for 16 bytes (8-byte aligned)
     // 16 bytes (unused) for 4 arguments
-    subPtr(Imm32(16), stackPointerRegister);
+    subPtr(TrustedImm32(16), stackPointerRegister);
 
     // Setup arg0
     move(callFrameRegister, MIPSRegisters::a0);
@@ -273,7 +273,7 @@ JIT::Label JIT::privateCompileCTINativeCall(JSGlobalData* globalData, bool isCon
     call(Address(regT2, executableOffsetToFunction));
 
     // Restore stack space
-    addPtr(Imm32(16), stackPointerRegister);
+    addPtr(TrustedImm32(16), stackPointerRegister);
 
     restoreReturnAddressBeforeReturn(regT3);
 
@@ -285,7 +285,7 @@ JIT::Label JIT::privateCompileCTINativeCall(JSGlobalData* globalData, bool isCon
 #endif // CPU(X86)
 
     // Check for an exception
-    Jump sawException = branch32(NotEqual, AbsoluteAddress(reinterpret_cast<char*>(&globalData->exception) + OBJECT_OFFSETOF(JSValue, u.asBits.tag)), Imm32(JSValue::EmptyValueTag));
+    Jump sawException = branch32(NotEqual, AbsoluteAddress(reinterpret_cast<char*>(&globalData->exception) + OBJECT_OFFSETOF(JSValue, u.asBits.tag)), TrustedImm32(JSValue::EmptyValueTag));
 
     // Return.
     ret();
@@ -296,12 +296,12 @@ JIT::Label JIT::privateCompileCTINativeCall(JSGlobalData* globalData, bool isCon
     // Grab the return address.
     preserveReturnAddressAfterCall(regT1);
 
-    move(ImmPtr(&globalData->exceptionLocation), regT2);
+    move(TrustedImmPtr(&globalData->exceptionLocation), regT2);
     storePtr(regT1, regT2);
     poke(callFrameRegister, OBJECT_OFFSETOF(struct JITStackFrame, callFrame) / sizeof(void*));
 
     // Set the return address.
-    move(ImmPtr(FunctionPtr(ctiVMThrowTrampoline).value()), regT1);
+    move(TrustedImmPtr(FunctionPtr(ctiVMThrowTrampoline).value()), regT1);
     restoreReturnAddressBeforeReturn(regT1);
 
     ret();
@@ -321,7 +321,7 @@ JIT::CodePtr JIT::privateCompileCTINativeCall(PassRefPtr<ExecutablePool> executa
     // get to its global data.
     emitGetFromCallFrameHeaderPtr(RegisterFile::CallerFrame, regT0);
     emitGetFromCallFrameHeaderPtr(RegisterFile::ScopeChain, regT1, regT0);
-    emitPutToCallFrameHeader(regT1, RegisterFile::ScopeChain);
+    emitPutCellToCallFrameHeader(regT1, RegisterFile::ScopeChain);
 
     peek(regT1);
     emitPutToCallFrameHeader(regT1, RegisterFile::ReturnPC);
@@ -330,21 +330,21 @@ JIT::CodePtr JIT::privateCompileCTINativeCall(PassRefPtr<ExecutablePool> executa
     // Host function signature: f(ExecState*);
     move(callFrameRegister, X86Registers::ecx);
 
-    subPtr(Imm32(16 - sizeof(void*)), stackPointerRegister); // Align stack after call.
+    subPtr(TrustedImm32(16 - sizeof(void*)), stackPointerRegister); // Align stack after call.
 
     move(regT0, callFrameRegister); // Eagerly restore caller frame register to avoid loading from stack.
 
     // call the function
     nativeCall = call();
 
-    addPtr(Imm32(16 - sizeof(void*)), stackPointerRegister);
+    addPtr(TrustedImm32(16 - sizeof(void*)), stackPointerRegister);
 
 #elif CPU(ARM)
     // Load caller frame's scope chain into this callframe so that whatever we call can
     // get to its global data.
     emitGetFromCallFrameHeaderPtr(RegisterFile::CallerFrame, regT2);
     emitGetFromCallFrameHeaderPtr(RegisterFile::ScopeChain, regT1, regT2);
-    emitPutToCallFrameHeader(regT1, RegisterFile::ScopeChain);
+    emitPutCellToCallFrameHeader(regT1, RegisterFile::ScopeChain);
 
     preserveReturnAddressAfterCall(regT3); // Callee preserved
     emitPutToCallFrameHeader(regT3, RegisterFile::ReturnPC);
@@ -367,7 +367,7 @@ JIT::CodePtr JIT::privateCompileCTINativeCall(PassRefPtr<ExecutablePool> executa
     // get to its global data.
     emitGetFromCallFrameHeaderPtr(RegisterFile::CallerFrame, regT0);
     emitGetFromCallFrameHeaderPtr(RegisterFile::ScopeChain, regT1, regT0);
-    emitPutToCallFrameHeader(regT1, RegisterFile::ScopeChain);
+    emitPutCellToCallFrameHeader(regT1, RegisterFile::ScopeChain);
 
     preserveReturnAddressAfterCall(regT3); // Callee preserved
     emitPutToCallFrameHeader(regT3, RegisterFile::ReturnPC);
@@ -377,7 +377,7 @@ JIT::CodePtr JIT::privateCompileCTINativeCall(PassRefPtr<ExecutablePool> executa
 
     // Allocate stack space for 16 bytes (8-byte aligned)
     // 16 bytes (unused) for 4 arguments
-    subPtr(Imm32(16), stackPointerRegister);
+    subPtr(TrustedImm32(16), stackPointerRegister);
 
     // Setup arg0
     move(callFrameRegister, MIPSRegisters::a0);
@@ -391,7 +391,7 @@ JIT::CodePtr JIT::privateCompileCTINativeCall(PassRefPtr<ExecutablePool> executa
     nativeCall = call();
 
     // Restore stack space
-    addPtr(Imm32(16), stackPointerRegister);
+    addPtr(TrustedImm32(16), stackPointerRegister);
 
     restoreReturnAddressBeforeReturn(regT3);
 
@@ -402,7 +402,7 @@ JIT::CodePtr JIT::privateCompileCTINativeCall(PassRefPtr<ExecutablePool> executa
 #endif // CPU(X86)
 
     // Check for an exception
-    Jump sawException = branch32(NotEqual, AbsoluteAddress(reinterpret_cast<char*>(&globalData->exception) + OBJECT_OFFSETOF(JSValue, u.asBits.tag)), Imm32(JSValue::EmptyValueTag));
+    Jump sawException = branch32(NotEqual, AbsoluteAddress(reinterpret_cast<char*>(&globalData->exception) + OBJECT_OFFSETOF(JSValue, u.asBits.tag)), TrustedImm32(JSValue::EmptyValueTag));
 
     // Return.
     ret();
@@ -413,12 +413,12 @@ JIT::CodePtr JIT::privateCompileCTINativeCall(PassRefPtr<ExecutablePool> executa
     // Grab the return address.
     preserveReturnAddressAfterCall(regT1);
 
-    move(ImmPtr(&globalData->exceptionLocation), regT2);
+    move(TrustedImmPtr(&globalData->exceptionLocation), regT2);
     storePtr(regT1, regT2);
     poke(callFrameRegister, OBJECT_OFFSETOF(struct JITStackFrame, callFrame) / sizeof(void*));
 
     // Set the return address.
-    move(ImmPtr(FunctionPtr(ctiVMThrowTrampoline).value()), regT1);
+    move(TrustedImmPtr(FunctionPtr(ctiVMThrowTrampoline).value()), regT1);
     restoreReturnAddressBeforeReturn(regT1);
 
     ret();
@@ -470,21 +470,21 @@ void JIT::emit_op_loop_if_lesseq(Instruction* currentInstruction)
 
     if (isOperandConstantImmediateInt(op1)) {
         emitLoad(op2, regT1, regT0);
-        addSlowCase(branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag)));
+        addSlowCase(branch32(NotEqual, regT1, TrustedImm32(JSValue::Int32Tag)));
         addJump(branch32(GreaterThanOrEqual, regT0, Imm32(getConstantOperand(op1).asInt32())), target);
         return;
     }
 
     if (isOperandConstantImmediateInt(op2)) {
         emitLoad(op1, regT1, regT0);
-        addSlowCase(branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag)));
+        addSlowCase(branch32(NotEqual, regT1, TrustedImm32(JSValue::Int32Tag)));
         addJump(branch32(LessThanOrEqual, regT0, Imm32(getConstantOperand(op2).asInt32())), target);
         return;
     }
 
     emitLoad2(op1, regT1, regT0, op2, regT3, regT2);
-    addSlowCase(branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag)));
-    addSlowCase(branch32(NotEqual, regT3, Imm32(JSValue::Int32Tag)));
+    addSlowCase(branch32(NotEqual, regT1, TrustedImm32(JSValue::Int32Tag)));
+    addSlowCase(branch32(NotEqual, regT3, TrustedImm32(JSValue::Int32Tag)));
     addJump(branch32(LessThanOrEqual, regT0, regT2), target);
 }
 
@@ -520,8 +520,8 @@ void JIT::emit_op_check_has_instance(Instruction* currentInstruction)
     emitJumpSlowCaseIfNotJSCell(baseVal);
     
     // Check that baseVal 'ImplementsHasInstance'.
-    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), regT0);
-    addSlowCase(branchTest8(Zero, Address(regT0, OBJECT_OFFSETOF(Structure, m_typeInfo.m_flags)), Imm32(ImplementsHasInstance)));
+    loadPtr(Address(regT0, JSCell::structureOffset()), regT0);
+    addSlowCase(branchTest8(Zero, Address(regT0, Structure::typeInfoFlagsOffset()), TrustedImm32(ImplementsHasInstance)));
 }
 
 void JIT::emit_op_instanceof(Instruction* currentInstruction)
@@ -542,29 +542,29 @@ void JIT::emit_op_instanceof(Instruction* currentInstruction)
     emitJumpSlowCaseIfNotJSCell(proto);
     
     // Check that prototype is an object
-    loadPtr(Address(regT1, OBJECT_OFFSETOF(JSCell, m_structure)), regT3);
-    addSlowCase(branch8(NotEqual, Address(regT3, OBJECT_OFFSETOF(Structure, m_typeInfo.m_type)), Imm32(ObjectType)));
+    loadPtr(Address(regT1, JSCell::structureOffset()), regT3);
+    addSlowCase(branch8(NotEqual, Address(regT3, Structure::typeInfoTypeOffset()), TrustedImm32(ObjectType)));
 
     // Fixme: this check is only needed because the JSC API allows HasInstance to be overridden; we should deprecate this.
     // Check that baseVal 'ImplementsDefaultHasInstance'.
-    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), regT0);
-    addSlowCase(branchTest8(Zero, Address(regT0, OBJECT_OFFSETOF(Structure, m_typeInfo.m_flags)), Imm32(ImplementsDefaultHasInstance)));
+    loadPtr(Address(regT0, JSCell::structureOffset()), regT0);
+    addSlowCase(branchTest8(Zero, Address(regT0, Structure::typeInfoFlagsOffset()), TrustedImm32(ImplementsDefaultHasInstance)));
 
     // Optimistically load the result true, and start looping.
     // Initially, regT1 still contains proto and regT2 still contains value.
     // As we loop regT2 will be updated with its prototype, recursively walking the prototype chain.
-    move(Imm32(JSValue::TrueTag), regT0);
+    move(TrustedImm32(JSValue::TrueTag), regT0);
     Label loop(this);
 
     // Load the prototype of the cell in regT2.  If this is equal to regT1 - WIN!
     // Otherwise, check if we've hit null - if we have then drop out of the loop, if not go again.
-    loadPtr(Address(regT2, OBJECT_OFFSETOF(JSCell, m_structure)), regT2);
-    load32(Address(regT2, OBJECT_OFFSETOF(Structure, m_prototype) + OBJECT_OFFSETOF(JSValue, u.asBits.payload)), regT2);
+    loadPtr(Address(regT2, JSCell::structureOffset()), regT2);
+    load32(Address(regT2, Structure::prototypeOffset() + OBJECT_OFFSETOF(JSValue, u.asBits.payload)), regT2);
     Jump isInstance = branchPtr(Equal, regT2, regT1);
     branchTest32(NonZero, regT2).linkTo(loop, this);
 
     // We get here either by dropping out of the loop, or if value was not an Object.  Result is false.
-    move(Imm32(JSValue::FalseTag), regT0);
+    move(TrustedImm32(JSValue::FalseTag), regT0);
 
     // isInstance jumps right down to here, to skip setting the result to false (it has already set true).
     isInstance.link(this);
@@ -609,7 +609,7 @@ void JIT::emit_op_get_global_var(Instruction* currentInstruction)
     ASSERT(globalObject->isGlobalObject());
     int index = currentInstruction[2].u.operand;
 
-    loadPtr(&globalObject->d()->registers, regT2);
+    loadPtr(&globalObject->m_registers, regT2);
 
     emitLoad(index, regT1, regT0, regT2);
     emitStore(dst, regT1, regT0);
@@ -625,7 +625,7 @@ void JIT::emit_op_put_global_var(Instruction* currentInstruction)
 
     emitLoad(value, regT1, regT0);
 
-    loadPtr(&globalObject->d()->registers, regT2);
+    loadPtr(&globalObject->m_registers, regT2);
     emitStore(index, regT1, regT0, regT2);
     map(m_bytecodeOffset + OPCODE_LENGTH(op_put_global_var), value, regT1, regT0);
 }
@@ -642,7 +642,7 @@ void JIT::emit_op_get_scoped_var(Instruction* currentInstruction)
     if (checkTopLevel && skip--) {
         Jump activationNotCreated;
         if (checkTopLevel)
-            activationNotCreated = branch32(Equal, tagFor(m_codeBlock->activationRegister()), Imm32(JSValue::EmptyValueTag));
+            activationNotCreated = branch32(Equal, tagFor(m_codeBlock->activationRegister()), TrustedImm32(JSValue::EmptyValueTag));
         loadPtr(Address(regT2, OBJECT_OFFSETOF(ScopeChainNode, next)), regT2);
         activationNotCreated.link(this);
     }
@@ -650,8 +650,7 @@ void JIT::emit_op_get_scoped_var(Instruction* currentInstruction)
         loadPtr(Address(regT2, OBJECT_OFFSETOF(ScopeChainNode, next)), regT2);
 
     loadPtr(Address(regT2, OBJECT_OFFSETOF(ScopeChainNode, object)), regT2);
-    loadPtr(Address(regT2, OBJECT_OFFSETOF(JSVariableObject, d)), regT2);
-    loadPtr(Address(regT2, OBJECT_OFFSETOF(JSVariableObject::JSVariableObjectData, registers)), regT2);
+    loadPtr(Address(regT2, OBJECT_OFFSETOF(JSVariableObject, m_registers)), regT2);
 
     emitLoad(index, regT1, regT0, regT2);
     emitStore(dst, regT1, regT0);
@@ -672,7 +671,7 @@ void JIT::emit_op_put_scoped_var(Instruction* currentInstruction)
     if (checkTopLevel && skip--) {
         Jump activationNotCreated;
         if (checkTopLevel)
-            activationNotCreated = branch32(Equal, tagFor(m_codeBlock->activationRegister()), Imm32(JSValue::EmptyValueTag));
+            activationNotCreated = branch32(Equal, tagFor(m_codeBlock->activationRegister()), TrustedImm32(JSValue::EmptyValueTag));
         loadPtr(Address(regT2, OBJECT_OFFSETOF(ScopeChainNode, next)), regT2);
         activationNotCreated.link(this);
     }
@@ -680,8 +679,7 @@ void JIT::emit_op_put_scoped_var(Instruction* currentInstruction)
         loadPtr(Address(regT2, OBJECT_OFFSETOF(ScopeChainNode, next)), regT2);
 
     loadPtr(Address(regT2, OBJECT_OFFSETOF(ScopeChainNode, object)), regT2);
-    loadPtr(Address(regT2, OBJECT_OFFSETOF(JSVariableObject, d)), regT2);
-    loadPtr(Address(regT2, OBJECT_OFFSETOF(JSVariableObject::JSVariableObjectData, registers)), regT2);
+    loadPtr(Address(regT2, OBJECT_OFFSETOF(JSVariableObject, m_registers)), regT2);
 
     emitStore(index, regT1, regT0, regT2);
     map(m_bytecodeOffset + OPCODE_LENGTH(op_put_scoped_var), value, regT1, regT0);
@@ -691,8 +689,8 @@ void JIT::emit_op_tear_off_activation(Instruction* currentInstruction)
 {
     unsigned activation = currentInstruction[1].u.operand;
     unsigned arguments = currentInstruction[2].u.operand;
-    Jump activationCreated = branch32(NotEqual, tagFor(activation), Imm32(JSValue::EmptyValueTag));
-    Jump argumentsNotCreated = branch32(Equal, tagFor(arguments), Imm32(JSValue::EmptyValueTag));
+    Jump activationCreated = branch32(NotEqual, tagFor(activation), TrustedImm32(JSValue::EmptyValueTag));
+    Jump argumentsNotCreated = branch32(Equal, tagFor(arguments), TrustedImm32(JSValue::EmptyValueTag));
     activationCreated.link(this);
     JITStubCall stubCall(this, cti_op_tear_off_activation);
     stubCall.addArgument(currentInstruction[1].u.operand);
@@ -705,7 +703,7 @@ void JIT::emit_op_tear_off_arguments(Instruction* currentInstruction)
 {
     int dst = currentInstruction[1].u.operand;
 
-    Jump argsNotCreated = branch32(Equal, tagFor(unmodifiedArgumentsRegister(dst)), Imm32(JSValue::EmptyValueTag));
+    Jump argsNotCreated = branch32(Equal, tagFor(unmodifiedArgumentsRegister(dst)), TrustedImm32(JSValue::EmptyValueTag));
     JITStubCall stubCall(this, cti_op_tear_off_arguments);
     stubCall.addArgument(unmodifiedArgumentsRegister(dst));
     stubCall.call();
@@ -723,7 +721,7 @@ void JIT::emit_op_new_array(Instruction* currentInstruction)
 void JIT::emit_op_resolve(Instruction* currentInstruction)
 {
     JITStubCall stubCall(this, cti_op_resolve);
-    stubCall.addArgument(ImmPtr(&m_codeBlock->identifier(currentInstruction[2].u.operand)));
+    stubCall.addArgument(TrustedImmPtr(&m_codeBlock->identifier(currentInstruction[2].u.operand)));
     stubCall.call(currentInstruction[1].u.operand);
 }
 
@@ -734,8 +732,8 @@ void JIT::emit_op_to_primitive(Instruction* currentInstruction)
 
     emitLoad(src, regT1, regT0);
 
-    Jump isImm = branch32(NotEqual, regT1, Imm32(JSValue::CellTag));
-    addSlowCase(branchPtr(NotEqual, Address(regT0), ImmPtr(m_globalData->jsStringVPtr)));
+    Jump isImm = branch32(NotEqual, regT1, TrustedImm32(JSValue::CellTag));
+    addSlowCase(branchPtr(NotEqual, Address(regT0), TrustedImmPtr(m_globalData->jsStringVPtr)));
     isImm.link(this);
 
     if (dst != src)
@@ -765,7 +763,7 @@ void JIT::emit_op_strcat(Instruction* currentInstruction)
 void JIT::emit_op_resolve_base(Instruction* currentInstruction)
 {
     JITStubCall stubCall(this, currentInstruction[3].u.operand ? cti_op_resolve_base_strict_put : cti_op_resolve_base);
-    stubCall.addArgument(ImmPtr(&m_codeBlock->identifier(currentInstruction[2].u.operand)));
+    stubCall.addArgument(TrustedImmPtr(&m_codeBlock->identifier(currentInstruction[2].u.operand)));
     stubCall.call(currentInstruction[1].u.operand);
 }
 
@@ -773,14 +771,14 @@ void JIT::emit_op_ensure_property_exists(Instruction* currentInstruction)
 {
     JITStubCall stubCall(this, cti_op_ensure_property_exists);
     stubCall.addArgument(Imm32(currentInstruction[1].u.operand));
-    stubCall.addArgument(ImmPtr(&m_codeBlock->identifier(currentInstruction[2].u.operand)));
+    stubCall.addArgument(TrustedImmPtr(&m_codeBlock->identifier(currentInstruction[2].u.operand)));
     stubCall.call(currentInstruction[1].u.operand);
 }
 
 void JIT::emit_op_resolve_skip(Instruction* currentInstruction)
 {
     JITStubCall stubCall(this, cti_op_resolve_skip);
-    stubCall.addArgument(ImmPtr(&m_codeBlock->identifier(currentInstruction[2].u.operand)));
+    stubCall.addArgument(TrustedImmPtr(&m_codeBlock->identifier(currentInstruction[2].u.operand)));
     stubCall.addArgument(Imm32(currentInstruction[3].u.operand));
     stubCall.call(currentInstruction[1].u.operand);
 }
@@ -797,9 +795,9 @@ void JIT::emit_op_resolve_global(Instruction* currentInstruction, bool dynamic)
     void* offsetAddr = &(m_codeBlock->globalResolveInfo(currentIndex).offset);
 
     // Verify structure.
-    move(ImmPtr(globalObject), regT0);
+    move(TrustedImmPtr(globalObject), regT0);
     loadPtr(structureAddress, regT1);
-    addSlowCase(branchPtr(NotEqual, regT1, Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure))));
+    addSlowCase(branchPtr(NotEqual, regT1, Address(regT0, JSCell::structureOffset())));
 
     // Load property.
     loadPtr(Address(regT0, OBJECT_OFFSETOF(JSGlobalObject, m_propertyStorage)), regT2);
@@ -819,7 +817,7 @@ void JIT::emitSlow_op_resolve_global(Instruction* currentInstruction, Vector<Slo
 
     linkSlowCase(iter);
     JITStubCall stubCall(this, cti_op_resolve_global);
-    stubCall.addArgument(ImmPtr(ident));
+    stubCall.addArgument(TrustedImmPtr(ident));
     stubCall.addArgument(Imm32(currentIndex));
     stubCall.call(dst);
 }
@@ -831,9 +829,9 @@ void JIT::emit_op_not(Instruction* currentInstruction)
 
     emitLoadTag(src, regT0);
 
-    xor32(Imm32(JSValue::FalseTag), regT0);
-    addSlowCase(branchTest32(NonZero, regT0, Imm32(~1)));
-    xor32(Imm32(JSValue::TrueTag), regT0);
+    xor32(TrustedImm32(JSValue::FalseTag), regT0);
+    addSlowCase(branchTest32(NonZero, regT0, TrustedImm32(~1)));
+    xor32(TrustedImm32(JSValue::TrueTag), regT0);
 
     emitStoreBool(dst, regT0, (dst == src));
 }
@@ -857,17 +855,17 @@ void JIT::emit_op_jfalse(Instruction* currentInstruction)
 
     emitLoad(cond, regT1, regT0);
 
-    Jump isTrue = branch32(Equal, regT1, Imm32(JSValue::TrueTag));
-    addJump(branch32(Equal, regT1, Imm32(JSValue::FalseTag)), target);
+    Jump isTrue = branch32(Equal, regT1, TrustedImm32(JSValue::TrueTag));
+    addJump(branch32(Equal, regT1, TrustedImm32(JSValue::FalseTag)), target);
 
-    Jump isNotInteger = branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag));
-    Jump isTrue2 = branch32(NotEqual, regT0, Imm32(0));
+    Jump isNotInteger = branch32(NotEqual, regT1, TrustedImm32(JSValue::Int32Tag));
+    Jump isTrue2 = branch32(NotEqual, regT0, TrustedImm32(0));
     addJump(jump(), target);
 
     if (supportsFloatingPoint()) {
         isNotInteger.link(this);
 
-        addSlowCase(branch32(Above, regT1, Imm32(JSValue::LowestTag)));
+        addSlowCase(branch32(Above, regT1, TrustedImm32(JSValue::LowestTag)));
 
         emitLoadDouble(cond, fpRegT0);
         addJump(branchDoubleZeroOrNaN(fpRegT0, fpRegT1), target);
@@ -897,17 +895,17 @@ void JIT::emit_op_jtrue(Instruction* currentInstruction)
 
     emitLoad(cond, regT1, regT0);
 
-    Jump isFalse = branch32(Equal, regT1, Imm32(JSValue::FalseTag));
-    addJump(branch32(Equal, regT1, Imm32(JSValue::TrueTag)), target);
+    Jump isFalse = branch32(Equal, regT1, TrustedImm32(JSValue::FalseTag));
+    addJump(branch32(Equal, regT1, TrustedImm32(JSValue::TrueTag)), target);
 
-    Jump isNotInteger = branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag));
-    Jump isFalse2 = branch32(Equal, regT0, Imm32(0));
+    Jump isNotInteger = branch32(NotEqual, regT1, TrustedImm32(JSValue::Int32Tag));
+    Jump isFalse2 = branch32(Equal, regT0, TrustedImm32(0));
     addJump(jump(), target);
 
     if (supportsFloatingPoint()) {
         isNotInteger.link(this);
 
-        addSlowCase(branch32(Above, regT1, Imm32(JSValue::LowestTag)));
+        addSlowCase(branch32(Above, regT1, TrustedImm32(JSValue::LowestTag)));
 
         emitLoadDouble(cond, fpRegT0);
         addJump(branchDoubleNonZero(fpRegT0, fpRegT1), target);
@@ -937,11 +935,11 @@ void JIT::emit_op_jeq_null(Instruction* currentInstruction)
 
     emitLoad(src, regT1, regT0);
 
-    Jump isImmediate = branch32(NotEqual, regT1, Imm32(JSValue::CellTag));
+    Jump isImmediate = branch32(NotEqual, regT1, TrustedImm32(JSValue::CellTag));
 
     // First, handle JSCell cases - check MasqueradesAsUndefined bit on the structure.
-    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), regT2);
-    addJump(branchTest8(NonZero, Address(regT2, OBJECT_OFFSETOF(Structure, m_typeInfo.m_flags)), Imm32(MasqueradesAsUndefined)), target);
+    loadPtr(Address(regT0, JSCell::structureOffset()), regT2);
+    addJump(branchTest8(NonZero, Address(regT2, Structure::typeInfoFlagsOffset()), TrustedImm32(MasqueradesAsUndefined)), target);
 
     Jump wasNotImmediate = jump();
 
@@ -949,7 +947,7 @@ void JIT::emit_op_jeq_null(Instruction* currentInstruction)
     isImmediate.link(this);
 
     ASSERT((JSValue::UndefinedTag + 1 == JSValue::NullTag) && !(JSValue::NullTag + 1));
-    addJump(branch32(AboveOrEqual, regT1, Imm32(JSValue::UndefinedTag)), target);
+    addJump(branch32(AboveOrEqual, regT1, TrustedImm32(JSValue::UndefinedTag)), target);
 
     wasNotImmediate.link(this);
 }
@@ -961,11 +959,11 @@ void JIT::emit_op_jneq_null(Instruction* currentInstruction)
 
     emitLoad(src, regT1, regT0);
 
-    Jump isImmediate = branch32(NotEqual, regT1, Imm32(JSValue::CellTag));
+    Jump isImmediate = branch32(NotEqual, regT1, TrustedImm32(JSValue::CellTag));
 
     // First, handle JSCell cases - check MasqueradesAsUndefined bit on the structure.
-    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), regT2);
-    addJump(branchTest8(Zero, Address(regT2, OBJECT_OFFSETOF(Structure, m_typeInfo.m_flags)), Imm32(MasqueradesAsUndefined)), target);
+    loadPtr(Address(regT0, JSCell::structureOffset()), regT2);
+    addJump(branchTest8(Zero, Address(regT2, Structure::typeInfoFlagsOffset()), TrustedImm32(MasqueradesAsUndefined)), target);
 
     Jump wasNotImmediate = jump();
 
@@ -973,7 +971,7 @@ void JIT::emit_op_jneq_null(Instruction* currentInstruction)
     isImmediate.link(this);
 
     ASSERT((JSValue::UndefinedTag + 1 == JSValue::NullTag) && !(JSValue::NullTag + 1));
-    addJump(branch32(Below, regT1, Imm32(JSValue::UndefinedTag)), target);
+    addJump(branch32(Below, regT1, TrustedImm32(JSValue::UndefinedTag)), target);
 
     wasNotImmediate.link(this);
 }
@@ -981,19 +979,19 @@ void JIT::emit_op_jneq_null(Instruction* currentInstruction)
 void JIT::emit_op_jneq_ptr(Instruction* currentInstruction)
 {
     unsigned src = currentInstruction[1].u.operand;
-    JSCell* ptr = currentInstruction[2].u.jsCell;
+    JSCell* ptr = currentInstruction[2].u.jsCell.get();
     unsigned target = currentInstruction[3].u.operand;
 
     emitLoad(src, regT1, regT0);
-    addJump(branch32(NotEqual, regT1, Imm32(JSValue::CellTag)), target);
-    addJump(branchPtr(NotEqual, regT0, ImmPtr(ptr)), target);
+    addJump(branch32(NotEqual, regT1, TrustedImm32(JSValue::CellTag)), target);
+    addJump(branchPtr(NotEqual, regT0, TrustedImmPtr(ptr)), target);
 }
 
 void JIT::emit_op_jsr(Instruction* currentInstruction)
 {
     int retAddrDst = currentInstruction[1].u.operand;
     int target = currentInstruction[2].u.operand;
-    DataLabelPtr storeLocation = storePtrWithPatch(ImmPtr(0), Address(callFrameRegister, sizeof(Register) * retAddrDst));
+    DataLabelPtr storeLocation = storePtrWithPatch(TrustedImmPtr(0), Address(callFrameRegister, sizeof(Register) * retAddrDst));
     addJump(jump(), target);
     m_jsrSites.append(JSRInfo(storeLocation, label()));
 }
@@ -1011,11 +1009,11 @@ void JIT::emit_op_eq(Instruction* currentInstruction)
 
     emitLoad2(src1, regT1, regT0, src2, regT3, regT2);
     addSlowCase(branch32(NotEqual, regT1, regT3));
-    addSlowCase(branch32(Equal, regT1, Imm32(JSValue::CellTag)));
-    addSlowCase(branch32(Below, regT1, Imm32(JSValue::LowestTag)));
+    addSlowCase(branch32(Equal, regT1, TrustedImm32(JSValue::CellTag)));
+    addSlowCase(branch32(Below, regT1, TrustedImm32(JSValue::LowestTag)));
 
     set8Compare32(Equal, regT0, regT2, regT0);
-    or32(Imm32(JSValue::FalseTag), regT0);
+    or32(TrustedImm32(JSValue::FalseTag), regT0);
 
     emitStoreBool(dst, regT0);
 }
@@ -1032,8 +1030,8 @@ void JIT::emitSlow_op_eq(Instruction* currentInstruction, Vector<SlowCaseEntry>:
     genericCase.append(getSlowCase(iter)); // tags not equal
 
     linkSlowCase(iter); // tags equal and JSCell
-    genericCase.append(branchPtr(NotEqual, Address(regT0), ImmPtr(m_globalData->jsStringVPtr)));
-    genericCase.append(branchPtr(NotEqual, Address(regT2), ImmPtr(m_globalData->jsStringVPtr)));
+    genericCase.append(branchPtr(NotEqual, Address(regT0), TrustedImmPtr(m_globalData->jsStringVPtr)));
+    genericCase.append(branchPtr(NotEqual, Address(regT2), TrustedImmPtr(m_globalData->jsStringVPtr)));
 
     // String case.
     JITStubCall stubCallEqStrings(this, cti_op_eq_strings);
@@ -1051,7 +1049,7 @@ void JIT::emitSlow_op_eq(Instruction* currentInstruction, Vector<SlowCaseEntry>:
     stubCallEq.call(regT0);
 
     storeResult.link(this);
-    or32(Imm32(JSValue::FalseTag), regT0);
+    or32(TrustedImm32(JSValue::FalseTag), regT0);
     emitStoreBool(dst, regT0);
 }
 
@@ -1063,11 +1061,11 @@ void JIT::emit_op_neq(Instruction* currentInstruction)
 
     emitLoad2(src1, regT1, regT0, src2, regT3, regT2);
     addSlowCase(branch32(NotEqual, regT1, regT3));
-    addSlowCase(branch32(Equal, regT1, Imm32(JSValue::CellTag)));
-    addSlowCase(branch32(Below, regT1, Imm32(JSValue::LowestTag)));
+    addSlowCase(branch32(Equal, regT1, TrustedImm32(JSValue::CellTag)));
+    addSlowCase(branch32(Below, regT1, TrustedImm32(JSValue::LowestTag)));
 
     set8Compare32(NotEqual, regT0, regT2, regT0);
-    or32(Imm32(JSValue::FalseTag), regT0);
+    or32(TrustedImm32(JSValue::FalseTag), regT0);
 
     emitStoreBool(dst, regT0);
 }
@@ -1082,8 +1080,8 @@ void JIT::emitSlow_op_neq(Instruction* currentInstruction, Vector<SlowCaseEntry>
     genericCase.append(getSlowCase(iter)); // tags not equal
 
     linkSlowCase(iter); // tags equal and JSCell
-    genericCase.append(branchPtr(NotEqual, Address(regT0), ImmPtr(m_globalData->jsStringVPtr)));
-    genericCase.append(branchPtr(NotEqual, Address(regT2), ImmPtr(m_globalData->jsStringVPtr)));
+    genericCase.append(branchPtr(NotEqual, Address(regT0), TrustedImmPtr(m_globalData->jsStringVPtr)));
+    genericCase.append(branchPtr(NotEqual, Address(regT2), TrustedImmPtr(m_globalData->jsStringVPtr)));
 
     // String case.
     JITStubCall stubCallEqStrings(this, cti_op_eq_strings);
@@ -1101,8 +1099,8 @@ void JIT::emitSlow_op_neq(Instruction* currentInstruction, Vector<SlowCaseEntry>
     stubCallEq.call(regT0);
 
     storeResult.link(this);
-    xor32(Imm32(0x1), regT0);
-    or32(Imm32(JSValue::FalseTag), regT0);
+    xor32(TrustedImm32(0x1), regT0);
+    or32(TrustedImm32(JSValue::FalseTag), regT0);
     emitStoreBool(dst, regT0);
 }
 
@@ -1119,15 +1117,15 @@ void JIT::compileOpStrictEq(Instruction* currentInstruction, CompileOpStrictEqTy
     // cells and/or Int32s.
     move(regT0, regT2);
     and32(regT1, regT2);
-    addSlowCase(branch32(Below, regT2, Imm32(JSValue::LowestTag)));
-    addSlowCase(branch32(AboveOrEqual, regT2, Imm32(JSValue::CellTag)));
+    addSlowCase(branch32(Below, regT2, TrustedImm32(JSValue::LowestTag)));
+    addSlowCase(branch32(AboveOrEqual, regT2, TrustedImm32(JSValue::CellTag)));
 
     if (type == OpStrictEq)
         set8Compare32(Equal, regT0, regT1, regT0);
     else
         set8Compare32(NotEqual, regT0, regT1, regT0);
 
-    or32(Imm32(JSValue::FalseTag), regT0);
+    or32(TrustedImm32(JSValue::FalseTag), regT0);
 
     emitStoreBool(dst, regT0);
 }
@@ -1178,22 +1176,22 @@ void JIT::emit_op_eq_null(Instruction* currentInstruction)
     unsigned src = currentInstruction[2].u.operand;
 
     emitLoad(src, regT1, regT0);
-    Jump isImmediate = branch32(NotEqual, regT1, Imm32(JSValue::CellTag));
+    Jump isImmediate = branch32(NotEqual, regT1, TrustedImm32(JSValue::CellTag));
 
-    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), regT1);
-    set32Test8(NonZero, Address(regT1, OBJECT_OFFSETOF(Structure, m_typeInfo.m_flags)), Imm32(MasqueradesAsUndefined), regT1);
+    loadPtr(Address(regT0, JSCell::structureOffset()), regT1);
+    set32Test8(NonZero, Address(regT1, Structure::typeInfoFlagsOffset()), TrustedImm32(MasqueradesAsUndefined), regT1);
 
     Jump wasNotImmediate = jump();
 
     isImmediate.link(this);
 
-    set8Compare32(Equal, regT1, Imm32(JSValue::NullTag), regT2);
-    set8Compare32(Equal, regT1, Imm32(JSValue::UndefinedTag), regT1);
+    set8Compare32(Equal, regT1, TrustedImm32(JSValue::NullTag), regT2);
+    set8Compare32(Equal, regT1, TrustedImm32(JSValue::UndefinedTag), regT1);
     or32(regT2, regT1);
 
     wasNotImmediate.link(this);
 
-    or32(Imm32(JSValue::FalseTag), regT1);
+    or32(TrustedImm32(JSValue::FalseTag), regT1);
 
     emitStoreBool(dst, regT1);
 }
@@ -1204,22 +1202,22 @@ void JIT::emit_op_neq_null(Instruction* currentInstruction)
     unsigned src = currentInstruction[2].u.operand;
 
     emitLoad(src, regT1, regT0);
-    Jump isImmediate = branch32(NotEqual, regT1, Imm32(JSValue::CellTag));
+    Jump isImmediate = branch32(NotEqual, regT1, TrustedImm32(JSValue::CellTag));
 
-    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), regT1);
-    set32Test8(Zero, Address(regT1, OBJECT_OFFSETOF(Structure, m_typeInfo.m_flags)), Imm32(MasqueradesAsUndefined), regT1);
+    loadPtr(Address(regT0, JSCell::structureOffset()), regT1);
+    set32Test8(Zero, Address(regT1, Structure::typeInfoFlagsOffset()), TrustedImm32(MasqueradesAsUndefined), regT1);
 
     Jump wasNotImmediate = jump();
 
     isImmediate.link(this);
 
-    set8Compare32(NotEqual, regT1, Imm32(JSValue::NullTag), regT2);
-    set8Compare32(NotEqual, regT1, Imm32(JSValue::UndefinedTag), regT1);
+    set8Compare32(NotEqual, regT1, TrustedImm32(JSValue::NullTag), regT2);
+    set8Compare32(NotEqual, regT1, TrustedImm32(JSValue::UndefinedTag), regT1);
     and32(regT2, regT1);
 
     wasNotImmediate.link(this);
 
-    or32(Imm32(JSValue::FalseTag), regT1);
+    or32(TrustedImm32(JSValue::FalseTag), regT1);
 
     emitStoreBool(dst, regT1);
 }
@@ -1227,7 +1225,7 @@ void JIT::emit_op_neq_null(Instruction* currentInstruction)
 void JIT::emit_op_resolve_with_base(Instruction* currentInstruction)
 {
     JITStubCall stubCall(this, cti_op_resolve_with_base);
-    stubCall.addArgument(ImmPtr(&m_codeBlock->identifier(currentInstruction[3].u.operand)));
+    stubCall.addArgument(TrustedImmPtr(&m_codeBlock->identifier(currentInstruction[3].u.operand)));
     stubCall.addArgument(Imm32(currentInstruction[1].u.operand));
     stubCall.call(currentInstruction[2].u.operand);
 }
@@ -1235,7 +1233,7 @@ void JIT::emit_op_resolve_with_base(Instruction* currentInstruction)
 void JIT::emit_op_new_func_exp(Instruction* currentInstruction)
 {
     JITStubCall stubCall(this, cti_op_new_func_exp);
-    stubCall.addArgument(ImmPtr(m_codeBlock->functionExpr(currentInstruction[2].u.operand)));
+    stubCall.addArgument(TrustedImmPtr(m_codeBlock->functionExpr(currentInstruction[2].u.operand)));
     stubCall.call(currentInstruction[1].u.operand);
 }
 
@@ -1265,10 +1263,10 @@ void JIT::emit_op_get_pnames(Instruction* currentInstruction)
 
     emitLoad(base, regT1, regT0);
     if (!m_codeBlock->isKnownNotImmediate(base))
-        isNotObject.append(branch32(NotEqual, regT1, Imm32(JSValue::CellTag)));
+        isNotObject.append(branch32(NotEqual, regT1, TrustedImm32(JSValue::CellTag)));
     if (base != m_codeBlock->thisRegister() || m_codeBlock->isStrictMode()) {
-        loadPtr(Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), regT2);
-        isNotObject.append(branch8(NotEqual, Address(regT2, OBJECT_OFFSETOF(Structure, m_typeInfo.m_type)), Imm32(ObjectType)));
+        loadPtr(Address(regT0, JSCell::structureOffset()), regT2);
+        isNotObject.append(branch8(NotEqual, Address(regT2, Structure::typeInfoTypeOffset()), TrustedImm32(ObjectType)));
     }
 
     // We could inline the case where you have a valid cache, but
@@ -1278,13 +1276,15 @@ void JIT::emit_op_get_pnames(Instruction* currentInstruction)
     getPnamesStubCall.addArgument(regT0);
     getPnamesStubCall.call(dst);
     load32(Address(regT0, OBJECT_OFFSETOF(JSPropertyNameIterator, m_jsStringsSize)), regT3);
-    store32(Imm32(0), addressFor(i));
-    store32(regT3, addressFor(size));
+    store32(TrustedImm32(Int32Tag), intTagFor(i));
+    store32(TrustedImm32(0), intPayloadFor(i));
+    store32(TrustedImm32(Int32Tag), intTagFor(size));
+    store32(regT3, payloadFor(size));
     Jump end = jump();
 
     isNotObject.link(this);
-    addJump(branch32(Equal, regT1, Imm32(JSValue::NullTag)), breakTarget);
-    addJump(branch32(Equal, regT1, Imm32(JSValue::UndefinedTag)), breakTarget);
+    addJump(branch32(Equal, regT1, TrustedImm32(JSValue::NullTag)), breakTarget);
+    addJump(branch32(Equal, regT1, TrustedImm32(JSValue::UndefinedTag)), breakTarget);
     JITStubCall toObjectStubCall(this, cti_to_object);
     toObjectStubCall.addArgument(regT1, regT0);
     toObjectStubCall.call(base);
@@ -1305,25 +1305,25 @@ void JIT::emit_op_next_pname(Instruction* currentInstruction)
     JumpList callHasProperty;
 
     Label begin(this);
-    load32(addressFor(i), regT0);
-    Jump end = branch32(Equal, regT0, addressFor(size));
+    load32(intPayloadFor(i), regT0);
+    Jump end = branch32(Equal, regT0, intPayloadFor(size));
 
     // Grab key @ i
-    loadPtr(addressFor(it), regT1);
+    loadPtr(payloadFor(it), regT1);
     loadPtr(Address(regT1, OBJECT_OFFSETOF(JSPropertyNameIterator, m_jsStrings)), regT2);
     load32(BaseIndex(regT2, regT0, TimesEight), regT2);
-    store32(Imm32(JSValue::CellTag), tagFor(dst));
+    store32(TrustedImm32(JSValue::CellTag), tagFor(dst));
     store32(regT2, payloadFor(dst));
 
     // Increment i
-    add32(Imm32(1), regT0);
-    store32(regT0, addressFor(i));
+    add32(TrustedImm32(1), regT0);
+    store32(regT0, intPayloadFor(i));
 
     // Verify that i is valid:
-    loadPtr(addressFor(base), regT0);
+    loadPtr(payloadFor(base), regT0);
 
     // Test base's structure
-    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), regT2);
+    loadPtr(Address(regT0, JSCell::structureOffset()), regT2);
     callHasProperty.append(branchPtr(NotEqual, regT2, Address(Address(regT1, OBJECT_OFFSETOF(JSPropertyNameIterator, m_cachedStructure)))));
 
     // Test base's prototype chain
@@ -1332,11 +1332,11 @@ void JIT::emit_op_next_pname(Instruction* currentInstruction)
     addJump(branchTestPtr(Zero, Address(regT3)), target);
 
     Label checkPrototype(this);
-    callHasProperty.append(branch32(Equal, Address(regT2, OBJECT_OFFSETOF(Structure, m_prototype) + OBJECT_OFFSETOF(JSValue, u.asBits.tag)), Imm32(JSValue::NullTag)));
-    loadPtr(Address(regT2, OBJECT_OFFSETOF(Structure, m_prototype) + OBJECT_OFFSETOF(JSValue, u.asBits.payload)), regT2);
-    loadPtr(Address(regT2, OBJECT_OFFSETOF(JSCell, m_structure)), regT2);
+    callHasProperty.append(branch32(Equal, Address(regT2, Structure::prototypeOffset() + OBJECT_OFFSETOF(JSValue, u.asBits.tag)), TrustedImm32(JSValue::NullTag)));
+    loadPtr(Address(regT2, Structure::prototypeOffset() + OBJECT_OFFSETOF(JSValue, u.asBits.payload)), regT2);
+    loadPtr(Address(regT2, JSCell::structureOffset()), regT2);
     callHasProperty.append(branchPtr(NotEqual, regT2, Address(regT3)));
-    addPtr(Imm32(sizeof(Structure*)), regT3);
+    addPtr(TrustedImm32(sizeof(Structure*)), regT3);
     branchTestPtr(NonZero, Address(regT3)).linkTo(checkPrototype, this);
 
     // Continue loop.
@@ -1377,8 +1377,8 @@ void JIT::emit_op_to_jsnumber(Instruction* currentInstruction)
 
     emitLoad(src, regT1, regT0);
 
-    Jump isInt32 = branch32(Equal, regT1, Imm32(JSValue::Int32Tag));
-    addSlowCase(branch32(AboveOrEqual, regT1, Imm32(JSValue::EmptyValueTag)));
+    Jump isInt32 = branch32(Equal, regT1, TrustedImm32(JSValue::Int32Tag));
+    addSlowCase(branch32(AboveOrEqual, regT1, TrustedImm32(JSValue::EmptyValueTag)));
     isInt32.link(this);
 
     if (src != dst)
@@ -1400,7 +1400,7 @@ void JIT::emitSlow_op_to_jsnumber(Instruction* currentInstruction, Vector<SlowCa
 void JIT::emit_op_push_new_scope(Instruction* currentInstruction)
 {
     JITStubCall stubCall(this, cti_op_push_new_scope);
-    stubCall.addArgument(ImmPtr(&m_codeBlock->identifier(currentInstruction[2].u.operand)));
+    stubCall.addArgument(TrustedImmPtr(&m_codeBlock->identifier(currentInstruction[2].u.operand)));
     stubCall.addArgument(currentInstruction[3].u.operand);
     stubCall.call(currentInstruction[1].u.operand);
 }
@@ -1414,8 +1414,8 @@ void JIT::emit_op_catch(Instruction* currentInstruction)
     loadPtr(Address(stackPointerRegister, OBJECT_OFFSETOF(struct JITStackFrame, globalData)), regT3);
     load32(Address(regT3, OBJECT_OFFSETOF(JSGlobalData, exception) + OBJECT_OFFSETOF(JSValue, u.asBits.payload)), regT0);
     load32(Address(regT3, OBJECT_OFFSETOF(JSGlobalData, exception) + OBJECT_OFFSETOF(JSValue, u.asBits.tag)), regT1);
-    store32(Imm32(JSValue().payload()), Address(regT3, OBJECT_OFFSETOF(JSGlobalData, exception) + OBJECT_OFFSETOF(JSValue, u.asBits.payload)));
-    store32(Imm32(JSValue().tag()), Address(regT3, OBJECT_OFFSETOF(JSGlobalData, exception) + OBJECT_OFFSETOF(JSValue, u.asBits.tag)));
+    store32(TrustedImm32(JSValue().payload()), Address(regT3, OBJECT_OFFSETOF(JSGlobalData, exception) + OBJECT_OFFSETOF(JSValue, u.asBits.payload)));
+    store32(TrustedImm32(JSValue().tag()), Address(regT3, OBJECT_OFFSETOF(JSGlobalData, exception) + OBJECT_OFFSETOF(JSValue, u.asBits.tag)));
 
     unsigned exception = currentInstruction[1].u.operand;
     emitStore(exception, regT1, regT0);
@@ -1520,7 +1520,7 @@ void JIT::emit_op_create_activation(Instruction* currentInstruction)
 {
     unsigned activation = currentInstruction[1].u.operand;
     
-    Jump activationCreated = branch32(NotEqual, tagFor(activation), Imm32(JSValue::EmptyValueTag));
+    Jump activationCreated = branch32(NotEqual, tagFor(activation), TrustedImm32(JSValue::EmptyValueTag));
     JITStubCall(this, cti_op_push_activation).call(activation);
     activationCreated.link(this);
 }
@@ -1529,7 +1529,7 @@ void JIT::emit_op_create_arguments(Instruction* currentInstruction)
 {
     unsigned dst = currentInstruction[1].u.operand;
 
-    Jump argsCreated = branch32(NotEqual, tagFor(dst), Imm32(JSValue::EmptyValueTag));
+    Jump argsCreated = branch32(NotEqual, tagFor(dst), TrustedImm32(JSValue::EmptyValueTag));
 
     if (m_codeBlock->m_numParameters == 1)
         JITStubCall(this, cti_op_create_arguments_no_params).call();
@@ -1571,10 +1571,10 @@ void JIT::emit_op_convert_this(Instruction* currentInstruction)
 
     emitLoad(thisRegister, regT1, regT0);
 
-    addSlowCase(branch32(NotEqual, regT1, Imm32(JSValue::CellTag)));
+    addSlowCase(branch32(NotEqual, regT1, TrustedImm32(JSValue::CellTag)));
 
-    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), regT2);
-    addSlowCase(branchTest8(NonZero, Address(regT2, OBJECT_OFFSETOF(Structure, m_typeInfo.m_flags)), Imm32(NeedsThisConversion)));
+    loadPtr(Address(regT0, JSCell::structureOffset()), regT2);
+    addSlowCase(branchTest8(NonZero, Address(regT2, Structure::typeInfoFlagsOffset()), TrustedImm32(NeedsThisConversion)));
 
     map(m_bytecodeOffset + OPCODE_LENGTH(op_convert_this), thisRegister, regT1, regT0);
 }
@@ -1585,14 +1585,14 @@ void JIT::emit_op_convert_this_strict(Instruction* currentInstruction)
     
     emitLoad(thisRegister, regT1, regT0);
     
-    Jump notNull = branch32(NotEqual, regT1, Imm32(JSValue::EmptyValueTag));
+    Jump notNull = branch32(NotEqual, regT1, TrustedImm32(JSValue::EmptyValueTag));
     emitStore(thisRegister, jsNull());
     Jump setThis = jump();
     notNull.link(this);
-    Jump isImmediate = branch32(NotEqual, regT1, Imm32(JSValue::CellTag));
-    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), regT2);
-    Jump notAnObject = branch8(NotEqual, Address(regT2, OBJECT_OFFSETOF(Structure, m_typeInfo.m_type)), Imm32(ObjectType));
-    addSlowCase(branchTest8(NonZero, Address(regT2, OBJECT_OFFSETOF(Structure, m_typeInfo.m_flags)), Imm32(NeedsThisConversion)));
+    Jump isImmediate = branch32(NotEqual, regT1, TrustedImm32(JSValue::CellTag));
+    loadPtr(Address(regT0, JSCell::structureOffset()), regT2);
+    Jump notAnObject = branch8(NotEqual, Address(regT2, Structure::typeInfoTypeOffset()), TrustedImm32(ObjectType));
+    addSlowCase(branchTest8(NonZero, Address(regT2, Structure::typeInfoFlagsOffset()), TrustedImm32(NeedsThisConversion)));
     isImmediate.link(this);
     notAnObject.link(this);
     setThis.link(this);
@@ -1648,9 +1648,9 @@ void JIT::emit_op_get_arguments_length(Instruction* currentInstruction)
 {
     int dst = currentInstruction[1].u.operand;
     int argumentsRegister = currentInstruction[2].u.operand;
-    addSlowCase(branch32(NotEqual, tagFor(argumentsRegister), Imm32(JSValue::EmptyValueTag)));
+    addSlowCase(branch32(NotEqual, tagFor(argumentsRegister), TrustedImm32(JSValue::EmptyValueTag)));
     emitGetFromCallFrameHeader32(RegisterFile::ArgumentCount, regT0);
-    sub32(Imm32(1), regT0);
+    sub32(TrustedImm32(1), regT0);
     emitStoreInt32(dst, regT0);
 }
 
@@ -1663,7 +1663,7 @@ void JIT::emitSlow_op_get_arguments_length(Instruction* currentInstruction, Vect
     
     JITStubCall stubCall(this, cti_op_get_by_id_generic);
     stubCall.addArgument(base);
-    stubCall.addArgument(ImmPtr(&(m_codeBlock->identifier(ident))));
+    stubCall.addArgument(TrustedImmPtr(&(m_codeBlock->identifier(ident))));
     stubCall.call(dst);
 }
 
@@ -1672,10 +1672,10 @@ void JIT::emit_op_get_argument_by_val(Instruction* currentInstruction)
     int dst = currentInstruction[1].u.operand;
     int argumentsRegister = currentInstruction[2].u.operand;
     int property = currentInstruction[3].u.operand;
-    addSlowCase(branch32(NotEqual, tagFor(argumentsRegister), Imm32(JSValue::EmptyValueTag)));
+    addSlowCase(branch32(NotEqual, tagFor(argumentsRegister), TrustedImm32(JSValue::EmptyValueTag)));
     emitLoad(property, regT1, regT2);
-    addSlowCase(branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag)));
-    add32(Imm32(1), regT2);
+    addSlowCase(branch32(NotEqual, regT1, TrustedImm32(JSValue::Int32Tag)));
+    add32(TrustedImm32(1), regT2);
     // regT2 now contains the integer index of the argument we want, including this
     emitGetFromCallFrameHeader32(RegisterFile::ArgumentCount, regT3);
     addSlowCase(branch32(AboveOrEqual, regT2, regT3));
@@ -1692,7 +1692,7 @@ void JIT::emit_op_get_argument_by_val(Instruction* currentInstruction)
     }
 
     addPtr(Imm32(static_cast<unsigned>(-(RegisterFile::CallFrameHeaderSize + numArgs) * sizeof(Register))), callFrameRegister, regT1);
-    mul32(Imm32(sizeof(Register)), regT3, regT3);
+    mul32(TrustedImm32(sizeof(Register)), regT3, regT3);
     subPtr(regT3, regT1);
     loadPtr(BaseIndex(regT1, regT2, TimesEight, OBJECT_OFFSETOF(JSValue, u.asBits.payload)), regT0);
     loadPtr(BaseIndex(regT1, regT2, TimesEight, OBJECT_OFFSETOF(JSValue, u.asBits.tag)), regT1);
@@ -1734,17 +1734,17 @@ void JIT::softModulo()
     push(regT3);
     move(regT2, regT3);
     move(regT0, regT2);
-    move(Imm32(0), regT1);
+    move(TrustedImm32(0), regT1);
 
     // Check for negative result reminder
-    Jump positiveRegT3 = branch32(GreaterThanOrEqual, regT3, Imm32(0));
+    Jump positiveRegT3 = branch32(GreaterThanOrEqual, regT3, TrustedImm32(0));
     neg32(regT3);
-    xor32(Imm32(1), regT1);
+    xor32(TrustedImm32(1), regT1);
     positiveRegT3.link(this);
 
-    Jump positiveRegT2 = branch32(GreaterThanOrEqual, regT2, Imm32(0));
+    Jump positiveRegT2 = branch32(GreaterThanOrEqual, regT2, TrustedImm32(0));
     neg32(regT2);
-    xor32(Imm32(2), regT1);
+    xor32(TrustedImm32(2), regT1);
     positiveRegT2.link(this);
 
     // Save the condition for negative reminder
@@ -1754,7 +1754,7 @@ void JIT::softModulo()
 
     // Power of two fast case
     move(regT3, regT0);
-    sub32(Imm32(1), regT0);
+    sub32(TrustedImm32(1), regT0);
     Jump powerOfTwo = branchTest32(NotEqual, regT0, regT3);
     and32(regT0, regT2);
     powerOfTwo.link(this);
@@ -1767,10 +1767,10 @@ void JIT::softModulo()
     countLeadingZeros32(regT3, regT1);
     sub32(regT0, regT1);
 
-    Jump useFullTable = branch32(Equal, regT1, Imm32(31));
+    Jump useFullTable = branch32(Equal, regT1, TrustedImm32(31));
 
     neg32(regT1);
-    add32(Imm32(31), regT1);
+    add32(TrustedImm32(31), regT1);
 
     int elementSizeByShift = -1;
 #if CPU(ARM)
@@ -1805,7 +1805,7 @@ void JIT::softModulo()
 
     // Check for negative reminder
     pop(regT1);
-    Jump positiveResult = branch32(Equal, regT1, Imm32(0));
+    Jump positiveResult = branch32(Equal, regT1, TrustedImm32(0));
     neg32(regT2);
     positiveResult.link(this);
 
diff --git a/Source/JavaScriptCore/jit/JITPropertyAccess.cpp b/Source/JavaScriptCore/jit/JITPropertyAccess.cpp
index b497319..68f8dda 100644
--- a/Source/JavaScriptCore/jit/JITPropertyAccess.cpp
+++ b/Source/JavaScriptCore/jit/JITPropertyAccess.cpp
@@ -54,7 +54,7 @@ JIT::CodePtr JIT::stringGetByValStubGenerator(JSGlobalData* globalData, Executab
 {
     JSInterfaceJIT jit;
     JumpList failures;
-    failures.append(jit.branchPtr(NotEqual, Address(regT0), ImmPtr(globalData->jsStringVPtr)));
+    failures.append(jit.branchPtr(NotEqual, Address(regT0), TrustedImmPtr(globalData->jsStringVPtr)));
     failures.append(jit.branchTest32(NonZero, Address(regT0, OBJECT_OFFSETOF(JSString, m_fiberCount))));
 
     // Load string length to regT1, and start the process of loading the data pointer into regT0
@@ -68,13 +68,13 @@ JIT::CodePtr JIT::stringGetByValStubGenerator(JSGlobalData* globalData, Executab
     // Load the character
     jit.load16(BaseIndex(regT0, regT1, TimesTwo, 0), regT0);
     
-    failures.append(jit.branch32(AboveOrEqual, regT0, Imm32(0x100)));
-    jit.move(ImmPtr(globalData->smallStrings.singleCharacterStrings()), regT1);
+    failures.append(jit.branch32(AboveOrEqual, regT0, TrustedImm32(0x100)));
+    jit.move(TrustedImmPtr(globalData->smallStrings.singleCharacterStrings()), regT1);
     jit.loadPtr(BaseIndex(regT1, regT0, ScalePtr, 0), regT0);
     jit.ret();
     
     failures.link(&jit);
-    jit.move(Imm32(0), regT0);
+    jit.move(TrustedImm32(0), regT0);
     jit.ret();
     
     LinkBuffer patchBuffer(&jit, pool, 0);
@@ -99,10 +99,10 @@ void JIT::emit_op_get_by_val(Instruction* currentInstruction)
     zeroExtend32ToPtr(regT1, regT1);
 
     emitJumpSlowCaseIfNotJSCell(regT0, base);
-    addSlowCase(branchPtr(NotEqual, Address(regT0), ImmPtr(m_globalData->jsArrayVPtr)));
+    addSlowCase(branchPtr(NotEqual, Address(regT0), TrustedImmPtr(m_globalData->jsArrayVPtr)));
 
-    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSArray, m_storage)), regT2);
-    addSlowCase(branch32(AboveOrEqual, regT1, Address(regT0, OBJECT_OFFSETOF(JSArray, m_vectorLength))));
+    loadPtr(Address(regT0, JSArray::storageOffset()), regT2);
+    addSlowCase(branch32(AboveOrEqual, regT1, Address(regT0, JSArray::vectorLengthOffset())));
 
     loadPtr(BaseIndex(regT2, regT1, ScalePtr, OBJECT_OFFSETOF(ArrayStorage, m_vector[0])), regT0);
     addSlowCase(branchTestPtr(Zero, regT0));
@@ -120,7 +120,7 @@ void JIT::emitSlow_op_get_by_val(Instruction* currentInstruction, Vector<SlowCas
     linkSlowCaseIfNotJSCell(iter, base); // base cell check
     Jump nonCell = jump();
     linkSlowCase(iter); // base array check
-    Jump notString = branchPtr(NotEqual, Address(regT0), ImmPtr(m_globalData->jsStringVPtr));
+    Jump notString = branchPtr(NotEqual, Address(regT0), TrustedImmPtr(m_globalData->jsStringVPtr));
     emitNakedCall(m_globalData->getCTIStub(stringGetByValStubGenerator));
     Jump failed = branchTestPtr(Zero, regT0);
     emitPutVirtualRegister(dst, regT0);
@@ -159,10 +159,10 @@ void JIT::emit_op_get_by_pname(Instruction* currentInstruction)
     emitJumpSlowCaseIfNotJSCell(regT0, base);
 
     // Test base's structure
-    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), regT2);
+    loadPtr(Address(regT0, JSCell::structureOffset()), regT2);
     addSlowCase(branchPtr(NotEqual, regT2, Address(regT1, OBJECT_OFFSETOF(JSPropertyNameIterator, m_cachedStructure))));
     load32(addressFor(i), regT3);
-    sub32(Imm32(1), regT3);
+    sub32(TrustedImm32(1), regT3);
     addSlowCase(branch32(AboveOrEqual, regT3, Address(regT1, OBJECT_OFFSETOF(JSPropertyNameIterator, m_numCacheableSlots))));
     compileGetDirectOffset(regT0, regT0, regT3, regT1);
 
@@ -197,10 +197,10 @@ void JIT::emit_op_put_by_val(Instruction* currentInstruction)
     // See comment in op_get_by_val.
     zeroExtend32ToPtr(regT1, regT1);
     emitJumpSlowCaseIfNotJSCell(regT0, base);
-    addSlowCase(branchPtr(NotEqual, Address(regT0), ImmPtr(m_globalData->jsArrayVPtr)));
-    addSlowCase(branch32(AboveOrEqual, regT1, Address(regT0, OBJECT_OFFSETOF(JSArray, m_vectorLength))));
+    addSlowCase(branchPtr(NotEqual, Address(regT0), TrustedImmPtr(m_globalData->jsArrayVPtr)));
+    addSlowCase(branch32(AboveOrEqual, regT1, Address(regT0, JSArray::vectorLengthOffset())));
 
-    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSArray, m_storage)), regT2);
+    loadPtr(Address(regT0, JSArray::storageOffset()), regT2);
     Jump empty = branchTestPtr(Zero, BaseIndex(regT2, regT1, ScalePtr, OBJECT_OFFSETOF(ArrayStorage, m_vector[0])));
 
     Label storeResult(this);
@@ -209,11 +209,11 @@ void JIT::emit_op_put_by_val(Instruction* currentInstruction)
     Jump end = jump();
     
     empty.link(this);
-    add32(Imm32(1), Address(regT2, OBJECT_OFFSETOF(ArrayStorage, m_numValuesInVector)));
+    add32(TrustedImm32(1), Address(regT2, OBJECT_OFFSETOF(ArrayStorage, m_numValuesInVector)));
     branch32(Below, regT1, Address(regT2, OBJECT_OFFSETOF(ArrayStorage, m_length))).linkTo(storeResult, this);
 
     move(regT1, regT0);
-    add32(Imm32(1), regT0);
+    add32(TrustedImm32(1), regT0);
     store32(regT0, Address(regT2, OBJECT_OFFSETOF(ArrayStorage, m_length)));
     jump().linkTo(storeResult, this);
 
@@ -224,7 +224,7 @@ void JIT::emit_op_put_by_index(Instruction* currentInstruction)
 {
     JITStubCall stubCall(this, cti_op_put_by_index);
     stubCall.addArgument(currentInstruction[1].u.operand, regT2);
-    stubCall.addArgument(Imm32(currentInstruction[2].u.operand));
+    stubCall.addArgument(TrustedImm32(currentInstruction[2].u.operand));
     stubCall.addArgument(currentInstruction[3].u.operand, regT2);
     stubCall.call();
 }
@@ -233,7 +233,7 @@ void JIT::emit_op_put_getter(Instruction* currentInstruction)
 {
     JITStubCall stubCall(this, cti_op_put_getter);
     stubCall.addArgument(currentInstruction[1].u.operand, regT2);
-    stubCall.addArgument(ImmPtr(&m_codeBlock->identifier(currentInstruction[2].u.operand)));
+    stubCall.addArgument(TrustedImmPtr(&m_codeBlock->identifier(currentInstruction[2].u.operand)));
     stubCall.addArgument(currentInstruction[3].u.operand, regT2);
     stubCall.call();
 }
@@ -242,7 +242,7 @@ void JIT::emit_op_put_setter(Instruction* currentInstruction)
 {
     JITStubCall stubCall(this, cti_op_put_setter);
     stubCall.addArgument(currentInstruction[1].u.operand, regT2);
-    stubCall.addArgument(ImmPtr(&m_codeBlock->identifier(currentInstruction[2].u.operand)));
+    stubCall.addArgument(TrustedImmPtr(&m_codeBlock->identifier(currentInstruction[2].u.operand)));
     stubCall.addArgument(currentInstruction[3].u.operand, regT2);
     stubCall.call();
 }
@@ -251,7 +251,7 @@ void JIT::emit_op_del_by_id(Instruction* currentInstruction)
 {
     JITStubCall stubCall(this, cti_op_del_by_id);
     stubCall.addArgument(currentInstruction[2].u.operand, regT2);
-    stubCall.addArgument(ImmPtr(&m_codeBlock->identifier(currentInstruction[3].u.operand)));
+    stubCall.addArgument(TrustedImmPtr(&m_codeBlock->identifier(currentInstruction[3].u.operand)));
     stubCall.call(currentInstruction[1].u.operand);
 }
 
@@ -276,7 +276,7 @@ void JIT::emit_op_get_by_id(Instruction* currentInstruction)
     emitGetVirtualRegister(baseVReg, regT0);
     JITStubCall stubCall(this, cti_op_get_by_id_generic);
     stubCall.addArgument(regT0);
-    stubCall.addArgument(ImmPtr(ident));
+    stubCall.addArgument(TrustedImmPtr(ident));
     stubCall.call(resultVReg);
 
     m_propertyAccessInstructionIndex++;
@@ -298,7 +298,7 @@ void JIT::emit_op_put_by_id(Instruction* currentInstruction)
 
     JITStubCall stubCall(this, direct ? cti_op_put_by_id_direct_generic, cti_op_put_by_id_generic);
     stubCall.addArgument(regT0);
-    stubCall.addArgument(ImmPtr(ident));
+    stubCall.addArgument(TrustedImmPtr(ident));
     stubCall.addArgument(regT1);
     stubCall.call();
 
@@ -336,12 +336,12 @@ void JIT::emit_op_method_check(Instruction* currentInstruction)
 
     BEGIN_UNINTERRUPTED_SEQUENCE(sequenceMethodCheck);
 
-    Jump structureCheck = branchPtrWithPatch(NotEqual, Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), info.structureToCompare, ImmPtr(reinterpret_cast<void*>(patchGetByIdDefaultStructure)));
-    DataLabelPtr protoStructureToCompare, protoObj = moveWithPatch(ImmPtr(0), regT1);
-    Jump protoStructureCheck = branchPtrWithPatch(NotEqual, Address(regT1, OBJECT_OFFSETOF(JSCell, m_structure)), protoStructureToCompare, ImmPtr(reinterpret_cast<void*>(patchGetByIdDefaultStructure)));
+    Jump structureCheck = branchPtrWithPatch(NotEqual, Address(regT0, JSCell::structureOffset()), info.structureToCompare, TrustedImmPtr(reinterpret_cast<void*>(patchGetByIdDefaultStructure)));
+    DataLabelPtr protoStructureToCompare, protoObj = moveWithPatch(TrustedImmPtr(0), regT1);
+    Jump protoStructureCheck = branchPtrWithPatch(NotEqual, Address(regT1, JSCell::structureOffset()), protoStructureToCompare, TrustedImmPtr(reinterpret_cast<void*>(patchGetByIdDefaultStructure)));
 
     // This will be relinked to load the function without doing a load.
-    DataLabelPtr putFunction = moveWithPatch(ImmPtr(0), regT0);
+    DataLabelPtr putFunction = moveWithPatch(TrustedImmPtr(0), regT0);
 
     END_UNINTERRUPTED_SEQUENCE(sequenceMethodCheck);
 
@@ -414,7 +414,7 @@ void JIT::compileGetByIdHotPath(int, int baseVReg, Identifier*, unsigned propert
     m_propertyAccessCompilationInfo[propertyAccessInstructionIndex].hotPathBegin = hotPathBegin;
 
     DataLabelPtr structureToCompare;
-    Jump structureCheck = branchPtrWithPatch(NotEqual, Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), structureToCompare, ImmPtr(reinterpret_cast<void*>(patchGetByIdDefaultStructure)));
+    Jump structureCheck = branchPtrWithPatch(NotEqual, Address(regT0, JSCell::structureOffset()), structureToCompare, TrustedImmPtr(reinterpret_cast<void*>(patchGetByIdDefaultStructure)));
     addSlowCase(structureCheck);
     ASSERT_JIT_OFFSET(differenceBetween(hotPathBegin, structureToCompare), patchOffsetGetByIdStructure);
     ASSERT_JIT_OFFSET(differenceBetween(hotPathBegin, structureCheck), patchOffsetGetByIdBranchToSlowCase)
@@ -457,7 +457,7 @@ void JIT::compileGetByIdSlowCase(int resultVReg, int baseVReg, Identifier* ident
 #endif
     JITStubCall stubCall(this, isMethodCheck ? cti_op_get_by_id_method_check : cti_op_get_by_id);
     stubCall.addArgument(regT0);
-    stubCall.addArgument(ImmPtr(ident));
+    stubCall.addArgument(TrustedImmPtr(ident));
     Call call = stubCall.call(resultVReg);
 
     END_UNINTERRUPTED_SEQUENCE(sequenceGetByIdSlowCase);
@@ -492,7 +492,7 @@ void JIT::emit_op_put_by_id(Instruction* currentInstruction)
 
     // It is important that the following instruction plants a 32bit immediate, in order that it can be patched over.
     DataLabelPtr structureToCompare;
-    addSlowCase(branchPtrWithPatch(NotEqual, Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), structureToCompare, ImmPtr(reinterpret_cast<void*>(patchGetByIdDefaultStructure))));
+    addSlowCase(branchPtrWithPatch(NotEqual, Address(regT0, JSCell::structureOffset()), structureToCompare, TrustedImmPtr(reinterpret_cast<void*>(patchGetByIdDefaultStructure))));
     ASSERT_JIT_OFFSET(differenceBetween(hotPathBegin, structureToCompare), patchOffsetPutByIdStructure);
 
     loadPtr(Address(regT0, OBJECT_OFFSETOF(JSObject, m_propertyStorage)), regT0);
@@ -516,7 +516,7 @@ void JIT::emitSlow_op_put_by_id(Instruction* currentInstruction, Vector<SlowCase
 
     JITStubCall stubCall(this, direct ? cti_op_put_by_id_direct : cti_op_put_by_id);
     stubCall.addArgument(regT0);
-    stubCall.addArgument(ImmPtr(ident));
+    stubCall.addArgument(TrustedImmPtr(ident));
     stubCall.addArgument(regT1);
     Call call = stubCall.call();
 
@@ -564,10 +564,10 @@ void JIT::testPrototype(JSValue prototype, JumpList& failureCases)
     // values.  In the non X86_64 case, the generated code is slightly more efficient because it uses
     // two less instructions and doesn't require any scratch registers.
 #if CPU(X86_64)
-    move(ImmPtr(prototype.asCell()->structure()), regT3);
-    failureCases.append(branchPtr(NotEqual, AbsoluteAddress(&prototype.asCell()->m_structure), regT3));
+    move(TrustedImmPtr(prototype.asCell()->structure()), regT3);
+    failureCases.append(branchPtr(NotEqual, AbsoluteAddress(prototype.asCell()->addressOfStructure()), regT3));
 #else
-    failureCases.append(branchPtr(NotEqual, AbsoluteAddress(&prototype.asCell()->m_structure), ImmPtr(prototype.asCell()->structure())));
+    failureCases.append(branchPtr(NotEqual, AbsoluteAddress(prototype.asCell()->addressOfStructure()), TrustedImmPtr(prototype.asCell()->structure())));
 #endif
 }
 
@@ -576,7 +576,7 @@ void JIT::privateCompilePutByIdTransition(StructureStubInfo* stubInfo, Structure
     JumpList failureCases;
     // Check eax is an object of the right Structure.
     failureCases.append(emitJumpIfNotJSCell(regT0));
-    failureCases.append(branchPtr(NotEqual, Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), ImmPtr(oldStructure)));
+    failureCases.append(branchPtr(NotEqual, Address(regT0, JSCell::structureOffset()), TrustedImmPtr(oldStructure)));
     testPrototype(oldStructure->storedPrototype(), failureCases);
 
     // ecx = baseObject->m_structure
@@ -598,8 +598,8 @@ void JIT::privateCompilePutByIdTransition(StructureStubInfo* stubInfo, Structure
         stubCall.skipArgument(); // base
         stubCall.skipArgument(); // ident
         stubCall.skipArgument(); // value
-        stubCall.addArgument(Imm32(oldStructure->propertyStorageCapacity()));
-        stubCall.addArgument(Imm32(newStructure->propertyStorageCapacity()));
+        stubCall.addArgument(TrustedImm32(oldStructure->propertyStorageCapacity()));
+        stubCall.addArgument(TrustedImm32(newStructure->propertyStorageCapacity()));
         stubCall.call(regT0);
         emitGetJITStubArg(2, regT1);
 
@@ -608,9 +608,9 @@ void JIT::privateCompilePutByIdTransition(StructureStubInfo* stubInfo, Structure
 
     // Assumes m_refCount can be decremented easily, refcount decrement is safe as 
     // codeblock should ensure oldStructure->m_refCount > 0
-    sub32(Imm32(1), AbsoluteAddress(oldStructure->addressOfCount()));
-    add32(Imm32(1), AbsoluteAddress(newStructure->addressOfCount()));
-    storePtr(ImmPtr(newStructure), Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)));
+    sub32(TrustedImm32(1), AbsoluteAddress(oldStructure->addressOfCount()));
+    add32(TrustedImm32(1), AbsoluteAddress(newStructure->addressOfCount()));
+    storePtr(TrustedImmPtr(newStructure), Address(regT0, JSCell::structureOffset()));
 
     // write the value
     compilePutDirectOffset(regT0, regT1, newStructure, cachedOffset);
@@ -692,12 +692,12 @@ void JIT::privateCompilePatchGetArrayLength(ReturnAddressPtr returnAddress)
     StructureStubInfo* stubInfo = &m_codeBlock->getStubInfo(returnAddress);
 
     // Check eax is an array
-    Jump failureCases1 = branchPtr(NotEqual, Address(regT0), ImmPtr(m_globalData->jsArrayVPtr));
+    Jump failureCases1 = branchPtr(NotEqual, Address(regT0), TrustedImmPtr(m_globalData->jsArrayVPtr));
 
     // Checks out okay! - get the length from the storage
-    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSArray, m_storage)), regT3);
+    loadPtr(Address(regT0, JSArray::storageOffset()), regT3);
     load32(Address(regT3, OBJECT_OFFSETOF(ArrayStorage, m_length)), regT2);
-    Jump failureCases2 = branch32(Above, regT2, Imm32(JSImmediate::maxImmediateInt));
+    Jump failureCases2 = branch32(Above, regT2, TrustedImm32(JSImmediate::maxImmediateInt));
 
     emitFastArithIntToImmNoCheck(regT2, regT0);
     Jump success = jump();
@@ -735,12 +735,12 @@ void JIT::privateCompileGetByIdProto(StructureStubInfo* stubInfo, Structure* str
     Jump failureCases1 = checkStructure(regT0, structure);
 
     // Check the prototype object's Structure had not changed.
-    Structure** prototypeStructureAddress = &(protoObject->m_structure);
+    Structure* const * prototypeStructureAddress = protoObject->addressOfStructure();
 #if CPU(X86_64)
-    move(ImmPtr(prototypeStructure), regT3);
+    move(TrustedImmPtr(prototypeStructure), regT3);
     Jump failureCases2 = branchPtr(NotEqual, AbsoluteAddress(prototypeStructureAddress), regT3);
 #else
-    Jump failureCases2 = branchPtr(NotEqual, AbsoluteAddress(prototypeStructureAddress), ImmPtr(prototypeStructure));
+    Jump failureCases2 = branchPtr(NotEqual, AbsoluteAddress(prototypeStructureAddress), TrustedImmPtr(prototypeStructure));
 #endif
 
     bool needsStubLink = false;
@@ -752,15 +752,15 @@ void JIT::privateCompileGetByIdProto(StructureStubInfo* stubInfo, Structure* str
         JITStubCall stubCall(this, cti_op_get_by_id_getter_stub);
         stubCall.addArgument(regT1);
         stubCall.addArgument(regT0);
-        stubCall.addArgument(ImmPtr(stubInfo->callReturnLocation.executableAddress()));
+        stubCall.addArgument(TrustedImmPtr(stubInfo->callReturnLocation.executableAddress()));
         stubCall.call();
     } else if (slot.cachedPropertyType() == PropertySlot::Custom) {
         needsStubLink = true;
         JITStubCall stubCall(this, cti_op_get_by_id_custom_stub);
-        stubCall.addArgument(ImmPtr(protoObject));
-        stubCall.addArgument(ImmPtr(FunctionPtr(slot.customGetter()).executableAddress()));
-        stubCall.addArgument(ImmPtr(const_cast<Identifier*>(&ident)));
-        stubCall.addArgument(ImmPtr(stubInfo->callReturnLocation.executableAddress()));
+        stubCall.addArgument(TrustedImmPtr(protoObject));
+        stubCall.addArgument(TrustedImmPtr(FunctionPtr(slot.customGetter()).executableAddress()));
+        stubCall.addArgument(TrustedImmPtr(const_cast<Identifier*>(&ident)));
+        stubCall.addArgument(TrustedImmPtr(stubInfo->callReturnLocation.executableAddress()));
         stubCall.call();
     } else
         compileGetDirectOffset(protoObject, regT0, cachedOffset);
@@ -804,15 +804,15 @@ void JIT::privateCompileGetByIdSelfList(StructureStubInfo* stubInfo, Polymorphic
         JITStubCall stubCall(this, cti_op_get_by_id_getter_stub);
         stubCall.addArgument(regT1);
         stubCall.addArgument(regT0);
-        stubCall.addArgument(ImmPtr(stubInfo->callReturnLocation.executableAddress()));
+        stubCall.addArgument(TrustedImmPtr(stubInfo->callReturnLocation.executableAddress()));
         stubCall.call();
     } else if (slot.cachedPropertyType() == PropertySlot::Custom) {
         needsStubLink = true;
         JITStubCall stubCall(this, cti_op_get_by_id_custom_stub);
         stubCall.addArgument(regT0);
-        stubCall.addArgument(ImmPtr(FunctionPtr(slot.customGetter()).executableAddress()));
-        stubCall.addArgument(ImmPtr(const_cast<Identifier*>(&ident)));
-        stubCall.addArgument(ImmPtr(stubInfo->callReturnLocation.executableAddress()));
+        stubCall.addArgument(TrustedImmPtr(FunctionPtr(slot.customGetter()).executableAddress()));
+        stubCall.addArgument(TrustedImmPtr(const_cast<Identifier*>(&ident)));
+        stubCall.addArgument(TrustedImmPtr(stubInfo->callReturnLocation.executableAddress()));
         stubCall.call();
     } else
         compileGetDirectOffset(regT0, regT0, structure, cachedOffset);
@@ -858,12 +858,12 @@ void JIT::privateCompileGetByIdProtoList(StructureStubInfo* stubInfo, Polymorphi
     Jump failureCases1 = checkStructure(regT0, structure);
 
     // Check the prototype object's Structure had not changed.
-    Structure** prototypeStructureAddress = &(protoObject->m_structure);
+    Structure* const * prototypeStructureAddress = protoObject->addressOfStructure();
 #if CPU(X86_64)
-    move(ImmPtr(prototypeStructure), regT3);
+    move(TrustedImmPtr(prototypeStructure), regT3);
     Jump failureCases2 = branchPtr(NotEqual, AbsoluteAddress(prototypeStructureAddress), regT3);
 #else
-    Jump failureCases2 = branchPtr(NotEqual, AbsoluteAddress(prototypeStructureAddress), ImmPtr(prototypeStructure));
+    Jump failureCases2 = branchPtr(NotEqual, AbsoluteAddress(prototypeStructureAddress), TrustedImmPtr(prototypeStructure));
 #endif
 
     // Checks out okay!
@@ -874,15 +874,15 @@ void JIT::privateCompileGetByIdProtoList(StructureStubInfo* stubInfo, Polymorphi
         JITStubCall stubCall(this, cti_op_get_by_id_getter_stub);
         stubCall.addArgument(regT1);
         stubCall.addArgument(regT0);
-        stubCall.addArgument(ImmPtr(stubInfo->callReturnLocation.executableAddress()));
+        stubCall.addArgument(TrustedImmPtr(stubInfo->callReturnLocation.executableAddress()));
         stubCall.call();
     } else if (slot.cachedPropertyType() == PropertySlot::Custom) {
         needsStubLink = true;
         JITStubCall stubCall(this, cti_op_get_by_id_custom_stub);
-        stubCall.addArgument(ImmPtr(protoObject));
-        stubCall.addArgument(ImmPtr(FunctionPtr(slot.customGetter()).executableAddress()));
-        stubCall.addArgument(ImmPtr(const_cast<Identifier*>(&ident)));
-        stubCall.addArgument(ImmPtr(stubInfo->callReturnLocation.executableAddress()));
+        stubCall.addArgument(TrustedImmPtr(protoObject));
+        stubCall.addArgument(TrustedImmPtr(FunctionPtr(slot.customGetter()).executableAddress()));
+        stubCall.addArgument(TrustedImmPtr(const_cast<Identifier*>(&ident)));
+        stubCall.addArgument(TrustedImmPtr(stubInfo->callReturnLocation.executableAddress()));
         stubCall.call();
     } else
         compileGetDirectOffset(protoObject, regT0, cachedOffset);
@@ -944,15 +944,15 @@ void JIT::privateCompileGetByIdChainList(StructureStubInfo* stubInfo, Polymorphi
         JITStubCall stubCall(this, cti_op_get_by_id_getter_stub);
         stubCall.addArgument(regT1);
         stubCall.addArgument(regT0);
-        stubCall.addArgument(ImmPtr(stubInfo->callReturnLocation.executableAddress()));
+        stubCall.addArgument(TrustedImmPtr(stubInfo->callReturnLocation.executableAddress()));
         stubCall.call();
     } else if (slot.cachedPropertyType() == PropertySlot::Custom) {
         needsStubLink = true;
         JITStubCall stubCall(this, cti_op_get_by_id_custom_stub);
-        stubCall.addArgument(ImmPtr(protoObject));
-        stubCall.addArgument(ImmPtr(FunctionPtr(slot.customGetter()).executableAddress()));
-        stubCall.addArgument(ImmPtr(const_cast<Identifier*>(&ident)));
-        stubCall.addArgument(ImmPtr(stubInfo->callReturnLocation.executableAddress()));
+        stubCall.addArgument(TrustedImmPtr(protoObject));
+        stubCall.addArgument(TrustedImmPtr(FunctionPtr(slot.customGetter()).executableAddress()));
+        stubCall.addArgument(TrustedImmPtr(const_cast<Identifier*>(&ident)));
+        stubCall.addArgument(TrustedImmPtr(stubInfo->callReturnLocation.executableAddress()));
         stubCall.call();
     } else
         compileGetDirectOffset(protoObject, regT0, cachedOffset);
@@ -979,8 +979,7 @@ void JIT::privateCompileGetByIdChainList(StructureStubInfo* stubInfo, Polymorphi
 
     // Track the stub we have created so that it will be deleted later.
     structure->ref();
-    chain->ref();
-    prototypeStructures->list[currentIndex].set(entryLabel, structure, chain);
+    prototypeStructures->list[currentIndex].set(callFrame->globalData(), m_codeBlock->ownerExecutable(), entryLabel, structure, chain);
 
     // Finally patch the jump to slow case back in the hot path to jump here instead.
     CodeLocationJump jumpLocation = stubInfo->hotPathBegin.jumpAtOffset(patchOffsetGetByIdBranchToSlowCase);
@@ -1014,15 +1013,15 @@ void JIT::privateCompileGetByIdChain(StructureStubInfo* stubInfo, Structure* str
         JITStubCall stubCall(this, cti_op_get_by_id_getter_stub);
         stubCall.addArgument(regT1);
         stubCall.addArgument(regT0);
-        stubCall.addArgument(ImmPtr(stubInfo->callReturnLocation.executableAddress()));
+        stubCall.addArgument(TrustedImmPtr(stubInfo->callReturnLocation.executableAddress()));
         stubCall.call();
     } else if (slot.cachedPropertyType() == PropertySlot::Custom) {
         needsStubLink = true;
         JITStubCall stubCall(this, cti_op_get_by_id_custom_stub);
-        stubCall.addArgument(ImmPtr(protoObject));
-        stubCall.addArgument(ImmPtr(FunctionPtr(slot.customGetter()).executableAddress()));
-        stubCall.addArgument(ImmPtr(const_cast<Identifier*>(&ident)));
-        stubCall.addArgument(ImmPtr(stubInfo->callReturnLocation.executableAddress()));
+        stubCall.addArgument(TrustedImmPtr(protoObject));
+        stubCall.addArgument(TrustedImmPtr(FunctionPtr(slot.customGetter()).executableAddress()));
+        stubCall.addArgument(TrustedImmPtr(const_cast<Identifier*>(&ident)));
+        stubCall.addArgument(TrustedImmPtr(stubInfo->callReturnLocation.executableAddress()));
         stubCall.call();
     } else
         compileGetDirectOffset(protoObject, regT0, cachedOffset);
diff --git a/Source/JavaScriptCore/jit/JITPropertyAccess32_64.cpp b/Source/JavaScriptCore/jit/JITPropertyAccess32_64.cpp
index 3562200..2a47e5c 100644
--- a/Source/JavaScriptCore/jit/JITPropertyAccess32_64.cpp
+++ b/Source/JavaScriptCore/jit/JITPropertyAccess32_64.cpp
@@ -70,7 +70,7 @@ void JIT::emit_op_put_getter(Instruction* currentInstruction)
     
     JITStubCall stubCall(this, cti_op_put_getter);
     stubCall.addArgument(base);
-    stubCall.addArgument(ImmPtr(&m_codeBlock->identifier(property)));
+    stubCall.addArgument(TrustedImmPtr(&m_codeBlock->identifier(property)));
     stubCall.addArgument(function);
     stubCall.call();
 }
@@ -83,7 +83,7 @@ void JIT::emit_op_put_setter(Instruction* currentInstruction)
     
     JITStubCall stubCall(this, cti_op_put_setter);
     stubCall.addArgument(base);
-    stubCall.addArgument(ImmPtr(&m_codeBlock->identifier(property)));
+    stubCall.addArgument(TrustedImmPtr(&m_codeBlock->identifier(property)));
     stubCall.addArgument(function);
     stubCall.call();
 }
@@ -96,7 +96,7 @@ void JIT::emit_op_del_by_id(Instruction* currentInstruction)
     
     JITStubCall stubCall(this, cti_op_del_by_id);
     stubCall.addArgument(base);
-    stubCall.addArgument(ImmPtr(&m_codeBlock->identifier(property)));
+    stubCall.addArgument(TrustedImmPtr(&m_codeBlock->identifier(property)));
     stubCall.call(dst);
 }
 
@@ -155,7 +155,7 @@ void JIT::emit_op_get_by_id(Instruction* currentInstruction)
     
     JITStubCall stubCall(this, cti_op_get_by_id_generic);
     stubCall.addArgument(base);
-    stubCall.addArgument(ImmPtr(&(m_codeBlock->identifier(ident))));
+    stubCall.addArgument(TrustedImmPtr(&(m_codeBlock->identifier(ident))));
     stubCall.call(dst);
     
     m_propertyAccessInstructionIndex++;
@@ -175,7 +175,7 @@ void JIT::emit_op_put_by_id(Instruction* currentInstruction)
     
     JITStubCall stubCall(this, cti_op_put_by_id_generic);
     stubCall.addArgument(base);
-    stubCall.addArgument(ImmPtr(&(m_codeBlock->identifier(ident))));
+    stubCall.addArgument(TrustedImmPtr(&(m_codeBlock->identifier(ident))));
     stubCall.addArgument(value);
     stubCall.call();
     
@@ -213,16 +213,16 @@ void JIT::emit_op_method_check(Instruction* currentInstruction)
     
     BEGIN_UNINTERRUPTED_SEQUENCE(sequenceMethodCheck);
     
-    Jump structureCheck = branchPtrWithPatch(NotEqual, Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), info.structureToCompare, ImmPtr(reinterpret_cast<void*>(patchGetByIdDefaultStructure)));
-    DataLabelPtr protoStructureToCompare, protoObj = moveWithPatch(ImmPtr(0), regT2);
-    Jump protoStructureCheck = branchPtrWithPatch(NotEqual, Address(regT2, OBJECT_OFFSETOF(JSCell, m_structure)), protoStructureToCompare, ImmPtr(reinterpret_cast<void*>(patchGetByIdDefaultStructure)));
+    Jump structureCheck = branchPtrWithPatch(NotEqual, Address(regT0, JSCell::structureOffset()), info.structureToCompare, TrustedImmPtr(reinterpret_cast<void*>(patchGetByIdDefaultStructure)));
+    DataLabelPtr protoStructureToCompare, protoObj = moveWithPatch(TrustedImmPtr(0), regT2);
+    Jump protoStructureCheck = branchPtrWithPatch(NotEqual, Address(regT2, JSCell::structureOffset()), protoStructureToCompare, TrustedImmPtr(reinterpret_cast<void*>(patchGetByIdDefaultStructure)));
     
     // This will be relinked to load the function without doing a load.
-    DataLabelPtr putFunction = moveWithPatch(ImmPtr(0), regT0);
+    DataLabelPtr putFunction = moveWithPatch(TrustedImmPtr(0), regT0);
     
     END_UNINTERRUPTED_SEQUENCE(sequenceMethodCheck);
     
-    move(Imm32(JSValue::CellTag), regT1);
+    move(TrustedImm32(JSValue::CellTag), regT1);
     Jump match = jump();
     
     ASSERT_JIT_OFFSET(differenceBetween(info.structureToCompare, protoObj), patchOffsetMethodCheckProtoObj);
@@ -271,7 +271,7 @@ JIT::CodePtr JIT::stringGetByValStubGenerator(JSGlobalData* globalData, Executab
 {
     JSInterfaceJIT jit;
     JumpList failures;
-    failures.append(jit.branchPtr(NotEqual, Address(regT0), ImmPtr(globalData->jsStringVPtr)));
+    failures.append(jit.branchPtr(NotEqual, Address(regT0), TrustedImmPtr(globalData->jsStringVPtr)));
     failures.append(jit.branchTest32(NonZero, Address(regT0, OBJECT_OFFSETOF(JSString, m_fiberCount))));
     
     // Load string length to regT1, and start the process of loading the data pointer into regT0
@@ -285,14 +285,14 @@ JIT::CodePtr JIT::stringGetByValStubGenerator(JSGlobalData* globalData, Executab
     // Load the character
     jit.load16(BaseIndex(regT0, regT2, TimesTwo, 0), regT0);
     
-    failures.append(jit.branch32(AboveOrEqual, regT0, Imm32(0x100)));
-    jit.move(ImmPtr(globalData->smallStrings.singleCharacterStrings()), regT1);
+    failures.append(jit.branch32(AboveOrEqual, regT0, TrustedImm32(0x100)));
+    jit.move(TrustedImmPtr(globalData->smallStrings.singleCharacterStrings()), regT1);
     jit.loadPtr(BaseIndex(regT1, regT0, ScalePtr, 0), regT0);
-    jit.move(Imm32(JSValue::CellTag), regT1); // We null check regT0 on return so this is safe
+    jit.move(TrustedImm32(JSValue::CellTag), regT1); // We null check regT0 on return so this is safe
     jit.ret();
 
     failures.link(&jit);
-    jit.move(Imm32(0), regT0);
+    jit.move(TrustedImm32(0), regT0);
     jit.ret();
     
     LinkBuffer patchBuffer(&jit, pool, 0);
@@ -307,16 +307,16 @@ void JIT::emit_op_get_by_val(Instruction* currentInstruction)
     
     emitLoad2(base, regT1, regT0, property, regT3, regT2);
     
-    addSlowCase(branch32(NotEqual, regT3, Imm32(JSValue::Int32Tag)));
+    addSlowCase(branch32(NotEqual, regT3, TrustedImm32(JSValue::Int32Tag)));
     emitJumpSlowCaseIfNotJSCell(base, regT1);
-    addSlowCase(branchPtr(NotEqual, Address(regT0), ImmPtr(m_globalData->jsArrayVPtr)));
+    addSlowCase(branchPtr(NotEqual, Address(regT0), TrustedImmPtr(m_globalData->jsArrayVPtr)));
     
-    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSArray, m_storage)), regT3);
-    addSlowCase(branch32(AboveOrEqual, regT2, Address(regT0, OBJECT_OFFSETOF(JSArray, m_vectorLength))));
+    loadPtr(Address(regT0, JSArray::storageOffset()), regT3);
+    addSlowCase(branch32(AboveOrEqual, regT2, Address(regT0, JSArray::vectorLengthOffset())));
     
     load32(BaseIndex(regT3, regT2, TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0]) + OBJECT_OFFSETOF(JSValue, u.asBits.tag)), regT1); // tag
     load32(BaseIndex(regT3, regT2, TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0]) + OBJECT_OFFSETOF(JSValue, u.asBits.payload)), regT0); // payload
-    addSlowCase(branch32(Equal, regT1, Imm32(JSValue::EmptyValueTag)));
+    addSlowCase(branch32(Equal, regT1, TrustedImm32(JSValue::EmptyValueTag)));
     
     emitStore(dst, regT1, regT0);
     map(m_bytecodeOffset + OPCODE_LENGTH(op_get_by_val), dst, regT1, regT0);
@@ -333,7 +333,7 @@ void JIT::emitSlow_op_get_by_val(Instruction* currentInstruction, Vector<SlowCas
 
     Jump nonCell = jump();
     linkSlowCase(iter); // base array check
-    Jump notString = branchPtr(NotEqual, Address(regT0), ImmPtr(m_globalData->jsStringVPtr));
+    Jump notString = branchPtr(NotEqual, Address(regT0), TrustedImmPtr(m_globalData->jsStringVPtr));
     emitNakedCall(m_globalData->getCTIStub(stringGetByValStubGenerator));
     Jump failed = branchTestPtr(Zero, regT0);
     emitStore(dst, regT1, regT0);
@@ -359,14 +359,14 @@ void JIT::emit_op_put_by_val(Instruction* currentInstruction)
     
     emitLoad2(base, regT1, regT0, property, regT3, regT2);
     
-    addSlowCase(branch32(NotEqual, regT3, Imm32(JSValue::Int32Tag)));
+    addSlowCase(branch32(NotEqual, regT3, TrustedImm32(JSValue::Int32Tag)));
     emitJumpSlowCaseIfNotJSCell(base, regT1);
-    addSlowCase(branchPtr(NotEqual, Address(regT0), ImmPtr(m_globalData->jsArrayVPtr)));
-    addSlowCase(branch32(AboveOrEqual, regT2, Address(regT0, OBJECT_OFFSETOF(JSArray, m_vectorLength))));
+    addSlowCase(branchPtr(NotEqual, Address(regT0), TrustedImmPtr(m_globalData->jsArrayVPtr)));
+    addSlowCase(branch32(AboveOrEqual, regT2, Address(regT0, JSArray::vectorLengthOffset())));
     
-    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSArray, m_storage)), regT3);
+    loadPtr(Address(regT0, JSArray::storageOffset()), regT3);
     
-    Jump empty = branch32(Equal, BaseIndex(regT3, regT2, TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0]) + OBJECT_OFFSETOF(JSValue, u.asBits.tag)), Imm32(JSValue::EmptyValueTag));
+    Jump empty = branch32(Equal, BaseIndex(regT3, regT2, TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0]) + OBJECT_OFFSETOF(JSValue, u.asBits.tag)), TrustedImm32(JSValue::EmptyValueTag));
     
     Label storeResult(this);
     emitLoad(value, regT1, regT0);
@@ -375,10 +375,10 @@ void JIT::emit_op_put_by_val(Instruction* currentInstruction)
     Jump end = jump();
     
     empty.link(this);
-    add32(Imm32(1), Address(regT3, OBJECT_OFFSETOF(ArrayStorage, m_numValuesInVector)));
+    add32(TrustedImm32(1), Address(regT3, OBJECT_OFFSETOF(ArrayStorage, m_numValuesInVector)));
     branch32(Below, regT2, Address(regT3, OBJECT_OFFSETOF(ArrayStorage, m_length))).linkTo(storeResult, this);
     
-    add32(Imm32(1), regT2, regT0);
+    add32(TrustedImm32(1), regT2, regT0);
     store32(regT0, Address(regT3, OBJECT_OFFSETOF(ArrayStorage, m_length)));
     jump().linkTo(storeResult, this);
     
@@ -429,7 +429,7 @@ void JIT::compileGetByIdHotPath()
     m_propertyAccessInstructionIndex++;
     
     DataLabelPtr structureToCompare;
-    Jump structureCheck = branchPtrWithPatch(NotEqual, Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), structureToCompare, ImmPtr(reinterpret_cast<void*>(patchGetByIdDefaultStructure)));
+    Jump structureCheck = branchPtrWithPatch(NotEqual, Address(regT0, JSCell::structureOffset()), structureToCompare, TrustedImmPtr(reinterpret_cast<void*>(patchGetByIdDefaultStructure)));
     addSlowCase(structureCheck);
     ASSERT_JIT_OFFSET(differenceBetween(hotPathBegin, structureToCompare), patchOffsetGetByIdStructure);
     ASSERT_JIT_OFFSET(differenceBetween(hotPathBegin, structureCheck), patchOffsetGetByIdBranchToSlowCase);
@@ -472,7 +472,7 @@ void JIT::compileGetByIdSlowCase(int dst, int base, Identifier* ident, Vector<Sl
 #endif
     JITStubCall stubCall(this, isMethodCheck ? cti_op_get_by_id_method_check : cti_op_get_by_id);
     stubCall.addArgument(regT1, regT0);
-    stubCall.addArgument(ImmPtr(ident));
+    stubCall.addArgument(TrustedImmPtr(ident));
     Call call = stubCall.call(dst);
     
     END_UNINTERRUPTED_SEQUENCE(sequenceGetByIdSlowCase);
@@ -505,7 +505,7 @@ void JIT::emit_op_put_by_id(Instruction* currentInstruction)
     
     // It is important that the following instruction plants a 32bit immediate, in order that it can be patched over.
     DataLabelPtr structureToCompare;
-    addSlowCase(branchPtrWithPatch(NotEqual, Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), structureToCompare, ImmPtr(reinterpret_cast<void*>(patchGetByIdDefaultStructure))));
+    addSlowCase(branchPtrWithPatch(NotEqual, Address(regT0, JSCell::structureOffset()), structureToCompare, TrustedImmPtr(reinterpret_cast<void*>(patchGetByIdDefaultStructure))));
     ASSERT_JIT_OFFSET(differenceBetween(hotPathBegin, structureToCompare), patchOffsetPutByIdStructure);
     
     loadPtr(Address(regT0, OBJECT_OFFSETOF(JSObject, m_propertyStorage)), regT0);
@@ -529,7 +529,7 @@ void JIT::emitSlow_op_put_by_id(Instruction* currentInstruction, Vector<SlowCase
     
     JITStubCall stubCall(this, direct ? cti_op_put_by_id_direct : cti_op_put_by_id);
     stubCall.addArgument(regT1, regT0);
-    stubCall.addArgument(ImmPtr(&(m_codeBlock->identifier(ident))));
+    stubCall.addArgument(TrustedImmPtr(&(m_codeBlock->identifier(ident))));
     stubCall.addArgument(regT3, regT2); 
     Call call = stubCall.call();
     
@@ -579,10 +579,10 @@ void JIT::testPrototype(JSValue prototype, JumpList& failureCases)
     // values.  In the non X86_64 case, the generated code is slightly more efficient because it uses
     // two less instructions and doesn't require any scratch registers.
 #if CPU(X86_64)
-    move(ImmPtr(prototype.asCell()->structure()), regT3);
-    failureCases.append(branchPtr(NotEqual, AbsoluteAddress(&prototype.asCell()->m_structure), regT3));
+    move(TrustedImmPtr(prototype.asCell()->structure()), regT3);
+    failureCases.append(branchPtr(NotEqual, AbsoluteAddress(prototype.asCell()->addressOfStructure()), regT3));
 #else
-    failureCases.append(branchPtr(NotEqual, AbsoluteAddress(&prototype.asCell()->m_structure), ImmPtr(prototype.asCell()->structure())));
+    failureCases.append(branchPtr(NotEqual, AbsoluteAddress(prototype.asCell()->addressOfStructure()), TrustedImmPtr(prototype.asCell()->structure())));
 #endif
 }
 
@@ -591,8 +591,8 @@ void JIT::privateCompilePutByIdTransition(StructureStubInfo* stubInfo, Structure
     // It is assumed that regT0 contains the basePayload and regT1 contains the baseTag.  The value can be found on the stack.
     
     JumpList failureCases;
-    failureCases.append(branch32(NotEqual, regT1, Imm32(JSValue::CellTag)));
-    failureCases.append(branchPtr(NotEqual, Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), ImmPtr(oldStructure)));
+    failureCases.append(branch32(NotEqual, regT1, TrustedImm32(JSValue::CellTag)));
+    failureCases.append(branchPtr(NotEqual, Address(regT0, JSCell::structureOffset()), TrustedImmPtr(oldStructure)));
     testPrototype(oldStructure->storedPrototype(), failureCases);
     
     if (!direct) {
@@ -613,16 +613,16 @@ void JIT::privateCompilePutByIdTransition(StructureStubInfo* stubInfo, Structure
         stubCall.skipArgument(); // base
         stubCall.skipArgument(); // ident
         stubCall.skipArgument(); // value
-        stubCall.addArgument(Imm32(oldStructure->propertyStorageCapacity()));
-        stubCall.addArgument(Imm32(newStructure->propertyStorageCapacity()));
+        stubCall.addArgument(TrustedImm32(oldStructure->propertyStorageCapacity()));
+        stubCall.addArgument(TrustedImm32(newStructure->propertyStorageCapacity()));
         stubCall.call(regT0);
         
         restoreReturnAddressBeforeReturn(regT3);
     }
     
-    sub32(Imm32(1), AbsoluteAddress(oldStructure->addressOfCount()));
-    add32(Imm32(1), AbsoluteAddress(newStructure->addressOfCount()));
-    storePtr(ImmPtr(newStructure), Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)));
+    sub32(TrustedImm32(1), AbsoluteAddress(oldStructure->addressOfCount()));
+    add32(TrustedImm32(1), AbsoluteAddress(newStructure->addressOfCount()));
+    storePtr(TrustedImmPtr(newStructure), Address(regT0, JSCell::structureOffset()));
     
 #if CPU(MIPS)
     // For MIPS, we don't add sizeof(void*) to the stack offset.
@@ -717,15 +717,15 @@ void JIT::privateCompilePatchGetArrayLength(ReturnAddressPtr returnAddress)
     // regT0 holds a JSCell*
     
     // Check for array
-    Jump failureCases1 = branchPtr(NotEqual, Address(regT0), ImmPtr(m_globalData->jsArrayVPtr));
+    Jump failureCases1 = branchPtr(NotEqual, Address(regT0), TrustedImmPtr(m_globalData->jsArrayVPtr));
     
     // Checks out okay! - get the length from the storage
-    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSArray, m_storage)), regT2);
+    loadPtr(Address(regT0, JSArray::storageOffset()), regT2);
     load32(Address(regT2, OBJECT_OFFSETOF(ArrayStorage, m_length)), regT2);
     
-    Jump failureCases2 = branch32(Above, regT2, Imm32(INT_MAX));
+    Jump failureCases2 = branch32(Above, regT2, TrustedImm32(INT_MAX));
     move(regT2, regT0);
-    move(Imm32(JSValue::Int32Tag), regT1);
+    move(TrustedImm32(JSValue::Int32Tag), regT1);
     Jump success = jump();
     
     LinkBuffer patchBuffer(this, m_codeBlock->executablePool(), 0);
@@ -762,12 +762,12 @@ void JIT::privateCompileGetByIdProto(StructureStubInfo* stubInfo, Structure* str
     Jump failureCases1 = checkStructure(regT0, structure);
     
     // Check the prototype object's Structure had not changed.
-    Structure** prototypeStructureAddress = &(protoObject->m_structure);
+    Structure* const * prototypeStructureAddress = protoObject->addressOfStructure();
 #if CPU(X86_64)
-    move(ImmPtr(prototypeStructure), regT3);
+    move(TrustedImmPtr(prototypeStructure), regT3);
     Jump failureCases2 = branchPtr(NotEqual, AbsoluteAddress(prototypeStructureAddress), regT3);
 #else
-    Jump failureCases2 = branchPtr(NotEqual, AbsoluteAddress(prototypeStructureAddress), ImmPtr(prototypeStructure));
+    Jump failureCases2 = branchPtr(NotEqual, AbsoluteAddress(prototypeStructureAddress), TrustedImmPtr(prototypeStructure));
 #endif
     bool needsStubLink = false;
     // Checks out okay!
@@ -777,15 +777,15 @@ void JIT::privateCompileGetByIdProto(StructureStubInfo* stubInfo, Structure* str
         JITStubCall stubCall(this, cti_op_get_by_id_getter_stub);
         stubCall.addArgument(regT1);
         stubCall.addArgument(regT0);
-        stubCall.addArgument(ImmPtr(stubInfo->callReturnLocation.executableAddress()));
+        stubCall.addArgument(TrustedImmPtr(stubInfo->callReturnLocation.executableAddress()));
         stubCall.call();
     } else if (slot.cachedPropertyType() == PropertySlot::Custom) {
         needsStubLink = true;
         JITStubCall stubCall(this, cti_op_get_by_id_custom_stub);
-        stubCall.addArgument(ImmPtr(protoObject));
-        stubCall.addArgument(ImmPtr(FunctionPtr(slot.customGetter()).executableAddress()));
-        stubCall.addArgument(ImmPtr(const_cast<Identifier*>(&ident)));
-        stubCall.addArgument(ImmPtr(stubInfo->callReturnLocation.executableAddress()));
+        stubCall.addArgument(TrustedImmPtr(protoObject));
+        stubCall.addArgument(TrustedImmPtr(FunctionPtr(slot.customGetter()).executableAddress()));
+        stubCall.addArgument(TrustedImmPtr(const_cast<Identifier*>(&ident)));
+        stubCall.addArgument(TrustedImmPtr(stubInfo->callReturnLocation.executableAddress()));
         stubCall.call();
     } else
         compileGetDirectOffset(protoObject, regT1, regT0, cachedOffset);
@@ -834,15 +834,15 @@ void JIT::privateCompileGetByIdSelfList(StructureStubInfo* stubInfo, Polymorphic
         JITStubCall stubCall(this, cti_op_get_by_id_getter_stub);
         stubCall.addArgument(regT1);
         stubCall.addArgument(regT0);
-        stubCall.addArgument(ImmPtr(stubInfo->callReturnLocation.executableAddress()));
+        stubCall.addArgument(TrustedImmPtr(stubInfo->callReturnLocation.executableAddress()));
         stubCall.call();
     } else if (slot.cachedPropertyType() == PropertySlot::Custom) {
         needsStubLink = true;
         JITStubCall stubCall(this, cti_op_get_by_id_custom_stub);
         stubCall.addArgument(regT0);
-        stubCall.addArgument(ImmPtr(FunctionPtr(slot.customGetter()).executableAddress()));
-        stubCall.addArgument(ImmPtr(const_cast<Identifier*>(&ident)));
-        stubCall.addArgument(ImmPtr(stubInfo->callReturnLocation.executableAddress()));
+        stubCall.addArgument(TrustedImmPtr(FunctionPtr(slot.customGetter()).executableAddress()));
+        stubCall.addArgument(TrustedImmPtr(const_cast<Identifier*>(&ident)));
+        stubCall.addArgument(TrustedImmPtr(stubInfo->callReturnLocation.executableAddress()));
         stubCall.call();
     } else
         compileGetDirectOffset(regT0, regT1, regT0, structure, cachedOffset);
@@ -889,12 +889,12 @@ void JIT::privateCompileGetByIdProtoList(StructureStubInfo* stubInfo, Polymorphi
     Jump failureCases1 = checkStructure(regT0, structure);
     
     // Check the prototype object's Structure had not changed.
-    Structure** prototypeStructureAddress = &(protoObject->m_structure);
+    Structure* const * prototypeStructureAddress = protoObject->addressOfStructure();
 #if CPU(X86_64)
-    move(ImmPtr(prototypeStructure), regT3);
+    move(TrustedImmPtr(prototypeStructure), regT3);
     Jump failureCases2 = branchPtr(NotEqual, AbsoluteAddress(prototypeStructureAddress), regT3);
 #else
-    Jump failureCases2 = branchPtr(NotEqual, AbsoluteAddress(prototypeStructureAddress), ImmPtr(prototypeStructure));
+    Jump failureCases2 = branchPtr(NotEqual, AbsoluteAddress(prototypeStructureAddress), TrustedImmPtr(prototypeStructure));
 #endif
     
     bool needsStubLink = false;
@@ -904,15 +904,15 @@ void JIT::privateCompileGetByIdProtoList(StructureStubInfo* stubInfo, Polymorphi
         JITStubCall stubCall(this, cti_op_get_by_id_getter_stub);
         stubCall.addArgument(regT1);
         stubCall.addArgument(regT0);
-        stubCall.addArgument(ImmPtr(stubInfo->callReturnLocation.executableAddress()));
+        stubCall.addArgument(TrustedImmPtr(stubInfo->callReturnLocation.executableAddress()));
         stubCall.call();
     } else if (slot.cachedPropertyType() == PropertySlot::Custom) {
         needsStubLink = true;
         JITStubCall stubCall(this, cti_op_get_by_id_custom_stub);
-        stubCall.addArgument(ImmPtr(protoObject));
-        stubCall.addArgument(ImmPtr(FunctionPtr(slot.customGetter()).executableAddress()));
-        stubCall.addArgument(ImmPtr(const_cast<Identifier*>(&ident)));
-        stubCall.addArgument(ImmPtr(stubInfo->callReturnLocation.executableAddress()));
+        stubCall.addArgument(TrustedImmPtr(protoObject));
+        stubCall.addArgument(TrustedImmPtr(FunctionPtr(slot.customGetter()).executableAddress()));
+        stubCall.addArgument(TrustedImmPtr(const_cast<Identifier*>(&ident)));
+        stubCall.addArgument(TrustedImmPtr(stubInfo->callReturnLocation.executableAddress()));
         stubCall.call();
     } else
         compileGetDirectOffset(protoObject, regT1, regT0, cachedOffset);
@@ -973,15 +973,15 @@ void JIT::privateCompileGetByIdChainList(StructureStubInfo* stubInfo, Polymorphi
         JITStubCall stubCall(this, cti_op_get_by_id_getter_stub);
         stubCall.addArgument(regT1);
         stubCall.addArgument(regT0);
-        stubCall.addArgument(ImmPtr(stubInfo->callReturnLocation.executableAddress()));
+        stubCall.addArgument(TrustedImmPtr(stubInfo->callReturnLocation.executableAddress()));
         stubCall.call();
     } else if (slot.cachedPropertyType() == PropertySlot::Custom) {
         needsStubLink = true;
         JITStubCall stubCall(this, cti_op_get_by_id_custom_stub);
-        stubCall.addArgument(ImmPtr(protoObject));
-        stubCall.addArgument(ImmPtr(FunctionPtr(slot.customGetter()).executableAddress()));
-        stubCall.addArgument(ImmPtr(const_cast<Identifier*>(&ident)));
-        stubCall.addArgument(ImmPtr(stubInfo->callReturnLocation.executableAddress()));
+        stubCall.addArgument(TrustedImmPtr(protoObject));
+        stubCall.addArgument(TrustedImmPtr(FunctionPtr(slot.customGetter()).executableAddress()));
+        stubCall.addArgument(TrustedImmPtr(const_cast<Identifier*>(&ident)));
+        stubCall.addArgument(TrustedImmPtr(stubInfo->callReturnLocation.executableAddress()));
         stubCall.call();
     } else
         compileGetDirectOffset(protoObject, regT1, regT0, cachedOffset);
@@ -1007,8 +1007,7 @@ void JIT::privateCompileGetByIdChainList(StructureStubInfo* stubInfo, Polymorphi
     
     // Track the stub we have created so that it will be deleted later.
     structure->ref();
-    chain->ref();
-    prototypeStructures->list[currentIndex].set(entryLabel, structure, chain);
+    prototypeStructures->list[currentIndex].set(callFrame->globalData(), m_codeBlock->ownerExecutable(), entryLabel, structure, chain);
     
     // Finally patch the jump to slow case back in the hot path to jump here instead.
     CodeLocationJump jumpLocation = stubInfo->hotPathBegin.jumpAtOffset(patchOffsetGetByIdBranchToSlowCase);
@@ -1043,15 +1042,15 @@ void JIT::privateCompileGetByIdChain(StructureStubInfo* stubInfo, Structure* str
         JITStubCall stubCall(this, cti_op_get_by_id_getter_stub);
         stubCall.addArgument(regT1);
         stubCall.addArgument(regT0);
-        stubCall.addArgument(ImmPtr(stubInfo->callReturnLocation.executableAddress()));
+        stubCall.addArgument(TrustedImmPtr(stubInfo->callReturnLocation.executableAddress()));
         stubCall.call();
     } else if (slot.cachedPropertyType() == PropertySlot::Custom) {
         needsStubLink = true;
         JITStubCall stubCall(this, cti_op_get_by_id_custom_stub);
-        stubCall.addArgument(ImmPtr(protoObject));
-        stubCall.addArgument(ImmPtr(FunctionPtr(slot.customGetter()).executableAddress()));
-        stubCall.addArgument(ImmPtr(const_cast<Identifier*>(&ident)));
-        stubCall.addArgument(ImmPtr(stubInfo->callReturnLocation.executableAddress()));
+        stubCall.addArgument(TrustedImmPtr(protoObject));
+        stubCall.addArgument(TrustedImmPtr(FunctionPtr(slot.customGetter()).executableAddress()));
+        stubCall.addArgument(TrustedImmPtr(const_cast<Identifier*>(&ident)));
+        stubCall.addArgument(TrustedImmPtr(stubInfo->callReturnLocation.executableAddress()));
         stubCall.call();
     } else
         compileGetDirectOffset(protoObject, regT1, regT0, cachedOffset);
@@ -1113,10 +1112,10 @@ void JIT::emit_op_get_by_pname(Instruction* currentInstruction)
     emitLoadPayload(iter, regT1);
     
     // Test base's structure
-    loadPtr(Address(regT2, OBJECT_OFFSETOF(JSCell, m_structure)), regT0);
+    loadPtr(Address(regT2, JSCell::structureOffset()), regT0);
     addSlowCase(branchPtr(NotEqual, regT0, Address(regT1, OBJECT_OFFSETOF(JSPropertyNameIterator, m_cachedStructure))));
     load32(addressFor(i), regT3);
-    sub32(Imm32(1), regT3);
+    sub32(TrustedImm32(1), regT3);
     addSlowCase(branch32(AboveOrEqual, regT3, Address(regT1, OBJECT_OFFSETOF(JSPropertyNameIterator, m_numCacheableSlots))));
     compileGetDirectOffset(regT2, regT1, regT0, regT3);    
     
diff --git a/Source/JavaScriptCore/jit/JITStubCall.h b/Source/JavaScriptCore/jit/JITStubCall.h
index 4478d06..a0341d6 100644
--- a/Source/JavaScriptCore/jit/JITStubCall.h
+++ b/Source/JavaScriptCore/jit/JITStubCall.h
@@ -99,13 +99,13 @@ namespace JSC {
             m_stackIndex += stackIndexStep;
         }
 
-        void addArgument(JIT::Imm32 argument)
+        void addArgument(JIT::TrustedImm32 argument)
         {
             m_jit->poke(argument, m_stackIndex);
             m_stackIndex += stackIndexStep;
         }
 
-        void addArgument(JIT::ImmPtr argument)
+        void addArgument(JIT::TrustedImmPtr argument)
         {
             m_jit->poke(argument, m_stackIndex);
             m_stackIndex += stackIndexStep;
diff --git a/Source/JavaScriptCore/jit/JITStubs.cpp b/Source/JavaScriptCore/jit/JITStubs.cpp
index 95bf52c..e52c7c8 100644
--- a/Source/JavaScriptCore/jit/JITStubs.cpp
+++ b/Source/JavaScriptCore/jit/JITStubs.cpp
@@ -40,6 +40,7 @@
 #include "Debugger.h"
 #include "ExceptionHelpers.h"
 #include "GetterSetter.h"
+#include "Global.h"
 #include "JIT.h"
 #include "JSActivation.h"
 #include "JSArray.h"
@@ -679,6 +680,7 @@ __asm void ctiOpThrowNotCaught()
 #endif
 
 JITThunks::JITThunks(JSGlobalData* globalData)
+    : m_hostFunctionStubMap(new HostFunctionStubMap)
 {
     if (!globalData->executableAllocator.isValid())
         return;
@@ -941,17 +943,17 @@ static NEVER_INLINE void throwStackOverflowError(CallFrame* callFrame, JSGlobalD
 
 #define CHECK_FOR_EXCEPTION() \
     do { \
-        if (UNLIKELY(stackFrame.globalData->exception.get())) \
+        if (UNLIKELY(stackFrame.globalData->exception)) \
             VM_THROW_EXCEPTION(); \
     } while (0)
 #define CHECK_FOR_EXCEPTION_AT_END() \
     do { \
-        if (UNLIKELY(stackFrame.globalData->exception.get())) \
+        if (UNLIKELY(stackFrame.globalData->exception)) \
             VM_THROW_EXCEPTION_AT_END(); \
     } while (0)
 #define CHECK_FOR_EXCEPTION_VOID() \
     do { \
-        if (UNLIKELY(stackFrame.globalData->exception.get())) { \
+        if (UNLIKELY(stackFrame.globalData->exception)) { \
             VM_THROW_EXCEPTION_AT_END(); \
             return; \
         } \
@@ -976,7 +978,7 @@ static ExceptionHandler jitThrow(JSGlobalData* globalData, CallFrame* callFrame,
     return exceptionHandler;
 }
 
-#if CPU(ARM_THUMB2)
+#if CPU(ARM_THUMB2) && COMPILER(GCC)
 
 #define DEFINE_STUB_FUNCTION(rtype, op) \
     extern "C" { \
@@ -1072,7 +1074,7 @@ static ExceptionHandler jitThrow(JSGlobalData* globalData, CallFrame* callFrame,
         ); \
     rtype JITStubThunked_##op(STUB_ARGS_DECLARATION)
 
-#elif CPU(ARM_TRADITIONAL) && COMPILER(RVCT)
+#elif (CPU(ARM_THUMB2) || CPU(ARM_TRADITIONAL)) && COMPILER(RVCT)
 
 #define DEFINE_STUB_FUNCTION(rtype, op) rtype JITStubThunked_##op(STUB_ARGS_DECLARATION)
 
@@ -1085,7 +1087,7 @@ static ExceptionHandler jitThrow(JSGlobalData* globalData, CallFrame* callFrame,
 RVCT(extern "C" #rtype# JITStubThunked_#op#(STUB_ARGS_DECLARATION);)
 RVCT(__asm #rtype# cti_#op#(STUB_ARGS_DECLARATION))
 RVCT({)
-RVCT(    ARM)
+RVCT(    PRESERVE8)
 RVCT(    IMPORT JITStubThunked_#op#)
 RVCT(    str lr, [sp, # THUNK_RETURN_ADDRESS_OFFSET])
 RVCT(    bl JITStubThunked_#op#)
@@ -1172,7 +1174,7 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_create_this)
     Structure* structure;
     JSValue proto = stackFrame.args[0].jsValue();
     if (proto.isObject())
-        structure = asObject(proto)->inheritorID();
+        structure = asObject(proto)->inheritorID(*stackFrame.globalData);
     else
         structure = constructor->scope()->globalObject->emptyObjectStructure();
     JSValue result = constructEmptyObject(callFrame, structure);
@@ -1551,7 +1553,7 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_get_by_id_self_fail)
     return JSValue::encode(result);
 }
 
-static PolymorphicAccessStructureList* getPolymorphicAccessStructureListSlot(StructureStubInfo* stubInfo, int& listIndex)
+static PolymorphicAccessStructureList* getPolymorphicAccessStructureListSlot(JSGlobalData& globalData, ScriptExecutable* owner, StructureStubInfo* stubInfo, int& listIndex)
 {
     PolymorphicAccessStructureList* prototypeStructureList = 0;
     listIndex = 1;
@@ -1563,7 +1565,7 @@ static PolymorphicAccessStructureList* getPolymorphicAccessStructureListSlot(Str
         stubInfo->initGetByIdProtoList(prototypeStructureList, 2);
         break;
     case access_get_by_id_chain:
-        prototypeStructureList = new PolymorphicAccessStructureList(stubInfo->stubRoutine, stubInfo->u.getByIdChain.baseObjectStructure, stubInfo->u.getByIdChain.chain);
+        prototypeStructureList = new PolymorphicAccessStructureList(globalData, owner, stubInfo->stubRoutine, stubInfo->u.getByIdChain.baseObjectStructure, stubInfo->u.getByIdChain.chain);
         stubInfo->stubRoutine = CodeLocationLabel();
         stubInfo->initGetByIdProtoList(prototypeStructureList, 2);
         break;
@@ -1651,7 +1653,7 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_get_by_id_proto_list)
         }
 
         int listIndex;
-        PolymorphicAccessStructureList* prototypeStructureList = getPolymorphicAccessStructureListSlot(stubInfo, listIndex);
+        PolymorphicAccessStructureList* prototypeStructureList = getPolymorphicAccessStructureListSlot(callFrame->globalData(), codeBlock->ownerExecutable(), stubInfo, listIndex);
         if (listIndex < POLYMORPHIC_LIST_CACHE_SIZE) {
             JIT::compileGetByIdProtoList(callFrame->scopeChain()->globalData, callFrame, codeBlock, stubInfo, prototypeStructureList, listIndex, structure, slotBaseObject->structure(), propertyName, slot, offset);
 
@@ -1661,7 +1663,7 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_get_by_id_proto_list)
     } else if (size_t count = normalizePrototypeChain(callFrame, baseValue, slot.slotBase(), propertyName, offset)) {
         ASSERT(!baseValue.asCell()->structure()->isDictionary());
         int listIndex;
-        PolymorphicAccessStructureList* prototypeStructureList = getPolymorphicAccessStructureListSlot(stubInfo, listIndex);
+        PolymorphicAccessStructureList* prototypeStructureList = getPolymorphicAccessStructureListSlot(callFrame->globalData(), codeBlock->ownerExecutable(), stubInfo, listIndex);
         
         if (listIndex < POLYMORPHIC_LIST_CACHE_SIZE) {
             StructureChain* protoChain = structure->prototypeChain(callFrame);
@@ -3067,7 +3069,15 @@ DEFINE_STUB_FUNCTION(JSObject*, op_new_regexp)
 {
     STUB_INIT_STACK_FRAME(stackFrame);
 
-    return new (stackFrame.globalData) RegExpObject(stackFrame.callFrame->lexicalGlobalObject(), stackFrame.callFrame->lexicalGlobalObject()->regExpStructure(), stackFrame.args[0].regExp());
+    CallFrame* callFrame = stackFrame.callFrame;
+
+    RegExp* regExp = stackFrame.args[0].regExp();
+    if (!regExp->isValid()) {
+        stackFrame.globalData->exception = createSyntaxError(callFrame, "Invalid flags supplied to RegExp constructor.");
+        VM_THROW_EXCEPTION();
+    }
+
+    return new (stackFrame.globalData) RegExpObject(stackFrame.callFrame->lexicalGlobalObject(), stackFrame.callFrame->lexicalGlobalObject()->regExpStructure(), regExp);
 }
 
 DEFINE_STUB_FUNCTION(EncodedJSValue, op_bitor)
@@ -3462,7 +3472,7 @@ DEFINE_STUB_FUNCTION(void*, vm_throw)
 {
     STUB_INIT_STACK_FRAME(stackFrame);
     JSGlobalData* globalData = stackFrame.globalData;
-    ExceptionHandler handler = jitThrow(globalData, stackFrame.callFrame, globalData->exception.get(), globalData->exceptionLocation);
+    ExceptionHandler handler = jitThrow(globalData, stackFrame.callFrame, globalData->exception, globalData->exceptionLocation);
     STUB_SET_RETURN_ADDRESS(handler.catchRoutine);
     return handler.callFrame;
 }
@@ -3483,22 +3493,27 @@ MacroAssemblerCodePtr JITThunks::ctiStub(JSGlobalData* globalData, ThunkGenerato
     return entry.first->second;
 }
 
-PassRefPtr<NativeExecutable> JITThunks::hostFunctionStub(JSGlobalData* globalData, NativeFunction function)
+NativeExecutable* JITThunks::hostFunctionStub(JSGlobalData* globalData, NativeFunction function)
 {
-    std::pair<HostFunctionStubMap::iterator, bool> entry = m_hostFunctionStubMap.add(function, 0);
+    std::pair<HostFunctionStubMap::iterator, bool> entry = m_hostFunctionStubMap->add(function, Global<NativeExecutable>(Global<NativeExecutable>::EmptyValue));
     if (entry.second)
-        entry.first->second = NativeExecutable::create(JIT::compileCTINativeCall(globalData, m_executablePool, function), function, ctiNativeConstruct(), callHostFunctionAsConstructor);
-    return entry.first->second;
+        entry.first->second.set(*globalData, NativeExecutable::create(*globalData, JIT::compileCTINativeCall(globalData, m_executablePool, function), function, ctiNativeConstruct(), callHostFunctionAsConstructor));
+    return entry.first->second.get();
 }
 
-PassRefPtr<NativeExecutable> JITThunks::hostFunctionStub(JSGlobalData* globalData, NativeFunction function, ThunkGenerator generator)
+NativeExecutable* JITThunks::hostFunctionStub(JSGlobalData* globalData, NativeFunction function, ThunkGenerator generator)
 {
-    std::pair<HostFunctionStubMap::iterator, bool> entry = m_hostFunctionStubMap.add(function, 0);
+    std::pair<HostFunctionStubMap::iterator, bool> entry = m_hostFunctionStubMap->add(function, Global<NativeExecutable>(Global<NativeExecutable>::EmptyValue));
     if (entry.second) {
         MacroAssemblerCodePtr code = globalData->canUseJIT() ? generator(globalData, m_executablePool.get()) : MacroAssemblerCodePtr();
-        entry.first->second = NativeExecutable::create(code, function, ctiNativeConstruct(), callHostFunctionAsConstructor);
+        entry.first->second.set(*globalData, NativeExecutable::create(*globalData, code, function, ctiNativeConstruct(), callHostFunctionAsConstructor));
     }
-    return entry.first->second;
+    return entry.first->second.get();
+}
+
+void JITThunks::clearHostFunctionStubs()
+{
+    m_hostFunctionStubMap.clear();
 }
 
 } // namespace JSC
diff --git a/Source/JavaScriptCore/jit/JITStubs.h b/Source/JavaScriptCore/jit/JITStubs.h
index 65f6a55..af6e13f 100644
--- a/Source/JavaScriptCore/jit/JITStubs.h
+++ b/Source/JavaScriptCore/jit/JITStubs.h
@@ -254,6 +254,8 @@ namespace JSC {
     extern "C" void ctiOpThrowNotCaught();
     extern "C" EncodedJSValue ctiTrampoline(void* code, RegisterFile*, CallFrame*, void* /*unused1*/, Profiler**, JSGlobalData*);
 
+    template <typename T> class Global;
+
     class JITThunks {
     public:
         JITThunks(JSGlobalData*);
@@ -273,13 +275,16 @@ namespace JSC {
 
         MacroAssemblerCodePtr ctiStub(JSGlobalData* globalData, ThunkGenerator generator);
 
-        PassRefPtr<NativeExecutable> hostFunctionStub(JSGlobalData* globalData, NativeFunction func);
-        PassRefPtr<NativeExecutable> hostFunctionStub(JSGlobalData* globalData, NativeFunction func, ThunkGenerator generator);
+        NativeExecutable* hostFunctionStub(JSGlobalData*, NativeFunction);
+        NativeExecutable* hostFunctionStub(JSGlobalData*, NativeFunction, ThunkGenerator);
+
+        void clearHostFunctionStubs();
+
     private:
         typedef HashMap<ThunkGenerator, MacroAssemblerCodePtr> CTIStubMap;
         CTIStubMap m_ctiStubMap;
-        typedef HashMap<NativeFunction, RefPtr<NativeExecutable> > HostFunctionStubMap;
-        HostFunctionStubMap m_hostFunctionStubMap;
+        typedef HashMap<NativeFunction, Global<NativeExecutable> > HostFunctionStubMap;
+        OwnPtr<HostFunctionStubMap> m_hostFunctionStubMap;
         RefPtr<ExecutablePool> m_executablePool;
 
         TrampolineStructure m_trampolineStructure;
diff --git a/Source/JavaScriptCore/jit/JSInterfaceJIT.h b/Source/JavaScriptCore/jit/JSInterfaceJIT.h
index 6453bab..5d3f239 100644
--- a/Source/JavaScriptCore/jit/JSInterfaceJIT.h
+++ b/Source/JavaScriptCore/jit/JSInterfaceJIT.h
@@ -29,6 +29,7 @@
 #include "JITCode.h"
 #include "JITStubs.h"
 #include "JSImmediate.h"
+#include "JSValue.h"
 #include "MacroAssembler.h"
 #include "RegisterFile.h"
 #include <wtf/AlwaysInline.h>
@@ -157,13 +158,20 @@ namespace JSC {
 #error "JIT not supported on this platform."
 #endif
 
+#if USE(JSVALUE32_64)
+        // Can't just propogate JSValue::Int32Tag as visual studio doesn't like it
+        static const unsigned Int32Tag = 0xfffffffd;
+        COMPILE_ASSERT(Int32Tag == JSValue::Int32Tag, Int32Tag_out_of_sync);
+#else
+        static const unsigned Int32Tag = JSImmediate::TagTypeNumber >> 32;
+#endif
         inline Jump emitLoadJSCell(unsigned virtualRegisterIndex, RegisterID payload);
         inline Jump emitLoadInt32(unsigned virtualRegisterIndex, RegisterID dst);
         inline Jump emitLoadDouble(unsigned virtualRegisterIndex, FPRegisterID dst, RegisterID scratch);
 
 #if USE(JSVALUE32_64)
         inline Jump emitJumpIfNotJSCell(unsigned virtualRegisterIndex);
-        inline Address tagFor(unsigned index, RegisterID base = callFrameRegister);
+        inline Address tagFor(int index, RegisterID base = callFrameRegister);
 #endif
 
 #if USE(JSVALUE64)
@@ -172,8 +180,10 @@ namespace JSC {
         void emitFastArithImmToInt(RegisterID reg);
 #endif
 
-        inline Address payloadFor(unsigned index, RegisterID base = callFrameRegister);
-        inline Address addressFor(unsigned index, RegisterID base = callFrameRegister);
+        inline Address payloadFor(int index, RegisterID base = callFrameRegister);
+        inline Address intPayloadFor(int index, RegisterID base = callFrameRegister);
+        inline Address intTagFor(int index, RegisterID base = callFrameRegister);
+        inline Address addressFor(int index, RegisterID base = callFrameRegister);
     };
 
     struct ThunkHelpers {
@@ -192,34 +202,44 @@ namespace JSC {
     inline JSInterfaceJIT::Jump JSInterfaceJIT::emitJumpIfNotJSCell(unsigned virtualRegisterIndex)
     {
         ASSERT(static_cast<int>(virtualRegisterIndex) < FirstConstantRegisterIndex);
-        return branch32(NotEqual, tagFor(virtualRegisterIndex), Imm32(JSValue::CellTag));
+        return branch32(NotEqual, tagFor(virtualRegisterIndex), TrustedImm32(JSValue::CellTag));
     }
     
     inline JSInterfaceJIT::Jump JSInterfaceJIT::emitLoadInt32(unsigned virtualRegisterIndex, RegisterID dst)
     {
         ASSERT(static_cast<int>(virtualRegisterIndex) < FirstConstantRegisterIndex);
         loadPtr(payloadFor(virtualRegisterIndex), dst);
-        return branch32(NotEqual, tagFor(virtualRegisterIndex), Imm32(JSValue::Int32Tag));
+        return branch32(NotEqual, tagFor(static_cast<int>(virtualRegisterIndex)), TrustedImm32(JSValue::Int32Tag));
     }
     
-    inline JSInterfaceJIT::Address JSInterfaceJIT::tagFor(unsigned virtualRegisterIndex, RegisterID base)
+    inline JSInterfaceJIT::Address JSInterfaceJIT::tagFor(int virtualRegisterIndex, RegisterID base)
     {
-        ASSERT(static_cast<int>(virtualRegisterIndex) < FirstConstantRegisterIndex);
-        return Address(base, (virtualRegisterIndex * sizeof(Register)) + OBJECT_OFFSETOF(JSValue, u.asBits.tag));
+        ASSERT(virtualRegisterIndex < FirstConstantRegisterIndex);
+        return Address(base, (static_cast<unsigned>(virtualRegisterIndex) * sizeof(Register)) + OBJECT_OFFSETOF(JSValue, u.asBits.tag));
     }
     
-    inline JSInterfaceJIT::Address JSInterfaceJIT::payloadFor(unsigned virtualRegisterIndex, RegisterID base)
+    inline JSInterfaceJIT::Address JSInterfaceJIT::payloadFor(int virtualRegisterIndex, RegisterID base)
     {
-        ASSERT(static_cast<int>(virtualRegisterIndex) < FirstConstantRegisterIndex);
-        return Address(base, (virtualRegisterIndex * sizeof(Register)) + OBJECT_OFFSETOF(JSValue, u.asBits.payload));
+        ASSERT(virtualRegisterIndex < FirstConstantRegisterIndex);
+        return Address(base, (static_cast<unsigned>(virtualRegisterIndex) * sizeof(Register)) + OBJECT_OFFSETOF(JSValue, u.asBits.payload));
+    }
+
+    inline JSInterfaceJIT::Address JSInterfaceJIT::intPayloadFor(int virtualRegisterIndex, RegisterID base)
+    {
+        return payloadFor(virtualRegisterIndex, base);
+    }
+
+    inline JSInterfaceJIT::Address JSInterfaceJIT::intTagFor(int virtualRegisterIndex, RegisterID base)
+    {
+        return tagFor(virtualRegisterIndex, base);
     }
 
     inline JSInterfaceJIT::Jump JSInterfaceJIT::emitLoadDouble(unsigned virtualRegisterIndex, FPRegisterID dst, RegisterID scratch)
     {
         ASSERT(static_cast<int>(virtualRegisterIndex) < FirstConstantRegisterIndex);
         loadPtr(tagFor(virtualRegisterIndex), scratch);
-        Jump isDouble = branch32(Below, scratch, Imm32(JSValue::LowestTag));
-        Jump notInt = branch32(NotEqual, scratch, Imm32(JSValue::Int32Tag));
+        Jump isDouble = branch32(Below, scratch, TrustedImm32(JSValue::LowestTag));
+        Jump notInt = branch32(NotEqual, scratch, TrustedImm32(JSValue::Int32Tag));
         loadPtr(payloadFor(virtualRegisterIndex), scratch);
         convertInt32ToDouble(scratch, dst);
         Jump done = jump();
@@ -274,17 +294,28 @@ namespace JSC {
 #endif
 
 #if USE(JSVALUE64)
-    inline JSInterfaceJIT::Address JSInterfaceJIT::payloadFor(unsigned virtualRegisterIndex, RegisterID base)
+    inline JSInterfaceJIT::Address JSInterfaceJIT::payloadFor(int virtualRegisterIndex, RegisterID base)
     {
-        ASSERT(static_cast<int>(virtualRegisterIndex) < FirstConstantRegisterIndex);
+        ASSERT(virtualRegisterIndex < FirstConstantRegisterIndex);
         return addressFor(virtualRegisterIndex, base);
     }
+
+    inline JSInterfaceJIT::Address JSInterfaceJIT::intPayloadFor(int virtualRegisterIndex, RegisterID base)
+    {
+        ASSERT(virtualRegisterIndex < FirstConstantRegisterIndex);
+        return Address(base, (static_cast<unsigned>(virtualRegisterIndex) * sizeof(Register)) + OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.payload));
+    }
+    inline JSInterfaceJIT::Address JSInterfaceJIT::intTagFor(int virtualRegisterIndex, RegisterID base)
+    {
+        ASSERT(virtualRegisterIndex < FirstConstantRegisterIndex);
+        return Address(base, (static_cast<unsigned>(virtualRegisterIndex) * sizeof(Register)) + OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.tag));
+    }
 #endif
 
-    inline JSInterfaceJIT::Address JSInterfaceJIT::addressFor(unsigned virtualRegisterIndex, RegisterID base)
+    inline JSInterfaceJIT::Address JSInterfaceJIT::addressFor(int virtualRegisterIndex, RegisterID base)
     {
-        ASSERT(static_cast<int>(virtualRegisterIndex) < FirstConstantRegisterIndex);
-        return Address(base, (virtualRegisterIndex * sizeof(Register)));
+        ASSERT(virtualRegisterIndex < FirstConstantRegisterIndex);
+        return Address(base, (static_cast<unsigned>(virtualRegisterIndex) * sizeof(Register)));
     }
 
 }
diff --git a/Source/JavaScriptCore/jit/SpecializedThunkJIT.h b/Source/JavaScriptCore/jit/SpecializedThunkJIT.h
index 5c593d9..8c79692 100644
--- a/Source/JavaScriptCore/jit/SpecializedThunkJIT.h
+++ b/Source/JavaScriptCore/jit/SpecializedThunkJIT.h
@@ -43,7 +43,7 @@ namespace JSC {
             , m_pool(pool)
         {
             // Check that we have the expected number of arguments
-            m_failures.append(branch32(NotEqual, Address(callFrameRegister, RegisterFile::ArgumentCount * (int)sizeof(Register)), Imm32(expectedArgCount + 1)));
+            m_failures.append(branch32(NotEqual, Address(callFrameRegister, RegisterFile::ArgumentCount * (int)sizeof(Register)), TrustedImm32(expectedArgCount + 1)));
         }
         
         void loadDoubleArgument(int argument, FPRegisterID dst, RegisterID scratch)
@@ -61,7 +61,7 @@ namespace JSC {
         void loadJSStringArgument(int argument, RegisterID dst)
         {
             loadCellArgument(argument, dst);
-            m_failures.append(branchPtr(NotEqual, Address(dst, 0), ImmPtr(m_globalData->jsStringVPtr)));
+            m_failures.append(branchPtr(NotEqual, Address(dst, 0), TrustedImmPtr(m_globalData->jsStringVPtr)));
             m_failures.append(branchTest32(NonZero, Address(dst, OBJECT_OFFSETOF(JSString, m_fiberCount))));
         }
         
@@ -87,7 +87,7 @@ namespace JSC {
         {
             if (src != regT0)
                 move(src, regT0);
-            loadPtr(Address(callFrameRegister, RegisterFile::CallerFrame * (int)sizeof(Register)), callFrameRegister);
+            loadPtr(payloadFor(RegisterFile::CallerFrame, callFrameRegister), callFrameRegister);
             ret();
         }
         
@@ -101,7 +101,7 @@ namespace JSC {
             loadPtr(Address(stackPointerRegister, OBJECT_OFFSETOF(JSValue, u.asBits.tag) - sizeof(double)), regT1);
             loadPtr(Address(stackPointerRegister, OBJECT_OFFSETOF(JSValue, u.asBits.payload) - sizeof(double)), regT0);
 #endif
-            loadPtr(Address(callFrameRegister, RegisterFile::CallerFrame * (int)sizeof(Register)), callFrameRegister);
+            loadPtr(payloadFor(RegisterFile::CallerFrame, callFrameRegister), callFrameRegister);
             ret();
         }
 
@@ -110,7 +110,7 @@ namespace JSC {
             if (src != regT0)
                 move(src, regT0);
             tagReturnAsInt32();
-            loadPtr(Address(callFrameRegister, RegisterFile::CallerFrame * (int)sizeof(Register)), callFrameRegister);
+            loadPtr(payloadFor(RegisterFile::CallerFrame, callFrameRegister), callFrameRegister);
             ret();
         }
 
@@ -119,7 +119,7 @@ namespace JSC {
             if (src != regT0)
                 move(src, regT0);
             tagReturnAsJSCell();
-            loadPtr(Address(callFrameRegister, RegisterFile::CallerFrame * (int)sizeof(Register)), callFrameRegister);
+            loadPtr(payloadFor(RegisterFile::CallerFrame, callFrameRegister), callFrameRegister);
             ret();
         }
         
@@ -141,14 +141,14 @@ namespace JSC {
 #if USE(JSVALUE64)
             orPtr(tagTypeNumberRegister, regT0);
 #else
-            move(Imm32(JSValue::Int32Tag), regT1);
+            move(TrustedImm32(JSValue::Int32Tag), regT1);
 #endif
         }
 
         void tagReturnAsJSCell()
         {
 #if USE(JSVALUE32_64)
-            move(Imm32(JSValue::CellTag), regT1);
+            move(TrustedImm32(JSValue::CellTag), regT1);
 #endif
         }
         
diff --git a/Source/JavaScriptCore/jit/ThunkGenerators.cpp b/Source/JavaScriptCore/jit/ThunkGenerators.cpp
index 9b40f12..1201696 100644
--- a/Source/JavaScriptCore/jit/ThunkGenerators.cpp
+++ b/Source/JavaScriptCore/jit/ThunkGenerators.cpp
@@ -57,8 +57,8 @@ static void stringCharLoad(SpecializedThunkJIT& jit)
 
 static void charToString(SpecializedThunkJIT& jit, JSGlobalData* globalData, MacroAssembler::RegisterID src, MacroAssembler::RegisterID dst, MacroAssembler::RegisterID scratch)
 {
-    jit.appendFailure(jit.branch32(MacroAssembler::AboveOrEqual, src, MacroAssembler::Imm32(0x100)));
-    jit.move(MacroAssembler::ImmPtr(globalData->smallStrings.singleCharacterStrings()), scratch);
+    jit.appendFailure(jit.branch32(MacroAssembler::AboveOrEqual, src, MacroAssembler::TrustedImm32(0x100)));
+    jit.move(MacroAssembler::TrustedImmPtr(globalData->smallStrings.singleCharacterStrings()), scratch);
     jit.loadPtr(MacroAssembler::BaseIndex(scratch, src, MacroAssembler::ScalePtr, 0), dst);
     jit.appendFailure(jit.branchTestPtr(MacroAssembler::Zero, dst));
 }
@@ -115,16 +115,16 @@ MacroAssemblerCodePtr powThunkGenerator(JSGlobalData* globalData, ExecutablePool
     jit.loadDoubleArgument(0, SpecializedThunkJIT::fpRegT0, SpecializedThunkJIT::regT0);
     MacroAssembler::Jump nonIntExponent;
     jit.loadInt32Argument(1, SpecializedThunkJIT::regT0, nonIntExponent);
-    jit.appendFailure(jit.branch32(MacroAssembler::LessThan, SpecializedThunkJIT::regT0, MacroAssembler::Imm32(0)));
+    jit.appendFailure(jit.branch32(MacroAssembler::LessThan, SpecializedThunkJIT::regT0, MacroAssembler::TrustedImm32(0)));
     
     MacroAssembler::Jump exponentIsZero = jit.branchTest32(MacroAssembler::Zero, SpecializedThunkJIT::regT0);
     MacroAssembler::Label startLoop(jit.label());
 
-    MacroAssembler::Jump exponentIsEven = jit.branchTest32(MacroAssembler::Zero, SpecializedThunkJIT::regT0, MacroAssembler::Imm32(1));
+    MacroAssembler::Jump exponentIsEven = jit.branchTest32(MacroAssembler::Zero, SpecializedThunkJIT::regT0, MacroAssembler::TrustedImm32(1));
     jit.mulDouble(SpecializedThunkJIT::fpRegT0, SpecializedThunkJIT::fpRegT1);
     exponentIsEven.link(&jit);
     jit.mulDouble(SpecializedThunkJIT::fpRegT0, SpecializedThunkJIT::fpRegT0);
-    jit.rshift32(MacroAssembler::Imm32(1), SpecializedThunkJIT::regT0);
+    jit.rshift32(MacroAssembler::TrustedImm32(1), SpecializedThunkJIT::regT0);
     jit.branchTest32(MacroAssembler::NonZero, SpecializedThunkJIT::regT0).linkTo(startLoop, &jit);
 
     exponentIsZero.link(&jit);
diff --git a/Source/JavaScriptCore/jsc.cpp b/Source/JavaScriptCore/jsc.cpp
index 1873659..8ccb039 100644
--- a/Source/JavaScriptCore/jsc.cpp
+++ b/Source/JavaScriptCore/jsc.cpp
@@ -141,14 +141,14 @@ long StopWatch::getElapsedMS()
 
 class GlobalObject : public JSGlobalObject {
 public:
-    GlobalObject(const Vector<UString>& arguments);
+    GlobalObject(JSGlobalData&, const Vector<UString>& arguments);
     virtual UString className() const { return "global"; }
 };
 COMPILE_ASSERT(!IsInteger<GlobalObject>::value, WTF_IsInteger_GlobalObject_false);
 ASSERT_CLASS_FITS_IN_CELL(GlobalObject);
 
-GlobalObject::GlobalObject(const Vector<UString>& arguments)
-    : JSGlobalObject()
+GlobalObject::GlobalObject(JSGlobalData& globalData, const Vector<UString>& arguments)
+    : JSGlobalObject(globalData)
 {
     putDirectFunction(globalExec(), new (globalExec()) JSFunction(globalExec(), this, functionStructure(), 1, Identifier(globalExec(), "debug"), functionDebug));
     putDirectFunction(globalExec(), new (globalExec()) JSFunction(globalExec(), this, functionStructure(), 1, Identifier(globalExec(), "print"), functionPrint));
@@ -212,7 +212,7 @@ EncodedJSValue JSC_HOST_CALL functionRun(ExecState* exec)
     if (!fillBufferWithContentsOfFile(fileName, script))
         return JSValue::encode(throwError(exec, createError(exec, "Could not open file.")));
 
-    GlobalObject* globalObject = new (&exec->globalData()) GlobalObject(Vector<UString>());
+    GlobalObject* globalObject = new (&exec->globalData()) GlobalObject(exec->globalData(), Vector<UString>());
 
     StopWatch stopWatch;
     stopWatch.start();
@@ -536,7 +536,7 @@ int jscmain(int argc, char** argv, JSGlobalData* globalData)
     Options options;
     parseArguments(argc, argv, options, globalData);
 
-    GlobalObject* globalObject = new (globalData) GlobalObject(options.arguments);
+    GlobalObject* globalObject = new (globalData) GlobalObject(*globalData, options.arguments);
     bool success = runWithScripts(globalObject, options.scripts, options.dump);
     if (options.interactive && success)
         runInteractive(globalObject);
diff --git a/Source/JavaScriptCore/jsc.pro b/Source/JavaScriptCore/jsc.pro
index a550c48..21ffeea 100644
--- a/Source/JavaScriptCore/jsc.pro
+++ b/Source/JavaScriptCore/jsc.pro
@@ -27,6 +27,10 @@ mac {
     LIBS_PRIVATE += -framework AppKit
 }
 
+win* {
+    LIBS += -ladvapi32
+}
+
 wince* {
     LIBS += mmtimer.lib
 }
diff --git a/Source/JavaScriptCore/profiler/CallIdentifier.h b/Source/JavaScriptCore/profiler/CallIdentifier.h
index a9827c0..1ba5ec6 100644
--- a/Source/JavaScriptCore/profiler/CallIdentifier.h
+++ b/Source/JavaScriptCore/profiler/CallIdentifier.h
@@ -63,7 +63,7 @@ namespace JSC {
                     key.m_url.impl()->hash(),
                     key.m_lineNumber
                 };
-                return WTF::StringHasher::createBlobHash<sizeof(hashCodes)>(hashCodes);
+                return StringHasher::hashMemory<sizeof(hashCodes)>(hashCodes);
             }
 
             static bool equal(const CallIdentifier& a, const CallIdentifier& b) { return a == b; }
diff --git a/Source/JavaScriptCore/profiler/ProfileGenerator.cpp b/Source/JavaScriptCore/profiler/ProfileGenerator.cpp
index 68d1733..5db38bc 100644
--- a/Source/JavaScriptCore/profiler/ProfileGenerator.cpp
+++ b/Source/JavaScriptCore/profiler/ProfileGenerator.cpp
@@ -40,19 +40,19 @@ namespace JSC {
 
 static const char* NonJSExecution = "(idle)";
 
-PassRefPtr<ProfileGenerator> ProfileGenerator::create(const UString& title, ExecState* originatingExec, unsigned uid)
+PassRefPtr<ProfileGenerator> ProfileGenerator::create(ExecState* exec, const UString& title, unsigned uid)
 {
-    return adoptRef(new ProfileGenerator(title, originatingExec, uid));
+    return adoptRef(new ProfileGenerator(exec, title, uid));
 }
 
-ProfileGenerator::ProfileGenerator(const UString& title, ExecState* originatingExec, unsigned uid)
-    : m_originatingGlobalExec(originatingExec ? originatingExec->lexicalGlobalObject()->globalExec() : 0)
-    , m_profileGroup(originatingExec ? originatingExec->lexicalGlobalObject()->profileGroup() : 0)
+ProfileGenerator::ProfileGenerator(ExecState* exec, const UString& title, unsigned uid)
+    : m_origin(exec ? exec->lexicalGlobalObject() : 0)
+    , m_profileGroup(exec ? exec->lexicalGlobalObject()->profileGroup() : 0)
 {
     m_profile = Profile::create(title, uid);
     m_currentNode = m_head = m_profile->head();
-    if (originatingExec)
-        addParentForConsoleStart(originatingExec);
+    if (exec)
+        addParentForConsoleStart(exec);
 }
 
 void ProfileGenerator::addParentForConsoleStart(ExecState* exec)
@@ -80,7 +80,7 @@ void ProfileGenerator::willExecute(ExecState* callerCallFrame, const CallIdentif
         JAVASCRIPTCORE_PROFILE_WILL_EXECUTE(m_profileGroup, const_cast<char*>(name.data()), const_cast<char*>(url.data()), callIdentifier.m_lineNumber);
     }
 
-    if (!m_originatingGlobalExec)
+    if (!m_origin)
         return;
 
     ASSERT(m_currentNode);
@@ -95,7 +95,7 @@ void ProfileGenerator::didExecute(ExecState* callerCallFrame, const CallIdentifi
         JAVASCRIPTCORE_PROFILE_DID_EXECUTE(m_profileGroup, const_cast<char*>(name.data()), const_cast<char*>(url.data()), callIdentifier.m_lineNumber);
     }
 
-    if (!m_originatingGlobalExec)
+    if (!m_origin)
         return;
 
     ASSERT(m_currentNode);
diff --git a/Source/JavaScriptCore/profiler/ProfileGenerator.h b/Source/JavaScriptCore/profiler/ProfileGenerator.h
index cbed73b..8c8b817 100644
--- a/Source/JavaScriptCore/profiler/ProfileGenerator.h
+++ b/Source/JavaScriptCore/profiler/ProfileGenerator.h
@@ -34,6 +34,7 @@
 namespace JSC {
 
     class ExecState;
+    class JSGlobalObject;
     class Profile;
     class ProfileNode;
     class UString;
@@ -41,12 +42,12 @@ namespace JSC {
 
     class ProfileGenerator : public RefCounted<ProfileGenerator>  {
     public:
-        static PassRefPtr<ProfileGenerator> create(const UString& title, ExecState* originatingExec, unsigned uid);
+        static PassRefPtr<ProfileGenerator> create(ExecState*, const UString& title, unsigned uid);
 
         // Members
         const UString& title() const;
         PassRefPtr<Profile> profile() const { return m_profile; }
-        ExecState* originatingGlobalExec() const { return m_originatingGlobalExec; }
+        JSGlobalObject* origin() const { return m_origin; }
         unsigned profileGroup() const { return m_profileGroup; }
 
         // Collecting
@@ -61,14 +62,14 @@ namespace JSC {
         typedef void (ProfileGenerator::*ProfileFunction)(ExecState* callerOrHandlerCallFrame, const CallIdentifier& callIdentifier);
 
     private:
-        ProfileGenerator(const UString& title, ExecState* originatingExec, unsigned uid);
+        ProfileGenerator(ExecState*, const UString& title, unsigned uid);
         void addParentForConsoleStart(ExecState*);
 
         void removeProfileStart();
         void removeProfileEnd();
 
         RefPtr<Profile> m_profile;
-        ExecState* m_originatingGlobalExec;
+        JSGlobalObject* m_origin;
         unsigned m_profileGroup;
         RefPtr<ProfileNode> m_head;
         RefPtr<ProfileNode> m_currentNode;
diff --git a/Source/JavaScriptCore/profiler/Profiler.cpp b/Source/JavaScriptCore/profiler/Profiler.cpp
index 301dc0c..bcaaaac 100644
--- a/Source/JavaScriptCore/profiler/Profiler.cpp
+++ b/Source/JavaScriptCore/profiler/Profiler.cpp
@@ -66,25 +66,25 @@ void Profiler::startProfiling(ExecState* exec, const UString& title)
 
     // Check if we currently have a Profile for this global ExecState and title.
     // If so return early and don't create a new Profile.
-    ExecState* globalExec = exec ? exec->lexicalGlobalObject()->globalExec() : 0;
+    JSGlobalObject* origin = exec ? exec->lexicalGlobalObject() : 0;
 
     for (size_t i = 0; i < m_currentProfiles.size(); ++i) {
         ProfileGenerator* profileGenerator = m_currentProfiles[i].get();
-        if (profileGenerator->originatingGlobalExec() == globalExec && profileGenerator->title() == title)
+        if (profileGenerator->origin() == origin && profileGenerator->title() == title)
             return;
     }
 
     s_sharedEnabledProfilerReference = this;
-    RefPtr<ProfileGenerator> profileGenerator = ProfileGenerator::create(title, exec, ++ProfilesUID);
+    RefPtr<ProfileGenerator> profileGenerator = ProfileGenerator::create(exec, title, ++ProfilesUID);
     m_currentProfiles.append(profileGenerator);
 }
 
 PassRefPtr<Profile> Profiler::stopProfiling(ExecState* exec, const UString& title)
 {
-    ExecState* globalExec = exec ? exec->lexicalGlobalObject()->globalExec() : 0;
+    JSGlobalObject* origin = exec ? exec->lexicalGlobalObject() : 0;
     for (ptrdiff_t i = m_currentProfiles.size() - 1; i >= 0; --i) {
         ProfileGenerator* profileGenerator = m_currentProfiles[i].get();
-        if (profileGenerator->originatingGlobalExec() == globalExec && (title.isNull() || profileGenerator->title() == title)) {
+        if (profileGenerator->origin() == origin && (title.isNull() || profileGenerator->title() == title)) {
             profileGenerator->stopProfiling();
             RefPtr<Profile> returnProfile = profileGenerator->profile();
 
@@ -99,10 +99,23 @@ PassRefPtr<Profile> Profiler::stopProfiling(ExecState* exec, const UString& titl
     return 0;
 }
 
+void Profiler::stopProfiling(JSGlobalObject* origin)
+{
+    for (ptrdiff_t i = m_currentProfiles.size() - 1; i >= 0; --i) {
+        ProfileGenerator* profileGenerator = m_currentProfiles[i].get();
+        if (profileGenerator->origin() == origin) {
+            profileGenerator->stopProfiling();
+            m_currentProfiles.remove(i);
+            if (!m_currentProfiles.size())
+                s_sharedEnabledProfilerReference = 0;
+        }
+    }
+}
+
 static inline void dispatchFunctionToProfiles(ExecState* callerOrHandlerCallFrame, const Vector<RefPtr<ProfileGenerator> >& profiles, ProfileGenerator::ProfileFunction function, const CallIdentifier& callIdentifier, unsigned currentProfileTargetGroup)
 {
     for (size_t i = 0; i < profiles.size(); ++i) {
-        if (profiles[i]->profileGroup() == currentProfileTargetGroup || !profiles[i]->originatingGlobalExec())
+        if (profiles[i]->profileGroup() == currentProfileTargetGroup || !profiles[i]->origin())
             (profiles[i].get()->*function)(callerOrHandlerCallFrame, callIdentifier);
     }
 }
diff --git a/Source/JavaScriptCore/profiler/Profiler.h b/Source/JavaScriptCore/profiler/Profiler.h
index f88746d..86366c1 100644
--- a/Source/JavaScriptCore/profiler/Profiler.h
+++ b/Source/JavaScriptCore/profiler/Profiler.h
@@ -38,6 +38,7 @@ namespace JSC {
 
     class ExecState;
     class JSGlobalData;
+    class JSGlobalObject;
     class JSObject;
     class JSValue;
     class ProfileGenerator;
@@ -57,6 +58,7 @@ namespace JSC {
 
         void startProfiling(ExecState*, const UString& title);
         PassRefPtr<Profile> stopProfiling(ExecState*, const UString& title);
+        void stopProfiling(JSGlobalObject*);
 
         void willExecute(ExecState* callerCallFrame, JSValue function);
         void willExecute(ExecState* callerCallFrame, const UString& sourceURL, int startingLineNumber);
diff --git a/Source/JavaScriptCore/runtime/ArgList.cpp b/Source/JavaScriptCore/runtime/ArgList.cpp
index 25a8916..f46d108 100644
--- a/Source/JavaScriptCore/runtime/ArgList.cpp
+++ b/Source/JavaScriptCore/runtime/ArgList.cpp
@@ -23,6 +23,7 @@
 
 #include "JSValue.h"
 #include "JSCell.h"
+#include "JSObject.h"
 #include "ScopeChain.h"
 
 using std::min;
@@ -38,12 +39,12 @@ void ArgList::getSlice(int startIndex, ArgList& result) const
     result = ArgList(m_args + startIndex, m_argCount - startIndex);
 }
 
-void MarkedArgumentBuffer::markLists(MarkStack& markStack, ListSet& markSet)
+void MarkedArgumentBuffer::markLists(HeapRootMarker& heapRootMarker, ListSet& markSet)
 {
     ListSet::iterator end = markSet.end();
     for (ListSet::iterator it = markSet.begin(); it != end; ++it) {
         MarkedArgumentBuffer* list = *it;
-        markStack.deprecatedAppendValues(list->m_buffer, list->m_size);
+        heapRootMarker.mark(reinterpret_cast<JSValue*>(list->m_buffer), list->m_size);
     }
 }
 
@@ -55,8 +56,8 @@ void MarkedArgumentBuffer::slowAppend(JSValue v)
     // our Vector's inline capacity, though, our values move to the 
     // heap, where they do need explicit marking.
     if (!m_markSet) {
-        // We can only register for explicit marking once we know which heap
-        // is the current one, i.e., when a non-immediate value is appended.
+        // FIXME: Even if v is not a JSCell*, if previous values in the buffer
+        // are, then they won't be marked!
         if (Heap* heap = Heap::heap(v)) {
             ListSet& markSet = heap->markListSet();
             markSet.add(this);
diff --git a/Source/JavaScriptCore/runtime/ArgList.h b/Source/JavaScriptCore/runtime/ArgList.h
index 5564d5b..a794a04 100644
--- a/Source/JavaScriptCore/runtime/ArgList.h
+++ b/Source/JavaScriptCore/runtime/ArgList.h
@@ -141,7 +141,7 @@ namespace JSC {
         const_iterator begin() const { return m_buffer; }
         const_iterator end() const { return m_buffer + m_size; }
 
-        static void markLists(MarkStack&, ListSet&);
+        static void markLists(HeapRootMarker&, ListSet&);
 
     private:
         void slowAppend(JSValue);
diff --git a/Source/JavaScriptCore/runtime/Arguments.h b/Source/JavaScriptCore/runtime/Arguments.h
index 007e0f1..950bb4e 100644
--- a/Source/JavaScriptCore/runtime/Arguments.h
+++ b/Source/JavaScriptCore/runtime/Arguments.h
@@ -92,9 +92,9 @@ namespace JSC {
             d->registers = &activation->registerAt(0);
         }
 
-        static PassRefPtr<Structure> createStructure(JSValue prototype) 
+        static PassRefPtr<Structure> createStructure(JSGlobalData& globalData, JSValue prototype) 
         { 
-            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info); 
+            return Structure::create(globalData, prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info); 
         }
 
     protected:
@@ -237,19 +237,17 @@ namespace JSC {
     // This JSActivation function is defined here so it can get at Arguments::setRegisters.
     inline void JSActivation::copyRegisters(JSGlobalData& globalData)
     {
-        ASSERT(!d()->registerArray);
+        ASSERT(!m_registerArray);
 
-        size_t numParametersMinusThis = d()->functionExecutable->parameterCount();
-        size_t numVars = d()->functionExecutable->capturedVariableCount();
-        size_t numLocals = numVars + numParametersMinusThis;
+        size_t numLocals = m_numCapturedVars + m_numParametersMinusThis;
 
         if (!numLocals)
             return;
 
-        int registerOffset = numParametersMinusThis + RegisterFile::CallFrameHeaderSize;
+        int registerOffset = m_numParametersMinusThis + RegisterFile::CallFrameHeaderSize;
         size_t registerArraySize = numLocals + RegisterFile::CallFrameHeaderSize;
 
-        OwnArrayPtr<WriteBarrier<Unknown> > registerArray = copyRegisterArray(globalData, d()->registers - registerOffset, registerArraySize);
+        OwnArrayPtr<WriteBarrier<Unknown> > registerArray = copyRegisterArray(globalData, m_registers - registerOffset, registerArraySize);
         WriteBarrier<Unknown>* registers = registerArray.get() + registerOffset;
         setRegisters(registers, registerArray.release());
     }
diff --git a/Source/JavaScriptCore/runtime/ArrayConstructor.cpp b/Source/JavaScriptCore/runtime/ArrayConstructor.cpp
index af2afc6..e0f4b23 100644
--- a/Source/JavaScriptCore/runtime/ArrayConstructor.cpp
+++ b/Source/JavaScriptCore/runtime/ArrayConstructor.cpp
@@ -52,16 +52,18 @@ ArrayConstructor::ArrayConstructor(ExecState* exec, JSGlobalObject* globalObject
 
 static inline JSObject* constructArrayWithSizeQuirk(ExecState* exec, const ArgList& args)
 {
+    JSGlobalObject* globalObject = asInternalFunction(exec->callee())->globalObject();
+
     // a single numeric argument denotes the array size (!)
     if (args.size() == 1 && args.at(0).isNumber()) {
         uint32_t n = args.at(0).toUInt32(exec);
         if (n != args.at(0).toNumber(exec))
             return throwError(exec, createRangeError(exec, "Array size is not a small enough positive integer."));
-        return new (exec) JSArray(exec->lexicalGlobalObject()->arrayStructure(), n, CreateInitialized);
+        return new (exec) JSArray(globalObject->arrayStructure(), n, CreateInitialized);
     }
 
     // otherwise the array is constructed with the arguments in it
-    return new (exec) JSArray(exec->globalData(), exec->lexicalGlobalObject()->arrayStructure(), args);
+    return new (exec) JSArray(exec->globalData(), globalObject->arrayStructure(), args);
 }
 
 static EncodedJSValue JSC_HOST_CALL constructWithArrayConstructor(ExecState* exec)
diff --git a/Source/JavaScriptCore/runtime/ArrayPrototype.cpp b/Source/JavaScriptCore/runtime/ArrayPrototype.cpp
index 488effd..fdbcd95 100644
--- a/Source/JavaScriptCore/runtime/ArrayPrototype.cpp
+++ b/Source/JavaScriptCore/runtime/ArrayPrototype.cpp
@@ -165,16 +165,20 @@ static unsigned argumentClampedIndexFromStartOrEnd(ExecState* exec, int argument
 EncodedJSValue JSC_HOST_CALL arrayProtoFuncToString(ExecState* exec)
 {
     JSValue thisValue = exec->hostThisValue();
+
     bool isRealArray = isJSArray(&exec->globalData(), thisValue);
     if (!isRealArray && !thisValue.inherits(&JSArray::s_info))
         return throwVMTypeError(exec);
     JSArray* thisObj = asArray(thisValue);
     
+    unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
+    if (exec->hadException())
+        return JSValue::encode(jsUndefined());
+
     StringRecursionChecker checker(exec, thisObj);
     if (EncodedJSValue earlyReturnValue = checker.earlyReturnValue())
         return earlyReturnValue;
 
-    unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
     unsigned totalSize = length ? length - 1 : 0;
 #if OS(SYMBIAN)
     // Symbian has very limited stack size available.
@@ -225,16 +229,20 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncToString(ExecState* exec)
 EncodedJSValue JSC_HOST_CALL arrayProtoFuncToLocaleString(ExecState* exec)
 {
     JSValue thisValue = exec->hostThisValue();
+
     if (!thisValue.inherits(&JSArray::s_info))
         return throwVMTypeError(exec);
     JSObject* thisObj = asArray(thisValue);
 
+    unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
+    if (exec->hadException())
+        return JSValue::encode(jsUndefined());
+
     StringRecursionChecker checker(exec, thisObj);
     if (EncodedJSValue earlyReturnValue = checker.earlyReturnValue())
         return earlyReturnValue;
 
     JSStringBuilder strBuffer;
-    unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
     for (unsigned k = 0; k < length; k++) {
         if (k >= 1)
             strBuffer.append(',');
@@ -260,6 +268,9 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncToLocaleString(ExecState* exec)
 EncodedJSValue JSC_HOST_CALL arrayProtoFuncJoin(ExecState* exec)
 {
     JSObject* thisObj = exec->hostThisValue().toThisObject(exec);
+    unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
+    if (exec->hadException())
+        return JSValue::encode(jsUndefined());
 
     StringRecursionChecker checker(exec, thisObj);
     if (EncodedJSValue earlyReturnValue = checker.earlyReturnValue())
@@ -271,7 +282,6 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncJoin(ExecState* exec)
     if (!exec->argument(0).isUndefined())
         separator = exec->argument(0).toString(exec);
 
-    unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
     unsigned k = 0;
     if (isJSArray(&exec->globalData(), thisObj)) {
         JSArray* array = asArray(thisObj);
@@ -355,12 +365,16 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncConcat(ExecState* exec)
 EncodedJSValue JSC_HOST_CALL arrayProtoFuncPop(ExecState* exec)
 {
     JSValue thisValue = exec->hostThisValue();
+
     if (isJSArray(&exec->globalData(), thisValue))
         return JSValue::encode(asArray(thisValue)->pop());
 
     JSObject* thisObj = thisValue.toThisObject(exec);
-    JSValue result;
     unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
+    if (exec->hadException())
+        return JSValue::encode(jsUndefined());
+
+    JSValue result;
     if (length == 0) {
         putProperty(exec, thisObj, exec->propertyNames().length, jsNumber(length));
         result = jsUndefined();
@@ -375,6 +389,7 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncPop(ExecState* exec)
 EncodedJSValue JSC_HOST_CALL arrayProtoFuncPush(ExecState* exec)
 {
     JSValue thisValue = exec->hostThisValue();
+
     if (isJSArray(&exec->globalData(), thisValue) && exec->argumentCount() == 1) {
         JSArray* array = asArray(thisValue);
         array->push(exec, exec->argument(0));
@@ -383,6 +398,9 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncPush(ExecState* exec)
 
     JSObject* thisObj = thisValue.toThisObject(exec);
     unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
+    if (exec->hadException())
+        return JSValue::encode(jsUndefined());
+
     for (unsigned n = 0; n < exec->argumentCount(); n++)
         thisObj->put(exec, length + n, exec->argument(n));
     length += exec->argumentCount();
@@ -394,8 +412,10 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncReverse(ExecState* exec)
 {
     JSObject* thisObj = exec->hostThisValue().toThisObject(exec);
     unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
-    unsigned middle = length / 2;
+    if (exec->hadException())
+        return JSValue::encode(jsUndefined());
 
+    unsigned middle = length / 2;
     for (unsigned k = 0; k < middle; k++) {
         unsigned lk1 = length - k - 1;
         JSValue obj2 = getProperty(exec, thisObj, lk1);
@@ -420,6 +440,9 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncShift(ExecState* exec)
     JSValue result;
 
     unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
+    if (exec->hadException())
+        return JSValue::encode(jsUndefined());
+
     if (length == 0) {
         putProperty(exec, thisObj, exec->propertyNames().length, jsNumber(length));
         result = jsUndefined();
@@ -451,6 +474,9 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncSlice(ExecState* exec)
     JSValue result = resObj;
 
     unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
+    if (exec->hadException())
+        return JSValue::encode(jsUndefined());
+
     unsigned begin = argumentClampedIndexFromStartOrEnd(exec, 0, length);
     unsigned end = argumentClampedIndexFromStartOrEnd(exec, 1, length, length);
 
@@ -466,6 +492,9 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncSlice(ExecState* exec)
 EncodedJSValue JSC_HOST_CALL arrayProtoFuncSort(ExecState* exec)
 {
     JSObject* thisObj = exec->hostThisValue().toThisObject(exec);
+    unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
+    if (!length || exec->hadException())
+        return JSValue::encode(thisObj);
 
     JSValue function = exec->argument(0);
     CallData callData;
@@ -481,11 +510,6 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncSort(ExecState* exec)
         return JSValue::encode(thisObj);
     }
 
-    unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
-
-    if (!length)
-        return JSValue::encode(thisObj);
-
     // "Min" sort. Not the fastest, but definitely less code than heapsort
     // or quicksort, and much less swapping than bubblesort/insertionsort.
     for (unsigned i = 0; i < length - 1; ++i) {
@@ -523,14 +547,16 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncSort(ExecState* exec)
 
 EncodedJSValue JSC_HOST_CALL arrayProtoFuncSplice(ExecState* exec)
 {
-    JSObject* thisObj = exec->hostThisValue().toThisObject(exec);
-
     // 15.4.4.12
 
+    JSObject* thisObj = exec->hostThisValue().toThisObject(exec);
+    unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
+    if (exec->hadException())
+        return JSValue::encode(jsUndefined());
+
     if (!exec->argumentCount())
         return JSValue::encode(constructEmptyArray(exec));
 
-    unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
     unsigned begin = argumentClampedIndexFromStartOrEnd(exec, 0, length);
 
     unsigned deleteCount = length - begin;
@@ -589,10 +615,13 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncSplice(ExecState* exec)
 
 EncodedJSValue JSC_HOST_CALL arrayProtoFuncUnShift(ExecState* exec)
 {
-    JSObject* thisObj = exec->hostThisValue().toThisObject(exec);
-
     // 15.4.4.13
+
+    JSObject* thisObj = exec->hostThisValue().toThisObject(exec);
     unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
+    if (exec->hadException())
+        return JSValue::encode(jsUndefined());
+
     unsigned nrArgs = exec->argumentCount();
     if ((nrArgs) && (length)) {
         if (isJSArray(&exec->globalData(), thisObj))
@@ -616,6 +645,9 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncUnShift(ExecState* exec)
 EncodedJSValue JSC_HOST_CALL arrayProtoFuncFilter(ExecState* exec)
 {
     JSObject* thisObj = exec->hostThisValue().toThisObject(exec);
+    unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
+    if (exec->hadException())
+        return JSValue::encode(jsUndefined());
 
     JSValue function = exec->argument(0);
     CallData callData;
@@ -627,7 +659,6 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncFilter(ExecState* exec)
     JSArray* resultArray = constructEmptyArray(exec);
 
     unsigned filterIndex = 0;
-    unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
     unsigned k = 0;
     if (callType == CallTypeJS && isJSArray(&exec->globalData(), thisObj)) {
         JSFunction* f = asFunction(function);
@@ -674,6 +705,9 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncFilter(ExecState* exec)
 EncodedJSValue JSC_HOST_CALL arrayProtoFuncMap(ExecState* exec)
 {
     JSObject* thisObj = exec->hostThisValue().toThisObject(exec);
+    unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
+    if (exec->hadException())
+        return JSValue::encode(jsUndefined());
 
     JSValue function = exec->argument(0);
     CallData callData;
@@ -683,8 +717,6 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncMap(ExecState* exec)
 
     JSObject* applyThis = exec->argument(1).isUndefinedOrNull() ? exec->globalThisValue() : exec->argument(1).toObject(exec);
 
-    unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
-
     JSArray* resultArray = constructEmptyArray(exec, length);
     unsigned k = 0;
     if (callType == CallTypeJS && isJSArray(&exec->globalData(), thisObj)) {
@@ -731,6 +763,9 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncMap(ExecState* exec)
 EncodedJSValue JSC_HOST_CALL arrayProtoFuncEvery(ExecState* exec)
 {
     JSObject* thisObj = exec->hostThisValue().toThisObject(exec);
+    unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
+    if (exec->hadException())
+        return JSValue::encode(jsUndefined());
 
     JSValue function = exec->argument(0);
     CallData callData;
@@ -742,7 +777,6 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncEvery(ExecState* exec)
 
     JSValue result = jsBoolean(true);
 
-    unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
     unsigned k = 0;
     if (callType == CallTypeJS && isJSArray(&exec->globalData(), thisObj)) {
         JSFunction* f = asFunction(function);
@@ -787,6 +821,9 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncEvery(ExecState* exec)
 EncodedJSValue JSC_HOST_CALL arrayProtoFuncForEach(ExecState* exec)
 {
     JSObject* thisObj = exec->hostThisValue().toThisObject(exec);
+    unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
+    if (exec->hadException())
+        return JSValue::encode(jsUndefined());
 
     JSValue function = exec->argument(0);
     CallData callData;
@@ -796,7 +833,6 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncForEach(ExecState* exec)
 
     JSObject* applyThis = exec->argument(1).isUndefinedOrNull() ? exec->globalThisValue() : exec->argument(1).toObject(exec);
 
-    unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
     unsigned k = 0;
     if (callType == CallTypeJS && isJSArray(&exec->globalData(), thisObj)) {
         JSFunction* f = asFunction(function);
@@ -832,6 +868,9 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncForEach(ExecState* exec)
 EncodedJSValue JSC_HOST_CALL arrayProtoFuncSome(ExecState* exec)
 {
     JSObject* thisObj = exec->hostThisValue().toThisObject(exec);
+    unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
+    if (exec->hadException())
+        return JSValue::encode(jsUndefined());
 
     JSValue function = exec->argument(0);
     CallData callData;
@@ -843,7 +882,6 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncSome(ExecState* exec)
 
     JSValue result = jsBoolean(false);
 
-    unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
     unsigned k = 0;
     if (callType == CallTypeJS && isJSArray(&exec->globalData(), thisObj)) {
         JSFunction* f = asFunction(function);
@@ -885,7 +923,10 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncSome(ExecState* exec)
 EncodedJSValue JSC_HOST_CALL arrayProtoFuncReduce(ExecState* exec)
 {
     JSObject* thisObj = exec->hostThisValue().toThisObject(exec);
-    
+    unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
+    if (exec->hadException())
+        return JSValue::encode(jsUndefined());
+
     JSValue function = exec->argument(0);
     CallData callData;
     CallType callType = getCallData(function, callData);
@@ -894,9 +935,9 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncReduce(ExecState* exec)
 
     unsigned i = 0;
     JSValue rv;
-    unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
     if (!length && exec->argumentCount() == 1)
         return throwVMTypeError(exec);
+
     JSArray* array = 0;
     if (isJSArray(&exec->globalData(), thisObj))
         array = asArray(thisObj);
@@ -955,7 +996,10 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncReduce(ExecState* exec)
 EncodedJSValue JSC_HOST_CALL arrayProtoFuncReduceRight(ExecState* exec)
 {
     JSObject* thisObj = exec->hostThisValue().toThisObject(exec);
-    
+    unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
+    if (exec->hadException())
+        return JSValue::encode(jsUndefined());
+
     JSValue function = exec->argument(0);
     CallData callData;
     CallType callType = getCallData(function, callData);
@@ -964,9 +1008,9 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncReduceRight(ExecState* exec)
     
     unsigned i = 0;
     JSValue rv;
-    unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
     if (!length && exec->argumentCount() == 1)
         return throwVMTypeError(exec);
+
     JSArray* array = 0;
     if (isJSArray(&exec->globalData(), thisObj))
         array = asArray(thisObj);
@@ -1023,13 +1067,13 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncReduceRight(ExecState* exec)
 
 EncodedJSValue JSC_HOST_CALL arrayProtoFuncIndexOf(ExecState* exec)
 {
-    // JavaScript 1.5 Extension by Mozilla
-    // Documentation: http://developer.mozilla.org/en/docs/Core_JavaScript_1.5_Reference:Global_Objects:Array:indexOf
+    // 15.4.4.14
     JSObject* thisObj = exec->hostThisValue().toThisObject(exec);
-
     unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
-    unsigned index = argumentClampedIndexFromStartOrEnd(exec, 1, length);
+    if (exec->hadException())
+        return JSValue::encode(jsUndefined());
 
+    unsigned index = argumentClampedIndexFromStartOrEnd(exec, 1, length);
     JSValue searchElement = exec->argument(0);
     for (; index < length; ++index) {
         JSValue e = getProperty(exec, thisObj, index);
@@ -1044,10 +1088,8 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncIndexOf(ExecState* exec)
 
 EncodedJSValue JSC_HOST_CALL arrayProtoFuncLastIndexOf(ExecState* exec)
 {
-    // JavaScript 1.6 Extension by Mozilla
-    // Documentation: http://developer.mozilla.org/en/docs/Core_JavaScript_1.5_Reference:Global_Objects:Array:lastIndexOf
+    // 15.4.4.15
     JSObject* thisObj = exec->hostThisValue().toThisObject(exec);
-
     unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
     if (!length)
         return JSValue::encode(jsNumber(-1));
diff --git a/Source/JavaScriptCore/runtime/ArrayPrototype.h b/Source/JavaScriptCore/runtime/ArrayPrototype.h
index e41d8ca..96641bd 100644
--- a/Source/JavaScriptCore/runtime/ArrayPrototype.h
+++ b/Source/JavaScriptCore/runtime/ArrayPrototype.h
@@ -35,9 +35,9 @@ namespace JSC {
 
         static const ClassInfo s_info;
 
-        static PassRefPtr<Structure> createStructure(JSValue prototype)
+        static PassRefPtr<Structure> createStructure(JSGlobalData& globalData, JSValue prototype)
         {
-            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
+            return Structure::create(globalData, prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
         }
 
     protected:
diff --git a/Source/JavaScriptCore/runtime/BooleanConstructor.cpp b/Source/JavaScriptCore/runtime/BooleanConstructor.cpp
index 21ef5bb..e5b0f3d 100644
--- a/Source/JavaScriptCore/runtime/BooleanConstructor.cpp
+++ b/Source/JavaScriptCore/runtime/BooleanConstructor.cpp
@@ -40,7 +40,7 @@ BooleanConstructor::BooleanConstructor(ExecState* exec, JSGlobalObject* globalOb
 // ECMA 15.6.2
 JSObject* constructBoolean(ExecState* exec, const ArgList& args)
 {
-    BooleanObject* obj = new (exec) BooleanObject(exec->globalData(), exec->lexicalGlobalObject()->booleanObjectStructure());
+    BooleanObject* obj = new (exec) BooleanObject(exec->globalData(), asInternalFunction(exec->callee())->globalObject()->booleanObjectStructure());
     obj->setInternalValue(exec->globalData(), jsBoolean(args.at(0).toBoolean(exec)));
     return obj;
 }
@@ -69,9 +69,9 @@ CallType BooleanConstructor::getCallData(CallData& callData)
     return CallTypeHost;
 }
 
-JSObject* constructBooleanFromImmediateBoolean(ExecState* exec, JSValue immediateBooleanValue)
+JSObject* constructBooleanFromImmediateBoolean(ExecState* exec, JSGlobalObject* globalObject, JSValue immediateBooleanValue)
 {
-    BooleanObject* obj = new (exec) BooleanObject(exec->globalData(), exec->lexicalGlobalObject()->booleanObjectStructure());
+    BooleanObject* obj = new (exec) BooleanObject(exec->globalData(), globalObject->booleanObjectStructure());
     obj->setInternalValue(exec->globalData(), immediateBooleanValue);
     return obj;
 }
diff --git a/Source/JavaScriptCore/runtime/BooleanConstructor.h b/Source/JavaScriptCore/runtime/BooleanConstructor.h
index 0f3efa7..2550b3b 100644
--- a/Source/JavaScriptCore/runtime/BooleanConstructor.h
+++ b/Source/JavaScriptCore/runtime/BooleanConstructor.h
@@ -36,7 +36,7 @@ namespace JSC {
         virtual CallType getCallData(CallData&);
     };
 
-    JSObject* constructBooleanFromImmediateBoolean(ExecState*, JSValue);
+    JSObject* constructBooleanFromImmediateBoolean(ExecState*, JSGlobalObject*, JSValue);
     JSObject* constructBoolean(ExecState*, const ArgList&);
 
 } // namespace JSC
diff --git a/Source/JavaScriptCore/runtime/BooleanObject.cpp b/Source/JavaScriptCore/runtime/BooleanObject.cpp
index 16c4669..2945c0e 100644
--- a/Source/JavaScriptCore/runtime/BooleanObject.cpp
+++ b/Source/JavaScriptCore/runtime/BooleanObject.cpp
@@ -27,8 +27,8 @@ ASSERT_CLASS_FITS_IN_CELL(BooleanObject);
 
 const ClassInfo BooleanObject::s_info = { "Boolean", &JSWrapperObject::s_info, 0, 0 };
 
-BooleanObject::BooleanObject(JSGlobalData& globalData, NonNullPassRefPtr<Structure> structure)
-    : JSWrapperObject(globalData, structure)
+BooleanObject::BooleanObject(JSGlobalData&, NonNullPassRefPtr<Structure> structure)
+    : JSWrapperObject(structure)
 {
     ASSERT(inherits(&s_info));
 }
diff --git a/Source/JavaScriptCore/runtime/BooleanObject.h b/Source/JavaScriptCore/runtime/BooleanObject.h
index e2af0c2..ef2d403 100644
--- a/Source/JavaScriptCore/runtime/BooleanObject.h
+++ b/Source/JavaScriptCore/runtime/BooleanObject.h
@@ -31,9 +31,9 @@ namespace JSC {
 
         static const ClassInfo s_info;
         
-        static PassRefPtr<Structure> createStructure(JSValue prototype)
+        static PassRefPtr<Structure> createStructure(JSGlobalData& globalData, JSValue prototype)
         {
-            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
+            return Structure::create(globalData, prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
         }
     };
 
diff --git a/Source/JavaScriptCore/runtime/Completion.cpp b/Source/JavaScriptCore/runtime/Completion.cpp
index 83d8bd8..ac19705 100644
--- a/Source/JavaScriptCore/runtime/Completion.cpp
+++ b/Source/JavaScriptCore/runtime/Completion.cpp
@@ -39,7 +39,7 @@ Completion checkSyntax(ExecState* exec, const SourceCode& source)
     JSLock lock(exec);
     ASSERT(exec->globalData().identifierTable == wtfThreadData().currentIdentifierTable());
 
-    RefPtr<ProgramExecutable> program = ProgramExecutable::create(exec, source);
+    ProgramExecutable* program = ProgramExecutable::create(exec, source);
     JSObject* error = program->checkSyntax(exec);
     if (error)
         return Completion(Throw, error);
@@ -52,14 +52,16 @@ Completion evaluate(ExecState* exec, ScopeChainNode* scopeChain, const SourceCod
     JSLock lock(exec);
     ASSERT(exec->globalData().identifierTable == wtfThreadData().currentIdentifierTable());
 
-    RefPtr<ProgramExecutable> program = ProgramExecutable::create(exec, source);
-    JSObject* error = program->compile(exec, scopeChain);
-    if (error)
-        return Completion(Throw, error);
+    ProgramExecutable* program = ProgramExecutable::create(exec, source);
+    if (!program) {
+        JSValue exception = exec->globalData().exception;
+        exec->globalData().exception = JSValue();
+        return Completion(Throw, exception);
+    }
 
     JSObject* thisObj = (!thisValue || thisValue.isUndefinedOrNull()) ? exec->dynamicGlobalObject() : thisValue.toObject(exec);
 
-    JSValue result = exec->interpreter()->execute(program.get(), exec, scopeChain, thisObj);
+    JSValue result = exec->interpreter()->execute(program, exec, scopeChain, thisObj);
 
     if (exec->hadException()) {
         JSValue exception = exec->exception();
diff --git a/Source/JavaScriptCore/runtime/ConservativeSet.cpp b/Source/JavaScriptCore/runtime/ConservativeSet.cpp
index bc8bd6d..8872023 100644
--- a/Source/JavaScriptCore/runtime/ConservativeSet.cpp
+++ b/Source/JavaScriptCore/runtime/ConservativeSet.cpp
@@ -33,33 +33,26 @@ inline bool isPointerAligned(void* p)
     return !((intptr_t)(p) & (sizeof(char*) - 1));
 }
 
-void ConservativeSet::grow()
+void ConservativeRoots::grow()
 {
     size_t newCapacity = m_capacity == inlineCapacity ? nonInlineCapacity : m_capacity * 2;
-    DeprecatedPtr<JSCell>* newSet = static_cast<DeprecatedPtr<JSCell>*>(OSAllocator::reserveAndCommit(newCapacity * sizeof(JSCell*)));
-    memcpy(newSet, m_set, m_size * sizeof(JSCell*));
-    if (m_set != m_inlineSet)
-        OSAllocator::decommitAndRelease(m_set, m_capacity * sizeof(JSCell*));
+    JSCell** newRoots = static_cast<JSCell**>(OSAllocator::reserveAndCommit(newCapacity * sizeof(JSCell*)));
+    memcpy(newRoots, m_roots, m_size * sizeof(JSCell*));
+    if (m_roots != m_inlineRoots)
+        OSAllocator::decommitAndRelease(m_roots, m_capacity * sizeof(JSCell*));
     m_capacity = newCapacity;
-    m_set = newSet;
+    m_roots = newRoots;
 }
 
-void ConservativeSet::add(void* begin, void* end)
+void ConservativeRoots::add(void* begin, void* end)
 {
     ASSERT(begin <= end);
     ASSERT((static_cast<char*>(end) - static_cast<char*>(begin)) < 0x1000000);
     ASSERT(isPointerAligned(begin));
     ASSERT(isPointerAligned(end));
 
-    for (char** it = static_cast<char**>(begin); it != static_cast<char**>(end); ++it) {
-        if (!m_heap->contains(*it))
-            continue;
-
-        if (m_size == m_capacity)
-            grow();
-
-        m_set[m_size++] = reinterpret_cast<JSCell*>(*it);
-    }
+    for (char** it = static_cast<char**>(begin); it != static_cast<char**>(end); ++it)
+        add(*it);
 }
 
 } // namespace JSC
diff --git a/Source/JavaScriptCore/runtime/ConservativeSet.h b/Source/JavaScriptCore/runtime/ConservativeSet.h
index e7c2c4a..d078606 100644
--- a/Source/JavaScriptCore/runtime/ConservativeSet.h
+++ b/Source/JavaScriptCore/runtime/ConservativeSet.h
@@ -23,24 +23,30 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
-#ifndef ConservativeSet_h
-#define ConservativeSet_h
+#ifndef ConservativeRoots_h
+#define ConservativeRoots_h
 
 #include "Heap.h"
-#include "MarkStack.h"
+#include <wtf/OSAllocator.h>
 #include <wtf/Vector.h>
 
 namespace JSC {
 
 class JSCell;
+class Heap;
 
-class ConservativeSet {
+// May contain duplicates.
+
+class ConservativeRoots {
 public:
-    ConservativeSet(Heap*);
-    ~ConservativeSet();
+    ConservativeRoots(Heap*);
+    ~ConservativeRoots();
 
+    void add(void*);
     void add(void* begin, void* end);
-    void mark(MarkStack&);
+    
+    size_t size();
+    JSCell** roots();
 
 private:
     static const size_t inlineCapacity = 128;
@@ -49,32 +55,47 @@ private:
     void grow();
 
     Heap* m_heap;
-    DeprecatedPtr<JSCell>* m_set;
+    JSCell** m_roots;
     size_t m_size;
     size_t m_capacity;
-    DeprecatedPtr<JSCell> m_inlineSet[inlineCapacity];
+    JSCell* m_inlineRoots[inlineCapacity];
 };
 
-inline ConservativeSet::ConservativeSet(Heap* heap)
+inline ConservativeRoots::ConservativeRoots(Heap* heap)
     : m_heap(heap)
-    , m_set(m_inlineSet)
+    , m_roots(m_inlineRoots)
     , m_size(0)
     , m_capacity(inlineCapacity)
 {
 }
 
-inline ConservativeSet::~ConservativeSet()
+inline ConservativeRoots::~ConservativeRoots()
+{
+    if (m_roots != m_inlineRoots)
+        OSAllocator::decommitAndRelease(m_roots, m_capacity * sizeof(JSCell*));
+}
+
+inline void ConservativeRoots::add(void* p)
+{
+    if (!m_heap->contains(p))
+        return;
+
+    if (m_size == m_capacity)
+        grow();
+
+    m_roots[m_size++] = reinterpret_cast<JSCell*>(p);
+}
+
+inline size_t ConservativeRoots::size()
 {
-    if (m_set != m_inlineSet)
-        OSAllocator::decommitAndRelease(m_set, m_capacity * sizeof(DeprecatedPtr<JSCell>*));
+    return m_size;
 }
 
-inline void ConservativeSet::mark(MarkStack& markStack)
+inline JSCell** ConservativeRoots::roots()
 {
-    for (size_t i = 0; i < m_size; ++i)
-        markStack.append(&m_set[i]);
+    return m_roots;
 }
 
 } // namespace JSC
 
-#endif // ConservativeSet_h
+#endif // ConservativeRoots_h
diff --git a/Source/JavaScriptCore/runtime/DateConstructor.cpp b/Source/JavaScriptCore/runtime/DateConstructor.cpp
index efaeb0f..0a06148 100644
--- a/Source/JavaScriptCore/runtime/DateConstructor.cpp
+++ b/Source/JavaScriptCore/runtime/DateConstructor.cpp
@@ -70,7 +70,7 @@ DateConstructor::DateConstructor(ExecState* exec, JSGlobalObject* globalObject,
 }
 
 // ECMA 15.9.3
-JSObject* constructDate(ExecState* exec, const ArgList& args)
+JSObject* constructDate(ExecState* exec, JSGlobalObject* globalObject, const ArgList& args)
 {
     int numArgs = args.size();
 
@@ -121,13 +121,13 @@ JSObject* constructDate(ExecState* exec, const ArgList& args)
         }
     }
 
-    return new (exec) DateInstance(exec, value);
+    return new (exec) DateInstance(exec, globalObject->dateStructure(), value);
 }
     
 static EncodedJSValue JSC_HOST_CALL constructWithDateConstructor(ExecState* exec)
 {
     ArgList args(exec);
-    return JSValue::encode(constructDate(exec, args));
+    return JSValue::encode(constructDate(exec, asInternalFunction(exec->callee())->globalObject(), args));
 }
 
 ConstructType DateConstructor::getConstructData(ConstructData& constructData)
diff --git a/Source/JavaScriptCore/runtime/DateConstructor.h b/Source/JavaScriptCore/runtime/DateConstructor.h
index 2adcd08..bd529f1 100644
--- a/Source/JavaScriptCore/runtime/DateConstructor.h
+++ b/Source/JavaScriptCore/runtime/DateConstructor.h
@@ -36,7 +36,7 @@ namespace JSC {
         virtual CallType getCallData(CallData&);
     };
 
-    JSObject* constructDate(ExecState*, const ArgList&);
+    JSObject* constructDate(ExecState*, JSGlobalObject*, const ArgList&);
 
 } // namespace JSC
 
diff --git a/Source/JavaScriptCore/runtime/DateConversion.cpp b/Source/JavaScriptCore/runtime/DateConversion.cpp
index 597f1e9..1418876 100644
--- a/Source/JavaScriptCore/runtime/DateConversion.cpp
+++ b/Source/JavaScriptCore/runtime/DateConversion.cpp
@@ -44,6 +44,7 @@
 #include "DateConversion.h"
 
 #include "CallFrame.h"
+#include "JSObject.h"
 #include "ScopeChain.h"
 #include "UString.h"
 #include <wtf/DateMath.h>
diff --git a/Source/JavaScriptCore/runtime/DateInstance.cpp b/Source/JavaScriptCore/runtime/DateInstance.cpp
index 95d5dc2..74adda4 100644
--- a/Source/JavaScriptCore/runtime/DateInstance.cpp
+++ b/Source/JavaScriptCore/runtime/DateInstance.cpp
@@ -35,21 +35,14 @@ namespace JSC {
 const ClassInfo DateInstance::s_info = {"Date", &JSWrapperObject::s_info, 0, 0};
 
 DateInstance::DateInstance(ExecState* exec, NonNullPassRefPtr<Structure> structure)
-    : JSWrapperObject(exec->globalData(), structure)
+    : JSWrapperObject(structure)
 {
     ASSERT(inherits(&s_info));
     setInternalValue(exec->globalData(), jsNaN());
 }
 
 DateInstance::DateInstance(ExecState* exec, NonNullPassRefPtr<Structure> structure, double time)
-    : JSWrapperObject(exec->globalData(), structure)
-{
-    ASSERT(inherits(&s_info));
-    setInternalValue(exec->globalData(), jsNumber(timeClip(time)));
-}
-
-DateInstance::DateInstance(ExecState* exec, double time)
-    : JSWrapperObject(exec->globalData(), exec->lexicalGlobalObject()->dateStructure())
+    : JSWrapperObject(structure)
 {
     ASSERT(inherits(&s_info));
     setInternalValue(exec->globalData(), jsNumber(timeClip(time)));
diff --git a/Source/JavaScriptCore/runtime/DateInstance.h b/Source/JavaScriptCore/runtime/DateInstance.h
index 627b9e7..d0dcf0b 100644
--- a/Source/JavaScriptCore/runtime/DateInstance.h
+++ b/Source/JavaScriptCore/runtime/DateInstance.h
@@ -31,7 +31,6 @@ namespace JSC {
 
     class DateInstance : public JSWrapperObject {
     public:
-        DateInstance(ExecState*, double);
         DateInstance(ExecState*, NonNullPassRefPtr<Structure>, double);
         explicit DateInstance(ExecState*, NonNullPassRefPtr<Structure>);
 
@@ -53,14 +52,11 @@ namespace JSC {
             return calculateGregorianDateTimeUTC(exec);
         }
 
-        static PassRefPtr<Structure> createStructure(JSValue prototype)
+        static PassRefPtr<Structure> createStructure(JSGlobalData& globalData, JSValue prototype)
         {
-            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
+            return Structure::create(globalData, prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
         }
 
-    protected:
-        static const unsigned StructureFlags = OverridesMarkChildren | JSWrapperObject::StructureFlags;
-
     private:
         const GregorianDateTime* calculateGregorianDateTime(ExecState*) const;
         const GregorianDateTime* calculateGregorianDateTimeUTC(ExecState*) const;
diff --git a/Source/JavaScriptCore/runtime/DatePrototype.h b/Source/JavaScriptCore/runtime/DatePrototype.h
index dca90e3..0ebbedc 100644
--- a/Source/JavaScriptCore/runtime/DatePrototype.h
+++ b/Source/JavaScriptCore/runtime/DatePrototype.h
@@ -36,14 +36,16 @@ namespace JSC {
 
         static const ClassInfo s_info;
 
-        static PassRefPtr<Structure> createStructure(JSValue prototype)
+        static PassRefPtr<Structure> createStructure(JSGlobalData& globalData, JSValue prototype)
         {
-            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
+            return Structure::create(globalData, prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
         }
 
     protected:
         static const unsigned StructureFlags = OverridesGetOwnPropertySlot | DateInstance::StructureFlags;
 
+        COMPILE_ASSERT(!DateInstance::AnonymousSlotCount, DatePrototype_stomps_on_your_anonymous_slot);
+        static const unsigned AnonymousSlotCount = 1;
     };
 
 } // namespace JSC
diff --git a/Source/JavaScriptCore/runtime/ErrorConstructor.cpp b/Source/JavaScriptCore/runtime/ErrorConstructor.cpp
index 2e53b95..7f4f82c 100644
--- a/Source/JavaScriptCore/runtime/ErrorConstructor.cpp
+++ b/Source/JavaScriptCore/runtime/ErrorConstructor.cpp
@@ -42,7 +42,7 @@ ErrorConstructor::ErrorConstructor(ExecState* exec, JSGlobalObject* globalObject
 static EncodedJSValue JSC_HOST_CALL constructWithErrorConstructor(ExecState* exec)
 {
     JSValue message = exec->argumentCount() ? exec->argument(0) : jsUndefined();
-    Structure* errorStructure = exec->lexicalGlobalObject()->errorStructure();
+    Structure* errorStructure = asInternalFunction(exec->callee())->globalObject()->errorStructure();
     return JSValue::encode(ErrorInstance::create(exec, errorStructure, message));
 }
 
@@ -55,7 +55,7 @@ ConstructType ErrorConstructor::getConstructData(ConstructData& constructData)
 static EncodedJSValue JSC_HOST_CALL callErrorConstructor(ExecState* exec)
 {
     JSValue message = exec->argumentCount() ? exec->argument(0) : jsUndefined();
-    Structure* errorStructure = exec->lexicalGlobalObject()->errorStructure();
+    Structure* errorStructure = asInternalFunction(exec->callee())->globalObject()->errorStructure();
     return JSValue::encode(ErrorInstance::create(exec, errorStructure, message));
 }
 
diff --git a/Source/JavaScriptCore/runtime/ErrorInstance.h b/Source/JavaScriptCore/runtime/ErrorInstance.h
index c1beef7..82dbf0f 100644
--- a/Source/JavaScriptCore/runtime/ErrorInstance.h
+++ b/Source/JavaScriptCore/runtime/ErrorInstance.h
@@ -29,9 +29,9 @@ namespace JSC {
     public:
         static const ClassInfo s_info;
 
-        static PassRefPtr<Structure> createStructure(JSValue prototype)
+        static PassRefPtr<Structure> createStructure(JSGlobalData& globalData, JSValue prototype)
         {
-            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
+            return Structure::create(globalData, prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
         }
 
         static ErrorInstance* create(JSGlobalData*, NonNullPassRefPtr<Structure>, const UString&);
diff --git a/Source/JavaScriptCore/runtime/Executable.cpp b/Source/JavaScriptCore/runtime/Executable.cpp
index 607a2c2..a059ed2 100644
--- a/Source/JavaScriptCore/runtime/Executable.cpp
+++ b/Source/JavaScriptCore/runtime/Executable.cpp
@@ -33,6 +33,11 @@
 #include "UStringBuilder.h"
 #include "Vector.h"
 
+#if ENABLE(DFG_JIT)
+#include "DFGByteCodeParser.h"
+#include "DFGJITCompiler.h"
+#endif
+
 namespace JSC {
 
 NativeExecutable::~NativeExecutable()
@@ -44,7 +49,7 @@ VPtrHackExecutable::~VPtrHackExecutable()
 }
 
 EvalExecutable::EvalExecutable(ExecState* exec, const SourceCode& source, bool inStrictContext)
-    : ScriptExecutable(exec, source, inStrictContext)
+    : ScriptExecutable(exec->globalData().evalExecutableStructure.get(), exec, source, inStrictContext)
 {
 }
 
@@ -53,7 +58,7 @@ EvalExecutable::~EvalExecutable()
 }
 
 ProgramExecutable::ProgramExecutable(ExecState* exec, const SourceCode& source)
-    : ScriptExecutable(exec, source, false)
+    : ScriptExecutable(exec->globalData().programExecutableStructure.get(), exec, source, false)
 {
 }
 
@@ -62,7 +67,7 @@ ProgramExecutable::~ProgramExecutable()
 }
 
 FunctionExecutable::FunctionExecutable(JSGlobalData* globalData, const Identifier& name, const SourceCode& source, bool forceUsesArguments, FunctionParameters* parameters, bool inStrictContext, int firstLine, int lastLine)
-    : ScriptExecutable(globalData, source, inStrictContext)
+    : ScriptExecutable(globalData->functionExecutableStructure.get(), globalData, source, inStrictContext)
     , m_numCapturedVariables(0)
     , m_forceUsesArguments(forceUsesArguments)
     , m_parameters(parameters)
@@ -74,7 +79,7 @@ FunctionExecutable::FunctionExecutable(JSGlobalData* globalData, const Identifie
 }
 
 FunctionExecutable::FunctionExecutable(ExecState* exec, const Identifier& name, const SourceCode& source, bool forceUsesArguments, FunctionParameters* parameters, bool inStrictContext, int firstLine, int lastLine)
-    : ScriptExecutable(exec, source, inStrictContext)
+    : ScriptExecutable(exec->globalData().functionExecutableStructure.get(), exec, source, inStrictContext)
     , m_numCapturedVariables(0)
     , m_forceUsesArguments(forceUsesArguments)
     , m_parameters(parameters)
@@ -85,9 +90,6 @@ FunctionExecutable::FunctionExecutable(ExecState* exec, const Identifier& name,
     m_lastLine = lastLine;
 }
 
-FunctionExecutable::~FunctionExecutable()
-{
-}
 
 JSObject* EvalExecutable::compileInternal(ExecState* exec, ScopeChainNode* scopeChainNode)
 {
@@ -127,6 +129,13 @@ JSObject* EvalExecutable::compileInternal(ExecState* exec, ScopeChainNode* scope
     return 0;
 }
 
+void EvalExecutable::markChildren(MarkStack& markStack)
+{
+    ScriptExecutable::markChildren(markStack);
+    if (m_evalCodeBlock)
+        m_evalCodeBlock->markAggregate(markStack);
+}
+
 JSObject* ProgramExecutable::checkSyntax(ExecState* exec)
 {
     JSObject* exception = 0;
@@ -178,6 +187,41 @@ JSObject* ProgramExecutable::compileInternal(ExecState* exec, ScopeChainNode* sc
    return 0;
 }
 
+#if ENABLE(JIT)
+static bool tryDFGCompile(JSGlobalData* globalData, CodeBlock* codeBlock, JITCode& jitCode, MacroAssemblerCodePtr& jitCodeWithArityCheck)
+{
+#if ENABLE(DFG_JIT)
+#if ENABLE(DFG_JIT_RESTRICTIONS)
+    // FIXME: No flow control yet supported, don't bother scanning the bytecode if there are any jump targets.
+    // FIXME: temporarily disable property accesses until we fix regressions.
+    if (codeBlock->numberOfJumpTargets() || codeBlock->numberOfStructureStubInfos())
+        return false;
+#endif
+
+    DFG::Graph dfg;
+    if (!parse(dfg, globalData, codeBlock))
+        return false;
+
+    DFG::JITCompiler dataFlowJIT(globalData, dfg, codeBlock);
+    dataFlowJIT.compileFunction(jitCode, jitCodeWithArityCheck);
+    return true;
+#else
+    UNUSED_PARAM(globalData);
+    UNUSED_PARAM(codeBlock);
+    UNUSED_PARAM(jitCode);
+    UNUSED_PARAM(jitCodeWithArityCheck);
+    return false;
+#endif
+}
+#endif
+
+void ProgramExecutable::markChildren(MarkStack& markStack)
+{
+    ScriptExecutable::markChildren(markStack);
+    if (m_programCodeBlock)
+        m_programCodeBlock->markAggregate(markStack);
+}
+
 JSObject* FunctionExecutable::compileForCallInternal(ExecState* exec, ScopeChainNode* scopeChainNode)
 {
     JSObject* exception = 0;
@@ -212,7 +256,10 @@ JSObject* FunctionExecutable::compileForCallInternal(ExecState* exec, ScopeChain
 
 #if ENABLE(JIT)
     if (exec->globalData().canUseJIT()) {
-        m_jitCodeForCall = JIT::compile(scopeChainNode->globalData, m_codeBlockForCall.get(), &m_jitCodeForCallWithArityCheck);
+        bool dfgCompiled = tryDFGCompile(&exec->globalData(), m_codeBlockForCall.get(), m_jitCodeForCall, m_jitCodeForCallWithArityCheck);
+        if (!dfgCompiled)
+            m_jitCodeForCall = JIT::compile(scopeChainNode->globalData, m_codeBlockForCall.get(), &m_jitCodeForCallWithArityCheck);
+
 #if !ENABLE(OPCODE_SAMPLING)
         if (!BytecodeGenerator::dumpsGeneratedCode())
             m_codeBlockForCall->discardBytecode();
@@ -268,8 +315,9 @@ JSObject* FunctionExecutable::compileForConstructInternal(ExecState* exec, Scope
     return 0;
 }
 
-void FunctionExecutable::markAggregate(MarkStack& markStack)
+void FunctionExecutable::markChildren(MarkStack& markStack)
 {
+    ScriptExecutable::markChildren(markStack);
     if (m_codeBlockForCall)
         m_codeBlockForCall->markAggregate(markStack);
     if (m_codeBlockForConstruct)
@@ -288,7 +336,7 @@ void FunctionExecutable::discardCode()
 #endif
 }
 
-PassRefPtr<FunctionExecutable> FunctionExecutable::fromGlobalCode(const Identifier& functionName, ExecState* exec, Debugger* debugger, const SourceCode& source, JSObject** exception)
+FunctionExecutable* FunctionExecutable::fromGlobalCode(const Identifier& functionName, ExecState* exec, Debugger* debugger, const SourceCode& source, JSObject** exception)
 {
     JSGlobalObject* lexicalGlobalObject = exec->lexicalGlobalObject();
     RefPtr<ProgramNode> program = exec->globalData().parser->parse<ProgramNode>(lexicalGlobalObject, debugger, exec, source, 0, JSParseNormal, exception);
diff --git a/Source/JavaScriptCore/runtime/Executable.h b/Source/JavaScriptCore/runtime/Executable.h
index b2565a0..f15df07 100644
--- a/Source/JavaScriptCore/runtime/Executable.h
+++ b/Source/JavaScriptCore/runtime/Executable.h
@@ -44,7 +44,7 @@ namespace JSC {
 
     struct ExceptionInfo;
 
-    class ExecutableBase : public RefCounted<ExecutableBase> {
+    class ExecutableBase : public JSCell {
         friend class JIT;
 
     protected:
@@ -52,21 +52,23 @@ namespace JSC {
         static const int NUM_PARAMETERS_NOT_COMPILED = -1;
     
     public:
-        ExecutableBase(int numParameters)
-            : m_numParametersForCall(numParameters)
+        ExecutableBase(Structure* structure, int numParameters)
+            : JSCell(structure)
+            , m_numParametersForCall(numParameters)
             , m_numParametersForConstruct(numParameters)
         {
         }
 
-        virtual ~ExecutableBase() {}
-
         bool isHostFunction() const
         {
             ASSERT((m_numParametersForCall == NUM_PARAMETERS_IS_HOST) == (m_numParametersForConstruct == NUM_PARAMETERS_IS_HOST));
             return m_numParametersForCall == NUM_PARAMETERS_IS_HOST;
         }
 
+        static PassRefPtr<Structure> createStructure(JSGlobalData& globalData, JSValue proto) { return Structure::create(globalData, proto, TypeInfo(CompoundType, StructureFlags), AnonymousSlotCount, 0); }
+
     protected:
+        static const unsigned StructureFlags = 0;
         int m_numParametersForCall;
         int m_numParametersForConstruct;
 
@@ -96,16 +98,16 @@ namespace JSC {
         friend class JIT;
     public:
 #if ENABLE(JIT)
-        static PassRefPtr<NativeExecutable> create(MacroAssemblerCodePtr callThunk, NativeFunction function, MacroAssemblerCodePtr constructThunk, NativeFunction constructor)
+        static NativeExecutable* create(JSGlobalData& globalData, MacroAssemblerCodePtr callThunk, NativeFunction function, MacroAssemblerCodePtr constructThunk, NativeFunction constructor)
         {
             if (!callThunk)
-                return adoptRef(new NativeExecutable(JITCode(), function, JITCode(), constructor));
-            return adoptRef(new NativeExecutable(JITCode::HostFunction(callThunk), function, JITCode::HostFunction(constructThunk), constructor));
+                return new (&globalData) NativeExecutable(globalData, JITCode(), function, JITCode(), constructor);
+            return new (&globalData) NativeExecutable(globalData, JITCode::HostFunction(callThunk), function, JITCode::HostFunction(constructThunk), constructor);
         }
 #else
-        static PassRefPtr<NativeExecutable> create(NativeFunction function, NativeFunction constructor)
+        static NativeExecutable* create(JSGlobalData& globalData, NativeFunction function, NativeFunction constructor)
         {
-            return adoptRef(new NativeExecutable(function, constructor));
+            return new (&globalData) NativeExecutable(globalData, function, constructor);
         }
 #endif
 
@@ -115,8 +117,8 @@ namespace JSC {
 
     private:
 #if ENABLE(JIT)
-        NativeExecutable(JITCode callThunk, NativeFunction function, JITCode constructThunk, NativeFunction constructor)
-            : ExecutableBase(NUM_PARAMETERS_IS_HOST)
+        NativeExecutable(JSGlobalData& globalData, JITCode callThunk, NativeFunction function, JITCode constructThunk, NativeFunction constructor)
+            : ExecutableBase(globalData.executableStructure.get(), NUM_PARAMETERS_IS_HOST)
             , m_function(function)
             , m_constructor(constructor)
         {
@@ -126,8 +128,8 @@ namespace JSC {
             m_jitCodeForConstructWithArityCheck = constructThunk.addressForCall();
         }
 #else
-        NativeExecutable(NativeFunction function, NativeFunction constructor)
-            : ExecutableBase(NUM_PARAMETERS_IS_HOST)
+        NativeExecutable(JSGlobalData& globalData, NativeFunction function, NativeFunction constructor)
+            : ExecutableBase(globalData.executableStructure.get(), NUM_PARAMETERS_IS_HOST)
             , m_function(function)
             , m_constructor(constructor)
         {
@@ -142,8 +144,8 @@ namespace JSC {
 
     class VPtrHackExecutable : public ExecutableBase {
     public:
-        VPtrHackExecutable()
-            : ExecutableBase(NUM_PARAMETERS_IS_HOST)
+        VPtrHackExecutable(Structure* structure)
+            : ExecutableBase(structure, NUM_PARAMETERS_IS_HOST)
         {
         }
 
@@ -152,8 +154,8 @@ namespace JSC {
 
     class ScriptExecutable : public ExecutableBase {
     public:
-        ScriptExecutable(JSGlobalData* globalData, const SourceCode& source, bool isInStrictContext)
-            : ExecutableBase(NUM_PARAMETERS_NOT_COMPILED)
+        ScriptExecutable(Structure* structure, JSGlobalData* globalData, const SourceCode& source, bool isInStrictContext)
+            : ExecutableBase(structure, NUM_PARAMETERS_NOT_COMPILED)
             , m_source(source)
             , m_features(isInStrictContext ? StrictModeFeature : 0)
         {
@@ -166,8 +168,8 @@ namespace JSC {
 #endif
         }
 
-        ScriptExecutable(ExecState* exec, const SourceCode& source, bool isInStrictContext)
-            : ExecutableBase(NUM_PARAMETERS_NOT_COMPILED)
+        ScriptExecutable(Structure* structure, ExecState* exec, const SourceCode& source, bool isInStrictContext)
+            : ExecutableBase(structure, NUM_PARAMETERS_NOT_COMPILED)
             , m_source(source)
             , m_features(isInStrictContext ? StrictModeFeature : 0)
         {
@@ -214,6 +216,7 @@ namespace JSC {
 
         JSObject* compile(ExecState* exec, ScopeChainNode* scopeChainNode)
         {
+            ASSERT(exec->globalData().dynamicGlobalObject);
             JSObject* error = 0;
             if (!m_evalCodeBlock)
                 error = compileInternal(exec, scopeChainNode);
@@ -227,7 +230,7 @@ namespace JSC {
             return *m_evalCodeBlock;
         }
 
-        static PassRefPtr<EvalExecutable> create(ExecState* exec, const SourceCode& source, bool isInStrictContext) { return adoptRef(new EvalExecutable(exec, source, isInStrictContext)); }
+        static EvalExecutable* create(ExecState* exec, const SourceCode& source, bool isInStrictContext) { return new (exec) EvalExecutable(exec, source, isInStrictContext); }
 
 #if ENABLE(JIT)
         JITCode& generatedJITCode()
@@ -235,26 +238,30 @@ namespace JSC {
             return generatedJITCodeForCall();
         }
 #endif
+        static PassRefPtr<Structure> createStructure(JSGlobalData& globalData, JSValue proto) { return Structure::create(globalData, proto, TypeInfo(CompoundType, StructureFlags), AnonymousSlotCount, 0); }
 
     private:
+        static const unsigned StructureFlags = OverridesMarkChildren | ScriptExecutable::StructureFlags;
         EvalExecutable(ExecState*, const SourceCode&, bool);
 
         JSObject* compileInternal(ExecState*, ScopeChainNode*);
+        virtual void markChildren(MarkStack&);
 
         OwnPtr<EvalCodeBlock> m_evalCodeBlock;
     };
 
     class ProgramExecutable : public ScriptExecutable {
     public:
-        static PassRefPtr<ProgramExecutable> create(ExecState* exec, const SourceCode& source)
+        static ProgramExecutable* create(ExecState* exec, const SourceCode& source)
         {
-            return adoptRef(new ProgramExecutable(exec, source));
+            return new (exec) ProgramExecutable(exec, source);
         }
 
         ~ProgramExecutable();
 
         JSObject* compile(ExecState* exec, ScopeChainNode* scopeChainNode)
         {
+            ASSERT(exec->globalData().dynamicGlobalObject);
             JSObject* error = 0;
             if (!m_programCodeBlock)
                 error = compileInternal(exec, scopeChainNode);
@@ -276,11 +283,15 @@ namespace JSC {
             return generatedJITCodeForCall();
         }
 #endif
+        
+        static PassRefPtr<Structure> createStructure(JSGlobalData& globalData, JSValue proto) { return Structure::create(globalData, proto, TypeInfo(CompoundType, StructureFlags), AnonymousSlotCount, 0); }
 
     private:
+        static const unsigned StructureFlags = OverridesMarkChildren | ScriptExecutable::StructureFlags;
         ProgramExecutable(ExecState*, const SourceCode&);
 
         JSObject* compileInternal(ExecState*, ScopeChainNode*);
+        virtual void markChildren(MarkStack&);
 
         OwnPtr<ProgramCodeBlock> m_programCodeBlock;
     };
@@ -288,18 +299,16 @@ namespace JSC {
     class FunctionExecutable : public ScriptExecutable {
         friend class JIT;
     public:
-        static PassRefPtr<FunctionExecutable> create(ExecState* exec, const Identifier& name, const SourceCode& source, bool forceUsesArguments, FunctionParameters* parameters, bool isInStrictContext, int firstLine, int lastLine)
+        static FunctionExecutable* create(ExecState* exec, const Identifier& name, const SourceCode& source, bool forceUsesArguments, FunctionParameters* parameters, bool isInStrictContext, int firstLine, int lastLine)
         {
-            return adoptRef(new FunctionExecutable(exec, name, source, forceUsesArguments, parameters, isInStrictContext, firstLine, lastLine));
+            return new (exec) FunctionExecutable(exec, name, source, forceUsesArguments, parameters, isInStrictContext, firstLine, lastLine);
         }
 
-        static PassRefPtr<FunctionExecutable> create(JSGlobalData* globalData, const Identifier& name, const SourceCode& source, bool forceUsesArguments, FunctionParameters* parameters, bool isInStrictContext, int firstLine, int lastLine)
+        static FunctionExecutable* create(JSGlobalData* globalData, const Identifier& name, const SourceCode& source, bool forceUsesArguments, FunctionParameters* parameters, bool isInStrictContext, int firstLine, int lastLine)
         {
-            return adoptRef(new FunctionExecutable(globalData, name, source, forceUsesArguments, parameters, isInStrictContext, firstLine, lastLine));
+            return new (globalData) FunctionExecutable(globalData, name, source, forceUsesArguments, parameters, isInStrictContext, firstLine, lastLine);
         }
 
-        ~FunctionExecutable();
-
         JSFunction* make(ExecState* exec, ScopeChainNode* scopeChain)
         {
             return new (exec) JSFunction(exec, this, scopeChain);
@@ -318,6 +327,7 @@ namespace JSC {
 
         JSObject* compileForCall(ExecState* exec, ScopeChainNode* scopeChainNode)
         {
+            ASSERT(exec->globalData().dynamicGlobalObject);
             JSObject* error = 0;
             if (!m_codeBlockForCall)
                 error = compileForCallInternal(exec, scopeChainNode);
@@ -338,6 +348,7 @@ namespace JSC {
 
         JSObject* compileForConstruct(ExecState* exec, ScopeChainNode* scopeChainNode)
         {
+            ASSERT(exec->globalData().dynamicGlobalObject);
             JSObject* error = 0;
             if (!m_codeBlockForConstruct)
                 error = compileForConstructInternal(exec, scopeChainNode);
@@ -363,8 +374,9 @@ namespace JSC {
         SharedSymbolTable* symbolTable() const { return m_symbolTable; }
 
         void discardCode();
-        void markAggregate(MarkStack&);
-        static PassRefPtr<FunctionExecutable> fromGlobalCode(const Identifier&, ExecState*, Debugger*, const SourceCode&, JSObject** exception);
+        void markChildren(MarkStack&);
+        static FunctionExecutable* fromGlobalCode(const Identifier&, ExecState*, Debugger*, const SourceCode&, JSObject** exception);
+        static PassRefPtr<Structure> createStructure(JSGlobalData& globalData, JSValue proto) { return Structure::create(globalData, proto, TypeInfo(CompoundType, StructureFlags), AnonymousSlotCount, 0); }
 
     private:
         FunctionExecutable(JSGlobalData*, const Identifier& name, const SourceCode&, bool forceUsesArguments, FunctionParameters*, bool, int firstLine, int lastLine);
@@ -372,7 +384,8 @@ namespace JSC {
 
         JSObject* compileForCallInternal(ExecState*, ScopeChainNode*);
         JSObject* compileForConstructInternal(ExecState*, ScopeChainNode*);
-
+        
+        static const unsigned StructureFlags = OverridesMarkChildren | ScriptExecutable::StructureFlags;
         unsigned m_numCapturedVariables : 31;
         bool m_forceUsesArguments : 1;
 
diff --git a/Source/JavaScriptCore/runtime/FunctionConstructor.cpp b/Source/JavaScriptCore/runtime/FunctionConstructor.cpp
index e642594..a9f0a06 100644
--- a/Source/JavaScriptCore/runtime/FunctionConstructor.cpp
+++ b/Source/JavaScriptCore/runtime/FunctionConstructor.cpp
@@ -49,7 +49,7 @@ FunctionConstructor::FunctionConstructor(ExecState* exec, JSGlobalObject* global
 static EncodedJSValue JSC_HOST_CALL constructWithFunctionConstructor(ExecState* exec)
 {
     ArgList args(exec);
-    return JSValue::encode(constructFunction(exec, args));
+    return JSValue::encode(constructFunction(exec, asInternalFunction(exec->callee())->globalObject(), args));
 }
 
 ConstructType FunctionConstructor::getConstructData(ConstructData& constructData)
@@ -61,7 +61,7 @@ ConstructType FunctionConstructor::getConstructData(ConstructData& constructData
 static EncodedJSValue JSC_HOST_CALL callFunctionConstructor(ExecState* exec)
 {
     ArgList args(exec);
-    return JSValue::encode(constructFunction(exec, args));
+    return JSValue::encode(constructFunction(exec, asInternalFunction(exec->callee())->globalObject(), args));
 }
 
 // ECMA 15.3.1 The Function Constructor Called as a Function
@@ -72,7 +72,7 @@ CallType FunctionConstructor::getCallData(CallData& callData)
 }
 
 // ECMA 15.3.2 The Function Constructor
-JSObject* constructFunction(ExecState* exec, const ArgList& args, const Identifier& functionName, const UString& sourceURL, int lineNumber)
+JSObject* constructFunction(ExecState* exec, JSGlobalObject* globalObject, const ArgList& args, const Identifier& functionName, const UString& sourceURL, int lineNumber)
 {
     // Functions need to have a space following the opening { due to for web compatibility
     // see https://bugs.webkit.org/show_bug.cgi?id=24350
@@ -96,11 +96,10 @@ JSObject* constructFunction(ExecState* exec, const ArgList& args, const Identifi
         program = builder.toUString();
     }
 
-    JSGlobalObject* globalObject = exec->lexicalGlobalObject();
     JSGlobalData& globalData = globalObject->globalData();
     SourceCode source = makeSource(program, sourceURL, lineNumber);
     JSObject* exception = 0;
-    RefPtr<FunctionExecutable> function = FunctionExecutable::fromGlobalCode(functionName, exec, exec->dynamicGlobalObject()->debugger(), source, &exception);
+    FunctionExecutable* function = FunctionExecutable::fromGlobalCode(functionName, exec, exec->dynamicGlobalObject()->debugger(), source, &exception);
     if (!function) {
         ASSERT(exception);
         return throwError(exec, exception);
@@ -111,9 +110,9 @@ JSObject* constructFunction(ExecState* exec, const ArgList& args, const Identifi
 }
 
 // ECMA 15.3.2 The Function Constructor
-JSObject* constructFunction(ExecState* exec, const ArgList& args)
+JSObject* constructFunction(ExecState* exec, JSGlobalObject* globalObject, const ArgList& args)
 {
-    return constructFunction(exec, args, Identifier(exec, "anonymous"), UString(), 1);
+    return constructFunction(exec, globalObject, args, Identifier(exec, "anonymous"), UString(), 1);
 }
 
 } // namespace JSC
diff --git a/Source/JavaScriptCore/runtime/FunctionConstructor.h b/Source/JavaScriptCore/runtime/FunctionConstructor.h
index 6af4861..7f21b20 100644
--- a/Source/JavaScriptCore/runtime/FunctionConstructor.h
+++ b/Source/JavaScriptCore/runtime/FunctionConstructor.h
@@ -36,8 +36,8 @@ namespace JSC {
         virtual CallType getCallData(CallData&);
     };
 
-    JSObject* constructFunction(ExecState*, const ArgList&, const Identifier& functionName, const UString& sourceURL, int lineNumber);
-    JSObject* constructFunction(ExecState*, const ArgList&);
+    JSObject* constructFunction(ExecState*, JSGlobalObject*, const ArgList&, const Identifier& functionName, const UString& sourceURL, int lineNumber);
+    JSObject* constructFunction(ExecState*, JSGlobalObject*, const ArgList&);
 
 } // namespace JSC
 
diff --git a/Source/JavaScriptCore/runtime/FunctionPrototype.h b/Source/JavaScriptCore/runtime/FunctionPrototype.h
index fb0bb48..447f00b 100644
--- a/Source/JavaScriptCore/runtime/FunctionPrototype.h
+++ b/Source/JavaScriptCore/runtime/FunctionPrototype.h
@@ -30,9 +30,9 @@ namespace JSC {
         FunctionPrototype(ExecState*, JSGlobalObject*, NonNullPassRefPtr<Structure>);
         void addFunctionProperties(ExecState*, JSGlobalObject*, Structure* functionStructure, JSFunction** callFunction, JSFunction** applyFunction);
 
-        static PassRefPtr<Structure> createStructure(JSValue proto)
+        static PassRefPtr<Structure> createStructure(JSGlobalData& globalData, JSValue proto)
         {
-            return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
+            return Structure::create(globalData, proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
         }
 
     private:
diff --git a/Source/JavaScriptCore/runtime/GCActivityCallbackCF.cpp b/Source/JavaScriptCore/runtime/GCActivityCallbackCF.cpp
index a941cfa..2e878bf 100644
--- a/Source/JavaScriptCore/runtime/GCActivityCallbackCF.cpp
+++ b/Source/JavaScriptCore/runtime/GCActivityCallbackCF.cpp
@@ -33,6 +33,7 @@
 #include "Heap.h"
 #include "JSGlobalData.h"
 #include "JSLock.h"
+#include "JSObject.h"
 #include "ScopeChain.h"
 #include <wtf/RetainPtr.h>
 #include <wtf/WTFThreadData.h>
diff --git a/Source/JavaScriptCore/runtime/GetterSetter.h b/Source/JavaScriptCore/runtime/GetterSetter.h
index 68a8c70..8241275 100644
--- a/Source/JavaScriptCore/runtime/GetterSetter.h
+++ b/Source/JavaScriptCore/runtime/GetterSetter.h
@@ -47,9 +47,9 @@ namespace JSC {
         void setGetter(JSGlobalData& globalData, JSObject* getter) { m_getter.set(globalData, this, getter); }
         JSObject* setter() const { return m_setter.get(); }
         void setSetter(JSGlobalData& globalData, JSObject* setter) { m_setter.set(globalData, this, setter); }
-        static PassRefPtr<Structure> createStructure(JSValue prototype)
+        static PassRefPtr<Structure> createStructure(JSGlobalData& globalData, JSValue prototype)
         {
-            return Structure::create(prototype, TypeInfo(GetterSetterType, OverridesMarkChildren), AnonymousSlotCount, 0);
+            return Structure::create(globalData, prototype, TypeInfo(GetterSetterType, OverridesMarkChildren), AnonymousSlotCount, 0);
         }
     private:
         virtual bool isGetterSetter() const;
diff --git a/Source/JavaScriptCore/runtime/Heap.cpp b/Source/JavaScriptCore/runtime/Heap.cpp
index c52bcfe..e3ef8bb 100644
--- a/Source/JavaScriptCore/runtime/Heap.cpp
+++ b/Source/JavaScriptCore/runtime/Heap.cpp
@@ -46,7 +46,7 @@ Heap::Heap(JSGlobalData* globalData)
     , m_markListSet(0)
     , m_activityCallback(DefaultGCActivityCallback::create(this))
     , m_globalData(globalData)
-    , m_machineStackMarker(this)
+    , m_machineThreads(this)
     , m_markStack(globalData->jsArrayVPtr)
     , m_handleHeap(globalData)
     , m_extraCost(0)
@@ -75,6 +75,10 @@ void Heap::destroy()
     // (and thus the global data) before other objects that may use the global data.
     RefPtr<JSGlobalData> protect(m_globalData);
 
+#if ENABLE(JIT)
+    m_globalData->jitStubs->clearHostFunctionStubs();
+#endif
+
     delete m_markListSet;
     m_markListSet = 0;
     m_markedSpace.clearMarks();
@@ -97,7 +101,7 @@ void Heap::reportExtraMemoryCostSlowCase(size_t cost)
     // if a large value survives one garbage collection, there is not much point to
     // collecting more frequently as long as it stays alive.
 
-    if (m_extraCost > maxExtraCost && m_extraCost > m_markedSpace.capacity() / 2)
+    if (m_extraCost > maxExtraCost && m_extraCost > m_markedSpace.highWaterMark() / 2)
         collectAllGarbage();
     m_extraCost += cost;
 }
@@ -147,11 +151,11 @@ bool Heap::unprotect(JSValue k)
     return m_protectedValues.remove(k.asCell());
 }
 
-void Heap::markProtectedObjects(MarkStack& markStack)
+void Heap::markProtectedObjects(HeapRootMarker& heapRootMarker)
 {
     ProtectCountSet::iterator end = m_protectedValues.end();
     for (ProtectCountSet::iterator it = m_protectedValues.begin(); it != end; ++it)
-        markStack.deprecatedAppend(&it->first);
+        heapRootMarker.mark(&it->first);
 }
 
 void Heap::pushTempSortVector(Vector<ValueStringPair>* tempVector)
@@ -165,7 +169,7 @@ void Heap::popTempSortVector(Vector<ValueStringPair>* tempVector)
     m_tempSortingVectors.removeLast();
 }
     
-void Heap::markTempSortVectors(MarkStack& markStack)
+void Heap::markTempSortVectors(HeapRootMarker& heapRootMarker)
 {
     typedef Vector<Vector<ValueStringPair>* > VectorOfValueStringVectors;
 
@@ -176,7 +180,7 @@ void Heap::markTempSortVectors(MarkStack& markStack)
         Vector<ValueStringPair>::iterator vectorEnd = tempSortingVector->end();
         for (Vector<ValueStringPair>::iterator vectorIt = tempSortingVector->begin(); vectorIt != vectorEnd; ++vectorIt) {
             if (vectorIt->first)
-                markStack.deprecatedAppend(&vectorIt->first);
+                heapRootMarker.mark(&vectorIt->first);
         }
     }
 }
@@ -195,52 +199,52 @@ void Heap::markRoots()
     }
 #endif
 
+    void* dummy;
+
     ASSERT(m_operationInProgress == NoOperation);
     if (m_operationInProgress != NoOperation)
         CRASH();
 
     m_operationInProgress = Collection;
 
-    // We gather the conservative set before clearing mark bits, because
+    MarkStack& markStack = m_markStack;
+    HeapRootMarker heapRootMarker(markStack);
+    
+    // We gather conservative roots before clearing mark bits because
     // conservative gathering uses the mark bits from our last mark pass to
     // determine whether a reference is valid.
-    ConservativeSet conservativeSet(this);
-    m_machineStackMarker.markMachineStackConservatively(conservativeSet);
-    conservativeSet.add(registerFile().start(), registerFile().end());
+    ConservativeRoots machineThreadRoots(this);
+    m_machineThreads.gatherConservativeRoots(machineThreadRoots, &dummy);
+
+    ConservativeRoots registerFileRoots(this);
+    registerFile().gatherConservativeRoots(registerFileRoots);
 
     m_markedSpace.clearMarks();
 
-    MarkStack& markStack = m_markStack;
-    conservativeSet.mark(markStack);
+    markStack.append(machineThreadRoots);
     markStack.drain();
 
-    // Mark explicitly registered roots.
-    markProtectedObjects(markStack);
+    markStack.append(registerFileRoots);
     markStack.drain();
-    
-    // Mark temporary vector for Array sorting
-    markTempSortVectors(markStack);
+
+    markProtectedObjects(heapRootMarker);
     markStack.drain();
     
-    HashSet<GlobalCodeBlock*>::const_iterator end = m_codeBlocks.end();
-    for (HashSet<GlobalCodeBlock*>::const_iterator it = m_codeBlocks.begin(); it != end; ++it)
-        (*it)->markAggregate(markStack);
+    markTempSortVectors(heapRootMarker);
     markStack.drain();
 
-    // Mark misc. other roots.
     if (m_markListSet && m_markListSet->size())
-        MarkedArgumentBuffer::markLists(markStack, *m_markListSet);
+        MarkedArgumentBuffer::markLists(heapRootMarker, *m_markListSet);
     if (m_globalData->exception)
-        markStack.append(&m_globalData->exception);
-    if (m_globalData->firstStringifierToMark)
-        JSONObject::markStringifiers(markStack, m_globalData->firstStringifierToMark);
+        heapRootMarker.mark(&m_globalData->exception);
     markStack.drain();
 
-    m_handleHeap.markStrongHandles(markStack);
+    m_handleHeap.markStrongHandles(heapRootMarker);
+    m_handleStack.mark(heapRootMarker);
 
     // Mark the small strings cache last, since it will clear itself if nothing
     // else has marked it.
-    m_globalData->smallStrings.markChildren(markStack);
+    m_globalData->smallStrings.markChildren(heapRootMarker);
 
     markStack.drain();
     markStack.compact();
@@ -371,7 +375,7 @@ void Heap::reset(SweepToggle sweepToggle)
     m_extraCost = 0;
 
 #if ENABLE(JSC_ZOMBIES)
-    sweep();
+    sweepToggle = DoSweep;
 #endif
 
     if (sweepToggle == DoSweep) {
@@ -379,7 +383,11 @@ void Heap::reset(SweepToggle sweepToggle)
         m_markedSpace.shrink();
     }
 
-    size_t proportionalBytes = static_cast<size_t>(1.5 * m_markedSpace.size());
+    // To avoid pathological GC churn in large heaps, we set the allocation high
+    // water mark to be proportional to the current size of the heap. The exact
+    // proportion is a bit arbitrary. A 2X multiplier gives a 1:1 (heap size :
+    // new bytes allocated) proportion, and seems to work well in benchmarks.
+    size_t proportionalBytes = 2 * m_markedSpace.size();
     m_markedSpace.setHighWaterMark(max(proportionalBytes, minBytesPerCycle));
 
     JAVASCRIPTCORE_GC_END();
diff --git a/Source/JavaScriptCore/runtime/Heap.h b/Source/JavaScriptCore/runtime/Heap.h
index eb8af70..c2d3bac 100644
--- a/Source/JavaScriptCore/runtime/Heap.h
+++ b/Source/JavaScriptCore/runtime/Heap.h
@@ -23,6 +23,7 @@
 #define Heap_h
 
 #include "HandleHeap.h"
+#include "HandleStack.h"
 #include "MarkStack.h"
 #include "MarkedSpace.h"
 #include <wtf/Forward.h>
@@ -33,6 +34,7 @@ namespace JSC {
 
     class GCActivityCallback;
     class GlobalCodeBlock;
+    class HeapRootMarker;
     class JSCell;
     class JSGlobalData;
     class JSValue;
@@ -65,7 +67,7 @@ namespace JSC {
 
         JSGlobalData* globalData() const { return m_globalData; }
         MarkedSpace& markedSpace() { return m_markedSpace; }
-        MachineStackMarker& machineStackMarker() { return m_machineStackMarker; }
+        MachineThreads& machineThreads() { return m_machineThreads; }
 
         GCActivityCallback* activityCallback();
         void setActivityCallback(PassOwnPtr<GCActivityCallback>);
@@ -92,14 +94,15 @@ namespace JSC {
 
         void pushTempSortVector(Vector<ValueStringPair>*);
         void popTempSortVector(Vector<ValueStringPair>*);
-        
-        HashSet<GlobalCodeBlock*>& codeBlocks() { return m_codeBlocks; }
-
+    
         HashSet<MarkedArgumentBuffer*>& markListSet() { if (!m_markListSet) m_markListSet = new HashSet<MarkedArgumentBuffer*>; return *m_markListSet; }
         
         template <typename Functor> void forEach(Functor&);
         
         HandleSlot allocateGlobalHandle() { return m_handleHeap.allocate(); }
+        HandleSlot allocateLocalHandle() { return m_handleStack.push(); }
+
+        HandleStack* handleStack() { return &m_handleStack; }
 
     private:
         friend class JSGlobalData;
@@ -111,8 +114,8 @@ namespace JSC {
         void reportExtraMemoryCostSlowCase(size_t);
 
         void markRoots();
-        void markProtectedObjects(MarkStack&);
-        void markTempSortVectors(MarkStack&);
+        void markProtectedObjects(HeapRootMarker&);
+        void markTempSortVectors(HeapRootMarker&);
 
         enum SweepToggle { DoNotSweep, DoSweep };
         void reset(SweepToggle);
@@ -124,7 +127,6 @@ namespace JSC {
 
         ProtectCountSet m_protectedValues;
         Vector<Vector<ValueStringPair>* > m_tempSortingVectors;
-        HashSet<GlobalCodeBlock*> m_codeBlocks;
 
         HashSet<MarkedArgumentBuffer*>* m_markListSet;
 
@@ -132,10 +134,11 @@ namespace JSC {
 
         JSGlobalData* m_globalData;
         
-        MachineStackMarker m_machineStackMarker;
+        MachineThreads m_machineThreads;
         MarkStack m_markStack;
         HandleHeap m_handleHeap;
-        
+        HandleStack m_handleStack;
+
         size_t m_extraCost;
     };
 
diff --git a/Source/JavaScriptCore/runtime/Identifier.cpp b/Source/JavaScriptCore/runtime/Identifier.cpp
index 3992418..4a99b19 100644
--- a/Source/JavaScriptCore/runtime/Identifier.cpp
+++ b/Source/JavaScriptCore/runtime/Identifier.cpp
@@ -22,6 +22,7 @@
 #include "Identifier.h"
 
 #include "CallFrame.h"
+#include "JSObject.h"
 #include "NumericStrings.h"
 #include "ScopeChain.h"
 #include <new> // for placement new
@@ -90,7 +91,7 @@ bool Identifier::equal(const StringImpl* r, const UChar* s, unsigned length)
 struct IdentifierCStringTranslator {
     static unsigned hash(const char* c)
     {
-        return WTF::StringHasher::createHash<char>(c);
+        return StringHasher::computeHash<char>(c);
     }
 
     static bool equal(StringImpl* r, const char* s)
@@ -150,7 +151,7 @@ struct UCharBuffer {
 struct IdentifierUCharBufferTranslator {
     static unsigned hash(const UCharBuffer& buf)
     {
-        return WTF::StringHasher::createHash<UChar>(buf.s, buf.length);
+        return StringHasher::computeHash<UChar>(buf.s, buf.length);
     }
 
     static bool equal(StringImpl* str, const UCharBuffer& buf)
@@ -216,7 +217,7 @@ PassRefPtr<StringImpl> Identifier::add(JSGlobalData* globalData, const UChar* s,
 {
     if (length == 1) {
         UChar c = s[0];
-        if (c <= 0xFF)
+        if (c <= maxSingleCharacterString)
             return add(globalData, globalData->smallStrings.singleCharacterStringRep(c));
     }
     if (!length)
@@ -243,7 +244,7 @@ PassRefPtr<StringImpl> Identifier::addSlowCase(JSGlobalData* globalData, StringI
 
     if (r->length() == 1) {
         UChar c = r->characters()[0];
-        if (c <= 0xFF)
+        if (c <= maxSingleCharacterString)
             r = globalData->smallStrings.singleCharacterStringRep(c);
             if (r->isIdentifier())
                 return r;
diff --git a/Source/JavaScriptCore/runtime/InternalFunction.h b/Source/JavaScriptCore/runtime/InternalFunction.h
index 8427b8c..08c98a5 100644
--- a/Source/JavaScriptCore/runtime/InternalFunction.h
+++ b/Source/JavaScriptCore/runtime/InternalFunction.h
@@ -39,9 +39,9 @@ namespace JSC {
         const UString displayName(ExecState*);
         const UString calculatedDisplayName(ExecState*);
 
-        static PassRefPtr<Structure> createStructure(JSValue proto) 
+        static PassRefPtr<Structure> createStructure(JSGlobalData& globalData, JSValue proto) 
         { 
-            return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info); 
+            return Structure::create(globalData, proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info); 
         }
 
     protected:
diff --git a/Source/JavaScriptCore/runtime/JSAPIValueWrapper.h b/Source/JavaScriptCore/runtime/JSAPIValueWrapper.h
index 43dd0d3..54fe909 100644
--- a/Source/JavaScriptCore/runtime/JSAPIValueWrapper.h
+++ b/Source/JavaScriptCore/runtime/JSAPIValueWrapper.h
@@ -35,9 +35,9 @@ namespace JSC {
 
         virtual bool isAPIValueWrapper() const { return true; }
 
-        static PassRefPtr<Structure> createStructure(JSValue prototype)
+        static PassRefPtr<Structure> createStructure(JSGlobalData& globalData, JSValue prototype)
         {
-            return Structure::create(prototype, TypeInfo(CompoundType, OverridesMarkChildren | OverridesGetPropertyNames), AnonymousSlotCount, 0);
+            return Structure::create(globalData, prototype, TypeInfo(CompoundType, OverridesMarkChildren | OverridesGetPropertyNames), AnonymousSlotCount, 0);
         }
 
         
diff --git a/Source/JavaScriptCore/runtime/JSActivation.cpp b/Source/JavaScriptCore/runtime/JSActivation.cpp
index eb9c7c1..d0c50dd 100644
--- a/Source/JavaScriptCore/runtime/JSActivation.cpp
+++ b/Source/JavaScriptCore/runtime/JSActivation.cpp
@@ -39,15 +39,23 @@ ASSERT_CLASS_FITS_IN_CELL(JSActivation);
 
 const ClassInfo JSActivation::s_info = { "JSActivation", &Base::s_info, 0, 0 };
 
-JSActivation::JSActivation(CallFrame* callFrame, NonNullPassRefPtr<FunctionExecutable> functionExecutable)
-    : Base(callFrame->globalData().activationStructure, new JSActivationData(functionExecutable, callFrame->registers()))
+JSActivation::JSActivation(CallFrame* callFrame, FunctionExecutable* functionExecutable)
+    : Base(callFrame->globalData().activationStructure, functionExecutable->symbolTable(), callFrame->registers())
+    , m_numParametersMinusThis(static_cast<int>(functionExecutable->parameterCount()))
+    , m_numCapturedVars(functionExecutable->capturedVariableCount())
+    , m_requiresDynamicChecks(functionExecutable->usesEval())
+    , m_argumentsRegister(functionExecutable->generatedBytecode().argumentsRegister())
 {
     ASSERT(inherits(&s_info));
+
+    // We have to manually ref and deref the symbol table as JSVariableObject
+    // doesn't know about SharedSymbolTable
+    static_cast<SharedSymbolTable*>(m_symbolTable)->ref();
 }
 
 JSActivation::~JSActivation()
 {
-    delete d();
+    static_cast<SharedSymbolTable*>(m_symbolTable)->deref();
 }
 
 void JSActivation::markChildren(MarkStack& markStack)
@@ -55,30 +63,26 @@ void JSActivation::markChildren(MarkStack& markStack)
     Base::markChildren(markStack);
 
     // No need to mark our registers if they're still in the RegisterFile.
-    WriteBarrier<Unknown>* registerArray = d()->registerArray.get();
+    WriteBarrier<Unknown>* registerArray = m_registerArray.get();
     if (!registerArray)
         return;
 
-    size_t numParametersMinusThis = d()->functionExecutable->parameterCount();
-
-    size_t count = numParametersMinusThis;
-    markStack.appendValues(registerArray, count);
-
-    size_t numVars = d()->functionExecutable->capturedVariableCount();
+    markStack.appendValues(registerArray, m_numParametersMinusThis);
 
     // Skip the call frame, which sits between the parameters and vars.
-    markStack.appendValues(registerArray + count + RegisterFile::CallFrameHeaderSize, numVars, MayContainNullValues);
+    markStack.appendValues(registerArray + m_numParametersMinusThis + RegisterFile::CallFrameHeaderSize, m_numCapturedVars, MayContainNullValues);
 }
 
 inline bool JSActivation::symbolTableGet(const Identifier& propertyName, PropertySlot& slot)
 {
     SymbolTableEntry entry = symbolTable().inlineGet(propertyName.impl());
-    if (!entry.isNull()) {
-        ASSERT(entry.getIndex() < static_cast<int>(d()->functionExecutable->capturedVariableCount()));
-        slot.setValue(registerAt(entry.getIndex()).get());
-        return true;
-    }
-    return false;
+    if (entry.isNull())
+        return false;
+    if (entry.getIndex() >= m_numCapturedVars)
+        return false;
+
+    slot.setValue(registerAt(entry.getIndex()).get());
+    return true;
 }
 
 inline bool JSActivation::symbolTablePut(JSGlobalData& globalData, const Identifier& propertyName, JSValue value)
@@ -90,7 +94,9 @@ inline bool JSActivation::symbolTablePut(JSGlobalData& globalData, const Identif
         return false;
     if (entry.isReadOnly())
         return true;
-    ASSERT(entry.getIndex() < static_cast<int>(d()->functionExecutable->capturedVariableCount()));
+    if (entry.getIndex() >= m_numCapturedVars)
+        return false;
+
     registerAt(entry.getIndex()).set(globalData, this, value);
     return true;
 }
@@ -99,9 +105,11 @@ void JSActivation::getOwnPropertyNames(ExecState* exec, PropertyNameArray& prope
 {
     SymbolTable::const_iterator end = symbolTable().end();
     for (SymbolTable::const_iterator it = symbolTable().begin(); it != end; ++it) {
-        ASSERT(it->second.getIndex() < static_cast<int>(d()->functionExecutable->capturedVariableCount()));
-        if (!(it->second.getAttributes() & DontEnum) || (mode == IncludeDontEnumProperties))
-            propertyNames.add(Identifier(exec, it->first.get()));
+        if (it->second.getAttributes() & DontEnum && mode != IncludeDontEnumProperties)
+            continue;
+        if (it->second.getIndex() >= m_numCapturedVars)
+            continue;
+        propertyNames.add(Identifier(exec, it->first.get()));
     }
     // Skip the JSVariableObject implementation of getOwnPropertyNames
     JSObject::getOwnPropertyNames(exec, propertyNames, mode);
@@ -116,8 +124,9 @@ inline bool JSActivation::symbolTablePutWithAttributes(JSGlobalData& globalData,
         return false;
     SymbolTableEntry& entry = iter->second;
     ASSERT(!entry.isNull());
-    if (entry.getIndex() >= static_cast<int>(d()->functionExecutable->capturedVariableCount()))
+    if (entry.getIndex() >= m_numCapturedVars)
         return false;
+
     entry.setAttributes(attributes);
     registerAt(entry.getIndex()).set(globalData, this, value);
     return true;
@@ -195,15 +204,15 @@ JSValue JSActivation::toStrictThisObject(ExecState*) const
     
 bool JSActivation::isDynamicScope(bool& requiresDynamicChecks) const
 {
-    requiresDynamicChecks = d()->functionExecutable->usesEval();
+    requiresDynamicChecks = m_requiresDynamicChecks;
     return false;
 }
 
 JSValue JSActivation::argumentsGetter(ExecState*, JSValue slotBase, const Identifier&)
 {
     JSActivation* activation = asActivation(slotBase);
-    CallFrame* callFrame = CallFrame::create(reinterpret_cast<Register*>(activation->d()->registers));
-    int argumentsRegister = activation->d()->functionExecutable->generatedBytecode().argumentsRegister();
+    CallFrame* callFrame = CallFrame::create(reinterpret_cast<Register*>(activation->m_registers));
+    int argumentsRegister = activation->m_argumentsRegister;
     if (JSValue arguments = callFrame->uncheckedR(argumentsRegister).jsValue())
         return arguments;
     int realArgumentsRegister = unmodifiedArgumentsRegister(argumentsRegister);
diff --git a/Source/JavaScriptCore/runtime/JSActivation.h b/Source/JavaScriptCore/runtime/JSActivation.h
index 6e04041..7463f47 100644
--- a/Source/JavaScriptCore/runtime/JSActivation.h
+++ b/Source/JavaScriptCore/runtime/JSActivation.h
@@ -42,7 +42,7 @@ namespace JSC {
     class JSActivation : public JSVariableObject {
         typedef JSVariableObject Base;
     public:
-        JSActivation(CallFrame*, NonNullPassRefPtr<FunctionExecutable>);
+        JSActivation(CallFrame*, FunctionExecutable*);
         virtual ~JSActivation();
 
         virtual void markChildren(MarkStack&);
@@ -66,29 +66,12 @@ namespace JSC {
         
         static const ClassInfo s_info;
 
-        static PassRefPtr<Structure> createStructure(JSValue proto) { return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info); }
+        static PassRefPtr<Structure> createStructure(JSGlobalData& globalData, JSValue proto) { return Structure::create(globalData, proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info); }
 
     protected:
         static const unsigned StructureFlags = OverridesGetOwnPropertySlot | NeedsThisConversion | OverridesMarkChildren | OverridesGetPropertyNames | JSVariableObject::StructureFlags;
 
     private:
-        struct JSActivationData : public JSVariableObjectData {
-            JSActivationData(NonNullPassRefPtr<FunctionExecutable> _functionExecutable, Register* registers)
-                : JSVariableObjectData(_functionExecutable->symbolTable(), registers)
-                , functionExecutable(_functionExecutable)
-            {
-                // We have to manually ref and deref the symbol table as JSVariableObjectData
-                // doesn't know about SharedSymbolTable
-                functionExecutable->symbolTable()->ref();
-            }
-            ~JSActivationData()
-            {
-                static_cast<SharedSymbolTable*>(symbolTable)->deref();
-            }
-
-            RefPtr<FunctionExecutable> functionExecutable;
-        };
-
         bool symbolTableGet(const Identifier&, PropertySlot&);
         bool symbolTableGet(const Identifier&, PropertyDescriptor&);
         bool symbolTableGet(const Identifier&, PropertySlot&, bool& slotIsWriteable);
@@ -98,7 +81,10 @@ namespace JSC {
         static JSValue argumentsGetter(ExecState*, JSValue, const Identifier&);
         NEVER_INLINE PropertySlot::GetValueFunc getArgumentsGetter();
 
-        JSActivationData* d() const { return static_cast<JSActivationData*>(JSVariableObject::d); }
+        int m_numParametersMinusThis;
+        int m_numCapturedVars : 31;
+        bool m_requiresDynamicChecks : 1;
+        int m_argumentsRegister;
     };
 
     JSActivation* asActivation(JSValue);
@@ -108,6 +94,11 @@ namespace JSC {
         ASSERT(asObject(value)->inherits(&JSActivation::s_info));
         return static_cast<JSActivation*>(asObject(value));
     }
+    
+    ALWAYS_INLINE JSActivation* Register::activation() const
+    {
+        return asActivation(jsValue());
+    }
 
 } // namespace JSC
 
diff --git a/Source/JavaScriptCore/runtime/JSArray.cpp b/Source/JavaScriptCore/runtime/JSArray.cpp
index 822b84c..1d621fe 100644
--- a/Source/JavaScriptCore/runtime/JSArray.cpp
+++ b/Source/JavaScriptCore/runtime/JSArray.cpp
@@ -127,7 +127,7 @@ inline void JSArray::checkConsistency(ConsistencyCheckType)
 #endif
 
 JSArray::JSArray(VPtrStealingHackType)
-    : JSNonFinalObject(createStructure(jsNull()))
+    : JSNonFinalObject(Structure::create(Structure::VPtrStealingHack, &s_info))
 {
     ASSERT(inherits(&s_info));
 
diff --git a/Source/JavaScriptCore/runtime/JSArray.h b/Source/JavaScriptCore/runtime/JSArray.h
index ede3c61..1a6eba8 100644
--- a/Source/JavaScriptCore/runtime/JSArray.h
+++ b/Source/JavaScriptCore/runtime/JSArray.h
@@ -58,7 +58,6 @@ namespace JSC {
     enum ArrayCreationMode { CreateCompact, CreateInitialized };
 
     class JSArray : public JSNonFinalObject {
-        friend class JIT;
         friend class Walker;
 
     public:
@@ -125,13 +124,23 @@ namespace JSC {
         void fillArgList(ExecState*, MarkedArgumentBuffer&);
         void copyToRegisters(ExecState*, Register*, uint32_t);
 
-        static PassRefPtr<Structure> createStructure(JSValue prototype)
+        static PassRefPtr<Structure> createStructure(JSGlobalData& globalData, JSValue prototype)
         {
-            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
+            return Structure::create(globalData, prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
         }
         
         inline void markChildrenDirect(MarkStack& markStack);
 
+        static ptrdiff_t storageOffset()
+        {
+            return OBJECT_OFFSETOF(JSArray, m_storage);
+        }
+
+        static ptrdiff_t vectorLengthOffset()
+        {
+            return OBJECT_OFFSETOF(JSArray, m_vectorLength);
+        }
+
     protected:
         static const unsigned StructureFlags = OverridesGetOwnPropertySlot | OverridesMarkChildren | OverridesGetPropertyNames | JSObject::StructureFlags;
         virtual void put(ExecState*, const Identifier& propertyName, JSValue, PutPropertySlot&);
@@ -142,7 +151,7 @@ namespace JSC {
 
         void* subclassData() const;
         void setSubclassData(void*);
-        
+
     private:
         bool getOwnPropertySlotSlowCase(ExecState*, unsigned propertyName, PropertySlot&);
         void putSlowCase(ExecState*, unsigned propertyName, JSValue);
@@ -174,11 +183,8 @@ namespace JSC {
         return asArray(value.asCell());
     }
 
-    inline bool isJSArray(JSGlobalData* globalData, JSValue v)
-    {
-        return v.isCell() && v.asCell()->vptr() == globalData->jsArrayVPtr;
-    }
     inline bool isJSArray(JSGlobalData* globalData, JSCell* cell) { return cell->vptr() == globalData->jsArrayVPtr; }
+    inline bool isJSArray(JSGlobalData* globalData, JSValue v) { return v.isCell() && isJSArray(globalData, v.asCell()); }
 
     inline void JSArray::markChildrenDirect(MarkStack& markStack)
     {
@@ -196,77 +202,6 @@ namespace JSC {
         }
     }
 
-    inline void MarkStack::markChildren(JSCell* cell)
-    {
-        ASSERT(Heap::isMarked(cell));
-        if (!cell->structure()->typeInfo().overridesMarkChildren()) {
-#ifdef NDEBUG
-            asObject(cell)->markChildrenDirect(*this);
-#else
-            ASSERT(!m_isCheckingForDefaultMarkViolation);
-            m_isCheckingForDefaultMarkViolation = true;
-            cell->markChildren(*this);
-            ASSERT(m_isCheckingForDefaultMarkViolation);
-            m_isCheckingForDefaultMarkViolation = false;
-#endif
-            return;
-        }
-        if (cell->vptr() == m_jsArrayVPtr) {
-            asArray(cell)->markChildrenDirect(*this);
-            return;
-        }
-        cell->markChildren(*this);
-    }
-
-    inline void MarkStack::drain()
-    {
-#if !ASSERT_DISABLED
-        ASSERT(!m_isDraining);
-        m_isDraining = true;
-#endif
-        while (!m_markSets.isEmpty() || !m_values.isEmpty()) {
-            while (!m_markSets.isEmpty() && m_values.size() < 50) {
-                ASSERT(!m_markSets.isEmpty());
-                MarkSet& current = m_markSets.last();
-                ASSERT(current.m_values);
-                JSValue* end = current.m_end;
-                ASSERT(current.m_values);
-                ASSERT(current.m_values != end);
-            findNextUnmarkedNullValue:
-                ASSERT(current.m_values != end);
-                JSValue value = *current.m_values;
-                current.m_values++;
-
-                JSCell* cell;
-                if (!value || !value.isCell() || Heap::testAndSetMarked(cell = value.asCell())) {
-                    if (current.m_values == end) {
-                        m_markSets.removeLast();
-                        continue;
-                    }
-                    goto findNextUnmarkedNullValue;
-                }
-
-                if (cell->structure()->typeInfo().type() < CompoundType) {
-                    if (current.m_values == end) {
-                        m_markSets.removeLast();
-                        continue;
-                    }
-                    goto findNextUnmarkedNullValue;
-                }
-
-                if (current.m_values == end)
-                    m_markSets.removeLast();
-
-                markChildren(cell);
-            }
-            while (!m_values.isEmpty())
-                markChildren(m_values.removeLast());
-        }
-#if !ASSERT_DISABLED
-        m_isDraining = false;
-#endif
-    }
-
     // Rule from ECMA 15.2 about what an array index is.
     // Must exactly match string form of an unsigned integer, and be less than 2^32 - 1.
     inline unsigned Identifier::toArrayIndex(bool& ok) const
diff --git a/Source/JavaScriptCore/runtime/JSByteArray.cpp b/Source/JavaScriptCore/runtime/JSByteArray.cpp
index ae735dc..fbaea1d 100644
--- a/Source/JavaScriptCore/runtime/JSByteArray.cpp
+++ b/Source/JavaScriptCore/runtime/JSByteArray.cpp
@@ -50,9 +50,9 @@ JSByteArray::~JSByteArray()
 #endif
 
 
-PassRefPtr<Structure> JSByteArray::createStructure(JSValue prototype, const JSC::ClassInfo* classInfo)
+PassRefPtr<Structure> JSByteArray::createStructure(JSGlobalData& globalData, JSValue prototype, const JSC::ClassInfo* classInfo)
 {
-    return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, classInfo);
+    return Structure::create(globalData, prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, classInfo);
 }
 
 bool JSByteArray::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
diff --git a/Source/JavaScriptCore/runtime/JSByteArray.h b/Source/JavaScriptCore/runtime/JSByteArray.h
index 6e91594..e674958 100644
--- a/Source/JavaScriptCore/runtime/JSByteArray.h
+++ b/Source/JavaScriptCore/runtime/JSByteArray.h
@@ -76,7 +76,7 @@ namespace JSC {
         }
 
         JSByteArray(ExecState*, NonNullPassRefPtr<Structure>, WTF::ByteArray* storage);
-        static PassRefPtr<Structure> createStructure(JSValue prototype, const JSC::ClassInfo* = &s_defaultInfo);
+        static PassRefPtr<Structure> createStructure(JSGlobalData&, JSValue prototype, const JSC::ClassInfo* = &s_defaultInfo);
 
         virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
         virtual bool getOwnPropertySlot(JSC::ExecState*, unsigned propertyName, JSC::PropertySlot&);
@@ -102,7 +102,7 @@ namespace JSC {
     private:
         enum VPtrStealingHackType { VPtrStealingHack };
         JSByteArray(VPtrStealingHackType)
-            : JSNonFinalObject(createStructure(jsNull()))
+            : JSNonFinalObject(Structure::create(Structure::VPtrStealingHack, &s_info))
         {
         }
 
diff --git a/Source/JavaScriptCore/runtime/JSCell.cpp b/Source/JavaScriptCore/runtime/JSCell.cpp
index 9acb777..ce7fe22 100644
--- a/Source/JavaScriptCore/runtime/JSCell.cpp
+++ b/Source/JavaScriptCore/runtime/JSCell.cpp
@@ -119,7 +119,7 @@ bool JSCell::getOwnPropertySlot(ExecState* exec, const Identifier& identifier, P
     // This is not a general purpose implementation of getOwnPropertySlot.
     // It should only be called by JSValue::get.
     // It calls getPropertySlot, not getOwnPropertySlot.
-    JSObject* object = toObject(exec);
+    JSObject* object = toObject(exec, exec->lexicalGlobalObject());
     slot.setBase(object);
     if (!object->getPropertySlot(exec, identifier, slot))
         slot.setUndefined();
@@ -131,7 +131,7 @@ bool JSCell::getOwnPropertySlot(ExecState* exec, unsigned identifier, PropertySl
     // This is not a general purpose implementation of getOwnPropertySlot.
     // It should only be called by JSValue::get.
     // It calls getPropertySlot, not getOwnPropertySlot.
-    JSObject* object = toObject(exec);
+    JSObject* object = toObject(exec, exec->lexicalGlobalObject());
     slot.setBase(object);
     if (!object->getPropertySlot(exec, identifier, slot))
         slot.setUndefined();
@@ -140,27 +140,27 @@ bool JSCell::getOwnPropertySlot(ExecState* exec, unsigned identifier, PropertySl
 
 void JSCell::put(ExecState* exec, const Identifier& identifier, JSValue value, PutPropertySlot& slot)
 {
-    toObject(exec)->put(exec, identifier, value, slot);
+    toObject(exec, exec->lexicalGlobalObject())->put(exec, identifier, value, slot);
 }
 
 void JSCell::put(ExecState* exec, unsigned identifier, JSValue value)
 {
-    toObject(exec)->put(exec, identifier, value);
+    toObject(exec, exec->lexicalGlobalObject())->put(exec, identifier, value);
 }
 
 bool JSCell::deleteProperty(ExecState* exec, const Identifier& identifier)
 {
-    return toObject(exec)->deleteProperty(exec, identifier);
+    return toObject(exec, exec->lexicalGlobalObject())->deleteProperty(exec, identifier);
 }
 
 bool JSCell::deleteProperty(ExecState* exec, unsigned identifier)
 {
-    return toObject(exec)->deleteProperty(exec, identifier);
+    return toObject(exec, exec->lexicalGlobalObject())->deleteProperty(exec, identifier);
 }
 
 JSObject* JSCell::toThisObject(ExecState* exec) const
 {
-    return toObject(exec);
+    return toObject(exec, exec->lexicalGlobalObject());
 }
 
 JSValue JSCell::getJSNumber()
@@ -203,7 +203,7 @@ UString JSCell::toString(ExecState*) const
     return UString();
 }
 
-JSObject* JSCell::toObject(ExecState*) const
+JSObject* JSCell::toObject(ExecState*, JSGlobalObject*) const
 {
     ASSERT_NOT_REACHED();
     return 0;
diff --git a/Source/JavaScriptCore/runtime/JSCell.h b/Source/JavaScriptCore/runtime/JSCell.h
index 7313d52..ab0e237 100644
--- a/Source/JavaScriptCore/runtime/JSCell.h
+++ b/Source/JavaScriptCore/runtime/JSCell.h
@@ -35,6 +35,8 @@
 
 namespace JSC {
 
+    class JSGlobalObject;
+
 #if COMPILER(MSVC)
     // If WTF_MAKE_NONCOPYABLE is applied to JSCell we end up with a bunch of
     // undefined references to the JSCell copy constructor and assignment operator
@@ -53,10 +55,9 @@ namespace JSC {
         WTF_MAKE_NONCOPYABLE(JSCell);
 #endif
 
+        friend class ExecutableBase;
         friend class GetterSetter;
         friend class Heap;
-        friend class JIT;
-        friend class JSNumberCell;
         friend class JSObject;
         friend class JSPropertyNameIterator;
         friend class JSString;
@@ -67,15 +68,16 @@ namespace JSC {
         friend class MarkedSpace;
         friend class MarkedBlock;
         friend class ScopeChainNode;
+        friend class StructureChain;
 
     private:
         explicit JSCell(Structure*);
         virtual ~JSCell();
 
     public:
-        static PassRefPtr<Structure> createDummyStructure()
+        static PassRefPtr<Structure> createDummyStructure(JSGlobalData& globalData)
         {
-            return Structure::create(jsNull(), TypeInfo(UnspecifiedType), AnonymousSlotCount, 0);
+            return Structure::create(globalData, jsNull(), TypeInfo(UnspecifiedType), AnonymousSlotCount, 0);
         }
 
         // Querying the type.
@@ -107,7 +109,7 @@ namespace JSC {
         virtual bool toBoolean(ExecState*) const;
         virtual double toNumber(ExecState*) const;
         virtual UString toString(ExecState*) const;
-        virtual JSObject* toObject(ExecState*) const;
+        virtual JSObject* toObject(ExecState*, JSGlobalObject*) const;
 
         // Garbage collection.
         void* operator new(size_t, ExecState*);
@@ -137,6 +139,16 @@ namespace JSC {
         // property names, we want a similar interface with appropriate optimizations.)
         bool fastGetOwnPropertySlot(ExecState*, const Identifier& propertyName, PropertySlot&);
 
+        static ptrdiff_t structureOffset()
+        {
+            return OBJECT_OFFSETOF(JSCell, m_structure);
+        }
+
+        Structure* const * addressOfStructure() const
+        {
+            return &m_structure;
+        }
+
     protected:
         static const unsigned AnonymousSlotCount = 0;
 
@@ -203,6 +215,11 @@ namespace JSC {
         return isCell() ? asCell()->getString(exec) : UString();
     }
 
+    template <typename Base> UString HandleConverter<Base, Unknown>::getString(ExecState* exec) const
+    {
+        return jsValue().getString(exec);
+    }
+
     inline JSObject* JSValue::getObject() const
     {
         return isCell() ? asCell()->getObject() : 0;
@@ -322,24 +339,19 @@ namespace JSC {
 
     inline JSObject* JSValue::toObject(ExecState* exec) const
     {
-        return isCell() ? asCell()->toObject(exec) : toObjectSlowCase(exec);
+        return isCell() ? asCell()->toObject(exec, exec->lexicalGlobalObject()) : toObjectSlowCase(exec, exec->lexicalGlobalObject());
     }
 
-    inline JSObject* JSValue::toThisObject(ExecState* exec) const
+    inline JSObject* JSValue::toObject(ExecState* exec, JSGlobalObject* globalObject) const
     {
-        return isCell() ? asCell()->toThisObject(exec) : toThisObjectSlowCase(exec);
+        return isCell() ? asCell()->toObject(exec, globalObject) : toObjectSlowCase(exec, globalObject);
     }
-    
-    template <typename T> void MarkStack::append(DeprecatedPtr<T>* slot)
+
+    inline JSObject* JSValue::toThisObject(ExecState* exec) const
     {
-        internalAppend(slot->get());
+        return isCell() ? asCell()->toThisObject(exec) : toThisObjectSlowCase(exec);
     }
     
-    template <typename T> void MarkStack::append(WriteBarrierBase<T>* slot)
-    {
-        internalAppend(slot->get());
-    }
-
     ALWAYS_INLINE void MarkStack::internalAppend(JSCell* cell)
     {
         ASSERT(!m_isCheckingForDefaultMarkViolation);
@@ -350,31 +362,6 @@ namespace JSC {
             m_values.append(cell);
     }
 
-    ALWAYS_INLINE void MarkStack::deprecatedAppend(JSCell** value)
-    {
-        ASSERT(value);
-        internalAppend(*value);
-    }
-
-    ALWAYS_INLINE void MarkStack::deprecatedAppend(JSValue* value)
-    {
-        ASSERT(value);
-        internalAppend(*value);
-    }
-    
-    ALWAYS_INLINE void MarkStack::deprecatedAppend(Register* value)
-    {
-        ASSERT(value);
-        internalAppend(value->jsValue());
-    }
-
-    ALWAYS_INLINE void MarkStack::internalAppend(JSValue value)
-    {
-        ASSERT(value);
-        if (value.isCell())
-            internalAppend(value.asCell());
-    }
-
     inline Heap* Heap::heap(JSValue v)
     {
         if (!v.isCell())
@@ -411,8 +398,10 @@ namespace JSC {
     
     inline MarkedSpace::SizeClass& MarkedSpace::sizeClassFor(size_t bytes)
     {
-        ASSERT(bytes && bytes <= preciseCutoff);
-        return m_preciseSizeClasses[(bytes - 1) / preciseStep];
+        ASSERT(bytes && bytes < maxCellSize);
+        if (bytes < preciseCutoff)
+            return m_preciseSizeClasses[(bytes - 1) / preciseStep];
+        return m_impreciseSizeClasses[(bytes - 1) / impreciseStep];
     }
 
     inline void* MarkedSpace::allocate(size_t bytes)
diff --git a/Source/JavaScriptCore/runtime/JSFunction.cpp b/Source/JavaScriptCore/runtime/JSFunction.cpp
index 2ade441..dbfc606 100644
--- a/Source/JavaScriptCore/runtime/JSFunction.cpp
+++ b/Source/JavaScriptCore/runtime/JSFunction.cpp
@@ -56,16 +56,16 @@ bool JSFunction::isHostFunctionNonInline() const
     return isHostFunction();
 }
 
-JSFunction::JSFunction(NonNullPassRefPtr<Structure> structure)
+JSFunction::JSFunction(NonNullPassRefPtr<Structure> structure, VPtrHackExecutable* executable)
     : Base(structure)
-    , m_executable(adoptRef(new VPtrHackExecutable()))
 {
     ASSERT(inherits(&s_info));
+    m_executable.setWithoutWriteBarrier(executable);
 }
 
-JSFunction::JSFunction(ExecState* exec, JSGlobalObject* globalObject, NonNullPassRefPtr<Structure> structure, int length, const Identifier& name, PassRefPtr<NativeExecutable> thunk)
+JSFunction::JSFunction(ExecState* exec, JSGlobalObject* globalObject, NonNullPassRefPtr<Structure> structure, int length, const Identifier& name, NativeExecutable* thunk)
     : Base(globalObject, structure)
-    , m_executable(thunk)
+    , m_executable(exec->globalData(), this, thunk)
     , m_scopeChain(exec->globalData(), this, globalObject->globalScopeChain())
 {
     ASSERT(inherits(&s_info));
@@ -75,17 +75,20 @@ JSFunction::JSFunction(ExecState* exec, JSGlobalObject* globalObject, NonNullPas
 
 JSFunction::JSFunction(ExecState* exec, JSGlobalObject* globalObject, NonNullPassRefPtr<Structure> structure, int length, const Identifier& name, NativeFunction func)
     : Base(globalObject, structure)
-    , m_executable(exec->globalData().getHostFunction(func))
     , m_scopeChain(exec->globalData(), this, globalObject->globalScopeChain())
 {
     ASSERT(inherits(&s_info));
+    // We separate out intialisation from setting the executable
+    // as getHostFunction may perform a GC allocation, so we have to be able to
+    // mark ourselves safely
+    m_executable.set(exec->globalData(), this, exec->globalData().getHostFunction(func));
     putDirect(exec->globalData(), exec->globalData().propertyNames->name, jsString(exec, name.isNull() ? "" : name.ustring()), DontDelete | ReadOnly | DontEnum);
     putDirect(exec->globalData(), exec->propertyNames().length, jsNumber(length), DontDelete | ReadOnly | DontEnum);
 }
 
-JSFunction::JSFunction(ExecState* exec, NonNullPassRefPtr<FunctionExecutable> executable, ScopeChainNode* scopeChainNode)
+JSFunction::JSFunction(ExecState* exec, FunctionExecutable* executable, ScopeChainNode* scopeChainNode)
     : Base(scopeChainNode->globalObject.get(), scopeChainNode->globalObject->functionStructure())
-    , m_executable(executable)
+    , m_executable(exec->globalData(), this, executable)
     , m_scopeChain(exec->globalData(), this, scopeChainNode)
 {
     ASSERT(inherits(&s_info));
@@ -96,19 +99,6 @@ JSFunction::JSFunction(ExecState* exec, NonNullPassRefPtr<FunctionExecutable> ex
 JSFunction::~JSFunction()
 {
     ASSERT(vptr() == JSGlobalData::jsFunctionVPtr);
-
-    // JIT code for other functions may have had calls linked directly to the code for this function; these links
-    // are based on a check for the this pointer value for this JSFunction - which will no longer be valid once
-    // this memory is freed and may be reused (potentially for another, different JSFunction).
-    if (!isHostFunction()) {
-#if ENABLE(JIT_OPTIMIZE_CALL)
-        ASSERT(m_executable);
-        if (jsExecutable()->isGeneratedForCall())
-            jsExecutable()->generatedBytecodeForCall().unlinkCallers();
-        if (jsExecutable()->isGeneratedForConstruct())
-            jsExecutable()->generatedBytecodeForConstruct().unlinkCallers();
-#endif
-    }
 }
 
 static const char* StrictModeCallerAccessError = "Cannot access caller property of a strict mode function";
@@ -148,9 +138,13 @@ const UString JSFunction::calculatedDisplayName(ExecState* exec)
 void JSFunction::markChildren(MarkStack& markStack)
 {
     Base::markChildren(markStack);
-    if (!isHostFunction()) {
-        jsExecutable()->markAggregate(markStack);
-        markStack.append(&m_scopeChain);
+
+    markStack.append(&m_scopeChain);
+    if (m_executable) {
+        // Delightful race condition: m_executable may not have been initialised
+        // if this is a host function, as the executable isn't necessarily created 
+        // until after the function has been allocated.
+        markStack.append(&m_executable);
     }
 }
 
diff --git a/Source/JavaScriptCore/runtime/JSFunction.h b/Source/JavaScriptCore/runtime/JSFunction.h
index 089f42e..505b9de 100644
--- a/Source/JavaScriptCore/runtime/JSFunction.h
+++ b/Source/JavaScriptCore/runtime/JSFunction.h
@@ -34,6 +34,7 @@ namespace JSC {
     class JSActivation;
     class JSGlobalObject;
     class NativeExecutable;
+    class VPtrHackExecutable;
 
     EncodedJSValue JSC_HOST_CALL callHostFunctionAsConstructor(ExecState*);
 
@@ -45,8 +46,8 @@ namespace JSC {
 
     public:
         JSFunction(ExecState*, JSGlobalObject*, NonNullPassRefPtr<Structure>, int length, const Identifier&, NativeFunction);
-        JSFunction(ExecState*, JSGlobalObject*, NonNullPassRefPtr<Structure>, int length, const Identifier&, PassRefPtr<NativeExecutable>);
-        JSFunction(ExecState*, NonNullPassRefPtr<FunctionExecutable>, ScopeChainNode*);
+        JSFunction(ExecState*, JSGlobalObject*, NonNullPassRefPtr<Structure>, int length, const Identifier&, NativeExecutable*);
+        JSFunction(ExecState*, FunctionExecutable*, ScopeChainNode*);
         virtual ~JSFunction();
 
         const UString& name(ExecState*);
@@ -72,9 +73,9 @@ namespace JSC {
 
         static JS_EXPORTDATA const ClassInfo s_info;
 
-        static PassRefPtr<Structure> createStructure(JSValue prototype) 
+        static PassRefPtr<Structure> createStructure(JSGlobalData& globalData, JSValue prototype) 
         { 
-            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info); 
+            return Structure::create(globalData, prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info); 
         }
 
         NativeFunction nativeFunction();
@@ -86,7 +87,7 @@ namespace JSC {
         const static unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | OverridesMarkChildren | OverridesGetPropertyNames | JSObject::StructureFlags;
 
     private:
-        JSFunction(NonNullPassRefPtr<Structure>);
+        JSFunction(NonNullPassRefPtr<Structure>, VPtrHackExecutable*);
 
         bool isHostFunctionNonInline() const;
 
@@ -102,7 +103,7 @@ namespace JSC {
         static JSValue callerGetter(ExecState*, JSValue, const Identifier&);
         static JSValue lengthGetter(ExecState*, JSValue, const Identifier&);
 
-        RefPtr<ExecutableBase> m_executable;
+        WriteBarrier<ExecutableBase> m_executable;
         WriteBarrier<ScopeChainNode> m_scopeChain;
     };
 
diff --git a/Source/JavaScriptCore/runtime/JSGlobalData.cpp b/Source/JavaScriptCore/runtime/JSGlobalData.cpp
index e25040c..ee1829b 100644
--- a/Source/JavaScriptCore/runtime/JSGlobalData.cpp
+++ b/Source/JavaScriptCore/runtime/JSGlobalData.cpp
@@ -68,6 +68,27 @@
 
 using namespace WTF;
 
+namespace {
+
+using namespace JSC;
+
+class Recompiler {
+public:
+    void operator()(JSCell*);
+};
+
+inline void Recompiler::operator()(JSCell* cell)
+{
+    if (!cell->inherits(&JSFunction::s_info))
+        return;
+    JSFunction* function = asFunction(cell);
+    if (function->executable()->isHostFunction())
+        return;
+    function->jsExecutable()->discardCode();
+}
+
+} // namespace
+
 namespace JSC {
 
 extern JSC_CONST_HASHTABLE HashTable arrayTable;
@@ -107,8 +128,12 @@ void JSGlobalData::storeVPtrs()
     jsString->~JSCell();
 
     COMPILE_ASSERT(sizeof(JSFunction) <= sizeof(storage), sizeof_JSFunction_must_be_less_than_storage);
-    JSCell* jsFunction = new (storage) JSFunction(JSFunction::createStructure(jsNull()));
+    char executableStorage[sizeof(VPtrHackExecutable)];
+    RefPtr<Structure> executableStructure = Structure::create(Structure::VPtrStealingHack, 0);
+    JSCell* executable = new (executableStorage) VPtrHackExecutable(executableStructure.get());
+    JSCell* jsFunction = new (storage) JSFunction(Structure::create(Structure::VPtrStealingHack, &JSFunction::s_info), static_cast<VPtrHackExecutable*>(executable));
     JSGlobalData::jsFunctionVPtr = jsFunction->vptr();
+    executable->~JSCell();
     jsFunction->~JSCell();
 }
 
@@ -124,18 +149,6 @@ JSGlobalData::JSGlobalData(GlobalDataType globalDataType, ThreadStackType thread
     , regExpTable(fastNew<HashTable>(JSC::regExpTable))
     , regExpConstructorTable(fastNew<HashTable>(JSC::regExpConstructorTable))
     , stringTable(fastNew<HashTable>(JSC::stringTable))
-    , activationStructure(JSActivation::createStructure(jsNull()))
-    , interruptedExecutionErrorStructure(JSNonFinalObject::createStructure(jsNull()))
-    , terminatedExecutionErrorStructure(JSNonFinalObject::createStructure(jsNull()))
-    , staticScopeStructure(JSStaticScopeObject::createStructure(jsNull()))
-    , strictEvalActivationStructure(StrictEvalActivation::createStructure(jsNull()))
-    , stringStructure(JSString::createStructure(jsNull()))
-    , notAnObjectStructure(JSNotAnObject::createStructure(jsNull()))
-    , propertyNameIteratorStructure(JSPropertyNameIterator::createStructure(jsNull()))
-    , getterSetterStructure(GetterSetter::createStructure(jsNull()))
-    , apiWrapperStructure(JSAPIValueWrapper::createStructure(jsNull()))
-    , scopeChainNodeStructure(ScopeChainNode::createStructure(jsNull()))
-    , dummyMarkableCellStructure(JSCell::createDummyStructure())
     , identifierTable(globalDataType == Default ? wtfThreadData().currentIdentifierTable() : createIdentifierTable())
     , propertyNames(new CommonIdentifiers(this))
     , emptyList(new MarkedArgumentBuffer)
@@ -145,7 +158,6 @@ JSGlobalData::JSGlobalData(GlobalDataType globalDataType, ThreadStackType thread
     , heap(this)
     , globalObjectCount(0)
     , dynamicGlobalObject(0)
-    , firstStringifierToMark(0)
     , cachedUTCOffset(NaN)
     , maxReentryDepth(threadStackType == ThreadStackTypeSmall ? MaxSmallThreadReentryDepth : MaxLargeThreadReentryDepth)
     , m_regExpCache(new RegExpCache(this))
@@ -156,6 +168,24 @@ JSGlobalData::JSGlobalData(GlobalDataType globalDataType, ThreadStackType thread
     , exclusiveThread(0)
 #endif
 {
+    activationStructure = JSActivation::createStructure(*this, jsNull());
+    interruptedExecutionErrorStructure = JSNonFinalObject::createStructure(*this, jsNull());
+    terminatedExecutionErrorStructure = JSNonFinalObject::createStructure(*this, jsNull());
+    staticScopeStructure = JSStaticScopeObject::createStructure(*this, jsNull());
+    strictEvalActivationStructure = StrictEvalActivation::createStructure(*this, jsNull());
+    stringStructure = JSString::createStructure(*this, jsNull());
+    notAnObjectStructure = JSNotAnObject::createStructure(*this, jsNull());
+    propertyNameIteratorStructure = JSPropertyNameIterator::createStructure(*this, jsNull());
+    getterSetterStructure = GetterSetter::createStructure(*this, jsNull());
+    apiWrapperStructure = JSAPIValueWrapper::createStructure(*this, jsNull());
+    scopeChainNodeStructure = ScopeChainNode::createStructure(*this, jsNull());
+    executableStructure = ExecutableBase::createStructure(*this, jsNull());
+    evalExecutableStructure = EvalExecutable::createStructure(*this, jsNull());
+    programExecutableStructure = ProgramExecutable::createStructure(*this, jsNull());
+    functionExecutableStructure = FunctionExecutable::createStructure(*this, jsNull());
+    dummyMarkableCellStructure = JSCell::createDummyStructure(*this);
+    structureChainStructure = StructureChain::createStructure(*this, jsNull());
+
     interpreter = new Interpreter(*this);
     if (globalDataType == Default)
         m_stack = wtfThreadData().stack();
@@ -282,18 +312,18 @@ JSGlobalData*& JSGlobalData::sharedInstanceInternal()
 }
 
 #if ENABLE(JIT)
-PassRefPtr<NativeExecutable> JSGlobalData::getHostFunction(NativeFunction function)
+NativeExecutable* JSGlobalData::getHostFunction(NativeFunction function)
 {
     return jitStubs->hostFunctionStub(this, function);
 }
-PassRefPtr<NativeExecutable> JSGlobalData::getHostFunction(NativeFunction function, ThunkGenerator generator)
+NativeExecutable* JSGlobalData::getHostFunction(NativeFunction function, ThunkGenerator generator)
 {
     return jitStubs->hostFunctionStub(this, function, generator);
 }
 #else
-PassRefPtr<NativeExecutable> JSGlobalData::getHostFunction(NativeFunction function)
+NativeExecutable* JSGlobalData::getHostFunction(NativeFunction function)
 {
-    return NativeExecutable::create(function, callHostFunctionAsConstructor);
+    return NativeExecutable::create(*this, function, callHostFunctionAsConstructor);
 }
 #endif
 
@@ -325,22 +355,6 @@ void JSGlobalData::dumpSampleData(ExecState* exec)
     interpreter->dumpSampleData(exec);
 }
 
-class Recompiler {
-public:
-    void operator()(JSCell*);
-};
-
-inline void Recompiler::operator()(JSCell* cell)
-{
-    if (!cell->inherits(&JSFunction::s_info))
-        return;
-    JSFunction* function = asFunction(cell);
-    if (function->executable()->isHostFunction())
-        return;
-    function->jsExecutable()->discardCode();
-}
-
-
 void JSGlobalData::recompileAllJSFunctions()
 {
     // If JavaScript is running, it's not safe to recompile, since we'll end
diff --git a/Source/JavaScriptCore/runtime/JSGlobalData.h b/Source/JavaScriptCore/runtime/JSGlobalData.h
index ee3e067..34ea75d 100644
--- a/Source/JavaScriptCore/runtime/JSGlobalData.h
+++ b/Source/JavaScriptCore/runtime/JSGlobalData.h
@@ -57,6 +57,7 @@ namespace JSC {
 
     class CodeBlock;
     class CommonIdentifiers;
+    class HandleStack;
     class IdentifierTable;
     class Interpreter;
     class JSGlobalObject;
@@ -128,7 +129,7 @@ namespace JSC {
 
 #if ENABLE(JSC_MULTIPLE_THREADS)
         // Will start tracking threads that use the heap, which is resource-heavy.
-        void makeUsableFromMultipleThreads() { heap.machineStackMarker().makeUsableFromMultipleThreads(); }
+        void makeUsableFromMultipleThreads() { heap.machineThreads().makeUsableFromMultipleThreads(); }
 #endif
 
         GlobalDataType globalDataType;
@@ -155,7 +156,12 @@ namespace JSC {
         RefPtr<Structure> getterSetterStructure;
         RefPtr<Structure> apiWrapperStructure;
         RefPtr<Structure> scopeChainNodeStructure;
+        RefPtr<Structure> executableStructure;
+        RefPtr<Structure> evalExecutableStructure;
+        RefPtr<Structure> programExecutableStructure;
+        RefPtr<Structure> functionExecutableStructure;
         RefPtr<Structure> dummyMarkableCellStructure;
+        RefPtr<Structure> structureChainStructure;
 
         static void storeVPtrs();
         static JS_EXPORTDATA void* jsArrayVPtr;
@@ -199,15 +205,15 @@ namespace JSC {
         {
             return jitStubs->ctiStub(this, generator);
         }
-        PassRefPtr<NativeExecutable> getHostFunction(NativeFunction, ThunkGenerator);
+        NativeExecutable* getHostFunction(NativeFunction, ThunkGenerator);
 #endif
-        PassRefPtr<NativeExecutable> getHostFunction(NativeFunction);
+        NativeExecutable* getHostFunction(NativeFunction);
 
         TimeoutChecker timeoutChecker;
         Terminator terminator;
         Heap heap;
 
-        DeprecatedPtr<Unknown> exception;
+        JSValue exception;
 #if ENABLE(JIT)
         ReturnAddressPtr exceptionLocation;
 #endif
@@ -219,8 +225,6 @@ namespace JSC {
 
         HashSet<JSObject*> stringRecursionCheckVisitedObjects;
 
-        Stringifier* firstStringifierToMark;
-
         double cachedUTCOffset;
         DSTOffsetCache dstOffsetCache;
         
@@ -255,6 +259,7 @@ namespace JSC {
 #endif
         void dumpRegExpTrace();
         HandleSlot allocateGlobalHandle() { return heap.allocateGlobalHandle(); }
+        HandleSlot allocateLocalHandle() { return heap.allocateLocalHandle(); }
 
     private:
         JSGlobalData(GlobalDataType, ThreadStackType);
diff --git a/Source/JavaScriptCore/runtime/JSGlobalObject.cpp b/Source/JavaScriptCore/runtime/JSGlobalObject.cpp
index 28fc07d..a2bbfbd 100644
--- a/Source/JavaScriptCore/runtime/JSGlobalObject.cpp
+++ b/Source/JavaScriptCore/runtime/JSGlobalObject.cpp
@@ -88,21 +88,21 @@ static inline void markIfNeeded(MarkStack& markStack, const RefPtr<Structure>& s
 {
     if (s && s->storedPrototype())
         markStack.append(s->storedPrototypeSlot());
+    if (s && *s->cachedPrototypeChainSlot())
+        markStack.append(s->cachedPrototypeChainSlot());
 }
 
 JSGlobalObject::~JSGlobalObject()
 {
     ASSERT(JSLock::currentThreadIsHoldingLock());
 
-    if (d()->debugger)
-        d()->debugger->detach(this);
+    if (m_debugger)
+        m_debugger->detach(this);
 
     Profiler** profiler = Profiler::enabledProfilerReference();
     if (UNLIKELY(*profiler != 0)) {
-        (*profiler)->stopProfiling(globalExec(), UString());
+        (*profiler)->stopProfiling(this);
     }
-
-    d()->destructor(d());
 }
 
 void JSGlobalObject::init(JSObject* thisValue)
@@ -111,14 +111,14 @@ void JSGlobalObject::init(JSObject* thisValue)
     
     structure()->disableSpecificFunctionTracking();
 
-    d()->globalData = Heap::heap(this)->globalData();
-    d()->globalScopeChain.set(*d()->globalData, this, new (d()->globalData.get()) ScopeChainNode(0, this, d()->globalData.get(), this, thisValue));
+    m_globalData = Heap::heap(this)->globalData();
+    m_globalScopeChain.set(*m_globalData, this, new (m_globalData.get()) ScopeChainNode(0, this, m_globalData.get(), this, thisValue));
 
-    JSGlobalObject::globalExec()->init(0, 0, d()->globalScopeChain.get(), CallFrame::noCaller(), 0, 0);
+    JSGlobalObject::globalExec()->init(0, 0, m_globalScopeChain.get(), CallFrame::noCaller(), 0, 0);
 
-    d()->debugger = 0;
+    m_debugger = 0;
 
-    d()->profileGroup = 0;
+    m_profileGroup = 0;
 
     reset(prototype());
 }
@@ -177,80 +177,80 @@ void JSGlobalObject::reset(JSValue prototype)
 
     // Prototypes
 
-    d()->functionPrototype.set(exec->globalData(), this, new (exec) FunctionPrototype(exec, this, FunctionPrototype::createStructure(jsNull()))); // The real prototype will be set once ObjectPrototype is created.
-    d()->functionStructure = JSFunction::createStructure(d()->functionPrototype.get());
-    d()->internalFunctionStructure = InternalFunction::createStructure(d()->functionPrototype.get());
+    m_functionPrototype.set(exec->globalData(), this, new (exec) FunctionPrototype(exec, this, FunctionPrototype::createStructure(exec->globalData(), jsNull()))); // The real prototype will be set once ObjectPrototype is created.
+    m_functionStructure = JSFunction::createStructure(exec->globalData(), m_functionPrototype.get());
+    m_internalFunctionStructure = InternalFunction::createStructure(exec->globalData(), m_functionPrototype.get());
     JSFunction* callFunction = 0;
     JSFunction* applyFunction = 0;
-    d()->functionPrototype->addFunctionProperties(exec, this, d()->functionStructure.get(), &callFunction, &applyFunction);
-    d()->callFunction.set(exec->globalData(), this, callFunction);
-    d()->applyFunction.set(exec->globalData(), this, applyFunction);
-    d()->objectPrototype.set(exec->globalData(), this, new (exec) ObjectPrototype(exec, this, ObjectPrototype::createStructure(jsNull()), d()->functionStructure.get()));
-    d()->functionPrototype->structure()->setPrototypeWithoutTransition(d()->objectPrototype.get());
+    m_functionPrototype->addFunctionProperties(exec, this, m_functionStructure.get(), &callFunction, &applyFunction);
+    m_callFunction.set(exec->globalData(), this, callFunction);
+    m_applyFunction.set(exec->globalData(), this, applyFunction);
+    m_objectPrototype.set(exec->globalData(), this, new (exec) ObjectPrototype(exec, this, ObjectPrototype::createStructure(exec->globalData(), jsNull()), m_functionStructure.get()));
+    m_functionPrototype->structure()->setPrototypeWithoutTransition(m_objectPrototype.get());
 
-    d()->emptyObjectStructure = d()->objectPrototype->inheritorID();
+    m_emptyObjectStructure = m_objectPrototype->inheritorID(exec->globalData());
 
-    d()->callbackFunctionStructure = JSCallbackFunction::createStructure(d()->functionPrototype.get());
-    d()->argumentsStructure = Arguments::createStructure(d()->objectPrototype.get());
-    d()->callbackConstructorStructure = JSCallbackConstructor::createStructure(d()->objectPrototype.get());
-    d()->callbackObjectStructure = JSCallbackObject<JSObjectWithGlobalObject>::createStructure(d()->objectPrototype.get());
+    m_callbackFunctionStructure = JSCallbackFunction::createStructure(exec->globalData(), m_functionPrototype.get());
+    m_argumentsStructure = Arguments::createStructure(exec->globalData(), m_objectPrototype.get());
+    m_callbackConstructorStructure = JSCallbackConstructor::createStructure(exec->globalData(), m_objectPrototype.get());
+    m_callbackObjectStructure = JSCallbackObject<JSObjectWithGlobalObject>::createStructure(exec->globalData(), m_objectPrototype.get());
 
-    d()->arrayPrototype.set(exec->globalData(), this, new (exec) ArrayPrototype(this, ArrayPrototype::createStructure(d()->objectPrototype.get())));
-    d()->arrayStructure = JSArray::createStructure(d()->arrayPrototype.get());
-    d()->regExpMatchesArrayStructure = RegExpMatchesArray::createStructure(d()->arrayPrototype.get());
+    m_arrayPrototype.set(exec->globalData(), this, new (exec) ArrayPrototype(this, ArrayPrototype::createStructure(exec->globalData(), m_objectPrototype.get())));
+    m_arrayStructure = JSArray::createStructure(exec->globalData(), m_arrayPrototype.get());
+    m_regExpMatchesArrayStructure = RegExpMatchesArray::createStructure(exec->globalData(), m_arrayPrototype.get());
 
-    d()->stringPrototype.set(exec->globalData(), this, new (exec) StringPrototype(exec, this, StringPrototype::createStructure(d()->objectPrototype.get())));
-    d()->stringObjectStructure = StringObject::createStructure(d()->stringPrototype.get());
+    m_stringPrototype.set(exec->globalData(), this, new (exec) StringPrototype(exec, this, StringPrototype::createStructure(exec->globalData(), m_objectPrototype.get())));
+    m_stringObjectStructure = StringObject::createStructure(exec->globalData(), m_stringPrototype.get());
 
-    d()->booleanPrototype.set(exec->globalData(), this, new (exec) BooleanPrototype(exec, this, BooleanPrototype::createStructure(d()->objectPrototype.get()), d()->functionStructure.get()));
-    d()->booleanObjectStructure = BooleanObject::createStructure(d()->booleanPrototype.get());
+    m_booleanPrototype.set(exec->globalData(), this, new (exec) BooleanPrototype(exec, this, BooleanPrototype::createStructure(exec->globalData(), m_objectPrototype.get()), m_functionStructure.get()));
+    m_booleanObjectStructure = BooleanObject::createStructure(exec->globalData(), m_booleanPrototype.get());
 
-    d()->numberPrototype.set(exec->globalData(), this, new (exec) NumberPrototype(exec, this, NumberPrototype::createStructure(d()->objectPrototype.get()), d()->functionStructure.get()));
-    d()->numberObjectStructure = NumberObject::createStructure(d()->numberPrototype.get());
+    m_numberPrototype.set(exec->globalData(), this, new (exec) NumberPrototype(exec, this, NumberPrototype::createStructure(exec->globalData(), m_objectPrototype.get()), m_functionStructure.get()));
+    m_numberObjectStructure = NumberObject::createStructure(exec->globalData(), m_numberPrototype.get());
 
-    d()->datePrototype.set(exec->globalData(), this, new (exec) DatePrototype(exec, this, DatePrototype::createStructure(d()->objectPrototype.get())));
-    d()->dateStructure = DateInstance::createStructure(d()->datePrototype.get());
+    m_datePrototype.set(exec->globalData(), this, new (exec) DatePrototype(exec, this, DatePrototype::createStructure(exec->globalData(), m_objectPrototype.get())));
+    m_dateStructure = DateInstance::createStructure(exec->globalData(), m_datePrototype.get());
 
-    d()->regExpPrototype.set(exec->globalData(), this, new (exec) RegExpPrototype(exec, this, RegExpPrototype::createStructure(d()->objectPrototype.get()), d()->functionStructure.get()));
-    d()->regExpStructure = RegExpObject::createStructure(d()->regExpPrototype.get());
+    m_regExpPrototype.set(exec->globalData(), this, new (exec) RegExpPrototype(exec, this, RegExpPrototype::createStructure(exec->globalData(), m_objectPrototype.get()), m_functionStructure.get()));
+    m_regExpStructure = RegExpObject::createStructure(exec->globalData(), m_regExpPrototype.get());
 
-    d()->methodCallDummy.set(exec->globalData(), this, constructEmptyObject(exec));
+    m_methodCallDummy.set(exec->globalData(), this, constructEmptyObject(exec));
 
-    ErrorPrototype* errorPrototype = new (exec) ErrorPrototype(exec, this, ErrorPrototype::createStructure(d()->objectPrototype.get()), d()->functionStructure.get());
-    d()->errorStructure = ErrorInstance::createStructure(errorPrototype);
+    ErrorPrototype* errorPrototype = new (exec) ErrorPrototype(exec, this, ErrorPrototype::createStructure(exec->globalData(), m_objectPrototype.get()), m_functionStructure.get());
+    m_errorStructure = ErrorInstance::createStructure(exec->globalData(), errorPrototype);
 
     // Constructors
 
-    JSCell* objectConstructor = new (exec) ObjectConstructor(exec, this, ObjectConstructor::createStructure(d()->functionPrototype.get()), d()->objectPrototype.get());
-    JSCell* functionConstructor = new (exec) FunctionConstructor(exec, this, FunctionConstructor::createStructure(d()->functionPrototype.get()), d()->functionPrototype.get());
-    JSCell* arrayConstructor = new (exec) ArrayConstructor(exec, this, ArrayConstructor::createStructure(d()->functionPrototype.get()), d()->arrayPrototype.get(), d()->functionStructure.get());
-    JSCell* stringConstructor = new (exec) StringConstructor(exec, this, StringConstructor::createStructure(d()->functionPrototype.get()), d()->functionStructure.get(), d()->stringPrototype.get());
-    JSCell* booleanConstructor = new (exec) BooleanConstructor(exec, this, BooleanConstructor::createStructure(d()->functionPrototype.get()), d()->booleanPrototype.get());
-    JSCell* numberConstructor = new (exec) NumberConstructor(exec, this, NumberConstructor::createStructure(d()->functionPrototype.get()), d()->numberPrototype.get());
-    JSCell* dateConstructor = new (exec) DateConstructor(exec, this, DateConstructor::createStructure(d()->functionPrototype.get()), d()->functionStructure.get(), d()->datePrototype.get());
-
-    d()->regExpConstructor.set(exec->globalData(), this, new (exec) RegExpConstructor(exec, this, RegExpConstructor::createStructure(d()->functionPrototype.get()), d()->regExpPrototype.get()));
-
-    d()->errorConstructor.set(exec->globalData(), this, new (exec) ErrorConstructor(exec, this, ErrorConstructor::createStructure(d()->functionPrototype.get()), errorPrototype));
-
-    RefPtr<Structure> nativeErrorPrototypeStructure = NativeErrorPrototype::createStructure(errorPrototype);
-    RefPtr<Structure> nativeErrorStructure = NativeErrorConstructor::createStructure(d()->functionPrototype.get());
-    d()->evalErrorConstructor.set(exec->globalData(), this, new (exec) NativeErrorConstructor(exec, this, nativeErrorStructure, nativeErrorPrototypeStructure, "EvalError"));
-    d()->rangeErrorConstructor.set(exec->globalData(), this, new (exec) NativeErrorConstructor(exec, this, nativeErrorStructure, nativeErrorPrototypeStructure, "RangeError"));
-    d()->referenceErrorConstructor.set(exec->globalData(), this, new (exec) NativeErrorConstructor(exec, this, nativeErrorStructure, nativeErrorPrototypeStructure, "ReferenceError"));
-    d()->syntaxErrorConstructor.set(exec->globalData(), this, new (exec) NativeErrorConstructor(exec, this, nativeErrorStructure, nativeErrorPrototypeStructure, "SyntaxError"));
-    d()->typeErrorConstructor.set(exec->globalData(), this, new (exec) NativeErrorConstructor(exec, this, nativeErrorStructure, nativeErrorPrototypeStructure, "TypeError"));
-    d()->URIErrorConstructor.set(exec->globalData(), this, new (exec) NativeErrorConstructor(exec, this, nativeErrorStructure, nativeErrorPrototypeStructure, "URIError"));
-
-    d()->objectPrototype->putDirectFunctionWithoutTransition(exec->globalData(), exec->propertyNames().constructor, objectConstructor, DontEnum);
-    d()->functionPrototype->putDirectFunctionWithoutTransition(exec->globalData(), exec->propertyNames().constructor, functionConstructor, DontEnum);
-    d()->arrayPrototype->putDirectFunctionWithoutTransition(exec->globalData(), exec->propertyNames().constructor, arrayConstructor, DontEnum);
-    d()->booleanPrototype->putDirectFunctionWithoutTransition(exec->globalData(), exec->propertyNames().constructor, booleanConstructor, DontEnum);
-    d()->stringPrototype->putDirectFunctionWithoutTransition(exec->globalData(), exec->propertyNames().constructor, stringConstructor, DontEnum);
-    d()->numberPrototype->putDirectFunctionWithoutTransition(exec->globalData(), exec->propertyNames().constructor, numberConstructor, DontEnum);
-    d()->datePrototype->putDirectFunctionWithoutTransition(exec->globalData(), exec->propertyNames().constructor, dateConstructor, DontEnum);
-    d()->regExpPrototype->putDirectFunctionWithoutTransition(exec->globalData(), exec->propertyNames().constructor, d()->regExpConstructor.get(), DontEnum);
-    errorPrototype->putDirectFunctionWithoutTransition(exec->globalData(), exec->propertyNames().constructor, d()->errorConstructor.get(), DontEnum);
+    JSCell* objectConstructor = new (exec) ObjectConstructor(exec, this, ObjectConstructor::createStructure(exec->globalData(), m_functionPrototype.get()), m_objectPrototype.get());
+    JSCell* functionConstructor = new (exec) FunctionConstructor(exec, this, FunctionConstructor::createStructure(exec->globalData(), m_functionPrototype.get()), m_functionPrototype.get());
+    JSCell* arrayConstructor = new (exec) ArrayConstructor(exec, this, ArrayConstructor::createStructure(exec->globalData(), m_functionPrototype.get()), m_arrayPrototype.get(), m_functionStructure.get());
+    JSCell* stringConstructor = new (exec) StringConstructor(exec, this, StringConstructor::createStructure(exec->globalData(), m_functionPrototype.get()), m_functionStructure.get(), m_stringPrototype.get());
+    JSCell* booleanConstructor = new (exec) BooleanConstructor(exec, this, BooleanConstructor::createStructure(exec->globalData(), m_functionPrototype.get()), m_booleanPrototype.get());
+    JSCell* numberConstructor = new (exec) NumberConstructor(exec, this, NumberConstructor::createStructure(exec->globalData(), m_functionPrototype.get()), m_numberPrototype.get());
+    JSCell* dateConstructor = new (exec) DateConstructor(exec, this, DateConstructor::createStructure(exec->globalData(), m_functionPrototype.get()), m_functionStructure.get(), m_datePrototype.get());
+
+    m_regExpConstructor.set(exec->globalData(), this, new (exec) RegExpConstructor(exec, this, RegExpConstructor::createStructure(exec->globalData(), m_functionPrototype.get()), m_regExpPrototype.get()));
+
+    m_errorConstructor.set(exec->globalData(), this, new (exec) ErrorConstructor(exec, this, ErrorConstructor::createStructure(exec->globalData(), m_functionPrototype.get()), errorPrototype));
+
+    RefPtr<Structure> nativeErrorPrototypeStructure = NativeErrorPrototype::createStructure(exec->globalData(), errorPrototype);
+    RefPtr<Structure> nativeErrorStructure = NativeErrorConstructor::createStructure(exec->globalData(), m_functionPrototype.get());
+    m_evalErrorConstructor.set(exec->globalData(), this, new (exec) NativeErrorConstructor(exec, this, nativeErrorStructure, nativeErrorPrototypeStructure, "EvalError"));
+    m_rangeErrorConstructor.set(exec->globalData(), this, new (exec) NativeErrorConstructor(exec, this, nativeErrorStructure, nativeErrorPrototypeStructure, "RangeError"));
+    m_referenceErrorConstructor.set(exec->globalData(), this, new (exec) NativeErrorConstructor(exec, this, nativeErrorStructure, nativeErrorPrototypeStructure, "ReferenceError"));
+    m_syntaxErrorConstructor.set(exec->globalData(), this, new (exec) NativeErrorConstructor(exec, this, nativeErrorStructure, nativeErrorPrototypeStructure, "SyntaxError"));
+    m_typeErrorConstructor.set(exec->globalData(), this, new (exec) NativeErrorConstructor(exec, this, nativeErrorStructure, nativeErrorPrototypeStructure, "TypeError"));
+    m_URIErrorConstructor.set(exec->globalData(), this, new (exec) NativeErrorConstructor(exec, this, nativeErrorStructure, nativeErrorPrototypeStructure, "URIError"));
+
+    m_objectPrototype->putDirectFunctionWithoutTransition(exec->globalData(), exec->propertyNames().constructor, objectConstructor, DontEnum);
+    m_functionPrototype->putDirectFunctionWithoutTransition(exec->globalData(), exec->propertyNames().constructor, functionConstructor, DontEnum);
+    m_arrayPrototype->putDirectFunctionWithoutTransition(exec->globalData(), exec->propertyNames().constructor, arrayConstructor, DontEnum);
+    m_booleanPrototype->putDirectFunctionWithoutTransition(exec->globalData(), exec->propertyNames().constructor, booleanConstructor, DontEnum);
+    m_stringPrototype->putDirectFunctionWithoutTransition(exec->globalData(), exec->propertyNames().constructor, stringConstructor, DontEnum);
+    m_numberPrototype->putDirectFunctionWithoutTransition(exec->globalData(), exec->propertyNames().constructor, numberConstructor, DontEnum);
+    m_datePrototype->putDirectFunctionWithoutTransition(exec->globalData(), exec->propertyNames().constructor, dateConstructor, DontEnum);
+    m_regExpPrototype->putDirectFunctionWithoutTransition(exec->globalData(), exec->propertyNames().constructor, m_regExpConstructor.get(), DontEnum);
+    errorPrototype->putDirectFunctionWithoutTransition(exec->globalData(), exec->propertyNames().constructor, m_errorConstructor.get(), DontEnum);
 
     // Set global constructors
 
@@ -263,42 +263,42 @@ void JSGlobalObject::reset(JSValue prototype)
     putDirectFunctionWithoutTransition(exec->globalData(), Identifier(exec, "String"), stringConstructor, DontEnum);
     putDirectFunctionWithoutTransition(exec->globalData(), Identifier(exec, "Number"), numberConstructor, DontEnum);
     putDirectFunctionWithoutTransition(exec->globalData(), Identifier(exec, "Date"), dateConstructor, DontEnum);
-    putDirectFunctionWithoutTransition(exec->globalData(), Identifier(exec, "RegExp"), d()->regExpConstructor.get(), DontEnum);
-    putDirectFunctionWithoutTransition(exec->globalData(), Identifier(exec, "Error"), d()->errorConstructor.get(), DontEnum);
-    putDirectFunctionWithoutTransition(exec->globalData(), Identifier(exec, "EvalError"), d()->evalErrorConstructor.get(), DontEnum);
-    putDirectFunctionWithoutTransition(exec->globalData(), Identifier(exec, "RangeError"), d()->rangeErrorConstructor.get(), DontEnum);
-    putDirectFunctionWithoutTransition(exec->globalData(), Identifier(exec, "ReferenceError"), d()->referenceErrorConstructor.get(), DontEnum);
-    putDirectFunctionWithoutTransition(exec->globalData(), Identifier(exec, "SyntaxError"), d()->syntaxErrorConstructor.get(), DontEnum);
-    putDirectFunctionWithoutTransition(exec->globalData(), Identifier(exec, "TypeError"), d()->typeErrorConstructor.get(), DontEnum);
-    putDirectFunctionWithoutTransition(exec->globalData(), Identifier(exec, "URIError"), d()->URIErrorConstructor.get(), DontEnum);
+    putDirectFunctionWithoutTransition(exec->globalData(), Identifier(exec, "RegExp"), m_regExpConstructor.get(), DontEnum);
+    putDirectFunctionWithoutTransition(exec->globalData(), Identifier(exec, "Error"), m_errorConstructor.get(), DontEnum);
+    putDirectFunctionWithoutTransition(exec->globalData(), Identifier(exec, "EvalError"), m_evalErrorConstructor.get(), DontEnum);
+    putDirectFunctionWithoutTransition(exec->globalData(), Identifier(exec, "RangeError"), m_rangeErrorConstructor.get(), DontEnum);
+    putDirectFunctionWithoutTransition(exec->globalData(), Identifier(exec, "ReferenceError"), m_referenceErrorConstructor.get(), DontEnum);
+    putDirectFunctionWithoutTransition(exec->globalData(), Identifier(exec, "SyntaxError"), m_syntaxErrorConstructor.get(), DontEnum);
+    putDirectFunctionWithoutTransition(exec->globalData(), Identifier(exec, "TypeError"), m_typeErrorConstructor.get(), DontEnum);
+    putDirectFunctionWithoutTransition(exec->globalData(), Identifier(exec, "URIError"), m_URIErrorConstructor.get(), DontEnum);
 
     // Set global values.
     GlobalPropertyInfo staticGlobals[] = {
-        GlobalPropertyInfo(Identifier(exec, "Math"), new (exec) MathObject(exec, this, MathObject::createStructure(d()->objectPrototype.get())), DontEnum | DontDelete),
+        GlobalPropertyInfo(Identifier(exec, "Math"), new (exec) MathObject(exec, this, MathObject::createStructure(exec->globalData(), m_objectPrototype.get())), DontEnum | DontDelete),
         GlobalPropertyInfo(Identifier(exec, "NaN"), jsNaN(), DontEnum | DontDelete | ReadOnly),
         GlobalPropertyInfo(Identifier(exec, "Infinity"), jsNumber(Inf), DontEnum | DontDelete | ReadOnly),
         GlobalPropertyInfo(Identifier(exec, "undefined"), jsUndefined(), DontEnum | DontDelete | ReadOnly),
-        GlobalPropertyInfo(Identifier(exec, "JSON"), new (exec) JSONObject(this, JSONObject::createStructure(d()->objectPrototype.get())), DontEnum | DontDelete)
+        GlobalPropertyInfo(Identifier(exec, "JSON"), new (exec) JSONObject(this, JSONObject::createStructure(exec->globalData(), m_objectPrototype.get())), DontEnum | DontDelete)
     };
 
     addStaticGlobals(staticGlobals, WTF_ARRAY_LENGTH(staticGlobals));
 
     // Set global functions.
 
-    d()->evalFunction.set(exec->globalData(), this, new (exec) JSFunction(exec, this, d()->functionStructure.get(), 1, exec->propertyNames().eval, globalFuncEval));
-    putDirectFunctionWithoutTransition(exec, d()->evalFunction.get(), DontEnum);
-    putDirectFunctionWithoutTransition(exec, new (exec) JSFunction(exec, this, d()->functionStructure.get(), 2, Identifier(exec, "parseInt"), globalFuncParseInt), DontEnum);
-    putDirectFunctionWithoutTransition(exec, new (exec) JSFunction(exec, this, d()->functionStructure.get(), 1, Identifier(exec, "parseFloat"), globalFuncParseFloat), DontEnum);
-    putDirectFunctionWithoutTransition(exec, new (exec) JSFunction(exec, this, d()->functionStructure.get(), 1, Identifier(exec, "isNaN"), globalFuncIsNaN), DontEnum);
-    putDirectFunctionWithoutTransition(exec, new (exec) JSFunction(exec, this, d()->functionStructure.get(), 1, Identifier(exec, "isFinite"), globalFuncIsFinite), DontEnum);
-    putDirectFunctionWithoutTransition(exec, new (exec) JSFunction(exec, this, d()->functionStructure.get(), 1, Identifier(exec, "escape"), globalFuncEscape), DontEnum);
-    putDirectFunctionWithoutTransition(exec, new (exec) JSFunction(exec, this, d()->functionStructure.get(), 1, Identifier(exec, "unescape"), globalFuncUnescape), DontEnum);
-    putDirectFunctionWithoutTransition(exec, new (exec) JSFunction(exec, this, d()->functionStructure.get(), 1, Identifier(exec, "decodeURI"), globalFuncDecodeURI), DontEnum);
-    putDirectFunctionWithoutTransition(exec, new (exec) JSFunction(exec, this, d()->functionStructure.get(), 1, Identifier(exec, "decodeURIComponent"), globalFuncDecodeURIComponent), DontEnum);
-    putDirectFunctionWithoutTransition(exec, new (exec) JSFunction(exec, this, d()->functionStructure.get(), 1, Identifier(exec, "encodeURI"), globalFuncEncodeURI), DontEnum);
-    putDirectFunctionWithoutTransition(exec, new (exec) JSFunction(exec, this, d()->functionStructure.get(), 1, Identifier(exec, "encodeURIComponent"), globalFuncEncodeURIComponent), DontEnum);
+    m_evalFunction.set(exec->globalData(), this, new (exec) JSFunction(exec, this, m_functionStructure.get(), 1, exec->propertyNames().eval, globalFuncEval));
+    putDirectFunctionWithoutTransition(exec, m_evalFunction.get(), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) JSFunction(exec, this, m_functionStructure.get(), 2, Identifier(exec, "parseInt"), globalFuncParseInt), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) JSFunction(exec, this, m_functionStructure.get(), 1, Identifier(exec, "parseFloat"), globalFuncParseFloat), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) JSFunction(exec, this, m_functionStructure.get(), 1, Identifier(exec, "isNaN"), globalFuncIsNaN), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) JSFunction(exec, this, m_functionStructure.get(), 1, Identifier(exec, "isFinite"), globalFuncIsFinite), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) JSFunction(exec, this, m_functionStructure.get(), 1, Identifier(exec, "escape"), globalFuncEscape), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) JSFunction(exec, this, m_functionStructure.get(), 1, Identifier(exec, "unescape"), globalFuncUnescape), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) JSFunction(exec, this, m_functionStructure.get(), 1, Identifier(exec, "decodeURI"), globalFuncDecodeURI), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) JSFunction(exec, this, m_functionStructure.get(), 1, Identifier(exec, "decodeURIComponent"), globalFuncDecodeURIComponent), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) JSFunction(exec, this, m_functionStructure.get(), 1, Identifier(exec, "encodeURI"), globalFuncEncodeURI), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) JSFunction(exec, this, m_functionStructure.get(), 1, Identifier(exec, "encodeURIComponent"), globalFuncEncodeURIComponent), DontEnum);
 #ifndef NDEBUG
-    putDirectFunctionWithoutTransition(exec, new (exec) JSFunction(exec, this, d()->functionStructure.get(), 1, Identifier(exec, "jscprint"), globalFuncJSCPrint), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) JSFunction(exec, this, m_functionStructure.get(), 1, Identifier(exec, "jscprint"), globalFuncJSCPrint), DontEnum);
 #endif
 
     resetPrototype(prototype);
@@ -310,7 +310,7 @@ void JSGlobalObject::resetPrototype(JSValue prototype)
     setPrototype(prototype);
 
     JSObject* oldLastInPrototypeChain = lastInPrototypeChain(this);
-    JSObject* objectPrototype = d()->objectPrototype.get();
+    JSObject* objectPrototype = m_objectPrototype.get();
     if (oldLastInPrototypeChain != objectPrototype)
         oldLastInPrototypeChain->setPrototype(objectPrototype);
 }
@@ -318,67 +318,63 @@ void JSGlobalObject::resetPrototype(JSValue prototype)
 void JSGlobalObject::markChildren(MarkStack& markStack)
 {
     JSVariableObject::markChildren(markStack);
-    
-    markIfNeeded(markStack, &d()->globalScopeChain);
-
-    markIfNeeded(markStack, &d()->regExpConstructor);
-    markIfNeeded(markStack, &d()->errorConstructor);
-    markIfNeeded(markStack, &d()->evalErrorConstructor);
-    markIfNeeded(markStack, &d()->rangeErrorConstructor);
-    markIfNeeded(markStack, &d()->referenceErrorConstructor);
-    markIfNeeded(markStack, &d()->syntaxErrorConstructor);
-    markIfNeeded(markStack, &d()->typeErrorConstructor);
-    markIfNeeded(markStack, &d()->URIErrorConstructor);
-
-    markIfNeeded(markStack, &d()->evalFunction);
-    markIfNeeded(markStack, &d()->callFunction);
-    markIfNeeded(markStack, &d()->applyFunction);
-
-    markIfNeeded(markStack, &d()->objectPrototype);
-    markIfNeeded(markStack, &d()->functionPrototype);
-    markIfNeeded(markStack, &d()->arrayPrototype);
-    markIfNeeded(markStack, &d()->booleanPrototype);
-    markIfNeeded(markStack, &d()->stringPrototype);
-    markIfNeeded(markStack, &d()->numberPrototype);
-    markIfNeeded(markStack, &d()->datePrototype);
-    markIfNeeded(markStack, &d()->regExpPrototype);
-
-    markIfNeeded(markStack, &d()->methodCallDummy);
-
-    markIfNeeded(markStack, d()->errorStructure);
-    markIfNeeded(markStack, d()->argumentsStructure);
-    markIfNeeded(markStack, d()->arrayStructure);
-    markIfNeeded(markStack, d()->booleanObjectStructure);
-    markIfNeeded(markStack, d()->callbackConstructorStructure);
-    markIfNeeded(markStack, d()->callbackFunctionStructure);
-    markIfNeeded(markStack, d()->callbackObjectStructure);
-    markIfNeeded(markStack, d()->dateStructure);
-    markIfNeeded(markStack, d()->emptyObjectStructure);
-    markIfNeeded(markStack, d()->errorStructure);
-    markIfNeeded(markStack, d()->functionStructure);
-    markIfNeeded(markStack, d()->numberObjectStructure);
-    markIfNeeded(markStack, d()->regExpMatchesArrayStructure);
-    markIfNeeded(markStack, d()->regExpStructure);
-    markIfNeeded(markStack, d()->stringObjectStructure);
-
-    // No need to mark the other structures, because their prototypes are all
-    // guaranteed to be referenced elsewhere.
-
-    if (d()->registerArray) {
+
+    markIfNeeded(markStack, &m_globalScopeChain);
+    markIfNeeded(markStack, &m_methodCallDummy);
+
+    markIfNeeded(markStack, &m_regExpConstructor);
+    markIfNeeded(markStack, &m_errorConstructor);
+    markIfNeeded(markStack, &m_evalErrorConstructor);
+    markIfNeeded(markStack, &m_rangeErrorConstructor);
+    markIfNeeded(markStack, &m_referenceErrorConstructor);
+    markIfNeeded(markStack, &m_syntaxErrorConstructor);
+    markIfNeeded(markStack, &m_typeErrorConstructor);
+    markIfNeeded(markStack, &m_URIErrorConstructor);
+
+    markIfNeeded(markStack, &m_evalFunction);
+    markIfNeeded(markStack, &m_callFunction);
+    markIfNeeded(markStack, &m_applyFunction);
+
+    markIfNeeded(markStack, &m_objectPrototype);
+    markIfNeeded(markStack, &m_functionPrototype);
+    markIfNeeded(markStack, &m_arrayPrototype);
+    markIfNeeded(markStack, &m_booleanPrototype);
+    markIfNeeded(markStack, &m_stringPrototype);
+    markIfNeeded(markStack, &m_numberPrototype);
+    markIfNeeded(markStack, &m_datePrototype);
+    markIfNeeded(markStack, &m_regExpPrototype);
+
+    markIfNeeded(markStack, m_argumentsStructure);
+    markIfNeeded(markStack, m_arrayStructure);
+    markIfNeeded(markStack, m_booleanObjectStructure);
+    markIfNeeded(markStack, m_callbackConstructorStructure);
+    markIfNeeded(markStack, m_callbackFunctionStructure);
+    markIfNeeded(markStack, m_callbackObjectStructure);
+    markIfNeeded(markStack, m_dateStructure);
+    markIfNeeded(markStack, m_emptyObjectStructure);
+    markIfNeeded(markStack, m_errorStructure);
+    markIfNeeded(markStack, m_functionStructure);
+    markIfNeeded(markStack, m_numberObjectStructure);
+    markIfNeeded(markStack, m_regExpMatchesArrayStructure);
+    markIfNeeded(markStack, m_regExpStructure);
+    markIfNeeded(markStack, m_stringObjectStructure);
+    markIfNeeded(markStack, m_internalFunctionStructure);
+
+    if (m_registerArray) {
         // Outside the execution of global code, when our variables are torn off,
         // we can mark the torn-off array.
-        markStack.appendValues(d()->registerArray.get(), d()->registerArraySize);
-    } else if (d()->registers) {
+        markStack.appendValues(m_registerArray.get(), m_registerArraySize);
+    } else if (m_registers) {
         // During execution of global code, when our variables are in the register file,
         // the symbol table tells us how many variables there are, and registers
         // points to where they end, and the registers used for execution begin.
-        markStack.appendValues(d()->registers - symbolTable().size(), symbolTable().size());
+        markStack.appendValues(m_registers - symbolTable().size(), symbolTable().size());
     }
 }
 
 ExecState* JSGlobalObject::globalExec()
 {
-    return CallFrame::create(d()->globalCallFrame + RegisterFile::CallFrameHeaderSize);
+    return CallFrame::create(m_globalCallFrame + RegisterFile::CallFrameHeaderSize);
 }
 
 bool JSGlobalObject::isDynamicScope(bool&) const
@@ -388,12 +384,12 @@ bool JSGlobalObject::isDynamicScope(bool&) const
 
 void JSGlobalObject::copyGlobalsFrom(RegisterFile& registerFile)
 {
-    ASSERT(!d()->registerArray);
-    ASSERT(!d()->registerArraySize);
+    ASSERT(!m_registerArray);
+    ASSERT(!m_registerArraySize);
 
     int numGlobals = registerFile.numGlobals();
     if (!numGlobals) {
-        d()->registers = 0;
+        m_registers = 0;
         return;
     }
 
@@ -411,24 +407,24 @@ void JSGlobalObject::copyGlobalsTo(RegisterFile& registerFile)
     registerFile.setGlobalObject(this);
     registerFile.setNumGlobals(symbolTable().size());
 
-    if (d()->registerArray) {
+    if (m_registerArray) {
         // The register file is always a gc root so no barrier is needed here
-        memcpy(registerFile.start() - d()->registerArraySize, d()->registerArray.get(), d()->registerArraySize * sizeof(WriteBarrier<Unknown>));
+        memcpy(registerFile.start() - m_registerArraySize, m_registerArray.get(), m_registerArraySize * sizeof(WriteBarrier<Unknown>));
         setRegisters(reinterpret_cast<WriteBarrier<Unknown>*>(registerFile.start()), nullptr, 0);
     }
 }
 
 void JSGlobalObject::resizeRegisters(int oldSize, int newSize)
 {
-    ASSERT(symbolTable().size() == newSize);
+    ASSERT(oldSize <= newSize);
     if (newSize == oldSize)
         return;
     ASSERT(newSize && newSize > oldSize);
-    if (d()->registerArray || !d()->registers) {
-        ASSERT(static_cast<size_t>(oldSize) == d()->registerArraySize);
+    if (m_registerArray || !m_registers) {
+        ASSERT(static_cast<size_t>(oldSize) == m_registerArraySize);
         OwnArrayPtr<WriteBarrier<Unknown> > registerArray = adoptArrayPtr(new WriteBarrier<Unknown>[newSize]);
         for (int i = 0; i < oldSize; i++)
-            registerArray[newSize - oldSize + i].set(globalData(), this, d()->registerArray[i].get());
+            registerArray[newSize - oldSize + i].set(globalData(), this, m_registerArray[i].get());
         WriteBarrier<Unknown>* registers = registerArray.get() + newSize;
         setRegisters(registers, registerArray.release(), newSize);
     } else {
@@ -437,7 +433,7 @@ void JSGlobalObject::resizeRegisters(int oldSize, int newSize)
     }
 
     for (int i = -newSize; i < -oldSize; ++i)
-        d()->registers[i].setUndefined();
+        m_registers[i].setUndefined();
 }
 
 void* JSGlobalObject::operator new(size_t size, JSGlobalData* globalData)
@@ -445,26 +441,21 @@ void* JSGlobalObject::operator new(size_t size, JSGlobalData* globalData)
     return globalData->heap.allocate(size);
 }
 
-void JSGlobalObject::destroyJSGlobalObjectData(void* jsGlobalObjectData)
-{
-    delete static_cast<JSGlobalObjectData*>(jsGlobalObjectData);
-}
-
-DynamicGlobalObjectScope::DynamicGlobalObjectScope(CallFrame* callFrame, JSGlobalObject* dynamicGlobalObject)
-    : m_dynamicGlobalObjectSlot(callFrame->globalData().dynamicGlobalObject)
+DynamicGlobalObjectScope::DynamicGlobalObjectScope(JSGlobalData& globalData, JSGlobalObject* dynamicGlobalObject)
+    : m_dynamicGlobalObjectSlot(globalData.dynamicGlobalObject)
     , m_savedDynamicGlobalObject(m_dynamicGlobalObjectSlot)
 {
     if (!m_dynamicGlobalObjectSlot) {
 #if ENABLE(ASSEMBLER)
         if (ExecutableAllocator::underMemoryPressure())
-            callFrame->globalData().recompileAllJSFunctions();
+            globalData.recompileAllJSFunctions();
 #endif
 
         m_dynamicGlobalObjectSlot = dynamicGlobalObject;
 
         // Reset the date cache between JS invocations to force the VM
         // to observe time zone changes.
-        callFrame->globalData().resetDateCache();
+        globalData.resetDateCache();
     }
 }
 
diff --git a/Source/JavaScriptCore/runtime/JSGlobalObject.h b/Source/JavaScriptCore/runtime/JSGlobalObject.h
index 03b39fc..04f63eb 100644
--- a/Source/JavaScriptCore/runtime/JSGlobalObject.h
+++ b/Source/JavaScriptCore/runtime/JSGlobalObject.h
@@ -28,6 +28,7 @@
 #include "JSWeakObjectMapRefInternal.h"
 #include "NumberPrototype.h"
 #include "StringPrototype.h"
+#include "StructureChain.h"
 #include <wtf/HashSet.h>
 #include <wtf/OwnPtr.h>
 #include <wtf/RandomNumber.h>
@@ -54,92 +55,70 @@ namespace JSC {
     
     class JSGlobalObject : public JSVariableObject {
     protected:
-        using JSVariableObject::JSVariableObjectData;
         typedef HashSet<RefPtr<OpaqueJSWeakObjectMap> > WeakMapSet;
 
-        struct JSGlobalObjectData : public JSVariableObjectData {
-            // We use an explicit destructor function pointer instead of a
-            // virtual destructor because we want to avoid adding a vtable
-            // pointer to this struct. Adding a vtable pointer would force the
-            // compiler to emit costly pointer fixup code when casting from
-            // JSVariableObjectData* to JSGlobalObjectData*.
-            typedef void (*Destructor)(void*);
-
-            JSGlobalObjectData(Destructor destructor)
-                : JSVariableObjectData(&symbolTable, 0)
-                , destructor(destructor)
-                , registerArraySize(0)
-                , globalScopeChain()
-                , weakRandom(static_cast<unsigned>(randomNumber() * (std::numeric_limits<unsigned>::max() + 1.0)))
-            {
-            }
-            
-            Destructor destructor;
-            
-            size_t registerArraySize;
-
-            JSGlobalObject* next;
-            JSGlobalObject* prev;
-
-            Debugger* debugger;
-            
-            WriteBarrier<ScopeChainNode> globalScopeChain;
-            Register globalCallFrame[RegisterFile::CallFrameHeaderSize];
-
-            WriteBarrier<RegExpConstructor> regExpConstructor;
-            WriteBarrier<ErrorConstructor> errorConstructor;
-            WriteBarrier<NativeErrorConstructor> evalErrorConstructor;
-            WriteBarrier<NativeErrorConstructor> rangeErrorConstructor;
-            WriteBarrier<NativeErrorConstructor> referenceErrorConstructor;
-            WriteBarrier<NativeErrorConstructor> syntaxErrorConstructor;
-            WriteBarrier<NativeErrorConstructor> typeErrorConstructor;
-            WriteBarrier<NativeErrorConstructor> URIErrorConstructor;
-
-            WriteBarrier<JSFunction> evalFunction;
-            WriteBarrier<JSFunction> callFunction;
-            WriteBarrier<JSFunction> applyFunction;
-
-            WriteBarrier<ObjectPrototype> objectPrototype;
-            WriteBarrier<FunctionPrototype> functionPrototype;
-            WriteBarrier<ArrayPrototype> arrayPrototype;
-            WriteBarrier<BooleanPrototype> booleanPrototype;
-            WriteBarrier<StringPrototype> stringPrototype;
-            WriteBarrier<NumberPrototype> numberPrototype;
-            WriteBarrier<DatePrototype> datePrototype;
-            WriteBarrier<RegExpPrototype> regExpPrototype;
-
-            WriteBarrier<JSObject> methodCallDummy;
-
-            RefPtr<Structure> argumentsStructure;
-            RefPtr<Structure> arrayStructure;
-            RefPtr<Structure> booleanObjectStructure;
-            RefPtr<Structure> callbackConstructorStructure;
-            RefPtr<Structure> callbackFunctionStructure;
-            RefPtr<Structure> callbackObjectStructure;
-            RefPtr<Structure> dateStructure;
-            RefPtr<Structure> emptyObjectStructure;
-            RefPtr<Structure> errorStructure;
-            RefPtr<Structure> functionStructure;
-            RefPtr<Structure> numberObjectStructure;
-            RefPtr<Structure> regExpMatchesArrayStructure;
-            RefPtr<Structure> regExpStructure;
-            RefPtr<Structure> stringObjectStructure;
-            RefPtr<Structure> internalFunctionStructure;
-
-            SymbolTable symbolTable;
-            unsigned profileGroup;
-
-            RefPtr<JSGlobalData> globalData;
-
-            WeakMapSet weakMaps;
-            WeakRandom weakRandom;
-        };
+        RefPtr<JSGlobalData> m_globalData;
+
+        size_t m_registerArraySize;
+        Register m_globalCallFrame[RegisterFile::CallFrameHeaderSize];
+
+        WriteBarrier<ScopeChainNode> m_globalScopeChain;
+        WriteBarrier<JSObject> m_methodCallDummy;
+
+        WriteBarrier<RegExpConstructor> m_regExpConstructor;
+        WriteBarrier<ErrorConstructor> m_errorConstructor;
+        WriteBarrier<NativeErrorConstructor> m_evalErrorConstructor;
+        WriteBarrier<NativeErrorConstructor> m_rangeErrorConstructor;
+        WriteBarrier<NativeErrorConstructor> m_referenceErrorConstructor;
+        WriteBarrier<NativeErrorConstructor> m_syntaxErrorConstructor;
+        WriteBarrier<NativeErrorConstructor> m_typeErrorConstructor;
+        WriteBarrier<NativeErrorConstructor> m_URIErrorConstructor;
+
+        WriteBarrier<JSFunction> m_evalFunction;
+        WriteBarrier<JSFunction> m_callFunction;
+        WriteBarrier<JSFunction> m_applyFunction;
+
+        WriteBarrier<ObjectPrototype> m_objectPrototype;
+        WriteBarrier<FunctionPrototype> m_functionPrototype;
+        WriteBarrier<ArrayPrototype> m_arrayPrototype;
+        WriteBarrier<BooleanPrototype> m_booleanPrototype;
+        WriteBarrier<StringPrototype> m_stringPrototype;
+        WriteBarrier<NumberPrototype> m_numberPrototype;
+        WriteBarrier<DatePrototype> m_datePrototype;
+        WriteBarrier<RegExpPrototype> m_regExpPrototype;
+
+        RefPtr<Structure> m_argumentsStructure;
+        RefPtr<Structure> m_arrayStructure;
+        RefPtr<Structure> m_booleanObjectStructure;
+        RefPtr<Structure> m_callbackConstructorStructure;
+        RefPtr<Structure> m_callbackFunctionStructure;
+        RefPtr<Structure> m_callbackObjectStructure;
+        RefPtr<Structure> m_dateStructure;
+        RefPtr<Structure> m_emptyObjectStructure;
+        RefPtr<Structure> m_errorStructure;
+        RefPtr<Structure> m_functionStructure;
+        RefPtr<Structure> m_numberObjectStructure;
+        RefPtr<Structure> m_regExpMatchesArrayStructure;
+        RefPtr<Structure> m_regExpStructure;
+        RefPtr<Structure> m_stringObjectStructure;
+        RefPtr<Structure> m_internalFunctionStructure;
+
+        unsigned m_profileGroup;
+        Debugger* m_debugger;
+
+        WeakMapSet m_weakMaps;
+        WeakRandom m_weakRandom;
+
+        SymbolTable m_symbolTable;
 
     public:
         void* operator new(size_t, JSGlobalData*);
         
-        explicit JSGlobalObject()
-            : JSVariableObject(JSGlobalObject::createStructure(jsNull()), new JSGlobalObjectData(destroyJSGlobalObjectData))
+        explicit JSGlobalObject(JSGlobalData& globalData)
+            : JSVariableObject(JSGlobalObject::createStructure(globalData, jsNull()), &m_symbolTable, 0)
+            , m_registerArraySize(0)
+            , m_globalScopeChain()
+            , m_weakRandom(static_cast<unsigned>(randomNumber() * (std::numeric_limits<unsigned>::max() + 1.0)))
         {
             COMPILE_ASSERT(JSGlobalObject::AnonymousSlotCount == 1, JSGlobalObject_has_only_a_single_slot);
             putThisToAnonymousValue(0);
@@ -147,7 +126,10 @@ namespace JSC {
         }
         
         explicit JSGlobalObject(NonNullPassRefPtr<Structure> structure)
-            : JSVariableObject(structure, new JSGlobalObjectData(destroyJSGlobalObjectData))
+            : JSVariableObject(structure, &m_symbolTable, 0)
+            , m_registerArraySize(0)
+            , m_globalScopeChain()
+            , m_weakRandom(static_cast<unsigned>(randomNumber() * (std::numeric_limits<unsigned>::max() + 1.0)))
         {
             COMPILE_ASSERT(JSGlobalObject::AnonymousSlotCount == 1, JSGlobalObject_has_only_a_single_slot);
             putThisToAnonymousValue(0);
@@ -155,8 +137,11 @@ namespace JSC {
         }
 
     protected:
-        JSGlobalObject(NonNullPassRefPtr<Structure> structure, JSGlobalObjectData* data, JSObject* thisValue)
-            : JSVariableObject(structure, data)
+        JSGlobalObject(NonNullPassRefPtr<Structure> structure, JSObject* thisValue)
+            : JSVariableObject(structure, &m_symbolTable, 0)
+            , m_registerArraySize(0)
+            , m_globalScopeChain()
+            , m_weakRandom(static_cast<unsigned>(randomNumber() * (std::numeric_limits<unsigned>::max() + 1.0)))
         {
             COMPILE_ASSERT(JSGlobalObject::AnonymousSlotCount == 1, JSGlobalObject_has_only_a_single_slot);
             putThisToAnonymousValue(0);
@@ -184,55 +169,57 @@ namespace JSC {
         // The following accessors return pristine values, even if a script 
         // replaces the global object's associated property.
 
-        RegExpConstructor* regExpConstructor() const { return d()->regExpConstructor.get(); }
-
-        ErrorConstructor* errorConstructor() const { return d()->errorConstructor.get(); }
-        NativeErrorConstructor* evalErrorConstructor() const { return d()->evalErrorConstructor.get(); }
-        NativeErrorConstructor* rangeErrorConstructor() const { return d()->rangeErrorConstructor.get(); }
-        NativeErrorConstructor* referenceErrorConstructor() const { return d()->referenceErrorConstructor.get(); }
-        NativeErrorConstructor* syntaxErrorConstructor() const { return d()->syntaxErrorConstructor.get(); }
-        NativeErrorConstructor* typeErrorConstructor() const { return d()->typeErrorConstructor.get(); }
-        NativeErrorConstructor* URIErrorConstructor() const { return d()->URIErrorConstructor.get(); }
-
-        JSFunction* evalFunction() const { return d()->evalFunction.get(); }
-
-        ObjectPrototype* objectPrototype() const { return d()->objectPrototype.get(); }
-        FunctionPrototype* functionPrototype() const { return d()->functionPrototype.get(); }
-        ArrayPrototype* arrayPrototype() const { return d()->arrayPrototype.get(); }
-        BooleanPrototype* booleanPrototype() const { return d()->booleanPrototype.get(); }
-        StringPrototype* stringPrototype() const { return d()->stringPrototype.get(); }
-        NumberPrototype* numberPrototype() const { return d()->numberPrototype.get(); }
-        DatePrototype* datePrototype() const { return d()->datePrototype.get(); }
-        RegExpPrototype* regExpPrototype() const { return d()->regExpPrototype.get(); }
-
-        JSObject* methodCallDummy() const { return d()->methodCallDummy.get(); }
-
-        Structure* argumentsStructure() const { return d()->argumentsStructure.get(); }
-        Structure* arrayStructure() const { return d()->arrayStructure.get(); }
-        Structure* booleanObjectStructure() const { return d()->booleanObjectStructure.get(); }
-        Structure* callbackConstructorStructure() const { return d()->callbackConstructorStructure.get(); }
-        Structure* callbackFunctionStructure() const { return d()->callbackFunctionStructure.get(); }
-        Structure* callbackObjectStructure() const { return d()->callbackObjectStructure.get(); }
-        Structure* dateStructure() const { return d()->dateStructure.get(); }
-        Structure* emptyObjectStructure() const { return d()->emptyObjectStructure.get(); }
-        Structure* errorStructure() const { return d()->errorStructure.get(); }
-        Structure* functionStructure() const { return d()->functionStructure.get(); }
-        Structure* numberObjectStructure() const { return d()->numberObjectStructure.get(); }
-        Structure* internalFunctionStructure() const { return d()->internalFunctionStructure.get(); }
-        Structure* regExpMatchesArrayStructure() const { return d()->regExpMatchesArrayStructure.get(); }
-        Structure* regExpStructure() const { return d()->regExpStructure.get(); }
-        Structure* stringObjectStructure() const { return d()->stringObjectStructure.get(); }
-
-        void setProfileGroup(unsigned value) { d()->profileGroup = value; }
-        unsigned profileGroup() const { return d()->profileGroup; }
-
-        Debugger* debugger() const { return d()->debugger; }
-        void setDebugger(Debugger* debugger) { d()->debugger = debugger; }
+        RegExpConstructor* regExpConstructor() const { return m_regExpConstructor.get(); }
+
+        ErrorConstructor* errorConstructor() const { return m_errorConstructor.get(); }
+        NativeErrorConstructor* evalErrorConstructor() const { return m_evalErrorConstructor.get(); }
+        NativeErrorConstructor* rangeErrorConstructor() const { return m_rangeErrorConstructor.get(); }
+        NativeErrorConstructor* referenceErrorConstructor() const { return m_referenceErrorConstructor.get(); }
+        NativeErrorConstructor* syntaxErrorConstructor() const { return m_syntaxErrorConstructor.get(); }
+        NativeErrorConstructor* typeErrorConstructor() const { return m_typeErrorConstructor.get(); }
+        NativeErrorConstructor* URIErrorConstructor() const { return m_URIErrorConstructor.get(); }
+
+        JSFunction* evalFunction() const { return m_evalFunction.get(); }
+        JSFunction* callFunction() const { return m_callFunction.get(); }
+        JSFunction* applyFunction() const { return m_applyFunction.get(); }
+
+        ObjectPrototype* objectPrototype() const { return m_objectPrototype.get(); }
+        FunctionPrototype* functionPrototype() const { return m_functionPrototype.get(); }
+        ArrayPrototype* arrayPrototype() const { return m_arrayPrototype.get(); }
+        BooleanPrototype* booleanPrototype() const { return m_booleanPrototype.get(); }
+        StringPrototype* stringPrototype() const { return m_stringPrototype.get(); }
+        NumberPrototype* numberPrototype() const { return m_numberPrototype.get(); }
+        DatePrototype* datePrototype() const { return m_datePrototype.get(); }
+        RegExpPrototype* regExpPrototype() const { return m_regExpPrototype.get(); }
+
+        JSObject* methodCallDummy() const { return m_methodCallDummy.get(); }
+
+        Structure* argumentsStructure() const { return m_argumentsStructure.get(); }
+        Structure* arrayStructure() const { return m_arrayStructure.get(); }
+        Structure* booleanObjectStructure() const { return m_booleanObjectStructure.get(); }
+        Structure* callbackConstructorStructure() const { return m_callbackConstructorStructure.get(); }
+        Structure* callbackFunctionStructure() const { return m_callbackFunctionStructure.get(); }
+        Structure* callbackObjectStructure() const { return m_callbackObjectStructure.get(); }
+        Structure* dateStructure() const { return m_dateStructure.get(); }
+        Structure* emptyObjectStructure() const { return m_emptyObjectStructure.get(); }
+        Structure* errorStructure() const { return m_errorStructure.get(); }
+        Structure* functionStructure() const { return m_functionStructure.get(); }
+        Structure* numberObjectStructure() const { return m_numberObjectStructure.get(); }
+        Structure* internalFunctionStructure() const { return m_internalFunctionStructure.get(); }
+        Structure* regExpMatchesArrayStructure() const { return m_regExpMatchesArrayStructure.get(); }
+        Structure* regExpStructure() const { return m_regExpStructure.get(); }
+        Structure* stringObjectStructure() const { return m_stringObjectStructure.get(); }
+
+        void setProfileGroup(unsigned value) { m_profileGroup = value; }
+        unsigned profileGroup() const { return m_profileGroup; }
+
+        Debugger* debugger() const { return m_debugger; }
+        void setDebugger(Debugger* debugger) { m_debugger = debugger; }
 
         virtual bool supportsProfiling() const { return false; }
         virtual bool supportsRichSourceInfo() const { return true; }
 
-        ScopeChainNode* globalScopeChain() { return d()->globalScopeChain.get(); }
+        ScopeChainNode* globalScopeChain() { return m_globalScopeChain.get(); }
 
         virtual bool isGlobalObject() const { return true; }
 
@@ -250,25 +237,24 @@ namespace JSC {
 
         void resetPrototype(JSValue prototype);
 
-        JSGlobalData& globalData() const { return *d()->globalData.get(); }
-        JSGlobalObjectData* d() const { return static_cast<JSGlobalObjectData*>(JSVariableObject::d); }
+        JSGlobalData& globalData() const { return *m_globalData.get(); }
 
-        static PassRefPtr<Structure> createStructure(JSValue prototype)
+        static PassRefPtr<Structure> createStructure(JSGlobalData& globalData, JSValue prototype)
         {
-            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
+            return Structure::create(globalData, prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
         }
 
         void registerWeakMap(OpaqueJSWeakObjectMap* map)
         {
-            d()->weakMaps.add(map);
+            m_weakMaps.add(map);
         }
 
         void deregisterWeakMap(OpaqueJSWeakObjectMap* map)
         {
-            d()->weakMaps.remove(map);
+            m_weakMaps.remove(map);
         }
 
-        double weakRandomNumber() { return d()->weakRandom.get(); }
+        double weakRandomNumber() { return m_weakRandom.get(); }
     protected:
 
         static const unsigned AnonymousSlotCount = JSVariableObject::AnonymousSlotCount + 1;
@@ -289,8 +275,6 @@ namespace JSC {
         void addStaticGlobals(GlobalPropertyInfo*, int count);
 
     private:
-        static void destroyJSGlobalObjectData(void*);
-
         // FIXME: Fold reset into init.
         void init(JSObject* thisValue);
         void reset(JSValue prototype);
@@ -311,17 +295,17 @@ namespace JSC {
     inline void JSGlobalObject::setRegisters(WriteBarrier<Unknown>* registers, PassOwnArrayPtr<WriteBarrier<Unknown> > registerArray, size_t count)
     {
         JSVariableObject::setRegisters(registers, registerArray);
-        d()->registerArraySize = count;
+        m_registerArraySize = count;
     }
 
     inline void JSGlobalObject::addStaticGlobals(GlobalPropertyInfo* globals, int count)
     {
-        size_t oldSize = d()->registerArraySize;
+        size_t oldSize = m_registerArraySize;
         size_t newSize = oldSize + count;
         OwnArrayPtr<WriteBarrier<Unknown> > registerArray = adoptArrayPtr(new WriteBarrier<Unknown>[newSize]);
-        if (d()->registerArray) {
+        if (m_registerArray) {
             // memcpy is safe here as we're copying barriers we already own from the existing array
-            memcpy(registerArray.get() + count, d()->registerArray.get(), oldSize * sizeof(Register));
+            memcpy(registerArray.get() + count, m_registerArray.get(), oldSize * sizeof(Register));
         }
 
         WriteBarrier<Unknown>* registers = registerArray.get() + newSize;
@@ -379,7 +363,7 @@ namespace JSC {
         // We cache our prototype chain so our clients can share it.
         if (!isValid(exec, m_cachedPrototypeChain.get())) {
             JSValue prototype = prototypeForLookup(exec);
-            m_cachedPrototypeChain = StructureChain::create(prototype.isNull() ? 0 : asObject(prototype)->structure());
+            m_cachedPrototypeChain = StructureChain::create(exec->globalData(), prototype.isNull() ? 0 : asObject(prototype)->structure());
         }
         return m_cachedPrototypeChain.get();
     }
@@ -451,7 +435,7 @@ namespace JSC {
     class DynamicGlobalObjectScope {
         WTF_MAKE_NONCOPYABLE(DynamicGlobalObjectScope);
     public:
-        DynamicGlobalObjectScope(CallFrame* callFrame, JSGlobalObject* dynamicGlobalObject);
+        DynamicGlobalObjectScope(JSGlobalData&, JSGlobalObject*);
 
         ~DynamicGlobalObjectScope()
         {
diff --git a/Source/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp b/Source/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp
index de1300a..f0da773 100644
--- a/Source/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp
+++ b/Source/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp
@@ -449,12 +449,12 @@ EncodedJSValue JSC_HOST_CALL globalFuncEval(ExecState* exec)
     if (JSValue parsedObject = preparser.tryLiteralParse())
         return JSValue::encode(parsedObject);
 
-    RefPtr<EvalExecutable> eval = EvalExecutable::create(exec, makeSource(s), false);
+    EvalExecutable* eval = EvalExecutable::create(exec, makeSource(s), false);
     JSObject* error = eval->compile(exec, static_cast<JSGlobalObject*>(unwrappedObject)->globalScopeChain());
     if (error)
         return throwVMError(exec, error);
 
-    return JSValue::encode(exec->interpreter()->execute(eval.get(), exec, thisObject, static_cast<JSGlobalObject*>(unwrappedObject)->globalScopeChain()));
+    return JSValue::encode(exec->interpreter()->execute(eval, exec, thisObject, static_cast<JSGlobalObject*>(unwrappedObject)->globalScopeChain()));
 }
 
 EncodedJSValue JSC_HOST_CALL globalFuncParseInt(ExecState* exec)
diff --git a/Source/JavaScriptCore/runtime/JSLock.cpp b/Source/JavaScriptCore/runtime/JSLock.cpp
index 64dcb08..fc543f0 100644
--- a/Source/JavaScriptCore/runtime/JSLock.cpp
+++ b/Source/JavaScriptCore/runtime/JSLock.cpp
@@ -23,6 +23,7 @@
 
 #include "Heap.h"
 #include "CallFrame.h"
+#include "JSObject.h"
 #include "ScopeChain.h"
 
 #if USE(PTHREADS)
diff --git a/Source/JavaScriptCore/runtime/JSNotAnObject.cpp b/Source/JavaScriptCore/runtime/JSNotAnObject.cpp
index e01b401..1115dc0 100644
--- a/Source/JavaScriptCore/runtime/JSNotAnObject.cpp
+++ b/Source/JavaScriptCore/runtime/JSNotAnObject.cpp
@@ -67,7 +67,7 @@ UString JSNotAnObject::toString(ExecState* exec) const
     return "";
 }
 
-JSObject* JSNotAnObject::toObject(ExecState* exec) const
+JSObject* JSNotAnObject::toObject(ExecState* exec, JSGlobalObject*) const
 {
     ASSERT_UNUSED(exec, exec->hadException());
     return const_cast<JSNotAnObject*>(this);
diff --git a/Source/JavaScriptCore/runtime/JSNotAnObject.h b/Source/JavaScriptCore/runtime/JSNotAnObject.h
index 7e70a98..75bca18 100644
--- a/Source/JavaScriptCore/runtime/JSNotAnObject.h
+++ b/Source/JavaScriptCore/runtime/JSNotAnObject.h
@@ -43,9 +43,9 @@ namespace JSC {
         {
         }
 
-        static PassRefPtr<Structure> createStructure(JSValue prototype)
+        static PassRefPtr<Structure> createStructure(JSGlobalData& globalData, JSValue prototype)
         {
-            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
+            return Structure::create(globalData, prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
         }
 
      private:
@@ -58,7 +58,7 @@ namespace JSC {
         virtual bool toBoolean(ExecState*) const;
         virtual double toNumber(ExecState*) const;
         virtual UString toString(ExecState*) const;
-        virtual JSObject* toObject(ExecState*) const;
+        virtual JSObject* toObject(ExecState*, JSGlobalObject*) const;
 
         // JSObject methods
         virtual bool getOwnPropertySlot(ExecState*, const Identifier& propertyName, PropertySlot&);
diff --git a/Source/JavaScriptCore/runtime/JSNumberCell.cpp b/Source/JavaScriptCore/runtime/JSNumberCell.cpp
index 3172cc9..79f2d2a 100644
--- a/Source/JavaScriptCore/runtime/JSNumberCell.cpp
+++ b/Source/JavaScriptCore/runtime/JSNumberCell.cpp
@@ -22,6 +22,7 @@
 
 #include "config.h"
 #include "JSNumberCell.h"
+#include "JSObject.h"
 #include "ScopeChain.h"
 
 // Keep our exported symbols lists happy.
diff --git a/Source/JavaScriptCore/runtime/JSONObject.cpp b/Source/JavaScriptCore/runtime/JSONObject.cpp
index 7d18e08..8fc7ac9 100644
--- a/Source/JavaScriptCore/runtime/JSONObject.cpp
+++ b/Source/JavaScriptCore/runtime/JSONObject.cpp
@@ -32,6 +32,8 @@
 #include "JSArray.h"
 #include "JSGlobalObject.h"
 #include "LiteralParser.h"
+#include "Local.h"
+#include "LocalScope.h"
 #include "Lookup.h"
 #include "PropertyNameArray.h"
 #include "UStringBuilder.h"
@@ -74,24 +76,22 @@ private:
 class Stringifier {
     WTF_MAKE_NONCOPYABLE(Stringifier);
 public:
-    Stringifier(ExecState*, JSValue replacer, JSValue space);
-    ~Stringifier();
-    JSValue stringify(JSValue);
+    Stringifier(ExecState*, const Local<Unknown>& replacer, const Local<Unknown>& space);
+    Local<Unknown> stringify(Handle<Unknown>);
 
     void markAggregate(MarkStack&);
 
 private:
     class Holder {
     public:
-        Holder(JSObject*);
+        Holder(JSGlobalData&, JSObject*);
 
         JSObject* object() const { return m_object.get(); }
-        DeprecatedPtr<JSObject>* objectSlot() { return &m_object; }
 
         bool appendNextProperty(Stringifier&, UStringBuilder&);
 
     private:
-        DeprecatedPtr<JSObject> m_object;
+        Local<JSObject> m_object;
         const bool m_isArray;
         bool m_isJSArray;
         unsigned m_index;
@@ -113,16 +113,14 @@ private:
     void unindent();
     void startNewLine(UStringBuilder&) const;
 
-    Stringifier* const m_nextStringifierToMark;
     ExecState* const m_exec;
-    const JSValue m_replacer;
+    const Local<Unknown> m_replacer;
     bool m_usingArrayReplacer;
     PropertyNameArray m_arrayReplacerPropertyNames;
     CallType m_replacerCallType;
     CallData m_replacerCallData;
     const UString m_gap;
 
-    HashSet<JSObject*> m_holderCycleDetector;
     Vector<Holder, 16> m_holderStack;
     UString m_repeatedGap;
     UString m_indent;
@@ -199,23 +197,20 @@ JSValue PropertyNameForFunctionCall::value(ExecState* exec) const
 
 // ------------------------------ Stringifier --------------------------------
 
-Stringifier::Stringifier(ExecState* exec, JSValue replacer, JSValue space)
-    : m_nextStringifierToMark(exec->globalData().firstStringifierToMark)
-    , m_exec(exec)
+Stringifier::Stringifier(ExecState* exec, const Local<Unknown>& replacer, const Local<Unknown>& space)
+    : m_exec(exec)
     , m_replacer(replacer)
     , m_usingArrayReplacer(false)
     , m_arrayReplacerPropertyNames(exec)
     , m_replacerCallType(CallTypeNone)
-    , m_gap(gap(exec, space))
+    , m_gap(gap(exec, space.get()))
 {
-    exec->globalData().firstStringifierToMark = this;
-
     if (!m_replacer.isObject())
         return;
 
-    if (asObject(m_replacer)->inherits(&JSArray::s_info)) {
+    if (m_replacer.asObject()->inherits(&JSArray::s_info)) {
         m_usingArrayReplacer = true;
-        JSObject* array = asObject(m_replacer);
+        Handle<JSObject> array = m_replacer.asObject();
         unsigned length = array->get(exec, exec->globalData().propertyNames->length).toUInt32(exec);
         for (unsigned i = 0; i < length; ++i) {
             JSValue name = array->get(exec, i);
@@ -246,40 +241,25 @@ Stringifier::Stringifier(ExecState* exec, JSValue replacer, JSValue space)
         return;
     }
 
-    m_replacerCallType = asObject(m_replacer)->getCallData(m_replacerCallData);
-}
-
-Stringifier::~Stringifier()
-{
-    ASSERT(m_exec->globalData().firstStringifierToMark == this);
-    m_exec->globalData().firstStringifierToMark = m_nextStringifierToMark;
-}
-
-void Stringifier::markAggregate(MarkStack& markStack)
-{
-    for (Stringifier* stringifier = this; stringifier; stringifier = stringifier->m_nextStringifierToMark) {
-        size_t size = m_holderStack.size();
-        for (size_t i = 0; i < size; ++i)
-            markStack.append(m_holderStack[i].objectSlot());
-    }
+    m_replacerCallType = m_replacer.asObject()->getCallData(m_replacerCallData);
 }
 
-JSValue Stringifier::stringify(JSValue value)
+Local<Unknown> Stringifier::stringify(Handle<Unknown> value)
 {
     JSObject* object = constructEmptyObject(m_exec);
     if (m_exec->hadException())
-        return jsNull();
+        return Local<Unknown>(m_exec->globalData(), jsNull());
 
     PropertyNameForFunctionCall emptyPropertyName(m_exec->globalData().propertyNames->emptyIdentifier);
-    object->putDirect(m_exec->globalData(), m_exec->globalData().propertyNames->emptyIdentifier, value);
+    object->putDirect(m_exec->globalData(), m_exec->globalData().propertyNames->emptyIdentifier, value.get());
 
     UStringBuilder result;
-    if (appendStringifiedValue(result, value, object, emptyPropertyName) != StringifySucceeded)
-        return jsUndefined();
+    if (appendStringifiedValue(result, value.get(), object, emptyPropertyName) != StringifySucceeded)
+        return Local<Unknown>(m_exec->globalData(), jsUndefined());
     if (m_exec->hadException())
-        return jsNull();
+        return Local<Unknown>(m_exec->globalData(), jsNull());
 
-    return jsString(m_exec, result.toUString());
+    return Local<Unknown>(m_exec->globalData(), jsString(m_exec, result.toUString()));
 }
 
 void Stringifier::appendQuotedString(UStringBuilder& builder, const UString& value)
@@ -372,7 +352,7 @@ Stringifier::StringifyResult Stringifier::appendStringifiedValue(UStringBuilder&
     if (m_replacerCallType != CallTypeNone) {
         JSValue list[] = { propertyName.value(m_exec), value };
         ArgList args(list, WTF_ARRAY_LENGTH(list));
-        value = call(m_exec, m_replacer, m_replacerCallType, m_replacerCallData, holder, args);
+        value = call(m_exec, m_replacer.get(), m_replacerCallType, m_replacerCallData, holder, args);
         if (m_exec->hadException())
             return StringifyFailed;
     }
@@ -425,12 +405,14 @@ Stringifier::StringifyResult Stringifier::appendStringifiedValue(UStringBuilder&
     }
 
     // Handle cycle detection, and put the holder on the stack.
-    if (!m_holderCycleDetector.add(object).second) {
-        throwError(m_exec, createTypeError(m_exec, "JSON.stringify cannot serialize cyclic structures."));
-        return StringifyFailed;
+    for (unsigned i = 0; i < m_holderStack.size(); i++) {
+        if (m_holderStack[i].object() == object) {
+            throwError(m_exec, createTypeError(m_exec, "JSON.stringify cannot serialize cyclic structures."));
+            return StringifyFailed;
+        }
     }
     bool holderStackWasEmpty = m_holderStack.isEmpty();
-    m_holderStack.append(object);
+    m_holderStack.append(Holder(m_exec->globalData(), object));
     if (!holderStackWasEmpty)
         return StringifySucceeded;
 
@@ -450,7 +432,6 @@ Stringifier::StringifyResult Stringifier::appendStringifiedValue(UStringBuilder&
                 tickCount = localTimeoutChecker.ticksUntilNextCheck();
             }
         }
-        m_holderCycleDetector.remove(m_holderStack.last().object());
         m_holderStack.removeLast();
     } while (!m_holderStack.isEmpty());
     return StringifySucceeded;
@@ -485,8 +466,8 @@ inline void Stringifier::startNewLine(UStringBuilder& builder) const
     builder.append(m_indent);
 }
 
-inline Stringifier::Holder::Holder(JSObject* object)
-    : m_object(object)
+inline Stringifier::Holder::Holder(JSGlobalData& globalData, JSObject* object)
+    : m_object(globalData, object)
     , m_isArray(object->inherits(&JSArray::s_info))
     , m_index(0)
 {
@@ -623,16 +604,11 @@ bool JSONObject::getOwnPropertyDescriptor(ExecState* exec, const Identifier& pro
     return getStaticFunctionDescriptor<JSObject>(exec, ExecState::jsonTable(exec), this, propertyName, descriptor);
 }
 
-void JSONObject::markStringifiers(MarkStack& markStack, Stringifier* stringifier)
-{
-    stringifier->markAggregate(markStack);
-}
-
 class Walker {
 public:
-    Walker(ExecState* exec, JSObject* function, CallType callType, CallData callData)
+    Walker(ExecState* exec, Handle<JSObject> function, CallType callType, CallData callData)
         : m_exec(exec)
-        , m_function(function)
+        , m_function(exec->globalData(), function)
         , m_callType(callType)
         , m_callData(callData)
     {
@@ -649,7 +625,7 @@ private:
     friend class Holder;
 
     ExecState* m_exec;
-    DeprecatedPtr<JSObject> m_function;
+    Local<JSObject> m_function;
     CallType m_callType;
     CallData m_callData;
 };
@@ -663,8 +639,8 @@ NEVER_INLINE JSValue Walker::walk(JSValue unfiltered)
 {
     Vector<PropertyNameArray, 16> propertyStack;
     Vector<uint32_t, 16> indexStack;
-    Vector<JSObject*, 16> objectStack;
-    Vector<JSArray*, 16> arrayStack;
+    LocalStack<JSObject, 16> objectStack(m_exec->globalData());
+    LocalStack<JSArray, 16> arrayStack(m_exec->globalData());
     
     Vector<WalkerState, 16> stateStack;
     WalkerState state = StateUnknown;
@@ -684,7 +660,7 @@ NEVER_INLINE JSValue Walker::walk(JSValue unfiltered)
                     return throwError(m_exec, createStackOverflowError(m_exec));
 
                 JSArray* array = asArray(inValue);
-                arrayStack.append(array);
+                arrayStack.push(array);
                 indexStack.append(0);
                 // fallthrough
             }
@@ -696,11 +672,11 @@ NEVER_INLINE JSValue Walker::walk(JSValue unfiltered)
                     tickCount = localTimeoutChecker.ticksUntilNextCheck();
                 }
 
-                JSArray* array = arrayStack.last();
+                JSArray* array = arrayStack.peek();
                 uint32_t index = indexStack.last();
                 if (index == array->length()) {
                     outValue = array;
-                    arrayStack.removeLast();
+                    arrayStack.pop();
                     indexStack.removeLast();
                     break;
                 }
@@ -722,7 +698,7 @@ NEVER_INLINE JSValue Walker::walk(JSValue unfiltered)
                 // fallthrough
             }
             case ArrayEndVisitMember: {
-                JSArray* array = arrayStack.last();
+                JSArray* array = arrayStack.peek();
                 JSValue filteredValue = callReviver(array, jsString(m_exec, UString::number(indexStack.last())), outValue);
                 if (filteredValue.isUndefined())
                     array->deleteProperty(m_exec, indexStack.last());
@@ -745,7 +721,7 @@ NEVER_INLINE JSValue Walker::walk(JSValue unfiltered)
                     return throwError(m_exec, createStackOverflowError(m_exec));
 
                 JSObject* object = asObject(inValue);
-                objectStack.append(object);
+                objectStack.push(object);
                 indexStack.append(0);
                 propertyStack.append(PropertyNameArray(m_exec));
                 object->getOwnPropertyNames(m_exec, propertyStack.last());
@@ -759,12 +735,12 @@ NEVER_INLINE JSValue Walker::walk(JSValue unfiltered)
                     tickCount = localTimeoutChecker.ticksUntilNextCheck();
                 }
 
-                JSObject* object = objectStack.last();
+                JSObject* object = objectStack.peek();
                 uint32_t index = indexStack.last();
                 PropertyNameArray& properties = propertyStack.last();
                 if (index == properties.size()) {
                     outValue = object;
-                    objectStack.removeLast();
+                    objectStack.pop();
                     indexStack.removeLast();
                     propertyStack.removeLast();
                     break;
@@ -787,7 +763,7 @@ NEVER_INLINE JSValue Walker::walk(JSValue unfiltered)
                 // fallthrough
             }
             case ObjectEndVisitMember: {
-                JSObject* object = objectStack.last();
+                JSObject* object = objectStack.peek();
                 Identifier prop = propertyStack.last()[indexStack.last()];
                 PutPropertySlot slot;
                 JSValue filteredValue = callReviver(object, jsString(m_exec, prop.ustring()), outValue);
@@ -838,7 +814,8 @@ EncodedJSValue JSC_HOST_CALL JSONProtoFuncParse(ExecState* exec)
     UString source = value.toString(exec);
     if (exec->hadException())
         return JSValue::encode(jsNull());
-    
+
+    LocalScope scope(exec->globalData());
     LiteralParser jsonParser(exec, source, LiteralParser::StrictJSON);
     JSValue unfiltered = jsonParser.tryLiteralParse();
     if (!unfiltered)
@@ -852,7 +829,7 @@ EncodedJSValue JSC_HOST_CALL JSONProtoFuncParse(ExecState* exec)
     CallType callType = getCallData(function, callData);
     if (callType == CallTypeNone)
         return JSValue::encode(unfiltered);
-    return JSValue::encode(Walker(exec, asObject(function), callType, callData).walk(unfiltered));
+    return JSValue::encode(Walker(exec, Local<JSObject>(exec->globalData(), asObject(function)), callType, callData).walk(unfiltered));
 }
 
 // ECMA-262 v5 15.12.3
@@ -860,15 +837,17 @@ EncodedJSValue JSC_HOST_CALL JSONProtoFuncStringify(ExecState* exec)
 {
     if (!exec->argumentCount())
         return throwVMError(exec, createError(exec, "No input to stringify"));
-    JSValue value = exec->argument(0);
-    JSValue replacer = exec->argument(1);
-    JSValue space = exec->argument(2);
-    return JSValue::encode(Stringifier(exec, replacer, space).stringify(value));
+    LocalScope scope(exec->globalData());
+    Local<Unknown> value(exec->globalData(), exec->argument(0));
+    Local<Unknown> replacer(exec->globalData(), exec->argument(1));
+    Local<Unknown> space(exec->globalData(), exec->argument(2));
+    return JSValue::encode(Stringifier(exec, replacer, space).stringify(value).get());
 }
 
 UString JSONStringify(ExecState* exec, JSValue value, unsigned indent)
 {
-    JSValue result = Stringifier(exec, jsNull(), jsNumber(indent)).stringify(value);
+    LocalScope scope(exec->globalData());
+    Local<Unknown> result = Stringifier(exec, Local<Unknown>(exec->globalData(), jsNull()), Local<Unknown>(exec->globalData(), jsNumber(indent))).stringify(Local<Unknown>(exec->globalData(), value));
     if (result.isUndefinedOrNull())
         return UString();
     return result.getString(exec);
diff --git a/Source/JavaScriptCore/runtime/JSONObject.h b/Source/JavaScriptCore/runtime/JSONObject.h
index acffeca..a52c543 100644
--- a/Source/JavaScriptCore/runtime/JSONObject.h
+++ b/Source/JavaScriptCore/runtime/JSONObject.h
@@ -36,13 +36,11 @@ namespace JSC {
     public:
         JSONObject(JSGlobalObject* globalObject, NonNullPassRefPtr<Structure> structure);
 
-        static PassRefPtr<Structure> createStructure(JSValue prototype)
+        static PassRefPtr<Structure> createStructure(JSGlobalData& globalData, JSValue prototype)
         {
-            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
+            return Structure::create(globalData, prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
         }
 
-        static void markStringifiers(MarkStack&, Stringifier*);
-
     protected:
         static const unsigned StructureFlags = OverridesGetOwnPropertySlot | JSObject::StructureFlags;
 
diff --git a/Source/JavaScriptCore/runtime/JSObject.cpp b/Source/JavaScriptCore/runtime/JSObject.cpp
index 87fbb67..b307540 100644
--- a/Source/JavaScriptCore/runtime/JSObject.cpp
+++ b/Source/JavaScriptCore/runtime/JSObject.cpp
@@ -43,7 +43,7 @@ namespace JSC {
 
 ASSERT_CLASS_FITS_IN_CELL(JSObject);
 ASSERT_CLASS_FITS_IN_CELL(JSNonFinalObject);
-ASSERT_CLASS_FILLS_CELL(JSFinalObject);
+ASSERT_CLASS_FITS_IN_CELL(JSFinalObject);
 
 const char* StrictModeReadonlyPropertyWriteError = "Attempted to assign to readonly property.";
 
@@ -489,7 +489,7 @@ UString JSObject::toString(ExecState* exec) const
     return primitive.toString(exec);
 }
 
-JSObject* JSObject::toObject(ExecState*) const
+JSObject* JSObject::toObject(ExecState*, JSGlobalObject*) const
 {
     return const_cast<JSObject*>(this);
 }
@@ -572,9 +572,9 @@ NEVER_INLINE void JSObject::fillGetterPropertySlot(PropertySlot& slot, WriteBarr
         slot.setUndefined();
 }
 
-Structure* JSObject::createInheritorID()
+Structure* JSObject::createInheritorID(JSGlobalData& globalData)
 {
-    m_inheritorID = createEmptyObjectStructure(this);
+    m_inheritorID = createEmptyObjectStructure(globalData, this);
     return m_inheritorID.get();
 }
 
@@ -743,12 +743,12 @@ bool JSObject::defineOwnProperty(ExecState* exec, const Identifier& propertyName
     // Changing the accessor functions of an existing accessor property
     ASSERT(descriptor.isAccessorDescriptor());
     if (!current.configurable()) {
-        if (descriptor.setterPresent() && !(current.setter() && JSValue::strictEqual(exec, current.setter(), descriptor.setter()))) {
+        if (descriptor.setterPresent() && !(current.setterPresent() && JSValue::strictEqual(exec, current.setter(), descriptor.setter()))) {
             if (throwException)
                 throwError(exec, createTypeError(exec, "Attempting to change the setter of an unconfigurable property."));
             return false;
         }
-        if (descriptor.getterPresent() && !(current.getter() && JSValue::strictEqual(exec, current.getter(), descriptor.getter()))) {
+        if (descriptor.getterPresent() && !(current.getterPresent() && JSValue::strictEqual(exec, current.getter(), descriptor.getter()))) {
             if (throwException)
                 throwError(exec, createTypeError(exec, "Attempting to change the getter of an unconfigurable property."));
             return false;
diff --git a/Source/JavaScriptCore/runtime/JSObject.h b/Source/JavaScriptCore/runtime/JSObject.h
index 2b4db43..578b3cf 100644
--- a/Source/JavaScriptCore/runtime/JSObject.h
+++ b/Source/JavaScriptCore/runtime/JSObject.h
@@ -92,7 +92,7 @@ namespace JSC {
         bool setPrototypeWithCycleCheck(JSValue prototype);
         
         void setStructure(NonNullPassRefPtr<Structure>);
-        Structure* inheritorID();
+        Structure* inheritorID(JSGlobalData&);
 
         virtual UString className() const;
 
@@ -138,7 +138,7 @@ namespace JSC {
         virtual bool toBoolean(ExecState*) const;
         virtual double toNumber(ExecState*) const;
         virtual UString toString(ExecState*) const;
-        virtual JSObject* toObject(ExecState*) const;
+        virtual JSObject* toObject(ExecState*, JSGlobalObject*) const;
 
         virtual JSObject* toThisObject(ExecState*) const;
         virtual JSValue toStrictThisObject(ExecState*) const;
@@ -250,9 +250,9 @@ namespace JSC {
         static JS_EXPORTDATA const ClassInfo s_info;
 
     protected:
-        static PassRefPtr<Structure> createStructure(JSValue prototype)
+        static PassRefPtr<Structure> createStructure(JSGlobalData& globalData, JSValue prototype)
         {
-            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
+            return Structure::create(globalData, prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
         }
 
         static const unsigned StructureFlags = 0;
@@ -296,7 +296,7 @@ namespace JSC {
         bool inlineGetOwnPropertySlot(ExecState*, const Identifier& propertyName, PropertySlot&);
 
         const HashEntry* findPropertyHashEntry(ExecState*, const Identifier& propertyName) const;
-        Structure* createInheritorID();
+        Structure* createInheritorID(JSGlobalData&);
 
         PropertyStorage m_propertyStorage;
         RefPtr<Structure> m_inheritorID;
@@ -320,9 +320,9 @@ COMPILE_ASSERT((JSFinalObject_inlineStorageCapacity >= JSNonFinalObject_inlineSt
         friend class JSObject;
 
     public:
-        static PassRefPtr<Structure> createStructure(JSValue prototype)
+        static PassRefPtr<Structure> createStructure(JSGlobalData& globalData, JSValue prototype)
         {
-            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
+            return Structure::create(globalData, prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
         }
 
     protected:
@@ -348,9 +348,9 @@ COMPILE_ASSERT((JSFinalObject_inlineStorageCapacity >= JSNonFinalObject_inlineSt
             return new (exec) JSFinalObject(structure);
         }
 
-        static PassRefPtr<Structure> createStructure(JSValue prototype)
+        static PassRefPtr<Structure> createStructure(JSGlobalData& globalData, JSValue prototype)
         {
-            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
+            return Structure::create(globalData, prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
         }
 
     private:
@@ -377,9 +377,9 @@ inline JSObject* constructEmptyObject(ExecState* exec, NonNullPassRefPtr<Structu
     return JSFinalObject::create(exec, structure);
 }
 
-inline PassRefPtr<Structure> createEmptyObjectStructure(JSValue prototype)
+inline PassRefPtr<Structure> createEmptyObjectStructure(JSGlobalData& globalData, JSValue prototype)
 {
-    return JSFinalObject::createStructure(prototype);
+    return JSFinalObject::createStructure(globalData, prototype);
 }
 
 inline JSObject* asObject(JSCell* cell)
@@ -442,11 +442,11 @@ inline void JSObject::setStructure(NonNullPassRefPtr<Structure> structure)
     m_structure = structure.leakRef(); // ~JSObject balances this ref()
 }
 
-inline Structure* JSObject::inheritorID()
+inline Structure* JSObject::inheritorID(JSGlobalData& globalData)
 {
     if (m_inheritorID)
         return m_inheritorID.get();
-    return createInheritorID();
+    return createInheritorID(globalData);
 }
 
 inline bool Structure::isUsingInlineStorage() const
@@ -814,8 +814,10 @@ inline void JSValue::put(ExecState* exec, unsigned propertyName, JSValue value)
 ALWAYS_INLINE void JSObject::markChildrenDirect(MarkStack& markStack)
 {
     JSCell::markChildren(markStack);
-
+    
     markStack.append(m_structure->storedPrototypeSlot());
+    if (*m_structure->cachedPrototypeChainSlot())
+        markStack.append(m_structure->cachedPrototypeChainSlot());
     PropertyStorage storage = propertyStorage();
     size_t storageSize = m_structure->propertyStorageSize();
     markStack.appendValues(storage, storageSize);
@@ -840,6 +842,20 @@ inline JSValue JSValue::toStrictThisObject(ExecState* exec) const
     return asObject(asCell())->toStrictThisObject(exec);
 }
 
+ALWAYS_INLINE JSObject* Register::function() const
+{
+    if (!jsValue())
+        return 0;
+    return asObject(jsValue());
+}
+
+ALWAYS_INLINE Register Register::withCallee(JSObject* callee)
+{
+    Register r;
+    r = JSValue(callee);
+    return r;
+}
+
 } // namespace JSC
 
 #endif // JSObject_h
diff --git a/Source/JavaScriptCore/runtime/JSObjectWithGlobalObject.h b/Source/JavaScriptCore/runtime/JSObjectWithGlobalObject.h
index c5e3047..8380514 100644
--- a/Source/JavaScriptCore/runtime/JSObjectWithGlobalObject.h
+++ b/Source/JavaScriptCore/runtime/JSObjectWithGlobalObject.h
@@ -34,9 +34,9 @@ class JSGlobalObject;
 
 class JSObjectWithGlobalObject : public JSNonFinalObject {
 public:
-    static PassRefPtr<Structure> createStructure(JSValue proto)
+    static PassRefPtr<Structure> createStructure(JSGlobalData& globalData, JSValue proto)
     {
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
+        return Structure::create(globalData, proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
     }
 
     JSGlobalObject* globalObject() const;
diff --git a/Source/JavaScriptCore/runtime/JSPropertyNameIterator.cpp b/Source/JavaScriptCore/runtime/JSPropertyNameIterator.cpp
index 0d759cf..6f31f99 100644
--- a/Source/JavaScriptCore/runtime/JSPropertyNameIterator.cpp
+++ b/Source/JavaScriptCore/runtime/JSPropertyNameIterator.cpp
@@ -77,7 +77,7 @@ JSPropertyNameIterator* JSPropertyNameIterator::create(ExecState* exec, JSObject
             return jsPropertyNameIterator;
     }
 
-    jsPropertyNameIterator->setCachedPrototypeChain(structureChain);
+    jsPropertyNameIterator->setCachedPrototypeChain(exec->globalData(), structureChain);
     jsPropertyNameIterator->setCachedStructure(o->structure());
     o->structure()->setEnumerationCache(exec->globalData(), jsPropertyNameIterator);
     return jsPropertyNameIterator;
@@ -86,7 +86,7 @@ JSPropertyNameIterator* JSPropertyNameIterator::create(ExecState* exec, JSObject
 JSValue JSPropertyNameIterator::get(ExecState* exec, JSObject* base, size_t i)
 {
     JSValue identifier = m_jsStrings[i].get();
-    if (m_cachedStructure == base->structure() && m_cachedPrototypeChain == base->structure()->prototypeChain(exec))
+    if (m_cachedStructure == base->structure() && m_cachedPrototypeChain.get() == base->structure()->prototypeChain(exec))
         return identifier;
 
     if (!base->hasProperty(exec, Identifier(exec, asString(identifier)->value(exec))))
@@ -97,6 +97,8 @@ JSValue JSPropertyNameIterator::get(ExecState* exec, JSObject* base, size_t i)
 void JSPropertyNameIterator::markChildren(MarkStack& markStack)
 {
     markStack.appendValues(m_jsStrings.get(), m_jsStringsSize, MayContainNullValues);
+    if (m_cachedPrototypeChain)
+        markStack.append(&m_cachedPrototypeChain);
 }
 
 #if !ASSERT_DISABLED
diff --git a/Source/JavaScriptCore/runtime/JSPropertyNameIterator.h b/Source/JavaScriptCore/runtime/JSPropertyNameIterator.h
index d51cba8..499396c 100644
--- a/Source/JavaScriptCore/runtime/JSPropertyNameIterator.h
+++ b/Source/JavaScriptCore/runtime/JSPropertyNameIterator.h
@@ -45,9 +45,9 @@ namespace JSC {
     public:
         static JSPropertyNameIterator* create(ExecState*, JSObject*);
         
-        static PassRefPtr<Structure> createStructure(JSValue prototype)
+        static PassRefPtr<Structure> createStructure(JSGlobalData& globalData, JSValue prototype)
         {
-            return Structure::create(prototype, TypeInfo(CompoundType, OverridesMarkChildren), AnonymousSlotCount, 0);
+            return Structure::create(globalData, prototype, TypeInfo(CompoundType, OverridesMarkChildren), AnonymousSlotCount, 0);
         }
 
         virtual bool isPropertyNameIterator() const { return true; }
@@ -73,7 +73,7 @@ namespace JSC {
         }
         Structure* cachedStructure() { return m_cachedStructure.get(); }
 
-        void setCachedPrototypeChain(NonNullPassRefPtr<StructureChain> cachedPrototypeChain) { m_cachedPrototypeChain = cachedPrototypeChain; }
+        void setCachedPrototypeChain(JSGlobalData& globalData, StructureChain* cachedPrototypeChain) { m_cachedPrototypeChain.set(globalData, this, cachedPrototypeChain); }
         StructureChain* cachedPrototypeChain() { return m_cachedPrototypeChain.get(); }
 
     private:
@@ -84,7 +84,7 @@ namespace JSC {
 #endif
 
         RefPtr<Structure> m_cachedStructure;
-        RefPtr<StructureChain> m_cachedPrototypeChain;
+        WriteBarrier<StructureChain> m_cachedPrototypeChain;
         uint32_t m_numCacheableSlots;
         uint32_t m_jsStringsSize;
         OwnArrayPtr<WriteBarrier<Unknown> > m_jsStrings;
@@ -106,6 +106,11 @@ namespace JSC {
         return m_enumerationCache.get();
     }
 
+    ALWAYS_INLINE JSPropertyNameIterator* Register::propertyNameIterator() const
+    {
+        return static_cast<JSPropertyNameIterator*>(jsValue().asCell());
+    }
+
 } // namespace JSC
 
 #endif // JSPropertyNameIterator_h
diff --git a/Source/JavaScriptCore/runtime/JSStaticScopeObject.cpp b/Source/JavaScriptCore/runtime/JSStaticScopeObject.cpp
index 727ac28..3d4dc7c 100644
--- a/Source/JavaScriptCore/runtime/JSStaticScopeObject.cpp
+++ b/Source/JavaScriptCore/runtime/JSStaticScopeObject.cpp
@@ -28,13 +28,12 @@
 #include "JSStaticScopeObject.h"
 
 namespace JSC {
-
 ASSERT_CLASS_FITS_IN_CELL(JSStaticScopeObject);
 
 void JSStaticScopeObject::markChildren(MarkStack& markStack)
 {
     JSVariableObject::markChildren(markStack);
-    markStack.deprecatedAppend(&d()->registerStore);
+    markStack.append(&m_registerStore);
 }
 
 JSObject* JSStaticScopeObject::toThisObject(ExecState* exec) const
@@ -68,12 +67,6 @@ bool JSStaticScopeObject::isDynamicScope(bool&) const
     return false;
 }
 
-JSStaticScopeObject::~JSStaticScopeObject()
-{
-    ASSERT(d());
-    delete d();
-}
-
 bool JSStaticScopeObject::getOwnPropertySlot(ExecState*, const Identifier& propertyName, PropertySlot& slot)
 {
     return symbolTableGet(propertyName, slot);
diff --git a/Source/JavaScriptCore/runtime/JSStaticScopeObject.h b/Source/JavaScriptCore/runtime/JSStaticScopeObject.h
index b3c0695..3e19bbc 100644
--- a/Source/JavaScriptCore/runtime/JSStaticScopeObject.h
+++ b/Source/JavaScriptCore/runtime/JSStaticScopeObject.h
@@ -31,25 +31,14 @@
 namespace JSC{
     
     class JSStaticScopeObject : public JSVariableObject {
-    protected:
-        using JSVariableObject::JSVariableObjectData;
-        struct JSStaticScopeObjectData : public JSVariableObjectData {
-            JSStaticScopeObjectData()
-                : JSVariableObjectData(&symbolTable, &registerStore + 1)
-            {
-            }
-            SymbolTable symbolTable;
-            Register registerStore;
-        };
-        
     public:
         JSStaticScopeObject(ExecState* exec, const Identifier& ident, JSValue value, unsigned attributes)
-            : JSVariableObject(exec->globalData().staticScopeStructure, new JSStaticScopeObjectData())
+            : JSVariableObject(exec->globalData().staticScopeStructure, &m_symbolTable, reinterpret_cast<Register*>(&m_registerStore + 1))
         {
-            d()->registerStore = value;
+            m_registerStore.set(exec->globalData(), this, value);
             symbolTable().add(ident.impl(), SymbolTableEntry(-1, attributes));
         }
-        virtual ~JSStaticScopeObject();
+
         virtual void markChildren(MarkStack&);
         bool isDynamicScope(bool& requiresDynamicChecks) const;
         virtual JSObject* toThisObject(ExecState*) const;
@@ -58,13 +47,14 @@ namespace JSC{
         virtual void put(ExecState*, const Identifier&, JSValue, PutPropertySlot&);
         void putWithAttributes(ExecState*, const Identifier&, JSValue, unsigned attributes);
 
-        static PassRefPtr<Structure> createStructure(JSValue proto) { return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info); }
+        static PassRefPtr<Structure> createStructure(JSGlobalData& globalData, JSValue proto) { return Structure::create(globalData, proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info); }
 
     protected:
         static const unsigned StructureFlags = OverridesGetOwnPropertySlot | NeedsThisConversion | OverridesMarkChildren | OverridesGetPropertyNames | JSVariableObject::StructureFlags;
 
     private:
-        JSStaticScopeObjectData* d() { return static_cast<JSStaticScopeObjectData*>(JSVariableObject::d); }
+        SymbolTable m_symbolTable;
+        WriteBarrier<Unknown> m_registerStore;
     };
 
 }
diff --git a/Source/JavaScriptCore/runtime/JSString.cpp b/Source/JavaScriptCore/runtime/JSString.cpp
index 848c431..d9c4d46 100644
--- a/Source/JavaScriptCore/runtime/JSString.cpp
+++ b/Source/JavaScriptCore/runtime/JSString.cpp
@@ -152,7 +152,7 @@ JSString* JSString::substringFromRope(ExecState* exec, unsigned substringStart,
     if (substringLength == 1) {
         ASSERT(substringFiberCount == 1);
         UChar c = substringFibers[0].characters()[0];
-        if (c <= 0xFF)
+        if (c <= maxSingleCharacterString)
             return globalData->smallStrings.singleCharacterString(globalData, c);
     }
     if (substringFiberCount == 1)
@@ -253,19 +253,19 @@ UString JSString::toString(ExecState* exec) const
     return value(exec);
 }
 
-inline StringObject* StringObject::create(ExecState* exec, JSString* string)
+inline StringObject* StringObject::create(ExecState* exec, JSGlobalObject* globalObject, JSString* string)
 {
-    return new (exec) StringObject(exec->globalData(), exec->lexicalGlobalObject()->stringObjectStructure(), string);
+    return new (exec) StringObject(exec->globalData(), globalObject->stringObjectStructure(), string);
 }
 
-JSObject* JSString::toObject(ExecState* exec) const
+JSObject* JSString::toObject(ExecState* exec, JSGlobalObject* globalObject) const
 {
-    return StringObject::create(exec, const_cast<JSString*>(this));
+    return StringObject::create(exec, globalObject, const_cast<JSString*>(this));
 }
 
 JSObject* JSString::toThisObject(ExecState* exec) const
 {
-    return StringObject::create(exec, const_cast<JSString*>(this));
+    return StringObject::create(exec, exec->lexicalGlobalObject(), const_cast<JSString*>(this));
 }
 
 bool JSString::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
diff --git a/Source/JavaScriptCore/runtime/JSString.h b/Source/JavaScriptCore/runtime/JSString.h
index 3672300..9113d4a 100644
--- a/Source/JavaScriptCore/runtime/JSString.h
+++ b/Source/JavaScriptCore/runtime/JSString.h
@@ -349,7 +349,7 @@ namespace JSC {
 
         JSValue replaceCharacter(ExecState*, UChar, const UString& replacement);
 
-        static PassRefPtr<Structure> createStructure(JSValue proto) { return Structure::create(proto, TypeInfo(StringType, OverridesGetOwnPropertySlot | NeedsThisConversion), AnonymousSlotCount, 0); }
+        static PassRefPtr<Structure> createStructure(JSGlobalData& globalData, JSValue proto) { return Structure::create(globalData, proto, TypeInfo(StringType, OverridesGetOwnPropertySlot | NeedsThisConversion), AnonymousSlotCount, 0); }
 
     private:
         enum VPtrStealingHackType { VPtrStealingHack };
@@ -402,7 +402,7 @@ namespace JSC {
         virtual bool getPrimitiveNumber(ExecState*, double& number, JSValue& value);
         virtual bool toBoolean(ExecState*) const;
         virtual double toNumber(ExecState*) const;
-        virtual JSObject* toObject(ExecState*) const;
+        virtual JSObject* toObject(ExecState*, JSGlobalObject*) const;
         virtual UString toString(ExecState*) const;
 
         virtual JSObject* toThisObject(ExecState*) const;
@@ -468,7 +468,7 @@ namespace JSC {
 
     inline JSString* jsSingleCharacterString(JSGlobalData* globalData, UChar c)
     {
-        if (c <= 0xFF)
+        if (c <= maxSingleCharacterString)
             return globalData->smallStrings.singleCharacterString(globalData, c);
         return fixupVPtr(globalData, new (globalData) JSString(globalData, UString(&c, 1)));
     }
@@ -478,7 +478,7 @@ namespace JSC {
         JSGlobalData* globalData = &exec->globalData();
         ASSERT(offset < static_cast<unsigned>(s.length()));
         UChar c = s.characters()[offset];
-        if (c <= 0xFF)
+        if (c <= maxSingleCharacterString)
             return globalData->smallStrings.singleCharacterString(globalData, c);
         return fixupVPtr(globalData, new (globalData) JSString(globalData, UString(StringImpl::create(s.impl(), offset, 1))));
     }
@@ -513,7 +513,7 @@ namespace JSC {
             return globalData->smallStrings.emptyString(globalData);
         if (size == 1) {
             UChar c = s.characters()[0];
-            if (c <= 0xFF)
+            if (c <= maxSingleCharacterString)
                 return globalData->smallStrings.singleCharacterString(globalData, c);
         }
         return fixupVPtr(globalData, new (globalData) JSString(globalData, s));
@@ -521,7 +521,7 @@ namespace JSC {
 
     inline JSString* jsStringWithFinalizer(ExecState* exec, const UString& s, JSStringFinalizerCallback callback, void* context)
     {
-        ASSERT(s.length() && (s.length() > 1 || s.characters()[0] > 0xFF));
+        ASSERT(s.length() && (s.length() > 1 || s.characters()[0] > maxSingleCharacterString));
         JSGlobalData* globalData = &exec->globalData();
         return fixupVPtr(globalData, new (globalData) JSString(globalData, s, callback, context));
     }
@@ -548,7 +548,7 @@ namespace JSC {
             return globalData->smallStrings.emptyString(globalData);
         if (length == 1) {
             UChar c = s.characters()[offset];
-            if (c <= 0xFF)
+            if (c <= maxSingleCharacterString)
                 return globalData->smallStrings.singleCharacterString(globalData, c);
         }
         return fixupVPtr(globalData, new (globalData) JSString(globalData, UString(StringImpl::create(s.impl(), offset, length)), JSString::HasOtherOwner));
@@ -561,7 +561,7 @@ namespace JSC {
             return globalData->smallStrings.emptyString(globalData);
         if (size == 1) {
             UChar c = s.characters()[0];
-            if (c <= 0xFF)
+            if (c <= maxSingleCharacterString)
                 return globalData->smallStrings.singleCharacterString(globalData, c);
         }
         return fixupVPtr(globalData, new (globalData) JSString(globalData, s, JSString::HasOtherOwner));
diff --git a/Source/JavaScriptCore/runtime/JSTypeInfo.h b/Source/JavaScriptCore/runtime/JSTypeInfo.h
index fdcaf31..284d2b2 100644
--- a/Source/JavaScriptCore/runtime/JSTypeInfo.h
+++ b/Source/JavaScriptCore/runtime/JSTypeInfo.h
@@ -46,7 +46,6 @@ namespace JSC {
     static const unsigned IsJSFinalObject = 1 << 8;
 
     class TypeInfo {
-        friend class JIT;
     public:
         TypeInfo(JSType type, unsigned flags = 0)
             : m_type(type)
@@ -72,6 +71,16 @@ namespace JSC {
         unsigned flags() const { return m_flags; }
         unsigned isFinal() const { return m_flags2 && (IsJSFinalObject >> 8); }
 
+        static ptrdiff_t flagsOffset()
+        {
+            return OBJECT_OFFSETOF(TypeInfo, m_flags);
+        }
+
+        static ptrdiff_t typeOffset()
+        {
+            return OBJECT_OFFSETOF(TypeInfo, m_type);
+        }
+
     private:
         unsigned char m_type;
         unsigned char m_flags;
diff --git a/Source/JavaScriptCore/runtime/JSValue.cpp b/Source/JavaScriptCore/runtime/JSValue.cpp
index f4662db..d3ee89e 100644
--- a/Source/JavaScriptCore/runtime/JSValue.cpp
+++ b/Source/JavaScriptCore/runtime/JSValue.cpp
@@ -54,14 +54,14 @@ double JSValue::toIntegerPreserveNaN(ExecState* exec) const
     return trunc(toNumber(exec));
 }
 
-JSObject* JSValue::toObjectSlowCase(ExecState* exec) const
+JSObject* JSValue::toObjectSlowCase(ExecState* exec, JSGlobalObject* globalObject) const
 {
     ASSERT(!isCell());
 
     if (isInt32() || isDouble())
-        return constructNumber(exec, asValue());
+        return constructNumber(exec, globalObject, asValue());
     if (isTrue() || isFalse())
-        return constructBooleanFromImmediateBoolean(exec, asValue());
+        return constructBooleanFromImmediateBoolean(exec, globalObject, asValue());
 
     ASSERT(isUndefinedOrNull());
     throwError(exec, createNotAnObjectError(exec, *this));
@@ -73,9 +73,9 @@ JSObject* JSValue::toThisObjectSlowCase(ExecState* exec) const
     ASSERT(!isCell());
 
     if (isInt32() || isDouble())
-        return constructNumber(exec, asValue());
+        return constructNumber(exec, exec->lexicalGlobalObject(), asValue());
     if (isTrue() || isFalse())
-        return constructBooleanFromImmediateBoolean(exec, asValue());
+        return constructBooleanFromImmediateBoolean(exec, exec->lexicalGlobalObject(), asValue());
     ASSERT(isUndefinedOrNull());
     return exec->globalThisValue();
 }
@@ -84,9 +84,9 @@ JSObject* JSValue::synthesizeObject(ExecState* exec) const
 {
     ASSERT(!isCell());
     if (isNumber())
-        return constructNumber(exec, asValue());
+        return constructNumber(exec, exec->lexicalGlobalObject(), asValue());
     if (isBoolean())
-        return constructBooleanFromImmediateBoolean(exec, asValue());
+        return constructBooleanFromImmediateBoolean(exec, exec->lexicalGlobalObject(), asValue());
 
     ASSERT(isUndefinedOrNull());
     throwError(exec, createNotAnObjectError(exec, *this));
diff --git a/Source/JavaScriptCore/runtime/JSValue.h b/Source/JavaScriptCore/runtime/JSValue.h
index b2e7a51..098123e 100644
--- a/Source/JavaScriptCore/runtime/JSValue.h
+++ b/Source/JavaScriptCore/runtime/JSValue.h
@@ -37,6 +37,7 @@ namespace JSC {
     class Identifier;
     class JSCell;
     class JSGlobalData;
+    class JSGlobalObject;
     class JSImmediate;
     class JSObject;
     class JSString;
@@ -52,11 +53,33 @@ namespace JSC {
 
     enum PreferredPrimitiveType { NoPreference, PreferNumber, PreferString };
 
+
 #if USE(JSVALUE32_64)
     typedef int64_t EncodedJSValue;
 #else
     typedef void* EncodedJSValue;
 #endif
+    
+    union EncodedValueDescriptor {
+        EncodedJSValue asEncodedJSValue;
+#if USE(JSVALUE32_64)
+        double asDouble;
+#elif USE(JSVALUE64)
+        JSCell* ptr;
+#endif
+        
+#if CPU(BIG_ENDIAN)
+        struct {
+            int32_t tag;
+            int32_t payload;
+        } asBits;
+#else
+        struct {
+            int32_t payload;
+            int32_t tag;
+        } asBits;
+#endif
+    };
 
     double nonInlineNaN();
 
@@ -167,6 +190,7 @@ namespace JSC {
         UString toString(ExecState*) const;
         UString toPrimitiveString(ExecState*) const;
         JSObject* toObject(ExecState*) const;
+        JSObject* toObject(ExecState*, JSGlobalObject*) const;
 
         // Integer conversions.
         double toInteger(ExecState*) const;
@@ -222,7 +246,7 @@ namespace JSC {
         JSValue(HashTableDeletedValueTag);
 
         inline const JSValue asValue() const { return *this; }
-        JSObject* toObjectSlowCase(ExecState*) const;
+        JSObject* toObjectSlowCase(ExecState*, JSGlobalObject*) const;
         JSObject* toThisObjectSlowCase(ExecState*) const;
 
         JSObject* synthesizePrototype(ExecState*) const;
@@ -239,28 +263,14 @@ namespace JSC {
         enum { DeletedValueTag = 0xfffffff8 };
         
         enum { LowestTag =  DeletedValueTag };
-        
+
         uint32_t tag() const;
         int32_t payload() const;
 
-        union {
-            EncodedJSValue asEncodedJSValue;
-            double asDouble;
-#if CPU(BIG_ENDIAN)
-            struct {
-                int32_t tag;
-                int32_t payload;
-            } asBits;
-#else
-            struct {
-                int32_t payload;
-                int32_t tag;
-            } asBits;
-#endif
-        } u;
-#else // USE(JSVALUE32_64)
+        EncodedValueDescriptor u;
+#elif USE(JSVALUE64)
         JSCell* m_ptr;
-#endif // USE(JSVALUE32_64)
+#endif
     };
 
 #if USE(JSVALUE32_64)
@@ -392,9 +402,6 @@ namespace JSC {
     {
         JSValue v;
         v.u.asEncodedJSValue = encodedJSValue;
-#if ENABLE(JSC_ZOMBIES)
-        ASSERT(!v.isZombie());
-#endif
         return v;
     }
 
diff --git a/Source/JavaScriptCore/runtime/JSVariableObject.h b/Source/JavaScriptCore/runtime/JSVariableObject.h
index e94d277..891ada8 100644
--- a/Source/JavaScriptCore/runtime/JSVariableObject.h
+++ b/Source/JavaScriptCore/runtime/JSVariableObject.h
@@ -44,7 +44,7 @@ namespace JSC {
         friend class JIT;
 
     public:
-        SymbolTable& symbolTable() const { return *d->symbolTable; }
+        SymbolTable& symbolTable() const { return *m_symbolTable; }
 
         virtual void putWithAttributes(ExecState*, const Identifier&, JSValue, unsigned attributes) = 0;
 
@@ -54,39 +54,24 @@ namespace JSC {
         virtual bool isVariableObject() const;
         virtual bool isDynamicScope(bool& requiresDynamicChecks) const = 0;
 
-        WriteBarrier<Unknown>& registerAt(int index) const { return d->registers[index]; }
+        WriteBarrier<Unknown>& registerAt(int index) const { return m_registers[index]; }
 
-        static PassRefPtr<Structure> createStructure(JSValue prototype)
+        WriteBarrier<Unknown>* const * addressOfRegisters() const { return &m_registers; }
+
+        static PassRefPtr<Structure> createStructure(JSGlobalData& globalData, JSValue prototype)
         {
-            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
+            return Structure::create(globalData, prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
         }
         
     protected:
         static const unsigned StructureFlags = OverridesGetPropertyNames | JSObject::StructureFlags;
-        // Subclasses of JSVariableObject can subclass this struct to add data
-        // without increasing their own size (since there's a hard limit on the
-        // size of a JSCell).
-        struct JSVariableObjectData {
-            JSVariableObjectData(SymbolTable* symbolTable, Register* registers)
-                : symbolTable(symbolTable)
-                , registers(reinterpret_cast<WriteBarrier<Unknown>*>(registers))
-            {
-                ASSERT(symbolTable);
-            }
-
-            SymbolTable* symbolTable; // Maps name -> offset from "r" in register file.
-            WriteBarrier<Unknown>* registers; // "r" in the register file.
-            OwnArrayPtr<WriteBarrier<Unknown> > registerArray; // Independent copy of registers, used when a variable object copies its registers out of the register file.
-
-        private:
-            JSVariableObjectData(const JSVariableObjectData&);
-            JSVariableObjectData& operator=(const JSVariableObjectData&);
-        };
-
-        JSVariableObject(NonNullPassRefPtr<Structure> structure, JSVariableObjectData* data)
+
+        JSVariableObject(NonNullPassRefPtr<Structure> structure, SymbolTable* symbolTable, Register* registers)
             : JSNonFinalObject(structure)
-            , d(data) // Subclass owns this pointer.
+            , m_symbolTable(symbolTable)
+            , m_registers(reinterpret_cast<WriteBarrier<Unknown>*>(registers))
         {
+            ASSERT(m_symbolTable);
             COMPILE_ASSERT(sizeof(WriteBarrier<Unknown>) == sizeof(Register), Register_should_be_same_size_as_WriteBarrier);
         }
 
@@ -99,7 +84,9 @@ namespace JSC {
         bool symbolTablePut(JSGlobalData&, const Identifier&, JSValue);
         bool symbolTablePutWithAttributes(JSGlobalData&, const Identifier&, JSValue, unsigned attributes);
 
-        JSVariableObjectData* d;
+        SymbolTable* m_symbolTable; // Maps name -> offset from "r" in register file.
+        WriteBarrier<Unknown>* m_registers; // "r" in the register file.
+        OwnArrayPtr<WriteBarrier<Unknown> > m_registerArray; // Independent copy of registers, used when a variable object copies its registers out of the register file.
     };
 
     inline bool JSVariableObject::symbolTableGet(const Identifier& propertyName, PropertySlot& slot)
@@ -161,9 +148,9 @@ namespace JSC {
 
     inline void JSVariableObject::setRegisters(WriteBarrier<Unknown>* registers, PassOwnArrayPtr<WriteBarrier<Unknown> > registerArray)
     {
-        ASSERT(registerArray != d->registerArray);
-        d->registerArray = registerArray;
-        d->registers = registers;
+        ASSERT(registerArray != m_registerArray);
+        m_registerArray = registerArray;
+        m_registers = registers;
     }
 
 } // namespace JSC
diff --git a/Source/JavaScriptCore/runtime/JSWrapperObject.h b/Source/JavaScriptCore/runtime/JSWrapperObject.h
index 6d586df..63833e9 100644
--- a/Source/JavaScriptCore/runtime/JSWrapperObject.h
+++ b/Source/JavaScriptCore/runtime/JSWrapperObject.h
@@ -30,19 +30,19 @@ namespace JSC {
     // Number, Boolean and Date which are wrappers for primitive types.
     class JSWrapperObject : public JSNonFinalObject {
     protected:
-        explicit JSWrapperObject(JSGlobalData&, NonNullPassRefPtr<Structure>);
+        explicit JSWrapperObject(NonNullPassRefPtr<Structure>);
 
     public:
-        JSValue internalValue() const { return m_internalValue.get(); }
+        JSValue internalValue() const;
         void setInternalValue(JSGlobalData&, JSValue);
 
-        static PassRefPtr<Structure> createStructure(JSValue prototype) 
+        static PassRefPtr<Structure> createStructure(JSGlobalData& globalData, JSValue prototype) 
         { 
-            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
+            return Structure::create(globalData, prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
         }
 
     protected:
-        static const unsigned AnonymousSlotCount = 1 + JSObject::AnonymousSlotCount;
+        static const unsigned StructureFlags = OverridesMarkChildren | JSNonFinalObject::StructureFlags;
 
     private:
         virtual void markChildren(MarkStack&);
@@ -50,10 +50,14 @@ namespace JSC {
         WriteBarrier<Unknown> m_internalValue;
     };
 
-    inline JSWrapperObject::JSWrapperObject(JSGlobalData& globalData, NonNullPassRefPtr<Structure> structure)
+    inline JSWrapperObject::JSWrapperObject(NonNullPassRefPtr<Structure> structure)
         : JSNonFinalObject(structure)
     {
-        putAnonymousValue(globalData, 0, jsNull());
+    }
+
+    inline JSValue JSWrapperObject::internalValue() const
+    {
+        return m_internalValue.get();
     }
 
     inline void JSWrapperObject::setInternalValue(JSGlobalData& globalData, JSValue value)
@@ -61,7 +65,6 @@ namespace JSC {
         ASSERT(value);
         ASSERT(!value.isObject());
         m_internalValue.set(globalData, this, value);
-        putAnonymousValue(globalData, 0, value);
     }
 
 } // namespace JSC
diff --git a/Source/JavaScriptCore/runtime/JSZombie.cpp b/Source/JavaScriptCore/runtime/JSZombie.cpp
index c0c5f11..23cf135 100644
--- a/Source/JavaScriptCore/runtime/JSZombie.cpp
+++ b/Source/JavaScriptCore/runtime/JSZombie.cpp
@@ -26,6 +26,7 @@
 #include "config.h"
 #include "JSZombie.h"
 #include "ClassInfo.h"
+#include "JSObject.h"
 #include "ScopeChain.h"
 
 #if ENABLE(JSC_ZOMBIES)
@@ -38,7 +39,7 @@ Structure* JSZombie::leakedZombieStructure() {
     static Structure* structure = 0;
     if (!structure) {
         Structure::startIgnoringLeaks();
-        structure = Structure::create(jsNull(), TypeInfo(UnspecifiedType), 0, &info).leakRef();
+        structure = Structure::create(jsNull(), TypeInfo(UnspecifiedType), 0, &s_info).leakRef();
         Structure::stopIgnoringLeaks();
     }
     return structure;
diff --git a/Source/JavaScriptCore/runtime/JSZombie.h b/Source/JavaScriptCore/runtime/JSZombie.h
index 5fe6b6d..179ff53 100644
--- a/Source/JavaScriptCore/runtime/JSZombie.h
+++ b/Source/JavaScriptCore/runtime/JSZombie.h
@@ -66,9 +66,9 @@ public:
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&) { ASSERT_NOT_REACHED(); return false; }
     virtual bool getOwnPropertySlot(ExecState*, unsigned, PropertySlot&) { ASSERT_NOT_REACHED(); return false; }
     
-    static PassRefPtr<Structure> createStructure(JSValue prototype)
+    static PassRefPtr<Structure> createStructure(JSGlobalData& globalData, JSValue prototype)
     {
-        return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
+        return Structure::create(globalData, prototype, TypeInfo(ObjectType, 0), AnonymousSlotCount, &s_info);
     }
 
     static const ClassInfo s_info;
diff --git a/Source/JavaScriptCore/runtime/MachineStackMarker.cpp b/Source/JavaScriptCore/runtime/MachineStackMarker.cpp
index 4614a7c..3e205a1 100644
--- a/Source/JavaScriptCore/runtime/MachineStackMarker.cpp
+++ b/Source/JavaScriptCore/runtime/MachineStackMarker.cpp
@@ -28,6 +28,11 @@
 #include "JSGlobalData.h"
 #include <setjmp.h>
 #include <stdlib.h>
+#include <wtf/StdLibExtras.h>
+
+#if USE(PTHREAD_BASED_QT) && !defined(WTF_USE_PTHREADS)
+#define WTF_USE_PTHREADS 1
+#endif
 
 #if OS(DARWIN)
 
@@ -74,12 +79,14 @@
 #if USE(PTHREADS) && !OS(WINDOWS) && !OS(DARWIN)
 #include <signal.h>
 #ifndef SA_RESTART
-#error MachineStackMarker requires SA_RESTART
+#error MachineThreads requires SA_RESTART
 #endif
 #endif
 
 #endif
 
+using namespace WTF;
+
 namespace JSC {
 
 static inline void swapIfBackwards(void*& begin, void*& end)
@@ -113,7 +120,7 @@ static void pthreadSignalHandlerSuspendResume(int signo)
 }
 #endif
 
-class MachineStackMarker::Thread {
+class MachineThreads::Thread {
 public:
     Thread(pthread_t pthread, const PlatformThread& platThread, void* base) 
         : posixThread(pthread)
@@ -142,20 +149,20 @@ public:
 
 #endif
 
-MachineStackMarker::MachineStackMarker(Heap* heap)
+MachineThreads::MachineThreads(Heap* heap)
     : m_heap(heap)
 #if ENABLE(JSC_MULTIPLE_THREADS)
     , m_registeredThreads(0)
-    , m_currentThreadRegistrar(0)
+    , m_threadSpecific(0)
 #endif
 {
 }
 
-MachineStackMarker::~MachineStackMarker()
+MachineThreads::~MachineThreads()
 {
 #if ENABLE(JSC_MULTIPLE_THREADS)
-    if (m_currentThreadRegistrar) {
-        int error = pthread_key_delete(m_currentThreadRegistrar);
+    if (m_threadSpecific) {
+        int error = pthread_key_delete(m_threadSpecific);
         ASSERT_UNUSED(error, !error);
     }
 
@@ -181,24 +188,24 @@ static inline PlatformThread getCurrentPlatformThread()
 #endif
 }
 
-void MachineStackMarker::makeUsableFromMultipleThreads()
+void MachineThreads::makeUsableFromMultipleThreads()
 {
-    if (m_currentThreadRegistrar)
+    if (m_threadSpecific)
         return;
 
-    int error = pthread_key_create(&m_currentThreadRegistrar, unregisterThread);
+    int error = pthread_key_create(&m_threadSpecific, removeThread);
     if (error)
         CRASH();
 }
 
-void MachineStackMarker::registerThread()
+void MachineThreads::addCurrentThread()
 {
     ASSERT(!m_heap->globalData()->exclusiveThread || m_heap->globalData()->exclusiveThread == currentThread());
 
-    if (!m_currentThreadRegistrar || pthread_getspecific(m_currentThreadRegistrar))
+    if (!m_threadSpecific || pthread_getspecific(m_threadSpecific))
         return;
 
-    pthread_setspecific(m_currentThreadRegistrar, this);
+    pthread_setspecific(m_threadSpecific, this);
     Thread* thread = new Thread(pthread_self(), getCurrentPlatformThread(), m_heap->globalData()->stack().origin());
 
     MutexLocker lock(m_registeredThreadsMutex);
@@ -207,13 +214,13 @@ void MachineStackMarker::registerThread()
     m_registeredThreads = thread;
 }
 
-void MachineStackMarker::unregisterThread(void* p)
+void MachineThreads::removeThread(void* p)
 {
     if (p)
-        static_cast<MachineStackMarker*>(p)->unregisterThread();
+        static_cast<MachineThreads*>(p)->removeCurrentThread();
 }
 
-void MachineStackMarker::unregisterThread()
+void MachineThreads::removeCurrentThread()
 {
     pthread_t currentPosixThread = pthread_self();
 
@@ -240,21 +247,13 @@ void MachineStackMarker::unregisterThread()
 
 #endif
 
-void NEVER_INLINE MachineStackMarker::markCurrentThreadConservativelyInternal(ConservativeSet& conservativeSet)
-{
-    void* begin = m_heap->globalData()->stack().current();
-    void* end = m_heap->globalData()->stack().origin();
-    swapIfBackwards(begin, end);
-    conservativeSet.add(begin, end);
-}
-
 #if COMPILER(GCC)
 #define REGISTER_BUFFER_ALIGNMENT __attribute__ ((aligned (sizeof(void*))))
 #else
 #define REGISTER_BUFFER_ALIGNMENT
 #endif
 
-void MachineStackMarker::markCurrentThreadConservatively(ConservativeSet& conservativeSet)
+void MachineThreads::gatherFromCurrentThread(ConservativeRoots& conservativeRoots, void* stackCurrent)
 {
     // setjmp forces volatile registers onto the stack
     jmp_buf registers REGISTER_BUFFER_ALIGNMENT;
@@ -267,7 +266,15 @@ void MachineStackMarker::markCurrentThreadConservatively(ConservativeSet& conser
 #pragma warning(pop)
 #endif
 
-    markCurrentThreadConservativelyInternal(conservativeSet);
+    void* registersBegin = &registers;
+    void* registersEnd = reinterpret_cast<void*>(roundUpToMultipleOf<sizeof(void*)>(reinterpret_cast<uintptr_t>(&registers + 1)));
+    swapIfBackwards(registersBegin, registersEnd);
+    conservativeRoots.add(registersBegin, registersEnd);
+
+    void* stackBegin = stackCurrent;
+    void* stackEnd = m_heap->globalData()->stack().origin();
+    swapIfBackwards(stackBegin, stackEnd);
+    conservativeRoots.add(stackBegin, stackEnd);
 }
 
 #if ENABLE(JSC_MULTIPLE_THREADS)
@@ -431,20 +438,19 @@ static void freePlatformThreadRegisters(PlatformThreadRegisters& regs)
 #endif
 }
 
-void MachineStackMarker::markOtherThreadConservatively(ConservativeSet& conservativeSet, Thread* thread)
+void MachineThreads::gatherFromOtherThread(ConservativeRoots& conservativeRoots, Thread* thread)
 {
     suspendThread(thread->platformThread);
 
     PlatformThreadRegisters regs;
     size_t regSize = getPlatformThreadRegisters(thread->platformThread, regs);
 
-    // mark the thread's registers
-    conservativeSet.add(static_cast<void*>(&regs), static_cast<void*>(reinterpret_cast<char*>(&regs) + regSize));
+    conservativeRoots.add(static_cast<void*>(&regs), static_cast<void*>(reinterpret_cast<char*>(&regs) + regSize));
 
     void* stackPointer = otherThreadStackPointer(regs);
     void* stackBase = thread->stackBase;
     swapIfBackwards(stackPointer, stackBase);
-    conservativeSet.add(stackPointer, stackBase);
+    conservativeRoots.add(stackPointer, stackBase);
 
     resumeThread(thread->platformThread);
 
@@ -453,27 +459,27 @@ void MachineStackMarker::markOtherThreadConservatively(ConservativeSet& conserva
 
 #endif
 
-void MachineStackMarker::markMachineStackConservatively(ConservativeSet& conservativeSet)
+void MachineThreads::gatherConservativeRoots(ConservativeRoots& conservativeRoots, void* stackCurrent)
 {
-    markCurrentThreadConservatively(conservativeSet);
+    gatherFromCurrentThread(conservativeRoots, stackCurrent);
 
 #if ENABLE(JSC_MULTIPLE_THREADS)
 
-    if (m_currentThreadRegistrar) {
+    if (m_threadSpecific) {
 
         MutexLocker lock(m_registeredThreadsMutex);
 
 #ifndef NDEBUG
-        // Forbid malloc during the mark phase. Marking a thread suspends it, so 
-        // a malloc inside markChildren() would risk a deadlock with a thread that had been 
-        // suspended while holding the malloc lock.
+        // Forbid malloc during the gather phase. The gather phase suspends
+        // threads, so a malloc during gather would risk a deadlock with a
+        // thread that had been suspended while holding the malloc lock.
         fastMallocForbid();
 #endif
         // It is safe to access the registeredThreads list, because we earlier asserted that locks are being held,
         // and since this is a shared heap, they are real locks.
         for (Thread* thread = m_registeredThreads; thread; thread = thread->next) {
             if (!pthread_equal(thread->posixThread, pthread_self()))
-                markOtherThreadConservatively(conservativeSet, thread);
+                gatherFromOtherThread(conservativeRoots, thread);
         }
 #ifndef NDEBUG
         fastMallocAllow();
diff --git a/Source/JavaScriptCore/runtime/MachineStackMarker.h b/Source/JavaScriptCore/runtime/MachineStackMarker.h
index 8afdb46..c814ac5 100644
--- a/Source/JavaScriptCore/runtime/MachineStackMarker.h
+++ b/Source/JavaScriptCore/runtime/MachineStackMarker.h
@@ -19,8 +19,8 @@
  *
  */
 
-#ifndef MachineStackMarker_h
-#define MachineStackMarker_h
+#ifndef MachineThreads_h
+#define MachineThreads_h
 
 #include <wtf/Noncopyable.h>
 #include <wtf/ThreadingPrimitives.h>
@@ -32,32 +32,31 @@
 namespace JSC {
 
     class Heap;
-    class ConservativeSet;
+    class ConservativeRoots;
 
-    class MachineStackMarker {
-        WTF_MAKE_NONCOPYABLE(MachineStackMarker);
+    class MachineThreads {
+        WTF_MAKE_NONCOPYABLE(MachineThreads);
     public:
-        MachineStackMarker(Heap*);
-        ~MachineStackMarker();
+        MachineThreads(Heap*);
+        ~MachineThreads();
 
-        void markMachineStackConservatively(ConservativeSet&);
+        void gatherConservativeRoots(ConservativeRoots&, void* stackCurrent);
 
 #if ENABLE(JSC_MULTIPLE_THREADS)
         void makeUsableFromMultipleThreads();
-        void registerThread(); // Only needs to be called by clients that can use the same heap from multiple threads.
+        void addCurrentThread(); // Only needs to be called by clients that can use the same heap from multiple threads.
 #endif
 
     private:
-        void markCurrentThreadConservatively(ConservativeSet&);
-        void markCurrentThreadConservativelyInternal(ConservativeSet&);
+        void gatherFromCurrentThread(ConservativeRoots&, void* stackCurrent);
 
 #if ENABLE(JSC_MULTIPLE_THREADS)
         class Thread;
 
-        static void unregisterThread(void*);
+        static void removeThread(void*);
+        void removeCurrentThread();
 
-        void unregisterThread();
-        void markOtherThreadConservatively(ConservativeSet&, Thread*);
+        void gatherFromOtherThread(ConservativeRoots&, Thread*);
 #endif
 
         Heap* m_heap;
@@ -65,10 +64,10 @@ namespace JSC {
 #if ENABLE(JSC_MULTIPLE_THREADS)
         Mutex m_registeredThreadsMutex;
         Thread* m_registeredThreads;
-        pthread_key_t m_currentThreadRegistrar;
+        pthread_key_t m_threadSpecific;
 #endif
     };
 
 } // namespace JSC
 
-#endif // MachineStackMarker_h
+#endif // MachineThreads_h
diff --git a/Source/JavaScriptCore/runtime/MarkStack.cpp b/Source/JavaScriptCore/runtime/MarkStack.cpp
index a350c35..e9d1b13 100644
--- a/Source/JavaScriptCore/runtime/MarkStack.cpp
+++ b/Source/JavaScriptCore/runtime/MarkStack.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2009, 2011 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -26,6 +26,14 @@
 #include "config.h"
 #include "MarkStack.h"
 
+#include "ConservativeSet.h"
+#include "Heap.h"
+#include "JSArray.h"
+#include "JSCell.h"
+#include "JSObject.h"
+#include "ScopeChain.h"
+#include "Structure.h"
+
 namespace JSC {
 
 size_t MarkStack::s_pageSize = 0;
@@ -37,4 +45,83 @@ void MarkStack::compact()
     m_markSets.shrinkAllocation(s_pageSize);
 }
 
+void MarkStack::append(ConservativeRoots& conservativeRoots)
+{
+    JSCell** roots = conservativeRoots.roots();
+    size_t size = conservativeRoots.size();
+    for (size_t i = 0; i < size; ++i)
+        internalAppend(roots[i]);
 }
+
+inline void MarkStack::markChildren(JSCell* cell)
+{
+    ASSERT(Heap::isMarked(cell));
+    if (!cell->structure()->typeInfo().overridesMarkChildren()) {
+#ifdef NDEBUG
+        asObject(cell)->markChildrenDirect(*this);
+#else
+        ASSERT(!m_isCheckingForDefaultMarkViolation);
+        m_isCheckingForDefaultMarkViolation = true;
+        cell->markChildren(*this);
+        ASSERT(m_isCheckingForDefaultMarkViolation);
+        m_isCheckingForDefaultMarkViolation = false;
+#endif
+        return;
+    }
+    if (cell->vptr() == m_jsArrayVPtr) {
+        asArray(cell)->markChildrenDirect(*this);
+        return;
+    }
+    cell->markChildren(*this);
+}
+
+void MarkStack::drain()
+{
+#if !ASSERT_DISABLED
+    ASSERT(!m_isDraining);
+    m_isDraining = true;
+#endif
+    while (!m_markSets.isEmpty() || !m_values.isEmpty()) {
+        while (!m_markSets.isEmpty() && m_values.size() < 50) {
+            ASSERT(!m_markSets.isEmpty());
+            MarkSet& current = m_markSets.last();
+            ASSERT(current.m_values);
+            JSValue* end = current.m_end;
+            ASSERT(current.m_values);
+            ASSERT(current.m_values != end);
+        findNextUnmarkedNullValue:
+            ASSERT(current.m_values != end);
+            JSValue value = *current.m_values;
+            current.m_values++;
+
+            JSCell* cell;
+            if (!value || !value.isCell() || Heap::testAndSetMarked(cell = value.asCell())) {
+                if (current.m_values == end) {
+                    m_markSets.removeLast();
+                    continue;
+                }
+                goto findNextUnmarkedNullValue;
+            }
+
+            if (cell->structure()->typeInfo().type() < CompoundType) {
+                if (current.m_values == end) {
+                    m_markSets.removeLast();
+                    continue;
+                }
+                goto findNextUnmarkedNullValue;
+            }
+
+            if (current.m_values == end)
+                m_markSets.removeLast();
+
+            markChildren(cell);
+        }
+        while (!m_values.isEmpty())
+            markChildren(m_values.removeLast());
+    }
+#if !ASSERT_DISABLED
+    m_isDraining = false;
+#endif
+}
+
+} // namespace JSC
diff --git a/Source/JavaScriptCore/runtime/MarkStack.h b/Source/JavaScriptCore/runtime/MarkStack.h
index 0b7941e..7131917 100644
--- a/Source/JavaScriptCore/runtime/MarkStack.h
+++ b/Source/JavaScriptCore/runtime/MarkStack.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2009, 2011 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -27,6 +27,7 @@
 #define MarkStack_h
 
 #include "JSValue.h"
+#include "Register.h"
 #include "WriteBarrier.h"
 #include <wtf/Vector.h>
 #include <wtf/Noncopyable.h>
@@ -34,6 +35,7 @@
 
 namespace JSC {
 
+    class ConservativeRoots;
     class JSGlobalData;
     class Register;
     
@@ -50,7 +52,13 @@ namespace JSC {
 #endif
         {
         }
-        
+
+        ~MarkStack()
+        {
+            ASSERT(m_markSets.isEmpty());
+            ASSERT(m_values.isEmpty());
+        }
+
         void deprecatedAppend(JSValue*);
         void deprecatedAppend(JSCell**);
         void deprecatedAppend(Register*);
@@ -70,17 +78,18 @@ namespace JSC {
             if (count)
                 m_markSets.append(MarkSet(values, values + count, properties));
         }
+        
+        void append(ConservativeRoots&);
 
-        inline void drain();
+        void drain();
         void compact();
 
-        ~MarkStack()
-        {
-            ASSERT(m_markSets.isEmpty());
-            ASSERT(m_values.isEmpty());
-        }
-
     private:
+        friend class HeapRootMarker; // Allowed to mark a JSValue* or JSCell** directly.
+        void append(JSValue*);
+        void append(JSValue*, size_t count);
+        void append(JSCell**);
+
         void internalAppend(JSCell*);
         void internalAppend(JSValue);
         void markChildren(JSCell*);
@@ -196,7 +205,105 @@ namespace JSC {
         bool m_isDraining;
 #endif
     };
+
+    inline void MarkStack::append(JSValue* slot, size_t count)
+    {
+        if (!count)
+            return;
+        m_markSets.append(MarkSet(slot, slot + count, NoNullValues));
+    }
+
+    template <typename T> inline void MarkStack::append(DeprecatedPtr<T>* slot)
+    {
+        internalAppend(*slot->slot());
+    }
     
-}
+    template <typename T> inline void MarkStack::append(WriteBarrierBase<T>* slot)
+    {
+        internalAppend(*slot->slot());
+    }
+
+    ALWAYS_INLINE void MarkStack::deprecatedAppend(JSCell** value)
+    {
+        ASSERT(value);
+        internalAppend(*value);
+    }
+
+    ALWAYS_INLINE void MarkStack::deprecatedAppend(JSValue* value)
+    {
+        ASSERT(value);
+        internalAppend(*value);
+    }
+    
+    ALWAYS_INLINE void MarkStack::append(JSValue* value)
+    {
+        ASSERT(value);
+        internalAppend(*value);
+    }
+
+    ALWAYS_INLINE void MarkStack::append(JSCell** value)
+    {
+        ASSERT(value);
+        internalAppend(*value);
+    }
+
+    ALWAYS_INLINE void MarkStack::deprecatedAppend(Register* value)
+    {
+        ASSERT(value);
+        internalAppend(value->jsValue());
+    }
+
+    ALWAYS_INLINE void MarkStack::internalAppend(JSValue value)
+    {
+        ASSERT(value);
+        if (value.isCell())
+            internalAppend(value.asCell());
+    }
+
+    // Privileged class for marking JSValues directly. It is only safe to use
+    // this class to mark direct heap roots that are marked during every GC pass.
+    // All other references should be wrapped in WriteBarriers and marked through
+    // the MarkStack.
+    class HeapRootMarker {
+    private:
+        friend class Heap;
+        HeapRootMarker(MarkStack&);
+        
+    public:
+        void mark(JSValue*);
+        void mark(JSValue*, size_t);
+        void mark(JSString**);
+        void mark(JSCell**);
+
+    private:
+        MarkStack& m_markStack;
+    };
+
+    inline HeapRootMarker::HeapRootMarker(MarkStack& markStack)
+        : m_markStack(markStack)
+    {
+    }
+
+    inline void HeapRootMarker::mark(JSValue* slot)
+    {
+        m_markStack.append(slot);
+    }
+
+    inline void HeapRootMarker::mark(JSValue* slot, size_t count)
+    {
+        m_markStack.append(slot, count);
+    }
+
+    inline void HeapRootMarker::mark(JSString** slot)
+    {
+        m_markStack.append(reinterpret_cast<JSCell**>(slot));
+    }
+
+    inline void HeapRootMarker::mark(JSCell** slot)
+    {
+        m_markStack.append(slot);
+    }
+
+} // namespace JSC
 
 #endif
diff --git a/Source/JavaScriptCore/runtime/MarkedBlock.cpp b/Source/JavaScriptCore/runtime/MarkedBlock.cpp
index 48dda4c..cae701f 100644
--- a/Source/JavaScriptCore/runtime/MarkedBlock.cpp
+++ b/Source/JavaScriptCore/runtime/MarkedBlock.cpp
@@ -27,6 +27,8 @@
 #include "MarkedBlock.h"
 
 #include "JSCell.h"
+#include "JSObject.h"
+#include "JSZombie.h"
 #include "ScopeChain.h"
 
 namespace JSC {
diff --git a/Source/JavaScriptCore/runtime/MarkedBlock.h b/Source/JavaScriptCore/runtime/MarkedBlock.h
index e80fe82..0e2b59c 100644
--- a/Source/JavaScriptCore/runtime/MarkedBlock.h
+++ b/Source/JavaScriptCore/runtime/MarkedBlock.h
@@ -24,6 +24,7 @@
 
 #include <wtf/Bitmap.h>
 #include <wtf/PageAllocationAligned.h>
+#include <wtf/StdLibExtras.h>
 
 namespace JSC {
 
@@ -35,15 +36,6 @@ namespace JSC {
 
     static const size_t KB = 1024;
 
-    // Efficient implementation that takes advantage of powers of two.
-    template<size_t divisor> inline size_t roundUpToMultipleOf(size_t x)
-    {
-        COMPILE_ASSERT(divisor && !(divisor & (divisor - 1)), divisor_is_a_power_of_two);
-
-        size_t remainderMask = divisor - 1;
-        return (x + remainderMask) & ~remainderMask;
-    }
-
     class MarkedBlock {
     public:
         static const size_t atomSize = sizeof(double); // Ensures natural alignment for all built-in types.
@@ -109,7 +101,7 @@ namespace JSC {
 
     inline size_t MarkedBlock::firstAtom()
     {
-        return roundUpToMultipleOf<atomSize>(sizeof(MarkedBlock)) / atomSize;
+        return WTF::roundUpToMultipleOf<atomSize>(sizeof(MarkedBlock)) / atomSize;
     }
 
     inline MarkedBlock::Atom* MarkedBlock::atoms()
diff --git a/Source/JavaScriptCore/runtime/MarkedSpace.cpp b/Source/JavaScriptCore/runtime/MarkedSpace.cpp
index 15ab514..d9a1e42 100644
--- a/Source/JavaScriptCore/runtime/MarkedSpace.cpp
+++ b/Source/JavaScriptCore/runtime/MarkedSpace.cpp
@@ -24,6 +24,7 @@
 #include "JSCell.h"
 #include "JSGlobalData.h"
 #include "JSLock.h"
+#include "JSObject.h"
 #include "ScopeChain.h"
 
 namespace JSC {
@@ -35,7 +36,10 @@ MarkedSpace::MarkedSpace(JSGlobalData* globalData)
     , m_highWaterMark(0)
     , m_globalData(globalData)
 {
-    for (size_t cellSize = preciseStep; cellSize <= preciseCutoff; cellSize += preciseStep)
+    for (size_t cellSize = preciseStep; cellSize < preciseCutoff; cellSize += preciseStep)
+        sizeClassFor(cellSize).cellSize = cellSize;
+
+    for (size_t cellSize = impreciseStep; cellSize < impreciseCutoff; cellSize += impreciseStep)
         sizeClassFor(cellSize).cellSize = cellSize;
 }
 
@@ -148,7 +152,10 @@ void MarkedSpace::reset()
 {
     m_waterMark = 0;
 
-    for (size_t cellSize = preciseStep; cellSize <= preciseCutoff; cellSize += preciseStep)
+    for (size_t cellSize = preciseStep; cellSize < preciseCutoff; cellSize += preciseStep)
+        sizeClassFor(cellSize).reset();
+
+    for (size_t cellSize = impreciseStep; cellSize < impreciseCutoff; cellSize += impreciseStep)
         sizeClassFor(cellSize).reset();
 
     BlockIterator end = m_blocks.end();
diff --git a/Source/JavaScriptCore/runtime/MarkedSpace.h b/Source/JavaScriptCore/runtime/MarkedSpace.h
index 2e88887..29a8cd0 100644
--- a/Source/JavaScriptCore/runtime/MarkedSpace.h
+++ b/Source/JavaScriptCore/runtime/MarkedSpace.h
@@ -32,8 +32,7 @@
 #include <wtf/Noncopyable.h>
 #include <wtf/Vector.h>
 
-#define ASSERT_CLASS_FITS_IN_CELL(class) COMPILE_ASSERT(sizeof(class) <= MarkedSpace::maxCellSize, class_fits_in_cell)
-#define ASSERT_CLASS_FILLS_CELL(class) COMPILE_ASSERT(sizeof(class) == MarkedSpace::maxCellSize, class_fills_cell)
+#define ASSERT_CLASS_FITS_IN_CELL(class) COMPILE_ASSERT(sizeof(class) < MarkedSpace::maxCellSize, class_fits_in_cell)
 
 namespace JSC {
 
@@ -48,7 +47,7 @@ namespace JSC {
         WTF_MAKE_NONCOPYABLE(MarkedSpace);
     public:
         // Currently public for use in assertions.
-        static const size_t maxCellSize = 64;
+        static const size_t maxCellSize = 1024;
 
         static Heap* heap(JSCell*);
 
@@ -81,10 +80,15 @@ namespace JSC {
         template<typename Functor> void forEach(Functor&);
 
     private:
-        // [ 8, 16... 64 ]
+        // [ 8, 16... 128 )
         static const size_t preciseStep = MarkedBlock::atomSize;
-        static const size_t preciseCutoff = maxCellSize;
-        static const size_t preciseCount = preciseCutoff / preciseStep;
+        static const size_t preciseCutoff = 128;
+        static const size_t preciseCount = preciseCutoff / preciseStep - 1;
+
+        // [ 128, 256... 1024 )
+        static const size_t impreciseStep = preciseCutoff;
+        static const size_t impreciseCutoff = maxCellSize;
+        static const size_t impreciseCount = impreciseCutoff / impreciseStep - 1;
 
         typedef HashSet<MarkedBlock*>::iterator BlockIterator;
 
@@ -106,6 +110,7 @@ namespace JSC {
         void clearMarks(MarkedBlock*);
 
         SizeClass m_preciseSizeClasses[preciseCount];
+        SizeClass m_impreciseSizeClasses[impreciseCount];
         HashSet<MarkedBlock*> m_blocks;
         size_t m_waterMark;
         size_t m_highWaterMark;
diff --git a/Source/JavaScriptCore/runtime/MathObject.h b/Source/JavaScriptCore/runtime/MathObject.h
index 86e7951..26eaae0 100644
--- a/Source/JavaScriptCore/runtime/MathObject.h
+++ b/Source/JavaScriptCore/runtime/MathObject.h
@@ -34,9 +34,9 @@ namespace JSC {
 
         static const ClassInfo s_info;
 
-        static PassRefPtr<Structure> createStructure(JSValue prototype)
+        static PassRefPtr<Structure> createStructure(JSGlobalData& globalData, JSValue prototype)
         {
-            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
+            return Structure::create(globalData, prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
         }
 
     protected:
diff --git a/Source/JavaScriptCore/runtime/NativeErrorConstructor.cpp b/Source/JavaScriptCore/runtime/NativeErrorConstructor.cpp
index 7949dd9..d8fda69 100644
--- a/Source/JavaScriptCore/runtime/NativeErrorConstructor.cpp
+++ b/Source/JavaScriptCore/runtime/NativeErrorConstructor.cpp
@@ -41,7 +41,7 @@ NativeErrorConstructor::NativeErrorConstructor(ExecState* exec, JSGlobalObject*
 
     putDirect(exec->globalData(), exec->propertyNames().length, jsNumber(1), DontDelete | ReadOnly | DontEnum); // ECMA 15.11.7.5
     putDirect(exec->globalData(), exec->propertyNames().prototype, prototype, DontDelete | ReadOnly | DontEnum);
-    m_errorStructure = ErrorInstance::createStructure(prototype);
+    m_errorStructure = ErrorInstance::createStructure(exec->globalData(), prototype);
 }
 
 static EncodedJSValue JSC_HOST_CALL constructWithNativeErrorConstructor(ExecState* exec)
diff --git a/Source/JavaScriptCore/runtime/NativeErrorConstructor.h b/Source/JavaScriptCore/runtime/NativeErrorConstructor.h
index e4978cc..23f798e 100644
--- a/Source/JavaScriptCore/runtime/NativeErrorConstructor.h
+++ b/Source/JavaScriptCore/runtime/NativeErrorConstructor.h
@@ -35,9 +35,9 @@ namespace JSC {
 
         static const ClassInfo s_info;
 
-        static PassRefPtr<Structure> createStructure(JSValue prototype)
+        static PassRefPtr<Structure> createStructure(JSGlobalData& globalData, JSValue prototype)
         {
-            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
+            return Structure::create(globalData, prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
         }
 
         Structure* errorStructure() { return m_errorStructure.get(); }
diff --git a/Source/JavaScriptCore/runtime/NumberConstructor.cpp b/Source/JavaScriptCore/runtime/NumberConstructor.cpp
index 3e4d6c7..aee143a 100644
--- a/Source/JavaScriptCore/runtime/NumberConstructor.cpp
+++ b/Source/JavaScriptCore/runtime/NumberConstructor.cpp
@@ -104,7 +104,7 @@ static JSValue numberConstructorMinValue(ExecState*, JSValue, const Identifier&)
 // ECMA 15.7.1
 static EncodedJSValue JSC_HOST_CALL constructWithNumberConstructor(ExecState* exec)
 {
-    NumberObject* object = new (exec) NumberObject(exec->globalData(), exec->lexicalGlobalObject()->numberObjectStructure());
+    NumberObject* object = new (exec) NumberObject(exec->globalData(), asInternalFunction(exec->callee())->globalObject()->numberObjectStructure());
     double n = exec->argumentCount() ? exec->argument(0).toNumber(exec) : 0;
     object->setInternalValue(exec->globalData(), jsNumber(n));
     return JSValue::encode(object);
diff --git a/Source/JavaScriptCore/runtime/NumberConstructor.h b/Source/JavaScriptCore/runtime/NumberConstructor.h
index aaf7c32..ab4507e 100644
--- a/Source/JavaScriptCore/runtime/NumberConstructor.h
+++ b/Source/JavaScriptCore/runtime/NumberConstructor.h
@@ -37,9 +37,9 @@ namespace JSC {
 
         static const ClassInfo s_info;
 
-        static PassRefPtr<Structure> createStructure(JSValue proto) 
+        static PassRefPtr<Structure> createStructure(JSGlobalData& globalData, JSValue proto) 
         { 
-            return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info); 
+            return Structure::create(globalData, proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info); 
         }
 
         enum { NaNValue, NegInfinity, PosInfinity, MaxValue, MinValue };
diff --git a/Source/JavaScriptCore/runtime/NumberObject.cpp b/Source/JavaScriptCore/runtime/NumberObject.cpp
index 4408673..74b5e98 100644
--- a/Source/JavaScriptCore/runtime/NumberObject.cpp
+++ b/Source/JavaScriptCore/runtime/NumberObject.cpp
@@ -31,8 +31,8 @@ ASSERT_CLASS_FITS_IN_CELL(NumberObject);
 
 const ClassInfo NumberObject::s_info = { "Number", &JSWrapperObject::s_info, 0, 0 };
 
-NumberObject::NumberObject(JSGlobalData& globalData, NonNullPassRefPtr<Structure> structure)
-    : JSWrapperObject(globalData, structure)
+NumberObject::NumberObject(JSGlobalData&, NonNullPassRefPtr<Structure> structure)
+    : JSWrapperObject(structure)
 {
     ASSERT(inherits(&s_info));
 }
@@ -42,9 +42,9 @@ JSValue NumberObject::getJSNumber()
     return internalValue();
 }
 
-NumberObject* constructNumber(ExecState* exec, JSValue number)
+NumberObject* constructNumber(ExecState* exec, JSGlobalObject* globalObject, JSValue number)
 {
-    NumberObject* object = new (exec) NumberObject(exec->globalData(), exec->lexicalGlobalObject()->numberObjectStructure());
+    NumberObject* object = new (exec) NumberObject(exec->globalData(), globalObject->numberObjectStructure());
     object->setInternalValue(exec->globalData(), number);
     return object;
 }
diff --git a/Source/JavaScriptCore/runtime/NumberObject.h b/Source/JavaScriptCore/runtime/NumberObject.h
index 8a80382..90d0b26 100644
--- a/Source/JavaScriptCore/runtime/NumberObject.h
+++ b/Source/JavaScriptCore/runtime/NumberObject.h
@@ -31,19 +31,16 @@ namespace JSC {
 
         static const ClassInfo s_info;
 
-        static PassRefPtr<Structure> createStructure(JSValue prototype)
+        static PassRefPtr<Structure> createStructure(JSGlobalData& globalData, JSValue prototype)
         {
-            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
+            return Structure::create(globalData, prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
         }
 
-    protected:
-        static const unsigned StructureFlags = JSWrapperObject::StructureFlags;
-
     private:
         virtual JSValue getJSNumber();
     };
 
-    NumberObject* constructNumber(ExecState*, JSValue);
+    NumberObject* constructNumber(ExecState*, JSGlobalObject*, JSValue);
 
 } // namespace JSC
 
diff --git a/Source/JavaScriptCore/runtime/ObjectConstructor.cpp b/Source/JavaScriptCore/runtime/ObjectConstructor.cpp
index 5080ef8..c642a5b 100644
--- a/Source/JavaScriptCore/runtime/ObjectConstructor.cpp
+++ b/Source/JavaScriptCore/runtime/ObjectConstructor.cpp
@@ -95,18 +95,18 @@ bool ObjectConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifi
 }
 
 // ECMA 15.2.2
-static ALWAYS_INLINE JSObject* constructObject(ExecState* exec, const ArgList& args)
+static ALWAYS_INLINE JSObject* constructObject(ExecState* exec, JSGlobalObject* globalObject, const ArgList& args)
 {
     JSValue arg = args.at(0);
     if (arg.isUndefinedOrNull())
-        return constructEmptyObject(exec);
-    return arg.toObject(exec);
+        return constructEmptyObject(exec, globalObject);
+    return arg.toObject(exec, globalObject);
 }
 
 static EncodedJSValue JSC_HOST_CALL constructWithObjectConstructor(ExecState* exec)
 {
     ArgList args(exec);
-    return JSValue::encode(constructObject(exec, args));
+    return JSValue::encode(constructObject(exec, asInternalFunction(exec->callee())->globalObject(), args));
 }
 
 ConstructType ObjectConstructor::getConstructData(ConstructData& constructData)
@@ -118,7 +118,7 @@ ConstructType ObjectConstructor::getConstructData(ConstructData& constructData)
 static EncodedJSValue JSC_HOST_CALL callObjectConstructor(ExecState* exec)
 {
     ArgList args(exec);
-    return JSValue::encode(constructObject(exec, args));
+    return JSValue::encode(constructObject(exec, asInternalFunction(exec->callee())->globalObject(), args));
 }
 
 CallType ObjectConstructor::getCallData(CallData& callData)
diff --git a/Source/JavaScriptCore/runtime/ObjectConstructor.h b/Source/JavaScriptCore/runtime/ObjectConstructor.h
index 895f988..b7bfc1d 100644
--- a/Source/JavaScriptCore/runtime/ObjectConstructor.h
+++ b/Source/JavaScriptCore/runtime/ObjectConstructor.h
@@ -36,9 +36,9 @@ namespace JSC {
 
         static const ClassInfo s_info;
 
-        static PassRefPtr<Structure> createStructure(JSValue prototype)
+        static PassRefPtr<Structure> createStructure(JSGlobalData& globalData, JSValue prototype)
         {
-            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
+            return Structure::create(globalData, prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
         }
 
     protected:
diff --git a/Source/JavaScriptCore/runtime/PropertyMapHashTable.h b/Source/JavaScriptCore/runtime/PropertyMapHashTable.h
index 85a3818..c000dc8 100644
--- a/Source/JavaScriptCore/runtime/PropertyMapHashTable.h
+++ b/Source/JavaScriptCore/runtime/PropertyMapHashTable.h
@@ -291,7 +291,7 @@ inline PropertyTable::~PropertyTable()
 {
     iterator end = this->end();
     for (iterator iter = begin(); iter != end; ++iter)
-        iter->key->ref();
+        iter->key->deref();
 
     fastFree(m_index);
 }
diff --git a/Source/JavaScriptCore/runtime/PropertyNameArray.cpp b/Source/JavaScriptCore/runtime/PropertyNameArray.cpp
index 351ecc3..8efb406 100644
--- a/Source/JavaScriptCore/runtime/PropertyNameArray.cpp
+++ b/Source/JavaScriptCore/runtime/PropertyNameArray.cpp
@@ -21,6 +21,7 @@
 #include "config.h"
 #include "PropertyNameArray.h"
 
+#include "JSObject.h"
 #include "ScopeChain.h"
 #include "Structure.h"
 #include "StructureChain.h"
diff --git a/Source/JavaScriptCore/runtime/PutPropertySlot.h b/Source/JavaScriptCore/runtime/PutPropertySlot.h
index 4c9e0e6..69d1f8b 100644
--- a/Source/JavaScriptCore/runtime/PutPropertySlot.h
+++ b/Source/JavaScriptCore/runtime/PutPropertySlot.h
@@ -45,14 +45,14 @@ namespace JSC {
         {
         }
 
-        void setExistingProperty(DeprecatedPtr<JSObject> base, size_t offset)
+        void setExistingProperty(JSObject* base, size_t offset)
         {
             m_type = ExistingProperty;
             m_base = base;
             m_offset = offset;
         }
 
-        void setNewProperty(DeprecatedPtr<JSObject> base, size_t offset)
+        void setNewProperty(JSObject* base, size_t offset)
         {
             m_type = NewProperty;
             m_base = base;
@@ -60,7 +60,7 @@ namespace JSC {
         }
 
         Type type() const { return m_type; }
-        JSObject* base() const { return m_base.get(); }
+        JSObject* base() const { return m_base; }
 
         bool isStrictMode() const { return m_isStrictMode; }
         bool isCacheable() const { return m_type != Uncachable; }
@@ -68,9 +68,10 @@ namespace JSC {
             ASSERT(isCacheable());
             return m_offset;
         }
+
     private:
         Type m_type;
-        DeprecatedPtr<JSObject> m_base;
+        JSObject* m_base;
         size_t m_offset;
         bool m_isStrictMode;
     };
diff --git a/Source/JavaScriptCore/runtime/RegExp.cpp b/Source/JavaScriptCore/runtime/RegExp.cpp
index 95ce5e9..25cb2d5 100644
--- a/Source/JavaScriptCore/runtime/RegExp.cpp
+++ b/Source/JavaScriptCore/runtime/RegExp.cpp
@@ -34,6 +34,38 @@
 
 namespace JSC {
 
+RegExpFlags regExpFlags(const UString& string)
+{
+    RegExpFlags flags = NoFlags;
+
+    for (unsigned i = 0; i < string.length(); ++i) {
+        switch (string.characters()[i]) {
+        case 'g':
+            if (flags & FlagGlobal)
+                return InvalidFlags;
+            flags = static_cast<RegExpFlags>(flags | FlagGlobal);
+            break;
+
+        case 'i':
+            if (flags & FlagIgnoreCase)
+                return InvalidFlags;
+            flags = static_cast<RegExpFlags>(flags | FlagIgnoreCase);
+            break;
+
+        case 'm':
+            if (flags & FlagMultiline)
+                return InvalidFlags;
+            flags = static_cast<RegExpFlags>(flags | FlagMultiline);
+            break;
+
+        default:
+            return InvalidFlags;
+        }
+    }
+
+    return flags;
+}
+  
 struct RegExpRepresentation {
 #if ENABLE(YARR_JIT)
     Yarr::YarrCodeBlock m_regExpJITCode;
@@ -41,9 +73,9 @@ struct RegExpRepresentation {
     OwnPtr<Yarr::BytecodePattern> m_regExpBytecode;
 };
 
-inline RegExp::RegExp(JSGlobalData* globalData, const UString& patternString, const UString& flags)
+inline RegExp::RegExp(JSGlobalData* globalData, const UString& patternString, RegExpFlags flags)
     : m_patternString(patternString)
-    , m_flagBits(0)
+    , m_flags(flags)
     , m_constructionError(0)
     , m_numSubpatterns(0)
 #if ENABLE(REGEXP_TRACING)
@@ -52,17 +84,6 @@ inline RegExp::RegExp(JSGlobalData* globalData, const UString& patternString, co
 #endif
     , m_representation(adoptPtr(new RegExpRepresentation))
 {
-    // NOTE: The global flag is handled on a case-by-case basis by functions like
-    // String::match and RegExpObject::match.
-    if (!flags.isNull()) {
-        if (flags.find('g') != notFound)
-            m_flagBits |= Global;
-        if (flags.find('i') != notFound)
-            m_flagBits |= IgnoreCase;
-        if (flags.find('m') != notFound)
-            m_flagBits |= Multiline;
-    }
-
     m_state = compile(globalData);
 }
 
@@ -70,7 +91,7 @@ RegExp::~RegExp()
 {
 }
 
-PassRefPtr<RegExp> RegExp::create(JSGlobalData* globalData, const UString& patternString, const UString& flags)
+PassRefPtr<RegExp> RegExp::create(JSGlobalData* globalData, const UString& patternString, RegExpFlags flags)
 {
     RefPtr<RegExp> res = adoptRef(new RegExp(globalData, patternString, flags));
 #if ENABLE(REGEXP_TRACING)
diff --git a/Source/JavaScriptCore/runtime/RegExp.h b/Source/JavaScriptCore/runtime/RegExp.h
index d99befb..000c33a 100644
--- a/Source/JavaScriptCore/runtime/RegExp.h
+++ b/Source/JavaScriptCore/runtime/RegExp.h
@@ -24,6 +24,7 @@
 
 #include "UString.h"
 #include "ExecutableAllocator.h"
+#include "RegExpKey.h"
 #include <wtf/Forward.h>
 #include <wtf/RefCounted.h>
 
@@ -32,18 +33,20 @@ namespace JSC {
     struct RegExpRepresentation;
     class JSGlobalData;
 
+    RegExpFlags regExpFlags(const UString&);
+
     class RegExp : public RefCounted<RegExp> {
     public:
-        static PassRefPtr<RegExp> create(JSGlobalData* globalData, const UString& pattern, const UString& flags);
+        static PassRefPtr<RegExp> create(JSGlobalData* globalData, const UString& pattern, RegExpFlags);
         ~RegExp();
 
-        bool global() const { return m_flagBits & Global; }
-        bool ignoreCase() const { return m_flagBits & IgnoreCase; }
-        bool multiline() const { return m_flagBits & Multiline; }
+        bool global() const { return m_flags & FlagGlobal; }
+        bool ignoreCase() const { return m_flags & FlagIgnoreCase; }
+        bool multiline() const { return m_flags & FlagMultiline; }
 
         const UString& pattern() const { return m_patternString; }
 
-        bool isValid() const { return !m_constructionError; }
+        bool isValid() const { return !m_constructionError && m_flags != InvalidFlags; }
         const char* errorMessage() const { return m_constructionError; }
 
         int match(const UString&, int startOffset, Vector<int, 32>* ovector = 0);
@@ -54,7 +57,7 @@ namespace JSC {
 #endif
 
     private:
-        RegExp(JSGlobalData* globalData, const UString& pattern, const UString& flags);
+        RegExp(JSGlobalData* globalData, const UString& pattern, RegExpFlags);
 
         enum RegExpState {
             ParseError,
@@ -68,9 +71,8 @@ namespace JSC {
         void matchCompareWithInterpreter(const UString&, int startOffset, int* offsetVector, int jitResult);
 #endif
 
-        enum FlagBits { Global = 1, IgnoreCase = 2, Multiline = 4 };
         UString m_patternString;
-        int m_flagBits;
+        RegExpFlags m_flags;
         const char* m_constructionError;
         unsigned m_numSubpatterns;
 #if ENABLE(REGEXP_TRACING)
diff --git a/Source/JavaScriptCore/runtime/RegExpCache.cpp b/Source/JavaScriptCore/runtime/RegExpCache.cpp
index d101758..c96b047 100644
--- a/Source/JavaScriptCore/runtime/RegExpCache.cpp
+++ b/Source/JavaScriptCore/runtime/RegExpCache.cpp
@@ -31,7 +31,7 @@
 
 namespace JSC {
 
-PassRefPtr<RegExp> RegExpCache::lookupOrCreate(const UString& patternString, const UString& flags)
+PassRefPtr<RegExp> RegExpCache::lookupOrCreate(const UString& patternString, RegExpFlags flags)
 {
     if (patternString.length() < maxCacheablePatternLength) {
         pair<RegExpCacheMap::iterator, bool> result = m_cacheMap.add(RegExpKey(flags, patternString), 0);
@@ -43,7 +43,7 @@ PassRefPtr<RegExp> RegExpCache::lookupOrCreate(const UString& patternString, con
     return create(patternString, flags, m_cacheMap.end());
 }
 
-PassRefPtr<RegExp> RegExpCache::create(const UString& patternString, const UString& flags, RegExpCacheMap::iterator iterator) 
+PassRefPtr<RegExp> RegExpCache::create(const UString& patternString, RegExpFlags flags, RegExpCacheMap::iterator iterator) 
 {
     RefPtr<RegExp> regExp = RegExp::create(m_globalData, patternString, flags);
 
diff --git a/Source/JavaScriptCore/runtime/RegExpCache.h b/Source/JavaScriptCore/runtime/RegExpCache.h
index b5b637f..b4a6ae5 100644
--- a/Source/JavaScriptCore/runtime/RegExpCache.h
+++ b/Source/JavaScriptCore/runtime/RegExpCache.h
@@ -41,8 +41,8 @@ class RegExpCache {
 typedef HashMap<RegExpKey, RefPtr<RegExp> > RegExpCacheMap;
 
 public:
-    PassRefPtr<RegExp> lookupOrCreate(const UString& patternString, const UString& flags);
-    PassRefPtr<RegExp> create(const UString& patternString, const UString& flags, RegExpCacheMap::iterator iterator);
+    PassRefPtr<RegExp> lookupOrCreate(const UString& patternString, RegExpFlags);
+    PassRefPtr<RegExp> create(const UString& patternString, RegExpFlags, RegExpCacheMap::iterator);
     RegExpCache(JSGlobalData* globalData);
 
 private:
diff --git a/Source/JavaScriptCore/runtime/RegExpConstructor.cpp b/Source/JavaScriptCore/runtime/RegExpConstructor.cpp
index c06fdc4..19b4b36 100644
--- a/Source/JavaScriptCore/runtime/RegExpConstructor.cpp
+++ b/Source/JavaScriptCore/runtime/RegExpConstructor.cpp
@@ -291,9 +291,9 @@ void setRegExpConstructorMultiline(ExecState* exec, JSObject* baseObject, JSValu
 {
     asRegExpConstructor(baseObject)->setMultiline(value.toBoolean(exec));
 }
-  
+
 // ECMA 15.10.4
-JSObject* constructRegExp(ExecState* exec, const ArgList& args)
+JSObject* constructRegExp(ExecState* exec, JSGlobalObject* globalObject, const ArgList& args)
 {
     JSValue arg0 = args.at(0);
     JSValue arg1 = args.at(1);
@@ -305,18 +305,28 @@ JSObject* constructRegExp(ExecState* exec, const ArgList& args)
     }
 
     UString pattern = arg0.isUndefined() ? UString("") : arg0.toString(exec);
-    UString flags = arg1.isUndefined() ? UString("") : arg1.toString(exec);
+    if (exec->hadException())
+        return 0;
+
+    RegExpFlags flags = NoFlags;
+    if (!arg1.isUndefined()) {
+        flags = regExpFlags(arg1.toString(exec));
+        if (exec->hadException())
+            return 0;
+        if (flags == InvalidFlags)
+            return throwError(exec, createSyntaxError(exec, "Invalid flags supplied to RegExp constructor."));
+    }
 
     RefPtr<RegExp> regExp = exec->globalData().regExpCache()->lookupOrCreate(pattern, flags);
     if (!regExp->isValid())
         return throwError(exec, createSyntaxError(exec, regExp->errorMessage()));
-    return new (exec) RegExpObject(exec->lexicalGlobalObject(), exec->lexicalGlobalObject()->regExpStructure(), regExp.release());
+    return new (exec) RegExpObject(exec->lexicalGlobalObject(), globalObject->regExpStructure(), regExp.release());
 }
 
 static EncodedJSValue JSC_HOST_CALL constructWithRegExpConstructor(ExecState* exec)
 {
     ArgList args(exec);
-    return JSValue::encode(constructRegExp(exec, args));
+    return JSValue::encode(constructRegExp(exec, asInternalFunction(exec->callee())->globalObject(), args));
 }
 
 ConstructType RegExpConstructor::getConstructData(ConstructData& constructData)
@@ -329,7 +339,7 @@ ConstructType RegExpConstructor::getConstructData(ConstructData& constructData)
 static EncodedJSValue JSC_HOST_CALL callRegExpConstructor(ExecState* exec)
 {
     ArgList args(exec);
-    return JSValue::encode(constructRegExp(exec, args));
+    return JSValue::encode(constructRegExp(exec, asInternalFunction(exec->callee())->globalObject(), args));
 }
 
 CallType RegExpConstructor::getCallData(CallData& callData)
diff --git a/Source/JavaScriptCore/runtime/RegExpConstructor.h b/Source/JavaScriptCore/runtime/RegExpConstructor.h
index 8a8a54a..5e0b2b8 100644
--- a/Source/JavaScriptCore/runtime/RegExpConstructor.h
+++ b/Source/JavaScriptCore/runtime/RegExpConstructor.h
@@ -59,9 +59,9 @@ namespace JSC {
     public:
         RegExpConstructor(ExecState*, JSGlobalObject*, NonNullPassRefPtr<Structure>, RegExpPrototype*);
 
-        static PassRefPtr<Structure> createStructure(JSValue prototype)
+        static PassRefPtr<Structure> createStructure(JSGlobalData& globalData, JSValue prototype)
         {
-            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
+            return Structure::create(globalData, prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
         }
 
         virtual void put(ExecState*, const Identifier& propertyName, JSValue, PutPropertySlot&);
@@ -96,7 +96,7 @@ namespace JSC {
 
     RegExpConstructor* asRegExpConstructor(JSValue);
 
-    JSObject* constructRegExp(ExecState*, const ArgList&);
+    JSObject* constructRegExp(ExecState*, JSGlobalObject*, const ArgList&);
 
     inline RegExpConstructor* asRegExpConstructor(JSValue value)
     {
diff --git a/Source/JavaScriptCore/runtime/RegExpKey.h b/Source/JavaScriptCore/runtime/RegExpKey.h
index cd1368d..b4847f9 100644
--- a/Source/JavaScriptCore/runtime/RegExpKey.h
+++ b/Source/JavaScriptCore/runtime/RegExpKey.h
@@ -25,63 +25,54 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#include "UString.h"
-#include <wtf/text/StringHash.h>
-
 #ifndef RegExpKey_h
 #define RegExpKey_h
 
+#include "UString.h"
+#include <wtf/text/StringHash.h>
+
 namespace JSC {
 
+enum RegExpFlags {
+    NoFlags = 0,
+    FlagGlobal = 1,
+    FlagIgnoreCase = 2,
+    FlagMultiline = 4,
+    InvalidFlags = 8,
+    DeletedValueFlags = -1
+};
+
 struct RegExpKey {
-    int flagsValue;
+    RegExpFlags flagsValue;
     RefPtr<StringImpl> pattern;
 
     RegExpKey()
-        : flagsValue(0)
+        : flagsValue(NoFlags)
     {
     }
 
-    RegExpKey(int flags)
+    RegExpKey(RegExpFlags flags)
         : flagsValue(flags)
     {
     }
 
-    RegExpKey(int flags, const UString& pattern)
+    RegExpKey(RegExpFlags flags, const UString& pattern)
         : flagsValue(flags)
         , pattern(pattern.impl())
     {
     }
 
-    RegExpKey(int flags, const PassRefPtr<StringImpl> pattern)
+    RegExpKey(RegExpFlags flags, const PassRefPtr<StringImpl> pattern)
         : flagsValue(flags)
         , pattern(pattern)
     {
     }
 
-    RegExpKey(int flags, const RefPtr<StringImpl>& pattern)
+    RegExpKey(RegExpFlags flags, const RefPtr<StringImpl>& pattern)
         : flagsValue(flags)
         , pattern(pattern)
     {
     }
-
-    RegExpKey(const UString& flags, const UString& pattern)
-        : pattern(pattern.impl())
-    {
-        flagsValue = getFlagsValue(flags);
-    }
-
-    int getFlagsValue(const UString flags) 
-    {
-        flagsValue = 0;
-        if (flags.find('g') != notFound)
-            flagsValue += 4;
-        if (flags.find('i') != notFound)
-            flagsValue += 2;
-        if (flags.find('m') != notFound)
-            flagsValue += 1;
-        return flagsValue;
-    }
 };
 
 inline bool operator==(const RegExpKey& a, const RegExpKey& b) 
@@ -112,8 +103,8 @@ template<> struct DefaultHash<JSC::RegExpKey> {
 };
 
 template<> struct HashTraits<JSC::RegExpKey> : GenericHashTraits<JSC::RegExpKey> {
-    static void constructDeletedValue(JSC::RegExpKey& slot) { slot.flagsValue = -1; }
-    static bool isDeletedValue(const JSC::RegExpKey& value) { return value.flagsValue == -1; }
+    static void constructDeletedValue(JSC::RegExpKey& slot) { slot.flagsValue = JSC::DeletedValueFlags; }
+    static bool isDeletedValue(const JSC::RegExpKey& value) { return value.flagsValue == JSC::DeletedValueFlags; }
 };
 } // namespace WTF
 
diff --git a/Source/JavaScriptCore/runtime/RegExpObject.cpp b/Source/JavaScriptCore/runtime/RegExpObject.cpp
index 5baf884..4b5028b 100644
--- a/Source/JavaScriptCore/runtime/RegExpObject.cpp
+++ b/Source/JavaScriptCore/runtime/RegExpObject.cpp
@@ -63,7 +63,7 @@ const ClassInfo RegExpObject::s_info = { "RegExp", &JSObjectWithGlobalObject::s_
 
 RegExpObject::RegExpObject(JSGlobalObject* globalObject, NonNullPassRefPtr<Structure> structure, NonNullPassRefPtr<RegExp> regExp)
     : JSObjectWithGlobalObject(globalObject, structure)
-    , d(adoptPtr(new RegExpObjectData(regExp, 0)))
+    , d(adoptPtr(new RegExpObjectData(regExp)))
 {
     ASSERT(inherits(&s_info));
 }
@@ -72,6 +72,13 @@ RegExpObject::~RegExpObject()
 {
 }
 
+void RegExpObject::markChildren(MarkStack& markStack)
+{
+    Base::markChildren(markStack);
+    if (UNLIKELY(!d->lastIndex.get().isInt32()))
+        markStack.append(&d->lastIndex);
+}
+
 bool RegExpObject::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
 {
     return getStaticValueSlot<RegExpObject, JSObject>(exec, ExecState::regExpTable(exec), this, propertyName, slot);
@@ -104,7 +111,7 @@ JSValue regExpObjectSource(ExecState* exec, JSValue slotBase, const Identifier&)
 
 JSValue regExpObjectLastIndex(ExecState*, JSValue slotBase, const Identifier&)
 {
-    return jsNumber(asRegExpObject(slotBase)->lastIndex());
+    return asRegExpObject(slotBase)->getLastIndex();
 }
 
 void RegExpObject::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
@@ -114,7 +121,7 @@ void RegExpObject::put(ExecState* exec, const Identifier& propertyName, JSValue
 
 void setRegExpObjectLastIndex(ExecState* exec, JSObject* baseObject, JSValue value)
 {
-    asRegExpObject(baseObject)->setLastIndex(value.toInteger(exec));
+    asRegExpObject(baseObject)->setLastIndex(exec->globalData(), value);
 }
 
 JSValue RegExpObject::test(ExecState* exec)
@@ -133,12 +140,7 @@ JSValue RegExpObject::exec(ExecState* exec)
 bool RegExpObject::match(ExecState* exec)
 {
     RegExpConstructor* regExpConstructor = exec->lexicalGlobalObject()->regExpConstructor();
-
-    UString input = !exec->argumentCount() ? regExpConstructor->input() : exec->argument(0).toString(exec);
-    if (input.isNull()) {
-        throwError(exec, createError(exec, makeUString("No input to ", toString(exec), ".")));
-        return false;
-    }
+    UString input = exec->argument(0).toString(exec);
 
     if (!regExp()->global()) {
         int position;
@@ -147,20 +149,32 @@ bool RegExpObject::match(ExecState* exec)
         return position >= 0;
     }
 
-    if (d->lastIndex < 0 || d->lastIndex > input.length()) {
-        d->lastIndex = 0;
-        return false;
+    JSValue jsLastIndex = getLastIndex();
+    unsigned lastIndex;
+    if (LIKELY(jsLastIndex.isUInt32())) {
+        lastIndex = jsLastIndex.asUInt32();
+        if (lastIndex > input.length()) {
+            setLastIndex(0);
+            return false;
+        }
+    } else {
+        double doubleLastIndex = jsLastIndex.toInteger(exec);
+        if (doubleLastIndex < 0 || doubleLastIndex > input.length()) {
+            setLastIndex(0);
+            return false;
+        }
+        lastIndex = static_cast<unsigned>(doubleLastIndex);
     }
 
     int position;
     int length = 0;
-    regExpConstructor->performMatch(d->regExp.get(), input, static_cast<int>(d->lastIndex), position, length);
+    regExpConstructor->performMatch(d->regExp.get(), input, lastIndex, position, length);
     if (position < 0) {
-        d->lastIndex = 0;
+        setLastIndex(0);
         return false;
     }
 
-    d->lastIndex = position + length;
+    setLastIndex(position + length);
     return true;
 }
 
diff --git a/Source/JavaScriptCore/runtime/RegExpObject.h b/Source/JavaScriptCore/runtime/RegExpObject.h
index 1f89b84..fa2024d 100644
--- a/Source/JavaScriptCore/runtime/RegExpObject.h
+++ b/Source/JavaScriptCore/runtime/RegExpObject.h
@@ -28,14 +28,26 @@ namespace JSC {
 
     class RegExpObject : public JSObjectWithGlobalObject {
     public:
+        typedef JSObjectWithGlobalObject Base;
+
         RegExpObject(JSGlobalObject* globalObject, NonNullPassRefPtr<Structure>, NonNullPassRefPtr<RegExp>);
         virtual ~RegExpObject();
 
         void setRegExp(PassRefPtr<RegExp> r) { d->regExp = r; }
         RegExp* regExp() const { return d->regExp.get(); }
 
-        void setLastIndex(double lastIndex) { d->lastIndex = lastIndex; }
-        double lastIndex() const { return d->lastIndex; }
+        void setLastIndex(size_t lastIndex)
+        {
+            d->lastIndex.setWithoutWriteBarrier(jsNumber(lastIndex));
+        }
+        void setLastIndex(JSGlobalData& globalData, JSValue lastIndex)
+        {
+            d->lastIndex.set(globalData, this, lastIndex);
+        }
+        JSValue getLastIndex() const
+        {
+            return d->lastIndex.get();
+        }
 
         JSValue test(ExecState*);
         JSValue exec(ExecState*);
@@ -46,28 +58,30 @@ namespace JSC {
 
         static JS_EXPORTDATA const ClassInfo s_info;
 
-        static PassRefPtr<Structure> createStructure(JSValue prototype)
+        static PassRefPtr<Structure> createStructure(JSGlobalData& globalData, JSValue prototype)
         {
-            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
+            return Structure::create(globalData, prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
         }
 
     protected:
-        static const unsigned StructureFlags = OverridesGetOwnPropertySlot | JSObjectWithGlobalObject::StructureFlags;
-        
+        static const unsigned StructureFlags = OverridesMarkChildren | OverridesGetOwnPropertySlot | JSObjectWithGlobalObject::StructureFlags;
+
     private:
+        virtual void markChildren(MarkStack&);
+
         bool match(ExecState*);
 
         struct RegExpObjectData {
             WTF_MAKE_FAST_ALLOCATED;
         public:
-            RegExpObjectData(NonNullPassRefPtr<RegExp> regExp, double lastIndex)
+            RegExpObjectData(NonNullPassRefPtr<RegExp> regExp)
                 : regExp(regExp)
-                , lastIndex(lastIndex)
             {
+                lastIndex.setWithoutWriteBarrier(jsNumber(0));
             }
 
             RefPtr<RegExp> regExp;
-            double lastIndex;
+            WriteBarrier<Unknown> lastIndex;
         };
 #if COMPILER(MSVC)
         friend void WTF::deleteOwnedPtr<RegExpObjectData>(RegExpObjectData*);
diff --git a/Source/JavaScriptCore/runtime/RegExpPrototype.cpp b/Source/JavaScriptCore/runtime/RegExpPrototype.cpp
index 106006c..61747b1 100644
--- a/Source/JavaScriptCore/runtime/RegExpPrototype.cpp
+++ b/Source/JavaScriptCore/runtime/RegExpPrototype.cpp
@@ -48,11 +48,11 @@ static EncodedJSValue JSC_HOST_CALL regExpProtoFuncToString(ExecState*);
 // ECMA 15.10.5
 
 RegExpPrototype::RegExpPrototype(ExecState* exec, JSGlobalObject* globalObject, NonNullPassRefPtr<Structure> structure, Structure* functionStructure)
-    : RegExpObject(globalObject, structure, RegExp::create(&exec->globalData(), "", ""))
+    : RegExpObject(globalObject, structure, RegExp::create(&exec->globalData(), "", NoFlags))
 {
-    putDirectFunctionWithoutTransition(exec, new (exec) JSFunction(exec, globalObject, functionStructure, 0, exec->propertyNames().compile, regExpProtoFuncCompile), DontEnum);
-    putDirectFunctionWithoutTransition(exec, new (exec) JSFunction(exec, globalObject, functionStructure, 0, exec->propertyNames().exec, regExpProtoFuncExec), DontEnum);
-    putDirectFunctionWithoutTransition(exec, new (exec) JSFunction(exec, globalObject, functionStructure, 0, exec->propertyNames().test, regExpProtoFuncTest), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) JSFunction(exec, globalObject, functionStructure, 2, exec->propertyNames().compile, regExpProtoFuncCompile), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) JSFunction(exec, globalObject, functionStructure, 1, exec->propertyNames().exec, regExpProtoFuncExec), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) JSFunction(exec, globalObject, functionStructure, 1, exec->propertyNames().test, regExpProtoFuncTest), DontEnum);
     putDirectFunctionWithoutTransition(exec, new (exec) JSFunction(exec, globalObject, functionStructure, 0, exec->propertyNames().toString, regExpProtoFuncToString), DontEnum);
 }
 
@@ -90,7 +90,17 @@ EncodedJSValue JSC_HOST_CALL regExpProtoFuncCompile(ExecState* exec)
         regExp = asRegExpObject(arg0)->regExp();
     } else {
         UString pattern = !exec->argumentCount() ? UString("") : arg0.toString(exec);
-        UString flags = arg1.isUndefined() ? UString("") : arg1.toString(exec);
+        if (exec->hadException())
+            return JSValue::encode(jsUndefined());
+
+        RegExpFlags flags = NoFlags;
+        if (!arg1.isUndefined()) {
+            flags = regExpFlags(arg1.toString(exec));
+            if (exec->hadException())
+                return JSValue::encode(jsUndefined());
+            if (flags == InvalidFlags)
+                return throwVMError(exec, createSyntaxError(exec, "Invalid flags supplied to RegExp constructor."));
+        }
         regExp = exec->globalData().regExpCache()->lookupOrCreate(pattern, flags);
     }
 
diff --git a/Source/JavaScriptCore/runtime/ScopeChain.h b/Source/JavaScriptCore/runtime/ScopeChain.h
index fbecd11..cb70a34 100644
--- a/Source/JavaScriptCore/runtime/ScopeChain.h
+++ b/Source/JavaScriptCore/runtime/ScopeChain.h
@@ -64,7 +64,7 @@ namespace JSC {
         void print();
 #endif
         
-        static PassRefPtr<Structure> createStructure(JSValue proto) { return Structure::create(proto, TypeInfo(CompoundType, StructureFlags), AnonymousSlotCount, 0); }
+        static PassRefPtr<Structure> createStructure(JSGlobalData& globalData, JSValue proto) { return Structure::create(globalData, proto, TypeInfo(CompoundType, StructureFlags), AnonymousSlotCount, 0); }
         virtual void markChildren(MarkStack&);
     private:
         static const unsigned StructureFlags = OverridesMarkChildren;
@@ -100,7 +100,7 @@ namespace JSC {
         bool operator!=(const ScopeChainIterator& other) const { return m_node != other.m_node; }
 
     private:
-        DeprecatedPtr<ScopeChainNode> m_node;
+        ScopeChainNode* m_node;
     };
 
     inline ScopeChainIterator ScopeChainNode::begin()
@@ -128,6 +128,17 @@ namespace JSC {
     {
         return scopeChain()->globalThis.get();
     }
+    
+    ALWAYS_INLINE ScopeChainNode* Register::scopeChain() const
+    {
+        return static_cast<ScopeChainNode*>(jsValue().asCell());
+    }
+    
+    ALWAYS_INLINE Register& Register::operator=(ScopeChainNode* scopeChain)
+    {
+        *this = JSValue(scopeChain);
+        return *this;
+    }
 
 } // namespace JSC
 
diff --git a/Source/JavaScriptCore/runtime/SmallStrings.cpp b/Source/JavaScriptCore/runtime/SmallStrings.cpp
index 9b193f5..ac67020 100644
--- a/Source/JavaScriptCore/runtime/SmallStrings.cpp
+++ b/Source/JavaScriptCore/runtime/SmallStrings.cpp
@@ -33,8 +33,6 @@
 
 namespace JSC {
 
-static const unsigned numCharactersToStore = 0x100;
-
 static inline bool isMarked(JSCell* string)
 {
     return string && Heap::isMarked(string);
@@ -45,17 +43,22 @@ class SmallStringsStorage {
 public:
     SmallStringsStorage();
 
-    StringImpl* rep(unsigned char character) { return m_reps[character].get(); }
+    StringImpl* rep(unsigned char character)
+    {
+        return m_reps[character].get();
+    }
 
 private:
-    RefPtr<StringImpl> m_reps[numCharactersToStore];
+    static const unsigned singleCharacterStringCount = maxSingleCharacterString + 1;
+
+    RefPtr<StringImpl> m_reps[singleCharacterStringCount];
 };
 
 SmallStringsStorage::SmallStringsStorage()
 {
     UChar* characterBuffer = 0;
-    RefPtr<StringImpl> baseString = StringImpl::createUninitialized(numCharactersToStore, characterBuffer);
-    for (unsigned i = 0; i < numCharactersToStore; ++i) {
+    RefPtr<StringImpl> baseString = StringImpl::createUninitialized(singleCharacterStringCount, characterBuffer);
+    for (unsigned i = 0; i < singleCharacterStringCount; ++i) {
         characterBuffer[i] = i;
         m_reps[i] = StringImpl::create(baseString, i, 1);
     }
@@ -63,7 +66,7 @@ SmallStringsStorage::SmallStringsStorage()
 
 SmallStrings::SmallStrings()
 {
-    COMPILE_ASSERT(numCharactersToStore == sizeof(m_singleCharacterStrings) / sizeof(m_singleCharacterStrings[0]), IsNumCharactersConstInSyncWithClassUsage);
+    COMPILE_ASSERT(singleCharacterStringCount == sizeof(m_singleCharacterStrings) / sizeof(m_singleCharacterStrings[0]), IsNumCharactersConstInSyncWithClassUsage);
     clear();
 }
 
@@ -71,7 +74,7 @@ SmallStrings::~SmallStrings()
 {
 }
 
-void SmallStrings::markChildren(MarkStack& markStack)
+void SmallStrings::markChildren(HeapRootMarker& heapRootMarker)
 {
     /*
        Our hypothesis is that small strings are very common. So, we cache them
@@ -83,9 +86,9 @@ void SmallStrings::markChildren(MarkStack& markStack)
        so, it's probably reasonable to mark the rest. If not, we clear the cache.
      */
 
-    bool isAnyStringMarked = isMarked(m_emptyString.get());
-    for (unsigned i = 0; i < numCharactersToStore && !isAnyStringMarked; ++i)
-        isAnyStringMarked = isMarked(m_singleCharacterStrings[i].get());
+    bool isAnyStringMarked = isMarked(m_emptyString);
+    for (unsigned i = 0; i < singleCharacterStringCount && !isAnyStringMarked; ++i)
+        isAnyStringMarked = isMarked(m_singleCharacterStrings[i]);
     
     if (!isAnyStringMarked) {
         clear();
@@ -93,17 +96,17 @@ void SmallStrings::markChildren(MarkStack& markStack)
     }
     
     if (m_emptyString)
-        markStack.append(&m_emptyString);
-    for (unsigned i = 0; i < numCharactersToStore; ++i) {
+        heapRootMarker.mark(&m_emptyString);
+    for (unsigned i = 0; i < singleCharacterStringCount; ++i) {
         if (m_singleCharacterStrings[i])
-            markStack.append(&m_singleCharacterStrings[i]);
+            heapRootMarker.mark(&m_singleCharacterStrings[i]);
     }
 }
 
 void SmallStrings::clear()
 {
     m_emptyString = 0;
-    for (unsigned i = 0; i < numCharactersToStore; ++i)
+    for (unsigned i = 0; i < singleCharacterStringCount; ++i)
         m_singleCharacterStrings[i] = 0;
 }
 
@@ -112,7 +115,7 @@ unsigned SmallStrings::count() const
     unsigned count = 0;
     if (m_emptyString)
         ++count;
-    for (unsigned i = 0; i < numCharactersToStore; ++i) {
+    for (unsigned i = 0; i < singleCharacterStringCount; ++i) {
         if (m_singleCharacterStrings[i])
             ++count;
     }
diff --git a/Source/JavaScriptCore/runtime/SmallStrings.h b/Source/JavaScriptCore/runtime/SmallStrings.h
index cd9c325..b54d020 100644
--- a/Source/JavaScriptCore/runtime/SmallStrings.h
+++ b/Source/JavaScriptCore/runtime/SmallStrings.h
@@ -33,13 +33,16 @@
 
 namespace JSC {
 
+    class HeapRootMarker;
     class JSGlobalData;
     class JSString;
     class MarkStack;
     class SmallStringsStorage;
 
+    static const unsigned maxSingleCharacterString = 0xFF;
+
     class SmallStrings {
-        WTF_MAKE_NONCOPYABLE(SmallStrings); WTF_MAKE_FAST_ALLOCATED;
+        WTF_MAKE_NONCOPYABLE(SmallStrings);
     public:
         SmallStrings();
         ~SmallStrings();
@@ -48,30 +51,33 @@ namespace JSC {
         {
             if (!m_emptyString)
                 createEmptyString(globalData);
-            return m_emptyString.get();
+            return m_emptyString;
         }
+
         JSString* singleCharacterString(JSGlobalData* globalData, unsigned char character)
         {
             if (!m_singleCharacterStrings[character])
                 createSingleCharacterString(globalData, character);
-            return m_singleCharacterStrings[character].get();
+            return m_singleCharacterStrings[character];
         }
 
         StringImpl* singleCharacterStringRep(unsigned char character);
 
-        void markChildren(MarkStack&);
+        void markChildren(HeapRootMarker&);
         void clear();
 
         unsigned count() const;
 
-        JSCell** singleCharacterStrings() { return m_singleCharacterStrings[0].slot(); }
+        JSString** singleCharacterStrings() { return &m_singleCharacterStrings[0]; }
 
     private:
+        static const unsigned singleCharacterStringCount = maxSingleCharacterString + 1;
+
         void createEmptyString(JSGlobalData*);
         void createSingleCharacterString(JSGlobalData*, unsigned char);
 
-        DeprecatedPtr<JSString> m_emptyString;
-        FixedArray<DeprecatedPtr<JSString>, 0x100> m_singleCharacterStrings;
+        JSString* m_emptyString;
+        JSString* m_singleCharacterStrings[singleCharacterStringCount];
         OwnPtr<SmallStringsStorage> m_storage;
     };
 
diff --git a/Source/JavaScriptCore/runtime/StringConstructor.cpp b/Source/JavaScriptCore/runtime/StringConstructor.cpp
index 5398f31..ed088e4 100644
--- a/Source/JavaScriptCore/runtime/StringConstructor.cpp
+++ b/Source/JavaScriptCore/runtime/StringConstructor.cpp
@@ -67,9 +67,10 @@ StringConstructor::StringConstructor(ExecState* exec, JSGlobalObject* globalObje
 // ECMA 15.5.2
 static EncodedJSValue JSC_HOST_CALL constructWithStringConstructor(ExecState* exec)
 {
+    JSGlobalObject* globalObject = asInternalFunction(exec->callee())->globalObject();
     if (!exec->argumentCount())
-        return JSValue::encode(new (exec) StringObject(exec, exec->lexicalGlobalObject()->stringObjectStructure()));
-    return JSValue::encode(new (exec) StringObject(exec, exec->lexicalGlobalObject()->stringObjectStructure(), exec->argument(0).toString(exec)));
+        return JSValue::encode(new (exec) StringObject(exec, globalObject->stringObjectStructure()));
+    return JSValue::encode(new (exec) StringObject(exec, globalObject->stringObjectStructure(), exec->argument(0).toString(exec)));
 }
 
 ConstructType StringConstructor::getConstructData(ConstructData& constructData)
diff --git a/Source/JavaScriptCore/runtime/StringObject.cpp b/Source/JavaScriptCore/runtime/StringObject.cpp
index 5fe7544..47e5860 100644
--- a/Source/JavaScriptCore/runtime/StringObject.cpp
+++ b/Source/JavaScriptCore/runtime/StringObject.cpp
@@ -30,21 +30,21 @@ ASSERT_CLASS_FITS_IN_CELL(StringObject);
 const ClassInfo StringObject::s_info = { "String", &JSWrapperObject::s_info, 0, 0 };
 
 StringObject::StringObject(ExecState* exec, NonNullPassRefPtr<Structure> structure)
-    : JSWrapperObject(exec->globalData(), structure)
+    : JSWrapperObject(structure)
 {
     ASSERT(inherits(&s_info));
     setInternalValue(exec->globalData(), jsEmptyString(exec));
 }
 
 StringObject::StringObject(JSGlobalData& globalData, NonNullPassRefPtr<Structure> structure, JSString* string)
-    : JSWrapperObject(globalData, structure)
+    : JSWrapperObject(structure)
 {
     ASSERT(inherits(&s_info));
     setInternalValue(globalData, string);
 }
 
 StringObject::StringObject(ExecState* exec, NonNullPassRefPtr<Structure> structure, const UString& string)
-    : JSWrapperObject(exec->globalData(), structure)
+    : JSWrapperObject(structure)
 {
     ASSERT(inherits(&s_info));
     setInternalValue(exec->globalData(), jsString(exec, string));
diff --git a/Source/JavaScriptCore/runtime/StringObject.h b/Source/JavaScriptCore/runtime/StringObject.h
index 99f9add..ae3376d 100644
--- a/Source/JavaScriptCore/runtime/StringObject.h
+++ b/Source/JavaScriptCore/runtime/StringObject.h
@@ -31,7 +31,7 @@ namespace JSC {
         StringObject(ExecState*, NonNullPassRefPtr<Structure>);
         StringObject(ExecState*, NonNullPassRefPtr<Structure>, const UString&);
 
-        static StringObject* create(ExecState*, JSString*);
+        static StringObject* create(ExecState*, JSGlobalObject*, JSString*);
 
         virtual bool getOwnPropertySlot(ExecState*, const Identifier& propertyName, PropertySlot&);
         virtual bool getOwnPropertySlot(ExecState*, unsigned propertyName, PropertySlot&);
@@ -45,15 +45,15 @@ namespace JSC {
 
         JSString* internalValue() const { return asString(JSWrapperObject::internalValue());}
 
-        static PassRefPtr<Structure> createStructure(JSValue prototype)
+        static PassRefPtr<Structure> createStructure(JSGlobalData& globalData, JSValue prototype)
         {
-            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
+            return Structure::create(globalData, prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
         }
 
     protected:
-        static const unsigned StructureFlags = OverridesGetOwnPropertySlot | OverridesMarkChildren | OverridesGetPropertyNames | JSWrapperObject::StructureFlags;
+        static const unsigned StructureFlags = OverridesGetOwnPropertySlot | OverridesGetPropertyNames | JSWrapperObject::StructureFlags;
         StringObject(JSGlobalData&, NonNullPassRefPtr<Structure>, JSString*);
-  };
+    };
 
     StringObject* asStringObject(JSValue);
 
diff --git a/Source/JavaScriptCore/runtime/StringObjectThatMasqueradesAsUndefined.h b/Source/JavaScriptCore/runtime/StringObjectThatMasqueradesAsUndefined.h
index 0a44ed3..e4c7061 100644
--- a/Source/JavaScriptCore/runtime/StringObjectThatMasqueradesAsUndefined.h
+++ b/Source/JavaScriptCore/runtime/StringObjectThatMasqueradesAsUndefined.h
@@ -33,7 +33,7 @@ namespace JSC {
         static StringObjectThatMasqueradesAsUndefined* create(ExecState* exec, const UString& string)
         {
             return new (exec) StringObjectThatMasqueradesAsUndefined(exec,
-                createStructure(exec->lexicalGlobalObject()->stringPrototype()), string);
+                createStructure(exec->globalData(), exec->lexicalGlobalObject()->stringPrototype()), string);
         }
 
     private:
@@ -42,9 +42,9 @@ namespace JSC {
         {
         }
 
-        static PassRefPtr<Structure> createStructure(JSValue proto) 
+        static PassRefPtr<Structure> createStructure(JSGlobalData& globalData, JSValue proto) 
         { 
-            return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info); 
+            return Structure::create(globalData, proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info); 
         }
 
         static const unsigned StructureFlags = OverridesGetOwnPropertySlot | MasqueradesAsUndefined | OverridesGetPropertyNames | StringObject::StructureFlags;
diff --git a/Source/JavaScriptCore/runtime/StringPrototype.cpp b/Source/JavaScriptCore/runtime/StringPrototype.cpp
index aa37122..a6bf4e6 100644
--- a/Source/JavaScriptCore/runtime/StringPrototype.cpp
+++ b/Source/JavaScriptCore/runtime/StringPrototype.cpp
@@ -604,9 +604,7 @@ EncodedJSValue JSC_HOST_CALL stringProtoFuncMatch(ExecState* exec)
 
     JSValue a0 = exec->argument(0);
 
-    UString u = s;
     RefPtr<RegExp> reg;
-    RegExpObject* imp = 0;
     if (a0.inherits(&RegExpObject::s_info))
         reg = asRegExpObject(a0)->regExp();
     else {
@@ -615,12 +613,12 @@ EncodedJSValue JSC_HOST_CALL stringProtoFuncMatch(ExecState* exec)
          *  If regexp is not an object whose [[Class]] property is "RegExp", it is
          *  replaced with the result of the expression new RegExp(regexp).
          */
-        reg = exec->globalData().regExpCache()->lookupOrCreate(a0.toString(exec), UString());
+        reg = exec->globalData().regExpCache()->lookupOrCreate(a0.toString(exec), NoFlags);
     }
     RegExpConstructor* regExpConstructor = exec->lexicalGlobalObject()->regExpConstructor();
     int pos;
     int matchLength = 0;
-    regExpConstructor->performMatch(reg.get(), u, 0, pos, matchLength);
+    regExpConstructor->performMatch(reg.get(), s, 0, pos, matchLength);
     if (!(reg->global())) {
         // case without 'g' flag is handled like RegExp.prototype.exec
         if (pos < 0)
@@ -630,15 +628,13 @@ EncodedJSValue JSC_HOST_CALL stringProtoFuncMatch(ExecState* exec)
 
     // return array of matches
     MarkedArgumentBuffer list;
-    int lastIndex = 0;
+    unsigned lastIndex = 0;
     while (pos >= 0) {
-        list.append(jsSubstring(exec, u, pos, matchLength));
+        list.append(jsSubstring(exec, s, pos, matchLength));
         lastIndex = pos;
         pos += matchLength == 0 ? 1 : matchLength;
-        regExpConstructor->performMatch(reg.get(), u, pos, pos, matchLength);
+        regExpConstructor->performMatch(reg.get(), s, pos, pos, matchLength);
     }
-    if (imp)
-        imp->setLastIndex(lastIndex);
     if (list.isEmpty()) {
         // if there are no matches at all, it's important to return
         // Null instead of an empty array, because this matches
@@ -658,7 +654,6 @@ EncodedJSValue JSC_HOST_CALL stringProtoFuncSearch(ExecState* exec)
 
     JSValue a0 = exec->argument(0);
 
-    UString u = s;
     RefPtr<RegExp> reg;
     if (a0.inherits(&RegExpObject::s_info))
         reg = asRegExpObject(a0)->regExp();
@@ -668,12 +663,12 @@ EncodedJSValue JSC_HOST_CALL stringProtoFuncSearch(ExecState* exec)
          *  If regexp is not an object whose [[Class]] property is "RegExp", it is
          *  replaced with the result of the expression new RegExp(regexp).
          */
-        reg = exec->globalData().regExpCache()->lookupOrCreate(a0.toString(exec), UString());
+        reg = exec->globalData().regExpCache()->lookupOrCreate(a0.toString(exec), NoFlags);
     }
     RegExpConstructor* regExpConstructor = exec->lexicalGlobalObject()->regExpConstructor();
     int pos;
     int matchLength = 0;
-    regExpConstructor->performMatch(reg.get(), u, 0, pos, matchLength);
+    regExpConstructor->performMatch(reg.get(), s, 0, pos, matchLength);
     return JSValue::encode(jsNumber(pos));
 }
 
diff --git a/Source/JavaScriptCore/runtime/StringPrototype.h b/Source/JavaScriptCore/runtime/StringPrototype.h
index feea2e2..57def22 100644
--- a/Source/JavaScriptCore/runtime/StringPrototype.h
+++ b/Source/JavaScriptCore/runtime/StringPrototype.h
@@ -34,12 +34,18 @@ namespace JSC {
         virtual bool getOwnPropertySlot(ExecState*, const Identifier& propertyName, PropertySlot&);
         virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
 
-        static PassRefPtr<Structure> createStructure(JSValue prototype)
+        static PassRefPtr<Structure> createStructure(JSGlobalData& globalData, JSValue prototype)
         {
-            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
+            return Structure::create(globalData, prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
         }
 
         static const ClassInfo s_info;
+        
+    protected:
+        static const unsigned StructureFlags = OverridesGetOwnPropertySlot | StringObject::StructureFlags;
+
+        COMPILE_ASSERT(!StringObject::AnonymousSlotCount, StringPrototype_stomps_on_your_anonymous_slot);
+        static const unsigned AnonymousSlotCount = 1;
     };
 
 } // namespace JSC
diff --git a/Source/JavaScriptCore/runtime/Structure.h b/Source/JavaScriptCore/runtime/Structure.h
index bf27334..c9f900a 100644
--- a/Source/JavaScriptCore/runtime/Structure.h
+++ b/Source/JavaScriptCore/runtime/Structure.h
@@ -32,7 +32,6 @@
 #include "PropertyMapHashTable.h"
 #include "PropertyNameArray.h"
 #include "Protect.h"
-#include "StructureChain.h"
 #include "StructureTransitionTable.h"
 #include "JSTypeInfo.h"
 #include "UString.h"
@@ -46,6 +45,7 @@ namespace JSC {
     class MarkStack;
     class PropertyNameArray;
     class PropertyNameArrayData;
+    class StructureChain;
 
     struct ClassInfo;
 
@@ -56,13 +56,18 @@ namespace JSC {
 
     class Structure : public RefCounted<Structure> {
     public:
-        friend class JIT;
         friend class StructureTransitionTable;
-        static PassRefPtr<Structure> create(JSValue prototype, const TypeInfo& typeInfo, unsigned anonymousSlotCount, const ClassInfo* classInfo)
+        static PassRefPtr<Structure> create(JSGlobalData&, JSValue prototype, const TypeInfo& typeInfo, unsigned anonymousSlotCount, const ClassInfo* classInfo)
         {
             return adoptRef(new Structure(prototype, typeInfo, anonymousSlotCount, classInfo));
         }
 
+        enum VPtrStealingHackType { VPtrStealingHack };
+        static PassRefPtr<Structure> create(VPtrStealingHackType, const ClassInfo* classInfo)
+        {
+            return adoptRef(new Structure(jsNull(), TypeInfo(UnspecifiedType), 0, classInfo));
+        }
+
         static void startIgnoringLeaks();
         static void stopIgnoringLeaks();
 
@@ -102,6 +107,7 @@ namespace JSC {
         DeprecatedPtr<Unknown>* storedPrototypeSlot() { return &m_prototype; }
         JSValue prototypeForLookup(ExecState*) const;
         StructureChain* prototypeChain(ExecState*) const;
+        DeprecatedPtr<StructureChain>* cachedPrototypeChainSlot() { return &m_cachedPrototypeChain; }
 
         Structure* previousID() const { return m_previous.get(); }
 
@@ -140,6 +146,21 @@ namespace JSC {
 
         static void initializeThreading();
 
+        static ptrdiff_t prototypeOffset()
+        {
+            return OBJECT_OFFSETOF(Structure, m_prototype);
+        }
+
+        static ptrdiff_t typeInfoFlagsOffset()
+        {
+            return OBJECT_OFFSETOF(Structure, m_typeInfo) + TypeInfo::flagsOffset();
+        }
+
+        static ptrdiff_t typeInfoTypeOffset()
+        {
+            return OBJECT_OFFSETOF(Structure, m_typeInfo) + TypeInfo::typeOffset();
+        }
+
     private:
         Structure(JSValue prototype, const TypeInfo&, unsigned anonymousSlotCount, const ClassInfo*);
         Structure(const Structure*);
@@ -190,7 +211,7 @@ namespace JSC {
         TypeInfo m_typeInfo;
 
         DeprecatedPtr<Unknown> m_prototype;
-        mutable RefPtr<StructureChain> m_cachedPrototypeChain;
+        mutable DeprecatedPtr<StructureChain> m_cachedPrototypeChain;
 
         RefPtr<Structure> m_previous;
         RefPtr<StringImpl> m_nameInPrevious;
diff --git a/Source/JavaScriptCore/runtime/StructureChain.cpp b/Source/JavaScriptCore/runtime/StructureChain.cpp
index e4523c3..4fa4a4b 100644
--- a/Source/JavaScriptCore/runtime/StructureChain.cpp
+++ b/Source/JavaScriptCore/runtime/StructureChain.cpp
@@ -32,7 +32,8 @@
 
 namespace JSC {
 
-StructureChain::StructureChain(Structure* head)
+StructureChain::StructureChain(NonNullPassRefPtr<Structure> structure, Structure* head)
+    : JSCell(structure.releaseRef())
 {
     size_t size = 0;
     for (Structure* current = head; current; current = current->storedPrototype().isNull() ? 0 : asObject(current->storedPrototype())->structure())
diff --git a/Source/JavaScriptCore/runtime/StructureChain.h b/Source/JavaScriptCore/runtime/StructureChain.h
index 816b66d..88592dc 100644
--- a/Source/JavaScriptCore/runtime/StructureChain.h
+++ b/Source/JavaScriptCore/runtime/StructureChain.h
@@ -26,6 +26,8 @@
 #ifndef StructureChain_h
 #define StructureChain_h
 
+#include "JSCell.h"
+
 #include <wtf/OwnArrayPtr.h>
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefCounted.h>
@@ -35,15 +37,16 @@ namespace JSC {
 
     class Structure;
 
-    class StructureChain : public RefCounted<StructureChain> {
+    class StructureChain : public JSCell {
         friend class JIT;
 
     public:
-        static PassRefPtr<StructureChain> create(Structure* head) { return adoptRef(new StructureChain(head)); }
+        static StructureChain* create(JSGlobalData& globalData, Structure* head) { return new (&globalData) StructureChain(globalData.structureChainStructure, head); }
         RefPtr<Structure>* head() { return m_vector.get(); }
 
+        static PassRefPtr<Structure> createStructure(JSGlobalData& globalData, JSValue prototype) { return Structure::create(globalData, prototype, TypeInfo(CompoundType, OverridesMarkChildren), 0, 0); }
     private:
-        StructureChain(Structure* head);
+        StructureChain(NonNullPassRefPtr<Structure>, Structure* head);
 
         OwnArrayPtr<RefPtr<Structure> > m_vector;
     };
diff --git a/Source/JavaScriptCore/runtime/TimeoutChecker.cpp b/Source/JavaScriptCore/runtime/TimeoutChecker.cpp
index 04d904d..d3867d4 100644
--- a/Source/JavaScriptCore/runtime/TimeoutChecker.cpp
+++ b/Source/JavaScriptCore/runtime/TimeoutChecker.cpp
@@ -101,7 +101,7 @@ static inline unsigned getCPUTime()
 
     // use a relative time from first call in order to avoid an overflow
     static double firstTime = currentTime();
-    return (currentTime() - firstTime) * 1000;
+    return static_cast<unsigned> ((currentTime() - firstTime) * 1000);
 #endif
 }
 
diff --git a/Source/JavaScriptCore/runtime/WriteBarrier.h b/Source/JavaScriptCore/runtime/WriteBarrier.h
index 44840ad..af018a8 100644
--- a/Source/JavaScriptCore/runtime/WriteBarrier.h
+++ b/Source/JavaScriptCore/runtime/WriteBarrier.h
@@ -35,6 +35,7 @@ class JSGlobalData;
 typedef enum { } Unknown;
 typedef JSValue* HandleSlot;
 
+// FIXME: Remove all uses of this class.
 template <class T> class DeprecatedPtr {
 public:
     DeprecatedPtr() : m_cell(0) { }
@@ -54,6 +55,7 @@ protected:
     JSCell* m_cell;
 };
 
+// FIXME: Remove all uses of this class.
 template <> class DeprecatedPtr<Unknown> {
 public:
     DeprecatedPtr() { }
@@ -73,17 +75,23 @@ private:
     JSValue m_value;
 };
 
-template <typename T> struct WriteBarrierCheck {
+template <typename U, typename V> inline bool operator==(const DeprecatedPtr<U>& lhs, const DeprecatedPtr<V>& rhs)
+{
+    return lhs.get() == rhs.get();
+}
+
+template <typename T> struct JSValueChecker {
     static const bool IsJSValue = false;
 };
 
-template <> struct WriteBarrierCheck<JSValue> {
+template <> struct JSValueChecker<JSValue> {
     static const bool IsJSValue = true;
 };
 
+// We have a separate base class with no constructors for use in Unions.
 template <typename T> class WriteBarrierBase {
 public:
-    COMPILE_ASSERT(!WriteBarrierCheck<T>::IsJSValue, WriteBarrier_JSValue_is_invalid__use_unknown);
+    COMPILE_ASSERT(!JSValueChecker<T>::IsJSValue, WriteBarrier_JSValue_is_invalid__use_unknown);
     void set(JSGlobalData&, const JSCell*, T* value) { this->m_cell = reinterpret_cast<JSCell*>(value); }
     
     T* get() const { return reinterpret_cast<T*>(m_cell); }
@@ -100,20 +108,10 @@ public:
 
     void setWithoutWriteBarrier(T* value) { this->m_cell = reinterpret_cast<JSCell*>(value); }
 
-protected:
+private:
     JSCell* m_cell;
 };
 
-template <typename T> class WriteBarrier : public WriteBarrierBase<T> {
-public:
-    WriteBarrier() { this->m_cell = 0; }
-    WriteBarrier(JSGlobalData& globalData, const JSCell* owner, T* value)
-    {
-        this->set(globalData, owner, value);
-    }
-
-};
-
 template <> class WriteBarrierBase<Unknown> {
 public:
     void set(JSGlobalData&, const JSCell*, JSValue value) { m_value = JSValue::encode(value); }
@@ -138,29 +136,41 @@ public:
     operator UnspecifiedBoolType*() const { return get() ? reinterpret_cast<UnspecifiedBoolType*>(1) : 0; }
     bool operator!() const { return !get(); } 
     
-protected:
+private:
     EncodedJSValue m_value;
 };
 
+template <typename T> class WriteBarrier : public WriteBarrierBase<T> {
+public:
+    WriteBarrier()
+    {
+        this->setWithoutWriteBarrier(0);
+    }
+
+    WriteBarrier(JSGlobalData& globalData, const JSCell* owner, T* value)
+    {
+        this->set(globalData, owner, value);
+    }
+};
+
 template <> class WriteBarrier<Unknown> : public WriteBarrierBase<Unknown> {
 public:
-    WriteBarrier() { m_value = JSValue::encode(JSValue()); }
+    WriteBarrier()
+    {
+        this->setWithoutWriteBarrier(JSValue());
+    }
+
     WriteBarrier(JSGlobalData& globalData, const JSCell* owner, JSValue value)
     {
         this->set(globalData, owner, value);
     }
 };
 
-template <typename U, typename V> inline bool operator==(const DeprecatedPtr<U>& lhs, const DeprecatedPtr<V>& rhs)
-{
-    return lhs.get() == rhs.get();
-}
-
 template <typename U, typename V> inline bool operator==(const WriteBarrierBase<U>& lhs, const WriteBarrierBase<V>& rhs)
 {
     return lhs.get() == rhs.get();
 }
 
-}
+} // namespace JSC
 
 #endif // WriteBarrier_h
diff --git a/Source/JavaScriptCore/tests/mozilla/js1_2/regexp/RegExp_input.js b/Source/JavaScriptCore/tests/mozilla/js1_2/regexp/RegExp_input.js
index 01c145c..26db14c 100644
--- a/Source/JavaScriptCore/tests/mozilla/js1_2/regexp/RegExp_input.js
+++ b/Source/JavaScriptCore/tests/mozilla/js1_2/regexp/RegExp_input.js
@@ -50,40 +50,40 @@
 	testcases[count++] = new TestCase ( SECTION, "RegExp.input = 'abcd12357efg'; /\\d+/.exec('2345')",
 	                                    String(["2345"]), String(/\d+/.exec('2345')));
 
-    // RegExp.input = "abcd12357efg"; /\d+/.exec()
+    // RegExp.input = "abcd12357efg"; /\d+/.exec(RegExp.input)
     RegExp.input = "abcd12357efg";
-	testcases[count++] = new TestCase ( SECTION, "RegExp.input = 'abcd12357efg'; /\\d+/.exec()",
-	                                    String(["12357"]), String(/\d+/.exec()));
+	testcases[count++] = new TestCase ( SECTION, "RegExp.input = 'abcd12357efg'; /\\d+/.exec(RegExp.input)",
+	                                    String(["12357"]), String(/\d+/.exec(RegExp.input)));
 
-    // RegExp.input = "abcd12357efg"; /[h-z]+/.exec()
+    // RegExp.input = "abcd12357efg"; /[h-z]+/.exec(RegExp.input)
     RegExp.input = "abcd12357efg";
-	testcases[count++] = new TestCase ( SECTION, "RegExp.input = 'abcd12357efg'; /[h-z]+/.exec()",
-	                                    null, /[h-z]+/.exec());
+	testcases[count++] = new TestCase ( SECTION, "RegExp.input = 'abcd12357efg'; /[h-z]+/.exec(RegExp.input)",
+	                                    null, /[h-z]+/.exec(RegExp.input));
 
     // RegExp.input = "abcd12357efg"; /\d+/.test('2345')
     RegExp.input = "abcd12357efg";
 	testcases[count++] = new TestCase ( SECTION, "RegExp.input = 'abcd12357efg'; /\\d+/.test('2345')",
 	                                    true, /\d+/.test('2345'));
 
-    // RegExp.input = "abcd12357efg"; /\d+/.test()
+    // RegExp.input = "abcd12357efg"; /\d+/.test(RegExp.input)
     RegExp.input = "abcd12357efg";
-	testcases[count++] = new TestCase ( SECTION, "RegExp.input = 'abcd12357efg'; /\\d+/.test()",
-	                                    true, /\d+/.test());
+	testcases[count++] = new TestCase ( SECTION, "RegExp.input = 'abcd12357efg'; /\\d+/.test(RegExp.input)",
+	                                    true, /\d+/.test(RegExp.input));
 
-    // RegExp.input = "abcd12357efg"; (new RegExp('d+')).test()
+    // RegExp.input = "abcd12357efg"; (new RegExp('d+')).test(RegExp.input)
     RegExp.input = "abcd12357efg";
-	testcases[count++] = new TestCase ( SECTION, "RegExp.input = 'abcd12357efg'; (new RegExp('d+')).test()",
-	                                    true, (new RegExp('d+')).test());
+	testcases[count++] = new TestCase ( SECTION, "RegExp.input = 'abcd12357efg'; (new RegExp('d+')).test(RegExp.input)",
+	                                    true, (new RegExp('d+')).test(RegExp.input));
 
-    // RegExp.input = "abcd12357efg"; /[h-z]+/.test()
+    // RegExp.input = "abcd12357efg"; /[h-z]+/.test(RegExp.input)
     RegExp.input = "abcd12357efg";
-	testcases[count++] = new TestCase ( SECTION, "RegExp.input = 'abcd12357efg'; /[h-z]+/.test()",
-	                                    false, /[h-z]+/.test());
+	testcases[count++] = new TestCase ( SECTION, "RegExp.input = 'abcd12357efg'; /[h-z]+/.test(RegExp.input)",
+	                                    false, /[h-z]+/.test(RegExp.input));
 
-    // RegExp.input = "abcd12357efg"; (new RegExp('[h-z]+')).test()
+    // RegExp.input = "abcd12357efg"; (new RegExp('[h-z]+')).test(RegExp.input)
     RegExp.input = "abcd12357efg";
-	testcases[count++] = new TestCase ( SECTION, "RegExp.input = 'abcd12357efg'; (new RegExp('[h-z]+')).test()",
-	                                    false, (new RegExp('[h-z]+')).test());
+	testcases[count++] = new TestCase ( SECTION, "RegExp.input = 'abcd12357efg'; (new RegExp('[h-z]+')).test(RegExp.input)",
+	                                    false, (new RegExp('[h-z]+')).test(RegExp.input));
 
 	function test()
 	{
diff --git a/Source/JavaScriptCore/tests/mozilla/js1_2/regexp/RegExp_input_as_array.js b/Source/JavaScriptCore/tests/mozilla/js1_2/regexp/RegExp_input_as_array.js
index a1ed113..9afdb14 100644
--- a/Source/JavaScriptCore/tests/mozilla/js1_2/regexp/RegExp_input_as_array.js
+++ b/Source/JavaScriptCore/tests/mozilla/js1_2/regexp/RegExp_input_as_array.js
@@ -50,40 +50,40 @@
 	testcases[count++] = new TestCase ( SECTION, "RegExp['$_'] = 'abcd12357efg'; /\\d+/.exec('2345')",
 	                                    String(["2345"]), String(/\d+/.exec('2345')));
 
-    // RegExp['$_'] = "abcd12357efg"; /\d+/.exec()
+    // RegExp['$_'] = "abcd12357efg"; /\d+/.exec(RegExp.input)
     RegExp['$_'] = "abcd12357efg";
-	testcases[count++] = new TestCase ( SECTION, "RegExp['$_'] = 'abcd12357efg'; /\\d+/.exec()",
-	                                    String(["12357"]), String(/\d+/.exec()));
+	testcases[count++] = new TestCase ( SECTION, "RegExp['$_'] = 'abcd12357efg'; /\\d+/.exec(RegExp.input)",
+	                                    String(["12357"]), String(/\d+/.exec(RegExp.input)));
 
-    // RegExp['$_'] = "abcd12357efg"; /[h-z]+/.exec()
+    // RegExp['$_'] = "abcd12357efg"; /[h-z]+/.exec(RegExp.input)
     RegExp['$_'] = "abcd12357efg";
-	testcases[count++] = new TestCase ( SECTION, "RegExp['$_'] = 'abcd12357efg'; /[h-z]+/.exec()",
-	                                    null, /[h-z]+/.exec());
+	testcases[count++] = new TestCase ( SECTION, "RegExp['$_'] = 'abcd12357efg'; /[h-z]+/.exec(RegExp.input)",
+	                                    null, /[h-z]+/.exec(RegExp.input));
 
     // RegExp['$_'] = "abcd12357efg"; /\d+/.test('2345')
     RegExp['$_'] = "abcd12357efg";
 	testcases[count++] = new TestCase ( SECTION, "RegExp['$_'] = 'abcd12357efg'; /\\d+/.test('2345')",
 	                                    true, /\d+/.test('2345'));
 
-    // RegExp['$_'] = "abcd12357efg"; /\d+/.test()
+    // RegExp['$_'] = "abcd12357efg"; /\d+/.test(RegExp.input)
     RegExp['$_'] = "abcd12357efg";
-	testcases[count++] = new TestCase ( SECTION, "RegExp['$_'] = 'abcd12357efg'; /\\d+/.test()",
-	                                    true, /\d+/.test());
+	testcases[count++] = new TestCase ( SECTION, "RegExp['$_'] = 'abcd12357efg'; /\\d+/.test(RegExp.input)",
+	                                    true, /\d+/.test(RegExp.input));
 
-    // RegExp['$_'] = "abcd12357efg"; /[h-z]+/.test()
+    // RegExp['$_'] = "abcd12357efg"; /[h-z]+/.test(RegExp.input)
     RegExp['$_'] = "abcd12357efg";
-	testcases[count++] = new TestCase ( SECTION, "RegExp['$_'] = 'abcd12357efg'; /[h-z]+/.test()",
-	                                    false, /[h-z]+/.test());
+	testcases[count++] = new TestCase ( SECTION, "RegExp['$_'] = 'abcd12357efg'; /[h-z]+/.test(RegExp.input)",
+	                                    false, /[h-z]+/.test(RegExp.input));
 
-    // RegExp['$_'] = "abcd12357efg"; (new RegExp('\d+')).test()
+    // RegExp['$_'] = "abcd12357efg"; (new RegExp('\d+')).test(RegExp.input)
     RegExp['$_'] = "abcd12357efg";
-	testcases[count++] = new TestCase ( SECTION, "RegExp['$_'] = 'abcd12357efg'; (new RegExp('\d+')).test()",
-	                                    true, (new RegExp('\d+')).test());
+	testcases[count++] = new TestCase ( SECTION, "RegExp['$_'] = 'abcd12357efg'; (new RegExp('\d+')).test(RegExp.input)",
+	                                    true, (new RegExp('\d+')).test(RegExp.input));
 
-    // RegExp['$_'] = "abcd12357efg"; (new RegExp('[h-z]+')).test()
+    // RegExp['$_'] = "abcd12357efg"; (new RegExp('[h-z]+')).test(RegExp.input)
     RegExp['$_'] = "abcd12357efg";
-	testcases[count++] = new TestCase ( SECTION, "RegExp['$_'] = 'abcd12357efg'; (new RegExp('[h-z]+')).test()",
-	                                    false, (new RegExp('[h-z]+')).test());
+	testcases[count++] = new TestCase ( SECTION, "RegExp['$_'] = 'abcd12357efg'; (new RegExp('[h-z]+')).test(RegExp.input)",
+	                                    false, (new RegExp('[h-z]+')).test(RegExp.input));
 
 	function test()
 	{
diff --git a/Source/JavaScriptCore/wtf/Assertions.cpp b/Source/JavaScriptCore/wtf/Assertions.cpp
index 3c4fc77..77e30c1 100644
--- a/Source/JavaScriptCore/wtf/Assertions.cpp
+++ b/Source/JavaScriptCore/wtf/Assertions.cpp
@@ -24,6 +24,12 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
+// The vprintf_stderr_common function triggers this error in the Mac build.
+// Feel free to remove this pragma if this file builds on Mac.
+// According to http://gcc.gnu.org/onlinedocs/gcc-4.2.1/gcc/Diagnostic-Pragmas.html#Diagnostic-Pragmas
+// we need to place this directive before any data or functions are defined.
+#pragma GCC diagnostic ignored "-Wmissing-format-attribute"
+
 #include "config.h"
 #include "Assertions.h"
 
diff --git a/Source/JavaScriptCore/wtf/Assertions.h b/Source/JavaScriptCore/wtf/Assertions.h
index 13ece31..1d108e4 100644
--- a/Source/JavaScriptCore/wtf/Assertions.h
+++ b/Source/JavaScriptCore/wtf/Assertions.h
@@ -142,14 +142,14 @@ typedef struct {
     WTFLogChannelState state;
 } WTFLogChannel;
 
-void WTFReportAssertionFailure(const char* file, int line, const char* function, const char* assertion);
-void WTFReportAssertionFailureWithMessage(const char* file, int line, const char* function, const char* assertion, const char* format, ...) WTF_ATTRIBUTE_PRINTF(5, 6);
-void WTFReportArgumentAssertionFailure(const char* file, int line, const char* function, const char* argName, const char* assertion);
-void WTFReportBacktrace();
-void WTFReportFatalError(const char* file, int line, const char* function, const char* format, ...) WTF_ATTRIBUTE_PRINTF(4, 5);
-void WTFReportError(const char* file, int line, const char* function, const char* format, ...) WTF_ATTRIBUTE_PRINTF(4, 5);
-void WTFLog(WTFLogChannel* channel, const char* format, ...) WTF_ATTRIBUTE_PRINTF(2, 3);
-void WTFLogVerbose(const char* file, int line, const char* function, WTFLogChannel* channel, const char* format, ...) WTF_ATTRIBUTE_PRINTF(5, 6);
+WTF_EXPORT_PRIVATE void WTFReportAssertionFailure(const char* file, int line, const char* function, const char* assertion);
+WTF_EXPORT_PRIVATE void WTFReportAssertionFailureWithMessage(const char* file, int line, const char* function, const char* assertion, const char* format, ...) WTF_ATTRIBUTE_PRINTF(5, 6);
+WTF_EXPORT_PRIVATE void WTFReportArgumentAssertionFailure(const char* file, int line, const char* function, const char* argName, const char* assertion);
+WTF_EXPORT_PRIVATE void WTFReportBacktrace();
+WTF_EXPORT_PRIVATE void WTFReportFatalError(const char* file, int line, const char* function, const char* format, ...) WTF_ATTRIBUTE_PRINTF(4, 5);
+WTF_EXPORT_PRIVATE void WTFReportError(const char* file, int line, const char* function, const char* format, ...) WTF_ATTRIBUTE_PRINTF(4, 5);
+WTF_EXPORT_PRIVATE void WTFLog(WTFLogChannel*, const char* format, ...) WTF_ATTRIBUTE_PRINTF(2, 3);
+WTF_EXPORT_PRIVATE void WTFLogVerbose(const char* file, int line, const char* function, WTFLogChannel*, const char* format, ...) WTF_ATTRIBUTE_PRINTF(5, 6);
 
 #ifdef __cplusplus
 }
diff --git a/Source/JavaScriptCore/wtf/Atomics.h b/Source/JavaScriptCore/wtf/Atomics.h
index 1d190a3..1ebd487 100644
--- a/Source/JavaScriptCore/wtf/Atomics.h
+++ b/Source/JavaScriptCore/wtf/Atomics.h
@@ -78,7 +78,7 @@
 namespace WTF {
 
 #if OS(WINDOWS)
-#define WTF_USE_LOCKFREE_THREADSAFESHARED 1
+#define WTF_USE_LOCKFREE_THREADSAFEREFCOUNTED 1
 
 #if COMPILER(MINGW) || COMPILER(MSVC7_OR_LOWER) || OS(WINCE)
 inline int atomicIncrement(int* addend) { return InterlockedIncrement(reinterpret_cast<long*>(addend)); }
@@ -89,7 +89,7 @@ inline int atomicDecrement(int volatile* addend) { return InterlockedDecrement(r
 #endif
 
 #elif OS(DARWIN)
-#define WTF_USE_LOCKFREE_THREADSAFESHARED 1
+#define WTF_USE_LOCKFREE_THREADSAFEREFCOUNTED 1
 
 inline int atomicIncrement(int volatile* addend) { return OSAtomicIncrement32Barrier(const_cast<int*>(addend)); }
 inline int atomicDecrement(int volatile* addend) { return OSAtomicDecrement32Barrier(const_cast<int*>(addend)); }
@@ -100,7 +100,7 @@ inline int atomicIncrement(int volatile* addend) { return android_atomic_inc(add
 inline int atomicDecrement(int volatile* addend) { return android_atomic_dec(addend); }
 
 #elif COMPILER(GCC) && !CPU(SPARC64) && !OS(SYMBIAN) // sizeof(_Atomic_word) != sizeof(int) on sparc64 gcc
-#define WTF_USE_LOCKFREE_THREADSAFESHARED 1
+#define WTF_USE_LOCKFREE_THREADSAFEREFCOUNTED 1
 
 inline int atomicIncrement(int volatile* addend) { return __gnu_cxx::__exchange_and_add(addend, 1) + 1; }
 inline int atomicDecrement(int volatile* addend) { return __gnu_cxx::__exchange_and_add(addend, -1) - 1; }
@@ -109,7 +109,7 @@ inline int atomicDecrement(int volatile* addend) { return __gnu_cxx::__exchange_
 
 } // namespace WTF
 
-#if USE(LOCKFREE_THREADSAFESHARED)
+#if USE(LOCKFREE_THREADSAFEREFCOUNTED)
 using WTF::atomicDecrement;
 using WTF::atomicIncrement;
 #endif
diff --git a/Source/JavaScriptCore/wtf/CMakeLists.txt b/Source/JavaScriptCore/wtf/CMakeLists.txt
index c27b2e5..304be73 100644
--- a/Source/JavaScriptCore/wtf/CMakeLists.txt
+++ b/Source/JavaScriptCore/wtf/CMakeLists.txt
@@ -30,6 +30,7 @@ SET(WTF_HEADERS
     HashSet.h
     HashTable.h
     HashTraits.h
+    HexNumber.h
     ListHashSet.h
     ListRefPtr.h
     Locker.h
@@ -76,7 +77,7 @@ SET(WTF_HEADERS
     TCSpinLock.h
     TCSystemAlloc.h
     ThreadIdentifierDataPthreads.h
-    ThreadSafeShared.h
+    ThreadSafeRefCounted.h
     ThreadSpecific.h
     Threading.h
     ThreadingPrimitives.h
diff --git a/Source/JavaScriptCore/wtf/CrossThreadRefCounted.h b/Source/JavaScriptCore/wtf/CrossThreadRefCounted.h
index 8b65977..9d093ee 100644
--- a/Source/JavaScriptCore/wtf/CrossThreadRefCounted.h
+++ b/Source/JavaScriptCore/wtf/CrossThreadRefCounted.h
@@ -38,10 +38,10 @@
 
 namespace WTF {
 
-    // Used to allowing sharing data across classes and threads (like ThreadedSafeShared).
+    // Used to allowing sharing data across classes and threads (like ThreadSafeRefCounted).
     //
-    // Why not just use ThreadSafeShared?
-    // ThreadSafeShared can have a significant perf impact when used in low level classes
+    // Why not just use ThreadSafeRefCounted?
+    // ThreadSafeRefCounted can have a significant perf impact when used in low level classes
     // (like UString) that get ref/deref'ed a lot. This class has the benefit of doing fast ref
     // counts like RefPtr whenever possible, but it has the downside that you need to copy it
     // to use it on another thread.
@@ -72,7 +72,7 @@ namespace WTF {
         }
 
     private:
-        CrossThreadRefCounted(T* data, ThreadSafeSharedBase* threadedCounter)
+        CrossThreadRefCounted(T* data, ThreadSafeRefCountedBase* threadedCounter)
             : m_threadSafeRefCounter(threadedCounter)
             , m_data(data)
 #ifndef NDEBUG
@@ -97,7 +97,7 @@ namespace WTF {
 #endif
 
         RefCountedBase m_refCounter;
-        ThreadSafeSharedBase* m_threadSafeRefCounter;
+        ThreadSafeRefCountedBase* m_threadSafeRefCounter;
         T* m_data;
 #ifndef NDEBUG
         ThreadIdentifier m_threadId;
@@ -154,7 +154,7 @@ namespace WTF {
         if (m_threadSafeRefCounter)
             m_threadSafeRefCounter->ref();
         else
-            m_threadSafeRefCounter = new ThreadSafeSharedBase(2);
+            m_threadSafeRefCounter = new ThreadSafeRefCountedBase(2);
 
         return adoptRef(new CrossThreadRefCounted<T>(m_data, m_threadSafeRefCounter));
     }
diff --git a/Source/JavaScriptCore/wtf/DateMath.cpp b/Source/JavaScriptCore/wtf/DateMath.cpp
index 062cc1b..70c0cf4 100644
--- a/Source/JavaScriptCore/wtf/DateMath.cpp
+++ b/Source/JavaScriptCore/wtf/DateMath.cpp
@@ -75,6 +75,9 @@
 #include "Assertions.h"
 #include "ASCIICType.h"
 #include "CurrentTime.h"
+#if USE(JSC)
+#include "JSObject.h"
+#endif
 #include "MathExtras.h"
 #if USE(JSC)
 #include "ScopeChain.h"
@@ -924,8 +927,10 @@ static double parseDateFromNullTerminatedCharacters(const char* dateString, bool
         }
     }
     
-    // The year may be after the time but before the time zone.
-    if (year <= 0) {
+    // The year may be after the time but before the time zone, but don't
+    // confuse a time zone specificed as an offset from UTC (e.g. +0100) with a
+    // four-digit year.
+    if (year <= 0 && *dateString != '+' && *dateString != '-') {
        if (!parseLong(dateString, &newPosStr, 10, &year))
           year = 0;
        dateString = newPosStr;
diff --git a/Source/JavaScriptCore/wtf/ExportMacros.h b/Source/JavaScriptCore/wtf/ExportMacros.h
new file mode 100644
index 0000000..3fadd37
--- /dev/null
+++ b/Source/JavaScriptCore/wtf/ExportMacros.h
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) 2011 Apple Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ *
+ * This file handles shared library symbol export decorations. It is recommended
+ * that all WebKit projects use these definitions so that symbol exports work
+ * properly on all platforms and compilers that WebKit builds under.
+ */
+
+#ifndef ExportMacros_h
+#define ExportMacros_h
+
+#include "Platform.h"
+
+#if !PLATFORM(CHROMIUM) && OS(WINDOWS) && !COMPILER(GCC)
+#define WTF_EXPORT __declspec(dllexport)
+#define WTF_IMPORT __declspec(dllimport)
+#elif defined(__GNUC__) && !defined(__CC_ARM) && !defined(__ARMCC__)
+#define WTF_EXPORT __attribute__((visibility("default")))
+#define WTF_IMPORT WTF_EXPORT
+#else
+#define WTF_EXPORT
+#define WTF_IMPORT
+#endif
+
+#endif /* ExportMacros_h */
diff --git a/Source/JavaScriptCore/wtf/HexNumber.h b/Source/JavaScriptCore/wtf/HexNumber.h
new file mode 100644
index 0000000..8fd6032
--- /dev/null
+++ b/Source/JavaScriptCore/wtf/HexNumber.h
@@ -0,0 +1,107 @@
+/*
+ * Copyright (C) 2011 Research In Motion Limited. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#ifndef HexNumber_h
+#define HexNumber_h
+
+#include <wtf/text/StringConcatenate.h>
+
+namespace WTF {
+
+enum HexConversionMode {
+    Lowercase,
+    Uppercase
+};
+
+namespace Internal {
+
+static const char* hexDigitsForMode(HexConversionMode mode)
+{
+    static const char lowerHexDigits[17] = "0123456789abcdef";
+    static const char upperHexDigits[17] = "0123456789ABCDEF";
+    return mode == Lowercase ? lowerHexDigits : upperHexDigits;
+}
+
+}; // namespace Internal
+
+template<typename T>
+inline void appendByteAsHex(unsigned char byte, T& destination, HexConversionMode mode = Uppercase)
+{
+    const char* hexDigits = Internal::hexDigitsForMode(mode);
+    destination.append(hexDigits[byte >> 4]);
+    destination.append(hexDigits[byte & 0xF]);
+}
+
+template<typename T>
+inline void placeByteAsHexCompressIfPossible(unsigned char byte, T& destination, unsigned& index, HexConversionMode mode = Uppercase)
+{
+    const char* hexDigits = Internal::hexDigitsForMode(mode);
+    if (byte >= 0x10)
+        destination[index++] = hexDigits[byte >> 4];
+    destination[index++] = hexDigits[byte & 0xF];
+}
+
+template<typename T>
+inline void placeByteAsHex(unsigned char byte, T& destination, HexConversionMode mode = Uppercase)
+{
+    const char* hexDigits = Internal::hexDigitsForMode(mode);
+    *destination++ = hexDigits[byte >> 4];
+    *destination++ = hexDigits[byte & 0xF];
+}
+
+template<typename T>
+inline void appendUnsignedAsHex(unsigned number, T& destination, HexConversionMode mode = Uppercase)
+{
+    const char* hexDigits = Internal::hexDigitsForMode(mode);
+    Vector<UChar, 8> result;
+    do {
+        result.prepend(hexDigits[number % 16]);
+        number >>= 4;
+    } while (number > 0);
+
+    destination.append(result.data(), result.size());
+}
+
+// Same as appendUnsignedAsHex, but using exactly 'desiredDigits' for the conversion.
+template<typename T>
+inline void appendUnsignedAsHexFixedSize(unsigned number, T& destination, unsigned desiredDigits, HexConversionMode mode = Uppercase)
+{
+    ASSERT(desiredDigits);
+
+    const char* hexDigits = Internal::hexDigitsForMode(mode);
+    Vector<UChar, 8> result;
+    do {
+        result.prepend(hexDigits[number % 16]);
+        number >>= 4;
+    } while (result.size() < desiredDigits);
+
+    ASSERT(result.size() == desiredDigits);
+    destination.append(result.data(), result.size());
+}
+
+} // namespace WTF
+
+using WTF::appendByteAsHex;
+using WTF::appendUnsignedAsHex;
+using WTF::appendUnsignedAsHexFixedSize;
+using WTF::placeByteAsHex;
+using WTF::placeByteAsHexCompressIfPossible;
+using WTF::Lowercase;
+
+#endif // HexNumber_h
diff --git a/Source/JavaScriptCore/wtf/MathExtras.h b/Source/JavaScriptCore/wtf/MathExtras.h
index ec27f5f..66e557f 100644
--- a/Source/JavaScriptCore/wtf/MathExtras.h
+++ b/Source/JavaScriptCore/wtf/MathExtras.h
@@ -90,7 +90,7 @@ inline bool isfinite(double x) { return finite(x) && !isnand(x); }
 inline bool isinf(double x) { return !finite(x) && !isnand(x); }
 #endif
 #ifndef signbit
-inline bool signbit(double x) { return x < 0.0; } // FIXME: Wrong for negative 0.
+inline bool signbit(double x) { return copysign(1.0, x) < 0; }
 #endif
 
 #endif
@@ -106,7 +106,7 @@ inline bool signbit(double x) { struct ieee_double *p = (struct ieee_double *)&x
 
 #endif
 
-#if COMPILER(MSVC) || COMPILER(RVCT)
+#if COMPILER(MSVC) || (COMPILER(RVCT) && !(RVCT_VERSION_AT_LEAST(3, 0, 0, 0)))
 
 // We must not do 'num + 0.5' or 'num - 0.5' because they can cause precision loss.
 static double round(double num)
@@ -233,7 +233,12 @@ inline int clampToPositiveInteger(float d)
     return static_cast<int>(std::max<float>(std::min(d, maxIntAsFloat), 0));
 }
 
-#if !COMPILER(MSVC) && !COMPILER(WINSCW) && !(COMPILER(RVCT) && (OS(SYMBIAN) || PLATFORM(BREWMP)))
+inline int clampToInteger(unsigned value)
+{
+    return static_cast<int>(std::min(value, static_cast<unsigned>(std::numeric_limits<int>::max())));
+}
+
+#if !COMPILER(MSVC) && !COMPILER(WINSCW) && !(COMPILER(RVCT) && (OS(SYMBIAN) || PLATFORM(BREWMP))) && !OS(SOLARIS)
 using std::isfinite;
 using std::isinf;
 using std::isnan;
diff --git a/Source/JavaScriptCore/wtf/MessageQueue.h b/Source/JavaScriptCore/wtf/MessageQueue.h
index 7c18a0c..2b774fb 100644
--- a/Source/JavaScriptCore/wtf/MessageQueue.h
+++ b/Source/JavaScriptCore/wtf/MessageQueue.h
@@ -41,7 +41,7 @@ namespace WTF {
     enum MessageQueueWaitResult {
         MessageQueueTerminated,       // Queue was destroyed while waiting for message.
         MessageQueueTimeout,          // Timeout was specified and it expired.
-        MessageQueueMessageReceived,  // A message was successfully received and returned.
+        MessageQueueMessageReceived   // A message was successfully received and returned.
     };
 
     // The queue takes ownership of messages and transfer it to the new owner
diff --git a/Source/JavaScriptCore/wtf/Platform.h b/Source/JavaScriptCore/wtf/Platform.h
index f4fdbcb..aee03e6 100644
--- a/Source/JavaScriptCore/wtf/Platform.h
+++ b/Source/JavaScriptCore/wtf/Platform.h
@@ -114,6 +114,11 @@
 #define WTF_COMPILER_INTEL 1
 #endif
 
+/* COMPILER(SUNCC) */
+#if defined(__SUNPRO_CC) || defined(__SUNPRO_C)
+#define WTF_COMPILER_SUNCC 1
+#endif
+
 /* ==== CPU() - the target CPU architecture ==== */
 
 /* This also defines CPU(BIG_ENDIAN) or CPU(MIDDLE_ENDIAN) or neither, as appropriate. */
@@ -565,7 +570,11 @@
 #define WTF_USE_MERSENNE_TWISTER_19937 1
 #endif
 
-#if (PLATFORM(GTK) || PLATFORM(IOS) || PLATFORM(MAC) || PLATFORM(WIN) || (PLATFORM(QT) && OS(DARWIN) && !ENABLE(SINGLE_THREADED))) && !defined(ENABLE_JSC_MULTIPLE_THREADS)
+#if PLATFORM(QT) && OS(UNIX) && !OS(SYMBIAN) && !OS(DARWIN)
+#define WTF_USE_PTHREAD_BASED_QT 1
+#endif
+
+#if (PLATFORM(GTK) || PLATFORM(IOS) || PLATFORM(MAC) || PLATFORM(WIN) || (PLATFORM(QT) && (OS(DARWIN) || USE(PTHREAD_BASED_QT)) && !ENABLE(SINGLE_THREADED))) && !defined(ENABLE_JSC_MULTIPLE_THREADS)
 #define ENABLE_JSC_MULTIPLE_THREADS 1
 #endif
 
@@ -598,10 +607,6 @@
 #define WTF_USE_ICU_UNICODE 1
 #endif
 
-#if !PLATFORM(CHROMIUM) /* Chromium controls this macro with a gyp define */
-#define WTF_USE_BUILTIN_UTF8_CODEC 1
-#endif
-
 #if PLATFORM(MAC) && !PLATFORM(IOS)
 #if !defined(BUILDING_ON_LEOPARD) && !defined(BUILDING_ON_TIGER) && CPU(X86_64)
 #define WTF_USE_PLUGIN_HOST_PROCESS 1
@@ -963,6 +968,10 @@
 #define ENABLE_GEOLOCATION 0
 #endif
 
+#if !defined(ENABLE_GESTURE_RECOGNIZER)
+#define ENABLE_GESTURE_RECOGNIZER 0
+#endif
+
 #if !defined(ENABLE_NOTIFICATIONS)
 #define ENABLE_NOTIFICATIONS 0
 #endif
@@ -1022,6 +1031,13 @@
 #define ENABLE_JIT 1
 #endif
 
+/* Currently only implemented for JSVALUE64, only tested on PLATFORM(MAC) */
+#if ENABLE(JIT) && USE(JSVALUE64) && PLATFORM(MAC)
+#define ENABLE_DFG_JIT 1
+/* Enabled with restrictions to circumvent known performance regressions. */
+#define ENABLE_DFG_JIT_RESTRICTIONS 1
+#endif
+
 /* Ensure that either the JIT or the interpreter has been enabled. */
 #if !defined(ENABLE_INTERPRETER) && !ENABLE(JIT)
 #define ENABLE_INTERPRETER 1
@@ -1145,6 +1161,10 @@
 #define WTF_USE_PROTECTION_SPACE_AUTH_CALLBACK 1
 #endif
 
+#if PLATFORM(MAC) && !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD) && !defined(BUILDING_ON_SNOW_LEOPARD)
+#define WTF_USE_AVFOUNDATION 1
+#endif
+
 #if COMPILER(GCC)
 #define WARN_UNUSED_RETURN __attribute__ ((warn_unused_result))
 #else
@@ -1184,4 +1204,10 @@
 #include "GTypedefs.h"
 #endif
 
+/* FIXME: This define won't be needed once #27551 is fully landed. However, 
+   since most ports try to support sub-project independence, adding new headers
+   to WTF causes many ports to break, and so this way we can address the build
+   breakages one port at a time. */
+#define WTF_USE_EXPORT_MACROS 0
+
 #endif /* WTF_Platform_h */
diff --git a/Source/JavaScriptCore/wtf/RefCounted.h b/Source/JavaScriptCore/wtf/RefCounted.h
index da178b2..12b670e 100644
--- a/Source/JavaScriptCore/wtf/RefCounted.h
+++ b/Source/JavaScriptCore/wtf/RefCounted.h
@@ -59,6 +59,12 @@ public:
 #endif
     }
 
+    // Helper for generating JIT code. Please do not use for non-JIT purposes.
+    const int* addressOfCount() const
+    {
+        return &m_refCount;
+    }
+
 protected:
     RefCountedBase()
         : m_refCount(1)
@@ -93,12 +99,6 @@ protected:
         return false;
     }
 
-    // Helper for generating JIT code. Please do not use for non-JIT purposes.
-    int* addressOfCount()
-    {
-        return &m_refCount;
-    }
-
 #ifndef NDEBUG
     bool deletionHasBegun() const
     {
diff --git a/Source/JavaScriptCore/wtf/StdLibExtras.h b/Source/JavaScriptCore/wtf/StdLibExtras.h
index 4bb0076..0dacb91 100644
--- a/Source/JavaScriptCore/wtf/StdLibExtras.h
+++ b/Source/JavaScriptCore/wtf/StdLibExtras.h
@@ -114,6 +114,53 @@ inline size_t bitCount(unsigned bits)
 template<typename T, size_t Size> char (&ArrayLengthHelperFunction(T (&)[Size]))[Size];
 #define WTF_ARRAY_LENGTH(array) sizeof(::WTF::ArrayLengthHelperFunction(array))
 
+// Efficient implementation that takes advantage of powers of two.
+template<size_t divisor> inline size_t roundUpToMultipleOf(size_t x)
+{
+    COMPILE_ASSERT(divisor && !(divisor & (divisor - 1)), divisor_is_a_power_of_two);
+
+    size_t remainderMask = divisor - 1;
+    return (x + remainderMask) & ~remainderMask;
+}
+
+// Binary search algorithm, calls extractKey on pre-sorted elements in array,
+// compares result with key (KeyTypes should be comparable with '--', '<', '>').
+// Optimized for cases where the array contains the key, checked by assertions.
+template<typename ArrayType, typename KeyType, KeyType(*extractKey)(ArrayType*)>
+inline ArrayType* binarySearch(ArrayType* array, size_t size, KeyType key)
+{
+    // The array must contain at least one element (pre-condition, array does conatin key).
+    // If the array only contains one element, no need to do the comparison.
+    while (size > 1) {
+        // Pick an element to check, half way through the array, and read the value.
+        int pos = (size - 1) >> 1;
+        KeyType val = extractKey(&array[pos]);
+        
+        // If the key matches, success!
+        if (val == key)
+            return &array[pos];
+        // The item we are looking for is smaller than the item being check; reduce the value of 'size',
+        // chopping off the right hand half of the array.
+        else if (key < val)
+            size = pos;
+        // Discard all values in the left hand half of the array, up to and including the item at pos.
+        else {
+            size -= (pos + 1);
+            array += (pos + 1);
+        }
+
+        // 'size' should never reach zero.
+        ASSERT(size);
+    }
+    
+    // If we reach this point we've chopped down to one element, no need to check it matches
+    ASSERT(size == 1);
+    ASSERT(key == extractKey(&array[0]));
+    return &array[0];
+}
+
 } // namespace WTF
 
+using WTF::binarySearch;
+
 #endif // WTF_StdLibExtras_h
diff --git a/Source/JavaScriptCore/wtf/StringHasher.h b/Source/JavaScriptCore/wtf/StringHasher.h
index a84b2c4..5a2c36c 100644
--- a/Source/JavaScriptCore/wtf/StringHasher.h
+++ b/Source/JavaScriptCore/wtf/StringHasher.h
@@ -88,7 +88,7 @@ public:
         return result;
     }
 
-    template<typename T, UChar Converter(T)> static inline unsigned createHash(const T* data, unsigned length)
+    template<typename T, UChar Converter(T)> static inline unsigned computeHash(const T* data, unsigned length)
     {
         StringHasher hasher;
         bool rem = length & 1;
@@ -105,7 +105,7 @@ public:
         return hasher.hash();
     }
 
-    template<typename T, UChar Converter(T)> static inline unsigned createHash(const T* data)
+    template<typename T, UChar Converter(T)> static inline unsigned computeHash(const T* data)
     {
         StringHasher hasher;
 
@@ -125,26 +125,26 @@ public:
         return hasher.hash();
     }
 
-    template<typename T> static inline unsigned createHash(const T* data, unsigned length)
+    template<typename T> static inline unsigned computeHash(const T* data, unsigned length)
     {
-        return createHash<T, defaultCoverter>(data, length);
+        return computeHash<T, defaultCoverter>(data, length);
     }
 
-    template<typename T> static inline unsigned createHash(const T* data)
+    template<typename T> static inline unsigned computeHash(const T* data)
     {
-        return createHash<T, defaultCoverter>(data);
+        return computeHash<T, defaultCoverter>(data);
     }
 
-    template<size_t length> static inline unsigned createBlobHash(const void* data)
+    template<size_t length> static inline unsigned hashMemory(const void* data)
     {
         COMPILE_ASSERT(!(length % 4), length_must_be_a_multible_of_four);
-        return createHash<UChar>(static_cast<const UChar*>(data), length / sizeof(UChar));
+        return computeHash<UChar>(static_cast<const UChar*>(data), length / sizeof(UChar));
     }
 
-    static inline unsigned createBlobHash(const void* data, unsigned size)
+    static inline unsigned hashMemory(const void* data, unsigned size)
     {
         ASSERT(!(size % 2));
-        return createHash<UChar>(static_cast<const UChar*>(data), size / sizeof(UChar));
+        return computeHash<UChar>(static_cast<const UChar*>(data), size / sizeof(UChar));
     }
 
 private:
@@ -173,4 +173,6 @@ private:
 
 } // namespace WTF
 
+using WTF::StringHasher;
+
 #endif // WTF_StringHasher_h
diff --git a/Source/JavaScriptCore/wtf/ThreadSafeShared.h b/Source/JavaScriptCore/wtf/ThreadSafeRefCounted.h
index a6a1cf2..c9beec4 100644
--- a/Source/JavaScriptCore/wtf/ThreadSafeShared.h
+++ b/Source/JavaScriptCore/wtf/ThreadSafeRefCounted.h
@@ -56,8 +56,8 @@
  * DEALINGS IN THE SOFTWARE.
  */
 
-#ifndef ThreadSafeShared_h
-#define ThreadSafeShared_h
+#ifndef ThreadSafeRefCounted_h
+#define ThreadSafeRefCounted_h
 
 #include "Platform.h"
 
@@ -66,17 +66,18 @@
 
 namespace WTF {
 
-class ThreadSafeSharedBase {
-    WTF_MAKE_NONCOPYABLE(ThreadSafeSharedBase); WTF_MAKE_FAST_ALLOCATED;
+class ThreadSafeRefCountedBase {
+    WTF_MAKE_NONCOPYABLE(ThreadSafeRefCountedBase);
+    WTF_MAKE_FAST_ALLOCATED;
 public:
-    ThreadSafeSharedBase(int initialRefCount = 1)
+    ThreadSafeRefCountedBase(int initialRefCount = 1)
         : m_refCount(initialRefCount)
     {
     }
 
     void ref()
     {
-#if USE(LOCKFREE_THREADSAFESHARED)
+#if USE(LOCKFREE_THREADSAFEREFCOUNTED)
         atomicIncrement(&m_refCount);
 #else
         MutexLocker locker(m_mutex);
@@ -91,7 +92,7 @@ public:
 
     int refCount() const
     {
-#if !USE(LOCKFREE_THREADSAFESHARED)
+#if !USE(LOCKFREE_THREADSAFEREFCOUNTED)
         MutexLocker locker(m_mutex);
 #endif
         return static_cast<int const volatile &>(m_refCount);
@@ -101,7 +102,7 @@ protected:
     // Returns whether the pointer should be freed or not.
     bool derefBase()
     {
-#if USE(LOCKFREE_THREADSAFESHARED)
+#if USE(LOCKFREE_THREADSAFEREFCOUNTED)
         if (atomicDecrement(&m_refCount) <= 0)
             return true;
 #else
@@ -122,12 +123,12 @@ private:
     friend class CrossThreadRefCounted;
 
     int m_refCount;
-#if !USE(LOCKFREE_THREADSAFESHARED)
+#if !USE(LOCKFREE_THREADSAFEREFCOUNTED)
     mutable Mutex m_mutex;
 #endif
 };
 
-template<class T> class ThreadSafeShared : public ThreadSafeSharedBase {
+template<class T> class ThreadSafeRefCounted : public ThreadSafeRefCountedBase {
 public:
     void deref()
     {
@@ -136,13 +137,13 @@ public:
     }
 
 protected:
-    ThreadSafeShared()
+    ThreadSafeRefCounted()
     {
     }
 };
 
 } // namespace WTF
 
-using WTF::ThreadSafeShared;
+using WTF::ThreadSafeRefCounted;
 
-#endif // ThreadSafeShared_h
+#endif // ThreadSafeRefCounted_h
diff --git a/Source/JavaScriptCore/wtf/Threading.h b/Source/JavaScriptCore/wtf/Threading.h
index 044365f..b6f8c24 100644
--- a/Source/JavaScriptCore/wtf/Threading.h
+++ b/Source/JavaScriptCore/wtf/Threading.h
@@ -67,7 +67,7 @@
 #include <wtf/Locker.h>
 #include <wtf/MainThread.h>
 #include <wtf/Noncopyable.h>
-#include <wtf/ThreadSafeShared.h>
+#include <wtf/ThreadSafeRefCounted.h>
 #include <wtf/ThreadingPrimitives.h>
 
 // For portability, we do not use thread-safe statics natively supported by some compilers (e.g. gcc).
diff --git a/Source/JavaScriptCore/wtf/ThreadingPthreads.cpp b/Source/JavaScriptCore/wtf/ThreadingPthreads.cpp
index aa63f33..0ffcfe2 100644
--- a/Source/JavaScriptCore/wtf/ThreadingPthreads.cpp
+++ b/Source/JavaScriptCore/wtf/ThreadingPthreads.cpp
@@ -55,6 +55,10 @@
 #include <wtf/PassOwnPtr.h>
 #endif
 
+#if OS(MAC_OS_X) && !defined(BUILDING_ON_LEOPARD)
+#include <objc/objc-auto.h>
+#endif
+
 namespace WTF {
 
 typedef HashMap<ThreadIdentifier, pthread_t> ThreadMap;
@@ -190,6 +194,12 @@ void initializeCurrentThreadInternal(const char* threadName)
     UNUSED_PARAM(threadName);
 #endif
 
+#if OS(MAC_OS_X) && !defined(BUILDING_ON_LEOPARD)
+    // All threads that potentially use APIs above the BSD layer must be registered with the Objective-C
+    // garbage collector in case API implementations use garbage-collected memory.
+    objc_registerThreadWithCollector();
+#endif
+
     ThreadIdentifier id = identifierByPthreadHandle(pthread_self());
     ASSERT(id);
     ThreadIdentifierData::initialize(id);
diff --git a/Source/JavaScriptCore/wtf/Vector.h b/Source/JavaScriptCore/wtf/Vector.h
index 2fb4114..b26857c 100644
--- a/Source/JavaScriptCore/wtf/Vector.h
+++ b/Source/JavaScriptCore/wtf/Vector.h
@@ -40,7 +40,7 @@ namespace WTF {
     using std::max;
 
     // WTF_ALIGN_OF / WTF_ALIGNED
-    #if COMPILER(GCC) || COMPILER(MINGW) || COMPILER(RVCT) || COMPILER(WINSCW)
+    #if COMPILER(GCC) || COMPILER(MINGW) || COMPILER(RVCT) || COMPILER(WINSCW) || COMPILER(SUNCC)
         #define WTF_ALIGN_OF(type) __alignof__(type)
         #define WTF_ALIGNED(variable_type, variable, n) variable_type variable __attribute__((__aligned__(n)))
     #elif COMPILER(MSVC)
@@ -566,6 +566,7 @@ namespace WTF {
         T& last() { return at(size() - 1); }
         const T& last() const { return at(size() - 1); }
 
+        template<typename U> bool contains(const U&) const;
         template<typename U> size_t find(const U&) const;
         template<typename U> size_t reverseFind(const U&) const;
 
@@ -745,6 +746,13 @@ namespace WTF {
 
     template<typename T, size_t inlineCapacity>
     template<typename U>
+    bool Vector<T, inlineCapacity>::contains(const U& value) const
+    {
+        return find(value) != notFound;
+    }
+ 
+    template<typename T, size_t inlineCapacity>
+    template<typename U>
     size_t Vector<T, inlineCapacity>::find(const U& value) const
     {
         for (size_t i = 0; i < size(); ++i) {
diff --git a/Source/JavaScriptCore/wtf/text/AtomicString.cpp b/Source/JavaScriptCore/wtf/text/AtomicString.cpp
index e0a866d..eb0dbbb 100644
--- a/Source/JavaScriptCore/wtf/text/AtomicString.cpp
+++ b/Source/JavaScriptCore/wtf/text/AtomicString.cpp
@@ -87,7 +87,7 @@ static inline PassRefPtr<StringImpl> addToStringTable(const T& value)
 struct CStringTranslator {
     static unsigned hash(const char* c)
     {
-        return StringImpl::computeHash(c);
+        return StringHasher::computeHash(c);
     }
 
     static bool equal(StringImpl* r, const char* s)
@@ -142,7 +142,7 @@ static inline bool equal(StringImpl* string, const UChar* characters, unsigned l
 
     // FIXME: perhaps we should have a more abstract macro that indicates when
     // going 4 bytes at a time is unsafe
-#if CPU(ARM) || CPU(SH4) || CPU(MIPS)
+#if CPU(ARM) || CPU(SH4) || CPU(MIPS) || CPU(SPARC)
     const UChar* stringCharacters = string->characters();
     for (unsigned i = 0; i != length; ++i) {
         if (*stringCharacters++ != *characters++)
@@ -176,7 +176,7 @@ bool operator==(const AtomicString& string, const Vector<UChar>& vector)
 struct UCharBufferTranslator {
     static unsigned hash(const UCharBuffer& buf)
     {
-        return StringImpl::computeHash(buf.s, buf.length);
+        return StringHasher::computeHash(buf.s, buf.length);
     }
 
     static bool equal(StringImpl* const& str, const UCharBuffer& buf)
@@ -201,7 +201,7 @@ struct HashAndCharacters {
 struct HashAndCharactersTranslator {
     static unsigned hash(const HashAndCharacters& buffer)
     {
-        ASSERT(buffer.hash == StringImpl::computeHash(buffer.characters, buffer.length));
+        ASSERT(buffer.hash == StringHasher::computeHash(buffer.characters, buffer.length));
         return buffer.hash;
     }
 
diff --git a/Source/JavaScriptCore/wtf/text/StringConcatenate.h b/Source/JavaScriptCore/wtf/text/StringConcatenate.h
index 92a2d06..7fa7d2c 100644
--- a/Source/JavaScriptCore/wtf/text/StringConcatenate.h
+++ b/Source/JavaScriptCore/wtf/text/StringConcatenate.h
@@ -89,6 +89,34 @@ private:
 };
 
 template<>
+class StringTypeAdapter<const UChar*> {
+public:
+    StringTypeAdapter<const UChar*>(const UChar* buffer)
+        : m_buffer(buffer)
+    {
+        size_t len = 0;
+        while (m_buffer[len] != UChar(0))
+            len++;
+
+        if (len > std::numeric_limits<unsigned>::max())
+            CRASH();
+
+        m_length = len;
+    }
+
+    unsigned length() { return m_length; }
+
+    void writeTo(UChar* destination)
+    {
+        memcpy(destination, m_buffer, static_cast<size_t>(m_length) * sizeof(UChar));
+    }
+
+private:
+    const UChar* m_buffer;
+    unsigned m_length;
+};
+
+template<>
 class StringTypeAdapter<const char*> {
 public:
     StringTypeAdapter<const char*>(const char* buffer)
diff --git a/Source/JavaScriptCore/wtf/text/StringHash.h b/Source/JavaScriptCore/wtf/text/StringHash.h
index d7aabdb..80193a6 100644
--- a/Source/JavaScriptCore/wtf/text/StringHash.h
+++ b/Source/JavaScriptCore/wtf/text/StringHash.h
@@ -104,7 +104,7 @@ namespace WTF {
 
         static unsigned hash(const UChar* data, unsigned length)
         {
-            return StringHasher::createHash<UChar, foldCase<UChar> >(data, length);
+            return StringHasher::computeHash<UChar, foldCase<UChar> >(data, length);
         }
 
         static unsigned hash(StringImpl* str)
@@ -114,7 +114,7 @@ namespace WTF {
 
         static unsigned hash(const char* data, unsigned length)
         {
-            return StringHasher::createHash<char, foldCase<char> >(data, length);
+            return StringHasher::computeHash<char, foldCase<char> >(data, length);
         }
 
         static bool equal(const StringImpl* a, const StringImpl* b)
diff --git a/Source/JavaScriptCore/wtf/text/StringImpl.h b/Source/JavaScriptCore/wtf/text/StringImpl.h
index a08427b..81911b3 100644
--- a/Source/JavaScriptCore/wtf/text/StringImpl.h
+++ b/Source/JavaScriptCore/wtf/text/StringImpl.h
@@ -136,7 +136,7 @@ private:
     {
         ASSERT(!isStatic());
         ASSERT(!m_hash);
-        ASSERT(hash == computeHash(m_data, m_length));
+        ASSERT(hash == StringHasher::computeHash(m_data, m_length));
         m_hash = hash;
     }
 
@@ -235,11 +235,8 @@ public:
             m_refCountAndFlags &= ~s_refCountFlagIsAtomic;
     }
 
-    unsigned hash() const { if (!m_hash) m_hash = computeHash(m_data, m_length); return m_hash; }
+    unsigned hash() const { if (!m_hash) m_hash = StringHasher::computeHash(m_data, m_length); return m_hash; }
     unsigned existingHash() const { ASSERT(m_hash); return m_hash; }
-    static unsigned computeHash(const UChar* data, unsigned length) { return WTF::StringHasher::createHash<UChar>(data, length); }
-    static unsigned computeHash(const char* data, unsigned length) { return WTF::StringHasher::createHash<char>(data, length); }
-    static unsigned computeHash(const char* data) { return WTF::StringHasher::createHash<char>(data); }
 
     ALWAYS_INLINE void deref() { m_refCountAndFlags -= s_refCountIncrement; if (!(m_refCountAndFlags & (s_refCountMask | s_refCountFlagStatic))) delete this; }
     ALWAYS_INLINE bool hasOneRef() const { return (m_refCountAndFlags & (s_refCountMask | s_refCountFlagStatic)) == s_refCountIncrement; }
diff --git a/Source/JavaScriptCore/wtf/unicode/UTF8.cpp b/Source/JavaScriptCore/wtf/unicode/UTF8.cpp
index 4c3738b..6981fe4 100644
--- a/Source/JavaScriptCore/wtf/unicode/UTF8.cpp
+++ b/Source/JavaScriptCore/wtf/unicode/UTF8.cpp
@@ -319,7 +319,7 @@ static inline unsigned calculateStringHashAndLengthFromUTF8Internal(const char*
     if (!data)
         return 0;
 
-    WTF::StringHasher stringHasher;
+    StringHasher stringHasher;
     dataLength = 0;
     utf16Length = 0;
 
diff --git a/Source/JavaScriptCore/yarr/YarrInterpreter.cpp b/Source/JavaScriptCore/yarr/YarrInterpreter.cpp
index 37d44f7..d8c5d27 100644
--- a/Source/JavaScriptCore/yarr/YarrInterpreter.cpp
+++ b/Source/JavaScriptCore/yarr/YarrInterpreter.cpp
@@ -1234,6 +1234,10 @@ public:
             if (input.checkInput(currentTerm().checkInputCount))
                 MATCH_NEXT();
             BACKTRACK();
+
+            case ByteTerm::TypeUncheckInput:
+                input.uncheckInput(currentTerm().checkInputCount);
+                MATCH_NEXT();
         }
 
         // We should never fall-through to here.
@@ -1354,6 +1358,10 @@ public:
             case ByteTerm::TypeCheckInput:
                 input.uncheckInput(currentTerm().checkInputCount);
                 BACKTRACK();
+
+            case ByteTerm::TypeUncheckInput:
+                input.checkInput(currentTerm().checkInputCount);
+                BACKTRACK();
         }
 
         ASSERT_NOT_REACHED();
@@ -1453,6 +1461,11 @@ public:
         m_bodyDisjunction->terms.append(ByteTerm::CheckInput(count));
     }
 
+    void uncheckInput(unsigned count)
+    {
+        m_bodyDisjunction->terms.append(ByteTerm::UncheckInput(count));
+    }
+    
     void assertionBOL(int inputPosition)
     {
         m_bodyDisjunction->terms.append(ByteTerm::BOL(inputPosition));
@@ -1849,10 +1862,21 @@ public:
 
                     ASSERT(currentCountAlreadyChecked >= static_cast<unsigned>(term.inputPosition));
                     int positiveInputOffset = currentCountAlreadyChecked - term.inputPosition;
+                    int uncheckAmount = positiveInputOffset - term.parentheses.disjunction->m_minimumSize;
+
+                    if (uncheckAmount > 0) {
+                        uncheckInput(uncheckAmount);
+                        currentCountAlreadyChecked -= uncheckAmount;
+                    } else
+                        uncheckAmount = 0;
 
                     atomParentheticalAssertionBegin(term.parentheses.subpatternId, term.invert(), term.frameLocation, alternativeFrameLocation);
                     emitDisjunction(term.parentheses.disjunction, currentCountAlreadyChecked, positiveInputOffset, true);
                     atomParentheticalAssertionEnd(0, term.frameLocation, term.quantityCount, term.quantityType);
+                    if (uncheckAmount) {
+                        checkInput(uncheckAmount);
+                        currentCountAlreadyChecked += uncheckAmount;
+                    }
                     break;
                 }
                 }
diff --git a/Source/JavaScriptCore/yarr/YarrInterpreter.h b/Source/JavaScriptCore/yarr/YarrInterpreter.h
index eea5266..a9f4d48 100644
--- a/Source/JavaScriptCore/yarr/YarrInterpreter.h
+++ b/Source/JavaScriptCore/yarr/YarrInterpreter.h
@@ -70,6 +70,7 @@ struct ByteTerm {
         TypeParentheticalAssertionBegin,
         TypeParentheticalAssertionEnd,
         TypeCheckInput,
+        TypeUncheckInput,
     } type;
     union {
         struct {
@@ -205,6 +206,13 @@ struct ByteTerm {
         return term;
     }
 
+    static ByteTerm UncheckInput(unsigned count)
+    {
+        ByteTerm term(TypeUncheckInput);
+        term.checkInputCount = count;
+        return term;
+    }
+    
     static ByteTerm EOL(int inputPos)
     {
         ByteTerm term(TypeAssertionEOL);
diff --git a/Source/JavaScriptCore/yarr/YarrJIT.cpp b/Source/JavaScriptCore/yarr/YarrJIT.cpp
index e34e6f4..bc61a6e 100644
--- a/Source/JavaScriptCore/yarr/YarrJIT.cpp
+++ b/Source/JavaScriptCore/yarr/YarrJIT.cpp
@@ -157,7 +157,7 @@ class YarrGenerator : private MacroAssembler {
         }
         Jump unicodeFail;
         if (charClass->m_matchesUnicode.size() || charClass->m_rangesUnicode.size()) {
-            Jump isAscii = branch32(LessThanOrEqual, character, Imm32(0x7f));
+            Jump isAscii = branch32(LessThanOrEqual, character, TrustedImm32(0x7f));
 
             if (charClass->m_matchesUnicode.size()) {
                 for (unsigned i = 0; i < charClass->m_matchesUnicode.size(); ++i) {
@@ -207,9 +207,9 @@ class YarrGenerator : private MacroAssembler {
             }
 
             if (unsigned countAZaz = matchesAZaz.size()) {
-                or32(Imm32(32), character);
+                or32(TrustedImm32(32), character);
                 for (unsigned i = 0; i < countAZaz; ++i)
-                    matchDest.append(branch32(Equal, character, Imm32(matchesAZaz[i])));
+                    matchDest.append(branch32(Equal, character, TrustedImm32(matchesAZaz[i])));
             }
         }
 
@@ -265,14 +265,14 @@ class YarrGenerator : private MacroAssembler {
         poke(reg, frameLocation);
     }
 
-    void storeToFrame(Imm32 imm, unsigned frameLocation)
+    void storeToFrame(TrustedImm32 imm, unsigned frameLocation)
     {
         poke(imm, frameLocation);
     }
 
     DataLabelPtr storeToFrameWithPatch(unsigned frameLocation)
     {
-        return storePtrWithPatch(ImmPtr(0), Address(stackPointerRegister, frameLocation * sizeof(void*)));
+        return storePtrWithPatch(TrustedImmPtr(0), Address(stackPointerRegister, frameLocation * sizeof(void*)));
     }
 
     void loadFromFrame(unsigned frameLocation, RegisterID reg)
@@ -1109,11 +1109,11 @@ class YarrGenerator : private MacroAssembler {
             if (m_term.quantityType == QuantifierGreedy) {
                 // If this is -1 we have now tested with both with and without the parens.
                 generator->loadFromFrame(parenthesesFrameLocation, indexTemporary);
-                m_backtrack.jumpToBacktrack(generator, generator->branch32(Equal, indexTemporary, Imm32(-1)));
+                m_backtrack.jumpToBacktrack(generator, generator->branch32(Equal, indexTemporary, TrustedImm32(-1)));
             } else if (m_term.quantityType == QuantifierNonGreedy) {
                 // If this is -1 we have now tested with both with and without the parens.
                 generator->loadFromFrame(parenthesesFrameLocation, indexTemporary);
-                generator->branch32(Equal, indexTemporary, Imm32(-1)).linkTo(m_nonGreedyTryParentheses, generator);
+                generator->branch32(Equal, indexTemporary, TrustedImm32(-1)).linkTo(m_nonGreedyTryParentheses, generator);
             }
 
             if (!m_doDirectBacktrack)
@@ -1126,10 +1126,10 @@ class YarrGenerator : private MacroAssembler {
             m_withinBacktrackJumps.link(generator);
 
             if (m_term.capture())
-                generator->store32(Imm32(-1), Address(output, (m_term.parentheses.subpatternId << 1) * sizeof(int)));
+                generator->store32(TrustedImm32(-1), Address(output, (m_term.parentheses.subpatternId << 1) * sizeof(int)));
 
             if (m_term.quantityType == QuantifierGreedy) {
-                generator->storeToFrame(Imm32(-1), parenthesesFrameLocation);
+                generator->storeToFrame(TrustedImm32(-1), parenthesesFrameLocation);
                 generator->jump().linkTo(m_fallThrough, generator);
                 nextBacktrackFallThrough = false;
             } else if (!nextBacktrackFallThrough)
@@ -1271,7 +1271,7 @@ class YarrGenerator : private MacroAssembler {
 
         if (m_pattern.m_ignoreCase && isASCIIAlpha(ch)) {
             readCharacter(state.inputOffset(), character);
-            or32(Imm32(32), character);
+            or32(TrustedImm32(32), character);
             state.jumpToBacktrack(this, branch32(NotEqual, character, Imm32(Unicode::toLower(ch))));
         } else {
             ASSERT(!m_pattern.m_ignoreCase || (Unicode::toLower(ch) == Unicode::toUpper(ch)));
@@ -1316,13 +1316,13 @@ class YarrGenerator : private MacroAssembler {
         Label loop(this);
         if (m_pattern.m_ignoreCase && isASCIIAlpha(ch)) {
             load16(BaseIndex(input, countRegister, TimesTwo, (state.inputOffset() + term.quantityCount) * sizeof(UChar)), character);
-            or32(Imm32(32), character);
+            or32(TrustedImm32(32), character);
             state.jumpToBacktrack(this, branch32(NotEqual, character, Imm32(Unicode::toLower(ch))));
         } else {
             ASSERT(!m_pattern.m_ignoreCase || (Unicode::toLower(ch) == Unicode::toUpper(ch)));
             state.jumpToBacktrack(this, branch16(NotEqual, BaseIndex(input, countRegister, TimesTwo, (state.inputOffset() + term.quantityCount) * sizeof(UChar)), Imm32(ch)));
         }
-        add32(Imm32(1), countRegister);
+        add32(TrustedImm32(1), countRegister);
         branch32(NotEqual, countRegister, index).linkTo(loop, this);
     }
 
@@ -1333,22 +1333,22 @@ class YarrGenerator : private MacroAssembler {
         PatternTerm& term = state.term();
         UChar ch = term.patternCharacter;
 
-        move(Imm32(0), countRegister);
+        move(TrustedImm32(0), countRegister);
 
         JumpList failures;
         Label loop(this);
         failures.append(atEndOfInput());
         if (m_pattern.m_ignoreCase && isASCIIAlpha(ch)) {
             readCharacter(state.inputOffset(), character);
-            or32(Imm32(32), character);
+            or32(TrustedImm32(32), character);
             failures.append(branch32(NotEqual, character, Imm32(Unicode::toLower(ch))));
         } else {
             ASSERT(!m_pattern.m_ignoreCase || (Unicode::toLower(ch) == Unicode::toUpper(ch)));
             failures.append(jumpIfCharNotEquals(ch, state.inputOffset()));
         }
 
-        add32(Imm32(1), countRegister);
-        add32(Imm32(1), index);
+        add32(TrustedImm32(1), countRegister);
+        add32(TrustedImm32(1), index);
         if (term.quantityCount != quantifyInfinite) {
             branch32(NotEqual, countRegister, Imm32(term.quantityCount)).linkTo(loop, this);
             failures.append(jump());
@@ -1358,8 +1358,8 @@ class YarrGenerator : private MacroAssembler {
         Label backtrackBegin(this);
         loadFromFrame(term.frameLocation, countRegister);
         state.jumpToBacktrack(this, branchTest32(Zero, countRegister));
-        sub32(Imm32(1), countRegister);
-        sub32(Imm32(1), index);
+        sub32(TrustedImm32(1), countRegister);
+        sub32(TrustedImm32(1), index);
 
         failures.link(this);
 
@@ -1375,7 +1375,7 @@ class YarrGenerator : private MacroAssembler {
         PatternTerm& term = state.term();
         UChar ch = term.patternCharacter;
 
-        move(Imm32(0), countRegister);
+        move(TrustedImm32(0), countRegister);
 
         Jump firstTimeDoNothing = jump();
 
@@ -1391,15 +1391,15 @@ class YarrGenerator : private MacroAssembler {
             branch32(Equal, countRegister, Imm32(term.quantityCount), hardFail);
         if (m_pattern.m_ignoreCase && isASCIIAlpha(ch)) {
             readCharacter(state.inputOffset(), character);
-            or32(Imm32(32), character);
+            or32(TrustedImm32(32), character);
             branch32(NotEqual, character, Imm32(Unicode::toLower(ch))).linkTo(hardFail, this);
         } else {
             ASSERT(!m_pattern.m_ignoreCase || (Unicode::toLower(ch) == Unicode::toUpper(ch)));
             jumpIfCharNotEquals(ch, state.inputOffset()).linkTo(hardFail, this);
         }
 
-        add32(Imm32(1), countRegister);
-        add32(Imm32(1), index);
+        add32(TrustedImm32(1), countRegister);
+        add32(TrustedImm32(1), index);
 
         firstTimeDoNothing.link(this);
         storeToFrame(countRegister, term.frameLocation);
@@ -1445,7 +1445,7 @@ class YarrGenerator : private MacroAssembler {
             matchDest.link(this);
         }
 
-        add32(Imm32(1), countRegister);
+        add32(TrustedImm32(1), countRegister);
         branch32(NotEqual, countRegister, index).linkTo(loop, this);
     }
 
@@ -1455,7 +1455,7 @@ class YarrGenerator : private MacroAssembler {
         const RegisterID countRegister = regT1;
         PatternTerm& term = state.term();
 
-        move(Imm32(0), countRegister);
+        move(TrustedImm32(0), countRegister);
 
         JumpList failures;
         Label loop(this);
@@ -1472,8 +1472,8 @@ class YarrGenerator : private MacroAssembler {
             matchDest.link(this);
         }
 
-        add32(Imm32(1), countRegister);
-        add32(Imm32(1), index);
+        add32(TrustedImm32(1), countRegister);
+        add32(TrustedImm32(1), index);
         if (term.quantityCount != quantifyInfinite) {
             branch32(NotEqual, countRegister, Imm32(term.quantityCount)).linkTo(loop, this);
             failures.append(jump());
@@ -1483,8 +1483,8 @@ class YarrGenerator : private MacroAssembler {
         Label backtrackBegin(this);
         loadFromFrame(term.frameLocation, countRegister);
         state.jumpToBacktrack(this, branchTest32(Zero, countRegister));
-        sub32(Imm32(1), countRegister);
-        sub32(Imm32(1), index);
+        sub32(TrustedImm32(1), countRegister);
+        sub32(TrustedImm32(1), index);
 
         failures.link(this);
 
@@ -1499,7 +1499,7 @@ class YarrGenerator : private MacroAssembler {
         const RegisterID countRegister = regT1;
         PatternTerm& term = state.term();
 
-        move(Imm32(0), countRegister);
+        move(TrustedImm32(0), countRegister);
 
         Jump firstTimeDoNothing = jump();
 
@@ -1524,8 +1524,8 @@ class YarrGenerator : private MacroAssembler {
             matchDest.link(this);
         }
 
-        add32(Imm32(1), countRegister);
-        add32(Imm32(1), index);
+        add32(TrustedImm32(1), countRegister);
+        add32(TrustedImm32(1), index);
 
         firstTimeDoNothing.link(this);
         storeToFrame(countRegister, term.frameLocation);
@@ -1669,7 +1669,7 @@ class YarrGenerator : private MacroAssembler {
             if (term.quantityType == QuantifierGreedy)
                 storeToFrame(index, parenthesesFrameLocation);
             else if (term.quantityType == QuantifierNonGreedy) {
-                storeToFrame(Imm32(-1), parenthesesFrameLocation);
+                storeToFrame(TrustedImm32(-1), parenthesesFrameLocation);
                 nonGreedySkipParentheses = jump();
                 nonGreedyTryParentheses = label();
                 storeToFrame(index, parenthesesFrameLocation);
@@ -2140,7 +2140,7 @@ class YarrGenerator : private MacroAssembler {
         if (m_pattern.m_body->m_callFrameSize)
             addPtr(Imm32(m_pattern.m_body->m_callFrameSize * sizeof(void*)), stackPointerRegister);
 
-        move(Imm32(-1), returnRegister);
+        move(TrustedImm32(-1), returnRegister);
 
         generateReturn();
 
diff --git a/Source/JavaScriptGlue/ChangeLog b/Source/JavaScriptGlue/ChangeLog
index ed47e76..6093c84 100644
--- a/Source/JavaScriptGlue/ChangeLog
+++ b/Source/JavaScriptGlue/ChangeLog
@@ -1,3 +1,137 @@
+2011-03-25  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        instanceof Array test fails when using iframes
+        https://bugs.webkit.org/show_bug.cgi?id=17250
+
+        Up date for new toObject api
+
+        * UserObjectImp.cpp:
+        (UserObjectImp::toPrimitive):
+        (UserObjectImp::toBoolean):
+        (UserObjectImp::toNumber):
+        (UserObjectImp::toString):
+
+2011-03-26  Adam Barth  <abarth@webkit.org>
+
+        Remove the JavaScriptGlue GYP build.  We're not going to use GYP for
+        JavaScriptGlue because JavaScriptGlue is used only by one port.
+
+        * gyp: Removed.
+        * gyp/JavaScriptGlue.gyp: Removed.
+        * gyp/JavaScriptGlue.gypi: Removed.
+        * gyp/remove-headers-if-needed.sh: Removed.
+        * gyp/run-if-exists.sh: Removed.
+        * gyp/update-info-plist.sh: Removed.
+
+2011-03-22  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Make it possible to build JavaScriptCore and WebCore gyp builds outside of Source
+        https://bugs.webkit.org/show_bug.cgi?id=56867
+
+        This should make it possible to build the gyp-generated JavaScriptGlue.xcodeproj
+        from a JavaScriptGlue directory outside of Source.
+
+        * gyp/JavaScriptGlue.gyp:
+        * gyp/run-if-exists.sh: Added.
+        * gyp/update-info-plist.sh: Added.
+
+2011-03-22  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Production configuration in GYP isn&apos;t set up correctly
+        https://bugs.webkit.org/show_bug.cgi?id=56786
+
+        Update JavaScriptGlue.gyp with information mined from
+        JavaScriptGlue.xcodeproj.
+
+        * gyp/JavaScriptGlue.gyp:
+        * gyp/JavaScriptGlue.gypi:
+
+2011-03-21  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        GYP build should not have include paths that point within the source tree
+        https://bugs.webkit.org/show_bug.cgi?id=56788
+
+        Turns out we don't need these include paths anymore now that we have
+        header maps working properly.
+
+        * gyp/JavaScriptGlue.gyp:
+
+2011-03-20  Bill Budge  <bbudge@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Rename ThreadSafeShared to ThreadSafeRefCounted
+        https://bugs.webkit.org/show_bug.cgi?id=56714
+
+        No new tests. Exposes no new functionality.§
+
+        * ForwardingHeaders/wtf/ThreadSafeRefCounted.h: Copied from ForwardingHeaders/wtf/ThreadSafeShared.h.
+        * ForwardingHeaders/wtf/ThreadSafeShared.h: Removed.
+        * gyp/JavaScriptGlue.gypi:
+
+2011-03-17  Jeff Miller  <jeffm@apple.com>
+
+        Use a consistent set of file patterns in the svn:ignore property for all .xcodeproj directories, specifically:
+        
+        *.mode*
+        *.pbxuser
+        *.perspective*
+        project.xcworkspace
+        xcuserdata
+
+        * JavaScriptGlue.xcodeproj: Modified property svn:ignore.
+
+2011-03-15  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Make Structure creation require a JSGlobalData
+        https://bugs.webkit.org/show_bug.cgi?id=56438
+
+        Mechanical change to make all structure creation pass a JSGlobalData&.
+
+        * JSRun.cpp:
+        (JSGlueGlobalObject::JSGlueGlobalObject):
+        (JSRun::JSRun):
+        * JSRun.h:
+        * JSUtils.cpp:
+        (getThreadGlobalObject):
+        * UserObjectImp.h:
+        (UserObjectImp::createStructure):
+
+2011-03-15  Kevin Ollivier  <kevino@theolliviers.com>
+
+        Reviewed by Darin Adler.
+
+        Introduce WTF_USE_EXPORT_MACROS, which will allow us to put shared library import/export
+        info into the headers rather than in export symbol definition files, but disable it on 
+        all platforms initially so we can deal with port build issues one port at a time.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=27551
+
+        * config.h:
+
+2011-03-10  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Rolled back in 80277 and 80280 with event handler layout test failures fixed.
+        https://bugs.webkit.org/show_bug.cgi?id=55653        
+
+        The failures were caused by a last minute typo: assigning to currentEvent
+        instead of m_currentEvent.
+
+        * JSRun.cpp:
+        * JSRun.h:
+
 2011-03-04  Adam Barth  <abarth@webkit.org>
 
         Reviewed by Dimitri Glazkov.
diff --git a/Source/JavaScriptGlue/Configurations/Base.xcconfig b/Source/JavaScriptGlue/Configurations/Base.xcconfig
index 036a80c..3f5eeda 100644
--- a/Source/JavaScriptGlue/Configurations/Base.xcconfig
+++ b/Source/JavaScriptGlue/Configurations/Base.xcconfig
@@ -26,7 +26,6 @@ DEBUG_INFORMATION_FORMAT = dwarf;
 GCC_C_LANGUAGE_STANDARD = gnu99;
 GCC_DEBUGGING_SYMBOLS = default;
 GCC_DYNAMIC_NO_PIC = NO;
-GCC_ENABLE_CPP_EXCEPTIONS = NO;
 GCC_ENABLE_CPP_RTTI = NO;
 GCC_ENABLE_OBJC_EXCEPTIONS = YES;
 GCC_ENABLE_OBJC_GC = supported;
@@ -85,12 +84,23 @@ TARGET_GCC_VERSION_1050_ = $(TARGET_GCC_VERSION_1050_$(XCODE_VERSION_ACTUAL));
 TARGET_GCC_VERSION_1050_0310 = GCC_42;
 TARGET_GCC_VERSION_1050_0320 = GCC_42;
 TARGET_GCC_VERSION_1060 = GCC_42;
-TARGET_GCC_VERSION_1070 = LLVM_GCC_42;
+TARGET_GCC_VERSION_1070 = $(TARGET_GCC_VERSION_1070_$(CONFIGURATION));
+TARGET_GCC_VERSION_1070_Debug = LLVM_COMPILER;
+TARGET_GCC_VERSION_1070_Release = LLVM_GCC_42;
+TARGET_GCC_VERSION_1070_Production = LLVM_GCC_42;
 
 GCC_VERSION = $(GCC_VERSION_$(TARGET_GCC_VERSION));
 GCC_VERSION_GCC_40 = 4.0;
 GCC_VERSION_GCC_42 = 4.2;
 GCC_VERSION_LLVM_GCC_42 = com.apple.compilers.llvmgcc42;
+GCC_VERSION_LLVM_COMPILER = com.apple.compilers.llvm.clang.1_0;
+
+// FIXME: Disable C++ exceptions in the LLVM Compiler once it supports enabling Obj-C exceptions without C++ exceptions.
+GCC_ENABLE_CPP_EXCEPTIONS = $(GCC_ENABLE_CPP_EXCEPTIONS_$(TARGET_GCC_VERSION));
+GCC_ENABLE_CPP_EXCEPTIONS_GCC_40 = NO;
+GCC_ENABLE_CPP_EXCEPTIONS_GCC_42 = NO;
+GCC_ENABLE_CPP_EXCEPTIONS_LLVM_GCC = NO;
+GCC_ENABLE_CPP_EXCEPTIONS_LLVM_COMPILER = YES;
 
 // If the target Mac OS X version does not match the current Mac OS X version then we'll want to build using the target version's SDK.
 SDKROOT = $(SDKROOT_$(MAC_OS_X_VERSION_MAJOR)_$(TARGET_MAC_OS_X_VERSION_MAJOR));
diff --git a/Source/JavaScriptGlue/Configurations/Version.xcconfig b/Source/JavaScriptGlue/Configurations/Version.xcconfig
index ae9167c..59988e3 100644
--- a/Source/JavaScriptGlue/Configurations/Version.xcconfig
+++ b/Source/JavaScriptGlue/Configurations/Version.xcconfig
@@ -22,7 +22,7 @@
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 
 MAJOR_VERSION = 534;
-MINOR_VERSION = 24;
+MINOR_VERSION = 27;
 TINY_VERSION = 0;
 FULL_VERSION = $(MAJOR_VERSION).$(MINOR_VERSION);
 
diff --git a/Source/JavaScriptGlue/ForwardingHeaders/wtf/ThreadSafeRefCounted.h b/Source/JavaScriptGlue/ForwardingHeaders/wtf/ThreadSafeRefCounted.h
new file mode 100644
index 0000000..48a54cc
--- /dev/null
+++ b/Source/JavaScriptGlue/ForwardingHeaders/wtf/ThreadSafeRefCounted.h
@@ -0,0 +1 @@
+#include <JavaScriptCore/ThreadSafeRefCounted.h>
diff --git a/Source/JavaScriptGlue/ForwardingHeaders/wtf/ThreadSafeShared.h b/Source/JavaScriptGlue/ForwardingHeaders/wtf/ThreadSafeShared.h
deleted file mode 100644
index 4a7a77f..0000000
--- a/Source/JavaScriptGlue/ForwardingHeaders/wtf/ThreadSafeShared.h
+++ /dev/null
@@ -1 +0,0 @@
-#include <JavaScriptCore/ThreadSafeShared.h>
diff --git a/Source/JavaScriptGlue/JSRun.cpp b/Source/JavaScriptGlue/JSRun.cpp
index 78151c1..a8096aa 100644
--- a/Source/JavaScriptGlue/JSRun.cpp
+++ b/Source/JavaScriptGlue/JSRun.cpp
@@ -33,22 +33,17 @@
 #include <JavaScriptCore/Completion.h>
 #include <JavaScriptCore/SourceCode.h>
 
-JSGlueGlobalObject::JSGlueGlobalObject(PassRefPtr<Structure> structure, JSFlags flags)
-    : JSGlobalObject(structure, new Data, this)
+JSGlueGlobalObject::JSGlueGlobalObject(JSGlobalData& globalData, PassRefPtr<Structure> structure, JSFlags flags)
+    : JSGlobalObject(structure)
+    , m_flags(flags)
+    , m_userObjectStructure(UserObjectImp::createStructure(globalData, jsNull()))
 {
-    d()->flags = flags;
-    d()->userObjectStructure = UserObjectImp::createStructure(jsNull());
-}
-
-void JSGlueGlobalObject::destroyData(void* data)
-{
-    delete static_cast<Data*>(data);
 }
 
 JSRun::JSRun(CFStringRef source, JSFlags inFlags)
     :   JSBase(kJSRunTypeID),
         fSource(CFStringToUString(source)),
-        fGlobalObject(getThreadGlobalExecState()->globalData(), new (&getThreadGlobalExecState()->globalData()) JSGlueGlobalObject(JSGlueGlobalObject::createStructure(jsNull()), inFlags)),
+        fGlobalObject(getThreadGlobalExecState()->globalData(), new (&getThreadGlobalExecState()->globalData()) JSGlueGlobalObject(getThreadGlobalExecState()->globalData(), JSGlueGlobalObject::createStructure(getThreadGlobalExecState()->globalData(), jsNull()), inFlags)),
         fFlags(inFlags)
 {
 }
diff --git a/Source/JavaScriptGlue/JSRun.h b/Source/JavaScriptGlue/JSRun.h
index 924becd..d7aa682 100644
--- a/Source/JavaScriptGlue/JSRun.h
+++ b/Source/JavaScriptGlue/JSRun.h
@@ -34,25 +34,14 @@
 
 class JSGlueGlobalObject : public JSGlobalObject {
     public:
-        JSGlueGlobalObject(PassRefPtr<Structure>, JSFlags = kJSFlagNone);
+        JSGlueGlobalObject(JSGlobalData&, PassRefPtr<Structure>, JSFlags = kJSFlagNone);
 
-        JSFlags Flags() const { return d()->flags; }
-        Structure* userObjectStructure() const { return d()->userObjectStructure.get(); }
+        JSFlags Flags() const { return m_flags; }
+        Structure* userObjectStructure() const { return m_userObjectStructure.get(); }
 
     private:
-        struct Data : JSGlobalObjectData {
-            Data()
-                : JSGlobalObjectData(destroyData)
-            {
-            }
-            
-            RefPtr<Structure> userObjectStructure;
-            JSFlags flags;
-        };
-
-        static void destroyData(void*);
-
-        Data* d() const { return static_cast<Data*>(JSGlobalObject::d()); }
+        JSFlags m_flags;
+        RefPtr<Structure> m_userObjectStructure;
 };
 
 class JSRun : public JSBase {
diff --git a/Source/JavaScriptGlue/JSUtils.cpp b/Source/JavaScriptGlue/JSUtils.cpp
index 94c8dcc..b62e7bf 100644
--- a/Source/JavaScriptGlue/JSUtils.cpp
+++ b/Source/JavaScriptGlue/JSUtils.cpp
@@ -414,7 +414,7 @@ static JSGlueGlobalObject* getThreadGlobalObject()
     pthread_once(&globalObjectKeyOnce, initializeGlobalObjectKey);
     JSGlueGlobalObject* globalObject = static_cast<JSGlueGlobalObject*>(pthread_getspecific(globalObjectKey));
     if (!globalObject) {
-        globalObject = new (getThreadGlobalData()) JSGlueGlobalObject(JSGlueGlobalObject::createStructure(jsNull()));
+        globalObject = new (getThreadGlobalData()) JSGlueGlobalObject(*getThreadGlobalData(), JSGlueGlobalObject::createStructure(*getThreadGlobalData(), jsNull()));
         gcProtect(globalObject);
         pthread_setspecific(globalObjectKey, globalObject);
     }
diff --git a/Source/JavaScriptGlue/UserObjectImp.cpp b/Source/JavaScriptGlue/UserObjectImp.cpp
index f48a230..a04f58e 100644
--- a/Source/JavaScriptGlue/UserObjectImp.cpp
+++ b/Source/JavaScriptGlue/UserObjectImp.cpp
@@ -167,7 +167,7 @@ JSUserObject* UserObjectImp::GetJSUserObject() const
 JSValue UserObjectImp::toPrimitive(ExecState *exec, PreferredPrimitiveType) const
 {
     JSValue result = jsUndefined();
-    JSUserObject* jsObjPtr = KJSValueToJSObject(toObject(exec), exec);
+    JSUserObject* jsObjPtr = KJSValueToJSObject(toObject(exec, exec->lexicalGlobalObject()), exec);
     CFTypeRef cfValue = jsObjPtr ? jsObjPtr->CopyCFValue() : 0;
     if (cfValue) {
         CFTypeID cfType = CFGetTypeID(cfValue);  // toPrimitive
@@ -204,7 +204,7 @@ JSValue UserObjectImp::toPrimitive(ExecState *exec, PreferredPrimitiveType) cons
 bool UserObjectImp::toBoolean(ExecState *exec) const
 {
     bool result = false;
-    JSUserObject* jsObjPtr = KJSValueToJSObject(toObject(exec), exec);
+    JSUserObject* jsObjPtr = KJSValueToJSObject(toObject(exec, exec->lexicalGlobalObject()), exec);
     CFTypeRef cfValue = jsObjPtr ? jsObjPtr->CopyCFValue() : 0;
     if (cfValue)
     {
@@ -284,7 +284,7 @@ bool UserObjectImp::toBoolean(ExecState *exec) const
 double UserObjectImp::toNumber(ExecState *exec) const
 {
     double result = 0;
-    JSUserObject* jsObjPtr = KJSValueToJSObject(toObject(exec), exec);
+    JSUserObject* jsObjPtr = KJSValueToJSObject(toObject(exec, exec->lexicalGlobalObject()), exec);
     CFTypeRef cfValue = jsObjPtr ? jsObjPtr->CopyCFValue() : 0;
     if (cfValue)
     {
@@ -318,7 +318,7 @@ double UserObjectImp::toNumber(ExecState *exec) const
 UString UserObjectImp::toString(ExecState *exec) const
 {
     UString result;
-    JSUserObject* jsObjPtr = KJSValueToJSObject(toObject(exec), exec);
+    JSUserObject* jsObjPtr = KJSValueToJSObject(toObject(exec, exec->lexicalGlobalObject()), exec);
     CFTypeRef cfValue = jsObjPtr ? jsObjPtr->CopyCFValue() : 0;
     if (cfValue)
     {
diff --git a/Source/JavaScriptGlue/UserObjectImp.h b/Source/JavaScriptGlue/UserObjectImp.h
index 3f64153..c6b8d86 100644
--- a/Source/JavaScriptGlue/UserObjectImp.h
+++ b/Source/JavaScriptGlue/UserObjectImp.h
@@ -58,9 +58,9 @@ public:
 
     JSUserObject *GetJSUserObject() const;
 
-    static PassRefPtr<Structure> createStructure(JSValue prototype)
+    static PassRefPtr<Structure> createStructure(JSGlobalData& globalData, JSValue prototype)
     {
-        return Structure::create(prototype, TypeInfo(ObjectType, OverridesGetOwnPropertySlot | OverridesMarkChildren | OverridesGetPropertyNames), AnonymousSlotCount, &s_info);
+        return Structure::create(globalData, prototype, TypeInfo(ObjectType, OverridesGetOwnPropertySlot | OverridesMarkChildren | OverridesGetPropertyNames), AnonymousSlotCount, &s_info);
     }
 
 private:
diff --git a/Source/JavaScriptGlue/config.h b/Source/JavaScriptGlue/config.h
index 62a17f0..2e60237 100644
--- a/Source/JavaScriptGlue/config.h
+++ b/Source/JavaScriptGlue/config.h
@@ -19,3 +19,6 @@
 
 #define JS_EXPORTDATA
 #define JS_EXPORTCLASS
+#define JS_EXPORT_PRIVATE
+#define WTF_EXPORT_PRIVATE
+
diff --git a/Source/JavaScriptGlue/gyp/JavaScriptGlue.gyp b/Source/JavaScriptGlue/gyp/JavaScriptGlue.gyp
deleted file mode 100644
index c3bb711..0000000
--- a/Source/JavaScriptGlue/gyp/JavaScriptGlue.gyp
+++ /dev/null
@@ -1,73 +0,0 @@
-{
-  'includes': [
-    '../../gyp/common.gypi',
-    'JavaScriptGlue.gypi',
-  ],
-  'xcode_config_file': '<(DEPTH)/JavaScriptGlue/Configurations/DebugRelease.xcconfig',
-  'targets': [
-    {
-      'target_name': 'JavaScriptGlue',
-      'type': 'shared_library',
-      'dependencies': [
-        'Update Version'
-      ],
-      'include_dirs': [
-        '<(DEPTH)/JavaScriptGlue',
-        '<(DEPTH)/JavaScriptGlue/ForwardingHeaders',
-        '<(DEPTH)/JavaScriptGlue/icu',
-        '<(PRODUCT_DIR)/include',
-      ],
-      'sources': [
-        '<@(javascriptglue_files)',
-        '<(PRODUCT_DIR)/JavaScriptCore.framework',
-        '$(SDKROOT)/System/Library/Frameworks/CoreServices.framework',
-        '$(SDKROOT)/System/Library/Frameworks/Foundation.framework',
-        '$(SDKROOT)/System/Library/Frameworks/AppKit.framework',
-      ],
-      'xcode_config_file': '../Configurations/JavaScriptGlue.xcconfig',
-      'postbuilds': [
-        {
-          'postbuild_name': 'Check For Global Initializers',
-          'action': [
-            'sh', '<(DEPTH)/gyp/run-if-exists.sh', '<(DEPTH)/../Tools/Scripts/check-for-global-initializers'
-          ],
-        },
-        {
-          'postbuild_name': 'Check For Weak VTables and Externals',
-          'action': [
-            'sh', '<(DEPTH)/gyp/run-if-exists.sh', '<(DEPTH)/../Tools/Scripts/check-for-weak-vtables-and-externals'
-          ],
-        },
-        {
-          'postbuild_name': 'Remove Headers If Needed',
-          'action': [
-            'sh', '<(DEPTH)/gyp/remove-headers-if-needed.sh'
-          ],
-        },
-      ],
-      'conditions': [
-        ['OS=="mac"', {
-          'mac_bundle': 1,
-          'xcode_settings': {
-            # FIXME: Remove these overrides once JavaScriptGlue.xcconfig is
-            # used only by this project.
-            'INFOPLIST_FILE': '<(DEPTH)/JavaScriptGlue/Info.plist',
-            'EXPORTED_SYMBOLS_FILE': '<(DEPTH)/JavaScriptGlue/JavaScriptGlue.exp', 
-          },
-        }],
-      ],
-    },
-    {
-      'target_name': 'Update Version',
-      'type': 'none',
-      'actions': [{
-        'action_name': 'Update Info.plist with version information',
-        'inputs': [],
-         'outputs': [],
-         'action': [
-           'sh', '<(DEPTH)/gyp/update-info-plist.sh', '<(DEPTH)/JavaScriptGlue/Info.plist'
-          ]
-      }],
-    },
-  ], # targets
-}
diff --git a/Source/JavaScriptGlue/gyp/JavaScriptGlue.gypi b/Source/JavaScriptGlue/gyp/JavaScriptGlue.gypi
deleted file mode 100644
index abc98d0..0000000
--- a/Source/JavaScriptGlue/gyp/JavaScriptGlue.gypi
+++ /dev/null
@@ -1,111 +0,0 @@
-{
-    'variables': {
-        'javascriptglue_files': [
-            '../JavaScriptGlue.cpp',
-            '../JSBase.cpp',
-            '../JSObject.cpp',
-            '../JSRun.cpp',
-            '../JSUtils.cpp',
-            '../JSValueWrapper.cpp',
-            '../UserObjectImp.cpp',
-            '../config.h',
-            '../ForwardingHeaders/masm/X86Assembler.h',
-            '../ForwardingHeaders/profiler/Profiler.h',
-            '../ForwardingHeaders/runtime/CallFrame.h',
-            '../ForwardingHeaders/wtf/AlwaysInline.h',
-            '../ForwardingHeaders/wtf/ASCIICType.h',
-            '../ForwardingHeaders/wtf/Assertions.h',
-            '../ForwardingHeaders/wtf/Atomics.h',
-            '../ForwardingHeaders/wtf/Bitmap.h',
-            '../ForwardingHeaders/wtf/BumpPointerAllocator.h',
-            '../ForwardingHeaders/wtf/CrossThreadRefCounted.h',
-            '../ForwardingHeaders/wtf/CurrentTime.h',
-            '../ForwardingHeaders/wtf/DateInstanceCache.h',
-            '../ForwardingHeaders/wtf/DateMath.h',
-            '../ForwardingHeaders/wtf/FastAllocBase.h',
-            '../ForwardingHeaders/wtf/FastMalloc.h',
-            '../ForwardingHeaders/wtf/FixedArray.h',
-            '../ForwardingHeaders/wtf/Forward.h',
-            '../ForwardingHeaders/wtf/HashCountedSet.h',
-            '../ForwardingHeaders/wtf/HashFunctions.h',
-            '../ForwardingHeaders/wtf/HashMap.h',
-            '../ForwardingHeaders/wtf/HashSet.h',
-            '../ForwardingHeaders/wtf/HashTraits.h',
-            '../ForwardingHeaders/wtf/ListHashSet.h',
-            '../ForwardingHeaders/wtf/ListRefPtr.h',
-            '../ForwardingHeaders/wtf/Locker.h',
-            '../ForwardingHeaders/wtf/MainThread.h',
-            '../ForwardingHeaders/wtf/MathExtras.h',
-            '../ForwardingHeaders/wtf/Noncopyable.h',
-            '../ForwardingHeaders/wtf/NotFound.h',
-            '../ForwardingHeaders/wtf/OSAllocator.h',
-            '../ForwardingHeaders/wtf/OwnArrayPtr.h',
-            '../ForwardingHeaders/wtf/OwnFastMallocPtr.h',
-            '../ForwardingHeaders/wtf/OwnPtr.h',
-            '../ForwardingHeaders/wtf/OwnPtrCommon.h',
-            '../ForwardingHeaders/wtf/PageAllocation.h',
-            '../ForwardingHeaders/wtf/PageAllocationAligned.h',
-            '../ForwardingHeaders/wtf/PageBlock.h',
-            '../ForwardingHeaders/wtf/PageReservation.h',
-            '../ForwardingHeaders/wtf/PassOwnArrayPtr.h',
-            '../ForwardingHeaders/wtf/PassOwnPtr.h',
-            '../ForwardingHeaders/wtf/PassRefPtr.h',
-            '../ForwardingHeaders/wtf/Platform.h',
-            '../ForwardingHeaders/wtf/PossiblyNull.h',
-            '../ForwardingHeaders/wtf/PtrAndFlags.h',
-            '../ForwardingHeaders/wtf/RandomNumber.h',
-            '../ForwardingHeaders/wtf/RefCounted.h',
-            '../ForwardingHeaders/wtf/RefPtr.h',
-            '../ForwardingHeaders/wtf/StackBounds.h',
-            '../ForwardingHeaders/wtf/StdLibExtras.h',
-            '../ForwardingHeaders/wtf/StringHasher.h',
-            '../ForwardingHeaders/wtf/text/CString.h',
-            '../ForwardingHeaders/wtf/text/StringHash.h',
-            '../ForwardingHeaders/wtf/text/StringImpl.h',
-            '../ForwardingHeaders/wtf/text/StringImplBase.h',
-            '../ForwardingHeaders/wtf/text/TextPosition.h',
-            '../ForwardingHeaders/wtf/text/WTFString.h',
-            '../ForwardingHeaders/wtf/Threading.h',
-            '../ForwardingHeaders/wtf/ThreadingPrimitives.h',
-            '../ForwardingHeaders/wtf/ThreadSafeShared.h',
-            '../ForwardingHeaders/wtf/ThreadSpecific.h',
-            '../ForwardingHeaders/wtf/unicode/icu/UnicodeIcu.h',
-            '../ForwardingHeaders/wtf/unicode/Unicode.h',
-            '../ForwardingHeaders/wtf/UnusedParam.h',
-            '../ForwardingHeaders/wtf/ValueCheck.h',
-            '../ForwardingHeaders/wtf/Vector.h',
-            '../ForwardingHeaders/wtf/VectorTraits.h',
-            '../ForwardingHeaders/wtf/VMTags.h',
-            '../ForwardingHeaders/wtf/WTFThreadData.h',
-            '../icu/unicode/platform.h',
-            '../icu/unicode/putil.h',
-            '../icu/unicode/uchar.h',
-            '../icu/unicode/ucnv.h',
-            '../icu/unicode/ucnv_err.h',
-            '../icu/unicode/uconfig.h',
-            '../icu/unicode/uenum.h',
-            '../icu/unicode/uiter.h',
-            '../icu/unicode/umachine.h',
-            '../icu/unicode/urename.h',
-            '../icu/unicode/ustring.h',
-            '../icu/unicode/utf.h',
-            '../icu/unicode/utf16.h',
-            '../icu/unicode/utf8.h',
-            '../icu/unicode/utf_old.h',
-            '../icu/unicode/utypes.h',
-            '../icu/unicode/uversion.h',
-            '../JavaScriptGlue.h',
-            '../JSBase.h',
-            '../JSObject.h',
-            '../JSRun.h',
-            '../JSUtils.h',
-            '../JSValueWrapper.h',
-            '../UserObjectImp.h',
-            '../Info.plist',
-        ],
-        'testjsglue_files': [
-            '../testjsglue.cpp',
-        ]
-    }
-}
-
diff --git a/Source/ThirdParty/ANGLE/ChangeLog b/Source/ThirdParty/ANGLE/ChangeLog
index 604df51..374c349 100644
--- a/Source/ThirdParty/ANGLE/ChangeLog
+++ b/Source/ThirdParty/ANGLE/ChangeLog
@@ -1,3 +1,16 @@
+2011-03-17  Jeff Miller  <jeffm@apple.com>
+
+        Use a consistent set of file patterns in the svn:ignore property for all .xcodeproj directories, specifically:
+        
+        *.mode*
+        *.pbxuser
+        *.perspective*
+        project.xcworkspace
+        xcuserdata
+
+        * ANGLE.xcodeproj: Modified property svn:ignore.
+        * src/build_angle.xcodeproj: Modified property svn:ignore.
+
 2011-01-18  Kenneth Russell  <kbr@google.com>
 
         Unreviewed, Leopard build fix. Remove flex/bison targets for GLSL
diff --git a/Source/ThirdParty/ANGLE/Configurations/Base.xcconfig b/Source/ThirdParty/ANGLE/Configurations/Base.xcconfig
index e890e3b..c26baad 100644
--- a/Source/ThirdParty/ANGLE/Configurations/Base.xcconfig
+++ b/Source/ThirdParty/ANGLE/Configurations/Base.xcconfig
@@ -2,7 +2,6 @@ DEAD_CODE_STRIPPING = YES;
 DEBUG_INFORMATION_FORMAT = dwarf;
 GCC_C_LANGUAGE_STANDARD = gnu99;
 GCC_DEBUGGING_SYMBOLS = default;
-GCC_ENABLE_CPP_EXCEPTIONS = NO;
 GCC_ENABLE_CPP_RTTI = NO;
 GCC_ENABLE_OBJC_EXCEPTIONS = YES;
 GCC_ENABLE_OBJC_GC = supported;
@@ -37,12 +36,23 @@ TARGET_GCC_VERSION_1050_ = $(TARGET_GCC_VERSION_1050_$(XCODE_VERSION_ACTUAL));
 TARGET_GCC_VERSION_1050_0310 = GCC_42;
 TARGET_GCC_VERSION_1050_0320 = GCC_42;
 TARGET_GCC_VERSION_1060 = GCC_42;
-TARGET_GCC_VERSION_1070 = LLVM_GCC_42;
+TARGET_GCC_VERSION_1070 = $(TARGET_GCC_VERSION_1070_$(CONFIGURATION));
+TARGET_GCC_VERSION_1070_Debug = LLVM_COMPILER;
+TARGET_GCC_VERSION_1070_Release = LLVM_GCC_42;
+TARGET_GCC_VERSION_1070_Production = LLVM_GCC_42;
 
 GCC_VERSION = $(GCC_VERSION_$(TARGET_GCC_VERSION));
 GCC_VERSION_GCC_40 = 4.0;
 GCC_VERSION_GCC_42 = 4.2;
 GCC_VERSION_LLVM_GCC_42 = com.apple.compilers.llvmgcc42;
+GCC_VERSION_LLVM_COMPILER = com.apple.compilers.llvm.clang.1_0;
+
+// FIXME: Disable C++ exceptions in the LLVM Compiler once it supports enabling Obj-C exceptions without C++ exceptions.
+GCC_ENABLE_CPP_EXCEPTIONS = $(GCC_ENABLE_CPP_EXCEPTIONS_$(TARGET_GCC_VERSION));
+GCC_ENABLE_CPP_EXCEPTIONS_GCC_40 = NO;
+GCC_ENABLE_CPP_EXCEPTIONS_GCC_42 = NO;
+GCC_ENABLE_CPP_EXCEPTIONS_LLVM_GCC = NO;
+GCC_ENABLE_CPP_EXCEPTIONS_LLVM_COMPILER = YES;
 
 // If the target Mac OS X version does not match the current Mac OS X version then we'll want to build using the target version's SDK.
 SDKROOT = $(SDKROOT_$(MAC_OS_X_VERSION_MAJOR)_$(TARGET_MAC_OS_X_VERSION_MAJOR));
diff --git a/Source/WebCore/Android.derived.jscbindings.mk b/Source/WebCore/Android.derived.jscbindings.mk
index 831f2f5..eb070a4 100644
--- a/Source/WebCore/Android.derived.jscbindings.mk
+++ b/Source/WebCore/Android.derived.jscbindings.mk
@@ -375,7 +375,12 @@ GEN := \
     $(intermediates)/page/JSNavigator.h \
     $(intermediates)/page/JSPositionError.h \
     $(intermediates)/page/JSScreen.h \
+<<<<<<< HEAD
     $(intermediates)/page/JSSpeechInputEvent.h \
+=======
+    $(intermediates)/page/JSWebKitAnimation.h \
+    $(intermediates)/page/JSWebKitAnimationList.h \
+>>>>>>> webkit.org at r82507
     $(intermediates)/page/JSWebKitPoint.h \
     $(intermediates)/page/JSWorkerNavigator.h
 
diff --git a/Source/WebCore/Android.derived.v8bindings.mk b/Source/WebCore/Android.derived.v8bindings.mk
index 1612df9..0bee200 100644
--- a/Source/WebCore/Android.derived.v8bindings.mk
+++ b/Source/WebCore/Android.derived.v8bindings.mk
@@ -361,7 +361,12 @@ GEN := \
     $(intermediates)/bindings/V8Navigator.h \
     $(intermediates)/bindings/V8PositionError.h \
     $(intermediates)/bindings/V8Screen.h \
+<<<<<<< HEAD
     $(intermediates)/bindings/V8SpeechInputEvent.h \
+=======
+    $(intermediates)/bindings/V8WebKitAnimation.h \
+    $(intermediates)/bindings/V8WebKitAnimationList.h \
+>>>>>>> webkit.org at r82507
     $(intermediates)/bindings/V8WebKitPoint.h \
     $(intermediates)/bindings/V8WorkerNavigator.h
 $(GEN): PRIVATE_PATH := $(LOCAL_PATH)
diff --git a/Source/WebCore/Android.jscbindings.mk b/Source/WebCore/Android.jscbindings.mk
index f3b12be..44738a9 100644
--- a/Source/WebCore/Android.jscbindings.mk
+++ b/Source/WebCore/Android.jscbindings.mk
@@ -217,7 +217,7 @@ LOCAL_SRC_FILES += \
 	bridge/c/c_runtime.cpp \
 	bridge/c/c_utility.cpp \
 	bridge/jni/JNIUtility.cpp \
-	bridge/jni/JavaMethod.cpp \
+	bridge/jni/JavaMethodJobject.cpp \
 	bridge/jni/JobjectWrapper.cpp \
 	bridge/jni/jsc/JNIUtilityPrivate.cpp \
 	bridge/jni/jsc/JavaArrayJSC.cpp \
diff --git a/Source/WebCore/Android.mk b/Source/WebCore/Android.mk
index b2ad8f4..f7ecf6d 100644
--- a/Source/WebCore/Android.mk
+++ b/Source/WebCore/Android.mk
@@ -101,7 +101,6 @@ LOCAL_SRC_FILES := $(LOCAL_SRC_FILES) \
 	css/WebKitCSSTransformValue.cpp \
 	\
 	dom/ActiveDOMObject.cpp \
-	dom/AsyncScriptRunner.cpp \
 	dom/Attr.cpp \
 	dom/Attribute.cpp \
 	dom/BeforeTextInsertedEvent.cpp \
@@ -122,8 +121,12 @@ LOCAL_SRC_FILES := $(LOCAL_SRC_FILES) \
 	dom/CustomEvent.cpp \
 	dom/DOMImplementation.cpp \
 	dom/DOMStringList.cpp \
+<<<<<<< HEAD
 	dom/DOMStringMap.cpp \
 	dom/DatasetDOMStringMap.cpp \
+=======
+	dom/DataTransferItem.cpp \
+>>>>>>> webkit.org at r82507
 	dom/DecodedDataDocumentParser.cpp \
 	dom/DeviceMotionController.cpp \
 	dom/DeviceMotionData.cpp \
@@ -141,6 +144,7 @@ LOCAL_SRC_FILES := $(LOCAL_SRC_FILES) \
 	dom/ErrorEvent.cpp \
 	dom/Event.cpp \
 	dom/EventContext.cpp \
+	dom/EventDispatcher.cpp \
 	dom/EventNames.cpp \
 	dom/EventTarget.cpp \
 	dom/EventQueue.cpp \
@@ -183,11 +187,13 @@ LOCAL_SRC_FILES := $(LOCAL_SRC_FILES) \
 	dom/ScriptableDocumentParser.cpp \
 	dom/ScriptElement.cpp \
 	dom/ScriptExecutionContext.cpp \
+	dom/ScriptRunner.cpp \
 	dom/SelectElement.cpp \
 	dom/SelectorNodeList.cpp \
 	dom/SpaceSplitString.cpp \
 	dom/StaticHashSetNodeList.cpp \
 	dom/StaticNodeList.cpp \
+	dom/StringCallback.cpp \
 	dom/StyleElement.cpp \
 	dom/StyledElement.cpp \
 	dom/TagNodeList.cpp \
@@ -460,6 +466,11 @@ LOCAL_SRC_FILES := $(LOCAL_SRC_FILES) \
 	loader/cache/MemoryCache.cpp \
 	\
 	loader/icon/IconDatabase.cpp \
+<<<<<<< HEAD
+=======
+	loader/icon/IconDatabaseBase.cpp \
+	loader/icon/IconFetcher.cpp \
+>>>>>>> webkit.org at r82507
 	loader/icon/IconLoader.cpp \
 	loader/icon/IconRecord.cpp \
 	loader/icon/PageURLRecord.cpp \
@@ -507,6 +518,8 @@ LOCAL_SRC_FILES := $(LOCAL_SRC_FILES) \
 	page/SpeechInputResult.cpp \
 	page/SuspendableTimer.cpp \
 	page/UserContentURLPattern.cpp \
+	page/WebKitAnimation.cpp \
+	page/WebKitAnimationList.cpp \
 	page/WindowFeatures.cpp \
 	page/WorkerNavigator.cpp \
 	\
@@ -523,7 +536,11 @@ LOCAL_SRC_FILES := $(LOCAL_SRC_FILES) \
 	platform/ContentType.cpp \
 	platform/ContextMenuItem.cpp \
 	platform/CrossThreadCopier.cpp \
+<<<<<<< HEAD
 	platform/Cursor.cpp \
+=======
+	platform/DefaultLocalizationStrategy.cpp \
+>>>>>>> webkit.org at r82507
 	platform/DragData.cpp \
 	platform/DragImage.cpp \
 	platform/FileChooser.cpp \
diff --git a/Source/WebCore/Android.v8bindings.mk b/Source/WebCore/Android.v8bindings.mk
index f42fc28..8d858d9 100644
--- a/Source/WebCore/Android.v8bindings.mk
+++ b/Source/WebCore/Android.v8bindings.mk
@@ -52,6 +52,11 @@ LOCAL_SRC_FILES += \
 	bindings/v8/IsolatedWorld.cpp \
 	bindings/v8/MainThreadDOMData.cpp \
 	bindings/v8/NPV8Object.cpp \
+<<<<<<< HEAD
+=======
+	bindings/v8/RetainedDOMInfo.cpp \
+	bindings/v8/RuntimeEnabledFeatures.cpp \
+>>>>>>> webkit.org at r82507
 	bindings/v8/ScheduledAction.cpp \
 	bindings/v8/ScopedDOMDataStore.cpp \
 	bindings/v8/ScriptCachedFrameData.cpp \
@@ -182,6 +187,11 @@ LOCAL_SRC_FILES += \
 	bindings/v8/custom/V8StorageCustom.cpp \
 	bindings/v8/custom/V8StyleSheetCustom.cpp \
 	bindings/v8/custom/V8StyleSheetListCustom.cpp \
+<<<<<<< HEAD
+=======
+	bindings/v8/custom/V8TreeWalkerCustom.cpp \
+	bindings/v8/custom/V8WebKitAnimationCustom.cpp \
+>>>>>>> webkit.org at r82507
 	bindings/v8/custom/V8WebKitCSSMatrixConstructor.cpp \
 	bindings/v8/custom/V8WebKitPointConstructor.cpp \
 	bindings/v8/custom/V8WorkerContextCustom.cpp \
@@ -193,7 +203,7 @@ LOCAL_SRC_FILES += \
 
 LOCAL_SRC_FILES += \
 	bridge/jni/JNIUtility.cpp \
-	bridge/jni/JavaMethod.cpp \
+	bridge/jni/JavaMethodJobject.cpp \
 	bridge/jni/JobjectWrapper.cpp \
 	bridge/jni/v8/JNIUtilityPrivate.cpp \
 	bridge/jni/v8/JavaClassV8.cpp \
diff --git a/Source/WebCore/CMakeLists.txt b/Source/WebCore/CMakeLists.txt
index ed95064..630f76e 100644
--- a/Source/WebCore/CMakeLists.txt
+++ b/Source/WebCore/CMakeLists.txt
@@ -3,12 +3,8 @@ SET(WebCore_INCLUDE_DIRECTORIES
     "${WEBCORE_DIR}/accessibility"
     "${WEBCORE_DIR}/bindings"
     "${WEBCORE_DIR}/bindings/generic"
-    "${WEBCORE_DIR}/bindings/js"
-    "${WEBCORE_DIR}/bindings/js/specialization"
     "${WEBCORE_DIR}/bridge"
     "${WEBCORE_DIR}/bridge/c"
-    "${WEBCORE_DIR}/bridge/jni/jsc"
-    "${WEBCORE_DIR}/bridge/jsc"
     "${WEBCORE_DIR}/css"
     "${WEBCORE_DIR}/dom"
     "${WEBCORE_DIR}/dom/default"
@@ -86,7 +82,6 @@ SET(WebCore_INCLUDE_DIRECTORIES
 
 SET(WebCore_IDL_INCLUDES
     bindings/generic
-    bindings/js
     css
     dom
     fileapi
@@ -140,6 +135,8 @@ SET(WebCore_IDL_FILES
     dom/Comment.idl
     dom/CompositionEvent.idl
     dom/CustomEvent.idl
+    dom/DataTransferItem.idl
+    dom/DataTransferItems.idl
     dom/DeviceMotionEvent.idl
     dom/DeviceOrientationEvent.idl
     dom/DocumentFragment.idl
@@ -175,6 +172,7 @@ SET(WebCore_IDL_FILES
     dom/ProgressEvent.idl
     dom/RangeException.idl
     dom/Range.idl
+    dom/StringCallback.idl
     dom/TextEvent.idl
     dom/Text.idl
     dom/TouchEvent.idl
@@ -340,6 +338,8 @@ SET(WebCore_IDL_FILES
     page/SpeechInputEvent.idl
     page/SpeechInputResult.idl
     page/SpeechInputResultList.idl
+    page/WebKitAnimation.idl
+    page/WebKitAnimationList.idl
     page/WebKitPoint.idl
     page/WorkerNavigator.idl
 
@@ -453,168 +453,6 @@ SET(WebCore_SOURCES
     bindings/generic/ActiveDOMCallback.cpp
     bindings/generic/RuntimeEnabledFeatures.cpp
 
-    bindings/js/DOMObjectHashTableMap.cpp
-    bindings/js/DOMWrapperWorld.cpp
-    bindings/js/GCController.cpp
-    bindings/js/IDBBindingUtilities.cpp
-    bindings/js/JSAttrCustom.cpp
-    bindings/js/JSArrayBufferCustom.cpp
-    bindings/js/JSDataViewCustom.cpp
-    bindings/js/JSCDATASectionCustom.cpp
-    bindings/js/JSCSSFontFaceRuleCustom.cpp
-    bindings/js/JSCSSImportRuleCustom.cpp
-    bindings/js/JSCSSMediaRuleCustom.cpp
-    bindings/js/JSCSSPageRuleCustom.cpp
-    bindings/js/JSCSSRuleCustom.cpp
-    bindings/js/JSCSSRuleListCustom.cpp
-    bindings/js/JSCSSStyleDeclarationCustom.cpp
-    bindings/js/JSCSSStyleRuleCustom.cpp
-    bindings/js/JSCSSValueCustom.cpp
-    bindings/js/JSCallbackData.cpp
-    bindings/js/JSCanvasRenderingContext2DCustom.cpp
-    bindings/js/JSCanvasRenderingContextCustom.cpp
-    bindings/js/JSClipboardCustom.cpp
-    bindings/js/JSConsoleCustom.cpp
-    bindings/js/JSCoordinatesCustom.cpp
-    bindings/js/JSCustomPositionCallback.cpp
-    bindings/js/JSCustomPositionErrorCallback.cpp
-    bindings/js/JSCustomSQLStatementErrorCallback.cpp
-    bindings/js/JSCustomVoidCallback.cpp
-    bindings/js/JSCustomXPathNSResolver.cpp
-    bindings/js/JSDOMApplicationCacheCustom.cpp
-    bindings/js/JSDOMBinding.cpp
-    bindings/js/JSDOMFormDataCustom.cpp
-    bindings/js/JSDOMGlobalObject.cpp
-    bindings/js/JSDOMImplementationCustom.cpp
-    bindings/js/JSDOMMimeTypeArrayCustom.cpp
-    bindings/js/JSDOMPluginArrayCustom.cpp
-    bindings/js/JSDOMPluginCustom.cpp
-    bindings/js/JSDOMStringMapCustom.cpp
-    bindings/js/JSDOMWindowBase.cpp
-    bindings/js/JSDOMWindowCustom.cpp
-    bindings/js/JSDOMWindowShell.cpp
-    bindings/js/JSDOMWrapper.cpp
-    bindings/js/JSDataGridColumnListCustom.cpp
-    bindings/js/JSDataGridDataSource.cpp
-    bindings/js/JSDedicatedWorkerContextCustom.cpp
-    bindings/js/JSDeviceMotionEventCustom.cpp
-    bindings/js/JSDeviceOrientationEventCustom.cpp
-    bindings/js/JSDocumentCustom.cpp
-    bindings/js/JSElementCustom.cpp
-    bindings/js/JSErrorHandler.cpp
-    bindings/js/JSEventCustom.cpp
-    bindings/js/JSEventListener.cpp
-    bindings/js/JSEventSourceCustom.cpp
-    bindings/js/JSEventTarget.cpp
-    bindings/js/JSExceptionBase.cpp
-    bindings/js/JSFileReaderCustom.cpp
-    bindings/js/JSFloat32ArrayCustom.cpp
-    bindings/js/JSGeolocationCustom.cpp
-    bindings/js/JSHTMLAllCollectionCustom.cpp
-    bindings/js/JSHTMLAppletElementCustom.cpp
-    bindings/js/JSHTMLCanvasElementCustom.cpp
-    bindings/js/JSHTMLCollectionCustom.cpp
-    bindings/js/JSHTMLDataGridElementCustom.cpp
-    bindings/js/JSHTMLDocumentCustom.cpp
-    bindings/js/JSHTMLElementCustom.cpp
-    bindings/js/JSHTMLEmbedElementCustom.cpp
-    bindings/js/JSHTMLFormElementCustom.cpp
-    bindings/js/JSHTMLFrameElementCustom.cpp
-    bindings/js/JSHTMLFrameSetElementCustom.cpp
-    bindings/js/JSHTMLInputElementCustom.cpp
-    bindings/js/JSHTMLLinkElementCustom.cpp
-    bindings/js/JSHTMLObjectElementCustom.cpp
-    bindings/js/JSHTMLOptionsCollectionCustom.cpp
-    bindings/js/JSHTMLOutputElementCustom.cpp
-    bindings/js/JSHTMLSelectElementCustom.cpp
-    bindings/js/JSHTMLStyleElementCustom.cpp
-    bindings/js/JSHistoryCustom.cpp
-    bindings/js/JSIDBAnyCustom.cpp
-    bindings/js/JSIDBKeyCustom.cpp
-    bindings/js/JSImageConstructor.cpp
-    bindings/js/JSImageDataCustom.cpp
-    bindings/js/JSInt16ArrayCustom.cpp
-    bindings/js/JSInt32ArrayCustom.cpp
-    bindings/js/JSInt8ArrayCustom.cpp
-    bindings/js/JSInjectedScriptHostCustom.cpp
-    bindings/js/JSInspectorFrontendHostCustom.cpp
-    bindings/js/JSJavaScriptCallFrameCustom.cpp
-    bindings/js/JSLazyEventListener.cpp
-    bindings/js/JSLocationCustom.cpp
-    bindings/js/JSMainThreadExecState.cpp
-    bindings/js/JSMemoryInfoCustom.cpp
-    bindings/js/JSMessageChannelCustom.cpp
-    bindings/js/JSMessageEventCustom.cpp
-    bindings/js/JSMessagePortCustom.cpp
-    bindings/js/JSNamedNodeMapCustom.cpp
-    bindings/js/JSNavigatorCustom.cpp
-    bindings/js/JSNodeCustom.cpp
-    bindings/js/JSNodeFilterCondition.cpp
-    bindings/js/JSNodeFilterCustom.cpp
-    bindings/js/JSNodeIteratorCustom.cpp
-    bindings/js/JSNodeListCustom.cpp
-    bindings/js/JSOptionConstructor.cpp
-    bindings/js/JSPluginElementFunctions.cpp
-    bindings/js/JSProcessingInstructionCustom.cpp
-    bindings/js/JSSQLResultSetRowListCustom.cpp
-    bindings/js/JSSQLTransactionCustom.cpp
-    bindings/js/JSSQLTransactionSyncCustom.cpp
-    bindings/js/JSScriptProfileNodeCustom.cpp
-    bindings/js/JSSharedWorkerCustom.cpp
-    bindings/js/JSStorageCustom.cpp
-    bindings/js/JSStyleSheetCustom.cpp
-    bindings/js/JSStyleSheetListCustom.cpp
-    bindings/js/JSTextCustom.cpp
-    bindings/js/JSTouchCustom.cpp
-    bindings/js/JSTouchListCustom.cpp
-    bindings/js/JSTreeWalkerCustom.cpp
-    bindings/js/JSUint16ArrayCustom.cpp 
-    bindings/js/JSUint32ArrayCustom.cpp
-    bindings/js/JSUint8ArrayCustom.cpp
-    bindings/js/JSWebKitCSSKeyframeRuleCustom.cpp
-    bindings/js/JSWebKitCSSKeyframesRuleCustom.cpp
-    bindings/js/JSWebKitCSSMatrixCustom.cpp
-    bindings/js/JSWebKitPointCustom.cpp
-    bindings/js/JSWebSocketCustom.cpp
-    bindings/js/JSWorkerContextBase.cpp
-    bindings/js/JSWorkerContextCustom.cpp
-    bindings/js/JSWorkerCustom.cpp
-    bindings/js/JSXMLHttpRequestCustom.cpp
-    bindings/js/JSXMLHttpRequestUploadCustom.cpp
-    bindings/js/JSXSLTProcessorCustom.cpp
-    bindings/js/JavaScriptCallFrame.cpp
-    bindings/js/ScheduledAction.cpp
-    bindings/js/ScriptCachedFrameData.cpp
-    bindings/js/ScriptCallStackFactory.cpp
-    bindings/js/ScriptController.cpp
-    bindings/js/ScriptDebugServer.cpp
-    bindings/js/ScriptEventListener.cpp
-    bindings/js/ScriptFunctionCall.cpp
-    bindings/js/ScriptGCEvent.cpp
-    bindings/js/ScriptObject.cpp
-    bindings/js/ScriptProfile.cpp
-    bindings/js/ScriptProfiler.cpp
-    bindings/js/ScriptState.cpp
-    bindings/js/ScriptValue.cpp
-    bindings/js/SerializedScriptValue.cpp
-    bindings/js/WorkerScriptController.cpp
-
-    bridge/IdentifierRep.cpp
-    bridge/NP_jsobject.cpp
-    bridge/npruntime.cpp
-    bridge/runtime_array.cpp
-    bridge/runtime_method.cpp
-    bridge/runtime_object.cpp
-    bridge/runtime_root.cpp
-
-    bridge/c/CRuntimeObject.cpp
-    bridge/c/c_class.cpp
-    bridge/c/c_instance.cpp
-    bridge/c/c_runtime.cpp
-    bridge/c/c_utility.cpp
-
-    bridge/jsc/BridgeJSC.cpp
-
     css/CSSBorderImageValue.cpp
     css/CSSCanvasValue.cpp
     css/CSSCharsetRule.cpp
@@ -632,6 +470,7 @@ SET(WebCore_SOURCES
     css/CSSImportRule.cpp
     css/CSSInheritedValue.cpp
     css/CSSInitialValue.cpp
+    css/CSSLineBoxContainValue.cpp
     css/CSSMediaRule.cpp
     css/CSSMutableStyleDeclaration.cpp
     css/CSSOMUtils.cpp
@@ -649,6 +488,7 @@ SET(WebCore_SOURCES
     css/CSSSegmentedFontFace.cpp
     css/CSSSelector.cpp
     css/CSSSelectorList.cpp
+    css/CSSStyleApplyProperty.cpp
     css/CSSStyleDeclaration.cpp
     css/CSSStyleRule.cpp
     css/CSSStyleSelector.cpp
@@ -679,7 +519,6 @@ SET(WebCore_SOURCES
     css/WebKitCSSTransformValue.cpp
 
     dom/ActiveDOMObject.cpp
-    dom/AsyncScriptRunner.cpp
     dom/Attr.cpp
     dom/Attribute.cpp
     dom/BeforeTextInsertedEvent.cpp
@@ -722,6 +561,7 @@ SET(WebCore_SOURCES
     dom/ErrorEvent.cpp
     dom/Event.cpp
     dom/EventContext.cpp
+    dom/EventDispatcher.cpp
     dom/EventNames.cpp
     dom/EventTarget.cpp
     dom/EventQueue.cpp
@@ -760,6 +600,7 @@ SET(WebCore_SOURCES
     dom/ScriptableDocumentParser.cpp
     dom/ScriptElement.cpp
     dom/ScriptExecutionContext.cpp
+    dom/ScriptRunner.cpp
     dom/SelectElement.cpp
     dom/SelectorNodeList.cpp
     dom/SpaceSplitString.cpp
@@ -1038,10 +879,13 @@ SET(WebCore_SOURCES
     html/shadow/TextControlInnerElements.cpp
 
     inspector/ConsoleMessage.cpp
+    inspector/DOMNodeHighlighter.cpp
     inspector/InjectedScript.cpp
     inspector/InjectedScriptHost.cpp
+    inspector/InjectedScriptManager.cpp
     inspector/InspectorAgent.cpp
     inspector/InspectorApplicationCacheAgent.cpp
+    inspector/InspectorPageAgent.cpp
     inspector/InspectorBrowserDebuggerAgent.cpp
     inspector/InspectorCSSAgent.cpp
     inspector/InspectorClient.cpp
@@ -1063,10 +907,12 @@ SET(WebCore_SOURCES
     inspector/InspectorStyleSheet.cpp
     inspector/InspectorTimelineAgent.cpp
     inspector/InspectorValues.cpp
+    inspector/PageDebuggerAgent.cpp
     inspector/ScriptArguments.cpp
     inspector/ScriptCallFrame.cpp
     inspector/ScriptCallStack.cpp
     inspector/TimelineRecordFactory.cpp
+    inspector/WorkerDebuggerAgent.cpp
 
     loader/CrossOriginAccessControl.cpp
     loader/CrossOriginPreflightResultCache.cpp
@@ -1124,6 +970,7 @@ SET(WebCore_SOURCES
     loader/cache/MemoryCache.cpp
 
     loader/icon/IconDatabase.cpp
+    loader/icon/IconDatabaseBase.cpp
     loader/icon/IconLoader.cpp
     loader/icon/IconRecord.cpp
     loader/icon/PageURLRecord.cpp
@@ -1170,6 +1017,8 @@ SET(WebCore_SOURCES
     page/SpatialNavigation.cpp
     page/SuspendableTimer.cpp
     page/UserContentURLPattern.cpp
+    page/WebKitAnimation.cpp
+    page/WebKitAnimationList.cpp
     page/WindowFeatures.cpp
     page/WorkerNavigator.cpp
 
@@ -1184,6 +1033,7 @@ SET(WebCore_SOURCES
     platform/ContextMenuItem.cpp
     platform/ContentType.cpp
     platform/CrossThreadCopier.cpp
+    platform/DefaultLocalizationStrategy.cpp
     platform/DragData.cpp
     platform/DragImage.cpp
     platform/FileChooser.cpp
@@ -1479,6 +1329,7 @@ SET(WebCore_SOURCES
     storage/StorageNamespace.cpp
     storage/StorageNamespaceImpl.cpp
     storage/StorageSyncManager.cpp
+    storage/StorageTracker.cpp
 
     websockets/ThreadableWebSocketChannel.cpp
     websockets/WebSocket.cpp
@@ -1545,7 +1396,7 @@ SET(WebCore_USER_AGENT_STYLE_SHEETS
     ${WEBCORE_DIR}/css/html.css
     ${WEBCORE_DIR}/css/mathml.css
     ${WEBCORE_DIR}/css/mediaControls.css
-    ${WEBCORE_DIR}/css/mediaControlsGtk.css
+    ${WEBCORE_DIR}/css/mediaControlsEfl.css
     ${WEBCORE_DIR}/css/quirks.css
     ${WEBCORE_DIR}/css/svg.css
     ${WEBCORE_DIR}/css/view-source.css
@@ -1573,6 +1424,15 @@ IF (ENABLE_DATABASE)
     )
 ENDIF ()
 
+IF (ENABLE_DATA_TRANSFER_ITEMS)
+    LIST(APPEND WebCore_IDL_FILES
+    )
+    LIST(APPEND WebCore_SOURCES
+        dom/DataTransferItem.cpp
+        dom/StringCallback.cpp
+    )
+ENDIF ()
+
 IF (ENABLE_MATHML)
     LIST(APPEND WebCore_SOURCES
         mathml/MathMLElement.cpp
@@ -2087,42 +1947,26 @@ ENDIF ()
 
 # Modules that the bindings generator scripts may use
 SET(SCRIPTS_BINDINGS
-    ${WEBCORE_DIR}/bindings/scripts/CodeGenerator.pm
     ${WEBCORE_DIR}/bindings/scripts/IDLParser.pm
     ${WEBCORE_DIR}/bindings/scripts/IDLStructure.pm
     ${WEBCORE_DIR}/bindings/scripts/InFilesParser.pm
 )
 
-SET(IDL_INCLUDES "")
-FOREACH (_include ${WebCore_IDL_INCLUDES})
-    LIST(APPEND IDL_INCLUDES --include=${WEBCORE_DIR}/${_include})
-ENDFOREACH ()
-
-SET(FEATURE_DEFINES_JAVASCRIPT "LANGUAGE_JAVASCRIPT=1")
-FOREACH (_feature ${FEATURE_DEFINES})
-    SET(FEATURE_DEFINES_JAVASCRIPT "${FEATURE_DEFINES_JAVASCRIPT} ${_feature}")
-ENDFOREACH ()
-
-
-# Create JavaScript C++ code given an IDL input
-FOREACH (_file ${WebCore_IDL_FILES})
-    GET_FILENAME_COMPONENT (_name ${_file} NAME_WE)
-    ADD_CUSTOM_COMMAND(
-        OUTPUT  ${DERIVED_SOURCES_DIR}/JS${_name}.cpp ${DERIVED_SOURCES_DIR}/JS${_name}.h
-        MAIN_DEPENDENCY ${_file}
-        DEPENDS ${WEBCORE_DIR}/bindings/scripts/generate-bindings.pl ${SCRIPTS_BINDINGS} ${WEBCORE_DIR}/bindings/scripts/CodeGeneratorJS.pm ${_file}
-        COMMAND ${PERL_EXECUTABLE} -I${WEBCORE_DIR}/bindings/scripts ${WEBCORE_DIR}/bindings/scripts/generate-bindings.pl --defines "${FEATURE_DEFINES_JAVASCRIPT}" --generator JS ${IDL_INCLUDES} --outputDir "${DERIVED_SOURCES_DIR}" --preprocessor "${CODE_GENERATOR_PREPROCESSOR}" ${WEBCORE_DIR}/${_file}
-        VERBATIM)
-    LIST(APPEND WebCore_SOURCES ${DERIVED_SOURCES_DIR}/JS${_name}.cpp)
-ENDFOREACH ()
-
+INCLUDE(${WEBCORE_DIR}/UseJSC.cmake)
  
 # All Web Inspector generated files are created with this one call to CodeGeneratorInspector.pm
 ADD_CUSTOM_COMMAND(
+    OUTPUT ${DERIVED_SOURCES_DIR}/Inspector.idl
+    MAIN_DEPENDENCY inspector/Inspector.json
+    DEPENDS ${WEBCORE_DIR}/inspector/generate-inspector-idl ${WEBCORE_DIR}/inspector/Inspector.json
+    COMMAND ${PYTHON_EXECUTABLE} ${WEBCORE_DIR}/inspector/generate-inspector-idl -o ${DERIVED_SOURCES_DIR}/Inspector.idl ${WEBCORE_DIR}/inspector/Inspector.json
+    VERBATIM)
+
+ADD_CUSTOM_COMMAND(
     OUTPUT ${DERIVED_SOURCES_DIR}/InspectorBackendDispatcher.cpp ${DERIVED_SOURCES_DIR}/InspectorBackendDispatcher.h ${DERIVED_SOURCES_DIR}/InspectorFrontend.cpp ${DERIVED_SOURCES_DIR}/InspectorFrontend.h
-    MAIN_DEPENDENCY inspector/Inspector.idl
-    DEPENDS ${WEBCORE_DIR}/bindings/scripts/generate-bindings.pl ${SCRIPTS_BINDINGS} ${WEBCORE_DIR}/inspector/CodeGeneratorInspector.pm inspector/Inspector.idl
-    COMMAND ${PERL_EXECUTABLE} -I${WEBCORE_DIR}/bindings/scripts -I${WEBCORE_DIR}/inspector ${WEBCORE_DIR}/bindings/scripts/generate-bindings.pl --defines "${FEATURE_DEFINES_JAVASCRIPT}" --generator Inspector ${IDL_INCLUDES} --outputDir "${DERIVED_SOURCES_DIR}" --preprocessor "${CODE_GENERATOR_PREPROCESSOR}" ${WEBCORE_DIR}/inspector/Inspector.idl
+    MAIN_DEPENDENCY ${DERIVED_SOURCES_DIR}/Inspector.idl
+    DEPENDS ${WEBCORE_DIR}/bindings/scripts/generate-bindings.pl ${SCRIPTS_BINDINGS} ${WEBCORE_DIR}/inspector/CodeGeneratorInspector.pm ${DERIVED_SOURCES_DIR}/Inspector.idl
+    COMMAND ${PERL_EXECUTABLE} -I${WEBCORE_DIR}/bindings/scripts -I${WEBCORE_DIR}/inspector ${WEBCORE_DIR}/bindings/scripts/generate-bindings.pl --defines "${FEATURE_DEFINES_JAVASCRIPT}" --generator Inspector ${IDL_INCLUDES} --outputDir "${DERIVED_SOURCES_DIR}" --preprocessor "${CODE_GENERATOR_PREPROCESSOR}" ${DERIVED_SOURCES_DIR}/Inspector.idl
     VERBATIM)
 LIST(APPEND WebCore_SOURCES ${DERIVED_SOURCES_DIR}/InspectorBackendDispatcher.cpp ${DERIVED_SOURCES_DIR}/InspectorFrontend.cpp)
 
@@ -2263,6 +2107,15 @@ GENERATE_DOM_NAMES(XML ${WEBCORE_DIR}/xml/xmlattrs.in)
 LIST(APPEND WebCore_SOURCES ${DERIVED_SOURCES_DIR}/XMLNames.cpp)
 
 
+ADD_CUSTOM_COMMAND(
+    OUTPUT ${DERIVED_SOURCES_DIR}/WebKitVersion.h
+    MAIN_DEPENDENCY ${WEBKIT_DIR}/scripts/generate-webkitversion.pl
+    DEPENDS ${WEBKIT_DIR}/mac/Configurations/Version.xcconfig
+    COMMAND ${PERL_EXECUTABLE} ${WEBKIT_DIR}/scripts/generate-webkitversion.pl --config ${WEBKIT_DIR}/mac/Configurations/Version.xcconfig --outputDir ${DERIVED_SOURCES_DIR}
+    VERBATIM)
+LIST(APPEND WebCore_SOURCES ${DERIVED_SOURCES_DIR}/WebKitVersion.h)
+
+
 SET(WebCore_LIBRARIES
     ${JavaScriptCore_LIBRARY_NAME}
 )
diff --git a/Source/WebCore/CMakeListsEfl.txt b/Source/WebCore/CMakeListsEfl.txt
index ba7b554..8c19c19 100644
--- a/Source/WebCore/CMakeListsEfl.txt
+++ b/Source/WebCore/CMakeListsEfl.txt
@@ -13,6 +13,7 @@ LIST(APPEND WebCore_INCLUDE_DIRECTORIES
   "${WEBCORE_DIR}/accessibility/efl"
   "${WEBKIT_DIR}/efl/WebCoreSupport"
   "${WEBKIT_DIR}/efl/ewk"
+  "${DERIVED_SOURCES_DIR}"
 )
 
 LIST(APPEND WebCore_SOURCES
@@ -167,6 +168,12 @@ IF (WTF_USE_ICU_UNICODE)
   )
 ENDIF ()
 
+IF (ENABLE_GEOLOCATION)
+  LIST(APPEND WebCore_SOURCES
+    platform/efl/GeolocationServiceEfl.cpp
+  )
+ENDIF()
+
 IF (ENABLE_VIDEO)
   LIST(APPEND WebCore_INCLUDE_DIRECTORIES
     "${WEBCORE_DIR}/platform/graphics/gstreamer"
diff --git a/Source/WebCore/CMakeListsWinCE.txt b/Source/WebCore/CMakeListsWinCE.txt
index 01757a7..98e7410 100644
--- a/Source/WebCore/CMakeListsWinCE.txt
+++ b/Source/WebCore/CMakeListsWinCE.txt
@@ -24,8 +24,6 @@ LIST(APPEND WebCore_SOURCES
     page/win/EventHandlerWin.cpp
     page/wince/FrameWinCE.cpp
 
-    loader/icon/IconDatabaseNone.cpp
-
     rendering/RenderThemeWince.cpp
 
     plugins/PluginDatabase.cpp
@@ -60,6 +58,7 @@ LIST(APPEND WebCore_SOURCES
     platform/win/FileChooserWin.cpp
     platform/win/KeyEventWin.cpp
     platform/win/LanguageWin.cpp
+    platform/win/LocalizedStringsWin.cpp
     platform/win/PasteboardWin.cpp
     platform/win/PopupMenuWin.cpp
     platform/win/PlatformMouseEventWin.cpp
diff --git a/Source/WebCore/ChangeLog b/Source/WebCore/ChangeLog
index 46a64cd..204f540 100644
--- a/Source/WebCore/ChangeLog
+++ b/Source/WebCore/ChangeLog
@@ -1,3 +1,18167 @@
+2011-03-30  Martin Robinson  <mrobinson@igalia.com>
+
+        Try to fix the EFL build.
+
+        * platform/efl/RenderThemeEfl.cpp:
+        (WebCore::RenderThemeEfl::paintThemePart): Use the new cairo_t accessor on the platform context.
+
+2011-03-30  Abhishek Arya  <inferno@chromium.org>
+
+        Reviewed by Simon Fraser.
+
+        Fix wrong type assumptions in editing code. Move code
+        from ASSERTs to hard checks.
+        https://bugs.webkit.org/show_bug.cgi?id=57348
+
+        Test: editing/execCommand/remove-format-non-html-element-crash.html
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty):
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::getRGBAFontColor):
+        (WebCore::ApplyStyleCommand::pushDownInlineStyleAroundNode):
+        * editing/DeleteButtonController.cpp:
+        (WebCore::enclosingDeletableElement):
+        * editing/EditingStyle.cpp:
+        (WebCore::EditingStyle::textDirection):
+        (WebCore::EditingStyle::prepareToApplyAt):
+        * editing/Editor.cpp:
+        (WebCore::Editor::textDirectionForSelection):
+        * editing/FormatBlockCommand.cpp:
+        (WebCore::FormatBlockCommand::elementForFormatBlockCommand):
+
+2011-03-30  Stephen White  <senorblanco@chromium.org>
+
+        Reviewed by Kenneth Russell.
+
+        Speed up clipping in accelerated 2D canvas.
+        https://bugs.webkit.org/show_bug.cgi?id=57464
+
+        Instead of clearing the entire stencil buffer when removing clipping paths, we erase the path with a DECR stencil operation.
+        Covered by canvas/philip/tests/2d.path.clip.intersect.html, and others.
+
+        * platform/graphics/chromium/GLES2Canvas.cpp:
+        (WebCore::PathAndTransform::PathAndTransform):
+        New structure to keep track of the CTM at the time the clipping path was added.
+        (WebCore::GLES2Canvas::State::State):
+        Replace m_clippingEnabled with a count of total clipping paths.
+        (WebCore::GLES2Canvas::clearRect):
+        Check the total clipping path count, instead of m_clippingEnabled.
+        (WebCore::GLES2Canvas::fillPath):
+        (WebCore::GLES2Canvas::fillRect):
+        Perform state application after doing shadows.  This is necessary
+        since restore() may now leave clipping enabled.
+        (WebCore::GLES2Canvas::clipPath):
+        Explicitly specify the stencil operation as INCR.  Store the current
+        transformation when saving clipping paths.
+        (WebCore::GLES2Canvas::restore):
+        Don't clear the stencil buffer and re-draw active paths on each restore.
+        Erase the old paths with DECR.
+        (WebCore::GLES2Canvas::drawTexturedRect):
+        Check m_numClippingPaths instead of m_clippingEnabled.
+        (WebCore::GLES2Canvas::beginShadowDraw):
+        Perform state application when drawing hard shadows.
+        (WebCore::GLES2Canvas::endShadowDraw):
+        Check m_numClippingPaths instead of m_clippingEnabled.
+        (WebCore::GLES2Canvas::beginStencilDraw):
+        Make the stencil op a parameter to beginShadowDraw().
+        (WebCore::GLES2Canvas::applyClipping):
+        Compare against the total number of stencil paths, not just the ones in
+        the current state.
+        * platform/graphics/chromium/GLES2Canvas.h:
+        Make the stencil op a parameter to beginShadowDraw().
+
+2011-03-29  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Move factory-like things in EventDispatcher::dispatchMouseEvent to a factory, clean up names and ordering.
+        https://bugs.webkit.org/show_bug.cgi?id=57419
+
+        Refactoring, covered by existing tests.
+
+        * dom/EventDispatcher.cpp:
+        (WebCore::EventDispatcher::dispatchMouseEvent): Reordered and clarified names.
+        * dom/MouseEvent.cpp:
+        (WebCore::MouseEvent::create): Added a new factory method that takes PlatformMouseEvent.
+        * dom/MouseEvent.h: Added decl.
+
+2011-03-30  Erik Arvidsson  <arv@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Missing DOM bindings for a ping
+        https://bugs.webkit.org/show_bug.cgi?id=51955
+
+        Test: fast/dom/ping-attribute-dom-binding.html
+
+        * html/HTMLAnchorElement.idl:
+        * html/HTMLAreaElement.idl:
+
+2011-03-30  Martin Robinson  <mrobinson@igalia.com>
+
+        Reviewed by Dirk Schulze.
+
+        [Cairo] Better separate the concerns of GraphicsContextCairo
+        https://bugs.webkit.org/show_bug.cgi?id=55150
+
+        Add a PlatformContextCairo which right now stores the cairo_t* for a
+        GraphicsContextCairo. Later patches will move logic for tracking ContextShadow
+        and image masking layers into this PlatformContextCairo class.
+
+        No new tests. This patch is only a code cleanup.
+
+        * GNUmakefile.am:
+        * platform/graphics/GraphicsContext.h: The platform context is no longer a
+        cairo_t, but our new class the PlatformContextCairo.
+        * platform/graphics/cairo/ContextShadowCairo.cpp: Updated to reflect new class.j
+        * platform/graphics/cairo/FontCairo.cpp: Ditto.
+        * platform/graphics/cairo/GradientCairo.cpp: Ditto.
+        * platform/graphics/cairo/GraphicsContextCairo.cpp: Mostly mechanical
+        changes which now reference platformContext()->cr() to get the cairo_t.
+        * platform/graphics/cairo/GraphicsContextPlatformPrivateCairo.h: Now hold the
+        PlatformContextCairo instead of the cairo_t.
+        * platform/graphics/cairo/ImageBufferCairo.cpp: Update to reflect new class.
+        * platform/graphics/cairo/ImageCairo.cpp: Ditto.
+        * platform/graphics/cairo/PathCairo.cpp: Ditto.
+        * platform/graphics/cairo/PlatformContextCairo.cpp: Added.
+        * platform/graphics/cairo/PlatformContextCairo.h: Added.
+        * platform/graphics/gtk/FontGtk.cpp: Update to reflect new class.
+        * platform/graphics/gtk/IconGtk.cpp: Ditto.
+        * platform/graphics/win/GraphicsContextCairoWin.cpp: Now fill out
+        m_data with a private section containing the platform context instead of
+        just a cairo_t.
+        * platform/gtk/RenderThemeGtk.cpp: Update to reflect new class.
+        * platform/gtk/WidgetRenderingContext.cpp: Ditto.
+        (WebCore::WidgetRenderingContext::~WidgetRenderingContext): Ditto.
+        * plugins/gtk/PluginViewGtk.cpp: Ditto.
+
+2011-03-30  Patrick Gansterer  <paroga@webkit.org>
+
+        Unreviewed WinCE build fix for r82465.
+
+        * CMakeListsWinCE.txt:
+
+2011-03-30  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Update Windows production build logic for new production configurations
+        https://bugs.webkit.org/show_bug.cgi?id=57494
+
+        * WebCore.vcproj/QTMovieWinProduction.vsprops:
+        * WebCore.vcproj/WebCore.make:
+        * WebCore.vcproj/WebCoreProduction.vsprops:
+
+2011-03-30  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Brady Eidson.
+
+        WebKit2: Attempting to view css file from url causes it to download
+        <rdar://problem/9102611>
+        https://bugs.webkit.org/show_bug.cgi?id=57501
+
+        * WebCore.exp.in:
+        * platform/MIMETypeRegistry.cpp:
+        (WebCore::initializeUnsupportedTextMIMETypes):
+        (WebCore::initializeMIMETypeRegistry):
+        (WebCore::MIMETypeRegistry::isUnsupportedTextMIMEType):
+        (WebCore::MIMETypeRegistry::getUnsupportedTextMIMETypes):
+        * platform/MIMETypeRegistry.h:
+        Add set of unsupported text MIME types, taken from WebKit/mac.
+
+2011-03-30  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Darin Adler.
+        
+        Crash when closing "Add Bookmark" dialog using the Enter Key
+        https://bugs.webkit.org/show_bug.cgi?id=57294
+        <rdar://problem/9044756>
+
+        Protect the FrameView in EventHandler::keyEvent, like we do in other EventHandler
+        functions that could destroy the frame.
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::keyEvent):
+
+2011-03-30  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r82463.
+        http://trac.webkit.org/changeset/82463
+        https://bugs.webkit.org/show_bug.cgi?id=57482
+
+        Assertion failure in Node::rendererIsEditable on multiple
+        editing tests (Requested by aroben|meeting on #webkit).
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue):
+        * css/CSSPrimitiveValueMappings.h:
+        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
+        (WebCore::CSSPrimitiveValue::operator EUnicodeBidi):
+        * css/CSSValueKeywords.in:
+        * rendering/style/RenderStyle.h:
+        * rendering/style/RenderStyleConstants.h:
+
+2011-03-24  Luiz Agostini  <luiz.agostini@openbossa.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] QNetworkReplyHandler refactoring: signal sequence.
+        https://bugs.webkit.org/show_bug.cgi?id=57049
+
+        This is the first step in QNetworkReplyHandler. The main objective here is to create simple invariants:
+
+            1 - that the signals metadatachanged, readyRead and finished will come in this order.
+            2 - that signals metadatachanged and finished will be called exactly once.
+
+        Having these invariants further simplifications will be possible and will come in future patches.
+
+        Class QNetworkReplyWrapper was created to handle QNetworkReply object. To connect to the signals of it
+        instead of connecting to the signals of QNetworkReply is what guarantees the sequence of the signals.
+        QNetworkReplyWrapper will be used in future to perform mime type sniffing before sending
+        metadatachanged signal.
+
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::QNetworkReplyWrapper::QNetworkReplyWrapper):
+        (WebCore::QNetworkReplyWrapper::~QNetworkReplyWrapper):
+        (WebCore::QNetworkReplyWrapper::release):
+        (WebCore::QNetworkReplyWrapper::resetConnections):
+        (WebCore::QNetworkReplyWrapper::receiveMetaData):
+        (WebCore::QNetworkReplyWrapper::didReceiveFinished):
+        (WebCore::QNetworkReplyHandler::QNetworkReplyHandler):
+        (WebCore::QNetworkReplyHandler::resetState):
+        (WebCore::QNetworkReplyHandler::release):
+        (WebCore::QNetworkReplyHandler::finish):
+        (WebCore::QNetworkReplyHandler::sendResponseIfNeeded):
+        (WebCore::QNetworkReplyHandler::redirect):
+        (WebCore::QNetworkReplyHandler::forwardData):
+        (WebCore::QNetworkReplyHandler::sendNetworkRequest):
+        (WebCore::QNetworkReplyHandler::start):
+        * platform/network/qt/QNetworkReplyHandler.h:
+        (WebCore::QNetworkReplyWrapper::reply):
+        (WebCore::QNetworkReplyWrapper::redirectionTargetUrl):
+        (WebCore::QNetworkReplyWrapper::encoding):
+        (WebCore::QNetworkReplyWrapper::advertisedMimeType):
+        (WebCore::QNetworkReplyHandler::reply):
+
+2011-03-30  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Rename Windows configuration Release_LTCG to Production for clarity
+        https://bugs.webkit.org/show_bug.cgi?id=57465
+
+        * WebCore.vcproj/QTMovieWin.vcproj:
+        * WebCore.vcproj/QTMovieWinProduction.vsprops: Copied from Source/WebCore/WebCore.vcproj/QTMovieWinReleaseLTCG.vsprops.
+        * WebCore.vcproj/QTMovieWinReleaseLTCG.vsprops: Removed.
+        * WebCore.vcproj/WebCore.sln:
+        * WebCore.vcproj/WebCore.submit.sln:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.vcproj/WebCoreGenerated.vcproj:
+        * WebCore.vcproj/WebCoreProduction.vsprops: Copied from Source/WebCore/WebCore.vcproj/WebCoreReleaseLTCG.vsprops.
+        * WebCore.vcproj/WebCoreReleaseLTCG.vsprops: Removed.
+
+2011-03-30  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Anders Carlsson.
+        
+        ASSERT(cookieStorageAdapter) when calling stopObservingCookieChanges after WebProcess has crashed
+        https://bugs.webkit.org/show_bug.cgi?id=57477
+        <rdar://problem/9178751>
+        
+        If someone has called startObservingCookieChanges, and the WebProcess crashes and restarts, the UIProcess
+        will call stopObservingCookieChanges when cookieStorageAdapter is nil.
+        
+        The assert is wrong when the web process crashes, and there is no harm in dispatching a message to nil,
+        so remove the assert.
+        
+        * platform/network/mac/CookieStorageMac.mm:
+        (WebCore::stopObservingCookieChanges):
+
+2011-03-30  Sam Weinig  <sam@webkit.org>
+
+        Fix Leopard build.
+
+        * platform/DefaultLocalizationStrategy.cpp:
+        (WebCore::DefaultLocalizationStrategy::contextMenuItemTagLookUpInDictionary):
+
+2011-03-30  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Add default localization strategy that can be shared by WebKit1 and WebKit2
+        https://bugs.webkit.org/show_bug.cgi?id=57406
+
+        Currently, only WebKit2 uses this default strategy, but WebKit1 should be able
+        to adopt it soon.
+
+        * platform/DefaultLocalizationStrategy.cpp: Copied from Source/WebKit2/WebProcess/WebCoreSupport/WebPlatformStrategies.cpp.
+        (WebCore::DefaultLocalizationStrategy::DefaultLocalizationStrategy):
+        * platform/DefaultLocalizationStrategy.h: Copied from Source/WebKit2/WebProcess/WebCoreSupport/WebPlatformStrategies.h.
+        Copy the implementation of the Localization strategy from WebKit2 into a shared default strategy.
+
+        * platform/LocalizedStrings.cpp:
+        (WebCore::localizedString):
+        Add default implementation of localization bottleneck function.
+
+        * platform/LocalizedStrings.h:
+        Add localization macros here, instead of defining them in the above layer.
+
+        * platform/PlatformStrategies.cpp:
+        (WebCore::PlatformStrategies::createLocalizationStrategy):
+        * platform/PlatformStrategies.h:
+        Add default implementation of strategy creation function which creates the default strategy.
+
+        * platform/win/LocalizedStringsWin.cpp: Copied from Source/WebCore/platform/mac/LocalizedStringsMac.mm.
+        (WebCore::localizedString):
+        Add stub for windows, this will be update to pull from the bundle in a follow up patch.
+
+        * Android.mk:
+        * CMakeLists.txt:
+        * GNUmakefile.am:
+        * WebCore.exp.in:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        Add new files.
+
+2011-03-30  Andras Becsi  <abecsi@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        CSS: Slow parsing of rgb() with percent values
+        https://bugs.webkit.org/show_bug.cgi?id=16708
+
+        Implement fast-path parsing for percentage color values.
+
+        Gain ~30% speedup on  http://canvex.lazyilluminati.com/misc/3d.html
+
+        Relanding with rounding fix after it was rolled out in r82315.
+
+        * css/CSSParser.cpp:
+        (WebCore::checkForValidDouble): Extend to return the number of characters forming a valid double.
+        (WebCore::parseDouble): Function for parsing double values if they are valid.
+        (WebCore::parseColorIntOrPercentage): Extend parseColorInt to deal with percentage values.
+        (WebCore::parseAlphaValue): Use the new functions.
+        (WebCore::CSSParser::parseColor): Ditto.
+
+2011-03-30  Ofri Wolfus  <ofri@dhcp-172-28-40-178.tlv.corp.google.com>
+
+        Reviewed by Eric Seidel.
+
+        Add support for parsing unicode-bidi: -webkit-plaintext.
+        https://bugs.webkit.org/show_bug.cgi?id=57457
+
+        Test: css3/unicode-bidi-plaintext-parse.html
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue):
+        * css/CSSPrimitiveValueMappings.h:
+        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
+        (WebCore::CSSPrimitiveValue::operator EUnicodeBidi):
+        * css/CSSValueKeywords.in:
+        * rendering/style/RenderStyle.h:
+        * rendering/style/RenderStyleConstants.h:
+
+2011-03-30  Andreas Kling  <kling@webkit.org>
+
+        Reviewed by Benjamin Poulain.
+
+        [Qt] Remove unused variables in GraphicsContext::fillRect()
+
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::fillRect):
+
+2011-03-30  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        REGRESSION(r82419): New pixel test failure fast/box-shadow/basic-shadows.html
+        https://bugs.webkit.org/show_bug.cgi?id=57442
+
+        When checking the position of the inline iterator in the logicallyLastRun, we should not consider BR as text.
+
+        No new tests as existing test covers this case.
+
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::reachedEndOfTextRenderer):
+
+2011-03-30  Mario Sanchez Prada  <msanchez@igalia.com>
+
+        Reviewed by Chris Fleizach.
+
+        AX: GTK: ARIA role is not respected on <p> <label> <div> and <form>
+        https://bugs.webkit.org/show_bug.cgi?id=47636
+
+        Define new roles in WebCore and map them to ATK accordingly.
+
+        Test: platform/gtk/accessibility/aria-roles-unignored.html
+
+        * accessibility/AccessibilityObject.h: Added new roles to
+        represent paragraphs, labels, forms and div sections.
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::determineAccessibilityRole):
+        Return ParagraphRole, LabelRole, FormRole and DivRole when needed
+        for the GTK platform only.
+        * accessibility/gtk/AccessibilityObjectAtk.cpp:
+        (WebCore::AccessibilityObject::allowsTextRanges): Consider the new
+        roles now that those kind of nodes won't return true to isGroup().
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (atkRole): Map new WebCore roles to ATK Roles.
+        (webkit_accessible_get_role): Remove code to define roles for
+        paragraphs, labels, forms and divs based on node's tag name.
+
+        Update mappings for the Mac platform.
+
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        (createAccessibilityRoleMap): Add explicit mappings from the new
+        roles introduced to NSAccessibilityGroupRole.
+
+2011-03-30  Yury Semikhatsky  <yurys@chromium.org>
+
+        Unreviewed. Build fix for Efl and Qt Win.
+
+        * inspector/PageDebuggerAgent.cpp: removed ENABLE(WORKERS) guard from code that has nothing to do with workers.
+
+2011-03-30  Andrey Kosyakov  <caseq@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: audit run never completes, fails in DOMAgent.js
+        https://bugs.webkit.org/show_bug.cgi?id=57349
+
+        - assure document is present before calling DOMAgent.querySelectAll()
+
+        * inspector/front-end/AuditRules.js:
+        (WebInspector.AuditRules.ImageDimensionsRule.prototype.doRun):
+
+2011-03-30  Yury Semikhatsky  <yurys@chromium.org>
+
+        Unreviewed. Build fix.
+
+        * UseJSC.cmake: fix typo PageDebugServer -> PageScriptDebugServer
+
+2011-03-30  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: split debugger agent into Page and Worker-specific ones
+        https://bugs.webkit.org/show_bug.cgi?id=57345
+
+        ScriptDebugServer and InspectorDebuggerAgent contain only functionality common
+        for Worker and Page debugger. All specifics is moved into Page/WorkerScriptDebugServer
+        and Page/WorkerDebuggerAgent.
+
+        * CMakeLists.txt:
+        * GNUmakefile.am:
+        * UseJSC.cmake:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSBindingsAllInOne.cpp:
+        * bindings/js/JSInjectedScriptHostCustom.cpp:
+        (WebCore::JSInjectedScriptHost::currentCallFrame):
+        * bindings/js/PageScriptDebugServer.cpp: Added.
+        (WebCore::toPage):
+        (WebCore::PageScriptDebugServer::shared):
+        (WebCore::PageScriptDebugServer::PageScriptDebugServer):
+        (WebCore::PageScriptDebugServer::~PageScriptDebugServer):
+        (WebCore::PageScriptDebugServer::addListener):
+        (WebCore::PageScriptDebugServer::removeListener):
+        (WebCore::PageScriptDebugServer::recompileAllJSFunctions):
+        (WebCore::PageScriptDebugServer::getListenersForGlobalObject):
+        (WebCore::PageScriptDebugServer::didPause):
+        (WebCore::PageScriptDebugServer::didContinue):
+        (WebCore::PageScriptDebugServer::didRemoveLastListener):
+        (WebCore::PageScriptDebugServer::setJavaScriptPaused):
+        * bindings/js/PageScriptDebugServer.h: Added.
+        * bindings/js/ScriptDebugServer.cpp:
+        (WebCore::ScriptDebugServer::ScriptDebugServer):
+        (WebCore::ScriptDebugServer::sourceParsed):
+        (WebCore::ScriptDebugServer::dispatchFunctionToListeners):
+        (WebCore::ScriptDebugServer::createCallFrameAndPauseIfNeeded):
+        (WebCore::ScriptDebugServer::updateCallFrameAndPauseIfNeeded):
+        (WebCore::ScriptDebugServer::pauseIfNeeded):
+        * bindings/js/ScriptDebugServer.h:
+        * bindings/js/WorkerScriptDebugServer.cpp: Added.
+        (WebCore::WorkerScriptDebugServer::WorkerScriptDebugServer):
+        (WebCore::WorkerScriptDebugServer::addListener):
+        (WebCore::WorkerScriptDebugServer::removeListener):
+        * bindings/js/WorkerScriptDebugServer.h: Added.
+        (WebCore::WorkerScriptDebugServer::~WorkerScriptDebugServer):
+        (WebCore::WorkerScriptDebugServer::recompileAllJSFunctions):
+        (WebCore::WorkerScriptDebugServer::getListenersForGlobalObject):
+        (WebCore::WorkerScriptDebugServer::didPause):
+        (WebCore::WorkerScriptDebugServer::didContinue):
+        * bindings/v8/PageScriptDebugServer.cpp: Added.
+        (WebCore::retrieveFrame):
+        (WebCore::PageScriptDebugServer::shared):
+        (WebCore::PageScriptDebugServer::PageScriptDebugServer):
+        (WebCore::PageScriptDebugServer::addListener):
+        (WebCore::PageScriptDebugServer::removeListener):
+        (WebCore::PageScriptDebugServer::setClientMessageLoop):
+        (WebCore::PageScriptDebugServer::getDebugListenerForContext):
+        (WebCore::PageScriptDebugServer::runMessageLoopOnPause):
+        (WebCore::PageScriptDebugServer::quitMessageLoopOnPause):
+        * bindings/v8/PageScriptDebugServer.h: Added.
+        (WebCore::PageScriptDebugServer::setEnabled):
+        (WebCore::PageScriptDebugServer::ClientMessageLoop::~ClientMessageLoop):
+        (WebCore::PageScriptDebugServer::~PageScriptDebugServer):
+        * bindings/v8/ScriptDebugServer.cpp:
+        (WebCore::ScriptDebugServer::ScriptDebugServer):
+        (WebCore::ScriptDebugServer::setPauseOnNextStatement):
+        (WebCore::ScriptDebugServer::breakProgram):
+        (WebCore::ScriptDebugServer::continueProgram):
+        (WebCore::ScriptDebugServer::stepIntoStatement):
+        (WebCore::ScriptDebugServer::stepOverStatement):
+        (WebCore::ScriptDebugServer::stepOutOfFunction):
+        (WebCore::ScriptDebugServer::editScriptSource):
+        (WebCore::toScriptDebugServer):
+        (WebCore::ScriptDebugServer::breakProgramCallback):
+        (WebCore::ScriptDebugServer::v8DebugEventCallback):
+        (WebCore::ScriptDebugServer::handleV8DebugEvent):
+        (WebCore::ScriptDebugServer::isPaused):
+        * bindings/v8/ScriptDebugServer.h:
+        * bindings/v8/WorkerScriptDebugServer.cpp: Added.
+        (WebCore::WorkerScriptDebugServer::WorkerScriptDebugServer):
+        (WebCore::WorkerScriptDebugServer::addListener):
+        (WebCore::WorkerScriptDebugServer::removeListener):
+        * bindings/v8/WorkerScriptDebugServer.h: Added.
+        (WebCore::WorkerScriptDebugServer::~WorkerScriptDebugServer):
+        (WebCore::WorkerScriptDebugServer::getDebugListenerForContext):
+        (WebCore::WorkerScriptDebugServer::runMessageLoopOnPause):
+        (WebCore::WorkerScriptDebugServer::quitMessageLoopOnPause):
+        * bindings/v8/custom/V8InjectedScriptHostCustom.cpp:
+        (WebCore::V8InjectedScriptHost::currentCallFrameCallback):
+        * inspector/InjectedScriptHost.h:
+        (WebCore::InjectedScriptHost::init):
+        (WebCore::InjectedScriptHost::debuggerAgent):
+        * inspector/InspectorAgent.cpp:
+        (WebCore::InspectorAgent::InspectorAgent):
+        * inspector/InspectorDebuggerAgent.cpp:
+        (WebCore::InspectorDebuggerAgent::InspectorDebuggerAgent):
+        (WebCore::InspectorDebuggerAgent::enable):
+        (WebCore::InspectorDebuggerAgent::disable):
+        (WebCore::InspectorDebuggerAgent::setBreakpointsActive):
+        (WebCore::InspectorDebuggerAgent::removeBreakpoint):
+        (WebCore::InspectorDebuggerAgent::continueToLocation):
+        (WebCore::InspectorDebuggerAgent::resolveBreakpoint):
+        (WebCore::InspectorDebuggerAgent::editScriptSource):
+        (WebCore::InspectorDebuggerAgent::schedulePauseOnNextStatement):
+        (WebCore::InspectorDebuggerAgent::cancelPauseOnNextStatement):
+        (WebCore::InspectorDebuggerAgent::resume):
+        (WebCore::InspectorDebuggerAgent::stepOver):
+        (WebCore::InspectorDebuggerAgent::stepInto):
+        (WebCore::InspectorDebuggerAgent::stepOut):
+        (WebCore::InspectorDebuggerAgent::setPauseOnExceptionsState):
+        (WebCore::InspectorDebuggerAgent::didPause):
+        (WebCore::InspectorDebuggerAgent::breakProgram):
+        * inspector/InspectorDebuggerAgent.h:
+        * inspector/InspectorProfilerAgent.cpp:
+        (WebCore::InspectorProfilerAgent::disable):
+        (WebCore::InspectorProfilerAgent::enable):
+        (WebCore::InspectorProfilerAgent::startUserInitiatedProfiling):
+        * inspector/PageDebuggerAgent.cpp: Added.
+        (WebCore::PageDebuggerAgent::create):
+        (WebCore::PageDebuggerAgent::PageDebuggerAgent):
+        (WebCore::PageDebuggerAgent::~PageDebuggerAgent):
+        (WebCore::PageDebuggerAgent::startListeningScriptDebugServer):
+        (WebCore::PageDebuggerAgent::stopListeningScriptDebugServer):
+        (WebCore::PageDebuggerAgent::scriptDebugServer):
+        * inspector/PageDebuggerAgent.h: Added.
+        * inspector/WorkerDebuggerAgent.cpp: Added.
+        (WebCore::WorkerDebuggerAgent::create):
+        (WebCore::WorkerDebuggerAgent::WorkerDebuggerAgent):
+        (WebCore::WorkerDebuggerAgent::~WorkerDebuggerAgent):
+        (WebCore::WorkerDebuggerAgent::startListeningScriptDebugServer):
+        (WebCore::WorkerDebuggerAgent::stopListeningScriptDebugServer):
+        (WebCore::WorkerDebuggerAgent::scriptDebugServer):
+        * inspector/WorkerDebuggerAgent.h: Added.
+
+2011-03-30  Levi Weintraub  <leviw@chromium.org>
+
+        Reviewed by Ryosuke Niwa.
+
+        Clicking below last line of right-to-left editable text that puts caret in the wrong place
+        https://bugs.webkit.org/show_bug.cgi?id=38087
+
+        Moving getLogical[Start/End]BoxWithNode to RootInlineBox and using it in positionForPointWithInlineChildren
+        instead of lastLeafChild, which wasn't correct in the RTL case.
+
+        Test: editing/selection/click-below-rtl-text.html
+
+        * editing/visible_units.cpp:
+        (WebCore::logicalStartPositionForLine): Moved to RootInlineBox.
+        (WebCore::logicalEndPositionForLine): Ditto.
+        * editing/visible_units.h:
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::positionForPointWithInlineChildren): Useing getLogicalEndBoxWithNode instead
+        of lastLeafChild.
+        * rendering/RootInlineBox.cpp:
+        (WebCore::RootInlineBox::getLogicalStartBoxWithNode): Moved and refactored.
+        (WebCore::RootInlineBox::getLogicalEndBoxWithNode): Ditto.
+        * rendering/RootInlineBox.h:
+
+2011-03-30  Yury Semikhatsky  <yurys@chromium.org>
+
+        Unreviewed. Rollout r82438 and r82436.
+
+        * CMakeLists.txt:
+        * GNUmakefile.am:
+        * UseJSC.cmake:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSBindingsAllInOne.cpp:
+        * bindings/js/JSInjectedScriptHostCustom.cpp:
+        (WebCore::JSInjectedScriptHost::currentCallFrame):
+        * bindings/js/PageScriptDebugServer.cpp: Removed.
+        * bindings/js/PageScriptDebugServer.h: Removed.
+        * bindings/js/ScriptDebugServer.cpp:
+        (WebCore::ScriptDebugServer::shared):
+        (WebCore::ScriptDebugServer::ScriptDebugServer):
+        (WebCore::ScriptDebugServer::addListener):
+        (WebCore::ScriptDebugServer::removeListener):
+        (WebCore::ScriptDebugServer::hasListenersInterestedInPage):
+        (WebCore::toPage):
+        (WebCore::ScriptDebugServer::sourceParsed):
+        (WebCore::ScriptDebugServer::dispatchFunctionToListeners):
+        (WebCore::ScriptDebugServer::setJavaScriptPaused):
+        (WebCore::ScriptDebugServer::createCallFrameAndPauseIfNeeded):
+        (WebCore::ScriptDebugServer::updateCallFrameAndPauseIfNeeded):
+        (WebCore::ScriptDebugServer::pauseIfNeeded):
+        (WebCore::ScriptDebugServer::recompileAllJSFunctions):
+        (WebCore::ScriptDebugServer::didAddListener):
+        (WebCore::ScriptDebugServer::didRemoveListener):
+        * bindings/js/ScriptDebugServer.h:
+        * bindings/js/WorkerScriptDebugServer.cpp: Removed.
+        * bindings/js/WorkerScriptDebugServer.h: Removed.
+        * bindings/v8/PageScriptDebugServer.cpp: Removed.
+        * bindings/v8/PageScriptDebugServer.h: Removed.
+        * bindings/v8/ScriptDebugServer.cpp:
+        (WebCore::retrieveFrame):
+        (WebCore::ScriptDebugServer::shared):
+        (WebCore::ScriptDebugServer::ScriptDebugServer):
+        (WebCore::ScriptDebugServer::addListener):
+        (WebCore::ScriptDebugServer::removeListener):
+        (WebCore::ScriptDebugServer::setPauseOnNextStatement):
+        (WebCore::ScriptDebugServer::breakProgram):
+        (WebCore::ScriptDebugServer::continueProgram):
+        (WebCore::ScriptDebugServer::stepIntoStatement):
+        (WebCore::ScriptDebugServer::stepOverStatement):
+        (WebCore::ScriptDebugServer::stepOutOfFunction):
+        (WebCore::ScriptDebugServer::editScriptSource):
+        (WebCore::ScriptDebugServer::setEnabled):
+        (WebCore::ScriptDebugServer::breakProgramCallback):
+        (WebCore::ScriptDebugServer::v8DebugEventCallback):
+        (WebCore::ScriptDebugServer::handleV8DebugEvent):
+        (WebCore::ScriptDebugServer::didResume):
+        * bindings/v8/ScriptDebugServer.h:
+        (WebCore::ScriptDebugServer::pageCreated):
+        (WebCore::ScriptDebugServer::ClientMessageLoop::~ClientMessageLoop):
+        (WebCore::ScriptDebugServer::setClientMessageLoop):
+        * bindings/v8/WorkerScriptDebugServer.cpp: Removed.
+        * bindings/v8/WorkerScriptDebugServer.h: Removed.
+        * bindings/v8/custom/V8InjectedScriptHostCustom.cpp:
+        (WebCore::V8InjectedScriptHost::currentCallFrameCallback):
+        * inspector/InjectedScriptHost.h:
+        (WebCore::InjectedScriptHost::init):
+        * inspector/InspectorAgent.cpp:
+        (WebCore::InspectorAgent::InspectorAgent):
+        * inspector/InspectorDebuggerAgent.cpp:
+        (WebCore::InspectorDebuggerAgent::create):
+        (WebCore::InspectorDebuggerAgent::InspectorDebuggerAgent):
+        (WebCore::InspectorDebuggerAgent::enable):
+        (WebCore::InspectorDebuggerAgent::disable):
+        (WebCore::InspectorDebuggerAgent::setBreakpointsActive):
+        (WebCore::InspectorDebuggerAgent::removeBreakpoint):
+        (WebCore::InspectorDebuggerAgent::continueToLocation):
+        (WebCore::InspectorDebuggerAgent::resolveBreakpoint):
+        (WebCore::InspectorDebuggerAgent::editScriptSource):
+        (WebCore::InspectorDebuggerAgent::schedulePauseOnNextStatement):
+        (WebCore::InspectorDebuggerAgent::cancelPauseOnNextStatement):
+        (WebCore::InspectorDebuggerAgent::resume):
+        (WebCore::InspectorDebuggerAgent::stepOver):
+        (WebCore::InspectorDebuggerAgent::stepInto):
+        (WebCore::InspectorDebuggerAgent::stepOut):
+        (WebCore::InspectorDebuggerAgent::setPauseOnExceptionsState):
+        (WebCore::InspectorDebuggerAgent::didPause):
+        (WebCore::InspectorDebuggerAgent::breakProgram):
+        * inspector/InspectorDebuggerAgent.h:
+        * inspector/InspectorProfilerAgent.cpp:
+        (WebCore::InspectorProfilerAgent::disable):
+        (WebCore::InspectorProfilerAgent::enable):
+        (WebCore::InspectorProfilerAgent::startUserInitiatedProfiling):
+        * inspector/PageDebuggerAgent.cpp: Removed.
+        * inspector/PageDebuggerAgent.h: Removed.
+        * inspector/WorkerDebuggerAgent.cpp: Removed.
+        * inspector/WorkerDebuggerAgent.h: Removed.
+
+2011-03-30  Yury Semikhatsky  <yurys@chromium.org>
+
+        Unreviewed. Fix compilation on Windows and EFL.
+
+        * CMakeLists.txt:
+        * bindings/js/JSBindingsAllInOne.cpp:
+
+2011-03-30  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: split debugger agent into Page and Worker-specific ones
+        https://bugs.webkit.org/show_bug.cgi?id=57345
+
+        ScriptDebugServer and InspectorDebuggerAgent contain only functionality common
+        for Worker and Page debugger. All specifics is moved into Page/WorkerScriptDebugServer
+        and Page/WorkerDebuggerAgent.
+
+        * GNUmakefile.am:
+        * UseJSC.cmake:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSInjectedScriptHostCustom.cpp:
+        (WebCore::JSInjectedScriptHost::currentCallFrame):
+        * bindings/js/PageScriptDebugServer.cpp: Added.
+        (WebCore::toPage):
+        (WebCore::PageScriptDebugServer::shared):
+        (WebCore::PageScriptDebugServer::PageScriptDebugServer):
+        (WebCore::PageScriptDebugServer::~PageScriptDebugServer):
+        (WebCore::PageScriptDebugServer::addListener):
+        (WebCore::PageScriptDebugServer::removeListener):
+        (WebCore::PageScriptDebugServer::recompileAllJSFunctions):
+        (WebCore::PageScriptDebugServer::getListenersForGlobalObject):
+        (WebCore::PageScriptDebugServer::didPause):
+        (WebCore::PageScriptDebugServer::didContinue):
+        (WebCore::PageScriptDebugServer::didRemoveLastListener):
+        (WebCore::PageScriptDebugServer::setJavaScriptPaused):
+        * bindings/js/PageScriptDebugServer.h: Added.
+        * bindings/js/ScriptDebugServer.cpp:
+        (WebCore::ScriptDebugServer::ScriptDebugServer):
+        (WebCore::ScriptDebugServer::sourceParsed):
+        (WebCore::ScriptDebugServer::dispatchFunctionToListeners):
+        (WebCore::ScriptDebugServer::createCallFrameAndPauseIfNeeded):
+        (WebCore::ScriptDebugServer::updateCallFrameAndPauseIfNeeded):
+        (WebCore::ScriptDebugServer::pauseIfNeeded):
+        * bindings/js/ScriptDebugServer.h:
+        * bindings/js/WorkerScriptDebugServer.cpp: Added.
+        (WebCore::WorkerScriptDebugServer::WorkerScriptDebugServer):
+        (WebCore::WorkerScriptDebugServer::addListener):
+        (WebCore::WorkerScriptDebugServer::removeListener):
+        * bindings/js/WorkerScriptDebugServer.h: Added.
+        (WebCore::WorkerScriptDebugServer::~WorkerScriptDebugServer):
+        (WebCore::WorkerScriptDebugServer::recompileAllJSFunctions):
+        (WebCore::WorkerScriptDebugServer::getListenersForGlobalObject):
+        (WebCore::WorkerScriptDebugServer::didPause):
+        (WebCore::WorkerScriptDebugServer::didContinue):
+        * bindings/v8/PageScriptDebugServer.cpp: Added.
+        (WebCore::retrieveFrame):
+        (WebCore::PageScriptDebugServer::shared):
+        (WebCore::PageScriptDebugServer::PageScriptDebugServer):
+        (WebCore::PageScriptDebugServer::addListener):
+        (WebCore::PageScriptDebugServer::removeListener):
+        (WebCore::PageScriptDebugServer::setClientMessageLoop):
+        (WebCore::PageScriptDebugServer::getDebugListenerForContext):
+        (WebCore::PageScriptDebugServer::runMessageLoopOnPause):
+        (WebCore::PageScriptDebugServer::quitMessageLoopOnPause):
+        * bindings/v8/PageScriptDebugServer.h: Added.
+        (WebCore::PageScriptDebugServer::setEnabled):
+        (WebCore::PageScriptDebugServer::ClientMessageLoop::~ClientMessageLoop):
+        (WebCore::PageScriptDebugServer::~PageScriptDebugServer):
+        * bindings/v8/ScriptDebugServer.cpp:
+        (WebCore::ScriptDebugServer::ScriptDebugServer):
+        (WebCore::ScriptDebugServer::setPauseOnNextStatement):
+        (WebCore::ScriptDebugServer::breakProgram):
+        (WebCore::ScriptDebugServer::continueProgram):
+        (WebCore::ScriptDebugServer::stepIntoStatement):
+        (WebCore::ScriptDebugServer::stepOverStatement):
+        (WebCore::ScriptDebugServer::stepOutOfFunction):
+        (WebCore::ScriptDebugServer::editScriptSource):
+        (WebCore::toScriptDebugServer):
+        (WebCore::ScriptDebugServer::breakProgramCallback):
+        (WebCore::ScriptDebugServer::v8DebugEventCallback):
+        (WebCore::ScriptDebugServer::handleV8DebugEvent):
+        (WebCore::ScriptDebugServer::isPaused):
+        * bindings/v8/ScriptDebugServer.h:
+        * bindings/v8/WorkerScriptDebugServer.cpp: Added.
+        (WebCore::WorkerScriptDebugServer::WorkerScriptDebugServer):
+        (WebCore::WorkerScriptDebugServer::addListener):
+        (WebCore::WorkerScriptDebugServer::removeListener):
+        * bindings/v8/WorkerScriptDebugServer.h: Added.
+        (WebCore::WorkerScriptDebugServer::~WorkerScriptDebugServer):
+        (WebCore::WorkerScriptDebugServer::getDebugListenerForContext):
+        (WebCore::WorkerScriptDebugServer::runMessageLoopOnPause):
+        (WebCore::WorkerScriptDebugServer::quitMessageLoopOnPause):
+        * bindings/v8/custom/V8InjectedScriptHostCustom.cpp:
+        (WebCore::V8InjectedScriptHost::currentCallFrameCallback):
+        * inspector/InjectedScriptHost.h:
+        (WebCore::InjectedScriptHost::init):
+        (WebCore::InjectedScriptHost::debuggerAgent):
+        * inspector/InspectorAgent.cpp:
+        (WebCore::InspectorAgent::InspectorAgent):
+        * inspector/InspectorDebuggerAgent.cpp:
+        (WebCore::InspectorDebuggerAgent::InspectorDebuggerAgent):
+        (WebCore::InspectorDebuggerAgent::enable):
+        (WebCore::InspectorDebuggerAgent::disable):
+        (WebCore::InspectorDebuggerAgent::setBreakpointsActive):
+        (WebCore::InspectorDebuggerAgent::removeBreakpoint):
+        (WebCore::InspectorDebuggerAgent::continueToLocation):
+        (WebCore::InspectorDebuggerAgent::resolveBreakpoint):
+        (WebCore::InspectorDebuggerAgent::editScriptSource):
+        (WebCore::InspectorDebuggerAgent::schedulePauseOnNextStatement):
+        (WebCore::InspectorDebuggerAgent::cancelPauseOnNextStatement):
+        (WebCore::InspectorDebuggerAgent::resume):
+        (WebCore::InspectorDebuggerAgent::stepOver):
+        (WebCore::InspectorDebuggerAgent::stepInto):
+        (WebCore::InspectorDebuggerAgent::stepOut):
+        (WebCore::InspectorDebuggerAgent::setPauseOnExceptionsState):
+        (WebCore::InspectorDebuggerAgent::didPause):
+        (WebCore::InspectorDebuggerAgent::breakProgram):
+        * inspector/InspectorDebuggerAgent.h:
+        * inspector/InspectorProfilerAgent.cpp:
+        (WebCore::InspectorProfilerAgent::disable):
+        (WebCore::InspectorProfilerAgent::enable):
+        (WebCore::InspectorProfilerAgent::startUserInitiatedProfiling):
+        * inspector/PageDebuggerAgent.cpp: Added.
+        (WebCore::PageDebuggerAgent::create):
+        (WebCore::PageDebuggerAgent::PageDebuggerAgent):
+        (WebCore::PageDebuggerAgent::~PageDebuggerAgent):
+        (WebCore::PageDebuggerAgent::startListeningScriptDebugServer):
+        (WebCore::PageDebuggerAgent::stopListeningScriptDebugServer):
+        (WebCore::PageDebuggerAgent::scriptDebugServer):
+        * inspector/PageDebuggerAgent.h: Added.
+        * inspector/WorkerDebuggerAgent.cpp: Added.
+        (WebCore::WorkerDebuggerAgent::create):
+        (WebCore::WorkerDebuggerAgent::WorkerDebuggerAgent):
+        (WebCore::WorkerDebuggerAgent::~WorkerDebuggerAgent):
+        (WebCore::WorkerDebuggerAgent::startListeningScriptDebugServer):
+        (WebCore::WorkerDebuggerAgent::stopListeningScriptDebugServer):
+        (WebCore::WorkerDebuggerAgent::scriptDebugServer):
+        * inspector/WorkerDebuggerAgent.h: Added.
+
+2011-03-30  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: Make the getStylesForNode result "styleAttributes" value an array rather than a map
+        https://bugs.webkit.org/show_bug.cgi?id=57440
+
+        * inspector/InspectorCSSAgent.cpp:
+        (WebCore::InspectorCSSAgent::getStylesForNode):
+        (WebCore::InspectorCSSAgent::buildArrayForAttributeStyles):
+        * inspector/InspectorCSSAgent.h:
+        * inspector/front-end/CSSStyleModel.js:
+        (WebInspector.CSSStyleModel.prototype.getStylesAsync):
+
+2011-03-30  Evan Martin  <evan@chromium.org>
+
+        Reviewed by Ryosuke Niwa.
+
+        Fix a last-second ASSERT in previous change that was wrong.
+
+        * dom/Document.cpp:
+        (WebCore::Document::setTitle):
+
+2011-03-30  Levi Weintraub  <leviw@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        RTL:  Directionality always reset on hard line break
+        https://bugs.webkit.org/show_bug.cgi?id=23124
+
+        No longer clearing all BidiContexts when we hit a hard line break.
+        Instead, directionality applied by DOM elements is preserved by
+        reconstructing the context stack ignoring those that didn't come
+        from the DOM.
+
+        Test: fast/text/international/bidi-br-as-paragraph-separator.html
+
+        * platform/text/BidiContext.cpp:
+        (WebCore::BidiContext::createUncached):
+        (WebCore::BidiContext::create):
+        (WebCore::copyContextAndRebaselineLevel): Helper to make a copy of a context
+        and recalculate its bidi level.
+        (WebCore::BidiContext::copyStackRemovingUnicodeEmbeddingContexts): Returns the top of
+        a BidiContext stack that's equivalent but without contexts from Unicode directional
+        characters.
+        (WebCore::operator==): Now takes into account embedding source.
+        * platform/text/BidiContext.h:
+        (WebCore::BidiContext::source): Enum to specify whether an embedded
+        bidirectional control came from the DOM/Style or Unicode characters
+        (WebCore::BidiContext::BidiContext):
+        * platform/text/BidiResolver.h:
+        (WebCore::BidiEmbedding::BidiEmbedding): An embedding is now a direction
+        and a hint about where it came from so we can differentiate DOM directions
+        from unicode direction control characters.
+        (WebCore::BidiEmbedding::direction):
+        (WebCore::BidiEmbedding::source):
+        (WebCore::::embed): Now takes a source as well as a direction.
+        (WebCore::::commitExplicitEmbedding):
+        (WebCore::::createBidiRunsForLine):
+        * rendering/InlineIterator.h:
+        (WebCore::bidiNext):
+        (WebCore::bidiFirst):
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::determineStartPosition):
+
+2011-03-30  Steve Block  <steveblock@google.com>
+
+        Reviewed by Jeremy Orlow.
+
+        JavaMethod should not expose JavaString in its API
+        https://bugs.webkit.org/show_bug.cgi?id=55765
+
+        - Factors out a JavaMethod interface which does not use JNI types.
+          This will allow the Java bridge to be used with objects that
+          don't use JNI directly. The existing jobject-backed
+          implementation is moved to a new JavaMethodJobject class which
+          implements the interface.
+        - Use WTF::String in place of JavaString in the API, as JavaString
+          exposes JNI types in its interface.
+        - Remove the method ID as it uses JNI types.
+
+        No new tests, refactoring only.
+
+        * Android.jscbindings.mk:
+        * Android.v8bindings.mk:
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bridge/jni/JavaMethod.h:
+        * bridge/jni/JavaMethodJobject.cpp:
+        (JavaMethodJobject::JavaMethodJobject):
+        (JavaMethodJobject::~JavaMethodJobject):
+        (appendClassName):
+        (JavaMethodJobject::signature):
+        * bridge/jni/JavaMethodJobject.h: Copied from Source/WebCore/bridge/jni/JavaMethod.h.
+        (JSC::Bindings::JavaMethodJobject::name):
+        (JSC::Bindings::JavaMethodJobject::returnTypeClassName):
+        (JSC::Bindings::JavaMethodJobject::parameterAt):
+        (JSC::Bindings::JavaMethodJobject::returnType):
+        (JSC::Bindings::JavaMethodJobject::isStatic):
+        (JSC::Bindings::JavaMethodJobject::numParameters):
+        * bridge/jni/jsc/JavaClassJSC.cpp:
+        (JavaClass::JavaClass):
+        * bridge/jni/jsc/JavaInstanceJSC.cpp:
+        (JavaInstance::invokeMethod):
+        * bridge/jni/v8/JavaClassV8.cpp:
+        (JavaClass::JavaClass):
+        * bridge/jni/v8/JavaInstanceV8.cpp:
+        (JavaInstance::invokeMethod):
+
+2011-03-30  Evan Martin  <evan@chromium.org>
+
+        Reviewed by Ryosuke Niwa.
+
+        clean up Document's handling of title changes
+        https://bugs.webkit.org/show_bug.cgi?id=57433
+
+        Document::setTitle has two entry points:
+        1) from DOM bindings, like document.title="foo"
+        2) from title tags, like <title>foo</title> in HTML
+
+        Split these two code paths to make the code easier to follow.
+        Also, replace the repeated pattern of
+            m_rawTitle = "foo"; updateTitle();
+        with
+            updateTitle("foo");
+
+        * dom/Document.cpp:
+        (WebCore::Document::updateTitle):
+        (WebCore::Document::setTitle):
+        (WebCore::Document::setTitleElement):
+        (WebCore::Document::removeTitle):
+        * dom/Document.h:
+        * html/HTMLTitleElement.cpp:
+        (WebCore::HTMLTitleElement::insertedIntoDocument):
+        (WebCore::HTMLTitleElement::childrenChanged):
+        * svg/SVGTitleElement.cpp:
+        (WebCore::SVGTitleElement::insertedIntoDocument):
+        (WebCore::SVGTitleElement::childrenChanged):
+
+2011-03-30  Levi Weintraub  <leviw@chromium.org>
+
+        Reviewed by Ryosuke Niwa.
+
+        BreakBlockQuoteCommand assumes all li tags have list item renderers
+        https://bugs.webkit.org/show_bug.cgi?id=57253
+
+        Checking that the renderers of li nodes are actually RenderListItems
+        before treating them as such.
+
+        Test: editing/execCommand/crash-breaking-blockquote-with-list.html
+
+        * editing/BreakBlockquoteCommand.cpp:
+        (WebCore::BreakBlockQuoteCommand::doApply):
+
+2011-03-30  Pavel Feldman  <pfeldman@chromium.org>
+
+        Not reviewed: fixing typo in the inspector front-end.
+
+        Web Inspector: REGRESSION: Broken live edit errors handling
+        https://bugs.webkit.org/show_bug.cgi?id=57436
+
+        * inspector/front-end/DebuggerModel.js:
+        (WebInspector.DebuggerModel.prototype._didEditScriptSource):
+
+2011-03-30  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        Left/Right borders/padding/margins are not always added correctly when rendering multiline inline boxes with bidi elements
+        https://bugs.webkit.org/show_bug.cgi?id=9272
+
+
+        Also fixes https://bugs.webkit.org/show_bug.cgi?id=47210 and https://bugs.webkit.org/show_bug.cgi?id=8392.
+
+        Change how we decide if an InlineFlowBox is the last one for its renderer. Use the position of resolver's logicallyLastRun
+        to decide if there is more text in the next line.
+
+        Tests: fast/borders/rtl-border-01.html
+               fast/borders/rtl-border-02.html
+               fast/borders/rtl-border-03.html
+               fast/borders/rtl-border-04.html
+               fast/borders/rtl-border-05.html
+
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::isAnsectorAndWithinBlock):
+        (WebCore::InlineFlowBox::determineSpacingForFlowBoxes):
+        * rendering/InlineFlowBox.h:
+        * rendering/RenderBlock.h:
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::constructLine):
+        (WebCore::reachedEndOfTextRenderer):
+        (WebCore::RenderBlock::layoutInlineChildren):
+
+2011-03-29  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Eric Seidel.
+
+        REGRESSION (r68976): Incorrect bidi rendering in SVG text
+        https://bugs.webkit.org/show_bug.cgi?id=53980
+
+        Deconvolute SVGTextLayoutEngine code, which was confusing due to the simultaneous processing of the rendered text
+        in visual and logical order. Added several helper methods to make the code more readable.
+
+        Fix Unicode directional formatting characters support, now works as expected.
+
+        Test: svg/text/bidi-embedded-direction.svg
+
+        * editing/visible_units.cpp: Refactor getLeafBoxesInLogicalOrder(), move to InlineFlowBox.
+        (WebCore::getLogicalStartBoxAndNode): Use new collectLeafBoxesInLogicalOrder() method in InlineFlowBox.
+        (WebCore::getLogicalEndBoxAndNode): Ditto.
+        * rendering/InlineFlowBox.cpp: Add new helper function, that returns a list of all leaf boxes in logical order.
+        (WebCore::InlineFlowBox::collectLeafBoxesInLogicalOrder):
+        * rendering/InlineFlowBox.h:
+        * rendering/svg/RenderSVGText.cpp: Actually trigger reordering the x/y/dx/dy/rotate value lists, if needed.
+        (WebCore::RenderSVGText::RenderSVGText):
+        (WebCore::RenderSVGText::layout):
+        * rendering/svg/RenderSVGText.h: Ditto.
+        (WebCore::RenderSVGText::layoutAttributes):
+        (WebCore::RenderSVGText::needsReordering):
+        * rendering/svg/SVGRootInlineBox.cpp: Use new InlineFlowBox::collectLeafBoxesINLogicalOrder(), with a custom "inline box reverse" implementation,
+                                              which not only reverses the order of InlineBoxes, but also the order of the x/y/dx/dy/rotate value lists, if needed.
+        (WebCore::SVGRootInlineBox::computePerCharacterLayoutInformation):
+        (WebCore::SVGRootInlineBox::layoutCharactersInTextBoxes):
+        (WebCore::swapItems):
+        (WebCore::reverseInlineBoxRangeAndValueListsIfNeeded):
+        (WebCore::SVGRootInlineBox::reorderValueLists):
+        * rendering/svg/SVGRootInlineBox.h:
+        * rendering/svg/SVGTextLayoutAttributes.cpp: Store RenderSVGInlineText* pointer, where we belong to.
+        (WebCore::SVGTextLayoutAttributes::SVGTextLayoutAttributes):
+        (WebCore::SVGTextLayoutAttributes::dump):
+        * rendering/svg/SVGTextLayoutAttributes.h:
+        (WebCore::SVGTextLayoutAttributes::context):
+        * rendering/svg/SVGTextLayoutAttributesBuilder.cpp: Pass RenderSVGInlineText* object when creating SVGTextLayoutAttributes.
+        (WebCore::SVGTextLayoutAttributesBuilder::buildLayoutAttributesForTextSubtree):
+        (WebCore::SVGTextLayoutAttributesBuilder::propagateLayoutAttributes):
+        * rendering/svg/SVGTextLayoutAttributesBuilder.h:
+        * rendering/svg/SVGTextLayoutEngine.cpp: Rewrite & cleanup the main layout algorithm, to be less confusing.
+        (WebCore::SVGTextLayoutEngine::SVGTextLayoutEngine):
+        (WebCore::SVGTextLayoutEngine::updateRelativePositionAdjustmentsIfNeeded):
+        (WebCore::SVGTextLayoutEngine::recordTextFragment):
+        (WebCore::SVGTextLayoutEngine::currentLogicalCharacterAttributes):
+        (WebCore::SVGTextLayoutEngine::currentLogicalCharacterMetrics):
+        (WebCore::SVGTextLayoutEngine::currentVisualCharacterMetrics):
+        (WebCore::SVGTextLayoutEngine::advanceToNextLogicalCharacter):
+        (WebCore::SVGTextLayoutEngine::advanceToNextVisualCharacter):
+        (WebCore::SVGTextLayoutEngine::layoutTextOnLineOrPath):
+        * rendering/svg/SVGTextLayoutEngine.h:
+
+2011-03-30  Ilya Tikhonovsky  <loislo@chromium.org>
+
+        Not reviewed trivial change.
+
+        Web Inspector: Remove unnecessary function arguments after r82281.
+        https://bugs.webkit.org/show_bug.cgi?id=57327
+
+        * inspector/InspectorAgent.cpp:
+        (WebCore::InspectorAgent::didCommitLoad):
+        (WebCore::InspectorAgent::domContentLoadedEventFired):
+        * inspector/InspectorAgent.h:
+        * inspector/InspectorInstrumentation.cpp:
+        (WebCore::InspectorInstrumentation::domContentLoadedEventFiredImpl):
+        (WebCore::InspectorInstrumentation::didCommitLoadImpl):
+
+2011-03-30  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Ojan Vafai.
+
+        H1 element should have different default style if it is in HTML5 sectioning elements.
+        https://bugs.webkit.org/show_bug.cgi?id=52693
+
+        Test: fast/css/h1-in-section-elements.html
+
+        * css/html.css: Add font-size and margin declarations to follow HTML5 specification.
+        (:-webkit-any(article,aside,nav,section) h1):
+        (:-webkit-any(article,aside,nav,section) :-webkit-any(article,aside,nav,section) h1):
+        (:-webkit-any(article,aside,nav,section) :-webkit-any(article,aside,nav,section) :-webkit-any(article,aside,nav,section) h1):
+        (:-webkit-any(article,aside,nav,section) :-webkit-any(article,aside,nav,section) :-webkit-any(article,aside,nav,section) :-webkit-any(article,aside,nav,section) h1):
+        (:-webkit-any(article,aside,nav,section) :-webkit-any(article,aside,nav,section) :-webkit-any(article,aside,nav,section) :-webkit-any(article,aside,nav,section) :-webkit-any(article,aside,nav,section) h1):
+
+2011-03-29  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=57408
+        webkit-min-device-pixel-ratio media query doesn't work post-SnowLeopard 
+        -and corresponding-
+        <rdar://problem/8665411>
+
+        * platform/mac/PlatformScreenMac.mm:
+        (WebCore::windowScaleFactor):
+        (WebCore::toUserSpace):
+        (WebCore::toDeviceSpace):
+
+2011-03-29  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Rename BidiResolver::eor and sor to m_eor and m_sor to match modern style
+        https://bugs.webkit.org/show_bug.cgi?id=57369
+
+        I considered renaming these to m_endOfRun and m_startOfRun but decided
+        that was too verbose for now (given how often they're used).  I suspect
+        with a bit more refactoring we'll find they're not used very often and can be renamed
+        if so desired.
+
+        * platform/text/BidiResolver.h:
+        (WebCore::::appendRun):
+        (WebCore::::checkDirectionInLowerRaiseEmbeddingLevel):
+        (WebCore::::lowerExplicitEmbeddingLevel):
+        (WebCore::::raiseExplicitEmbeddingLevel):
+        (WebCore::::createBidiRunsForLine):
+        * rendering/InlineIterator.h:
+        (WebCore::InlineBidiResolver::appendRun):
+
+2011-03-29  Mikhail Naganov  <mnaganov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: [Chromium] Remove exact retained size request in detailed heap snapshots.
+        https://bugs.webkit.org/show_bug.cgi?id=57351
+
+        * bindings/js/ScriptHeapSnapshot.h:
+        * bindings/v8/ScriptHeapSnapshot.cpp:
+        * bindings/v8/ScriptHeapSnapshot.h:
+        * inspector/Inspector.json:
+        * inspector/InspectorProfilerAgent.cpp:
+        * inspector/InspectorProfilerAgent.h:
+        * inspector/front-end/DetailedHeapshotGridNodes.js:
+        (WebInspector.HeapSnapshotGenericObjectNode):
+        (WebInspector.HeapSnapshotGenericObjectNode.prototype.get data):
+        * inspector/front-end/DetailedHeapshotView.js:
+        (WebInspector.DetailedHeapshotView.prototype._mouseClickInContainmentGrid):
+
+2011-03-29  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Ryosuke Niwa.
+
+        Split more logic out from createBidiRunsForLine for readability
+        https://bugs.webkit.org/show_bug.cgi?id=57341
+
+        I marked reorderRunsFromLevels inline, but it probably doesn't actually need to (or want to) be.
+        This lops another large hunk off of reorderRunsFromLevels further reducing the size and complexity.
+
+        * platform/text/BidiResolver.h:
+        (WebCore::::reorderRunsFromLevels):
+        (WebCore::::createBidiRunsForLine):
+
+2011-03-29  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Make validation message bubble testable
+        https://bugs.webkit.org/show_bug.cgi?id=57290
+
+        Introduce a setting for validation message timer so that we can configure
+        how long we show a validation message bubble.
+
+        Test: fast/forms/validation-message-appearance.html
+
+        * html/ValidationMessage.cpp:
+        (WebCore::ValidationMessage::setMessageDOMAndStartTimer):
+          Don't set a timer if the timer magnification value is 0 or negative.
+          Otherwise, hides the bubble length * magnification / 1000 seconds.
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings): Initialize the timer magnification value.
+        * page/Settings.h:
+        (WebCore::Settings::setValidationMessageTimerMagnification): Added.
+        (WebCore::Settings::validationMessageTimerMaginification): Added.
+
+2011-03-29  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Remove the extraneous declaration I accidentally added in r82376.
+
+        * dom/MouseEvent.h: Removed createSimulated decl.
+
+2011-03-29  James Robinson  <jamesr@chromium.org>
+
+        Reviewed by Kenneth Russell.
+
+        [chromium] Compositor crash with show-layer-borders flag
+        https://bugs.webkit.org/show_bug.cgi?id=57292
+
+        Synchronize the debug border color/width with other properties to ensure the appropriate
+        CCLayerImpl exists.  Code is only exercised with a debugging command line flag so no layout
+        test.
+
+        * platform/graphics/chromium/LayerChromium.cpp:
+        (WebCore::LayerChromium::pushPropertiesTo):
+        (WebCore::LayerChromium::setBorderColor):
+        (WebCore::LayerChromium::setBorderWidth):
+        * platform/graphics/chromium/LayerChromium.h:
+
+2011-03-29  Tony Gentilcore  <tonyg@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Teach the preload scanner about &lt;input type=image&gt;
+        https://bugs.webkit.org/show_bug.cgi?id=57404
+
+        I did a very rough sample of the top 50 web pages to see how many of each
+        HTML resource type they include:
+        img src: 1,359
+        script src: 276
+        link href: 256
+        iframe src: 104
+        input src: 50
+        embed src: 37
+        @import: 13
+        object data: 11
+
+        Based on this, it seems worthwhile to preload inputs and iframes (possibly embed).
+        This patch only does inputs.
+
+        Test: fast/preloader/input.html
+
+        * html/parser/HTMLPreloadScanner.cpp:
+        (WebCore::HTMLNames::PreloadTask::PreloadTask):
+        (WebCore::HTMLNames::PreloadTask::processAttributes):
+        (WebCore::HTMLNames::PreloadTask::inputTypeAttributeIsImage):
+        (WebCore::HTMLNames::PreloadTask::preload):
+
+2011-03-29  Luke Macpherson   <macpherson@chromium.org>
+
+        Reviewed by David Levin.
+
+        Improve the massive switch statement in CSSStyleSelector::applyProperty.
+        https://bugs.webkit.org/show_bug.cgi?id=56288
+
+        No new tests are needed because no new functionality exposed.
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty):
+        Asserted that cases implemented in the CSSStyleApplyProperty lookup table are unreachable.
+        Updated comment.
+
+2011-03-29  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Introduce SimulatedMouseEvent and teach EventDispatcher how to use it.
+        https://bugs.webkit.org/show_bug.cgi?id=57402
+
+        No functional changes, covered by existing tests.
+
+        * dom/EventDispatcher.cpp:
+        (WebCore::EventDispatcher::dispatchSimulatedClick): Changed to use SimulatedMouseEvent.
+        (WebCore::EventDispatcher::dispatchMouseEvent): Combined two dispatchMouseEvent methods
+            into one, now that simulated-click events don't need one.
+        * dom/EventDispatcher.h: Updated decls.
+        * dom/MouseEvent.cpp:
+        (WebCore::SimulatedMouseEvent::create): Added.
+        (WebCore::SimulatedMouseEvent::~SimulatedMouseEvent): Added.
+        (WebCore::SimulatedMouseEvent::SimulatedMouseEvent): Added.
+        * dom/MouseEvent.h: Made constructor protected.
+
+2011-03-29  Anders Carlsson  <andersca@apple.com>
+
+        Fix build.
+
+        * WebCore.exp.in:
+
+2011-03-29  Steve Block  <steveblock@google.com>
+
+        Reviewed by Jeremy Orlow.
+
+        JavaInstance should not use jvalue in its API
+        https://bugs.webkit.org/show_bug.cgi?id=57019
+
+        This change updates JavaInstance for V8 to use JavaValue, rather than
+        jvalue, in its API. This will allow us to create an API for
+        JavaInstance that is independent of JNI, to allow it to be
+        implemented on platforms that do not use JNI directly.
+
+        Refactoring only, no new tests.
+
+        * bridge/jni/v8/JavaInstanceV8.cpp:
+        (JavaInstance::invokeMethod):
+        (JavaInstance::getField):
+        * bridge/jni/v8/JavaInstanceV8.h:
+        * bridge/jni/v8/JavaNPObjectV8.cpp:
+        (JSC::Bindings::JavaNPObjectInvoke):
+        (JSC::Bindings::JavaNPObjectGetProperty):
+        * bridge/jni/v8/JavaValueV8.h:
+
+2011-03-29  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Rename BidiResolver::last to m_last to match modern style
+        https://bugs.webkit.org/show_bug.cgi?id=57367
+
+        * platform/text/BidiResolver.h:
+        (WebCore::::lowerExplicitEmbeddingLevel):
+        (WebCore::::raiseExplicitEmbeddingLevel):
+        (WebCore::::createBidiRunsForLine):
+
+2011-03-29  Justin Schuh  <jschuh@chromium.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        SVGComponentTransferFunctionElement should validate type
+        https://bugs.webkit.org/show_bug.cgi?id=56960
+
+        Test: svg/filters/feComponentTransfer-style-crash.xhtml
+
+        * svg/SVGComponentTransferFunctionElement.cpp:
+        (WebCore::SVGComponentTransferFunctionElement::svgAttributeChanged):
+        * svg/SVGComponentTransferFunctionElement.h:
+
+2011-03-29  Thomas Klausner  <tk@giga.or.at>
+
+        Reviewed by David Levin.
+
+        png-1.5 fixes
+        https://bugs.webkit.org/show_bug.cgi?id=54406
+
+        Fix compilation with png-1.5: struct members were hidden, and
+        a new API to terminate data processing was added (especially for
+        WebKit).
+
+        Compilation fixes, so no new tests.
+
+        * platform/image-decoders/png/PNGImageDecoder.cpp:
+        (WebCore::PNGImageDecoder::headerAvailable):
+        (WebCore::PNGImageDecoder::rowAvailable):
+
+2011-03-29  Gavin Peters  <gavinp@chromium.org>
+
+        Reviewed by Tony Gentilcore.
+
+        Add beforeload to icon and prefetch link rel types
+        https://bugs.webkit.org/show_bug.cgi?id=56424
+
+        Over in https://lists.webkit.org/pipermail/webkit-dev/2011-February/016034.html , a webkit-dev
+        thread, I've discussed my hopes for the link element, and adding the link header.  This
+        change helps improve the link header by making it participate in the beforeload event in
+        two more important cases.
+
+        Tests: fast/dom/HTMLLinkElement/prefetch-beforeload.html
+               http/tests/misc/link-rel-icon-beforeload.html
+               webarchive/test-link-rel-icon-beforeload.html
+
+        * html/HTMLLinkElement.cpp:
+        (WebCore::HTMLLinkElement::checkBeforeLoadEvent):
+        (WebCore::HTMLLinkElement::process):
+        * html/HTMLLinkElement.h:
+
+2011-03-29  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Rename BidiResolver::current to BidiResolver::m_current to match modern style
+        https://bugs.webkit.org/show_bug.cgi?id=57363
+
+        I was very confused by current until I realized it was a member variable.
+        I also did m_reachedEndOfLine since that was small.
+
+        * platform/text/BidiResolver.h:
+        (WebCore::BidiResolver::position):
+        (WebCore::BidiResolver::setPosition):
+        (WebCore::BidiResolver::increment):
+        (WebCore::::createBidiRunsForLine):
+
+2011-03-29  Geoff Pike  <gpike@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        In HitTestResult objects, initialize the ListHashSet<RefPtr<Node> >
+        lazily.  In my informal testing it seems to be used hardly at all, so
+        it's wasteful to create it eagerly.  Initializing a ListHashSet
+        is expensive because a ListHashSet initially has space for 256
+        elements, and that space is memset to 0.
+
+        This change should improve performance but have no impact on
+        correctness.  On x86-64, for example, the change cuts the
+        cost of HitTestResult(IntPoint()) in EventHandler::mouseMoved()
+        from ~1700 cycles to ~300 cycles.
+
+        * rendering/HitTestResult.cpp:
+        (WebCore::HitTestResult::HitTestResult): copy *m_rectBasedTestResult if m_rectBasedTestResult isn't 0
+        (WebCore::HitTestResult::operator=): copy *m_rectBasedTestResult if m_rectBasedTestResult isn't 0
+        (WebCore::HitTestResult::addNodeToRectBasedTestResult): use mutableRectBasedTestResult() rather than m_rectBasedTestResult
+        (WebCore::HitTestResult::append): append *(other.m_rectBasedTestResult) if other.m_rectBasedTestResult isn't 0
+        * rendering/HitTestResult.h:
+        (WebCore::HitTestResult::rectBasedTestResult): Add a typedef for ListHashSet<RefPtr<Node> > to ease readability.  Change m_rectBasedTestResult from ListHashSet<RefPtr<Node> > to an OwnPtr of same.  Modify rectBasedTestResult() and add mutableRectBasedTestResult().
+
+2011-03-29  Timothy Hatcher  <timothy@apple.com>
+
+        Update the order of the context menu to better match AppKit on Mac.
+
+        <rdar://problem/9054893>
+
+        Reviewed by John Sullivan.
+
+        * English.lproj/Localizable.strings: Updated.
+        * page/ContextMenuController.cpp:
+        (WebCore::ContextMenuController::populate): Update the order of items on Mac.
+        * platform/LocalizationStrategy.h:
+        * platform/LocalizedStrings.cpp:
+        (WebCore::contextMenuItemTagLookUpInDictionary): Added argument for selected string.
+        * platform/LocalizedStrings.h:
+        * platform/android/LocalizedStringsAndroid.cpp:
+        (WebCore::contextMenuItemTagLookUpInDictionary): Ditto.
+        * platform/brew/LocalizedStringsBrew.cpp:
+        (WebCore::contextMenuItemTagLookUpInDictionary): Ditto.
+        * platform/efl/LocalizedStringsEfl.cpp:
+        (WebCore::contextMenuItemTagLookUpInDictionary): Ditto.
+        * platform/gtk/LocalizedStringsGtk.cpp:
+        (WebCore::contextMenuItemTagLookUpInDictionary): Ditto.
+        * platform/haiku/LocalizedStringsHaiku.cpp:
+        (WebCore::contextMenuItemTagLookUpInDictionary): Ditto.
+        * platform/wx/LocalizedStringsWx.cpp:
+        (WebCore::contextMenuItemTagLookUpInDictionary): Ditto.
+
+2011-03-29  Dean Jackson  <dino@apple.com>
+
+        Reviewed by Chris Marrin and Ken Russell.
+
+        https://bugs.webkit.org/show_bug.cgi?id=57248
+        Occlusion issues with WebGL in Safari
+
+        The depth buffer on Safari ports was being set up with a
+        maximum of 16 bits. Now we use a combined 24/8 depth/stencil
+        buffer on Mac ports.
+
+        No new tests as this is the setting for a particular port. Other
+        ports may use different defaults.
+
+        * platform/graphics/opengl/GraphicsContext3DOpenGL.cpp:
+        (WebCore::GraphicsContext3D::validateAttributes):
+        - use Extensions3D to test for depth and multisample extensions
+          rather than querying OpenGL directly.
+        (WebCore::GraphicsContext3D::reshape):
+        - use a 24bit depth buffer when the extension is enabled.
+
+2011-03-29  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Sorted XCode project. It's gotten quite out of sorts.
+
+        * WebCore.xcodeproj/project.pbxproj: Ran sort-XCode-project-file.
+
+2011-03-29  Emil A Eklund  <eae@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        DatasetDOMStringMap::item and ::contains copies attribute name string
+        https://bugs.webkit.org/show_bug.cgi?id=55645
+
+        Change propertyNameMatchesAttributeName to match without creating a copy
+        of the string.
+
+        * dom/DatasetDOMStringMap.cpp:
+        (WebCore::propertyNameMatchesAttributeName):
+
+2011-03-29  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Unreviewed rollout r82282, part of r82288, r82298.
+
+        * css/CSSParser.cpp:
+        (WebCore::parseColorInt):
+        (WebCore::isValidDouble):
+        (WebCore::parseAlphaValue):
+        (WebCore::CSSParser::parseColor):
+
+2011-03-25  Brent Fulgham  <bfulgham@webkit.org>
+
+        Reviewed by Dave Hyatt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=55981
+        Second round of clean-ups, aimed at supporting GTK with the
+        same unified FontPlatformData header.  This version removes
+        some unneeded WinCairo code, and aligns the WinCairo and
+        GTK ports to reduce code duplication.
+
+        * WebCore.vcproj/WebCore.vcproj: Get rid of a dangling reference
+          to an old WinCairo file.
+        * platform/graphics/FontPlatformData.h: Remove unneeded member
+          for m_fontFace, which is a member of m_scaledFont.  Switch to
+          standard Cairo hashing.
+        (WebCore::FontPlatformData::FontPlatformData):
+        (WebCore::FontPlatformData::font):
+        (WebCore::FontPlatformData::scaledFont):
+        (WebCore::FontPlatformData::hash):
+        (WebCore::FontPlatformData::isHashTableDeletedValue):
+        (WebCore::FontPlatformData::hashTableDeletedFontValue):
+        * platform/graphics/win/FontCacheWin.cpp: Update to no longer use
+          the unnecessary fontFace() accessor.
+        (WebCore::FontCache::createFontPlatformData):
+        * platform/graphics/win/FontCustomPlatformDataCairo.cpp:
+        * platform/graphics/win/FontPlatformDataCairoWin.cpp:
+        (WebCore::FontPlatformData::platformDataInit):
+        (WebCore::FontPlatformData::FontPlatformData):
+        (WebCore::FontPlatformData::~FontPlatformData):
+        (WebCore::FontPlatformData::platformDataAssign):
+        (WebCore::FontPlatformData::platformIsEqual):
+        * platform/graphics/win/FontPlatformDataWin.cpp:
+        (WebCore::FontPlatformData::FontPlatformData):
+
+2011-03-29  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Inline worker powered by blob URL does not work with files URL even if
+        allowFileAccessFromFileURLs is enabled
+        https://bugs.webkit.org/show_bug.cgi?id=56063
+
+        Test: fast/files/workers/inline-worker-via-blob-url.html
+
+        * fileapi/BlobURL.cpp: Removed unneeded getOrigin() method.
+        * fileapi/BlobURL.h: Removed unneeded getOrigin() method.
+        * page/SecurityOrigin.cpp:
+        (WebCore::SecurityOrigin::SecurityOrigin): Extended the logic to handle
+        filesystem URL also to blob URL. Also fixed the problem that m_isUnique
+        is incorrectly set for blob and filesystem URLs.
+        (WebCore::SecurityOrigin::create): Removed the special logic for blob URL
+        since we use the same logic in SecurityOrigin constructor as filesystem
+        URL.
+        (WebCore::SecurityOrigin::canRequest): Removed the special logic for blob
+        URL since it is not needed with the fix in SecurityOrigin constructor.
+
+2011-03-29  Timothy Hatcher  <timothy@apple.com>
+
+        Update WebCore Localizable.strings to contain WebCore, WebKit/mac and WebKit2 strings.
+
+        https://webkit.org/b/57354
+
+        Reviewed by Sam Weinig.
+
+        * English.lproj/Localizable.strings: Updated.
+        * StringsNotToBeLocalized.txt: Removed. To hard to maintain in WebCore.
+        * platform/network/cf/LoaderRunLoopCF.h: Remove a single quote in an #error so
+        extract-localizable-strings does not complain about unbalanced single quotes.
+
+2011-03-29  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r82295 and r82300.
+        http://trac.webkit.org/changeset/82295
+        http://trac.webkit.org/changeset/82300
+        https://bugs.webkit.org/show_bug.cgi?id=57380
+
+        This patch breaks compile on Chromium (Requested by
+        abarth|gardener on #webkit).
+
+        * accessibility/AccessibilityObject.h:
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::determineAccessibilityRole):
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (atkRole):
+        (webkit_accessible_get_role):
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+
+2011-03-29  Anders Carlsson  <andersca@apple.com>
+
+        Fix clang build.
+
+        * platform/text/BidiResolver.h:
+        (WebCore::::createBidiRunsForLine):
+
+2011-03-29  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Use per-configuration vsprops in WebCore to avoid WebKitVSPropsRedirectionDir removal by MSVC IDE
+        https://bugs.webkit.org/show_bug.cgi?id=57378
+
+        Visual Studio's IDE was removing instances of $(WebKitVSPropsRedirectionDir) from
+        InheritedPropertySheet rules in our vcproj files when the vcproj was edited from within
+        the IDE. To avoid this, add a separate vsprops file for each project configuration that
+        contains the required inherited property sheets.
+
+        * WebCore.vcproj/QTMovieWin.vcproj:
+        * WebCore.vcproj/QTMovieWinDebug.vsprops: Added.
+        * WebCore.vcproj/QTMovieWinDebugAll.vsprops: Added.
+        * WebCore.vcproj/QTMovieWinDebugCairoCFLite.vsprops: Added.
+        * WebCore.vcproj/QTMovieWinRelease.vsprops: Added.
+        * WebCore.vcproj/QTMovieWinReleaseCairoCFLite.vsprops: Added.
+        * WebCore.vcproj/QTMovieWinReleaseLTCG.vsprops: Added.
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.vcproj/WebCoreDebug.vsprops: Added.
+        * WebCore.vcproj/WebCoreDebugAll.vsprops: Added.
+        * WebCore.vcproj/WebCoreDebugCairoCFLite.vsprops: Added.
+        * WebCore.vcproj/WebCoreRelease.vsprops: Added.
+        * WebCore.vcproj/WebCoreReleaseCairoCFLite.vsprops: Added.
+        * WebCore.vcproj/WebCoreReleaseLTCG.vsprops: Added.
+
+2011-03-29  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        <rdar://problem/9194927> REGRESSION (r81691): Page at www.mondaynote.com lays out incorrectly
+        
+        Back out the optimization that stopped when it hit the first float. This was an incorrect optimization
+        and can't be done without more work.
+
+        Added fast/block/float/float-forced-below-other-floats.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::logicalLeftOffsetForLine):
+        (WebCore::RenderBlock::logicalRightOffsetForLine):
+
+2011-03-29  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Ryosuke Niwa.
+
+        Start to clean up BidiResolver::createBidiRunsForLine so that mere mortals can understand it
+        https://bugs.webkit.org/show_bug.cgi?id=57338
+
+        I'm attempting to break createBidiRunsForLine into understandable pieces
+        so that we can tell what it's actually doing.  Our implementation of the
+        unicode bidi algorithm is slightly different from the spec in that we
+        run it per-line (instead of over the entire paragraph at once).  This is
+        great for performance (our implementation is resumable), but it makes
+        things a bit tricky to understand.  Splitting createBidiRunsForLine into
+        pieces should help make our UBA implementation more readable.
+
+        * platform/text/BidiResolver.h:
+        (WebCore::::updateStatusLastFromCurrentDirection):
+        (WebCore::::createBidiRunsForLine):
+
+2011-03-29  Mario Sanchez Prada  <msanchez@igalia.com>
+
+        Reviewed by Martin Robinson.
+
+        [Gtk] Consistent crash from Google/ARIA combobox click
+        https://bugs.webkit.org/show_bug.cgi?id=55883
+
+        Do not call to firstChild() to avoid entering into infinite loops.
+
+        This would happen when current item is a WebCore Group and some of
+        its children have either role 'option' or 'menuitem'. Other than
+        that the logic behind that call to firstChild() seems to be no
+        longer needed so it's safe to remove it.
+
+        Test: platform/gtk/accessibility/aria-options-and-menuitems-crash.html
+
+        * accessibility/gtk/AccessibilityObjectAtk.cpp:
+        (WebCore::AccessibilityObject::accessibilityPlatformIncludesObject):
+        Remove call to firsChild, which was leading to crashes sometimes.
+
+2011-03-29  Mario Sanchez Prada  <msanchez@igalia.com>
+
+        Reviewed by Chris Fleizach.
+
+        AX: GTK: ARIA role is not respected on <p> <label> <div> and <form>
+        https://bugs.webkit.org/show_bug.cgi?id=47636
+
+        Define new roles in WebCore and map them to ATK accordingly.
+
+        Test: platform/gtk/accessibility/aria-roles-unignored.html
+
+        * accessibility/AccessibilityObject.h: Added new roles to
+        represent paragraphs, labels, forms and div sections.
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::determineAccessibilityRole):
+        Return ParagraphRole, LabelRole, FormRole and DivRole when needed.
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (atkRole): Map new WebCore roles to ATK Roles.
+        (webkit_accessible_get_role): Remove code to define roles for
+        paragraphs, labels, forms and divs based on node's tag name.
+
+        Update mappings for the Mac platform.
+
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        (createAccessibilityRoleMap): Add explicit mappings from the new
+        roles introduced to NSAccessibilityGroupRole.
+
+2011-03-29  Philippe Normand  <pnormand@igalia.com>
+
+        Unreviewed build fix. Remove ASSERT hitting consitently on GTK.
+
+        * rendering/InlineIterator.h:
+        (WebCore::InlineIterator::moveToStartOf):
+
+2011-03-29  Darin Adler  <darin@apple.com>
+
+        Fix some just-introduced build failures.
+
+        * WebCore.pro: Correct spelling of filename.
+
+        * css/CSSParser.cpp:
+        (WebCore::parseColorIntOrPercentage): Fix double/int conversion that fails to compile
+        on Leopard. Also renamed one local variabel.
+
+        * inspector/InspectorAgent.cpp:
+        (WebCore::InspectorAgent::didCommitLoad): Removed unused argument names to avoid warning.
+        (WebCore::InspectorAgent::domContentLoadedEventFired): Ditto.
+
+2011-03-29  Andras Becsi  <abecsi@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        CSS: Slow parsing of rgb() with percent values
+        https://bugs.webkit.org/show_bug.cgi?id=16708
+
+        Implement fast-path parsing for percentage color values.
+
+        Gain ~30% speedup on http://canvex.lazyilluminati.com/misc/3d.html.
+
+        * css/CSSParser.cpp:
+        (WebCore::checkForValidDouble): Extend to return the number of characters forming a valid double.
+        (WebCore::parseDouble): Function for parsing double values if they are valid.
+        (WebCore::parseColorIntOrPercentage): Extend parseColorInt to deal with percentage values.
+        (WebCore::parseAlphaValue): Use the new functions.
+        (WebCore::CSSParser::parseColor): Ditto.
+
+2011-03-29  Ilya Tikhonovsky  <loislo@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: extract InspectorPageAgent from InspectorAgent.
+        https://bugs.webkit.org/show_bug.cgi?id=57327
+
+        There are page related methods and inspector related methods in InspectorAgent.
+        It would be nice to extract page specific methods for future usage the rest of methods in workers debugger.
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * inspector/CodeGeneratorInspector.pm:
+        * inspector/Inspector.json:
+        * inspector/InspectorAgent.cpp:
+        (WebCore::InspectorAgent::InspectorAgent):
+        (WebCore::InspectorAgent::restoreInspectorStateFromCookie):
+        (WebCore::InspectorAgent::didClearWindowObjectInWorld):
+        (WebCore::InspectorAgent::setFrontend):
+        (WebCore::InspectorAgent::disconnectFrontend):
+        (WebCore::InspectorAgent::didCommitLoad):
+        (WebCore::InspectorAgent::domContentLoadedEventFired):
+        * inspector/InspectorAgent.h:
+        (WebCore::InspectorAgent::pageAgent):
+        * inspector/InspectorPageAgent.cpp: Added.
+        (WebCore::InspectorPageAgent::create):
+        (WebCore::InspectorPageAgent::InspectorPageAgent):
+        (WebCore::InspectorPageAgent::setFrontend):
+        (WebCore::InspectorPageAgent::clearFrontend):
+        (WebCore::InspectorPageAgent::addScriptToEvaluateOnLoad):
+        (WebCore::InspectorPageAgent::removeAllScriptsToEvaluateOnLoad):
+        (WebCore::InspectorPageAgent::reloadPage):
+        (WebCore::InspectorPageAgent::openInInspectedWindow):
+        (WebCore::InspectorPageAgent::setUserAgentOverride):
+        (WebCore::buildObjectForCookie):
+        (WebCore::buildArrayForCookies):
+        (WebCore::InspectorPageAgent::getCookies):
+        (WebCore::InspectorPageAgent::deleteCookie):
+        (WebCore::InspectorPageAgent::inspectedURLChanged):
+        (WebCore::InspectorPageAgent::restore):
+        (WebCore::InspectorPageAgent::didCommitLoad):
+        (WebCore::InspectorPageAgent::domContentEventFired):
+        (WebCore::InspectorPageAgent::loadEventFired):
+        (WebCore::InspectorPageAgent::didClearWindowObjectInWorld):
+        (WebCore::InspectorPageAgent::applyUserAgentOverride):
+        * inspector/InspectorPageAgent.h: Added.
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::connectFrontend):
+        * inspector/InspectorInstrumentation.cpp:
+        (WebCore::InspectorInstrumentation::didClearWindowObjectInWorldImpl):
+        (WebCore::InspectorInstrumentation::applyUserAgentOverrideImpl):
+        (WebCore::InspectorInstrumentation::domContentLoadedEventFiredImpl):
+        (WebCore::InspectorInstrumentation::loadEventFiredImpl):
+        (WebCore::InspectorInstrumentation::didCommitLoadImpl):
+        (WebCore::InspectorInstrumentation::retrievePageAgent):
+        * inspector/InspectorInstrumentation.h:
+        * inspector/InstrumentingAgents.h:
+        (WebCore::InstrumentingAgents::InstrumentingAgents):
+        (WebCore::InstrumentingAgents::inspectorPageAgent):
+        (WebCore::InstrumentingAgents::setInspectorPageAgent):
+        * inspector/front-end/AuditsPanel.js:
+        (WebInspector.AuditsPanel.prototype._reloadResources):
+        * inspector/front-end/CookieItemsView.js:
+        (WebInspector.CookieItemsView.prototype._deleteCookie):
+        (WebInspector.Cookies.getCookiesAsync):
+        * inspector/front-end/ExtensionServer.js:
+        (WebInspector.ExtensionServer.prototype._onReload):
+        * inspector/front-end/NetworkPanel.js:
+        (WebInspector.NetworkDataGridNode.prototype._openInNewTab):
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.FrameResourceTreeElement.prototype.ondblclick):
+        * inspector/front-end/WorkersSidebarPane.js:
+        (WebInspector.WorkersSidebarPane.prototype.setInstrumentation):
+        * inspector/front-end/inspector.js:
+        (WebInspector.openResource):
+        (WebInspector.documentKeyDown):
+
+2011-03-29  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=57276
+        
+        Add optimizations to make the vertical placement of boxes much faster. Whenever a box is added
+        to a line, compare it with the parent box. If we can determine that the child box has the exact
+        same height and baseline position as the parent box, then we keep a boolean flag set called
+        descendantsHaveSameLineHeightAndBaseline(). If the box is different for any reason then we clear the
+        flag up the line box parent chain.
+
+        When it comes time to do computeLogicalboxHeights, we can avoid recurring into the children of
+        a box whose descendants all have the same position. When we do placeBoxesInBlockDirection, we
+        can do a simplified recursion that just calls adjustBlockDirectionPosition to offset the boxes
+        without doing anything else.
+        
+        Because of the quirks mode rule of only shrinking boxes with no immediate text children, we need
+        to track whether a box has text descendants now as well.  When we avoid doing the recursion
+        this flag tells us whether the collection of boxes should have an effect on the ascent and descent
+        of the line in quirks mode.
+ 
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::addToLine):
+        (WebCore::InlineFlowBox::computeLogicalBoxHeights):
+        (WebCore::InlineFlowBox::placeBoxesInBlockDirection):
+        (WebCore::InlineFlowBox::nodeAtPoint):
+        (WebCore::InlineFlowBox::paintBoxDecorations):
+        (WebCore::InlineFlowBox::paintMask):
+        * rendering/InlineFlowBox.h:
+        (WebCore::InlineFlowBox::InlineFlowBox):
+        (WebCore::InlineFlowBox::hasTextDescendants):
+        (WebCore::InlineFlowBox::descendantsHaveSameLineHeightAndBaseline):
+        (WebCore::InlineFlowBox::clearDescendantsHaveSameLineHeightAndBaseline):
+        * rendering/RenderBlock.h:
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::createLineBoxes):
+        (WebCore::RenderBlock::constructLine):
+        (WebCore::RenderBlock::computeInlineDirectionPositionsForLine):
+
+2011-03-29  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Ryosuke Niwa.
+
+        Remove a bunch of duplicate code by adding some InlineIterator helper methods
+        https://bugs.webkit.org/show_bug.cgi?id=57326
+
+        Once I started adding these it became clear how much crazy duplicated code
+        we had due to treating InlineIterator as a struct and accessing its
+        members directly.  We can't quite make the members private yet since
+        findNextLineBreak still splits out the members.  But this change
+        makes the code much cleaner.
+
+        * rendering/InlineIterator.h:
+        (WebCore::InlineIterator::clear):
+        (WebCore::InlineIterator::moveToStartOf):i
+        (WebCore::InlineIterator::moveTo):
+        (WebCore::InlineIterator::increment):
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::tryHyphenating):
+        (WebCore::RenderBlock::findNextLineBreak):
+
+2011-03-29  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Ryosuke Niwa.
+
+        Clean up bidiNext by abstracting repeated code
+        https://bugs.webkit.org/show_bug.cgi?id=57335
+
+        I also added a comment to explain what bidiNext is actually doing.
+        This whole area of code is confusing but need not be.
+
+        * rendering/InlineIterator.h:
+        (WebCore::embedCharFromDirection):
+        (WebCore::notifyResolverEnteredObject):
+        (WebCore::notifyResolverWillExitObject):
+        (WebCore::bidiNext):
+        (WebCore::bidiFirst):
+
+2011-03-29  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: Support external CSS stylesheet freeflow text editing
+        https://bugs.webkit.org/show_bug.cgi?id=54397
+
+        In this implementation, Ctrl/Cmd-S commits the current changes into the model.
+
+        * inspector/front-end/ResourceView.js:
+        (WebInspector.ResourceView.createResourceView):
+        (WebInspector.CSSSourceFrameDelegateForResourcesPanel):
+        (WebInspector.CSSSourceFrameDelegateForResourcesPanel.prototype.canEditScriptSource):
+        (WebInspector.CSSSourceFrameDelegateForResourcesPanel.prototype.editScriptSource):
+        (WebInspector.CSSSourceFrameDelegateForResourcesPanel.prototype.editScriptSource.handleInfos):
+        (WebInspector.CSSSourceFrameDelegateForResourcesPanel.prototype._saveStyleSheet):
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel.prototype._applyDiffMarkup):
+        (WebInspector.FrameResourceTreeElement.prototype._contentChanged):
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype._createTextViewer):
+
+2011-03-29  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        playbackRate should not be set to defaultPlaybackRate in play()
+        https://bugs.webkit.org/show_bug.cgi?id=55943
+
+        Test: media/video-playbackrate.html
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::playbackRate): No need to ask the media engine for the current
+            rate, we already have the current value cached.
+        (WebCore::HTMLMediaElement::playInternal): Don't reset the engine's playback rate to 
+            the default rate.
+        (WebCore::HTMLMediaElement::togglePlayState): Do reset the engine's playback rate to 
+            the default rate before triggering playback.
+        * manual-tests/media-default-playback-rate.html: Added.
+
+2011-03-28  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Remove specialization of EventDispatcher with inversion of control.
+        https://bugs.webkit.org/show_bug.cgi?id=57285
+
+        Since some events have extra logic around their dispatch, allow them
+        to dispatch themselves and specialize the logic. This change only
+        converts KeyboardEvent to this model.
+
+        No functional change, covered by existing tests.
+
+        * dom/Event.cpp:
+        (WebCore::Event::dispatch): Added.
+        * dom/Event.h: Updated decls.
+        * dom/EventDispatcher.cpp:
+        (WebCore::EventDispatcher::dispatchEvent): Changed to ask event to dispatch
+            itself.
+        * dom/EventDispatcher.h: Updated decls.
+        * dom/KeyboardEvent.cpp:
+        (WebCore::KeyboardEvent::dispatch): Added, moving code from EventDispatcher.
+        * dom/KeyboardEvent.h: Updated decls.
+        * dom/Node.cpp:
+        (WebCore::Node::dispatchKeyEvent): Changed to use the new ways.
+
+2011-03-29  Ilya Tikhonovsky  <loislo@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: InspectorDOMAgent has unnecessary dependency from InspectorAgent.
+        https://bugs.webkit.org/show_bug.cgi?id=57329
+
+        * inspector/InspectorAgent.cpp:
+        (WebCore::InspectorAgent::InspectorAgent):
+        (WebCore::InspectorAgent::setFrontend):
+        * inspector/InspectorAgent.h:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::inspect):
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::InspectorDOMAgent):
+        (WebCore::InspectorDOMAgent::setFrontend):
+        (WebCore::InspectorDOMAgent::handleMousePress):
+        (WebCore::InspectorDOMAgent::inspect):
+        (WebCore::InspectorDOMAgent::focusNode):
+        (WebCore::InspectorDOMAgent::highlight):
+        (WebCore::InspectorDOMAgent::hideHighlight):
+        * inspector/InspectorDOMAgent.h:
+        (WebCore::InspectorDOMAgent::create):
+
+2011-03-29  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        Rename InlineIterator::pos to m_pos to match modern style
+        https://bugs.webkit.org/show_bug.cgi?id=57342
+
+        Somehow I failed to upload this one earlier, no wonder later patches didn't apply.
+
+        * rendering/InlineIterator.h:
+        (WebCore::InlineIterator::InlineIterator):
+        (WebCore::operator==):
+        (WebCore::operator!=):
+        (WebCore::InlineIterator::increment):
+        (WebCore::InlineIterator::current):
+        (WebCore::InlineBidiResolver::appendRun):
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::checkMidpoints):
+        (WebCore::RenderBlock::appendRunsForObject):
+        (WebCore::RenderBlock::layoutInlineChildren):
+        (WebCore::RenderBlock::matchedEndLine):
+        (WebCore::tryHyphenating):
+        (WebCore::RenderBlock::findNextLineBreak):
+
+2011-03-29  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: document BrowserDebugger agent.
+        https://bugs.webkit.org/show_bug.cgi?id=57331
+
+        * inspector/Inspector.json:
+
+2011-03-29  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: Fix handling of the CSSAgent.setStyleSheetText() results in CSSStyleModel.js
+        https://bugs.webkit.org/show_bug.cgi?id=56310
+
+        Instead of stylesheet ids, CSSAgent.getAllStyleSheets() now returns metainfo objects containing
+        "styleSheetId", "sourceURL", "disabled", and "title" fields. The latter three are not returned
+        by CSSAgent.getStyleSheet() anymore.
+
+        Test: inspector/styles/get-set-stylesheet-text.html
+
+        * inspector/Inspector.json:
+        * inspector/InspectorCSSAgent.cpp:
+        (WebCore::InspectorCSSAgent::getAllStyleSheets):
+        * inspector/InspectorCSSAgent.h:
+        * inspector/InspectorStyleSheet.cpp:
+        (WebCore::InspectorStyleSheet::buildObjectForStyleSheet):
+        (WebCore::InspectorStyleSheet::buildObjectForStyleSheetInfo):
+        * inspector/InspectorStyleSheet.h:
+        * inspector/front-end/AuditRules.js:
+        (WebInspector.AuditRules.UnusedCssRule.prototype.doRun.styleSheetCallback):
+        (WebInspector.AuditRules.UnusedCssRule.prototype.doRun.allStylesCallback):
+        (WebInspector.AuditRules.UnusedCssRule.prototype.doRun):
+        * inspector/front-end/CSSStyleModel.js:
+        (WebInspector.CSSStyleModel.prototype._styleSheetChanged.callback):
+        (WebInspector.CSSStyleModel.prototype._styleSheetChanged):
+        (WebInspector.CSSStyleModel.prototype._onRevert):
+        (WebInspector.CSSStyleSheet):
+        (WebInspector.CSSStyleSheet.prototype.setText):
+
+2011-03-29  Jeremy Moskovich  <jeremy@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Implement text-align:match-parent as -webkit-match-parent.
+        https://bugs.webkit.org/show_bug.cgi?id=50951
+
+        Add support to the CSS parser.
+
+        Tests: fast/css/text-align-webkit-match-parent-parse.html
+               fast/css/text-align-webkit-match-parent.html
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue):
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty):
+        * css/CSSValueKeywords.in:
+
+2011-03-29  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Ryosuke Niwa.
+
+        Rename InlineIterator::nextBreakablePosition to m_nextBreakablePosition to match modern style
+        https://bugs.webkit.org/show_bug.cgi?id=57323
+
+        All of these m_nextBreakablePosition = -1 could probably be replaced with
+        some new methods.  But I'll do that in a separate change.  Clearly
+        m_nextBreakablePosition is just a cached value which should be cleared
+        at the right times.  I suspect we may even fail to clear it sometimes when
+        we should due to the current used of direct access instead of smarter functions.
+
+        * rendering/InlineIterator.h:
+        (WebCore::InlineIterator::InlineIterator):
+        (WebCore::InlineIterator::increment):
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::tryHyphenating):
+        (WebCore::RenderBlock::findNextLineBreak):
+
+2011-03-29  Jeff Miller  <jeffm@apple.com>
+
+        Reviewed by Jon Honeycutt.
+
+        Add WebCore::copyCertificateToData() on Windows
+        https://bugs.webkit.org/show_bug.cgi?id=57296
+
+        Create a new win directory in platform/cf and add CertificateCFWin.cpp and CertificateCFWin.h to it.
+
+        * WebCore.vcproj/WebCore.vcproj: Added CertificateCFWin.cpp and CertificateCFWin.h.
+        * WebCore.vcproj/copyForwardingHeaders.cmd: Copy all header files in \platform\cf\win\.
+        * platform/cf/win: Added.
+        * platform/cf/win/CertificateCFWin.cpp: Added.
+        (WebCore::deallocCertContext): Added.
+        (WebCore::createCertContextDeallocator): Added.
+        (WebCore::copyCertificateToData): Added.
+        * platform/cf/win/CertificateCFWin.h: Added.
+
+2011-03-29  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Ryosuke Niwa.
+
+        Rename InlineIterator::block to m_block to match modern style
+        https://bugs.webkit.org/show_bug.cgi?id=57321
+
+        I could have made m_block private, since it's only accessed in
+        one place outside of InlineIterator (for an ASSERT).  But I chose
+        not to do so in this change.
+
+        * rendering/InlineIterator.h:
+        (WebCore::InlineIterator::InlineIterator):
+        (WebCore::InlineIterator::increment):
+        (WebCore::InlineBidiResolver::appendRun):
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::findNextLineBreak):
+
+2011-03-29  Leo Yang  <leo.yang@torchmobile.com.cn>
+
+        Reviewed by Nikolas Zimmermann.
+
+        Incorrect offset of svg <use> element which is in <symbol> element
+        https://bugs.webkit.org/show_bug.cgi?id=57318
+
+        When webkit expanded a svg <symbol> element in the shadow tree it
+        would clone the children of the <symbol>. The children may contain
+        SVGShadowTreeContainerElement which was expanded from svg <use>
+        element. But the clone operation would clone a
+        SVGShadowTreeContainerElement as a svg <g> element. This resulted
+        that updateContainerOffset wouldn't update offset for those elements
+        which were expand from <use> elements.
+
+        This patch implements cloneElementWithoutAttributesAndChildren for
+        SVGShadowTreeContainerElement to make the container clone itself
+        correctly.
+
+        Test: svg/custom/use-in-symbol-with-offset.svg
+
+        * rendering/svg/SVGShadowTreeElements.cpp:
+        (WebCore::SVGShadowTreeContainerElement::cloneElementWithoutAttributesAndChildren):
+        * rendering/svg/SVGShadowTreeElements.h:
+
+2011-03-29  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Ryosuke Niwa.
+
+        Rename InlineIterator::obj to m_obj to match modern style
+        https://bugs.webkit.org/show_bug.cgi?id=57319
+
+        I started this rename after confusion in InlineBidiResolver::appendRun.
+        (Which uses an "obj" local in InlineIterator.h.  It's not actually
+        masking m_obj because it's a separate class, but I didn't realize
+        that at the time because it's in InlineIterator.h which is itself confusing!)
+
+        * rendering/InlineIterator.h:
+        (WebCore::InlineIterator::InlineIterator):
+        (WebCore::operator==):
+        (WebCore::operator!=):
+        (WebCore::InlineIterator::increment):
+        (WebCore::InlineIterator::atEnd):
+        (WebCore::InlineIterator::current):
+        (WebCore::InlineIterator::direction):
+        (WebCore::InlineBidiResolver::appendRun):
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::checkMidpoints):
+        (WebCore::RenderBlock::appendRunsForObject):
+        (WebCore::RenderBlock::layoutInlineChildren):
+        (WebCore::RenderBlock::matchedEndLine):
+        (WebCore::skipNonBreakingSpace):
+        (WebCore::RenderBlock::requiresLineBox):
+        (WebCore::RenderBlock::skipTrailingWhitespace):
+        (WebCore::RenderBlock::skipLeadingWhitespace):
+        (WebCore::tryHyphenating):
+        (WebCore::RenderBlock::findNextLineBreak):
+
+2011-03-29  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: document Timeline domain, make timeline event types of type string.
+        https://bugs.webkit.org/show_bug.cgi?id=57299
+
+        * inspector/Inspector.json:
+        * inspector/InspectorTimelineAgent.cpp:
+        (WebCore::InspectorTimelineAgent::pushGCEventRecords):
+        (WebCore::InspectorTimelineAgent::start):
+        (WebCore::InspectorTimelineAgent::stop):
+        (WebCore::InspectorTimelineAgent::willCallFunction):
+        (WebCore::InspectorTimelineAgent::didCallFunction):
+        (WebCore::InspectorTimelineAgent::willDispatchEvent):
+        (WebCore::InspectorTimelineAgent::didDispatchEvent):
+        (WebCore::InspectorTimelineAgent::willLayout):
+        (WebCore::InspectorTimelineAgent::didLayout):
+        (WebCore::InspectorTimelineAgent::willRecalculateStyle):
+        (WebCore::InspectorTimelineAgent::didRecalculateStyle):
+        (WebCore::InspectorTimelineAgent::willPaint):
+        (WebCore::InspectorTimelineAgent::didPaint):
+        (WebCore::InspectorTimelineAgent::willWriteHTML):
+        (WebCore::InspectorTimelineAgent::didWriteHTML):
+        (WebCore::InspectorTimelineAgent::didInstallTimer):
+        (WebCore::InspectorTimelineAgent::didRemoveTimer):
+        (WebCore::InspectorTimelineAgent::willFireTimer):
+        (WebCore::InspectorTimelineAgent::didFireTimer):
+        (WebCore::InspectorTimelineAgent::willChangeXHRReadyState):
+        (WebCore::InspectorTimelineAgent::didChangeXHRReadyState):
+        (WebCore::InspectorTimelineAgent::willLoadXHR):
+        (WebCore::InspectorTimelineAgent::didLoadXHR):
+        (WebCore::InspectorTimelineAgent::willEvaluateScript):
+        (WebCore::InspectorTimelineAgent::didEvaluateScript):
+        (WebCore::InspectorTimelineAgent::didScheduleResourceRequest):
+        (WebCore::InspectorTimelineAgent::willSendResourceRequest):
+        (WebCore::InspectorTimelineAgent::willReceiveResourceData):
+        (WebCore::InspectorTimelineAgent::didReceiveResourceData):
+        (WebCore::InspectorTimelineAgent::willReceiveResourceResponse):
+        (WebCore::InspectorTimelineAgent::didReceiveResourceResponse):
+        (WebCore::InspectorTimelineAgent::didFinishLoadingResource):
+        (WebCore::InspectorTimelineAgent::didMarkTimeline):
+        (WebCore::InspectorTimelineAgent::didMarkDOMContentEvent):
+        (WebCore::InspectorTimelineAgent::didMarkLoadEvent):
+        (WebCore::InspectorTimelineAgent::addRecordToTimeline):
+        (WebCore::InspectorTimelineAgent::didCompleteCurrentRecord):
+        (WebCore::InspectorTimelineAgent::pushCurrentRecord):
+        * inspector/InspectorTimelineAgent.h:
+        (WebCore::InspectorTimelineAgent::TimelineRecordEntry::TimelineRecordEntry):
+        * inspector/front-end/TimelineAgent.js:
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel.prototype.get _recordStyles):
+        (WebInspector.TimelinePanel.prototype._createEventDivider):
+        (WebInspector.TimelinePanel.prototype._findParentRecord):
+        (WebInspector.TimelinePanel.prototype._innerAddRecordToTimeline):
+        (WebInspector.TimelineDispatcher.prototype.started):
+        (WebInspector.TimelineDispatcher.prototype.stopped):
+        (WebInspector.TimelineDispatcher.prototype.eventRecorded):
+        (WebInspector.TimelinePanel.FormattedRecord):
+        (WebInspector.TimelinePanel.FormattedRecord.prototype._generatePopupContent):
+        (WebInspector.TimelinePanel.FormattedRecord.prototype._getRecordDetails):
+
+2011-03-29  Andrey Adaikin  <aandrey@google.com>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: Fixing live edits tests on chromium.
+        https://bugs.webkit.org/show_bug.cgi?id=57316
+
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.SourceFrameDelegateForScriptsPanel.prototype.editScriptSource):
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype._handleSave.didEditScriptSource):
+        (WebInspector.SourceFrame.prototype._handleSave):
+        (WebInspector.SourceFrameDelegate.prototype.editScriptSource):
+
+2011-03-29  Pavel Podivilov  <podivilov@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: fix call frames positions in formatted scripts.
+        https://bugs.webkit.org/show_bug.cgi?id=57036
+
+        Introduce PresentationCallFrame class that encapsulates source mapping details from UI components.
+
+        * inspector/front-end/CallStackSidebarPane.js:
+        (WebInspector.CallStackSidebarPane.prototype.update.didGetSourceLocation):
+        (WebInspector.CallStackSidebarPane.prototype.update):
+        (WebInspector.CallStackSidebarPane.prototype.set selectedCallFrame):
+        (WebInspector.CallStackSidebarPane.prototype._placardSelected):
+        (WebInspector.CallStackSidebarPane.prototype._contextMenu):
+        (WebInspector.CallStackSidebarPane.prototype._copyStackTrace):
+        * inspector/front-end/DebuggerModel.js:
+        (WebInspector.DebuggerModel.prototype._didEditScriptSource):
+        (WebInspector.DebuggerModel.prototype.get debuggerPausedDetails):
+        (WebInspector.DebuggerModel.prototype._pausedScript):
+        * inspector/front-end/DebuggerPresentationModel.js:
+        (WebInspector.DebuggerPresentationModel):
+        (WebInspector.DebuggerPresentationModel.prototype.editScriptSource.didEditScriptSource):
+        (WebInspector.DebuggerPresentationModel.prototype.editScriptSource):
+        (WebInspector.DebuggerPresentationModel.prototype.toggleFormatSourceFiles):
+        (WebInspector.DebuggerPresentationModel.prototype._debuggerPaused):
+        (WebInspector.DebuggerPresentationModel.prototype._debuggerResumed):
+        (WebInspector.DebuggerPresentationModel.prototype.set selectedCallFrame):
+        (WebInspector.DebuggerPresentationModel.prototype.get selectedCallFrame):
+        (WebInspector.DebuggerPresentationModel.prototype._reset):
+        (WebInspector.PresenationCallFrame): Call frame wrapper for UI.
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel):
+        (WebInspector.ScriptsPanel.prototype.evaluateInSelectedCallFrame):
+        (WebInspector.ScriptsPanel.prototype._debuggerPaused.else.didGetSourceLocation):
+        (WebInspector.ScriptsPanel.prototype._debuggerPaused):
+        (WebInspector.ScriptsPanel.prototype._debuggerResumed):
+        (WebInspector.ScriptsPanel.prototype._sourceFrameLoaded):
+        (WebInspector.ScriptsPanel.prototype._callFrameSelected.didGetSourceLocation):
+        (WebInspector.ScriptsPanel.prototype._callFrameSelected):
+        (WebInspector.SourceFrameDelegateForScriptsPanel.prototype.evaluateInSelectedCallFrame):
+        * inspector/front-end/SourceFile.js:
+        (WebInspector.SourceFile.prototype.get content):
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype._createTextViewer):
+        (WebInspector.SourceFrame.prototype.setExecutionLine):
+        (WebInspector.SourceFrame.prototype.clearExecutionLine):
+        (WebInspector.SourceFrame.prototype._showPopup.showObjectPopup):
+        (WebInspector.SourceFrame.prototype._showPopup):
+
+2011-03-29  Emil A Eklund  <eae@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Fix for execCommand("Delete") with an empty selection.
+        https://bugs.webkit.org/show_bug.cgi?id=56652
+
+        Test: editing/execCommand/delete-empty-container.html
+
+        * editing/TypingCommand.cpp:
+        (WebCore::TypingCommand::makeEditableRootEmpty): Add check for root element.
+
+2011-03-29  Mikhail Naganov  <mnaganov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: [Chromium] Refactor HeapSnapshot-related code to
+        make sure we don't return big amounts of data to forms.
+        https://bugs.webkit.org/show_bug.cgi?id=57227
+
+        * inspector/front-end/DetailedHeapshotGridNodes.js:
+        (WebInspector.HeapSnapshotGridNode.prototype.populateChildren):
+        (WebInspector.HeapSnapshotGenericObjectNode.prototype.get _countPercent):
+        (WebInspector.HeapSnapshotObjectNode):
+        (WebInspector.HeapSnapshotObjectNode.prototype._createProvider):
+        (WebInspector.HeapSnapshotInstanceNode):
+        (WebInspector.HeapSnapshotInstanceNode.prototype._createProvider):
+        (WebInspector.HeapSnapshotConstructorNode.prototype._createNodesProvider):
+        (WebInspector.HeapSnapshotConstructorNode.prototype.get _countPercent):
+        (WebInspector.HeapSnapshotDiffNode.prototype._createNodesProvider.createProvider):
+        (WebInspector.HeapSnapshotDiffNode.prototype._createNodesProvider):
+        (WebInspector.HeapSnapshotDominatorObjectNode.prototype._createProvider):
+        * inspector/front-end/DetailedHeapshotView.js:
+        (WebInspector.HeapSnapshotContainmentDataGrid.prototype.setDataSource):
+        (WebInspector.HeapSnapshotDominatorsDataGrid.prototype.setDataSource):
+        * inspector/front-end/HeapSnapshot.js:
+        (WebInspector.HeapSnapshotNode.prototype.get dominatorIndex):
+        (WebInspector.HeapSnapshotNode.prototype.get retainers):
+        (WebInspector.HeapSnapshot):
+        (WebInspector.HeapSnapshot.prototype.get _allNodes):
+        (WebInspector.HeapSnapshot.prototype.get nodeCount):
+        (WebInspector.HeapSnapshot.prototype.get rootNodeIndex):
+        (WebInspector.HeapSnapshot.prototype.hasId):
+        (WebInspector.HeapSnapshot.prototype.get nodeIds):
+        (WebInspector.HeapSnapshot.prototype._retainersForNode):
+        (WebInspector.HeapSnapshot.prototype._buildRetainers):
+        (WebInspector.HeapSnapshot.prototype._buildAggregates):
+        (WebInspector.HeapSnapshot.prototype._buildAggregatesIndexes):
+        (WebInspector.HeapSnapshot.prototype._buildIdsList):
+        (WebInspector.HeapSnapshot.prototype._buildNodeIndex):
+        (WebInspector.HeapSnapshotFilteredOrderedIterator):
+        (WebInspector.HeapSnapshotFilteredOrderedIterator.prototype.next):
+        (WebInspector.HeapSnapshotEdgesProvider):
+        (WebInspector.HeapSnapshotNodesProvider):
+
+2011-03-29  Mikhail Naganov  <mnaganov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: [Chromium] Fix detailed heap snapshots UI.
+        https://bugs.webkit.org/show_bug.cgi?id=57235
+
+        Fix two problems:
+          1. Text color of grid cells under selection needs to be white, otherwise it's unreadable for some colors;
+          2. Long strings need to be truncated in grid, their contents can be shown on hover.
+
+        * inspector/front-end/DetailedHeapshotView.js:
+        (WebInspector.DetailedHeapshotView.prototype._getHoverAnchor):
+        (WebInspector.DetailedHeapshotView.prototype._showStringContentPopup):
+        * inspector/front-end/heapProfiler.css:
+        (.detailed-heapshot-view .console-formatted-string):
+        (.detailed-heapshot-view .data-grid tr.selected *):
+        (.detailed-heapshot-view .data-grid:focus tr.selected *):
+
+2011-03-29  Andrey Adaikin  <aandrey@google.com>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: Highlight visible lines first
+        https://bugs.webkit.org/show_bug.cgi?id=57013
+
+        * inspector/front-end/TextViewer.js:
+        (WebInspector.TextEditorChunkedPanel.prototype._findFirstVisibleChunkNumber):
+        (WebInspector.TextEditorChunkedPanel.prototype._findVisibleChunks):
+        (WebInspector.TextEditorChunkedPanel.prototype._findFirstVisibleLineNumber.compareLineRowOffsetTops):
+        (WebInspector.TextEditorChunkedPanel.prototype._findFirstVisibleLineNumber):
+        (WebInspector.TextEditorMainPanel.prototype._paintScheduledLines):
+        (WebInspector.TextEditorMainPanel.prototype._paintLines):
+        (WebInspector.TextEditorMainPanel.prototype._paintLineChunks):
+        (WebInspector.TextEditorMainPanel.prototype._paintLine):
+        (WebInspector.TextEditorMainChunk.prototype.set expanded):
+
+2011-03-29  Emil A Eklund  <eae@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Relative mouse coordinates recalculated for each target
+        https://bugs.webkit.org/show_bug.cgi?id=57130
+
+        Calculate relative coordinates lazily for mouse events instead of doing
+        it for each target. Speeds up dispatching of mouse events in deep dom
+        structures significantly, O(n^2) to O(n).
+
+        Also fixes https://bugs.webkit.org/show_bug.cgi?id=34973
+
+        Tests: fast/events/mouse-relative-position.html
+               perf/mouse-event.html
+
+        * dom/Event.cpp:
+        (WebCore::Event::setTarget):
+        * dom/MouseRelatedEvent.cpp:
+        (WebCore::MouseRelatedEvent::MouseRelatedEvent):
+        (WebCore::MouseRelatedEvent::initCoordinates):
+        (WebCore::pageZoomFactor):
+        (WebCore::MouseRelatedEvent::receivedTarget):
+        (WebCore::MouseRelatedEvent::computeRelativePosition):
+        (WebCore::MouseRelatedEvent::layerX):
+        (WebCore::MouseRelatedEvent::layerY):
+        (WebCore::MouseRelatedEvent::offsetX):
+        (WebCore::MouseRelatedEvent::offsetY):
+        * dom/MouseRelatedEvent.h:
+        * dom/UIEvent.cpp:
+        (WebCore::UIEvent::layerX):
+        (WebCore::UIEvent::layerY):
+        * dom/UIEvent.h:
+
+2011-03-29  Emil A Eklund  <eae@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        getComputedStyle counterIncrement crash @ WebCore::counterToCSSValue
+        https://bugs.webkit.org/show_bug.cgi?id=57266
+
+        Add null check to counterToCSSValue.
+
+        Test: fast/css/getComputedStyle/counterIncrement-without-counter.html
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::counterToCSSValue):
+
+2011-03-29  Gavin Peters  <gavinp@chromium.org>
+
+        Reviewed by Tony Gentilcore.
+
+        Implement onerror events for <link rel=prefetch>
+        https://bugs.webkit.org/show_bug.cgi?id=57182
+
+        These events are equired on link elements, see
+        http://dev.w3.org/html5/spec/Overview.html#the-link-element
+
+        After a discussion in WebKit-dev about the direction of prefetch in the loader, and about a path
+        to adding the Link header, we decided to look at making onerror, onload and onbeforeload events
+        more uniformly supported.  See the thread at
+        https://lists.webkit.org/pipermail/webkit-dev/2011-February/016034.html .
+
+        It turned out that part of adding onerror for link prefetch was to make the top CachedResource less
+        abstract.  It was pure virtual until prefetch became the first consumer to use an unspecialised
+        implementation, and this CL continues that by adding a default checkNotify method to it.  As it
+        happens there were already two subclasses using what amounted to the generic checkNotify, so I
+        also removed those, buying us some code cleanup with the change.
+
+        Test: fast/dom/HTMLLinkElement/prefetch-onerror.html
+
+        * html/HTMLLinkElement.cpp:
+        (WebCore::HTMLLinkElement::parseMappedAttribute):
+        (WebCore::HTMLLinkElement::onloadTimerFired):
+        (WebCore::HTMLLinkElement::notifyFinished):
+        * loader/cache/CachedImage.cpp:
+        * loader/cache/CachedImage.h:
+        * loader/cache/CachedResource.cpp:
+        (WebCore::CachedResource::checkNotify):
+        (WebCore::CachedResource::data):
+        (WebCore::CachedResource::error):
+        * loader/cache/CachedResource.h:
+        * loader/cache/CachedScript.cpp:
+        * loader/cache/CachedScript.h:
+
+2011-03-29  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Ryosuke Niwa.
+
+        Add support for parsing unicode-bidi: -webkit-isolate
+        https://bugs.webkit.org/show_bug.cgi?id=57181
+
+        Test: css3/unicode-bidi-insolate-parse.html
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue):
+        * css/CSSPrimitiveValueMappings.h:
+        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
+        (WebCore::CSSPrimitiveValue::operator EUnicodeBidi):
+        * css/CSSValueKeywords.in:
+        * rendering/style/RenderStyleConstants.h:
+
+2011-03-29  Patrick Gansterer  <paroga@webkit.org>
+
+        Unreviewed WinCE build fix for r82193.
+
+        * platform/wince/FileSystemWinCE.cpp:
+        (WebCore::openTemporaryFile):
+
+2011-03-28  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r82198.
+        http://trac.webkit.org/changeset/82198
+        https://bugs.webkit.org/show_bug.cgi?id=57304
+
+        Broke Chromium Win build. (Requested by dave_levin on
+        #webkit).
+
+        * platform/image-decoders/png/PNGImageDecoder.cpp:
+        (WebCore::PNGImageDecoder::headerAvailable):
+        (WebCore::PNGImageDecoder::rowAvailable):
+
+2011-03-28  Ofri Wolfus  <ofri@google.com>
+
+        Reviewed by Eric Seidel.
+
+        RTL: Select elements with a size attribute are always left aligned.
+        https://bugs.webkit.org/show_bug.cgi?id=50928
+
+        Added support for alignment in RenderListBox.
+
+        Test: fast/forms/listbox-bidi-align.html
+
+        * rendering/RenderListBox.cpp:
+        (WebCore::itemOffsetForAlignment):
+        (WebCore::RenderListBox::paintItemForeground): Add support for alignment and directionality.
+
+2011-03-28  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Benjamin Poulain.
+
+        [Qt] Change TextureMapperVideoLayer to TextureMapperMediaLayer
+        https://bugs.webkit.org/show_bug.cgi?id=57142
+
+        TextureMapperMediaLayer is a better name here because both video and plugins use this layer.
+        Remove ENABLE(VIDEO) guard.
+
+        * platform/graphics/qt/MediaPlayerPrivateQt.cpp:
+        * platform/graphics/qt/MediaPlayerPrivateQt.h:
+        * platform/graphics/texmap/GraphicsLayerTextureMapper.cpp:
+        (WebCore::GraphicsLayerTextureMapper::setContentsToMedia):
+        * platform/graphics/texmap/TextureMapperNode.h:
+        * platform/graphics/texmap/TextureMapperPlatformLayer.h:
+        (WebCore::TextureMapperMediaLayer::layerType):
+
+2011-03-28  Thomas Klausner  <tk@giga.or.at>
+
+        Reviewed by David Levin.
+
+        png-1.5 fixes
+        https://bugs.webkit.org/show_bug.cgi?id=54406
+
+        Fix compilation with png-1.5: struct members were hidden, and
+        a new API to terminate data processing was added (especially for
+        WebKit).
+
+        Compilation fixes, so no new tests.
+
+        * platform/image-decoders/png/PNGImageDecoder.cpp:
+        (WebCore::PNGImageDecoder::headerAvailable):
+        (WebCore::PNGImageDecoder::rowAvailable):
+
+2011-03-28  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Adam Barth.
+
+        Replace fprintf(stderr, ...) with LOG_ERROR
+        https://bugs.webkit.org/show_bug.cgi?id=57216
+
+        LOG_ERROR is a better choice here.
+
+        * bridge/jni/v8/JavaClassV8.cpp:
+        (JavaClass::JavaClass):
+
+2011-03-28  Steve Block  <steveblock@google.com>
+
+        Reviewed by Jeremy Orlow.
+
+        Add a new JavaValue to type to represent a Java value in the Java bridge
+        https://bugs.webkit.org/show_bug.cgi?id=57022
+
+        This change introduces a new JavaValue type and uses it in place of jvalue
+        in the conversions to and from JavaNPObject used in the V8 Java bridge.
+
+        Refactoring only, no new tests.
+
+        * WebCore.gypi:
+        * bridge/jni/JNIUtility.cpp:
+        (JSC::Bindings::javaTypeFromClassName):
+        (JSC::Bindings::signatureFromJavaType):
+        (JSC::Bindings::getJNIField):
+        (JSC::Bindings::callJNIMethod):
+        * bridge/jni/JavaType.h:
+        * bridge/jni/v8/JNIUtilityPrivate.cpp:
+        (JSC::Bindings::convertNPVariantToJavaValue):
+        (JSC::Bindings::convertJavaValueToNPVariant):
+        (JSC::Bindings::jvalueToJavaValue):
+        (JSC::Bindings::javaValueToJvalue):
+        * bridge/jni/v8/JNIUtilityPrivate.h:
+        * bridge/jni/v8/JavaNPObjectV8.cpp:
+        (JSC::Bindings::JavaNPObjectInvoke):
+        (JSC::Bindings::JavaNPObjectGetProperty):
+        * bridge/jni/v8/JavaValueV8.h: Added.
+        (JSC::Bindings::JavaValue::JavaValue):
+
+2011-03-28  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Use String instead of CString as return value of openTemporaryFile
+        https://bugs.webkit.org/show_bug.cgi?id=55332
+
+        We usually store all paths as UTF-16. Do this for temporary files too.
+
+        * WebCore.exp.in
+        * platform/FileSystem.h:
+        * platform/android/FileSystemAndroid.cpp:
+        * platform/brew/FileSystemBrew.cpp:
+        * platform/efl/FileSystemEfl.cpp:
+        * platform/gtk/FileSystemGtk.cpp:
+        * platform/haiku/FileSystemHaiku.cpp:
+        * platform/mac/FileSystemMac.mm:
+        * platform/qt/FileSystemQt.cpp:
+        * platform/win/FileSystemWin.cpp:
+        * platform/wince/FileSystemWinCE.cpp:
+        * platform/wx/FileSystemWx.cpp:
+        * plugins/PluginStream.cpp:
+        (WebCore::PluginStream::destroyStream):
+        * plugins/PluginStream.h:
+
+2011-03-28  Jeff Johnson  <opendarwin@lapcatsoftware.com>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: empty, non-functional window
+        https://bugs.webkit.org/show_bug.cgi?id=56354
+
+        Check whether DOM local storage is enabled
+        before attempting to access window.localStorage.
+
+        No new tests.
+
+        * inspector/front-end/Settings.js:
+        (WebInspector.Settings.prototype.findSettingForAllProjects):
+        (WebInspector.Settings.prototype._get):
+        (WebInspector.Settings.prototype._set):
+
+2011-03-28  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=57286 Alternative fix for: 
+        Horizontal scroller stops appearing after going Forward
+        -and corresponding-
+        <rdar://problem/9026946>
+
+        This patch rolls out revision 79053 and fixes the same bug in a  better way.
+
+        New function resetScrollbarsAndClearContentsSize() calls resetScrollbars() and then 
+        sets the contents size to 0. This is called when a document is going into the page 
+        cache.
+        * dom/Document.cpp:
+        (WebCore::Document::setInPageCache):
+        (WebCore::FrameView::resetScrollbarsAndClearContentsSize):
+
+        Roll-out of 79053.
+        * history/CachedFrame.cpp:
+        (WebCore::CachedFrameBase::restore):
+        * page/FrameView.cpp:
+        (WebCore::FrameView::FrameView):
+        (WebCore::FrameView::reset):
+        (WebCore::FrameView::layout):
+        * page/FrameView.h:
+
+2011-03-28  Ojan Vafai  <ojan@chromium.org>
+
+        Reviewed by Antti Koivisto.
+
+        fix style sharing with :any and sibling selectors
+        https://bugs.webkit.org/show_bug.cgi?id=57211
+
+        Test: fast/css/sibling-selectors.html
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::collectFeaturesFromList):
+
+2011-03-27  Ojan Vafai  <ojan@chromium.org>
+
+        Reviewed by Antti Koivisto.
+
+        fix :-webkit-any(:last-child)
+        https://bugs.webkit.org/show_bug.cgi?id=57207
+
+        We were passing the wrong arguments to checkSelector. Also, we were not
+        passing through the encounteredLink bool.
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::SelectorChecker::checkSelector):
+        (WebCore::CSSStyleSelector::SelectorChecker::checkOneSelector):
+        * css/CSSStyleSelector.h:
+
+2011-03-27  Ojan Vafai  <ojan@chromium.org>
+
+        Reviewed by Antti Koivisto.
+
+        fix :-webkit-any(:last-child)
+        https://bugs.webkit.org/show_bug.cgi?id=57207
+
+        We were passing the wrong arguments to checkSelector. Also, we were not
+        passing through the encounteredLink bool.
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::SelectorChecker::checkSelector):
+        (WebCore::CSSStyleSelector::SelectorChecker::checkOneSelector):
+        * css/CSSStyleSelector.h:
+
+2011-03-28  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Darin Adler.
+
+        REGRESSION(r82152): fast/dom/HTMLAnchorElement/set-href-attribute-pathname.html
+        https://bugs.webkit.org/show_bug.cgi?id=57291
+
+        * platform/KURL.cpp:
+        (WebCore::KURL::parse): Instead of considering URLs with
+        credentials but no host invalid, consider them to have a host
+        ending in @ (which fails down the line)/
+
+2011-03-28  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Fix some problems of the appearance of form validation message bubble.
+        https://bugs.webkit.org/show_bug.cgi?id=57208
+
+        No new tests. Validation message bubble appearance is not testable
+        because it depends on a timer.
+
+        * css/html.css:
+        (::-webkit-validation-bubble):
+        (::-webkit-validation-bubble-message):
+        (::-webkit-validation-bubble-arrow):
+        (::-webkit-validation-bubble-arrow-clipper):
+          - Explicitly set margin, padding, and color.
+          - Make the shadow darker.
+          - Make the background color darker.
+          - Make opacity larger.
+          - Make the border color lighter.
+          - Add inset shadows
+          - Change the implementation of an arrow.
+            Stop making a right triangle by the border trick.
+            Use -webkit-transform instead.
+          - Make min-width workable by changing display property of
+            -webkit-validation-bubble to "inline-block".
+        * html/ValidationMessage.cpp:
+        (WebCore::ValidationMessage::buildBubbleTree):
+          Change the node structure. Before this change, -webkit-validation-bubble
+          had three DIVs inside. After this change, it has two DIVs;
+          -webkit-validation-bubble-arrow-clipper and
+          -webkit-validation-bubble-message, and
+          -webkit-validation-bubble-arrow-clipper contains
+          -webkit-validation-bubble-arrow.
+
+2011-03-28  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        REGRESSION: Can't enter pasted with context or Edit menu text in search or address field in the browser.
+        https://bugs.webkit.org/show_bug.cgi?id=57275
+        <rdar://problem/8246691>
+
+        We need to classify cut and paste actions as user typing actions even when
+        the action is triggered by a context menu selection to
+        allow the propagation of the textDidChangeInTextField event.
+
+        * editing/EditorCommand.cpp:
+        The following methods have been modified to properly set up
+        the UserTypingGestureAction when the command source is the
+        menu or a key binding sequence.
+        (WebCore::executeCut):
+        (WebCore::executePaste):
+        (WebCore::executePasteAndMatchStyle):
+        (WebCore::executePasteAsPlainText):
+        (WebCore::executeDelete):
+        * page/ContextMenuController.cpp:
+        (WebCore::ContextMenuController::contextMenuItemSelected): Changed to
+        call execute command instead of referring to the specific method in
+        the editor class.
+
+2011-03-28  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        instanceof Array test fails when using iframes
+        https://bugs.webkit.org/show_bug.cgi?id=17250
+
+        Update for new function and date apis
+
+        Test: fast/js/js-constructors-use-correct-global.html
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::jsDateOrNull):
+        * bindings/js/JSLazyEventListener.cpp:
+        (WebCore::JSLazyEventListener::initializeJSFunction):
+
+2011-03-28  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=57124 When the scroller style is 
+        changed via delegate method, the page needs a full relayout and repaint
+        -and corresponding-
+        <rdar://problem/9059129>
+
+        Call into WebKitSystemInterface to associate the new painter with the existing 
+        painter controller. Reset the scrollbar frame rects to the new thickness -- normally 
+        this only happens when a scrollbar is created, so we have to reset the thickness 
+        here to pick up the new theme thickness. Finally, force a full relayout and style 
+        recall with setNeedsRecalcStyleInAllFrames()
+        * platform/mac/ScrollAnimatorMac.mm:
+        (-[ScrollbarPainterControllerDelegate scrollerImpPair:updateScrollerStyleForNewRecommendedScrollerStyle:]):
+
+        setNeedsRecalcStyleInAllFrames() used to be a static method in Settings.cpp. This 
+        patch moves it to be a member function on Page so that it can be called from 
+        FrameView when the scrollbar style changes.
+        * page/FrameView.cpp:
+        (WebCore::FrameView::setNeedsRecalcStyleInAllFrames):
+        * page/FrameView.h:
+        * page/Page.cpp:
+        (WebCore::Page::setNeedsRecalcStyleInAllFrames):
+        * page/Page.h:
+        * page/Settings.cpp:
+        (WebCore::Settings::setStandardFontFamily):
+        (WebCore::Settings::setFixedFontFamily):
+        (WebCore::Settings::setSerifFontFamily):
+        (WebCore::Settings::setSansSerifFontFamily):
+        (WebCore::Settings::setCursiveFontFamily):
+        (WebCore::Settings::setFantasyFontFamily):
+        (WebCore::Settings::setMinimumFontSize):
+        (WebCore::Settings::setMinimumLogicalFontSize):
+        (WebCore::Settings::setDefaultFontSize):
+        (WebCore::Settings::setDefaultFixedFontSize):
+        (WebCore::Settings::setTextAreasAreResizable):
+        (WebCore::Settings::setAuthorAndUserStylesEnabled):
+        (WebCore::Settings::setFontRenderingMode):
+        (WebCore::Settings::setAcceleratedCompositingEnabled):
+        (WebCore::Settings::setShowDebugBorders):
+        (WebCore::Settings::setShowRepaintCounter):
+        * platform/ScrollableArea.h:
+        (WebCore::ScrollableArea::setNeedsRecalcStyleInAllFrames):
+
+2011-03-28  Dirk Pranke  <dpranke@chromium.org>
+
+        RS=Tony Chang.
+
+        r81977 moved FontPlatformData.h from
+        WebCore/platform/graphics/cocoa to platform/graphics. This
+        change updates the chromium build accordingly.
+
+        https://bugs.webkit.org/show_bug.cgi?id=57281
+
+        * platform/graphics/chromium/CrossProcessFontLoading.mm:
+
+2011-03-28  Jer Noble  <jer.noble@apple.com>
+
+        Reviewed by Darin Adler.
+
+        MediaPlayerPrivateAVFoundation should report that it supportsFullScreen()
+        https://bugs.webkit.org/show_bug.cgi?id=57249
+
+        * platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.cpp:
+        (WebCore::MediaPlayerPrivateAVFoundation::supportsFullscreen):
+        * platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.h:
+
+2011-03-28  Jer Noble  <jer.noble@apple.com>
+
+        Reviewed by Darin Adler.
+
+        AVFoundation can indeed support full screen.
+
+        MediaPlayerPrivateAVFoundation should report that it supportsFullScreen()
+        https://bugs.webkit.org/show_bug.cgi?id=57249
+
+        * platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.cpp:
+        (WebCore::MediaPlayerPrivateAVFoundation::supportsFullscreen): Return true if using
+            the new full screen APIs.
+        * platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.h:
+
+2011-03-28  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Darin Adler.
+
+        http streams don't always display video with AVFoundation backend
+        https://bugs.webkit.org/show_bug.cgi?id=57203
+
+        No new tests, we don't currently have tests for http live streams. Changes verified manually.
+
+        * platform/graphics/MediaPlayer.cpp:
+        (WebCore::MediaPlayer::MediaPlayer): Initialize m_shouldPrepareToRender.
+        (WebCore::MediaPlayer::loadWithNextMediaEngine): Call prepareForRendering on new engine
+            if m_shouldPrepareToRender is set.
+        (WebCore::MediaPlayer::prepareForRendering): Set m_shouldPrepareToRender.
+        * platform/graphics/MediaPlayer.h:
+
+        * platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.cpp:
+        (WebCore::MediaPlayerPrivateAVFoundation::isReadyForVideoSetup): Don't return true until
+            m_isAllowedToRender has been set.
+        (WebCore::MediaPlayerPrivateAVFoundation::prepareForRendering): Always call setUpVideoRendering,
+            it has logic to figure out when setup is required.
+        (WebCore::MediaPlayerPrivateAVFoundation::updateStates): Call setUpVideoRendering when we aren't
+            using the preferred rendering mode because if we get a file's metadata between the
+            time supportsAcceleratedRendering() and paint() are called, we will allocate a software
+            renderer even when we prefer a layer backed renderer.
+        (WebCore::MediaPlayerPrivateAVFoundation::movieLoadType): Return "unknown" until we have metadata.
+
+        * platform/graphics/avfoundation/MediaPlayerPrivateAVFoundationObjC.h:
+        * platform/graphics/avfoundation/MediaPlayerPrivateAVFoundationObjC.mm:
+        (WebCore::MediaPlayerPrivateAVFoundationObjC::cancelLoad): Use itemKVOProperties() instead of
+            an explicit list of key path names.
+        (WebCore::MediaPlayerPrivateAVFoundationObjC::createAVPlayerForURL): Ditto.
+        (WebCore::MediaPlayerPrivateAVFoundationObjC::beginLoadingMetadata): metadataKeyNames renamed
+            to assetMetadataKeyNames, return an NSArray instead of a CFArrayRef since that is what the
+            callers need.
+        (WebCore::MediaPlayerPrivateAVFoundationObjC::platformDuration): Return the duration of the 
+            player item, not the asset, because AVAsset.duration always returns an indefinite time
+            for all streaming files.
+        (WebCore::MediaPlayerPrivateAVFoundationObjC::assetStatus): metadataKeyNames renamed
+            to assetMetadataKeyNames.
+        (WebCore::MediaPlayerPrivateAVFoundationObjC::paintCurrentFrameInContext): Do nothing until
+            metadata is available.
+        (WebCore::MediaPlayerPrivateAVFoundationObjC::paint): Ditto.
+        (WebCore::MediaPlayerPrivateAVFoundationObjC::tracksChanged): Split size calculation logic off
+            into sizeChanged().
+        (WebCore::MediaPlayerPrivateAVFoundationObjC::sizeChanged): New. Use AVPlayerItem.presentationSize
+            until tracks is non-NULL so we have a size as early as possible.
+        (WebCore::MediaPlayerPrivateAVFoundationObjC::assetMetadataKeyNames): Renamed from metadataKeyNames.
+        (WebCore::MediaPlayerPrivateAVFoundationObjC::itemKVOProperties): New, return an array of
+            KVO observable properties.
+        (-[WebCoreAVFMovieObserver observeValueForKeyPath:ofObject:change:context:]): Respond to 
+            presentationSize change.
+
+2011-03-28  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Search field focus ring is missing
+        https://bugs.webkit.org/show_bug.cgi?id=57270
+        <rdar://problem/8765555>
+
+        Add an _automaticFocusRingDisabled method which returns YES.
+
+        * platform/mac/ThemeMac.mm:
+        (-[WebCoreFlippedView _automaticFocusRingDisabled]):
+
+2011-03-28  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Move more events to EventDispatcher.
+        https://bugs.webkit.org/show_bug.cgi?id=57247
+
+        No functional changes, covered by existing tests.
+
+        * dom/EventDispatcher.cpp:
+        (WebCore::eventTargetRespectingSVGTargetRules): Made a static function,
+            since it's not used anywhere outside of the EventDispatcher.
+        (WebCore::EventDispatcher::dispatchScopedEvent): Moved from Node.cpp.
+        (WebCore::EventDispatcher::dispatchKeyEvent): Ditto.
+        (WebCore::EventDispatcher::dispatchWheelEvent): Ditto.
+        (WebCore::EventDispatcher::dispatchEvent): Changed to use eventTargetRespectingSVGTargetRules
+            as a static function.
+        * dom/EventDispatcher.h: Updated decls.
+        * dom/Node.cpp:
+        (WebCore::Node::dispatchScopedEvent): Replaced with calling EventDispatcher.
+        (WebCore::Node::dispatchKeyEvent): Ditto.
+        (WebCore::Node::dispatchWheelEvent): Ditto.
+
+2011-03-28  Adele Peterson  <adele@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        Fix for <rdar://problem/9112694> REGRESSION (r79411): "Check grammar with spelling" context menu doesn't check as you type
+        https://bugs.webkit.org/show_bug.cgi?id=57173
+
+        Test: editing/spelling/grammar.html
+
+        * WebCore.exp.in: Add symbol for new selectionStartHasMarkerFor method.
+        * editing/Editor.cpp:
+        (WebCore::Editor::markAllMisspellingsAndBadGrammarInRanges): Every use of paragraph is specific to spelling or grammar, 
+         so to avoid confusion, we should explicitly use spellingParagraph or grammarParagraph.  In the case of this bug, 
+         when we're consider ambiguous boundary characters (characters that could indicate word boundaries, but are used 
+         in the middle of words too, like apostrophes), we should use the use the spellingParagraph since the spellingParagraph 
+         is the only one operated on when this information is used.
+         (WebCore::Editor::selectionStartHasMarkerFor): Changed from selectionStartHasSpellingMarkerFor so it can check for grammar as well as spelling.
+        * editing/Editor.h:
+
+2011-03-28  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/8895977> REGRESSION: multicol crashes with positioned elements
+        https://bugs.webkit.org/show_bug.cgi?id=48983
+
+        Test: fast/multicol/paginated-layer-crash.html
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::paintPaginatedChildLayer): Bring the logic for finding pagintating layers
+        into sync with updatePagination() after r68069.
+        (WebCore::RenderLayer::hitTestPaginatedChildLayer): Ditto.
+
+2011-03-28  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Darin Adler' .
+
+        URLSs with non-empty username but empty hostname treat first path segment as hostname, potentially enabling XSS
+        https://bugs.webkit.org/show_bug.cgi?id=57220
+
+        Test: http/tests/uri/username-with-no-hostname.html
+
+        * platform/KURL.cpp:
+        (WebCore::hostPortIsEmptyButUserPassIsNot):
+        (WebCore::KURL::parse):
+
+2011-03-28  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        script-src should block inline event handlers
+        https://bugs.webkit.org/show_bug.cgi?id=57212
+
+        I considered wrapping this into the canExecute check, but that approach
+        would require passing that function a bunch of context information to
+        behave correctly once we add support for the "options" directive that
+        re-enables these features.
+
+        Test: http/tests/security/contentSecurityPolicy/script-src-none-inline-event.html
+
+        * bindings/js/JSLazyEventListener.cpp:
+        (WebCore::JSLazyEventListener::initializeJSFunction):
+            - This function was a mess.  I couldn't resist cleaning it up a
+              bunch.  Notice that we ASSERT at the beginning of the function
+              that scriptExecutionContext is a document and that both ways of
+              getting the global object are the same when document->frame() is
+              non-zero because the document must be active and there is a
+              one-to-one relation between Frames and active Documents.
+        * bindings/v8/V8LazyEventListener.cpp:
+        (WebCore::V8LazyEventListener::prepareListenerObject):
+        * page/ContentSecurityPolicy.cpp:
+        (WebCore::ContentSecurityPolicy::allowInlineEventHandlers):
+        * page/ContentSecurityPolicy.h:
+
+2011-03-28  Jeff Miller  <jeffm@apple.com>
+
+        Reviewed by Adam Roben.
+
+        ResourceError::certificate() should return a PCCERT_CONTEXT
+        https://bugs.webkit.org/show_bug.cgi?id=57262
+
+        * platform/network/cf/ResourceError.h: certificate() now returns a PCCERT_CONTEXT.
+        * platform/network/cf/ResourceErrorCF.cpp:
+        (WebCore::ResourceError::certificate): Added.
+
+2011-03-28  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Simon Fraser and Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=57221, memory corruption/crashes when positioned objects
+        occur at the end of a line.
+        
+        The old code and new code for dealing with a trailing space object midpoint manipulated a raw
+        array instead of the Vector. Otherwise this corruption would have been caught prior to check-in.
+        
+        I have patched the code to only go through the Vector and to make it handle the case that led to
+        the corruption. Trailing positioned objects can occur both prior to and following the trailing space
+        object's midpoint, so we have to be prepared to deal with both cases.
+        
+        This is already tested by fast/block/positioning/052.html, and that test now properly progresses
+        like the other positioning tests did.
+
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::findNextLineBreak):
+
+2011-03-28  Andrei Popescu  <andreip@google.com>
+
+        Reviewed by Steve Block.
+
+        V8IDBKeyCustom.cpp does not compile with INDEXED_DATABASE disabled
+        https://bugs.webkit.org/show_bug.cgi?id=57100
+
+        Close the ENABLE guard and the namespace in the right order.
+
+        No new tests, just cleanup.
+
+        * bindings/v8/custom/V8IDBAnyCustom.cpp:
+        * bindings/v8/custom/V8IDBKeyCustom.cpp:
+
+2011-03-28  Jeff Miller  <jeffm@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Include certificate when sending a WebCore::ResourceError to UI process on Windows
+        https://bugs.webkit.org/show_bug.cgi?id=57195
+
+        Add support for tracking the certificate in WebCore::ResourceError.
+
+        * platform/network/ResourceErrorBase.cpp:
+        (WebCore::ResourceErrorBase::copy): Call platformCopy() to copy platform-specific fields.
+        * platform/network/ResourceErrorBase.h:
+        (WebCore::ResourceErrorBase::platformCopy): Added.
+        * platform/network/cf/ResourceError.h: Added constructor that takes certificate data, shadowed platformCopy, added m_certificate.
+        (WebCore::ResourceError::certificate): Added.
+        * platform/network/cf/ResourceErrorCF.cpp:
+        (WebCore::ResourceError::ResourceError): Added constructor that takes certificate data.
+        (WebCore::ResourceError::platformLazyInit): Read any certificate from the userInfo dictionary.
+        (WebCore::ResourceError::platformCopy): Copy m_certificate.
+        (WebCore::ResourceError::cfError): Add any certificate data to the userInfo dictionary in the CFErrorRef.
+
+2011-03-28  Jessie Berlin  <jberlin@apple.com>
+
+        Rubber-stamped by Adam Roben.
+
+        Add an extra newline to the end of the generated Inspector.idl file so that it does not
+        trigger the Windows "no newline at at end of file" warning.
+
+        * inspector/generate-inspector-idl:
+
+2011-03-28  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Buildfix after r82125.
+
+        [Qt] QtWebKit will not compile with QT_ASCII_CAST_WARNINGS enabled
+        https://bugs.webkit.org/show_bug.cgi?id=57087
+
+        * platform/graphics/qt/MediaPlayerPrivateQt.cpp: Convert all char* to QString explicitly.
+        (WebCore::MediaPlayerPrivateQt::getSupportedTypes):
+        (WebCore::MediaPlayerPrivateQt::commitLoad):
+
+2011-03-28  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r82099.
+        http://trac.webkit.org/changeset/82099
+        https://bugs.webkit.org/show_bug.cgi?id=57245
+
+        Breaks live edits tests on chromium. (Requested by pfeldman on
+        #webkit).
+
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.SourceFrameDelegateForScriptsPanel.prototype.editScriptSource):
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype._handleSave):
+        (WebInspector.SourceFrameDelegate.prototype.editScriptSource):
+
+2011-03-28  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: brush up and rename debugger domain functions.
+        https://bugs.webkit.org/show_bug.cgi?id=57240
+
+        * inspector/Inspector.json:
+        * inspector/InspectorAgent.cpp:
+        (WebCore::InspectorAgent::setFrontend):
+        (WebCore::InspectorAgent::postWorkerNotificationToFrontend):
+        * inspector/InspectorDebuggerAgent.cpp:
+        (WebCore::InspectorDebuggerAgent::setBreakpointsActive):
+        (WebCore::InspectorDebuggerAgent::setBreakpointByUrl):
+        (WebCore::InspectorDebuggerAgent::setBreakpoint):
+        (WebCore::InspectorDebuggerAgent::removeBreakpoint):
+        (WebCore::InspectorDebuggerAgent::editScriptSource):
+        (WebCore::InspectorDebuggerAgent::setPauseOnExceptionsState):
+        (WebCore::InspectorDebuggerAgent::didParseSource):
+        (WebCore::InspectorDebuggerAgent::failedToParseSource):
+        (WebCore::InspectorDebuggerAgent::didPause):
+        (WebCore::InspectorDebuggerAgent::didContinue):
+        * inspector/InspectorDebuggerAgent.h:
+        * inspector/front-end/DebuggerModel.js:
+        (WebInspector.DebuggerModel.prototype.setBreakpoint):
+        (WebInspector.DebuggerModel.prototype.setBreakpointBySourceId):
+        (WebInspector.DebuggerModel.prototype.removeBreakpoint):
+        (WebInspector.DebuggerModel.prototype._didEditScriptSource):
+        (WebInspector.DebuggerDispatcher.prototype.paused):
+        (WebInspector.DebuggerDispatcher.prototype.resumed):
+        (WebInspector.DebuggerDispatcher.prototype.scriptParsed):
+        (WebInspector.DebuggerDispatcher.prototype.scriptFailedToParse):
+        (WebInspector.DebuggerDispatcher.prototype.breakpointResolved):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype.toggleBreakpointsClicked):
+        * inspector/front-end/inspector.js:
+        (WebInspector.didCreateWorker):
+        (WebInspector.didDestroyWorker):
+
+2011-03-28  David Kilzer  <ddkilzer@apple.com>
+
+        <http://webkit.org/b/57239> Use forward class declaration instead of including header
+
+        Reviewed by Dan Bernstein.
+
+        Adding a "using namespace WebCore;" statement in a header may
+        cause issues when <WebCore/Length.h> is included before
+        <CoreText/CoreText.h>.
+
+        Length.h defines the LengthType enum with a 'Fixed' value.
+        CoreText.h includes MacTypes.h, which has a
+        "typedef SInt32 Fixed;" statement, and then CoreText.h includes
+        other headers that also use 'Fixed', but expect the typedef to
+        be defined, not the enum.  If another header includes
+        "using namespace WebCore;" before CoreText.h, the
+        following compiler errors result (paths abbreviated):
+
+            CoreText.framework/Headers/SFNTLayoutTypes.h:689: error: reference to 'Fixed' is ambiguous
+            MacTypes.h:184: error: candidates are: typedef SInt32 Fixed
+            Length.h:37: error:                 WebCore::LengthType WebCore::Fixed
+            SFNTLayoutTypes.h:689: error: 'Fixed' does not name a type
+
+        * platform/mac/HTMLConverter.h: Use forward declaration of
+        DocumentLoader class instead of including header.  Remove the
+        unused "using namespace WebCore;" statement.
+
+2011-03-26  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Introduce EventDispatcher, the new common way to fire events.
+        https://bugs.webkit.org/show_bug.cgi?id=57168
+
+        The goal here is two-fold:
+        1) reduce the need to randomly sprinkle guards around the dispatch code
+        by creating a well-scoped abstraction for dispatching events.
+        2) create a place where fiddly event-related things like creating event
+        contexts for ancestors can be done lazily.
+
+        Additionally, with all the free-standing static functions, this code was
+        just begging to come out of Node.cpp.
+
+        The first step is a near-mechanical extraction of mouse-related events
+        from Node.cpp to EventDispatcher. For now, the call sites are just
+        replaced with invoking EventDispatcher. Later, we can remove these methods
+        from Node.
+
+        Refactoring, no functional changes.
+
+        * Android.mk: Added EventDispatcher to build system.
+        * CMakeLists.txt: Ditto.
+        * GNUmakefile.am: Ditto.
+        * WebCore.gypi: Ditto.
+        * WebCore.pro: Ditto.
+        * WebCore.vcproj/WebCore.vcproj: Ditto.
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
+        * dom/DOMAllInOne.cpp: Ditto.
+        * dom/EventDispatcher.cpp: Added.
+        * dom/EventDispatcher.h: Added.
+        * dom/Node.cpp:
+        (WebCore::Node::dispatchScopedEvent): Replaced to use EventDispatcher.
+        (WebCore::Node::dispatchEvent): Ditto.
+        (WebCore::Node::dispatchMouseEvent): Ditto.
+        (WebCore::Node::dispatchSimulatedClick): Ditto.
+        * dom/Node.h: Updated decls.
+
+2011-03-28  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        <rdar://problem/9003382> Incomplete repaint of overflow in flipped lines writing modes
+        https://bugs.webkit.org/show_bug.cgi?id=57197
+
+        Tests: fast/repaint/overflow-flipped-writing-mode-block.html
+               fast/repaint/overflow-flipped-writing-mode-table.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::paint): Flip the overflow rect before testing for intersection
+        with the damage rect.
+        * rendering/RenderTable.cpp:
+        (WebCore::RenderTable::paint): Made the intersection check more like the one in
+        RenderBlock::paint().
+
+2011-03-28  Xiaomei Ji  <xji@chromium.org>
+
+        Reviewed by Ryosuke Niwa.
+
+        move directionOfEnclosingBlock() to be global so that it could be reused.
+        https://bugs.webkit.org/show_bug.cgi?id=57233.
+
+        Provide global function directionOfEnclosingBlock(Node*) so that it could be
+        reused in SelectionController and other functionalities that need enclosing
+        block's direcionality, such as moving caret by word in visual order.
+      
+        No new functionality, so no new tests.
+
+        * editing/SelectionController.cpp:
+        (WebCore::SelectionController::directionOfEnclosingBlock):
+        * editing/htmlediting.cpp:
+        (WebCore::directionOfEnclosingBlock):
+        * editing/htmlediting.h:
+
+2011-03-28  Jarkko Sakkinen  <jarkko.j.sakkinen@gmail.com>
+
+        Reviewed by Benjamin Poulain.
+
+        [Qt] fast/canvas/webgl/context-attributes-alpha-depth-stencil-antialias.html fails
+        https://bugs.webkit.org/show_bug.cgi?id=56825
+
+        Fixes for context attribute handling:
+        - Initialize depth and stencil buffer depending on whether they
+        are enabled in context attributes.
+        - Always enable depth buffer when stencil buffer is enabled.
+        - Disable stencil buffer on OpenGL ES 2.0
+        - Cleaned up clutter code from initialization. Made code paths 
+        more sane.
+        - Clear mask is now set correctly in reshape().
+
+        Tests: fast/canvas/webgl/context-attributes-alpha-depth-stencil-antialias.html
+
+        * platform/graphics/qt/GraphicsContext3DQt.cpp:
+        (WebCore::GraphicsContext3DInternal::isValid):
+        (WebCore::GraphicsContext3DInternal::GraphicsContext3DInternal):
+        (WebCore::GraphicsContext3DInternal::reshape):
+        (WebCore::GraphicsContext3DInternal::paint):
+        (WebCore::GraphicsContext3DInternal::getProcAddress):
+        (WebCore::GraphicsContext3D::GraphicsContext3D):
+        (WebCore::GraphicsContext3D::reshape):
+        (WebCore::GraphicsContext3D::bindFramebuffer):
+
+2011-03-28  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: rename network domain events from didHappenSomething to somethingHappened.
+        https://bugs.webkit.org/show_bug.cgi?id=57226
+
+        * inspector/Inspector.json:
+        * inspector/InspectorResourceAgent.cpp:
+        (WebCore::InspectorResourceAgent::willSendRequest):
+        (WebCore::InspectorResourceAgent::markResourceAsCached):
+        (WebCore::InspectorResourceAgent::didReceiveResponse):
+        (WebCore::InspectorResourceAgent::didReceiveContentLength):
+        (WebCore::InspectorResourceAgent::didFinishLoading):
+        (WebCore::InspectorResourceAgent::didFailLoading):
+        (WebCore::InspectorResourceAgent::didLoadResourceFromMemoryCache):
+        (WebCore::InspectorResourceAgent::setInitialContent):
+        (WebCore::InspectorResourceAgent::didCommitLoad):
+        (WebCore::InspectorResourceAgent::frameDetachedFromParent):
+        (WebCore::InspectorResourceAgent::didCreateWebSocket):
+        (WebCore::InspectorResourceAgent::willSendWebSocketHandshakeRequest):
+        (WebCore::InspectorResourceAgent::didReceiveWebSocketHandshakeResponse):
+        (WebCore::InspectorResourceAgent::didCloseWebSocket):
+        * inspector/front-end/NetworkManager.js:
+        (WebInspector.NetworkDispatcher.prototype.requestWillBeSent):
+        (WebInspector.NetworkDispatcher.prototype.resourceMarkedAsCached):
+        (WebInspector.NetworkDispatcher.prototype.responseReceived):
+        (WebInspector.NetworkDispatcher.prototype.dataReceived):
+        (WebInspector.NetworkDispatcher.prototype.loadingFinished):
+        (WebInspector.NetworkDispatcher.prototype.loadingFailed):
+        (WebInspector.NetworkDispatcher.prototype.resourceLoadedFromMemoryCache):
+        (WebInspector.NetworkDispatcher.prototype.frameDetached):
+        (WebInspector.NetworkDispatcher.prototype.initialContentSet):
+        (WebInspector.NetworkDispatcher.prototype.frameNavigated):
+        (WebInspector.NetworkDispatcher.prototype.webSocketCreated):
+        (WebInspector.NetworkDispatcher.prototype.webSocketWillSendHandshakeRequest):
+        (WebInspector.NetworkDispatcher.prototype.webSocketHandshakeResponseReceived):
+        (WebInspector.NetworkDispatcher.prototype.webSocketClosed):
+
+2011-03-28  Mikhail Naganov  <mnaganov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        WebInspector: [Chromium] Delete native CPU profiles and heap snapshots on binding disposal.
+        https://bugs.webkit.org/show_bug.cgi?id=57099
+
+        * bindings/v8/ScriptHeapSnapshot.cpp:
+        (WebCore::ScriptHeapSnapshot::~ScriptHeapSnapshot):
+        * bindings/v8/ScriptHeapSnapshot.h:
+        * bindings/v8/ScriptProfile.cpp:
+        (WebCore::ScriptProfile::~ScriptProfile):
+        * bindings/v8/ScriptProfile.h:
+        * inspector/InspectorProfilerAgent.cpp:
+        (WebCore::InspectorProfilerAgent::resetState):
+
+2011-03-24  Pavel Podivilov  <podivilov@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: fix console messages positions in formatted scripts.
+        https://bugs.webkit.org/show_bug.cgi?id=57010
+
+        * inspector/front-end/DebuggerPresentationModel.js:
+        (WebInspector.DebuggerPresentationModel):
+        (WebInspector.DebuggerPresentationModel.prototype.toggleFormatSourceFiles):
+        (WebInspector.DebuggerPresentationModel.prototype.addConsoleMessage.didRequestMapping):
+        (WebInspector.DebuggerPresentationModel.prototype.addConsoleMessage):
+        (WebInspector.DebuggerPresentationModel.prototype.clearConsoleMessages):
+        (WebInspector.DebuggerPresentationModel.prototype._reset):
+        * inspector/front-end/ResourceTreeModel.js:
+        (WebInspector.ResourceTreeModel.prototype.addConsoleMessage):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel):
+        (WebInspector.ScriptsPanel.prototype.addConsoleMessage):
+        (WebInspector.ScriptsPanel.prototype.clearConsoleMessages):
+        (WebInspector.ScriptsPanel.prototype._consoleMessageAdded):
+        (WebInspector.ScriptsPanel.prototype.reset):
+        (WebInspector.ScriptsPanel.prototype._sourceFrameLoaded):
+        * inspector/front-end/SourceFile.js:
+        (WebInspector.SourceFile):
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype.addMessage):
+        (WebInspector.SourceFrame.prototype._addExistingMessagesToSource):
+        (WebInspector.SourceFrame.prototype.addMessageToSource):
+
+2011-03-27  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: refactor ResourceTreeModel to remove poor dependencies.
+        https://bugs.webkit.org/show_bug.cgi?id=57186
+
+        - ResourceTreeModel is now event target (Object)
+        - There is no ResourceTreeModel -> UI dependencies
+        - NetworkManager -> ResourceTreeModel dependencies has been removed
+        - NetworkManager is no longer dealing with the resources tree, it is only responsible for network events
+        - ResourceTreeModel requests tree structure from the backend separately
+        - Cached resources tree payload is now limited to url and type (no headers involved)
+        - Resources tree is being rendered lazily upon request from the panel.
+
+        * inspector/Inspector.json:
+        * inspector/InspectorResourceAgent.cpp:
+        (WebCore::InspectorResourceAgent::resourceContent):
+        (WebCore::InspectorResourceAgent::resourceContentBase64):
+        (WebCore::buildObjectForFrameTree):
+        (WebCore::InspectorResourceAgent::enable):
+        (WebCore::InspectorResourceAgent::getCachedResources):
+        (WebCore::InspectorResourceAgent::getResourceContent):
+        * inspector/InspectorResourceAgent.h:
+        * inspector/InspectorStyleSheet.cpp:
+        (WebCore::InspectorStyleSheet::resourceStyleSheetText):
+        * inspector/front-end/InspectorFrontendHostStub.js:
+        (.WebInspector.InspectorFrontendHostStub.prototype.sendMessageToBackend):
+        (.WebInspector.InspectorFrontendHostStub.prototype.loadSessionSetting):
+        * inspector/front-end/NetworkManager.js:
+        (WebInspector.NetworkManager):
+        (WebInspector.NetworkManager.prototype.frontendReused):
+        (WebInspector.NetworkManager.prototype.requestContent):
+        (WebInspector.NetworkDispatcher):
+        (WebInspector.NetworkDispatcher.prototype.didReceiveResponse):
+        (WebInspector.NetworkDispatcher.prototype.didLoadResourceFromMemoryCache):
+        (WebInspector.NetworkDispatcher.prototype.frameDetachedFromParent):
+        (WebInspector.NetworkDispatcher.prototype.didCommitLoadForFrame):
+        * inspector/front-end/NetworkPanel.js:
+        (WebInspector.NetworkPanel):
+        (WebInspector.NetworkPanel.prototype._updateSummaryBar):
+        (WebInspector.NetworkPanel.prototype._onFrameCommitLoad):
+        * inspector/front-end/ResourceTreeModel.js:
+        (WebInspector.ResourceTreeModel):
+        (WebInspector.ResourceTreeModel.prototype.frontendReused):
+        (WebInspector.ResourceTreeModel.prototype._processCachedResources):
+        (WebInspector.ResourceTreeModel.prototype._addOrUpdateFrame):
+        (WebInspector.ResourceTreeModel.prototype.frames):
+        (WebInspector.ResourceTreeModel.prototype.subframes):
+        (WebInspector.ResourceTreeModel.prototype.resources):
+        (WebInspector.ResourceTreeModel.prototype._onCommitLoad):
+        (WebInspector.ResourceTreeModel.prototype._onFrameDetachedFromParent):
+        (WebInspector.ResourceTreeModel.prototype._onResourceUpdated):
+        (WebInspector.ResourceTreeModel.prototype._addResourceToFrame):
+        (WebInspector.ResourceTreeModel.prototype.resourceForURL):
+        (WebInspector.ResourceTreeModel.prototype._bindResourceURL):
+        (WebInspector.ResourceTreeModel.prototype._clearChildFramesAndResources):
+        (WebInspector.ResourceTreeModel.prototype._clearResources):
+        (WebInspector.ResourceTreeModel.prototype._callForFrameResources):
+        (WebInspector.ResourceTreeModel.prototype._unbindResourceURL):
+        (WebInspector.ResourceTreeModel.prototype._addFramesRecursively):
+        (WebInspector.ResourceTreeModel.prototype._createResource):
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel):
+        (WebInspector.ResourcesPanel.prototype.show):
+        (WebInspector.ResourcesPanel.prototype._populateResourceTree.populateFrame):
+        (WebInspector.ResourcesPanel.prototype._populateResourceTree):
+        (WebInspector.ResourcesPanel.prototype._frameAdded):
+        (WebInspector.ResourcesPanel.prototype._frameDetached):
+        (WebInspector.ResourcesPanel.prototype._resourceAdded):
+        (WebInspector.ResourcesPanel.prototype._frameNavigated):
+        (WebInspector.FrameTreeElement.prototype.setTitles):
+        * inspector/front-end/inspector.js:
+        (WebInspector.frontendReused):
+
+2011-03-27  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        WebKit's behavior for text-align inherit differs from other browsers
+        https://bugs.webkit.org/show_bug.cgi?id=56377
+
+        The bug was caused by WebKit's resolving text-align: start and text-align: end too early.
+        As discussed on the bug, when text-align: start and text-align: end are inherited by descendent nodes,
+        the alignment of the text in those nodes should be determined based on the directionality of the text,
+        not by the directionality of the ancestor node from which text-align property is inherited.
+
+        Fixed the bug by introducing new enum values to ETextAlign: TASTART and TAEND. These two values will
+        align text to the left in a LTR context and to the right in a RTL context respectively.
+
+        * css/CSSPrimitiveValueMappings.h:
+        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue): Added the support for TASTART and TAEND.
+        (WebCore::CSSPrimitiveValue::operator ETextAlign): Ditto.
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty): No longer processes CSSValueStart and CSSValueEnd.
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::localCaretRect): Added the support for TASTART and TAEND.
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::computeInlineDirectionPositionsForLine): Added the support for TASTART and TAEND.
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::localCaretRect): Ditto.
+        * rendering/style/RenderStyle.h: ETextAlign now has 10 values and requires 4 bits.
+        * rendering/style/RenderStyleConstants.h: Added TASTART and TAEND to ETextAlign.
+
+2011-03-28  Pavel Podivilov  <podivilov@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: fix breakpoints positions in formatted scripts.
+        https://bugs.webkit.org/show_bug.cgi?id=56931
+
+        Add async requestMapping method to SourceFile interface as required for populating
+        breakpoints sidebar pane when in "format all scripts" mode.
+
+        * inspector/front-end/DebuggerPresentationModel.js:
+        (WebInspector.DebuggerPresentationModel.prototype.continueToLine):
+        (WebInspector.DebuggerPresentationModel.prototype.setBreakpoint.didRequestSourceMapping):
+        (WebInspector.DebuggerPresentationModel.prototype.setBreakpoint):
+        (WebInspector.DebuggerPresentationModel.prototype._breakpointAdded.didRequestSourceMapping):
+        (WebInspector.DebuggerPresentationModel.prototype._breakpointAdded):
+        (WebInspector.DebuggerPresentationModel.prototype.set selectedCallFrame.didRequestSourceMapping):
+        (WebInspector.DebuggerPresentationModel.prototype.set selectedCallFrame):
+        (WebInspector.PresentationBreakpoint): Breakpoint wrapper for UI.
+        (WebInspector.PresentationBreakpoint.prototype.get sourceFileId):
+        (WebInspector.PresentationBreakpoint.prototype.get lineNumber):
+        (WebInspector.PresentationBreakpoint.prototype.get condition):
+        (WebInspector.PresentationBreakpoint.prototype.get enabled):
+        (WebInspector.PresentationBreakpoint.prototype.get url):
+        (WebInspector.PresentationBreakpoint.prototype.get resolved):
+        (WebInspector.PresentationBreakpoint.prototype.loadSnippet):
+        * inspector/front-end/ScriptFormatter.js:
+        (WebInspector.ScriptFormatter.prototype.formatContent.didFormatChunks):
+        (WebInspector.ScriptFormatter.prototype.formatContent):
+        * inspector/front-end/SourceFile.js:
+        (WebInspector.SourceFile.prototype.requestSourceMapping):
+        (WebInspector.FormattedSourceFile.prototype.requestSourceMapping):
+        (WebInspector.FormattedSourceFile.prototype._didRequestContent):
+        (WebInspector.SourceMapping):
+        (WebInspector.SourceMapping.prototype.scriptLocationToSourceLocation):
+        (WebInspector.SourceMapping.prototype.sourceLocationToScriptLocation):
+        (WebInspector.FormattedSourceMapping):
+        (WebInspector.FormattedSourceMapping.prototype.scriptLocationToSourceLocation):
+        (WebInspector.FormattedSourceMapping.prototype.sourceLocationToScriptLocation):
+        (WebInspector.FormattedSourceMapping.prototype._convertPosition):
+
+2011-03-28  Nancy Piedra  <nancy.piedra@nokia.com>
+
+        Reviewed by Csaba Osztrogonác.
+
+        This patch fixes linking errors on Qt Webkit Windows MinGW builds.
+        This patch sets the BUILDING_WEBKIT & QT_MAKEDLL macros so that
+        QWEBKIT_EXPORT is defined as follows:
+        #define QWEBKIT_EXPORT Q_DECL_EXPORT
+
+        No new tests needed since only changing .pro file.
+
+        * WebCore.pro:
+
+2011-03-28  Andrey Adaikin  <aandrey@google.com>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: source frame should show the error to user when live edit is failed
+        https://bugs.webkit.org/show_bug.cgi?id=57002
+
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.SourceFrameDelegateForScriptsPanel.prototype.editScriptSource):
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype._handleSave.didSaveScriptSource):
+        (WebInspector.SourceFrame.prototype._handleSave):
+        (WebInspector.SourceFrameDelegate.prototype.editScriptSource):
+
+2011-03-26  Mario Sanchez Prada  <msanchez@igalia.com>
+
+        Reviewed by Martin Robinson.
+
+        [GTK] Expose the AtkValue interface for WAI-ARIA sliders
+        https://bugs.webkit.org/show_bug.cgi?id=56655
+
+        Implement AtkValue interface for WAI-ARIA sliders.
+
+        Test: platform/gtk/accessibility/aria-slider-required-attributes.html
+
+        * accessibility/gtk/AXObjectCacheAtk.cpp:
+        (WebCore::AXObjectCache::postPlatformNotification): Emit the
+        'property-change::accessible-value' signal when needed.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (core): New, returns a core object from an AtkValue.
+        (webkitAccessibleValueGetCurrentValue): New, implements AtkValue.
+        (webkitAccessibleValueGetMaximumValue): Ditto.
+        (webkitAccessibleValueGetMinimumValue): Ditto.
+        (webkitAccessibleValueSetCurrentValue): Ditto.
+        (webkitAccessibleValueGetMinimumIncrement): Ditto.
+        (atkValueInterfaceInit): Ditto.
+        (GetAtkInterfaceTypeFromWAIType): Add ATK_TYPE_VALUE.
+        (getInterfaceMaskFromObject): Set the WAI_VALUE bit for sliders.
+
+2011-03-28  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Assigning location.path to something that doesn't start with / mangles the authority
+        https://bugs.webkit.org/show_bug.cgi?id=57209
+        <rdar://problem/9195132>
+        
+        Tests: http/tests/uri/assign-path-with-leading-slash.html
+               http/tests/uri/assign-path-without-leading-slash.html
+
+        * platform/KURL.cpp:
+        (WebCore::KURL::setPath): If the new path does not have a leading slash, add one.
+
+2011-03-28  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Extract functions to update logical width from computeInlineDirectionPositionsForLine
+        https://bugs.webkit.org/show_bug.cgi?id=57213
+
+        Extracted updateLogicalWidthForLeftAlignedBlock, updateLogicalWidthForRightAlignedBlock,
+        and updateLogicalWidthForCenterAlignedBlock from computeInlineDirectionPositionsForLine.
+
+        They are used to update logical widths, logical left, and total logical width for left,
+        right, and center aligned blocks.
+
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::updateLogicalWidthForLeftAlignedBlock):
+        (WebCore::updateLogicalWidthForRightAlignedBlock):
+        (WebCore::updateLogicalWidthForCenterAlignedBlock):
+        (WebCore::RenderBlock::computeInlineDirectionPositionsForLine):
+
+2011-03-28  Evan Martin  <evan@chromium.org>
+
+        Reviewed by Ryosuke Niwa.
+
+        Refactor duplicate code in HTMLTextElement
+        https://bugs.webkit.org/show_bug.cgi?id=57215
+
+        * html/HTMLTitleElement.cpp:
+        (WebCore::HTMLTitleElement::childrenChanged):
+        This method did an equivalent loop to the text() method on
+        the same object.
+
+2011-03-27  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Don't call WebSocket::didClose() more than once.
+        https://bugs.webkit.org/show_bug.cgi?id=57081
+
+        If WebSocket close() is called, and connection is established, then
+        it will call didClose() that resets m_channel to 0.
+        After that, when connection is closed, WebSocketChannel will call
+        didClose for the WebSocket instance.
+
+        Call WebSocketChannel::disconnect() before m_channel = 0 to make sure
+        WebSocketChannel suppress the second didClose().
+
+        Test: http/tests/websocket/tests/close-unref-websocket.html
+
+        * websockets/WebSocket.cpp:
+        (WebCore::WebSocket::didClose):
+
+2011-03-27  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Fix script-src redirect handling
+        https://bugs.webkit.org/show_bug.cgi?id=57196
+
+        Resource-loading requirements in CSP apply to each hop in the redirect
+        chain.  To make that work properly, we need to move enforcement into
+        the loader.  Fortunately, we already have a choke-point in the loader
+        for enforcing this kind of policy.
+
+        * dom/ScriptElement.cpp:
+        (WebCore::ScriptElement::requestScript):
+        * html/parser/HTMLDocumentParser.cpp:
+        * html/parser/HTMLDocumentParser.h:
+        * html/parser/HTMLScriptRunnerHost.h:
+        * loader/cache/CachedResourceLoader.cpp:
+        (WebCore::CachedResourceLoader::canRequest):
+        * page/ContentSecurityPolicy.cpp:
+        (WebCore::ContentSecurityPolicy::allowScriptFromSource):
+        * page/ContentSecurityPolicy.h:
+
+2011-03-27  Jer Noble  <jer.noble@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Full Screen: disable keyboard access by default
+        https://bugs.webkit.org/show_bug.cgi?id=56684
+
+        Pass whether keyboard access was requested up to ChromeClient when asking
+        if fullscreen mode is supported.
+
+        * dom/Document.cpp:
+        (WebCore::Document::webkitRequestFullScreenForElement):
+        * page/ChromeClient.h:
+        (WebCore::ChromeClient::supportsFullscreenForElement):
+
+2011-03-27  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Andreas Kling.
+
+        [CMake] Generate WebKitVersion.h
+        https://bugs.webkit.org/show_bug.cgi?id=57128
+
+        This file will be used for the user agent string by the CMake based ports.
+
+        * CMakeLists.txt:
+
+2011-03-27  Ben Taylor  <bentaylor.solx86@gmail.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=57170  Fix last elements
+        in an enum to remove a trailing comma. Sun Studio 12 CC errors out.
+
+        Compile fix only, no actual code change.
+
+        * dom/ExceptionCode.h:
+        * editing/EditorInsertAction.h:
+        * loader/FrameLoaderTypes.h:
+        * platform/PlatformKeyboardEvent.h:
+        * platform/ScrollTypes.h:
+        * platform/graphics/BitmapImage.h:
+        * platform/image-decoders/ImageDecoder.h:
+        * platform/network/ProtectionSpace.h:
+        * platform/network/ResourceHandleClient.h:
+        * platform/network/ResourceRequestBase.h:
+        * platform/text/TextCodec.h:
+
+2011-03-27  Rob Buis  <rwlbuis@gmail.com>
+
+        Reviewed by Nikolas Zimmermann.
+
+        Text on path positioning at zero startOffset
+        https://bugs.webkit.org/show_bug.cgi?id=56245
+
+        Since for length 0 no previous point is set, choose epsilon
+        length to get normal at starting point of the path.
+
+        Test: svg/text/text-path-middle-align.svg
+
+        * platform/graphics/Path.cpp:
+        (WebCore::Path::normalAngleAtLength):
+
+2011-03-27  Ben Taylor  <bentaylor.solx86@gmail.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=57151, patch derived from set
+        created by Thiago Macieria in bug https://bugs.webkit.org/show_bug.cgi?id=24932
+
+        Fix compile issue on Solaris 10/Sun Studio 12 regarding ambiguity on ?: functions
+
+        * bindings/js/JSJavaScriptCallFrameCustom.cpp:
+        (WebCore::JSJavaScriptCallFrame::thisObject):
+
+2011-03-26  Jer Noble  <jer.noble@apple.com>
+
+        Unreviewed build fix.
+
+        Fix a bug which was causing the "skip back" button to be missing, causing 
+        the media layout tests to fail.
+
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderThemeMac::shouldRenderMediaControlPart):
+
+2011-03-26  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        <rdar://problem/9180716> REGRESSION (r80582): Angle bracket rendered upright in vertical mode
+        https://bugs.webkit.org/show_bug.cgi?id=57169
+
+        Test: fast/blockflow/fallback-orientation.html
+
+        * platform/graphics/FontFastPath.cpp:
+        (WebCore::Font::glyphDataForCharacter): If the font has vertical glyphs, use it, rather
+        than continuing down the fallback list.
+
+2011-03-26  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Follow-up fix for crash with giant inline stylesheets - actually don't crash, and add test
+        https://bugs.webkit.org/show_bug.cgi?id=56150
+
+        Test: fast/css/giant-stylesheet-crash.html
+
+        * dom/StyleElement.cpp:
+        (WebCore::StyleElement::process):
+
+2011-03-22  Jer Noble  <jer.noble@apple.com>
+
+        Reviewed by Eric Carlson.
+
+        Media controls must use full screen style when in new full screen mode.
+        https://bugs.webkit.org/show_bug.cgi?id=56851
+
+        Add new full screen styles for the full screen media elements.
+
+        * DerivedSources.make: Add fullScreenQuickTime.css.
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
+        * css/CSSStyleSelector.cpp: Removed loadFullScreenRulesIfNeeded().
+        (WebCore::CSSStyleSelector::CSSStyleSelector): Ditto.
+        (WebCore::CSSStyleSelector::styleForElement): Load full screen rules 
+            if needed.
+        * css/fullscreenQuickTime.css: Added.
+        * css/mediaControls.css:
+        * html/shadow/MediaControls.cpp:
+        (WebCore::isFullScreen): Added.
+        (WebCore::MediaControls::create): Add new full screen volume controls.
+        (WebCore::MediaControls::updateStyle): Ditto.
+        (WebCore::MediaControls::update): Ditto.
+        (WebCore::MediaControls::updateVolumeSliderContainer): Ditto.
+        (WebCore::MediaControls::forwardEvent): Ditto.
+        * rendering/MediaControlElements.cpp:
+        (WebCore::MediaControlFullscreenVolumeSliderElement::MediaControlFullscreenVolumeSliderElement): Added.
+        (WebCore::MediaControlFullscreenVolumeSliderElement::create): Added.
+        (WebCore::MediaControlFullscreenVolumeSliderElement::shadowPseudoId): Added.
+        (WebCore::MediaControlFullscreenVolumeMinButtonElement::MediaControlFullscreenVolumeMinButtonElement): Addet
+        (WebCore::MediaControlFullscreenVolumeMinButtonElement::create): Added.
+        (WebCore::MediaControlFullscreenVolumeMinButtonElement::defaultEventHandler): Added.
+        (WebCore::MediaControlFullscreenVolumeMinButtonElement::shadowPseudoId): Added.
+        (WebCore::MediaControlFullscreenVolumeMaxButtonElement::MediaControlFullscreenVolumeMaxButtonElement): Added.
+        (WebCore::MediaControlFullscreenVolumeMaxButtonElement::create): Added.
+        (WebCore::MediaControlFullscreenVolumeMaxButtonElement::defaultEventHandler): Added.
+        (WebCore::MediaControlFullscreenVolumeMaxButtonElement::shadowPseudoId): Added.
+        * rendering/MediaControlElements.h:
+            Added m_overridePosition.
+        (WebCore::MediaControlVolumeSliderContainerElement::setOverridesPosition): Added.
+        * rendering/MediaControlElements.h:
+        (WebCore::MediaControlVolumeSliderContainerElement::overridesPosition): Added.
+        * rendering/RenderTheme.h:
+        (WebCore::RenderTheme::extraFullScreenStyleSheet): Added.
+        * rendering/RenderThemeMac.h:
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderThemeMac::extraFullScreenStyleSheet): Added.
+        (WebCore::RenderThemeMac::shouldRenderMediaControlPart): Render seek forward and backward 
+            buttons.
+
+2011-03-26  Jer Noble  <jer.noble@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        RenderMedia should obey the view's flattening bit.
+        https://bugs.webkit.org/show_bug.cgi?id=57156
+
+        Paint the current frame in software when the associated FrameView
+        has its flattening bit set.
+
+        * rendering/RenderVideo.cpp:
+        (WebCore::RenderVideo::paintReplaced):
+
+2011-03-26  Patrick Gansterer  <paroga@webkit.org>
+
+        Unreviewed build fix for !ENABLE(DOM_STORAGE).
+
+        * storage/StorageTracker.cpp:
+            Added #if ENABLE(DOM_STORAGE) like in the other storage files.
+
+2011-03-26  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Benjamin Poulain.
+
+        [Qt] Remove GraphicsLayerTextureMapper::nativeLayer
+        https://bugs.webkit.org/show_bug.cgi?id=57141
+
+        GraphicsLayer::nativeLayer was removed in r73380.
+
+        * platform/graphics/texmap/GraphicsLayerTextureMapper.cpp:
+        * platform/graphics/texmap/GraphicsLayerTextureMapper.h:
+
+2011-03-26  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Teach Content Security Policy how to parse source-list
+        https://bugs.webkit.org/show_bug.cgi?id=54799
+
+        This patch is larger than I would like, but I wasn't sure how to make
+        it any smaller while still being reasonably testable.  I've left out
+        some features (such as host wildcarding and 'self') so I can add them
+        in later patches with tests.
+
+        Test: http/tests/security/contentSecurityPolicy/source-list-parsing.html
+
+        * bindings/ScriptControllerBase.cpp:
+        * dom/ScriptElement.cpp:
+        * html/parser/HTMLDocumentParser.cpp:
+        * loader/FrameLoader.cpp:
+            - Add include explicitly now that we're not spamming the include
+              everywhere.
+        * dom/Document.cpp:
+        (WebCore::Document::initSecurityContext):
+            - We need to pass the SecurityOrigin object to
+              ContentSecurityPolicy so that it can resolve implicit parts of
+              source patterns, such as the scheme.
+        * dom/Document.h:
+            - Forward declare ContentSecurityPolicy rather than including the
+              header.  Technically this could be a separate change, but I was
+              getting annoyed at the world re-builds.
+        * page/ContentSecurityPolicy.cpp:
+        (WebCore::skipExactly):
+        (WebCore::skipUtil):
+        (WebCore::skipWhile):
+            - Clean up these parser helper functions.  We might consider moving
+              them to a more general location.  They're very helpful for
+              writing secure HTTP header parsers.
+        (WebCore::CSPSource::CSPSource):
+            - New class to represent one source in a source-list.
+        (WebCore::CSPSource::matches):
+        (WebCore::CSPSource::schemeMatches):
+        (WebCore::CSPSource::hostMatches):
+        (WebCore::CSPSource::portMatches):
+        (WebCore::CSPSource::isSchemeOnly):
+            - Currently we represent scheme-only sources using with an empty
+              m_host.  Another approach I considered was using another bool,
+              but that seemed slighly messier.
+        (WebCore::CSPSourceList::CSPSourceList):
+            - CSPSourceList doesn't need to ref SecurityOrigin because
+              CSPSourceList is owned by ContentSecurityPolicy, which holds a
+              ref.
+        (WebCore::CSPSourceList::parse):
+        (WebCore::CSPSourceList::matches):
+        (WebCore::CSPSourceList::parseSource):
+        (WebCore::CSPSourceList::parseScheme):
+        (WebCore::CSPSourceList::parseHost):
+        (WebCore::CSPSourceList::parsePort):
+            - A basic "segment and recurse" parser.  This parser causes us to
+              take more branches than we need, but I don't think we need to
+              squeeze every last ouch of performance out of this parser.  This
+              approach is more simple than some of the other approaches I
+              tried.
+        (WebCore::CSPSourceList::addSourceSelf):
+        (WebCore::CSPDirective::CSPDirective):
+        (WebCore::CSPDirective::allows):
+        (WebCore::ContentSecurityPolicy::ContentSecurityPolicy):
+        (WebCore::ContentSecurityPolicy::parse):
+        (WebCore::ContentSecurityPolicy::parseDirective):
+        (WebCore::ContentSecurityPolicy::addDirective):
+            - I couldn't resist re-writing this parser to use the helper
+              functions and to match the style of the source-list parser.
+        * page/ContentSecurityPolicy.h:
+        (WebCore::ContentSecurityPolicy::create):
+            - Accept a SecurityOrigin context object.
+
+2011-03-26  Patrick Gansterer  <paroga@webkit.org>
+
+        Unreviewed EFL and WinCE build fix for r81977.
+
+        * platform/graphics/FontPlatformData.h:
+
+2011-03-26  Patrick Gansterer  <paroga@webkit.org>
+
+        Unreviewed WinCE build fix for r82000.
+
+        * platform/wince/FileSystemWinCE.cpp:
+        (WebCore::openFile): Added missing function.
+
+2011-03-25  Kevin Ollivier  <kevino@theolliviers.com>
+
+        [wx] Build fix, don't use the new FPD implementation yet, until we can merge ours with it.
+
+        * platform/graphics/FontPlatformData.h:
+
+2011-03-25  Jer Noble  <jer.noble@apple.com>
+
+        Reviewed by Eric Carlson.
+
+        MediaPlayerPrivateQuickTimeVisualContext should use the Application Cache during load.
+        https://bugs.webkit.org/show_bug.cgi?id=57047
+
+        No new tests.
+        
+        When loading a URL, checkk osee if the Appplication Cache has a version of that URL
+        stored; if so, use the local path to that cached media instead of the remote URL.
+
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeVisualContext.cpp:
+        (WebCore::MediaPlayerPrivateQuickTimeVisualContext::loadInternal):
+        * platform/graphics/win/QTMovie.cpp:
+        (QTMovie::loadPath):
+        * platform/graphics/win/QTMovie.h:
+
+2011-03-25  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/9134330> Missing expansion before ideograph at the beginning or end of a text run
+        https://bugs.webkit.org/show_bug.cgi?id=57106
+
+        Test: fast/text/justify-ideograph-leading-expansion.html
+
+        * platform/graphics/TextRun.h:
+        Replaced TrailingExpansionBehavior enum with ExpansionBehavior flags.
+        (WebCore::TextRun::TextRun): Constructors now take an expansionBehavior parameter.
+        (WebCore::TextRun::allowsLeadingExpansion): Added this accessor.
+        (WebCore::TextRun::allowsTrailingExpansion): Changed to use the m_expansionBehavior member.
+        * platform/graphics/WidthIterator.cpp:
+        (WebCore::WidthIterator::WidthIterator): Initialize m_isAfterExpansion from the TextRun, allowing
+        leading expansion when appropriate.
+        (WebCore::WidthIterator::advance): Moved the last-glyph-in-run check to only apply to expansion
+        after the glyph, not expansion before the glyph, since that is not trailing expansion. Added code
+        to handle expansion before the first glyph.
+        * platform/graphics/mac/ComplexTextController.cpp:
+        (WebCore::ComplexTextController::ComplexTextController): Initialize m_afterExpansion from the
+        TextRun, allowing leading expansion when appropriate. Set m_runWidthSoFar to the leading expansion.
+        (WebCore::ComplexTextController::offsetForPosition): Account for leading expansion.
+        (WebCore::ComplexTextController::adjustGlyphsAndAdvances): Similar to WidthIterator::advance()
+        * platform/graphics/mac/ComplexTextController.h: Added m_leadingExpansion member variable.
+        * rendering/InlineBox.h:
+        (WebCore::InlineBox::InlineBox): Renamed m_hasSelectedChildren to m_hasSelectedChildrenOrCanHaveLeadingExpansion
+        to reflect the use of this bit by InlineTextBox.
+        * rendering/InlineTextBox.cpp:
+        (WebCore::InlineTextBox::selectionRect): Replaced calls to trailingExpansionBehavior() with expansionBehavior().
+        (WebCore::InlineTextBox::paint): Ditto.
+        (WebCore::InlineTextBox::paintSelection): Ditto.
+        (WebCore::InlineTextBox::paintCompositionBackground): Ditto.
+        (WebCore::InlineTextBox::paintSpellingOrGrammarMarker): Ditto.
+        (WebCore::InlineTextBox::paintTextMatchMarker): Ditto.
+        (WebCore::InlineTextBox::computeRectForReplacementMarker): Ditto.
+        (WebCore::InlineTextBox::offsetForPosition): Ditto.
+        (WebCore::InlineTextBox::positionForOffset): Ditto.
+        * rendering/InlineTextBox.h:
+        (WebCore::InlineTextBox::canHaveLeadingExpansion): Added this accessor.
+        (WebCore::InlineTextBox::setCanHaveLeadingExpansion): Ditto.
+        (WebCore::InlineTextBox::expansionBehavior): Replaced trailingExpansionBehavior() with this function,
+        which also considers canHaveLeadingExpansion().
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::computeInlineDirectionPositionsForLine): Call setCanHaveLeadingExpansion() on
+        text boxes that can have leading expansion. Avoid negative expansion.
+        * rendering/RootInlineBox.cpp:
+        * rendering/RootInlineBox.h:
+        (WebCore::RootInlineBox::hasSelectedChildren): Updated for renaming of the flag.
+        (WebCore::RootInlineBox::setHasSelectedChildren): Ditto.
+
+2011-03-23  Jer Noble  <jer.noble@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        MediaPlayerPrivateAVFoundation should use the Application Cache during load.
+        https://bugs.webkit.org/show_bug.cgi?id=56997
+
+        No new tests.
+
+        When loading a URL, check to see if the Application Cache has a version of that URL
+        stored; if so, use the local path to that cached media instead of the remote URL.
+
+        * platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.cpp:
+        (WebCore::MediaPlayerPrivateAVFoundation::prepareToPlay): Check to see if the media should be loaded
+            from the application cache.
+        * platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.h:
+        * platform/graphics/avfoundation/MediaPlayerPrivateAVFoundationObjC.h:
+        * platform/graphics/avfoundation/MediaPlayerPrivateAVFoundationObjC.mm:
+        (WebCore::MediaPlayerPrivateAVFoundationObjC::createAVPlayerForURL):
+        (WebCore::MediaPlayerPrivateAVFoundationObjC::createAVPlayerForCacheResource): Added.
+        (WebCore::MediaPlayerPrivateAVFoundationObjC::createAVPlayer): Split out from createAVPlayerForURL.
+
+2011-03-25  Ben Taylor  <bentaylor.solx86@gmail.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=57122. Solaris 10/SunStudio 12 expect
+        both sides of a ?: operation to have the same types.  Extracted from original
+        https://bugs.webkit.org/show_bug.cgi?id=24932, patch 13 of 17, and originally
+        created by Thiago Macieira.
+
+        fixes a compile issue on Solaris 10/SunStudio 12
+
+        * loader/DocumentLoader.h:
+        (WebCore::DocumentLoader::serverRedirectSourceForHistory):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::load):
+        (WebCore::FrameLoader::loadWithNavigationAction):
+
+2011-02-03  Jer Noble  <jer.noble@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        MediaPlayerPrivateQTKit should use the Application Cache during load.        
+        https://bugs.webkit.org/show_bug.cgi?id=53818
+
+        No new tests.
+
+        When loading a URL, check to see if the Application Cache has a version of that URL
+        stored; if so, use that data instead of the remote URL.
+
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.h:
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivateQTKit::commonMovieAttributes):
+        (WebCore::MediaPlayerPrivateQTKit::createQTMovie):
+        (WebCore::MediaPlayerPrivateQTKit::loadInternal):
+
+2011-03-25  James Robinson  <jamesr@chromium.org>
+
+        Reviewed by Kenneth Russell.
+
+        [chromium] Move draw implementations to CCLayerImpl for everything except content layers
+        https://bugs.webkit.org/show_bug.cgi?id=56793
+
+        Moves the implementation of the layer's draw() function from LayerChromium subclasses to CCLayerImpl subclasses for
+        all layer types except content layers.  This gets us closer to decoupling the composite step itself from updating the layers.
+
+        The biggest change in this patch is adding a set of CCLayerImpl subclasses to implement the different drawing routines
+        and moving the code from each XXXLayerChromium to CCXXXLayerImpl.  In order to render from the CCLayerImpl side all state
+        needed at draw time also has to be synchronized, which is performed in pushPropertiesTo().
+
+        On the LayerRendererChromium side there are a few changes.  I've split the updateContents calls on LayerChromiums into two operations
+        tentatively named 'paintContentsIfNeeded' and 'updateCompositorResources'.  paintContents() is used for any code that calls into WebKit in order to generate
+        new pixel data.  It's expected that this call may take a long period of time and may involve "odd" side effects.  updateCompositorResources() is used for
+        code that needs to update the compositor's texture data or other state.  It is not expected that this callback will take long (since it's just inserting
+        commands into the GL command stream, ideally) and this call is expected to have access to the compositor's context, unlike paintContents().
+
+        The updateAndDrawLayers cycle now looks like this:
+        1.) update the root content layer
+        2.) update the root layer scrollbars
+        3.) for each LayerChromium in tree order:
+          a.) ensure a CCLayerImpl of the correct type exists for this layer
+          b.) push all draw time properties from the LayerChromium to the CCLayerImpl
+          c.) construct the appropriate draw transforms, render surfaces and render surface z-order sublayer lists
+        4.) for each LayerChromium in tree order, paint the layer's contents
+        5.) for each LayerChromium in tree order, update the associate compositor resources (textures, etc)
+        6.) draw the root layer and its scrollbars
+        7.) for each CCLayerImpl in render surface order, draw it
+
+        Step 3 should really happen after step 5, but right now painting a content layer requires knowledge of the render surface properties and draw transforms
+        in order to paint.  We also currently push layer properties from LayerChromium->CCLayerImpls twice now - once at 3.b and once after 5 so we can pick
+        up any texture updates.  This will also get fixed when the paint dependency on render surfaces is resolved.
+
+        I haven't modified the root layer or content layers in order to minimize conflicts with the other pending work in that area.
+
+        Tests: compositing/
+
+        * WebCore.gypi:
+        * platform/graphics/chromium/Canvas2DLayerChromium.cpp:
+        (WebCore::Canvas2DLayerChromium::updateCompositorResources):
+        * platform/graphics/chromium/Canvas2DLayerChromium.h:
+        * platform/graphics/chromium/CanvasLayerChromium.cpp:
+        (WebCore::CanvasLayerChromium::createCCLayerImpl):
+        (WebCore::CanvasLayerChromium::pushPropertiesTo):
+        * platform/graphics/chromium/CanvasLayerChromium.h:
+        * platform/graphics/chromium/ContentLayerChromium.cpp:
+        (WebCore::ContentLayerChromium::requiresClippedUpdateRect):
+        (WebCore::ContentLayerChromium::paintContentsIfDirty):
+        (WebCore::ContentLayerChromium::updateCompositorResources):
+        (WebCore::ContentLayerChromium::bindContentsTexture):
+        * platform/graphics/chromium/ContentLayerChromium.h:
+        * platform/graphics/chromium/ImageLayerChromium.cpp:
+        (WebCore::ImageLayerChromium::paintContentsIfDirty):
+        * platform/graphics/chromium/ImageLayerChromium.h:
+        * platform/graphics/chromium/LayerChromium.cpp:
+        (WebCore::LayerChromium::LayerChromium):
+        (WebCore::LayerChromium::cleanupResources):
+        (WebCore::LayerChromium::setLayerRenderer):
+        (WebCore::LayerChromium::setName):
+        (WebCore::LayerChromium::pushPropertiesTo):
+        (WebCore::LayerChromium::dumpLayer):
+        (WebCore::LayerChromium::createCCLayerImpl):
+        (WebCore::LayerChromium::createCCLayerImplIfNeeded):
+        (WebCore::LayerChromium::ccLayerImpl):
+        (WebCore::LayerChromium::layerRenderer):
+        * platform/graphics/chromium/LayerChromium.h:
+        (WebCore::LayerChromium::paintContentsIfDirty):
+        (WebCore::LayerChromium::updateCompositorResources):
+        * platform/graphics/chromium/LayerRendererChromium.cpp:
+        (WebCore::LayerRendererChromium::updateLayers):
+        (WebCore::LayerRendererChromium::updatePropertiesAndRenderSurfaces):
+        (WebCore::LayerRendererChromium::paintContentsRecursive):
+        (WebCore::LayerRendererChromium::updateCompositorResourcesRecursive):
+        (WebCore::LayerRendererChromium::drawLayer):
+        (WebCore::LayerRendererChromium::initializeSharedObjects):
+        * platform/graphics/chromium/LayerRendererChromium.h:
+        (WebCore::LayerRendererChromium::canvasLayerProgram):
+        (WebCore::LayerRendererChromium::pluginLayerProgram):
+        (WebCore::LayerRendererChromium::videoLayerRGBAProgram):
+        (WebCore::LayerRendererChromium::videoLayerYUVProgram):
+        * platform/graphics/chromium/PluginLayerChromium.cpp:
+        (WebCore::PluginLayerChromium::createCCLayerImpl):
+        (WebCore::PluginLayerChromium::setTextureId):
+        (WebCore::PluginLayerChromium::pushPropertiesTo):
+        * platform/graphics/chromium/PluginLayerChromium.h:
+        (WebCore::PluginLayerChromium::textureId):
+        * platform/graphics/chromium/VideoLayerChromium.cpp:
+        (WebCore::VideoLayerChromium::createCCLayerImpl):
+        (WebCore::VideoLayerChromium::updateCompositorResources):
+        (WebCore::VideoLayerChromium::pushPropertiesTo):
+        * platform/graphics/chromium/VideoLayerChromium.h:
+        * platform/graphics/chromium/WebGLLayerChromium.cpp:
+        (WebCore::WebGLLayerChromium::updateCompositorResources):
+        * platform/graphics/chromium/WebGLLayerChromium.h:
+        * platform/graphics/chromium/cc/CCCanvasLayerImpl.cpp: Copied from Source/WebCore/platform/graphics/chromium/PluginLayerChromium.cpp.
+        (WebCore::CCCanvasLayerImpl::CCCanvasLayerImpl):
+        (WebCore::CCCanvasLayerImpl::~CCCanvasLayerImpl):
+        (WebCore::CCCanvasLayerImpl::draw):
+        (WebCore::CCCanvasLayerImpl::dumpLayerProperties):
+        * platform/graphics/chromium/cc/CCCanvasLayerImpl.h: Copied from Source/WebCore/platform/graphics/chromium/PluginLayerChromium.h.
+        (WebCore::CCCanvasLayerImpl::create):
+        (WebCore::CCCanvasLayerImpl::setTextureId):
+        (WebCore::CCCanvasLayerImpl::setPremultipliedAlpha):
+        * platform/graphics/chromium/cc/CCLayerImpl.cpp:
+        (WebCore::CCLayerImpl::descendantsDrawsContent):
+        (WebCore::CCLayerImpl::updateCompositorResources):
+        (WebCore::CCLayerImpl::writeIndent):
+        * platform/graphics/chromium/cc/CCLayerImpl.h:
+        (WebCore::CCLayerImpl::setAnchorPoint):
+        (WebCore::CCLayerImpl::setAnchorPointZ):
+        (WebCore::CCLayerImpl::setMasksToBounds):
+        (WebCore::CCLayerImpl::setOpacity):
+        (WebCore::CCLayerImpl::setPosition):
+        (WebCore::CCLayerImpl::setPreserves3D):
+        (WebCore::CCLayerImpl::setSublayerTransform):
+        (WebCore::CCLayerImpl::setTransform):
+        * platform/graphics/chromium/cc/CCPluginLayerImpl.cpp: Copied from Source/WebCore/platform/graphics/chromium/PluginLayerChromium.cpp.
+        (WebCore::CCPluginLayerImpl::CCPluginLayerImpl):
+        (WebCore::CCPluginLayerImpl::~CCPluginLayerImpl):
+        (WebCore::CCPluginLayerImpl::draw):
+        (WebCore::CCPluginLayerImpl::dumpLayerProperties):
+        * platform/graphics/chromium/cc/CCPluginLayerImpl.h: Copied from Source/WebCore/platform/graphics/chromium/PluginLayerChromium.h.
+        (WebCore::CCPluginLayerImpl::create):
+        (WebCore::CCPluginLayerImpl::setTextureId):
+        * platform/graphics/chromium/cc/CCVideoLayerImpl.cpp: Added.
+        (WebCore::CCVideoLayerImpl::CCVideoLayerImpl):
+        (WebCore::CCVideoLayerImpl::~CCVideoLayerImpl):
+        (WebCore::CCVideoLayerImpl::setTexture):
+        (WebCore::CCVideoLayerImpl::draw):
+        (WebCore::CCVideoLayerImpl::drawYUV):
+        (WebCore::CCVideoLayerImpl::drawRGBA):
+        (WebCore::CCVideoLayerImpl::dumpLayerProperties):
+        * platform/graphics/chromium/cc/CCVideoLayerImpl.h: Copied from Source/WebCore/platform/graphics/chromium/PluginLayerChromium.h.
+        (WebCore::CCVideoLayerImpl::create):
+        (WebCore::CCVideoLayerImpl::setSkipsDraw):
+        (WebCore::CCVideoLayerImpl::setFrameFormat):
+
+2011-03-25  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Allow defineOwnProperty to work on DOMObjects
+        https://bugs.webkit.org/show_bug.cgi?id=57129
+
+        As other engines are allowing defineOwnProperty to be applied
+        to host objects there's no reason for us to retain this
+        restriction.
+
+        * bindings/js/JSDOMWrapper.cpp:
+        * bindings/js/JSDOMWrapper.h:
+
+2011-03-25  Andy Estes  <aestes@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        REGRESSION (r70748): latest nightly builds kills AC_QuickTime.js
+        https://bugs.webkit.org/show_bug.cgi?id=49016
+
+        AC_QuickTime.js uses the common <object>/<embed> paradigm to embed the 
+        QuickTime plug-in in web pages. r70748 removed our mapping of classids 
+        to MIME types, which causes WebKit to fall back from the object to the 
+        embed tag when QuickTime is embedded by this script. The script emits 
+        the following embed tag to embed a QuickTime movie with a poster frame: 
+
+        <embed src="poster-frame.png" target="quicktimeplayer" href="movie.mov"> 
+
+        The expectation is that a QuickTime plug-in is instantiated to display the 
+        poster frame, since QuickTime registers for many common image MIME 
+        types. This is how Gecko behaves for embed. However, WebKit prefers to 
+        use its native image rendering for image embeds, in which case no movie 
+        is played when the poster frame is clicked. 
+
+        Fix this by changing embed to check for a plug-in that can handle the 
+        image type before rendering the image natively. This matches Gecko. 
+
+        Test: plugins/embed-prefers-plugins-for-images.html
+
+        * html/HTMLEmbedElement.cpp:
+        (WebCore::HTMLEmbedElement::HTMLEmbedElement):
+        * html/HTMLObjectElement.cpp:
+        (WebCore::HTMLObjectElement::HTMLObjectElement):
+        (WebCore::HTMLObjectElement::parametersForPlugin):
+        * html/HTMLPlugInImageElement.cpp:
+        (WebCore::HTMLPlugInImageElement::HTMLPlugInImageElement):
+        (WebCore::HTMLPlugInImageElement::isImageType):
+        (WebCore::HTMLPlugInImageElement::wouldLoadAsNetscapePlugin):
+        * html/HTMLPlugInImageElement.h:
+        (WebCore::HTMLPlugInImageElement::shouldPreferPlugInsForImages):
+        * loader/EmptyClients.h:
+        (WebCore::EmptyFrameLoaderClient::objectContentType):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::defaultObjectContentType):
+        * loader/FrameLoader.h:
+        * loader/FrameLoaderClient.h:
+        * loader/SubframeLoader.cpp:
+        (WebCore::SubframeLoader::resourceWillUsePlugin):
+        (WebCore::SubframeLoader::requestPlugin):
+        (WebCore::SubframeLoader::requestObject):
+        (WebCore::SubframeLoader::shouldUsePlugin):
+        * loader/SubframeLoader.h:
+
+2011-03-23  Jer Noble  <jer.noble@apple.com>
+
+        Reviewed by Eric Carlson.
+
+        Application Cache should save audio/ and video/ mime types as flat files
+        https://bugs.webkit.org/show_bug.cgi?id=53784
+        <rdar://problem/8932473>
+
+        No new tests, as this behavior is not possible to test without changes to the MediaPlayer engines.
+
+        Store certain mime types as flat files alongside the Application Cache database.
+        This requires plumbing the saved file path from ApplicationCacheStorage through
+        to ApplicationCacheResource.
+
+        (WebCore::ApplicationCacheStorage::openDatabase): Modify the CacheResourceData schema and
+            add a new DeletedCacheResources table, add a new CacheResourceDataDeleted trigger.
+        (WebCore::ApplicationCacheStorage::store): Add the new path data when adding new rows in 
+            CacheResourceData, and store media resources as flat files.
+        (WebCore::ApplicationCacheStorage::loadCache): Pull the "path" column from CacheResourceData
+            when loading cache items.
+        (WebCore::ApplicationCacheStorage::remove): Call checkForDeletedResources.
+        (WebCore::ApplicationCacheStorage::empty): Ditto.
+        (WebCore::ApplicationCacheStorage::storeCopyOfCache): Ditto.
+        (WebCore::ApplicationCacheStorage::deleteCacheGroup): Ditto.
+        (WebCore::ApplicationCacheStorage::checkForDeletedResources): Walk through DeletedCacheResourceData
+            looking for entries with non-empty "path" columns; if found, delete.
+        (WebCore::ApplicationCacheStorage::flatFileAreaSize): Walk through CacheResourceData rows
+            and sum the file size of those rows with flat file storage.
+        (WebCore::ApplicationCacheStorage::verifySchemaVersion): Call deleteTables() instead of 
+            clearAllTables() directly.
+        (WebCore::ApplicationCacheStorage::deleteTables): Call empty() before deleting the tables,
+            so that flat files get deleted.
+        (WebCore::ApplicationCacheStorage::shouldStoreResourceAsFlatFile): Added.
+        (WebCore::ApplicationCacheStorage::writeDataToUniqueFileInDirectory): Added.
+        * loader/appcache/ApplicationCacheStorage.h:
+        * platform/win/FileSystemWin.cpp:
+        (WebCore::openFile): Implement openFile on Windows.
+
+2011-03-24  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=56909
+        
+        Add a simplified normal flow layout path optimization for overflow recomputation
+        and for positioned objects inside relative positioned containers.
+
+        Currently there is an optimized code path for positioned objects, but as soon as
+        we encounter a normal flow object in the containing block chain, we lose the
+        optimization.
+
+        This patch adds a new type of style difference called SimplifiedLayout that is
+        returned when only overflow needs to be recomputed. Whenever a transform changes,
+        this is the hint returned now instead of a full layout.
+        
+        In addition, when positioned objects need layout and start marking up the
+        containing block chain, we now propagate the fact that the layout is simplified
+        all the way up to the root, even when we encounter normal flow containing
+        blocks.
+        
+        The layoutOnlyPositionedObjects function has been renamed to simplifiedLayout()
+        and is now used for all of these cases (in addition to what it handled before).
+        
+        The simplified layout optimization (even in ToT) did not work correctly when
+        static distances needed to be recomputed. In order to make static distance
+        computations work with simplified layout, positioned objects now always compute
+        their static offsets, even if they explicitly specify left/top.  That way normal
+        flow layout never has to re-run when the positioned object moves.  This makes
+        movement of a positioned object along a single non-auto axis much faster when the
+        other axis is auto. Because this code kicked in more often for absolutely positioned
+        objects whose original display was inline, I went ahead and fixed the trailing space
+        issue with those objects.  This causes a bunch of layout tests to progress.
+
+        Added fast/block/positioning/static-inline-position-dynamic.html and trailing-space-test.html.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::layoutBlock):
+        (WebCore::RenderBlock::adjustPositionedBlock):
+        (WebCore::RenderBlock::simplifiedNormalFlowLayout):
+        (WebCore::RenderBlock::simplifiedLayout):
+        * rendering/RenderBlock.h:
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::setStaticPositions):
+        (WebCore::RenderBlock::findNextLineBreak):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::styleDidChange):
+        (WebCore::RenderBox::positionLineBox):
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::styleWillChange):
+        * rendering/RenderFlexibleBox.cpp:
+        (WebCore::RenderFlexibleBox::layoutBlock):
+        (WebCore::RenderFlexibleBox::layoutHorizontalBox):
+        (WebCore::RenderFlexibleBox::layoutVerticalBox):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::RenderObject):
+        (WebCore::RenderObject::adjustStyleDifference):
+        (WebCore::RenderObject::setStyle):
+        (WebCore::RenderObject::styleDidChange):
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::needsLayout):
+        (WebCore::RenderObject::needsPositionedMovementLayoutOnly):
+        (WebCore::RenderObject::needsSimplifiedNormalFlowLayout):
+        (WebCore::RenderObject::setNeedsLayout):
+        (WebCore::RenderObject::setChildNeedsLayout):
+        (WebCore::RenderObject::setNeedsSimplifiedNormalFlowLayout):
+        (WebCore::RenderObject::markContainingBlocksForLayout):
+        * rendering/RenderTable.cpp:
+        (WebCore::RenderTable::layout):
+        * rendering/style/RenderStyle.cpp:
+        (WebCore::RenderStyle::diff):
+        * rendering/style/RenderStyleConstants.h:
+        * rendering/svg/RenderSVGText.cpp:
+        (WebCore::RenderSVGText::layout):
+
+2011-03-25  Martin Robinson  <mrobinson@igalia.com>
+
+        Fix the GTK+ build until we can implement the new cross-platform
+        FontPlatformData.h bits.
+
+        * platform/graphics/FontPlatformData.h: Include the proper old font headers.
+        (WebCore::FontPlatformData::FontPlatformData): Eliminate GTK+ specific bits of this file
+        which reference our obsolete font implementation.
+        (WebCore::FontPlatformData::hash): Ditto.
+
+2011-03-25  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Brian Weinstein.
+
+        Microsoft Windows Presentation Foundation (WPF) plug-in complains about missing xpcom.dll
+        https://bugs.webkit.org/show_bug.cgi?id=57119
+        <rdar://problem/9054148>
+        
+        This plug-in from Microsoft links against xpcom.dll, which is a Firefox-specific DLL
+        not available in WebKit. The plug-in is fairly widespread, since it was included in
+        a Windows Update push at one point.
+
+        * plugins/win/PluginPackageWin.cpp:
+        (WebCore::PluginPackage::isPluginBlacklisted): Blacklist npwpf.dll.
+
+2011-03-25  Tony Chang  <tony@chromium.org>
+
+        Try to fix the chromium mac build.
+        We used the mac FontPlatformData on chromium mac.
+
+        * WebCore.gyp/WebCore.gyp:
+        * WebCore.gypi:
+        * platform/graphics/FontPlatformData.h:
+
+2011-03-25  Tony Chang  <tony@chromium.org>
+
+        Build fix:
+        have chromium and qt use the correct FontPlatformData.h
+        https://bugs.webkit.org/show_bug.cgi?id=57115
+
+        * platform/graphics/FontPlatformData.h:
+
+2011-03-25  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=57057 Overlay scrollbars in overflow 
+        areas paint behind positive z-index content
+        -and corresponding-
+        <rdar://problem/9070500>
+
+        Since overlay scrollbars don't clip the scrollable content like other scrollbars do, 
+        the only way to get them to paint on top of all possible scrollable content is to 
+        make them paint on top of everything. To do this, this patch adds a second trip 
+        through the layer tree if it contains overlay scrollbars that need painting.
+
+        After calling paint() on the rootLayer, call paintOverlayScrollers() if 
+        containsDirtyOverlayScrollbars() is true. 
+        * page/FrameView.cpp:
+        (WebCore::FrameView::paintContents):
+
+        RenderLayer has two new member variable. m_containsDirtyOverlayScrollbars is a bool 
+        that is set on the root layer when it has child layers that need overlay scrollbars 
+        to be painted. m_cachedOverlayScrollbarOffset is an IntPoint to cache the tx and ty 
+        of the overlay scrollbars on the first (normal) pass through the layer tree. This 
+        prevents us from having to re-enter the render tree during the second (overlay-only) 
+        pass. Finally, there is also a new paint flag: PaintLayerPaintingOverlayScrollbars.
+        * rendering/RenderLayer.h:
+        (WebCore::RenderLayer::containsDirtyOverlayScrollbars):
+        (WebCore::RenderLayer::setContainsDirtyOverlayScrollbars):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::RenderLayer):
+        (WebCore::RenderLayer::paintOverflowControls):
+        (WebCore::RenderLayer::paintOverlayScrollbars):
+        (WebCore::RenderLayer::paintLayer):
+
+2011-03-25  Jessie Berlin  <jberlin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        WebKit2: Need to be able to set and get the Cookie Storage Policy.
+        https://bugs.webkit.org/show_bug.cgi?id=50780
+
+        * platform/network/cf/CookieStorageCFNet.cpp:
+        (WebCore::privateCookieStorage):
+        Rename privateBrowsingCookieStorage to privateCookieStorage.
+        (WebCore::currentCookieStorage):
+        Ditto.
+        (WebCore::setCurrentCookieStorage):
+        Ditto.
+        (WebCore::setCookieStoragePrivateBrowsingEnabled):
+        Ditto.
+        (WebCore::defaultCookieStorage):
+        Return the default cookie storage.
+        (WebCore::privateBrowsingCookieStorage):
+        Return privateCookieStorage().get()
+        * platform/network/cf/CookieStorageCFNet.h:
+
+2011-03-25  Emil A Eklund  <eae@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Text field "onchange" event is triggered if actual value unchanged
+        https://bugs.webkit.org/show_bug.cgi?id=36314
+
+        Change RenderTextControl::subtreeHasChanged to only return true if the
+        subtree has changed since the last event was triggered.
+
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::HTMLTextFormControlElement::insertedIntoDocument):
+        (WebCore::HTMLTextFormControlElement::dispatchFormControlChangeEvent):
+        * html/HTMLFormControlElement.h:
+        (WebCore::HTMLTextFormControlElement::setTextAsOfLastFormControlChangeEvent):
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::setChecked):
+        (WebCore::HTMLInputElement::setValue):
+        * html/HTMLTextAreaElement.cpp:
+        (WebCore::HTMLTextAreaElement::setValue):
+        (WebCore::HTMLTextAreaElement::setNonDirtyValue):
+
+2011-03-25  Brent Fulgham  <bfulgham@webkit.org>
+
+        Reviewed by David Hyatt.
+
+        Clean up FontPlatformData structure so that a single implementation
+        is used across all ports.  This first patch works for the Windows
+        build (both CG and WinCairo), and Cocoa.
+
+        * WebCore.vcproj/WebCore.vcproj:
+        * platform/graphics/FontPlatformData.cpp: Added.
+        (WebCore::FontPlatformData::FontPlatformData):
+        (WebCore::FontPlatformData::operator=):
+        * platform/graphics/FontPlatformData.h: Added.
+        (WebCore::toCTFontRef):
+        (WebCore::FontPlatformData::FontPlatformData):
+        (WebCore::FontPlatformData::hfont):
+        (WebCore::FontPlatformData::useGDI):
+        (WebCore::FontPlatformData::font):
+        (WebCore::FontPlatformData::cgFont):
+        (WebCore::FontPlatformData::size):
+        (WebCore::FontPlatformData::setSize):
+        (WebCore::FontPlatformData::syntheticBold):
+        (WebCore::FontPlatformData::syntheticOblique):
+        (WebCore::FontPlatformData::isColorBitmapFont):
+        (WebCore::FontPlatformData::orientation):
+        (WebCore::FontPlatformData::textOrientation):
+        (WebCore::FontPlatformData::widthVariant):
+        (WebCore::FontPlatformData::setOrientation):
+        (WebCore::FontPlatformData::scaledFont):
+        (WebCore::FontPlatformData::fontFace):
+        (WebCore::FontPlatformData::hash):
+        (WebCore::FontPlatformData::operator==):
+        (WebCore::FontPlatformData::isHashTableDeletedValue):
+        (WebCore::FontPlatformData::hashTableDeletedFontValue):
+        * platform/graphics/cg/FontPlatformData.h: Removed.
+        * platform/graphics/cocoa/FontPlatformData.h: Removed.
+        * platform/graphics/cocoa/FontPlatformDataCocoa.mm:
+        (WebCore::~FontPlatformData):
+        (WebCore::FontPlatformData::platformDataInit):
+        (WebCore::FontPlatformData::platformDataAssign):
+        * platform/graphics/win/FontPlatformDataCGWin.cpp:
+        (WebCore::FontPlatformData::FontPlatformData):
+        (WebCore::FontPlatformData::~FontPlatformData):
+        (WebCore::FontPlatformData::platformDataInit):
+        (WebCore::FontPlatformData::platformDataAssign):
+        * platform/graphics/win/FontPlatformDataCairoWin.cpp:
+        (WebCore::FontPlatformData::FontPlatformData):
+        (WebCore::FontPlatformData::~FontPlatformData):
+        (WebCore::FontPlatformData::platformDataInit):
+        (WebCore::FontPlatformData::platformDataAssign):
+        * platform/graphics/win/FontPlatformDataWin.cpp:
+        (WebCore::FontPlatformData::FontPlatformData):
+        * platform/graphics/win/cairo/FontPlatformData.h: Removed.
+
+2011-03-25  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Pasteboard data's RTF data doesn't always include URLs via NSLinkAttributeName.
+        https://bugs.webkit.org/show_bug.cgi?id=57107
+        <rdar://problem/9084267>
+
+        If the selection is at the beginning of content inside an anchor tag
+        we move the selection start to include the anchor.
+        
+        * platform/mac/PasteboardMac.mm:
+        (WebCore::Pasteboard::writeSelection): Modified to change the selection
+        start according to the new rule.
+
+2011-03-25  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: refactor Network domain's frame tree API
+        https://bugs.webkit.org/show_bug.cgi?id=57103
+
+        * inspector/Inspector.json:
+        * inspector/InspectorResourceAgent.cpp:
+        (WebCore::buildObjectForFrameResource):
+        (WebCore::buildObjectForCachedResource):
+        (WebCore::InspectorResourceAgent::willSendRequest):
+        (WebCore::InspectorResourceAgent::didLoadResourceFromMemoryCache):
+        (WebCore::buildObjectForFrame):
+        (WebCore::buildObjectForFrameTree):
+        (WebCore::InspectorResourceAgent::didCommitLoad):
+        (WebCore::InspectorResourceAgent::enable):
+        * inspector/front-end/NetworkManager.js:
+        (WebInspector.NetworkManager.prototype.requestContent):
+        (WebInspector.NetworkDispatcher):
+        (WebInspector.NetworkDispatcher.prototype.willSendRequest):
+        (WebInspector.NetworkDispatcher.prototype.didReceiveResponse):
+        (WebInspector.NetworkDispatcher.prototype.didLoadResourceFromMemoryCache):
+        (WebInspector.NetworkDispatcher.prototype.frameDetachedFromParent):
+        (WebInspector.NetworkDispatcher.prototype.didCommitLoadForFrame):
+        (WebInspector.NetworkDispatcher.prototype.didCreateWebSocket):
+        (WebInspector.NetworkDispatcher.prototype._appendRedirect):
+        (WebInspector.NetworkDispatcher.prototype._addFramesRecursively):
+        (WebInspector.NetworkDispatcher.prototype._createResource):
+        * inspector/front-end/ResourceTreeModel.js:
+        (WebInspector.ResourceTreeModel.prototype.addOrUpdateFrame):
+        (WebInspector.ResourceTreeModel.prototype.didCommitLoadForFrame):
+        (WebInspector.ResourceTreeModel.prototype._clearChildFramesAndResources):
+        (WebInspector.ResourceTreeModel.prototype._clearResources):
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel.prototype.addOrUpdateFrame):
+        (WebInspector.ResourcesPanel.prototype.addResourceToFrame):
+
+2011-03-25  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        REGRESSION(r77257): Only first page of a document is printed
+        https://bugs.webkit.org/show_bug.cgi?id=56958
+
+        Test: printing/page-count-layout-overflow.html
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::forceLayoutForPagination): Moved clearing of overflow
+            to the right place.
+
+2011-03-25  Benjamin Poulain  <benjamin.poulain@nokia.com>
+
+        Reviewed by Andreas Kling.
+
+        [Qt] QtWebKit will not compile with QT_ASCII_CAST_WARNINGS enabled
+        https://bugs.webkit.org/show_bug.cgi?id=57087
+
+        Use explicit conversion for string to avoid depending on the default codec
+        installed by the user code.
+
+        * bridge/qt/qt_pixmapruntime.cpp:
+        (JSC::Bindings::QtPixmapToDataUrlMethod::invoke):
+        (JSC::Bindings::QtPixmapInstance::valueOf):
+        * platform/qt/LanguageQt.cpp:
+        (WebCore::platformDefaultLanguage):
+        * platform/qt/PasteboardQt.cpp:
+        (WebCore::Pasteboard::writeSelection):
+        * plugins/qt/PluginPackageQt.cpp:
+        (WebCore::initializeGtk):
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::getPluginDisplay):
+
+2011-03-25  Chang Shu  <cshu@webkit.org>
+
+        Reviewed by Ryosuke Niwa.
+
+        rename Node::isContentEditable and all call sites to rendererIsEditable
+        https://bugs.webkit.org/show_bug.cgi?id=54290
+
+        This is part of the effort to separate JS API HTMLElement isContentEditable from
+        internal Node::rendererIsEditable.
+
+        Code refactoring. No new tests.
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::isReadOnly):
+        (WebCore::AccessibilityRenderObject::accessibilityIsIgnored):
+        * dom/Document.cpp:
+        (WebCore::acceptsEditingFocus):
+        * dom/Node.cpp:
+        (WebCore::Node::rendererIsEditable):
+        (WebCore::Node::shouldUseInputMethod):
+        (WebCore::Node::canStartSelection):
+        (WebCore::Node::rootEditableElement):
+        * dom/Node.h:
+        (WebCore::Node::isContentEditable):
+        (WebCore::Node::rendererIsEditable):
+        (WebCore::Node::rendererIsRichlyEditable):
+        * dom/Position.cpp:
+        (WebCore::nextRenderedEditable):
+        (WebCore::previousRenderedEditable):
+        (WebCore::Position::atEditingBoundary):
+        (WebCore::Position::parentEditingBoundary):
+        (WebCore::Position::upstream):
+        (WebCore::Position::downstream):
+        (WebCore::Position::isCandidate):
+        * dom/PositionIterator.cpp:
+        (WebCore::PositionIterator::isCandidate):
+        * editing/AppendNodeCommand.cpp:
+        (WebCore::AppendNodeCommand::AppendNodeCommand):
+        (WebCore::AppendNodeCommand::doApply):
+        (WebCore::AppendNodeCommand::doUnapply):
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::containsNonEditableRegion):
+        (WebCore::ApplyStyleCommand::applyInlineStyleToNodeRange):
+        (WebCore::ApplyStyleCommand::removeInlineStyleFromElement):
+        (WebCore::ApplyStyleCommand::surroundNodeRangeWithElement):
+        * editing/CompositeEditCommand.cpp:
+        (WebCore::CompositeEditCommand::breakOutOfEmptyListItem):
+        * editing/DeleteButtonController.cpp:
+        (WebCore::isDeletableElement):
+        (WebCore::enclosingDeletableElement):
+        * editing/DeleteFromTextNodeCommand.cpp:
+        (WebCore::DeleteFromTextNodeCommand::doApply):
+        (WebCore::DeleteFromTextNodeCommand::doUnapply):
+        * editing/DeleteSelectionCommand.cpp:
+        (WebCore::DeleteSelectionCommand::removeNode):
+        * editing/Editor.cpp:
+        (WebCore::Editor::canDeleteRange):
+        (WebCore::Editor::markMisspellingsOrBadGrammar):
+        (WebCore::Editor::markAllMisspellingsAndBadGrammarInRanges):
+        * editing/EditorCommand.cpp:
+        (WebCore::verticalScrollDistance):
+        * editing/FormatBlockCommand.cpp:
+        (WebCore::enclosingBlockToSplitTreeTo):
+        * editing/IndentOutdentCommand.cpp:
+        (WebCore::IndentOutdentCommand::outdentParagraph):
+        * editing/InsertIntoTextNodeCommand.cpp:
+        (WebCore::InsertIntoTextNodeCommand::doApply):
+        (WebCore::InsertIntoTextNodeCommand::doUnapply):
+        * editing/InsertNodeBeforeCommand.cpp:
+        (WebCore::InsertNodeBeforeCommand::InsertNodeBeforeCommand):
+        (WebCore::InsertNodeBeforeCommand::doApply):
+        (WebCore::InsertNodeBeforeCommand::doUnapply):
+        * editing/JoinTextNodesCommand.cpp:
+        (WebCore::JoinTextNodesCommand::doApply):
+        (WebCore::JoinTextNodesCommand::doUnapply):
+        * editing/MergeIdenticalElementsCommand.cpp:
+        (WebCore::MergeIdenticalElementsCommand::doApply):
+        (WebCore::MergeIdenticalElementsCommand::doUnapply):
+        * editing/RemoveNodeCommand.cpp:
+        (WebCore::RemoveNodeCommand::doApply):
+        (WebCore::RemoveNodeCommand::doUnapply):
+        * editing/ReplaceSelectionCommand.cpp:
+        (WebCore::ReplacementFragment::ReplacementFragment):
+        * editing/SelectionController.cpp:
+        (WebCore::SelectionController::selectFrameElementInParentIfFullySelected):
+        (WebCore::SelectionController::setSelectionFromNone):
+        * editing/SplitElementCommand.cpp:
+        (WebCore::SplitElementCommand::executeApply):
+        (WebCore::SplitElementCommand::doUnapply):
+        * editing/SplitTextNodeCommand.cpp:
+        (WebCore::SplitTextNodeCommand::doApply):
+        (WebCore::SplitTextNodeCommand::doUnapply):
+        (WebCore::SplitTextNodeCommand::doReapply):
+        * editing/SplitTextNodeContainingElementCommand.cpp:
+        (WebCore::SplitTextNodeContainingElementCommand::doApply):
+        * editing/VisiblePosition.cpp:
+        (WebCore::VisiblePosition::canonicalPosition):
+        * editing/WrapContentsInDummySpanCommand.cpp:
+        (WebCore::WrapContentsInDummySpanCommand::doUnapply):
+        (WebCore::WrapContentsInDummySpanCommand::doReapply):
+        * editing/htmlediting.cpp:
+        (WebCore::highestEditableRoot):
+        (WebCore::lowestEditableAncestor):
+        (WebCore::isEditablePosition):
+        (WebCore::isRichlyEditablePosition):
+        (WebCore::firstEditablePositionAfterPositionInRoot):
+        (WebCore::extendRangeToWrappingNodes):
+        (WebCore::enclosingNodeWithTag):
+        (WebCore::enclosingNodeOfType):
+        (WebCore::highestEnclosingNodeOfType):
+        (WebCore::canMergeLists):
+        * editing/visible_units.cpp:
+        (WebCore::previousLeafWithSameEditability):
+        (WebCore::previousLinePosition):
+        (WebCore::nextLeafWithSameEditability):
+        (WebCore::nextLinePosition):
+        (WebCore::startOfParagraph):
+        (WebCore::endOfParagraph):
+        * html/HTMLAnchorElement.cpp:
+        (WebCore::HTMLAnchorElement::supportsFocus):
+        (WebCore::HTMLAnchorElement::defaultEventHandler):
+        (WebCore::HTMLAnchorElement::setActive):
+        (WebCore::HTMLAnchorElement::canStartSelection):
+        (WebCore::HTMLAnchorElement::treatLinkAsLiveForEventType):
+        * html/HTMLBodyElement.cpp:
+        (WebCore::HTMLBodyElement::supportsFocus):
+        * html/HTMLElement.cpp:
+        (WebCore::HTMLElement::supportsFocus):
+        (WebCore::HTMLElement::isContentEditable):
+        (WebCore::HTMLElement::contentEditable):
+        * html/HTMLElement.h:
+        * page/DragController.cpp:
+        (WebCore::DragController::operationForLoad):
+        (WebCore::DragController::canProcessDrag):
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::handleMouseReleaseEvent):
+        (WebCore::EventHandler::selectCursor):
+        * page/FocusController.cpp:
+        (WebCore::relinquishesEditingFocus):
+        * rendering/HitTestResult.cpp:
+        (WebCore::HitTestResult::isContentEditable):
+        * rendering/RenderBlock.cpp:
+        (WebCore::positionForPointRespectingEditingBoundaries):
+        (WebCore::RenderBlock::hasLineIfEmpty):
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::addOverflowFromInlineChildren):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::canBeProgramaticallyScrolled):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::createVisiblePosition):
+        * rendering/RootInlineBox.cpp:
+        (WebCore::isEditableLeaf):
+        * svg/SVGAElement.cpp:
+        (WebCore::SVGAElement::supportsFocus):
+
+2011-03-25  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Antti Koivisto.
+
+        Crash when a wbr element is inserted inside mroot
+        https://bugs.webkit.org/show_bug.cgi?id=56352
+
+        Test: mathml/wbr-in-mroot-crash.html
+
+        * rendering/mathml/RenderMathMLRoot.cpp:
+        (WebCore::RenderMathMLRoot::layout): Look for the first box model child of the first
+        child, instead of just assuming.
+
+2011-03-25  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        XML Viewer: extensions can't render original XML
+        https://bugs.webkit.org/show_bug.cgi?id=56263
+
+        Added source xml to transformed document, renamed onload function.
+
+        * xml/XMLTreeViewer.cpp:
+        (WebCore::XMLTreeViewer::transformDocumentToTreeView):
+        * xml/XMLViewer.xsl:
+
+2011-03-25  Benjamin Poulain  <benjamin.poulain@nokia.com>
+
+        Reviewed by Andreas Kling.
+
+        [Qt] Get rid of the invalid string conversion with ::fromAscii()
+        https://bugs.webkit.org/show_bug.cgi?id=57102
+
+        Replace ::fromAscii() with ::fromLatin1() to make sure the codec does not depend on the user code.
+
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::QNetworkReplyHandler::sendResponseIfNeeded):
+        * platform/qt/CookieJarQt.cpp:
+        (WebCore::cookies):
+        (WebCore::cookieRequestHeaderFieldValue):
+
+2011-03-25  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r81953.
+        http://trac.webkit.org/changeset/81953
+        https://bugs.webkit.org/show_bug.cgi?id=57096
+
+        "inspector test breakage: part 2/2" (Requested by apavlov on
+        #webkit).
+
+        * inspector/Inspector.json:
+        * inspector/InspectorCSSAgent.cpp:
+        (WebCore::InspectorCSSAgent::getAllStyles):
+        * inspector/InspectorCSSAgent.h:
+        * inspector/InspectorStyleSheet.cpp:
+        (WebCore::InspectorStyleSheet::buildObjectForStyleSheet):
+        * inspector/InspectorStyleSheet.h:
+        * inspector/front-end/AuditRules.js:
+        (WebInspector.AuditRules.UnusedCssRule.prototype.doRun.styleSheetCallback):
+        (WebInspector.AuditRules.UnusedCssRule.prototype.doRun.allStylesCallback):
+        (WebInspector.AuditRules.UnusedCssRule.prototype.doRun):
+        * inspector/front-end/CSSStyleModel.js:
+        (WebInspector.CSSStyleModel.prototype._styleSheetChanged.callback):
+        (WebInspector.CSSStyleModel.prototype._styleSheetChanged):
+        (WebInspector.CSSStyleModel.prototype._onRevert):
+        (WebInspector.CSSStyleSheet):
+        (WebInspector.CSSStyleSheet.prototype.setText):
+
+2011-03-15  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: Fix handling of the CSSAgent.setStyleSheetText() results in CSSStyleModel.js
+        https://bugs.webkit.org/show_bug.cgi?id=56310
+
+        Instead of stylesheet ids, CSSAgent.getAllStyleSheets() now returns metainfo objects containing
+        "styleSheetId", "sourceURL", "disabled", and "title" fields. The latter three are not returned
+        by CSSAgent.getStyleSheet() anymore.
+
+        Test: inspector/styles/get-set-stylesheet-text.html
+
+        * inspector/Inspector.json:
+        * inspector/InspectorCSSAgent.cpp:
+        (WebCore::InspectorCSSAgent::getAllStyleSheets):
+        * inspector/InspectorCSSAgent.h:
+        * inspector/InspectorStyleSheet.cpp:
+        (WebCore::InspectorStyleSheet::buildObjectForStyleSheet):
+        (WebCore::InspectorStyleSheet::buildObjectForStyleSheetInfo):
+        * inspector/InspectorStyleSheet.h:
+        * inspector/front-end/AuditRules.js:
+        (WebInspector.AuditRules.UnusedCssRule.prototype.doRun.styleSheetCallback):
+        (WebInspector.AuditRules.UnusedCssRule.prototype.doRun.allStylesCallback):
+        (WebInspector.AuditRules.UnusedCssRule.prototype.doRun):
+        * inspector/front-end/CSSStyleModel.js:
+        (WebInspector.CSSStyleModel.prototype._styleSheetChanged.callback):
+        (WebInspector.CSSStyleModel.prototype._styleSheetChanged):
+        (WebInspector.CSSStyleModel.prototype._onRevert):
+        (WebInspector.CSSStyleSheet):
+        (WebInspector.CSSStyleSheet.prototype.setText):
+
+2011-03-25  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: extension server should not convert all resources to HAR when there are no extensions.
+        https://bugs.webkit.org/show_bug.cgi?id=57044
+
+        * inspector/front-end/ExtensionServer.js:
+        (WebInspector.ExtensionServer.prototype._notifyResourceFinished):
+        (WebInspector.ExtensionServer.prototype._hasSubscribers):
+
+2011-03-25  Leo Yang  <leo.yang@torchmobile.com.cn>
+
+        Reviewed by Nikolas Zimmermann.
+
+        SVG <use> element performance improvement
+        https://bugs.webkit.org/show_bug.cgi?id=57077
+
+        SVG <use> element was expanding nesting <use> and <symbol> elements
+        in an inefficient way. After it expanded an <use> or a <symbol>
+        element it would restart expanding from the shadow tree root.
+        This behavior was leading about 160 millions of calls to
+        expandUseElementInShadowTree or expandSymbolElementInShadowTree for
+        a single shadow tree which is illustrated by
+        http://upload.wikimedia.org/wikipedia/commons/4/4e/Sierpinski_carpet_6.svg.
+        But the effective calls, which really expand <use> or <symbol>
+        elements, were about 5200; others were passing-by calls, which are
+        recursively down to the children.
+
+        This patch is altering the expanding path to reduce the passing-by
+        calls. It will expand elements in sibling chain where there is an
+        effective call, because the effective call replaces element which is
+        expanded and the replacement results lose of the sibling chain of
+        the replaced on the upper recursion stack. With this patch the
+        passing-by calls are reduced from about 160 millions to about 30
+        thousands.
+
+        No functionality change, no new tests.
+
+        * svg/SVGUseElement.cpp:
+        (WebCore::SVGUseElement::expandUseElementsInShadowTree):
+        (WebCore::SVGUseElement::expandSymbolElementsInShadowTree):
+        * svg/SVGUseElement.h:
+
+2011-03-25  Dominic Cooney  <dominicc@google.com>
+
+        Reviewed by Kent Tamura.
+
+        Makes keygen support autofocus attribute.
+        https://bugs.webkit.org/show_bug.cgi?id=57091
+
+        Test: fast/forms/autofocus-keygen.html
+
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::HTMLFormControlElement::attach):
+
+2011-03-24  Gyuyoung Kim  <gyuyoung.kim@samsung.com>
+
+        Reviewed by Antonio Gomes.
+
+        [EFL] Add sound / mute button to MediaControl UI
+        https://bugs.webkit.org/show_bug.cgi?id=56726
+
+        Add sound / mute button to MediaControl UI.
+
+        * platform/efl/RenderThemeEfl.cpp:
+        (WebCore::RenderThemeEfl::edjeGroupFromFormType):
+        (WebCore::RenderThemeEfl::emitMediaButtonSignal):
+        (WebCore::RenderThemeEfl::paintMediaMuteButton):
+        * platform/efl/RenderThemeEfl.h:
+
+2011-03-24  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Darin Adler.
+
+        Introduce WTF HexNumber.h
+        https://bugs.webkit.org/show_bug.cgi?id=56099
+
+        Introduce a set of functions that ease converting from a bye or a number to a hex string,
+        replacing several of these conversions and String::format("%x") usages all over WebCore.
+
+        * ForwardingHeaders/wtf/HexNumber.h: Added.
+        * css/CSSOMUtils.cpp:
+        (WebCore::serializeCharacterAsCodePoint):
+        * css/CSSParser.cpp:
+        (WebCore::quoteCSSString):
+        * inspector/InspectorResourceAgent.cpp:
+        (WebCore::createReadableStringFromBinary):
+        * platform/FileSystem.cpp:
+        (WebCore::encodeForFileName):
+        * platform/KURL.cpp:
+        (WebCore::appendEscapedChar):
+        * platform/UUID.cpp:
+        (WebCore::createCanonicalUUIDString):
+        * platform/graphics/Color.cpp:
+        (WebCore::Color::serialized):
+        * platform/network/FormDataBuilder.cpp:
+        (WebCore::FormDataBuilder::encodeStringAsFormData):
+        * rendering/RenderTreeAsText.cpp:
+        (WebCore::quoteAndEscapeNonPrintables):
+
+2011-03-24  Stephanie Lewis  <slewis@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        <rdar://problem/9146716> REGRESSION: ~10 MB increase in memory under CachedScripts
+        Add back a call to destroy decoded data after access.  Keep the SourceProviderCache 
+        around as long as their are still clients to use it.
+
+        No new tests because there is no change in behavior.  Current tests pass.
+
+        * loader/cache/CachedScript.cpp:
+        (WebCore::CachedScript::script):
+        (WebCore::CachedScript::destroyDecodedData):
+
+2011-03-24  Stephanie Lewis  <slewis@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        https://bugs.webkit.org/show_bug.cgi?id=57073
+        Rework the AtomicHTMLConstructor to reserve space for attributes based on the size of the attribute list.
+        Saves 1.5 MB on Membuster.
+
+        No new tests because there was no change in behavior.  Current tests pass.
+
+        * html/parser/HTMLToken.h:
+        (WebCore::AtomicHTMLToken::AtomicHTMLToken):
+        (WebCore::AtomicHTMLToken::initializeAttributes):
+
+2011-03-24  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r81916 and r81917.
+        http://trac.webkit.org/changeset/81916
+        http://trac.webkit.org/changeset/81917
+        https://bugs.webkit.org/show_bug.cgi?id=57071
+
+        broke a test on platforms that do not have QuickTime installed
+        (Requested by estes on #webkit).
+
+        * html/HTMLEmbedElement.cpp:
+        (WebCore::HTMLEmbedElement::HTMLEmbedElement):
+        * html/HTMLObjectElement.cpp:
+        (WebCore::HTMLObjectElement::HTMLObjectElement):
+        (WebCore::HTMLObjectElement::parametersForPlugin):
+        * html/HTMLPlugInImageElement.cpp:
+        (WebCore::HTMLPlugInImageElement::HTMLPlugInImageElement):
+        (WebCore::HTMLPlugInImageElement::isImageType):
+        (WebCore::HTMLPlugInImageElement::wouldLoadAsNetscapePlugin):
+        * html/HTMLPlugInImageElement.h:
+        * loader/EmptyClients.h:
+        (WebCore::EmptyFrameLoaderClient::objectContentType):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::defaultObjectContentType):
+        * loader/FrameLoader.h:
+        * loader/FrameLoaderClient.h:
+        * loader/SubframeLoader.cpp:
+        (WebCore::SubframeLoader::resourceWillUsePlugin):
+        (WebCore::SubframeLoader::requestObject):
+        (WebCore::SubframeLoader::shouldUsePlugin):
+        * loader/SubframeLoader.h:
+
+2011-03-24  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Eliminate Node::dispatchGenericEvent.
+        https://bugs.webkit.org/show_bug.cgi?id=57045
+
+        No functional change, covered by existing tests.
+
+        * dom/Node.cpp:
+        (WebCore::Node::dispatchEvent): Combined with the body of dispatchGenericEvent,
+            removed unnecessary extra refs and a stale comment.
+        * dom/Node.h:
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::dispatchLoadEvent): Changed to use dispatchEvent.
+        * svg/SVGElement.cpp:
+        (WebCore::SVGElement::sendSVGLoadEventIfPossible): Ditto.
+        * svg/SVGElementInstance.cpp:
+        (WebCore::SVGElementInstance::dispatchEvent): Ditto. The code here still
+            works thanks to SVG-aware retargeting in Node.
+
+2011-03-24  Chris Rogers  <crogers@google.com>
+
+        Reviewed by Kenneth Russell.
+
+        web audio: Properly sample-rate convert audio assets in chromium port
+        https://bugs.webkit.org/show_bug.cgi?id=56980
+
+        No new tests since audio API is not yet implemented.
+
+        * WebCore.gypi:
+        * platform/audio/AudioBus.cpp:
+        (WebCore::AudioBus::createBySampleRateConverting):
+        (WebCore::AudioBus::createByMixingToMono):
+        * platform/audio/AudioBus.h:
+        * platform/audio/HRTFKernel.cpp:
+        (WebCore::extractAverageGroupDelay):
+        (WebCore::HRTFKernel::HRTFKernel):
+        * platform/audio/SincResampler.cpp:
+        * platform/audio/chromium/AudioBusChromium.cpp:
+        (WebCore::AudioBus::loadPlatformResource):
+        (WebCore::createBusFromInMemoryAudioFile):
+
+2011-03-24  Rik Cabanier  <cabanier@adobe.com>
+
+        Reviewed by David Hyatt.
+
+        REGRESSION (r81625): fast/css/percentage-non-integer.html fails on Windows
+        https://bugs.webkit.org/show_bug.cgi?id=56829
+
+        Test: fast/css/percentage-non-integer.html
+
+        * platform/Length.h:
+        (WebCore::Length::calcValue):
+        (WebCore::Length::calcMinValue):
+        (WebCore::Length::calcFloatValue):
+
+2011-03-24  Mihai Parparita  <mihaip@chromium.org>
+
+        Reviewed by James Robinson.
+
+        [Chromium] Vertical Japanese text is not displayed on Snow Leopard
+        https://bugs.webkit.org/show_bug.cgi?id=56962
+
+        Make Snow Leopard check added by r80740 into a runtime check for
+        Chromium, since it uses the same binary on both Leopard and Snow Leopard.
+
+        * platform/graphics/mac/FontMac.mm:
+        (WebCore::hasBrokenCTFontGetVerticalTranslationsForGlyphs):
+        (WebCore::showGlyphsWithAdvances):
+
+2011-03-24  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=57058
+        Hookup the UIProcess WebIconDatabase to a WebCore::IconDatabase as its implementation
+
+        * loader/icon/IconDatabase.cpp:
+        (WebCore::IconDatabase::synchronousLoadDecisionForIconURL): Only add the DocumentLoader to the set if it's non-zero.
+        (WebCore::IconDatabase::IconDatabase): Add more logging.
+        (WebCore::IconDatabase::performURLImport): Dispatch the "didFinishURLImport" client callback using the following 3 methods.
+        (WebCore::FinishedURLImport::FinishedURLImport):
+        (WebCore::FinishedURLImport::performWork):
+        (WebCore::IconDatabase::dispatchDidFinishURLImportOnMainThread):
+
+        * loader/icon/IconDatabase.h:
+        (WebCore::IconDatabase::create): Expose a PassOwnPtr<> creator.
+
+        * WebCore.exp.in:
+
+2011-03-23  Jer Noble  <jer.noble@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Application Cache should save audio/ and video/ mime types as flat files
+        https://bugs.webkit.org/show_bug.cgi?id=53784
+        <rdar://problem/8932473>
+
+        No new tests.
+
+        ApplicationCacheResource::create() now takes an additional "path" parameter.  To facilitate 
+        extracting this path information, two functions in ApplicationCacheHost have been made public.
+
+        * loader/appcache/ApplicationCacheGroup.cpp:
+        (WebCore::ApplicationCacheGroup::didReceiveResponse): Pass along new "path" parameter.
+        (WebCore::ApplicationCacheGroup::didFail): Ditto.
+        * loader/appcache/ApplicationCacheHost.h:
+        (WebCore::ApplicationCacheHost::shouldLoadResourceFromApplicationCache): Made public.
+        (WebCore::ApplicationCacheHost::getApplicationCacheFallbackResource): Made public.
+        * loader/appcache/ApplicationCacheResource.cpp:
+        (WebCore::ApplicationCacheResource::ApplicationCacheResource): Add new "path" parameter.
+        * loader/appcache/ApplicationCacheResource.h:
+        (WebCore::ApplicationCacheResource::create): Ditto.
+        (WebCore::ApplicationCacheResource::path): New accessor.
+
+2011-03-24  Andy Estes  <aestes@apple.com>
+
+        Reviewed by Darin Adler.
+
+        REGRESSION (r70748): latest nightly builds kills AC_QuickTime.js
+        https://bugs.webkit.org/show_bug.cgi?id=49016
+
+        AC_QuickTime.js uses the common <object>/<embed> paradigm to embed the
+        QuickTime plug-in in web pages. r70748 removed our mapping of classids
+        to MIME types, which causes WebKit to fall back from the object to the
+        embed tag when QuickTime is embedded by this script. The script emits
+        the following embed tag to embed a QuickTime movie with a poster frame:
+
+        <embed src="poster-frame.png" target="quicktimeplayer" href="movie.mov">
+
+        The expectation is that a QuickTime plug-in is instantiated to display the
+        poster frame, since QuickTime registers for many common image MIME
+        types. This is how Gecko behaves for embed. However, WebKit prefers to
+        use its native image rendering for image embeds, in which case no movie
+        is played when the poster frame is clicked.
+
+        Fix this by changing embed to check for a plug-in that can handle the
+        image type before rendering the image natively. This matches Gecko.
+
+        Test: fast/images/embed-image-plugins-disabled.html
+
+        * html/HTMLObjectElement.cpp:
+        (WebCore::HTMLObjectElement::parametersForPlugin):
+        * html/HTMLPlugInImageElement.cpp:
+        (WebCore::HTMLPlugInImageElement::HTMLPlugInImageElement):
+        (WebCore::HTMLPlugInImageElement::isImageType):
+        (WebCore::HTMLPlugInImageElement::wouldLoadAsNetscapePlugin):
+        * html/HTMLPlugInImageElement.h:
+        (WebCore::HTMLPlugInImageElement::preferPluginsForImages):
+        * loader/EmptyClients.h:
+        (WebCore::EmptyFrameLoaderClient::objectContentType):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::defaultObjectContentType):
+        * loader/FrameLoader.h:
+        * loader/FrameLoaderClient.h:
+        * loader/SubframeLoader.cpp:
+        (WebCore::SubframeLoader::resourceWillUsePlugin):
+        (WebCore::SubframeLoader::requestPlugin):
+        (WebCore::SubframeLoader::requestObject):
+        (WebCore::SubframeLoader::shouldUsePlugin):
+        * loader/SubframeLoader.h:
+
+2011-03-24  Mike Reed  <reed@google.com>
+
+        Reviewed by James Robinson.
+
+        Move lifetime management of grContext from a global to being
+        per-SharedGraphicsContext3D, which correctly is 1:1 with the
+        underlying opengl context.
+        https://bugs.webkit.org/show_bug.cgi?id=54330
+
+        No new tests. Existing <canvas> tests exercise this:
+
+        * platform/graphics/chromium/DrawingBufferChromium.cpp:
+        (WebCore::DrawingBuffer::DrawingBuffer):
+        (WebCore::DrawingBuffer::~DrawingBuffer):
+        (WebCore::DrawingBuffer::publishToPlatformLayer):
+        (WebCore::DrawingBuffer::setGrContext):
+        * platform/graphics/gpu/DrawingBuffer.h:
+        * platform/graphics/gpu/SharedGraphicsContext3D.cpp:
+        (WebCore::SharedGraphicsContext3D::SharedGraphicsContext3D):
+        (WebCore::SharedGraphicsContext3D::~SharedGraphicsContext3D):
+        (WebCore::SharedGraphicsContext3D::getGrContext):
+        * platform/graphics/gpu/SharedGraphicsContext3D.h:
+        * platform/graphics/skia/PlatformContextSkia.cpp:
+        (WebCore::PlatformContextSkia::~PlatformContextSkia):
+        (WebCore::PlatformContextSkia::setSharedGraphicsContext3D):
+
+2011-03-24  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Untangle dependency between event ancestor chain computation and InspectorDOMAgent.
+        https://bugs.webkit.org/show_bug.cgi?id=57050
+
+        Inspector's list of event listeners does not need to invoke Node::getEventListeners,
+        because it simply wants to collect all ancestors and never uses EventContext bits.
+
+        No functional change, covered by existing tests.
+
+        * dom/Node.cpp:
+        (WebCore::getEventAncestors): Converted into a static function.
+        (WebCore::Node::dispatchGenericEvent): Changed to pass node to getEventAncestors.
+        * dom/Node.h: Removed decl, moved EventDispatchBehavior enum inside.
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::getEventListenersForNode): Replaced the call
+            to getEventAncestors with a simple ancestor traversal loop.
+
+2011-03-24  Adam Klein  <adamk@chromium.org>
+
+        Reviewed by David Levin.
+
+        [fileapi] Make FileError and FileException accessible from WorkerContext
+        https://bugs.webkit.org/show_bug.cgi?id=57041
+
+        * workers/WorkerContext.idl:
+
+2011-03-24  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Remove legacy version of findPlainText.
+        https://bugs.webkit.org/show_bug.cgi?id=57056
+
+        * editing/TextIterator.cpp:
+        * editing/TextIterator.h:
+        Remove legacy overload of findPlainText that doesn't
+        take an options parameter.
+
+2011-03-24  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Ensure that all compilation takes place within a dynamic global object scope
+        https://bugs.webkit.org/show_bug.cgi?id=57054
+
+        * bindings/js/JSErrorHandler.cpp:
+        (WebCore::JSErrorHandler::handleEvent):
+        * bindings/js/JSEventListener.cpp:
+        (WebCore::JSEventListener::handleEvent): Updated for signature change.
+
+2011-03-24  John Bauman  <jbauman@chromium.org>
+
+        Reviewed by Kenneth Russell.
+
+        preserveDrawingBuffer=true is ignored
+        https://bugs.webkit.org/show_bug.cgi?id=56987
+
+        Add code to the V8 and JSC bindings to support grabbing the value of
+        preserveDrawingBuffer from the input context attributes. Also, in
+        WebGLRenderingContext use the WebGLContextAttributes that were input
+        directly, not those from the GraphicsContext3D which could have been
+        changed.
+
+        No new tests, as this can't be tested with DRT. However, this works
+        when tested manually.
+
+        * bindings/js/JSHTMLCanvasElementCustom.cpp:
+        (WebCore::JSHTMLCanvasElement::getContext):
+        * bindings/v8/custom/V8HTMLCanvasElementCustom.cpp:
+        (WebCore::V8HTMLCanvasElement::getContextCallback):
+        * html/canvas/WebGLRenderingContext.cpp:
+        (WebCore::WebGLRenderingContext::clearIfComposited):
+        (WebCore::WebGLRenderingContext::paintRenderingResultsToCanvas):
+
+2011-03-24  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        WebKit2:Services menu item to convert selected Simplified/Traditional Chinese Text is not working.
+        https://bugs.webkit.org/show_bug.cgi?id=56975
+        <rdar://problem/8915066>
+        
+        Adding support in WebCore to implement readSelectionFromPasteboard
+        to support Mac OS X services from WebKit2.
+
+        * WebCore.exp.in:
+        * editing/Editor.h:
+        * editing/mac/EditorMac.mm:
+        (WebCore::Editor::readSelectionFromPasteboard): Added entry point
+        to call the paste functions with the specified pasteboard.
+
+2011-03-24  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: Inspector does not show correct transfer size for synchronous requests
+        https://bugs.webkit.org/show_bug.cgi?id=56951
+
+        Fixed transfer size for synchronous load.
+
+        Test: http/tests/inspector/network/network-size-sync.html
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::willLoadMediaElementURL):
+        (WebCore::FrameLoader::commitProvisionalLoad):
+        (WebCore::FrameLoader::loadResourceSynchronously):
+        (WebCore::FrameLoader::loadedResourceFromMemoryCache):
+        * loader/ResourceLoadNotifier.cpp:
+        (WebCore::ResourceLoadNotifier::sendRemainingDelegateMessages):
+        * loader/ResourceLoadNotifier.h:
+
+2011-03-24  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Adam Roben.
+
+        https://bugs.webkit.org/show_bug.cgi?id=57030
+        REGRESSION (r81782): http/tests/inspector/extensions-resources-redirect.html sometimes crashes WebKit2's 
+        web process while handling a WebIconDatabaseProxy::ReceivedIconLoadDecision message
+
+        The callback objects had some bogus ASSERTs and missed a relevant null check. If a callback was waiting on
+        a message back from the UIProcess, but was invalidated from within the WebProcess in the meantime, it's
+        perfectly valid to attempt to performCallback() after the callback function pointer has been cleared.
+
+        * loader/icon/IconDatabaseBase.h:
+        (WebCore::EnumCallback::performCallback):
+        (WebCore::EnumCallback::invalidate):
+        (WebCore::EnumCallback::EnumCallback):
+        (WebCore::ObjectCallback::performCallback):
+        (WebCore::ObjectCallback::invalidate):
+        (WebCore::ObjectCallback::ObjectCallback):
+
+2011-03-24  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Dictionary text extraction is not correctly detecting word boundaries on bing.com
+        <rdar://problem/9078569>
+        https://bugs.webkit.org/show_bug.cgi?id=56995
+
+        * WebCore.exp.in:
+        Add some editing related exports needed by WebKit2.
+
+2011-03-24  Andy Estes  <aestes@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        REGRESSION (r80231): Bad cast in HTMLTreeBuilder with closed </form> tags
+        https://bugs.webkit.org/show_bug.cgi?id=56836
+
+        During fragment parsing, HTMLConstructionSite holds a reference to the
+        fragment context's closest form ancestor. If a misnested form end tag is
+        then encountered as the first node of the fragment, we will check to see
+        if a corresponding form start tag is in scope even though no such tag
+        exists. This led to isScope() walking the HTMLElementStack all the way
+        to the root DocumentFragment and attempting to cast it to Element*.
+
+        Fix this by ensuring that the inScope() family of functions operate in
+        terms of ContainerNodes to account for the fragment case.
+
+        Test: fast/parser/fragment-closest-form-ancestor.html
+
+        * html/parser/HTMLElementStack.cpp:
+        (WebCore::HTMLNames::isRootNode):
+        (WebCore::HTMLNames::isScopeMarker):
+        (WebCore::HTMLNames::isTableScopeMarker):
+        (WebCore::HTMLNames::isTableBodyScopeMarker):
+        (WebCore::HTMLNames::isTableRowScopeMarker):
+        (WebCore::HTMLElementStack::hasOnlyHTMLElementsInScope):
+        (WebCore::HTMLElementStack::inScope):
+
+2011-03-24  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Repeated copy and paste-in-place operation results in increasingly verbose HTML.
+        <rdar://problem/8690506>
+        https://bugs.webkit.org/show_bug.cgi?id=56874
+        
+        When we calculate the style to apply at the insertion point we compare the initial
+        style at the insertion point against the style calculated at the span we wrap the
+        copied markup fragment with. We could end up with a series of unnecessary spans
+        to remove the initial style that simply grow our markup.
+        The consists in moving the insertion point outside any inline element that could
+        affect the fragment being inserted when we are not pasting and matching the style.
+
+        Test: editing/pasteboard/paste-text-with-style.html
+
+        * editing/ReplaceSelectionCommand.cpp:
+        (WebCore::isInlineNodeWithStyle): Added.
+        (WebCore::ReplaceSelectionCommand::doApply): Added logic to change the insertion
+        point according to the new rules.
+
+2011-03-24  Benjamin Poulain  <benjamin.poulain@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] When we render WebGL offscreen, color conversion cost a lot of CPU cycles
+        https://bugs.webkit.org/show_bug.cgi?id=40884
+
+        The software fallback is now only needed for corner cases like a manual rendering
+        of the page to QImage.
+
+        Keeping the image with the last pixel values is no longer needed. Removing it reduce the
+        performance for real-time rendering on software surface, but this case should no longer be
+        supported.
+
+        The conversion from OpenGL color space and coordinates is done manually for performance. This
+        also fix the bug of the inverted X axis due to the transformation.
+
+        The tests and benchmarks are done through Qt API tests.
+
+        * platform/graphics/qt/GraphicsContext3DQt.cpp:
+        (WebCore::swapBgrToRgb):
+        (WebCore::GraphicsContext3DInternal::paint):
+        (WebCore::GraphicsContext3D::reshape):
+
+2011-03-24  Nat Duca  <nduca@chromium.org>
+
+        Reviewed by James Robinson.
+
+        [chromium] Remove bool that forces compositor HUD to always be enabled
+        https://bugs.webkit.org/show_bug.cgi?id=57034
+
+        * platform/graphics/chromium/cc/CCHeadsUpDisplay.h:
+        (WebCore::CCHeadsUpDisplay::enabled):
+
+2011-03-24  Nat Duca  <nduca@chromium.org>
+
+        Reviewed by Kenneth Russell.
+
+        [chromium] Add traceEvents to compositor
+        https://bugs.webkit.org/show_bug.cgi?id=56965
+
+        * WebCore.gypi:
+        * platform/chromium/TraceEvent.h: Added.
+        (WebCore::internal::ScopeTracer::ScopeTracer):
+        (WebCore::internal::ScopeTracer::~ScopeTracer):
+        * platform/graphics/chromium/LayerRendererChromium.cpp:
+        (WebCore::LayerRendererChromium::updateRootLayerContents):
+        (WebCore::LayerRendererChromium::updateRootLayerScrollbars):
+        (WebCore::LayerRendererChromium::updateLayers):
+        (WebCore::LayerRendererChromium::drawLayers):
+        (WebCore::LayerRendererChromium::finish):
+        (WebCore::LayerRendererChromium::present):
+        * platform/graphics/chromium/LayerTilerChromium.cpp:
+        (WebCore::LayerTilerChromium::update):
+
+2011-03-24  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: render XHRs matching JSON regex as JSON.
+        https://bugs.webkit.org/show_bug.cgi?id=57035
+
+        * English.lproj/localizedStrings.js:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/front-end/NetworkItemView.js:
+        (WebInspector.NetworkItemView):
+        * inspector/front-end/RemoteObject.js:
+        (WebInspector.LocalJSONObject.prototype.get description.switch.case):
+        (WebInspector.LocalJSONObject.prototype.get description):
+        (WebInspector.LocalJSONObject.prototype._concatenate):
+        (WebInspector.LocalJSONObject.prototype.getProperties):
+        (WebInspector.LocalJSONObject.prototype._children):
+        * inspector/front-end/ResourceJSONView.js: Added.
+        (WebInspector.ResourceJSONView):
+        (WebInspector.ResourceJSONView.parseJSON.WebInspector.ResourceJSONView.prototype.hasContent):
+        (WebInspector.ResourceJSONView.parseJSON.WebInspector.ResourceJSONView.prototype.show):
+        (WebInspector.ResourceJSONView.parseJSON.WebInspector.ResourceJSONView.prototype._initialize):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.css:
+        (.resource-view.json):
+        * inspector/front-end/inspector.html:
+
+2011-03-24  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Move media controls subtree creation into one method.
+        https://bugs.webkit.org/show_bug.cgi?id=56969
+
+        Mechanical move, no changes in functionality.
+
+        The purpose of this patch is to align existing code closer with its
+        future version, when MediaControls is an element whose tree is created
+        at the instantiation.
+
+        * html/shadow/MediaControls.cpp:
+        (WebCore::MediaControls::create): Added, consolidating all subtree generation logic into one place.
+        (WebCore::MediaControls::update): Replaced methods with one call.
+        * html/shadow/MediaControls.h: Updated decls.
+        * rendering/MediaControlElements.cpp:
+        (WebCore::MediaControlTimelineElement::create): Moved setting of attributes here.
+        (WebCore::MediaControlVolumeSliderElement::create): Ditto.
+
+2011-03-24  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Use proper string method to generate webloc string.
+        https://bugs.webkit.org/show_bug.cgi?id=57028
+        <rdar://problem/9181955>
+
+        * platform/win/ClipboardUtilitiesWin.cpp:
+        (WebCore::getWebLocData):
+
+2011-03-24  Ben Taylor  <bentaylor.solx86@gmail.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32821
+        Fix conditionals which had an int for one case and a pointer for another.
+        Fix is similar to https://bugs.webkit.org/show_bug.cgi?id=56198
+
+        No new tests. Fix compilation on Solaris 10 with SunStudio 12 C++
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::CSSComputedStyleDeclaration::valueForShadow):
+
+2011-03-24  Pavel Podivilov  <podivilov@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: provide live edit callback to source frame delegate.
+        https://bugs.webkit.org/show_bug.cgi?id=57003
+
+        * inspector/front-end/DebuggerModel.js:
+        (WebInspector.DebuggerModel.prototype.editScriptSource):
+        (WebInspector.DebuggerModel.prototype._didEditScriptSource):
+        * inspector/front-end/DebuggerPresentationModel.js:
+        (WebInspector.DebuggerPresentationModel):
+        (WebInspector.DebuggerPresentationModel.prototype.canEditScriptSource):
+        (WebInspector.DebuggerPresentationModel.prototype.editScriptSource.didEditScriptSource):
+        (WebInspector.DebuggerPresentationModel.prototype.editScriptSource):
+        (WebInspector.DebuggerPresentationModel.prototype._updateBreakpointsAfterLiveEdit):
+        (WebInspector.DebuggerPresentationModel.prototype._scriptForSourceFileId):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype._createSourceFrame):
+        (WebInspector.SourceFrameDelegateForScriptsPanel):
+        (WebInspector.SourceFrameDelegateForScriptsPanel.prototype.canEditScriptSource):
+        (WebInspector.SourceFrameDelegateForScriptsPanel.prototype.editScriptSource):
+
+2011-03-24  Benjamin Poulain  <benjamin.poulain@nokia.com>
+
+        Reviewed by Andreas Kling.
+
+        Regression: WebKit does not build with Python 3 following 56807
+        https://bugs.webkit.org/show_bug.cgi?id=56923
+
+        The module string does not have the function replace in Python 3. The str.replace function
+        can do the same operation in this case and works with the versions 2 and 3.
+
+        * inspector/generate-inspector-idl:
+
+2011-03-24  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: brush up Network agent API.
+        https://bugs.webkit.org/show_bug.cgi?id=57001
+
+        * inspector/Inspector.json:
+        * inspector/InspectorInstrumentation.cpp:
+        (WebCore::InspectorInstrumentation::willSendRequestImpl):
+        * inspector/InspectorInstrumentation.h:
+        (WebCore::InspectorInstrumentation::willSendRequest):
+        * inspector/InspectorResourceAgent.cpp:
+        (WebCore::buildObjectForResourceRequest):
+        (WebCore::buildObjectForResourceResponse):
+        (WebCore::buildObjectForCachedResource):
+        (WebCore::InspectorResourceAgent::willSendRequest):
+        (WebCore::InspectorResourceAgent::willSendWebSocketHandshakeRequest):
+        (WebCore::InspectorResourceAgent::didReceiveWebSocketHandshakeResponse):
+        (WebCore::InspectorResourceAgent::setExtraHeaders):
+        * inspector/InspectorResourceAgent.h:
+        * inspector/TimelineRecordFactory.cpp:
+        (WebCore::TimelineRecordFactory::createResourceReceiveResponseData):
+        * inspector/front-end/NetworkManager.js:
+        (WebInspector.NetworkDispatcher.prototype._updateResourceWithRequest):
+        (WebInspector.NetworkDispatcher.prototype._updateResourceWithResponse):
+        (WebInspector.NetworkDispatcher.prototype._updateResourceWithCachedResource):
+        (WebInspector.NetworkDispatcher.prototype.willSendRequest):
+        (WebInspector.NetworkDispatcher.prototype.didReceiveWebSocketHandshakeResponse):
+        (WebInspector.NetworkDispatcher.prototype.didCloseWebSocket):
+        * inspector/front-end/Resource.js:
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel.FormattedRecord.prototype._generatePopupContent):
+        * loader/ResourceLoadNotifier.cpp:
+        (WebCore::ResourceLoadNotifier::assignIdentifierToInitialRequest):
+        (WebCore::ResourceLoadNotifier::dispatchWillSendRequest):
+        * loader/appcache/ApplicationCacheGroup.cpp:
+        (WebCore::ApplicationCacheGroup::createResourceHandle):
+
+2011-03-11  Steve Block  <steveblock@google.com>
+
+        Reviewed by Jeremy Orlow.
+
+        JNIType is not specific to JNI so should be renamed
+        https://bugs.webkit.org/show_bug.cgi?id=56197
+
+        This patch renames JNIType to JavaType, renames the values of
+        the enum, and moves it out of JNIUtility.h to its own file.
+        Also renames the corresponding JavaField and JavaMethod getters.
+
+        No new tests, refactoring only.
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bridge/jni/JNIUtility.cpp:
+        (JSC::Bindings::javaTypeFromClassName):
+        (JSC::Bindings::signatureFromJavaType):
+        (JSC::Bindings::javaTypeFromPrimitiveType):
+        (JSC::Bindings::getJNIField):
+        (JSC::Bindings::callJNIMethod):
+        * bridge/jni/JNIUtility.h:
+        * bridge/jni/JavaMethod.cpp:
+        (JavaMethod::JavaMethod):
+        (JavaMethod::signature):
+        * bridge/jni/JavaMethod.h:
+        (JSC::Bindings::JavaMethod::returnTypeClassName):
+        (JSC::Bindings::JavaMethod::returnType):
+        * bridge/jni/JavaType.h: Copied from Source/WebCore/bridge/jni/JavaMethod.h.
+        * bridge/jni/jni_jsobject.mm:
+        (JavaJSObject::toString):
+        * bridge/jni/jni_objc.mm:
+        (JSC::Bindings::dispatchJNICall):
+        * bridge/jni/jsc/JNIUtilityPrivate.cpp:
+        (JSC::Bindings::convertArrayInstanceToJavaArray):
+        (JSC::Bindings::convertValueToJValue):
+        * bridge/jni/jsc/JNIUtilityPrivate.h:
+        * bridge/jni/jsc/JavaArrayJSC.cpp:
+        (JavaArray::setValueAt):
+        (JavaArray::valueAt):
+        * bridge/jni/jsc/JavaClassJSC.cpp:
+        * bridge/jni/jsc/JavaFieldJSC.cpp:
+        (JavaField::JavaField):
+        (JavaField::dispatchValueFromInstance):
+        (JavaField::valueFromInstance):
+        (JavaField::dispatchSetValueToInstance):
+        (JavaField::setValueToInstance):
+        * bridge/jni/jsc/JavaFieldJSC.h:
+        (JSC::Bindings::JavaField::typeClassName):
+        (JSC::Bindings::JavaField::type):
+        * bridge/jni/jsc/JavaInstanceJSC.cpp:
+        (JavaInstance::invokeMethod):
+        * bridge/jni/v8/JNIUtilityPrivate.cpp:
+        (JSC::Bindings::convertNPVariantToJValue):
+        (JSC::Bindings::convertJValueToNPVariant):
+        * bridge/jni/v8/JNIUtilityPrivate.h:
+        * bridge/jni/v8/JavaFieldV8.cpp:
+        (JavaField::JavaField):
+        * bridge/jni/v8/JavaFieldV8.h:
+        (JSC::Bindings::JavaField::typeClassName):
+        (JSC::Bindings::JavaField::type):
+        * bridge/jni/v8/JavaInstanceV8.cpp:
+        (JavaInstance::invokeMethod):
+        (JavaInstance::getField):
+        * bridge/jni/v8/JavaNPObjectV8.cpp:
+        (JSC::Bindings::JavaNPObjectInvoke):
+        (JSC::Bindings::JavaNPObjectGetProperty):
+
+2011-03-24  Ojan Vafai  <ojan@chromium.org>
+
+        Was being a little braindead when I committed this.
+        Only simple selectors are allowed, but sibling selectors
+        are sibling selectors.
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::collectFeaturesFromList):
+
+2011-03-23  MORITA Hajime  <morrita@google.com>
+
+        Reviewed by Kent Tamura.
+
+        Spellcheck feature specific symbols should be defined.
+        https://bugs.webkit.org/show_bug.cgi?id=56818
+        
+        * Introduced USE(UNIFIED_TEXT_CHECKING), USE(GRAMMAR_CHECKING) and USE(AUTOMATIC_TEXT_REPLACEMENT)
+        * Replaced a part of of BUILDING_ON_* conditionals with them.
+
+        Note that small amount of code path on Editor.cpp is now compiled under USE(GRAMMAR_CHECKING)
+        because these code path is already built under non-Mac ports and
+        Keeping them buildable for such platforms reduces the build breakage risk.
+        These path is guarded by Settings thus should never get reached.
+
+        No new tests. No behavioral change.
+
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * editing/Editor.cpp:
+        (WebCore::Editor::advanceToNextMisspelling):
+        (WebCore::Editor::isSelectionUngrammatical):
+        (WebCore::Editor::guessesForUngrammaticalSelection):
+        (WebCore::Editor::guessesForMisspelledOrUngrammaticalSelection):
+        (WebCore::Editor::markMisspellingsAfterTypingToWord):
+        (WebCore::Editor::markMisspellingsOrBadGrammar):
+        (WebCore::Editor::markBadGrammar):
+        (WebCore::Editor::markAllMisspellingsAndBadGrammarInRanges):
+        (WebCore::Editor::changeBackToReplacedString):
+        (WebCore::Editor::markMisspellingsAndBadGrammar):
+        * editing/Editor.h:
+        * editing/TextCheckingHelper.cpp:
+        (WebCore::TextCheckingHelper::findFirstMisspellingOrBadGrammar):
+        (WebCore::TextCheckingHelper::findFirstGrammarDetail):
+        (WebCore::TextCheckingHelper::findFirstBadGrammar):
+        (WebCore::TextCheckingHelper::isUngrammatical):
+        (WebCore::TextCheckingHelper::guessesForMisspelledOrUngrammaticalRange):
+        (WebCore::TextCheckingHelper::markAllBadGrammar):
+        * loader/EmptyClients.h:
+        * platform/text/TextCheckerClient.h:
+        * platform/text/TextChecking.h: Added.
+
+2011-03-23  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [Chromium] Force to make validation bubble DIV position:absolute
+        https://bugs.webkit.org/show_bug.cgi?id=56901
+
+        Test: fast/forms/interactive-validation-crash-by-style-override.html
+
+        * html/ValidationMessage.cpp:
+        (WebCore::ValidationMessage::buildBubbleTree): Add position:absolute
+          because we need to move the validation message to a good position.
+        * rendering/RenderMenuList.cpp:
+        (WebCore::RenderMenuList::addChild):
+
+2011-03-23  Mike Lawther  <mikelawther@chromium.org>
+
+        Reviewed by Ojan Vafai.
+
+        flex/bison tokens and grammar for CSS calc
+        https://bugs.webkit.org/show_bug.cgi?id=54412
+
+        Tests: css3/calc/calc-errors.html
+               css3/calc/minmax-errors.html
+               css3/calc/simple-calcs.html
+               css3/calc/simple-minmax.html
+
+        * css/CSSGrammar.y:
+        * css/CSSParserValues.cpp:
+        (WebCore::CSSParserValueList::insertValueAt):
+        (WebCore::CSSParserValueList::extend):
+        * css/CSSParserValues.h:
+        * css/tokenizer.flex:
+
+2011-03-23  Adam Klein  <adamk@chromium.org>
+
+        Reviewed by David Levin.
+
+        Fix resolveLocalFileSystemURL (and sync version) error codes to match the spec
+        https://bugs.webkit.org/show_bug.cgi?id=56961
+
+        See error code listing in the Files & Directories spec:
+        http://dev.w3.org/2009/dap/file-system/file-dir-sys.html#widl-LocalFileSystemSync-resolveLocalFileSystemSyncURL
+
+        Note that the spec currently only specifies errors for the sync
+        version; I've used the same codes for the async version.
+
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::resolveLocalFileSystemURL):
+        * workers/WorkerContext.cpp:
+        (WebCore::WorkerContext::resolveLocalFileSystemURL):
+        (WebCore::WorkerContext::resolveLocalFileSystemSyncURL):
+
+2011-03-23  Jia Pu  <jpu@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Hook up new AppKit autocorrection UI with WK2.
+        https://bugs.webkit.org/show_bug.cgi?id=56055
+        <rdar://problem/8947463>
+
+        This patch is to enable WK2 to utilize autocorrection UI on Mac OS X. It contains following
+        major changes:
+
+        1. All but one autocorrection related message is synchronous. Since dismissing autocorrection
+        panel can potentially cause editing to occur, a synchronous dismissCorrectionPanelSoon() function
+        is introduced to ensure all editing commands occur in correct order.
+
+        2. Additional condition variable is needed to implement dismissCorrectionPanelSoon().
+        To improve maintainability, CorrectionPanel class is introduced to manage the
+        internal state related to correction panel. This change is applied to both WK1 and WK2.
+
+        3. EditorClient::isShowingCorrectionPanel() has been removed. The original purpose is to allow
+        editor to know when to handle ESC key event. Now this is handled internally in AppKit, so
+        EditorClient::isShowingCorrectionPanel() isn't necessary anymore.
+
+        4. The Editor* argument in EditorClient::showCorrectionPanel() has been removed, since we can
+        access object via WebView or WKView.
+
+        * editing/Editor.cpp:
+        (WebCore::Editor::markMisspellingsAfterTypingToWord):
+        (WebCore::Editor::markAllMisspellingsAndBadGrammarInRanges):
+        (WebCore::Editor::correctionPanelTimerFired):
+        (WebCore::Editor::dismissCorrectionPanel):
+        (WebCore::Editor::dismissCorrectionPanelSoon):
+        (WebCore::Editor::applyAutocorrectionBeforeTypingIfAppropriate):
+        * editing/Editor.h:
+        * editing/EditorCommand.cpp:
+        (WebCore::createCommandMap):
+        * loader/EmptyClients.h:
+        (WebCore::EmptyEditorClient::showCorrectionPanel):
+        (WebCore::EmptyEditorClient::dismissCorrectionPanelSoon):
+        * manual-tests/autocorrection/close-window-when-correction-is-shown.html: Added.
+        * page/EditorClient.h:
+
+2011-03-22  Ojan Vafai  <ojan@chromium.org>
+
+        Reviewed by Antti Koivisto.
+
+        move :not over to using selectorList instead of simpleSelector
+        https://bugs.webkit.org/show_bug.cgi?id=56894
+
+        Saves memory and simplifies code.
+
+        No new tests since existing tests cover this code.
+
+        * css/CSSGrammar.y:
+        Also removed extranenous calls to updateLastSelectorLineAndPosition in
+        simple_selector_list. These happened to work, but are only actually
+        needed in selector_list.
+        * css/CSSParserValues.h:
+        * css/CSSSelector.cpp:
+        (WebCore::CSSSelector::specificityForOneSelector):
+        Removed null-check. The parser null-checks, I don't see why we need to here.
+        (WebCore::CSSSelector::selectorText):
+        Ditto.
+        (WebCore::CSSSelector::setArgument):
+        (WebCore::CSSSelector::isSimple):
+        * css/CSSSelector.h:
+        * css/CSSSelectorList.cpp:
+        (WebCore::forEachTagSelector):
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::SelectorChecker::checkOneSelector):
+        (WebCore::collectFeaturesFromSelector):
+        (WebCore::collectFeaturesFromList):
+
+2011-03-23  Carol Szabo  <carol.szabo@nokia.com>
+
+        Reviewed by David Hyatt.
+
+        Made sure that renderers displaying counters are invalidated upon
+        counter destruction.
+
+        Assertion and incorrect rendering of counters.
+        https://bugs.webkit.org/show_bug.cgi?id=56896
+
+        Test: fast/css/counters/2displays.html
+
+        * rendering/CounterNode.cpp:
+        (WebCore::CounterNode::~CounterNode):
+        Added to make sure that its display renderers are always reset when
+        the node is deleted.
+        (WebCore::CounterNode::resetRenderers):
+        Fixed bug that would prevent reset of second and subsequent
+        display renderers.
+        * rendering/CounterNode.h:
+        * rendering/RenderCounter.cpp:
+        (WebCore::destroyCounterNodeWithoutMapRemoval):
+        removed unnecessary calls to resetRenderers() as the CounterNode
+        destructor takes care of that now.
+
+2011-03-23  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        WebKit2: Need API to manage the Media Cache
+        https://bugs.webkit.org/show_bug.cgi?id=56878
+        <rdar://problem/9082503>
+
+        Add functions that need to be exported.
+
+        * WebCore.exp.in:
+
+2011-03-23  Robert Kroeger  <rjkroege@chromium.org>
+
+        Reviewed by James Robinson.
+
+        Correct use of ENABLE() Macro
+
+        In http://trac.webkit.org/changeset/81618, I mis-used the ENABLE()
+        macro. This patch corrects.
+
+        https://bugs.webkit.org/show_bug.cgi?id=56964
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::EventHandler):
+        (WebCore::EventHandler::handleTouchEvent):
+        * page/EventHandler.h:
+
+2011-03-23  Jer Noble  <jer.noble@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Scrubbing <video> with HTTP Live Stream resizes element to 0x0
+        https://bugs.webkit.org/show_bug.cgi?id=55702
+
+        QTKit will occasionally set the natural size of a QTMovie to 0x0 while scrubbing
+        an HTTP Live Stream.  So we will cache the last valid value returned by QTKit
+        and use that as our naturalSize until a new valid value is returned.
+
+        Unfortunately, QTKit will also fail to generate a notification when the natural size
+        changes, so we are forced to cache the natural size from within naturalSize(), which
+        is a const function, necessitating a const_cast to set m_cachedNaturalSize.
+
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.h: Added m_cachedNaturalSize.
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivateQTKit::MediaPlayerPrivateQTKit): Initialize m_cachedNaturalSize.
+        (WebCore::MediaPlayerPrivateQTKit::naturalSize): 
+
+2011-03-23  Alexey Proskuryakov  <ap@apple.com>
+
+        Build fix.
+
+        * loader/FrameLoader.cpp: (WebCore::FrameLoader::checkLoadCompleteForThisFrame):
+        Removed a stray parenthesis.
+
+2011-03-23  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        REGRESSION: Infinite recursion in recursiveCheckLoadComplete()/checkLoadCompleteForThisFrame()/stopLoading()
+        https://bugs.webkit.org/show_bug.cgi?id=56978
+        <rdar://problem/9041670>
+
+        No new tests, because there is no known way to reproduce.
+
+        Removed strange code that was trying to stop a non-loading provisional document loader and
+        even its subframes (?!). Added assertions to catch it if we can actually be loading here in
+        some sense.
+        Rewrote a condition for clarity - starting with r43148, it was acting as an opposite of a
+        recursion guard (but that didn't cause immediate problems then).
+
+        * loader/FrameLoader.cpp: (WebCore::FrameLoader::checkLoadCompleteForThisFrame):
+
+2011-03-23  Brady Eidson  <beidson@apple.com>
+
+        Attempt to fix the build for platforms that have the icon database 
+        disabled but still provide settings API for it...?
+
+        * loader/icon/IconDatabase.h:
+        (WebCore::IconDatabase::defaultDatabaseFilename):
+
+2011-03-23  Mark Rowe  <mrowe@apple.com>
+
+        Fix the build.
+
+        * WebCore.exp.in: Export the new version of IconDatabase::open.
+
+2011-03-23  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Change IconDatabase opening to allow for arbitrary filenames
+        https://bugs.webkit.org/show_bug.cgi?id=56977
+
+        * WebCore.exp.in:
+        * loader/icon/IconDatabase.cpp:
+        (WebCore::IconDatabase::open):
+        * loader/icon/IconDatabase.h:
+        * loader/icon/IconDatabaseBase.cpp:
+        (WebCore::IconDatabaseBase::open):
+        * loader/icon/IconDatabaseBase.h:
+        * loader/icon/IconDatabaseClient.h:
+
+2011-03-23  Kenneth Russell  <kbr@google.com>
+
+        Reviewed by James Robinson.
+
+        [chromium] WebGLRenderingContext and other DOMWindow properties should remain if WebGL is disabled
+        https://bugs.webkit.org/show_bug.cgi?id=56947
+
+        Removed the RuntimeEnabledFeatures setting for WebGL and the
+        EnabledAtRuntime extended attribute from the WebGL-related
+        properties on the DOMWindow. WebGL support is now controlled
+        exclusively through the page's Settings.
+
+        No new tests; tested manually in Chromium with --disable-webgl
+        command line argument and blacklist.
+
+        * bindings/generic/RuntimeEnabledFeatures.cpp:
+        * bindings/generic/RuntimeEnabledFeatures.h:
+        * page/DOMWindow.idl:
+
+2011-03-23  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r81802.
+        http://trac.webkit.org/changeset/81802
+        https://bugs.webkit.org/show_bug.cgi?id=56963
+
+        Broke a layout test, and this fix is not trivial. (Requested
+        by dhyatt on #webkit).
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::layoutBlock):
+        (WebCore::RenderBlock::layoutOnlyPositionedObjects):
+        * rendering/RenderBlock.h:
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::styleDidChange):
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::styleWillChange):
+        * rendering/RenderFlexibleBox.cpp:
+        (WebCore::RenderFlexibleBox::layoutBlock):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::RenderObject):
+        (WebCore::RenderObject::adjustStyleDifference):
+        (WebCore::RenderObject::setStyle):
+        (WebCore::RenderObject::styleDidChange):
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::needsLayout):
+        (WebCore::RenderObject::needsPositionedMovementLayoutOnly):
+        (WebCore::RenderObject::setNeedsLayout):
+        (WebCore::RenderObject::setChildNeedsLayout):
+        (WebCore::RenderObject::markContainingBlocksForLayout):
+        * rendering/RenderTable.cpp:
+        (WebCore::RenderTable::layout):
+        * rendering/style/RenderStyle.cpp:
+        (WebCore::RenderStyle::diff):
+        * rendering/style/RenderStyleConstants.h:
+        * rendering/svg/RenderSVGText.cpp:
+        (WebCore::RenderSVGText::layout):
+
+2011-03-23  Luiz Agostini  <luiz.agostini@openbossa.org>
+
+        Reviewed by David Hyatt.
+
+        REGRESSION(81035): crash in RenderDetails::removeChild
+        https://bugs.webkit.org/show_bug.cgi?id=56773
+
+        Test: fast/html/details-children-merge-crash.html
+
+        Preventing merging of RenderDetails's anonymous children.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::canMergeContiguousAnonymousBlocks):
+
+        Fixing RenderDetails::removeChild and cleaning m_marker in RenderDetails::destroy.
+
+        * rendering/RenderDetails.cpp:
+        (WebCore::RenderDetails::destroy):
+        (WebCore::RenderDetails::removeChild):
+
+2011-03-23  Xiaomei Ji  <xji@chromium.org>
+
+        Reviewed by David Hyatt.
+
+        Preserve unicode-bidi:bidi-override in anonymous block.
+        https://bugs.webkit.org/show_bug.cgi?id=21440
+
+        unicode-bidi:bidi-override should be preserved in anonymous block
+        according to http://www.w3.org/TR/CSS21/visuren.html#propdef-unicode-bidi.
+
+        Introduce a helper function RenderStyle()::createAnonymousStyle() which
+        creates a default RenderStyle, inherits the inherited style from parent,
+        and inherit unicode-bidi:bidi-override from parent.
+        And replace the style creation when anonymous block is created.
+
+        Note: the TABLE releated anonymous blocks are untouched, including:
+        TABLE, TABLE_CELL, TABLE_ROW, TABLE_ROW_GROUP anonymous blocks created in
+        RenderObject, RenderTable, RenderTableRow, and RenderTableSection,
+        due to the expected behavior is not clear.
+        Please refer to https://bugs.webkit.org/show_bug.cgi?id=56594.
+        
+        Test: fast/css/bidi-override-in-anonymous-block.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::styleDidChange):
+        (WebCore::RenderBlock::removeChild):
+        (WebCore::RenderBlock::createAnonymousBlock):
+        (WebCore::RenderBlock::createAnonymousColumnsBlock):
+        (WebCore::RenderBlock::createAnonymousColumnSpanBlock):
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::addChildIgnoringContinuation):
+        * rendering/RenderRubyRun.cpp:
+        (WebCore::RenderRubyRun::createRubyBase):
+        (WebCore::RenderRubyRun::staticCreateRubyRun):
+        * rendering/style/RenderStyle.cpp:
+        (WebCore::RenderStyle::createAnonymousStyle):
+        * rendering/style/RenderStyle.h:
+
+2011-03-23  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=56909
+        
+        Add a simplified normal flow layout path optimization for overflow recomputation
+        and for positioned objects inside relative positioned containers.
+
+        Currently there is an optimized code path for positioned objects, but as soon as
+        we encounter a normal flow object in the containing block chain, we lose the
+        optimization.
+
+        This patch adds a new type of style difference called SimplifiedLayout that is
+        returned when only overflow needs to be recomputed. Whenever opacity changes or
+        a transform changes, this is the hint returned now instead of a full layout.
+        
+        In addition, when positioned objects need layout and start marking up the
+        containing block chain, we now propagate the fact that the layout is simplified
+        all the way up to the root, even when we encounter normal flow containing
+        blocks.
+        
+        The layoutOnlyPositionedObjects function has been renamed to simplifiedLayout()
+        and is now used for all of these cases (in addition to what it handled before).
+        
+        No new tests, since existing tests covered this very well (especially the opacity
+        and transforms repaint tests in fast/repaint).
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::layoutBlock):
+        (WebCore::RenderBlock::simplifiedNormalFlowLayout):
+        (WebCore::RenderBlock::simplifiedLayout):
+        * rendering/RenderBlock.h:
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::styleDidChange):
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::styleWillChange):
+        * rendering/RenderFlexibleBox.cpp:
+        (WebCore::RenderFlexibleBox::layoutBlock):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::RenderObject):
+        (WebCore::RenderObject::adjustStyleDifference):
+        (WebCore::RenderObject::setStyle):
+        (WebCore::RenderObject::styleDidChange):
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::needsLayout):
+        (WebCore::RenderObject::needsPositionedMovementLayoutOnly):
+        (WebCore::RenderObject::needsSimplifiedNormalFlowLayout):
+        (WebCore::RenderObject::setNeedsLayout):
+        (WebCore::RenderObject::setChildNeedsLayout):
+        (WebCore::RenderObject::setNeedsSimplifiedNormalFlowLayout):
+        (WebCore::RenderObject::markContainingBlocksForLayout):
+        * rendering/RenderTable.cpp:
+        (WebCore::RenderTable::layout):
+        * rendering/style/RenderStyle.cpp:
+        (WebCore::RenderStyle::diff):
+        * rendering/style/RenderStyleConstants.h:
+        * rendering/svg/RenderSVGText.cpp:
+        (WebCore::RenderSVGText::layout):
+
+2011-03-23  Tyler Close  <tjclose@chromium.org>
+
+        Reviewed by Jeremy Orlow.
+
+        Fix ambiguous method call in V8 IDL generated code for DOMStringList callback parameter
+        https://bugs.webkit.org/show_bug.cgi?id=56950
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/scripts/test/CPP/WebDOMTestCallback.cpp:
+        (WebDOMTestCallback::callbackWithStringList):
+        * bindings/scripts/test/CPP/WebDOMTestCallback.h:
+        * bindings/scripts/test/GObject/WebKitDOMTestCallback.cpp:
+        (webkit_dom_test_callback_callback_with_string_list):
+        * bindings/scripts/test/GObject/WebKitDOMTestCallback.h:
+        * bindings/scripts/test/JS/JSTestCallback.cpp:
+        (WebCore::JSTestCallback::callbackWithStringList):
+        * bindings/scripts/test/JS/JSTestCallback.h:
+        * bindings/scripts/test/ObjC/DOMTestCallback.h:
+        * bindings/scripts/test/ObjC/DOMTestCallback.mm:
+        (-[DOMTestCallback callbackWithStringList:]):
+        * bindings/scripts/test/TestCallback.idl:
+        * bindings/scripts/test/V8/V8TestCallback.cpp:
+        (WebCore::V8TestCallback::callbackWithStringList):
+        * bindings/scripts/test/V8/V8TestCallback.h:
+
+2011-03-23  Cris Neckar  <cdn@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Add refptr for widget. Mutations can happen within the event handler.
+        https://bugs.webkit.org/show_bug.cgi?id=56774
+
+        Test: plugins/change-widget-and-click-crash.html
+
+        * html/HTMLPlugInElement.cpp:
+        (WebCore::HTMLPlugInElement::defaultEventHandler):
+
+2011-03-23  Abhishek Arya  <inferno@chromium.org>
+
+        Reviewed by Dave Hyatt.
+
+        Add combine text cast checks since style property is insufficient
+        in telling object types.
+        https://bugs.webkit.org/show_bug.cgi?id=56358
+
+        Test: fast/text/input-box-text-fragment-combine-text-crash.html
+
+        * rendering/InlineTextBox.cpp:
+        (WebCore::InlineTextBox::paint):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::computeInlinePreferredLogicalWidths):
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::findNextLineBreak):
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::widthFromCache):
+
+2011-03-23  Andreas Kling  <kling@webkit.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] "Unwavering" HTML5 game freezes the web page.
+        https://bugs.webkit.org/show_bug.cgi?id=56944
+
+        For canvas's getImageData() API, we don't want to make a deep-copy of
+        the pixels, which is the case on Qt's "raster" graphics system.
+
+        To work around this, we trick QPixmap::toImage() into giving us the
+        QPixmap's backing QImage by temporarily pointing the paint engine to
+        a null paint device.
+
+        * platform/graphics/qt/ImageBufferData.h:
+        * platform/graphics/qt/ImageBufferQt.cpp:
+        (WebCore::ImageBufferData::toQImage): Added, returns the
+        ImageBufferData as a QImage, avoiding a backend deep-copy if possible.
+        (WebCore::ImageBuffer::platformTransformColorSpace):
+        (WebCore::getImageData):
+
+2011-03-23  Viet-Trung Luu  <viettrungluu@chromium.org>
+
+        Reviewed by Tony Chang.
+
+        [chromium] Add FormatPlainText to WebClipboard::Format enumeration.
+        https://bugs.webkit.org/show_bug.cgi?id=56868
+
+        Chromium's WebClipboard::isFormatAvailable() will be correspondingly
+        extended.
+
+        * platform/chromium/PasteboardPrivate.h: Add corresponding enum entry.
+            This part of the change is inert and should have no effect.
+
+2011-03-23  Tyler Close  <tjclose@chromium.org>
+
+        Reviewed by Jeremy Orlow.
+
+        run-bindings-tests reference files are out of sync with CodeGenerator*.pm
+        https://bugs.webkit.org/show_bug.cgi?id=56934
+
+        * bindings/scripts/test/GObject/WebKitDOMTestObj.cpp:
+        * bindings/scripts/test/GObject/WebKitDOMTestObj.h:
+        * bindings/scripts/test/JS/JSTestInterface.cpp:
+        (WebCore::JSTestInterfaceConstructor::createStructure):
+        (WebCore::JSTestInterfaceConstructor::JSTestInterfaceConstructor):
+        (WebCore::JSTestInterface::createPrototype):
+        * bindings/scripts/test/JS/JSTestInterface.h:
+        (WebCore::JSTestInterface::createStructure):
+        (WebCore::JSTestInterfacePrototype::createStructure):
+        * bindings/scripts/test/JS/JSTestMediaQueryListListener.cpp:
+        (WebCore::JSTestMediaQueryListListenerConstructor::createStructure):
+        (WebCore::JSTestMediaQueryListListenerConstructor::JSTestMediaQueryListListenerConstructor):
+        (WebCore::JSTestMediaQueryListListener::createPrototype):
+        * bindings/scripts/test/JS/JSTestMediaQueryListListener.h:
+        (WebCore::JSTestMediaQueryListListener::createStructure):
+        (WebCore::JSTestMediaQueryListListenerPrototype::createStructure):
+        * bindings/scripts/test/JS/JSTestObj.cpp:
+        (WebCore::JSTestObjConstructor::createStructure):
+        (WebCore::JSTestObjConstructor::JSTestObjConstructor):
+        (WebCore::JSTestObj::createPrototype):
+        * bindings/scripts/test/JS/JSTestObj.h:
+        (WebCore::JSTestObj::createStructure):
+        (WebCore::JSTestObjPrototype::createStructure):
+        * bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.cpp:
+        (WebCore::JSTestSerializedScriptValueInterfaceConstructor::createStructure):
+        (WebCore::JSTestSerializedScriptValueInterfaceConstructor::JSTestSerializedScriptValueInterfaceConstructor):
+        (WebCore::JSTestSerializedScriptValueInterface::createPrototype):
+        * bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.h:
+        (WebCore::JSTestSerializedScriptValueInterface::createStructure):
+        (WebCore::JSTestSerializedScriptValueInterfacePrototype::createStructure):
+        * bindings/scripts/test/V8/V8TestCallback.cpp:
+        * bindings/scripts/test/V8/V8TestInterface.cpp:
+        (WebCore::V8TestInterface::wrapSlow):
+        * bindings/scripts/test/V8/V8TestMediaQueryListListener.cpp:
+        (WebCore::V8TestMediaQueryListListener::wrapSlow):
+        * bindings/scripts/test/V8/V8TestObj.cpp:
+        (WebCore::V8TestObj::wrapSlow):
+        * bindings/scripts/test/V8/V8TestSerializedScriptValueInterface.cpp:
+        (WebCore::V8TestSerializedScriptValueInterface::wrapSlow):
+
+2011-03-23  Daniel Bates  <dbates@rim.com>
+
+        Reviewed by Antonio Gomes.
+
+        Clean up: Rename HTMLFrameSetElement::{noresize, frameborder, and frameBorderSet}
+        to conform to the WebKit Code style guidelines
+        https://bugs.webkit.org/show_bug.cgi?id=56871
+
+        No functionality changed. So, no new tests.
+
+        * html/HTMLFrameSetElement.cpp:
+        (WebCore::HTMLFrameSetElement::HTMLFrameSetElement):
+        (WebCore::HTMLFrameSetElement::parseMappedAttribute):
+        (WebCore::HTMLFrameSetElement::attach):
+        (WebCore::HTMLFrameSetElement::defaultEventHandler):
+        * html/HTMLFrameSetElement.h:
+        (WebCore::HTMLFrameSetElement::hasFrameBorder):
+        (WebCore::HTMLFrameSetElement::noResize):
+
+2011-03-23  Abhishek Arya  <inferno@chromium.org>
+
+        Reviewed by Dan Bernstein.
+
+        Replace height with logicalHeight when removing items from
+        gPercentHeightDescendantMap so that it is writing mode aware.
+        https://bugs.webkit.org/show_bug.cgi?id=56902
+
+        Test: fast/block/percent-height-descendant-not-removed-crash.html
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::destroy):
+        (WebCore::RenderBox::styleDidChange):
+        * rendering/RenderWidget.cpp:
+        (WebCore::RenderWidget::destroy):
+
+2011-03-23  Anders Carlsson  <andersca@apple.com>
+
+        Fix clang build.
+
+        * inspector/DOMNodeHighlighter.cpp:
+        Remove an unused function.
+
+2011-03-22  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Add asynchronous load decision call to WebKit2 IconDatabase
+        https://bugs.webkit.org/show_bug.cgi?id=56887
+
+        Clear the callback when it's made:
+        * loader/DocumentLoader.cpp:
+        (WebCore::DocumentLoader::continueIconLoadWithDecision):
+
+        Don't load icons when using new-style icon database if in private browsing:
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::continueIconLoadWithDecision):
+        
+        Enhance the IconDatabase callbacks to have an ID and inherit from a common base:
+        * loader/icon/IconDatabaseBase.h:
+        (WebCore::CallbackBase::~CallbackBase):
+        (WebCore::CallbackBase::callbackID):
+        (WebCore::CallbackBase::CallbackBase):
+        (WebCore::CallbackBase::context):
+        (WebCore::CallbackBase::generateCallbackID):
+        (WebCore::EnumCallback::performCallback):
+        (WebCore::EnumCallback::EnumCallback):
+        (WebCore::ObjectCallback::performCallback):
+        (WebCore::ObjectCallback::ObjectCallback):
+
+2011-03-21  Pavel Podivilov  <podivilov@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: move scripts concatenation logic to SourceFile.
+        https://bugs.webkit.org/show_bug.cgi?id=56756
+
+        * inspector/front-end/ScriptsPanel.js:
+        * inspector/front-end/SourceFile.js:
+        (WebInspector.SourceFile.prototype._requestContent):
+        (WebInspector.SourceFile.prototype._loadResourceContent):
+        (WebInspector.SourceFile.prototype._loadAndConcatenateScriptsContent):
+        (WebInspector.SourceFile.prototype._concatenateScriptsContent):
+
+2011-03-23  Leandro Gracia Gil  <leandrogracia@chromium.org>
+
+        Reviewed by Steve Block.
+
+        Media Stream API: add a flag to RuntimeEnabledFeatures.
+        https://bugs.webkit.org/show_bug.cgi?id=56921
+
+        Add a flag to RuntimeEnabledFeatures to check if the Media Stream API is enabled at runtime.
+
+        Tests for the Media Stream API will be provided by the bug 56587.
+
+        * bindings/generic/RuntimeEnabledFeatures.cpp:
+        * bindings/generic/RuntimeEnabledFeatures.h:
+        (WebCore::RuntimeEnabledFeatures::mediaStreamEnabled):
+        (WebCore::RuntimeEnabledFeatures::setMediaStreamEnabled):
+        (WebCore::RuntimeEnabledFeatures::webkitGetUserMediaEnabled):
+
+2011-03-23  Carol Szabo  <carol.szabo@nokia.com>
+
+        Reviewed by David Hyatt.
+
+        Modified RenderCounter::originalText() to correctly attach
+        the created counter to the before/after container even when
+        that is not the RenderCounter's direct parent.
+
+        CSS 2.1 failure: various before-after-* tests fail
+        https://bugs.webkit.org/show_bug.cgi?id=47207
+
+        Test: fast/css/counters/complex-before.html
+
+        * rendering/RenderCounter.cpp:
+        (WebCore::RenderCounter::originalText):
+
+2011-03-23  Gyuyoung Kim  <gyuyoung.kim@samsung.com>
+
+        Reviewed by Antonio Gomes.
+
+        [EFL] Add play / pause button to media control
+        https://bugs.webkit.org/show_bug.cgi?id=55463
+
+        Add play|pause button to media control.
+
+        * platform/efl/RenderThemeEfl.cpp:
+        (WebCore::RenderThemeEfl::edjeGroupFromFormType):
+        (WebCore::RenderThemeEfl::emitMediaButtonSignal): Added.
+        (WebCore::RenderThemeEfl::paintMediaPlayButton):
+        * platform/efl/RenderThemeEfl.h:
+
+2011-03-23  Aparna Nandyal  <aparna.nand@wipro.com>
+
+        Reviewed by Andreas Kling.
+
+        [Qt] QtWebKit rendering problem when maximizing and doing a back
+        https://bugs.webkit.org/show_bug.cgi?id=56669
+
+        Contents of the page are not re-sized on going back after
+        maximizing. ContentsResized() is not getting called. Hence old
+        document width and height are used. Corrected this behaviour by 
+        calling setBoundsSize() which calls contentsSize(). 
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::open):
+
+2011-03-21  Pavel Podivilov  <podivilov@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: add support for formating source files in debugger presentation model.
+        https://bugs.webkit.org/show_bug.cgi?id=56558
+
+        * inspector/front-end/DebuggerModel.js:
+        (WebInspector.DebuggerModel.prototype.reset):
+        (WebInspector.DebuggerModel.prototype.get scripts):
+        * inspector/front-end/DebuggerPresentationModel.js:
+        (WebInspector.DebuggerPresentationModel):
+        (WebInspector.DebuggerPresentationModel.prototype._addScript):
+        (WebInspector.DebuggerPresentationModel.prototype._refreshBreakpoints):
+        (WebInspector.DebuggerPresentationModel.prototype.toggleFormatSourceFiles):
+        (WebInspector.DebuggerPresentationModel.prototype.continueToLine):
+        (WebInspector.DebuggerPresentationModel.prototype.setBreakpoint):
+        (WebInspector.DebuggerPresentationModel.prototype._breakpointAdded):
+        (WebInspector.DebuggerPresentationModel.prototype.set selectedCallFrame):
+        (WebInspector.DebuggerPresentationModel.prototype._sourceFileForScript):
+        (WebInspector.DebuggerPresentationModel.prototype._reset):
+        * inspector/front-end/ScriptFormatter.js:
+        (WebInspector.ScriptFormatter.prototype.formatContent.didFormatChunks):
+        (WebInspector.ScriptFormatter.prototype.formatContent):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel):
+        (WebInspector.ScriptsPanel.prototype.reset):
+        (WebInspector.ScriptsPanel.prototype._toggleFormatSourceFiles):
+        * inspector/front-end/Settings.js:
+        * inspector/front-end/SourceFile.js:
+        (WebInspector.SourceFile.prototype.scriptLocationToSourceLocation):
+        (WebInspector.SourceFile.prototype.sourceLocationToScriptLocation):
+        (WebInspector.FormattedSourceFile):
+        (WebInspector.FormattedSourceFile.prototype.scriptLocationToSourceLocation):
+        (WebInspector.FormattedSourceFile.prototype.sourceLocationToScriptLocation):
+        (WebInspector.FormattedSourceFile.prototype._didRequestContent):
+
+2011-03-23  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: use unsigned char instead of char when storing script source
+        https://bugs.webkit.org/show_bug.cgi?id=56920
+
+        * bindings/v8/DebuggerScript.js:
+        * bindings/v8/ScriptDebugServer.cpp:
+        (WebCore::ScriptDebugServer::ensureDebuggerScriptCompiled):
+        * inspector/InjectedScriptManager.cpp:
+        (WebCore::InjectedScriptManager::injectedScriptSource):
+        * inspector/InjectedScriptSource.js: whitespace change to trigger compilation
+        * inspector/xxd.pl:
+        * xml/XMLViewer.xsl:
+
+2011-03-23  Ilya Tikhonovsky  <loislo@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: move node searching and node highlight related methods from InspectorAgent to InspectorDOMAgent.
+        https://bugs.webkit.org/show_bug.cgi?id=56912
+
+        The next functions were moved:
+            setSearchingForNode
+            highlightDOMNode
+            hideDOMNodeHighlight
+            highlightFrame
+            hideFrameHighlight
+            mouseDidMoveOverElement
+            handleMousePress
+
+        The code which does real highlight in Graphic context was moved to new files DOMNodeHighlighter.*
+
+        * CMakeLists.txt:
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * inspector/DOMNodeHighlighter.cpp: Added.
+        (WebCore::DOMNodeHighlighter::DrawNodeHighlight):
+        * inspector/DOMNodeHighlighter.h: Added.
+        * inspector/Inspector.json:
+        * inspector/InspectorAgent.cpp:
+        (WebCore::InspectorAgent::InspectorAgent):
+        (WebCore::InspectorAgent::~InspectorAgent):
+        (WebCore::InspectorAgent::inspectedPageDestroyed):
+        (WebCore::InspectorAgent::disconnectFrontend):
+        * inspector/InspectorAgent.h:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::drawNodeHighlight):
+        (WebCore::InspectorController::hideHighlight):
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::InspectorDOMAgent):
+        (WebCore::InspectorDOMAgent::~InspectorDOMAgent):
+        (WebCore::InspectorDOMAgent::clearFrontend):
+        (WebCore::InspectorDOMAgent::handleMousePress):
+        (WebCore::InspectorDOMAgent::mouseDidMoveOverElement):
+        (WebCore::InspectorDOMAgent::searchingForNodeInPage):
+        (WebCore::InspectorDOMAgent::setSearchingForNode):
+        (WebCore::InspectorDOMAgent::highlight):
+        (WebCore::InspectorDOMAgent::highlightDOMNode):
+        (WebCore::InspectorDOMAgent::highlightFrame):
+        (WebCore::InspectorDOMAgent::hideHighlight):
+        (WebCore::InspectorDOMAgent::drawNodeHighlight):
+        * inspector/InspectorDOMAgent.h:
+        (WebCore::InspectorDOMAgent::hideDOMNodeHighlight):
+        (WebCore::InspectorDOMAgent::hideFrameHighlight):
+        * inspector/InspectorInstrumentation.cpp:
+        (WebCore::InspectorInstrumentation::mouseDidMoveOverElementImpl):
+        (WebCore::InspectorInstrumentation::handleMousePressImpl):
+        * inspector/InstrumentingAgents.h:
+        (WebCore::InstrumentingAgents::InstrumentingAgents):
+        (WebCore::InstrumentingAgents::inspectorAgent):
+        (WebCore::InstrumentingAgents::setInspectorAgent):
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.prototype.setSearchingForNode):
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.FrameTreeElement.prototype.onselect):
+        (WebInspector.FrameTreeElement.prototype.set hovered):
+        * inspector/front-end/inspector.js:
+        (WebInspector.highlightDOMNode):
+
+2011-03-23  Yury Semikhatsky  <yurys@chromium.org>
+
+        Unreviewed. Rollout r81768 which broke compilation on Win.
+
+        * xml/XMLTreeViewer.cpp:
+        (WebCore::XMLTreeViewer::transformDocumentToTreeView):
+        * xml/XMLViewer.xsl:
+
+2011-03-23  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: remove unnecessary reinterpret_cast in XMLTreeViewer
+        https://bugs.webkit.org/show_bug.cgi?id=56919
+
+        * xml/XMLTreeViewer.cpp:
+        (WebCore::XMLTreeViewer::transformDocumentToTreeView):
+        * xml/XMLViewer.xsl: whitespace change to trigger compilation.
+
+2011-03-21  Pavel Podivilov  <podivilov@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: move content loading logic to a new SourceFile class.
+        https://bugs.webkit.org/show_bug.cgi?id=56748
+
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/front-end/DebuggerPresentationModel.js:
+        (WebInspector.DebuggerPresentationModel.prototype.requestSourceFileContent):
+        (WebInspector.DebuggerPresentationModel.prototype._addScript.contentChanged):
+        (WebInspector.DebuggerPresentationModel.prototype._addScript):
+        (WebInspector.DebuggerPresentationModel.prototype._scriptSourceChanged):
+        (WebInspector.DebuggerPresentationModel.prototype.set selectedCallFrame):
+        * inspector/front-end/SourceFile.js: Added.
+        (WebInspector.SourceFile):
+        (WebInspector.SourceFile.prototype.addScript):
+        (WebInspector.SourceFile.prototype.requestContent):
+        (WebInspector.SourceFile.prototype.forceLoadContent):
+        (WebInspector.SourceFile.prototype.reload):
+        (WebInspector.SourceFile.prototype._requestContent):
+        (WebInspector.SourceFile.prototype._loadResourceContent):
+        (WebInspector.SourceFile.prototype._loadScriptContent):
+        (WebInspector.SourceFile.prototype._loadAndConcatenateScriptsContent):
+        (WebInspector.SourceFile.prototype._didRequestContent):
+        (WebInspector.SourceFile.prototype._hasPendingResource):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.html:
+
+2011-03-23  Pavel Podivilov  <podivilov@chromium.org>
+
+        Unreviewed, fix compilation broken by r81758.
+
+        * xml/XMLTreeViewer.cpp:
+        (WebCore::XMLTreeViewer::transformDocumentToTreeView):
+
+2011-03-23  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: define array types properly in the Inspector.json
+        https://bugs.webkit.org/show_bug.cgi?id=56915
+
+        * inspector/Inspector.json:
+        * inspector/generate-inspector-idl:
+
+2011-03-23  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        [V8] Web Inspector: compile DebuggerScript.js into DebuggerScriptSource.h
+        https://bugs.webkit.org/show_bug.cgi?id=56843
+
+        * inspector/front-end/WebKit.qrc:
+
+2011-03-23  Andrey Adaikin  <aandrey@google.com>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: Add a star while editing a source code
+        https://bugs.webkit.org/show_bug.cgi?id=56743
+
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype.setScriptSourceIsBeingEdited):
+        (WebInspector.SourceFrameDelegateForScriptsPanel.prototype.setScriptSourceIsBeingEdited):
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype._startEditing):
+        (WebInspector.SourceFrame.prototype._registerShortcuts):
+        (WebInspector.SourceFrame.prototype._handleSave):
+        (WebInspector.SourceFrame.prototype._handleRevertEditing):
+        (WebInspector.SourceFrameDelegate.prototype.setScriptSourceIsBeingEdited):
+
+2011-03-23  Andrey Adaikin  <aandrey@google.com>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: Scrolling and navigation is not smooth on a script with many long lines
+        https://bugs.webkit.org/show_bug.cgi?id=56559
+
+        * inspector/front-end/TextViewer.js:
+        (WebInspector.TextEditorChunkedPanel.prototype._expandChunks):
+        (WebInspector.TextEditorMainPanel.prototype._expandChunks):
+        (WebInspector.TextEditorMainPanel.prototype._highlightDataReady):
+        (WebInspector.TextEditorMainPanel.prototype._schedulePaintLines):
+        (WebInspector.TextEditorMainPanel.prototype._paintScheduledLines):
+        (WebInspector.TextEditorMainPanel.prototype._restorePaintLinesOperationsCredit):
+        (WebInspector.TextEditorMainPanel.prototype._paintLines):
+        (WebInspector.TextEditorMainPanel.prototype._paintLine):
+        (WebInspector.TextEditorMainPanel.prototype._applyDomUpdates):
+
+2011-03-22  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        [V8] Web Inspector: compile DebuggerScript.js into DebuggerScriptSource.h
+        https://bugs.webkit.org/show_bug.cgi?id=56843
+
+        DebuggerScript.js is now translated into a char[] array before inspector compilation.
+
+        * WebCore.gyp/WebCore.gyp:
+        * WebCore.gypi:
+        * bindings/v8/ScriptDebugServer.cpp:
+        (WebCore::ScriptDebugServer::ensureDebuggerScriptCompiled):
+        * bindings/v8/ScriptDebugServer.h:
+        * inspector/InjectedScriptManager.cpp:
+        (WebCore::InjectedScriptManager::injectedScriptSource):
+        * inspector/InjectedScriptSource.js: whitespace change to trigger InjectedScriptSource.h generation.
+        * inspector/xxd.pl:
+
+2011-03-23  Mark Rowe  <mrowe@apple.com>
+
+        Fix the 32-bit build.
+
+        * html/canvas/WebGLRenderingContext.cpp:
+        (WebCore::WebGLRenderingContext::initializeNewContext):
+
+2011-03-22  Noel Gordon  <noel.gordon@gmail.com>
+
+        Reviewed by Ojan Vafai.
+
+        [chromium] skia image encoders should use <wtf/Vector.h>
+        https://bugs.webkit.org/show_bug.cgi?id=56893
+
+        No new tests. Covered by existing canvas.toDataURL tests.
+
+        * platform/image-encoders/skia/JPEGImageEncoder.h:
+        * platform/image-encoders/skia/PNGImageEncoder.h:
+
+2011-03-22  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        Move the cellWidthChanged bit out of RenderObject and back down into RenderTableCell in order to
+        free up a bit for another performance optimization I have planned.
+
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::RenderObject):
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::setHasColumns):
+        * rendering/RenderTableCell.cpp:
+        (WebCore::RenderTableCell::RenderTableCell):
+        * rendering/RenderTableCell.h:
+        (WebCore::RenderTableCell::cellWidthChanged):
+        (WebCore::RenderTableCell::setCellWidthChanged):
+
+2011-03-22  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=56892
+        
+        Adding floats to an empty block is O(n^2). 
+
+        If you just add floats back to back to an empty block, the addition is essentially O(n^2)
+        once the floats move below your current line position.  This is because we repeatedly ask for the
+        available width for the line from scratch every time we add a float, regardless of whether the
+        float even vertically intersected our current line position.
+        
+        Change positionNewFloatOnLine to update left and right line offsets intelligently and to only
+        do it based off the single new float that just got added.
+        
+        This fix cuts the IE MazeSolver time in half.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::positionNewFloatOnLine):
+        * rendering/RenderBlock.h:
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::skipLeadingWhitespace):
+        (WebCore::RenderBlock::findNextLineBreak):
+
+2011-03-22  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=56890 It is possible to calculate a 
+        NaN value for "value" in ScrollbarThemeMac::paint()
+        -and corresponding-
+        <rdar://problem/9160621>
+
+        * platform/mac/ScrollbarThemeMac.mm:
+        (WebCore::ScrollbarThemeMac::paint):
+
+2011-03-17  Ojan Vafai  <ojan@chromium.org>
+
+        Reviewed by Antti Koivisto.
+
+        webkit should implement -moz-any selector (as -webkit-any obviously)
+        https://bugs.webkit.org/show_bug.cgi?id=38095
+
+        For now, match the Mozilla implementation with respect to specificity
+        and only allowing simple selectors. Both of these are likely to change
+        pending discussion on www-style@. 
+
+        Tests: fast/css/pseudo-any.html
+               fast/dom/SelectorAPI/unknown-pseudo.html
+
+        * css/CSSGrammar.y:
+        Create simple_selector_list. This is exactly like selector_list
+        except it only allows simple selectors and creates a new vector
+        instead of a reusable one since there can be multiple in one rule.
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::~CSSParser):
+        (WebCore::CSSParser::lex):
+        (WebCore::CSSParser::createFloatingSelectorVector):
+        (WebCore::CSSParser::sinkFloatingSelectorVector):
+        * css/CSSParser.h:
+        * css/CSSParserValues.cpp:
+        (WebCore::CSSParserSelector::adoptSelectorVector):
+        * css/CSSParserValues.h:
+        * css/CSSSelector.cpp:
+        (WebCore::CSSSelector::specificityForOneSelector):
+        (WebCore::CSSSelector::pseudoId):
+        (WebCore::nameToPseudoTypeMap):
+        (WebCore::CSSSelector::extractPseudoType):
+        (WebCore::CSSSelector::selectorText):
+        (WebCore::CSSSelector::setSelectorList):
+        (WebCore::CSSSelector::RareData::RareData):
+        (WebCore::CSSSelector::RareData::~RareData):
+        These need to be moved into the cpp file so that we can
+        have an OwnPtr<CSSSelectorList> in CSSSelector::RareData.
+        * css/CSSSelector.h:
+        (WebCore::CSSSelector::selectorList):
+        * css/CSSSelectorList.cpp:
+        (WebCore::forEachTagSelector):
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::SelectorChecker::checkOneSelector):
+        (WebCore::collectFeaturesFromSelector):
+        * css/tokenizer.flex:
+
+2011-03-22  John Bauman  <jbauman@chromium.org>
+
+        Reviewed by Kenneth Russell.
+
+        Add support for preserveDrawingBuffer context creation attribute
+        https://bugs.webkit.org/show_bug.cgi?id=56431
+
+        For the accelerated compositing case, only prepare the texture if it
+        has been updated since the last composite. For the non-accelerated case, make sure to
+        grab a copy of the image buffer and paint from that if the backbuffer
+        would be cleared.
+
+        In both cases, make sure to clear the context's backbuffer before the
+        first operation that uses it.
+
+        No new tests. It seems to be difficult/impossible to trigger an early
+        compositing operation in DumpRenderTree, making this hard to
+        test automatically. However, Chromium and Safari (Mac) have been
+        tested manually on the webgl conformance test for this.
+
+        * html/HTMLCanvasElement.cpp:
+        (WebCore::HTMLCanvasElement::paint):
+        (WebCore::HTMLCanvasElement::makePresentationCopy):
+        (WebCore::HTMLCanvasElement::clearPresentationCopy):
+        * html/HTMLCanvasElement.h:
+        * html/canvas/WebGLContextAttributes.cpp:
+        (WebCore::WebGLContextAttributes::preserveDrawingBuffer):
+        (WebCore::WebGLContextAttributes::setPreserveDrawingBuffer):
+        * html/canvas/WebGLContextAttributes.h:
+        * html/canvas/WebGLContextAttributes.idl:
+        * html/canvas/WebGLRenderingContext.cpp:
+        (WebCore::WebGLRenderingContext::initializeNewContext):
+        (WebCore::WebGLRenderingContext::markContextChanged):
+        (WebCore::WebGLRenderingContext::clearIfComposited):
+        (WebCore::WebGLRenderingContext::markLayerComposited):
+        (WebCore::WebGLRenderingContext::paintRenderingResultsToCanvas):
+        (WebCore::WebGLRenderingContext::paintRenderingResultsToImageData):
+        (WebCore::WebGLRenderingContext::clear):
+        (WebCore::WebGLRenderingContext::clearColor):
+        (WebCore::WebGLRenderingContext::clearDepth):
+        (WebCore::WebGLRenderingContext::clearStencil):
+        (WebCore::WebGLRenderingContext::colorMask):
+        (WebCore::WebGLRenderingContext::disable):
+        (WebCore::WebGLRenderingContext::drawArrays):
+        (WebCore::WebGLRenderingContext::drawElements):
+        (WebCore::WebGLRenderingContext::enable):
+        (WebCore::WebGLRenderingContext::readPixels):
+        * html/canvas/WebGLRenderingContext.h:
+        * platform/graphics/GraphicsContext3D.h:
+        (WebCore::GraphicsContext3D::Attributes::Attributes):
+        * platform/graphics/chromium/WebGLLayerChromium.cpp:
+        (WebCore::WebGLLayerChromium::updateContentsIfDirty):
+        (WebCore::WebGLLayerChromium::textureUpdated):
+        (WebCore::WebGLLayerChromium::setContext):
+        * platform/graphics/chromium/WebGLLayerChromium.h:
+        * platform/graphics/mac/GraphicsContext3DMac.mm
+        (WebCore::GraphicsContext3D::GraphicsContext3D):
+        (WebCore::GraphicsContext3D::~GraphicsContext3D):
+        * platform/graphics/opengl/GraphicsContext3DOpenGL.cpp:
+        (WebCore::GraphicsContext3D::reshape):
+        (WebCore::GraphicsContext3D::prepareTexture):
+        (WebCore::GraphicsContext3D::activeTexture):
+        (WebCore::GraphicsContext3D::bindTexture):
+        (WebCore::GraphicsContext3D::markContextChanged):
+        (WebCore::GraphicsContext3D::markLayerComposited):
+        (WebCore::GraphicsContext3D::layerComposited):
+        * platform/graphics/qt/GraphicsContext3DQt.cpp:
+        (WebCore::GraphicsContext3DInternal::GraphicsContext3DInternal):
+        (WebCore::GraphicsContext3D::markLayerComposited):
+        (WebCore::GraphicsContext3D::markContextChanged):
+        (WebCore::GraphicsContext3D::layerComposited):
+
+2011-03-22  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Mark Rowe.
+
+        Remove USE_WK_SCROLLBAR_PAINTER_AND_CONTROLLER.
+        <rdar://problem/8944718> 
+
+        * DerivedSources.make:
+        Remove generation of HeaderDetection.h.
+
+        * WebCore.xcodeproj/project.pbxproj:
+        Remove HeaderDetection.h.
+
+        * platform/mac/ScrollAnimatorMac.h:
+        * platform/mac/ScrollAnimatorMac.mm:
+        * platform/mac/ScrollbarThemeMac.h:
+        * platform/mac/ScrollbarThemeMac.mm:
+        Replace use of USE_WK_SCROLLBAR_PAINTER_AND_CONTROLLER with USE(WK_SCROLLBAR_PAINTER).
+
+2011-03-22  Victoria Kirst  <vrk@google.com>
+
+        Reviewed by Kenneth Russell.
+
+        [chromium] Properly reset VideoLayerChromium textures after lost renderer context
+        https://bugs.webkit.org/show_bug.cgi?id=56514
+
+        The VideoLayerChromium textures were still mapped to the old
+        renderer's context when LayerRendererChromium was being recreated
+        i.e. when GPU process is killed. This patch allows VideoLayerChromium
+        it recreate textures in the new context when the old renderer is lost.
+        Patch also does a bit of refactoring and code clean-up.
+
+        * platform/graphics/chromium/VideoLayerChromium.cpp:
+        (WebCore::VideoLayerChromium::~VideoLayerChromium):
+        (WebCore::VideoLayerChromium::cleanupResources):
+        (WebCore::VideoLayerChromium::updateContentsIfDirty):
+        (WebCore::VideoLayerChromium::allocateTexturesIfNeeded):
+        (WebCore::VideoLayerChromium::computeVisibleSize):
+        (WebCore::VideoLayerChromium::drawYUV):
+        (WebCore::VideoLayerChromium::drawRGBA):
+        (WebCore::VideoLayerChromium::resetFrameParameters):
+        (WebCore::VideoLayerChromium::saveCurrentFrame):
+        * platform/graphics/chromium/VideoLayerChromium.h:
+
+2011-03-22  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        WebCore GYP build should export the headers needed by WebKit
+        https://bugs.webkit.org/show_bug.cgi?id=56883
+
+        * WebCore.gypi:
+        * gyp/WebCore.gyp:
+            - Export a couple more headers.
+            - Remove FIXME comments for things we've already fixed.
+
+2011-03-22  Anton D'Auria  <adauria@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Add +[WebApplicationCache getOriginsWithCache]
+        https://bugs.webkit.org/show_bug.cgi?id=56722
+
+        Added test that exercises WebCore API to get origins with application cache.
+
+        Test: http/tests/appcache/origins-with-appcache.html
+
+        * loader/appcache/ApplicationCacheStorage.cpp: 
+        (WebCore::ApplicationCacheStorage::getOriginsWithCache):
+        * loader/appcache/ApplicationCacheStorage.h:
+
+2011-03-22  Carol Szabo  <carol.szabo@nokia.com>
+
+        Reviewed by David Hyatt.
+
+        Introduced double linkage between a CounterNode and its display renderer.
+
+        use of freed pointer in WebCore::RenderCounter::originalText()
+        https://bugs.webkit.org/show_bug.cgi?id=56065
+
+        No new tests. This bug could only be reproduced manually by
+        refreshing the page during load at a critical point.
+        See bug attachment for testing.
+
+        * rendering/CounterNode.cpp:
+        Introduced new member "m_owner" to store the renderer that has the
+        style directives that produce the CounterNode.
+        Repurposed m_renderer to reffer to the RenderCounter that shows the
+        CounterNode.
+        (WebCore::CounterNode::CounterNode):
+        Updated member initialization.
+        (WebCore::CounterNode::create):
+        (WebCore::CounterNode::addRenderer):
+        (WebCore::CounterNode::removeRenderer):
+        Introduced to manage the renderer list associated wit this CounterNode.
+        (WebCore::CounterNode::resetRenderers):
+        This is the old resetRenderer. Renamed to take into account that there may be
+        more than one renderer to a CounterNode.
+        (WebCore::CounterNode::resetThisAndDescendantsRenderers):
+        This is the old resetRenderers renamed for clarity.
+        (WebCore::CounterNode::recount):
+        (WebCore::CounterNode::insertAfter):
+        (WebCore::CounterNode::removeChild):
+        No functional changes.
+        (WebCore::showTreeAndMark):
+        Added flushing to ensure that the output is complete.
+        * rendering/CounterNode.h:
+        (WebCore::CounterNode::owner):
+        Renamed from renderer()
+        * rendering/RenderCounter.cpp:
+        (WebCore::findPlaceForCounter):
+        Fixed comments. No functional changes.
+        (WebCore::RenderCounter::~RenderCounter):
+        Made sure that the CounterNode that this renderers displays is
+        detached from this.
+        (WebCore::RenderCounter::originalText):
+        (WebCore::RenderCounter::invalidate):
+        Changed to maintain the bidirectional relationship with the displayed CounterNode.
+        Also made "invalidate" private as it should be used only by CounterNode.
+        (WebCore::destroyCounterNodeWithoutMapRemoval):
+        (WebCore::RenderCounter::destroyCounterNodes):
+        (WebCore::RenderCounter::destroyCounterNode):
+        (WebCore::updateCounters):
+        No change, just kept code in line with the changes above.
+        (showCounterRendererTree):
+        Added fflush to ensure complete display.
+        * rendering/RenderCounter.h:
+        * rendering/RenderObjectChildList.cpp:
+        * rendering/RenderObjectChildList.h:
+        Removed unneeded invalidateCounters related functions.
+
+2011-03-22  Dean Jackson  <dino@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=56242
+        Interrupted accelerated animations/transitions were causing
+        subsequent animations to not start (because they were stuck
+        waiting for a response from the compositing layer). I renamed
+        the instance variable that indicates whether or not to
+        notify animations of start time, from m_waitingForStartTimeResponse
+        to m_waitingForAsyncStartNotification, so that it makes more sense.
+        The actual bug fix was changing the logic so that the flag is reset
+        when the list of waiting animations becomes empty. I mistakenly committed
+        the bad logic in r81613.
+
+        * page/animation/AnimationBase.cpp:
+        (WebCore::AnimationBase::updateStateMachine):
+        - Always set paused time as we enter the paused state
+        * page/animation/AnimationController.cpp:
+        (WebCore::AnimationControllerPrivate::AnimationControllerPrivate):
+        (WebCore::AnimationControllerPrivate::endAnimationUpdate):
+        (WebCore::AnimationControllerPrivate::receivedStartTimeResponse):
+        (WebCore::AnimationControllerPrivate::addToAnimationsWaitingForStartTimeResponse):
+        (WebCore::AnimationControllerPrivate::removeFromAnimationsWaitingForStartTimeResponse):
+        - reset the waiting flag when the list is empty (rather than not empty)
+        (WebCore::AnimationControllerPrivate::startTimeResponse):
+        * page/animation/AnimationControllerPrivate.h:
+        - rename m_waitingForStartTimeResponse to m_waitingForAsyncStartNotification
+
+2011-03-22  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        <rdar://problem/8648311> and https://bugs.webkit.org/show_bug.cgi?id=56876
+        WK2 Icon DB: Expand IconDatabaseClient interface and move it to the main thread
+
+        * loader/icon/IconDatabase.cpp:
+        Add a dummy client implementation for non-Mac, non-Win ports:
+        (WebCore::DefaultIconDatabaseClient::performImport):
+        (WebCore::DefaultIconDatabaseClient::didImportIconURLForPageURL):
+        (WebCore::DefaultIconDatabaseClient::didImportIconDataForPageURL):
+        (WebCore::DefaultIconDatabaseClient::didChangeIconForPageURL):
+        (WebCore::DefaultIconDatabaseClient::didRemoveAllIcons):
+        (WebCore::DefaultIconDatabaseClient::didFinishURLImport):
+        (WebCore::defaultClient):
+
+        Either call the client directly when on the main thread, or use the dispatch functions below
+        if on the background thread:
+        (WebCore::IconDatabase::setIconDataForIconURL):
+        (WebCore::IconDatabase::setIconURLForPageURL):
+        (WebCore::IconDatabase::performURLImport):
+        (WebCore::IconDatabase::readFromDatabase):
+        (WebCore::IconDatabase::removeAllIconsOnThread):
+
+        Add a very targeted WorkItem interface for dispatching client calls on the main thread:
+        (WebCore::ClientWorkItem::ClientWorkItem):
+        (WebCore::ClientWorkItem::~ClientWorkItem):
+        (WebCore::ImportedIconURLForPageURLWorkItem::ImportedIconURLForPageURLWorkItem):
+        (WebCore::ImportedIconURLForPageURLWorkItem::~ImportedIconURLForPageURLWorkItem):
+        (WebCore::ImportedIconURLForPageURLWorkItem::performWork):
+        (WebCore::ImportedIconDataForPageURLWorkItem::ImportedIconDataForPageURLWorkItem):
+        (WebCore::ImportedIconDataForPageURLWorkItem::~ImportedIconDataForPageURLWorkItem):
+        (WebCore::ImportedIconDataForPageURLWorkItem::performWork):
+        (WebCore::RemovedAllIconsWorkItem::RemovedAllIconsWorkItem):
+        (WebCore::RemovedAllIconsWorkItem::performWork):
+        (WebCore::performWorkItem):
+
+        Use the client WorkItem interface to perform these callbacks on the main thread:
+        (WebCore::IconDatabase::dispatchDidImportIconURLForPageURLOnMainThread):
+        (WebCore::IconDatabase::dispatchDidImportIconDataForPageURLOnMainThread):
+        (WebCore::IconDatabase::dispatchDidRemoveAllIconsOnMainThread):
+        * loader/icon/IconDatabase.h:
+        * loader/icon/IconDatabaseClient.h:
+
+2011-03-22  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=56869
+        
+        Make horizontal writing mode a bit on RenderObject with a fast inlined method for access. This should be
+        a little faster than having to access the information from the RenderStyle's sub-structure.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::layoutBlock):
+        (WebCore::RenderBlock::addOverflowFromChildren):
+        (WebCore::RenderBlock::computeOverflow):
+        (WebCore::RenderBlock::adjustPositionedBlock):
+        (WebCore::RenderBlock::setLogicalLeftForChild):
+        (WebCore::RenderBlock::setLogicalTopForChild):
+        (WebCore::RenderBlock::layoutPositionedObjects):
+        (WebCore::RenderBlock::paintColumnRules):
+        (WebCore::RenderBlock::paintColumnContents):
+        (WebCore::RenderBlock::flipFloatForWritingMode):
+        (WebCore::blockDirectionOffset):
+        (WebCore::inlineDirectionOffset):
+        (WebCore::RenderBlock::logicalRectToPhysicalRect):
+        (WebCore::RenderBlock::inlineSelectionGaps):
+        (WebCore::RenderBlock::addOverhangingFloats):
+        (WebCore::RenderBlock::addIntrudingFloats):
+        (WebCore::RenderBlock::hitTestColumns):
+        (WebCore::positionForPointRespectingEditingBoundaries):
+        (WebCore::RenderBlock::positionForPointWithInlineChildren):
+        (WebCore::RenderBlock::positionForPoint):
+        (WebCore::RenderBlock::columnRectAt):
+        (WebCore::RenderBlock::adjustPointToColumnContents):
+        (WebCore::RenderBlock::adjustRectForColumns):
+        (WebCore::RenderBlock::flipForWritingModeIncludingColumns):
+        (WebCore::RenderBlock::adjustForColumns):
+        (WebCore::RenderBlock::lastLineBoxBaseline):
+        (WebCore::RenderBlock::nextPageLogicalTop):
+        (WebCore::RenderBlock::adjustForUnsplittableChild):
+        (WebCore::RenderBlock::adjustLinePositionForPagination):
+        (WebCore::RenderBlock::collapsedMarginBeforeForChild):
+        (WebCore::RenderBlock::collapsedMarginAfterForChild):
+        (WebCore::RenderBlock::marginStartForChild):
+        (WebCore::RenderBlock::marginEndForChild):
+        (WebCore::RenderBlock::setMarginStartForChild):
+        (WebCore::RenderBlock::setMarginEndForChild):
+        (WebCore::RenderBlock::marginValuesForChild):
+        * rendering/RenderBlock.h:
+        (WebCore::RenderBlock::logicalWidthForChild):
+        (WebCore::RenderBlock::logicalHeightForChild):
+        (WebCore::RenderBlock::logicalTopForChild):
+        (WebCore::RenderBlock::logicalRightOffsetForContent):
+        (WebCore::RenderBlock::logicalLeftOffsetForContent):
+        (WebCore::RenderBlock::logicalTopForFloat):
+        (WebCore::RenderBlock::logicalBottomForFloat):
+        (WebCore::RenderBlock::logicalLeftForFloat):
+        (WebCore::RenderBlock::logicalRightForFloat):
+        (WebCore::RenderBlock::logicalWidthForFloat):
+        (WebCore::RenderBlock::setLogicalTopForFloat):
+        (WebCore::RenderBlock::setLogicalLeftForFloat):
+        (WebCore::RenderBlock::setLogicalHeightForFloat):
+        (WebCore::RenderBlock::setLogicalWidthForFloat):
+        (WebCore::RenderBlock::xPositionForFloatIncludingMargin):
+        (WebCore::RenderBlock::yPositionForFloatIncludingMargin):
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::createLineBoxes):
+        (WebCore::RenderBlock::layoutInlineChildren):
+        (WebCore::RenderBlock::checkFloatsInCleanLine):
+        (WebCore::setStaticPositions):
+        (WebCore::RenderBlock::findNextLineBreak):
+        (WebCore::RenderBlock::beforeSideVisualOverflowForLine):
+        (WebCore::RenderBlock::afterSideVisualOverflowForLine):
+        (WebCore::RenderBlock::beforeSideLayoutOverflowForLine):
+        (WebCore::RenderBlock::afterSideLayoutOverflowForLine):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::marginStart):
+        (WebCore::RenderBox::marginEnd):
+        (WebCore::RenderBox::setMarginStart):
+        (WebCore::RenderBox::setMarginEnd):
+        (WebCore::RenderBox::styleDidChange):
+        (WebCore::RenderBox::logicalScroll):
+        (WebCore::RenderBox::computeLogicalWidth):
+        (WebCore::RenderBox::computeLogicalHeight):
+        (WebCore::RenderBox::availableLogicalHeightUsing):
+        (WebCore::RenderBox::containingBlockLogicalWidthForPositioned):
+        (WebCore::RenderBox::containingBlockLogicalHeightForPositioned):
+        (WebCore::RenderBox::computePositionedLogicalWidth):
+        (WebCore::computeLogicalLeftPositionedOffset):
+        (WebCore::RenderBox::computePositionedLogicalHeight):
+        (WebCore::computeLogicalTopPositionedOffset):
+        (WebCore::RenderBox::computePositionedLogicalWidthReplaced):
+        (WebCore::RenderBox::computePositionedLogicalHeightReplaced):
+        (WebCore::RenderBox::addLayoutOverflow):
+        (WebCore::RenderBox::flipForWritingMode):
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::updateBoxModelInfoFromStyle):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::RenderObject):
+        (WebCore::RenderObject::styleWillChange):
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::isHorizontalWritingMode):
+        (WebCore::RenderObject::setHorizontalWritingMode):
+        * rendering/RenderTableCell.cpp:
+        (WebCore::RenderTableCell::paddingTop):
+        (WebCore::RenderTableCell::paddingBottom):
+        (WebCore::RenderTableCell::paddingLeft):
+        (WebCore::RenderTableCell::paddingRight):
+        (WebCore::RenderTableCell::scrollbarsChanged):
+        * rendering/RootInlineBox.cpp:
+        (WebCore::RootInlineBox::RootInlineBox):
+        (WebCore::RootInlineBox::lineSelectionGap):
+        (WebCore::RootInlineBox::verticalPositionForBox):
+
+2011-03-22  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        Incorrect rendering of composited element with negative z-index child
+        https://bugs.webkit.org/show_bug.cgi?id=56846
+        
+        When a composited element has a child with negative z-index, we make
+        a separate layer for that element's foreground content. This layer
+        was positioned incorrectly (but the content happened to paint at
+        the right location), resulting in right/bottom clipping.
+        
+        Fix this, remove the little-used graphicsLayerToContentsCoordinates()
+        contentsToGraphicsLayerCoordinates() methods, and optimize incremental
+        repaints in the foreground and mask layers.
+
+        Tests: compositing/geometry/foreground-layer.html
+               compositing/geometry/repaint-foreground-layer.html
+
+        * platform/graphics/ca/GraphicsLayerCA.cpp:
+        (WebCore::GraphicsLayerCA::setNeedsDisplayInRect): Cull repaints
+        which fall outside the layer bounds, so callers don't have to,
+        and to avoid unnecessary layer commits.
+
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::updateGraphicsLayerGeometry): If
+        we have a foreground layer inside a clipping layer, the foreground
+        layer's offset is zero, since the clipping layer is its parent.
+        
+        (WebCore::RenderLayerBacking::setContentsNeedDisplayInRect): Use
+        offsetFromRenderer() directly instead of contentsToGraphicsLayerCoordinates().
+        Also do incremental repaints of the foreground and mask layers.
+        
+        (WebCore::RenderLayerBacking::paintContents): It was incorrect to always
+        use compositedBounds() to compute the painting offset, since that's
+        per-RenderLayerBacking, but a single RenderLayerBacking can have different
+        GraphicsLayers with different offsets (e.g. the foreground layer).
+        Instead, use offsetFromRenderer(), which gives has the correct offset.
+
+        * rendering/RenderLayerBacking.h: Remove unused methods.
+
+2011-03-22  Chris Rogers  <crogers@google.com>
+
+        Reviewed by Kenneth Russell.
+
+        Use default-output instead of default-input to get hardware sample-rate
+        https://bugs.webkit.org/show_bug.cgi?id=56858
+
+        No new tests since audio API is not yet implemented.
+
+        * platform/audio/mac/AudioDestinationMac.cpp:
+        (WebCore::AudioDestination::hardwareSampleRate):
+
+2011-03-22  Pratik Solanki  <psolanki@apple.com>
+
+        Reviewed by David Kilzer.
+
+        Implement -connection:didReceiveDataArray: NSURLConnection delegate method
+        https://bugs.webkit.org/show_bug.cgi?id=56838
+
+        Add experimental support for the didReceiveDataArray callback on
+        NSURLConnection. A RessourceHandleClient indicates its ability to
+        handle this callback by returning true from supportsDataArray() method.
+        Currently only SubresourceLoader uses this so we get the benefit for
+        CSS, JS and image loads. For other clients we call didReceiveData with
+        the CFData contents as before.
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * loader/ResourceLoader.h:
+        * loader/SubresourceLoader.h:
+        (WebCore::SubresourceLoader::supportsDataArray):
+        * loader/cf/SubresourceLoaderCF.cpp: Added.
+        (WebCore::SubresourceLoader::didReceiveDataArray):
+        * loader/mac/ResourceLoaderMac.mm:
+        (WebCore::ResourceLoader::didReceiveDataArray):
+        * platform/SharedBuffer.cpp:
+        (WebCore::SharedBuffer::clear):
+        (WebCore::SharedBuffer::buffer):
+        * platform/SharedBuffer.h:
+        * platform/cf/SharedBufferCF.cpp:
+        (WebCore::SharedBuffer::append):
+        (WebCore::SharedBuffer::copyDataArrayAndClear):
+        * platform/network/ResourceHandleClient.h:
+        (WebCore::ResourceHandleClient::supportsDataArray):
+        (WebCore::ResourceHandleClient::didReceiveDataArray):
+        * platform/network/mac/ResourceHandleMac.mm:
+        (-[WebCoreResourceHandleAsDelegate connection:didReceiveDataArray:]):
+
+2011-03-22  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Make it possible to build JavaScriptCore and WebCore gyp builds outside of Source
+        https://bugs.webkit.org/show_bug.cgi?id=56867
+
+        This should make it possible to build the gyp-generated WebCore.xcodeproj
+        from a WebCore directory outside of Source.
+
+        * gyp/WebCore.gyp:
+        * gyp/run-if-exists.sh: Added.
+        * gyp/update-info-plist.sh: Added.
+
+2011-03-22  Anders Carlsson  <andersca@apple.com>
+
+        Fix WebKit2 build.
+
+        * WebCore.exp.in:
+        Export a symbol needed by WebKit2.
+
+2011-03-22  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Add the remaining steps to WebCore GYP build
+        https://bugs.webkit.org/show_bug.cgi?id=56864
+
+        These steps match the normal build.  After this patch, I believe the
+        WebCore GYP build is complete.
+
+        * WebCore.gypi:
+        * gyp/WebCore.gyp:
+        * gyp/copy-inspector-resources.sh: Added.
+
+2011-03-22  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=56856 RenderListBox needs to be 
+        added to Page::scrollableAreaSet()
+
+        * rendering/RenderListBox.cpp:
+        (WebCore::RenderListBox::RenderListBox):
+        (WebCore::RenderListBox::~RenderListBox):
+        * rendering/RenderListBox.h:
+        (WebCore::RenderListBox::disconnectFromPage):
+
+2011-03-22  Chris Rogers  <crogers@google.com>
+
+        Reviewed by Kenneth Russell.
+
+        Add high-quality band-limited audio resampling algorithm
+        https://bugs.webkit.org/show_bug.cgi?id=56692
+
+        No new tests since audio API is not yet implemented.
+
+        * platform/audio/SincResampler.cpp: Added.
+        (WebCore::SincResampler::SincResampler):
+        (WebCore::SincResampler::initializeKernel):
+        (WebCore::SincResampler::consumeSource):
+        (WebCore::SincResampler::process):
+        * platform/audio/SincResampler.h: Added.
+
+2011-03-22  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        WebCore GYP build should build without help from normal WebCore build
+        https://bugs.webkit.org/show_bug.cgi?id=56860
+
+        Before this patch, the WebCore GYP build wasn't generating the derived
+        sources quite right because the ENABLE macros were not being
+        communicated to the "Derived Sources" target.
+
+        This patch also adds the "Copy Forwarding and ICU Headers" as well as
+        the "Streamline Inspector Source" steps, which are present in the
+        normal build.  Unlike the normal build, these steps occur in a new
+        target, called "WebCore Support", which is less than aesthetically
+        beautiful.  Hopefully we'll be able to move them into the WebCore
+        target proper in the future, but that will likely require some GYP
+        changes.
+
+        This patch probably could have been broken down into a couple smaller
+        patches, but that doesn't seem necessary.
+
+        * WebCore.gypi:
+            - This file appears to no longer exist.
+        * gyp/WebCore.gyp:
+        * gyp/copy-forwarding-and-icu-headers.sh: Added.
+        * gyp/streamline-inspector-source.sh: Added.
+
+2011-03-22  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=56859
+        
+        Floats in the floating object list occur in the order that they are positioned. This means
+        that for a given vertical offset, the last left object in the list that intersects that offset
+        will be the rightmost float. There is no need to check any previous floats, since they have to be
+        further left than that rightmost float. The same rules hold true for right-aligned floats.
+        
+        Change logicalLeft/RightOffsetForLine to iterate backwards instead of forwards and to stop the moment
+        they encounter a float that intersects the vertical range.
+        
+        This cuts the maze solving time for a 20x20 maze in the IE MazeSolver test in half.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::logicalLeftOffsetForLine):
+        (WebCore::RenderBlock::logicalRightOffsetForLine):
+
+2011-03-22  Justin Schuh  <jschuh@chromium.org>
+
+        Reviewed by Dirk Schulze.
+
+        SVG displacement map should validate channel selections
+        https://bugs.webkit.org/show_bug.cgi?id=56794
+
+        Test: svg/filters/feDisplacementMap-crash-test.xhtml
+
+        * svg/SVGFEDisplacementMapElement.cpp:
+        (WebCore::SVGFEDisplacementMapElement::svgAttributeChanged):
+
+2011-03-22  Huahui Wu  <mediadependent@gmail.com>
+
+        Reviewed by Steve Block.
+
+        [Android] Update PlatformTouchEvent for android so it can pass IDs and states around.
+        https://bugs.webkit.org/show_bug.cgi?id=56763
+
+        No new tests as no new functionality is exposed.
+
+        * platform/PlatformTouchEvent.h:
+        * platform/android/PlatformTouchEventAndroid.cpp:
+        (WebCore::PlatformTouchEvent::PlatformTouchEvent):
+
+2011-03-22  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Implement the CSS3 line-box-contain property. This property provides authors with more control over spacing between lines. For example,
+        you can fix the height of lines and cause all line contents to be ignored. You can make lines fit to glyphs. You can ignore leading and
+        fit to the font size. You can ignore replaced elements, etc.
+
+        Refactor the code in computeLogicalBoxHeights into helper methods on RootInlineBox. verticalPositionForBox moved over to RootInlineBox
+        so that it could be called from RenderBlockLineLayout. ascentAndDescentForBox is the new method that computes the appropriate box
+        height based off the block's line-box-contain value.
+        
+        GlyphOverflow can now have a computeBounds parameter set, in which case glyph bounds will be computed and stored in the overflow struct.
+        
+        RenderInline no longer returns 0 margins in the block direction, since line-box-contain can size around the margin box.
+        
+        Added new tests in fast/block/lineboxcontain
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::createLineBoxContainValue):
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+        * css/CSSLineBoxContainValue.cpp: Added.
+        (WebCore::CSSLineBoxContainValue::CSSLineBoxContainValue):
+        (WebCore::CSSLineBoxContainValue::cssText):
+        * css/CSSLineBoxContainValue.h: Added.
+        (WebCore::CSSLineBoxContainValue::create):
+        (WebCore::CSSLineBoxContainValue::value):
+        (WebCore::CSSLineBoxContainValue::isCSSLineBoxContainValue):
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue):
+        (WebCore::CSSParser::parseLineBoxContain):
+        * css/CSSParser.h:
+        * css/CSSPropertyNames.in:
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty):
+        * css/CSSValue.h:
+        (WebCore::CSSValue::isCSSLineBoxContainValue):
+        * css/CSSValueKeywords.in:
+        * platform/graphics/Font.cpp:
+        (WebCore::Font::width):
+        * platform/graphics/Font.h:
+        (WebCore::GlyphOverflow::GlyphOverflow):
+        * platform/graphics/FontFastPath.cpp:
+        (WebCore::Font::floatWidthForSimpleText):
+        * platform/graphics/mac/FontComplexTextMac.cpp:
+        (WebCore::Font::floatWidthForComplexText):
+        * platform/graphics/win/FontWin.cpp:
+        (WebCore::Font::floatWidthForComplexText):
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::computeLogicalBoxHeights):
+        * rendering/InlineFlowBox.h:
+        * rendering/RenderBlock.h:
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::computeInlineDirectionPositionsForLine):
+        (WebCore::RenderBlock::layoutInlineChildren):
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::marginLeft):
+        (WebCore::RenderInline::marginRight):
+        (WebCore::RenderInline::marginTop):
+        (WebCore::RenderInline::marginBottom):
+        (WebCore::RenderInline::marginBefore):
+        (WebCore::RenderInline::marginAfter):
+        * rendering/RenderInline.h:
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::widthFromCache):
+        (WebCore::RenderText::width):
+        * rendering/RootInlineBox.cpp:
+        (WebCore::RootInlineBox::alignBoxesInBlockDirection):
+        (WebCore::setAscentAndDescent):
+        (WebCore::RootInlineBox::ascentAndDescentForBox):
+        (WebCore::RootInlineBox::verticalPositionForBox):
+        (WebCore::RootInlineBox::includeLeadingForBox):
+        (WebCore::RootInlineBox::includeFontForBox):
+        (WebCore::RootInlineBox::includeGlyphsForBox):
+        (WebCore::RootInlineBox::includeMarginForBox):
+        (WebCore::RootInlineBox::fitsToGlyphs):
+        (WebCore::RootInlineBox::includesRootLineBoxFontOrLeading):
+        * rendering/RootInlineBox.h:
+        * rendering/style/RenderStyle.cpp:
+        (WebCore::RenderStyle::diff):
+        * rendering/style/RenderStyle.h:
+        (WebCore::InheritedFlags::lineBoxContain):
+        (WebCore::InheritedFlags::setLineBoxContain):
+        (WebCore::InheritedFlags::initialLineBoxContain):
+        * rendering/style/StyleRareInheritedData.cpp:
+        (WebCore::StyleRareInheritedData::StyleRareInheritedData):
+        (WebCore::StyleRareInheritedData::operator==):
+        * rendering/style/StyleRareInheritedData.h:
+
+2011-03-22  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r81653.
+        http://trac.webkit.org/changeset/81653
+        https://bugs.webkit.org/show_bug.cgi?id=56839
+
+        Breaks fast/text/drawBidiText.html on Chromium. (Requested by
+        pfeldman on #webkit).
+
+        * rendering/RenderListBox.cpp:
+        (WebCore::RenderListBox::paintItemForeground):
+
+2011-03-22  Pavel Feldman  <pfeldman@chromium.org>
+
+        Not reviewed. Rolling out 81657, 81654, 81651 for breaking tests on chromium.
+
+        * inspector/Inspector.json:
+        * inspector/InspectorDatabaseResource.cpp:
+        (WebCore::InspectorDatabaseResource::bind):
+        * inspector/front-end/Database.js:
+        (WebInspector.DatabaseDispatcher.prototype.addDatabase):
+
+2011-03-21  Pavel Podivilov  <podivilov@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: [REGRESSION] scripts panel is broken when frontend is reopened.
+        https://bugs.webkit.org/show_bug.cgi?id=56747
+
+        Debugger should be enabled on front-end side to guarantee initialization sequence (resources come before scripts).
+
+        * inspector/Inspector.json:
+        * inspector/InspectorAgent.cpp:
+        (WebCore::InspectorAgent::showProfilesPanel):
+        * inspector/InspectorAgent.h:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::InspectorController):
+        (WebCore::InspectorController::connectFrontend):
+        (WebCore::InspectorController::showAndEnableDebugger):
+        * inspector/InspectorController.h:
+        * inspector/InspectorDebuggerAgent.cpp:
+        (WebCore::InspectorDebuggerAgent::setFrontend):
+        (WebCore::InspectorDebuggerAgent::clearFrontend):
+        * inspector/InspectorDebuggerAgent.h:
+
+2011-03-22  Jarkko Sakkinen  <jarkko.j.sakkinen@gmail.com>
+
+        Reviewed by Benjamin Poulain.
+
+        [Qt] WebGL: renderbufferStorage() fails with internal format GL_RGBA4
+        https://bugs.webkit.org/show_bug.cgi?id=56824
+
+        On desktop OpenGL substitute in renderbufferStorage:
+        - GL_DEPTH24_STENCIL8 for GL_DEPTH_STENCIL
+        - GL_DEPTH_COMPONENT for GL_DEPTH_COMPONENT16
+        - GL_RGBA for GL_RGBA4 and GL_RGBA565
+        - GL_RGB for RGB5_A1.
+
+        Tests: fast/canvas/webgl/uninitialized-test.html
+
+        * platform/graphics/qt/GraphicsContext3DQt.cpp:
+        (WebCore::GraphicsContext3D::renderbufferStorage):
+
+2011-03-16  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Move volume slider positioning logic to a custom renderer.
+        https://bugs.webkit.org/show_bug.cgi?id=56498
+
+        No functional change, covered by existing tests.
+
+        * html/shadow/MediaControls.cpp:
+        (WebCore::MediaControls::updateVolumeSliderContainer): Removed positioning logic.
+        * rendering/MediaControlElements.cpp:
+        (WebCore::RenderMediaVolumeSliderContainer::RenderMediaVolumeSliderContainer): Added.
+        (WebCore::RenderMediaVolumeSliderContainer::layout): Added.
+        (WebCore::MediaControlVolumeSliderContainerElement::MediaControlVolumeSliderContainerElement): Removed storing of coordinates.
+        (WebCore::MediaControlVolumeSliderContainerElement::createRenderer): Added.
+        (WebCore::MediaControlVolumeSliderContainerElement::styleForElement): Removed setting of coordinates.
+        * rendering/MediaControlElements.h: Changed corresponding decls.
+
+2011-03-22  Andrew Wason  <rectalogic@rectalogic.com>
+
+        Reviewed by Benjamin Poulain.
+
+        [Qt] QWebPage with WebGL content crashes when rendering if no QWebView parent
+        https://bugs.webkit.org/show_bug.cgi?id=54138
+
+        * platform/graphics/qt/GraphicsContext3DQt.cpp:
+        (WebCore::GraphicsContext3DInternal::getViewportGLWidget):
+         Check if we actually have a QWebPageClient before dereferencing it.
+
+2011-03-22  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: document DOM domain types and protocol methods.
+        https://bugs.webkit.org/show_bug.cgi?id=56807
+
+        * inspector/InjectedScript.cpp:
+        (WebCore::InjectedScript::wrapNode):
+        * inspector/InjectedScript.h:
+        * inspector/Inspector.json:
+        * inspector/InspectorBrowserDebuggerAgent.cpp:
+        (WebCore::InspectorBrowserDebuggerAgent::descriptionForDOMEvent):
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::removeNode):
+        (WebCore::InspectorDOMAgent::setNodeValue):
+        * inspector/InspectorDOMAgent.h:
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeElement.prototype._createTooltipForNode.resolvedNode):
+        (WebInspector.ElementsTreeElement.prototype._createTooltipForNode):
+        * inspector/front-end/EventListenersSidebarPane.js:
+        * inspector/front-end/PropertiesSidebarPane.js:
+        (WebInspector.PropertiesSidebarPane.prototype.update.nodeResolved):
+        * inspector/front-end/RemoteObject.js:
+        (WebInspector.RemoteObject.resolveNode):
+
+2011-03-22  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Production configuration in GYP isn&apos;t set up correctly
+        https://bugs.webkit.org/show_bug.cgi?id=56786
+
+        Update WebCore.gyp with information mined from WebCore.xcodeproj.
+
+        * WebCore.gypi:
+        * gyp/WebCore.gyp:
+
+2011-03-22  Ofri Wolfus  <ofri@google.com>
+
+        Reviewed by Eric Seidel.
+
+        RTL: Select elements with a size attribute are always left aligned.
+        https://bugs.webkit.org/show_bug.cgi?id=50928
+
+        Added support for alignment in RenderListBox.
+
+        Test: fast/forms/listbox-bidi-align.html
+
+        * rendering/RenderListBox.cpp:
+        (WebCore::RenderListBox::paintItemForeground): Add support for alignment and directionality.
+
+2011-03-22  Ilya Sherman  <isherman@chromium.org>
+
+        Reviewed by Kent Tamura.
+
+        Clear autofilled flag when reseting a form
+        In service of https://code.google.com/p/chromium/issues/detail?id=70037
+        https://bugs.webkit.org/show_bug.cgi?id=56802
+
+        Test: fast/forms/reset-autofilled.html
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::reset): Clear the autofilled flag.
+
+2011-03-22  Ilya Tikhonovsky  <loislo@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: protocol cleanup. DatabaseAgent.
+        https://bugs.webkit.org/show_bug.cgi?id=56815
+
+        see protocol metabug:
+        - All events should use notification wording, not command wording:
+
+        addDatabase was renamed to DatabaseOpened.
+
+        Test: inspector/protocol/database-agent.html
+
+        * inspector/Inspector.json:
+        * inspector/InspectorDatabaseResource.cpp:
+        (WebCore::InspectorDatabaseResource::bind):
+        * inspector/front-end/Database.js:
+        (WebInspector.DatabaseDispatcher.prototype.DatabaseOpened):
+
+2011-03-22  Ilya Tikhonovsky  <loislo@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: protocol cleanup. ConsoleAgent.
+        https://bugs.webkit.org/show_bug.cgi?id=56806
+
+        renamed method: void setConsoleMessagesEnabled(in boolean enabled, out boolean newState); => void enable(out long expiredMessagesCount);
+        new method: disable()
+        deleted method: [event] void consoleMessageExpiredCountUpdate(out unsigned long count); delete it. The counter will be transfered as out argument of enable command.
+
+        * inspector/ConsoleMessage.cpp:
+        (WebCore::ConsoleMessage::updateRepeatCountInConsole):
+        * inspector/Inspector.json:
+        * inspector/InspectorConsoleAgent.cpp:
+        (WebCore::InspectorConsoleAgent::enable):
+        (WebCore::InspectorConsoleAgent::disable):
+        * inspector/InspectorConsoleAgent.h:
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype._registerConsoleDomainDispatcher.dispatcher.consoleMessageRepeatCountUpdated):
+        (WebInspector.ConsoleView.prototype.setConsoleMessageExpiredCount):
+        * inspector/front-end/inspector.js:
+
+2011-03-22  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        REGRESSION(r80096): Number type input unexpectedly rounds fractional values
+        https://bugs.webkit.org/show_bug.cgi?id=56367
+
+        Because the default value of the maximum fractional digits of NSNumberFormatter
+        and ICU NumberFormat is 3, the value 0.55555 is rounded to 0.556 in a
+        localized representation. This bug affects only in Mac and Chromium.
+
+        To fix this bug,
+         - Add "maximum fractional digits" parameter to formatLocalizedNumber(), and
+         - NumberInputType::visibleValue uses parseToDoubleForNumberTypeWithDecimalPlaces()
+          instead of parseToDoubleForNumberType().
+
+        No automated tests because the behavior is locale-dependent. This change
+        updates a manual test.
+
+        * html/NumberInputType.cpp:
+        (WebCore::NumberInputType::visibleValue):
+          Use parseToDoubleForNumberTypeWithDecimalPlaces() and passing fractional
+          part length to formatLocalizedNumber().
+        * manual-tests/input-number-localization.html:
+          Update the test to cover this change.
+        * platform/text/LocalizedNumber.h: Add a parameter to formatLocalizedNumber().
+        * platform/text/LocalizedNumberICU.cpp:
+        (WebCore::formatLocalizedNumber): Call setMaximumFractionalDigits().
+        * platform/text/LocalizedNumberNone.cpp:
+        (WebCore::formatLocalizedNumber):
+        * platform/text/mac/LocalizedNumberMac.mm:
+        (WebCore::formatLocalizedNumber): Call setMaximumFractionalDigits().
+
+2011-03-21  Abhishek Arya  <inferno@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Anonymous blocks need isRenderBlock cast check. Also, need
+        to allow display BOX for flexible boxes.
+        https://bugs.webkit.org/show_bug.cgi?id=56709
+
+        Test: accessibility/anchor-linked-anonymous-block-crash.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::canMergeContiguousAnonymousBlocks): remove specific
+        fix in r81088 which is no longer needed.
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::isAnonymousBlock): Add isRenderBlock cast
+        check.
+
+2011-03-21  Abhishek Arya  <inferno@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Revert small change made in r78846 of replacing move with positionLineBox
+        in the adjusting position function for inline box.
+        https://bugs.webkit.org/show_bug.cgi?id=56300
+
+        The change in r78846 caused positioning line boxes during the step of adjusting
+        position for inline box, thereby causing line boxes to be nuked. This happens as
+        part of aligning boxes in block direction in RenderBlock::computeBlockDirectionPositionsForLine.
+        Later on, we do the positioning of line boxes again later in that function. This
+        causes use of removed inline box leading to crash. Also, it is unnecessary to do
+        this twice.
+
+        Tests: fast/inline/inline-box-adjust-position-crash.html
+               fast/inline/inline-box-adjust-position-crash2.html
+
+        * rendering/InlineBox.cpp:
+        (WebCore::InlineBox::adjustPosition):
+
+2011-03-21  Adam Klein  <adamk@chromium.org>
+
+        Reviewed by David Levin.
+
+        [fileapi] Add URI resolution support to WorkerContext
+        https://bugs.webkit.org/show_bug.cgi?id=55644
+
+        Tests: http/tests/filesystem/workers/resolve-url-sync.html
+               http/tests/filesystem/workers/resolve-url.html
+
+        * fileapi/LocalFileSystem.cpp:
+        (WebCore::LocalFileSystem::readFileSystem):
+        Add support for workers.
+        * fileapi/LocalFileSystem.h:
+        * workers/WorkerContext.cpp:
+        (WebCore::WorkerContext::resolveLocalFileSystemURL):
+        (WebCore::WorkerContext::resolveLocalFileSystemSyncURL):
+        * workers/WorkerContext.h:
+        * workers/WorkerContext.idl:
+
+2011-03-21  David Levin  <levin@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        XHR in Workers doesn't set the referrer correctly.
+        https://bugs.webkit.org/show_bug.cgi?id=24683
+
+        Tests: http/tests/xmlhttprequest/workers/referer.html
+               http/tests/xmlhttprequest/workers/shared-worker-referer.html
+
+        * loader/DocumentThreadableLoader.cpp:
+        (WebCore::DocumentThreadableLoader::loadResourceSynchronously): Fill in empty string for the outgoing referrer.
+        (WebCore::DocumentThreadableLoader::create): Added the ability to set the outgoing referrer.
+        (WebCore::DocumentThreadableLoader::DocumentThreadableLoader): Ditto.
+        (WebCore::DocumentThreadableLoader::loadRequest): Ditto.
+        * loader/DocumentThreadableLoader.h: Ditto.
+        * loader/ResourceLoadScheduler.cpp:
+        (WebCore::ResourceLoadScheduler::scheduleSubresourceLoad): Ditto.
+        * loader/ResourceLoadScheduler.h: Ditto.
+        * loader/SubresourceLoader.cpp:
+        (WebCore::SubresourceLoader::create): Fixed bug (caught by the test) in last minute change done in previous check-in.
+        * loader/WorkerThreadableLoader.cpp:
+        (WebCore::WorkerThreadableLoader::WorkerThreadableLoader): Fill in the outgoing referrer.
+        (WebCore::WorkerThreadableLoader::MainThreadBridge::MainThreadBridge): Plumbing for the outgoing referrer.
+        (WebCore::WorkerThreadableLoader::MainThreadBridge::mainThreadCreateLoader): Plumbing for the outgoing referrer.
+        * loader/WorkerThreadableLoader.h:
+
+2011-03-21  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Brady Eidson.
+
+        Do not check the DocumentLoader's request cache policy
+        in determining whether we should force revalidation of a cached
+        subresource. If the main resource received headers telling it not
+        to cache, that policy will be propagated to subresources.
+
+        The previous behavior is left in behind a flag in Settings, since
+        QuickLook depends on it.
+
+        https://bugs.webkit.org/show_bug.cgi?id=38690
+
+        Tests: http/tests/cache/post-redirect-get.php
+               http/tests/cache/post-with-cached-subresources.php
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::subresourceCachePolicy):
+        (WebCore::FrameLoader::loadPostRequest):
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+        * page/Settings.h:
+        (WebCore::Settings::setUseQuickLookResourceCachingQuirks):
+        (WebCore::Settings::useQuickLookResourceCachingQuirks):
+
+2011-03-21  Rik Cabanier  <cabanier@adobe.com>
+
+        Reviewed by James Robinson.
+
+        bug 56052: percentages are incorrectly rounded in WebKit
+        https://bugs.webkit.org/show_bug.cgi?id=56052
+
+        test: fast/css/percentage-non-integer.html
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty):
+        * page/PrintContext.cpp:
+        (WebCore::PrintContext::pageProperty):
+        * platform/Length.h:
+        (WebCore::Length::Length):
+        (WebCore::Length::operator*=):
+        (WebCore::Length::value):
+        (WebCore::Length::percent):
+        (WebCore::Length::setValue):
+        (WebCore::Length::calcValue):
+        (WebCore::Length::calcMinValue):
+        (WebCore::Length::isUndefined):
+        (WebCore::Length::isZero):
+        (WebCore::Length::isPositive):
+        (WebCore::Length::isNegative):
+        * rendering/AutoTableLayout.cpp:
+        (WebCore::AutoTableLayout::recalcColumn):
+        (WebCore::AutoTableLayout::computePreferredLogicalWidths):
+        (WebCore::AutoTableLayout::calcEffectiveLogicalWidth):
+        (WebCore::AutoTableLayout::layout):
+        * rendering/FixedTableLayout.cpp:
+        (WebCore::FixedTableLayout::calcWidthArray):
+        (WebCore::FixedTableLayout::layout):
+        * rendering/RenderTableSection.cpp:
+        (WebCore::RenderTableSection::addCell):
+        (WebCore::RenderTableSection::layoutRows):
+        * rendering/style/BorderData.h:
+        (WebCore::BorderData::hasBorderRadius):
+
+2011-03-21  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Add WebCoreExportFileGenerator to WebCore GYP build
+        https://bugs.webkit.org/show_bug.cgi?id=56778
+
+        This target mirrors the eponymous target from WebCore.xcodeproj.
+
+        * WebCore.gypi:
+        * gyp/WebCore.gyp:
+        * generate-webcore-export-file-generator.sh: Added.
+
+2011-03-21  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        WebCore GYP build shouldn&apos;t crash on startup
+        https://bugs.webkit.org/show_bug.cgi?id=56776
+
+        Debug builds shouldn't define NDEBUG.  This same logic exists in the
+        project.pbxproj file.
+
+        * gyp/WebCore.gyp:
+
+2011-03-21  Daniel Cheng  <dcheng@chromium.org>
+
+        Reviewed by Tony Chang.
+
+        [chromium] Implement glue between DataTransferItems and the pasteboard.
+        https://bugs.webkit.org/show_bug.cgi?id=56330
+
+        Support retrieving clipboard data in a paste through DataTransferItems.
+
+        Test: editing/pasteboard/data-transfer-items.html
+
+        * platform/chromium/ClipboardChromium.cpp:
+        (WebCore::ClipboardChromium::items):
+        * platform/chromium/DataTransferItemChromium.cpp:
+        (WebCore::DataTransferItemChromium::createFromPasteboard):
+        (WebCore::DataTransferItemChromium::create):
+        (WebCore::DataTransferItemChromium::DataTransferItemChromium):
+        (WebCore::DataTransferItemChromium::getAsString):
+        * platform/chromium/DataTransferItemChromium.h:
+        * platform/chromium/DataTransferItemsChromium.cpp:
+        (WebCore::DataTransferItemsChromium::addPasteboardItem):
+        * platform/chromium/DataTransferItemsChromium.h:
+
+2011-03-21  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        AX: showContextMenu not working in WK2
+        https://bugs.webkit.org/show_bug.cgi?id=56734
+
+        WebKit2 is not able to directly open a context menu because the UI is in the other process.
+        Instead the chrome client should be used. This also means implementing showContextMenu() in WebKit1
+        code.
+        
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        (-[AccessibilityObjectWrapper accessibilityShowContextMenu]):
+
+2011-03-21  Robert Kroeger  <rjkroege@chromium.org>
+
+        Reviewed by Antonio Gomes.
+
+        Add Support to WebCore to optionally call a platform-specific gesture recognizer
+        https://bugs.webkit.org/show_bug.cgi?id=49345
+
+        Added an ability for the EventHandler to invoke an optional platform
+        specific gesture recognizer.
+
+        No tests added because the change should be functionally invisible.
+
+        * WebCore.gypi:
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::EventHandler):
+        (WebCore::EventHandler::handleTouchEvent):
+        * page/EventHandler.h:
+        * platform/PlatformGestureRecognizer.cpp: Added.
+        (WebCore::PlatformGestureRecognizer::PlatformGestureRecognizer):
+        (WebCore::PlatformGestureRecognizer::~PlatformGestureRecognizer):
+        (WebCore::PlatformGestureRecognizer::create):
+        * platform/PlatformGestureRecognizer.h: Added.
+
+2011-03-21  Dean Jackson  <dino@apple.com>
+
+        Reviewed by Chris Marrin and Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=56325
+        ASSERTION FAILED: paused() in AnimationBase::updateStateMachine()
+
+        AnimationBase had a custom linked-list/self-pointer for keeping
+        track of animations that needed to be notified of style updates
+        and start progress. This caused problems when AnimationBase was
+        destroyed, since the pointer wasn't managed in any way. I replaced
+        these pointers with HashSets and moved the code that removes animations
+        from the sets into AnimationControllerPrivate, where it belongs.
+        CompositeAnimation is also more careful to tell AnimationControllerPrivate
+        when it no longer needs to keep track of waiting animations.
+
+        This should stop the style updates being called on non-active animations
+        (which was the cause of the state machine error here) and should also
+        stop a few of the related flakey test failures and occasional crashes.
+
+        Test: animations/body-removal-crash.html
+
+        * page/animation/AnimationBase.cpp:
+        (WebCore::AnimationBase::AnimationBase):
+        (WebCore::AnimationBase::updateStateMachine):
+        * page/animation/AnimationBase.h:
+        (WebCore::AnimationBase::~AnimationBase):
+        - Remove the linked-list
+        * page/animation/AnimationController.cpp:
+        (WebCore::AnimationControllerPrivate::AnimationControllerPrivate):
+        (WebCore::AnimationControllerPrivate::addToAnimationsWaitingForStyle):
+        (WebCore::AnimationControllerPrivate::removeFromAnimationsWaitingForStyle):
+        (WebCore::AnimationControllerPrivate::styleAvailable):
+        (WebCore::AnimationControllerPrivate::addToAnimationsWaitingForStartTimeResponse):
+        (WebCore::AnimationControllerPrivate::removeFromAnimationsWaitingForStartTimeResponse):
+        (WebCore::AnimationControllerPrivate::startTimeResponse):
+        (WebCore::AnimationControllerPrivate::animationWillBeRemoved):
+        - New method to remove animations from the waiting lists
+        * page/animation/AnimationControllerPrivate.h:
+        - use a HashSet rather than an AnimationBase* pointer.
+        * page/animation/CompositeAnimation.cpp:
+        (WebCore::CompositeAnimation::~CompositeAnimation):
+        (WebCore::CompositeAnimation::clearRenderer):
+        (WebCore::CompositeAnimation::updateTransitions):
+        (WebCore::CompositeAnimation::updateKeyframeAnimations):
+        - remove the animations and transitions from the lists when we know
+          they are no longer active (rather than waiting for the AnimationBase
+          to do it when destructing)
+
+2011-03-21  Justin Schuh  <jschuh@chromium.org>
+
+        Reviewed by James Robinson.
+
+        Stop inserting when the parent is removed
+        https://bugs.webkit.org/show_bug.cgi?id=56690
+
+        Tests: fast/dom/insertedIntoDocument-child.html
+               fast/dom/insertedIntoDocument-iframe.html
+               fast/dom/insertedIntoDocument-sibling.html
+
+        * dom/ContainerNode.cpp:
+        (WebCore::ContainerNode::insertedIntoDocument):
+        * html/HTMLEmbedElement.cpp:
+        (WebCore::HTMLEmbedElement::insertedIntoDocument):
+        * html/HTMLObjectElement.cpp:
+        (WebCore::HTMLObjectElement::insertedIntoDocument):
+
+2011-03-07  David Levin  <levin@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        SubresourceLoader should expose a way to set the outgoing referer/origin
+        https://bugs.webkit.org/show_bug.cgi?id=55903
+
+        No new tests as no new functionality is exposed.
+
+        * loader/SubresourceLoader.cpp:
+        (WebCore::SubresourceLoader::create):
+        * loader/SubresourceLoader.h:
+
+2011-03-21  Daniel Sievers  <sievers@google.com>
+
+        Reviewed by Simon Fraser.
+
+        [Chromium] Make RenderAsTextBehavior and LayerTreeAsTextBehavior tweakable from the DumpRenderTree commandline
+        https://bugs.webkit.org/show_bug.cgi?id=56139
+
+        * WebCore.exp.in:
+        * WebCore.order:
+        * page/Frame.cpp:
+        (WebCore::Frame::layerTreeAsText):
+        * page/Frame.h:
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::layerTreeAsText):
+        * rendering/RenderLayerCompositor.h:
+
+2011-03-21  Chang Shu  <cshu@webkit.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        REGRESSION (r79953): Can't type in MS Outlook 2011
+        https://bugs.webkit.org/show_bug.cgi?id=56665
+
+        r79953 removed the WebView level editablity which is persistent no matter whether
+        underlying document itself is changed and editability gets lost. The resolution is to
+        set this WebView editable value to WebCore. This avoids the callback from WebCore to
+        WebKit which was the main goal in r79953 to improve performance.
+
+        * WebCore.exp.in:
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::isReadOnly):
+        * dom/Node.cpp:
+        (WebCore::Node::isContentEditable):
+        * editing/SelectionController.cpp:
+        (WebCore::SelectionController::setSelectionFromNone):
+        * page/DragController.cpp:
+        (WebCore::DragController::operationForLoad):
+        * page/Page.cpp:
+        (WebCore::Page::Page):
+        * page/Page.h:
+        (WebCore::Page::setEditable):
+        (WebCore::Page::isEditable):
+
+2011-03-21  Eric Uhrhane <ericu@chromium.org>
+
+        Reviewed by David Levin.
+
+        [fileapi/chromium] Fetch platform path using GetMetadata before creating File from FileEntry*
+        https://bugs.webkit.org/show_bug.cgi?id=56704
+
+        * fileapi/DOMFileSystemSync.cpp
+        (DOMFileSystemSync::createFile)
+        (class GetPathHelper): Added, to look up path before creating File.
+        * fileapi/DOMFileSystem.cpp
+        (DOMFileSystem::createFile)
+        (GetPathCallback): Added, to look up path before creating File.
+        * platform/FileMetadata.h
+        (struct FileMetadata): Added new field platformPath.
+
+2011-03-21  Dominic Cooney  <dominicc@google.com>
+
+        Reviewed by Jeremy Orlow.
+
+        Establishes a V8 context before executing MediaQueryList callbacks.
+        https://bugs.webkit.org/show_bug.cgi?id=56166
+
+        MediaQueryList listener callbacks didn't establish a V8 context
+        before running script, causing crashes on C++-only
+        callstacks (such as user resizing, printing, etc.) I believe this
+        could also be contrived to execute media query list listener
+        callbacks across domain.
+
+        Test: fast/media/media-query-list-callback.html
+
+        * css/MediaQueryListListener.cpp:
+        (WebCore::MediaQueryListListener::queryChanged):
+
+2011-03-21  Andreas Kling  <kling@webkit.org>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Add QNetworkReplyHandler::wasAborted()
+
+        Instead of checking if the ResourceHandle is null everywhere,
+        use a wasAborted() method to make the code readable.
+
+        * platform/network/qt/QNetworkReplyHandler.h:
+        (WebCore::QNetworkReplyHandler::wasAborted):
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::QNetworkReplyHandler::finish):
+        (WebCore::QNetworkReplyHandler::sendResponseIfNeeded):
+        (WebCore::QNetworkReplyHandler::redirect):
+        (WebCore::QNetworkReplyHandler::forwardData):
+        (WebCore::QNetworkReplyHandler::uploadProgress):
+
+2011-03-21  Christian Dywan  <christian@lanedo.com>
+
+        Reviewed by Martin Robinson.
+
+        WebKitIconDatabase may trigger crash in cairoImageSurfaceToGdkPixbuf
+        https://bugs.webkit.org/show_bug.cgi?id=56201
+
+        * platform/graphics/gtk/ImageGtk.cpp: Don't attempt to make a pixbuf
+            if there is no image.
+
+2011-03-21  Mario Sanchez Prada  <msanchez@igalia.com>
+
+        Reviewed by Martin Robinson.
+
+        [GTK] [Stable] AtkHypertext exposes wrong offsets for links placed inside <span> nodes
+        https://bugs.webkit.org/show_bug.cgi?id=56737
+
+        Only consider parent objects not ignoring accessibility.
+
+        * accessibility/gtk/WebKitAccessibleHyperlink.cpp:
+        (webkitAccessibleHyperlinkGetStartIndex): Look for the parent
+        object not ignoring accessibility for the current hyperlink.
+        (webkitAccessibleHyperlinkGetEndIndex): Ditto.
+
+2011-03-21  Andreas Kling  <kling@webkit.org>
+
+        Reviewed by Benjamin Poulain.
+
+        [Qt] Remove handling of QNetworkAccessManager::UnknownOperation
+
+        Now that Qt 4.7 is required we never have to fall back to UnknownOperation.
+        Custom verb requests are using CustomOperation already, so this was dead code.
+
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::QNetworkReplyHandler::start):
+
+2011-03-21  Adam Roben  <aroben@apple.com>
+
+        Fix multiple-definition linker warnings on Windows
+
+        * WebCore.vcproj/WebCore.vcproj: Exclude RenderSVGPath.cpp from the build, since it is
+        already being compiled via RenderingAllInOne.cpp. Let VS have its way with the rest of the
+        file.
+
+2011-03-21  Andreas Kling  <kling@webkit.org>
+
+        Reviewed by Benjamin Poulain.
+
+        [Qt] Clean up QNetworkReplyHandler::release()
+
+        Since QNetworkReplyHandler no longer uses queued connections to
+        the QNetworkReply, it's not necessary to mess with the event
+        queue when releasing a reply.
+
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::QNetworkReplyHandler::abort):
+        (WebCore::QNetworkReplyHandler::release):
+
+2011-03-21  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: Inspector does not always show correct transfer size (for compressed/chunked data)
+        https://bugs.webkit.org/show_bug.cgi?id=56691
+
+        Added transfer size support in inspector for compressed data.
+
+        Test: http/tests/inspector/network/network-size-chunked.html
+
+        * inspector/Inspector.idl:
+        * inspector/InspectorInstrumentation.cpp:
+        (WebCore::InspectorInstrumentation::didReceiveContentLengthImpl):
+        * inspector/InspectorInstrumentation.h:
+        (WebCore::InspectorInstrumentation::didReceiveContentLength):
+        * inspector/InspectorResourceAgent.cpp:
+        (WebCore::InspectorResourceAgent::didReceiveResponse):
+        (WebCore::InspectorResourceAgent::didReceiveContentLength):
+        * inspector/InspectorResourceAgent.h:
+        * inspector/front-end/NetworkManager.js:
+        (WebInspector.NetworkDispatcher.prototype.didReceiveContentLength):
+        * inspector/front-end/Resource.js:
+        (WebInspector.Resource.prototype.get transferSize):
+        (WebInspector.Resource.prototype.increaseTransferSize):
+        * loader/ResourceLoadNotifier.cpp:
+        (WebCore::ResourceLoadNotifier::didReceiveData):
+        (WebCore::ResourceLoadNotifier::dispatchDidReceiveContentLength):
+        (WebCore::ResourceLoadNotifier::sendRemainingDelegateMessages):
+        * loader/ResourceLoadNotifier.h:
+        * loader/appcache/ApplicationCacheGroup.cpp:
+        (WebCore::ApplicationCacheGroup::didReceiveData):
+        * platform/network/mac/ResourceHandleMac.mm:
+        (-[WebCoreResourceHandleAsDelegate connection:didReceiveData:lengthReceived:]):
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::QNetworkReplyHandler::forwardData):
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::gotChunkCallback):
+        * platform/network/win/ResourceHandleWin.cpp:
+        (WebCore::ResourceHandle::onRequestComplete):
+        (WebCore::ResourceHandle::fileLoadTimer):
+
+2011-03-21  Leo Yang  <leo.yang@torchmobile.com.cn>
+
+        Reviewed by Dirk Schulze.
+
+        symbol display <use> at wrong scale
+        https://bugs.webkit.org/show_bug.cgi?id=54538
+
+        SVG spec: http://www.w3.org/TR/SVG/struct.html#UseElement
+        Quotation for referenced <symbol>: "If attributes 'width'
+        and/or 'height' are provided on the 'use' element, then
+        these attributes will be transferred to the generated 'svg'."
+        Quotation for referenced <svg>: "If attributes 'width'
+        and/or 'height' are provided on the 'use' element, then
+        these values will override the corresponding attributes
+        on the 'svg' in the generated tree."
+        For above quotations, we should treat 'use' element as referencing
+        'use' element, just like Firefox 3.6 and Opera 11, instead of
+        corrensponding 'use' element.
+
+        Tests: svg/custom/use-transfer-width-height-properties-to-svg.svg
+               svg/custom/use-transfer-width-height-properties-to-svg1.svg
+               svg/custom/use-transfer-width-height-properties-to-svg2.svg
+               svg/custom/use-transfer-width-height-properties-to-symbol.svg
+               svg/custom/use-transfer-width-height-properties-to-symbol1.svg
+               svg/custom/use-transfer-width-height-properties-to-symbol2.svg
+
+        * svg/SVGElementInstance.cpp:
+        (WebCore::SVGElementInstance::SVGElementInstance):
+        * svg/SVGElementInstance.h:
+        (WebCore::SVGElementInstance::create):
+        (WebCore::SVGElementInstance::correspondingUseElement):
+        (WebCore::SVGElementInstance::directUseElement):
+        (WebCore::SVGElementInstance::clearUseElements):
+        * svg/SVGUseElement.cpp:
+        (WebCore::updateContainerSize):
+        (WebCore::SVGUseElement::updateContainerSizes):
+        (WebCore::dumpInstanceTree):
+        (WebCore::SVGUseElement::detachInstance):
+        (WebCore::SVGUseElement::buildInstanceTree):
+
+2011-03-21  Jaehun Lim  <ljaehun.lim@samsung.com>
+
+        Reviewed by Pavel Feldman.
+
+        Fix build break when inspector is enabled.
+        https://bugs.webkit.org/show_bug.cgi?id=56735
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::continueLoadAfterNavigationPolicy): Add ENABLE(INSPECTOR).
+
+2011-03-21  Philippe Normand  <pnormand@igalia.com>
+
+        Unreviewed, GTK distcheck build fix.
+
+        * GNUmakefile.am:
+
+2011-03-21  Julien Chaffraix  <jchaffraix@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Bug 51465 - chrome.dll!WebCore::RenderLayer::currentTransform
+        ReadAV@NULL (8968fc97874fa23b6799ff8f09c142e4)
+
+        Test: fast/css/webkit-empty-transform-preserve3d-crash.html
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::layoutOverflowRectForPropagation): Mimicked the
+        rest of the code and check that the RenderBox has a layer to avoid
+        crashing on the layer() call.
+
+2011-03-21  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: move cookie processing and appcache from DOMAgent.js
+        https://bugs.webkit.org/show_bug.cgi?id=56713
+
+        * inspector/front-end/ApplicationCacheItemsView.js:
+        (WebInspector.ApplicationCacheDispatcher):
+        (WebInspector.ApplicationCacheDispatcher.getApplicationCachesAsync):
+        (WebInspector.ApplicationCacheDispatcher.prototype.updateApplicationCacheStatus):
+        (WebInspector.ApplicationCacheDispatcher.prototype.updateNetworkState):
+        * inspector/front-end/CookieItemsView.js:
+        (WebInspector.Cookies.getCookiesAsync):
+        (WebInspector.Cookies.buildCookiesFromString):
+        (WebInspector.Cookies.cookieMatchesResourceURL):
+        (WebInspector.Cookies.cookieDomainMatchesResourceDomain):
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.DOMNode.prototype.eventListeners):
+        * inspector/front-end/EventListenersSidebarPane.js:
+        (WebInspector.EventListenersSidebarPane.prototype.update):
+
+2011-03-21  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: migrate Inspector.json to valid JSON types.
+        https://bugs.webkit.org/show_bug.cgi?id=56651
+
+        This change migrates inspector from long to int as
+        dom, storage, database and other id types.
+
+        * inspector/InjectedScriptHost.cpp:
+        (WebCore::InjectedScriptHost::inspectedNode):
+        (WebCore::InjectedScriptHost::databaseIdImpl):
+        (WebCore::InjectedScriptHost::storageIdImpl):
+        (WebCore::InjectedScriptHost::didCreateWorker):
+        (WebCore::InjectedScriptHost::didDestroyWorker):
+        * inspector/InjectedScriptHost.h:
+        * inspector/InjectedScriptHost.idl:
+        * inspector/Inspector.json:
+        * inspector/InspectorAgent.cpp:
+        (WebCore::InspectorAgent::highlightDOMNode):
+        * inspector/InspectorAgent.h:
+        * inspector/InspectorBrowserDebuggerAgent.cpp:
+        (WebCore::InspectorBrowserDebuggerAgent::setDOMBreakpoint):
+        (WebCore::InspectorBrowserDebuggerAgent::removeDOMBreakpoint):
+        (WebCore::InspectorBrowserDebuggerAgent::descriptionForDOMEvent):
+        (WebCore::InspectorBrowserDebuggerAgent::hasBreakpoint):
+        * inspector/InspectorBrowserDebuggerAgent.h:
+        * inspector/InspectorCSSAgent.cpp:
+        (WebCore::InspectorCSSAgent::getStylesForNode):
+        (WebCore::InspectorCSSAgent::getInlineStyleForNode):
+        (WebCore::InspectorCSSAgent::getComputedStyleForNode):
+        (WebCore::InspectorCSSAgent::setPropertyText):
+        (WebCore::InspectorCSSAgent::toggleProperty):
+        (WebCore::InspectorCSSAgent::addRule):
+        (WebCore::InspectorCSSAgent::elementForId):
+        * inspector/InspectorCSSAgent.h:
+        * inspector/InspectorConsoleAgent.cpp:
+        (WebCore::InspectorConsoleAgent::count):
+        (WebCore::InspectorConsoleAgent::addInspectedNode):
+        (WebCore::InspectorConsoleAgent::setConsoleMessagesEnabled):
+        * inspector/InspectorConsoleAgent.h:
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::bind):
+        (WebCore::InspectorDOMAgent::unbind):
+        (WebCore::InspectorDOMAgent::assertNode):
+        (WebCore::InspectorDOMAgent::assertElement):
+        (WebCore::InspectorDOMAgent::assertHTMLElement):
+        (WebCore::InspectorDOMAgent::nodeToSelectOn):
+        (WebCore::InspectorDOMAgent::pushChildNodesToFrontend):
+        (WebCore::InspectorDOMAgent::nodeForId):
+        (WebCore::InspectorDOMAgent::getChildNodes):
+        (WebCore::InspectorDOMAgent::querySelector):
+        (WebCore::InspectorDOMAgent::querySelectorAll):
+        (WebCore::InspectorDOMAgent::pushNodePathToFrontend):
+        (WebCore::InspectorDOMAgent::boundNodeId):
+        (WebCore::InspectorDOMAgent::setAttribute):
+        (WebCore::InspectorDOMAgent::removeAttribute):
+        (WebCore::InspectorDOMAgent::removeNode):
+        (WebCore::InspectorDOMAgent::setNodeName):
+        (WebCore::InspectorDOMAgent::getOuterHTML):
+        (WebCore::InspectorDOMAgent::setOuterHTML):
+        (WebCore::InspectorDOMAgent::setNodeValue):
+        (WebCore::InspectorDOMAgent::getEventListenersForNode):
+        (WebCore::InspectorDOMAgent::resolveNode):
+        (WebCore::InspectorDOMAgent::pushNodeToFrontend):
+        (WebCore::InspectorDOMAgent::buildObjectForNode):
+        (WebCore::InspectorDOMAgent::loadEventFired):
+        (WebCore::InspectorDOMAgent::didInsertDOMNode):
+        (WebCore::InspectorDOMAgent::didRemoveDOMNode):
+        (WebCore::InspectorDOMAgent::didModifyDOMAttr):
+        (WebCore::InspectorDOMAgent::characterDataModified):
+        (WebCore::InspectorDOMAgent::didInvalidateStyleAttr):
+        (WebCore::InspectorDOMAgent::reportNodesAsSearchResults):
+        (WebCore::InspectorDOMAgent::copyNode):
+        (WebCore::InspectorDOMAgent::pushNodeByPathToFrontend):
+        * inspector/InspectorDOMAgent.h:
+        * inspector/InspectorDOMStorageAgent.cpp:
+        (WebCore::InspectorDOMStorageAgent::getDOMStorageEntries):
+        (WebCore::InspectorDOMStorageAgent::setDOMStorageItem):
+        (WebCore::InspectorDOMStorageAgent::removeDOMStorageItem):
+        (WebCore::InspectorDOMStorageAgent::storageId):
+        (WebCore::InspectorDOMStorageAgent::getDOMStorageResourceForId):
+        * inspector/InspectorDOMStorageAgent.h:
+        * inspector/InspectorDOMStorageResource.cpp:
+        * inspector/InspectorDOMStorageResource.h:
+        (WebCore::InspectorDOMStorageResource::id):
+        * inspector/InspectorDatabaseAgent.cpp:
+        (WebCore::InspectorDatabaseAgent::getDatabaseTableNames):
+        (WebCore::InspectorDatabaseAgent::executeSQL):
+        (WebCore::InspectorDatabaseAgent::databaseId):
+        (WebCore::InspectorDatabaseAgent::databaseForId):
+        * inspector/InspectorDatabaseAgent.h:
+        * inspector/InspectorDatabaseResource.cpp:
+        * inspector/InspectorDatabaseResource.h:
+        (WebCore::InspectorDatabaseResource::id):
+        * inspector/InspectorDebuggerAgent.cpp:
+        (WebCore::InspectorDebuggerAgent::setPauseOnExceptionsState):
+        * inspector/InspectorDebuggerAgent.h:
+        * inspector/InspectorProfilerAgent.cpp:
+        (WebCore::InspectorProfilerAgent::getExactHeapSnapshotNodeRetainedSize):
+        * inspector/InspectorProfilerAgent.h:
+        * inspector/InspectorResourceAgent.cpp:
+        (WebCore::InspectorResourceAgent::identifierForInitialRequest):
+        (WebCore::InspectorResourceAgent::willSendRequest):
+        (WebCore::InspectorResourceAgent::markResourceAsCached):
+        (WebCore::InspectorResourceAgent::didReceiveResponse):
+        (WebCore::InspectorResourceAgent::didReceiveContentLength):
+        (WebCore::InspectorResourceAgent::didFinishLoading):
+        (WebCore::InspectorResourceAgent::didFailLoading):
+        (WebCore::InspectorResourceAgent::setInitialContent):
+        (WebCore::InspectorResourceAgent::didCreateWebSocket):
+        (WebCore::InspectorResourceAgent::willSendWebSocketHandshakeRequest):
+        (WebCore::InspectorResourceAgent::didReceiveWebSocketHandshakeResponse):
+        (WebCore::InspectorResourceAgent::didCloseWebSocket):
+        * inspector/generate-inspector-idl:
+
+2011-03-21  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: make frameId in network agent of type string, not unsigned long.
+        https://bugs.webkit.org/show_bug.cgi?id=56708
+
+        * inspector/Inspector.json:
+        * inspector/InspectorAgent.cpp:
+        (WebCore::InspectorAgent::highlightFrame):
+        * inspector/InspectorAgent.h:
+        * inspector/InspectorResourceAgent.cpp:
+        (WebCore::pointerAsId):
+        (WebCore::buildObjectForDocumentLoader):
+        (WebCore::buildObjectForFrame):
+        (WebCore::InspectorResourceAgent::frameDetachedFromParent):
+        (WebCore::InspectorResourceAgent::frameForId):
+        (WebCore::InspectorResourceAgent::resourceContent):
+        * inspector/InspectorResourceAgent.h:
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel.prototype.addOrUpdateFrame):
+
+2011-03-21  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: expose object id as string, not JSON struct in the protocol.
+        https://bugs.webkit.org/show_bug.cgi?id=56681
+
+        * bindings/js/JSInjectedScriptHostCustom.cpp:
+        (WebCore::JSInjectedScriptHost::inspect):
+        * bindings/v8/custom/V8InjectedScriptHostCustom.cpp:
+        (WebCore::V8InjectedScriptHost::inspectCallback):
+        * inspector/InjectedScript.cpp:
+        (WebCore::InjectedScript::evaluateOn):
+        (WebCore::InjectedScript::evaluateOnCallFrame):
+        (WebCore::InjectedScript::getProperties):
+        (WebCore::InjectedScript::nodeForObjectId):
+        (WebCore::InjectedScript::setPropertyValue):
+        (WebCore::InjectedScript::releaseObject):
+        * inspector/InjectedScript.h:
+        * inspector/InjectedScriptHost.cpp:
+        (WebCore::InjectedScriptHost::inspectImpl):
+        * inspector/InjectedScriptHost.h:
+        * inspector/InjectedScriptManager.cpp:
+        (WebCore::InjectedScriptManager::injectedScriptForObjectId):
+        (WebCore::InjectedScriptManager::releaseObjectGroup):
+        * inspector/InjectedScriptManager.h:
+        * inspector/InjectedScriptSource.js:
+        * inspector/Inspector.json:
+        * inspector/InspectorConsoleAgent.cpp:
+        (WebCore::InspectorConsoleAgent::clearConsoleMessages):
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::pushNodeToFrontend):
+        * inspector/InspectorDOMAgent.h:
+        * inspector/InspectorDebuggerAgent.cpp:
+        (WebCore::InspectorDebuggerAgent::evaluateOnCallFrame):
+        * inspector/InspectorDebuggerAgent.h:
+        * inspector/InspectorRuntimeAgent.cpp:
+        (WebCore::InspectorRuntimeAgent::evaluateOn):
+        (WebCore::InspectorRuntimeAgent::getProperties):
+        (WebCore::InspectorRuntimeAgent::setPropertyValue):
+        (WebCore::InspectorRuntimeAgent::releaseObject):
+        (WebCore::InspectorRuntimeAgent::releaseObjectGroup):
+        * inspector/InspectorRuntimeAgent.h:
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype.completions.evaluatedProperties):
+        (WebInspector.ConsoleView.prototype.completions):
+        * inspector/front-end/PropertiesSidebarPane.js:
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.SourceFrameDelegateForScriptsPanel.prototype.releaseEvaluationResult):
+        * inspector/front-end/WatchExpressionsSidebarPane.js:
+        (WebInspector.WatchExpressionsSection.prototype.update):
+        * inspector/front-end/inspector.js:
+        (WebInspector.inspect):
+
+2011-03-20  Bill Budge  <bbudge@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Rename ThreadSafeShared to ThreadSafeRefCounted
+        https://bugs.webkit.org/show_bug.cgi?id=56714
+
+        No new tests. Exposes no new functionality.
+
+        * ForwardingHeaders/wtf/ThreadSafeRefCounted.h: Copied from ForwardingHeaders/wtf/ThreadSafeShared.h.
+        * ForwardingHeaders/wtf/ThreadSafeShared.h: Removed.
+        * bindings/v8/SerializedScriptValue.h:
+        * dom/Document.cpp:
+        * dom/default/PlatformMessagePortChannel.h:
+        * fileapi/FileThread.h:
+        * loader/ThreadableLoaderClientWrapper.h:
+        (WebCore::ThreadableLoaderClientWrapper::create):
+        (WebCore::ThreadableLoaderClientWrapper::clearClient):
+        (WebCore::ThreadableLoaderClientWrapper::done):
+        (WebCore::ThreadableLoaderClientWrapper::didSendData):
+        (WebCore::ThreadableLoaderClientWrapper::didReceiveResponse):
+        (WebCore::ThreadableLoaderClientWrapper::didReceiveData):
+        (WebCore::ThreadableLoaderClientWrapper::didReceiveCachedMetadata):
+        (WebCore::ThreadableLoaderClientWrapper::didFinishLoading):
+        (WebCore::ThreadableLoaderClientWrapper::didFail):
+        (WebCore::ThreadableLoaderClientWrapper::didFailRedirectCheck):
+        (WebCore::ThreadableLoaderClientWrapper::didReceiveAuthenticationCancellation):
+        (WebCore::ThreadableLoaderClientWrapper::ThreadableLoaderClientWrapper):
+        * page/SecurityOrigin.h:
+        * platform/CrossThreadCopier.h:
+        * platform/network/BlobData.h:
+        * platform/network/cf/SocketStreamHandle.h:
+        * storage/AbstractDatabase.h:
+        * storage/DatabaseAuthorizer.h:
+        * storage/DatabaseCallback.h:
+        * storage/DatabaseThread.h:
+        * storage/IDBCallbacks.h:
+        * storage/IDBCursorBackendInterface.h:
+        * storage/IDBDatabaseBackendInterface.h:
+        * storage/IDBFactoryBackendInterface.h:
+        * storage/IDBIndexBackendInterface.h:
+        * storage/IDBKey.h:
+        * storage/IDBKeyRange.h:
+        * storage/IDBObjectStoreBackendInterface.h:
+        * storage/IDBRequest.h:
+        * storage/IDBTransactionBackendInterface.h:
+        * storage/SQLError.h:
+        * storage/SQLResultSet.h:
+        * storage/SQLStatement.h:
+        * storage/SQLStatementCallback.h:
+        * storage/SQLStatementErrorCallback.h:
+        * storage/SQLTransaction.h:
+        * storage/SQLTransactionCallback.h:
+        * storage/SQLTransactionErrorCallback.h:
+        * websockets/ThreadableWebSocketChannelClientWrapper.h:
+        * workers/DefaultSharedWorkerRepository.cpp:
+
+2011-03-20  Andreas Kling  <kling@webkit.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Clean up redirection logic in QNetworkReplyHandler
+        https://bugs.webkit.org/show_bug.cgi?id=56717
+
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::QNetworkReplyHandler::QNetworkReplyHandler):
+        Use resetState() when constructing QNRH as well.
+
+        (WebCore::QNetworkReplyHandler::resetState):
+        Delete (deferred) the m_reply if one exists (only when redirecting.)
+
+        (WebCore::QNetworkReplyHandler::finish):
+        Return early when redirecting.
+
+        (WebCore::QNetworkReplyHandler::sendResponseIfNeeded):
+        (WebCore::QNetworkReplyHandler::redirect):
+        Move the redirection logic from sendResponseIfNeeded() into a
+        separate redirect() method.
+
+2011-03-19  Andreas Kling  <kling@webkit.org>
+
+        Reviewed by Benjamin Poulain.
+
+        [Qt] Rename ignoreHttpError() to shouldIgnoreHttpError()
+
+        The function doesn't ignore anything, thus it shouldn't have an imperative name.
+
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::shouldIgnoreHttpError):
+        (WebCore::QNetworkReplyHandler::finish):
+        (WebCore::QNetworkReplyHandler::sendResponseIfNeeded):
+
+2011-03-19  Andreas Kling  <kling@webkit.org>
+
+        Reviewed by Benjamin Poulain.
+
+        [Qt] Kill layer violation FIXME in ResourceHandleQt.
+
+        We were including qwebframe_p.h from WebKit/qt for no reason.
+
+        * platform/network/qt/ResourceHandleQt.cpp:
+
+2011-03-19  Andreas Kling  <kling@webkit.org>
+
+        Reviewed by Benjamin Poulain.
+
+        [Qt] Refactor handling of deferred loads
+        https://bugs.webkit.org/show_bug.cgi?id=56715
+
+        Split QNetworkReplyHandler's "load mode" into two parameters
+        instead of trying to fit the deferral mechanism into it.
+
+        Loads are now AsynchronousLoad (default) or SynchronousLoad (for sync XHR.)
+
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::QNetworkReplyHandler::QNetworkReplyHandler):
+        (WebCore::QNetworkReplyHandler::setLoadingDeferred):
+        (WebCore::QNetworkReplyHandler::resumeDeferredLoad):
+        (WebCore::QNetworkReplyHandler::finish):
+        (WebCore::QNetworkReplyHandler::sendResponseIfNeeded):
+        (WebCore::QNetworkReplyHandler::forwardData):
+        (WebCore::QNetworkReplyHandler::start):
+        (WebCore::QNetworkReplyHandler::resetState):
+        * platform/network/qt/QNetworkReplyHandler.h:
+        * platform/network/qt/ResourceHandleQt.cpp:
+        (WebCore::ResourceHandle::start):
+        (WebCore::ResourceHandle::loadResourceSynchronously):
+        (WebCore::ResourceHandle::platformSetDefersLoading):
+
+2011-03-19  Anton D'Auria  <adauria@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        ApplicationCacheGroup is not obsolete after being deleted via ApplicationCacheStorage::deleteEntriesForOrigin
+        https://bugs.webkit.org/show_bug.cgi?id=56415
+
+        To delete all Application Cache for an origin, we must obsolete all
+        in-memory cache groups for that origin. If a cache group isn't in memory,
+        then it must be deleted from disk. The previous implementation correctly
+        removed on-disk cache groups, but did not mark in-memory cache groups as obsolete.
+        This caused an assertion failure in ApplicationCacheStorage::cacheGroupDestroyed()
+        when the DocumentLoader was destroyed.
+
+        Test: http/tests/appcache/origin-delete.html
+
+        * WebCore.exp.in:
+        * WebCore.xcodeproj/project.pbxproj:
+        * loader/appcache/ApplicationCache.cpp:
+        (WebCore::ApplicationCache::clearStorageID):
+        (WebCore::ApplicationCache::deleteCacheForOrigin):
+        * loader/appcache/ApplicationCache.h:
+        * loader/appcache/ApplicationCacheStorage.cpp:
+        (WebCore::ApplicationCacheStorage::findInMemoryCacheGroup):
+        * loader/appcache/ApplicationCacheStorage.h:
+
+2011-03-19  Gyuyoung Kim  <gyuyoung.kim@samsung.com>
+
+        Reviewed by Antonio Gomes.
+
+        [EFL] Add dummy GeolocationServiceEfl. cpp | h
+        https://bugs.webkit.org/show_bug.cgi?id=56710
+
+        Add dummy GeolocationServiceEfl.cpp | h to platform/efl.
+
+        * CMakeListsEfl.txt:
+        * platform/efl/GeolocationServiceEfl.cpp: Added.
+        (WebCore::GeolocationServiceEfl::create):
+        (WebCore::GeolocationServiceEfl::GeolocationServiceEfl):
+        (WebCore::GeolocationServiceEfl::~GeolocationServiceEfl):
+        (WebCore::GeolocationServiceEfl::startUpdating):
+        (WebCore::GeolocationServiceEfl::stopUpdating):
+        (WebCore::GeolocationServiceEfl::suspend):
+        (WebCore::GeolocationServiceEfl::resume):
+        (WebCore::GeolocationServiceEfl::lastPosition):
+        (WebCore::GeolocationServiceEfl::lastError):
+        * platform/efl/GeolocationServiceEfl.h: Added.
+
+2011-03-19  Patrick Gansterer  <paroga@webkit.org>
+
+        Unreviewed, rolling out r81551.
+        http://trac.webkit.org/changeset/81551
+        https://bugs.webkit.org/show_bug.cgi?id=55336
+
+        Broke some storage tests on Win32.
+
+        * platform/win/FileSystemWin.cpp:
+        (WebCore::statFile):
+        (WebCore::getFileSize):
+        (WebCore::getFileModificationTime):
+        (WebCore::fileExists):
+
+2011-03-19  Andreas Kling  <kling@webkit.org>
+
+        Reviewed by Benjamin Poulain.
+
+        [Qt] Remove support for Qt 4.6
+        https://bugs.webkit.org/show_bug.cgi?id=56712
+
+        * platform/graphics/qt/FontPlatformDataQt.cpp:
+        (WebCore::FontPlatformData::FontPlatformData):
+        * platform/graphics/qt/FontQt.cpp:
+        (WebCore::drawTextCommon):
+        (WebCore::Font::drawSimpleText):
+        (WebCore::Font::floatWidthForSimpleText):
+        (WebCore::Font::offsetForPositionForSimpleText):
+        (WebCore::Font::selectionRectForSimpleText):
+        * platform/graphics/qt/GraphicsContext3DQt.cpp:
+        (WebCore::GraphicsContext3DInternal::paint):
+        * platform/graphics/qt/ImageBufferQt.cpp:
+        (WebCore::getImageData):
+        * platform/graphics/qt/ImageDecoderQt.cpp:
+        (WebCore::ImageDecoderQt::internalHandleCurrentImage):
+        * platform/graphics/qt/PathQt.cpp:
+        (WebCore::Path::transform):
+        * platform/network/qt/DnsPrefetchHelper.h:
+        (WebCore::DnsPrefetchHelper::DnsPrefetchHelper):
+        (WebCore::DnsPrefetchHelper::lookup):
+        * platform/network/qt/NetworkStateNotifierPrivate.h:
+        * platform/network/qt/NetworkStateNotifierQt.cpp:
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::QNetworkReplyHandler::httpMethod):
+        (WebCore::QNetworkReplyHandler::QNetworkReplyHandler):
+        (WebCore::QNetworkReplyHandler::sendResponseIfNeeded):
+        (WebCore::QNetworkReplyHandler::start):
+        * platform/network/qt/ResourceRequestQt.cpp:
+        (WebCore::ResourceRequest::toNetworkRequest):
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore::RenderThemeQt::paintMediaSliderTrack):
+
+2011-03-19  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Adam Roben.
+
+        Use Win32 API to get file information
+        https://bugs.webkit.org/show_bug.cgi?id=55336
+
+        Use GetFileInformationByHandle() in favour over _wstat64(), GetFileSizeEx()
+        and GetFileAttributesEx() so we can share the code with WinCE.
+
+        * platform/win/FileSystemWin.cpp:
+        (WebCore::createFileHandle):
+        (WebCore::getFileInformation):
+        (WebCore::getFileSize):
+        (WebCore::getFileModificationTime):
+        (WebCore::fileExists):
+
+2011-03-19  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Martin Robinson.
+
+        [GTK] Simplify GObjectEventListener
+        https://bugs.webkit.org/show_bug.cgi?id=56698
+
+        Get rid of special case for DOMWindow, since it's also an
+        EventTarget.
+
+        * bindings/gobject/GObjectEventListener.cpp:
+        (WebCore::GObjectEventListener::GObjectEventListener): remove
+        DOMWindow special casing.
+        (WebCore::GObjectEventListener::~GObjectEventListener): ditto.
+        (WebCore::GObjectEventListener::gobjectDestroyed):
+        * bindings/gobject/GObjectEventListener.h:
+        (WebCore::GObjectEventListener::addEventListener): ditto.
+        (WebCore::GObjectEventListener::removeEventListener): ditto.
+
+2011-03-19  Ben Taylor  <bentaylor.solx86@gmail.com>
+
+        Reviewed by Nikolas Zimmermann.
+
+        https://bugs.webkit.org/show_bug.cgi?id=56195
+        Fix conditional which had an int for one case and a pointer for another.
+        Similar fix as https://bugs.webkit.org/show_bug.cgi?id=56198
+
+        No new tests. Fix compilation on Solaris 10 with Sun Studio C++
+
+        * svg/SVGElement.cpp:
+        (WebCore::SVGElement::sendSVGLoadEventIfPossible):
+
+2011-03-19  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Rename WTF::StringHasher methods
+        https://bugs.webkit.org/show_bug.cgi?id=53532
+
+        Rename createHash to computeHash and createBlobHash to hashMemory.
+        Also add a using WTF::StringHasher in the header file.
+
+        * dom/Document.cpp:
+        (WebCore::FormElementKeyHash::hash):
+        * dom/QualifiedName.h:
+        (WebCore::hashComponents):
+        * dom/StyledElement.cpp:
+        (WebCore::MappedAttributeHash::hash):
+        * loader/appcache/ApplicationCacheStorage.cpp:
+        (WebCore::urlHostHash):
+        * page/SecurityOriginHash.h:
+        (WebCore::SecurityOriginHash::hash):
+        * platform/LinkHash.cpp:
+        (WebCore::visitedLinkHashInline):
+        * platform/cf/BinaryPropertyList.cpp:
+        (WebCore::IntegerArrayHash::hash):
+        * platform/cf/SchedulePair.h:
+        (WebCore::SchedulePairHash::hash):
+        * platform/graphics/FontCache.cpp:
+        (WebCore::computeHash):
+        * platform/graphics/chromium/FontPlatformDataChromiumWin.h:
+        (WebCore::FontPlatformData::RefCountedHFONT::hash):
+        * platform/graphics/cocoa/FontPlatformData.h:
+        (WebCore::FontPlatformData::hash):
+        * platform/graphics/pango/FontPlatformData.h:
+        (WebCore::FontPlatformData::hash):
+        * platform/graphics/wince/FontPlatformData.cpp:
+        (WebCore::FixedSizeFontDataKeyHash::hash):
+        * platform/graphics/wx/FontPlatformDataWx.cpp:
+        (WebCore::FontPlatformData::computeHash):
+        * platform/network/ProtectionSpaceHash.h:
+        (WebCore::ProtectionSpaceHash::hash):
+        * plugins/PluginPackage.cpp:
+        (WebCore::PluginPackage::hash):
+        * plugins/win/PluginPackageWin.cpp:
+        (WebCore::PluginPackage::hash):
+        * svg/properties/SVGAnimatedPropertyDescription.h:
+        (WebCore::SVGAnimatedPropertyDescriptionHash::hash):
+
+2011-03-18  David Kilzer  <ddkilzer@apple.com>
+
+        <http://webkit.org/b/56688> Fix clang static analyzer warning in WebCoreViewFactory.m
+
+        Reviewed by Anders Carlsson.
+
+        Fixes the following static analyzer warning:
+
+            Source/WebCore/page/mac/WebCoreViewFactory.m:45:5: warning: Returning 'self' while it is not set to the result of '[(super or self) init...]'
+                 return self;
+                 ^
+
+        * page/mac/WebCoreViewFactory.m:
+        (-[WebCoreViewFactory init]): Assign the result of [super init]
+        to self.
+
+2011-03-18  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        WebCore GYP build should build
+        https://bugs.webkit.org/show_bug.cgi?id=56696
+
+        After this patch, the WebCore GYP build successfully compiles and
+        links.  I haven't trying executing it yet.
+
+        * WebCore.gypi:
+            - DOMMouseEvent should be included as part of the Objective-C bindings.
+        * WebCore.xcodeproj/project.pbxproj:
+            - RenderSVGPath.cpp was mistakenly included directly in the project
+              instead of being built by RenderSVGAllInOne.
+        * gyp/WebCore.gyp:
+            - Exclude some more files from the build.  These files are absent
+              in the normal build.  I didn't see them earlier because the dead
+              code stripping was hiding them.  (They're probably unreferenced.)
+            - Switch to using RenderSVGAllInOne.  I'm not entirely sure if this
+              part of the patch is necessary, but it matches the normal build
+              more closely.
+        * platform/mac/WebCoreObjCExtras.mm:
+            - The normal build passes the -Wdeprecated-declarations flag when
+              compiling this file.  The GYP folks explicitly do not want to add
+              that feature to GYP, and there does not appear to be a way to
+              remove the deprecated call from this file.
+        * rendering/svg/RenderSVGAllInOne.cpp:
+            - Add RenderSVGPath.cpp, which was missing previously.
+
+2011-03-18  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        WebCore GYP build should (almost!) link
+        https://bugs.webkit.org/show_bug.cgi?id=56689
+
+        This patch is a grab-bag of small changes to bring the WebCore GYP
+        build down to two link errors or one compile error (take your pick).
+        We might need a GYP change to get this last file to compile, however.
+
+        * WebCore.gypi:
+        * gyp/WebCore.gyp:
+
+2011-03-16  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Ojan Vafai.
+
+        Add a test for r81266 and fix HTML Editing for fallback contents in object element
+        https://bugs.webkit.org/show_bug.cgi?id=56505
+
+        The bug was caused by canHaveChildrenForEditing's always returning false even when
+        object element used fallback content. Fixed the bug by adding a check.
+
+        Test: editing/editability/ignored-content.html
+
+        * editing/htmlediting.cpp:
+        (WebCore::canHaveChildrenForEditing):
+
+2011-03-18  Andy Estes  <aestes@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        REGRESSION (r80231): Bad cast in HTMLTreeBuilder::processStartTag
+        https://bugs.webkit.org/show_bug.cgi?id=56380
+        
+        Fix two issues with parsing a fragment that has a foreign content
+        element as its context element. The first issue is that the parser will
+        initially be in the InForeignContentMode insertion mode when processing
+        the first tag in the fragment in this case so one call site needs to
+        change from currentElement() to currentNode(). The second issue is that
+        when we changed fragments from using a fake HTML root element to a
+        DocumentFragment we broke checks that assumed the root element was in
+        the HTML namespace. Fix this by claiming that the DocumentFragment is
+        also in the HTML namespace.
+
+        Test: fast/parser/fragment-foreign-content-context.html
+
+        * html/parser/HTMLElementStack.cpp:
+        (WebCore::HTMLNames::isForeignContentScopeMarker):
+        (WebCore::HTMLElementStack::hasOnlyHTMLElementsInScope):
+        * html/parser/HTMLElementStack.h:
+        (WebCore::isInHTMLNamespace):
+        * html/parser/HTMLTreeBuilder.cpp:
+        (WebCore::HTMLTreeBuilder::constructTreeFromAtomicToken):
+        (WebCore::HTMLTreeBuilder::processStartTag):
+        (WebCore::HTMLTreeBuilder::processEndTag):
+
+2011-03-18  James Robinson  <jamesr@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        REGRESSION(78846) [chromium] Justified text renders at incorrect offsets on windows
+        https://bugs.webkit.org/show_bug.cgi?id=56629
+
+        Preserves offsets as absolute floating point offsets and rounds to
+        advances at the last possible second.  I can't prove to myself that
+        this is sound but it seems to work on the test cases I've constructed.
+
+        Will probably change the pixel tests on chromium windows given that we
+        were horribly broken before this patch.
+
+        * platform/graphics/chromium/FontChromiumWin.cpp:
+        (WebCore::Font::drawGlyphs):
+        (WebCore::Font::drawComplexText):
+
+2011-03-18  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        REGRESSION(81374, 81384): editing/deleting/5206311-1.html hits assertion on non-Mac platforms
+        https://bugs.webkit.org/show_bug.cgi?id=56599
+
+        Debug build fix.
+
+        * dom/Position.cpp:
+        (WebCore::Position::parentAnchoredEquivalent): If the original position was a position before a node,
+        then we can't necessarily instantiate a position inside the node.
+        * editing/VisibleSelection.cpp:
+        (WebCore::VisibleSelection::toNormalizedRange): Even if s and e were not null, container nodes of s and e
+        could be null. Exit early in those cases as well.
+
+2011-03-18  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Add ObjC bindings to the WebCore GYP build
+        https://bugs.webkit.org/show_bug.cgi?id=56671
+
+        It turns out we generate a bunch of ObjC bindings files that we don't
+        actually build.  I've manually synced the list of ObjC derived source
+        files to match the existing list.  This brings us down to 19 link
+        errors.
+
+        * WebCore.gypi:
+        * gyp/WebCore.gyp:
+
+2011-03-18  Ryuan Choi  <ryuan.choi@samsung.com>
+
+        Reviewed by Eric Seidel.
+
+        [CMAKE] Split JSC related configurations from WebCore/CMakeLists.txt
+        https://bugs.webkit.org/show_bug.cgi?id=56624
+
+        No new tests, just splitting jsc related configuration.
+
+        * CMakeLists.txt:
+        * UseJSC.cmake: Added.
+
+2011-03-16  Stephen White  <senorblanco@chromium.org>
+
+        Reviewed by Kenneth Russell.
+
+        Implement GPU-accelerated shadows.
+        https://bugs.webkit.org/show_bug.cgi?id=56476
+
+        For hard shadows, we simply offset the CTM and draw in the shadow
+        color.  For soft shadows, we use a separable Gaussian convolution,
+        with a bilinear downsample and Mitchell-Netravali upsample in order to
+        preserve quality.
+
+        * WebCore.gypi:
+        Add BicubicShader and ConvolutionShader to the build.
+        * platform/graphics/chromium/GLES2Canvas.cpp:
+        (WebCore::GLES2Canvas::State::State):
+        Add shadow-related members to the GLES2Canvas::State
+        (WebCore::GLES2Canvas::State::shadowActive):
+        Add a helper function to know if shadows are active.
+        (WebCore::GLES2Canvas::clearRect):
+        (WebCore::GLES2Canvas::scissorClear):
+        Refactor the scissor clearing function out of clearRect().
+        (WebCore::GLES2Canvas::fillPath):
+        Add hook for shadow rendering in paths.  Bind framebuffer at this level.
+        (WebCore::GLES2Canvas::fillRect):
+        Add hook for shadow rendering in rects.  Bind framebuffer at this level.
+        (WebCore::GLES2Canvas::fillRectInternal):
+        Rename fillRect() -> fillRectInternal(), which does bind its vertex 
+        buffer, but does not bind the framebuffer.
+        (WebCore::GLES2Canvas::setShadowColor):
+        (WebCore::GLES2Canvas::setShadowOffset):
+        (WebCore::GLES2Canvas::setShadowBlur):
+        (WebCore::GLES2Canvas::setShadowsIgnoreTransforms):
+        Implement graphicsContext-style setters for shadow parameters.
+        (WebCore::GLES2Canvas::clipPath):
+        Call fillPathInternal(), not fillPath().
+        (WebCore::GLES2Canvas::restore):
+        (WebCore::GLES2Canvas::drawTexturedRect):
+        Bind the framebuffer at this level.  Do not bind vertices here (will
+        be done in drawTexturedQuad).
+        (WebCore::GLES2Canvas::drawTexturedRectTile):
+        drawQuad() -> drawTexturedQuad().
+        (WebCore::GLES2Canvas::convolveRect):
+        Implement one pass of a convolution filter (X or Y).
+        (WebCore::gauss):
+        (WebCore::buildKernel):
+        Some helper functions to build a Gaussian convolution kernel.
+        (WebCore::GLES2Canvas::drawTexturedQuad):
+        Rename drawQuad() -> drawTexturedQuad(), to be more clear.  Do not
+        bind the framebuffer at this level (it will be done higher).
+        (WebCore::GLES2Canvas::drawTexturedQuadMitchell):
+        Implement Mitchell-Netravali bicubic sampling, using BicubicShader.
+        (WebCore::GLES2Canvas::fillPathInternal):
+        Rename fillPath() -> fillPathInternal(), which does use quad vertices,
+        but does not bind the framebuffer or set the compositing mode.
+        (WebCore::GLES2Canvas::flipRect):
+        Implement a helper function to flip a rectangle in Y within the canvas.
+        (WebCore::GLES2Canvas::clearBorders):
+        Implement a helper function to clear an n-pixel border around a rect.
+        (WebCore::GLES2Canvas::beginShadowDraw):
+        Setup before drawing a primitive's shadow:  for hard shadows, just
+        offset the CTM by the shadow offset.  For soft shadows, bind to an
+        offscreen DrawingBuffer.
+        (WebCore::GLES2Canvas::endShadowDraw):
+        Tear-down after drawing a primitive's shadow:  for hard shadows, just
+        restore the CTM.  For soft shadows, downsample (if necessary), then
+        blur in X, blur in Y, upsample if necessary).
+        * platform/graphics/chromium/GLES2Canvas.h:
+        * platform/graphics/gpu/BicubicShader.cpp: Added.
+        (WebCore::BicubicShader::BicubicShader):
+        (WebCore::BicubicShader::create):
+        (WebCore::BicubicShader::use):
+        * platform/graphics/gpu/BicubicShader.h: Added.
+        Implement a bicubic image filtering shader.
+        * platform/graphics/gpu/ConvolutionShader.cpp: Added.
+        (WebCore::ConvolutionShader::ConvolutionShader):
+        (WebCore::ConvolutionShader::create):
+        (WebCore::ConvolutionShader::use):
+        * platform/graphics/gpu/ConvolutionShader.h: Added.
+        Implement a 1-dimensional convolution shader.  In order to minimize
+        texture samples, this shader is parameterized at compile time by the
+        width of the convolution kernel.
+        * platform/graphics/gpu/DrawingBuffer.h:
+        (WebCore::DrawingBuffer::colorBuffer):
+        Add an accessor to retrieve a DrawingBuffer's texture ID.
+        * platform/graphics/gpu/SharedGraphicsContext3D.cpp:
+        (WebCore::SharedGraphicsContext3D::create):
+        (WebCore::SharedGraphicsContext3D::SharedGraphicsContext3D):
+        (WebCore::SharedGraphicsContext3D::useBicubicProgram):
+        (WebCore::SharedGraphicsContext3D::useConvolutionProgram):
+        Create BicubicShader and cMaxKernelWidth ConvolutionShader's (one for
+        each possible kernel width).
+        (WebCore::SharedGraphicsContext3D::getOffscreenBuffer):
+        Implement a simple cache of offscreen DrawingBuffers, integer-indexed.
+        This is done to minimize the VRAM usage:  only 2 buffers are used for
+        all canvases.
+        * platform/graphics/gpu/SharedGraphicsContext3D.h:
+        Add bicubic and convolution shader members, and useXXX() functions.
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        (WebCore::GraphicsContext::setPlatformShadow):
+        Hook into GraphicsContextSkia's platform shadow setters to set
+        parameters on GLES2Canvas.
+        * platform/graphics/skia/PlatformContextSkia.cpp:
+        (WebCore::PlatformContextSkia::canAccelerate):
+        Remove shadows (loopers) from the list of things we can't accelerate.
+
+2011-03-18  Andreas Kling  <kling@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Remove unused method FontFallbackList::fontDataForCharacters()
+        https://bugs.webkit.org/show_bug.cgi?id=56657
+
+        * platform/graphics/Font.h:
+        * platform/graphics/FontFallbackList.cpp:
+        * platform/graphics/FontFallbackList.h:
+
+2011-03-18  Andreas Kling  <kling@webkit.org>
+
+        Reverting accidental changes in r81498.
+
+2011-03-18  Ilya Tikhonovsky  <loislo@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: rename console agent events.
+        https://bugs.webkit.org/show_bug.cgi?id=56646
+
+        addConsoleMessage -> consoleMessage
+        updateConsoleMessageExpiredCount -> consoleMessageExpiredCountUpdate
+        updateConsoleMessageRepeatCount -> consoleMessageRepeatCountUpdate
+
+        * inspector/ConsoleMessage.cpp:
+        (WebCore::ConsoleMessage::addToFrontend):
+        (WebCore::ConsoleMessage::updateRepeatCountInConsole):
+        * inspector/Inspector.json:
+        * inspector/InspectorConsoleAgent.cpp:
+        (WebCore::InspectorConsoleAgent::setConsoleMessagesEnabled):
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype._registerConsoleDomainDispatcher.dispatcher.consoleMessage):
+        (WebInspector.ConsoleView.prototype._registerConsoleDomainDispatcher.dispatcher.consoleMessageExpiredCountUpdate):
+        (WebInspector.ConsoleView.prototype._registerConsoleDomainDispatcher.dispatcher.consoleMessageRepeatCountUpdate):
+
+2011-03-18  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r81487.
+        http://trac.webkit.org/changeset/81487
+        https://bugs.webkit.org/show_bug.cgi?id=56662
+
+        "Breaks inspector/styles/styles-add-blank-property.html"
+        (Requested by apavlov on #webkit).
+
+        * inspector/Inspector.json:
+        * inspector/InspectorCSSAgent.cpp:
+        (WebCore::InspectorCSSAgent::getAllStyles):
+        * inspector/InspectorCSSAgent.h:
+        * inspector/InspectorStyleSheet.cpp:
+        (WebCore::InspectorStyleSheet::buildObjectForStyleSheet):
+        * inspector/InspectorStyleSheet.h:
+        * inspector/front-end/AuditRules.js:
+        (WebInspector.AuditRules.UnusedCssRule.prototype.doRun.styleSheetCallback):
+        (WebInspector.AuditRules.UnusedCssRule.prototype.doRun.allStylesCallback):
+        (WebInspector.AuditRules.UnusedCssRule.prototype.doRun):
+        * inspector/front-end/CSSStyleModel.js:
+        (WebInspector.CSSStyleModel.prototype._styleSheetChanged.callback):
+        (WebInspector.CSSStyleModel.prototype._styleSheetChanged):
+        (WebInspector.CSSStyleModel.prototype._onRevert):
+        (WebInspector.CSSStyleSheet):
+        (WebInspector.CSSStyleSheet.prototype.setText):
+
+2011-03-18  Justin Novosad  <junov@chromium.org>
+
+        Reviewed by Kenneth Russell.
+
+        [Chromium] Canvas shadow is not working with drawImage
+        https://bugs.webkit.org/show_bug.cgi?id=55506
+
+        Patch also fixes shadow blur quality and color. 
+        Affects Chromium win/linux. Also fixes the following bugs:
+        https://bugs.webkit.org/show_bug.cgi?id=50112
+        https://bugs.webkit.org/show_bug.cgi?id=51989
+        https://bugs.webkit.org/show_bug.cgi?id=55410
+        No tests were added, impact is already covered by multiple layout tests.
+
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        (WebCore::GraphicsContext::setPlatformShadow):
+        * platform/graphics/skia/ImageSkia.cpp:
+        (WebCore::paintSkBitmap):
+
+2011-03-15  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: Fix handling of the CSSAgent.setStyleSheetText() results in CSSStyleModel.js
+        https://bugs.webkit.org/show_bug.cgi?id=56310
+
+        Instead of stylesheet ids, CSSAgent.getAllStyleSheets() now returns metainfo objects containing
+        "styleSheetId", "sourceURL", "disabled", and "title" fields. The latter three are not returned
+        by CSSAgent.getStyleSheet() anymore.
+
+        Test: inspector/styles/get-set-stylesheet-text.html
+
+        * inspector/Inspector.json:
+        * inspector/InspectorCSSAgent.cpp:
+        (WebCore::InspectorCSSAgent::getAllStyleSheets):
+        * inspector/InspectorCSSAgent.h:
+        * inspector/InspectorStyleSheet.cpp:
+        (WebCore::InspectorStyleSheet::buildObjectForStyleSheet):
+        (WebCore::InspectorStyleSheet::buildObjectForStyleSheetInfo):
+        * inspector/InspectorStyleSheet.h:
+        * inspector/front-end/AuditRules.js:
+        (WebInspector.AuditRules.UnusedCssRule.prototype.doRun.styleSheetCallback):
+        (WebInspector.AuditRules.UnusedCssRule.prototype.doRun.allStylesCallback):
+        (WebInspector.AuditRules.UnusedCssRule.prototype.doRun):
+        * inspector/front-end/CSSStyleModel.js:
+        (WebInspector.CSSStyleModel.prototype._styleSheetChanged.callback):
+        (WebInspector.CSSStyleModel.prototype._styleSheetChanged):
+        (WebInspector.CSSStyleModel.prototype._onRevert):
+        (WebInspector.CSSStyleSheet):
+        (WebInspector.CSSStyleSheet.prototype.setText):
+
+2011-03-18  David Keijser  <keijser@gmail.com> and Xan Lopez <xlopez@igalia.com>
+
+        Reviewed by Martin Robinson.
+
+        [GTK] On-demand event-listeners for DOM event signals
+        https://bugs.webkit.org/show_bug.cgi?id=49649
+
+        Add explicit EventTarget API to add/remove event listeners instead
+        of using GSignal, which due to internal limitations in glib makes
+        us preemptively add listeners for all event types.
+
+        * bindings/gobject/GObjectEventListener.cpp: add new
+        addEventListener/removeEventListener methods, and small
+        refactoring to store an EventTarget internally instead of a DOM
+        node, which is more generic and can be reused in more cases.
+        * bindings/gobject/GObjectEventListener.h: ditto.
+        * bindings/gobject/WebKitDOMEventTarget.cpp:
+        (webkit_dom_event_target_add_event_listener): new iface method to
+        add an event listener.
+        (webkit_dom_event_target_remove_event_listener): new iface method
+        to remove an event listener.
+        * bindings/gobject/WebKitDOMEventTarget.h: add new iface methods.
+        * bindings/scripts/CodeGeneratorGObject.pm: change code generation
+        accordingly.
+
+2011-03-18  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=56425
+        More groundwork for WebKit2 IconDatabase
+
+        -Update the synchronous method names to be prefixed with "synchronous."
+        -Call asynchronous versions of the appropriate methods if the IconDatabase supports them.
+
+        Update icon database calls to be prefixed with "synchronous":
+        * loader/archive/cf/LegacyWebArchive.cpp:
+        (WebCore::LegacyWebArchive::create):
+        * loader/icon/IconDatabaseBase.h:
+        (WebCore::IconDatabaseBase::synchronousIconDataKnownForIconURL):
+        (WebCore::IconDatabaseBase::synchronousLoadDecisionForIconURL):
+        (WebCore::IconDatabaseBase::synchronousIconForPageURL):
+        * loader/icon/IconDatabase.cpp:
+        (WebCore::IconDatabase::synchronousIconForPageURL):
+        (WebCore::IconDatabase::readIconForPageURLFromDisk):
+        (WebCore::IconDatabase::synchronousIconURLForPageURL):
+        (WebCore::IconDatabase::synchronousLoadDecisionForIconURL):
+        (WebCore::IconDatabase::synchronousIconDataKnownForIconURL):
+        * loader/icon/IconDatabase.h:
+        * loader/icon/IconDatabaseBase.cpp:
+        (WebCore::IconDatabaseBase::synchronousIconURLForPageURL):
+
+        Add nascent support for an asynchronous icon database mode:
+        * loader/icon/IconDatabaseBase.h:
+        (WebCore::EnumCallback::create):
+        (WebCore::EnumCallback::~EnumCallback):
+        (WebCore::EnumCallback::performCallback):
+        (WebCore::EnumCallback::invalidate):
+        (WebCore::EnumCallback::EnumCallback):
+        (WebCore::ObjectCallback::create):
+        (WebCore::ObjectCallback::~ObjectCallback):
+        (WebCore::ObjectCallback::performCallback):
+        (WebCore::ObjectCallback::invalidate):
+        (WebCore::ObjectCallback::ObjectCallback):
+        (WebCore::IconDatabaseBase::supportsAsynchronousMode):
+        (WebCore::IconDatabaseBase::loadDecisionForIconURL):
+        (WebCore::IconDatabaseBase::iconDataForIconURL):
+
+        Add interfaces to use the asynchronous versions of certain IconDatabase calls:
+        * loader/DocumentLoader.cpp:
+        (WebCore::DocumentLoader::~DocumentLoader):
+        (WebCore::DocumentLoader::iconLoadDecisionAvailable):
+        (WebCore::iconLoadDecisionCallback):
+        (WebCore::DocumentLoader::getIconLoadDecisionForIconURL):
+        (WebCore::DocumentLoader::continueIconLoadWithDecision):
+        (WebCore::iconDataCallback):
+        (WebCore::DocumentLoader::getIconDataForIconURL):
+        * loader/DocumentLoader.h:
+
+        Break "startIconLoader" into two pieces so it can be used from both the synchronous and asynchronous 
+        icon database modes:
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::iconLoadDecisionReceived):
+        (WebCore::FrameLoader::startIconLoader):
+        (WebCore::FrameLoader::continueIconLoadWithDecision):
+        * loader/FrameLoader.h:
+
+        * WebCore.exp.in:
+
+2011-03-18  Pavel Feldman  <pfeldman@chromium.org>
+
+        Not reviewed: add missing brace to the generated Inspector.idl.
+
+        * inspector/generate-inspector-idl:
+
+2011-03-18  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: migrate from Inspector.idl to InspectorAPI.json for protocol schema definition meta bug.
+        https://bugs.webkit.org/show_bug.cgi?id=56294
+
+        * CMakeLists.txt:
+        * CodeGenerators.pri:
+        * DerivedSources.make:
+        * GNUmakefile.am:
+        * WebCore.gyp/WebCore.gyp:
+        * inspector/Inspector.idl: Removed.
+        * inspector/Inspector.json: Added.
+        * inspector/generate-inspector-idl: Added.
+
+2011-03-18  Pavel Podivilov  <podivilov@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: implement inspector session storage.
+        https://bugs.webkit.org/show_bug.cgi?id=56643
+
+        We would like to enable debugger/profiler from frontend side only.
+        However, when user clicks "Start Debugging JavaScript" in Safari, we
+        need to enable debugger when frontend is opened or re-opened for the
+        same page. The idea is to store debugger-enabled setting in session
+        storage and check it on frontend load.
+
+        * inspector/InspectorFrontendClient.h:
+        (WebCore::InspectorFrontendClient::saveSessionSetting):
+        (WebCore::InspectorFrontendClient::loadSessionSetting):
+        * inspector/InspectorFrontendHost.cpp:
+        (WebCore::InspectorFrontendHost::saveSessionSetting):
+        (WebCore::InspectorFrontendHost::loadSessionSetting):
+        * inspector/InspectorFrontendHost.h:
+        * inspector/InspectorFrontendHost.idl:
+
+2011-03-18  Jarkko Sakkinen  <jarkko.j.sakkinen@gmail.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Enable GraphicsContext3D only when the window surface support OpenGL
+        https://bugs.webkit.org/show_bug.cgi?id=56555
+
+        Allow creation of WebGLRenderingContext in the HTMLCanvasElement
+        only if accelerated compositing is enabled. In GraphicsContext3D,
+        while blitting the surface check that viewport hasn't changed from
+        creation and painter is associated to the viewport.
+
+        * html/HTMLCanvasElement.cpp:
+        (WebCore::HTMLCanvasElement::getContext):
+        * platform/graphics/qt/GraphicsContext3DQt.cpp:
+        (WebCore::GraphicsContext3DInternal::GraphicsContext3DInternal):
+        (WebCore::GraphicsContext3DInternal::getViewportGLWidget):
+        (WebCore::GraphicsContext3DInternal::paint):
+
+2011-03-17  Pavel Podivilov  <podivilov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: extract content loading logic from scripts panel.
+        https://bugs.webkit.org/show_bug.cgi?id=55237
+
+        Encapsulate source files creation logic in debugger presentation model
+        to support source mappings in a pluggable way.
+
+        * inspector/front-end/DebuggerPresentationModel.js:
+        (WebInspector.DebuggerPresentationModel.prototype.sourceFile):
+        (WebInspector.DebuggerPresentationModel.prototype.requestSourceFileContent.else.didRequestSource):
+        (WebInspector.DebuggerPresentationModel.prototype.requestSourceFileContent):
+        (WebInspector.DebuggerPresentationModel.prototype._parsedScriptSource):
+        (WebInspector.DebuggerPresentationModel.prototype._failedToParseScriptSource):
+        (WebInspector.DebuggerPresentationModel.prototype._addScript.else.resourceFinished):
+        (WebInspector.DebuggerPresentationModel.prototype._addScript):
+        (WebInspector.DebuggerPresentationModel.prototype._ensureSourceFileAdded):
+        (WebInspector.DebuggerPresentationModel.prototype._resourceForURL):
+        (WebInspector.DebuggerPresentationModel.prototype._scriptSourceChanged):
+        (WebInspector.DebuggerPresentationModel.prototype._sourceFileAdded):
+        (WebInspector.DebuggerPresentationModel.prototype.breakpointsForSourceFileId):
+        (WebInspector.DebuggerPresentationModel.prototype.findBreakpoint):
+        (WebInspector.DebuggerPresentationModel.prototype._breakpointAdded):
+        (WebInspector.DebuggerPresentationModel.prototype._breakpointRemoved):
+        (WebInspector.DebuggerPresentationModel.prototype._breakpointResolved):
+        (WebInspector.DebuggerPresentationModel.prototype._restoreBreakpoints):
+        (WebInspector.DebuggerPresentationModel.prototype.set selectedCallFrame):
+        (WebInspector.DebuggerPresentationModel.prototype._actualLocationToSourceLocation):
+        (WebInspector.DebuggerPresentationModel.prototype.reset):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel):
+        (WebInspector.ScriptsPanel.prototype._sourceFileAdded):
+        (WebInspector.ScriptsPanel.prototype._showSourceFrame):
+        (WebInspector.ScriptsPanel.prototype._sourceFileChanged):
+        (WebInspector.ScriptsPanel.prototype._callFrameSelected):
+        (WebInspector.SourceFrameDelegateForScriptsPanel.prototype.requestContent):
+
+2011-03-18  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: console doesn&apos;t scroll when multiline expression is being evaluated
+        https://bugs.webkit.org/show_bug.cgi?id=56639
+
+        Always scoll in the console when command result is received.
+
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype.addMessage):
+
+2011-03-18  Adam Roben  <aroben@apple.com>
+
+        Fix a CFNumber leak seen on the leaks bot
+
+        Reviewed by Gavin Barraclough.
+
+        * platform/network/mac/FormDataStreamMac.mm:
+        (WebCore::advanceCurrentStream): Use a RetainPtr to cause the CFNumber we allocate to be
+        released.
+
+2011-03-17  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Add some of the remaining platform/mac files to WebCore GYP build
+        https://bugs.webkit.org/show_bug.cgi?id=56616
+
+        These files used to be hard, but are now magically easy.  76 link errors.
+
+        * gyp/WebCore.gyp:
+
+2011-03-17  Adam Klein  <adamk@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        [filesystem] Rename toURI->toURL, resolveLocalFileSystemURI->resolveLocalFileSystemURL
+        https://bugs.webkit.org/show_bug.cgi?id=56502
+
+        * fileapi/Entry.idl:
+        * fileapi/EntryBase.cpp:
+        (WebCore::EntryBase::toURL):
+        * fileapi/EntryBase.h:
+        * fileapi/EntrySync.idl:
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::resolveLocalFileSystemURL):
+        * page/DOMWindow.h:
+        * page/DOMWindow.idl:
+
+2011-03-17  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Update CSP directive parser to match spec
+        https://bugs.webkit.org/show_bug.cgi?id=56582
+
+        Brandon updated the CSP spec.  I've updated our implementation to
+        match.  In the process, I found a couple bugs in the spec, which I've
+        sent to the working group.  This patch assumes that the bugs will be
+        fixed in the way I suggested.  If they get fixed a different way, we
+        might need to update the parser again.
+
+        Test: http/tests/security/contentSecurityPolicy/directive-parsing.html
+
+        * page/ContentSecurityPolicy.cpp:
+        (WebCore::isDirectiveNameCharacter):
+        (WebCore::isDirectiveValueCharacter):
+        (WebCore::advanceUntil):
+        (WebCore::ContentSecurityPolicy::parse):
+        (WebCore::ContentSecurityPolicy::parseDirective):
+        * page/ContentSecurityPolicy.h:
+
+2011-03-17  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        WebCore GYP build should have PrivateHeaders
+        https://bugs.webkit.org/show_bug.cgi?id=56604
+
+        I've manually verified that this produces the correct set of
+        PrivateHeaders (modulo the ForwardingHeaders and icu issue).
+        Unforunately, this patch breakes compile slightly, but I'll fix that
+        in a followup patch.
+
+        * WebCore.gyp/WebCore.gyp:
+        * WebCore.gypi:
+        * gyp/WebCore.gyp:
+
+2011-03-17  Victoria Kirst  <vrk@google.com>
+
+        Reviewed by Kenneth Russell.
+
+        [chromium] Video colors have wrong brightness/contrast
+        https://bugs.webkit.org/show_bug.cgi?id=56598
+
+        This patch changes the YUV to RGB color conversion matrix
+        to have brighter whites and darker blacks in accordance to
+        the BT.601 standard.
+
+        * platform/graphics/chromium/ShaderChromium.cpp:
+        (WebCore::FragmentShaderYUVVideo::FragmentShaderYUVVideo):
+        (WebCore::FragmentShaderYUVVideo::init):
+        (WebCore::FragmentShaderYUVVideo::getShaderString):
+        * platform/graphics/chromium/ShaderChromium.h:
+        (WebCore::FragmentShaderYUVVideo::yuvAdjLocation):
+        * platform/graphics/chromium/VideoLayerChromium.cpp:
+        (WebCore::VideoLayerChromium::drawYUV):
+        * platform/graphics/chromium/VideoLayerChromium.h:
+
+2011-03-17  Zhenyao Mo  <zmo@google.com>
+
+        Reviewed by Adam Barth.
+
+        RequestAnimationFrame callbacks prevent Document from being released on detach
+        https://bugs.webkit.org/show_bug.cgi?id=56607
+
+        * dom/Document.cpp:
+        (WebCore::Document::removedLastRef): Remove RequestAnimationFrame callbacks.
+        (WebCore::Document::detach): Ditto.
+
+2011-03-17  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=56596 Overlay scrollbars sometimes 
+        fail to appear
+        -and corresponding-
+        <rdar://problem/8953779>
+
+        * platform/mac/ScrollAnimatorMac.mm:
+        (-[ScrollbarPainterDelegate setUpAnimation:scrollerPainter:part:WebCore::animateAlphaTo:duration:]):
+
+2011-03-17  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        <rdar://problem/9052166> Emphasis marks appear over combined text rather than beside it
+        https://bugs.webkit.org/show_bug.cgi?id=56480
+
+        Test: fast/text/emphasis-combined-text.html
+
+        * rendering/InlineTextBox.cpp:
+        (WebCore::rotation): Added this helper.
+        (WebCore::InlineTextBox::paint): Paint a single emphasis mark beside the combined text,
+        centered vertically.
+
+2011-03-17  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Blob URL should not be allow to get created from the code running from data URI
+        https://bugs.webkit.org/show_bug.cgi?id=56600
+
+        Test: http/tests/fileapi/create-blob-url-from-data-url.html
+
+        * dom/ScriptExecutionContext.cpp:
+        (WebCore::ScriptExecutionContext::createPublicBlobURL):
+        * fileapi/BlobURL.cpp:
+        (WebCore::BlobURL::createBlobURL):
+        * fileapi/EntryBase.cpp:
+        (WebCore::EntryBase::toURI):
+        * fileapi/FileReaderLoader.cpp:
+        (WebCore::FileReaderLoader::start):
+
+2011-03-17  Jeff Miller  <jeffm@apple.com>
+
+        Use a consistent set of file patterns in the svn:ignore property for all .xcodeproj directories, specifically:
+        
+        *.mode*
+        *.pbxuser
+        *.perspective*
+        project.xcworkspace
+        xcuserdata
+
+        * WebCore.xcodeproj: Modified property svn:ignore.
+        * manual-tests/NPN_Invoke/NPN_Invoke.xcodeproj: Modified property svn:ignore.
+
+2011-03-17  Sam Weinig  <sam@webkit.org>
+
+        Fix Mac build.
+
+        * WebCore.exp.in:
+        Add missing symbol.
+
+2011-03-17  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Adele Peterson and Enrica Casucci.
+
+        Assert that editing does not ignore position's anchorNode if position is an offset in anchor
+        https://bugs.webkit.org/show_bug.cgi?id=56027
+
+        Debug build fix.
+
+        * dom/Element.cpp:
+        (WebCore::Element::updateFocusAppearance): "this" can be an input element so can't always instantiate
+        a position inside the node. Call firstPositionInOrBeforeNode instead.
+        * editing/ReplaceSelectionCommand.cpp:
+        (WebCore::positionAvoidingPrecedingNodes): Exit early when a node's content is ignored by editing instead
+        of just when the node is br.
+        * editing/htmlediting.cpp:
+        (WebCore::lastEditablePositionBeforePositionInRoot): The shadow ancestor node is usually an input element
+        so don't instantiate a position inside it. Call firstPositionInOrBeforeNode instead.
+
+2011-03-17  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r81369.
+        http://trac.webkit.org/changeset/81369
+        https://bugs.webkit.org/show_bug.cgi?id=56579
+
+        breaks debugger test (Requested by podivilov on #webkit).
+
+        * inspector/front-end/DebuggerPresentationModel.js:
+        (WebInspector.DebuggerPresentationModel.prototype._parsedScriptSource):
+        (WebInspector.DebuggerPresentationModel.prototype._failedToParseScriptSource):
+        (WebInspector.DebuggerPresentationModel.prototype._scriptSourceChanged):
+        (WebInspector.DebuggerPresentationModel.prototype.breakpointsForSourceFileId):
+        (WebInspector.DebuggerPresentationModel.prototype.findBreakpoint):
+        (WebInspector.DebuggerPresentationModel.prototype._breakpointAdded):
+        (WebInspector.DebuggerPresentationModel.prototype._breakpointRemoved):
+        (WebInspector.DebuggerPresentationModel.prototype._breakpointResolved):
+        (WebInspector.DebuggerPresentationModel.prototype._encodeSourceLocation):
+        (WebInspector.DebuggerPresentationModel.prototype._restoreBreakpoints):
+        (WebInspector.DebuggerPresentationModel.prototype.set selectedCallFrame):
+        (WebInspector.DebuggerPresentationModel.prototype._actualLocationToSourceLocation):
+        (WebInspector.DebuggerPresentationModel.prototype.reset):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel):
+        (WebInspector.ScriptsPanel.prototype._parsedScriptSource):
+        (WebInspector.ScriptsPanel.prototype._failedToParseScriptSource):
+        (WebInspector.ScriptsPanel.prototype._scriptSourceChanged):
+        (WebInspector.ScriptsPanel.prototype._addScript):
+        (WebInspector.ScriptsPanel.prototype._resourceForURL):
+        (WebInspector.ScriptsPanel.prototype._resourceLoadingFinished):
+        (WebInspector.ScriptsPanel.prototype._addOptionToFilesSelectAndShowSourceFrameIfNeeded):
+        (WebInspector.ScriptsPanel.prototype._showSourceFrame):
+        (WebInspector.ScriptsPanel.prototype._recreateSourceFrame):
+        (WebInspector.ScriptsPanel.prototype._sourceFileIdForScript):
+        (WebInspector.ScriptsPanel.prototype._callFrameSelected):
+        (WebInspector.SourceFrameDelegateForScriptsPanel.prototype.requestContent):
+
+2011-03-17  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Justin Garcia.
+
+        Assert that editing does not ignore position's anchorNode if position is an offset in anchor
+        https://bugs.webkit.org/show_bug.cgi?id=56027
+
+        Added the assertion in Position::Position and Position::moveToPosition. This assertion catches
+        places where we instantiate positions inside a node on which editingIgnoresContent returns true.
+
+        Test: editing/execCommand/button.html
+
+        * dom/Position.cpp:
+        (WebCore::Position::Position): Added an assertion.
+        (WebCore::Position::moveToPosition): Ditto.
+        * dom/PositionIterator.cpp:
+        (WebCore::PositionIterator::operator Position): Avoid creating a position immediately below
+        a node whose content is ignored by editing. While this does not avoid creation of positions
+        inside ignored contents completely, it works in most cases. Filed the bug 56027 to resolve
+        the underlying problem. Without this change, the assertion hits in existing layout tests.
+        cannot be tested directly.
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::ApplyStyleCommand::addInlineStyleIfNeeded): Call firstPositionInOrBeforeNode
+        instead of firstPositionInNode because startNode may as well be a br element. Without this change,
+        the assertion hits in existing layout tests.
+        * editing/htmlediting.cpp:
+        (WebCore::canHaveChildrenForEditing): button is editable so content is not ignored. Added a test
+        for this.
+        * editing/visible_units.cpp:
+        (WebCore::previousBoundary): Added a FIXME.
+        (WebCore::startPositionForLine): Because br can also have an inline text box, checking that
+        startBox is an inline text box isn't an adequate to instantiate a position inside startNode.
+        Call startNode->isTextNode() instead. Without this change, the assertion hits in existing layout
+        tests.
+
+2011-03-17  Pavel Podivilov  <podivilov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: extract content loading logic from scripts panel.
+        https://bugs.webkit.org/show_bug.cgi?id=55237
+
+        Encapsulate source files creation logic in debugger presentation model
+        to support source mappings in a pluggable way.
+
+        * inspector/front-end/DebuggerPresentationModel.js:
+        (WebInspector.DebuggerPresentationModel.prototype.sourceFile):
+        (WebInspector.DebuggerPresentationModel.prototype.requestSourceFileContent.else.didRequestSource):
+        (WebInspector.DebuggerPresentationModel.prototype.requestSourceFileContent):
+        (WebInspector.DebuggerPresentationModel.prototype._parsedScriptSource):
+        (WebInspector.DebuggerPresentationModel.prototype._failedToParseScriptSource):
+        (WebInspector.DebuggerPresentationModel.prototype._addScript.else.resourceFinished):
+        (WebInspector.DebuggerPresentationModel.prototype._addScript):
+        (WebInspector.DebuggerPresentationModel.prototype._ensureSourceFileAdded):
+        (WebInspector.DebuggerPresentationModel.prototype._resourceForURL):
+        (WebInspector.DebuggerPresentationModel.prototype._scriptSourceChanged):
+        (WebInspector.DebuggerPresentationModel.prototype._sourceFileAdded):
+        (WebInspector.DebuggerPresentationModel.prototype.breakpointsForSourceFileId):
+        (WebInspector.DebuggerPresentationModel.prototype.findBreakpoint):
+        (WebInspector.DebuggerPresentationModel.prototype._breakpointAdded):
+        (WebInspector.DebuggerPresentationModel.prototype._breakpointRemoved):
+        (WebInspector.DebuggerPresentationModel.prototype._breakpointResolved):
+        (WebInspector.DebuggerPresentationModel.prototype._restoreBreakpoints):
+        (WebInspector.DebuggerPresentationModel.prototype.set selectedCallFrame):
+        (WebInspector.DebuggerPresentationModel.prototype._actualLocationToSourceLocation):
+        (WebInspector.DebuggerPresentationModel.prototype.reset):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel):
+        (WebInspector.ScriptsPanel.prototype._sourceFileAdded):
+        (WebInspector.ScriptsPanel.prototype._showSourceFrame):
+        (WebInspector.ScriptsPanel.prototype._sourceFileChanged):
+        (WebInspector.ScriptsPanel.prototype._callFrameSelected):
+        (WebInspector.SourceFrameDelegateForScriptsPanel.prototype.requestContent):
+
+2011-03-17  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: add types markup to the IDL, remove Value types from the protocol.
+        https://bugs.webkit.org/show_bug.cgi?id=56562
+
+        * inspector/ConsoleMessage.cpp:
+        (WebCore::ConsoleMessage::addToFrontend):
+        * inspector/InjectedScript.cpp:
+        (WebCore::InjectedScript::evaluate):
+        (WebCore::InjectedScript::evaluateOn):
+        (WebCore::InjectedScript::evaluateOnCallFrame):
+        (WebCore::InjectedScript::getProperties):
+        (WebCore::InjectedScript::setPropertyValue):
+        (WebCore::InjectedScript::callFrames):
+        (WebCore::InjectedScript::makeCall):
+        (WebCore::InjectedScript::makeObjectCall):
+        * inspector/InjectedScript.h:
+        * inspector/InjectedScriptSource.js:
+        (.):
+        * inspector/Inspector.idl:
+        * inspector/InspectorApplicationCacheAgent.cpp:
+        (WebCore::InspectorApplicationCacheAgent::getApplicationCaches):
+        * inspector/InspectorApplicationCacheAgent.h:
+        * inspector/InspectorCSSAgent.cpp:
+        (WebCore::InspectorCSSAgent::getStylesForNode):
+        (WebCore::InspectorCSSAgent::getInlineStyleForNode):
+        (WebCore::InspectorCSSAgent::getComputedStyleForNode):
+        (WebCore::InspectorCSSAgent::getStyleSheet):
+        (WebCore::InspectorCSSAgent::setPropertyText):
+        (WebCore::InspectorCSSAgent::toggleProperty):
+        (WebCore::InspectorCSSAgent::setRuleSelector):
+        (WebCore::InspectorCSSAgent::addRule):
+        * inspector/InspectorCSSAgent.h:
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::resolveNode):
+        * inspector/InspectorDOMAgent.h:
+        * inspector/InspectorDebuggerAgent.cpp:
+        (WebCore::InspectorDebuggerAgent::editScriptSource):
+        (WebCore::InspectorDebuggerAgent::evaluateOnCallFrame):
+        (WebCore::InspectorDebuggerAgent::currentCallFrames):
+        * inspector/InspectorDebuggerAgent.h:
+        * inspector/InspectorResourceAgent.cpp:
+        (WebCore::InspectorResourceAgent::identifierForInitialRequest):
+        * inspector/InspectorRuntimeAgent.cpp:
+        (WebCore::InspectorRuntimeAgent::evaluate):
+        (WebCore::InspectorRuntimeAgent::evaluateOn):
+        (WebCore::InspectorRuntimeAgent::getProperties):
+        (WebCore::InspectorRuntimeAgent::setPropertyValue):
+        * inspector/InspectorRuntimeAgent.h:
+        * inspector/ScriptCallStack.cpp:
+        (WebCore::ScriptCallStack::buildInspectorArray):
+        * inspector/ScriptCallStack.h:
+        * inspector/TimelineRecordFactory.cpp:
+        (WebCore::TimelineRecordFactory::createGenericRecord):
+        * inspector/front-end/NetworkManager.js:
+        (WebInspector.NetworkDispatcher.prototype._createResource):
+
+2011-03-17  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r81350.
+        http://trac.webkit.org/changeset/81350
+        https://bugs.webkit.org/show_bug.cgi?id=56560
+
+        "Breaks twenty Chromium Webkit Win builder webkit_gpu_tests"
+        (Requested by apavlov on #webkit).
+
+        * WebCore.gypi:
+        * platform/graphics/chromium/GLES2Canvas.cpp:
+        (WebCore::GLES2Canvas::State::State):
+        (WebCore::GLES2Canvas::clearRect):
+        (WebCore::GLES2Canvas::fillPath):
+        (WebCore::GLES2Canvas::fillRect):
+        (WebCore::GLES2Canvas::clipPath):
+        (WebCore::GLES2Canvas::restore):
+        (WebCore::GLES2Canvas::drawTexturedRect):
+        (WebCore::GLES2Canvas::drawTexturedRectTile):
+        (WebCore::GLES2Canvas::drawQuad):
+        * platform/graphics/chromium/GLES2Canvas.h:
+        * platform/graphics/gpu/BicubicShader.cpp: Removed.
+        * platform/graphics/gpu/BicubicShader.h: Removed.
+        * platform/graphics/gpu/ConvolutionShader.cpp: Removed.
+        * platform/graphics/gpu/ConvolutionShader.h: Removed.
+        * platform/graphics/gpu/DrawingBuffer.h:
+        * platform/graphics/gpu/SharedGraphicsContext3D.cpp:
+        (WebCore::SharedGraphicsContext3D::create):
+        (WebCore::SharedGraphicsContext3D::SharedGraphicsContext3D):
+        * platform/graphics/gpu/SharedGraphicsContext3D.h:
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        (WebCore::GraphicsContext::setPlatformShadow):
+        * platform/graphics/skia/PlatformContextSkia.cpp:
+        (WebCore::PlatformContextSkia::canAccelerate):
+
+2011-03-17  Mikhail Naganov  <mnaganov@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: Clean up Inspector strings.
+        https://bugs.webkit.org/show_bug.cgi?id=56557
+
+        * English.lproj/localizedStrings.js:
+
+2011-03-14  Pavel Podivilov  <podivilov@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: refactor event listener breakpoints.
+        https://bugs.webkit.org/show_bug.cgi?id=56305
+
+        - restore event listener breakpoints one by one instead of using setAllBrowserBreakpoints
+        - store event listener breakpoints in a separate separate setting
+        - move presentation-related code from BreakpointManager to EventListenerBreakpointsSidebarPane
+
+        Test: inspector/debugger/event-listener-breakpoints.html
+
+        * inspector/Inspector.idl:
+        * inspector/InspectorAgent.cpp:
+        (WebCore::InspectorAgent::setFrontend):
+        * inspector/InspectorBrowserDebuggerAgent.cpp:
+        (WebCore::InspectorBrowserDebuggerAgent::setEventListenerBreakpoint):
+        (WebCore::InspectorBrowserDebuggerAgent::removeEventListenerBreakpoint):
+        (WebCore::InspectorBrowserDebuggerAgent::pauseOnNativeEventIfNeeded):
+        (WebCore::InspectorBrowserDebuggerAgent::clear):
+        * inspector/InspectorBrowserDebuggerAgent.h:
+        * inspector/InspectorInstrumentation.cpp:
+        (WebCore::InspectorInstrumentation::didCommitLoadImpl):
+        * inspector/front-end/BreakpointManager.js:
+        (WebInspector.BreakpointManager.prototype.setEventListenerBreakpoint):
+        (WebInspector.BreakpointManager.prototype.removeEventListenerBreakpoint):
+        (WebInspector.BreakpointManager.prototype.breakpointViewForEventData):
+        (WebInspector.BreakpointManager.prototype._projectChanged):
+        (WebInspector.BreakpointManager.prototype._saveBreakpoints):
+        (WebInspector.BreakpointManager.prototype._validateBreakpoints):
+        (WebInspector.BreakpointManager.prototype._createDOMBreakpointId):
+        * inspector/front-end/BreakpointsSidebarPane.js:
+        (WebInspector.EventListenerBreakpointsSidebarPane):
+        (WebInspector.EventListenerBreakpointsSidebarPane.eventNameForUI):
+        (WebInspector.EventListenerBreakpointsSidebarPane.prototype._createCategory):
+        (WebInspector.EventListenerBreakpointsSidebarPane.prototype._categoryCheckboxClicked):
+        (WebInspector.EventListenerBreakpointsSidebarPane.prototype._breakpointCheckboxClicked):
+        (WebInspector.EventListenerBreakpointsSidebarPane.prototype._setBreakpoint):
+        (WebInspector.EventListenerBreakpointsSidebarPane.prototype._removeBreakpoint):
+        (WebInspector.EventListenerBreakpointsSidebarPane.prototype._updateCategoryCheckbox):
+        (WebInspector.EventListenerBreakpointsSidebarPane.prototype.highlightBreakpoint):
+        (WebInspector.EventListenerBreakpointsSidebarPane.prototype.clearBreakpointHighlight):
+        (WebInspector.EventListenerBreakpointsSidebarPane.prototype._saveBreakpoints):
+        (WebInspector.EventListenerBreakpointsSidebarPane.prototype._restoreBreakpoints):
+        * inspector/front-end/CallStackSidebarPane.js:
+        (WebInspector.CallStackSidebarPane.prototype.update):
+        (WebInspector.CallStackSidebarPane.prototype.setStatus):
+        (WebInspector.CallStackSidebarPane.prototype._domBreakpointHit):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype._debuggerPaused):
+        (WebInspector.ScriptsPanel.prototype._clearInterface):
+        * inspector/front-end/Settings.js:
+        (WebInspector.Settings):
+
+2011-03-16  Stephen White  <senorblanco@chromium.org>
+
+        Reviewed by Kenneth Russell.
+
+        Implement GPU-accelerated shadows.
+        https://bugs.webkit.org/show_bug.cgi?id=56476
+
+        For hard shadows, we simply offset the CTM and draw in the shadow
+        color.  For soft shadows, we use a separable Gaussian convolution,
+        with a bilinear downsample and Mitchell-Netravali upsample in order to
+        preserve quality.
+
+        * WebCore.gypi:
+        Add BicubicShader and ConvolutionShader to the build.
+        * platform/graphics/chromium/GLES2Canvas.cpp:
+        (WebCore::GLES2Canvas::State::State):
+        Add shadow-related members to the GLES2Canvas::State
+        (WebCore::GLES2Canvas::State::shadowActive):
+        Add a helper function to know if shadows are active.
+        (WebCore::GLES2Canvas::clearRect):
+        (WebCore::GLES2Canvas::scissorClear):
+        Refactor the scissor clearing function out of clearRect().
+        (WebCore::GLES2Canvas::fillPath):
+        Add hook for shadow rendering in paths.  Bind framebuffer at this level.
+        (WebCore::GLES2Canvas::fillRect):
+        Add hook for shadow rendering in rects.  Bind framebuffer at this level.
+        (WebCore::GLES2Canvas::fillRectInternal):
+        Rename fillRect() -> fillRectInternal(), which does bind its vertex 
+        buffer, but does not bind the framebuffer.
+        (WebCore::GLES2Canvas::setShadowColor):
+        (WebCore::GLES2Canvas::setShadowOffset):
+        (WebCore::GLES2Canvas::setShadowBlur):
+        (WebCore::GLES2Canvas::setShadowsIgnoreTransforms):
+        Implement graphicsContext-style setters for shadow parameters.
+        (WebCore::GLES2Canvas::clipPath):
+        Call fillPathInternal(), not fillPath().
+        (WebCore::GLES2Canvas::restore):
+        (WebCore::GLES2Canvas::drawTexturedRect):
+        Bind the framebuffer at this level.  Do not bind vertices here (will
+        be done in drawTexturedQuad).
+        (WebCore::GLES2Canvas::drawTexturedRectTile):
+        drawQuad() -> drawTexturedQuad().
+        (WebCore::GLES2Canvas::convolveRect):
+        Implement one pass of a convolution filter (X or Y).
+        (WebCore::gauss):
+        (WebCore::buildKernel):
+        Some helper functions to build a Gaussian convolution kernel.
+        (WebCore::GLES2Canvas::drawTexturedQuad):
+        Rename drawQuad() -> drawTexturedQuad(), to be more clear.  Do not
+        bind the framebuffer at this level (it will be done higher).
+        (WebCore::GLES2Canvas::drawTexturedQuadMitchell):
+        Implement Mitchell-Netravali bicubic sampling, using BicubicShader.
+        (WebCore::GLES2Canvas::fillPathInternal):
+        Rename fillPath() -> fillPathInternal(), which does use quad vertices,
+        but does not bind the framebuffer or set the compositing mode.
+        (WebCore::GLES2Canvas::flipRect):
+        Implement a helper function to flip a rectangle in Y within the canvas.
+        (WebCore::GLES2Canvas::clearBorders):
+        Implement a helper function to clear an n-pixel border around a rect.
+        (WebCore::GLES2Canvas::beginShadowDraw):
+        Setup before drawing a primitive's shadow:  for hard shadows, just
+        offset the CTM by the shadow offset.  For soft shadows, bind to an
+        offscreen DrawingBuffer.
+        (WebCore::GLES2Canvas::endShadowDraw):
+        Tear-down after drawing a primitive's shadow:  for hard shadows, just
+        restore the CTM.  For soft shadows, downsample (if necessary), then
+        blur in X, blur in Y, upsample if necessary).
+        * platform/graphics/chromium/GLES2Canvas.h:
+        * platform/graphics/gpu/BicubicShader.cpp: Added.
+        (WebCore::BicubicShader::BicubicShader):
+        (WebCore::BicubicShader::create):
+        (WebCore::BicubicShader::use):
+        * platform/graphics/gpu/BicubicShader.h: Added.
+        Implement a bicubic image filtering shader.
+        * platform/graphics/gpu/ConvolutionShader.cpp: Added.
+        (WebCore::ConvolutionShader::ConvolutionShader):
+        (WebCore::ConvolutionShader::create):
+        (WebCore::ConvolutionShader::use):
+        * platform/graphics/gpu/ConvolutionShader.h: Added.
+        Implement a 1-dimensional convolution shader.  In order to minimize
+        texture samples, this shader is parameterized at compile time by the
+        width of the convolution kernel.
+        * platform/graphics/gpu/DrawingBuffer.h:
+        (WebCore::DrawingBuffer::colorBuffer):
+        Add an accessor to retrieve a DrawingBuffer's texture ID.
+        * platform/graphics/gpu/SharedGraphicsContext3D.cpp:
+        (WebCore::SharedGraphicsContext3D::create):
+        (WebCore::SharedGraphicsContext3D::SharedGraphicsContext3D):
+        (WebCore::SharedGraphicsContext3D::useBicubicProgram):
+        (WebCore::SharedGraphicsContext3D::useConvolutionProgram):
+        Create BicubicShader and cMaxKernelWidth ConvolutionShader's (one for
+        each possible kernel width).
+        (WebCore::SharedGraphicsContext3D::getOffscreenBuffer):
+        Implement a simple cache of offscreen DrawingBuffers, integer-indexed.
+        This is done to minimize the VRAM usage:  only 2 buffers are used for
+        all canvases.
+        * platform/graphics/gpu/SharedGraphicsContext3D.h:
+        Add bicubic and convolution shader members, and useXXX() functions.
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        (WebCore::GraphicsContext::setPlatformShadow):
+        Hook into GraphicsContextSkia's platform shadow setters to set
+        parameters on GLES2Canvas.
+        * platform/graphics/skia/PlatformContextSkia.cpp:
+        (WebCore::PlatformContextSkia::canAccelerate):
+        Remove shadows (loopers) from the list of things we can't accelerate.
+
+2011-03-17  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Andreas Kling.
+
+        Tiled backing store should only request repaint for updated areas
+        https://bugs.webkit.org/show_bug.cgi?id=56464
+
+        Reuse updateBackBuffer's dirty rectangle calculations to only
+        invalidate the necessary parts of the window.
+
+        * platform/graphics/Tile.h:
+        * platform/graphics/TiledBackingStore.cpp:
+        (WebCore::TiledBackingStore::updateTileBuffers):
+        * platform/graphics/qt/TileQt.cpp:
+        (WebCore::Tile::updateBackBuffer):
+
+2011-03-17  Mikhail Naganov  <mnaganov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: [Chromium] Reduce memory consumption by detailed heap snapshots indexes.
+        https://bugs.webkit.org/show_bug.cgi?id=56395
+
+        * inspector/front-end/DetailedHeapshotGridNodes.js:
+        (WebInspector.HeapSnapshotDiffNode.prototype._createNodesProvider.createProvider):
+        (WebInspector.HeapSnapshotDiffNode.prototype._createNodesProvider):
+        * inspector/front-end/HeapSnapshot.js:
+        (WebInspector.HeapSnapshotRetainerEdge): Added
+        (WebInspector.HeapSnapshotRetainerEdgeIterator): Added
+        (WebInspector.HeapSnapshotNode.prototype.get retainers):
+        (WebInspector.HeapSnapshot.prototype.dispose):
+        (WebInspector.HeapSnapshot.prototype.hasId):
+        (WebInspector.HeapSnapshot.prototype.retainers):
+        (WebInspector.HeapSnapshot.prototype._buildRetainers):
+        (WebInspector.HeapSnapshot.prototype._buildIdsList):
+        (WebInspector.HeapSnapshot.prototype._buildNodeIndex):
+        (WebInspector.HeapSnapshot.prototype._findNodePositionInIndex):
+        (WebInspector.HeapSnapshot.prototype._findNearestNodeIndex):
+        (WebInspector.HeapSnapshot.prototype._getRetainerIndex):
+        (WebInspector.HeapSnapshot.prototype._markInvisibleEdges):
+        (WebInspector.HeapSnapshot.prototype._numbersComparator):
+        (WebInspector.HeapSnapshotPathFinder.prototype.get _lastEdge):
+        (WebInspector.HeapSnapshotPathFinder.prototype._nextEdgeIter):
+        (WebInspector.HeapSnapshotPathFinder.prototype._buildNextPath):
+        (WebInspector.HeapSnapshotPathFinder.prototype._pathToString):
+
+2011-03-17  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r81243.
+        http://trac.webkit.org/changeset/81243
+        https://bugs.webkit.org/show_bug.cgi?id=56471
+
+        Breaks GTK 64-bit Debug tests (Requested by podivilov on
+        #webkit).
+
+        * inspector/Inspector.idl:
+        * inspector/InspectorAgent.cpp:
+        (WebCore::InspectorAgent::setFrontend):
+        * inspector/InspectorBrowserDebuggerAgent.cpp:
+        (WebCore::InspectorBrowserDebuggerAgent::setFrontend):
+        (WebCore::InspectorBrowserDebuggerAgent::setAllBrowserBreakpoints):
+        (WebCore::InspectorBrowserDebuggerAgent::inspectedURLChanged):
+        (WebCore::InspectorBrowserDebuggerAgent::restoreStickyBreakpoint):
+        (WebCore::InspectorBrowserDebuggerAgent::discardBindings):
+        (WebCore::InspectorBrowserDebuggerAgent::setEventListenerBreakpoint):
+        (WebCore::InspectorBrowserDebuggerAgent::removeEventListenerBreakpoint):
+        (WebCore::InspectorBrowserDebuggerAgent::pauseOnNativeEventIfNeeded):
+        (WebCore::InspectorBrowserDebuggerAgent::clear):
+        * inspector/InspectorBrowserDebuggerAgent.h:
+        * inspector/InspectorInstrumentation.cpp:
+        (WebCore::InspectorInstrumentation::didCommitLoadImpl):
+        * inspector/front-end/BreakpointManager.js:
+        (WebInspector.BreakpointManager.prototype.createEventListenerBreakpoint):
+        (WebInspector.BreakpointManager.prototype._createEventListenerBreakpoint):
+        (WebInspector.BreakpointManager.prototype.setXHRBreakpoint):
+        (WebInspector.BreakpointManager.prototype.removeXHRBreakpoint):
+        (WebInspector.BreakpointManager.prototype.breakpointViewForEventData):
+        (WebInspector.BreakpointManager.prototype._projectChanged):
+        (WebInspector.BreakpointManager.prototype._saveBreakpoints):
+        (WebInspector.BreakpointManager.prototype._validateBreakpoints):
+        (WebInspector.BreakpointManager.prototype._createDOMBreakpointId):
+        (WebInspector.BreakpointManager.prototype._createEventListenerBreakpointId):
+        (WebInspector.EventListenerBreakpoint):
+        (WebInspector.EventListenerBreakpoint.prototype._enable):
+        (WebInspector.EventListenerBreakpoint.prototype._disable):
+        (WebInspector.EventListenerBreakpoint.prototype._serializeToJSON):
+        (WebInspector.EventListenerBreakpointView):
+        (WebInspector.EventListenerBreakpointView.eventNameForUI):
+        (WebInspector.EventListenerBreakpointView.prototype.get eventName):
+        (WebInspector.EventListenerBreakpointView.prototype.compareTo):
+        (WebInspector.EventListenerBreakpointView.prototype.populateLabelElement):
+        (WebInspector.EventListenerBreakpointView.prototype.populateStatusMessageElement):
+        (WebInspector.EventListenerBreakpointView.prototype._uiEventName):
+        * inspector/front-end/BreakpointsSidebarPane.js:
+        (WebInspector.XHRBreakpointsSidebarPane.prototype._setBreakpoint):
+        (WebInspector.XHRBreakpointsSidebarPane.prototype._removeBreakpoint):
+        (WebInspector.EventListenerBreakpointsSidebarPane):
+        (WebInspector.EventListenerBreakpointsSidebarPane.prototype._createCategory):
+        (WebInspector.EventListenerBreakpointsSidebarPane.prototype._categoryCheckboxClicked):
+        (WebInspector.EventListenerBreakpointsSidebarPane.prototype._breakpointCheckboxClicked):
+        (WebInspector.EventListenerBreakpointsSidebarPane.prototype._breakpointAdded):
+        (WebInspector.EventListenerBreakpointsSidebarPane.prototype._breakpointHitStateChanged):
+        (WebInspector.EventListenerBreakpointsSidebarPane.prototype._breakpointRemoved):
+        (WebInspector.EventListenerBreakpointsSidebarPane.prototype._updateCategoryCheckbox):
+        (WebInspector.EventListenerBreakpointsSidebarPane.prototype._projectChanged):
+        * inspector/front-end/CallStackSidebarPane.js:
+        (WebInspector.CallStackSidebarPane.prototype.update):
+        (WebInspector.CallStackSidebarPane.prototype._scriptBreakpointHit):
+        (WebInspector.CallStackSidebarPane.prototype._xhrBreakpointHit):
+        (WebInspector.CallStackSidebarPane.prototype._nativeBreakpointHit):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype._debuggerPaused):
+        (WebInspector.ScriptsPanel.prototype._clearInterface):
+        * inspector/front-end/Settings.js:
+        (WebInspector.Settings):
+
+2011-03-17  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Add more ObjC++ files to the build
+        https://bugs.webkit.org/show_bug.cgi?id=56548
+
+        96 link errors.
+
+        * WebCore.gypi:
+        * gyp/WebCore.gyp:
+
+2011-03-17  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Add a few Objective-C++ files to the WebCore GYP build
+        https://bugs.webkit.org/show_bug.cgi?id=56547
+
+        464 link errors.
+
+        * gyp/WebCore.gyp:
+
+2011-03-17  Yuta Kitamura  <yutak@chromium.org>
+
+        Unreviewed build fix.
+
+        Non-ASCII characters in XMLTreeViewer.{cpp,h}
+        https://bugs.webkit.org/show_bug.cgi?id=56549
+
+        * xml/XMLTreeViewer.cpp: Replace non-ASCII characters with ASCII equivalents.
+        * xml/XMLTreeViewer.h: Ditto.
+
+2011-03-17  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Add plugins and bridge to the WebCore GYP build
+        https://bugs.webkit.org/show_bug.cgi?id=56546
+
+        506 link errors.
+
+        * gyp/WebCore.gyp:
+
+2011-03-16  Jeff Johnson  <github@lapcatsoftware.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Logic error in -[WebHTMLView close]
+        https://bugs.webkit.org/show_bug.cgi?id=56445
+
+        The function setDraggingImageURL() is no longer called and can be deleted.
+
+        No new tests. Deleting dead code.
+
+        * page/DragController.h:
+
+2011-03-16  Naoki Takano  <takano.naoki@gmail.com>
+
+        Reviewed by Ryosuke Niwa.
+
+        Textarea maxlength doesn't account for newlines
+        https://bugs.webkit.org/show_bug.cgi?id=54443
+
+        When a user presses a return key, TypingCommand::insertLineBreak() is called.
+        So before append a new line, check if we can add the new line.
+
+        * editing/TypingCommand.cpp:
+        (WebCore::canAppendNewLineFeed): Implement new helper function to check if we can add new line.
+        (WebCore::TypingCommand::insertLineBreak): Added check logic before adding the new line.
+        (WebCore::TypingCommand::insertParagraphSeparator): Added check logic before adding the new line.
+
+2011-03-16  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        WebCore GYP build should build more derived sources
+        https://bugs.webkit.org/show_bug.cgi?id=56529
+
+        This patch brings us down to 597 link errors.
+
+        * gyp/WebCore.gyp:
+
+2011-03-16  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        WebCore GYP should build (most) remaining source files
+        https://bugs.webkit.org/show_bug.cgi?id=56515
+
+        We're still not building all the files and we have 1305 link errors,
+        but this patch is progress.
+
+        * WebCore.gypi:
+        * gyp/WebCore.gyp:
+        * plugins/PluginStream.cpp:
+
+2011-03-16  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Update the default navigator.vendor value
+        https://bugs.webkit.org/show_bug.cgi?id=56449
+
+        * page/NavigatorBase.cpp: Updated the default value of
+        WEBCORE_NAVIGATOR_VENDOR.
+
+2011-03-16  John Bauman  <jbauman@chromium.org>
+
+        Reviewed by James Robinson.
+
+        texImage2D gets old contents of canvas
+        https://bugs.webkit.org/show_bug.cgi?id=56414
+
+        Always update the canvas contents in copiedImage, as there's no reason
+        to ask for an out-of-date image.
+
+        * html/HTMLCanvasElement.cpp:
+        (WebCore::HTMLCanvasElement::copiedImage):
+
+2011-03-16  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by James Robinson.
+
+        Remove USE(BUILTIN_UTF8_CODEC)
+        https://bugs.webkit.org/show_bug.cgi?id=56508
+
+        * platform/text/TextCodecICU.cpp:
+        (WebCore::TextCodecICU::registerEncodingNames):
+        * platform/text/TextEncodingRegistry.cpp:
+        (WebCore::buildBaseTextCodecMaps):
+
+2011-03-16  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Viewport no longer allows an auto value for "user-scalable"
+        https://bugs.webkit.org/show_bug.cgi?id=55416
+
+        This restores our behavior before r67376 the default "user-scalable"
+        behavior can be defined by a WebKit client if a value was not
+        explicitly provided in web content (via the viewport <meta> tag).
+        Here, all WebKit ports default to "yes" after computing
+        viewport arguments. However, in the future they may consider
+        changing the default user-scalable value based on the type
+        of the document being viewed, a user preference, or other reasons.
+
+        Covered by existing tests. Should be no changes.
+
+        * dom/ViewportArguments.cpp:
+        (WebCore::computeViewportAttributes): be explicit about 0.
+        (WebCore::findUserScalableValue): convert to return a float, the instance variable type.
+        * dom/ViewportArguments.h:
+        (WebCore::ViewportArguments::ViewportArguments): convert the boolean back to a float to
+        allow for 3 states. Explicit no, explicit yes, and ValueAuto to be defined by the
+        WebKit client.
+
+2011-03-16  David Levin  <levin@chromium.org>
+
+        Reviewed by Dmitry Titov.
+
+        REGRESSION(r81289): Fix valgrind error (and crashes) when running the chromium unit test "test_shell_test".
+
+        Conditional jump or move depends on uninitialised value(s)
+            WebCore::RenderLayerCompositor::RenderLayerCompositor(WebCore::RenderView*) (third_party/WebKit/Source/WebCore/rendering/RenderLayerCompositor.cpp:117)
+
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+
+2011-03-16  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=56493 Drag-scrolling overlay 
+        scrollbars thumb in overflow regions does not work
+        -and corresponding-
+        <rdar://problem/9112688> Drag-scrolling overlay scrollbars thumb in overflow 
+        regions does not work
+
+        Up until now, overlay scrollbars have always been treated in the Render Tree as if 
+        they have a thickness of 0 because they should not affect layout. However, it is 
+        important to consider their size when hit-testing because otherwise, we have this 
+        bug! This patch adds a boolean parameter to overflowClipRect(), 
+        RenderLayer::verticalScrollbarWidth(), and 
+        RenderLayer::horizontalScrollbarHeight(). This bool indicates whether to include 
+        the actual overlay scrollbar thickness. It defaults to false and is only sent is 
+        as true from RenderBloc::nodeAtPoint().
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::nodeAtPoint):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::overflowClipRect):
+        * rendering/RenderBox.h:
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::verticalScrollbarWidth):
+        (WebCore::RenderLayer::horizontalScrollbarHeight):
+        * rendering/RenderLayer.h:
+        * rendering/RenderTable.cpp:
+        (WebCore::RenderTable::overflowClipRect):
+        * rendering/RenderTable.h:
+
+2011-03-16  Keith Kyzivat  <keith.kyzivat@nokia.com>
+
+        Reviewed by Andreas Kling.
+
+        [Qt] Fix std::swap not found issue on mobile Qt devices.
+        https://bugs.webkit.org/show_bug.cgi?id=56463
+
+        Include <algorithm> in TextBreakIteratorQt.cpp so std::swap is found
+        on some Qt mobile devices.
+
+        No new tests: No tests needed - compilation verified manually.
+
+        * platform/text/qt/TextBreakIteratorQt.cpp:
+        (WebCore::acquireLineBreakIterator):
+
+2011-03-16  Jarkko Sakkinen  <jarkko.j.sakkinen@gmail.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] WebGL content not shown when accelerated compositing is enabled
+        https://bugs.webkit.org/show_bug.cgi?id=56339
+
+        Removed all previously implemented WebGL code from GraphicsLayerQt
+        because API has changed. GraphicsContext3D provides PlatformLayer
+        that is added as a child of GraphicsLayer and is therefore painted
+        through QGraphicsView pipeline.
+
+        * platform/graphics/GraphicsContext3D.h:
+        * platform/graphics/qt/GraphicsContext3DQt.cpp:
+        (WebCore::GraphicsContext3DInternal::GraphicsContext3DInternal):
+        (WebCore::GraphicsContext3DInternal::paint):
+        (WebCore::GraphicsContext3DInternal::boundingRect):
+        (WebCore::GraphicsContext3D::platformLayer):
+        (WebCore::GraphicsContext3D::paintRenderingResultsToCanvas):
+        (WebCore::GraphicsContext3D::reshape):
+        * platform/graphics/qt/GraphicsLayerQt.cpp:
+        (WebCore::GraphicsLayerQtImpl::GraphicsLayerQtImpl):
+        (WebCore::GraphicsLayerQtImpl::paint):
+        (WebCore::GraphicsLayerQtImpl::flushChanges):
+        (WebCore::GraphicsLayerQt::setContentsToCanvas):
+        * platform/graphics/qt/GraphicsLayerQt.h:
+
+2011-03-16  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Tony Chang.
+
+        Get rid of nearestMailBlockquote
+        https://bugs.webkit.org/show_bug.cgi?id=56439
+
+        Removed nearestMailBlockquote and replaced the calls to the function by calls
+        to enclosingNodeOfType and highestEnclosingNodeOfType.
+        
+        Also fixed a bug in BreakBlockquoteCommand and DeleteSelectionCommand not to
+        respect editing boundaries.  Added a test for the former command.
+
+        Test: editing/execCommand/break-non-editable-blockquote.html
+
+        * editing/BreakBlockquoteCommand.cpp:
+        (WebCore::BreakBlockquoteCommand::doApply): No longer crosses editing boundary
+        when looking for a Mail blockquote.
+        * editing/DeleteSelectionCommand.cpp:
+        (WebCore::DeleteSelectionCommand::saveTypingStyleState): Ditto.
+        (WebCore::DeleteSelectionCommand::calculateTypingStyleAfterDelete):
+        * editing/ReplaceSelectionCommand.cpp:
+        (WebCore::hasMatchingQuoteLevel):
+        (WebCore::handleStyleSpansBeforeInsertion):
+        (WebCore::ReplaceSelectionCommand::handleStyleSpans):
+        (WebCore::ReplaceSelectionCommand::doApply):
+        * editing/htmlediting.cpp:
+        (WebCore::enclosingNodeOfType): Check rule upfront to improve the performance.
+        (WebCore::highestEnclosingNodeOfType): Ditto; also add the missing check.
+        * editing/htmlediting.h:
+        (WebCore::firstPositionInOrBeforeNode): Added a null pointer check.
+        (WebCore::lastPositionInOrAfterNode): Ditto.
+        * editing/markup.cpp:
+        (WebCore::highestAncestorToWrapMarkup):
+        (WebCore::createMarkup):
+
+2011-03-16  Jer Noble  <jer.noble@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        RenderFullScreen::createFullScreenStyle() leaks
+        https://bugs.webkit.org/show_bug.cgi?id=53384
+
+        Two problems: a) not calling release() on the style returned in setFullScreenRenderer
+        causes an unnecessary ref/deref, and b) the fullscreen renderer needs to be destroyed,
+        not just detached, when it is no longer needed.
+
+        * dom/Document.cpp:
+        (WebCore::Document::setFullScreenRenderer): Destroy the current renderer when a new one is set.
+        * rendering/RenderFullScreen.cpp:
+        (RenderFullScreen::createFullScreenStyle): release() the return value.
+
+2011-03-16  Mike Reed  <reed@google.com>
+
+        Reviewed by James Robinson.
+
+        Reestablish typeface/size/encoding when drawing stroked text
+        https://bugs.webkit.org/show_bug.cgi?id=56481
+
+        No new tests. LayoutTests/svg/css/composite-shadow-text.svg
+
+        * platform/graphics/skia/SkiaFontWin.cpp:
+        (WebCore::paintSkiaText):
+
+2011-03-16  Daniel Sievers  <sievers@google.com>
+
+        Reviewed by James Robinson.
+
+        Add setting to always force compositing mode
+        https://bugs.webkit.org/show_bug.cgi?id=56156
+
+        No new tests needed as this defaults to disabled (and is unfeasible
+        to be tested through property overriding at runtime).
+
+        * page/Settings.h:
+        (WebCore::Settings::setForceCompositingMode):
+        (WebCore::Settings::forceCompositingMode):
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::RenderLayerCompositor):
+        (WebCore::RenderLayerCompositor::computeCompositingRequirements):
+        * rendering/RenderLayerCompositor.h:
+
+2011-03-16  Vangelis Kokkevis  <vangelis@chromium.org>
+
+        Reviewed by Kenneth Russell.
+
+        [chromium] Fixing backface visibility for transformed layers.
+        https://bugs.webkit.org/show_bug.cgi?id=56237
+
+        Test: platform/chromium/compositing/backface-visibility-transformed.html
+
+        * platform/graphics/chromium/LayerRendererChromium.cpp:
+        (WebCore::LayerRendererChromium::drawLayer):
+
+2011-03-16  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        REGRESSION(r76147): Dragging slider thumb is impossible or results in drawing artifacts.
+        https://bugs.webkit.org/show_bug.cgi?id=56469
+
+        Technically, this is not a regression, but rather uncovering of an old
+        problem. When the RenderSlider::layout was written, the layout state was
+        pushed with a wrong offset. However, since the whole slider track was
+        always repainted, the problem didn't manifest itself until we actually
+        started being more precise in our repaints.
+
+        Test: fast/repaint/slider-thumb-float.html
+
+        * rendering/RenderSlider.cpp:
+        (WebCore::RenderSlider::layout): Changed to pass actual thumb offset
+        to the LayoutStateMaintainer, rather than thumb size.
+
+2011-03-16  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Eric Carlson.
+
+        Add play state callbacks to MediaControls, kill timeUpdate timer.
+        https://bugs.webkit.org/show_bug.cgi?id=56473
+
+        No change in behavior, covered by existing tests.
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::playbackProgressTimerFired): Added a call to
+            media controls.
+        (WebCore::HTMLMediaElement::updatePlayState): Ditto.
+        * html/shadow/MediaControls.cpp:
+        (WebCore::MediaControls::MediaControls): Removed initialization of the timer.
+        (WebCore::MediaControls::playbackProgressed): Added.
+        (WebCore::MediaControls::playbackStarted): Added, for now routing to just
+            call playbackProgressed.
+        (WebCore::MediaControls::playbackStopped): Ditto.
+        (WebCore::MediaControls::update): Removed the code to start/stop the
+            timer that's now gone.
+        * html/shadow/MediaControls.h: Removed timer decls.
+
+2011-03-16  Bill Budge  <bbudge@chromium.org>
+
+        Reviewed by David Levin.
+
+        DocumentThreadableLoaderClient needs a protected default Constructor
+        https://bugs.webkit.org/show_bug.cgi?id=56479
+
+        No new tests. Exposes no new functionality.
+
+        * loader/DocumentThreadableLoaderClient.h:
+        (WebCore::DocumentThreadableLoaderClient::DocumentThreadableLoaderClient):
+
+2011-03-16  David Levin  <levin@chromium.org>
+
+        Chromium Leopard build fix attempt #2.
+
+        Same error as before.
+        * bindings/v8/V8GCController.cpp:
+
+2011-03-16  David Levin  <levin@chromium.org>
+
+        Chromium Leopard build fix attempt.
+
+        The error was 'WebCore::GrouperVisitor' has a field 'WebCore::GrouperVisitor::m_grouper' whose type uses the anonymous namespace.
+
+        * bindings/v8/V8GCController.cpp:
+
+2011-03-16  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Dimitri Glazkov and Darin Adler.
+
+        Node::isContentEditable should always call parentNode() instead of parentOrHostNode()
+        https://bugs.webkit.org/show_bug.cgi?id=56472
+
+        Replaced the call to parentOrHostNode() in Node::isContentEditable by a call to parentNode().
+        Node::isContentEditable now calls parentNode() on all nodes.
+
+        No tests are added since this behavior change is not visible to scripts at the moment.
+
+        * dom/Node.cpp:
+        (WebCore::Node::isContentEditable):
+
+2011-03-16  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        WK2: Need to propagate enhanced accessibility flag from UI -> web process
+        https://bugs.webkit.org/show_bug.cgi?id=56379
+
+        Allow the enhanced accessibility flag to be toggleable. 
+
+        * accessibility/AXObjectCache.h:
+        (WebCore::AXObjectCache::setEnhancedUserInterfaceAccessibility):
+
+2011-03-16  Csaba Osztrogonác  <ossy@webkit.org>
+
+        [Qt] Buildfix after r81230.
+
+        * WebCore.pri: Missing include path added.
+
+2011-03-15  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Make Structure creation require a JSGlobalData
+        https://bugs.webkit.org/show_bug.cgi?id=56438
+
+        Mechanical change to make all structure creation use GlobalData
+
+        * bindings/js/JSAudioConstructor.cpp:
+        (WebCore::JSAudioConstructor::JSAudioConstructor):
+        * bindings/js/JSAudioConstructor.h:
+        (WebCore::JSAudioConstructor::createStructure):
+        * bindings/js/JSDOMBinding.h:
+        (WebCore::DOMObjectWithGlobalPointer::createStructure):
+        (WebCore::DOMConstructorObject::createStructure):
+        (WebCore::getDOMStructure):
+        * bindings/js/JSDOMGlobalObject.h:
+        (WebCore::JSDOMGlobalObject::createStructure):
+        * bindings/js/JSDOMWindowBase.h:
+        (WebCore::JSDOMWindowBase::createStructure):
+        * bindings/js/JSDOMWindowShell.cpp:
+        (WebCore::JSDOMWindowShell::JSDOMWindowShell):
+        (WebCore::JSDOMWindowShell::setWindow):
+        * bindings/js/JSDOMWindowShell.h:
+        (WebCore::JSDOMWindowShell::createStructure):
+        * bindings/js/JSImageConstructor.cpp:
+        (WebCore::JSImageConstructor::JSImageConstructor):
+        * bindings/js/JSImageConstructor.h:
+        (WebCore::JSImageConstructor::createStructure):
+        * bindings/js/JSImageDataCustom.cpp:
+        (WebCore::toJS):
+        * bindings/js/JSOptionConstructor.cpp:
+        (WebCore::JSOptionConstructor::JSOptionConstructor):
+        * bindings/js/JSOptionConstructor.h:
+        (WebCore::JSOptionConstructor::createStructure):
+        * bindings/js/JSWorkerContextBase.h:
+        (WebCore::JSWorkerContextBase::createStructure):
+        * bindings/js/WorkerScriptController.cpp:
+        (WebCore::WorkerScriptController::initScript):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * bridge/c/CRuntimeObject.h:
+        (JSC::Bindings::CRuntimeObject::createStructure):
+        * bridge/c/c_instance.cpp:
+        (JSC::Bindings::CRuntimeMethod::createStructure):
+        * bridge/jni/jsc/JavaInstanceJSC.cpp:
+        (JavaRuntimeMethod::createStructure):
+        * bridge/jni/jsc/JavaRuntimeObject.h:
+        (JSC::Bindings::JavaRuntimeObject::createStructure):
+        * bridge/objc/ObjCRuntimeObject.h:
+        (JSC::Bindings::ObjCRuntimeObject::createStructure):
+        * bridge/objc/objc_instance.mm:
+        (ObjCRuntimeMethod::createStructure):
+        * bridge/objc/objc_runtime.h:
+        (JSC::Bindings::ObjcFallbackObjectImp::createStructure):
+        * bridge/runtime_array.h:
+        (JSC::RuntimeArray::createStructure):
+        * bridge/runtime_method.h:
+        (JSC::RuntimeMethod::createStructure):
+        * bridge/runtime_object.h:
+        (JSC::Bindings::RuntimeObject::createStructure):
+
+2011-03-16  Pratik Solanki  <psolanki@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        REGRESSION: Crash in adjustMIMETypeIfNecessary since r81001
+        https://bugs.webkit.org/show_bug.cgi?id=56345
+
+        Add NULL check for Content-Type header field.
+
+        Test: http/tests/xmlhttprequest/xmlhttprequest-no-content-type.html
+
+        * platform/network/mac/WebCoreURLResponse.mm:
+        (WebCore::adjustMIMETypeIfNecessary):
+
+2011-03-15  Levi Weintraub  <leviw@chromium.org>
+
+        Reviewed by Ryosuke Niwa.
+
+        REGRESSION (r81165): Assert running editing/style/iframe-onload-crash.html with non-Mac editing behavior
+        https://bugs.webkit.org/show_bug.cgi?id=56407
+
+        Fixing the creation of incorrect ranges from TextIterator due to passing node/offset pairs that
+        weren't parent-anchored. Also changing canHaveChildrenForEditing to properly handle nodes that
+        have had children appended to them that editing wouldn't normally allow.
+
+        Tests: editing/style/iframe-onload-crash-mac.html
+               editing/style/iframe-onload-crash-unix.html
+               editing/style/iframe-onload-crash-win.html
+
+        * editing/TextIterator.cpp:
+        (WebCore::TextIterator::rangeFromLocationAndLength): Passing parent-anchored values to range.
+        * editing/htmlediting.cpp:
+        (WebCore::canHaveChildrenForEditing): Adding a condition that the nodes don't already have children
+        for hr and datagrid, as you can append any node to another using javascript.
+
+2011-03-16  Mikhail Naganov  <mnaganov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        [Chromium] Report object groups and single DOM-related objects
+        to the new heap profiler.
+        https://bugs.webkit.org/show_bug.cgi?id=53659
+
+        * Android.v8bindings.mk:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/RetainedDOMInfo.cpp: Added.
+        (WebCore::RetainedDOMInfo::RetainedDOMInfo):
+        * bindings/v8/RetainedDOMInfo.h: Added.
+        * bindings/v8/RetainedObjectInfo.h: Added.
+        * bindings/v8/ScriptProfiler.cpp:
+        (WebCore::retainedDOMInfo):
+        (WebCore::ScriptProfiler::initialize):
+        * bindings/v8/ScriptProfiler.h:
+        * bindings/v8/V8DOMWindowShell.cpp:
+        (WebCore::V8DOMWindowShell::initContextIfNeeded):
+        * bindings/v8/V8GCController.cpp:
+        (WebCore::GroupId::GrouperItem::GrouperItem):
+        (WebCore::GroupId::GrouperItem::groupId):
+        (WebCore::GroupId::GrouperItem::createRetainedObjectInfo):
+        (WebCore::calculateGroupId):
+        (WebCore::GrouperVisitor::visitDOMWrapper):
+        (WebCore::GrouperVisitor::applyGrouping):
+        * bindings/v8/WrapperTypeInfo.h:
+        * inspector/front-end/DetailedHeapshotGridNodes.js:
+        (WebInspector.HeapSnapshotConstructorNode):
+        (WebInspector.HeapSnapshotConstructorNode.prototype._createNodesProvider):
+        (WebInspector.HeapSnapshotDiffNode):
+        (WebInspector.HeapSnapshotDiffNode.prototype._createNodesProvider.createProvider):
+        (WebInspector.HeapSnapshotDiffNode.prototype._createNodesProvider):
+        * inspector/front-end/DetailedHeapshotView.js:
+        (WebInspector.HeapSnapshotRetainingPathsList.prototype.setDataSource):
+        (WebInspector.HeapSnapshotRetainingPathsList.prototype.refresh):
+        (WebInspector.HeapSnapshotRetainingPathsList.prototype.showNext.startSearching):
+        (WebInspector.HeapSnapshotRetainingPathsList.prototype.showNext):
+        (WebInspector.HeapSnapshotRetainingPathsList.prototype._setRootChildrenForFinder):
+        (WebInspector.DetailedHeapshotView.prototype._changeRetainingPathsRoot):
+        (WebInspector.DetailedHeapshotView.prototype.get isTracingToWindowObjects):
+        * inspector/front-end/HeapSnapshot.js:
+        (WebInspector.HeapSnapshotNode.prototype.get className):
+        (WebInspector.HeapSnapshot.prototype._buildAggregates):
+        (WebInspector.HeapSnapshotPathFinder.prototype.updateRoots):
+        (WebInspector.HeapSnapshotPathFinder.prototype._fillRootChildren):
+        * inspector/front-end/heapProfiler.css:
+        (.detailed-heapshot-view .retaining-paths-view .title > span):
+        (.detailed-heapshot-view .retaining-paths-to-windows):
+
+2011-03-16  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Adam Roben.
+
+        Add WebKit2 API to figure out if an input or textarea was edited
+        https://bugs.webkit.org/show_bug.cgi?id=56474
+
+        Add HTMLInputElement::lastChangeWasUserEdit and HTMLTextAreaElement::lastChangeWasUserEdit
+        and use them to implement -[DOMHTMLInputElement _isEdited] and -[DOMHTMLTextAreaElement _isEdited]
+        as well as API in WebKit2.
+
+        * WebCore.exp.in:
+        * bindings/objc/DOMHTML.mm:
+        (-[DOMHTMLInputElement _isEdited]):
+        (-[DOMHTMLTextAreaElement _isEdited]):
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::lastChangeWasUserEdit):
+        * html/HTMLInputElement.h:
+        * html/HTMLTextAreaElement.cpp:
+        (WebCore::HTMLTextAreaElement::lastChangeWasUserEdit):
+        * html/HTMLTextAreaElement.h:
+
+2011-03-15  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: ASSERTION FAILED: !HashTranslator::equal(KeyTraits::emptyValue(), key)
+        https://bugs.webkit.org/show_bug.cgi?id=56376
+
+        * inspector/InspectorBrowserDebuggerAgent.cpp:
+        (WebCore::InspectorBrowserDebuggerAgent::willRemoveDOMNode):
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.DOMAgent.prototype._setDocument):
+
+2011-03-16  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        text-combine text retains compressed font after adding characters to it
+        https://bugs.webkit.org/show_bug.cgi?id=56448
+
+        Test: fast/dynamic/text-combine.html
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty): Allow styles with text-combine to be shared, since
+        only the clones on the RenderCombineText will be mutated.
+        * rendering/RenderCombineText.cpp:
+        (WebCore::RenderCombineText::styleDidChange): Clone the style, to avoid mutating the parent’s
+        style.
+        (WebCore::RenderCombineText::combineText): Start off with the original font; restore it if
+        the text cannot be combined.
+        * rendering/RenderCombineText.h:
+        (WebCore::RenderCombineText::originalFont): Added. Returns the parent’s font.
+
+2011-03-14  Pavel Podivilov  <podivilov@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: refactor event listener breakpoints.
+        https://bugs.webkit.org/show_bug.cgi?id=56305
+
+        - restore event listener breakpoints one by one instead of using setAllBrowserBreakpoints
+        - store event listener breakpoints in a separate separate setting
+        - move presentation-related code from BreakpointManager to EventListenerBreakpointsSidebarPane
+
+        Test: inspector/debugger/event-listener-breakpoints.html
+
+        * inspector/Inspector.idl:
+        * inspector/InspectorAgent.cpp:
+        (WebCore::InspectorAgent::setFrontend):
+        * inspector/InspectorBrowserDebuggerAgent.cpp:
+        (WebCore::InspectorBrowserDebuggerAgent::setEventListenerBreakpoint):
+        (WebCore::InspectorBrowserDebuggerAgent::removeEventListenerBreakpoint):
+        (WebCore::InspectorBrowserDebuggerAgent::pauseOnNativeEventIfNeeded):
+        (WebCore::InspectorBrowserDebuggerAgent::clear):
+        * inspector/InspectorBrowserDebuggerAgent.h:
+        * inspector/InspectorInstrumentation.cpp:
+        (WebCore::InspectorInstrumentation::didCommitLoadImpl):
+        * inspector/front-end/BreakpointManager.js:
+        (WebInspector.BreakpointManager.prototype.setEventListenerBreakpoint):
+        (WebInspector.BreakpointManager.prototype.removeEventListenerBreakpoint):
+        (WebInspector.BreakpointManager.prototype.breakpointViewForEventData):
+        (WebInspector.BreakpointManager.prototype._projectChanged):
+        (WebInspector.BreakpointManager.prototype._saveBreakpoints):
+        (WebInspector.BreakpointManager.prototype._validateBreakpoints):
+        (WebInspector.BreakpointManager.prototype._createDOMBreakpointId):
+        * inspector/front-end/BreakpointsSidebarPane.js:
+        (WebInspector.EventListenerBreakpointsSidebarPane):
+        (WebInspector.EventListenerBreakpointsSidebarPane.eventNameForUI):
+        (WebInspector.EventListenerBreakpointsSidebarPane.prototype._createCategory):
+        (WebInspector.EventListenerBreakpointsSidebarPane.prototype._categoryCheckboxClicked):
+        (WebInspector.EventListenerBreakpointsSidebarPane.prototype._breakpointCheckboxClicked):
+        (WebInspector.EventListenerBreakpointsSidebarPane.prototype._setBreakpoint):
+        (WebInspector.EventListenerBreakpointsSidebarPane.prototype._removeBreakpoint):
+        (WebInspector.EventListenerBreakpointsSidebarPane.prototype._updateCategoryCheckbox):
+        (WebInspector.EventListenerBreakpointsSidebarPane.prototype.highlightBreakpoint):
+        (WebInspector.EventListenerBreakpointsSidebarPane.prototype.clearBreakpointHighlight):
+        (WebInspector.EventListenerBreakpointsSidebarPane.prototype._saveBreakpoints):
+        (WebInspector.EventListenerBreakpointsSidebarPane.prototype._restoreBreakpoints):
+        * inspector/front-end/CallStackSidebarPane.js:
+        (WebInspector.CallStackSidebarPane.prototype.update):
+        (WebInspector.CallStackSidebarPane.prototype.setStatus):
+        (WebInspector.CallStackSidebarPane.prototype._domBreakpointHit):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype._debuggerPaused):
+        (WebInspector.ScriptsPanel.prototype._clearInterface):
+        * inspector/front-end/Settings.js:
+        (WebInspector.Settings):
+
+2011-03-16  David Kilzer  <ddkilzer@apple.com>
+
+        Minor clean-up after r81156, r81172
+
+        Follow-up for:
+        <http://webkit.org/b/56381> Objective-C classes should be typedef-ed as structs (not void*) in C++
+
+        * platform/graphics/GraphicsLayer.h: Removed unused @class
+        WebLayer declaration.
+        * platform/graphics/ca/PlatformCAAnimation.h: Changed typedef
+        struct CAPropertyAnimation to class declaration.
+
+2011-03-16  Andrey Adaikin  <aandrey@google.com>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: Remove live-edit code
+        https://bugs.webkit.org/show_bug.cgi?id=56177
+
+        * inspector/front-end/Settings.js:
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame):
+        (WebInspector.SourceFrame.prototype._doubleClick):
+        * inspector/front-end/TextViewer.js:
+        (WebInspector.TextEditorMainPanel):
+        (WebInspector.TextEditorMainPanel.prototype.set readOnly):
+
+2011-03-16  Alexis Menard  <alexis.menard@openbossa.org>
+
+        Reviewed by Martin Robinson.
+
+        [GStreamer] There is no need to set the state of the pipeline to playing, HTMLMediaElement will do it.
+        https://bugs.webkit.org/show_bug.cgi?id=56403
+
+        In case of a seek on a live pipeline there is no need to call gst_element_set_state(m_playBin, GST_STATE_PLAYING);
+        As soon as HTMLMediaElement::updatePlayState() is called (like when the data comes in) the playback will be relaunched
+        i.e the pause() made when beginScrubbing is done is just internal.
+
+        No new tests: Verified manually.
+
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivateGStreamer::updateStates):
+
+2011-03-16  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        WebCore GYP build should build platform/
+        https://bugs.webkit.org/show_bug.cgi?id=56430
+
+        Adding platform/ to the GYP build required disabling
+        ALWAYS_SEARCH_USER_PATHS, which in turn required fixing some latent
+        style issues.  I suspect we'll end up excluding some of these files
+        from the build in the final analysis, but we might as well fix the
+        style errors while we're here.
+
+        * bindings/js/JSMainThreadExecState.h:
+        * bindings/js/ScheduledAction.h:
+        * css/CSSPrimitiveValueCache.cpp:
+        * gyp/WebCore.gyp:
+        * platform/KillRingNone.cpp:
+        (WebCore::KillRing::append):
+        (WebCore::KillRing::prepend):
+        * platform/graphics/ContextShadow.h:
+        * platform/graphics/gpu/LoopBlinnPathProcessor.cpp:
+        (WebCore::LoopBlinnPathProcessor::buildContours):
+        (WebCore::TessellationState::combineCallback):
+        * platform/graphics/gpu/PODRedBlackTree.h:
+        (WebCore::PODRedBlackTree::updateNode):
+        (WebCore::PODRedBlackTree::logIfVerbose):
+        * platform/graphics/opengl/TextureMapperGL.cpp:
+        * platform/graphics/opengl/TextureMapperGL.h:
+        * platform/graphics/texmap/TextureMapper.h:
+        (WebCore::BitmapTexture::save):
+        (WebCore::TextureMapper::paintToTarget):
+        * platform/graphics/texmap/TextureMapperNode.h:
+
+2011-03-15  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Eric Carlson.
+
+        [GStreamer] http/tests/media/video-play-stall-before-meta-data.html fails
+        https://bugs.webkit.org/show_bug.cgi?id=56370
+
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::mediaPlayerPrivateMessageCallback): Let the
+        mediaPlayerClient handle the stream error, in this case the
+        HTMLMediaElement will emit a stalled event.
+
+2011-03-10  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Martin Robinson.
+
+        [GStreamer] Frame accurate seeking isn't always accurate
+        https://bugs.webkit.org/show_bug.cgi?id=55217
+
+        Attempt to build the seek GstClockTime position by converting the
+        float time value to a GTimeVal value rounded at microsecond
+        precision. Additionally perform the seek with the ACCURATE seek
+        flag. These modifications at least fix this manual-test:
+        http://www.massive-interactive.nl/html5_video/smpte_test_universal.html
+
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivateGStreamer::currentTime):
+        (WebCore::MediaPlayerPrivateGStreamer::seek):
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h:
+
+2011-03-15  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: split InspectorAgent.populateScriptObjects into more granular agent-specific requests
+        https://bugs.webkit.org/show_bug.cgi?id=56389
+
+        Instead of sending one big request populateScriptObjects each agent requests
+        for initial data in its constructor.
+        
+        * inspector/Inspector.idl:
+        * inspector/InspectorAgent.cpp:
+        (WebCore::InspectorAgent::InspectorAgent):
+        (WebCore::InspectorAgent::restoreInspectorStateFromCookie):
+        (WebCore::InspectorAgent::setFrontend):
+        (WebCore::InspectorAgent::pushDataCollectedOffline):
+        (WebCore::InspectorAgent::getPreferredPanel):
+        * inspector/InspectorAgent.h:
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::InspectorDOMAgent):
+        (WebCore::InspectorDOMAgent::setFrontend):
+        (WebCore::InspectorDOMAgent::restore):
+        * inspector/InspectorDOMAgent.h:
+        (WebCore::InspectorDOMAgent::create):
+        * inspector/InspectorDebuggerAgent.cpp:
+        (WebCore::InspectorDebuggerAgent::setFrontend):
+        * inspector/InspectorDebuggerAgent.h:
+        * inspector/InspectorProfilerAgent.h:
+        (WebCore::InspectorProfilerAgent::isEnabled):
+        * inspector/front-end/ProfilesPanel.js:
+        (WebInspector.ProfilesPanel):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel):
+        * inspector/front-end/inspector.js:
+
+2011-03-15  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Devirtualize isContentEditable and isRichlyContentEditable
+        https://bugs.webkit.org/show_bug.cgi?id=56421
+
+        Rewrote Node::isContentEditable as a non-recursive non-virtual function.
+
+        * dom/Document.cpp: Removed isContentEditable and isContentRichlyEditable.
+        * dom/Document.h: Ditto.
+        * dom/Node.cpp:
+        (WebCore::Node::isContentEditable): Rewritten.
+        * dom/Node.h:
+        (WebCore::Node::isContentEditable): Calls isContentEditable(Editable).
+        (WebCore::Node::isContentRichlyEditable): Calls isContentEditable(RichlyEditable).
+        * html/HTMLElement.cpp: Removed isContentEditable and isContentRichlyEditable.
+        * html/HTMLElement.h: Ditto.
+
+2011-03-15  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        WebCore GYP build should build inspector/ loader/ mathml/ notifications/ and page/
+        https://bugs.webkit.org/show_bug.cgi?id=56412
+
+        Yay for smooth sailing.
+
+        * gyp/WebCore.gyp:
+
+2011-03-15  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Kent Tamura.
+
+        REGRESSION(r76147): A slider thumb that is styled cannot be programmatically moved
+        https://bugs.webkit.org/show_bug.cgi?id=56059
+
+        Test: fast/dom/HTMLInputElement/input-slider-update-styled.html
+
+        * html/RangeInputType.cpp:
+        (WebCore::RangeInputType::valueChanged): Changed to use setPositionFromValue.
+        * html/shadow/SliderThumbElement.cpp:
+        (WebCore::SliderThumbElement::setPositionFromValue): Added.
+        (WebCore::SliderThumbElement::dragFrom): Changed to use setPositionFromPoint.
+        (WebCore::SliderThumbElement::setPositionFromPoint): Ditto.
+        (WebCore::SliderThumbElement::defaultEventHandler): Ditto.
+        * html/shadow/SliderThumbElement.h: Added decls.
+
+2011-03-15  David Levin  <levin@chromium.org>
+
+        Attempted build fix following r81213. Same song second verse.
+
+        * platform/image-encoders/skia/PNGImageEncoder.cpp:
+        (WebCore::encodePixels):
+
+2011-03-15  David Levin  <levin@chromium.org>
+
+        Attempted build fix for Chromium OSX release build following r81213.
+
+        * platform/image-encoders/skia/JPEGImageEncoder.cpp:
+        (WebCore::encodePixels): Change scoping of |pixels| to be after setjmp call.
+
+2011-03-15  John Bauman  <jbauman@chromium.org>
+
+        Reviewed by Kenneth Russell.
+
+        Non-premultiplied-alpha canvas attribute is ignore for toDataURL, drawImage, texImage2D
+        https://bugs.webkit.org/show_bug.cgi?id=56238
+
+       Attempt to get an ImageData (non-premultiplied) from a WebGL canvas
+       instead of getting an ImageBuffer, so there's a chance the data can be
+       passed straight through to the consumer with no premultiplication
+       necessary. Fixes Chromium and Safari.
+
+        Test: fast/canvas/webgl/premultiplyalpha-test.html
+
+        * html/HTMLCanvasElement.cpp:
+        (WebCore::HTMLCanvasElement::toDataURL):
+        (WebCore::HTMLCanvasElement::getImageData):
+        * html/HTMLCanvasElement.h:
+        * html/canvas/WebGLRenderingContext.cpp:
+        (WebCore::WebGLRenderingContext::paintRenderingResultsToImageData):
+        (WebCore::WebGLRenderingContext::texImage2D):
+        (WebCore::WebGLRenderingContext::texSubImage2D):
+        * html/canvas/WebGLRenderingContext.h:
+        * platform/graphics/GraphicsContext3D.h:
+        * platform/graphics/ImageBuffer.h:
+        * platform/graphics/cg/ImageBufferCG.cpp:
+        (WebCore::CGImageToDataURL):
+        (WebCore::ImageBuffer::toDataURL):
+        (WebCore::ImageDataToDataURL):
+        * platform/graphics/opengl/GraphicsContext3DOpenGL.cpp:
+        (WebCore::GraphicsContext3D::validateAttributes):
+        (WebCore::GraphicsContext3D::readRenderingResults):
+        (WebCore::GraphicsContext3D::paintRenderingResultsToCanvas):
+        (WebCore::GraphicsContext3D::paintRenderingResultsToImageData):
+        * platform/graphics/qt/GraphicsContext3DQt.cpp:
+        (WebCore::GraphicsContext3D::paintRenderingResultsToImageData):
+        * platform/graphics/skia/ImageBufferSkia.cpp:
+        (WebCore::ImageToDataURL):
+        (WebCore::ImageBuffer::toDataURL):
+        (WebCore::ImageDataToDataURL):
+        * platform/image-encoders/skia/JPEGImageEncoder.cpp:
+        (WebCore::preMultipliedBGRAtoRGB):
+        (WebCore::RGBAtoRGB):
+        (WebCore::encodePixels):
+        (WebCore::JPEGImageEncoder::encode):
+        * platform/image-encoders/skia/JPEGImageEncoder.h:
+        * platform/image-encoders/skia/PNGImageEncoder.cpp:
+        (WebCore::preMultipliedBGRAtoRGBA):
+        (WebCore::encodePixels):
+        (WebCore::PNGImageEncoder::encode):
+        * platform/image-encoders/skia/PNGImageEncoder.h:
+
+2011-03-15  Kevin Ollivier  <kevino@theolliviers.com>
+
+        [wx] Build fix, only compile the methods when the INDEXED_DATABASE feature is enabled.
+        
+        * storage/IDBDatabaseCallbacksImpl.cpp:
+
+2011-03-15  Brady Eidson  <beidson@apple.com>
+
+        Build fix after r81208 for https://bugs.webkit.org/show_bug.cgi?id=56425
+
+        * loader/icon/IconDatabaseBase.h: #include instead of forward declare.
+
+2011-03-15  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fix for <rdar://problem/8944558> Overlay scrollers in overflow areas need to 
+        send notifications appropriate times (showing up, resizing)
+        -and corresponding-
+        https://bugs.webkit.org/show_bug.cgi?id=56067
+
+        The general strategy here is to add a HashSet of ScrollableAreas to the page that 
+        can be accessed when necessary to send notifications to all ScrollableAreas. In 
+        turn, all of the ScrollableArea classes that add themselves to the HashSet must 
+        keep a weak pointer to Page so that they can remove themselves without relying on 
+        Frames or Renderers to still have references.
+
+        Find layers for relevant node and if the layers are in the Page's ScrollableArea 
+        set, then send the relevant notification.
+        * page/EventHandler.cpp:
+        (WebCore::layerForNode):
+        (WebCore::EventHandler::mouseMoved):
+        (WebCore::EventHandler::updateMouseEventTargetNode):
+
+        When the page is set active or not active, iterate through the Page's 
+        ScrollableAreas to send hide/show notifications. 
+        * page/FocusController.cpp:
+        (WebCore::FocusController::setActive):
+
+        When a FrameView is created, add it to the ScrollableArea set. When it's 
+        destroyed, remove it.
+        * page/FrameView.cpp:
+        (WebCore::FrameView::FrameView):
+        (WebCore::FrameView::~FrameView):
+
+        Iterate through the Page's ScrollableAreas to send the paint notification.
+        (WebCore::FrameView::notifyPageThatContentAreaWillPaint):
+        * page/FrameView.h:
+        (WebCore::FrameView::disconnectFromPage):
+
+        Add the new ScrollableArea set.
+        * page/Page.cpp:
+        (WebCore::Page::~Page):
+        (WebCore::Page::addScrollableArea):
+(WebCore::Page::removeScrollableArea):
+        (WebCore::Page::containsScrollableArea):
+        * page/Page.h:
+        (WebCore::Page::scrollableAreaSet):
+
+        notifyPageThatContentAreaWillPaint() is a dummy function implemented in FrameView.
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::notifyPageThatContentAreaWillPaint):
+        
+        Call notifyPageThatContentAreaWillPaint() instead of calling 
+        contentAreaWillPaint() just for the ScrollView.
+        (WebCore::ScrollView::paint):
+        * platform/ScrollView.h:
+
+        Add/remove ScrollableAreas to the set. Add new disconnectFromPage().
+        * platform/ScrollableArea.h:
+        (WebCore::ScrollableArea::disconnectFromPage):
+        * rendering/RenderDataGrid.cpp:
+        (WebCore::RenderDataGrid::RenderDataGrid):
+        (WebCore::RenderDataGrid::~RenderDataGrid):
+        * rendering/RenderDataGrid.h:
+        (WebCore::RenderDataGrid::disconnectFromPage):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::RenderLayer):
+        (WebCore::RenderLayer::~RenderLayer):
+        * rendering/RenderLayer.h:
+        (WebCore::RenderLayer::disconnectFromPage):
+        * rendering/RenderListBox.cpp:
+        (WebCore::RenderListBox::RenderListBox):
+        (WebCore::RenderListBox::~RenderListBox):
+        * rendering/RenderListBox.h:
+        (WebCore::RenderListBox::disconnectFromPage):
+
+        Should have implemented this ScrollableArea-interface function a while ago.
+        (WebCore::RenderLayer::currentMousePosition):
+
+2011-03-15  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=56425
+        WebKit2 icon database.
+
+        * WebCore.exp.in:
+
+2011-03-15  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        WebCore GYP build should build editing, fileapi, history, and html
+        https://bugs.webkit.org/show_bug.cgi?id=56411
+
+        These all went smoothly.
+
+        * gyp/WebCore.gyp:
+
+2011-03-15  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        WebCore GYP build should build dom/
+        https://bugs.webkit.org/show_bug.cgi?id=56409
+
+        * gyp/WebCore.gyp:
+
+2011-03-15  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        WebCore GYP build should build css/
+        https://bugs.webkit.org/show_bug.cgi?id=56408
+
+        CSSParser.cpp #includes tokenizer.cpp, which we haven't included in the
+        build yet.  I've punted on that problem for now, but we'll come back to
+        it.
+
+        * gyp/WebCore.gyp:
+
+2011-03-15  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        WebCore GYP build should build bindings/
+        https://bugs.webkit.org/show_bug.cgi?id=56406
+
+        I wanted to include bindings/objc in this patch, but they were somewhat
+        complicated.  It looks like they include headers from the output
+        directory (via PrivateHeaders), but we haven't wired up the
+        PrivateHeaders yet.
+
+        * gyp/WebCore.gyp:
+
+2011-03-15  James Simonsen  <simonjam@chromium.org>
+
+        Reviewed by Tony Gentilcore.
+
+        Need different behavior for ensuring execution order of dynamically loaded scripts
+        https://bugs.webkit.org/show_bug.cgi?id=50115
+
+        Dynamically added scripts with async=false will load in parallel, but execute in order.
+        See: http://www.whatwg.org/specs/web-apps/current-work/multipage/scripting-1.html#force-async
+
+        Tests: fast/dom/HTMLScriptElement/script-async-attr.html
+               http/tests/misc/script-async-load-execute-in-order.html
+
+        * Android.mk: Rename AsyncScriptRunner -> ScriptRunner.
+        * CMakeLists.txt: Ditto.
+        * GNUmakefile.am: Ditto.
+        * WebCore.gypi: Ditto.
+        * WebCore.pro: Ditto.
+        * WebCore.vcproj/WebCore.vcproj: Ditto.
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
+        * dom/DOMAllInOne.cpp: Ditto.
+        * dom/Document.cpp:
+        (WebCore::Document::Document): Ditto.
+        (WebCore::Document::~Document): Ditto.
+        * dom/Document.h:
+        (WebCore::Document::scriptRunner): Ditto.
+        * dom/ScriptElement.cpp:
+        (WebCore::ScriptElement::ScriptElement): Added forceAsync and willExecuteInOrder.
+        (WebCore::ScriptElement::handleAsyncAttribute): Called by HTMLScriptElement when async attribute changes.
+        (WebCore::ScriptElement::prepareScript): Added support for forceAsync.
+        (WebCore::ScriptElement::notifyFinished): Tell ScriptRunner to execute in order if needed.
+        * dom/ScriptElement.h:
+        (WebCore::ScriptElement::forceAsync): Added.
+        * dom/ScriptRunner.cpp: Renamed from Source/WebCore/dom/AsyncScriptRunner.cpp.
+        (WebCore::ScriptRunner::ScriptRunner): Added in-order script queue.
+        (WebCore::ScriptRunner::~ScriptRunner): Ditto.
+        (WebCore::ScriptRunner::executeScriptSoon):
+        (WebCore::ScriptRunner::queueScriptForInOrderExecution): Added.
+        (WebCore::ScriptRunner::suspend):
+        (WebCore::ScriptRunner::resume):
+        (WebCore::ScriptRunner::timerFired): Execute in-order scripts if ready.
+        * dom/ScriptRunner.h: Renamed from Source/WebCore/dom/AsyncScriptRunner.h.
+        (WebCore::ScriptRunner::create):
+        (WebCore::ScriptRunner::hasPendingScripts): Check for in-order scripts too.
+        * html/HTMLScriptElement.cpp:
+        (WebCore::HTMLScriptElement::attributeChanged): Notify ScriptElement when async changes.
+        (WebCore::HTMLScriptElement::setAsync): Ditto.
+        (WebCore::HTMLScriptElement::async): Include forceAsync in calculation.
+        * html/HTMLScriptElement.h:
+        * html/HTMLScriptElement.idl: Removed Reflect from async for custom behavior.
+        * page/PageGroupLoadDeferrer.cpp:
+        (WebCore::PageGroupLoadDeferrer::PageGroupLoadDeferrer): Rename AsyncScriptRunner -> ScriptRunner.
+        (WebCore::PageGroupLoadDeferrer::~PageGroupLoadDeferrer): Ditto.
+
+2011-03-15  Tony Chang  <tony@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        pngcrush images used by inspector
+        https://bugs.webkit.org/show_bug.cgi?id=56426
+
+        This saves 120k in WebCore and 8k in WebKit/chromium.  I ran
+        pngcrush -brute, so none of the meta data (ancillary chunks)
+        are modified.
+
+        No new tests, just compressing png files.
+
+        * inspector/front-end/Images/applicationCache.png:
+        * inspector/front-end/Images/auditsIcon.png:
+        * inspector/front-end/Images/back.png:
+        * inspector/front-end/Images/breakpointBorder.png:
+        * inspector/front-end/Images/breakpointConditionalBorder.png:
+        * inspector/front-end/Images/breakpointConditionalCounterBorder.png:
+        * inspector/front-end/Images/breakpointCounterBorder.png:
+        * inspector/front-end/Images/breakpointsActivateButtonGlyph.png:
+        * inspector/front-end/Images/breakpointsDeactivateButtonGlyph.png:
+        * inspector/front-end/Images/checker.png:
+        * inspector/front-end/Images/clearConsoleButtonGlyph.png:
+        * inspector/front-end/Images/closeButtons.png:
+        * inspector/front-end/Images/consoleButtonGlyph.png:
+        * inspector/front-end/Images/consoleIcon.png:
+        * inspector/front-end/Images/cookie.png:
+        * inspector/front-end/Images/database.png:
+        * inspector/front-end/Images/databaseTable.png:
+        * inspector/front-end/Images/debuggerContinue.png:
+        * inspector/front-end/Images/debuggerPause.png:
+        * inspector/front-end/Images/debuggerStepInto.png:
+        * inspector/front-end/Images/debuggerStepOut.png:
+        * inspector/front-end/Images/debuggerStepOver.png:
+        * inspector/front-end/Images/disclosureTriangleSmallDown.png:
+        * inspector/front-end/Images/disclosureTriangleSmallDownBlack.png:
+        * inspector/front-end/Images/disclosureTriangleSmallDownWhite.png:
+        * inspector/front-end/Images/disclosureTriangleSmallRight.png:
+        * inspector/front-end/Images/disclosureTriangleSmallRightBlack.png:
+        * inspector/front-end/Images/disclosureTriangleSmallRightDown.png:
+        * inspector/front-end/Images/disclosureTriangleSmallRightDownBlack.png:
+        * inspector/front-end/Images/disclosureTriangleSmallRightDownWhite.png:
+        * inspector/front-end/Images/disclosureTriangleSmallRightWhite.png:
+        * inspector/front-end/Images/dockButtonGlyph.png:
+        * inspector/front-end/Images/elementsIcon.png:
+        * inspector/front-end/Images/enableOutlineButtonGlyph.png:
+        * inspector/front-end/Images/enableSolidButtonGlyph.png:
+        * inspector/front-end/Images/errorIcon.png:
+        * inspector/front-end/Images/errorMediumIcon.png:
+        * inspector/front-end/Images/errorRedDot.png:
+        * inspector/front-end/Images/excludeButtonGlyph.png:
+        * inspector/front-end/Images/focusButtonGlyph.png:
+        * inspector/front-end/Images/forward.png:
+        * inspector/front-end/Images/frame.png:
+        * inspector/front-end/Images/garbageCollectButtonGlyph.png:
+        * inspector/front-end/Images/gearButtonGlyph.png:
+        * inspector/front-end/Images/glossyHeader.png:
+        * inspector/front-end/Images/glossyHeaderPressed.png:
+        * inspector/front-end/Images/glossyHeaderSelected.png:
+        * inspector/front-end/Images/glossyHeaderSelectedPressed.png:
+        * inspector/front-end/Images/goArrow.png:
+        * inspector/front-end/Images/graphLabelCalloutLeft.png:
+        * inspector/front-end/Images/graphLabelCalloutRight.png:
+        * inspector/front-end/Images/helpButtonGlyph.png:
+        * inspector/front-end/Images/largerResourcesButtonGlyph.png:
+        * inspector/front-end/Images/localStorage.png:
+        * inspector/front-end/Images/networkIcon.png:
+        * inspector/front-end/Images/nodeSearchButtonGlyph.png:
+        * inspector/front-end/Images/paneAddButtons.png:
+        * inspector/front-end/Images/paneBottomGrow.png:
+        * inspector/front-end/Images/paneBottomGrowActive.png:
+        * inspector/front-end/Images/paneGrowHandleLine.png:
+        * inspector/front-end/Images/paneSettingsButtons.png:
+        * inspector/front-end/Images/pauseOnExceptionButtonGlyph.png:
+        * inspector/front-end/Images/percentButtonGlyph.png:
+        * inspector/front-end/Images/popoverArrows.png:
+        * inspector/front-end/Images/popoverBackground.png:
+        * inspector/front-end/Images/profileGroupIcon.png:
+        * inspector/front-end/Images/profileIcon.png:
+        * inspector/front-end/Images/profileSmallIcon.png:
+        * inspector/front-end/Images/profilesIcon.png:
+        * inspector/front-end/Images/profilesSilhouette.png:
+        * inspector/front-end/Images/programCounterBorder.png:
+        * inspector/front-end/Images/radioDot.png:
+        * inspector/front-end/Images/recordButtonGlyph.png:
+        * inspector/front-end/Images/recordToggledButtonGlyph.png:
+        * inspector/front-end/Images/reloadButtonGlyph.png:
+        * inspector/front-end/Images/resourceCSSIcon.png:
+        * inspector/front-end/Images/resourceDocumentIcon.png:
+        * inspector/front-end/Images/resourceDocumentIconSmall.png:
+        * inspector/front-end/Images/resourceJSIcon.png:
+        * inspector/front-end/Images/resourcePlainIcon.png:
+        * inspector/front-end/Images/resourcePlainIconSmall.png:
+        * inspector/front-end/Images/resourcesIcon.png:
+        * inspector/front-end/Images/resourcesSizeGraphIcon.png:
+        * inspector/front-end/Images/resourcesTimeGraphIcon.png:
+        * inspector/front-end/Images/scriptsIcon.png:
+        * inspector/front-end/Images/scriptsSilhouette.png:
+        * inspector/front-end/Images/searchSmallBlue.png:
+        * inspector/front-end/Images/searchSmallBrightBlue.png:
+        * inspector/front-end/Images/searchSmallGray.png:
+        * inspector/front-end/Images/searchSmallWhite.png:
+        * inspector/front-end/Images/segment.png:
+        * inspector/front-end/Images/segmentEnd.png:
+        * inspector/front-end/Images/segmentHover.png:
+        * inspector/front-end/Images/segmentHoverEnd.png:
+        * inspector/front-end/Images/segmentSelected.png:
+        * inspector/front-end/Images/segmentSelectedEnd.png:
+        * inspector/front-end/Images/sessionStorage.png:
+        * inspector/front-end/Images/splitviewDimple.png:
+        * inspector/front-end/Images/splitviewDividerBackground.png:
+        * inspector/front-end/Images/statusbarButtons.png:
+        * inspector/front-end/Images/statusbarMenuButton.png:
+        * inspector/front-end/Images/statusbarMenuButtonSelected.png:
+        * inspector/front-end/Images/statusbarResizerHorizontal.png:
+        * inspector/front-end/Images/statusbarResizerVertical.png:
+        * inspector/front-end/Images/successGreenDot.png:
+        * inspector/front-end/Images/thumbActiveHoriz.png:
+        * inspector/front-end/Images/thumbActiveVert.png:
+        * inspector/front-end/Images/thumbHoriz.png:
+        * inspector/front-end/Images/thumbHoverHoriz.png:
+        * inspector/front-end/Images/thumbHoverVert.png:
+        * inspector/front-end/Images/thumbVert.png:
+        * inspector/front-end/Images/timelineBarBlue.png:
+        * inspector/front-end/Images/timelineBarGray.png:
+        * inspector/front-end/Images/timelineBarGreen.png:
+        * inspector/front-end/Images/timelineBarOrange.png:
+        * inspector/front-end/Images/timelineBarPurple.png:
+        * inspector/front-end/Images/timelineBarRed.png:
+        * inspector/front-end/Images/timelineBarYellow.png:
+        * inspector/front-end/Images/timelineCheckmarks.png:
+        * inspector/front-end/Images/timelineDots.png:
+        * inspector/front-end/Images/timelineHollowPillBlue.png:
+        * inspector/front-end/Images/timelineHollowPillGray.png:
+        * inspector/front-end/Images/timelineHollowPillGreen.png:
+        * inspector/front-end/Images/timelineHollowPillOrange.png:
+        * inspector/front-end/Images/timelineHollowPillPurple.png:
+        * inspector/front-end/Images/timelineHollowPillRed.png:
+        * inspector/front-end/Images/timelineHollowPillYellow.png:
+        * inspector/front-end/Images/timelineIcon.png:
+        * inspector/front-end/Images/timelinePillBlue.png:
+        * inspector/front-end/Images/timelinePillGray.png:
+        * inspector/front-end/Images/timelinePillGreen.png:
+        * inspector/front-end/Images/timelinePillOrange.png:
+        * inspector/front-end/Images/timelinePillPurple.png:
+        * inspector/front-end/Images/timelinePillRed.png:
+        * inspector/front-end/Images/timelinePillYellow.png:
+        * inspector/front-end/Images/toolbarItemSelected.png:
+        * inspector/front-end/Images/trackHoriz.png:
+        * inspector/front-end/Images/trackVert.png:
+        * inspector/front-end/Images/treeDownTriangleBlack.png:
+        * inspector/front-end/Images/treeDownTriangleWhite.png:
+        * inspector/front-end/Images/treeRightTriangleBlack.png:
+        * inspector/front-end/Images/treeRightTriangleWhite.png:
+        * inspector/front-end/Images/treeUpTriangleBlack.png:
+        * inspector/front-end/Images/treeUpTriangleWhite.png:
+        * inspector/front-end/Images/undockButtonGlyph.png:
+        * inspector/front-end/Images/userInputIcon.png:
+        * inspector/front-end/Images/userInputPreviousIcon.png:
+        * inspector/front-end/Images/userInputResultIcon.png:
+        * inspector/front-end/Images/warningIcon.png:
+        * inspector/front-end/Images/warningMediumIcon.png:
+        * inspector/front-end/Images/warningOrangeDot.png:
+        * inspector/front-end/Images/warningsErrors.png:
+
+2011-03-15  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Tony Chang.
+
+        Crash in ReplaceSelectionCommand::doApply when inserting a node under a document node
+        https://bugs.webkit.org/show_bug.cgi?id=56372
+
+        The bug was caused by insertNodeAfter's calling parentElement on document's child.
+        Fixed this by changing the node that AppendNodeCommand takes.
+
+        There was also a bug that document node always returned false for isContentEditable
+        and isContentRichlyEditable because they never overrode Node's default implementation.
+        Fixed this by overriding them in Document.
+
+        Test: editing/execCommand/append-node-under-document.html
+
+        * dom/Document.cpp:
+        (WebCore::Document::isContentEditable): Added.
+        (WebCore::Document::isContentRichlyEditable): Added.
+        * dom/Document.h:
+        * editing/AppendNodeCommand.cpp:
+        (WebCore::AppendNodeCommand::AppendNodeCommand): Takes ContainerNode instead of Element.
+        * editing/AppendNodeCommand.h:
+        (WebCore::AppendNodeCommand::create): Ditto.
+        * editing/CompositeEditCommand.cpp:
+        (WebCore::CompositeEditCommand::appendNode): Ditto.
+        (WebCore::CompositeEditCommand::insertNodeAfter): Calls parentNode instead of parentElement.
+        * editing/CompositeEditCommand.h:
+
+2011-03-15  David Grogan  <dgrogan@chromium.org>
+
+        Reviewed by Jeremy Orlow.
+
+        Fix crash caused by Invalid call to destroyActiveDOMObject during stopActiveDOMObjects
+        https://bugs.webkit.org/show_bug.cgi?id=56350
+
+        When a frame is unloaded, ScriptExecutionContext::stopActiveDOMObjects
+        calls stop() on each ActiveDOMObject.
+
+        Calling IDBDatabase::stop() can cause IDBDatabase to be destroyed:
+        * IDBDatabase::stop() causes the chrome message dispatcher to remove
+        its reference to IDBDatabase, which it has as type
+        IDBDatabaseCallbacks.
+        * If that reference is the last one, the IDBDatabase is destroyed.
+        * Destroying an ActiveDOMObject while they are being iterated over causes
+        a defensive crash.
+        
+        This change creates a separate IDBDatabaseCallbacks object that is not
+        an ActiveDOMObject, so it can be destroyed by
+        ScriptExecutionContext::stopActiveDOMObjects.
+        
+        Because the chrome message dispatcher is only used in multi-process
+        chromium, that's the only platform affected.  Chromium browser tests
+        forthcoming.
+
+        * WebCore.gypi:
+        * storage/IDBDatabase.cpp:
+        (WebCore::IDBDatabase::IDBDatabase):
+        (WebCore::IDBDatabase::~IDBDatabase):
+        (WebCore::IDBDatabase::setVersion):
+        (WebCore::IDBDatabase::close):
+        (WebCore::IDBDatabase::open):
+        * storage/IDBDatabase.h:
+        * storage/IDBDatabaseCallbacks.h:
+        (WebCore::IDBDatabaseCallbacks::unRegisterDatabase):
+        * storage/IDBDatabaseCallbacksImpl.cpp: Copied from Source/WebCore/storage/IDBDatabaseCallbacks.h.
+        (WebCore::IDBDatabaseCallbacksImpl::create):
+        (WebCore::IDBDatabaseCallbacksImpl::IDBDatabaseCallbacksImpl):
+        (WebCore::IDBDatabaseCallbacksImpl::onVersionChange):
+        (WebCore::IDBDatabaseCallbacksImpl::unRegisterDatabase):
+        * storage/IDBDatabaseCallbacksImpl.h: Copied from Source/WebCore/storage/IDBDatabaseCallbacks.h.
+        (WebCore::IDBDatabaseCallbacksImpl::~IDBDatabaseCallbacksImpl):
+
+2011-03-15  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        accessibility should build in WebCore GYP build
+        https://bugs.webkit.org/show_bug.cgi?id=56405
+
+        This patch changes our include/exclude strategy to more closely match
+        the strategy used by the Chromium GYP build system.  Ideally, we'd find
+        a way to share more of these patterns.  In the meantime, I'm going to
+        slowly increase the number of translation units in the project and
+        adjust the include/exclude filters appropriately.
+
+        * gyp/WebCore.gyp:
+
+2011-03-15  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        REGRESSION (WebKit2): keygen element doesn't work
+        https://bugs.webkit.org/show_bug.cgi?id=56402
+        <rdar://problem/9006545>
+
+        Covered by existing regresison tests.
+
+        * English.lproj/Localizable.strings:
+
+        * WebCore.exp.in: Removed WebCoreKeyGenerator, which no longer exists. Added
+        _wkSignedPublicKeyAndChallengeString, so that this WKSI function could be used in WebCore.
+
+        * platform/mac/SSLKeyGeneratorMac.mm: Removed.
+        * platform/mac/WebCoreKeyGenerator.h: Removed.
+        * platform/mac/WebCoreKeyGenerator.m: Removed.
+        * platform/mac/WebCoreSystemInterface.h:
+        * platform/mac/WebCoreSystemInterface.mm:
+        * WebCore.xcodeproj/project.pbxproj:
+        Renamed SSLKeyGeneratorMac.mm to .cpp, as it doesn't use any Objective C any more.
+        Removed WebCoreKeyGenerator, as we no longer need an interface to WebKit.
+
+        * platform/LocalizationStrategy.h:
+        * platform/LocalizedStrings.cpp:
+        (WebCore::keygenMenuItem512):
+        (WebCore::keygenMenuItem1024):
+        (WebCore::keygenMenuItem2048):
+        (WebCore::keygenKeychainItemName):
+        * platform/LocalizedStrings.h:
+        Added strings used by keygen element, now that the code using them is in WebCore.
+
+        * platform/mac/SSLKeyGeneratorMac.cpp: Copied from Source/WebCore/platform/mac/SSLKeyGeneratorMac.mm.
+        (WebCore::getSupportedKeySizes):
+        (WebCore::signedPublicKeyAndChallengeString):
+        Moved the code from WebKit. There is never any need to provide implementation at runtime,
+        like old code was doing.
+
+        * platform/win/SSLKeyGeneratorWin.cpp: (WebCore::WebCore::getSupportedKeySizes):
+        Added a FIXME about localization. Note that Safari for Windows doesn't support keygen.
+
+2011-03-15  Anders Carlsson  <andersca@apple.com>
+
+        Fix clang build.
+
+        * platform/graphics/GraphicsContext3D.h:
+        * platform/graphics/GraphicsLayer.h:
+
+2011-03-15  Simon Fraser  <simon.fraser@apple.com>
+
+        Fix Lion build after r81161.
+        
+        Pass the PlatformCALayer down into drawLayerContents()
+        so we can use its acceleratesDrawing() method.
+
+        * platform/graphics/mac/WebLayer.h:
+        * platform/graphics/mac/WebLayer.mm:
+        (drawLayerContents):
+        (-[WebLayer drawInContext:]):
+        * platform/graphics/mac/WebTiledLayer.mm:
+        (-[WebTiledLayer drawInContext:]):
+
+2011-03-15  Alok priyadarshi  <alokp@chromium.org>
+
+        Reviewed by James Robinson.
+
+        Valgrind error due to uninitialized PluginLayerChromium::m_textureId
+        https://bugs.webkit.org/show_bug.cgi?id=56390
+
+        * platform/graphics/chromium/PluginLayerChromium.cpp:
+        (WebCore::PluginLayerChromium::PluginLayerChromium):
+        * platform/graphics/chromium/PluginLayerChromium.h:
+        (WebCore::PluginLayerChromium::textureId):
+
+2011-03-14  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Dirk Schulze.
+
+        REGRESSION (r68976): Incorrect bidi rendering in SVG text
+        https://bugs.webkit.org/show_bug.cgi?id=53980
+
+        rework the test engine or SVG "text-intro" tests so we can turn them back on
+        https://bugs.webkit.org/show_bug.cgi?id=6524
+
+        svg/W3C-SVG-1.1/text-intro-0*.svg fail when MS Office fonts are present
+        https://bugs.webkit.org/show_bug.cgi?id=11662
+
+        svg/batik/text/textBiDi.svg failing
+        https://bugs.webkit.org/show_bug.cgi?id=17392
+
+        SVG bidi examples at w3C I18N WG tutorials are not rendered correctly.
+        https://bugs.webkit.org/show_bug.cgi?id=24374
+
+        Implement proper bidirectionality support for SVG text.
+
+        BiDi didn't work properly until now, because the x/y/dx/dy/rotate value lists are stored in logical order (aka. in
+        the order the characters appear in the markup), and when laying out bidi text, we associated the current character
+        in visual order with the current x/y/dx/dy/rotate value in logical order, messing up RTL text layout.
+        The BiDi algorithm itself, inherited by RenderBlockLineLayout, works just fine, the inline box tree is correct.
+
+        Long story:
+        Before the inline box tree is created, SVGTextLayoutAttributesBuilder builds a list of x/y/dx/dy/rotate/<text metrics>
+        for each RenderSVGInlineText* object, called SVGTextLayoutAttributes. This happens in logical order, as specified in
+        the markup. <text x="10 20" y="10">abcdef</text> creates a SVGTextLayoutAttributes object in the renderer associated with
+        "abcdef" that contains (10, 20) for x, (10) for y, the dx/dy/rotate lists are empty, and the SVGTextMetrics list holds 6
+        width/height values for each of the glyphs (and some other infromation, see SVGTextMetrics class).
+        The SVGTextLayoutAttributes object is _used by_ RenderBlockLineLayout when applying the BiDi algorithm as SVG demands
+        that BiDi reordering does not happen across text chunks (a text chunk is defined by an absolute position, eg. x="10").
+
+        To summarize: SVGTextLayoutAttributes are stored in all RenderSVGInlineText renderers, caching the metrics of all
+        characters, their position based on the DOM attributes x/y/dx/dy/rotate. Using that information it's possible to
+        determine whether a position starts a new text chunk, and that's used by RenderBlockLineLayout to create the 
+        inline box tree, in _visual order_, as it will appear on screen.
+
+        After the inline box tree is created, the SVGRootInlineBox traverses its children in visual order and feeds the
+        found text boxes to SVGTextLayoutEngine, which lays out the text on a line or a path, according to SVG text layout
+        rules. For each character of the passed in InlineTextBox, it determines the x/y/dx/dy/rotate value, and the position
+        in the <text metrics> list of the renderer. The problem here is that the passed in text boxes are in visual order,
+        the x/y/.. lists are all in logical order.
+
+        Example: <text direction="rtl" unicde-bidi="bidi-override" x="10 20">abcdef</text>, reverse the text direction:
+                 the visual order now is: "fedcba", where 'f' should be associated with x="10" and 'e' with x="20".
+
+        Fix that problem, by computing a list of text boxes in _logical_ order in advance and pass it to SVGTextLayoutEngine,
+        before it starts processing the boxes in visual order, fed by SVGRootInlineBox. When laying oout text, we can now
+        process text in visual order, but grab the x/y/.. coordinates from the renderer in logical order.
+
+        Some more work was needed to truly fix Arabic. The SVGTextLayoutAttributesBuilder measured all characters isolated,
+        which is not a problem with latin text, but results in wrong advances for Arabic text, as isolated forms, instead of
+        shaped forms are measured. This broke text-anchor support, text queries on Arabic text etc. Fixed now, covered by
+        dozens of new tests.
+
+        Tests: svg/W3C-I18N/g-dirLTR-ubNone.svg
+               svg/W3C-I18N/g-dirLTR-ubOverride.svg
+               svg/W3C-I18N/g-dirRTL-ubNone.svg
+               svg/W3C-I18N/g-dirRTL-ubOverride.svg
+               svg/W3C-I18N/text-anchor-dirLTR-anchorEnd.svg
+               svg/W3C-I18N/text-anchor-dirLTR-anchorMiddle.svg
+               svg/W3C-I18N/text-anchor-dirLTR-anchorStart.svg
+               svg/W3C-I18N/text-anchor-dirNone-anchorEnd.svg
+               svg/W3C-I18N/text-anchor-dirNone-anchorMiddle.svg
+               svg/W3C-I18N/text-anchor-dirNone-anchorStart.svg
+               svg/W3C-I18N/text-anchor-dirRTL-anchorEnd.svg
+               svg/W3C-I18N/text-anchor-dirRTL-anchorMiddle.svg
+               svg/W3C-I18N/text-anchor-dirRTL-anchorStart.svg
+               svg/W3C-I18N/text-anchor-inherited-dirLTR-anchorEnd.svg
+               svg/W3C-I18N/text-anchor-inherited-dirLTR-anchorMiddle.svg
+               svg/W3C-I18N/text-anchor-inherited-dirLTR-anchorStart.svg
+               svg/W3C-I18N/text-anchor-inherited-dirRTL-anchorEnd.svg
+               svg/W3C-I18N/text-anchor-inherited-dirRTL-anchorMiddle.svg
+               svg/W3C-I18N/text-anchor-inherited-dirRTL-anchorStart.svg
+               svg/W3C-I18N/text-anchor-no-markup.svg
+               svg/W3C-I18N/text-dirLTR-ubNone.svg
+               svg/W3C-I18N/text-dirLTR-ubOverride.svg
+               svg/W3C-I18N/text-dirRTL-ubNone.svg
+               svg/W3C-I18N/text-dirRTL-ubOverride.svg
+               svg/W3C-I18N/tspan-dirLTR-ubEmbed-in-rtl-context.svg
+               svg/W3C-I18N/tspan-dirLTR-ubNone-in-rtl-context.svg
+               svg/W3C-I18N/tspan-dirLTR-ubOverride-in-default-context.svg
+               svg/W3C-I18N/tspan-dirLTR-ubOverride-in-ltr-context.svg
+               svg/W3C-I18N/tspan-dirLTR-ubOverride-in-rtl-context.svg
+               svg/W3C-I18N/tspan-dirNone-ubOverride-in-default-context.svg
+               svg/W3C-I18N/tspan-dirNone-ubOverride-in-ltr-context.svg
+               svg/W3C-I18N/tspan-dirNone-ubOverride-in-rtl-context.svg
+               svg/W3C-I18N/tspan-dirRTL-ubEmbed-in-default-context.svg
+               svg/W3C-I18N/tspan-dirRTL-ubEmbed-in-ltr-context.svg
+               svg/W3C-I18N/tspan-dirRTL-ubNone-in-default-context.svg
+               svg/W3C-I18N/tspan-dirRTL-ubNone-in-ltr-context.svg
+               svg/W3C-I18N/tspan-dirRTL-ubOverride-in-default-context.svg
+               svg/W3C-I18N/tspan-dirRTL-ubOverride-in-ltr-context.svg
+               svg/W3C-I18N/tspan-dirRTL-ubOverride-in-rtl-context.svg
+               svg/W3C-I18N/tspan-direction-ltr.svg
+               svg/W3C-I18N/tspan-direction-rtl.svg
+               svg/W3C-SVG-1.1-SE/text-intro-02-b.svg
+               svg/W3C-SVG-1.1-SE/text-intro-05-t.svg
+               svg/W3C-SVG-1.1-SE/text-intro-09-b.svg
+               svg/W3C-SVG-1.1/text-align-08-b.svg
+               svg/W3C-SVG-1.1/text-fonts-03-t.svg
+               svg/W3C-SVG-1.1/text-intro-01-t.svg
+               svg/W3C-SVG-1.1/text-intro-02-b.svg
+               svg/W3C-SVG-1.1/text-intro-03-b.svg
+               svg/W3C-SVG-1.1/text-intro-04-t.svg
+               svg/text/bidi-reorder-value-lists.svg
+               svg/text/bidi-text-anchor-direction.svg
+               svg/text/bidi-text-query.svg
+               svg/text/bidi-tspans.svg
+
+        * rendering/RenderBlockLineLayout.cpp: Remove hack that forced LTR support when unicode-bidi="normal" and handling SVG text.
+        (WebCore::RenderBlock::determineStartPosition):
+        * rendering/svg/SVGInlineTextBox.cpp: s/fragment.positionListOffset/fragment.characterOffset/
+        (WebCore::SVGInlineTextBox::offsetForPositionInFragment):
+        (WebCore::SVGInlineTextBox::constructTextRun):
+        (WebCore::SVGInlineTextBox::mapStartEndPositionsIntoFragmentCoordinates):
+        * rendering/svg/SVGRenderTreeAsText.cpp: Ditto.
+        (WebCore::writeSVGInlineTextBox):
+        * rendering/svg/SVGRootInlineBox.cpp: Add new buildTextBoxListInLogicalOrder(), collecting all text boxes recursively in logical order (aka. as specified in markup).
+                                              This is needed as we have to process x/y/dx/dy/rotate value lists of text/tspan/.. elements in logical order, not in visual
+                                              order as the characters are presented on screen.
+        (WebCore::SVGRootInlineBox::computePerCharacterLayoutInformation):
+        (WebCore::SVGRootInlineBox::buildTextBoxListInLogicalOrder):
+        (WebCore::SVGRootInlineBox::layoutCharactersInTextBoxes):
+        * rendering/svg/SVGRootInlineBox.h:
+        * rendering/svg/SVGTextChunk.cpp: Cleanup code, minimize SVGTextChunks memory consumption.
+        (WebCore::SVGTextChunk::SVGTextChunk): A text chunk now know whether its base progress direction is left-to-right or right-to-left.
+        (WebCore::SVGTextChunk::calculateLength):
+        (WebCore::SVGTextChunk::calculateTextAnchorShift): Make text-anchor direction aware. text-anchor="start/end" meaning depends on the context (ltr vs. rtl).
+        * rendering/svg/SVGTextChunk.h: Adapt code, merging three members into a bitfield.
+        (WebCore::SVGTextChunk::isVerticalText):
+        (WebCore::SVGTextChunk::hasDesiredTextLength):
+        (WebCore::SVGTextChunk::hasTextAnchor):
+        (WebCore::SVGTextChunk::hasLengthAdjustSpacing):
+        (WebCore::SVGTextChunk::hasLengthAdjustSpacingAndGlyphs):
+        * rendering/svg/SVGTextChunkBuilder.cpp: Adapt to SVGTextChunk code changes.
+        (WebCore::SVGTextChunkBuilder::addTextChunk):
+        (WebCore::SVGTextChunkBuilder::processTextChunk):
+        * rendering/svg/SVGTextFragment.h: Add metricsListOffset, needed only while laying out text.
+        (WebCore::SVGTextFragment::SVGTextFragment): Rename positionListOffset to characterOffset, as it describes an offset in the textRenderer->characters() array.
+        * rendering/svg/SVGTextLayoutAttributesBuilder.cpp
+        (WebCore::SVGTextLayoutAttributesBuilder::propagateLayoutAttributes): Fix measuring Arabic text in LTR/RTL modes. Assure that each SVGTextMetrics object
+                                                                              that we cache, refers to the _rendered_ character. For Arabic text that means, that we're
+                                                                              measuring the shaped width of the glyph, not the glyph in its isolated form. Without that
+                                                                              fix reordering boxes containing Arabic is wrong.
+        * rendering/svg/SVGTextLayoutEngine.cpp: SVGTextLayoutEngine is fed with text boxes to be laid out in _visual_ order, left-to-right, after the BiDi algorithm
+                                                 has been applied by RenderBlockLineLayout to create the inline box tree. The coordinates lists x/y/dx/dy/rotate have
+                                                 to be processed in _logical_ order. SVGRootInlineBox now passes a list of text boxes in logical order to SVGTextLayoutEngine,
+                                                 to assure it grabs the coordinates from the correct InlineTextBox. See examples at the top of the ChangeLog.
+        (WebCore::SVGTextLayoutEngine::SVGTextLayoutEngine):
+        (WebCore::SVGTextLayoutEngine::recordTextFragment): No need to measure text here anymore, SVGTextLayoutAttributesBuilder now provides exact advances for each glyph.
+                                                            The width of a SVGTextFragment is always equal to the sum of each glyph advance. (This was not the case for
+                                                            Arabic until now.)
+        (WebCore::SVGTextLayoutEngine::finalizeTransformMatrices):
+        (WebCore::SVGTextLayoutEngine::nextLogicalBoxAndOffset): Computes the next logical box and the offset to the next coordinate value in its position list.
+        (WebCore::SVGTextLayoutEngine::layoutTextOnLineOrPath):
+        * rendering/svg/SVGTextLayoutEngine.h: Add CharacterRange helper struct.
+        (WebCore::SVGTextLayoutEngine::CharacterRange::CharacterRange):
+        * rendering/svg/SVGTextMetrics.cpp: Remove unused measureAllCharactersIndividually() method.
+        (WebCore::constructTextRun): Pass direction and unicode-bidi="override" values to the TextRun, otherwhise LTR is always asumed.
+        * rendering/svg/SVGTextMetrics.h:
+        (WebCore::SVGTextMetrics::setWidth): Add private setter, only SVGTextLayoutAttributesBuilder is allowed to modify the metrics (to fix up glyph widths for Arabic).
+        * rendering/svg/SVGTextQuery.cpp: s/fragment.positionListOffset/fragment.characterOffset/
+        (WebCore::SVGTextQuery::subStringLengthCallback):
+        (WebCore::SVGTextQuery::startPositionOfCharacterCallback):
+        (WebCore::SVGTextQuery::endPositionOfCharacterCallback):
+        (WebCore::calculateGlyphBoundaries):
+
+2011-03-15  Sergio Villar Senin  <svillar@igalia.com>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] Fix make distcheck for 1.3.13 release
+        https://bugs.webkit.org/show_bug.cgi?id=56371
+
+        No new tests as this is a build fix.
+
+        * GNUmakefile.am: added a couple of missing files.
+
+2011-03-08  Levi Weintraub  <leviw@chromium.org>
+
+        Reviewed by Ryosuke Niwa.
+
+        Get rid of firstDeepEditingPositionForNode and lastDeepEditingPositionForNode
+        https://bugs.webkit.org/show_bug.cgi?id=52642
+
+        Replacing calls to first/lastDeepEditingPositionForNode with calls to their analogous
+        functions that create new positions. Also fixing various parts of editing code that
+        incorrectly handled the new positions now being created.
+
+        No new tests as this is refactoring/cleanup.
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::visiblePositionRange):
+        * dom/Position.cpp:
+        (WebCore::Position::parentAnchoredEquivalent):
+        (WebCore::Position::previous):
+        (WebCore::Position::next):
+        (WebCore::Position::atFirstEditingPositionForNode):
+        (WebCore::Position::atLastEditingPositionForNode):
+        (WebCore::Position::upstream):
+        (WebCore::Position::isCandidate):
+        (WebCore::Position::getInlineBoxAndOffset):
+        * dom/Position.h:
+        (WebCore::operator==):
+        * dom/PositionIterator.cpp:
+        (WebCore::PositionIterator::operator Position):
+        * editing/ApplyBlockElementCommand.cpp:
+        (WebCore::ApplyBlockElementCommand::rangeForParagraphSplittingTextNodesIfNeeded):
+        * editing/CompositeEditCommand.cpp:
+        (WebCore::CompositeEditCommand::positionAvoidingSpecialElementBoundary):
+        * editing/DeleteSelectionCommand.cpp:
+        (WebCore::isTableCellEmpty):
+        (WebCore::DeleteSelectionCommand::removeNode):
+        * editing/InsertLineBreakCommand.cpp:
+        (WebCore::InsertLineBreakCommand::doApply):
+        * editing/InsertListCommand.cpp:
+        (WebCore::InsertListCommand::unlistifyParagraph):
+        * editing/ReplaceSelectionCommand.cpp:
+        (WebCore::ReplaceSelectionCommand::positionAtEndOfInsertedContent):
+        * editing/TypingCommand.cpp:
+        (WebCore::TypingCommand::forwardDeleteKeyPressed):
+        * editing/VisibleSelection.cpp:
+        (WebCore::VisibleSelection::selectionFromContentsOfNode):
+        (WebCore::VisibleSelection::adjustSelectionToAvoidCrossingEditingBoundaries):
+        * editing/htmlediting.cpp:
+        (WebCore::firstEditablePositionAfterPositionInRoot):
+        (WebCore::lastEditablePositionBeforePositionInRoot):
+        (WebCore::enclosingEmptyListItem):
+        * editing/htmlediting.h:
+        * editing/visible_units.cpp:
+        (WebCore::startOfParagraph):
+        (WebCore::endOfParagraph):
+        (WebCore::startOfEditableContent):
+        (WebCore::endOfEditableContent):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::positionForPoint):
+
+2011-03-15  Beth Dakin  <bdakin@apple.com>
+
+        Attempted build fix.
+
+        * platform/mac/ScrollAnimatorMac.mm:
+        (WebCore::ScrollAnimatorMac::cancelAnimations):
+
+2011-03-15  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Dave Levin.
+
+        https://bugs.webkit.org/show_bug.cgi?id=56329
+
+        Fix FontCache problems on Linux.  Make sure not to mutate the platform data passed in to SimpleFontData's
+        constructor.  Change this code to match Mac and to set the new m_hasVerticalGlyphs boolean instead of
+        mutating orientation.
+
+        * platform/graphics/chromium/SimpleFontDataLinux.cpp:
+        (WebCore::SimpleFontData::platformInit):
+
+2011-03-15  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Disable ShadowBlur shadow drawing in accelerated contexts
+        https://bugs.webkit.org/show_bug.cgi?id=56392
+
+        When drawing into a graphics context that is accelerated, don't use
+        ShadowBlur, because it may be slower.
+        
+        * platform/graphics/GraphicsContext.h:
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::GraphicsContext::fillRect):
+        (WebCore::GraphicsContext::fillRoundedRect):
+        (WebCore::GraphicsContext::fillRectWithRoundedHole):
+        (WebCore::GraphicsContext::setIsCALayerContext):
+        (WebCore::GraphicsContext::isCALayerContext):
+        (WebCore::GraphicsContext::setIsAcceleratedContext):
+        (WebCore::GraphicsContext::isAcceleratedContext):
+        * platform/graphics/cg/GraphicsContextPlatformPrivateCG.h:
+        (WebCore::GraphicsContextPlatformPrivate::GraphicsContextPlatformPrivate):
+        * platform/graphics/mac/WebLayer.mm:
+        (drawLayerContents):
+
+2011-03-15  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Fix for <rdar://problem/9075624> Overlay scrollbars slow down PLT by 6%
+
+        Tell the ScrollAnimator to cancelAnimations() since we are navigating to a new 
+        page.
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::transitionToCommitted):
+        
+        Scroll animations should be suspended if the FrameLoadState is anything but 
+        complete.
+        * page/FrameView.cpp:
+        (WebCore::FrameView::shouldSuspendScrollAnimations):
+        * page/FrameView.h:
+        * platform/ScrollableArea.h:
+        (WebCore::ScrollableArea::shouldSuspendScrollAnimations):
+        * rendering/RenderDataGrid.cpp:
+        (WebCore::RenderDataGrid::shouldSuspendScrollAnimations):
+        * rendering/RenderDataGrid.h:
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::shouldSuspendScrollAnimations):
+        * rendering/RenderLayer.h:
+        * rendering/RenderListBox.cpp:
+        (WebCore::RenderListBox::shouldSuspendScrollAnimations):
+        * rendering/RenderListBox.h:
+
+        New virtual function cancelAnimations() is only needed on the Mac, so the base 
+        class is empty.
+        * platform/ScrollAnimator.h:
+        (WebCore::ScrollAnimator::cancelAnimations):
+
+        ScrollAnimatorMac needs to keep track of whether the page has been scrolled since 
+        it started loading. If so, we will override optimizations that wait for the 
+        FrameLoadState to be complete before animating scrollbars.
+        * platform/mac/ScrollAnimatorMac.h:
+        (WebCore::ScrollAnimatorMac::haveScrolledSincePageLoad):
+
+        If the scrollbar animations should be suspended, we start a timer to make sure 
+        that we do flash the scrollbars. Animating the scrollbars is expensive, so this is 
+        both a performance optimization and a UI enhancement since the scrollbar won't 
+        jump around nearly as much on a page load.
+        * platform/mac/ScrollAnimatorMac.mm:
+        (-[ScrollbarPainterDelegate cancelAnimations]):
+        (-[ScrollbarPainterDelegate scrollerImp:animateKnobAlphaTo:duration:]):
+        (-[ScrollbarPainterDelegate scrollerImp:animateTrackAlphaTo:duration:]):
+        (-[ScrollbarPainterDelegate scrollerImp:overlayScrollerStateChangedTo:]):
+        (WebCore::ScrollAnimatorMac::ScrollAnimatorMac):
+        (WebCore::ScrollAnimatorMac::scroll):
+        (WebCore::ScrollAnimatorMac::handleWheelEvent):
+        (WebCore::ScrollAnimatorMac::cancelAnimations):
+        (WebCore::ScrollAnimatorMac::smoothScrollWithEvent):
+        (WebCore::ScrollAnimatorMac::beginScrollGesture):
+        (WebCore::ScrollAnimatorMac::startScrollbarPaintTimer):
+        (WebCore::ScrollAnimatorMac::scrollbarPaintTimerIsActive):
+        (WebCore::ScrollAnimatorMac::stopScrollbarPaintTimer):
+        (WebCore::ScrollAnimatorMac::initialScrollbarPaintTimerFired):
+
+        New WebCoreSystemInterface function to force the scrollbars to flash
+        * WebCore.exp.in:
+        * platform/mac/WebCoreSystemInterface.h:
+        * platform/mac/WebCoreSystemInterface.mm:
+
+2011-03-15  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Remove stale comment at RenderStyle::diff.
+        https://bugs.webkit.org/show_bug.cgi?id=56387
+
+        * rendering/style/RenderStyle.cpp: Removed comment.
+
+2011-03-15  David Kilzer  <ddkilzer@apple.com>
+
+        <http://webkit.org/b/56381> Objective-C classes should be typedef-ed as structs (not void*) in C++
+
+        Reviewed by Simon Fraser.
+
+        Typedef-ing Objective-C classes as void* for pure C++ makes it
+        easier for bugs to creep in because compilers can't do any type
+        checking for void pointers.
+
+        * platform/graphics/GraphicsContext3D.h: Changed typedef
+        declarations for CALayer and WebGLLayer from void* to structs.
+        (WebCore::GraphicsContext3D::platformLayer): Changed
+        static_cast<CALayer*> to reinterpret_cast<CALayer*> now that
+        CALayer and WebGLLayer are not void pointers.
+        * platform/graphics/GraphicsLayer.h: Changed typedef declaration
+        for PlatformLayer from void* to struct CALayer.
+        * platform/graphics/ca/PlatformCAAnimation.h: Changed typedef
+        declaration for CAPropertyAnimation from void* to a struct.
+        Extracted typdef for PlatformAnimationRef.
+
+2011-03-15  Ilya Sherman  <isherman@chromium.org>
+
+        Reviewed by Tony Chang.
+
+        Autofilled form elements are assigned fixed background color but not text color
+        https://bugs.webkit.org/show_bug.cgi?id=48382
+
+        Test: fast/forms/input-autofilled.html
+
+        * css/html.css:
+        (input:-webkit-autofill): Added foreground color: #000000
+        * css/wml.css:
+        (input:-webkit-autofill): Added foreground color: #000000
+
+2011-03-15  Alexis Menard  <alexis.menard@openbossa.org>
+
+        Reviewed by Eric Carlson.
+
+        HTMLMediaElement::mediaPlayerPlaybackStateChanged should not change the "public" state of the element
+        if it's an internal pause for example.
+        https://bugs.webkit.org/show_bug.cgi?id=56374
+
+        In case of an internal pause, the callback from the mediaplayer should be ignored to avoid reflecting the
+        change into the DOM.
+
+        No new tests: Verified manually.
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::mediaPlayerPlaybackStateChanged):
+
+2011-03-12  Pavel Podivilov  <podivilov@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: re-implement xhr breakpoints.
+        https://bugs.webkit.org/show_bug.cgi?id=56252
+
+        - restore xhr breakpoints one by one instead of using setAllBrowserBreakpoints
+        - store xhr breakpoints in a separate setting
+        - move presentation-related code from BreakpointManager to XHRBreakpointsSidebarPane
+
+        Test: inspector/debugger/xhr-breakpoints.html
+
+        * inspector/InspectorBrowserDebuggerAgent.cpp:
+        (WebCore::InspectorBrowserDebuggerAgent::InspectorBrowserDebuggerAgent):
+        (WebCore::InspectorBrowserDebuggerAgent::inspectedURLChanged):
+        (WebCore::InspectorBrowserDebuggerAgent::restoreStickyBreakpoint):
+        (WebCore::InspectorBrowserDebuggerAgent::setXHRBreakpoint):
+        (WebCore::InspectorBrowserDebuggerAgent::removeXHRBreakpoint):
+        (WebCore::InspectorBrowserDebuggerAgent::willSendXMLHttpRequest):
+        (WebCore::InspectorBrowserDebuggerAgent::clear):
+        * inspector/InspectorBrowserDebuggerAgent.h:
+        * inspector/front-end/BreakpointManager.js:
+        (WebInspector.BreakpointManager.prototype.setXHRBreakpoint):
+        (WebInspector.BreakpointManager.prototype.removeXHRBreakpoint):
+        (WebInspector.BreakpointManager.prototype.breakpointViewForEventData):
+        (WebInspector.BreakpointManager.prototype._projectChanged):
+        (WebInspector.BreakpointManager.prototype._validateBreakpoints):
+        (WebInspector.BreakpointManager.prototype._createEventListenerBreakpointId):
+        * inspector/front-end/BreakpointsSidebarPane.js:
+        (WebInspector.XHRBreakpointsSidebarPane):
+        (WebInspector.XHRBreakpointsSidebarPane.prototype._addButtonClicked.finishEditing):
+        (WebInspector.XHRBreakpointsSidebarPane.prototype._addButtonClicked):
+        (WebInspector.XHRBreakpointsSidebarPane.prototype._setBreakpoint):
+        (WebInspector.XHRBreakpointsSidebarPane.prototype._removeBreakpoint):
+        (WebInspector.XHRBreakpointsSidebarPane.prototype._contextMenu.removeBreakpoint):
+        (WebInspector.XHRBreakpointsSidebarPane.prototype._contextMenu):
+        (WebInspector.XHRBreakpointsSidebarPane.prototype._checkboxClicked):
+        (WebInspector.XHRBreakpointsSidebarPane.prototype._labelClicked.finishEditing):
+        (WebInspector.XHRBreakpointsSidebarPane.prototype._labelClicked):
+        (WebInspector.XHRBreakpointsSidebarPane.prototype.highlightBreakpoint):
+        (WebInspector.XHRBreakpointsSidebarPane.prototype.clearBreakpointHighlight):
+        (WebInspector.XHRBreakpointsSidebarPane.prototype._saveBreakpoints):
+        (WebInspector.XHRBreakpointsSidebarPane.prototype._restoreBreakpoints):
+        (WebInspector.XHRBreakpointsSidebarPane.prototype._projectChanged):
+        * inspector/front-end/CallStackSidebarPane.js:
+        (WebInspector.CallStackSidebarPane.prototype.update):
+        (WebInspector.CallStackSidebarPane.prototype._xhrBreakpointHit):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel):
+        (WebInspector.ScriptsPanel.prototype._debuggerPaused):
+        (WebInspector.ScriptsPanel.prototype._clearInterface):
+        * inspector/front-end/Settings.js:
+        (WebInspector.Settings):
+        * inspector/front-end/inspector.js:
+        (WebInspector.resetFocusElement):
+        (WebInspector.set attached):
+
+2011-03-15  Kevin Ollivier  <kevino@theolliviers.com>
+
+        Reviewed by Darin Adler.
+
+        Introduce WTF_USE_EXPORT_MACROS, which will allow us to put shared library import/export
+        info into the headers rather than in export symbol definition files, but disable it on 
+        all platforms initially so we can deal with port build issues one port at a time.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=27551
+
+        * config.h:
+        * platform/mac/LoggingMac.mm:
+
+2011-03-15  Ilya Tikhonovsky  <loislo@chromium.org>
+
+        Unreviewed build fix.
+
+        Chromium: shared lib linux build are failing.
+
+        Two exclude rules for LocalizedNumberNone and TextEncodingDetectorNone were added to the wrong library.
+        It was webcore_remaining instead of webcore_platform.
+
+        * WebCore.gyp/WebCore.gyp:
+
+2011-03-15  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: expanding/collapsing object shouldn&apos;t affect outer console.group expansion state
+        https://bugs.webkit.org/show_bug.cgi?id=56373
+
+        * inspector/front-end/Section.js:
+        (WebInspector.Section):
+        (WebInspector.Section.prototype.toggleExpanded):
+        (WebInspector.Section.prototype.handleClick): stop click even propagation if it was handled by this section.
+
+2011-03-15  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: crash upon "//html//@id" search in elements panel.
+        https://bugs.webkit.org/show_bug.cgi?id=56334
+
+        * inspector/InspectorDOMAgent.cpp:
+        * inspector/front-end/ElementsTreeOutline.js:
+
+2011-03-15  Andrey Kosyakov  <caseq@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: further extension API cleanup (removed inspectedPage, add experimental prefix)
+        https://bugs.webkit.org/show_bug.cgi?id=56327
+
+        * inspector/front-end/ExtensionAPI.js:
+        (WebInspector.injectedExtensionAPI):
+        * inspector/front-end/ExtensionAPISchema.json:
+
+2011-03-15  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: when console.groupEnd calls twice
+        https://bugs.webkit.org/show_bug.cgi?id=56114
+
+        Test: inspector/console/console-nested-group.html
+
+        * inspector/ConsoleMessage.h:
+        (WebCore::ConsoleMessage::type):
+        * inspector/InspectorConsoleAgent.cpp:
+        (WebCore::InspectorConsoleAgent::addConsoleMessage): do not coalesce adjacent EndGroup messages.
+
+2011-03-15  Chris Mumford  <chris.mumford@palm.com>
+
+        Reviewed by Adam Barth.
+
+        Initializing several member variables that were not initialized in
+        their constructors. These values were all read prior to initialization
+        as reported by Valgrind.
+
+        No new tests: No feature additions/removals.
+
+        * accessibility/AccessibilityImageMapLink.cpp:
+        (WebCore::AccessibilityImageMapLink::AccessibilityImageMapLink):
+        * editing/DeleteSelectionCommand.cpp:
+        (WebCore::DeleteSelectionCommand::DeleteSelectionCommand):
+        * html/HTMLCanvasElement.cpp:
+        (WebCore::HTMLCanvasElement::HTMLCanvasElement):
+        * xml/XPathResult.cpp:
+        (WebCore::XPathResult::XPathResult):
+
+2011-03-15  Ben Taylor  <bentaylor.solx86@gmail.com>
+
+        Reviewed by Adam Barth.
+
+        https://bugs.webkit.org/show_bug.cgi?id=56255
+        Fix build on Solaris 10/Sun Studio 12 C++
+
+        No new tests. This is to fix compilation on Solaris 10 with Sun Studio 12 C++
+
+        * bridge/runtime_array.h:
+        (JSC::RuntimeArray::getConcreteArray):
+
+2011-03-14  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Adam Roben
+
+        about:blank fake responses don't get serialized when sent the UIProcess
+        <rdar://problem/9108119>
+        https://bugs.webkit.org/show_bug.cgi?id=56357
+
+        Test: AboutBlankLoad
+
+        * platform/network/cf/ResourceResponse.h:
+        * platform/network/cf/ResourceResponseCFNet.cpp:
+        (WebCore::ResourceResponse::cfURLResponse):
+        Create a CFURLResponseRef if one does not exist yet as we do for
+        NSURLResponses on the mac.
+
+2011-03-14  Alexis Menard  <alexis.menard@openbossa.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Seeking videos using the timeline bar does not work properly and stop the video playback.
+        https://bugs.webkit.org/show_bug.cgi?id=56145
+
+        We do not need seekTimeout and queuedSeekTimeout anymore. setPosition on QMediaPlayer is good enough.
+        positionChanged() will be emitted when the data is buffered. On Linux the signal was not emitted because
+        of a bug in QtMultimedia.
+
+        * platform/graphics/qt/MediaPlayerPrivateQt.cpp:
+        (WebCore::MediaPlayerPrivateQt::MediaPlayerPrivateQt):
+        (WebCore::MediaPlayerPrivateQt::seek):
+        (WebCore::MediaPlayerPrivateQt::stateChanged):
+        (WebCore::MediaPlayerPrivateQt::positionChanged):
+        * platform/graphics/qt/MediaPlayerPrivateQt.h:
+
+2011-03-14  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Adam Roben.
+
+        https://bugs.webkit.org/show_bug.cgi?id=44138
+        Crash beneath SocketStreamHandle::readStreamCallback when running websocket/tests/workers/worker-handshake-challenge-randomness.html
+
+        https://bugs.webkit.org/show_bug.cgi?id=55375
+        http/tests/websocket/tests/reload-crash.html sometimes crashes beneath SocketStreamHandle::readStreamCallback on Windows
+
+        https://bugs.webkit.org/show_bug.cgi?id=56185
+        http/tests/websocket/tests/url-with-credential.html sometimes crashes beneath SocketStreamHandle::readStreamCallback on Windows
+
+        * platform/network/cf/SocketStreamHandle.h: Made SocketStreamHandle ThreadSafeShared, so that
+        a pointer can be passed across threads when wrapped in a RefPtr.
+
+        * platform/network/cf/SocketStreamHandleCFNet.cpp: Make sure that an object still exists
+        when executing a method on main thread by using RefPtr.
+
+2011-03-14  Sam Weinig  <sam@webkit.org>
+
+        Mac build fix. Part 1 of N.
+
+        * WebCore.exp.in:
+
+2011-03-14  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Eric Carlson.
+
+        Stalled media elements don't stop delaying the load event
+        https://bugs.webkit.org/show_bug.cgi?id=56316
+
+        We should stop delaying the load event when the load has
+        stalled naturally, or if we require a user gesture to
+        continue the load.
+
+        Test: http/tests/media/video-play-stall-before-meta-data.html
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::setNetworkState): when suspending, stop delaying.
+        (WebCore::HTMLMediaElement::progressEventTimerFired): when stalling, stop delaying.
+
+2011-03-13  MORITA Hajime  <morrita@google.com>
+
+        Reviewed by Tony Chang.
+
+        Crash when dragging and dropping in a document with an invalid XHTML header
+        https://bugs.webkit.org/show_bug.cgi?id=48799
+
+        DragController tried to dispatch textInput event even when the
+        drag destination is not the editable area.
+        This change skips the event dispatching on that case.
+        
+        Test: editing/pasteboard/drop-file-svg.html
+
+        * page/DragController.cpp:
+        (WebCore::DragController::dispatchTextInputEventFor):
+        (WebCore::DragController::concludeEditDrag):
+
+2011-03-14  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r81094.
+        http://trac.webkit.org/changeset/81094
+        https://bugs.webkit.org/show_bug.cgi?id=56355
+
+        Broke the chromium DRT related build. (Requested by dave_levin
+        on #webkit).
+
+        * WebCore.exp.in:
+        * WebCore.order:
+        * page/Frame.cpp:
+        (WebCore::Frame::layerTreeAsText):
+        * page/Frame.h:
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::layerTreeAsText):
+        * rendering/RenderLayerCompositor.h:
+
+2011-03-14  Adam Barth  <abarth@webkit.org>
+
+        Apparently we need to exclude DefaultSharedWorkerRepository.cpp from
+        the Chromium build, otherwise the objects visible in the global scope
+        change.
+
+        * WebCore.gyp/WebCore.gyp:
+
+2011-03-14  Adam Barth  <abarth@webkit.org>
+
+        Attempted Chromium build fix.  Exclude AllInOne harder.
+
+        * WebCore.gyp/WebCore.gyp:
+
+2011-03-14  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        EventHandler calls shouldChangeSelection needlessly
+        https://bugs.webkit.org/show_bug.cgi?id=56324
+
+        Extracted setSelectionIfNeeded and setNonDirectionalSelectionIfNeeded and
+        avoided calling shouldChangeSelection and setSelection when the existing
+        selection is identical to that of new selection.
+
+        * page/EventHandler.cpp:
+        (WebCore::setSelectionIfNeeded): Extracted.
+        (WebCore::setNonDirectionalSelectionIfNeeded): Extracted.
+        (WebCore::EventHandler::selectClosestWordFromMouseEvent): Calls a helper function above.
+        (WebCore::EventHandler::selectClosestWordOrLinkFromMouseEvent): Ditto.
+        (WebCore::EventHandler::handleMousePressEventTripleClick): Ditto.
+        (WebCore::EventHandler::handleMousePressEventSingleClick): Ditto.
+        (WebCore::EventHandler::updateSelectionForMouseDrag): Ditto.
+        (WebCore::EventHandler::handleMouseReleaseEvent): Ditto.
+
+2011-03-14  Daniel Sievers  <sievers@google.com>
+
+        Reviewed by Simon Fraser.
+
+        [Chromium] Make RenderAsTextBehavior and LayerTreeAsTextBehavior tweakable from the DumpRenderTree commandline
+        https://bugs.webkit.org/show_bug.cgi?id=56139
+
+        * WebCore.exp.in:
+        * WebCore.order:
+        * page/Frame.cpp:
+        (WebCore::Frame::layerTreeAsText):
+        * page/Frame.h:
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::layerTreeAsText):
+        * rendering/RenderLayerCompositor.h:
+
+2011-03-14  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Add remaining files to WebCore.gypi
+        https://bugs.webkit.org/show_bug.cgi?id=56351
+
+        Adding the remaining files to WebCore.gypi required updating the
+        include/exclude lists in WebCore.gyp.  These lists aren't overly
+        elegant, but we can try to improve them in the future.
+
+        * WebCore.gyp/WebCore.gyp:
+        * WebCore.gypi:
+        * bindings/v8/ScriptCachedFrameData.cpp:
+            - Added ifdefs to this file to match the header.
+        * platform/graphics/WOFFFileFormat.cpp:
+            - Fixed build error when compiling without ENABLE(OPENTYPE_SANITIZER).
+
+2011-03-14  Anton Muhin  <antonm@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        [v8] Rework object group building.
+        https://bugs.webkit.org/show_bug.cgi?id=55399
+
+        Instead of going top-down (from owner to owned elements), go up---from objects
+        to their group ids.  That fits better to v8's object grouping model and guarantees
+        that each wrapper belongs to the single group.
+
+        Alas, this cannot be implemented for one kind of objects---CSSProperties.
+
+        Part of core GC algorithm and tested extensively by exisiting layout tests.
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/scripts/test/V8/V8TestInterface.cpp:
+        * bindings/scripts/test/V8/V8TestMediaQueryListListener.cpp:
+        * bindings/scripts/test/V8/V8TestObj.cpp:
+        * bindings/v8/V8GCController.cpp:
+        (WebCore::calculateGroupId):
+        (WebCore::calculateRootStyleSheet):
+        (WebCore::GrouperVisitor::visitDOMWrapper):
+        (WebCore::GrouperVisitor::applyGrouping):
+        (WebCore::V8GCController::gcPrologue):
+        * bindings/v8/WrapperTypeInfo.h:
+        (WebCore::WrapperTypeInfo::isSubclass):
+        * css/CSSRuleList.h:
+        (WebCore::CSSRuleList::styleList):
+        * css/StyleSheetList.h:
+        (WebCore::StyleSheetList::document):
+
+2011-03-14  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by James Robinson.
+
+        Assertion failure by form validation message for <select required> with float:left
+        https://bugs.webkit.org/show_bug.cgi?id=55995
+
+        Test: fast/forms/interactive-validation-select-crash.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::canMergeContiguousAnonymousBlocks):
+          isAnonymousBlock() doesn't mean it is a RenderBlock. We need to check isRenderBlock().
+
+2011-03-14  Balazs Kelemen  <kbalazs@webkit.org>
+
+        Reviewed by Adam Roben.
+
+        [Qt][WK2]Unbreak InjectedBundle on Qt
+        https://bugs.webkit.org/show_bug.cgi?id=54109
+
+        No code changes so no new tests.
+
+        Revert the changes that were needed to use KURL
+        in WebKitTestRunner.
+
+        * Configurations/WebCore.xcconfig:
+        * WebCore.exp.in:
+
+2011-03-14  Jarkko Sakkinen  <jarkko.j.sakkinen@gmail.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Compilation fails with --3d-canvas 
+        https://bugs.webkit.org/show_bug.cgi?id=55964
+
+        * WebCore.pro:
+        * platform/graphics/qt/Extensions3DQt.cpp:
+
+2011-03-14  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Adam Roben and Gavin Barraclough.
+
+        FileSystemWin.cpp needs listDirectory() implementation
+        https://bugs.webkit.org/show_bug.cgi?id=56331
+        <rdar://problem/9126635>
+        
+        Move PathWalker from an inline class in WebKit2 to its own class in WebCore,
+        so it can be used from both WebCore and WebKit2.
+        
+        Implement FileSystemWin::listDirectory using PathWalker to populate the Vector
+        of paths matching the passed in pattern.
+
+        * WebCore.vcproj/WebCore.vcproj:
+        * platform/win/FileSystemWin.cpp:
+        (WebCore::listDirectory): Call through to PathWalker.
+        * platform/win/PathWalker.cpp: Added.
+        (WebCore::PathWalker::PathWalker): Moved from WebKit2. Added a second argument
+            for the pattern to pass to the Windows File APIs.
+        (WebCore::PathWalker::~PathWalker): Moved from WebKit2.
+        (WebCore::PathWalker::isValid): Ditto.
+        (WebCore::PathWalker::data): Ditto.
+        (WebCore::PathWalker::step): Ditto.
+        * platform/win/PathWalker.h: Added.
+
+2011-03-14  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=56320
+        Remove HistoryItem::icon() and the WebCore dependency on "IconDatabaseBase::defaultIcon()"
+
+        Remove HistoryItem::icon():
+        * history/HistoryItem.cpp:
+        * history/HistoryItem.h:
+        * WebCore.exp.in:
+
+        * loader/icon/IconDatabaseBase.h:
+        (WebCore::IconDatabaseBase::defaultIcon):
+
+2011-03-14  Andy Estes  <aestes@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Timer-based events should inherit the user gesture state of their
+        originating event in certain cases.
+        https://bugs.webkit.org/show_bug.cgi?id=55104
+
+        If a timer is installed by a gesture-originated event and will fire
+        within one second, the timer-initiated event should behave as if it
+        were also initiated by a user gesture. Multi-shot timers should only
+        get this behavior on their first execution. Nested timers should not
+        get this behavior. This makes us compatible with Gecko when handling
+        popups and file chooser dialogs created from timer events.
+
+        Test: fast/events/popup-blocking-timers.html
+
+        * page/DOMTimer.cpp:
+        (WebCore::timeoutId): Create a helper function so that m_timeoutId can
+        be initialized in the data member initialization list.
+        (WebCore::shouldForwardUserGesture): Ditto, but for
+        m_shouldForwardUserGesture.
+        (WebCore::DOMTimer::DOMTimer): Move initialization of data members from
+        the ctor body to the data member initialization list. Also rename the
+        argument 'timeout' to 'interval'.
+        (WebCore::DOMTimer::fired): Create a UserGestureIndicator and set its
+        state based on the value of m_shouldForwardUserGesture.
+        (WebCore::DOMTimer::adjustMinimumTimerInterval): m_originalTimeout was
+        renamed to m_originalInterval.
+        * page/DOMTimer.h: Add m_shouldForwardUserGesture and rename
+        m_originalTimeout to m_originalInterval.
+
+2011-03-09  Levi Weintraub  <leviw@chromium.org>
+
+        Reviewed by Ryosuke Niwa.
+
+        Deleting content directly following a button inserts an unnecessary placeholder
+        https://bugs.webkit.org/show_bug.cgi?id=56053
+
+        Fixing a use of Node's enclosingBlockFlowElement with enclosingBlock htmlediting's
+        enclosingBlock, as enclosingBlockFlowElement would return inline-block elements despite
+        DeleteSelectionCommand treating them as blockflow.
+
+        Test: editing/deleting/delete-inserts-br-after-button.html
+
+        * editing/DeleteSelectionCommand.cpp:
+        (WebCore::DeleteSelectionCommand::mergeParagraphs):
+
+2011-03-14  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=45164
+
+        REGRESSION: <a><img align=top></a> Clickable area too large
+        
+        Make sure to clamp hit testing of quirky inline flow boxes the same way we already clamped
+        painting.
+
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::nodeAtPoint):
+
+2011-03-14  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Adam Roben.
+
+        REGRESSION (r75138-r75503): Animations on Apple HTML5 Gallery demo are wrong
+        https://bugs.webkit.org/show_bug.cgi?id=52845
+
+        The lastCommitTime() value in CACFLayerTreeHost was returning as the time
+        the render previous to this one happened. That often made it seem like
+        animations started more in the past than they did, breaking many animations.
+        The startAnimations() call actually fires from a CACF callback after all the
+        WebKit content has been rendered. So sending currentTime as the start time
+        to the animations is close enough for proper synchronization.
+
+        * platform/graphics/ca/win/CACFLayerTreeHost.cpp:
+        (WebCore::CACFLayerTreeHost::notifyAnimationsStarted):
+
+2011-03-11  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Tony Chang.
+
+        Selection uses first mousemove's localRect instead of that of mousedown
+        https://bugs.webkit.org/show_bug.cgi?id=56213
+
+        Fixed the bug by adding an extra call to updateSelectionForMouseDrag in handleMouseDraggedEvent
+        using the mouse coordinates of the mousedown event that started the drag.
+
+        Test: editing/selection/drag-select-rapidly.html
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::handleMouseDraggedEvent):
+
+2011-03-14  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Apply a large, blunt object directly to the skull of the Leopard build.
+
+        * Configurations/Base.xcconfig: Disable the generation of debugging symbols when
+        building the Debug configuration on Leopard. This should cut the size of the object
+        files that the linker needs to process by over 85%. This will hopefully allow them
+        to fit in to the 32-bit address space of the Leopard linker.
+
+2011-03-14  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        https://bugs.webkit.org/show_bug.cgi?id=56246
+        
+        Add support for relative positioning to table cells.   Back out the code that hacked around the lack of support
+        for offsetLeft, and add new tests to demonstrate that relative positioning works.
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::adjustRenderStyle):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::offsetParent):
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::isRelPositioned):
+        * rendering/RenderTableCell.h:
+        * rendering/style/RenderStyle.h:
+        * rendering/style/StyleRareNonInheritedData.cpp:
+        (WebCore::StyleRareNonInheritedData::StyleRareNonInheritedData):
+        (WebCore::StyleRareNonInheritedData::operator==):
+        * rendering/style/StyleRareNonInheritedData.h:
+
+2011-03-14  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        Partial backout of https://bugs.webkit.org/show_bug.cgi?id=56230.  Go back to repainting the root
+        layer, since first layouts and printing mess up otherwise.
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::layout):
+
+2011-03-11  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Clean up full repainting of layers during layout and at other times.  Platforms that did not do an invalidation on
+        size changes were incorrectly relying on the DoFullRepaint case of RenderLayer::updateLayerPositions to invalidate
+        for them. However this code is now wrong, since it assumed that the outermost layer was a RenderView that encompassed
+        all of the child layers.  This is no longer the case since the overflow changes that tightened up visual overflow
+        and limited that overflow only to content that the layer painted.
+        
+        Eliminate the DoFullRepaint flag and actually make no repainting of any kind happen from the layer code if FrameView's
+        m_doFullRepaint boolean is set.  This will flush out any ports that aren't just invalidating the world on their
+        own in response to view resizes or fixed layout size changes and force them to fix things to be consistent with
+        the other ports.
+        
+        Make the two dynamic calls to updateLayerPositions still do a full repaint by setting the repaint flag on the layer.
+        I'm suspicious as to the correctness of the repainting in both of these cases (both before and after this patch),
+        but the behavior should be the same.
+        
+        No new tests, since this is untestable on ports that invalidate on a resize.
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::layout):
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::styleDidChange):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::updateLayerPositions):
+        (WebCore::RenderLayer::removeOnlyThisLayer):
+        * rendering/RenderLayer.h:
+
+2011-03-11  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Ensure all values are correctly tagged in the registerfile
+        https://bugs.webkit.org/show_bug.cgi?id=56214
+
+        Make sure everything builds still.
+
+        * bridge/c/c_class.cpp:
+        * bridge/c/c_runtime.cpp:
+        * bridge/jni/JavaMethod.cpp:
+        * plugins/PluginViewNone.cpp:
+
+2011-03-14  Luiz Agostini  <luiz.agostini@openbossa.org>
+
+        Unreviewed build fix for r81035.
+
+        * html/HTMLDetailsElement.cpp:
+        (WebCore::HTMLDetailsElement::defaultEventHandler):
+        * rendering/RenderDetailsMarker.cpp:
+        (WebCore::createDownArrowPath):
+        (WebCore::createUpArrowPath):
+        (WebCore::createLeftArrowPath):
+        (WebCore::createRightArrowPath):
+
+2011-03-13  Jer Noble  <jer.noble@apple.com>
+
+        FullScreen: Handle entering full screen security restrictions
+        https://bugs.webkit.org/show_bug.cgi?id=56264
+
+        Tests: fullscreen/full-screen-iframe-allowed.html
+               fullscreen/full-screen-iframe-not-allowed.html
+
+        Disable full screen documents in the following conditions:
+        1) requesting element is in an iframe which does not have a
+        webkitallowfullscreen attribute.
+        2) page is not processing a user gesture.
+
+        * dom/Document.cpp:
+        (WebCore::Document::fullScreenIsAllowedForElement): Added.  Checks
+            to see if elements contained in IFRAMES are allowed to
+            enter full screen.
+        (WebCore::Document::webkitRequestFullScreenForElement): Checks
+            if page is currently processing a user gesture.
+        * dom/Document.h:
+        * html/HTMLAttributeNames.in: Added webkitallowfullscreenAttr.
+        * html/HTMLFrameElementBase.cpp:
+        (WebCore::HTMLFrameElementBase::allowFullScreen): Added.
+        * html/HTMLFrameElementBase.h:
+
+2011-03-14  Anton D'Auria  <adauria@apple.com>
+
+        Reviewed by David Levin.
+
+        REGRESSION(r80892): Use of uninitialized variable "m_syncCloseDatabase" in StorageAreaSync::sync
+        https://bugs.webkit.org/show_bug.cgi?id=56303
+
+        Initialized m_syncCloseDatabase to false in the StorageAreaSync constructor.
+
+        * storage/StorageAreaSync.cpp:
+        (WebCore::StorageAreaSync::StorageAreaSync):
+
+2011-03-14  Steve Block  <steveblock@google.com>
+
+        Reviewed by Oliver Hunt.
+
+        JavaMethod.cpp does not compile with V8
+        https://bugs.webkit.org/show_bug.cgi?id=56306
+
+        Moved the ScopeChain.h include to JavaStringJSC.
+
+        No new tests, build fix only.
+
+        * bridge/jni/JavaMethod.cpp:
+        * bridge/jni/jsc/JavaStringJSC.h
+
+2011-02-28  Luiz Agostini  <luiz.agostini@openbossa.org>
+
+        Reviewed by Dave Hyatt.
+
+        HTML5 <details> and <summary>: rendering
+        https://bugs.webkit.org/show_bug.cgi?id=51071
+
+        Tests: fast/html/details-add-summary-1-and-click.html
+               fast/html/details-add-summary-1.html
+               fast/html/details-add-summary-10-and-click.html
+               fast/html/details-add-summary-10.html
+               fast/html/details-add-summary-2-and-click.html
+               fast/html/details-add-summary-2.html
+               fast/html/details-add-summary-3-and-click.html
+               fast/html/details-add-summary-3.html
+               fast/html/details-add-summary-4-and-click.html
+               fast/html/details-add-summary-4.html
+               fast/html/details-add-summary-5-and-click.html
+               fast/html/details-add-summary-5.html
+               fast/html/details-add-summary-6-and-click.html
+               fast/html/details-add-summary-6.html
+               fast/html/details-add-summary-7-and-click.html
+               fast/html/details-add-summary-7.html
+               fast/html/details-add-summary-8-and-click.html
+               fast/html/details-add-summary-8.html
+               fast/html/details-add-summary-9-and-click.html
+               fast/html/details-add-summary-9.html
+               fast/html/details-mouse-click.html
+               fast/html/details-no-summary1.html
+               fast/html/details-no-summary2.html
+               fast/html/details-no-summary3.html
+               fast/html/details-no-summary4.html
+               fast/html/details-open-javascript.html
+               fast/html/details-open1.html
+               fast/html/details-open2.html
+               fast/html/details-open3.html
+               fast/html/details-open4.html
+               fast/html/details-open5.html
+               fast/html/details-open6.html
+               fast/html/details-position.html
+               fast/html/details-remove-summary-1-and-click.html
+               fast/html/details-remove-summary-1.html
+               fast/html/details-remove-summary-2-and-click.html
+               fast/html/details-remove-summary-2.html
+               fast/html/details-remove-summary-3-and-click.html
+               fast/html/details-remove-summary-3.html
+               fast/html/details-remove-summary-4-and-click.html
+               fast/html/details-remove-summary-4.html
+               fast/html/details-remove-summary-5-and-click.html
+               fast/html/details-remove-summary-5.html
+               fast/html/details-remove-summary-6-and-click.html
+               fast/html/details-remove-summary-6.html
+               fast/html/details-writing-mode.html
+
+        http://www.w3.org/TR/html5/interactive-elements.html#the-details-element
+
+        The main <summary> element is the first <summary> element of a <details> element.
+        All other childs of the <details> element are rendered only if the attribute 'open' is set.
+        Click event toggles the 'open' attribute.
+
+        * html/HTMLDetailsElement.cpp:
+        (WebCore::HTMLDetailsElement::HTMLDetailsElement):
+        (WebCore::HTMLDetailsElement::findMainSummary):
+        (WebCore::HTMLDetailsElement::childrenChanged):
+        (WebCore::HTMLDetailsElement::finishParsingChildren):
+        (WebCore::HTMLDetailsElement::parseMappedAttribute):
+        (WebCore::HTMLDetailsElement::childShouldCreateRenderer):
+        (WebCore::HTMLDetailsElement::defaultEventHandler):
+        * html/HTMLDetailsElement.h:
+        (WebCore::HTMLDetailsElement::mainSummary):
+
+        Method createRenderer added to class HTMLSummaryElement.
+
+        * html/HTMLSummaryElement.cpp:
+        (WebCore::HTMLSummaryElement::createRenderer):
+        * html/HTMLSummaryElement.h:
+
+        The first <summary> element is positioned at the top of its <details> parent.
+        The area occupied by this main <summary> element is the interactive area of the
+        <details> element. If the <details> tag has no <summary> child an OwnedSummaryRenderer
+        is created and added to the corresponding RenderDetails object.
+
+        * rendering/RenderDetails.cpp:
+        (WebCore::RenderDetails::RenderDetails):
+        (WebCore::RenderDetails::destroy):
+        (WebCore::RenderDetails::summaryBlock):
+        (WebCore::RenderDetails::contentBlock):
+        (WebCore::RenderDetails::addChild):
+        (WebCore::RenderDetails::removeChild):
+        (WebCore::RenderDetails::setMarkerStyle):
+        (WebCore::RenderDetails::styleDidChange):
+        (WebCore::RenderDetails::getRenderPosition):
+        (WebCore::RenderDetails::markerDestroyed):
+        (WebCore::RenderDetails::summaryDestroyed):
+        (WebCore::RenderDetails::moveSummaryToContents):
+        (WebCore::RenderDetails::createSummaryStyle):
+        (WebCore::RenderDetails::replaceMainSummary):
+        (WebCore::RenderDetails::createDefaultSummary):
+        (WebCore::RenderDetails::checkMainSummary):
+        (WebCore::RenderDetails::layout):
+        (WebCore::RenderDetails::isOpen):
+        (WebCore::RenderDetails::getParentOfFirstLineBox):
+        (WebCore::RenderDetails::firstNonMarkerChild):
+        (WebCore::RenderDetails::updateMarkerLocation):
+        * rendering/RenderDetails.h:
+        (WebCore::RenderDetails::interactiveArea):
+        (WebCore::RenderDetails::removeLeftoverAnonymousBlock):
+        (WebCore::RenderDetails::createsAnonymousWrapper):
+        (WebCore::RenderDetails::requiresForcedStyleRecalcPropagation):
+
+        A marker is added to the main <summary> element to indicate the current value of the 'open'
+        attribute of the <details> element.
+
+        * rendering/RenderDetailsMarker.cpp:
+        (WebCore::RenderDetailsMarker::RenderDetailsMarker):
+        (WebCore::RenderDetailsMarker::destroy):
+        (WebCore::RenderDetailsMarker::lineHeight):
+        (WebCore::RenderDetailsMarker::baselinePosition):
+        (WebCore::RenderDetailsMarker::computePreferredLogicalWidths):
+        (WebCore::RenderDetailsMarker::layout):
+        (WebCore::RenderDetailsMarker::getRelativeMarkerRect):
+        (WebCore::RenderDetailsMarker::isOpen):
+        (WebCore::createPath):
+        (WebCore::createDownArrowPath):
+        (WebCore::createUpArrowPath):
+        (WebCore::createLeftArrowPath):
+        (WebCore::createRightArrowPath):
+        (WebCore::RenderDetailsMarker::orientation):
+        (WebCore::RenderDetailsMarker::getCanonicalPath):
+        (WebCore::RenderDetailsMarker::getPath):
+        (WebCore::RenderDetailsMarker::paint):
+        * rendering/RenderDetailsMarker.h:
+        (WebCore::toRenderDetailsMarker):
+
+        * rendering/RenderSummary.cpp:
+        (WebCore::RenderSummary::RenderSummary):
+        (WebCore::RenderSummary::destroy):
+        (WebCore::RenderSummary::parentDetails):
+        (WebCore::RenderSummary::styleDidChange):
+        * rendering/RenderSummary.h:
+
+        * rendering/RenderTreeAsText.cpp:
+        (WebCore::RenderTreeAsText::writeRenderObject):
+
+2011-03-14  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=56296
+        Clean up IconDatabaseBase header.
+
+        -Get rid of the "PlatformString.h" include and replace it with a forward declaration.
+        -Group methods by which are used in WebCore directly and which are used in WebKit ports.
+
+        This'll make it easier to use in external frameworks (like WebKit2).
+
+        * loader/icon/IconDatabase.h:
+        * loader/icon/IconDatabaseBase.h:
+        (WebCore::IconDatabaseBase::retainIconForPageURL):
+        (WebCore::IconDatabaseBase::releaseIconForPageURL):
+        (WebCore::IconDatabaseBase::iconForPageURL):
+        (WebCore::IconDatabaseBase::setIconURLForPageURL):
+        (WebCore::IconDatabaseBase::setIconDataForIconURL):
+        (WebCore::IconDatabaseBase::iconDataKnownForIconURL):
+        (WebCore::IconDatabaseBase::loadDecisionForIconURL):
+        (WebCore::IconDatabaseBase::importIconURLForPageURL):
+        (WebCore::IconDatabaseBase::importIconDataForIconURL):
+        (WebCore::IconDatabaseBase::open):
+
+2011-03-14  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r81026.
+        http://trac.webkit.org/changeset/81026
+        https://bugs.webkit.org/show_bug.cgi?id=56313
+
+        Breaks gtk 64-bit tests (Requested by podivilov on #webkit).
+
+        * inspector/InspectorBrowserDebuggerAgent.cpp:
+        (WebCore::InspectorBrowserDebuggerAgent::InspectorBrowserDebuggerAgent):
+        (WebCore::InspectorBrowserDebuggerAgent::inspectedURLChanged):
+        (WebCore::InspectorBrowserDebuggerAgent::restoreStickyBreakpoint):
+        (WebCore::InspectorBrowserDebuggerAgent::setXHRBreakpoint):
+        (WebCore::InspectorBrowserDebuggerAgent::removeXHRBreakpoint):
+        (WebCore::InspectorBrowserDebuggerAgent::willSendXMLHttpRequest):
+        (WebCore::InspectorBrowserDebuggerAgent::clear):
+        * inspector/InspectorBrowserDebuggerAgent.h:
+        * inspector/front-end/BreakpointManager.js:
+        (WebInspector.BreakpointManager.prototype.createXHRBreakpoint):
+        (WebInspector.BreakpointManager.prototype._createXHRBreakpoint):
+        (WebInspector.BreakpointManager.prototype.breakpointViewForEventData):
+        (WebInspector.BreakpointManager.prototype._projectChanged):
+        (WebInspector.BreakpointManager.prototype._validateBreakpoints):
+        (WebInspector.BreakpointManager.prototype._createEventListenerBreakpointId):
+        (WebInspector.BreakpointManager.prototype._createXHRBreakpointId):
+        (WebInspector.XHRBreakpoint):
+        (WebInspector.XHRBreakpoint.prototype._enable):
+        (WebInspector.XHRBreakpoint.prototype._disable):
+        (WebInspector.XHRBreakpoint.prototype._serializeToJSON):
+        (WebInspector.XHRBreakpointView):
+        (WebInspector.XHRBreakpointView.prototype.compareTo):
+        (WebInspector.XHRBreakpointView.prototype.populateEditElement):
+        (WebInspector.XHRBreakpointView.prototype.populateLabelElement):
+        (WebInspector.XHRBreakpointView.prototype.populateStatusMessageElement):
+        * inspector/front-end/BreakpointsSidebarPane.js:
+        (WebInspector.XHRBreakpointsSidebarPane.addButtonClicked):
+        (WebInspector.XHRBreakpointsSidebarPane):
+        (WebInspector.XHRBreakpointsSidebarPane.prototype.addBreakpointItem):
+        (WebInspector.XHRBreakpointsSidebarPane.prototype._startEditingBreakpoint):
+        (WebInspector.XHRBreakpointsSidebarPane.prototype._hideEditBreakpointDialog):
+        * inspector/front-end/CallStackSidebarPane.js:
+        (WebInspector.CallStackSidebarPane.prototype.update):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel):
+        (WebInspector.ScriptsPanel.prototype._debuggerPaused):
+        (WebInspector.ScriptsPanel.prototype._clearInterface):
+        * inspector/front-end/Settings.js:
+        (WebInspector.Settings):
+        * inspector/front-end/inspector.js:
+        (WebInspector.resetFocusElement):
+        (WebInspector.createXHRBreakpointsSidebarPane.breakpointAdded):
+        (WebInspector.createXHRBreakpointsSidebarPane):
+        (WebInspector.set attached):
+
+2011-03-14  Mikhail Naganov  <mnaganov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: Factor out binary search algo from the insertionIndexForObjectInListSortedByFunction function.
+        https://bugs.webkit.org/show_bug.cgi?id=56312
+
+        Test: inspector/utilities.html
+
+        * inspector/front-end/utilities.js:
+
+2011-03-12  Pavel Podivilov  <podivilov@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: re-implement xhr breakpoints.
+        https://bugs.webkit.org/show_bug.cgi?id=56252
+
+        - restore xhr breakpoints one by one instead of using setAllBrowserBreakpoints
+        - store xhr breakpoints in a separate setting
+        - move presentation-related code from BreakpointManager to XHRBreakpointsSidebarPane
+
+        Test: inspector/debugger/xhr-breakpoints.html
+
+        * inspector/InspectorBrowserDebuggerAgent.cpp:
+        (WebCore::InspectorBrowserDebuggerAgent::InspectorBrowserDebuggerAgent):
+        (WebCore::InspectorBrowserDebuggerAgent::inspectedURLChanged):
+        (WebCore::InspectorBrowserDebuggerAgent::restoreStickyBreakpoint):
+        (WebCore::InspectorBrowserDebuggerAgent::setXHRBreakpoint):
+        (WebCore::InspectorBrowserDebuggerAgent::removeXHRBreakpoint):
+        (WebCore::InspectorBrowserDebuggerAgent::willSendXMLHttpRequest):
+        (WebCore::InspectorBrowserDebuggerAgent::clear):
+        * inspector/InspectorBrowserDebuggerAgent.h:
+        * inspector/front-end/BreakpointManager.js:
+        (WebInspector.BreakpointManager.prototype.setXHRBreakpoint):
+        (WebInspector.BreakpointManager.prototype.removeXHRBreakpoint):
+        (WebInspector.BreakpointManager.prototype.breakpointViewForEventData):
+        (WebInspector.BreakpointManager.prototype._projectChanged):
+        (WebInspector.BreakpointManager.prototype._validateBreakpoints):
+        (WebInspector.BreakpointManager.prototype._createEventListenerBreakpointId):
+        * inspector/front-end/BreakpointsSidebarPane.js:
+        (WebInspector.XHRBreakpointsSidebarPane):
+        (WebInspector.XHRBreakpointsSidebarPane.prototype._addButtonClicked.finishEditing):
+        (WebInspector.XHRBreakpointsSidebarPane.prototype._addButtonClicked):
+        (WebInspector.XHRBreakpointsSidebarPane.prototype._setBreakpoint):
+        (WebInspector.XHRBreakpointsSidebarPane.prototype._removeBreakpoint):
+        (WebInspector.XHRBreakpointsSidebarPane.prototype._contextMenu.removeBreakpoint):
+        (WebInspector.XHRBreakpointsSidebarPane.prototype._contextMenu):
+        (WebInspector.XHRBreakpointsSidebarPane.prototype._checkboxClicked):
+        (WebInspector.XHRBreakpointsSidebarPane.prototype._labelClicked.finishEditing):
+        (WebInspector.XHRBreakpointsSidebarPane.prototype._labelClicked):
+        (WebInspector.XHRBreakpointsSidebarPane.prototype.highlightBreakpoint):
+        (WebInspector.XHRBreakpointsSidebarPane.prototype.clearBreakpointHighlight):
+        (WebInspector.XHRBreakpointsSidebarPane.prototype._saveBreakpoints):
+        (WebInspector.XHRBreakpointsSidebarPane.prototype._restoreBreakpoints):
+        (WebInspector.XHRBreakpointsSidebarPane.prototype._projectChanged):
+        * inspector/front-end/CallStackSidebarPane.js:
+        (WebInspector.CallStackSidebarPane.prototype.update):
+        (WebInspector.CallStackSidebarPane.prototype._xhrBreakpointHit):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel):
+        (WebInspector.ScriptsPanel.prototype._debuggerPaused):
+        (WebInspector.ScriptsPanel.prototype._clearInterface):
+        * inspector/front-end/Settings.js:
+        (WebInspector.Settings):
+        * inspector/front-end/inspector.js:
+        (WebInspector.resetFocusElement):
+        (WebInspector.set attached):
+
+2011-03-14  Pavel Podivilov  <podivilov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: move breakpoints restoring to debugger presentation model.
+        https://bugs.webkit.org/show_bug.cgi?id=56123
+
+        DebuggerModel's "breakpoint-added" and "breakpoint-removed" events are gone since
+        setBreakpoint/removeBreakpoint are now called from DPM only.
+
+        * inspector/InspectorDebuggerAgent.cpp:
+        (WebCore::InspectorDebuggerAgent::disable):
+        (WebCore::InspectorDebuggerAgent::enableDebuggerAfterShown):
+        * inspector/front-end/DebuggerModel.js:
+        (WebInspector.DebuggerModel.prototype.enableDebugger):
+        (WebInspector.DebuggerModel.prototype._debuggerWasEnabled):
+        (WebInspector.DebuggerModel.prototype._debuggerWasDisabled):
+        (WebInspector.DebuggerModel.prototype.setBreakpoint.didSetBreakpoint):
+        (WebInspector.DebuggerModel.prototype.setBreakpoint):
+        (WebInspector.DebuggerModel.prototype.setBreakpointBySourceId):
+        (WebInspector.DebuggerModel.prototype.removeBreakpoint):
+        (WebInspector.DebuggerModel.prototype._breakpointResolved):
+        (WebInspector.DebuggerModel.prototype.reset):
+        (WebInspector.DebuggerDispatcher.prototype.debuggerWasEnabled):
+        (WebInspector.DebuggerDispatcher.prototype.debuggerWasDisabled):
+        * inspector/front-end/DebuggerPresentationModel.js:
+        (WebInspector.DebuggerPresentationModel):
+        (WebInspector.DebuggerPresentationModel.prototype._debuggerWasEnabled):
+        (WebInspector.DebuggerPresentationModel.prototype._parsedScriptSource):
+        (WebInspector.DebuggerPresentationModel.prototype._failedToParseScriptSource):
+        (WebInspector.DebuggerPresentationModel.prototype._scriptSourceChanged):
+        (WebInspector.DebuggerPresentationModel.prototype.breakpointsForSourceFileId):
+        (WebInspector.DebuggerPresentationModel.prototype.setBreakpoint):
+        (WebInspector.DebuggerPresentationModel.prototype.setBreakpointEnabled):
+        (WebInspector.DebuggerPresentationModel.prototype.updateBreakpoint):
+        (WebInspector.DebuggerPresentationModel.prototype.removeBreakpoint):
+        (WebInspector.DebuggerPresentationModel.prototype.findBreakpoint):
+        (WebInspector.DebuggerPresentationModel.prototype._breakpointAdded):
+        (WebInspector.DebuggerPresentationModel.prototype._breakpointRemoved):
+        (WebInspector.DebuggerPresentationModel.prototype._breakpointResolved):
+        (WebInspector.DebuggerPresentationModel.prototype._restoreBreakpoints):
+        (WebInspector.DebuggerPresentationModel.prototype._saveBreakpoints):
+        (WebInspector.DebuggerPresentationModel.prototype.reset):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel):
+        (WebInspector.ScriptsPanel.prototype._debuggerWasEnabled):
+        (WebInspector.ScriptsPanel.prototype._debuggerWasDisabled):
+
+2011-03-14  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r81015.
+        http://trac.webkit.org/changeset/81015
+        https://bugs.webkit.org/show_bug.cgi?id=56308
+
+        A Similar patch landed in r76960 (Requested by philn-tp on
+        #webkit).
+
+        * GNUmakefile.am:
+
+2011-03-14  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: don't use innerText, use textContent instead.
+        https://bugs.webkit.org/show_bug.cgi?id=56307
+
+        * inspector/front-end/AuditFormatters.js:
+        (WebInspector.AuditFormatters.snippet):
+        * inspector/front-end/ElementsTreeOutline.js:
+        * inspector/front-end/GoToLineDialog.js:
+        * inspector/front-end/HelpScreen.js:
+        (WebInspector.HelpScreen):
+        * inspector/front-end/ShortcutsHelp.js:
+        (WebInspector.ShortcutsSection.prototype.renderSection):
+        (WebInspector.ShortcutsSection.prototype._renderHeader):
+
+2011-03-14  Andrey Adaikin  <aandrey@google.com>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: [Text editor] Disable live-edit in favor of the text editor
+        https://bugs.webkit.org/show_bug.cgi?id=56176
+
+        * inspector/front-end/Settings.js:
+
+2011-03-14  Andrey Adaikin  <aandrey@google.com>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: [REGRESSION] scroll does not work in source frame when mouse is inside the gutter
+        https://bugs.webkit.org/show_bug.cgi?id=56095
+
+        * inspector/front-end/TextViewer.js:
+        (WebInspector.TextViewer):
+
+2011-03-11  Pavel Podivilov  <podivilov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: move breakpoints restoring after live edit to debugger presentation model.
+        https://bugs.webkit.org/show_bug.cgi?id=56179
+
+        Presentation model should move breakpoints based on text diff as required by "revert to revision" action in resources panel.
+
+        * inspector/front-end/DebuggerModel.js:
+        (WebInspector.DebuggerModel):
+        (WebInspector.DebuggerModel.prototype.setBreakpoint.didSetBreakpoint):
+        (WebInspector.DebuggerModel.prototype.setBreakpoint):
+        (WebInspector.DebuggerModel.prototype.reset):
+        (WebInspector.DebuggerModel.prototype.editScriptSource.didEditScriptSource):
+        (WebInspector.DebuggerModel.prototype.editScriptSource):
+        (WebInspector.DebuggerModel.prototype.get callFrames):
+        (WebInspector.DebuggerModel.prototype._pausedScript):
+        (WebInspector.DebuggerModel.prototype._resumedScript):
+        * inspector/front-end/DebuggerPresentationModel.js:
+        (WebInspector.DebuggerPresentationModel):
+        (WebInspector.DebuggerPresentationModel.prototype._scriptSourceChanged):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype._scriptSourceChanged):
+
+2011-03-10  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: Optimize backend-frontend data transfer volume for CSS styles
+        https://bugs.webkit.org/show_bug.cgi?id=56111
+
+        This change reduces the getStylesForNode() payload more than twice for BODY elements.
+
+        * inspector/InspectorStyleSheet.cpp:
+        (WebCore::InspectorStyle::populateObjectWithStyleProperties):
+        * inspector/front-end/CSSStyleModel.js:
+        (WebInspector.CSSProperty.parsePayload):
+
+2011-03-14  John Knottenbelt  <jknotten@chromium.org>
+
+        Reviewed by Steve Block.
+
+        Detach Geolocation from Frame when Page destroyed.
+        https://bugs.webkit.org/show_bug.cgi?id=52877
+
+        On Page destruction, any outstanding Geolocation permission
+        requests should be cancelled, because the Geolocation can only
+        access the client indirectly via m_frame->page().
+
+        Page destruction is signalled by a call to the
+        Frame::pageDestroyed() method. This explictly calls
+        DOMWindow::resetGeolocation which ultimately calls Geolocation::reset.
+
+        Geolocation::reset() detaches from the GeolocationController,
+        cancels requests, watches and single shots, and sets the
+        permission state back to Unknown.
+
+        Frame::pageDestroyed() is also called by FrameLoader even though
+        the page is not destroyed. We should still cancel permission
+        requests, because the GeolocationClient will become inaccessible
+        to the Geolocation object after this call.
+
+        Frame::transferChildFrameToNewDocument also indirectly calls
+        Geolocation::reset when the frame is reparented between
+        pages. Ideally we would like the Geolocation's activities to
+        continue after reparenting, see bug
+        https://bugs.webkit.org/show_bug.cgi?id=55577
+
+        Since GeolocationController is owned by Page, and all Geolocation
+        objects will now unsubscribe from the GeolocationController on
+        pageDetached(), we no longer need to call stopUpdating() from the
+        GeolocationController's destructor. Instead we can simply assert
+        that there should be no no observers. See related bug
+        https://bugs.webkit.org/show_bug.cgi?id=52216 .
+
+        Introduced new method 'numberOfPendingPermissionRequests' on
+        GeolocationClientMock to count the number of outstanding pending
+        permission requests. This provides a reusable implementation for
+        client-based implementations of the LayoutTestController's
+        numberOfPendingGeolocationPermissionRequests method.
+
+        Test: fast/dom/Geolocation/page-reload-cancel-permission-requests.html
+
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::resetGeolocation):
+        * page/DOMWindow.h:
+        * page/Frame.cpp:
+        (WebCore::Frame::pageDestroyed):
+        (WebCore::Frame::transferChildFrameToNewDocument):
+        * page/Geolocation.cpp:
+        (WebCore::Geolocation::~Geolocation):
+        (WebCore::Geolocation::page):
+        (WebCore::Geolocation::reset):
+        (WebCore::Geolocation::disconnectFrame):
+        (WebCore::Geolocation::lastPosition):
+        (WebCore::Geolocation::requestPermission):
+        (WebCore::Geolocation::startUpdating):
+        (WebCore::Geolocation::stopUpdating):
+        * page/Geolocation.h:
+        * page/GeolocationController.cpp:
+        (WebCore::GeolocationController::~GeolocationController):
+        * page/Navigator.cpp:
+        (WebCore::Navigator::resetGeolocation):
+        * page/Navigator.h:
+        * platform/mock/GeolocationClientMock.cpp:
+        (WebCore::GeolocationClientMock::numberOfPendingPermissionRequests):
+        * platform/mock/GeolocationClientMock.h:
+
+2011-03-14  Andrey Adaikin  <aandrey@google.com>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: REGRESSION: Messed up with the tabIndex for text editor
+        https://bugs.webkit.org/show_bug.cgi?id=56183
+
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype._handleKeyDown):
+        (WebInspector.SourceFrame.prototype._handleSave):
+        (WebInspector.SourceFrame.prototype._handleRevertEditing):
+        * inspector/front-end/TextViewer.js:
+        (WebInspector.TextEditorMainPanel):
+        (WebInspector.TextEditorMainPanel.prototype.set readOnly):
+
+2011-03-14  Chris Rogers  <crogers@google.com>
+
+        Reviewed by Xan Lopez.
+
+        Add all web audio auto-generated files to GTK make system
+        https://bugs.webkit.org/show_bug.cgi?id=50497
+
+        No new tests since these are build-system tweaks.
+
+        * GNUmakefile.am:
+
+2011-03-14  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: make DOMAgent event target, remove dependency from ElementsPanel.
+        https://bugs.webkit.org/show_bug.cgi?id=56268
+
+        * inspector/Inspector.idl:
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::reset):
+        (WebCore::InspectorDOMAgent::performSearch):
+        (WebCore::InspectorDOMAgent::cancelSearch):
+        (WebCore::InspectorDOMAgent::onMatchJobsTimer):
+        (WebCore::InspectorDOMAgent::reportNodesAsSearchResults):
+        * inspector/InspectorDOMAgent.h:
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.DOMAgent.prototype.requestDocument.mycallback):
+        (WebInspector.DOMAgent.prototype.requestDocument):
+        (WebInspector.DOMAgent.prototype._attributesUpdated):
+        (WebInspector.DOMAgent.prototype._characterDataModified):
+        (WebInspector.DOMAgent.prototype._documentUpdated):
+        (WebInspector.DOMAgent.prototype._setDocument):
+        (WebInspector.DOMAgent.prototype._childNodeCountUpdated):
+        (WebInspector.DOMAgent.prototype._childNodeInserted):
+        (WebInspector.DOMAgent.prototype._childNodeRemoved):
+        (WebInspector.DOMAgent.prototype._removeBreakpoints):
+        (WebInspector.DOMAgent.prototype.performSearch):
+        (WebInspector.DOMAgent.prototype.cancelSearch):
+        (WebInspector.DOMDispatcher.prototype.searchResults):
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel):
+        (WebInspector.ElementsPanel.prototype._reset):
+        (WebInspector.ElementsPanel.prototype._documentUpdated):
+        (WebInspector.ElementsPanel.prototype.searchCanceled):
+        (WebInspector.ElementsPanel.prototype.performSearch):
+        (WebInspector.ElementsPanel.prototype._addNodesToSearchResult):
+        (WebInspector.ElementsPanel.prototype._attributesUpdated):
+        (WebInspector.ElementsPanel.prototype._characterDataModified):
+        (WebInspector.ElementsPanel.prototype._nodeInserted):
+        (WebInspector.ElementsPanel.prototype._nodeRemoved):
+        (WebInspector.ElementsPanel.prototype._childNodeCountUpdated):
+        (WebInspector.ElementsPanel.prototype.updateModifiedNodes):
+
+2011-03-14  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: add tests for edit dom operations.
+        https://bugs.webkit.org/show_bug.cgi?id=56248
+
+        Test: inspector/elements/edit-dom-actions.html
+
+        * inspector/Inspector.idl:
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::assertNode):
+        (WebCore::InspectorDOMAgent::assertElement):
+        (WebCore::InspectorDOMAgent::assertHTMLElement):
+        (WebCore::InspectorDOMAgent::nodeToSelectOn):
+        (WebCore::InspectorDOMAgent::querySelector):
+        (WebCore::InspectorDOMAgent::querySelectorAll):
+        (WebCore::InspectorDOMAgent::setAttribute):
+        (WebCore::InspectorDOMAgent::removeAttribute):
+        (WebCore::InspectorDOMAgent::getOuterHTML):
+        (WebCore::InspectorDOMAgent::setOuterHTML):
+        * inspector/InspectorDOMAgent.h:
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.DOMNode.prototype.setAttribute):
+        (WebInspector.DOMNode.prototype.removeAttribute):
+        * inspector/front-end/inspector.js:
+        (WebInspector.startEditing.defaultFinishHandler):
+
+2011-03-14  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        <rdar://problem/8762095> and https://bugs.webkit.org/show_bug.cgi?id=55172
+        Need WK2 API to view/manage origins with LocalStorage
+
+        * storage/StorageTracker.cpp:
+        (WebCore::StorageTracker::initializeTracker): Make sure the TextEncoding map is initialized on the main thread
+          before the StorageTracker thread can do it on the background thread.
+
+2011-03-13  Anton D'Auria  <adauria@apple.com>
+
+        Reviewed by Brady Eidson and David Levin, landed by Brady Eidson.
+
+        Fixed lock-taking order to prevent deadlock, added lock for m_client,
+        removed premature return in syncImportOriginIdentifiers when tracker
+        db does not exist because that prevented syncFileSystemAndTrackerDatabase()
+        from running until next LocalStorage db creation, cleaned up
+        StorageTracker::scheduleTask() code for readability.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=56285
+        
+        * storage/StorageTracker.cpp:
+        (WebCore::StorageTracker::trackerDatabasePath):
+        (WebCore::StorageTracker::syncImportOriginIdentifiers): If tracker db isn't
+        optionally opened (as in the case when it doesn't exist on disk), don't
+        exit early and call syncFileSystemAndTrackerDatabase(), which will create
+        a tracker db if localstorage db files are found on disk by calling setOriginDetails.
+        (WebCore::StorageTracker::syncFileSystemAndTrackerDatabase):
+        (WebCore::StorageTracker::setOriginDetails):
+        (WebCore::StorageTracker::scheduleTask): readability changes.
+        (WebCore::StorageTracker::syncSetOriginDetails):
+        (WebCore::StorageTracker::syncDeleteAllOrigins):
+        (WebCore::StorageTracker::syncDeleteOrigin):
+        (WebCore::StorageTracker::cancelDeletingOrigin): order lock-taking consistently to avoid deadlock.
+        (WebCore::StorageTracker::setClient):
+        * storage/StorageTracker.h:
+
+2011-03-13  Anton D'Auria  <adauria@apple.com>
+
+        Reviewed and landed by Brady Eidson.
+
+        Invalid assertion in StorageTracker - PageGroup::numberOfPageGroups() == 1
+        https://bugs.webkit.org/show_bug.cgi?id=56240
+
+        This assertion is invalid until LocalStorage is either global or is isolated by PageGroup.
+
+        * storage/StorageTracker.cpp:
+        (WebCore::StorageTracker::origins):
+        (WebCore::StorageTracker::deleteAllOrigins):
+        (WebCore::StorageTracker::deleteOrigin):
+
+2011-03-13  Pratik Solanki  <psolanki@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Make adjustMIMETypeIfNecessary use CFNetwork directly
+        https://bugs.webkit.org/show_bug.cgi?id=55912
+
+        Follow up fix for Layout Test failure. Fix typo - it should be text/plain, not test/plain.
+
+        * platform/network/mac/WebCoreURLResponse.mm:
+        (WebCore::adjustMIMETypeIfNecessary):
+
+2011-03-13  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Include hyphenation information in text representation of render tree
+        https://bugs.webkit.org/show_bug.cgi?id=56287
+
+        (WebCore::writeTextRun): If the text box is hyphenated, output the hyphenation
+        string.
+
+2011-03-13  David Levin  <levin@chromium.org>
+
+        Improve my hasitly added build fix and added a bug https://bugs.webkit.org/show_bug.cgi?id=56288
+        above addressing this FIXME.
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty):
+
+2011-03-13  David Levin  <levin@chromium.org>
+
+        Build fix adding remaining enum values to switch statement.
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty):
+
+2011-03-13  Sam Weinig  <sam@webkit.org>
+
+        Fix windows build.
+
+        * platform/network/cf/ResourceErrorCF.cpp:
+        (WebCore::ResourceError::ResourceError):
+        Add missing constructor.
+
+2011-03-13  David Sosby  <dsosby@rim.com>
+
+        Reviewed by Dan Bernstein.
+
+        REGRESSION: Soft hyphen is not always rendered
+        https://bugs.webkit.org/show_bug.cgi?id=56017
+        
+        The check to flag a text block as hyphenated was only
+        occurring at break points in the line. If no break points
+        were found after the soft hyphen then the line would not
+        be flagged hyphenated. Adding a check for soft hyphen at
+        the end of the text run resolves the issue.
+
+        Test: fast/text/soft-hyphen-4.html
+
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::findNextLineBreak):
+
+2011-03-13  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        REGRESSION (r80438): fast/text/hyphenate-character failing in pixel mode
+        https://bugs.webkit.org/show_bug.cgi?id=56280
+
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::tryHyphenating): Avoid subtracting 1 from an unsigned 0.
+
+2011-03-13  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Add ability to create a WKErrorRef
+        <rdar://problem/9115768>
+        https://bugs.webkit.org/show_bug.cgi?id=56279
+
+        * WebCore.exp.in:
+        Add new exports.
+
+        * platform/network/cf/ResourceError.h:
+        * platform/network/cf/ResourceErrorCF.cpp:
+        (WebCore::ResourceError::platformCompare):
+        (WebCore::ResourceError::cfError):
+        (WebCore::ResourceError::operator CFErrorRef):
+        (WebCore::ResourceError::ResourceError):
+        (WebCore::ResourceError::cfStreamError):
+        (WebCore::ResourceError::operator CFStreamError):
+        * platform/network/mac/ResourceErrorMac.mm:
+        (WebCore::ResourceError::ResourceError):
+        (WebCore::ResourceError::platformCompare):
+        (WebCore::ResourceError::nsError):
+        (WebCore::ResourceError::operator NSError *):
+        (WebCore::ResourceError::cfError):
+        (WebCore::ResourceError::operator CFErrorRef):
+        Clean up ResourceError a bit and add ability to create a ResourceError from a CFErrorRef
+        regardless of whether CFNetwork is being used.
+
+2011-03-13  Pratik Solanki  <psolanki@apple.com>
+
+        Reviewed by Brady Eidson.
+
+        Make adjustMIMETypeIfNecessary use CFNetwork directly
+        https://bugs.webkit.org/show_bug.cgi?id=55912
+
+        Convert category method [NSURLResponse adjustMIMETypeIfNecessary] to C function
+        WebCore::adjustMIMETypeIfNecessary() that takes a CFURLResponseRef and is functionally
+        identical.
+
+        Testing is covered by existing LayoutTests.
+
+        * WebCore.exp.in:
+        * platform/mac/WebCoreSystemInterface.h:
+        * platform/mac/WebCoreSystemInterface.mm:
+        * platform/network/mac/ResourceHandleMac.mm:
+        (-[WebCoreResourceHandleAsDelegate connection:didReceiveResponse:]):
+        * platform/network/mac/WebCoreURLResponse.h:
+        * platform/network/mac/WebCoreURLResponse.mm:
+        (WebCore::createBinaryExtensionsSet):
+        (WebCore::createExtensionToMIMETypeMap):
+        (WebCore::mimeTypeFromUTITree):
+        (WebCore::adjustMIMETypeIfNecessary):
+
+2011-03-13  Jeremy Moskovich  <jeremy@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Update comment in CSSValueKeywords.in
+        https://bugs.webkit.org/show_bug.cgi?id=56266
+
+        The enums the comment refers to were moved from RenderStyle.h to RenderStyleConstants.h
+        in r36579 but it appears that the comment in CSSValueKeywords.in wasn't updated.
+
+        No tests - just updating a comment.
+
+        * css/CSSValueKeywords.in:
+
+2011-03-13  Anton D'Auria  <adauria@apple.com>
+
+        Reviewed by Alice Liu.
+
+        StorageTracker constructor shouldn't have initialization code and isMainThread() assertion
+        https://bugs.webkit.org/show_bug.cgi?id=56259
+
+        Move all StorageTracker initialization to
+        StorageTracker::initializeTracker. This also removes the
+        requirement that the StorageTracker constructor isn't run
+        on the main thread.
+
+        * storage/StorageTracker.cpp:
+        (WebCore::StorageTracker::initializeTracker):
+        (WebCore::StorageTracker::tracker):
+        (WebCore::StorageTracker::StorageTracker):
+
+2011-03-13  Rob Buis  <rwlbuis@gmail.com>
+
+        Reviewed by Dave Hyatt.
+
+        REGRESSION (r61383): Navigation menu laid out incorrectly on aboardtheworld.com
+        https://bugs.webkit.org/show_bug.cgi?id=53470
+
+        Prefer !important over normal properties when dealing with duplicate properties in style rules.
+
+        Test: fast/css/duplicate-property-in-rule-important.html
+
+        * css/CSSMutableStyleDeclaration.cpp:
+        (WebCore::CSSMutableStyleDeclaration::CSSMutableStyleDeclaration):
+
+2011-03-12  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r80895.
+        http://trac.webkit.org/changeset/80895
+        https://bugs.webkit.org/show_bug.cgi?id=56261
+
+        Causing crashes in several tests including
+        t1202-counters-16-c.html (see
+        http://build.webkit.org/results/SnowLeopard%20Intel%20Leaks/r80956%20(15528)/results.html)
+        (Requested by dave_levin on #webkit).
+
+        * rendering/CounterNode.cpp:
+        (WebCore::CounterNode::CounterNode):
+        (WebCore::CounterNode::create):
+        (WebCore::CounterNode::resetRenderer):
+        (WebCore::CounterNode::resetRenderers):
+        (WebCore::CounterNode::recount):
+        (WebCore::CounterNode::insertAfter):
+        (WebCore::CounterNode::removeChild):
+        (WebCore::showTreeAndMark):
+        * rendering/CounterNode.h:
+        (WebCore::CounterNode::renderer):
+        * rendering/RenderCounter.cpp:
+        (WebCore::findPlaceForCounter):
+        (WebCore::RenderCounter::~RenderCounter):
+        (WebCore::RenderCounter::originalText):
+        (WebCore::RenderCounter::invalidate):
+        (WebCore::destroyCounterNodeWithoutMapRemoval):
+        (WebCore::RenderCounter::destroyCounterNodes):
+        (WebCore::RenderCounter::destroyCounterNode):
+        (WebCore::updateCounters):
+        (showCounterRendererTree):
+        * rendering/RenderCounter.h:
+        * rendering/RenderObjectChildList.cpp:
+        (WebCore::invalidateCountersInContainer):
+        (WebCore::RenderObjectChildList::invalidateCounters):
+        * rendering/RenderObjectChildList.h:
+
+2011-03-12  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        REGRESSION (r76474): IntegerArray hash hashes only 1/4 of the array
+        https://bugs.webkit.org/show_bug.cgi?id=56258
+
+        No tests because the wrong hashing is mostly harmless. The only symptom
+        we have seen is an occasional assertion in debug builds about the size
+        not being a multiple of two. But a worse hash is worse for performance too.
+
+        * platform/cf/BinaryPropertyList.cpp:
+        (WebCore::IntegerArrayHash::hash): Pass in the size in bytes rather
+        than the number of array entries.
+
+2011-03-12  Cameron Zwarich  <zwarich@apple.com>
+
+        Not reviewed.
+
+        Fix the build with newer GCCs and remove some extra whitespae.
+
+        * bindings/js/SerializedScriptValue.cpp:
+        (WebCore::uint8_t):
+
+2011-03-12  Cameron Zwarich  <zwarich@apple.com>
+
+        Rubber-stamped by Oliver Hunt.
+
+        Removed unused ARMv5 code. The ARMv5 case now falls under the general
+        unaligned accessed case.
+
+        * bindings/js/SerializedScriptValue.cpp:
+        (WebCore::CloneDeserializer::readLittleEndian):
+        (WebCore::CloneDeserializer::readString):
+
+2011-03-12  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        WebCore fails to build with Clang on ARM
+        https://bugs.webkit.org/show_bug.cgi?id=56257
+
+        Add an explicit instantiation of writeLittleEndian for uint8_t and move it to
+        namespace scope, since explicit specializations are not allowed at class scope.
+
+        * bindings/js/SerializedScriptValue.cpp:
+        (WebCore::writeLittleEndian):
+
+2011-03-11  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Dragging image to desktop gives webloc instead of image file in WebKit2
+        https://bugs.webkit.org/show_bug.cgi?id=56193
+
+        * WebCore.exp.in: Added some additional exports. Re-sorted.
+
+2011-03-12  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r80919.
+        http://trac.webkit.org/changeset/80919
+        https://bugs.webkit.org/show_bug.cgi?id=56251
+
+        all windows bots failed to compile this change (Requested by
+        loislo on #webkit).
+
+        * bridge/c/c_class.cpp:
+        * bridge/c/c_runtime.cpp:
+        * bridge/jni/JavaMethod.cpp:
+        * plugins/PluginViewNone.cpp:
+
+2011-03-12  Patrick Gansterer  <paroga@webkit.org>
+
+        Unreviewed WinCE build fix for r80900.
+
+        * CMakeListsWinCE.txt: Removed IconDatabaseNone.cpp.
+
+2011-03-12  Andras Becsi  <abecsi@webkit.org>
+
+        Unreviewed typo fix.
+
+        No new tests needed.
+
+        * WebCore.pro: Fix typo in header name.
+
+2011-03-12  Pavel Feldman  <pfeldman@chromium.org>
+
+        Not reviewed: Inspect Element action regression fix.
+
+        * inspector/front-end/inspector.js:
+        (WebInspector.inspect):
+
+2011-03-12  Ilya Tikhonovsky  <loislo@chromium.org>
+
+        Unreviewed. One line fix for inspector/dom-breakpoints.html
+
+        * inspector/front-end/BreakpointManager.js:
+        (WebInspector.DOMBreakpointView.prototype.populateStatusMessageElement.decorateNode):
+
+2011-03-12  Ilya Tikhonovsky  <loislo@chromium.org>
+
+        Unreviewed build fix.
+
+        Almost all inspector tests are crashing after r80928.
+
+        * inspector/front-end/inspector.js:
+
+2011-03-11  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: follow up to error reporting, fixing multiple regressions.
+        https://bugs.webkit.org/show_bug.cgi?id=56243
+
+        * inspector/InjectedScript.cpp:
+        (WebCore::InjectedScript::setPropertyValue):
+        * inspector/InjectedScript.h:
+        * inspector/Inspector.idl:
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::getChildNodes):
+        (WebCore::InspectorDOMAgent::getOuterHTML):
+        (WebCore::InspectorDOMAgent::getEventListenersForNode):
+        * inspector/InspectorDOMAgent.h:
+        * inspector/InspectorRuntimeAgent.cpp:
+        (WebCore::InspectorRuntimeAgent::setPropertyValue):
+        * inspector/InspectorRuntimeAgent.h:
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.DOMNode.prototype.setNodeName):
+        (WebInspector.DOMNode.prototype.setNodeValue):
+        (WebInspector.DOMNode.prototype.getChildNodes):
+        (WebInspector.DOMNode.prototype.getOuterHTML):
+        (WebInspector.DOMNode.prototype.setOuterHTML):
+        (WebInspector.DOMNode.prototype.removeNode):
+        (WebInspector.DOMNode.prototype.copyNode):
+        (WebInspector.DOMAgent.prototype.pushNodeToFrontend):
+        (WebInspector.DOMAgent.prototype.pushNodeByPathToFrontend):
+        (WebInspector.EventListeners.getEventListenersForNode):
+        * inspector/front-end/DOMStorage.js:
+        (WebInspector.DOMStorage.prototype.getEntries):
+        (WebInspector.DOMStorage.prototype.setItem):
+        (WebInspector.DOMStorage.prototype.removeItem):
+        * inspector/front-end/DOMStorageItemsView.js:
+        (WebInspector.DOMStorageItemsView.prototype.update):
+        (WebInspector.DOMStorageItemsView.prototype._showDOMStorageEntries):
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeElement.prototype._createTooltipForNode.setTooltip):
+        (WebInspector.ElementsTreeElement.prototype.updateChildren):
+        ():
+        * inspector/front-end/EventListenersSidebarPane.js:
+        (WebInspector.EventListenersSidebarPane.prototype.update.callback):
+        (WebInspector.EventListenersSidebarPane.prototype.update):
+        * inspector/front-end/ObjectPropertiesSection.js:
+        (WebInspector.ObjectPropertyTreeElement.prototype.applyExpression.callback):
+        (WebInspector.ObjectPropertyTreeElement.prototype.applyExpression):
+        * inspector/front-end/PropertiesSidebarPane.js:
+        (WebInspector.PropertiesSidebarPane.prototype.update.nodeResolved):
+        * inspector/front-end/RemoteObject.js:
+        (WebInspector.RemoteObject.prototype.setPropertyValue):
+        (WebInspector.RemoteObject.prototype.evaluate):
+        * inspector/front-end/inspector.js:
+
+2011-03-12  Jer Noble  <jer.noble@apple.com>
+
+        Unreviewed build fix.
+
+        Fix GTK+ builds by wrapping sections of full screen code in USE(ACCELERATED_COMPOSITING)
+        checks.
+
+        * dom/Document.cpp:
+        (WebCore::Document::webkitWillEnterFullScreenForElement):
+        (WebCore::Document::webkitDidEnterFullScreenForElement):
+        (WebCore::Document::webkitWillExitFullScreenForElement):
+        (WebCore::Document::webkitDidExitFullScreenForElement):
+
+2011-03-12  Ryuan Choi  <ryuan.choi@samsung.com>
+
+        Unreviewed build fix.
+
+        [EFL] Fix build break because of several reason.
+        https://bugs.webkit.org/show_bug.cgi?id=56244
+
+        * CMakeLists.txt: Add missing files.
+        * platform/posix/FileSystemPOSIX.cpp: Add PLATFORM(EFL).
+
+2011-03-11  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: move profiler related methods from inspector agent to profiler agent
+        https://bugs.webkit.org/show_bug.cgi?id=56204
+
+        * inspector/Inspector.idl:
+        * inspector/InspectorAgent.cpp:
+        (WebCore::InspectorAgent::InspectorAgent):
+        (WebCore::InspectorAgent::restoreInspectorStateFromCookie):
+        (WebCore::InspectorAgent::setFrontend):
+        (WebCore::InspectorAgent::disconnectFrontend):
+        (WebCore::InspectorAgent::populateScriptObjects):
+        (WebCore::InspectorAgent::showProfilesPanel):
+        * inspector/InspectorAgent.h:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::enableProfiler):
+        (WebCore::InspectorController::disableProfiler):
+        (WebCore::InspectorController::profilerEnabled):
+        (WebCore::InspectorController::startUserInitiatedProfiling):
+        (WebCore::InspectorController::stopUserInitiatedProfiling):
+        (WebCore::InspectorController::isRecordingUserInitiatedProfile):
+        * inspector/InspectorInstrumentation.cpp:
+        (WebCore::InspectorInstrumentation::profilerEnabledImpl):
+        * inspector/InspectorProfilerAgent.cpp:
+        (WebCore::InspectorProfilerAgent::create):
+        (WebCore::InspectorProfilerAgent::InspectorProfilerAgent):
+        (WebCore::InspectorProfilerAgent::enable):
+        (WebCore::InspectorProfilerAgent::disable):
+        (WebCore::InspectorProfilerAgent::setFrontend):
+        (WebCore::InspectorProfilerAgent::clearFrontend):
+        (WebCore::InspectorProfilerAgent::restore):
+        (WebCore::InspectorProfilerAgent::restoreEnablement):
+        (WebCore::InspectorProfilerAgent::startUserInitiatedProfiling):
+        (WebCore::InspectorProfilerAgent::stopUserInitiatedProfiling):
+        * inspector/InspectorProfilerAgent.h:
+        (WebCore::InspectorProfilerAgent::start):
+        (WebCore::InspectorProfilerAgent::stop):
+        * inspector/front-end/ProfileView.js:
+        (WebInspector.CPUProfileType.prototype.buttonClicked):
+        * inspector/front-end/ProfilesPanel.js:
+        (WebInspector.ProfilesPanel):
+        (WebInspector.ProfilesPanel.prototype._registerProfileType):
+        (WebInspector.ProfilesPanel.prototype._toggleProfiling):
+        * inspector/front-end/inspector.js:
+        (WebInspector._createPanels):
+
+2011-03-11  Jer Noble  <jer.noble@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        WebCore::Document should notify ChromeClient when the full screen renderer's backing changes.
+        https://bugs.webkit.org/show_bug.cgi?id=56226
+
+        * dom/Document.cpp:
+        (WebCore::Document::webkitWillEnterFullScreenForElement): Call setRootFullScreenLayer().
+        (WebCore::Document::webkitDidEnterFullScreenForElement): Ditto.
+        (WebCore::Document::webkitWillExitFullScreenForElement): Ditto.
+        (WebCore::Document::webkitDidExitFullScreenForElement): Ditto.
+        (WebCore::Document::setFullScreenRendererSize): Layout after setting the renderer's size.
+
+2011-03-11  Jer Noble  <jer.noble@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        Create new interface stubs to support full screen mode in WebKit2.
+
+        WebKit2: Plumb new full screen animation APIs through WebKit2.
+        https://bugs.webkit.org/show_bug.cgi?id=55993
+
+        * page/ChromeClient.h:
+        (WebCore::ChromeClient::setRootFullScreenLayer): Added.
+
+2011-03-11  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Ensure all values are correctly tagged in the registerfile
+        https://bugs.webkit.org/show_bug.cgi?id=56214
+
+        Make sure everything builds still.
+
+        * bridge/c/c_class.cpp:
+        * bridge/c/c_runtime.cpp:
+        * bridge/jni/JavaMethod.cpp:
+        * plugins/PluginViewNone.cpp:
+
+2011-03-11  Mark Rowe  <mrowe@apple.com>
+
+        Fix the 32-bit build.
+
+        * platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.cpp:
+        (WebCore::MediaPlayerPrivateAVFoundation::MediaPlayerPrivateAVFoundation):
+
+2011-03-11  Mark Rowe  <mrowe@apple.com>
+
+        Rubber-stamped by Eric Carlsson.
+
+        <rdar://problem/9124537> Crashes during layout tests due to overrelease of AVFoundation objects.
+
+        * platform/graphics/avfoundation/MediaPlayerPrivateAVFoundationObjC.mm:
+        (WebCore::MediaPlayerPrivateAVFoundationObjC::createContextVideoRenderer):
+        (WebCore::MediaPlayerPrivateAVFoundationObjC::setAsset):
+
+2011-03-11  Chris Marrin  <cmarrin@apple.com>
+
+        Unreviewed.
+
+        Fixes an error with the checkin for https://bugs.webkit.org/show_bug.cgi?id=52468
+
+        * platform/graphics/ca/GraphicsLayerCA.cpp:
+        (WebCore::GraphicsLayerCA::createTransformAnimationsFromKeyframes):
+
+2011-03-11  Brady Eidson  <beidson@apple.com>
+
+        Attempted Qt build fix for https://bugs.webkit.org/show_bug.cgi?id=56216
+
+        * loader/icon/IconDatabase.h: Make this guy public.
+
+2011-03-11  Brady Eidson  <beidson@apple.com>
+
+        Attempted Qt build fix for https://bugs.webkit.org/show_bug.cgi?id=56216
+
+        * loader/icon/IconDatabase.h:
+        (WebCore::IconDatabase::delayDatabaseCleanup): Maybe Qt has Icon Database disabled, so we need to define this here?
+
+2011-03-11  Brady Eidson  <beidson@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=56216
+        Fix the Qt build following the same pattern of the patch.
+
+        * loader/icon/IconDatabase.h:
+        * loader/icon/IconDatabaseBase.cpp:
+        (WebCore::IconDatabaseBase::databasePath): Added to the virtual base.
+        * loader/icon/IconDatabaseBase.h:
+        (WebCore::IconDatabaseBase::isOpen): Ditto.
+
+2011-03-11  Ben Taylor  <bentaylor.solx86@gmail.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=56198
+        Fix conditional which had an int for one case and a pointer for another.
+
+        No new tests. Fix compilation on Solaris 10 with SunStudio 12 C++
+
+        * loader/appcache/ApplicationCacheGroup.cpp:
+        (WebCore::ApplicationCacheGroup::checkIfLoadIsComplete):
+
+2011-03-11  Brady Eidson  <beidson@apple.com>
+
+        Windows build fix.
+
+        * history/HistoryItem.cpp:
+        * loader/icon/IconDatabaseBase.cpp:
+
+2011-03-11  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        <rdar://problem/8648311> and https://bugs.webkit.org/show_bug.cgi?id=56216
+        Rework disabled IconDatabase builds while allowing for a pluggable icon database implementation.
+
+        Project file stuff:
+        * Android.mk:
+        * CMakeLists.txt:
+        * GNUmakefile.am:
+        * WebCore.gyp/WebCore.gyp:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCore.vcproj/WebCore.vcproj:
+
+        * loader/icon/IconDatabase.cpp:
+        * loader/icon/IconDatabase.h: Inherit from IconDatabaseBase.
+
+        * loader/icon/IconDatabaseBase.cpp: Added.
+        (WebCore::IconDatabaseBase::iconURLForPageURL):
+        (WebCore::iconDatabase):
+        (WebCore::setGlobalIconDatabase):
+        * loader/icon/IconDatabaseBase.h: Added.
+        (WebCore::IconDatabaseBase::IconDatabaseBase):
+        (WebCore::IconDatabaseBase::~IconDatabaseBase):
+        (WebCore::IconDatabaseBase::setEnabled):
+        (WebCore::IconDatabaseBase::isEnabled):
+        (WebCore::IconDatabaseBase::defaultIcon):
+        (WebCore::IconDatabaseBase::retainIconForPageURL):
+        (WebCore::IconDatabaseBase::releaseIconForPageURL):
+        (WebCore::IconDatabaseBase::iconForPageURL):
+        (WebCore::IconDatabaseBase::setIconURLForPageURL):
+        (WebCore::IconDatabaseBase::setIconDataForIconURL):
+        (WebCore::IconDatabaseBase::iconDataKnownForIconURL):
+        (WebCore::IconDatabaseBase::loadDecisionForIconURL):
+        (WebCore::IconDatabaseBase::pageURLMappingCount):
+        (WebCore::IconDatabaseBase::retainedPageURLCount):
+        (WebCore::IconDatabaseBase::iconRecordCount):
+        (WebCore::IconDatabaseBase::iconRecordCountWithData):
+        (WebCore::IconDatabaseBase::importIconURLForPageURL):
+        (WebCore::IconDatabaseBase::importIconDataForIconURL):
+        (WebCore::IconDatabaseBase::shouldStopThreadActivity):
+        (WebCore::IconDatabaseBase::open):
+        (WebCore::IconDatabaseBase::close):
+        (WebCore::IconDatabaseBase::removeAllIcons):
+        (WebCore::IconDatabaseBase::setPrivateBrowsingEnabled):
+        (WebCore::IconDatabaseBase::setClient):
+
+        * loader/icon/IconDatabaseNone.cpp: Removed.
+
+2011-03-11  Brady Eidson  <beidson@apple.com>
+
+        Attempt at a build-fix for https://bugs.webkit.org/show_bug.cgi?id=51878
+
+        * page/PageGroup.h: Declare this method, even if the definition will end up being empty.
+
+2011-03-11  Michael Nordman  <michaeln@google.com>
+
+        Reviewed by Dmitry Titov.
+
+        Adding the '~' to the dtor (duh).
+
+        No new tests.
+
+        * storage/SQLCallbackWrapper.h:
+        (WebCore::SQLCallbackWrapper::~SQLCallbackWrapper):
+
+2011-03-11  Carol Szabo  <carol.szabo@nokia.com>
+
+        Reviewed by David Hyatt.
+
+        Introduced double linkage between a CounterNode and its display renderer.
+
+        use of freed pointer in WebCore::RenderCounter::originalText()
+        https://bugs.webkit.org/show_bug.cgi?id=56065
+
+        No new tests. This bug could only be reproduced manually by
+        refreshing the page during load at a critical point.
+        See bug attachment for testing.
+
+        * rendering/CounterNode.cpp:
+        Introduced new member "m_owner" to store the renderer that has the
+        style directives that produce the CounterNode.
+        Repurposed m_renderer to reffer to the RenderCounter that shows the
+        CounterNode.
+        (WebCore::CounterNode::CounterNode):
+        Updated member initialization.
+        (WebCore::CounterNode::create):
+        (WebCore::CounterNode::resetRenderer):
+        (WebCore::CounterNode::resetRenderers):
+        (WebCore::CounterNode::recount):
+        (WebCore::CounterNode::removeChild):
+        (WebCore::CounterNode::insertAfter):
+        No functional changes.
+        (WebCore::showTreeAndMark):
+        Added flushing to ensure that the output is complete.
+        * rendering/CounterNode.h:
+        (WebCore::CounterNode::owner):
+        Renamed from renderer()
+        (WebCore::CounterNode::renderer):
+        (WebCore::CounterNode::setRenderer):
+        Added new accessors for the display renderer.
+        * rendering/RenderCounter.cpp:
+        (WebCore::findPlaceForCounter):
+        Fixed comments. No functional changes.
+        (WebCore::RenderCounter::~RenderCounter):
+        Made sure that the CounterNode that this renderers displays is
+        detached from this.
+        (WebCore::RenderCounter::originalText):
+        (WebCore::RenderCounter::invalidate):
+        Added code to update m_renderer on the displayed CounterNode.
+        (WebCore::destroyCounterNodeWithoutMapRemoval):
+        (WebCore::RenderCounter::destroyCounterNodes):
+        (WebCore::RenderCounter::destroyCounterNode):
+        (WebCore::updateCounters):
+        No change, just kept code in line with the changes above.
+        (showCounterRendererTree):
+        Added fflush to ensure complete display.
+        * rendering/RenderCounter.h:
+        * rendering/RenderObjectChildList.cpp:
+        * rendering/RenderObjectChildList.h:
+        Removed unneeded invalidateCounters related functions.
+
+2011-03-11  Luke Macpherson   <macpherson@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Introduce lookup-table based approach for applying CSS properties.
+        The aim is to be a starting point for refactoring
+        CSSStyleSelector::applyProperty() into more readable, maintainable code.
+        https://bugs.webkit.org/show_bug.cgi?id=54707
+
+        No new behavior / covered by existing tests.
+
+        * css/CSSStyleApplyProperty.cpp: Added.
+        (WebCore::ApplyPropertyNull):
+        Class that provides empty implementations of inherit, initial, value.
+        (WebCore::ApplyPropertyDefault::ApplyPropertyDefault):
+        Class that calls the appropriate RenderStyle setters directly.
+        (WebCore::ApplyPropertyColorBase::ApplyPropertyColorBase):
+        Class for handling CSSProperty*Color.
+        (WebCore::ApplyPropertyColor::ApplyPropertyColor):
+        Class for handling CSSPropertyColor.
+        (WebCore::CSSStyleApplyProperty::sharedCSSStyleApplyProperty):
+        Singleton initializer.
+        (WebCore::CSSStyleApplyProperty::CSSStyleApplyProperty):
+        Constructor that bulds up the map from property id to apply-er objects.
+        * css/CSSStyleApplyProperty.h: Added.
+        (WebCore::CSSStyleApplyProperty::inherit):
+        Handle the inherit case for a given property.
+        (WebCore::CSSStyleApplyProperty::initial):
+        Handle the initial case for a given property.
+        (WebCore::CSSStyleApplyProperty::value):
+        Apply a value to a given property.
+        (WebCore::CSSStyleApplyProperty::implements):
+        Returns true if the provided property id is implemented.
+        (WebCore::CSSStyleApplyProperty::index):
+        Private function to determine the index of a property the property map.
+        (WebCore::CSSStyleApplyProperty::valid):
+        Function to determine that a given property id is valid.
+        (WebCore::CSSStyleApplyProperty::setPropertyValue):
+        (WebCore::CSSStyleApplyProperty::propertyValue):
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::CSSStyleSelector):
+        Get reference to the CSSStyleApplyProperty singleton.
+        (WebCore::CSSStyleSelector::applyProperty):
+        Now calls into CSSStyleApplyProperty for implemented property ids.
+        Deleted color-related methods from the property id switch.
+        * css/CSSStyleSelector.h:
+        (WebCore::CSSStyleSelector::style):
+        Made public to allow access from CSSStyleApplyProperty.
+        (WebCore::CSSStyleSelector::parentStyle):
+        Made public to allow access from CSSStyleApplyProperty.
+        * rendering/style/RenderStyle.h:
+        Made CSSStyleApplyProperty a friend class. Necessary because it needs
+        to access the private getters and setters on this clsass.
+
+2011-03-11  Anton D'Auria  <adauria@apple.com>
+
+        Reviewed and landed by Brady Eidson.
+
+        Add WebKit1 API to view and delete local storage
+        https://bugs.webkit.org/show_bug.cgi?id=51878
+
+        Created StorageTracker as a central point for tracking and deleting LocalStorage per origin.
+        StorageTracker maintains its own database of origin identifiers and backing db paths,
+        and this allows it to contain more relational data in the future, like variable quotas per origin.
+
+        On initialization, StorageTracker syncs its database with LocalStorage files on disk. It adds
+        an origin entry when StorageAreaSync performs a first sync for an origin.
+
+        All StorageTracker file operations are performed on one background thread with a task queue.
+
+        Tests: storage/domstorage/localstorage/storagetracker/storage-tracker-1-prepare.html
+               storage/domstorage/localstorage/storagetracker/storage-tracker-2-create.html
+               storage/domstorage/localstorage/storagetracker/storage-tracker-3-delete-all.html
+               storage/domstorage/localstorage/storagetracker/storage-tracker-4-create.html
+               storage/domstorage/localstorage/storagetracker/storage-tracker-5-delete-one.html
+
+        * GNUmakefile.am:
+        * WebCore.exp.in:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * page/PageGroup.cpp:
+        (WebCore::PageGroup::clearLocalStorageForAllOrigins):
+        (WebCore::PageGroup::clearLocalStorageForOrigin):
+        (WebCore::PageGroup::syncLocalStorage):
+        (WebCore::PageGroup::numberOfPageGroups):
+        * page/PageGroup.h:
+        * platform/chromium/FileSystemChromium.cpp:
+        (WebCore::listDirectory):
+        * platform/posix/FileSystemPOSIX.cpp:
+        (WebCore::listDirectory):
+        * storage/LocalStorageTask.cpp:
+        (WebCore::LocalStorageTask::LocalStorageTask):
+        (WebCore::LocalStorageTask::performTask):
+        * storage/LocalStorageTask.h:
+        (WebCore::LocalStorageTask::createOriginIdentifiersImport):
+        (WebCore::LocalStorageTask::createSetOriginDetails):
+        (WebCore::LocalStorageTask::createDeleteOrigin):
+        (WebCore::LocalStorageTask::createDeleteAllOrigins):
+        * storage/StorageAreaImpl.cpp:
+        (WebCore::StorageAreaImpl::clearForOriginDeletion):
+        (WebCore::StorageAreaImpl::sync):
+        * storage/StorageAreaImpl.h:
+        * storage/StorageAreaSync.cpp:
+        (WebCore::StorageAreaSync::scheduleCloseDatabase):
+        (WebCore::StorageAreaSync::openDatabase):
+        (WebCore::StorageAreaSync::sync):
+        (WebCore::StorageAreaSync::deleteEmptyDatabase):
+        (WebCore::StorageAreaSync::scheduleSync):
+        * storage/StorageAreaSync.h:
+        * storage/StorageNamespace.h:
+        * storage/StorageNamespaceImpl.cpp:
+        (WebCore::StorageNamespaceImpl::clearOriginForDeletion):
+        (WebCore::StorageNamespaceImpl::clearAllOriginsForDeletion):
+        (WebCore::StorageNamespaceImpl::sync):
+        * storage/StorageNamespaceImpl.h:
+        * storage/StorageTracker.cpp: Added.
+        (WebCore::StorageTracker::initializeTracker):
+        (WebCore::StorageTracker::tracker):
+        (WebCore::StorageTracker::StorageTracker):
+        (WebCore::StorageTracker::setStorageDirectoryPath):
+        (WebCore::StorageTracker::trackerDatabasePath):
+        (WebCore::StorageTracker::openTrackerDatabase):
+        (WebCore::StorageTracker::importOriginIdentifiers):
+        (WebCore::StorageTracker::syncImportOriginIdentifiers):
+        (WebCore::StorageTracker::syncFileSystemAndTrackerDatabase):
+        (WebCore::StorageTracker::setOriginDetails):
+        (WebCore::StorageTracker::scheduleTask):
+        (WebCore::StorageTracker::syncSetOriginDetails):
+        (WebCore::StorageTracker::origins):
+        (WebCore::StorageTracker::deleteAllOrigins):
+        (WebCore::StorageTracker::syncDeleteAllOrigins):
+        (WebCore::StorageTracker::deleteOrigin):
+        (WebCore::StorageTracker::syncDeleteOrigin):
+        (WebCore::StorageTracker::willDeleteAllOrigins):
+        (WebCore::StorageTracker::willDeleteOrigin):
+        (WebCore::StorageTracker::canDeleteOrigin):
+        (WebCore::StorageTracker::cancelDeletingOrigin):
+        (WebCore::StorageTracker::setClient):
+        (WebCore::StorageTracker::syncLocalStorage):
+        * storage/StorageTracker.h: Added.
+        * storage/StorageTrackerClient.h: Added.
+        (WebCore::StorageTrackerClient::~StorageTrackerClient):
+
+2011-03-11  Steve Block  <steveblock@google.com>
+
+        Reviewed by Jeremy Orlow.
+
+        JavaMethod does not correctly check for a null jstring for the method name
+        https://bugs.webkit.org/show_bug.cgi?id=56187
+
+        No new tests, simple typo fix.
+
+        * bridge/jni/JavaMethod.cpp:
+        (JavaMethod::JavaMethod):
+
+2011-03-11  Adrienne Walker  <enne@google.com>
+
+        Reviewed by James Robinson.
+
+        [chromium] Compositor uses too much texture memory for scrollbars
+        https://bugs.webkit.org/show_bug.cgi?id=56212
+
+        Compositor invalidations can be off the page (and very large), but
+        scrollbars only need to care about the invalidation that's visible.
+        The large invalidation was causing the tiler layer size to grow
+        needlessly larger than the scrollbar.
+
+        * platform/graphics/chromium/LayerRendererChromium.cpp:
+        (WebCore::LayerRendererChromium::invalidateRootLayerRect):
+
+2011-03-11  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=52987
+        
+        REGRESSION: Overflowing columns not repainted correctly
+        
+        Make sure to add in column overflow as visual overflow as well.  It was only propagating layout overflow, which is obviously not
+        sufficient, since blocks paint their own columns.
+
+        Added fast/multicol/scrolling-overflow.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::addOverflowFromChildren):
+
+2011-03-11  Matthew Delaney  <mdelaney@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Set canvasUsesAcceleratedDrawing setting to be off(false) by default
+        https://bugs.webkit.org/show_bug.cgi?id=56215
+
+        No new tests. Does not affect behavior. Just keeping the setting off by default.
+
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+
+2011-03-11  Andy Estes  <aestes@apple.com>
+
+        Reviewed by David Hyatt.
+
+        Table cells with dynamically added percentage height descendants do not
+        grow in size if the table has already been laid out.
+        https://bugs.webkit.org/show_bug.cgi?id=56174
+        
+        Table cells ignore their specified size and collapse to fit their
+        children. When a descendent with percentage height is present before
+        the table is first laid out, the descendent is sized based on the
+        specified size of the table cell. However, when the child isn't present
+        when the table is first laid out, the table cell ignores its specified
+        size and collapses down to 0. Then, when the child div is added in a
+        separate run loop iteration, it is sized to be 100% of the collapsed
+        cell height instead of 100% of the cell's specified height. We should
+        not get different layouts depending on the timing of tree construction.
+        
+        Fix this by clearing intrinsic padding before calculating the table
+        cell's override height when we detect a child that should flex the
+        table cell.
+
+        Test: fast/table/dynamic-descendant-percentage-height.html
+
+        * rendering/RenderTableCell.cpp:
+        (WebCore::RenderTableCell::setOverrideSizeFromRowHeight): clear
+        intrinsic padding before setting the override size.
+        * rendering/RenderTableCell.h:
+        * rendering/RenderTableSection.cpp:
+        (WebCore::RenderTableSection::layoutRows): Call
+        setOverrideSizeFromRowHeight() instead of setOverrideSize().
+
+2011-03-11  Michael Nordman  <michaeln@google.com>
+
+        Reviewed by David Levin.
+
+        Add SQLCallbackWrapper
+        Instead of directly holding RefPtrs to the Callback objects in SQLStatement and SQLTransaction, hold a wrapper objects
+        which holds those references whose dtors will schedule the release of those references on the ScriptExecution thread.
+        https://bugs.webkit.org/show_bug.cgi?id=55919
+
+        No new tests, existing tests apply.
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * storage/SQLCallbackWrapper.h: Added.
+        (WebCore::SQLCallbackWrapper::SQLCallbackWrapper):
+        (WebCore::SQLCallbackWrapper::clear):
+        (WebCore::SQLCallbackWrapper::unwrap):
+        (WebCore::SQLCallbackWrapper::hasCallback):
+        (WebCore::SQLCallbackWrapper::safeRelease):
+        * storage/SQLStatement.cpp:
+        (WebCore::SQLStatement::create):
+        (WebCore::SQLStatement::SQLStatement):
+        (WebCore::SQLStatement::performCallback):
+        * storage/SQLStatement.h:
+        (WebCore::SQLStatement::hasStatementCallback):
+        (WebCore::SQLStatement::hasStatementErrorCallback):
+        * storage/SQLTransaction.cpp:
+        (WebCore::SQLTransaction::SQLTransaction):
+        (WebCore::SQLTransaction::executeSQL):
+        (WebCore::SQLTransaction::checkAndHandleClosedOrInterruptedDatabase):
+        (WebCore::SQLTransaction::deliverTransactionCallback):
+        (WebCore::SQLTransaction::deliverStatementCallback):
+        (WebCore::SQLTransaction::postflightAndCommit):
+        (WebCore::SQLTransaction::deliverSuccessCallback):
+        (WebCore::SQLTransaction::handleTransactionError):
+        (WebCore::SQLTransaction::deliverTransactionErrorCallback):
+        * storage/SQLTransaction.h:
+
+2011-03-11  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        <rdar://problem/8955589> Adopt AVFoundation media back end on Lion.
+
+        No new tests, existing media tests cover this.
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * platform/graphics/MediaPlayer.cpp:
+        (WebCore::installedMediaEngines): Register MediaPlayerPrivateAVFoundationObjC.
+        (WebCore::bestMediaEngineForTypeAndCodecs): Kill some whitespace.
+        (WebCore::MediaPlayer::loadWithNextMediaEngine): Ditto.
+        (WebCore::MediaPlayer::inMediaDocument): Ditto.
+        * platform/graphics/MediaPlayer.h:
+
+        * platform/graphics/avfoundation: Added.
+        * platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.cpp: Added.
+        * platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.h: Added.
+
+        * platform/graphics/avfoundation/MediaPlayerPrivateAVFoundationObjC.h: Added.
+        * platform/graphics/avfoundation/MediaPlayerPrivateAVFoundationObjC.mm: Added.
+
+2011-03-11  Dean Jackson  <dino@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=56205
+        m_restrictions needs to allow multiple values (a bitfield)
+
+        HTMLMediaElement::m_restrictions needs to hold multiple values, so
+        change BehaviorRestrictions to an unsigned typedef and rename the
+        existing enum BehaviorRestrictionFlags.
+
+        * html/HTMLMediaElement.h:
+        (WebCore::HTMLMediaElement::setBehaviorRestrictions):
+
+2011-03-11  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=47206
+        
+        Table rows don't support ::before/::after.  Add support to RenderTableRow::styleDidChange so that ::before/::after content gets
+        properly constructed.
+
+        Added fast/css-generated-content/table-row-before-after.html
+
+        * rendering/RenderTableRow.cpp:
+        (WebCore::RenderTableRow::styleDidChange):
+        * rendering/RenderTableRow.h:
+
+2011-03-11  James Robinson  <jamesr@chromium.org>
+
+        Reviewed by Kenneth Russell.
+
+        [chromium] Avoid updating a composited layer&apos;s contents if the layer has nonpositive dimensions
+        https://bugs.webkit.org/show_bug.cgi?id=56209
+
+        This matches the behavior prior to r80482.  No test since the only changes in
+        behavior are avoiding work on invisible layers, which is unobservable,
+        and fixing a crash due to bug 56153.
+
+        * platform/graphics/chromium/LayerRendererChromium.cpp:
+        (WebCore::LayerRendererChromium::updateContentsRecursive):
+
+2011-03-11  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=47159
+        
+        CSS2.1 failures in background position parsing.
+        
+        Rewrite background position component parsing to match the spec.  Our old parsing would allow "100% left" to be valid
+        when it should not have.  Rename parseFillPositionXY to parseFillPositionComponent and pass in enough information for
+        it to understand what the first component was.
+        
+        For individual property parsing using background-position-x/y, I added new functions that just handle that without
+        worrying about the other component.
+        
+        In order to pass the CSS2.1 test, I also had to fix multiple background parsing.  The number of layers in multiple
+        backgrounds is determined solely by the background-image property and not by any of the other properties.  cullEmptyLayers
+        has been changed to always consider a layer empty if it has no image set, even if other properties are set.
+        
+        A number of layout tests had to be patched as they were invalid.  A couple of them relied on incorrect background-position
+        parsing (e.g., "50 left") and another relied on incorrect multiple background parsing.  It's not clear if the computed style
+        should actually include the additional values when no image is set though, so that should perhaps be the subject of a 
+        follow-up bug.
+
+        Added fast/backgrounds/background-position-parsing.html
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseFillPositionX):
+        (WebCore::CSSParser::parseFillPositionY):
+        (WebCore::CSSParser::parseFillPositionComponent):
+        (WebCore::CSSParser::parseFillPosition):
+        (WebCore::CSSParser::parseFillProperty):
+        (WebCore::CSSParser::parseTransformOrigin):
+        (WebCore::CSSParser::parsePerspectiveOrigin):
+        * css/CSSParser.h:
+        * rendering/style/FillLayer.cpp:
+        (WebCore::FillLayer::fillUnsetProperties):
+        (WebCore::FillLayer::cullEmptyLayers):
+
+2011-03-11  Vangelis Kokkevis  <vangelis@chromium.org>
+
+        Reviewed by James Robinson.
+
+        [chromium] Allow large layers with non-identity transforms to be drawn
+        as long as their visible portion is smaller than the largest supported
+        texture size. This code will soon be replaced by tiled layers.
+        https://bugs.webkit.org/show_bug.cgi?id=55984
+
+        Test: platform/chromium/compositing/huge-layer-rotated.html
+
+        * platform/graphics/chromium/ContentLayerChromium.cpp:
+        (WebCore::ContentLayerChromium::updateContentsIfDirty):
+        (WebCore::ContentLayerChromium::draw):
+        * platform/graphics/chromium/ContentLayerChromium.h:
+
+2011-03-09  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Adam Roben.
+
+        REGRESSION (5.0.3-ToT): Scrolling text doesn&apos;t scroll in Star Wars intro animation
+        https://bugs.webkit.org/show_bug.cgi?id=52468
+
+        Added WIN32 to the ifdef controlling whether animations are applied in normal or
+        reverse order. On Mac, animations used to be applied in reverse, but 
+        <rdar://problem/7095638> fixed this in the release after Snow Leopard.
+        But that patch has not be applied to the Safari Windows SDK yet. For now
+        I've made Windows use the reverse order logig. <rdar://problem/9112233> is
+        tracking the inclusion of the patch on Windows.
+
+        * platform/graphics/ca/GraphicsLayerCA.cpp:
+        (WebCore::GraphicsLayerCA::createTransformAnimationsFromKeyframes):
+
+2011-03-11  Tony Gentilcore  <tonyg@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Let the parser yield for layout before running scripts
+        https://bugs.webkit.org/show_bug.cgi?id=54355
+
+        Prior to this patch, the parser would yield to perform a layout/paint before running a
+        script only if the script or a stylesheet blocking the script is not loaded yet. Since we
+        don't preload scan into the body while parsing the head, typically we'll block on a script
+        early in the body that causes us to yield to do the first paint within a reasonable time.
+
+        However, I'm planning to change the PreloadScanner to scan into the body from the head.
+        That significantly improves overall load time, but would hurt first paint time because
+        fewer scripts would be blocked during parsing and thus wouldn't yield.
+
+        This change causes us to yield before running scripts if we haven't painted yet (regardless
+        of whether or not the script is loaded). In addition to allowing the above mentioned
+        PreloadScanner change to be implemented without regressing first paint time, this also
+        improves first paint time by itself.
+
+        I tested Alexa's top 45 websites using Web Page Replay to control the content and simulate
+        bandwidth. This patch improved average first paint time by 1% over an unlimited connection,
+        6% over a 1Mbps connection and 11% over a 5Mbps connection. There was no statistically
+        signifcant change in page load time.
+
+        Within the pages tested, 33 had no statistically significant change in time to first paint,
+        12 improved, and none regressed. Of the improved, some of the standouts from the 1Mbps set
+        are: 20% on youtube, 37% on wiki, 27% on ebay, 13% on cnn, 16% on espn, 74% on sohu.
+
+        * html/parser/HTMLDocumentParser.cpp:
+        (WebCore::HTMLDocumentParser::canTakeNextToken): This is the new yield point.
+        (WebCore::HTMLDocumentParser::pumpTokenizer): Remove ASSERT that we are not paused. isPaused
+        means that we are waiting for a script. Bug 54574 changed pumpTokenizer() so that it does
+        the right thing whether we are just before a token or waiting for a script. Now that we may
+        yield before a token or before a script, this may be called while paused.
+        * html/parser/HTMLParserScheduler.cpp:
+        (WebCore::HTMLParserScheduler::checkForYieldBeforeScript): Added.
+        * page/FrameView.h:
+        (WebCore::FrameView::hasEverPainted): Added.
+
+2011-03-11  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Fix crashes in dom/html/level2/html/HTMLInputElement*.
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::adjustRenderStyle): Added a null-check for e,
+            because e can certainly be a null.
+
+2011-03-09  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by David Hyatt.
+
+        Choke text-decoration when entering shadow DOM subtree.
+        https://bugs.webkit.org/show_bug.cgi?id=56044
+
+        No new tests, because the functionality can't be tested yet.
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::adjustRenderStyle): Added a check for shadow DOM root.
+
+2011-03-08  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Eric Carlson.
+
+        Convert MediaControlTimeDisplayElement to use standard layout with a custom renderer.
+        https://bugs.webkit.org/show_bug.cgi?id=55972
+
+        Instead of poking at the time display elements all the way from RenderMedia,
+        let the standard layout cycle take care of things. Move the logic of calculating
+        when to collapse the time display elements into a custom renderer, since
+        this is not something that can be accomplished with CSS.
+
+        Also, the logic of keeping the timeline slider at least 100px needed refreshing,
+        since it didn't actually keep it at 100px.
+
+        * html/shadow/MediaControls.cpp: Moved the logic of determining visibility
+            of time display elements to RenderMediaControlTimeDisplay, eliminating
+            updateTimeDisplayVisibility method.
+        * html/shadow/MediaControls.h: Removed decl.
+        * rendering/MediaControlElements.cpp:
+        (WebCore::RenderMediaControlTimeDisplay::RenderMediaControlTimeDisplay):
+            Added new renderer class.
+        (WebCore::RenderMediaControlTimeDisplay::layout): Simplified (and corrected)
+            size-sensing logic, still using hard-coded values.
+        (WebCore::MediaControlTimeDisplayElement::MediaControlTimeDisplayElement):
+            Removed m_isVisible member, which is no longer necessary.
+        (WebCore::MediaControlTimeDisplayElement::createRenderer): Added to
+            return the new renderer.
+        * rendering/MediaControlElements.h: Adjusted decls.
+        * rendering/RenderMedia.cpp:
+        (WebCore::RenderMedia::layout): Remove the now-unnecessary poking at
+            media controls in layout.
+
+2011-03-09  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Eric Carlson.
+
+        Start focusing updates to media controls, away from always updating everything.
+        https://bugs.webkit.org/show_bug.cgi?id=56038
+
+        For now, the new methods just call generic MediaControls::update.
+
+        Covered by existing tests.
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::attributeChanged): Changed to use MediaControls::reset.
+        (WebCore::HTMLMediaElement::setMuted): Changed to use MediaControls::changedMute.
+        (WebCore::HTMLMediaElement::updateVolume): Changed to use MediaControls::changedVolume.
+        (WebCore::HTMLMediaElement::defaultEventHandler): Changed to use the new mediaControls
+            accessor.
+        (WebCore::HTMLMediaElement::setClosedCaptionsVisible): Changed to use
+            MediaControls::changedClosedCaptionsVisibility.
+        (WebCore::HTMLMediaElement::mediaControls): Added.
+        (WebCore::HTMLMediaElement::hasMediaControls): Added.
+        * html/HTMLMediaElement.h: Added decls.
+        * html/shadow/MediaControls.cpp:
+        (WebCore::MediaControls::reset): Added.
+        (WebCore::MediaControls::changedMute): Added.
+        (WebCore::MediaControls::changedVolume): Added.
+        (WebCore::MediaControls::changedClosedCaptionsVisibility): Added.
+        * html/shadow/MediaControls.h: Added decls.
+
+2011-03-11  Alexis Menard  <alexis.menard@openbossa.org>
+
+        Reviewed by Martin Robinson.
+
+        [GStreamer] When seeking webKitWebSrcStop release the frame but should not.
+        https://bugs.webkit.org/show_bug.cgi?id=55703
+
+        When calling webKitWebSrcStop in case of a seeking, the frame should not
+        be reset (the source hasn't change). The frame may be used to get the network
+        context. Some network stack (like Qt) are relaying on the network context
+        to work.
+
+        * platform/graphics/gstreamer/WebKitWebSourceGStreamer.cpp:
+        (webKitWebSrcStop):
+
+2011-03-11  Dean Jackson  <dino@apple.com>
+
+        Unreviewed.
+
+        Build fixes for GTK and Leopard.
+
+        * bindings/gobject/GNUmakefile.am:
+        - add missing WebKitAnimation* generated bindings
+        * page/WebKitAnimation.idl:
+        - use double in place of float (the core values are double anyway)
+
+2011-03-11  Dean Jackson  <dino@apple.com>
+
+        Unreviewed build fix for QT.
+
+        * WebCore.pro:
+
+2011-03-11  Dean Jackson  <dino@apple.com>
+
+        Reviewed by Simon Fraser and Chris Marrin.
+
+        https://bugs.webkit.org/show_bug.cgi?id=54151
+        Implement an API to play/pause/scrub animations
+
+        This is Part 1. Adds the new WebKitAnimation and WebKitAnimationList
+        APIs, exposed via Element.getWebKitAnimations(). This first pass
+        is a read-only API - a subsequent commit will add the ability
+        to scrub animations.
+
+        Test: animations/animation-api-1.html
+
+        * Android.derived.jscbindings.mk:
+        * Android.derived.v8bindings.mk:
+        * Android.mk:
+        * Android.v8bindings.mk:
+        * CMakeLists.txt:
+        * CodeGenerators.pri:
+        * DerivedSources.cpp:
+        * DerivedSources.make:
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        - All build settings updated for new files
+        * bindings/js/JSBindingsAllInOne.cpp:
+        - Include new custom files
+        * bindings/js/JSWebKitAnimationCustom.cpp: Added.
+        (WebCore::JSWebKitAnimation::iterationCount):
+        - Custom property getter so that we can return INFINITY
+        * bindings/js/JSWebKitAnimationListCustom.cpp: Added.
+        (WebCore::JSWebKitAnimationList::markChildren):
+        - Make sure WebKitAnimations are marked
+        * bindings/v8/custom/V8WebKitAnimationCustom.cpp: Added.
+        (WebCore::V8WebkitAnimation::iterationCountAccessorGetter):
+        - Custom property getter so that we can return INFINITY
+        * dom/Element.cpp:
+        (WebCore::Element::webkitGetAnimations):
+        * dom/Element.h:
+        * dom/Element.idl:
+        - New API entry point
+        * page/DOMWindow.idl:
+        - Constructor definitions for WebKitAnimation and WebKitAnimationList
+        * page/animation/AnimationBase.cpp:
+        (WebCore::AnimationBase::~AnimationBase):
+        - Since AnimationBase can now live longer (if a WebKitAnimation is
+        held in Javascript) we need to guard for the renderer having disappeared.
+        (WebCore::AnimationBase::setElapsedTime):
+        (WebCore::AnimationBase::play):
+        (WebCore::AnimationBase::pause):
+        - Stub implementations at present
+        * page/animation/AnimationBase.h:
+        (WebCore::AnimationBase::animation):
+        - Expose the Animation properties
+        * page/animation/AnimationController.cpp:
+        (WebCore::AnimationControllerPrivate::animationsForRenderer):
+        (WebCore::AnimationController::animationsForRenderer):
+        - Builds the list of WebKitAnimations
+        * page/animation/AnimationController.h:
+        * page/animation/AnimationControllerPrivate.h:
+        * page/animation/CompositeAnimation.cpp:
+        (WebCore::CompositeAnimation::updateKeyframeAnimations):
+        - Make sure we clear the renderer if we are removing the animation
+        (WebCore::CompositeAnimation::animations):
+        * page/animation/CompositeAnimation.h:
+        * page/WebKitAnimation.cpp: Added.
+        (WebCore::WebKitAnimation::WebKitAnimation):
+        (WebCore::WebKitAnimation::name):
+        (WebCore::WebKitAnimation::duration):
+        (WebCore::WebKitAnimation::elapsedTime):
+        (WebCore::WebKitAnimation::setElapsedTime):
+        (WebCore::WebKitAnimation::delay):
+        (WebCore::WebKitAnimation::iterationCount):
+        (WebCore::WebKitAnimation::paused):
+        (WebCore::WebKitAnimation::ended):
+        (WebCore::WebKitAnimation::direction):
+        (WebCore::WebKitAnimation::fillMode):
+        (WebCore::WebKitAnimation::pause):
+        (WebCore::WebKitAnimation::play):
+        - The implementation of the new API. All the read-only parts are
+        done, but elapsedTime, play() and pause() are stubs.
+        * page/WebKitAnimation.h: Added.
+        (WebCore::WebKitAnimation::create):
+        (WebCore::WebKitAnimation::~WebKitAnimation):
+        * page/WebKitAnimation.idl: Added.
+        * page/WebKitAnimationList.cpp: Added.
+        * page/WebKitAnimationList.h: Added.
+        * page/WebKitAnimationList.idl: Added.
+        - Copies NodeList implementation
+
+2011-03-11  Ilya Tikhonovsky  <loislo@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: introduce error argument for all the callbacks on frontend.
+        https://bugs.webkit.org/show_bug.cgi?id=56100
+
+        * inspector/CodeGeneratorInspector.pm:
+        * inspector/front-end/AuditRules.js:
+        (WebInspector.AuditRules.evaluateInTargetWindow):
+        (WebInspector.AuditRules.UnusedCssRule.prototype.doRun.allStylesCallback):
+        (WebInspector.AuditRules.UnusedCssRule.prototype.doRun):
+        (WebInspector.AuditRules.ImageDimensionsRule.prototype.doRun.getStyles):
+        (WebInspector.AuditRules.ImageDimensionsRule.prototype.doRun):
+        * inspector/front-end/CSSStyleModel.js:
+        (WebInspector.CSSStyleModel.prototype.getStylesAsync):
+        (WebInspector.CSSStyleModel.prototype.getComputedStyleAsync):
+        (WebInspector.CSSStyleModel.prototype.getInlineStyleAsync):
+        (WebInspector.CSSStyleModel.prototype.setRuleSelector):
+        (WebInspector.CSSStyleModel.prototype.setRuleSelector.callback):
+        (WebInspector.CSSStyleModel.prototype.addRule):
+        (WebInspector.CSSStyleModel.prototype.addRule.callback):
+        (WebInspector.CSSStyleModel.prototype._styleSheetChanged.callback):
+        (WebInspector.CSSStyleModel.prototype._styleSheetChanged):
+        (WebInspector.CSSStyleModel.prototype._onRevert):
+        (WebInspector.CSSStyleDeclaration.prototype.insertPropertyAt):
+        (WebInspector.CSSProperty.prototype.setText.callback):
+        (WebInspector.CSSProperty.prototype.setText):
+        (WebInspector.CSSProperty.prototype.setDisabled.callback):
+        (WebInspector.CSSProperty.prototype.setDisabled):
+        (WebInspector.CSSStyleSheet.createForId):
+        (WebInspector.CSSStyleSheet.prototype.setText):
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype.evalInInspectedWindow):
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.DOMNode.prototype.setNodeName):
+        (WebInspector.DOMNode.prototype.setNodeValue):
+        (WebInspector.DOMNode.prototype.setAttribute):
+        (WebInspector.DOMNode.prototype.removeAttribute):
+        (WebInspector.DOMNode.prototype.childNodes.mycallback):
+        (WebInspector.DOMNode.prototype.childNodes):
+        (WebInspector.DOMNode.prototype.outerHTML):
+        (WebInspector.DOMNode.prototype.setOuterHTML):
+        (WebInspector.DOMNode.prototype.removeNode):
+        (WebInspector.DOMNode.prototype.copyNode):
+        (WebInspector.DOMAgent.prototype.pushNodeToFrontend):
+        (WebInspector.DOMAgent.prototype.pushNodeByPathToFrontend):
+        (WebInspector.DOMAgent.prototype._documentUpdated):
+        (WebInspector.ApplicationCacheDispatcher.getApplicationCachesAsync):
+        (WebInspector.Cookies.getCookiesAsync):
+        (WebInspector.EventListeners.getEventListenersForNodeAsync):
+        * inspector/front-end/DOMStorage.js:
+        (WebInspector.DOMStorage.prototype.getEntries):
+        (WebInspector.DOMStorage.prototype.setItem):
+        (WebInspector.DOMStorage.prototype.removeItem):
+        * inspector/front-end/Database.js:
+        (WebInspector.Database.prototype.getTableNames):
+        (WebInspector.Database.prototype.executeSql):
+        * inspector/front-end/DebuggerModel.js:
+        (WebInspector.DebuggerModel.prototype.setBreakpoint.didSetBreakpoint):
+        (WebInspector.DebuggerModel.prototype.setBreakpoint):
+        (WebInspector.DebuggerModel.prototype.setBreakpointBySourceId):
+        (WebInspector.DebuggerModel.prototype.editScriptSource):
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.prototype._setSearchingForNode):
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeElement.prototype._createTooltipForNode.resolvedNode):
+        (WebInspector.ElementsTreeElement.prototype._createTooltipForNode):
+        (WebInspector.ElementsTreeElement.prototype._tagNameEditingCommitted.changeTagNameCallback):
+        (WebInspector.ElementsTreeElement.prototype._tagNameEditingCommitted):
+        ():
+        * inspector/front-end/ExtensionPanel.js:
+        (WebInspector.ExtensionWatchSidebarPane.prototype._onEvaluate):
+        * inspector/front-end/ExtensionServer.js:
+        (WebInspector.ExtensionServer.prototype._onEvaluateOnInspectedPage):
+        * inspector/front-end/NetworkManager.js:
+        (WebInspector.NetworkManager.prototype.requestContent):
+        (WebInspector.NetworkManager.prototype._processCachedResources):
+        * inspector/front-end/ProfileView.js:
+        (WebInspector.CPUProfileView.profileCallback):
+        (WebInspector.CPUProfileView):
+        * inspector/front-end/ProfilesPanel.js:
+        * inspector/front-end/RemoteObject.js:
+        (WebInspector.RemoteObject.resolveNode):
+        (WebInspector.RemoteObject.prototype.getProperties.remoteObjectBinder):
+        (WebInspector.RemoteObject.prototype.getProperties):
+        (WebInspector.RemoteObject.prototype.setPropertyValue):
+        (WebInspector.RemoteObject.prototype.evaluate):
+        * inspector/front-end/Script.js:
+        (WebInspector.Script.prototype.requestSource.didGetScriptSource):
+        (WebInspector.Script.prototype.requestSource):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype.evaluateInSelectedCallFrame.updatingCallbackWrapper):
+        (WebInspector.ScriptsPanel.prototype.evaluateInSelectedCallFrame):
+        (WebInspector.ScriptsPanel.prototype._setPauseOnExceptions):
+        * inspector/front-end/inspector.js:
+        ():
+        (WebInspector.doLoadedDone.onPopulateScriptObjects):
+        (WebInspector.doLoadedDone.propertyNamesCallback):
+        (WebInspector.doLoadedDone):
+
+2011-03-11  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: split InjectedScriptHost into InjectedScriptManager and InjectedScriptHost
+        https://bugs.webkit.org/show_bug.cgi?id=56173
+
+        Moved all injected script managing logic into InjectedScriptManager which is owned by InspectorController.
+
+        * CMakeLists.txt:
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSInjectedScriptHostCustom.cpp:
+        * bindings/js/JSInjectedScriptManager.cpp: Added.
+        (WebCore::InjectedScriptManager::createInjectedScript):
+        (WebCore::InjectedScriptManager::discardInjectedScript):
+        (WebCore::InjectedScriptManager::injectedScriptFor):
+        (WebCore::InjectedScriptManager::canAccessInspectedWindow):
+        * bindings/v8/custom/V8InjectedScriptHostCustom.cpp:
+        * bindings/v8/custom/V8InjectedScriptManager.cpp: Copied from Source/WebCore/bindings/v8/custom/V8InjectedScriptHostCustom.cpp.
+        (WebCore::WeakReferenceCallback):
+        (WebCore::createInjectedScriptHostV8Wrapper):
+        (WebCore::InjectedScriptManager::createInjectedScript):
+        (WebCore::InjectedScriptManager::discardInjectedScript):
+        (WebCore::InjectedScriptManager::injectedScriptFor):
+        (WebCore::InjectedScriptManager::canAccessInspectedWindow):
+        * inspector/ConsoleMessage.cpp:
+        (WebCore::ConsoleMessage::addToFrontend):
+        * inspector/ConsoleMessage.h:
+        * inspector/InjectedScript.cpp:
+        (WebCore::InjectedScript::canAccessInspectedWindow):
+        * inspector/InjectedScript.h:
+        * inspector/InjectedScriptHost.cpp:
+        (WebCore::InjectedScriptHost::create):
+        (WebCore::InjectedScriptHost::InjectedScriptHost):
+        (WebCore::InjectedScriptHost::~InjectedScriptHost):
+        (WebCore::InjectedScriptHost::disconnect):
+        (WebCore::InjectedScriptHost::inspectImpl):
+        (WebCore::InjectedScriptHost::clearConsoleMessages):
+        (WebCore::InjectedScriptHost::databaseIdImpl):
+        (WebCore::InjectedScriptHost::storageIdImpl):
+        * inspector/InjectedScriptHost.h:
+        (WebCore::InjectedScriptHost::init):
+        (WebCore::InjectedScriptHost::setFrontend):
+        (WebCore::InjectedScriptHost::clearFrontend):
+        * inspector/InjectedScriptManager.cpp: Added.
+        (WebCore::InjectedScriptManager::create):
+        (WebCore::InjectedScriptManager::InjectedScriptManager):
+        (WebCore::InjectedScriptManager::~InjectedScriptManager):
+        (WebCore::InjectedScriptManager::disconnect):
+        (WebCore::InjectedScriptManager::injectedScriptHost):
+        (WebCore::InjectedScriptManager::injectedScriptForId):
+        (WebCore::InjectedScriptManager::injectedScriptForObjectId):
+        (WebCore::InjectedScriptManager::discardInjectedScripts):
+        (WebCore::InjectedScriptManager::releaseObjectGroup):
+        (WebCore::InjectedScriptManager::injectedScriptSource):
+        (WebCore::InjectedScriptManager::injectScript):
+        * inspector/InjectedScriptManager.h: Copied from Source/WebCore/inspector/InjectedScriptHost.h.
+        * inspector/Inspector.idl:
+        * inspector/InspectorAgent.cpp:
+        (WebCore::InspectorAgent::InspectorAgent):
+        (WebCore::InspectorAgent::inspectedPageDestroyed):
+        (WebCore::InspectorAgent::focusNode):
+        (WebCore::InspectorAgent::didClearWindowObjectInWorld):
+        (WebCore::InspectorAgent::createFrontendLifetimeAgents):
+        (WebCore::InspectorAgent::didCommitLoad):
+        (WebCore::InspectorAgent::domContentLoadedEventFired):
+        * inspector/InspectorAgent.h:
+        * inspector/InspectorBrowserDebuggerAgent.cpp:
+        * inspector/InspectorConsoleAgent.cpp:
+        (WebCore::InspectorConsoleAgent::InspectorConsoleAgent):
+        (WebCore::InspectorConsoleAgent::~InspectorConsoleAgent):
+        (WebCore::InspectorConsoleAgent::clearConsoleMessages):
+        (WebCore::InspectorConsoleAgent::addInspectedNode):
+        (WebCore::InspectorConsoleAgent::setConsoleMessagesEnabled):
+        (WebCore::InspectorConsoleAgent::addConsoleMessage):
+        * inspector/InspectorConsoleAgent.h:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::InspectorController):
+        (WebCore::InspectorController::connectFrontend):
+        (WebCore::InspectorController::disconnectFrontend):
+        * inspector/InspectorController.h:
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::InspectorDOMAgent):
+        (WebCore::InspectorDOMAgent::discardBindings):
+        (WebCore::InspectorDOMAgent::pushNodeToFrontend):
+        (WebCore::InspectorDOMAgent::resolveNode):
+        * inspector/InspectorDOMAgent.h:
+        (WebCore::InspectorDOMAgent::create):
+        * inspector/InspectorDebuggerAgent.cpp:
+        (WebCore::InspectorDebuggerAgent::create):
+        (WebCore::InspectorDebuggerAgent::InspectorDebuggerAgent):
+        (WebCore::InspectorDebuggerAgent::evaluateOnCallFrame):
+        (WebCore::InspectorDebuggerAgent::currentCallFrames):
+        * inspector/InspectorDebuggerAgent.h:
+        * inspector/InspectorRuntimeAgent.cpp:
+        (WebCore::InspectorRuntimeAgent::create):
+        (WebCore::InspectorRuntimeAgent::InspectorRuntimeAgent):
+        (WebCore::InspectorRuntimeAgent::~InspectorRuntimeAgent):
+        (WebCore::InspectorRuntimeAgent::evaluate):
+        (WebCore::InspectorRuntimeAgent::evaluateOn):
+        (WebCore::InspectorRuntimeAgent::getProperties):
+        (WebCore::InspectorRuntimeAgent::setPropertyValue):
+        (WebCore::InspectorRuntimeAgent::releaseObject):
+        (WebCore::InspectorRuntimeAgent::releaseObjectGroup):
+        * inspector/InspectorRuntimeAgent.h:
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.this.treeOutline.focusedNodeChanged):
+        (WebInspector.ElementsPanel):
+
+2011-03-11  Anton Muhin  <antonm@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        [v8] Change the way group id for CSS objects is calculated
+        https://bugs.webkit.org/show_bug.cgi?id=56117
+
+        Do not treat CSSStyleDeclarations under not CSSRule as belonging to the same object group
+        as they should not be reachable in JavaScript.
+
+        Covered by existing layout tests.  Fact of absence of retention is not trivial to prove.
+
+        * bindings/v8/V8GCController.cpp:
+        (WebCore::calculateGroupId):
+        (WebCore::DOMObjectGrouperVisitor::visitDOMWrapper):
+
+2011-03-11  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: hover over elements in Elements panel does not highlight nodes
+        https://bugs.webkit.org/show_bug.cgi?id=56121
+
+        In DOM trees with a comment and/or doctype preceding the HTML tag, the tree container right boundary
+        is 16px apart from the OL right boundary, and we miss the relevant LI by 4px. The fix is to compensate
+        for these 16px when computing the test point coordinates.
+
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeOutline.prototype._treeElementFromEvent):
+
+2011-03-11  Yury Semikhatsky  <yurys@chromium.org>
+
+        Unreviewed. Roll out r80837.
+
+        * CMakeLists.txt:
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSInjectedScriptHostCustom.cpp:
+        (WebCore::InjectedScriptHost::createInjectedScript):
+        (WebCore::InjectedScriptHost::discardInjectedScript):
+        (WebCore::InjectedScriptHost::injectedScriptFor):
+        (WebCore::InjectedScriptHost::canAccessInspectedWindow):
+        * bindings/js/JSInjectedScriptManager.cpp: Removed.
+        * bindings/v8/custom/V8InjectedScriptHostCustom.cpp:
+        (WebCore::WeakReferenceCallback):
+        (WebCore::createInjectedScriptHostV8Wrapper):
+        (WebCore::InjectedScriptHost::createInjectedScript):
+        (WebCore::InjectedScriptHost::discardInjectedScript):
+        (WebCore::InjectedScriptHost::injectedScriptFor):
+        (WebCore::InjectedScriptHost::canAccessInspectedWindow):
+        * bindings/v8/custom/V8InjectedScriptManager.cpp: Removed.
+        * inspector/ConsoleMessage.cpp:
+        (WebCore::ConsoleMessage::addToFrontend):
+        * inspector/ConsoleMessage.h:
+        * inspector/InjectedScript.cpp:
+        (WebCore::InjectedScript::canAccessInspectedWindow):
+        * inspector/InjectedScript.h:
+        * inspector/InjectedScriptHost.cpp:
+        (WebCore::InjectedScriptHost::InjectedScriptHost):
+        (WebCore::InjectedScriptHost::~InjectedScriptHost):
+        (WebCore::InjectedScriptHost::inspectImpl):
+        (WebCore::InjectedScriptHost::clearConsoleMessages):
+        (WebCore::InjectedScriptHost::databaseIdImpl):
+        (WebCore::InjectedScriptHost::storageIdImpl):
+        (WebCore::InjectedScriptHost::injectedScriptForId):
+        (WebCore::InjectedScriptHost::injectedScriptForObjectId):
+        (WebCore::InjectedScriptHost::injectedScriptForMainFrame):
+        (WebCore::InjectedScriptHost::discardInjectedScripts):
+        (WebCore::InjectedScriptHost::releaseObjectGroup):
+        (WebCore::InjectedScriptHost::frontend):
+        (WebCore::InjectedScriptHost::injectedScriptSource):
+        (WebCore::InjectedScriptHost::injectScript):
+        * inspector/InjectedScriptHost.h:
+        (WebCore::InjectedScriptHost::create):
+        (WebCore::InjectedScriptHost::inspectorAgent):
+        (WebCore::InjectedScriptHost::disconnectController):
+        * inspector/InjectedScriptManager.cpp: Removed.
+        * inspector/InjectedScriptManager.h: Removed.
+        * inspector/Inspector.idl:
+        * inspector/InspectorAgent.cpp:
+        (WebCore::InspectorAgent::InspectorAgent):
+        (WebCore::InspectorAgent::inspectedPageDestroyed):
+        (WebCore::InspectorAgent::focusNode):
+        (WebCore::InspectorAgent::didClearWindowObjectInWorld):
+        (WebCore::InspectorAgent::createFrontendLifetimeAgents):
+        (WebCore::InspectorAgent::didCommitLoad):
+        (WebCore::InspectorAgent::domContentLoadedEventFired):
+        * inspector/InspectorAgent.h:
+        (WebCore::InspectorAgent::injectedScriptHost):
+        * inspector/InspectorBrowserDebuggerAgent.cpp:
+        * inspector/InspectorConsoleAgent.cpp:
+        (WebCore::InspectorConsoleAgent::InspectorConsoleAgent):
+        (WebCore::InspectorConsoleAgent::~InspectorConsoleAgent):
+        (WebCore::InspectorConsoleAgent::clearConsoleMessages):
+        (WebCore::InspectorConsoleAgent::setConsoleMessagesEnabled):
+        (WebCore::InspectorConsoleAgent::addConsoleMessage):
+        * inspector/InspectorConsoleAgent.h:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::InspectorController):
+        (WebCore::InspectorController::connectFrontend):
+        (WebCore::InspectorController::disconnectFrontend):
+        * inspector/InspectorController.h:
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::InspectorDOMAgent):
+        (WebCore::InspectorDOMAgent::discardBindings):
+        (WebCore::InspectorDOMAgent::addInspectedNode):
+        (WebCore::InspectorDOMAgent::pushNodeToFrontend):
+        (WebCore::InspectorDOMAgent::resolveNode):
+        * inspector/InspectorDOMAgent.h:
+        (WebCore::InspectorDOMAgent::create):
+        * inspector/InspectorDebuggerAgent.cpp:
+        (WebCore::InspectorDebuggerAgent::create):
+        (WebCore::InspectorDebuggerAgent::InspectorDebuggerAgent):
+        (WebCore::InspectorDebuggerAgent::evaluateOnCallFrame):
+        (WebCore::InspectorDebuggerAgent::currentCallFrames):
+        * inspector/InspectorDebuggerAgent.h:
+        * inspector/InspectorRuntimeAgent.cpp:
+        (WebCore::InspectorRuntimeAgent::InspectorRuntimeAgent):
+        (WebCore::InspectorRuntimeAgent::~InspectorRuntimeAgent):
+        (WebCore::InspectorRuntimeAgent::evaluate):
+        (WebCore::InspectorRuntimeAgent::evaluateOn):
+        (WebCore::InspectorRuntimeAgent::getProperties):
+        (WebCore::InspectorRuntimeAgent::setPropertyValue):
+        (WebCore::InspectorRuntimeAgent::releaseObject):
+        (WebCore::InspectorRuntimeAgent::releaseObjectGroup):
+        * inspector/InspectorRuntimeAgent.h:
+        (WebCore::InspectorRuntimeAgent::create):
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.this.treeOutline.focusedNodeChanged):
+        (WebInspector.ElementsPanel):
+
+2011-03-11  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: split InjectedScriptHost into InjectedScriptManager and InjectedScriptHost
+        https://bugs.webkit.org/show_bug.cgi?id=56173
+
+        Moved all injected script managing logic into InjectedScriptManager which is owned by InspectorController.
+
+        * CMakeLists.txt:
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSInjectedScriptHostCustom.cpp:
+        * bindings/js/JSInjectedScriptManager.cpp: Added.
+        (WebCore::InjectedScriptManager::createInjectedScript):
+        (WebCore::InjectedScriptManager::discardInjectedScript):
+        (WebCore::InjectedScriptManager::injectedScriptFor):
+        (WebCore::InjectedScriptManager::canAccessInspectedWindow):
+        * bindings/v8/custom/V8InjectedScriptHostCustom.cpp:
+        * bindings/v8/custom/V8InjectedScriptManager.cpp: Copied from Source/WebCore/bindings/v8/custom/V8InjectedScriptHostCustom.cpp.
+        (WebCore::WeakReferenceCallback):
+        (WebCore::createInjectedScriptHostV8Wrapper):
+        (WebCore::InjectedScriptManager::createInjectedScript):
+        (WebCore::InjectedScriptManager::discardInjectedScript):
+        (WebCore::InjectedScriptManager::injectedScriptFor):
+        (WebCore::InjectedScriptManager::canAccessInspectedWindow):
+        * inspector/ConsoleMessage.cpp:
+        (WebCore::ConsoleMessage::addToFrontend):
+        * inspector/ConsoleMessage.h:
+        * inspector/InjectedScript.cpp:
+        (WebCore::InjectedScript::canAccessInspectedWindow):
+        * inspector/InjectedScript.h:
+        * inspector/InjectedScriptHost.cpp:
+        (WebCore::InjectedScriptHost::create):
+        (WebCore::InjectedScriptHost::InjectedScriptHost):
+        (WebCore::InjectedScriptHost::~InjectedScriptHost):
+        (WebCore::InjectedScriptHost::disconnect):
+        (WebCore::InjectedScriptHost::inspectImpl):
+        (WebCore::InjectedScriptHost::clearConsoleMessages):
+        (WebCore::InjectedScriptHost::databaseIdImpl):
+        (WebCore::InjectedScriptHost::storageIdImpl):
+        * inspector/InjectedScriptHost.h:
+        (WebCore::InjectedScriptHost::init):
+        (WebCore::InjectedScriptHost::setFrontend):
+        (WebCore::InjectedScriptHost::clearFrontend):
+        * inspector/InjectedScriptManager.cpp: Added.
+        (WebCore::InjectedScriptManager::create):
+        (WebCore::InjectedScriptManager::InjectedScriptManager):
+        (WebCore::InjectedScriptManager::~InjectedScriptManager):
+        (WebCore::InjectedScriptManager::disconnect):
+        (WebCore::InjectedScriptManager::injectedScriptHost):
+        (WebCore::InjectedScriptManager::injectedScriptForId):
+        (WebCore::InjectedScriptManager::injectedScriptForObjectId):
+        (WebCore::InjectedScriptManager::discardInjectedScripts):
+        (WebCore::InjectedScriptManager::releaseObjectGroup):
+        (WebCore::InjectedScriptManager::injectedScriptSource):
+        (WebCore::InjectedScriptManager::injectScript):
+        * inspector/InjectedScriptManager.h: Copied from Source/WebCore/inspector/InjectedScriptHost.h.
+        * inspector/Inspector.idl:
+        * inspector/InspectorAgent.cpp:
+        (WebCore::InspectorAgent::InspectorAgent):
+        (WebCore::InspectorAgent::inspectedPageDestroyed):
+        (WebCore::InspectorAgent::focusNode):
+        (WebCore::InspectorAgent::didClearWindowObjectInWorld):
+        (WebCore::InspectorAgent::createFrontendLifetimeAgents):
+        (WebCore::InspectorAgent::didCommitLoad):
+        (WebCore::InspectorAgent::domContentLoadedEventFired):
+        * inspector/InspectorAgent.h:
+        * inspector/InspectorBrowserDebuggerAgent.cpp:
+        * inspector/InspectorConsoleAgent.cpp:
+        (WebCore::InspectorConsoleAgent::InspectorConsoleAgent):
+        (WebCore::InspectorConsoleAgent::~InspectorConsoleAgent):
+        (WebCore::InspectorConsoleAgent::clearConsoleMessages):
+        (WebCore::InspectorConsoleAgent::addInspectedNode):
+        (WebCore::InspectorConsoleAgent::setConsoleMessagesEnabled):
+        (WebCore::InspectorConsoleAgent::addConsoleMessage):
+        * inspector/InspectorConsoleAgent.h:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::InspectorController):
+        (WebCore::InspectorController::connectFrontend):
+        (WebCore::InspectorController::disconnectFrontend):
+        * inspector/InspectorController.h:
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::InspectorDOMAgent):
+        (WebCore::InspectorDOMAgent::discardBindings):
+        (WebCore::InspectorDOMAgent::pushNodeToFrontend):
+        (WebCore::InspectorDOMAgent::resolveNode):
+        * inspector/InspectorDOMAgent.h:
+        (WebCore::InspectorDOMAgent::create):
+        * inspector/InspectorDebuggerAgent.cpp:
+        (WebCore::InspectorDebuggerAgent::create):
+        (WebCore::InspectorDebuggerAgent::InspectorDebuggerAgent):
+        (WebCore::InspectorDebuggerAgent::evaluateOnCallFrame):
+        (WebCore::InspectorDebuggerAgent::currentCallFrames):
+        * inspector/InspectorDebuggerAgent.h:
+        * inspector/InspectorRuntimeAgent.cpp:
+        (WebCore::InspectorRuntimeAgent::create):
+        (WebCore::InspectorRuntimeAgent::InspectorRuntimeAgent):
+        (WebCore::InspectorRuntimeAgent::~InspectorRuntimeAgent):
+        (WebCore::InspectorRuntimeAgent::evaluate):
+        (WebCore::InspectorRuntimeAgent::evaluateOn):
+        (WebCore::InspectorRuntimeAgent::getProperties):
+        (WebCore::InspectorRuntimeAgent::setPropertyValue):
+        (WebCore::InspectorRuntimeAgent::releaseObject):
+        (WebCore::InspectorRuntimeAgent::releaseObjectGroup):
+        * inspector/InspectorRuntimeAgent.h:
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.this.treeOutline.focusedNodeChanged):
+        (WebInspector.ElementsPanel):
+
+2011-03-09  Hans Wennborg  <hans@chromium.org>
+
+        Reviewed by Jeremy Orlow.
+
+        IndexedDB: Make IDBBackingStore abstract
+        https://bugs.webkit.org/show_bug.cgi?id=56013
+
+        Make IDBBackingStore abstract to allow for multiple implementations.
+        Move the SQLite implementation to IDBSQLiteBackingStore.
+
+        No new tests: refactoring only.
+
+        * WebCore.gypi:
+        * storage/IDBBackingStore.h:
+        (WebCore::IDBBackingStore::~IDBBackingStore):
+        * storage/IDBFactoryBackendImpl.cpp:
+        (WebCore::IDBFactoryBackendImpl::open):
+        * storage/IDBSQLiteBackingStore.cpp:
+        (WebCore::IDBSQLiteBackingStore::IDBSQLiteBackingStore):
+        (WebCore::IDBSQLiteBackingStore::~IDBSQLiteBackingStore):
+        (WebCore::runCommands):
+        (WebCore::createTables):
+        (WebCore::createMetaDataTable):
+        (WebCore::getDatabaseSchemaVersion):
+        (WebCore::migrateDatabase):
+        (WebCore::IDBSQLiteBackingStore::open):
+        (WebCore::IDBSQLiteBackingStore::extractIDBDatabaseMetaData):
+        (WebCore::IDBSQLiteBackingStore::setIDBDatabaseMetaData):
+        (WebCore::IDBSQLiteBackingStore::getObjectStores):
+        (WebCore::IDBSQLiteBackingStore::createObjectStore):
+        (WebCore::doDelete):
+        (WebCore::IDBSQLiteBackingStore::deleteObjectStore):
+        (WebCore::whereSyntaxForKey):
+        (WebCore::bindKeyToQuery):
+        (WebCore::lowerCursorWhereFragment):
+        (WebCore::upperCursorWhereFragment):
+        (WebCore::IDBSQLiteBackingStore::getObjectStoreRecord):
+        (WebCore::bindKeyToQueryWithNulls):
+        (WebCore::IDBSQLiteBackingStore::putObjectStoreRecord):
+        (WebCore::IDBSQLiteBackingStore::clearObjectStore):
+        (WebCore::IDBSQLiteBackingStore::deleteObjectStoreRecord):
+        (WebCore::IDBSQLiteBackingStore::nextAutoIncrementNumber):
+        (WebCore::IDBSQLiteBackingStore::keyExistsInObjectStore):
+        (WebCore::IDBSQLiteBackingStore::forEachObjectStoreRecord):
+        (WebCore::IDBSQLiteBackingStore::getIndexes):
+        (WebCore::IDBSQLiteBackingStore::createIndex):
+        (WebCore::IDBSQLiteBackingStore::deleteIndex):
+        (WebCore::IDBSQLiteBackingStore::putIndexDataForRecord):
+        (WebCore::IDBSQLiteBackingStore::deleteIndexDataForRecord):
+        (WebCore::IDBSQLiteBackingStore::getObjectViaIndex):
+        (WebCore::keyFromQuery):
+        (WebCore::IDBSQLiteBackingStore::getPrimaryKeyViaIndex):
+        (WebCore::IDBSQLiteBackingStore::keyExistsInIndex):
+        (WebCore::IDBSQLiteBackingStore::openObjectStoreCursor):
+        (WebCore::IDBSQLiteBackingStore::openIndexKeyCursor):
+        (WebCore::IDBSQLiteBackingStore::openIndexCursor):
+        (WebCore::IDBSQLiteBackingStore::createTransaction):
+        * storage/IDBSQLiteBackingStore.h: Added.
+
+2011-03-11  Gyuyoung Kim  <gyuyoung.kim@samsung.com>
+
+        Unreviewed build error fix.
+
+        [EFL] Fix build break when SHARED_CORE is ON
+        https://bugs.webkit.org/show_bug.cgi?id=56155
+
+        * platform/efl/ContextMenuEfl.cpp:
+        (WebCore::ContextMenu::ContextMenu):
+        * platform/efl/ContextMenuItemEfl.cpp:
+        (WebCore::ContextMenuItem::nativeMenuItem):
+        (WebCore::ContextMenuItem::ContextMenuItem):
+        (WebCore::ContextMenuItem::~ContextMenuItem):
+
+2011-03-11  Andrey Kosyakov  <caseq@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: resource load cancellation is reported to console as an error
+        https://bugs.webkit.org/show_bug.cgi?id=55764
+
+        - mark interruptionForPolicyChangeError as cancellation
+        - do not log resource cancelation as an error
+        - always push resource to front-end before console message, so front-end can use resource info while formatting message.
+
+        * inspector/InspectorConsoleAgent.cpp:
+        (WebCore::InspectorConsoleAgent::didFailLoading):
+        * inspector/InspectorInstrumentation.cpp:
+        (WebCore::InspectorInstrumentation::didReceiveResourceResponseImpl):
+        (WebCore::InspectorInstrumentation::didFailLoadingImpl):
+        * loader/MainResourceLoader.cpp:
+        (WebCore::MainResourceLoader::stopLoadingForPolicyChange):
+
+2011-03-10  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: Get rid of has/add/removeStyleClass() methods on Element.prototype - Step 1
+        https://bugs.webkit.org/show_bug.cgi?id=56096
+
+        No new tests, as this is a refactoring.
+
+        * inspector/front-end/BreakpointsSidebarPane.js:
+        (WebInspector.EventListenerBreakpointsSidebarPane):
+        * inspector/front-end/DetailedHeapshotView.js:
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel):
+        (WebInspector.BaseStorageTreeElement):
+        (WebInspector.BaseStorageTreeElement.prototype.onattach):
+        (WebInspector.StorageCategoryTreeElement):
+        (WebInspector.FrameTreeElement):
+        (WebInspector.FrameResourceTreeElement):
+        (WebInspector.DatabaseTreeElement):
+        (WebInspector.DatabaseTableTreeElement):
+        (WebInspector.DOMStorageTreeElement):
+        (WebInspector.CookieTreeElement):
+        (WebInspector.ApplicationCacheTreeElement):
+        (WebInspector.ResourceRevisionTreeElement):
+        * inspector/front-end/utilities.js:
+        (Element.prototype.removeStyleClass):
+        (Element.prototype.addStyleClass):
+        (Element.prototype.hasStyleClass):
+
+2011-03-11  Brian Salomon  <bsalomon@google.com>
+
+        Reviewed by Kenneth Russell.
+
+        Adds GrContext flush call to PlatformContextSkia destructor. 
+Calls GrContext flush with int parameter instead of bool due to skia 
+revision.       
+
+        No new tests needed.
+
+        * platform/graphics/chromium/DrawingBufferChromium.cpp:
+        (WebCore::DrawingBuffer::publishToPlatformLayer):
+        * platform/graphics/skia/PlatformContextSkia.cpp:
+        (WebCore::PlatformContextSkia::~PlatformContextSkia):
+        (WebCore::PlatformContextSkia::setSharedGraphicsContext3D):
+
+2011-03-10  Chris Guillory  <chris.guillory@google.com>
+
+        Reviewed by James Robinson.
+
+        Fix for Coverity discovered NO_EFFECT (self-assign) defect.
+        https://bugs.webkit.org/show_bug.cgi?id=54143
+
+        * platform/graphics/gpu/TilingData.cpp:
+        (WebCore::TilingData::setMaxTextureSize):
+
+2011-03-10  Emil A Eklund  <eae@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        The web colours palevioletred and mediumpurple are incorrect
+        https://bugs.webkit.org/show_bug.cgi?id=46658
+
+        Changed value for the palevioletred and mediumpurple colors to match
+        the css3 specification.
+
+        Test: fast/css/named-colors.html
+
+        * inspector/front-end/Color.js:
+        * platform/ColorData.gperf:
+
+2011-03-10  Gyuyoung Kim  <gyuyoung.kim@samsung.com>
+
+        Unreviewed build fix.
+
+        [WML] Fix build error
+        https://bugs.webkit.org/show_bug.cgi?id=56078
+
+        * wml/WMLInputElement.cpp:
+        (WebCore::WMLInputElement::defaultEventHandler):
+
+2011-03-10  Jeremy Moskovich  <jeremy@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Fix navigation menus on a bunch of sites in WebKit.
+        https://bugs.webkit.org/show_bug.cgi?id=52535
+
+        WebKit doesn't support position:relative for several table elements and
+        overwrites the style internally when position:relative is encountered.
+        Unfortunately position:relative affects the choice of nodes returned by
+        offsetParent.
+
+        This CL adds a bit to RenderStyle to track whether position:relative was
+        overwritten.  The value is then consulted in offsetParent which makes us
+        match FF/IE.
+
+        Tests: fast/block/positioning/offsetLeft-relative-iframe.html
+               fast/block/positioning/offsetLeft-relative-td.html
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::adjustRenderStyle):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::isOriginallyRelPositioned):
+        (WebCore::RenderObject::offsetParent):
+        * rendering/RenderObject.h:
+        * rendering/style/RenderStyle.h: Add a bit to track the original value of position:relative.
+        (WebCore::InheritedFlags::positionWasRelative):
+        (WebCore::InheritedFlags::setPositionWasRelative):
+        * rendering/style/StyleRareNonInheritedData.cpp:
+        (WebCore::StyleRareNonInheritedData::StyleRareNonInheritedData):
+        (WebCore::StyleRareNonInheritedData::operator==):
+        * rendering/style/StyleRareNonInheritedData.h:
+
+2011-03-10  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        REGRESSION (r66428/r71892): Crash after assertion failure (!m_reachedTerminalState) in ResourceLoader::didCancel()
+        https://bugs.webkit.org/show_bug.cgi?id=51357
+
+        Previously, we would try to print from a callstack that didn't want a
+        nested event loop, leading to re-entrancy problems.  In this patch, we
+        complete the print call asynchronously, giving us a clean stack on
+        which to run the nested event loop.
+
+        Test: printing/print-close-crash.html
+
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::DOMWindow):
+        (WebCore::DOMWindow::print):
+        (WebCore::DOMWindow::printTimerFired):
+        * page/DOMWindow.h:
+
+2011-03-11  Roland Steiner  <rolandsteiner@chromium.org>
+
+        Reviewed by Ryosuke Niwa.
+
+        Bug 55570 - Remove dependency of dom/InputElement.cpp on html/ and wml/
+        https://bugs.webkit.org/show_bug.cgi?id=55570
+
+        Add a virtual function toInputElement() to Node that has a default
+        implementation of returning 0.
+        For HTMLInputElement and WMLInputElement (which derive from InputElement)
+        override this to return the object.
+        Change all calling sites of the old toInputElement to use the new member
+        function. This also allows us to save some casts.
+
+        No new tests. (refactoring)
+
+        * WebCore.exp.in:
+        * accessibility/AXObjectCache.cpp:
+        (WebCore::AXObjectCache::textMarkerDataForVisiblePosition):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::isPasswordField):
+        (WebCore::AccessibilityRenderObject::isIndeterminate):
+        (WebCore::AccessibilityRenderObject::isNativeCheckboxOrRadio):
+        (WebCore::AccessibilityRenderObject::isChecked):
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::canShareStyleWithElement):
+        (WebCore::CSSStyleSelector::SelectorChecker::checkOneSelector):
+        * dom/CheckedRadioButtons.cpp:
+        (WebCore::CheckedRadioButtons::removeButton):
+        * dom/InputElement.cpp:
+        * dom/InputElement.h:
+        * dom/Node.cpp:
+        (WebCore::Node::toInputElement):
+        * dom/Node.h:
+        * html/HTMLInputElement.h:
+        (WebCore::HTMLInputElement::toInputElement):
+        * rendering/RenderTextControlSingleLine.cpp:
+        (WebCore::RenderTextControlSingleLine::inputElement):
+        * rendering/RenderTheme.cpp:
+        (WebCore::RenderTheme::isChecked):
+        (WebCore::RenderTheme::isIndeterminate):
+        * wml/WMLInputElement.h:
+        (WebCore::WMLInputElement::toInputElement):
+
+2011-03-10  Gyuyoung Kim  <gyuyoung.kim@samsung.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [EFL] New mediaControl css file for EFL
+        https://bugs.webkit.org/show_bug.cgi?id=55460
+
+        Add new mediaControl css file for html5 video UI.
+
+        * CMakeLists.txt:
+        * CMakeListsEfl.txt:
+        * css/mediaControlsEfl.css: Added.
+        (audio):
+        (audio::-webkit-media-controls-panel, video::-webkit-media-controls-panel):
+        (video:-webkit-full-page-media::-webkit-media-controls-panel):
+        (audio::-webkit-media-controls-mute-button, video::-webkit-media-controls-mute-button):
+        (audio::-webkit-media-controls-play-button, video::-webkit-media-controls-play-button):
+        (audio::-webkit-media-controls-timeline-container, video::-webkit-media-controls-timeline-container):
+        (audio::-webkit-media-controls-current-time-display, video::-webkit-media-controls-current-time-display):
+        (audio::-webkit-media-controls-time-remaining-display, video::-webkit-media-controls-time-remaining-display):
+        (audio::-webkit-media-controls-timeline, video::-webkit-media-controls-timeline):
+        (audio::-webkit-media-controls-volume-slider-container, video::-webkit-media-controls-volume-slider-container):
+        (audio::-webkit-media-controls-volume-slider, video::-webkit-media-controls-volume-slider):
+        (audio::-webkit-media-controls-seek-back-button, video::-webkit-media-controls-seek-back-button):
+        (audio::-webkit-media-controls-seek-forward-button, video::-webkit-media-controls-seek-forward-button):
+        (audio::-webkit-media-controls-fullscreen-button, video::-webkit-media-controls-fullscreen-button):
+        (audio::-webkit-media-controls-rewind-button, video::-webkit-media-controls-rewind-button):
+        (audio::-webkit-media-controls-return-to-realtime-button, video::-webkit-media-controls-return-to-realtime-button):
+        (audio::-webkit-media-controls-toggle-closed-captions-button, video::-webkit-media-controls-toggle-closed-captions-button):
+        (audio::-webkit-media-controls-volume-slider-mute-button, video::-webkit-media-controls-volume-slider-mute-button):
+        * platform/efl/RenderThemeEfl.cpp:
+        (WebCore::RenderThemeEfl::extraMediaControlsStyleSheet):
+
+2011-03-10  Emil A Eklund  <eae@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        style.display affecting the initial selectedIndex value of a <select> when its multiple attribute is set programatically
+        https://bugs.webkit.org/show_bug.cgi?id=53860
+
+        Preserve selection when changing between multi-select and single-select
+        for <select> boxes even if it has not yet been rendered.
+
+        Test: fast/dom/HTMLSelectElement/change-multiple-preserve-selection.html
+
+        * html/HTMLSelectElement.cpp:
+        (WebCore::HTMLSelectElement::setMultiple):
+
+2011-03-10  Ojan Vafai  <ojan@chromium.org>
+
+        Reviewed by Tony Chang.
+
+        update comment to reference new DOM Core spec
+        https://bugs.webkit.org/show_bug.cgi?id=56079
+
+        I'm excising all instances of WRONG_DOCUMENT_ERR from WebKit.
+        This is the only one that's actually specified to fire
+        in the latest DOM Core spec.
+
+        * dom/DOMImplementation.cpp:
+        (WebCore::DOMImplementation::createDocument):
+
+2011-03-10  Rik Cabanier  <cabanier@gmail.com>
+
+        Reviewed by Tony Gentilcore.
+
+        Fix that allows fixed length values to be floating point
+        https://bugs.webkit.org/show_bug.cgi?id=52699
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * css/CSSStyleSelector.cpp:
+        (WebCore::convertToLength):
+        (WebCore::convertToIntLength):
+        (WebCore::convertToFloatLength):
+        (WebCore::CSSStyleSelector::applyProperty):
+        (WebCore::CSSStyleSelector::createTransformOperations):
+        * platform/Length.h:
+        (WebCore::Length::Length):
+        (WebCore::Length::operator==):
+        (WebCore::Length::operator!=):
+        (WebCore::Length::rawValue):
+        (WebCore::Length::type):
+        (WebCore::Length::quirk):
+        (WebCore::Length::setValue):
+        (WebCore::Length::calcFloatValue):
+        (WebCore::Length::isZero):
+        (WebCore::Length::blend):
+        (WebCore::Length::getIntValue):
+        (WebCore::Length::getFloatValue):
+        * rendering/AutoTableLayout.cpp:
+        (WebCore::AutoTableLayout::recalcColumn):
+        (WebCore::AutoTableLayout::calcEffectiveLogicalWidth):
+        * rendering/FixedTableLayout.cpp:
+        (WebCore::FixedTableLayout::calcWidthArray):
+
+2011-03-10  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r80800.
+        http://trac.webkit.org/changeset/80800
+        https://bugs.webkit.org/show_bug.cgi?id=56163
+
+        Caused hundreds of tests to crash on Windows 7 (Requested by
+        rniwa on #webkit).
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::mouseMoved):
+        (WebCore::EventHandler::updateMouseEventTargetNode):
+        * page/FocusController.cpp:
+        (WebCore::FocusController::setActive):
+        * page/FrameView.cpp:
+        (WebCore::FrameView::FrameView):
+        (WebCore::FrameView::~FrameView):
+        * page/FrameView.h:
+        * page/Page.cpp:
+        * page/Page.h:
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::wheelEvent):
+        * platform/ScrollView.h:
+        * rendering/RenderDataGrid.cpp:
+        (WebCore::RenderDataGrid::RenderDataGrid):
+        (WebCore::RenderDataGrid::~RenderDataGrid):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::RenderLayer):
+        (WebCore::RenderLayer::~RenderLayer):
+        * rendering/RenderLayer.h:
+        * rendering/RenderListBox.cpp:
+        (WebCore::RenderListBox::RenderListBox):
+        (WebCore::RenderListBox::~RenderListBox):
+
+2011-03-10  Alice Boxhall  <aboxhall@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        NULL pointer crash when using :empty and :first-line pseudoclass selectors together
+        https://bugs.webkit.org/show_bug.cgi?id=53316
+
+        :empty is calculated for each element during parsing, but then not 
+        recalculated after any child elements are attached. Force style 
+        re-calculation on elements which have :empty in their style when
+        their children are changed.
+
+        Test: fast/css/empty-first-line-crash.html
+
+        * dom/Element.cpp:
+        (WebCore::checkForEmptyStyleChange): Pull out empty style checking
+        logic from checkForSiblingStyleChanges().
+        (WebCore::checkForSiblingStyleChanges): Use new checkForEmptyStyleChanges()
+        method.
+        (WebCore::Element::childrenChanged):  Call checkForEmptyStyleChanges() when
+        called with changedByParser = true.
+
+2011-03-10  Emil A Eklund  <eae@chromium.org>
+
+        Unreviewed build fix.
+
+        Fix Leopard Release build broken by r80797.
+
+        * html/CollectionCache.h:
+
+2011-03-10  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fix for <rdar://problem/8944558> Overlay scrollers in overflow areas need to 
+        send notifications appropriate times (showing up, resizing)
+        -and corresponding-
+        https://bugs.webkit.org/show_bug.cgi?id=56067
+
+        The general strategy here is to add a HashSet of ScrollableAreas to the page that 
+        can be accessed when necessary to send notifications to all ScrollableAreas.
+
+        Find layers for relevant node and if the layers are in the Page's ScrollableArea 
+        set, then send the relevant notification.
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::mouseMoved):
+        (WebCore::EventHandler::updateMouseEventTargetNode):
+
+        When the page is set active or not active, iterate through the Page's 
+        ScrollableAreas to send hide/show notifications. 
+        * page/FocusController.cpp:
+        (WebCore::FocusController::setActive):
+
+        When a FrameView is created, add it to the ScrollableArea set. When it's 
+        destroyed, remove it.
+        * page/FrameView.cpp:
+        (WebCore::FrameView::FrameView):
+        (WebCore::FrameView::~FrameView):
+
+        Iterate through the Page's ScrollableAreas to send the paint notification.
+        (WebCore::FrameView::notifyPageThatContentAreaWillPaint):
+        * page/FrameView.h:
+
+        Add the new ScrollableArea set.
+        * page/Page.cpp:
+        (WebCore::Page::addScrollableArea):
+        (WebCore::Page::removeScrollableArea):
+        (WebCore::Page::pageContainsScrollableArea):
+        * page/Page.h:
+        (WebCore::Page::scrollableAreaSet):
+
+        notifyPageThatContentAreaWillPaint() is a dummy function implemented in FrameView.
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::notifyPageThatContentAreaWillPaint):
+
+        Call notifyPageThatContentAreaWillPaint() instead of calling 
+        contentAreaWillPaint() just for the ScrollView.
+        (WebCore::ScrollView::paint):
+        * platform/ScrollView.h:
+
+        Add/remove ScrollableAreas to the set.
+        * rendering/RenderDataGrid.cpp:
+        (WebCore::RenderDataGrid::RenderDataGrid):
+        (WebCore::RenderDataGrid::~RenderDataGrid):
+        * rendering/RenderListBox.cpp:
+        (WebCore::RenderListBox::RenderListBox):
+        (WebCore::RenderListBox::~RenderListBox):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::RenderLayer):
+        (WebCore::RenderLayer::~RenderLayer):
+
+        Should have implemented this ScrollableArea-interface function a while ago.
+        (WebCore::RenderLayer::currentMousePosition):
+        * rendering/RenderLayer.h:
+
+2011-03-10  takano takumi  <takano@apple.com>
+
+        Reviewed by David Hyatt.
+
+        Crash in RenderCombineText::combineText when running fast/text/international/text-combine-parser-test.html on Windows with full page heap enabled
+        https://bugs.webkit.org/show_bug.cgi?id=55069
+
+        No new tests. If the test above runs without crash, the fix should be okay.
+
+        * dom/Node.cpp:
+        (WebCore::Node::diff):
+        - Changed to return Detach when textCombine style was changed.
+        * rendering/RenderCombineText.cpp:
+        (WebCore::RenderCombineText::styleDidChange):
+        (WebCore::RenderCombineText::setTextInternal):
+        (WebCore::RenderCombineText::width):
+        (WebCore::RenderCombineText::adjustTextOrigin):
+        (WebCore::RenderCombineText::charactersToRender):
+        (WebCore::RenderCombineText::combineText):
+        - Added assertions to ensure the passed object is RenderCombineText.
+        * rendering/RenderCombineText.h:
+        (WebCore::RenderCombineText::isCombineText):
+        - Added to distinguish plain RenderText and RenderCombineText.
+        (WebCore::toRenderCombineText):
+        - Added assertions to ensure the passed object is RenderCombineText.
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::isCombineText):
+        - Added to distinguish plain RenderText and RenderCombineText.
+
+2011-03-10  Emil A Eklund  <eae@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Collection cache not reset when moving base node between documents
+        https://bugs.webkit.org/show_bug.cgi?id=55446
+
+        Fix bug where HTMLCollection::resetCollectionInfo does not reset the
+        cache when the base node is moved to a different document by making sure
+        that the DOMVersion is updated and that it's unique across documents.
+
+        Tests: fast/dom/HTMLFormElement/invalid-form-field.html
+               fast/dom/HTMLFormElement/move-option-between-documents.html
+               fast/dom/collection-nameditem-move-between-documents.html
+
+        * dom/Document.cpp:
+        (WebCore::Document::Document):
+        * dom/Document.h:
+        (WebCore::Document::incDOMTreeVersion):
+        (WebCore::Document::domTreeVersion):
+        * dom/Node.cpp:
+        (WebCore::Node::setDocumentRecursively):
+        * html/FormAssociatedElement.cpp:
+        (WebCore::FormAssociatedElement::resetFormOwner):
+        * html/HTMLCollection.cpp:
+        (WebCore::HTMLCollection::resetCollectionInfo):
+        * xml/XPathResult.h:
+
+2011-03-10  Gyuyoung Kim  <gyuyoung.kim@samsung.com>
+
+        Unreviewed build fix.
+
+        [EFL] Fix build break when CROSS_PLATFORM_CONTEXT_MENUS is disabled.
+        https://bugs.webkit.org/show_bug.cgi?id=56005
+
+        There are build breaks when CROSS_PLATFORM_CONTEXT_MENUS is disabled.
+
+        * platform/efl/ContextMenuEfl.cpp:
+        (WebCore::ContextMenu::ContextMenu):
+        * platform/efl/ContextMenuItemEfl.cpp:
+
+2011-03-10  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Tony Chang.
+
+        startOfBlock and endOfBlock may return a position inside hr
+        https://bugs.webkit.org/show_bug.cgi?id=56025
+
+        Replaced calls to enclosingBlockFlowElement in startOfBlock and endOfBlock by
+        calls to enclosingBlock. Added EditingBoundaryCrossingRule to the argument lists
+        of startOfBlock, endOfBlock, and enclosingBlock. Also replaced the last boolean
+        argument variable of enclosingNodeOfType by EditingBoundaryCrossingRule.
+
+        Also replaced calls to enclosingBlockFlowElement in inSameBlock by calls to
+        enclosingBlock to be consitent with startOfBlock and endOfBlock.
+
+        This patch also replaced calls to deprecatedNode in startOfBlock, endOfBlock,
+        and inSameBlock by calls to containerNode because the enclosing block of a position
+        should never be before or after the position.
+
+        No tests are added because this change only affects WebCore internally.
+
+        * editing/DeleteSelectionCommand.cpp:
+        (WebCore::DeleteSelectionCommand::initializePositionData): Calls enclosingNodeOfType.
+        Pass CanCrossEditingBoundary instead of false.
+        * editing/htmlediting.cpp:
+        (WebCore::unsplittableElementForPosition): Ditto.
+        (WebCore::enclosingBlock): Takes EditingBoundaryCrossingRule and passes it to
+        enclosingNodeOfType.
+        (WebCore::enclosingNodeOfType): Takes EditingBoundaryCrossingRule instead of boolean.
+        Fixed a bug that it stops walking the tree when it reached the root editable node
+        even when the editing boundary crossing rule is CanCrossEditingBoundary.
+        * editing/htmlediting.h: Prototype changes.
+        * editing/visible_units.cpp:
+        (WebCore::startOfBlock): Calls enclosingBlock instead of enclosingBlockFlowElement.
+        Also added an early exit when there's no enclosing block.
+        (WebCore::endOfBlock): Ditto. The early exist in this case prevents crash in
+        lastPositionInNode.
+        (WebCore::inSameBlock): Calls enclosingBlock instead of enclosingBlockFlowElement.
+        (WebCore::isStartOfBlock): Calls startOfBlock with CanCrossEditingBoundary because
+        we don't care where the start of block is when we're comparing against the given position.
+        (WebCore::isEndOfBlock): Ditto.
+        * editing/visible_units.h:
+
+2011-03-10  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Backspace deletes all non-BMP symbols at once, and then some
+        https://bugs.webkit.org/show_bug.cgi?id=55971
+        <rdar://problem/8725312>
+
+        Test: platform/mac/editing/input/insert-delete-smp-symbol.html
+
+        * rendering/RenderText.cpp:
+        (WebCore::isMark): This matches what Core Foundation does for all characters that I tested.
+        (WebCore::RenderText::previousOffsetForBackwardDeletion): Changed to use isMark().
+
+2011-03-10  Chris Evans  <cevans@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Error in StyleElement::process with large nodesets
+        https://bugs.webkit.org/show_bug.cgi?id=56150
+
+        Test: none due to excessive runtime and CRASH() vs. real crash.
+
+        * dom/StyleElement.cpp:
+        (WebCore::StyleElement::process): Handle large node sets better.
+
+2011-03-10  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=47151
+        
+        Percentage heights should skip anonymous containing blocks when computing the used value.
+
+        Added fast/block/basic/percentage-height-inside-anonymous-block.html
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::computePercentageLogicalHeight):
+
+2011-03-10  Nat Duca  <nduca@chromium.org>
+
+        Reviewed by James Robinson.
+
+        [chromium] Make updateAndDrawLayers argumentless.
+        https://bugs.webkit.org/show_bug.cgi?id=55985
+
+        Made the TilePainters and viewport parameters for
+        LayerRendererChromium member variables instead of arguments on
+        updateAndDrawLayers. In a future change, this will allows us to
+        draw the layer tree without the WebView's assistance.
+
+        * platform/graphics/chromium/LayerRendererChromium.cpp:
+        (WebCore::LayerRendererChromium::create):
+        (WebCore::LayerRendererChromium::LayerRendererChromium):
+        (WebCore::LayerRendererChromium::verticalScrollbarRect):
+        (WebCore::LayerRendererChromium::horizontalScrollbarRect):
+        (WebCore::LayerRendererChromium::invalidateRootLayerRect):
+        (WebCore::LayerRendererChromium::updateRootLayerContents):
+        (WebCore::LayerRendererChromium::updateRootLayerScrollbars):
+        (WebCore::LayerRendererChromium::drawRootLayer):
+        (WebCore::LayerRendererChromium::setViewport):
+        (WebCore::LayerRendererChromium::updateAndDrawLayers):
+        (WebCore::LayerRendererChromium::updateLayers):
+        (WebCore::LayerRendererChromium::drawLayers):
+        (WebCore::LayerRendererChromium::setRootLayer):
+        (WebCore::LayerRendererChromium::getFramebufferPixels):
+        (WebCore::LayerRendererChromium::cleanupSharedObjects):
+        * platform/graphics/chromium/LayerRendererChromium.h:
+        (WebCore::LayerRendererChromium::viewportSize):
+        * platform/graphics/chromium/cc/CCHeadsUpDisplay.cpp:
+        (WebCore::CCHeadsUpDisplay::draw):
+
+2011-01-25  Martin Robinson  <mrobinson@igalia.com>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] Implement spin buttons for GTK+ 2.x
+        https://bugs.webkit.org/show_bug.cgi?id=53098
+
+        Implement spin buttons for GTK+ 2.x. This allows proper render and functioning
+        for input type=number. The implementation is based on the one in gtkspinbutton.c
+        from the GTK+ sources.
+
+        * platform/gtk/RenderThemeGtk.h: Added new members and getters.
+        * platform/gtk/RenderThemeGtk2.cpp:
+        (WebCore::RenderThemeGtk::platformInit): Initialize spin button widget.
+        (WebCore::RenderThemeGtk::adjustRepaintRect): We need to draw outside the
+        spin button area to have proper rendering. There doesn't seem to be any other
+        clean way of having spin buttons that are the size of the text input frame.
+        (WebCore::RenderThemeGtk::adjustInnerSpinButtonStyle): Added implementation.
+        (WebCore::RenderThemeGtk::paintInnerSpinButton): Ditto.
+        (WebCore::RenderThemeGtk::gtkSpinButton): Added.
+
+2011-03-10  Levi Weintraub  <leviw@chromium.org>
+
+        Reviewed by Ryosuke Niwa.
+
+        InsertUnorderedList over a non-editable region and multiple lines enters an infinite loop
+        https://bugs.webkit.org/show_bug.cgi?id=53409
+
+        Fixing broken handling of mixed-editability content for InsertListCommand. Previously, if the selection
+        spanned non-contenteditable regions, it would get stuck endlessly iterating the same region as the algorithm
+        didn't skip the editable boundary.
+
+        Test: editing/execCommand/insert-list-with-noneditable-content.html
+
+        * editing/CompositeEditCommand.cpp:
+        (WebCore::CompositeEditCommand::cleanupAfterDeletion): Changed signature to take the destination
+        position for the active editing command. Without this, there are cases when the destination happens
+        to be a placeholder, and we remove it.
+        (WebCore::CompositeEditCommand::moveParagraphs):
+        * editing/CompositeEditCommand.h:
+        * editing/InsertListCommand.cpp:
+        (WebCore::InsertListCommand::doApply): Added logic to the paragraph iteration loop to handle pockets of
+        non-editable content in an editable context. Previously, this could cause an infinite loop.
+        * editing/visible_units.cpp:
+        (WebCore::startOfParagraph): Added a mode of operation where we'll jump across non-editable
+        content in the same paragraph to reach the actual editable paragraph start.
+        (WebCore::endOfParagraph): Ditto.
+        (WebCore::startOfNextParagraph): Now uses the aforementioned non-editable content skipping mode of
+        endOfParagraph.
+
+2011-03-10  Berend-Jan Wever  <skylined@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Calling focus() on an area element not in a document should not cause a NULL ptr crash
+        https://bugs.webkit.org/show_bug.cgi?id=54877
+
+        Test: fast/dom/HTMLAreaElement/area-islink-focus-null-ptr-crash.html
+
+        * dom/Element.cpp:
+        (WebCore::Element::focus): Check element is in the document before allowing focus
+        * html/HTMLAreaElement.cpp: 
+        (WebCore::HTMLAreaElement::imageElement): Check element has a parent before checking if its parent is a map
+
+2011-03-10  Xiyuan Xia  <xiyuan@chromium.org>
+
+        Reviewed by Tony Chang.
+
+        [Chromium] Fix default single selection select's popup background on chromium/linux
+        https://bugs.webkit.org/show_bug.cgi?id=56023
+
+        Test: fast/html/select-dropdown-consistent-background-color.html
+
+        * css/themeChromiumLinux.css:
+
+2011-03-10  Kris Jordan  <krisjordan@gmail.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Improve default Accept header to give preference to HTML over XML.
+        https://bugs.webkit.org/show_bug.cgi?id=27267
+
+        * loader/FrameLoader.cpp:Changed default accept header to match
+        FireFox' as per bug 27267.
+
+2011-03-10  Martin Robinson  <mrobinson@igalia.com>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] [Webkit2] There are no scrollbars visible in the MiniBrowser
+        https://bugs.webkit.org/show_bug.cgi?id=56125
+
+        No new tests. This functionality will be tested once we have TestRunner
+        implementation for WebKit2 with pixel dumping support.
+
+        * GNUmakefile.am: Add a new define with tracks whether or not we are using
+        our specialized GTK+ ScrollView.
+        * platform/ScrollView.cpp: Only use the GTK+-specific ScrollView if we are compiling
+        WebKit1.
+        (WebCore::ScrollView::wheelEvent):
+        * platform/gtk/ScrollViewGtk.cpp: Ditto.
+
+2011-03-10  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Assertion fails by validating a form twice very quickly
+        https://bugs.webkit.org/show_bug.cgi?id=56069
+
+        If the interactive validation is invoked when a form control is in
+        needsLayout() state, an assertion in isFocusable() fails. To avoid it,
+        Add a call to updateLayoutIgnorePendingStylesheets() before isFocusable().
+
+        Test: fast/forms/interactive-validation-assertion-by-validate-twice.html
+
+        * html/HTMLFormElement.cpp:
+        (WebCore::HTMLFormElement::validateInteractively):
+          Calls updateLayoutIgnorePendingStylesheets().
+
+2011-03-10  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        https://bugs.webkit.org/show_bug.cgi?id=47143
+        
+        Static distance computation is wrong when an ancestor is also positioned.  We need to go up the container()
+        chain (after initially starting with the parent()) when doing this computation, so that we properly skip
+        intermediate boxes between two positioned blocks.
+
+        Added fast/block/positioning/static-distance-with-positioned-ancestor.html.
+
+        * rendering/RenderBox.cpp:
+        (WebCore::computeInlineStaticDistance):
+        (WebCore::computeBlockStaticDistance):
+
+2011-03-10  Adrienne Walker  <enne@google.com>
+
+        Reviewed by Kenneth Russell.
+
+        [chromium] Make tiled compositor data structure more efficient.
+        https://bugs.webkit.org/show_bug.cgi?id=54133
+
+        Previously, the compositor had a sparse 2D array of tiles for the
+        whole page, most of which were null.  The tiles were implicitly
+        located based on their position in the array. This was inefficient
+        when the page grew (e.g. infinite scrolling) and caused some bugs
+        (e.g. width * height > MAX_INT).  This change modifies tiles to have
+        explicit positions so they can be stored in a hash map.
+
+        Tests: LayoutTests/compositing/
+
+        * platform/graphics/chromium/LayerTilerChromium.cpp:
+        (WebCore::LayerTilerChromium::reset):
+        (WebCore::LayerTilerChromium::createTile):
+        (WebCore::LayerTilerChromium::invalidateTiles):
+        (WebCore::LayerTilerChromium::contentRectToTileIndices):
+        (WebCore::LayerTilerChromium::tileAt):
+        (WebCore::LayerTilerChromium::tileContentRect):
+        (WebCore::LayerTilerChromium::tileLayerRect):
+        (WebCore::LayerTilerChromium::invalidateRect):
+        (WebCore::LayerTilerChromium::invalidateEntireLayer):
+        (WebCore::LayerTilerChromium::update):
+        (WebCore::LayerTilerChromium::updateFromPixels):
+        (WebCore::LayerTilerChromium::draw):
+        (WebCore::LayerTilerChromium::growLayerToContain):
+        * platform/graphics/chromium/LayerTilerChromium.h:
+        (WebCore::LayerTilerChromium::Tile::Tile):
+        (WebCore::LayerTilerChromium::Tile::i):
+        (WebCore::LayerTilerChromium::Tile::j):
+        (WebCore::LayerTilerChromium::Tile::moveTo):
+        (WebCore::LayerTilerChromium::TileMapKeyTraits::emptyValue):
+        (WebCore::LayerTilerChromium::TileMapKeyTraits::constructDeletedValue):
+        (WebCore::LayerTilerChromium::TileMapKeyTraits::isDeletedValue):
+
+2011-03-10  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Unreviewed build fix for r80752; Negated the boolean logic.
+
+        * editing/VisiblePosition.cpp:
+        (WebCore::VisiblePosition::next):
+        (WebCore::VisiblePosition::previous):
+
+2011-03-10  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Make the same change to xheight on Windows for CG.
+
+        * platform/graphics/win/SimpleFontDataCGWin.cpp:
+        (WebCore::SimpleFontData::platformInit):
+
+2011-03-10  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=47147
+        
+        Fix for repaint issues when the root element is a table and needs to paint a background that
+        covers the entire canvas.  Remove paintRootBoxDecorations and replace with paintRootBoxFillLayers,
+        so that it can be called only for fill layer painting.  Make tables and normal boxes both
+        call this new method.  Fix the dirty check at the start of RenderTable paint to not happen if
+        the table is the root of the document (this same check exists in RenderBlock painting already).
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::paintRootBoxFillLayers):
+        (WebCore::RenderBox::paintBoxDecorations):
+        (WebCore::RenderBox::paintBoxDecorationsWithSize):
+        * rendering/RenderBox.h:
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::calculateCompositedBounds):
+        * rendering/RenderTable.cpp:
+        (WebCore::RenderTable::paint):
+        (WebCore::RenderTable::paintBoxDecorations):
+
+2011-03-10  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r80749.
+        http://trac.webkit.org/changeset/80749
+        https://bugs.webkit.org/show_bug.cgi?id=56143
+
+        "Caused at least 3 media tests to be flaky" (Requested by
+        tonyg-cr on #webkit).
+
+        * html/parser/HTMLDocumentParser.cpp:
+        (WebCore::HTMLDocumentParser::canTakeNextToken):
+        (WebCore::HTMLDocumentParser::pumpTokenizer):
+        * html/parser/HTMLParserScheduler.cpp:
+        * html/parser/HTMLParserScheduler.h:
+        (WebCore::HTMLParserScheduler::checkForYieldBeforeToken):
+        * page/FrameView.h:
+
+2011-03-10  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by David Hyatt.
+
+        Regression: Content not drawn when scrolling horizontally in an RTL page
+        https://bugs.webkit.org/show_bug.cgi?id=55077
+
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::overhangAmount):
+        (WebCore::ScrollView::calculateOverhangAreasForPainting):
+        Take the scroll origin into account when calculating overhang.
+
+        * platform/ScrollView.h:
+        * rendering/RenderLayer.h:
+        * platform/ScrollableArea.h:
+        (WebCore::ScrollableArea::scrollOrigin):
+        Move identical scroll origin member from ScrollView and RenderLayer
+        to shared base ScrollableArea. This is also needed so that the animator
+        can access it.
+
+        * platform/mac/ScrollAnimatorMac.mm:
+        (WebCore::ScrollAnimatorMac::pinnedInDirection):
+        (WebCore::ScrollAnimatorMac::smoothScrollWithEvent):
+        (WebCore::ScrollAnimatorMac::snapRubberBandTimerFired):
+        Account for a scroll origin when doing calculating scroll offsets.
+
+2011-03-09  Matthew Delaney  <mdelaney@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Plumb through settings for accelerated drawing for canvas
+        https://bugs.webkit.org/show_bug.cgi?id=56039
+
+        No new tests. Doesn't affect behavior, just adding a switch to toggle canvas backends.
+
+        * WebCore.exp.in:
+        * html/HTMLCanvasElement.cpp:
+        * html/canvas/CanvasRenderingContext2D.cpp:
+        * page/Settings.cpp:
+        * page/Settings.h:
+
+2011-03-10  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=47157
+        
+        CSS2.1 test suite failures because the ex unit is broken with the Ahem font.
+        
+        Remove the code that tries to also include the maxX of the glyph bounds for the
+        'x' glyph, since it just causes the x-height to be way too large in cases where the 'x' glyph extends
+        below the baseline.
+
+        Remove the Apple Symbol hack for ex units, since the person who added that was confused by another
+        issue, namely that CGFontGetXHeight wasn't being properly multiplied by the pointSize.  That's why
+        the value was too small.  Patched the code to just multiply by pointSize and took out the hack.
+        
+        Fix causes many tests in the css2.1 directory to progress, so no new tests required.  Many other
+        layout tests change because the xHeight for Lucida Grande gets smaller by a little bit, and radio
+        buttons use ex horizontal margins by default.
+
+        * platform/graphics/mac/SimpleFontDataMac.mm:
+        (WebCore::SimpleFontData::platformInit):
+
+2011-03-10  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Tony Chang.
+
+        VisiblePosition's next and previous should take an enum instead of a boolean
+        https://bugs.webkit.org/show_bug.cgi?id=56135
+
+        Changed the argument type of VisiblePosition::next and VisiblePosition::previous
+        from bool to EditingBoundaryCrossingRule. Also got rid of StayInEditableContent enum
+        in VisibleSelection and replaced it by EditingBoundaryCrossingRule because the enum
+        was only used in VisiblePosition::isAll and subsequently in SelectionController::isAll
+        to call VisiblePosition::next and VisiblePosition::previous.
+
+        * WebCore.exp.in:
+        * dom/Position.cpp:
+        (WebCore::Position::trailingWhitespacePosition):
+        * editing/ApplyBlockElementCommand.cpp:
+        (WebCore::ApplyBlockElementCommand::doApply):
+        * editing/CompositeEditCommand.cpp:
+        (WebCore::CompositeEditCommand::breakOutOfEmptyMailBlockquotedParagraph):
+        * editing/InsertListCommand.cpp:
+        (WebCore::InsertListCommand::doApply):
+        (WebCore::InsertListCommand::listifyParagraph):
+        * editing/ReplaceSelectionCommand.cpp:
+        (WebCore::ReplaceSelectionCommand::shouldMergeStart):
+        (WebCore::ReplaceSelectionCommand::shouldMergeEnd):
+        (WebCore::ReplaceSelectionCommand::doApply):
+        * editing/SelectionController.cpp:
+        (WebCore::SelectionController::modifyExtendingRight):
+        (WebCore::SelectionController::modifyExtendingForward):
+        (WebCore::SelectionController::modifyMovingForward):
+        (WebCore::SelectionController::modifyExtendingLeft):
+        (WebCore::SelectionController::modifyExtendingBackward):
+        (WebCore::SelectionController::modifyMovingBackward):
+        * editing/SelectionController.h:
+        (WebCore::SelectionController::isAll):
+        * editing/TypingCommand.cpp:
+        (WebCore::TypingCommand::deleteKeyPressed):
+        (WebCore::TypingCommand::forwardDeleteKeyPressed):
+        * editing/VisiblePosition.cpp:
+        (WebCore::VisiblePosition::next):
+        (WebCore::VisiblePosition::previous):
+        * editing/VisiblePosition.h:
+        * editing/VisibleSelection.cpp:
+        (WebCore::VisibleSelection::isAll):
+        (WebCore::VisibleSelection::setStartAndEndFromBaseAndExtentRespectingGranularity):
+        * editing/VisibleSelection.h:
+        * editing/htmlediting.cpp:
+        (WebCore::selectionForParagraphIteration):
+        * editing/visible_units.cpp:
+        (WebCore::startOfNextParagraph):
+
+2011-03-10  Mihai Parparita  <mihaip@chromium.org>
+
+        Reviewed by Tony Gentilcore.
+
+        Remove CRASH() calls added to track down bug 53045
+        https://bugs.webkit.org/show_bug.cgi?id=56137
+
+        Remove CRASH() calls added by r76575 and re-label ones added by r80155
+        and r80269 as being associated with bug 56124 (which may still be
+        happening).
+
+        * css/CSSImageValue.cpp:
+        (WebCore::CSSImageValue::cachedImage):
+        * css/CSSSelector.h:
+        * css/CSSSelectorList.cpp:
+        (WebCore::CSSSelectorList::deleteSelectors):
+        * loader/cache/CachedResource.cpp:
+        (WebCore::CachedResource::CachedResource):
+        (WebCore::CachedResource::~CachedResource):
+        * loader/cache/CachedResource.h:
+
+2011-03-10  Tony Gentilcore  <tonyg@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Let the parser yield for layout before running scripts
+        https://bugs.webkit.org/show_bug.cgi?id=54355
+
+        Prior to this patch, the parser would yield to perform a layout/paint before running a
+        script only if the script or a stylesheet blocking the script is not loaded yet. Since we
+        don't preload scan into the body while parsing the head, typically we'll block on a script
+        early in the body that causes us to yield to do the first paint within a reasonable time.
+
+        However, I'm planning to change the PreloadScanner to scan into the body from the head.
+        That significantly improves overall load time, but would hurt first paint time because
+        fewer scripts would be blocked during parsing and thus wouldn't yield.
+
+        This change causes us to yield before running scripts if we haven't painted yet (regardless
+        of whether or not the script is loaded). In addition to allowing the above mentioned
+        PreloadScanner change to be implemented without regressing first paint time, this also
+        improves first paint time by itself.
+
+        I tested Alexa's top 45 websites using Web Page Replay to control the content and simulate
+        bandwidth. This patch improved average first paint time by 1% over an unlimited connection,
+        6% over a 1Mbps connection and 11% over a 5Mbps connection. There was no statistically
+        signifcant change in page load time.
+
+        Within the pages tested, 33 had no statistically significant change in time to first paint,
+        12 improved, and none regressed. Of the improved, some of the standouts from the 1Mbps set
+        are: 20% on youtube, 37% on wiki, 27% on ebay, 13% on cnn, 16% on espn, 74% on sohu.
+
+        * html/parser/HTMLDocumentParser.cpp:
+        (WebCore::HTMLDocumentParser::canTakeNextToken): This is the new yield point.
+        (WebCore::HTMLDocumentParser::pumpTokenizer): Remove ASSERT that we are not paused. isPaused
+        means that we are waiting for a script. Bug 54574 changed pumpTokenizer() so that it does
+        the right thing whether we are just before a token or waiting for a script. Now that we may
+        yield before a token or before a script, this may be called while paused.
+        * html/parser/HTMLParserScheduler.cpp:
+        (WebCore::HTMLParserScheduler::checkForYieldBeforeScript): Added.
+        * page/FrameView.h:
+        (WebCore::FrameView::hasEverPainted): Added.
+
+2011-03-10  Alejandro G. Castro  <alex@igalia.com>
+
+        Reviewed by Martin Robinson.
+
+        Some Gtk code uses defined(USE_FREETYPE) instead of just USE(FREETYPE)
+        https://bugs.webkit.org/show_bug.cgi?id=55996
+
+        Use the macre USE instead of defined fro WTF_USE_FREETYPE and
+        WTF_USE_PANGO.
+
+        * GNUmakefile.am:
+        * platform/graphics/cairo/OwnPtrCairo.cpp:
+        * platform/graphics/cairo/OwnPtrCairo.h:
+        * platform/graphics/cairo/RefPtrCairo.cpp:
+        * platform/graphics/cairo/RefPtrCairo.h:
+        * platform/graphics/gtk/FontGtk.cpp:
+        (WebCore::setPangoAttributes):
+        (WebCore::Font::drawComplexText):
+        (WebCore::Font::floatWidthForComplexText):
+        (WebCore::Font::offsetForPositionForComplexText):
+        (WebCore::Font::selectionRectForComplexText):
+
+2011-03-10  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Rolled back in 80277 and 80280 with event handler layout test failures fixed.
+        https://bugs.webkit.org/show_bug.cgi?id=55653
+
+        The failures were caused by a last minute typo: assigning to currentEvent
+        instead of m_currentEvent.
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSDOMGlobalObject.cpp:
+        * bindings/js/JSDOMGlobalObject.h:
+        * bindings/js/JSDOMWindowBase.cpp:
+        * bindings/js/JSDOMWindowBase.h:
+        * bindings/js/JSDOMWindowCustom.h:
+        * bindings/js/JSWorkerContextBase.cpp:
+
+2011-03-10  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=56129, vertical text broken on Lion and Leopard.
+
+        Add Snow Leopard ifdefs for the scaling by point size and then the division by unitsPerEm to the
+        translationsTransform applied to the results from CTFontGetVerticalTranslationsForGlyphs, since
+        this is done already on Lion and Leopard.
+
+        * platform/graphics/mac/FontMac.mm:
+        (WebCore::showGlyphsWithAdvances):
+
+2011-03-10  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r80701.
+        http://trac.webkit.org/changeset/80701
+        https://bugs.webkit.org/show_bug.cgi?id=56126
+
+        fast/dom/Geolocation/window-close-crash.html fails on Snow
+        Leopard release builds (Requested by mihaip on #webkit).
+
+        * page/DOMWindow.cpp:
+        * page/DOMWindow.h:
+        * page/Frame.cpp:
+        (WebCore::Frame::pageDestroyed):
+        (WebCore::Frame::transferChildFrameToNewDocument):
+        * page/Geolocation.cpp:
+        (WebCore::Geolocation::~Geolocation):
+        (WebCore::Geolocation::disconnectFrame):
+        (WebCore::Geolocation::lastPosition):
+        (WebCore::Geolocation::requestPermission):
+        (WebCore::Geolocation::startUpdating):
+        (WebCore::Geolocation::stopUpdating):
+        * page/Geolocation.h:
+        * page/GeolocationController.cpp:
+        (WebCore::GeolocationController::~GeolocationController):
+        * page/Navigator.cpp:
+        * page/Navigator.h:
+        * platform/mock/GeolocationClientMock.cpp:
+        * platform/mock/GeolocationClientMock.h:
+
+2011-03-10  Pratik Solanki  <psolanki@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        ASSERT_NOT_REACHED triggered in WebCore::mapHTTPPipeliningPriorityToResourceLoadPriority
+        https://bugs.webkit.org/show_bug.cgi?id=56075
+
+        Map priority value 3, which means no priority, to ResourceLoadPriorityUnresolved.
+
+        * platform/network/cf/ResourceRequestCFNet.h:
+        (WebCore::mapHTTPPipeliningPriorityToResourceLoadPriority):
+        (WebCore::mapResourceLoadPriorityToHTTPPipeliningPriority):
+
+2011-03-10  Andrey Adaikin  <aandrey@google.com>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: [Text editor] Substitute live-edit mode activation by double-click
+        https://bugs.webkit.org/show_bug.cgi?id=56084
+
+        Also fixed a regression: console was not opening/closing on ESC key press because tabIndex="0" attribute was preserved for a readOnly viewer.
+
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame):
+        (WebInspector.SourceFrame.prototype._startEditing):
+        (WebInspector.SourceFrame.prototype._registerShortcuts):
+        (WebInspector.SourceFrame.prototype._handleKeyDown):
+        (WebInspector.SourceFrame.prototype._handleSave):
+        (WebInspector.SourceFrame.prototype._handleRevertEditing):
+        (WebInspector.SourceFrame.prototype._doubleClick):
+        * inspector/front-end/TextEditorModel.js:
+        (WebInspector.TextEditorModel.prototype.get text):
+        * inspector/front-end/TextViewer.js:
+        (WebInspector.TextViewer.prototype.get readOnly):
+        (WebInspector.TextEditorMainPanel):
+        (WebInspector.TextEditorMainPanel.prototype.set readOnly):
+        (WebInspector.TextEditorMainPanel.prototype.get readOnly):
+
+2011-03-10  Greg Simon  <gregsimon@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: Need new graphic icon for garbage collect button.
+        https://bugs.webkit.org/show_bug.cgi?id=55794
+
+        No new tests: gc tests are flaky due to non-determinisic
+        behavior of collection APIs (more notes in bug)
+
+        * English.lproj/localizedStrings.js:
+        * WebCore.gypi:
+        * bindings/js/ScriptProfiler.cpp:
+        (WebCore::ScriptProfiler::collectGarbage):
+        * bindings/js/ScriptProfiler.h:
+        * bindings/v8/ScriptProfiler.cpp:
+        (WebCore::ScriptProfiler::collectGarbage):
+        * bindings/v8/ScriptProfiler.h:
+        * inspector/Inspector.idl:
+        * inspector/InspectorProfilerAgent.cpp:
+        (WebCore::InspectorProfilerAgent::collectGarbage):
+        * inspector/InspectorProfilerAgent.h:
+        * inspector/front-end/Images/garbageCollectButtonGlyph.png: Added.
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel.prototype.get statusBarItems):
+        (WebInspector.TimelinePanel.prototype._createStatusbarButtons):
+        (WebInspector.TimelinePanel.prototype._garbageCollectButtonClicked):
+        * inspector/front-end/inspector.css:
+        (.garbage-collect-status-bar-item .glyph):
+
+2011-03-10  Andrey Kosyakov  <caseq@chromium.org>
+
+        Web Inspector: better names for HAR export commands
+        https://bugs.webkit.org/show_bug.cgi?id=56097
+
+        Rename Export to HAR to Copy entry/network log as HAR
+        Expose Copy as HAR unconditionally, remove related settings entry.
+
+        * English.lproj/localizedStrings.js:
+        * inspector/front-end/NetworkPanel.js:
+        (WebInspector.NetworkPanel.prototype._contextMenu):
+        * inspector/front-end/Settings.js:
+
+2011-03-10  Qi Zhang  <qi.2.zhang@nokia.com>
+
+        Reviewed by Laszlo Gombos.
+
+        [Qt] Mobile Devices should include Model and Firmware Version in Webkit Generated User Agent String
+        https://bugs.webkit.org/show_bug.cgi?id=48636
+
+        Fix a typo in features.pri that turns on this feature on mobile
+        devices by default.
+
+        * features.pri:
+
+2011-03-10  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: Invalid expected parameter list in CSSAgent.setSelectorText() callback (CSSStyleModel.js)
+        https://bugs.webkit.org/show_bug.cgi?id=56092
+
+        * inspector/front-end/CSSStyleModel.js:
+        (WebInspector.CSSStyleModel.prototype.setRuleSelector):
+
+2011-03-10  Pavel Feldman  <pfeldman@chromium.org>
+
+        Not reviewed: rolling out r80478 and its follow ups for breaking
+        inspector and engadget.com.
+        https://bugs.webkit.org/show_bug.cgi?id=49401
+
+        * dom/Document.cpp:
+        (WebCore::Document::Document):
+        (WebCore::performTask):
+        (WebCore::Document::postTask):
+        * dom/Document.h:
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::setDefersLoading):
+        * manual-tests/database-callback-deferred.html: Removed.
+        * page/PageGroupLoadDeferrer.cpp:
+        (WebCore::PageGroupLoadDeferrer::PageGroupLoadDeferrer):
+        (WebCore::PageGroupLoadDeferrer::~PageGroupLoadDeferrer):
+
+2011-03-10  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Tiled backing store's delegated scroll request uses incorrect convention
+        https://bugs.webkit.org/show_bug.cgi?id=56011
+
+        Use a point instead of delta, when relaying the scroll request from
+        ScrollView::setScrollPosition.
+
+        * loader/EmptyClients.h:
+        (WebCore::EmptyChromeClient::delegatedScrollRequested):
+        * page/Chrome.cpp:
+        (WebCore::Chrome::delegatedScrollRequested):
+        * page/Chrome.h:
+        * page/ChromeClient.h:
+        * platform/HostWindow.h:
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::setScrollPosition):
+
+2011-03-10  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: brush up DOM agent API.
+        https://bugs.webkit.org/show_bug.cgi?id=56093
+
+        * inspector/Inspector.idl:
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::childNodes):
+        (WebCore::InspectorDOMAgent::setNodeName):
+        (WebCore::InspectorDOMAgent::outerHTML):
+        (WebCore::InspectorDOMAgent::setNodeValue):
+        * inspector/InspectorDOMAgent.h:
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.DOMNode):
+        (WebInspector.DOMNode.prototype.hasAttributes):
+        (WebInspector.DOMNode.prototype.nodeType):
+        (WebInspector.DOMNode.prototype.nodeName):
+        (WebInspector.DOMNode.prototype.setNodeName):
+        (WebInspector.DOMNode.prototype.localName):
+        (WebInspector.DOMNode.prototype.nodeValue):
+        (WebInspector.DOMNode.prototype.setNodeValue):
+        (WebInspector.DOMNode.prototype.setAttribute):
+        (WebInspector.DOMNode.prototype.attributes):
+        (WebInspector.DOMNode.prototype.removeAttribute):
+        (WebInspector.DOMNode.prototype.childNodes.mycallback):
+        (WebInspector.DOMNode.prototype.childNodes):
+        (WebInspector.DOMNode.prototype.outerHTML):
+        (WebInspector.DOMNode.prototype.setOuterHTML):
+        (WebInspector.DOMNode.prototype.removeNode):
+        (WebInspector.DOMNode.prototype.copyNode):
+        (WebInspector.DOMNode.prototype.path):
+        (WebInspector.DOMNode.prototype._setAttributesPayload):
+        (WebInspector.DOMNode.prototype._addAttribute):
+        (WebInspector.DOMAgent.prototype._characterDataModified):
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.prototype.updateBreadcrumb):
+        (WebInspector.ElementsPanel.prototype.decorateNodeLabel):
+        (WebInspector.ElementsPanel.prototype.handleCopyEvent):
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeOutline.prototype.findTreeElement):
+        (WebInspector.ElementsTreeElement):
+        (WebInspector.ElementsTreeElement.prototype.updateChildren):
+        (WebInspector.ElementsTreeElement.prototype._updateChildren):
+        (WebInspector.ElementsTreeElement.prototype._startEditingTarget):
+        (WebInspector.ElementsTreeElement.prototype._startEditing):
+        (WebInspector.ElementsTreeElement.prototype._attributeEditingCommitted):
+        (WebInspector.ElementsTreeElement.prototype._tagNameEditingCommitted.moveToNextAttributeIfNeeded):
+        (WebInspector.ElementsTreeElement.prototype._tagNameEditingCommitted):
+        (WebInspector.ElementsTreeElement.prototype._textNodeEditingCommitted):
+        (WebInspector.ElementsTreeElement.prototype._attributeHTML):
+        ():
+        * inspector/front-end/EventListenersSidebarPane.js:
+        ():
+        * inspector/front-end/MetricsSidebarPane.js:
+        * inspector/front-end/StylesSidebarPane.js:
+        * inspector/front-end/utilities.js:
+
+2011-03-09  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: [STYLES] Editing a property value adds a word for any property value that uses a paren
+        https://bugs.webkit.org/show_bug.cgi?id=56002
+
+        * inspector/front-end/StylesSidebarPane.js: Introduce an additional check.
+
+2011-03-09  Pavel Podivilov  <podivilov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: use DebuggerPresentation instead of DebuggerModel in source frame delegate.
+        https://bugs.webkit.org/show_bug.cgi?id=56034
+
+        * inspector/front-end/DebuggerPresentationModel.js:
+        (WebInspector.DebuggerPresentationModel.prototype.continueToLine):
+        (WebInspector.DebuggerPresentationModel.prototype.setBreakpoint):
+        (WebInspector.DebuggerPresentationModel.prototype.updateBreakpoint):
+        (WebInspector.DebuggerPresentationModel.prototype.findBreakpoint):
+        (WebInspector.DebuggerPresentationModel.prototype._sourceLocationToActualLocation):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype._createSourceFrame):
+        (WebInspector.SourceFrameDelegateForScriptsPanel):
+        (WebInspector.SourceFrameDelegateForScriptsPanel.prototype.setBreakpoint):
+        (WebInspector.SourceFrameDelegateForScriptsPanel.prototype.updateBreakpoint):
+        (WebInspector.SourceFrameDelegateForScriptsPanel.prototype.removeBreakpoint):
+        (WebInspector.SourceFrameDelegateForScriptsPanel.prototype.findBreakpoint):
+        (WebInspector.SourceFrameDelegateForScriptsPanel.prototype.continueToLine):
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype._contextMenu.else.editBreakpointCondition.didEditBreakpointCondition):
+        (WebInspector.SourceFrame.prototype._contextMenu.else.editBreakpointCondition):
+        (WebInspector.SourceFrame.prototype._contextMenu.else.setBreakpointEnabled):
+        (WebInspector.SourceFrame.prototype._contextMenu):
+        (WebInspector.SourceFrame.prototype._mouseDown):
+        (WebInspector.SourceFrameDelegate.prototype.removeBreakpoint):
+        (WebInspector.SourceFrameDelegate.prototype.updateBreakpoint):
+
+2011-03-09  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: elements dom tree - word wrap toggle
+        https://bugs.webkit.org/show_bug.cgi?id=44311
+
+        A "Word Wrap" option is now shown in a context menu for the entire DOM tree content area
+        and persisted into application settings.
+
+        * English.lproj/localizedStrings.js:
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.prototype._contextMenuEventFired):
+        (WebInspector.ElementsPanel.prototype._contextMenuEventFired.toggleWordWrap):
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeOutline):
+        (WebInspector.ElementsTreeOutline.prototype._treeElementFromEvent):
+        (WebInspector.ElementsTreeOutline.prototype.populateContextMenu):
+        (WebInspector.ElementsTreeElement.prototype.onreveal):
+        * inspector/front-end/Settings.js:
+        (WebInspector.Settings):
+        * inspector/front-end/inspector.css:
+        (#elements-content.nowrap):
+        (#elements-content > ol):
+
+2011-03-09  Pavel Podivilov  <podivilov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: re-implement breakpoints sidebar pane based on debugger presentation model.
+        https://bugs.webkit.org/show_bug.cgi?id=55823
+
+        * inspector/front-end/BreakpointsSidebarPane.js:
+        (WebInspector.JavaScriptBreakpointsSidebarPane):
+        (WebInspector.JavaScriptBreakpointsSidebarPane.prototype.addBreakpoint.didLoadSnippet):
+        (WebInspector.JavaScriptBreakpointsSidebarPane.prototype.addBreakpoint):
+        (WebInspector.JavaScriptBreakpointsSidebarPane.prototype.removeBreakpoint):
+        (WebInspector.JavaScriptBreakpointsSidebarPane.prototype.highlightBreakpoint):
+        (WebInspector.JavaScriptBreakpointsSidebarPane.prototype.clearBreakpointHighlight):
+        (WebInspector.JavaScriptBreakpointsSidebarPane.prototype._createBreakpointItemId):
+        (WebInspector.JavaScriptBreakpointsSidebarPane.prototype._breakpointClicked):
+        (WebInspector.JavaScriptBreakpointsSidebarPane.prototype._breakpointCheckboxClicked):
+        (WebInspector.JavaScriptBreakpointsSidebarPane.prototype._contextMenu):
+        (WebInspector.JavaScriptBreakpointsSidebarPane.prototype.reset):
+        * inspector/front-end/DebuggerPresentationModel.js:
+        (WebInspector.DebuggerPresentationModel):
+        (WebInspector.DebuggerPresentationModel.prototype._parsedScriptSource):
+        (WebInspector.DebuggerPresentationModel.prototype._failedToParseScriptSource):
+        (WebInspector.DebuggerPresentationModel.prototype._revealHiddenBreakpoints):
+        (WebInspector.DebuggerPresentationModel.prototype.breakpointsForSourceFileId):
+        (WebInspector.DebuggerPresentationModel.prototype.setBreakpointEnabled):
+        (WebInspector.DebuggerPresentationModel.prototype.removeBreakpoint):
+        (WebInspector.DebuggerPresentationModel.prototype._breakpointAdded):
+        (WebInspector.DebuggerPresentationModel.prototype.set selectedCallFrame):
+        (WebInspector.DebuggerPresentationModel.prototype._actualLocationToSourceLocation):
+        (WebInspector.DebuggerPresentationModel.prototype.reset):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel):
+        (WebInspector.ScriptsPanel.prototype._breakpointAdded):
+        (WebInspector.ScriptsPanel.prototype._breakpointRemoved):
+        (WebInspector.ScriptsPanel.prototype._debuggerPaused):
+        (WebInspector.ScriptsPanel.prototype.reset):
+        (WebInspector.ScriptsPanel.prototype._clearInterface):
+
+2011-03-10  Andrey Adaikin  <aandrey@google.com>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: Highlighter refactoring
+        https://bugs.webkit.org/show_bug.cgi?id=56015
+
+        * inspector/front-end/TextEditorHighlighter.js:
+        (WebInspector.TextEditorHighlighter):
+        (WebInspector.TextEditorHighlighter.prototype.set mimeType):
+        (WebInspector.TextEditorHighlighter.prototype.highlight):
+        (WebInspector.TextEditorHighlighter.prototype.updateHighlight):
+        (WebInspector.TextEditorHighlighter.prototype._highlightInChunks):
+        (WebInspector.TextEditorHighlighter.prototype._highlightLines):
+        (WebInspector.TextEditorHighlighter.prototype._selectHighlightState):
+        (WebInspector.TextEditorHighlighter.prototype._clearHighlightState):
+        * inspector/front-end/TextViewer.js:
+        (WebInspector.TextEditorMainPanel.prototype._buildChunks):
+        (WebInspector.TextEditorMainPanel.prototype._updateHighlightsForRange):
+
+2011-03-05  Pavel Podivilov  <podivilov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: move breakpoint column adjustment to debugger model.
+        https://bugs.webkit.org/show_bug.cgi?id=55821
+
+        Test: inspector/debugger/debug-inlined-scripts.html
+
+        * inspector/front-end/DebuggerModel.js:
+        (WebInspector.DebuggerModel.prototype.setBreakpoint.didSetBreakpoint):
+        (WebInspector.DebuggerModel.prototype.setBreakpoint):
+        * inspector/front-end/SourceFrameContent.js:
+        (WebInspector.SourceFrameContent.prototype.sourceFrameLineNumberToActualLocation):
+
+2011-01-21  John Knottenbelt  <jknotten@chromium.org>
+
+        Reviewed by Dmitry Titov.
+
+        Detach Geolocation from Frame when Page destroyed.
+        https://bugs.webkit.org/show_bug.cgi?id=52877
+
+        On Page destruction, any outstanding Geolocation permission
+        requests should be cancelled, because the Geolocation can only
+        access the client indirectly via m_frame->page().
+
+        Page destruction is signalled by a call to the
+        Frame::pageDestroyed() method. This explictly calls
+        DOMWindow::resetGeolocation which ultimately calls Geolocation::reset.
+
+        Geolocation::reset() detaches from the GeolocationController,
+        cancels requests, watches and single shots, and sets the
+        permission state back to Unknown.
+
+        Frame::pageDestroyed() is also called by FrameLoader even though
+        the page is not destroyed. We should still cancel permission
+        requests, because the GeolocationClient will become inaccessible
+        to the Geolocation object after this call.
+
+        Frame::transferChildFrameToNewDocument also indirectly calls
+        Geolocation::reset when the frame is reparented between
+        pages. Ideally we would like the Geolocation's activities to
+        continue after reparenting, see bug
+        https://bugs.webkit.org/show_bug.cgi?id=55577
+
+        Since GeolocationController is owned by Page, and all Geolocation
+        objects will now unsubscribe from the GeolocationController on
+        pageDetached(), we no longer need to call stopUpdating() from the
+        GeolocationController's destructor. Instead we can simply assert
+        that there should be no no observers. See related bug
+        https://bugs.webkit.org/show_bug.cgi?id=52216 .
+
+        Introduced new method 'numberOfPendingPermissionRequests' on
+        GeolocationClientMock to count the number of outstanding pending
+        permission requests. This provides a reusable implementation for
+        client-based implementations of the LayoutTestController's
+        numberOfPendingGeolocationPermissionRequests method.
+
+        Test: fast/dom/Geolocation/page-reload-cancel-permission-requests.html
+
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::resetGeolocation):
+        * page/DOMWindow.h:
+        * page/Frame.cpp:
+        (WebCore::Frame::pageDestroyed):
+        (WebCore::Frame::transferChildFrameToNewDocument):
+        * page/Geolocation.cpp:
+        (WebCore::Geolocation::~Geolocation):
+        (WebCore::Geolocation::page):
+        (WebCore::Geolocation::reset):
+        (WebCore::Geolocation::disconnectFrame):
+        (WebCore::Geolocation::lastPosition):
+        (WebCore::Geolocation::requestPermission):
+        (WebCore::Geolocation::startUpdating):
+        (WebCore::Geolocation::stopUpdating):
+        * page/Geolocation.h:
+        * page/GeolocationController.cpp:
+        (WebCore::GeolocationController::~GeolocationController):
+        * page/Navigator.cpp:
+        (WebCore::Navigator::resetGeolocation):
+        * page/Navigator.h:
+        * platform/mock/GeolocationClientMock.cpp:
+        (WebCore::GeolocationClientMock::numberOfPendingPermissionRequests):
+        * platform/mock/GeolocationClientMock.h:
+
+2011-03-10  Ojan Vafai  <ojan@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Able to move nodes across documents
+        https://bugs.webkit.org/show_bug.cgi?id=19524
+
+        Makes cross-document appendChild, insertBefore, Range.insertNode and Range.surroundContents work.
+        This matches Gecko and the new Dom Core spec. There are a number of Range methods where we don't 
+        match Gecko or the spec that will need to be updated in a following patch.
+
+        Test: fast/dom/move-nodes-across-documents.html
+
+        * dom/Element.cpp:
+        (WebCore::Element::removeAttributeNode):
+        * dom/NamedNodeMap.cpp:
+        (WebCore::NamedNodeMap::setNamedItem):
+        * dom/Node.cpp:
+        (WebCore::Node::setDocumentRecursively):
+        (WebCore::checkAcceptChild):
+        (WebCore::Node::checkReplaceChild):
+        * dom/Range.cpp:
+        (WebCore::Range::insertNode):
+        (WebCore::Range::surroundContents):
+
+2011-03-09  Antti Koivisto  <antti@apple.com>
+
+        Not reviewed.
+
+        Reverting crash catching code, the bug being hunted was fixed by
+        http://trac.webkit.org/changeset/80686
+
+        * loader/cache/CachedResourceLoader.cpp:
+        (WebCore::CachedResourceLoader::CachedResourceLoader):
+        (WebCore::CachedResourceLoader::~CachedResourceLoader):
+        (WebCore::CachedResourceLoader::requestImage):
+        (WebCore::CachedResourceLoader::requestUserCSSStyleSheet):
+        (WebCore::CachedResourceLoader::requestResource):
+        (WebCore::CachedResourceLoader::setAutoLoadImages):
+        (WebCore::CachedResourceLoader::load):
+        (WebCore::CachedResourceLoader::loadDone):
+        (WebCore::CachedResourceLoader::preload):
+        (WebCore::CachedResourceLoader::requestPreload):
+        * loader/cache/CachedResourceLoader.h:
+
+2011-03-09  Peter Kasting  <pkasting@google.com>
+
+        Unreviewed, build fix.
+
+        * StringsNotToBeLocalized.txt: Add function names I forgot.
+        * platform/win/SystemInfo.cpp: #if out some uncalled functions on WinCE,
+          since they don't compile anyway.  Use ZeroMemory() instead of "= {0}"
+          since Qt is stupid and (sometimes?!) warns about it.
+        (WebCore::windowsVersion):
+        (WebCore::processorArchitecture):
+
+2011-03-09  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Ryosuke Niwa.
+
+        Add UA string tags for Windows 64.
+        https://bugs.webkit.org/show_bug.cgi?id=55226
+
+        * StringsNotToBeLocalized.txt:
+        * platform/win/SystemInfo.cpp:
+        (WebCore::osVersionForUAString):
+        (WebCore::isWOW64):
+        (WebCore::processorArchitecture):
+        (WebCore::architectureTokenForUAString):
+        (WebCore::windowsVersionForUAString):
+
+2011-03-09  Peter Kasting  <pkasting@google.com>
+
+        Unreviewed, attempted build fix.
+
+        * WebCore.pri: Try to update include path for Qt Windows build.
+
+2011-03-09  Peter Kasting  <pkasting@google.com>
+
+        Unreviewed, build fix.
+
+        * platform/win/SystemInfo.cpp:
+        (WebCore::windowsVersionForUAString): Fix const conversion warning on Qt.
+
+2011-03-09  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Mihai Parparita.
+
+        Unify Windows version checks.
+        https://bugs.webkit.org/show_bug.cgi?id=55979
+
+        * GNUmakefile.am: Fix spaces -> tabs.
+        * StringsNotToBeLocalized.txt:
+        * WebCore.pro: Add SystemInfo.* to Qt build.
+        * platform/chromium/ScrollbarThemeChromiumWin.cpp:
+        (WebCore::ScrollbarThemeChromiumWin::invalidateOnMouseEnterExit):
+        (WebCore::ScrollbarThemeChromiumWin::getThemeState):
+        (WebCore::ScrollbarThemeChromiumWin::getThemeArrowState):
+        * platform/graphics/chromium/GlyphPageTreeNodeChromiumWin.cpp:
+        (WebCore::fillBMPGlyphs):
+        * platform/win/CursorWin.cpp:
+        (WebCore::createSharedCursor):
+        * platform/win/ScrollbarThemeWin.cpp:
+        (WebCore::ScrollbarThemeWin::ScrollbarThemeWin):
+        * platform/win/SystemInfo.cpp: Add full-fledged version check and UA string helper function.
+        (WebCore::windowsVersion):
+        (WebCore::windowsVersionForUAString):
+        * platform/win/SystemInfo.h: Add full-fledged version check and UA string helper function.
+        * rendering/RenderThemeChromiumWin.cpp:
+        (WebCore::getNonClientMetrics):
+        * rendering/RenderThemeWin.cpp:
+        (WebCore::RenderThemeWin::getThemeData):
+        (WebCore::RenderThemeWin::paintMenuList):
+        (WebCore::RenderThemeWin::paintMenuListButton):
+
+2011-03-09  Mihai Parparita  <mihaip@chromium.org>
+
+        Reviewed by Tony Gentilcore.
+
+        REGRESSION (r74807): memory corruption after CachedResourceLoader refactoring
+        https://bugs.webkit.org/show_bug.cgi?id=53045
+        
+        Copy the URL out of the CachedResource that is being revalidated, so
+        that we can still use it (in m_validatedURLs) after removing the
+        resource from the memory cache, which may delete it.
+
+        No new tests, since I was not able to trigger this locally (in a layout
+        test or otherwise).
+
+        * loader/cache/CachedResourceLoader.cpp:
+        (WebCore::CachedResourceLoader::revalidateResource):
+
+2011-03-09  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        VO reporting incorrect list count for http://www.macworld.com/news.html
+        https://bugs.webkit.org/show_bug.cgi?id=56064
+
+        <li> tags should not be ignored, because they provide valuable information
+        to screen readers.
+
+        Test: platform/mac/accessibility/list-items-ignored.html
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::accessibilityIsIgnored):
+
+2011-03-09  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        <rdar://problem/8733254> Float disappears after incremental layout
+        Fixed the original bug and a copule more issues noticed while doing so.
+
+        Tests: fast/dynamic/dirty-float-in-clean-line.html
+               fast/dynamic/float-at-line-break.html
+               fast/dynamic/float-from-empty-line.html
+
+        * rendering/RenderBlock.h:
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::layoutInlineChildren): If findNextLineBreak() returned an empty line,
+        update the line break info of the last line with the new line break position. This is tested
+        by float-from-empty-line.html.
+        (WebCore::RenderBlock::checkFloatsInCleanLine): Factored out code from determineStartPosition()
+        into this new function.
+        (WebCore::RenderBlock::determineStartPosition): Call checkFloatsInCleanLine().
+        (WebCore::RenderBlock::determineEndPosition): When iterating over lines, check clean lines with
+        floats, as they may yet become dirty because of the floats. This is tested by
+        dirty-float-in-clean-line.html.
+        (WebCore::RenderBlock::findNextLineBreak): If a float fits on the line, and the current line
+        break is at the float, advance it to after the float. Otherwise, if the line gets dirty and the
+        next one does not, the float will not make it into any line. This is tested by
+        float-at-line-break.html.
+
+2011-03-09  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Kent Tamura.
+
+        selectionStart reports wrong caret position when the last characters are newlines
+        https://bugs.webkit.org/show_bug.cgi?id=56061
+
+        The bug was caused by SelectionController::setSelection's not calling
+        notifyRendererOfSelectionChange when old selection was equal to new selection.
+
+        Because InsertLineBreakCommand inserts a text node with a single LF before the caret,
+        this condition holds after the command is executed. However, the values of
+        selectionStart and selectionEnd still need to be updated in this case because
+        the offsets counted from the beginning of textarea have been increased by 1.
+
+        * editing/SelectionController.cpp:
+        (WebCore::SelectionController::setSelection): Call notifyRendererOfSelectionChange
+        when m_selection = s.
+        * manual-tests/selection-start-after-inserting-line-break-in-textarea.html: Added.
+
+2011-03-09  Andy Estes  <aestes@apple.com>
+
+        Reviewed by Adam Barth.
+
+        Bad cast in HTMLTreeBuilder::processStartTag
+        https://bugs.webkit.org/show_bug.cgi?id=55955
+
+        Test: fast/parser/self-closing-foreign-content.html
+
+        When the parser encounters an svg or mathml root element, it places the
+        insertion mode into InForeignContentMode. However, if the root element
+        is self-closing (e.g. <svg />) then the element is never placed on the
+        open elements stack. This leaves the parser in an inconsistent state
+        where it is in InForeignContentMode but no foreign content is in the
+        open element stack.
+
+        * html/parser/HTMLTreeBuilder.cpp:
+        (WebCore::HTMLTreeBuilder::processStartTagForInBody): If a self-closing
+        foreign element is inserted into the tree, do not set the insertion
+        mode to InForeignContentMode.
+
+2011-03-09  Gavin Barraclough  <barraclough@apple.com>
+
+        Qt build fix.
+
+        * bridge/qt/qt_runtime.cpp:
+        (JSC::Bindings::convertQVariantToValue):
+
+2011-03-09  Andy Estes  <aestes@apple.com>
+
+        Reviewed by Adam Barth.
+
+        REGRESSION (r80320): Assertion failure when processing mis-nested foreign content.
+        https://bugs.webkit.org/show_bug.cgi?id=55982
+
+        Test: fast/parser/fragment-foreign-content-misnested.html
+        
+        It is a parse error to encounter certain start tags while the parser's
+        insertion mode is InForeignContentMode (e.g. <br>). In these cases, we
+        are to pop open elements off the HTMLElementStack until a foreign
+        content scope marker is encountered. Before the change in r80320 to not
+        insert a fake HTML element during fragment parsing, said fake HTML
+        element counted as a foreign content scope marker.
+        
+        With r80320, no fake HTML element is inserted and the stack is popped
+        until empty in cases where no other element claims to be a foreign
+        content scope marker. Fix this by treating the DocumentFragment as a
+        foreign content scope marker.
+
+        * html/parser/HTMLElementStack.cpp:
+        (WebCore::HTMLNames::isForeignContentScopeMarker): Take a
+        ContainerNode* instead of a Element*.
+        (WebCore::HTMLElementStack::popUntilForeignContentScopeMarker): Pass
+        topNode() to isForeignContentScopeMarker() instead of top().
+
+2011-03-09  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Bug 56041 - RexExp constructor should only accept flags "gim"
+        We also should be passing the flags around as a bitfield rather than a string,
+        and should not have redundant, incompatible code for converting the string to a bitfield!
+
+        * bindings/js/SerializedScriptValue.cpp:
+        (WebCore::CloneDeserializer::readTerminal):
+            - Need to parse flags string back to enum.
+
+2011-03-09  James Robinson  <jamesr@chromium.org>
+
+        Reviewed by Kenneth Russell.
+
+        [chromium]: Regression - Explicitly copy compositing properties from LayerChromium to CCLayerImpl
+        https://bugs.webkit.org/show_bug.cgi?id=56021
+
+        Initializes the m_doubleSided flag of LayerChromiums to the default
+        value of true so the back sides of layers without
+        backface-visibility:hidden are rendered.
+
+        Test: compositing/backface-visibility.html
+
+        * platform/graphics/chromium/LayerChromium.cpp:
+        (WebCore::LayerChromium::LayerChromium):
+
+2011-03-09  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        <rdar://problem/9110316> REGRESSION: 'ex' unit broken for vertical text
+
+        Fall back to the verticalRightOrientation data when obtaining the x-height for vertically oriented
+        text. That way we use the same metrics as for horizontal.
+
+        This fixes regressions in fast/lists and fast/overflow vertical text tests.
+
+        * platform/graphics/mac/SimpleFontDataMac.mm:
+        (WebCore::SimpleFontData::platformInit):
+        (WebCore::SimpleFontData::platformBoundsForGlyph):
+
+2011-03-09  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Tony Chang.
+
+        REGRESSION: crash in nextLinePosition when extending selection forward by line in an empty document
+        https://bugs.webkit.org/show_bug.cgi?id=56004
+
+        The crash was caused by the false assumption that rootEditableElement() or documentElement()
+        always return non-null pointer. Fixed the bug by adding an early exit.
+
+        Test: editing/selection/extend-by-line-in-empty-document.html
+
+        * editing/visible_units.cpp:
+        (WebCore::previousLinePosition):
+        (WebCore::nextLinePosition):
+
+2011-03-09  Pavel Podivilov  <podivilov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: it should be possible to copy stack trace from call stack sidebar pane.
+        https://bugs.webkit.org/show_bug.cgi?id=56024
+
+        * English.lproj/localizedStrings.js:
+        * inspector/front-end/CallStackSidebarPane.js:
+        (WebInspector.CallStackSidebarPane):
+        (WebInspector.CallStackSidebarPane.prototype.update):
+        (WebInspector.CallStackSidebarPane.prototype._contextMenu):
+
+2011-03-09  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Patch FontPlatformDataLinux to properly initialize and copy orientation/text-orientation in all
+        places.  Make sure text-orientation is specified in the lookups/creation in FontCustomPlatformData
+        and FontCache.
+
+        * platform/graphics/chromium/FontPlatformDataLinux.cpp:
+        (WebCore::FontPlatformData::FontPlatformData):
+        * platform/graphics/chromium/FontPlatformDataLinux.h:
+        (WebCore::FontPlatformData::FontPlatformData):
+
+2011-03-09  Steve Block  <steveblock@google.com>
+
+        Reviewed by Jeremy Orlow.
+
+        JavaNPObject should not use JNI directly
+        https://bugs.webkit.org/show_bug.cgi?id=56009
+
+        We move the JNI code to access a Java object's fields into
+        a new JavaInstance::getField() method.
+
+        No new tests, refactoring only.
+
+        * bridge/jni/v8/JavaInstanceV8.cpp:
+        (JavaInstance::getField):
+        * bridge/jni/v8/JavaInstanceV8.h:
+        * bridge/jni/v8/JavaNPObjectV8.cpp:
+        (JSC::Bindings::JavaNPObjectGetProperty):
+
+2011-03-09  Steve Block  <steveblock@google.com>
+
+        Reviewed by Jeremy Orlow.
+
+        NPAPI - jvalue conversion should not be in JavaInstance
+        https://bugs.webkit.org/show_bug.cgi?id=55967
+
+        No new tests, refactoring only.
+
+        * bridge/jni/v8/JavaInstanceV8.cpp:
+        (JavaInstance::invokeMethod):
+        * bridge/jni/v8/JavaInstanceV8.h:
+        * bridge/jni/v8/JavaNPObjectV8.cpp:
+        (JSC::Bindings::JavaNPObjectInvoke):
+
+2011-03-09  Jessie Berlin  <jberlin@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Use the Cookie Storage from the Private Browsing Storage Session directly
+        https://bugs.webkit.org/show_bug.cgi?id=55986
+
+        * WebCore.exp.in:
+        * platform/mac/WebCoreSystemInterface.h:
+        * platform/mac/WebCoreSystemInterface.mm:
+
+        * platform/network/mac/CookieStorageMac.mm:
+        (WebCore::setCookieStoragePrivateBrowsingEnabled):
+        Just copy the cookie storage from the private browsing storage session.
+        * platform/network/cf/CookieStorageCFNet.cpp:
+        (WebCore::setCookieStoragePrivateBrowsingEnabled):
+        Ditto.
+
+2011-03-09  Andrey Kosyakov  <caseq@chromium.org>
+
+        Unreviewed. Fixed a crash in InspectorInstrumentation::didReceiveResponse() when loader is null (broken in r80639)
+
+        * inspector/InspectorInstrumentation.cpp:
+        (WebCore::InspectorInstrumentation::didReceiveResourceResponseImpl):
+
+2011-03-09  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: pass explicit agent references to InspectorBackendDispatcher
+        https://bugs.webkit.org/show_bug.cgi?id=55820
+
+        * inspector/CodeGeneratorInspector.pm:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::InspectorController):
+        (WebCore::InspectorController::connectFrontend):
+        (WebCore::InspectorController::disconnectFrontend):
+        (WebCore::InspectorController::dispatchMessageFromFrontend):
+
+2011-03-09  Andrey Kosyakov  <caseq@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: resource errors are not reported before front-end is opened
+        https://bugs.webkit.org/show_bug.cgi?id=55939
+
+        * inspector/InspectorInstrumentation.cpp:
+        (WebCore::InspectorInstrumentation::didReceiveResourceResponseImpl):
+        * inspector/InspectorInstrumentation.h:
+        (WebCore::InspectorInstrumentation::didReceiveResourceResponse):
+        (WebCore::InspectorInstrumentation::didFailLoading):
+
+2011-03-08  Hans Wennborg  <hans@chromium.org>
+
+        Reviewed by Jeremy Orlow.
+
+        IndexedDB: Add BackingStoreType parameter to IDBFactoryBackendInterface::open
+        https://bugs.webkit.org/show_bug.cgi?id=55948
+
+        Add a parameter that allows for selection of alternative backing store
+        implementations.
+
+        No new tests: no new functionality.
+
+        * storage/IDBFactory.cpp:
+        (WebCore::IDBFactory::open):
+        * storage/IDBFactoryBackendImpl.cpp:
+        (WebCore::IDBFactoryBackendImpl::open):
+        * storage/IDBFactoryBackendImpl.h:
+        * storage/IDBFactoryBackendInterface.h:
+
+2011-03-08  Steve Block  <steveblock@google.com>
+
+        Reviewed by Jeremy Orlow.
+
+        Factor out JNI method call to be used by both JSC and V8
+        https://bugs.webkit.org/show_bug.cgi?id=55966
+
+        No new tests, refactoring only.
+
+        * bridge/jni/JNIUtility.cpp:
+        (JSC::Bindings::callJNIMethod):
+        * bridge/jni/JNIUtility.h:
+        * bridge/jni/jsc/JavaInstanceJSC.cpp:
+        (JavaInstance::invokeMethod):
+        * bridge/jni/v8/JavaInstanceV8.cpp:
+        (JavaInstance::invokeMethod):
+
+2011-03-09  Andrey Adaikin  <aandrey@google.com>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: [Text editor] Regression in handling DOMNodeInserted/DOMNodeRemoved events
+        https://bugs.webkit.org/show_bug.cgi?id=55818
+
+        * inspector/front-end/TextViewer.js:
+        (WebInspector.TextEditorMainPanel.prototype._handleDOMUpdates):
+
+2011-03-09  Ilya Tikhonovsky  <loislo@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: Web Inspector: we don't need to transfer objectId and hasChildren for primitive values.
+        https://bugs.webkit.org/show_bug.cgi?id=55998
+
+        * inspector/InjectedScriptSource.js:
+
+2011-03-09  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: watch expressions should show string values in quotes.
+        https://bugs.webkit.org/show_bug.cgi?id=55846
+
+        * inspector/InjectedScriptSource.js:
+        * inspector/front-end/ObjectPropertiesSection.js:
+        (WebInspector.ObjectPropertyTreeElement.prototype.update):
+        * inspector/front-end/RemoteObject.js:
+        (WebInspector.LocalJSONObject.prototype.get description):
+        * inspector/front-end/WatchExpressionsSidebarPane.js:
+        (WebInspector.WatchExpressionsSection.prototype.update):
+        * inspector/front-end/inspector.css:
+        (.console-formatted-string, .console-formatted-regexp):
+
+2011-03-09  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: "length" getter is invoked upon console object formatting.
+        https://bugs.webkit.org/show_bug.cgi?id=55220
+
+        * inspector/InjectedScriptSource.js:
+
+2011-03-08  Ilya Tikhonovsky  <loislo@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: remove groupName from objectId.
+        https://bugs.webkit.org/show_bug.cgi?id=55825
+
+        * inspector/InjectedScriptSource.js:
+
+2011-03-08  Xiaomei Ji  <xji@chromium.org>
+
+        Reviewed by David Hyatt.
+
+        Fix Regression: Content not drawn when scrolling horizontally in an RTL page.
+        https://bugs.webkit.org/show_bug.cgi?id=55077.
+
+        Inside ScrollView::calculateOverhangAreasForPainting(), when scroll position
+        is negative, should include the position value into overhang rectangle's 
+        starting position. 
+
+        Tests: fast/dom/scroll-reveal-left-overflow.html
+               fast/dom/scroll-reveal-top-overflow.html
+
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::calculateOverhangAreasForPainting):
+
+2011-03-08  Daniel Bates  <dbates@rim.com>
+
+        Reviewed by Darin Adler.
+
+        Add templatized CSSMutableStyleDeclaration::get{ShorthandValue, CommonValue, LayeredShorthandValue}()
+        https://bugs.webkit.org/show_bug.cgi?id=55351
+
+        By using some template magic CSSMutableStyleDeclaration::get{ShorthandValue, CommonValue, LayeredShorthandValue}()
+        can be called on an array A without the caller explicitly specifying the size of A.
+
+        No functionality was changed. So no new tests.
+
+        * css/CSSMutableStyleDeclaration.cpp:
+        (WebCore::CSSMutableStyleDeclaration::getPropertyValue): Modified to call templatized variants of
+        CSSMutableStyleDeclaration::get{ShorthandValue, CommonValue, LayeredShorthandValue}().
+        (WebCore::CSSMutableStyleDeclaration::getLayeredShorthandValue): Renamed second argument from "number" to "size"
+        to better reflect its purpose - to be the size of the passed array.
+        (WebCore::CSSMutableStyleDeclaration::getShorthandValue): Ditto.
+        (WebCore::CSSMutableStyleDeclaration::getCommonValue): Ditto.
+        (WebCore::CSSMutableStyleDeclaration::cssText): Modified to call templatized variant of CSSMutableStyleDeclaration::getShorthandValue().
+        * css/CSSMutableStyleDeclaration.h:
+        (WebCore::CSSMutableStyleDeclaration::getShorthandValue): Added templatized function that can determine
+        the size of a passed array. Changed type of second argument to size_t since it represents the size of
+        an array.
+        (WebCore::CSSMutableStyleDeclaration::getCommonValue): Ditto.
+        (WebCore::CSSMutableStyleDeclaration::getLayeredShorthandValue): Ditto.
+
+2011-03-08  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by Darin Adler.
+        
+        REGRESSION: Copied content loses formatting on paste to external apps.
+        https://bugs.webkit.org/show_bug.cgi?id=47615
+        <rdar://problem/9001214>
+        
+        This is a resubmission of a patch that was landed a while ago then rolled
+        back because of a build failure on SnowLeopard and Leopard on the 32-bit builds.
+
+        This patch adds a way for WebKit2 to create NSAttributedStrings from
+        a DOM range without using the AppKit api initWithDOMRange that internally
+        needs to access the WebView. The NSAttributedString is needed to create
+        RTF formats in the pasteboard.
+        This is to be considered a first step, since in the future we want to have
+        an implementation based on the TextIterator.
+        * WebCore.xcodeproj/project.pbxproj:
+        * platform/mac/HTMLConverter.h: Added.
+        * platform/mac/HTMLConverter.mm: Added.
+        * platform/mac/PasteboardMac.mm:
+        (WebCore::Pasteboard::writeSelection):
+
+2011-03-08  James Robinson  <jamesr@chromium.org>
+
+        Reviewed by Kenneth Russell.
+
+        [chromium] Explicitly copy compositing properties from LayerChromium to CCLayerImpl
+        https://bugs.webkit.org/show_bug.cgi?id=55900
+
+        This adds an explicit step to synchronize properties from
+        LayerChromiums to their corresponding CCLayerImpls.
+
+        * platform/graphics/chromium/LayerChromium.cpp:
+        (WebCore::LayerChromium::setBounds):
+        * platform/graphics/chromium/LayerChromium.h:
+        (WebCore::LayerChromium::bounds):
+        (WebCore::LayerChromium::doubleSided):
+        (WebCore::LayerChromium::setDoubleSided):
+        * platform/graphics/chromium/LayerRendererChromium.cpp:
+        (WebCore::LayerRendererChromium::updatePropertiesAndRenderSurfaces):
+        * platform/graphics/chromium/cc/CCLayerImpl.cpp:
+        (WebCore::CCLayerImpl::CCLayerImpl):
+        (WebCore::CCLayerImpl::updateFromLayer):
+        (WebCore::CCLayerImpl::descendantsDrawsContent):
+        * platform/graphics/chromium/cc/CCLayerImpl.h:
+        (WebCore::CCLayerImpl::anchorPoint):
+        (WebCore::CCLayerImpl::anchorPointZ):
+        (WebCore::CCLayerImpl::masksToBounds):
+        (WebCore::CCLayerImpl::opacity):
+        (WebCore::CCLayerImpl::position):
+        (WebCore::CCLayerImpl::preserves3D):
+        (WebCore::CCLayerImpl::sublayerTransform):
+        (WebCore::CCLayerImpl::transform):
+
+2011-03-08  James Robinson  <jamesr@chromium.org>
+
+        Chromium compile fix.
+
+        * platform/graphics/chromium/SimpleFontDataLinux.cpp:
+        (WebCore::SimpleFontData::platformInit):
+
+2011-03-08  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by James Robinson.
+
+        Unify Windows version checks, part 1.
+        https://bugs.webkit.org/show_bug.cgi?id=55979
+
+        Make everyone (I hope) pull in SystemInfo.cpp.  Eliminate the
+        now-unnecessary WindowsVersion.cpp from Chromium.
+
+        * GNUmakefile.am:
+        * WebCore.gyp/WebCore.gyp:
+        * WebCore.gypi:
+        * platform/chromium/ScrollbarThemeChromiumWin.cpp:
+        (WebCore::ScrollbarThemeChromiumWin::invalidateOnMouseEnterExit):
+        (WebCore::ScrollbarThemeChromiumWin::getThemeState):
+        (WebCore::ScrollbarThemeChromiumWin::getThemeArrowState):
+        * platform/chromium/WindowsVersion.cpp: Removed.
+        * platform/chromium/WindowsVersion.h: Removed.
+        * platform/graphics/chromium/GlyphPageTreeNodeChromiumWin.cpp:
+        (WebCore::fillBMPGlyphs):
+        * rendering/RenderThemeChromiumWin.cpp:
+        (WebCore::getNonClientMetrics):
+
+2011-03-08  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Chromium Linux build fix attempt after r80582.
+
+        * platform/graphics/chromium/FontLinux.cpp:
+        (WebCore::Font::drawGlyphs):
+        * platform/graphics/chromium/SimpleFontDataLinux.cpp:
+        (WebCore::SimpleFontData::platformInit):
+        * platform/graphics/skia/GlyphPageTreeNodeSkia.cpp:
+        (WebCore::GlyphPage::fill):
+
+2011-03-08  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Mac build fix attempt for r80582.
+
+        * platform/graphics/mac/ComplexTextControllerATSUI.cpp:
+        (WebCore::disableLigatures):
+
+2011-03-08  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Kent Tamura.
+
+        Remove calls to deprecatedEditingOffset in SelectionController and VisibleSelection
+        https://bugs.webkit.org/show_bug.cgi?id=54937
+
+        * editing/SelectionController.cpp:
+        (WebCore::SelectionController::setSelection): Calls anchorNode() instead of deprecatedNode() to obtain
+        the document. Also restrained the lifetime of document variable.
+        (WebCore::removingNodeRemovesPosition): Compare the node with anchorNode() instead of deprecatedNode()
+        to determine whether or not position becomes null after removing a node.
+        (WebCore::SelectionController::directionOfEnclosingBlock): The enclosing block is always a container
+        so call containerNode() instead of deprecatedNode().
+        (WebCore::SelectionController::debugRenderer): Call containerNode() and computeOffsetInContainer()
+        instead of deprecatedNode() and deprecatedEditingOffset() respectively.
+        (WebCore::SelectionController::isInPasswordField): Look for the shadow root from containerNode()
+        instead of deprecatedNode to determine whether or not selection inside a password field. Also assert
+        that the specified position is not before or after the shadow root as it violates our assumption.
+        * editing/VisibleSelection.cpp:
+        (WebCore::makeSearchRange): Call containerNode() and offsetInContainerNode() instead of deprecatedNode()
+        and deprecatedEditingOffset() respectively because start is always parent anchored and therefore
+        guaranteed to be an offset inside an anchor node.
+        (WebCore::VisibleSelection::adjustSelectionToAvoidCrossingEditingBoundaries): Call containerNode()
+        instead of deprecatedNode() to look for the lowest editable ancestor because position before or after
+        an editable element isn't editable.
+        * page/DOMSelection.cpp: Call containerNode() and offsetInContainerNode() instead of deprecatedNode()
+        and deprecatedEditingOffset() respectively in the following functions because they are exposed to
+        DOM, which doesn't have before/after concept.
+        (WebCore::DOMSelection::anchorNode):
+        (WebCore::DOMSelection::anchorOffset):
+        (WebCore::DOMSelection::focusNode):
+        (WebCore::DOMSelection::focusOffset):
+        (WebCore::DOMSelection::baseNode):
+        (WebCore::DOMSelection::baseOffset):
+        (WebCore::DOMSelection::extentNode):
+        (WebCore::DOMSelection::extentOffset):
+
+2011-03-08  Brent Fulgham  <bfulgham@webkit.org>
+
+        Reviewed by Adam Roben.
+
+        Correct uninitialized variable in PolicyCallback found while
+        running WebKit in BoundsChecker.
+        https://bugs.webkit.org/show_bug.cgi?id=45199.
+
+        * loader/PolicyCallback.cpp:
+        (WebCore::PolicyCallback::PolicyCallback): Initialize
+        m_argument.
+
+2011-03-08  Brent Fulgham  <bfulgham@webkit.org>
+
+        More build bustage fix.
+
+        * platform/graphics/win/cairo/FontPlatformData.h:
+        (WebCore::FontPlatformData::setOrientation): Duplicate accessor
+        in WinCairo-local header.  This is such a mess!
+
+2011-03-08  David Hyatt  <hyatt@apple.com>
+
+        Fix build bustage.  Hide orientation setting behind a setter and stub it out in all
+        FontPlatformData classes.  (This class really needs to move to a common header with ifdefs.)
+
+        * platform/graphics/SimpleFontData.cpp:
+        (WebCore::SimpleFontData::verticalRightOrientationFontData):
+        * platform/graphics/cg/FontPlatformData.h:
+        (WebCore::FontPlatformData::setOrientation):
+        * platform/graphics/chromium/FontPlatformDataChromiumWin.h:
+        (WebCore::FontPlatformData::setOrientation):
+        * platform/graphics/chromium/FontPlatformDataLinux.h:
+        (WebCore::FontPlatformData::setOrientation):
+        * platform/graphics/cocoa/FontPlatformData.h:
+        (WebCore::FontPlatformData::setOrientation):
+        * platform/graphics/freetype/FontPlatformData.h:
+        (WebCore::FontPlatformData::setOrientation):
+        * platform/graphics/qt/FontPlatformData.h:
+        (WebCore::FontPlatformData::setOrientation):
+        * platform/graphics/wince/FontPlatformData.h:
+        (WebCore::FontPlatformData::setOrientation):
+        * platform/graphics/wx/FontPlatformData.h:
+        (WebCore::FontPlatformData::setOrientation):
+
+2011-03-08  Joe Wild  <joseph.wild@nokia.com>
+
+        Reviewed by Csaba Osztrogonác.
+
+        [Qt] Missing SVG variables
+        https://bugs.webkit.org/show_bug.cgi?id=32941
+
+        Basically, this patch just modifies features.pri to the Qt build to
+        pass on the ENABLE_SVG_* flags to the IDL binding generator.
+
+        Also I had remove global-construtors.html from the skip list and
+        updated the associated expected results files.
+
+        * features.pri:
+        * page/DOMWindow.idl:
+
+2011-03-08  Alok priyadarshi  <alokp@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Plugins needs a way to trigger style recalc
+        https://bugs.webkit.org/show_bug.cgi?id=55242
+
+        No test needed. A simple get function is added.
+
+        * platform/graphics/chromium/PluginLayerChromium.h:
+        (WebCore::PluginLayerChromium::getTextureId):
+
+2011-03-08  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=48540, support the text-orientation CSS property.
+        
+        This patch adds support for two values of the text-orientation property (the ones that actually matter): vertical-right and upright.
+        The TextOrientation is part of the FontDescription and used to look up fonts (similar to FontOrientation).
+        
+        Orientation of non-CJK characters is done using fallback font data of the appropriate orientation type, e.g., verticalRightOrientation and
+        uprightOrientation fallback font data.  Vertical right is just implemented as a normal horizontal font.  Upright is implemented as a
+        vertically oriented font that rotates all glyphs.
+        
+        The main complication implementing text-orientation is that fonts have "baked-in" vertical glyphs for letters that are hardcoded to
+        a vertical right facing.  This means that you can use those special vertical glyphs for vertical-right orientation without having to 
+        fall back, but then for upright orientation you have to ignore them and still fall back.  As you can see from the test case, this doesn't
+        work very well, but hopefully it won't be all that common.  Limitations of CoreText prevent this case from rendering properly in either the
+        simple or complex code paths, although the simple code path at least gets close.
+
+        Added fast/blockflow/text-orientation-basic.html
+
+        * WebCore.exp.in:
+        * WebCore.xcodeproj/project.pbxproj:
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+        * css/CSSFontFaceSource.cpp:
+        (WebCore::CSSFontFaceSource::getFontData):
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue):
+        * css/CSSPrimitiveValueMappings.h:
+        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
+        (WebCore::CSSPrimitiveValue::operator TextOrientation):
+        * css/CSSPropertyNames.in:
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyDeclarations):
+        (WebCore::CSSStyleSelector::applyProperty):
+        * css/CSSValueKeywords.in:
+        * loader/cache/CachedFont.cpp:
+        (WebCore::CachedFont::platformDataFromCustomData):
+        * loader/cache/CachedFont.h:
+        * platform/graphics/FontCache.cpp:
+        (WebCore::FontPlatformDataCacheKey::FontPlatformDataCacheKey):
+        (WebCore::FontPlatformDataCacheKey::operator==):
+        (WebCore::computeHash):
+        (WebCore::FontCache::getCachedFontPlatformData):
+        * platform/graphics/FontDescription.h:
+        (WebCore::FontDescription::FontDescription):
+        (WebCore::FontDescription::textOrientation):
+        (WebCore::FontDescription::setTextOrientation):
+        (WebCore::FontDescription::operator==):
+        * platform/graphics/FontFastPath.cpp:
+        (WebCore::Font::glyphDataForCharacter):
+        (WebCore::offsetToMiddleOfGlyph):
+        * platform/graphics/SimpleFontData.cpp:
+        (WebCore::SimpleFontData::SimpleFontData):
+        (WebCore::SimpleFontData::verticalRightOrientationFontData):
+        (WebCore::SimpleFontData::uprightOrientationFontData):
+        (WebCore::SimpleFontData::brokenIdeographFontData):
+        (WebCore::SimpleFontData::DerivedFontData::~DerivedFontData):
+        * platform/graphics/SimpleFontData.h:
+        (WebCore::SimpleFontData::hasVerticalGlyphs):
+        (WebCore::SimpleFontData::isTextOrientationFallback):
+        * platform/graphics/cairo/FontCustomPlatformData.h:
+        * platform/graphics/cocoa/FontPlatformData.h:
+        (WebCore::FontPlatformData::FontPlatformData):
+        (WebCore::FontPlatformData::textOrientation):
+        (WebCore::FontPlatformData::hash):
+        (WebCore::FontPlatformData::operator==):
+        * platform/graphics/cocoa/FontPlatformDataCocoa.mm:
+        (WebCore::FontPlatformData::FontPlatformData):
+        (WebCore::FontPlatformData::operator=):
+        * platform/graphics/freetype/FontCustomPlatformDataFreeType.cpp:
+        (WebCore::FontCustomPlatformData::fontPlatformData):
+        * platform/graphics/haiku/FontCustomPlatformData.cpp:
+        (WebCore::FontCustomPlatformData::fontPlatformData):
+        * platform/graphics/haiku/FontCustomPlatformData.h:
+        * platform/graphics/mac/ComplexTextControllerCoreText.cpp:
+        (WebCore::ComplexTextController::collectComplexTextRunsForCharactersCoreText):
+        * platform/graphics/mac/FontCacheMac.mm:
+        (WebCore::FontCache::createFontPlatformData):
+        * platform/graphics/mac/FontCustomPlatformData.cpp:
+        (WebCore::FontCustomPlatformData::fontPlatformData):
+        * platform/graphics/mac/FontCustomPlatformData.h:
+        * platform/graphics/mac/FontMac.mm:
+        (WebCore::showGlyphsWithAdvances):
+        (WebCore::Font::drawGlyphs):
+        * platform/graphics/mac/GlyphPageTreeNodeMac.cpp:
+        (WebCore::shouldUseCoreText):
+        (WebCore::GlyphPage::fill):
+        * platform/graphics/mac/SimpleFontDataCoreText.cpp:
+        (WebCore::SimpleFontData::getCFStringAttributes):
+        * platform/graphics/mac/SimpleFontDataMac.mm:
+        (WebCore::SimpleFontData::platformInit):
+        (WebCore::SimpleFontData::platformBoundsForGlyph):
+        (WebCore::SimpleFontData::platformWidthForGlyph):
+        * platform/graphics/pango/FontCustomPlatformDataPango.cpp:
+        (WebCore::FontCustomPlatformData::fontPlatformData):
+        * platform/graphics/qt/FontCustomPlatformData.h:
+        * platform/graphics/qt/FontCustomPlatformDataQt.cpp:
+        (WebCore::FontCustomPlatformData::fontPlatformData):
+        * platform/graphics/skia/FontCustomPlatformData.cpp:
+        (WebCore::FontCustomPlatformData::fontPlatformData):
+        * platform/graphics/skia/FontCustomPlatformData.h:
+        * platform/graphics/win/FontCustomPlatformData.cpp:
+        (WebCore::FontCustomPlatformData::fontPlatformData):
+        * platform/graphics/win/FontCustomPlatformData.h:
+        * platform/graphics/win/FontCustomPlatformDataCairo.cpp:
+        (WebCore::FontCustomPlatformData::fontPlatformData):
+        * platform/graphics/win/FontCustomPlatformDataCairo.h:
+        * platform/graphics/wince/FontCustomPlatformData.cpp:
+        (WebCore::FontCustomPlatformData::fontPlatformData):
+        * platform/graphics/wince/FontCustomPlatformData.h:
+        * platform/text/TextOrientation.h: Added.
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::requiresIdeographicBaseline):
+        * rendering/style/RenderStyle.h:
+        (WebCore::InheritedFlags::initialTextOrientation):
+
+2011-03-08  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        addInlineStyleIfNeeded should take EditingStyle
+        https://bugs.webkit.org/show_bug.cgi?id=55950
+
+        Deployed EditingStyle in addInlineStyleIfNeeded, StyleChange::StyleChange, and StyleChange::init.
+        Also extracted EditingStyle::styleIsPresentInComputedStyleOfNode from removeStyleFromRunBeforeApplyingStyle.
+
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::StyleChange::StyleChange): Takes EditingStyle instead of CSSStyleDeclaration.
+        (WebCore::StyleChange::init): Ditto.
+        (WebCore::ApplyStyleCommand::applyBlockStyle): Instantiates StyleChange.
+        (WebCore::ApplyStyleCommand::applyInlineStyleToNodeRange): Calls addInlineStyleIfNeeded.
+        (WebCore::ApplyStyleCommand::removeStyleFromRunBeforeApplyingStyle): Calls styleIsPresentInComputedStyleOfNode.
+        (WebCore::ApplyStyleCommand::removeInlineStyleFromElement): Calls EditingStyle::mergeInlineStyleOfElement
+        instead of manually merging styles.
+        (WebCore::ApplyStyleCommand::applyInlineStyleToPushDown): Calls addInlineStyleIfNeeded.
+        (WebCore::ApplyStyleCommand::addInlineStyleIfNeeded): Takes EditingStyle instead of CSSMutableStyleDeclaration.
+        * editing/ApplyStyleCommand.h:
+        * editing/CompositeEditCommand.h:
+        * editing/EditingStyle.cpp:
+        (WebCore::EditingStyle::styleIsPresentInComputedStyleOfNode): Extracted from removeStyleFromRunBeforeApplyingStyle.
+        * editing/EditingStyle.h:
+
+2011-03-08  Nico Weber  <thakis@chromium.org>
+
+        Reviewed by James Robinson.
+
+        Crash on big blur radius with canvas
+        https://bugs.webkit.org/show_bug.cgi?id=55951
+
+        Move the clamping code out of an if branch, so that it happens in the
+        canvas case as well.
+
+        Test: fast/canvas/shadow-huge-blur.html
+
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::GraphicsContext::setPlatformShadow):
+
+2011-03-08  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        WK2: Cannot set focus on an element when focus is outside of WKView
+        https://bugs.webkit.org/show_bug.cgi?id=55281
+    
+        In WK2, focus cannot be set from the WebProcess side because there's no platformWidget().
+        Instead, the focus/unfocus messages need to be sent to the UIProcess side.
+
+        * platform/mac/WidgetMac.mm:
+        (WebCore::Widget::setFocus):
+
+2011-03-08  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Overflow: scroll areas should not paint white in scroll corner if the 
+        scrollbars are overlay.
+        <rdar://problem/9082871>
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::paintScrollCorner):
+        Don't paint the scroll corner white if we have overlay scrollbars.
+
+2011-03-08  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Darin Adler.
+
+        The first time animations are committed they have a bad start time
+        https://bugs.webkit.org/show_bug.cgi?id=55947
+
+        Do a check for a returned lastCommitTime of <=0 and replace it
+        with the mediaTime.
+
+
+        * platform/graphics/ca/win/CACFLayerTreeHost.cpp:
+        (WebCore::CACFLayerTreeHost::notifyAnimationsStarted):
+
+2011-03-08  James Kozianski  <koz@chromium.org>
+
+        Reviewed by David Levin.
+
+        Expose isValidProtocol() in KURL.h.
+        https://bugs.webkit.org/show_bug.cgi?id=54594
+
+        This is needed to validate protocols used in calls to
+        navigator.registerProtocolHandler().
+
+        * platform/KURL.cpp:
+        * platform/KURL.h:
+        * platform/KURLGoogle.cpp:
+        (WebCore::isValidProtocol):
+
+2011-03-08  Adam Roben  <aroben@apple.com>
+
+        Set svn:mime-type to text/css for all Inspector CSS files
+
+        This will cause them to be served with the correct MIME type from svn.webkit.org's web
+        interface.
+
+        Rubber-stamped by Tim Hatcher.
+
+        * inspector/front-end/audits.css: Added property svn:mime-type.
+        * inspector/front-end/goToLineDialog.css: Added property svn:mime-type.
+        * inspector/front-end/heapProfiler.css: Added property svn:mime-type.
+        * inspector/front-end/helpScreen.css: Added property svn:mime-type.
+        * inspector/front-end/inspector.css: Added property svn:mime-type.
+        * inspector/front-end/inspectorSyntaxHighlight.css: Added property svn:mime-type.
+        * inspector/front-end/networkPanel.css: Added property svn:mime-type.
+        * inspector/front-end/popover.css: Added property svn:mime-type.
+        * inspector/front-end/textViewer.css: Added property svn:mime-type.
+
+2011-03-08  Andrei Popescu  <andreip@google.com>
+
+        Reviewed by Steve Block.
+
+        IDBCallbacks::onsuccess(IDBIndex*) is unused and should be removed.
+        https://bugs.webkit.org/show_bug.cgi?id=55938
+
+        The IndexedDatabase specification changed and IDBIndex objects are no
+        longer created asynchronously. We therefore no longer need this method.
+
+        No new tests, just cleanup.
+
+        * storage/IDBCallbacks.h:
+        * storage/IDBRequest.cpp:
+        * storage/IDBRequest.h:
+
+2011-03-08  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r80551.
+        http://trac.webkit.org/changeset/80551
+        https://bugs.webkit.org/show_bug.cgi?id=55933
+
+        It broke 285 tests on Qt bot (Requested by Ossy on #webkit).
+
+        * WebCore.pro:
+        * platform/SharedBuffer.cpp:
+        * platform/SharedBuffer.h:
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::QNetworkReplyHandler::QNetworkReplyHandler):
+        (WebCore::QNetworkReplyHandler::sendResponseIfNeeded):
+        (WebCore::QNetworkReplyHandler::forwardData):
+        (WebCore::QNetworkReplyHandler::start):
+        * platform/network/qt/QNetworkReplyHandler.h:
+        * platform/network/qt/ResourceHandleQt.cpp:
+        (WebCore::ResourceHandle::supportsBufferedData):
+        (WebCore::ResourceHandle::bufferedData):
+        * platform/qt/QtByteBlock.cpp: Removed.
+        * platform/qt/QtByteBlock.h: Removed.
+        * platform/qt/SharedBufferQt.cpp:
+
+2011-03-08  Andreas Kling  <kling@webkit.org>
+
+        Reviewed by Benjamin Poulain.
+
+        RenderObject: Pass complex type arguments as const-references.
+
+        * WebCore.exp.in:
+        * rendering/RenderObject.h:
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::drawBoxSideFromPath):
+        (WebCore::RenderObject::drawArcForBoxSide):
+        (WebCore::RenderObject::localToAbsolute):
+        (WebCore::RenderObject::absoluteToLocal):
+
+2011-03-08  Andreas Kling  <kling@webkit.org>
+
+        Reviewed by Antonio Gomes.
+
+        Path: Make measurement functions const
+        https://bugs.webkit.org/show_bug.cgi?id=55914
+
+        * platform/graphics/Path.cpp:
+        (WebCore::Path::length):
+        (WebCore::Path::pointAtLength):
+        (WebCore::Path::normalAngleAtLength):
+        * platform/graphics/Path.h:
+        * platform/graphics/cairo/PathCairo.cpp:
+        (WebCore::Path::strokeBoundingRect):
+        * platform/graphics/cg/PathCG.cpp:
+        (WebCore::Path::strokeBoundingRect):
+        * platform/graphics/openvg/PathOpenVG.cpp:
+        (WebCore::Path::strokeBoundingRect):
+        (WebCore::Path::length):
+        (WebCore::Path::pointAtLength):
+        (WebCore::Path::normalAngleAtLength):
+        * platform/graphics/qt/PathQt.cpp:
+        (WebCore::Path::strokeBoundingRect):
+        (WebCore::Path::length):
+        (WebCore::Path::pointAtLength):
+        (WebCore::Path::normalAngleAtLength):
+        * platform/graphics/skia/PathSkia.cpp:
+        (WebCore::Path::strokeBoundingRect):
+        * platform/graphics/wince/PathWinCE.cpp:
+        (WebCore::Path::strokeBoundingRect):
+        * platform/graphics/wx/PathWx.cpp:
+        (WebCore::Path::strokeBoundingRect):
+
+2011-03-08  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        Reviewed by Martin Robinson.
+
+        [GTK] Do not set juntion sides on scrollbar stepper buttons
+        https://bugs.webkit.org/show_bug.cgi?id=55868
+
+        Fixes rendering of steppers for themes using rounded stepper
+        buttons on scrollbars like Adwaita.
+
+        * platform/gtk/ScrollbarThemeGtk3.cpp:
+        (WebCore::ScrollbarThemeGtk::paintButton):
+
+2011-03-08  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        Reviewed by Martin Robinson.
+
+        [GTK] Use doubles instead of integers for coordinates when rendering arrows
+        https://bugs.webkit.org/show_bug.cgi?id=55866
+
+        To prevent off-by-one rounding errors.
+
+        * platform/gtk/RenderThemeGtk3.cpp:
+        (WebCore::RenderThemeGtk::paintMenuList):
+        * platform/gtk/ScrollbarThemeGtk3.cpp:
+        (WebCore::ScrollbarThemeGtk::paintButton):
+
+2011-03-08  Markus Goetz  <guruz@guruz.de>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Use the QNetworkAccessManager zerocopy feature
+        https://bugs.webkit.org/show_bug.cgi?id=50082
+
+        The feature will be introduced in Qt 4.8.
+        This patch is backwards compatible with Qt 4.7.
+
+        * WebCore.pro:
+        * platform/SharedBuffer.cpp:
+        * platform/SharedBuffer.h:
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::QNetworkReplyHandler::QNetworkReplyHandler):
+        (WebCore::QNetworkReplyHandler::bufferedData):
+        (WebCore::QNetworkReplyHandler::sendResponseIfNeeded):
+        (WebCore::QNetworkReplyHandler::downloadProgress):
+        (WebCore::QNetworkReplyHandler::forwardData):
+        (WebCore::QNetworkReplyHandler::start):
+        * platform/network/qt/QNetworkReplyHandler.h:
+        * platform/network/qt/ResourceHandleQt.cpp:
+        (WebCore::ResourceHandle::supportsBufferedData):
+        (WebCore::ResourceHandle::bufferedData):
+        * platform/qt/SharedBufferQt.cpp:
+        (WebCore::SharedBuffer::wrapQtByteBlock):
+        (WebCore::SharedBuffer::hasPlatformData):
+        (WebCore::SharedBuffer::platformData):
+        (WebCore::SharedBuffer::platformDataSize):
+        (WebCore::SharedBuffer::maybeTransferPlatformData):
+        (WebCore::SharedBuffer::clearPlatformData):
+
+2011-03-08  Alejandro G. Castro  <alex@igalia.com>
+
+        Reviewed by Martin Robinson.
+
+        [GTK] Fix compilation warnings after r80429
+        https://bugs.webkit.org/show_bug.cgi?id=55864
+
+        * platform/gtk/WidgetGtk.cpp:
+
+2011-03-08  Philippe Normand  <pnormand@igalia.com>
+
+        Unreviewed, GTK build fix after r80536
+
+        * GNUmakefile.am:
+
+2011-03-08  Zan Dobersek  <zandobersek@gmail.com>
+
+        Reviewed by Martin Robinson.
+
+        [Gtk] toDataURL uses incorrect quality value when saving GdkPixbuf to buffer
+        https://bugs.webkit.org/show_bug.cgi?id=55878
+
+        Multiply the quality parameter by 100 to put it in the range [0, 100] as needed
+        when saving GdkPixbuf to a buffer.
+
+        * platform/graphics/gtk/ImageBufferGtk.cpp:
+        (WebCore::ImageBuffer::toDataURL):
+
+2011-03-07  Daniel Cheng  <dcheng@chromium.org>
+
+        Unreviewed.
+
+        Final build fix for r80536.
+
+        * DerivedSources.make:
+
+2011-03-07  Gyuyoung Kim  <gyuyoung.kim@samsung.com>
+
+        Reviewed by Kent Tamura.
+
+        [EFL] Adjust functions of WebCore's efl port to WebKit coding style
+        https://bugs.webkit.org/show_bug.cgi?id=55924
+
+        Adjust webkit style to PlatformKeyboardEventEfl, PlatformMouseEventEfl and WidgetEfl files.
+
+        * platform/efl/PlatformKeyboardEventEfl.cpp:
+        (WebCore::PlatformKeyboardEvent::PlatformKeyboardEvent):
+        * platform/efl/PlatformMouseEventEfl.cpp:
+        (WebCore::PlatformMouseEvent::PlatformMouseEvent):
+        * platform/efl/WidgetEfl.cpp:
+        (WebCore::Widget::frameRectsChanged):
+        (WebCore::Widget::setEvasObject):
+
+2011-03-07  Daniel Cheng  <dcheng@chromium.org>
+
+        Unreviewed.
+
+        More build fixes for r80536.
+
+        * CMakeLists.txt:
+        * platform/chromium/ClipboardChromium.cpp:
+        * platform/chromium/ClipboardChromium.h:
+
+2011-03-07  Gyuyoung Kim  <gyuyoung.kim@samsung.com>
+
+        Reviewed by Antonio Gomes.
+
+        [EFL] Adjust functions of ScrollbarEfl.cpp to WebKit coding style
+        https://bugs.webkit.org/show_bug.cgi?id=55917
+
+        Adjust webkit style to ScrollbarEfl files.
+
+        * platform/efl/ScrollbarEfl.cpp:
+        (scrollbarEflEdjeMessage):
+        (ScrollbarEfl::setParent):
+        (ScrollbarEfl::updateThumbPositionAndProportion):
+        (ScrollbarEfl::frameRectsChanged):
+        (ScrollbarEfl::paint):
+        * platform/efl/ScrollbarEfl.h:
+
+2011-03-07  Daniel Cheng  <dcheng@chromium.org>
+
+        Unreviewed.
+
+        Build fix for Chromium after r80536.
+
+        * platform/chromium/DataTransferItemChromium.cpp:
+        * platform/chromium/DataTransferItemsChromium.cpp:
+
+2011-03-07  Daniel Cheng  <dcheng@chromium.org>
+
+        Unreviewed.
+
+        More build fixes for r80536.
+
+        * CMakeLists.txt:
+        * platform/chromium/ClipboardChromium.cpp:
+        * platform/chromium/ClipboardChromium.h:
+
+2011-03-07  Daniel Cheng  <dcheng@chromium.org>
+
+        Reviewed by David Levin.
+
+        Add support for DataTransferItems
+        https://bugs.webkit.org/show_bug.cgi?id=55115
+
+        This patch adds stubs for DataTransferItems/DataTransferItem as well as implementing the
+        basic functionality on the Chromium port. With the exception of DataTransferItem::getAsFile,
+        all functionality on the DataTransferItems collection has been implemented.
+        This change does not actually hook up DataTransferItems to reflect the actual contents of a
+        drop/paste operation or to allow mutation of data in a copy/drag start yet. That will be
+        enabled via several followup patches.
+
+        Test: editing/pasteboard/data-transfer-items.html
+
+        * Android.mk:
+        * CMakeLists.txt:
+        * CodeGenerators.pri:
+        * DerivedSources.cpp:
+        * DerivedSources.make:
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/generic/RuntimeEnabledFeatures.cpp:
+        * bindings/generic/RuntimeEnabledFeatures.h:
+        (WebCore::RuntimeEnabledFeatures::setDataTransferItemsEnabled):
+        (WebCore::RuntimeEnabledFeatures::dataTransferItemsEnabled):
+        * bindings/scripts/CodeGeneratorV8.pm: Do not emit an #include line for DOMString, since it's built-in.
+        * dom/Clipboard.h:
+        (WebCore::Clipboard::policy):
+        * dom/Clipboard.idl:
+        * dom/DataTransferItem.cpp: Added.
+        * dom/DataTransferItem.h: Added.
+        (WebCore::DataTransferItem::~DataTransferItem):
+        * dom/DataTransferItem.idl: Added.
+        * dom/DataTransferItems.h: Added.
+        (WebCore::DataTransferItems::~DataTransferItems):
+        * dom/DataTransferItems.idl: Added.
+        * dom/StringCallback.cpp: Added.
+        (WebCore::StringCallback::scheduleCallback):
+        * dom/StringCallback.h: Added.
+        (WebCore::StringCallback::~StringCallback):
+        * dom/StringCallback.idl: Added.
+        * platform/chromium/ClipboardChromium.cpp:
+        (WebCore::ClipboardChromium::items):
+        * platform/chromium/ClipboardChromium.h:
+        * platform/chromium/DataTransferItemChromium.cpp: Added.
+        (WebCore::DataTransferItemChromium::create):
+        (WebCore::DataTransferItemChromium::DataTransferItemChromium):
+        (WebCore::DataTransferItemChromium::kind):
+        (WebCore::DataTransferItemChromium::type):
+        (WebCore::DataTransferItemChromium::getAsString):
+        * platform/chromium/DataTransferItemChromium.h: Added.
+        * platform/chromium/DataTransferItemsChromium.cpp: Added.
+        (WebCore::DataTransferItemsChromium::create):
+        (WebCore::DataTransferItemsChromium::DataTransferItemsChromium):
+        (WebCore::DataTransferItemsChromium::length):
+        (WebCore::DataTransferItemsChromium::item):
+        (WebCore::DataTransferItemsChromium::deleteItem):
+        (WebCore::DataTransferItemsChromium::clear):
+        (WebCore::DataTransferItemsChromium::add):
+        * platform/chromium/DataTransferItemsChromium.h: Added.
+
 2011-03-07  Ryosuke Niwa  <rniwa@webkit.org>
 
         Reviewed by Darin Adler.
diff --git a/Source/WebCore/CodeGenerators.pri b/Source/WebCore/CodeGenerators.pri
index d20f661..2f89a5d 100644
--- a/Source/WebCore/CodeGenerators.pri
+++ b/Source/WebCore/CodeGenerators.pri
@@ -109,6 +109,8 @@ IDL_BINDINGS += \
     dom/Comment.idl \
     dom/CompositionEvent.idl \
     dom/CustomEvent.idl \
+    dom/DataTransferItem.idl \
+    dom/DataTransferItems.idl \
     dom/DeviceMotionEvent.idl \
     dom/DeviceOrientationEvent.idl \
     dom/DocumentFragment.idl \
@@ -146,6 +148,7 @@ IDL_BINDINGS += \
     dom/ProgressEvent.idl \
     dom/RangeException.idl \
     dom/Range.idl \
+    dom/StringCallback.idl \
     dom/Text.idl \
     dom/TextEvent.idl \
     dom/Touch.idl \
@@ -331,6 +334,8 @@ IDL_BINDINGS += \
     page/SpeechInputEvent.idl \
     page/SpeechInputResult.idl \
     page/SpeechInputResultList.idl \
+    page/WebKitAnimation.idl \
+    page/WebKitAnimationList.idl \
     page/WebKitPoint.idl \
     page/WorkerNavigator.idl \
     plugins/DOMPlugin.idl \
@@ -542,7 +547,8 @@ IDL_BINDINGS += \
     xml/XSLTProcessor.idl
 
 
-INSPECTOR_INTERFACES = inspector/Inspector.idl
+INSPECTOR_JSON = inspector/Inspector.json
+INSPECTOR_IDL = $${WC_GENERATED_SOURCES_DIR}/Inspector.idl
 INSPECTOR_BACKEND_STUB_QRC = inspector/front-end/InspectorBackendStub.qrc
 INJECTED_SCRIPT_SOURCE = $$PWD/inspector/InjectedScriptSource.js
 
@@ -640,18 +646,27 @@ v8 {
 addExtraCompiler(idl)
 
 # GENERATOR 2: inspector idl compiler
+inspectorJSON.output = $${WC_GENERATED_SOURCES_DIR}/Inspector.idl
+inspectorJSON.input = INSPECTOR_JSON
+inspectorJSON.wkScript = $$PWD/inspector/generate-inspector-idl
+inspectorJSON.commands = python $$inspectorJSON.wkScript -o $${WC_GENERATED_SOURCES_DIR}/Inspector.idl $$PWD/inspector/Inspector.json
+inspectorJSON.depends = $$PWD/inspector/generate-inspector-idl
+inspectorJSON.wkAddOutputToSources = false
+addExtraCompiler(inspectorJSON)
+
 inspectorIDL.output = $${WC_GENERATED_SOURCES_DIR}/${QMAKE_FILE_BASE}Frontend.cpp $${WC_GENERATED_SOURCES_DIR}/${QMAKE_FILE_BASE}BackendDispatcher.cpp
-inspectorIDL.input = INSPECTOR_INTERFACES
+inspectorIDL.input = INSPECTOR_IDL
 inspectorIDL.wkScript = $$PWD/bindings/scripts/generate-bindings.pl
 inspectorIDL.commands = perl -I$$PWD/bindings/scripts -I$$PWD/inspector $$inspectorIDL.wkScript --defines \"$${FEATURE_DEFINES_JAVASCRIPT}\" --generator Inspector --outputDir $$WC_GENERATED_SOURCES_DIR --preprocessor \"$${QMAKE_MOC} -E\" ${QMAKE_FILE_NAME}
 inspectorIDL.depends = $$PWD/bindings/scripts/CodeGenerator.pm \
               $$PWD/inspector/CodeGeneratorInspector.pm \
               $$PWD/bindings/scripts/IDLParser.pm \
               $$PWD/bindings/scripts/IDLStructure.pm \
-              $$PWD/bindings/scripts/InFilesParser.pm
+              $$PWD/bindings/scripts/InFilesParser.pm \
+              $$PWD/inspector/Inspector.json \
+              $$PWD/inspector/generate-inspector-idl
 addExtraCompiler(inspectorIDL)
 
-inspectorBackendStub.wkAddOutputToSources = false
 inspectorBackendStub.output = generated/InspectorBackendStub.qrc
 inspectorBackendStub.input = INSPECTOR_BACKEND_STUB_QRC
 inspectorBackendStub.tempNames = $$PWD/$$INSPECTOR_BACKEND_STUB_QRC $${WC_GENERATED_SOURCES_DIR}/InspectorBackendStub.qrc
diff --git a/Source/WebCore/Configurations/Base.xcconfig b/Source/WebCore/Configurations/Base.xcconfig
index 94beb03..71344d4 100644
--- a/Source/WebCore/Configurations/Base.xcconfig
+++ b/Source/WebCore/Configurations/Base.xcconfig
@@ -25,7 +25,6 @@ DEBUG_INFORMATION_FORMAT = dwarf;
 GCC_C_LANGUAGE_STANDARD = gnu99;
 GCC_DEBUGGING_SYMBOLS = default;
 GCC_DYNAMIC_NO_PIC = NO;
-GCC_ENABLE_CPP_EXCEPTIONS = NO;
 GCC_ENABLE_CPP_RTTI = NO;
 GCC_ENABLE_OBJC_EXCEPTIONS = YES;
 GCC_ENABLE_OBJC_GC = $(GCC_ENABLE_OBJC_GC_$(REAL_PLATFORM_NAME));
@@ -118,12 +117,36 @@ TARGET_GCC_VERSION_macosx_1050_ = $(TARGET_GCC_VERSION_macosx_1050_$(XCODE_VERSI
 TARGET_GCC_VERSION_macosx_1050_0310 = GCC_42;
 TARGET_GCC_VERSION_macosx_1050_0320 = GCC_42;
 TARGET_GCC_VERSION_macosx_1060 = GCC_42;
-TARGET_GCC_VERSION_macosx_1070 = LLVM_GCC_42;
+TARGET_GCC_VERSION_macosx_1070 = $(TARGET_GCC_VERSION_macosx_1070_$(CONFIGURATION));
+TARGET_GCC_VERSION_macosx_1070_Debug = LLVM_COMPILER;
+TARGET_GCC_VERSION_macosx_1070_Release = LLVM_GCC_42;
+TARGET_GCC_VERSION_macosx_1070_Production = LLVM_GCC_42;
 
 GCC_VERSION = $(GCC_VERSION_$(TARGET_GCC_VERSION));
 GCC_VERSION_GCC_40 = 4.0;
 GCC_VERSION_GCC_42 = 4.2;
 GCC_VERSION_LLVM_GCC_42 = com.apple.compilers.llvmgcc42;
+GCC_VERSION_LLVM_COMPILER = com.apple.compilers.llvm.clang.1_0;
+
+// FIXME: Disable C++ exceptions in the LLVM Compiler once it supports enabling Obj-C exceptions without C++ exceptions.
+GCC_ENABLE_CPP_EXCEPTIONS = $(GCC_ENABLE_CPP_EXCEPTIONS_$(TARGET_GCC_VERSION));
+GCC_ENABLE_CPP_EXCEPTIONS_GCC_40 = NO;
+GCC_ENABLE_CPP_EXCEPTIONS_GCC_42 = NO;
+GCC_ENABLE_CPP_EXCEPTIONS_LLVM_GCC = NO;
+GCC_ENABLE_CPP_EXCEPTIONS_LLVM_COMPILER = YES;
+
+// FIXME: The size of the debug symbols generated for WebCore exceeds that which a 32-bit linker can deal with.
+// To allow the Leopard build bots to successfully compile WebCore we're disabling debug symbols in debug builds.
+GCC_GENERATE_DEBUGGING_SYMBOLS = $(GCC_GENERATE_DEBUGGING_SYMBOLS_$(REAL_PLATFORM_NAME));
+GCC_GENERATE_DEBUGGING_SYMBOLS_iphoneos = YES;
+GCC_GENERATE_DEBUGGING_SYMBOLS_iphonesimulator = YES;
+GCC_GENERATE_DEBUGGING_SYMBOLS_macosx = $(GCC_GENERATE_DEBUGGING_SYMBOLS_macosx_$(TARGET_MAC_OS_X_VERSION_MAJOR));
+GCC_GENERATE_DEBUGGING_SYMBOLS_macosx_1050 = $(GCC_GENERATE_DEBUGGING_SYMBOLS_macosx_1050_$(CONFIGURATION));
+GCC_GENERATE_DEBUGGING_SYMBOLS_macosx_1050_Debug = NO;
+GCC_GENERATE_DEBUGGING_SYMBOLS_macosx_1050_Release = YES;
+GCC_GENERATE_DEBUGGING_SYMBOLS_macosx_1050_Production = YES;
+GCC_GENERATE_DEBUGGING_SYMBOLS_macosx_1060 = YES;
+GCC_GENERATE_DEBUGGING_SYMBOLS_macosx_1070 = YES;
 
 // If the target Mac OS X version does not match the current Mac OS X version then we'll want to build using the target version's SDK.
 SDKROOT = $(SDKROOT_$(MAC_OS_X_VERSION_MAJOR)_$(TARGET_MAC_OS_X_VERSION_MAJOR));
diff --git a/Source/WebCore/Configurations/Version.xcconfig b/Source/WebCore/Configurations/Version.xcconfig
index 312b348..cc13feb 100644
--- a/Source/WebCore/Configurations/Version.xcconfig
+++ b/Source/WebCore/Configurations/Version.xcconfig
@@ -22,7 +22,7 @@
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 
 MAJOR_VERSION = 534;
-MINOR_VERSION = 24;
+MINOR_VERSION = 27;
 TINY_VERSION = 0;
 FULL_VERSION = $(MAJOR_VERSION).$(MINOR_VERSION);
 
diff --git a/Source/WebCore/Configurations/WebCore.xcconfig b/Source/WebCore/Configurations/WebCore.xcconfig
index f164902..33dc0e7 100644
--- a/Source/WebCore/Configurations/WebCore.xcconfig
+++ b/Source/WebCore/Configurations/WebCore.xcconfig
@@ -63,7 +63,7 @@ PRODUCTION_FRAMEWORKS_DIR_iphonesimulator = $(PRODUCTION_FRAMEWORKS_DIR_iphoneos
 PRODUCTION_FRAMEWORKS_DIR_macosx = $(NEXT_ROOT)$(SYSTEM_LIBRARY_DIR)/Frameworks;
 
 WEBKIT2_LDFLAGS = $(WEBKIT2_LDFLAGS_$(TARGET_MAC_OS_X_VERSION_MAJOR));
-WEBKIT2_LDFLAGS_1060 = -allowable_client WebKit2 -allowable_client WebKitTestRunner -allowable_client WebKitTestRunnerInjectedBundle;
+WEBKIT2_LDFLAGS_1060 = -allowable_client WebKit2
 WEBKIT2_LDFLAGS_1070 = $(WEBKIT2_LDFLAGS_1060);
 
 JAVASCRIPTCORE_PRIVATE_HEADERS_DIR = $(JAVASCRIPTCORE_PRIVATE_HEADERS_DIR_$(CONFIGURATION));
diff --git a/Source/WebCore/DerivedSources.cpp b/Source/WebCore/DerivedSources.cpp
index 72f1b2d..24022f7 100644
--- a/Source/WebCore/DerivedSources.cpp
+++ b/Source/WebCore/DerivedSources.cpp
@@ -72,6 +72,8 @@
 #include "JSDatabaseSync.cpp"
 #include "JSDataGridColumn.cpp"
 #include "JSDataGridColumnList.cpp"
+#include "JSDataTransferItem.cpp"
+#include "JSDataTransferItems.cpp"
 #include "JSDataView.cpp"
 #include "JSDedicatedWorkerContext.cpp"
 #include "JSDeviceOrientationEvent.cpp"
@@ -281,6 +283,7 @@
 #include "JSSQLTransactionSyncCallback.cpp"
 #include "JSStorage.cpp"
 #include "JSStorageEvent.cpp"
+#include "JSStringCallback.cpp"
 #include "JSStyleMedia.cpp"
 #include "JSStyleSheet.cpp"
 #include "JSStyleSheetList.cpp"
@@ -432,7 +435,9 @@
 #include "JSUint8Array.cpp"
 #include "JSUIEvent.cpp"
 #include "JSValidityState.cpp"
+#include "JSWebKitAnimation.cpp"
 #include "JSWebKitAnimationEvent.cpp"
+#include "JSWebKitAnimationList.cpp"
 #include "JSWebKitCSSKeyframeRule.cpp"
 #include "JSWebKitCSSKeyframesRule.cpp"
 #include "JSWebKitCSSTransformValue.cpp"
diff --git a/Source/WebCore/DerivedSources.make b/Source/WebCore/DerivedSources.make
index 29298ff..c8fa310 100644
--- a/Source/WebCore/DerivedSources.make
+++ b/Source/WebCore/DerivedSources.make
@@ -131,6 +131,8 @@ DOM_CLASSES = \
     CustomEvent \
     DataGridColumn \
     DataGridColumnList \
+    DataTransferItem \
+    DataTransferItems \
     DedicatedWorkerContext \
     DOMApplicationCache \
     DOMCoreException \
@@ -150,6 +152,8 @@ DOM_CLASSES = \
     DOMTokenList \
     DOMURL \
     DOMWindow \
+    DataTransferItem \
+    DataTransferItems \
     Database \
     DatabaseCallback \
     DatabaseSync \
@@ -347,6 +351,7 @@ DOM_CLASSES = \
     SQLTransactionSyncCallback \
     Storage \
     StorageEvent \
+    StringCallback \
     SVGAElement \
     SVGAltGlyphElement \
     SVGAngle \
@@ -493,6 +498,7 @@ DOM_CLASSES = \
     SVGZoomAndPan \
     SVGZoomEvent \
     Screen \
+    StringCallback \
     StyleMedia \
     StyleSheet \
     StyleSheetList \
@@ -506,7 +512,9 @@ DOM_CLASSES = \
     TreeWalker \
     UIEvent \
     ValidityState \
+    WebKitAnimation \
     WebKitAnimationEvent \
+    WebKitAnimationList \
     WebKitCSSKeyframeRule \
     WebKitCSSKeyframesRule \
     WebKitCSSMatrix \
@@ -569,7 +577,6 @@ all : \
     MathMLNames.cpp \
     XPathGrammar.cpp \
     tokenizer.cpp \
-    HeaderDetection.h \
 #
 
 # --------
@@ -730,7 +737,7 @@ ifeq ($(findstring ENABLE_VIDEO,$(FEATURE_DEFINES)), ENABLE_VIDEO)
 endif
 
 ifeq ($(findstring ENABLE_FULLSCREEN_API,$(FEATURE_DEFINES)), ENABLE_FULLSCREEN_API)
-    USER_AGENT_STYLE_SHEETS := $(USER_AGENT_STYLE_SHEETS) $(WebCore)/css/fullscreen.css
+    USER_AGENT_STYLE_SHEETS := $(USER_AGENT_STYLE_SHEETS) $(WebCore)/css/fullscreen.css $(WebCore)/css/fullscreenQuickTime.css
 endif
 
 UserAgentStyleSheets.h : css/make-css-file-arrays.pl $(USER_AGENT_STYLE_SHEETS)
@@ -881,6 +888,9 @@ JS%.h : %.idl $(JS_BINDINGS_SCRIPTS)
 
 # Inspector interfaces generator
 
+Inspector.idl : Inspector.json inspector/generate-inspector-idl
+	python $(WebCore)/inspector/generate-inspector-idl -o Inspector.idl $(WebCore)/inspector/Inspector.json
+
 all : InspectorFrontend.h
 
 INSPECTOR_GENERATOR_SCRIPTS = $(GENERATE_SCRIPTS) inspector/CodeGeneratorInspector.pm
@@ -949,21 +959,3 @@ DOM%.h : %.idl $(DOM_BINDINGS_SCRIPTS) bindings/objc/PublicDOMInterfaces.h
 # --------
 
 endif # MACOS
-
-# ------------------------
-
-# header detection
-
-ifeq ($(OS),MACOS)
-
-HeaderDetection.h : DerivedSources.make /System/Library/CoreServices/SystemVersion.plist
-	rm -f $@
-	echo "/* This is a generated file. Do not edit. */" > $@
-	if [ -f $(SDKROOT)/System/Library/Frameworks/AppKit.framework/PrivateHeaders/NSScrollerImpPair_Private.h ]; then echo "#define USE_WK_SCROLLBAR_PAINTER_AND_CONTROLLER 1" >> $@; else echo >> $@; fi
-
-else
-
-HeaderDetection.h :
-	echo > $@
-
-endif
diff --git a/Source/WebCore/English.lproj/Localizable.strings b/Source/WebCore/English.lproj/Localizable.strings
index 2019d1d..d47f260 100644
--- a/Source/WebCore/English.lproj/Localizable.strings
+++ b/Source/WebCore/English.lproj/Localizable.strings
diff --git a/Source/WebCore/English.lproj/localizedStrings.js b/Source/WebCore/English.lproj/localizedStrings.js
index cd4e6aa..0acde95 100644
--- a/Source/WebCore/English.lproj/localizedStrings.js
+++ b/Source/WebCore/English.lproj/localizedStrings.js
diff --git a/Source/WebCore/ForwardingHeaders/wtf/HexNumber.h b/Source/WebCore/ForwardingHeaders/wtf/HexNumber.h
new file mode 100644
index 0000000..d17b95e
--- /dev/null
+++ b/Source/WebCore/ForwardingHeaders/wtf/HexNumber.h
@@ -0,0 +1,4 @@
+#ifndef WebCore_FWD_HexNumber_h
+#define WebCore_FWD_HexNumber_h
+#include <JavaScriptCore/HexNumber.h>
+#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/ThreadSafeRefCounted.h b/Source/WebCore/ForwardingHeaders/wtf/ThreadSafeRefCounted.h
new file mode 100644
index 0000000..d7a35f8
--- /dev/null
+++ b/Source/WebCore/ForwardingHeaders/wtf/ThreadSafeRefCounted.h
@@ -0,0 +1,4 @@
+#ifndef WebCore_FWD_ThreadSafeRefCounted_h
+#define WebCore_FWD_ThreadSafeRefCounted_h
+#include <JavaScriptCore/ThreadSafeRefCounted.h>
+#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/ThreadSafeShared.h b/Source/WebCore/ForwardingHeaders/wtf/ThreadSafeShared.h
deleted file mode 100644
index 50c2bf4..0000000
--- a/Source/WebCore/ForwardingHeaders/wtf/ThreadSafeShared.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_ThreadSafeShared_h
-#define WebCore_FWD_ThreadSafeShared_h
-#include <JavaScriptCore/ThreadSafeShared.h>
-#endif
diff --git a/Source/WebCore/GNUmakefile.am b/Source/WebCore/GNUmakefile.am
index 4993bbb..eedbc9a 100644
--- a/Source/WebCore/GNUmakefile.am
+++ b/Source/WebCore/GNUmakefile.am
@@ -196,6 +196,8 @@ webcore_built_sources += \
 	DerivedSources/WebCore/JSDataGridColumn.h \
 	DerivedSources/WebCore/JSDataGridColumnList.cpp \
 	DerivedSources/WebCore/JSDataGridColumnList.h \
+	DerivedSources/WebCore/JSDataTransferItems.h \
+	DerivedSources/WebCore/JSDataTransferItems.cpp \
 	DerivedSources/WebCore/JSDataView.cpp \
 	DerivedSources/WebCore/JSDataView.h \
 	DerivedSources/WebCore/JSDedicatedWorkerContext.cpp \
@@ -596,7 +598,11 @@ webcore_built_sources += \
 	DerivedSources/WebCore/JSWebGLUniformLocation.h \
 	DerivedSources/WebCore/JSWebGLVertexArrayObjectOES.cpp \
 	DerivedSources/WebCore/JSWebGLVertexArrayObjectOES.h \
+	DerivedSources/WebCore/JSWebKitAnimation.cpp \
+	DerivedSources/WebCore/JSWebKitAnimation.h \
 	DerivedSources/WebCore/JSWebKitAnimationEvent.cpp \
+	DerivedSources/WebCore/JSWebKitAnimationList.h \
+	DerivedSources/WebCore/JSWebKitAnimationList.cpp \
 	DerivedSources/WebCore/JSWebKitAnimationEvent.h \
 	DerivedSources/WebCore/JSWebKitCSSKeyframeRule.cpp \
 	DerivedSources/WebCore/JSWebKitCSSKeyframeRule.h \
@@ -819,6 +825,7 @@ webcore_sources += \
 	Source/WebCore/bindings/js/JSImageConstructor.h \
 	Source/WebCore/bindings/js/JSImageDataCustom.cpp \
 	Source/WebCore/bindings/js/JSInjectedScriptHostCustom.cpp \
+	Source/WebCore/bindings/js/JSInjectedScriptManager.cpp \
 	Source/WebCore/bindings/js/JSInspectorFrontendHostCustom.cpp \
 	Source/WebCore/bindings/js/JSInt16ArrayCustom.cpp \
 	Source/WebCore/bindings/js/JSInt32ArrayCustom.cpp \
@@ -868,6 +875,8 @@ webcore_sources += \
 	Source/WebCore/bindings/js/JSUint16ArrayCustom.cpp \
 	Source/WebCore/bindings/js/JSUint32ArrayCustom.cpp \
 	Source/WebCore/bindings/js/JSUint8ArrayCustom.cpp \
+	Source/WebCore/bindings/js/JSWebKitAnimationCustom.cpp \
+	Source/WebCore/bindings/js/JSWebKitAnimationListCustom.cpp \
 	Source/WebCore/bindings/js/JSWebKitCSSKeyframeRuleCustom.cpp \
 	Source/WebCore/bindings/js/JSWebKitCSSKeyframesRuleCustom.cpp \
 	Source/WebCore/bindings/js/JSWebGLRenderingContextCustom.cpp \
@@ -884,6 +893,8 @@ webcore_sources += \
 	Source/WebCore/bindings/js/JavaScriptCallFrame.cpp \
 	Source/WebCore/bindings/js/JavaScriptCallFrame.h \
 	Source/WebCore/bindings/js/OptionsObject.h \
+	Source/WebCore/bindings/js/PageScriptDebugServer.cpp \
+	Source/WebCore/bindings/js/PageScriptDebugServer.h \
 	Source/WebCore/bindings/js/ScheduledAction.cpp \
 	Source/WebCore/bindings/js/ScheduledAction.h \
 	Source/WebCore/bindings/js/ScriptCachedFrameData.cpp \
@@ -922,6 +933,8 @@ webcore_sources += \
 	Source/WebCore/bindings/js/WebCoreJSClientData.h \
 	Source/WebCore/bindings/js/WorkerScriptController.cpp \
 	Source/WebCore/bindings/js/WorkerScriptController.h \
+	Source/WebCore/bindings/js/WorkerScriptDebugServer.cpp \
+	Source/WebCore/bindings/js/WorkerScriptDebugServer.h \
 	Source/WebCore/bindings/ScriptControllerBase.cpp \
 	Source/WebCore/bindings/ScriptControllerBase.h \
 	Source/WebCore/bridge/Bridge.h \
@@ -939,7 +952,10 @@ webcore_sources += \
 	Source/WebCore/bridge/IdentifierRep.h \
 	Source/WebCore/bridge/jni/JNIUtility.h \
 	Source/WebCore/bridge/jni/JavaMethod.h \
+	Source/WebCore/bridge/jni/JavaMethodJobject.cpp \
+	Source/WebCore/bridge/jni/JavaMethodJobject.h \
 	Source/WebCore/bridge/jni/JavaString.h \
+	Source/WebCore/bridge/jni/JavaType.h \
 	Source/WebCore/bridge/jni/jni_jsobject.h \
 	Source/WebCore/bridge/jni/jsc/JavaArrayJSC.h \
 	Source/WebCore/bridge/jni/jsc/JavaClassJSC.h \
@@ -1001,6 +1017,8 @@ webcore_sources += \
 	Source/WebCore/css/CSSInheritedValue.h \
 	Source/WebCore/css/CSSInitialValue.cpp \
 	Source/WebCore/css/CSSInitialValue.h \
+        Source/WebCore/css/CSSLineBoxContainValue.cpp \
+	Source/WebCore/css/CSSLineBoxContainValue.h \
 	Source/WebCore/css/CSSMediaRule.cpp \
 	Source/WebCore/css/CSSMediaRule.h \
 	Source/WebCore/css/CSSMutableStyleDeclaration.cpp \
@@ -1040,6 +1058,8 @@ webcore_sources += \
 	Source/WebCore/css/CSSSelector.h \
 	Source/WebCore/css/CSSSelectorList.cpp \
 	Source/WebCore/css/CSSSelectorList.h \
+	Source/WebCore/css/CSSStyleApplyProperty.cpp \
+	Source/WebCore/css/CSSStyleApplyProperty.h \
 	Source/WebCore/css/CSSStyleDeclaration.cpp \
 	Source/WebCore/css/CSSStyleDeclaration.h \
 	Source/WebCore/css/CSSStyleRule.cpp \
@@ -1106,8 +1126,6 @@ webcore_sources += \
 	Source/WebCore/css/WebKitCSSTransformValue.h \
 	Source/WebCore/dom/ActiveDOMObject.cpp \
 	Source/WebCore/dom/ActiveDOMObject.h \
-	Source/WebCore/dom/AsyncScriptRunner.cpp \
-	Source/WebCore/dom/AsyncScriptRunner.h \
 	Source/WebCore/dom/Attr.cpp \
 	Source/WebCore/dom/Attr.h \
 	Source/WebCore/dom/Attribute.cpp \
@@ -1208,6 +1226,8 @@ webcore_sources += \
 	Source/WebCore/dom/Event.h \
 	Source/WebCore/dom/EventContext.cpp \
 	Source/WebCore/dom/EventContext.h \
+	Source/WebCore/dom/EventDispatcher.cpp \
+	Source/WebCore/dom/EventDispatcher.h \
 	Source/WebCore/dom/EventException.h \
 	Source/WebCore/dom/EventListener.h \
 	Source/WebCore/dom/EventNames.cpp \
@@ -1297,6 +1317,8 @@ webcore_sources += \
 	Source/WebCore/dom/ScriptElement.h \
 	Source/WebCore/dom/ScriptExecutionContext.cpp \
 	Source/WebCore/dom/ScriptExecutionContext.h \
+	Source/WebCore/dom/ScriptRunner.cpp \
+	Source/WebCore/dom/ScriptRunner.h \
 	Source/WebCore/dom/SelectElement.cpp \
 	Source/WebCore/dom/SelectElement.h \
 	Source/WebCore/dom/SelectorNodeList.cpp \
@@ -1965,10 +1987,14 @@ webcore_sources += \
 	Source/WebCore/icu/unicode/uversion.h \
 	Source/WebCore/inspector/ConsoleMessage.cpp \
 	Source/WebCore/inspector/ConsoleMessage.h \
+	Source/WebCore/inspector/DOMNodeHighlighter.cpp \
+	Source/WebCore/inspector/DOMNodeHighlighter.h \
 	Source/WebCore/inspector/InjectedScript.cpp \
 	Source/WebCore/inspector/InjectedScript.h \
 	Source/WebCore/inspector/InjectedScriptHost.cpp \
 	Source/WebCore/inspector/InjectedScriptHost.h \
+	Source/WebCore/inspector/InjectedScriptManager.cpp \
+	Source/WebCore/inspector/InjectedScriptManager.h \
 	Source/WebCore/inspector/InspectorAgent.cpp \
 	Source/WebCore/inspector/InspectorAgent.h \
 	Source/WebCore/inspector/InspectorApplicationCacheAgent.cpp \
@@ -2004,6 +2030,8 @@ webcore_sources += \
 	Source/WebCore/inspector/InspectorFrontendHost.h \
 	Source/WebCore/inspector/InspectorInstrumentation.cpp \
 	Source/WebCore/inspector/InspectorInstrumentation.h \
+	Source/WebCore/inspector/InspectorPageAgent.cpp \
+	Source/WebCore/inspector/InspectorPageAgent.h \
 	Source/WebCore/inspector/InspectorProfilerAgent.cpp \
 	Source/WebCore/inspector/InspectorProfilerAgent.h \
 	Source/WebCore/inspector/InspectorResourceAgent.cpp \
@@ -2020,6 +2048,8 @@ webcore_sources += \
 	Source/WebCore/inspector/InspectorValues.h \
 	Source/WebCore/inspector/InspectorWorkerResource.h \
 	Source/WebCore/inspector/InstrumentingAgents.h \
+	Source/WebCore/inspector/PageDebuggerAgent.cpp \
+	Source/WebCore/inspector/PageDebuggerAgent.h \
 	Source/WebCore/inspector/ScriptArguments.cpp \
 	Source/WebCore/inspector/ScriptArguments.h \
 	Source/WebCore/inspector/ScriptBreakpoint.h \
@@ -2031,6 +2061,8 @@ webcore_sources += \
 	Source/WebCore/inspector/ScriptGCEventListener.h \
 	Source/WebCore/inspector/TimelineRecordFactory.cpp \
 	Source/WebCore/inspector/TimelineRecordFactory.h \
+	Source/WebCore/inspector/WorkerDebuggerAgent.cpp \
+	Source/WebCore/inspector/WorkerDebuggerAgent.h \
 	Source/WebCore/loader/appcache/ApplicationCache.cpp \
 	Source/WebCore/loader/appcache/ApplicationCacheGroup.cpp \
 	Source/WebCore/loader/appcache/ApplicationCacheGroup.h \
@@ -2108,7 +2140,8 @@ webcore_sources += \
 	Source/WebCore/loader/icon/IconDatabaseClient.h \
 	Source/WebCore/loader/icon/IconDatabase.cpp \
 	Source/WebCore/loader/icon/IconDatabase.h \
-	Source/WebCore/loader/icon/IconDatabaseNone.cpp \
+	Source/WebCore/loader/icon/IconDatabaseBase.cpp \
+	Source/WebCore/loader/icon/IconDatabaseBase.h \
 	Source/WebCore/loader/icon/IconLoader.cpp \
 	Source/WebCore/loader/icon/IconLoader.h \
 	Source/WebCore/loader/icon/IconRecord.cpp \
@@ -2303,6 +2336,11 @@ webcore_sources += \
 	Source/WebCore/page/UserScriptTypes.h \
 	Source/WebCore/page/UserStyleSheet.h \
 	Source/WebCore/page/UserStyleSheetTypes.h \
+	Source/WebCore/page/WebCoreKeyboardUIMode.h \
+	Source/WebCore/page/WebKitAnimation.h \
+	Source/WebCore/page/WebKitAnimation.cpp \
+	Source/WebCore/page/WebKitAnimationList.h \
+	Source/WebCore/page/WebKitAnimationList.cpp \
 	Source/WebCore/page/WebKitPoint.h \
 	Source/WebCore/page/WindowFeatures.cpp \
 	Source/WebCore/page/WindowFeatures.h \
@@ -2329,6 +2367,8 @@ webcore_sources += \
 	Source/WebCore/platform/CrossThreadCopier.h \
 	Source/WebCore/platform/Cursor.cpp \
 	Source/WebCore/platform/Cursor.h \
+	Source/WebCore/platform/DefaultLocalizationStrategy.cpp \
+	Source/WebCore/platform/DefaultLocalizationStrategy.h \
 	Source/WebCore/platform/DragData.cpp \
 	Source/WebCore/platform/DragData.h \
 	Source/WebCore/platform/DragImage.cpp \
@@ -2671,6 +2711,7 @@ webcore_sources += \
 	Source/WebCore/platform/text/TextEncoding.h \
 	Source/WebCore/platform/text/TextEncodingRegistry.cpp \
 	Source/WebCore/platform/text/TextEncodingRegistry.h \
+	Source/WebCore/platform/text/TextOrientation.h \
 	Source/WebCore/platform/text/TextStream.cpp \
 	Source/WebCore/platform/text/TextStream.h \
 	Source/WebCore/platform/text/transcoder/FontTranscoder.cpp \
@@ -3104,7 +3145,6 @@ webcore_sources += \
 	Source/WebCore/storage/DatabaseTracker.h \
 	Source/WebCore/storage/IDBAny.cpp \
 	Source/WebCore/storage/IDBAny.h \
-	Source/WebCore/storage/IDBBackingStore.cpp \
 	Source/WebCore/storage/IDBBackingStore.h \
 	Source/WebCore/storage/IDBCallbacks.h \
 	Source/WebCore/storage/IDBCursorBackendImpl.cpp \
@@ -3115,6 +3155,8 @@ webcore_sources += \
 	Source/WebCore/storage/IDBDatabaseBackendImpl.cpp \
 	Source/WebCore/storage/IDBDatabaseBackendImpl.h \
 	Source/WebCore/storage/IDBDatabaseBackendInterface.h \
+	Source/WebCore/storage/IDBDatabaseCallbacks.h \
+	Source/WebCore/storage/IDBDatabaseCallbacksImpl.h \
 	Source/WebCore/storage/IDBDatabase.cpp \
 	Source/WebCore/storage/IDBDatabaseError.h \
 	Source/WebCore/storage/IDBDatabaseException.h \
@@ -3146,10 +3188,13 @@ webcore_sources += \
 	Source/WebCore/storage/IDBObjectStore.h \
 	Source/WebCore/storage/IDBRequest.cpp \
 	Source/WebCore/storage/IDBRequest.h \
+	Source/WebCore/storage/IDBSQLiteBackingStore.cpp \
+	Source/WebCore/storage/IDBSQLiteBackingStore.h \
 	Source/WebCore/storage/IDBTransactionBackendInterface.h \
 	Source/WebCore/storage/IDBTransactionCoordinator.h \
 	Source/WebCore/storage/IDBTransaction.cpp \
 	Source/WebCore/storage/IDBTransaction.h \
+	Source/WebCore/storage/IDBVersionChangeEvent.h \
 	Source/WebCore/storage/IDBVersionChangeRequest.h \
 	Source/WebCore/storage/LocalStorageTask.cpp \
 	Source/WebCore/storage/LocalStorageTask.h \
@@ -3159,6 +3204,7 @@ webcore_sources += \
 	Source/WebCore/storage/OriginQuotaManager.h \
 	Source/WebCore/storage/OriginUsageRecord.cpp \
 	Source/WebCore/storage/OriginUsageRecord.h \
+	Source/WebCore/storage/SQLCallbackWrapper.h \
 	Source/WebCore/storage/SQLError.h \
 	Source/WebCore/storage/SQLException.h \
 	Source/WebCore/storage/SQLResultSet.cpp \
@@ -3201,6 +3247,9 @@ webcore_sources += \
 	Source/WebCore/storage/StorageNamespaceImpl.h \
 	Source/WebCore/storage/StorageSyncManager.cpp \
 	Source/WebCore/storage/StorageSyncManager.h \
+	Source/WebCore/storage/StorageTracker.cpp \
+	Source/WebCore/storage/StorageTracker.h \
+	Source/WebCore/storage/StorageTrackerClient.h \
 	Source/WebCore/svg/animation/SMILTimeContainer.cpp \
 	Source/WebCore/svg/animation/SMILTimeContainer.h \
 	Source/WebCore/svg/animation/SMILTime.cpp \
@@ -3711,6 +3760,8 @@ webcoregtk_sources += \
 	Source/WebCore/platform/graphics/cairo/OwnPtrCairo.h \
 	Source/WebCore/platform/graphics/cairo/PathCairo.cpp \
 	Source/WebCore/platform/graphics/cairo/PatternCairo.cpp \
+	Source/WebCore/platform/graphics/cairo/PlatformContextCairo.cpp \
+	Source/WebCore/platform/graphics/cairo/PlatformContextCairo.h \
 	Source/WebCore/platform/graphics/cairo/RefPtrCairo.cpp \
 	Source/WebCore/platform/graphics/cairo/RefPtrCairo.h \
 	Source/WebCore/platform/graphics/cairo/TransformationMatrixCairo.cpp \
@@ -3849,6 +3900,8 @@ if TARGET_WIN32
 webcore_sources += \
 	Source/WebCore/platform/ScrollAnimatorWin.cpp \
 	Source/WebCore/platform/ScrollAnimatorWin.h \
+	Source/WebCore/platform/win/SystemInfo.cpp \
+	Source/WebCore/platform/win/SystemInfo.h \
 	Source/WebCore/plugins/win/PluginDatabaseWin.cpp \
 	Source/WebCore/plugins/win/PluginMessageThrottlerWin.cpp \
 	Source/WebCore/plugins/win/PluginMessageThrottlerWin.h
@@ -3876,6 +3929,10 @@ webcoregtk_sources += \
 	Source/WebCore/platform/text/gtk/TextBreakIteratorGtk.cpp
 endif
 
+if !ENABLE_WEBKIT2
+FEATURE_DEFINES += WTF_USE_NATIVE_GTK_MAIN_FRAME_SCROLLBAR=1
+webcore_cppflags += -DWTF_USE_NATIVE_GTK_MAIN_FRAME_SCROLLBAR=1
+endif # END WEBKIT2
 
 # ---
 # Channel mesaging support
@@ -3898,7 +3955,7 @@ endif # END ENABLE_FAST_MOBILE_SCROLLING
 # ---
 if USE_FREETYPE
 webcoregtk_cppflags += \
-	-DUSE_FREETYPE=1 \
+	-DWTF_USE_FREETYPE=1 \
 	-I$(srcdir)/Source/WebCore/platform/graphics/freetype
 
 webcoregtk_sources += \
@@ -3915,7 +3972,7 @@ endif # END USE_FREETYPE
 # ---
 if USE_PANGO
 webcoregtk_cppflags += \
-	-DUSE_PANGO=1 \
+	-DWTF_USE_PANGO=1 \
 	-I$(srcdir)/Source/WebCore/platform/graphics/pango
 
 webcoregtk_sources += \
@@ -4016,10 +4073,23 @@ endif # END ENABLE_DATALIST
 
 # ----
 # HTML5 data transfer items support
-#-----
+# ----
 if ENABLE_DATA_TRANSFER_ITEMS
 FEATURE_DEFINES += ENABLE_DATA_TRANSFER_ITEMS=1
 webcore_cppflags += -DENABLE_DATA_TRANSFER_ITEMS=1
+webcore_built_sources += \
+        DerivedSources/WebCore/JSDataTransferItem.cpp \
+        DerivedSources/WebCore/JSDataTransferItem.h \
+        DerivedSources/WebCore/JSDataTransferItems.cpp \
+        DerivedSources/WebCore/JSDataTransferItems.h \
+        DerivedSources/WebCore/JSStringCallback.cpp \
+        DerivedSources/WebCore/JSStringCallback.h
+webcore_sources += \
+	Source/WebCore/dom/DataTransferItem.cpp \
+	Source/WebCore/dom/DataTransferItem.h \
+	Source/WebCore/dom/DataTransferItems.h \
+	Source/WebCore/dom/StringCallback.cpp \
+	Source/WebCore/dom/StringCallback.h
 endif # END ENABLE_DATA_TRANSFER_ITEMS
 
 # ----
@@ -4954,7 +5024,10 @@ DerivedSources/WebCore/XMLNames.cpp DerivedSources/WebCore/XMLNames.h: $(WebCore
 	$(AM_V_GEN)$(PERL) -I$(WebCore)/bindings/scripts $< --attrs $(WebCore)/xml/xmlattrs.in --outputDir "$(GENSOURCES_WEBCORE)"
 
 # All Web Inspector generated files are created with this one call to CodeGeneratorInspector.pm
-DerivedSources/WebCore/InspectorBackendDispatcher.cpp: $(WebCore)/inspector/Inspector.idl $(SCRIPTS_BINDINGS) $(WebCore)/inspector/CodeGeneratorInspector.pm
+DerivedSources/WebCore/Inspector.idl : $(WebCore)/inspector/Inspector.json $(WebCore)/inspector/generate-inspector-idl
+	$(PYTHON) $(WebCore)/inspector/generate-inspector-idl -o $(GENSOURCES_WEBCORE)/Inspector.idl $(WebCore)/inspector/Inspector.json
+
+DerivedSources/WebCore/InspectorBackendDispatcher.cpp: DerivedSources/WebCore/Inspector.idl $(SCRIPTS_BINDINGS) $(WebCore)/inspector/CodeGeneratorInspector.pm
 	$(AM_V_GEN)$(PERL) -I$(WebCore)/bindings/scripts -I$(WebCore)/inspector $(WebCore)/bindings/scripts/generate-bindings.pl $(IDL_PATH:%=--include "%") --outputDir "$(GENSOURCES_WEBCORE)" --defines "LANGUAGE_JAVASCRIPT=1 $(FEATURE_DEFINES)" --generator Inspector $<
 DerivedSources/WebCore/InspectorFrontend.h: DerivedSources/WebCore/InspectorFrontend.cpp
 DerivedSources/WebCore/InspectorFrontend.cpp: DerivedSources/WebCore/InspectorBackendStub.js
@@ -5090,6 +5163,8 @@ EXTRA_DIST += \
 	Source/WebCore/icu/LICENSE \
 	Source/WebCore/inspector/CodeGeneratorInspector.pm \
 	Source/WebCore/inspector/InjectedScriptSource.js \
+	Source/WebCore/inspector/Inspector.json \
+	Source/WebCore/inspector/generate-inspector-idl \
 	Source/WebCore/inspector/xxd.pl \
 	Source/WebCore/LICENSE-APPLE \
 	Source/WebCore/LICENSE-LGPL-2 \
@@ -5104,6 +5179,7 @@ EXTRA_DIST += \
 	Source/WebCore/svg/xlinkattrs.in \
 	Source/WebCore/xml/xmlattrs.in \
 	Source/WebCore/xml/xmlnsattrs.in \
+	Source/WebCore/xml/XMLViewer.xsl \
 	Source/WebCore/xml/XPathGrammar.y
 
 # Installing web inspector files
diff --git a/Source/WebCore/StringsNotToBeLocalized.txt b/Source/WebCore/StringsNotToBeLocalized.txt
deleted file mode 100644
index 6fb11f2..0000000
--- a/Source/WebCore/StringsNotToBeLocalized.txt
+++ /dev/null
@@ -1,893 +0,0 @@
-"    "
-" "
-" #%*[^\n\r]%*[\n\r]"
-" %32[^# \t\n\r]%*[^# \t\n\r] "
-" %@"
-" (KHTML, like Gecko) "
-" (KHTML, like Gecko)"
-" (clipped)"
-" (clipping)"
-" (reflection)"
-" *POST*"
-" *target*"
-" >>>"
-" Mac OS X %@) AppleWebKit/%@ (KHTML, like Gecko) %@"
-" Mac OS X %@) AppleWebKit/%@ (KHTML, like Gecko)"
-" Version/3.2.1"
-" class=\"%@\""
-" id=\"%@\""
-"#"
-"%"
-"%.0f"
-"%.1lf"
-"%.2lu/%.2lu/%.10lu-%.10lu.cache"
-"%.2u/%.2u/%.10u-%.10u.cache"
-"%0.fpx"
-"%02d:%02d"
-"%20"
-"%2d) "
-"%4u"
-"%@ %.0fpx %.0fpx %.0fpx"
-"%@ %.0fpx %.0fpx"
-"%@ %@"
-"%@%@"
-"%@, %@"
-"%@-%d"
-"%@/%s"
-"%@/Library/Preferences/%@"
-"%@:%u"
-"%@://%@"
-"%@://%@/%@"
-"%@://%@:%d"
-"%d"
-"%d:%02d:%02d"
-"%d_%d"
-"%d_%d_%d"
-"%dpx"
-"%ld"
-"%s%01d:%02d:%02d"
-"%s%02d:%02d"
-"%s%02d:%02d:%02d"
-"%u"
-"&ie=UTF-8&oe=UTF-8"
-"(%.0f, %.0f)"
-") AppleWebKit/"
-"+"
-"+ve z-order list"
-", "
-","
-"-"
-"-1px"
-"-createPluginMIMETypesPreferences"
-"-khtml-text-decorations-in-effect"
-"-ve z-order list"
-"."
-".download"
-".html"
-".jpg"
-".svg"
-".xhtml"
-"/"
-"/Frameworks/PDFKit.framework"
-"/Library/Internet Plug-Ins"
-"/System/Library/Frameworks/ApplicationServices.framework/Frameworks/LangAnalysis.framework/LangAnalysis"
-"/System/Library/Frameworks/Carbon.framework/Frameworks/HIToolbox.framework/HIToolbox"
-"/System/Library/Frameworks/CoreVideo.framework"
-"/Volumes"
-"/tmp/XXXXXX.tiff"
-"0"
-"062AEEE3-9E42-44DC-A8A9-236B216FE011"
-"1"
-"10.1"
-"10.1.53.60"
-"1000"
-"12px"
-"13"
-"16"
-"1800"
-"1px"
-"2"
-"3.1"
-"3dbd565b-db22-4d88-8e0e-778bde54524a"
-"420+"
-"5CACD637-F82F-491F-947A-5DCA38AA0FEA"
-"6EB8D98F-2723-4472-88D3-5936F9D6E631"
-"7"
-"7.1"
-"9"
-":"
-"://"
-":/?#"
-"; "
-"<!"
-"<%@ %@>"
-"<?"
-"<a "
-"<channel"
-"<feed"
-"<html"
-"<html>"
-"<rdf"
-"<rss"
-"<script"
-"<title>"
-">,?"
-"?"
-"@"
-"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+-."
-"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+.-"
-"ARIAApplicationAlert"
-"ARIAApplicationAlertDialog"
-"ARIAApplicationDialog"
-"ARIAApplicationLog"
-"ARIAApplicationMarquee"
-"ARIAApplicationStatus"
-"ARIAApplicationTimer"
-"ARIADocument"
-"ARIADocumentArticle"
-"ARIADocumentMath"
-"ARIADocumentNote"
-"ARIADocumentRegion"
-"ARIALandmarkApplication"
-"ARIALandmarkBanner"
-"ARIALandmarkComplementary"
-"ARIALandmarkContentInfo"
-"ARIALandmarkMain"
-"ARIALandmarkNavigation"
-"ARIALandmarkSearch"
-"ARIATabPanel"
-"ARIAUserInterfaceTooltip"
-"AXEnhancedUserInterface"
-"AccessibleBase"
-"AccessibleObjectFromWindow"
-"AllowsUndo"
-"Apple Web Archive pasteboard type"
-"AppleKeyboardUIMode"
-"AppleTextDirection"
-"AudioElement"
-"BEGIN:VCALENDAR"
-"BEGIN:VCARD"
-"BP_CreatePluginMIMETypesPreferences"
-"CFBundleShortVersionString"
-"CFDictionaryPropertyBag"
-"CSS"
-"Change Back to \\U201C%@\\U201D"
-"Content-Encoding"
-"Content-Length"
-"Content-Type"
-"ControlsPanel"
-"CurrentTimeDisplay"
-"D"
-"DCMDictionaryServiceWindowShow"
-"DELEGATE METHODS"
-"DOCBASE"
-"DOMHTMLObjectElement"
-"DOMNode"
-"DYLD_FRAMEWORK_PATH"
-"DefaultDownloadDelegate"
-"DefaultPolicyDelegate"
-"DeleteBackward"
-"DeleteForward"
-"DeleteWordBackward"
-"DeleteWordForward"
-"DisableWebKitDeveloperExtras"
-"FAKETRACKPOINTHSCROLLBAR"
-"FAKETRACKPOINTVSCROLLBAR"
-"FD3B2381-0BB6-4B59-AF09-0E599C8901CF"
-"FastMallocCommittedVMBytes"
-"FastMallocFreeListBytes"
-"FastMallocReservedVMBytes"
-"FrameName"
-"FullscreenButton"
-"GCS_COMPATTR"
-"GEN_DOMObject"
-"GET"
-"GroupName"
-"HIDictionaryWindowShow"
-"HTTP "
-"Helvetica"
-"HideClosedCaptionsButton"
-"HostedNetscapePluginStream"
-"IDNScriptWhiteList"
-"IDNScriptWhiteList.txt"
-"IMM32.DLL"
-"IMN_CHANGECANDIDATE"
-"IMN_CLOSECANDIDATE"
-"IMN_CLOSESTATUSWINDOW"
-"IMN_GUIDELINE"
-"IMN_OPENCANDIDATE"
-"IMN_OPENSTATUSWINDOW"
-"IMN_SETCANDIDATEPOS"
-"IMN_SETCOMPOSITIONFONT"
-"IMN_SETCOMPOSITIONWINDOW"
-"IMN_SETCONVERSIONMODE"
-"IMN_SETOPENSTATUS"
-"IMN_SETSENTENCEMODE"
-"IMN_SETSTATUSWINDOWPOS"
-"IMR_CANDIDATEWINDOW"
-"IMR_COMPOSITIONFONT"
-"IMR_COMPOSITIONWINDOW"
-"IMR_CONFIRMRECONVERTSTRING"
-"IMR_DOCUMENTFEED"
-"IMR_QUERYCHARPOSITION"
-"IMR_RECONVERTSTRING"
-"If-Match"
-"If-Modified-Since"
-"If-None-Match"
-"If-Range"
-"If-Unmodified-Since"
-"ImmAssociateContextEx"
-"ImmGetCompositionStringW"
-"ImmGetContext"
-"ImmNotifyIME"
-"ImmReleaseContext"
-"ImmSetCandidateWindow"
-"ImmSetOpenStatus"
-"IncludeDebugMenu"
-"InsertBacktab"
-"InsertNewline"
-"InsertTab"
-"Intel"
-"JSDOMWindowShell"
-"JavaScript"
-"JavaScriptFreeSize"
-"JavaScriptHeapSize"
-"JavaScriptJITSize"
-"JavaScriptStackSize"
-"Joy!peff"
-"LTR"
-"Library/Caches"
-"Library/Internet Plug-Ins"
-"LresultFromObject"
-"MIME\\Database\\Content Type"
-"MailQuirksUserScript"
-"MainPageJavaScript.js"
-"MemoryStream"
-"MenuCommands"
-"Microsoft/com.microsoft.Messenger"
-"MoveDown"
-"MoveDownAndModifySelection"
-"MoveLeft"
-"MoveLeftAndModifySelection"
-"MovePageDown"
-"MovePageDownAndModifySelection"
-"MovePageUp"
-"MovePageUpAndModifySelection"
-"MoveRight"
-"MoveRightAndModifySelection"
-"MoveToBeginningOfDocument"
-"MoveToBeginningOfDocumentAndModifySelection"
-"MoveToBeginningOfLine"
-"MoveToBeginningOfLineAndModifySelection"
-"MoveToEndOfDocument"
-"MoveToEndOfDocumentAndModifySelection"
-"MoveToEndOfLine"
-"MoveToEndOfLineAndModifySelection"
-"MoveUp"
-"MoveUpAndModifySelection"
-"MoveWordLeft"
-"MoveWordLeftAndModifySelection"
-"MoveWordRight"
-"MoveWordRightAndModifySelection"
-"Mozilla/5.0 (Macintosh; "
-"Mozilla/5.0 ("
-"MuteButton"
-"NP_GetEntryPoints"
-"NP_Initialize"
-"NP_Shutdown"
-"NSAlert"
-"NSAllowContinuousSpellChecking"
-"NSAllowsBaseWritingDirectionKeyBindings"
-"NSApplicationIcon"
-"NSCarbonWindow"
-"NSErrorFailingURLKey"
-"NSErrorFailingURLStringKey"
-"NSEvent"
-"NSView"
-"NeXT smart paste pasteboard type"
-"NetscapePluginInstanceProxy"
-"PDFDocument"
-"PDFPreviewView"
-"PDFView"
-"PDFViewChangedPage"
-"PDFViewDisplayModeChanged"
-"PDFViewScaleChanged"
-"POST"
-"PPC"
-"PauseButton"
-"PlayButton"
-"ProxyRuntimeObject"
-"Quartz.framework"
-"RTL"
-"Referer"
-"ReturnToRealtimeButton"
-"RewindButton"
-"SAMILang"
-"SAMIStyle"
-"SCROLLBAR"
-"Safari.exe"
-"ScrollerRectangle"
-"SeekBackButton"
-"SeekForwardButton"
-"SelectAll"
-"ShowClosedCaptionsButton"
-"Slider"
-"SliderThumb"
-"Software\\Alps\\Apoint\\TrackPoint"
-"Software\\Lenovo\\TrackPoint"
-"Software\\Lenovo\\UltraNav"
-"Software\\Synaptics\\SynTPEnh\\UltraNavPS2"
-"Software\\Synaptics\\SynTPEnh\\UltraNavUSB"
-"StatusDisplay"
-"TSUpdateCheck"
-"TimeRemainingDisplay"
-"Times"
-"ToggleBold"
-"ToggleItalic"
-"U+0009"
-"U+001B"
-"UTF-8"
-"UnMuteButton"
-"UseBackForwardList"
-"User-Agent"
-"VideoElement"
-"Volumes"
-"W"
-"WEBKIT_UNSET_DYLD_FRAMEWORK_PATH"
-"WebActionButtonKey"
-"WebActionElementKey"
-"WebActionFormKey"
-"WebActionModifierFlagsKey"
-"WebActionNavigationTypeKey"
-"WebActionOriginalURLKey"
-"WebActionPropertyBag"
-"WebArchive"
-"WebAuthenticationPanel"
-"WebBackForwardList"
-"WebBackForwardList:\n"
-"WebCache"
-"WebCookieManager"
-"WebCoreStatistics"
-"WebDataRequest"
-"WebDataSource"
-"WebDatabaseDidModifyDatabaseNotification"
-"WebDatabaseDidModifyOriginNotification"
-"WebDatabaseDirectory"
-"WebDatabaseDisplayNameKey"
-"WebDatabaseExpectedSizeKey"
-"WebDatabaseIdentifierKey"
-"WebDatabaseManager"
-"WebDatabaseUsageKey"
-"WebDocumentLoader"
-"WebDownload"
-"WebDropSource"
-"WebElementDOMNode"
-"WebElementFrame"
-"WebElementImage"
-"WebElementImageAltString"
-"WebElementImageRect"
-"WebElementImageURL"
-"WebElementIsContentEditableKey"
-"WebElementIsInScrollBar"
-"WebElementIsSelected"
-"WebElementLinkIsLive"
-"WebElementLinkLabel"
-"WebElementLinkTitle"
-"WebElementLinkURL"
-"WebElementMediaURL"
-"WebElementPropertyBag"
-"WebElementSpellingToolTip"
-"WebElementTargetFrame"
-"WebElementTitle"
-"WebError"
-"WebFrame"
-"WebFrameCanSuspendActiveDOMObjectsKey"
-"WebFrameHasPluginsKey"
-"WebFrameHasUnloadListenerKey"
-"WebFrameMainDocumentErrorKey"
-"WebFramePolicyListener"
-"WebFrameUsesApplicationCacheKey"
-"WebFrameUsesDatabasesKey"
-"WebFrameUsesGeolocationKey"
-"WebGeolocationPolicyListener"
-"WebGeolocationPosition"
-"WebHTMLRepresentation"
-"WebHistory"
-"WebHistoryAllItemsRemovedNotification"
-"WebHistoryDates"
-"WebHistoryFileVersion"
-"WebHistoryItem"
-"WebHistoryItemChangedNotification"
-"WebHistoryItems"
-"WebHistoryItemsAddedNotification"
-"WebHistoryItemsDiscardedWhileLoadingNotification"
-"WebHistoryItemsRemovedNotification"
-"WebHistoryLoadedNotification"
-"WebHistorySavedNotification"
-"WebIconDatabase"
-"WebIconDatabaseDidAddIconNotification"
-"WebIconDatabaseDidRemoveAllIconsNotification"
-"WebIconDatabaseDirectoryDefaultsKey"
-"WebIconDatabaseEnabled"
-"WebIconDatabaseImportDirectoryDefaultsKey"
-"WebIconDatabaseVersion"
-"WebIconNotificationUserInfoURLKey"
-"WebInspector"
-"WebInspectorPointer"
-"WebInspectorPreferences"
-"WebInspectorWindowClass"
-"WebJavaScriptCollector"
-"WebJavaScriptTextInputPanel"
-"WebKitClassFactory"
-"WebKitDeveloperExtras"
-"WebKitErrorDomain"
-"WebKitErrorMIMETypeKey"
-"WebKitErrorPlugInNameKey"
-"WebKitErrorPlugInPageURLStringKey"
-"WebKitHistoryAgeInDaysLimit"
-"WebKitHistoryItemLimit"
-"WebKitInspectorHiddenPanels"
-"WebKitLocalCache"
-"WebKitLogLevel"
-"WebKitOmitPDFSupport"
-"WebKitOriginalBottomMargin"
-"WebKitOriginalTopMargin"
-"WebKitPDFs-XXXXXX"
-"WebKitPlugInStreamXXXXXX"
-"WebKitPluginHost.app"
-"WebKitPreferences.plist"
-"WebKitStatistics"
-"WebLoginWindowDidSwitchFromUserNotification"
-"WebLoginWindowDidSwitchToUserNotification"
-"WebMainResource"
-"WebModalDialogPretendWindow"
-"WebMutableURLRequest"
-"WebNavigationData"
-"WebNodeHighlightPointer"
-"WebNodeHighlightWindowClass"
-"WebNotification"
-"WebNotificationCenter"
-"WebPageCacheDataSourceKey"
-"WebPageCacheDocumentViewKey"
-"WebPageCacheEntryDateKey"
-"WebPlugInAttributesKey"
-"WebPlugInBaseURLKey"
-"WebPlugInContainerKey"
-"WebPlugInContainingElementKey"
-"WebPlugInModeKey"
-"WebPlugInShouldLoadMainResourceKey"
-"WebPluginAttributes"
-"WebPluginBaseURL"
-"WebPluginContainer"
-"WebPluginDescription"
-"WebPluginExtensions"
-"WebPluginLocalizationName"
-"WebPluginMIMETypes"
-"WebPluginMIMETypesFilename"
-"WebPluginName"
-"WebPluginTypeDescription"
-"WebPluginTypeEnabled"
-"WebPluginWillPresentNativeUserInterface"
-"WebPreferences"
-"WebPreferences%d"
-"WebPreferencesChangedNotification"
-"WebPreferencesRemovedNotification"
-"WebProgressEstimateChangedNotification"
-"WebProgressFinishedNotification"
-"WebProgressStartedNotification"
-"WebResource"
-"WebResourceData"
-"WebResourceFrameName"
-"WebResourceHandler"
-"WebResourceMIMEType"
-"WebResourceResponse"
-"WebResourceTextEncodingName"
-"WebResourceURL"
-"WebScriptErrorDescription"
-"WebScriptErrorDomain"
-"WebScriptErrorLineNumber"
-"WebScriptObject"
-"WebScriptWorld"
-"WebScrollBar"
-"WebSecurityOrigin"
-"WebSerializedJSValue"
-"WebSiteURLToIconURLKey"
-"WebSubframeArchives"
-"WebSubresources"
-"WebTextRenderer"
-"WebURLAuthenticationChallenge"
-"WebURLAuthenticationChallengeSender"
-"WebURLCredential"
-"WebURLProtectionSpace"
-"WebURLResponse"
-"WebURLsWithTitlesPboardType"
-"WebUserContentURLPattern"
-"WebView"
-"WebViewDidBeginEditingNotification"
-"WebViewDidChangeNotification"
-"WebViewDidChangeSelectionNotification"
-"WebViewDidChangeTypingStyleNotification"
-"WebViewDidEndEditingNotification"
-"WebViewWindowClass"
-"WebWorkersPrivate"
-"Windows "
-"Windows 95"
-"Windows 98"
-"Windows 98; Win 9x 4.90"
-"Windows NT "
-"WmvPlugin"
-"XSL"
-"XXXXXX-"
-"\"@?"
-"\"\\"
-"\0"
-"\0*.*\0\0"
-"\\"
-"\\StringFileInfo\\%04x%04x\\ProductVersion"
-"\\StringFileInfo\\040904b0\\ProductVersion"
-"\\VarFileInfo\\Translation"
-"\\WebKit.resources"
-"\n        "
-"\n    "
-"\n"
-"\n--------------------------------------------\n"
-"\r"
-"\xFF\xD8\xFF\xE0"
-"_WebViewDidStartAcceleratedCompositing"
-"_top"
-"a"
-"ab"
-"about:"
-"acceleratedCompositingEnabled"
-"actions"
-"anchorPoint"
-"apple-dashboard://stylesheet"
-"applewebdata"
-"applewebdata://%@"
-"application.pdf"
-"application/atom+xml"
-"application/octet-stream"
-"application/pdf"
-"application/postscript"
-"application/rss+xml"
-"application/x-apple-msg-attachment"
-"application/x-java-applet"
-"application/x-snkp"
-"application/x-webarchive"
-"application/xhtml+xml"
-"attributeKeys"
-"attributeValues"
-"b"
-"basefont"
-"bounds"
-"bundlePath"
-"c"
-"canGoBack"
-"canGoForward"
-"com.RealNetworks.RealOne Player"
-"com.adiumX.adiumX"
-"com.adobe.Acrobat"
-"com.adobe.Acrobat.Pro"
-"com.adobe.Contribute"
-"com.adobe.InCopy"
-"com.adobe.InDesign"
-"com.adobe.Installers.Setup"
-"com.adobe.Reader"
-"com.adobe.Soundbooth"
-"com.adobe.distiller"
-"com.adobe.dreamweaver-9.0"
-"com.alientechnology.Proteus"
-"com.app4mac.KidsBrowsercom.app4mac.wKiosk"
-"com.apple.Aperture"
-"com.apple.AppKit"
-"com.apple.Automator"
-"com.apple.Automator."
-"com.apple.AutomatorRunner"
-"com.apple.Dashcode"
-"com.apple.Dictionary"
-"com.apple.HIWebView"
-"com.apple.JavaAppletPlugin"
-"com.apple.JavaPluginCocoa"
-"com.apple.KeyboardUIModeDidChange"
-"com.apple.Mail"
-"com.apple.QuickTime Plugin.plugin"
-"com.apple.Safari"
-"com.apple.WebCore"
-"com.apple.WebKit"
-"com.apple.WebKit.PluginAgent"
-"com.apple.Xcode"
-"com.apple.dashboard.client"
-"com.apple.helpviewer"
-"com.apple.hiview"
-"com.apple.iChat"
-"com.apple.iWeb"
-"com.apple.installer"
-"com.apple.mail"
-"com.apple.quicktime.webplugin"
-"com.apple.universalaccess"
-"com.barebones.bbedit"
-"com.barebones.textwrangler"
-"com.barebones.yojimbo"
-"com.culturedcode.xyle"
-"com.e-frontier.shade10"
-"com.equinux.iSale4"
-"com.equinux.iSale5"
-"com.freeverse.bumpercar"
-"com.growl.growlframework"
-"com.intrarts.PandoraMan"
-"com.karelia.Sandvox"
-"com.lizardtech.NPDjVu"
-"com.macrabbit.CSSEdit"
-"com.macromates.textmate"
-"com.macromedia.Flash Player.plugin"
-"com.macromedia.fireworks"
-"com.microsoft.SilverlightPlugin"
-"com.microsoft.WMP.defaultplugin"
-"com.omnigroup.OmniWeb5"
-"com.panic.Coda"
-"com.ranchero.NetNewsWire"
-"com.realmacsoftware.rapidweaverpro"
-"com.red-sweater.marsedit"
-"com.sunrisebrowser.Sunrise"
-"com.thinkmac.NewsLife"
-"com.yahoo.messenger3"
-"composited for plug-in, video or WebGL"
-"composited: container layer"
-"composited: tiled layer"
-"contents"
-"contentsRect"
-"cp949"
-"cpuType"
-"de.codingmonkeys.SubEthaEdit"
-"dir"
-"displayTitle"
-"doctype"
-"estimatedProgress"
-"fi.karppinen.Pyro"
-"file:"
-"file:///System/Library/PrivateFrameworks/DashboardClient.framework/Resources/widget.css"
-"frameName"
-"fsVideoAudioVolumeHigh"
-"fsVideoAudioVolumeLow"
-"fsVideoExitFullscreen"
-"fsVideoPause"
-"fsVideoPlay"
-"ftp:"
-"fullFrame"
-"fullscreenVideeoHUDWindowClass"
-"groupName"
-"htm"
-"html"
-"http"
-"http:"
-"http://"
-"http://www.google.com/search?q="
-"https"
-"https:"
-"i"
-"icon.db"
-"image.pict"
-"image.png"
-"image.tiff"
-"image/jpeg"
-"image/pict"
-"image/png"
-"image/svg+xml"
-"image/tiff"
-"img"
-"info.colloquy"
-"insertText:"
-"isLoading"
-"isindex"
-"javascript:"
-"jpeg"
-"js"
-"kioskmode"
-"ks_c_5601-1987"
-"kungfoo.tv.ecto"
-"lastVisitWasFailure"
-"lastVisitWasHTTPNonGet"
-"lastVisitedDate"
-"line-through"
-"lineNumber"
-"localhost"
-"localized string not found"
-"localizedStrings"
-"mailto:"
-"mainFrameDocument"
-"mainFrameIcon"
-"mainFrameTitle"
-"mainFrameURL"
-"mimeType"
-"net.hmdt-web.Shiira"
-"normal flow list"
-"oleacc.dll"
-"opacity"
-"org.xlife.NewsFire"
-"pluginHostPath"
-"pluginspage"
-"position"
-"privateBrowsingEnabled"
-"public.url"
-"public.url-name"
-"r"
-"r+b"
-"rect:%@ clip:%@ type:%s"
-"redirectURLs"
-"rgb(%.0f,%.0f,%.0f)"
-"rgba(%.0f,%.0f,%.0f,%f)"
-"s"
-"sourceURL"
-"src"
-"sub"
-"sublayerTransform"
-"sublayers"
-"text/calendar"
-"text/directory"
-"text/html"
-"text/ldif"
-"text/pdf"
-"text/plain"
-"text/qif"
-"text/rtf"
-"text/vcalendar"
-"text/vcard"
-"text/x-calendar"
-"text/x-csv"
-"text/x-qif"
-"text/x-vcalendar"
-"text/x-vcard"
-"text/x-vcf"
-"transform"
-"txt"
-"u"
-"uk.co.opencommunity.vienna2"
-"userAgent"
-"userInfo"
-"utf-16"
-"visibleName"
-"visitCount"
-"webkit-fake-url"
-"webplugin"
-"x"
-"x-apple-web-kit/"
-"xml"
-"xsl"
-"{A3676398-4485-4a9d-87DC-CB5A40E6351D}"
-"~/Library/Icons"
-"~/Library/WebKit/Databases"
-WebKit/mac/History/WebHistoryItem.mm:" in \"%@\""
-WebKit/mac/History/WebHistoryItem.mm:"children"
-WebKit/mac/History/WebHistoryItem.mm:"title"
-WebKit/mac/Misc/WebCache.mm:"Images"
-WebKit/mac/Misc/WebKitLogging.h:"<not running on main thread>"
-WebKit/mac/Misc/WebKitVersionChecks.m:"WebKit"
-WebKit/mac/Misc/WebNSNotificationCenterExtras.m:"name"
-WebKit/mac/Misc/WebNSNotificationCenterExtras.m:"object"
-WebKit/mac/Misc/WebNSURLExtras.mm:"file"
-WebKit/mac/Plugins/Hosted/HostedNetscapePluginStream.mm:" OK\n"
-WebKit/mac/Plugins/Hosted/HostedNetscapePluginStream.mm:": "
-WebKit/mac/Plugins/Hosted/HostedNetscapePluginStream.mm:"identity"
-WebKit/mac/Plugins/Hosted/NetscapePluginHostManager.mm:"localization"
-WebKit/mac/Plugins/Hosted/ProxyInstance.mm
-WebKit/mac/Plugins/WebBaseNetscapePluginView.mm:"basic"
-WebKit/mac/Plugins/WebBaseNetscapePluginView.mm:"digest"
-WebKit/mac/Plugins/WebBaseNetscapePluginView.mm:"true"
-WebKit/mac/Plugins/WebBasePluginPackage.mm:"Java Applet Plugin Enabler"
-WebKit/mac/Plugins/WebNetscapePluginPackage.mm:"RealPlayer Plugin"
-WebKit/mac/Plugins/WebNetscapePluginPackage.mm:"main"
-WebKit/mac/Plugins/WebNetscapePluginStream.mm:" OK\n"
-WebKit/mac/Plugins/WebNetscapePluginStream.mm:": "
-WebKit/mac/Plugins/WebNetscapePluginStream.mm:"identity"
-WebKit/mac/Plugins/WebNetscapePluginView.mm:"height"
-WebKit/mac/Plugins/WebNetscapePluginView.mm:"width"
-WebKit/mac/WebCoreSupport/WebChromeClient.mm:"dialog"
-WebKit/mac/WebCoreSupport/WebChromeClient.mm:"fullscreen"
-WebKit/mac/WebCoreSupport/WebChromeClient.mm:"height"
-WebKit/mac/WebCoreSupport/WebChromeClient.mm:"menuBarVisible"
-WebKit/mac/WebCoreSupport/WebChromeClient.mm:"message"
-WebKit/mac/WebCoreSupport/WebChromeClient.mm:"resizable"
-WebKit/mac/WebCoreSupport/WebChromeClient.mm:"scrollbarsVisible"
-WebKit/mac/WebCoreSupport/WebChromeClient.mm:"statusBarVisible"
-WebKit/mac/WebCoreSupport/WebChromeClient.mm:"toolBarVisible"
-WebKit/mac/WebCoreSupport/WebChromeClient.mm:"width"
-WebKit/mac/WebCoreSupport/WebChromeClient.mm:"y"
-WebKit/mac/WebCoreSupport/WebEditorClient.mm:"Down"
-WebKit/mac/WebCoreSupport/WebEditorClient.mm:"Enter"
-WebKit/mac/WebCoreSupport/WebEditorClient.mm:"Up"
-WebKit/mac/WebCoreSupport/WebEditorClient.mm:"applet"
-WebKit/mac/WebCoreSupport/WebEditorClient.mm:"body"
-WebKit/mac/WebCoreSupport/WebEditorClient.mm:"center"
-WebKit/mac/WebCoreSupport/WebEditorClient.mm:"font"
-WebKit/mac/WebCoreSupport/WebEditorClient.mm:"head"
-WebKit/mac/WebCoreSupport/WebEditorClient.mm:"menu"
-WebKit/mac/WebCoreSupport/WebEditorClient.mm:"object"
-WebKit/mac/WebCoreSupport/WebEditorClient.mm:"strike"
-WebKit/mac/WebCoreSupport/WebEditorClient.mm:"style"
-WebKit/mac/WebCoreSupport/WebFrameLoaderClient.mm:"height"
-WebKit/mac/WebCoreSupport/WebFrameLoaderClient.mm:"width"
-WebKit/mac/WebCoreSupport/WebInspectorClient.mm:"Menlo"
-WebKit/mac/WebCoreSupport/WebInspectorClient.mm:"Monaco"
-WebKit/mac/WebCoreSupport/WebInspectorClient.mm:"Web Inspector 2"
-WebKit/mac/WebCoreSupport/WebInspectorClient.mm:"inspector"
-WebKit/mac/WebView/WebDashboardRegion.mm:"Circle"
-WebKit/mac/WebView/WebDashboardRegion.mm:"None"
-WebKit/mac/WebView/WebDashboardRegion.mm:"Rectangle"
-WebKit/mac/WebView/WebDashboardRegion.mm:"Unknown"
-WebKit/mac/WebView/WebHTMLView.mm:"'%@'"
-WebKit/mac/WebView/WebHTMLView.mm:"Version:"
-WebKit/mac/WebView/WebHTMLView.mm:"applet"
-WebKit/mac/WebView/WebHTMLView.mm:"baseline"
-WebKit/mac/WebView/WebHTMLView.mm:"black"
-WebKit/mac/WebView/WebHTMLView.mm:"body"
-WebKit/mac/WebView/WebHTMLView.mm:"bold"
-WebKit/mac/WebView/WebHTMLView.mm:"center"
-WebKit/mac/WebView/WebHTMLView.mm:"direction"
-WebKit/mac/WebView/WebHTMLView.mm:"font"
-WebKit/mac/WebView/WebHTMLView.mm:"head"
-WebKit/mac/WebView/WebHTMLView.mm:"italic"
-WebKit/mac/WebView/WebHTMLView.mm:"menu"
-WebKit/mac/WebView/WebHTMLView.mm:"none"
-WebKit/mac/WebView/WebHTMLView.mm:"normal"
-WebKit/mac/WebView/WebHTMLView.mm:"object"
-WebKit/mac/WebView/WebHTMLView.mm:"print"
-WebKit/mac/WebView/WebHTMLView.mm:"screen"
-WebKit/mac/WebView/WebHTMLView.mm:"strike"
-WebKit/mac/WebView/WebHTMLView.mm:"style"
-WebKit/mac/WebView/WebHTMLView.mm:"super"
-WebKit/mac/WebView/WebHTMLView.mm:"transparent"
-WebKit/mac/WebView/WebHTMLView.mm:"underline"
-WebKit/mac/WebView/WebHTMLView.mm:"white"
-WebKit/mac/WebView/WebJSPDFDoc.mm
-WebKit/mac/WebView/WebPDFDocumentExtras.mm
-WebKit/mac/WebView/WebPreferenceKeysPrivate.h
-WebKit/mac/WebView/WebPreferences.mm:"Apple Chancery"
-WebKit/mac/WebView/WebPreferences.mm:"Courier"
-WebKit/mac/WebView/WebPreferences.mm:"ISO-8859-1"
-WebKit/mac/WebView/WebPreferences.mm:"Identifier"
-WebKit/mac/WebView/WebPreferences.mm:"Papyrus"
-WebKit/mac/WebView/WebPreferences.mm:"Values"
-WebKit/mac/WebView/WebRenderLayer.mm:"composited"
-WebKit/mac/WebView/WebVideoFullscreenController.mm:"WebKit playing a video fullscreen."
-WebKit/mac/WebView/WebVideoFullscreenHUDWindowController.mm:"maxValue"
-WebKit/mac/WebView/WebView.mm:"At least one WebView is still open."
-WebKit/mac/WebView/WebView.mm:"At least one WebView was closed with fast teardown."
-WebKit/mac/WebView/WebView.mm:"Preferences"
-WebKit/mac/WebView/WebView.mm:"Search With Google"
-WebKit/mac/WebView/WebView.mm:"control"
-WebKit/mac/WebView/WebView.mm:"data"
-WebKit/mac/WebView/WebView.mm:"decoder"
-WebKit/mac/WebView/WebView.mm:"frame"
-WebKit/mac/WebView/WebView.mm:"return "
-WebKit/win/AccessibleBase.cpp:"Alt+"
-WebKit/win/AccessibleBase.cpp:"Ctrl+"
-WebKit/win/AccessibleBase.cpp:"Shift+"
-WebKit/win/AccessibleBase.cpp:"Win+"
-WebKit/win/ProgIDMacros.h:"OpenSource"
-WebKit/win/ProgIDMacros.h:"WebKit."
-WebKit/win/WebCache.cpp:"images"
-WebKit/win/WebCache.cpp:"scripts"
-WebKit/win/WebCache.cpp:"style sheets"
-WebKit/win/WebCoreSupport/WebInspectorClient.cpp:"Courier New"
-WebKit/win/WebCoreSupport/WebInspectorClient.cpp:"Web Inspector "
-WebKit/win/WebCoreSupport/WebInspectorClient.cpp:"Web Inspector"
-WebKit/win/WebCoreSupport/WebInspectorClient.cpp:"inspector"
-WebKit/win/WebDatabaseManager.cpp:"Databases"
-WebKit/win/WebHistoryItem.cpp:"title"
-WebKit/win/WebKitDLL.cpp
-WebKit/win/WebPreferenceKeysPrivate.h
-WebKit/win/WebPreferences.cpp:"Arial"
-WebKit/win/WebPreferences.cpp:"Comic Sans MS"
-WebKit/win/WebPreferences.cpp:"Courier New"
-WebKit/win/WebPreferences.cpp:"Times New Roman"
-WebKit/win/WebURLResponse.cpp:"Extension"
-WebKit/win/WebView.cpp:")"
-WebKit/win/WebView.cpp:"Cancel"
-WebKit/win/WebView.cpp:"Copy"
-WebKit/win/WebView.cpp:"Cut"
-WebKit/win/WebView.cpp:"Delete"
-WebKit/win/WebView.cpp:"Paste"
-WebKit/win/WebView.cpp:"Redo"
-WebKit/win/WebView.cpp:"Undo"
-WebKit/win/WebView.cpp:"Unknown ("
-WebKit/win/WebView.cpp:"about"
diff --git a/Source/WebCore/UseJSC.cmake b/Source/WebCore/UseJSC.cmake
new file mode 100644
index 0000000..f6d9c90
--- /dev/null
+++ b/Source/WebCore/UseJSC.cmake
@@ -0,0 +1,203 @@
+LIST(APPEND WebCore_INCLUDE_DIRECTORIES
+    "${WEBCORE_DIR}/bindings/js"
+    "${WEBCORE_DIR}/bridge/jsc"
+)
+
+LIST(APPEND WebCore_IDL_INCLUDES
+    bindings/js
+)
+
+LIST(APPEND WebCore_SOURCES
+    bindings/js/DOMObjectHashTableMap.cpp
+    bindings/js/DOMWrapperWorld.cpp
+    bindings/js/GCController.cpp
+    bindings/js/IDBBindingUtilities.cpp
+    bindings/js/JSAttrCustom.cpp
+    bindings/js/JSArrayBufferCustom.cpp
+    bindings/js/JSDataViewCustom.cpp
+    bindings/js/JSCDATASectionCustom.cpp
+    bindings/js/JSCSSFontFaceRuleCustom.cpp
+    bindings/js/JSCSSImportRuleCustom.cpp
+    bindings/js/JSCSSMediaRuleCustom.cpp
+    bindings/js/JSCSSPageRuleCustom.cpp
+    bindings/js/JSCSSRuleCustom.cpp
+    bindings/js/JSCSSRuleListCustom.cpp
+    bindings/js/JSCSSStyleDeclarationCustom.cpp
+    bindings/js/JSCSSStyleRuleCustom.cpp
+    bindings/js/JSCSSValueCustom.cpp
+    bindings/js/JSCallbackData.cpp
+    bindings/js/JSCanvasRenderingContext2DCustom.cpp
+    bindings/js/JSCanvasRenderingContextCustom.cpp
+    bindings/js/JSClipboardCustom.cpp
+    bindings/js/JSConsoleCustom.cpp
+    bindings/js/JSCoordinatesCustom.cpp
+    bindings/js/JSCustomPositionCallback.cpp
+    bindings/js/JSCustomPositionErrorCallback.cpp
+    bindings/js/JSCustomSQLStatementErrorCallback.cpp
+    bindings/js/JSCustomVoidCallback.cpp
+    bindings/js/JSCustomXPathNSResolver.cpp
+    bindings/js/JSDOMApplicationCacheCustom.cpp
+    bindings/js/JSDOMBinding.cpp
+    bindings/js/JSDOMFormDataCustom.cpp
+    bindings/js/JSDOMGlobalObject.cpp
+    bindings/js/JSDOMImplementationCustom.cpp
+    bindings/js/JSDOMMimeTypeArrayCustom.cpp
+    bindings/js/JSDOMPluginArrayCustom.cpp
+    bindings/js/JSDOMPluginCustom.cpp
+    bindings/js/JSDOMStringMapCustom.cpp
+    bindings/js/JSDOMWindowBase.cpp
+    bindings/js/JSDOMWindowCustom.cpp
+    bindings/js/JSDOMWindowShell.cpp
+    bindings/js/JSDOMWrapper.cpp
+    bindings/js/JSDataGridColumnListCustom.cpp
+    bindings/js/JSDataGridDataSource.cpp
+    bindings/js/JSDedicatedWorkerContextCustom.cpp
+    bindings/js/JSDeviceMotionEventCustom.cpp
+    bindings/js/JSDeviceOrientationEventCustom.cpp
+    bindings/js/JSDocumentCustom.cpp
+    bindings/js/JSElementCustom.cpp
+    bindings/js/JSErrorHandler.cpp
+    bindings/js/JSEventCustom.cpp
+    bindings/js/JSEventListener.cpp
+    bindings/js/JSEventSourceCustom.cpp
+    bindings/js/JSEventTarget.cpp
+    bindings/js/JSExceptionBase.cpp
+    bindings/js/JSFileReaderCustom.cpp
+    bindings/js/JSFloat32ArrayCustom.cpp
+    bindings/js/JSGeolocationCustom.cpp
+    bindings/js/JSHTMLAllCollectionCustom.cpp
+    bindings/js/JSHTMLAppletElementCustom.cpp
+    bindings/js/JSHTMLCanvasElementCustom.cpp
+    bindings/js/JSHTMLCollectionCustom.cpp
+    bindings/js/JSHTMLDataGridElementCustom.cpp
+    bindings/js/JSHTMLDocumentCustom.cpp
+    bindings/js/JSHTMLElementCustom.cpp
+    bindings/js/JSHTMLEmbedElementCustom.cpp
+    bindings/js/JSHTMLFormElementCustom.cpp
+    bindings/js/JSHTMLFrameElementCustom.cpp
+    bindings/js/JSHTMLFrameSetElementCustom.cpp
+    bindings/js/JSHTMLInputElementCustom.cpp
+    bindings/js/JSHTMLLinkElementCustom.cpp
+    bindings/js/JSHTMLObjectElementCustom.cpp
+    bindings/js/JSHTMLOptionsCollectionCustom.cpp
+    bindings/js/JSHTMLOutputElementCustom.cpp
+    bindings/js/JSHTMLSelectElementCustom.cpp
+    bindings/js/JSHTMLStyleElementCustom.cpp
+    bindings/js/JSHistoryCustom.cpp
+    bindings/js/JSIDBAnyCustom.cpp
+    bindings/js/JSIDBKeyCustom.cpp
+    bindings/js/JSImageConstructor.cpp
+    bindings/js/JSImageDataCustom.cpp
+    bindings/js/JSInt16ArrayCustom.cpp
+    bindings/js/JSInt32ArrayCustom.cpp
+    bindings/js/JSInt8ArrayCustom.cpp
+    bindings/js/JSInjectedScriptHostCustom.cpp
+    bindings/js/JSInjectedScriptManager.cpp
+    bindings/js/JSInspectorFrontendHostCustom.cpp
+    bindings/js/JSJavaScriptCallFrameCustom.cpp
+    bindings/js/JSLazyEventListener.cpp
+    bindings/js/JSLocationCustom.cpp
+    bindings/js/JSMainThreadExecState.cpp
+    bindings/js/JSMemoryInfoCustom.cpp
+    bindings/js/JSMessageChannelCustom.cpp
+    bindings/js/JSMessageEventCustom.cpp
+    bindings/js/JSMessagePortCustom.cpp
+    bindings/js/JSNamedNodeMapCustom.cpp
+    bindings/js/JSNavigatorCustom.cpp
+    bindings/js/JSNodeCustom.cpp
+    bindings/js/JSNodeFilterCondition.cpp
+    bindings/js/JSNodeFilterCustom.cpp
+    bindings/js/JSNodeIteratorCustom.cpp
+    bindings/js/JSNodeListCustom.cpp
+    bindings/js/JSOptionConstructor.cpp
+    bindings/js/JSPluginElementFunctions.cpp
+    bindings/js/JSProcessingInstructionCustom.cpp
+    bindings/js/JSSQLResultSetRowListCustom.cpp
+    bindings/js/JSSQLTransactionCustom.cpp
+    bindings/js/JSSQLTransactionSyncCustom.cpp
+    bindings/js/JSScriptProfileNodeCustom.cpp
+    bindings/js/JSSharedWorkerCustom.cpp
+    bindings/js/JSStorageCustom.cpp
+    bindings/js/JSStyleSheetCustom.cpp
+    bindings/js/JSStyleSheetListCustom.cpp
+    bindings/js/JSTextCustom.cpp
+    bindings/js/JSTouchCustom.cpp
+    bindings/js/JSTouchListCustom.cpp
+    bindings/js/JSTreeWalkerCustom.cpp
+    bindings/js/JSUint16ArrayCustom.cpp 
+    bindings/js/JSUint32ArrayCustom.cpp
+    bindings/js/JSUint8ArrayCustom.cpp
+    bindings/js/JSWebKitAnimationCustom.cpp
+    bindings/js/JSWebKitAnimationListCustom.cpp
+    bindings/js/JSWebKitCSSKeyframeRuleCustom.cpp
+    bindings/js/JSWebKitCSSKeyframesRuleCustom.cpp
+    bindings/js/JSWebKitCSSMatrixCustom.cpp
+    bindings/js/JSWebKitPointCustom.cpp
+    bindings/js/JSWebSocketCustom.cpp
+    bindings/js/JSWorkerContextBase.cpp
+    bindings/js/JSWorkerContextCustom.cpp
+    bindings/js/JSWorkerCustom.cpp
+    bindings/js/JSXMLHttpRequestCustom.cpp
+    bindings/js/JSXMLHttpRequestUploadCustom.cpp
+    bindings/js/JSXSLTProcessorCustom.cpp
+    bindings/js/JavaScriptCallFrame.cpp
+    bindings/js/PageScriptDebugServer.cpp
+    bindings/js/ScheduledAction.cpp
+    bindings/js/ScriptCachedFrameData.cpp
+    bindings/js/ScriptCallStackFactory.cpp
+    bindings/js/ScriptController.cpp
+    bindings/js/ScriptDebugServer.cpp
+    bindings/js/ScriptEventListener.cpp
+    bindings/js/ScriptFunctionCall.cpp
+    bindings/js/ScriptGCEvent.cpp
+    bindings/js/ScriptObject.cpp
+    bindings/js/ScriptProfile.cpp
+    bindings/js/ScriptProfiler.cpp
+    bindings/js/ScriptState.cpp
+    bindings/js/ScriptValue.cpp
+    bindings/js/SerializedScriptValue.cpp
+    bindings/js/WorkerScriptController.cpp
+    bindings/js/WorkerScriptDebugServer.cpp
+
+    bridge/IdentifierRep.cpp
+    bridge/NP_jsobject.cpp
+    bridge/npruntime.cpp
+    bridge/runtime_array.cpp
+    bridge/runtime_method.cpp
+    bridge/runtime_object.cpp
+    bridge/runtime_root.cpp
+
+    bridge/c/CRuntimeObject.cpp
+    bridge/c/c_class.cpp
+    bridge/c/c_instance.cpp
+    bridge/c/c_runtime.cpp
+    bridge/c/c_utility.cpp
+
+    bridge/jsc/BridgeJSC.cpp
+)
+
+LIST(APPEND SCRIPTS_BINDINGS
+    ${WEBCORE_DIR}/bindings/scripts/CodeGenerator.pm
+)
+
+SET(IDL_INCLUDES "")
+FOREACH (_include ${WebCore_IDL_INCLUDES})
+    LIST(APPEND IDL_INCLUDES --include=${WEBCORE_DIR}/${_include})
+ENDFOREACH ()
+
+SET(FEATURE_DEFINES_JAVASCRIPT "LANGUAGE_JAVASCRIPT=1")
+FOREACH (_feature ${FEATURE_DEFINES})
+    SET(FEATURE_DEFINES_JAVASCRIPT "${FEATURE_DEFINES_JAVASCRIPT} ${_feature}")
+ENDFOREACH ()
+
+# Create JavaScript C++ code given an IDL input
+FOREACH (_file ${WebCore_IDL_FILES})
+    GET_FILENAME_COMPONENT (_name ${_file} NAME_WE)
+    ADD_CUSTOM_COMMAND(
+        OUTPUT  ${DERIVED_SOURCES_DIR}/JS${_name}.cpp ${DERIVED_SOURCES_DIR}/JS${_name}.h
+        MAIN_DEPENDENCY ${_file}
+        DEPENDS ${WEBCORE_DIR}/bindings/scripts/generate-bindings.pl ${SCRIPTS_BINDINGS} ${WEBCORE_DIR}/bindings/scripts/CodeGeneratorJS.pm ${_file}
+        COMMAND ${PERL_EXECUTABLE} -I${WEBCORE_DIR}/bindings/scripts ${WEBCORE_DIR}/bindings/scripts/generate-bindings.pl --defines "${FEATURE_DEFINES_JAVASCRIPT}" --generator JS ${IDL_INCLUDES} --outputDir "${DERIVED_SOURCES_DIR}" --preprocessor "${CODE_GENERATOR_PREPROCESSOR}" ${WEBCORE_DIR}/${_file}
+        VERBATIM)
+    LIST(APPEND WebCore_SOURCES ${DERIVED_SOURCES_DIR}/JS${_name}.cpp)
+ENDFOREACH ()
diff --git a/Source/WebCore/WebCore.exp.in b/Source/WebCore/WebCore.exp.in
index c287bb2..c3de299 100644
--- a/Source/WebCore/WebCore.exp.in
+++ b/Source/WebCore/WebCore.exp.in
@@ -105,7 +105,6 @@
 .objc_class_name_DOMTreeWalker
 .objc_class_name_DOMUIEvent
 .objc_class_name_DOMWheelEvent
-.objc_class_name_WebCoreKeyGenerator
 .objc_class_name_WebCoreViewFactory
 .objc_class_name_WebFontCache
 .objc_class_name_WebScriptObject
@@ -217,6 +216,7 @@ __ZN7WebCore11MemoryCache25removeResourcesWithOriginEPNS_14SecurityOriginE
 __ZN7WebCore11RenderLayer19scrollRectToVisibleERKNS_7IntRectEbRKNS_15ScrollAlignmentES6_
 __ZN7WebCore11globalPointERK8_NSPointP8NSWindow
 __ZN7WebCore11memoryCacheEv
+__ZN7WebCore11startOfWordERKNS_15VisiblePositionENS_9EWordSideE
 __ZN7WebCore11toUserSpaceERK7_NSRectP8NSWindow
 __ZN7WebCore11writeToFileEiPKci
 __ZN7WebCore12ChromeClient20paintCustomScrollbarEPNS_15GraphicsContextERKNS_9FloatRectENS_20ScrollbarControlSizeEjNS_13ScrollbarPartEbffj
@@ -246,10 +246,8 @@ __ZN7WebCore12GCController17garbageCollectNowEv
 __ZN7WebCore12GCController43garbageCollectOnAlternateThreadForDebuggingEb
 __ZN7WebCore12IconDatabase10setEnabledEb
 __ZN7WebCore12IconDatabase11defaultIconERKNS_7IntSizeE
-__ZN7WebCore12IconDatabase14iconForPageURLERKN3WTF6StringERKNS_7IntSizeE
 __ZN7WebCore12IconDatabase14removeAllIconsEv
 __ZN7WebCore12IconDatabase15iconRecordCountEv
-__ZN7WebCore12IconDatabase17iconURLForPageURLERKN3WTF6StringE
 __ZN7WebCore12IconDatabase19pageURLMappingCountEv
 __ZN7WebCore12IconDatabase20allowDatabaseCleanupEv
 __ZN7WebCore12IconDatabase20delayDatabaseCleanupEv   
@@ -262,9 +260,9 @@ __ZN7WebCore12IconDatabase23importIconURLForPageURLERKN3WTF6StringES4_
 __ZN7WebCore12IconDatabase24importIconDataForIconURLEN3WTF10PassRefPtrINS_12SharedBufferEEERKNS1_6StringE
 __ZN7WebCore12IconDatabase25setPrivateBrowsingEnabledEb
 __ZN7WebCore12IconDatabase27checkIntegrityBeforeOpeningEv
-__ZN7WebCore12IconDatabase4openERKN3WTF6StringE
 __ZN7WebCore12IconDatabase5closeEv
 __ZN7WebCore12IconDatabase9setClientEPNS_18IconDatabaseClientE
+__ZN7WebCore12IconDatabaseC1Ev
 __ZN7WebCore12PopupMenuMacC1EPNS_15PopupMenuClientE
 __ZN7WebCore12PrintContext12pagePropertyEPNS_5FrameEPKci
 __ZN7WebCore12PrintContext13numberOfPagesEPNS_5FrameERKNS_9FloatSizeE
@@ -291,6 +289,7 @@ __ZN7WebCore12SharedBuffer12createNSDataEv
 __ZN7WebCore12SharedBuffer24createWithContentsOfFileERKN3WTF6StringE
 __ZN7WebCore12SharedBuffer6appendEPKcj
 __ZN7WebCore12SharedBufferC1EPKci
+__ZN7WebCore12SharedBufferC1EPKhi
 __ZN7WebCore12SharedBufferC1Ev
 __ZN7WebCore12SharedBufferD1Ev
 __ZN7WebCore12SpellChecker8didCheckEiRKN3WTF6VectorINS_19SpellCheckingResultELm0EEE
@@ -298,6 +297,7 @@ __ZN7WebCore12TextEncodingC1ERKN3WTF6StringE
 __ZN7WebCore12TextIterator11rangeLengthEPKNS_5RangeEb
 __ZN7WebCore12TextIterator26rangeFromLocationAndLengthEPNS_7ElementEiib
 __ZN7WebCore12TextIterator7advanceEv
+__ZN7WebCore12TextIterator8subrangeEPNS_5RangeEii
 __ZN7WebCore12TextIteratorC1EPKNS_5RangeENS_20TextIteratorBehaviorE
 __ZN7WebCore12TextIteratorD1Ev
 __ZN7WebCore12WorkerThread17workerThreadCountEv
@@ -319,12 +319,16 @@ __ZN7WebCore13IdentifierRep3getEPKc
 __ZN7WebCore13IdentifierRep3getEi
 __ZN7WebCore13JSHTMLElement6s_infoE
 __ZN7WebCore13KeyboardEventC1ERKN3WTF12AtomicStringEbbPNS_9DOMWindowERKNS1_6StringEjbbbbb
+__ZN7WebCore13ResourceErrorC1EP7NSError
+__ZN7WebCore13ResourceErrorC1EP9__CFError
 __ZN7WebCore13TypingCommand39insertParagraphSeparatorInQuotedContentEPNS_8DocumentE
 __ZN7WebCore13createWrapperEPN3JSC9ExecStateEPNS_17JSDOMGlobalObjectEPNS_4NodeE
+__ZN7WebCore13directoryNameERKN3WTF6StringE
 __ZN7WebCore13toDeviceSpaceERKNS_9FloatRectEP8NSWindow
 __ZN7WebCore13toHTMLElementEPNS_21FormAssociatedElementE
 __ZN7WebCore13toJSDOMWindowEN3JSC7JSValueE
 __ZN7WebCore14CachedResource12removeClientEPNS_20CachedResourceClientE
+__ZN7WebCore14CachedResource16unregisterHandleEPNS_24CachedResourceHandleBaseE
 __ZN7WebCore14CachedResource9addClientEPNS_20CachedResourceClientE
 __ZN7WebCore14DocumentLoader10commitDataEPKci
 __ZN7WebCore14DocumentLoader13attachToFrameEv
@@ -350,6 +354,7 @@ __ZN7WebCore14SVGSMILElement13isSMILElementEPNS_4NodeE
 __ZN7WebCore14SchemeRegistry24registerURLSchemeAsLocalERKN3WTF6StringE
 __ZN7WebCore14SchemeRegistry25registerURLSchemeAsSecureERKN3WTF6StringE
 __ZN7WebCore14SchemeRegistry32registerURLSchemeAsEmptyDocumentERKN3WTF6StringE
+__ZN7WebCore14SchemeRegistry34shouldLoadURLSchemeAsEmptyDocumentERKN3WTF6StringE
 __ZN7WebCore14ScrollableArea17willEndLiveResizeEv
 __ZN7WebCore14ScrollableArea19willStartLiveResizeEv
 __ZN7WebCore14ScrollbarTheme11nativeThemeEv
@@ -364,7 +369,7 @@ __ZN7WebCore14SecurityOrigin32removeOriginAccessWhitelistEntryERKS0_RKN3WTF6Stri
 __ZN7WebCore14SecurityOrigin40setDomainRelaxationForbiddenForURLSchemeEbRKN3WTF6StringE
 __ZN7WebCore14SecurityOrigin6createERKN3WTF6StringES4_i
 __ZN7WebCore14SecurityOrigin6createERKNS_4KURLEi
-__ZN7WebCore14toInputElementEPNS_7ElementE
+__ZN7WebCore14endOfParagraphERKNS_15VisiblePositionENS_27EditingBoundaryCrossingRuleE
 __ZN7WebCore15ArchiveResource6createEN3WTF10PassRefPtrINS_12SharedBufferEEERKNS_4KURLERKNS1_6StringESA_SA_RKNS_16ResourceResponseE
 __ZN7WebCore15DOMWrapperWorld13clearWrappersEv
 __ZN7WebCore15DOMWrapperWorldD1Ev
@@ -398,6 +403,7 @@ __ZN7WebCore15GraphicsContext7restoreEv
 __ZN7WebCore15GraphicsContext8fillPathERKNS_4PathE
 __ZN7WebCore15GraphicsContext8fillRectERKNS_9FloatRectE
 __ZN7WebCore15GraphicsContext8fillRectERKNS_9FloatRectERKNS_5ColorENS_10ColorSpaceE
+__ZN7WebCore15GraphicsContext9clearRectERKNS_9FloatRectE
 __ZN7WebCore15GraphicsContext9drawImageEPNS_5ImageENS_10ColorSpaceERKNS_8IntPointENS_17CompositeOperatorE
 __ZN7WebCore15GraphicsContext9setShadowERKNS_9FloatSizeEfRKNS_5ColorENS_10ColorSpaceE
 __ZN7WebCore15GraphicsContext9translateEff
@@ -414,6 +420,7 @@ __ZN7WebCore15StringTruncator5widthERKN3WTF6StringERKNS_4FontE
 __ZN7WebCore15VisiblePositionC1ERKNS_8PositionENS_9EAffinityE
 __ZN7WebCore15defaultLanguageEv
 __ZN7WebCore15localizedStringEPKc
+__ZN7WebCore15pathGetFileNameERKN3WTF6StringE
 __ZN7WebCore15reportExceptionEPN3JSC9ExecStateENS0_7JSValueE
 __ZN7WebCore15visitedLinkHashEPKtj
 __ZN7WebCore16AbstractDatabase14setIsAvailableEb
@@ -421,9 +428,11 @@ __ZN7WebCore16DeviceMotionData12Acceleration6createEbdbdbd
 __ZN7WebCore16DeviceMotionData12RotationRate6createEbdbdbd
 __ZN7WebCore16DeviceMotionData6createEN3WTF10PassRefPtrINS0_12AccelerationEEES4_NS2_INS0_12RotationRateEEEbd
 __ZN7WebCore16FontFallbackList15releaseFontDataEv
-__ZN7WebCore16FontPlatformDataC1EP6NSFontfbbNS_15FontOrientationENS_16FontWidthVariantE
+__ZN7WebCore16FontPlatformDataC1EP6NSFontfbbNS_15FontOrientationENS_15TextOrientationENS_16FontWidthVariantE
 __ZN7WebCore16FontPlatformDataD1Ev
 __ZN7WebCore16HTMLInputElement13setAutofilledEb
+__ZN7WebCore16IconDatabaseBase28synchronousIconURLForPageURLERKN3WTF6StringE
+__ZN7WebCore16IconDatabaseBase4openERKN3WTF6StringES4_
 __ZN7WebCore16LegacyWebArchive19createFromSelectionEPNS_5FrameE
 __ZN7WebCore16LegacyWebArchive21rawDataRepresentationEv
 __ZN7WebCore16LegacyWebArchive6createEN3WTF10PassRefPtrINS_15ArchiveResourceEEERNS1_6VectorIS4_Lm0EEERNS5_INS2_IS0_EELm0EEE
@@ -434,7 +443,9 @@ __ZN7WebCore16LegacyWebArchive6createEPNS_5RangeE
 __ZN7WebCore16LegacyWebArchive6createEv
 __ZN7WebCore16MIMETypeRegistry23getMIMETypeForExtensionERKN3WTF6StringE
 __ZN7WebCore16MIMETypeRegistry24isSupportedImageMIMETypeERKN3WTF6StringE
+__ZN7WebCore16MIMETypeRegistry25isUnsupportedTextMIMETypeERKN3WTF6StringE
 __ZN7WebCore16MIMETypeRegistry26getSupportedImageMIMETypesEv
+__ZN7WebCore16MIMETypeRegistry27getUnsupportedTextMIMETypesEv
 __ZN7WebCore16MIMETypeRegistry27isSupportedNonImageMIMETypeERKN3WTF6StringE
 __ZN7WebCore16MIMETypeRegistry29getSupportedNonImageMIMETypesEv
 __ZN7WebCore16MIMETypeRegistry32isSupportedImageResourceMIMETypeERKN3WTF6StringE
@@ -461,6 +472,7 @@ __ZN7WebCore16deleteAllCookiesEv
 __ZN7WebCore16enclosingIntRectERK7_NSRect
 __ZN7WebCore16enclosingIntRectERKNS_9FloatRectE
 __ZN7WebCore16isEndOfParagraphERKNS_15VisiblePositionENS_27EditingBoundaryCrossingRuleE
+__ZN7WebCore16startOfParagraphERKNS_15VisiblePositionENS_27EditingBoundaryCrossingRuleE
 __ZN7WebCore17CredentialStorage3getERKNS_15ProtectionSpaceE
 __ZN7WebCore17DOMImplementation13isXMLMIMETypeERKN3WTF6StringE
 __ZN7WebCore17DOMImplementation14isTextMIMETypeERKN3WTF6StringE
@@ -468,7 +480,8 @@ __ZN7WebCore17DeviceOrientation6createEbdbdbd
 __ZN7WebCore17GlyphPageTreeNode18treeGlyphPageCountEv
 __ZN7WebCore17HistoryController26saveDocumentAndScrollStateEv
 __ZN7WebCore17nameForCursorTypeENS_6Cursor4TypeE
-__ZN7WebCore17openTemporaryFileEPKcRi
+__ZN7WebCore17openTemporaryFileERKN3WTF6StringERi
+__ZN7WebCore18PlatformStrategies26createLocalizationStrategyEv
 __ZN7WebCore18SearchPopupMenuMacC1EPNS_15PopupMenuClientE
 __ZN7WebCore18isStartOfParagraphERKNS_15VisiblePositionENS_27EditingBoundaryCrossingRuleE
 __ZN7WebCore18pluginScriptObjectEPN3JSC9ExecStateEPNS_13JSHTMLElementE
@@ -541,6 +554,7 @@ __ZN7WebCore21mainThreadNormalWorldEv
 __ZN7WebCore21markerTextForListItemEPNS_7ElementE
 __ZN7WebCore21reportThreadViolationEPKcNS_20ThreadViolationRoundE
 __ZN7WebCore21resourceLoadSchedulerEv
+__ZN7WebCore21setGlobalIconDatabaseEPNS_16IconDatabaseBaseE
 __ZN7WebCore21setPlatformStrategiesEPNS_18PlatformStrategiesE
 __ZN7WebCore22ScriptExecutionContext26canSuspendActiveDOMObjectsEv
 __ZN7WebCore22applicationIsAppleMailEv
@@ -554,6 +568,7 @@ __ZN7WebCore23createFragmentFromNodesEPNS_8DocumentERKN3WTF6VectorIPNS_4NodeELm0
 __ZN7WebCore23getHostnamesWithCookiesERN3WTF7HashSetINS0_6StringENS0_10StringHashENS0_10HashTraitsIS2_EEEE
 __ZN7WebCore23overrideDefaultLanguageERKN3WTF6StringE
 __ZN7WebCore24BinaryPropertyListWriter17writePropertyListEv
+__ZN7WebCore24CachedResourceHandleBase11setResourceEPNS_14CachedResourceE
 __ZN7WebCore24DocumentMarkerController13removeMarkersEj
 __ZN7WebCore24DocumentMarkerController14markersForNodeEPNS_4NodeE
 __ZN7WebCore24DocumentMarkerController14markersForNodeEPNS_4NodeE
@@ -642,7 +657,6 @@ __ZN7WebCore4FontaSERKS0_
 __ZN7WebCore4Icon18createIconForFilesERKN3WTF6VectorINS1_6StringELm0EEE
 __ZN7WebCore4IconD1Ev
 __ZN7WebCore4KURL10invalidateEv
-__ZN7WebCore4KURLC1ENS_18ParsedURLStringTagEPKc
 __ZN7WebCore4KURLC1ENS_18ParsedURLStringTagERKN3WTF6StringE
 __ZN7WebCore4KURLC1EP5NSURL
 __ZN7WebCore4KURLC1EPK7__CFURL
@@ -684,6 +698,7 @@ __ZN7WebCore4Path14addRoundedRectERKNS_9FloatRectERKNS_9FloatSizeE
 __ZN7WebCore4PathC1Ev
 __ZN7WebCore4PathD1Ev
 __ZN7WebCore4coreEP20NSURLProtectionSpace
+__ZN7WebCore4coreEP28NSURLAuthenticationChallenge
 __ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_17JSDOMGlobalObjectEPNS_19CSSStyleDeclarationE
 __ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_17JSDOMGlobalObjectEPNS_5RangeE
 __ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_17JSDOMGlobalObjectEPNS_8NodeListE
@@ -743,6 +758,7 @@ __ZN7WebCore6Editor26decreaseSelectionListLevelEv
 __ZN7WebCore6Editor26increaseSelectionListLevelEv
 __ZN7WebCore6Editor26writeSelectionToPasteboardERKN3WTF6StringERKNS1_6VectorIS2_Lm0EEE
 __ZN7WebCore6Editor27handleCorrectionPanelResultERKN3WTF6StringE
+__ZN7WebCore6Editor27readSelectionFromPasteboardERKN3WTF6StringE
 __ZN7WebCore6Editor29canDecreaseSelectionListLevelEv
 __ZN7WebCore6Editor29canIncreaseSelectionListLevelEv
 __ZN7WebCore6Editor30applyParagraphStyleToSelectionEPNS_19CSSStyleDeclarationENS_10EditActionE
@@ -787,7 +803,6 @@ __ZN7WebCore7cookiesEPKNS_8DocumentERKNS_4KURLE
 __ZN7WebCore7nsColorERKNS_5ColorE
 __ZN7WebCore8Document11createRangeEv
 __ZN7WebCore8Document12updateLayoutEv
-__ZN7WebCore8Document13setDesignModeENS0_13InheritedBoolE
 __ZN7WebCore8Document13svgExtensionsEv
 __ZN7WebCore8Document14setFocusedNodeEN3WTF10PassRefPtrINS_4NodeEEE
 __ZN7WebCore8Document16isPageBoxVisibleEi
@@ -864,6 +879,7 @@ __ZN7WebCore8Settings29setAuthorAndUserStylesEnabledEb
 __ZN7WebCore8Settings29setDefaultMinDOMTimerIntervalEd
 __ZN7WebCore8Settings29setWebArchiveDebugModeEnabledEb
 __ZN7WebCore8Settings30setAllowFileAccessFromFileURLsEb
+__ZN7WebCore8Settings31setCanvasUsesAcceleratedDrawingEb
 __ZN7WebCore8Settings31setJavaScriptCanAccessClipboardEb
 __ZN7WebCore8Settings31setShrinksStandaloneImagesToFitEb
 __ZN7WebCore8Settings32setAcceleratedCompositingEnabledEb
@@ -959,6 +975,7 @@ __ZN7WebCore9PageGroup13isLinkVisitedEy
 __ZN7WebCore9PageGroup14addVisitedLinkEPKtm
 __ZN7WebCore9PageGroup17closeLocalStorageEv
 __ZN7WebCore9PageGroup18addVisitedLinkHashEy
+__ZN7WebCore9PageGroup18numberOfPageGroupsEv
 __ZN7WebCore9PageGroup20addUserScriptToWorldEPNS_15DOMWrapperWorldERKN3WTF6StringERKNS_4KURLENS3_10PassOwnPtrINS3_6VectorIS4_Lm0EEEEESD_NS_23UserScriptInjectionTimeENS_25UserContentInjectedFramesE
 __ZN7WebCore9PageGroup20removeAllUserContentEv
 __ZN7WebCore9PageGroup21removeAllVisitedLinksEv
@@ -975,6 +992,7 @@ __ZN7WebCore9TimerBase5startEdd
 __ZN7WebCore9TimerBaseC2Ev
 __ZN7WebCore9TimerBaseD2Ev
 __ZN7WebCore9closeFileERi
+__ZN7WebCore9endOfWordERKNS_15VisiblePositionENS_9EWordSideE
 __ZN7WebCore9fontCacheEv
 __ZN7WebCore9makeRangeERKNS_15VisiblePositionES2_
 __ZN7WebCore9pageCacheEv
@@ -1027,7 +1045,6 @@ __ZNK7WebCore11HistoryItem20getTransientPropertyERKN3WTF6StringE
 __ZNK7WebCore11HistoryItem21encodeBackForwardTreeERN3WTF7EncoderE
 __ZNK7WebCore11HistoryItem3urlEv
 __ZNK7WebCore11HistoryItem4copyEv
-__ZNK7WebCore11HistoryItem4iconEv
 __ZNK7WebCore11HistoryItem5titleEv
 __ZNK7WebCore11HistoryItem6targetEv
 __ZNK7WebCore11HistoryItem8childrenEv
@@ -1042,7 +1059,7 @@ __ZNK7WebCore12IconDatabase12databasePathEv
 __ZNK7WebCore12IconDatabase24shouldStopThreadActivityEv
 __ZNK7WebCore12IconDatabase9isEnabledEv
 __ZNK7WebCore12RenderObject14enclosingLayerEv
-__ZNK7WebCore12RenderObject15localToAbsoluteENS_10FloatPointEbb
+__ZNK7WebCore12RenderObject15localToAbsoluteERKNS_10FloatPointEbb
 __ZNK7WebCore12RenderObject4viewEv
 __ZNK7WebCore12RenderObject7childAtEj
 __ZNK7WebCore12RenderWidget14windowClipRectEv
@@ -1070,6 +1087,8 @@ __ZNK7WebCore13HitTestResult18titleDisplayStringEv
 __ZNK7WebCore13HitTestResult5imageEv
 __ZNK7WebCore13HitTestResult5titleERNS_13TextDirectionE
 __ZNK7WebCore13HitTestResult9imageRectEv
+__ZNK7WebCore13ResourceError7cfErrorEv
+__ZNK7WebCore13ResourceError7nsErrorEv
 __ZNK7WebCore13ResourceErrorcvP7NSErrorEv
 __ZNK7WebCore14DocumentLoader10requestURLEv
 __ZNK7WebCore14DocumentLoader11frameLoaderEv
@@ -1106,18 +1125,21 @@ __ZNK7WebCore15ResourceRequest12nsURLRequestEv
 __ZNK7WebCore15VisiblePosition14characterAfterEv
 __ZNK7WebCore15VisiblePosition14localCaretRectERPNS_12RenderObjectE
 __ZNK7WebCore15VisiblePosition19absoluteCaretBoundsEv
-__ZNK7WebCore15VisiblePosition4nextEb
-__ZNK7WebCore15VisiblePosition8previousEb
+__ZNK7WebCore15VisiblePosition4nextENS_27EditingBoundaryCrossingRuleE
+__ZNK7WebCore15VisiblePosition8previousENS_27EditingBoundaryCrossingRuleE
 __ZNK7WebCore16FontFallbackList10fontDataAtEPKNS_4FontEj
 __ZNK7WebCore16HTMLInputElement12autoCompleteEv
+__ZNK7WebCore16HTMLInputElement21lastChangeWasUserEditEv
+__ZNK7WebCore16IconDatabaseBase12databasePathEv
 __ZNK7WebCore16ResourceResponse13nsURLResponseEv
 __ZNK7WebCore16VisibleSelection17isContentEditableEv
 __ZNK7WebCore16VisibleSelection17toNormalizedRangeEv
 __ZNK7WebCore16VisibleSelection19rootEditableElementEv
 __ZNK7WebCore16VisibleSelection23isContentRichlyEditableEv
-__ZNK7WebCore16VisibleSelection5isAllENS_21StayInEditableContentE
+__ZNK7WebCore16VisibleSelection5isAllENS_27EditingBoundaryCrossingRuleE
 __ZNK7WebCore17ResourceErrorBase8lazyInitEv
 __ZNK7WebCore19AnimationController24numberOfActiveAnimationsEv
+__ZNK7WebCore19HTMLTextAreaElement21lastChangeWasUserEditEv
 __ZNK7WebCore19ResourceRequestBase10httpMethodEv
 __ZNK7WebCore19ResourceRequestBase15httpHeaderFieldEPKc
 __ZNK7WebCore19ResourceRequestBase3urlEv
@@ -1175,7 +1197,7 @@ __ZNK7WebCore5Color7getRGBAERdS1_S1_S1_
 __ZNK7WebCore5Frame13ownerRendererEv
 __ZNK7WebCore5Frame14selectionImageEb
 __ZNK7WebCore5Frame15contentRendererEv
-__ZNK7WebCore5Frame15layerTreeAsTextEv
+__ZNK7WebCore5Frame15layerTreeAsTextEb
 __ZNK7WebCore5Frame18documentTypeStringEv
 __ZNK7WebCore5Frame8settingsEv
 __ZNK7WebCore5Frame9domWindowEv
@@ -1198,9 +1220,9 @@ __ZNK7WebCore6Editor17firstRectForRangeEPNS_5RangeE
 __ZNK7WebCore6Editor17selectionHasStyleEiRKN3WTF6StringE
 __ZNK7WebCore6Editor17shouldDeleteRangeEPNS_5RangeE
 __ZNK7WebCore6Editor23getCompositionSelectionERjS1_
+__ZNK7WebCore6Editor26selectionStartHasMarkerForENS_14DocumentMarker10MarkerTypeEii
 __ZNK7WebCore6Editor30applyEditingStyleToBodyElementEv
 __ZNK7WebCore6Editor31fontAttributesForSelectionStartEv
-__ZNK7WebCore6Editor34selectionStartHasSpellingMarkerForEii
 __ZNK7WebCore6Editor37baseWritingDirectionForSelectionStartEv
 __ZNK7WebCore6Editor6canCutEv
 __ZNK7WebCore6Editor7Command11isSupportedEv
@@ -1232,7 +1254,6 @@ __ZNK7WebCore7IntRectcv7_NSRectEv
 __ZNK7WebCore7IntSizecv7_NSSizeEv
 __ZNK7WebCore8Document10renderViewEv
 __ZNK7WebCore8Document11completeURLERKN3WTF6StringE
-__ZNK7WebCore8Document12inDesignModeEv
 __ZNK7WebCore8Document13axObjectCacheEv
 __ZNK7WebCore8Document13nodesFromRectEiijjjjb
 __ZNK7WebCore8Document14getElementByIdERKN3WTF12AtomicStringE
@@ -1266,8 +1287,10 @@ __ZNK7WebCore9FrameView28isEnclosedInCompositingLayerEv
 __ZNK7WebCore9PageCache10frameCountEv
 __ZNK7WebCore9PageCache21autoreleasedPageCountEv
 __ZTVN7WebCore12ChromeClientE
+__ZTVN7WebCore16IconDatabaseBaseE
 __ZTVN7WebCore17FileChooserClientE
 __ZTVN7WebCore17FrameLoaderClientE
+__ZTVN7WebCore18PlatformStrategiesE
 __ZTVN7WebCore25HistoryPropertyListWriterE
 __ZTVN7WebCore28InspectorFrontendClientLocal8SettingsE
 _filenameByFixingIllegalCharacters
@@ -1279,13 +1302,18 @@ _suggestedFilenameWithMIMEType
 _wkAdvanceDefaultButtonPulseAnimation
 _wkCGContextGetShouldSmoothFonts
 _wkCopyCFLocalizationPreferredName
+_wkCopyCFURLResponseSuggestedFilename
 _wkCopyCONNECTProxyResponse
+_wkCopyHTTPCookieStorage
 _wkCopyNSURLResponseStatusLine
+_wkCopyRequestWithStorageSession
 _wkCreateCTLineWithUniCharProvider
 _wkCreateCustomCFReadStream
 _wkCreateNSURLConnectionDelegateProxy
+_wkCreatePrivateStorageSession
 _wkCreateURLNPasteboardFlavorTypeName
 _wkCreateURLPasteboardFlavorTypeName
+_wkDeleteHTTPCookie
 _wkDrawBezeledTextArea
 _wkDrawBezeledTextFieldCell
 _wkDrawCapsLockIndicator
@@ -1293,11 +1321,15 @@ _wkDrawFocusRing
 _wkDrawMediaSliderTrack
 _wkDrawMediaUIPart
 _wkDrawTextFieldCellFocusRing
+_wkGetCFURLResponseHTTPResponse
+_wkGetCFURLResponseMIMEType
+_wkGetCFURLResponseURL
 _wkGetExtensionsForMIMEType
 _wkGetFontInLanguageForCharacter
 _wkGetFontInLanguageForRange
 _wkGetGlyphTransformedAdvances
 _wkGetGlyphsForCharacters
+_wkGetHTTPCookieAcceptPolicy
 _wkGetHTTPPipeliningPriority
 _wkGetHyphenationLocationBeforeIndex
 _wkGetMIMETypeForExtension
@@ -1307,6 +1339,7 @@ _wkGetNSURLResponseMustRevalidate
 _wkGetPreferredExtensionForMIMEType
 _wkGetUserToBaseCTM
 _wkGetWheelEventDeltas
+_wkHTTPCookiesForURL
 _wkHitTestMediaUIPart
 _wkInitializeMaximumHTTPConnectionCountPerHost
 _wkIsLatchingWheelEvent
@@ -1324,11 +1357,13 @@ _wkQTMovieMaxTimeSeekable
 _wkQTMovieSelectPreferredAlternates
 _wkQTMovieSetShowClosedCaptions
 _wkQTMovieViewSetDrawSynchronously
+_wkSetCFURLResponseMIMEType
 _wkSetCGFontRenderingMode
 _wkSetCONNECTProxyAuthorizationForStream
 _wkSetCONNECTProxyForStream
 _wkSetCookieStoragePrivateBrowsingEnabled
 _wkSetDragImage
+_wkSetHTTPCookiesForURL
 _wkSetHTTPPipeliningPriority
 _wkSetNSURLConnectionDefersCallbacks
 _wkSetNSURLRequestShouldContentSniff
@@ -1338,13 +1373,18 @@ _wkSetUpFontCache
 _wkSignalCFReadStreamEnd
 _wkSignalCFReadStreamError
 _wkSignalCFReadStreamHasBytes
-_wkCreatePrivateStorageSession
-_wkCopyRequestWithStorageSession
-_wkCreatePrivateInMemoryHTTPCookieStorage
-_wkGetHTTPCookieAcceptPolicy
-_wkHTTPCookiesForURL
-_wkSetHTTPCookiesForURL
-_wkDeleteHTTPCookie
+_wkSignedPublicKeyAndChallengeString
+
+#if ENABLE(DOM_STORAGE)
+__ZN7WebCore14StorageTracker17initializeTrackerERKN3WTF6StringE
+__ZN7WebCore14StorageTracker16deleteAllOriginsEv
+__ZN7WebCore14StorageTracker12deleteOriginEPNS_14SecurityOriginE
+__ZN7WebCore14StorageTracker7trackerEv
+__ZN7WebCore14StorageTracker7originsERN3WTF6VectorINS1_6RefPtrINS_14SecurityOriginEEELm0EEE
+__ZN7WebCore14StorageTracker9setClientEPNS_20StorageTrackerClientE
+__ZN7WebCore14StorageTracker16syncLocalStorageEv
+__ZN7WebCore14StorageTracker32syncFileSystemAndTrackerDatabaseEv
+#endif
 
 #if !defined(NDEBUG)
 __ZN7WebCore20LogNotYetImplementedE
@@ -1371,6 +1411,7 @@ _wkScrollbarMinimumTotalLengthNeededForThumb
 _wkScrollbarPainterIsHorizontal
 _wkScrollbarPainterKnobAlpha
 _wkScrollbarPainterPaint
+_wkScrollbarPainterForceFlashScrollers
 _wkScrollbarPainterSetDelegate
 _wkScrollbarPainterSetOverlayState
 _wkScrollbarPainterTrackAlpha
@@ -1731,6 +1772,9 @@ __ZN7WebCore16HTMLMediaElement12endScrubbingEv
 __ZN7WebCore16HTMLMediaElement14beginScrubbingEv
 __ZN7WebCore16HTMLMediaElement14exitFullscreenEv
 __ZN7WebCore16HTMLMediaElement14setCurrentTimeEfRi
+__ZN7WebCore16HTMLMediaElement15clearMediaCacheEv
+__ZN7WebCore16HTMLMediaElement20getSitesInMediaCacheERN3WTF6VectorINS1_6StringELm0EEE
+__ZN7WebCore16HTMLMediaElement22clearMediaCacheForSiteERKN3WTF6StringE
 __ZN7WebCore16HTMLMediaElement4playEb
 __ZN7WebCore16HTMLMediaElement5pauseEb
 __ZN7WebCore16HTMLMediaElement6rewindEf
@@ -1768,6 +1812,7 @@ __ZNK7WebCore4Node16traverseNextNodeEPKS0_
 #endif
 
 #if ENABLE(OFFLINE_WEB_APPLICATIONS)
+__ZN7WebCore16ApplicationCache20deleteCacheForOriginEPNS_14SecurityOriginE
 __ZN7WebCore23ApplicationCacheStorage14quotaForOriginEPKNS_14SecurityOriginERx
 __ZN7WebCore23ApplicationCacheStorage14setMaximumSizeEx
 __ZN7WebCore23ApplicationCacheStorage14usageForOriginEPKNS_14SecurityOriginERx
@@ -1777,7 +1822,6 @@ __ZN7WebCore23ApplicationCacheStorage17setCacheDirectoryERKN3WTF6StringE
 __ZN7WebCore23ApplicationCacheStorage18vacuumDatabaseFileEv
 __ZN7WebCore23ApplicationCacheStorage19getOriginsWithCacheERN3WTF7HashSetINS1_6RefPtrINS_14SecurityOriginEEENS_18SecurityOriginHashENS1_10HashTraitsIS5_EEEE
 __ZN7WebCore23ApplicationCacheStorage21setDefaultOriginQuotaEx
-__ZN7WebCore23ApplicationCacheStorage22deleteEntriesForOriginEPNS_14SecurityOriginE
 __ZN7WebCore23ApplicationCacheStorage26storeUpdatedQuotaForOriginEPKNS_14SecurityOriginEx
 __ZN7WebCore23ApplicationCacheStorage36remainingSizeForOriginExcludingCacheEPKNS_14SecurityOriginEPNS_16ApplicationCacheERx
 __ZN7WebCore23ApplicationCacheStorage5emptyEv
diff --git a/Source/WebCore/WebCore.gyp/WebCore.gyp b/Source/WebCore/WebCore.gyp/WebCore.gyp
index bf570ff..e692f54 100644
--- a/Source/WebCore/WebCore.gyp/WebCore.gyp
+++ b/Source/WebCore/WebCore.gyp/WebCore.gyp
@@ -305,8 +305,39 @@
   },
   'targets': [
     {
+      'target_name': 'inspector_idl',
+      'type': 'none',
+      'actions': [
+        {
+          'action_name': 'generateInspectorProtocolIDL',
+          'inputs': [
+            '../inspector/generate-inspector-idl',
+            '../inspector/Inspector.json',
+          ],
+          'outputs': [
+            '<(SHARED_INTERMEDIATE_DIR)/webcore/Inspector.idl',
+          ],
+          'variables': {
+            'generator_include_dirs': [
+            ],
+          },
+          'action': [
+            'python',
+            '../inspector/generate-inspector-idl',
+            '-o',
+            '<@(_outputs)',
+            '<@(_inputs)'
+          ],
+          'message': 'Generating Inspector protocol sources from Inspector.idl',
+        },
+      ]
+    },
+    {
       'target_name': 'inspector_protocol_sources',
       'type': 'none',
+      'dependencies': [
+        'inspector_idl'
+      ],
       'actions': [
         {
           'action_name': 'generateInspectorProtocolSources',
@@ -319,7 +350,7 @@
             '../bindings/scripts/CodeGenerator.pm',
             '../bindings/scripts/IDLParser.pm',
             '../bindings/scripts/IDLStructure.pm',
-            '../inspector/Inspector.idl',
+            '<(SHARED_INTERMEDIATE_DIR)/webcore/Inspector.idl',
           ],
           'outputs': [
             '<(SHARED_INTERMEDIATE_DIR)/webcore/InspectorBackendDispatcher.cpp',
@@ -335,7 +366,7 @@
           'action': [
             'python',
             'scripts/rule_binding.py',
-            '../inspector/Inspector.idl',
+            '<(SHARED_INTERMEDIATE_DIR)/webcore/Inspector.idl',
             '<(SHARED_INTERMEDIATE_DIR)/webcore',
             '<(SHARED_INTERMEDIATE_DIR)/webkit',
             '--',
@@ -365,14 +396,37 @@
             'perl',
             '../inspector/xxd.pl',
             'InjectedScriptSource_js',
-            '../inspector/InjectedScriptSource.js',
-            '<(SHARED_INTERMEDIATE_DIR)/webkit/InjectedScriptSource.h'
+            '<@(_inputs)',
+            '<@(_outputs)'
           ],
           'message': 'Generating InjectedScriptSource.h from InjectedScriptSource.js',
         },
       ]
     },
     {
+      'target_name': 'debugger_script_source',
+      'type': 'none',
+      'actions': [
+        {
+          'action_name': 'generateDebuggerScriptSource',
+          'inputs': [
+            '../bindings/v8/DebuggerScript.js',
+          ],
+          'outputs': [
+            '<(SHARED_INTERMEDIATE_DIR)/webkit/DebuggerScriptSource.h',
+          ],
+          'action': [
+            'perl',
+            '../inspector/xxd.pl',
+            'DebuggerScriptSource_js',
+            '<@(_inputs)',
+            '<@(_outputs)'
+          ],
+          'message': 'Generating DebuggerScriptSource.h from DebuggerScript.js',
+        },
+      ]
+    },
+    {
       'target_name': 'webcore_bindings_sources',
       'type': 'none',
       'hard_dependency': 1,
@@ -783,6 +837,7 @@
         'webcore_bindings_sources',
         'inspector_protocol_sources',
         'injected_script_source',
+        'debugger_script_source',
         '../../JavaScriptCore/JavaScriptCore.gyp/JavaScriptCore.gyp:yarr',
         '../../JavaScriptCore/JavaScriptCore.gyp/JavaScriptCore.gyp:wtf',
         '<(chromium_src_dir)/build/temp_gyp/googleurl.gyp:googleurl',
@@ -1121,12 +1176,15 @@
         'webcore_prerequisites',
       ],
       'sources': [
+        '<@(webcore_privateheader_files)',
         '<@(webcore_files)',
       ],
       'sources/': [
         # Start by excluding everything then include html files only.
         ['exclude', '.*'],
         ['include', 'html/'],
+
+        ['exclude', 'AllInOne\\.cpp$'],
       ],
     },
     {
@@ -1136,6 +1194,7 @@
         'webcore_prerequisites',
       ],
       'sources': [
+        '<@(webcore_privateheader_files)',
         '<@(webcore_files)',
       ],
       'sources/': [
@@ -1148,7 +1207,8 @@
         ['include', 'rendering/style/SVG'],
         ['include', 'rendering/RenderSVG'],
         ['include', 'rendering/SVG'],
-        ['exclude', 'svg/SVGAllInOne\\.cpp$'],
+
+        ['exclude', 'AllInOne\\.cpp$'],
       ],
     },
     {
@@ -1161,38 +1221,32 @@
       # if this hard dependency could be split off the rest.
       'hard_dependency': 1,
       'sources': [
+        '<@(webcore_privateheader_files)',
         '<@(webcore_files)',
 
         # For WebCoreSystemInterface, Mac-only.
         '../../WebKit/mac/WebCoreSupport/WebSystemInterface.mm',
       ],
       'sources/': [
-        # Start by excluding everything then include platform files only.
         ['exclude', '.*'],
         ['include', 'platform/'],
 
-        # Exclude things that don't apply to the Chromium platform on the basis
-        # of their enclosing directories and tags at the ends of their
-        # filenames.
-        ['exclude', '(android|brew|cairo|ca|cf|cg|curl|efl|fftw|gtk|haiku|linux|mac|mkl|opentype|posix|qt|soup|svg|symbian|win|wince|wx)/'],
-        ['exclude', '(?<!Chromium)(Android|Cairo|CF|CG|Curl|Gtk|Linux|Mac|OpenType|POSIX|Posix|Qt|Safari|Soup|Symbian|Win|Wx)\\.(cpp|mm?)$'],
-
-        # A few things can't be excluded by patterns.  List them individually.
+        # FIXME: Figure out how to store these patterns in a variable.
+        ['exclude', '(android|brew|cairo|ca|cf|cg|curl|efl|freetype|fftw|gstreamer|gtk|haiku|linux|mac|mkl|opengl|openvg|opentype|pango|posix|qt|soup|svg|symbian|texmap|iphone|win|wince|wx)/'],
+        ['exclude', '(?<!Chromium)(Android|Cairo|CF|CG|Curl|Gtk|JSC|Linux|Mac|OpenType|POSIX|Posix|Qt|Safari|Soup|Symbian|Win|WinCE|Wx)\\.(cpp|mm?)$'],
 
         ['include', 'platform/graphics/opentype/OpenTypeSanitizer\\.cpp$'],
 
-        # Exclude some DB-related files.
-        ['exclude', 'platform/sql/SQLiteFileSystem\\.cpp$'],
-
-        # Use platform/MIMETypeRegistryChromium.cpp instead.
+        ['exclude', 'platform/LinkHash\\.cpp$'],
         ['exclude', 'platform/MIMETypeRegistry\\.cpp$'],
-
-        # Theme.cpp is used only if we're using USE_NEW_THEME. We are not for
-        # Windows and Linux. We manually include Theme.cpp for the Mac below.
         ['exclude', 'platform/Theme\\.cpp$'],
-
-        # Use LinkHashChromium.cpp instead
-        ['exclude', 'platform/LinkHash\\.cpp$'],
+        ['exclude', 'platform/graphics/ANGLEWebKitBridge\\.(cpp|h)$'],
+        ['exclude', 'platform/image-encoders/JPEGImageEncoder\\.(cpp|h)$'],
+        ['exclude', 'platform/image-encoders/PNGImageEncoder\\.(cpp|h)$'],
+        ['exclude', 'platform/network/ResourceHandle\\.cpp$'],
+        ['exclude', 'platform/sql/SQLiteFileSystem\\.cpp$'],
+        ['exclude', 'platform/text/LocalizedNumberNone\\.cpp$'],
+        ['exclude', 'platform/text/TextEncodingDetectorNone\\.cpp$'],
 
         ['include', 'thirdparty/glu/libtess/'],
       ],
@@ -1309,6 +1363,12 @@
             # Again, Skia is not used on Mac.
             ['exclude', 'platform/chromium/DragImageChromiumSkia\\.cpp$'],
           ],
+        },{ # OS!="mac"
+          'sources/': [
+            # FIXME: We will eventually compile this too, but for now it's
+            # only used on mac.
+            ['exclude', 'platform/graphics/FontPlatformData\\.cpp$']
+          ],
         }],
         ['OS!="linux" and OS!="freebsd"', {
           'sources/': [
@@ -1332,7 +1392,10 @@
 
             # The Chromium Win currently uses GlyphPageTreeNodeChromiumWin.cpp from
             # platform/graphics/chromium, included by regex above, instead.
-            ['exclude', 'platform/graphics/skia/GlyphPageTreeNodeSkia\\.cpp$']
+            ['exclude', 'platform/graphics/skia/GlyphPageTreeNodeSkia\\.cpp$'],
+
+            # SystemInfo.cpp is useful and we don't want to copy it.
+            ['include', 'platform/win/SystemInfo\\.cpp$'],
           ],
         }],
         ['(OS=="linux" or OS=="win") and "WTF_USE_WEBAUDIO_MKL=1" in feature_defines', {
@@ -1354,18 +1417,18 @@
         'webcore_prerequisites',
       ],
       'sources': [
+        '<@(webcore_privateheader_files)',
         '<@(webcore_files)',
       ],
       'sources/': [
-        # Start by excluding everything then include rendering files only.
         ['exclude', '.*'],
         ['include', 'rendering/'],
 
-        # Exclude things that don't apply to the Chromium platform on the basis
-        # of their enclosing directories and tags at the ends of their
-        # filenames.
-        ['exclude', '(android|brew|cairo|ca|cf|cg|curl|efl|gtk|haiku|html|linux|mac|opentype|platform|posix|qt|soup|svg|symbian|win|wince|wx)/'],
-        ['exclude', '(?<!Chromium)(Android|Cairo|CF|CG|Curl|Gtk|Linux|Mac|OpenType|POSIX|Posix|Qt|Safari|Soup|Symbian|Win|Wx)\\.(cpp|mm?)$'],
+        # FIXME: Figure out how to store these patterns in a variable.
+        ['exclude', '(android|brew|cairo|ca|cf|cg|curl|efl|freetype|fftw|gstreamer|gtk|haiku|linux|mac|mkl|opengl|openvg|opentype|pango|posix|qt|soup|svg|symbian|texmap|iphone|win|wince|wx)/'],
+        ['exclude', '(?<!Chromium)(Android|Cairo|CF|CG|Curl|Gtk|JSC|Linux|Mac|OpenType|POSIX|Posix|Qt|Safari|Soup|Symbian|Win|WinCE|Wx)\\.(cpp|mm?)$'],
+
+        ['exclude', 'AllInOne\\.cpp$'],
 
         # Exclude most of SVG except css and javascript bindings.
         ['exclude', 'rendering/style/SVG[^/]+.(cpp|h)$'],
@@ -1415,75 +1478,64 @@
       # if this hard dependency could be split off the rest.
       'hard_dependency': 1,
       'sources': [
+        '<@(webcore_privateheader_files)',
         '<@(webcore_files)',
       ],
       'sources/': [
-        # Exclude JSC custom bindings.
-        ['exclude', 'bindings/cpp'],
-        ['exclude', 'bindings/gobject'],
-        ['exclude', 'bindings/js'],
-        ['exclude', 'bindings/objc'],
-
-        # Fortunately, many things can be excluded by using broad patterns.
+        ['exclude', 'html/'],
+        ['exclude', 'platform/'],
+        ['exclude', 'rendering/'],
 
-        # Exclude things that don't apply to the Chromium platform on the basis
-        # of their enclosing directories and tags at the ends of their
-        # filenames.
-        ['exclude', '(android|brew|cairo|ca|cf|cg|curl|efl|gtk|haiku|html|linux|mac|opentype|platform|posix|qt|rendering|soup|svg|symbian|win|wince|wx)/'],
-        ['exclude', '(?<!Chromium)(Android|Cairo|CF|CG|Curl|Gtk|Linux|Mac|OpenType|POSIX|Posix|Qt|Safari|Soup|Symbian|Win|Wx)\\.(cpp|mm?)$'],
+        # Exclude most of bindings, except of the V8-related parts.
+        ['exclude', 'bindings/[^/]+/'],
+        ['include', 'bindings/generic/'],
+        ['include', 'bindings/v8/'],
 
-        # JSC-only.
-        ['exclude', 'inspector/JavaScript[^/]*\\.cpp$'],
+        # Exclude most of bridge, except for the V8-related parts.
+        ['exclude', 'bridge/'],
+        ['include', 'bridge/jni/'],
+        ['exclude', 'bridge/jni/[^/]+_jsobject\\.mm$'],
+        ['exclude', 'bridge/jni/[^/]+_objc\\.mm$'],
+        ['exclude', 'bridge/jni/jsc/'],
 
-        # ENABLE_OFFLINE_WEB_APPLICATIONS, exclude most of webcore's impl
-        ['exclude', 'loader/appcache/'],
-        ['include', 'loader/appcache/ApplicationCacheHost\.h$'],
-        ['include', 'loader/appcache/DOMApplicationCache\.(h|cpp)$'],
+        # FIXME: Figure out how to store these patterns in a variable.
+        ['exclude', '(android|brew|cairo|ca|cf|cg|curl|efl|freetype|fftw|gstreamer|gtk|haiku|linux|mac|mkl|opengl|openvg|opentype|pango|posix|qt|soup|svg|symbian|texmap|iphone|win|wince|wx)/'],
+        ['exclude', '(?<!Chromium)(Android|Cairo|CF|CG|Curl|Gtk|JSC|Linux|Mac|OpenType|POSIX|Posix|Qt|Safari|Soup|Symbian|Win|WinCE|Wx)\\.(cpp|mm?)$'],
 
-        # Exclude some DB-related files.
-        ['exclude', 'storage/DatabaseTracker\\.cpp$'],
-        ['exclude', 'storage/DatabaseTrackerClient\\.h$'],
-        ['exclude', 'storage/OriginQuotaManager\\.(cpp|h)$'],
-        ['exclude', 'storage/OriginUsageRecord\\.(cpp|h)$'],
-        ['exclude', 'storage/SQLTransactionClient\\.cpp$'],
-
-        # Don't build StorageNamespace.  We have our own implementation.
-        ['exclude', 'storage/StorageNamespace\\.cpp$'],
-
-        # Don't build StorageEventDispatcher.  We have our own implementation.
-        ['exclude', 'storage/StorageEventDispatcher\\.cpp$'],
-
-        # Don't build IDBFactoryBackendInterface.  We have our own implementation.
-        ['exclude', 'storage/IDBFactoryBackendInterface\\.cpp$'],
-
-        # Don't build IDBKeyPathBackendImpl.  We have our own implementation.
-        ['exclude', 'storage/IDBKeyPathBackendImpl\\.cpp$'],
+        ['exclude', 'AllInOne\\.cpp$'],
 
-        # Don't build files needed for WebArchive support, since we disable
-        # this feature.
-        ['exclude', 'loader/archive/cf/LegacyWebArchive\\.cpp$'],
-        ['exclude', 'loader/archive/cf/LegacyWebArchiveMac\\.mm$'],
+        ['exclude', 'dom/StaticStringList\\.cpp$'],
+        ['exclude', 'dom/default/PlatformMessagePortChannel\\.(cpp|h)$'],
+        ['exclude', 'fileapi/LocalFileSystem\\.cpp$'],
+        ['exclude', 'inspector/InspectorFrontendClientLocal\\.cpp$'],
+        ['exclude', 'inspector/JavaScript[^/]*\\.cpp$'],
+        ['exclude', 'loader/UserStyleSheetLoader\\.cpp$'],
+        ['exclude', 'loader/appcache/'],
         ['exclude', 'loader/archive/ArchiveFactory\\.cpp$'],
-
-        # Use loader/icon/IconDatabaseNone.cpp instead.
+        ['exclude', 'loader/archive/cf/LegacyWebArchiveMac\\.mm$'],
+        ['exclude', 'loader/archive/cf/LegacyWebArchive\\.cpp$'],
         ['exclude', 'loader/icon/IconDatabase\\.cpp$'],
-
-        # Exclude some, but not all, of plugins.
+        ['exclude', 'plugins/PluginDataNone\\.cpp$'],
         ['exclude', 'plugins/PluginDatabase\\.cpp$'],
         ['exclude', 'plugins/PluginMainThreadScheduler\\.cpp$'],
+        ['exclude', 'plugins/PluginPackageNone\\.cpp$'],
         ['exclude', 'plugins/PluginPackage\\.cpp$'],
         ['exclude', 'plugins/PluginStream\\.cpp$'],
         ['exclude', 'plugins/PluginView\\.cpp$'],
         ['exclude', 'plugins/npapi\\.cpp$'],
+        ['exclude', 'storage/DatabaseTrackerClient\\.h$'],
+        ['exclude', 'storage/DatabaseTracker\\.cpp$'],
+        ['exclude', 'storage/IDBFactoryBackendInterface\\.cpp$'],
+        ['exclude', 'storage/IDBKeyPathBackendImpl\\.cpp$'],
+        ['exclude', 'storage/OriginQuotaManager\\.(cpp|h)$'],
+        ['exclude', 'storage/OriginUsageRecord\\.(cpp|h)$'],
+        ['exclude', 'storage/SQLTransactionClient\\.cpp$'],
+        ['exclude', 'storage/StorageEventDispatcher\\.cpp$'],
+        ['exclude', 'storage/StorageNamespace\\.cpp$'],
+        ['exclude', 'workers/DefaultSharedWorkerRepository\\.(cpp|h)$'],
 
-        # FIXME: I don't know exactly why these are excluded.  It would
-        # be nice to provide more explicit comments.  Some of these do actually
-        # compile.
-        ['exclude', 'dom/StaticStringList\\.cpp$'],
-        ['exclude', 'loader/UserStyleSheetLoader\\.cpp$'],
-
-        # We use a multi-process version from the WebKit API.
-        ['exclude', 'dom/default/PlatformMessagePortChannel\\.(cpp|h)$'],
+        ['include', 'loader/appcache/ApplicationCacheHost\.h$'],
+        ['include', 'loader/appcache/DOMApplicationCache\.(cpp|h)$'],
       ],
       'link_settings': {
         'mac_bundle_resources': [
diff --git a/Source/WebCore/WebCore.gypi b/Source/WebCore/WebCore.gypi
index 3abfc9c..290b93a 100644
--- a/Source/WebCore/WebCore.gypi
+++ b/Source/WebCore/WebCore.gypi
@@ -1,12 +1,1065 @@
 {
     'variables': {
-        # These headers are part of WebCore's public API in the Apple Mac build.
-        'webcore_publicheader_files': [
-          #FIXME: Add headers.
-        ],
+        'project_dir': ['.'],
         # These headers are part of WebCore's private API in the Apple Mac build.
         'webcore_privateheader_files': [
-          #FIXME: Add headers.
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/CSSPropertyNames.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMAbstractView.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMAttr.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMBlob.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMBlobInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCDATASection.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCSSCharsetRule.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCSSFontFaceRule.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCSSImportRule.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCSSMediaRule.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCSSPageRule.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCSSPrimitiveValue.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCSSRule.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCSSRuleList.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCSSStyleDeclaration.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCSSStyleDeclarationInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCSSStyleRule.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCSSStyleSheet.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCSSUnknownRule.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCSSValue.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCSSValueList.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCharacterData.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMComment.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCounter.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDOMImplementation.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDocument.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDocumentFragment.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDocumentFragmentInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDocumentFragmentPrivate.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDocumentInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDocumentPrivate.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDocumentType.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMElementInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMElementTimeControl.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMEntity.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMEntityReference.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMEvent.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMEventListener.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMEventTarget.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMFile.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMFileInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMFileList.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMFileListInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLAnchorElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLAppletElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLAreaElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLBRElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLBaseElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLBaseFontElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLBodyElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLButtonElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLCanvasElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLCollection.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLDListElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLDirectoryElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLDivElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLDocument.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLElementInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLEmbedElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLEmbedElementPrivate.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLFieldSetElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLFontElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLFormElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLFrameElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLFrameElementPrivate.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLFrameSetElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLHRElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLHeadElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLHeadingElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLHtmlElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLIFrameElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLIFrameElementPrivate.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLImageElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLInputElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLInputElementInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLInputElementPrivate.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLIsIndexElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLLIElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLLabelElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLLegendElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLLinkElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLMapElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLMarqueeElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLMenuElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLMetaElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLModElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLOListElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLObjectElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLObjectElementPrivate.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLOptGroupElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLOptionElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLOptionsCollection.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLParagraphElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLParamElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLPreElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLQuoteElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLScriptElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLSelectElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLStyleElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLTableCaptionElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLTableCellElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLTableColElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLTableElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLTableRowElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLTableSectionElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLTextAreaElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLTextAreaElementInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLTitleElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLUListElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMKeyboardEvent.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMMediaList.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMMouseEvent.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMMutationEvent.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMNamedNodeMap.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMNode.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMNodeFilter.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMNodeInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMNodeIterator.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMNodeList.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMNotation.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMOverflowEvent.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMProcessingInstruction.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMProgressEvent.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMProgressEventInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMRGBColor.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMRange.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMRangeInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMRect.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAElementInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAltGlyphElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAltGlyphElementInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAngle.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAngleInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimateColorElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimateColorElementInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimateElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimateElementInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimateTransformElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimateTransformElementInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimatedAngle.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimatedAngleInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimatedBoolean.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimatedBooleanInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimatedEnumeration.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimatedEnumerationInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimatedInteger.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimatedIntegerInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimatedLength.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimatedLengthInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimatedLengthList.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimatedLengthListInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimatedNumber.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimatedNumberInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimatedNumberList.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimatedNumberListInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimatedPreserveAspectRatio.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimatedPreserveAspectRatioInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimatedRect.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimatedRectInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimatedString.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimatedStringInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimatedTransformList.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimatedTransformListInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimationElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimationElementInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGCircleElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGCircleElementInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGClipPathElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGClipPathElementInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGColor.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGColorInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGComponentTransferFunctionElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGComponentTransferFunctionElementInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGCursorElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGCursorElementInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGDefsElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGDefsElementInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGDescElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGDescElementInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGDocument.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGDocumentInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGElementInstance.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGElementInstanceInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGElementInstanceList.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGElementInstanceListInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGElementInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGEllipseElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGEllipseElementInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGExternalResourcesRequired.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEBlendElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEBlendElementInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEColorMatrixElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEColorMatrixElementInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEComponentTransferElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEComponentTransferElementInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFECompositeElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFECompositeElementInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEConvolveMatrixElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEConvolveMatrixElementInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEDiffuseLightingElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEDiffuseLightingElementInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEDisplacementMapElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEDisplacementMapElementInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEDistantLightElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEDistantLightElementInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEFloodElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEFloodElementInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEFuncAElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEFuncAElementInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEFuncBElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEFuncBElementInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEFuncGElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEFuncGElementInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEFuncRElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEFuncRElementInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEGaussianBlurElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEGaussianBlurElementInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEImageElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEImageElementInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEMergeElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEMergeElementInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEMergeNodeElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEMergeNodeElementInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEMorphologyElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEMorphologyElementInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEOffsetElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEOffsetElementInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEPointLightElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEPointLightElementInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFESpecularLightingElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFESpecularLightingElementInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFESpotLightElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFESpotLightElementInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFETileElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFETileElementInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFETurbulenceElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFETurbulenceElementInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFilterElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFilterElementInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFilterPrimitiveStandardAttributes.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFitToViewBox.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFontElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFontFaceElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFontFaceFormatElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFontFaceNameElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFontFaceSrcElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFontFaceUriElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGForeignObjectElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGForeignObjectElementInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGGElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGGElementInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGGlyphElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGGradientElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGGradientElementInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGImageElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGImageElementInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGLangSpace.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGLength.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGLengthInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGLengthList.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGLengthListInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGLineElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGLineElementInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGLinearGradientElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGLinearGradientElementInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGLocatable.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGMarkerElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGMarkerElementInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGMaskElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGMaskElementInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGMatrix.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGMatrixInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGMetadataElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGMetadataElementInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGMissingGlyphElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGNumber.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGNumberInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGNumberList.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGNumberListInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPaint.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPaintInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathElementInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSeg.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegArcAbs.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegArcAbsInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegArcRel.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegArcRelInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegClosePath.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegClosePathInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegCurvetoCubicAbs.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegCurvetoCubicAbsInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegCurvetoCubicRel.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegCurvetoCubicRelInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegCurvetoCubicSmoothAbs.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegCurvetoCubicSmoothAbsInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegCurvetoCubicSmoothRel.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegCurvetoCubicSmoothRelInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegCurvetoQuadraticAbs.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegCurvetoQuadraticAbsInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegCurvetoQuadraticRel.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegCurvetoQuadraticRelInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegCurvetoQuadraticSmoothAbs.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegCurvetoQuadraticSmoothAbsInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegCurvetoQuadraticSmoothRel.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegCurvetoQuadraticSmoothRelInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegLinetoAbs.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegLinetoAbsInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegLinetoHorizontalAbs.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegLinetoHorizontalAbsInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegLinetoHorizontalRel.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegLinetoHorizontalRelInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegLinetoRel.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegLinetoRelInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegLinetoVerticalAbs.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegLinetoVerticalAbsInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegLinetoVerticalRel.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegLinetoVerticalRelInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegList.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegListInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegMovetoAbs.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegMovetoAbsInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegMovetoRel.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegMovetoRelInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPatternElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPatternElementInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPoint.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPointList.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPointListInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPolygonElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPolygonElementInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPolylineElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPolylineElementInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPreserveAspectRatio.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPreserveAspectRatioInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGRadialGradientElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGRadialGradientElementInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGRect.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGRectElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGRectElementInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGRenderingIntent.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGRenderingIntentInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGSVGElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGSVGElementInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGScriptElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGScriptElementInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGSetElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGSetElementInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGStopElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGStopElementInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGStringList.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGStringListInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGStylable.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGStyleElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGStyleElementInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGSwitchElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGSwitchElementInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGSymbolElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGSymbolElementInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGTRefElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGTRefElementInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGTSpanElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGTSpanElementInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGTests.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGTextContentElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGTextContentElementInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGTextElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGTextElementInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGTextPathElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGTextPositioningElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGTextPositioningElementInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGTitleElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGTitleElementInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGTransform.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGTransformInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGTransformList.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGTransformListInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGTransformable.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGURIReference.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGUnitTypes.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGUnitTypesInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGUseElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGUseElementInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGViewElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGViewElementInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGZoomAndPan.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGZoomEvent.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGZoomEventInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMStyleSheet.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMStyleSheetList.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMText.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMTextEvent.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMTreeWalker.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMUIEvent.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMWheelEvent.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMXPathExpression.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMXPathNSResolver.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMXPathResult.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/HTMLNames.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/JSCSSStyleDeclaration.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/JSDOMWindow.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/JSDocument.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/JSElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/JSHTMLElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/JSNode.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/JSNodeList.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/JSRange.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/SVGNames.h',
+            'accessibility/AXObjectCache.h',
+            'accessibility/AccessibilityObject.h',
+            'bindings/ScriptControllerBase.h',
+            'bindings/js/DOMObjectHashTableMap.h',
+            'bindings/js/DOMWrapperWorld.h',
+            'bindings/js/GCController.h',
+            'bindings/js/JSDOMBinding.h',
+            'bindings/js/JSDOMGlobalObject.h',
+            'bindings/js/JSDOMWindowBase.h',
+            'bindings/js/JSDOMWindowShell.h',
+            'bindings/js/JSDOMWrapper.h',
+            'bindings/js/JSNodeCustom.h',
+            'bindings/js/JSPluginElementFunctions.h',
+            'bindings/js/ScriptCachedFrameData.h',
+            'bindings/js/ScriptController.h',
+            'bindings/js/ScriptDebugServer.h',
+            'bindings/js/ScriptInstance.h',
+            'bindings/js/ScriptObject.h',
+            'bindings/js/ScriptProfile.h',
+            'bindings/js/ScriptProfileNode.h',
+            'bindings/js/ScriptProfiler.h',
+            'bindings/js/ScriptSourceProvider.h',
+            'bindings/js/ScriptState.h',
+            'bindings/js/ScriptValue.h',
+            'bindings/js/ScriptWrappable.h',
+            'bindings/js/SerializedScriptValue.h',
+            'bindings/js/StringSourceProvider.h',
+            'bindings/objc/DOM.h',
+            'bindings/objc/DOMCSS.h',
+            'bindings/objc/DOMCore.h',
+            'bindings/objc/DOMEventException.h',
+            'bindings/objc/DOMEvents.h',
+            'bindings/objc/DOMException.h',
+            'bindings/objc/DOMExtensions.h',
+            'bindings/objc/DOMHTML.h',
+            'bindings/objc/DOMObject.h',
+            'bindings/objc/DOMPrivate.h',
+            'bindings/objc/DOMRangeException.h',
+            'bindings/objc/DOMRanges.h',
+            'bindings/objc/DOMSVG.h',
+            'bindings/objc/DOMSVGException.h',
+            'bindings/objc/DOMStylesheets.h',
+            'bindings/objc/DOMTraversal.h',
+            'bindings/objc/DOMViews.h',
+            'bindings/objc/DOMXPath.h',
+            'bindings/objc/DOMXPathException.h',
+            'bindings/objc/ExceptionHandlers.h',
+            'bindings/objc/WebScriptObject.h',
+            'bindings/objc/WebScriptObjectPrivate.h',
+            'bridge/Bridge.h',
+            'bridge/IdentifierRep.h',
+            'bridge/jni/JNIUtility.h',
+            'bridge/jni/jni_jsobject.h',
+            'bridge/jsc/BridgeJSC.h',
+            'bridge/npapi.h',
+            'bridge/npruntime.h',
+            'bridge/npruntime_impl.h',
+            'bridge/npruntime_internal.h',
+            'bridge/nptypes.h',
+            'bridge/runtime_method.h',
+            'bridge/runtime_object.h',
+            'bridge/runtime_root.h',
+            'css/CSSComputedStyleDeclaration.h',
+            'css/CSSCursorImageValue.h',
+            'css/CSSHelper.h',
+            'css/CSSImageGeneratorValue.h',
+            'css/CSSImageValue.h',
+            'css/CSSLineBoxContainValue.h',
+            'css/CSSMutableStyleDeclaration.h',
+            'css/CSSMutableValue.h',
+            'css/CSSParserValues.h',
+            'css/CSSPrimitiveValue.h',
+            'css/CSSProperty.h',
+            'css/CSSPropertySourceData.h',
+            'css/CSSReflectValue.h',
+            'css/CSSReflectionDirection.h',
+            'css/CSSSelector.h',
+            'css/CSSStyleDeclaration.h',
+            'css/CSSValue.h',
+            'css/CSSValueList.h',
+            'css/Pair.h',
+            'css/StyleBase.h',
+            'css/WebKitCSSTransformValue.h',
+            'dom/ActiveDOMObject.h',
+            'dom/Attr.h',
+            'dom/Attribute.h',
+            'dom/CSSMappedAttributeDeclaration.h',
+            'dom/CharacterData.h',
+            'dom/CheckedRadioButtons.h',
+            'dom/Clipboard.h',
+            'dom/ClipboardAccessPolicy.h',
+            'dom/ContainerNode.h',
+            'dom/DOMImplementation.h',
+            'dom/DOMTimeStamp.h',
+            'dom/DeviceOrientation.h',
+            'dom/DeviceOrientationClient.h',
+            'dom/Document.h',
+            'dom/DocumentFragment.h',
+            'dom/DocumentMarker.h',
+            'dom/DocumentMarkerController.h',
+            'dom/DocumentOrderedMap.h',
+            'dom/DocumentParser.h',
+            'dom/DocumentTiming.h',
+            'dom/DocumentType.h',
+            'dom/Element.h',
+            'dom/Event.h',
+            'dom/EventListener.h',
+            'dom/EventNames.h',
+            'dom/EventTarget.h',
+            'dom/ExceptionCode.h',
+            'dom/FragmentScriptingPermission.h',
+            'dom/InputElement.h',
+            'dom/KeyboardEvent.h',
+            'dom/MappedAttributeEntry.h',
+            'dom/MessagePort.h',
+            'dom/MessagePortChannel.h',
+            'dom/MouseEvent.h',
+            'dom/MouseRelatedEvent.h',
+            'dom/NamedNodeMap.h',
+            'dom/Node.h',
+            'dom/NodeList.h',
+            'dom/PendingScript.h',
+            'dom/Position.h',
+            'dom/QualifiedName.h',
+            'dom/Range.h',
+            'dom/RangeBoundaryPoint.h',
+            'dom/RegisteredEventListener.h',
+            'dom/ScriptExecutionContext.h',
+            'dom/ScriptRunner.h',
+            'dom/SpaceSplitString.h',
+            'dom/StyledElement.h',
+            'dom/Text.h',
+            'dom/TextEventInputType.h',
+            'dom/UIEvent.h',
+            'dom/UIEventWithKeyState.h',
+            'dom/UserGestureIndicator.h',
+            'dom/UserTypingGestureIndicator.h',
+            'dom/ViewportArguments.h',
+            'dom/XMLDocumentParser.h',
+            'editing/ApplyBlockElementCommand.h',
+            'editing/CompositeEditCommand.h',
+            'editing/CorrectionPanelInfo.h',
+            'editing/DeleteSelectionCommand.h',
+            'editing/EditAction.h',
+            'editing/EditCommand.h',
+            'editing/EditingBehavior.h',
+            'editing/EditingBehaviorTypes.h',
+            'editing/EditingBoundary.h',
+            'editing/EditingStyle.h',
+            'editing/Editor.h',
+            'editing/EditorDeleteAction.h',
+            'editing/EditorInsertAction.h',
+            'editing/FindOptions.h',
+            'editing/HTMLInterchange.h',
+            'editing/MoveSelectionCommand.h',
+            'editing/ReplaceSelectionCommand.h',
+            'editing/SelectionController.h',
+            'editing/SmartReplace.h',
+            'editing/SpellChecker.h',
+            'editing/TextAffinity.h',
+            'editing/TextGranularity.h',
+            'editing/TextIterator.h',
+            'editing/TypingCommand.h',
+            'editing/VisiblePosition.h',
+            'editing/VisibleSelection.h',
+            'editing/WritingDirection.h',
+            'editing/htmlediting.h',
+            'editing/markup.h',
+            'editing/visible_units.h',
+            'history/BackForwardController.h',
+            'history/BackForwardList.h',
+            'history/BackForwardListImpl.h',
+            'history/CachedFrame.h',
+            'history/CachedFramePlatformData.h',
+            'history/CachedPage.h',
+            'history/HistoryItem.h',
+            'history/PageCache.h',
+            'history/cf/HistoryPropertyList.h',
+            'html/CollectionCache.h',
+            'html/CollectionType.h',
+            'html/DateComponents.h',
+            'html/FormAssociatedElement.h',
+            'html/HTMLAppletElement.h',
+            'html/HTMLCollection.h',
+            'html/HTMLDataGridElement.h',
+            'html/HTMLDocument.h',
+            'html/HTMLElement.h',
+            'html/HTMLFormControlElement.h',
+            'html/HTMLFormElement.h',
+            'html/HTMLFrameElement.h',
+            'html/HTMLFrameElementBase.h',
+            'html/HTMLFrameOwnerElement.h',
+            'html/HTMLHeadElement.h',
+            'html/HTMLIFrameElement.h',
+            'html/HTMLInputElement.h',
+            'html/HTMLMediaElement.h',
+            'html/HTMLParserQuirks.h',
+            'html/HTMLPlugInElement.h',
+            'html/HTMLPlugInImageElement.h',
+            'html/HTMLTableCellElement.h',
+            'html/HTMLTablePartElement.h',
+            'html/HTMLTextAreaElement.h',
+            'html/InputType.h',
+            'html/VoidCallback.h',
+            'html/parser/HTMLParserIdioms.h',
+            'inspector/InspectorAgent.h',
+            'inspector/InspectorClient.h',
+            'inspector/InspectorController.h',
+            'inspector/InspectorDOMAgent.h',
+            'inspector/InspectorFrontendClient.h',
+            'inspector/InspectorFrontendClientLocal.h',
+            'inspector/InspectorValues.h',
+            'inspector/ScriptBreakpoint.h',
+            'inspector/ScriptDebugListener.h',
+            'loader/CrossOriginPreflightResultCache.h',
+            'loader/DocumentLoadTiming.h',
+            'loader/DocumentLoader.h',
+            'loader/DocumentWriter.h',
+            'loader/FormState.h',
+            'loader/FormSubmission.h',
+            'loader/FrameLoader.h',
+            'loader/FrameLoaderClient.h',
+            'loader/FrameLoaderStateMachine.h',
+            'loader/FrameLoaderTypes.h',
+            'loader/FrameNetworkingContext.h',
+            'loader/HistoryController.h',
+            'loader/NavigationAction.h',
+            'loader/NavigationScheduler.h',
+            'loader/NetscapePlugInStreamLoader.h',
+            'loader/PolicyCallback.h',
+            'loader/PolicyChecker.h',
+            'loader/ProgressTracker.h',
+            'loader/ResourceLoadNotifier.h',
+            'loader/ResourceLoadScheduler.h',
+            'loader/ResourceLoader.h',
+            'loader/SubframeLoader.h',
+            'loader/SubresourceLoader.h',
+            'loader/SubresourceLoaderClient.h',
+            'loader/SubstituteData.h',
+            'loader/SubstituteResource.h',
+            'loader/TextResourceDecoder.h',
+            'loader/ThreadableLoader.h',
+            'loader/appcache/ApplicationCache.h',
+            'loader/appcache/ApplicationCacheStorage.h',
+            'loader/archive/Archive.h',
+            'loader/archive/ArchiveResource.h',
+            'loader/archive/cf/LegacyWebArchive.h',
+            'loader/cache/CachePolicy.h',
+            'loader/cache/CachedImage.h',
+            'loader/cache/CachedResource.h',
+            'loader/cache/CachedResourceClient.h',
+            'loader/cache/CachedResourceHandle.h',
+            'loader/cache/CachedResourceLoader.h',
+            'loader/cache/CachedResourceRequest.h',
+            'loader/cache/MemoryCache.h',
+            'loader/icon/IconDatabase.h',
+            'loader/icon/IconDatabaseBase.h',
+            'loader/icon/IconDatabaseClient.h',
+            'loader/mac/LoaderNSURLExtras.h',
+            'notifications/NotificationPresenter.h',
+            'page/Chrome.h',
+            'page/ChromeClient.h',
+            'page/Console.h',
+            'page/ContentSecurityPolicy.h',
+            'page/ContextMenuClient.h',
+            'page/ContextMenuController.h',
+            'page/Coordinates.h',
+            'page/DOMWindow.h',
+            'page/DragActions.h',
+            'page/DragClient.h',
+            'page/DragController.h',
+            'page/EditorClient.h',
+            'page/EventHandler.h',
+            'page/FocusController.h',
+            'page/FocusDirection.h',
+            'page/Frame.h',
+            'page/FrameLoadRequest.h',
+            'page/FrameTree.h',
+            'page/FrameView.h',
+            'page/Geolocation.h',
+            'page/GeolocationClient.h',
+            'page/GeolocationController.h',
+            'page/GeolocationError.h',
+            'page/GeolocationPosition.h',
+            'page/GeolocationPositionCache.h',
+            'page/Geoposition.h',
+            'page/GroupSettings.h',
+            'page/HaltablePlugin.h',
+            'page/MediaCanStartListener.h',
+            'page/MemoryInfo.h',
+            'page/Page.h',
+            'page/PageGroup.h',
+            'page/PluginHalterClient.h',
+            'page/PositionCallback.h',
+            'page/PositionError.h',
+            'page/PositionErrorCallback.h',
+            'page/PositionOptions.h',
+            'page/PrintContext.h',
+            'page/SecurityOrigin.h',
+            'page/SecurityOriginHash.h',
+            'page/Settings.h',
+            'page/SpatialNavigation.h',
+            'page/UserContentTypes.h',
+            'page/UserContentURLPattern.h',
+            'page/UserScript.h',
+            'page/UserScriptTypes.h',
+            'page/UserStyleSheet.h',
+            'page/UserStyleSheetTypes.h',
+            'page/WebCoreKeyboardUIMode.h',
+            'page/WindowFeatures.h',
+            'page/animation/AnimationController.h',
+            'page/mac/WebCoreFrameView.h',
+            'page/mac/WebCoreViewFactory.h',
+            'platform/AsyncFileStream.h',
+            'platform/ContextMenu.h',
+            'platform/ContextMenuItem.h',
+            'platform/Cookie.h',
+            'platform/CookieJar.h',
+            'platform/CookiesStrategy.h',
+            'platform/Cursor.h',
+            'platform/DefaultLocalizationStrategy.h',
+            'platform/DragData.h',
+            'platform/DragImage.h',
+            'platform/FileChooser.h',
+            'platform/FileStream.h',
+            'platform/FileStreamClient.h',
+            'platform/FileSystem.h',
+            'platform/HostWindow.h',
+            'platform/KURL.h',
+            'platform/KURLHash.h',
+            'platform/Language.h',
+            'platform/Length.h',
+            'platform/LengthBox.h',
+            'platform/LengthSize.h',
+            'platform/LinkHash.h',
+            'platform/LocalizationStrategy.h',
+            'platform/LocalizedStrings.h',
+            'platform/Logging.h',
+            'platform/MIMETypeRegistry.h',
+            'platform/NotImplemented.h',
+            'platform/PlatformGestureEvent.h',
+            'platform/PlatformGestureRecognizer.cpp',
+            'platform/PlatformGestureRecognizer.h',
+            'platform/PlatformKeyboardEvent.h',
+            'platform/PlatformMenuDescription.h',
+            'platform/PlatformMouseEvent.h',
+            'platform/PlatformScreen.h',
+            'platform/PlatformStrategies.h',
+            'platform/PlatformWheelEvent.h',
+            'platform/PopupMenu.h',
+            'platform/PopupMenuClient.h',
+            'platform/PopupMenuStyle.h',
+            'platform/PurgePriority.h',
+            'platform/SchemeRegistry.h',
+            'platform/ScrollTypes.h',
+            'platform/ScrollView.h',
+            'platform/ScrollableArea.h',
+            'platform/Scrollbar.h',
+            'platform/ScrollbarTheme.h',
+            'platform/SearchPopupMenu.h',
+            'platform/SharedBuffer.h',
+            'platform/SystemTime.h',
+            'platform/Theme.h',
+            'platform/ThemeTypes.h',
+            'platform/ThreadCheck.h',
+            'platform/ThreadGlobalData.h',
+            'platform/Timer.h',
+            'platform/TreeShared.h',
+            'platform/URLString.h',
+            'platform/VisitedLinkStrategy.h',
+            'platform/Widget.h',
+            'platform/WindowsKeyboardCodes.h',
+            'platform/animation/Animation.h',
+            'platform/animation/AnimationList.h',
+            'platform/animation/TimingFunction.h',
+            'platform/cf/BinaryPropertyList.h',
+            'platform/cf/SchedulePair.h',
+            'platform/graphics/BitmapImage.h',
+            'platform/graphics/Color.h',
+            'platform/graphics/ColorSpace.h',
+            'platform/graphics/DashArray.h',
+            'platform/graphics/FloatPoint.h',
+            'platform/graphics/FloatPoint3D.h',
+            'platform/graphics/FloatQuad.h',
+            'platform/graphics/FloatRect.h',
+            'platform/graphics/FloatSize.h',
+            'platform/graphics/Font.h',
+            'platform/graphics/FontBaseline.h',
+            'platform/graphics/FontCache.h',
+            'platform/graphics/FontData.h',
+            'platform/graphics/FontDescription.h',
+            'platform/graphics/FontFallbackList.h',
+            'platform/graphics/FontFamily.h',
+            'platform/graphics/FontMetrics.h',
+            'platform/graphics/FontOrientation.h',
+            'platform/graphics/FontRenderingMode.h',
+            'platform/graphics/FontSelector.h',
+            'platform/graphics/FontSmoothingMode.h',
+            'platform/graphics/FontTraitsMask.h',
+            'platform/graphics/FontWidthVariant.h',
+            'platform/graphics/Generator.h',
+            'platform/graphics/GlyphBuffer.h',
+            'platform/graphics/GlyphMetricsMap.h',
+            'platform/graphics/GlyphPageTreeNode.h',
+            'platform/graphics/Gradient.h',
+            'platform/graphics/GraphicsContext.h',
+            'platform/graphics/GraphicsContext3D.h',
+            'platform/graphics/GraphicsLayer.h',
+            'platform/graphics/GraphicsLayerClient.h',
+            'platform/graphics/GraphicsTypes.h',
+            'platform/graphics/GraphicsTypes3D.h',
+            'platform/graphics/Icon.h',
+            'platform/graphics/Image.h',
+            'platform/graphics/ImageBuffer.h',
+            'platform/graphics/ImageObserver.h',
+            'platform/graphics/ImageSource.h',
+            'platform/graphics/IntPoint.h',
+            'platform/graphics/IntPointHash.h',
+            'platform/graphics/IntRect.h',
+            'platform/graphics/IntRectHash.h',
+            'platform/graphics/IntSize.h',
+            'platform/graphics/IntSizeHash.h',
+            'platform/graphics/MediaPlayer.h',
+            'platform/graphics/Path.h',
+            'platform/graphics/Pattern.h',
+            'platform/graphics/RoundedIntRect.h',
+            'platform/graphics/SimpleFontData.h',
+            'platform/graphics/StringTruncator.h',
+            'platform/graphics/TextRenderingMode.h',
+            'platform/graphics/TextRun.h',
+            'platform/graphics/TypesettingFeatures.h',
+            'platform/graphics/cg/ImageBufferData.h',
+            'platform/graphics/mac/ColorMac.h',
+            'platform/graphics/mac/MediaPlayerProxy.h',
+            'platform/graphics/transforms/AffineTransform.h',
+            'platform/graphics/transforms/TransformOperation.h',
+            'platform/graphics/transforms/TransformOperations.h',
+            'platform/graphics/transforms/TransformationMatrix.h',
+            'platform/gtk/PasteboardHelper.h',
+            'platform/mac/BlockExceptions.h',
+            'platform/mac/ClipboardMac.h',
+            'platform/mac/EmptyProtocolDefinitions.h',
+            'platform/mac/FoundationExtras.h',
+            'platform/mac/PopupMenuMac.h',
+            'platform/mac/RuntimeApplicationChecks.h',
+            'platform/mac/SearchPopupMenuMac.h',
+            'platform/mac/SoftLinking.h',
+            'platform/mac/WebCoreNSStringExtras.h',
+            'platform/mac/WebCoreObjCExtras.h',
+            'platform/mac/WebCoreSystemInterface.h',
+            'platform/mac/WebCoreView.h',
+            'platform/mac/WebFontCache.h',
+            'platform/mock/DeviceOrientationClientMock.h',
+            'platform/mock/GeolocationClientMock.h',
+            'platform/network/AuthenticationChallengeBase.h',
+            'platform/network/AuthenticationClient.h',
+            'platform/network/CookieStorage.h',
+            'platform/network/Credential.h',
+            'platform/network/CredentialStorage.h',
+            'platform/network/FormData.h',
+            'platform/network/HTTPHeaderMap.h',
+            'platform/network/NetworkingContext.h',
+            'platform/network/ProtectionSpace.h',
+            'platform/network/ProtectionSpaceHash.h',
+            'platform/network/ProxyServer.h',
+            'platform/network/ResourceErrorBase.h',
+            'platform/network/ResourceHandle.h',
+            'platform/network/ResourceHandleClient.h',
+            'platform/network/ResourceLoadInfo.h',
+            'platform/network/ResourceLoadPriority.h',
+            'platform/network/ResourceLoadTiming.h',
+            'platform/network/ResourceRequestBase.h',
+            'platform/network/ResourceResponseBase.h',
+            'platform/network/cf/AuthenticationChallenge.h',
+            'platform/network/cf/ResourceError.h',
+            'platform/network/cf/ResourceRequest.h',
+            'platform/network/cf/ResourceResponse.h',
+            'platform/network/mac/AuthenticationMac.h',
+            'platform/network/mac/FormDataStreamMac.h',
+            'platform/network/mac/WebCoreURLResponse.h',
+            'platform/sql/SQLValue.h',
+            'platform/sql/SQLiteDatabase.h',
+            'platform/sql/SQLiteTransaction.h',
+            'platform/text/Base64.h',
+            'platform/text/BidiContext.h',
+            'platform/text/BidiResolver.h',
+            'platform/text/LineEnding.h',
+            'platform/text/PlatformString.h',
+            'platform/text/RegularExpression.h',
+            'platform/text/SegmentedString.h',
+            'platform/text/TextBoundaries.h',
+            'platform/text/TextBreakIterator.h',
+            'platform/text/TextBreakIteratorInternalICU.h',
+            'platform/text/TextCheckerClient.h',
+            'platform/text/TextChecking.h',
+            'platform/text/TextCodec.h',
+            'platform/text/TextCodecICU.h',
+            'platform/text/TextCodecLatin1.h',
+            'platform/text/TextCodecUTF16.h',
+            'platform/text/TextCodecUserDefined.h',
+            'platform/text/TextDirection.h',
+            'platform/text/TextEncoding.h',
+            'platform/text/TextEncodingRegistry.h',
+            'platform/text/TextOrientation.h',
+            'platform/text/TextStream.h',
+            'platform/text/UnicodeRange.h',
+            'platform/text/mac/CharsetData.h',
+            'plugins/PluginData.h',
+            'plugins/PluginMainThreadScheduler.h',
+            'plugins/PluginStrategy.h',
+            'plugins/PluginViewBase.h',
+            'plugins/npfunctions.h',
+            'rendering/ColumnInfo.h',
+            'rendering/GapRects.h',
+            'rendering/HitTestRequest.h',
+            'rendering/HitTestResult.h',
+            'rendering/InlineBox.h',
+            'rendering/InlineFlowBox.h',
+            'rendering/InlineTextBox.h',
+            'rendering/LayoutState.h',
+            'rendering/OverlapTestRequestClient.h',
+            'rendering/PaintInfo.h',
+            'rendering/PaintPhase.h',
+            'rendering/RenderBR.h',
+            'rendering/RenderBlock.h',
+            'rendering/RenderBox.h',
+            'rendering/RenderBoxModelObject.h',
+            'rendering/RenderEmbeddedObject.h',
+            'rendering/RenderImage.h',
+            'rendering/RenderImageResource.h',
+            'rendering/RenderImageResourceStyleImage.h',
+            'rendering/RenderLayer.h',
+            'rendering/RenderLayerBacking.h',
+            'rendering/RenderLineBoxList.h',
+            'rendering/RenderListItem.h',
+            'rendering/RenderObject.h',
+            'rendering/RenderObjectChildList.h',
+            'rendering/RenderOverflow.h',
+            'rendering/RenderPart.h',
+            'rendering/RenderReplaced.h',
+            'rendering/RenderText.h',
+            'rendering/RenderTreeAsText.h',
+            'rendering/RenderView.h',
+            'rendering/RenderWidget.h',
+            'rendering/RootInlineBox.h',
+            'rendering/ScrollBehavior.h',
+            'rendering/style/BorderData.h',
+            'rendering/style/BorderValue.h',
+            'rendering/style/CollapsedBorderValue.h',
+            'rendering/style/ContentData.h',
+            'rendering/style/CounterContent.h',
+            'rendering/style/CounterDirectives.h',
+            'rendering/style/CursorData.h',
+            'rendering/style/CursorList.h',
+            'rendering/style/DataRef.h',
+            'rendering/style/FillLayer.h',
+            'rendering/style/LineClampValue.h',
+            'rendering/style/NinePieceImage.h',
+            'rendering/style/OutlineValue.h',
+            'rendering/style/RenderStyle.h',
+            'rendering/style/RenderStyleConstants.h',
+            'rendering/style/SVGRenderStyle.h',
+            'rendering/style/SVGRenderStyleDefs.h',
+            'rendering/style/ShadowData.h',
+            'rendering/style/StyleBackgroundData.h',
+            'rendering/style/StyleBoxData.h',
+            'rendering/style/StyleCachedImage.h',
+            'rendering/style/StyleDashboardRegion.h',
+            'rendering/style/StyleFlexibleBoxData.h',
+            'rendering/style/StyleGeneratedImage.h',
+            'rendering/style/StyleImage.h',
+            'rendering/style/StyleInheritedData.h',
+            'rendering/style/StyleMarqueeData.h',
+            'rendering/style/StyleMultiColData.h',
+            'rendering/style/StyleRareInheritedData.h',
+            'rendering/style/StyleRareNonInheritedData.h',
+            'rendering/style/StyleReflection.h',
+            'rendering/style/StyleSurroundData.h',
+            'rendering/style/StyleTransformData.h',
+            'rendering/style/StyleVisualData.h',
+            'rendering/svg/SVGResourcesCache.h',
+            'storage/AbstractDatabase.h',
+            'storage/Database.h',
+            'storage/DatabaseDetails.h',
+            'storage/DatabaseTracker.h',
+            'storage/DatabaseTrackerClient.h',
+            'storage/SQLError.h',
+            'storage/SQLResultSet.h',
+            'storage/SQLResultSetRowList.h',
+            'storage/SQLStatement.h',
+            'storage/SQLStatementCallback.h',
+            'storage/SQLStatementErrorCallback.h',
+            'storage/SQLTransaction.h',
+            'storage/SQLTransactionCallback.h',
+            'storage/SQLTransactionErrorCallback.h',
+            'storage/StorageTracker.h',
+            'storage/StorageTrackerClient.h',
+            'svg/SVGAngle.h',
+            'svg/SVGAnimatedAngle.h',
+            'svg/SVGAnimatedBoolean.h',
+            'svg/SVGAnimatedEnumeration.h',
+            'svg/SVGAnimatedInteger.h',
+            'svg/SVGAnimatedLength.h',
+            'svg/SVGAnimatedLengthList.h',
+            'svg/SVGAnimatedNumber.h',
+            'svg/SVGAnimatedNumberList.h',
+            'svg/SVGAnimatedPreserveAspectRatio.h',
+            'svg/SVGAnimatedRect.h',
+            'svg/SVGAnimatedString.h',
+            'svg/SVGAnimatedTransformList.h',
+            'svg/SVGColor.h',
+            'svg/SVGDocumentExtensions.h',
+            'svg/SVGElement.h',
+            'svg/SVGLength.h',
+            'svg/SVGLengthList.h',
+            'svg/SVGLocatable.h',
+            'svg/SVGMatrix.h',
+            'svg/SVGNumberList.h',
+            'svg/SVGPaint.h',
+            'svg/SVGPreserveAspectRatio.h',
+            'svg/SVGTransform.h',
+            'svg/SVGTransformList.h',
+            'svg/animation/SMILTime.h',
+            'svg/animation/SVGSMILElement.h',
+            'svg/properties/SVGAnimatedListPropertyTearOff.h',
+            'svg/properties/SVGAnimatedProperty.h',
+            'svg/properties/SVGAnimatedPropertyDescription.h',
+            'svg/properties/SVGAnimatedPropertyMacros.h',
+            'svg/properties/SVGAnimatedPropertySynchronizer.h',
+            'svg/properties/SVGAnimatedPropertyTearOff.h',
+            'svg/properties/SVGAnimatedStaticPropertyTearOff.h',
+            'svg/properties/SVGAnimatedTransformListPropertyTearOff.h',
+            'svg/properties/SVGListProperty.h',
+            'svg/properties/SVGListPropertyTearOff.h',
+            'svg/properties/SVGPathSegListPropertyTearOff.h',
+            'svg/properties/SVGProperty.h',
+            'svg/properties/SVGPropertyTearOff.h',
+            'svg/properties/SVGPropertyTraits.h',
+            'svg/properties/SVGStaticListPropertyTearOff.h',
+            'svg/properties/SVGStaticPropertyTearOff.h',
+            'svg/properties/SVGStaticPropertyWithParentTearOff.h',
+            'svg/properties/SVGTransformListPropertyTearOff.h',
+            'workers/WorkerRunLoop.h',
+            'workers/WorkerThread.h',
         ],
         'webcore_bindings_idl_files': [
             'css/CSSCharsetRule.idl',
@@ -50,6 +1103,8 @@
             'dom/DOMImplementation.idl',
             'dom/DOMStringList.idl',
             'dom/DOMStringMap.idl',
+            'dom/DataTransferItem.idl',
+            'dom/DataTransferItems.idl',
             'dom/DeviceMotionEvent.idl',
             'dom/DeviceOrientationEvent.idl',
             'dom/Document.idl',
@@ -84,6 +1139,7 @@
             'dom/Range.idl',
             'dom/RangeException.idl',
             'dom/RequestAnimationFrameCallback.idl',
+            'dom/StringCallback.idl',
             'dom/Text.idl',
             'dom/TextEvent.idl',
             'dom/Touch.idl',
@@ -273,6 +1329,8 @@
             'page/SpeechInputEvent.idl',
             'page/SpeechInputResult.idl',
             'page/SpeechInputResultList.idl',
+            'page/WebKitAnimation.idl',
+            'page/WebKitAnimationList.idl',
             'page/WebKitPoint.idl',
             'page/WorkerNavigator.idl',
             'plugins/DOMMimeType.idl',
@@ -501,13 +1559,13 @@
         ],
         'webcore_files': [
             'accessibility/AXObjectCache.cpp',
-            'accessibility/AXObjectCache.h',
             'accessibility/AccessibilityARIAGrid.cpp',
             'accessibility/AccessibilityARIAGrid.h',
             'accessibility/AccessibilityARIAGridCell.cpp',
             'accessibility/AccessibilityARIAGridCell.h',
             'accessibility/AccessibilityARIAGridRow.cpp',
             'accessibility/AccessibilityARIAGridRow.h',
+            'accessibility/AccessibilityAllInOne.cpp',
             'accessibility/AccessibilityImageMapLink.cpp',
             'accessibility/AccessibilityImageMapLink.h',
             'accessibility/AccessibilityList.cpp',
@@ -525,7 +1583,6 @@
             'accessibility/AccessibilityMenuListPopup.cpp',
             'accessibility/AccessibilityMenuListPopup.h',
             'accessibility/AccessibilityObject.cpp',
-            'accessibility/AccessibilityObject.h',
             'accessibility/AccessibilityProgressIndicator.cpp',
             'accessibility/AccessibilityProgressIndicator.h',
             'accessibility/AccessibilityRenderObject.cpp',
@@ -549,10 +1606,13 @@
             'accessibility/chromium/AXObjectCacheChromium.cpp',
             'accessibility/chromium/AccessibilityObjectChromium.cpp',
             'accessibility/chromium/AccessibilityObjectWrapper.h',
+            'accessibility/efl/AccessibilityObjectEfl.cpp',
             'accessibility/gtk/AXObjectCacheAtk.cpp',
             'accessibility/gtk/AccessibilityObjectAtk.cpp',
             'accessibility/gtk/AccessibilityObjectWrapperAtk.cpp',
             'accessibility/gtk/AccessibilityObjectWrapperAtk.h',
+            'accessibility/gtk/WebKitAccessibleHyperlink.cpp',
+            'accessibility/gtk/WebKitAccessibleHyperlink.h',
             'accessibility/mac/AXObjectCacheMac.mm',
             'accessibility/mac/AccessibilityObjectMac.mm',
             'accessibility/mac/AccessibilityObjectWrapper.h',
@@ -563,7 +1623,6 @@
             'accessibility/win/AccessibilityObjectWrapperWin.h',
             'accessibility/wx/AccessibilityObjectWx.cpp',
             'bindings/ScriptControllerBase.cpp',
-            'bindings/ScriptControllerBase.h',
             'bindings/cpp/WebDOMCString.cpp',
             'bindings/cpp/WebDOMCString.h',
             'bindings/cpp/WebDOMCustomVoidCallback.cpp',
@@ -611,11 +1670,8 @@
             'bindings/gobject/WebKitHTMLElementWrapperFactory.h',
             'bindings/js/CachedScriptSourceProvider.h',
             'bindings/js/DOMObjectHashTableMap.cpp',
-            'bindings/js/DOMObjectHashTableMap.h',
             'bindings/js/DOMWrapperWorld.cpp',
-            'bindings/js/DOMWrapperWorld.h',
             'bindings/js/GCController.cpp',
-            'bindings/js/GCController.h',
             'bindings/js/IDBBindingUtilities.cpp',
             'bindings/js/IDBBindingUtilities.h',
             'bindings/js/JSArrayBufferCustom.cpp',
@@ -657,10 +1713,8 @@
             'bindings/js/JSCustomXPathNSResolver.h',
             'bindings/js/JSDOMApplicationCacheCustom.cpp',
             'bindings/js/JSDOMBinding.cpp',
-            'bindings/js/JSDOMBinding.h',
             'bindings/js/JSDOMFormDataCustom.cpp',
             'bindings/js/JSDOMGlobalObject.cpp',
-            'bindings/js/JSDOMGlobalObject.h',
             'bindings/js/JSDOMImplementationCustom.cpp',
             'bindings/js/JSDOMMimeTypeArrayCustom.cpp',
             'bindings/js/JSDOMPluginArrayCustom.cpp',
@@ -668,13 +1722,10 @@
             'bindings/js/JSDOMStringMapCustom.cpp',
             'bindings/js/JSDOMStringMapCustom.h',
             'bindings/js/JSDOMWindowBase.cpp',
-            'bindings/js/JSDOMWindowBase.h',
             'bindings/js/JSDOMWindowCustom.cpp',
             'bindings/js/JSDOMWindowCustom.h',
             'bindings/js/JSDOMWindowShell.cpp',
-            'bindings/js/JSDOMWindowShell.h',
             'bindings/js/JSDOMWrapper.cpp',
-            'bindings/js/JSDOMWrapper.h',
             'bindings/js/JSDataGridColumnListCustom.cpp',
             'bindings/js/JSDataGridDataSource.cpp',
             'bindings/js/JSDataGridDataSource.h',
@@ -733,6 +1784,7 @@
             'bindings/js/JSImageConstructor.h',
             'bindings/js/JSImageDataCustom.cpp',
             'bindings/js/JSInjectedScriptHostCustom.cpp',
+            'bindings/js/JSInjectedScriptManager.cpp',
             'bindings/js/JSInspectorFrontendHostCustom.cpp',
             'bindings/js/JSInt16ArrayCustom.cpp',
             'bindings/js/JSInt32ArrayCustom.cpp',
@@ -753,7 +1805,6 @@
             'bindings/js/JSNamedNodeMapCustom.cpp',
             'bindings/js/JSNavigatorCustom.cpp',
             'bindings/js/JSNodeCustom.cpp',
-            'bindings/js/JSNodeCustom.h',
             'bindings/js/JSNodeFilterCondition.cpp',
             'bindings/js/JSNodeFilterCondition.h',
             'bindings/js/JSNodeFilterCustom.cpp',
@@ -762,7 +1813,6 @@
             'bindings/js/JSOptionConstructor.cpp',
             'bindings/js/JSOptionConstructor.h',
             'bindings/js/JSPluginElementFunctions.cpp',
-            'bindings/js/JSPluginElementFunctions.h',
             'bindings/js/JSProcessingInstructionCustom.cpp',
             'bindings/js/JSSQLResultSetRowListCustom.cpp',
             'bindings/js/JSSQLTransactionCustom.cpp',
@@ -784,6 +1834,8 @@
             'bindings/js/JSUint32ArrayCustom.cpp',
             'bindings/js/JSUint8ArrayCustom.cpp',
             'bindings/js/JSWebGLRenderingContextCustom.cpp',
+            'bindings/js/JSWebKitAnimationCustom.cpp',
+            'bindings/js/JSWebKitAnimationListCustom.cpp',
             'bindings/js/JSWebKitCSSKeyframeRuleCustom.cpp',
             'bindings/js/JSWebKitCSSKeyframesRuleCustom.cpp',
             'bindings/js/JSWebKitCSSMatrixCustom.cpp',
@@ -802,11 +1854,9 @@
             'bindings/js/ScheduledAction.cpp',
             'bindings/js/ScheduledAction.h',
             'bindings/js/ScriptCachedFrameData.cpp',
-            'bindings/js/ScriptCachedFrameData.h',
             'bindings/js/ScriptCallStackFactory.cpp',
             'bindings/js/ScriptCallStackFactory.h',
             'bindings/js/ScriptController.cpp',
-            'bindings/js/ScriptController.h',
             'bindings/js/ScriptControllerBrew.cpp',
             'bindings/js/ScriptControllerEfl.cpp',
             'bindings/js/ScriptControllerGtk.cpp',
@@ -816,7 +1866,6 @@
             'bindings/js/ScriptControllerWin.cpp',
             'bindings/js/ScriptControllerWx.cpp',
             'bindings/js/ScriptDebugServer.cpp',
-            'bindings/js/ScriptDebugServer.h',
             'bindings/js/ScriptEventListener.cpp',
             'bindings/js/ScriptEventListener.h',
             'bindings/js/ScriptFunctionCall.cpp',
@@ -824,72 +1873,39 @@
             'bindings/js/ScriptGCEvent.cpp',
             'bindings/js/ScriptGCEvent.h',
             'bindings/js/ScriptHeapSnapshot.h',
-            'bindings/js/ScriptInstance.h',
             'bindings/js/ScriptObject.cpp',
-            'bindings/js/ScriptObject.h',
             'bindings/js/ScriptProfile.cpp',
-            'bindings/js/ScriptProfile.h',
-            'bindings/js/ScriptProfileNode.h',
             'bindings/js/ScriptProfiler.cpp',
-            'bindings/js/ScriptProfiler.h',
             'bindings/js/ScriptSourceCode.h',
-            'bindings/js/ScriptSourceProvider.h',
             'bindings/js/ScriptState.cpp',
-            'bindings/js/ScriptState.h',
             'bindings/js/ScriptValue.cpp',
-            'bindings/js/ScriptValue.h',
-            'bindings/js/ScriptWrappable.h',
             'bindings/js/SerializedScriptValue.cpp',
-            'bindings/js/SerializedScriptValue.h',
-            'bindings/js/StringSourceProvider.h',
             'bindings/js/WebCoreJSClientData.h',
             'bindings/js/WorkerScriptController.cpp',
             'bindings/js/WorkerScriptController.h',
-            'bindings/objc/DOM.h',
             'bindings/objc/DOM.mm',
             'bindings/objc/DOMAbstractView.mm',
             'bindings/objc/DOMAbstractViewFrame.h',
-            'bindings/objc/DOMCSS.h',
             'bindings/objc/DOMCSS.mm',
-            'bindings/objc/DOMCore.h',
             'bindings/objc/DOMCustomXPathNSResolver.h',
             'bindings/objc/DOMCustomXPathNSResolver.mm',
-            'bindings/objc/DOMEventException.h',
-            'bindings/objc/DOMEvents.h',
             'bindings/objc/DOMEvents.mm',
-            'bindings/objc/DOMException.h',
-            'bindings/objc/DOMExtensions.h',
-            'bindings/objc/DOMHTML.h',
             'bindings/objc/DOMHTML.mm',
             'bindings/objc/DOMImplementationFront.cpp',
             'bindings/objc/DOMImplementationFront.h',
             'bindings/objc/DOMInternal.h',
             'bindings/objc/DOMInternal.mm',
-            'bindings/objc/DOMObject.h',
             'bindings/objc/DOMObject.mm',
-            'bindings/objc/DOMPrivate.h',
-            'bindings/objc/DOMRangeException.h',
-            'bindings/objc/DOMRanges.h',
-            'bindings/objc/DOMSVG.h',
-            'bindings/objc/DOMSVGException.h',
             'bindings/objc/DOMSVGPathSegInternal.mm',
-            'bindings/objc/DOMStylesheets.h',
-            'bindings/objc/DOMTraversal.h',
             'bindings/objc/DOMUtility.mm',
-            'bindings/objc/DOMViews.h',
-            'bindings/objc/DOMXPath.h',
             'bindings/objc/DOMXPath.mm',
-            'bindings/objc/DOMXPathException.h',
-            'bindings/objc/ExceptionHandlers.h',
             'bindings/objc/ExceptionHandlers.mm',
             'bindings/objc/ObjCEventListener.h',
             'bindings/objc/ObjCEventListener.mm',
             'bindings/objc/ObjCNodeFilterCondition.h',
             'bindings/objc/ObjCNodeFilterCondition.mm',
             'bindings/objc/PublicDOMInterfaces.h',
-            'bindings/objc/WebScriptObject.h',
             'bindings/objc/WebScriptObject.mm',
-            'bindings/objc/WebScriptObjectPrivate.h',
             'bindings/v8/ChildThreadDOMData.cpp',
             'bindings/v8/ChildThreadDOMData.h',
             'bindings/v8/DOMData.cpp',
@@ -914,15 +1930,22 @@
             'bindings/v8/OptionsObject.cpp',
             'bindings/v8/OptionsObject.h',
             'bindings/v8/OwnHandle.h',
+            'bindings/v8/PageScriptDebugServer.cpp',
+            'bindings/v8/PageScriptDebugServer.h',
+            'bindings/v8/RetainedDOMInfo.cpp',
+            'bindings/v8/RetainedDOMInfo.h',
+            'bindings/v8/RetainedObjectInfo.h',
             'bindings/v8/ScheduledAction.cpp',
             'bindings/v8/ScheduledAction.h',
             'bindings/v8/ScopedDOMDataStore.cpp',
             'bindings/v8/ScopedDOMDataStore.h',
+            'bindings/v8/ScriptCachedFrameData.cpp',
             'bindings/v8/ScriptCachedFrameData.h',
             'bindings/v8/ScriptCallStackFactory.cpp',
             'bindings/v8/ScriptCallStackFactory.h',
             'bindings/v8/ScriptController.cpp',
             'bindings/v8/ScriptController.h',
+            'bindings/v8/ScriptControllerQt.cpp',
             'bindings/v8/ScriptDebugServer.cpp',
             'bindings/v8/ScriptDebugServer.h',
             'bindings/v8/ScriptEventListener.cpp',
@@ -953,6 +1976,7 @@
             'bindings/v8/ScriptWrappable.h',
             'bindings/v8/SerializedScriptValue.cpp',
             'bindings/v8/SerializedScriptValue.h',
+            'bindings/v8/SharedPersistent.h',
             'bindings/v8/StaticDOMDataStore.cpp',
             'bindings/v8/StaticDOMDataStore.h',
             'bindings/v8/V8AbstractEventListener.cpp',
@@ -1005,6 +2029,8 @@
             'bindings/v8/WorkerContextExecutionProxy.h',
             'bindings/v8/WorkerScriptController.cpp',
             'bindings/v8/WorkerScriptController.h',
+            'bindings/v8/WorkerScriptDebugServer.cpp',
+            'bindings/v8/WorkerScriptDebugServer.h',
             'bindings/v8/WorldContextHandle.cpp',
             'bindings/v8/WorldContextHandle.h',
             'bindings/v8/WrapperTypeInfo.h',
@@ -1038,7 +2064,6 @@
             'bindings/v8/custom/V8DOMWindowCustom.cpp',
             'bindings/v8/custom/V8DataGridColumnListCustom.cpp',
             'bindings/v8/custom/V8DataViewCustom.cpp',
-            'bindings/v8/custom/V8DataViewCustom.h',
             'bindings/v8/custom/V8DedicatedWorkerContextCustom.cpp',
             'bindings/v8/custom/V8DeviceMotionEventCustom.cpp',
             'bindings/v8/custom/V8DeviceOrientationEventCustom.cpp',
@@ -1080,6 +2105,7 @@
             'bindings/v8/custom/V8IDBKeyCustom.cpp',
             'bindings/v8/custom/V8ImageDataCustom.cpp',
             'bindings/v8/custom/V8InjectedScriptHostCustom.cpp',
+            'bindings/v8/custom/V8InjectedScriptManager.cpp',
             'bindings/v8/custom/V8InspectorFrontendHostCustom.cpp',
             'bindings/v8/custom/V8Int16ArrayCustom.cpp',
             'bindings/v8/custom/V8Int32ArrayCustom.cpp',
@@ -1115,6 +2141,7 @@
             'bindings/v8/custom/V8Uint32ArrayCustom.cpp',
             'bindings/v8/custom/V8Uint8ArrayCustom.cpp',
             'bindings/v8/custom/V8WebGLRenderingContextCustom.cpp',
+            'bindings/v8/custom/V8WebKitAnimationCustom.cpp',
             'bindings/v8/custom/V8WebKitCSSMatrixConstructor.cpp',
             'bindings/v8/custom/V8WebKitPointConstructor.cpp',
             'bindings/v8/custom/V8WebSocketCustom.cpp',
@@ -1124,19 +2151,45 @@
             'bindings/v8/custom/V8XMLHttpRequestCustom.cpp',
             'bindings/v8/custom/V8XSLTProcessorCustom.cpp',
             'bindings/v8/npruntime.cpp',
-            'bindings/v8/npruntime_impl.h',
-            'bindings/v8/npruntime_internal.h',
             'bindings/v8/npruntime_priv.h',
             'bindings/v8/specialization/V8BindingState.cpp',
             'bindings/v8/specialization/V8BindingState.h',
-            'bridge/Bridge.h',
+            'bridge/IdentifierRep.cpp',
+            'bridge/NP_jsobject.cpp',
+            'bridge/NP_jsobject.h',
+            'bridge/c/CRuntimeObject.cpp',
+            'bridge/c/CRuntimeObject.h',
+            'bridge/c/c_class.cpp',
+            'bridge/c/c_class.h',
+            'bridge/c/c_instance.cpp',
+            'bridge/c/c_instance.h',
+            'bridge/c/c_runtime.cpp',
+            'bridge/c/c_runtime.h',
+            'bridge/c/c_utility.cpp',
+            'bridge/c/c_utility.h',
             'bridge/jni/JNIUtility.cpp',
-            'bridge/jni/JNIUtility.h',
-            'bridge/jni/JavaMethod.cpp',
             'bridge/jni/JavaMethod.h',
+            'bridge/jni/JavaMethodJobject.cpp',
+            'bridge/jni/JavaMethodJobject.h',
             'bridge/jni/JavaString.h',
+            'bridge/jni/JavaType.h',
             'bridge/jni/JobjectWrapper.cpp',
             'bridge/jni/JobjectWrapper.h',
+            'bridge/jni/jni_jsobject.mm',
+            'bridge/jni/jni_objc.mm',
+            'bridge/jni/jsc/JNIUtilityPrivate.cpp',
+            'bridge/jni/jsc/JNIUtilityPrivate.h',
+            'bridge/jni/jsc/JavaArrayJSC.cpp',
+            'bridge/jni/jsc/JavaArrayJSC.h',
+            'bridge/jni/jsc/JavaClassJSC.cpp',
+            'bridge/jni/jsc/JavaClassJSC.h',
+            'bridge/jni/jsc/JavaFieldJSC.cpp',
+            'bridge/jni/jsc/JavaFieldJSC.h',
+            'bridge/jni/jsc/JavaInstanceJSC.cpp',
+            'bridge/jni/jsc/JavaInstanceJSC.h',
+            'bridge/jni/jsc/JavaRuntimeObject.cpp',
+            'bridge/jni/jsc/JavaRuntimeObject.h',
+            'bridge/jni/jsc/JavaStringJSC.h',
             'bridge/jni/v8/JNIUtilityPrivate.cpp',
             'bridge/jni/v8/JNIUtilityPrivate.h',
             'bridge/jni/v8/JavaClassV8.cpp',
@@ -1148,6 +2201,39 @@
             'bridge/jni/v8/JavaNPObjectV8.cpp',
             'bridge/jni/v8/JavaNPObjectV8.h',
             'bridge/jni/v8/JavaStringV8.h',
+            'bridge/jni/v8/JavaValueV8.h',
+            'bridge/jsc/BridgeJSC.cpp',
+            'bridge/npruntime.cpp',
+            'bridge/npruntime_priv.h',
+            'bridge/objc/ObjCRuntimeObject.h',
+            'bridge/objc/ObjCRuntimeObject.mm',
+            'bridge/objc/WebScriptObject.h',
+            'bridge/objc/objc_class.h',
+            'bridge/objc/objc_class.mm',
+            'bridge/objc/objc_header.h',
+            'bridge/objc/objc_instance.h',
+            'bridge/objc/objc_instance.mm',
+            'bridge/objc/objc_runtime.h',
+            'bridge/objc/objc_runtime.mm',
+            'bridge/objc/objc_utility.h',
+            'bridge/objc/objc_utility.mm',
+            'bridge/qt/qt_class.cpp',
+            'bridge/qt/qt_class.h',
+            'bridge/qt/qt_instance.cpp',
+            'bridge/qt/qt_instance.h',
+            'bridge/qt/qt_pixmapruntime.cpp',
+            'bridge/qt/qt_pixmapruntime.h',
+            'bridge/qt/qt_runtime.cpp',
+            'bridge/qt/qt_runtime.h',
+            'bridge/runtime_array.cpp',
+            'bridge/runtime_array.h',
+            'bridge/runtime_method.cpp',
+            'bridge/runtime_object.cpp',
+            'bridge/runtime_root.cpp',
+            'bridge/testbindings.cpp',
+            'bridge/testbindings.mm',
+            'bridge/testqtbindings.cpp',
+            'config.h',
             'css/CSSBorderImageValue.cpp',
             'css/CSSBorderImageValue.h',
             'css/CSSCanvasValue.cpp',
@@ -1155,9 +2241,7 @@
             'css/CSSCharsetRule.cpp',
             'css/CSSCharsetRule.h',
             'css/CSSComputedStyleDeclaration.cpp',
-            'css/CSSComputedStyleDeclaration.h',
             'css/CSSCursorImageValue.cpp',
-            'css/CSSCursorImageValue.h',
             'css/CSSFontFace.cpp',
             'css/CSSFontFace.h',
             'css/CSSFontFaceRule.cpp',
@@ -1172,22 +2256,18 @@
             'css/CSSFunctionValue.h',
             'css/CSSGradientValue.cpp',
             'css/CSSGradientValue.h',
-            'css/CSSHelper.h',
             'css/CSSImageGeneratorValue.cpp',
-            'css/CSSImageGeneratorValue.h',
             'css/CSSImageValue.cpp',
-            'css/CSSImageValue.h',
             'css/CSSImportRule.cpp',
             'css/CSSImportRule.h',
             'css/CSSInheritedValue.cpp',
             'css/CSSInheritedValue.h',
             'css/CSSInitialValue.cpp',
             'css/CSSInitialValue.h',
+            'css/CSSLineBoxContainValue.cpp',
             'css/CSSMediaRule.cpp',
             'css/CSSMediaRule.h',
             'css/CSSMutableStyleDeclaration.cpp',
-            'css/CSSMutableStyleDeclaration.h',
-            'css/CSSMutableValue.h',
             'css/CSSNamespace.h',
             'css/CSSOMUtils.cpp',
             'css/CSSOMUtils.h',
@@ -1196,22 +2276,16 @@
             'css/CSSParser.cpp',
             'css/CSSParser.h',
             'css/CSSParserValues.cpp',
-            'css/CSSParserValues.h',
             'css/CSSPrimitiveValue.cpp',
-            'css/CSSPrimitiveValue.h',
             'css/CSSPrimitiveValueCache.cpp',
             'css/CSSPrimitiveValueCache.h',
             'css/CSSPrimitiveValueMappings.h',
             'css/CSSProperty.cpp',
-            'css/CSSProperty.h',
             'css/CSSPropertyLonghand.cpp',
             'css/CSSPropertyLonghand.h',
             'css/CSSPropertySourceData.cpp',
-            'css/CSSPropertySourceData.h',
             'css/CSSQuirkPrimitiveValue.h',
             'css/CSSReflectValue.cpp',
-            'css/CSSReflectValue.h',
-            'css/CSSReflectionDirection.h',
             'css/CSSRule.cpp',
             'css/CSSRule.h',
             'css/CSSRuleList.cpp',
@@ -1219,11 +2293,11 @@
             'css/CSSSegmentedFontFace.cpp',
             'css/CSSSegmentedFontFace.h',
             'css/CSSSelector.cpp',
-            'css/CSSSelector.h',
             'css/CSSSelectorList.cpp',
             'css/CSSSelectorList.h',
+            'css/CSSStyleApplyProperty.cpp',
+            'css/CSSStyleApplyProperty.h',
             'css/CSSStyleDeclaration.cpp',
-            'css/CSSStyleDeclaration.h',
             'css/CSSStyleRule.cpp',
             'css/CSSStyleRule.h',
             'css/CSSStyleSelector.cpp',
@@ -1235,9 +2309,7 @@
             'css/CSSUnicodeRangeValue.cpp',
             'css/CSSUnicodeRangeValue.h',
             'css/CSSUnknownRule.h',
-            'css/CSSValue.h',
             'css/CSSValueList.cpp',
-            'css/CSSValueList.h',
             'css/Counter.h',
             'css/DashboardRegion.h',
             'css/FontFamilyValue.cpp',
@@ -1260,7 +2332,6 @@
             'css/MediaQueryListListener.h',
             'css/MediaQueryMatcher.cpp',
             'css/MediaQueryMatcher.h',
-            'css/Pair.h',
             'css/RGBColor.cpp',
             'css/RGBColor.h',
             'css/Rect.h',
@@ -1270,7 +2341,6 @@
             'css/ShadowValue.cpp',
             'css/ShadowValue.h',
             'css/StyleBase.cpp',
-            'css/StyleBase.h',
             'css/StyleList.cpp',
             'css/StyleList.h',
             'css/StyleMedia.cpp',
@@ -1286,15 +2356,9 @@
             'css/WebKitCSSMatrix.cpp',
             'css/WebKitCSSMatrix.h',
             'css/WebKitCSSTransformValue.cpp',
-            'css/WebKitCSSTransformValue.h',
             'dom/ActiveDOMObject.cpp',
-            'dom/ActiveDOMObject.h',
-            'dom/AsyncScriptRunner.cpp',
-            'dom/AsyncScriptRunner.h',
             'dom/Attr.cpp',
-            'dom/Attr.h',
             'dom/Attribute.cpp',
-            'dom/Attribute.h',
             'dom/BeforeLoadEvent.h',
             'dom/BeforeProcessEvent.cpp',
             'dom/BeforeProcessEvent.h',
@@ -1305,11 +2369,8 @@
             'dom/CDATASection.cpp',
             'dom/CDATASection.h',
             'dom/CSSMappedAttributeDeclaration.cpp',
-            'dom/CSSMappedAttributeDeclaration.h',
             'dom/CharacterData.cpp',
-            'dom/CharacterData.h',
             'dom/CheckedRadioButtons.cpp',
-            'dom/CheckedRadioButtons.h',
             'dom/ChildNodeList.cpp',
             'dom/ChildNodeList.h',
             'dom/ClassNodeList.cpp',
@@ -1319,8 +2380,6 @@
             'dom/ClientRectList.cpp',
             'dom/ClientRectList.h',
             'dom/Clipboard.cpp',
-            'dom/Clipboard.h',
-            'dom/ClipboardAccessPolicy.h',
             'dom/ClipboardEvent.cpp',
             'dom/ClipboardEvent.h',
             'dom/Comment.cpp',
@@ -1328,19 +2387,20 @@
             'dom/CompositionEvent.cpp',
             'dom/CompositionEvent.h',
             'dom/ContainerNode.cpp',
-            'dom/ContainerNode.h',
             'dom/ContainerNodeAlgorithms.h',
             'dom/CrossThreadTask.h',
             'dom/CustomEvent.cpp',
             'dom/CustomEvent.h',
+            'dom/DOMAllInOne.cpp',
             'dom/DOMCoreException.h',
             'dom/DOMImplementation.cpp',
-            'dom/DOMImplementation.h',
             'dom/DOMStringList.cpp',
             'dom/DOMStringList.h',
             'dom/DOMStringMap.cpp',
             'dom/DOMStringMap.h',
-            'dom/DOMTimeStamp.h',
+            'dom/DataTransferItem.cpp',
+            'dom/DataTransferItem.h',
+            'dom/DataTransferItems.h',
             'dom/DatasetDOMStringMap.cpp',
             'dom/DatasetDOMStringMap.h',
             'dom/DecodedDataDocumentParser.cpp',
@@ -1353,32 +2413,21 @@
             'dom/DeviceMotionEvent.cpp',
             'dom/DeviceMotionEvent.h',
             'dom/DeviceOrientation.cpp',
-            'dom/DeviceOrientation.h',
-            'dom/DeviceOrientationClient.h',
             'dom/DeviceOrientationController.cpp',
             'dom/DeviceOrientationController.h',
             'dom/DeviceOrientationEvent.cpp',
             'dom/DeviceOrientationEvent.h',
             'dom/Document.cpp',
-            'dom/Document.h',
             'dom/DocumentFragment.cpp',
-            'dom/DocumentFragment.h',
-            'dom/DocumentMarker.h',
             'dom/DocumentMarkerController.cpp',
-            'dom/DocumentMarkerController.h',
             'dom/DocumentOrderedMap.cpp',
-            'dom/DocumentOrderedMap.h',
             'dom/DocumentParser.cpp',
-            'dom/DocumentParser.h',
-            'dom/DocumentTiming.h',
             'dom/DocumentType.cpp',
-            'dom/DocumentType.h',
             'dom/DynamicNodeList.cpp',
             'dom/DynamicNodeList.h',
             'dom/EditingText.cpp',
             'dom/EditingText.h',
             'dom/Element.cpp',
-            'dom/Element.h',
             'dom/ElementRareData.h',
             'dom/Entity.h',
             'dom/EntityReference.cpp',
@@ -1386,56 +2435,42 @@
             'dom/ErrorEvent.cpp',
             'dom/ErrorEvent.h',
             'dom/Event.cpp',
-            'dom/Event.h',
             'dom/EventContext.cpp',
             'dom/EventContext.h',
+            'dom/EventDispatcher.cpp',
+            'dom/EventDispatcher.h',
             'dom/EventException.h',
-            'dom/EventListener.h',
             'dom/EventNames.cpp',
-            'dom/EventNames.h',
             'dom/EventQueue.cpp',
             'dom/EventQueue.h',
             'dom/EventTarget.cpp',
-            'dom/EventTarget.h',
             'dom/ExceptionBase.cpp',
             'dom/ExceptionBase.h',
             'dom/ExceptionCode.cpp',
-            'dom/ExceptionCode.h',
-            'dom/FragmentScriptingPermission.h',
             'dom/HashChangeEvent.h',
             'dom/IgnoreDestructiveWriteCountIncrementer.h',
             'dom/InputElement.cpp',
-            'dom/InputElement.h',
             'dom/KeyboardEvent.cpp',
-            'dom/KeyboardEvent.h',
-            'dom/MappedAttributeEntry.h',
             'dom/MessageChannel.cpp',
             'dom/MessageChannel.h',
             'dom/MessageEvent.cpp',
             'dom/MessageEvent.h',
             'dom/MessagePort.cpp',
-            'dom/MessagePort.h',
             'dom/MessagePortChannel.cpp',
-            'dom/MessagePortChannel.h',
             'dom/MouseEvent.cpp',
-            'dom/MouseEvent.h',
             'dom/MouseRelatedEvent.cpp',
-            'dom/MouseRelatedEvent.h',
             'dom/MutationEvent.cpp',
             'dom/MutationEvent.h',
             'dom/NameNodeList.cpp',
             'dom/NameNodeList.h',
             'dom/NamedNodeMap.cpp',
-            'dom/NamedNodeMap.h',
             'dom/Node.cpp',
-            'dom/Node.h',
             'dom/NodeFilter.cpp',
             'dom/NodeFilter.h',
             'dom/NodeFilterCondition.cpp',
             'dom/NodeFilterCondition.h',
             'dom/NodeIterator.cpp',
             'dom/NodeIterator.h',
-            'dom/NodeList.h',
             'dom/NodeRareData.h',
             'dom/NodeRenderStyle.h',
             'dom/NodeWithIndex.h',
@@ -1450,11 +2485,10 @@
             'dom/PageTransitionEvent.cpp',
             'dom/PageTransitionEvent.h',
             'dom/PendingScript.cpp',
-            'dom/PendingScript.h',
             'dom/PopStateEvent.cpp',
             'dom/PopStateEvent.h',
             'dom/Position.cpp',
-            'dom/Position.h',
+            'dom/PositionCreationFunctions.h',
             'dom/PositionIterator.cpp',
             'dom/PositionIterator.h',
             'dom/ProcessingInstruction.cpp',
@@ -1462,21 +2496,17 @@
             'dom/ProgressEvent.cpp',
             'dom/ProgressEvent.h',
             'dom/QualifiedName.cpp',
-            'dom/QualifiedName.h',
             'dom/Range.cpp',
-            'dom/Range.h',
-            'dom/RangeBoundaryPoint.h',
             'dom/RangeException.h',
             'dom/RawDataDocumentParser.h',
             'dom/RegisteredEventListener.cpp',
-            'dom/RegisteredEventListener.h',
             'dom/RequestAnimationFrameCallback.h',
             'dom/ScopedEventQueue.cpp',
             'dom/ScopedEventQueue.h',
             'dom/ScriptElement.cpp',
             'dom/ScriptElement.h',
             'dom/ScriptExecutionContext.cpp',
-            'dom/ScriptExecutionContext.h',
+            'dom/ScriptRunner.cpp',
             'dom/ScriptableDocumentParser.cpp',
             'dom/ScriptableDocumentParser.h',
             'dom/ScriptedAnimationController.cpp',
@@ -1486,46 +2516,39 @@
             'dom/SelectorNodeList.cpp',
             'dom/SelectorNodeList.h',
             'dom/SpaceSplitString.cpp',
-            'dom/SpaceSplitString.h',
             'dom/StaticHashSetNodeList.cpp',
             'dom/StaticHashSetNodeList.h',
             'dom/StaticNodeList.cpp',
             'dom/StaticNodeList.h',
-            'dom/StaticStringList.cpp',
-            'dom/StaticStringList.h',
+            'dom/StringCallback.cpp',
+            'dom/StringCallback.h',
             'dom/StyleElement.cpp',
             'dom/StyleElement.h',
             'dom/StyledElement.cpp',
-            'dom/StyledElement.h',
             'dom/TagNodeList.cpp',
             'dom/TagNodeList.h',
             'dom/Text.cpp',
-            'dom/Text.h',
             'dom/TextEvent.cpp',
             'dom/TextEvent.h',
-            'dom/TextEventInputType.h',
             'dom/Touch.cpp',
             'dom/Touch.h',
             'dom/TouchEvent.cpp',
+            'dom/TouchEvent.h',
             'dom/TouchList.cpp',
             'dom/TouchList.h',
             'dom/TransformSource.h',
             'dom/TransformSourceLibxslt.cpp',
+            'dom/TransformSourceQt.cpp',
             'dom/Traversal.cpp',
             'dom/Traversal.h',
             'dom/TreeDepthLimit.h',
             'dom/TreeWalker.cpp',
             'dom/TreeWalker.h',
             'dom/UIEvent.cpp',
-            'dom/UIEvent.h',
             'dom/UIEventWithKeyState.cpp',
-            'dom/UIEventWithKeyState.h',
             'dom/UserGestureIndicator.cpp',
-            'dom/UserGestureIndicator.h',
             'dom/UserTypingGestureIndicator.cpp',
-            'dom/UserTypingGestureIndicator.h',
             'dom/ViewportArguments.cpp',
-            'dom/ViewportArguments.h',
             'dom/WebKitAnimationEvent.cpp',
             'dom/WebKitAnimationEvent.h',
             'dom/WebKitTransitionEvent.cpp',
@@ -1535,7 +2558,6 @@
             'dom/WindowEventContext.cpp',
             'dom/WindowEventContext.h',
             'dom/XMLDocumentParser.cpp',
-            'dom/XMLDocumentParser.h',
             'dom/XMLDocumentParserLibxml2.cpp',
             'dom/XMLDocumentParserQt.cpp',
             'dom/XMLDocumentParserScope.cpp',
@@ -1545,14 +2567,11 @@
             'editing/AppendNodeCommand.cpp',
             'editing/AppendNodeCommand.h',
             'editing/ApplyBlockElementCommand.cpp',
-            'editing/ApplyBlockElementCommand.h',
             'editing/ApplyStyleCommand.cpp',
             'editing/ApplyStyleCommand.h',
             'editing/BreakBlockquoteCommand.cpp',
             'editing/BreakBlockquoteCommand.h',
             'editing/CompositeEditCommand.cpp',
-            'editing/CompositeEditCommand.h',
-            'editing/CorrectionPanelInfo.h',
             'editing/CreateLinkCommand.cpp',
             'editing/CreateLinkCommand.h',
             'editing/DeleteButton.cpp',
@@ -1562,25 +2581,14 @@
             'editing/DeleteFromTextNodeCommand.cpp',
             'editing/DeleteFromTextNodeCommand.h',
             'editing/DeleteSelectionCommand.cpp',
-            'editing/DeleteSelectionCommand.h',
-            'editing/EditAction.h',
             'editing/EditCommand.cpp',
-            'editing/EditCommand.h',
-            'editing/EditingBehavior.h',
-            'editing/EditingBehaviorTypes.h',
-            'editing/EditingBoundary.h',
+            'editing/EditingAllInOne.cpp',
             'editing/EditingStyle.cpp',
-            'editing/EditingStyle.h',
             'editing/Editor.cpp',
-            'editing/Editor.h',
             'editing/EditorCommand.cpp',
-            'editing/EditorDeleteAction.h',
-            'editing/EditorInsertAction.h',
-            'editing/FindOptions.h',
             'editing/FormatBlockCommand.cpp',
             'editing/FormatBlockCommand.h',
             'editing/HTMLInterchange.cpp',
-            'editing/HTMLInterchange.h',
             'editing/IndentOutdentCommand.cpp',
             'editing/IndentOutdentCommand.h',
             'editing/InsertIntoTextNodeCommand.cpp',
@@ -1604,7 +2612,6 @@
             'editing/ModifySelectionListLevel.cpp',
             'editing/ModifySelectionListLevel.h',
             'editing/MoveSelectionCommand.cpp',
-            'editing/MoveSelectionCommand.h',
             'editing/RemoveCSSPropertyCommand.cpp',
             'editing/RemoveCSSPropertyCommand.h',
             'editing/RemoveFormatCommand.cpp',
@@ -1616,51 +2623,46 @@
             'editing/ReplaceNodeWithSpanCommand.cpp',
             'editing/ReplaceNodeWithSpanCommand.h',
             'editing/ReplaceSelectionCommand.cpp',
-            'editing/ReplaceSelectionCommand.h',
             'editing/SelectionController.cpp',
-            'editing/SelectionController.h',
             'editing/SetNodeAttributeCommand.cpp',
             'editing/SetNodeAttributeCommand.h',
+            'editing/SetSelectionCommand.cpp',
+            'editing/SetSelectionCommand.h',
             'editing/SmartReplace.cpp',
-            'editing/SmartReplace.h',
             'editing/SmartReplaceCF.cpp',
             'editing/SmartReplaceICU.cpp',
             'editing/SpellChecker.cpp',
-            'editing/SpellChecker.h',
+            'editing/SpellingCorrectionCommand.cpp',
+            'editing/SpellingCorrectionCommand.h',
             'editing/SplitElementCommand.cpp',
             'editing/SplitElementCommand.h',
             'editing/SplitTextNodeCommand.cpp',
             'editing/SplitTextNodeCommand.h',
             'editing/SplitTextNodeContainingElementCommand.cpp',
             'editing/SplitTextNodeContainingElementCommand.h',
-            'editing/TextAffinity.h',
             'editing/TextCheckingHelper.cpp',
             'editing/TextCheckingHelper.h',
-            'editing/TextGranularity.h',
             'editing/TextIterator.cpp',
-            'editing/TextIterator.h',
             'editing/TypingCommand.cpp',
-            'editing/TypingCommand.h',
             'editing/UnlinkCommand.cpp',
             'editing/UnlinkCommand.h',
             'editing/VisiblePosition.cpp',
-            'editing/VisiblePosition.h',
             'editing/VisibleSelection.cpp',
-            'editing/VisibleSelection.h',
             'editing/WrapContentsInDummySpanCommand.cpp',
             'editing/WrapContentsInDummySpanCommand.h',
             'editing/android/EditorAndroid.cpp',
+            'editing/brew/EditorBrew.cpp',
             'editing/chromium/EditorChromium.cpp',
             'editing/chromium/SelectionControllerChromium.cpp',
+            'editing/gtk/SelectionControllerGtk.cpp',
+            'editing/haiku/EditorHaiku.cpp',
             'editing/htmlediting.cpp',
-            'editing/htmlediting.h',
             'editing/mac/EditorMac.mm',
             'editing/mac/SelectionControllerMac.mm',
             'editing/markup.cpp',
-            'editing/markup.h',
             'editing/qt/EditorQt.cpp',
+            'editing/qt/SmartReplaceQt.cpp',
             'editing/visible_units.cpp',
-            'editing/visible_units.h',
             'editing/wx/EditorWx.cpp',
             'fileapi/AsyncFileWriter.h',
             'fileapi/AsyncFileWriterClient.h',
@@ -1735,6 +2737,7 @@
             'fileapi/FileWriterSync.cpp',
             'fileapi/FileWriterSync.h',
             'fileapi/Flags.h',
+            'fileapi/LocalFileSystem.cpp',
             'fileapi/LocalFileSystem.h',
             'fileapi/Metadata.h',
             'fileapi/MetadataCallback.h',
@@ -1742,20 +2745,16 @@
             'fileapi/ThreadableBlobRegistry.cpp',
             'fileapi/ThreadableBlobRegistry.h',
             'history/BackForwardController.cpp',
-            'history/BackForwardController.h',
-            'history/BackForwardList.h',
             'history/BackForwardListImpl.cpp',
-            'history/BackForwardListImpl.h',
             'history/CachedFrame.cpp',
-            'history/CachedFrame.h',
-            'history/CachedFramePlatformData.h',
             'history/CachedPage.cpp',
-            'history/CachedPage.h',
             'history/HistoryItem.cpp',
-            'history/HistoryItem.h',
             'history/PageCache.cpp',
-            'history/PageCache.h',
+            'history/android/AndroidWebHistoryBridge.h',
+            'history/android/HistoryItemAndroid.cpp',
+            'history/cf/HistoryPropertyList.cpp',
             'history/mac/HistoryItemMac.mm',
+            'history/qt/HistoryItemQt.cpp',
             'html/AsyncImageResizer.cpp',
             'html/AsyncImageResizer.h',
             'html/BaseButtonInputType.cpp',
@@ -1773,8 +2772,6 @@
             'html/ClassList.cpp',
             'html/ClassList.h',
             'html/CollectionCache.cpp',
-            'html/CollectionCache.h',
-            'html/CollectionType.h',
             'html/ColorInputType.cpp',
             'html/ColorInputType.h',
             'html/DOMDataGridDataSource.cpp',
@@ -1791,8 +2788,8 @@
             'html/DataGridColumn.h',
             'html/DataGridColumnList.cpp',
             'html/DataGridColumnList.h',
+            'html/DataGridDataSource.h',
             'html/DateComponents.cpp',
-            'html/DateComponents.h',
             'html/DateInputType.cpp',
             'html/DateInputType.h',
             'html/DateTimeInputType.cpp',
@@ -1806,7 +2803,6 @@
             'html/FileInputType.cpp',
             'html/FileInputType.h',
             'html/FormAssociatedElement.cpp',
-            'html/FormAssociatedElement.h',
             'html/FormDataList.cpp',
             'html/FormDataList.h',
             'html/HTMLAllCollection.cpp',
@@ -1814,7 +2810,6 @@
             'html/HTMLAnchorElement.cpp',
             'html/HTMLAnchorElement.h',
             'html/HTMLAppletElement.cpp',
-            'html/HTMLAppletElement.h',
             'html/HTMLAreaElement.cpp',
             'html/HTMLAreaElement.h',
             'html/HTMLAudioElement.cpp',
@@ -1834,7 +2829,6 @@
             'html/HTMLCanvasElement.cpp',
             'html/HTMLCanvasElement.h',
             'html/HTMLCollection.cpp',
-            'html/HTMLCollection.h',
             'html/HTMLDListElement.cpp',
             'html/HTMLDListElement.h',
             'html/HTMLDataGridCellElement.cpp',
@@ -1842,7 +2836,6 @@
             'html/HTMLDataGridColElement.cpp',
             'html/HTMLDataGridColElement.h',
             'html/HTMLDataGridElement.cpp',
-            'html/HTMLDataGridElement.h',
             'html/HTMLDataGridRowElement.cpp',
             'html/HTMLDataGridRowElement.h',
             'html/HTMLDataListElement.cpp',
@@ -1854,9 +2847,8 @@
             'html/HTMLDivElement.cpp',
             'html/HTMLDivElement.h',
             'html/HTMLDocument.cpp',
-            'html/HTMLDocument.h',
             'html/HTMLElement.cpp',
-            'html/HTMLElement.h',
+            'html/HTMLElementsAllInOne.cpp',
             'html/HTMLEmbedElement.cpp',
             'html/HTMLEmbedElement.h',
             'html/HTMLFieldSetElement.cpp',
@@ -1866,33 +2858,25 @@
             'html/HTMLFormCollection.cpp',
             'html/HTMLFormCollection.h',
             'html/HTMLFormControlElement.cpp',
-            'html/HTMLFormControlElement.h',
             'html/HTMLFormElement.cpp',
-            'html/HTMLFormElement.h',
             'html/HTMLFrameElement.cpp',
-            'html/HTMLFrameElement.h',
             'html/HTMLFrameElementBase.cpp',
-            'html/HTMLFrameElementBase.h',
             'html/HTMLFrameOwnerElement.cpp',
-            'html/HTMLFrameOwnerElement.h',
             'html/HTMLFrameSetElement.cpp',
             'html/HTMLFrameSetElement.h',
             'html/HTMLHRElement.cpp',
             'html/HTMLHRElement.h',
             'html/HTMLHeadElement.cpp',
-            'html/HTMLHeadElement.h',
             'html/HTMLHeadingElement.cpp',
             'html/HTMLHeadingElement.h',
             'html/HTMLHtmlElement.cpp',
             'html/HTMLHtmlElement.h',
             'html/HTMLIFrameElement.cpp',
-            'html/HTMLIFrameElement.h',
             'html/HTMLImageElement.cpp',
             'html/HTMLImageElement.h',
             'html/HTMLImageLoader.cpp',
             'html/HTMLImageLoader.h',
             'html/HTMLInputElement.cpp',
-            'html/HTMLInputElement.h',
             'html/HTMLIsIndexElement.cpp',
             'html/HTMLIsIndexElement.h',
             'html/HTMLKeygenElement.cpp',
@@ -1910,7 +2894,6 @@
             'html/HTMLMarqueeElement.cpp',
             'html/HTMLMarqueeElement.h',
             'html/HTMLMediaElement.cpp',
-            'html/HTMLMediaElement.h',
             'html/HTMLMenuElement.cpp',
             'html/HTMLMenuElement.h',
             'html/HTMLMetaElement.cpp',
@@ -1921,6 +2904,8 @@
             'html/HTMLModElement.h',
             'html/HTMLNameCollection.cpp',
             'html/HTMLNameCollection.h',
+            'html/HTMLNoScriptElement.cpp',
+            'html/HTMLNoScriptElement.h',
             'html/HTMLOListElement.cpp',
             'html/HTMLOListElement.h',
             'html/HTMLObjectElement.cpp',
@@ -1940,9 +2925,7 @@
             'html/HTMLParserErrorCodes.cpp',
             'html/HTMLParserErrorCodes.h',
             'html/HTMLPlugInElement.cpp',
-            'html/HTMLPlugInElement.h',
             'html/HTMLPlugInImageElement.cpp',
-            'html/HTMLPlugInImageElement.h',
             'html/HTMLPreElement.cpp',
             'html/HTMLPreElement.h',
             'html/HTMLProgressElement.cpp',
@@ -1962,13 +2945,11 @@
             'html/HTMLTableCaptionElement.cpp',
             'html/HTMLTableCaptionElement.h',
             'html/HTMLTableCellElement.cpp',
-            'html/HTMLTableCellElement.h',
             'html/HTMLTableColElement.cpp',
             'html/HTMLTableColElement.h',
             'html/HTMLTableElement.cpp',
             'html/HTMLTableElement.h',
             'html/HTMLTablePartElement.cpp',
-            'html/HTMLTablePartElement.h',
             'html/HTMLTableRowElement.cpp',
             'html/HTMLTableRowElement.h',
             'html/HTMLTableRowsCollection.cpp',
@@ -1976,7 +2957,6 @@
             'html/HTMLTableSectionElement.cpp',
             'html/HTMLTableSectionElement.h',
             'html/HTMLTextAreaElement.cpp',
-            'html/HTMLTextAreaElement.h',
             'html/HTMLTitleElement.cpp',
             'html/HTMLTitleElement.h',
             'html/HTMLUListElement.cpp',
@@ -1996,7 +2976,6 @@
             'html/ImageResizerThread.cpp',
             'html/ImageResizerThread.h',
             'html/InputType.cpp',
-            'html/InputType.h',
             'html/IsIndexInputType.cpp',
             'html/IsIndexInputType.h',
             'html/LabelsNodeList.cpp',
@@ -2043,7 +3022,6 @@
             'html/ValidationMessage.h',
             'html/ValidityState.cpp',
             'html/ValidityState.h',
-            'html/VoidCallback.h',
             'html/WeekInputType.cpp',
             'html/WeekInputType.h',
             'html/canvas/ArrayBuffer.cpp',
@@ -2089,6 +3067,7 @@
             'html/canvas/Uint32Array.h',
             'html/canvas/Uint8Array.cpp',
             'html/canvas/Uint8Array.h',
+            'html/canvas/WebGLActiveInfo.h',
             'html/canvas/WebGLBuffer.cpp',
             'html/canvas/WebGLBuffer.h',
             'html/canvas/WebGLContextAttributes.cpp',
@@ -2131,13 +3110,13 @@
             'html/parser/HTMLEntityParser.h',
             'html/parser/HTMLEntitySearch.cpp',
             'html/parser/HTMLEntitySearch.h',
+            'html/parser/HTMLEntityTable.h',
             'html/parser/HTMLFormattingElementList.cpp',
             'html/parser/HTMLFormattingElementList.h',
             'html/parser/HTMLInputStream.h',
             'html/parser/HTMLMetaCharsetParser.cpp',
             'html/parser/HTMLMetaCharsetParser.h',
             'html/parser/HTMLParserIdioms.cpp',
-            'html/parser/HTMLParserIdioms.h',
             'html/parser/HTMLParserScheduler.cpp',
             'html/parser/HTMLParserScheduler.h',
             'html/parser/HTMLPreloadScanner.cpp',
@@ -2168,14 +3147,47 @@
             'html/shadow/SliderThumbElement.h',
             'html/shadow/TextControlInnerElements.cpp',
             'html/shadow/TextControlInnerElements.h',
+            'icu/unicode/parseerr.h',
+            'icu/unicode/platform.h',
+            'icu/unicode/putil.h',
+            'icu/unicode/ubrk.h',
+            'icu/unicode/uchar.h',
+            'icu/unicode/ucnv.h',
+            'icu/unicode/ucnv_cb.h',
+            'icu/unicode/ucnv_err.h',
+            'icu/unicode/ucol.h',
+            'icu/unicode/ucoleitr.h',
+            'icu/unicode/uconfig.h',
+            'icu/unicode/ucsdet.h',
+            'icu/unicode/uenum.h',
+            'icu/unicode/uidna.h',
+            'icu/unicode/uiter.h',
+            'icu/unicode/uloc.h',
+            'icu/unicode/umachine.h',
+            'icu/unicode/unorm.h',
+            'icu/unicode/urename.h',
+            'icu/unicode/uscript.h',
+            'icu/unicode/usearch.h',
+            'icu/unicode/uset.h',
+            'icu/unicode/ushape.h',
+            'icu/unicode/ustring.h',
+            'icu/unicode/utf.h',
+            'icu/unicode/utf16.h',
+            'icu/unicode/utf8.h',
+            'icu/unicode/utf_old.h',
+            'icu/unicode/utypes.h',
+            'icu/unicode/uversion.h',
             'inspector/ConsoleMessage.cpp',
             'inspector/ConsoleMessage.h',
+            'inspector/DOMNodeHighlighter.cpp',
+            'inspector/DOMNodeHighlighter.h',
             'inspector/InjectedScript.cpp',
             'inspector/InjectedScript.h',
             'inspector/InjectedScriptHost.cpp',
             'inspector/InjectedScriptHost.h',
+            'inspector/InjectedScriptManager.cpp',
+            'inspector/InjectedScriptManager.h',
             'inspector/InspectorAgent.cpp',
-            'inspector/InspectorAgent.h',
             'inspector/InspectorApplicationCacheAgent.cpp',
             'inspector/InspectorApplicationCacheAgent.h',
             'inspector/InspectorBrowserDebuggerAgent.cpp',
@@ -2183,14 +3195,11 @@
             'inspector/InspectorCSSAgent.cpp',
             'inspector/InspectorCSSAgent.h',
             'inspector/InspectorClient.cpp',
-            'inspector/InspectorClient.h',
             'inspector/InspectorConsoleAgent.cpp',
             'inspector/InspectorConsoleAgent.h',
             'inspector/InspectorConsoleInstrumentation.h',
             'inspector/InspectorController.cpp',
-            'inspector/InspectorController.h',
             'inspector/InspectorDOMAgent.cpp',
-            'inspector/InspectorDOMAgent.h',
             'inspector/InspectorDOMStorageAgent.cpp',
             'inspector/InspectorDOMStorageAgent.h',
             'inspector/InspectorDOMStorageResource.cpp',
@@ -2202,11 +3211,13 @@
             'inspector/InspectorDatabaseResource.h',
             'inspector/InspectorDebuggerAgent.cpp',
             'inspector/InspectorDebuggerAgent.h',
-            'inspector/InspectorFrontendClient.h',
+            'inspector/InspectorFrontendClientLocal.cpp',
             'inspector/InspectorFrontendHost.cpp',
             'inspector/InspectorFrontendHost.h',
             'inspector/InspectorInstrumentation.cpp',
             'inspector/InspectorInstrumentation.h',
+            'inspector/InspectorPageAgent.cpp',
+            'inspector/InspectorPageAgent.h',
             'inspector/InspectorProfilerAgent.cpp',
             'inspector/InspectorProfilerAgent.h',
             'inspector/InspectorResourceAgent.cpp',
@@ -2220,94 +3231,66 @@
             'inspector/InspectorTimelineAgent.cpp',
             'inspector/InspectorTimelineAgent.h',
             'inspector/InspectorValues.cpp',
-            'inspector/InspectorValues.h',
             'inspector/InspectorWorkerResource.h',
             'inspector/InstrumentingAgents.h',
+            'inspector/PageDebuggerAgent.cpp',
+            'inspector/PageDebuggerAgent.h',
             'inspector/ScriptArguments.cpp',
             'inspector/ScriptArguments.h',
-            'inspector/ScriptBreakpoint.h',
             'inspector/ScriptCallFrame.cpp',
             'inspector/ScriptCallFrame.h',
             'inspector/ScriptCallStack.cpp',
             'inspector/ScriptCallStack.h',
-            'inspector/ScriptDebugListener.h',
             'inspector/ScriptGCEventListener.h',
             'inspector/TimelineRecordFactory.cpp',
             'inspector/TimelineRecordFactory.h',
+            'inspector/WorkerDebuggerAgent.cpp',
+            'inspector/WorkerDebuggerAgent.h',
             'loader/CachedMetadata.h',
             'loader/CrossOriginAccessControl.cpp',
             'loader/CrossOriginAccessControl.h',
             'loader/CrossOriginPreflightResultCache.cpp',
-            'loader/CrossOriginPreflightResultCache.h',
-            'loader/DocumentLoadTiming.h',
             'loader/DocumentLoader.cpp',
-            'loader/DocumentLoader.h',
             'loader/DocumentThreadableLoader.cpp',
             'loader/DocumentThreadableLoader.h',
             'loader/DocumentThreadableLoaderClient.h',
             'loader/DocumentWriter.cpp',
-            'loader/DocumentWriter.h',
             'loader/EmptyClients.h',
             'loader/FTPDirectoryParser.cpp',
             'loader/FTPDirectoryParser.h',
             'loader/FormState.cpp',
-            'loader/FormState.h',
             'loader/FormSubmission.cpp',
-            'loader/FormSubmission.h',
             'loader/FrameLoader.cpp',
-            'loader/FrameLoader.h',
-            'loader/FrameLoaderClient.h',
             'loader/FrameLoaderStateMachine.cpp',
-            'loader/FrameLoaderStateMachine.h',
-            'loader/FrameLoaderTypes.h',
-            'loader/FrameNetworkingContext.h',
             'loader/HistoryController.cpp',
-            'loader/HistoryController.h',
             'loader/ImageLoader.cpp',
             'loader/ImageLoader.h',
             'loader/MainResourceLoader.cpp',
             'loader/MainResourceLoader.h',
             'loader/NavigationAction.cpp',
-            'loader/NavigationAction.h',
             'loader/NavigationScheduler.cpp',
-            'loader/NavigationScheduler.h',
             'loader/NetscapePlugInStreamLoader.cpp',
-            'loader/NetscapePlugInStreamLoader.h',
             'loader/PingLoader.cpp',
             'loader/PingLoader.h',
             'loader/PlaceholderDocument.cpp',
             'loader/PlaceholderDocument.h',
             'loader/PolicyCallback.cpp',
-            'loader/PolicyCallback.h',
             'loader/PolicyChecker.cpp',
-            'loader/PolicyChecker.h',
             'loader/ProgressTracker.cpp',
-            'loader/ProgressTracker.h',
             'loader/ResourceLoadNotifier.cpp',
-            'loader/ResourceLoadNotifier.h',
             'loader/ResourceLoadScheduler.cpp',
-            'loader/ResourceLoadScheduler.h',
             'loader/ResourceLoader.cpp',
-            'loader/ResourceLoader.h',
             'loader/SinkDocument.cpp',
             'loader/SinkDocument.h',
             'loader/SubframeLoader.cpp',
-            'loader/SubframeLoader.h',
             'loader/SubresourceLoader.cpp',
-            'loader/SubresourceLoader.h',
-            'loader/SubresourceLoaderClient.h',
-            'loader/SubstituteData.h',
-            'loader/SubstituteResource.h',
             'loader/TextResourceDecoder.cpp',
-            'loader/TextResourceDecoder.h',
             'loader/ThreadableLoader.cpp',
-            'loader/ThreadableLoader.h',
             'loader/ThreadableLoaderClient.h',
             'loader/ThreadableLoaderClientWrapper.h',
             'loader/WorkerThreadableLoader.cpp',
             'loader/WorkerThreadableLoader.h',
             'loader/appcache/ApplicationCache.cpp',
-            'loader/appcache/ApplicationCache.h',
             'loader/appcache/ApplicationCacheGroup.cpp',
             'loader/appcache/ApplicationCacheGroup.h',
             'loader/appcache/ApplicationCacheHost.cpp',
@@ -2315,57 +3298,44 @@
             'loader/appcache/ApplicationCacheResource.cpp',
             'loader/appcache/ApplicationCacheResource.h',
             'loader/appcache/ApplicationCacheStorage.cpp',
-            'loader/appcache/ApplicationCacheStorage.h',
             'loader/appcache/DOMApplicationCache.cpp',
             'loader/appcache/DOMApplicationCache.h',
             'loader/appcache/ManifestParser.cpp',
             'loader/appcache/ManifestParser.h',
-            'loader/archive/Archive.h',
             'loader/archive/ArchiveFactory.cpp',
             'loader/archive/ArchiveFactory.h',
             'loader/archive/ArchiveResource.cpp',
-            'loader/archive/ArchiveResource.h',
             'loader/archive/ArchiveResourceCollection.cpp',
             'loader/archive/ArchiveResourceCollection.h',
             'loader/archive/cf/LegacyWebArchive.cpp',
-            'loader/archive/cf/LegacyWebArchive.h',
             'loader/archive/cf/LegacyWebArchiveMac.mm',
-            'loader/cache/CachePolicy.h',
             'loader/cache/CachedCSSStyleSheet.cpp',
             'loader/cache/CachedCSSStyleSheet.h',
             'loader/cache/CachedFont.cpp',
             'loader/cache/CachedFont.h',
             'loader/cache/CachedImage.cpp',
-            'loader/cache/CachedImage.h',
             'loader/cache/CachedResource.cpp',
-            'loader/cache/CachedResource.h',
-            'loader/cache/CachedResourceClient.h',
             'loader/cache/CachedResourceClientWalker.cpp',
             'loader/cache/CachedResourceClientWalker.h',
             'loader/cache/CachedResourceHandle.cpp',
-            'loader/cache/CachedResourceHandle.h',
             'loader/cache/CachedResourceLoader.cpp',
-            'loader/cache/CachedResourceLoader.h',
             'loader/cache/CachedResourceRequest.cpp',
-            'loader/cache/CachedResourceRequest.h',
             'loader/cache/CachedScript.cpp',
             'loader/cache/CachedScript.h',
             'loader/cache/CachedXSLStyleSheet.cpp',
             'loader/cache/CachedXSLStyleSheet.h',
             'loader/cache/MemoryCache.cpp',
-            'loader/cache/MemoryCache.h',
+            'loader/cf/ResourceLoaderCFNet.cpp',
             'loader/icon/IconDatabase.cpp',
-            'loader/icon/IconDatabase.h',
-            'loader/icon/IconDatabaseClient.h',
-            'loader/icon/IconDatabaseNone.cpp',
+            'loader/icon/IconDatabaseBase.cpp',
             'loader/icon/IconLoader.cpp',
             'loader/icon/IconLoader.h',
             'loader/icon/IconRecord.cpp',
             'loader/icon/IconRecord.h',
             'loader/icon/PageURLRecord.cpp',
             'loader/icon/PageURLRecord.h',
+            'loader/icon/wince/IconDatabaseWinCE.cpp',
             'loader/mac/DocumentLoaderMac.cpp',
-            'loader/mac/LoaderNSURLExtras.h',
             'loader/mac/LoaderNSURLExtras.mm',
             'loader/mac/ResourceLoaderMac.mm',
             'loader/win/DocumentLoaderWin.cpp',
@@ -2383,19 +3353,12 @@
             'notifications/NotificationCenter.cpp',
             'notifications/NotificationCenter.h',
             'notifications/NotificationContents.h',
-            'notifications/NotificationPresenter.h',
             'page/BarInfo.cpp',
             'page/BarInfo.h',
             'page/Chrome.cpp',
-            'page/Chrome.h',
-            'page/ChromeClient.h',
             'page/Console.cpp',
-            'page/Console.h',
             'page/ContentSecurityPolicy.cpp',
-            'page/ContentSecurityPolicy.h',
-            'page/ContextMenuClient.h',
             'page/ContextMenuController.cpp',
-            'page/ContextMenuController.h',
             'page/ContextMenuProvider.h',
             'page/Crypto.cpp',
             'page/Crypto.h',
@@ -2404,47 +3367,25 @@
             'page/DOMTimer.cpp',
             'page/DOMTimer.h',
             'page/DOMWindow.cpp',
-            'page/DOMWindow.h',
-            'page/DragActions.h',
-            'page/DragClient.h',
             'page/DragController.cpp',
-            'page/DragController.h',
-            'page/EditorClient.h',
             'page/EventHandler.cpp',
-            'page/EventHandler.h',
             'page/EventSource.cpp',
             'page/EventSource.h',
             'page/FocusController.cpp',
-            'page/FocusController.h',
-            'page/FocusDirection.h',
             'page/Frame.cpp',
-            'page/Frame.h',
             'page/FrameActionScheduler.cpp',
             'page/FrameActionScheduler.h',
-            'page/FrameLoadRequest.h',
             'page/FrameTree.cpp',
-            'page/FrameTree.h',
             'page/FrameView.cpp',
-            'page/FrameView.h',
             'page/Geolocation.cpp',
-            'page/Geolocation.h',
-            'page/GeolocationClient.h',
             'page/GeolocationController.cpp',
-            'page/GeolocationController.h',
-            'page/GeolocationError.h',
-            'page/GeolocationPosition.h',
             'page/GeolocationPositionCache.cpp',
-            'page/GeolocationPositionCache.h',
-            'page/Geoposition.h',
             'page/GroupSettings.cpp',
-            'page/GroupSettings.h',
-            'page/HaltablePlugin.h',
             'page/History.cpp',
             'page/History.h',
             'page/Location.cpp',
             'page/Location.h',
             'page/MemoryInfo.cpp',
-            'page/MemoryInfo.h',
             'page/MouseEventWithHitTestResults.cpp',
             'page/MouseEventWithHitTestResults.h',
             'page/Navigator.cpp',
@@ -2454,9 +3395,7 @@
             'page/OriginAccessEntry.cpp',
             'page/OriginAccessEntry.h',
             'page/Page.cpp',
-            'page/Page.h',
             'page/PageGroup.cpp',
-            'page/PageGroup.h',
             'page/PageGroupLoadDeferrer.cpp',
             'page/PageGroupLoadDeferrer.h',
             'page/Performance.cpp',
@@ -2467,22 +3406,12 @@
             'page/PerformanceTiming.h',
             'page/PluginHalter.cpp',
             'page/PluginHalter.h',
-            'page/PluginHalterClient.h',
-            'page/PositionCallback.h',
-            'page/PositionError.h',
-            'page/PositionErrorCallback.h',
-            'page/PositionOptions.h',
             'page/PrintContext.cpp',
-            'page/PrintContext.h',
             'page/Screen.cpp',
             'page/Screen.h',
             'page/SecurityOrigin.cpp',
-            'page/SecurityOrigin.h',
-            'page/SecurityOriginHash.h',
             'page/Settings.cpp',
-            'page/Settings.h',
             'page/SpatialNavigation.cpp',
-            'page/SpatialNavigation.h',
             'page/SpeechInput.cpp',
             'page/SpeechInput.h',
             'page/SpeechInputClient.h',
@@ -2495,22 +3424,20 @@
             'page/SpeechInputResultList.h',
             'page/SuspendableTimer.cpp',
             'page/SuspendableTimer.h',
-            'page/UserContentTypes.h',
             'page/UserContentURLPattern.cpp',
-            'page/UserContentURLPattern.h',
-            'page/UserScript.h',
-            'page/UserScriptTypes.h',
-            'page/UserStyleSheet.h',
-            'page/UserStyleSheetTypes.h',
+            'page/WebKitAnimation.cpp',
+            'page/WebKitAnimation.h',
+            'page/WebKitAnimationList.cpp',
+            'page/WebKitAnimationList.h',
             'page/WebKitPoint.h',
             'page/WindowFeatures.cpp',
-            'page/WindowFeatures.h',
             'page/WorkerNavigator.cpp',
             'page/WorkerNavigator.h',
+            'page/android/DragControllerAndroid.cpp',
+            'page/android/EventHandlerAndroid.cpp',
             'page/animation/AnimationBase.cpp',
             'page/animation/AnimationBase.h',
             'page/animation/AnimationController.cpp',
-            'page/animation/AnimationController.h',
             'page/animation/AnimationControllerPrivate.h',
             'page/animation/CompositeAnimation.cpp',
             'page/animation/CompositeAnimation.h',
@@ -2518,24 +3445,29 @@
             'page/animation/ImplicitAnimation.h',
             'page/animation/KeyframeAnimation.cpp',
             'page/animation/KeyframeAnimation.h',
+            'page/brew/ChromeClientBrew.h',
+            'page/brew/DragControllerBrew.cpp',
+            'page/brew/EventHandlerBrew.cpp',
+            'page/brew/FrameBrew.cpp',
             'page/chromium/ChromeClientChromium.h',
             'page/chromium/DragControllerChromium.cpp',
             'page/chromium/EventHandlerChromium.cpp',
             'page/chromium/FrameChromium.cpp',
+            'page/efl/DragControllerEfl.cpp',
+            'page/efl/EventHandlerEfl.cpp',
+            'page/efl/FrameEfl.cpp',
             'page/gtk/DragControllerGtk.cpp',
             'page/gtk/EventHandlerGtk.cpp',
             'page/gtk/FrameGtk.cpp',
+            'page/haiku/DragControllerHaiku.cpp',
+            'page/haiku/EventHandlerHaiku.cpp',
+            'page/haiku/FrameHaiku.cpp',
             'page/mac/ChromeMac.mm',
             'page/mac/DragControllerMac.mm',
             'page/mac/EventHandlerMac.mm',
             'page/mac/FrameMac.mm',
             'page/mac/PageMac.cpp',
-            'page/mac/WebCoreFrameView.h',
-            'page/mac/WebCoreKeyboardUIMode.h',
-            'page/mac/WebCoreViewFactory.h',
             'page/mac/WebCoreViewFactory.m',
-            'page/mac/WebDashboardRegion.h',
-            'page/mac/WebDashboardRegion.m',
             'page/qt/DragControllerQt.cpp',
             'page/qt/EventHandlerQt.cpp',
             'page/qt/FrameQt.cpp',
@@ -2545,116 +3477,77 @@
             'page/win/FrameCairoWin.cpp',
             'page/win/FrameWin.cpp',
             'page/win/FrameWin.h',
-            'page/win/PageWin.cpp',
+            'page/wince/FrameWinCE.cpp',
             'page/wx/DragControllerWx.cpp',
             'page/wx/EventHandlerWx.cpp',
+            'page/wx/FrameWx.cpp',
             'platform/Arena.cpp',
             'platform/Arena.h',
-            'platform/AsyncFileStream.h',
             'platform/AsyncFileSystem.cpp',
             'platform/AsyncFileSystem.h',
             'platform/AsyncFileSystemCallbacks.h',
             'platform/AutodrainedPool.h',
             'platform/ContentType.cpp',
             'platform/ContentType.h',
-            'platform/ContextMenu.h',
-            'platform/ContextMenuItem.h',
-            'platform/Cookie.h',
-            'platform/CookieJar.h',
+            'platform/ContextMenu.cpp',
+            'platform/ContextMenuItem.cpp',
             'platform/CrossThreadCopier.cpp',
             'platform/CrossThreadCopier.h',
-            'platform/Cursor.h',
+            'platform/Cursor.cpp',
+            'platform/DefaultLocalizationStrategy.cpp',
             'platform/DragData.cpp',
-            'platform/DragData.h',
             'platform/DragImage.cpp',
-            'platform/DragImage.h',
             'platform/EventLoop.h',
             'platform/FileChooser.cpp',
-            'platform/FileChooser.h',
             'platform/FileMetadata.h',
             'platform/FileStream.cpp',
-            'platform/FileStream.h',
-            'platform/FileStreamClient.h',
             'platform/FileSystem.cpp',
-            'platform/FileSystem.h',
             'platform/FloatConversion.h',
             'platform/GeolocationService.cpp',
             'platform/GeolocationService.h',
-            'platform/HostWindow.h',
+            'platform/HashTools.h',
             'platform/KURL.cpp',
-            'platform/KURL.h',
             'platform/KURLGoogle.cpp',
             'platform/KURLGooglePrivate.h',
-            'platform/KURLHash.h',
             'platform/KillRing.h',
             'platform/KillRingNone.cpp',
             'platform/Language.cpp',
-            'platform/Language.h',
             'platform/Length.cpp',
-            'platform/Length.h',
-            'platform/LengthBox.h',
-            'platform/LengthSize.h',
             'platform/LinkHash.cpp',
-            'platform/LinkHash.h',
-            'platform/LocalizedStrings.h',
+            'platform/LocalizedStrings.cpp',
             'platform/Logging.cpp',
-            'platform/Logging.h',
             'platform/MIMETypeRegistry.cpp',
-            'platform/MIMETypeRegistry.h',
-            'platform/NotImplemented.h',
             'platform/Pasteboard.h',
-            'platform/PlatformKeyboardEvent.h',
-            'platform/PlatformMenuDescription.h',
-            'platform/PlatformMouseEvent.h',
-            'platform/PlatformScreen.h',
-            'platform/PlatformWheelEvent.h',
-            'platform/PopupMenu.h',
-            'platform/PopupMenuClient.h',
-            'platform/PopupMenuStyle.h',
+            'platform/PlatformStrategies.cpp',
+            'platform/PlatformTouchEvent.h',
+            'platform/PlatformTouchPoint.h',
             'platform/PurgeableBuffer.h',
+            'platform/RunLoopTimer.h',
             'platform/SSLKeyGenerator.h',
             'platform/SchemeRegistry.cpp',
-            'platform/SchemeRegistry.h',
             'platform/ScrollAnimator.cpp',
             'platform/ScrollAnimator.h',
             'platform/ScrollAnimatorWin.cpp',
             'platform/ScrollAnimatorWin.h',
-            'platform/ScrollTypes.h',
             'platform/ScrollView.cpp',
-            'platform/ScrollView.h',
             'platform/ScrollableArea.cpp',
-            'platform/ScrollableArea.h',
             'platform/Scrollbar.cpp',
-            'platform/Scrollbar.h',
-            'platform/ScrollbarTheme.h',
             'platform/ScrollbarThemeComposite.cpp',
             'platform/ScrollbarThemeComposite.h',
-            'platform/SearchPopupMenu.h',
             'platform/SecureTextInput.cpp',
             'platform/SecureTextInput.h',
             'platform/SharedBuffer.cpp',
-            'platform/SharedBuffer.h',
             'platform/SharedTimer.h',
             'platform/Sound.h',
-            'platform/StaticConstructors.h',
-            'platform/SystemTime.h',
+            'platform/SuddenTermination.h',
             'platform/Theme.cpp',
-            'platform/Theme.h',
-            'platform/ThemeTypes.h',
-            'platform/ThreadCheck.h',
             'platform/ThreadGlobalData.cpp',
-            'platform/ThreadGlobalData.h',
             'platform/ThreadTimers.cpp',
             'platform/ThreadTimers.h',
             'platform/Timer.cpp',
-            'platform/Timer.h',
-            'platform/TreeShared.h',
-            'platform/URLString.h',
             'platform/UUID.cpp',
             'platform/UUID.h',
             'platform/Widget.cpp',
-            'platform/Widget.h',
-            'platform/WindowsKeyboardCodes.h',
             'platform/android/ClipboardAndroid.cpp',
             'platform/android/ClipboardAndroid.h',
             'platform/android/CursorAndroid.cpp',
@@ -2685,10 +3578,7 @@
             'platform/android/TemporaryLinkStubs.cpp',
             'platform/android/WidgetAndroid.cpp',
             'platform/animation/Animation.cpp',
-            'platform/animation/Animation.h',
             'platform/animation/AnimationList.cpp',
-            'platform/animation/AnimationList.h',
-            'platform/animation/TimingFunction.h',
             'platform/audio/AudioArray.h',
             'platform/audio/AudioBus.cpp',
             'platform/audio/AudioBus.h',
@@ -2742,6 +3632,8 @@
             'platform/audio/ReverbConvolverStage.h',
             'platform/audio/ReverbInputBuffer.cpp',
             'platform/audio/ReverbInputBuffer.h',
+            'platform/audio/SincResampler.cpp',
+            'platform/audio/SincResampler.h',
             'platform/audio/VectorMath.cpp',
             'platform/audio/VectorMath.h',
             'platform/audio/chromium/AudioBusChromium.cpp',
@@ -2787,15 +3679,15 @@
             'platform/brew/TemporaryLinkStubs.cpp',
             'platform/brew/WidgetBrew.cpp',
             'platform/cf/BinaryPropertyList.cpp',
-            'platform/cf/BinaryPropertyList.h',
             'platform/cf/FileSystemCF.cpp',
             'platform/cf/KURLCFNet.cpp',
             'platform/cf/RunLoopTimerCF.cpp',
             'platform/cf/SchedulePair.cpp',
-            'platform/cf/SchedulePair.h',
             'platform/cf/SharedBufferCF.cpp',
             'platform/chromium/ChromiumDataObject.cpp',
             'platform/chromium/ChromiumDataObject.h',
+            'platform/chromium/ChromiumDataObjectLegacy.cpp',
+            'platform/chromium/ChromiumDataObjectLegacy.h',
             'platform/chromium/ClipboardChromium.cpp',
             'platform/chromium/ClipboardChromium.h',
             'platform/chromium/ClipboardChromiumLinux.cpp',
@@ -2808,6 +3700,10 @@
             'platform/chromium/ContextMenuChromium.cpp',
             'platform/chromium/ContextMenuItemChromium.cpp',
             'platform/chromium/CursorChromium.cpp',
+            'platform/chromium/DataTransferItemChromium.cpp',
+            'platform/chromium/DataTransferItemChromium.h',
+            'platform/chromium/DataTransferItemsChromium.cpp',
+            'platform/chromium/DataTransferItemsChromium.h',
             'platform/chromium/DragDataChromium.cpp',
             'platform/chromium/DragDataRef.h',
             'platform/chromium/DragImageChromiumMac.cpp',
@@ -2823,6 +3719,7 @@
             'platform/chromium/FramelessScrollViewClient.h',
             'platform/chromium/KeyCodeConversion.h',
             'platform/chromium/KeyCodeConversionGtk.cpp',
+            'platform/chromium/KeyboardCodes.h',
             'platform/chromium/LanguageChromium.cpp',
             'platform/chromium/LinkHashChromium.cpp',
             'platform/chromium/MIMETypeRegistryChromium.cpp',
@@ -2838,6 +3735,8 @@
             'platform/chromium/PopupMenuChromium.cpp',
             'platform/chromium/PopupMenuChromium.h',
             'platform/chromium/PopupMenuPrivate.h',
+            'platform/chromium/ReadableDataObject.cpp',
+            'platform/chromium/ReadableDataObject.h',
             'platform/chromium/SSLKeyGeneratorChromium.cpp',
             'platform/chromium/ScrollbarThemeChromium.cpp',
             'platform/chromium/ScrollbarThemeChromium.h',
@@ -2857,9 +3756,10 @@
             'platform/chromium/TemporaryLinkStubs.cpp',
             'platform/chromium/ThemeChromiumMac.h',
             'platform/chromium/ThemeChromiumMac.mm',
+            'platform/chromium/TraceEvent.h',
             'platform/chromium/WidgetChromium.cpp',
-            'platform/chromium/WindowsVersion.cpp',
-            'platform/chromium/WindowsVersion.h',
+            'platform/chromium/WritableDataObject.cpp',
+            'platform/chromium/WritableDataObject.h',
             'platform/cocoa/KeyEventCocoa.h',
             'platform/cocoa/KeyEventCocoa.mm',
             'platform/efl/ClipboardEfl.cpp',
@@ -2902,98 +3802,66 @@
             'platform/efl/SystemTimeEfl.cpp',
             'platform/efl/TemporaryLinkStubs.cpp',
             'platform/efl/WidgetEfl.cpp',
+            'platform/graphics/ANGLEWebKitBridge.cpp',
+            'platform/graphics/ANGLEWebKitBridge.h',
             'platform/graphics/BitmapImage.cpp',
-            'platform/graphics/BitmapImage.h',
             'platform/graphics/Color.cpp',
-            'platform/graphics/Color.h',
-            'platform/graphics/DashArray.h',
+            'platform/graphics/ContextShadow.cpp',
+            'platform/graphics/ContextShadow.h',
             'platform/graphics/Extensions3D.h',
             'platform/graphics/FloatPoint.cpp',
-            'platform/graphics/FloatPoint.h',
             'platform/graphics/FloatPoint3D.cpp',
-            'platform/graphics/FloatPoint3D.h',
             'platform/graphics/FloatQuad.cpp',
-            'platform/graphics/FloatQuad.h',
             'platform/graphics/FloatRect.cpp',
-            'platform/graphics/FloatRect.h',
             'platform/graphics/FloatSize.cpp',
-            'platform/graphics/FloatSize.h',
             'platform/graphics/Font.cpp',
-            'platform/graphics/Font.h',
             'platform/graphics/FontCache.cpp',
-            'platform/graphics/FontCache.h',
             'platform/graphics/FontData.cpp',
-            'platform/graphics/FontData.h',
             'platform/graphics/FontDescription.cpp',
-            'platform/graphics/FontDescription.h',
             'platform/graphics/FontFallbackList.cpp',
-            'platform/graphics/FontFallbackList.h',
             'platform/graphics/FontFamily.cpp',
-            'platform/graphics/FontFamily.h',
             'platform/graphics/FontFastPath.cpp',
-            'platform/graphics/FontMetrics.h',
-            'platform/graphics/FontRenderingMode.h',
-            'platform/graphics/FontSelector.h',
-            'platform/graphics/FontSmoothingMode.h',
-            'platform/graphics/FontTraitsMask.h',
+            'platform/graphics/FontPlatformData.cpp',
+            'platform/graphics/FontPlatformData.h',
             'platform/graphics/GeneratedImage.cpp',
             'platform/graphics/GeneratedImage.h',
-            'platform/graphics/Generator.h',
-            'platform/graphics/GlyphBuffer.h',
-            'platform/graphics/GlyphMetricsMap.h',
             'platform/graphics/GlyphPageTreeNode.cpp',
-            'platform/graphics/GlyphPageTreeNode.h',
             'platform/graphics/Gradient.cpp',
-            'platform/graphics/Gradient.h',
             'platform/graphics/GraphicsContext.cpp',
-            'platform/graphics/GraphicsContext.h',
             'platform/graphics/GraphicsContext3D.cpp',
-            'platform/graphics/GraphicsContext3D.h',
-            'platform/graphics/GraphicsContextPrivate.h',
             'platform/graphics/GraphicsLayer.cpp',
-            'platform/graphics/GraphicsLayer.h',
-            'platform/graphics/GraphicsLayerClient.h',
             'platform/graphics/GraphicsTypes.cpp',
-            'platform/graphics/GraphicsTypes.h',
-            'platform/graphics/GraphicsTypes3D.h',
-            'platform/graphics/Icon.h',
             'platform/graphics/Image.cpp',
-            'platform/graphics/Image.h',
             'platform/graphics/ImageBuffer.cpp',
-            'platform/graphics/ImageBuffer.h',
-            'platform/graphics/ImageObserver.h',
             'platform/graphics/ImageSource.cpp',
-            'platform/graphics/ImageSource.h',
-            'platform/graphics/IntPoint.h',
             'platform/graphics/IntRect.cpp',
-            'platform/graphics/IntRect.h',
-            'platform/graphics/IntSize.h',
-            'platform/graphics/IntSizeHash.h',
             'platform/graphics/MediaPlayer.cpp',
-            'platform/graphics/MediaPlayer.cpp',
-            'platform/graphics/MediaPlayer.h',
             'platform/graphics/MediaPlayerPrivate.h',
             'platform/graphics/Path.cpp',
-            'platform/graphics/Path.h',
             'platform/graphics/PathTraversalState.cpp',
             'platform/graphics/PathTraversalState.h',
             'platform/graphics/Pattern.cpp',
-            'platform/graphics/Pattern.h',
             'platform/graphics/RoundedIntRect.cpp',
-            'platform/graphics/RoundedIntRect.h',
             'platform/graphics/SegmentedFontData.cpp',
             'platform/graphics/SegmentedFontData.h',
             'platform/graphics/ShadowBlur.cpp',
             'platform/graphics/ShadowBlur.h',
             'platform/graphics/SimpleFontData.cpp',
-            'platform/graphics/SimpleFontData.h',
             'platform/graphics/StringTruncator.cpp',
-            'platform/graphics/StringTruncator.h',
             'platform/graphics/StrokeStyleApplier.h',
-            'platform/graphics/TextRun.h',
+            'platform/graphics/Tile.h',
+            'platform/graphics/TiledBackingStore.cpp',
+            'platform/graphics/TiledBackingStore.h',
+            'platform/graphics/TiledBackingStoreClient.h',
             'platform/graphics/UnitBezier.h',
+            'platform/graphics/WOFFFileFormat.cpp',
+            'platform/graphics/WOFFFileFormat.h',
             'platform/graphics/WidthIterator.cpp',
             'platform/graphics/WidthIterator.h',
+            'platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.cpp',
+            'platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.h',
+            'platform/graphics/avfoundation/MediaPlayerPrivateAVFoundationObjC.h',
+            'platform/graphics/avfoundation/MediaPlayerPrivateAVFoundationObjC.mm',
             'platform/graphics/brew/IconBrew.cpp',
             'platform/graphics/brew/ImageBrew.cpp',
             'platform/graphics/brew/IntPointBrew.cpp',
@@ -3044,14 +3912,12 @@
             'platform/graphics/cg/FloatPointCG.cpp',
             'platform/graphics/cg/FloatRectCG.cpp',
             'platform/graphics/cg/FloatSizeCG.cpp',
-            'platform/graphics/cg/FontPlatformData.h',
             'platform/graphics/cg/GradientCG.cpp',
             'platform/graphics/cg/GraphicsContext3DCG.cpp',
             'platform/graphics/cg/GraphicsContextCG.cpp',
             'platform/graphics/cg/GraphicsContextCG.h',
             'platform/graphics/cg/GraphicsContextPlatformPrivateCG.h',
             'platform/graphics/cg/ImageBufferCG.cpp',
-            'platform/graphics/cg/ImageBufferData.h',
             'platform/graphics/cg/ImageCG.cpp',
             'platform/graphics/cg/ImageSourceCG.cpp',
             'platform/graphics/cg/ImageSourceCG.h',
@@ -3145,11 +4011,16 @@
             'platform/graphics/chromium/VideoLayerChromium.h',
             'platform/graphics/chromium/WebGLLayerChromium.cpp',
             'platform/graphics/chromium/WebGLLayerChromium.h',
+            'platform/graphics/chromium/cc/CCCanvasLayerImpl.cpp',
+            'platform/graphics/chromium/cc/CCCanvasLayerImpl.h',
             'platform/graphics/chromium/cc/CCHeadsUpDisplay.cpp',
             'platform/graphics/chromium/cc/CCHeadsUpDisplay.h',
             'platform/graphics/chromium/cc/CCLayerImpl.cpp',
             'platform/graphics/chromium/cc/CCLayerImpl.h',
-            'platform/graphics/cocoa/FontPlatformData.h',
+            'platform/graphics/chromium/cc/CCPluginLayerImpl.cpp',
+            'platform/graphics/chromium/cc/CCPluginLayerImpl.h',
+            'platform/graphics/chromium/cc/CCVideoLayerImpl.cpp',
+            'platform/graphics/chromium/cc/CCVideoLayerImpl.h',
             'platform/graphics/cocoa/FontPlatformDataCocoa.mm',
             'platform/graphics/efl/FontEfl.cpp',
             'platform/graphics/efl/IconEfl.cpp',
@@ -3203,13 +4074,23 @@
             'platform/graphics/filters/SourceGraphic.h',
             'platform/graphics/filters/SpotLightSource.cpp',
             'platform/graphics/filters/SpotLightSource.h',
+            'platform/graphics/freetype/FontCacheFreeType.cpp',
+            'platform/graphics/freetype/FontCustomPlatformDataFreeType.cpp',
+            'platform/graphics/freetype/FontPlatformData.h',
+            'platform/graphics/freetype/FontPlatformDataFreeType.cpp',
+            'platform/graphics/freetype/GlyphPageTreeNodeFreeType.cpp',
+            'platform/graphics/freetype/SimpleFontDataFreeType.cpp',
+            'platform/graphics/gpu/BicubicShader.cpp',
+            'platform/graphics/gpu/BicubicShader.h',
+            'platform/graphics/gpu/ConvolutionShader.cpp',
+            'platform/graphics/gpu/ConvolutionShader.h',
             'platform/graphics/gpu/DrawingBuffer.cpp',
             'platform/graphics/gpu/DrawingBuffer.h',
-            'platform/graphics/gpu/LoopBLinnLocalTriangulator.h',
             'platform/graphics/gpu/LoopBlinnClassifier.cpp',
             'platform/graphics/gpu/LoopBlinnClassifier.h',
             'platform/graphics/gpu/LoopBlinnConstants.h',
             'platform/graphics/gpu/LoopBlinnLocalTriangulator.cpp',
+            'platform/graphics/gpu/LoopBlinnLocalTriangulator.h',
             'platform/graphics/gpu/LoopBlinnMathUtils.cpp',
             'platform/graphics/gpu/LoopBlinnMathUtils.h',
             'platform/graphics/gpu/LoopBlinnPathCache.cpp',
@@ -3238,6 +4119,30 @@
             'platform/graphics/gpu/Texture.h',
             'platform/graphics/gpu/TilingData.cpp',
             'platform/graphics/gpu/TilingData.h',
+            'platform/graphics/gpu/mac/DrawingBufferMac.mm',
+            'platform/graphics/gpu/qt/DrawingBufferQt.cpp',
+            'platform/graphics/gstreamer/GOwnPtrGStreamer.cpp',
+            'platform/graphics/gstreamer/GOwnPtrGStreamer.h',
+            'platform/graphics/gstreamer/GRefPtrGStreamer.cpp',
+            'platform/graphics/gstreamer/GRefPtrGStreamer.h',
+            'platform/graphics/gstreamer/GStreamerGWorld.cpp',
+            'platform/graphics/gstreamer/GStreamerGWorld.h',
+            'platform/graphics/gstreamer/ImageGStreamer.h',
+            'platform/graphics/gstreamer/ImageGStreamerCG.mm',
+            'platform/graphics/gstreamer/ImageGStreamerCairo.cpp',
+            'platform/graphics/gstreamer/ImageGStreamerQt.cpp',
+            'platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp',
+            'platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h',
+            'platform/graphics/gstreamer/PlatformVideoWindow.h',
+            'platform/graphics/gstreamer/PlatformVideoWindowEfl.cpp',
+            'platform/graphics/gstreamer/PlatformVideoWindowGtk.cpp',
+            'platform/graphics/gstreamer/PlatformVideoWindowMac.mm',
+            'platform/graphics/gstreamer/PlatformVideoWindowPrivate.h',
+            'platform/graphics/gstreamer/PlatformVideoWindowQt.cpp',
+            'platform/graphics/gstreamer/VideoSinkGStreamer.cpp',
+            'platform/graphics/gstreamer/VideoSinkGStreamer.h',
+            'platform/graphics/gstreamer/WebKitWebSourceGStreamer.cpp',
+            'platform/graphics/gstreamer/WebKitWebSourceGStreamer.h',
             'platform/graphics/gtk/ColorGtk.cpp',
             'platform/graphics/gtk/FontGtk.cpp',
             'platform/graphics/gtk/GdkCairoUtilities.cpp',
@@ -3269,7 +4174,6 @@
             'platform/graphics/haiku/SimpleFontDataHaiku.cpp',
             'platform/graphics/haiku/StillImageHaiku.cpp',
             'platform/graphics/haiku/StillImageHaiku.h',
-            'platform/graphics/mac/ColorMac.h',
             'platform/graphics/mac/ColorMac.mm',
             'platform/graphics/mac/ComplexTextController.cpp',
             'platform/graphics/mac/ComplexTextController.h',
@@ -3293,7 +4197,6 @@
             'platform/graphics/mac/IntSizeMac.mm',
             'platform/graphics/mac/MediaPlayerPrivateQTKit.h',
             'platform/graphics/mac/MediaPlayerPrivateQTKit.mm',
-            'platform/graphics/mac/MediaPlayerProxy.h',
             'platform/graphics/mac/SimpleFontDataATSUI.mm',
             'platform/graphics/mac/SimpleFontDataCoreText.cpp',
             'platform/graphics/mac/SimpleFontDataMac.mm',
@@ -3303,10 +4206,38 @@
             'platform/graphics/mac/WebLayer.mm',
             'platform/graphics/mac/WebTiledLayer.h',
             'platform/graphics/mac/WebTiledLayer.mm',
+            'platform/graphics/opengl/Extensions3DOpenGL.cpp',
+            'platform/graphics/opengl/Extensions3DOpenGL.h',
+            'platform/graphics/opengl/GraphicsContext3DOpenGL.cpp',
+            'platform/graphics/opengl/TextureMapperGL.cpp',
+            'platform/graphics/opengl/TextureMapperGL.h',
             'platform/graphics/opentype/OpenTypeSanitizer.cpp',
             'platform/graphics/opentype/OpenTypeSanitizer.h',
             'platform/graphics/opentype/OpenTypeUtilities.cpp',
             'platform/graphics/opentype/OpenTypeUtilities.h',
+            'platform/graphics/openvg/EGLDisplayOpenVG.cpp',
+            'platform/graphics/openvg/EGLDisplayOpenVG.h',
+            'platform/graphics/openvg/EGLUtils.h',
+            'platform/graphics/openvg/GraphicsContextOpenVG.cpp',
+            'platform/graphics/openvg/ImageOpenVG.cpp',
+            'platform/graphics/openvg/PainterOpenVG.cpp',
+            'platform/graphics/openvg/PainterOpenVG.h',
+            'platform/graphics/openvg/PathOpenVG.cpp',
+            'platform/graphics/openvg/PlatformPathOpenVG.h',
+            'platform/graphics/openvg/SharedResourceOpenVG.cpp',
+            'platform/graphics/openvg/SharedResourceOpenVG.h',
+            'platform/graphics/openvg/SurfaceOpenVG.cpp',
+            'platform/graphics/openvg/SurfaceOpenVG.h',
+            'platform/graphics/openvg/TiledImageOpenVG.cpp',
+            'platform/graphics/openvg/TiledImageOpenVG.h',
+            'platform/graphics/openvg/VGUtils.cpp',
+            'platform/graphics/openvg/VGUtils.h',
+            'platform/graphics/pango/FontCachePango.cpp',
+            'platform/graphics/pango/FontCustomPlatformDataPango.cpp',
+            'platform/graphics/pango/FontPlatformData.h',
+            'platform/graphics/pango/FontPlatformDataPango.cpp',
+            'platform/graphics/pango/GlyphPageTreeNodePango.cpp',
+            'platform/graphics/pango/SimpleFontDataPango.cpp',
             'platform/graphics/qt/ColorQt.cpp',
             'platform/graphics/qt/ContextShadowQt.cpp',
             'platform/graphics/qt/Extensions3DQt.cpp',
@@ -3374,8 +4305,13 @@
             'platform/graphics/skia/SkiaUtils.cpp',
             'platform/graphics/skia/SkiaUtils.h',
             'platform/graphics/skia/TransformationMatrixSkia.cpp',
+            'platform/graphics/texmap/GraphicsLayerTextureMapper.cpp',
+            'platform/graphics/texmap/GraphicsLayerTextureMapper.h',
+            'platform/graphics/texmap/TextureMapper.h',
+            'platform/graphics/texmap/TextureMapperNode.cpp',
+            'platform/graphics/texmap/TextureMapperNode.h',
+            'platform/graphics/texmap/TextureMapperPlatformLayer.h',
             'platform/graphics/transforms/AffineTransform.cpp',
-            'platform/graphics/transforms/AffineTransform.h',
             'platform/graphics/transforms/IdentityTransformOperation.h',
             'platform/graphics/transforms/Matrix3DTransformOperation.cpp',
             'platform/graphics/transforms/Matrix3DTransformOperation.h',
@@ -3389,11 +4325,8 @@
             'platform/graphics/transforms/ScaleTransformOperation.h',
             'platform/graphics/transforms/SkewTransformOperation.cpp',
             'platform/graphics/transforms/SkewTransformOperation.h',
-            'platform/graphics/transforms/TransformOperation.h',
             'platform/graphics/transforms/TransformOperations.cpp',
-            'platform/graphics/transforms/TransformOperations.h',
             'platform/graphics/transforms/TransformationMatrix.cpp',
-            'platform/graphics/transforms/TransformationMatrix.h',
             'platform/graphics/transforms/TranslateTransformOperation.cpp',
             'platform/graphics/transforms/TranslateTransformOperation.h',
             'platform/graphics/win/FontCGWin.cpp',
@@ -3542,7 +4475,6 @@
             'platform/gtk/MouseEventGtk.cpp',
             'platform/gtk/PasteboardGtk.cpp',
             'platform/gtk/PasteboardHelper.cpp',
-            'platform/gtk/PasteboardHelper.h',
             'platform/gtk/PlatformScreenGtk.cpp',
             'platform/gtk/PopupMenuGtk.cpp',
             'platform/gtk/PopupMenuGtk.h',
@@ -3614,31 +4546,26 @@
             'platform/image-decoders/ico/ICOImageDecoder.h',
             'platform/image-decoders/jpeg/JPEGImageDecoder.cpp',
             'platform/image-decoders/jpeg/JPEGImageDecoder.h',
+            'platform/image-decoders/openvg/ImageDecoderOpenVG.cpp',
             'platform/image-decoders/png/PNGImageDecoder.cpp',
             'platform/image-decoders/png/PNGImageDecoder.h',
+            'platform/image-decoders/qt/ImageFrameQt.cpp',
             'platform/image-decoders/skia/ImageDecoderSkia.cpp',
             'platform/image-decoders/webp/WEBPImageDecoder.cpp',
             'platform/image-decoders/webp/WEBPImageDecoder.h',
             'platform/image-decoders/wx/ImageDecoderWx.cpp',
-            'platform/image-decoders/zlib/crc32.h',
-            'platform/image-decoders/zlib/deflate.h',
-            'platform/image-decoders/zlib/inffast.h',
-            'platform/image-decoders/zlib/inffixed.h',
-            'platform/image-decoders/zlib/inflate.h',
-            'platform/image-decoders/zlib/inftrees.h',
-            'platform/image-decoders/zlib/mozzconf.h',
-            'platform/image-decoders/zlib/trees.h',
-            'platform/image-decoders/zlib/zconf.h',
-            'platform/image-decoders/zlib/zlib.h',
-            'platform/image-decoders/zlib/zutil.h',
+            'platform/image-encoders/JPEGImageEncoder.cpp',
+            'platform/image-encoders/JPEGImageEncoder.h',
+            'platform/image-encoders/PNGImageEncoder.cpp',
+            'platform/image-encoders/PNGImageEncoder.h',
             'platform/image-encoders/skia/JPEGImageEncoder.cpp',
             'platform/image-encoders/skia/JPEGImageEncoder.h',
             'platform/image-encoders/skia/PNGImageEncoder.cpp',
             'platform/image-encoders/skia/PNGImageEncoder.h',
+            'platform/iphone/KeyEventCodesIPhone.h',
+            'platform/iphone/KeyEventIPhone.mm',
             'platform/mac/AutodrainedPool.mm',
-            'platform/mac/BlockExceptions.h',
             'platform/mac/BlockExceptions.mm',
-            'platform/mac/ClipboardMac.h',
             'platform/mac/ClipboardMac.mm',
             'platform/mac/ContextMenuItemMac.mm',
             'platform/mac/ContextMenuMac.mm',
@@ -3646,11 +4573,11 @@
             'platform/mac/CursorMac.mm',
             'platform/mac/DragDataMac.mm',
             'platform/mac/DragImageMac.mm',
-            'platform/mac/EmptyProtocolDefinitions.h',
             'platform/mac/EventLoopMac.mm',
             'platform/mac/FileChooserMac.mm',
             'platform/mac/FileSystemMac.mm',
-            'platform/mac/FoundationExtras.h',
+            'platform/mac/HTMLConverter.h',
+            'platform/mac/HTMLConverter.mm',
             'platform/mac/KURLMac.mm',
             'platform/mac/KeyEventMac.mm',
             'platform/mac/KillRingMac.mm',
@@ -3664,97 +4591,104 @@
             'platform/mac/PasteboardMac.mm',
             'platform/mac/PlatformMouseEventMac.mm',
             'platform/mac/PlatformScreenMac.mm',
-            'platform/mac/PopupMenuMac.h',
             'platform/mac/PopupMenuMac.mm',
             'platform/mac/PurgeableBufferMac.cpp',
-            'platform/mac/RuntimeApplicationChecks.h',
             'platform/mac/RuntimeApplicationChecks.mm',
-            'platform/mac/SSLKeyGeneratorMac.mm',
+            'platform/mac/SSLKeyGeneratorMac.cpp',
             'platform/mac/SchedulePairMac.mm',
             'platform/mac/ScrollAnimatorMac.h',
             'platform/mac/ScrollAnimatorMac.mm',
             'platform/mac/ScrollViewMac.mm',
             'platform/mac/ScrollbarThemeMac.h',
             'platform/mac/ScrollbarThemeMac.mm',
-            'platform/mac/SearchPopupMenuMac.h',
             'platform/mac/SearchPopupMenuMac.mm',
             'platform/mac/SharedBufferMac.mm',
             'platform/mac/SharedTimerMac.mm',
-            'platform/mac/SoftLinking.h',
             'platform/mac/SoundMac.mm',
             'platform/mac/SuddenTermination.mm',
             'platform/mac/SystemTimeMac.cpp',
             'platform/mac/ThemeMac.h',
             'platform/mac/ThemeMac.mm',
             'platform/mac/ThreadCheck.mm',
-            'platform/mac/WebCoreKeyGenerator.h',
-            'platform/mac/WebCoreKeyGenerator.m',
-            'platform/mac/WebCoreNSStringExtras.h',
             'platform/mac/WebCoreNSStringExtras.mm',
-            'platform/mac/WebCoreObjCExtras.h',
             'platform/mac/WebCoreObjCExtras.mm',
-            'platform/mac/WebCoreSystemInterface.h',
             'platform/mac/WebCoreSystemInterface.mm',
-            'platform/mac/WebCoreView.h',
             'platform/mac/WebCoreView.m',
-            'platform/mac/WebFontCache.h',
             'platform/mac/WebFontCache.mm',
             'platform/mac/WheelEventMac.mm',
             'platform/mac/WidgetMac.mm',
             'platform/mock/DeviceOrientationClientMock.cpp',
-            'platform/mock/DeviceOrientationClientMock.h',
             'platform/mock/GeolocationClientMock.cpp',
-            'platform/mock/GeolocationClientMock.h',
             'platform/mock/GeolocationServiceMock.cpp',
             'platform/mock/GeolocationServiceMock.h',
             'platform/mock/SpeechInputClientMock.cpp',
             'platform/mock/SpeechInputClientMock.h',
             'platform/network/AuthenticationChallengeBase.cpp',
-            'platform/network/AuthenticationChallengeBase.h',
-            'platform/network/AuthenticationClient.h',
             'platform/network/BlobData.cpp',
             'platform/network/BlobData.h',
             'platform/network/BlobRegistry.h',
+            'platform/network/BlobRegistryImpl.cpp',
+            'platform/network/BlobRegistryImpl.h',
+            'platform/network/BlobResourceHandle.cpp',
+            'platform/network/BlobResourceHandle.h',
             'platform/network/BlobStorageData.h',
-            'platform/network/CookieStorage.h',
             'platform/network/Credential.cpp',
-            'platform/network/Credential.h',
+            'platform/network/CredentialStorage.cpp',
             'platform/network/DNS.h',
             'platform/network/DataURL.cpp',
             'platform/network/DataURL.h',
             'platform/network/FormData.cpp',
-            'platform/network/FormData.h',
             'platform/network/FormDataBuilder.cpp',
             'platform/network/FormDataBuilder.h',
             'platform/network/HTTPHeaderMap.cpp',
-            'platform/network/HTTPHeaderMap.h',
             'platform/network/HTTPParsers.cpp',
             'platform/network/HTTPParsers.h',
             'platform/network/NetworkStateNotifier.cpp',
             'platform/network/NetworkStateNotifier.h',
-            'platform/network/NetworkingContext.h',
             'platform/network/ProtectionSpace.cpp',
-            'platform/network/ProtectionSpace.h',
+            'platform/network/ProxyServer.cpp',
             'platform/network/ResourceErrorBase.cpp',
-            'platform/network/ResourceErrorBase.h',
-            'platform/network/ResourceHandleClient.h',
+            'platform/network/ResourceHandle.cpp',
             'platform/network/ResourceHandleInternal.h',
-            'platform/network/ResourceLoadInfo.h',
-            'platform/network/ResourceLoadPriority.h',
-            'platform/network/ResourceLoadTiming.h',
             'platform/network/ResourceRequestBase.cpp',
-            'platform/network/ResourceRequestBase.h',
             'platform/network/ResourceResponseBase.cpp',
-            'platform/network/ResourceResponseBase.h',
             'platform/network/SocketStreamErrorBase.cpp',
             'platform/network/SocketStreamErrorBase.h',
             'platform/network/SocketStreamHandleBase.cpp',
             'platform/network/SocketStreamHandleBase.h',
             'platform/network/SocketStreamHandleClient.h',
+            'platform/network/android/AuthenticationChallenge.h',
+            'platform/network/android/CookieJarAndroid.cpp',
+            'platform/network/android/ProxyServerAndroid.cpp',
+            'platform/network/android/ResourceError.h',
+            'platform/network/android/ResourceHandleAndroid.cpp',
+            'platform/network/android/ResourceLoaderAndroid.h',
+            'platform/network/android/ResourceRequest.h',
+            'platform/network/android/ResourceRequestAndroid.cpp',
+            'platform/network/android/ResourceResponse.h',
+            'platform/network/brew/DNSBrew.cpp',
+            'platform/network/brew/SocketStreamError.h',
+            'platform/network/brew/SocketStreamHandle.h',
+            'platform/network/brew/SocketStreamHandleBrew.cpp',
+            'platform/network/brew/SocketStreamHandlePrivate.h',
             'platform/network/cf/AuthenticationCF.cpp',
             'platform/network/cf/AuthenticationCF.h',
-            'platform/network/cf/AuthenticationChallenge.h',
+            'platform/network/cf/CookieJarCFNet.cpp',
+            'platform/network/cf/CookieStorageCFNet.cpp',
+            'platform/network/cf/CookieStorageCFNet.h',
+            'platform/network/cf/CredentialStorageCFNet.cpp',
             'platform/network/cf/DNSCFNet.cpp',
+            'platform/network/cf/DownloadBundle.h',
+            'platform/network/cf/FormDataStreamCFNet.cpp',
+            'platform/network/cf/FormDataStreamCFNet.h',
+            'platform/network/cf/LoaderRunLoopCF.cpp',
+            'platform/network/cf/LoaderRunLoopCF.h',
+            'platform/network/cf/ProxyServerCFNet.cpp',
+            'platform/network/cf/ResourceErrorCF.cpp',
+            'platform/network/cf/ResourceHandleCFNet.cpp',
+            'platform/network/cf/ResourceRequestCFNet.cpp',
+            'platform/network/cf/ResourceRequestCFNet.h',
+            'platform/network/cf/ResourceResponseCFNet.cpp',
             'platform/network/cf/SocketStreamError.h',
             'platform/network/cf/SocketStreamHandle.h',
             'platform/network/cf/SocketStreamHandleCFNet.cpp',
@@ -3772,31 +4706,36 @@
             'platform/network/curl/AuthenticationChallenge.h',
             'platform/network/curl/CookieJarCurl.cpp',
             'platform/network/curl/DNSCurl.cpp',
+            'platform/network/curl/DownloadBundle.h',
             'platform/network/curl/FormDataStreamCurl.cpp',
             'platform/network/curl/FormDataStreamCurl.h',
+            'platform/network/curl/ProxyServerCurl.cpp',
             'platform/network/curl/ResourceError.h',
             'platform/network/curl/ResourceHandleCurl.cpp',
             'platform/network/curl/ResourceHandleManager.cpp',
             'platform/network/curl/ResourceHandleManager.h',
             'platform/network/curl/ResourceRequest.h',
             'platform/network/curl/ResourceResponse.h',
-            'platform/network/mac/AuthenticationChallenge.h',
-            'platform/network/mac/AuthenticationMac.h',
+            'platform/network/curl/SocketStreamError.h',
+            'platform/network/curl/SocketStreamHandle.h',
+            'platform/network/curl/SocketStreamHandleCurl.cpp',
             'platform/network/mac/AuthenticationMac.mm',
-            'platform/network/mac/FormDataStreamMac.h',
+            'platform/network/mac/CookieStorageMac.mm',
+            'platform/network/mac/CredentialStorageMac.mm',
             'platform/network/mac/FormDataStreamMac.mm',
             'platform/network/mac/NetworkStateNotifierMac.cpp',
-            'platform/network/mac/ResourceError.h',
             'platform/network/mac/ResourceErrorMac.mm',
             'platform/network/mac/ResourceHandleMac.mm',
-            'platform/network/mac/ResourceRequest.h',
             'platform/network/mac/ResourceRequestMac.mm',
-            'platform/network/mac/ResourceResponse.h',
             'platform/network/mac/ResourceResponseMac.mm',
-            'platform/network/mac/WebCoreURLResponse.h',
             'platform/network/mac/WebCoreURLResponse.mm',
             'platform/network/qt/AuthenticationChallenge.h',
             'platform/network/qt/CredentialStorageQt.cpp',
+            'platform/network/qt/DnsPrefetchHelper.cpp',
+            'platform/network/qt/DnsPrefetchHelper.h',
+            'platform/network/qt/NetworkStateNotifierPrivate.h',
+            'platform/network/qt/NetworkStateNotifierQt.cpp',
+            'platform/network/qt/ProxyServerQt.cpp',
             'platform/network/qt/QNetworkReplyHandler.cpp',
             'platform/network/qt/QNetworkReplyHandler.h',
             'platform/network/qt/ResourceError.h',
@@ -3804,27 +4743,42 @@
             'platform/network/qt/ResourceRequest.h',
             'platform/network/qt/ResourceRequestQt.cpp',
             'platform/network/qt/ResourceResponse.h',
+            'platform/network/qt/SocketStreamError.h',
+            'platform/network/qt/SocketStreamHandle.h',
+            'platform/network/qt/SocketStreamHandlePrivate.h',
+            'platform/network/qt/SocketStreamHandleQt.cpp',
             'platform/network/soup/AuthenticationChallenge.h',
             'platform/network/soup/CookieJarSoup.cpp',
             'platform/network/soup/CookieJarSoup.h',
-            'platform/network/soup/DNSSoup.cpp',
+            'platform/network/soup/GOwnPtrSoup.cpp',
+            'platform/network/soup/GOwnPtrSoup.h',
+            'platform/network/soup/ProxyServerSoup.cpp',
             'platform/network/soup/ResourceError.h',
             'platform/network/soup/ResourceHandleSoup.cpp',
             'platform/network/soup/ResourceRequest.h',
+            'platform/network/soup/ResourceRequestSoup.cpp',
             'platform/network/soup/ResourceResponse.h',
+            'platform/network/soup/ResourceResponseSoup.cpp',
             'platform/network/soup/SocketStreamError.h',
             'platform/network/soup/SocketStreamHandle.h',
             'platform/network/soup/SocketStreamHandleSoup.cpp',
-            'platform/network/soup/webkit-soup-auth-dialog.c',
-            'platform/network/soup/webkit-soup-auth-dialog.h',
-            'platform/network/win/CookieJarCFNetWin.cpp',
+            'platform/network/soup/SoupURIUtils.cpp',
+            'platform/network/soup/SoupURIUtils.h',
+            'platform/network/win/AuthenticationChallenge.h',
             'platform/network/win/CookieJarWin.cpp',
             'platform/network/win/CookieStorageWin.cpp',
-            'platform/network/win/CookieStorageWin.h',
+            'platform/network/win/DownloadBundleWin.cpp',
             'platform/network/win/NetworkStateNotifierWin.cpp',
+            'platform/network/win/ProxyServerWin.cpp',
+            'platform/network/win/ResourceError.h',
             'platform/network/win/ResourceHandleWin.cpp',
-            'platform/network/win/ResourceHandleWin.h',
+            'platform/network/win/ResourceRequest.h',
+            'platform/network/win/ResourceResponse.h',
+            'platform/network/win/SocketStreamError.h',
+            'platform/network/win/SocketStreamHandle.h',
+            'platform/network/win/SocketStreamHandleWin.cpp',
             'platform/posix/FileSystemPOSIX.cpp',
+            'platform/posix/SharedBufferPOSIX.cpp',
             'platform/qt/ClipboardQt.cpp',
             'platform/qt/ClipboardQt.h',
             'platform/qt/ContextMenuItemQt.cpp',
@@ -3837,18 +4791,21 @@
             'platform/qt/FileChooserQt.cpp',
             'platform/qt/FileSystemQt.cpp',
             'platform/qt/KURLQt.cpp',
-            'platform/qt/Localizations.cpp',
+            'platform/qt/LanguageQt.cpp',
             'platform/qt/LoggingQt.cpp',
             'platform/qt/MIMETypeRegistryQt.cpp',
-            'platform/qt/MenuEventProxy.h',
             'platform/qt/PasteboardQt.cpp',
+            'platform/qt/PlatformBridge.h',
+            'platform/qt/PlatformBridgeQt.cpp',
             'platform/qt/PlatformKeyboardEventQt.cpp',
             'platform/qt/PlatformMouseEventQt.cpp',
             'platform/qt/PlatformScreenQt.cpp',
-            'platform/qt/PopupMenuQt.cpp',
-            'platform/qt/PopupMenuQt.h',
-            'platform/qt/QWebPopup.cpp',
-            'platform/qt/QWebPopup.h',
+            'platform/qt/PlatformTouchEventQt.cpp',
+            'platform/qt/PlatformTouchPointQt.cpp',
+            'platform/qt/QWebPageClient.h',
+            'platform/qt/QtMobileWebStyle.cpp',
+            'platform/qt/QtMobileWebStyle.h',
+            'platform/qt/QtStyleOptionWebComboBox.h',
             'platform/qt/RenderThemeQt.cpp',
             'platform/qt/RenderThemeQt.h',
             'platform/qt/ScreenQt.cpp',
@@ -3856,8 +4813,6 @@
             'platform/qt/ScrollbarQt.cpp',
             'platform/qt/ScrollbarThemeQt.cpp',
             'platform/qt/ScrollbarThemeQt.h',
-            'platform/qt/SearchPopupMenuQt.cpp',
-            'platform/qt/SearchPopupMenuQt.h',
             'platform/qt/SharedBufferQt.cpp',
             'platform/qt/SharedTimerQt.cpp',
             'platform/qt/SoundQt.cpp',
@@ -3865,81 +4820,65 @@
             'platform/qt/WheelEventQt.cpp',
             'platform/qt/WidgetQt.cpp',
             'platform/sql/SQLValue.cpp',
-            'platform/sql/SQLValue.h',
             'platform/sql/SQLiteAuthorizer.cpp',
             'platform/sql/SQLiteDatabase.cpp',
-            'platform/sql/SQLiteDatabase.h',
             'platform/sql/SQLiteFileSystem.cpp',
             'platform/sql/SQLiteFileSystem.h',
             'platform/sql/SQLiteStatement.cpp',
             'platform/sql/SQLiteStatement.h',
             'platform/sql/SQLiteTransaction.cpp',
-            'platform/sql/SQLiteTransaction.h',
             'platform/sql/chromium/SQLiteFileSystemChromium.cpp',
             'platform/sql/chromium/SQLiteFileSystemChromiumPosix.cpp',
             'platform/sql/chromium/SQLiteFileSystemChromiumWin.cpp',
-            'platform/symbian/FloatPointSymbian.cpp',
-            'platform/symbian/FloatRectSymbian.cpp',
-            'platform/symbian/IntPointSymbian.cpp',
-            'platform/symbian/IntRectSymbian.cpp',
-            'platform/symbian/IntSizeSymbian.cpp',
-            'platform/text/AtomicStringImpl.h',
+            'platform/text/AtomicStringKeyedMRUCache.h',
             'platform/text/Base64.cpp',
-            'platform/text/Base64.h',
             'platform/text/BidiContext.cpp',
-            'platform/text/BidiContext.h',
-            'platform/text/BidiResolver.h',
             'platform/text/Hyphenation.cpp',
             'platform/text/Hyphenation.h',
             'platform/text/LineEnding.cpp',
-            'platform/text/LineEnding.h',
             'platform/text/LocalizedNumber.h',
             'platform/text/LocalizedNumberICU.cpp',
+            'platform/text/LocalizedNumberNone.cpp',
             'platform/text/ParserUtilities.h',
-            'platform/text/PlatformString.h',
             'platform/text/RegularExpression.cpp',
-            'platform/text/RegularExpression.h',
             'platform/text/SegmentedString.cpp',
-            'platform/text/SegmentedString.h',
             'platform/text/String.cpp',
-            'platform/text/StringHash.h',
-            'platform/text/StringImpl.h',
             'platform/text/SuffixTree.h',
             'platform/text/TextBoundaries.cpp',
-            'platform/text/TextBoundaries.h',
-            'platform/text/TextBreakIterator.h',
             'platform/text/TextBreakIteratorICU.cpp',
-            'platform/text/TextBreakIteratorInternalICU.h',
-            'platform/text/TextCheckerClient.h',
             'platform/text/TextCodec.cpp',
-            'platform/text/TextCodec.h',
             'platform/text/TextCodecASCIIFastPath.h',
             'platform/text/TextCodecICU.cpp',
-            'platform/text/TextCodecICU.h',
             'platform/text/TextCodecLatin1.cpp',
-            'platform/text/TextCodecLatin1.h',
             'platform/text/TextCodecUTF16.cpp',
-            'platform/text/TextCodecUTF16.h',
             'platform/text/TextCodecUTF8.cpp',
             'platform/text/TextCodecUTF8.h',
             'platform/text/TextCodecUserDefined.cpp',
-            'platform/text/TextCodecUserDefined.h',
-            'platform/text/TextDirection.h',
             'platform/text/TextEncoding.cpp',
-            'platform/text/TextEncoding.h',
             'platform/text/TextEncodingDetector.h',
             'platform/text/TextEncodingDetectorICU.cpp',
+            'platform/text/TextEncodingDetectorNone.cpp',
             'platform/text/TextEncodingRegistry.cpp',
-            'platform/text/TextEncodingRegistry.h',
             'platform/text/TextStream.cpp',
-            'platform/text/TextStream.h',
             'platform/text/UnicodeRange.cpp',
-            'platform/text/UnicodeRange.h',
+            'platform/text/android/HyphenationAndroid.cpp',
+            'platform/text/android/TextBreakIteratorInternalICU.cpp',
+            'platform/text/brew/TextBoundariesBrew.cpp',
+            'platform/text/brew/TextBreakIteratorBrew.cpp',
+            'platform/text/brew/TextCodecBrew.cpp',
+            'platform/text/brew/TextCodecBrew.h',
+            'platform/text/cf/HyphenationCF.cpp',
             'platform/text/cf/StringCF.cpp',
             'platform/text/cf/StringImplCF.cpp',
             'platform/text/chromium/TextBreakIteratorInternalICUChromium.cpp',
+            'platform/text/efl/TextBreakIteratorInternalICUEfl.cpp',
+            'platform/text/gtk/TextBreakIteratorGtk.cpp',
             'platform/text/gtk/TextBreakIteratorInternalICUGtk.cpp',
-            'platform/text/mac/CharsetData.h',
+            'platform/text/gtk/TextCodecGtk.cpp',
+            'platform/text/gtk/TextCodecGtk.h',
+            'platform/text/haiku/TextBreakIteratorInternalICUHaiku.cpp',
+            'platform/text/mac/HyphenationMac.mm',
+            'platform/text/mac/LocalizedNumberMac.mm',
             'platform/text/mac/ShapeArabic.c',
             'platform/text/mac/ShapeArabic.h',
             'platform/text/mac/StringImplMac.mm',
@@ -3948,17 +4887,20 @@
             'platform/text/mac/TextBreakIteratorInternalICUMac.mm',
             'platform/text/mac/TextCodecMac.cpp',
             'platform/text/mac/TextCodecMac.h',
-            'platform/text/qt/TextBoundaries.cpp',
+            'platform/text/qt/TextBoundariesQt.cpp',
             'platform/text/qt/TextBreakIteratorQt.cpp',
             'platform/text/qt/TextCodecQt.cpp',
             'platform/text/qt/TextCodecQt.h',
-            'platform/text/symbian/StringImplSymbian.cpp',
-            'platform/text/symbian/StringSymbian.cpp',
             'platform/text/transcoder/FontTranscoder.cpp',
             'platform/text/transcoder/FontTranscoder.h',
             'platform/text/win/TextBreakIteratorInternalICUWin.cpp',
+            'platform/text/wince/TextBreakIteratorWinCE.cpp',
+            'platform/text/wince/TextCodecWinCE.cpp',
+            'platform/text/wince/TextCodecWinCE.h',
             'platform/win/BString.cpp',
             'platform/win/BString.h',
+            'platform/win/BitmapInfo.cpp',
+            'platform/win/BitmapInfo.h',
             'platform/win/COMPtr.h',
             'platform/win/ClipboardUtilitiesWin.cpp',
             'platform/win/ClipboardUtilitiesWin.h',
@@ -3985,26 +4927,43 @@
             'platform/win/PlatformMouseEventWin.cpp',
             'platform/win/PlatformScreenWin.cpp',
             'platform/win/PopupMenuWin.cpp',
+            'platform/win/PopupMenuWin.h',
+            'platform/win/SSLKeyGeneratorWin.cpp',
             'platform/win/ScrollbarThemeSafari.cpp',
             'platform/win/ScrollbarThemeSafari.h',
             'platform/win/ScrollbarThemeWin.cpp',
             'platform/win/ScrollbarThemeWin.h',
             'platform/win/SearchPopupMenuWin.cpp',
+            'platform/win/SearchPopupMenuWin.h',
             'platform/win/SharedBufferWin.cpp',
             'platform/win/SharedTimerWin.cpp',
             'platform/win/SoftLinking.h',
             'platform/win/SoundWin.cpp',
+            'platform/win/SystemInfo.cpp',
+            'platform/win/SystemInfo.h',
             'platform/win/SystemTimeWin.cpp',
             'platform/win/TemporaryLinkStubs.cpp',
             'platform/win/WCDataObject.cpp',
             'platform/win/WCDataObject.h',
+            'platform/win/WebCoreInstanceHandle.cpp',
+            'platform/win/WebCoreInstanceHandle.h',
             'platform/win/WebCoreTextRenderer.cpp',
             'platform/win/WebCoreTextRenderer.h',
             'platform/win/WheelEventWin.cpp',
             'platform/win/WidgetWin.cpp',
+            'platform/win/Win32Handle.h',
             'platform/win/WindowMessageBroadcaster.cpp',
             'platform/win/WindowMessageBroadcaster.h',
             'platform/win/WindowMessageListener.h',
+            'platform/wince/CursorWinCE.cpp',
+            'platform/wince/DragDataWinCE.cpp',
+            'platform/wince/DragImageWinCE.cpp',
+            'platform/wince/FileSystemWinCE.cpp',
+            'platform/wince/KURLWinCE.cpp',
+            'platform/wince/MIMETypeRegistryWinCE.cpp',
+            'platform/wince/PasteboardWinCE.cpp',
+            'platform/wince/SearchPopupMenuWinCE.cpp',
+            'platform/wince/SharedTimerWinCE.cpp',
             'platform/wx/ClipboardWx.cpp',
             'platform/wx/ClipboardWx.h',
             'platform/wx/ContextMenuItemWx.cpp',
@@ -4013,7 +4972,9 @@
             'platform/wx/DragDataWx.cpp',
             'platform/wx/DragImageWx.cpp',
             'platform/wx/EventLoopWx.cpp',
+            'platform/wx/FileChooserWx.cpp',
             'platform/wx/FileSystemWx.cpp',
+            'platform/wx/KURLWx.cpp',
             'platform/wx/KeyEventWin.cpp',
             'platform/wx/KeyboardEventWx.cpp',
             'platform/wx/LocalizedStringsWx.cpp',
@@ -4023,22 +4984,35 @@
             'platform/wx/MouseWheelEventWx.cpp',
             'platform/wx/PasteboardWx.cpp',
             'platform/wx/PopupMenuWx.cpp',
+            'platform/wx/PopupMenuWx.h',
             'platform/wx/RenderThemeWx.cpp',
+            'platform/wx/SSLKeyGeneratorWx.cpp',
             'platform/wx/ScreenWx.cpp',
             'platform/wx/ScrollViewWx.cpp',
+            'platform/wx/ScrollbarThemeWx.cpp',
+            'platform/wx/ScrollbarThemeWx.h',
+            'platform/wx/SearchPopupMenuWx.cpp',
+            'platform/wx/SearchPopupMenuWx.h',
+            'platform/wx/SharedBufferWx.cpp',
             'platform/wx/SharedTimerWx.cpp',
             'platform/wx/SoundWx.cpp',
+            'platform/wx/SystemTimeWx.cpp',
             'platform/wx/TemporaryLinkStubs.cpp',
+            'platform/wx/TextBreakIteratorInternalICUWx.cpp',
             'platform/wx/WidgetWx.cpp',
             'platform/wx/wxcode/fontprops.cpp',
             'platform/wx/wxcode/fontprops.h',
             'platform/wx/wxcode/gtk/fontprops.cpp',
             'platform/wx/wxcode/gtk/non-kerned-drawing.cpp',
-            'platform/wx/wxcode/mac/carbon/fontprops.cpp',
+            'platform/wx/wxcode/gtk/scrollbar_render.cpp',
+            'platform/wx/wxcode/mac/carbon/fontprops.mm',
             'platform/wx/wxcode/mac/carbon/non-kerned-drawing.cpp',
+            'platform/wx/wxcode/mac/carbon/scrollbar_render.cpp',
             'platform/wx/wxcode/non-kerned-drawing.h',
+            'platform/wx/wxcode/scrollbar_render.h',
             'platform/wx/wxcode/win/fontprops.cpp',
             'platform/wx/wxcode/win/non-kerned-drawing.cpp',
+            'platform/wx/wxcode/win/scrollbar_render.cpp',
             'plugins/DOMMimeType.cpp',
             'plugins/DOMMimeType.h',
             'plugins/DOMMimeTypeArray.cpp',
@@ -4050,15 +5024,15 @@
             'plugins/IFrameShimSupport.cpp',
             'plugins/IFrameShimSupport.h',
             'plugins/PluginData.cpp',
-            'plugins/PluginData.h',
+            'plugins/PluginDataNone.cpp',
             'plugins/PluginDatabase.cpp',
             'plugins/PluginDatabase.h',
             'plugins/PluginDebug.cpp',
             'plugins/PluginDebug.h',
             'plugins/PluginMainThreadScheduler.cpp',
-            'plugins/PluginMainThreadScheduler.h',
             'plugins/PluginPackage.cpp',
             'plugins/PluginPackage.h',
+            'plugins/PluginPackageNone.cpp',
             'plugins/PluginQuirkSet.h',
             'plugins/PluginStream.cpp',
             'plugins/PluginStream.h',
@@ -4072,23 +5046,25 @@
             'plugins/gtk/PluginViewGtk.cpp',
             'plugins/gtk/gtk2xtbin.h',
             'plugins/gtk/xembed.h',
-            'plugins/mac/PluginDataMac.mm',
             'plugins/mac/PluginPackageMac.cpp',
             'plugins/mac/PluginViewMac.mm',
             'plugins/npapi.cpp',
-            'plugins/npfunctions.h',
-            'plugins/qt/PluginDataQt.cpp',
+            'plugins/qt/PluginContainerQt.cpp',
+            'plugins/qt/PluginContainerQt.h',
             'plugins/qt/PluginPackageQt.cpp',
             'plugins/qt/PluginViewQt.cpp',
-            'plugins/win/PluginDataWin.cpp',
+            'plugins/symbian/PluginContainerSymbian.cpp',
+            'plugins/symbian/PluginContainerSymbian.h',
+            'plugins/symbian/PluginDatabaseSymbian.cpp',
+            'plugins/symbian/PluginPackageSymbian.cpp',
+            'plugins/symbian/PluginViewSymbian.cpp',
+            'plugins/symbian/npinterface.h',
             'plugins/win/PluginDatabaseWin.cpp',
             'plugins/win/PluginMessageThrottlerWin.cpp',
             'plugins/win/PluginMessageThrottlerWin.h',
             'plugins/win/PluginPackageWin.cpp',
             'plugins/win/PluginViewWin.cpp',
             'plugins/wx/PluginDataWx.cpp',
-            'plugins/wx/PluginPackageWx.cpp',
-            'plugins/wx/PluginViewWx.cpp',
             'rendering/AutoTableLayout.cpp',
             'rendering/AutoTableLayout.h',
             'rendering/BidiRun.cpp',
@@ -4099,23 +5075,14 @@
             'rendering/EllipsisBox.h',
             'rendering/FixedTableLayout.cpp',
             'rendering/FixedTableLayout.h',
-            'rendering/GapRects.h',
-            'rendering/HitTestRequest.h',
             'rendering/HitTestResult.cpp',
-            'rendering/HitTestResult.h',
             'rendering/InlineBox.cpp',
-            'rendering/InlineBox.h',
             'rendering/InlineFlowBox.cpp',
-            'rendering/InlineFlowBox.h',
             'rendering/InlineIterator.h',
             'rendering/InlineTextBox.cpp',
-            'rendering/InlineTextBox.h',
             'rendering/LayoutState.cpp',
-            'rendering/LayoutState.h',
             'rendering/MediaControlElements.cpp',
             'rendering/MediaControlElements.h',
-            'rendering/PaintInfo.h',
-            'rendering/PaintPhase.h',
             'rendering/PointerEventsHitRules.cpp',
             'rendering/PointerEventsHitRules.h',
             'rendering/RenderApplet.cpp',
@@ -4123,14 +5090,10 @@
             'rendering/RenderArena.cpp',
             'rendering/RenderArena.h',
             'rendering/RenderBR.cpp',
-            'rendering/RenderBR.h',
             'rendering/RenderBlock.cpp',
-            'rendering/RenderBlock.h',
             'rendering/RenderBlockLineLayout.cpp',
             'rendering/RenderBox.cpp',
-            'rendering/RenderBox.h',
             'rendering/RenderBoxModelObject.cpp',
-            'rendering/RenderBoxModelObject.h',
             'rendering/RenderButton.cpp',
             'rendering/RenderButton.h',
             'rendering/RenderCombineText.cpp',
@@ -4144,7 +5107,6 @@
             'rendering/RenderDetailsMarker.cpp',
             'rendering/RenderDetailsMarker.h',
             'rendering/RenderEmbeddedObject.cpp',
-            'rendering/RenderEmbeddedObject.h',
             'rendering/RenderFieldset.cpp',
             'rendering/RenderFieldset.h',
             'rendering/RenderFileUploadControl.cpp',
@@ -4164,11 +5126,8 @@
             'rendering/RenderIFrame.cpp',
             'rendering/RenderIFrame.h',
             'rendering/RenderImage.cpp',
-            'rendering/RenderImage.h',
             'rendering/RenderImageResource.cpp',
-            'rendering/RenderImageResource.h',
             'rendering/RenderImageResourceStyleImage.cpp',
-            'rendering/RenderImageResourceStyleImage.h',
             'rendering/RenderIndicator.cpp',
             'rendering/RenderIndicator.h',
             'rendering/RenderInline.cpp',
@@ -4176,17 +5135,13 @@
             'rendering/RenderInputSpeech.cpp',
             'rendering/RenderInputSpeech.h',
             'rendering/RenderLayer.cpp',
-            'rendering/RenderLayer.h',
             'rendering/RenderLayerBacking.cpp',
-            'rendering/RenderLayerBacking.h',
             'rendering/RenderLayerCompositor.cpp',
             'rendering/RenderLayerCompositor.h',
             'rendering/RenderLineBoxList.cpp',
-            'rendering/RenderLineBoxList.h',
             'rendering/RenderListBox.cpp',
             'rendering/RenderListBox.h',
             'rendering/RenderListItem.cpp',
-            'rendering/RenderListItem.h',
             'rendering/RenderListMarker.cpp',
             'rendering/RenderListMarker.h',
             'rendering/RenderMarquee.cpp',
@@ -4202,17 +5157,13 @@
             'rendering/RenderMeter.cpp',
             'rendering/RenderMeter.h',
             'rendering/RenderObject.cpp',
-            'rendering/RenderObject.h',
             'rendering/RenderObjectChildList.cpp',
-            'rendering/RenderObjectChildList.h',
             'rendering/RenderPart.cpp',
-            'rendering/RenderPart.h',
             'rendering/RenderProgress.cpp',
             'rendering/RenderProgress.h',
             'rendering/RenderQuote.cpp',
             'rendering/RenderQuote.h',
             'rendering/RenderReplaced.cpp',
-            'rendering/RenderReplaced.h',
             'rendering/RenderReplica.cpp',
             'rendering/RenderReplica.h',
             'rendering/RenderRuby.cpp',
@@ -4245,7 +5196,6 @@
             'rendering/RenderTableSection.cpp',
             'rendering/RenderTableSection.h',
             'rendering/RenderText.cpp',
-            'rendering/RenderText.h',
             'rendering/RenderTextControl.cpp',
             'rendering/RenderTextControl.h',
             'rendering/RenderTextControlMultiLine.cpp',
@@ -4270,25 +5220,26 @@
             'rendering/RenderThemeSafari.h',
             'rendering/RenderThemeWin.cpp',
             'rendering/RenderThemeWin.h',
+            'rendering/RenderThemeWinCE.cpp',
+            'rendering/RenderThemeWinCE.h',
             'rendering/RenderTreeAsText.cpp',
-            'rendering/RenderTreeAsText.h',
             'rendering/RenderVideo.cpp',
             'rendering/RenderVideo.h',
             'rendering/RenderView.cpp',
-            'rendering/RenderView.h',
             'rendering/RenderWidget.cpp',
-            'rendering/RenderWidget.h',
+            'rendering/RenderWidgetProtector.h',
             'rendering/RenderWordBreak.cpp',
             'rendering/RenderWordBreak.h',
+            'rendering/RenderingAllInOne.cpp',
             'rendering/RootInlineBox.cpp',
-            'rendering/RootInlineBox.h',
             'rendering/ScrollBehavior.cpp',
-            'rendering/ScrollBehavior.h',
             'rendering/ShadowElement.cpp',
             'rendering/ShadowElement.h',
             'rendering/TableLayout.h',
+            'rendering/TrailingFloatsRootInlineBox.h',
             'rendering/TransformState.cpp',
             'rendering/TransformState.h',
+            'rendering/VerticalPositionCache.h',
             'rendering/break_lines.cpp',
             'rendering/break_lines.h',
             'rendering/mathml/RenderMathMLBlock.cpp',
@@ -4311,65 +5262,34 @@
             'rendering/mathml/RenderMathMLSubSup.h',
             'rendering/mathml/RenderMathMLUnderOver.cpp',
             'rendering/mathml/RenderMathMLUnderOver.h',
-            'rendering/style/BorderData.h',
-            'rendering/style/BorderValue.h',
-            'rendering/style/CollapsedBorderValue.h',
             'rendering/style/ContentData.cpp',
-            'rendering/style/ContentData.h',
-            'rendering/style/CounterContent.h',
             'rendering/style/CounterDirectives.cpp',
-            'rendering/style/CounterDirectives.h',
-            'rendering/style/CursorData.h',
-            'rendering/style/CursorList.h',
-            'rendering/style/DataRef.h',
             'rendering/style/FillLayer.cpp',
-            'rendering/style/FillLayer.h',
             'rendering/style/KeyframeList.cpp',
             'rendering/style/KeyframeList.h',
             'rendering/style/NinePieceImage.cpp',
-            'rendering/style/NinePieceImage.h',
-            'rendering/style/OutlineValue.h',
             'rendering/style/QuotesData.cpp',
             'rendering/style/QuotesData.h',
             'rendering/style/RenderStyle.cpp',
-            'rendering/style/RenderStyle.h',
-            'rendering/style/RenderStyleConstants.h',
             'rendering/style/SVGRenderStyle.cpp',
-            'rendering/style/SVGRenderStyle.h',
             'rendering/style/SVGRenderStyleDefs.cpp',
-            'rendering/style/SVGRenderStyleDefs.h',
             'rendering/style/ShadowData.cpp',
-            'rendering/style/ShadowData.h',
+            'rendering/style/StyleAllInOne.cpp',
             'rendering/style/StyleBackgroundData.cpp',
-            'rendering/style/StyleBackgroundData.h',
             'rendering/style/StyleBoxData.cpp',
-            'rendering/style/StyleBoxData.h',
             'rendering/style/StyleCachedImage.cpp',
-            'rendering/style/StyleCachedImage.h',
-            'rendering/style/StyleDashboardRegion.h',
             'rendering/style/StyleFlexibleBoxData.cpp',
-            'rendering/style/StyleFlexibleBoxData.h',
             'rendering/style/StyleGeneratedImage.cpp',
-            'rendering/style/StyleGeneratedImage.h',
-            'rendering/style/StyleImage.h',
             'rendering/style/StyleInheritedData.cpp',
-            'rendering/style/StyleInheritedData.h',
             'rendering/style/StyleMarqueeData.cpp',
-            'rendering/style/StyleMarqueeData.h',
             'rendering/style/StyleMultiColData.cpp',
-            'rendering/style/StyleMultiColData.h',
             'rendering/style/StylePendingImage.h',
             'rendering/style/StyleRareInheritedData.cpp',
-            'rendering/style/StyleRareInheritedData.h',
             'rendering/style/StyleRareNonInheritedData.cpp',
-            'rendering/style/StyleRareNonInheritedData.h',
-            'rendering/style/StyleReflection.h',
             'rendering/style/StyleSurroundData.cpp',
-            'rendering/style/StyleSurroundData.h',
             'rendering/style/StyleTransformData.cpp',
-            'rendering/style/StyleTransformData.h',
             'rendering/style/StyleVisualData.cpp',
-            'rendering/style/StyleVisualData.h',
+            'rendering/svg/RenderSVGAllInOne.cpp',
             'rendering/svg/RenderSVGBlock.cpp',
             'rendering/svg/RenderSVGBlock.h',
             'rendering/svg/RenderSVGContainer.cpp',
@@ -4444,7 +5364,6 @@
             'rendering/svg/SVGResources.cpp',
             'rendering/svg/SVGResources.h',
             'rendering/svg/SVGResourcesCache.cpp',
-            'rendering/svg/SVGResourcesCache.h',
             'rendering/svg/SVGResourcesCycleSolver.cpp',
             'rendering/svg/SVGResourcesCycleSolver.h',
             'rendering/svg/SVGRootInlineBox.cpp',
@@ -4471,15 +5390,12 @@
             'rendering/svg/SVGTextQuery.cpp',
             'rendering/svg/SVGTextQuery.h',
             'storage/AbstractDatabase.cpp',
-            'storage/AbstractDatabase.h',
             'storage/ChangeVersionWrapper.cpp',
             'storage/ChangeVersionWrapper.h',
             'storage/Database.cpp',
-            'storage/Database.h',
             'storage/DatabaseAuthorizer.cpp',
             'storage/DatabaseAuthorizer.h',
             'storage/DatabaseCallback.h',
-            'storage/DatabaseDetails.h',
             'storage/DatabaseSync.cpp',
             'storage/DatabaseSync.h',
             'storage/DatabaseTask.cpp',
@@ -4487,11 +5403,8 @@
             'storage/DatabaseThread.cpp',
             'storage/DatabaseThread.h',
             'storage/DatabaseTracker.cpp',
-            'storage/DatabaseTracker.h',
-            'storage/DatabaseTrackerClient.h',
             'storage/IDBAny.cpp',
             'storage/IDBAny.h',
-            'storage/IDBBackingStore.cpp',
             'storage/IDBBackingStore.h',
             'storage/IDBCallbacks.h',
             'storage/IDBCursor.cpp',
@@ -4506,6 +5419,10 @@
             'storage/IDBDatabaseBackendImpl.cpp',
             'storage/IDBDatabaseBackendImpl.h',
             'storage/IDBDatabaseBackendInterface.h',
+            'storage/IDBDatabaseCallbacks.h',
+            'storage/IDBDatabaseCallbacks.h',
+            'storage/IDBDatabaseCallbacksImpl.cpp',
+            'storage/IDBDatabaseCallbacksImpl.h',
             'storage/IDBDatabaseError.h',
             'storage/IDBDatabaseException.h',
             'storage/IDBEventDispatcher.cpp',
@@ -4538,6 +5455,8 @@
             'storage/IDBPendingTransactionMonitor.h',
             'storage/IDBRequest.cpp',
             'storage/IDBRequest.h',
+            'storage/IDBSQLiteBackingStore.cpp',
+            'storage/IDBSQLiteBackingStore.h',
             'storage/IDBTransaction.cpp',
             'storage/IDBTransaction.h',
             'storage/IDBTransactionBackendImpl.cpp',
@@ -4558,26 +5477,18 @@
             'storage/OriginQuotaManager.h',
             'storage/OriginUsageRecord.cpp',
             'storage/OriginUsageRecord.h',
-            'storage/SQLError.h',
+            'storage/SQLCallbackWrapper.h',
             'storage/SQLException.h',
             'storage/SQLResultSet.cpp',
-            'storage/SQLResultSet.h',
             'storage/SQLResultSetRowList.cpp',
-            'storage/SQLResultSetRowList.h',
             'storage/SQLStatement.cpp',
-            'storage/SQLStatement.h',
-            'storage/SQLStatementCallback.h',
-            'storage/SQLStatementErrorCallback.h',
             'storage/SQLStatementSync.cpp',
             'storage/SQLStatementSync.h',
             'storage/SQLTransaction.cpp',
-            'storage/SQLTransaction.h',
-            'storage/SQLTransactionCallback.h',
             'storage/SQLTransactionClient.cpp',
             'storage/SQLTransactionClient.h',
             'storage/SQLTransactionCoordinator.cpp',
             'storage/SQLTransactionCoordinator.h',
-            'storage/SQLTransactionErrorCallback.h',
             'storage/SQLTransactionSync.cpp',
             'storage/SQLTransactionSync.h',
             'storage/SQLTransactionSyncCallback.h',
@@ -4600,6 +5511,7 @@
             'storage/StorageNamespaceImpl.h',
             'storage/StorageSyncManager.cpp',
             'storage/StorageSyncManager.h',
+            'storage/StorageTracker.cpp',
             'storage/chromium/DatabaseObserver.h',
             'storage/chromium/DatabaseTrackerChromium.cpp',
             'storage/chromium/IDBFactoryBackendInterface.cpp',
@@ -4607,6 +5519,10 @@
             'storage/chromium/QuotaTracker.cpp',
             'storage/chromium/QuotaTracker.h',
             'storage/chromium/SQLTransactionClientChromium.cpp',
+            'storage/wince/DatabaseThreadWinCE.cpp',
+            'storage/wince/DatabaseThreadWinCE.h',
+            'storage/wince/LocalStorageThreadWinCE.cpp',
+            'storage/wince/LocalStorageThreadWinCE.h',
             'svg/ColorDistance.cpp',
             'svg/ColorDistance.h',
             'svg/ElementTimeControl.h',
@@ -4620,7 +5536,6 @@
             'svg/SVGAltGlyphElement.cpp',
             'svg/SVGAltGlyphElement.h',
             'svg/SVGAngle.cpp',
-            'svg/SVGAngle.h',
             'svg/SVGAnimateColorElement.cpp',
             'svg/SVGAnimateColorElement.h',
             'svg/SVGAnimateElement.cpp',
@@ -4629,18 +5544,6 @@
             'svg/SVGAnimateMotionElement.h',
             'svg/SVGAnimateTransformElement.cpp',
             'svg/SVGAnimateTransformElement.h',
-            'svg/SVGAnimatedAngle.h',
-            'svg/SVGAnimatedBoolean.h',
-            'svg/SVGAnimatedEnumeration.h',
-            'svg/SVGAnimatedInteger.h',
-            'svg/SVGAnimatedLength.h',
-            'svg/SVGAnimatedLengthList.h',
-            'svg/SVGAnimatedNumber.h',
-            'svg/SVGAnimatedNumberList.h',
-            'svg/SVGAnimatedPreserveAspectRatio.h',
-            'svg/SVGAnimatedRect.h',
-            'svg/SVGAnimatedString.h',
-            'svg/SVGAnimatedTransformList.h',
             'svg/SVGAnimationElement.cpp',
             'svg/SVGAnimationElement.h',
             'svg/SVGCircleElement.cpp',
@@ -4648,7 +5551,6 @@
             'svg/SVGClipPathElement.cpp',
             'svg/SVGClipPathElement.h',
             'svg/SVGColor.cpp',
-            'svg/SVGColor.h',
             'svg/SVGComponentTransferFunctionElement.cpp',
             'svg/SVGComponentTransferFunctionElement.h',
             'svg/SVGCursorElement.cpp',
@@ -4660,9 +5562,7 @@
             'svg/SVGDocument.cpp',
             'svg/SVGDocument.h',
             'svg/SVGDocumentExtensions.cpp',
-            'svg/SVGDocumentExtensions.h',
             'svg/SVGElement.cpp',
-            'svg/SVGElement.h',
             'svg/SVGElementInstance.cpp',
             'svg/SVGElementInstance.h',
             'svg/SVGElementInstanceList.cpp',
@@ -4762,30 +5662,24 @@
             'svg/SVGLangSpace.cpp',
             'svg/SVGLangSpace.h',
             'svg/SVGLength.cpp',
-            'svg/SVGLength.h',
             'svg/SVGLengthList.cpp',
-            'svg/SVGLengthList.h',
             'svg/SVGLineElement.cpp',
             'svg/SVGLineElement.h',
             'svg/SVGLinearGradientElement.cpp',
             'svg/SVGLinearGradientElement.h',
             'svg/SVGLocatable.cpp',
-            'svg/SVGLocatable.h',
             'svg/SVGMPathElement.cpp',
             'svg/SVGMPathElement.h',
             'svg/SVGMarkerElement.cpp',
             'svg/SVGMarkerElement.h',
             'svg/SVGMaskElement.cpp',
             'svg/SVGMaskElement.h',
-            'svg/SVGMatrix.h',
             'svg/SVGMetadataElement.cpp',
             'svg/SVGMetadataElement.h',
             'svg/SVGMissingGlyphElement.cpp',
             'svg/SVGMissingGlyphElement.h',
             'svg/SVGNumberList.cpp',
-            'svg/SVGNumberList.h',
             'svg/SVGPaint.cpp',
-            'svg/SVGPaint.h',
             'svg/SVGParserUtilities.cpp',
             'svg/SVGParserUtilities.h',
             'svg/SVGPathBlender.cpp',
@@ -4840,7 +5734,6 @@
             'svg/SVGPolylineElement.cpp',
             'svg/SVGPolylineElement.h',
             'svg/SVGPreserveAspectRatio.cpp',
-            'svg/SVGPreserveAspectRatio.h',
             'svg/SVGRadialGradientElement.cpp',
             'svg/SVGRadialGradientElement.h',
             'svg/SVGRect.h',
@@ -4888,11 +5781,9 @@
             'svg/SVGTitleElement.cpp',
             'svg/SVGTitleElement.h',
             'svg/SVGTransform.cpp',
-            'svg/SVGTransform.h',
             'svg/SVGTransformDistance.cpp',
             'svg/SVGTransformDistance.h',
             'svg/SVGTransformList.cpp',
-            'svg/SVGTransformList.h',
             'svg/SVGTransformable.cpp',
             'svg/SVGTransformable.h',
             'svg/SVGURIReference.cpp',
@@ -4911,11 +5802,9 @@
             'svg/SVGZoomEvent.cpp',
             'svg/SVGZoomEvent.h',
             'svg/animation/SMILTime.cpp',
-            'svg/animation/SMILTime.h',
             'svg/animation/SMILTimeContainer.cpp',
             'svg/animation/SMILTimeContainer.h',
             'svg/animation/SVGSMILElement.cpp',
-            'svg/animation/SVGSMILElement.h',
             'svg/graphics/SVGImage.cpp',
             'svg/graphics/SVGImage.h',
             'svg/graphics/filters/SVGFEImage.cpp',
@@ -4924,27 +5813,10 @@
             'svg/graphics/filters/SVGFilter.h',
             'svg/graphics/filters/SVGFilterBuilder.cpp',
             'svg/graphics/filters/SVGFilterBuilder.h',
-            'svg/properties/SVGAnimatedListPropertyTearOff.h',
             'svg/properties/SVGAnimatedPathSegListPropertyTearOff.h',
-            'svg/properties/SVGAnimatedProperty.h',
-            'svg/properties/SVGAnimatedPropertyDescription.h',
-            'svg/properties/SVGAnimatedPropertyMacros.h',
-            'svg/properties/SVGAnimatedPropertySynchronizer.h',
-            'svg/properties/SVGAnimatedPropertySynchronizer.h',
-            'svg/properties/SVGAnimatedPropertyTearOff.h',
-            'svg/properties/SVGAnimatedStaticPropertyTearOff.h',
-            'svg/properties/SVGAnimatedTransformListPropertyTearOff.h',
-            'svg/properties/SVGListProperty.h',
-            'svg/properties/SVGListPropertyTearOff.h',
             'svg/properties/SVGPathSegListPropertyTearOff.cpp',
-            'svg/properties/SVGPathSegListPropertyTearOff.h',
-            'svg/properties/SVGProperty.h',
-            'svg/properties/SVGPropertyTearOff.h',
-            'svg/properties/SVGPropertyTraits.h',
-            'svg/properties/SVGStaticListPropertyTearOff.h',
-            'svg/properties/SVGStaticPropertyTearOff.h',
-            'svg/properties/SVGStaticPropertyWithParentTearOff.h',
-            'svg/properties/SVGTransformListPropertyTearOff.h',
+            'thirdparty/glu/gluos.h',
+            'thirdparty/glu/internal_glu.h',
             'thirdparty/glu/libtess/dict-list.h',
             'thirdparty/glu/libtess/dict.c',
             'thirdparty/glu/libtess/dict.h',
@@ -5038,12 +5910,88 @@
             'websockets/WebSocketHandshakeResponse.h',
             'websockets/WorkerThreadableWebSocketChannel.cpp',
             'websockets/WorkerThreadableWebSocketChannel.h',
+            # FIXME: For some reason including these files and excluding them
+            # in the GYP file causes GYP not to create a valid Xcode project.
+            # 'wml/WMLAElement.cpp',
+            # 'wml/WMLAElement.h',
+            # 'wml/WMLAccessElement.cpp',
+            # 'wml/WMLAccessElement.h',
+            # 'wml/WMLAnchorElement.cpp',
+            # 'wml/WMLAnchorElement.h',
+            # 'wml/WMLBRElement.cpp',
+            # 'wml/WMLBRElement.h',
+            # 'wml/WMLCardElement.cpp',
+            # 'wml/WMLCardElement.h',
+            # 'wml/WMLDoElement.cpp',
+            # 'wml/WMLDoElement.h',
+            # 'wml/WMLDocument.cpp',
+            # 'wml/WMLDocument.h',
+            # 'wml/WMLElement.cpp',
+            # 'wml/WMLElement.h',
+            # 'wml/WMLErrorHandling.cpp',
+            # 'wml/WMLErrorHandling.h',
+            # 'wml/WMLEventHandlingElement.cpp',
+            # 'wml/WMLEventHandlingElement.h',
+            # 'wml/WMLFieldSetElement.cpp',
+            # 'wml/WMLFieldSetElement.h',
+            # 'wml/WMLFormControlElement.cpp',
+            # 'wml/WMLFormControlElement.h',
+            # 'wml/WMLGoElement.cpp',
+            # 'wml/WMLGoElement.h',
+            # 'wml/WMLImageElement.cpp',
+            # 'wml/WMLImageElement.h',
+            # 'wml/WMLImageLoader.cpp',
+            # 'wml/WMLImageLoader.h',
+            # 'wml/WMLInputElement.cpp',
+            # 'wml/WMLInputElement.h',
+            # 'wml/WMLInsertedLegendElement.cpp',
+            # 'wml/WMLInsertedLegendElement.h',
+            # 'wml/WMLIntrinsicEvent.cpp',
+            # 'wml/WMLIntrinsicEvent.h',
+            # 'wml/WMLIntrinsicEventHandler.cpp',
+            # 'wml/WMLIntrinsicEventHandler.h',
+            # 'wml/WMLMetaElement.cpp',
+            # 'wml/WMLMetaElement.h',
+            # 'wml/WMLNoopElement.cpp',
+            # 'wml/WMLNoopElement.h',
+            # 'wml/WMLOnEventElement.cpp',
+            # 'wml/WMLOnEventElement.h',
+            # 'wml/WMLOptGroupElement.cpp',
+            # 'wml/WMLOptGroupElement.h',
+            # 'wml/WMLOptionElement.cpp',
+            # 'wml/WMLOptionElement.h',
+            # 'wml/WMLPElement.cpp',
+            # 'wml/WMLPElement.h',
+            # 'wml/WMLPageState.cpp',
+            # 'wml/WMLPageState.h',
+            # 'wml/WMLPostfieldElement.cpp',
+            # 'wml/WMLPostfieldElement.h',
+            # 'wml/WMLPrevElement.cpp',
+            # 'wml/WMLPrevElement.h',
+            # 'wml/WMLRefreshElement.cpp',
+            # 'wml/WMLRefreshElement.h',
+            # 'wml/WMLSelectElement.cpp',
+            # 'wml/WMLSelectElement.h',
+            # 'wml/WMLSetvarElement.cpp',
+            # 'wml/WMLSetvarElement.h',
+            # 'wml/WMLTableElement.cpp',
+            # 'wml/WMLTableElement.h',
+            # 'wml/WMLTaskElement.cpp',
+            # 'wml/WMLTaskElement.h',
+            # 'wml/WMLTemplateElement.cpp',
+            # 'wml/WMLTemplateElement.h',
+            # 'wml/WMLTimerElement.cpp',
+            # 'wml/WMLTimerElement.h',
+            # 'wml/WMLVariables.cpp',
+            # 'wml/WMLVariables.h',
             'workers/AbstractWorker.cpp',
             'workers/AbstractWorker.h',
             'workers/DedicatedWorkerContext.cpp',
             'workers/DedicatedWorkerContext.h',
             'workers/DedicatedWorkerThread.cpp',
             'workers/DedicatedWorkerThread.h',
+            'workers/DefaultSharedWorkerRepository.cpp',
+            'workers/DefaultSharedWorkerRepository.h',
             'workers/SharedWorker.cpp',
             'workers/SharedWorker.h',
             'workers/SharedWorkerContext.cpp',
@@ -5064,12 +6012,10 @@
             'workers/WorkerObjectProxy.h',
             'workers/WorkerReportingProxy.h',
             'workers/WorkerRunLoop.cpp',
-            'workers/WorkerRunLoop.h',
             'workers/WorkerScriptLoader.cpp',
             'workers/WorkerScriptLoader.h',
             'workers/WorkerScriptLoaderClient.h',
             'workers/WorkerThread.cpp',
-            'workers/WorkerThread.h',
             'xml/DOMParser.cpp',
             'xml/DOMParser.h',
             'xml/NativeXPathNSResolver.cpp',
@@ -5121,16 +6067,54 @@
             'xml/XSLImportRule.h',
             'xml/XSLStyleSheet.h',
             'xml/XSLStyleSheetLibxslt.cpp',
+            'xml/XSLStyleSheetQt.cpp',
             'xml/XSLTExtensions.cpp',
             'xml/XSLTExtensions.h',
             'xml/XSLTProcessor.cpp',
             'xml/XSLTProcessor.h',
             'xml/XSLTProcessorLibxslt.cpp',
+            'xml/XSLTProcessorQt.cpp',
             'xml/XSLTUnicodeSort.cpp',
             'xml/XSLTUnicodeSort.h',
         ],
+        'webcore_resource_files': [
+            'English.lproj/Localizable.strings',
+            'English.lproj/localizedStrings.js',
+            'Resources/aliasCursor.png',
+            'Resources/cellCursor.png',
+            'Resources/contextMenuCursor.png',
+            'Resources/copyCursor.png',
+            'Resources/crossHairCursor.png',
+            'Resources/deleteButton.tiff',
+            'Resources/deleteButtonPressed.tiff',
+            'Resources/eastResizeCursor.png',
+            'Resources/eastWestResizeCursor.png',
+            'Resources/helpCursor.png',
+            'Resources/inputSpeech.tiff',
+            'Resources/linkCursor.png',
+            'Resources/missingImage.tiff',
+            'Resources/moveCursor.png',
+            'Resources/noDropCursor.png',
+            'Resources/noneCursor.png',
+            'Resources/northEastResizeCursor.png',
+            'Resources/northEastSouthWestResizeCursor.png',
+            'Resources/northResizeCursor.png',
+            'Resources/northSouthResizeCursor.png',
+            'Resources/northWestResizeCursor.png',
+            'Resources/northWestSouthEastResizeCursor.png',
+            'Resources/notAllowedCursor.png',
+            'Resources/progressCursor.png',
+            'Resources/southEastResizeCursor.png',
+            'Resources/southResizeCursor.png',
+            'Resources/southWestResizeCursor.png',
+            'Resources/textAreaResizeCorner.tiff',
+            'Resources/verticalTextCursor.png',
+            'Resources/waitCursor.png',
+            'Resources/westResizeCursor.png',
+            'Resources/zoomInCursor.png',
+            'Resources/zoomOutCursor.png',
+        ],
         'webinspector_files': [
-
             'inspector/front-end/inspector.html',
             'inspector/front-end/ApplicationCacheItemsView.js',
             'inspector/front-end/AuditCategories.js',
@@ -5209,6 +6193,7 @@
             'inspector/front-end/ResourceCategory.js',
             'inspector/front-end/ResourceCookiesView.js',
             'inspector/front-end/ResourceHeadersView.js',
+            'inspector/front-end/ResourceJSONView.js',
             'inspector/front-end/ResourceTimingView.js',
             'inspector/front-end/ResourceTreeModel.js',
             'inspector/front-end/ResourceView.js',
@@ -5226,6 +6211,7 @@
             'inspector/front-end/SidebarPane.js',
             'inspector/front-end/SidebarTreeElement.js',
             'inspector/front-end/SourceCSSTokenizer.js',
+            'inspector/front-end/SourceFile.js',
             'inspector/front-end/SourceFrame.js',
             'inspector/front-end/SourceFrameContent.js',
             'inspector/front-end/SourceHTMLTokenizer.js',
@@ -5317,6 +6303,7 @@
             'inspector/front-end/Images/graphLabelCalloutRight.png',
             'inspector/front-end/Images/helpButtonGlyph.png',
             'inspector/front-end/Images/largerResourcesButtonGlyph.png',
+            'inspector/front-end/Images/garbageCollectButtonGlyph.png',
             'inspector/front-end/Images/localStorage.png',
             'inspector/front-end/Images/networkIcon.png',
             'inspector/front-end/Images/nodeSearchButtonGlyph.png',
@@ -5425,7 +6412,6 @@
             '<(PRODUCT_DIR)/DerivedSources/WebCore/CSSGrammar.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/CSSPropertyNames.cpp',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/CSSPropertyNames.gperf',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/CSSPropertyNames.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/CSSPropertyNames.in',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/CSSValueKeywords.cpp',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/CSSValueKeywords.gperf',
@@ -5433,1412 +6419,476 @@
             '<(PRODUCT_DIR)/DerivedSources/WebCore/CSSValueKeywords.in',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/CharsetData.cpp',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/ColorData.cpp',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMAbstractView.h',
+            # This list does not contain all the Objective-C bindings files
+            # that we generate.  We run all the IDL files through the
+            # Objective-C code generator, but not all of them even build.
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMAbstractViewInternal.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMAbstractViewPrivate.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMAbstractWorker.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMAbstractWorker.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMAbstractWorkerInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMArrayBuffer.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMArrayBuffer.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMArrayBufferInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMArrayBufferView.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMArrayBufferView.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMArrayBufferViewInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMAttr.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMAttr.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMAttrInternal.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMAttrPrivate.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMAudioBuffer.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMAudioBuffer.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMAudioBufferInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMAudioBufferSourceNode.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMAudioBufferSourceNode.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMAudioBufferSourceNodeInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMAudioChannelMerger.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMAudioChannelMerger.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMAudioChannelMergerInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMAudioChannelSplitter.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMAudioChannelSplitter.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMAudioChannelSplitterInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMAudioContext.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMAudioContext.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMAudioContextInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMAudioDestinationNode.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMAudioDestinationNode.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMAudioDestinationNodeInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMAudioGain.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMAudioGain.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMAudioGainInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMAudioGainNode.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMAudioGainNode.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMAudioGainNodeInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMAudioListener.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMAudioListener.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMAudioListenerInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMAudioNode.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMAudioNode.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMAudioNodeInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMAudioPannerNode.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMAudioPannerNode.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMAudioPannerNodeInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMAudioParam.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMAudioParam.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMAudioParamInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMAudioProcessingEvent.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMAudioProcessingEvent.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMAudioProcessingEventInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMAudioSourceNode.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMAudioSourceNode.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMAudioSourceNodeInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMBarInfo.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMBarInfo.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMBarInfoInternal.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMBeforeLoadEvent.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMBeforeLoadEvent.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMBeforeLoadEventInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMBeforeProcessEvent.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMBeforeProcessEvent.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMBeforeProcessEventInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMBlob.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMBlob.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMBlobBuilder.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMBlobBuilder.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMBlobBuilderInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMBlobInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMBlobPrivate.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCDATASection.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCDATASection.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCDATASectionInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCSSCharsetRule.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCSSCharsetRule.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCSSCharsetRuleInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCSSFontFaceRule.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCSSFontFaceRule.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCSSFontFaceRuleInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCSSImportRule.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCSSImportRule.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCSSImportRuleInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCSSMediaRule.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCSSMediaRule.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCSSMediaRuleInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCSSPageRule.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCSSPageRule.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCSSPageRuleInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCSSPrimitiveValue.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCSSPrimitiveValue.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCSSPrimitiveValueInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCSSRule.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCSSRule.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCSSRuleInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCSSRuleList.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCSSRuleList.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCSSRuleListInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCSSStyleDeclaration.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCSSStyleDeclaration.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCSSStyleDeclarationInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCSSStyleRule.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCSSStyleRule.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCSSStyleRuleInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCSSStyleSheet.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCSSStyleSheet.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCSSStyleSheetInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCSSUnknownRule.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCSSUnknownRule.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCSSUnknownRuleInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCSSValue.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCSSValue.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCSSValueInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCSSValueList.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCSSValueList.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCSSValueListInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCanvasGradient.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCanvasGradient.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCanvasGradientInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCanvasPattern.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCanvasPattern.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCanvasPatternInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCanvasRenderingContext.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCanvasRenderingContext.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCanvasRenderingContext2D.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCanvasRenderingContext2D.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCanvasRenderingContext2DInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCanvasRenderingContextInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCharacterData.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCharacterData.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCharacterDataInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMClientRect.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMClientRect.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMClientRectInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMClientRectList.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMClientRectList.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMClientRectListInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMClipboard.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMClipboard.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMClipboardInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMComment.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMComment.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCommentInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCompositionEvent.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCompositionEvent.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCompositionEventInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMConsole.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMConsole.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMConsoleInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMConvolverNode.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMConvolverNode.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMConvolverNodeInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCoordinates.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCoordinates.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCoordinatesInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCounter.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCounter.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCounterInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCrypto.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCrypto.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCryptoInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCustomEvent.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCustomEvent.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCustomEventInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDOMApplicationCache.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDOMApplicationCache.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDOMApplicationCacheInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDOMCoreException.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDOMCoreException.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDOMCoreExceptionInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDOMFileSystem.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDOMFileSystem.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDOMFileSystemInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDOMFileSystemSync.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDOMFileSystemSync.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDOMFileSystemSyncInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDOMFormData.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDOMFormData.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDOMFormDataInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDOMImplementation.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDOMImplementation.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDOMImplementationInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDOMMimeTypeArray.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDOMMimeTypeArray.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDOMMimeTypeArrayInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDOMParser.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDOMParser.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDOMParserInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDOMPluginArray.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDOMPluginArray.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDOMPluginArrayInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDOMSelection.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDOMSelection.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDOMSelectionInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDOMSettableTokenList.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDOMSettableTokenList.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDOMSettableTokenListInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDOMStringList.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDOMStringList.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDOMStringListInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDOMStringMap.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDOMStringMap.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDOMStringMapInternal.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDOMTokenList.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDOMTokenList.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDOMTokenListInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDOMURL.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDOMURL.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDOMURLInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDataGridColumn.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDataGridColumn.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDataGridColumnInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDataGridColumnList.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDataGridColumnList.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDataGridColumnListInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDataView.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDataView.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDataViewInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDatabase.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDatabase.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDatabaseCallback.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDatabaseCallback.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDatabaseCallbackInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDatabaseInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDatabaseSync.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDatabaseSync.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDatabaseSyncInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDedicatedWorkerContext.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDedicatedWorkerContext.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDedicatedWorkerContextInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDelayNode.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDelayNode.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDelayNodeInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDeviceMotionEvent.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDeviceMotionEvent.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDeviceMotionEventInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDeviceOrientationEvent.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDeviceOrientationEvent.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDeviceOrientationEventInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDirectoryEntry.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDirectoryEntry.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDirectoryEntryInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDirectoryEntrySync.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDirectoryEntrySync.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDirectoryEntrySyncInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDirectoryReader.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDirectoryReader.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDirectoryReaderInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDirectoryReaderSync.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDirectoryReaderSync.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDirectoryReaderSyncInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDocument.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDocument.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDocumentFragment.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDocumentFragment.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDocumentFragmentInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDocumentFragmentPrivate.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDocumentInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDocumentPrivate.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDocumentType.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDocumentType.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDocumentTypeInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMElementInternal.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMElementPrivate.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMElementTimeControl.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMEntity.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMEntity.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMEntityInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMEntityReference.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMEntityReference.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMEntityReferenceInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMEntriesCallback.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMEntriesCallback.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMEntriesCallbackInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMEntry.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMEntry.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMEntryArray.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMEntryArray.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMEntryArrayInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMEntryArraySync.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMEntryArraySync.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMEntryArraySyncInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMEntryCallback.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMEntryCallback.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMEntryCallbackInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMEntryInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMEntrySync.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMEntrySync.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMEntrySyncInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMErrorCallback.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMErrorCallback.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMErrorCallbackInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMErrorEvent.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMErrorEvent.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMErrorEventInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMEvent.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMEvent.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMEventException.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMEventException.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMEventExceptionInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMEventInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMEventListener.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMEventPrivate.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMEventSource.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMEventSource.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMEventSourceInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMEventTarget.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMFile.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMFile.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMFileCallback.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMFileCallback.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMFileCallbackInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMFileEntry.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMFileEntry.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMFileEntryInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMFileEntrySync.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMFileEntrySync.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMFileEntrySyncInternal.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMFileError.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMFileError.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMFileErrorInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMFileException.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMFileException.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMFileExceptionInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMFileInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMFileList.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMFileList.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMFileListInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMFilePrivate.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMFileReader.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMFileReader.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMFileReaderInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMFileReaderSync.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMFileReaderSync.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMFileReaderSyncInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMFileSystemCallback.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMFileSystemCallback.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMFileSystemCallbackInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMFileWriter.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMFileWriter.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMFileWriterCallback.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMFileWriterCallback.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMFileWriterCallbackInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMFileWriterInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMFileWriterSync.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMFileWriterSync.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMFileWriterSyncInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMFlags.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMFlags.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMFlagsInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMFloat32Array.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMFloat32Array.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMFloat32ArrayInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMGeolocation.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMGeolocation.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMGeolocationInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMGeoposition.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMGeoposition.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMGeopositionInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLAllCollection.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLAllCollection.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLAllCollectionInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLAnchorElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLAnchorElement.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLAnchorElementInternal.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLAnchorElementPrivate.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLAppletElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLAppletElement.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLAppletElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLAreaElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLAreaElement.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLAreaElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLAudioElement.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLAudioElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLAudioElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLBRElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLBRElement.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLBRElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLBaseElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLBaseElement.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLBaseElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLBaseFontElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLBaseFontElement.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLBaseFontElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLBlockquoteElement.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLBlockquoteElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLBlockquoteElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLBodyElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLBodyElement.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLBodyElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLButtonElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLButtonElement.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLButtonElementInternal.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLButtonElementPrivate.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLCanvasElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLCanvasElement.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLCanvasElementInternal.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLCanvasElementPrivate.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLCollection.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLCollection.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLCollectionInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLDListElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLDListElement.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLDListElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLDataGridCellElement.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLDataGridCellElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLDataGridCellElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLDataGridColElement.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLDataGridColElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLDataGridColElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLDataGridElement.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLDataGridElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLDataGridElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLDataGridRowElement.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLDataGridRowElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLDataGridRowElementInternal.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLDataListElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLDataListElement.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLDataListElementInternal.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLDetailsElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLDetailsElement.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLDetailsElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLDirectoryElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLDirectoryElement.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLDirectoryElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLDivElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLDivElement.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLDivElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLDocument.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLDocument.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLDocumentInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLElementInternal.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLElementPrivate.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLEmbedElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLEmbedElement.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLEmbedElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLEmbedElementPrivate.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLFieldSetElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLFieldSetElement.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLFieldSetElementInternal.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLFieldSetElementPrivate.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLFontElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLFontElement.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLFontElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLFormElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLFormElement.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLFormElementInternal.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLFormElementPrivate.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLFrameElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLFrameElement.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLFrameElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLFrameSetElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLFrameSetElement.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLFrameSetElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLHRElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLHRElement.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLHRElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLHeadElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLHeadElement.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLHeadElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLHeadingElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLHeadingElement.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLHeadingElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLHtmlElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLHtmlElement.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLHtmlElementInternal.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLHtmlElementPrivate.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLIFrameElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLIFrameElement.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLIFrameElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLIFrameElementPrivate.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLImageElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLImageElement.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLImageElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLInputElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLInputElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLInputElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLInputElementPrivate.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLIsIndexElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLIsIndexElement.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLIsIndexElementInternal.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLKeygenElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLKeygenElement.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLKeygenElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLLIElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLLIElement.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLLIElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLLabelElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLLabelElement.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLLabelElementInternal.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLLabelElementPrivate.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLLegendElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLLegendElement.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLLegendElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLLinkElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLLinkElement.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLLinkElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLMapElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLMapElement.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLMapElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLMarqueeElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLMarqueeElement.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLMarqueeElementInternal.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLMarqueeElementPrivate.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLMediaElement.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLMediaElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLMediaElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLMenuElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLMenuElement.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLMenuElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLMetaElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLMetaElement.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLMetaElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLMeterElement.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLMeterElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLMeterElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLModElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLModElement.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLModElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLOListElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLOListElement.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLOListElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLObjectElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLObjectElement.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLObjectElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLObjectElementPrivate.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLOptGroupElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLOptGroupElement.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLOptGroupElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLOptionElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLOptionElement.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLOptionElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLOptionsCollection.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLOptionsCollection.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLOptionsCollectionInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLOutputElement.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLOutputElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLOutputElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLParagraphElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLParagraphElement.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLParagraphElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLParamElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLParamElement.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLParamElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLPreElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLPreElement.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLPreElementInternal.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLProgressElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLProgressElement.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLProgressElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLQuoteElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLQuoteElement.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLQuoteElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLScriptElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLScriptElement.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLScriptElementInternal.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLScriptElementPrivate.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLSelectElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLSelectElement.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLSelectElementInternal.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLSelectElementPrivate.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLSourceElement.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLSourceElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLSourceElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLStyleElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLStyleElement.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLStyleElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLTableCaptionElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLTableCaptionElement.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLTableCaptionElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLTableCellElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLTableCellElement.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLTableCellElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLTableColElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLTableColElement.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLTableColElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLTableElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLTableElement.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLTableElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLTableRowElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLTableRowElement.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLTableRowElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLTableSectionElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLTableSectionElement.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLTableSectionElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLTextAreaElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLTextAreaElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLTextAreaElementInternal.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLTextAreaElementPrivate.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLTitleElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLTitleElement.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLTitleElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLUListElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLUListElement.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLUListElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLVideoElement.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLVideoElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLVideoElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHashChangeEvent.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHashChangeEvent.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHashChangeEventInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHighPass2FilterNode.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHighPass2FilterNode.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHighPass2FilterNodeInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHistory.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHistory.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHistoryInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMIDBAny.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMIDBAny.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMIDBAnyInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMIDBCursor.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMIDBCursor.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMIDBCursorInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMIDBDatabase.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMIDBDatabase.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMIDBDatabaseError.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMIDBDatabaseError.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMIDBDatabaseErrorInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMIDBDatabaseException.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMIDBDatabaseException.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMIDBDatabaseExceptionInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMIDBDatabaseInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMIDBFactory.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMIDBFactory.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMIDBFactoryInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMIDBIndex.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMIDBIndex.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMIDBIndexInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMIDBKey.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMIDBKey.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMIDBKeyInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMIDBKeyRange.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMIDBKeyRange.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMIDBKeyRangeInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMIDBObjectStore.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMIDBObjectStore.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMIDBObjectStoreInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMIDBRequest.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMIDBRequest.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMIDBRequestInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMIDBTransaction.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMIDBTransaction.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMIDBTransactionInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMImageData.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMImageData.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMImageDataInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMInjectedScriptHost.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMInjectedScriptHost.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMInjectedScriptHostInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMInspectorFrontendHost.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMInspectorFrontendHost.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMInspectorFrontendHostInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMInt16Array.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMInt16Array.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMInt16ArrayInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMInt32Array.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMInt32Array.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMInt32ArrayInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMInt8Array.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMInt8Array.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMInt8ArrayInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMJavaScriptAudioNode.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMJavaScriptAudioNode.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMJavaScriptAudioNodeInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMKeyboardEvent.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMKeyboardEvent.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMKeyboardEventInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMLocation.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMLocation.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMLocationInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMLowPass2FilterNode.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMLowPass2FilterNode.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMLowPass2FilterNodeInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMMediaError.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMMediaError.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMMediaErrorInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMMediaList.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMMediaList.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMMediaListInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMMediaQueryList.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMMediaQueryList.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMMediaQueryListInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMMediaQueryListListener.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMMemoryInfo.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMMemoryInfo.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMMemoryInfoInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMMessageChannel.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMMessageChannel.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMMessageChannelInternal.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMMessageEvent.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMMessageEvent.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMMessageEventInternal.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMMessagePort.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMMessagePort.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMMessagePortInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMMetadata.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMMetadata.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMMetadataCallback.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMMetadataCallback.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMMetadataCallbackInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMMetadataInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMMouseEvent.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMMouseEvent.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMMouseEventInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMMutationEvent.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMMutationEvent.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMMutationEventInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMNamedNodeMap.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMNamedNodeMap.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMNamedNodeMapInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMNavigator.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMNavigator.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMNavigatorInternal.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMNode.dep',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMNode.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMNode.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMNodeFilter.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMNodeInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMNodeIterator.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMNodeIterator.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMNodeIteratorInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMNodeList.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMNodeList.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMNodeListInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMNotation.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMNotation.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMNotationInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMNotification.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMNotification.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMNotificationCenter.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMNotificationCenter.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMNotificationCenterInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMNotificationInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMOESStandardDerivatives.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMOESStandardDerivatives.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMOESStandardDerivativesInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMOESTextureFloat.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMOESTextureFloat.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMOESTextureFloatInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMOESVertexArrayObject.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMOESVertexArrayObject.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMOESVertexArrayObjectInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMOverflowEvent.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMOverflowEvent.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMOverflowEventInternal.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMPageTransitionEvent.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMPageTransitionEvent.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMPageTransitionEventInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMPerformance.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMPerformance.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMPerformanceInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMPerformanceNavigation.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMPerformanceNavigation.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMPerformanceNavigationInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMPerformanceTiming.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMPerformanceTiming.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMPerformanceTimingInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMPopStateEvent.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMPopStateEvent.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMPopStateEventInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMPositionError.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMPositionError.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMPositionErrorInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMProcessingInstruction.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMProcessingInstruction.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMProcessingInstructionInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMProgressEvent.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMProgressEvent.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMProgressEventInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMRGBColor.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMRGBColor.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMRGBColorInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMRange.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMRange.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMRangeException.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMRangeException.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMRangeExceptionInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMRangeInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMRangePrivate.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMRealtimeAnalyserNode.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMRealtimeAnalyserNode.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMRealtimeAnalyserNodeInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMRect.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMRect.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMRectInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSQLError.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSQLError.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSQLErrorInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSQLException.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSQLException.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSQLExceptionInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSQLResultSet.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSQLResultSet.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSQLResultSetInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSQLResultSetRowList.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSQLResultSetRowList.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSQLResultSetRowListInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSQLStatementCallback.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSQLStatementCallback.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSQLStatementCallbackInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSQLStatementErrorCallback.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSQLStatementErrorCallback.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSQLStatementErrorCallbackInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSQLTransaction.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSQLTransaction.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSQLTransactionCallback.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSQLTransactionCallback.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSQLTransactionCallbackInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSQLTransactionErrorCallback.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSQLTransactionErrorCallback.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSQLTransactionErrorCallbackInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSQLTransactionInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSQLTransactionSync.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSQLTransactionSync.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSQLTransactionSyncCallback.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSQLTransactionSyncCallback.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSQLTransactionSyncCallbackInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSQLTransactionSyncInternal.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAElement.dep',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAElementInternal.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAltGlyphElement.dep',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAltGlyphElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAltGlyphElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAltGlyphElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAngle.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAngle.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAngleInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimateColorElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimateColorElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimateColorElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimateElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimateElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimateElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimateTransformElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimateTransformElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimateTransformElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimatedAngle.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimatedAngle.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimatedAngleInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimatedBoolean.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimatedBoolean.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimatedBooleanInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimatedEnumeration.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimatedEnumeration.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimatedEnumerationInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimatedInteger.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimatedInteger.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimatedIntegerInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimatedLength.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimatedLength.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimatedLengthInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimatedLengthList.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimatedLengthList.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimatedLengthListInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimatedNumber.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimatedNumber.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimatedNumberInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimatedNumberList.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimatedNumberList.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimatedNumberListInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimatedPreserveAspectRatio.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimatedPreserveAspectRatio.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimatedPreserveAspectRatioInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimatedRect.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimatedRect.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimatedRectInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimatedString.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimatedString.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimatedStringInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimatedTransformList.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimatedTransformList.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimatedTransformListInternal.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimationElement.dep',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimationElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimationElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimationElementInternal.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGCircleElement.dep',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGCircleElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGCircleElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGCircleElementInternal.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGClipPathElement.dep',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGClipPathElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGClipPathElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGClipPathElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGColor.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGColor.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGColorInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGComponentTransferFunctionElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGComponentTransferFunctionElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGComponentTransferFunctionElementInternal.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGCursorElement.dep',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGCursorElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGCursorElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGCursorElementInternal.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGDefsElement.dep',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGDefsElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGDefsElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGDefsElementInternal.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGDescElement.dep',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGDescElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGDescElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGDescElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGDocument.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGDocument.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGDocumentInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGElement.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGElementInstance.dep',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGElementInstance.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGElementInstance.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGElementInstanceInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGElementInstanceList.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGElementInstanceList.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGElementInstanceListInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGElementInternal.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGEllipseElement.dep',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGEllipseElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGEllipseElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGEllipseElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGException.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGException.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGExceptionInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGExternalResourcesRequired.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEBlendElement.dep',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEBlendElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEBlendElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEBlendElementInternal.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEColorMatrixElement.dep',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEColorMatrixElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEColorMatrixElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEColorMatrixElementInternal.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEComponentTransferElement.dep',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEComponentTransferElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEComponentTransferElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEComponentTransferElementInternal.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFECompositeElement.dep',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFECompositeElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFECompositeElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFECompositeElementInternal.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEConvolveMatrixElement.dep',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEConvolveMatrixElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEConvolveMatrixElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEConvolveMatrixElementInternal.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEDiffuseLightingElement.dep',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEDiffuseLightingElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEDiffuseLightingElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEDiffuseLightingElementInternal.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEDisplacementMapElement.dep',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEDisplacementMapElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEDisplacementMapElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEDisplacementMapElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEDistantLightElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEDistantLightElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEDistantLightElementInternal.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEFloodElement.dep',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEFloodElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEFloodElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEFloodElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEFuncAElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEFuncAElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEFuncAElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEFuncBElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEFuncBElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEFuncBElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEFuncGElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEFuncGElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEFuncGElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEFuncRElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEFuncRElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEFuncRElementInternal.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEGaussianBlurElement.dep',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEGaussianBlurElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEGaussianBlurElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEGaussianBlurElementInternal.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEImageElement.dep',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEImageElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEImageElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEImageElementInternal.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEMergeElement.dep',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEMergeElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEMergeElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEMergeElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEMergeNodeElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEMergeNodeElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEMergeNodeElementInternal.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEMorphologyElement.dep',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEMorphologyElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEMorphologyElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEMorphologyElementInternal.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEOffsetElement.dep',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEOffsetElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEOffsetElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEOffsetElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEPointLightElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEPointLightElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEPointLightElementInternal.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFESpecularLightingElement.dep',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFESpecularLightingElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFESpecularLightingElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFESpecularLightingElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFESpotLightElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFESpotLightElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFESpotLightElementInternal.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFETileElement.dep',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFETileElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFETileElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFETileElementInternal.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFETurbulenceElement.dep',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFETurbulenceElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFETurbulenceElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFETurbulenceElementInternal.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFilterElement.dep',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFilterElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFilterElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFilterElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFilterPrimitiveStandardAttributes.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFitToViewBox.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFontElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFontElement.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFontElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFontFaceElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFontFaceElement.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFontFaceElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFontFaceFormatElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFontFaceFormatElement.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFontFaceFormatElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFontFaceNameElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFontFaceNameElement.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFontFaceNameElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFontFaceSrcElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFontFaceSrcElement.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFontFaceSrcElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFontFaceUriElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFontFaceUriElement.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFontFaceUriElementInternal.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGForeignObjectElement.dep',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGForeignObjectElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGForeignObjectElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGForeignObjectElementInternal.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGGElement.dep',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGGElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGGElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGGElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGGlyphElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGGlyphElement.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGGlyphElementInternal.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGGradientElement.dep',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGGradientElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGGradientElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGGradientElementInternal.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGHKernElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGHKernElement.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGHKernElementInternal.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGImageElement.dep',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGImageElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGImageElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGImageElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGLangSpace.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGLength.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGLength.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGLengthInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGLengthList.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGLengthList.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGLengthListInternal.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGLineElement.dep',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGLineElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGLineElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGLineElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGLinearGradientElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGLinearGradientElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGLinearGradientElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGLocatable.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGMarkerElement.dep',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGMarkerElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGMarkerElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGMarkerElementInternal.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGMaskElement.dep',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGMaskElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGMaskElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGMaskElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGMatrix.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGMatrix.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGMatrixInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGMetadataElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGMetadataElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGMetadataElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGMissingGlyphElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGMissingGlyphElement.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGMissingGlyphElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGNumber.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGNumber.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGNumberInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGNumberList.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGNumberList.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGNumberListInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPaint.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPaint.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPaintInternal.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathElement.dep',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSeg.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSeg.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegArcAbs.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegArcAbs.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegArcAbsInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegArcRel.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegArcRel.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegArcRelInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegClosePath.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegClosePath.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegClosePathInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegCurvetoCubicAbs.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegCurvetoCubicAbs.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegCurvetoCubicAbsInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegCurvetoCubicRel.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegCurvetoCubicRel.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegCurvetoCubicRelInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegCurvetoCubicSmoothAbs.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegCurvetoCubicSmoothAbs.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegCurvetoCubicSmoothAbsInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegCurvetoCubicSmoothRel.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegCurvetoCubicSmoothRel.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegCurvetoCubicSmoothRelInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegCurvetoQuadraticAbs.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegCurvetoQuadraticAbs.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegCurvetoQuadraticAbsInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegCurvetoQuadraticRel.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegCurvetoQuadraticRel.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegCurvetoQuadraticRelInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegCurvetoQuadraticSmoothAbs.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegCurvetoQuadraticSmoothAbs.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegCurvetoQuadraticSmoothAbsInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegCurvetoQuadraticSmoothRel.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegCurvetoQuadraticSmoothRel.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegCurvetoQuadraticSmoothRelInternal.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegLinetoAbs.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegLinetoAbs.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegLinetoAbsInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegLinetoHorizontalAbs.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegLinetoHorizontalAbs.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegLinetoHorizontalAbsInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegLinetoHorizontalRel.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegLinetoHorizontalRel.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegLinetoHorizontalRelInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegLinetoRel.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegLinetoRel.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegLinetoRelInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegLinetoVerticalAbs.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegLinetoVerticalAbs.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegLinetoVerticalAbsInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegLinetoVerticalRel.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegLinetoVerticalRel.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegLinetoVerticalRelInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegList.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegList.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegListInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegMovetoAbs.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegMovetoAbs.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegMovetoAbsInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegMovetoRel.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegMovetoRel.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegMovetoRelInternal.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPatternElement.dep',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPatternElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPatternElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPatternElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPoint.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPoint.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPointInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPointList.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPointList.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPointListInternal.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPolygonElement.dep',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPolygonElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPolygonElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPolygonElementInternal.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPolylineElement.dep',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPolylineElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPolylineElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPolylineElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPreserveAspectRatio.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPreserveAspectRatio.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPreserveAspectRatioInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGRadialGradientElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGRadialGradientElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGRadialGradientElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGRect.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGRect.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGRectElement.dep',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGRectElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGRectElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGRectElementInternal.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGRectInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGRenderingIntent.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGRenderingIntent.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGRenderingIntentInternal.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGSVGElement.dep',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGSVGElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGSVGElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGSVGElementInternal.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGScriptElement.dep',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGScriptElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGScriptElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGScriptElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGSetElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGSetElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGSetElementInternal.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGStopElement.dep',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGStopElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGStopElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGStopElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGStringList.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGStringList.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGStringListInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGStylable.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGStyleElement.dep',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGStyleElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGStyleElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGStyleElementInternal.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGSwitchElement.dep',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGSwitchElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGSwitchElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGSwitchElementInternal.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGSymbolElement.dep',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGSymbolElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGSymbolElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGSymbolElementInternal.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGTRefElement.dep',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGTRefElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGTRefElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGTRefElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGTSpanElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGTSpanElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGTSpanElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGTests.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGTextContentElement.dep',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGTextContentElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGTextContentElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGTextContentElementInternal.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGTextElement.dep',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGTextElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGTextElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGTextElementInternal.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGTextPathElement.dep',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGTextPathElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGTextPathElement.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGTextPathElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGTextPositioningElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGTextPositioningElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGTextPositioningElementInternal.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGTitleElement.dep',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGTitleElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGTitleElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGTitleElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGTransform.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGTransform.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGTransformInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGTransformList.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGTransformList.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGTransformListInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGTransformable.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGURIReference.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGUnitTypes.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGUnitTypes.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGUnitTypesInternal.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGUseElement.dep',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGUseElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGUseElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGUseElementInternal.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGVKernElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGVKernElement.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGVKernElementInternal.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGViewElement.dep',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGViewElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGViewElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGViewElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGZoomAndPan.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGZoomEvent.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGZoomEvent.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGZoomEventInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMScreen.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMScreen.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMScreenInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMScriptProfile.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMScriptProfile.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMScriptProfileInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMScriptProfileNode.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMScriptProfileNode.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMScriptProfileNodeInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSharedWorker.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSharedWorker.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSharedWorkerContext.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSharedWorkerContext.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSharedWorkerContextInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSharedWorkerInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSpeechInputEvent.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSpeechInputEvent.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSpeechInputEventInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSpeechInputResult.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSpeechInputResult.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSpeechInputResultInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSpeechInputResultList.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSpeechInputResultList.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSpeechInputResultListInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMStorage.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMStorage.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMStorageEvent.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMStorageEvent.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMStorageEventInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMStorageInternal.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMStyleMedia.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMStyleMedia.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMStyleMediaInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMStyleSheet.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMStyleSheet.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMStyleSheetInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMStyleSheetList.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMStyleSheetList.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMStyleSheetListInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMText.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMText.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMTextEvent.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMTextEvent.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMTextEventInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMTextInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMTextMetrics.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMTextMetrics.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMTextMetricsInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMTimeRanges.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMTimeRanges.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMTimeRangesInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMTouch.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMTouch.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMTouchEvent.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMTouchEvent.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMTouchEventInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMTouchInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMTouchList.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMTouchList.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMTouchListInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMTreeWalker.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMTreeWalker.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMTreeWalkerInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMUIEvent.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMUIEvent.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMUIEventInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMUint16Array.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMUint16Array.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMUint16ArrayInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMUint32Array.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMUint32Array.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMUint32ArrayInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMUint8Array.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMUint8Array.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMUint8ArrayInternal.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMValidityState.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMValidityState.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMValidityStateInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMWebGLActiveInfo.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMWebGLActiveInfo.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMWebGLActiveInfoInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMWebGLBuffer.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMWebGLBuffer.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMWebGLBufferInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMWebGLContextAttributes.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMWebGLContextAttributes.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMWebGLContextAttributesInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMWebGLFramebuffer.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMWebGLFramebuffer.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMWebGLFramebufferInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMWebGLProgram.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMWebGLProgram.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMWebGLProgramInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMWebGLRenderbuffer.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMWebGLRenderbuffer.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMWebGLRenderbufferInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMWebGLRenderingContext.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMWebGLRenderingContext.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMWebGLRenderingContextInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMWebGLShader.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMWebGLShader.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMWebGLShaderInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMWebGLTexture.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMWebGLTexture.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMWebGLTextureInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMWebGLUniformLocation.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMWebGLUniformLocation.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMWebGLUniformLocationInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMWebGLVertexArrayObjectOES.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMWebGLVertexArrayObjectOES.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMWebGLVertexArrayObjectOESInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMWebKitAnimation.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMWebKitAnimation.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMWebKitAnimationEvent.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMWebKitAnimationEvent.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMWebKitAnimationEventInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMWebKitAnimationList.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMWebKitAnimationList.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMWebKitCSSKeyframeRule.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMWebKitCSSKeyframeRule.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMWebKitCSSKeyframeRuleInternal.h',
@@ -6851,70 +6901,18 @@
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMWebKitCSSTransformValue.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMWebKitCSSTransformValue.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMWebKitCSSTransformValueInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMWebKitLoseContext.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMWebKitLoseContext.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMWebKitLoseContextInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMWebKitPoint.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMWebKitPoint.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMWebKitPointInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMWebKitTransitionEvent.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMWebKitTransitionEvent.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMWebKitTransitionEventInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMWebSocket.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMWebSocket.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMWebSocketInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMWheelEvent.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMWheelEvent.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMWheelEventInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMWorker.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMWorker.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMWorkerContext.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMWorkerContext.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMWorkerContextInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMWorkerInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMWorkerLocation.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMWorkerLocation.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMWorkerLocationInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMWorkerNavigator.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMWorkerNavigator.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMWorkerNavigatorInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMXMLHttpRequest.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMXMLHttpRequest.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMXMLHttpRequestException.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMXMLHttpRequestException.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMXMLHttpRequestExceptionInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMXMLHttpRequestInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMXMLHttpRequestProgressEvent.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMXMLHttpRequestProgressEvent.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMXMLHttpRequestProgressEventInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMXMLHttpRequestUpload.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMXMLHttpRequestUpload.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMXMLHttpRequestUploadInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMXMLSerializer.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMXMLSerializer.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMXMLSerializerInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMXPathEvaluator.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMXPathEvaluator.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMXPathEvaluatorInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMXPathException.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMXPathException.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMXPathExceptionInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMXPathExpression.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMXPathExpression.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMXPathExpressionInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMXPathNSResolver.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMXPathResult.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMXPathResult.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMXPathResultInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMXSLTProcessor.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMXSLTProcessor.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMXSLTProcessorInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DebuggerScriptSource.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DocTypeStrings.cpp',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/HTMLElementFactory.cpp',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/HTMLElementFactory.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/HTMLEntityTable.cpp',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/HTMLNames.cpp',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/HTMLNames.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/HeaderDetection.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/InjectedScriptSource.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/InspectorBackendDispatcher.cpp',
@@ -6989,7 +6987,6 @@
             '<(PRODUCT_DIR)/DerivedSources/WebCore/JSCSSRuleList.cpp',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/JSCSSRuleList.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/JSCSSStyleDeclaration.cpp',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/JSCSSStyleDeclaration.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/JSCSSStyleRule.cpp',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/JSCSSStyleRule.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/JSCSSStyleSheet.cpp',
@@ -7067,7 +7064,6 @@
             '<(PRODUCT_DIR)/DerivedSources/WebCore/JSDOMURL.cpp',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/JSDOMURL.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/JSDOMWindow.cpp',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/JSDOMWindow.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/JSDataGridColumn.cpp',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/JSDataGridColumn.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/JSDataGridColumnList.cpp',
@@ -7097,13 +7093,11 @@
             '<(PRODUCT_DIR)/DerivedSources/WebCore/JSDirectoryReaderSync.cpp',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/JSDirectoryReaderSync.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/JSDocument.cpp',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/JSDocument.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/JSDocumentFragment.cpp',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/JSDocumentFragment.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/JSDocumentType.cpp',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/JSDocumentType.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/JSElement.cpp',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/JSElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/JSElementTimeControl.cpp',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/JSElementTimeControl.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/JSEntity.cpp',
@@ -7213,7 +7207,6 @@
             '<(PRODUCT_DIR)/DerivedSources/WebCore/JSHTMLDocument.cpp',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/JSHTMLDocument.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/JSHTMLElement.cpp',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/JSHTMLElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/JSHTMLElementWrapperFactory.cpp',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/JSHTMLElementWrapperFactory.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/JSHTMLEmbedElement.cpp',
@@ -7399,13 +7392,11 @@
             '<(PRODUCT_DIR)/DerivedSources/WebCore/JSNavigator.cpp',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/JSNavigator.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/JSNode.cpp',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/JSNode.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/JSNodeFilter.cpp',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/JSNodeFilter.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/JSNodeIterator.cpp',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/JSNodeIterator.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/JSNodeList.cpp',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/JSNodeList.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/JSNotation.cpp',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/JSNotation.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/JSNotification.cpp',
@@ -7439,7 +7430,6 @@
             '<(PRODUCT_DIR)/DerivedSources/WebCore/JSRGBColor.cpp',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/JSRGBColor.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/JSRange.cpp',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/JSRange.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/JSRangeException.cpp',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/JSRangeException.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/JSRealtimeAnalyserNode.cpp',
@@ -7885,8 +7875,12 @@
             '<(PRODUCT_DIR)/DerivedSources/WebCore/JSWebGLUniformLocation.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/JSWebGLVertexArrayObjectOES.cpp',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/JSWebGLVertexArrayObjectOES.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/JSWebKitAnimation.cpp',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/JSWebKitAnimation.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/JSWebKitAnimationEvent.cpp',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/JSWebKitAnimationEvent.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/JSWebKitAnimationList.cpp',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/JSWebKitAnimationList.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/JSWebKitCSSKeyframeRule.cpp',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/JSWebKitCSSKeyframeRule.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/JSWebKitCSSKeyframesRule.cpp',
@@ -7942,7 +7936,6 @@
             '<(PRODUCT_DIR)/DerivedSources/WebCore/SVGElementFactory.cpp',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/SVGElementFactory.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/SVGNames.cpp',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/SVGNames.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/UserAgentStyleSheets.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/UserAgentStyleSheetsData.cpp',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/WMLElementFactory.cpp',
@@ -7958,5 +7951,8 @@
             '<(PRODUCT_DIR)/DerivedSources/WebCore/XPathGrammar.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/tokenizer.cpp',
         ],
+        'export_file_generator_files': [
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/ExportFileGenerator.cpp',
+        ],
     }
 }
diff --git a/Source/WebCore/WebCore.order b/Source/WebCore/WebCore.order
index 65c7d84..af1a2ab 100644
--- a/Source/WebCore/WebCore.order
+++ b/Source/WebCore/WebCore.order
@@ -16003,7 +16003,7 @@ __ZNK7WebCore16PDFDocumentImage4sizeEv
 __ZN7WebCore5Image26nativeImageForCurrentFrameEv
 __ZN7WebCore5Image14resetAnimationEv
 __ZN7WebCore11RenderLayer29updateRepaintRectsAfterScrollEb
-__ZNK7WebCore5Frame15layerTreeAsTextEv
+__ZNK7WebCore5Frame15layerTreeAsTextEb
 __ZNK7WebCore13GraphicsLayer15layerTreeAsTextEj
 __ZNK7WebCore13GraphicsLayer9dumpLayerERNS_10TextStreamEij
 __ZN7WebCoreL11writeIndentERNS_10TextStreamEi
diff --git a/Source/WebCore/WebCore.pri b/Source/WebCore/WebCore.pri
index 3946384..3644184 100644
--- a/Source/WebCore/WebCore.pri
+++ b/Source/WebCore/WebCore.pri
@@ -91,6 +91,7 @@ WEBCORE_INCLUDEPATH = \
     $$SOURCE_DIR/WebCore/platform/audio \
     $$SOURCE_DIR/WebCore/platform/graphics \
     $$SOURCE_DIR/WebCore/platform/graphics/filters \
+    $$SOURCE_DIR/WebCore/platform/graphics/texmap \
     $$SOURCE_DIR/WebCore/platform/graphics/transforms \
     $$SOURCE_DIR/WebCore/platform/image-decoders \
     $$SOURCE_DIR/WebCore/platform/mock \
@@ -311,6 +312,7 @@ contains (CONFIG, text_breaking_with_icu) {
 }
 
 win32-* {
+    INCLUDEPATH += $$SOURCE_DIR/WebCore/platform/win
     LIBS += -lgdi32
     LIBS += -lole32
     LIBS += -luser32
diff --git a/Source/WebCore/WebCore.pro b/Source/WebCore/WebCore.pro
index 583df14..2ac917a 100644
--- a/Source/WebCore/WebCore.pro
+++ b/Source/WebCore/WebCore.pro
@@ -13,6 +13,9 @@ CONFIG += staticlib
 
 DESTDIR = $$WEBCORE_DESTDIR
 
+DEFINES += BUILDING_WEBKIT
+DEFINES += QT_MAKEDLL
+
 contains(DEFINES, WTF_USE_QT_MOBILE_THEME=1) {
     DEFINES += ENABLE_NO_LISTBOX_RENDERING=1
 }
@@ -90,6 +93,7 @@ v8 {
         bindings/v8/DOMDataStore.cpp \
         bindings/v8/MainThreadDOMData.cpp \
         bindings/v8/NPV8Object.cpp \
+        bindings/v8/RetainedDOMInfo.cpp \
         bindings/v8/ScheduledAction.cpp \
         bindings/v8/ScopedDOMDataStore.cpp \
         bindings/v8/ScriptCachedFrameData.cpp \
@@ -203,6 +207,7 @@ v8 {
         bindings/v8/custom/V8StorageCustom.cpp \
         bindings/v8/custom/V8StyleSheetCustom.cpp \
         bindings/v8/custom/V8StyleSheetListCustom.cpp \
+        bindings/v8/custom/V8WebKitAnimationCustom.cpp \
         bindings/v8/custom/V8WebKitCSSMatrixConstructor.cpp \
         bindings/v8/custom/V8WebKitPointConstructor.cpp \
         bindings/v8/custom/V8WorkerContextCustom.cpp \
@@ -300,6 +305,7 @@ v8 {
         bindings/js/JSImageConstructor.cpp \
         bindings/js/JSImageDataCustom.cpp \
         bindings/js/JSInjectedScriptHostCustom.cpp \
+        bindings/js/JSInjectedScriptManager.cpp \
         bindings/js/JSInspectorFrontendHostCustom.cpp \
         bindings/js/JSInt16ArrayCustom.cpp \
         bindings/js/JSInt32ArrayCustom.cpp \
@@ -332,12 +338,15 @@ v8 {
         bindings/js/JSUint16ArrayCustom.cpp \
         bindings/js/JSUint32ArrayCustom.cpp \
         bindings/js/JSUint8ArrayCustom.cpp \
+        bindings/js/JSWebKitAnimationCustom.cpp \
+        bindings/js/JSWebKitAnimationListCustom.cpp \
         bindings/js/JSWebKitCSSKeyframeRuleCustom.cpp \
         bindings/js/JSWebKitCSSKeyframesRuleCustom.cpp \
         bindings/js/JSWebKitCSSMatrixCustom.cpp \
         bindings/js/JSWebKitPointCustom.cpp \
         bindings/js/JSXMLHttpRequestCustom.cpp \
         bindings/js/JSXMLHttpRequestUploadCustom.cpp \
+        bindings/js/PageScriptDebugServer.cpp \
         bindings/js/ScheduledAction.cpp \
         bindings/js/ScriptCachedFrameData.cpp \
         bindings/js/ScriptCallStackFactory.cpp \
@@ -389,6 +398,7 @@ SOURCES += \
     css/CSSImportRule.cpp \
     css/CSSInheritedValue.cpp \
     css/CSSInitialValue.cpp \
+    css/CSSLineBoxContainValue.cpp \
     css/CSSMediaRule.cpp \
     css/CSSMutableStyleDeclaration.cpp \
     css/CSSOMUtils.cpp \
@@ -406,6 +416,7 @@ SOURCES += \
     css/CSSSelector.cpp \
     css/CSSSelectorList.cpp \
     css/CSSSegmentedFontFace.cpp \
+    css/CSSStyleApplyProperty.cpp \
     css/CSSStyleDeclaration.cpp \
     css/CSSStyleRule.cpp \
     css/CSSStyleSelector.cpp \
@@ -435,7 +446,6 @@ SOURCES += \
     css/WebKitCSSMatrix.cpp \
     css/WebKitCSSTransformValue.cpp \
     dom/ActiveDOMObject.cpp \
-    dom/AsyncScriptRunner.cpp \
     dom/Attr.cpp \
     dom/Attribute.cpp \
     dom/BeforeProcessEvent.cpp \
@@ -479,6 +489,7 @@ SOURCES += \
     dom/ErrorEvent.cpp \
     dom/Event.cpp \
     dom/EventContext.cpp \
+    dom/EventDispatcher.cpp \
     dom/EventNames.cpp \
     dom/EventTarget.cpp \
     dom/EventQueue.cpp \
@@ -519,6 +530,7 @@ SOURCES += \
     dom/ScriptableDocumentParser.cpp \
     dom/ScriptElement.cpp \
     dom/ScriptExecutionContext.cpp \
+    dom/ScriptRunner.cpp \
     dom/SelectElement.cpp \
     dom/SelectorNodeList.cpp \
     dom/SpaceSplitString.cpp \
@@ -791,8 +803,10 @@ SOURCES += \
     html/shadow/SliderThumbElement.cpp \
     html/shadow/TextControlInnerElements.cpp \
     inspector/ConsoleMessage.cpp \
+    inspector/DOMNodeHighlighter.cpp \
     inspector/InjectedScript.cpp \
     inspector/InjectedScriptHost.cpp \
+    inspector/InjectedScriptManager.cpp \
     inspector/InspectorAgent.cpp \
     inspector/InspectorApplicationCacheAgent.cpp \
     inspector/InspectorBrowserDebuggerAgent.cpp \
@@ -809,6 +823,7 @@ SOURCES += \
     inspector/InspectorFrontendClientLocal.cpp \
     inspector/InspectorFrontendHost.cpp \
     inspector/InspectorInstrumentation.cpp \
+    inspector/InspectorPageAgent.cpp \
     inspector/InspectorProfilerAgent.cpp \
     inspector/InspectorResourceAgent.cpp \
     inspector/InspectorRuntimeAgent.cpp \
@@ -816,10 +831,12 @@ SOURCES += \
     inspector/InspectorStyleSheet.cpp \
     inspector/InspectorTimelineAgent.cpp \
     inspector/InspectorValues.cpp \
+    inspector/PageDebuggerAgent.cpp \
     inspector/ScriptArguments.cpp \
     inspector/ScriptCallFrame.cpp \
     inspector/ScriptCallStack.cpp \
     inspector/TimelineRecordFactory.cpp \
+    inspector/WorkerDebuggerAgent.cpp \
     loader/archive/ArchiveResource.cpp \
     loader/archive/ArchiveResourceCollection.cpp \
     loader/cache/MemoryCache.cpp \
@@ -844,6 +861,7 @@ SOURCES += \
     loader/FrameLoaderStateMachine.cpp \
     loader/HistoryController.cpp \
     loader/FTPDirectoryParser.cpp \
+    loader/icon/IconDatabaseBase.cpp \
     loader/icon/IconLoader.cpp \
     loader/ImageLoader.cpp \
     loader/MainResourceLoader.cpp \
@@ -870,6 +888,8 @@ SOURCES += \
     page/animation/CompositeAnimation.cpp \
     page/animation/ImplicitAnimation.cpp \
     page/animation/KeyframeAnimation.cpp \
+    page/WebKitAnimation.cpp \
+    page/WebKitAnimationList.cpp \
     page/BarInfo.cpp \
     page/Chrome.cpp \
     page/Console.cpp \
@@ -928,6 +948,7 @@ SOURCES += \
     platform/text/LocalizedNumberNone.cpp \
     platform/ContentType.cpp \
     platform/CrossThreadCopier.cpp \
+    platform/DefaultLocalizationStrategy.cpp \
     platform/DragData.cpp \
     platform/DragImage.cpp \
     platform/FileChooser.cpp \
@@ -1198,6 +1219,8 @@ v8 {
         bindings/v8/npruntime_priv.h \
         bindings/v8/NPV8Object.h \
         bindings/v8/OwnHandle.h \
+        bindings/v8/RetainedDOMInfo.h \
+        bindings/v8/RetainedObjectInfo.h \
         bindings/v8/ScheduledAction.h \
         bindings/v8/ScopedDOMDataStore.h \
         bindings/v8/ScriptCachedFrameData.h \
@@ -1281,9 +1304,11 @@ v8 {
         bindings/js/JSStorageCustom.h \
         bindings/js/JSWorkerContextBase.h \
         bindings/js/JavaScriptCallFrame.h \
+        bindings/js/PageScriptDebugServer.h \
         bindings/js/ScheduledAction.h \
         bindings/js/ScriptCachedFrameData.h \
         bindings/js/ScriptController.h \
+        bindings/js/ScriptDebugServer.h \
         bindings/js/ScriptEventListener.h \
         bindings/js/ScriptFunctionCall.h \
         bindings/js/ScriptGCEvent.h \
@@ -1301,6 +1326,7 @@ v8 {
         bindings/js/StringSourceProvider.h \
         bindings/js/WebCoreJSClientData.h \
         bindings/js/WorkerScriptController.h \
+        bindings/js/WorkerScriptDebugServer.h \
         bridge/Bridge.h \
         bridge/c/CRuntimeObject.h \
         bridge/c/c_class.h \
@@ -1356,6 +1382,7 @@ HEADERS += \
     css/CSSSegmentedFontFace.h \
     css/CSSSelector.h \
     css/CSSSelectorList.h \
+    css/CSSStyleApplyProperty.h \
     css/CSSStyleDeclaration.h \
     css/CSSStyleRule.h \
     css/CSSStyleSelector.h \
@@ -1706,8 +1733,10 @@ HEADERS += \
     html/parser/HTMLViewSourceParser.h \
     html/parser/XSSFilter.h \
     inspector/ConsoleMessage.h \
+    inspector/DOMNodeHighlighter.h \
     inspector/InjectedScript.h \
     inspector/InjectedScriptHost.h \
+    inspector/InjectedScriptManager.h \
     inspector/InspectorAgent.h \
     inspector/InspectorApplicationCacheAgent.h \
     inspector/InspectorBrowserDebuggerAgent.h \
@@ -1725,6 +1754,7 @@ HEADERS += \
     inspector/InspectorFrontendClientLocal.h \
     inspector/InspectorFrontendHost.h \
     inspector/InspectorInstrumentation.h \
+    inspector/InspectorPageAgent.h \
     inspector/InspectorProfilerAgent.h \
     inspector/InspectorResourceAgent.h \
     inspector/InspectorRuntimeAgent.h \
@@ -1732,8 +1762,10 @@ HEADERS += \
     inspector/InspectorStyleSheet.h \
     inspector/InspectorTimelineAgent.h \
     inspector/InstrumentingAgents.h \
+    inspector/PageDebuggerAgent.h \
     inspector/ScriptGCEventListener.h \
     inspector/TimelineRecordFactory.h \
+    inspector/WorkerDebuggerAgent.h \
     loader/appcache/ApplicationCacheGroup.h \
     loader/appcache/ApplicationCacheHost.h \
     loader/appcache/ApplicationCache.h \
@@ -1763,6 +1795,7 @@ HEADERS += \
     loader/FrameLoaderStateMachine.h \
     loader/FTPDirectoryParser.h \
     loader/icon/IconDatabase.h \
+    loader/icon/IconDatabaseBase.h \
     loader/icon/IconLoader.h \
     loader/icon/IconRecord.h \
     loader/icon/PageURLRecord.h \
@@ -1833,6 +1866,8 @@ HEADERS += \
     page/SpeechInputListener.h \
     page/SpeechInputResult.h \
     page/SpeechInputResultList.h \
+    page/WebKitAnimation.h \
+    page/WebKitAnimationList.h \
     page/WindowFeatures.h \
     page/WorkerNavigator.h \
     platform/animation/Animation.h \
@@ -1842,6 +1877,7 @@ HEADERS += \
     platform/ContentType.h \
     platform/ContextMenu.h \
     platform/CrossThreadCopier.h \
+    platform/DefaultLocalizationStrategy.h \
     platform/DragData.h \
     platform/DragImage.h \
     platform/FileChooser.h \
@@ -1927,6 +1963,7 @@ HEADERS += \
     platform/Length.h \
     platform/text/LineEnding.h \
     platform/text/TextCheckerClient.h \
+    platform/text/TextChecking.h \
     platform/LinkHash.h \
     platform/Logging.h \
     platform/Language.h \
@@ -2523,7 +2560,9 @@ contains(DEFINES, ENABLE_SMOOTH_SCROLLING=1) {
 }
 
 win32-*|wince* {
+    HEADERS += platform/win/SystemInfo.h
     SOURCES += \
+        platform/win/SystemInfo.cpp \
         platform/win/SystemTimeWin.cpp \
         platform/graphics/win/TransformationMatrixWin.cpp
 }
@@ -2692,6 +2731,16 @@ contains(DEFINES, ENABLE_INDEXED_DATABASE=1) {
         storage/IDBTransaction.cpp
 }
 
+contains(DEFINES, ENABLE_DATA_TRANSFER_ITEMS=1) {
+    HEADERS += \
+        dom/DataTransferItem.h \
+        dom/DataTransferItems.h \
+        dom/StringCallback.h
+    SOURCES += \
+        dom/DataTransferItem.cpp \
+        dom/StringCallback.cpp
+}
+
 contains(DEFINES, ENABLE_DOM_STORAGE=1) {
     HEADERS += \
         storage/AbstractDatabase.h \
@@ -2707,6 +2756,7 @@ contains(DEFINES, ENABLE_DOM_STORAGE=1) {
         storage/LocalStorageThread.h \
         storage/OriginQuotaManager.h \
         storage/OriginUsageRecord.h \
+        storage/SQLCallbackWrapper.h \
         storage/SQLResultSet.h \
         storage/SQLResultSetRowList.h \
         storage/SQLStatement.h \
@@ -2725,7 +2775,9 @@ contains(DEFINES, ENABLE_DOM_STORAGE=1) {
         storage/StorageMap.h \
         storage/StorageNamespace.h \
         storage/StorageNamespaceImpl.h \
-        storage/StorageSyncManager.h
+        storage/StorageSyncManager.h \
+        storage/StorageTracker.h \
+        storage/StorageTrackerClient.h
 
     !v8 {
         SOURCES += \
@@ -2742,7 +2794,8 @@ contains(DEFINES, ENABLE_DOM_STORAGE=1) {
         storage/StorageMap.cpp \
         storage/StorageNamespace.cpp \
         storage/StorageNamespaceImpl.cpp \
-        storage/StorageSyncManager.cpp
+        storage/StorageSyncManager.cpp \
+        storage/StorageTracker.cpp
 }
 
 contains(DEFINES, ENABLE_FILE_SYSTEM=1) {
@@ -2816,9 +2869,6 @@ contains(DEFINES, ENABLE_ICONDATABASE=1) {
         loader/icon/IconDatabase.cpp \
         loader/icon/IconRecord.cpp \
         loader/icon/PageURLRecord.cpp
-} else {
-    SOURCES += \
-        loader/icon/IconDatabaseNone.cpp
 }
 
 contains(DEFINES, ENABLE_WORKERS=1) {
@@ -2828,7 +2878,8 @@ contains(DEFINES, ENABLE_WORKERS=1) {
             bindings/js/JSWorkerContextBase.cpp \
             bindings/js/JSWorkerContextCustom.cpp \
             bindings/js/JSWorkerCustom.cpp \
-            bindings/js/WorkerScriptController.cpp
+            bindings/js/WorkerScriptController.cpp \
+            bindings/js/WorkerScriptDebugServer.cpp
     }
     SOURCES += \
         loader/WorkerThreadableLoader.cpp \
@@ -3369,9 +3420,9 @@ contains(DEFINES, ENABLE_WEBGL=1) {
         html/canvas/OESStandardDerivatives.h \
         html/canvas/OESTextureFloat.h \
         html/canvas/OESVertexArrayObject.h \
-        html/canvas/OESVertexArray.h \
         html/canvas/WebGLTexture.h \
         html/canvas/WebGLUniformLocation.h \
+        html/canvas/WebGLVertexArrayObjectOES.h \
         html/canvas/WebKitLoseContext.h \
         platform/graphics/Extensions3D.h \
         platform/graphics/GraphicsContext3D.h \
@@ -3398,9 +3449,9 @@ contains(DEFINES, ENABLE_WEBGL=1) {
         html/canvas/OESStandardDerivatives.cpp \
         html/canvas/OESTextureFloat.cpp \
         html/canvas/OESVertexArrayObject.cpp \
-        html/canvas/OESVertexArray.cpp \
         html/canvas/WebGLTexture.cpp \
         html/canvas/WebGLUniformLocation.cpp \
+        html/canvas/WebGLVertexArrayObjectOES.cpp \
         html/canvas/WebKitLoseContext.cpp \
         platform/graphics/GraphicsContext3D.cpp \
         platform/graphics/gpu/DrawingBuffer.cpp \
diff --git a/Source/WebCore/WebCore.vcproj/QTMovieWin.vcproj b/Source/WebCore/WebCore.vcproj/QTMovieWin.vcproj
index 3c9cc6f..3e944b7 100644
--- a/Source/WebCore/WebCore.vcproj/QTMovieWin.vcproj
+++ b/Source/WebCore/WebCore.vcproj/QTMovieWin.vcproj
@@ -18,7 +18,7 @@
 		<Configuration
 			Name="Debug|Win32"
 			ConfigurationType="2"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;.\QTMovieWinCommon.vsprops"
+			InheritedPropertySheets=".\QTMovieWinDebug.vsprops"
 			CharacterSet="1"
 			>
 			<Tool
@@ -79,7 +79,7 @@
 		<Configuration
 			Name="Release|Win32"
 			ConfigurationType="2"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;.\QTMovieWinCommon.vsprops"
+			InheritedPropertySheets=".\QTMovieWinRelease.vsprops"
 			CharacterSet="1"
 			>
 			<Tool
@@ -140,7 +140,7 @@
 		<Configuration
 			Name="Debug_All|Win32"
 			ConfigurationType="2"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\debug_all.vsprops;.\QTMovieWinCommon.vsprops"
+			InheritedPropertySheets=".\QTMovieWinDebugAll.vsprops"
 			CharacterSet="1"
 			>
 			<Tool
@@ -199,9 +199,9 @@
 			/>
 		</Configuration>
 		<Configuration
-			Name="Release_LTCG|Win32"
+			Name="Production|Win32"
 			ConfigurationType="2"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;.\QTMovieWinCommon.vsprops"
+			InheritedPropertySheets=".\QTMovieWinProduction.vsprops"
 			CharacterSet="1"
 			WholeProgramOptimization="1"
 			>
@@ -263,7 +263,7 @@
 		<Configuration
 			Name="Release_Cairo_CFLite|Win32"
 			ConfigurationType="2"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefinesCairo.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\WinCairo.vsprops;.\QTMovieWinCommon.vsprops"
+			InheritedPropertySheets=".\QTMovieWinReleaseCairoCFLite.vsprops"
 			CharacterSet="1"
 			>
 			<Tool
@@ -324,7 +324,7 @@
 		<Configuration
 			Name="Debug_Cairo_CFLite|Win32"
 			ConfigurationType="2"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefinesCairo.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\debug_wincairo.vsprops;.\QTMovieWinCommon.vsprops"
+			InheritedPropertySheets=".\QTMovieWinDebugCairoCFLite.vsprops"
 			CharacterSet="1"
 			>
 			<Tool
diff --git a/Source/WebCore/WebCore.vcproj/QTMovieWinDebug.vsprops b/Source/WebCore/WebCore.vcproj/QTMovieWinDebug.vsprops
new file mode 100644
index 0000000..158353e
--- /dev/null
+++ b/Source/WebCore/WebCore.vcproj/QTMovieWinDebug.vsprops
@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="QTMovieWinDebug"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;
+      .\QTMovieWinCommon.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Source/WebCore/WebCore.vcproj/QTMovieWinDebugAll.vsprops b/Source/WebCore/WebCore.vcproj/QTMovieWinDebugAll.vsprops
new file mode 100644
index 0000000..9d2bb0f
--- /dev/null
+++ b/Source/WebCore/WebCore.vcproj/QTMovieWinDebugAll.vsprops
@@ -0,0 +1,13 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="QTMovieWinDebugAll"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\debug_all.vsprops;
+      .\QTMovieWinCommon.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Source/WebCore/WebCore.vcproj/QTMovieWinDebugCairoCFLite.vsprops b/Source/WebCore/WebCore.vcproj/QTMovieWinDebugCairoCFLite.vsprops
new file mode 100644
index 0000000..74bdd57
--- /dev/null
+++ b/Source/WebCore/WebCore.vcproj/QTMovieWinDebugCairoCFLite.vsprops
@@ -0,0 +1,13 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="QTMovieWinDebugCairoCFLite"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefinesCairo.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\debug_wincairo.vsprops;
+      .\QTMovieWinCommon.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Source/WebCore/WebCore.vcproj/QTMovieWinProduction.vsprops b/Source/WebCore/WebCore.vcproj/QTMovieWinProduction.vsprops
new file mode 100644
index 0000000..5001f2b
--- /dev/null
+++ b/Source/WebCore/WebCore.vcproj/QTMovieWinProduction.vsprops
@@ -0,0 +1,13 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="QTMovieWinProduction"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\production.vsprops;
+      .\QTMovieWinCommon.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Source/WebCore/WebCore.vcproj/QTMovieWinRelease.vsprops b/Source/WebCore/WebCore.vcproj/QTMovieWinRelease.vsprops
new file mode 100644
index 0000000..aab50d9
--- /dev/null
+++ b/Source/WebCore/WebCore.vcproj/QTMovieWinRelease.vsprops
@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="QTMovieWinRelease"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
+      .\QTMovieWinCommon.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Source/WebCore/WebCore.vcproj/QTMovieWinReleaseCairoCFLite.vsprops b/Source/WebCore/WebCore.vcproj/QTMovieWinReleaseCairoCFLite.vsprops
new file mode 100644
index 0000000..df313d2
--- /dev/null
+++ b/Source/WebCore/WebCore.vcproj/QTMovieWinReleaseCairoCFLite.vsprops
@@ -0,0 +1,13 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="QTMovieWinReleaseCairoCFLite"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefinesCairo.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\WinCairo.vsprops;
+      .\QTMovieWinCommon.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Source/WebCore/WebCore.vcproj/WebCore.make b/Source/WebCore/WebCore.vcproj/WebCore.make
index 1be2edd..be313dc 100644
--- a/Source/WebCore/WebCore.vcproj/WebCore.make
+++ b/Source/WebCore/WebCore.vcproj/WebCore.make
@@ -1,11 +1,10 @@
 !IF "$(BUILDSTYLE)"=="DEBUG"
 BUILDSTYLE=Debug_All
 !ELSE
-BUILDSTYLE=Release_LTCG
+BUILDSTYLE=Production
 !ENDIF
 
 install:
-    set PRODUCTION=1
 	set WebKitLibrariesDir=$(SRCROOT)\AppleInternal
 	set WebKitOutputDir=$(OBJROOT)
 	set ConfigurationBuildDir=$(OBJROOT)\$(BUILDSTYLE)
diff --git a/Source/WebCore/WebCore.vcproj/WebCore.sln b/Source/WebCore/WebCore.vcproj/WebCore.sln
index 4290107..0ab426b 100644
--- a/Source/WebCore/WebCore.vcproj/WebCore.sln
+++ b/Source/WebCore/WebCore.vcproj/WebCore.sln
@@ -15,7 +15,7 @@ Global
 	GlobalSection(SolutionConfigurationPlatforms) = preSolution
 		Debug_All|Win32 = Debug_All|Win32
 		Debug|Win32 = Debug|Win32
-		Release_LTCG|Win32 = Release_LTCG|Win32
+		Production|Win32 = Production|Win32
 		Release|Win32 = Release|Win32
 	EndGlobalSection
 	GlobalSection(ProjectConfigurationPlatforms) = postSolution
@@ -23,24 +23,24 @@ Global
 		{1C16337B-ACF3-4D03-AA90-851C5B5EADA6}.Debug_All|Win32.Build.0 = Debug_All|Win32
 		{1C16337B-ACF3-4D03-AA90-851C5B5EADA6}.Debug|Win32.ActiveCfg = Debug|Win32
 		{1C16337B-ACF3-4D03-AA90-851C5B5EADA6}.Debug|Win32.Build.0 = Debug|Win32
-		{1C16337B-ACF3-4D03-AA90-851C5B5EADA6}.Release_LTCG|Win32.ActiveCfg = Release_LTCG|Win32
-		{1C16337B-ACF3-4D03-AA90-851C5B5EADA6}.Release_LTCG|Win32.Build.0 = Release_LTCG|Win32
+		{1C16337B-ACF3-4D03-AA90-851C5B5EADA6}.Production|Win32.ActiveCfg = Production|Win32
+		{1C16337B-ACF3-4D03-AA90-851C5B5EADA6}.Production|Win32.Build.0 = Production|Win32
 		{1C16337B-ACF3-4D03-AA90-851C5B5EADA6}.Release|Win32.ActiveCfg = Release|Win32
 		{1C16337B-ACF3-4D03-AA90-851C5B5EADA6}.Release|Win32.Build.0 = Release|Win32
 		{0A324352-B3B6-496C-9E5B-4C7E923E628B}.Debug_All|Win32.ActiveCfg = Debug_All|Win32
 		{0A324352-B3B6-496C-9E5B-4C7E923E628B}.Debug_All|Win32.Build.0 = Debug_All|Win32
 		{0A324352-B3B6-496C-9E5B-4C7E923E628B}.Debug|Win32.ActiveCfg = Debug|Win32
 		{0A324352-B3B6-496C-9E5B-4C7E923E628B}.Debug|Win32.Build.0 = Debug|Win32
-		{0A324352-B3B6-496C-9E5B-4C7E923E628B}.Release_LTCG|Win32.ActiveCfg = Release_LTCG|Win32
-		{0A324352-B3B6-496C-9E5B-4C7E923E628B}.Release_LTCG|Win32.Build.0 = Release_LTCG|Win32
+		{0A324352-B3B6-496C-9E5B-4C7E923E628B}.Production|Win32.ActiveCfg = Production|Win32
+		{0A324352-B3B6-496C-9E5B-4C7E923E628B}.Production|Win32.Build.0 = Production|Win32
 		{0A324352-B3B6-496C-9E5B-4C7E923E628B}.Release|Win32.ActiveCfg = Release|Win32
 		{0A324352-B3B6-496C-9E5B-4C7E923E628B}.Release|Win32.Build.0 = Release|Win32
 		{E498CA9D-3BD2-4D52-8E37-C8DC76526325}.Debug_All|Win32.ActiveCfg = Debug_All|Win32
 		{E498CA9D-3BD2-4D52-8E37-C8DC76526325}.Debug_All|Win32.Build.0 = Debug_All|Win32
 		{E498CA9D-3BD2-4D52-8E37-C8DC76526325}.Debug|Win32.ActiveCfg = Debug|Win32
 		{E498CA9D-3BD2-4D52-8E37-C8DC76526325}.Debug|Win32.Build.0 = Debug|Win32
-		{E498CA9D-3BD2-4D52-8E37-C8DC76526325}.Release_LTCG|Win32.ActiveCfg = Release_LTCG|Win32
-		{E498CA9D-3BD2-4D52-8E37-C8DC76526325}.Release_LTCG|Win32.Build.0 = Release_LTCG|Win32
+		{E498CA9D-3BD2-4D52-8E37-C8DC76526325}.Production|Win32.ActiveCfg = Production|Win32
+		{E498CA9D-3BD2-4D52-8E37-C8DC76526325}.Production|Win32.Build.0 = Production|Win32
 		{E498CA9D-3BD2-4D52-8E37-C8DC76526325}.Release|Win32.ActiveCfg = Release|Win32
 		{E498CA9D-3BD2-4D52-8E37-C8DC76526325}.Release|Win32.Build.0 = Release|Win32
 	EndGlobalSection
diff --git a/Source/WebCore/WebCore.vcproj/WebCore.submit.sln b/Source/WebCore/WebCore.vcproj/WebCore.submit.sln
index 344af4b..8373b03 100644
--- a/Source/WebCore/WebCore.vcproj/WebCore.submit.sln
+++ b/Source/WebCore/WebCore.vcproj/WebCore.submit.sln
@@ -17,7 +17,7 @@ Global
 	GlobalSection(SolutionConfigurationPlatforms) = preSolution
 		Debug_All|Win32 = Debug_All|Win32
 		Debug|Win32 = Debug|Win32
-		Release_LTCG|Win32 = Release_LTCG|Win32
+		Production|Win32 = Production|Win32
 		Release|Win32 = Release|Win32
 	EndGlobalSection
 	GlobalSection(ProjectConfigurationPlatforms) = postSolution
@@ -25,24 +25,24 @@ Global
 		{1C16337B-ACF3-4D03-AA90-851C5B5EADA6}.Debug_All|Win32.Build.0 = Debug_All|Win32
 		{1C16337B-ACF3-4D03-AA90-851C5B5EADA6}.Debug|Win32.ActiveCfg = Debug|Win32
 		{1C16337B-ACF3-4D03-AA90-851C5B5EADA6}.Debug|Win32.Build.0 = Debug|Win32
-		{1C16337B-ACF3-4D03-AA90-851C5B5EADA6}.Release_LTCG|Win32.ActiveCfg = Release_LTCG|Win32
-		{1C16337B-ACF3-4D03-AA90-851C5B5EADA6}.Release_LTCG|Win32.Build.0 = Release_LTCG|Win32
+		{1C16337B-ACF3-4D03-AA90-851C5B5EADA6}.Production|Win32.ActiveCfg = Production|Win32
+		{1C16337B-ACF3-4D03-AA90-851C5B5EADA6}.Production|Win32.Build.0 = Production|Win32
 		{1C16337B-ACF3-4D03-AA90-851C5B5EADA6}.Release|Win32.ActiveCfg = Release|Win32
 		{1C16337B-ACF3-4D03-AA90-851C5B5EADA6}.Release|Win32.Build.0 = Release|Win32
 		{0A324352-B3B6-496C-9E5B-4C7E923E628B}.Debug_All|Win32.ActiveCfg = Debug_All|Win32
 		{0A324352-B3B6-496C-9E5B-4C7E923E628B}.Debug_All|Win32.Build.0 = Debug_All|Win32
 		{0A324352-B3B6-496C-9E5B-4C7E923E628B}.Debug|Win32.ActiveCfg = Debug|Win32
 		{0A324352-B3B6-496C-9E5B-4C7E923E628B}.Debug|Win32.Build.0 = Debug|Win32
-		{0A324352-B3B6-496C-9E5B-4C7E923E628B}.Release_LTCG|Win32.ActiveCfg = Release_LTCG|Win32
-		{0A324352-B3B6-496C-9E5B-4C7E923E628B}.Release_LTCG|Win32.Build.0 = Release_LTCG|Win32
+		{0A324352-B3B6-496C-9E5B-4C7E923E628B}.Production|Win32.ActiveCfg = Production|Win32
+		{0A324352-B3B6-496C-9E5B-4C7E923E628B}.Production|Win32.Build.0 = Production|Win32
 		{0A324352-B3B6-496C-9E5B-4C7E923E628B}.Release|Win32.ActiveCfg = Release|Win32
 		{0A324352-B3B6-496C-9E5B-4C7E923E628B}.Release|Win32.Build.0 = Release|Win32
 		{E498CA9D-3BD2-4D52-8E37-C8DC76526325}.Debug_All|Win32.ActiveCfg = Debug_All|Win32
 		{E498CA9D-3BD2-4D52-8E37-C8DC76526325}.Debug_All|Win32.Build.0 = Debug_All|Win32
 		{E498CA9D-3BD2-4D52-8E37-C8DC76526325}.Debug|Win32.ActiveCfg = Debug|Win32
 		{E498CA9D-3BD2-4D52-8E37-C8DC76526325}.Debug|Win32.Build.0 = Debug|Win32
-		{E498CA9D-3BD2-4D52-8E37-C8DC76526325}.Release_LTCG|Win32.ActiveCfg = Release_LTCG|Win32
-		{E498CA9D-3BD2-4D52-8E37-C8DC76526325}.Release_LTCG|Win32.Build.0 = Release_LTCG|Win32
+		{E498CA9D-3BD2-4D52-8E37-C8DC76526325}.Production|Win32.ActiveCfg = Production|Win32
+		{E498CA9D-3BD2-4D52-8E37-C8DC76526325}.Production|Win32.Build.0 = Production|Win32
 		{E498CA9D-3BD2-4D52-8E37-C8DC76526325}.Release|Win32.ActiveCfg = Release|Win32
 		{E498CA9D-3BD2-4D52-8E37-C8DC76526325}.Release|Win32.Build.0 = Release|Win32
 	EndGlobalSection
diff --git a/Source/WebCore/WebCore.vcproj/WebCore.vcproj b/Source/WebCore/WebCore.vcproj/WebCore.vcproj
index 847c04f..f00a591 100755
--- a/Source/WebCore/WebCore.vcproj/WebCore.vcproj
+++ b/Source/WebCore/WebCore.vcproj/WebCore.vcproj
@@ -18,7 +18,7 @@
 		<Configuration
 			Name="Debug|Win32"
 			ConfigurationType="4"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;.\WebCoreCommon.vsprops;.\WebCoreCG.vsprops;.\WebCoreCFNetwork.vsprops;.\WebCorePthreads.vsprops;.\WebCoreMediaQT.vsprops;.\WebCoreQuartzCore.vsprops"
+			InheritedPropertySheets=".\WebCoreDebug.vsprops"
 			CharacterSet="1"
 			>
 			<Tool
@@ -72,7 +72,7 @@
 		<Configuration
 			Name="Release|Win32"
 			ConfigurationType="4"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;.\WebCoreCommon.vsprops;.\WebCoreCG.vsprops;.\WebCoreCFNetwork.vsprops;.\WebCorePthreads.vsprops;.\WebCoreMediaQT.vsprops;.\WebCoreQuartzCore.vsprops"
+			InheritedPropertySheets=".\WebCoreRelease.vsprops"
 			CharacterSet="1"
 			>
 			<Tool
@@ -126,7 +126,7 @@
 		<Configuration
 			Name="Debug_Cairo_CFLite|Win32"
 			ConfigurationType="4"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefinesCairo.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\debug_wincairo.vsprops;.\WebCoreCommon.vsprops;.\WebCoreCairo.vsprops;.\WebCoreCURL.vsprops"
+			InheritedPropertySheets=".\WebCoreDebugCairoCFLite.vsprops"
 			CharacterSet="1"
 			>
 			<Tool
@@ -180,7 +180,7 @@
 		<Configuration
 			Name="Release_Cairo_CFLite|Win32"
 			ConfigurationType="4"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefinesCairo.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\WinCairo.vsprops;.\WebCoreCommon.vsprops;.\WebCoreCairo.vsprops;.\WebCoreCURL.vsprops"
+			InheritedPropertySheets=".\WebCoreReleaseCairoCFLite.vsprops"
 			CharacterSet="1"
 			>
 			<Tool
@@ -234,7 +234,7 @@
 		<Configuration
 			Name="Debug_All|Win32"
 			ConfigurationType="4"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;.\WebCoreCommon.vsprops;.\WebCoreCG.vsprops;.\WebCoreCFNetwork.vsprops;.\WebCorePthreads.vsprops;.\WebCoreMediaQT.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\debug_all.vsprops;.\WebCoreQuartzCore.vsprops"
+			InheritedPropertySheets=".\WebCoreDebugAll.vsprops"
 			CharacterSet="1"
 			>
 			<Tool
@@ -286,9 +286,9 @@
 			/>
 		</Configuration>
 		<Configuration
-			Name="Release_LTCG|Win32"
+			Name="Production|Win32"
 			ConfigurationType="4"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;.\WebCoreCommon.vsprops;.\WebCoreCG.vsprops;.\WebCoreCFNetwork.vsprops;.\WebCorePthreads.vsprops;.\WebCoreMediaQT.vsprops;.\WebCoreQuartzCore.vsprops"
+			InheritedPropertySheets=".\WebCoreProduction.vsprops"
 			CharacterSet="1"
 			WholeProgramOptimization="1"
 			>
@@ -405,7 +405,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					>
 					<Tool
 						Name="VCCLCompilerTool"
@@ -476,7 +476,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					>
 					<Tool
 						Name="VCCLCompilerTool"
@@ -537,7 +537,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -621,7 +621,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -677,7 +677,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -733,7 +733,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -789,7 +789,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -845,7 +845,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -901,7 +901,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -957,7 +957,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -1013,7 +1013,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -1069,7 +1069,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -1125,7 +1125,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -1181,7 +1181,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -1237,7 +1237,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -1293,7 +1293,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -1349,7 +1349,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -1405,7 +1405,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -1461,7 +1461,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -1517,7 +1517,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -1573,7 +1573,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -1629,7 +1629,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -1685,7 +1685,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -1741,7 +1741,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -1797,7 +1797,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -1853,7 +1853,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -1909,7 +1909,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -1965,7 +1965,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -2021,7 +2021,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -2077,7 +2077,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -2133,7 +2133,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -2189,7 +2189,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -2245,7 +2245,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -2301,7 +2301,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -2357,7 +2357,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -2413,7 +2413,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -2469,7 +2469,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -2525,7 +2525,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -2581,7 +2581,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -2637,7 +2637,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -2693,7 +2693,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -2749,7 +2749,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -2805,7 +2805,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -2818,6 +2818,118 @@
 				>
 			</File>
 			<File
+				RelativePath="$(ConfigurationBuildDir)\obj\$(ProjectName)\DerivedSources\JSDataTransferItem.cpp"
+				>
+				<FileConfiguration
+					Name="Debug|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Release|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Debug_Cairo_CFLite|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Release_Cairo_CFLite|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Debug_All|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Production|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+			</File>
+			<File
+				RelativePath="$(ConfigurationBuildDir)\obj\$(ProjectName)\DerivedSources\JSDataTransferItem.h"
+				>
+			</File>
+			<File
+				RelativePath="$(ConfigurationBuildDir)\obj\$(ProjectName)\DerivedSources\JSDataTransferItems.cpp"
+				>
+				<FileConfiguration
+					Name="Debug|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Release|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Debug_Cairo_CFLite|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Release_Cairo_CFLite|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Debug_All|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Production|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+			</File>
+			<File
+				RelativePath="$(ConfigurationBuildDir)\obj\$(ProjectName)\DerivedSources\JSDataTransferItems.h"
+				>
+			</File>
+			<File
 				RelativePath="$(ConfigurationBuildDir)\obj\WebCore\DerivedSources\JSDedicatedWorkerContext.cpp"
 				>
 				<FileConfiguration
@@ -2861,7 +2973,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -2917,7 +3029,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -2973,7 +3085,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -3029,7 +3141,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -3093,7 +3205,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -3157,7 +3269,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -3213,7 +3325,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -3269,7 +3381,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -3325,7 +3437,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -3381,7 +3493,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -3437,7 +3549,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -3501,7 +3613,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -3557,7 +3669,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -3613,7 +3725,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -3669,7 +3781,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -3725,7 +3837,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -3781,7 +3893,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -3837,7 +3949,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -3893,7 +4005,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -3949,7 +4061,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -4005,7 +4117,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -4061,7 +4173,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -4117,7 +4229,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -4173,7 +4285,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -4229,7 +4341,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -4289,7 +4401,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -4345,7 +4457,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -4401,7 +4513,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -4457,7 +4569,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -4513,7 +4625,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -4569,7 +4681,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -4633,7 +4745,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -4697,7 +4809,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -4753,7 +4865,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -4809,7 +4921,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -4865,7 +4977,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -4921,7 +5033,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -4977,7 +5089,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -5057,7 +5169,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -5121,7 +5233,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -5177,7 +5289,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -5241,7 +5353,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -5297,7 +5409,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -5361,7 +5473,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -5417,7 +5529,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -5473,7 +5585,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -5529,7 +5641,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -5585,7 +5697,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -5641,7 +5753,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -5697,7 +5809,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -5753,7 +5865,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -5809,7 +5921,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -5865,7 +5977,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -5921,7 +6033,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -5977,7 +6089,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -6033,7 +6145,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -6089,7 +6201,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -6145,7 +6257,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -6201,7 +6313,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -6257,7 +6369,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -6313,7 +6425,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -6369,7 +6481,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -6425,7 +6537,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -6481,7 +6593,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -6537,7 +6649,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -6593,7 +6705,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -6649,7 +6761,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -6705,7 +6817,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -6761,7 +6873,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -6817,7 +6929,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -6873,7 +6985,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -6929,7 +7041,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -6985,7 +7097,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -7041,7 +7153,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -7097,7 +7209,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -7153,7 +7265,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -7209,7 +7321,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -7265,7 +7377,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -7321,7 +7433,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -7377,7 +7489,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -7433,7 +7545,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -7489,7 +7601,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -7545,7 +7657,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -7601,7 +7713,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -7657,7 +7769,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -7713,7 +7825,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -7769,7 +7881,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -7825,7 +7937,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -7881,7 +7993,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -7937,7 +8049,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -7993,7 +8105,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -8049,7 +8161,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -8105,7 +8217,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -8161,7 +8273,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -8217,7 +8329,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -8273,7 +8385,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -8329,7 +8441,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -8385,7 +8497,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -8441,7 +8553,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -8497,7 +8609,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -8553,7 +8665,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -8609,7 +8721,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -8665,7 +8777,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -8721,7 +8833,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -8777,7 +8889,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -8833,7 +8945,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -8889,7 +9001,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -8945,7 +9057,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -9001,7 +9113,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -9057,7 +9169,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -9113,7 +9225,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -9169,7 +9281,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -9225,7 +9337,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -9281,7 +9393,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -9337,7 +9449,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -9393,7 +9505,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -9449,7 +9561,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -9505,7 +9617,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -9561,7 +9673,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -9617,7 +9729,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -9673,7 +9785,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -9729,7 +9841,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -9785,7 +9897,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -9841,7 +9953,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -9897,7 +10009,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -9953,7 +10065,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -10005,7 +10117,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -10057,7 +10169,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -10109,7 +10221,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -10165,7 +10277,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -10221,7 +10333,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -10277,7 +10389,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -10333,7 +10445,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -10389,7 +10501,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -10445,7 +10557,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -10497,7 +10609,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -10553,7 +10665,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -10609,7 +10721,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -10665,7 +10777,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -10721,7 +10833,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -10777,7 +10889,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -10833,7 +10945,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -10889,7 +11001,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -10945,7 +11057,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -11001,7 +11113,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -11057,7 +11169,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -11113,7 +11225,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -11169,7 +11281,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -11249,7 +11361,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -11305,7 +11417,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -11361,7 +11473,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -11417,7 +11529,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -11473,7 +11585,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -11529,7 +11641,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -11585,7 +11697,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -11641,7 +11753,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -11697,7 +11809,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -11753,7 +11865,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -11809,7 +11921,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -11865,7 +11977,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -11921,7 +12033,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -11977,7 +12089,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -12033,7 +12145,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -12089,7 +12201,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -12145,7 +12257,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -12201,7 +12313,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -12257,7 +12369,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -12313,7 +12425,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -12369,7 +12481,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -12425,7 +12537,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -12481,7 +12593,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -12537,7 +12649,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -12593,7 +12705,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -12649,7 +12761,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -12705,7 +12817,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -12761,7 +12873,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -12817,7 +12929,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -12873,7 +12985,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -12929,7 +13041,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -12985,7 +13097,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -13041,7 +13153,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -13097,7 +13209,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -13153,7 +13265,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -13209,7 +13321,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -13265,7 +13377,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -13321,7 +13433,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -13377,7 +13489,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -13433,7 +13545,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -13446,6 +13558,62 @@
 				>
 			</File>
 			<File
+				RelativePath="$(ConfigurationBuildDir)\obj\$(ProjectName)\DerivedSources\JSStringCallback.cpp"
+				>
+				<FileConfiguration
+					Name="Debug|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Release|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Debug_Cairo_CFLite|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Release_Cairo_CFLite|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Debug_All|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Production|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+			</File>
+			<File
+				RelativePath="$(ConfigurationBuildDir)\obj\$(ProjectName)\DerivedSources\JSStringCallback.h"
+				>
+			</File>
+			<File
 				RelativePath="$(ConfigurationBuildDir)\obj\$(ProjectName)\DerivedSources\JSStyleMedia.cpp"
 				>
 				<FileConfiguration
@@ -13489,7 +13657,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -13545,7 +13713,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -13601,7 +13769,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -13657,7 +13825,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -13713,7 +13881,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -13769,7 +13937,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -13825,7 +13993,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -13881,7 +14049,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -13937,7 +14105,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -13993,7 +14161,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -14049,7 +14217,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -14105,7 +14273,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -14161,7 +14329,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -14217,7 +14385,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -14273,7 +14441,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -14329,7 +14497,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -14385,7 +14553,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -14441,7 +14609,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -14497,7 +14665,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -14553,7 +14721,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -14609,7 +14777,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -14665,7 +14833,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -14721,7 +14889,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -14777,7 +14945,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -14833,7 +15001,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -14889,7 +15057,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -14945,7 +15113,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -15001,7 +15169,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -15057,7 +15225,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -15113,7 +15281,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -15169,7 +15337,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -15225,7 +15393,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -15281,7 +15449,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -15345,7 +15513,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -15401,7 +15569,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -15457,7 +15625,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -15513,7 +15681,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -15569,7 +15737,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -15625,7 +15793,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -15681,7 +15849,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -15737,7 +15905,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -15793,7 +15961,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -15849,7 +16017,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -15905,7 +16073,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -15961,7 +16129,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -16017,7 +16185,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -16073,7 +16241,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -16129,7 +16297,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -16185,7 +16353,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -16241,7 +16409,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -16297,7 +16465,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -16353,7 +16521,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -16409,7 +16577,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -16465,7 +16633,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -16521,7 +16689,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -16577,7 +16745,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -16633,7 +16801,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -16689,7 +16857,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -16745,7 +16913,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -16801,7 +16969,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -16857,7 +17025,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -16913,7 +17081,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -16969,7 +17137,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -17025,7 +17193,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -17081,7 +17249,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -17137,7 +17305,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -17193,7 +17361,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -17249,7 +17417,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -17305,7 +17473,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -17361,7 +17529,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -17417,7 +17585,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -17473,7 +17641,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -17529,7 +17697,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -17585,7 +17753,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -17641,7 +17809,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -17697,7 +17865,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -17753,7 +17921,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -17809,7 +17977,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -17865,7 +18033,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -17921,7 +18089,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -17977,7 +18145,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -18033,7 +18201,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -18089,7 +18257,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -18145,7 +18313,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -18201,7 +18369,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -18257,7 +18425,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -18313,7 +18481,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -18369,7 +18537,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -18425,7 +18593,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -18481,7 +18649,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -18537,7 +18705,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -18593,7 +18761,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -18649,7 +18817,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -18705,7 +18873,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -18761,7 +18929,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -18817,7 +18985,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -18873,7 +19041,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -18929,7 +19097,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -18985,7 +19153,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -19041,7 +19209,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -19097,7 +19265,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -19153,7 +19321,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -19209,7 +19377,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -19265,7 +19433,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -19321,7 +19489,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -19377,7 +19545,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -19433,7 +19601,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -19489,7 +19657,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -19545,7 +19713,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -19601,7 +19769,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -19657,7 +19825,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -19713,7 +19881,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -19769,7 +19937,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -19825,7 +19993,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -19881,7 +20049,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -19937,7 +20105,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -19993,7 +20161,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -20049,7 +20217,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -20105,7 +20273,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -20161,7 +20329,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -20217,7 +20385,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -20273,7 +20441,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -20329,7 +20497,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -20385,7 +20553,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -20441,7 +20609,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -20497,7 +20665,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -20553,7 +20721,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -20609,7 +20777,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -20665,7 +20833,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -20721,7 +20889,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -20777,7 +20945,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -20833,7 +21001,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -20889,7 +21057,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -20945,7 +21113,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -21001,7 +21169,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -21057,7 +21225,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -21113,7 +21281,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -21169,7 +21337,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -21225,7 +21393,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -21281,7 +21449,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -21337,7 +21505,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -21393,7 +21561,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -21449,7 +21617,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -21505,7 +21673,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -21518,6 +21686,62 @@
 				>
 			</File>
 			<File
+				RelativePath="$(ConfigurationBuildDir)\obj\$(ProjectName)\DerivedSources\JSWebKitAnimation.cpp"
+				>
+				<FileConfiguration
+					Name="Debug|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Release|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Debug_Cairo_CFLite|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Release_Cairo_CFLite|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Debug_All|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Production|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+			</File>
+			<File
+				RelativePath="$(ConfigurationBuildDir)\obj\$(ProjectName)\DerivedSources\JSWebKitAnimation.h"
+				>
+			</File>
+			<File
 				RelativePath="$(ConfigurationBuildDir)\obj\$(ProjectName)\DerivedSources\JSWebKitAnimationEvent.cpp"
 				>
 				<FileConfiguration
@@ -21561,7 +21785,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -21574,6 +21798,62 @@
 				>
 			</File>
 			<File
+				RelativePath="$(ConfigurationBuildDir)\obj\$(ProjectName)\DerivedSources\JSWebKitAnimationList.cpp"
+				>
+				<FileConfiguration
+					Name="Debug|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Release|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Debug_Cairo_CFLite|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Release_Cairo_CFLite|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Debug_All|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Production|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+			</File>
+			<File
+				RelativePath="$(ConfigurationBuildDir)\obj\$(ProjectName)\DerivedSources\JSWebKitAnimationList.h"
+				>
+			</File>
+			<File
 				RelativePath="$(ConfigurationBuildDir)\obj\$(ProjectName)\DerivedSources\JSWebKitCSSKeyframeRule.cpp"
 				>
 				<FileConfiguration
@@ -21617,7 +21897,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -21673,7 +21953,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -21729,7 +22009,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -21785,7 +22065,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -21841,7 +22121,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -21897,7 +22177,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -21953,7 +22233,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -22009,7 +22289,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -22065,7 +22345,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -22121,7 +22401,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -22181,7 +22461,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -22237,7 +22517,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -22293,7 +22573,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -22349,7 +22629,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -22405,7 +22685,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -22461,7 +22741,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -22517,7 +22797,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -22573,7 +22853,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -22629,7 +22909,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -22685,7 +22965,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -22741,7 +23021,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -22797,7 +23077,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -22853,7 +23133,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -22949,7 +23229,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -23005,7 +23285,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -23095,7 +23375,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					>
 					<Tool
 						Name="VCCLCompilerTool"
@@ -23161,7 +23441,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -23217,7 +23497,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -23273,7 +23553,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -23329,7 +23609,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -23385,7 +23665,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -23441,7 +23721,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -23497,7 +23777,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -23553,7 +23833,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -23633,7 +23913,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -23689,7 +23969,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -23745,7 +24025,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -23801,7 +24081,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -23857,7 +24137,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -23913,7 +24193,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -23969,7 +24249,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -24025,7 +24305,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -24081,7 +24361,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -24137,7 +24417,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -24193,7 +24473,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -24249,7 +24529,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -24460,14 +24740,14 @@
 			<File
 				RelativePath="..\page\Frame.h"
 				>
-			<File
-				RelativePath="..\page\FrameActionScheduler.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\page\FrameActionScheduler.h"
-				>
-			</File>
+				<File
+					RelativePath="..\page\FrameActionScheduler.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\page\FrameActionScheduler.h"
+					>
+				</File>
 			</File>
 			<File
 				RelativePath="..\page\FrameLoadRequest.h"
@@ -24766,6 +25046,22 @@
 				>
 			</File>
 			<File
+				RelativePath="..\page\WebKitAnimation.cpp"
+				>
+			</File>
+			<File
+				RelativePath="..\page\WebKitAnimation.h"
+				>
+			</File>
+			<File
+				RelativePath="..\page\WebKitAnimationList.cpp"
+				>
+			</File>
+			<File
+				RelativePath="..\page\WebKitAnimationList.h"
+				>
+			</File>
+			<File
 				RelativePath="..\page\WebKitPoint.h"
 				>
 			</File>
@@ -24816,7 +25112,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -25169,6 +25465,14 @@
 					>
 				</File>
 				<File
+					RelativePath="..\loader\icon\IconDatabaseBase.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\loader\icon\IconDatabaseBase.h"
+					>
+				</File>
+				<File
 					RelativePath="..\loader\icon\IconDatabaseClient.h"
 					>
 				</File>
@@ -25486,6 +25790,14 @@
 				>
 			</File>
 			<File
+				RelativePath="..\platform\DefaultLocalizationStrategy.cpp"
+				>
+			</File>
+			<File
+				RelativePath="..\platform\DefaultLocalizationStrategy.h"
+				>
+			</File>
+			<File
 				RelativePath="..\platform\DragImage.cpp"
 				>
 			</File>
@@ -25928,7 +26240,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -25993,6 +26305,10 @@
 					>
 				</File>
 				<File
+					RelativePath="..\platform\win\LocalizedStringsWin.cpp"
+					>
+				</File>
+				<File
 					RelativePath="..\platform\win\LoggingWin.cpp"
 					>
 				</File>
@@ -26005,6 +26321,14 @@
 					>
 				</File>
 				<File
+					RelativePath="..\platform\win\PathWalker.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\platform\win\PathWalker.h"
+					>
+				</File>
+				<File
 					RelativePath="..\platform\win\PlatformMouseEventWin.cpp"
 					>
 				</File>
@@ -26129,7 +26453,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						>
 						<Tool
 							Name="VCCLCompilerTool"
@@ -26199,7 +26523,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						>
 						<Tool
 							Name="VCCLCompilerTool"
@@ -26264,6 +26588,18 @@
 					RelativePath="..\platform\cf\SharedBufferCF.cpp"
 					>
 				</File>
+				<Filter
+					Name="win"
+					>
+					<File
+						RelativePath="..\platform\cf\win\CertificateCFWin.cpp"
+						>
+					</File>
+					<File
+						RelativePath="..\platform\cf\win\CertificateCFWin.h"
+						>
+					</File>
+				</Filter>
 			</Filter>
 			<Filter
 				Name="graphics"
@@ -26316,7 +26652,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -26352,7 +26688,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -26444,7 +26780,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						>
 						<Tool
 							Name="VCCLCompilerTool"
@@ -26505,6 +26841,14 @@
 					>
 				</File>
 				<File
+					RelativePath="..\platform\graphics\FontPlatformData.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\platform\graphics\FontPlatformData.h"
+					>
+				</File>
+				<File
 					RelativePath="..\platform\graphics\FontRenderingMode.h"
 					>
 				</File>
@@ -26640,7 +26984,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -26831,7 +27175,7 @@
 							/>
 						</FileConfiguration>
 						<FileConfiguration
-							Name="Release_LTCG|Win32"
+							Name="Production|Win32"
 							ExcludedFromBuild="true"
 							>
 							<Tool
@@ -26867,7 +27211,7 @@
 							/>
 						</FileConfiguration>
 						<FileConfiguration
-							Name="Release_LTCG|Win32"
+							Name="Production|Win32"
 							ExcludedFromBuild="true"
 							>
 							<Tool
@@ -26943,7 +27287,7 @@
 							/>
 						</FileConfiguration>
 						<FileConfiguration
-							Name="Release_LTCG|Win32"
+							Name="Production|Win32"
 							>
 							<Tool
 								Name="VCCLCompilerTool"
@@ -26979,7 +27323,7 @@
 							/>
 						</FileConfiguration>
 						<FileConfiguration
-							Name="Release_LTCG|Win32"
+							Name="Production|Win32"
 							ExcludedFromBuild="true"
 							>
 							<Tool
@@ -27035,7 +27379,7 @@
 							/>
 						</FileConfiguration>
 						<FileConfiguration
-							Name="Release_LTCG|Win32"
+							Name="Production|Win32"
 							ExcludedFromBuild="true"
 							>
 							<Tool
@@ -27099,7 +27443,7 @@
 							/>
 						</FileConfiguration>
 						<FileConfiguration
-							Name="Release_LTCG|Win32"
+							Name="Production|Win32"
 							ExcludedFromBuild="true"
 							>
 							<Tool
@@ -27315,7 +27659,7 @@
 							/>
 						</FileConfiguration>
 						<FileConfiguration
-							Name="Release_LTCG|Win32"
+							Name="Production|Win32"
 							ExcludedFromBuild="true"
 							>
 							<Tool
@@ -27399,46 +27743,6 @@
 							/>
 						</FileConfiguration>
 					</File>
-					<Filter
-						Name="cairo"
-						>
-						<File
-							RelativePath="..\platform\graphics\win\cairo\FontPlatformData.h"
-							>
-							<FileConfiguration
-								Name="Debug|Win32"
-								ExcludedFromBuild="true"
-								>
-								<Tool
-									Name="VCCustomBuildTool"
-								/>
-							</FileConfiguration>
-							<FileConfiguration
-								Name="Release|Win32"
-								ExcludedFromBuild="true"
-								>
-								<Tool
-									Name="VCCustomBuildTool"
-								/>
-							</FileConfiguration>
-							<FileConfiguration
-								Name="Debug_All|Win32"
-								ExcludedFromBuild="true"
-								>
-								<Tool
-									Name="VCCustomBuildTool"
-								/>
-							</FileConfiguration>
-							<FileConfiguration
-								Name="Release_LTCG|Win32"
-								ExcludedFromBuild="true"
-								>
-								<Tool
-									Name="VCCustomBuildTool"
-								/>
-							</FileConfiguration>
-						</File>
-					</Filter>
 				</Filter>
 				<Filter
 					Name="cg"
@@ -27895,7 +28199,7 @@
 							/>
 						</FileConfiguration>
 						<FileConfiguration
-							Name="Release_LTCG|Win32"
+							Name="Production|Win32"
 							ExcludedFromBuild="true"
 							>
 							<Tool
@@ -27931,7 +28235,7 @@
 							/>
 						</FileConfiguration>
 						<FileConfiguration
-							Name="Release_LTCG|Win32"
+							Name="Production|Win32"
 							ExcludedFromBuild="true"
 							>
 							<Tool
@@ -27967,7 +28271,7 @@
 							/>
 						</FileConfiguration>
 						<FileConfiguration
-							Name="Release_LTCG|Win32"
+							Name="Production|Win32"
 							ExcludedFromBuild="true"
 							>
 							<Tool
@@ -28003,7 +28307,7 @@
 							/>
 						</FileConfiguration>
 						<FileConfiguration
-							Name="Release_LTCG|Win32"
+							Name="Production|Win32"
 							ExcludedFromBuild="true"
 							>
 							<Tool
@@ -28039,7 +28343,7 @@
 							/>
 						</FileConfiguration>
 						<FileConfiguration
-							Name="Release_LTCG|Win32"
+							Name="Production|Win32"
 							ExcludedFromBuild="true"
 							>
 							<Tool
@@ -28075,7 +28379,7 @@
 							/>
 						</FileConfiguration>
 						<FileConfiguration
-							Name="Release_LTCG|Win32"
+							Name="Production|Win32"
 							ExcludedFromBuild="true"
 							>
 							<Tool
@@ -28111,7 +28415,7 @@
 							/>
 						</FileConfiguration>
 						<FileConfiguration
-							Name="Release_LTCG|Win32"
+							Name="Production|Win32"
 							ExcludedFromBuild="true"
 							>
 							<Tool
@@ -28147,7 +28451,7 @@
 							/>
 						</FileConfiguration>
 						<FileConfiguration
-							Name="Release_LTCG|Win32"
+							Name="Production|Win32"
 							ExcludedFromBuild="true"
 							>
 							<Tool
@@ -28183,7 +28487,7 @@
 							/>
 						</FileConfiguration>
 						<FileConfiguration
-							Name="Release_LTCG|Win32"
+							Name="Production|Win32"
 							ExcludedFromBuild="true"
 							>
 							<Tool
@@ -28219,7 +28523,7 @@
 							/>
 						</FileConfiguration>
 						<FileConfiguration
-							Name="Release_LTCG|Win32"
+							Name="Production|Win32"
 							ExcludedFromBuild="true"
 							>
 							<Tool
@@ -28255,7 +28559,7 @@
 							/>
 						</FileConfiguration>
 						<FileConfiguration
-							Name="Release_LTCG|Win32"
+							Name="Production|Win32"
 							ExcludedFromBuild="true"
 							>
 							<Tool
@@ -28291,7 +28595,7 @@
 							/>
 						</FileConfiguration>
 						<FileConfiguration
-							Name="Release_LTCG|Win32"
+							Name="Production|Win32"
 							ExcludedFromBuild="true"
 							>
 							<Tool
@@ -28327,7 +28631,7 @@
 							/>
 						</FileConfiguration>
 						<FileConfiguration
-							Name="Release_LTCG|Win32"
+							Name="Production|Win32"
 							ExcludedFromBuild="true"
 							>
 							<Tool
@@ -28363,7 +28667,7 @@
 							/>
 						</FileConfiguration>
 						<FileConfiguration
-							Name="Release_LTCG|Win32"
+							Name="Production|Win32"
 							ExcludedFromBuild="true"
 							>
 							<Tool
@@ -28399,7 +28703,7 @@
 							/>
 						</FileConfiguration>
 						<FileConfiguration
-							Name="Release_LTCG|Win32"
+							Name="Production|Win32"
 							ExcludedFromBuild="true"
 							>
 							<Tool
@@ -28435,7 +28739,7 @@
 							/>
 						</FileConfiguration>
 						<FileConfiguration
-							Name="Release_LTCG|Win32"
+							Name="Production|Win32"
 							ExcludedFromBuild="true"
 							>
 							<Tool
@@ -28471,7 +28775,7 @@
 							/>
 						</FileConfiguration>
 						<FileConfiguration
-							Name="Release_LTCG|Win32"
+							Name="Production|Win32"
 							ExcludedFromBuild="true"
 							>
 							<Tool
@@ -28507,7 +28811,7 @@
 							/>
 						</FileConfiguration>
 						<FileConfiguration
-							Name="Release_LTCG|Win32"
+							Name="Production|Win32"
 							ExcludedFromBuild="true"
 							>
 							<Tool
@@ -29643,7 +29947,7 @@
 							/>
 						</FileConfiguration>
 						<FileConfiguration
-							Name="Release_LTCG|Win32"
+							Name="Production|Win32"
 							ExcludedFromBuild="true"
 							>
 							<Tool
@@ -29679,7 +29983,7 @@
 							/>
 						</FileConfiguration>
 						<FileConfiguration
-							Name="Release_LTCG|Win32"
+							Name="Production|Win32"
 							ExcludedFromBuild="true"
 							>
 							<Tool
@@ -29715,7 +30019,7 @@
 							/>
 						</FileConfiguration>
 						<FileConfiguration
-							Name="Release_LTCG|Win32"
+							Name="Production|Win32"
 							ExcludedFromBuild="true"
 							>
 							<Tool
@@ -29751,7 +30055,7 @@
 							/>
 						</FileConfiguration>
 						<FileConfiguration
-							Name="Release_LTCG|Win32"
+							Name="Production|Win32"
 							ExcludedFromBuild="true"
 							>
 							<Tool
@@ -29787,7 +30091,7 @@
 							/>
 						</FileConfiguration>
 						<FileConfiguration
-							Name="Release_LTCG|Win32"
+							Name="Production|Win32"
 							ExcludedFromBuild="true"
 							>
 							<Tool
@@ -29823,7 +30127,7 @@
 							/>
 						</FileConfiguration>
 						<FileConfiguration
-							Name="Release_LTCG|Win32"
+							Name="Production|Win32"
 							ExcludedFromBuild="true"
 							>
 							<Tool
@@ -29859,7 +30163,7 @@
 							/>
 						</FileConfiguration>
 						<FileConfiguration
-							Name="Release_LTCG|Win32"
+							Name="Production|Win32"
 							ExcludedFromBuild="true"
 							>
 							<Tool
@@ -29895,7 +30199,7 @@
 							/>
 						</FileConfiguration>
 						<FileConfiguration
-							Name="Release_LTCG|Win32"
+							Name="Production|Win32"
 							ExcludedFromBuild="true"
 							>
 							<Tool
@@ -29931,7 +30235,7 @@
 							/>
 						</FileConfiguration>
 						<FileConfiguration
-							Name="Release_LTCG|Win32"
+							Name="Production|Win32"
 							ExcludedFromBuild="true"
 							>
 							<Tool
@@ -29967,7 +30271,7 @@
 							/>
 						</FileConfiguration>
 						<FileConfiguration
-							Name="Release_LTCG|Win32"
+							Name="Production|Win32"
 							ExcludedFromBuild="true"
 							>
 							<Tool
@@ -30003,7 +30307,7 @@
 							/>
 						</FileConfiguration>
 						<FileConfiguration
-							Name="Release_LTCG|Win32"
+							Name="Production|Win32"
 							ExcludedFromBuild="true"
 							>
 							<Tool
@@ -30039,7 +30343,7 @@
 							/>
 						</FileConfiguration>
 						<FileConfiguration
-							Name="Release_LTCG|Win32"
+							Name="Production|Win32"
 							ExcludedFromBuild="true"
 							>
 							<Tool
@@ -30075,7 +30379,7 @@
 							/>
 						</FileConfiguration>
 						<FileConfiguration
-							Name="Release_LTCG|Win32"
+							Name="Production|Win32"
 							ExcludedFromBuild="true"
 							>
 							<Tool
@@ -30249,6 +30553,14 @@
 					>
 				</File>
 				<File
+					RelativePath="..\platform\text\TextCheckerClient.h"
+					>
+				</File>
+				<File
+					RelativePath="..\platform\text\TextChecking.h"
+					>
+				</File>
+				<File
 					RelativePath="..\platform\text\TextCodec.cpp"
 					>
 				</File>
@@ -30304,7 +30616,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						>
 						<Tool
 							Name="VCCLCompilerTool"
@@ -30337,7 +30649,7 @@
 					>
 				</File>
 				<File
-					RelativePath="..\platform\text\TextCodecUTF8.h"
+					RelativePath="..\platform\text\TextCodecUTF16.h"
 					>
 				</File>
 				<File
@@ -30345,11 +30657,7 @@
 					>
 				</File>
 				<File
-					RelativePath="..\platform\text\TextCodecUTF16.h"
-					>
-				</File>
-				<File
-					RelativePath="..\platform\text\TextCheckerClient.h"
+					RelativePath="..\platform\text\TextCodecUTF8.h"
 					>
 				</File>
 				<File
@@ -30472,7 +30780,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -30508,7 +30816,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -30547,7 +30855,7 @@
 							/>
 						</FileConfiguration>
 						<FileConfiguration
-							Name="Release_LTCG|Win32"
+							Name="Production|Win32"
 							ExcludedFromBuild="true"
 							>
 							<Tool
@@ -30587,7 +30895,7 @@
 							/>
 						</FileConfiguration>
 						<FileConfiguration
-							Name="Release_LTCG|Win32"
+							Name="Production|Win32"
 							ExcludedFromBuild="true"
 							>
 							<Tool
@@ -30623,7 +30931,7 @@
 							/>
 						</FileConfiguration>
 						<FileConfiguration
-							Name="Release_LTCG|Win32"
+							Name="Production|Win32"
 							ExcludedFromBuild="true"
 							>
 							<Tool
@@ -30659,7 +30967,7 @@
 							/>
 						</FileConfiguration>
 						<FileConfiguration
-							Name="Release_LTCG|Win32"
+							Name="Production|Win32"
 							ExcludedFromBuild="true"
 							>
 							<Tool
@@ -30695,7 +31003,7 @@
 							/>
 						</FileConfiguration>
 						<FileConfiguration
-							Name="Release_LTCG|Win32"
+							Name="Production|Win32"
 							ExcludedFromBuild="true"
 							>
 							<Tool
@@ -30751,7 +31059,7 @@
 							/>
 						</FileConfiguration>
 						<FileConfiguration
-							Name="Release_LTCG|Win32"
+							Name="Production|Win32"
 							ExcludedFromBuild="true"
 							>
 							<Tool
@@ -30787,7 +31095,7 @@
 							/>
 						</FileConfiguration>
 						<FileConfiguration
-							Name="Release_LTCG|Win32"
+							Name="Production|Win32"
 							ExcludedFromBuild="true"
 							>
 							<Tool
@@ -30843,7 +31151,7 @@
 							/>
 						</FileConfiguration>
 						<FileConfiguration
-							Name="Release_LTCG|Win32"
+							Name="Production|Win32"
 							ExcludedFromBuild="true"
 							>
 							<Tool
@@ -30879,7 +31187,7 @@
 							/>
 						</FileConfiguration>
 						<FileConfiguration
-							Name="Release_LTCG|Win32"
+							Name="Production|Win32"
 							ExcludedFromBuild="true"
 							>
 							<Tool
@@ -30919,7 +31227,7 @@
 							/>
 						</FileConfiguration>
 						<FileConfiguration
-							Name="Release_LTCG|Win32"
+							Name="Production|Win32"
 							ExcludedFromBuild="true"
 							>
 							<Tool
@@ -30955,7 +31263,7 @@
 							/>
 						</FileConfiguration>
 						<FileConfiguration
-							Name="Release_LTCG|Win32"
+							Name="Production|Win32"
 							ExcludedFromBuild="true"
 							>
 							<Tool
@@ -30991,7 +31299,7 @@
 							/>
 						</FileConfiguration>
 						<FileConfiguration
-							Name="Release_LTCG|Win32"
+							Name="Production|Win32"
 							ExcludedFromBuild="true"
 							>
 							<Tool
@@ -31027,7 +31335,7 @@
 							/>
 						</FileConfiguration>
 						<FileConfiguration
-							Name="Release_LTCG|Win32"
+							Name="Production|Win32"
 							ExcludedFromBuild="true"
 							>
 							<Tool
@@ -31067,7 +31375,7 @@
 							/>
 						</FileConfiguration>
 						<FileConfiguration
-							Name="Release_LTCG|Win32"
+							Name="Production|Win32"
 							ExcludedFromBuild="true"
 							>
 							<Tool
@@ -31103,7 +31411,7 @@
 							/>
 						</FileConfiguration>
 						<FileConfiguration
-							Name="Release_LTCG|Win32"
+							Name="Production|Win32"
 							ExcludedFromBuild="true"
 							>
 							<Tool
@@ -31165,7 +31473,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						>
 						<Tool
 							Name="VCCLCompilerTool"
@@ -31227,7 +31535,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						>
 						<Tool
 							Name="VCCLCompilerTool"
@@ -31434,6 +31742,14 @@
 				>
 			</File>
 			<File
+				RelativePath="..\css\CSSLineBoxContainValue.cpp"
+				>
+			</File>
+			<File
+				RelativePath="..\css\CSSLineBoxContainValue.h"
+				>
+			</File>
+			<File
 				RelativePath="..\css\CSSMediaRule.cpp"
 				>
 			</File>
@@ -31586,6 +31902,14 @@
 				>
 			</File>
 			<File
+				RelativePath="..\css\CSSStyleApplyProperty.cpp"
+				>
+			</File>
+			<File
+				RelativePath="..\css\CSSStyleApplyProperty.h"
+				>
+			</File>
+			<File
 				RelativePath="..\css\CSSStyleDeclaration.cpp"
 				>
 			</File>
@@ -31909,7 +32233,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -31965,7 +32289,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -32021,7 +32345,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -32077,7 +32401,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -32133,7 +32457,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -32189,7 +32513,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -32253,7 +32577,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -32309,7 +32633,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -32365,7 +32689,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -32425,7 +32749,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -32481,7 +32805,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -32537,7 +32861,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -32601,7 +32925,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -32657,7 +32981,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -32713,7 +33037,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -32769,7 +33093,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -32825,7 +33149,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -32877,7 +33201,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -32933,7 +33257,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -32989,7 +33313,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -33045,7 +33369,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -33101,7 +33425,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -33157,7 +33481,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -33213,7 +33537,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -33269,7 +33593,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -33325,7 +33649,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -33381,7 +33705,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -33437,7 +33761,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -33493,7 +33817,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -33549,7 +33873,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -33605,7 +33929,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -33661,7 +33985,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -33717,7 +34041,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -33773,7 +34097,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -33829,7 +34153,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -33885,7 +34209,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -33941,7 +34265,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -33997,7 +34321,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -34053,7 +34377,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -34109,7 +34433,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -34169,7 +34493,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -34225,7 +34549,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -34289,7 +34613,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -34345,7 +34669,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -34401,7 +34725,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -34457,7 +34781,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -34513,7 +34837,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -34569,7 +34893,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -34625,7 +34949,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -34681,7 +35005,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -34753,7 +35077,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -34809,7 +35133,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -34865,7 +35189,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -34921,7 +35245,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -34977,7 +35301,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -35033,7 +35357,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -35089,7 +35413,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -35145,7 +35469,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -35201,7 +35525,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -35257,7 +35581,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -35313,7 +35637,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -35369,7 +35693,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -35425,7 +35749,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -35481,7 +35805,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -35537,7 +35861,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -35593,7 +35917,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -35653,7 +35977,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -35709,7 +36033,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -35769,7 +36093,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -35825,7 +36149,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -35881,7 +36205,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -35937,7 +36261,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -35993,7 +36317,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -36049,7 +36373,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -36105,7 +36429,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -36161,7 +36485,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -36217,7 +36541,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -36273,7 +36597,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -36329,7 +36653,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -36385,7 +36709,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -36441,7 +36765,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -36497,7 +36821,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -36553,7 +36877,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -36609,7 +36933,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -36665,7 +36989,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -36721,7 +37045,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -36777,7 +37101,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -36833,7 +37157,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -36889,7 +37213,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -36945,7 +37269,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -36997,7 +37321,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -37053,7 +37377,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -37109,7 +37433,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -37165,7 +37489,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -37221,7 +37545,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -37277,7 +37601,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -37333,7 +37657,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -37389,7 +37713,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -37445,7 +37769,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -37501,7 +37825,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -37557,7 +37881,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -37653,7 +37977,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -37700,7 +38024,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					>
 					<Tool
 						Name="VCCustomBuildTool"
@@ -37751,7 +38075,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -37807,7 +38131,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -37863,7 +38187,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -37919,7 +38243,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -37975,7 +38299,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -38031,7 +38355,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -38087,7 +38411,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -38143,7 +38467,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -38203,7 +38527,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -38259,7 +38583,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -38315,7 +38639,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -38371,7 +38695,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -38427,7 +38751,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -38483,7 +38807,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -38539,7 +38863,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -38603,7 +38927,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -38758,7 +39082,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -38818,7 +39142,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -38886,7 +39210,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -38942,7 +39266,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -38998,7 +39322,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -39058,7 +39382,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -39114,7 +39438,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -39174,7 +39498,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -39234,7 +39558,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -39290,7 +39614,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -39346,7 +39670,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -39402,7 +39726,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -39458,7 +39782,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -39518,7 +39842,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -39574,7 +39898,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -39630,7 +39954,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -39690,7 +40014,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -39746,7 +40070,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -39806,7 +40130,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -39862,7 +40186,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -39918,7 +40242,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -39974,7 +40298,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -40030,7 +40354,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -40090,7 +40414,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -40146,7 +40470,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -40161,6 +40485,54 @@
 				<File
 					RelativePath="..\rendering\svg\RenderSVGPath.cpp"
 					>
+					<FileConfiguration
+						Name="Debug|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+					<FileConfiguration
+						Name="Release|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+					<FileConfiguration
+						Name="Debug_Cairo_CFLite|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+					<FileConfiguration
+						Name="Release_Cairo_CFLite|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+					<FileConfiguration
+						Name="Debug_All|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+					<FileConfiguration
+						Name="Production|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
 				</File>
 				<File
 					RelativePath="..\rendering\svg\RenderSVGPath.h"
@@ -40210,7 +40582,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -40266,7 +40638,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -40322,7 +40694,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -40378,7 +40750,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -40434,7 +40806,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -40490,7 +40862,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -40546,7 +40918,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -40602,7 +40974,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -40662,7 +41034,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -40718,7 +41090,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -40774,7 +41146,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -40830,7 +41202,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -40886,7 +41258,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -40942,7 +41314,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -40998,7 +41370,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -41064,19 +41436,19 @@
 				>
 			</File>
 			<File
-				RelativePath="..\xml\XMLTreeViewer.cpp"
+				RelativePath="..\xml\XMLSerializer.cpp"
 				>
 			</File>
 			<File
-				RelativePath="..\xml\XMLTreeViewer.h"
+				RelativePath="..\xml\XMLSerializer.h"
 				>
 			</File>
 			<File
-				RelativePath="..\xml\XMLSerializer.cpp"
+				RelativePath="..\xml\XMLTreeViewer.cpp"
 				>
 			</File>
 			<File
-				RelativePath="..\xml\XMLSerializer.h"
+				RelativePath="..\xml\XMLTreeViewer.h"
 				>
 			</File>
 			<File
@@ -41192,7 +41564,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					>
 					<Tool
 						Name="VCCLCompilerTool"
@@ -41353,7 +41725,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -41366,62 +41738,6 @@
 				>
 			</File>
 			<File
-				RelativePath="..\dom\AsyncScriptRunner.cpp"
-				>
-				<FileConfiguration
-					Name="Debug|Win32"
-					ExcludedFromBuild="true"
-					>
-					<Tool
-						Name="VCCLCompilerTool"
-					/>
-				</FileConfiguration>
-				<FileConfiguration
-					Name="Release|Win32"
-					ExcludedFromBuild="true"
-					>
-					<Tool
-						Name="VCCLCompilerTool"
-					/>
-				</FileConfiguration>
-				<FileConfiguration
-					Name="Debug_Cairo_CFLite|Win32"
-					ExcludedFromBuild="true"
-					>
-					<Tool
-						Name="VCCLCompilerTool"
-					/>
-				</FileConfiguration>
-				<FileConfiguration
-					Name="Release_Cairo_CFLite|Win32"
-					ExcludedFromBuild="true"
-					>
-					<Tool
-						Name="VCCLCompilerTool"
-					/>
-				</FileConfiguration>
-				<FileConfiguration
-					Name="Debug_All|Win32"
-					ExcludedFromBuild="true"
-					>
-					<Tool
-						Name="VCCLCompilerTool"
-					/>
-				</FileConfiguration>
-				<FileConfiguration
-					Name="Release_LTCG|Win32"
-					ExcludedFromBuild="true"
-					>
-					<Tool
-						Name="VCCLCompilerTool"
-					/>
-				</FileConfiguration>
-			</File>
-			<File
-				RelativePath="..\dom\AsyncScriptRunner.h"
-				>
-			</File>
-			<File
 				RelativePath="..\dom\AtomicStringList.h"
 				>
 			</File>
@@ -41469,7 +41785,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -41525,7 +41841,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -41585,7 +41901,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -41641,7 +41957,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -41697,7 +42013,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -41753,7 +42069,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -41809,7 +42125,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -41865,7 +42181,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -41921,7 +42237,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -41977,7 +42293,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -42033,7 +42349,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -42089,7 +42405,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -42145,7 +42461,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -42205,7 +42521,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -42261,7 +42577,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -42317,7 +42633,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -42373,7 +42689,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -42433,7 +42749,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -42489,7 +42805,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -42545,7 +42861,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -42558,6 +42874,66 @@
 				>
 			</File>
 			<File
+				RelativePath="..\dom\DataTransferItem.cpp"
+				>
+				<FileConfiguration
+					Name="Debug|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Release|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Debug_Cairo_CFLite|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Release_Cairo_CFLite|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Debug_All|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Production|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+			</File>
+			<File
+				RelativePath="..\dom\DataTransferItem.h"
+				>
+			</File>
+			<File
+				RelativePath="..\dom\DataTransferItems.h"
+				>
+			</File>
+			<File
 				RelativePath="..\dom\DecodedDataDocumentParser.cpp"
 				>
 				<FileConfiguration
@@ -42601,7 +42977,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -42661,7 +43037,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -42717,7 +43093,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -42773,7 +43149,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -42829,7 +43205,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -42889,7 +43265,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -42945,7 +43321,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -43001,7 +43377,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -43057,7 +43433,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -43117,7 +43493,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -43173,7 +43549,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -43229,7 +43605,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -43289,7 +43665,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -43353,7 +43729,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -43409,7 +43785,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -43465,7 +43841,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -43525,7 +43901,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -43581,7 +43957,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -43637,7 +44013,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -43697,7 +44073,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -43753,7 +44129,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -43809,7 +44185,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -43865,7 +44241,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -43878,6 +44254,62 @@
 				>
 			</File>
 			<File
+				RelativePath="..\dom\EventDispatcher.cpp"
+				>
+				<FileConfiguration
+					Name="Debug|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Release|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Debug_Cairo_CFLite|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Release_Cairo_CFLite|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Debug_All|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Production|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+			</File>
+			<File
+				RelativePath="..\dom\EventDispatcher.h"
+				>
+			</File>
+			<File
 				RelativePath="..\dom\EventException.h"
 				>
 			</File>
@@ -43929,7 +44361,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -43977,7 +44409,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -44033,7 +44465,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -44113,7 +44545,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -44169,7 +44601,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -44233,7 +44665,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -44289,7 +44721,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -44349,7 +44781,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -44405,7 +44837,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -44461,7 +44893,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -44517,7 +44949,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -44573,7 +45005,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -44629,7 +45061,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -44685,7 +45117,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -44749,7 +45181,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -44813,7 +45245,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -44869,7 +45301,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -44925,7 +45357,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -44981,7 +45413,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -45037,7 +45469,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -45093,7 +45525,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -45149,7 +45581,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -45205,7 +45637,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -45261,7 +45693,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -45325,7 +45757,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -45381,7 +45813,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -45437,7 +45869,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -45493,7 +45925,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -45549,7 +45981,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -45613,7 +46045,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -45677,7 +46109,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -45733,7 +46165,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -45789,7 +46221,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -45845,7 +46277,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -45901,7 +46333,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -45914,6 +46346,62 @@
 				>
 			</File>
 			<File
+				RelativePath="..\dom\ScriptRunner.cpp"
+				>
+				<FileConfiguration
+					Name="Debug|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Release|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Debug_Cairo_CFLite|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Release_Cairo_CFLite|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Debug_All|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Production|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+			</File>
+			<File
+				RelativePath="..\dom\ScriptRunner.h"
+				>
+			</File>
+			<File
 				RelativePath="..\dom\SelectElement.cpp"
 				>
 				<FileConfiguration
@@ -45957,7 +46445,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -46013,7 +46501,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -46069,7 +46557,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -46125,7 +46613,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -46181,7 +46669,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -46194,6 +46682,62 @@
 				>
 			</File>
 			<File
+				RelativePath="..\dom\StringCallback.cpp"
+				>
+				<FileConfiguration
+					Name="Debug|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Release|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Debug_Cairo_CFLite|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Release_Cairo_CFLite|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Debug_All|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Production|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+			</File>
+			<File
+				RelativePath="..\dom\StringCallback.h"
+				>
+			</File>
+			<File
 				RelativePath="..\dom\StyledElement.cpp"
 				>
 				<FileConfiguration
@@ -46237,7 +46781,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -46293,7 +46837,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -46349,7 +46893,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -46405,7 +46949,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -46461,7 +47005,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -46525,7 +47069,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -46577,7 +47121,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -46637,7 +47181,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -46693,7 +47237,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -46749,7 +47293,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -46805,7 +47349,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -46861,7 +47405,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -46917,7 +47461,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -46973,7 +47517,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -47029,7 +47573,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -47085,7 +47629,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -47141,7 +47685,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -47197,7 +47741,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -47257,7 +47801,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -47485,7 +48029,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -47541,7 +48085,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -47597,7 +48141,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -47653,7 +48197,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -47713,7 +48257,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -47769,7 +48313,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -47825,7 +48369,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -47881,7 +48425,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -47937,7 +48481,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -47997,7 +48541,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -48069,7 +48613,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -48125,7 +48669,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -48181,7 +48725,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -48245,7 +48789,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -48301,7 +48845,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -48357,7 +48901,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -48413,7 +48957,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -48469,7 +49013,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -48525,7 +49069,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -48581,7 +49125,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -48637,7 +49181,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -48693,7 +49237,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -48749,7 +49293,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -48805,7 +49349,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -48861,7 +49405,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -48917,7 +49461,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -48973,7 +49517,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -49029,7 +49573,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -49085,7 +49629,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -49141,7 +49685,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -49197,7 +49741,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -49249,7 +49793,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -49305,7 +49849,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -49361,7 +49905,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -49417,7 +49961,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -49473,7 +50017,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -49529,7 +50073,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -49585,7 +50129,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -49641,7 +50185,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -49693,7 +50237,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -49749,7 +50293,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -49805,7 +50349,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -49861,7 +50405,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -49921,7 +50465,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -49981,7 +50525,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -50037,7 +50581,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -50093,7 +50637,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -50149,7 +50693,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -50205,7 +50749,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -50261,7 +50805,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -50317,7 +50861,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -50334,6 +50878,22 @@
 			Name="html"
 			>
 			<File
+				RelativePath="..\html\canvas\ArrayBuffer.cpp"
+				>
+			</File>
+			<File
+				RelativePath="..\html\canvas\ArrayBuffer.h"
+				>
+			</File>
+			<File
+				RelativePath="..\html\canvas\ArrayBufferView.cpp"
+				>
+			</File>
+			<File
+				RelativePath="..\html\canvas\ArrayBufferView.h"
+				>
+			</File>
+			<File
 				RelativePath="..\fileapi\AsyncFileWriter.h"
 				>
 			</File>
@@ -50414,22 +50974,6 @@
 				>
 			</File>
 			<File
-				RelativePath="..\html\canvas\ArrayBuffer.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\html\canvas\ArrayBuffer.h"
-				>
-			</File>
-			<File
-				RelativePath="..\html\canvas\ArrayBufferView.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\html\canvas\ArrayBufferView.h"
-				>
-			</File>
-			<File
 				RelativePath="..\html\canvas\CanvasGradient.cpp"
 				>
 			</File>
@@ -50478,70 +51022,6 @@
 				>
 			</File>
 			<File
-				RelativePath="..\html\canvas\DataView.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\html\canvas\DataView.h"
-				>
-			</File>
-			<File
-				RelativePath="..\html\canvas\Float32Array.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\html\canvas\Float32Array.h"
-				>
-			</File>
-			<File
-				RelativePath="..\html\canvas\Int32Array.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\html\canvas\Int32Array.h"
-				>
-			</File>
-			<File
-				RelativePath="..\html\canvas\Int16Array.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\html\canvas\Int16Array.h"
-				>
-			</File>
-			<File
-				RelativePath="..\html\canvas\Int8Array.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\html\canvas\Int8Array.h"
-				>
-			</File>
-			<File
-				RelativePath="..\html\canvas\UInt16Array.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\html\canvas\UInt16Array.h"
-				>
-			</File>
-			<File
-				RelativePath="..\html\canvas\UInt32Array.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\html\canvas\UInt32Array.h"
-				>
-			</File>
-			<File
-				RelativePath="..\html\canvas\UInt8Array.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\html\canvas\UInt8Array.h"
-				>
-			</File>
-			<File
 				RelativePath="..\html\CheckboxInputType.cpp"
 				>
 			</File>
@@ -50598,6 +51078,14 @@
 				>
 			</File>
 			<File
+				RelativePath="..\html\canvas\DataView.cpp"
+				>
+			</File>
+			<File
+				RelativePath="..\html\canvas\DataView.h"
+				>
+			</File>
+			<File
 				RelativePath="..\html\DateComponents.cpp"
 				>
 			</File>
@@ -50942,6 +51430,14 @@
 				>
 			</File>
 			<File
+				RelativePath="..\html\canvas\Float32Array.cpp"
+				>
+			</File>
+			<File
+				RelativePath="..\html\canvas\Float32Array.h"
+				>
+			</File>
+			<File
 				RelativePath="..\html\FormAssociatedElement.cpp"
 				>
 			</File>
@@ -51025,7 +51521,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -51081,7 +51577,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -51137,7 +51633,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -51193,7 +51689,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -51249,7 +51745,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -51305,7 +51801,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -51361,7 +51857,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -51417,7 +51913,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -51473,7 +51969,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -51529,7 +52025,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -51585,7 +52081,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -51649,7 +52145,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -51705,7 +52201,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -51761,7 +52257,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -51817,7 +52313,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -51873,7 +52369,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -51929,7 +52425,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -51985,7 +52481,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -52041,7 +52537,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -52097,7 +52593,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -52161,7 +52657,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -52221,7 +52717,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -52277,7 +52773,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -52333,7 +52829,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -52397,7 +52893,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -52453,7 +52949,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -52509,7 +53005,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -52565,7 +53061,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -52621,7 +53117,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -52677,7 +53173,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -52733,7 +53229,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -52789,7 +53285,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -52845,7 +53341,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -52901,7 +53397,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -52957,7 +53453,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -53013,7 +53509,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -53077,7 +53573,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -53133,7 +53629,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -53189,7 +53685,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -53245,7 +53741,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -53301,7 +53797,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -53357,7 +53853,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -53413,7 +53909,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -53469,7 +53965,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -53525,7 +54021,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -53581,7 +54077,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -53637,7 +54133,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -53693,7 +54189,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -53749,7 +54245,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -53805,7 +54301,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -53869,7 +54365,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -53925,7 +54421,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -53981,7 +54477,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -54037,7 +54533,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -54093,7 +54589,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -54165,7 +54661,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -54221,7 +54717,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -54285,7 +54781,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -54341,7 +54837,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -54397,7 +54893,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -54453,7 +54949,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -54509,7 +55005,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -54565,7 +55061,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -54621,7 +55117,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -54677,7 +55173,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -54733,7 +55229,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -54789,7 +55285,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -54845,7 +55341,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -54901,7 +55397,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -54957,7 +55453,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -55013,7 +55509,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -55069,7 +55565,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -55125,7 +55621,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -55189,7 +55685,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -55245,7 +55741,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -55301,7 +55797,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -55357,7 +55853,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -55413,7 +55909,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -55474,6 +55970,30 @@
 				>
 			</File>
 			<File
+				RelativePath="..\html\canvas\Int16Array.cpp"
+				>
+			</File>
+			<File
+				RelativePath="..\html\canvas\Int16Array.h"
+				>
+			</File>
+			<File
+				RelativePath="..\html\canvas\Int32Array.cpp"
+				>
+			</File>
+			<File
+				RelativePath="..\html\canvas\Int32Array.h"
+				>
+			</File>
+			<File
+				RelativePath="..\html\canvas\Int8Array.cpp"
+				>
+			</File>
+			<File
+				RelativePath="..\html\canvas\Int8Array.h"
+				>
+			</File>
+			<File
 				RelativePath="..\html\IsIndexInputType.cpp"
 				>
 			</File>
@@ -55650,6 +56170,30 @@
 				>
 			</File>
 			<File
+				RelativePath="..\html\canvas\UInt16Array.cpp"
+				>
+			</File>
+			<File
+				RelativePath="..\html\canvas\UInt16Array.h"
+				>
+			</File>
+			<File
+				RelativePath="..\html\canvas\UInt32Array.cpp"
+				>
+			</File>
+			<File
+				RelativePath="..\html\canvas\UInt32Array.h"
+				>
+			</File>
+			<File
+				RelativePath="..\html\canvas\UInt8Array.cpp"
+				>
+			</File>
+			<File
+				RelativePath="..\html\canvas\UInt8Array.h"
+				>
+			</File>
+			<File
 				RelativePath="..\html\URLInputType.cpp"
 				>
 			</File>
@@ -55880,14 +56424,14 @@
 					RelativePath="..\html\shadow\SliderThumbElement.h"
 					>
 				</File>
-                <File
-                    RelativePath="..\html\shadow\TextControlInnerElements.cpp"
-                    >
-                </File>
-                <File
-                    RelativePath="..\html\shadow\TextControlInnerElements.h"
-                    >
-                </File>
+				<File
+					RelativePath="..\html\shadow\TextControlInnerElements.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\html\shadow\TextControlInnerElements.h"
+					>
+				</File>
 			</Filter>
 		</Filter>
 		<Filter
@@ -55992,7 +56536,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -56048,7 +56592,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -56104,7 +56648,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -56160,7 +56704,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -56216,7 +56760,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -56272,7 +56816,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -56324,7 +56868,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -56384,7 +56928,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -56440,7 +56984,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -56492,7 +57036,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -56544,7 +57088,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -56596,7 +57140,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -56648,7 +57192,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -56700,7 +57244,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -56752,7 +57296,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -56804,7 +57348,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -56856,7 +57400,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -56908,7 +57452,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -56960,7 +57504,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -57012,7 +57556,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -57064,7 +57608,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -57120,7 +57664,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -57172,7 +57716,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -57224,7 +57768,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -57280,7 +57824,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -57336,7 +57880,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -57388,7 +57932,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -57444,7 +57988,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -57500,7 +58044,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -57552,7 +58096,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -57604,7 +58148,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -57656,7 +58200,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -57708,7 +58252,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -57760,7 +58304,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -57820,7 +58364,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -57872,7 +58416,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -57924,7 +58468,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -57980,7 +58524,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -58032,7 +58576,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -58049,7 +58593,7 @@
 					>
 					<FileConfiguration
 						Name="Debug|Win32"
-					ExcludedFromBuild="true"
+						ExcludedFromBuild="true"
 						>
 						<Tool
 							Name="VCCLCompilerTool"
@@ -58088,7 +58632,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -58140,7 +58684,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -58192,7 +58736,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -58244,7 +58788,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -58296,7 +58840,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -58352,7 +58896,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -58408,7 +58952,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -58464,7 +59008,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -58520,7 +59064,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -58576,7 +59120,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -58636,7 +59180,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -58692,7 +59236,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -58744,7 +59288,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -58800,7 +59344,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -58852,7 +59396,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -58908,7 +59452,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -58968,7 +59512,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -59020,7 +59564,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -59076,7 +59620,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -59128,7 +59672,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -59184,7 +59728,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -59236,7 +59780,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -59288,7 +59832,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -59340,7 +59884,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -59392,7 +59936,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -59444,7 +59988,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -59500,7 +60044,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -59552,7 +60096,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -59604,7 +60148,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -59656,7 +60200,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -59712,7 +60256,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -59764,7 +60308,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -59820,7 +60364,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -59872,7 +60416,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -59924,7 +60468,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -59980,7 +60524,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -60032,7 +60576,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -60088,7 +60632,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -60140,7 +60684,59 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+				</File>
+				<File
+					RelativePath="..\bindings\js\JSInjectedScriptManager.cpp"
+					>
+					<FileConfiguration
+						Name="Debug|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+					<FileConfiguration
+						Name="Release|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+					<FileConfiguration
+						Name="Debug_Cairo_CFLite|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+					<FileConfiguration
+						Name="Release_Cairo_CFLite|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+					<FileConfiguration
+						Name="Debug_All|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+					<FileConfiguration
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -60192,7 +60788,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -60244,7 +60840,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -60296,7 +60892,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -60352,7 +60948,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -60408,7 +61004,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -60464,7 +61060,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -60516,7 +61112,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -60568,7 +61164,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -60620,7 +61216,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -60676,7 +61272,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -60728,7 +61324,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -60780,7 +61376,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -60836,7 +61432,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -60892,7 +61488,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -60944,7 +61540,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -60996,7 +61592,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -61048,7 +61644,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -61104,7 +61700,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -61160,7 +61756,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -61212,7 +61808,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -61264,7 +61860,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -61316,7 +61912,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -61368,7 +61964,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -61420,7 +62016,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -61472,7 +62068,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -61528,7 +62124,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -61580,7 +62176,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -61632,7 +62228,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -61684,7 +62280,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -61736,7 +62332,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -61788,7 +62384,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -61840,7 +62436,111 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+				</File>
+				<File
+					RelativePath="..\bindings\js\JSWebKitAnimationCustom.cpp"
+					>
+					<FileConfiguration
+						Name="Debug|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+					<FileConfiguration
+						Name="Release|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+					<FileConfiguration
+						Name="Debug_Cairo_CFLite|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+					<FileConfiguration
+						Name="Release_Cairo_CFLite|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+					<FileConfiguration
+						Name="Debug_All|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+					<FileConfiguration
+						Name="Production|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+				</File>
+				<File
+					RelativePath="..\bindings\js\JSWebKitAnimationListCustom.cpp"
+					>
+					<FileConfiguration
+						Name="Debug|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+					<FileConfiguration
+						Name="Release|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+					<FileConfiguration
+						Name="Debug_Cairo_CFLite|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+					<FileConfiguration
+						Name="Release_Cairo_CFLite|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+					<FileConfiguration
+						Name="Debug_All|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+					<FileConfiguration
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -61892,7 +62592,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -61944,7 +62644,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -61996,7 +62696,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -62048,7 +62748,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -62100,7 +62800,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -62152,7 +62852,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -62208,7 +62908,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -62260,7 +62960,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -62312,7 +63012,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -62364,7 +63064,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -62416,7 +63116,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -62429,6 +63129,62 @@
 					>
 				</File>
 				<File
+					RelativePath="..\bindings\js\PageScriptDebugServer.cpp"
+					>
+					<FileConfiguration
+						Name="Debug|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+					<FileConfiguration
+						Name="Release|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+					<FileConfiguration
+						Name="Debug_Cairo_CFLite|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+					<FileConfiguration
+						Name="Release_Cairo_CFLite|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+					<FileConfiguration
+						Name="Debug_All|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+					<FileConfiguration
+						Name="Production|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+				</File>
+				<File
+					RelativePath="..\bindings\js\PageScriptDebugServer.h"
+					>
+				</File>
+				<File
 					RelativePath="..\bindings\js\ScheduledAction.cpp"
 					>
 					<FileConfiguration
@@ -62472,7 +63228,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -62528,7 +63284,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -62584,7 +63340,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -62640,7 +63396,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -62696,7 +63452,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -62748,7 +63504,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -62804,7 +63560,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -62860,7 +63616,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -62916,7 +63672,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -63000,7 +63756,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -63064,7 +63820,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -63132,7 +63888,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -63196,7 +63952,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -63208,6 +63964,62 @@
 					RelativePath="..\bindings\js\WorkerScriptController.h"
 					>
 				</File>
+				<File
+					RelativePath="..\bindings\js\WorkerScriptDebugServer.cpp"
+					>
+					<FileConfiguration
+						Name="Debug|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+					<FileConfiguration
+						Name="Release|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+					<FileConfiguration
+						Name="Debug_Cairo_CFLite|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+					<FileConfiguration
+						Name="Release_Cairo_CFLite|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+					<FileConfiguration
+						Name="Debug_All|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+					<FileConfiguration
+						Name="Production|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+				</File>
+				<File
+					RelativePath="..\bindings\js\PageScriptDebugServer.h"
+					>
+				</File>
 			</Filter>
 			<Filter
 				Name="scripts"
@@ -63697,7 +64509,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -63777,7 +64589,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -63841,7 +64653,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -63933,7 +64745,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -64181,7 +64993,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -64245,7 +65057,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -64381,7 +65193,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -65154,7 +65966,7 @@
 				>
 			</File>
 			<File
-				RelativePath="..\storage\SQLCallback.h"
+				RelativePath="..\storage\SQLCallbackWrapper.h"
 				>
 			</File>
 			<File
@@ -65326,6 +66138,14 @@
 				>
 			</File>
 			<File
+				RelativePath="..\storage\StorageTracker.cpp"
+				>
+			</File>
+			<File
+				RelativePath="..\storage\StorageTracker.h"
+				>
+			</File>
+			<File
 				RelativePath="..\storage\VersionChangeCallback.h"
 				>
 			</File>
@@ -65486,6 +66306,14 @@
 				>
 			</File>
 			<File
+				RelativePath="..\inspector\DOMNodeHighlighter.cpp"
+				>
+			</File>
+			<File
+				RelativePath="..\inspector\DOMNodeHighlighter.h"
+				>
+			</File>
+			<File
 				RelativePath="..\inspector\InjectedScript.cpp"
 				>
 			</File>
@@ -65502,6 +66330,14 @@
 				>
 			</File>
 			<File
+				RelativePath="..\inspector\InjectedScriptManager.cpp"
+				>
+			</File>
+			<File
+				RelativePath="..\inspector\InjectedScriptManager.h"
+				>
+			</File>
+			<File
 				RelativePath="..\inspector\InspectorAgent.cpp"
 				>
 			</File>
@@ -65646,6 +66482,14 @@
 				>
 			</File>
 			<File
+				RelativePath="..\inspector\InspectorPageAgent.cpp"
+				>
+			</File>
+			<File
+				RelativePath="..\inspector\InspectorPageAgent.h"
+				>
+			</File>
+			<File
 				RelativePath="..\inspector\InspectorProfilerAgent.h"
 				>
 			</File>
@@ -65706,6 +66550,14 @@
 				>
 			</File>
 			<File
+				RelativePath="..\inspector\PageDebuggerAgent.cpp"
+				>
+			</File>
+			<File
+				RelativePath="..\inspector\PageDebuggerAgent.h"
+				>
+			</File>
+			<File
 				RelativePath="..\inspector\ScriptArguments.cpp"
 				>
 			</File>
@@ -65745,6 +66597,14 @@
 				RelativePath="..\inspector\TimelineRecordFactory.h"
 				>
 			</File>
+			<File
+				RelativePath="..\inspector\WorkerDebuggerAgent.cpp"
+				>
+			</File>
+			<File
+				RelativePath="..\inspector\WorkerDebuggerAgent.h"
+				>
+			</File>
 			<Filter
 				Name="front-end"
 				>
@@ -66097,6 +66957,10 @@
 					>
 				</File>
 				<File
+					RelativePath="..\inspector\front-end\ResourceJSONView.js"
+					>
+				</File>
+				<File
 					RelativePath="..\inspector\front-end\ResourcesPanel.js"
 					>
 				</File>
@@ -66165,6 +67029,10 @@
 					>
 				</File>
 				<File
+					RelativePath="..\inspector\front-end\SourceFile.js"
+					>
+				</File>
+				<File
 					RelativePath="..\inspector\front-end\SourceFrame.js"
 					>
 				</File>
@@ -66553,7 +67421,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					>
 					<Tool
 						Name="VCCLCompilerTool"
diff --git a/Source/WebCore/WebCore.vcproj/WebCoreDebug.vsprops b/Source/WebCore/WebCore.vcproj/WebCoreDebug.vsprops
new file mode 100644
index 0000000..d5bcbd8
--- /dev/null
+++ b/Source/WebCore/WebCore.vcproj/WebCoreDebug.vsprops
@@ -0,0 +1,17 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="WebCoreDebug"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;
+      .\WebCoreCommon.vsprops;
+      .\WebCoreCG.vsprops;
+      .\WebCoreCFNetwork.vsprops;
+      .\WebCorePthreads.vsprops;
+      .\WebCoreMediaQT.vsprops;
+      .\WebCoreQuartzCore.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Source/WebCore/WebCore.vcproj/WebCoreDebugAll.vsprops b/Source/WebCore/WebCore.vcproj/WebCoreDebugAll.vsprops
new file mode 100644
index 0000000..ce6ec7a
--- /dev/null
+++ b/Source/WebCore/WebCore.vcproj/WebCoreDebugAll.vsprops
@@ -0,0 +1,18 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="WebCoreDebugAll"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;
+      .\WebCoreCommon.vsprops;
+      .\WebCoreCG.vsprops;
+      .\WebCoreCFNetwork.vsprops;
+      .\WebCorePthreads.vsprops;
+      .\WebCoreMediaQT.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\debug_all.vsprops;
+      .\WebCoreQuartzCore.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Source/WebCore/WebCore.vcproj/WebCoreDebugCairoCFLite.vsprops b/Source/WebCore/WebCore.vcproj/WebCoreDebugCairoCFLite.vsprops
new file mode 100644
index 0000000..588694a
--- /dev/null
+++ b/Source/WebCore/WebCore.vcproj/WebCoreDebugCairoCFLite.vsprops
@@ -0,0 +1,15 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="WebCoreDebugCairoCFLite"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefinesCairo.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\debug_wincairo.vsprops;
+      .\WebCoreCommon.vsprops;
+      .\WebCoreCairo.vsprops;
+      .\WebCoreCURL.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Source/WebCore/WebCore.vcproj/WebCoreGenerated.vcproj b/Source/WebCore/WebCore.vcproj/WebCoreGenerated.vcproj
index 60bf017..23bedfb 100644
--- a/Source/WebCore/WebCore.vcproj/WebCoreGenerated.vcproj
+++ b/Source/WebCore/WebCore.vcproj/WebCoreGenerated.vcproj
@@ -51,7 +51,7 @@
 			/>
 		</Configuration>
 		<Configuration
-			Name="Release_LTCG|Win32"
+			Name="Production|Win32"
 			ConfigurationType="0"
 			InheritedPropertySheets=".\WebCoreGeneratedCommon.vsprops"
 			>
diff --git a/Source/WebCore/WebCore.vcproj/WebCoreProduction.vsprops b/Source/WebCore/WebCore.vcproj/WebCoreProduction.vsprops
new file mode 100644
index 0000000..af07ec2
--- /dev/null
+++ b/Source/WebCore/WebCore.vcproj/WebCoreProduction.vsprops
@@ -0,0 +1,18 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="WebCoreProduction"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\production.vsprops;
+      .\WebCoreCommon.vsprops;
+      .\WebCoreCG.vsprops;
+      .\WebCoreCFNetwork.vsprops;
+      .\WebCorePthreads.vsprops;
+      .\WebCoreMediaQT.vsprops;
+      .\WebCoreQuartzCore.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Source/WebCore/WebCore.vcproj/WebCoreRelease.vsprops b/Source/WebCore/WebCore.vcproj/WebCoreRelease.vsprops
new file mode 100644
index 0000000..f1c9d03
--- /dev/null
+++ b/Source/WebCore/WebCore.vcproj/WebCoreRelease.vsprops
@@ -0,0 +1,17 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="WebCoreRelease"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
+      .\WebCoreCommon.vsprops;
+      .\WebCoreCG.vsprops;
+      .\WebCoreCFNetwork.vsprops;
+      .\WebCorePthreads.vsprops;
+      .\WebCoreMediaQT.vsprops;
+      .\WebCoreQuartzCore.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Source/WebCore/WebCore.vcproj/WebCoreReleaseCairoCFLite.vsprops b/Source/WebCore/WebCore.vcproj/WebCoreReleaseCairoCFLite.vsprops
new file mode 100644
index 0000000..613c9b1
--- /dev/null
+++ b/Source/WebCore/WebCore.vcproj/WebCoreReleaseCairoCFLite.vsprops
@@ -0,0 +1,15 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="WebCoreReleaseCairoCFLite"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefinesCairo.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\WinCairo.vsprops;
+      .\WebCoreCommon.vsprops;
+      .\WebCoreCairo.vsprops;
+      .\WebCoreCURL.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Source/WebCore/WebCore.vcproj/copyForwardingHeaders.cmd b/Source/WebCore/WebCore.vcproj/copyForwardingHeaders.cmd
index c6c74df..98d2452 100755
--- a/Source/WebCore/WebCore.vcproj/copyForwardingHeaders.cmd
+++ b/Source/WebCore/WebCore.vcproj/copyForwardingHeaders.cmd
@@ -36,6 +36,7 @@ xcopy /y /d "%ProjectDir%..\css\*.h" "%CONFIGURATIONBUILDDIR%\include\WebCore"
 xcopy /y /d "%ProjectDir%..\platform\*.h" "%CONFIGURATIONBUILDDIR%\include\WebCore"
 xcopy /y /d "%ProjectDir%..\platform\animation\*.h" "%CONFIGURATIONBUILDDIR%\include\WebCore"
 xcopy /y /d "%ProjectDir%..\platform\cf\*.h" "%CONFIGURATIONBUILDDIR%\include\WebCore"
+xcopy /y /d "%ProjectDir%..\platform\cf\win\*.h" "%CONFIGURATIONBUILDDIR%\include\WebCore"
 xcopy /y /d "%ProjectDir%..\platform\graphics\*.h" "%CONFIGURATIONBUILDDIR%\include\WebCore"
 xcopy /y /d "%ProjectDir%..\platform\graphics\%1\*.h" "%CONFIGURATIONBUILDDIR%\include\WebCore"
 xcopy /y /d "%ProjectDir%..\platform\graphics\transforms\*.h" "%CONFIGURATIONBUILDDIR%\include\WebCore"
diff --git a/Source/WebCore/WebCore.xcodeproj/project.pbxproj b/Source/WebCore/WebCore.xcodeproj/project.pbxproj
index 403a618..45ea664 100644
--- a/Source/WebCore/WebCore.xcodeproj/project.pbxproj
+++ b/Source/WebCore/WebCore.xcodeproj/project.pbxproj
@@ -54,7 +54,11 @@
 		06E81ED70AB5D5E900C87837 /* LocalCurrentGraphicsContext.h in Headers */ = {isa = PBXBuildFile; fileRef = 06E81ED60AB5D5E900C87837 /* LocalCurrentGraphicsContext.h */; };
 		06E81EEC0AB5DA9700C87837 /* LocalCurrentGraphicsContext.mm in Sources */ = {isa = PBXBuildFile; fileRef = 06E81EEB0AB5DA9700C87837 /* LocalCurrentGraphicsContext.mm */; };
 		0709FC4E1025DEE30059CDBA /* AccessibilitySlider.h in Headers */ = {isa = PBXBuildFile; fileRef = 0709FC4D1025DEE30059CDBA /* AccessibilitySlider.h */; };
+		072C8B11131C518600A4FCE9 /* MediaPlayerPrivateAVFoundation.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 076F0D0912B8192700C26AA4 /* MediaPlayerPrivateAVFoundation.cpp */; };
+		072C8B12131C518B00A4FCE9 /* MediaPlayerPrivateAVFoundationObjC.mm in Sources */ = {isa = PBXBuildFile; fileRef = 076F0D0C12B8192700C26AA4 /* MediaPlayerPrivateAVFoundationObjC.mm */; };
 		0735EE6A0F40C5E4004A2604 /* MediaPlayerProxy.h in Headers */ = {isa = PBXBuildFile; fileRef = 0735EE690F40C5E4004A2604 /* MediaPlayerProxy.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		076F0D0E12B8192700C26AA4 /* MediaPlayerPrivateAVFoundation.h in Headers */ = {isa = PBXBuildFile; fileRef = 076F0D0A12B8192700C26AA4 /* MediaPlayerPrivateAVFoundation.h */; };
+		076F0D0F12B8192700C26AA4 /* MediaPlayerPrivateAVFoundationObjC.h in Headers */ = {isa = PBXBuildFile; fileRef = 076F0D0B12B8192700C26AA4 /* MediaPlayerPrivateAVFoundationObjC.h */; };
 		07B0113F1032242200FBDC33 /* AccessibilityMediaControls.h in Headers */ = {isa = PBXBuildFile; fileRef = 07B0113E1032242200FBDC33 /* AccessibilityMediaControls.h */; };
 		080081960ED3B2DD00C53BC0 /* WMLAnchorElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 080081940ED3B2DD00C53BC0 /* WMLAnchorElement.cpp */; };
 		080081970ED3B2DD00C53BC0 /* WMLAnchorElement.h in Headers */ = {isa = PBXBuildFile; fileRef = 080081950ED3B2DD00C53BC0 /* WMLAnchorElement.h */; };
@@ -458,9 +462,9 @@
 		1A85B2B70A1B2AC700D8C87C /* JSHTMLDivElement.h in Headers */ = {isa = PBXBuildFile; fileRef = 1A85B2B50A1B2AC700D8C87C /* JSHTMLDivElement.h */; };
 		1A8F6B020DB53006001DB794 /* SubstituteResource.h in Headers */ = {isa = PBXBuildFile; fileRef = 1A8F6B010DB53006001DB794 /* SubstituteResource.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		1A8F6BBC0DB55CDC001DB794 /* ApplicationCache.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1A8F6BB10DB55CDC001DB794 /* ApplicationCache.cpp */; };
-		1A8F6BBD0DB55CDC001DB794 /* ApplicationCache.h in Headers */ = {isa = PBXBuildFile; fileRef = 1A8F6BB20DB55CDC001DB794 /* ApplicationCache.h */; };
+		1A8F6BBD0DB55CDC001DB794 /* ApplicationCache.h in Headers */ = {isa = PBXBuildFile; fileRef = 1A8F6BB20DB55CDC001DB794 /* ApplicationCache.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		1A8F6BBE0DB55CDC001DB794 /* ApplicationCacheGroup.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1A8F6BB30DB55CDC001DB794 /* ApplicationCacheGroup.cpp */; };
-		1A8F6BBF0DB55CDC001DB794 /* ApplicationCacheGroup.h in Headers */ = {isa = PBXBuildFile; fileRef = 1A8F6BB40DB55CDC001DB794 /* ApplicationCacheGroup.h */; };
+		1A8F6BBF0DB55CDC001DB794 /* ApplicationCacheGroup.h in Headers */ = {isa = PBXBuildFile; fileRef = 1A8F6BB40DB55CDC001DB794 /* ApplicationCacheGroup.h */; settings = {ATTRIBUTES = (); }; };
 		1A8F6BC00DB55CDC001DB794 /* ApplicationCacheResource.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1A8F6BB50DB55CDC001DB794 /* ApplicationCacheResource.cpp */; };
 		1A8F6BC10DB55CDC001DB794 /* ApplicationCacheResource.h in Headers */ = {isa = PBXBuildFile; fileRef = 1A8F6BB60DB55CDC001DB794 /* ApplicationCacheResource.h */; };
 		1A8F6BC20DB55CDC001DB794 /* DOMApplicationCache.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1A8F6BB70DB55CDC001DB794 /* DOMApplicationCache.cpp */; };
@@ -641,6 +645,7 @@
 		20D629271253690B00081543 /* InspectorInstrumentation.h in Headers */ = {isa = PBXBuildFile; fileRef = 20D629251253690B00081543 /* InspectorInstrumentation.h */; };
 		22885E641301AE4C00526E68 /* JSDOMImplementationCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 22885E631301AE4C00526E68 /* JSDOMImplementationCustom.cpp */; };
 		228C284510D82500009D0D0E /* ScriptWrappable.h in Headers */ = {isa = PBXBuildFile; fileRef = 228C284410D82500009D0D0E /* ScriptWrappable.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		245D80A313280E40003492A6 /* SQLCallbackWrapper.h in Headers */ = {isa = PBXBuildFile; fileRef = 245D80A213280E40003492A6 /* SQLCallbackWrapper.h */; };
 		24F54EAC101FE914000AE741 /* ApplicationCacheHost.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 24F54EAA101FE914000AE741 /* ApplicationCacheHost.cpp */; };
 		24F54EAD101FE914000AE741 /* ApplicationCacheHost.h in Headers */ = {isa = PBXBuildFile; fileRef = 24F54EAB101FE914000AE741 /* ApplicationCacheHost.h */; settings = {ATTRIBUTES = (); }; };
 		2542F4DA1166C25A00E89A86 /* UserGestureIndicator.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 2542F4D81166C25A00E89A86 /* UserGestureIndicator.cpp */; };
@@ -769,6 +774,20 @@
 		316FE1180E6E1DA700BF6088 /* ImplicitAnimation.h in Headers */ = {isa = PBXBuildFile; fileRef = 316FE10E0E6E1DA700BF6088 /* ImplicitAnimation.h */; };
 		316FE1190E6E1DA700BF6088 /* KeyframeAnimation.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 316FE10F0E6E1DA700BF6088 /* KeyframeAnimation.cpp */; };
 		316FE11A0E6E1DA700BF6088 /* KeyframeAnimation.h in Headers */ = {isa = PBXBuildFile; fileRef = 316FE1100E6E1DA700BF6088 /* KeyframeAnimation.h */; };
+		3194616213020B20004BB3F8 /* JSWebKitAnimation.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 3194616013020B20004BB3F8 /* JSWebKitAnimation.cpp */; };
+		3194616313020B20004BB3F8 /* JSWebKitAnimation.h in Headers */ = {isa = PBXBuildFile; fileRef = 3194616113020B20004BB3F8 /* JSWebKitAnimation.h */; };
+		3194616A13020B66004BB3F8 /* DOMWebKitAnimation.h in Headers */ = {isa = PBXBuildFile; fileRef = 3194616813020B66004BB3F8 /* DOMWebKitAnimation.h */; };
+		3194616B13020B66004BB3F8 /* DOMWebKitAnimation.mm in Sources */ = {isa = PBXBuildFile; fileRef = 3194616913020B66004BB3F8 /* DOMWebKitAnimation.mm */; };
+		319461FE13022BB8004BB3F8 /* JSWebKitAnimationList.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 319461FC13022BB8004BB3F8 /* JSWebKitAnimationList.cpp */; };
+		319461FF13022BB8004BB3F8 /* JSWebKitAnimationList.h in Headers */ = {isa = PBXBuildFile; fileRef = 319461FD13022BB8004BB3F8 /* JSWebKitAnimationList.h */; };
+		3194620413022BF1004BB3F8 /* DOMWebKitAnimationList.h in Headers */ = {isa = PBXBuildFile; fileRef = 3194620213022BF1004BB3F8 /* DOMWebKitAnimationList.h */; };
+		3194620513022BF1004BB3F8 /* DOMWebKitAnimationList.mm in Sources */ = {isa = PBXBuildFile; fileRef = 3194620313022BF1004BB3F8 /* DOMWebKitAnimationList.mm */; };
+		3194623213022F65004BB3F8 /* JSWebKitAnimationListCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 3194623113022F65004BB3F8 /* JSWebKitAnimationListCustom.cpp */; };
+		319E68871327C911004AC91A /* JSWebKitAnimationCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 319E68861327C911004AC91A /* JSWebKitAnimationCustom.cpp */; };
+		319E69B213299BBD004AC91A /* WebKitAnimation.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 319E69AC13299BBD004AC91A /* WebKitAnimation.cpp */; };
+		319E69B313299BBD004AC91A /* WebKitAnimation.h in Headers */ = {isa = PBXBuildFile; fileRef = 319E69AD13299BBD004AC91A /* WebKitAnimation.h */; };
+		319E69B513299BBD004AC91A /* WebKitAnimationList.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 319E69AF13299BBD004AC91A /* WebKitAnimationList.cpp */; };
+		319E69B613299BBD004AC91A /* WebKitAnimationList.h in Headers */ = {isa = PBXBuildFile; fileRef = 319E69B013299BBD004AC91A /* WebKitAnimationList.h */; };
 		31C0FF210E4CEB6E007D6FE5 /* WebKitAnimationEvent.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 31C0FF1B0E4CEB6E007D6FE5 /* WebKitAnimationEvent.cpp */; };
 		31C0FF220E4CEB6E007D6FE5 /* WebKitAnimationEvent.h in Headers */ = {isa = PBXBuildFile; fileRef = 31C0FF1C0E4CEB6E007D6FE5 /* WebKitAnimationEvent.h */; };
 		31C0FF240E4CEB6E007D6FE5 /* WebKitTransitionEvent.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 31C0FF1E0E4CEB6E007D6FE5 /* WebKitTransitionEvent.cpp */; };
@@ -851,6 +870,9 @@
 		37F818FD0D657606005E1F05 /* WebCoreURLResponse.h in Headers */ = {isa = PBXBuildFile; fileRef = 37F818FB0D657606005E1F05 /* WebCoreURLResponse.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		37F818FE0D657606005E1F05 /* WebCoreURLResponse.mm in Sources */ = {isa = PBXBuildFile; fileRef = 37F818FC0D657606005E1F05 /* WebCoreURLResponse.mm */; };
 		37FD4298118368460093C029 /* TreeDepthLimit.h in Headers */ = {isa = PBXBuildFile; fileRef = 37FD4297118368460093C029 /* TreeDepthLimit.h */; };
+		3AB02D2A12D4F91600FBB694 /* StorageTracker.h in Headers */ = {isa = PBXBuildFile; fileRef = 3AB02D2812D4F91600FBB694 /* StorageTracker.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		3AB02D2B12D4F91600FBB694 /* StorageTracker.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 3AB02D2912D4F91600FBB694 /* StorageTracker.cpp */; };
+		3AC3680012EF7A09006A3D6F /* StorageTrackerClient.h in Headers */ = {isa = PBXBuildFile; fileRef = 3AC367FE12EF7A09006A3D6F /* StorageTrackerClient.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		3AC648B2129E146500C3EB25 /* EditingBoundary.h in Headers */ = {isa = PBXBuildFile; fileRef = 3AC648B1129E146500C3EB25 /* EditingBoundary.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		41002CCD0F66EDEF009E660D /* ScriptFunctionCall.h in Headers */ = {isa = PBXBuildFile; fileRef = 41002CCB0F66EDEF009E660D /* ScriptFunctionCall.h */; };
 		41002CCE0F66EDEF009E660D /* ScriptFunctionCall.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 41002CCC0F66EDEF009E660D /* ScriptFunctionCall.cpp */; };
@@ -880,6 +902,8 @@
 		416E75CC0EDF90C700360E1D /* ScriptCallFrame.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 416E75CA0EDF90C700360E1D /* ScriptCallFrame.cpp */; };
 		41885B9311B6FDA6003383BB /* FormSubmission.h in Headers */ = {isa = PBXBuildFile; fileRef = 41885B9111B6FDA6003383BB /* FormSubmission.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		41885B9411B6FDA6003383BB /* FormSubmission.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 41885B9211B6FDA6003383BB /* FormSubmission.cpp */; };
+		418A06D0133C04D500CD379C /* EventDispatcher.h in Headers */ = {isa = PBXBuildFile; fileRef = 418A06CE133C04D500CD379C /* EventDispatcher.h */; };
+		418A06D1133C04D500CD379C /* EventDispatcher.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 418A06CF133C04D500CD379C /* EventDispatcher.cpp */; };
 		418F88040FF957AE0080F045 /* JSAbstractWorker.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 418F88020FF957AE0080F045 /* JSAbstractWorker.cpp */; };
 		418F88050FF957AF0080F045 /* JSAbstractWorker.h in Headers */ = {isa = PBXBuildFile; fileRef = 418F88030FF957AE0080F045 /* JSAbstractWorker.h */; };
 		41A3D58E101C152D00316D07 /* DedicatedWorkerThread.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 41A3D58C101C152D00316D07 /* DedicatedWorkerThread.cpp */; };
@@ -979,7 +1003,6 @@
 		44311CD812E4E24B000A8D19 /* DOMDocumentPrivate.h in Copy Generated Headers */ = {isa = PBXBuildFile; fileRef = 44311CD512E4E22D000A8D19 /* DOMDocumentPrivate.h */; };
 		44311CD912E4E257000A8D19 /* DOMDocumentFragmentPrivate.h in Copy Generated Headers */ = {isa = PBXBuildFile; fileRef = 44311CD412E4E22D000A8D19 /* DOMDocumentFragmentPrivate.h */; };
 		44311F8212E4E66C000A8D19 /* DOMDocumentFragmentInternal.h in Headers */ = {isa = PBXBuildFile; fileRef = 85E711450AC5D5340053270F /* DOMDocumentFragmentInternal.h */; };
-		445C8DB710015FC90031531A /* IconDatabaseNone.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 445C8DB610015FC90031531A /* IconDatabaseNone.cpp */; };
 		447D69030FA626810015CCB1 /* RuntimeApplicationChecks.h in Headers */ = {isa = PBXBuildFile; fileRef = 447D69010FA626810015CCB1 /* RuntimeApplicationChecks.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		447D69040FA626810015CCB1 /* RuntimeApplicationChecks.mm in Sources */ = {isa = PBXBuildFile; fileRef = 447D69020FA626810015CCB1 /* RuntimeApplicationChecks.mm */; };
 		448A29BF0A46D9CB0030759F /* JSHTMLOptionsCollection.h in Headers */ = {isa = PBXBuildFile; fileRef = 448A29BD0A46D9CB0030759F /* JSHTMLOptionsCollection.h */; };
@@ -1211,6 +1234,8 @@
 		4E19592C0A39DACC00220FE5 /* MediaQueryEvaluator.h in Headers */ = {isa = PBXBuildFile; fileRef = 4E1959260A39DACC00220FE5 /* MediaQueryEvaluator.h */; };
 		4E19592D0A39DACC00220FE5 /* MediaQueryExp.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 4E1959270A39DACC00220FE5 /* MediaQueryExp.cpp */; };
 		4E19592E0A39DACC00220FE5 /* MediaQueryExp.h in Headers */ = {isa = PBXBuildFile; fileRef = 4E1959280A39DACC00220FE5 /* MediaQueryExp.h */; };
+		4F1442281339FD6200E0D6F8 /* DOMNodeHighlighter.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 4F1442261339FD6200E0D6F8 /* DOMNodeHighlighter.cpp */; };
+		4F1442291339FD6200E0D6F8 /* DOMNodeHighlighter.h in Headers */ = {isa = PBXBuildFile; fileRef = 4F1442271339FD6200E0D6F8 /* DOMNodeHighlighter.h */; };
 		4F1534DE11B532EC0021FD86 /* EditingBehavior.h in Headers */ = {isa = PBXBuildFile; fileRef = 4F1534DD11B532EC0021FD86 /* EditingBehavior.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		4F1534E011B533020021FD86 /* EditingBehaviorTypes.h in Headers */ = {isa = PBXBuildFile; fileRef = 4F1534DF11B533020021FD86 /* EditingBehaviorTypes.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		4F2D205412EAE7B3005C2874 /* InspectorAgent.h in Headers */ = {isa = PBXBuildFile; fileRef = 4F2D205212EAE7B3005C2874 /* InspectorAgent.h */; settings = {ATTRIBUTES = (Private, ); }; };
@@ -1218,6 +1243,8 @@
 		4F3289B511A42AAB005ABE7E /* InspectorValues.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 4F3289B311A42AAB005ABE7E /* InspectorValues.cpp */; };
 		4F3289B611A42AAB005ABE7E /* InspectorValues.h in Headers */ = {isa = PBXBuildFile; fileRef = 4F3289B411A42AAB005ABE7E /* InspectorValues.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		4F4F5FFB11CBD2E100A186BF /* InspectorFrontend.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 4F4F5FFA11CBD2D200A186BF /* InspectorFrontend.cpp */; };
+		4F6FDD641341DEDD001F8EE3 /* InspectorPageAgent.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 4F6FDD621341DEDD001F8EE3 /* InspectorPageAgent.cpp */; };
+		4F6FDD651341DEDD001F8EE3 /* InspectorPageAgent.h in Headers */ = {isa = PBXBuildFile; fileRef = 4F6FDD631341DEDD001F8EE3 /* InspectorPageAgent.h */; };
 		4F707A9911EF679400ACDA69 /* InspectorBackendDispatcher.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 4F707A9711EF679400ACDA69 /* InspectorBackendDispatcher.cpp */; };
 		4F707A9A11EF679400ACDA69 /* InspectorBackendDispatcher.h in Headers */ = {isa = PBXBuildFile; fileRef = 4F707A9811EF679400ACDA69 /* InspectorBackendDispatcher.h */; };
 		4FA3B90A125CD12200300BAD /* InspectorState.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 4FA3B908125CD12100300BAD /* InspectorState.cpp */; };
@@ -1299,6 +1326,8 @@
 		5160F4980B0AA75F00C1D2AF /* HistoryItemMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = 5160F4970B0AA75F00C1D2AF /* HistoryItemMac.mm */; };
 		5162C7F411F77EFB00612EFE /* SchemeRegistry.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 5162C7F211F77EFA00612EFE /* SchemeRegistry.cpp */; };
 		5162C7F511F77EFB00612EFE /* SchemeRegistry.h in Headers */ = {isa = PBXBuildFile; fileRef = 5162C7F311F77EFB00612EFE /* SchemeRegistry.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		516953971329A3C800B92D04 /* IconDatabaseBase.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 516953951329A3C800B92D04 /* IconDatabaseBase.cpp */; };
+		516953981329A3C800B92D04 /* IconDatabaseBase.h in Headers */ = {isa = PBXBuildFile; fileRef = 516953961329A3C800B92D04 /* IconDatabaseBase.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		516BB7940CE91E6800512F79 /* JSTreeWalkerCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 516BB7920CE91E6800512F79 /* JSTreeWalkerCustom.cpp */; };
 		51721FBB11D2790700638B42 /* BeforeProcessEvent.h in Headers */ = {isa = PBXBuildFile; fileRef = 51721FB911D2790700638B42 /* BeforeProcessEvent.h */; };
 		51721FD211D27EF200638B42 /* JSBeforeProcessEvent.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 51721FD011D27EF200638B42 /* JSBeforeProcessEvent.cpp */; };
@@ -1377,7 +1406,6 @@
 		590E1B4B11E4EF700069F784 /* JSDeviceOrientationEventCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 590E1B4A11E4EF700069F784 /* JSDeviceOrientationEventCustom.cpp */; };
 		59309A1111F4AE5800250603 /* DeviceOrientationClientMock.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 59309A1011F4AE5800250603 /* DeviceOrientationClientMock.cpp */; };
 		59309A1311F4AE6A00250603 /* DeviceOrientationClientMock.h in Headers */ = {isa = PBXBuildFile; fileRef = 59309A1211F4AE6A00250603 /* DeviceOrientationClientMock.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		593D3EAD132532840057E7EE /* JavaMethod.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 593D3EAC132532840057E7EE /* JavaMethod.cpp */; };
 		593D3EAF1325328C0057E7EE /* JavaMethod.h in Headers */ = {isa = PBXBuildFile; fileRef = 593D3EAE1325328C0057E7EE /* JavaMethod.h */; };
 		593D3EB1132532950057E7EE /* JavaString.h in Headers */ = {isa = PBXBuildFile; fileRef = 593D3EB0132532950057E7EE /* JavaString.h */; };
 		596229781133EFD700DC4CBB /* GeolocationPositionCache.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 596229771133EFD700DC4CBB /* GeolocationPositionCache.cpp */; };
@@ -1388,6 +1416,8 @@
 		598D77DF132541FA00761B22 /* JavaArrayJSC.h in Headers */ = {isa = PBXBuildFile; fileRef = 598D77DE132541FA00761B22 /* JavaArrayJSC.h */; };
 		598D77E11325420400761B22 /* JavaFieldJSC.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 598D77E01325420400761B22 /* JavaFieldJSC.cpp */; };
 		598D77E31325420E00761B22 /* JavaFieldJSC.h in Headers */ = {isa = PBXBuildFile; fileRef = 598D77E21325420E00761B22 /* JavaFieldJSC.h */; };
+		599C671C1343438900C3423C /* JavaMethodJobject.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 599C671B1343438900C3423C /* JavaMethodJobject.cpp */; };
+		599C671E1343439400C3423C /* JavaMethodJobject.h in Headers */ = {isa = PBXBuildFile; fileRef = 599C671D1343439400C3423C /* JavaMethodJobject.h */; };
 		599E759011055A1F00D904FA /* Bridge.h in Headers */ = {isa = PBXBuildFile; fileRef = 599E758F11055A1F00D904FA /* Bridge.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		59A85EA2119D68D900DEF1EF /* DeviceOrientationEvent.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 59A85EA1119D68D900DEF1EF /* DeviceOrientationEvent.cpp */; };
 		59A85EA4119D68EC00DEF1EF /* DeviceOrientationEvent.h in Headers */ = {isa = PBXBuildFile; fileRef = 59A85EA3119D68EC00DEF1EF /* DeviceOrientationEvent.h */; };
@@ -1398,6 +1428,7 @@
 		59A8F1D811A69520001AC34A /* DeviceOrientationClient.h in Headers */ = {isa = PBXBuildFile; fileRef = 59A8F1D711A69520001AC34A /* DeviceOrientationClient.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		59A9E7B01104758800DFB4C1 /* JavaInstanceJSC.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 59A9E7AF1104758800DFB4C1 /* JavaInstanceJSC.cpp */; };
 		59A9E7B21104759400DFB4C1 /* JavaInstanceJSC.h in Headers */ = {isa = PBXBuildFile; fileRef = 59A9E7B11104759400DFB4C1 /* JavaInstanceJSC.h */; };
+		59B0EEA7132A6F2A004331C7 /* JavaType.h in Headers */ = {isa = PBXBuildFile; fileRef = 59B0EEA6132A6F2A004331C7 /* JavaType.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		59B597731108656B007159E8 /* BridgeJSC.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 59B597721108656B007159E8 /* BridgeJSC.cpp */; };
 		59B5977511086579007159E8 /* BridgeJSC.h in Headers */ = {isa = PBXBuildFile; fileRef = 59B5977411086579007159E8 /* BridgeJSC.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		59BC393F11054A1300FD85DB /* JavaStringJSC.h in Headers */ = {isa = PBXBuildFile; fileRef = 59BC393E11054A1300FD85DB /* JavaStringJSC.h */; };
@@ -1414,6 +1445,7 @@
 		5A574F29131DB96D00471B88 /* QuotesData.h in Headers */ = {isa = PBXBuildFile; fileRef = 5A574F27131DB96D00471B88 /* QuotesData.h */; };
 		5D15E3AB0F9E6AC1009E0E3F /* XMLDocumentParserScope.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 5D15E3A90F9E6AC1009E0E3F /* XMLDocumentParserScope.cpp */; };
 		5D15E3AC0F9E6AC1009E0E3F /* XMLDocumentParserScope.h in Headers */ = {isa = PBXBuildFile; fileRef = 5D15E3AA0F9E6AC1009E0E3F /* XMLDocumentParserScope.h */; };
+		5D4F51DF132725480016F541 /* HTMLConverter.mm in Sources */ = {isa = PBXBuildFile; fileRef = C5392D341326AD0100043D35 /* HTMLConverter.mm */; };
 		5D874F130D161D3200796C3B /* NetscapePlugInStreamLoader.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 93E227DD0AF589AD00D48324 /* NetscapePlugInStreamLoader.cpp */; };
 		5D87BB8311E3ED8600702B6F /* ExportFileGenerator.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 5D87BB8211E3ED8600702B6F /* ExportFileGenerator.cpp */; };
 		5D88EE9111407FD300BC3ABC /* DOMSVGFEMorphologyElement.h in Copy Generated Headers */ = {isa = PBXBuildFile; fileRef = 84224189107E786F00766A87 /* DOMSVGFEMorphologyElement.h */; };
@@ -1641,6 +1673,7 @@
 		7AFD4A8B1131C2760035B883 /* ScriptBreakpoint.h in Headers */ = {isa = PBXBuildFile; fileRef = 7AFD4A8A1131C2760035B883 /* ScriptBreakpoint.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		7AFD4FF4113277B60035B883 /* ScriptDebugListener.h in Headers */ = {isa = PBXBuildFile; fileRef = 7AFD4FF3113277B60035B883 /* ScriptDebugListener.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		7E33CD01127F340D00BE8F17 /* PurgePriority.h in Headers */ = {isa = PBXBuildFile; fileRef = 7E33CD00127F340D00BE8F17 /* PurgePriority.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		7E37EF2E1339208800B29250 /* SubresourceLoaderCF.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 7E37EF2D1339208800B29250 /* SubresourceLoaderCF.cpp */; };
 		7EE6845F12D26E3800E79415 /* AuthenticationCF.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 7EE6844C12D26E3800E79415 /* AuthenticationCF.cpp */; };
 		7EE6846012D26E3800E79415 /* AuthenticationCF.h in Headers */ = {isa = PBXBuildFile; fileRef = 7EE6844D12D26E3800E79415 /* AuthenticationCF.h */; };
 		7EE6846112D26E3800E79415 /* AuthenticationChallenge.h in Headers */ = {isa = PBXBuildFile; fileRef = 7EE6844E12D26E3800E79415 /* AuthenticationChallenge.h */; settings = {ATTRIBUTES = (Private, ); }; };
@@ -1661,9 +1694,16 @@
 		7EE6847012D26E3800E79415 /* ResourceResponse.h in Headers */ = {isa = PBXBuildFile; fileRef = 7EE6845D12D26E3800E79415 /* ResourceResponse.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		7EE6847112D26E3800E79415 /* ResourceResponseCFNet.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 7EE6845E12D26E3800E79415 /* ResourceResponseCFNet.cpp */; };
 		7EE6847512D26E7000E79415 /* ResourceLoaderCFNet.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 7EE6847412D26E7000E79415 /* ResourceLoaderCFNet.cpp */; };
+		809DD1DF130DE2AD00CAE3ED /* CSSStyleApplyProperty.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 809DD1DD130DE2AD00CAE3ED /* CSSStyleApplyProperty.cpp */; };
+		809DD1E0130DE2AD00CAE3ED /* CSSStyleApplyProperty.h in Headers */ = {isa = PBXBuildFile; fileRef = 809DD1DE130DE2AD00CAE3ED /* CSSStyleApplyProperty.h */; };
+		8102C5881325BB1100DDE67A /* StringCallback.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 8102C5871325BB1100DDE67A /* StringCallback.cpp */; };
+		815E6167132587AA00B622B0 /* DataTransferItem.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 815E6166132587AA00B622B0 /* DataTransferItem.cpp */; };
 		81A7325E1210189B00FC0D9E /* IDBCursor.h in Headers */ = {isa = PBXBuildFile; fileRef = 81A7325D1210189B00FC0D9E /* IDBCursor.h */; };
 		81A73260121018A400FC0D9E /* IDBCursor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 81A7325F121018A400FC0D9E /* IDBCursor.cpp */; };
 		81A73278121019E100FC0D9E /* IDBCursorBackendImpl.h in Headers */ = {isa = PBXBuildFile; fileRef = 81A73277121019E100FC0D9E /* IDBCursorBackendImpl.h */; };
+		81AC5999131636E60009A7E0 /* DataTransferItem.h in Headers */ = {isa = PBXBuildFile; fileRef = 81AC5997131636E60009A7E0 /* DataTransferItem.h */; };
+		81AC599A131636E60009A7E0 /* DataTransferItems.h in Headers */ = {isa = PBXBuildFile; fileRef = 81AC5998131636E60009A7E0 /* DataTransferItems.h */; };
+		81AC6C36131C57D30009A7E0 /* StringCallback.h in Headers */ = {isa = PBXBuildFile; fileRef = 81AC6C35131C57D30009A7E0 /* StringCallback.h */; };
 		81BE209811F4AB8D00915DFA /* IDBCursorBackendImpl.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 81BE209311F4AB8D00915DFA /* IDBCursorBackendImpl.cpp */; };
 		81BE209911F4AB8D00915DFA /* IDBCursorBackendInterface.h in Headers */ = {isa = PBXBuildFile; fileRef = 81BE209411F4AB8D00915DFA /* IDBCursorBackendInterface.h */; };
 		81BE20D211F4BC3200915DFA /* JSIDBCursor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 81BE20A711F4B66F00915DFA /* JSIDBCursor.cpp */; };
@@ -1752,6 +1792,7 @@
 		84A81F3E0FC7DFF000955300 /* SourceAlpha.h in Headers */ = {isa = PBXBuildFile; fileRef = 84A81F3C0FC7DFF000955300 /* SourceAlpha.h */; };
 		84A81F410FC7E02700955300 /* SourceGraphic.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 84A81F3F0FC7E02700955300 /* SourceGraphic.cpp */; };
 		84A81F420FC7E02700955300 /* SourceGraphic.h in Headers */ = {isa = PBXBuildFile; fileRef = 84A81F400FC7E02700955300 /* SourceGraphic.h */; };
+		84B62685133138F90095A489 /* FontPlatformData.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 84B62684133138F90095A489 /* FontPlatformData.cpp */; };
 		84B6B977120F13E500B8EFAF /* SVGPathSegListSource.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 84B6B975120F13E500B8EFAF /* SVGPathSegListSource.cpp */; };
 		84B6B978120F13E500B8EFAF /* SVGPathSegListSource.h in Headers */ = {isa = PBXBuildFile; fileRef = 84B6B976120F13E500B8EFAF /* SVGPathSegListSource.h */; };
 		84C5B2FA1216DC810088B53A /* SVGPathTraversalStateBuilder.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 84C5B2F81216DC810088B53A /* SVGPathTraversalStateBuilder.cpp */; };
@@ -2706,8 +2747,8 @@
 		89D08DA112228451001241DF /* AsyncFileSystemCallbacks.h in Headers */ = {isa = PBXBuildFile; fileRef = 89D08D9E12228451001241DF /* AsyncFileSystemCallbacks.h */; };
 		8A12E35D11FA33280025836A /* DocumentLoadTiming.h in Headers */ = {isa = PBXBuildFile; fileRef = 8A12E35C11FA33280025836A /* DocumentLoadTiming.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		8A309C9F123950BE00CB9204 /* NestingLevelIncrementer.h in Headers */ = {isa = PBXBuildFile; fileRef = 8A309C9E123950BE00CB9204 /* NestingLevelIncrementer.h */; };
-		8A413AE01207BBA50082016E /* AsyncScriptRunner.h in Headers */ = {isa = PBXBuildFile; fileRef = 8A413ADE1207BBA50082016E /* AsyncScriptRunner.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		8A413AE11207BBA50082016E /* AsyncScriptRunner.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 8A413ADF1207BBA50082016E /* AsyncScriptRunner.cpp */; };
+		8A413AE01207BBA50082016E /* ScriptRunner.h in Headers */ = {isa = PBXBuildFile; fileRef = 8A413ADE1207BBA50082016E /* ScriptRunner.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		8A413AE11207BBA50082016E /* ScriptRunner.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 8A413ADF1207BBA50082016E /* ScriptRunner.cpp */; };
 		8A7CC96B12076D73001D4588 /* PendingScript.h in Headers */ = {isa = PBXBuildFile; fileRef = 8A7CC96A12076D73001D4588 /* PendingScript.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		8A7CC97012076F8A001D4588 /* PendingScript.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 8A7CC96F12076F8A001D4588 /* PendingScript.cpp */; };
 		8A81BF8511DCFD9000DA2B98 /* ResourceLoadTiming.h in Headers */ = {isa = PBXBuildFile; fileRef = 8A81BF8411DCFD9000DA2B98 /* ResourceLoadTiming.h */; settings = {ATTRIBUTES = (Private, ); }; };
@@ -2945,7 +2986,6 @@
 		93F199B808245E59001E9ABC /* Scrollbar.h in Headers */ = {isa = PBXBuildFile; fileRef = BC7B2AF80450824100A8000F /* Scrollbar.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		93F199BB08245E59001E9ABC /* WebCoreKeyboardUIMode.h in Headers */ = {isa = PBXBuildFile; fileRef = BE983D95052A2E0A00892D85 /* WebCoreKeyboardUIMode.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		93F199BE08245E59001E9ABC /* BlockExceptions.h in Headers */ = {isa = PBXBuildFile; fileRef = 65A640F00533BB1F0085E777 /* BlockExceptions.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		93F199C208245E59001E9ABC /* WebCoreKeyGenerator.h in Headers */ = {isa = PBXBuildFile; fileRef = 84B2B1F7056BEF3A00D2B771 /* WebCoreKeyGenerator.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		93F199DE08245E59001E9ABC /* Position.h in Headers */ = {isa = PBXBuildFile; fileRef = BE91FC8B06133666005E3790 /* Position.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		93F199E508245E59001E9ABC /* HTMLCanvasElement.h in Headers */ = {isa = PBXBuildFile; fileRef = 51F6A3D60663BF04004D2919 /* HTMLCanvasElement.h */; };
 		93F199E708245E59001E9ABC /* ClipboardMac.h in Headers */ = {isa = PBXBuildFile; fileRef = 2D90660B0665D937006B6F1A /* ClipboardMac.h */; settings = {ATTRIBUTES = (Private, ); }; };
@@ -2961,8 +3001,7 @@
 		93F19ABC08245E59001E9ABC /* XMLDocumentParser.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F523D30902DE4476018635CA /* XMLDocumentParser.cpp */; };
 		93F19AD508245E59001E9ABC /* RenderTreeAsText.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 93955A4203D72932008635CE /* RenderTreeAsText.cpp */; };
 		93F19AE108245E59001E9ABC /* BlockExceptions.mm in Sources */ = {isa = PBXBuildFile; fileRef = 65F80697054D9F86008BF776 /* BlockExceptions.mm */; };
-		93F19AE508245E59001E9ABC /* WebCoreKeyGenerator.m in Sources */ = {isa = PBXBuildFile; fileRef = 84B2B1F8056BEF3A00D2B771 /* WebCoreKeyGenerator.m */; };
-		93F19AE608245E59001E9ABC /* SSLKeyGeneratorMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = 84B2B24F056BF15F00D2B771 /* SSLKeyGeneratorMac.mm */; };
+		93F19AE608245E59001E9ABC /* SSLKeyGeneratorMac.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 84B2B24F056BF15F00D2B771 /* SSLKeyGeneratorMac.cpp */; };
 		93F19AF808245E59001E9ABC /* Position.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BE91FC8C06133666005E3790 /* Position.cpp */; };
 		93F19AFD08245E59001E9ABC /* HTMLCanvasElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 51F6A3D50663BF04004D2919 /* HTMLCanvasElement.cpp */; };
 		93F19AFF08245E59001E9ABC /* ClipboardMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = 2D90660C0665D937006B6F1A /* ClipboardMac.mm */; };
@@ -3173,6 +3212,7 @@
 		A77979280D6B9E64003851B9 /* JSImageData.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A77979240D6B9E64003851B9 /* JSImageData.cpp */; };
 		A77979290D6B9E64003851B9 /* JSImageData.h in Headers */ = {isa = PBXBuildFile; fileRef = A77979250D6B9E64003851B9 /* JSImageData.h */; };
 		A77B41A012E675A90054343D /* TextEventInputType.h in Headers */ = {isa = PBXBuildFile; fileRef = A77B419F12E675A90054343D /* TextEventInputType.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		A77D0012133B0AEB00D6658C /* TextChecking.h in Headers */ = {isa = PBXBuildFile; fileRef = A77D0011133B0AEB00D6658C /* TextChecking.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		A784941B0B5FE507001E237A /* Clipboard.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A784941A0B5FE507001E237A /* Clipboard.cpp */; };
 		A78FE13B12366B1000ACE8D0 /* SpellChecker.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A78FE13912366B1000ACE8D0 /* SpellChecker.cpp */; };
 		A78FE13C12366B1000ACE8D0 /* SpellChecker.h in Headers */ = {isa = PBXBuildFile; fileRef = A78FE13A12366B1000ACE8D0 /* SpellChecker.h */; settings = {ATTRIBUTES = (Private, ); }; };
@@ -4043,7 +4083,6 @@
 		ABDDFE7A0A5C6E7000A3E11D /* RenderMenuList.h in Headers */ = {isa = PBXBuildFile; fileRef = ABDDFE740A5C6E7000A3E11D /* RenderMenuList.h */; };
 		ABFE7E120D32FAF60066F4D2 /* MediaControlElements.cpp in Sources */ = {isa = PBXBuildFile; fileRef = ABFE7E100D32FAF50066F4D2 /* MediaControlElements.cpp */; };
 		ABFE7E130D32FAF60066F4D2 /* MediaControlElements.h in Headers */ = {isa = PBXBuildFile; fileRef = ABFE7E110D32FAF50066F4D2 /* MediaControlElements.h */; };
-		ADDF1AD61257CD9A0003A759 /* RenderSVGPath.cpp in Sources */ = {isa = PBXBuildFile; fileRef = ADDF1AD41257CD9A0003A759 /* RenderSVGPath.cpp */; };
 		ADDF1AD71257CD9A0003A759 /* RenderSVGPath.h in Headers */ = {isa = PBXBuildFile; fileRef = ADDF1AD51257CD9A0003A759 /* RenderSVGPath.h */; };
 		B0149E7D11A4B21500196A7B /* AsyncImageResizer.cpp in Sources */ = {isa = PBXBuildFile; fileRef = B0149E7911A4B21500196A7B /* AsyncImageResizer.cpp */; };
 		B0149E7E11A4B21500196A7B /* AsyncImageResizer.h in Headers */ = {isa = PBXBuildFile; fileRef = B0149E7A11A4B21500196A7B /* AsyncImageResizer.h */; };
@@ -5005,6 +5044,8 @@
 		BC772C4E0C4EB3040083285F /* MIMETypeRegistry.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC772C4C0C4EB3040083285F /* MIMETypeRegistry.cpp */; };
 		BC772C4F0C4EB3040083285F /* MIMETypeRegistry.h in Headers */ = {isa = PBXBuildFile; fileRef = BC772C4D0C4EB3040083285F /* MIMETypeRegistry.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC772C5E0C4EB3440083285F /* MIMETypeRegistryMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = BC772C5D0C4EB3440083285F /* MIMETypeRegistryMac.mm */; };
+		BC772E131331620C001EC9CE /* CSSLineBoxContainValue.h in Headers */ = {isa = PBXBuildFile; fileRef = BC772E121331620C001EC9CE /* CSSLineBoxContainValue.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		BC772E16133162C2001EC9CE /* CSSLineBoxContainValue.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC772E15133162C2001EC9CE /* CSSLineBoxContainValue.cpp */; };
 		BC77CB870FEBF5AF0070887B /* HTMLDataGridColElement.h in Headers */ = {isa = PBXBuildFile; fileRef = BC77CB860FEBF5AF0070887B /* HTMLDataGridColElement.h */; };
 		BC77CBAA0FEBF6C90070887B /* HTMLDataGridColElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC77CBA90FEBF6C90070887B /* HTMLDataGridColElement.cpp */; };
 		BC77CBD30FEBF8310070887B /* JSHTMLDataGridColElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC77CBD10FEBF8310070887B /* JSHTMLDataGridColElement.cpp */; };
@@ -5137,6 +5178,8 @@
 		BCC065880F3CE2A700CD2D87 /* JSClientRect.h in Headers */ = {isa = PBXBuildFile; fileRef = BCC065840F3CE2A700CD2D87 /* JSClientRect.h */; };
 		BCC065890F3CE2A700CD2D87 /* JSClientRectList.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BCC065850F3CE2A700CD2D87 /* JSClientRectList.cpp */; };
 		BCC0658A0F3CE2A700CD2D87 /* JSClientRectList.h in Headers */ = {isa = PBXBuildFile; fileRef = BCC065860F3CE2A700CD2D87 /* JSClientRectList.h */; };
+		BCC36EB81342AA3F004BEEF7 /* DefaultLocalizationStrategy.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BCC36EB61342AA3F004BEEF7 /* DefaultLocalizationStrategy.cpp */; };
+		BCC36EB91342AA3F004BEEF7 /* DefaultLocalizationStrategy.h in Headers */ = {isa = PBXBuildFile; fileRef = BCC36EB71342AA3F004BEEF7 /* DefaultLocalizationStrategy.h */; };
 		BCC438780E886CC700533DD5 /* JSHTMLInputElementCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BCC438770E886CC700533DD5 /* JSHTMLInputElementCustom.cpp */; };
 		BCC573350D695BBE006EF517 /* DOMProgressEvent.h in Headers */ = {isa = PBXBuildFile; fileRef = BCC573330D695BBE006EF517 /* DOMProgressEvent.h */; };
 		BCC573360D695BBE006EF517 /* DOMProgressEvent.mm in Sources */ = {isa = PBXBuildFile; fileRef = BCC573340D695BBE006EF517 /* DOMProgressEvent.mm */; };
@@ -5156,6 +5199,7 @@
 		BCD0E0FC0E972C3500265DEA /* SecurityOriginHash.h in Headers */ = {isa = PBXBuildFile; fileRef = BCD0E0F90E972C3500265DEA /* SecurityOriginHash.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BCD0FBD00DBD625E00B2F630 /* DOMAbstractView.mm in Sources */ = {isa = PBXBuildFile; fileRef = BCD0FBCF0DBD625E00B2F630 /* DOMAbstractView.mm */; };
 		BCD0FC4F0DBD720B00B2F630 /* DOMRGBColorInternal.h in Headers */ = {isa = PBXBuildFile; fileRef = BCD0FC4E0DBD720B00B2F630 /* DOMRGBColorInternal.h */; };
+		BCD3F9831326C93700098A60 /* TextOrientation.h in Headers */ = {isa = PBXBuildFile; fileRef = BCD3F9821326C93700098A60 /* TextOrientation.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BCD41ABB0C060DE800C0E446 /* JSHTMLFrameSetElementCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BCD41ABA0C060DE800C0E446 /* JSHTMLFrameSetElementCustom.cpp */; };
 		BCD533640ED6848900887468 /* CachedScriptSourceProvider.h in Headers */ = {isa = PBXBuildFile; fileRef = BCD533630ED6848900887468 /* CachedScriptSourceProvider.h */; };
 		BCD9C2620C17AA67005C90A2 /* JSDOMWindowCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BCD9C25E0C17AA67005C90A2 /* JSDOMWindowCustom.cpp */; };
@@ -5592,6 +5636,9 @@
 		ED501DC60B249F2900AE18D9 /* EditorMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = ED501DC50B249F2900AE18D9 /* EditorMac.mm */; };
 		EDE3A5000C7A430600956A37 /* ColorMac.h in Headers */ = {isa = PBXBuildFile; fileRef = EDE3A4FF0C7A430600956A37 /* ColorMac.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		EDEC98030AED7E170059137F /* WebCorePrefix.h in Headers */ = {isa = PBXBuildFile; fileRef = EDEC98020AED7E170059137F /* WebCorePrefix.h */; };
+		F316396B1329481A00A649CB /* InjectedScriptManager.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F31639691329481A00A649CB /* InjectedScriptManager.cpp */; };
+		F316396C1329481A00A649CB /* InjectedScriptManager.h in Headers */ = {isa = PBXBuildFile; fileRef = F316396A1329481A00A649CB /* InjectedScriptManager.h */; };
+		F316396E1329487600A649CB /* JSInjectedScriptManager.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F316396D1329487600A649CB /* JSInjectedScriptManager.cpp */; };
 		F3335BF812E07DC300D33011 /* InspectorConsoleAgent.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F3335BF612E07DC300D33011 /* InspectorConsoleAgent.cpp */; };
 		F3335BF912E07DC300D33011 /* InspectorConsoleAgent.h in Headers */ = {isa = PBXBuildFile; fileRef = F3335BF712E07DC300D33011 /* InspectorConsoleAgent.h */; };
 		F33F0282120947F200E5743A /* ScriptProfile.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F33F0281120947F200E5743A /* ScriptProfile.cpp */; };
@@ -5600,6 +5647,14 @@
 		F344C7141125B82C00F26EEE /* InspectorFrontendClient.h in Headers */ = {isa = PBXBuildFile; fileRef = F344C7121125B82C00F26EEE /* InspectorFrontendClient.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		F344C75311294D9D00F26EEE /* InspectorFrontendClientLocal.h in Headers */ = {isa = PBXBuildFile; fileRef = F344C75211294D9D00F26EEE /* InspectorFrontendClientLocal.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		F344C75811294FF600F26EEE /* InspectorFrontendClientLocal.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F344C75711294FF600F26EEE /* InspectorFrontendClientLocal.cpp */; };
+		F34742DC134362F000531BC2 /* PageDebuggerAgent.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F34742DA134362F000531BC2 /* PageDebuggerAgent.cpp */; };
+		F34742DD134362F000531BC2 /* PageDebuggerAgent.h in Headers */ = {isa = PBXBuildFile; fileRef = F34742DB134362F000531BC2 /* PageDebuggerAgent.h */; };
+		F34742E01343631F00531BC2 /* WorkerDebuggerAgent.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F34742DE1343631F00531BC2 /* WorkerDebuggerAgent.cpp */; };
+		F34742E11343631F00531BC2 /* WorkerDebuggerAgent.h in Headers */ = {isa = PBXBuildFile; fileRef = F34742DF1343631F00531BC2 /* WorkerDebuggerAgent.h */; };
+		F34742E41343633C00531BC2 /* PageScriptDebugServer.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F34742E21343633C00531BC2 /* PageScriptDebugServer.cpp */; };
+		F34742E51343633C00531BC2 /* PageScriptDebugServer.h in Headers */ = {isa = PBXBuildFile; fileRef = F34742E31343633C00531BC2 /* PageScriptDebugServer.h */; };
+		F34742E81343635000531BC2 /* WorkerScriptDebugServer.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F34742E61343635000531BC2 /* WorkerScriptDebugServer.cpp */; };
+		F34742E91343635000531BC2 /* WorkerScriptDebugServer.h in Headers */ = {isa = PBXBuildFile; fileRef = F34742E71343635000531BC2 /* WorkerScriptDebugServer.h */; };
 		F3644AFF1119805900E0D537 /* InjectedScript.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F3644AFD1119805900E0D537 /* InjectedScript.cpp */; };
 		F3644B001119805900E0D537 /* InjectedScript.h in Headers */ = {isa = PBXBuildFile; fileRef = F3644AFE1119805900E0D537 /* InjectedScript.h */; };
 		F375CC071150D300008DDB81 /* InspectorWorkerResource.h in Headers */ = {isa = PBXBuildFile; fileRef = F375CC061150D300008DDB81 /* InspectorWorkerResource.h */; };
@@ -6357,6 +6412,10 @@
 		0709FC4D1025DEE30059CDBA /* AccessibilitySlider.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = AccessibilitySlider.h; sourceTree = "<group>"; };
 		070DD8F50F01868000727DEB /* mediaControls.css */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = mediaControls.css; sourceTree = "<group>"; };
 		0735EE690F40C5E4004A2604 /* MediaPlayerProxy.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MediaPlayerProxy.h; sourceTree = "<group>"; };
+		076F0D0912B8192700C26AA4 /* MediaPlayerPrivateAVFoundation.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = MediaPlayerPrivateAVFoundation.cpp; sourceTree = "<group>"; };
+		076F0D0A12B8192700C26AA4 /* MediaPlayerPrivateAVFoundation.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MediaPlayerPrivateAVFoundation.h; sourceTree = "<group>"; };
+		076F0D0B12B8192700C26AA4 /* MediaPlayerPrivateAVFoundationObjC.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MediaPlayerPrivateAVFoundationObjC.h; sourceTree = "<group>"; };
+		076F0D0C12B8192700C26AA4 /* MediaPlayerPrivateAVFoundationObjC.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = MediaPlayerPrivateAVFoundationObjC.mm; sourceTree = "<group>"; };
 		079F5E4B0F3BEBEA005E0782 /* MediaPlayerPrivate.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MediaPlayerPrivate.h; sourceTree = "<group>"; };
 		07AFE5900F1446BD00841617 /* mediaControlsQuickTime.css */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.css; path = mediaControlsQuickTime.css; sourceTree = "<group>"; };
 		07B0113E1032242200FBDC33 /* AccessibilityMediaControls.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = AccessibilityMediaControls.h; sourceTree = "<group>"; };
@@ -6986,6 +7045,7 @@
 		22885E631301AE4C00526E68 /* JSDOMImplementationCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSDOMImplementationCustom.cpp; sourceTree = "<group>"; };
 		228C284410D82500009D0D0E /* ScriptWrappable.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ScriptWrappable.h; sourceTree = "<group>"; };
 		2442BBF81194C9D300D49469 /* HashChangeEvent.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = HashChangeEvent.h; sourceTree = "<group>"; };
+		245D80A213280E40003492A6 /* SQLCallbackWrapper.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SQLCallbackWrapper.h; sourceTree = "<group>"; };
 		24F54EAA101FE914000AE741 /* ApplicationCacheHost.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ApplicationCacheHost.cpp; sourceTree = "<group>"; };
 		24F54EAB101FE914000AE741 /* ApplicationCacheHost.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ApplicationCacheHost.h; sourceTree = "<group>"; };
 		2542F4D81166C25A00E89A86 /* UserGestureIndicator.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = UserGestureIndicator.cpp; sourceTree = "<group>"; };
@@ -7144,6 +7204,22 @@
 		316FE10E0E6E1DA700BF6088 /* ImplicitAnimation.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = ImplicitAnimation.h; path = animation/ImplicitAnimation.h; sourceTree = "<group>"; };
 		316FE10F0E6E1DA700BF6088 /* KeyframeAnimation.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = KeyframeAnimation.cpp; path = animation/KeyframeAnimation.cpp; sourceTree = "<group>"; };
 		316FE1100E6E1DA700BF6088 /* KeyframeAnimation.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = KeyframeAnimation.h; path = animation/KeyframeAnimation.h; sourceTree = "<group>"; };
+		3194616013020B20004BB3F8 /* JSWebKitAnimation.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSWebKitAnimation.cpp; sourceTree = "<group>"; };
+		3194616113020B20004BB3F8 /* JSWebKitAnimation.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSWebKitAnimation.h; sourceTree = "<group>"; };
+		3194616813020B66004BB3F8 /* DOMWebKitAnimation.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DOMWebKitAnimation.h; sourceTree = "<group>"; };
+		3194616913020B66004BB3F8 /* DOMWebKitAnimation.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = DOMWebKitAnimation.mm; sourceTree = "<group>"; };
+		319461FC13022BB8004BB3F8 /* JSWebKitAnimationList.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSWebKitAnimationList.cpp; sourceTree = "<group>"; };
+		319461FD13022BB8004BB3F8 /* JSWebKitAnimationList.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSWebKitAnimationList.h; sourceTree = "<group>"; };
+		3194620213022BF1004BB3F8 /* DOMWebKitAnimationList.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DOMWebKitAnimationList.h; sourceTree = "<group>"; };
+		3194620313022BF1004BB3F8 /* DOMWebKitAnimationList.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = DOMWebKitAnimationList.mm; sourceTree = "<group>"; };
+		3194623113022F65004BB3F8 /* JSWebKitAnimationListCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSWebKitAnimationListCustom.cpp; sourceTree = "<group>"; };
+		319E68861327C911004AC91A /* JSWebKitAnimationCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSWebKitAnimationCustom.cpp; sourceTree = "<group>"; };
+		319E69AC13299BBD004AC91A /* WebKitAnimation.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WebKitAnimation.cpp; sourceTree = "<group>"; };
+		319E69AD13299BBD004AC91A /* WebKitAnimation.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebKitAnimation.h; sourceTree = "<group>"; };
+		319E69AE13299BBD004AC91A /* WebKitAnimation.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = WebKitAnimation.idl; sourceTree = "<group>"; };
+		319E69AF13299BBD004AC91A /* WebKitAnimationList.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WebKitAnimationList.cpp; sourceTree = "<group>"; };
+		319E69B013299BBD004AC91A /* WebKitAnimationList.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebKitAnimationList.h; sourceTree = "<group>"; };
+		319E69B113299BBD004AC91A /* WebKitAnimationList.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = WebKitAnimationList.idl; sourceTree = "<group>"; };
 		31C0FF1B0E4CEB6E007D6FE5 /* WebKitAnimationEvent.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WebKitAnimationEvent.cpp; sourceTree = "<group>"; };
 		31C0FF1C0E4CEB6E007D6FE5 /* WebKitAnimationEvent.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebKitAnimationEvent.h; sourceTree = "<group>"; };
 		31C0FF1D0E4CEB6E007D6FE5 /* WebKitAnimationEvent.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = WebKitAnimationEvent.idl; sourceTree = "<group>"; };
@@ -7232,6 +7308,9 @@
 		37F818FC0D657606005E1F05 /* WebCoreURLResponse.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = WebCoreURLResponse.mm; sourceTree = "<group>"; };
 		37FC96DA1104ED71003E1FAD /* TrailingFloatsRootInlineBox.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = TrailingFloatsRootInlineBox.h; sourceTree = "<group>"; };
 		37FD4297118368460093C029 /* TreeDepthLimit.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = TreeDepthLimit.h; sourceTree = "<group>"; };
+		3AB02D2812D4F91600FBB694 /* StorageTracker.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = StorageTracker.h; sourceTree = "<group>"; };
+		3AB02D2912D4F91600FBB694 /* StorageTracker.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = StorageTracker.cpp; sourceTree = "<group>"; };
+		3AC367FE12EF7A09006A3D6F /* StorageTrackerClient.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = StorageTrackerClient.h; sourceTree = "<group>"; };
 		3AC648B1129E146500C3EB25 /* EditingBoundary.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = EditingBoundary.h; sourceTree = "<group>"; };
 		41002CCB0F66EDEF009E660D /* ScriptFunctionCall.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ScriptFunctionCall.h; sourceTree = "<group>"; };
 		41002CCC0F66EDEF009E660D /* ScriptFunctionCall.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ScriptFunctionCall.cpp; sourceTree = "<group>"; };
@@ -7262,6 +7341,8 @@
 		416E75CA0EDF90C700360E1D /* ScriptCallFrame.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ScriptCallFrame.cpp; sourceTree = "<group>"; };
 		41885B9111B6FDA6003383BB /* FormSubmission.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = FormSubmission.h; sourceTree = "<group>"; };
 		41885B9211B6FDA6003383BB /* FormSubmission.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = FormSubmission.cpp; sourceTree = "<group>"; };
+		418A06CE133C04D500CD379C /* EventDispatcher.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = EventDispatcher.h; sourceTree = "<group>"; };
+		418A06CF133C04D500CD379C /* EventDispatcher.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = EventDispatcher.cpp; sourceTree = "<group>"; };
 		418F88020FF957AE0080F045 /* JSAbstractWorker.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSAbstractWorker.cpp; sourceTree = "<group>"; };
 		418F88030FF957AE0080F045 /* JSAbstractWorker.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSAbstractWorker.h; sourceTree = "<group>"; };
 		41A3D58C101C152D00316D07 /* DedicatedWorkerThread.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DedicatedWorkerThread.cpp; path = workers/DedicatedWorkerThread.cpp; sourceTree = "<group>"; };
@@ -7393,7 +7474,6 @@
 		4429AB070CB84F81007647C5 /* DOMTextEventInternal.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = DOMTextEventInternal.h; sourceTree = "<group>"; };
 		44311CD412E4E22D000A8D19 /* DOMDocumentFragmentPrivate.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DOMDocumentFragmentPrivate.h; sourceTree = "<group>"; };
 		44311CD512E4E22D000A8D19 /* DOMDocumentPrivate.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DOMDocumentPrivate.h; sourceTree = "<group>"; };
-		445C8DB610015FC90031531A /* IconDatabaseNone.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = IconDatabaseNone.cpp; sourceTree = "<group>"; };
 		447D69010FA626810015CCB1 /* RuntimeApplicationChecks.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RuntimeApplicationChecks.h; sourceTree = "<group>"; };
 		447D69020FA626810015CCB1 /* RuntimeApplicationChecks.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = RuntimeApplicationChecks.mm; sourceTree = "<group>"; };
 		448A29BD0A46D9CB0030759F /* JSHTMLOptionsCollection.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = JSHTMLOptionsCollection.h; sourceTree = "<group>"; };
@@ -7666,6 +7746,8 @@
 		4E1959260A39DACC00220FE5 /* MediaQueryEvaluator.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = MediaQueryEvaluator.h; sourceTree = "<group>"; };
 		4E1959270A39DACC00220FE5 /* MediaQueryExp.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = MediaQueryExp.cpp; sourceTree = "<group>"; };
 		4E1959280A39DACC00220FE5 /* MediaQueryExp.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = MediaQueryExp.h; sourceTree = "<group>"; };
+		4F1442261339FD6200E0D6F8 /* DOMNodeHighlighter.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = DOMNodeHighlighter.cpp; sourceTree = "<group>"; };
+		4F1442271339FD6200E0D6F8 /* DOMNodeHighlighter.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DOMNodeHighlighter.h; sourceTree = "<group>"; };
 		4F1534DD11B532EC0021FD86 /* EditingBehavior.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = EditingBehavior.h; sourceTree = "<group>"; };
 		4F1534DF11B533020021FD86 /* EditingBehaviorTypes.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = EditingBehaviorTypes.h; sourceTree = "<group>"; };
 		4F2D205212EAE7B3005C2874 /* InspectorAgent.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InspectorAgent.h; sourceTree = "<group>"; };
@@ -7674,6 +7756,8 @@
 		4F3289B411A42AAB005ABE7E /* InspectorValues.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InspectorValues.h; sourceTree = "<group>"; };
 		4F4F5FFA11CBD2D200A186BF /* InspectorFrontend.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = InspectorFrontend.cpp; sourceTree = "<group>"; };
 		4F4F5FFC11CBD30100A186BF /* InspectorFrontend.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InspectorFrontend.h; sourceTree = "<group>"; };
+		4F6FDD621341DEDD001F8EE3 /* InspectorPageAgent.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = InspectorPageAgent.cpp; sourceTree = "<group>"; };
+		4F6FDD631341DEDD001F8EE3 /* InspectorPageAgent.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InspectorPageAgent.h; sourceTree = "<group>"; };
 		4F707A9711EF679400ACDA69 /* InspectorBackendDispatcher.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = InspectorBackendDispatcher.cpp; sourceTree = "<group>"; };
 		4F707A9811EF679400ACDA69 /* InspectorBackendDispatcher.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InspectorBackendDispatcher.h; sourceTree = "<group>"; };
 		4FA3B908125CD12100300BAD /* InspectorState.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = InspectorState.cpp; sourceTree = "<group>"; };
@@ -7755,6 +7839,8 @@
 		5160F4970B0AA75F00C1D2AF /* HistoryItemMac.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; name = HistoryItemMac.mm; path = mac/HistoryItemMac.mm; sourceTree = "<group>"; };
 		5162C7F211F77EFA00612EFE /* SchemeRegistry.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SchemeRegistry.cpp; sourceTree = "<group>"; };
 		5162C7F311F77EFB00612EFE /* SchemeRegistry.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SchemeRegistry.h; sourceTree = "<group>"; };
+		516953951329A3C800B92D04 /* IconDatabaseBase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = IconDatabaseBase.cpp; sourceTree = "<group>"; };
+		516953961329A3C800B92D04 /* IconDatabaseBase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = IconDatabaseBase.h; sourceTree = "<group>"; };
 		516BB7920CE91E6800512F79 /* JSTreeWalkerCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSTreeWalkerCustom.cpp; sourceTree = "<group>"; };
 		51721FB911D2790700638B42 /* BeforeProcessEvent.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = BeforeProcessEvent.h; sourceTree = "<group>"; };
 		51721FBA11D2790700638B42 /* BeforeProcessEvent.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = BeforeProcessEvent.idl; sourceTree = "<group>"; };
@@ -7847,7 +7933,6 @@
 		590E1B4A11E4EF700069F784 /* JSDeviceOrientationEventCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSDeviceOrientationEventCustom.cpp; sourceTree = "<group>"; };
 		59309A1011F4AE5800250603 /* DeviceOrientationClientMock.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DeviceOrientationClientMock.cpp; path = mock/DeviceOrientationClientMock.cpp; sourceTree = "<group>"; };
 		59309A1211F4AE6A00250603 /* DeviceOrientationClientMock.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DeviceOrientationClientMock.h; path = mock/DeviceOrientationClientMock.h; sourceTree = "<group>"; };
-		593D3EAC132532840057E7EE /* JavaMethod.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JavaMethod.cpp; sourceTree = "<group>"; };
 		593D3EAE1325328C0057E7EE /* JavaMethod.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JavaMethod.h; sourceTree = "<group>"; };
 		593D3EB0132532950057E7EE /* JavaString.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JavaString.h; sourceTree = "<group>"; };
 		596229771133EFD700DC4CBB /* GeolocationPositionCache.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = GeolocationPositionCache.cpp; sourceTree = "<group>"; };
@@ -7859,6 +7944,8 @@
 		598D77DE132541FA00761B22 /* JavaArrayJSC.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = JavaArrayJSC.h; path = jsc/JavaArrayJSC.h; sourceTree = "<group>"; };
 		598D77E01325420400761B22 /* JavaFieldJSC.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = JavaFieldJSC.cpp; path = jsc/JavaFieldJSC.cpp; sourceTree = "<group>"; };
 		598D77E21325420E00761B22 /* JavaFieldJSC.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = JavaFieldJSC.h; path = jsc/JavaFieldJSC.h; sourceTree = "<group>"; };
+		599C671B1343438900C3423C /* JavaMethodJobject.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JavaMethodJobject.cpp; sourceTree = "<group>"; };
+		599C671D1343439400C3423C /* JavaMethodJobject.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JavaMethodJobject.h; sourceTree = "<group>"; };
 		599E758F11055A1F00D904FA /* Bridge.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = Bridge.h; path = bridge/Bridge.h; sourceTree = "<group>"; };
 		59A85EA1119D68D900DEF1EF /* DeviceOrientationEvent.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = DeviceOrientationEvent.cpp; sourceTree = "<group>"; };
 		59A85EA3119D68EC00DEF1EF /* DeviceOrientationEvent.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DeviceOrientationEvent.h; sourceTree = "<group>"; };
@@ -7870,6 +7957,7 @@
 		59A8F1D711A69520001AC34A /* DeviceOrientationClient.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DeviceOrientationClient.h; sourceTree = "<group>"; };
 		59A9E7AF1104758800DFB4C1 /* JavaInstanceJSC.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = JavaInstanceJSC.cpp; path = jsc/JavaInstanceJSC.cpp; sourceTree = "<group>"; };
 		59A9E7B11104759400DFB4C1 /* JavaInstanceJSC.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = JavaInstanceJSC.h; path = jsc/JavaInstanceJSC.h; sourceTree = "<group>"; };
+		59B0EEA6132A6F2A004331C7 /* JavaType.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JavaType.h; sourceTree = "<group>"; };
 		59B597721108656B007159E8 /* BridgeJSC.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = BridgeJSC.cpp; path = bridge/jsc/BridgeJSC.cpp; sourceTree = "<group>"; };
 		59B5977411086579007159E8 /* BridgeJSC.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = BridgeJSC.h; path = bridge/jsc/BridgeJSC.h; sourceTree = "<group>"; };
 		59BC393E11054A1300FD85DB /* JavaStringJSC.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = JavaStringJSC.h; path = jsc/JavaStringJSC.h; sourceTree = "<group>"; };
@@ -8135,6 +8223,7 @@
 		7AFD4A8A1131C2760035B883 /* ScriptBreakpoint.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ScriptBreakpoint.h; sourceTree = "<group>"; };
 		7AFD4FF3113277B60035B883 /* ScriptDebugListener.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ScriptDebugListener.h; sourceTree = "<group>"; };
 		7E33CD00127F340D00BE8F17 /* PurgePriority.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PurgePriority.h; sourceTree = "<group>"; };
+		7E37EF2D1339208800B29250 /* SubresourceLoaderCF.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = SubresourceLoaderCF.cpp; path = cf/SubresourceLoaderCF.cpp; sourceTree = "<group>"; };
 		7EE6844C12D26E3800E79415 /* AuthenticationCF.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = AuthenticationCF.cpp; sourceTree = "<group>"; };
 		7EE6844D12D26E3800E79415 /* AuthenticationCF.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = AuthenticationCF.h; sourceTree = "<group>"; };
 		7EE6844E12D26E3800E79415 /* AuthenticationChallenge.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = AuthenticationChallenge.h; sourceTree = "<group>"; };
@@ -8155,9 +8244,19 @@
 		7EE6845D12D26E3800E79415 /* ResourceResponse.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ResourceResponse.h; sourceTree = "<group>"; };
 		7EE6845E12D26E3800E79415 /* ResourceResponseCFNet.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ResourceResponseCFNet.cpp; sourceTree = "<group>"; };
 		7EE6847412D26E7000E79415 /* ResourceLoaderCFNet.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = ResourceLoaderCFNet.cpp; path = cf/ResourceLoaderCFNet.cpp; sourceTree = "<group>"; };
+		809DD1DD130DE2AD00CAE3ED /* CSSStyleApplyProperty.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = CSSStyleApplyProperty.cpp; sourceTree = "<group>"; };
+		809DD1DE130DE2AD00CAE3ED /* CSSStyleApplyProperty.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CSSStyleApplyProperty.h; sourceTree = "<group>"; };
+		8102C5871325BB1100DDE67A /* StringCallback.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = StringCallback.cpp; sourceTree = "<group>"; };
+		815E6166132587AA00B622B0 /* DataTransferItem.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = DataTransferItem.cpp; sourceTree = "<group>"; };
 		81A7325D1210189B00FC0D9E /* IDBCursor.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = IDBCursor.h; sourceTree = "<group>"; };
 		81A7325F121018A400FC0D9E /* IDBCursor.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = IDBCursor.cpp; sourceTree = "<group>"; };
 		81A73277121019E100FC0D9E /* IDBCursorBackendImpl.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = IDBCursorBackendImpl.h; sourceTree = "<group>"; };
+		81AC5997131636E60009A7E0 /* DataTransferItem.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DataTransferItem.h; sourceTree = "<group>"; };
+		81AC5998131636E60009A7E0 /* DataTransferItems.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DataTransferItems.h; sourceTree = "<group>"; };
+		81AC5AE81316392E0009A7E0 /* DataTransferItem.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = DataTransferItem.idl; sourceTree = "<group>"; };
+		81AC5AE91316392E0009A7E0 /* DataTransferItems.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = DataTransferItems.idl; sourceTree = "<group>"; };
+		81AC6C34131C57C20009A7E0 /* StringCallback.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = StringCallback.idl; sourceTree = "<group>"; };
+		81AC6C35131C57D30009A7E0 /* StringCallback.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = StringCallback.h; sourceTree = "<group>"; };
 		81BE209311F4AB8D00915DFA /* IDBCursorBackendImpl.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = IDBCursorBackendImpl.cpp; sourceTree = "<group>"; };
 		81BE209411F4AB8D00915DFA /* IDBCursorBackendInterface.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = IDBCursorBackendInterface.h; sourceTree = "<group>"; };
 		81BE209C11F4ABBD00915DFA /* IDBCursor.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = IDBCursor.idl; sourceTree = "<group>"; };
@@ -8249,9 +8348,8 @@
 		84A81F3C0FC7DFF000955300 /* SourceAlpha.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = SourceAlpha.h; path = filters/SourceAlpha.h; sourceTree = "<group>"; };
 		84A81F3F0FC7E02700955300 /* SourceGraphic.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = SourceGraphic.cpp; path = filters/SourceGraphic.cpp; sourceTree = "<group>"; };
 		84A81F400FC7E02700955300 /* SourceGraphic.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = SourceGraphic.h; path = filters/SourceGraphic.h; sourceTree = "<group>"; };
-		84B2B1F7056BEF3A00D2B771 /* WebCoreKeyGenerator.h */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.c.h; path = WebCoreKeyGenerator.h; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
-		84B2B1F8056BEF3A00D2B771 /* WebCoreKeyGenerator.m */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.c.objc; path = WebCoreKeyGenerator.m; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
-		84B2B24F056BF15F00D2B771 /* SSLKeyGeneratorMac.mm */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = SSLKeyGeneratorMac.mm; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
+		84B2B24F056BF15F00D2B771 /* SSLKeyGeneratorMac.cpp */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SSLKeyGeneratorMac.cpp; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
+		84B62684133138F90095A489 /* FontPlatformData.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = FontPlatformData.cpp; sourceTree = "<group>"; };
 		84B6B975120F13E500B8EFAF /* SVGPathSegListSource.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SVGPathSegListSource.cpp; sourceTree = "<group>"; };
 		84B6B976120F13E500B8EFAF /* SVGPathSegListSource.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SVGPathSegListSource.h; sourceTree = "<group>"; };
 		84C5B2F81216DC810088B53A /* SVGPathTraversalStateBuilder.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SVGPathTraversalStateBuilder.cpp; sourceTree = "<group>"; };
@@ -9151,8 +9249,8 @@
 		89D08D9E12228451001241DF /* AsyncFileSystemCallbacks.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = AsyncFileSystemCallbacks.h; sourceTree = "<group>"; };
 		8A12E35C11FA33280025836A /* DocumentLoadTiming.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DocumentLoadTiming.h; sourceTree = "<group>"; };
 		8A309C9E123950BE00CB9204 /* NestingLevelIncrementer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = NestingLevelIncrementer.h; path = parser/NestingLevelIncrementer.h; sourceTree = "<group>"; };
-		8A413ADE1207BBA50082016E /* AsyncScriptRunner.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = AsyncScriptRunner.h; sourceTree = "<group>"; };
-		8A413ADF1207BBA50082016E /* AsyncScriptRunner.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = AsyncScriptRunner.cpp; sourceTree = "<group>"; };
+		8A413ADE1207BBA50082016E /* ScriptRunner.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ScriptRunner.h; sourceTree = "<group>"; };
+		8A413ADF1207BBA50082016E /* ScriptRunner.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ScriptRunner.cpp; sourceTree = "<group>"; };
 		8A7CC96A12076D73001D4588 /* PendingScript.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PendingScript.h; sourceTree = "<group>"; };
 		8A7CC96F12076F8A001D4588 /* PendingScript.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = PendingScript.cpp; sourceTree = "<group>"; };
 		8A81BF8411DCFD9000DA2B98 /* ResourceLoadTiming.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ResourceLoadTiming.h; sourceTree = "<group>"; };
@@ -9622,6 +9720,7 @@
 		A77979240D6B9E64003851B9 /* JSImageData.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSImageData.cpp; sourceTree = "<group>"; };
 		A77979250D6B9E64003851B9 /* JSImageData.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSImageData.h; sourceTree = "<group>"; };
 		A77B419F12E675A90054343D /* TextEventInputType.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = TextEventInputType.h; sourceTree = "<group>"; };
+		A77D0011133B0AEB00D6658C /* TextChecking.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = TextChecking.h; sourceTree = "<group>"; };
 		A784941A0B5FE507001E237A /* Clipboard.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = Clipboard.cpp; sourceTree = "<group>"; };
 		A78FE13912366B1000ACE8D0 /* SpellChecker.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SpellChecker.cpp; sourceTree = "<group>"; };
 		A78FE13A12366B1000ACE8D0 /* SpellChecker.h */ = {isa = PBXFileReference; explicitFileType = sourcecode.c.h; fileEncoding = 4; path = SpellChecker.h; sourceTree = "<group>"; };
@@ -11369,6 +11468,8 @@
 		BC772C4C0C4EB3040083285F /* MIMETypeRegistry.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = MIMETypeRegistry.cpp; sourceTree = "<group>"; };
 		BC772C4D0C4EB3040083285F /* MIMETypeRegistry.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = MIMETypeRegistry.h; sourceTree = "<group>"; };
 		BC772C5D0C4EB3440083285F /* MIMETypeRegistryMac.mm */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.objcpp; path = MIMETypeRegistryMac.mm; sourceTree = "<group>"; };
+		BC772E121331620C001EC9CE /* CSSLineBoxContainValue.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CSSLineBoxContainValue.h; sourceTree = "<group>"; };
+		BC772E15133162C2001EC9CE /* CSSLineBoxContainValue.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = CSSLineBoxContainValue.cpp; sourceTree = "<group>"; };
 		BC77CB860FEBF5AF0070887B /* HTMLDataGridColElement.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = HTMLDataGridColElement.h; sourceTree = "<group>"; };
 		BC77CB880FEBF5BA0070887B /* HTMLDataGridColElement.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = HTMLDataGridColElement.idl; sourceTree = "<group>"; };
 		BC77CBA90FEBF6C90070887B /* HTMLDataGridColElement.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = HTMLDataGridColElement.cpp; sourceTree = "<group>"; };
@@ -11409,7 +11510,6 @@
 		BC7FA6800D1F167900DB22A9 /* SelectorNodeList.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SelectorNodeList.cpp; sourceTree = "<group>"; };
 		BC80C9850CD294EE00A0B7B3 /* CSSTimingFunctionValue.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = CSSTimingFunctionValue.cpp; sourceTree = "<group>"; };
 		BC80C9860CD294EE00A0B7B3 /* CSSTimingFunctionValue.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = CSSTimingFunctionValue.h; sourceTree = "<group>"; };
-		BC814A4112F8C34A007B2C32 /* HeaderDetection.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = HeaderDetection.h; sourceTree = "<group>"; };
 		BC8243250D0CE8A200460C8F /* JSSQLError.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSSQLError.h; sourceTree = "<group>"; };
 		BC8243260D0CE8A200460C8F /* JSSQLTransaction.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSSQLTransaction.h; sourceTree = "<group>"; };
 		BC8243E60D0CFD7500460C8F /* WindowFeatures.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WindowFeatures.cpp; sourceTree = "<group>"; };
@@ -11516,6 +11616,8 @@
 		BCC065840F3CE2A700CD2D87 /* JSClientRect.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSClientRect.h; sourceTree = "<group>"; };
 		BCC065850F3CE2A700CD2D87 /* JSClientRectList.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSClientRectList.cpp; sourceTree = "<group>"; };
 		BCC065860F3CE2A700CD2D87 /* JSClientRectList.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSClientRectList.h; sourceTree = "<group>"; };
+		BCC36EB61342AA3F004BEEF7 /* DefaultLocalizationStrategy.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = DefaultLocalizationStrategy.cpp; sourceTree = "<group>"; };
+		BCC36EB71342AA3F004BEEF7 /* DefaultLocalizationStrategy.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DefaultLocalizationStrategy.h; sourceTree = "<group>"; };
 		BCC438770E886CC700533DD5 /* JSHTMLInputElementCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSHTMLInputElementCustom.cpp; sourceTree = "<group>"; };
 		BCC573330D695BBE006EF517 /* DOMProgressEvent.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DOMProgressEvent.h; sourceTree = "<group>"; };
 		BCC573340D695BBE006EF517 /* DOMProgressEvent.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = DOMProgressEvent.mm; sourceTree = "<group>"; };
@@ -11535,6 +11637,7 @@
 		BCD0E0F90E972C3500265DEA /* SecurityOriginHash.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SecurityOriginHash.h; sourceTree = "<group>"; };
 		BCD0FBCF0DBD625E00B2F630 /* DOMAbstractView.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = DOMAbstractView.mm; sourceTree = "<group>"; };
 		BCD0FC4E0DBD720B00B2F630 /* DOMRGBColorInternal.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DOMRGBColorInternal.h; sourceTree = "<group>"; };
+		BCD3F9821326C93700098A60 /* TextOrientation.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = TextOrientation.h; sourceTree = "<group>"; };
 		BCD41ABA0C060DE800C0E446 /* JSHTMLFrameSetElementCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = JSHTMLFrameSetElementCustom.cpp; sourceTree = "<group>"; };
 		BCD533630ED6848900887468 /* CachedScriptSourceProvider.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CachedScriptSourceProvider.h; sourceTree = "<group>"; };
 		BCD9C25E0C17AA67005C90A2 /* JSDOMWindowCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = JSDOMWindowCustom.cpp; sourceTree = "<group>"; };
@@ -11678,6 +11781,8 @@
 		C5137CF111A58378004ADB99 /* JSDOMStringList.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSDOMStringList.h; sourceTree = "<group>"; };
 		C5160EE81004543A00A7CEE2 /* StorageAreaImpl.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = StorageAreaImpl.cpp; sourceTree = "<group>"; };
 		C5160EE91004543A00A7CEE2 /* StorageAreaImpl.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = StorageAreaImpl.h; sourceTree = "<group>"; };
+		C5392D331326AD0100043D35 /* HTMLConverter.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = HTMLConverter.h; sourceTree = "<group>"; };
+		C5392D341326AD0100043D35 /* HTMLConverter.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = HTMLConverter.mm; sourceTree = "<group>"; };
 		C544274911A57E7A0063A749 /* DOMStringList.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DOMStringList.h; sourceTree = "<group>"; };
 		C544274A11A57E7A0063A749 /* DOMStringList.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = DOMStringList.idl; sourceTree = "<group>"; };
 		C55610F011A704EB00B82D27 /* DOMStringList.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = DOMStringList.cpp; sourceTree = "<group>"; };
@@ -11757,6 +11862,7 @@
 		CA3BF67B10D99BAE00E6CE53 /* ScrollAnimator.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ScrollAnimator.cpp; sourceTree = "<group>"; };
 		CA3BF67D10D99BAE00E6CE53 /* ScrollAnimator.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ScrollAnimator.h; sourceTree = "<group>"; };
 		CD4E0AFA11F7BC27009D3811 /* fullscreen.css */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.css; path = fullscreen.css; sourceTree = "<group>"; };
+		CDBD93BA1333BD4B002570E3 /* fullscreenQuickTime.css */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.css; path = fullscreenQuickTime.css; sourceTree = "<group>"; };
 		CDEA7C821276230400B846DD /* RenderFullScreen.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RenderFullScreen.h; sourceTree = "<group>"; };
 		CDEA7C831276230400B846DD /* RenderFullScreen.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = RenderFullScreen.cpp; sourceTree = "<group>"; };
 		CE02F0C311E83ADD00C6684A /* ScriptControllerBase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ScriptControllerBase.h; sourceTree = "<group>"; };
@@ -12012,6 +12118,9 @@
 		ED501DC50B249F2900AE18D9 /* EditorMac.mm */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.objcpp; name = EditorMac.mm; path = mac/EditorMac.mm; sourceTree = "<group>"; };
 		EDE3A4FF0C7A430600956A37 /* ColorMac.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ColorMac.h; sourceTree = "<group>"; };
 		EDEC98020AED7E170059137F /* WebCorePrefix.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = WebCorePrefix.h; sourceTree = "<group>"; tabWidth = 4; usesTabs = 0; };
+		F31639691329481A00A649CB /* InjectedScriptManager.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = InjectedScriptManager.cpp; sourceTree = "<group>"; };
+		F316396A1329481A00A649CB /* InjectedScriptManager.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InjectedScriptManager.h; sourceTree = "<group>"; };
+		F316396D1329487600A649CB /* JSInjectedScriptManager.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSInjectedScriptManager.cpp; sourceTree = "<group>"; };
 		F3335BF612E07DC300D33011 /* InspectorConsoleAgent.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = InspectorConsoleAgent.cpp; sourceTree = "<group>"; };
 		F3335BF712E07DC300D33011 /* InspectorConsoleAgent.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InspectorConsoleAgent.h; sourceTree = "<group>"; };
 		F33F0281120947F200E5743A /* ScriptProfile.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ScriptProfile.cpp; sourceTree = "<group>"; };
@@ -12020,6 +12129,14 @@
 		F344C7121125B82C00F26EEE /* InspectorFrontendClient.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InspectorFrontendClient.h; sourceTree = "<group>"; };
 		F344C75211294D9D00F26EEE /* InspectorFrontendClientLocal.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InspectorFrontendClientLocal.h; sourceTree = "<group>"; };
 		F344C75711294FF600F26EEE /* InspectorFrontendClientLocal.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = InspectorFrontendClientLocal.cpp; sourceTree = "<group>"; };
+		F34742DA134362F000531BC2 /* PageDebuggerAgent.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = PageDebuggerAgent.cpp; sourceTree = "<group>"; };
+		F34742DB134362F000531BC2 /* PageDebuggerAgent.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PageDebuggerAgent.h; sourceTree = "<group>"; };
+		F34742DE1343631F00531BC2 /* WorkerDebuggerAgent.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WorkerDebuggerAgent.cpp; sourceTree = "<group>"; };
+		F34742DF1343631F00531BC2 /* WorkerDebuggerAgent.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WorkerDebuggerAgent.h; sourceTree = "<group>"; };
+		F34742E21343633C00531BC2 /* PageScriptDebugServer.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = PageScriptDebugServer.cpp; sourceTree = "<group>"; };
+		F34742E31343633C00531BC2 /* PageScriptDebugServer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PageScriptDebugServer.h; sourceTree = "<group>"; };
+		F34742E61343635000531BC2 /* WorkerScriptDebugServer.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WorkerScriptDebugServer.cpp; sourceTree = "<group>"; };
+		F34742E71343635000531BC2 /* WorkerScriptDebugServer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WorkerScriptDebugServer.h; sourceTree = "<group>"; };
 		F3644AFD1119805900E0D537 /* InjectedScript.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = InjectedScript.cpp; sourceTree = "<group>"; };
 		F3644AFE1119805900E0D537 /* InjectedScript.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InjectedScript.h; sourceTree = "<group>"; };
 		F375CC061150D300008DDB81 /* InspectorWorkerResource.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InspectorWorkerResource.h; sourceTree = "<group>"; };
@@ -12404,6 +12521,17 @@
 			tabWidth = 4;
 			usesTabs = 0;
 		};
+		076F0D0812B8192700C26AA4 /* avfoundation */ = {
+			isa = PBXGroup;
+			children = (
+				076F0D0912B8192700C26AA4 /* MediaPlayerPrivateAVFoundation.cpp */,
+				076F0D0A12B8192700C26AA4 /* MediaPlayerPrivateAVFoundation.h */,
+				076F0D0B12B8192700C26AA4 /* MediaPlayerPrivateAVFoundationObjC.h */,
+				076F0D0C12B8192700C26AA4 /* MediaPlayerPrivateAVFoundationObjC.mm */,
+			);
+			path = avfoundation;
+			sourceTree = "<group>";
+		};
 		081CDFBD126ECFE800D215CA /* properties */ = {
 			isa = PBXGroup;
 			children = (
@@ -12745,16 +12873,18 @@
 		1A569CCE0D7E2B82007C3983 /* jni */ = {
 			isa = PBXGroup;
 			children = (
-				593D3EB0132532950057E7EE /* JavaString.h */,
+				599C671D1343439400C3423C /* JavaMethodJobject.h */,
+				599C671B1343438900C3423C /* JavaMethodJobject.cpp */,
 				593D3EAE1325328C0057E7EE /* JavaMethod.h */,
-				593D3EAC132532840057E7EE /* JavaMethod.cpp */,
-				59695083132105A500C3ED18 /* JobjectWrapper.cpp */,
-				596950811321059900C3ED18 /* JobjectWrapper.h */,
+				593D3EB0132532950057E7EE /* JavaString.h */,
+				59B0EEA6132A6F2A004331C7 /* JavaType.h */,
 				1A569CD40D7E2B82007C3983 /* jni_jsobject.h */,
 				1A569CD30D7E2B82007C3983 /* jni_jsobject.mm */,
 				1A569CD50D7E2B82007C3983 /* jni_objc.mm */,
 				59EE122F1106081F00885116 /* JNIUtility.cpp */,
 				59EE12311106082900885116 /* JNIUtility.h */,
+				59695083132105A500C3ED18 /* JobjectWrapper.cpp */,
+				596950811321059900C3ED18 /* JobjectWrapper.h */,
 				599D1E2F10C97D4C00E0EF12 /* jsc */,
 			);
 			name = jni;
@@ -12912,6 +13042,7 @@
 				51A926790D53F0570063ECC2 /* OriginQuotaManager.h */,
 				51A9267A0D53F0570063ECC2 /* OriginUsageRecord.cpp */,
 				51A9267B0D53F0570063ECC2 /* OriginUsageRecord.h */,
+				245D80A213280E40003492A6 /* SQLCallbackWrapper.h */,
 				51EC92570CE90DB400F90308 /* SQLError.h */,
 				51EC92580CE90DB400F90308 /* SQLError.idl */,
 				B56EBA8311C9FF8100B04477 /* SQLException.h */,
@@ -12967,6 +13098,9 @@
 				C55E38BB10040D5D00A56BDB /* StorageNamespaceImpl.h */,
 				C5102D930FD9AA2D00FAFF04 /* StorageSyncManager.cpp */,
 				C5102D920FD9AA2D00FAFF04 /* StorageSyncManager.h */,
+				3AB02D2912D4F91600FBB694 /* StorageTracker.cpp */,
+				3AB02D2812D4F91600FBB694 /* StorageTracker.h */,
+				3AC367FE12EF7A09006A3D6F /* StorageTrackerClient.h */,
 			);
 			indentWidth = 4;
 			path = storage;
@@ -13002,11 +13136,15 @@
 				1C81B9590E97330800266E07 /* front-end */,
 				41F0618D0F5F069800A07EAC /* ConsoleMessage.cpp */,
 				41F0618C0F5F069800A07EAC /* ConsoleMessage.h */,
+				4F1442261339FD6200E0D6F8 /* DOMNodeHighlighter.cpp */,
+				4F1442271339FD6200E0D6F8 /* DOMNodeHighlighter.h */,
 				F3644AFD1119805900E0D537 /* InjectedScript.cpp */,
 				F3644AFE1119805900E0D537 /* InjectedScript.h */,
 				7A0E76F610BF08ED00A0276E /* InjectedScriptHost.cpp */,
 				7A0E76F710BF08ED00A0276E /* InjectedScriptHost.h */,
 				7A0E76F810BF08ED00A0276E /* InjectedScriptHost.idl */,
+				F31639691329481A00A649CB /* InjectedScriptManager.cpp */,
+				F316396A1329481A00A649CB /* InjectedScriptManager.h */,
 				7A563F9512DF5C9100F4536D /* InjectedScriptSource.js */,
 				4F2D205312EAE7B3005C2874 /* InspectorAgent.cpp */,
 				4F2D205212EAE7B3005C2874 /* InspectorAgent.h */,
@@ -13044,6 +13182,8 @@
 				7A0E770D10C00A8800A0276E /* InspectorFrontendHost.idl */,
 				20D629241253690B00081543 /* InspectorInstrumentation.cpp */,
 				20D629251253690B00081543 /* InspectorInstrumentation.h */,
+				4F6FDD621341DEDD001F8EE3 /* InspectorPageAgent.cpp */,
+				4F6FDD631341DEDD001F8EE3 /* InspectorPageAgent.h */,
 				9F0D6B2C121BFEBA006C0288 /* InspectorProfilerAgent.cpp */,
 				9F0D6B2D121BFEBA006C0288 /* InspectorProfilerAgent.h */,
 				82AB1771125C826700C5069D /* InspectorResourceAgent.cpp */,
@@ -13062,6 +13202,8 @@
 				F3ABFE0B130E9DA000E7F7D1 /* InstrumentingAgents.h */,
 				1C81BA050E97348300266E07 /* JavaScriptCallFrame.idl */,
 				BCC64F5F0DCFB84E0081EF3B /* localizedStrings.js */,
+				F34742DA134362F000531BC2 /* PageDebuggerAgent.cpp */,
+				F34742DB134362F000531BC2 /* PageDebuggerAgent.h */,
 				F39BE95912673BF400E0A674 /* ScriptArguments.cpp */,
 				F39BE95A12673BF400E0A674 /* ScriptArguments.h */,
 				7AFD4A8A1131C2760035B883 /* ScriptBreakpoint.h */,
@@ -13074,6 +13216,8 @@
 				9FA37EF01172FD4100C4CD55 /* ScriptProfileNode.idl */,
 				7553CFE7108F473F00EA281E /* TimelineRecordFactory.cpp */,
 				7553CFE6108F473F00EA281E /* TimelineRecordFactory.h */,
+				F34742DE1343631F00531BC2 /* WorkerDebuggerAgent.cpp */,
+				F34742DF1343631F00531BC2 /* WorkerDebuggerAgent.h */,
 			);
 			path = inspector;
 			sourceTree = "<group>";
@@ -13606,8 +13750,9 @@
 			children = (
 				5126E6B90A2E3B12005C29FA /* IconDatabase.cpp */,
 				5126E6BA0A2E3B12005C29FA /* IconDatabase.h */,
+				516953951329A3C800B92D04 /* IconDatabaseBase.cpp */,
+				516953961329A3C800B92D04 /* IconDatabaseBase.h */,
 				51E1ECB80C91C90400DC255B /* IconDatabaseClient.h */,
-				445C8DB610015FC90031531A /* IconDatabaseNone.cpp */,
 				513F14510AB634C400094DDF /* IconLoader.cpp */,
 				513F14520AB634C400094DDF /* IconLoader.h */,
 				51E1ECBA0C91C90400DC255B /* IconRecord.cpp */,
@@ -13711,12 +13856,12 @@
 		599D1E2F10C97D4C00E0EF12 /* jsc */ = {
 			isa = PBXGroup;
 			children = (
-				598D77E21325420E00761B22 /* JavaFieldJSC.h */,
-				598D77E01325420400761B22 /* JavaFieldJSC.cpp */,
-				598D77DE132541FA00761B22 /* JavaArrayJSC.h */,
 				598D77DC132541EE00761B22 /* JavaArrayJSC.cpp */,
+				598D77DE132541FA00761B22 /* JavaArrayJSC.h */,
 				59E560A81105336F00AA1258 /* JavaClassJSC.cpp */,
 				59E560A61105336600AA1258 /* JavaClassJSC.h */,
+				598D77E01325420400761B22 /* JavaFieldJSC.cpp */,
+				598D77E21325420E00761B22 /* JavaFieldJSC.h */,
 				59A9E7AF1104758800DFB4C1 /* JavaInstanceJSC.cpp */,
 				59A9E7B11104759400DFB4C1 /* JavaInstanceJSC.h */,
 				E1698263113467F300894115 /* JavaRuntimeObject.cpp */,
@@ -13800,7 +13945,6 @@
 				6565814709D13043000E61D7 /* CSSValueKeywords.gperf */,
 				6565814809D13043000E61D7 /* CSSValueKeywords.h */,
 				E406F3FA1198304D009D59D6 /* DocTypeStrings.cpp */,
-				BC814A4112F8C34A007B2C32 /* HeaderDetection.h */,
 				A17C81200F2A5CF7005DAAEB /* HTMLElementFactory.cpp */,
 				A17C81210F2A5CF7005DAAEB /* HTMLElementFactory.h */,
 				A8BC04911214F69600B5F122 /* HTMLEntityTable.cpp */,
@@ -13939,6 +14083,8 @@
 				066C772C0AB603D200238CC4 /* FileChooserMac.mm */,
 				514B3F750C722055000530DF /* FileSystemMac.mm */,
 				935C476C09AC4D6300A6AAB4 /* FoundationExtras.h */,
+				C5392D331326AD0100043D35 /* HTMLConverter.h */,
+				C5392D341326AD0100043D35 /* HTMLConverter.mm */,
 				935C476E09AC4D7300A6AAB4 /* KeyEventMac.mm */,
 				521D46F511AEC98100514613 /* KillRingMac.mm */,
 				6593923909AE435C002C531F /* KURLMac.mm */,
@@ -13969,14 +14115,12 @@
 				93309E9F099EB78C0056E581 /* SharedTimerMac.mm */,
 				0A4844980CA44CB200B7BD48 /* SoftLinking.h */,
 				4B3043C80AE0371D00A82647 /* SoundMac.mm */,
-				84B2B24F056BF15F00D2B771 /* SSLKeyGeneratorMac.mm */,
+				84B2B24F056BF15F00D2B771 /* SSLKeyGeneratorMac.cpp */,
 				93B2D8170F9920EE006AE6B2 /* SuddenTermination.mm */,
 				6582A15509999D6D00BEEB6D /* SystemTimeMac.cpp */,
 				BCE659E50EA92FB2007E4533 /* ThemeMac.h */,
 				BCE659E80EA92FFA007E4533 /* ThemeMac.mm */,
 				51DF6D7F0B92A18E00C2DC85 /* ThreadCheck.mm */,
-				84B2B1F7056BEF3A00D2B771 /* WebCoreKeyGenerator.h */,
-				84B2B1F8056BEF3A00D2B771 /* WebCoreKeyGenerator.m */,
 				934D9BA60B8C1175007B42A9 /* WebCoreNSStringExtras.h */,
 				934D9BA40B8C116B007B42A9 /* WebCoreNSStringExtras.mm */,
 				DD05FE0B0B8BA3C6009ACDFE /* WebCoreObjCExtras.h */,
@@ -14141,6 +14285,12 @@
 				BC8BF150105813BF00A40A07 /* UserStyleSheet.h */,
 				BC8BF1591058141800A40A07 /* UserStyleSheetTypes.h */,
 				BE983D95052A2E0A00892D85 /* WebCoreKeyboardUIMode.h */,
+				319E69AC13299BBD004AC91A /* WebKitAnimation.cpp */,
+				319E69AD13299BBD004AC91A /* WebKitAnimation.h */,
+				319E69AE13299BBD004AC91A /* WebKitAnimation.idl */,
+				319E69AF13299BBD004AC91A /* WebKitAnimationList.cpp */,
+				319E69B013299BBD004AC91A /* WebKitAnimationList.h */,
+				319E69B113299BBD004AC91A /* WebKitAnimationList.idl */,
 				494BD7930F55C8EE00747828 /* WebKitPoint.h */,
 				494BD7940F55C8EE00747828 /* WebKitPoint.idl */,
 				BC8243E60D0CFD7500460C8F /* WindowFeatures.cpp */,
@@ -14158,6 +14308,7 @@
 			isa = PBXGroup;
 			children = (
 				7EE6847412D26E7000E79415 /* ResourceLoaderCFNet.cpp */,
+				7E37EF2D1339208800B29250 /* SubresourceLoaderCF.cpp */,
 			);
 			name = cf;
 			sourceTree = "<group>";
@@ -14994,6 +15145,10 @@
 				85BA4D0A0AA688680088052D /* DOMHTMLUListElement.mm */,
 				15C770A4100D41CD005BA267 /* DOMValidityState.h */,
 				15C770A3100D41CD005BA267 /* DOMValidityState.mm */,
+				3194616813020B66004BB3F8 /* DOMWebKitAnimation.h */,
+				3194616913020B66004BB3F8 /* DOMWebKitAnimation.mm */,
+				3194620213022BF1004BB3F8 /* DOMWebKitAnimationList.h */,
+				3194620313022BF1004BB3F8 /* DOMWebKitAnimationList.mm */,
 			);
 			name = HTML;
 			sourceTree = "<group>";
@@ -16321,6 +16476,10 @@
 				0C45342610CDBBFA00869157 /* JSWebGLUniformLocation.h */,
 				77EF62F112F9DB7400C77BD2 /* JSWebGLVertexArrayObjectOES.cpp */,
 				77EF62F212F9DB7400C77BD2 /* JSWebGLVertexArrayObjectOES.h */,
+				3194616013020B20004BB3F8 /* JSWebKitAnimation.cpp */,
+				3194616113020B20004BB3F8 /* JSWebKitAnimation.h */,
+				319461FC13022BB8004BB3F8 /* JSWebKitAnimationList.cpp */,
+				319461FD13022BB8004BB3F8 /* JSWebKitAnimationList.h */,
 				93F1D5BE12D5335600832BEC /* JSWebKitLoseContext.cpp */,
 				93F1D5BF12D5335600832BEC /* JSWebKitLoseContext.h */,
 			);
@@ -17491,6 +17650,7 @@
 		B2A015910AF6CD53006BCE0E /* graphics */ = {
 			isa = PBXGroup;
 			children = (
+				076F0D0812B8192700C26AA4 /* avfoundation */,
 				499B3EC0128CCC1800E726C2 /* ca */,
 				B27535290B053814002CE64F /* cg */,
 				B5320D68122A24E9002D1440 /* cocoa */,
@@ -17535,6 +17695,8 @@
 				72626E010EF022FE00A07E20 /* FontFastPath.cpp */,
 				0845680712B90DA600960A9F /* FontMetrics.h */,
 				F7A034C3126BF6BE007DC19E /* FontOrientation.h */,
+				84B62684133138F90095A489 /* FontPlatformData.cpp */,
+				B5320D69122A24E9002D1440 /* FontPlatformData.h */,
 				37ACCE410DA2980F0089E602 /* FontRenderingMode.h */,
 				B2C3DA5A0D006CD600EF6F26 /* FontSelector.h */,
 				37202198106213C600F25C4B /* FontSmoothingMode.h */,
@@ -17643,6 +17805,7 @@
 				B2C3DA070D006C1D00EF6F26 /* TextBreakIteratorICU.cpp */,
 				B2C3DA080D006C1D00EF6F26 /* TextBreakIteratorInternalICU.h */,
 				A7151BD712F1558F005A0F64 /* TextCheckerClient.h */,
+				A77D0011133B0AEB00D6658C /* TextChecking.h */,
 				B2C3DA090D006C1D00EF6F26 /* TextCodec.cpp */,
 				B2C3DA0A0D006C1D00EF6F26 /* TextCodec.h */,
 				26E98A0F130A9FCA008EB7B2 /* TextCodecASCIIFastPath.h */,
@@ -17663,6 +17826,7 @@
 				C105DA610F3AA68F001DD44F /* TextEncodingDetectorICU.cpp */,
 				B2C3DA180D006C1D00EF6F26 /* TextEncodingRegistry.cpp */,
 				B2C3DA190D006C1D00EF6F26 /* TextEncodingRegistry.h */,
+				BCD3F9821326C93700098A60 /* TextOrientation.h */,
 				B2C3DA1A0D006C1D00EF6F26 /* TextStream.cpp */,
 				B2C3DA1B0D006C1D00EF6F26 /* TextStream.h */,
 				B2C3DA1C0D006C1D00EF6F26 /* UnicodeRange.cpp */,
@@ -17726,7 +17890,6 @@
 		B5320D68122A24E9002D1440 /* cocoa */ = {
 			isa = PBXGroup;
 			children = (
-				B5320D69122A24E9002D1440 /* FontPlatformData.h */,
 				B5320D6A122A24E9002D1440 /* FontPlatformDataCocoa.mm */,
 			);
 			path = cocoa;
@@ -17818,6 +17981,8 @@
 				14CD8D81106B529000A46D23 /* JSSharedWorkerCustom.cpp */,
 				E1C36D320EB0A094007410BC /* JSWorkerContextBase.cpp */,
 				E1C36D330EB0A094007410BC /* JSWorkerContextBase.h */,
+				F34742E21343633C00531BC2 /* PageScriptDebugServer.cpp */,
+				F34742E31343633C00531BC2 /* PageScriptDebugServer.h */,
 				BCA378BA0D15F64200B793D6 /* ScheduledAction.cpp */,
 				BCA378BB0D15F64200B793D6 /* ScheduledAction.h */,
 				41F1D21E0EF35C2A00DA8753 /* ScriptCachedFrameData.cpp */,
@@ -17857,6 +18022,8 @@
 				BC53D910114310CC000D817E /* WebCoreJSClientData.h */,
 				E1A643FC0EC097A000779668 /* WorkerScriptController.cpp */,
 				E1A643F10EC0972500779668 /* WorkerScriptController.h */,
+				F34742E61343635000531BC2 /* WorkerScriptDebugServer.cpp */,
+				F34742E71343635000531BC2 /* WorkerScriptDebugServer.h */,
 			);
 			path = js;
 			sourceTree = "<group>";
@@ -17985,6 +18152,7 @@
 				C585A65D11D4FAB2004C3E4B /* JSIDBKeyCustom.cpp */,
 				A7D0318D0E93540300E24ACD /* JSImageDataCustom.cpp */,
 				7A0E76D410BF050700A0276E /* JSInjectedScriptHostCustom.cpp */,
+				F316396D1329487600A649CB /* JSInjectedScriptManager.cpp */,
 				7A74ECBC101839DA00BF939E /* JSInspectorFrontendHostCustom.cpp */,
 				49EECF7410508D9C00099FAB /* JSInt16ArrayCustom.cpp */,
 				49EECF7310508D9C00099FAB /* JSInt32ArrayCustom.cpp */,
@@ -18020,6 +18188,8 @@
 				49EECF7610508D9C00099FAB /* JSUint32ArrayCustom.cpp */,
 				49EECF7510508D9C00099FAB /* JSUint8ArrayCustom.cpp */,
 				49EED14C1051971A00099FAB /* JSWebGLRenderingContextCustom.cpp */,
+				319E68861327C911004AC91A /* JSWebKitAnimationCustom.cpp */,
+				3194623113022F65004BB3F8 /* JSWebKitAnimationListCustom.cpp */,
 				E1AD14C41297354900ACA989 /* JSWebKitCSSKeyframeRuleCustom.cpp */,
 				E1AD14B4129734CA00ACA989 /* JSWebKitCSSKeyframesRuleCustom.cpp */,
 				BC275B7C11C5D23500C9206C /* JSWebKitCSSMatrixCustom.cpp */,
@@ -18037,8 +18207,6 @@
 		BC8C8FAA0DDCD2F200B592F4 /* style */ = {
 			isa = PBXGroup;
 			children = (
-				5A574F26131DB96D00471B88 /* QuotesData.cpp */,
-				5A574F27131DB96D00471B88 /* QuotesData.h */,
 				BC5EB5E00E81BE8700B25965 /* BorderData.h */,
 				BC5EB5DA0E81B7EA00B25965 /* BorderValue.h */,
 				BC5EB5DE0E81B9AB00B25965 /* CollapsedBorderValue.h */,
@@ -18058,6 +18226,8 @@
 				BCEF43DF0E674110001C1287 /* NinePieceImage.cpp */,
 				BCEF43DC0E674012001C1287 /* NinePieceImage.h */,
 				BC5EB5DC0E81B8DD00B25965 /* OutlineValue.h */,
+				5A574F26131DB96D00471B88 /* QuotesData.cpp */,
+				5A574F27131DB96D00471B88 /* QuotesData.h */,
 				BC8C8FAB0DDCD31B00B592F4 /* RenderStyle.cpp */,
 				BC8C8FAC0DDCD31B00B592F4 /* RenderStyle.h */,
 				BC5EB6670E81CB7100B25965 /* RenderStyleConstants.h */,
@@ -18327,6 +18497,8 @@
 				2E4346570F546A9900B0F1BA /* CrossThreadCopier.h */,
 				E11AF15011B9A1A300805103 /* Cursor.cpp */,
 				F587868402DE3B8601EA4122 /* Cursor.h */,
+				BCC36EB61342AA3F004BEEF7 /* DefaultLocalizationStrategy.cpp */,
+				BCC36EB71342AA3F004BEEF7 /* DefaultLocalizationStrategy.h */,
 				A79546420B5C4CB4007B438F /* DragData.cpp */,
 				A7B6E69D0B291A9600D0529F /* DragData.h */,
 				A7CFB3CF0B7ED10A0070C32D /* DragImage.cpp */,
@@ -18606,6 +18778,8 @@
 				A80E6CD70A1989CA007FB8C5 /* CSSInheritedValue.h */,
 				A80E6CD80A1989CA007FB8C5 /* CSSInitialValue.cpp */,
 				A80E6CDE0A1989CA007FB8C5 /* CSSInitialValue.h */,
+				BC772E15133162C2001EC9CE /* CSSLineBoxContainValue.cpp */,
+				BC772E121331620C001EC9CE /* CSSLineBoxContainValue.h */,
 				A80E6CD20A1989CA007FB8C5 /* CSSMediaRule.cpp */,
 				A80E6CD90A1989CA007FB8C5 /* CSSMediaRule.h */,
 				85C56CA20AA89C1000D95755 /* CSSMediaRule.idl */,
@@ -18625,8 +18799,8 @@
 				A80E6CDB0A1989CA007FB8C5 /* CSSPrimitiveValue.cpp */,
 				A80E6CBC0A1989CA007FB8C5 /* CSSPrimitiveValue.h */,
 				9307059009E0C75800B17FE4 /* CSSPrimitiveValue.idl */,
-				E49BD9F9131FD2ED003C56F0 /* CSSPrimitiveValueCache.h */,
 				E49BDA0A131FD3E5003C56F0 /* CSSPrimitiveValueCache.cpp */,
+				E49BD9F9131FD2ED003C56F0 /* CSSPrimitiveValueCache.h */,
 				E1ED8AC20CC49BE000BFC557 /* CSSPrimitiveValueMappings.h */,
 				A80E6CCD0A1989CA007FB8C5 /* CSSProperty.cpp */,
 				A80E6CD50A1989CA007FB8C5 /* CSSProperty.h */,
@@ -18651,6 +18825,8 @@
 				A80E734B0A199C77007FB8C5 /* CSSSelector.h */,
 				E4C178950EE6903800824D69 /* CSSSelectorList.cpp */,
 				E4C178960EE6903800824D69 /* CSSSelectorList.h */,
+				809DD1DD130DE2AD00CAE3ED /* CSSStyleApplyProperty.cpp */,
+				809DD1DE130DE2AD00CAE3ED /* CSSStyleApplyProperty.h */,
 				A80E6E0E0A19911C007FB8C5 /* CSSStyleDeclaration.cpp */,
 				A80E6E0D0A19911C007FB8C5 /* CSSStyleDeclaration.h */,
 				142011AE0A003117008303F9 /* CSSStyleDeclaration.idl */,
@@ -18681,6 +18857,7 @@
 				A80E6CC70A1989CA007FB8C5 /* FontValue.cpp */,
 				A80E6CC30A1989CA007FB8C5 /* FontValue.h */,
 				CD4E0AFA11F7BC27009D3811 /* fullscreen.css */,
+				CDBD93BA1333BD4B002570E3 /* fullscreenQuickTime.css */,
 				93CA4C9909DF93FA00DF8677 /* html.css */,
 				93CA4C9A09DF93FA00DF8677 /* make-css-file-arrays.pl */,
 				93CA4C9B09DF93FA00DF8677 /* makeprop.pl */,
@@ -18966,8 +19143,6 @@
 			children = (
 				E1C4DE6D0EA75C650023CCD6 /* ActiveDOMObject.cpp */,
 				E1C4DE680EA75C1E0023CCD6 /* ActiveDOMObject.h */,
-				8A413ADF1207BBA50082016E /* AsyncScriptRunner.cpp */,
-				8A413ADE1207BBA50082016E /* AsyncScriptRunner.h */,
 				A8C4A7FC09D563270003AC8D /* Attr.cpp */,
 				A8C4A7FB09D563270003AC8D /* Attr.h */,
 				93EEC1E509C2877700C515D1 /* Attr.idl */,
@@ -19023,6 +19198,11 @@
 				62CD32581157E57C0063B0A7 /* CustomEvent.idl */,
 				BC64641B11D7F416006455B0 /* DatasetDOMStringMap.cpp */,
 				BC64641A11D7F416006455B0 /* DatasetDOMStringMap.h */,
+				815E6166132587AA00B622B0 /* DataTransferItem.cpp */,
+				81AC5997131636E60009A7E0 /* DataTransferItem.h */,
+				81AC5AE81316392E0009A7E0 /* DataTransferItem.idl */,
+				81AC5998131636E60009A7E0 /* DataTransferItems.h */,
+				81AC5AE91316392E0009A7E0 /* DataTransferItems.idl */,
 				A8C228A011D5722E00D5A7D3 /* DecodedDataDocumentParser.cpp */,
 				A8C2289F11D5722E00D5A7D3 /* DecodedDataDocumentParser.h */,
 				31FB1A4F120A5D0600DC02A0 /* DeviceMotionClient.h */,
@@ -19091,6 +19271,8 @@
 				14E836D209F8512000B85AE4 /* Event.idl */,
 				4138D3341244054800323D33 /* EventContext.cpp */,
 				4138D3331244054800323D33 /* EventContext.h */,
+				418A06CF133C04D500CD379C /* EventDispatcher.cpp */,
+				418A06CE133C04D500CD379C /* EventDispatcher.h */,
 				BC60D9090D2A17CE00B9918F /* EventException.h */,
 				BC60D90A0D2A17CE00B9918F /* EventException.idl */,
 				935FBC4409BA00B900E230B1 /* EventListener.h */,
@@ -19205,6 +19387,8 @@
 				08A484760E5272C500C3FE76 /* ScriptElement.h */,
 				E11C9DAF0EB3699500E409DB /* ScriptExecutionContext.cpp */,
 				E11C9D9A0EB3681200E409DB /* ScriptExecutionContext.h */,
+				8A413ADF1207BBA50082016E /* ScriptRunner.cpp */,
+				8A413ADE1207BBA50082016E /* ScriptRunner.h */,
 				084AEBE20FB505FA0038483E /* SelectElement.cpp */,
 				084AEBE30FB505FA0038483E /* SelectElement.h */,
 				BC7FA6800D1F167900DB22A9 /* SelectorNodeList.cpp */,
@@ -19215,6 +19399,9 @@
 				CEA3949B11D45CDA003094CF /* StaticHashSetNodeList.h */,
 				BC7FA62C0D1F0EFF00DB22A9 /* StaticNodeList.cpp */,
 				BC7FA62B0D1F0EFF00DB22A9 /* StaticNodeList.h */,
+				8102C5871325BB1100DDE67A /* StringCallback.cpp */,
+				81AC6C35131C57D30009A7E0 /* StringCallback.h */,
+				81AC6C34131C57C20009A7E0 /* StringCallback.idl */,
 				A8C4A7EC09D563270003AC8D /* StyledElement.cpp */,
 				A8C4A7EB09D563270003AC8D /* StyledElement.h */,
 				AA4C3A740B2B1679002334A2 /* StyleElement.cpp */,
@@ -19560,7 +19747,6 @@
 				976D6C77122B8A3D001FD1F7 /* AsyncFileWriter.h in Headers */,
 				976D6C93122B8A3D001FD1F7 /* AsyncFileWriterClient.h in Headers */,
 				B0149E7E11A4B21500196A7B /* AsyncImageResizer.h in Headers */,
-				8A413AE01207BBA50082016E /* AsyncScriptRunner.h in Headers */,
 				37C61F0112095C87007A3C67 /* AtomicStringKeyedMRUCache.h in Headers */,
 				A8C4A80D09D563270003AC8D /* Attr.h in Headers */,
 				A8C4A80B09D563270003AC8D /* Attribute.h in Headers */,
@@ -19719,6 +19905,8 @@
 				FD31602912B0267600C1A359 /* ConvolverNode.h in Headers */,
 				D8B6152F1032495100C8554A /* Cookie.h in Headers */,
 				9352088209BD45E900F2038D /* CookieJar.h in Headers */,
+				339B5B63131DAA3200F48D02 /* CookiesStrategy.h in Headers */,
+				33D0212D131DB37B004091A8 /* CookieStorage.h in Headers */,
 				7EE6846412D26E3800E79415 /* CookieStorageCFNet.h in Headers */,
 				FE6FD4880F676E5700092873 /* Coordinates.h in Headers */,
 				B8A6A6D5127B338D008673BA /* CorrectionPanelInfo.h in Headers */,
@@ -19754,6 +19942,7 @@
 				A80E6CF60A1989CA007FB8C5 /* CSSImportRule.h in Headers */,
 				A80E6D010A1989CA007FB8C5 /* CSSInheritedValue.h in Headers */,
 				A80E6D080A1989CA007FB8C5 /* CSSInitialValue.h in Headers */,
+				BC772E131331620C001EC9CE /* CSSLineBoxContainValue.h in Headers */,
 				A8C4A80909D563270003AC8D /* CSSMappedAttributeDeclaration.h in Headers */,
 				A80E6D030A1989CA007FB8C5 /* CSSMediaRule.h in Headers */,
 				A80E6DFC0A199067007FB8C5 /* CSSMutableStyleDeclaration.h in Headers */,
@@ -19765,6 +19954,7 @@
 				BC02A4B70E0997B9004B6D2B /* CSSParserValues.h in Headers */,
 				977B3863122883E900B81FF8 /* CSSPreloadScanner.h in Headers */,
 				A80E6CE60A1989CA007FB8C5 /* CSSPrimitiveValue.h in Headers */,
+				E49BD9FA131FD2ED003C56F0 /* CSSPrimitiveValueCache.h in Headers */,
 				E1ED8AC30CC49BE000BFC557 /* CSSPrimitiveValueMappings.h in Headers */,
 				A80E6CFF0A1989CA007FB8C5 /* CSSProperty.h in Headers */,
 				0F6ECD450F252F3700BDE271 /* CSSPropertyLonghand.h in Headers */,
@@ -19778,6 +19968,7 @@
 				371F51A10D262FA000ECE0D5 /* CSSSegmentedFontFace.h in Headers */,
 				A80E73520A199C77007FB8C5 /* CSSSelector.h in Headers */,
 				E4C1789B0EE6903800824D69 /* CSSSelectorList.h in Headers */,
+				809DD1E0130DE2AD00CAE3ED /* CSSStyleApplyProperty.h in Headers */,
 				A80E6E0F0A19911C007FB8C5 /* CSSStyleDeclaration.h in Headers */,
 				A80E6D0C0A1989CA007FB8C5 /* CSSStyleRule.h in Headers */,
 				BC772B400C4EA91E0083285F /* CSSStyleSelector.h in Headers */,
@@ -19808,6 +19999,8 @@
 				BCBCAE370FF19385000762AE /* DataGridDataSource.h in Headers */,
 				BC22746F0E83664500E7F975 /* DataRef.h in Headers */,
 				BC64641C11D7F416006455B0 /* DatasetDOMStringMap.h in Headers */,
+				81AC5999131636E60009A7E0 /* DataTransferItem.h in Headers */,
+				81AC599A131636E60009A7E0 /* DataTransferItems.h in Headers */,
 				2E97CCEB12939CB800C5C8FF /* DataView.h in Headers */,
 				F5D3A57D106B83B300545297 /* DateComponents.h in Headers */,
 				F55B3DB61251F12D003EF269 /* DateInputType.h in Headers */,
@@ -20090,6 +20283,7 @@
 				85E711D20AC5D5350053270F /* DOMNamedNodeMapInternal.h in Headers */,
 				853BF4DB0ABB6B55008647BB /* DOMNode.h in Headers */,
 				854075260AD6C66700620C57 /* DOMNodeFilter.h in Headers */,
+				4F1442291339FD6200E0D6F8 /* DOMNodeHighlighter.h in Headers */,
 				85B498FB0ADB340200925CBB /* DOMNodeInternal.h in Headers */,
 				85526C370AB0A17E000302EA /* DOMNodeIterator.h in Headers */,
 				850B41C20AD9E7E700A6ED4F /* DOMNodeIteratorInternal.h in Headers */,
@@ -20589,8 +20783,10 @@
 				2E37DFDB12DBAFB800A6B233 /* DOMURL.h in Headers */,
 				15C770A6100D41CD005BA267 /* DOMValidityState.h in Headers */,
 				BC1A37C0097C715F0019F3D8 /* DOMViews.h in Headers */,
+				3194616A13020B66004BB3F8 /* DOMWebKitAnimation.h in Headers */,
 				31C0FF490E4CEFDD007D6FE5 /* DOMWebKitAnimationEvent.h in Headers */,
 				31C0FF4B0E4CEFDD007D6FE5 /* DOMWebKitAnimationEventInternal.h in Headers */,
+				3194620413022BF1004BB3F8 /* DOMWebKitAnimationList.h in Headers */,
 				316FE07D0E6CCC2800BF6088 /* DOMWebKitCSSKeyframeRule.h in Headers */,
 				316FE07F0E6CCC2800BF6088 /* DOMWebKitCSSKeyframeRuleInternal.h in Headers */,
 				316FE0800E6CCC2800BF6088 /* DOMWebKitCSSKeyframesRule.h in Headers */,
@@ -20651,6 +20847,7 @@
 				2ECF7AE210162B5800427DE7 /* ErrorEvent.h in Headers */,
 				85031B420A44EFC700F992E0 /* Event.h in Headers */,
 				4138D3351244054800323D33 /* EventContext.h in Headers */,
+				418A06D0133C04D500CD379C /* EventDispatcher.h in Headers */,
 				BC60D90C0D2A17CE00B9918F /* EventException.h in Headers */,
 				93C09A530B064DB3005ABD4D /* EventHandler.h in Headers */,
 				935FBC4509BA00B900E230B1 /* EventListener.h in Headers */,
@@ -20928,6 +21125,7 @@
 				375CD232119D43C800A2A859 /* Hyphenation.h in Headers */,
 				B275356E0B053814002CE64F /* Icon.h in Headers */,
 				5126E6BC0A2E3B12005C29FA /* IconDatabase.h in Headers */,
+				516953981329A3C800B92D04 /* IconDatabaseBase.h in Headers */,
 				51E1ECBE0C91C90400DC255B /* IconDatabaseClient.h in Headers */,
 				513F14540AB634C400094DDF /* IconLoader.h in Headers */,
 				51E1ECC10C91C90400DC255B /* IconRecord.h in Headers */,
@@ -20975,6 +21173,7 @@
 				DB23C2CC0A508D29002489EB /* IndentOutdentCommand.h in Headers */,
 				F3644B001119805900E0D537 /* InjectedScript.h in Headers */,
 				7A0E76FA10BF08ED00A0276E /* InjectedScriptHost.h in Headers */,
+				F316396C1329481A00A649CB /* InjectedScriptManager.h in Headers */,
 				A8CFF5E50A155A05000A4234 /* InlineBox.h in Headers */,
 				A8CFF5E30A155A05000A4234 /* InlineFlowBox.h in Headers */,
 				BCE789161120D6080060ECE5 /* InlineIterator.h in Headers */,
@@ -21007,6 +21206,7 @@
 				F344C75311294D9D00F26EEE /* InspectorFrontendClientLocal.h in Headers */,
 				7A0E770F10C00A8800A0276E /* InspectorFrontendHost.h in Headers */,
 				20D629271253690B00081543 /* InspectorInstrumentation.h in Headers */,
+				4F6FDD651341DEDD001F8EE3 /* InspectorPageAgent.h in Headers */,
 				9F0D6B2F121BFEBA006C0288 /* InspectorProfilerAgent.h in Headers */,
 				82AB1776125C826700C5069D /* InspectorResourceAgent.h in Headers */,
 				7AF11A5A12E727490061F23C /* InspectorRuntimeAgent.h in Headers */,
@@ -21027,15 +21227,21 @@
 				B27535750B053814002CE64F /* IntSize.h in Headers */,
 				B27535760B053814002CE64F /* IntSizeHash.h in Headers */,
 				F55B3DC41251F12D003EF269 /* IsIndexInputType.h in Headers */,
+				598D77DF132541FA00761B22 /* JavaArrayJSC.h in Headers */,
 				59E560A71105336600AA1258 /* JavaClassJSC.h in Headers */,
+				598D77E31325420E00761B22 /* JavaFieldJSC.h in Headers */,
 				59A9E7B21104759400DFB4C1 /* JavaInstanceJSC.h in Headers */,
+				593D3EAF1325328C0057E7EE /* JavaMethod.h in Headers */,
 				E16982681134680700894115 /* JavaRuntimeObject.h in Headers */,
 				FD31603612B0267600C1A359 /* JavaScriptAudioNode.h in Headers */,
 				1C81BA0A0E97348300266E07 /* JavaScriptCallFrame.h in Headers */,
+				593D3EB1132532950057E7EE /* JavaString.h in Headers */,
 				59BC393F11054A1300FD85DB /* JavaStringJSC.h in Headers */,
+				59B0EEA7132A6F2A004331C7 /* JavaType.h in Headers */,
 				1A569D040D7E2B82007C3983 /* jni_jsobject.h in Headers */,
 				59EE12321106082900885116 /* JNIUtility.h in Headers */,
 				59EE122E1106080F00885116 /* JNIUtilityPrivate.h in Headers */,
+				596950821321059900C3ED18 /* JobjectWrapper.h in Headers */,
 				93309DF4099E64920056E581 /* JoinTextNodesCommand.h in Headers */,
 				418F88050FF957AF0080F045 /* JSAbstractWorker.h in Headers */,
 				49EECF01105070C400099FAB /* JSArrayBuffer.h in Headers */,
@@ -21502,7 +21708,9 @@
 				49C7B9A51042D2D30009D447 /* JSWebGLTexture.h in Headers */,
 				0C45342810CDBBFA00869157 /* JSWebGLUniformLocation.h in Headers */,
 				77EF62F412F9DB7400C77BD2 /* JSWebGLVertexArrayObjectOES.h in Headers */,
+				3194616313020B20004BB3F8 /* JSWebKitAnimation.h in Headers */,
 				31C0FF3E0E4CEFAC007D6FE5 /* JSWebKitAnimationEvent.h in Headers */,
+				319461FF13022BB8004BB3F8 /* JSWebKitAnimationList.h in Headers */,
 				316FE0720E6CCBEE00BF6088 /* JSWebKitCSSKeyframeRule.h in Headers */,
 				316FE0740E6CCBEE00BF6088 /* JSWebKitCSSKeyframesRule.h in Headers */,
 				498391400F1E767500C23782 /* JSWebKitCSSMatrix.h in Headers */,
@@ -21585,6 +21793,8 @@
 				4E1959220A39DABA00220FE5 /* MediaFeatureNames.h in Headers */,
 				A8EA800E0A19516E00A8EF5F /* MediaList.h in Headers */,
 				E44613E40CD681A200FADA75 /* MediaPlayer.h in Headers */,
+				076F0D0E12B8192700C26AA4 /* MediaPlayerPrivateAVFoundation.h in Headers */,
+				076F0D0F12B8192700C26AA4 /* MediaPlayerPrivateAVFoundationObjC.h in Headers */,
 				E44613E60CD681A900FADA75 /* MediaPlayerPrivateQTKit.h in Headers */,
 				0735EE6A0F40C5E4004A2604 /* MediaPlayerProxy.h in Headers */,
 				4E19592A0A39DACC00220FE5 /* MediaQuery.h in Headers */,
@@ -21739,6 +21949,7 @@
 				E4D687790ED7AE4F006EA978 /* PurgeableBuffer.h in Headers */,
 				7E33CD01127F340D00BE8F17 /* PurgePriority.h in Headers */,
 				550A0BCA085F6039007353D6 /* QualifiedName.h in Headers */,
+				5A574F29131DB96D00471B88 /* QuotesData.h in Headers */,
 				B22279720D00BF220071B782 /* RadialGradientAttributes.h in Headers */,
 				F55B3DCC1251F12D003EF269 /* RadioInputType.h in Headers */,
 				93F1991808245E59001E9ABC /* Range.h in Headers */,
@@ -21810,6 +22021,7 @@
 				BCFA930810333193007B25D1 /* RenderOverflow.h in Headers */,
 				A871DED70A1530C700B12A68 /* RenderPart.h in Headers */,
 				A43BF59D1149292800C643CA /* RenderProgress.h in Headers */,
+				5A574F25131DB93900471B88 /* RenderQuote.h in Headers */,
 				A871DFE30A15376B00B12A68 /* RenderReplaced.h in Headers */,
 				BCA846D70DC67A350026C309 /* RenderReplica.h in Headers */,
 				1479FAEE109AE37500DED655 /* RenderRuby.h in Headers */,
@@ -21933,6 +22145,7 @@
 				9F72304F11184B4100AD0126 /* ScriptProfile.h in Headers */,
 				9FA37EE41172FC8000C4CD55 /* ScriptProfileNode.h in Headers */,
 				9F72305111184B4100AD0126 /* ScriptProfiler.h in Headers */,
+				8A413AE01207BBA50082016E /* ScriptRunner.h in Headers */,
 				934CC10A0EDB223900A658F2 /* ScriptSourceCode.h in Headers */,
 				CE54FD381016D9A6008B44C8 /* ScriptSourceProvider.h in Headers */,
 				41C760B10EDE03D300C1655F /* ScriptState.h in Headers */,
@@ -22007,6 +22220,7 @@
 				93309E14099E64920056E581 /* SplitTextNodeCommand.h in Headers */,
 				93309E16099E64920056E581 /* SplitTextNodeContainingElementCommand.h in Headers */,
 				84730D931248F0B300D3A9C9 /* SpotLightSource.h in Headers */,
+				245D80A313280E40003492A6 /* SQLCallbackWrapper.h in Headers */,
 				51EC92590CE90DB400F90308 /* SQLError.h in Headers */,
 				B56EBA8511C9FF8100B04477 /* SQLException.h in Headers */,
 				1A22464A0CC98DDB00C05240 /* SQLiteDatabase.h in Headers */,
@@ -22040,6 +22254,9 @@
 				C50D0E830FF4272900AC2644 /* StorageNamespace.h in Headers */,
 				C55E38BF10040D5D00A56BDB /* StorageNamespaceImpl.h in Headers */,
 				C5102D940FD9AA2D00FAFF04 /* StorageSyncManager.h in Headers */,
+				3AB02D2A12D4F91600FBB694 /* StorageTracker.h in Headers */,
+				3AC3680012EF7A09006A3D6F /* StorageTrackerClient.h in Headers */,
+				81AC6C36131C57D30009A7E0 /* StringCallback.h in Headers */,
 				65488D6B0DD5A83D009D83B2 /* StringSourceProvider.h in Headers */,
 				B23540F30D00782E002382FA /* StringTruncator.h in Headers */,
 				849F77760EFEC6200090849D /* StrokeStyleApplier.h in Headers */,
@@ -22299,6 +22516,7 @@
 				B2C3DA360D006C1D00EF6F26 /* TextBreakIterator.h in Headers */,
 				B2C3DA380D006C1D00EF6F26 /* TextBreakIteratorInternalICU.h in Headers */,
 				A7151BD812F1558F005A0F64 /* TextCheckerClient.h in Headers */,
+				A77D0012133B0AEB00D6658C /* TextChecking.h in Headers */,
 				A7DBF8DE1276919C006B6008 /* TextCheckingHelper.h in Headers */,
 				B2C3DA3A0D006C1D00EF6F26 /* TextCodec.h in Headers */,
 				26E98A10130A9FCA008EB7B2 /* TextCodecASCIIFastPath.h in Headers */,
@@ -22322,6 +22540,7 @@
 				F55B3DDA1251F12D003EF269 /* TextInputType.h in Headers */,
 				93309E1C099E64920056E581 /* TextIterator.h in Headers */,
 				BCEF45E90E687767001C1287 /* TextMetrics.h in Headers */,
+				BCD3F9831326C93700098A60 /* TextOrientation.h in Headers */,
 				930FC68A1072B9280045293E /* TextRenderingMode.h in Headers */,
 				93F198F608245E59001E9ABC /* TextResourceDecoder.h in Headers */,
 				A824B4650E2EF2EA0081A7B7 /* TextRun.h in Headers */,
@@ -22391,7 +22610,6 @@
 				93F199A808245E59001E9ABC /* WebCoreFrameView.h in Headers */,
 				BC53D911114310CC000D817E /* WebCoreJSClientData.h in Headers */,
 				93F199BB08245E59001E9ABC /* WebCoreKeyboardUIMode.h in Headers */,
-				93F199C208245E59001E9ABC /* WebCoreKeyGenerator.h in Headers */,
 				934D9BA70B8C1175007B42A9 /* WebCoreNSStringExtras.h in Headers */,
 				DD05FE0D0B8BA3C6009ACDFE /* WebCoreObjCExtras.h in Headers */,
 				EDEC98030AED7E170059137F /* WebCorePrefix.h in Headers */,
@@ -22416,7 +22634,9 @@
 				49C7B9E61042D32F0009D447 /* WebGLTexture.h in Headers */,
 				0C3F1F5B10C8871200D72CE1 /* WebGLUniformLocation.h in Headers */,
 				77A17A7812F28642004E02F6 /* WebGLVertexArrayObjectOES.h in Headers */,
+				319E69B313299BBD004AC91A /* WebKitAnimation.h in Headers */,
 				31C0FF220E4CEB6E007D6FE5 /* WebKitAnimationEvent.h in Headers */,
+				319E69B613299BBD004AC91A /* WebKitAnimationList.h in Headers */,
 				31288E730E3005D6003619AE /* WebKitCSSKeyframeRule.h in Headers */,
 				31288E750E3005D6003619AE /* WebKitCSSKeyframesRule.h in Headers */,
 				498391590F1E776900C23782 /* WebKitCSSMatrix.h in Headers */,
@@ -22534,16 +22754,12 @@
 				93F199ED08245E59001E9ABC /* XSLTProcessor.h in Headers */,
 				E1BE512E0CF6C512002EA959 /* XSLTUnicodeSort.h in Headers */,
 				977E2E0F12F0FC9C00C13379 /* XSSFilter.h in Headers */,
-				E49BD9FA131FD2ED003C56F0 /* CSSPrimitiveValueCache.h in Headers */,
-				5A574F25131DB93900471B88 /* RenderQuote.h in Headers */,
-				5A574F29131DB96D00471B88 /* QuotesData.h in Headers */,
-				339B5B63131DAA3200F48D02 /* CookiesStrategy.h in Headers */,
-				33D0212D131DB37B004091A8 /* CookieStorage.h in Headers */,
-				596950821321059900C3ED18 /* JobjectWrapper.h in Headers */,
-				593D3EAF1325328C0057E7EE /* JavaMethod.h in Headers */,
-				593D3EB1132532950057E7EE /* JavaString.h in Headers */,
-				598D77DF132541FA00761B22 /* JavaArrayJSC.h in Headers */,
-				598D77E31325420E00761B22 /* JavaFieldJSC.h in Headers */,
+				BCC36EB91342AA3F004BEEF7 /* DefaultLocalizationStrategy.h in Headers */,
+				599C671E1343439400C3423C /* JavaMethodJobject.h in Headers */,
+				F34742DD134362F000531BC2 /* PageDebuggerAgent.h in Headers */,
+				F34742E11343631F00531BC2 /* WorkerDebuggerAgent.h in Headers */,
+				F34742E51343633C00531BC2 /* PageScriptDebugServer.h in Headers */,
+				F34742E91343635000531BC2 /* WorkerScriptDebugServer.h in Headers */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
@@ -22876,7 +23092,6 @@
 				49EECDDF10503C2400099FAB /* ArrayBufferView.cpp in Sources */,
 				89D08D9F12228451001241DF /* AsyncFileSystem.cpp in Sources */,
 				B0149E7D11A4B21500196A7B /* AsyncImageResizer.cpp in Sources */,
-				8A413AE11207BBA50082016E /* AsyncScriptRunner.cpp in Sources */,
 				A8C4A80E09D563270003AC8D /* Attr.cpp in Sources */,
 				A8C4A80C09D563270003AC8D /* Attribute.cpp in Sources */,
 				FD315FF612B0267600C1A359 /* AudioBasicProcessorNode.cpp in Sources */,
@@ -23037,6 +23252,7 @@
 				A80E6CEB0A1989CA007FB8C5 /* CSSImportRule.cpp in Sources */,
 				A80E6CF00A1989CA007FB8C5 /* CSSInheritedValue.cpp in Sources */,
 				A80E6D020A1989CA007FB8C5 /* CSSInitialValue.cpp in Sources */,
+				BC772E16133162C2001EC9CE /* CSSLineBoxContainValue.cpp in Sources */,
 				A8C4A80A09D563270003AC8D /* CSSMappedAttributeDeclaration.cpp in Sources */,
 				A80E6CFC0A1989CA007FB8C5 /* CSSMediaRule.cpp in Sources */,
 				A80E6DFB0A199067007FB8C5 /* CSSMutableStyleDeclaration.cpp in Sources */,
@@ -23046,6 +23262,7 @@
 				BC02A5400E099C5A004B6D2B /* CSSParserValues.cpp in Sources */,
 				977B3862122883E900B81FF8 /* CSSPreloadScanner.cpp in Sources */,
 				A80E6D050A1989CA007FB8C5 /* CSSPrimitiveValue.cpp in Sources */,
+				E49BDA0B131FD3E5003C56F0 /* CSSPrimitiveValueCache.cpp in Sources */,
 				A80E6CF70A1989CA007FB8C5 /* CSSProperty.cpp in Sources */,
 				0F6ECD460F252F3700BDE271 /* CSSPropertyLonghand.cpp in Sources */,
 				1ABA76CA11D20E50004C201C /* CSSPropertyNames.cpp in Sources */,
@@ -23056,6 +23273,7 @@
 				371F51A20D262FA000ECE0D5 /* CSSSegmentedFontFace.cpp in Sources */,
 				A80E734F0A199C77007FB8C5 /* CSSSelector.cpp in Sources */,
 				E4C1789A0EE6903800824D69 /* CSSSelectorList.cpp in Sources */,
+				809DD1DF130DE2AD00CAE3ED /* CSSStyleApplyProperty.cpp in Sources */,
 				A80E6E100A19911C007FB8C5 /* CSSStyleDeclaration.cpp in Sources */,
 				A80E6CEF0A1989CA007FB8C5 /* CSSStyleRule.cpp in Sources */,
 				BC772B3F0C4EA91E0083285F /* CSSStyleSelector.cpp in Sources */,
@@ -23076,6 +23294,7 @@
 				BC77D2390FF298080070887B /* DataGridColumn.cpp in Sources */,
 				BC77D1FD0FF28D9B0070887B /* DataGridColumnList.cpp in Sources */,
 				BC64641D11D7F416006455B0 /* DatasetDOMStringMap.cpp in Sources */,
+				815E6167132587AA00B622B0 /* DataTransferItem.cpp in Sources */,
 				2E97CCEA12939CB800C5C8FF /* DataView.cpp in Sources */,
 				F5D3A57C106B83B300545297 /* DateComponents.cpp in Sources */,
 				F55B3DB51251F12D003EF269 /* DateInputType.cpp in Sources */,
@@ -23239,6 +23458,7 @@
 				85C7F5C00AAFB7CD004014DD /* DOMMutationEvent.mm in Sources */,
 				8518DD790A9CF31B0091B7A6 /* DOMNamedNodeMap.mm in Sources */,
 				853BF4DC0ABB6B55008647BB /* DOMNode.mm in Sources */,
+				4F1442281339FD6200E0D6F8 /* DOMNodeHighlighter.cpp in Sources */,
 				85526C380AB0A17E000302EA /* DOMNodeIterator.mm in Sources */,
 				85ACAA8E0A9B759C00671E90 /* DOMNodeList.mm in Sources */,
 				85CA96EB0A9624E900690CCF /* DOMNotation.mm in Sources */,
@@ -23405,7 +23625,9 @@
 				2E37DFDA12DBAFB800A6B233 /* DOMURL.cpp in Sources */,
 				BC1A37BF097C715F0019F3D8 /* DOMUtility.mm in Sources */,
 				15C770A5100D41CD005BA267 /* DOMValidityState.mm in Sources */,
+				3194616B13020B66004BB3F8 /* DOMWebKitAnimation.mm in Sources */,
 				31C0FF4A0E4CEFDD007D6FE5 /* DOMWebKitAnimationEvent.mm in Sources */,
+				3194620513022BF1004BB3F8 /* DOMWebKitAnimationList.mm in Sources */,
 				316FE07E0E6CCC2800BF6088 /* DOMWebKitCSSKeyframeRule.mm in Sources */,
 				316FE0810E6CCC2800BF6088 /* DOMWebKitCSSKeyframesRule.mm in Sources */,
 				498391510F1E76B400C23782 /* DOMWebKitCSSMatrix.mm in Sources */,
@@ -23445,6 +23667,7 @@
 				2ECF7AE110162B5800427DE7 /* ErrorEvent.cpp in Sources */,
 				85031B410A44EFC700F992E0 /* Event.cpp in Sources */,
 				4138D3361244054800323D33 /* EventContext.cpp in Sources */,
+				418A06D1133C04D500CD379C /* EventDispatcher.cpp in Sources */,
 				93C09A810B064F00005ABD4D /* EventHandler.cpp in Sources */,
 				93C09A7F0B064EEF005ABD4D /* EventHandlerMac.mm in Sources */,
 				1CA19E050DC255950065A994 /* EventLoopMac.mm in Sources */,
@@ -23524,6 +23747,7 @@
 				A80E6CEC0A1989CA007FB8C5 /* FontFamilyValue.cpp in Sources */,
 				72626E020EF022FE00A07E20 /* FontFastPath.cpp in Sources */,
 				B2AFFC800D00A5C10030074D /* FontMac.mm in Sources */,
+				84B62685133138F90095A489 /* FontPlatformData.cpp in Sources */,
 				B5320D6C122A24E9002D1440 /* FontPlatformDataCocoa.mm in Sources */,
 				B734B181119B9911006587BD /* FontTranscoder.cpp in Sources */,
 				A80E6CF10A1989CA007FB8C5 /* FontValue.cpp in Sources */,
@@ -23593,6 +23817,7 @@
 				93F19AFD08245E59001E9ABC /* HTMLCanvasElement.cpp in Sources */,
 				A8DF3FD1097FA0FC0052981B /* HTMLCollection.cpp in Sources */,
 				977B3864122883E900B81FF8 /* HTMLConstructionSite.cpp in Sources */,
+				5D4F51DF132725480016F541 /* HTMLConverter.mm in Sources */,
 				BC77CDB80FEFF1210070887B /* HTMLDataGridCellElement.cpp in Sources */,
 				BC77CBAA0FEBF6C90070887B /* HTMLDataGridColElement.cpp in Sources */,
 				BCF524600FEBEE5D0095BF26 /* HTMLDataGridElement.cpp in Sources */,
@@ -23693,7 +23918,7 @@
 				371A67CB11C6C7DB00047B8B /* HyphenationCF.cpp in Sources */,
 				375CD23B119D44EA00A2A859 /* HyphenationMac.mm in Sources */,
 				5126E6BB0A2E3B12005C29FA /* IconDatabase.cpp in Sources */,
-				445C8DB710015FC90031531A /* IconDatabaseNone.cpp in Sources */,
+				516953971329A3C800B92D04 /* IconDatabaseBase.cpp in Sources */,
 				513F14530AB634C400094DDF /* IconLoader.cpp in Sources */,
 				B275358E0B053A66002CE64F /* IconMac.mm in Sources */,
 				51E1ECC00C91C90400DC255B /* IconRecord.cpp in Sources */,
@@ -23730,6 +23955,7 @@
 				DB23C2CB0A508D29002489EB /* IndentOutdentCommand.cpp in Sources */,
 				F3644AFF1119805900E0D537 /* InjectedScript.cpp in Sources */,
 				7A0E76F910BF08ED00A0276E /* InjectedScriptHost.cpp in Sources */,
+				F316396B1329481A00A649CB /* InjectedScriptManager.cpp in Sources */,
 				A8CFF5E60A155A05000A4234 /* InlineBox.cpp in Sources */,
 				A8CFF5E40A155A05000A4234 /* InlineFlowBox.cpp in Sources */,
 				BCEA4859097D93020094C9E4 /* InlineTextBox.cpp in Sources */,
@@ -23759,6 +23985,7 @@
 				F344C75811294FF600F26EEE /* InspectorFrontendClientLocal.cpp in Sources */,
 				7A0E770E10C00A8800A0276E /* InspectorFrontendHost.cpp in Sources */,
 				20D629261253690B00081543 /* InspectorInstrumentation.cpp in Sources */,
+				4F6FDD641341DEDD001F8EE3 /* InspectorPageAgent.cpp in Sources */,
 				9F0D6B2E121BFEBA006C0288 /* InspectorProfilerAgent.cpp in Sources */,
 				82AB1775125C826700C5069D /* InspectorResourceAgent.cpp in Sources */,
 				7AA365EE12E7265400DCA242 /* InspectorRuntimeAgent.cpp in Sources */,
@@ -23777,7 +24004,9 @@
 				B27535620B053814002CE64F /* IntSizeCG.cpp in Sources */,
 				B275357E0B053814002CE64F /* IntSizeMac.mm in Sources */,
 				F55B3DC31251F12D003EF269 /* IsIndexInputType.cpp in Sources */,
+				598D77DD132541EE00761B22 /* JavaArrayJSC.cpp in Sources */,
 				59E560A91105336F00AA1258 /* JavaClassJSC.cpp in Sources */,
+				598D77E11325420400761B22 /* JavaFieldJSC.cpp in Sources */,
 				59A9E7B01104758800DFB4C1 /* JavaInstanceJSC.cpp in Sources */,
 				E1698264113467F300894115 /* JavaRuntimeObject.cpp in Sources */,
 				FD31603512B0267600C1A359 /* JavaScriptAudioNode.cpp in Sources */,
@@ -23786,6 +24015,7 @@
 				1A569D050D7E2B82007C3983 /* jni_objc.mm in Sources */,
 				59EE12301106081F00885116 /* JNIUtility.cpp in Sources */,
 				59EE122C1106080500885116 /* JNIUtilityPrivate.cpp in Sources */,
+				59695084132105A500C3ED18 /* JobjectWrapper.cpp in Sources */,
 				93309DF3099E64920056E581 /* JoinTextNodesCommand.cpp in Sources */,
 				418F88040FF957AE0080F045 /* JSAbstractWorker.cpp in Sources */,
 				49EECF00105070C400099FAB /* JSArrayBuffer.cpp in Sources */,
@@ -24085,6 +24315,7 @@
 				A7D0318E0E93540300E24ACD /* JSImageDataCustom.cpp in Sources */,
 				7A0E76DA10BF059800A0276E /* JSInjectedScriptHost.cpp in Sources */,
 				7A0E76D510BF050700A0276E /* JSInjectedScriptHostCustom.cpp in Sources */,
+				F316396E1329487600A649CB /* JSInjectedScriptManager.cpp in Sources */,
 				7A0E771E10C00DB100A0276E /* JSInspectorFrontendHost.cpp in Sources */,
 				7A74ECBD101839DA00BF939E /* JSInspectorFrontendHostCustom.cpp in Sources */,
 				49EECF06105070C400099FAB /* JSInt16Array.cpp in Sources */,
@@ -24352,7 +24583,11 @@
 				49C7B9A41042D2D30009D447 /* JSWebGLTexture.cpp in Sources */,
 				0C45342710CDBBFA00869157 /* JSWebGLUniformLocation.cpp in Sources */,
 				77EF62F312F9DB7400C77BD2 /* JSWebGLVertexArrayObjectOES.cpp in Sources */,
+				3194616213020B20004BB3F8 /* JSWebKitAnimation.cpp in Sources */,
+				319E68871327C911004AC91A /* JSWebKitAnimationCustom.cpp in Sources */,
 				31C0FF3D0E4CEFAC007D6FE5 /* JSWebKitAnimationEvent.cpp in Sources */,
+				319461FE13022BB8004BB3F8 /* JSWebKitAnimationList.cpp in Sources */,
+				3194623213022F65004BB3F8 /* JSWebKitAnimationListCustom.cpp in Sources */,
 				316FE0710E6CCBEE00BF6088 /* JSWebKitCSSKeyframeRule.cpp in Sources */,
 				E1AD14C51297354900ACA989 /* JSWebKitCSSKeyframeRuleCustom.cpp in Sources */,
 				316FE0730E6CCBEE00BF6088 /* JSWebKitCSSKeyframesRule.cpp in Sources */,
@@ -24442,6 +24677,8 @@
 				4E1959210A39DABA00220FE5 /* MediaFeatureNames.cpp in Sources */,
 				A8EA80090A19516E00A8EF5F /* MediaList.cpp in Sources */,
 				E44613E30CD6819F00FADA75 /* MediaPlayer.cpp in Sources */,
+				072C8B11131C518600A4FCE9 /* MediaPlayerPrivateAVFoundation.cpp in Sources */,
+				072C8B12131C518B00A4FCE9 /* MediaPlayerPrivateAVFoundationObjC.mm in Sources */,
 				E44613E50CD681A600FADA75 /* MediaPlayerPrivateQTKit.mm in Sources */,
 				4E1959290A39DACC00220FE5 /* MediaQuery.cpp in Sources */,
 				4E19592B0A39DACC00220FE5 /* MediaQueryEvaluator.cpp in Sources */,
@@ -24554,6 +24791,7 @@
 				1AF8E1C3125673E000230FF7 /* ProxyServerCFNet.cpp in Sources */,
 				E4D687770ED7AE3D006EA978 /* PurgeableBufferMac.cpp in Sources */,
 				550A0BC9085F6039007353D6 /* QualifiedName.cpp in Sources */,
+				5A574F28131DB96D00471B88 /* QuotesData.cpp in Sources */,
 				F55B3DCB1251F12D003EF269 /* RadioInputType.cpp in Sources */,
 				93F19AB908245E59001E9ABC /* Range.cpp in Sources */,
 				F55B3DCD1251F12D003EF269 /* RangeInputType.cpp in Sources */,
@@ -24620,6 +24858,7 @@
 				BC60EFB70F33A0E700812A93 /* RenderObjectChildList.cpp in Sources */,
 				A871DED00A1530C700B12A68 /* RenderPart.cpp in Sources */,
 				A43BF59C1149292800C643CA /* RenderProgress.cpp in Sources */,
+				5A574F24131DB93900471B88 /* RenderQuote.cpp in Sources */,
 				A871DFE20A15376B00B12A68 /* RenderReplaced.cpp in Sources */,
 				BCA846D60DC67A350026C309 /* RenderReplica.cpp in Sources */,
 				1479FAED109AE37500DED655 /* RenderRuby.cpp in Sources */,
@@ -24633,7 +24872,6 @@
 				BC8C8FAD0DDCD31B00B592F4 /* RenderStyle.cpp in Sources */,
 				D302754D12A5FEAB004BD828 /* RenderSummary.cpp in Sources */,
 				0F4E57171313276200CF85AF /* RenderSVGAllInOne.cpp in Sources */,
-				ADDF1AD61257CD9A0003A759 /* RenderSVGPath.cpp in Sources */,
 				A8DF4AEC0980C42C0052981B /* RenderTable.cpp in Sources */,
 				A8DF4AEA0980C42C0052981B /* RenderTableCell.cpp in Sources */,
 				A8DF4AE80980C42C0052981B /* RenderTableCol.cpp in Sources */,
@@ -24712,6 +24950,7 @@
 				41F066E50F64BCF600A07EAC /* ScriptObject.cpp in Sources */,
 				F33F0282120947F200E5743A /* ScriptProfile.cpp in Sources */,
 				9F72305011184B4100AD0126 /* ScriptProfiler.cpp in Sources */,
+				8A413AE11207BBA50082016E /* ScriptRunner.cpp in Sources */,
 				4127D5370F8AAB1D00E424F5 /* ScriptState.cpp in Sources */,
 				934CC0E10ED39D6F00A658F2 /* ScriptValue.cpp in Sources */,
 				BC8AE34E12EA096A00EB3AE6 /* ScrollableArea.cpp in Sources */,
@@ -24796,7 +25035,7 @@
 				B5C1123B102B6C4600096578 /* SQLTransactionCoordinator.cpp in Sources */,
 				B523CF091182675400EBB29C /* SQLTransactionSync.cpp in Sources */,
 				1A2E6E590CC55213004A2062 /* SQLValue.cpp in Sources */,
-				93F19AE608245E59001E9ABC /* SSLKeyGeneratorMac.mm in Sources */,
+				93F19AE608245E59001E9ABC /* SSLKeyGeneratorMac.cpp in Sources */,
 				CEA3949C11D45CDA003094CF /* StaticHashSetNodeList.cpp in Sources */,
 				BC7FA62E0D1F0EFF00DB22A9 /* StaticNodeList.cpp in Sources */,
 				A5AFB34F115151A700B045CB /* StepRange.cpp in Sources */,
@@ -24809,7 +25048,9 @@
 				C50D0E820FF4272900AC2644 /* StorageNamespace.cpp in Sources */,
 				C55E38C010040D5D00A56BDB /* StorageNamespaceImpl.cpp in Sources */,
 				C5102D950FD9AA2D00FAFF04 /* StorageSyncManager.cpp in Sources */,
+				3AB02D2B12D4F91600FBB694 /* StorageTracker.cpp in Sources */,
 				B2C3DA300D006C1D00EF6F26 /* String.cpp in Sources */,
+				8102C5881325BB1100DDE67A /* StringCallback.cpp in Sources */,
 				B2B2645C0D00A77E000ACC1D /* StringCF.cpp in Sources */,
 				B2B2645D0D00A77E000ACC1D /* StringImplCF.cpp in Sources */,
 				B2AFFC950D00A5DF0030074D /* StringImplMac.mm in Sources */,
@@ -24838,6 +25079,7 @@
 				D000ED2711C1B9CD00C47726 /* SubframeLoader.cpp in Sources */,
 				F55B3DD31251F12D003EF269 /* SubmitInputType.cpp in Sources */,
 				93E227E40AF589AD00D48324 /* SubresourceLoader.cpp in Sources */,
+				7E37EF2E1339208800B29250 /* SubresourceLoaderCF.cpp in Sources */,
 				93B2D8180F9920EE006AE6B2 /* SuddenTermination.mm in Sources */,
 				62C1217C11AB9E77003C462C /* SuspendableTimer.cpp in Sources */,
 				B22279730D00BF220071B782 /* SVGAElement.cpp in Sources */,
@@ -25058,7 +25300,6 @@
 				93309E1D099E64920056E581 /* visible_units.cpp in Sources */,
 				93309E1F099E64920056E581 /* VisiblePosition.cpp in Sources */,
 				A883DF270F3D045D00F19BF6 /* VisibleSelection.cpp in Sources */,
-				93F19AE508245E59001E9ABC /* WebCoreKeyGenerator.m in Sources */,
 				934D9BA50B8C116B007B42A9 /* WebCoreNSStringExtras.mm in Sources */,
 				B50F5B810E96CD9900AD71A6 /* WebCoreObjCExtras.mm in Sources */,
 				93EB169509F880B00091F8FF /* WebCoreSystemInterface.mm in Sources */,
@@ -25081,7 +25322,9 @@
 				49C7B9E51042D32F0009D447 /* WebGLTexture.cpp in Sources */,
 				0C3F1F5A10C8871200D72CE1 /* WebGLUniformLocation.cpp in Sources */,
 				77A17A7712F28642004E02F6 /* WebGLVertexArrayObjectOES.cpp in Sources */,
+				319E69B213299BBD004AC91A /* WebKitAnimation.cpp in Sources */,
 				31C0FF210E4CEB6E007D6FE5 /* WebKitAnimationEvent.cpp in Sources */,
+				319E69B513299BBD004AC91A /* WebKitAnimationList.cpp in Sources */,
 				31288E720E3005D6003619AE /* WebKitCSSKeyframeRule.cpp in Sources */,
 				31288E740E3005D6003619AE /* WebKitCSSKeyframesRule.cpp in Sources */,
 				498391580F1E776900C23782 /* WebKitCSSMatrix.cpp in Sources */,
@@ -25189,13 +25432,12 @@
 				93F19B0508245E59001E9ABC /* XSLTProcessorLibxslt.cpp in Sources */,
 				E1BE512D0CF6C512002EA959 /* XSLTUnicodeSort.cpp in Sources */,
 				977E2E0E12F0FC9C00C13379 /* XSSFilter.cpp in Sources */,
-				E49BDA0B131FD3E5003C56F0 /* CSSPrimitiveValueCache.cpp in Sources */,
-				5A574F24131DB93900471B88 /* RenderQuote.cpp in Sources */,
-				5A574F28131DB96D00471B88 /* QuotesData.cpp in Sources */,
-				59695084132105A500C3ED18 /* JobjectWrapper.cpp in Sources */,
-				593D3EAD132532840057E7EE /* JavaMethod.cpp in Sources */,
-				598D77DD132541EE00761B22 /* JavaArrayJSC.cpp in Sources */,
-				598D77E11325420400761B22 /* JavaFieldJSC.cpp in Sources */,
+				BCC36EB81342AA3F004BEEF7 /* DefaultLocalizationStrategy.cpp in Sources */,
+				599C671C1343438900C3423C /* JavaMethodJobject.cpp in Sources */,
+				F34742DC134362F000531BC2 /* PageDebuggerAgent.cpp in Sources */,
+				F34742E01343631F00531BC2 /* WorkerDebuggerAgent.cpp in Sources */,
+				F34742E41343633C00531BC2 /* PageScriptDebugServer.cpp in Sources */,
+				F34742E81343635000531BC2 /* WorkerScriptDebugServer.cpp in Sources */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
@@ -25244,6 +25486,11 @@
 			isa = XCBuildConfiguration;
 			baseConfigurationReference = 1CDD45E50BA9C84600F90147 /* WebCore.xcconfig */;
 			buildSettings = {
+				FRAMEWORK_SEARCH_PATHS = (
+					"$(inherited)",
+					"$(FRAMEWORK_SEARCH_PATHS_QUOTED_FOR_TARGET_1)",
+				);
+				FRAMEWORK_SEARCH_PATHS_QUOTED_FOR_TARGET_1 = "\"$(SYSTEM_LIBRARY_DIR)/PrivateFrameworks\"";
 				INSTALL_PATH = "$(BUILT_PRODUCTS_DIR)";
 			};
 			name = Debug;
@@ -25252,6 +25499,11 @@
 			isa = XCBuildConfiguration;
 			baseConfigurationReference = 1CDD45E50BA9C84600F90147 /* WebCore.xcconfig */;
 			buildSettings = {
+				FRAMEWORK_SEARCH_PATHS = (
+					"$(inherited)",
+					"$(FRAMEWORK_SEARCH_PATHS_QUOTED_FOR_TARGET_1)",
+				);
+				FRAMEWORK_SEARCH_PATHS_QUOTED_FOR_TARGET_1 = "\"$(SYSTEM_LIBRARY_DIR)/PrivateFrameworks\"";
 				INSTALL_PATH = "$(BUILT_PRODUCTS_DIR)";
 			};
 			name = Release;
@@ -25261,6 +25513,11 @@
 			baseConfigurationReference = 1CDD45E50BA9C84600F90147 /* WebCore.xcconfig */;
 			buildSettings = {
 				BUILD_VARIANTS = normal;
+				FRAMEWORK_SEARCH_PATHS = (
+					"$(inherited)",
+					"$(FRAMEWORK_SEARCH_PATHS_QUOTED_FOR_TARGET_1)",
+				);
+				FRAMEWORK_SEARCH_PATHS_QUOTED_FOR_TARGET_1 = "\"$(SYSTEM_LIBRARY_DIR)/PrivateFrameworks\"";
 			};
 			name = Production;
 		};
diff --git a/Source/WebCore/accessibility/AXObjectCache.cpp b/Source/WebCore/accessibility/AXObjectCache.cpp
index a01cb59..b471201 100644
--- a/Source/WebCore/accessibility/AXObjectCache.cpp
+++ b/Source/WebCore/accessibility/AXObjectCache.cpp
@@ -616,7 +616,7 @@ void AXObjectCache::textMarkerDataForVisiblePosition(TextMarkerData& textMarkerD
         return;
     
     if (domNode->isHTMLElement()) {
-        InputElement* inputElement = toInputElement(static_cast<Element*>(domNode));
+        InputElement* inputElement = domNode->toInputElement();
         if (inputElement && inputElement->isPasswordField())
             return;
     }
diff --git a/Source/WebCore/accessibility/AXObjectCache.h b/Source/WebCore/accessibility/AXObjectCache.h
index 4c231b5..4805a7f 100644
--- a/Source/WebCore/accessibility/AXObjectCache.h
+++ b/Source/WebCore/accessibility/AXObjectCache.h
@@ -96,7 +96,8 @@ public:
     void handleScrollbarUpdate(ScrollView*);
     
     static void enableAccessibility() { gAccessibilityEnabled = true; }
-    static void enableEnhancedUserInterfaceAccessibility() { gAccessibilityEnhancedUserInterfaceEnabled = true; }
+    // Enhanced user interface accessibility can be toggled by the assistive technology.
+    static void setEnhancedUserInterfaceAccessibility(bool flag) { gAccessibilityEnhancedUserInterfaceEnabled = flag; }
     
     static bool accessibilityEnabled() { return gAccessibilityEnabled; }
     static bool accessibilityEnhancedUserInterfaceEnabled() { return gAccessibilityEnhancedUserInterfaceEnabled; }
diff --git a/Source/WebCore/accessibility/AccessibilityImageMapLink.cpp b/Source/WebCore/accessibility/AccessibilityImageMapLink.cpp
index 0844d02..a41f228 100644
--- a/Source/WebCore/accessibility/AccessibilityImageMapLink.cpp
+++ b/Source/WebCore/accessibility/AccessibilityImageMapLink.cpp
@@ -42,6 +42,7 @@ using namespace HTMLNames;
 AccessibilityImageMapLink::AccessibilityImageMapLink()
     : m_areaElement(0)
     , m_mapElement(0)
+    , m_parent(0)
 {
 }
 
diff --git a/Source/WebCore/accessibility/AccessibilityObject.h b/Source/WebCore/accessibility/AccessibilityObject.h
index 4687cae..2d27e39 100644
--- a/Source/WebCore/accessibility/AccessibilityObject.h
+++ b/Source/WebCore/accessibility/AccessibilityObject.h
@@ -171,6 +171,10 @@ enum AccessibilityRole {
     ListItemRole,
     MenuListPopupRole,
     MenuListOptionRole,
+    ParagraphRole,
+    LabelRole,
+    DivRole,
+    FormRole,
 
     // ARIA Grouping roles
     LandmarkApplicationRole,
diff --git a/Source/WebCore/accessibility/AccessibilityRenderObject.cpp b/Source/WebCore/accessibility/AccessibilityRenderObject.cpp
index a626950..9b54a69 100644
--- a/Source/WebCore/accessibility/AccessibilityRenderObject.cpp
+++ b/Source/WebCore/accessibility/AccessibilityRenderObject.cpp
@@ -495,7 +495,7 @@ bool AccessibilityRenderObject::isPasswordField() const
     if (ariaRoleAttribute() != UnknownRole)
         return false;
 
-    InputElement* inputElement = toInputElement(static_cast<Element*>(m_renderer->node()));
+    InputElement* inputElement = m_renderer->node()->toInputElement();
     if (!inputElement)
         return false;
 
@@ -585,10 +585,10 @@ bool AccessibilityRenderObject::isPressed() const
 bool AccessibilityRenderObject::isIndeterminate() const
 {
     ASSERT(m_renderer);
-    if (!m_renderer->node() || !m_renderer->node()->isElementNode())
+    if (!m_renderer->node())
         return false;
 
-    InputElement* inputElement = toInputElement(static_cast<Element*>(m_renderer->node()));
+    InputElement* inputElement = m_renderer->node()->toInputElement();
     if (!inputElement)
         return false;
 
@@ -598,8 +598,8 @@ bool AccessibilityRenderObject::isIndeterminate() const
 bool AccessibilityRenderObject::isNativeCheckboxOrRadio() const
 {
     Node* elementNode = node();
-    if (elementNode && elementNode->isElementNode()) {
-        InputElement* input = toInputElement(static_cast<Element*>(elementNode));
+    if (elementNode) {
+        InputElement* input = elementNode->toInputElement();
         if (input)
             return input->isCheckbox() || input->isRadioButton();
     }
@@ -610,11 +610,11 @@ bool AccessibilityRenderObject::isNativeCheckboxOrRadio() const
 bool AccessibilityRenderObject::isChecked() const
 {
     ASSERT(m_renderer);
-    if (!m_renderer->node() || !m_renderer->node()->isElementNode())
+    if (!m_renderer->node())
         return false;
 
     // First test for native checkedness semantics
-    InputElement* inputElement = toInputElement(static_cast<Element*>(m_renderer->node()));
+    InputElement* inputElement = m_renderer->node()->toInputElement();
     if (inputElement)
         return inputElement->isChecked();
 
@@ -661,10 +661,10 @@ bool AccessibilityRenderObject::isReadOnly() const
             return true;
         
         HTMLElement* body = document->body();
-        if (body && body->isContentEditable())
+        if (body && body->rendererIsEditable())
             return false;
 
-        return !document->inDesignMode();
+        return !document->rendererIsEditable();
     }
 
     if (m_renderer->isBoxModelObject()) {
@@ -675,7 +675,7 @@ bool AccessibilityRenderObject::isReadOnly() const
             return static_cast<HTMLTextAreaElement*>(box->node())->readOnly();
     }
 
-    return !m_renderer->node() || !m_renderer->node()->isContentEditable();
+    return !m_renderer->node() || !m_renderer->node()->rendererIsEditable();
 }
 
 bool AccessibilityRenderObject::isOffScreen() const
@@ -1829,7 +1829,7 @@ bool AccessibilityRenderObject::accessibilityIsIgnored() const
         return false;
     
     // Anything that is content editable should not be ignored.
-    // However, one cannot just call node->isContentEditable() since that will ask if its parents
+    // However, one cannot just call node->rendererIsEditable() since that will ask if its parents
     // are also editable. Only the top level content editable region should be exposed.
     if (node && node->isElementNode()) {
         Element* element = static_cast<Element*>(node);
@@ -1838,6 +1838,10 @@ bool AccessibilityRenderObject::accessibilityIsIgnored() const
             return false;
     }
     
+    // List items play an important role in defining the structure of lists. They should not be ignored.
+    if (roleValue() == ListItemRole)
+        return false;
+    
     // if this element has aria attributes on it, it should not be ignored.
     if (supportsARIAAttributes())
         return false;
@@ -2401,8 +2405,8 @@ VisiblePositionRange AccessibilityRenderObject::visiblePositionRange() const
     if (!node)
         return VisiblePositionRange();
 
-    VisiblePosition startPos = firstDeepEditingPositionForNode(node);
-    VisiblePosition endPos = lastDeepEditingPositionForNode(node);
+    VisiblePosition startPos = firstPositionInOrBeforeNode(node);
+    VisiblePosition endPos = lastPositionInOrAfterNode(node);
 
     // the VisiblePositions are equal for nodes like buttons, so adjust for that
     // FIXME: Really?  [button, 0] and [button, 1] are distinct (before and after the button)
@@ -3083,9 +3087,24 @@ AccessibilityRole AccessibilityRenderObject::determineAccessibilityRole()
 #if PLATFORM(GTK)
     if (m_renderer->isHR())
         return SplitterRole;
+
+    if (node && node->hasTagName(pTag))
+        return ParagraphRole;
+
+    if (node && node->hasTagName(labelTag))
+        return LabelRole;
+
+    if (node && node->hasTagName(divTag))
+        return DivRole;
+
+    if (node && node->hasTagName(formTag))
+        return FormRole;
+#else
+    if (node && node->hasTagName(labelTag))
+        return GroupRole;
 #endif
 
-    if (m_renderer->isBlockFlow() || (node && node->hasTagName(labelTag)))
+    if (m_renderer->isBlockFlow())
         return GroupRole;
     
     // If the element does not have role, but it has ARIA attributes, accessibility should fallback to exposing it as a group.
diff --git a/Source/WebCore/accessibility/gtk/AXObjectCacheAtk.cpp b/Source/WebCore/accessibility/gtk/AXObjectCacheAtk.cpp
index 0701ece..f910ca6 100644
--- a/Source/WebCore/accessibility/gtk/AXObjectCacheAtk.cpp
+++ b/Source/WebCore/accessibility/gtk/AXObjectCacheAtk.cpp
@@ -143,6 +143,17 @@ void AXObjectCache::postPlatformNotification(AccessibilityObject* coreObject, AX
             g_signal_emit_by_name(axObject, "state-change", "focused", true);
         }
         notifyChildrenSelectionChange(coreObject);
+    } else if (notification == AXValueChanged) {
+        if (!ATK_IS_VALUE(axObject))
+            return;
+
+        AtkPropertyValues propertyValues;
+        propertyValues.property_name = "accessible-value";
+
+        memset(&propertyValues.new_value,  0, sizeof(GValue));
+        atk_value_get_current_value(ATK_VALUE(axObject), &propertyValues.new_value);
+
+        g_signal_emit_by_name(ATK_OBJECT(axObject), "property-change::accessible-value", &propertyValues, NULL);
     }
 }
 
diff --git a/Source/WebCore/accessibility/gtk/AccessibilityObjectAtk.cpp b/Source/WebCore/accessibility/gtk/AccessibilityObjectAtk.cpp
index c8c1951..850bcbe 100644
--- a/Source/WebCore/accessibility/gtk/AccessibilityObjectAtk.cpp
+++ b/Source/WebCore/accessibility/gtk/AccessibilityObjectAtk.cpp
@@ -43,17 +43,10 @@ AccessibilityObjectInclusion AccessibilityObject::accessibilityPlatformIncludesO
     if (roleValue() == SplitterRole)
         return IncludeObject;
 
-    if (isGroup()) {
-        // When a list item is made up entirely of children (e.g. paragraphs)
-        // the list item gets ignored. We need it.
-        if (parent->isList())
-            return IncludeObject;
-
-        // We expect the parent of a table cell to be a table.
-        AccessibilityObject* child = firstChild();
-        if (child && child->roleValue() == CellRole)
-            return IgnoreObject;
-    }
+    // When a list item is made up entirely of children (e.g. paragraphs)
+    // the list item gets ignored. We need it.
+    if (isGroup() && parent->isList())
+        return IncludeObject;
 
     // Entries and password fields have extraneous children which we want to ignore.
     if (parent->isPasswordField() || parent->isTextControl())
@@ -105,7 +98,13 @@ void AccessibilityObject::setWrapper(AccessibilityObjectWrapper* wrapper)
 
 bool AccessibilityObject::allowsTextRanges() const
 {
-    return isTextControl() || isWebArea() || isGroup() || isLink() || isHeading() || isListItem();
+    // Check type for the AccessibilityObject.
+    if (isTextControl() || isWebArea() || isGroup() || isLink() || isHeading() || isListItem())
+        return true;
+
+    // Check roles as the last fallback mechanism.
+    AccessibilityRole role = roleValue();
+    return role == ParagraphRole || role == LabelRole || role == DivRole || role == FormRole;
 }
 
 unsigned AccessibilityObject::getLengthForTextRange() const
diff --git a/Source/WebCore/accessibility/gtk/AccessibilityObjectWrapperAtk.cpp b/Source/WebCore/accessibility/gtk/AccessibilityObjectWrapperAtk.cpp
index 1d23612..7dff2e3 100644
--- a/Source/WebCore/accessibility/gtk/AccessibilityObjectWrapperAtk.cpp
+++ b/Source/WebCore/accessibility/gtk/AccessibilityObjectWrapperAtk.cpp
@@ -158,6 +158,11 @@ static AccessibilityObject* core(AtkDocument* document)
     return core(ATK_OBJECT(document));
 }
 
+static AccessibilityObject* core(AtkValue* value)
+{
+    return core(ATK_OBJECT(value));
+}
+
 static gchar* webkit_accessible_text_get_text(AtkText* text, gint startOffset, gint endOffset);
 
 static const gchar* webkit_accessible_get_name(AtkObject* object)
@@ -471,6 +476,14 @@ static AtkRole atkRole(AccessibilityRole role)
     case ListItemRole:
     case ListBoxOptionRole:
         return ATK_ROLE_LIST_ITEM;
+    case ParagraphRole:
+        return ATK_ROLE_PARAGRAPH;
+    case LabelRole:
+        return ATK_ROLE_LABEL;
+    case DivRole:
+        return ATK_ROLE_SECTION;
+    case FormRole:
+        return ATK_ROLE_FORM;
     default:
         return ATK_ROLE_UNKNOWN;
     }
@@ -478,31 +491,16 @@ static AtkRole atkRole(AccessibilityRole role)
 
 static AtkRole webkit_accessible_get_role(AtkObject* object)
 {
-    AccessibilityObject* axObject = core(object);
+    AccessibilityObject* coreObject = core(object);
 
-    if (!axObject)
+    if (!coreObject)
         return ATK_ROLE_UNKNOWN;
 
-    // WebCore does not know about paragraph role, label role, or section role
-    if (axObject->isAccessibilityRenderObject()) {
-        Node* node = static_cast<AccessibilityRenderObject*>(axObject)->renderer()->node();
-        if (node) {
-            if (node->hasTagName(HTMLNames::pTag))
-                return ATK_ROLE_PARAGRAPH;
-            if (node->hasTagName(HTMLNames::labelTag))
-                return ATK_ROLE_LABEL;
-            if (node->hasTagName(HTMLNames::divTag))
-                return ATK_ROLE_SECTION;
-            if (node->hasTagName(HTMLNames::formTag))
-                return ATK_ROLE_FORM;
-        }
-    }
-
     // Note: Why doesn't WebCore have a password field for this
-    if (axObject->isPasswordField())
+    if (coreObject->isPasswordField())
         return ATK_ROLE_PASSWORD_TEXT;
 
-    return atkRole(axObject->roleValue());
+    return atkRole(coreObject->roleValue());
 }
 
 static bool selectionBelongsToObject(AccessibilityObject* coreObject, VisibleSelection& selection)
@@ -2301,6 +2299,63 @@ static void atk_document_interface_init(AtkDocumentIface* iface)
     iface->get_document_locale = webkit_accessible_document_get_locale;
 }
 
+
+static void webkitAccessibleValueGetCurrentValue(AtkValue* value, GValue* gValue)
+{
+    memset(gValue,  0, sizeof(GValue));
+    g_value_init(gValue, G_TYPE_DOUBLE);
+    g_value_set_double(gValue, core(value)->valueForRange());
+}
+
+static void webkitAccessibleValueGetMaximumValue(AtkValue* value, GValue* gValue)
+{
+    memset(gValue,  0, sizeof(GValue));
+    g_value_init(gValue, G_TYPE_DOUBLE);
+    g_value_set_double(gValue, core(value)->maxValueForRange());
+}
+
+static void webkitAccessibleValueGetMinimumValue(AtkValue* value, GValue* gValue)
+{
+    memset(gValue,  0, sizeof(GValue));
+    g_value_init(gValue, G_TYPE_DOUBLE);
+    g_value_set_double(gValue, core(value)->minValueForRange());
+}
+
+static gboolean webkitAccessibleValueSetCurrentValue(AtkValue* value, const GValue* gValue)
+{
+    if (!G_VALUE_HOLDS_DOUBLE(gValue) && !G_VALUE_HOLDS_INT(gValue))
+        return FALSE;
+
+    AccessibilityObject* coreObject = core(value);
+    if (!coreObject->canSetValueAttribute())
+        return FALSE;
+
+    if (G_VALUE_HOLDS_DOUBLE(gValue))
+        coreObject->setValue(String::number(g_value_get_double(gValue)));
+    else
+        coreObject->setValue(String::number(g_value_get_int(gValue)));
+
+    return TRUE;
+}
+
+static void webkitAccessibleValueGetMinimumIncrement(AtkValue* value, GValue* gValue)
+{
+    memset(gValue,  0, sizeof(GValue));
+    g_value_init(gValue, G_TYPE_DOUBLE);
+
+    // There's not such a thing in the WAI-ARIA specification, thus return zero.
+    g_value_set_double(gValue, 0.0);
+}
+
+static void atkValueInterfaceInit(AtkValueIface* iface)
+{
+    iface->get_current_value = webkitAccessibleValueGetCurrentValue;
+    iface->get_maximum_value = webkitAccessibleValueGetMaximumValue;
+    iface->get_minimum_value = webkitAccessibleValueGetMinimumValue;
+    iface->set_current_value = webkitAccessibleValueSetCurrentValue;
+    iface->get_minimum_increment = webkitAccessibleValueGetMinimumIncrement;
+}
+
 static const GInterfaceInfo AtkInterfacesInitFunctions[] = {
     {(GInterfaceInitFunc)atk_action_interface_init,
      (GInterfaceFinalizeFunc) 0, 0},
@@ -2321,6 +2376,8 @@ static const GInterfaceInfo AtkInterfacesInitFunctions[] = {
     {(GInterfaceInitFunc)atkHyperlinkImplInterfaceInit,
      (GInterfaceFinalizeFunc) 0, 0},
     {(GInterfaceInitFunc)atk_document_interface_init,
+     (GInterfaceFinalizeFunc) 0, 0},
+    {(GInterfaceInitFunc)atkValueInterfaceInit,
      (GInterfaceFinalizeFunc) 0, 0}
 };
 
@@ -2334,7 +2391,8 @@ enum WAIType {
     WAI_TABLE,
     WAI_HYPERTEXT,
     WAI_HYPERLINK,
-    WAI_DOCUMENT
+    WAI_DOCUMENT,
+    WAI_VALUE,
 };
 
 static GType GetAtkInterfaceTypeFromWAIType(WAIType type)
@@ -2360,6 +2418,8 @@ static GType GetAtkInterfaceTypeFromWAIType(WAIType type)
         return ATK_TYPE_HYPERLINK_IMPL;
     case WAI_DOCUMENT:
         return ATK_TYPE_DOCUMENT;
+    case WAI_VALUE:
+        return ATK_TYPE_VALUE;
     }
 
     return G_TYPE_INVALID;
@@ -2431,6 +2491,10 @@ static guint16 getInterfaceMaskFromObject(AccessibilityObject* coreObject)
     if (role == WebAreaRole)
         interfaceMask |= 1 << WAI_DOCUMENT;
 
+    // Value
+    if (role == SliderRole)
+        interfaceMask |= 1 << WAI_VALUE;
+
     return interfaceMask;
 }
 
diff --git a/Source/WebCore/accessibility/gtk/WebKitAccessibleHyperlink.cpp b/Source/WebCore/accessibility/gtk/WebKitAccessibleHyperlink.cpp
index 5927430..b9e483c 100644
--- a/Source/WebCore/accessibility/gtk/WebKitAccessibleHyperlink.cpp
+++ b/Source/WebCore/accessibility/gtk/WebKitAccessibleHyperlink.cpp
@@ -32,6 +32,7 @@
 #include "RenderListMarker.h"
 #include "RenderObject.h"
 #include "TextIterator.h"
+#include "htmlediting.h"
 
 #include <atk/atk.h>
 #include <glib.h>
@@ -230,11 +231,19 @@ static gint webkitAccessibleHyperlinkGetStartIndex(AtkHyperlink* link)
     if (!coreObject)
         return 0;
 
+    AccessibilityObject* parentUnignored = coreObject->parentObjectUnignored();
+    if (!parentUnignored)
+        return 0;
+
     Node* node = coreObject->node();
     if (!node)
         return 0;
 
-    RefPtr<Range> range = Range::create(node->document(), firstPositionInNode(node->parentNode()), firstPositionInNode(node));
+    Node* parentNode = parentUnignored->node();
+    if (!parentNode)
+        return 0;
+
+    RefPtr<Range> range = Range::create(node->document(), firstPositionInOrBeforeNode(parentNode), firstPositionInOrBeforeNode(node));
     return getRangeLengthForObject(coreObject, range.get());
 }
 
@@ -246,11 +255,19 @@ static gint webkitAccessibleHyperlinkGetEndIndex(AtkHyperlink* link)
     if (!coreObject)
         return 0;
 
+    AccessibilityObject* parentUnignored = coreObject->parentObjectUnignored();
+    if (!parentUnignored)
+        return 0;
+
     Node* node = coreObject->node();
     if (!node)
         return 0;
 
-    RefPtr<Range> range = Range::create(node->document(), firstPositionInNode(node->parentNode()), lastPositionInNode(node));
+    Node* parentNode = parentUnignored->node();
+    if (!parentNode)
+        return 0;
+
+    RefPtr<Range> range = Range::create(node->document(), firstPositionInOrBeforeNode(parentNode), lastPositionInOrAfterNode(node));
     return getRangeLengthForObject(coreObject, range.get());
 }
 
diff --git a/Source/WebCore/accessibility/mac/AccessibilityObjectWrapper.mm b/Source/WebCore/accessibility/mac/AccessibilityObjectWrapper.mm
index a71ccd4..c0dd795 100644
--- a/Source/WebCore/accessibility/mac/AccessibilityObjectWrapper.mm
+++ b/Source/WebCore/accessibility/mac/AccessibilityObjectWrapper.mm
@@ -41,6 +41,7 @@
 #import "AccessibilityTableCell.h"
 #import "AccessibilityTableRow.h"
 #import "AccessibilityTableColumn.h"
+#import "Chrome.h"
 #import "ColorMac.h"
 #import "Frame.h"
 #import "FrameLoaderClient.h"
@@ -1286,7 +1287,11 @@ static const AccessibilityRoleMap& createAccessibilityRoleMap()
         { TabPanelRole, NSAccessibilityGroupRole },
         { TreeRole, NSAccessibilityOutlineRole },
         { TreeItemRole, NSAccessibilityRowRole },
-        { ListItemRole, NSAccessibilityGroupRole }
+        { ListItemRole, NSAccessibilityGroupRole },
+        { ParagraphRole, NSAccessibilityGroupRole },
+        { LabelRole, NSAccessibilityGroupRole },
+        { DivRole, NSAccessibilityGroupRole },
+        { FormRole, NSAccessibilityGroupRole }
     };
     AccessibilityRoleMap& roleMap = *new AccessibilityRoleMap;
     
@@ -2330,28 +2335,20 @@ static NSString* roleValueToNSString(AccessibilityRole value)
     FrameView* frameView = m_object->documentFrameView();
     if (!frameView)
         return;
+    Frame* frame = frameView->frame();
+    if (!frame)
+        return;
+    Page* page = frame->page();
+    if (!page)
+        return;
 
-    // simulate a click in the middle of the object
+    // Simulate a click in the middle of the object.
     IntPoint clickPoint = m_object->clickPoint();
-    NSPoint nsClickPoint = NSMakePoint(clickPoint.x(), clickPoint.y());
-    
-    NSView* view = nil;
-    if (m_object->isAttachment())
-        view = [self attachmentView];
-    else
-        view = frameView->documentView();
-    
-    if (!view)
-        return;
-    
-    NSPoint nsScreenPoint = [view convertPoint:nsClickPoint toView:nil];
-    
-    // Show the contextual menu for this event.
-    NSEvent* event = [NSEvent mouseEventWithType:NSRightMouseDown location:nsScreenPoint modifierFlags:0 timestamp:0 windowNumber:[[view window] windowNumber] context:0 eventNumber:0 clickCount:1 pressure:1];
-    NSMenu* menu = [view menuForEvent:event];
     
-    if (menu)
-        [NSMenu popUpContextMenu:menu withEvent:event forView:view];    
+    PlatformMouseEvent mouseEvent(clickPoint, clickPoint, RightButton, MouseEventPressed, 1, false, false, false, false, currentTime());
+    bool handled = frame->eventHandler()->sendContextMenuEvent(mouseEvent);
+    if (handled)
+        page->chrome()->showContextMenu();
 }
 
 - (void)accessibilityPerformAction:(NSString*)action
diff --git a/Source/WebCore/bindings/ScriptControllerBase.cpp b/Source/WebCore/bindings/ScriptControllerBase.cpp
index fbf6d3e..5e87dbf 100644
--- a/Source/WebCore/bindings/ScriptControllerBase.cpp
+++ b/Source/WebCore/bindings/ScriptControllerBase.cpp
@@ -21,6 +21,7 @@
 #include "config.h"
 #include "ScriptController.h"
 
+#include "ContentSecurityPolicy.h"
 #include "DocumentLoader.h"
 #include "Frame.h"
 #include "FrameLoaderClient.h"
diff --git a/Source/WebCore/bindings/generic/RuntimeEnabledFeatures.cpp b/Source/WebCore/bindings/generic/RuntimeEnabledFeatures.cpp
index 14e4ac8..e9591fd 100644
--- a/Source/WebCore/bindings/generic/RuntimeEnabledFeatures.cpp
+++ b/Source/WebCore/bindings/generic/RuntimeEnabledFeatures.cpp
@@ -46,16 +46,20 @@ bool RuntimeEnabledFeatures::isLocalStorageEnabled = true;
 bool RuntimeEnabledFeatures::isSessionStorageEnabled = true;
 bool RuntimeEnabledFeatures::isWebkitNotificationsEnabled = false;
 bool RuntimeEnabledFeatures::isApplicationCacheEnabled = true;
+bool RuntimeEnabledFeatures::isDataTransferItemsEnabled = true;
 bool RuntimeEnabledFeatures::isGeolocationEnabled = true;
 bool RuntimeEnabledFeatures::isIndexedDBEnabled = false;
 bool RuntimeEnabledFeatures::isWebAudioEnabled = false;
-bool RuntimeEnabledFeatures::isWebGLEnabled = false;
 bool RuntimeEnabledFeatures::isPushStateEnabled = false;
 bool RuntimeEnabledFeatures::isTouchEnabled = true;
 bool RuntimeEnabledFeatures::isDeviceMotionEnabled = true;
 bool RuntimeEnabledFeatures::isDeviceOrientationEnabled = true;
 bool RuntimeEnabledFeatures::isSpeechInputEnabled = true;
 
+#if ENABLE(MEDIA_STREAM)
+bool RuntimeEnabledFeatures::isMediaStreamEnabled = true;
+#endif
+
 #if ENABLE(XHR_RESPONSE_BLOB)
 bool RuntimeEnabledFeatures::isXHRResponseBlobEnabled = false;
 #endif
diff --git a/Source/WebCore/bindings/generic/RuntimeEnabledFeatures.h b/Source/WebCore/bindings/generic/RuntimeEnabledFeatures.h
index 7e21214..1004ea4 100644
--- a/Source/WebCore/bindings/generic/RuntimeEnabledFeatures.h
+++ b/Source/WebCore/bindings/generic/RuntimeEnabledFeatures.h
@@ -51,6 +51,9 @@ public:
     static void setApplicationCacheEnabled(bool isEnabled) { isApplicationCacheEnabled = isEnabled; }
     static bool applicationCacheEnabled() { return isApplicationCacheEnabled; }
 
+    static void setDataTransferItemsEnabled(bool isEnabled) { isDataTransferItemsEnabled = isEnabled; }
+    static bool dataTransferItemsEnabled() { return isDataTransferItemsEnabled; }
+
     static void setGeolocationEnabled(bool isEnabled) { isGeolocationEnabled = isEnabled; }
     static bool geolocationEnabled() { return isGeolocationEnabled; }
 
@@ -94,27 +97,6 @@ public:
     static bool webkitAudioContextEnabled() { return isWebAudioEnabled; }
 #endif
 
-#if ENABLE(WEBGL) || ENABLE(BLOB)
-    static void setWebGLEnabled(bool isEnabled) { isWebGLEnabled = isEnabled; }
-    static bool webGLRenderingContextEnabled() { return isWebGLEnabled; }
-    static bool webGLArrayBufferEnabled() { return isWebGLEnabled; }
-    static bool webGLByteArrayEnabled() { return isWebGLEnabled; }
-    static bool webGLUnsignedByteArrayEnabled() { return isWebGLEnabled; }
-    static bool webGLShortArrayEnabled() { return isWebGLEnabled; }
-    static bool webGLUnsignedShortArrayEnabled() { return isWebGLEnabled; }
-    static bool webGLIntArrayEnabled() { return isWebGLEnabled; }
-    static bool webGLUnsignedIntArrayEnabled() { return isWebGLEnabled; }
-    static bool webGLFloatArrayEnabled() { return isWebGLEnabled; }
-    static bool webGLActiveInfoEnabled() { return isWebGLEnabled; }
-    static bool webGLBufferEnabled() { return isWebGLEnabled; }
-    static bool webGLFramebufferEnabled() { return isWebGLEnabled; }
-    static bool webGLProgramEnabled() { return isWebGLEnabled; }
-    static bool webGLRenderbufferEnabled() { return isWebGLEnabled; }
-    static bool webGLShaderEnabled() { return isWebGLEnabled; }
-    static bool webGLTextureEnabled() { return isWebGLEnabled; }
-    static bool webGLUniformLocationEnabled() { return isWebGLEnabled; }
-#endif
-
     static void setPushStateEnabled(bool isEnabled) { isPushStateEnabled = isEnabled; }
     static bool pushStateEnabled() { return isPushStateEnabled; }
     static bool replaceStateEnabled() { return isPushStateEnabled; }
@@ -162,6 +144,12 @@ public:
     static void setJavaScriptI18NAPIEnabled(bool isEnabled) { isJavaScriptI18NAPIEnabled = isEnabled; }
 #endif
 
+#if ENABLE(MEDIA_STREAM)
+    static bool mediaStreamEnabled() { return isMediaStreamEnabled; }
+    static void setMediaStreamEnabled(bool isEnabled) { isMediaStreamEnabled = isEnabled; }
+    static bool webkitGetUserMediaEnabled() { return isMediaStreamEnabled; }
+#endif
+
 private:
     // Never instantiate.
     RuntimeEnabledFeatures() { }
@@ -170,10 +158,10 @@ private:
     static bool isSessionStorageEnabled;
     static bool isWebkitNotificationsEnabled;
     static bool isApplicationCacheEnabled;
+    static bool isDataTransferItemsEnabled;
     static bool isGeolocationEnabled;
     static bool isIndexedDBEnabled;
     static bool isWebAudioEnabled;
-    static bool isWebGLEnabled;
     static bool isPushStateEnabled;
     static bool isTouchEnabled;
     static bool isDeviceMotionEnabled;
@@ -190,6 +178,10 @@ private:
 #if ENABLE(JAVASCRIPT_I18N_API)
     static bool isJavaScriptI18NAPIEnabled;
 #endif
+
+#if ENABLE(MEDIA_STREAM)
+    static bool isMediaStreamEnabled;
+#endif
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/bindings/gobject/GNUmakefile.am b/Source/WebCore/bindings/gobject/GNUmakefile.am
index 881f45a..8370b86 100644
--- a/Source/WebCore/bindings/gobject/GNUmakefile.am
+++ b/Source/WebCore/bindings/gobject/GNUmakefile.am
@@ -244,6 +244,8 @@ webkitgtk_gdom_built_sources += \
 	DerivedSources/webkit/WebKitDOMUIEventPrivate.h \
 	DerivedSources/webkit/WebKitDOMValidityState.cpp \
 	DerivedSources/webkit/WebKitDOMValidityStatePrivate.h \
+	DerivedSources/webkit/WebKitDOMWebKitAnimation.cpp \
+	DerivedSources/webkit/WebKitDOMWebKitAnimationList.cpp \
 	DerivedSources/webkit/WebKitDOMWebKitPoint.cpp \
 	DerivedSources/webkit/WebKitDOMWebKitPointPrivate.h \
 	DerivedSources/webkit/WebKitDOMXPathExpression.cpp \
@@ -372,6 +374,8 @@ webkitgtk_built_h_api += \
 	DerivedSources/webkit/WebKitDOMObject.h \
 	DerivedSources/webkit/WebKitDOMNavigator.h \
 	DerivedSources/webkit/WebKitDOMScreen.h \
+	DerivedSources/webkit/WebKitDOMWebKitAnimation.h \
+	DerivedSources/webkit/WebKitDOMWebKitAnimationList.h \
 	DerivedSources/webkit/WebKitDOMWebKitPoint.h \
 	DerivedSources/webkit/WebKitDOMDOMMimeType.h \
 	DerivedSources/webkit/WebKitDOMDOMMimeTypeArray.h \
diff --git a/Source/WebCore/bindings/gobject/GObjectEventListener.cpp b/Source/WebCore/bindings/gobject/GObjectEventListener.cpp
index 27432b9..6211e7d 100644
--- a/Source/WebCore/bindings/gobject/GObjectEventListener.cpp
+++ b/Source/WebCore/bindings/gobject/GObjectEventListener.cpp
@@ -1,5 +1,5 @@
 /*
- *  Copyright (C) 2010 Igalia S.L.
+ *  Copyright (C) 2010, 2011 Igalia S.L.
  *
  *  This library is free software; you can redistribute it and/or
  *  modify it under the terms of the GNU Lesser General Public
@@ -29,55 +29,51 @@
 
 namespace WebCore {
 
-GObjectEventListener::GObjectEventListener(GObject* object, DOMWindow* window, Node* node, const char* domEventName, const char* signalName)
+typedef void (*GObjectEventListenerCallback)(GObject*, WebKitDOMEvent*, void*);
+
+GObjectEventListener::GObjectEventListener(GObject* object, EventTarget* target, const char* domEventName, GCallback handler, bool capture, void* userData)
     : EventListener(GObjectEventListenerType)
     , m_object(object)
-    , m_coreNode(node)
-    , m_coreWindow(window)
+    , m_coreTarget(target)
     , m_domEventName(domEventName)
-    , m_signalName(signalName)
+    , m_handler(handler)
+    , m_capture(capture)
+    , m_userData(userData)
 {
-    ASSERT(!m_coreWindow || !m_coreNode);
-
+    ASSERT(m_coreTarget);
     g_object_weak_ref(object, reinterpret_cast<GWeakNotify>(GObjectEventListener::gobjectDestroyedCallback), this);
 }
 
 GObjectEventListener::~GObjectEventListener()
 {
-    if (!m_coreWindow && !m_coreNode)
+    if (!m_coreTarget)
         return;
     g_object_weak_unref(m_object, reinterpret_cast<GWeakNotify>(GObjectEventListener::gobjectDestroyedCallback), this);
 }
 
 void GObjectEventListener::gobjectDestroyed()
 {
-    ASSERT(!m_coreWindow || !m_coreNode);
-
-    // We must set m_coreWindow and m_coreNode to null, because removeEventListener may call the
-    // destructor as a side effect and we must be in the proper state to prevent g_object_weak_unref.
-    if (DOMWindow* window = m_coreWindow) {
-        m_coreWindow = 0;
-        window->removeEventListener(m_domEventName.data(), this, false);
-        return;
-    }
+    ASSERT(m_coreTarget);
 
-    Node* node = m_coreNode;
-    m_coreNode = 0; // See above.
-    node->removeEventListener(m_domEventName.data(), this, false);
+    // We must set m_coreTarget to null, because removeEventListener
+    // may call the destructor as a side effect and we must be in the
+    // proper state to prevent g_object_weak_unref.
+    EventTarget* target = m_coreTarget;
+    m_coreTarget = 0;
+    target->removeEventListener(m_domEventName.data(), this, m_capture);
 }
 
 void GObjectEventListener::handleEvent(ScriptExecutionContext*, Event* event)
 {
-    gboolean handled = FALSE;
     WebKitDOMEvent* gobjectEvent = WEBKIT_DOM_EVENT(WebKit::kit(event));
-    g_signal_emit_by_name(m_object, m_signalName.data(), gobjectEvent, &handled);
+    reinterpret_cast<GObjectEventListenerCallback>(m_handler)(m_object, gobjectEvent, m_userData);
     g_object_unref(gobjectEvent);
 }
 
 bool GObjectEventListener::operator==(const EventListener& listener)
 {
     if (const GObjectEventListener* gobjectEventListener = GObjectEventListener::cast(&listener))
-        return m_signalName == gobjectEventListener->m_signalName && m_object == gobjectEventListener->m_object;
+        return m_object == gobjectEventListener->m_object && m_handler == gobjectEventListener->m_handler;
 
     return false;
 }
diff --git a/Source/WebCore/bindings/gobject/GObjectEventListener.h b/Source/WebCore/bindings/gobject/GObjectEventListener.h
index ef1637a..6c85701 100644
--- a/Source/WebCore/bindings/gobject/GObjectEventListener.h
+++ b/Source/WebCore/bindings/gobject/GObjectEventListener.h
@@ -1,5 +1,5 @@
 /*
- *  Copyright (C) 2010 Igalia S.L.
+ *  Copyright (C) 2010, 2011 Igalia S.L.
  *
  *  This library is free software; you can redistribute it and/or
  *  modify it under the terms of the GNU Lesser General Public
@@ -19,30 +19,30 @@
 #ifndef GObjectEventListener_h
 #define GObjectEventListener_h
 
-#include "DOMWindow.h"
 #include "EventListener.h"
-#include "Node.h"
+#include "EventTarget.h"
 
 #include <wtf/RefPtr.h>
 #include <wtf/text/CString.h>
 
 typedef struct _GObject GObject;
+typedef void (*GCallback) (void);
 
 namespace WebCore {
 
 class GObjectEventListener : public EventListener {
 public:
 
-    static void addEventListener(GObject* object, DOMWindow* window, const char* domEventName, const char* signalName)
+    static bool addEventListener(GObject* object, EventTarget* target, const char* domEventName, GCallback handler, bool useCapture, void* userData)
     {
-        RefPtr<GObjectEventListener> listener(adoptRef(new GObjectEventListener(object, window, 0, domEventName, signalName)));
-        window->addEventListener(domEventName, listener.release(), false);
+        RefPtr<GObjectEventListener> listener(adoptRef(new GObjectEventListener(object, target, domEventName, handler, useCapture, userData)));
+        return target->addEventListener(domEventName, listener.release(), useCapture);
     }
 
-    static void addEventListener(GObject* object, Node* node, const char* domEventName, const char* signalName)
+    static bool removeEventListener(GObject* object, EventTarget* target, const char* domEventName, GCallback handler, bool useCapture)
     {
-        RefPtr<GObjectEventListener> listener(adoptRef(new GObjectEventListener(object, 0, node, domEventName, signalName)));
-        node->addEventListener(domEventName, listener.release(), false);
+        GObjectEventListener key(object, target, domEventName, handler, useCapture, 0);
+        return target->removeEventListener(domEventName, &key, useCapture);
     }
 
     static void gobjectDestroyedCallback(GObjectEventListener* listener, GObject*)
@@ -60,7 +60,7 @@ public:
     virtual bool operator==(const EventListener& other);
 
 private:
-    GObjectEventListener(GObject*, DOMWindow*, Node*, const char* domEventName, const char* signalName);
+    GObjectEventListener(GObject*, EventTarget*, const char* domEventName, GCallback handler, bool capture, void* userData);
     ~GObjectEventListener();
     void gobjectDestroyed();
 
@@ -68,12 +68,13 @@ private:
 
     GObject* m_object;
 
-    // We do not need to keep a reference to these WebCore objects, because
-    // we only use them when the GObject and thus the WebCore object is alive.
-    Node* m_coreNode;
-    DOMWindow* m_coreWindow;
+    // We do not need to keep a reference to the m_coreTarget, because
+    // we only use it when the GObject and thus the m_coreTarget object is alive.
+    EventTarget* m_coreTarget;
     CString m_domEventName;
-    CString m_signalName;
+    GCallback m_handler;
+    bool m_capture;
+    void* m_userData;
 };
 } // namespace WebCore
 
diff --git a/Source/WebCore/bindings/gobject/WebKitDOMEventTarget.cpp b/Source/WebCore/bindings/gobject/WebKitDOMEventTarget.cpp
index f2b1a94..f74c340 100644
--- a/Source/WebCore/bindings/gobject/WebKitDOMEventTarget.cpp
+++ b/Source/WebCore/bindings/gobject/WebKitDOMEventTarget.cpp
@@ -66,17 +66,42 @@ static void webkit_dom_event_target_default_init(WebKitDOMEventTargetIface*)
 
 void webkit_dom_event_target_dispatch_event(WebKitDOMEventTarget* target, WebKitDOMEvent* event, GError** error)
 {
-    WebKitDOMEventTargetIface* iface;
-
     g_return_if_fail(WEBKIT_DOM_IS_EVENT_TARGET(target));
     g_return_if_fail(WEBKIT_DOM_IS_EVENT(event));
 
-    iface = WEBKIT_DOM_EVENT_TARGET_GET_IFACE(target);
+    WebKitDOMEventTargetIface* iface = WEBKIT_DOM_EVENT_TARGET_GET_IFACE(target);
 
     if (iface->dispatch_event)
         iface->dispatch_event(target, event, error);
 }
 
+gboolean webkit_dom_event_target_add_event_listener(WebKitDOMEventTarget* target, const char* eventName, GCallback handler, gboolean bubble, gpointer userData)
+{
+
+    g_return_val_if_fail(WEBKIT_DOM_IS_EVENT_TARGET(target), FALSE);
+    g_return_val_if_fail(eventName, FALSE);
+
+    WebKitDOMEventTargetIface* iface = WEBKIT_DOM_EVENT_TARGET_GET_IFACE(target);
+
+    if (iface->add_event_listener)
+        return iface->add_event_listener(target, eventName, handler, bubble, userData);
+
+    return FALSE;
+}
+
+gboolean webkit_dom_event_target_remove_event_listener(WebKitDOMEventTarget* target, const char* eventName, GCallback handler, gboolean bubble)
+{
+    g_return_val_if_fail(WEBKIT_DOM_IS_EVENT_TARGET(target), FALSE);
+    g_return_val_if_fail(eventName, FALSE);
+
+    WebKitDOMEventTargetIface* iface = WEBKIT_DOM_EVENT_TARGET_GET_IFACE(target);
+
+    if (iface->remove_event_listener)
+        return iface->remove_event_listener(target, eventName, handler, bubble);
+
+    return FALSE;
+}
+
 namespace WebKit {
 
 WebCore::EventTarget* core(WebKitDOMEventTarget* request)
diff --git a/Source/WebCore/bindings/gobject/WebKitDOMEventTarget.h b/Source/WebCore/bindings/gobject/WebKitDOMEventTarget.h
index 206abc7..4adbda1 100644
--- a/Source/WebCore/bindings/gobject/WebKitDOMEventTarget.h
+++ b/Source/WebCore/bindings/gobject/WebKitDOMEventTarget.h
@@ -37,9 +37,19 @@ struct _WebKitDOMEventTargetIface {
     GTypeInterface gIface;
 
     /* virtual table */
-    void          (* dispatch_event)(WebKitDOMEventTarget* target,
-                                     WebKitDOMEvent*       event,
-                                     GError**              error);
+    void          (* dispatch_event)(WebKitDOMEventTarget *target,
+                                     WebKitDOMEvent       *event,
+                                     GError              **error);
+
+    gboolean      (* add_event_listener)(WebKitDOMEventTarget *target,
+                                         const char          *eventName,
+                                         GCallback             handler,
+                                         gboolean              bubble,
+                                         gpointer              userData);
+    gboolean      (* remove_event_listener)(WebKitDOMEventTarget *target,
+                                            const char           *eventName,
+                                            GCallback             handler,
+                                            gboolean              bubble);
 };
 
 
@@ -49,6 +59,17 @@ WEBKIT_API void      webkit_dom_event_target_dispatch_event(WebKitDOMEventTarget
                                                             WebKitDOMEvent       *event,
                                                             GError              **error);
 
+WEBKIT_API gboolean  webkit_dom_event_target_add_event_listener(WebKitDOMEventTarget *target,
+                                                                const char           *eventName,
+                                                                GCallback             handler,
+                                                                gboolean              bubble,
+                                                                gpointer              userData);
+
+WEBKIT_API gboolean  webkit_dom_event_target_remove_event_listener(WebKitDOMEventTarget *target,
+                                                                   const char           *eventName,
+                                                                   GCallback             handler,
+                                                                   gboolean              bubble);
+
 G_END_DECLS
 
 #endif /* WebKitDOMEventTarget_h */
diff --git a/Source/WebCore/bindings/js/JSAudioConstructor.cpp b/Source/WebCore/bindings/js/JSAudioConstructor.cpp
index f0040fa..9ac797b 100644
--- a/Source/WebCore/bindings/js/JSAudioConstructor.cpp
+++ b/Source/WebCore/bindings/js/JSAudioConstructor.cpp
@@ -40,7 +40,7 @@ namespace WebCore {
 const ClassInfo JSAudioConstructor::s_info = { "AudioConstructor", &DOMConstructorWithDocument::s_info, 0, 0 };
 
 JSAudioConstructor::JSAudioConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
-    : DOMConstructorWithDocument(JSAudioConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+    : DOMConstructorWithDocument(JSAudioConstructor::createStructure(globalObject->globalData(), globalObject->objectPrototype()), globalObject)
 {
     ASSERT(inherits(&s_info));
     putDirect(exec->globalData(), exec->propertyNames().prototype, JSHTMLAudioElementPrototype::self(exec, globalObject), None);
diff --git a/Source/WebCore/bindings/js/JSAudioConstructor.h b/Source/WebCore/bindings/js/JSAudioConstructor.h
index c90abbf..be0b800 100644
--- a/Source/WebCore/bindings/js/JSAudioConstructor.h
+++ b/Source/WebCore/bindings/js/JSAudioConstructor.h
@@ -38,9 +38,9 @@ namespace WebCore {
     public:
         JSAudioConstructor(JSC::ExecState*, JSDOMGlobalObject*);
 
-        static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+        static PassRefPtr<JSC::Structure> createStructure(JSC::JSGlobalData& globalData, JSC::JSValue prototype)
         {
-            return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
+            return JSC::Structure::create(globalData, prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
         }
 
         static const JSC::ClassInfo s_info;
diff --git a/Source/WebCore/bindings/js/JSBindingsAllInOne.cpp b/Source/WebCore/bindings/js/JSBindingsAllInOne.cpp
index b53d950..d5c9135 100644
--- a/Source/WebCore/bindings/js/JSBindingsAllInOne.cpp
+++ b/Source/WebCore/bindings/js/JSBindingsAllInOne.cpp
@@ -103,6 +103,7 @@
 #include "JSImageConstructor.cpp"
 #include "JSImageDataCustom.cpp"
 #include "JSInjectedScriptHostCustom.cpp"
+#include "JSInjectedScriptManager.cpp"
 #include "JSInspectorFrontendHostCustom.cpp"
 #include "JSInt16ArrayCustom.cpp"
 #include "JSInt32ArrayCustom.cpp"
@@ -143,6 +144,8 @@
 #include "JSUint16ArrayCustom.cpp"
 #include "JSUint32ArrayCustom.cpp"
 #include "JSUint8ArrayCustom.cpp"
+#include "JSWebKitAnimationCustom.cpp"
+#include "JSWebKitAnimationListCustom.cpp"
 #include "JSWebKitCSSKeyframeRuleCustom.cpp"
 #include "JSWebKitCSSKeyframesRuleCustom.cpp"
 #include "JSWebKitCSSMatrixCustom.cpp"
@@ -156,6 +159,7 @@
 #include "JSXSLTProcessorCustom.cpp"
 #include "JavaScriptCallFrame.cpp"
 #include "MemoryInfo.cpp"
+#include "PageScriptDebugServer.cpp"
 #include "ScheduledAction.cpp"
 #include "ScriptCachedFrameData.cpp"
 #include "ScriptCallStackFactory.cpp"
@@ -169,4 +173,5 @@
 #include "ScriptState.cpp"
 #include "SerializedScriptValue.cpp"
 #include "WorkerScriptController.cpp"
+#include "WorkerScriptDebugServer.cpp"
 
diff --git a/Source/WebCore/bindings/js/JSDOMBinding.cpp b/Source/WebCore/bindings/js/JSDOMBinding.cpp
index 4d18a4e..8501eb9 100644
--- a/Source/WebCore/bindings/js/JSDOMBinding.cpp
+++ b/Source/WebCore/bindings/js/JSDOMBinding.cpp
@@ -483,7 +483,7 @@ JSValue jsDateOrNull(ExecState* exec, double value)
 {
     if (!isfinite(value))
         return jsNull();
-    return new (exec) DateInstance(exec, value);
+    return new (exec) DateInstance(exec, exec->lexicalGlobalObject()->dateStructure(), value);
 }
 
 double valueToDate(ExecState* exec, JSValue value)
diff --git a/Source/WebCore/bindings/js/JSDOMBinding.h b/Source/WebCore/bindings/js/JSDOMBinding.h
index 4fe3d16..934d9b3 100644
--- a/Source/WebCore/bindings/js/JSDOMBinding.h
+++ b/Source/WebCore/bindings/js/JSDOMBinding.h
@@ -64,9 +64,9 @@ namespace WebCore {
             return globalObject()->scriptExecutionContext();
         }
 
-        static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+        static PassRefPtr<JSC::Structure> createStructure(JSC::JSGlobalData& globalData, JSC::JSValue prototype)
         {
-            return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
+            return JSC::Structure::create(globalData, prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
         }
 
     protected:
@@ -83,9 +83,9 @@ namespace WebCore {
     // Base class for all constructor objects in the JSC bindings.
     class DOMConstructorObject : public DOMObjectWithGlobalPointer {
     public:
-        static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+        static PassRefPtr<JSC::Structure> createStructure(JSC::JSGlobalData& globalData, JSC::JSValue prototype)
         {
-            return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
+            return JSC::Structure::create(globalData, prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
         }
 
     protected:
@@ -143,7 +143,7 @@ namespace WebCore {
     {
         if (JSC::Structure* structure = getCachedDOMStructure(globalObject, &WrapperClass::s_info))
             return structure;
-        return cacheDOMStructure(globalObject, WrapperClass::createStructure(WrapperClass::createPrototype(exec, globalObject)), &WrapperClass::s_info);
+        return cacheDOMStructure(globalObject, WrapperClass::createStructure(exec->globalData(), WrapperClass::createPrototype(exec, globalObject)), &WrapperClass::s_info);
     }
     template<class WrapperClass> inline JSC::Structure* deprecatedGetDOMStructure(JSC::ExecState* exec)
     {
diff --git a/Source/WebCore/bindings/js/JSDOMGlobalObject.cpp b/Source/WebCore/bindings/js/JSDOMGlobalObject.cpp
index efd0ae0..8183b6e 100644
--- a/Source/WebCore/bindings/js/JSDOMGlobalObject.cpp
+++ b/Source/WebCore/bindings/js/JSDOMGlobalObject.cpp
@@ -42,8 +42,10 @@ namespace WebCore {
 
 const ClassInfo JSDOMGlobalObject::s_info = { "DOMGlobalObject", &JSGlobalObject::s_info, 0, 0 };
 
-JSDOMGlobalObject::JSDOMGlobalObject(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject::JSDOMGlobalObjectData* data, JSObject* thisValue)
-    : JSGlobalObject(structure, data, thisValue)
+JSDOMGlobalObject::JSDOMGlobalObject(NonNullPassRefPtr<Structure> structure, PassRefPtr<DOMWrapperWorld> world, JSObject* thisValue)
+    : JSGlobalObject(structure, thisValue)
+    , m_currentEvent(0)
+    , m_world(world)
 {
     ASSERT(inherits(&s_info));
 }
@@ -60,33 +62,28 @@ void JSDOMGlobalObject::markChildren(MarkStack& markStack)
     for (JSDOMConstructorMap::iterator it2 = constructors().begin(); it2 != end2; ++it2)
         markStack.append(&it2->second);
 
-    if (d()->m_injectedScript)
-        markStack.append(&d()->m_injectedScript);
+    if (m_injectedScript)
+        markStack.append(&m_injectedScript);
 }
 
-void JSDOMGlobalObject::setCurrentEvent(Event* evt)
+void JSDOMGlobalObject::setCurrentEvent(Event* currentEvent)
 {
-    d()->evt = evt;
+    m_currentEvent = currentEvent;
 }
 
 Event* JSDOMGlobalObject::currentEvent() const
 {
-    return d()->evt;
+    return m_currentEvent;
 }
 
 void JSDOMGlobalObject::setInjectedScript(JSObject* injectedScript)
 {
-    d()->m_injectedScript.set(globalData(), this, injectedScript);
+    m_injectedScript.set(globalData(), this, injectedScript);
 }
 
 JSObject* JSDOMGlobalObject::injectedScript() const
 {
-    return d()->m_injectedScript.get();
-}
-
-void JSDOMGlobalObject::destroyJSDOMGlobalObjectData(void* jsDOMGlobalObjectData)
-{
-    delete static_cast<JSDOMGlobalObjectData*>(jsDOMGlobalObjectData);
+    return m_injectedScript.get();
 }
 
 JSDOMGlobalObject* toJSDOMGlobalObject(Document* document, JSC::ExecState* exec)
diff --git a/Source/WebCore/bindings/js/JSDOMGlobalObject.h b/Source/WebCore/bindings/js/JSDOMGlobalObject.h
index ac07969..1e992c5 100644
--- a/Source/WebCore/bindings/js/JSDOMGlobalObject.h
+++ b/Source/WebCore/bindings/js/JSDOMGlobalObject.h
@@ -46,11 +46,11 @@ namespace WebCore {
     protected:
         struct JSDOMGlobalObjectData;
 
-        JSDOMGlobalObject(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObjectData*, JSC::JSObject* thisValue);
+        JSDOMGlobalObject(NonNullPassRefPtr<JSC::Structure>, PassRefPtr<DOMWrapperWorld>, JSC::JSObject* thisValue);
 
     public:
-        JSDOMStructureMap& structures() { return d()->structures; }
-        JSDOMConstructorMap& constructors() const { return d()->constructors; }
+        JSDOMStructureMap& structures() { return m_structures; }
+        JSDOMConstructorMap& constructors() { return m_constructors; }
 
         virtual ScriptExecutionContext* scriptExecutionContext() const = 0;
 
@@ -65,47 +65,33 @@ namespace WebCore {
 
         virtual void markChildren(JSC::MarkStack&);
 
-        DOMWrapperWorld* world() { return d()->m_world.get(); }
+        DOMWrapperWorld* world() { return m_world.get(); }
 
         static const JSC::ClassInfo s_info;
 
-        static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+        static PassRefPtr<JSC::Structure> createStructure(JSC::JSGlobalData& globalData, JSC::JSValue prototype)
         {
-            return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
+            return JSC::Structure::create(globalData, prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
         }
 
     protected:
-        struct JSDOMGlobalObjectData : public JSC::JSGlobalObject::JSGlobalObjectData {
-            JSDOMGlobalObjectData(DOMWrapperWorld* world, Destructor destructor = destroyJSDOMGlobalObjectData)
-                : JSGlobalObjectData(destructor)
-                , evt(0)
-                , m_world(world)
-            {
-            }
-
-            JSDOMStructureMap structures;
-            JSDOMConstructorMap constructors;
-
-            Event* evt;
-            RefPtr<DOMWrapperWorld> m_world;
-            JSC::WriteBarrier<JSObject> m_injectedScript;
-        };
-
-    private:
-        static void destroyJSDOMGlobalObjectData(void*);
-
-        JSDOMGlobalObjectData* d() const { return static_cast<JSDOMGlobalObjectData*>(JSC::JSVariableObject::d); }
+        JSDOMStructureMap m_structures;
+        JSDOMConstructorMap m_constructors;
+
+        Event* m_currentEvent;
+        RefPtr<DOMWrapperWorld> m_world;
+        JSC::WriteBarrier<JSObject> m_injectedScript;
     };
 
     template<class ConstructorClass>
     inline JSC::JSObject* getDOMConstructor(JSC::ExecState* exec, const JSDOMGlobalObject* globalObject)
     {
-        if (JSC::JSObject* constructor = globalObject->constructors().get(&ConstructorClass::s_info).get())
+        if (JSC::JSObject* constructor = const_cast<JSDOMGlobalObject*>(globalObject)->constructors().get(&ConstructorClass::s_info).get())
             return constructor;
         JSC::JSObject* constructor = new (exec) ConstructorClass(exec, const_cast<JSDOMGlobalObject*>(globalObject));
-        ASSERT(!globalObject->constructors().contains(&ConstructorClass::s_info));
+        ASSERT(!const_cast<JSDOMGlobalObject*>(globalObject)->constructors().contains(&ConstructorClass::s_info));
         JSC::WriteBarrier<JSC::JSObject> temp;
-        globalObject->constructors().add(&ConstructorClass::s_info, temp).first->second.set(exec->globalData(), globalObject, constructor);
+        const_cast<JSDOMGlobalObject*>(globalObject)->constructors().add(&ConstructorClass::s_info, temp).first->second.set(exec->globalData(), globalObject, constructor);
         return constructor;
     }
 
diff --git a/Source/WebCore/bindings/js/JSDOMWindowBase.cpp b/Source/WebCore/bindings/js/JSDOMWindowBase.cpp
index df01f77..584f610 100644
--- a/Source/WebCore/bindings/js/JSDOMWindowBase.cpp
+++ b/Source/WebCore/bindings/js/JSDOMWindowBase.cpp
@@ -45,21 +45,16 @@ namespace WebCore {
 
 const ClassInfo JSDOMWindowBase::s_info = { "Window", &JSDOMGlobalObject::s_info, 0, 0 };
 
-JSDOMWindowBase::JSDOMWindowBaseData::JSDOMWindowBaseData(PassRefPtr<DOMWindow> window, JSDOMWindowShell* shell)
-    : JSDOMGlobalObjectData(shell->world(), destroyJSDOMWindowBaseData)
-    , impl(window)
-    , shell(shell)
-{
-}
-
 JSDOMWindowBase::JSDOMWindowBase(NonNullPassRefPtr<Structure> structure, PassRefPtr<DOMWindow> window, JSDOMWindowShell* shell)
-    : JSDOMGlobalObject(structure, new JSDOMWindowBaseData(window, shell), shell)
+    : JSDOMGlobalObject(structure, shell->world(), shell)
+    , m_impl(window)
+    , m_shell(shell)
 {
     ASSERT(inherits(&s_info));
 
     GlobalPropertyInfo staticGlobals[] = {
         GlobalPropertyInfo(Identifier(globalExec(), "document"), jsNull(), DontDelete | ReadOnly),
-        GlobalPropertyInfo(Identifier(globalExec(), "window"), d()->shell, DontDelete | ReadOnly)
+        GlobalPropertyInfo(Identifier(globalExec(), "window"), m_shell, DontDelete | ReadOnly)
     };
     
     addStaticGlobals(staticGlobals, WTF_ARRAY_LENGTH(staticGlobals));
@@ -67,19 +62,19 @@ JSDOMWindowBase::JSDOMWindowBase(NonNullPassRefPtr<Structure> structure, PassRef
 
 void JSDOMWindowBase::updateDocument()
 {
-    ASSERT(d()->impl->document());
+    ASSERT(m_impl->document());
     ExecState* exec = globalExec();
-    symbolTablePutWithAttributes(exec->globalData(), Identifier(exec, "document"), toJS(exec, this, d()->impl->document()), DontDelete | ReadOnly);
+    symbolTablePutWithAttributes(exec->globalData(), Identifier(exec, "document"), toJS(exec, this, m_impl->document()), DontDelete | ReadOnly);
 }
 
 ScriptExecutionContext* JSDOMWindowBase::scriptExecutionContext() const
 {
-    return d()->impl->document();
+    return m_impl->document();
 }
 
 String JSDOMWindowBase::crossDomainAccessErrorMessage(const JSGlobalObject* other) const
 {
-    return d()->shell->window()->impl()->crossDomainAccessErrorMessage(asJSDOMWindow(other)->impl());
+    return m_shell->window()->impl()->crossDomainAccessErrorMessage(asJSDOMWindow(other)->impl());
 }
 
 void JSDOMWindowBase::printErrorMessage(const String& message) const
@@ -170,7 +165,7 @@ JSValue JSDOMWindowBase::toStrictThisObject(ExecState*) const
 
 JSDOMWindowShell* JSDOMWindowBase::shell() const
 {
-    return d()->shell;
+    return m_shell;
 }
 
 JSGlobalData* JSDOMWindowBase::commonJSGlobalData()
@@ -190,11 +185,6 @@ JSGlobalData* JSDOMWindowBase::commonJSGlobalData()
     return globalData;
 }
 
-void JSDOMWindowBase::destroyJSDOMWindowBaseData(void* jsDOMWindowBaseData)
-{
-    delete static_cast<JSDOMWindowBaseData*>(jsDOMWindowBaseData);
-}
-
 // JSDOMGlobalObject* is ignored, accessing a window in any context will
 // use that DOMWindow's prototype chain.
 JSValue toJS(ExecState* exec, JSDOMGlobalObject*, DOMWindow* domWindow)
diff --git a/Source/WebCore/bindings/js/JSDOMWindowBase.h b/Source/WebCore/bindings/js/JSDOMWindowBase.h
index 91b4f42..bfec31c 100644
--- a/Source/WebCore/bindings/js/JSDOMWindowBase.h
+++ b/Source/WebCore/bindings/js/JSDOMWindowBase.h
@@ -49,7 +49,7 @@ namespace WebCore {
     public:
         void updateDocument();
 
-        DOMWindow* impl() const { return d()->impl.get(); }
+        DOMWindow* impl() const { return m_impl.get(); }
         virtual ScriptExecutionContext* scriptExecutionContext() const;
 
         // Called just before removing this window from the JSDOMWindowShell.
@@ -57,9 +57,9 @@ namespace WebCore {
 
         static const JSC::ClassInfo s_info;
 
-        static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+        static PassRefPtr<JSC::Structure> createStructure(JSC::JSGlobalData& globalData, JSC::JSValue prototype)
         {
-            return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
+            return JSC::Structure::create(globalData, prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
         }
 
         virtual JSC::ExecState* globalExec();
@@ -82,19 +82,11 @@ namespace WebCore {
         static JSC::JSGlobalData* commonJSGlobalData();
 
     private:
-        struct JSDOMWindowBaseData : public JSDOMGlobalObjectData {
-            JSDOMWindowBaseData(PassRefPtr<DOMWindow> window, JSDOMWindowShell* shell);
-
-            RefPtr<DOMWindow> impl;
-            JSDOMWindowShell* shell;
-        };
+        RefPtr<DOMWindow> m_impl;
+        JSDOMWindowShell* m_shell;
 
         bool allowsAccessFromPrivate(const JSC::JSGlobalObject*) const;
         String crossDomainAccessErrorMessage(const JSC::JSGlobalObject*) const;
-        
-        static void destroyJSDOMWindowBaseData(void*);
-
-        JSDOMWindowBaseData* d() const { return static_cast<JSDOMWindowBaseData*>(JSC::JSVariableObject::d); }
     };
 
     // Returns a JSDOMWindow or jsNull()
diff --git a/Source/WebCore/bindings/js/JSDOMWindowCustom.h b/Source/WebCore/bindings/js/JSDOMWindowCustom.h
index a0e1b8f..a8d5a91 100644
--- a/Source/WebCore/bindings/js/JSDOMWindowCustom.h
+++ b/Source/WebCore/bindings/js/JSDOMWindowCustom.h
@@ -67,7 +67,7 @@ inline bool JSDOMWindowBase::allowsAccessFrom(JSC::ExecState* exec, String& mess
 ALWAYS_INLINE bool JSDOMWindowBase::allowsAccessFromPrivate(const JSGlobalObject* other) const
 {
     const JSDOMWindow* originWindow = asJSDOMWindow(other);
-    const JSDOMWindow* targetWindow = d()->shell->window();
+    const JSDOMWindow* targetWindow = m_shell->window();
 
     if (originWindow == targetWindow)
         return true;
diff --git a/Source/WebCore/bindings/js/JSDOMWindowShell.cpp b/Source/WebCore/bindings/js/JSDOMWindowShell.cpp
index a4cc777..817e9c0 100644
--- a/Source/WebCore/bindings/js/JSDOMWindowShell.cpp
+++ b/Source/WebCore/bindings/js/JSDOMWindowShell.cpp
@@ -44,7 +44,7 @@ ASSERT_CLASS_FITS_IN_CELL(JSDOMWindowShell);
 const ClassInfo JSDOMWindowShell::s_info = { "JSDOMWindowShell", &Base::s_info, 0, 0 };
 
 JSDOMWindowShell::JSDOMWindowShell(PassRefPtr<DOMWindow> window, DOMWrapperWorld* world)
-    : Base(JSDOMWindowShell::createStructure(jsNull()))
+    : Base(JSDOMWindowShell::createStructure(*world->globalData(), jsNull()))
     , m_world(world)
 {
     ASSERT(inherits(&s_info));
@@ -60,10 +60,10 @@ void JSDOMWindowShell::setWindow(PassRefPtr<DOMWindow> domWindow)
     // Explicitly protect the global object's prototype so it isn't collected
     // when we allocate the global object. (Once the global object is fully
     // constructed, it can mark its own prototype.)
-    RefPtr<Structure> prototypeStructure = JSDOMWindowPrototype::createStructure(jsNull());
+    RefPtr<Structure> prototypeStructure = JSDOMWindowPrototype::createStructure(*JSDOMWindow::commonJSGlobalData(), jsNull());
     Global<JSDOMWindowPrototype> prototype(*JSDOMWindow::commonJSGlobalData(), new JSDOMWindowPrototype(0, prototypeStructure.release()));
 
-    RefPtr<Structure> structure = JSDOMWindow::createStructure(prototype.get());
+    RefPtr<Structure> structure = JSDOMWindow::createStructure(*JSDOMWindow::commonJSGlobalData(), prototype.get());
     JSDOMWindow* jsDOMWindow = new (JSDOMWindow::commonJSGlobalData()) JSDOMWindow(structure.release(), domWindow, this);
     prototype->putAnonymousValue(*JSDOMWindow::commonJSGlobalData(), 0, jsDOMWindow);
     setWindow(*JSDOMWindow::commonJSGlobalData(), jsDOMWindow);
diff --git a/Source/WebCore/bindings/js/JSDOMWindowShell.h b/Source/WebCore/bindings/js/JSDOMWindowShell.h
index 06dd1ff..4307c1c 100644
--- a/Source/WebCore/bindings/js/JSDOMWindowShell.h
+++ b/Source/WebCore/bindings/js/JSDOMWindowShell.h
@@ -58,9 +58,9 @@ namespace WebCore {
 
         void* operator new(size_t);
 
-        static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype) 
+        static PassRefPtr<JSC::Structure> createStructure(JSC::JSGlobalData& globalData, JSC::JSValue prototype) 
         {
-            return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount, &s_info); 
+            return JSC::Structure::create(globalData, prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount, &s_info); 
         }
 
         DOMWrapperWorld* world() { return m_world.get(); }
diff --git a/Source/WebCore/bindings/js/JSDOMWrapper.cpp b/Source/WebCore/bindings/js/JSDOMWrapper.cpp
index 794f039..c91230b 100644
--- a/Source/WebCore/bindings/js/JSDOMWrapper.cpp
+++ b/Source/WebCore/bindings/js/JSDOMWrapper.cpp
@@ -40,10 +40,4 @@ DOMObject::~DOMObject()
 
 #endif
 
-bool DOMObject::defineOwnProperty(ExecState* exec, const Identifier&, PropertyDescriptor&, bool)
-{
-    throwError(exec, createTypeError(exec, "defineProperty is not supported on DOM Objects"));
-    return false;
-}
-
 } // namespace WebCore
diff --git a/Source/WebCore/bindings/js/JSDOMWrapper.h b/Source/WebCore/bindings/js/JSDOMWrapper.h
index 2d09f01..0f8031c 100644
--- a/Source/WebCore/bindings/js/JSDOMWrapper.h
+++ b/Source/WebCore/bindings/js/JSDOMWrapper.h
@@ -34,8 +34,6 @@ protected:
     {
     }
 
-    virtual bool defineOwnProperty(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&, bool);
-
 #ifndef NDEBUG
     virtual ~DOMObject();
 #endif
diff --git a/Source/WebCore/bindings/js/JSErrorHandler.cpp b/Source/WebCore/bindings/js/JSErrorHandler.cpp
index ae8e363..3d916e6 100644
--- a/Source/WebCore/bindings/js/JSErrorHandler.cpp
+++ b/Source/WebCore/bindings/js/JSErrorHandler.cpp
@@ -88,7 +88,7 @@ void JSErrorHandler::handleEvent(ScriptExecutionContext* scriptExecutionContext,
         args.append(jsNumber(errorEvent->lineno()));
 
         JSGlobalData& globalData = globalObject->globalData();
-        DynamicGlobalObjectScope globalObjectScope(exec, globalData.dynamicGlobalObject ? globalData.dynamicGlobalObject : globalObject);
+        DynamicGlobalObjectScope globalObjectScope(globalData, globalData.dynamicGlobalObject ? globalData.dynamicGlobalObject : globalObject);
 
         JSValue thisValue = globalObject->toThisObject(exec);
 
diff --git a/Source/WebCore/bindings/js/JSEventListener.cpp b/Source/WebCore/bindings/js/JSEventListener.cpp
index 90a164b..e444d88 100644
--- a/Source/WebCore/bindings/js/JSEventListener.cpp
+++ b/Source/WebCore/bindings/js/JSEventListener.cpp
@@ -108,7 +108,7 @@ void JSEventListener::handleEvent(ScriptExecutionContext* scriptExecutionContext
         globalObject->setCurrentEvent(event);
 
         JSGlobalData& globalData = globalObject->globalData();
-        DynamicGlobalObjectScope globalObjectScope(exec, globalData.dynamicGlobalObject ? globalData.dynamicGlobalObject : globalObject);
+        DynamicGlobalObjectScope globalObjectScope(globalData, globalData.dynamicGlobalObject ? globalData.dynamicGlobalObject : globalObject);
 
         globalData.timeoutChecker.start();
         JSValue retval;
diff --git a/Source/WebCore/bindings/js/JSHTMLCanvasElementCustom.cpp b/Source/WebCore/bindings/js/JSHTMLCanvasElementCustom.cpp
index 84dd72e..72aec4b 100644
--- a/Source/WebCore/bindings/js/JSHTMLCanvasElementCustom.cpp
+++ b/Source/WebCore/bindings/js/JSHTMLCanvasElementCustom.cpp
@@ -76,6 +76,9 @@ JSValue JSHTMLCanvasElement::getContext(ExecState* exec)
             Identifier premultipliedAlpha(exec, "premultipliedAlpha");
             if (jsAttrs->hasProperty(exec, premultipliedAlpha))
                 webGLAttrs->setPremultipliedAlpha(jsAttrs->get(exec, premultipliedAlpha).toBoolean(exec));
+            Identifier preserveDrawingBuffer(exec, "preserveDrawingBuffer");
+            if (jsAttrs->hasProperty(exec, preserveDrawingBuffer))
+                webGLAttrs->setPreserveDrawingBuffer(jsAttrs->get(exec, preserveDrawingBuffer).toBoolean(exec));
         }
     }
 #endif
diff --git a/Source/WebCore/bindings/js/JSImageConstructor.cpp b/Source/WebCore/bindings/js/JSImageConstructor.cpp
index 1ddf136..be75af0 100644
--- a/Source/WebCore/bindings/js/JSImageConstructor.cpp
+++ b/Source/WebCore/bindings/js/JSImageConstructor.cpp
@@ -35,7 +35,7 @@ ASSERT_CLASS_FITS_IN_CELL(JSImageConstructor);
 const ClassInfo JSImageConstructor::s_info = { "ImageConstructor", &DOMConstructorWithDocument::s_info, 0, 0 };
 
 JSImageConstructor::JSImageConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
-    : DOMConstructorWithDocument(JSImageConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+    : DOMConstructorWithDocument(JSImageConstructor::createStructure(globalObject->globalData(), globalObject->objectPrototype()), globalObject)
 {
     ASSERT(inherits(&s_info));
     putDirect(exec->globalData(), exec->propertyNames().prototype, JSHTMLImageElementPrototype::self(exec, globalObject), None);
diff --git a/Source/WebCore/bindings/js/JSImageConstructor.h b/Source/WebCore/bindings/js/JSImageConstructor.h
index 73293c7..654e223 100644
--- a/Source/WebCore/bindings/js/JSImageConstructor.h
+++ b/Source/WebCore/bindings/js/JSImageConstructor.h
@@ -29,9 +29,9 @@ namespace WebCore {
     public:
         JSImageConstructor(JSC::ExecState*, JSDOMGlobalObject*);
 
-        static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+        static PassRefPtr<JSC::Structure> createStructure(JSC::JSGlobalData& globalData, JSC::JSValue prototype)
         {
-            return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
+            return JSC::Structure::create(globalData, prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
         }
 
         static const JSC::ClassInfo s_info;
diff --git a/Source/WebCore/bindings/js/JSImageDataCustom.cpp b/Source/WebCore/bindings/js/JSImageDataCustom.cpp
index b5592d8..a92ed47 100644
--- a/Source/WebCore/bindings/js/JSImageDataCustom.cpp
+++ b/Source/WebCore/bindings/js/JSImageDataCustom.cpp
@@ -48,7 +48,7 @@ JSValue toJS(ExecState* exec, JSDOMGlobalObject* globalObject, ImageData* imageD
     wrapper = CREATE_DOM_OBJECT_WRAPPER(exec, globalObject, ImageData, imageData);
     Identifier dataName(exec, "data");
     static const ClassInfo cpaClassInfo = { "CanvasPixelArray", &JSByteArray::Base::s_info, 0, 0 };
-    DEFINE_STATIC_LOCAL(RefPtr<Structure>, cpaStructure, (JSByteArray::createStructure(jsNull(), &cpaClassInfo)));
+    DEFINE_STATIC_LOCAL(RefPtr<Structure>, cpaStructure, (JSByteArray::createStructure(exec->globalData(), jsNull(), &cpaClassInfo)));
     wrapper->putDirect(exec->globalData(), dataName, new (exec) JSByteArray(exec, cpaStructure, imageData->data()->data()), DontDelete | ReadOnly);
     exec->heap()->reportExtraMemoryCost(imageData->data()->length());
     
diff --git a/Source/WebCore/bindings/js/JSInjectedScriptHostCustom.cpp b/Source/WebCore/bindings/js/JSInjectedScriptHostCustom.cpp
index bc1d877..d56251f 100644
--- a/Source/WebCore/bindings/js/JSInjectedScriptHostCustom.cpp
+++ b/Source/WebCore/bindings/js/JSInjectedScriptHostCustom.cpp
@@ -1,7 +1,7 @@
 /*
  * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
  * Copyright (C) 2008 Matt Lilek <webkit@mattlilek.com>
- * Copyright (C) 2010 Google Inc. All rights reserved.
+ * Copyright (C) 2010-2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -35,37 +35,21 @@
 
 #if ENABLE(INSPECTOR)
 
-#include "Console.h"
-#include "JSMainThreadExecState.h"
 #if ENABLE(DATABASE)
 #include "Database.h"
 #include "JSDatabase.h"
 #endif
 #include "ExceptionCode.h"
-#include "Frame.h"
-#include "FrameLoader.h"
-#include "InjectedScript.h"
 #include "InjectedScriptHost.h"
-#include "InspectorAgent.h"
+#include "InspectorDebuggerAgent.h"
 #include "InspectorValues.h"
-#include "JSDOMWindow.h"
-#include "JSDOMWindowCustom.h"
 #include "JSNode.h"
-#include "JSRange.h"
-#include "Node.h"
-#include "Page.h"
 #include "ScriptValue.h"
 #if ENABLE(DOM_STORAGE)
 #include "Storage.h"
 #include "JSStorage.h"
 #endif
-#include "TextIterator.h"
-#include "VisiblePosition.h"
-#include <parser/SourceCode.h>
-#include <runtime/JSArray.h>
 #include <runtime/JSLock.h>
-#include <wtf/RefPtr.h>
-#include <wtf/Vector.h>
 
 #if ENABLE(JAVASCRIPT_DEBUGGER)
 #include "JavaScriptCallFrame.h"
@@ -89,41 +73,10 @@ ScriptValue InjectedScriptHost::nodeAsScriptValue(ScriptState* state, Node* node
     return ScriptValue(state->globalData(), toJS(state, node));
 }
 
-ScriptObject InjectedScriptHost::createInjectedScript(const String& source, ScriptState* scriptState, long id)
-{
-    SourceCode sourceCode = makeSource(stringToUString(source));
-    JSLock lock(SilenceAssertionsOnly);
-    JSDOMGlobalObject* globalObject = static_cast<JSDOMGlobalObject*>(scriptState->lexicalGlobalObject());
-    JSValue globalThisValue = scriptState->globalThisValue();
-    Completion comp = JSMainThreadExecState::evaluate(scriptState, globalObject->globalScopeChain(), sourceCode, globalThisValue);
-    if (comp.complType() != JSC::Normal && comp.complType() != JSC::ReturnValue)
-        return ScriptObject();
-    JSValue functionValue = comp.value();
-    CallData callData;
-    CallType callType = getCallData(functionValue, callData);
-    if (callType == CallTypeNone)
-        return ScriptObject();
-
-    MarkedArgumentBuffer args;
-    args.append(toJS(scriptState, globalObject, this));
-    args.append(globalThisValue);
-    args.append(jsNumber(id));
-    JSValue result = JSC::call(scriptState, functionValue, callType, callData, globalThisValue, args);
-    if (result.isObject())
-        return ScriptObject(scriptState, result.getObject());
-    return ScriptObject();
-}
-
-void InjectedScriptHost::discardInjectedScript(ScriptState* scriptState)
-{
-    JSDOMGlobalObject* globalObject = static_cast<JSDOMGlobalObject*>(scriptState->lexicalGlobalObject());
-    globalObject->setInjectedScript(0);
-}
-
 JSValue JSInjectedScriptHost::currentCallFrame(ExecState* exec)
 {
 #if ENABLE(JAVASCRIPT_DEBUGGER)
-    JavaScriptCallFrame* callFrame = ScriptDebugServer::shared().currentCallFrame();
+    JavaScriptCallFrame* callFrame = impl()->debuggerAgent()->scriptDebugServer().currentCallFrame();
     if (!callFrame || !callFrame->isValid())
         return jsUndefined();
 
@@ -160,9 +113,9 @@ JSValue JSInjectedScriptHost::internalConstructorName(ExecState* exec)
 JSValue JSInjectedScriptHost::inspect(ExecState* exec)
 {
     if (exec->argumentCount() >= 2) {
-        ScriptValue objectId(exec->globalData(), exec->argument(0));
+        ScriptValue object(exec->globalData(), exec->argument(0));
         ScriptValue hints(exec->globalData(), exec->argument(1));
-        impl()->inspectImpl(objectId.toInspectorValue(exec), hints.toInspectorValue(exec));
+        impl()->inspectImpl(object.toInspectorValue(exec), hints.toInspectorValue(exec));
     }
     return jsUndefined();
 }
@@ -191,33 +144,6 @@ JSValue JSInjectedScriptHost::storageId(ExecState* exec)
     return jsUndefined();
 }
 
-InjectedScript InjectedScriptHost::injectedScriptFor(ScriptState* scriptState)
-{
-    JSLock lock(SilenceAssertionsOnly);
-    JSDOMGlobalObject* globalObject = static_cast<JSDOMGlobalObject*>(scriptState->lexicalGlobalObject());
-    JSObject* injectedScript = globalObject->injectedScript();
-    if (injectedScript)
-        return InjectedScript(ScriptObject(scriptState, injectedScript));
-
-    if (!canAccessInspectedWindow(scriptState))
-        return InjectedScript();
-
-    pair<long, ScriptObject> injectedScriptObject = injectScript(injectedScriptSource(), scriptState);
-    globalObject->setInjectedScript(injectedScriptObject.second.jsObject());
-    InjectedScript result(injectedScriptObject.second);
-    m_idToInjectedScript.set(injectedScriptObject.first, result);
-    return result;
-}
-
-bool InjectedScriptHost::canAccessInspectedWindow(ScriptState* scriptState)
-{
-    JSLock lock(SilenceAssertionsOnly);
-    JSDOMWindow* inspectedWindow = toJSDOMWindow(scriptState->lexicalGlobalObject());
-    if (!inspectedWindow)
-        return false;
-    return inspectedWindow->allowsAccessFromNoErrorMessage(scriptState);
-}
-
 } // namespace WebCore
 
 #endif // ENABLE(INSPECTOR)
diff --git a/Source/WebCore/bindings/js/JSInjectedScriptManager.cpp b/Source/WebCore/bindings/js/JSInjectedScriptManager.cpp
new file mode 100644
index 0000000..1843cd2
--- /dev/null
+++ b/Source/WebCore/bindings/js/JSInjectedScriptManager.cpp
@@ -0,0 +1,111 @@
+/*
+ * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2008 Matt Lilek <webkit@mattlilek.com>
+ * Copyright (C) 2010-2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "InjectedScriptManager.h"
+
+#if ENABLE(INSPECTOR)
+
+#include "ExceptionCode.h"
+#include "InjectedScript.h"
+#include "JSDOMWindow.h"
+#include "JSDOMWindowCustom.h"
+#include "JSInjectedScriptHost.h"
+#include "JSMainThreadExecState.h"
+#include <parser/SourceCode.h>
+#include <runtime/JSLock.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+ScriptObject InjectedScriptManager::createInjectedScript(const String& source, ScriptState* scriptState, long id)
+{
+    SourceCode sourceCode = makeSource(stringToUString(source));
+    JSLock lock(SilenceAssertionsOnly);
+    JSDOMGlobalObject* globalObject = static_cast<JSDOMGlobalObject*>(scriptState->lexicalGlobalObject());
+    JSValue globalThisValue = scriptState->globalThisValue();
+    Completion comp = JSMainThreadExecState::evaluate(scriptState, globalObject->globalScopeChain(), sourceCode, globalThisValue);
+    if (comp.complType() != JSC::Normal && comp.complType() != JSC::ReturnValue)
+        return ScriptObject();
+    JSValue functionValue = comp.value();
+    CallData callData;
+    CallType callType = getCallData(functionValue, callData);
+    if (callType == CallTypeNone)
+        return ScriptObject();
+
+    MarkedArgumentBuffer args;
+    args.append(toJS(scriptState, globalObject, m_injectedScriptHost.get()));
+    args.append(globalThisValue);
+    args.append(jsNumber(id));
+    JSValue result = JSC::call(scriptState, functionValue, callType, callData, globalThisValue, args);
+    if (result.isObject())
+        return ScriptObject(scriptState, result.getObject());
+    return ScriptObject();
+}
+
+void InjectedScriptManager::discardInjectedScript(ScriptState* scriptState)
+{
+    JSDOMGlobalObject* globalObject = static_cast<JSDOMGlobalObject*>(scriptState->lexicalGlobalObject());
+    globalObject->setInjectedScript(0);
+}
+
+InjectedScript InjectedScriptManager::injectedScriptFor(ScriptState* scriptState)
+{
+    JSLock lock(SilenceAssertionsOnly);
+    JSDOMGlobalObject* globalObject = static_cast<JSDOMGlobalObject*>(scriptState->lexicalGlobalObject());
+    JSObject* injectedScript = globalObject->injectedScript();
+    if (injectedScript)
+        return InjectedScript(ScriptObject(scriptState, injectedScript));
+
+    if (!canAccessInspectedWindow(scriptState))
+        return InjectedScript();
+
+    pair<long, ScriptObject> injectedScriptObject = injectScript(injectedScriptSource(), scriptState);
+    globalObject->setInjectedScript(injectedScriptObject.second.jsObject());
+    InjectedScript result(injectedScriptObject.second);
+    m_idToInjectedScript.set(injectedScriptObject.first, result);
+    return result;
+}
+
+bool InjectedScriptManager::canAccessInspectedWindow(ScriptState* scriptState)
+{
+    JSLock lock(SilenceAssertionsOnly);
+    JSDOMWindow* inspectedWindow = toJSDOMWindow(scriptState->lexicalGlobalObject());
+    if (!inspectedWindow)
+        return false;
+    return inspectedWindow->allowsAccessFromNoErrorMessage(scriptState);
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(INSPECTOR)
diff --git a/Source/WebCore/bindings/js/JSJavaScriptCallFrameCustom.cpp b/Source/WebCore/bindings/js/JSJavaScriptCallFrameCustom.cpp
index e493508..e477a50 100644
--- a/Source/WebCore/bindings/js/JSJavaScriptCallFrameCustom.cpp
+++ b/Source/WebCore/bindings/js/JSJavaScriptCallFrameCustom.cpp
@@ -49,7 +49,7 @@ JSValue JSJavaScriptCallFrame::evaluate(ExecState* exec)
 
 JSValue JSJavaScriptCallFrame::thisObject(ExecState*) const
 {
-    return impl()->thisObject() ? impl()->thisObject() : jsNull();
+    return impl()->thisObject() ? JSValue(impl()->thisObject()) : jsNull();
 }
 
 JSValue JSJavaScriptCallFrame::type(ExecState* exec) const
diff --git a/Source/WebCore/bindings/js/JSLazyEventListener.cpp b/Source/WebCore/bindings/js/JSLazyEventListener.cpp
index 98db97a..5b17727 100644
--- a/Source/WebCore/bindings/js/JSLazyEventListener.cpp
+++ b/Source/WebCore/bindings/js/JSLazyEventListener.cpp
@@ -20,6 +20,7 @@
 #include "config.h"
 #include "JSLazyEventListener.h"
 
+#include "ContentSecurityPolicy.h"
 #include "Frame.h"
 #include "JSNode.h"
 #include <runtime/FunctionConstructor.h>
@@ -74,36 +75,29 @@ JSObject* JSLazyEventListener::initializeJSFunction(ScriptExecutionContext* exec
     if (!executionContext)
         return 0;
 
-    Frame* frame = static_cast<Document*>(executionContext)->frame();
-    if (!frame)
+    Document* document = static_cast<Document*>(executionContext);
+
+    if (!document->frame())
+        return 0;
+
+    if (!document->contentSecurityPolicy()->allowInlineEventHandlers())
         return 0;
 
-    ScriptController* scriptController = frame->script();
-    if (!scriptController->canExecuteScripts(AboutToExecuteScript))
+    ScriptController* script = document->frame()->script();
+    if (!script->canExecuteScripts(AboutToExecuteScript) || script->isPaused())
         return 0;
 
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(executionContext, isolatedWorld());
     if (!globalObject)
         return 0;
 
-    if (executionContext->isDocument()) {
-        JSDOMWindow* window = static_cast<JSDOMWindow*>(globalObject);
-        Frame* frame = window->impl()->frame();
-        if (!frame)
-            return 0;
-        // FIXME: Is this check needed for non-Document contexts?
-        ScriptController* script = frame->script();
-        if (!script->canExecuteScripts(AboutToExecuteScript) || script->isPaused())
-            return 0;
-    }
-
     ExecState* exec = globalObject->globalExec();
 
     MarkedArgumentBuffer args;
     args.append(jsNontrivialString(exec, stringToUString(m_eventParameterName)));
     args.append(jsString(exec, m_code));
 
-    JSObject* jsFunction = constructFunction(exec, args, Identifier(exec, stringToUString(m_functionName)), stringToUString(m_sourceURL), m_lineNumber); // FIXME: is globalExec ok?
+    JSObject* jsFunction = constructFunction(exec, exec->lexicalGlobalObject(), args, Identifier(exec, stringToUString(m_functionName)), stringToUString(m_sourceURL), m_lineNumber); // FIXME: is globalExec ok?
     if (exec->hadException()) {
         exec->clearException();
         return 0;
diff --git a/Source/WebCore/bindings/js/JSMainThreadExecState.h b/Source/WebCore/bindings/js/JSMainThreadExecState.h
index fb01000..436de5e 100644
--- a/Source/WebCore/bindings/js/JSMainThreadExecState.h
+++ b/Source/WebCore/bindings/js/JSMainThreadExecState.h
@@ -26,7 +26,7 @@
 #ifndef JSMainThreadExecState_h
 #define JSMainThreadExecState_h
 
-#include <JSDOMBinding.h>
+#include "JSDOMBinding.h"
 #ifndef NDEBUG
 #include <wtf/MainThread.h>
 #endif
diff --git a/Source/WebCore/bindings/js/JSOptionConstructor.cpp b/Source/WebCore/bindings/js/JSOptionConstructor.cpp
index a3c9aab..59e0b6a 100644
--- a/Source/WebCore/bindings/js/JSOptionConstructor.cpp
+++ b/Source/WebCore/bindings/js/JSOptionConstructor.cpp
@@ -36,7 +36,7 @@ ASSERT_CLASS_FITS_IN_CELL(JSOptionConstructor);
 const ClassInfo JSOptionConstructor::s_info = { "OptionConstructor", &DOMConstructorWithDocument::s_info, 0, 0 };
 
 JSOptionConstructor::JSOptionConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
-    : DOMConstructorWithDocument(JSOptionConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+    : DOMConstructorWithDocument(JSOptionConstructor::createStructure(globalObject->globalData(), globalObject->objectPrototype()), globalObject)
 {
     ASSERT(inherits(&s_info));
     putDirect(exec->globalData(), exec->propertyNames().prototype, JSHTMLOptionElementPrototype::self(exec, globalObject), None);
diff --git a/Source/WebCore/bindings/js/JSOptionConstructor.h b/Source/WebCore/bindings/js/JSOptionConstructor.h
index 03633c7..8a18007 100644
--- a/Source/WebCore/bindings/js/JSOptionConstructor.h
+++ b/Source/WebCore/bindings/js/JSOptionConstructor.h
@@ -30,9 +30,9 @@ namespace WebCore {
     public:
         JSOptionConstructor(JSC::ExecState*, JSDOMGlobalObject*);
 
-        static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+        static PassRefPtr<JSC::Structure> createStructure(JSC::JSGlobalData& globalData, JSC::JSValue prototype)
         {
-            return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
+            return JSC::Structure::create(globalData, prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
         }
 
         static const JSC::ClassInfo s_info;
diff --git a/Source/WebCore/bindings/js/JSWebKitAnimationCustom.cpp b/Source/WebCore/bindings/js/JSWebKitAnimationCustom.cpp
new file mode 100644
index 0000000..8425c4c
--- /dev/null
+++ b/Source/WebCore/bindings/js/JSWebKitAnimationCustom.cpp
@@ -0,0 +1,44 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All right reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JSWebKitAnimation.h"
+
+#include "WebKitAnimation.h"
+
+using namespace JSC;
+
+namespace WebCore {
+
+JSValue JSWebKitAnimation::iterationCount(ExecState*) const
+{
+    WebKitAnimation* imp = impl();
+    int count = imp->iterationCount();
+    if (count == Animation::IterationCountInfinite)
+        return jsNumber(std::numeric_limits<float>::infinity());
+    return jsNumber(count);
+}
+
+}
diff --git a/Source/WebCore/bindings/js/JSWebKitAnimationListCustom.cpp b/Source/WebCore/bindings/js/JSWebKitAnimationListCustom.cpp
new file mode 100644
index 0000000..eaf77cf
--- /dev/null
+++ b/Source/WebCore/bindings/js/JSWebKitAnimationListCustom.cpp
@@ -0,0 +1,47 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All right reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JSWebKitAnimationList.h"
+
+#include "WebKitAnimationList.h"
+
+using namespace JSC;
+
+namespace WebCore {
+
+void JSWebKitAnimationList::markChildren(MarkStack& markStack)
+{
+    Base::markChildren(markStack);
+
+    WebKitAnimationList* list = impl();
+    JSGlobalData& globalData = *Heap::heap(this)->globalData();
+
+    unsigned length = list->length();
+    for (unsigned i = 0; i < length; ++i)
+        markDOMObjectWrapper(markStack, globalData, list->item(i));
+}
+
+}
diff --git a/Source/WebCore/bindings/js/JSWorkerContextBase.cpp b/Source/WebCore/bindings/js/JSWorkerContextBase.cpp
index 88fa43f..c6f86b5 100644
--- a/Source/WebCore/bindings/js/JSWorkerContextBase.cpp
+++ b/Source/WebCore/bindings/js/JSWorkerContextBase.cpp
@@ -45,7 +45,7 @@ ASSERT_CLASS_FITS_IN_CELL(JSWorkerContextBase);
 const ClassInfo JSWorkerContextBase::s_info = { "WorkerContext", &JSDOMGlobalObject::s_info, 0, 0 };
 
 JSWorkerContextBase::JSWorkerContextBase(NonNullPassRefPtr<JSC::Structure> structure, PassRefPtr<WorkerContext> impl)
-    : JSDOMGlobalObject(structure, new JSDOMGlobalObjectData(normalWorld(*impl->script()->globalData())), this)
+    : JSDOMGlobalObject(structure, normalWorld(*impl->script()->globalData()), this)
     , m_impl(impl)
 {
     ASSERT(inherits(&s_info));
diff --git a/Source/WebCore/bindings/js/JSWorkerContextBase.h b/Source/WebCore/bindings/js/JSWorkerContextBase.h
index 99948b7..b9c234a 100644
--- a/Source/WebCore/bindings/js/JSWorkerContextBase.h
+++ b/Source/WebCore/bindings/js/JSWorkerContextBase.h
@@ -49,9 +49,9 @@ namespace WebCore {
         WorkerContext* impl() const { return m_impl.get(); }
         virtual ScriptExecutionContext* scriptExecutionContext() const;
 
-        static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+        static PassRefPtr<JSC::Structure> createStructure(JSC::JSGlobalData& globalData, JSC::JSValue prototype)
         {
-            return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
+            return JSC::Structure::create(globalData, prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
         }
 
     private:
diff --git a/Source/WebCore/bindings/js/PageScriptDebugServer.cpp b/Source/WebCore/bindings/js/PageScriptDebugServer.cpp
new file mode 100755
index 0000000..3d9cb9d
--- /dev/null
+++ b/Source/WebCore/bindings/js/PageScriptDebugServer.cpp
@@ -0,0 +1,215 @@
+/*
+ * Copyright (c) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "PageScriptDebugServer.h"
+
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+
+#include "Frame.h"
+#include "FrameView.h"
+#include "JSDOMWindowCustom.h"
+#include "Page.h"
+#include "PageGroup.h"
+#include "PluginView.h"
+#include "ScriptDebugListener.h"
+#include "Widget.h"
+#include <runtime/JSLock.h>
+#include <wtf/MainThread.h>
+#include <wtf/OwnPtr.h>
+#include <wtf/PassOwnPtr.h>
+#include <wtf/StdLibExtras.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+static Page* toPage(JSGlobalObject* globalObject)
+{
+    ASSERT_ARG(globalObject, globalObject);
+
+    JSDOMWindow* window = asJSDOMWindow(globalObject);
+    Frame* frame = window->impl()->frame();
+    return frame ? frame->page() : 0;
+}
+
+PageScriptDebugServer& PageScriptDebugServer::shared()
+{
+    DEFINE_STATIC_LOCAL(PageScriptDebugServer, server, ());
+    return server;
+}
+
+PageScriptDebugServer::PageScriptDebugServer()
+    : ScriptDebugServer()
+{
+}
+
+PageScriptDebugServer::~PageScriptDebugServer()
+{
+    deleteAllValues(m_pageListenersMap);
+}
+
+void PageScriptDebugServer::addListener(ScriptDebugListener* listener, Page* page)
+{
+    ASSERT_ARG(listener, listener);
+    ASSERT_ARG(page, page);
+
+    pair<PageListenersMap::iterator, bool> result = m_pageListenersMap.add(page, 0);
+    if (result.second)
+        result.first->second = new ListenerSet;
+
+    ListenerSet* listeners = result.first->second;
+    listeners->add(listener);
+
+    recompileAllJSFunctionsSoon();
+    page->setDebugger(this);
+}
+
+void PageScriptDebugServer::removeListener(ScriptDebugListener* listener, Page* page)
+{
+    ASSERT_ARG(listener, listener);
+    ASSERT_ARG(page, page);
+
+    PageListenersMap::iterator it = m_pageListenersMap.find(page);
+    if (it == m_pageListenersMap.end())
+        return;
+
+    ListenerSet* listeners = it->second;
+    listeners->remove(listener);
+    if (listeners->isEmpty()) {
+        m_pageListenersMap.remove(it);
+        delete listeners;
+        didRemoveLastListener(page);
+    }
+}
+
+void PageScriptDebugServer::recompileAllJSFunctions(Timer<ScriptDebugServer>*)
+{
+    JSLock lock(SilenceAssertionsOnly);
+    // If JavaScript stack is not empty postpone recompilation.
+    if (JSDOMWindow::commonJSGlobalData()->dynamicGlobalObject)
+        recompileAllJSFunctionsSoon();
+    else
+        Debugger::recompileAllJSFunctions(JSDOMWindow::commonJSGlobalData());
+}
+
+ScriptDebugServer::ListenerSet* PageScriptDebugServer::getListenersForGlobalObject(JSGlobalObject* globalObject)
+{
+    Page* page = toPage(globalObject);
+    if (!page)
+        return 0;
+    return m_pageListenersMap.get(page);
+}
+
+void PageScriptDebugServer::didPause(JSC::JSGlobalObject* globalObject)
+{
+    Page* page = toPage(globalObject);
+    m_pausedPage = page;
+    setJavaScriptPaused(page->group(), true);
+}
+
+void PageScriptDebugServer::didContinue(JSC::JSGlobalObject* globalObject)
+{
+    Page* page = toPage(globalObject);
+    m_pausedPage = 0;
+    setJavaScriptPaused(page->group(), false);
+}
+
+void PageScriptDebugServer::didRemoveLastListener(Page* page)
+{
+    if (m_pausedPage == page)
+        m_doneProcessingDebuggerEvents = true;
+
+    recompileAllJSFunctionsSoon();
+    page->setDebugger(0);
+}
+
+void PageScriptDebugServer::setJavaScriptPaused(const PageGroup& pageGroup, bool paused)
+{
+    setMainThreadCallbacksPaused(paused);
+
+    const HashSet<Page*>& pages = pageGroup.pages();
+
+    HashSet<Page*>::const_iterator end = pages.end();
+    for (HashSet<Page*>::const_iterator it = pages.begin(); it != end; ++it)
+        setJavaScriptPaused(*it, paused);
+}
+
+void PageScriptDebugServer::setJavaScriptPaused(Page* page, bool paused)
+{
+    ASSERT_ARG(page, page);
+
+    page->setDefersLoading(paused);
+
+    for (Frame* frame = page->mainFrame(); frame; frame = frame->tree()->traverseNext())
+        setJavaScriptPaused(frame, paused);
+}
+
+void PageScriptDebugServer::setJavaScriptPaused(Frame* frame, bool paused)
+{
+    ASSERT_ARG(frame, frame);
+
+    if (!frame->script()->canExecuteScripts(NotAboutToExecuteScript))
+        return;
+
+    frame->script()->setPaused(paused);
+
+    Document* document = frame->document();
+    if (paused) {
+        document->suspendScriptedAnimationControllerCallbacks();
+        document->suspendActiveDOMObjects(ActiveDOMObject::JavaScriptDebuggerPaused);
+    } else {
+        document->resumeActiveDOMObjects();
+        document->resumeScriptedAnimationControllerCallbacks();
+    }
+
+    setJavaScriptPaused(frame->view(), paused);
+}
+
+void PageScriptDebugServer::setJavaScriptPaused(FrameView* view, bool paused)
+{
+    if (!view)
+        return;
+
+    const HashSet<RefPtr<Widget> >* children = view->children();
+    ASSERT(children);
+
+    HashSet<RefPtr<Widget> >::const_iterator end = children->end();
+    for (HashSet<RefPtr<Widget> >::const_iterator it = children->begin(); it != end; ++it) {
+        Widget* widget = (*it).get();
+        if (!widget->isPluginView())
+            continue;
+        static_cast<PluginView*>(widget)->setJavaScriptPaused(paused);
+    }
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(JAVASCRIPT_DEBUGGER)
diff --git a/Source/WebCore/bindings/js/PageScriptDebugServer.h b/Source/WebCore/bindings/js/PageScriptDebugServer.h
new file mode 100755
index 0000000..5563e26
--- /dev/null
+++ b/Source/WebCore/bindings/js/PageScriptDebugServer.h
@@ -0,0 +1,81 @@
+/*
+ * Copyright (c) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef PageScriptDebugServer_h
+#define PageScriptDebugServer_h
+
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+
+#include "ScriptDebugServer.h"
+#include <wtf/Forward.h>
+
+namespace WebCore {
+
+class Frame;
+class FrameView;
+class Page;
+class PageGroup;
+
+class PageScriptDebugServer : public ScriptDebugServer {
+    WTF_MAKE_NONCOPYABLE(PageScriptDebugServer);
+public:
+    static PageScriptDebugServer& shared();
+
+    void addListener(ScriptDebugListener*, Page*);
+    void removeListener(ScriptDebugListener*, Page*);
+
+    virtual void recompileAllJSFunctions(Timer<ScriptDebugServer>*);
+
+private:
+    typedef HashMap<Page*, ListenerSet*> PageListenersMap;
+
+    PageScriptDebugServer();
+    virtual ~PageScriptDebugServer();
+
+    virtual ListenerSet* getListenersForGlobalObject(JSC::JSGlobalObject*);
+    virtual void didPause(JSC::JSGlobalObject*);
+    virtual void didContinue(JSC::JSGlobalObject*);
+
+    void didRemoveLastListener(Page*);
+
+    void setJavaScriptPaused(const PageGroup&, bool paused);
+    void setJavaScriptPaused(Page*, bool paused);
+    void setJavaScriptPaused(Frame*, bool paused);
+    void setJavaScriptPaused(FrameView*, bool paused);
+
+    PageListenersMap m_pageListenersMap;
+    Page* m_pausedPage;
+};
+
+} // namespace WebCore
+
+#endif // ENABLE(JAVASCRIPT_DEBUGGER)
+
+#endif // PageScriptDebugServer_h
diff --git a/Source/WebCore/bindings/js/ScheduledAction.h b/Source/WebCore/bindings/js/ScheduledAction.h
index c4b3edf..3adc185 100644
--- a/Source/WebCore/bindings/js/ScheduledAction.h
+++ b/Source/WebCore/bindings/js/ScheduledAction.h
@@ -20,8 +20,8 @@
 #ifndef ScheduledAction_h
 #define ScheduledAction_h
 
+#include "JSDOMBinding.h"
 #include "PlatformString.h"
-#include <JSDOMBinding.h>
 #include <collector/handles/Global.h>
 #include <runtime/JSCell.h>
 #include <wtf/PassOwnPtr.h>
diff --git a/Source/WebCore/bindings/js/ScriptDebugServer.cpp b/Source/WebCore/bindings/js/ScriptDebugServer.cpp
index 32a3b2d..05c0f2c 100644
--- a/Source/WebCore/bindings/js/ScriptDebugServer.cpp
+++ b/Source/WebCore/bindings/js/ScriptDebugServer.cpp
@@ -1,6 +1,6 @@
 /*
  * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
- * Copyright (C) 2010 Google Inc. All rights reserved.
+ * Copyright (C) 2010-2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -32,45 +32,27 @@
 
 #if ENABLE(JAVASCRIPT_DEBUGGER)
 
-#include "DOMWindow.h"
 #include "EventLoop.h"
 #include "Frame.h"
-#include "FrameTree.h"
-#include "FrameView.h"
-#include "JSDOMWindowCustom.h"
 #include "JavaScriptCallFrame.h"
-#include "Page.h"
-#include "PageGroup.h"
-#include "PluginView.h"
 #include "ScriptBreakpoint.h"
 #include "ScriptController.h"
 #include "ScriptDebugListener.h"
-#include "ScrollView.h"
-#include "Widget.h"
 #include <debugger/DebuggerCallFrame.h>
 #include <parser/SourceProvider.h>
 #include <runtime/JSLock.h>
 #include <wtf/text/StringConcatenate.h>
 #include <wtf/MainThread.h>
-#include <wtf/StdLibExtras.h>
-#include <wtf/UnusedParam.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ScriptDebugServer& ScriptDebugServer::shared()
-{
-    DEFINE_STATIC_LOCAL(ScriptDebugServer, server, ());
-    return server;
-}
-
 ScriptDebugServer::ScriptDebugServer()
     : m_callingListeners(false)
     , m_pauseOnExceptionsState(DontPauseOnExceptions)
     , m_pauseOnNextStatement(false)
     , m_paused(false)
-    , m_pausedPage(0)
     , m_doneProcessingDebuggerEvents(true)
     , m_breakpointsActivated(true)
     , m_pauseOnCallFrame(0)
@@ -83,47 +65,6 @@ ScriptDebugServer::~ScriptDebugServer()
     deleteAllValues(m_pageListenersMap);
 }
 
-void ScriptDebugServer::addListener(ScriptDebugListener* listener, Page* page)
-{
-    ASSERT_ARG(listener, listener);
-    ASSERT_ARG(page, page);
-
-    pair<PageListenersMap::iterator, bool> result = m_pageListenersMap.add(page, 0);
-    if (result.second)
-        result.first->second = new ListenerSet;
-
-    ListenerSet* listeners = result.first->second;
-    listeners->add(listener);
-
-    didAddListener(page);
-}
-
-void ScriptDebugServer::removeListener(ScriptDebugListener* listener, Page* page)
-{
-    ASSERT_ARG(listener, listener);
-    ASSERT_ARG(page, page);
-
-    PageListenersMap::iterator it = m_pageListenersMap.find(page);
-    if (it == m_pageListenersMap.end())
-        return;
-
-    ListenerSet* listeners = it->second;
-    listeners->remove(listener);
-    if (listeners->isEmpty()) {
-        m_pageListenersMap.remove(it);
-        delete listeners;
-    }
-
-    didRemoveListener(page);
-}
-
-bool ScriptDebugServer::hasListenersInterestedInPage(Page* page)
-{
-    ASSERT_ARG(page, page);
-
-    return m_pageListenersMap.contains(page);
-}
-
 String ScriptDebugServer::setBreakpoint(const String& sourceID, const ScriptBreakpoint& scriptBreakpoint, int* actualLineNumber, int* actualColumnNumber)
 {
     intptr_t sourceIDValue = sourceID.toIntPtr();
@@ -299,15 +240,6 @@ void ScriptDebugServer::dispatchFailedToParseSource(const ListenerSet& listeners
         copy[i]->failedToParseSource(url, data, firstLine, errorLine, errorMessage);
 }
 
-static Page* toPage(JSGlobalObject* globalObject)
-{
-    ASSERT_ARG(globalObject, globalObject);
-
-    JSDOMWindow* window = asJSDOMWindow(globalObject);
-    Frame* frame = window->impl()->frame();
-    return frame ? frame->page() : 0;
-}
-
 static ScriptWorldType currentWorldType(ExecState* exec)
 {
     if (currentWorld(exec) == mainThreadNormalWorld())
@@ -333,22 +265,19 @@ void ScriptDebugServer::sourceParsed(ExecState* exec, SourceProvider* sourceProv
     if (m_callingListeners)
         return;
 
-    Page* page = toPage(exec->lexicalGlobalObject());
-    if (!page)
+    ListenerSet* listeners = getListenersForGlobalObject(exec->lexicalGlobalObject());
+    if (!listeners)
         return;
-
-    ScriptWorldType worldType = currentWorldType(exec);
+    ASSERT(!listeners->isEmpty());
 
     m_callingListeners = true;
 
     bool isError = errorLine != -1;
-
-    if (ListenerSet* pageListeners = m_pageListenersMap.get(page)) {
-        ASSERT(!pageListeners->isEmpty());
-        if (isError)
-            dispatchFailedToParseSource(*pageListeners, sourceProvider, errorLine, ustringToString(errorMessage));
-        else
-            dispatchDidParseSource(*pageListeners, sourceProvider, worldType);
+    if (isError)
+        dispatchFailedToParseSource(*listeners, sourceProvider, errorLine, ustringToString(errorMessage));
+    else {
+        ScriptWorldType worldType = currentWorldType(exec);
+        dispatchDidParseSource(*listeners, sourceProvider, worldType);
     }
 
     m_callingListeners = false;
@@ -362,85 +291,26 @@ void ScriptDebugServer::dispatchFunctionToListeners(const ListenerSet& listeners
         (this->*callback)(copy[i]);
 }
 
-void ScriptDebugServer::dispatchFunctionToListeners(JavaScriptExecutionCallback callback, Page* page)
+void ScriptDebugServer::dispatchFunctionToListeners(JavaScriptExecutionCallback callback, JSGlobalObject* globalObject)
 {
     if (m_callingListeners)
         return;
 
     m_callingListeners = true;
 
-    if (ListenerSet* pageListeners = m_pageListenersMap.get(page)) {
-        ASSERT(!pageListeners->isEmpty());
-        dispatchFunctionToListeners(*pageListeners, callback);
+    if (ListenerSet* listeners = getListenersForGlobalObject(globalObject)) {
+        ASSERT(!listeners->isEmpty());
+        dispatchFunctionToListeners(*listeners, callback);
     }
 
     m_callingListeners = false;
 }
 
-void ScriptDebugServer::setJavaScriptPaused(const PageGroup& pageGroup, bool paused)
-{
-    setMainThreadCallbacksPaused(paused);
-
-    const HashSet<Page*>& pages = pageGroup.pages();
-
-    HashSet<Page*>::const_iterator end = pages.end();
-    for (HashSet<Page*>::const_iterator it = pages.begin(); it != end; ++it)
-        setJavaScriptPaused(*it, paused);
-}
-
-void ScriptDebugServer::setJavaScriptPaused(Page* page, bool paused)
-{
-    ASSERT_ARG(page, page);
-
-    page->setDefersLoading(paused);
-
-    for (Frame* frame = page->mainFrame(); frame; frame = frame->tree()->traverseNext())
-        setJavaScriptPaused(frame, paused);
-}
-
-void ScriptDebugServer::setJavaScriptPaused(Frame* frame, bool paused)
-{
-    ASSERT_ARG(frame, frame);
-
-    if (!frame->script()->canExecuteScripts(NotAboutToExecuteScript))
-        return;
-
-    frame->script()->setPaused(paused);
-
-    Document* document = frame->document();
-    if (paused) {
-        document->suspendScriptedAnimationControllerCallbacks();
-        document->suspendActiveDOMObjects(ActiveDOMObject::JavaScriptDebuggerPaused);
-    } else {
-        document->resumeActiveDOMObjects();
-        document->resumeScriptedAnimationControllerCallbacks();
-    }
-
-    setJavaScriptPaused(frame->view(), paused);
-}
-
-void ScriptDebugServer::setJavaScriptPaused(FrameView* view, bool paused)
-{
-    if (!view)
-        return;
-
-    const HashSet<RefPtr<Widget> >* children = view->children();
-    ASSERT(children);
-
-    HashSet<RefPtr<Widget> >::const_iterator end = children->end();
-    for (HashSet<RefPtr<Widget> >::const_iterator it = children->begin(); it != end; ++it) {
-        Widget* widget = (*it).get();
-        if (!widget->isPluginView())
-            continue;
-        static_cast<PluginView*>(widget)->setJavaScriptPaused(paused);
-    }
-}
-
 void ScriptDebugServer::createCallFrameAndPauseIfNeeded(const DebuggerCallFrame& debuggerCallFrame, intptr_t sourceID, int lineNumber)
 {
     TextPosition0 textPosition(WTF::OneBasedNumber::fromOneBasedInt(lineNumber).convertToZeroBased(), WTF::ZeroBasedNumber::base());
     m_currentCallFrame = JavaScriptCallFrame::create(debuggerCallFrame, m_currentCallFrame, sourceID, textPosition);
-    pauseIfNeeded(toPage(debuggerCallFrame.dynamicGlobalObject()));
+    pauseIfNeeded(debuggerCallFrame.dynamicGlobalObject());
 }
 
 void ScriptDebugServer::updateCallFrameAndPauseIfNeeded(const DebuggerCallFrame& debuggerCallFrame, intptr_t sourceID, int lineNumber)
@@ -451,15 +321,15 @@ void ScriptDebugServer::updateCallFrameAndPauseIfNeeded(const DebuggerCallFrame&
 
     TextPosition0 textPosition(WTF::OneBasedNumber::fromOneBasedInt(lineNumber).convertToZeroBased(), WTF::ZeroBasedNumber::base());
     m_currentCallFrame->update(debuggerCallFrame, sourceID, textPosition);
-    pauseIfNeeded(toPage(debuggerCallFrame.dynamicGlobalObject()));
+    pauseIfNeeded(debuggerCallFrame.dynamicGlobalObject());
 }
 
-void ScriptDebugServer::pauseIfNeeded(Page* page)
+void ScriptDebugServer::pauseIfNeeded(JSGlobalObject* dynamicGlobalObject)
 {
     if (m_paused)
         return;
-
-    if (!page || !hasListenersInterestedInPage(page))
+ 
+    if (!getListenersForGlobalObject(dynamicGlobalObject))
         return;
 
     bool pauseNow = m_pauseOnNextStatement;
@@ -471,11 +341,9 @@ void ScriptDebugServer::pauseIfNeeded(Page* page)
     m_pauseOnCallFrame = 0;
     m_pauseOnNextStatement = false;
     m_paused = true;
-    m_pausedPage = page;
 
-    dispatchFunctionToListeners(&ScriptDebugServer::dispatchDidPause, page);
-
-    setJavaScriptPaused(page->group(), true);
+    dispatchFunctionToListeners(&ScriptDebugServer::dispatchDidPause, dynamicGlobalObject);
+    didPause(dynamicGlobalObject);
 
     TimerBase::fireTimersInNestedEventLoop();
 
@@ -484,12 +352,10 @@ void ScriptDebugServer::pauseIfNeeded(Page* page)
     while (!m_doneProcessingDebuggerEvents && !loop.ended())
         loop.cycle();
 
-    setJavaScriptPaused(page->group(), false);
+    didContinue(dynamicGlobalObject);
+    dispatchFunctionToListeners(&ScriptDebugServer::dispatchDidContinue, dynamicGlobalObject);
 
     m_paused = false;
-    m_pausedPage = 0;
-
-    dispatchFunctionToListeners(&ScriptDebugServer::dispatchDidContinue, page);
 }
 
 void ScriptDebugServer::callEvent(const DebuggerCallFrame& debuggerCallFrame, intptr_t sourceID, int lineNumber)
@@ -565,34 +431,6 @@ void ScriptDebugServer::recompileAllJSFunctionsSoon()
     m_recompileTimer.startOneShot(0);
 }
 
-void ScriptDebugServer::recompileAllJSFunctions(Timer<ScriptDebugServer>*)
-{
-    JSLock lock(SilenceAssertionsOnly);
-    // If JavaScript stack is not empty postpone recompilation.
-    if (JSDOMWindow::commonJSGlobalData()->dynamicGlobalObject)
-        recompileAllJSFunctionsSoon();
-    else
-        Debugger::recompileAllJSFunctions(JSDOMWindow::commonJSGlobalData());
-}
-
-void ScriptDebugServer::didAddListener(Page* page)
-{
-    recompileAllJSFunctionsSoon();
-    page->setDebugger(this);
-}
-
-void ScriptDebugServer::didRemoveListener(Page* page)
-{
-    if (hasListenersInterestedInPage(page))
-        return;
-
-    if (m_pausedPage == page)
-        m_doneProcessingDebuggerEvents = true;
-
-    recompileAllJSFunctionsSoon();
-    page->setDebugger(0);
-}
-
 } // namespace WebCore
 
 #endif // ENABLE(JAVASCRIPT_DEBUGGER)
diff --git a/Source/WebCore/bindings/js/ScriptDebugServer.h b/Source/WebCore/bindings/js/ScriptDebugServer.h
index e7e8502..e53cb4d 100644
--- a/Source/WebCore/bindings/js/ScriptDebugServer.h
+++ b/Source/WebCore/bindings/js/ScriptDebugServer.h
@@ -1,6 +1,6 @@
 /*
  * Copyright (C) 2008 Apple Inc. All rights reserved.
- * Copyright (C) 2010 Google Inc. All rights reserved.
+ * Copyright (C) 2010-2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -50,21 +50,12 @@ class JSGlobalObject;
 }
 namespace WebCore {
 
-class Frame;
-class FrameView;
-class Page;
-class PageGroup;
 class ScriptDebugListener;
 class JavaScriptCallFrame;
 
-class ScriptDebugServer : JSC::Debugger {
+class ScriptDebugServer : protected JSC::Debugger {
     WTF_MAKE_NONCOPYABLE(ScriptDebugServer); WTF_MAKE_FAST_ALLOCATED;
 public:
-    static ScriptDebugServer& shared();
-
-    void addListener(ScriptDebugListener*, Page*);
-    void removeListener(ScriptDebugListener*, Page*);
-
     String setBreakpoint(const String& sourceID, const ScriptBreakpoint&, int* actualLineNumber, int* actualColumnNumber);
     void removeBreakpoint(const String& breakpointId);
     void clearBreakpoints();
@@ -90,26 +81,24 @@ public:
     bool editScriptSource(const String& sourceID, const String& newContent, String& newSourceOrErrorMessage);
 
     void recompileAllJSFunctionsSoon();
-    void recompileAllJSFunctions(Timer<ScriptDebugServer>* = 0);
+    virtual void recompileAllJSFunctions(Timer<ScriptDebugServer>* = 0) = 0;
 
     JavaScriptCallFrame* currentCallFrame();
 
-private:
+protected:
     typedef HashSet<ScriptDebugListener*> ListenerSet;
     typedef void (ScriptDebugServer::*JavaScriptExecutionCallback)(ScriptDebugListener*);
 
     ScriptDebugServer();
     ~ScriptDebugServer();
 
-    bool hasBreakpoint(intptr_t sourceID, const TextPosition0& position) const;
-    bool hasListenersInterestedInPage(Page*);
+    virtual ListenerSet* getListenersForGlobalObject(JSC::JSGlobalObject*) = 0;
+    virtual void didPause(JSC::JSGlobalObject*) = 0;
+    virtual void didContinue(JSC::JSGlobalObject*) = 0;
 
-    void setJavaScriptPaused(const PageGroup&, bool paused);
-    void setJavaScriptPaused(Page*, bool paused);
-    void setJavaScriptPaused(Frame*, bool paused);
-    void setJavaScriptPaused(FrameView*, bool paused);
+    bool hasBreakpoint(intptr_t sourceID, const TextPosition0&) const;
 
-    void dispatchFunctionToListeners(JavaScriptExecutionCallback, Page*);
+    void dispatchFunctionToListeners(JavaScriptExecutionCallback, JSC::JSGlobalObject*);
     void dispatchFunctionToListeners(const ListenerSet& listeners, JavaScriptExecutionCallback callback);
     void dispatchDidPause(ScriptDebugListener*);
     void dispatchDidContinue(ScriptDebugListener*);
@@ -118,7 +107,7 @@ private:
 
     void createCallFrameAndPauseIfNeeded(const JSC::DebuggerCallFrame&, intptr_t sourceID, int lineNumber);
     void updateCallFrameAndPauseIfNeeded(const JSC::DebuggerCallFrame&, intptr_t sourceID, int lineNumber);
-    void pauseIfNeeded(Page*);
+    void pauseIfNeeded(JSC::JSGlobalObject* dynamicGlobalObject);
 
     virtual void detach(JSC::JSGlobalObject*);
 
@@ -131,9 +120,6 @@ private:
     virtual void didExecuteProgram(const JSC::DebuggerCallFrame&, intptr_t sourceID, int lineno);
     virtual void didReachBreakpoint(const JSC::DebuggerCallFrame&, intptr_t sourceID, int lineno);
 
-    void didAddListener(Page*);
-    void didRemoveListener(Page*);
-
     typedef HashMap<Page*, ListenerSet*> PageListenersMap;
     typedef HashMap<long, ScriptBreakpoint> LineToBreakpointMap;
     typedef HashMap<intptr_t, LineToBreakpointMap> SourceIdToBreakpointsMap;
@@ -143,7 +129,6 @@ private:
     PauseOnExceptionsState m_pauseOnExceptionsState;
     bool m_pauseOnNextStatement;
     bool m_paused;
-    Page* m_pausedPage;
     bool m_doneProcessingDebuggerEvents;
     bool m_breakpointsActivated;
     JavaScriptCallFrame* m_pauseOnCallFrame;
diff --git a/Source/WebCore/bindings/js/ScriptHeapSnapshot.h b/Source/WebCore/bindings/js/ScriptHeapSnapshot.h
index 6b40e20..a341ddc 100644
--- a/Source/WebCore/bindings/js/ScriptHeapSnapshot.h
+++ b/Source/WebCore/bindings/js/ScriptHeapSnapshot.h
@@ -50,7 +50,6 @@ public:
     unsigned int uid() const { return 0; }
 
     void writeJSON(OutputStream*) { }
-    int exactRetainedSize(uint64_t) { return -1; }
 
 private:
     ScriptHeapSnapshot() { }
diff --git a/Source/WebCore/bindings/js/ScriptProfiler.cpp b/Source/WebCore/bindings/js/ScriptProfiler.cpp
index f372c3c..3468ae3 100644
--- a/Source/WebCore/bindings/js/ScriptProfiler.cpp
+++ b/Source/WebCore/bindings/js/ScriptProfiler.cpp
@@ -30,11 +30,17 @@
 
 #include "ScriptProfiler.h"
 
+#include "GCController.h"
 #include "JSDOMBinding.h"
 #include <profiler/Profiler.h>
 
 namespace WebCore {
 
+void ScriptProfiler::collectGarbage()
+{
+    gcController().garbageCollectNow();
+}
+
 void ScriptProfiler::start(ScriptState* state, const String& title)
 {
     JSC::Profiler::profiler()->startProfiling(state, stringToUString(title));
diff --git a/Source/WebCore/bindings/js/ScriptProfiler.h b/Source/WebCore/bindings/js/ScriptProfiler.h
index d8ad482..05d5e92 100644
--- a/Source/WebCore/bindings/js/ScriptProfiler.h
+++ b/Source/WebCore/bindings/js/ScriptProfiler.h
@@ -47,6 +47,7 @@ public:
         virtual bool isCanceled() = 0;
     };
 
+    static void collectGarbage();
     static void start(ScriptState* state, const String& title);
     static PassRefPtr<ScriptProfile> stop(ScriptState* state, const String& title);
     static PassRefPtr<ScriptHeapSnapshot> takeHeapSnapshot(const String&, HeapSnapshotProgress*) { return 0; }
diff --git a/Source/WebCore/bindings/js/SerializedScriptValue.cpp b/Source/WebCore/bindings/js/SerializedScriptValue.cpp
index b3d07ca..a9c1b24 100644
--- a/Source/WebCore/bindings/js/SerializedScriptValue.cpp
+++ b/Source/WebCore/bindings/js/SerializedScriptValue.cpp
@@ -206,6 +206,45 @@ protected:
     MarkedArgumentBuffer m_gcBuffer;
 };
 
+#if ASSUME_LITTLE_ENDIAN
+template <typename T> static void writeLittleEndian(Vector<uint8_t>& buffer, T value)
+{
+    buffer.append(reinterpret_cast<uint8_t*>(&value), sizeof(value));
+}
+#else
+template <typename T> static void writeLittleEndian(Vector<uint8_t>& buffer, T value)
+{
+    for (unsigned i = 0; i < sizeof(T); i++) {
+        buffer.append(value & 0xFF);
+        value >>= 8;
+    }
+}
+#endif
+
+template <> void writeLittleEndian<uint8_t>(Vector<uint8_t>& buffer, uint8_t value)
+{
+    buffer.append(value);
+}
+
+template <typename T> static bool writeLittleEndian(Vector<uint8_t>& buffer, const T* values, uint32_t length)
+{
+    if (length > numeric_limits<uint32_t>::max() / sizeof(T))
+        return false;
+
+#if ASSUME_LITTLE_ENDIAN
+    buffer.append(reinterpret_cast<const uint8_t*>(values), length * sizeof(T));
+#else
+    for (unsigned i = 0; i < length; i++) {
+        T value = values[i];
+        for (unsigned j = 0; j < sizeof(T); j++) {
+            buffer.append(static_cast<uint8_t>(value & 0xFF));
+            value >>= 8;
+        }
+    }
+#endif
+    return true;
+}
+
 class CloneSerializer : CloneBase {
 public:
     static bool serialize(ExecState* exec, JSValue value, Vector<uint8_t>& out)
@@ -444,43 +483,6 @@ private:
         writeLittleEndian(m_buffer, c);
     }
 
-#if ASSUME_LITTLE_ENDIAN
-    template <typename T> static void writeLittleEndian(Vector<uint8_t>& buffer, T value)
-    {
-        if (sizeof(T) == 1)
-            buffer.append(value);
-        else
-            buffer.append(reinterpret_cast<uint8_t*>(&value), sizeof(value));
-    }
-#else
-    template <typename T> static void writeLittleEndian(Vector<uint8_t>& buffer, T value)
-    {
-        for (unsigned i = 0; i < sizeof(T); i++) {
-            buffer.append(value & 0xFF);
-            value >>= 8;
-        }
-    }
-#endif
-
-    template <typename T> static bool writeLittleEndian(Vector<uint8_t>& buffer, const T* values, uint32_t length)
-    {
-        if (length > numeric_limits<uint32_t>::max() / sizeof(T))
-            return false;
-
-#if ASSUME_LITTLE_ENDIAN
-        buffer.append(reinterpret_cast<const uint8_t*>(values), length * sizeof(T));
-#else
-        for (unsigned i = 0; i < length; i++) {
-            T value = values[i];
-            for (unsigned j = 0; j < sizeof(T); j++) {
-                buffer.append(static_cast<uint8_t>(value & 0xFF));
-                value >>= 8;
-            }
-        }
-#endif
-        return true;
-    }
-
     void write(uint32_t i)
     {
         writeLittleEndian(m_buffer, i);
@@ -870,12 +872,7 @@ private:
         if (sizeof(T) == 1)
             value = *ptr++;
         else {
-#if CPU(ARMV5_OR_LOWER)
-            // To protect misaligned memory access.
-            memcpy(&value, ptr, sizeof(T));
-#else
             value = *reinterpret_cast<const T*>(ptr);
-#endif
             ptr += sizeof(T);
         }
         return true;
@@ -968,14 +965,7 @@ private:
             return false;
 
 #if ASSUME_LITTLE_ENDIAN
-#if CPU(ARMV5_OR_LOWER)
-        // To protect misaligned memory access.
-        Vector<UChar> alignedBuffer(length);
-        memcpy(alignedBuffer.data(), ptr, length * sizeof(UChar));
-        str = UString::adopt(alignedBuffer);
-#else
         str = UString(reinterpret_cast<const UChar*>(ptr), length);
-#endif
         ptr += length * sizeof(UChar);
 #else
         Vector<UChar> buffer;
@@ -1176,7 +1166,9 @@ private:
             CachedStringRef flags;
             if (!readStringData(flags))
                 return JSValue();
-            RefPtr<RegExp> regExp = RegExp::create(&m_exec->globalData(), pattern->ustring(), flags->ustring());
+            RegExpFlags reFlags = regExpFlags(flags->ustring());
+            ASSERT(reFlags != InvalidFlags);
+            RefPtr<RegExp> regExp = RegExp::create(&m_exec->globalData(), pattern->ustring(), reFlags);
             return new (m_exec) RegExpObject(m_exec->lexicalGlobalObject(), m_globalObject->regExpStructure(), regExp); 
         }
         case ObjectReferenceTag: {
diff --git a/Source/WebCore/bindings/js/WorkerScriptController.cpp b/Source/WebCore/bindings/js/WorkerScriptController.cpp
index d392281..67b0441 100644
--- a/Source/WebCore/bindings/js/WorkerScriptController.cpp
+++ b/Source/WebCore/bindings/js/WorkerScriptController.cpp
@@ -73,13 +73,13 @@ void WorkerScriptController::initScript()
     // Explicitly protect the global object's prototype so it isn't collected
     // when we allocate the global object. (Once the global object is fully
     // constructed, it can mark its own prototype.)
-    RefPtr<Structure> workerContextPrototypeStructure = JSWorkerContextPrototype::createStructure(jsNull());
+    RefPtr<Structure> workerContextPrototypeStructure = JSWorkerContextPrototype::createStructure(*m_globalData, jsNull());
     Global<JSWorkerContextPrototype> workerContextPrototype(*m_globalData, new (m_globalData.get()) JSWorkerContextPrototype(0, workerContextPrototypeStructure.release()));
 
     if (m_workerContext->isDedicatedWorkerContext()) {
-        RefPtr<Structure> dedicatedContextPrototypeStructure = JSDedicatedWorkerContextPrototype::createStructure(workerContextPrototype.get());
+        RefPtr<Structure> dedicatedContextPrototypeStructure = JSDedicatedWorkerContextPrototype::createStructure(*m_globalData, workerContextPrototype.get());
         Global<JSDedicatedWorkerContextPrototype> dedicatedContextPrototype(*m_globalData, new (m_globalData.get()) JSDedicatedWorkerContextPrototype(0, dedicatedContextPrototypeStructure.release()));
-        RefPtr<Structure> structure = JSDedicatedWorkerContext::createStructure(dedicatedContextPrototype.get());
+        RefPtr<Structure> structure = JSDedicatedWorkerContext::createStructure(*m_globalData, dedicatedContextPrototype.get());
 
         m_workerContextWrapper.set(*m_globalData, new (m_globalData.get()) JSDedicatedWorkerContext(structure.release(), m_workerContext->toDedicatedWorkerContext()));
         workerContextPrototype->putAnonymousValue(*m_globalData, 0, m_workerContextWrapper.get());
@@ -87,9 +87,9 @@ void WorkerScriptController::initScript()
 #if ENABLE(SHARED_WORKERS)
     } else {
         ASSERT(m_workerContext->isSharedWorkerContext());
-        RefPtr<Structure> sharedContextPrototypeStructure = JSSharedWorkerContextPrototype::createStructure(workerContextPrototype.get());
+        RefPtr<Structure> sharedContextPrototypeStructure = JSSharedWorkerContextPrototype::createStructure(*m_globalData, workerContextPrototype.get());
         Global<JSSharedWorkerContextPrototype> sharedContextPrototype(*m_globalData, new (m_globalData.get()) JSSharedWorkerContextPrototype(0, sharedContextPrototypeStructure.release()));
-        RefPtr<Structure> structure = JSSharedWorkerContext::createStructure(sharedContextPrototype.get());
+        RefPtr<Structure> structure = JSSharedWorkerContext::createStructure(*m_globalData, sharedContextPrototype.get());
 
         m_workerContextWrapper.set(*m_globalData, new (m_globalData.get()) JSSharedWorkerContext(structure.release(), m_workerContext->toSharedWorkerContext()));
         workerContextPrototype->putAnonymousValue(*m_globalData, 0, m_workerContextWrapper.get());
diff --git a/Source/WebCore/bindings/js/WorkerScriptDebugServer.cpp b/Source/WebCore/bindings/js/WorkerScriptDebugServer.cpp
new file mode 100755
index 0000000..5e2acd2
--- /dev/null
+++ b/Source/WebCore/bindings/js/WorkerScriptDebugServer.cpp
@@ -0,0 +1,55 @@
+/*
+ * Copyright (c) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WorkerScriptDebugServer.h"
+
+#if ENABLE(JAVASCRIPT_DEBUGGER) && ENABLE(WORKERS)
+
+#include "WorkerContext.h"
+
+namespace WebCore {
+
+WorkerScriptDebugServer::WorkerScriptDebugServer()
+    : ScriptDebugServer()
+{
+}
+
+void WorkerScriptDebugServer::addListener(ScriptDebugListener*, WorkerContext*)
+{
+}
+
+void WorkerScriptDebugServer::removeListener(ScriptDebugListener*, WorkerContext*)
+{
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(JAVASCRIPT_DEBUGGER) && ENABLE(WORKERS)
diff --git a/Source/WebCore/bindings/js/WorkerScriptDebugServer.h b/Source/WebCore/bindings/js/WorkerScriptDebugServer.h
new file mode 100755
index 0000000..4062435
--- /dev/null
+++ b/Source/WebCore/bindings/js/WorkerScriptDebugServer.h
@@ -0,0 +1,62 @@
+/*
+ * Copyright (c) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WorkerScriptDebugServer_h
+#define WorkerScriptDebugServer_h
+
+#if ENABLE(JAVASCRIPT_DEBUGGER) && ENABLE(WORKERS)
+
+#include "ScriptDebugServer.h"
+
+namespace WebCore {
+
+class WorkerContext;
+
+class WorkerScriptDebugServer : public ScriptDebugServer {
+    WTF_MAKE_NONCOPYABLE(WorkerScriptDebugServer);
+public:
+    WorkerScriptDebugServer();
+    ~WorkerScriptDebugServer() { }
+
+    void addListener(ScriptDebugListener*, WorkerContext*);
+    void removeListener(ScriptDebugListener*, WorkerContext*);
+
+private:
+    virtual void recompileAllJSFunctions(Timer<ScriptDebugServer>*) { }
+    virtual ListenerSet* getListenersForGlobalObject(JSC::JSGlobalObject*) { return 0; }
+    virtual void didPause(JSC::JSGlobalObject*) { }
+    virtual void didContinue(JSC::JSGlobalObject*) { }
+};
+
+} // namespace WebCore
+
+#endif // ENABLE(JAVASCRIPT_DEBUGGER) && ENABLE(WORKERS)
+
+#endif // WorkerScriptDebugServer_h
diff --git a/Source/WebCore/bindings/objc/DOMHTML.mm b/Source/WebCore/bindings/objc/DOMHTML.mm
index a2277d2..92588e1 100644
--- a/Source/WebCore/bindings/objc/DOMHTML.mm
+++ b/Source/WebCore/bindings/objc/DOMHTML.mm
@@ -182,8 +182,7 @@
 
 - (BOOL)_isEdited
 {
-    WebCore::RenderObject *renderer = core(self)->renderer();
-    return renderer && [self _isTextField] && static_cast<WebCore::RenderTextControl *>(renderer)->lastChangeWasUserEdit();
+    return core(self)->lastChangeWasUserEdit();
 }
 
 @end
@@ -192,8 +191,7 @@
 
 - (BOOL)_isEdited
 {
-    WebCore::RenderObject* renderer = core(self)->renderer();
-    return renderer && static_cast<WebCore::RenderTextControl*>(renderer)->lastChangeWasUserEdit();
+    return core(self)->lastChangeWasUserEdit();
 }
 
 @end
diff --git a/Source/WebCore/bindings/scripts/CodeGeneratorGObject.pm b/Source/WebCore/bindings/scripts/CodeGeneratorGObject.pm
index ed76d08..3806b75 100644
--- a/Source/WebCore/bindings/scripts/CodeGeneratorGObject.pm
+++ b/Source/WebCore/bindings/scripts/CodeGeneratorGObject.pm
@@ -459,89 +459,6 @@ EOF
     push(@txtInstallProps, "#endif /* ${conditionalString} */\n") if $conditionalString;
 }
 
-my %breakWords = ("before" => 1, "can" => 1, "context" => 1, "dbl" => 1, "drag" => 1,
-                  "drag" => 1, "duration" => 1, "has" => 1, "key" => 1, "loaded" => 1,
-                  "mouse" => 1, "page" => 1, "pop" => 1, "rate" => 1, "select" => 1,
-                  "time" => 1, "touch" => 1, "volume" => 1);
-
-sub SplitEventListenerAttrName {
-    my $attrName = shift;
-
-    my @matches = grep { $attrName =~ /^$_/ } keys (%breakWords);
-
-    if (@matches && (length $matches[0] < length $attrName)) {
-        $attrName = $matches[0] . "-" . substr($attrName, length $matches[0]);
-    }
-
-    return $attrName;
-}
-
-sub EventSignalName {
-    my $attrName = shift;
-    my $name = SplitEventListenerAttrName($attrName) . "-event";
-
-    return $name;
-}
-
-sub GenerateEventListener {
-    my $name = shift;
-    my $object = shift;
-    my $interfaceName = shift;
-
-    my $gobjectSignalName = EventSignalName($name);
-
-    my $txtInstallSignal = << "EOF";
-    g_signal_new("${gobjectSignalName}",
-                 G_TYPE_FROM_CLASS(gobjectClass),
-                 G_SIGNAL_RUN_LAST,
-                 0,
-                 g_signal_accumulator_true_handled, 0,
-                 webkit_marshal_BOOLEAN__OBJECT,
-                 G_TYPE_BOOLEAN, 1,
-                 WEBKIT_TYPE_DOM_EVENT | G_SIGNAL_TYPE_STATIC_SCOPE);
-
-EOF
-    push(@txtInstallSignals, $txtInstallSignal);
-
-    my ${listenerName} = $name . "Listener";
-
-    my $txtInstallEventListener = << "EOF";
-    WebCore::GObjectEventListener::addEventListener(object, coreObject, "${name}", "${gobjectSignalName}");
-EOF
-    push(@txtInstallEventListeners, $txtInstallEventListener);
-
-    $implIncludes{"webkit/WebKitDOMEvent.h"} = 1;
-    $implIncludes{"GObjectEventListener.h"} = 1;
-}
-
-my @eventSignalNames = (
-    # User Interface Event types
-    "focus", "blur",
-    # Basic Event types
-    "load", "unload", "abort", "error", "select", "change", "formchange", "submit", "reset",
-    "resize", "scroll",
-    # Mouse Event types
-    "click", "dblclick", "mousedown", "mouseup",
-    "mousemove", "mouseover", "mouseout",
-    # Mouse Wheel Event types
-    "mousewheel",
-    # Keyboard Event types
-    "keydown", "keypress", "keyup",
-    # -- Events not in the spec but defined in WebKit
-    # Media Event types,
-    "loadstart", "progress", "suspend", "emptied", "stalled", "play",
-    "loadedmetadata", "loadeddata", "waiting", "playing", "canplay",
-    "canplaythrough", "seeking", "seeked", "timeupdate", "ended",
-    "ratechange", "durationchange", "volumechange",
-    # Drag and Drop Event types
-    "drag", "dragend", "dragenter", "dragleave", "dragover", "dragstart", "drop",
-    # Cut and Paste Event types
-    "beforecut", "cut", "beforecopy", "copy", "beforepaste", "paste",
-    # Animations
-    "webkitanimationend", "webkitanimationstart", "webkitanimationiteration",
-    # Other
-    "contextmenu", "input", "forminput", "invalid", "search", "selectstart");
-
 sub GenerateProperties {
     my ($object, $interfaceName, $dataNode) = @_;
 
@@ -610,15 +527,6 @@ EOF
         }
     }
 
-    # We need to define all the events there are in all base classes
-    # that implement EventTarget. For now we only care about these
-    # two.
-    if ($interfaceName eq "Node" || $interfaceName eq "DOMWindow") {
-        foreach my $signalName (@eventSignalNames) {
-            GenerateEventListener($signalName, $object, $interfaceName);
-        }
-    }
-
     push(@cBodyPriv, "};\n\n");
 
     $txtGetProp = << "EOF";
@@ -669,13 +577,6 @@ static void ${lowerCaseIfaceName}_constructed(GObject* object)
 EOF
     push(@cBodyPriv, $implContent);
 
-    if (scalar @txtInstallEventListeners > 0) {
-        $implContent = << "EOF";
-    WebCore::${interfaceName}* coreObject = static_cast<WebCore::${interfaceName}*>(WEBKIT_DOM_OBJECT(object)->coreObject);
-EOF
-    push(@cBodyPriv, $implContent);
-    }
-
     $implContent = << "EOF";
 @txtInstallEventListeners
     if (G_OBJECT_CLASS(${lowerCaseIfaceName}_parent_class)->constructed)
@@ -833,8 +734,7 @@ sub GenerateFunction {
     foreach my $param (@{$function->parameters}) {
         my $paramIDLType = $param->type;
         if ($paramIDLType eq "EventListener" || $paramIDLType eq "MediaQueryListListener") {
-            push(@hBody, "\n/* TODO: event function ${functionName} */\n\n");
-            push(@cBody, "\n/* TODO: event function ${functionName} */\n\n");
+            # EventListeners are handled elsewhere.
             return;
         }
         addIncludeInBody($paramIDLType);
@@ -1283,6 +1183,7 @@ sub GenerateEventTargetIface {
     my $interfaceName = $dataNode->name;
     my $decamelize = FixUpDecamelizedName(decamelize($interfaceName));
 
+    $implIncludes{"GObjectEventListener.h"} = 1;
     $implIncludes{"WebKitDOMEventTarget.h"} = 1;
     $implIncludes{"WebKitDOMEventPrivate.h"} = 1;
 
@@ -1301,9 +1202,23 @@ static void webkit_dom_${decamelize}_dispatch_event(WebKitDOMEventTarget* target
     }
 }
 
+static gboolean webkit_dom_${decamelize}_add_event_listener(WebKitDOMEventTarget* target, const char* eventName, GCallback handler, gboolean bubble, gpointer userData)
+{
+    WebCore::${interfaceName}* coreTarget = static_cast<WebCore::${interfaceName}*>(WEBKIT_DOM_OBJECT(target)->coreObject);
+    return WebCore::GObjectEventListener::addEventListener(G_OBJECT(target), coreTarget, eventName, handler, bubble, userData);
+}
+
+static gboolean webkit_dom_${decamelize}_remove_event_listener(WebKitDOMEventTarget* target, const char* eventName, GCallback handler, gboolean bubble)
+{
+    WebCore::${interfaceName}* coreTarget = static_cast<WebCore::${interfaceName}*>(WEBKIT_DOM_OBJECT(target)->coreObject);
+    return WebCore::GObjectEventListener::removeEventListener(G_OBJECT(target), coreTarget, eventName, handler, bubble);
+}
+
 static void webkit_dom_event_target_init(WebKitDOMEventTargetIface* iface)
 {
     iface->dispatch_event = webkit_dom_${decamelize}_dispatch_event;
+    iface->add_event_listener = webkit_dom_${decamelize}_add_event_listener;
+    iface->remove_event_listener = webkit_dom_${decamelize}_remove_event_listener;
 }
 
 EOF
diff --git a/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm b/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm
index cb51c8a..12b477b 100644
--- a/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm
+++ b/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm
@@ -746,9 +746,9 @@ sub GenerateHeader
         $structureFlags{"JSC::NeedsThisConversion"} = 1;
     }
     push(@headerContent,
-        "    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)\n" .
+        "    static PassRefPtr<JSC::Structure> createStructure(JSC::JSGlobalData& globalData, JSC::JSValue prototype)\n" .
         "    {\n" .
-        "        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount, &s_info);\n" .
+        "        return JSC::Structure::create(globalData, prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount, &s_info);\n" .
         "    }\n\n");
 
     # markChildren function
@@ -958,9 +958,9 @@ sub GenerateHeader
         $structureFlags{"JSC::OverridesMarkChildren"} = 1;
     }
     push(@headerContent,
-        "    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)\n" .
+        "    static PassRefPtr<JSC::Structure> createStructure(JSC::JSGlobalData& globalData, JSC::JSValue prototype)\n" .
         "    {\n" .
-        "        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount, &s_info);\n" .
+        "        return JSC::Structure::create(globalData, prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount, &s_info);\n" .
         "    }\n");
     if ($dataNode->extendedAttributes->{"DelegatingPrototypePutFunction"}) {
         push(@headerContent, "    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);\n");
@@ -1442,9 +1442,9 @@ sub GenerateImplementation
         push(@implContent, "JSObject* ${className}::createPrototype(ExecState* exec, JSGlobalObject* globalObject)\n");
         push(@implContent, "{\n");
         if ($hasParent && $parentClassName ne "JSC::DOMNodeFilter") {
-            push(@implContent, "    return new (exec) ${className}Prototype(globalObject, ${className}Prototype::createStructure(${parentClassName}Prototype::self(exec, globalObject)));\n");
+            push(@implContent, "    return new (exec) ${className}Prototype(globalObject, ${className}Prototype::createStructure(exec->globalData(), ${parentClassName}Prototype::self(exec, globalObject)));\n");
         } else {
-            push(@implContent, "    return new (exec) ${className}Prototype(globalObject, ${className}Prototype::createStructure(globalObject->objectPrototype()));\n");
+            push(@implContent, "    return new (exec) ${className}Prototype(globalObject, ${className}Prototype::createStructure(globalObject->globalData(), globalObject->objectPrototype()));\n");
         }
         push(@implContent, "}\n\n");
     }
@@ -2873,9 +2873,9 @@ sub GenerateConstructorDeclaration
     push(@$outputArray, "    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);\n");
     push(@$outputArray, "    static const JSC::ClassInfo s_info;\n");
 
-    push(@$outputArray, "    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)\n");
+    push(@$outputArray, "    static PassRefPtr<JSC::Structure> createStructure(JSC::JSGlobalData& globalData, JSC::JSValue prototype)\n");
     push(@$outputArray, "    {\n");
-    push(@$outputArray, "        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount, &s_info);\n");
+    push(@$outputArray, "        return JSC::Structure::create(globalData, prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount, &s_info);\n");
     push(@$outputArray, "    }\n");
 
     push(@$outputArray, "protected:\n");
@@ -2907,7 +2907,7 @@ sub GenerateConstructorDefinition
     push(@$outputArray, "const ClassInfo ${constructorClassName}::s_info = { \"${visibleClassName}Constructor\", &DOMConstructorObject::s_info, &${constructorClassName}Table, 0 };\n\n");
 
     push(@$outputArray, "${constructorClassName}::${constructorClassName}(ExecState* exec, JSDOMGlobalObject* globalObject)\n");
-    push(@$outputArray, "    : DOMConstructorObject(${constructorClassName}::createStructure(globalObject->objectPrototype()), globalObject)\n");
+    push(@$outputArray, "    : DOMConstructorObject(${constructorClassName}::createStructure(globalObject->globalData(), globalObject->objectPrototype()), globalObject)\n");
     push(@$outputArray, "{\n");
     push(@$outputArray, "    ASSERT(inherits(&s_info));\n");
     if ($interfaceName eq "DOMWindow") {
diff --git a/Source/WebCore/bindings/scripts/CodeGeneratorV8.pm b/Source/WebCore/bindings/scripts/CodeGeneratorV8.pm
index df1c04a..6fc0b9a 100644
--- a/Source/WebCore/bindings/scripts/CodeGeneratorV8.pm
+++ b/Source/WebCore/bindings/scripts/CodeGeneratorV8.pm
@@ -128,7 +128,7 @@ sub AddIncludesForType
 
     # When we're finished with the one-file-per-class
     # reorganization, we won't need these special cases.
-    if (!$codeGenerator->IsPrimitiveType($type) and !$codeGenerator->AvoidInclusionOfType($type) and $type ne "Date") {
+    if (!$codeGenerator->IsPrimitiveType($type) and !$codeGenerator->IsStringType($type) and !$codeGenerator->AvoidInclusionOfType($type) and $type ne "Date") {
         # default, include the same named file
         $implIncludes{GetV8HeaderName(${type})} = 1;
 
@@ -1716,8 +1716,22 @@ sub GenerateImplementation
 
     my $toActive = IsActiveDomType($interfaceName) ? "${className}::toActiveDOMObject" : "0";
 
+    # Find the super descriptor.
+    my $parentClass = "";
+    my $parentClassTemplate = "";
+    foreach (@{$dataNode->parents}) {
+        my $parent = $codeGenerator->StripModule($_);
+        if ($parent eq "EventTarget") {
+            next;
+        }
+        $implIncludes{"V8${parent}.h"} = 1;
+        $parentClass = "V8" . $parent;
+        $parentClassTemplate = $parentClass . "::GetTemplate()";
+        last;
+    }
     push(@implContentDecls, "namespace WebCore {\n\n");
-    push(@implContentDecls, "WrapperTypeInfo ${className}::info = { ${className}::GetTemplate, ${className}::derefObject, ${toActive} };\n\n");   
+    my $parentClassInfo = $parentClass ? "&${parentClass}::info" : "0";
+    push(@implContentDecls, "WrapperTypeInfo ${className}::info = { ${className}::GetTemplate, ${className}::derefObject, ${toActive}, ${parentClassInfo} };\n\n");   
     push(@implContentDecls, "namespace ${interfaceName}Internal {\n\n");
     push(@implContentDecls, "template <typename T> void V8_USE(T) { }\n\n");
 
@@ -1941,15 +1955,6 @@ static v8::Persistent<v8::ObjectTemplate> ConfigureShadowObjectTemplate(v8::Pers
 END
     }
 
-    # find the super descriptor
-    my $parentClassTemplate = "";
-    foreach (@{$dataNode->parents}) {
-        my $parent = $codeGenerator->StripModule($_);
-        if ($parent eq "EventTarget") { next; }
-        $implIncludes{"V8${parent}.h"} = 1;
-        $parentClassTemplate = "V8" . $parent . "::GetTemplate()";
-        last;
-    }
     if (!$parentClassTemplate) {
         $parentClassTemplate = "v8::Persistent<v8::FunctionTemplate>()";
     }
@@ -2506,7 +2511,15 @@ END
     }
 
     push(@implContent, <<END);
-    ${domMapFunction}.set(impl, v8::Persistent<v8::Object>::New(wrapper));
+    v8::Persistent<v8::Object> wrapperHandle = v8::Persistent<v8::Object>::New(wrapper);
+END
+    if (IsNodeSubType($dataNode)) {
+        push(@implContent, <<END);
+    wrapperHandle.SetWrapperClassId(v8DOMSubtreeClassId);
+END
+    }    
+    push(@implContent, <<END);
+    ${domMapFunction}.set(impl, wrapperHandle);
 END
 
     push(@implContent, <<END);
@@ -2833,6 +2846,7 @@ sub GetNativeType
 
     return "RefPtr<MediaQueryListListener>" if $type eq "MediaQueryListListener";
 
+    return "PassRefPtr<DOMStringList>" if $type eq "DOMStringList" and $isParameter;
     return "RefPtr<DOMStringList>" if $type eq "DOMStringList";
 
     # Default, assume native type is a pointer with same type name as idl type
diff --git a/Source/WebCore/bindings/scripts/test/CPP/WebDOMTestCallback.cpp b/Source/WebCore/bindings/scripts/test/CPP/WebDOMTestCallback.cpp
index 62ebc3c..d12d0c3 100644
--- a/Source/WebCore/bindings/scripts/test/CPP/WebDOMTestCallback.cpp
+++ b/Source/WebCore/bindings/scripts/test/CPP/WebDOMTestCallback.cpp
@@ -27,11 +27,13 @@
 #include "Class1.h"
 #include "Class2.h"
 #include "Class3.h"
+#include "DOMStringList.h"
 #include "KURL.h"
 #include "TestCallback.h"
 #include "WebDOMClass1.h"
 #include "WebDOMClass2.h"
 #include "WebDOMClass3.h"
+#include "WebDOMDOMStringList.h"
 #include "WebDOMString.h"
 #include "WebExceptionHandler.h"
 #include "wtf/text/AtomicString.h"
@@ -115,6 +117,14 @@ int WebDOMTestCallback::callbackWithNonBoolReturnType(const WebDOMClass3& class3
     return impl()->callbackWithNonBoolReturnType(toWebCore(class3Param));
 }
 
+bool WebDOMTestCallback::callbackWithStringList(const WebDOMDOMStringList& listParam)
+{
+    if (!impl())
+        return false;
+
+    return impl()->callbackWithStringList(toWebCore(listParam));
+}
+
 WebCore::TestCallback* toWebCore(const WebDOMTestCallback& wrapper)
 {
     return wrapper.impl();
diff --git a/Source/WebCore/bindings/scripts/test/CPP/WebDOMTestCallback.h b/Source/WebCore/bindings/scripts/test/CPP/WebDOMTestCallback.h
index 7a077e2..8d11a4b 100644
--- a/Source/WebCore/bindings/scripts/test/CPP/WebDOMTestCallback.h
+++ b/Source/WebCore/bindings/scripts/test/CPP/WebDOMTestCallback.h
@@ -37,6 +37,7 @@ class WebDOMClass2;
 class WebDOMClass3;
 class WebDOMClass5;
 class WebDOMClass6;
+class WebDOMDOMStringList;
 
 class WebDOMTestCallback : public WebDOMObject {
 public:
@@ -51,6 +52,7 @@ public:
     bool callbackWithClass2Param(const WebDOMClass2& class2Param, const WebDOMString& strArg);
     int callbackWithNonBoolReturnType(const WebDOMClass3& class3Param);
     int customCallback(const WebDOMClass5& class5Param, const WebDOMClass6& class6Param);
+    bool callbackWithStringList(const WebDOMDOMStringList& listParam);
 
     WebCore::TestCallback* impl() const;
 
diff --git a/Source/WebCore/bindings/scripts/test/GObject/WebKitDOMTestCallback.cpp b/Source/WebCore/bindings/scripts/test/GObject/WebKitDOMTestCallback.cpp
index 054dc38..b63f50e 100644
--- a/Source/WebCore/bindings/scripts/test/GObject/WebKitDOMTestCallback.cpp
+++ b/Source/WebCore/bindings/scripts/test/GObject/WebKitDOMTestCallback.cpp
@@ -37,6 +37,8 @@
 #include "webkit/WebKitDOMClass2Private.h"
 #include "webkit/WebKitDOMClass3.h"
 #include "webkit/WebKitDOMClass3Private.h"
+#include "webkit/WebKitDOMDOMStringList.h"
+#include "webkit/WebKitDOMDOMStringListPrivate.h"
 #include "webkit/WebKitDOMTestCallback.h"
 #include "webkit/WebKitDOMTestCallbackPrivate.h"
 #include "webkitdefines.h"
@@ -117,6 +119,22 @@ webkit_dom_test_callback_callback_with_non_bool_return_type(WebKitDOMTestCallbac
     return res;
 }
 
+gboolean
+webkit_dom_test_callback_callback_with_string_list(WebKitDOMTestCallback* self, WebKitDOMDOMStringList* list_param)
+{
+    g_return_val_if_fail(self, 0);
+    WebCore::JSMainThreadNullState state;
+    WebCore::TestCallback * item = WebKit::core(self);
+    g_return_val_if_fail(list_param, 0);
+    WebCore::DOMStringList * converted_list_param = NULL;
+    if (list_param != NULL) {
+        converted_list_param = WebKit::core(list_param);
+        g_return_val_if_fail(converted_list_param, 0);
+    }
+    gboolean res = item->callbackWithStringList(converted_list_param);
+    return res;
+}
+
 
 G_DEFINE_TYPE(WebKitDOMTestCallback, webkit_dom_test_callback, WEBKIT_TYPE_DOM_OBJECT)
 
diff --git a/Source/WebCore/bindings/scripts/test/GObject/WebKitDOMTestCallback.h b/Source/WebCore/bindings/scripts/test/GObject/WebKitDOMTestCallback.h
index 6049c79..541afb2 100644
--- a/Source/WebCore/bindings/scripts/test/GObject/WebKitDOMTestCallback.h
+++ b/Source/WebCore/bindings/scripts/test/GObject/WebKitDOMTestCallback.h
@@ -58,6 +58,9 @@ webkit_dom_test_callback_callback_with_class2param(WebKitDOMTestCallback* self,
 WEBKIT_API glong
 webkit_dom_test_callback_callback_with_non_bool_return_type(WebKitDOMTestCallback* self, WebKitDOMClass3* class3param);
 
+WEBKIT_API gboolean
+webkit_dom_test_callback_callback_with_string_list(WebKitDOMTestCallback* self, WebKitDOMDOMStringList* list_param);
+
 G_END_DECLS
 
 #endif /* WebKitDOMTestCallback_h */
diff --git a/Source/WebCore/bindings/scripts/test/GObject/WebKitDOMTestObj.cpp b/Source/WebCore/bindings/scripts/test/GObject/WebKitDOMTestObj.cpp
index 44d58d4..1f81c5d 100644
--- a/Source/WebCore/bindings/scripts/test/GObject/WebKitDOMTestObj.cpp
+++ b/Source/WebCore/bindings/scripts/test/GObject/WebKitDOMTestObj.cpp
@@ -250,12 +250,6 @@ webkit_dom_test_obj_method_with_exception(WebKitDOMTestObj* self, GError **error
     }
 }
 
-
-/* TODO: event function webkit_dom_test_obj_add_event_listener */
-
-
-/* TODO: event function webkit_dom_test_obj_remove_event_listener */
-
 void
 webkit_dom_test_obj_with_dynamic_frame(WebKitDOMTestObj* self)
 {
diff --git a/Source/WebCore/bindings/scripts/test/GObject/WebKitDOMTestObj.h b/Source/WebCore/bindings/scripts/test/GObject/WebKitDOMTestObj.h
index 0416664..0f0f3c1 100644
--- a/Source/WebCore/bindings/scripts/test/GObject/WebKitDOMTestObj.h
+++ b/Source/WebCore/bindings/scripts/test/GObject/WebKitDOMTestObj.h
@@ -82,12 +82,6 @@ webkit_dom_test_obj_options_object(WebKitDOMTestObj* self, WebKitDOMOptionsObjec
 WEBKIT_API void
 webkit_dom_test_obj_method_with_exception(WebKitDOMTestObj* self, GError **error);
 
-
-/* TODO: event function webkit_dom_test_obj_add_event_listener */
-
-
-/* TODO: event function webkit_dom_test_obj_remove_event_listener */
-
 WEBKIT_API void
 webkit_dom_test_obj_with_dynamic_frame(WebKitDOMTestObj* self);
 
diff --git a/Source/WebCore/bindings/scripts/test/JS/JSTestCallback.cpp b/Source/WebCore/bindings/scripts/test/JS/JSTestCallback.cpp
index 1f48ee9..a5234d9 100644
--- a/Source/WebCore/bindings/scripts/test/JS/JSTestCallback.cpp
+++ b/Source/WebCore/bindings/scripts/test/JS/JSTestCallback.cpp
@@ -26,6 +26,7 @@
 
 #include "JSClass1.h"
 #include "JSClass2.h"
+#include "JSDOMStringList.h"
 #include "ScriptExecutionContext.h"
 #include <runtime/JSLock.h>
 #include <wtf/MainThread.h>
@@ -110,6 +111,24 @@ bool JSTestCallback::callbackWithClass2Param(Class2* class2Param, const String&
     return !raisedException;
 }
 
+bool JSTestCallback::callbackWithStringList(DOMStringList* listParam)
+{
+    if (!canInvokeCallback())
+        return true;
+
+    RefPtr<JSTestCallback> protect(this);
+
+    JSLock lock(SilenceAssertionsOnly);
+
+    ExecState* exec = m_data->globalObject()->globalExec();
+    MarkedArgumentBuffer args;
+    args.append(toJS(exec, listParam));
+
+    bool raisedException = false;
+    m_data->invokeCallback(args, &raisedException);
+    return !raisedException;
+}
+
 }
 
 #endif // ENABLE(DATABASE)
diff --git a/Source/WebCore/bindings/scripts/test/JS/JSTestCallback.h b/Source/WebCore/bindings/scripts/test/JS/JSTestCallback.h
index ba3559c..226e874 100644
--- a/Source/WebCore/bindings/scripts/test/JS/JSTestCallback.h
+++ b/Source/WebCore/bindings/scripts/test/JS/JSTestCallback.h
@@ -45,6 +45,7 @@ public:
     virtual bool callbackWithClass2Param(Class2* class2Param, const String& strArg);
     COMPILE_ASSERT(false)    virtual int callbackWithNonBoolReturnType(Class3* class3Param);
     virtual int customCallback(Class5* class5Param, Class6* class6Param);
+    virtual bool callbackWithStringList(DOMStringList* listParam);
 
 private:
     JSTestCallback(JSC::JSObject* callback, JSDOMGlobalObject*);
diff --git a/Source/WebCore/bindings/scripts/test/JS/JSTestInterface.cpp b/Source/WebCore/bindings/scripts/test/JS/JSTestInterface.cpp
index 8d519f5..ce0fef6 100644
--- a/Source/WebCore/bindings/scripts/test/JS/JSTestInterface.cpp
+++ b/Source/WebCore/bindings/scripts/test/JS/JSTestInterface.cpp
@@ -69,9 +69,9 @@ public:
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static const JSC::ClassInfo s_info;
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSGlobalData& globalData, JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
+        return JSC::Structure::create(globalData, prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
     }
 protected:
     static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | JSC::ImplementsHasInstance | DOMConstructorObject::StructureFlags;
@@ -82,7 +82,7 @@ protected:
 const ClassInfo JSTestInterfaceConstructor::s_info = { "TestInterfaceConstructor", &DOMConstructorObject::s_info, &JSTestInterfaceConstructorTable, 0 };
 
 JSTestInterfaceConstructor::JSTestInterfaceConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
-    : DOMConstructorObject(JSTestInterfaceConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+    : DOMConstructorObject(JSTestInterfaceConstructor::createStructure(globalObject->globalData(), globalObject->objectPrototype()), globalObject)
 {
     ASSERT(inherits(&s_info));
     putDirect(exec->globalData(), exec->propertyNames().prototype, JSTestInterfacePrototype::self(exec, globalObject), DontDelete | ReadOnly);
@@ -144,7 +144,7 @@ JSTestInterface::JSTestInterface(NonNullPassRefPtr<Structure> structure, JSDOMGl
 
 JSObject* JSTestInterface::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSTestInterfacePrototype(globalObject, JSTestInterfacePrototype::createStructure(globalObject->objectPrototype()));
+    return new (exec) JSTestInterfacePrototype(globalObject, JSTestInterfacePrototype::createStructure(globalObject->globalData(), globalObject->objectPrototype()));
 }
 
 bool JSTestInterface::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
diff --git a/Source/WebCore/bindings/scripts/test/JS/JSTestInterface.h b/Source/WebCore/bindings/scripts/test/JS/JSTestInterface.h
index 2cabc23..5ee33a0 100644
--- a/Source/WebCore/bindings/scripts/test/JS/JSTestInterface.h
+++ b/Source/WebCore/bindings/scripts/test/JS/JSTestInterface.h
@@ -41,9 +41,9 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSGlobalData& globalData, JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
+        return JSC::Structure::create(globalData, prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -63,9 +63,9 @@ class JSTestInterfacePrototype : public JSC::JSObjectWithGlobalObject {
 public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     static const JSC::ClassInfo s_info;
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSGlobalData& globalData, JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
+        return JSC::Structure::create(globalData, prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
     }
     JSTestInterfacePrototype(JSC::JSGlobalObject* globalObject, NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObjectWithGlobalObject(globalObject, structure) { }
 protected:
diff --git a/Source/WebCore/bindings/scripts/test/JS/JSTestMediaQueryListListener.cpp b/Source/WebCore/bindings/scripts/test/JS/JSTestMediaQueryListListener.cpp
index 0e5edeb..efaee3b 100644
--- a/Source/WebCore/bindings/scripts/test/JS/JSTestMediaQueryListListener.cpp
+++ b/Source/WebCore/bindings/scripts/test/JS/JSTestMediaQueryListListener.cpp
@@ -70,9 +70,9 @@ public:
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static const JSC::ClassInfo s_info;
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSGlobalData& globalData, JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
+        return JSC::Structure::create(globalData, prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
     }
 protected:
     static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | JSC::ImplementsHasInstance | DOMConstructorObject::StructureFlags;
@@ -81,7 +81,7 @@ protected:
 const ClassInfo JSTestMediaQueryListListenerConstructor::s_info = { "TestMediaQueryListListenerConstructor", &DOMConstructorObject::s_info, &JSTestMediaQueryListListenerConstructorTable, 0 };
 
 JSTestMediaQueryListListenerConstructor::JSTestMediaQueryListListenerConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
-    : DOMConstructorObject(JSTestMediaQueryListListenerConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+    : DOMConstructorObject(JSTestMediaQueryListListenerConstructor::createStructure(globalObject->globalData(), globalObject->objectPrototype()), globalObject)
 {
     ASSERT(inherits(&s_info));
     putDirect(exec->globalData(), exec->propertyNames().prototype, JSTestMediaQueryListListenerPrototype::self(exec, globalObject), DontDelete | ReadOnly);
@@ -140,7 +140,7 @@ JSTestMediaQueryListListener::JSTestMediaQueryListListener(NonNullPassRefPtr<Str
 
 JSObject* JSTestMediaQueryListListener::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSTestMediaQueryListListenerPrototype(globalObject, JSTestMediaQueryListListenerPrototype::createStructure(globalObject->objectPrototype()));
+    return new (exec) JSTestMediaQueryListListenerPrototype(globalObject, JSTestMediaQueryListListenerPrototype::createStructure(globalObject->globalData(), globalObject->objectPrototype()));
 }
 
 bool JSTestMediaQueryListListener::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
diff --git a/Source/WebCore/bindings/scripts/test/JS/JSTestMediaQueryListListener.h b/Source/WebCore/bindings/scripts/test/JS/JSTestMediaQueryListListener.h
index a9f8606..fdb8a02 100644
--- a/Source/WebCore/bindings/scripts/test/JS/JSTestMediaQueryListListener.h
+++ b/Source/WebCore/bindings/scripts/test/JS/JSTestMediaQueryListListener.h
@@ -39,9 +39,9 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSGlobalData& globalData, JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
+        return JSC::Structure::create(globalData, prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -63,9 +63,9 @@ public:
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSGlobalData& globalData, JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
+        return JSC::Structure::create(globalData, prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
     }
     JSTestMediaQueryListListenerPrototype(JSC::JSGlobalObject* globalObject, NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObjectWithGlobalObject(globalObject, structure) { }
 protected:
diff --git a/Source/WebCore/bindings/scripts/test/JS/JSTestObj.cpp b/Source/WebCore/bindings/scripts/test/JS/JSTestObj.cpp
index fd2f4d9..a98cafa 100644
--- a/Source/WebCore/bindings/scripts/test/JS/JSTestObj.cpp
+++ b/Source/WebCore/bindings/scripts/test/JS/JSTestObj.cpp
@@ -149,9 +149,9 @@ public:
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static const JSC::ClassInfo s_info;
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSGlobalData& globalData, JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
+        return JSC::Structure::create(globalData, prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
     }
 protected:
     static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | JSC::ImplementsHasInstance | DOMConstructorObject::StructureFlags;
@@ -160,7 +160,7 @@ protected:
 const ClassInfo JSTestObjConstructor::s_info = { "TestObjConstructor", &DOMConstructorObject::s_info, &JSTestObjConstructorTable, 0 };
 
 JSTestObjConstructor::JSTestObjConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
-    : DOMConstructorObject(JSTestObjConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+    : DOMConstructorObject(JSTestObjConstructor::createStructure(globalObject->globalData(), globalObject->objectPrototype()), globalObject)
 {
     ASSERT(inherits(&s_info));
     putDirect(exec->globalData(), exec->propertyNames().prototype, JSTestObjPrototype::self(exec, globalObject), DontDelete | ReadOnly);
@@ -265,7 +265,7 @@ JSTestObj::JSTestObj(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject*
 
 JSObject* JSTestObj::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSTestObjPrototype(globalObject, JSTestObjPrototype::createStructure(globalObject->objectPrototype()));
+    return new (exec) JSTestObjPrototype(globalObject, JSTestObjPrototype::createStructure(globalObject->globalData(), globalObject->objectPrototype()));
 }
 
 bool JSTestObj::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
diff --git a/Source/WebCore/bindings/scripts/test/JS/JSTestObj.h b/Source/WebCore/bindings/scripts/test/JS/JSTestObj.h
index 7e21168..751239b 100644
--- a/Source/WebCore/bindings/scripts/test/JS/JSTestObj.h
+++ b/Source/WebCore/bindings/scripts/test/JS/JSTestObj.h
@@ -40,9 +40,9 @@ public:
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSGlobalData& globalData, JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
+        return JSC::Structure::create(globalData, prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -72,9 +72,9 @@ public:
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSGlobalData& globalData, JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
+        return JSC::Structure::create(globalData, prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
     }
     JSTestObjPrototype(JSC::JSGlobalObject* globalObject, NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObjectWithGlobalObject(globalObject, structure) { }
 protected:
diff --git a/Source/WebCore/bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.cpp b/Source/WebCore/bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.cpp
index 5dd6c44..535f99b 100644
--- a/Source/WebCore/bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.cpp
+++ b/Source/WebCore/bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.cpp
@@ -71,9 +71,9 @@ public:
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static const JSC::ClassInfo s_info;
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSGlobalData& globalData, JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
+        return JSC::Structure::create(globalData, prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
     }
 protected:
     static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | JSC::ImplementsHasInstance | DOMConstructorObject::StructureFlags;
@@ -82,7 +82,7 @@ protected:
 const ClassInfo JSTestSerializedScriptValueInterfaceConstructor::s_info = { "TestSerializedScriptValueInterfaceConstructor", &DOMConstructorObject::s_info, &JSTestSerializedScriptValueInterfaceConstructorTable, 0 };
 
 JSTestSerializedScriptValueInterfaceConstructor::JSTestSerializedScriptValueInterfaceConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
-    : DOMConstructorObject(JSTestSerializedScriptValueInterfaceConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+    : DOMConstructorObject(JSTestSerializedScriptValueInterfaceConstructor::createStructure(globalObject->globalData(), globalObject->objectPrototype()), globalObject)
 {
     ASSERT(inherits(&s_info));
     putDirect(exec->globalData(), exec->propertyNames().prototype, JSTestSerializedScriptValueInterfacePrototype::self(exec, globalObject), DontDelete | ReadOnly);
@@ -130,7 +130,7 @@ JSTestSerializedScriptValueInterface::JSTestSerializedScriptValueInterface(NonNu
 
 JSObject* JSTestSerializedScriptValueInterface::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSTestSerializedScriptValueInterfacePrototype(globalObject, JSTestSerializedScriptValueInterfacePrototype::createStructure(globalObject->objectPrototype()));
+    return new (exec) JSTestSerializedScriptValueInterfacePrototype(globalObject, JSTestSerializedScriptValueInterfacePrototype::createStructure(globalObject->globalData(), globalObject->objectPrototype()));
 }
 
 bool JSTestSerializedScriptValueInterface::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
diff --git a/Source/WebCore/bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.h b/Source/WebCore/bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.h
index 175fb12..d5f8879 100644
--- a/Source/WebCore/bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.h
+++ b/Source/WebCore/bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.h
@@ -41,9 +41,9 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSGlobalData& globalData, JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
+        return JSC::Structure::create(globalData, prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -63,9 +63,9 @@ class JSTestSerializedScriptValueInterfacePrototype : public JSC::JSObjectWithGl
 public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     static const JSC::ClassInfo s_info;
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSGlobalData& globalData, JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
+        return JSC::Structure::create(globalData, prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
     }
     JSTestSerializedScriptValueInterfacePrototype(JSC::JSGlobalObject* globalObject, NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObjectWithGlobalObject(globalObject, structure) { }
 protected:
diff --git a/Source/WebCore/bindings/scripts/test/ObjC/DOMTestCallback.h b/Source/WebCore/bindings/scripts/test/ObjC/DOMTestCallback.h
index 08c30b7..3d6f7bd 100644
--- a/Source/WebCore/bindings/scripts/test/ObjC/DOMTestCallback.h
+++ b/Source/WebCore/bindings/scripts/test/ObjC/DOMTestCallback.h
@@ -33,6 +33,7 @@
 @class DOMClass3;
 @class DOMClass5;
 @class DOMClass6;
+@class DOMDOMStringList;
 @class NSString;
 
 @interface DOMTestCallback : DOMObject
@@ -41,6 +42,7 @@
 - (BOOL)callbackWithClass2Param:(DOMClass2 *)class2Param strArg:(NSString *)strArg;
 - (int)callbackWithNonBoolReturnType:(DOMClass3 *)class3Param;
 - (int)customCallback:(DOMClass5 *)class5Param class6Param:(DOMClass6 *)class6Param;
+- (BOOL)callbackWithStringList:(DOMDOMStringList *)listParam;
 @end
 
 #endif
diff --git a/Source/WebCore/bindings/scripts/test/ObjC/DOMTestCallback.mm b/Source/WebCore/bindings/scripts/test/ObjC/DOMTestCallback.mm
index c4be39d..e070de5 100644
--- a/Source/WebCore/bindings/scripts/test/ObjC/DOMTestCallback.mm
+++ b/Source/WebCore/bindings/scripts/test/ObjC/DOMTestCallback.mm
@@ -45,8 +45,10 @@
 #import "DOMClass3Internal.h"
 #import "DOMClass5Internal.h"
 #import "DOMClass6Internal.h"
+#import "DOMDOMStringListInternal.h"
 #import "DOMEventInternal.h"
 #import "DOMNodeInternal.h"
+#import "DOMStringList.h"
 #import "DOMStyleSheetInternal.h"
 #import "DOMTestCallbackInternal.h"
 #import "ExceptionHandlers.h"
@@ -109,6 +111,12 @@
     return IMPL->customCallback(core(class5Param), core(class6Param));
 }
 
+- (BOOL)callbackWithStringList:(DOMDOMStringList *)listParam
+{
+    WebCore::JSMainThreadNullState state;
+    return IMPL->callbackWithStringList(core(listParam));
+}
+
 @end
 
 WebCore::TestCallback* core(DOMTestCallback *wrapper)
diff --git a/Source/WebCore/bindings/scripts/test/TestCallback.idl b/Source/WebCore/bindings/scripts/test/TestCallback.idl
index 9679a5a..2475251 100644
--- a/Source/WebCore/bindings/scripts/test/TestCallback.idl
+++ b/Source/WebCore/bindings/scripts/test/TestCallback.idl
@@ -38,5 +38,6 @@ module test {
       boolean callbackWithClass2Param(in Class2 class2Param, in DOMString strArg);
       long callbackWithNonBoolReturnType(in Class3 class3Param);
       [Custom] long customCallback(in Class5 class5Param, in Class6 class6Param);
+      boolean callbackWithStringList(in DOMStringList listParam);
     };
 }
diff --git a/Source/WebCore/bindings/scripts/test/V8/V8TestCallback.cpp b/Source/WebCore/bindings/scripts/test/V8/V8TestCallback.cpp
index 057302d..c17f73d 100644
--- a/Source/WebCore/bindings/scripts/test/V8/V8TestCallback.cpp
+++ b/Source/WebCore/bindings/scripts/test/V8/V8TestCallback.cpp
@@ -27,7 +27,7 @@
 #include "V8Class1.h"
 #include "V8Class2.h"
 #include "V8CustomVoidCallback.h"
-#include "V8DOMString.h"
+#include "V8DOMStringList.h"
 #include "V8Proxy.h"
 #include <wtf/GetPtr.h>
 #include <wtf/RefCounted.h>
@@ -131,6 +131,33 @@ bool V8TestCallback::callbackWithClass2Param(Class2* class2Param, const String&
     return !invokeCallback(m_callback, 2, argv, callbackReturnValue, scriptExecutionContext());
 }
 
+bool V8TestCallback::callbackWithStringList(PassRefPtr<DOMStringList> listParam)
+{
+    if (!canInvokeCallback())
+        return true;
+
+    v8::HandleScope handleScope;
+
+    v8::Handle<v8::Context> v8Context = toV8Context(scriptExecutionContext(), m_worldContext);
+    if (v8Context.IsEmpty())
+        return true;
+
+    v8::Context::Scope scope(v8Context);
+
+    v8::Handle<v8::Value> listParamHandle = toV8(listParam);
+    if (listParamHandle.IsEmpty()) {
+        CRASH();
+        return true;
+    }
+
+    v8::Handle<v8::Value> argv[] = {
+        listParamHandle
+    };
+
+    bool callbackReturnValue = false;
+    return !invokeCallback(m_callback, 1, argv, callbackReturnValue, scriptExecutionContext());
+}
+
 } // namespace WebCore
 
 #endif // ENABLE(DATABASE)
diff --git a/Source/WebCore/bindings/scripts/test/V8/V8TestCallback.h b/Source/WebCore/bindings/scripts/test/V8/V8TestCallback.h
index 8ff8c26..194f13c 100644
--- a/Source/WebCore/bindings/scripts/test/V8/V8TestCallback.h
+++ b/Source/WebCore/bindings/scripts/test/V8/V8TestCallback.h
@@ -50,6 +50,7 @@ public:
     virtual bool callbackWithClass2Param(Class2* class2Param, const String& strArg);
     COMPILE_ASSERT(false)    virtual int callbackWithNonBoolReturnType(Class3* class3Param);
     virtual int customCallback(Class5* class5Param, Class6* class6Param);
+    virtual bool callbackWithStringList(PassRefPtr<DOMStringList> listParam);
 
 private:
     V8TestCallback(v8::Local<v8::Object>, ScriptExecutionContext*);
diff --git a/Source/WebCore/bindings/scripts/test/V8/V8TestInterface.cpp b/Source/WebCore/bindings/scripts/test/V8/V8TestInterface.cpp
index 4c40d98..21c8804 100644
--- a/Source/WebCore/bindings/scripts/test/V8/V8TestInterface.cpp
+++ b/Source/WebCore/bindings/scripts/test/V8/V8TestInterface.cpp
@@ -33,7 +33,7 @@
 
 namespace WebCore {
 
-WrapperTypeInfo V8TestInterface::info = { V8TestInterface::GetTemplate, V8TestInterface::derefObject, 0 };
+WrapperTypeInfo V8TestInterface::info = { V8TestInterface::GetTemplate, V8TestInterface::derefObject, 0, 0 };
 
 namespace TestInterfaceInternal {
 
@@ -87,7 +87,8 @@ v8::Handle<v8::Object> V8TestInterface::wrapSlow(TestInterface* impl)
         return wrapper;
 
     impl->ref();
-    getDOMObjectMap().set(impl, v8::Persistent<v8::Object>::New(wrapper));
+    v8::Persistent<v8::Object> wrapperHandle = v8::Persistent<v8::Object>::New(wrapper);
+    getDOMObjectMap().set(impl, wrapperHandle);
     return wrapper;
 }
 
diff --git a/Source/WebCore/bindings/scripts/test/V8/V8TestMediaQueryListListener.cpp b/Source/WebCore/bindings/scripts/test/V8/V8TestMediaQueryListListener.cpp
index ab9e6db..6d71ea7 100644
--- a/Source/WebCore/bindings/scripts/test/V8/V8TestMediaQueryListListener.cpp
+++ b/Source/WebCore/bindings/scripts/test/V8/V8TestMediaQueryListListener.cpp
@@ -33,7 +33,7 @@
 
 namespace WebCore {
 
-WrapperTypeInfo V8TestMediaQueryListListener::info = { V8TestMediaQueryListListener::GetTemplate, V8TestMediaQueryListListener::derefObject, 0 };
+WrapperTypeInfo V8TestMediaQueryListListener::info = { V8TestMediaQueryListListener::GetTemplate, V8TestMediaQueryListListener::derefObject, 0, 0 };
 
 namespace TestMediaQueryListListenerInternal {
 
@@ -94,7 +94,8 @@ v8::Handle<v8::Object> V8TestMediaQueryListListener::wrapSlow(TestMediaQueryList
         return wrapper;
 
     impl->ref();
-    getDOMObjectMap().set(impl, v8::Persistent<v8::Object>::New(wrapper));
+    v8::Persistent<v8::Object> wrapperHandle = v8::Persistent<v8::Object>::New(wrapper);
+    getDOMObjectMap().set(impl, wrapperHandle);
     return wrapper;
 }
 
diff --git a/Source/WebCore/bindings/scripts/test/V8/V8TestObj.cpp b/Source/WebCore/bindings/scripts/test/V8/V8TestObj.cpp
index 4298756..5884e89 100644
--- a/Source/WebCore/bindings/scripts/test/V8/V8TestObj.cpp
+++ b/Source/WebCore/bindings/scripts/test/V8/V8TestObj.cpp
@@ -46,7 +46,7 @@
 
 namespace WebCore {
 
-WrapperTypeInfo V8TestObj::info = { V8TestObj::GetTemplate, V8TestObj::derefObject, 0 };
+WrapperTypeInfo V8TestObj::info = { V8TestObj::GetTemplate, V8TestObj::derefObject, 0, 0 };
 
 namespace TestObjInternal {
 
@@ -1380,7 +1380,8 @@ v8::Handle<v8::Object> V8TestObj::wrapSlow(TestObj* impl)
         return wrapper;
 
     impl->ref();
-    getDOMObjectMap().set(impl, v8::Persistent<v8::Object>::New(wrapper));
+    v8::Persistent<v8::Object> wrapperHandle = v8::Persistent<v8::Object>::New(wrapper);
+    getDOMObjectMap().set(impl, wrapperHandle);
     return wrapper;
 }
 
diff --git a/Source/WebCore/bindings/scripts/test/V8/V8TestSerializedScriptValueInterface.cpp b/Source/WebCore/bindings/scripts/test/V8/V8TestSerializedScriptValueInterface.cpp
index fef8dbd..c6cc4d6 100644
--- a/Source/WebCore/bindings/scripts/test/V8/V8TestSerializedScriptValueInterface.cpp
+++ b/Source/WebCore/bindings/scripts/test/V8/V8TestSerializedScriptValueInterface.cpp
@@ -34,7 +34,7 @@
 
 namespace WebCore {
 
-WrapperTypeInfo V8TestSerializedScriptValueInterface::info = { V8TestSerializedScriptValueInterface::GetTemplate, V8TestSerializedScriptValueInterface::derefObject, 0 };
+WrapperTypeInfo V8TestSerializedScriptValueInterface::info = { V8TestSerializedScriptValueInterface::GetTemplate, V8TestSerializedScriptValueInterface::derefObject, 0, 0 };
 
 namespace TestSerializedScriptValueInterfaceInternal {
 
@@ -83,7 +83,8 @@ v8::Handle<v8::Object> V8TestSerializedScriptValueInterface::wrapSlow(TestSerial
 
     impl->ref();
     SerializedScriptValue::deserializeAndSetProperty(wrapper, "value", static_cast<v8::PropertyAttribute>(v8::DontDelete | v8::ReadOnly), impl->value());
-    getDOMObjectMap().set(impl, v8::Persistent<v8::Object>::New(wrapper));
+    v8::Persistent<v8::Object> wrapperHandle = v8::Persistent<v8::Object>::New(wrapper);
+    getDOMObjectMap().set(impl, wrapperHandle);
     return wrapper;
 }
 
diff --git a/Source/WebCore/bindings/v8/DebuggerScript.js b/Source/WebCore/bindings/v8/DebuggerScript.js
index 0bed33d..fe6e8ab 100644
--- a/Source/WebCore/bindings/v8/DebuggerScript.js
+++ b/Source/WebCore/bindings/v8/DebuggerScript.js
@@ -262,5 +262,4 @@ DebuggerScript._frameMirrorToJSCallFrame = function(frameMirror, callerFrame)
 }
 
 return DebuggerScript;
-
 })();
diff --git a/Source/WebCore/bindings/v8/PageScriptDebugServer.cpp b/Source/WebCore/bindings/v8/PageScriptDebugServer.cpp
new file mode 100755
index 0000000..f149d8f
--- /dev/null
+++ b/Source/WebCore/bindings/v8/PageScriptDebugServer.cpp
@@ -0,0 +1,165 @@
+/*
+ * Copyright (c) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "PageScriptDebugServer.h"
+
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+
+#include "Frame.h"
+#include "Page.h"
+#include "ScriptDebugListener.h"
+#include "V8Binding.h"
+#include "V8DOMWindow.h"
+#include "V8Proxy.h"
+#include <wtf/OwnPtr.h>
+#include <wtf/PassOwnPtr.h>
+#include <wtf/StdLibExtras.h>
+
+namespace WebCore {
+
+static Frame* retrieveFrame(v8::Handle<v8::Context> context)
+{
+    if (context.IsEmpty())
+        return 0;
+
+    // Test that context has associated global dom window object.
+    v8::Handle<v8::Object> global = context->Global();
+    if (global.IsEmpty())
+        return 0;
+
+    global = V8DOMWrapper::lookupDOMWrapper(V8DOMWindow::GetTemplate(), global);
+    if (global.IsEmpty())
+        return 0;
+
+    return V8Proxy::retrieveFrame(context);
+}
+
+PageScriptDebugServer& PageScriptDebugServer::shared()
+{
+    DEFINE_STATIC_LOCAL(PageScriptDebugServer, server, ());
+    return server;
+}
+
+PageScriptDebugServer::PageScriptDebugServer()
+    : ScriptDebugServer()
+    , m_pausedPage(0)
+    , m_enabled(true)
+{
+}
+
+void PageScriptDebugServer::addListener(ScriptDebugListener* listener, Page* page)
+{
+    if (!m_enabled)
+        return;
+
+    V8Proxy* proxy = V8Proxy::retrieve(page->mainFrame());
+    if (!proxy)
+        return;
+
+    v8::HandleScope scope;
+    v8::Local<v8::Context> debuggerContext = v8::Debug::GetDebugContext();
+    v8::Context::Scope contextScope(debuggerContext);
+
+    if (!m_listenersMap.size()) {
+        ensureDebuggerScriptCompiled();
+        ASSERT(!m_debuggerScript.get()->IsUndefined());
+        v8::Debug::SetDebugEventListener2(&PageScriptDebugServer::v8DebugEventCallback, v8::External::New(this));
+    }
+    m_listenersMap.set(page, listener);
+
+    V8DOMWindowShell* shell = proxy->windowShell();
+    if (!shell->isContextInitialized())
+        return;
+    v8::Handle<v8::Context> context = shell->context();
+    v8::Handle<v8::Function> getScriptsFunction = v8::Local<v8::Function>::Cast(m_debuggerScript.get()->Get(v8::String::New("getScripts")));
+    v8::Handle<v8::Value> argv[] = { context->GetData() };
+    v8::Handle<v8::Value> value = getScriptsFunction->Call(m_debuggerScript.get(), 1, argv);
+    if (value.IsEmpty())
+        return;
+    ASSERT(!value->IsUndefined() && value->IsArray());
+    v8::Handle<v8::Array> scriptsArray = v8::Handle<v8::Array>::Cast(value);
+    for (unsigned i = 0; i < scriptsArray->Length(); ++i)
+        dispatchDidParseSource(listener, v8::Handle<v8::Object>::Cast(scriptsArray->Get(v8::Integer::New(i))));
+}
+
+void PageScriptDebugServer::removeListener(ScriptDebugListener* listener, Page* page)
+{
+    if (!m_listenersMap.contains(page))
+        return;
+
+    if (m_pausedPage == page)
+        continueProgram();
+
+    m_listenersMap.remove(page);
+
+    if (m_listenersMap.isEmpty())
+        v8::Debug::SetDebugEventListener(0);
+    // FIXME: Remove all breakpoints set by the agent.
+}
+
+void PageScriptDebugServer::setClientMessageLoop(PassOwnPtr<ClientMessageLoop> clientMessageLoop)
+{
+    m_clientMessageLoop = clientMessageLoop;
+}
+
+ScriptDebugListener* PageScriptDebugServer::getDebugListenerForContext(v8::Handle<v8::Context> context)
+{
+    v8::HandleScope scope;
+    Frame* frame = retrieveFrame(context);
+    if (!frame)
+        return 0;
+    return m_listenersMap.get(frame->page());
+}
+
+void PageScriptDebugServer::runMessageLoopOnPause(v8::Handle<v8::Context> context)
+{
+    v8::HandleScope scope;
+    Frame* frame = retrieveFrame(context);
+    m_pausedPage = frame->page();
+
+    // Wait for continue or step command.
+    m_clientMessageLoop->run(m_pausedPage);
+
+    // The listener may have been removed in the nested loop.
+    if (ScriptDebugListener* listener = m_listenersMap.get(m_pausedPage))
+        listener->didContinue();
+     
+    m_pausedPage = 0;
+}
+
+void PageScriptDebugServer::quitMessageLoopOnPause()
+{
+    m_clientMessageLoop->quitNow();
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(JAVASCRIPT_DEBUGGER)
diff --git a/Source/WebCore/bindings/v8/PageScriptDebugServer.h b/Source/WebCore/bindings/v8/PageScriptDebugServer.h
new file mode 100755
index 0000000..4b134c1
--- /dev/null
+++ b/Source/WebCore/bindings/v8/PageScriptDebugServer.h
@@ -0,0 +1,81 @@
+/*
+ * Copyright (c) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef PageScriptDebugServer_h
+#define PageScriptDebugServer_h
+
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+
+#include "ScriptDebugServer.h"
+#include <wtf/Forward.h>
+
+namespace WebCore {
+
+class Page;
+
+class PageScriptDebugServer : public ScriptDebugServer {
+    WTF_MAKE_NONCOPYABLE(PageScriptDebugServer);
+public:
+    static PageScriptDebugServer& shared();
+
+    void addListener(ScriptDebugListener*, Page*);
+    void removeListener(ScriptDebugListener*, Page*);
+
+    // v8-specific methods.
+    void setEnabled(bool value) { m_enabled = value; }
+    
+    class ClientMessageLoop {
+    public:
+        virtual ~ClientMessageLoop() { }
+        virtual void run(Page*) = 0;
+        virtual void quitNow() = 0;
+    };
+    void setClientMessageLoop(PassOwnPtr<ClientMessageLoop>);
+
+private:
+    PageScriptDebugServer();
+    virtual ~PageScriptDebugServer() { }
+    
+    virtual ScriptDebugListener* getDebugListenerForContext(v8::Handle<v8::Context>);
+    virtual void runMessageLoopOnPause(v8::Handle<v8::Context>);
+    virtual void quitMessageLoopOnPause();
+
+    typedef HashMap<Page*, ScriptDebugListener*> ListenersMap;
+    ListenersMap m_listenersMap;
+    OwnPtr<ClientMessageLoop> m_clientMessageLoop;
+    Page* m_pausedPage;
+    bool m_enabled;
+};
+
+} // namespace WebCore
+
+#endif // ENABLE(JAVASCRIPT_DEBUGGER)
+
+#endif // PageScriptDebugServer_h
diff --git a/Source/WebCore/bindings/v8/RetainedDOMInfo.cpp b/Source/WebCore/bindings/v8/RetainedDOMInfo.cpp
new file mode 100644
index 0000000..ba64263
--- /dev/null
+++ b/Source/WebCore/bindings/v8/RetainedDOMInfo.cpp
@@ -0,0 +1,85 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ * 
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "RetainedDOMInfo.h"
+
+#include "Node.h"
+
+namespace WebCore {
+
+RetainedDOMInfo::RetainedDOMInfo(Node* root)
+    : m_root(root)
+{
+    ASSERT(m_root);
+}
+
+RetainedDOMInfo::~RetainedDOMInfo()
+{
+}
+
+void RetainedDOMInfo::Dispose()
+{
+    delete this;
+}
+
+bool RetainedDOMInfo::IsEquivalent(v8::RetainedObjectInfo* other)
+{
+    ASSERT(other);
+    return other == this || static_cast<WebCore::RetainedObjectInfo*>(other)->GetEquivalenceClass() == this->GetEquivalenceClass();
+}
+
+intptr_t RetainedDOMInfo::GetHash()
+{
+    return reinterpret_cast<intptr_t>(m_root);
+}
+    
+const char* RetainedDOMInfo::GetLabel()
+{
+    return m_root->inDocument() ? "Document DOM tree" : "Detached DOM tree";
+}
+
+intptr_t RetainedDOMInfo::GetElementCount()
+{
+    intptr_t count = 1;
+    Node* current = m_root;
+    while (current) {
+        current = current->traverseNextNode(m_root);
+        ++count;
+    }
+    return count;
+}
+
+intptr_t RetainedDOMInfo::GetEquivalenceClass()
+{
+    return reinterpret_cast<intptr_t>(m_root);
+}
+
+} // namespace WebCore
diff --git a/Source/WebCore/bindings/v8/RetainedDOMInfo.h b/Source/WebCore/bindings/v8/RetainedDOMInfo.h
new file mode 100644
index 0000000..6767f75
--- /dev/null
+++ b/Source/WebCore/bindings/v8/RetainedDOMInfo.h
@@ -0,0 +1,60 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ * 
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef RetainedDOMInfo_h
+#define RetainedDOMInfo_h
+
+#include "RetainedObjectInfo.h"
+
+namespace WebCore {
+
+class Node;
+
+// Implements v8::RetainedObjectInfo.
+class RetainedDOMInfo : public RetainedObjectInfo {
+public:
+    explicit RetainedDOMInfo(Node* root);
+    virtual ~RetainedDOMInfo();
+    virtual void Dispose();
+    virtual bool IsEquivalent(v8::RetainedObjectInfo* other);
+    virtual intptr_t GetHash();
+    virtual const char* GetLabel();
+    virtual intptr_t GetElementCount();
+    virtual intptr_t GetEquivalenceClass();
+    
+private:
+    // V8 guarantees to keep RetainedObjectInfos alive only during a GC or heap snapshotting round, when renderer
+    // doesn't get control. This allows us to use raw pointers.
+    Node* m_root;
+};
+
+} // namespace WebCore
+
+#endif // RetainedDOMInfo_h
diff --git a/Source/WebCore/bindings/v8/RetainedObjectInfo.h b/Source/WebCore/bindings/v8/RetainedObjectInfo.h
new file mode 100644
index 0000000..0368fb1
--- /dev/null
+++ b/Source/WebCore/bindings/v8/RetainedObjectInfo.h
@@ -0,0 +1,45 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ * 
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef RetainedObjectInfo_h
+#define RetainedObjectInfo_h
+
+#include <v8-profiler.h>
+
+namespace WebCore {
+
+class RetainedObjectInfo : public v8::RetainedObjectInfo {
+public:
+    virtual intptr_t GetEquivalenceClass() = 0;
+};
+
+} // namespace WebCore
+
+#endif // RetainedObjectInfo_h
diff --git a/Source/WebCore/bindings/v8/ScriptCachedFrameData.cpp b/Source/WebCore/bindings/v8/ScriptCachedFrameData.cpp
index dc28f32..9e15d1c 100644
--- a/Source/WebCore/bindings/v8/ScriptCachedFrameData.cpp
+++ b/Source/WebCore/bindings/v8/ScriptCachedFrameData.cpp
@@ -26,6 +26,10 @@
 #include "config.h"
 #include "ScriptCachedFrameData.h"
 
+#if PLATFORM(ANDROID) || PLATFORM(QT)
+// FIXME: the right guard should be ENABLE(PAGE_CACHE). Replace with the right guard, once
+// https://bugs.webkit.org/show_bug.cgi?id=35061 is fixed.
+
 #include "Frame.h"
 #include "ScriptController.h"
 #include "V8DOMWindow.h"
@@ -72,3 +76,5 @@ void ScriptCachedFrameData::clear()
 }
 
 } // namespace WebCore
+
+#endif // PLATFORM(ANDROID) || PLATFORM(QT)
diff --git a/Source/WebCore/bindings/v8/ScriptDebugServer.cpp b/Source/WebCore/bindings/v8/ScriptDebugServer.cpp
index cc7fba8..5758639 100644
--- a/Source/WebCore/bindings/v8/ScriptDebugServer.cpp
+++ b/Source/WebCore/bindings/v8/ScriptDebugServer.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2010, Google Inc. All rights reserved.
+ * Copyright (c) 2010-2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -33,13 +33,10 @@
 
 #if ENABLE(JAVASCRIPT_DEBUGGER)
 
-#include "Frame.h"
+#include "DebuggerScriptSource.h"
 #include "JavaScriptCallFrame.h"
-#include "Page.h"
 #include "ScriptDebugListener.h"
 #include "V8Binding.h"
-#include "V8DOMWindow.h"
-#include "V8Proxy.h"
 #include <wtf/StdLibExtras.h>
 
 namespace WebCore {
@@ -57,92 +54,12 @@ private:
 
 }
 
-static Frame* retrieveFrame(v8::Handle<v8::Context> context)
-{
-    if (context.IsEmpty())
-        return 0;
-
-    // Test that context has associated global dom window object.
-    v8::Handle<v8::Object> global = context->Global();
-    if (global.IsEmpty())
-        return 0;
-
-    global = V8DOMWrapper::lookupDOMWrapper(V8DOMWindow::GetTemplate(), global);
-    if (global.IsEmpty())
-        return 0;
-
-    return V8Proxy::retrieveFrame(context);
-}
-
-ScriptDebugServer& ScriptDebugServer::shared()
-{
-    DEFINE_STATIC_LOCAL(ScriptDebugServer, server, ());
-    return server;
-}
-
 ScriptDebugServer::ScriptDebugServer()
     : m_pauseOnExceptionsState(DontPauseOnExceptions)
-    , m_pausedPage(0)
-    , m_enabled(true)
     , m_breakpointsActivated(true)
 {
 }
 
-void ScriptDebugServer::setDebuggerScriptSource(const String& scriptSource)
-{
-    m_debuggerScriptSource = scriptSource;
-}
-
-void ScriptDebugServer::addListener(ScriptDebugListener* listener, Page* page)
-{
-    if (!m_enabled)
-        return;
-
-    V8Proxy* proxy = V8Proxy::retrieve(page->mainFrame());
-    if (!proxy)
-        return;
-
-    v8::HandleScope scope;
-    v8::Local<v8::Context> debuggerContext = v8::Debug::GetDebugContext();
-    v8::Context::Scope contextScope(debuggerContext);
-
-    if (!m_listenersMap.size()) {
-        ensureDebuggerScriptCompiled();
-        ASSERT(!m_debuggerScript.get()->IsUndefined());
-        v8::Debug::SetDebugEventListener2(&ScriptDebugServer::v8DebugEventCallback);
-    }
-    m_listenersMap.set(page, listener);
-
-    V8DOMWindowShell* shell = proxy->windowShell();
-    if (!shell->isContextInitialized())
-        return;
-    v8::Handle<v8::Context> context = shell->context();
-    v8::Handle<v8::Function> getScriptsFunction = v8::Local<v8::Function>::Cast(m_debuggerScript.get()->Get(v8::String::New("getScripts")));
-    v8::Handle<v8::Value> argv[] = { context->GetData() };
-    v8::Handle<v8::Value> value = getScriptsFunction->Call(m_debuggerScript.get(), 1, argv);
-    if (value.IsEmpty())
-        return;
-    ASSERT(!value->IsUndefined() && value->IsArray());
-    v8::Handle<v8::Array> scriptsArray = v8::Handle<v8::Array>::Cast(value);
-    for (unsigned i = 0; i < scriptsArray->Length(); ++i)
-        dispatchDidParseSource(listener, v8::Handle<v8::Object>::Cast(scriptsArray->Get(v8::Integer::New(i))));
-}
-
-void ScriptDebugServer::removeListener(ScriptDebugListener* listener, Page* page)
-{
-    if (!m_listenersMap.contains(page))
-        return;
-
-    if (m_pausedPage == page)
-        continueProgram();
-
-    m_listenersMap.remove(page);
-
-    if (m_listenersMap.isEmpty())
-        v8::Debug::SetDebugEventListener(0);
-    // FIXME: Remove all breakpoints set by the agent.
-}
-
 String ScriptDebugServer::setBreakpoint(const String& sourceID, const ScriptBreakpoint& scriptBreakpoint, int* actualLineNumber, int* actualColumnNumber)
 {
     v8::HandleScope scope;
@@ -229,7 +146,7 @@ void ScriptDebugServer::setPauseOnExceptionsState(PauseOnExceptionsState pauseOn
 
 void ScriptDebugServer::setPauseOnNextStatement(bool pause)
 {
-    if (m_pausedPage)
+    if (isPaused())
         return;
     if (pause)
         v8::Debug::DebugBreak();
@@ -239,17 +156,15 @@ void ScriptDebugServer::setPauseOnNextStatement(bool pause)
 
 void ScriptDebugServer::breakProgram()
 {
-    DEFINE_STATIC_LOCAL(v8::Persistent<v8::FunctionTemplate>, callbackTemplate, ());
-
     if (!m_breakpointsActivated)
         return;
 
     if (!v8::Context::InContext())
         return;
 
-    if (callbackTemplate.IsEmpty()) {
-        callbackTemplate = v8::Persistent<v8::FunctionTemplate>::New(v8::FunctionTemplate::New());
-        callbackTemplate->SetCallHandler(&ScriptDebugServer::breakProgramCallback);
+    if (m_breakProgramCallbackTemplate.get().IsEmpty()) {
+        m_breakProgramCallbackTemplate.set(v8::FunctionTemplate::New());
+        m_breakProgramCallbackTemplate.get()->SetCallHandler(&ScriptDebugServer::breakProgramCallback, v8::External::New(this));
     }
 
     v8::Handle<v8::Context> context = v8::Context::GetCurrent();
@@ -257,21 +172,22 @@ void ScriptDebugServer::breakProgram()
         return;
 
     m_pausedPageContext = *context;
-    v8::Handle<v8::Function> breakProgramFunction = callbackTemplate->GetFunction();
+    v8::Handle<v8::Function> breakProgramFunction = m_breakProgramCallbackTemplate.get()->GetFunction();
     v8::Debug::Call(breakProgramFunction);
     m_pausedPageContext.Clear();
 }
 
 void ScriptDebugServer::continueProgram()
 {
-    if (m_pausedPage)
-        m_clientMessageLoop->quitNow();
-    didResume();
+    if (isPaused())
+        quitMessageLoopOnPause();
+    m_currentCallFrame.clear();
+    m_executionState.clear();
 }
 
 void ScriptDebugServer::stepIntoStatement()
 {
-    ASSERT(m_pausedPage);
+    ASSERT(isPaused());
     v8::Handle<v8::Function> function = v8::Local<v8::Function>::Cast(m_debuggerScript.get()->Get(v8::String::New("stepIntoStatement")));
     v8::Handle<v8::Value> argv[] = { m_executionState.get() };
     function->Call(m_debuggerScript.get(), 1, argv);
@@ -280,7 +196,7 @@ void ScriptDebugServer::stepIntoStatement()
 
 void ScriptDebugServer::stepOverStatement()
 {
-    ASSERT(m_pausedPage);
+    ASSERT(isPaused());
     v8::Handle<v8::Function> function = v8::Local<v8::Function>::Cast(m_debuggerScript.get()->Get(v8::String::New("stepOverStatement")));
     v8::Handle<v8::Value> argv[] = { m_executionState.get() };
     function->Call(m_debuggerScript.get(), 1, argv);
@@ -289,7 +205,7 @@ void ScriptDebugServer::stepOverStatement()
 
 void ScriptDebugServer::stepOutOfFunction()
 {
-    ASSERT(m_pausedPage);
+    ASSERT(isPaused());
     v8::Handle<v8::Function> function = v8::Local<v8::Function>::Cast(m_debuggerScript.get()->Get(v8::String::New("stepOutOfFunction")));
     v8::Handle<v8::Value> argv[] = { m_executionState.get() };
     function->Call(m_debuggerScript.get(), 1, argv);
@@ -302,7 +218,7 @@ bool ScriptDebugServer::editScriptSource(const String& sourceID, const String& n
     v8::HandleScope scope;
 
     OwnPtr<v8::Context::Scope> contextScope;
-    if (!m_pausedPage)
+    if (!isPaused())
         contextScope.set(new v8::Context::Scope(v8::Debug::GetDebugContext()));
 
     v8::Handle<v8::Function> function = v8::Local<v8::Function>::Cast(m_debuggerScript.get()->Get(v8::String::New("editScriptSource")));
@@ -337,11 +253,6 @@ PassRefPtr<JavaScriptCallFrame> ScriptDebugServer::currentCallFrame()
     return m_currentCallFrame;
 }
 
-void ScriptDebugServer::setEnabled(bool value)
-{
-     m_enabled = value;
-}
-
 void ScriptDebugServer::interruptAndRun(PassOwnPtr<Task> task)
 {
     v8::Debug::DebugBreakForCommand(new ClientDataImpl(task));
@@ -352,44 +263,42 @@ void ScriptDebugServer::runPendingTasks()
     v8::Debug::ProcessDebugMessages();
 }
 
+static ScriptDebugServer* toScriptDebugServer(v8::Handle<v8::Value> data)
+{
+    void* p = v8::Handle<v8::External>::Cast(data)->Value();
+    return static_cast<ScriptDebugServer*>(p);
+}
+
 v8::Handle<v8::Value> ScriptDebugServer::breakProgramCallback(const v8::Arguments& args)
 {
     ASSERT(2 == args.Length());
-    ScriptDebugServer::shared().breakProgram(v8::Handle<v8::Object>::Cast(args[0]));
+    
+    ScriptDebugServer* thisPtr = toScriptDebugServer(args.Data());
+    thisPtr->breakProgram(v8::Handle<v8::Object>::Cast(args[0]));
     return v8::Undefined();
 }
 
 void ScriptDebugServer::breakProgram(v8::Handle<v8::Object> executionState)
 {
     // Don't allow nested breaks.
-    if (m_pausedPage)
-        return;
-
-    Frame* frame = retrieveFrame(m_pausedPageContext);
-    if (!frame)
+    if (isPaused())
         return;
 
-    ScriptDebugListener* listener = m_listenersMap.get(frame->page());
+    ScriptDebugListener* listener = getDebugListenerForContext(m_pausedPageContext);
     if (!listener)
         return;
 
     m_executionState.set(executionState);
-    m_pausedPage = frame->page();
     ScriptState* currentCallFrameState = ScriptState::forContext(m_pausedPageContext);
     listener->didPause(currentCallFrameState);
 
-    // Wait for continue or step command.
-    m_clientMessageLoop->run(m_pausedPage);
-    ASSERT(!m_pausedPage);
-
-    // The listener may have been removed in the nested loop.
-    if (ScriptDebugListener* listener = m_listenersMap.get(frame->page()))
-        listener->didContinue();
+    runMessageLoopOnPause(m_pausedPageContext);
 }
 
 void ScriptDebugServer::v8DebugEventCallback(const v8::Debug::EventDetails& eventDetails)
 {
-    ScriptDebugServer::shared().handleV8DebugEvent(eventDetails);
+    ScriptDebugServer* thisPtr = toScriptDebugServer(eventDetails.GetCallbackData());
+    thisPtr->handleV8DebugEvent(eventDetails);
 }
 
 void ScriptDebugServer::handleV8DebugEvent(const v8::Debug::EventDetails& eventDetails)
@@ -408,31 +317,28 @@ void ScriptDebugServer::handleV8DebugEvent(const v8::Debug::EventDetails& eventD
     v8::Handle<v8::Context> eventContext = eventDetails.GetEventContext();
     ASSERT(!eventContext.IsEmpty());
 
-    Frame* frame = retrieveFrame(eventContext);
-    if (frame) {
-        ScriptDebugListener* listener = m_listenersMap.get(frame->page());
-        if (listener) {
-            v8::HandleScope scope;
-            if (event == v8::AfterCompile) {
-                v8::Context::Scope contextScope(v8::Debug::GetDebugContext());
-                v8::Handle<v8::Function> onAfterCompileFunction = v8::Local<v8::Function>::Cast(m_debuggerScript.get()->Get(v8::String::New("getAfterCompileScript")));
-                v8::Handle<v8::Value> argv[] = { eventDetails.GetEventData() };
-                v8::Handle<v8::Value> value = onAfterCompileFunction->Call(m_debuggerScript.get(), 1, argv);
-                ASSERT(value->IsObject());
-                v8::Handle<v8::Object> object = v8::Handle<v8::Object>::Cast(value);
-                dispatchDidParseSource(listener, object);
-            } else if (event == v8::Break || event == v8::Exception) {
-                if (event == v8::Exception) {
-                    v8::Local<v8::StackTrace> stackTrace = v8::StackTrace::CurrentStackTrace(1);
-                    // Stack trace is empty in case of syntax error. Silently continue execution in such cases.
-                    if (!stackTrace->GetFrameCount())
-                        return;
-                }
-
-                m_pausedPageContext = *eventContext;
-                breakProgram(eventDetails.GetExecutionState());
-                m_pausedPageContext.Clear();
+    ScriptDebugListener* listener = getDebugListenerForContext(eventContext);
+    if (listener) {
+        v8::HandleScope scope;
+        if (event == v8::AfterCompile) {
+            v8::Context::Scope contextScope(v8::Debug::GetDebugContext());
+            v8::Handle<v8::Function> onAfterCompileFunction = v8::Local<v8::Function>::Cast(m_debuggerScript.get()->Get(v8::String::New("getAfterCompileScript")));
+            v8::Handle<v8::Value> argv[] = { eventDetails.GetEventData() };
+            v8::Handle<v8::Value> value = onAfterCompileFunction->Call(m_debuggerScript.get(), 1, argv);
+            ASSERT(value->IsObject());
+            v8::Handle<v8::Object> object = v8::Handle<v8::Object>::Cast(value);
+            dispatchDidParseSource(listener, object);
+        } else if (event == v8::Break || event == v8::Exception) {
+            if (event == v8::Exception) {
+                v8::Local<v8::StackTrace> stackTrace = v8::StackTrace::CurrentStackTrace(1);
+                // Stack trace is empty in case of syntax error. Silently continue execution in such cases.
+                if (!stackTrace->GetFrameCount())
+                    return;
             }
+
+            m_pausedPageContext = *eventContext;
+            breakProgram(eventDetails.GetExecutionState());
+            m_pausedPageContext.Clear();
         }
     }
 }
@@ -454,15 +360,14 @@ void ScriptDebugServer::ensureDebuggerScriptCompiled()
         v8::HandleScope scope;
         v8::Local<v8::Context> debuggerContext = v8::Debug::GetDebugContext();
         v8::Context::Scope contextScope(debuggerContext);
-        m_debuggerScript.set(v8::Handle<v8::Object>::Cast(v8::Script::Compile(v8String(m_debuggerScriptSource))->Run()));
+        String debuggerScriptSource(reinterpret_cast<const char*>(DebuggerScriptSource_js), sizeof(DebuggerScriptSource_js));
+        m_debuggerScript.set(v8::Handle<v8::Object>::Cast(v8::Script::Compile(v8String(debuggerScriptSource))->Run()));
     }
 }
 
-void ScriptDebugServer::didResume()
+bool ScriptDebugServer::isPaused()
 {
-    m_currentCallFrame.clear();
-    m_executionState.clear();
-    m_pausedPage = 0;
+    return !m_executionState.get().IsEmpty();
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/bindings/v8/ScriptDebugServer.h b/Source/WebCore/bindings/v8/ScriptDebugServer.h
index af3d2ab..15004ea 100644
--- a/Source/WebCore/bindings/v8/ScriptDebugServer.h
+++ b/Source/WebCore/bindings/v8/ScriptDebugServer.h
@@ -45,17 +45,11 @@
 
 namespace WebCore {
 
-class Page;
 class ScriptDebugListener;
 
 class ScriptDebugServer {
     WTF_MAKE_NONCOPYABLE(ScriptDebugServer);
 public:
-    static ScriptDebugServer& shared();
-
-    void addListener(ScriptDebugListener*, Page*);
-    void removeListener(ScriptDebugListener*, Page*);
-
     String setBreakpoint(const String& sourceID, const ScriptBreakpoint&, int* actualLineNumber, int* actualColumnNumber);
     void removeBreakpoint(const String& breakpointId);
     void clearBreakpoints();
@@ -83,23 +77,8 @@ public:
     void recompileAllJSFunctionsSoon() { }
     void recompileAllJSFunctions(Timer<ScriptDebugServer>* = 0) { }
 
-    void pageCreated(Page*) { }
-
-    // v8-specific methods.
-    void setDebuggerScriptSource(const String& scriptSource);
-
-    class ClientMessageLoop {
-    public:
-        virtual ~ClientMessageLoop() { }
-        virtual void run(Page*) = 0;
-        virtual void quitNow() = 0;
-    };
-    void setClientMessageLoop(PassOwnPtr<ClientMessageLoop> clientMessageLoop) { m_clientMessageLoop = clientMessageLoop; }
-
     PassRefPtr<JavaScriptCallFrame> currentCallFrame();
 
-    void setEnabled(bool);
-
     class Task {
     public:
         virtual ~Task() { }
@@ -108,9 +87,13 @@ public:
     static void interruptAndRun(PassOwnPtr<Task>);
     void runPendingTasks();
 
-private:
+protected:
     ScriptDebugServer();
     ~ScriptDebugServer() { }
+    
+    virtual ScriptDebugListener* getDebugListenerForContext(v8::Handle<v8::Context>) = 0;
+    virtual void runMessageLoopOnPause(v8::Handle<v8::Context>) = 0;
+    virtual void quitMessageLoopOnPause() = 0;
 
     static v8::Handle<v8::Value> breakProgramCallback(const v8::Arguments& args);
     void breakProgram(v8::Handle<v8::Object> executionState);
@@ -121,21 +104,17 @@ private:
     void dispatchDidParseSource(ScriptDebugListener* listener, v8::Handle<v8::Object> sourceObject);
 
     void ensureDebuggerScriptCompiled();
-    void didResume();
+    
+    bool isPaused();
 
-    typedef HashMap<Page*, ScriptDebugListener*> ListenersMap;
-    ListenersMap m_listenersMap;
-    String m_debuggerScriptSource;
     PauseOnExceptionsState m_pauseOnExceptionsState;
     OwnHandle<v8::Object> m_debuggerScript;
     RefPtr<JavaScriptCallFrame> m_currentCallFrame;
     OwnHandle<v8::Object> m_executionState;
-    OwnPtr<ClientMessageLoop> m_clientMessageLoop;
-    Page* m_pausedPage;
     v8::Local<v8::Context> m_pausedPageContext;
-    bool m_enabled;
 
     bool m_breakpointsActivated;
+    OwnHandle<v8::FunctionTemplate> m_breakProgramCallbackTemplate;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/bindings/v8/ScriptHeapSnapshot.cpp b/Source/WebCore/bindings/v8/ScriptHeapSnapshot.cpp
index 09e1e54..68ed8da 100644
--- a/Source/WebCore/bindings/v8/ScriptHeapSnapshot.cpp
+++ b/Source/WebCore/bindings/v8/ScriptHeapSnapshot.cpp
@@ -40,6 +40,11 @@
 
 namespace WebCore {
 
+ScriptHeapSnapshot::~ScriptHeapSnapshot()
+{
+    const_cast<v8::HeapSnapshot*>(m_snapshot)->Delete();
+}
+
 String ScriptHeapSnapshot::title() const
 {
     v8::HandleScope scope;
@@ -76,10 +81,4 @@ void ScriptHeapSnapshot::writeJSON(ScriptHeapSnapshot::OutputStream* stream)
     m_snapshot->Serialize(&outputStream, v8::HeapSnapshot::kJSON);
 }
 
-int ScriptHeapSnapshot::exactRetainedSize(uint64_t nodeId)
-{
-    const v8::HeapGraphNode* node = m_snapshot->GetNodeById(nodeId);
-    return node ? node->GetRetainedSize(true) : -1;
-}
-
 } // namespace WebCore
diff --git a/Source/WebCore/bindings/v8/ScriptHeapSnapshot.h b/Source/WebCore/bindings/v8/ScriptHeapSnapshot.h
index 6cfd76d..4093fa7 100644
--- a/Source/WebCore/bindings/v8/ScriptHeapSnapshot.h
+++ b/Source/WebCore/bindings/v8/ScriptHeapSnapshot.h
@@ -54,12 +54,11 @@ public:
     {
         return adoptRef(new ScriptHeapSnapshot(snapshot));
     }
-    virtual ~ScriptHeapSnapshot() {}
+    virtual ~ScriptHeapSnapshot();
 
     String title() const;
     unsigned int uid() const;
     void writeJSON(OutputStream* stream);
-    int exactRetainedSize(uint64_t nodeId);
 
 private:
     ScriptHeapSnapshot(const v8::HeapSnapshot* snapshot)
diff --git a/Source/WebCore/bindings/v8/ScriptProfile.cpp b/Source/WebCore/bindings/v8/ScriptProfile.cpp
index c5a6dbf..2c9f0f5 100644
--- a/Source/WebCore/bindings/v8/ScriptProfile.cpp
+++ b/Source/WebCore/bindings/v8/ScriptProfile.cpp
@@ -39,6 +39,11 @@
 
 namespace WebCore {
 
+ScriptProfile::~ScriptProfile()
+{
+    const_cast<v8::CpuProfile*>(m_profile)->Delete();
+}
+
 String ScriptProfile::title() const
 {
     v8::HandleScope scope;
diff --git a/Source/WebCore/bindings/v8/ScriptProfile.h b/Source/WebCore/bindings/v8/ScriptProfile.h
index 0182669..d8196a4 100644
--- a/Source/WebCore/bindings/v8/ScriptProfile.h
+++ b/Source/WebCore/bindings/v8/ScriptProfile.h
@@ -48,7 +48,7 @@ public:
     {
         return adoptRef(new ScriptProfile(profile));
     }
-    virtual ~ScriptProfile() {}
+    virtual ~ScriptProfile();
 
     String title() const;
     unsigned int uid() const;
diff --git a/Source/WebCore/bindings/v8/ScriptProfiler.cpp b/Source/WebCore/bindings/v8/ScriptProfiler.cpp
index 615dcfc..3fe45a8 100644
--- a/Source/WebCore/bindings/v8/ScriptProfiler.cpp
+++ b/Source/WebCore/bindings/v8/ScriptProfiler.cpp
@@ -32,9 +32,11 @@
 #include "ScriptProfiler.h"
 
 #include "InspectorValues.h"
+#include "RetainedDOMInfo.h"
+#include "V8Binding.h"
+#include "V8Node.h"
 
 #include <v8-profiler.h>
-#include <V8Binding.h>
 
 namespace WebCore {
 
@@ -53,6 +55,14 @@ PassRefPtr<ScriptProfile> ScriptProfiler::stop(ScriptState* state, const String&
     return profile ? ScriptProfile::create(profile) : 0;
 }
 
+void ScriptProfiler::collectGarbage()
+{
+    // NOTE : There is currently no direct way to collect memory from the v8 C++ API
+    // but notifying low-memory forces a mark-compact, which is exactly what we want
+    // in this case.
+    v8::V8::LowMemoryNotification();
+}
+
 namespace {
 
 class ActivityControlAdapter : public v8::ActivityControl {
@@ -90,4 +100,19 @@ PassRefPtr<ScriptHeapSnapshot> ScriptProfiler::takeHeapSnapshot(const String& ti
     return snapshot ? ScriptHeapSnapshot::create(snapshot) : 0;
 }
 
+static v8::RetainedObjectInfo* retainedDOMInfo(uint16_t classId, v8::Handle<v8::Value> wrapper)
+{
+    ASSERT(classId == v8DOMSubtreeClassId);
+    if (!wrapper->IsObject())
+        return 0;
+    Node* node = V8Node::toNative(wrapper.As<v8::Object>());
+    return node ? new RetainedDOMInfo(node) : 0;
+}
+
+void ScriptProfiler::initialize()
+{
+    v8::HeapProfiler::DefineWrapperClass(v8DOMSubtreeClassId, &retainedDOMInfo);
+}
+
+
 } // namespace WebCore
diff --git a/Source/WebCore/bindings/v8/ScriptProfiler.h b/Source/WebCore/bindings/v8/ScriptProfiler.h
index 9016668..92a980b 100644
--- a/Source/WebCore/bindings/v8/ScriptProfiler.h
+++ b/Source/WebCore/bindings/v8/ScriptProfiler.h
@@ -53,9 +53,11 @@ public:
         virtual bool isCanceled() = 0;
     };
 
+    static void collectGarbage();
     static void start(ScriptState* state, const String& title);
     static PassRefPtr<ScriptProfile> stop(ScriptState* state, const String& title);
     static PassRefPtr<ScriptHeapSnapshot> takeHeapSnapshot(const String& title, HeapSnapshotProgress*);
+    static void initialize();
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/bindings/v8/SerializedScriptValue.h b/Source/WebCore/bindings/v8/SerializedScriptValue.h
index c0e9109..212be66 100644
--- a/Source/WebCore/bindings/v8/SerializedScriptValue.h
+++ b/Source/WebCore/bindings/v8/SerializedScriptValue.h
@@ -37,7 +37,7 @@
 
 namespace WebCore {
 
-class SerializedScriptValue : public ThreadSafeShared<SerializedScriptValue> {
+class SerializedScriptValue : public ThreadSafeRefCounted<SerializedScriptValue> {
 public:
     static void deserializeAndSetProperty(v8::Handle<v8::Object>, const char* propertyName,
                                           v8::PropertyAttribute, SerializedScriptValue*);
diff --git a/Source/WebCore/bindings/v8/V8DOMWindowShell.cpp b/Source/WebCore/bindings/v8/V8DOMWindowShell.cpp
index d88d8a6..e025008 100644
--- a/Source/WebCore/bindings/v8/V8DOMWindowShell.cpp
+++ b/Source/WebCore/bindings/v8/V8DOMWindowShell.cpp
@@ -43,6 +43,7 @@
 #include "ScriptCallStack.h"
 #include "ScriptCallStackFactory.h"
 #include "ScriptController.h"
+#include "ScriptProfiler.h"
 #include "StorageNamespace.h"
 #include "V8Binding.h"
 #include "V8BindingState.h"
@@ -305,6 +306,8 @@ bool V8DOMWindowShell::initContextIfNeeded()
 
         v8::V8::SetFailedAccessCheckCallbackFunction(reportUnsafeJavaScriptAccess);
 
+        ScriptProfiler::initialize();
+        
         isV8Initialized = true;
     }
 
diff --git a/Source/WebCore/bindings/v8/V8GCController.cpp b/Source/WebCore/bindings/v8/V8GCController.cpp
index cda9f3d..82c9ca4 100644
--- a/Source/WebCore/bindings/v8/V8GCController.cpp
+++ b/Source/WebCore/bindings/v8/V8GCController.cpp
@@ -34,27 +34,20 @@
 #include "ActiveDOMObject.h"
 #include "Attr.h"
 #include "DOMDataStore.h"
-#include "Frame.h"
+#include "DOMImplementation.h"
 #include "HTMLImageElement.h"
 #include "HTMLNames.h"
 #include "MessagePort.h"
 #include "PlatformBridge.h"
-#include "SVGElement.h"
+#include "RetainedDOMInfo.h"
+#include "RetainedObjectInfo.h"
 #include "V8Binding.h"
-#include "V8CSSCharsetRule.h"
-#include "V8CSSFontFaceRule.h"
-#include "V8CSSImportRule.h"
-#include "V8CSSMediaRule.h"
+#include "V8CSSRule.h"
 #include "V8CSSRuleList.h"
 #include "V8CSSStyleDeclaration.h"
-#include "V8CSSStyleRule.h"
-#include "V8CSSStyleSheet.h"
-#include "V8DOMMap.h"
-#include "V8HTMLLinkElement.h"
-#include "V8HTMLStyleElement.h"
+#include "V8DOMImplementation.h"
 #include "V8MessagePort.h"
-#include "V8ProcessingInstruction.h"
-#include "V8Proxy.h"
+#include "V8StyleSheet.h"
 #include "V8StyleSheetList.h"
 #include "WrapperTypeInfo.h"
 
@@ -175,19 +168,86 @@ public:
     }
 };
 
-class GrouperItem {
+// Implements v8::RetainedObjectInfo.
+class UnspecifiedGroup : public RetainedObjectInfo {
 public:
-    GrouperItem(uintptr_t groupId, v8::Persistent<v8::Object> wrapper) 
-        : m_groupId(groupId)
-        , m_wrapper(wrapper) 
-        {
-        }
+    explicit UnspecifiedGroup(void* object)
+        : m_object(object)
+    {
+        ASSERT(m_object);
+    }
+    
+    virtual void Dispose() { delete this; }
+  
+    virtual bool IsEquivalent(v8::RetainedObjectInfo* other)
+    {
+        ASSERT(other);
+        return other == this || static_cast<WebCore::RetainedObjectInfo*>(other)->GetEquivalenceClass() == this->GetEquivalenceClass();
+    }
 
+    virtual intptr_t GetHash()
+    {
+        return reinterpret_cast<intptr_t>(m_object);
+    }
+    
+    virtual const char* GetLabel()
+    {
+        return "Object group";
+    }
+
+    virtual intptr_t GetEquivalenceClass()
+    {
+        return reinterpret_cast<intptr_t>(m_object);
+    }
+
+private:
+    void* m_object;
+};
+
+class GroupId {
+public:
+    GroupId() : m_type(NullType), m_groupId(0) {}
+    GroupId(Node* node) : m_type(NodeType), m_node(node) {}
+    GroupId(void* other) : m_type(OtherType), m_other(other) {}
+    bool operator!() const { return m_type == NullType; }
     uintptr_t groupId() const { return m_groupId; }
+    RetainedObjectInfo* createRetainedObjectInfo() const
+    {
+        switch (m_type) {
+        case NullType:
+            return 0;
+        case NodeType:
+            return new RetainedDOMInfo(m_node);
+        case OtherType:
+            return new UnspecifiedGroup(m_other);
+        default:
+            return 0;
+        }
+    }
+    
+private:
+    enum Type {
+        NullType,
+        NodeType,
+        OtherType
+    };
+    Type m_type;
+    union {
+        uintptr_t m_groupId;
+        Node* m_node;
+        void* m_other;
+    };
+};
+
+class GrouperItem {
+public:
+    GrouperItem(GroupId groupId, v8::Persistent<v8::Object> wrapper) : m_groupId(groupId), m_wrapper(wrapper) {}
+    uintptr_t groupId() const { return m_groupId.groupId(); }
+    RetainedObjectInfo* createRetainedObjectInfo() const { return m_groupId.createRetainedObjectInfo(); }
     v8::Persistent<v8::Object> wrapper() const { return m_wrapper; }
 
 private:
-    uintptr_t m_groupId;
+    GroupId m_groupId;
     v8::Persistent<v8::Object> m_wrapper;
 };
 
@@ -198,215 +258,160 @@ bool operator<(const GrouperItem& a, const GrouperItem& b)
 
 typedef Vector<GrouperItem> GrouperList;
 
-void makeV8ObjectGroups(GrouperList& grouper)
+// If the node is in document, put it in the ownerDocument's object group.
+//
+// If an image element was created by JavaScript "new Image",
+// it is not in a document. However, if the load event has not
+// been fired (still onloading), it is treated as in the document.
+//
+// Otherwise, the node is put in an object group identified by the root
+// element of the tree to which it belongs.
+static GroupId calculateGroupId(Node* node)
 {
-    // Group by sorting by the group id.
-    std::sort(grouper.begin(), grouper.end());
-
-    // FIXME Should probably work in iterators here, but indexes were easier for my simple mind.
-    for (size_t i = 0; i < grouper.size(); ) {
-        // Seek to the next key (or the end of the list).
-        size_t nextKeyIndex = grouper.size();
-        for (size_t j = i; j < grouper.size(); ++j) {
-            if (grouper[i].groupId() != grouper[j].groupId()) {
-                nextKeyIndex = j;
-                break;
-            }
-        }
+    if (node->inDocument() || (node->hasTagName(HTMLNames::imgTag) && !static_cast<HTMLImageElement*>(node)->haveFiredLoadEvent()))
+        return GroupId(node->document());
+
+    Node* root = node;
+    if (node->isAttributeNode()) {
+        root = static_cast<Attr*>(node)->ownerElement();
+        // If the attribute has no element, no need to put it in the group,
+        // because it'll always be a group of 1.
+        if (!root)
+            return GroupId();
+    } else {
+        while (Node* parent = root->parentNode())
+            root = parent;
+    }
 
-        ASSERT(nextKeyIndex > i);
+    return GroupId(root);
+}
 
-        // We only care about a group if it has more than one object. If it only
-        // has one object, it has nothing else that needs to be kept alive.
-        if (nextKeyIndex - i <= 1) {
-            i = nextKeyIndex;
-            continue;
+static GroupId calculateGroupId(StyleBase* styleBase)
+{
+    ASSERT(styleBase);
+    StyleBase* current = styleBase;
+    StyleSheet* styleSheet = 0;
+    while (true) {
+        // Special case: CSSStyleDeclarations might be either inline and in this case
+        // we need to group them with their node or regular ones.
+        if (current->isMutableStyleDeclaration()) {
+            CSSMutableStyleDeclaration* cssMutableStyleDeclaration = static_cast<CSSMutableStyleDeclaration*>(current);
+            if (cssMutableStyleDeclaration->isInlineStyleDeclaration()) {
+                ASSERT(cssMutableStyleDeclaration->parent()->isStyleSheet());
+                return calculateGroupId(cssMutableStyleDeclaration->node());
+            }
+            // Either we have no parent, or this parent is a CSSRule.
+            ASSERT(cssMutableStyleDeclaration->parent() == cssMutableStyleDeclaration->parentRule());
         }
 
-        Vector<v8::Persistent<v8::Value> > group;
-        group.reserveCapacity(nextKeyIndex - i);
-        for (; i < nextKeyIndex; ++i) {
-            v8::Persistent<v8::Value> wrapper = grouper[i].wrapper();
-            if (!wrapper.IsEmpty())
-                group.append(wrapper);
-        }
+        if (current->isStyleSheet())
+            styleSheet = static_cast<StyleSheet*>(current);
 
-        if (group.size() > 1)
-            v8::V8::AddObjectGroup(&group[0], group.size());
+        StyleBase* parent = current->parent();
+        if (!parent)
+            break;
+        current = parent;
+    }
 
-        ASSERT(i == nextKeyIndex);
+    if (styleSheet) {
+        if (Node* ownerNode = styleSheet->ownerNode())
+            return calculateGroupId(ownerNode);
+        return GroupId(styleSheet);
     }
+
+    return GroupId(current);
 }
 
-class NodeGrouperVisitor : public DOMWrapperMap<Node>::Visitor {
+class GrouperVisitor : public DOMWrapperMap<Node>::Visitor, public DOMWrapperMap<void>::Visitor {
 public:
-    NodeGrouperVisitor()
-    {
-        // FIXME: grouper_.reserveCapacity(node_map.size());  ?
-    }
-
     void visitDOMWrapper(DOMDataStore* store, Node* node, v8::Persistent<v8::Object> wrapper)
     {
-        // If the node is in document, put it in the ownerDocument's object group.
-        //
-        // If an image element was created by JavaScript "new Image",
-        // it is not in a document. However, if the load event has not
-        // been fired (still onloading), it is treated as in the document.
-        //
-        // Otherwise, the node is put in an object group identified by the root
-        // element of the tree to which it belongs.
-        uintptr_t groupId;
-        if (node->inDocument() || (node->hasTagName(HTMLNames::imgTag) && !static_cast<HTMLImageElement*>(node)->haveFiredLoadEvent()))
-            groupId = reinterpret_cast<uintptr_t>(node->document());
-        else {
-            Node* root = node;
-            if (node->isAttributeNode()) {
-                root = static_cast<Attr*>(node)->ownerElement();
-                // If the attribute has no element, no need to put it in the group,
-                // because it'll always be a group of 1.
-                if (!root)
-                    return;
-            } else {
-                while (root->parentNode())
-                    root = root->parentNode();
-
-                // If the node is alone in its DOM tree (doesn't have a parent or any
-                // children) then the group will be filtered out later anyway.
-                if (root == node && !node->hasChildNodes() && !node->hasAttributes())
-                    return;
-            }
-            groupId = reinterpret_cast<uintptr_t>(root);
-        }
+        GroupId groupId = calculateGroupId(node);
+        if (!groupId)
+            return;
         m_grouper.append(GrouperItem(groupId, wrapper));
+    }
 
-        // If the node is styled and there is a wrapper for the inline
-        // style declaration, we need to keep that style declaration
-        // wrapper alive as well, so we add it to the object group.
-        if (node->isStyledElement()) {
-            StyledElement* element = reinterpret_cast<StyledElement*>(node);
-            addDOMObjectToGroup(store, groupId, element->inlineStyleDecl());
-        }
-
-        if (node->isDocumentNode()) {
-            Document* document = reinterpret_cast<Document*>(node);
-            addDOMObjectToGroup(store, groupId, document->styleSheets());
-            addDOMObjectToGroup(store, groupId, document->implementation());
-        }
-
+    void visitDOMWrapper(DOMDataStore* store, void* object, v8::Persistent<v8::Object> wrapper)
+    {
         WrapperTypeInfo* typeInfo = V8DOMWrapper::domWrapperType(wrapper);
 
-        if (V8HTMLLinkElement::info.equals(typeInfo)) {
-            HTMLLinkElement* htmlLinkElement = static_cast<HTMLLinkElement*>(node);
-            addDOMObjectToGroup(store, groupId, htmlLinkElement->sheet());
-        }
+        if (typeInfo->isSubclass(&V8StyleSheetList::info)) {
+            StyleSheetList* styleSheetList = static_cast<StyleSheetList*>(object);
+            GroupId groupId(styleSheetList);
+            if (Document* document = styleSheetList->document())
+                groupId = GroupId(document);
+            m_grouper.append(GrouperItem(groupId, wrapper));
 
-        if (V8HTMLStyleElement::info.equals(typeInfo)) {
-            HTMLStyleElement* htmlStyleElement = static_cast<HTMLStyleElement*>(node);
-            addDOMObjectToGroup(store, groupId, htmlStyleElement->sheet());
-        }
+        } else if (typeInfo->isSubclass(&V8DOMImplementation::info)) {
+            DOMImplementation* domImplementation = static_cast<DOMImplementation*>(object);
+            GroupId groupId(domImplementation);
+            if (Document* document = domImplementation->ownerDocument())
+                groupId = GroupId(document);
+            m_grouper.append(GrouperItem(groupId, wrapper));
 
-        if (V8ProcessingInstruction::info.equals(typeInfo)) {
-            ProcessingInstruction* processingInstruction = static_cast<ProcessingInstruction*>(node);
-            addDOMObjectToGroup(store, groupId, processingInstruction->sheet());
-        }
-    }
+        } else if (typeInfo->isSubclass(&V8StyleSheet::info) || typeInfo->isSubclass(&V8CSSRule::info)) {
+            m_grouper.append(GrouperItem(calculateGroupId(static_cast<StyleBase*>(object)), wrapper));
 
-    void applyGrouping()
-    {
-        makeV8ObjectGroups(m_grouper);
-    }
-
-private:
-    GrouperList m_grouper;
+        } else if (typeInfo->isSubclass(&V8CSSStyleDeclaration::info)) {
+            CSSStyleDeclaration* cssStyleDeclaration = static_cast<CSSStyleDeclaration*>(object);
 
-    void addDOMObjectToGroup(DOMDataStore* store, uintptr_t groupId, void* object)
-    {
-        if (!object)
-            return;
-        v8::Persistent<v8::Object> wrapper = store->domObjectMap().get(object);
-        if (!wrapper.IsEmpty())
+            GroupId groupId = calculateGroupId(cssStyleDeclaration);
             m_grouper.append(GrouperItem(groupId, wrapper));
-    }
-};
 
-class DOMObjectGrouperVisitor : public DOMWrapperMap<void>::Visitor {
-public:
-    DOMObjectGrouperVisitor()
-    {
+        } else if (typeInfo->isSubclass(&V8CSSRuleList::info)) {
+            CSSRuleList* cssRuleList = static_cast<CSSRuleList*>(object);
+            GroupId groupId(cssRuleList);
+            StyleList* styleList = cssRuleList->styleList();
+            if (styleList)
+                groupId = calculateGroupId(styleList);
+            m_grouper.append(GrouperItem(groupId, wrapper));
+        }
     }
 
-    void startMap()
+    void applyGrouping()
     {
-        m_grouper.shrink(0);
-    }
+        // Group by sorting by the group id.
+        std::sort(m_grouper.begin(), m_grouper.end());
+
+        for (size_t i = 0; i < m_grouper.size(); ) {
+            // Seek to the next key (or the end of the list).
+            size_t nextKeyIndex = m_grouper.size();
+            for (size_t j = i; j < m_grouper.size(); ++j) {
+                if (m_grouper[i].groupId() != m_grouper[j].groupId()) {
+                    nextKeyIndex = j;
+                    break;
+                }
+            }
 
-    void endMap()
-    {
-        makeV8ObjectGroups(m_grouper);
-    }
+            ASSERT(nextKeyIndex > i);
 
-    void visitDOMWrapper(DOMDataStore* store, void* object, v8::Persistent<v8::Object> wrapper)
-    {
-        WrapperTypeInfo* typeInfo = V8DOMWrapper::domWrapperType(wrapper);
-        // FIXME: extend WrapperTypeInfo with isStyle to simplify the check below or consider
-        // adding a virtual method to WrapperTypeInfo which would know how to group objects.
-        // FIXME: check if there are other StyleBase wrappers we should care of.
-        if (V8CSSStyleSheet::info.equals(typeInfo)
-            || V8CSSStyleDeclaration::info.equals(typeInfo)
-            || V8CSSCharsetRule::info.equals(typeInfo)
-            || V8CSSFontFaceRule::info.equals(typeInfo)
-            || V8CSSStyleRule::info.equals(typeInfo)
-            || V8CSSImportRule::info.equals(typeInfo)
-            || V8CSSMediaRule::info.equals(typeInfo)) {
-            StyleBase* styleBase = static_cast<StyleBase*>(object);
-
-            // We put the whole tree of style elements into a single object group.
-            // To achieve that we group elements by the roots of their trees.
-            StyleBase* root = styleBase;
-            ASSERT(root);
-            while (true) {
-                StyleBase* parent = root->parent();
-                if (!parent)
-                    break;
-                root = parent;
+            // We only care about a group if it has more than one object. If it only
+            // has one object, it has nothing else that needs to be kept alive.
+            if (nextKeyIndex - i <= 1) {
+                i = nextKeyIndex;
+                continue;
             }
-            // Group id is an address of the root.
-            uintptr_t groupId = reinterpret_cast<uintptr_t>(root);
-            m_grouper.append(GrouperItem(groupId, wrapper));
 
-            if (V8CSSStyleDeclaration::info.equals(typeInfo)) {
-                CSSStyleDeclaration* cssStyleDeclaration = static_cast<CSSStyleDeclaration*>(styleBase);
-                if (cssStyleDeclaration->isMutableStyleDeclaration()) {
-                    CSSMutableStyleDeclaration* cssMutableStyleDeclaration = static_cast<CSSMutableStyleDeclaration*>(cssStyleDeclaration);
-                    CSSMutableStyleDeclaration::const_iterator end = cssMutableStyleDeclaration->end();
-                    for (CSSMutableStyleDeclaration::const_iterator it = cssMutableStyleDeclaration->begin(); it != end; ++it) {
-                        wrapper = store->domObjectMap().get(it->value());
-                        if (!wrapper.IsEmpty())
-                            m_grouper.append(GrouperItem(groupId, wrapper));
-                    }
-                }
+            size_t rootIndex = i;
+            
+            Vector<v8::Persistent<v8::Value> > group;
+            group.reserveCapacity(nextKeyIndex - i);
+            for (; i < nextKeyIndex; ++i) {
+                v8::Persistent<v8::Value> wrapper = m_grouper[i].wrapper();
+                if (!wrapper.IsEmpty())
+                    group.append(wrapper);
             }
-        } else if (V8StyleSheetList::info.equals(typeInfo)) {
-            addAllItems(store, static_cast<StyleSheetList*>(object), wrapper);
-        } else if (V8CSSRuleList::info.equals(typeInfo)) {
-            addAllItems(store, static_cast<CSSRuleList*>(object), wrapper);
+
+            if (group.size() > 1)
+                v8::V8::AddObjectGroup(&group[0], group.size(), m_grouper[rootIndex].createRetainedObjectInfo());
+
+            ASSERT(i == nextKeyIndex);
         }
     }
 
 private:
     GrouperList m_grouper;
-
-    template <class C>
-    void addAllItems(DOMDataStore* store, C* collection, v8::Persistent<v8::Object> wrapper)
-    {
-        uintptr_t groupId = reinterpret_cast<uintptr_t>(collection);
-        m_grouper.append(GrouperItem(groupId, wrapper));
-        for (unsigned i = 0; i < collection->length(); i++) {
-            wrapper = store->domObjectMap().get(collection->item(i));
-            if (!wrapper.IsEmpty())
-                m_grouper.append(GrouperItem(groupId, wrapper));
-        }
-    }
 };
 
 // Create object groups for DOM tree nodes.
@@ -425,12 +430,10 @@ void V8GCController::gcPrologue()
     visitActiveDOMObjectsInCurrentThread(&prologueVisitor);
 
     // Create object groups.
-    NodeGrouperVisitor nodeGrouperVisitor;
-    visitDOMNodesInCurrentThread(&nodeGrouperVisitor);
-    nodeGrouperVisitor.applyGrouping();
-
-    DOMObjectGrouperVisitor domObjectGrouperVisitor;
-    visitDOMObjectsInCurrentThread(&domObjectGrouperVisitor);
+    GrouperVisitor grouperVisitor;
+    visitDOMNodesInCurrentThread(&grouperVisitor);
+    visitDOMObjectsInCurrentThread(&grouperVisitor);
+    grouperVisitor.applyGrouping();
 
     // Clean single element cache for string conversions.
     lastStringImpl = 0;
diff --git a/Source/WebCore/bindings/v8/V8LazyEventListener.cpp b/Source/WebCore/bindings/v8/V8LazyEventListener.cpp
index 7f46333..0e2c368 100644
--- a/Source/WebCore/bindings/v8/V8LazyEventListener.cpp
+++ b/Source/WebCore/bindings/v8/V8LazyEventListener.cpp
@@ -31,6 +31,7 @@
 #include "config.h"
 #include "V8LazyEventListener.h"
 
+#include "ContentSecurityPolicy.h"
 #include "Frame.h"
 #include "V8Binding.h"
 #include "V8HiddenPropertyName.h"
@@ -80,6 +81,9 @@ void V8LazyEventListener::prepareListenerObject(ScriptExecutionContext* context)
     if (hasExistingListenerObject())
         return;
 
+    if (context->isDocument() && !static_cast<Document*>(context)->contentSecurityPolicy()->allowInlineEventHandlers())
+        return;
+
     v8::HandleScope handleScope;
 
     V8Proxy* proxy = V8Proxy::retrieve(context);
diff --git a/Source/WebCore/bindings/v8/WorkerScriptDebugServer.cpp b/Source/WebCore/bindings/v8/WorkerScriptDebugServer.cpp
new file mode 100755
index 0000000..5e2acd2
--- /dev/null
+++ b/Source/WebCore/bindings/v8/WorkerScriptDebugServer.cpp
@@ -0,0 +1,55 @@
+/*
+ * Copyright (c) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WorkerScriptDebugServer.h"
+
+#if ENABLE(JAVASCRIPT_DEBUGGER) && ENABLE(WORKERS)
+
+#include "WorkerContext.h"
+
+namespace WebCore {
+
+WorkerScriptDebugServer::WorkerScriptDebugServer()
+    : ScriptDebugServer()
+{
+}
+
+void WorkerScriptDebugServer::addListener(ScriptDebugListener*, WorkerContext*)
+{
+}
+
+void WorkerScriptDebugServer::removeListener(ScriptDebugListener*, WorkerContext*)
+{
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(JAVASCRIPT_DEBUGGER) && ENABLE(WORKERS)
diff --git a/Source/WebCore/bindings/v8/WorkerScriptDebugServer.h b/Source/WebCore/bindings/v8/WorkerScriptDebugServer.h
new file mode 100755
index 0000000..fdc47ac
--- /dev/null
+++ b/Source/WebCore/bindings/v8/WorkerScriptDebugServer.h
@@ -0,0 +1,61 @@
+/*
+ * Copyright (c) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WorkerScriptDebugServer_h
+#define WorkerScriptDebugServer_h
+
+#if ENABLE(JAVASCRIPT_DEBUGGER) && ENABLE(WORKERS)
+
+#include "ScriptDebugServer.h"
+
+namespace WebCore {
+
+class WorkerContext;
+
+class WorkerScriptDebugServer : public ScriptDebugServer {
+    WTF_MAKE_NONCOPYABLE(WorkerScriptDebugServer);
+public:
+    WorkerScriptDebugServer();
+    ~WorkerScriptDebugServer() { }
+
+    void addListener(ScriptDebugListener*, WorkerContext*);
+    void removeListener(ScriptDebugListener*, WorkerContext*);
+
+private:
+    virtual ScriptDebugListener* getDebugListenerForContext(v8::Handle<v8::Context>) { return 0; }
+    virtual void runMessageLoopOnPause(v8::Handle<v8::Context>) { }
+    virtual void quitMessageLoopOnPause() { }
+};
+
+} // namespace WebCore
+
+#endif // ENABLE(JAVASCRIPT_DEBUGGER) && ENABLE(WORKERS)
+
+#endif // WorkerScriptDebugServer_h
diff --git a/Source/WebCore/bindings/v8/WrapperTypeInfo.h b/Source/WebCore/bindings/v8/WrapperTypeInfo.h
index 1d1cbfd..166d642 100644
--- a/Source/WebCore/bindings/v8/WrapperTypeInfo.h
+++ b/Source/WebCore/bindings/v8/WrapperTypeInfo.h
@@ -41,7 +41,9 @@ namespace WebCore {
     static const int v8DOMWrapperObjectIndex = 1;
     static const int v8DOMHiddenReferenceArrayIndex = 2;
     static const int v8DefaultWrapperInternalFieldCount = 3;
-    
+
+    static const uint16_t v8DOMSubtreeClassId = 1;
+
     typedef v8::Persistent<v8::FunctionTemplate> (*GetTemplateFunction)();
     typedef void (*DerefObjectFunction)(void*);
     typedef ActiveDOMObject* (*ToActiveDOMObjectFunction)(v8::Handle<v8::Object>);
@@ -61,6 +63,16 @@ namespace WebCore {
         {
             return this == that;
         }
+
+        bool isSubclass(const WrapperTypeInfo* that) const
+        {
+            for (const WrapperTypeInfo* current = this; current; current = current->parentClass) {
+                if (current == that)
+                    return true;
+            }
+
+            return false;
+        }
         
         v8::Persistent<v8::FunctionTemplate> getTemplate() { return getTemplateFunction(); }
         
@@ -80,6 +92,7 @@ namespace WebCore {
         const GetTemplateFunction getTemplateFunction;
         const DerefObjectFunction derefObjectFunction;
         const ToActiveDOMObjectFunction toActiveDOMObjectFunction;
+        const WrapperTypeInfo* parentClass;
     };
 }
 
diff --git a/Source/WebCore/bindings/v8/custom/V8HTMLCanvasElementCustom.cpp b/Source/WebCore/bindings/v8/custom/V8HTMLCanvasElementCustom.cpp
index 8fd2d62..52465b6 100644
--- a/Source/WebCore/bindings/v8/custom/V8HTMLCanvasElementCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8HTMLCanvasElementCustom.cpp
@@ -76,6 +76,9 @@ v8::Handle<v8::Value> V8HTMLCanvasElement::getContextCallback(const v8::Argument
             v8::Handle<v8::String> premultipliedAlpha = v8::String::New("premultipliedAlpha");
             if (jsAttrs->Has(premultipliedAlpha))
                 webGLAttrs->setPremultipliedAlpha(jsAttrs->Get(premultipliedAlpha)->BooleanValue());
+            v8::Handle<v8::String> preserveDrawingBuffer = v8::String::New("preserveDrawingBuffer");
+            if (jsAttrs->Has(preserveDrawingBuffer))
+                webGLAttrs->setPreserveDrawingBuffer(jsAttrs->Get(preserveDrawingBuffer)->BooleanValue());
         }
     }
 #endif
diff --git a/Source/WebCore/bindings/v8/custom/V8IDBAnyCustom.cpp b/Source/WebCore/bindings/v8/custom/V8IDBAnyCustom.cpp
index ccd6fb2..a1a8636 100644
--- a/Source/WebCore/bindings/v8/custom/V8IDBAnyCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8IDBAnyCustom.cpp
@@ -77,6 +77,6 @@ v8::Handle<v8::Value> toV8(IDBAny* impl)
     return v8::Undefined();
 }
 
-#endif // ENABLE(INDEXED_DATABASE)
-
 } // namespace WebCore
+
+#endif // ENABLE(INDEXED_DATABASE)
diff --git a/Source/WebCore/bindings/v8/custom/V8IDBKeyCustom.cpp b/Source/WebCore/bindings/v8/custom/V8IDBKeyCustom.cpp
index 3805dca..b8fa6bb 100644
--- a/Source/WebCore/bindings/v8/custom/V8IDBKeyCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8IDBKeyCustom.cpp
@@ -56,6 +56,6 @@ v8::Handle<v8::Value> toV8(IDBKey* key)
     return v8::Undefined();
 }
 
-#endif // ENABLE(INDEXED_DATABASE)
-
 } // namespace WebCore
+
+#endif // ENABLE(INDEXED_DATABASE)
diff --git a/Source/WebCore/bindings/v8/custom/V8InjectedScriptHostCustom.cpp b/Source/WebCore/bindings/v8/custom/V8InjectedScriptHostCustom.cpp
index 7a33ed0..3dbacb2 100644
--- a/Source/WebCore/bindings/v8/custom/V8InjectedScriptHostCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8InjectedScriptHostCustom.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007-2009 Google Inc. All rights reserved.
+ * Copyright (C) 2007-2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -31,27 +31,21 @@
 #include "config.h"
 #include "V8InjectedScriptHost.h"
 
-#include "DOMWindow.h"
 #include "Database.h"
-#include "Frame.h"
 #include "InjectedScript.h"
 #include "InjectedScriptHost.h"
+#include "InspectorDebuggerAgent.h"
 #include "InspectorValues.h"
-#include "Node.h"
-#include "Page.h"
 #include "ScriptDebugServer.h"
 #include "ScriptValue.h"
-
 #include "V8Binding.h"
 #include "V8BindingState.h"
-#include "V8DOMWindow.h"
 #include "V8Database.h"
 #include "V8HiddenPropertyName.h"
 #include "V8JavaScriptCallFrame.h"
 #include "V8Node.h"
 #include "V8Proxy.h"
 #include "V8Storage.h"
-#include <wtf/RefPtr.h>
 
 namespace WebCore {
 
@@ -71,86 +65,6 @@ ScriptValue InjectedScriptHost::nodeAsScriptValue(ScriptState* state, Node* node
     return ScriptValue(toV8(node));
 }
 
-static void WeakReferenceCallback(v8::Persistent<v8::Value> object, void* parameter)
-{
-    InjectedScriptHost* nativeObject = static_cast<InjectedScriptHost*>(parameter);
-    nativeObject->deref();
-    object.Dispose();
-}
-
-static v8::Local<v8::Object> createInjectedScriptHostV8Wrapper(InjectedScriptHost* host)
-{
-    v8::Local<v8::Function> function = V8InjectedScriptHost::GetTemplate()->GetFunction();
-    if (function.IsEmpty()) {
-        // Return if allocation failed.
-        return v8::Local<v8::Object>();
-    }
-    v8::Local<v8::Object> instance = SafeAllocation::newInstance(function);
-    if (instance.IsEmpty()) {
-        // Avoid setting the wrapper if allocation failed.
-        return v8::Local<v8::Object>();
-    }
-    V8DOMWrapper::setDOMWrapper(instance, &V8InjectedScriptHost::info, host);
-    // Create a weak reference to the v8 wrapper of InspectorBackend to deref
-    // InspectorBackend when the wrapper is garbage collected.
-    host->ref();
-    v8::Persistent<v8::Object> weakHandle = v8::Persistent<v8::Object>::New(instance);
-    weakHandle.MakeWeak(host, &WeakReferenceCallback);
-    return instance;
-}
-
-ScriptObject InjectedScriptHost::createInjectedScript(const String& scriptSource, ScriptState* inspectedScriptState, long id)
-{
-    v8::HandleScope scope;
-
-    v8::Local<v8::Context> inspectedContext = inspectedScriptState->context();
-    v8::Context::Scope contextScope(inspectedContext);
-
-    // Call custom code to create InjectedScripHost wrapper specific for the context
-    // instead of calling toV8() that would create the
-    // wrapper in the current context.
-    // FIXME: make it possible to use generic bindings factory for InjectedScriptHost.
-    v8::Local<v8::Object> scriptHostWrapper = createInjectedScriptHostV8Wrapper(this);
-    if (scriptHostWrapper.IsEmpty())
-        return ScriptObject();
-
-    v8::Local<v8::Object> windowGlobal = inspectedContext->Global();
-
-    // Inject javascript into the context. The compiled script is supposed to evaluate into
-    // a single anonymous function(it's anonymous to avoid cluttering the global object with
-    // inspector's stuff) the function is called a few lines below with InjectedScriptHost wrapper,
-    // injected script id and explicit reference to the inspected global object. The function is expected
-    // to create and configure InjectedScript instance that is going to be used by the inspector.
-    v8::Local<v8::Script> script = v8::Script::Compile(v8String(scriptSource));
-    v8::Local<v8::Value> v = script->Run();
-    ASSERT(!v.IsEmpty());
-    ASSERT(v->IsFunction());
-
-    v8::Handle<v8::Value> args[] = {
-      scriptHostWrapper,
-      windowGlobal,
-      v8::Number::New(id),
-    };
-    v8::Local<v8::Value> injectedScriptValue = v8::Function::Cast(*v)->Call(windowGlobal, 3, args);
-    v8::Local<v8::Object> injectedScript(v8::Object::Cast(*injectedScriptValue));
-    return ScriptObject(inspectedScriptState, injectedScript);
-}
-
-void InjectedScriptHost::discardInjectedScript(ScriptState* inspectedScriptState)
-{
-    v8::HandleScope handleScope;
-    v8::Local<v8::Context> context = inspectedScriptState->context();
-    v8::Context::Scope contextScope(context);
-
-    v8::Local<v8::Object> global = context->Global();
-    // Skip proxy object. The proxy object will survive page navigation while we need
-    // an object whose lifetime consides with that of the inspected context.
-    global = v8::Local<v8::Object>::Cast(global->GetPrototype());
-
-    v8::Handle<v8::String> key = V8HiddenPropertyName::devtoolsInjectedScript();
-    global->DeleteHiddenValue(key);
-}
-
 v8::Handle<v8::Value> V8InjectedScriptHost::inspectedNodeCallback(const v8::Arguments& args)
 {
     INC_STATS("InjectedScriptHost.inspectedNode()");
@@ -185,9 +99,9 @@ v8::Handle<v8::Value> V8InjectedScriptHost::inspectCallback(const v8::Arguments&
         return v8::Undefined();
 
     InjectedScriptHost* host = V8InjectedScriptHost::toNative(args.Holder());
-    ScriptValue objectId(args[0]);
+    ScriptValue object(args[0]);
     ScriptValue hints(args[1]);
-    host->inspectImpl(objectId.toInspectorValue(ScriptState::current()), hints.toInspectorValue(ScriptState::current()));
+    host->inspectImpl(object.toInspectorValue(ScriptState::current()), hints.toInspectorValue(ScriptState::current()));
 
     return v8::Undefined();
 }
@@ -196,7 +110,8 @@ v8::Handle<v8::Value> V8InjectedScriptHost::currentCallFrameCallback(const v8::A
 {
 #if ENABLE(JAVASCRIPT_DEBUGGER)
     INC_STATS("InjectedScriptHost.currentCallFrame()");
-    return toV8(ScriptDebugServer::shared().currentCallFrame());
+    InjectedScriptHost* host = V8InjectedScriptHost::toNative(args.Holder());
+    return toV8(host->debuggerAgent()->scriptDebugServer().currentCallFrame());
 #else
     UNUSED_PARAM(args);
     return v8::Undefined();
@@ -231,46 +146,4 @@ v8::Handle<v8::Value> V8InjectedScriptHost::storageIdCallback(const v8::Argument
     return v8::Undefined();
 }
 
-InjectedScript InjectedScriptHost::injectedScriptFor(ScriptState* inspectedScriptState)
-{
-    v8::HandleScope handleScope;
-    v8::Local<v8::Context> context = inspectedScriptState->context();
-    v8::Context::Scope contextScope(context);
-
-    v8::Local<v8::Object> global = context->Global();
-    // Skip proxy object. The proxy object will survive page navigation while we need
-    // an object whose lifetime consides with that of the inspected context.
-    global = v8::Local<v8::Object>::Cast(global->GetPrototype());
-
-    v8::Handle<v8::String> key = V8HiddenPropertyName::devtoolsInjectedScript();
-    v8::Local<v8::Value> val = global->GetHiddenValue(key);
-    if (!val.IsEmpty() && val->IsObject())
-        return InjectedScript(ScriptObject(inspectedScriptState, v8::Local<v8::Object>::Cast(val)));
-
-    if (!canAccessInspectedWindow(inspectedScriptState))
-        return InjectedScript();
-
-    pair<long, ScriptObject> injectedScript = injectScript(injectedScriptSource(), inspectedScriptState);
-    InjectedScript result(injectedScript.second);
-    m_idToInjectedScript.set(injectedScript.first, result);
-    global->SetHiddenValue(key, injectedScript.second.v8Object());
-    return result;
-}
-
-bool InjectedScriptHost::canAccessInspectedWindow(ScriptState* scriptState)
-{
-    v8::HandleScope handleScope;
-    v8::Local<v8::Context> context = scriptState->context();
-    v8::Local<v8::Object> global = context->Global();
-    if (global.IsEmpty())
-        return false;
-    v8::Handle<v8::Object> holder = V8DOMWrapper::lookupDOMWrapper(V8DOMWindow::GetTemplate(), global);
-    if (holder.IsEmpty())
-        return false;
-    Frame* frame = V8DOMWindow::toNative(holder)->frame();
-
-    v8::Context::Scope contextScope(context);
-    return V8BindingSecurity::canAccessFrame(V8BindingState::Only(), frame, false);
-}
-
 } // namespace WebCore
diff --git a/Source/WebCore/bindings/v8/custom/V8InjectedScriptManager.cpp b/Source/WebCore/bindings/v8/custom/V8InjectedScriptManager.cpp
new file mode 100644
index 0000000..f4006b8
--- /dev/null
+++ b/Source/WebCore/bindings/v8/custom/V8InjectedScriptManager.cpp
@@ -0,0 +1,170 @@
+/*
+ * Copyright (C) 2007-2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "InjectedScriptManager.h"
+
+#include "DOMWindow.h"
+#include "InjectedScript.h"
+#include "InjectedScriptHost.h"
+#include "ScriptValue.h"
+#include "V8Binding.h"
+#include "V8BindingState.h"
+#include "V8DOMWindow.h"
+#include "V8HiddenPropertyName.h"
+#include "V8InjectedScriptHost.h"
+#include "V8Proxy.h"
+#include <wtf/RefPtr.h>
+
+namespace WebCore {
+
+static void WeakReferenceCallback(v8::Persistent<v8::Value> object, void* parameter)
+{
+    InjectedScriptHost* nativeObject = static_cast<InjectedScriptHost*>(parameter);
+    nativeObject->deref();
+    object.Dispose();
+}
+
+static v8::Local<v8::Object> createInjectedScriptHostV8Wrapper(InjectedScriptHost* host)
+{
+    v8::Local<v8::Function> function = V8InjectedScriptHost::GetTemplate()->GetFunction();
+    if (function.IsEmpty()) {
+        // Return if allocation failed.
+        return v8::Local<v8::Object>();
+    }
+    v8::Local<v8::Object> instance = SafeAllocation::newInstance(function);
+    if (instance.IsEmpty()) {
+        // Avoid setting the wrapper if allocation failed.
+        return v8::Local<v8::Object>();
+    }
+    V8DOMWrapper::setDOMWrapper(instance, &V8InjectedScriptHost::info, host);
+    // Create a weak reference to the v8 wrapper of InspectorBackend to deref
+    // InspectorBackend when the wrapper is garbage collected.
+    host->ref();
+    v8::Persistent<v8::Object> weakHandle = v8::Persistent<v8::Object>::New(instance);
+    weakHandle.MakeWeak(host, &WeakReferenceCallback);
+    return instance;
+}
+
+ScriptObject InjectedScriptManager::createInjectedScript(const String& scriptSource, ScriptState* inspectedScriptState, long id)
+{
+    v8::HandleScope scope;
+
+    v8::Local<v8::Context> inspectedContext = inspectedScriptState->context();
+    v8::Context::Scope contextScope(inspectedContext);
+
+    // Call custom code to create InjectedScripHost wrapper specific for the context
+    // instead of calling toV8() that would create the
+    // wrapper in the current context.
+    // FIXME: make it possible to use generic bindings factory for InjectedScriptHost.
+    v8::Local<v8::Object> scriptHostWrapper = createInjectedScriptHostV8Wrapper(m_injectedScriptHost.get());
+    if (scriptHostWrapper.IsEmpty())
+        return ScriptObject();
+
+    v8::Local<v8::Object> windowGlobal = inspectedContext->Global();
+
+    // Inject javascript into the context. The compiled script is supposed to evaluate into
+    // a single anonymous function(it's anonymous to avoid cluttering the global object with
+    // inspector's stuff) the function is called a few lines below with InjectedScriptHost wrapper,
+    // injected script id and explicit reference to the inspected global object. The function is expected
+    // to create and configure InjectedScript instance that is going to be used by the inspector.
+    v8::Local<v8::Script> script = v8::Script::Compile(v8String(scriptSource));
+    v8::Local<v8::Value> v = script->Run();
+    ASSERT(!v.IsEmpty());
+    ASSERT(v->IsFunction());
+
+    v8::Handle<v8::Value> args[] = {
+      scriptHostWrapper,
+      windowGlobal,
+      v8::Number::New(id),
+    };
+    v8::Local<v8::Value> injectedScriptValue = v8::Function::Cast(*v)->Call(windowGlobal, 3, args);
+    v8::Local<v8::Object> injectedScript(v8::Object::Cast(*injectedScriptValue));
+    return ScriptObject(inspectedScriptState, injectedScript);
+}
+
+void InjectedScriptManager::discardInjectedScript(ScriptState* inspectedScriptState)
+{
+    v8::HandleScope handleScope;
+    v8::Local<v8::Context> context = inspectedScriptState->context();
+    v8::Context::Scope contextScope(context);
+
+    v8::Local<v8::Object> global = context->Global();
+    // Skip proxy object. The proxy object will survive page navigation while we need
+    // an object whose lifetime consides with that of the inspected context.
+    global = v8::Local<v8::Object>::Cast(global->GetPrototype());
+
+    v8::Handle<v8::String> key = V8HiddenPropertyName::devtoolsInjectedScript();
+    global->DeleteHiddenValue(key);
+}
+
+InjectedScript InjectedScriptManager::injectedScriptFor(ScriptState* inspectedScriptState)
+{
+    v8::HandleScope handleScope;
+    v8::Local<v8::Context> context = inspectedScriptState->context();
+    v8::Context::Scope contextScope(context);
+
+    v8::Local<v8::Object> global = context->Global();
+    // Skip proxy object. The proxy object will survive page navigation while we need
+    // an object whose lifetime consides with that of the inspected context.
+    global = v8::Local<v8::Object>::Cast(global->GetPrototype());
+
+    v8::Handle<v8::String> key = V8HiddenPropertyName::devtoolsInjectedScript();
+    v8::Local<v8::Value> val = global->GetHiddenValue(key);
+    if (!val.IsEmpty() && val->IsObject())
+        return InjectedScript(ScriptObject(inspectedScriptState, v8::Local<v8::Object>::Cast(val)));
+
+    if (!canAccessInspectedWindow(inspectedScriptState))
+        return InjectedScript();
+
+    pair<long, ScriptObject> injectedScript = injectScript(injectedScriptSource(), inspectedScriptState);
+    InjectedScript result(injectedScript.second);
+    m_idToInjectedScript.set(injectedScript.first, result);
+    global->SetHiddenValue(key, injectedScript.second.v8Object());
+    return result;
+}
+
+bool InjectedScriptManager::canAccessInspectedWindow(ScriptState* scriptState)
+{
+    v8::HandleScope handleScope;
+    v8::Local<v8::Context> context = scriptState->context();
+    v8::Local<v8::Object> global = context->Global();
+    if (global.IsEmpty())
+        return false;
+    v8::Handle<v8::Object> holder = V8DOMWrapper::lookupDOMWrapper(V8DOMWindow::GetTemplate(), global);
+    if (holder.IsEmpty())
+        return false;
+    Frame* frame = V8DOMWindow::toNative(holder)->frame();
+
+    v8::Context::Scope contextScope(context);
+    return V8BindingSecurity::canAccessFrame(V8BindingState::Only(), frame, false);
+}
+
+} // namespace WebCore
diff --git a/Source/WebCore/bindings/v8/custom/V8WebKitAnimationCustom.cpp b/Source/WebCore/bindings/v8/custom/V8WebKitAnimationCustom.cpp
new file mode 100644
index 0000000..c0949ae
--- /dev/null
+++ b/Source/WebCore/bindings/v8/custom/V8WebKitAnimationCustom.cpp
@@ -0,0 +1,50 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT OWNER OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "V8WebKitAnimation.h"
+
+#include "V8Binding.h"
+#include "V8BindingMacros.h"
+#include "V8Proxy.h"
+#include "WebKitAnimation.h"
+
+#include <v8.h>
+
+namespace WebCore {
+
+v8::Handle<v8::Value> V8WebKitAnimation::iterationCountAccessorGetter(v8::Local<v8::String> name, const v8::AccessorInfo& info)
+{
+    INC_STATS("DOM.WebKitAnimation.iterationCount._get");
+    v8::Handle<v8::Object> holder = info.Holder();
+    WebKitAnimation* imp = V8WebKitAnimation::toNative(holder);
+    int count = imp->iterationCount();
+    if (count == Animation::IterationCountInfinite)
+        return v8::Number::New(std::numeric_limits<float>::infinity());
+    return v8::Number::New(count);
+}
+
+} // namespace WebCore
+
diff --git a/Source/WebCore/bridge/c/CRuntimeObject.h b/Source/WebCore/bridge/c/CRuntimeObject.h
index 267d71e..85815fb 100644
--- a/Source/WebCore/bridge/c/CRuntimeObject.h
+++ b/Source/WebCore/bridge/c/CRuntimeObject.h
@@ -44,9 +44,9 @@ public:
 
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValue prototype)
+    static PassRefPtr<Structure> createStructure(JSGlobalData& globalData, JSValue prototype)
     {
-        return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
+        return Structure::create(globalData, prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
     }
 };
 
diff --git a/Source/WebCore/bridge/c/c_class.cpp b/Source/WebCore/bridge/c/c_class.cpp
index a808946..4f9cdd9 100644
--- a/Source/WebCore/bridge/c/c_class.cpp
+++ b/Source/WebCore/bridge/c/c_class.cpp
@@ -35,6 +35,7 @@
 #include <runtime/ScopeChain.h>
 #include <runtime/Identifier.h>
 #include <runtime/JSLock.h>
+#include <runtime/JSObject.h>
 #include <wtf/text/StringHash.h>
 
 namespace JSC { namespace Bindings {
diff --git a/Source/WebCore/bridge/c/c_instance.cpp b/Source/WebCore/bridge/c/c_instance.cpp
index 27affeb..21fae4f 100644
--- a/Source/WebCore/bridge/c/c_instance.cpp
+++ b/Source/WebCore/bridge/c/c_instance.cpp
@@ -120,9 +120,9 @@ public:
         ASSERT(inherits(&s_info));
     }
 
-    static PassRefPtr<Structure> createStructure(JSValue prototype)
+    static PassRefPtr<Structure> createStructure(JSGlobalData& globalData, JSValue prototype)
     {
-        return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
+        return Structure::create(globalData, prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
     }
 
     static const ClassInfo s_info;
diff --git a/Source/WebCore/bridge/c/c_runtime.cpp b/Source/WebCore/bridge/c/c_runtime.cpp
index f8c0dba..a84acbb 100644
--- a/Source/WebCore/bridge/c/c_runtime.cpp
+++ b/Source/WebCore/bridge/c/c_runtime.cpp
@@ -34,6 +34,7 @@
 #include "npruntime_impl.h"
 #include <runtime/ScopeChain.h>
 #include <runtime/JSLock.h>
+#include <runtime/JSObject.h>
 
 namespace JSC {
 namespace Bindings {
diff --git a/Source/WebCore/bridge/jni/JNIUtility.cpp b/Source/WebCore/bridge/jni/JNIUtility.cpp
index 17cc038..cfd4e83 100644
--- a/Source/WebCore/bridge/jni/JNIUtility.cpp
+++ b/Source/WebCore/bridge/jni/JNIUtility.cpp
@@ -166,122 +166,129 @@ void releaseUCharactersForJStringInEnv(JNIEnv* env, jstring aJString, const jcha
     env->ReleaseStringChars(aJString, s);
 }
 
-JNIType JNITypeFromClassName(const char* name)
+JavaType javaTypeFromClassName(const char* name)
 {
-    JNIType type;
+    JavaType type;
 
     if (!strcmp("byte", name))
-        type = byte_type;
+        type = JavaTypeByte;
     else if (!strcmp("short", name))
-        type = short_type;
+        type = JavaTypeShort;
     else if (!strcmp("int", name))
-        type = int_type;
+        type = JavaTypeInt;
     else if (!strcmp("long", name))
-        type = long_type;
+        type = JavaTypeLong;
     else if (!strcmp("float", name))
-        type = float_type;
+        type = JavaTypeFloat;
     else if (!strcmp("double", name))
-        type = double_type;
+        type = JavaTypeDouble;
     else if (!strcmp("char", name))
-        type = char_type;
+        type = JavaTypeChar;
     else if (!strcmp("boolean", name))
-        type = boolean_type;
+        type = JavaTypeBoolean;
     else if (!strcmp("void", name))
-        type = void_type;
+        type = JavaTypeVoid;
     else if ('[' == name[0])
-        type = array_type;
+        type = JavaTypeArray;
+#if USE(V8)
+    else if (!strcmp("java.lang.String", name))
+        type = JavaTypeString;
+#endif
     else
-        type = object_type;
+        type = JavaTypeObject;
 
     return type;
 }
 
-const char* signatureFromPrimitiveType(JNIType type)
+const char* signatureFromJavaType(JavaType type)
 {
     switch (type) {
-    case void_type:
+    case JavaTypeVoid:
         return "V";
 
-    case array_type:
+    case JavaTypeArray:
         return "[";
 
-    case object_type:
+    case JavaTypeObject:
+#if USE(V8)
+    case JavaTypeString:
+#endif
         return "L";
 
-    case boolean_type:
+    case JavaTypeBoolean:
         return "Z";
 
-    case byte_type:
+    case JavaTypeByte:
         return "B";
 
-    case char_type:
+    case JavaTypeChar:
         return "C";
 
-    case short_type:
+    case JavaTypeShort:
         return "S";
 
-    case int_type:
+    case JavaTypeInt:
         return "I";
 
-    case long_type:
+    case JavaTypeLong:
         return "J";
 
-    case float_type:
+    case JavaTypeFloat:
         return "F";
 
-    case double_type:
+    case JavaTypeDouble:
         return "D";
 
-    case invalid_type:
+    case JavaTypeInvalid:
     default:
         break;
     }
     return "";
 }
 
-JNIType JNITypeFromPrimitiveType(char type)
+JavaType javaTypeFromPrimitiveType(char type)
 {
     switch (type) {
     case 'V':
-        return void_type;
+        return JavaTypeVoid;
 
     case 'L':
-        return object_type;
+        return JavaTypeObject;
 
     case '[':
-        return array_type;
+        return JavaTypeArray;
 
     case 'Z':
-        return boolean_type;
+        return JavaTypeBoolean;
 
     case 'B':
-        return byte_type;
+        return JavaTypeByte;
 
     case 'C':
-        return char_type;
+        return JavaTypeChar;
 
     case 'S':
-        return short_type;
+        return JavaTypeShort;
 
     case 'I':
-        return int_type;
+        return JavaTypeInt;
 
     case 'J':
-        return long_type;
+        return JavaTypeLong;
 
     case 'F':
-        return float_type;
+        return JavaTypeFloat;
 
     case 'D':
-        return double_type;
+        return JavaTypeDouble;
 
     default:
         break;
     }
-    return invalid_type;
+    return JavaTypeInvalid;
 }
 
-jvalue getJNIField(jobject obj, JNIType type, const char* name, const char* signature)
+jvalue getJNIField(jobject obj, JavaType type, const char* name, const char* signature)
 {
     JavaVM* jvm = getJavaVM();
     JNIEnv* env = getJNIEnv();
@@ -294,32 +301,35 @@ jvalue getJNIField(jobject obj, JNIType type, const char* name, const char* sign
             jfieldID field = env->GetFieldID(cls, name, signature);
             if (field) {
                 switch (type) {
-                case array_type:
-                case object_type:
+                case JavaTypeArray:
+                case JavaTypeObject:
+#if USE(V8)
+                case JavaTypeString:
+#endif
                     result.l = env->functions->GetObjectField(env, obj, field);
                     break;
-                case boolean_type:
+                case JavaTypeBoolean:
                     result.z = env->functions->GetBooleanField(env, obj, field);
                     break;
-                case byte_type:
+                case JavaTypeByte:
                     result.b = env->functions->GetByteField(env, obj, field);
                     break;
-                case char_type:
+                case JavaTypeChar:
                     result.c = env->functions->GetCharField(env, obj, field);
                     break;
-                case short_type:
+                case JavaTypeShort:
                     result.s = env->functions->GetShortField(env, obj, field);
                     break;
-                case int_type:
+                case JavaTypeInt:
                     result.i = env->functions->GetIntField(env, obj, field);
                     break;
-                case long_type:
+                case JavaTypeLong:
                     result.j = env->functions->GetLongField(env, obj, field);
                     break;
-                case float_type:
+                case JavaTypeFloat:
                     result.f = env->functions->GetFloatField(env, obj, field);
                     break;
-                case double_type:
+                case JavaTypeDouble:
                     result.d = env->functions->GetDoubleField(env, obj, field);
                     break;
                 default:
@@ -340,6 +350,50 @@ jvalue getJNIField(jobject obj, JNIType type, const char* name, const char* sign
     return result;
 }
 
+jvalue callJNIMethod(jobject object, JavaType returnType, const char* name, const char* signature, jvalue* args)
+{
+    jmethodID methodId = getMethodID(object, name, signature);
+    jvalue result;
+    switch (returnType) {
+    case JavaTypeVoid:
+        callJNIMethodIDA<void>(object, methodId, args);
+        break;
+    case JavaTypeObject:
+#if USE(V8)
+    case JavaTypeString:
+#endif
+        result.l = callJNIMethodIDA<jobject>(object, methodId, args);
+        break;
+    case JavaTypeBoolean:
+        result.z = callJNIMethodIDA<jboolean>(object, methodId, args);
+        break;
+    case JavaTypeByte:
+        result.b = callJNIMethodIDA<jbyte>(object, methodId, args);
+        break;
+    case JavaTypeChar:
+        result.c = callJNIMethodIDA<jchar>(object, methodId, args);
+        break;
+    case JavaTypeShort:
+        result.s = callJNIMethodIDA<jshort>(object, methodId, args);
+        break;
+    case JavaTypeInt:
+        result.i = callJNIMethodIDA<jint>(object, methodId, args);
+        break;
+    case JavaTypeLong:
+        result.j = callJNIMethodIDA<jlong>(object, methodId, args);
+        break;
+    case JavaTypeFloat:
+        result.f = callJNIMethodIDA<jfloat>(object, methodId, args);
+        break;
+    case JavaTypeDouble:
+        result.d = callJNIMethodIDA<jdouble>(object, methodId, args);
+        break;
+    default:
+        break;
+    }
+    return result;
+}
+
 } // namespace Bindings
 
 } // namespace JSC
diff --git a/Source/WebCore/bridge/jni/JNIUtility.h b/Source/WebCore/bridge/jni/JNIUtility.h
index 7b5d37c..508a2e5 100644
--- a/Source/WebCore/bridge/jni/JNIUtility.h
+++ b/Source/WebCore/bridge/jni/JNIUtility.h
@@ -28,36 +28,14 @@
 
 #if ENABLE(JAVA_BRIDGE)
 
+#include "JavaType.h"
+
 #if OS(MAC_OS_X)
 #include <JavaVM/jni.h>
 #else
 #include <jni.h>
 #endif
 
-// The order of these items can not be modified as they are tightly
-// bound with the JVM on Mac OSX. If new types need to be added, they
-// should be added to the end. It is used in jni_obc.mm when calling
-// through to the JVM. Newly added items need to be made compatible
-// in that file.
-//
-// TODO: Strictly, these are not JNI types but simply Java types. The type
-// conversion logic used here needs improving and this enum will likely be
-// changed at that time. See https://bugs.webkit.org/show_bug.cgi?id=38745
-typedef enum {
-    invalid_type = 0,
-    void_type,
-    object_type,
-    boolean_type,
-    byte_type,
-    char_type,
-    short_type,
-    int_type,
-    long_type,
-    float_type,
-    double_type,
-    array_type
-} JNIType;
-
 namespace JSC {
 
 namespace Bindings {
@@ -70,11 +48,12 @@ void releaseCharactersForJStringInEnv(JNIEnv*, jstring, const char*);
 const jchar* getUCharactersFromJStringInEnv(JNIEnv*, jstring);
 void releaseUCharactersForJStringInEnv(JNIEnv*, jstring, const jchar*);
 
-JNIType JNITypeFromClassName(const char* name);
-JNIType JNITypeFromPrimitiveType(char type);
-const char* signatureFromPrimitiveType(JNIType);
+JavaType javaTypeFromClassName(const char* name);
+JavaType javaTypeFromPrimitiveType(char type);
+const char* signatureFromJavaType(JavaType);
 
-jvalue getJNIField(jobject, JNIType, const char* name, const char* signature);
+jvalue getJNIField(jobject, JavaType, const char* name, const char* signature);
+jvalue callJNIMethod(jobject, JavaType returnType, const char* name, const char* signature, jvalue* args);
 
 jmethodID getMethodID(jobject, const char* name, const char* sig);
 JNIEnv* getJNIEnv();
diff --git a/Source/WebCore/bridge/jni/JavaMethod.h b/Source/WebCore/bridge/jni/JavaMethod.h
index 39d04c9..f15b653 100644
--- a/Source/WebCore/bridge/jni/JavaMethod.h
+++ b/Source/WebCore/bridge/jni/JavaMethod.h
@@ -30,9 +30,9 @@
 #if ENABLE(JAVA_BRIDGE)
 
 #include "Bridge.h"
-#include "JNIUtility.h"
+#include "JavaType.h"
 
-#include "JavaString.h"
+#include <wtf/text/WTFString.h>
 
 namespace JSC {
 
@@ -42,29 +42,12 @@ typedef const char* RuntimeType;
 
 class JavaMethod : public Method {
 public:
-    JavaMethod(JNIEnv*, jobject aMethod);
-    ~JavaMethod();
-
-    const JavaString& name() const { return m_name; }
-    RuntimeType returnType() const { return m_returnType.utf8(); }
-    const WTF::String& parameterAt(int i) const { return m_parameters[i]; }
-    int numParameters() const { return m_parameters.size(); }
-
-    const char* signature() const;
-    JNIType JNIReturnType() const;
-
-    jmethodID methodID(jobject obj) const;
-
-    bool isStatic() const { return m_isStatic; }
-
-private:
-    Vector<WTF::String> m_parameters;
-    JavaString m_name;
-    mutable char* m_signature;
-    JavaString m_returnType;
-    JNIType m_JNIReturnType;
-    mutable jmethodID m_methodID;
-    bool m_isStatic;
+    virtual String name() const = 0;
+    virtual RuntimeType returnTypeClassName() const = 0;
+    virtual String parameterAt(int) const = 0;
+    virtual const char* signature() const = 0;
+    virtual JavaType returnType() const = 0;
+    virtual bool isStatic() const = 0;
 };
 
 } // namespace Bindings
diff --git a/Source/WebCore/bridge/jni/JavaMethod.cpp b/Source/WebCore/bridge/jni/JavaMethodJobject.cpp
index 60620a0..2f2802c 100644
--- a/Source/WebCore/bridge/jni/JavaMethod.cpp
+++ b/Source/WebCore/bridge/jni/JavaMethodJobject.cpp
@@ -25,7 +25,7 @@
  */
 
 #include "config.h"
-#include "JavaMethod.h"
+#include "JavaMethodJobject.h"
 
 #if ENABLE(JAVA_BRIDGE)
 
@@ -40,7 +40,7 @@
 using namespace JSC;
 using namespace JSC::Bindings;
 
-JavaMethod::JavaMethod(JNIEnv* env, jobject aMethod)
+JavaMethodJobject::JavaMethodJobject(JNIEnv* env, jobject aMethod)
 {
     // Get return type name
     jstring returnTypeName = 0;
@@ -50,14 +50,14 @@ JavaMethod::JavaMethod(JNIEnv* env, jobject aMethod)
             returnTypeName = env->NewStringUTF("<Unknown>");
         env->DeleteLocalRef(returnType);
     }
-    m_returnType = JavaString(env, returnTypeName);
-    m_JNIReturnType = JNITypeFromClassName(m_returnType.utf8());
+    m_returnTypeClassName = JavaString(env, returnTypeName);
+    m_returnType = javaTypeFromClassName(m_returnTypeClassName.utf8());
     env->DeleteLocalRef(returnTypeName);
 
     // Get method name
     jstring methodName = static_cast<jstring>(callJNIMethod<jobject>(aMethod, "getName", "()Ljava/lang/String;"));
-    if (!returnTypeName)
-        returnTypeName = env->NewStringUTF("<Unknown>");
+    if (!methodName)
+        methodName = env->NewStringUTF("<Unknown>");
     m_name = JavaString(env, methodName);
     env->DeleteLocalRef(methodName);
 
@@ -79,7 +79,6 @@ JavaMethod::JavaMethod(JNIEnv* env, jobject aMethod)
 
     // Created lazily.
     m_signature = 0;
-    m_methodID = 0;
 
     jclass modifierClass = env->FindClass("java/lang/reflect/Modifier");
     int modifiers = callJNIMethod<jint>(aMethod, "getModifiers", "()I");
@@ -87,7 +86,7 @@ JavaMethod::JavaMethod(JNIEnv* env, jobject aMethod)
     env->DeleteLocalRef(modifierClass);
 }
 
-JavaMethod::~JavaMethod()
+JavaMethodJobject::~JavaMethodJobject()
 {
     if (m_signature)
         fastFree(m_signature);
@@ -115,7 +114,7 @@ static void appendClassName(StringBuilder& builder, const char* className)
     fastFree(result);
 }
 
-const char* JavaMethod::signature() const
+const char* JavaMethodJobject::signature() const
 {
     if (!m_signature) {
 #if USE(JSC)
@@ -126,12 +125,12 @@ const char* JavaMethod::signature() const
         signatureBuilder.append('(');
         for (unsigned int i = 0; i < m_parameters.size(); i++) {
             CString javaClassName = parameterAt(i).utf8();
-            JNIType type = JNITypeFromClassName(javaClassName.data());
-            if (type == array_type)
+            JavaType type = javaTypeFromClassName(javaClassName.data());
+            if (type == JavaTypeArray)
                 appendClassName(signatureBuilder, javaClassName.data());
             else {
-                signatureBuilder.append(signatureFromPrimitiveType(type));
-                if (type == object_type) {
+                signatureBuilder.append(signatureFromJavaType(type));
+                if (type == JavaTypeObject) {
                     appendClassName(signatureBuilder, javaClassName.data());
                     signatureBuilder.append(';');
                 }
@@ -139,12 +138,12 @@ const char* JavaMethod::signature() const
         }
         signatureBuilder.append(')');
 
-        const char* returnType = m_returnType.utf8();
-        if (m_JNIReturnType == array_type)
+        const char* returnType = m_returnTypeClassName.utf8();
+        if (m_returnType == JavaTypeArray)
             appendClassName(signatureBuilder, returnType);
         else {
-            signatureBuilder.append(signatureFromPrimitiveType(m_JNIReturnType));
-            if (m_JNIReturnType == object_type) {
+            signatureBuilder.append(signatureFromJavaType(m_returnType));
+            if (m_returnType == JavaTypeObject) {
                 appendClassName(signatureBuilder, returnType);
                 signatureBuilder.append(';');
             }
@@ -157,16 +156,4 @@ const char* JavaMethod::signature() const
     return m_signature;
 }
 
-JNIType JavaMethod::JNIReturnType() const
-{
-    return m_JNIReturnType;
-}
-
-jmethodID JavaMethod::methodID(jobject obj) const
-{
-    if (!m_methodID)
-        m_methodID = getMethodID(obj, m_name.utf8(), signature());
-    return m_methodID;
-}
-
 #endif // ENABLE(JAVA_BRIDGE)
diff --git a/Source/WebCore/bridge/jni/JavaMethodJobject.h b/Source/WebCore/bridge/jni/JavaMethodJobject.h
new file mode 100644
index 0000000..d9482ba
--- /dev/null
+++ b/Source/WebCore/bridge/jni/JavaMethodJobject.h
@@ -0,0 +1,72 @@
+/*
+ * Copyright (C) 2003, 2004, 2005, 2007, 2009, 2010 Apple Inc. All rights reserved.
+ * Copyright 2010, The Android Open Source Project
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef JavaMethodJobject_h
+#define JavaMethodJobject_h
+
+#if ENABLE(JAVA_BRIDGE)
+
+#include "JavaMethod.h"
+#include "JavaString.h"
+
+#include <wtf/text/CString.h>
+
+namespace JSC {
+
+namespace Bindings {
+
+class JavaMethodJobject : public JavaMethod {
+public:
+    JavaMethodJobject(JNIEnv*, jobject);
+    virtual ~JavaMethodJobject();
+
+    // JavaMethod implementation
+    virtual String name() const { return m_name.impl(); }
+    virtual RuntimeType returnTypeClassName() const { return m_returnTypeClassName.utf8(); }
+    virtual String parameterAt(int i) const { return m_parameters[i]; }
+    virtual const char* signature() const;
+    virtual JavaType returnType() const { return m_returnType; }
+    virtual bool isStatic() const { return m_isStatic; }
+
+    // Method implementation
+    virtual int numParameters() const { return m_parameters.size(); }
+
+private:
+    Vector<String> m_parameters;
+    JavaString m_name;
+    mutable char* m_signature;
+    JavaString m_returnTypeClassName;
+    JavaType m_returnType;
+    bool m_isStatic;
+};
+
+} // namespace Bindings
+
+} // namespace JSC
+
+#endif // ENABLE(JAVA_BRIDGE)
+
+#endif // JavaMethodJobject_h
diff --git a/Source/WebCore/bridge/jni/JavaType.h b/Source/WebCore/bridge/jni/JavaType.h
new file mode 100644
index 0000000..17053fb
--- /dev/null
+++ b/Source/WebCore/bridge/jni/JavaType.h
@@ -0,0 +1,78 @@
+/*
+ * Copyright (C) 2003, 2004, 2005, 2008, 2009, 2010 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef JavaType_h
+#define JavaType_h
+
+#if ENABLE(JAVA_BRIDGE)
+
+namespace JSC {
+
+namespace Bindings {
+
+// The order of these items can not be modified as they are tightly
+// bound with the JVM on Mac OSX. If new types need to be added, they
+// should be added to the end. It is used in jni_obc.mm when calling
+// through to the JVM. Newly added items need to be made compatible
+// in that file.
+//
+// The type conversion logic used here needs improving and this enum will likely
+// be changed at that time. See https://bugs.webkit.org/show_bug.cgi?id=38745
+enum JavaType {
+    JavaTypeInvalid = 0,
+    JavaTypeVoid,
+    JavaTypeObject,
+    JavaTypeBoolean,
+    JavaTypeByte,
+    JavaTypeChar,
+    JavaTypeShort,
+    JavaTypeInt,
+    JavaTypeLong,
+    JavaTypeFloat,
+    JavaTypeDouble,
+    JavaTypeArray,
+#if USE(V8)
+    // JavaTypeString is distinct from JavaTypeObject because strings receive
+    // special handling when we convert to and from JavaScript. When calling
+    // Java methods, we must create Java String objects for string arguments.
+    // However, at conversion time we cannot assume that the mechanism used to
+    // interact with Java is JNI. Instead we use a special JavaTypeString.
+    // Implementations of JavaInstance which use JNI will create a Java String
+    // object when converting the JavaValue to a jvalue.
+    //
+    // Note that this type is independent of the JavaScript engine, but is
+    // currently used only with V8.
+    // See https://bugs.webkit.org/show_bug.cgi?id=57023.
+    JavaTypeString,
+#endif
+};
+
+} // namespace Bindings
+
+} // namespace JSC
+
+#endif // ENABLE(JAVA_BRIDGE)
+
+#endif // JavaType_h
diff --git a/Source/WebCore/bridge/jni/jni_jsobject.mm b/Source/WebCore/bridge/jni/jni_jsobject.mm
index 172559e..03b8fc2 100644
--- a/Source/WebCore/bridge/jni/jni_jsobject.mm
+++ b/Source/WebCore/bridge/jni/jni_jsobject.mm
@@ -419,7 +419,7 @@ jstring JavaJSObject::toString() const
     JSObject *thisObj = const_cast<JSObject*>(_imp);
     ExecState* exec = rootObject->globalObject()->globalExec();
     
-    return static_cast<jstring>(convertValueToJValue(exec, rootObject, thisObj, object_type, "java.lang.String").l);
+    return static_cast<jstring>(convertValueToJValue(exec, rootObject, thisObj, JavaTypeObject, "java.lang.String").l);
 }
 
 void JavaJSObject::finalize() const
diff --git a/Source/WebCore/bridge/jni/jni_objc.mm b/Source/WebCore/bridge/jni/jni_objc.mm
index 8fa2c3f..9c943e8 100644
--- a/Source/WebCore/bridge/jni/jni_objc.mm
+++ b/Source/WebCore/bridge/jni/jni_objc.mm
@@ -28,31 +28,31 @@
 #if ENABLE(JAVA_BRIDGE)
 
 #import <Foundation/Foundation.h>
-#import "JNIUtility.h"
 #import "JNIUtilityPrivate.h"
+#import "JavaType.h"
 #import "objc_utility.h"
 #include <runtime/JSLock.h>
 
 using namespace JSC::Bindings;
 
 @interface NSObject (WebScriptingPrivate)
-- (jvalue)webPlugInCallJava:(jobject)object method:(jmethodID)method returnType:(JNIType)returnType arguments:(jvalue*)args;
+- (jvalue)webPlugInCallJava:(jobject)object method:(jmethodID)method returnType:(JavaType)returnType arguments:(jvalue*)args;
 - (jvalue)webPlugInCallJava:(jobject)object
                    isStatic:(BOOL)isStatic
-                 returnType:(JNIType)returnType
+                 returnType:(JavaType)returnType
                      method:(jmethodID)method
                   arguments:(jvalue*)args
                  callingURL:(NSURL *)url
        exceptionDescription:(NSString **)exceptionString;
 @end
 
-bool JSC::Bindings::dispatchJNICall(ExecState* exec, const void* targetAppletView, jobject obj, bool isStatic, JNIType returnType, jmethodID methodID, jvalue* args, jvalue &result, const char*, JSValue& exceptionDescription)
+bool JSC::Bindings::dispatchJNICall(ExecState* exec, const void* targetAppletView, jobject obj, bool isStatic, JavaType returnType, jmethodID methodID, jvalue* args, jvalue &result, const char*, JSValue& exceptionDescription)
 {
     id view = (id)targetAppletView;
     
-    // As array_type is not known by the Mac JVM, change it to a compatible type.
-    if (returnType == array_type)
-        returnType = object_type;
+    // As JavaTypeArray is not known by the Mac JVM, change it to a compatible type.
+    if (returnType == JavaTypeArray)
+        returnType = JavaTypeObject;
     
     if ([view respondsToSelector:@selector(webPlugInCallJava:isStatic:returnType:method:arguments:callingURL:exceptionDescription:)]) {
         NSString *_exceptionDescription = 0;
diff --git a/Source/WebCore/bridge/jni/jsc/JNIUtilityPrivate.cpp b/Source/WebCore/bridge/jni/jsc/JNIUtilityPrivate.cpp
index a8be0bd..2356fe1 100644
--- a/Source/WebCore/bridge/jni/jsc/JNIUtilityPrivate.cpp
+++ b/Source/WebCore/bridge/jni/jsc/JNIUtilityPrivate.cpp
@@ -53,8 +53,8 @@ static jobject convertArrayInstanceToJavaArray(ExecState* exec, JSArray* jsArray
     jobjectArray jarray = 0;
 
     // Build the correct array type
-    switch (JNITypeFromPrimitiveType(javaClassName[1])) {
-    case object_type:
+    switch (javaTypeFromPrimitiveType(javaClassName[1])) {
+    case JavaTypeObject:
             {
             // Only support string object types
             if (!strcmp("[Ljava.lang.String;", javaClassName)) {
@@ -71,7 +71,7 @@ static jobject convertArrayInstanceToJavaArray(ExecState* exec, JSArray* jsArray
             break;
         }
 
-    case boolean_type:
+    case JavaTypeBoolean:
         {
             jarray = (jobjectArray)env->NewBooleanArray(length);
             for (unsigned i = 0; i < length; i++) {
@@ -82,7 +82,7 @@ static jobject convertArrayInstanceToJavaArray(ExecState* exec, JSArray* jsArray
             break;
         }
 
-    case byte_type:
+    case JavaTypeByte:
         {
             jarray = (jobjectArray)env->NewByteArray(length);
             for (unsigned i = 0; i < length; i++) {
@@ -93,7 +93,7 @@ static jobject convertArrayInstanceToJavaArray(ExecState* exec, JSArray* jsArray
             break;
         }
 
-    case char_type:
+    case JavaTypeChar:
         {
             jarray = (jobjectArray)env->NewCharArray(length);
             for (unsigned i = 0; i < length; i++) {
@@ -107,7 +107,7 @@ static jobject convertArrayInstanceToJavaArray(ExecState* exec, JSArray* jsArray
             break;
         }
 
-    case short_type:
+    case JavaTypeShort:
         {
             jarray = (jobjectArray)env->NewShortArray(length);
             for (unsigned i = 0; i < length; i++) {
@@ -118,7 +118,7 @@ static jobject convertArrayInstanceToJavaArray(ExecState* exec, JSArray* jsArray
             break;
         }
 
-    case int_type:
+    case JavaTypeInt:
         {
             jarray = (jobjectArray)env->NewIntArray(length);
             for (unsigned i = 0; i < length; i++) {
@@ -129,7 +129,7 @@ static jobject convertArrayInstanceToJavaArray(ExecState* exec, JSArray* jsArray
             break;
         }
 
-    case long_type:
+    case JavaTypeLong:
         {
             jarray = (jobjectArray)env->NewLongArray(length);
             for (unsigned i = 0; i < length; i++) {
@@ -140,7 +140,7 @@ static jobject convertArrayInstanceToJavaArray(ExecState* exec, JSArray* jsArray
             break;
         }
 
-    case float_type:
+    case JavaTypeFloat:
         {
             jarray = (jobjectArray)env->NewFloatArray(length);
             for (unsigned i = 0; i < length; i++) {
@@ -151,7 +151,7 @@ static jobject convertArrayInstanceToJavaArray(ExecState* exec, JSArray* jsArray
             break;
         }
 
-    case double_type:
+    case JavaTypeDouble:
         {
             jarray = (jobjectArray)env->NewDoubleArray(length);
             for (unsigned i = 0; i < length; i++) {
@@ -162,9 +162,9 @@ static jobject convertArrayInstanceToJavaArray(ExecState* exec, JSArray* jsArray
             break;
         }
 
-    case array_type: // don't handle embedded arrays
-    case void_type: // Don't expect arrays of void objects
-    case invalid_type: // Array of unknown objects
+    case JavaTypeArray: // don't handle embedded arrays
+    case JavaTypeVoid: // Don't expect arrays of void objects
+    case JavaTypeInvalid: // Array of unknown objects
         break;
     }
 
@@ -172,16 +172,16 @@ static jobject convertArrayInstanceToJavaArray(ExecState* exec, JSArray* jsArray
     return jarray;
 }
 
-jvalue convertValueToJValue(ExecState* exec, RootObject* rootObject, JSValue value, JNIType jniType, const char* javaClassName)
+jvalue convertValueToJValue(ExecState* exec, RootObject* rootObject, JSValue value, JavaType javaType, const char* javaClassName)
 {
     JSLock lock(SilenceAssertionsOnly);
 
     jvalue result;
     memset(&result, 0, sizeof(jvalue));
 
-    switch (jniType) {
-    case array_type:
-    case object_type:
+    switch (javaType) {
+    case JavaTypeArray:
+    case JavaTypeObject:
         {
             // FIXME: JavaJSObject::convertValueToJObject functionality is almost exactly the same,
             // these functions should use common code.
@@ -258,56 +258,56 @@ jvalue convertValueToJValue(ExecState* exec, RootObject* rootObject, JSValue val
         }
         break;
 
-    case boolean_type:
+    case JavaTypeBoolean:
         {
             result.z = (jboolean)value.toNumber(exec);
         }
         break;
 
-    case byte_type:
+    case JavaTypeByte:
         {
             result.b = (jbyte)value.toNumber(exec);
         }
         break;
 
-    case char_type:
+    case JavaTypeChar:
         {
             result.c = (jchar)value.toNumber(exec);
         }
         break;
 
-    case short_type:
+    case JavaTypeShort:
         {
             result.s = (jshort)value.toNumber(exec);
         }
         break;
 
-    case int_type:
+    case JavaTypeInt:
         {
             result.i = (jint)value.toNumber(exec);
         }
         break;
 
-    case long_type:
+    case JavaTypeLong:
         {
             result.j = (jlong)value.toNumber(exec);
         }
         break;
 
-    case float_type:
+    case JavaTypeFloat:
         {
             result.f = (jfloat)value.toNumber(exec);
         }
         break;
 
-    case double_type:
+    case JavaTypeDouble:
         {
             result.d = (jdouble)value.toNumber(exec);
         }
         break;
 
-    case invalid_type:
-    case void_type:
+    case JavaTypeInvalid:
+    case JavaTypeVoid:
         break;
     }
     return result;
diff --git a/Source/WebCore/bridge/jni/jsc/JNIUtilityPrivate.h b/Source/WebCore/bridge/jni/jsc/JNIUtilityPrivate.h
index 1266acd..ed09fd6 100644
--- a/Source/WebCore/bridge/jni/jsc/JNIUtilityPrivate.h
+++ b/Source/WebCore/bridge/jni/jsc/JNIUtilityPrivate.h
@@ -41,8 +41,8 @@ namespace Bindings {
 
 class RootObject;
 
-jvalue convertValueToJValue(ExecState*, RootObject*, JSValue, JNIType, const char* javaClassName);
-bool dispatchJNICall(ExecState*, const void* targetAppletView, jobject obj, bool isStatic, JNIType returnType, jmethodID methodID, jvalue* args, jvalue& result, const char* callingURL, JSValue& exceptionDescription);
+jvalue convertValueToJValue(ExecState*, RootObject*, JSValue, JavaType, const char* javaClassName);
+bool dispatchJNICall(ExecState*, const void* targetAppletView, jobject, bool isStatic, JavaType returnType, jmethodID, jvalue* args, jvalue& result, const char* callingURL, JSValue& exceptionDescription);
 
 } // namespace Bindings
 
diff --git a/Source/WebCore/bridge/jni/jsc/JavaArrayJSC.cpp b/Source/WebCore/bridge/jni/jsc/JavaArrayJSC.cpp
index db87baa..caa8579 100644
--- a/Source/WebCore/bridge/jni/jsc/JavaArrayJSC.cpp
+++ b/Source/WebCore/bridge/jni/jsc/JavaArrayJSC.cpp
@@ -75,7 +75,7 @@ void JavaArray::setValueAt(ExecState* exec, unsigned index, JSValue aValue) cons
     JNIEnv* env = getJNIEnv();
     char* javaClassName = 0;
 
-    JNIType arrayType = JNITypeFromPrimitiveType(m_type[1]);
+    JavaType arrayType = javaTypeFromPrimitiveType(m_type[1]);
     if (m_type[1] == 'L') {
         // The type of the array will be something like:
         // "[Ljava.lang.string;". This is guaranteed, so no need
@@ -86,54 +86,54 @@ void JavaArray::setValueAt(ExecState* exec, unsigned index, JSValue aValue) cons
     jvalue aJValue = convertValueToJValue(exec, m_rootObject.get(), aValue, arrayType, javaClassName);
 
     switch (arrayType) {
-    case object_type:
+    case JavaTypeObject:
         {
             env->SetObjectArrayElement(static_cast<jobjectArray>(javaArray()), index, aJValue.l);
             break;
         }
 
-    case boolean_type:
+    case JavaTypeBoolean:
         {
             env->SetBooleanArrayRegion(static_cast<jbooleanArray>(javaArray()), index, 1, &aJValue.z);
             break;
         }
 
-    case byte_type:
+    case JavaTypeByte:
         {
             env->SetByteArrayRegion(static_cast<jbyteArray>(javaArray()), index, 1, &aJValue.b);
             break;
         }
 
-    case char_type:
+    case JavaTypeChar:
         {
             env->SetCharArrayRegion(static_cast<jcharArray>(javaArray()), index, 1, &aJValue.c);
             break;
         }
 
-    case short_type:
+    case JavaTypeShort:
         {
             env->SetShortArrayRegion(static_cast<jshortArray>(javaArray()), index, 1, &aJValue.s);
             break;
         }
 
-    case int_type:
+    case JavaTypeInt:
         {
             env->SetIntArrayRegion(static_cast<jintArray>(javaArray()), index, 1, &aJValue.i);
             break;
         }
 
-    case long_type:
+    case JavaTypeLong:
         {
             env->SetLongArrayRegion(static_cast<jlongArray>(javaArray()), index, 1, &aJValue.j);
         }
 
-    case float_type:
+    case JavaTypeFloat:
         {
             env->SetFloatArrayRegion(static_cast<jfloatArray>(javaArray()), index, 1, &aJValue.f);
             break;
         }
 
-    case double_type:
+    case JavaTypeDouble:
         {
             env->SetDoubleArrayRegion(static_cast<jdoubleArray>(javaArray()), index, 1, &aJValue.d);
             break;
@@ -149,9 +149,9 @@ void JavaArray::setValueAt(ExecState* exec, unsigned index, JSValue aValue) cons
 JSValue JavaArray::valueAt(ExecState* exec, unsigned index) const
 {
     JNIEnv* env = getJNIEnv();
-    JNIType arrayType = JNITypeFromPrimitiveType(m_type[1]);
+    JavaType arrayType = javaTypeFromPrimitiveType(m_type[1]);
     switch (arrayType) {
-    case object_type:
+    case JavaTypeObject:
         {
             jobjectArray objectArray = static_cast<jobjectArray>(javaArray());
             jobject anObject;
@@ -168,7 +168,7 @@ JSValue JavaArray::valueAt(ExecState* exec, unsigned index) const
             return JavaInstance::create(anObject, rootObject())->createRuntimeObject(exec);
         }
 
-    case boolean_type:
+    case JavaTypeBoolean:
         {
             jbooleanArray booleanArray = static_cast<jbooleanArray>(javaArray());
             jboolean aBoolean;
@@ -176,7 +176,7 @@ JSValue JavaArray::valueAt(ExecState* exec, unsigned index) const
             return jsBoolean(aBoolean);
         }
 
-    case byte_type:
+    case JavaTypeByte:
         {
             jbyteArray byteArray = static_cast<jbyteArray>(javaArray());
             jbyte aByte;
@@ -184,7 +184,7 @@ JSValue JavaArray::valueAt(ExecState* exec, unsigned index) const
             return jsNumber(aByte);
         }
 
-    case char_type:
+    case JavaTypeChar:
         {
             jcharArray charArray = static_cast<jcharArray>(javaArray());
             jchar aChar;
@@ -193,7 +193,7 @@ JSValue JavaArray::valueAt(ExecState* exec, unsigned index) const
             break;
         }
 
-    case short_type:
+    case JavaTypeShort:
         {
             jshortArray shortArray = static_cast<jshortArray>(javaArray());
             jshort aShort;
@@ -201,7 +201,7 @@ JSValue JavaArray::valueAt(ExecState* exec, unsigned index) const
             return jsNumber(aShort);
         }
 
-    case int_type:
+    case JavaTypeInt:
         {
             jintArray intArray = static_cast<jintArray>(javaArray());
             jint anInt;
@@ -209,7 +209,7 @@ JSValue JavaArray::valueAt(ExecState* exec, unsigned index) const
             return jsNumber(anInt);
         }
 
-    case long_type:
+    case JavaTypeLong:
         {
             jlongArray longArray = static_cast<jlongArray>(javaArray());
             jlong aLong;
@@ -217,7 +217,7 @@ JSValue JavaArray::valueAt(ExecState* exec, unsigned index) const
             return jsNumber(aLong);
         }
 
-    case float_type:
+    case JavaTypeFloat:
         {
             jfloatArray floatArray = static_cast<jfloatArray>(javaArray());
             jfloat aFloat;
@@ -225,7 +225,7 @@ JSValue JavaArray::valueAt(ExecState* exec, unsigned index) const
             return jsNumber(aFloat);
         }
 
-    case double_type:
+    case JavaTypeDouble:
         {
             jdoubleArray doubleArray = static_cast<jdoubleArray>(javaArray());
             jdouble aDouble;
diff --git a/Source/WebCore/bridge/jni/jsc/JavaClassJSC.cpp b/Source/WebCore/bridge/jni/jsc/JavaClassJSC.cpp
index 18cd1af..44ea2b4 100644
--- a/Source/WebCore/bridge/jni/jsc/JavaClassJSC.cpp
+++ b/Source/WebCore/bridge/jni/jsc/JavaClassJSC.cpp
@@ -28,10 +28,9 @@
 
 #if ENABLE(JAVA_BRIDGE)
 
-#include "JNIUtility.h"
 #include "JSDOMWindow.h"
 #include "JavaFieldJSC.h"
-#include "JavaMethod.h"
+#include "JavaMethodJobject.h"
 #include <runtime/Identifier.h>
 #include <runtime/JSLock.h>
 
@@ -77,7 +76,7 @@ JavaClass::JavaClass(jobject anInstance)
         int numMethods = env->GetArrayLength(methods);
         for (i = 0; i < numMethods; i++) {
             jobject aJMethod = env->GetObjectArrayElement((jobjectArray)methods, i);
-            JavaMethod* aMethod = new JavaMethod(env, aJMethod); // deleted in the JavaClass destructor
+            JavaMethod* aMethod = new JavaMethodJobject(env, aJMethod); // deleted in the JavaClass destructor
             MethodList* methodList;
             {
                 JSLock lock(SilenceAssertionsOnly);
diff --git a/Source/WebCore/bridge/jni/jsc/JavaFieldJSC.cpp b/Source/WebCore/bridge/jni/jsc/JavaFieldJSC.cpp
index d3ba06a..b7c664e 100644
--- a/Source/WebCore/bridge/jni/jsc/JavaFieldJSC.cpp
+++ b/Source/WebCore/bridge/jni/jsc/JavaFieldJSC.cpp
@@ -48,9 +48,9 @@ JavaField::JavaField(JNIEnv* env, jobject aField)
         fieldTypeName = static_cast<jstring>(callJNIMethod<jobject>(fieldType, "getName", "()Ljava/lang/String;"));
     if (!fieldTypeName)
         fieldTypeName = env->NewStringUTF("<Unknown>");
-    m_type = JavaString(env, fieldTypeName);
+    m_typeClassName = JavaString(env, fieldTypeName);
 
-    m_JNIType = JNITypeFromClassName(m_type.utf8());
+    m_type = javaTypeFromClassName(m_typeClassName.utf8());
 
     // Get field name
     jstring fieldName = static_cast<jstring>(callJNIMethod<jobject>(aField, "getName", "()Ljava/lang/String;"));
@@ -61,7 +61,7 @@ JavaField::JavaField(JNIEnv* env, jobject aField)
     m_field = new JobjectWrapper(aField);
 }
 
-jvalue JavaField::dispatchValueFromInstance(ExecState* exec, const JavaInstance* instance, const char* name, const char* sig, JNIType returnType) const
+jvalue JavaField::dispatchValueFromInstance(ExecState* exec, const JavaInstance* instance, const char* name, const char* sig, JavaType returnType) const
 {
     jobject jinstance = instance->javaInstance();
     jobject fieldJInstance = m_field->m_instance;
@@ -94,17 +94,17 @@ JSValue JavaField::valueFromInstance(ExecState* exec, const Instance* i) const
 
     JSValue jsresult = jsUndefined();
 
-    switch (m_JNIType) {
-    case array_type:
-    case object_type:
+    switch (m_type) {
+    case JavaTypeArray:
+    case JavaTypeObject:
         {
-            jvalue result = dispatchValueFromInstance(exec, instance, "get", "(Ljava/lang/Object;)Ljava/lang/Object;", object_type);
+            jvalue result = dispatchValueFromInstance(exec, instance, "get", "(Ljava/lang/Object;)Ljava/lang/Object;", JavaTypeObject);
             jobject anObject = result.l;
 
             if (!anObject)
                 return jsNull();
 
-            const char* arrayType = type();
+            const char* arrayType = typeClassName();
             if (arrayType[0] == '[')
                 jsresult = JavaArray::convertJObjectToArray(exec, anObject, arrayType, instance->rootObject());
             else if (anObject)
@@ -112,29 +112,29 @@ JSValue JavaField::valueFromInstance(ExecState* exec, const Instance* i) const
         }
         break;
 
-    case boolean_type:
-        jsresult = jsBoolean(dispatchValueFromInstance(exec, instance, "getBoolean", "(Ljava/lang/Object;)Z", boolean_type).z);
+    case JavaTypeBoolean:
+        jsresult = jsBoolean(dispatchValueFromInstance(exec, instance, "getBoolean", "(Ljava/lang/Object;)Z", JavaTypeBoolean).z);
         break;
 
-    case byte_type:
-    case char_type:
-    case short_type:
+    case JavaTypeByte:
+    case JavaTypeChar:
+    case JavaTypeShort:
 
-    case int_type:
+    case JavaTypeInt:
         {
             jint value;
-            jvalue result = dispatchValueFromInstance(exec, instance, "getInt", "(Ljava/lang/Object;)I", int_type);
+            jvalue result = dispatchValueFromInstance(exec, instance, "getInt", "(Ljava/lang/Object;)I", JavaTypeInt);
             value = result.i;
             jsresult = jsNumber(static_cast<int>(value));
         }
         break;
 
-    case long_type:
-    case float_type:
-    case double_type:
+    case JavaTypeLong:
+    case JavaTypeFloat:
+    case JavaTypeDouble:
         {
             jdouble value;
-            jvalue result = dispatchValueFromInstance(exec, instance, "getDouble", "(Ljava/lang/Object;)D", double_type);
+            jvalue result = dispatchValueFromInstance(exec, instance, "getDouble", "(Ljava/lang/Object;)D", JavaTypeDouble);
             value = result.i;
             jsresult = jsNumber(static_cast<double>(value));
         }
@@ -166,7 +166,7 @@ void JavaField::dispatchSetValueToInstance(ExecState* exec, const JavaInstance*
 
                 args[0].l = jinstance;
                 args[1] = javaValue;
-                dispatchJNICall(exec, rootObject->nativeHandle(), fieldJInstance, false, void_type, mid, args, result, 0, exceptionDescription);
+                dispatchJNICall(exec, rootObject->nativeHandle(), fieldJInstance, false, JavaTypeVoid, mid, args, result, 0, exceptionDescription);
                 if (exceptionDescription)
                     throwError(exec, createError(exec, exceptionDescription.toString(exec)));
             }
@@ -177,61 +177,61 @@ void JavaField::dispatchSetValueToInstance(ExecState* exec, const JavaInstance*
 void JavaField::setValueToInstance(ExecState* exec, const Instance* i, JSValue aValue) const
 {
     const JavaInstance* instance = static_cast<const JavaInstance*>(i);
-    jvalue javaValue = convertValueToJValue(exec, i->rootObject(), aValue, m_JNIType, type());
+    jvalue javaValue = convertValueToJValue(exec, i->rootObject(), aValue, m_type, typeClassName());
 
     LOG(LiveConnect, "JavaField::setValueToInstance setting value %s to %s", UString(name().impl()).utf8().data(), aValue.toString(exec).ascii().data());
 
-    switch (m_JNIType) {
-    case array_type:
-    case object_type:
+    switch (m_type) {
+    case JavaTypeArray:
+    case JavaTypeObject:
         {
             dispatchSetValueToInstance(exec, instance, javaValue, "set", "(Ljava/lang/Object;Ljava/lang/Object;)V");
         }
         break;
 
-    case boolean_type:
+    case JavaTypeBoolean:
         {
             dispatchSetValueToInstance(exec, instance, javaValue, "setBoolean", "(Ljava/lang/Object;Z)V");
         }
         break;
 
-    case byte_type:
+    case JavaTypeByte:
         {
             dispatchSetValueToInstance(exec, instance, javaValue, "setByte", "(Ljava/lang/Object;B)V");
         }
         break;
 
-    case char_type:
+    case JavaTypeChar:
         {
             dispatchSetValueToInstance(exec, instance, javaValue, "setChar", "(Ljava/lang/Object;C)V");
         }
         break;
 
-    case short_type:
+    case JavaTypeShort:
         {
             dispatchSetValueToInstance(exec, instance, javaValue, "setShort", "(Ljava/lang/Object;S)V");
         }
         break;
 
-    case int_type:
+    case JavaTypeInt:
         {
             dispatchSetValueToInstance(exec, instance, javaValue, "setInt", "(Ljava/lang/Object;I)V");
         }
         break;
 
-    case long_type:
+    case JavaTypeLong:
         {
             dispatchSetValueToInstance(exec, instance, javaValue, "setLong", "(Ljava/lang/Object;J)V");
         }
         break;
 
-    case float_type:
+    case JavaTypeFloat:
         {
             dispatchSetValueToInstance(exec, instance, javaValue, "setFloat", "(Ljava/lang/Object;F)V");
         }
         break;
 
-    case double_type:
+    case JavaTypeDouble:
         {
             dispatchSetValueToInstance(exec, instance, javaValue, "setDouble", "(Ljava/lang/Object;D)V");
         }
diff --git a/Source/WebCore/bridge/jni/jsc/JavaFieldJSC.h b/Source/WebCore/bridge/jni/jsc/JavaFieldJSC.h
index a67264a..9b95132 100644
--- a/Source/WebCore/bridge/jni/jsc/JavaFieldJSC.h
+++ b/Source/WebCore/bridge/jni/jsc/JavaFieldJSC.h
@@ -47,17 +47,16 @@ public:
     virtual void setValueToInstance(ExecState*, const Instance*, JSValue) const;
 
     const JavaString& name() const { return m_name; }
-    virtual RuntimeType type() const { return m_type.utf8(); }
-
-    JNIType getJNIType() const { return m_JNIType; }
+    virtual RuntimeType typeClassName() const { return m_typeClassName.utf8(); }
+    JavaType type() const { return m_type; }
 
 private:
     void dispatchSetValueToInstance(ExecState*, const JavaInstance*, jvalue, const char* name, const char* sig) const;
-    jvalue dispatchValueFromInstance(ExecState*, const JavaInstance*, const char* name, const char* sig, JNIType returnType) const;
+    jvalue dispatchValueFromInstance(ExecState*, const JavaInstance*, const char* name, const char* sig, JavaType returnType) const;
 
     JavaString m_name;
-    JavaString m_type;
-    JNIType m_JNIType;
+    JavaString m_typeClassName;
+    JavaType m_type;
     RefPtr<JobjectWrapper> m_field;
 };
 
diff --git a/Source/WebCore/bridge/jni/jsc/JavaInstanceJSC.cpp b/Source/WebCore/bridge/jni/jsc/JavaInstanceJSC.cpp
index 9d9a450..806efa6 100644
--- a/Source/WebCore/bridge/jni/jsc/JavaInstanceJSC.cpp
+++ b/Source/WebCore/bridge/jni/jsc/JavaInstanceJSC.cpp
@@ -29,7 +29,6 @@
 #if ENABLE(JAVA_BRIDGE)
 
 #include "JavaRuntimeObject.h"
-#include "JNIUtility.h"
 #include "JNIUtilityPrivate.h"
 #include "JSDOMBinding.h"
 #include "JavaArrayJSC.h"
@@ -125,9 +124,9 @@ public:
         ASSERT(inherits(&s_info));
     }
 
-    static PassRefPtr<Structure> createStructure(JSValue prototype)
+    static PassRefPtr<Structure> createStructure(JSGlobalData& globalData, JSValue prototype)
     {
-        return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
+        return Structure::create(globalData, prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
     }
 
     static const ClassInfo s_info;
@@ -178,7 +177,7 @@ JSValue JavaInstance::invokeMethod(ExecState* exec, RuntimeMethod* runtimeMethod
 
     for (i = 0; i < count; i++) {
         CString javaClassName = jMethod->parameterAt(i).utf8();
-        jArgs[i] = convertValueToJValue(exec, m_rootObject.get(), exec->argument(i), JNITypeFromClassName(javaClassName.data()), javaClassName.data());
+        jArgs[i] = convertValueToJValue(exec, m_rootObject.get(), exec->argument(i), javaTypeFromClassName(javaClassName.data()), javaClassName.data());
         LOG(LiveConnect, "JavaInstance::invokeMethod arg[%d] = %s", i, exec->argument(i).toString(exec).ascii().data());
     }
 
@@ -196,7 +195,8 @@ JSValue JavaInstance::invokeMethod(ExecState* exec, RuntimeMethod* runtimeMethod
         jobject obj = m_instance->m_instance;
         JSValue exceptionDescription;
         const char *callingURL = 0; // FIXME, need to propagate calling URL to Java
-        handled = dispatchJNICall(exec, rootObject->nativeHandle(), obj, jMethod->isStatic(), jMethod->JNIReturnType(), jMethod->methodID(obj), jArgs.data(), result, callingURL, exceptionDescription);
+        jmethodID methodId = getMethodID(obj, jMethod->name().utf8().data(), jMethod->signature());
+        handled = dispatchJNICall(exec, rootObject->nativeHandle(), obj, jMethod->isStatic(), jMethod->returnType(), methodId, jArgs.data(), result, callingURL, exceptionDescription);
         if (exceptionDescription) {
             throwError(exec, createError(exec, exceptionDescription.toString(exec)));
             return jsUndefined();
@@ -206,58 +206,22 @@ JSValue JavaInstance::invokeMethod(ExecState* exec, RuntimeMethod* runtimeMethod
 // This is a deprecated code path which should not be required on Android.
 // Remove this guard once Bug 39476 is fixed.
 #if PLATFORM(ANDROID) || defined(BUILDING_ON_TIGER)
-    if (!handled) {
-        jobject obj = m_instance->m_instance;
-        switch (jMethod->JNIReturnType()) {
-        case void_type:
-            callJNIMethodIDA<void>(obj, jMethod->methodID(obj), jArgs.data());
-            break;
-        case object_type:
-            result.l = callJNIMethodIDA<jobject>(obj, jMethod->methodID(obj), jArgs.data());
-            break;
-        case boolean_type:
-            result.z = callJNIMethodIDA<jboolean>(obj, jMethod->methodID(obj), jArgs.data());
-            break;
-        case byte_type:
-            result.b = callJNIMethodIDA<jbyte>(obj, jMethod->methodID(obj), jArgs.data());
-            break;
-        case char_type:
-            result.c = callJNIMethodIDA<jchar>(obj, jMethod->methodID(obj), jArgs.data());
-            break;
-        case short_type:
-            result.s = callJNIMethodIDA<jshort>(obj, jMethod->methodID(obj), jArgs.data());
-            break;
-        case int_type:
-            result.i = callJNIMethodIDA<jint>(obj, jMethod->methodID(obj), jArgs.data());
-            break;
-        case long_type:
-            result.j = callJNIMethodIDA<jlong>(obj, jMethod->methodID(obj), jArgs.data());
-            break;
-        case float_type:
-            result.f = callJNIMethodIDA<jfloat>(obj, jMethod->methodID(obj), jArgs.data());
-            break;
-        case double_type:
-            result.d = callJNIMethodIDA<jdouble>(obj, jMethod->methodID(obj), jArgs.data());
-            break;
-        case array_type:
-        case invalid_type:
-            break;
-        }
-    }
+    if (!handled)
+        result = callJNIMethod(m_instance->m_instance, jMethod->returnType(), jMethod->name().utf8().data(), jMethod->signature(), jArgs.data());
 #endif
 
-    switch (jMethod->JNIReturnType()) {
-    case void_type:
+    switch (jMethod->returnType()) {
+    case JavaTypeVoid:
         {
             resultValue = jsUndefined();
         }
         break;
 
-    case object_type:
+    case JavaTypeObject:
         {
             if (result.l) {
-                // FIXME: array_type return type is handled below, can we actually get an array here?
-                const char* arrayType = jMethod->returnType();
+                // FIXME: JavaTypeArray return type is handled below, can we actually get an array here?
+                const char* arrayType = jMethod->returnTypeClassName();
                 if (arrayType[0] == '[')
                     resultValue = JavaArray::convertJObjectToArray(exec, result.l, arrayType, rootObject);
                 else {
@@ -281,63 +245,63 @@ JSValue JavaInstance::invokeMethod(ExecState* exec, RuntimeMethod* runtimeMethod
         }
         break;
 
-    case boolean_type:
+    case JavaTypeBoolean:
         {
             resultValue = jsBoolean(result.z);
         }
         break;
 
-    case byte_type:
+    case JavaTypeByte:
         {
             resultValue = jsNumber(result.b);
         }
         break;
 
-    case char_type:
+    case JavaTypeChar:
         {
             resultValue = jsNumber(result.c);
         }
         break;
 
-    case short_type:
+    case JavaTypeShort:
         {
             resultValue = jsNumber(result.s);
         }
         break;
 
-    case int_type:
+    case JavaTypeInt:
         {
             resultValue = jsNumber(result.i);
         }
         break;
 
-    case long_type:
+    case JavaTypeLong:
         {
             resultValue = jsNumber(result.j);
         }
         break;
 
-    case float_type:
+    case JavaTypeFloat:
         {
             resultValue = jsNumber(result.f);
         }
         break;
 
-    case double_type:
+    case JavaTypeDouble:
         {
             resultValue = jsNumber(result.d);
         }
         break;
 
-    case array_type:
+    case JavaTypeArray:
         {
-            const char* arrayType = jMethod->returnType();
+            const char* arrayType = jMethod->returnTypeClassName();
             ASSERT(arrayType[0] == '[');
             resultValue = JavaArray::convertJObjectToArray(exec, result.l, arrayType, rootObject);
         }
         break;
 
-    case invalid_type:
+    case JavaTypeInvalid:
         {
             resultValue = jsUndefined();
         }
diff --git a/Source/WebCore/bridge/jni/jsc/JavaRuntimeObject.h b/Source/WebCore/bridge/jni/jsc/JavaRuntimeObject.h
index 12a85ae..03f116f 100644
--- a/Source/WebCore/bridge/jni/jsc/JavaRuntimeObject.h
+++ b/Source/WebCore/bridge/jni/jsc/JavaRuntimeObject.h
@@ -42,9 +42,9 @@ public:
 
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValue prototype)
+    static PassRefPtr<Structure> createStructure(JSGlobalData& globalData, JSValue prototype)
     {
-        return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
+        return Structure::create(globalData, prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
     }
 };
 
diff --git a/Source/WebCore/bridge/jni/jsc/JavaStringJSC.h b/Source/WebCore/bridge/jni/jsc/JavaStringJSC.h
index 3ce7a16..7c19d4e 100644
--- a/Source/WebCore/bridge/jni/jsc/JavaStringJSC.h
+++ b/Source/WebCore/bridge/jni/jsc/JavaStringJSC.h
@@ -28,7 +28,9 @@
 
 #include "JNIUtility.h"
 #include "JavaInstanceJSC.h"
+
 #include <runtime/JSLock.h>
+#include <runtime/ScopeChain.h>
 
 
 namespace JSC {
diff --git a/Source/WebCore/bridge/jni/v8/JNIUtilityPrivate.cpp b/Source/WebCore/bridge/jni/v8/JNIUtilityPrivate.cpp
index 30e344d..7ac1a93 100644
--- a/Source/WebCore/bridge/jni/v8/JNIUtilityPrivate.cpp
+++ b/Source/WebCore/bridge/jni/v8/JNIUtilityPrivate.cpp
@@ -30,22 +30,28 @@
 
 #include "JavaInstanceV8.h"
 #include "JavaNPObjectV8.h"
+<<<<<<< HEAD
 #if PLATFORM(ANDROID)
 #include "npruntime_impl.h"
 #endif // PLATFORM(ANDROID)
+=======
+#include "JavaValueV8.h"
+>>>>>>> webkit.org at r82507
 #include <wtf/text/CString.h>
 
 namespace JSC {
 
 namespace Bindings {
 
-jvalue convertNPVariantToJValue(NPVariant value, const WTF::String& javaType)
+JavaValue convertNPVariantToJavaValue(NPVariant value, const String& javaClass)
 {
-    CString javaClassName = javaType.utf8();
-    JNIType jniType = JNITypeFromClassName(javaClassName.data());
-    jvalue result;
+    CString javaClassName = javaClass.utf8();
+    JavaType javaType = javaTypeFromClassName(javaClassName.data());
+    JavaValue result;
+    result.m_type = javaType;
     NPVariantType type = value.type;
 
+<<<<<<< HEAD
     switch (jniType) {
     case array_type:
 #if PLATFORM(ANDROID)
@@ -208,29 +214,31 @@ jvalue convertNPVariantToJValue(NPVariant value, const WTF::String& javaType)
 #endif // PLATFORM(ANDROID)
 
     case object_type:
+=======
+    switch (javaType) {
+    case JavaTypeArray:
+    case JavaTypeObject:
+>>>>>>> webkit.org at r82507
         {
-            result.l = static_cast<jobject>(0);
-
-            // First see if we have a Java instance.
+            // See if we have a Java instance.
             if (type == NPVariantType_Object) {
                 NPObject* objectImp = NPVARIANT_TO_OBJECT(value);
-                if (JavaInstance* instance = ExtractJavaInstance(objectImp))
-                    result.l = instance->javaInstance();
+                result.m_objectValue = ExtractJavaInstance(objectImp);
             }
+        }
+        break;
 
-            // Now convert value to a string if the target type is a java.lang.string, and we're not
-            // converting from a Null.
-            if (!result.l && !strcmp(javaClassName.data(), "java.lang.String")) {
+    case JavaTypeString:
+        {
 #ifdef CONVERT_NULL_TO_EMPTY_STRING
-                if (type == NPVariantType_Null) {
-                    JNIEnv* env = getJNIEnv();
-                    jchar buf[2];
-                    jobject javaString = env->functions->NewString(env, buf, 0);
-                    result.l = javaString;
-                } else
+            if (type == NPVariantType_Null) {
+                result.m_type = JavaTypeString;
+                result.m_stringValue = String::fromUTF8("");
+            } else
 #else
-                if (type == NPVariantType_String)
+            if (type == NPVariantType_String)
 #endif
+<<<<<<< HEAD
                 {
                     NPString src = NPVARIANT_TO_STRING(value);
                     JNIEnv* env = getJNIEnv();
@@ -261,182 +269,167 @@ jvalue convertNPVariantToJValue(NPVariant value, const WTF::String& javaType)
 #endif // PLATFORM(ANDROID)
             } else if (!result.l)
                 memset(&result, 0, sizeof(jvalue)); // Handle it the same as a void case
+=======
+            {
+                NPString src = NPVARIANT_TO_STRING(value);
+                result.m_type = JavaTypeString;
+                result.m_stringValue = String::fromUTF8(src.UTF8Characters);
+            }
+>>>>>>> webkit.org at r82507
         }
         break;
 
-    case boolean_type:
+    case JavaTypeBoolean:
         {
             if (type == NPVariantType_Bool)
-                result.z = NPVARIANT_TO_BOOLEAN(value);
-            else
-                memset(&result, 0, sizeof(jvalue)); // as void case
+                result.m_booleanValue = NPVARIANT_TO_BOOLEAN(value);
         }
         break;
 
-    case byte_type:
+    case JavaTypeByte:
         {
             if (type == NPVariantType_Int32)
-                result.b = static_cast<jbyte>(NPVARIANT_TO_INT32(value));
+                result.m_byteValue = static_cast<signed char>(NPVARIANT_TO_INT32(value));
             else if (type == NPVariantType_Double)
-                result.b = static_cast<jbyte>(NPVARIANT_TO_DOUBLE(value));
-            else
-                memset(&result, 0, sizeof(jvalue));
+                result.m_byteValue = static_cast<signed char>(NPVARIANT_TO_DOUBLE(value));
         }
         break;
 
-    case char_type:
+    case JavaTypeChar:
         {
             if (type == NPVariantType_Int32)
-                result.c = static_cast<char>(NPVARIANT_TO_INT32(value));
-            else
-                memset(&result, 0, sizeof(jvalue));
+                result.m_charValue = static_cast<unsigned short>(NPVARIANT_TO_INT32(value));
         }
         break;
 
-    case short_type:
+    case JavaTypeShort:
         {
             if (type == NPVariantType_Int32)
-                result.s = static_cast<jshort>(NPVARIANT_TO_INT32(value));
+                result.m_shortValue = static_cast<short>(NPVARIANT_TO_INT32(value));
             else if (type == NPVariantType_Double)
-                result.s = static_cast<jshort>(NPVARIANT_TO_DOUBLE(value));
-            else
-                memset(&result, 0, sizeof(jvalue));
+                result.m_shortValue = static_cast<short>(NPVARIANT_TO_DOUBLE(value));
         }
         break;
 
-    case int_type:
+    case JavaTypeInt:
         {
             if (type == NPVariantType_Int32)
-                result.i = static_cast<jint>(NPVARIANT_TO_INT32(value));
+                result.m_intValue = static_cast<int>(NPVARIANT_TO_INT32(value));
             else if (type == NPVariantType_Double)
-                result.i = static_cast<jint>(NPVARIANT_TO_DOUBLE(value));
-            else
-                memset(&result, 0, sizeof(jvalue));
+                result.m_intValue = static_cast<int>(NPVARIANT_TO_DOUBLE(value));
         }
         break;
 
-    case long_type:
+    case JavaTypeLong:
         {
             if (type == NPVariantType_Int32)
-                result.j = static_cast<jlong>(NPVARIANT_TO_INT32(value));
+                result.m_longValue = static_cast<long long>(NPVARIANT_TO_INT32(value));
             else if (type == NPVariantType_Double)
-                result.j = static_cast<jlong>(NPVARIANT_TO_DOUBLE(value));
-            else
-                memset(&result, 0, sizeof(jvalue));
+                result.m_longValue = static_cast<long long>(NPVARIANT_TO_DOUBLE(value));
         }
         break;
 
-    case float_type:
+    case JavaTypeFloat:
         {
             if (type == NPVariantType_Int32)
-                result.f = static_cast<jfloat>(NPVARIANT_TO_INT32(value));
+                result.m_floatValue = static_cast<float>(NPVARIANT_TO_INT32(value));
             else if (type == NPVariantType_Double)
-                result.f = static_cast<jfloat>(NPVARIANT_TO_DOUBLE(value));
-            else
-                memset(&result, 0, sizeof(jvalue));
+                result.m_floatValue = static_cast<float>(NPVARIANT_TO_DOUBLE(value));
         }
         break;
 
-    case double_type:
+    case JavaTypeDouble:
         {
             if (type == NPVariantType_Int32)
-                result.d = static_cast<jdouble>(NPVARIANT_TO_INT32(value));
+                result.m_doubleValue = static_cast<double>(NPVARIANT_TO_INT32(value));
             else if (type == NPVariantType_Double)
-                result.d = static_cast<jdouble>(NPVARIANT_TO_DOUBLE(value));
-            else
-                memset(&result, 0, sizeof(jvalue));
+                result.m_doubleValue = static_cast<double>(NPVARIANT_TO_DOUBLE(value));
         }
         break;
-
-        break;
-
-    case invalid_type:
     default:
-    case void_type:
-        {
-            memset(&result, 0, sizeof(jvalue));
-        }
         break;
     }
     return result;
 }
 
 
-void convertJValueToNPVariant(jvalue value, JNIType jniType, const char* javaTypeName, NPVariant* result)
+void convertJavaValueToNPVariant(JavaValue value, NPVariant* result)
 {
-    switch (jniType) {
-    case void_type:
+    switch (value.m_type) {
+    case JavaTypeVoid:
         {
             VOID_TO_NPVARIANT(*result);
         }
         break;
 
-    case object_type:
+    case JavaTypeObject:
         {
-            if (value.l) {
-                if (!strcmp(javaTypeName, "java.lang.String")) {
-                    const char* v = getCharactersFromJString(static_cast<jstring>(value.l));
-                    // s is freed in NPN_ReleaseVariantValue (see npruntime.cpp)
-                    const char* s = strdup(v);
-                    releaseCharactersForJString(static_cast<jstring>(value.l), v);
-                    STRINGZ_TO_NPVARIANT(s, *result);
-                } else
-                    OBJECT_TO_NPVARIANT(JavaInstanceToNPObject(new JavaInstance(value.l)), *result);
-            } else
+            // If the JavaValue is a String object, it should have type JavaTypeString.
+            if (value.m_objectValue)
+                OBJECT_TO_NPVARIANT(JavaInstanceToNPObject(value.m_objectValue.get()), *result);
+            else
                 VOID_TO_NPVARIANT(*result);
         }
         break;
 
-    case boolean_type:
+    case JavaTypeString:
+        {
+            const char* utf8String = strdup(value.m_stringValue.utf8().data());
+            // The copied string is freed in NPN_ReleaseVariantValue (see npruntime.cpp)
+            STRINGZ_TO_NPVARIANT(utf8String, *result);
+        }
+        break;
+
+    case JavaTypeBoolean:
         {
-            BOOLEAN_TO_NPVARIANT(value.z, *result);
+            BOOLEAN_TO_NPVARIANT(value.m_booleanValue, *result);
         }
         break;
 
-    case byte_type:
+    case JavaTypeByte:
         {
-            INT32_TO_NPVARIANT(value.b, *result);
+            INT32_TO_NPVARIANT(value.m_byteValue, *result);
         }
         break;
 
-    case char_type:
+    case JavaTypeChar:
         {
-            INT32_TO_NPVARIANT(value.c, *result);
+            INT32_TO_NPVARIANT(value.m_charValue, *result);
         }
         break;
 
-    case short_type:
+    case JavaTypeShort:
         {
-            INT32_TO_NPVARIANT(value.s, *result);
+            INT32_TO_NPVARIANT(value.m_shortValue, *result);
         }
         break;
 
-    case int_type:
+    case JavaTypeInt:
         {
-            INT32_TO_NPVARIANT(value.i, *result);
+            INT32_TO_NPVARIANT(value.m_intValue, *result);
         }
         break;
 
         // TODO: Check if cast to double is needed.
-    case long_type:
+    case JavaTypeLong:
         {
-            DOUBLE_TO_NPVARIANT(value.j, *result);
+            DOUBLE_TO_NPVARIANT(value.m_longValue, *result);
         }
         break;
 
-    case float_type:
+    case JavaTypeFloat:
         {
-            DOUBLE_TO_NPVARIANT(value.f, *result);
+            DOUBLE_TO_NPVARIANT(value.m_floatValue, *result);
         }
         break;
 
-    case double_type:
+    case JavaTypeDouble:
         {
-            DOUBLE_TO_NPVARIANT(value.d, *result);
+            DOUBLE_TO_NPVARIANT(value.m_doubleValue, *result);
         }
         break;
 
-    case invalid_type:
+    case JavaTypeInvalid:
     default:
         {
             VOID_TO_NPVARIANT(*result);
@@ -445,6 +438,103 @@ void convertJValueToNPVariant(jvalue value, JNIType jniType, const char* javaTyp
     }
 }
 
+JavaValue jvalueToJavaValue(const jvalue& value, const JavaType& type)
+{
+    JavaValue result;
+    result.m_type = type;
+    switch (result.m_type) {
+    case JavaTypeVoid:
+        break;
+    case JavaTypeObject:
+        result.m_objectValue = new JavaInstance(value.l);
+        break;
+    case JavaTypeString:
+        {
+            jstring javaString = static_cast<jstring>(value.l);
+            const UChar* a = getUCharactersFromJStringInEnv(getJNIEnv(), javaString);
+            // We take a copy to allow the Java String to be released.
+            result.m_stringValue = String(a).threadsafeCopy();
+            releaseUCharactersForJStringInEnv(getJNIEnv(), javaString, a);
+        }
+        break;
+    case JavaTypeBoolean:
+        result.m_booleanValue = value.z == JNI_FALSE ? false : true;
+        break;
+    case JavaTypeByte:
+        result.m_byteValue = value.b;
+        break;
+    case JavaTypeChar:
+        result.m_charValue = value.c;
+        break;
+    case JavaTypeShort:
+        result.m_shortValue = value.s;
+        break;
+    case JavaTypeInt:
+        result.m_intValue = value.i;
+        break;
+    case JavaTypeLong:
+        result.m_longValue = value.j;
+        break;
+    case JavaTypeFloat:
+        result.m_floatValue = value.f;
+        break;
+    case JavaTypeDouble:
+        result.m_doubleValue = value.d;
+        break;
+    default:
+        ASSERT(false);
+    }
+    return result;
+}
+
+jvalue javaValueToJvalue(const JavaValue& value)
+{
+    jvalue result;
+    memset(&result, 0, sizeof(jvalue));
+    switch (value.m_type) {
+    case JavaTypeVoid:
+        break;
+    case JavaTypeObject:
+        if (value.m_objectValue)
+            result.l = value.m_objectValue->javaInstance();
+        break;
+    case JavaTypeString:
+        // This creates a local reference to a new String object, which will
+        // be released when the call stack returns to Java. Note that this
+        // may cause leaks if invoked from a native message loop, as is the
+        // case in workers.
+        result.l = getJNIEnv()->NewString(value.m_stringValue.characters(), value.m_stringValue.length());
+        break;
+    case JavaTypeBoolean:
+        result.z = value.m_booleanValue ? JNI_TRUE : JNI_FALSE;
+        break;
+    case JavaTypeByte:
+        result.b = value.m_byteValue;
+        break;
+    case JavaTypeChar:
+        result.c = value.m_charValue;
+        break;
+    case JavaTypeShort:
+        result.s = value.m_shortValue;
+        break;
+    case JavaTypeInt:
+        result.i = value.m_intValue;
+        break;
+    case JavaTypeLong:
+        result.j = value.m_longValue;
+        break;
+    case JavaTypeFloat:
+        result.f = value.m_floatValue;
+        break;
+    case JavaTypeDouble:
+        result.d = value.m_doubleValue;
+        break;
+    default:
+        ASSERT(false);
+    }
+    return result;
+}
+
 } // namespace Bindings
 
 } // namespace JSC
diff --git a/Source/WebCore/bridge/jni/v8/JNIUtilityPrivate.h b/Source/WebCore/bridge/jni/v8/JNIUtilityPrivate.h
index df73a9e..0282904 100644
--- a/Source/WebCore/bridge/jni/v8/JNIUtilityPrivate.h
+++ b/Source/WebCore/bridge/jni/v8/JNIUtilityPrivate.h
@@ -36,8 +36,13 @@ namespace JSC {
 
 namespace Bindings {
 
-jvalue convertNPVariantToJValue(NPVariant, const WTF::String& javaType);
-void convertJValueToNPVariant(jvalue, JNIType, const char* javaClassName, NPVariant*);
+class JavaValue;
+
+JavaValue convertNPVariantToJavaValue(NPVariant, const String& javaClass);
+void convertJavaValueToNPVariant(JavaValue, NPVariant*);
+
+JavaValue jvalueToJavaValue(const jvalue&, const JavaType&);
+jvalue javaValueToJvalue(const JavaValue&);
 
 } // namespace Bindings
 
diff --git a/Source/WebCore/bridge/jni/v8/JavaClassV8.cpp b/Source/WebCore/bridge/jni/v8/JavaClassV8.cpp
index 18377bd..24d05f3 100644
--- a/Source/WebCore/bridge/jni/v8/JavaClassV8.cpp
+++ b/Source/WebCore/bridge/jni/v8/JavaClassV8.cpp
@@ -29,7 +29,7 @@
 #if ENABLE(JAVA_BRIDGE)
 
 #include "JavaFieldV8.h"
-#include "JavaMethod.h"
+#include "JavaMethodJobject.h"
 
 using namespace JSC::Bindings;
 
@@ -38,7 +38,7 @@ JavaClass::JavaClass(jobject anInstance)
     jobject aClass = callJNIMethod<jobject>(anInstance, "getClass", "()Ljava/lang/Class;");
 
     if (!aClass) {
-        fprintf(stderr, "%s:  unable to call getClass on instance %p\n", __PRETTY_FUNCTION__, anInstance);
+        LOG_ERROR("unable to call getClass on instance %p", anInstance);
         return;
     }
 
@@ -62,13 +62,13 @@ JavaClass::JavaClass(jobject anInstance)
     int numMethods = env->GetArrayLength(methods);
     for (i = 0; i < numMethods; i++) {
         jobject aJMethod = env->GetObjectArrayElement(static_cast<jobjectArray>(methods), i);
-        JavaMethod* aMethod = new JavaMethod(env, aJMethod); // deleted in the JavaClass destructor
+        JavaMethod* aMethod = new JavaMethodJobject(env, aJMethod); // deleted in the JavaClass destructor
         MethodList* methodList;
         {
-            methodList = m_methods.get(aMethod->name().utf8());
+            methodList = m_methods.get(aMethod->name());
             if (!methodList) {
                 methodList = new MethodList();
-                m_methods.set(aMethod->name().utf8(), methodList);
+                m_methods.set(aMethod->name(), methodList);
             }
         }
         methodList->append(aMethod);
diff --git a/Source/WebCore/bridge/jni/v8/JavaFieldV8.cpp b/Source/WebCore/bridge/jni/v8/JavaFieldV8.cpp
index 62081eb..2a6dd0b 100644
--- a/Source/WebCore/bridge/jni/v8/JavaFieldV8.cpp
+++ b/Source/WebCore/bridge/jni/v8/JavaFieldV8.cpp
@@ -35,8 +35,8 @@ JavaField::JavaField(JNIEnv* env, jobject aField)
     // Get field type
     jobject fieldType = callJNIMethod<jobject>(aField, "getType", "()Ljava/lang/Class;");
     jstring fieldTypeName = static_cast<jstring>(callJNIMethod<jobject>(fieldType, "getName", "()Ljava/lang/String;"));
-    m_type = JavaString(env, fieldTypeName);
-    m_JNIType = JNITypeFromClassName(m_type.utf8());
+    m_typeClassName = JavaString(env, fieldTypeName);
+    m_type = javaTypeFromClassName(m_typeClassName.utf8());
 
     // Get field name
     jstring fieldName = static_cast<jstring>(callJNIMethod<jobject>(aField, "getName", "()Ljava/lang/String;"));
diff --git a/Source/WebCore/bridge/jni/v8/JavaFieldV8.h b/Source/WebCore/bridge/jni/v8/JavaFieldV8.h
index caf28bf..defed60 100644
--- a/Source/WebCore/bridge/jni/v8/JavaFieldV8.h
+++ b/Source/WebCore/bridge/jni/v8/JavaFieldV8.h
@@ -40,14 +40,13 @@ public:
     JavaField(JNIEnv*, jobject aField);
 
     const JavaString& name() const { return m_name; }
-    const char* type() const { return m_type.utf8(); }
-
-    JNIType getJNIType() const { return m_JNIType; }
+    const char* typeClassName() const { return m_typeClassName.utf8(); }
+    JavaType type() const { return m_type; }
 
 private:
     JavaString m_name;
-    JavaString m_type;
-    JNIType m_JNIType;
+    JavaString m_typeClassName;
+    JavaType m_type;
     RefPtr<JobjectWrapper> m_field;
 };
 
diff --git a/Source/WebCore/bridge/jni/v8/JavaInstanceV8.cpp b/Source/WebCore/bridge/jni/v8/JavaInstanceV8.cpp
index dbf53f0..d1075ae 100644
--- a/Source/WebCore/bridge/jni/v8/JavaInstanceV8.cpp
+++ b/Source/WebCore/bridge/jni/v8/JavaInstanceV8.cpp
@@ -29,10 +29,12 @@
 
 #if ENABLE(JAVA_BRIDGE)
 
-#include "JavaMethod.h"
 #include "JNIUtilityPrivate.h"
 #include "JavaClassV8.h"
+#include "JavaFieldV8.h"
+#include "JavaMethod.h"
 
+#include <wtf/OwnArrayPtr.h>
 #include <wtf/text/CString.h>
 
 using namespace JSC::Bindings;
@@ -68,88 +70,21 @@ JavaClass* JavaInstance::getClass() const
     return m_class;
 }
 
-bool JavaInstance::invokeMethod(const char* methodName, const NPVariant* args, int count, NPVariant* resultValue)
+JavaValue JavaInstance::invokeMethod(const JavaMethod* method, JavaValue* args)
 {
-    VOID_TO_NPVARIANT(*resultValue);
-
-    MethodList methodList = getClass()->methodsNamed(methodName);
-
-    size_t numMethods = methodList.size();
-
-    // Try to find a good match for the overloaded method.  The
-    // fundamental problem is that JavaScript doesn't have the
-    // notion of method overloading and Java does.  We could
-    // get a bit more sophisticated and attempt to does some
-    // type checking as we as checking the number of parameters.
-    JavaMethod* aMethod;
-    JavaMethod* method = 0;
-    for (size_t methodIndex = 0; methodIndex < numMethods; methodIndex++) {
-        aMethod = methodList[methodIndex];
-        if (aMethod->numParameters() == count) {
-            method = aMethod;
-            break;
-        }
-    }
-    if (!method)
-        return false;
-
-    const JavaMethod* jMethod = static_cast<const JavaMethod*>(method);
-
-    jvalue* jArgs = 0;
-    if (count > 0)
-        jArgs = static_cast<jvalue*>(malloc(count * sizeof(jvalue)));
-
-    for (int i = 0; i < count; i++)
-        jArgs[i] = convertNPVariantToJValue(args[i], jMethod->parameterAt(i));
-
-    jvalue result;
-
-    // The following code can be conditionally removed once we have a Tiger update that
-    // contains the new Java plugin.  It is needed for builds prior to Tiger.
-    {
-        jobject obj = javaInstance();
-        switch (jMethod->JNIReturnType()) {
-        case void_type:
-            callJNIMethodIDA<void>(obj, jMethod->methodID(obj), jArgs);
-            break;
-        case object_type:
-            result.l = callJNIMethodIDA<jobject>(obj, jMethod->methodID(obj), jArgs);
-            break;
-        case boolean_type:
-            result.z = callJNIMethodIDA<jboolean>(obj, jMethod->methodID(obj), jArgs);
-            break;
-        case byte_type:
-            result.b = callJNIMethodIDA<jbyte>(obj, jMethod->methodID(obj), jArgs);
-            break;
-        case char_type:
-            result.c = callJNIMethodIDA<jchar>(obj, jMethod->methodID(obj), jArgs);
-            break;
-        case short_type:
-            result.s = callJNIMethodIDA<jshort>(obj, jMethod->methodID(obj), jArgs);
-            break;
-        case int_type:
-            result.i = callJNIMethodIDA<jint>(obj, jMethod->methodID(obj), jArgs);
-            break;
-
-        case long_type:
-            result.j = callJNIMethodIDA<jlong>(obj, jMethod->methodID(obj), jArgs);
-            break;
-        case float_type:
-            result.f = callJNIMethodIDA<jfloat>(obj, jMethod->methodID(obj), jArgs);
-            break;
-        case double_type:
-            result.d = callJNIMethodIDA<jdouble>(obj, jMethod->methodID(obj), jArgs);
-            break;
-        case invalid_type:
-        default:
-            break;
-        }
-    }
-
-    convertJValueToNPVariant(result, jMethod->JNIReturnType(), jMethod->returnType(), resultValue);
-    free(jArgs);
+    ASSERT(getClass()->methodsNamed(method->name().utf8().data()).find(method) != notFound);
+    unsigned int numParams = method->numParameters();
+    OwnArrayPtr<jvalue> jvalueArgs = adoptArrayPtr(new jvalue[numParams]);
+    for (unsigned int i = 0; i < numParams; ++i)
+        jvalueArgs[i] = javaValueToJvalue(args[i]);
+    jvalue result = callJNIMethod(javaInstance(), method->returnType(), method->name().utf8().data(), method->signature(), jvalueArgs.get());
+    return jvalueToJavaValue(result, method->returnType());
+}
 
-    return true;
+JavaValue JavaInstance::getField(const JavaField* field)
+{
+    ASSERT(getClass()->fieldNamed(field->name().utf8()) == field);
+    return jvalueToJavaValue(getJNIField(javaInstance(), field->type(), field->name().utf8(), field->typeClassName()), field->type());
 }
 
 #endif // ENABLE(JAVA_BRIDGE)
diff --git a/Source/WebCore/bridge/jni/v8/JavaInstanceV8.h b/Source/WebCore/bridge/jni/v8/JavaInstanceV8.h
index 8ee3195..b1150f8 100644
--- a/Source/WebCore/bridge/jni/v8/JavaInstanceV8.h
+++ b/Source/WebCore/bridge/jni/v8/JavaInstanceV8.h
@@ -30,6 +30,7 @@
 #if ENABLE(JAVA_BRIDGE)
 
 #include "JNIUtility.h"
+#include "JavaValueV8.h"
 #include "JobjectWrapper.h"
 #include "npruntime.h"
 
@@ -43,6 +44,8 @@ namespace JSC {
 namespace Bindings {
 
 class JavaClass;
+class JavaField;
+class JavaMethod;
 
 class JavaInstance : public RefCounted<JavaInstance> {
 public:
@@ -50,9 +53,10 @@ public:
     virtual ~JavaInstance();
 
     JavaClass* getClass() const;
-
-    bool invokeMethod(const char* name, const NPVariant* args, int argsCount, NPVariant* result);
-
+    // args must be an array of length greater than or equal to the number of
+    // arguments expected by the method.
+    JavaValue invokeMethod(const JavaMethod*, JavaValue* args);
+    JavaValue getField(const JavaField*);
     jobject javaInstance() const { return m_instance->m_instance; }
 
     // These functions are called before and after the main entry points into
diff --git a/Source/WebCore/bridge/jni/v8/JavaNPObjectV8.cpp b/Source/WebCore/bridge/jni/v8/JavaNPObjectV8.cpp
index 7a7adc5..b02d059 100644
--- a/Source/WebCore/bridge/jni/v8/JavaNPObjectV8.cpp
+++ b/Source/WebCore/bridge/jni/v8/JavaNPObjectV8.cpp
@@ -33,6 +33,8 @@
 #include "JavaClassV8.h"
 #include "JavaFieldV8.h"
 #include "JavaInstanceV8.h"
+#include "JavaMethod.h"
+#include "JavaValueV8.h"
 #include "npruntime_impl.h"
 
 namespace JSC {
@@ -115,12 +117,40 @@ bool JavaNPObjectInvoke(NPObject* obj, NPIdentifier identifier, const NPVariant*
         return false;
 
     instance->begin();
-    bool r = instance->invokeMethod(name, args, argCount, result);
-    instance->end();
 
+    MethodList methodList = instance->getClass()->methodsNamed(name);
     // TODO: use NPN_MemFree
     free(name);
-    return r;
+
+    // Try to find a good match for the overloaded method. The
+    // fundamental problem is that JavaScript doesn't have the
+    // notion of method overloading and Java does. We could
+    // get a bit more sophisticated and attempt to do some
+    // type checking as well as checking the number of parameters.
+    size_t numMethods = methodList.size();
+    JavaMethod* aMethod;
+    JavaMethod* jMethod = 0;
+    for (size_t methodIndex = 0; methodIndex < numMethods; methodIndex++) {
+        aMethod = methodList[methodIndex];
+        if (aMethod->numParameters() == static_cast<int>(argCount)) {
+            jMethod = aMethod;
+            break;
+        }
+    }
+    if (!jMethod)
+        return false;
+
+    JavaValue* jArgs = new JavaValue[argCount];
+    for (unsigned int i = 0; i < argCount; i++)
+        jArgs[i] = convertNPVariantToJavaValue(args[i], jMethod->parameterAt(i));
+
+    JavaValue jResult = instance->invokeMethod(jMethod, jArgs);
+    instance->end();
+    delete[] jArgs;
+
+    VOID_TO_NPVARIANT(*result);
+    convertJavaValueToNPVariant(jResult, result);
+    return true;
 }
 
 bool JavaNPObjectHasProperty(NPObject* obj, NPIdentifier identifier)
@@ -150,12 +180,11 @@ bool JavaNPObjectGetProperty(NPObject* obj, NPIdentifier identifier, NPVariant*
 
     instance->begin();
     JavaField* field = instance->getClass()->fieldNamed(name);
-    instance->end();
     free(name); // TODO: use NPN_MemFree
-
     if (!field)
         return false;
 
+<<<<<<< HEAD
 #if PLATFORM(ANDROID)
     // JSC does not seem to support returning object properties so we emulate that
     // behaviour here.
@@ -167,6 +196,12 @@ bool JavaNPObjectGetProperty(NPObject* obj, NPIdentifier identifier, NPVariant*
                                field->type());
 #endif // PLATFORM(ANDROID)
     convertJValueToNPVariant(value, field->getJNIType(), field->type(), result);
+=======
+    JavaValue value = instance->getField(field);
+    instance->end();
+
+    convertJavaValueToNPVariant(value, result);
+>>>>>>> webkit.org at r82507
 
     return true;
 }
diff --git a/Source/WebCore/bridge/jni/v8/JavaValueV8.h b/Source/WebCore/bridge/jni/v8/JavaValueV8.h
new file mode 100644
index 0000000..3e1c623
--- /dev/null
+++ b/Source/WebCore/bridge/jni/v8/JavaValueV8.h
@@ -0,0 +1,75 @@
+/*
+ * Copyright 2011, The Android Open Source Project
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT OWNER OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef JavaValueV8_h
+#define JavaValueV8_h
+
+#if ENABLE(JAVA_BRIDGE)
+
+#include "JavaType.h"
+
+#include <wtf/text/WTFString.h>
+
+namespace JSC {
+
+namespace Bindings {
+
+class JavaInstance;
+
+// A variant used to represent a Java value, almost identical to the JNI
+// jvalue type. It exists because the logic to convert between JavaScript
+// objects (as JavaNPObject or JSValue) and Java objects should not depend upon
+// JNI, to allow ports to provide a JavaInstance object etc which does not use
+// JNI. This means that the 'object' field of this variant uses JavaInstance,
+// not jobject.
+//
+// Note that this class is independent of the JavaScript engine, but is
+// currently used only with V8.
+// See https://bugs.webkit.org/show_bug.cgi?id=57023.
+struct JavaValue {
+    JavaValue() : m_type(JavaTypeInvalid) {}
+
+    JavaType m_type;
+    // We don't use a union because we want to be able to ref-count some of the
+    // values. This requires types with non-trivial constructors.
+    RefPtr<JavaInstance> m_objectValue;
+    bool m_booleanValue;
+    signed char m_byteValue;
+    unsigned short m_charValue;
+    short m_shortValue;
+    int m_intValue;
+    long long m_longValue;
+    float m_floatValue;
+    double m_doubleValue;
+    String m_stringValue;
+};
+
+} // namespace Bindings
+
+} // namespace JSC
+
+#endif // ENABLE(JAVA_BRIDGE)
+
+#endif // JavaValueV8_h
diff --git a/Source/WebCore/bridge/objc/ObjCRuntimeObject.h b/Source/WebCore/bridge/objc/ObjCRuntimeObject.h
index e9fa10d..b29a333 100644
--- a/Source/WebCore/bridge/objc/ObjCRuntimeObject.h
+++ b/Source/WebCore/bridge/objc/ObjCRuntimeObject.h
@@ -42,9 +42,9 @@ public:
 
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValue prototype)
+    static PassRefPtr<Structure> createStructure(JSGlobalData& globalData, JSValue prototype)
     {
-        return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
+        return Structure::create(globalData, prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
     }
 };
 
diff --git a/Source/WebCore/bridge/objc/objc_instance.mm b/Source/WebCore/bridge/objc/objc_instance.mm
index e0b18f1..4f93cfa 100644
--- a/Source/WebCore/bridge/objc/objc_instance.mm
+++ b/Source/WebCore/bridge/objc/objc_instance.mm
@@ -184,9 +184,9 @@ public:
         ASSERT(inherits(&s_info));
     }
 
-    static PassRefPtr<Structure> createStructure(JSValue prototype)
+    static PassRefPtr<Structure> createStructure(JSGlobalData& globalData, JSValue prototype)
     {
-        return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
+        return Structure::create(globalData, prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
     }
 
     static const ClassInfo s_info;
diff --git a/Source/WebCore/bridge/objc/objc_runtime.h b/Source/WebCore/bridge/objc/objc_runtime.h
index 1cee85b..4ef0afd 100644
--- a/Source/WebCore/bridge/objc/objc_runtime.h
+++ b/Source/WebCore/bridge/objc/objc_runtime.h
@@ -103,9 +103,9 @@ public:
         return globalObject->objectPrototype();
     }
 
-    static PassRefPtr<Structure> createStructure(JSValue prototype)
+    static PassRefPtr<Structure> createStructure(JSGlobalData& globalData, JSValue prototype)
     {
-        return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
+        return Structure::create(globalData, prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
     }
 
 private:
diff --git a/Source/WebCore/bridge/qt/qt_instance.cpp b/Source/WebCore/bridge/qt/qt_instance.cpp
index 7af752d..91ae40f 100644
--- a/Source/WebCore/bridge/qt/qt_instance.cpp
+++ b/Source/WebCore/bridge/qt/qt_instance.cpp
@@ -59,9 +59,9 @@ public:
             instance->markAggregate(markStack);
     }
 
-    static PassRefPtr<Structure> createStructure(JSValue prototype)
+    static PassRefPtr<Structure> createStructure(JSGlobalData& globalData, JSValue prototype)
     {
-        return Structure::create(prototype, TypeInfo(ObjectType,  StructureFlags), AnonymousSlotCount, &s_info);
+        return Structure::create(globalData, prototype, TypeInfo(ObjectType,  StructureFlags), AnonymousSlotCount, &s_info);
     }
 
 protected:
diff --git a/Source/WebCore/bridge/qt/qt_pixmapruntime.cpp b/Source/WebCore/bridge/qt/qt_pixmapruntime.cpp
index 534e28e..da3e383 100644
--- a/Source/WebCore/bridge/qt/qt_pixmapruntime.cpp
+++ b/Source/WebCore/bridge/qt/qt_pixmapruntime.cpp
@@ -119,7 +119,7 @@ public:
         QByteArray byteArray;
         QBuffer buffer(&byteArray);
         instance->toImage().save(&buffer, "PNG");
-        const QString encodedString = QString("data:image/png;base64,") + byteArray.toBase64();
+        const QString encodedString = QLatin1String("data:image/png;base64,") + QLatin1String(byteArray.toBase64());
         const UString ustring((UChar*)encodedString.utf16(), encodedString.length());
         return jsString(exec, ustring);
     }
@@ -150,9 +150,9 @@ public:
 
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValue prototype)
+    static PassRefPtr<Structure> createStructure(JSGlobalData& globalData, JSValue prototype)
     {
-        return Structure::create(prototype, TypeInfo(ObjectType,  StructureFlags), AnonymousSlotCount, &s_info);
+        return Structure::create(globalData, prototype, TypeInfo(ObjectType,  StructureFlags), AnonymousSlotCount, &s_info);
     }
 
 protected:
@@ -239,7 +239,7 @@ JSValue QtPixmapInstance::defaultValue(ExecState* exec, PreferredPrimitiveType p
 
 JSValue QtPixmapInstance::valueOf(ExecState* exec) const
 {
-    const QString stringValue = QString("[Qt Native Pixmap %1,%2]").arg(width()).arg(height());
+    const QString stringValue = QString::fromLatin1("[Qt Native Pixmap %1,%2]").arg(width()).arg(height());
     UString ustring((UChar*)stringValue.utf16(), stringValue.length());
     return jsString(exec, ustring);
 }
diff --git a/Source/WebCore/bridge/qt/qt_runtime.cpp b/Source/WebCore/bridge/qt/qt_runtime.cpp
index 78821b9..87ee522 100644
--- a/Source/WebCore/bridge/qt/qt_runtime.cpp
+++ b/Source/WebCore/bridge/qt/qt_runtime.cpp
@@ -845,17 +845,13 @@ JSValue convertQVariantToValue(ExecState* exec, PassRefPtr<RootObject> root, con
         QRegExp re = variant.value<QRegExp>();
 
         if (re.isValid()) {
-            UString uflags;
-            if (re.caseSensitivity() == Qt::CaseInsensitive)
-                uflags = "i"; // ### Can't do g or m
-
             UString pattern((UChar*)re.pattern().utf16(), re.pattern().length());
+            RegExpFlags flags = (re.caseSensitivity() == Qt::CaseInsensitive) ? FlagIgnoreCase : NoFlags;
 
-            RefPtr<JSC::RegExp> regExp = JSC::RegExp::create(&exec->globalData(), pattern, uflags);
+            RefPtr<JSC::RegExp> regExp = JSC::RegExp::create(&exec->globalData(), pattern, flags);
             if (regExp->isValid())
                 return new (exec) RegExpObject(exec->lexicalGlobalObject(), exec->lexicalGlobalObject()->regExpStructure(), regExp.release());
-            else
-                return jsNull();
+            return jsNull();
         }
     }
 
@@ -887,14 +883,14 @@ JSValue convertQVariantToValue(ExecState* exec, PassRefPtr<RootObject> root, con
         dt.isDST = -1;
         double ms = gregorianDateTimeToMS(exec, dt, time.msec(), /*inputIsUTC*/ false);
 
-        return new (exec) DateInstance(exec, trunc(ms));
+        return new (exec) DateInstance(exec, exec->lexicalGlobalObject()->dateStructure(), trunc(ms));
     }
 
     if (type == QMetaType::QByteArray) {
         QByteArray qtByteArray = variant.value<QByteArray>();
         WTF::RefPtr<WTF::ByteArray> wtfByteArray = WTF::ByteArray::create(qtByteArray.length());
         memcpy(wtfByteArray->data(), qtByteArray.constData(), qtByteArray.length());
-        return new (exec) JSC::JSByteArray(exec, JSC::JSByteArray::createStructure(jsNull()), wtfByteArray.get());
+        return new (exec) JSC::JSByteArray(exec, JSC::JSByteArray::createStructure(exec->globalData(), jsNull()), wtfByteArray.get());
     }
 
     if (type == QMetaType::QObjectStar || type == QMetaType::QWidgetStar) {
@@ -1832,7 +1828,7 @@ void QtConnectionObject::execute(void **argv)
                         fimp = static_cast<JSFunction*>(m_funcObject.get());
 
                         JSObject* qt_sender = QtInstance::getQtInstance(sender(), ro, QScriptEngine::QtOwnership)->createRuntimeObject(exec);
-                        JSObject* wrapper = constructEmptyObject(exec, createEmptyObjectStructure(jsNull()));
+                        JSObject* wrapper = constructEmptyObject(exec, createEmptyObjectStructure(exec->globalData(), jsNull()));
                         PutPropertySlot slot;
                         wrapper->put(exec, Identifier(exec, "__qt_sender__"), qt_sender, slot);
                         oldsc = fimp->scope();
diff --git a/Source/WebCore/bridge/qt/qt_runtime.h b/Source/WebCore/bridge/qt/qt_runtime.h
index b86ccbe..85b34b8 100644
--- a/Source/WebCore/bridge/qt/qt_runtime.h
+++ b/Source/WebCore/bridge/qt/qt_runtime.h
@@ -153,9 +153,9 @@ public:
         return globalObject->functionPrototype();
     }
 
-    static PassRefPtr<Structure> createStructure(JSValue prototype)
+    static PassRefPtr<Structure> createStructure(JSGlobalData& globalData, JSValue prototype)
     {
-        return Structure::create(prototype, TypeInfo(ObjectType,  StructureFlags), AnonymousSlotCount, &s_info);
+        return Structure::create(globalData, prototype, TypeInfo(ObjectType,  StructureFlags), AnonymousSlotCount, &s_info);
     }
 
 protected:
diff --git a/Source/WebCore/bridge/runtime_array.h b/Source/WebCore/bridge/runtime_array.h
index f4c74e2..9555545 100644
--- a/Source/WebCore/bridge/runtime_array.h
+++ b/Source/WebCore/bridge/runtime_array.h
@@ -33,6 +33,7 @@ namespace JSC {
     
 class RuntimeArray : public JSArray {
 public:
+    typedef Bindings::Array BindingsArray;
     RuntimeArray(ExecState*, Bindings::Array*);
     virtual ~RuntimeArray();
 
@@ -48,7 +49,7 @@ public:
     
     unsigned getLength() const { return getConcreteArray()->getLength(); }
     
-    Bindings::Array* getConcreteArray() const { return static_cast<Bindings::Array*>(subclassData()); }
+    Bindings::Array* getConcreteArray() const { return static_cast<BindingsArray*>(subclassData()); }
 
     static const ClassInfo s_info;
 
@@ -57,9 +58,9 @@ public:
         return globalObject->arrayPrototype();
     }
 
-    static PassRefPtr<Structure> createStructure(JSValue prototype)
+    static PassRefPtr<Structure> createStructure(JSGlobalData& globalData, JSValue prototype)
     {
-        return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
+        return Structure::create(globalData, prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
     }
 
 protected:
diff --git a/Source/WebCore/bridge/runtime_method.h b/Source/WebCore/bridge/runtime_method.h
index c0c9f16..9df796e 100644
--- a/Source/WebCore/bridge/runtime_method.h
+++ b/Source/WebCore/bridge/runtime_method.h
@@ -45,9 +45,9 @@ public:
         return globalObject->functionPrototype();
     }
 
-    static PassRefPtr<Structure> createStructure(JSValue prototype)
+    static PassRefPtr<Structure> createStructure(JSGlobalData& globalData, JSValue prototype)
     {
-        return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
+        return Structure::create(globalData, prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
     }
 
 protected:
diff --git a/Source/WebCore/bridge/runtime_object.h b/Source/WebCore/bridge/runtime_object.h
index 0decd17..bb6d051 100644
--- a/Source/WebCore/bridge/runtime_object.h
+++ b/Source/WebCore/bridge/runtime_object.h
@@ -61,9 +61,9 @@ public:
         return globalObject->objectPrototype();
     }
 
-    static PassRefPtr<Structure> createStructure(JSValue prototype)
+    static PassRefPtr<Structure> createStructure(JSGlobalData& globalData, JSValue prototype)
     {
-        return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
+        return Structure::create(globalData, prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
     }
 
 protected:
diff --git a/Source/WebCore/config.h b/Source/WebCore/config.h
index 176cd5b..13cf56d 100644
--- a/Source/WebCore/config.h
+++ b/Source/WebCore/config.h
@@ -29,6 +29,30 @@
 
 #include <wtf/Platform.h>
 
+/* See note in wtf/Platform.h for more info on EXPORT_MACROS. */
+#if USE(EXPORT_MACROS)
+
+#include <wtf/ExportMacros.h>
+
+#if defined(BUILDING_JavaScriptCore) || defined(BUILDING_WTF)
+#define WTF_EXPORT_PRIVATE WTF_EXPORT
+#define JS_EXPORT_PRIVATE WTF_EXPORT
+#else
+#define WTF_EXPORT_PRIVATE WTF_IMPORT
+#define JS_EXPORT_PRIVATE WTF_IMPORT
+#endif
+
+#define JS_EXPORTDATA JS_EXPORT_PRIVATE
+#define JS_EXPORTCLASS JS_EXPORT_PRIVATE
+
+#if defined(BUILDING_WebCore) || defined(BUILDING_WebKit)
+#define WEBKIT_EXPORTDATA WTF_EXPORT
+#else
+#define WEBKIT_EXPORTDATA WTF_IMPORT
+#endif
+
+#else /* !USE(EXPORT_MACROS) */
+
 #if !PLATFORM(CHROMIUM) && OS(WINDOWS) && !defined(BUILDING_WX__) && !COMPILER(GCC)
 #if defined(BUILDING_JavaScriptCore) || defined(BUILDING_WTF)
 #define JS_EXPORTDATA __declspec(dllexport)
@@ -40,13 +64,19 @@
 #else
 #define WEBKIT_EXPORTDATA __declspec(dllimport)
 #endif
+#define WTF_EXPORT_PRIVATE JS_EXPORTDATA
+#define JS_EXPORT_PRIVATE JS_EXPORTDATA
 #define JS_EXPORTCLASS JS_EXPORTDATA
 #else
 #define JS_EXPORTDATA
 #define JS_EXPORTCLASS
 #define WEBKIT_EXPORTDATA
+#define WTF_EXPORT_PRIVATE
+#define JS_EXPORT_PRIVATE
 #endif
 
+#endif /* USE(EXPORT_MACROS) */
+
 #ifdef __APPLE__
 #define HAVE_FUNC_USLEEP 1
 #endif /* __APPLE__ */
diff --git a/Source/WebCore/css/CSSComputedStyleDeclaration.cpp b/Source/WebCore/css/CSSComputedStyleDeclaration.cpp
index a023fbd..4c0571d 100644
--- a/Source/WebCore/css/CSSComputedStyleDeclaration.cpp
+++ b/Source/WebCore/css/CSSComputedStyleDeclaration.cpp
@@ -29,6 +29,7 @@
 #include "CounterContent.h"
 #include "CursorList.h"
 #include "CSSBorderImageValue.h"
+#include "CSSLineBoxContainValue.h"
 #include "CSSMutableStyleDeclaration.h"
 #include "CSSPrimitiveValue.h"
 #include "CSSPrimitiveValueCache.h"
@@ -204,6 +205,7 @@ static const int computedProperties[] = {
     CSSPropertyWebkitHyphenateLimitAfter,
     CSSPropertyWebkitHyphenateLimitBefore,
     CSSPropertyWebkitHyphens,
+    CSSPropertyWebkitLineBoxContain,
     CSSPropertyWebkitLineBreak,
     CSSPropertyWebkitLineClamp,
     CSSPropertyWebkitLocale,
@@ -232,6 +234,7 @@ static const int computedProperties[] = {
     CSSPropertyWebkitTextEmphasisPosition,
     CSSPropertyWebkitTextEmphasisStyle,
     CSSPropertyWebkitTextFillColor,
+    CSSPropertyWebkitTextOrientation,
     CSSPropertyWebkitTextSecurity,
     CSSPropertyWebkitTextStrokeColor,
     CSSPropertyWebkitTextStrokeWidth,
@@ -586,6 +589,13 @@ static PassRefPtr<CSSValue> getTimingFunctionValue(const AnimationList* animList
     return list.release();
 }
 
+static PassRefPtr<CSSValue> createLineBoxContainValue(CSSPrimitiveValueCache* primitiveValueCache, unsigned lineBoxContain)
+{
+    if (!lineBoxContain)
+        return primitiveValueCache->createIdentifierValue(CSSValueNone);
+    return CSSLineBoxContainValue::create(lineBoxContain);
+}
+
 CSSComputedStyleDeclaration::CSSComputedStyleDeclaration(PassRefPtr<Node> n, bool allowVisitedStyle, const String& pseudoElementName)
     : m_node(n)
     , m_allowVisitedStyle(allowVisitedStyle)
@@ -672,8 +682,8 @@ PassRefPtr<CSSValue> CSSComputedStyleDeclaration::valueForShadow(const ShadowDat
         RefPtr<CSSPrimitiveValue> x = zoomAdjustedPixelValue(s->x(), style, primitiveValueCache);
         RefPtr<CSSPrimitiveValue> y = zoomAdjustedPixelValue(s->y(), style, primitiveValueCache);
         RefPtr<CSSPrimitiveValue> blur = zoomAdjustedPixelValue(s->blur(), style, primitiveValueCache);
-        RefPtr<CSSPrimitiveValue> spread = propertyID == CSSPropertyTextShadow ? 0 : zoomAdjustedPixelValue(s->spread(), style, primitiveValueCache);
-        RefPtr<CSSPrimitiveValue> style = propertyID == CSSPropertyTextShadow || s->style() == Normal ? 0 : primitiveValueCache->createIdentifierValue(CSSValueInset);
+        RefPtr<CSSPrimitiveValue> spread = propertyID == CSSPropertyTextShadow ? PassRefPtr<CSSPrimitiveValue>() : zoomAdjustedPixelValue(s->spread(), style, primitiveValueCache);
+        RefPtr<CSSPrimitiveValue> style = propertyID == CSSPropertyTextShadow || s->style() == Normal ? PassRefPtr<CSSPrimitiveValue>() : primitiveValueCache->createIdentifierValue(CSSValueInset);
         RefPtr<CSSPrimitiveValue> color = primitiveValueCache->createColorValue(s->color().rgb());
         list->prepend(ShadowValue::create(x.release(), y.release(), blur.release(), spread.release(), style.release(), color.release()));
     }
@@ -780,8 +790,11 @@ static PassRefPtr<CSSValue> contentToCSSValue(const RenderStyle* style, CSSPrimi
 
 static PassRefPtr<CSSValue> counterToCSSValue(const RenderStyle* style, int propertyID, CSSPrimitiveValueCache* primitiveValueCache)
 {
-    RefPtr<CSSValueList> list = CSSValueList::createSpaceSeparated();
     const CounterDirectiveMap* map = style->counterDirectives();
+    if (!map)
+        return 0;
+
+    RefPtr<CSSValueList> list = CSSValueList::createSpaceSeparated();
     for (CounterDirectiveMap::const_iterator it = map->begin(); it != map->end(); ++it) {
         list->append(primitiveValueCache->createValue(it->first.get(), CSSPrimitiveValue::CSS_STRING));
         short number = propertyID == CSSPropertyCounterIncrement ? it->second.m_incrementValue : it->second.m_resetValue;
@@ -1687,7 +1700,10 @@ PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getPropertyCSSValue(int proper
             return primitiveValueCache->createValue(style->writingMode());
         case CSSPropertyWebkitTextCombine:
             return primitiveValueCache->createValue(style->textCombine());
-
+        case CSSPropertyWebkitTextOrientation:
+            return CSSPrimitiveValue::create(style->fontDescription().textOrientation());
+        case CSSPropertyWebkitLineBoxContain:
+            return createLineBoxContainValue(primitiveValueCache, style->lineBoxContain());
         case CSSPropertyContent:
             return contentToCSSValue(style.get(), primitiveValueCache);
         case CSSPropertyCounterIncrement:
diff --git a/Source/WebCore/css/CSSFontFaceSource.cpp b/Source/WebCore/css/CSSFontFaceSource.cpp
index 681a94b..d32684e 100644
--- a/Source/WebCore/css/CSSFontFaceSource.cpp
+++ b/Source/WebCore/css/CSSFontFaceSource.cpp
@@ -115,7 +115,8 @@ SimpleFontData* CSSFontFaceSource::getFontData(const FontDescription& fontDescri
     }
 
     // See if we have a mapping in our FontData cache.
-    unsigned hashKey = (fontDescription.computedPixelSize() + 1) << 5 | fontDescription.widthVariant() << 3 | (fontDescription.orientation() == Vertical ? 4 : 0) | (syntheticBold ? 2 : 0) | (syntheticItalic ? 1 : 0);
+    unsigned hashKey = (fontDescription.computedPixelSize() + 1) << 6 | fontDescription.widthVariant() << 4
+                       | (fontDescription.textOrientation() == TextOrientationUpright ? 8 : 0) | (fontDescription.orientation() == Vertical ? 4 : 0) | (syntheticBold ? 2 : 0) | (syntheticItalic ? 1 : 0);
     if (SimpleFontData* cachedData = m_fontDataTable.get(hashKey))
         return cachedData;
 
@@ -162,7 +163,8 @@ SimpleFontData* CSSFontFaceSource::getFontData(const FontDescription& fontDescri
                 if (!m_font->ensureCustomFontData())
                     return 0;
 
-                fontData.set(new SimpleFontData(m_font->platformDataFromCustomData(fontDescription.computedPixelSize(), syntheticBold, syntheticItalic, fontDescription.orientation(), fontDescription.widthVariant(), fontDescription.renderingMode()), true, false));
+                fontData.set(new SimpleFontData(m_font->platformDataFromCustomData(fontDescription.computedPixelSize(), syntheticBold, syntheticItalic, fontDescription.orientation(),
+                                                                                   fontDescription.textOrientation(), fontDescription.widthVariant(), fontDescription.renderingMode()), true, false));
             }
         } else {
 #if ENABLE(SVG_FONTS)
diff --git a/Source/WebCore/css/CSSGrammar.y b/Source/WebCore/css/CSSGrammar.y
index 8658674..246a449 100644
--- a/Source/WebCore/css/CSSGrammar.y
+++ b/Source/WebCore/css/CSSGrammar.y
@@ -99,7 +99,7 @@ static int cssyylex(YYSTYPE* yylval, void* parser)
 
 %}
 
-%expect 51
+%expect 55
 
 %nonassoc LOWEST_PREC
 
@@ -183,13 +183,18 @@ static int cssyylex(YYSTYPE* yylval, void* parser)
 %token <number> HERTZ
 %token <number> KHERTZ
 %token <string> DIMEN
+%token <string> INVALIDDIMEN
 %token <number> PERCENTAGE
 %token <number> FLOATTOKEN
 %token <number> INTEGER
 
 %token <string> URI
 %token <string> FUNCTION
+%token <string> ANYFUNCTION
 %token <string> NOTFUNCTION
+%token <string> CALCFUNCTION
+%token <string> MINFUNCTION
+%token <string> MAXFUNCTION
 
 %token <string> UNICODERANGE
 
@@ -247,6 +252,7 @@ static int cssyylex(YYSTYPE* yylval, void* parser)
 %type <selector> simple_selector
 %type <selector> selector
 %type <selectorList> selector_list
+%type <selectorList> simple_selector_list
 %type <selector> selector_with_trailing_whitespace
 %type <selector> class
 %type <selector> attrib
@@ -270,6 +276,14 @@ static int cssyylex(YYSTYPE* yylval, void* parser)
 %type <value> term
 %type <value> unary_term
 %type <value> function
+%type <value> calc_func_term
+%type <character> calc_func_operator
+%type <valueList> calc_func_expr
+%type <valueList> calc_func_expr_list
+%type <valueList> calc_func_paren_expr
+%type <value> calc_function
+%type <string> min_or_max
+%type <value> min_or_max_function
 
 %type <string> element_name
 %type <string> attr_name
@@ -921,6 +935,28 @@ simple_selector:
     }
   ;
 
+simple_selector_list:
+    simple_selector %prec UNIMPORTANT_TOK {
+        if ($1) {
+            CSSParser* p = static_cast<CSSParser*>(parser);
+            $$ = p->createFloatingSelectorVector();
+            $$->append(p->sinkFloatingSelector($1));
+        } else
+            $$ = 0
+    }
+    | simple_selector_list maybe_space ',' maybe_space simple_selector %prec UNIMPORTANT_TOK {
+        if ($1 && $5) {
+            CSSParser* p = static_cast<CSSParser*>(parser);
+            $$ = $1;
+            $$->append(p->sinkFloatingSelector($5));
+        } else
+            $$ = 0;
+    }
+    | simple_selector_list error {
+        $$ = 0;
+    }
+  ;
+
 element_name:
     IDENT {
         CSSParserString& str = $1;
@@ -1102,6 +1138,25 @@ pseudo:
         // FIXME: This call is needed to force selector to compute the pseudoType early enough.
         $$->pseudoType();
     }
+    // use by :-webkit-any.
+    // FIXME: should we support generic selectors here or just simple_selectors?
+    // Use simple_selector_list for now to match -moz-any.
+    // See http://lists.w3.org/Archives/Public/www-style/2010Sep/0566.html for some
+    // related discussion with respect to :not.
+    | ':' ANYFUNCTION maybe_space simple_selector_list maybe_space ')' {
+        if ($4) {
+            CSSParser *p = static_cast<CSSParser*>(parser);
+            $$ = p->createFloatingSelector();
+            $$->setMatch(CSSSelector::PseudoClass);
+            $$->adoptSelectorVector(*p->sinkFloatingSelectorVector($4));
+            $2.lower();
+            $$->setValue($2);
+            CSSSelector::PseudoType type = $$->pseudoType();
+            if (type != CSSSelector::PseudoAny)
+                $$ = 0;
+        } else
+            $$ = 0;
+    }
     // used by :nth-*(ax+b)
     | ':' FUNCTION maybe_space NTH maybe_space ')' {
         CSSParser *p = static_cast<CSSParser*>(parser);
@@ -1151,7 +1206,11 @@ pseudo:
             CSSParser* p = static_cast<CSSParser*>(parser);
             $$ = p->createFloatingSelector();
             $$->setMatch(CSSSelector::PseudoClass);
-            $$->setSimpleSelector(p->sinkFloatingSelector($4)->releaseSelector());
+
+            Vector<OwnPtr<CSSParserSelector> > selectorVector;
+            selectorVector.append(p->sinkFloatingSelector($4));
+            $$->adoptSelectorVector(selectorVector);
+
             $2.lower();
             $$->setValue($2);
         }
@@ -1361,6 +1420,12 @@ term:
   | function {
       $$ = $1;
   }
+  | calc_function {
+      $$ = $1;
+  }
+  | min_or_max_function {
+      $$ = $1;
+  }
   | '%' maybe_space { /* Handle width: %; */
       $$.id = 0; $$.unit = 0;
   }
@@ -1417,6 +1482,143 @@ function:
         $$.function = f;
   }
   ;
+ 
+calc_func_term:
+  unary_term { $$ = $1; }
+  | unary_operator unary_term { $$ = $2; $$.fValue *= $1; }
+  ;
+
+calc_func_operator:
+    '+' WHITESPACE {
+        $$ = '+';
+    }
+    | '-' WHITESPACE {
+        $$ = '-';
+    }
+    | '*' maybe_space {
+        $$ = '*';
+    }
+    | '/' maybe_space {
+        $$ = '/';
+    }
+    | IDENT maybe_space {
+        if (equalIgnoringCase("mod", $1.characters, $1.length))
+            $$ = '%';
+        else
+            $$ = 0;
+    }
+  ;
+
+calc_func_paren_expr:
+    '(' maybe_space calc_func_expr maybe_space ')' maybe_space {
+        if ($3) {
+            $$ = $3;
+            CSSParserValue v;
+            v.id = 0;
+            v.unit = CSSParserValue::Operator;
+            v.iValue = '(';
+            $$->insertValueAt(0, v);
+            v.iValue = ')';
+            $$->addValue(v);
+        }
+    }
+
+calc_func_expr:
+    calc_func_term maybe_space {
+        CSSParser* p = static_cast<CSSParser*>(parser);
+        $$ = p->createFloatingValueList();
+        $$->addValue(p->sinkFloatingValue($1));
+    }
+    | calc_func_expr calc_func_operator calc_func_term {
+        CSSParser* p = static_cast<CSSParser*>(parser);
+        if ($1 && $2) {
+            $$ = $1;
+            CSSParserValue v;
+            v.id = 0;
+            v.unit = CSSParserValue::Operator;
+            v.iValue = $2;
+            $$->addValue(v);
+            $$->addValue(p->sinkFloatingValue($3));
+        } else
+            $$ = 0;
+
+    }
+    | calc_func_expr calc_func_operator calc_func_paren_expr {
+        if ($1 && $2 && $3) {
+            $$ = $1;
+            CSSParserValue v;
+            v.id = 0;
+            v.unit = CSSParserValue::Operator;
+            v.iValue = $2;
+            $$->addValue(v);
+            $$->extend(*($3));
+        } else 
+            $$ = 0;
+    }
+    | calc_func_paren_expr
+    | calc_func_expr error {
+        $$ = 0;
+    }
+  ;
+
+calc_func_expr_list:
+    calc_func_expr  {
+        $$ = $1;
+    }    
+    | calc_func_expr_list ',' maybe_space calc_func_expr {
+        if ($1 && $4) {
+            $$ = $1;
+            CSSParserValue v;
+            v.id = 0;
+            v.unit = CSSParserValue::Operator;
+            v.iValue = ',';
+            $$->addValue(v);
+            $$->extend(*($4));
+        } else
+            $$ = 0;
+    }
+    
+
+calc_function:
+    CALCFUNCTION maybe_space calc_func_expr ')' maybe_space {
+        CSSParser* p = static_cast<CSSParser*>(parser);
+        CSSParserFunction* f = p->createFloatingFunction();
+        f->name = $1;
+        f->args = p->sinkFloatingValueList($3);
+        $$.id = 0;
+        $$.unit = CSSParserValue::Function;
+        $$.function = f;
+    }
+    | CALCFUNCTION maybe_space error {
+        YYERROR;
+    }
+    ;
+
+
+min_or_max:
+    MINFUNCTION {
+        $$ = $1;
+    }
+    | MAXFUNCTION {
+        $$ = $1;
+    }
+    ;
+
+min_or_max_function:
+    min_or_max maybe_space calc_func_expr_list ')' maybe_space {
+        CSSParser* p = static_cast<CSSParser*>(parser);
+        CSSParserFunction* f = p->createFloatingFunction();
+        f->name = $1;
+        f->args = p->sinkFloatingValueList($3);
+        $$.id = 0;
+        $$.unit = CSSParserValue::Function;
+        $$.function = f;
+    } 
+    | min_or_max maybe_space error {
+        YYERROR;
+    }
+    ;
+
 /*
  * There is a constraint on the color that it must
  * have either 3 or 6 hex-digits (i.e., [0-9a-fA-F])
diff --git a/Source/WebCore/css/CSSImageValue.cpp b/Source/WebCore/css/CSSImageValue.cpp
index 6896596..a9038b9 100644
--- a/Source/WebCore/css/CSSImageValue.cpp
+++ b/Source/WebCore/css/CSSImageValue.cpp
@@ -67,10 +67,6 @@ StyleCachedImage* CSSImageValue::cachedImage(CachedResourceLoader* loader)
 StyleCachedImage* CSSImageValue::cachedImage(CachedResourceLoader* loader, const String& url)
 {
     ASSERT(loader);
-    if (!loader) {
-        // FIXME: Remove when http://webkit.org/b/53045 is fixed.
-        CRASH();
-    }
 
     if (!m_accessedImage) {
         m_accessedImage = true;
diff --git a/Source/WebCore/css/CSSLineBoxContainValue.cpp b/Source/WebCore/css/CSSLineBoxContainValue.cpp
new file mode 100644
index 0000000..b029285
--- /dev/null
+++ b/Source/WebCore/css/CSSLineBoxContainValue.cpp
@@ -0,0 +1,74 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "CSSLineBoxContainValue.h"
+
+#include "CSSPrimitiveValue.h"
+#include "PlatformString.h"
+
+namespace WebCore {
+
+CSSLineBoxContainValue::CSSLineBoxContainValue(unsigned value)
+    : m_value(value)
+{
+}
+
+String CSSLineBoxContainValue::cssText() const
+{
+    String text("");
+
+    if (m_value & LineBoxContainBlock)
+        text += "block";
+    if (m_value & LineBoxContainInline) {
+        if (!text.isEmpty())
+            text += " ";
+        text += "inline";
+    }
+    if (m_value & LineBoxContainFont) {
+        if (!text.isEmpty())
+            text += " ";
+        text += "font";
+    }
+    if (m_value & LineBoxContainGlyphs) {
+        if (!text.isEmpty())
+            text += " ";
+        text += "glyphs";
+    }
+    if (m_value & LineBoxContainReplaced) {
+        if (!text.isEmpty())
+            text += " ";
+        text += "replaced";
+    }
+    if (m_value & LineBoxContainInlineBox) {
+        if (!text.isEmpty())
+            text += " ";
+        text += "inline-box";
+    }
+
+    return text;
+}
+
+}
diff --git a/Source/WebCore/css/CSSLineBoxContainValue.h b/Source/WebCore/css/CSSLineBoxContainValue.h
new file mode 100644
index 0000000..8d62b11
--- /dev/null
+++ b/Source/WebCore/css/CSSLineBoxContainValue.h
@@ -0,0 +1,63 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef CSSLineBoxContainValue_h
+#define CSSLineBoxContainValue_h
+
+#include "CSSValue.h"
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefPtr.h>
+
+namespace WebCore {
+
+class CSSPrimitiveValue;
+
+enum LineBoxContainFlags { LineBoxContainNone = 0x0, LineBoxContainBlock = 0x1, LineBoxContainInline = 0x2, LineBoxContainFont = 0x4, LineBoxContainGlyphs = 0x8,
+                           LineBoxContainReplaced = 0x10, LineBoxContainInlineBox = 0x20 };
+typedef unsigned LineBoxContain;
+
+// Used for text-CSSLineBoxContain and box-CSSLineBoxContain
+class CSSLineBoxContainValue : public CSSValue {
+public:
+    static PassRefPtr<CSSLineBoxContainValue> create(LineBoxContain value)
+    {
+        return adoptRef(new CSSLineBoxContainValue(value));
+    }
+
+    virtual String cssText() const;
+
+    LineBoxContain value() const { return m_value; }
+
+private:
+    LineBoxContain m_value;
+
+private:
+    CSSLineBoxContainValue(LineBoxContain);
+    virtual bool isCSSLineBoxContainValue() const { return true; }
+};
+
+} // namespace
+
+#endif
diff --git a/Source/WebCore/css/CSSMutableStyleDeclaration.cpp b/Source/WebCore/css/CSSMutableStyleDeclaration.cpp
index e6a49d3..6485e5b 100644
--- a/Source/WebCore/css/CSSMutableStyleDeclaration.cpp
+++ b/Source/WebCore/css/CSSMutableStyleDeclaration.cpp
@@ -82,15 +82,18 @@ CSSMutableStyleDeclaration::CSSMutableStyleDeclaration(CSSRule* parent, const CS
 #endif
 {
     m_properties.reserveInitialCapacity(numProperties);
-    HashSet<int> candidates;
+    HashMap<int, bool> candidates;
     for (int i = 0; i < numProperties; ++i) {
         const CSSProperty *property = properties[i];
         ASSERT(property);
-        if (candidates.contains(property->id()))
-            removeProperty(properties[i]->id(), false);
+        bool important = property->isImportant();
+        if (candidates.contains(property->id())) {
+            if (!important && candidates.get(property->id()))
+                continue;
+            removeProperty(property->id(), false);
+        }
         m_properties.append(*property);
-        if (!getPropertyPriority(property->id()) && !property->isImportant())
-            candidates.add(property->id());
+        candidates.set(property->id(), important);
     }
 }
 
@@ -129,11 +132,11 @@ String CSSMutableStyleDeclaration::getPropertyValue(int propertyID) const
         case CSSPropertyBackgroundPosition: {
             // FIXME: Is this correct? The code in cssparser.cpp is confusing
             const int properties[2] = { CSSPropertyBackgroundPositionX, CSSPropertyBackgroundPositionY };
-            return getLayeredShorthandValue(properties, 2);
+            return getLayeredShorthandValue(properties);
         }
         case CSSPropertyBackgroundRepeat: {
             const int properties[2] = { CSSPropertyBackgroundRepeatX, CSSPropertyBackgroundRepeatY };
-            return getLayeredShorthandValue(properties, 2);
+            return getLayeredShorthandValue(properties);
         }
         case CSSPropertyBackground: {
             const int properties[9] = { CSSPropertyBackgroundColor,
@@ -145,7 +148,7 @@ String CSSMutableStyleDeclaration::getPropertyValue(int propertyID) const
                                         CSSPropertyBackgroundPositionY, 
                                         CSSPropertyBackgroundClip,
                                         CSSPropertyBackgroundOrigin }; 
-            return getLayeredShorthandValue(properties, 9);
+            return getLayeredShorthandValue(properties);
         }
         case CSSPropertyBorder: {
             const int properties[3][4] = {{ CSSPropertyBorderTopWidth,
@@ -162,7 +165,7 @@ String CSSMutableStyleDeclaration::getPropertyValue(int propertyID) const
                                             CSSPropertyBorderLeftColor }};
             String res;
             for (size_t i = 0; i < WTF_ARRAY_LENGTH(properties); ++i) {
-                String value = getCommonValue(properties[i], 4);
+                String value = getCommonValue(properties[i]);
                 if (!value.isNull()) {
                     if (!res.isNull())
                         res += " ";
@@ -174,27 +177,27 @@ String CSSMutableStyleDeclaration::getPropertyValue(int propertyID) const
         case CSSPropertyBorderTop: {
             const int properties[3] = { CSSPropertyBorderTopWidth, CSSPropertyBorderTopStyle,
                                         CSSPropertyBorderTopColor};
-            return getShorthandValue(properties, 3);
+            return getShorthandValue(properties);
         }
         case CSSPropertyBorderRight: {
             const int properties[3] = { CSSPropertyBorderRightWidth, CSSPropertyBorderRightStyle,
                                         CSSPropertyBorderRightColor};
-            return getShorthandValue(properties, 3);
+            return getShorthandValue(properties);
         }
         case CSSPropertyBorderBottom: {
             const int properties[3] = { CSSPropertyBorderBottomWidth, CSSPropertyBorderBottomStyle,
                                         CSSPropertyBorderBottomColor};
-            return getShorthandValue(properties, 3);
+            return getShorthandValue(properties);
         }
         case CSSPropertyBorderLeft: {
             const int properties[3] = { CSSPropertyBorderLeftWidth, CSSPropertyBorderLeftStyle,
                                         CSSPropertyBorderLeftColor};
-            return getShorthandValue(properties, 3);
+            return getShorthandValue(properties);
         }
         case CSSPropertyOutline: {
             const int properties[3] = { CSSPropertyOutlineWidth, CSSPropertyOutlineStyle,
                                         CSSPropertyOutlineColor };
-            return getShorthandValue(properties, 3);
+            return getShorthandValue(properties);
         }
         case CSSPropertyBorderColor: {
             const int properties[4] = { CSSPropertyBorderTopColor, CSSPropertyBorderRightColor,
@@ -218,7 +221,7 @@ String CSSMutableStyleDeclaration::getPropertyValue(int propertyID) const
         }
         case CSSPropertyOverflow: {
             const int properties[2] = { CSSPropertyOverflowX, CSSPropertyOverflowY };
-            return getCommonValue(properties, 2);
+            return getCommonValue(properties);
         }
         case CSSPropertyPadding: {
             const int properties[4] = { CSSPropertyPaddingTop, CSSPropertyPaddingRight,
@@ -228,40 +231,40 @@ String CSSMutableStyleDeclaration::getPropertyValue(int propertyID) const
         case CSSPropertyListStyle: {
             const int properties[3] = { CSSPropertyListStyleType, CSSPropertyListStylePosition,
                                         CSSPropertyListStyleImage };
-            return getShorthandValue(properties, 3);
+            return getShorthandValue(properties);
         }
         case CSSPropertyWebkitMaskPosition: {
             // FIXME: Is this correct? The code in cssparser.cpp is confusing
             const int properties[2] = { CSSPropertyWebkitMaskPositionX, CSSPropertyWebkitMaskPositionY };
-            return getLayeredShorthandValue(properties, 2);
+            return getLayeredShorthandValue(properties);
         }
         case CSSPropertyWebkitMaskRepeat: {
             const int properties[2] = { CSSPropertyWebkitMaskRepeatX, CSSPropertyWebkitMaskRepeatY };
-            return getLayeredShorthandValue(properties, 2);
+            return getLayeredShorthandValue(properties);
         }
         case CSSPropertyWebkitMask: {
             const int properties[] = { CSSPropertyWebkitMaskImage, CSSPropertyWebkitMaskRepeat, 
                                        CSSPropertyWebkitMaskAttachment, CSSPropertyWebkitMaskPosition, CSSPropertyWebkitMaskClip,
                                        CSSPropertyWebkitMaskOrigin };
-            return getLayeredShorthandValue(properties, 6);
+            return getLayeredShorthandValue(properties);
         }
         case CSSPropertyWebkitTransformOrigin: {
             const int properties[3] = { CSSPropertyWebkitTransformOriginX,
                                         CSSPropertyWebkitTransformOriginY,
                                         CSSPropertyWebkitTransformOriginZ };
-            return getShorthandValue(properties, 3);
+            return getShorthandValue(properties);
         }
         case CSSPropertyWebkitTransition: {
             const int properties[4] = { CSSPropertyWebkitTransitionProperty, CSSPropertyWebkitTransitionDuration,
                                         CSSPropertyWebkitTransitionTimingFunction, CSSPropertyWebkitTransitionDelay };
-            return getLayeredShorthandValue(properties, 4);
+            return getLayeredShorthandValue(properties);
         }
         case CSSPropertyWebkitAnimation: {
             const int properties[7] = { CSSPropertyWebkitAnimationName, CSSPropertyWebkitAnimationDuration,
                                         CSSPropertyWebkitAnimationTimingFunction, CSSPropertyWebkitAnimationDelay,
                                         CSSPropertyWebkitAnimationIterationCount, CSSPropertyWebkitAnimationDirection,
                                         CSSPropertyWebkitAnimationFillMode };
-            return getLayeredShorthandValue(properties, 7);
+            return getLayeredShorthandValue(properties);
         }
 #if ENABLE(SVG)
         case CSSPropertyMarker: {
@@ -331,15 +334,15 @@ String CSSMutableStyleDeclaration::get4Values(const int* properties) const
     return res;
 }
 
-String CSSMutableStyleDeclaration::getLayeredShorthandValue(const int* properties, unsigned number) const
+String CSSMutableStyleDeclaration::getLayeredShorthandValue(const int* properties, size_t size) const
 {
     String res;
 
     // Begin by collecting the properties into an array.
-    Vector< RefPtr<CSSValue> > values(number);
+    Vector< RefPtr<CSSValue> > values(size);
     size_t numLayers = 0;
     
-    for (size_t i = 0; i < number; ++i) {
+    for (size_t i = 0; i < size; ++i) {
         values[i] = getPropertyCSSValue(properties[i]);
         if (values[i]) {
             if (values[i]->isValueList()) {
@@ -357,7 +360,7 @@ String CSSMutableStyleDeclaration::getLayeredShorthandValue(const int* propertie
         bool useRepeatXShorthand = false;
         bool useRepeatYShorthand = false;
         bool useSingleWordShorthand = false;
-        for (size_t j = 0; j < number; j++) {
+        for (size_t j = 0; j < size; j++) {
             RefPtr<CSSValue> value;
             if (values[j]) {
                 if (values[j]->isValueList())
@@ -380,7 +383,7 @@ String CSSMutableStyleDeclaration::getLayeredShorthandValue(const int* propertie
             if (properties[j] == CSSPropertyBackgroundRepeatX && isPropertyImplicit(properties[j])) {
 
                 // BUG 49055: make sure the value was not reset in the layer check just above.
-                if (j < number - 1 && properties[j + 1] == CSSPropertyBackgroundRepeatY && value) {
+                if (j < size - 1 && properties[j + 1] == CSSPropertyBackgroundRepeatY && value) {
                     RefPtr<CSSValue> yValue;
                     RefPtr<CSSValue> nextValue = values[j + 1];
                     if (nextValue->isValueList())
@@ -432,10 +435,10 @@ String CSSMutableStyleDeclaration::getLayeredShorthandValue(const int* propertie
     return res;
 }
 
-String CSSMutableStyleDeclaration::getShorthandValue(const int* properties, int number) const
+String CSSMutableStyleDeclaration::getShorthandValue(const int* properties, size_t size) const
 {
     String res;
-    for (int i = 0; i < number; ++i) {
+    for (size_t i = 0; i < size; ++i) {
         if (!isPropertyImplicit(properties[i])) {
             RefPtr<CSSValue> value = getPropertyCSSValue(properties[i]);
             // FIXME: provide default value if !value
@@ -450,10 +453,10 @@ String CSSMutableStyleDeclaration::getShorthandValue(const int* properties, int
 }
 
 // only returns a non-null value if all properties have the same, non-null value
-String CSSMutableStyleDeclaration::getCommonValue(const int* properties, int number) const
+String CSSMutableStyleDeclaration::getCommonValue(const int* properties, size_t size) const
 {
     String res;
-    for (int i = 0; i < number; ++i) {
+    for (size_t i = 0; i < size; ++i) {
         RefPtr<CSSValue> value = getPropertyCSSValue(properties[i]);
         if (!value)
             return String();
@@ -509,14 +512,18 @@ String CSSMutableStyleDeclaration::removeProperty(int propertyID, bool notifyCha
     return value;
 }
 
+bool CSSMutableStyleDeclaration::isInlineStyleDeclaration()
+{
+    // FIXME: Ideally, this should be factored better and there
+    // should be a subclass of CSSMutableStyleDeclaration just
+    // for inline style declarations that handles this
+    return m_node && m_node->isStyledElement() && static_cast<StyledElement*>(m_node)->inlineStyleDecl() == this;
+}
+
 void CSSMutableStyleDeclaration::setNeedsStyleRecalc()
 {
     if (m_node) {
-        // FIXME: Ideally, this should be factored better and there
-        // should be a subclass of CSSMutableStyleDeclaration just
-        // for inline style declarations that handles this
-        bool isInlineStyleDeclaration = m_node->isStyledElement() && this == static_cast<StyledElement*>(m_node)->inlineStyleDecl();
-        if (isInlineStyleDeclaration) {
+        if (isInlineStyleDeclaration()) {
             m_node->setNeedsStyleRecalc(InlineStyleChange);
             static_cast<StyledElement*>(m_node)->invalidateStyleAttribute();
             if (m_node->document())
@@ -717,7 +724,7 @@ String CSSMutableStyleDeclaration::cssText() const
         String positionValue;
         const int properties[2] = { CSSPropertyBackgroundPositionX, CSSPropertyBackgroundPositionY };
         if (positionXProp->value()->isValueList() || positionYProp->value()->isValueList()) 
-            positionValue = getLayeredShorthandValue(properties, 2);
+            positionValue = getLayeredShorthandValue(properties);
         else
             positionValue = positionXProp->value()->cssText() + " " + positionYProp->value()->cssText();
         result += "background-position: " + positionValue + (positionXProp->isImportant() ? " !important" : "") + "; ";
@@ -733,7 +740,7 @@ String CSSMutableStyleDeclaration::cssText() const
         String repeatValue;
         const int repeatProperties[2] = { CSSPropertyBackgroundRepeatX, CSSPropertyBackgroundRepeatY };
         if (repeatXProp->value()->isValueList() || repeatYProp->value()->isValueList()) 
-            repeatValue = getLayeredShorthandValue(repeatProperties, 2);
+            repeatValue = getLayeredShorthandValue(repeatProperties);
         else
             repeatValue = repeatXProp->value()->cssText() + " " + repeatYProp->value()->cssText();
         result += "background-repeat: " + repeatValue + (repeatXProp->isImportant() ? " !important" : "") + "; ";
diff --git a/Source/WebCore/css/CSSMutableStyleDeclaration.h b/Source/WebCore/css/CSSMutableStyleDeclaration.h
index 0eab1b6..ca17f11 100644
--- a/Source/WebCore/css/CSSMutableStyleDeclaration.h
+++ b/Source/WebCore/css/CSSMutableStyleDeclaration.h
@@ -140,6 +140,8 @@ public:
     
     bool propertiesEqual(const CSSMutableStyleDeclaration* o) const { return m_properties == o->m_properties; }
 
+    bool isInlineStyleDeclaration();
+
 protected:
     CSSMutableStyleDeclaration(CSSRule* parentRule);
 
@@ -152,12 +154,16 @@ private:
 
     void setNeedsStyleRecalc();
 
-    String getShorthandValue(const int* properties, int number) const;
-    String getCommonValue(const int* properties, int number) const;
-    String getLayeredShorthandValue(const int* properties, unsigned number) const;
+    String getShorthandValue(const int* properties, size_t) const;
+    String getCommonValue(const int* properties, size_t) const;
+    String getLayeredShorthandValue(const int* properties, size_t) const;
     String get4Values(const int* properties) const;
     String borderSpacingValue(const int properties[2]) const;
-    
+
+    template<size_t size> String getShorthandValue(const int (&properties)[size]) const { return getShorthandValue(properties, size); }
+    template<size_t size> String getCommonValue(const int (&properties)[size]) const { return getCommonValue(properties, size); }
+    template<size_t size> String getLayeredShorthandValue(const int (&properties)[size]) const { return getLayeredShorthandValue(properties, size); }
+
     void setPropertyInternal(const CSSProperty&, CSSProperty* slot = 0);
     bool removeShorthandProperty(int propertyID, bool notifyChanged);
 
diff --git a/Source/WebCore/css/CSSOMUtils.cpp b/Source/WebCore/css/CSSOMUtils.cpp
index d1e9638..7ecd938 100644
--- a/Source/WebCore/css/CSSOMUtils.cpp
+++ b/Source/WebCore/css/CSSOMUtils.cpp
@@ -31,7 +31,7 @@
 #include "config.h"
 #include "CSSOMUtils.h"
 
-#include "PlatformString.h"
+#include <wtf/HexNumber.h>
 
 namespace WebCore {
 
@@ -53,7 +53,9 @@ void serializeCharacter(UChar32 c, Vector<UChar>& appendTo)
 
 void serializeCharacterAsCodePoint(UChar32 c, Vector<UChar>& appendTo)
 {
-    append(appendTo, String::format("\\%x ", c));
+    appendTo.append('\\');
+    appendUnsignedAsHex(c, appendTo, Lowercase);
+    appendTo.append(' ');
 }
 
 void serializeIdentifier(const String& identifier, String& appendTo)
diff --git a/Source/WebCore/css/CSSParser.cpp b/Source/WebCore/css/CSSParser.cpp
index df8816c..02733ae 100644
--- a/Source/WebCore/css/CSSParser.cpp
+++ b/Source/WebCore/css/CSSParser.cpp
@@ -36,6 +36,7 @@
 #include "CSSImportRule.h"
 #include "CSSInheritedValue.h"
 #include "CSSInitialValue.h"
+#include "CSSLineBoxContainValue.h"
 #include "CSSMediaRule.h"
 #include "CSSMutableStyleDeclaration.h"
 #include "CSSPageRule.h"
@@ -72,6 +73,7 @@
 #include "WebKitCSSKeyframesRule.h"
 #include "WebKitCSSTransformValue.h"
 #include <limits.h>
+#include <wtf/HexNumber.h>
 #include <wtf/dtoa.h>
 #include <wtf/text/StringBuffer.h>
 
@@ -97,6 +99,7 @@ using namespace WTF;
 namespace WebCore {
 
 static const unsigned INVALID_NUM_PARSED_PROPERTIES = UINT_MAX;
+static const double MAX_SCALE = 1000000;
 
 static bool equal(const CSSParserString& a, const char* b)
 {
@@ -177,6 +180,7 @@ CSSParser::~CSSParser()
     fastFree(m_data);
 
     fastDeleteAllValues(m_floatingSelectors);
+    deleteAllValues(m_floatingSelectorVectors);
     deleteAllValues(m_floatingValueLists);
     deleteAllValues(m_floatingFunctions);
 }
@@ -698,10 +702,11 @@ bool CSSParser::parseValue(int propId, bool important)
         else
             return parseQuotes(propId, important);
         break;
-    case CSSPropertyUnicodeBidi:         // normal | embed | bidi-override | inherit
-        if (id == CSSValueNormal ||
-             id == CSSValueEmbed ||
-             id == CSSValueBidiOverride)
+    case CSSPropertyUnicodeBidi: // normal | embed | bidi-override | isolate | inherit
+        if (id == CSSValueNormal
+            || id == CSSValueEmbed
+            || id == CSSValueBidiOverride
+            || id == CSSValueWebkitIsolate)
             validPrimitive = true;
         break;
 
@@ -838,9 +843,10 @@ bool CSSParser::parseValue(int propId, bool important)
         break;
 
     case CSSPropertyTextAlign:
-        // left | right | center | justify | webkit_left | webkit_right | webkit_center | start | end | <string> | inherit
-        if ((id >= CSSValueWebkitAuto && id <= CSSValueWebkitCenter) || id == CSSValueStart || id == CSSValueEnd ||
-             value->unit == CSSPrimitiveValue::CSS_STRING)
+        // left | right | center | justify | webkit_left | webkit_right | webkit_center | webkit_match_parent |
+        // start | end | <string> | inherit
+        if ((id >= CSSValueWebkitAuto && id <= CSSValueWebkitMatchParent) || id == CSSValueStart || id == CSSValueEnd
+             || value->unit == CSSPrimitiveValue::CSS_STRING)
             validPrimitive = true;
         break;
 
@@ -1887,6 +1893,7 @@ bool CSSParser::parseValue(int propId, bool important)
     case CSSPropertyWebkitTextEmphasisStyle:
         return parseTextEmphasisStyle(important);
 
+<<<<<<< HEAD
 #ifdef ANDROID_CSS_RING
     case CSSPropertyWebkitRing:
     {
@@ -1924,6 +1931,20 @@ bool CSSParser::parseValue(int propId, bool important)
             m_valueList->next();
         break;
 #endif
+=======
+    case CSSPropertyWebkitTextOrientation:
+        // FIXME: For now just support upright and vertical-right.
+        if (id == CSSValueVerticalRight || id == CSSValueUpright)
+            validPrimitive = true;
+        break;
+
+    case CSSPropertyWebkitLineBoxContain:
+        if (id == CSSValueNone)
+            validPrimitive = true;
+        else
+            return parseLineBoxContain(important);
+        break;
+>>>>>>> webkit.org at r82507
 
 #if ENABLE(SVG)
     default:
@@ -2608,34 +2629,80 @@ bool CSSParser::parseFillImage(RefPtr<CSSValue>& value)
     return false;
 }
 
-PassRefPtr<CSSValue> CSSParser::parseFillPositionXY(CSSParserValueList* valueList, bool& xFound, bool& yFound)
+PassRefPtr<CSSValue> CSSParser::parseFillPositionX(CSSParserValueList* valueList)
+{
+    int id = valueList->current()->id;
+    if (id == CSSValueLeft || id == CSSValueRight || id == CSSValueCenter) {
+        int percent = 0;
+        if (id == CSSValueRight)
+            percent = 100;
+        else if (id == CSSValueCenter)
+            percent = 50;
+        return primitiveValueCache()->createValue(percent, CSSPrimitiveValue::CSS_PERCENTAGE);
+    }
+    if (validUnit(valueList->current(), FPercent | FLength, m_strict))
+        return primitiveValueCache()->createValue(valueList->current()->fValue,
+                                                  (CSSPrimitiveValue::UnitTypes)valueList->current()->unit);
+    return 0;
+}
+
+PassRefPtr<CSSValue> CSSParser::parseFillPositionY(CSSParserValueList* valueList)
+{
+    int id = valueList->current()->id;
+    if (id == CSSValueTop || id == CSSValueBottom || id == CSSValueCenter) {
+        int percent = 0;
+        if (id == CSSValueBottom)
+            percent = 100;
+        else if (id == CSSValueCenter)
+            percent = 50;
+        return primitiveValueCache()->createValue(percent, CSSPrimitiveValue::CSS_PERCENTAGE);
+    }
+    if (validUnit(valueList->current(), FPercent | FLength, m_strict))
+        return primitiveValueCache()->createValue(valueList->current()->fValue,
+                                                  (CSSPrimitiveValue::UnitTypes)valueList->current()->unit);
+    return 0;
+}
+
+PassRefPtr<CSSValue> CSSParser::parseFillPositionComponent(CSSParserValueList* valueList, unsigned& cumulativeFlags, FillPositionFlag& individualFlag)
 {
     int id = valueList->current()->id;
     if (id == CSSValueLeft || id == CSSValueTop || id == CSSValueRight || id == CSSValueBottom || id == CSSValueCenter) {
         int percent = 0;
         if (id == CSSValueLeft || id == CSSValueRight) {
-            if (xFound)
+            if (cumulativeFlags & XFillPosition)
                 return 0;
-            xFound = true;
+            cumulativeFlags |= XFillPosition;
+            individualFlag = XFillPosition;
             if (id == CSSValueRight)
                 percent = 100;
         }
         else if (id == CSSValueTop || id == CSSValueBottom) {
-            if (yFound)
+            if (cumulativeFlags & YFillPosition)
                 return 0;
-            yFound = true;
+            cumulativeFlags |= YFillPosition;
+            individualFlag = YFillPosition;
             if (id == CSSValueBottom)
                 percent = 100;
-        }
-        else if (id == CSSValueCenter)
+        } else if (id == CSSValueCenter) {
             // Center is ambiguous, so we're not sure which position we've found yet, an x or a y.
             percent = 50;
+            cumulativeFlags |= AmbiguousFillPosition;
+            individualFlag = AmbiguousFillPosition;
+        }
         return primitiveValueCache()->createValue(percent, CSSPrimitiveValue::CSS_PERCENTAGE);
     }
-    if (validUnit(valueList->current(), FPercent | FLength, m_strict))
+    if (validUnit(valueList->current(), FPercent | FLength, m_strict)) {
+        if (!cumulativeFlags) {
+            cumulativeFlags |= XFillPosition;
+            individualFlag = XFillPosition;
+        } else if (cumulativeFlags & (XFillPosition | AmbiguousFillPosition)) {
+            cumulativeFlags |= YFillPosition;
+            individualFlag = YFillPosition;
+        } else
+            return 0;
         return primitiveValueCache()->createValue(valueList->current()->fValue,
-                                         (CSSPrimitiveValue::UnitTypes)valueList->current()->unit);
-
+                                                  (CSSPrimitiveValue::UnitTypes)valueList->current()->unit);
+    }
     return 0;
 }
 
@@ -2644,8 +2711,10 @@ void CSSParser::parseFillPosition(CSSParserValueList* valueList, RefPtr<CSSValue
     CSSParserValue* value = valueList->current();
 
     // Parse the first value.  We're just making sure that it is one of the valid keywords or a percentage/length.
-    bool value1IsX = false, value1IsY = false;
-    value1 = parseFillPositionXY(valueList, value1IsX, value1IsY);
+    unsigned cumulativeFlags = 0;
+    FillPositionFlag value1Flag = InvalidFillPosition;
+    FillPositionFlag value2Flag = InvalidFillPosition;
+    value1 = parseFillPositionComponent(valueList, cumulativeFlags, value1Flag);
     if (!value1)
         return;
 
@@ -2658,9 +2727,8 @@ void CSSParser::parseFillPosition(CSSParserValueList* valueList, RefPtr<CSSValue
     if (value && value->unit == CSSParserValue::Operator && value->iValue == ',')
         value = 0;
 
-    bool value2IsX = false, value2IsY = false;
     if (value) {
-        value2 = parseFillPositionXY(valueList, value2IsX, value2IsY);
+        value2 = parseFillPositionComponent(valueList, cumulativeFlags, value2Flag);
         if (value2)
             valueList->next();
         else {
@@ -2678,7 +2746,7 @@ void CSSParser::parseFillPosition(CSSParserValueList* valueList, RefPtr<CSSValue
         // For left/right/center, the default of 50% in the y is still correct.
         value2 = primitiveValueCache()->createValue(50, CSSPrimitiveValue::CSS_PERCENTAGE);
 
-    if (value1IsY || value2IsX)
+    if (value1Flag == YFillPosition || value2Flag == XFillPosition)
         value1.swap(value2);
 }
 
@@ -2856,16 +2924,14 @@ bool CSSParser::parseFillProperty(int propId, int& propId1, int& propId2,
                     break;
                 case CSSPropertyBackgroundPositionX:
                 case CSSPropertyWebkitMaskPositionX: {
-                    bool xFound = false, yFound = true;
-                    currValue = parseFillPositionXY(m_valueList, xFound, yFound);
+                    currValue = parseFillPositionX(m_valueList);
                     if (currValue)
                         m_valueList->next();
                     break;
                 }
                 case CSSPropertyBackgroundPositionY:
                 case CSSPropertyWebkitMaskPositionY: {
-                    bool xFound = true, yFound = false;
-                    currValue = parseFillPositionXY(m_valueList, xFound, yFound);
+                    currValue = parseFillPositionY(m_valueList);
                     if (currValue)
                         m_valueList->next();
                     break;
@@ -3940,10 +4006,76 @@ bool CSSParser::parseFontFaceUnicodeRange()
     return true;
 }
 
-static inline bool parseColorInt(const UChar*& string, const UChar* end, UChar terminator, int& value)
+// Returns the number of characters which form a valid double
+// and are terminated by the given terminator character
+static int checkForValidDouble(const UChar* string, const UChar* end, const char terminator)
+{
+    int length = end - string;
+    if (length < 1)
+        return 0;
+
+    bool decimalMarkSeen = false;
+    int processedLength = 0;
+
+    for (int i = 0; i < length; ++i) {
+        if (string[i] == terminator) {
+            processedLength = i;
+            break;
+        }
+        if (!isASCIIDigit(string[i])) {
+            if (!decimalMarkSeen && string[i] == '.')
+                decimalMarkSeen = true;
+            else
+                return 0;
+        }
+    }
+
+    if (decimalMarkSeen && processedLength == 1)
+        return 0;
+
+    return processedLength;
+}
+
+// Returns the number of characters consumed for parsing a valid double
+// terminated by the given terminator character
+static int parseDouble(const UChar* string, const UChar* end, const char terminator, double& value)
+{
+    int length = checkForValidDouble(string, end, terminator);
+    if (!length)
+        return 0;
+
+    int position = 0;
+    double localValue = 0;
+
+    // The consumed characters here are guaranteed to be
+    // ASCII digits with or without a decimal mark
+    for (; position < length; ++position) {
+        if (string[position] == '.')
+            break;
+        localValue = localValue * 10 + string[position] - '0';
+    }
+
+    if (++position == length) {
+        value = localValue;
+        return length;
+    }
+
+    double fraction = 0;
+    double scale = 1;
+
+    while (position < length && scale < MAX_SCALE) {
+        fraction = fraction * 10 + string[position++] - '0';
+        scale *= 10;
+    }
+
+    value = localValue + fraction / scale;
+    return length;
+}
+
+static bool parseColorIntOrPercentage(const UChar*& string, const UChar* end, const char terminator, CSSPrimitiveValue::UnitTypes& expect, int& value)
 {
     const UChar* current = string;
-    int localValue = 0;
+    double localValue = 0;
     bool negative = false;
     while (current != end && isHTMLSpace(*current))
         current++;
@@ -3954,7 +4086,7 @@ static inline bool parseColorInt(const UChar*& string, const UChar* end, UChar t
     if (current == end || !isASCIIDigit(*current))
         return false;
     while (current != end && isASCIIDigit(*current)) {
-        int newValue = localValue * 10 + *current++ - '0';
+        double newValue = localValue * 10 + *current++ - '0';
         if (newValue >= 255) {
             // Clamp values at 255.
             localValue = 255;
@@ -3964,12 +4096,42 @@ static inline bool parseColorInt(const UChar*& string, const UChar* end, UChar t
         }
         localValue = newValue;
     }
+
+    if (expect == CSSPrimitiveValue::CSS_NUMBER && (*current == '.' || *current == '%'))
+        return false;
+
+    if (*current == '.') {
+        // We already parsed the integral part, try to parse
+        // the fraction part of the percentage value.
+        double percentage = 0;
+        int numCharactersParsed = parseDouble(current, end, '%', percentage);
+        if (!numCharactersParsed)
+            return false;
+        current += numCharactersParsed;
+        if (*current != '%')
+            return false;
+        localValue += percentage;
+    }
+
+    if (expect == CSSPrimitiveValue::CSS_PERCENTAGE && *current != '%')
+        return false;
+
+    if (*current == '%') {
+        expect = CSSPrimitiveValue::CSS_PERCENTAGE;
+        localValue = localValue / 100.0 * 256.0;
+        // Clamp values at 255 for percentages over 100%
+        if (localValue > 255)
+            localValue = 255;
+        current++;
+    } else
+        expect = CSSPrimitiveValue::CSS_NUMBER;
+
     while (current != end && isHTMLSpace(*current))
         current++;
     if (current == end || *current++ != terminator)
         return false;
     // Clamp negative values at zero.
-    value = negative ? 0 : localValue;
+    value = negative ? 0 : static_cast<int>(localValue);
     string = current;
     return true;
 }
@@ -3987,21 +4149,7 @@ static inline bool isTenthAlpha(const UChar* string, const int length)
     return false;
 }
 
-static inline bool isValidDouble(const UChar* string, const int length)
-{
-    bool decimalMarkSeen = false;
-    for (int i = 0; i < length; ++i) {
-        if (!isASCIIDigit(string[i])) {
-            if (!decimalMarkSeen && string[i] == '.')
-                decimalMarkSeen = true;
-            else
-                return false;
-        }
-    }
-    return true;
-}
-
-static inline bool parseAlphaValue(const UChar*& string, const UChar* end, UChar terminator, int& value)
+static inline bool parseAlphaValue(const UChar*& string, const UChar* end, const char terminator, int& value)
 {
     while (string != end && isHTMLSpace(*string))
         string++;
@@ -4023,7 +4171,7 @@ static inline bool parseAlphaValue(const UChar*& string, const UChar* end, UChar
         return false;
 
     if (string[0] != '0' && string[0] != '1' && string[0] != '.') {
-        if (isValidDouble(string, length - 1)) {
+        if (checkForValidDouble(string, end, terminator)) {
             value = negative ? 0 : 255;
             string = end;
             return true;
@@ -4044,20 +4192,12 @@ static inline bool parseAlphaValue(const UChar*& string, const UChar* end, UChar
         return true;
     }
 
-    if (!isValidDouble(string, length - 1))
-       return false;
-
-    Vector<char, 8> bytes(length + 1);
-
-    for (int i = 0; i < length; ++i)
-        bytes[i] = string[i];
-
-    bytes[length] = '\0';
-    char* foundTerminator;
-    double d = WTF::strtod(bytes.data(), &foundTerminator);
-    value = negative ? 0 : static_cast<int>(d * nextafter(256.0, 0.0));
-    string += (foundTerminator - bytes.data()) + 1;
-    return *foundTerminator == terminator;
+    double alpha = 0;
+    if (!parseDouble(string, end, terminator, alpha))
+        return false;
+    value = negative ? 0 : static_cast<int>(alpha * nextafter(256.0, 0.0));
+    string = end;
+    return true;
 }
 
 static inline bool mightBeRGBA(const UChar* characters, unsigned length)
@@ -4085,6 +4225,7 @@ bool CSSParser::parseColor(const String &name, RGBA32& rgb, bool strict)
 {
     const UChar* characters = name.characters();
     unsigned length = name.length();
+    CSSPrimitiveValue::UnitTypes expect = CSSPrimitiveValue::CSS_UNKNOWN;
 
     if (!strict && length >= 3) {
         if (name[0] == '#') {
@@ -4104,11 +4245,12 @@ bool CSSParser::parseColor(const String &name, RGBA32& rgb, bool strict)
         int green;
         int blue;
         int alpha;
-        if (!parseColorInt(current, end, ',', red))
+
+        if (!parseColorIntOrPercentage(current, end, ',', expect, red))
             return false;
-        if (!parseColorInt(current, end, ',', green))
+        if (!parseColorIntOrPercentage(current, end, ',', expect, green))
             return false;
-        if (!parseColorInt(current, end, ',', blue))
+        if (!parseColorIntOrPercentage(current, end, ',', expect, blue))
             return false;
         if (!parseAlphaValue(current, end, ')', alpha))
             return false;
@@ -4125,11 +4267,11 @@ bool CSSParser::parseColor(const String &name, RGBA32& rgb, bool strict)
         int red;
         int green;
         int blue;
-        if (!parseColorInt(current, end, ',', red))
+        if (!parseColorIntOrPercentage(current, end, ',', expect, red))
             return false;
-        if (!parseColorInt(current, end, ',', green))
+        if (!parseColorIntOrPercentage(current, end, ',', expect, green))
             return false;
-        if (!parseColorInt(current, end, ')', blue))
+        if (!parseColorIntOrPercentage(current, end, ')', expect, blue))
             return false;
         if (current != end)
             return false;
@@ -5544,15 +5686,13 @@ bool CSSParser::parseTransformOrigin(int propId, int& propId1, int& propId2, int
             // parseTransformOriginShorthand advances the m_valueList pointer
             break;
         case CSSPropertyWebkitTransformOriginX: {
-            bool xFound = false, yFound = true;
-            value = parseFillPositionXY(m_valueList, xFound, yFound);
+            value = parseFillPositionX(m_valueList);
             if (value)
                 m_valueList->next();
             break;
         }
         case CSSPropertyWebkitTransformOriginY: {
-            bool xFound = true, yFound = false;
-            value = parseFillPositionXY(m_valueList, xFound, yFound);
+            value = parseFillPositionY(m_valueList);
             if (value)
                 m_valueList->next();
             break;
@@ -5583,15 +5723,13 @@ bool CSSParser::parsePerspectiveOrigin(int propId, int& propId1, int& propId2, R
             parseFillPosition(m_valueList, value, value2);
             break;
         case CSSPropertyWebkitPerspectiveOriginX: {
-            bool xFound = false, yFound = true;
-            value = parseFillPositionXY(m_valueList, xFound, yFound);
+            value = parseFillPositionX(m_valueList);
             if (value)
                 m_valueList->next();
             break;
         }
         case CSSPropertyWebkitPerspectiveOriginY: {
-            bool xFound = true, yFound = false;
-            value = parseFillPositionXY(m_valueList, xFound, yFound);
+            value = parseFillPositionY(m_valueList);
             if (value)
                 m_valueList->next();
             break;
@@ -5658,6 +5796,46 @@ bool CSSParser::parseTextEmphasisStyle(bool important)
     return false;
 }
 
+bool CSSParser::parseLineBoxContain(bool important)
+{
+    LineBoxContain lineBoxContain = LineBoxContainNone;
+
+    for (CSSParserValue* value = m_valueList->current(); value; value = m_valueList->next()) {
+        if (value->id == CSSValueBlock) {
+            if (lineBoxContain & LineBoxContainBlock)
+                return false;
+            lineBoxContain |= LineBoxContainBlock;
+        } else if (value->id == CSSValueInline) {
+            if (lineBoxContain & LineBoxContainInline)
+                return false;
+            lineBoxContain |= LineBoxContainInline;
+        } else if (value->id == CSSValueFont) {
+            if (lineBoxContain & LineBoxContainFont)
+                return false;
+            lineBoxContain |= LineBoxContainFont;
+        } else if (value->id == CSSValueGlyphs) {
+            if (lineBoxContain & LineBoxContainGlyphs)
+                return false;
+            lineBoxContain |= LineBoxContainGlyphs;
+        } else if (value->id == CSSValueReplaced) {
+            if (lineBoxContain & LineBoxContainReplaced)
+                return false;
+            lineBoxContain |= LineBoxContainReplaced;
+        } else if (value->id == CSSValueInlineBox) {
+            if (lineBoxContain & LineBoxContainInlineBox)
+                return false;
+            lineBoxContain |= LineBoxContainInlineBox;
+        } else
+            return false;
+    }
+    
+    if (!lineBoxContain)
+        return false;
+
+    addProperty(CSSPropertyWebkitLineBoxContain, CSSLineBoxContainValue::create(lineBoxContain), important);
+    return true;
+}
+
 static inline int yyerror(const char*) { return 1; }
 
 #define END_TOKEN 0
@@ -5689,6 +5867,7 @@ int CSSParser::lex(void* yylvalWithoutType)
     case DIMEN:
     case UNICODERANGE:
     case FUNCTION:
+    case ANYFUNCTION:
     case NOTFUNCTION:
         yylval->string.characters = t;
         yylval->string.length = length;
@@ -5902,6 +6081,22 @@ PassOwnPtr<CSSParserSelector> CSSParser::sinkFloatingSelector(CSSParserSelector*
     return adoptPtr(selector);
 }
 
+Vector<OwnPtr<CSSParserSelector> >* CSSParser::createFloatingSelectorVector()
+{
+    Vector<OwnPtr<CSSParserSelector> >* selectorVector = new Vector<OwnPtr<CSSParserSelector> >;
+    m_floatingSelectorVectors.add(selectorVector);
+    return selectorVector;
+}
+
+Vector<OwnPtr<CSSParserSelector> >* CSSParser::sinkFloatingSelectorVector(Vector<OwnPtr<CSSParserSelector> >* selectorVector)
+{
+    if (selectorVector) {
+        ASSERT(m_floatingSelectorVectors.contains(selectorVector));
+        m_floatingSelectorVectors.remove(selectorVector);
+    }
+    return selectorVector;
+}
+
 CSSParserValueList* CSSParser::createFloatingValueList()
 {
     CSSParserValueList* list = new CSSParserValueList;
@@ -6485,11 +6680,8 @@ String quoteCSSString(const String& string)
             buffer[index++] = ch;
             afterEscape = false;
         } else if (ch < 0x20 || ch == 0x7F) { // Control characters.
-            static const char hexDigits[17] = "0123456789abcdef";
             buffer[index++] = '\\';
-            if (ch >= 0x10)
-                buffer[index++] = hexDigits[ch >> 4];
-            buffer[index++] = hexDigits[ch & 0xF];
+            placeByteAsHexCompressIfPossible(ch, buffer, index, Lowercase);
             afterEscape = true;
         } else {
             // Space character may be required to separate backslash-escape sequence and normal characters.
diff --git a/Source/WebCore/css/CSSParser.h b/Source/WebCore/css/CSSParser.h
index 230e699..c03afd9 100644
--- a/Source/WebCore/css/CSSParser.h
+++ b/Source/WebCore/css/CSSParser.h
@@ -89,8 +89,13 @@ namespace WebCore {
         PassRefPtr<CSSValue> parseBackgroundColor();
 
         bool parseFillImage(RefPtr<CSSValue>&);
-        PassRefPtr<CSSValue> parseFillPositionXY(CSSParserValueList*, bool& xFound, bool& yFound);
+
+        enum FillPositionFlag { InvalidFillPosition = 0, AmbiguousFillPosition = 1, XFillPosition = 2, YFillPosition = 4 };
+        PassRefPtr<CSSValue> parseFillPositionComponent(CSSParserValueList*, unsigned& cumulativeFlags, FillPositionFlag& individualFlag);
+        PassRefPtr<CSSValue> parseFillPositionX(CSSParserValueList*);
+        PassRefPtr<CSSValue> parseFillPositionY(CSSParserValueList*);
         void parseFillPosition(CSSParserValueList*, RefPtr<CSSValue>&, RefPtr<CSSValue>&);
+        
         void parseFillRepeat(RefPtr<CSSValue>&, RefPtr<CSSValue>&);
         PassRefPtr<CSSValue> parseFillSize(int propId, bool &allowComma);
 
@@ -173,11 +178,16 @@ namespace WebCore {
 
         bool parseTextEmphasisStyle(bool important);
 
+        bool parseLineBoxContain(bool important);
+
         int yyparse();
 
         CSSParserSelector* createFloatingSelector();
         PassOwnPtr<CSSParserSelector> sinkFloatingSelector(CSSParserSelector*);
 
+        Vector<OwnPtr<CSSParserSelector> >* createFloatingSelectorVector();
+        Vector<OwnPtr<CSSParserSelector> >* sinkFloatingSelectorVector(Vector<OwnPtr<CSSParserSelector> >*);
+
         CSSParserValueList* createFloatingValueList();
         CSSParserValueList* sinkFloatingValueList(CSSParserValueList*);
 
@@ -311,6 +321,7 @@ namespace WebCore {
         Vector<RefPtr<StyleBase> > m_parsedStyleObjects;
         Vector<RefPtr<CSSRuleList> > m_parsedRuleLists;
         HashSet<CSSParserSelector*> m_floatingSelectors;
+        HashSet<Vector<OwnPtr<CSSParserSelector> >*> m_floatingSelectorVectors;
         HashSet<CSSParserValueList*> m_floatingValueLists;
         HashSet<CSSParserFunction*> m_floatingFunctions;
 
diff --git a/Source/WebCore/css/CSSParserValues.cpp b/Source/WebCore/css/CSSParserValues.cpp
index dc0e82b..94dcd3c 100644
--- a/Source/WebCore/css/CSSParserValues.cpp
+++ b/Source/WebCore/css/CSSParserValues.cpp
@@ -25,6 +25,7 @@
 #include "CSSFunctionValue.h"
 #include "CSSQuirkPrimitiveValue.h"
 #include "CSSSelector.h"
+#include "CSSSelectorList.h"
 
 namespace WebCore {
         
@@ -43,12 +44,23 @@ void CSSParserValueList::addValue(const CSSParserValue& v)
 {
     m_values.append(v);
 }
-    
+
+void CSSParserValueList::insertValueAt(unsigned i, const CSSParserValue& v)
+{
+    m_values.insert(i, v);
+}
+
 void CSSParserValueList::deleteValueAt(unsigned i)
 { 
     m_values.remove(i);
 }
 
+void CSSParserValueList::extend(CSSParserValueList& valueList)
+{
+    for (unsigned int i = 0; i < valueList.size(); ++i)
+        m_values.append(*(valueList.valueAt(i)));
+}
+
 PassRefPtr<CSSValue> CSSParserValue::createCSSValue()
 {
     RefPtr<CSSValue> parsedValue;
@@ -96,5 +108,11 @@ CSSParserSelector::~CSSParserSelector()
     deleteAllValues(toDelete);
 }
 
+void CSSParserSelector::adoptSelectorVector(Vector<OwnPtr<CSSParserSelector> >& selectorVector)
+{
+    CSSSelectorList* selectorList = fastNew<CSSSelectorList>();
+    selectorList->adoptSelectorVector(selectorVector);
+    m_selector->setSelectorList(adoptPtr(selectorList));
+}
 }
 
diff --git a/Source/WebCore/css/CSSParserValues.h b/Source/WebCore/css/CSSParserValues.h
index d084091..81ecbc3 100644
--- a/Source/WebCore/css/CSSParserValues.h
+++ b/Source/WebCore/css/CSSParserValues.h
@@ -71,7 +71,9 @@ public:
     ~CSSParserValueList();
     
     void addValue(const CSSParserValue&);
+    void insertValueAt(unsigned, const CSSParserValue&);
     void deleteValueAt(unsigned);
+    void extend(CSSParserValueList&);
 
     unsigned size() const { return m_values.size(); }
     CSSParserValue* current() { return m_current < m_values.size() ? &m_values[m_current] : 0; }
@@ -105,11 +107,12 @@ public:
     void setValue(const AtomicString& value) { m_selector->setValue(value); }
     void setAttribute(const QualifiedName& value) { m_selector->setAttribute(value); }
     void setArgument(const AtomicString& value) { m_selector->setArgument(value); }
-    void setSimpleSelector(PassOwnPtr<CSSSelector> value) { m_selector->setSimpleSelector(value); }
     void setMatch(CSSSelector::Match value) { m_selector->m_match = value; }
     void setRelation(CSSSelector::Relation value) { m_selector->m_relation = value; }
     void setForPage() { m_selector->setForPage(); }
-    
+
+    void adoptSelectorVector(Vector<OwnPtr<CSSParserSelector> >& selectorVector);
+
     CSSSelector::PseudoType pseudoType() const { return m_selector->pseudoType(); }
     bool isUnknownPseudoElement() const { return m_selector->isUnknownPseudoElement(); }
     bool isSimple() const { return !m_tagHistory && m_selector->isSimple(); }
diff --git a/Source/WebCore/css/CSSPrimitiveValueCache.cpp b/Source/WebCore/css/CSSPrimitiveValueCache.cpp
index 6b3eebe..5c7a4c0 100644
--- a/Source/WebCore/css/CSSPrimitiveValueCache.cpp
+++ b/Source/WebCore/css/CSSPrimitiveValueCache.cpp
@@ -23,7 +23,7 @@
  * THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#include <config.h>
+#include "config.h"
 #include "CSSPrimitiveValueCache.h"
 
 namespace WebCore {
diff --git a/Source/WebCore/css/CSSPrimitiveValueMappings.h b/Source/WebCore/css/CSSPrimitiveValueMappings.h
index fb4aff3..16412ad 100644
--- a/Source/WebCore/css/CSSPrimitiveValueMappings.h
+++ b/Source/WebCore/css/CSSPrimitiveValueMappings.h
@@ -39,6 +39,7 @@
 #include "RenderStyleConstants.h"
 #include "SVGRenderStyleDefs.h"
 #include "TextDirection.h"
+#include "TextOrientation.h"
 #include "TextRenderingMode.h"
 #include "ThemeTypes.h"
 
@@ -1616,30 +1617,36 @@ template<> inline CSSPrimitiveValue::CSSPrimitiveValue(ETextAlign e)
     , m_hasCachedCSSText(false)
 {
     switch (e) {
-        case TAAUTO:
-            m_value.ident = CSSValueWebkitAuto;
-            break;
-        case LEFT:
-            m_value.ident = CSSValueLeft;
-            break;
-        case RIGHT:
-            m_value.ident = CSSValueRight;
-            break;
-        case CENTER:
-            m_value.ident = CSSValueCenter;
-            break;
-        case JUSTIFY:
-            m_value.ident = CSSValueJustify;
-            break;
-        case WEBKIT_LEFT:
-            m_value.ident = CSSValueWebkitLeft;
-            break;
-        case WEBKIT_RIGHT:
-            m_value.ident = CSSValueWebkitRight;
-            break;
-        case WEBKIT_CENTER:
-            m_value.ident = CSSValueWebkitCenter;
-            break;
+    case TAAUTO:
+        m_value.ident = CSSValueWebkitAuto;
+        break;
+    case TASTART:
+        m_value.ident = CSSValueStart;
+        break;
+    case TAEND:
+        m_value.ident = CSSValueEnd;
+        break;
+    case LEFT:
+        m_value.ident = CSSValueLeft;
+        break;
+    case RIGHT:
+        m_value.ident = CSSValueRight;
+        break;
+    case CENTER:
+        m_value.ident = CSSValueCenter;
+        break;
+    case JUSTIFY:
+        m_value.ident = CSSValueJustify;
+        break;
+    case WEBKIT_LEFT:
+        m_value.ident = CSSValueWebkitLeft;
+        break;
+    case WEBKIT_RIGHT:
+        m_value.ident = CSSValueWebkitRight;
+        break;
+    case WEBKIT_CENTER:
+        m_value.ident = CSSValueWebkitCenter;
+        break;
     }
 }
 
@@ -1647,9 +1654,9 @@ template<> inline CSSPrimitiveValue::operator ETextAlign() const
 {
     switch (m_value.ident) {
         case CSSValueStart:
+            return TASTART;
         case CSSValueEnd:
-            ASSERT_NOT_REACHED(); // Depends on direction, thus should be handled by the caller.
-            return LEFT;
+            return TAEND;
         default:
             return static_cast<ETextAlign>(m_value.ident - CSSValueWebkitAuto);
     }
@@ -1734,30 +1741,34 @@ template<> inline CSSPrimitiveValue::CSSPrimitiveValue(EUnicodeBidi e)
     , m_hasCachedCSSText(false)
 {
     switch (e) {
-        case UBNormal:
-            m_value.ident = CSSValueNormal;
-            break;
-        case Embed:
-            m_value.ident = CSSValueEmbed;
-            break;
-        case Override:
-            m_value.ident = CSSValueBidiOverride;
-            break;
+    case UBNormal:
+        m_value.ident = CSSValueNormal;
+        break;
+    case Embed:
+        m_value.ident = CSSValueEmbed;
+        break;
+    case Override:
+        m_value.ident = CSSValueBidiOverride;
+        break;
+    case Isolate:
+        m_value.ident = CSSValueWebkitIsolate;
     }
 }
 
 template<> inline CSSPrimitiveValue::operator EUnicodeBidi() const
 {
     switch (m_value.ident) {
-        case CSSValueNormal:
-            return UBNormal; 
-        case CSSValueEmbed:
-            return Embed; 
-        case CSSValueBidiOverride:
-            return Override;
-        default:
-            ASSERT_NOT_REACHED();
-            return UBNormal;
+    case CSSValueNormal:
+        return UBNormal;
+    case CSSValueEmbed:
+        return Embed;
+    case CSSValueBidiOverride:
+        return Override;
+    case CSSValueWebkitIsolate:
+        return Isolate;
+    default:
+        ASSERT_NOT_REACHED();
+        return UBNormal;
     }
 }
 
@@ -2177,6 +2188,33 @@ template<> inline CSSPrimitiveValue::operator TextEmphasisMark() const
     }
 }
 
+template<> inline CSSPrimitiveValue::CSSPrimitiveValue(TextOrientation e)
+    : m_type(CSS_IDENT)
+    , m_hasCachedCSSText(false)
+{
+    switch (e) {
+    case TextOrientationVerticalRight:
+        m_value.ident = CSSValueVerticalRight;
+        break;
+    case TextOrientationUpright:
+        m_value.ident = CSSValueUpright;
+        break;
+    }
+}
+
+template<> inline CSSPrimitiveValue::operator TextOrientation() const
+{
+    switch (m_value.ident) {
+    case CSSValueVerticalRight:
+        return TextOrientationVerticalRight;
+    case CSSValueUpright:
+        return TextOrientationUpright;
+    default:
+        ASSERT_NOT_REACHED();
+        return TextOrientationVerticalRight;
+    }
+}
+
 template<> inline CSSPrimitiveValue::CSSPrimitiveValue(EPointerEvents e)
     : m_type(CSS_IDENT)
     , m_hasCachedCSSText(false)
diff --git a/Source/WebCore/css/CSSPropertyNames.in b/Source/WebCore/css/CSSPropertyNames.in
index d1fdcd3..a62d2f3 100644
--- a/Source/WebCore/css/CSSPropertyNames.in
+++ b/Source/WebCore/css/CSSPropertyNames.in
@@ -21,6 +21,7 @@ font-variant
 font-weight
 text-rendering
 -webkit-font-smoothing
+-webkit-text-orientation
 -webkit-text-size-adjust
 -webkit-writing-mode
 zoom
@@ -230,6 +231,7 @@ z-index
 -webkit-hyphenate-limit-after
 -webkit-hyphenate-limit-before
 -webkit-hyphens
+-webkit-line-box-contain
 -webkit-line-break
 -webkit-line-clamp
 -webkit-locale
diff --git a/Source/WebCore/css/CSSRuleList.h b/Source/WebCore/css/CSSRuleList.h
index a355c4a..87996a9 100644
--- a/Source/WebCore/css/CSSRuleList.h
+++ b/Source/WebCore/css/CSSRuleList.h
@@ -53,6 +53,11 @@ public:
     void deleteRule(unsigned index);
     void append(CSSRule*);
 
+    StyleList* styleList()
+    {
+        return m_list.get();
+    }
+
 private:
     CSSRuleList();
     CSSRuleList(StyleList*, bool omitCharsetRules);
diff --git a/Source/WebCore/css/CSSSelector.cpp b/Source/WebCore/css/CSSSelector.cpp
index c804697..a87d4f3 100644
--- a/Source/WebCore/css/CSSSelector.cpp
+++ b/Source/WebCore/css/CSSSelector.cpp
@@ -27,6 +27,7 @@
 #include "CSSSelector.h"
 
 #include "CSSOMUtils.h"
+#include "CSSSelectorList.h"
 #include "HTMLNames.h"
 #include <wtf/Assertions.h>
 #include <wtf/HashMap.h>
@@ -78,9 +79,12 @@ inline unsigned CSSSelector::specificityForOneSelector() const
     case Contain:
     case Begin:
     case End:
-        if (pseudoType() == PseudoNot && simpleSelector())
-            s += simpleSelector()->specificityForOneSelector();
-        else
+        // FIXME: PsuedoAny should base the specificity on the sub-selectors.
+        // See http://lists.w3.org/Archives/Public/www-style/2010Sep/0530.html
+        if (pseudoType() == PseudoNot) {
+            ASSERT(selectorList());
+            s += selectorList()->first()->specificityForOneSelector();
+        } else
             s += 0x100;
     case None:
         break;
@@ -211,6 +215,7 @@ PseudoId CSSSelector::pseudoId(PseudoType type)
     case PseudoNthLastOfType:
     case PseudoLink:
     case PseudoVisited:
+    case PseudoAny:
     case PseudoAnyLink:
     case PseudoAutofill:
     case PseudoHover:
@@ -265,6 +270,7 @@ static HashMap<AtomicStringImpl*, CSSSelector::PseudoType>* nameToPseudoTypeMap(
 {
     DEFINE_STATIC_LOCAL(AtomicString, active, ("active"));
     DEFINE_STATIC_LOCAL(AtomicString, after, ("after"));
+    DEFINE_STATIC_LOCAL(AtomicString, any, ("-webkit-any("));
     DEFINE_STATIC_LOCAL(AtomicString, anyLink, ("-webkit-any-link"));
     DEFINE_STATIC_LOCAL(AtomicString, autofill, ("-webkit-autofill"));
     DEFINE_STATIC_LOCAL(AtomicString, before, ("before"));
@@ -364,6 +370,7 @@ static HashMap<AtomicStringImpl*, CSSSelector::PseudoType>* nameToPseudoTypeMap(
         nameToPseudoType->set(active.impl(), CSSSelector::PseudoActive);
         nameToPseudoType->set(after.impl(), CSSSelector::PseudoAfter);
         nameToPseudoType->set(anyLink.impl(), CSSSelector::PseudoAnyLink);
+        nameToPseudoType->set(any.impl(), CSSSelector::PseudoAny);
         nameToPseudoType->set(autofill.impl(), CSSSelector::PseudoAutofill);
         nameToPseudoType->set(before.impl(), CSSSelector::PseudoBefore);
         nameToPseudoType->set(checked.impl(), CSSSelector::PseudoChecked);
@@ -527,6 +534,7 @@ void CSSSelector::extractPseudoType() const
     case PseudoNthLastOfType:
     case PseudoLink:
     case PseudoVisited:
+    case PseudoAny:
     case PseudoAnyLink:
     case PseudoAutofill:
     case PseudoHover:
@@ -638,17 +646,33 @@ String CSSSelector::selectorText() const
         } else if (cs->m_match == CSSSelector::PseudoClass || cs->m_match == CSSSelector::PagePseudoClass) {
             str += ":";
             str += cs->value();
-            if (cs->pseudoType() == PseudoNot) {
-                if (CSSSelector* subSel = cs->simpleSelector())
-                    str += subSel->selectorText();
+
+            switch (cs->pseudoType()) {
+            case PseudoNot:
+                ASSERT(cs->selectorList());
+                str += cs->selectorList()->first()->selectorText();
                 str += ")";
-            } else if (cs->pseudoType() == PseudoLang
-                    || cs->pseudoType() == PseudoNthChild
-                    || cs->pseudoType() == PseudoNthLastChild
-                    || cs->pseudoType() == PseudoNthOfType
-                    || cs->pseudoType() == PseudoNthLastOfType) {
+                break;
+            case PseudoLang:
+            case PseudoNthChild:
+            case PseudoNthLastChild:
+            case PseudoNthOfType:
+            case PseudoNthLastOfType:
                 str += cs->argument();
                 str += ")";
+                break;
+            case PseudoAny: {
+                CSSSelector* firstSubSelector = cs->selectorList()->first();
+                for (CSSSelector* subSelector = firstSubSelector; subSelector; subSelector = CSSSelectorList::next(subSelector)) {
+                    if (subSelector != firstSubSelector)
+                        str += ",";
+                    str += subSelector->selectorText();
+                }
+                str += ")";
+                break;
+            }
+            default:
+                break;
             }
         } else if (cs->m_match == CSSSelector::PseudoElement) {
             str += "::";
@@ -736,11 +760,11 @@ void CSSSelector::setArgument(const AtomicString& value)
     createRareData(); 
     m_data.m_rareData->m_argument = value; 
 }
-
-void CSSSelector::setSimpleSelector(PassOwnPtr<CSSSelector> value)
+    
+void CSSSelector::setSelectorList(PassOwnPtr<CSSSelectorList> selectorList)
 {
     createRareData(); 
-    m_data.m_rareData->m_simpleSelector = value; 
+    m_data.m_rareData->m_selectorList = selectorList;
 }
 
 bool CSSSelector::parseNth()
@@ -761,7 +785,7 @@ bool CSSSelector::matchNth(int count)
 
 bool CSSSelector::isSimple() const
 {
-    if (simpleSelector() || tagHistory() || matchesPseudoElement())
+    if (selectorList() || tagHistory() || matchesPseudoElement())
         return false;
 
     int numConditions = 0;
@@ -784,6 +808,21 @@ bool CSSSelector::isSimple() const
     return numConditions <= 1;
 }
 
+CSSSelector::RareData::RareData(PassRefPtr<AtomicStringImpl> value)
+    : m_value(value.leakRef())
+    , m_a(0)
+    , m_b(0)
+    , m_attribute(anyQName())
+    , m_argument(nullAtom)
+{
+}
+
+CSSSelector::RareData::~RareData()
+{
+    if (m_value)
+        m_value->deref();
+}
+    
 // a helper function for parsing nth-arguments
 bool CSSSelector::RareData::parseNth()
 {
diff --git a/Source/WebCore/css/CSSSelector.h b/Source/WebCore/css/CSSSelector.h
index c04c27b..fdadafa 100644
--- a/Source/WebCore/css/CSSSelector.h
+++ b/Source/WebCore/css/CSSSelector.h
@@ -29,6 +29,7 @@
 #include <wtf/PassOwnPtr.h>
 
 namespace WebCore {
+    class CSSSelectorList;
 
     // this class represents a selector for a StyleRule
     class CSSSelector {
@@ -129,6 +130,7 @@ namespace WebCore {
             PseudoNthLastOfType,
             PseudoLink,
             PseudoVisited,
+            PseudoAny,
             PseudoAnyLink,
             PseudoAutofill,
             PseudoHover,
@@ -247,13 +249,13 @@ namespace WebCore {
         const AtomicString& value() const { return *reinterpret_cast<const AtomicString*>(m_hasRareData ? &m_data.m_rareData->m_value : &m_data.m_value); }
         const QualifiedName& attribute() const;
         const AtomicString& argument() const { return m_hasRareData ? m_data.m_rareData->m_argument : nullAtom; }
-        CSSSelector* simpleSelector() const { return m_hasRareData ? m_data.m_rareData->m_simpleSelector.get() : 0; }
+        CSSSelectorList* selectorList() const { return m_hasRareData ? m_data.m_rareData->m_selectorList.get() : 0; }
         
         void setTag(const QualifiedName& value) { m_tag = value; }
         void setValue(const AtomicString&);
         void setAttribute(const QualifiedName&);
         void setArgument(const AtomicString&);
-        void setSimpleSelector(PassOwnPtr<CSSSelector>);
+        void setSelectorList(PassOwnPtr<CSSSelectorList>);
         
         bool parseNth();
         bool matchNth(int count);
@@ -284,7 +286,7 @@ namespace WebCore {
         bool m_isLastInTagHistory     : 1;
         bool m_hasRareData            : 1;
         bool m_isForPage              : 1;
-        // FIXME: Remove once http://webkit.org/b/53045 is fixed.
+        // FIXME: Remove once http://webkit.org/b/56124 is fixed.
         bool m_deleted                : 1;
 
         unsigned specificityForOneSelector() const;
@@ -294,19 +296,8 @@ namespace WebCore {
         struct RareData {
             WTF_MAKE_NONCOPYABLE(RareData); WTF_MAKE_FAST_ALLOCATED;
         public:
-            RareData(PassRefPtr<AtomicStringImpl> value)
-                : m_value(value.leakRef())
-                , m_a(0)
-                , m_b(0)
-                , m_attribute(anyQName())
-                , m_argument(nullAtom)
-            {
-            }
-            ~RareData()
-            {
-                if (m_value)
-                    m_value->deref();
-            }
+            RareData(PassRefPtr<AtomicStringImpl> value);
+            ~RareData();
 
             bool parseNth();
             bool matchNth(int count);
@@ -314,9 +305,9 @@ namespace WebCore {
             AtomicStringImpl* m_value; // Plain pointer to keep things uniform with the union.
             int m_a; // Used for :nth-*
             int m_b; // Used for :nth-*
-            OwnPtr<CSSSelector> m_simpleSelector; // Used for :not.
             QualifiedName m_attribute; // used for attribute selector
             AtomicString m_argument; // Used for :contains, :lang and :nth-*
+            OwnPtr<CSSSelectorList> m_selectorList; // Used for :-webkit-any and :not
         };
         void createRareData();
         
diff --git a/Source/WebCore/css/CSSSelectorList.cpp b/Source/WebCore/css/CSSSelectorList.cpp
index 6f307ee..c0ffdd5 100644
--- a/Source/WebCore/css/CSSSelectorList.cpp
+++ b/Source/WebCore/css/CSSSelectorList.cpp
@@ -87,7 +87,7 @@ void CSSSelectorList::deleteSelectors()
     if (!m_selectorArray)
         return;
 
-    // FIXME: Remove once http://webkit.org/b/53045 is fixed.
+    // FIXME: Remove once http://webkit.org/b/56124 is fixed.
     if (m_selectorArray == freedSelectorArrayMarker)
         CRASH();
 
@@ -122,9 +122,11 @@ static bool forEachTagSelector(Functor& functor, CSSSelector* selector)
     do {
         if (functor(selector))
             return true;
-        if (CSSSelector* simpleSelector = selector->simpleSelector()) {
-            if (forEachTagSelector(functor, simpleSelector))
-                return true;
+        if (CSSSelectorList* selectorList = selector->selectorList()) {
+            for (CSSSelector* subSelector = selectorList->first(); subSelector; subSelector = CSSSelectorList::next(subSelector)) {
+                if (forEachTagSelector(functor, subSelector))
+                    return true;
+            }
         }
     } while ((selector = selector->tagHistory()));
 
diff --git a/Source/WebCore/css/CSSStyleApplyProperty.cpp b/Source/WebCore/css/CSSStyleApplyProperty.cpp
new file mode 100644
index 0000000..e075615
--- /dev/null
+++ b/Source/WebCore/css/CSSStyleApplyProperty.cpp
@@ -0,0 +1,163 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "CSSStyleApplyProperty.h"
+
+#include "CSSPrimitiveValueMappings.h"
+#include "CSSStyleSelector.h"
+#include "RenderStyle.h"
+#include <wtf/StdLibExtras.h>
+#include <wtf/UnusedParam.h>
+
+using namespace std;
+
+namespace WebCore {
+
+class ApplyPropertyNull : public ApplyPropertyBase {
+public:
+    virtual void inherit(CSSStyleSelector*) const {}
+    virtual void initial(CSSStyleSelector*) const {}
+    virtual void value(CSSStyleSelector*, CSSValue*) const {}
+};
+
+template <typename T>
+class ApplyPropertyDefault : public ApplyPropertyBase {
+public:
+    ApplyPropertyDefault(T (RenderStyle::*getter)() const, void (RenderStyle::*setter)(T), T (*initial)())
+        : m_getter(getter)
+        , m_setter(setter)
+        , m_initial(initial)
+    {
+    }
+
+    virtual void inherit(CSSStyleSelector* selector) const
+    {
+        (selector->style()->*m_setter)((selector->parentStyle()->*m_getter)());
+    }
+
+    virtual void initial(CSSStyleSelector* selector) const
+    {
+        (selector->style()->*m_setter)((*m_initial)());
+    }
+
+    virtual void value(CSSStyleSelector* selector, CSSValue* value) const
+    {
+        if (value->isPrimitiveValue())
+            (selector->style()->*m_setter)(*(static_cast<CSSPrimitiveValue*>(value)));
+    }
+
+protected:
+    T (RenderStyle::*m_getter)() const;
+    void (RenderStyle::*m_setter)(T);
+    T (*m_initial)();
+};
+
+// CSSPropertyColor
+class ApplyPropertyColorBase : public ApplyPropertyBase {
+public:
+    ApplyPropertyColorBase(const Color& (RenderStyle::*getter)() const, const Color& (RenderStyle::*defaultValue)() const, void (RenderStyle::*setter)(const Color&))
+        : m_getter(getter)
+        , m_defaultValue(defaultValue)
+        , m_setter(setter)
+    {
+    }
+    virtual void inherit(CSSStyleSelector* selector) const
+    {
+        const Color& color = (selector->parentStyle()->*m_getter)();
+        if (m_defaultValue && !color.isValid())
+            (selector->style()->*m_setter)((selector->parentStyle()->*m_defaultValue)());
+        else
+            (selector->style()->*m_setter)(color);
+    }
+    virtual void initial(CSSStyleSelector* selector) const
+    {
+        Color color;
+        (selector->style()->*m_setter)(color);
+    }
+    virtual void value(CSSStyleSelector* selector, CSSValue* value) const
+    {
+        if (value->isPrimitiveValue())
+            (selector->style()->*m_setter)(selector->getColorFromPrimitiveValue(static_cast<CSSPrimitiveValue*>(value)));
+    }
+protected:
+    const Color& (RenderStyle::*m_getter)() const;
+    const Color& (RenderStyle::*m_defaultValue)() const;
+    void (RenderStyle::*m_setter)(const Color&);
+};
+
+class ApplyPropertyColor : public ApplyPropertyColorBase {
+public:
+    ApplyPropertyColor(const Color& (RenderStyle::*getter)() const, void (RenderStyle::*setter)(const Color&), Color (*initialValue)())
+        : ApplyPropertyColorBase(getter, 0, setter)
+        , m_initialValue(initialValue)
+    {
+    }
+
+    virtual void initial(CSSStyleSelector* selector) const
+    {
+        (selector->style()->*m_setter)(m_initialValue());
+    }
+
+    virtual void value(CSSStyleSelector* selector, CSSValue* value) const
+    {
+        if (!value->isPrimitiveValue())
+            return;
+
+        if ((static_cast<CSSPrimitiveValue*>(value))->getIdent() == CSSValueCurrentcolor)
+            inherit(selector);
+        else
+            ApplyPropertyColorBase::value(selector, value);
+    }
+protected:
+    Color (*m_initialValue)();
+};
+
+const CSSStyleApplyProperty& CSSStyleApplyProperty::sharedCSSStyleApplyProperty()
+{
+    DEFINE_STATIC_LOCAL(CSSStyleApplyProperty, cssStyleApplyPropertyInstance, ());
+    return cssStyleApplyPropertyInstance;
+}
+
+
+CSSStyleApplyProperty::CSSStyleApplyProperty()
+{
+    for (int i = 0; i < numCSSProperties; ++i)
+       m_propertyMap[i] = 0;
+
+    setPropertyValue(CSSPropertyColor, new ApplyPropertyColor(&RenderStyle::color, &RenderStyle::setColor, RenderStyle::initialColor));
+    setPropertyValue(CSSPropertyBackgroundColor, new ApplyPropertyColorBase(&RenderStyle::backgroundColor, 0, &RenderStyle::setBackgroundColor));
+    setPropertyValue(CSSPropertyBorderBottomColor, new ApplyPropertyColorBase(&RenderStyle::borderBottomColor, &RenderStyle::color, &RenderStyle::setBorderBottomColor));
+    setPropertyValue(CSSPropertyBorderLeftColor, new ApplyPropertyColorBase(&RenderStyle::borderLeftColor, &RenderStyle::color, &RenderStyle::setBorderLeftColor));
+    setPropertyValue(CSSPropertyBorderRightColor, new ApplyPropertyColorBase(&RenderStyle::borderRightColor, &RenderStyle::color, &RenderStyle::setBorderRightColor));
+    setPropertyValue(CSSPropertyBorderTopColor, new ApplyPropertyColorBase(&RenderStyle::borderTopColor, &RenderStyle::color, &RenderStyle::setBorderTopColor));
+    setPropertyValue(CSSPropertyOutlineColor, new ApplyPropertyColorBase(&RenderStyle::outlineColor, &RenderStyle::color, &RenderStyle::setOutlineColor));
+    setPropertyValue(CSSPropertyWebkitColumnRuleColor, new ApplyPropertyColorBase(&RenderStyle::columnRuleColor, &RenderStyle::color, &RenderStyle::setColumnRuleColor));
+    setPropertyValue(CSSPropertyWebkitTextEmphasisColor, new ApplyPropertyColorBase(&RenderStyle::textEmphasisColor, &RenderStyle::color, &RenderStyle::setTextEmphasisColor));
+    setPropertyValue(CSSPropertyWebkitTextFillColor, new ApplyPropertyColorBase(&RenderStyle::textFillColor, &RenderStyle::color, &RenderStyle::setTextFillColor));
+    setPropertyValue(CSSPropertyWebkitTextStrokeColor, new ApplyPropertyColorBase(&RenderStyle::textStrokeColor, &RenderStyle::color, &RenderStyle::setTextStrokeColor));
+}
+
+
+}
diff --git a/Source/WebCore/css/CSSStyleApplyProperty.h b/Source/WebCore/css/CSSStyleApplyProperty.h
new file mode 100644
index 0000000..48e08da
--- /dev/null
+++ b/Source/WebCore/css/CSSStyleApplyProperty.h
@@ -0,0 +1,104 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef CSSStyleApplyProperty_h
+#define CSSStyleApplyProperty_h
+
+#include "CSSPropertyNames.h"
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+
+namespace WebCore {
+
+class CSSStyleSelector;
+class CSSValue;
+class ApplyPropertyBase {
+    WTF_MAKE_NONCOPYABLE(ApplyPropertyBase);
+    WTF_MAKE_FAST_ALLOCATED;
+public:
+    ApplyPropertyBase() { }
+    virtual ~ApplyPropertyBase() { }
+    virtual void inherit(CSSStyleSelector*) const = 0;
+    virtual void initial(CSSStyleSelector*) const = 0;
+    virtual void value(CSSStyleSelector*, CSSValue*) const = 0;
+};
+
+class CSSStyleApplyProperty : public RefCounted<CSSStyleApplyProperty> {
+public:
+    static const CSSStyleApplyProperty& sharedCSSStyleApplyProperty();
+
+    void inherit(CSSPropertyID property, CSSStyleSelector* selector) const
+    {
+        ASSERT(implements(property));
+        propertyValue(property)->inherit(selector);
+    }
+
+    void initial(CSSPropertyID property, CSSStyleSelector* selector) const
+    {
+        ASSERT(implements(property));
+        propertyValue(property)->initial(selector);
+    }
+
+    void value(CSSPropertyID property, CSSStyleSelector* selector, CSSValue* value) const
+    {
+        ASSERT(implements(property));
+        propertyValue(property)->value(selector, value);
+    }
+
+    bool implements(CSSPropertyID property) const
+    {
+        return propertyValue(property);
+    }
+
+private:
+    CSSStyleApplyProperty();
+    static int index(CSSPropertyID property)
+    {
+        return property - firstCSSProperty;
+    }
+
+    static bool valid(CSSPropertyID property)
+    {
+        int i = index(property);
+        return i >= 0 && i < numCSSProperties;
+    }
+
+    void setPropertyValue(CSSPropertyID property, ApplyPropertyBase* value)
+    {
+        ASSERT(valid(property));
+        m_propertyMap[index(property)] = value;
+    }
+
+    ApplyPropertyBase* propertyValue(CSSPropertyID property) const
+    {
+        ASSERT(valid(property));
+        return m_propertyMap[index(property)];
+    }
+
+    ApplyPropertyBase* m_propertyMap[numCSSProperties];
+};
+
+}
+
+#endif // CSSStyleApplyProperty_h
diff --git a/Source/WebCore/css/CSSStyleSelector.cpp b/Source/WebCore/css/CSSStyleSelector.cpp
index bcf7756..d41e41b 100644
--- a/Source/WebCore/css/CSSStyleSelector.cpp
+++ b/Source/WebCore/css/CSSStyleSelector.cpp
@@ -35,6 +35,7 @@
 #include "CSSCursorImageValue.h"
 #include "CSSFontFaceRule.h"
 #include "CSSImportRule.h"
+#include "CSSLineBoxContainValue.h"
 #include "CSSMediaRule.h"
 #include "CSSPageRule.h"
 #include "CSSParser.h"
@@ -44,6 +45,7 @@
 #include "CSSRuleList.h"
 #include "CSSSelector.h"
 #include "CSSSelectorList.h"
+#include "CSSStyleApplyProperty.h"
 #include "CSSStyleRule.h"
 #include "CSSStyleSheet.h"
 #include "CSSTimingFunctionValue.h"
@@ -435,9 +437,6 @@ static RuleSet* siblingRulesInDefaultStyle;
 RenderStyle* CSSStyleSelector::s_styleNotYetAvailable;
 
 static void loadFullDefaultStyle();
-#if ENABLE(FULLSCREEN_API)
-static void loadFullScreenRulesIfNeeded(Document*);
-#endif
 static void loadSimpleDefaultStyle();
 // FIXME: It would be nice to use some mechanism that guarantees this is in sync with the real UA stylesheet.
 static const char* simpleUserAgentStyleSheet = "html,body,div{display:block}body{margin:8px}div:focus,span:focus{outline:auto 5px -webkit-focus-ring-color}a:-webkit-any-link{color:-webkit-link;text-decoration:underline}a:-webkit-any-link:active{color:-webkit-activelink}";
@@ -507,6 +506,7 @@ CSSStyleSelector::CSSStyleSelector(Document* document, StyleSheetList* styleShee
     , m_styledElement(0)
     , m_elementLinkState(NotInsideLink)
     , m_fontSelector(CSSFontSelector::create(document))
+    , m_applyProperty(CSSStyleApplyProperty::sharedCSSStyleApplyProperty())
 {
     m_matchAuthorAndUserStyles = matchAuthorAndUserStyles;
     
@@ -517,9 +517,6 @@ CSSStyleSelector::CSSStyleSelector(Document* document, StyleSheetList* styleShee
             loadSimpleDefaultStyle();
         else {
             loadFullDefaultStyle();
-#if ENABLE(FULLSCREEN_API)
-            loadFullScreenRulesIfNeeded(document);
-#endif
         }
     }
 
@@ -654,19 +651,6 @@ static void loadFullDefaultStyle()
     defaultQuirksStyle->addRulesFromSheet(quirksSheet, screenEval());
 }
 
-#if ENABLE(FULLSCREEN_API)
-static void loadFullScreenRulesIfNeeded(Document* document)
-{
-    if (!document->webkitIsFullScreen())
-        return;
-    // Full-screen rules.
-    String fullscreenRules = String(fullscreenUserAgentStyleSheet, sizeof(fullscreenUserAgentStyleSheet)) + RenderTheme::defaultTheme()->extraDefaultStyleSheet();
-    CSSStyleSheet* fullscreenSheet = parseUASheet(fullscreenRules);
-    defaultStyle->addRulesFromSheet(fullscreenSheet, screenEval());
-    defaultQuirksStyle->addRulesFromSheet(fullscreenSheet, screenEval());
-}
-#endif
-
 static void loadSimpleDefaultStyle()
 {
     ASSERT(!defaultStyle);
@@ -1131,8 +1115,8 @@ bool CSSStyleSelector::canShareStyleWithElement(Node* node) const
         return false;
 
     if (isControl) {
-        InputElement* thisInputElement = toInputElement(element);
-        InputElement* otherInputElement = toInputElement(m_element);
+        InputElement* thisInputElement = element->toInputElement();
+        InputElement* otherInputElement = m_element->toInputElement();
 
         if (!thisInputElement || !otherInputElement)
             return false;
@@ -1386,9 +1370,6 @@ PassRefPtr<RenderStyle> CSSStyleSelector::styleForElement(Element* e, RenderStyl
     
     if (simpleDefaultStyleSheet && !elementCanUseSimpleDefaultStyle(e)) {
         loadFullDefaultStyle();
-#if ENABLE(FULLSCREEN_API)
-        loadFullScreenRulesIfNeeded(e->document());
-#endif
         assertNoSiblingRulesInDefaultStyle();
     }
 
@@ -1441,6 +1422,17 @@ PassRefPtr<RenderStyle> CSSStyleSelector::styleForElement(Element* e, RenderStyl
     }
 #endif
 
+#if ENABLE(FULLSCREEN_API)
+    static bool loadedFullScreenStyleSheet;
+    if (!loadedFullScreenStyleSheet && e->document()->webkitIsFullScreen()) {
+        loadedFullScreenStyleSheet = true;
+        String fullscreenRules = String(fullscreenUserAgentStyleSheet, sizeof(fullscreenUserAgentStyleSheet)) + RenderTheme::defaultTheme()->extraFullScreenStyleSheet();
+        CSSStyleSheet* fullscreenSheet = parseUASheet(fullscreenRules);
+        defaultStyle->addRulesFromSheet(fullscreenSheet, screenEval());
+        defaultQuirksStyle->addRulesFromSheet(fullscreenSheet, screenEval());
+    }
+#endif
+
     int firstUARule = -1, lastUARule = -1;
     int firstUserRule = -1, lastUserRule = -1;
     int firstAuthorRule = -1, lastAuthorRule = -1;
@@ -1932,8 +1924,8 @@ void CSSStyleSelector::adjustRenderStyle(RenderStyle* style, RenderStyle* parent
         // After performing the display mutation, check table rows.  We do not honor position:relative on
         // table rows or cells.  This has been established in CSS2.1 (and caused a crash in containingBlock()
         // on some sites).
-        if ((style->display() == TABLE_HEADER_GROUP || style->display() == TABLE_ROW_GROUP ||
-             style->display() == TABLE_FOOTER_GROUP || style->display() == TABLE_ROW || style->display() == TABLE_CELL) &&
+        if ((style->display() == TABLE_HEADER_GROUP || style->display() == TABLE_ROW_GROUP
+             || style->display() == TABLE_FOOTER_GROUP || style->display() == TABLE_ROW) &&
              style->position() == RelativePosition)
             style->setPosition(StaticPosition);
 
@@ -1976,9 +1968,9 @@ void CSSStyleSelector::adjustRenderStyle(RenderStyle* style, RenderStyle* parent
     }
 
     // Finally update our text decorations in effect, but don't allow text-decoration to percolate through
-    // tables, inline blocks, inline tables, or run-ins.
+    // tables, inline blocks, inline tables, run-ins, or shadow DOM.
     if (style->display() == TABLE || style->display() == INLINE_TABLE || style->display() == RUN_IN
-        || style->display() == INLINE_BLOCK || style->display() == INLINE_BOX)
+        || style->display() == INLINE_BLOCK || style->display() == INLINE_BOX || (e && e->isShadowRoot()))
         style->setTextDecorationsInEffect(style->textDecoration());
     else
         style->addToTextDecorationsInEffect(style->textDecoration());
@@ -2267,7 +2259,7 @@ CSSStyleSelector::SelectorMatch CSSStyleSelector::SelectorChecker::checkSelector
 #endif
 
     // first selector has to match
-    if (!checkOneSelector(sel, e, selectorAttrs, dynamicPseudo, isSubSelector, elementStyle, elementParentStyle))
+    if (!checkOneSelector(sel, e, selectorAttrs, dynamicPseudo, isSubSelector, encounteredLink, elementStyle, elementParentStyle))
         return SelectorFailsLocally;
 
     // The rest of the selectors has to match
@@ -2437,7 +2429,7 @@ static bool htmlAttributeHasCaseInsensitiveValue(const QualifiedName& attr)
     return isPossibleHTMLAttr && htmlCaseInsensitiveAttributesSet->contains(attr.localName().impl());
 }
 
-bool CSSStyleSelector::SelectorChecker::checkOneSelector(CSSSelector* sel, Element* e, HashSet<AtomicStringImpl*>* selectorAttrs, PseudoId& dynamicPseudo, bool isSubSelector, RenderStyle* elementStyle, RenderStyle* elementParentStyle) const
+bool CSSStyleSelector::SelectorChecker::checkOneSelector(CSSSelector* sel, Element* e, HashSet<AtomicStringImpl*>* selectorAttrs, PseudoId& dynamicPseudo, bool isSubSelector, bool encounteredLink, RenderStyle* elementStyle, RenderStyle* elementParentStyle) const
 {
     ASSERT(e);
     if (!e)
@@ -2526,14 +2518,14 @@ bool CSSStyleSelector::SelectorChecker::checkOneSelector(CSSSelector* sel, Eleme
     if (sel->m_match == CSSSelector::PseudoClass) {
         // Handle :not up front.
         if (sel->pseudoType() == CSSSelector::PseudoNot) {
-            // check the simple selector
-            for (CSSSelector* subSel = sel->simpleSelector(); subSel; subSel = subSel->tagHistory()) {
+            ASSERT(sel->selectorList());
+            for (CSSSelector* subSel = sel->selectorList()->first(); subSel; subSel = subSel->tagHistory()) {
                 // :not cannot nest. I don't really know why this is a
                 // restriction in CSS3, but it is, so let's honor it.
                 // the parser enforces that this never occurs
-                ASSERT(!subSel->simpleSelector());
+                ASSERT(subSel->pseudoType() != CSSSelector::PseudoNot);
 
-                if (!checkOneSelector(subSel, e, selectorAttrs, dynamicPseudo, true, elementStyle, elementParentStyle))
+                if (!checkOneSelector(subSel, e, selectorAttrs, dynamicPseudo, true, encounteredLink, elementStyle, elementParentStyle))
                     return true;
             }
         } else if (dynamicPseudo != NOPSEUDO && (RenderScrollbar::scrollbarForStyleResolve() || dynamicPseudo == SCROLLBAR_CORNER || dynamicPseudo == RESIZER)) {
@@ -2840,6 +2832,12 @@ bool CSSStyleSelector::SelectorChecker::checkOneSelector(CSSSelector* sel, Eleme
                 if (e == e->document()->cssTarget())
                     return true;
                 break;
+            case CSSSelector::PseudoAny:
+                for (CSSSelector* selector = sel->selectorList()->first(); selector; selector = CSSSelectorList::next(selector)) {
+                    if (checkSelector(selector, e, selectorAttrs, dynamicPseudo, true, encounteredLink, elementStyle, elementParentStyle) == SelectorMatches)
+                        return true;
+                }
+                break;
             case CSSSelector::PseudoAnyLink:
                 if (e && e->isLink())
                     return true;
@@ -2847,7 +2845,7 @@ bool CSSStyleSelector::SelectorChecker::checkOneSelector(CSSSelector* sel, Eleme
             case CSSSelector::PseudoAutofill: {
                 if (!e || !e->isFormControlElement())
                     break;
-                if (InputElement* inputElement = toInputElement(e))
+                if (InputElement* inputElement = e->toInputElement())
                     return inputElement->isAutofilled();
                 break;
             }
@@ -2940,7 +2938,7 @@ bool CSSStyleSelector::SelectorChecker::checkOneSelector(CSSSelector* sel, Eleme
                 // Even though WinIE allows checked and indeterminate to co-exist, the CSS selector spec says that
                 // you can't be both checked and indeterminate.  We will behave like WinIE behind the scenes and just
                 // obey the CSS spec here in the test for matching the pseudo.
-                InputElement* inputElement = toInputElement(e);
+                InputElement* inputElement = e->toInputElement();
                 if (inputElement && inputElement->isChecked() && !inputElement->isIndeterminate())
                     return true;
                 break;
@@ -2948,7 +2946,7 @@ bool CSSStyleSelector::SelectorChecker::checkOneSelector(CSSSelector* sel, Eleme
             case CSSSelector::PseudoIndeterminate: {
                 if (!e || !e->isFormControlElement())
                     break;
-                InputElement* inputElement = toInputElement(e);
+                InputElement* inputElement = e->toInputElement();
                 if (inputElement && inputElement->isIndeterminate())
                     return true;
                 break;
@@ -3313,9 +3311,14 @@ static void collectFeaturesFromList(CSSStyleSelector::Features& features, const
         bool foundSiblingSelector = false;
         for (CSSSelector* selector = ruleData.selector(); selector; selector = selector->tagHistory()) {
             collectFeaturesFromSelector(features, selector);
-            if (CSSSelector* simpleSelector = selector->simpleSelector())
-                collectFeaturesFromSelector(features, simpleSelector);
-            if (selector->isSiblingSelector())
+
+            if (CSSSelectorList* selectorList = selector->selectorList()) {
+                for (CSSSelector* subSelector = selectorList->first(); subSelector; subSelector = CSSSelectorList::next(subSelector)) {
+                    if (selector->isSiblingSelector())
+                        foundSiblingSelector = true;
+                    collectFeaturesFromSelector(features, subSelector);
+                }
+            } else if (selector->isSiblingSelector())
                 foundSiblingSelector = true;
         }
         if (foundSiblingSelector) {
@@ -3363,7 +3366,7 @@ void RuleSet::shrinkToFit()
 // -------------------------------------------------------------------------------------
 // this is mostly boring stuff on how to apply a certain rule to the renderstyle...
 
-static Length convertToLength(CSSPrimitiveValue* primitiveValue, RenderStyle* style, RenderStyle* rootStyle, double multiplier = 1, bool *ok = 0)
+static Length convertToLength(CSSPrimitiveValue* primitiveValue, RenderStyle* style, RenderStyle* rootStyle, bool toFloat, double multiplier = 1, bool *ok = 0)
 {
     // This function is tolerant of a null style value. The only place style is used is in
     // length measurements, like 'ems' and 'px'. And in those cases style is only used
@@ -3378,8 +3381,12 @@ static Length convertToLength(CSSPrimitiveValue* primitiveValue, RenderStyle* st
         if (!style && (type == CSSPrimitiveValue::CSS_EMS || type == CSSPrimitiveValue::CSS_EXS || type == CSSPrimitiveValue::CSS_REMS)) {
             if (ok)
                 *ok = false;
-        } else if (CSSPrimitiveValue::isUnitTypeLength(type))
-            l = Length(primitiveValue->computeLengthIntForLength(style, rootStyle, multiplier), Fixed);
+        } else if (CSSPrimitiveValue::isUnitTypeLength(type)) {
+            if (toFloat)
+                l = Length(primitiveValue->computeLengthDouble(style, rootStyle, multiplier), Fixed);
+            else
+                l = Length(primitiveValue->computeLengthIntForLength(style, rootStyle, multiplier), Fixed);
+        }
         else if (type == CSSPrimitiveValue::CSS_PERCENTAGE)
             l = Length(primitiveValue->getDoubleValue(), Percent);
         else if (type == CSSPrimitiveValue::CSS_NUMBER)
@@ -3389,6 +3396,16 @@ static Length convertToLength(CSSPrimitiveValue* primitiveValue, RenderStyle* st
     }
     return l;
 }
+    
+static Length convertToIntLength(CSSPrimitiveValue* primitiveValue, RenderStyle* style, RenderStyle* rootStyle, double multiplier = 1, bool *ok = 0)
+{
+    return convertToLength(primitiveValue, style, rootStyle, false, multiplier, ok);
+}
+
+static Length convertToFloatLength(CSSPrimitiveValue* primitiveValue, RenderStyle* style, RenderStyle* rootStyle, double multiplier = 1, bool *ok = 0)
+{
+    return convertToLength(primitiveValue, style, rootStyle, true, multiplier, ok);
+}
 
 template <bool applyFirst>
 void CSSStyleSelector::applyDeclarations(bool isImportant, int startIndex, int endIndex)
@@ -3406,7 +3423,7 @@ void CSSStyleSelector::applyDeclarations(bool isImportant, int startIndex, int e
 
                 if (applyFirst) {
                     COMPILE_ASSERT(firstCSSProperty == CSSPropertyColor, CSS_color_is_first_property);
-                    COMPILE_ASSERT(CSSPropertyZoom == CSSPropertyColor + 13, CSS_zoom_is_end_of_first_prop_range);
+                    COMPILE_ASSERT(CSSPropertyZoom == CSSPropertyColor + 14, CSS_zoom_is_end_of_first_prop_range);
                     COMPILE_ASSERT(CSSPropertyLineHeight == CSSPropertyZoom + 1, CSS_line_height_is_after_zoom);
 
                     // give special priority to font-xxx, color properties, etc
@@ -3612,10 +3629,22 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
         return;
     }
     
+    CSSPropertyID property = static_cast<CSSPropertyID>(id);
+
+    // check lookup table for implementations and use when available
+    if (m_applyProperty.implements(property)) {
+      if (isInherit)
+          m_applyProperty.inherit(property, this);
+      else if (isInitial)
+          m_applyProperty.initial(property, this);
+      else
+          m_applyProperty.value(property, this, value);
+      return;
+    }
+
     // What follows is a list that maps the CSS properties into their corresponding front-end
     // RenderStyle values.  Shorthands (e.g. border, background) occur in this list as well and
     // are only hit when mapping "inherit" or "initial" into front-end values.
-    CSSPropertyID property = static_cast<CSSPropertyID>(id);
     switch (property) {
 // ident only properties
     case CSSPropertyBackgroundAttachment:
@@ -4020,87 +4049,6 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
                 m_style->setCursor(*primitiveValue);
         }
         return;
-// colors || inherit
-    case CSSPropertyColor:
-        // If the 'currentColor' keyword is set on the 'color' property itself,
-        // it is treated as 'color:inherit' at parse time
-        if (primitiveValue && primitiveValue->getIdent() == CSSValueCurrentcolor)
-            isInherit = true;
-    case CSSPropertyBackgroundColor:
-    case CSSPropertyBorderTopColor:
-    case CSSPropertyBorderRightColor:
-    case CSSPropertyBorderBottomColor:
-    case CSSPropertyBorderLeftColor:
-    case CSSPropertyOutlineColor:
-    case CSSPropertyWebkitColumnRuleColor:
-    case CSSPropertyWebkitTextStrokeColor:
-    case CSSPropertyWebkitTextEmphasisColor:
-    case CSSPropertyWebkitTextFillColor: {
-        Color col;
-        if (isInherit) {
-            HANDLE_INHERIT_COND(CSSPropertyBackgroundColor, backgroundColor, BackgroundColor)
-            HANDLE_INHERIT_COND_WITH_BACKUP(CSSPropertyBorderTopColor, borderTopColor, color, BorderTopColor)
-            HANDLE_INHERIT_COND_WITH_BACKUP(CSSPropertyBorderBottomColor, borderBottomColor, color, BorderBottomColor)
-            HANDLE_INHERIT_COND_WITH_BACKUP(CSSPropertyBorderRightColor, borderRightColor, color, BorderRightColor)
-            HANDLE_INHERIT_COND_WITH_BACKUP(CSSPropertyBorderLeftColor, borderLeftColor, color, BorderLeftColor)
-            HANDLE_INHERIT_COND(CSSPropertyColor, color, Color)
-            HANDLE_INHERIT_COND_WITH_BACKUP(CSSPropertyOutlineColor, outlineColor, color, OutlineColor)
-            HANDLE_INHERIT_COND_WITH_BACKUP(CSSPropertyWebkitColumnRuleColor, columnRuleColor, color, ColumnRuleColor)
-            HANDLE_INHERIT_COND_WITH_BACKUP(CSSPropertyWebkitTextStrokeColor, textStrokeColor, color, TextStrokeColor)
-            HANDLE_INHERIT_COND_WITH_BACKUP(CSSPropertyWebkitTextEmphasisColor, textEmphasisColor, color, TextEmphasisColor)
-            HANDLE_INHERIT_COND_WITH_BACKUP(CSSPropertyWebkitTextFillColor, textFillColor, color, TextFillColor)
-            return;
-        }
-        if (isInitial) {
-            // The border/outline colors will just map to the invalid color |col| above.  This will have the
-            // effect of forcing the use of the currentColor when it comes time to draw the borders (and of
-            // not painting the background since the color won't be valid).
-            if (id == CSSPropertyColor)
-                col = RenderStyle::initialColor();
-        } else {
-            if (!primitiveValue)
-                return;
-            col = getColorFromPrimitiveValue(primitiveValue);
-        }
-
-        switch (id) {
-        case CSSPropertyBackgroundColor:
-            m_style->setBackgroundColor(col);
-            break;
-        case CSSPropertyBorderTopColor:
-            m_style->setBorderTopColor(col);
-            break;
-        case CSSPropertyBorderRightColor:
-            m_style->setBorderRightColor(col);
-            break;
-        case CSSPropertyBorderBottomColor:
-            m_style->setBorderBottomColor(col);
-            break;
-        case CSSPropertyBorderLeftColor:
-            m_style->setBorderLeftColor(col);
-            break;
-        case CSSPropertyColor:
-            m_style->setColor(col);
-            break;
-        case CSSPropertyOutlineColor:
-            m_style->setOutlineColor(col);
-            break;
-        case CSSPropertyWebkitColumnRuleColor:
-            m_style->setColumnRuleColor(col);
-            break;
-        case CSSPropertyWebkitTextStrokeColor:
-            m_style->setTextStrokeColor(col);
-            break;
-        case CSSPropertyWebkitTextEmphasisColor:
-            m_style->setTextEmphasisColor(col);
-            break;
-        case CSSPropertyWebkitTextFillColor:
-            m_style->setTextFillColor(col);
-            break;
-        }
-        
-        return;
-    }
     
 // uri || inherit
     case CSSPropertyBackgroundImage:
@@ -4672,13 +4620,16 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
         HANDLE_INHERIT_AND_INITIAL(textAlign, TextAlign)
         if (!primitiveValue)
             return;
-        int id = primitiveValue->getIdent();
-        if (id == CSSValueStart)
-            m_style->setTextAlign(m_style->isLeftToRightDirection() ? LEFT : RIGHT);
-        else if (id == CSSValueEnd)
-            m_style->setTextAlign(m_style->isLeftToRightDirection() ? RIGHT : LEFT);
-        else
-            m_style->setTextAlign(*primitiveValue);
+        if (primitiveValue->getIdent() == CSSValueWebkitMatchParent) {
+            if (m_parentStyle->textAlign() == TASTART)
+                m_style->setTextAlign(m_parentStyle->isLeftToRightDirection() ? LEFT : RIGHT);
+            else if (m_parentStyle->textAlign() == TAEND)
+                m_style->setTextAlign(m_parentStyle->isLeftToRightDirection() ? RIGHT : LEFT);
+            else
+                m_style->setTextAlign(m_parentStyle->textAlign());
+            return;
+        }
+        m_style->setTextAlign(*primitiveValue);
         return;
     }
 
@@ -4709,10 +4660,10 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
             Rect* rect = primitiveValue->getRectValue();
             if (!rect)
                 return;
-            top = convertToLength(rect->top(), style(), m_rootElementStyle, zoomFactor);
-            right = convertToLength(rect->right(), style(), m_rootElementStyle, zoomFactor);
-            bottom = convertToLength(rect->bottom(), style(), m_rootElementStyle, zoomFactor);
-            left = convertToLength(rect->left(), style(), m_rootElementStyle, zoomFactor);
+            top = convertToIntLength(rect->top(), style(), m_rootElementStyle, zoomFactor);
+            right = convertToIntLength(rect->right(), style(), m_rootElementStyle, zoomFactor);
+            bottom = convertToIntLength(rect->bottom(), style(), m_rootElementStyle, zoomFactor);
+            left = convertToIntLength(rect->left(), style(), m_rootElementStyle, zoomFactor);
         } else if (primitiveValue->getIdent() != CSSValueAuto) {
             return;
         }
@@ -5318,8 +5269,8 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
             radiusHeight = Length(pair->second()->getDoubleValue(), Percent);
         else
             radiusHeight = Length(max(intMinForLength, min(intMaxForLength, pair->second()->computeLengthInt(style(), m_rootElementStyle, zoomFactor))), Fixed);
-        int width = radiusWidth.rawValue();
-        int height = radiusHeight.rawValue();
+        int width = radiusWidth.value();
+        int height = radiusHeight.value();
         if (width < 0 || height < 0)
             return;
         if (width == 0)
@@ -5655,9 +5606,9 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
         }
         else {
             bool ok = true;
-            Length l = convertToLength(primitiveValue, style(), m_rootElementStyle, 1, &ok);
+            Length marqueeLength = convertToIntLength(primitiveValue, style(), m_rootElementStyle, 1, &ok);
             if (ok)
-                m_style->setMarqueeIncrement(l);
+                m_style->setMarqueeIncrement(marqueeLength);
         }
         return;
     }
@@ -5819,10 +5770,10 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
             
         DashboardRegion *first = region;
         while (region) {
-            Length top = convertToLength(region->top(), style(), m_rootElementStyle);
-            Length right = convertToLength(region->right(), style(), m_rootElementStyle);
-            Length bottom = convertToLength(region->bottom(), style(), m_rootElementStyle);
-            Length left = convertToLength(region->left(), style(), m_rootElementStyle);
+            Length top = convertToIntLength(region->top(), style(), m_rootElementStyle);
+            Length right = convertToIntLength(region->right(), style(), m_rootElementStyle);
+            Length bottom = convertToIntLength(region->bottom(), style(), m_rootElementStyle);
+            Length left = convertToIntLength(region->left(), style(), m_rootElementStyle);
             if (region->m_isCircle)
                 m_style->setDashboardRegion(StyleDashboardRegion::Circle, region->m_label, top, right, bottom, left, region == first ? false : true);
             else if (region->m_isRectangle)
@@ -6153,8 +6104,6 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
 
     case CSSPropertyWebkitTextCombine:
         HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(textCombine, TextCombine)
-        if (m_style->hasTextCombine())
-            m_style->setUnique(); // The style could be modified in RenderCombineText depending on text metrics.
         return;
 
     case CSSPropertyWebkitTextEmphasisPosition:
@@ -6174,8 +6123,11 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
             if (list->length() != 2)
                 return;
             for (unsigned i = 0; i < 2; ++i) {
-                ASSERT(list->itemWithoutBoundsCheck(i)->isPrimitiveValue());
-                CSSPrimitiveValue* value = static_cast<CSSPrimitiveValue*>(list->itemWithoutBoundsCheck(i));
+                CSSValue* item = list->itemWithoutBoundsCheck(i);
+                if (!item->isPrimitiveValue())
+                    continue;
+
+                CSSPrimitiveValue* value = static_cast<CSSPrimitiveValue*>(item);
                 if (value->getIdent() == CSSValueFilled || value->getIdent() == CSSValueOpen)
                     m_style->setTextEmphasisFill(*value);
                 else
@@ -6207,6 +6159,7 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
 
         return;
 
+<<<<<<< HEAD
 #ifdef ANDROID_CSS_RING
     case CSSPropertyWebkitRing:
         if (valueType != CSSValue::CSS_INHERIT || !m_parentNode) return;
@@ -6350,11 +6303,64 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
         return;
     }
 #endif
+=======
+    case CSSPropertyWebkitTextOrientation: {
+        if (!isInherit && !isInitial && !primitiveValue)
+            return;
+        
+        TextOrientation result;
+        if (isInherit)
+            result = m_parentStyle->fontDescription().textOrientation();
+        else if (isInitial)
+            result = RenderStyle::initialTextOrientation();
+        else
+            result = *primitiveValue;
+        
+        FontDescription fontDescription = m_style->fontDescription();
+        if (fontDescription.textOrientation() != result) {
+            fontDescription.setTextOrientation(result);
+            if (m_style->setFontDescription(fontDescription))
+                m_fontDirty = true;
+        }
+        return;
+    }
+
+    case CSSPropertyWebkitLineBoxContain: {
+        HANDLE_INHERIT_AND_INITIAL(lineBoxContain, LineBoxContain)
+        if (primitiveValue && primitiveValue->getIdent() == CSSValueNone) {
+            m_style->setLineBoxContain(LineBoxContainNone);
+            return;
+        }
+        
+        if (!value->isCSSLineBoxContainValue())
+            return;
+        
+        CSSLineBoxContainValue* lineBoxContainValue = static_cast<CSSLineBoxContainValue*>(value);
+        m_style->setLineBoxContain(lineBoxContainValue->value());
+        return;
+    }
+
+    // These properties are implemented in the CSSStyleApplyProperty lookup table.
+    case CSSPropertyColor:
+    case CSSPropertyBackgroundColor:
+    case CSSPropertyBorderBottomColor:
+    case CSSPropertyBorderLeftColor:
+    case CSSPropertyBorderRightColor:
+    case CSSPropertyBorderTopColor:
+    case CSSPropertyOutlineColor:
+    case CSSPropertyWebkitColumnRuleColor:
+    case CSSPropertyWebkitTextEmphasisColor:
+    case CSSPropertyWebkitTextFillColor:
+    case CSSPropertyWebkitTextStrokeColor:
+        ASSERT_NOT_REACHED();
+        return;
+>>>>>>> webkit.org at r82507
 
 #if ENABLE(SVG)
     default:
         // Try the SVG properties
         applySVGProperty(id, value);
+        return;
 #endif
     }
 }
@@ -7424,13 +7430,13 @@ bool CSSStyleSelector::createTransformOperations(CSSValue* inValue, RenderStyle*
                 Length tx = Length(0, Fixed);
                 Length ty = Length(0, Fixed);
                 if (transformValue->operationType() == WebKitCSSTransformValue::TranslateYTransformOperation)
-                    ty = convertToLength(firstValue, style, rootStyle, zoomFactor, &ok);
+                    ty = convertToFloatLength(firstValue, style, rootStyle, zoomFactor, &ok);
                 else { 
-                    tx = convertToLength(firstValue, style, rootStyle, zoomFactor, &ok);
+                    tx = convertToFloatLength(firstValue, style, rootStyle, zoomFactor, &ok);
                     if (transformValue->operationType() != WebKitCSSTransformValue::TranslateXTransformOperation) {
                         if (transformValue->length() > 1) {
                             CSSPrimitiveValue* secondValue = static_cast<CSSPrimitiveValue*>(transformValue->itemWithoutBoundsCheck(1));
-                            ty = convertToLength(secondValue, style, rootStyle, zoomFactor, &ok);
+                            ty = convertToFloatLength(secondValue, style, rootStyle, zoomFactor, &ok);
                         }
                     }
                 }
@@ -7448,19 +7454,19 @@ bool CSSStyleSelector::createTransformOperations(CSSValue* inValue, RenderStyle*
                 Length ty = Length(0, Fixed);
                 Length tz = Length(0, Fixed);
                 if (transformValue->operationType() == WebKitCSSTransformValue::TranslateZTransformOperation)
-                    tz = convertToLength(firstValue, style, rootStyle, zoomFactor, &ok);
+                    tz = convertToFloatLength(firstValue, style, rootStyle, zoomFactor, &ok);
                 else if (transformValue->operationType() == WebKitCSSTransformValue::TranslateYTransformOperation)
-                    ty = convertToLength(firstValue, style, rootStyle, zoomFactor, &ok);
+                    ty = convertToFloatLength(firstValue, style, rootStyle, zoomFactor, &ok);
                 else { 
-                    tx = convertToLength(firstValue, style, rootStyle, zoomFactor, &ok);
+                    tx = convertToFloatLength(firstValue, style, rootStyle, zoomFactor, &ok);
                     if (transformValue->operationType() != WebKitCSSTransformValue::TranslateXTransformOperation) {
                         if (transformValue->length() > 2) {
                             CSSPrimitiveValue* thirdValue = static_cast<CSSPrimitiveValue*>(transformValue->itemWithoutBoundsCheck(2));
-                            tz = convertToLength(thirdValue, style, rootStyle, zoomFactor, &ok);
+                            tz = convertToFloatLength(thirdValue, style, rootStyle, zoomFactor, &ok);
                         }
                         if (transformValue->length() > 1) {
                             CSSPrimitiveValue* secondValue = static_cast<CSSPrimitiveValue*>(transformValue->itemWithoutBoundsCheck(1));
-                            ty = convertToLength(secondValue, style, rootStyle, zoomFactor, &ok);
+                            ty = convertToFloatLength(secondValue, style, rootStyle, zoomFactor, &ok);
                         }
                     }
                 }
@@ -7591,7 +7597,7 @@ bool CSSStyleSelector::createTransformOperations(CSSValue* inValue, RenderStyle*
                 bool ok = true;
                 Length p = Length(0, Fixed);
                 if (CSSPrimitiveValue::isUnitTypeLength(firstValue->primitiveType()))
-                    p = convertToLength(firstValue, style, rootStyle, zoomFactor, &ok);
+                    p = convertToFloatLength(firstValue, style, rootStyle, zoomFactor, &ok);
                 else {
                     // This is a quirk that should go away when 3d transforms are finalized.
                     double val = firstValue->getDoubleValue();
diff --git a/Source/WebCore/css/CSSStyleSelector.h b/Source/WebCore/css/CSSStyleSelector.h
index 9f83f82..756c5bf 100644
--- a/Source/WebCore/css/CSSStyleSelector.h
+++ b/Source/WebCore/css/CSSStyleSelector.h
@@ -45,6 +45,7 @@ class CSSFontFaceRule;
 class CSSImageValue;
 class CSSRuleList;
 class CSSSelector;
+class CSSStyleApplyProperty;
 class CSSStyleRule;
 class CSSStyleSheet;
 class CSSValue;
@@ -95,6 +96,7 @@ public:
         void pushParent(Element* parent);
         void popParent(Element* parent);
 
+
         PassRefPtr<RenderStyle> styleForElement(Element* e, RenderStyle* parentStyle = 0, bool allowSharing = true, bool resolveForRootDefault = false, bool matchVisitedPseudoClass = false);
         
         void keyframeStylesForAnimation(Element*, const RenderStyle*, KeyframeList& list);
@@ -111,6 +113,9 @@ public:
         PassRefPtr<RenderStyle> pseudoStyleForDataGridColumnHeader(DataGridColumn*, RenderStyle* parentStyle);
 #endif
 
+        RenderStyle* style() const { return m_style.get(); }
+        RenderStyle* parentStyle() const { return m_parentStyle; }
+
     private:
         void initForStyleResolve(Element*, RenderStyle* parentStyle = 0, PseudoId = NOPSEUDO);
         void initElement(Element*);
@@ -123,8 +128,6 @@ public:
         void pushParentStackFrame(Element* parent);
         void popParentStackFrame();
 
-        RenderStyle* style() const { return m_style.get(); }
-
         PassRefPtr<RenderStyle> styleForKeyframe(const RenderStyle*, const WebKitCSSKeyframeRule*, KeyframeValue&);
 
     public:
@@ -156,7 +159,6 @@ public:
     private:
         void setFontSize(FontDescription&, float size);
         static float getComputedSizeFromSpecifiedSize(Document*, RenderStyle*, bool isAbsoluteSize, float specifiedSize, bool useSVGZoomRules);
-
     public:
         Color getColorFromPrimitiveValue(CSSPrimitiveValue*) const;
 
@@ -256,7 +258,7 @@ public:
 
             bool checkSelector(CSSSelector*, Element*) const;
             SelectorMatch checkSelector(CSSSelector*, Element*, HashSet<AtomicStringImpl*>* selectorAttrs, PseudoId& dynamicPseudo, bool isSubSelector, bool encounteredLink, RenderStyle* = 0, RenderStyle* elementParentStyle = 0) const;
-            bool checkOneSelector(CSSSelector*, Element*, HashSet<AtomicStringImpl*>* selectorAttrs, PseudoId& dynamicPseudo, bool isSubSelector, RenderStyle*, RenderStyle* elementParentStyle) const;
+            bool checkOneSelector(CSSSelector*, Element*, HashSet<AtomicStringImpl*>* selectorAttrs, PseudoId& dynamicPseudo, bool isSubSelector, bool encounteredLink, RenderStyle*, RenderStyle* elementParentStyle) const;
             bool checkScrollbarPseudoClass(CSSSelector*, PseudoId& dynamicPseudo) const;
             static bool fastCheckSelector(const CSSSelector*, const Element*);
 
@@ -355,6 +357,8 @@ public:
         HashSet<AtomicStringImpl*> m_selectorAttrs;
         Vector<CSSMutableStyleDeclaration*> m_additionalAttributeStyleDecls;
         Vector<MediaQueryResult*> m_viewportDependentMediaQueryResults;
+
+        const CSSStyleApplyProperty& m_applyProperty;
     };
 
 } // namespace WebCore
diff --git a/Source/WebCore/css/CSSValue.h b/Source/WebCore/css/CSSValue.h
index a101c66..de46ff9 100644
--- a/Source/WebCore/css/CSSValue.h
+++ b/Source/WebCore/css/CSSValue.h
@@ -65,7 +65,8 @@ public:
     virtual bool isTimingFunctionValue() const { return false; }
     virtual bool isValueList() const { return false; }
     virtual bool isWebKitCSSTransformValue() const { return false; }
-
+    virtual bool isCSSLineBoxContainValue() const { return false; }
+    
 #if ENABLE(SVG)
     virtual bool isSVGColor() const { return false; }
     virtual bool isSVGPaint() const { return false; }
diff --git a/Source/WebCore/css/CSSValueKeywords.in b/Source/WebCore/css/CSSValueKeywords.in
index 4fce4f3..6dac06f 100644
--- a/Source/WebCore/css/CSSValueKeywords.in
+++ b/Source/WebCore/css/CSSValueKeywords.in
@@ -4,7 +4,7 @@
 # --------
 #
 # The Values are sorted according to the properties they belong to,
-# and have to be in the same order as the enums in RenderStyle.h.
+# and have to be in the same order as the enums in RenderStyleConstants.h.
 #
 # If not, the optimizations in the cssparser and style selector will fail,
 # and produce incorrect results.
@@ -212,6 +212,7 @@ justify
 -webkit-left
 -webkit-right
 -webkit-center
+-webkit-match-parent
 #
 # CSS_PROP_LIST_STYLE_POSITION:
 #
@@ -406,6 +407,7 @@ hand
 hide
 higher
 invert
+-webkit-isolate
 landscape
 ledger
 legal
@@ -790,3 +792,15 @@ farthest-side
 farthest-corner
 # contain
 # cover
+
+# -webkit-text-orientation
+upright
+vertical-right
+
+# -webkit-line-box-contain
+font
+glyphs
+inline-box
+replaced
+
+
diff --git a/Source/WebCore/css/MediaQueryListListener.cpp b/Source/WebCore/css/MediaQueryListListener.cpp
index ab73b1d..7512161 100644
--- a/Source/WebCore/css/MediaQueryListListener.cpp
+++ b/Source/WebCore/css/MediaQueryListListener.cpp
@@ -37,6 +37,11 @@ void MediaQueryListListener::queryChanged(ScriptState* state, MediaQueryList* qu
 #if USE(JSC)
     callback.appendArgument(toJS(state, query));
 #else
+    v8::HandleScope handleScope;
+    v8::Handle<v8::Context> context = state->context();
+    if (context.IsEmpty())
+       return; // JS may not be enabled.
+    v8::Context::Scope scope(context);
     callback.appendArgument(toV8(query));
 #endif
     callback.call();
diff --git a/Source/WebCore/css/StyleSheetList.h b/Source/WebCore/css/StyleSheetList.h
index a486511..a019691 100644
--- a/Source/WebCore/css/StyleSheetList.h
+++ b/Source/WebCore/css/StyleSheetList.h
@@ -50,6 +50,11 @@ public:
     {
         m_sheets.swap(sheets);
     }
+
+    Document* document()
+    {
+        return m_doc;
+    }
     
 private:
     StyleSheetList(Document*);
diff --git a/Source/WebCore/css/fullscreenQuickTime.css b/Source/WebCore/css/fullscreenQuickTime.css
new file mode 100644
index 0000000..80cf9e4
--- /dev/null
+++ b/Source/WebCore/css/fullscreenQuickTime.css
@@ -0,0 +1,154 @@
+/*
+ * Copyright (C) 2011 Apple Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+/* alternate media controls - Extend fullscreen.css */
+
+video:-webkit-full-screen::-webkit-media-controls-panel {
+    -webkit-box-align: start;
+    -webkit-box-pack: end;    
+    -webkit-appearance: none;
+
+    bottom: 50px;
+    left: 50%;
+    margin-left: -220px;
+    padding: 12px 0 0 10px;
+    width: 430px;
+    height: 48px;
+    
+    background-image: -webkit-gradient(
+        linear,
+        left top,
+        left bottom,
+        color-stop(0, rgba(30, 30, 30, .97)),
+        color-stop(0.333, rgba(45, 45, 45, .97)),
+        color-stop(0.35,  rgba(25, 25, 25, .97)),
+        color-stop(0.366, rgba(25, 25, 25, .97)),
+        color-stop(0.366, rgba(12, 12, 12, .97)),
+        color-stop(1, rgba(19, 19, 19, .97))
+    );
+
+    -webkit-box-shadow: 
+        inset 0 -1px 1px rgba(0, 0, 0, 0.5),
+        inset 0  1px 0 0px   rgba(255, 255, 255, 0.15),
+        inset 0 -1px 0 0px   rgba(202, 202, 202, 0.09),
+        0  0   0 1px rgba(0, 0, 0, 0.5);
+    -webkit-border-radius: 8px;
+}
+
+video:-webkit-full-screen::-webkit-media-controls-mute-button {
+    display: none;
+}
+
+video:-webkit-full-screen::-webkit-media-controls-volume-slider-container {
+    display: none;
+}
+
+video:-webkit-full-screen::-webkit-media-controls-volume-slider {
+    display: none;
+}
+
+video:-webkit-full-screen::-webkit-media-controls-volume-slider-mute-button {
+    display: none;
+}
+
+video:-webkit-full-screen::-webkit-media-controls-fullscreen-volume-min-button {
+    -webkit-appearance: media-mute-button;
+    display: block;
+    position: absolute;
+    left: 11px;
+    top: 15px;
+    width: 14px;
+    height: 12px;
+}
+
+video:-webkit-full-screen::-webkit-media-controls-fullscreen-volume-slider {
+    -webkit-appearance: media-slider;
+    display: block;
+    position: absolute;
+    left: 28px;
+    top: 15px;
+    height: 12px;
+    width: 50px;
+}
+
+video:-webkit-full-screen::-webkit-media-controls-fullscreen-volume-max-button {
+    -webkit-appearance: media-mute-button;
+    display: block;
+    position: absolute;
+    left: 84px;
+    top: 15px;
+    width: 14px;
+    height: 12px;
+}
+
+video:-webkit-full-screen::-webkit-media-controls-play-button {
+    position: absolute;
+    width: 22px;
+    height: 23px;
+    left: 209px;
+    top: 9px;
+}
+
+video:-webkit-full-screen::-webkit-media-controls-rewind-button {
+    position: absolute;
+    left: 162px;
+    top: 13px;
+    width: 18px;
+    height: 18px;
+}
+
+video:-webkit-full-screen::-webkit-media-controls-seek-back-button {
+    position: absolute;
+    display: -webkit-box;
+    width: 23px;
+    height: 16px;
+    left: 162px;
+    top: 13px;
+}
+
+video:-webkit-full-screen::-webkit-media-controls-seek-forward-button {
+    position: absolute;
+    display: -webkit-box;
+    width: 23px;
+    height: 16px;
+    left: 262px;
+    top: 13px;
+}
+
+video:-webkit-full-screen::-webkit-media-controls-timeline-container {
+    height: auto;
+    width: 420px;
+    position: absolute;
+    bottom: 9px;
+    left: 8px;
+    right: 8px;
+}
+
+video:-webkit-full-screen::video::-webkit-media-controls-status-display {
+    width: 420px;
+    position: absolute;
+    bottom: 9px;
+    left: 8px;
+    right: 8px;
+}
diff --git a/Source/WebCore/css/html.css b/Source/WebCore/css/html.css
index 61178d0..bd3bde0 100644
--- a/Source/WebCore/css/html.css
+++ b/Source/WebCore/css/html.css
@@ -152,6 +152,36 @@ h1 {
     font-weight: bold
 }
 
+:-webkit-any(article,aside,nav,section) h1 {
+    font-size: 1.5em;
+    -webkit-margin-before: 0.83__qem;
+    -webkit-margin-after: 0.83em;
+}
+
+:-webkit-any(article,aside,nav,section) :-webkit-any(article,aside,nav,section) h1 {
+    font-size: 1.17em;
+    -webkit-margin-before: 1__qem;
+    -webkit-margin-after: 1em;
+}
+
+:-webkit-any(article,aside,nav,section) :-webkit-any(article,aside,nav,section) :-webkit-any(article,aside,nav,section) h1 {
+    font-size: 1.00em;
+    -webkit-margin-before: 1.33__qem;
+    -webkit-margin-after: 1.33em;
+}
+
+:-webkit-any(article,aside,nav,section) :-webkit-any(article,aside,nav,section) :-webkit-any(article,aside,nav,section) :-webkit-any(article,aside,nav,section) h1 {
+    font-size: .83em;
+    -webkit-margin-before: 1.67__qem;
+    -webkit-margin-after: 1.67em;
+}
+
+:-webkit-any(article,aside,nav,section) :-webkit-any(article,aside,nav,section) :-webkit-any(article,aside,nav,section) :-webkit-any(article,aside,nav,section) :-webkit-any(article,aside,nav,section) h1 {
+    font-size: .67em;
+    -webkit-margin-before: 2.33__qem;
+    -webkit-margin-after: 2.33em;
+}
+
 h2 {
     display: block;
     font-size: 1.5em;
@@ -476,6 +506,7 @@ input[type="file"] {
 input:-webkit-autofill {
     background-color: #FAFFBD !important;
     background-image:none !important;
+    color: #000000 !important;
 }
 
 input[type="radio"], input[type="checkbox"] {
@@ -587,55 +618,55 @@ output {
 /* form validation message bubble */
 
 ::-webkit-validation-bubble {
-    display: block;
+    display: inline-block;
     z-index: 2147483647;
     position: absolute;
-    opacity: 0.9;
+    opacity: 0.95;
     line-height: 0;
+    margin: 0;
     -webkit-text-security: none;
     -webkit-transition: opacity 05.5s ease;
 }
 
 ::-webkit-validation-bubble-message {
     display: block;
+    position: relative;
+    top: -4px;
     font: message-box;
+    color: black;
     min-width: 50px;
     max-width: 200px;
-    border: solid 2px black;
-    background: -webkit-gradient(linear, left top, left bottom, from(#fbf9f9), to(#f0e4e4));
+    border: solid 2px #400;
+    background: -webkit-gradient(linear, left top, left bottom, from(#f8ecec), to(#e8cccc));
     padding: 8px;
     -webkit-border-radius: 8px;
-    -webkit-box-shadow: 4px 4px 4px rgba(204,204,204,0.7);
+    -webkit-box-shadow: 4px 4px 4px rgba(100,100,100,0.6),
+        inset -2px -2px 1px #d0c4c4,
+        inset 2px 2px 1px white;
     line-height: normal;
+    z-index: 2147483644;
 }
 
-::-webkit-validation-bubble-top-outer-arrow {
+::-webkit-validation-bubble-arrow {
     display: inline-block;
     position: relative;
-    left: 14px;
-    height: 0;
-    width: 0;
+    left: 32px;
+    width: 16px;
+    height: 16px;
+    background-color: #f8ecec;
+    border-width: 2px 0 0 2px;
     border-style: solid;
-    border-width: 14px;
-    border-bottom-color: black;
-    border-right-color: transparent;
-    border-top-width: 0;
-    border-left-width: 0;
+    border-color: #400;
+    box-shadow: inset 2px 2px 1px white;
+    -webkit-transform-origin: 0 0;
+    -webkit-transform: rotate(45deg);
+    z-index: 2147483645;
 }
 
-::-webkit-validation-bubble-top-inner-arrow {
-    display: inline-block;
-    height: 0;
-    width: 0;
-    border-style: solid;
-    border-width: 10px; /* <border box width of outer-arrow> - <message border width> * 2 */
-    border-bottom-color: #fbf9f9;
-    border-right-color: transparent;
-    border-top-width: 0;
-    border-left-width: 0;
-    position: relative;
-    top: 2px; /* <message border width> */
-    left: 2px; /* <outer-arrow position> + <message border width> - <border box width of outer-arrow>  */
+::-webkit-validation-bubble-arrow-clipper {
+    display: block;
+    overflow: hidden;
+    height: 16px;
 }
 
 /* meter */
diff --git a/Source/WebCore/css/mediaControls.css b/Source/WebCore/css/mediaControls.css
index 88144b4..874cb13 100644
--- a/Source/WebCore/css/mediaControls.css
+++ b/Source/WebCore/css/mediaControls.css
@@ -171,3 +171,15 @@ audio::-webkit-media-controls-volume-slider-mute-button, video::-webkit-media-co
     border: initial;
     color: inherit;
 }
+
+audio::-webkit-media-controls-fullscreen-volume-slider, video::-webkit-media-controls-fullscreen-volume-slider {
+    display: none;
+}
+
+audio::-webkit-media-controls-fullscreen-volume-min-button, video::-webkit-media-controls-fullscreen-volume-min-button {
+    display: none;
+}
+
+audio::-webkit-media-controls-fullscreen-volume-max-button, video::-webkit-media-controls-fullscreen-volume-max-button {
+    display: none;
+}
diff --git a/Source/WebCore/css/mediaControlsEfl.css b/Source/WebCore/css/mediaControlsEfl.css
new file mode 100644
index 0000000..938d7e8
--- /dev/null
+++ b/Source/WebCore/css/mediaControlsEfl.css
@@ -0,0 +1,174 @@
+/*
+ * Copyright (C) 2009, 2010 Apple Inc.  All rights reserved.
+ * Copyright (C) 2011 Samsung Electronics
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+/* EFLWebKit media controls. Extends mediaControls.css */
+
+audio {
+    width: 200px;
+    height: 25px;
+}
+
+audio::-webkit-media-controls-panel, video::-webkit-media-controls-panel {
+    display: -webkit-box;
+    -webkit-box-orient: horizontal;
+    -webkit-box-align: center;
+    -webkit-user-select: none;
+    position: absolute;
+    bottom: 0;
+    width: 100%;
+    z-index: 0;
+    overflow: hidden;
+    height: 25px;
+    text-align: right;
+}
+
+video:-webkit-full-page-media::-webkit-media-controls-panel {
+    bottom: -25px;
+}
+
+audio::-webkit-media-controls-mute-button, video::-webkit-media-controls-mute-button {
+    -webkit-appearance: media-mute-button;
+    display: -webkit-box;
+    width: 25px;
+    height: 25px;
+    background-color: initial;
+    border: initial;
+    color: inherit;
+}
+
+audio::-webkit-media-controls-play-button, video::-webkit-media-controls-play-button {
+    -webkit-appearance: media-play-button;
+    display: -webkit-box;
+    width: 25px;
+    height: 25px;
+    background-color: initial;
+    border: initial;
+    color: inherit;
+}
+
+audio::-webkit-media-controls-timeline-container, video::-webkit-media-controls-timeline-container {
+    -webkit-appearance: media-controls-background;
+    display: -webkit-box;
+    -webkit-box-orient: horizontal;
+    -webkit-box-align: center;
+    -webkit-box-pack: end;
+    -webkit-box-flex: 1;
+    -webkit-user-select: none;
+    height: 25px;
+}
+
+audio::-webkit-media-controls-current-time-display, video::-webkit-media-controls-current-time-display {
+    display: none;
+}
+
+audio::-webkit-media-controls-time-remaining-display, video::-webkit-media-controls-time-remaining-display {
+    display: none;
+}
+
+audio::-webkit-media-controls-timeline, video::-webkit-media-controls-timeline {
+    -webkit-appearance: media-slider;
+    display: -webkit-box;
+    -webkit-box-flex: 1;
+    height: 25px;
+    padding: 0px 2px;
+    background-color: initial;
+    border: initial;
+    color: inherit;
+    margin: initial;
+}
+
+audio::-webkit-media-controls-volume-slider-container, video::-webkit-media-controls-volume-slider-container {
+    display: none;
+}
+
+audio::-webkit-media-controls-volume-slider, video::-webkit-media-controls-volume-slider {
+    display: none;
+    background-color: initial;
+    border: initial;
+    color: inherit;
+    margin: initial;
+}
+
+audio::-webkit-media-controls-seek-back-button, video::-webkit-media-controls-seek-back-button {
+    -webkit-appearance: media-seek-back-button;
+    display: -webkit-box;
+    width: 25px;
+    height: 25px;
+    background-color: initial;
+    border: initial;
+    color: inherit;
+}
+
+audio::-webkit-media-controls-seek-forward-button, video::-webkit-media-controls-seek-forward-button {
+    -webkit-appearance: media-seek-forward-button;
+    display: -webkit-box;
+    width: 25px;
+    height: 25px;
+    background-color: initial;
+    border: initial;
+    color: inherit;
+}
+
+audio::-webkit-media-controls-fullscreen-button, video::-webkit-media-controls-fullscreen-button {
+    -webkit-appearance: media-fullscreen-button;
+    display: -webkit-box;
+    width: 25px;
+    height: 25px;
+    background-color: initial;
+    border: initial;
+    color: inherit;
+}
+
+audio::-webkit-media-controls-rewind-button, video::-webkit-media-controls-rewind-button {
+    display: none;
+    background-color: initial;
+    border: initial;
+    color: inherit;
+}
+
+audio::-webkit-media-controls-return-to-realtime-button, video::-webkit-media-controls-return-to-realtime-button {
+    display: none;
+    background-color: initial;
+    border: initial;
+    color: inherit;
+}
+
+audio::-webkit-media-controls-toggle-closed-captions-button, video::-webkit-media-controls-toggle-closed-captions-button {
+    -webkit-appearance: media-toggle-closed-captions-button;
+    display: -webkit-box;
+    width: 25px;
+    height: 25px;
+    background-color: initial;
+    border: initial;
+    color: inherit;
+}
+
+audio::-webkit-media-controls-volume-slider-mute-button, video::-webkit-media-controls-volume-slider-mute-button {
+    -webkit-appearance: media-volume-slider-mute-button;
+    display: none;
+    background-color: initial;
+    border: initial;
+    color: inherit;
+}
diff --git a/Source/WebCore/css/themeChromiumLinux.css b/Source/WebCore/css/themeChromiumLinux.css
index cb7e900..a6a8828 100644
--- a/Source/WebCore/css/themeChromiumLinux.css
+++ b/Source/WebCore/css/themeChromiumLinux.css
@@ -34,6 +34,7 @@ select {
     background-color: #dddddd;
 }
 
+select:not([size]):not([multiple]) option,
 select[size="0"] option,
 select[size="1"] option {
     background-color: #f7f7f7;
diff --git a/Source/WebCore/css/tokenizer.flex b/Source/WebCore/css/tokenizer.flex
index eb18cb9..88a92a2 100644
--- a/Source/WebCore/css/tokenizer.flex
+++ b/Source/WebCore/css/tokenizer.flex
@@ -102,13 +102,18 @@ nth             [\+-]?{intnum}*n([\t\r\n ]*[\+-][\t\r\n ]*{intnum})?
 {num}Hz                 {yyTok = HERTZ; return yyTok;}
 {num}kHz                {yyTok = KHERTZ; return yyTok;}
 {num}{ident}            {yyTok = DIMEN; return yyTok;}
+{num}{ident}\+          {yyTok = INVALIDDIMEN; return yyTok;}
 {num}%+                 {yyTok = PERCENTAGE; return yyTok;}
 {intnum}                {yyTok = INTEGER; return yyTok;}
 {num}                   {yyTok = FLOATTOKEN; return yyTok;}
 
+"-webkit-any("          {yyTok = ANYFUNCTION; return yyTok;}
 "not("                  {yyTok = NOTFUNCTION; return yyTok;}
 "url("{w}{string}{w}")" {yyTok = URI; return yyTok;}
 "url("{w}{url}{w}")"    {yyTok = URI; return yyTok;}
+"-webkit-calc("         {yyTok = CALCFUNCTION; return yyTok;}
+"-webkit-min("          {yyTok = MINFUNCTION; return yyTok;}
+"-webkit-max("          {yyTok = MAXFUNCTION; return yyTok;}
 {ident}"("              {yyTok = FUNCTION; return yyTok;}
 
 U\+{range}              {yyTok = UNICODERANGE; return yyTok;}
diff --git a/Source/WebCore/css/wml.css b/Source/WebCore/css/wml.css
index 4bcf08f..38169fc 100644
--- a/Source/WebCore/css/wml.css
+++ b/Source/WebCore/css/wml.css
@@ -147,6 +147,7 @@ input[type="password"] {
 input:-webkit-autofill {
     background-color: #FAFFBD !important;
     background-image:none !important;
+    color: #000000 !important;
 }
 
 do:disabled, select:disabled, optgroup:disabled, option:disabled {
diff --git a/Source/WebCore/dom/CheckedRadioButtons.cpp b/Source/WebCore/dom/CheckedRadioButtons.cpp
index 3cf8848..20662a2 100644
--- a/Source/WebCore/dom/CheckedRadioButtons.cpp
+++ b/Source/WebCore/dom/CheckedRadioButtons.cpp
@@ -77,7 +77,7 @@ void CheckedRadioButtons::removeButton(HTMLFormControlElement* element)
     if (it == m_nameToCheckedRadioButtonMap->end() || it->second != element)
         return;
     
-    InputElement* inputElement = toInputElement(element);
+    InputElement* inputElement = element->toInputElement();
     ASSERT_UNUSED(inputElement, inputElement);
     ASSERT(inputElement->isChecked());
     ASSERT(element->isRadioButton());
diff --git a/Source/WebCore/dom/Clipboard.h b/Source/WebCore/dom/Clipboard.h
index b8eadfb..40141af 100644
--- a/Source/WebCore/dom/Clipboard.h
+++ b/Source/WebCore/dom/Clipboard.h
@@ -33,6 +33,7 @@
 
 namespace WebCore {
 
+    class DataTransferItems;
     class DragData;
     class FileList;
     class Frame;
@@ -84,6 +85,7 @@ namespace WebCore {
         virtual bool hasData() = 0;
         
         void setAccessPolicy(ClipboardAccessPolicy);
+        ClipboardAccessPolicy policy() const { return m_policy; }
 
         DragOperation sourceOperation() const;
         DragOperation destinationOperation() const;
@@ -91,11 +93,14 @@ namespace WebCore {
         void setDestinationOperation(DragOperation);
         
         void setDragHasStarted() { m_dragStarted = true; }
+
+#if ENABLE(DATA_TRANSFER_ITEMS)
+        virtual PassRefPtr<DataTransferItems> items() = 0;
+#endif
         
     protected:
         Clipboard(ClipboardAccessPolicy, ClipboardType);
 
-        ClipboardAccessPolicy policy() const { return m_policy; }
         bool dragStarted() const { return m_dragStarted; }
         
     private:
diff --git a/Source/WebCore/dom/Clipboard.idl b/Source/WebCore/dom/Clipboard.idl
index 1024a36..d5bb331 100644
--- a/Source/WebCore/dom/Clipboard.idl
+++ b/Source/WebCore/dom/Clipboard.idl
@@ -42,6 +42,8 @@ module core {
         [RequiresAllArguments] boolean setData(in DOMString type, in DOMString data);
         [Custom] void setDragImage(in HTMLImageElement image, in long x, in long y)
             raises(DOMException);
+
+        readonly attribute [Conditional=DATA_TRANSFER_ITEMS, EnabledAtRuntime=DataTransferItems] DataTransferItems items;
     };
 
 }
diff --git a/Source/WebCore/dom/ContainerNode.cpp b/Source/WebCore/dom/ContainerNode.cpp
index 7424875..4014cca 100644
--- a/Source/WebCore/dom/ContainerNode.cpp
+++ b/Source/WebCore/dom/ContainerNode.cpp
@@ -735,7 +735,7 @@ void ContainerNode::insertedIntoDocument()
 {
     Node::insertedIntoDocument();
     insertedIntoTree(false);
-    for (Node* child = m_firstChild; child; child = child->nextSibling())
+    for (Node* child = m_firstChild; child && inDocument(); child = child->nextSibling())
         child->insertedIntoDocument();
 }
 
diff --git a/Source/WebCore/dom/DOMAllInOne.cpp b/Source/WebCore/dom/DOMAllInOne.cpp
index c88aecf..cc4888f 100644
--- a/Source/WebCore/dom/DOMAllInOne.cpp
+++ b/Source/WebCore/dom/DOMAllInOne.cpp
@@ -26,7 +26,6 @@
 // This all-in-one cpp file cuts down on template bloat to allow us to build our Windows release build.
 
 #include "ActiveDOMObject.cpp"
-#include "AsyncScriptRunner.cpp"
 #include "Attr.cpp"
 #include "Attribute.cpp"
 #include "BeforeProcessEvent.cpp"
@@ -70,6 +69,7 @@
 #include "ErrorEvent.cpp"
 #include "Event.cpp"
 #include "EventContext.cpp"
+#include "EventDispatcher.cpp"
 #include "EventNames.cpp"
 #include "EventQueue.cpp"
 #include "EventTarget.cpp"
@@ -104,6 +104,7 @@
 #include "ScopedEventQueue.cpp"
 #include "ScriptElement.cpp"
 #include "ScriptExecutionContext.cpp"
+#include "ScriptRunner.cpp"
 #include "ScriptableDocumentParser.cpp"
 #include "SelectElement.cpp"
 #include "SelectorNodeList.cpp"
diff --git a/Source/WebCore/dom/DOMImplementation.cpp b/Source/WebCore/dom/DOMImplementation.cpp
index 3ba1137..782f203 100644
--- a/Source/WebCore/dom/DOMImplementation.cpp
+++ b/Source/WebCore/dom/DOMImplementation.cpp
@@ -262,7 +262,8 @@ PassRefPtr<Document> DOMImplementation::createDocument(const String& namespaceUR
     // WRONG_DOCUMENT_ERR: Raised if doctype has already been used with a different document or was
     // created from a different implementation.
     // Hixie's interpretation of the DOM Core spec suggests we should prefer
-    // other exceptions to WRONG_DOCUMENT_ERR (based on order mentioned in spec).
+    // other exceptions to WRONG_DOCUMENT_ERR (based on order mentioned in spec),
+    // but this matches the new DOM Core spec (http://www.w3.org/TR/domcore/).
     if (doctype && doctype->document()) {
         ec = WRONG_DOCUMENT_ERR;
         return 0;
diff --git a/Source/WebCore/dom/DataTransferItem.cpp b/Source/WebCore/dom/DataTransferItem.cpp
new file mode 100644
index 0000000..8eec869
--- /dev/null
+++ b/Source/WebCore/dom/DataTransferItem.cpp
@@ -0,0 +1,43 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "DataTransferItem.h"
+
+#if ENABLE(DATA_TRANSFER_ITEMS)
+
+namespace WebCore {
+
+const char DataTransferItem::kindString[] = "string";
+const char DataTransferItem::kindFile[] = "file";
+
+} // namespace WebCore
+
+#endif // ENABLE(DATA_TRANSFER_ITEMS)
diff --git a/Source/WebCore/dom/DataTransferItem.h b/Source/WebCore/dom/DataTransferItem.h
new file mode 100644
index 0000000..7b5886a
--- /dev/null
+++ b/Source/WebCore/dom/DataTransferItem.h
@@ -0,0 +1,60 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef DataTransferItem_h
+#define DataTransferItem_h
+
+#if ENABLE(DATA_TRANSFER_ITEMS)
+
+#include <wtf/Forward.h>
+#include <wtf/RefCounted.h>
+
+namespace WebCore {
+
+class StringCallback;
+
+class DataTransferItem : public RefCounted<DataTransferItem> {
+public:
+    ~DataTransferItem() {}
+
+    static const char kindString[];
+    static const char kindFile[];
+
+    virtual String kind() const = 0;
+    virtual String type() const = 0;
+
+    virtual void getAsString(PassRefPtr<StringCallback>) = 0;
+};
+
+} // namespace WebCore
+
+#endif // ENABLE(DATA_TRANSFER_ITEMS)
+
+#endif // DataTransferItem_h
diff --git a/Source/WebCore/dom/DataTransferItem.idl b/Source/WebCore/dom/DataTransferItem.idl
new file mode 100644
index 0000000..a2c9942
--- /dev/null
+++ b/Source/WebCore/dom/DataTransferItem.idl
@@ -0,0 +1,42 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+module core {
+
+    interface [
+        Conditional=DATA_TRANSFER_ITEMS
+    ] DataTransferItem {
+        readonly attribute DOMString kind;
+        readonly attribute DOMString type;
+
+        void getAsString(in [Callback] StringCallback callback);
+    };
+
+}
diff --git a/Source/WebCore/dom/DataTransferItems.h b/Source/WebCore/dom/DataTransferItems.h
new file mode 100644
index 0000000..0873384
--- /dev/null
+++ b/Source/WebCore/dom/DataTransferItems.h
@@ -0,0 +1,62 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef DataTransferItems_h
+#define DataTransferItems_h
+
+#if ENABLE(DATA_TRANSFER_ITEMS)
+
+#include <wtf/Forward.h>
+#include <wtf/RefCounted.h>
+
+namespace WebCore {
+
+class DataTransferItem;
+
+typedef int ExceptionCode;
+
+class DataTransferItems : public RefCounted<DataTransferItems> {
+public:
+    ~DataTransferItems() {}
+
+    virtual unsigned long length() const = 0;
+    virtual PassRefPtr<DataTransferItem> item(unsigned long index) const = 0;
+    virtual void deleteItem(unsigned long index, ExceptionCode&) = 0;
+    virtual void clear() = 0;
+
+    virtual void add(const String& data, const String& type, ExceptionCode&) = 0;
+};
+
+} // namespace WebCore
+
+#endif // ENABLE(DATA_TRANSFER_ITEMS)
+
+#endif // DataTransferItems_h
+
diff --git a/Source/WebCore/dom/DataTransferItems.idl b/Source/WebCore/dom/DataTransferItems.idl
new file mode 100644
index 0000000..1cb36b8
--- /dev/null
+++ b/Source/WebCore/dom/DataTransferItems.idl
@@ -0,0 +1,45 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+module core {
+
+    interface [
+        Conditional=DATA_TRANSFER_ITEMS,
+        HasIndexGetter,
+        CustomDeleteProperty,
+    ] DataTransferItems {
+        readonly attribute long length;
+        DataTransferItem item(in unsigned long index) getter;
+
+        void clear();
+        void add(in DOMString data, in DOMString type) raises(DOMException);
+    };
+
+}
diff --git a/Source/WebCore/dom/DatasetDOMStringMap.cpp b/Source/WebCore/dom/DatasetDOMStringMap.cpp
index 6359d55..a143743 100644
--- a/Source/WebCore/dom/DatasetDOMStringMap.cpp
+++ b/Source/WebCore/dom/DatasetDOMStringMap.cpp
@@ -72,13 +72,30 @@ static String convertAttributeNameToPropertyName(const String& name)
 
 static bool propertyNameMatchesAttributeName(const String& propertyName, const String& attributeName)
 {
-    // FIXME: This should be able to match without creating a new string.
-
-    if (!isValidAttributeName(attributeName))
+    if (!attributeName.startsWith("data-"))
         return false;
 
-    String convertedName = convertAttributeNameToPropertyName(attributeName);
-    return (convertedName == propertyName);
+    const UChar* property = propertyName.characters();
+    const UChar* attribute = attributeName.characters();
+    unsigned propertyLength = propertyName.length();
+    unsigned attributeLength = attributeName.length();
+   
+    unsigned a = 5;
+    unsigned p = 0;
+    bool wordBoundary = false;
+    while (a < attributeLength && p < propertyLength) {
+        if (attribute[a] == '-' && a + 1 < attributeLength && attribute[a + 1] != '-')
+            wordBoundary = true;
+        else {
+            if ((wordBoundary ? toASCIIUpper(attribute[a]) : attribute[a]) != property[p])
+                return false;
+            p++;
+            wordBoundary = false;
+        }
+        a++;
+    }
+
+    return (a == attributeLength && p == propertyLength);
 }
 
 static bool isValidPropertyName(const String& name)
diff --git a/Source/WebCore/dom/Document.cpp b/Source/WebCore/dom/Document.cpp
index a2a8040..233b798 100644
--- a/Source/WebCore/dom/Document.cpp
+++ b/Source/WebCore/dom/Document.cpp
@@ -7,7 +7,6 @@
  * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  * Copyright (C) 2008, 2009 Google Inc. All rights reserved.
  * Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies)
- * Copyright (C) Research In Motion, Limited 2010-2011.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -30,7 +29,6 @@
 
 #include "AXObjectCache.h"
 #include "AnimationController.h"
-#include "AsyncScriptRunner.h"
 #include "Attr.h"
 #include "Attribute.h"
 #include "CDATASection.h"
@@ -44,6 +42,7 @@
 #include "ChromeClient.h"
 #include "Comment.h"
 #include "Console.h"
+#include "ContentSecurityPolicy.h"
 #include "CookieJar.h"
 #include "CustomEvent.h"
 #include "DateComponents.h"
@@ -120,6 +119,7 @@
 #include "RegisteredEventListener.h"
 #include "RenderArena.h"
 #include "RenderLayer.h"
+#include "RenderLayerBacking.h"
 #include "RenderTextControl.h"
 #include "RenderView.h"
 #include "RenderWidget.h"
@@ -128,6 +128,7 @@
 #include "ScriptController.h"
 #include "ScriptElement.h"
 #include "ScriptEventListener.h"
+#include "ScriptRunner.h"
 #include "SecurityOrigin.h"
 #include "SegmentedString.h"
 #include "SelectionController.h"
@@ -333,7 +334,7 @@ static Widget* widgetForNode(Node* focusedNode)
 static bool acceptsEditingFocus(Node* node)
 {
     ASSERT(node);
-    ASSERT(node->isContentEditable());
+    ASSERT(node->rendererIsEditable());
 
     Node* root = node->rootEditableElement();
     Frame* frame = node->document()->frame();
@@ -358,7 +359,7 @@ static bool disableRangeMutation(Page* page)
 
 static HashSet<Document*>* documentsThatNeedStyleRecalc = 0;
 
-class DocumentWeakReference : public ThreadSafeShared<DocumentWeakReference> {
+class DocumentWeakReference : public ThreadSafeRefCounted<DocumentWeakReference> {
 public:
     static PassRefPtr<DocumentWeakReference> create(Document* document)
     {
@@ -387,14 +388,20 @@ private:
     Document* m_document;
 };
 
+uint64_t Document::s_globalTreeVersion = 0;
+
 Document::Document(Frame* frame, const KURL& url, bool isXHTML, bool isHTML)
     : ContainerNode(0)
     , m_compatibilityMode(NoQuirksMode)
     , m_compatibilityModeLocked(false)
+<<<<<<< HEAD
     , m_domTreeVersion(0)
 #ifdef ANDROID_STYLE_VERSION
     , m_styleVersion(0)
 #endif
+=======
+    , m_domTreeVersion(++s_globalTreeVersion)
+>>>>>>> webkit.org at r82507
     , m_styleSheets(StyleSheetList::create(this))
     , m_readyState(Complete)
     , m_styleRecalcTimer(this, &Document::styleRecalcTimerFired)
@@ -410,7 +417,7 @@ Document::Document(Frame* frame, const KURL& url, bool isXHTML, bool isHTML)
     , m_startTime(currentTime())
     , m_overMinimumLayoutThreshold(false)
     , m_extraLayoutDelay(0)
-    , m_asyncScriptRunner(AsyncScriptRunner::create(this))
+    , m_scriptRunner(ScriptRunner::create(this))
     , m_xmlVersion("1.0")
     , m_xmlStandalone(false)
     , m_savedRenderer(0)
@@ -454,7 +461,6 @@ Document::Document(Frame* frame, const KURL& url, bool isXHTML, bool isHTML)
     , m_writingModeSetOnDocumentElement(false)
     , m_writeRecursionIsTooDeep(false)
     , m_writeRecursionDepth(0)
-    , m_pendingTasksTimer(this, &Document::pendingTasksTimerFired)
 {
     m_document = this;
 
@@ -563,6 +569,11 @@ void Document::removedLastRef()
 
         m_cssCanvasElements.clear();
 
+#if ENABLE(REQUEST_ANIMATION_FRAME)
+        // FIXME: consider using ActiveDOMObject.
+        m_scriptedAnimationController = 0;
+#endif
+
 #ifndef NDEBUG
         m_inRemovedLastRefFunction = false;
 #endif
@@ -584,7 +595,7 @@ Document::~Document()
     ASSERT(m_ranges.isEmpty());
     ASSERT(!m_styleRecalcTimer.isActive());
 
-    m_asyncScriptRunner.clear();
+    m_scriptRunner.clear();
 
     removeAllEventListeners();
 
@@ -1345,43 +1356,51 @@ static inline String canonicalizedTitle(Document* document, const String& title)
     return String::adopt(buffer);
 }
 
-void Document::updateTitle()
+void Document::updateTitle(const String& title)
 {
+    if (m_rawTitle == title)
+        return;
+
+    m_rawTitle = title;
     m_title = canonicalizedTitle(this, m_rawTitle);
     if (Frame* f = frame())
         f->loader()->setTitle(m_title);
 }
 
-void Document::setTitle(const String& title, Element* titleElement)
+void Document::setTitle(const String& title)
 {
-    if (!titleElement) {
-        // Title set by JavaScript -- overrides any title elements.
-        m_titleSetExplicitly = true;
-        if (!isHTMLDocument())
-            m_titleElement = 0;
-        else if (!m_titleElement) {
-            if (HTMLElement* headElement = head()) {
-                m_titleElement = createElement(titleTag, false);
-                ExceptionCode ec = 0;
-                headElement->appendChild(m_titleElement, ec);
-                ASSERT(!ec);
-            }
+    // Title set by JavaScript -- overrides any title elements.
+    m_titleSetExplicitly = true;
+    if (!isHTMLDocument())
+        m_titleElement = 0;
+    else if (!m_titleElement) {
+        if (HTMLElement* headElement = head()) {
+            m_titleElement = createElement(titleTag, false);
+            ExceptionCode ec = 0;
+            headElement->appendChild(m_titleElement, ec);
+            ASSERT(!ec);
         }
-    } else if (titleElement != m_titleElement) {
+    }
+
+    updateTitle(title);
+
+    if (m_titleElement) {
+        ASSERT(m_titleElement->hasTagName(titleTag));
+        if (m_titleElement->hasTagName(titleTag))
+            static_cast<HTMLTitleElement*>(m_titleElement.get())->setText(m_title);
+    }
+}
+
+void Document::setTitleElement(const String& title, Element* titleElement)
+{
+    if (titleElement != m_titleElement) {
         if (m_titleElement || m_titleSetExplicitly)
             // Only allow the first title element to change the title -- others have no effect.
             return;
         m_titleElement = titleElement;
     }
 
-    if (m_rawTitle == title)
-        return;
-
-    m_rawTitle = title;
-    updateTitle();
-
-    if (m_titleSetExplicitly && m_titleElement && m_titleElement->hasTagName(titleTag) && !titleElement)
-        static_cast<HTMLTitleElement*>(m_titleElement.get())->setText(m_title);
+    updateTitle(title);
 }
 
 void Document::removeTitle(Element* titleElement)
@@ -1397,15 +1416,13 @@ void Document::removeTitle(Element* titleElement)
         for (Node* e = headElement->firstChild(); e; e = e->nextSibling())
             if (e->hasTagName(titleTag)) {
                 HTMLTitleElement* titleElement = static_cast<HTMLTitleElement*>(e);
-                setTitle(titleElement->text(), titleElement);
+                setTitleElement(titleElement->text(), titleElement);
                 break;
             }
     }
 
-    if (!m_titleElement && !m_rawTitle.isEmpty()) {
-        m_rawTitle = "";
-        updateTitle();
-    }
+    if (!m_titleElement)
+        updateTitle("");
 }
 
 String Document::nodeName() const
@@ -1793,7 +1810,12 @@ void Document::detach()
 
     clearAXObjectCache();
     stopActiveDOMObjects();
-    
+
+#if ENABLE(REQUEST_ANIMATION_FRAME)
+    // FIXME: consider using ActiveDOMObject.
+    m_scriptedAnimationController = 0;
+#endif
+
     RenderObject* render = renderer();
 
     // Send out documentWillBecomeInactive() notifications to registered elements,
@@ -3994,7 +4016,7 @@ void Document::setInPageCache(bool flag)
         ASSERT(!m_savedRenderer);
         m_savedRenderer = renderer();
         if (FrameView* v = view())
-            v->resetScrollbars();
+            v->resetScrollbarsAndClearContentsSize();
         m_styleRecalcTimer.stop();
     } else {
         ASSERT(!renderer() || renderer() == m_savedRenderer);
@@ -4486,7 +4508,7 @@ void FormElementKey::deref() const
 
 unsigned FormElementKeyHash::hash(const FormElementKey& key)
 {
-    return WTF::StringHasher::createBlobHash<sizeof(FormElementKey)>(&key);
+    return StringHasher::hashMemory<sizeof(FormElementKey)>(&key);
 }
 
 void Document::setIconURL(const String& iconURL, const String& type)
@@ -4551,7 +4573,7 @@ void Document::initSecurityContext()
     // loading URL with a fresh content security policy.
     m_cookieURL = m_url;
     ScriptExecutionContext::setSecurityOrigin(SecurityOrigin::create(m_url, m_frame->loader()->sandboxFlags()));
-    m_contentSecurityPolicy = ContentSecurityPolicy::create();
+    m_contentSecurityPolicy = ContentSecurityPolicy::create(securityOrigin());
 
     if (SecurityOrigin::allowSubstituteDataAccessToLocal()) {
         // If this document was loaded with substituteData, then the document can
@@ -4780,59 +4802,22 @@ public:
     OwnPtr<ScriptExecutionContext::Task> task;
 };
 
-void Document::didReceiveTask(void* untypedContext)
+static void performTask(void* ctx)
 {
     ASSERT(isMainThread());
 
-    OwnPtr<PerformTaskContext> context = adoptPtr(static_cast<PerformTaskContext*>(untypedContext));
+    PerformTaskContext* context = reinterpret_cast<PerformTaskContext*>(ctx);
     ASSERT(context);
 
-    Document* document = context->documentReference->document();
-    if (!document)
-        return;
-
-    Page* page = document->page();
-    if ((page && page->defersLoading()) || !document->m_pendingTasks.isEmpty()) {
-        document->m_pendingTasks.append(context->task.release());
-        return;
-    }
+    if (Document* document = context->documentReference->document())
+        context->task->performTask(document);
 
-    context->task->performTask(document);
+    delete context;
 }
 
 void Document::postTask(PassOwnPtr<Task> task)
 {
-    callOnMainThread(didReceiveTask, new PerformTaskContext(m_weakReference, task));
-}
-
-void Document::pendingTasksTimerFired(Timer<Document>*)
-{
-    while (!m_pendingTasks.isEmpty()) {
-        OwnPtr<Task> task = m_pendingTasks[0].release();
-        m_pendingTasks.remove(0);
-        task->performTask(this);
-    }
-}
-
-void Document::suspendScheduledTasks()
-{
-    suspendScriptedAnimationControllerCallbacks();
-    suspendActiveDOMObjects(ActiveDOMObject::WillShowDialog);
-    asyncScriptRunner()->suspend();
-    m_pendingTasksTimer.stop();
-    if (m_parser)
-        m_parser->suspendScheduledTasks();
-}
-
-void Document::resumeScheduledTasks()
-{
-    if (m_parser)
-        m_parser->resumeScheduledTasks();
-    if (!m_pendingTasks.isEmpty())
-        m_pendingTasksTimer.startOneShot(0);
-    asyncScriptRunner()->resume();
-    resumeActiveDOMObjects();
-    resumeScriptedAnimationControllerCallbacks();
+    callOnMainThread(performTask, new PerformTaskContext(m_weakReference, task));
 }
 
 void Document::suspendScriptedAnimationControllerCallbacks()
@@ -4947,6 +4932,20 @@ bool Document::isXHTMLMPDocument() const
 #endif
 
 #if ENABLE(FULLSCREEN_API)
+bool Document::fullScreenIsAllowedForElement(Element* element) const
+{
+    ASSERT(element);
+    while (HTMLFrameOwnerElement* ownerElement = element->document()->ownerElement()) {
+        if (!ownerElement->hasTagName(frameTag) && !ownerElement->hasTagName(iframeTag))
+            continue;
+
+        if (!static_cast<HTMLFrameElementBase*>(ownerElement)->allowFullScreen())
+            return false;
+        element = ownerElement;
+    }
+    return true;
+}
+
 void Document::webkitRequestFullScreenForElement(Element* element, unsigned short flags)
 {
     if (!page() || !page()->settings()->fullScreenEnabled())
@@ -4955,7 +4954,13 @@ void Document::webkitRequestFullScreenForElement(Element* element, unsigned shor
     if (!element)
         element = documentElement();
     
-    if (!page()->chrome()->client()->supportsFullScreenForElement(element))
+    if (!fullScreenIsAllowedForElement(element))
+        return;
+    
+    if (!ScriptController::processingUserGesture())
+        return;
+    
+    if (!page()->chrome()->client()->supportsFullScreenForElement(element, flags & Element::ALLOW_KEYBOARD_INPUT))
         return;
     
     m_areKeysEnabledInFullScreen = flags & Element::ALLOW_KEYBOARD_INPUT;
@@ -4983,23 +4988,40 @@ void Document::webkitWillEnterFullScreenForElement(Element* element)
 
     recalcStyle(Force);
     
-    if (m_fullScreenRenderer)
+    if (m_fullScreenRenderer) {
         m_fullScreenRenderer->setAnimating(true);
+#if USE(ACCELERATED_COMPOSITING)
+        view()->updateCompositingLayers();
+        ASSERT(m_fullScreenRenderer->layer()->backing());
+        page()->chrome()->client()->setRootFullScreenLayer(m_fullScreenRenderer->layer()->backing()->graphicsLayer());
+#endif
+    }
 }
     
 void Document::webkitDidEnterFullScreenForElement(Element*)
 {
-    if (m_fullScreenRenderer)
+    if (m_fullScreenRenderer) {
         m_fullScreenRenderer->setAnimating(false);
+#if USE(ACCELERATED_COMPOSITING)
+        view()->updateCompositingLayers();
+        ASSERT(!m_fullScreenRenderer->layer()->backing());
+        page()->chrome()->client()->setRootFullScreenLayer(0);
+#endif
+    }
     m_fullScreenChangeDelayTimer.startOneShot(0);
 }
 
 void Document::webkitWillExitFullScreenForElement(Element*)
 {
-    if (m_fullScreenRenderer)
+    if (m_fullScreenRenderer) {
         m_fullScreenRenderer->setAnimating(true);
-
-    recalcStyle(Force);
+        m_fullScreenRenderer->setAnimating(true);
+#if USE(ACCELERATED_COMPOSITING)
+        view()->updateCompositingLayers();
+        ASSERT(m_fullScreenRenderer->layer()->backing());
+        page()->chrome()->client()->setRootFullScreenLayer(m_fullScreenRenderer->layer()->backing()->graphicsLayer());
+#endif
+    }
 }
 
 void Document::webkitDidExitFullScreenForElement(Element*)
@@ -5014,6 +5036,9 @@ void Document::webkitDidExitFullScreenForElement(Element*)
         m_fullScreenElement->detach();
     
     setFullScreenRenderer(0);
+#if USE(ACCELERATED_COMPOSITING)
+    page()->chrome()->client()->setRootFullScreenLayer(0);
+#endif
     recalcStyle(Force);
     
     m_fullScreenChangeDelayTimer.startOneShot(0);
@@ -5021,6 +5046,11 @@ void Document::webkitDidExitFullScreenForElement(Element*)
     
 void Document::setFullScreenRenderer(RenderFullScreen* renderer)
 {
+    if (renderer == m_fullScreenRenderer)
+        return;
+
+    if (m_fullScreenRenderer)
+        m_fullScreenRenderer->destroy();
     m_fullScreenRenderer = renderer;
     
     // This notification can come in after the page has been destroyed.
@@ -5041,6 +5071,7 @@ void Document::setFullScreenRendererSize(const IntSize& size)
         newStyle->setTop(Length(0, WebCore::Fixed));
         newStyle->setLeft(Length(0, WebCore::Fixed));
         m_fullScreenRenderer->setStyle(newStyle);
+        updateLayout();
     }
 }
     
diff --git a/Source/WebCore/dom/Document.h b/Source/WebCore/dom/Document.h
index ae9b24e..c9a1b55 100644
--- a/Source/WebCore/dom/Document.h
+++ b/Source/WebCore/dom/Document.h
@@ -32,7 +32,6 @@
 #include "CollectionType.h"
 #include "Color.h"
 #include "ContainerNode.h"
-#include "ContentSecurityPolicy.h"
 #include "DOMTimeStamp.h"
 #include "DocumentOrderedMap.h"
 #include "DocumentTiming.h"
@@ -51,20 +50,20 @@
 
 namespace WebCore {
 
-class AsyncScriptRunner;
-class Attr;
 class AXObjectCache;
+class Attr;
 class CDATASection;
+class CSSPrimitiveValueCache;
+class CSSStyleDeclaration;
+class CSSStyleSelector;
+class CSSStyleSheet;
 class CachedCSSStyleSheet;
 class CachedResourceLoader;
 class CachedScript;
 class CanvasRenderingContext;
 class CharacterData;
-class CSSPrimitiveValueCache;
-class CSSStyleDeclaration;
-class CSSStyleSelector;
-class CSSStyleSheet;
 class Comment;
+class ContentSecurityPolicy;
 class DOMImplementation;
 class DOMSelection;
 class DOMWindow;
@@ -115,6 +114,7 @@ class RenderView;
 class RenderFullScreen;
 class ScriptableDocumentParser;
 class ScriptElementData;
+class ScriptRunner;
 class SecurityOrigin;
 class SerializedScriptValue;
 class SegmentedString;
@@ -820,7 +820,8 @@ public:
     HTMLFrameOwnerElement* ownerElement() const;
 
     String title() const { return m_title; }
-    void setTitle(const String&, Element* titleElement = 0);
+    void setTitle(const String&);
+    void setTitleElement(const String& title, Element* titleElement);
     void removeTitle(Element* titleElement);
 
     String cookie(ExceptionCode&) const;
@@ -908,7 +909,7 @@ public:
 
     int docID() const { return m_docID; }
     
-    AsyncScriptRunner* asyncScriptRunner() { return m_asyncScriptRunner.get(); }
+    ScriptRunner* scriptRunner() { return m_scriptRunner.get(); }
 
 #if ENABLE(XSLT)
     void applyXSLTransform(ProcessingInstruction* pi);
@@ -919,8 +920,8 @@ public:
     TransformSource* transformSource() const { return m_transformSource.get(); }
 #endif
 
-    void incDOMTreeVersion() { ++m_domTreeVersion; }
-    unsigned domTreeVersion() const { return m_domTreeVersion; }
+    void incDOMTreeVersion() { m_domTreeVersion = ++s_globalTreeVersion; }
+    uint64_t domTreeVersion() const { return m_domTreeVersion; }
 
 #ifdef ANDROID_STYLE_VERSION
     void incStyleVersion() { ++m_styleVersion; }
@@ -1106,6 +1107,7 @@ public:
     void setFullScreenRendererBackgroundColor(Color);
     
     void fullScreenChangeDelayTimerFired(Timer<Document>*);
+    bool fullScreenIsAllowedForElement(Element*) const;
 #endif
 
     // Used to allow element that loads data without going through a FrameLoader to delay the 'load' event.
@@ -1135,9 +1137,6 @@ public:
 
     ContentSecurityPolicy* contentSecurityPolicy() { return m_contentSecurityPolicy.get(); }
 
-    void suspendScheduledTasks();
-    void resumeScheduledTasks();
-
 protected:
     Document(Frame*, const KURL&, bool isXHTML, bool isHTML);
 
@@ -1173,7 +1172,7 @@ private:
 
     String encoding() const;
 
-    void updateTitle();
+    void updateTitle(const String& title);
     void updateFocusAppearanceTimerFired(Timer<Document>*);
     void updateBaseURL();
 
@@ -1185,10 +1184,6 @@ private:
 
     void loadEventDelayTimerFired(Timer<Document>*);
 
-    void pendingTasksTimerFired(Timer<Document>*);
-
-    static void didReceiveTask(void*);
-
     OwnPtr<CSSStyleSelector> m_styleSelector;
     bool m_didCalculateStyleSelector;
     bool m_hasDirtyStyleSelector;
@@ -1258,10 +1253,15 @@ private:
     RefPtr<Node> m_activeNode;
     mutable RefPtr<Element> m_documentElement;
 
+<<<<<<< HEAD
     unsigned m_domTreeVersion;
 #ifdef ANDROID_STYLE_VERSION
     unsigned m_styleVersion;
 #endif
+=======
+    uint64_t m_domTreeVersion;
+    static uint64_t s_globalTreeVersion;
+>>>>>>> webkit.org at r82507
     
     HashSet<NodeIterator*> m_nodeIterators;
     HashSet<Range*> m_ranges;
@@ -1341,7 +1341,7 @@ private:
     // points during the lifetime of the Document.
     int m_extraLayoutDelay;
     
-    OwnPtr<AsyncScriptRunner> m_asyncScriptRunner;
+    OwnPtr<ScriptRunner> m_scriptRunner;
 
 #if ENABLE(XSLT)
     OwnPtr<TransformSource> m_transformSource;
@@ -1460,9 +1460,6 @@ private:
 #endif
 
     RefPtr<ContentSecurityPolicy> m_contentSecurityPolicy;
-
-    Timer<Document> m_pendingTasksTimer;
-    Vector<OwnPtr<Task> > m_pendingTasks;
 };
 
 inline bool Document::hasElementWithId(AtomicStringImpl* id) const
diff --git a/Source/WebCore/dom/Element.cpp b/Source/WebCore/dom/Element.cpp
index 41c0fb1..81668cf 100644
--- a/Source/WebCore/dom/Element.cpp
+++ b/Source/WebCore/dom/Element.cpp
@@ -55,7 +55,9 @@
 #include "RenderWidget.h"
 #include "Settings.h"
 #include "TextIterator.h"
+#include "WebKitAnimationList.h"
 #include "XMLNames.h"
+#include "htmlediting.h"
 #include <wtf/text/CString.h>
 
 #if ENABLE(SVG)
@@ -1199,6 +1201,15 @@ bool Element::childTypeAllowed(NodeType type)
     return false;
 }
 
+static void checkForEmptyStyleChange(Element* element, RenderStyle* style)
+{
+    if (!style)
+        return;
+
+    if (style->affectedByEmpty() && (!style->emptyState() || element->hasChildNodes()))
+        element->setNeedsStyleRecalc();
+}
+
 static void checkForSiblingStyleChanges(Element* e, RenderStyle* style, bool finishedParsingCallback,
                                         Node* beforeChange, Node* afterChange, int childCountDelta)
 {
@@ -1275,17 +1286,18 @@ static void checkForSiblingStyleChanges(Element* e, RenderStyle* style, bool fin
         e->setNeedsStyleRecalc();
     
     // :empty selector.
-    if (style->affectedByEmpty() && (!style->emptyState() || e->hasChildNodes()))
-        e->setNeedsStyleRecalc();
+    checkForEmptyStyleChange(e, style);
 }
 
 void Element::childrenChanged(bool changedByParser, Node* beforeChange, Node* afterChange, int childCountDelta)
 {
     ContainerNode::childrenChanged(changedByParser, beforeChange, afterChange, childCountDelta);
-    if (!changedByParser)
+    if (changedByParser)
+        checkForEmptyStyleChange(this, renderStyle());
+    else
         checkForSiblingStyleChanges(this, renderStyle(), false, beforeChange, afterChange, childCountDelta);
 }
-    
+
 void Element::beginParsingChildren()
 {
     clearIsParsingChildrenFinished();
@@ -1413,10 +1425,8 @@ PassRefPtr<Attr> Element::removeAttributeNode(Attr* attr, ExceptionCode& ec)
         ec = NOT_FOUND_ERR;
         return 0;
     }
-    if (document() != attr->document()) {
-        ec = WRONG_DOCUMENT_ERR;
-        return 0;
-    }
+
+    ASSERT(document() == attr->document());
 
     NamedNodeMap* attrs = attributes(true);
     if (!attrs)
@@ -1508,6 +1518,9 @@ CSSStyleDeclaration *Element::style()
 
 void Element::focus(bool restorePreviousSelection)
 {
+    if (!inDocument())
+        return;
+
     Document* doc = document();
     if (doc->focusedNode() == this)
         return;
@@ -1558,7 +1571,7 @@ void Element::updateFocusAppearance(bool /*restorePreviousSelection*/)
             return;
 
         // FIXME: We should restore the previous selection if there is one.
-        VisibleSelection newSelection = VisibleSelection(firstPositionInNode(this), DOWNSTREAM);
+        VisibleSelection newSelection = VisibleSelection(firstPositionInOrBeforeNode(this), DOWNSTREAM);
         
         if (frame->selection()->shouldChangeSelection(newSelection)) {
             frame->selection()->setSelection(newSelection);
@@ -1891,4 +1904,17 @@ bool Element::isSpellCheckingEnabled() const
     return true;
 }
 
+PassRefPtr<WebKitAnimationList> Element::webkitGetAnimations() const
+{
+    if (!renderer())
+        return 0;
+
+    AnimationController* animController = renderer()->animation();
+
+    if (!animController)
+        return 0;
+    
+    return animController->animationsForRenderer(renderer());
+}
+
 } // namespace WebCore
diff --git a/Source/WebCore/dom/Element.h b/Source/WebCore/dom/Element.h
index 5c54ce4..ba0870c 100644
--- a/Source/WebCore/dom/Element.h
+++ b/Source/WebCore/dom/Element.h
@@ -39,6 +39,7 @@ class DOMStringMap;
 class DOMTokenList;
 class ElementRareData;
 class IntSize;
+class WebKitAnimationList;
 
 enum SpellcheckAttributeState {
     SpellcheckAttributeTrue,
@@ -344,6 +345,8 @@ public:
 
     virtual bool isSpellCheckingEnabled() const;
 
+    PassRefPtr<WebKitAnimationList> webkitGetAnimations() const;
+
 protected:
     Element(const QualifiedName& tagName, Document* document, ConstructionType type)
         : ContainerNode(document, type)
diff --git a/Source/WebCore/dom/Element.idl b/Source/WebCore/dom/Element.idl
index 652a75b..fc28642 100644
--- a/Source/WebCore/dom/Element.idl
+++ b/Source/WebCore/dom/Element.idl
@@ -96,6 +96,8 @@ module core {
         void scrollByLines(in long lines);
         void scrollByPages(in long pages);
 
+        WebKitAnimationList webkitGetAnimations();
+
         // HTML 5
         NodeList getElementsByClassName(in DOMString name);
 
diff --git a/Source/WebCore/dom/Event.cpp b/Source/WebCore/dom/Event.cpp
index 795dace..a1352dc 100644
--- a/Source/WebCore/dom/Event.cpp
+++ b/Source/WebCore/dom/Event.cpp
@@ -22,6 +22,7 @@
 
 #include "config.h"
 #include "Event.h"
+#include "EventDispatcher.h"
 #include "EventTarget.h"
 
 #include "UserGestureIndicator.h"
@@ -270,8 +271,16 @@ void Event::storeResult(const String&)
 {
 }
 
+bool Event::dispatch(EventDispatcher* dispatcher)
+{
+    return dispatcher->dispatchEvent(this);
+}
+
 void Event::setTarget(PassRefPtr<EventTarget> target)
 {
+    if (m_target == target)
+        return;
+
     m_target = target;
     if (m_target)
         receivedTarget();
diff --git a/Source/WebCore/dom/Event.h b/Source/WebCore/dom/Event.h
index ba9576b..d4d7e06 100644
--- a/Source/WebCore/dom/Event.h
+++ b/Source/WebCore/dom/Event.h
@@ -32,6 +32,7 @@
 namespace WebCore {
 
     class EventTarget;
+    class EventDispatcher;
 
     class Event : public RefCounted<Event> {
     public:
@@ -165,6 +166,8 @@ namespace WebCore {
 
         virtual Clipboard* clipboard() const { return 0; }
 
+        virtual bool dispatch(EventDispatcher*);
+
     protected:
         Event();
         Event(const AtomicString& type, bool canBubble, bool cancelable);
diff --git a/Source/WebCore/dom/EventDispatcher.cpp b/Source/WebCore/dom/EventDispatcher.cpp
new file mode 100644
index 0000000..c8b330d
--- /dev/null
+++ b/Source/WebCore/dom/EventDispatcher.cpp
@@ -0,0 +1,396 @@
+/*
+ * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
+ *           (C) 1999 Antti Koivisto (koivisto@kde.org)
+ *           (C) 2001 Dirk Mueller (mueller@kde.org)
+ * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2010 Apple Inc. All rights reserved.
+ * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
+ * Copyright (C) 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#include "config.h"
+#include "EventDispatcher.h"
+
+#include "Event.h"
+#include "EventContext.h"
+#include "EventTarget.h"
+#include "FrameView.h"
+#include "InspectorInstrumentation.h"
+#include "MouseEvent.h"
+#include "Node.h"
+#include "PlatformWheelEvent.h"
+#include "ScopedEventQueue.h"
+
+#if ENABLE(SVG)
+#include "SVGElementInstance.h"
+#include "SVGNames.h"
+#include "SVGUseElement.h"
+#endif
+
+#include "UIEvent.h"
+#include "UIEventWithKeyState.h"
+#include "WheelEvent.h"
+#include "WindowEventContext.h"
+
+#include <wtf/RefPtr.h>
+
+namespace WebCore {
+
+static HashSet<Node*>* gNodesDispatchingSimulatedClicks = 0;
+
+bool EventDispatcher::dispatchEvent(Node* node, PassRefPtr<Event> prpEvent)
+{
+    RefPtr<Event> event = prpEvent;
+
+    EventDispatcher dispatcher(node);
+    return event->dispatch(&dispatcher);
+}
+
+static EventTarget* findElementInstance(Node* referenceNode)
+{
+#if ENABLE(SVG)
+    // Spec: The event handling for the non-exposed tree works as if the referenced element had been textually included
+    // as a deeply cloned child of the 'use' element, except that events are dispatched to the SVGElementInstance objects
+    for (Node* n = referenceNode; n; n = n->parentNode()) {
+        if (!n->isShadowRoot() || !n->isSVGElement())
+            continue;
+
+        Element* shadowTreeParentElement = n->shadowHost();
+        ASSERT(shadowTreeParentElement->hasTagName(SVGNames::useTag));
+
+        if (SVGElementInstance* instance = static_cast<SVGUseElement*>(shadowTreeParentElement)->instanceForShadowTreeElement(referenceNode))
+            return instance;
+    }
+#else
+    // SVG elements with SVG disabled should not be possible.
+    ASSERT_NOT_REACHED();
+#endif
+
+    return referenceNode;
+}
+
+inline static EventTarget* eventTargetRespectingSVGTargetRules(Node* referenceNode)
+{
+    ASSERT(referenceNode);
+
+    return referenceNode->isSVGElement() ? findElementInstance(referenceNode) : referenceNode;
+}
+
+void EventDispatcher::dispatchScopedEvent(Node* node, PassRefPtr<Event> event)
+{
+    // We need to set the target here because it can go away by the time we actually fire the event.
+    event->setTarget(eventTargetRespectingSVGTargetRules(node));
+
+    ScopedEventQueue::instance()->enqueueEvent(event);
+}
+
+void EventDispatcher::dispatchSimulatedClick(Node* node, PassRefPtr<Event> underlyingEvent, bool sendMouseEvents, bool showPressedLook)
+{
+    EventDispatcher dispatcher(node);
+
+    if (!gNodesDispatchingSimulatedClicks)
+        gNodesDispatchingSimulatedClicks = new HashSet<Node*>;
+    else if (gNodesDispatchingSimulatedClicks->contains(node))
+        return;
+
+    gNodesDispatchingSimulatedClicks->add(node);
+
+    // send mousedown and mouseup before the click, if requested
+    if (sendMouseEvents)
+        dispatcher.dispatchEvent(SimulatedMouseEvent::create(eventNames().mousedownEvent, node->document()->defaultView(), underlyingEvent));
+    node->setActive(true, showPressedLook);
+    if (sendMouseEvents)
+        dispatcher.dispatchEvent(SimulatedMouseEvent::create(eventNames().mouseupEvent, node->document()->defaultView(), underlyingEvent));
+    node->setActive(false);
+
+    // always send click
+    dispatcher.dispatchEvent(SimulatedMouseEvent::create(eventNames().clickEvent, node->document()->defaultView(), underlyingEvent));
+
+    gNodesDispatchingSimulatedClicks->remove(node);
+}
+
+inline static WheelEvent::Granularity granularity(const PlatformWheelEvent& event)
+{
+    return event.granularity() == ScrollByPageWheelEvent ? WheelEvent::Page : WheelEvent::Pixel;
+}
+
+void EventDispatcher::dispatchWheelEvent(Node* node, PlatformWheelEvent& event)
+{
+    ASSERT(!eventDispatchForbidden());
+    if (!(event.deltaX() || event.deltaY()))
+        return;
+
+    EventDispatcher dispatcher(node);
+
+    if (!dispatcher.m_view)
+        return;
+
+    IntPoint position = dispatcher.m_view->windowToContents(event.pos());
+
+    int adjustedPageX = position.x();
+    int adjustedPageY = position.y();
+    if (Frame* frame = node->document()->frame()) {
+        float pageZoom = frame->pageZoomFactor();
+        if (pageZoom != 1.0f) {
+            adjustedPageX = lroundf(position.x() / pageZoom);
+            adjustedPageY = lroundf(position.y() / pageZoom);
+        }
+    }
+
+    RefPtr<WheelEvent> wheelEvent = WheelEvent::create(event.wheelTicksX(), event.wheelTicksY(), event.deltaX(), event.deltaY(), granularity(event),
+        node->document()->defaultView(), event.globalX(), event.globalY(), adjustedPageX, adjustedPageY,
+        event.ctrlKey(), event.altKey(), event.shiftKey(), event.metaKey());
+
+    wheelEvent->setAbsoluteLocation(position);
+
+    if (!dispatcher.dispatchEvent(wheelEvent) || wheelEvent->defaultHandled())
+        event.accept();
+
+}
+
+// FIXME: Once https://bugs.webkit.org/show_bug.cgi?id=52963 lands, this should
+// be greatly improved. See https://bugs.webkit.org/show_bug.cgi?id=54025.
+static Node* pullOutOfShadow(Node* node)
+{
+    Node* outermostShadowBoundary = node;
+    for (Node* n = node; n; n = n->parentOrHostNode()) {
+        if (n->isShadowRoot())
+            outermostShadowBoundary = n->parentOrHostNode();
+    }
+    return outermostShadowBoundary;
+}
+
+EventDispatcher::EventDispatcher(Node* node)
+    : m_node(node)
+{
+    ASSERT(node);
+    m_view = node->document()->view();
+}
+
+void EventDispatcher::getEventAncestors(EventTarget* originalTarget, EventDispatchBehavior behavior)
+{
+    if (!m_node->inDocument())
+        return;
+
+    if (ancestorsInitialized())
+        return;
+
+    EventTarget* target = originalTarget;
+    Node* ancestor = m_node.get();
+    bool shouldSkipNextAncestor = false;
+    while (true) {
+        if (ancestor->isShadowRoot()) {
+            if (behavior == StayInsideShadowDOM)
+                return;
+            ancestor = ancestor->shadowHost();
+            if (!shouldSkipNextAncestor)
+                target = ancestor;
+        } else
+            ancestor = ancestor->parentNodeGuaranteedHostFree();
+
+        if (!ancestor)
+            return;
+
+#if ENABLE(SVG)
+        // Skip SVGShadowTreeRootElement.
+        shouldSkipNextAncestor = ancestor->isSVGElement() && ancestor->isShadowRoot();
+        if (shouldSkipNextAncestor)
+            continue;
+#endif
+        // FIXME: Unroll the extra loop inside eventTargetRespectingSVGTargetRules into this loop.
+        m_ancestors.append(EventContext(ancestor, eventTargetRespectingSVGTargetRules(ancestor), target));
+    }
+}
+
+bool EventDispatcher::dispatchEvent(PassRefPtr<Event> event)
+{
+    event->setTarget(eventTargetRespectingSVGTargetRules(m_node.get()));
+
+    ASSERT(!eventDispatchForbidden());
+    ASSERT(event->target());
+    ASSERT(!event->type().isNull()); // JavaScript code can create an event with an empty name, but not null.
+
+    RefPtr<EventTarget> originalTarget = event->target();
+    getEventAncestors(originalTarget.get(), determineDispatchBehavior(event.get()));
+
+    WindowEventContext windowContext(event.get(), m_node.get(), topEventContext());
+
+    InspectorInstrumentationCookie cookie = InspectorInstrumentation::willDispatchEvent(m_node->document(), *event, windowContext.window(), m_node.get(), m_ancestors);
+
+    // Give the target node a chance to do some work before DOM event handlers get a crack.
+    void* data = m_node->preDispatchEventHandler(event.get());
+    if (event->propagationStopped())
+        goto doneDispatching;
+
+    // Trigger capturing event handlers, starting at the top and working our way down.
+    event->setEventPhase(Event::CAPTURING_PHASE);
+
+    if (windowContext.handleLocalEvents(event.get()) && event->propagationStopped())
+        goto doneDispatching;
+
+    for (size_t i = m_ancestors.size(); i; --i) {
+        m_ancestors[i - 1].handleLocalEvents(event.get());
+        if (event->propagationStopped())
+            goto doneDispatching;
+    }
+
+    event->setEventPhase(Event::AT_TARGET);
+    event->setTarget(originalTarget.get());
+    event->setCurrentTarget(eventTargetRespectingSVGTargetRules(m_node.get()));
+    m_node->handleLocalEvents(event.get());
+    if (event->propagationStopped())
+        goto doneDispatching;
+
+    if (event->bubbles() && !event->cancelBubble()) {
+        // Trigger bubbling event handlers, starting at the bottom and working our way up.
+        event->setEventPhase(Event::BUBBLING_PHASE);
+
+        size_t size = m_ancestors.size();
+        for (size_t i = 0; i < size; ++i) {
+            m_ancestors[i].handleLocalEvents(event.get());
+            if (event->propagationStopped() || event->cancelBubble())
+                goto doneDispatching;
+        }
+        windowContext.handleLocalEvents(event.get());
+    }
+
+doneDispatching:
+    event->setTarget(originalTarget.get());
+    event->setCurrentTarget(0);
+    event->setEventPhase(0);
+
+    // Pass the data from the preDispatchEventHandler to the postDispatchEventHandler.
+    m_node->postDispatchEventHandler(event.get(), data);
+
+    // Call default event handlers. While the DOM does have a concept of preventing
+    // default handling, the detail of which handlers are called is an internal
+    // implementation detail and not part of the DOM.
+    if (!event->defaultPrevented() && !event->defaultHandled()) {
+        // Non-bubbling events call only one default event handler, the one for the target.
+        m_node->defaultEventHandler(event.get());
+        ASSERT(!event->defaultPrevented());
+        if (event->defaultHandled())
+            goto doneWithDefault;
+        // For bubbling events, call default event handlers on the same targets in the
+        // same order as the bubbling phase.
+        if (event->bubbles()) {
+            size_t size = m_ancestors.size();
+            for (size_t i = 0; i < size; ++i) {
+                m_ancestors[i].node()->defaultEventHandler(event.get());
+                ASSERT(!event->defaultPrevented());
+                if (event->defaultHandled())
+                    goto doneWithDefault;
+            }
+        }
+    }
+
+doneWithDefault:
+
+    // Ensure that after event dispatch, the event's target object is the
+    // outermost shadow DOM boundary.
+    event->setTarget(windowContext.target());
+    event->setCurrentTarget(0);
+    InspectorInstrumentation::didDispatchEvent(cookie);
+
+    return !event->defaultPrevented();
+}
+bool EventDispatcher::dispatchMouseEvent(Node* node, const PlatformMouseEvent& event, const AtomicString& eventType,
+    int detail, Node* relatedTargetArg)
+{
+    ASSERT(!eventDispatchForbidden());
+    ASSERT(event.eventType() == MouseEventMoved || event.button() != NoButton);
+
+    if (node->disabled()) // Don't even send DOM events for disabled controls..
+        return true;
+
+    if (eventType.isEmpty())
+        return false; // Shouldn't happen.
+
+    EventDispatcher dispatcher(node);
+
+    // Attempting to dispatch with a non-EventTarget relatedTarget causes the relatedTarget to be silently ignored.
+    RefPtr<Node> relatedTarget = pullOutOfShadow(relatedTargetArg);
+
+    IntPoint contentsPosition;
+    if (FrameView* view = node->document()->view())
+        contentsPosition = view->windowToContents(event.pos());
+
+    IntPoint adjustedPagePosition = contentsPosition;
+    if (Frame* frame = node->document()->frame()) {
+        float pageZoom = frame->pageZoomFactor();
+        if (pageZoom != 1.0f) {
+            // Adjust our pageX and pageY to account for the page zoom.
+            adjustedPagePosition.setX(lroundf(contentsPosition.x() / pageZoom));
+            adjustedPagePosition.setY(lroundf(contentsPosition.y() / pageZoom));
+        }
+    }
+
+    RefPtr<MouseEvent> mouseEvent = MouseEvent::create(eventType, node->document()->defaultView(), event, adjustedPagePosition, detail, relatedTarget);
+    mouseEvent->setAbsoluteLocation(contentsPosition);
+
+    bool swallowEvent = false;
+
+    dispatcher.dispatchEvent(mouseEvent);
+    bool defaultHandled = mouseEvent->defaultHandled();
+    bool defaultPrevented = mouseEvent->defaultPrevented();
+    if (defaultHandled || defaultPrevented)
+        swallowEvent = true;
+
+    // Special case: If it's a double click event, we also send the dblclick event. This is not part
+    // of the DOM specs, but is used for compatibility with the ondblclick="" attribute. This is treated
+    // as a separate event in other DOM-compliant browsers like Firefox, and so we do the same.
+    if (eventType == eventNames().clickEvent && detail == 2) {
+        RefPtr<Event> doubleClickEvent = MouseEvent::create(eventNames().dblclickEvent, node->document()->defaultView(), event, adjustedPagePosition, detail, relatedTarget);
+        if (defaultHandled)
+            doubleClickEvent->setDefaultHandled();
+        dispatcher.dispatchEvent(doubleClickEvent);
+        if (doubleClickEvent->defaultHandled() || doubleClickEvent->defaultPrevented())
+            swallowEvent = true;
+    }
+
+    return swallowEvent;
+}
+
+const EventContext* EventDispatcher::topEventContext()
+{
+    return m_ancestors.isEmpty() ? 0 : &m_ancestors.last();
+}
+
+bool EventDispatcher::ancestorsInitialized() const
+{
+    return m_ancestors.size();
+}
+
+EventDispatchBehavior EventDispatcher::determineDispatchBehavior(Event* event)
+{
+    // Per XBL 2.0 spec, mutation events should never cross shadow DOM boundary:
+    // http://dev.w3.org/2006/xbl2/#event-flow-and-targeting-across-shadow-s
+    if (event->isMutationEvent())
+        return StayInsideShadowDOM;
+
+    // WebKit never allowed selectstart event to cross the the shadow DOM boundary.
+    // Changing this breaks existing sites.
+    // See https://bugs.webkit.org/show_bug.cgi?id=52195 for details.
+    if (event->type() == eventNames().selectstartEvent)
+        return StayInsideShadowDOM;
+
+    return RetargetEvent;
+}
+
+}
+
diff --git a/Source/WebCore/dom/EventDispatcher.h b/Source/WebCore/dom/EventDispatcher.h
new file mode 100644
index 0000000..d43127f
--- /dev/null
+++ b/Source/WebCore/dom/EventDispatcher.h
@@ -0,0 +1,78 @@
+/*
+ * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
+ *           (C) 1999 Antti Koivisto (koivisto@kde.org)
+ *           (C) 2001 Dirk Mueller (mueller@kde.org)
+ * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2010 Apple Inc. All rights reserved.
+ * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
+ * Copyright (C) 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#ifndef EventDispatcher_h
+#define EventDispatcher_h
+
+#include <wtf/Forward.h>
+#include <wtf/Vector.h>
+
+namespace WebCore {
+
+class Event;
+class EventContext;
+class EventTarget;
+class FrameView;
+class Node;
+class PlatformKeyboardEvent;
+class PlatformMouseEvent;
+class PlatformWheelEvent;
+
+enum EventDispatchBehavior {
+    RetargetEvent,
+    StayInsideShadowDOM
+};
+
+class EventDispatcher {
+public:
+    static bool dispatchEvent(Node*, PassRefPtr<Event>);
+    static void dispatchScopedEvent(Node*, PassRefPtr<Event>);
+
+    static bool dispatchMouseEvent(Node*, const PlatformMouseEvent&, const AtomicString& eventType, int clickCount = 0, Node* relatedTarget = 0);
+    static void dispatchSimulatedClick(Node*, PassRefPtr<Event> underlyingEvent, bool sendMouseEvents, bool showPressedLook);
+    static void dispatchWheelEvent(Node*, PlatformWheelEvent&);
+
+    bool dispatchEvent(PassRefPtr<Event>);
+private:
+    EventDispatcher(Node*);
+
+    EventDispatchBehavior determineDispatchBehavior(Event*);
+    void getEventAncestors(EventTarget* originalTarget, EventDispatchBehavior);
+    const EventContext* topEventContext();
+    bool ancestorsInitialized() const;
+
+    bool dispatchMouseEvent(const AtomicString& eventType, int button, int detail,
+        int pageX, int pageY, int screenX, int screenY, bool ctrlKey, bool altKey, bool shiftKey, bool metaKey,
+        bool isSimulated, Node* relatedTargetArg, PassRefPtr<Event> underlyingEvent);
+
+    Vector<EventContext> m_ancestors;
+    RefPtr<Node> m_node;
+    RefPtr<EventTarget> m_originalTarget;
+    RefPtr<FrameView> m_view;
+};
+
+}
+
+#endif
diff --git a/Source/WebCore/dom/ExceptionCode.h b/Source/WebCore/dom/ExceptionCode.h
index dd976c7..881c3a3 100644
--- a/Source/WebCore/dom/ExceptionCode.h
+++ b/Source/WebCore/dom/ExceptionCode.h
@@ -57,13 +57,13 @@ namespace WebCore {
         NETWORK_ERR = 19,
         ABORT_ERR = 20,
         URL_MISMATCH_ERR = 21,
-        QUOTA_EXCEEDED_ERR = 22,
+        QUOTA_EXCEEDED_ERR = 22
 
         // Introduced in File API:
         // http://www.w3.org/TR/file-upload/#dfn-fileerror
 #if ENABLE(BLOB) || ENABLE(FILE_SYSTEM)
-        NOT_READABLE_ERR = 24,
-        ENCODING_ERR = 26,
+        , NOT_READABLE_ERR = 24
+        , ENCODING_ERR = 26
 #endif
     };
 
diff --git a/Source/WebCore/dom/InputElement.cpp b/Source/WebCore/dom/InputElement.cpp
index b60fd44..b467df3 100644
--- a/Source/WebCore/dom/InputElement.cpp
+++ b/Source/WebCore/dom/InputElement.cpp
@@ -38,22 +38,13 @@
 #include "Event.h"
 #include "EventNames.h"
 #include "Frame.h"
-#include "HTMLInputElement.h"
-#include "HTMLNames.h"
 #include "Page.h"
 #include "RenderTextControlSingleLine.h"
 #include "SelectionController.h"
 #include "TextIterator.h"
 
-#if ENABLE(WML)
-#include "WMLInputElement.h"
-#include "WMLNames.h"
-#endif
-
 namespace WebCore {
 
-using namespace HTMLNames;
-
 // FIXME: According to HTML4, the length attribute's value can be arbitrarily
 // large. However, due to https://bugs.webkit.org/show_bug.cgi?id=14536 things
 // get rather sluggish when a text field has a larger number of characters than
@@ -287,19 +278,6 @@ const AtomicString& InputElementData::name() const
     return m_name.isNull() ? emptyAtom : m_name;
 }
 
-InputElement* toInputElement(Element* element)
-{
-    if (element->isHTMLElement() && (element->hasTagName(inputTag) || element->hasTagName(isindexTag)))
-        return static_cast<HTMLInputElement*>(element);
-
-#if ENABLE(WML)
-    if (element->isWMLElement() && element->hasTagName(WMLNames::inputTag))
-        return static_cast<WMLInputElement*>(element);
-#endif
-
-    return 0;
-}
-
 #if ENABLE(WCSS)
 static inline const AtomicString& formatCodes()
 {
diff --git a/Source/WebCore/dom/InputElement.h b/Source/WebCore/dom/InputElement.h
index 838adf5..26bf58d 100644
--- a/Source/WebCore/dom/InputElement.h
+++ b/Source/WebCore/dom/InputElement.h
@@ -160,8 +160,6 @@ private:
 #endif
 };
 
-InputElement* toInputElement(Element*);
-
 }
 
 #endif
diff --git a/Source/WebCore/dom/KeyboardEvent.cpp b/Source/WebCore/dom/KeyboardEvent.cpp
index 7b0f3af..109135d 100644
--- a/Source/WebCore/dom/KeyboardEvent.cpp
+++ b/Source/WebCore/dom/KeyboardEvent.cpp
@@ -25,6 +25,7 @@
 
 #include "Document.h"
 #include "DOMWindow.h"
+#include "EventDispatcher.h"
 #include "EventNames.h"
 #include "EventHandler.h"
 #include "Frame.h"
@@ -160,4 +161,10 @@ KeyboardEvent* findKeyboardEvent(Event* event)
     return 0;
 }
 
+bool KeyboardEvent::dispatch(EventDispatcher* dispatcher)
+{
+    // Make sure not to return true if we already took default action while handling the event.
+    return dispatcher->dispatchEvent(this) && !defaultHandled();
+}
+
 } // namespace WebCore
diff --git a/Source/WebCore/dom/KeyboardEvent.h b/Source/WebCore/dom/KeyboardEvent.h
index eeaef80..ebdb9c8 100644
--- a/Source/WebCore/dom/KeyboardEvent.h
+++ b/Source/WebCore/dom/KeyboardEvent.h
@@ -29,6 +29,8 @@
 
 namespace WebCore {
 
+    class EventDispatcher;
+    class Node;
     class PlatformKeyboardEvent;
 
 #if PLATFORM(MAC)
@@ -99,6 +101,7 @@ namespace WebCore {
         KeyboardEvent(const AtomicString& type, bool canBubble, bool cancelable, AbstractView*,
                       const String& keyIdentifier, unsigned keyLocation,
                       bool ctrlKey, bool altKey, bool shiftKey, bool metaKey, bool altGraphKey);
+        virtual bool dispatch(EventDispatcher*);
 
         OwnPtr<PlatformKeyboardEvent> m_keyEvent;
         String m_keyIdentifier;
diff --git a/Source/WebCore/dom/MouseEvent.cpp b/Source/WebCore/dom/MouseEvent.cpp
index bdd39d3..0acbd74 100644
--- a/Source/WebCore/dom/MouseEvent.cpp
+++ b/Source/WebCore/dom/MouseEvent.cpp
@@ -23,10 +23,23 @@
 #include "config.h"
 #include "MouseEvent.h"
 
+#include "Frame.h"
+#include "FrameView.h"
 #include "EventNames.h"
+#include "PlatformMouseEvent.h"
 
 namespace WebCore {
 
+PassRefPtr<MouseEvent> MouseEvent::create(const AtomicString& eventType, PassRefPtr<AbstractView> view, const PlatformMouseEvent& event, const IntPoint& position, int detail, PassRefPtr<Node> relatedTarget)
+{
+    bool isCancelable = eventType != eventNames().mousemoveEvent;
+
+    return MouseEvent::create(eventType, true, isCancelable, view,
+        detail, event.globalX(), event.globalY(), position.x(), position.y(),
+        event.ctrlKey(), event.altKey(), event.shiftKey(), event.metaKey(), event.button(),
+        relatedTarget, 0, false);
+}
+
 MouseEvent::MouseEvent()
     : m_button(0)
     , m_buttonDown(false)
@@ -115,4 +128,25 @@ Node* MouseEvent::fromElement() const
     return target() ? target()->toNode() : 0;
 }
 
+PassRefPtr<SimulatedMouseEvent> SimulatedMouseEvent::create(const AtomicString& eventType, PassRefPtr<AbstractView> view, PassRefPtr<Event> underlyingEvent)
+{
+    return adoptRef(new SimulatedMouseEvent(eventType, view, underlyingEvent));
+}
+
+SimulatedMouseEvent::~SimulatedMouseEvent()
+{
+}
+
+SimulatedMouseEvent::SimulatedMouseEvent(const AtomicString& eventType, PassRefPtr<AbstractView> view, PassRefPtr<Event> underlyingEvent)
+    : MouseEvent(eventType, true, true, view, 0, 0, 0, 0, 0, false, false, false, false, 0, 0, 0, true)
+{
+    if (UIEventWithKeyState* keyStateEvent = findEventWithKeyState(underlyingEvent.get())) {
+        m_ctrlKey = keyStateEvent->ctrlKey();
+        m_altKey = keyStateEvent->altKey();
+        m_shiftKey = keyStateEvent->shiftKey();
+        m_metaKey = keyStateEvent->metaKey();
+    }
+    setUnderlyingEvent(underlyingEvent);
+}
+
 } // namespace WebCore
diff --git a/Source/WebCore/dom/MouseEvent.h b/Source/WebCore/dom/MouseEvent.h
index 7454b04..06e6218 100644
--- a/Source/WebCore/dom/MouseEvent.h
+++ b/Source/WebCore/dom/MouseEvent.h
@@ -29,6 +29,8 @@
 
 namespace WebCore {
 
+class PlatformMouseEvent;
+
     // Introduced in DOM Level 2
     class MouseEvent : public MouseRelatedEvent {
     public:
@@ -44,6 +46,8 @@ namespace WebCore {
             return adoptRef(new MouseEvent(type, canBubble, cancelable, view, detail, screenX, screenY, pageX, pageY,
                 ctrlKey, altKey, shiftKey, metaKey, button, relatedTarget, clipboard, isSimulated));
         }
+        static PassRefPtr<MouseEvent> create(const AtomicString& eventType, PassRefPtr<AbstractView>, const PlatformMouseEvent&, const IntPoint&, int detail, PassRefPtr<Node> relatedTarget);
+
         virtual ~MouseEvent();
 
         void initMouseEvent(const AtomicString& type, bool canBubble, bool cancelable, PassRefPtr<AbstractView>,
@@ -68,19 +72,30 @@ namespace WebCore {
         virtual bool isDragEvent() const;
         virtual int which() const;
 
-    private:
-        MouseEvent();
+    protected:
         MouseEvent(const AtomicString& type, bool canBubble, bool cancelable, PassRefPtr<AbstractView>,
                    int detail, int screenX, int screenY, int pageX, int pageY,
                    bool ctrlKey, bool altKey, bool shiftKey, bool metaKey, unsigned short button,
                    PassRefPtr<EventTarget> relatedTarget, PassRefPtr<Clipboard> clipboard, bool isSimulated);
 
+    private:
+        MouseEvent();
+
         unsigned short m_button;
         bool m_buttonDown;
         RefPtr<EventTarget> m_relatedTarget;
         RefPtr<Clipboard> m_clipboard;
     };
 
+class SimulatedMouseEvent : public MouseEvent {
+public:
+    static PassRefPtr<SimulatedMouseEvent> create(const AtomicString& eventType, PassRefPtr<AbstractView>, PassRefPtr<Event> underlyingEvent);
+    virtual ~SimulatedMouseEvent();
+
+private:
+    SimulatedMouseEvent(const AtomicString& eventType, PassRefPtr<AbstractView>, PassRefPtr<Event> underlyingEvent);
+};
+
 } // namespace WebCore
 
 #endif // MouseEvent_h
diff --git a/Source/WebCore/dom/MouseRelatedEvent.cpp b/Source/WebCore/dom/MouseRelatedEvent.cpp
index 072656e..f752670 100644
--- a/Source/WebCore/dom/MouseRelatedEvent.cpp
+++ b/Source/WebCore/dom/MouseRelatedEvent.cpp
@@ -44,6 +44,7 @@ MouseRelatedEvent::MouseRelatedEvent()
     , m_offsetX(0)
     , m_offsetY(0)
     , m_isSimulated(false)
+    , m_hasCachedRelativePosition(false)
 {
 }
 
@@ -91,21 +92,20 @@ MouseRelatedEvent::MouseRelatedEvent(const AtomicString& eventType, bool canBubb
 void MouseRelatedEvent::initCoordinates()
 {
     // Set up initial values for coordinates.
-    // Correct values can't be computed until we have at target, so receivedTarget
-    // does the "real" computation.
+    // Correct values are computed lazily, see computeRelativePosition.
     m_layerX = m_pageX;
     m_layerY = m_pageY;
     m_offsetX = m_pageX;
     m_offsetY = m_pageY;
 
     computePageLocation();
+    m_hasCachedRelativePosition = false;
 }
 
 void MouseRelatedEvent::initCoordinates(int clientX, int clientY)
 {
     // Set up initial values for coordinates.
-    // Correct values can't be computed until we have at target, so receivedTarget
-    // does the "real" computation.
+    // Correct values are computed lazily, see computeRelativePosition.
     m_clientX = clientX;
     m_clientY = clientY;
     m_pageX = clientX + contentsX(view());
@@ -116,9 +116,10 @@ void MouseRelatedEvent::initCoordinates(int clientX, int clientY)
     m_offsetY = m_pageY;
 
     computePageLocation();
+    m_hasCachedRelativePosition = false;
 }
 
-static float pageZoomFactor(UIEvent* event)
+static float pageZoomFactor(const UIEvent* event)
 {
     DOMWindow* window = event->view();
     if (!window)
@@ -137,9 +138,13 @@ void MouseRelatedEvent::computePageLocation()
 
 void MouseRelatedEvent::receivedTarget()
 {
-    ASSERT(target());
-    Node* targ = target()->toNode();
-    if (!targ)
+    m_hasCachedRelativePosition = false;
+}
+
+void MouseRelatedEvent::computeRelativePosition()
+{
+    Node* targetNode = target() ? target()->toNode() : 0;
+    if (!targetNode)
         return;
 
     // Compute coordinates that are based on the target.
@@ -149,11 +154,11 @@ void MouseRelatedEvent::receivedTarget()
     m_offsetY = m_pageY;
 
     // Must have an updated render tree for this math to work correctly.
-    targ->document()->updateStyleIfNeeded();
+    targetNode->document()->updateStyleIfNeeded();
 
     // Adjust offsetX/Y to be relative to the target's position.
     if (!isSimulated()) {
-        if (RenderObject* r = targ->renderer()) {
+        if (RenderObject* r = targetNode->renderer()) {
             FloatPoint localPos = r->absoluteToLocal(absoluteLocation(), false, true);
             float zoomFactor = pageZoomFactor(this);
             m_offsetX = lroundf(localPos.x() / zoomFactor);
@@ -166,17 +171,48 @@ void MouseRelatedEvent::receivedTarget()
     // Our RenderLayer is a more modern concept, and layerX/Y is some
     // other notion about groups of elements (left over from the Netscape 4 days?);
     // we should test and fix this.
-    Node* n = targ;
+    Node* n = targetNode;
     while (n && !n->renderer())
         n = n->parentNode();
-    if (n) {
-        RenderLayer* layer = n->renderer()->enclosingLayer();
+
+    RenderLayer* layer;
+    if (n && (layer = n->renderer()->enclosingLayer())) {
         layer->updateLayerPosition();
         for (; layer; layer = layer->parent()) {
             m_layerX -= layer->x();
             m_layerY -= layer->y();
         }
     }
+
+    m_hasCachedRelativePosition = true;
+}
+
+int MouseRelatedEvent::layerX()
+{
+    if (!m_hasCachedRelativePosition)
+        computeRelativePosition();
+    return m_layerX;
+}
+
+int MouseRelatedEvent::layerY()
+{
+    if (!m_hasCachedRelativePosition)
+        computeRelativePosition();
+    return m_layerY;
+}
+
+int MouseRelatedEvent::offsetX()
+{
+    if (!m_hasCachedRelativePosition)
+        computeRelativePosition();
+    return m_offsetX;
+}
+
+int MouseRelatedEvent::offsetY()
+{
+    if (!m_hasCachedRelativePosition)
+        computeRelativePosition();
+    return m_offsetY;
 }
 
 int MouseRelatedEvent::pageX() const
diff --git a/Source/WebCore/dom/MouseRelatedEvent.h b/Source/WebCore/dom/MouseRelatedEvent.h
index fc494d1..b03b28a 100644
--- a/Source/WebCore/dom/MouseRelatedEvent.h
+++ b/Source/WebCore/dom/MouseRelatedEvent.h
@@ -38,10 +38,10 @@ namespace WebCore {
         int screenY() const { return m_screenY; }
         int clientX() const { return m_clientX; }
         int clientY() const { return m_clientY; }
-        int layerX() const { return m_layerX; }
-        int layerY() const { return m_layerY; }
-        int offsetX() const { return m_offsetX; }
-        int offsetY() const { return m_offsetY; }
+        int layerX();
+        int layerY();
+        int offsetX();
+        int offsetY();
         bool isSimulated() const { return m_isSimulated; }
         virtual int pageX() const;
         virtual int pageY() const;
@@ -64,6 +64,7 @@ namespace WebCore {
         virtual void receivedTarget();
 
         void computePageLocation();
+        void computeRelativePosition();
         
         // Expose these so MouseEvent::initMouseEvent can set them.
         int m_screenX;
@@ -80,6 +81,7 @@ namespace WebCore {
         int m_offsetY;
         IntPoint m_absoluteLocation;
         bool m_isSimulated;
+        bool m_hasCachedRelativePosition;
     };
 
 } // namespace WebCore
diff --git a/Source/WebCore/dom/NamedNodeMap.cpp b/Source/WebCore/dom/NamedNodeMap.cpp
index 2861226..6fa30bf 100644
--- a/Source/WebCore/dom/NamedNodeMap.cpp
+++ b/Source/WebCore/dom/NamedNodeMap.cpp
@@ -100,12 +100,6 @@ PassRefPtr<Node> NamedNodeMap::setNamedItem(Node* arg, ExceptionCode& ec)
         return 0;
     }
 
-    // WRONG_DOCUMENT_ERR: Raised if arg was created from a different document than the one that created this map.
-    if (arg->document() != m_element->document()) {
-        ec = WRONG_DOCUMENT_ERR;
-        return 0;
-    }
-
     // Not mentioned in spec: throw a HIERARCHY_REQUEST_ERROR if the user passes in a non-attribute node
     if (!arg->isAttributeNode()) {
         ec = HIERARCHY_REQUEST_ERR;
diff --git a/Source/WebCore/dom/Node.cpp b/Source/WebCore/dom/Node.cpp
index c125d16..4def034 100644
--- a/Source/WebCore/dom/Node.cpp
+++ b/Source/WebCore/dom/Node.cpp
@@ -51,6 +51,7 @@
 #include "Element.h"
 #include "Event.h"
 #include "EventContext.h"
+#include "EventDispatcher.h"
 #include "EventException.h"
 #include "EventHandler.h"
 #include "EventListener.h"
@@ -106,10 +107,13 @@
 
 #if ENABLE(SVG)
 #include "SVGElementInstance.h"
-#include "SVGNames.h"
 #include "SVGUseElement.h"
 #endif
 
+#if ENABLE(WML)
+#include "WMLNames.h"
+#endif
+
 #if ENABLE(XHTMLMP)
 #include "HTMLNoScriptElement.h"
 #endif
@@ -126,8 +130,6 @@ namespace WebCore {
 
 using namespace HTMLNames;
 
-static HashSet<Node*>* gNodesDispatchingSimulatedClicks = 0;
-
 bool Node::isSupported(const String& feature, const String& version)
 {
     return DOMImplementation::hasFeature(feature, version);
@@ -347,6 +349,12 @@ Node::StyleChange Node::diff(const RenderStyle* s1, const RenderStyle* s2)
         }
     }
 
+    // When text-combine property has been changed, we need to prepare a separate renderer object.
+    // When text-combine is on, we use RenderCombineText, otherwise RenderText.
+    // https://bugs.webkit.org/show_bug.cgi?id=55069
+    if ((s1 && s2) && (s1->hasTextCombine() != s2->hasTextCombine()))
+        ch = Detach;
+
     return ch;
 }
 
@@ -506,6 +514,18 @@ void Node::setShadowHost(Element* host)
     setParent(host);
 }
 
+InputElement* Node::toInputElement()
+{
+    // If one of the below ASSERTs trigger, you are calling this function
+    // directly or indirectly from a constructor or destructor of this object.
+    // Don't do this!
+    ASSERT(!(isHTMLElement() && hasTagName(inputTag)));
+#if ENABLE(WML)
+    ASSERT(!(isWMLElement() && hasTagName(WMLNames::inputTag)));
+#endif
+    return 0;
+}
+
 short Node::tabIndex() const
 {
     return hasRareData() ? rareData()->tabIndex() : 0;
@@ -694,19 +714,36 @@ void Node::deprecatedParserAddChild(PassRefPtr<Node>)
 {
 }
 
-bool Node::isContentEditable() const
+bool Node::rendererIsEditable(EditableLevel editableLevel) const
 {
-    return parentOrHostNode() && parentOrHostNode()->isContentEditable();
-}
+    if (document()->inDesignMode() || (document()->frame() && document()->frame()->page() && document()->frame()->page()->isEditable()))
+        return true;
 
-bool Node::isContentRichlyEditable() const
-{
-    return parentOrHostNode() && parentOrHostNode()->isContentRichlyEditable();
+    // Ideally we'd call ASSERT(!needsStyleRecalc()) here, but
+    // ContainerNode::setFocus() calls setNeedsStyleRecalc(), so the assertion
+    // would fire in the middle of Document::setFocusedNode().
+
+    for (const Node* node = this; node; node = node->parentNode()) {
+        if ((node->isHTMLElement() || node->isDocumentNode()) && node->renderer()) {
+            switch (node->renderer()->style()->userModify()) {
+            case READ_ONLY:
+                return false;
+            case READ_WRITE:
+                return true;
+            case READ_WRITE_PLAINTEXT_ONLY:
+                return editableLevel != RichlyEditable;
+            }
+            ASSERT_NOT_REACHED();
+            return false;
+        }
+    }
+
+    return false;
 }
 
 bool Node::shouldUseInputMethod() const
 {
-    return isContentEditable();
+    return rendererIsEditable();
 }
 
 RenderBox* Node::renderBox() const
@@ -764,10 +801,16 @@ bool Node::hasNonEmptyBoundingBox() const
 
 void Node::setDocumentRecursively(Document* document)
 {
-    // FIXME: To match Gecko, we should do this for nodes that are already in the document as well.
-    if (this->document() == document || this->inDocument())
+    if (this->document() == document)
         return;
 
+    // If an element is moved from a document and then eventually back again the collection cache for
+    // that element may contain stale data as changes made to it will have updated the DOMTreeVersion
+    // of the document it was moved to. By increasing the DOMTreeVersion of the donating document here
+    // we ensure that the collection cache will be invalidated as needed when the element is moved back.
+    if (this->document())
+        this->document()->incDOMTreeVersion();
+
     for (Node* node = this; node; node = node->traverseNextNode(this)) {
         node->setDocument(document);
         if (!node->isElementNode())
@@ -1147,37 +1190,25 @@ bool Node::canReplaceChild(Node* newChild, Node*)
 
 static void checkAcceptChild(Node* newParent, Node* newChild, ExceptionCode& ec)
 {
-    // Perform error checking as required by spec for adding a new child. Used by replaceChild().
-    
     // Not mentioned in spec: throw NOT_FOUND_ERR if newChild is null
     if (!newChild) {
         ec = NOT_FOUND_ERR;
         return;
     }
     
-    // NO_MODIFICATION_ALLOWED_ERR: Raised if this node is readonly
     if (newParent->isReadOnlyNode()) {
         ec = NO_MODIFICATION_ALLOWED_ERR;
         return;
     }
-    
-    // WRONG_DOCUMENT_ERR: Raised if newChild was created from a different document than the one that
-    // created this node.
-    // We assume that if newChild is a DocumentFragment, all children are created from the same document
-    // as the fragment itself (otherwise they could not have been added as children)
-    if (newChild->document() != newParent->document() && newChild->inDocument()) {
-        // but if the child is not in a document yet then loosen the
-        // restriction, so that e.g. creating an element with the Option()
-        // constructor and then adding it to a different document works,
-        // as it does in Mozilla and Mac IE.
-        ec = WRONG_DOCUMENT_ERR;
+
+    if (newChild->inDocument() && newChild->nodeType() == Node::DOCUMENT_TYPE_NODE) {
+        ec = HIERARCHY_REQUEST_ERR;
         return;
     }
-    
+
     // HIERARCHY_REQUEST_ERR: Raised if this node is of a type that does not allow children of the type of the
     // newChild node, or if the node to append is one of this node's ancestors.
 
-    // check for ancestor/same node
     if (newChild == newParent || newParent->isDescendantOf(newChild)) {
         ec = HIERARCHY_REQUEST_ERR;
         return;
@@ -1186,6 +1217,11 @@ static void checkAcceptChild(Node* newParent, Node* newChild, ExceptionCode& ec)
 
 void Node::checkReplaceChild(Node* newChild, Node* oldChild, ExceptionCode& ec)
 {
+    if (!oldChild) {
+        ec = NOT_FOUND_ERR;
+        return;
+    }
+
     checkAcceptChild(this, newChild, ec);
     if (ec)
         return;
@@ -1481,7 +1517,7 @@ int Node::maxCharacterOffset() const
 // is obviously misplaced.
 bool Node::canStartSelection() const
 {
-    if (isContentEditable())
+    if (rendererIsEditable())
         return true;
 
     if (renderer()) {
@@ -1559,7 +1595,7 @@ Element *Node::enclosingBlockFlowElement() const
 Element* Node::rootEditableElement() const
 {
     Element* result = 0;
-    for (Node* n = const_cast<Node*>(this); n && n->isContentEditable(); n = n->parentNode()) {
+    for (Node* n = const_cast<Node*>(this); n && n->rendererIsEditable(); n = n->parentNode()) {
         if (n->isElementNode())
             result = static_cast<Element*>(n);
         if (n->hasTagName(bodyTag))
@@ -2638,200 +2674,14 @@ void Node::handleLocalEvents(Event* event)
     fireEventListeners(event);
 }
 
-static inline EventTarget* eventTargetRespectingSVGTargetRules(Node* referenceNode)
-{
-    ASSERT(referenceNode);
-
-#if ENABLE(SVG)
-    if (!referenceNode->isSVGElement())
-        return referenceNode;
-
-    // Spec: The event handling for the non-exposed tree works as if the referenced element had been textually included
-    // as a deeply cloned child of the 'use' element, except that events are dispatched to the SVGElementInstance objects
-    for (Node* n = referenceNode; n; n = n->parentNode()) {
-        if (!n->isShadowRoot() || !n->isSVGElement())
-            continue;
-
-        Element* shadowTreeParentElement = n->shadowHost();
-        ASSERT(shadowTreeParentElement->hasTagName(SVGNames::useTag));
-
-        if (SVGElementInstance* instance = static_cast<SVGUseElement*>(shadowTreeParentElement)->instanceForShadowTreeElement(referenceNode))
-            return instance;
-    }
-#endif
-
-    return referenceNode;
-}
-
-void Node::getEventAncestors(Vector<EventContext>& ancestors, EventTarget* originalTarget, EventDispatchBehavior behavior)
-{
-    if (!inDocument())
-        return;
-
-    EventTarget* target = originalTarget;
-    Node* ancestor = this;
-    bool shouldSkipNextAncestor = false;
-    while (true) {
-        if (ancestor->isShadowRoot()) {
-            if (behavior == StayInsideShadowDOM)
-                return;
-            ancestor = ancestor->shadowHost();
-            if (!shouldSkipNextAncestor)
-                target = ancestor;
-        } else
-            ancestor = ancestor->parentNodeGuaranteedHostFree();
-
-        if (!ancestor)
-            return;
-
-#if ENABLE(SVG)
-        // Skip SVGShadowTreeRootElement.
-        shouldSkipNextAncestor = ancestor->isSVGElement() && ancestor->isShadowRoot();
-        if (shouldSkipNextAncestor)
-            continue;
-#endif
-        // FIXME: Unroll the extra loop inside eventTargetRespectingSVGTargetRules into this loop.
-        ancestors.append(EventContext(ancestor, eventTargetRespectingSVGTargetRules(ancestor), target));
-
-    }
-}
-
-bool Node::dispatchEvent(PassRefPtr<Event> prpEvent)
-{
-    RefPtr<EventTarget> protect = this;
-    RefPtr<Event> event = prpEvent;
-
-    event->setTarget(eventTargetRespectingSVGTargetRules(this));
-
-    RefPtr<FrameView> view = document()->view();
-    return dispatchGenericEvent(event.release());
-}
-
 void Node::dispatchScopedEvent(PassRefPtr<Event> event)
 {
-    // We need to set the target here because it can go away by the time we actually fire the event.
-    event->setTarget(eventTargetRespectingSVGTargetRules(this));
-
-    ScopedEventQueue::instance()->enqueueEvent(event);
-}
-
-static const EventContext* topEventContext(const Vector<EventContext>& ancestors)
-{
-    return ancestors.isEmpty() ? 0 : &ancestors.last();
+    EventDispatcher::dispatchScopedEvent(this, event);
 }
 
-static EventDispatchBehavior determineDispatchBehavior(Event* event)
+bool Node::dispatchEvent(PassRefPtr<Event> event)
 {
-    // Per XBL 2.0 spec, mutation events should never cross shadow DOM boundary:
-    // http://dev.w3.org/2006/xbl2/#event-flow-and-targeting-across-shadow-s
-    if (event->isMutationEvent())
-        return StayInsideShadowDOM;
-
-    // WebKit never allowed selectstart event to cross the the shadow DOM boundary.
-    // Changing this breaks existing sites.
-    // See https://bugs.webkit.org/show_bug.cgi?id=52195 for details.
-    if (event->type() == eventNames().selectstartEvent)
-        return StayInsideShadowDOM;
-
-    return RetargetEvent;
-}
-
-bool Node::dispatchGenericEvent(PassRefPtr<Event> prpEvent)
-{
-    RefPtr<Event> event(prpEvent);
-
-    ASSERT(!eventDispatchForbidden());
-    ASSERT(event->target());
-    ASSERT(!event->type().isNull()); // JavaScript code can create an event with an empty name, but not null.
-
-    // Make a vector of ancestors to send the event to.
-    // If the node is not in a document just send the event to it.
-    // Be sure to ref all of nodes since event handlers could result in the last reference going away.
-    RefPtr<Node> thisNode(this);
-    RefPtr<EventTarget> originalTarget = event->target();
-    Vector<EventContext> ancestors;
-    getEventAncestors(ancestors, originalTarget.get(), determineDispatchBehavior(event.get()));
-
-    WindowEventContext windowContext(event.get(), this, topEventContext(ancestors));
-
-    InspectorInstrumentationCookie cookie = InspectorInstrumentation::willDispatchEvent(document(), *event, windowContext.window(), this, ancestors);
-
-    // Give the target node a chance to do some work before DOM event handlers get a crack.
-    void* data = preDispatchEventHandler(event.get());
-    if (event->propagationStopped())
-        goto doneDispatching;
-
-    // Trigger capturing event handlers, starting at the top and working our way down.
-    event->setEventPhase(Event::CAPTURING_PHASE);
-
-    if (windowContext.handleLocalEvents(event.get()) && event->propagationStopped())
-        goto doneDispatching;
-
-    for (size_t i = ancestors.size(); i; --i) {
-        ancestors[i - 1].handleLocalEvents(event.get());
-        if (event->propagationStopped())
-            goto doneDispatching;
-    }
-
-    event->setEventPhase(Event::AT_TARGET);
-    event->setTarget(originalTarget.get());
-    event->setCurrentTarget(eventTargetRespectingSVGTargetRules(this));
-    handleLocalEvents(event.get());
-    if (event->propagationStopped())
-        goto doneDispatching;
-
-    if (event->bubbles() && !event->cancelBubble()) {
-        // Trigger bubbling event handlers, starting at the bottom and working our way up.
-        event->setEventPhase(Event::BUBBLING_PHASE);
-
-        size_t size = ancestors.size();
-        for (size_t i = 0; i < size; ++i) {
-            ancestors[i].handleLocalEvents(event.get());
-            if (event->propagationStopped() || event->cancelBubble())
-                goto doneDispatching;
-        }
-        windowContext.handleLocalEvents(event.get());
-    }
-
-doneDispatching:
-    event->setTarget(originalTarget.get());
-    event->setCurrentTarget(0);
-    event->setEventPhase(0);
-
-    // Pass the data from the preDispatchEventHandler to the postDispatchEventHandler.
-    postDispatchEventHandler(event.get(), data);
-
-    // Call default event handlers. While the DOM does have a concept of preventing
-    // default handling, the detail of which handlers are called is an internal
-    // implementation detail and not part of the DOM.
-    if (!event->defaultPrevented() && !event->defaultHandled()) {
-        // Non-bubbling events call only one default event handler, the one for the target.
-        defaultEventHandler(event.get());
-        ASSERT(!event->defaultPrevented());
-        if (event->defaultHandled())
-            goto doneWithDefault;
-        // For bubbling events, call default event handlers on the same targets in the
-        // same order as the bubbling phase.
-        if (event->bubbles()) {
-            size_t size = ancestors.size();
-            for (size_t i = 0; i < size; ++i) {
-                ancestors[i].node()->defaultEventHandler(event.get());
-                ASSERT(!event->defaultPrevented());
-                if (event->defaultHandled())
-                    goto doneWithDefault;
-            }
-        }
-    }
-
-doneWithDefault:
-
-    // Ensure that after event dispatch, the event's target object is the
-    // outermost shadow DOM boundary.
-    event->setTarget(windowContext.target());
-    event->setCurrentTarget(0);
-    InspectorInstrumentation::didDispatchEvent(cookie);
-
-    return !event->defaultPrevented();
+    return EventDispatcher::dispatchEvent(this, event);
 }
 
 void Node::dispatchSubtreeModifiedEvent()
@@ -2861,209 +2711,25 @@ void Node::dispatchUIEvent(const AtomicString& eventType, int detail, PassRefPtr
     dispatchScopedEvent(event.release());
 }
 
-bool Node::dispatchKeyEvent(const PlatformKeyboardEvent& key)
+bool Node::dispatchKeyEvent(const PlatformKeyboardEvent& event)
 {
-    RefPtr<KeyboardEvent> keyboardEvent = KeyboardEvent::create(key, document()->defaultView());
-    bool r = dispatchEvent(keyboardEvent);
-    
-    // we want to return false if default is prevented (already taken care of)
-    // or if the element is default-handled by the DOM. Otherwise we let it just
-    // let it get handled by AppKit 
-    if (keyboardEvent->defaultHandled())
-        r = false;
-    
-    return r;
+    return EventDispatcher::dispatchEvent(this, KeyboardEvent::create(event, document()->defaultView()));
 }
 
 bool Node::dispatchMouseEvent(const PlatformMouseEvent& event, const AtomicString& eventType,
     int detail, Node* relatedTarget)
 {
-    ASSERT(!eventDispatchForbidden());
-    
-    IntPoint contentsPos;
-    if (FrameView* view = document()->view())
-        contentsPos = view->windowToContents(event.pos());
-
-    short button = event.button();
-
-    ASSERT(event.eventType() == MouseEventMoved || button != NoButton);
-    
-    return dispatchMouseEvent(eventType, button, detail,
-        contentsPos.x(), contentsPos.y(), event.globalX(), event.globalY(),
-        event.ctrlKey(), event.altKey(), event.shiftKey(), event.metaKey(),
-        false, relatedTarget, 0);
-}
-
-void Node::dispatchSimulatedMouseEvent(const AtomicString& eventType,
-    PassRefPtr<Event> underlyingEvent)
-{
-    ASSERT(!eventDispatchForbidden());
-
-    bool ctrlKey = false;
-    bool altKey = false;
-    bool shiftKey = false;
-    bool metaKey = false;
-    if (UIEventWithKeyState* keyStateEvent = findEventWithKeyState(underlyingEvent.get())) {
-        ctrlKey = keyStateEvent->ctrlKey();
-        altKey = keyStateEvent->altKey();
-        shiftKey = keyStateEvent->shiftKey();
-        metaKey = keyStateEvent->metaKey();
-    }
-
-    // Like Gecko, we just pass 0 for everything when we make a fake mouse event.
-    // Internet Explorer instead gives the current mouse position and state.
-    dispatchMouseEvent(eventType, 0, 0, 0, 0, 0, 0,
-        ctrlKey, altKey, shiftKey, metaKey, true, 0, underlyingEvent);
+    return EventDispatcher::dispatchMouseEvent(this, event, eventType, detail, relatedTarget);
 }
 
 void Node::dispatchSimulatedClick(PassRefPtr<Event> event, bool sendMouseEvents, bool showPressedLook)
 {
-    if (!gNodesDispatchingSimulatedClicks)
-        gNodesDispatchingSimulatedClicks = new HashSet<Node*>;
-    else if (gNodesDispatchingSimulatedClicks->contains(this))
-        return;
-    
-    gNodesDispatchingSimulatedClicks->add(this);
-    
-    // send mousedown and mouseup before the click, if requested
-    if (sendMouseEvents)
-        dispatchSimulatedMouseEvent(eventNames().mousedownEvent, event.get());
-    setActive(true, showPressedLook);
-    if (sendMouseEvents)
-        dispatchSimulatedMouseEvent(eventNames().mouseupEvent, event.get());
-    setActive(false);
-
-    // always send click
-    dispatchSimulatedMouseEvent(eventNames().clickEvent, event);
-    
-    gNodesDispatchingSimulatedClicks->remove(this);
-}
-
-// FIXME: Once https://bugs.webkit.org/show_bug.cgi?id=52963 lands, this should
-// be greatly improved. See https://bugs.webkit.org/show_bug.cgi?id=54025.
-static Node* pullOutOfShadow(Node* node)
-{
-    Node* outermostShadowBoundary = node;
-    for (Node* n = node; n; n = n->parentOrHostNode()) {
-        if (n->isShadowRoot())
-            outermostShadowBoundary = n->parentOrHostNode();
-    }
-    return outermostShadowBoundary;
-}
-
-bool Node::dispatchMouseEvent(const AtomicString& eventType, int button, int detail,
-    int pageX, int pageY, int screenX, int screenY,
-    bool ctrlKey, bool altKey, bool shiftKey, bool metaKey, 
-    bool isSimulated, Node* relatedTargetArg, PassRefPtr<Event> underlyingEvent)
-{
-    ASSERT(!eventDispatchForbidden());
-    if (disabled()) // Don't even send DOM events for disabled controls..
-        return true;
-    
-    if (eventType.isEmpty())
-        return false; // Shouldn't happen.
-    
-    // Dispatching the first event can easily result in this node being destroyed.
-    // Since we dispatch up to three events here, we need to make sure we're referenced
-    // so the pointer will be good for the two subsequent ones.
-    RefPtr<Node> protect(this);
-    
-    bool cancelable = eventType != eventNames().mousemoveEvent;
-    
-    bool swallowEvent = false;
-    
-    // Attempting to dispatch with a non-EventTarget relatedTarget causes the relatedTarget to be silently ignored.
-    RefPtr<Node> relatedTarget = pullOutOfShadow(relatedTargetArg);
-
-    int adjustedPageX = pageX;
-    int adjustedPageY = pageY;
-    if (Frame* frame = document()->frame()) {
-        float pageZoom = frame->pageZoomFactor();
-        if (pageZoom != 1.0f) {
-            // Adjust our pageX and pageY to account for the page zoom.
-            adjustedPageX = lroundf(pageX / pageZoom);
-            adjustedPageY = lroundf(pageY / pageZoom);
-        }
-    }
-
-    RefPtr<MouseEvent> mouseEvent = MouseEvent::create(eventType,
-        true, cancelable, document()->defaultView(),
-        detail, screenX, screenY, adjustedPageX, adjustedPageY,
-        ctrlKey, altKey, shiftKey, metaKey, button,
-        relatedTarget, 0, isSimulated);
-    mouseEvent->setUnderlyingEvent(underlyingEvent.get());
-    mouseEvent->setAbsoluteLocation(IntPoint(pageX, pageY));
-    
-    dispatchEvent(mouseEvent);
-    bool defaultHandled = mouseEvent->defaultHandled();
-    bool defaultPrevented = mouseEvent->defaultPrevented();
-    if (defaultHandled || defaultPrevented)
-        swallowEvent = true;
-    
-    // Special case: If it's a double click event, we also send the dblclick event. This is not part
-    // of the DOM specs, but is used for compatibility with the ondblclick="" attribute.  This is treated
-    // as a separate event in other DOM-compliant browsers like Firefox, and so we do the same.
-    if (eventType == eventNames().clickEvent && detail == 2) {
-        RefPtr<Event> doubleClickEvent = MouseEvent::create(eventNames().dblclickEvent,
-            true, cancelable, document()->defaultView(),
-            detail, screenX, screenY, adjustedPageX, adjustedPageY,
-            ctrlKey, altKey, shiftKey, metaKey, button,
-            relatedTarget, 0, isSimulated);
-        doubleClickEvent->setUnderlyingEvent(underlyingEvent.get());
-        if (defaultHandled)
-            doubleClickEvent->setDefaultHandled();
-        dispatchEvent(doubleClickEvent);
-        if (doubleClickEvent->defaultHandled() || doubleClickEvent->defaultPrevented())
-            swallowEvent = true;
-    }
-
-    return swallowEvent;
+    EventDispatcher::dispatchSimulatedClick(this, event, sendMouseEvents, showPressedLook);
 }
 
 void Node::dispatchWheelEvent(PlatformWheelEvent& e)
 {
-    ASSERT(!eventDispatchForbidden());
-    if (e.deltaX() == 0 && e.deltaY() == 0)
-        return;
-    
-    FrameView* view = document()->view();
-    if (!view)
-        return;
-    
-    IntPoint pos = view->windowToContents(e.pos());
-
-    int adjustedPageX = pos.x();
-    int adjustedPageY = pos.y();
-    if (Frame* frame = document()->frame()) {
-        float pageZoom = frame->pageZoomFactor();
-        if (pageZoom != 1.0f) {
-            // Adjust our pageX and pageY to account for the page zoom.
-            adjustedPageX = lroundf(pos.x() / pageZoom);
-            adjustedPageY = lroundf(pos.y() / pageZoom);
-        }
-    }
-    
-    WheelEvent::Granularity granularity;
-    switch (e.granularity()) {
-    case ScrollByPageWheelEvent:
-        granularity = WheelEvent::Page;
-        break;
-    case ScrollByPixelWheelEvent:
-    default:
-        granularity = WheelEvent::Pixel;
-        break;
-    }
-    
-    RefPtr<WheelEvent> we = WheelEvent::create(e.wheelTicksX(), e.wheelTicksY(), e.deltaX(), e.deltaY(), granularity,
-        document()->defaultView(), e.globalX(), e.globalY(), adjustedPageX, adjustedPageY,
-        e.ctrlKey(), e.altKey(), e.shiftKey(), e.metaKey());
-
-    we->setAbsoluteLocation(IntPoint(pos.x(), pos.y()));
-
-    if (!dispatchEvent(we) || we->defaultHandled())
-        e.accept();
-
-    we.release();
+    EventDispatcher::dispatchWheelEvent(this, e);
 }
 
 void Node::dispatchFocusEvent()
diff --git a/Source/WebCore/dom/Node.h b/Source/WebCore/dom/Node.h
index 7ef7e80..31f6ae8 100644
--- a/Source/WebCore/dom/Node.h
+++ b/Source/WebCore/dom/Node.h
@@ -53,6 +53,7 @@ class EventContext;
 class EventListener;
 class FloatPoint;
 class Frame;
+class InputElement;
 class IntRect;
 class KeyboardEvent;
 class NSResolver;
@@ -86,11 +87,6 @@ enum StyleChangeType {
     SyntheticStyleChange = 3 << nodeStyleChangeShift
 };
 
-enum EventDispatchBehavior {
-    RetargetEvent,
-    StayInsideShadowDOM
-};
-
 class Node : public EventTarget, public TreeShared<ContainerNode>, public ScriptWrappable {
     friend class Document;
 public:
@@ -224,9 +220,6 @@ public:
     // Returns the enclosing event parent node (or self) that, when clicked, would trigger a navigation.
     Node* enclosingLinkEventParentOrSelf();
 
-    // Node ancestors when concerned about event flow.
-    void getEventAncestors(Vector<EventContext>& ancestors, EventTarget*, EventDispatchBehavior = RetargetEvent);
-
     bool isBlockFlow() const;
     bool isBlockFlowOrBlockTable() const;
     
@@ -326,8 +319,12 @@ public:
     virtual bool isKeyboardFocusable(KeyboardEvent*) const;
     virtual bool isMouseFocusable() const;
 
-    virtual bool isContentEditable() const;
-    virtual bool isContentRichlyEditable() const;
+#if PLATFORM(MAC)
+    // Objective-C extensions
+    bool isContentEditable() const { return rendererIsEditable(Editable); }
+#endif
+    bool rendererIsEditable() const { return rendererIsEditable(Editable); }
+    bool rendererIsRichlyEditable() const { return rendererIsEditable(RichlyEditable); }
     virtual bool shouldUseInputMethod() const;
     virtual IntRect getRect() const;
     IntRect renderRect(bool* isReplaced);
@@ -529,6 +526,8 @@ public:
 
     virtual Node* toNode() { return this; }
 
+    virtual InputElement* toInputElement();
+
     virtual ScriptExecutionContext* scriptExecutionContext() const;
 
     virtual bool addEventListener(const AtomicString& eventType, PassRefPtr<EventListener>, bool useCapture);
@@ -543,7 +542,6 @@ public:
     bool dispatchEvent(PassRefPtr<Event>);
     void dispatchScopedEvent(PassRefPtr<Event>);
 
-    bool dispatchGenericEvent(PassRefPtr<Event>);
     virtual void handleLocalEvents(Event*);
 
     void dispatchSubtreeModifiedEvent();
@@ -551,11 +549,6 @@ public:
     bool dispatchKeyEvent(const PlatformKeyboardEvent&);
     void dispatchWheelEvent(PlatformWheelEvent&);
     bool dispatchMouseEvent(const PlatformMouseEvent&, const AtomicString& eventType, int clickCount = 0, Node* relatedTarget = 0);
-    bool dispatchMouseEvent(const AtomicString& eventType, int button, int clickCount,
-        int pageX, int pageY, int screenX, int screenY,
-        bool ctrlKey, bool altKey, bool shiftKey, bool metaKey,
-        bool isSimulated, Node* relatedTarget, PassRefPtr<Event> underlyingEvent);
-    void dispatchSimulatedMouseEvent(const AtomicString& eventType, PassRefPtr<Event> underlyingEvent);
     void dispatchSimulatedClick(PassRefPtr<Event> underlyingEvent, bool sendMouseEvents = false, bool showPressedLook = true);
 
     virtual void dispatchFocusEvent();
@@ -668,6 +661,9 @@ private:
     void markCachedNodeListsSlow(JSC::MarkStack&, JSC::JSGlobalData&);
 #endif
 
+    enum EditableLevel { Editable, RichlyEditable };
+    bool rendererIsEditable(EditableLevel) const;
+
     void setStyleChange(StyleChangeType);
 
     // Used to share code between lazyAttach and setNeedsStyleRecalc.
diff --git a/Source/WebCore/dom/Position.cpp b/Source/WebCore/dom/Position.cpp
index 473610a..1b58a42 100644
--- a/Source/WebCore/dom/Position.cpp
+++ b/Source/WebCore/dom/Position.cpp
@@ -46,7 +46,7 @@ using namespace HTMLNames;
 static Node* nextRenderedEditable(Node* node)
 {
     while ((node = node->nextLeafNode())) {
-        if (!node->isContentEditable())
+        if (!node->rendererIsEditable())
             continue;
         RenderObject* renderer = node->renderer();
         if (!renderer)
@@ -60,7 +60,7 @@ static Node* nextRenderedEditable(Node* node)
 static Node* previousRenderedEditable(Node* node)
 {
     while ((node = node->previousLeafNode())) {
-        if (!node->isContentEditable())
+        if (!node->rendererIsEditable())
             continue;
         RenderObject* renderer = node->renderer();
         if (!renderer)
@@ -94,11 +94,13 @@ Position::Position(PassRefPtr<Node> anchorNode, int offset, AnchorType anchorTyp
     , m_anchorType(anchorType)
     , m_isLegacyEditingPosition(false)
 {
+    ASSERT(!m_anchorNode || !editingIgnoresContent(m_anchorNode.get()));
     ASSERT(anchorType == PositionIsOffsetInAnchor);
 }
 
 void Position::moveToPosition(PassRefPtr<Node> node, int offset)
 {
+    ASSERT(!editingIgnoresContent(node.get()));
     ASSERT(anchorType() == PositionIsOffsetInAnchor || m_isLegacyEditingPosition);
     m_anchorNode = node;
     m_offset = offset;
@@ -161,12 +163,12 @@ Position Position::parentAnchoredEquivalent() const
         return Position();
     
     // FIXME: This should only be necessary for legacy positions, but is also needed for positions before and after Tables
-    if (m_offset <= 0) {
+    if (m_offset <= 0 && m_anchorType != PositionIsAfterAnchor) {
         if (m_anchorNode->parentNode() && (editingIgnoresContent(m_anchorNode.get()) || isTableElement(m_anchorNode.get())))
             return positionInParentBeforeNode(m_anchorNode.get());
-        return Position(m_anchorNode, 0, PositionIsOffsetInAnchor);
+        return firstPositionInOrBeforeNode(m_anchorNode.get());
     }
-    if (!m_anchorNode->offsetInCharacters() && static_cast<unsigned>(m_offset) == m_anchorNode->childNodeCount()
+    if (!m_anchorNode->offsetInCharacters() && (m_anchorType == PositionIsAfterAnchor || static_cast<unsigned>(m_offset) == m_anchorNode->childNodeCount())
         && (editingIgnoresContent(m_anchorNode.get()) || isTableElement(m_anchorNode.get()))) {
         return positionInParentAfterNode(m_anchorNode.get());
     }
@@ -240,15 +242,15 @@ Position Position::previous(PositionMoveType moveType) const
     Node* n = deprecatedNode();
     if (!n)
         return *this;
-    
-    int o = m_offset;
+
+    int o = deprecatedEditingOffset();
     // FIXME: Negative offsets shouldn't be allowed. We should catch this earlier.
     ASSERT(o >= 0);
 
     if (o > 0) {
         Node* child = n->childNode(o - 1);
         if (child)
-            return lastDeepEditingPositionForNode(child);
+            return lastPositionInOrAfterNode(child);
 
         // There are two reasons child might be 0:
         //   1) The node is node like a text node that is not an element, and therefore has no children.
@@ -279,15 +281,15 @@ Position Position::next(PositionMoveType moveType) const
     Node* n = deprecatedNode();
     if (!n)
         return *this;
-    
-    int o = m_offset;
+
+    int o = deprecatedEditingOffset();
     // FIXME: Negative offsets shouldn't be allowed. We should catch this earlier.
     ASSERT(o >= 0);
 
     Node* child = n->childNode(o);
     if (child || (!n->hasChildNodes() && o < lastOffsetForEditing(n))) {
         if (child)
-            return firstDeepEditingPositionForNode(child);
+            return firstPositionInOrBeforeNode(child);
 
         // There are two reasons child might be 0:
         //   1) The node is node like a text node that is not an element, and therefore has no children.
@@ -323,14 +325,14 @@ bool Position::atFirstEditingPositionForNode() const
 {
     if (isNull())
         return true;
-    return m_offset <= 0;
+    return m_anchorType == PositionIsBeforeAnchor || m_offset <= 0;
 }
 
 bool Position::atLastEditingPositionForNode() const
 {
     if (isNull())
         return true;
-    return m_offset >= lastOffsetForEditing(deprecatedNode());
+    return m_anchorType == PositionIsAfterAnchor || m_offset >= lastOffsetForEditing(deprecatedNode());
 }
 
 // A position is considered at editing boundary if one of the following is true:
@@ -343,15 +345,15 @@ bool Position::atLastEditingPositionForNode() const
 bool Position::atEditingBoundary() const
 {
     Position nextPosition = downstream(CanCrossEditingBoundary);
-    if (atFirstEditingPositionForNode() && nextPosition.isNotNull() && !nextPosition.deprecatedNode()->isContentEditable())
+    if (atFirstEditingPositionForNode() && nextPosition.isNotNull() && !nextPosition.deprecatedNode()->rendererIsEditable())
         return true;
         
     Position prevPosition = upstream(CanCrossEditingBoundary);
-    if (atLastEditingPositionForNode() && prevPosition.isNotNull() && !prevPosition.deprecatedNode()->isContentEditable())
+    if (atLastEditingPositionForNode() && prevPosition.isNotNull() && !prevPosition.deprecatedNode()->rendererIsEditable())
         return true;
         
-    return nextPosition.isNotNull() && !nextPosition.deprecatedNode()->isContentEditable()
-        && prevPosition.isNotNull() && !prevPosition.deprecatedNode()->isContentEditable();
+    return nextPosition.isNotNull() && !nextPosition.deprecatedNode()->rendererIsEditable()
+        && prevPosition.isNotNull() && !prevPosition.deprecatedNode()->rendererIsEditable();
 }
 
 Node* Position::parentEditingBoundary() const
@@ -364,7 +366,7 @@ Node* Position::parentEditingBoundary() const
         return 0;
 
     Node* boundary = m_anchorNode.get();
-    while (boundary != documentElement && boundary->parentNode() && m_anchorNode->isContentEditable() == boundary->parentNode()->isContentEditable())
+    while (boundary != documentElement && boundary->parentNode() && m_anchorNode->rendererIsEditable() == boundary->parentNode()->rendererIsEditable())
         boundary = boundary->parentNode();
     
     return boundary;
@@ -523,17 +525,17 @@ Position Position::upstream(EditingBoundaryCrossingRule rule) const
     // FIXME: PositionIterator should respect Before and After positions.
     PositionIterator lastVisible = m_anchorType == PositionIsAfterAnchor ? Position(m_anchorNode, caretMaxOffset(m_anchorNode.get())) : *this;
     PositionIterator currentPos = lastVisible;
-    bool startEditable = startNode->isContentEditable();
+    bool startEditable = startNode->rendererIsEditable();
     Node* lastNode = startNode;
     bool boundaryCrossed = false;
     for (; !currentPos.atStart(); currentPos.decrement()) {
         Node* currentNode = currentPos.node();
         
         // Don't check for an editability change if we haven't moved to a different node,
-        // to avoid the expense of computing isContentEditable().
+        // to avoid the expense of computing rendererIsEditable().
         if (currentNode != lastNode) {
             // Don't change editability.
-            bool currentEditable = currentNode->isContentEditable();
+            bool currentEditable = currentNode->rendererIsEditable();
             if (startEditable != currentEditable) {
                 if (rule == CannotCrossEditingBoundary)
                     break;
@@ -569,7 +571,7 @@ Position Position::upstream(EditingBoundaryCrossingRule rule) const
         // Return position after tables and nodes which have content that can be ignored.
         if (editingIgnoresContent(currentNode) || isTableElement(currentNode)) {
             if (currentPos.atEndOfNode())
-                return lastDeepEditingPositionForNode(currentNode);
+                return positionAfterNode(currentNode);
             continue;
         }
 
@@ -645,17 +647,17 @@ Position Position::downstream(EditingBoundaryCrossingRule rule) const
     // FIXME: PositionIterator should respect Before and After positions.
     PositionIterator lastVisible = m_anchorType == PositionIsAfterAnchor ? Position(m_anchorNode, caretMaxOffset(m_anchorNode.get())) : *this;
     PositionIterator currentPos = lastVisible;
-    bool startEditable = startNode->isContentEditable();
+    bool startEditable = startNode->rendererIsEditable();
     Node* lastNode = startNode;
     bool boundaryCrossed = false;
     for (; !currentPos.atEnd(); currentPos.increment()) {   
         Node* currentNode = currentPos.node();
         
         // Don't check for an editability change if we haven't moved to a different node,
-        // to avoid the expense of computing isContentEditable().
+        // to avoid the expense of computing rendererIsEditable().
         if (currentNode != lastNode) {
             // Don't change editability.
-            bool currentEditable = currentNode->isContentEditable();
+            bool currentEditable = currentNode->rendererIsEditable();
             if (startEditable != currentEditable) {
                 if (rule == CannotCrossEditingBoundary)
                     break;
@@ -781,7 +783,8 @@ bool Position::isCandidate() const
         return false;
 
     if (renderer->isBR())
-        return !m_offset && !nodeIsUserSelectNone(deprecatedNode()->parentNode());
+        // FIXME: The condition should be m_anchorType == PositionIsBeforeAnchor, but for now we still need to support legacy positions.
+        return !m_offset && m_anchorType != PositionIsAfterAnchor && !nodeIsUserSelectNone(deprecatedNode()->parentNode());
 
     if (renderer->isText())
         return !nodeIsUserSelectNone(deprecatedNode()) && inRenderedText();
@@ -796,10 +799,10 @@ bool Position::isCandidate() const
         if (toRenderBlock(renderer)->height() || m_anchorNode->hasTagName(bodyTag)) {
             if (!Position::hasRenderedNonAnonymousDescendantsWithHeight(renderer))
                 return atFirstEditingPositionForNode() && !Position::nodeIsUserSelectNone(deprecatedNode());
-            return m_anchorNode->isContentEditable() && !Position::nodeIsUserSelectNone(deprecatedNode()) && atEditingBoundary();
+            return m_anchorNode->rendererIsEditable() && !Position::nodeIsUserSelectNone(deprecatedNode()) && atEditingBoundary();
         }
     } else
-        return m_anchorNode->isContentEditable() && !Position::nodeIsUserSelectNone(deprecatedNode()) && atEditingBoundary();
+        return m_anchorNode->rendererIsEditable() && !Position::nodeIsUserSelectNone(deprecatedNode()) && atEditingBoundary();
 
     return false;
 }
@@ -982,7 +985,7 @@ Position Position::trailingWhitespacePosition(EAffinity, bool considerNonCollaps
     VisiblePosition v(*this);
     UChar c = v.characterAfter();
     // The space must not be in another paragraph and it must be editable.
-    if (!isEndOfParagraph(v) && v.next(true).isNotNull())
+    if (!isEndOfParagraph(v) && v.next(CannotCrossEditingBoundary).isNotNull())
         if (considerNonCollapsibleWhitespace ? (isSpaceOrNewline(c) || c == noBreakSpace) : isCollapsibleWhitespace(c))
             return *this;
     
@@ -1053,7 +1056,7 @@ static Position upstreamIgnoringEditingBoundaries(Position position)
 
 void Position::getInlineBoxAndOffset(EAffinity affinity, TextDirection primaryDirection, InlineBox*& inlineBox, int& caretOffset) const
 {
-    caretOffset = m_offset;
+    caretOffset = deprecatedEditingOffset();
     RenderObject* renderer = deprecatedNode()->renderer();
 
     if (!renderer->isText()) {
diff --git a/Source/WebCore/dom/Position.h b/Source/WebCore/dom/Position.h
index 4e1eff4..a72664e 100644
--- a/Source/WebCore/dom/Position.h
+++ b/Source/WebCore/dom/Position.h
@@ -133,6 +133,7 @@ public:
 
     // These can be either inside or just before/after the node, depending on
     // if the node is ignored by editing or not.
+    // FIXME: These should go away. They only make sense for legacy positions.
     bool atFirstEditingPositionForNode() const;
     bool atLastEditingPositionForNode() const;
 
@@ -196,7 +197,7 @@ inline bool operator==(const Position& a, const Position& b)
 {
     // FIXME: In <div><img></div> [div, 0] != [img, 0] even though most of the
     // editing code will treat them as identical.
-    return a.anchorNode() == b.anchorNode() && a.deprecatedEditingOffset() == b.deprecatedEditingOffset();
+    return a.anchorNode() == b.anchorNode() && a.deprecatedEditingOffset() == b.deprecatedEditingOffset() && a.anchorType() == b.anchorType();
 }
 
 inline bool operator!=(const Position& a, const Position& b)
diff --git a/Source/WebCore/dom/PositionIterator.cpp b/Source/WebCore/dom/PositionIterator.cpp
index 5de9d9d..6821308 100644
--- a/Source/WebCore/dom/PositionIterator.cpp
+++ b/Source/WebCore/dom/PositionIterator.cpp
@@ -38,10 +38,13 @@ PositionIterator::operator Position() const
 {
     if (m_nodeAfterPositionInAnchor) {
         ASSERT(m_nodeAfterPositionInAnchor->parentNode() == m_anchorNode);
+        // FIXME: This check is inadaquete because any ancestor could be ignored by editing
+        if (editingIgnoresContent(m_nodeAfterPositionInAnchor->parentNode()))
+            return positionBeforeNode(m_anchorNode);
         return positionInParentBeforeNode(m_nodeAfterPositionInAnchor);
     }
     if (m_anchorNode->hasChildNodes())
-        return lastDeepEditingPositionForNode(m_anchorNode);
+        return lastPositionInOrAfterNode(m_anchorNode);
     return Position(m_anchorNode, m_offsetInAnchor);
 }
 
@@ -166,7 +169,7 @@ bool PositionIterator::isCandidate() const
         if (toRenderBlock(renderer)->height() || m_anchorNode->hasTagName(bodyTag)) {
             if (!Position::hasRenderedNonAnonymousDescendantsWithHeight(renderer))
                 return atStartOfNode() && !Position::nodeIsUserSelectNone(m_anchorNode);
-            return m_anchorNode->isContentEditable() && !Position::nodeIsUserSelectNone(m_anchorNode) && Position(*this).atEditingBoundary();
+            return m_anchorNode->rendererIsEditable() && !Position::nodeIsUserSelectNone(m_anchorNode) && Position(*this).atEditingBoundary();
         }
     }
 
diff --git a/Source/WebCore/dom/QualifiedName.h b/Source/WebCore/dom/QualifiedName.h
index cb95f20..192e7bc 100644
--- a/Source/WebCore/dom/QualifiedName.h
+++ b/Source/WebCore/dom/QualifiedName.h
@@ -113,7 +113,7 @@ inline bool operator!=(const QualifiedName& q, const AtomicString& a) { return a
 
 inline unsigned hashComponents(const QualifiedNameComponents& buf)
 {
-    return WTF::StringHasher::createBlobHash<sizeof(QualifiedNameComponents)>(&buf);
+    return StringHasher::hashMemory<sizeof(QualifiedNameComponents)>(&buf);
 }
 
 struct QualifiedNameHash {
diff --git a/Source/WebCore/dom/Range.cpp b/Source/WebCore/dom/Range.cpp
index a0370fa..423d43f 100644
--- a/Source/WebCore/dom/Range.cpp
+++ b/Source/WebCore/dom/Range.cpp
@@ -932,13 +932,6 @@ void Range::insertNode(PassRefPtr<Node> prpNewNode, ExceptionCode& ec)
         return;
     }
 
-    // WRONG_DOCUMENT_ERR: Raised if newParent and the container of the start of the Range were
-    // not created from the same document.
-    if (newNode->document() != m_start.container()->document()) {
-        ec = WRONG_DOCUMENT_ERR;
-        return;
-    }
-
     // HIERARCHY_REQUEST_ERR: Raised if the container of the start of the Range is of a type that
     // does not allow children of the type of newNode or if newNode is an ancestor of the container.
 
@@ -1423,13 +1416,6 @@ void Range::surroundContents(PassRefPtr<Node> passNewParent, ExceptionCode& ec)
         return;
     }
 
-    // WRONG_DOCUMENT_ERR: Raised if newParent and the container of the start of the Range were
-    // not created from the same document.
-    if (newParent->document() != m_start.container()->document()) {
-        ec = WRONG_DOCUMENT_ERR;
-        return;
-    }
-
     // Raise a HIERARCHY_REQUEST_ERR if m_start.container() doesn't accept children like newParent.
     Node* parentOfNewParent = m_start.container();
 
diff --git a/Source/WebCore/dom/ScriptElement.cpp b/Source/WebCore/dom/ScriptElement.cpp
index 3bba9a0..9a07bb8 100644
--- a/Source/WebCore/dom/ScriptElement.cpp
+++ b/Source/WebCore/dom/ScriptElement.cpp
@@ -24,9 +24,9 @@
 #include "config.h"
 #include "ScriptElement.h"
 
-#include "AsyncScriptRunner.h"
 #include "CachedScript.h"
 #include "CachedResourceLoader.h"
+#include "ContentSecurityPolicy.h"
 #include "Document.h"
 #include "DocumentParser.h"
 #include "Frame.h"
@@ -37,6 +37,7 @@
 #include "MIMETypeRegistry.h"
 #include "Page.h"
 #include "ScriptController.h"
+#include "ScriptRunner.h"
 #include "ScriptSourceCode.h"
 #include "ScriptValue.h"
 #include "Settings.h"
@@ -61,6 +62,8 @@ ScriptElement::ScriptElement(Element* element, bool parserInserted, bool already
     , m_willBeParserExecuted(false)
     , m_readyToBeParserExecuted(false)
     , m_willExecuteWhenDocumentFinishedParsing(false)
+    , m_forceAsync(!parserInserted)
+    , m_willExecuteInOrder(false)
 {
     ASSERT(m_element);
 }
@@ -96,6 +99,11 @@ void ScriptElement::handleSourceAttribute(const String& sourceUrl)
     prepareScript(); // FIXME: Provide a real starting line number here.
 }
 
+void ScriptElement::handleAsyncAttribute()
+{
+    m_forceAsync = false;
+}
+
 // Helper function
 static bool isLegacySupportedJavaScriptLanguage(const String& language)
 {
@@ -159,7 +167,8 @@ bool ScriptElement::prepareScript(const TextPosition1& scriptStartPosition, Lega
     } else
         wasParserInserted = false;
 
-    // FIXME: HTML5 spec says we should set forceAsync.
+    if (wasParserInserted && !asyncAttributeValue())
+        m_forceAsync = true;
 
     // FIXME: HTML5 spec says we should check that all children are either comments or empty text nodes.
     if (!hasSourceAttribute() && !m_element->firstChild())
@@ -171,8 +180,10 @@ bool ScriptElement::prepareScript(const TextPosition1& scriptStartPosition, Lega
     if (!isScriptTypeSupported(supportLegacyTypes))
         return false;
 
-    if (wasParserInserted)
+    if (wasParserInserted) {
         m_parserInserted = true;
+        m_forceAsync = false;
+    }
 
     m_alreadyStarted = true;
 
@@ -207,6 +218,10 @@ bool ScriptElement::prepareScript(const TextPosition1& scriptStartPosition, Lega
     else if (!hasSourceAttribute() && m_parserInserted && !m_element->document()->haveStylesheetsLoaded()) {
         m_willBeParserExecuted = true;
         m_readyToBeParserExecuted = true;
+    } else if (hasSourceAttribute() && !asyncAttributeValue() && !m_forceAsync) {
+        m_willExecuteInOrder = true;
+        m_element->document()->scriptRunner()->queueScriptForExecution(this, m_cachedScript, ScriptRunner::IN_ORDER_EXECUTION);
+        m_cachedScript->addClient(this);
     } else if (hasSourceAttribute())
         m_cachedScript->addClient(this);
     else
@@ -217,9 +232,6 @@ bool ScriptElement::prepareScript(const TextPosition1& scriptStartPosition, Lega
 
 bool ScriptElement::requestScript(const String& sourceUrl)
 {
-    if (!m_element->document()->contentSecurityPolicy()->canLoadExternalScriptFromSrc(sourceUrl))
-        return false;
-
     RefPtr<Document> originalDocument = m_element->document();
     if (!m_element->dispatchBeforeLoadEvent(sourceUrl))
         return false;
@@ -286,7 +298,10 @@ void ScriptElement::notifyFinished(CachedResource* o)
 {
     ASSERT(!m_willBeParserExecuted);
     ASSERT_UNUSED(o, o == m_cachedScript);
-    m_element->document()->asyncScriptRunner()->executeScriptSoon(this, m_cachedScript);
+    if (m_willExecuteInOrder)
+        m_element->document()->scriptRunner()->notifyInOrderScriptReady();
+    else
+        m_element->document()->scriptRunner()->queueScriptForExecution(this, m_cachedScript, ScriptRunner::ASYNC_EXECUTION);
     m_cachedScript = 0;
 }
 
diff --git a/Source/WebCore/dom/ScriptElement.h b/Source/WebCore/dom/ScriptElement.h
index 79dff33..9ce66e5 100644
--- a/Source/WebCore/dom/ScriptElement.h
+++ b/Source/WebCore/dom/ScriptElement.h
@@ -63,12 +63,14 @@ protected:
     void setHaveFiredLoadEvent(bool haveFiredLoad) { m_haveFiredLoad = haveFiredLoad; }
     bool isParserInserted() const { return m_parserInserted; }
     bool alreadyStarted() const { return m_alreadyStarted; }
+    bool forceAsync() const { return m_forceAsync; }
 
     // Helper functions used by our parent classes.
     void insertedIntoDocument();
     void removedFromDocument();
     void childrenChanged();
     void handleSourceAttribute(const String& sourceUrl);
+    void handleAsyncAttribute();
 
 private:
     bool ignoresLoadRequest() const;
@@ -98,6 +100,8 @@ private:
     bool m_willBeParserExecuted : 1; // Same as "The parser will handle executing the script."
     bool m_readyToBeParserExecuted : 1;
     bool m_willExecuteWhenDocumentFinishedParsing : 1;
+    bool m_forceAsync : 1;
+    bool m_willExecuteInOrder : 1;
     String m_characterEncoding;
     String m_fallbackCharacterEncoding;
 };
diff --git a/Source/WebCore/dom/ScriptExecutionContext.cpp b/Source/WebCore/dom/ScriptExecutionContext.cpp
index 6685416..b9a1e92 100644
--- a/Source/WebCore/dom/ScriptExecutionContext.cpp
+++ b/Source/WebCore/dom/ScriptExecutionContext.cpp
@@ -382,6 +382,8 @@ KURL ScriptExecutionContext::createPublicBlobURL(Blob* blob)
     if (!blob)
         return KURL();
     KURL publicURL = BlobURL::createPublicURL(securityOrigin());
+    if (publicURL.isEmpty())
+        return KURL();
     ThreadableBlobRegistry::registerBlobURL(publicURL, blob->url());
     m_publicBlobURLs.add(publicURL.string());
     return publicURL;
diff --git a/Source/WebCore/dom/AsyncScriptRunner.cpp b/Source/WebCore/dom/ScriptRunner.cpp
index 28b1b31..10198bf 100644
--- a/Source/WebCore/dom/AsyncScriptRunner.cpp
+++ b/Source/WebCore/dom/ScriptRunner.cpp
@@ -24,7 +24,7 @@
  */
 
 #include "config.h"
-#include "AsyncScriptRunner.h"
+#include "ScriptRunner.h"
 
 #include "CachedScript.h"
 #include "Document.h"
@@ -34,52 +34,79 @@
 
 namespace WebCore {
 
-AsyncScriptRunner::AsyncScriptRunner(Document* document)
+ScriptRunner::ScriptRunner(Document* document)
     : m_document(document)
-    , m_timer(this, &AsyncScriptRunner::timerFired)
+    , m_timer(this, &ScriptRunner::timerFired)
 {
     ASSERT(document);
 }
 
-AsyncScriptRunner::~AsyncScriptRunner()
+ScriptRunner::~ScriptRunner()
 {
     for (size_t i = 0; i < m_scriptsToExecuteSoon.size(); ++i)
         m_document->decrementLoadEventDelayCount();
+    for (size_t i = 0; i < m_scriptsToExecuteInOrder.size(); ++i)
+        m_document->decrementLoadEventDelayCount();
 }
 
-void AsyncScriptRunner::executeScriptSoon(ScriptElement* scriptElement, CachedResourceHandle<CachedScript> cachedScript)
+void ScriptRunner::queueScriptForExecution(ScriptElement* scriptElement, CachedResourceHandle<CachedScript> cachedScript, ExecutionType executionType)
 {
-    ASSERT_ARG(scriptElement, scriptElement);
+    ASSERT(scriptElement);
 
     Element* element = scriptElement->element();
     ASSERT(element);
     ASSERT(element->inDocument());
 
     m_document->incrementLoadEventDelayCount();
-    m_scriptsToExecuteSoon.append(PendingScript(element, cachedScript.get()));
-    if (!m_timer.isActive())
-        m_timer.startOneShot(0);
+
+    switch (executionType) {
+    case ASYNC_EXECUTION:
+        m_scriptsToExecuteSoon.append(PendingScript(element, cachedScript.get()));
+        if (!m_timer.isActive())
+            m_timer.startOneShot(0);
+        break;
+
+    case IN_ORDER_EXECUTION:
+        m_scriptsToExecuteInOrder.append(PendingScript(element, cachedScript.get()));
+        break;
+
+    default:
+        ASSERT_NOT_REACHED();
+    }
 }
 
-void AsyncScriptRunner::suspend()
+void ScriptRunner::suspend()
 {
     m_timer.stop();
 }
 
-void AsyncScriptRunner::resume()
+void ScriptRunner::resume()
 {
     if (hasPendingScripts())
         m_timer.startOneShot(0);
 }
 
-void AsyncScriptRunner::timerFired(Timer<AsyncScriptRunner>* timer)
+void ScriptRunner::notifyInOrderScriptReady()
+{
+    ASSERT(!m_scriptsToExecuteInOrder.isEmpty());
+    m_timer.startOneShot(0);
+}
+
+void ScriptRunner::timerFired(Timer<ScriptRunner>* timer)
 {
     ASSERT_UNUSED(timer, timer == &m_timer);
 
     RefPtr<Document> protect(m_document);
-    
+
     Vector<PendingScript> scripts;
     scripts.swap(m_scriptsToExecuteSoon);
+
+    size_t numInOrderScriptsToExecute = 0;
+    for (; numInOrderScriptsToExecute < m_scriptsToExecuteInOrder.size() && m_scriptsToExecuteInOrder[numInOrderScriptsToExecute].cachedScript()->isLoaded(); ++numInOrderScriptsToExecute)
+        scripts.append(m_scriptsToExecuteInOrder[numInOrderScriptsToExecute]);
+    if (numInOrderScriptsToExecute)
+        m_scriptsToExecuteInOrder.remove(0, numInOrderScriptsToExecute);
+
     size_t size = scripts.size();
     for (size_t i = 0; i < size; ++i) {
         CachedScript* cachedScript = scripts[i].cachedScript();
diff --git a/Source/WebCore/dom/AsyncScriptRunner.h b/Source/WebCore/dom/ScriptRunner.h
index 6a75323..d6d7411 100644
--- a/Source/WebCore/dom/AsyncScriptRunner.h
+++ b/Source/WebCore/dom/ScriptRunner.h
@@ -23,8 +23,8 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
-#ifndef AsyncScriptRunner_h
-#define AsyncScriptRunner_h
+#ifndef ScriptRunner_h
+#define ScriptRunner_h
 
 #include "CachedResourceHandle.h"
 #include "Timer.h"
@@ -38,26 +38,29 @@ class CachedScript;
 class Document;
 class PendingScript;
 class ScriptElement;
-    
-class AsyncScriptRunner {
-    WTF_MAKE_NONCOPYABLE(AsyncScriptRunner); WTF_MAKE_FAST_ALLOCATED;
+
+class ScriptRunner {
+    WTF_MAKE_NONCOPYABLE(ScriptRunner); WTF_MAKE_FAST_ALLOCATED;
 public:
-    static PassOwnPtr<AsyncScriptRunner> create(Document* document) { return new AsyncScriptRunner(document); }
-    ~AsyncScriptRunner();
+    static PassOwnPtr<ScriptRunner> create(Document* document) { return new ScriptRunner(document); }
+    ~ScriptRunner();
 
-    void executeScriptSoon(ScriptElement*, CachedResourceHandle<CachedScript>);
-    bool hasPendingScripts() const { return !m_scriptsToExecuteSoon.isEmpty(); }
+    enum ExecutionType { ASYNC_EXECUTION, IN_ORDER_EXECUTION };
+    void queueScriptForExecution(ScriptElement*, CachedResourceHandle<CachedScript>, ExecutionType);
+    bool hasPendingScripts() const { return !m_scriptsToExecuteSoon.isEmpty() || !m_scriptsToExecuteInOrder.isEmpty(); }
     void suspend();
     void resume();
+    void notifyInOrderScriptReady();
 
 private:
-    AsyncScriptRunner(Document*);
+    ScriptRunner(Document*);
 
-    void timerFired(Timer<AsyncScriptRunner>*);
+    void timerFired(Timer<ScriptRunner>*);
 
     Document* m_document;
+    Vector<PendingScript> m_scriptsToExecuteInOrder;
     Vector<PendingScript> m_scriptsToExecuteSoon; // http://www.whatwg.org/specs/web-apps/current-work/#set-of-scripts-that-will-execute-as-soon-as-possible
-    Timer<AsyncScriptRunner> m_timer;
+    Timer<ScriptRunner> m_timer;
 };
 
 }
diff --git a/Source/WebCore/dom/StringCallback.cpp b/Source/WebCore/dom/StringCallback.cpp
new file mode 100644
index 0000000..c6285b1
--- /dev/null
+++ b/Source/WebCore/dom/StringCallback.cpp
@@ -0,0 +1,71 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "StringCallback.h"
+
+#include "ScriptExecutionContext.h"
+#include <wtf/text/WTFString.h>
+
+namespace WebCore {
+
+namespace {
+
+class DispatchCallbackTask : public ScriptExecutionContext::Task {
+public:
+    static PassOwnPtr<DispatchCallbackTask> create(PassRefPtr<StringCallback> callback, const String& data)
+    {
+        return adoptPtr(new DispatchCallbackTask(callback, data));
+    }
+
+    virtual void performTask(ScriptExecutionContext*)
+    {
+        m_callback->handleEvent(m_data);
+    }
+
+private:
+    DispatchCallbackTask(PassRefPtr<StringCallback> callback, const String& data)
+        : m_callback(callback)
+        , m_data(data)
+    {
+    }
+
+    RefPtr<StringCallback> m_callback;
+    const String m_data;
+};
+
+} // namespace
+
+void StringCallback::scheduleCallback(ScriptExecutionContext* context, const String& data)
+{
+    context->postTask(DispatchCallbackTask::create(this, data));
+}
+
+} // namespace WebCore
diff --git a/Source/WebCore/dom/StringCallback.h b/Source/WebCore/dom/StringCallback.h
new file mode 100644
index 0000000..92e83e2
--- /dev/null
+++ b/Source/WebCore/dom/StringCallback.h
@@ -0,0 +1,52 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef StringCallback_h
+#define StringCallback_h
+
+#include <wtf/Forward.h>
+#include <wtf/RefCounted.h>
+
+namespace WebCore {
+
+class ScriptExecutionContext;
+
+class StringCallback : public RefCounted<StringCallback> {
+public:
+    virtual ~StringCallback() { }
+    virtual bool handleEvent(const String& data) = 0;
+
+    // Helper to post callback task.
+    void scheduleCallback(ScriptExecutionContext*, const String& data);
+};
+
+} // namespace WebCore
+
+#endif // StringCallback_h
diff --git a/Source/WebCore/platform/chromium/WindowsVersion.h b/Source/WebCore/dom/StringCallback.idl
index 3b2010a..1e18d83 100644
--- a/Source/WebCore/platform/chromium/WindowsVersion.h
+++ b/Source/WebCore/dom/StringCallback.idl
@@ -1,10 +1,10 @@
 /*
- * Copyright (c) 2008, 2009, Google Inc. All rights reserved.
- * 
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
- * 
+ *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ -14,7 +14,7 @@
  *     * Neither the name of Google Inc. nor the names of its
  * contributors may be used to endorse or promote products derived from
  * this software without specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -28,13 +28,10 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef WindowsVersion_h
-#define WindowsVersion_h
-
-namespace WebCore {
-
-    bool isVistaOrNewer();
-
-} // namespace WebCore
-
-#endif
+module core {
+    interface [
+        Callback
+    ] StringCallback {
+        boolean handleEvent(in DOMString data);
+    };
+}
diff --git a/Source/WebCore/dom/StyleElement.cpp b/Source/WebCore/dom/StyleElement.cpp
index f984fda..e9d035d 100644
--- a/Source/WebCore/dom/StyleElement.cpp
+++ b/Source/WebCore/dom/StyleElement.cpp
@@ -103,8 +103,15 @@ void StyleElement::process(Element* e)
     for (Node* c = e->firstChild(); c; c = c->nextSibling()) {
         if (isValidStyleChild(c)) {
             unsigned length = c->nodeValue().length();
+<<<<<<< HEAD
             if (length > std::numeric_limits<unsigned>::max() - resultLength)
                 CRASH();
+=======
+            if (length > std::numeric_limits<unsigned>::max() - resultLength) {
+                createSheet(e, m_startLineNumber, "");
+                return;
+            }
+>>>>>>> webkit.org at r82507
             resultLength += length;
         }
     }
diff --git a/Source/WebCore/dom/StyledElement.cpp b/Source/WebCore/dom/StyledElement.cpp
index d6a532f..3c55591 100644
--- a/Source/WebCore/dom/StyledElement.cpp
+++ b/Source/WebCore/dom/StyledElement.cpp
@@ -412,7 +412,7 @@ unsigned MappedAttributeHash::hash(const MappedAttributeKey& key)
     COMPILE_ASSERT(sizeof(key.name) == 4 || sizeof(key.name) == 8, key_name_size);
     COMPILE_ASSERT(sizeof(key.value) == 4 || sizeof(key.value) == 8, key_value_size);
 
-    WTF::StringHasher hasher;
+    StringHasher hasher;
     const UChar* data;
 
     data = reinterpret_cast<const UChar*>(&key.name);
diff --git a/Source/WebCore/dom/UIEvent.cpp b/Source/WebCore/dom/UIEvent.cpp
index 401015b..dfdd34d 100644
--- a/Source/WebCore/dom/UIEvent.cpp
+++ b/Source/WebCore/dom/UIEvent.cpp
@@ -69,12 +69,12 @@ int UIEvent::charCode() const
     return 0;
 }
 
-int UIEvent::layerX() const
+int UIEvent::layerX()
 {
     return 0;
 }
 
-int UIEvent::layerY() const
+int UIEvent::layerY()
 {
     return 0;
 }
diff --git a/Source/WebCore/dom/UIEvent.h b/Source/WebCore/dom/UIEvent.h
index 8e330a5..a2f4e65 100644
--- a/Source/WebCore/dom/UIEvent.h
+++ b/Source/WebCore/dom/UIEvent.h
@@ -53,8 +53,8 @@ namespace WebCore {
         virtual int keyCode() const;
         virtual int charCode() const;
 
-        virtual int layerX() const;
-        virtual int layerY() const;
+        virtual int layerX();
+        virtual int layerY();
 
         virtual int pageX() const;
         virtual int pageY() const;
diff --git a/Source/WebCore/dom/ViewportArguments.cpp b/Source/WebCore/dom/ViewportArguments.cpp
index e75a3eb..49c94d7 100644
--- a/Source/WebCore/dom/ViewportArguments.cpp
+++ b/Source/WebCore/dom/ViewportArguments.cpp
@@ -257,32 +257,32 @@ static float findScaleValue(const String& keyString, const String& valueString,
     return value;
 }
 
-static bool findUserScalableValue(const String& keyString, const String& valueString, Document* document)
+static float findUserScalableValue(const String& keyString, const String& valueString, Document* document)
 {
     // yes and no are used as keywords.
     // Numbers >= 1, numbers <= -1, device-width and device-height are mapped to yes.
     // Numbers in the range <-1, 1>, and unknown values, are mapped to no.
 
     if (equalIgnoringCase(valueString, "yes"))
-        return true;
+        return 1;
     if (equalIgnoringCase(valueString, "no"))
-        return false;
+        return 0;
     if (equalIgnoringCase(valueString, "desktop-width"))
-        return true;
+        return 1;
     if (equalIgnoringCase(valueString, "device-width"))
-        return true;
+        return 1;
     if (equalIgnoringCase(valueString, "device-height"))
-        return true;
+        return 1;
 
     bool ok;
     float value = numericPrefix(keyString, valueString, document, &ok);
     if (!ok)
-        return false;
+        return 0;
 
     if (fabs(value) < 1)
-        return false;
+        return 0;
 
-    return true;
+    return 1;
 }
 
 static float findTargetDensityDPIValue(const String& keyString, const String& valueString, Document* document)
diff --git a/Source/WebCore/dom/ViewportArguments.h b/Source/WebCore/dom/ViewportArguments.h
index 2e0fd19..66bb281 100644
--- a/Source/WebCore/dom/ViewportArguments.h
+++ b/Source/WebCore/dom/ViewportArguments.h
@@ -51,7 +51,7 @@ struct ViewportAttributes {
     float minimumScale;
     float maximumScale;
 
-    bool userScalable;
+    float userScalable;
 };
 
 struct ViewportArguments {
@@ -74,7 +74,7 @@ struct ViewportArguments {
         , width(ValueAuto)
         , height(ValueAuto)
         , targetDensityDpi(ValueAuto)
-        , userScalable(true)
+        , userScalable(ValueAuto)
     {
     }
 
@@ -84,8 +84,7 @@ struct ViewportArguments {
     float width;
     float height;
     float targetDensityDpi;
-
-    bool userScalable;
+    float userScalable;
 
     bool operator==(const ViewportArguments& other) const
     {
diff --git a/Source/WebCore/dom/default/PlatformMessagePortChannel.h b/Source/WebCore/dom/default/PlatformMessagePortChannel.h
index 2aad952..651810b 100644
--- a/Source/WebCore/dom/default/PlatformMessagePortChannel.h
+++ b/Source/WebCore/dom/default/PlatformMessagePortChannel.h
@@ -44,7 +44,7 @@ namespace WebCore {
     // PlatformMessagePortChannel is a platform-dependent interface to the remote side of a message channel.
     // This default implementation supports multiple threads running within a single process. Implementations for multi-process platforms should define these public APIs in their own platform-specific PlatformMessagePortChannel file.
     // The goal of this implementation is to eliminate contention except when cloning or closing the port, so each side of the channel has its own separate mutex.
-    class PlatformMessagePortChannel : public ThreadSafeShared<PlatformMessagePortChannel> {
+    class PlatformMessagePortChannel : public ThreadSafeRefCounted<PlatformMessagePortChannel> {
     public:
         static void createChannel(PassRefPtr<MessagePort>, PassRefPtr<MessagePort>);
 
@@ -59,7 +59,7 @@ namespace WebCore {
         MessagePort* locallyEntangledPort(const ScriptExecutionContext*);
 
         // Wrapper for MessageQueue that allows us to do thread safe sharing by two proxies.
-        class MessagePortQueue : public ThreadSafeShared<MessagePortQueue> {
+        class MessagePortQueue : public ThreadSafeRefCounted<MessagePortQueue> {
         public:
             static PassRefPtr<MessagePortQueue> create() { return adoptRef(new MessagePortQueue()); }
 
diff --git a/Source/WebCore/editing/AppendNodeCommand.cpp b/Source/WebCore/editing/AppendNodeCommand.cpp
index 58f7fa6..9395968 100644
--- a/Source/WebCore/editing/AppendNodeCommand.cpp
+++ b/Source/WebCore/editing/AppendNodeCommand.cpp
@@ -31,7 +31,7 @@
 
 namespace WebCore {
 
-AppendNodeCommand::AppendNodeCommand(PassRefPtr<Element> parent, PassRefPtr<Node> node)
+AppendNodeCommand::AppendNodeCommand(PassRefPtr<ContainerNode> parent, PassRefPtr<Node> node)
     : SimpleEditCommand(parent->document())
     , m_parent(parent)
     , m_node(node)
@@ -40,7 +40,7 @@ AppendNodeCommand::AppendNodeCommand(PassRefPtr<Element> parent, PassRefPtr<Node
     ASSERT(m_node);
     ASSERT(!m_node->parentNode());
 
-    ASSERT(m_parent->isContentEditable() || !m_parent->attached());
+    ASSERT(m_parent->rendererIsEditable() || !m_parent->attached());
 }
 
 static void sendAXTextChangedIgnoringLineBreaks(Node* node, AXObjectCache::AXTextChange textChange)
@@ -56,7 +56,7 @@ static void sendAXTextChangedIgnoringLineBreaks(Node* node, AXObjectCache::AXTex
 
 void AppendNodeCommand::doApply()
 {
-    if (!m_parent->isContentEditable() && m_parent->attached())
+    if (!m_parent->rendererIsEditable() && m_parent->attached())
         return;
         
     ExceptionCode ec;
@@ -68,7 +68,7 @@ void AppendNodeCommand::doApply()
 
 void AppendNodeCommand::doUnapply()
 {
-    if (!m_parent->isContentEditable())
+    if (!m_parent->rendererIsEditable())
         return;
         
     // Need to notify this before actually deleting the text
diff --git a/Source/WebCore/editing/AppendNodeCommand.h b/Source/WebCore/editing/AppendNodeCommand.h
index 5ffb881..87a8cd2 100644
--- a/Source/WebCore/editing/AppendNodeCommand.h
+++ b/Source/WebCore/editing/AppendNodeCommand.h
@@ -32,18 +32,18 @@ namespace WebCore {
 
 class AppendNodeCommand : public SimpleEditCommand {
 public:
-    static PassRefPtr<AppendNodeCommand> create(PassRefPtr<Element> parent, PassRefPtr<Node> node)
+    static PassRefPtr<AppendNodeCommand> create(PassRefPtr<ContainerNode> parent, PassRefPtr<Node> node)
     {
         return adoptRef(new AppendNodeCommand(parent, node));
     }
 
 private:
-    AppendNodeCommand(PassRefPtr<Element> parent, PassRefPtr<Node> node);
+    AppendNodeCommand(PassRefPtr<ContainerNode> parent, PassRefPtr<Node>);
 
     virtual void doApply();
     virtual void doUnapply();
 
-    RefPtr<Element> m_parent;
+    RefPtr<ContainerNode> m_parent;
     RefPtr<Node> m_node;
 };
 
diff --git a/Source/WebCore/editing/ApplyBlockElementCommand.cpp b/Source/WebCore/editing/ApplyBlockElementCommand.cpp
index 7e20acc..c8f2161 100644
--- a/Source/WebCore/editing/ApplyBlockElementCommand.cpp
+++ b/Source/WebCore/editing/ApplyBlockElementCommand.cpp
@@ -72,7 +72,7 @@ void ApplyBlockElementCommand::doApply()
     // margin/padding, but not others.  We should make the gap painting more consistent and 
     // then use a left margin/padding rule here.
     if (visibleEnd != visibleStart && isStartOfParagraph(visibleEnd))
-        setEndingSelection(VisibleSelection(visibleStart, visibleEnd.previous(true)));
+        setEndingSelection(VisibleSelection(visibleStart, visibleEnd.previous(CannotCrossEditingBoundary)));
 
     VisibleSelection selection = selectionForParagraphIteration(endingSelection());
     VisiblePosition startOfSelection = selection.visibleStart();
@@ -193,7 +193,7 @@ void ApplyBlockElementCommand::rangeForParagraphSplittingTextNodesIfNeeded(const
         if (!startStyle->collapseWhiteSpace() && start.offsetInContainerNode() > 0) {
             int startOffset = start.offsetInContainerNode();
             splitTextNode(static_cast<Text*>(start.deprecatedNode()), startOffset);
-            start = positionBeforeNode(start.deprecatedNode());
+            start = firstPositionInOrBeforeNode(start.deprecatedNode());
             if (isStartAndEndOnSameNode) {
                 ASSERT(end.offsetInContainerNode() >= startOffset);
                 end = Position(end.deprecatedNode(), end.offsetInContainerNode() - startOffset, Position::PositionIsOffsetInAnchor);
@@ -224,7 +224,7 @@ void ApplyBlockElementCommand::rangeForParagraphSplittingTextNodesIfNeeded(const
             && end.offsetInContainerNode() < end.containerNode()->maxCharacterOffset()) {
             splitTextNode(static_cast<Text*>(end.deprecatedNode()), end.offsetInContainerNode());
             if (isStartAndEndOnSameNode)
-                start = positionBeforeNode(end.deprecatedNode()->previousSibling());
+                start = firstPositionInOrBeforeNode(end.deprecatedNode()->previousSibling());
             if (isEndAndEndOfLastParagraphOnSameNode) {
                 if (m_endOfLastParagraph.offsetInContainerNode() == end.offsetInContainerNode())
                     m_endOfLastParagraph = lastPositionInNode(end.deprecatedNode()->previousSibling());
diff --git a/Source/WebCore/editing/ApplyStyleCommand.cpp b/Source/WebCore/editing/ApplyStyleCommand.cpp
index f9ed18e..59540ec 100644
--- a/Source/WebCore/editing/ApplyStyleCommand.cpp
+++ b/Source/WebCore/editing/ApplyStyleCommand.cpp
@@ -57,11 +57,9 @@ using namespace HTMLNames;
 static RGBA32 getRGBAFontColor(CSSStyleDeclaration* style)
 {
     RefPtr<CSSValue> colorValue = style->getPropertyCSSValue(CSSPropertyColor);
-    if (!colorValue)
+    if (!colorValue || !colorValue->isPrimitiveValue())
         return Color::transparent;
 
-    ASSERT(colorValue->isPrimitiveValue());
-
     CSSPrimitiveValue* primitiveColor = static_cast<CSSPrimitiveValue*>(colorValue.get());
     RGBA32 rgba = 0;
     if (primitiveColor->primitiveType() != CSSPrimitiveValue::CSS_RGBCOLOR) {
@@ -76,7 +74,7 @@ static RGBA32 getRGBAFontColor(CSSStyleDeclaration* style)
 
 class StyleChange {
 public:
-    explicit StyleChange(CSSStyleDeclaration*, const Position&);
+    StyleChange(EditingStyle*, const Position&);
 
     String cssStyle() const { return m_cssStyle; }
     bool applyBold() const { return m_applyBold; }
@@ -111,7 +109,7 @@ public:
         return !(*this == other);
     }
 private:
-    void init(PassRefPtr<CSSStyleDeclaration>, const Position&);
+    void init(EditingStyle*, const Position&);
     void reconcileTextDecorationProperties(CSSMutableStyleDeclaration*);
     void extractTextStyles(Document*, CSSMutableStyleDeclaration*, bool shouldUseFixedFontDefaultSize);
 
@@ -128,7 +126,7 @@ private:
 };
 
 
-StyleChange::StyleChange(CSSStyleDeclaration* style, const Position& position)
+StyleChange::StyleChange(EditingStyle* style, const Position& position)
     : m_applyBold(false)
     , m_applyItalic(false)
     , m_applyUnderline(false)
@@ -139,14 +137,14 @@ StyleChange::StyleChange(CSSStyleDeclaration* style, const Position& position)
     init(style, position);
 }
 
-void StyleChange::init(PassRefPtr<CSSStyleDeclaration> style, const Position& position)
+void StyleChange::init(EditingStyle* style, const Position& position)
 {
     Document* document = position.anchorNode() ? position.anchorNode()->document() : 0;
-    if (!style || !document || !document->frame())
+    if (!style || !style->style() || !document || !document->frame())
         return;
 
     RefPtr<CSSComputedStyleDeclaration> computedStyle = position.computedStyle();
-    RefPtr<CSSMutableStyleDeclaration> mutableStyle = getPropertiesNotIn(style.get(), computedStyle.get());
+    RefPtr<CSSMutableStyleDeclaration> mutableStyle = getPropertiesNotIn(style->style(), computedStyle.get());
 
     reconcileTextDecorationProperties(mutableStyle.get());
     if (!document->frame()->editor()->shouldStyleWithCSS())
@@ -158,8 +156,8 @@ void StyleChange::init(PassRefPtr<CSSStyleDeclaration> style, const Position& po
 
     // If unicode-bidi is present in mutableStyle and direction is not, then add direction to mutableStyle.
     // FIXME: Shouldn't this be done in getPropertiesNotIn?
-    if (mutableStyle->getPropertyCSSValue(CSSPropertyUnicodeBidi) && !style->getPropertyCSSValue(CSSPropertyDirection))
-        mutableStyle->setProperty(CSSPropertyDirection, style->getPropertyValue(CSSPropertyDirection));
+    if (mutableStyle->getPropertyCSSValue(CSSPropertyUnicodeBidi) && !style->style()->getPropertyCSSValue(CSSPropertyDirection))
+        mutableStyle->setProperty(CSSPropertyDirection, style->style()->getPropertyValue(CSSPropertyDirection));
 
     // Save the result for later
     m_cssStyle = mutableStyle->cssText().stripWhiteSpace();
@@ -591,7 +589,7 @@ void ApplyStyleCommand::applyBlockStyle(EditingStyle *style)
     VisiblePosition nextParagraphStart(endOfParagraph(paragraphStart).next());
     VisiblePosition beyondEnd(endOfParagraph(visibleEnd).next());
     while (paragraphStart.isNotNull() && paragraphStart != beyondEnd) {
-        StyleChange styleChange(style->style(), paragraphStart.deepEquivalent());
+        StyleChange styleChange(style, paragraphStart.deepEquivalent());
         if (styleChange.cssStyle().length() || m_removeOnly) {
             RefPtr<Node> block = enclosingBlock(paragraphStart.deepEquivalent().deprecatedNode());
             if (!m_removeOnly) {
@@ -1017,12 +1015,12 @@ void ApplyStyleCommand::fixRangeAndApplyInlineStyle(EditingStyle* style, const P
 
 static bool containsNonEditableRegion(Node* node)
 {
-    if (!node->isContentEditable())
+    if (!node->rendererIsEditable())
         return true;
 
     Node* sibling = node->traverseNextSibling();
     for (Node* descendent = node->firstChild(); descendent && descendent != sibling; descendent = descendent->traverseNextNode()) {
-        if (!descendent->isContentEditable())
+        if (!descendent->rendererIsEditable())
             return true;
     }
 
@@ -1037,10 +1035,10 @@ void ApplyStyleCommand::applyInlineStyleToNodeRange(EditingStyle* style, Node* n
     for (RefPtr<Node> next; node && node != pastEndNode; node = next.get()) {
         next = node->traverseNextNode();
 
-        if (!node->renderer() || !node->isContentEditable())
+        if (!node->renderer() || !node->rendererIsEditable())
             continue;
         
-        if (!node->isContentRichlyEditable() && node->isHTMLElement()) {
+        if (!node->rendererIsRichlyEditable() && node->isHTMLElement()) {
             // This is a plaintext-only region. Only proceed if it's fully selected.
             // pastEndNode is the node after the last fully selected node, so if it's inside node then
             // node isn't fully selected.
@@ -1059,7 +1057,7 @@ void ApplyStyleCommand::applyInlineStyleToNodeRange(EditingStyle* style, Node* n
             continue;
         
         if (node->childNodeCount()) {
-            if (node->contains(pastEndNode) || containsNonEditableRegion(node) || !node->parentNode()->isContentEditable())
+            if (node->contains(pastEndNode) || containsNonEditableRegion(node) || !node->parentNode()->rendererIsEditable())
                 continue;
             if (editingIgnoresContent(node)) {
                 next = node->traverseNextSibling();
@@ -1080,7 +1078,7 @@ void ApplyStyleCommand::applyInlineStyleToNodeRange(EditingStyle* style, Node* n
 
         if (!removeStyleFromRunBeforeApplyingStyle(style, runStart, runEnd))
             continue;
-        addInlineStyleIfNeeded(style->style(), runStart.get(), runEnd.get(), AddStyledElement);
+        addInlineStyleIfNeeded(style, runStart.get(), runEnd.get(), AddStyledElement);
     }
 }
 
@@ -1099,7 +1097,7 @@ bool ApplyStyleCommand::removeStyleFromRunBeforeApplyingStyle(EditingStyle* styl
         if (node->childNodeCount())
             continue;
         // We don't consider m_isInlineElementToRemoveFunction here because we never apply style when m_isInlineElementToRemoveFunction is specified
-        if ((!style->isEmpty() && getPropertiesNotIn(style->style(), computedStyle(node).get())->length())
+        if (!style->styleIsPresentInComputedStyleOfNode(node)
             || (m_styledInlineElement && !enclosingNodeWithTag(positionBeforeNode(node), m_styledInlineElement->tagQName()))) {
             needToApplyStyle = true;
             break;
@@ -1134,26 +1132,18 @@ bool ApplyStyleCommand::removeInlineStyleFromElement(EditingStyle* style, PassRe
 {
     ASSERT(element);
 
-    if (!element->parentNode() || !element->parentNode()->isContentEditable())
+    if (!element->parentNode() || !element->parentNode()->rendererIsEditable())
         return false;
 
     if (isStyledInlineElementToRemove(element.get())) {
         if (mode == RemoveNone)
             return true;
         ASSERT(extractedStyle);
-        if (element->inlineStyleDecl()) {
-            if (extractedStyle->style())
-                extractedStyle->style()->merge(element->inlineStyleDecl());
-            else
-                extractedStyle->setStyle(element->inlineStyleDecl()->copy());
-        }
+        extractedStyle->mergeInlineStyleOfElement(element.get());
         removeNodePreservingChildren(element);
         return true;
     }
 
-    if (!style->style())
-        return false;
-
     bool removed = false;
     if (removeImplicitlyStyledElement(style, element.get(), mode, extractedStyle))
         removed = true;
@@ -1296,7 +1286,7 @@ void ApplyStyleCommand::applyInlineStyleToPushDown(Node* node, EditingStyle* sty
     // We can't wrap node with the styled element here because new styled element will never be removed if we did.
     // If we modified the child pointer in pushDownInlineStyleAroundNode to point to new style element
     // then we fall into an infinite loop where we keep removing and adding styled element wrapping node.
-    addInlineStyleIfNeeded(newInlineStyle->style(), node, node, DoNotAddStyledElement);
+    addInlineStyleIfNeeded(newInlineStyle.get(), node, node, DoNotAddStyledElement);
 }
 
 void ApplyStyleCommand::pushDownInlineStyleAroundNode(EditingStyle* style, Node* targetNode)
@@ -1312,7 +1302,6 @@ void ApplyStyleCommand::pushDownInlineStyleAroundNode(EditingStyle* style, Node*
     Vector<RefPtr<Element> > elementsToPushDown;
     while (current != targetNode) {
         ASSERT(current);
-        ASSERT(current->isHTMLElement());
         ASSERT(current->contains(targetNode));
         Node* child = current->firstChild();
         Node* lastChild = current->lastChild();
@@ -1321,8 +1310,10 @@ void ApplyStyleCommand::pushDownInlineStyleAroundNode(EditingStyle* style, Node*
             styledElement = static_cast<StyledElement*>(current);
             elementsToPushDown.append(styledElement);
         }
+
         RefPtr<EditingStyle> styleToPushDown = EditingStyle::create();
-        removeInlineStyleFromElement(style, toHTMLElement(current), RemoveIfNeeded, styleToPushDown.get());
+        if (current->isHTMLElement())
+            removeInlineStyleFromElement(style, toHTMLElement(current), RemoveIfNeeded, styleToPushDown.get());
 
         // The inner loop will go through children on each level
         // FIXME: we should aggregate inline child elements together so that we don't wrap each child separately.
@@ -1659,13 +1650,13 @@ void ApplyStyleCommand::surroundNodeRangeWithElement(PassRefPtr<Node> passedStar
 
     RefPtr<Node> nextSibling = element->nextSibling();
     RefPtr<Node> previousSibling = element->previousSibling();
-    if (nextSibling && nextSibling->isElementNode() && nextSibling->isContentEditable()
+    if (nextSibling && nextSibling->isElementNode() && nextSibling->rendererIsEditable()
         && areIdenticalElements(element.get(), static_cast<Element*>(nextSibling.get())))
         mergeIdenticalElements(element.get(), static_cast<Element*>(nextSibling.get()));
 
-    if (previousSibling && previousSibling->isElementNode() && previousSibling->isContentEditable()) {
+    if (previousSibling && previousSibling->isElementNode() && previousSibling->rendererIsEditable()) {
         Node* mergedElement = previousSibling->nextSibling();
-        if (mergedElement->isElementNode() && mergedElement->isContentEditable()
+        if (mergedElement->isElementNode() && mergedElement->rendererIsEditable()
             && areIdenticalElements(static_cast<Element*>(previousSibling.get()), static_cast<Element*>(mergedElement)))
             mergeIdenticalElements(static_cast<Element*>(previousSibling.get()), static_cast<Element*>(mergedElement));
     }
@@ -1689,7 +1680,7 @@ void ApplyStyleCommand::addBlockStyle(const StyleChange& styleChange, HTMLElemen
     setNodeAttribute(block, styleAttr, cssText);
 }
 
-void ApplyStyleCommand::addInlineStyleIfNeeded(CSSMutableStyleDeclaration *style, PassRefPtr<Node> passedStart, PassRefPtr<Node> passedEnd, EAddStyledElement addStyledElement)
+void ApplyStyleCommand::addInlineStyleIfNeeded(EditingStyle* style, PassRefPtr<Node> passedStart, PassRefPtr<Node> passedEnd, EAddStyledElement addStyledElement)
 {
     if (!passedStart || !passedEnd || !passedStart->inDocument() || !passedEnd->inDocument())
         return;
@@ -1704,7 +1695,7 @@ void ApplyStyleCommand::addInlineStyleIfNeeded(CSSMutableStyleDeclaration *style
         insertNodeAt(dummyElement, positionBeforeNode(startNode.get()));
         positionForStyleComparison = positionBeforeNode(dummyElement.get());
     } else
-        positionForStyleComparison = firstPositionInNode(startNode.get());
+        positionForStyleComparison = firstPositionInOrBeforeNode(startNode.get());
 
     StyleChange styleChange(style, positionForStyleComparison);
 
diff --git a/Source/WebCore/editing/ApplyStyleCommand.h b/Source/WebCore/editing/ApplyStyleCommand.h
index d4444e4..dc2217e 100644
--- a/Source/WebCore/editing/ApplyStyleCommand.h
+++ b/Source/WebCore/editing/ApplyStyleCommand.h
@@ -97,7 +97,7 @@ private:
     void fixRangeAndApplyInlineStyle(EditingStyle*, const Position& start, const Position& end);
     void applyInlineStyleToNodeRange(EditingStyle*, Node* startNode, Node* pastEndNode);
     void addBlockStyle(const StyleChange&, HTMLElement*);
-    void addInlineStyleIfNeeded(CSSMutableStyleDeclaration*, PassRefPtr<Node> start, PassRefPtr<Node> end, EAddStyledElement addStyledElement = AddStyledElement);
+    void addInlineStyleIfNeeded(EditingStyle*, PassRefPtr<Node> start, PassRefPtr<Node> end, EAddStyledElement = AddStyledElement);
     void splitTextAtStart(const Position& start, const Position& end);
     void splitTextAtEnd(const Position& start, const Position& end);
     void splitTextElementAtStart(const Position& start, const Position& end);
diff --git a/Source/WebCore/editing/BreakBlockquoteCommand.cpp b/Source/WebCore/editing/BreakBlockquoteCommand.cpp
index 011a787..91f496c 100644
--- a/Source/WebCore/editing/BreakBlockquoteCommand.cpp
+++ b/Source/WebCore/editing/BreakBlockquoteCommand.cpp
@@ -66,12 +66,8 @@ void BreakBlockquoteCommand::doApply()
     Position pos = endingSelection().start().downstream();
     
     // Find the top-most blockquote from the start.
-    Element* topBlockquote = 0;
-    for (ContainerNode* node = pos.deprecatedNode()->parentNode(); node; node = node->parentNode()) {
-        if (isMailBlockquote(node))
-            topBlockquote = static_cast<Element*>(node);
-    }
-    if (!topBlockquote || !topBlockquote->parentNode())
+    Node* topBlockquote = highestEnclosingNodeOfType(pos, isMailBlockquote);
+    if (!topBlockquote || !topBlockquote->parentNode() || !topBlockquote->isElementNode())
         return;
     
     RefPtr<Element> breakNode = createBreakElement(document());
@@ -103,7 +99,7 @@ void BreakBlockquoteCommand::doApply()
         pos = pos.next();
         
     // Adjust the position so we don't split at the beginning of a quote.  
-    while (isFirstVisiblePositionInNode(VisiblePosition(pos), nearestMailBlockquote(pos.deprecatedNode())))
+    while (isFirstVisiblePositionInNode(VisiblePosition(pos), enclosingNodeOfType(pos, isMailBlockquote)))
         pos = pos.previous();
     
     // startNode is the first node that we need to move to the new blockquote.
@@ -135,7 +131,7 @@ void BreakBlockquoteCommand::doApply()
         ancestors.append(node);
     
     // Insert a clone of the top blockquote after the break.
-    RefPtr<Element> clonedBlockquote = topBlockquote->cloneElementWithoutChildren();
+    RefPtr<Element> clonedBlockquote = static_cast<Element*>(topBlockquote)->cloneElementWithoutChildren();
     insertNodeAfter(clonedBlockquote.get(), breakNode.get());
     
     // Clone startNode's ancestors into the cloned blockquote.
@@ -152,7 +148,7 @@ void BreakBlockquoteCommand::doApply()
             // find the first one so that we know where to start numbering.
             while (listChildNode && !listChildNode->hasTagName(liTag))
                 listChildNode = listChildNode->nextSibling();
-            if (listChildNode && listChildNode->renderer())
+            if (listChildNode && listChildNode->renderer() && listChildNode->renderer()->isListItem())
                 setNodeAttribute(static_cast<Element*>(clonedChild.get()), startAttr, String::number(toRenderListItem(listChildNode->renderer())->value()));
         }
             
diff --git a/Source/WebCore/editing/CompositeEditCommand.cpp b/Source/WebCore/editing/CompositeEditCommand.cpp
index b7672ee..2a69fb7 100644
--- a/Source/WebCore/editing/CompositeEditCommand.cpp
+++ b/Source/WebCore/editing/CompositeEditCommand.cpp
@@ -144,7 +144,7 @@ void CompositeEditCommand::insertNodeAfter(PassRefPtr<Node> insertChild, PassRef
     ASSERT(insertChild);
     ASSERT(refChild);
     ASSERT(!refChild->hasTagName(bodyTag));
-    Element* parent = refChild->parentElement();
+    ContainerNode* parent = refChild->parentNode();
     ASSERT(parent);
     if (parent->lastChild() == refChild)
         appendNode(insertChild, parent);
@@ -184,7 +184,7 @@ void CompositeEditCommand::insertNodeAt(PassRefPtr<Node> insertChild, const Posi
         insertNodeAfter(insertChild, refChild);
 }
 
-void CompositeEditCommand::appendNode(PassRefPtr<Node> node, PassRefPtr<Element> parent)
+void CompositeEditCommand::appendNode(PassRefPtr<Node> node, PassRefPtr<ContainerNode> parent)
 {
     ASSERT(canHaveChildrenForEditing(parent.get()));
     applyCommandToComposite(AppendNodeCommand::create(parent, node));
@@ -830,10 +830,10 @@ void CompositeEditCommand::cloneParagraphUnderNewElement(Position& start, Positi
 // Deleting a paragraph will leave a placeholder. Remove it (and prune
 // empty or unrendered parents).
 
-void CompositeEditCommand::cleanupAfterDeletion()
+void CompositeEditCommand::cleanupAfterDeletion(VisiblePosition destination)
 {
     VisiblePosition caretAfterDelete = endingSelection().visibleStart();
-    if (isStartOfParagraph(caretAfterDelete) && isEndOfParagraph(caretAfterDelete)) {
+    if (caretAfterDelete != destination && isStartOfParagraph(caretAfterDelete) && isEndOfParagraph(caretAfterDelete)) {
         // Note: We want the rightmost candidate.
         Position position = caretAfterDelete.deepEquivalent().downstream();
         Node* node = position.deprecatedNode();
@@ -947,8 +947,8 @@ void CompositeEditCommand::moveParagraphs(const VisiblePosition& startOfParagrap
         }
     }
     
-    VisiblePosition beforeParagraph = startOfParagraphToMove.previous();
-    VisiblePosition afterParagraph(endOfParagraphToMove.next());
+    VisiblePosition beforeParagraph = startOfParagraphToMove.previous(CannotCrossEditingBoundary);
+    VisiblePosition afterParagraph(endOfParagraphToMove.next(CannotCrossEditingBoundary));
 
     // We upstream() the end and downstream() the start so that we don't include collapsed whitespace in the move.
     // When we paste a fragment, spaces after the end and before the start are treated as though they were rendered.
@@ -985,8 +985,7 @@ void CompositeEditCommand::moveParagraphs(const VisiblePosition& startOfParagrap
     deleteSelection(false, false, false, false);
 
     ASSERT(destination.deepEquivalent().anchorNode()->inDocument());
-
-    cleanupAfterDeletion();
+    cleanupAfterDeletion(destination);
     ASSERT(destination.deepEquivalent().anchorNode()->inDocument());
 
     // Add a br if pruning an empty block level element caused a collapse. For example:
@@ -1049,7 +1048,7 @@ bool CompositeEditCommand::breakOutOfEmptyListItem()
     // FIXME: Can't we do something better when the immediate parent wasn't a list node?
     if (!listNode
         || (!listNode->hasTagName(ulTag) && !listNode->hasTagName(olTag))
-        || !listNode->isContentEditable()
+        || !listNode->rendererIsEditable()
         || listNode == emptyListItem->rootEditableElement())
         return false;
 
@@ -1114,7 +1113,7 @@ bool CompositeEditCommand::breakOutOfEmptyMailBlockquotedParagraph()
     if (!isStartOfParagraph(caret) || !isEndOfParagraph(caret))
         return false;
     
-    VisiblePosition previous(caret.previous(true));
+    VisiblePosition previous(caret.previous(CannotCrossEditingBoundary));
     // Only move forward if there's nothing before the caret, or if there's unquoted content before it.
     if (enclosingNodeOfType(previous.deepEquivalent(), &isMailBlockquote))
         return false;
@@ -1173,8 +1172,8 @@ Position CompositeEditCommand::positionAvoidingSpecialElementBoundary(const Posi
 
     // Don't avoid block level anchors, because that would insert content into the wrong paragraph.
     if (enclosingAnchor && !isBlock(enclosingAnchor)) {
-        VisiblePosition firstInAnchor(firstDeepEditingPositionForNode(enclosingAnchor));
-        VisiblePosition lastInAnchor(lastDeepEditingPositionForNode(enclosingAnchor));
+        VisiblePosition firstInAnchor(firstPositionInNode(enclosingAnchor));
+        VisiblePosition lastInAnchor(lastPositionInNode(enclosingAnchor));
         // If visually just after the anchor, insert *inside* the anchor unless it's the last
         // VisiblePosition in the document, to match NSTextView.
         if (visiblePos == lastInAnchor) {
diff --git a/Source/WebCore/editing/CompositeEditCommand.h b/Source/WebCore/editing/CompositeEditCommand.h
index 9066b65..4b96d8f 100644
--- a/Source/WebCore/editing/CompositeEditCommand.h
+++ b/Source/WebCore/editing/CompositeEditCommand.h
@@ -32,7 +32,6 @@
 
 namespace WebCore {
 
-class CSSStyleDeclaration;
 class EditingStyle;
 class HTMLElement;
 class StyledElement;
@@ -50,7 +49,7 @@ protected:
     //
     // sugary-sweet convenience functions to help create and apply edit commands in composite commands
     //
-    void appendNode(PassRefPtr<Node>, PassRefPtr<Element> parent);
+    void appendNode(PassRefPtr<Node>, PassRefPtr<ContainerNode> parent);
     void applyCommandToComposite(PassRefPtr<EditCommand>);
     void applyStyle(const EditingStyle*, EditAction = EditActionChangeAttributes);
     void applyStyle(const EditingStyle*, const Position& start, const Position& end, EditAction = EditActionChangeAttributes);
@@ -110,7 +109,7 @@ protected:
     void moveParagraphs(const VisiblePosition&, const VisiblePosition&, const VisiblePosition&, bool preserveSelection = false, bool preserveStyle = true);
     void moveParagraphWithClones(const VisiblePosition& startOfParagraphToMove, const VisiblePosition& endOfParagraphToMove, Element* blockElement, Node* outerNode);
     void cloneParagraphUnderNewElement(Position& start, Position& end, Node* outerNode, Element* blockElement);
-    void cleanupAfterDeletion();
+    void cleanupAfterDeletion(VisiblePosition destination = VisiblePosition());
     
     bool breakOutOfEmptyListItem();
     bool breakOutOfEmptyMailBlockquotedParagraph();
diff --git a/Source/WebCore/editing/DeleteButtonController.cpp b/Source/WebCore/editing/DeleteButtonController.cpp
index 75b9a96..332e68f 100644
--- a/Source/WebCore/editing/DeleteButtonController.cpp
+++ b/Source/WebCore/editing/DeleteButtonController.cpp
@@ -63,7 +63,7 @@ DeleteButtonController::DeleteButtonController(Frame* frame)
 
 static bool isDeletableElement(const Node* node)
 {
-    if (!node || !node->isHTMLElement() || !node->inDocument() || !node->isContentEditable())
+    if (!node || !node->isHTMLElement() || !node->inDocument() || !node->rendererIsEditable())
         return false;
 
     // In general we want to only draw the UI around object of a certain area, but we still keep the min width/height to
@@ -156,15 +156,11 @@ static HTMLElement* enclosingDeletableElement(const VisibleSelection& selection)
 
     // The enclosingNodeOfType function only works on nodes that are editable
     // (which is strange, given its name).
-    if (!container->isContentEditable())
+    if (!container->rendererIsEditable())
         return 0;
 
     Node* element = enclosingNodeOfType(firstPositionInNode(container), &isDeletableElement);
-    if (!element)
-        return 0;
-
-    ASSERT(element->isHTMLElement());
-    return toHTMLElement(element);
+    return element && element->isHTMLElement() ? toHTMLElement(element) : 0;
 }
 
 void DeleteButtonController::respondToChangedSelection(const VisibleSelection& oldSelection)
diff --git a/Source/WebCore/editing/DeleteFromTextNodeCommand.cpp b/Source/WebCore/editing/DeleteFromTextNodeCommand.cpp
index fe572e1..8ee28a1 100644
--- a/Source/WebCore/editing/DeleteFromTextNodeCommand.cpp
+++ b/Source/WebCore/editing/DeleteFromTextNodeCommand.cpp
@@ -46,7 +46,7 @@ void DeleteFromTextNodeCommand::doApply()
 {
     ASSERT(m_node);
 
-    if (!m_node->isContentEditable())
+    if (!m_node->rendererIsEditable())
         return;
 
     ExceptionCode ec = 0;
@@ -65,7 +65,7 @@ void DeleteFromTextNodeCommand::doUnapply()
 {
     ASSERT(m_node);
 
-    if (!m_node->isContentEditable())
+    if (!m_node->rendererIsEditable())
         return;
         
     ExceptionCode ec;
diff --git a/Source/WebCore/editing/DeleteSelectionCommand.cpp b/Source/WebCore/editing/DeleteSelectionCommand.cpp
index 897c305..cbebe54 100644
--- a/Source/WebCore/editing/DeleteSelectionCommand.cpp
+++ b/Source/WebCore/editing/DeleteSelectionCommand.cpp
@@ -52,7 +52,7 @@ static bool isTableRow(const Node* node)
 static bool isTableCellEmpty(Node* cell)
 {
     ASSERT(isTableCell(cell));
-    return VisiblePosition(firstDeepEditingPositionForNode(cell)) == VisiblePosition(lastDeepEditingPositionForNode(cell));
+    return VisiblePosition(firstPositionInNode(cell)) == VisiblePosition(lastPositionInNode(cell));
 }
 
 static bool isTableRowEmpty(Node* row)
@@ -72,6 +72,7 @@ DeleteSelectionCommand::DeleteSelectionCommand(Document *document, bool smartDel
       m_hasSelectionToDelete(false), 
       m_smartDelete(smartDelete), 
       m_mergeBlocksAfterDelete(mergeBlocksAfterDelete),
+      m_needPlaceholder(false),
       m_replace(replace),
       m_expandForSpecialElements(expandForSpecialElements),
       m_pruneStartBlockIfNecessary(false),
@@ -88,6 +89,7 @@ DeleteSelectionCommand::DeleteSelectionCommand(const VisibleSelection& selection
       m_hasSelectionToDelete(true), 
       m_smartDelete(smartDelete), 
       m_mergeBlocksAfterDelete(mergeBlocksAfterDelete),
+      m_needPlaceholder(false),
       m_replace(replace),
       m_expandForSpecialElements(expandForSpecialElements),
       m_pruneStartBlockIfNecessary(false),
@@ -188,8 +190,8 @@ void DeleteSelectionCommand::initializePositionData()
     // Don't move content out of a table cell.
     // If the cell is non-editable, enclosingNodeOfType won't return it by default, so
     // tell that function that we don't care if it returns non-editable nodes.
-    Node* startCell = enclosingNodeOfType(m_upstreamStart, &isTableCell, false);
-    Node* endCell = enclosingNodeOfType(m_downstreamEnd, &isTableCell, false);
+    Node* startCell = enclosingNodeOfType(m_upstreamStart, &isTableCell, CanCrossEditingBoundary);
+    Node* endCell = enclosingNodeOfType(m_downstreamEnd, &isTableCell, CanCrossEditingBoundary);
     // FIXME: This isn't right.  A borderless table with two rows and a single column would appear as two paragraphs.
     if (endCell && endCell != startCell)
         m_mergeBlocksAfterDelete = false;
@@ -262,8 +264,8 @@ void DeleteSelectionCommand::initializePositionData()
     // like the one below, since editing functions should obviously accept editing positions.
     // FIXME: Passing false to enclosingNodeOfType tells it that it's OK to return a non-editable
     // node.  This was done to match existing behavior, but it seems wrong.
-    m_startBlock = enclosingNodeOfType(m_downstreamStart.parentAnchoredEquivalent(), &isBlock, false);
-    m_endBlock = enclosingNodeOfType(m_upstreamEnd.parentAnchoredEquivalent(), &isBlock, false);
+    m_startBlock = enclosingNodeOfType(m_downstreamStart.parentAnchoredEquivalent(), &isBlock, CanCrossEditingBoundary);
+    m_endBlock = enclosingNodeOfType(m_upstreamEnd.parentAnchoredEquivalent(), &isBlock, CanCrossEditingBoundary);
 }
 
 void DeleteSelectionCommand::saveTypingStyleState()
@@ -284,7 +286,7 @@ void DeleteSelectionCommand::saveTypingStyleState()
 
     // If we're deleting into a Mail blockquote, save the style at end() instead of start()
     // We'll use this later in computeTypingStyleAfterDelete if we end up outside of a Mail blockquote
-    if (nearestMailBlockquote(m_selectionToDelete.start().deprecatedNode()))
+    if (enclosingNodeOfType(m_selectionToDelete.start(), isMailBlockquote))
         m_deleteIntoBlockquoteStyle = EditingStyle::create(m_selectionToDelete.end());
     else
         m_deleteIntoBlockquoteStyle = 0;
@@ -340,7 +342,7 @@ void DeleteSelectionCommand::removeNode(PassRefPtr<Node> node)
         
     if (m_startRoot != m_endRoot && !(node->isDescendantOf(m_startRoot.get()) && node->isDescendantOf(m_endRoot.get()))) {
         // If a node is not in both the start and end editable roots, remove it only if its inside an editable region.
-        if (!node->parentNode()->isContentEditable()) {
+        if (!node->parentNode()->rendererIsEditable()) {
             // Don't remove non-editable atomic nodes.
             if (!node->firstChild())
                 return;
@@ -378,9 +380,9 @@ void DeleteSelectionCommand::removeNode(PassRefPtr<Node> node)
         return;
     }
     
-    if (node == m_startBlock && !isEndOfBlock(VisiblePosition(firstDeepEditingPositionForNode(m_startBlock.get())).previous()))
+    if (node == m_startBlock && !isEndOfBlock(VisiblePosition(firstPositionInNode(m_startBlock.get())).previous()))
         m_needPlaceholder = true;
-    else if (node == m_endBlock && !isStartOfBlock(VisiblePosition(lastDeepEditingPositionForNode(m_startBlock.get())).next()))
+    else if (node == m_endBlock && !isStartOfBlock(VisiblePosition(lastPositionInNode(m_startBlock.get())).next()))
         m_needPlaceholder = true;
     
     // FIXME: Update the endpoints of the range being deleted.
@@ -592,7 +594,7 @@ void DeleteSelectionCommand::mergeParagraphs()
     }
     
     // We need to merge into m_upstreamStart's block, but it's been emptied out and collapsed by deletion.
-    if (!mergeDestination.deepEquivalent().deprecatedNode() || !mergeDestination.deepEquivalent().deprecatedNode()->isDescendantOf(m_upstreamStart.deprecatedNode()->enclosingBlockFlowElement()) || m_startsAtEmptyLine) {
+    if (!mergeDestination.deepEquivalent().deprecatedNode() || !mergeDestination.deepEquivalent().deprecatedNode()->isDescendantOf(enclosingBlock(m_upstreamStart.containerNode())) || m_startsAtEmptyLine) {
         insertNodeAt(createBreakElement(document()).get(), m_upstreamStart);
         mergeDestination = VisiblePosition(m_upstreamStart);
     }
@@ -687,7 +689,7 @@ void DeleteSelectionCommand::calculateTypingStyleAfterDelete()
     // has completed.
     
     // If we deleted into a blockquote, but are now no longer in a blockquote, use the alternate typing style
-    if (m_deleteIntoBlockquoteStyle && !nearestMailBlockquote(m_endingPosition.deprecatedNode()))
+    if (m_deleteIntoBlockquoteStyle && !enclosingNodeOfType(m_endingPosition, isMailBlockquote, CanCrossEditingBoundary))
         m_typingStyle = m_deleteIntoBlockquoteStyle;
     m_deleteIntoBlockquoteStyle = 0;
 
diff --git a/Source/WebCore/editing/EditingStyle.cpp b/Source/WebCore/editing/EditingStyle.cpp
index de71fb7..668c943 100644
--- a/Source/WebCore/editing/EditingStyle.cpp
+++ b/Source/WebCore/editing/EditingStyle.cpp
@@ -377,15 +377,13 @@ bool EditingStyle::textDirection(WritingDirection& writingDirection) const
         return false;
 
     RefPtr<CSSValue> unicodeBidi = m_mutableStyle->getPropertyCSSValue(CSSPropertyUnicodeBidi);
-    if (!unicodeBidi)
+    if (!unicodeBidi || !unicodeBidi->isPrimitiveValue())
         return false;
 
-    ASSERT(unicodeBidi->isPrimitiveValue());
     int unicodeBidiValue = static_cast<CSSPrimitiveValue*>(unicodeBidi.get())->getIdent();
     if (unicodeBidiValue == CSSValueEmbed) {
         RefPtr<CSSValue> direction = m_mutableStyle->getPropertyCSSValue(CSSPropertyDirection);
-        ASSERT(!direction || direction->isPrimitiveValue());
-        if (!direction)
+        if (!direction || !direction->isPrimitiveValue())
             return false;
 
         writingDirection = static_cast<CSSPrimitiveValue*>(direction.get())->getIdent() == CSSValueLtr ? LeftToRightWritingDirection : RightToLeftWritingDirection;
@@ -675,6 +673,11 @@ bool EditingStyle::extractConflictingImplicitStyleOfAttributes(HTMLElement* elem
     return removed;
 }
 
+bool EditingStyle::styleIsPresentInComputedStyleOfNode(Node* node) const
+{
+    return !m_mutableStyle || !getPropertiesNotIn(m_mutableStyle.get(), computedStyle(node).get())->length();
+}
+
 void EditingStyle::prepareToApplyAt(const Position& position, ShouldPreserveWritingDirection shouldPreserveWritingDirection)
 {
     if (!m_mutableStyle)
@@ -702,13 +705,10 @@ void EditingStyle::prepareToApplyAt(const Position& position, ShouldPreserveWrit
         m_mutableStyle->removeProperty(CSSPropertyBackgroundColor, ec);
     }
 
-    if (unicodeBidi) {
-        ASSERT(unicodeBidi->isPrimitiveValue());
+    if (unicodeBidi && unicodeBidi->isPrimitiveValue()) {
         m_mutableStyle->setProperty(CSSPropertyUnicodeBidi, static_cast<CSSPrimitiveValue*>(unicodeBidi.get())->getIdent());
-        if (direction) {
-            ASSERT(direction->isPrimitiveValue());
+        if (direction && direction->isPrimitiveValue())
             m_mutableStyle->setProperty(CSSPropertyDirection, static_cast<CSSPrimitiveValue*>(direction.get())->getIdent());
-        }
     }
 }
 
diff --git a/Source/WebCore/editing/EditingStyle.h b/Source/WebCore/editing/EditingStyle.h
index aa310ac..37bfea7 100644
--- a/Source/WebCore/editing/EditingStyle.h
+++ b/Source/WebCore/editing/EditingStyle.h
@@ -113,6 +113,7 @@ public:
     bool conflictsWithImplicitStyleOfAttributes(HTMLElement*) const;
     bool extractConflictingImplicitStyleOfAttributes(HTMLElement*, ShouldPreserveWritingDirection, EditingStyle* extractedStyle,
             Vector<QualifiedName>& conflictingAttributes, ShouldExtractMatchingStyle) const;
+    bool styleIsPresentInComputedStyleOfNode(Node*) const;
     void prepareToApplyAt(const Position&, ShouldPreserveWritingDirection = DoNotPreserveWritingDirection);
     void mergeTypingStyle(Document*);
     void mergeInlineStyleOfElement(StyledElement*);
diff --git a/Source/WebCore/editing/Editor.cpp b/Source/WebCore/editing/Editor.cpp
index 8807965..a793e0b 100644
--- a/Source/WebCore/editing/Editor.cpp
+++ b/Source/WebCore/editing/Editor.cpp
@@ -289,7 +289,7 @@ bool Editor::canDeleteRange(Range* range) const
     if (!startContainer || !endContainer)
         return false;
     
-    if (!startContainer->isContentEditable() || !endContainer->isContentEditable())
+    if (!startContainer->rendererIsEditable() || !endContainer->rendererIsEditable())
         return false;
     
     if (range->collapsed(ec)) {
@@ -653,10 +653,9 @@ WritingDirection Editor::textDirectionForSelection(bool& hasNestedOrMultipleEmbe
 
             RefPtr<CSSComputedStyleDeclaration> style = computedStyle(n);
             RefPtr<CSSValue> unicodeBidi = style->getPropertyCSSValue(CSSPropertyUnicodeBidi);
-            if (!unicodeBidi)
+            if (!unicodeBidi || !unicodeBidi->isPrimitiveValue())
                 continue;
 
-            ASSERT(unicodeBidi->isPrimitiveValue());
             int unicodeBidiValue = static_cast<CSSPrimitiveValue*>(unicodeBidi.get())->getIdent();
             if (unicodeBidiValue == CSSValueEmbed || unicodeBidiValue == CSSValueBidiOverride)
                 return NaturalWritingDirection;
@@ -684,10 +683,9 @@ WritingDirection Editor::textDirectionForSelection(bool& hasNestedOrMultipleEmbe
 
         RefPtr<CSSComputedStyleDeclaration> style = computedStyle(node);
         RefPtr<CSSValue> unicodeBidi = style->getPropertyCSSValue(CSSPropertyUnicodeBidi);
-        if (!unicodeBidi)
+        if (!unicodeBidi || !unicodeBidi->isPrimitiveValue())
             continue;
 
-        ASSERT(unicodeBidi->isPrimitiveValue());
         int unicodeBidiValue = static_cast<CSSPrimitiveValue*>(unicodeBidi.get())->getIdent();
         if (unicodeBidiValue == CSSValueNormal)
             continue;
@@ -697,10 +695,9 @@ WritingDirection Editor::textDirectionForSelection(bool& hasNestedOrMultipleEmbe
 
         ASSERT(unicodeBidiValue == CSSValueEmbed);
         RefPtr<CSSValue> direction = style->getPropertyCSSValue(CSSPropertyDirection);
-        if (!direction)
+        if (!direction || !direction->isPrimitiveValue())
             continue;
 
-        ASSERT(direction->isPrimitiveValue());
         int directionValue = static_cast<CSSPrimitiveValue*>(direction.get())->getIdent();
         if (directionValue != CSSValueLtr && directionValue != CSSValueRtl)
             continue;
@@ -1371,7 +1368,7 @@ int Editor::spellCheckerDocumentTag()
     return client() ? client()->spellCheckerDocumentTag() : 0;
 }
 
-#if PLATFORM(MAC) && !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
+#if USE(AUTOMATIC_TEXT_REPLACEMENT)
 
 void Editor::uppercaseWord()
 {
@@ -1823,14 +1820,16 @@ void Editor::advanceToNextMisspelling(bool startBeforeSelection)
     int searchEndOffsetAfterWrap = spellingSearchRange->endOffset(ec);
     
     int misspellingOffset = 0;
-#if PLATFORM(MAC) && !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
-    RefPtr<Range> grammarSearchRange = spellingSearchRange->cloneRange(ec);
-    String misspelledWord;
-    String badGrammarPhrase;
+    GrammarDetail grammarDetail;
     int grammarPhraseOffset = 0;
+    RefPtr<Range> grammarSearchRange;
+    String badGrammarPhrase;
+    String misspelledWord;
+
+#if USE(UNIFIED_TEXT_CHECKING)
+    grammarSearchRange = spellingSearchRange->cloneRange(ec);
     bool isSpelling = true;
     int foundOffset = 0;
-    GrammarDetail grammarDetail;
     String foundItem = TextCheckingHelper(client(), spellingSearchRange).findFirstMisspellingOrBadGrammar(isGrammarCheckingEnabled(), isSpelling, foundOffset, grammarDetail);
     if (isSpelling) {
         misspelledWord = foundItem;
@@ -1841,15 +1840,11 @@ void Editor::advanceToNextMisspelling(bool startBeforeSelection)
     }
 #else
     RefPtr<Range> firstMisspellingRange;
-    String misspelledWord = TextCheckingHelper(client(), spellingSearchRange).findFirstMisspelling(misspellingOffset, false, firstMisspellingRange);
-    String badGrammarPhrase;
-
-#ifndef BUILDING_ON_TIGER
-    int grammarPhraseOffset = 0;
-    GrammarDetail grammarDetail;
+    misspelledWord = TextCheckingHelper(client(), spellingSearchRange).findFirstMisspelling(misspellingOffset, false, firstMisspellingRange);
 
+#if USE(GRAMMAR_CHECKING)
     // Search for bad grammar that occurs prior to the next misspelled word (if any)
-    RefPtr<Range> grammarSearchRange = spellingSearchRange->cloneRange(ec);
+    grammarSearchRange = spellingSearchRange->cloneRange(ec);
     if (!misspelledWord.isEmpty()) {
         // Stop looking at start of next misspelled word
         CharacterIterator chars(grammarSearchRange.get());
@@ -1869,7 +1864,7 @@ void Editor::advanceToNextMisspelling(bool startBeforeSelection)
         // going until the end of the very first chunk we tested is far enough
         spellingSearchRange->setEnd(searchEndNodeAfterWrap, searchEndOffsetAfterWrap, ec);
         
-#if PLATFORM(MAC) && !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
+#if USE(UNIFIED_TEXT_CHECKING)
         grammarSearchRange = spellingSearchRange->cloneRange(ec);
         foundItem = TextCheckingHelper(client(), spellingSearchRange).findFirstMisspellingOrBadGrammar(isGrammarCheckingEnabled(), isSpelling, foundOffset, grammarDetail);
         if (isSpelling) {
@@ -1882,7 +1877,7 @@ void Editor::advanceToNextMisspelling(bool startBeforeSelection)
 #else
         misspelledWord = TextCheckingHelper(client(), spellingSearchRange).findFirstMisspelling(misspellingOffset, false, firstMisspellingRange);
 
-#ifndef BUILDING_ON_TIGER
+#if USE(GRAMMAR_CHECKING)
         grammarSearchRange = spellingSearchRange->cloneRange(ec);
         if (!misspelledWord.isEmpty()) {
             // Stop looking at start of next misspelled word
@@ -1898,9 +1893,7 @@ void Editor::advanceToNextMisspelling(bool startBeforeSelection)
     }
     
     if (!badGrammarPhrase.isEmpty()) {
-#ifdef BUILDING_ON_TIGER
-        ASSERT_NOT_REACHED();
-#else
+        ASSERT(WTF_USE_GRAMMAR_CHECKING);
         // We found bad grammar. Since we only searched for bad grammar up to the first misspelled word, the bad grammar
         // takes precedence and we ignore any potential misspelled word. Select the grammar detail, update the spelling
         // panel, and store a marker so we draw the green squiggle later.
@@ -1915,7 +1908,6 @@ void Editor::advanceToNextMisspelling(bool startBeforeSelection)
         
         client()->updateSpellingUIWithGrammarString(badGrammarPhrase, grammarDetail);
         frame()->document()->markers()->addMarker(badGrammarRange.get(), DocumentMarker::Grammar, grammarDetail.userDescription);
-#endif        
     } else if (!misspelledWord.isEmpty()) {
         // We found a misspelling, but not any earlier bad grammar. Select the misspelling, update the spelling panel, and store
         // a marker so we draw the red squiggle later.
@@ -1958,23 +1950,23 @@ bool Editor::isSelectionMisspelled()
 
 bool Editor::isSelectionUngrammatical()
 {
-#ifdef BUILDING_ON_TIGER
-    return false;
-#else
+#if USE(GRAMMAR_CHECKING)
     Vector<String> ignoredGuesses;
     return TextCheckingHelper(client(), frame()->selection()->toNormalizedRange()).isUngrammatical(ignoredGuesses);
+#else
+    return false;
 #endif
 }
 
 Vector<String> Editor::guessesForUngrammaticalSelection()
 {
-#ifdef BUILDING_ON_TIGER
-    return Vector<String>();
-#else
+#if USE(GRAMMAR_CHECKING)
     Vector<String> guesses;
     // Ignore the result of isUngrammatical; we just want the guesses, whether or not there are any
     TextCheckingHelper(client(), frame()->selection()->toNormalizedRange()).isUngrammatical(guesses);
     return guesses;
+#else
+    return Vector<String>();
 #endif
 }
 
@@ -1991,7 +1983,7 @@ Vector<String> Editor::guessesForMisspelledSelection()
 
 Vector<String> Editor::guessesForMisspelledOrUngrammaticalSelection(bool& misspelled, bool& ungrammatical)
 {
-#if PLATFORM(MAC) && !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
+#if USE(UNIFIED_TEXT_CHECKING)
     return TextCheckingHelper(client(), frame()->selection()->toNormalizedRange()).guessesForMisspelledOrUngrammaticalRange(isGrammarCheckingEnabled(), misspelled, ungrammatical);
 #else
     misspelled = isSelectionMisspelled();
@@ -2060,7 +2052,7 @@ void Editor::markMisspellingsAndBadGrammar(const VisibleSelection &movingSelecti
 
 void Editor::markMisspellingsAfterTypingToWord(const VisiblePosition &wordStart, const VisibleSelection& selectionAfterTyping)
 {
-#if PLATFORM(MAC) && !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
+#if USE(UNIFIED_TEXT_CHECKING)
 #if SUPPORT_AUTOCORRECTION_PANEL
     // Apply pending autocorrection before next round of spell checking.
     bool doApplyCorrection = true;
@@ -2072,7 +2064,7 @@ void Editor::markMisspellingsAfterTypingToWord(const VisiblePosition &wordStart,
             doApplyCorrection = false;
     }
     if (doApplyCorrection)
-        dismissCorrectionPanel(ReasonForDismissingCorrectionPanelAccepted);
+        handleCorrectionPanelResult(dismissCorrectionPanelSoon(ReasonForDismissingCorrectionPanelAccepted));
     else
         m_correctionPanelInfo.rangeToBeReplaced.clear();
 #else
@@ -2082,12 +2074,14 @@ void Editor::markMisspellingsAfterTypingToWord(const VisiblePosition &wordStart,
     if (isContinuousSpellCheckingEnabled())
         textCheckingOptions |= MarkSpelling;
 
+#if USE(AUTOMATIC_TEXT_REPLACEMENT)
     if (isAutomaticQuoteSubstitutionEnabled()
         || isAutomaticLinkDetectionEnabled()
         || isAutomaticDashSubstitutionEnabled()
         || isAutomaticTextReplacementEnabled()
         || ((textCheckingOptions & MarkSpelling) && isAutomaticSpellingCorrectionEnabled()))
         textCheckingOptions |= PerformReplacement;
+#endif
 
     if (!textCheckingOptions & (MarkSpelling | PerformReplacement))
         return;
@@ -2162,7 +2156,7 @@ void Editor::markMisspellingsOrBadGrammar(const VisibleSelection& selection, boo
     
     // If we're not in an editable node, bail.
     Node* editableNode = searchRange->startContainer();
-    if (!editableNode || !editableNode->isContentEditable())
+    if (!editableNode || !editableNode->rendererIsEditable())
         return;
 
     if (!isSpellCheckingEnabledFor(editableNode))
@@ -2176,12 +2170,9 @@ void Editor::markMisspellingsOrBadGrammar(const VisibleSelection& selection, boo
     if (checkSpelling)
         checker.markAllMisspellings(firstMisspellingRange);
     else {
-#ifdef BUILDING_ON_TIGER
-        ASSERT_NOT_REACHED();
-#else
+        ASSERT(WTF_USE_GRAMMAR_CHECKING);
         if (isGrammarCheckingEnabled())
             checker.markAllBadGrammar();
-#endif
     }    
 }
 
@@ -2207,17 +2198,14 @@ void Editor::markMisspellings(const VisibleSelection& selection, RefPtr<Range>&
     
 void Editor::markBadGrammar(const VisibleSelection& selection)
 {
-#ifndef BUILDING_ON_TIGER
+    ASSERT(WTF_USE_GRAMMAR_CHECKING);
     RefPtr<Range> firstMisspellingRange;
     markMisspellingsOrBadGrammar(selection, false, firstMisspellingRange);
-#else
-    UNUSED_PARAM(selection);
-#endif
 }
 
-#if PLATFORM(MAC) && !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
 void Editor::markAllMisspellingsAndBadGrammarInRanges(TextCheckingOptions textCheckingOptions, Range* spellingRange, Range* grammarRange)
 {
+#if USE(UNIFIED_TEXT_CHECKING)
     // There shouldn't be pending autocorrection at this moment.
     ASSERT(!m_correctionPanelInfo.rangeToBeReplaced);
 
@@ -2233,7 +2221,7 @@ void Editor::markAllMisspellingsAndBadGrammarInRanges(TextCheckingOptions textCh
 
     // If we're not in an editable node, bail.
     Node* editableNode = spellingRange->startContainer();
-    if (!editableNode || !editableNode->isContentEditable())
+    if (!editableNode || !editableNode->rendererIsEditable())
         return;
 
     if (!isSpellCheckingEnabledFor(editableNode))
@@ -2248,7 +2236,6 @@ void Editor::markAllMisspellingsAndBadGrammarInRanges(TextCheckingOptions textCh
 
     TextCheckingParagraph spellingParagraph(spellingRange);
     TextCheckingParagraph grammarParagraph(shouldMarkGrammar ? grammarRange : 0);
-    TextCheckingParagraph& paragraph = shouldMarkGrammar ? grammarParagraph : spellingParagraph; 
 
     if (shouldMarkGrammar ? (spellingParagraph.isRangeEmpty() && grammarParagraph.isEmpty()) : spellingParagraph.isEmpty())
         return;
@@ -2257,13 +2244,13 @@ void Editor::markAllMisspellingsAndBadGrammarInRanges(TextCheckingOptions textCh
         if (m_frame->selection()->selectionType() == VisibleSelection::CaretSelection) {
             // Attempt to save the caret position so we can restore it later if needed
             Position caretPosition = m_frame->selection()->end();
-            int offset = paragraph.offsetTo(caretPosition, ec);
+            int offset = spellingParagraph.offsetTo(caretPosition, ec);
             if (!ec) {
                 selectionOffset = offset;
                 restoreSelectionAfterChange = true;
-                if (selectionOffset > 0 && (selectionOffset > paragraph.textLength() || paragraph.textCharAt(selectionOffset - 1) == newlineCharacter))
+                if (selectionOffset > 0 && (selectionOffset > spellingParagraph.textLength() || spellingParagraph.textCharAt(selectionOffset - 1) == newlineCharacter))
                     adjustSelectionForParagraphBoundaries = true;
-                if (selectionOffset > 0 && selectionOffset <= paragraph.textLength() && isAmbiguousBoundaryCharacter(paragraph.textCharAt(selectionOffset - 1)))
+                if (selectionOffset > 0 && selectionOffset <= spellingParagraph.textLength() && isAmbiguousBoundaryCharacter(spellingParagraph.textCharAt(selectionOffset - 1)))
                     ambiguousBoundaryOffset = selectionOffset - 1;
             }
         }
@@ -2278,6 +2265,7 @@ void Editor::markAllMisspellingsAndBadGrammarInRanges(TextCheckingOptions textCh
     if (shouldShowCorrectionPanel)
         checkingTypes |= TextCheckingTypeCorrection;
     if (shouldPerformReplacement) {
+#if USE(AUTOMATIC_TEXT_REPLACEMENT)
         if (isAutomaticLinkDetectionEnabled())
             checkingTypes |= TextCheckingTypeLink;
         if (isAutomaticQuoteSubstitutionEnabled())
@@ -2288,8 +2276,13 @@ void Editor::markAllMisspellingsAndBadGrammarInRanges(TextCheckingOptions textCh
             checkingTypes |= TextCheckingTypeReplacement;
         if (shouldMarkSpelling && isAutomaticSpellingCorrectionEnabled())
             checkingTypes |= TextCheckingTypeCorrection;
+#endif
     }
-    textChecker()->checkTextOfParagraph(paragraph.textCharacters(), paragraph.textLength(), checkingTypes, results);
+    if (shouldMarkGrammar)
+        textChecker()->checkTextOfParagraph(grammarParagraph.textCharacters(), grammarParagraph.textLength(), checkingTypes, results);
+    else
+        textChecker()->checkTextOfParagraph(spellingParagraph.textCharacters(), spellingParagraph.textLength(), checkingTypes, results);
+        
 
 #if SUPPORT_AUTOCORRECTION_PANEL
     // If this checking is only for showing correction panel, we shouldn't bother to mark misspellings.
@@ -2348,7 +2341,7 @@ void Editor::markAllMisspellingsAndBadGrammarInRanges(TextCheckingOptions textCh
             // 2. The result doesn't end at an ambiguous boundary.
             //    (FIXME: this is required until 6853027 is fixed and text checking can do this for us
             bool doReplacement = replacementLength > 0 && !resultEndsAtAmbiguousBoundary;
-            RefPtr<Range> rangeToReplace = paragraph.subrange(resultLocation, resultLength);
+            RefPtr<Range> rangeToReplace = spellingParagraph.subrange(resultLocation, resultLength);
             VisibleSelection selectionToReplace(rangeToReplace.get(), DOWNSTREAM);
 
             // adding links should be done only immediately after they are typed
@@ -2387,7 +2380,7 @@ void Editor::markAllMisspellingsAndBadGrammarInRanges(TextCheckingOptions textCh
                     m_correctionPanelInfo.replacedString = plainText(rangeToReplace.get());
                     m_correctionPanelInfo.replacementString = result->replacement;
                     m_correctionPanelInfo.isActive = true;
-                    client()->showCorrectionPanel(m_correctionPanelInfo.panelType, boundingBox, m_correctionPanelInfo.replacedString, result->replacement, Vector<String>(), this);
+                    client()->showCorrectionPanel(m_correctionPanelInfo.panelType, boundingBox, m_correctionPanelInfo.replacedString, result->replacement, Vector<String>());
                     break;
                 }
                 // If this function is called for showing correction panel, we ignore other correction or replacement.
@@ -2433,7 +2426,7 @@ void Editor::markAllMisspellingsAndBadGrammarInRanges(TextCheckingOptions textCh
 
                 if (result->type == TextCheckingTypeCorrection) {
                     // Add a marker so that corrections can easily be undone and won't be re-corrected.
-                    RefPtr<Range> replacedRange = paragraph.subrange(resultLocation, replacementLength);
+                    RefPtr<Range> replacedRange = spellingParagraph.subrange(resultLocation, replacementLength);
                     replacedRange->startContainer()->document()->markers()->addMarker(replacedRange.get(), DocumentMarker::Replacement, replacedString);
                     replacedRange->startContainer()->document()->markers()->addMarker(replacedRange.get(), DocumentMarker::CorrectionIndicator);
                     replacedRange->startContainer()->document()->markers()->addMarker(replacedRange.get(), DocumentMarker::SpellCheckingExemption);
@@ -2444,9 +2437,9 @@ void Editor::markAllMisspellingsAndBadGrammarInRanges(TextCheckingOptions textCh
 
     if (selectionChanged) {
         // Restore the caret position if we have made any replacements
-        paragraph.expandRangeToNextEnd();
-        if (restoreSelectionAfterChange && selectionOffset >= 0 && selectionOffset <= paragraph.rangeLength()) {
-            RefPtr<Range> selectionRange = paragraph.subrange(0, selectionOffset);
+        spellingParagraph.expandRangeToNextEnd();
+        if (restoreSelectionAfterChange && selectionOffset >= 0 && selectionOffset <= spellingParagraph.rangeLength()) {
+            RefPtr<Range> selectionRange = spellingParagraph.subrange(0, selectionOffset);
             m_frame->selection()->moveTo(selectionRange->endPosition(), DOWNSTREAM);
             if (adjustSelectionForParagraphBoundaries)
                 m_frame->selection()->modify(SelectionController::AlterationMove, DirectionForward, CharacterGranularity);
@@ -2456,10 +2449,17 @@ void Editor::markAllMisspellingsAndBadGrammarInRanges(TextCheckingOptions textCh
             m_frame->selection()->modify(SelectionController::AlterationMove, DirectionForward, CharacterGranularity);
         }
     }
+#else
+    ASSERT_NOT_REACHED();
+    UNUSED_PARAM(textCheckingOptions);
+    UNUSED_PARAM(spellingRange);
+    UNUSED_PARAM(grammarRange);
+#endif // USE(UNIFIED_TEXT_CHECKING)
 }
 
 void Editor::changeBackToReplacedString(const String& replacedString)
 {
+#if USE(UNIFIED_TEXT_CHECKING)
     if (replacedString.isEmpty())
         return;
 
@@ -2478,13 +2478,16 @@ void Editor::changeBackToReplacedString(const String& replacedString)
 #if SUPPORT_AUTOCORRECTION_PANEL
     changedRange->startContainer()->document()->markers()->addMarker(changedRange.get(), DocumentMarker::SpellCheckingExemption);
 #endif
+#else
+    ASSERT_NOT_REACHED();
+    UNUSED_PARAM(replacedString);
+#endif // USE(UNIFIED_TEXT_CHECKING)
 }
 
-#endif
 
 void Editor::markMisspellingsAndBadGrammar(const VisibleSelection& spellingSelection, bool markGrammar, const VisibleSelection& grammarSelection)
 {
-#if PLATFORM(MAC) && !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
+#if USE(UNIFIED_TEXT_CHECKING)
     if (!isContinuousSpellCheckingEnabled())
         return;
     TextCheckingOptions textCheckingOptions = MarkSpelling;
@@ -2517,7 +2520,7 @@ void Editor::correctionPanelTimerFired(Timer<Editor>*)
         m_correctionPanelInfo.replacedString = plainText(m_correctionPanelInfo.rangeToBeReplaced.get());
         FloatRect boundingBox = windowRectForRange(m_correctionPanelInfo.rangeToBeReplaced.get());
         if (!boundingBox.isEmpty())
-            client()->showCorrectionPanel(m_correctionPanelInfo.panelType, boundingBox, m_correctionPanelInfo.replacedString, m_correctionPanelInfo.replacementString, Vector<String>(), this);
+            client()->showCorrectionPanel(m_correctionPanelInfo.panelType, boundingBox, m_correctionPanelInfo.replacedString, m_correctionPanelInfo.replacementString, Vector<String>());
     }
         break;
     case CorrectionPanelInfo::PanelTypeSpellingSuggestions: {
@@ -2535,7 +2538,7 @@ void Editor::correctionPanelTimerFired(Timer<Editor>*)
         m_correctionPanelInfo.isActive = true;
         FloatRect boundingBox = windowRectForRange(m_correctionPanelInfo.rangeToBeReplaced.get());
         if (!boundingBox.isEmpty())
-            client()->showCorrectionPanel(m_correctionPanelInfo.panelType, boundingBox, m_correctionPanelInfo.replacedString, topSuggestion, suggestions, this);
+            client()->showCorrectionPanel(m_correctionPanelInfo.panelType, boundingBox, m_correctionPanelInfo.replacedString, topSuggestion, suggestions);
     }
         break;
     }
@@ -2601,39 +2604,36 @@ void Editor::stopCorrectionPanelTimer()
 #endif
 }
 
-void Editor::handleCancelOperation()
+void Editor::dismissCorrectionPanel(ReasonForDismissingCorrectionPanel reasonForDismissing)
 {
 #if SUPPORT_AUTOCORRECTION_PANEL
     if (!m_correctionPanelInfo.isActive)
         return;
     m_correctionPanelInfo.isActive = false;
+    m_correctionPanelIsDismissedByEditor = true;
     if (client())
-        client()->dismissCorrectionPanel(ReasonForDismissingCorrectionPanelCancelled);
-#endif
-}
-
-bool Editor::isShowingCorrectionPanel()
-{
-#if SUPPORT_AUTOCORRECTION_PANEL
-    if (client())
-        return client()->isShowingCorrectionPanel();
+        client()->dismissCorrectionPanel(reasonForDismissing);
+#else
+    UNUSED_PARAM(reasonForDismissing);
 #endif
-    return false;
 }
 
-void Editor::dismissCorrectionPanel(ReasonForDismissingCorrectionPanel reasonForDismissing)
+String Editor::dismissCorrectionPanelSoon(ReasonForDismissingCorrectionPanel reasonForDismissing)
 {
 #if SUPPORT_AUTOCORRECTION_PANEL
     if (!m_correctionPanelInfo.isActive)
-        return;
+        return String();
     m_correctionPanelInfo.isActive = false;
     m_correctionPanelIsDismissedByEditor = true;
-    if (client())
-        client()->dismissCorrectionPanel(reasonForDismissing);
+    if (!client())
+        return String();
+    return client()->dismissCorrectionPanelSoon(reasonForDismissing);
 #else
     UNUSED_PARAM(reasonForDismissing);
+    return String();
 #endif
 }
+
 void Editor::removeSpellAndCorrectionMarkersFromWordsToBeEdited(bool doNotRemoveIfSelectionAtWordBoundary)
 {
     // We want to remove the markers from a word if an editing command will change the word. This can happen in one of
@@ -2768,7 +2768,7 @@ bool Editor::applyAutocorrectionBeforeTypingIfAppropriate()
     Position caretPosition = m_frame->selection()->selection().start();
 
     if (m_correctionPanelInfo.rangeToBeReplaced->endPosition() == caretPosition) {
-        dismissCorrectionPanel(ReasonForDismissingCorrectionPanelAccepted);
+        handleCorrectionPanelResult(dismissCorrectionPanelSoon(ReasonForDismissingCorrectionPanelAccepted));
         return true;
     } 
     
@@ -3572,7 +3572,7 @@ static Node* findFirstMarkable(Node* node)
     return 0;
 }
 
-bool Editor::selectionStartHasSpellingMarkerFor(int from, int length) const
+bool Editor::selectionStartHasMarkerFor(DocumentMarker::MarkerType markerType, int from, int length) const
 {
     Node* node = findFirstMarkable(m_frame->selection()->start().deprecatedNode());
     if (!node)
@@ -3583,7 +3583,7 @@ bool Editor::selectionStartHasSpellingMarkerFor(int from, int length) const
     Vector<DocumentMarker> markers = m_frame->document()->markers()->markersForNode(node);
     for (size_t i = 0; i < markers.size(); ++i) {
         DocumentMarker marker = markers[i];
-        if (marker.startOffset <= startOffset && endOffset <= marker.endOffset && marker.type == DocumentMarker::Spelling)
+        if (marker.startOffset <= startOffset && endOffset <= marker.endOffset && marker.type == markerType)
             return true;
     }
 
diff --git a/Source/WebCore/editing/Editor.h b/Source/WebCore/editing/Editor.h
index e1a7119..c723ddf 100644
--- a/Source/WebCore/editing/Editor.h
+++ b/Source/WebCore/editing/Editor.h
@@ -36,6 +36,7 @@
 #include "EditorInsertAction.h"
 #include "FindOptions.h"
 #include "SelectionController.h"
+#include "TextChecking.h"
 #include "Timer.h"
 #include "VisibleSelection.h"
 #include "WritingDirection.h"
@@ -222,7 +223,7 @@ public:
     void markMisspellings(const VisibleSelection&, RefPtr<Range>& firstMisspellingRange);
     void markBadGrammar(const VisibleSelection&);
     void markMisspellingsAndBadGrammar(const VisibleSelection& spellingSelection, bool markGrammar, const VisibleSelection& grammarSelection);
-#if PLATFORM(MAC) && !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
+#if USE(AUTOMATIC_TEXT_REPLACEMENT)
     void uppercaseWord();
     void lowercaseWord();
     void capitalizeWord();
@@ -239,6 +240,8 @@ public:
     void toggleAutomaticTextReplacement();
     bool isAutomaticSpellingCorrectionEnabled();
     void toggleAutomaticSpellingCorrection();
+#endif
+
     enum TextCheckingOptionFlags {
         MarkSpelling = 1 << 0,
         MarkGrammar = 1 << 1,
@@ -249,7 +252,7 @@ public:
 
     void markAllMisspellingsAndBadGrammarInRanges(TextCheckingOptions, Range* spellingRange, Range* grammarRange);
     void changeBackToReplacedString(const String& replacedString);
-#endif
+
     void advanceToNextMisspelling(bool startBeforeSelection = false);
     void showSpellingGuessPanel();
     bool spellingPanelIsShowing();
@@ -320,11 +323,9 @@ public:
 
     void addToKillRing(Range*, bool prepend);
 
-    void handleCancelOperation();
     void startCorrectionPanelTimer(CorrectionPanelInfo::PanelType);
     // If user confirmed a correction in the correction panel, correction has non-zero length, otherwise it means that user has dismissed the panel.
     void handleCorrectionPanelResult(const String& correction);
-    bool isShowingCorrectionPanel();
 
     void pasteAsFragment(PassRefPtr<DocumentFragment>, bool smartReplace, bool matchStyle);
     void pasteAsPlainText(const String&, bool smartReplace);
@@ -376,9 +377,10 @@ public:
     bool canCopyExcludingStandaloneImages();
     void takeFindStringFromSelection();
     void writeSelectionToPasteboard(const String& pasteboardName, const Vector<String>& pasteboardTypes);
+    void readSelectionFromPasteboard(const String& pasteboardName);
 #endif
 
-    bool selectionStartHasSpellingMarkerFor(int from, int length) const;
+    bool selectionStartHasMarkerFor(DocumentMarker::MarkerType, int from, int length) const;
     void removeSpellAndCorrectionMarkersFromWordsToBeEdited(bool doNotRemoveIfSelectionAtWordBoundary);
 
 private:
@@ -425,6 +427,7 @@ private:
     Node* findEventTargetFromSelection() const;
     void stopCorrectionPanelTimer();
     void dismissCorrectionPanel(ReasonForDismissingCorrectionPanel);
+    String dismissCorrectionPanelSoon(ReasonForDismissingCorrectionPanel);
     void applyCorrectionPanelInfo(const Vector<DocumentMarker::MarkerType>& markerTypesToAdd);
     // Return true if correction was applied, false otherwise.
     bool applyAutocorrectionBeforeTypingIfAppropriate();
diff --git a/Source/WebCore/editing/EditorCommand.cpp b/Source/WebCore/editing/EditorCommand.cpp
index 6ea9954..8ea37bb 100644
--- a/Source/WebCore/editing/EditorCommand.cpp
+++ b/Source/WebCore/editing/EditorCommand.cpp
@@ -56,6 +56,7 @@
 #include "Sound.h"
 #include "TypingCommand.h"
 #include "UnlinkCommand.h"
+#include "UserTypingGestureIndicator.h"
 #include "htmlediting.h"
 #include "markup.h"
 #include <wtf/text/AtomicString.h>
@@ -254,7 +255,7 @@ static int verticalScrollDistance(Frame* frame)
     RenderStyle* style = renderer->style();
     if (!style)
         return 0;
-    if (!(style->overflowY() == OSCROLL || style->overflowY() == OAUTO || focusedNode->isContentEditable()))
+    if (!(style->overflowY() == OSCROLL || style->overflowY() == OAUTO || focusedNode->rendererIsEditable()))
         return 0;
     int height = std::min<int>(toRenderBox(renderer)->clientHeight(),
                                frame->view()->visibleHeight());
@@ -294,19 +295,25 @@ static bool executeCreateLink(Frame* frame, Event*, EditorCommandSource, const S
     return true;
 }
 
-static bool executeCut(Frame* frame, Event*, EditorCommandSource, const String&)
+static bool executeCut(Frame* frame, Event*, EditorCommandSource source, const String&)
 {
-    frame->editor()->cut();
+    if (source == CommandFromMenuOrKeyBinding) {
+        UserTypingGestureIndicator typingGestureIndicator(frame);
+        frame->editor()->cut();
+    } else
+        frame->editor()->cut();
     return true;
 }
 
 static bool executeDelete(Frame* frame, Event*, EditorCommandSource source, const String&)
 {
     switch (source) {
-    case CommandFromMenuOrKeyBinding:
+    case CommandFromMenuOrKeyBinding: {
         // Doesn't modify the text if the current selection isn't a range.
+        UserTypingGestureIndicator typingGestureIndicator(frame);
         frame->editor()->performDelete();
         return true;
+    }
     case CommandFromDOM:
     case CommandFromDOMWithUserInterface:
         // If the current selection is a caret, delete the preceding character. IE performs forwardDelete, but we currently side with Firefox.
@@ -883,21 +890,33 @@ static bool executeOutdent(Frame* frame, Event*, EditorCommandSource, const Stri
     return true;
 }
 
-static bool executePaste(Frame* frame, Event*, EditorCommandSource, const String&)
+static bool executePaste(Frame* frame, Event*, EditorCommandSource source, const String&)
 {
-    frame->editor()->paste();
+    if (source == CommandFromMenuOrKeyBinding) {
+        UserTypingGestureIndicator typingGestureIndicator(frame);
+        frame->editor()->paste();
+    } else
+        frame->editor()->paste();
     return true;
 }
 
-static bool executePasteAndMatchStyle(Frame* frame, Event*, EditorCommandSource, const String&)
+static bool executePasteAndMatchStyle(Frame* frame, Event*, EditorCommandSource source, const String&)
 {
-    frame->editor()->pasteAsPlainText();
+    if (source == CommandFromMenuOrKeyBinding) {
+        UserTypingGestureIndicator typingGestureIndicator(frame);
+        frame->editor()->pasteAsPlainText();
+    } else
+        frame->editor()->pasteAsPlainText();
     return true;
 }
 
-static bool executePasteAsPlainText(Frame* frame, Event*, EditorCommandSource, const String&)
+static bool executePasteAsPlainText(Frame* frame, Event*, EditorCommandSource source, const String&)
 {
-    frame->editor()->pasteAsPlainText();
+    if (source == CommandFromMenuOrKeyBinding) {
+        UserTypingGestureIndicator typingGestureIndicator(frame);
+        frame->editor()->pasteAsPlainText();
+    } else
+        frame->editor()->pasteAsPlainText();
     return true;
 }
 
@@ -1091,14 +1110,6 @@ static bool executeYankAndSelect(Frame* frame, Event*, EditorCommandSource, cons
     return true;
 }
 
-#if SUPPORT_AUTOCORRECTION_PANEL
-static bool executeCancelOperation(Frame* frame, Event*, EditorCommandSource, const String&)
-{
-    frame->editor()->handleCancelOperation();
-    return true;
-}
-#endif
-
 // Supported functions
 
 static bool supported(Frame*)
@@ -1249,13 +1260,6 @@ static bool enabledUndo(Frame* frame, Event*, EditorCommandSource)
     return frame->editor()->canUndo();
 }
 
-#if SUPPORT_AUTOCORRECTION_PANEL
-static bool enabledDismissCorrectionPanel(Frame* frame, Event*, EditorCommandSource)
-{
-    return frame->editor()->isShowingCorrectionPanel();
-}
-#endif
-
 // State functions
 
 static TriState stateNone(Frame*, Event*)
@@ -1532,10 +1536,6 @@ static const CommandMap& createCommandMap()
 #if PLATFORM(MAC)
         { "TakeFindStringFromSelection", { executeTakeFindStringFromSelection, supportedFromMenuOrKeyBinding, enabledTakeFindStringFromSelection, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
 #endif
-
-#if SUPPORT_AUTOCORRECTION_PANEL
-        { "CancelOperation", { executeCancelOperation, supportedFromMenuOrKeyBinding, enabledDismissCorrectionPanel, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
-#endif
     };
 
     // These unsupported commands are listed here since they appear in the Microsoft
diff --git a/Source/WebCore/editing/EditorInsertAction.h b/Source/WebCore/editing/EditorInsertAction.h
index 5b732dc..b8b137d 100644
--- a/Source/WebCore/editing/EditorInsertAction.h
+++ b/Source/WebCore/editing/EditorInsertAction.h
@@ -32,7 +32,7 @@ namespace WebCore {
 enum EditorInsertAction {
     EditorInsertActionTyped,
     EditorInsertActionPasted,
-    EditorInsertActionDropped,
+    EditorInsertActionDropped
 };
 
 } // namespace
diff --git a/Source/WebCore/editing/FormatBlockCommand.cpp b/Source/WebCore/editing/FormatBlockCommand.cpp
index 9d90a1e..759ca31 100644
--- a/Source/WebCore/editing/FormatBlockCommand.cpp
+++ b/Source/WebCore/editing/FormatBlockCommand.cpp
@@ -112,8 +112,7 @@ Element* FormatBlockCommand::elementForFormatBlockCommand(Range* range)
     if (!rootEditableElement || commonAncestor->contains(rootEditableElement))
         return 0;
 
-    ASSERT(commonAncestor->isElementNode());
-    return static_cast<Element*>(commonAncestor);
+    return commonAncestor->isElementNode() ? toElement(commonAncestor) : 0;
 }
 
 bool isElementForFormatBlock(const QualifiedName& tagName)
@@ -149,14 +148,14 @@ Node* enclosingBlockToSplitTreeTo(Node* startNode)
 {
     Node* lastBlock = startNode;
     for (Node* n = startNode; n; n = n->parentNode()) {
-        if (!n->isContentEditable())
+        if (!n->rendererIsEditable())
             return lastBlock;
-        if (isTableCell(n) || n->hasTagName(bodyTag) || !n->parentNode() || !n->parentNode()->isContentEditable() || isElementForFormatBlock(n))
+        if (isTableCell(n) || n->hasTagName(bodyTag) || !n->parentNode() || !n->parentNode()->rendererIsEditable() || isElementForFormatBlock(n))
             return n;
         if (isBlock(n))
             lastBlock = n;
         if (isListElement(n))
-            return n->parentNode()->isContentEditable() ? n->parentNode() : n;
+            return n->parentNode()->rendererIsEditable() ? n->parentNode() : n;
     }
     return lastBlock;
 }
diff --git a/Source/WebCore/editing/IndentOutdentCommand.cpp b/Source/WebCore/editing/IndentOutdentCommand.cpp
index 82bec06..0229e85 100644
--- a/Source/WebCore/editing/IndentOutdentCommand.cpp
+++ b/Source/WebCore/editing/IndentOutdentCommand.cpp
@@ -120,7 +120,7 @@ void IndentOutdentCommand::outdentParagraph()
     VisiblePosition visibleEndOfParagraph = endOfParagraph(visibleStartOfParagraph);
 
     Node* enclosingNode = enclosingNodeOfType(visibleStartOfParagraph.deepEquivalent(), &isListOrIndentBlockquote);
-    if (!enclosingNode || !enclosingNode->parentNode()->isContentEditable())  // We can't outdent if there is no place to go!
+    if (!enclosingNode || !enclosingNode->parentNode()->rendererIsEditable()) // We can't outdent if there is no place to go!
         return;
 
     // Use InsertListCommand to remove the selection from the list
@@ -151,7 +151,7 @@ void IndentOutdentCommand::outdentParagraph()
             if (ContainerNode* splitPointParent = splitPoint->parentNode()) {
                 if (splitPointParent->hasTagName(blockquoteTag)
                     && !splitPoint->hasTagName(blockquoteTag)
-                    && splitPointParent->parentNode()->isContentEditable()) // We can't outdent if there is no place to go!
+                    && splitPointParent->parentNode()->rendererIsEditable()) // We can't outdent if there is no place to go!
                     splitElement(static_cast<Element*>(splitPointParent), splitPoint);
             }
         }
diff --git a/Source/WebCore/editing/InsertIntoTextNodeCommand.cpp b/Source/WebCore/editing/InsertIntoTextNodeCommand.cpp
index 9b7761c..b1a455b 100644
--- a/Source/WebCore/editing/InsertIntoTextNodeCommand.cpp
+++ b/Source/WebCore/editing/InsertIntoTextNodeCommand.cpp
@@ -44,7 +44,7 @@ InsertIntoTextNodeCommand::InsertIntoTextNodeCommand(PassRefPtr<Text> node, unsi
 
 void InsertIntoTextNodeCommand::doApply()
 {
-    if (!m_node->isContentEditable())
+    if (!m_node->rendererIsEditable())
         return;
     
     ExceptionCode ec;
@@ -56,7 +56,7 @@ void InsertIntoTextNodeCommand::doApply()
 
 void InsertIntoTextNodeCommand::doUnapply()
 {
-    if (!m_node->isContentEditable())
+    if (!m_node->rendererIsEditable())
         return;
         
     // Need to notify this before actually deleting the text
diff --git a/Source/WebCore/editing/InsertLineBreakCommand.cpp b/Source/WebCore/editing/InsertLineBreakCommand.cpp
index 2260a00..76c9052 100644
--- a/Source/WebCore/editing/InsertLineBreakCommand.cpp
+++ b/Source/WebCore/editing/InsertLineBreakCommand.cpp
@@ -171,7 +171,7 @@ void InsertLineBreakCommand::doApply()
         // leaves and then comes back, new input will have the right style.
         // FIXME: We shouldn't always apply the typing style to the line break here,
         // see <rdar://problem/5794462>.
-        applyStyle(typingStyle.get(), firstDeepEditingPositionForNode(nodeToInsert.get()), lastDeepEditingPositionForNode(nodeToInsert.get()));
+        applyStyle(typingStyle.get(), firstPositionInOrBeforeNode(nodeToInsert.get()), lastPositionInOrAfterNode(nodeToInsert.get()));
         // Even though this applyStyle operates on a Range, it still sets an endingSelection().
         // It tries to set a VisibleSelection around the content it operated on. So, that VisibleSelection
         // will either (a) select the line break we inserted, or it will (b) be a caret just 
diff --git a/Source/WebCore/editing/InsertListCommand.cpp b/Source/WebCore/editing/InsertListCommand.cpp
index 68661b4..4585b2e 100644
--- a/Source/WebCore/editing/InsertListCommand.cpp
+++ b/Source/WebCore/editing/InsertListCommand.cpp
@@ -121,8 +121,8 @@ void InsertListCommand::doApply()
     // FIXME: We paint the gap before some paragraphs that are indented with left 
     // margin/padding, but not others.  We should make the gap painting more consistent and 
     // then use a left margin/padding rule here.
-    if (visibleEnd != visibleStart && isStartOfParagraph(visibleEnd))
-        setEndingSelection(VisibleSelection(visibleStart, visibleEnd.previous(true)));
+    if (visibleEnd != visibleStart && isStartOfParagraph(visibleEnd, CanSkipOverEditingBoundary))
+        setEndingSelection(VisibleSelection(visibleStart, visibleEnd.previous(CannotCrossEditingBoundary)));
 
     const QualifiedName& listTag = (m_type == OrderedList) ? olTag : ulTag;
     if (endingSelection().isRange()) {
@@ -130,14 +130,14 @@ void InsertListCommand::doApply()
         ASSERT(selection.isRange());
         VisiblePosition startOfSelection = selection.visibleStart();
         VisiblePosition endOfSelection = selection.visibleEnd();
-        VisiblePosition startOfLastParagraph = startOfParagraph(endOfSelection);
+        VisiblePosition startOfLastParagraph = startOfParagraph(endOfSelection, CanSkipOverEditingBoundary);
 
-        if (startOfParagraph(startOfSelection) != startOfLastParagraph) {
+        if (startOfParagraph(startOfSelection, CanSkipOverEditingBoundary) != startOfLastParagraph) {
             bool forceCreateList = !selectionHasListOfType(selection, listTag);
 
             RefPtr<Range> currentSelection = endingSelection().firstRange();
             VisiblePosition startOfCurrentParagraph = startOfSelection;
-            while (startOfCurrentParagraph != startOfLastParagraph) {
+            while (!inSameParagraph(startOfCurrentParagraph, startOfLastParagraph, CanCrossEditingBoundary)) {
                 // doApply() may operate on and remove the last paragraph of the selection from the document 
                 // if it's in the same list item as startOfCurrentParagraph.  Return early to avoid an 
                 // infinite loop and because there is no more work to be done.
@@ -162,7 +162,7 @@ void InsertListCommand::doApply()
                     if (!lastSelectionRange)
                         return;
                     endOfSelection = lastSelectionRange->startPosition();
-                    startOfLastParagraph = startOfParagraph(endOfSelection);
+                    startOfLastParagraph = startOfParagraph(endOfSelection, CanSkipOverEditingBoundary);
                 }
 
                 // Fetch the start of the selection after moving the first paragraph,
@@ -257,14 +257,14 @@ void InsertListCommand::unlistifyParagraph(const VisiblePosition& originalStart,
     VisiblePosition start;
     VisiblePosition end;
     if (listChildNode->hasTagName(liTag)) {
-        start = firstDeepEditingPositionForNode(listChildNode);
-        end = lastDeepEditingPositionForNode(listChildNode);
+        start = firstPositionInNode(listChildNode);
+        end = lastPositionInNode(listChildNode);
         nextListChild = listChildNode->nextSibling();
         previousListChild = listChildNode->previousSibling();
     } else {
         // A paragraph is visually a list item minus a list marker.  The paragraph will be moved.
-        start = startOfParagraph(originalStart);
-        end = endOfParagraph(start);
+        start = startOfParagraph(originalStart, CanSkipOverEditingBoundary);
+        end = endOfParagraph(start, CanSkipOverEditingBoundary);
         nextListChild = enclosingListChild(end.next().deepEquivalent().deprecatedNode(), listNode);
         ASSERT(nextListChild != listChildNode);
         previousListChild = enclosingListChild(start.previous().deepEquivalent().deprecatedNode(), listNode);
@@ -327,8 +327,8 @@ static Element* adjacentEnclosingList(const VisiblePosition& pos, const VisibleP
 
 PassRefPtr<HTMLElement> InsertListCommand::listifyParagraph(const VisiblePosition& originalStart, const QualifiedName& listTag)
 {
-    VisiblePosition start = startOfParagraph(originalStart);
-    VisiblePosition end = endOfParagraph(start);
+    VisiblePosition start = startOfParagraph(originalStart, CanSkipOverEditingBoundary);
+    VisiblePosition end = endOfParagraph(start, CanSkipOverEditingBoundary);
     
     if (start.isNull() || end.isNull())
         return 0;
@@ -339,8 +339,8 @@ PassRefPtr<HTMLElement> InsertListCommand::listifyParagraph(const VisiblePositio
     appendNode(placeholder, listItemElement);
 
     // Place list item into adjoining lists.
-    Element* previousList = adjacentEnclosingList(start.deepEquivalent(), start.previous(true), listTag);
-    Element* nextList = adjacentEnclosingList(start.deepEquivalent(), end.next(true), listTag);
+    Element* previousList = adjacentEnclosingList(start.deepEquivalent(), start.previous(CannotCrossEditingBoundary), listTag);
+    Element* nextList = adjacentEnclosingList(start.deepEquivalent(), end.next(CannotCrossEditingBoundary), listTag);
     RefPtr<HTMLElement> listElement;
     if (previousList)
         appendNode(listItemElement, previousList);
@@ -375,8 +375,11 @@ PassRefPtr<HTMLElement> InsertListCommand::listifyParagraph(const VisiblePositio
 
         // We inserted the list at the start of the content we're about to move
         // Update the start of content, so we don't try to move the list into itself.  bug 19066
-        if (insertionPos == start.deepEquivalent())
-            start = startOfParagraph(originalStart);
+        // Layout is necessary since start's node's inline renderers may have been destroyed by the insertion
+        if (insertionPos == start.deepEquivalent()) {
+            listElement->document()->updateLayoutIgnorePendingStylesheets();
+            start = startOfParagraph(originalStart, CanSkipOverEditingBoundary);
+        }
     }
 
     moveParagraph(start, end, positionBeforeNode(placeholder.get()), true);
diff --git a/Source/WebCore/editing/InsertNodeBeforeCommand.cpp b/Source/WebCore/editing/InsertNodeBeforeCommand.cpp
index 5fae45e..4b028e7 100644
--- a/Source/WebCore/editing/InsertNodeBeforeCommand.cpp
+++ b/Source/WebCore/editing/InsertNodeBeforeCommand.cpp
@@ -41,13 +41,13 @@ InsertNodeBeforeCommand::InsertNodeBeforeCommand(PassRefPtr<Node> insertChild, P
     ASSERT(m_refChild);
     ASSERT(m_refChild->parentNode());
 
-    ASSERT(m_refChild->parentNode()->isContentEditable() || !m_refChild->parentNode()->attached());
+    ASSERT(m_refChild->parentNode()->rendererIsEditable() || !m_refChild->parentNode()->attached());
 }
 
 void InsertNodeBeforeCommand::doApply()
 {
     ContainerNode* parent = m_refChild->parentNode();
-    if (!parent || !parent->isContentEditable())
+    if (!parent || !parent->rendererIsEditable())
         return;
 
     ExceptionCode ec;
@@ -59,7 +59,7 @@ void InsertNodeBeforeCommand::doApply()
 
 void InsertNodeBeforeCommand::doUnapply()
 {
-    if (!m_insertChild->isContentEditable())
+    if (!m_insertChild->rendererIsEditable())
         return;
         
     // Need to notify this before actually deleting the text
diff --git a/Source/WebCore/editing/JoinTextNodesCommand.cpp b/Source/WebCore/editing/JoinTextNodesCommand.cpp
index 2766b84..86dd381 100644
--- a/Source/WebCore/editing/JoinTextNodesCommand.cpp
+++ b/Source/WebCore/editing/JoinTextNodesCommand.cpp
@@ -46,7 +46,7 @@ void JoinTextNodesCommand::doApply()
         return;
 
     ContainerNode* parent = m_text2->parentNode();
-    if (!parent || !parent->isContentEditable())
+    if (!parent || !parent->rendererIsEditable())
         return;
     
     ExceptionCode ec = 0;
@@ -63,7 +63,7 @@ void JoinTextNodesCommand::doUnapply()
         return;
 
     ContainerNode* parent = m_text2->parentNode();
-    if (!parent || !parent->isContentEditable())
+    if (!parent || !parent->rendererIsEditable())
         return;
 
     ExceptionCode ec = 0;
diff --git a/Source/WebCore/editing/MergeIdenticalElementsCommand.cpp b/Source/WebCore/editing/MergeIdenticalElementsCommand.cpp
index ff59f49..4ee9436 100644
--- a/Source/WebCore/editing/MergeIdenticalElementsCommand.cpp
+++ b/Source/WebCore/editing/MergeIdenticalElementsCommand.cpp
@@ -42,7 +42,7 @@ MergeIdenticalElementsCommand::MergeIdenticalElementsCommand(PassRefPtr<Element>
 
 void MergeIdenticalElementsCommand::doApply()
 {
-    if (m_element1->nextSibling() != m_element2 || !m_element1->isContentEditable() || !m_element2->isContentEditable())
+    if (m_element1->nextSibling() != m_element2 || !m_element1->rendererIsEditable() || !m_element2->rendererIsEditable())
         return;
 
     m_atChild = m_element2->firstChild();
@@ -68,7 +68,7 @@ void MergeIdenticalElementsCommand::doUnapply()
     RefPtr<Node> atChild = m_atChild.release();
 
     ContainerNode* parent = m_element2->parentNode();
-    if (!parent || !parent->isContentEditable())
+    if (!parent || !parent->rendererIsEditable())
         return;
 
     ExceptionCode ec = 0;
diff --git a/Source/WebCore/editing/RemoveNodeCommand.cpp b/Source/WebCore/editing/RemoveNodeCommand.cpp
index 94e3e62..4a52492 100644
--- a/Source/WebCore/editing/RemoveNodeCommand.cpp
+++ b/Source/WebCore/editing/RemoveNodeCommand.cpp
@@ -42,7 +42,7 @@ RemoveNodeCommand::RemoveNodeCommand(PassRefPtr<Node> node)
 void RemoveNodeCommand::doApply()
 {
     ContainerNode* parent = m_node->parentNode();
-    if (!parent || !parent->isContentEditable())
+    if (!parent || !parent->rendererIsEditable())
         return;
 
     m_parent = parent;
@@ -56,7 +56,7 @@ void RemoveNodeCommand::doUnapply()
 {
     RefPtr<ContainerNode> parent = m_parent.release();
     RefPtr<Node> refChild = m_refChild.release();
-    if (!parent || !parent->isContentEditable())
+    if (!parent || !parent->rendererIsEditable())
         return;
 
     ExceptionCode ec;
diff --git a/Source/WebCore/editing/ReplaceSelectionCommand.cpp b/Source/WebCore/editing/ReplaceSelectionCommand.cpp
index b0a2d68..94531a6 100644
--- a/Source/WebCore/editing/ReplaceSelectionCommand.cpp
+++ b/Source/WebCore/editing/ReplaceSelectionCommand.cpp
@@ -43,6 +43,7 @@
 #include "HTMLInputElement.h"
 #include "HTMLInterchange.h"
 #include "HTMLNames.h"
+#include "NodeList.h"
 #include "SelectionController.h"
 #include "SmartReplace.h"
 #include "TextIterator.h"
@@ -110,7 +111,7 @@ static bool isInterchangeConvertedSpaceSpan(const Node *node)
 static Position positionAvoidingPrecedingNodes(Position pos)
 {
     // If we're already on a break, it's probably a placeholder and we shouldn't change our position.
-    if (pos.deprecatedNode()->hasTagName(brTag))
+    if (editingIgnoresContent(pos.deprecatedNode()))
         return pos;
 
     // We also stop when changing block flow elements because even though the visual position is the
@@ -147,7 +148,7 @@ ReplacementFragment::ReplacementFragment(Document* document, DocumentFragment* f
     if (!editableRoot->getAttributeEventListener(eventNames().webkitBeforeTextInsertedEvent) &&
         // FIXME: Remove these checks once textareas and textfields actually register an event handler.
         !(shadowAncestorNode && shadowAncestorNode->renderer() && shadowAncestorNode->renderer()->isTextControl()) &&
-        editableRoot->isContentRichlyEditable()) {
+        editableRoot->rendererIsRichlyEditable()) {
         removeInterchangeNodes(m_fragment.get());
         return;
     }
@@ -162,7 +163,7 @@ ReplacementFragment::ReplacementFragment(Document* document, DocumentFragment* f
     ExceptionCode ec = 0;
     editableRoot->dispatchEvent(evt, ec);
     ASSERT(ec == 0);
-    if (text != evt->text() || !editableRoot->isContentRichlyEditable()) {
+    if (text != evt->text() || !editableRoot->rendererIsRichlyEditable()) {
         restoreTestRenderingNodesToFragment(holder.get());
         removeNode(holder);
 
@@ -357,7 +358,7 @@ static bool hasMatchingQuoteLevel(VisiblePosition endOfExistingContent, VisibleP
 {
     Position existing = endOfExistingContent.deepEquivalent();
     Position inserted = endOfInsertedContent.deepEquivalent();
-    bool isInsideMailBlockquote = nearestMailBlockquote(inserted.deprecatedNode());
+    bool isInsideMailBlockquote = enclosingNodeOfType(inserted, isMailBlockquote, CanCrossEditingBoundary);
     return isInsideMailBlockquote && (numEnclosingMailBlockquotes(existing) == numEnclosingMailBlockquotes(inserted));
 }
 
@@ -367,7 +368,7 @@ bool ReplaceSelectionCommand::shouldMergeStart(bool selectionStartWasStartOfPara
         return false;
     
     VisiblePosition startOfInsertedContent(positionAtStartOfInsertedContent());
-    VisiblePosition prev = startOfInsertedContent.previous(true);
+    VisiblePosition prev = startOfInsertedContent.previous(CannotCrossEditingBoundary);
     if (prev.isNull())
         return false;
     
@@ -389,7 +390,7 @@ bool ReplaceSelectionCommand::shouldMergeStart(bool selectionStartWasStartOfPara
 bool ReplaceSelectionCommand::shouldMergeEnd(bool selectionEndWasEndOfParagraph)
 {
     VisiblePosition endOfInsertedContent(positionAtEndOfInsertedContent());
-    VisiblePosition next = endOfInsertedContent.next(true);
+    VisiblePosition next = endOfInsertedContent.next(CannotCrossEditingBoundary);
     if (next.isNull())
         return false;
 
@@ -536,10 +537,10 @@ VisiblePosition ReplaceSelectionCommand::positionAtEndOfInsertedContent()
 {
     Node* lastNode = m_lastLeafInserted.get();
     // FIXME: Why is this hack here?  What's special about <select> tags?
-    Node* enclosingSelect = enclosingNodeWithTag(firstDeepEditingPositionForNode(lastNode), selectTag);
+    Node* enclosingSelect = enclosingNodeWithTag(firstPositionInOrBeforeNode(lastNode), selectTag);
     if (enclosingSelect)
         lastNode = enclosingSelect;
-    return lastDeepEditingPositionForNode(lastNode);
+    return lastPositionInOrAfterNode(lastNode);
 }
 
 VisiblePosition ReplaceSelectionCommand::positionAtStartOfInsertedContent()
@@ -556,7 +557,7 @@ static bool handleStyleSpansBeforeInsertion(ReplacementFragment& fragment, const
 
     // Handling the case where we are doing Paste as Quotation or pasting into quoted content is more complicated (see handleStyleSpans)
     // and doesn't receive the optimization.
-    if (isMailPasteAsQuotationNode(topNode) || nearestMailBlockquote(topNode))
+    if (isMailPasteAsQuotationNode(topNode) || enclosingNodeOfType(firstPositionInOrBeforeNode(topNode), isMailBlockquote, CanCrossEditingBoundary))
         return false;
 
     // Either there are no style spans in the fragment or a WebKit client has added content to the fragment
@@ -623,7 +624,7 @@ void ReplaceSelectionCommand::handleStyleSpans()
 
     // If Mail wraps the fragment with a Paste as Quotation blockquote, or if you're pasting into a quoted region,
     // styles from blockquoteNode are allowed to override those from the source document, see <rdar://problem/4930986> and <rdar://problem/5089327>.
-    Node* blockquoteNode = isMailPasteAsQuotationNode(context) ? context : nearestMailBlockquote(context);
+    Node* blockquoteNode = isMailPasteAsQuotationNode(context) ? context : enclosingNodeOfType(firstPositionInNode(context), isMailBlockquote, CanCrossEditingBoundary);
     if (blockquoteNode) {
         sourceDocumentStyle->removeStyleConflictingWithStyleOfNode(blockquoteNode);
         context = blockquoteNode->parentNode();
@@ -776,6 +777,34 @@ static Node* enclosingInline(Node* node)
     return node;
 }
 
+static bool isInlineNodeWithStyle(const Node* node)
+{
+    // We don't want to skip over any block elements.
+    if (!node->renderer() || !node->renderer()->isInline())
+        return false;
+
+    if (!node->isHTMLElement())
+        return false;
+    
+    // We can skip over elements whose class attribute is
+    // one of our internal classes.
+    const HTMLElement* element = static_cast<const HTMLElement*>(node);
+    AtomicString classAttributeValue = element->getAttribute(classAttr);
+    if (classAttributeValue == AppleStyleSpanClass
+        || classAttributeValue == AppleTabSpanClass
+        || classAttributeValue == AppleConvertedSpace
+        || classAttributeValue == ApplePasteAsQuotation)
+        return true;
+
+    // We can skip inline elements that don't have attributes or whose only
+    // attribute is the style attribute.
+    const NamedNodeMap* attributeMap = element->attributeMap();
+    if (!attributeMap || attributeMap->isEmpty() || (attributeMap->length() == 1 && element->hasAttribute(styleAttr)))
+        return true;
+
+    return false;
+}
+    
 void ReplaceSelectionCommand::doApply()
 {
     VisibleSelection selection = endingSelection();
@@ -811,8 +840,8 @@ void ReplaceSelectionCommand::doApply()
     Node* startBlock = enclosingBlock(visibleStart.deepEquivalent().deprecatedNode());
     
     Position insertionPos = selection.start();
-    bool startIsInsideMailBlockquote = nearestMailBlockquote(insertionPos.deprecatedNode());
-    
+    bool startIsInsideMailBlockquote = enclosingNodeOfType(insertionPos, isMailBlockquote, CanCrossEditingBoundary);
+
     if ((selectionStartWasStartOfParagraph && selectionEndWasEndOfParagraph && !startIsInsideMailBlockquote) ||
         startBlock == currentRoot || isListItem(startBlock) || selectionIsPlainText)
         m_preventNesting = false;
@@ -840,7 +869,7 @@ void ReplaceSelectionCommand::doApply()
     } else {
         ASSERT(selection.isCaret());
         if (fragment.hasInterchangeNewlineAtStart()) {
-            VisiblePosition next = visibleStart.next(true);
+            VisiblePosition next = visibleStart.next(CannotCrossEditingBoundary);
             if (isEndOfParagraph(visibleStart) && !isStartOfParagraph(visibleStart) && next.isNotNull())
                 setEndingSelection(next);
             else 
@@ -917,6 +946,29 @@ void ReplaceSelectionCommand::doApply()
     // outside of preceding tags.
     insertionPos = positionAvoidingPrecedingNodes(insertionPos);
 
+    // If we are not trying to match the destination style we prefer a position
+    // that is outside inline elements that provide style.
+    // This way we can produce a less verbose markup.
+    // We can skip this optimization for fragments not wrapped in one of
+    // our style spans and for positions inside list items
+    // since insertAsListItems already does the right thing.
+    if (!m_matchStyle && !enclosingList(insertionPos.anchorNode()) && isStyleSpan(fragment.firstChild())) {
+        Node* parentNode = insertionPos.anchorNode()->parentNode();
+        while (parentNode && parentNode->renderer() && isInlineNodeWithStyle(parentNode)) {
+            // If we are in the middle of a text node, we need to split it before we can
+            // move the insertion position.
+            if (insertionPos.anchorNode()->isTextNode() && insertionPos.anchorType() == Position::PositionIsOffsetInAnchor && insertionPos.offsetInContainerNode() && !insertionPos.atLastEditingPositionForNode())
+                splitTextNodeContainingElement(static_cast<Text*>(insertionPos.anchorNode()), insertionPos.offsetInContainerNode());
+            
+            // If the style element has more than one child, we need to split it.
+            if (parentNode->firstChild()->nextSibling())
+                splitElement(static_cast<Element*>(parentNode), insertionPos.computeNodeAfterPosition());
+            
+            insertionPos = positionInParentBeforeNode(parentNode);
+            parentNode = parentNode->parentNode();
+        }
+    }
+
     // FIXME: When pasting rich content we're often prevented from heading down the fast path by style spans.  Try
     // again here if they've been removed.
     
@@ -1036,7 +1088,7 @@ void ReplaceSelectionCommand::doApply()
     startOfInsertedContent = positionAtStartOfInsertedContent();
     
     if (interchangeNewlineAtEnd) {
-        VisiblePosition next = endOfInsertedContent.next(true);
+        VisiblePosition next = endOfInsertedContent.next(CannotCrossEditingBoundary);
 
         if (selectionEndWasEndOfParagraph || !isEndOfParagraph(endOfInsertedContent) || next.isNull()) {
             if (!isStartOfParagraph(endOfInsertedContent)) {
diff --git a/Source/WebCore/editing/SelectionController.cpp b/Source/WebCore/editing/SelectionController.cpp
index 65f9062..698ba2c 100644
--- a/Source/WebCore/editing/SelectionController.cpp
+++ b/Source/WebCore/editing/SelectionController.cpp
@@ -153,16 +153,14 @@ void SelectionController::setSelection(const VisibleSelection& s, SetSelectionOp
         return;
     }
 
-    Node* baseNode = s.base().deprecatedNode();
-    Document* document = 0;
-    if (baseNode)
-        document = baseNode->document();
-    
     // <http://bugs.webkit.org/show_bug.cgi?id=23464>: Infinite recursion at SelectionController::setSelection
     // if document->frame() == m_frame we can get into an infinite loop
-    if (document && document->frame() && document->frame() != m_frame && document != m_frame->document()) {
-        document->frame()->selection()->setSelection(s, options);
-        return;
+    if (s.base().anchorNode()) {
+        Document* document = s.base().anchorNode()->document();
+        if (document && document->frame() && document->frame() != m_frame && document != m_frame->document()) {
+            document->frame()->selection()->setSelection(s, options);
+            return;
+        }
     }
 
     if (closeTyping)
@@ -170,10 +168,13 @@ void SelectionController::setSelection(const VisibleSelection& s, SetSelectionOp
 
     if (shouldClearTypingStyle)
         clearTypingStyle();
-        
-    if (m_selection == s)
+
+    if (m_selection == s) {
+        // Even if selection was not changed, selection offsets may have been changed.
+        notifyRendererOfSelectionChange(userTriggered);
         return;
-    
+    }
+
     VisibleSelection oldSelection = m_selection;
 
     m_selection = s;
@@ -208,17 +209,17 @@ void SelectionController::setSelection(const VisibleSelection& s, SetSelectionOp
 
 static bool removingNodeRemovesPosition(Node* node, const Position& position)
 {
-    if (!position.deprecatedNode())
+    if (!position.anchorNode())
         return false;
 
-    if (position.deprecatedNode() == node)
+    if (position.anchorNode() == node)
         return true;
 
     if (!node->isElementNode())
         return false;
 
     Element* element = static_cast<Element*>(node);
-    return element->contains(position.deprecatedNode()) || element->contains(position.deprecatedNode()->shadowAncestorNode());
+    return element->contains(position.anchorNode()) || element->contains(position.anchorNode()->shadowAncestorNode());
 }
 
 void SelectionController::nodeWillBeRemoved(Node *node)
@@ -336,6 +337,11 @@ void SelectionController::setIsDirectional(bool isDirectional)
     m_isDirectional = !m_frame || m_frame->editor()->behavior().shouldConsiderSelectionAsDirectional() || isDirectional;
 }
 
+TextDirection SelectionController::directionOfEnclosingBlock()
+{
+    return WebCore::directionOfEnclosingBlock(m_selection.extent());
+}
+
 void SelectionController::willBeModified(EAlteration alter, SelectionDirection direction)
 {
     if (alter != AlterationExtend)
@@ -385,17 +391,6 @@ void SelectionController::willBeModified(EAlteration alter, SelectionDirection d
     }
 }
 
-TextDirection SelectionController::directionOfEnclosingBlock()
-{
-    Node* enclosingBlockNode = enclosingBlock(m_selection.extent().deprecatedNode());
-    if (!enclosingBlockNode)
-        return LTR;
-    RenderObject* renderer = enclosingBlockNode->renderer();
-    if (renderer)
-        return renderer->style()->direction();
-    return LTR;
-}
-
 VisiblePosition SelectionController::positionForPlatform(bool isGetStart) const
 {
     Settings* settings = m_frame ? m_frame->settings() : 0;
@@ -431,9 +426,9 @@ VisiblePosition SelectionController::modifyExtendingRight(TextGranularity granul
     switch (granularity) {
     case CharacterGranularity:
         if (directionOfEnclosingBlock() == LTR)
-            pos = pos.next(true);
+            pos = pos.next(CannotCrossEditingBoundary);
         else
-            pos = pos.previous(true);
+            pos = pos.previous(CannotCrossEditingBoundary);
         break;
     case WordGranularity:
         if (directionOfEnclosingBlock() == LTR)
@@ -464,7 +459,7 @@ VisiblePosition SelectionController::modifyExtendingForward(TextGranularity gran
     VisiblePosition pos(m_selection.extent(), m_selection.affinity());
     switch (granularity) {
     case CharacterGranularity:
-        pos = pos.next(true);
+        pos = pos.next(CannotCrossEditingBoundary);
         break;
     case WordGranularity:
         pos = nextWordPosition(pos);
@@ -538,7 +533,7 @@ VisiblePosition SelectionController::modifyMovingForward(TextGranularity granula
         if (isRange())
             pos = VisiblePosition(m_selection.end(), m_selection.affinity());
         else
-            pos = VisiblePosition(m_selection.extent(), m_selection.affinity()).next(true);
+            pos = VisiblePosition(m_selection.extent(), m_selection.affinity()).next(CannotCrossEditingBoundary);
         break;
     case WordGranularity:
         pos = nextWordPosition(VisiblePosition(m_selection.extent(), m_selection.affinity()));
@@ -589,9 +584,9 @@ VisiblePosition SelectionController::modifyExtendingLeft(TextGranularity granula
     switch (granularity) {
     case CharacterGranularity:
         if (directionOfEnclosingBlock() == LTR)
-            pos = pos.previous(true);
+            pos = pos.previous(CannotCrossEditingBoundary);
         else
-            pos = pos.next(true);
+            pos = pos.next(CannotCrossEditingBoundary);
         break;
     case WordGranularity:
         if (directionOfEnclosingBlock() == LTR)
@@ -626,7 +621,7 @@ VisiblePosition SelectionController::modifyExtendingBackward(TextGranularity gra
     // over everything.
     switch (granularity) {
     case CharacterGranularity:
-        pos = pos.previous(true);
+        pos = pos.previous(CannotCrossEditingBoundary);
         break;
     case WordGranularity:
         pos = previousWordPosition(pos);
@@ -698,7 +693,7 @@ VisiblePosition SelectionController::modifyMovingBackward(TextGranularity granul
         if (isRange())
             pos = VisiblePosition(m_selection.start(), m_selection.affinity());
         else
-            pos = VisiblePosition(m_selection.extent(), m_selection.affinity()).previous(true);
+            pos = VisiblePosition(m_selection.extent(), m_selection.affinity()).previous(CannotCrossEditingBoundary);
         break;
     case WordGranularity:
         pos = previousWordPosition(VisiblePosition(m_selection.extent(), m_selection.affinity()));
@@ -1256,11 +1251,11 @@ void SelectionController::debugRenderer(RenderObject *r, bool selected) const
         int textLength = text.length();
         if (selected) {
             int offset = 0;
-            if (r->node() == m_selection.start().deprecatedNode())
-                offset = m_selection.start().deprecatedEditingOffset();
-            else if (r->node() == m_selection.end().deprecatedNode())
-                offset = m_selection.end().deprecatedEditingOffset();
-                
+            if (r->node() == m_selection.start().containerNode())
+                offset = m_selection.start().computeOffsetInContainerNode();
+            else if (r->node() == m_selection.end().containerNode())
+                offset = m_selection.end().computeOffsetInContainerNode();
+
             int pos;
             InlineTextBox* box = textRenderer->findNextInlineTextBox(offset, pos);
             text = text.substring(box->start(), box->len());
@@ -1368,7 +1363,7 @@ void SelectionController::selectFrameElementInParentIfFullySelected()
         return;
         
     // This method's purpose is it to make it easier to select iframes (in order to delete them).  Don't do anything if the iframe isn't deletable.
-    if (!ownerElementParent->isContentEditable())
+    if (!ownerElementParent->rendererIsEditable())
         return;
 
     // Create compute positions before and after the element.
@@ -1456,7 +1451,9 @@ bool SelectionController::setSelectedRange(Range* range, EAffinity affinity, boo
 
 bool SelectionController::isInPasswordField() const
 {
-    Node* startNode = start().deprecatedNode();
+    ASSERT(start().isNull() || start().anchorType() == Position::PositionIsOffsetInAnchor
+           || start().containerNode() || !start().anchorNode()->shadowAncestorNode());
+    Node* startNode = start().containerNode();
     if (!startNode)
         return false;
 
@@ -1828,7 +1825,7 @@ void SelectionController::setSelectionFromNone()
 
     Document* document = m_frame->document();
     bool caretBrowsing = m_frame->settings() && m_frame->settings()->caretBrowsingEnabled();
-    if (!isNone() || !(document->inDesignMode() || caretBrowsing))
+    if (!isNone() || !(document->rendererIsEditable() || caretBrowsing))
         return;
 
     Node* node = document->documentElement();
diff --git a/Source/WebCore/editing/SelectionController.h b/Source/WebCore/editing/SelectionController.h
index d6a9dff..2e3a6cd 100644
--- a/Source/WebCore/editing/SelectionController.h
+++ b/Source/WebCore/editing/SelectionController.h
@@ -127,7 +127,7 @@ public:
     bool isRange() const { return m_selection.isRange(); }
     bool isCaretOrRange() const { return m_selection.isCaretOrRange(); }
     bool isInPasswordField() const;
-    bool isAll(StayInEditableContent stayInEditableContent = MustStayInEditableContent) const { return m_selection.isAll(stayInEditableContent); }
+    bool isAll(EditingBoundaryCrossingRule rule = CannotCrossEditingBoundary) const { return m_selection.isAll(rule); }
     
     PassRefPtr<Range> toNormalizedRange() const { return m_selection.toNormalizedRange(); }
 
diff --git a/Source/WebCore/editing/SplitElementCommand.cpp b/Source/WebCore/editing/SplitElementCommand.cpp
index 888c45f..fc135f7 100644
--- a/Source/WebCore/editing/SplitElementCommand.cpp
+++ b/Source/WebCore/editing/SplitElementCommand.cpp
@@ -54,7 +54,7 @@ void SplitElementCommand::executeApply()
     ExceptionCode ec = 0;
     
     ContainerNode* parent = m_element2->parentNode();
-    if (!parent || !parent->isContentEditable())
+    if (!parent || !parent->rendererIsEditable())
         return;
     parent->insertBefore(m_element1.get(), m_element2.get(), ec);
     if (ec)
@@ -78,7 +78,7 @@ void SplitElementCommand::doApply()
 
 void SplitElementCommand::doUnapply()
 {
-    if (!m_element1 || !m_element1->isContentEditable() || !m_element2->isContentEditable())
+    if (!m_element1 || !m_element1->rendererIsEditable() || !m_element2->rendererIsEditable())
         return;
 
     Vector<RefPtr<Node> > children;
diff --git a/Source/WebCore/editing/SplitTextNodeCommand.cpp b/Source/WebCore/editing/SplitTextNodeCommand.cpp
index aea36b9..5cf7ac8 100644
--- a/Source/WebCore/editing/SplitTextNodeCommand.cpp
+++ b/Source/WebCore/editing/SplitTextNodeCommand.cpp
@@ -51,7 +51,7 @@ SplitTextNodeCommand::SplitTextNodeCommand(PassRefPtr<Text> text, int offset)
 void SplitTextNodeCommand::doApply()
 {
     ContainerNode* parent = m_text2->parentNode();
-    if (!parent || !parent->isContentEditable())
+    if (!parent || !parent->rendererIsEditable())
         return;
 
     ExceptionCode ec = 0;
@@ -68,7 +68,7 @@ void SplitTextNodeCommand::doApply()
 
 void SplitTextNodeCommand::doUnapply()
 {
-    if (!m_text1 || !m_text1->isContentEditable())
+    if (!m_text1 || !m_text1->rendererIsEditable())
         return;
 
     ASSERT(m_text1->document() == document());
@@ -89,7 +89,7 @@ void SplitTextNodeCommand::doReapply()
         return;
 
     ContainerNode* parent = m_text2->parentNode();
-    if (!parent || !parent->isContentEditable())
+    if (!parent || !parent->rendererIsEditable())
         return;
 
     insertText1AndTrimText2();
diff --git a/Source/WebCore/editing/SplitTextNodeContainingElementCommand.cpp b/Source/WebCore/editing/SplitTextNodeContainingElementCommand.cpp
index 8c90fb0..7b9fd2a 100644
--- a/Source/WebCore/editing/SplitTextNodeContainingElementCommand.cpp
+++ b/Source/WebCore/editing/SplitTextNodeContainingElementCommand.cpp
@@ -48,7 +48,7 @@ void SplitTextNodeContainingElementCommand::doApply()
     splitTextNode(m_text.get(), m_offset);
 
     Element* parent = m_text->parentElement();
-    if (!parent || !parent->parentElement() || !parent->parentElement()->isContentEditable())
+    if (!parent || !parent->parentElement() || !parent->parentElement()->rendererIsEditable())
         return;
 
     RenderObject* parentRenderer = parent->renderer();
diff --git a/Source/WebCore/editing/TextCheckingHelper.cpp b/Source/WebCore/editing/TextCheckingHelper.cpp
index e5553fd..009c807 100644
--- a/Source/WebCore/editing/TextCheckingHelper.cpp
+++ b/Source/WebCore/editing/TextCheckingHelper.cpp
@@ -224,7 +224,7 @@ String TextCheckingHelper::findFirstMisspelling(int& firstMisspellingOffset, boo
 
 String TextCheckingHelper::findFirstMisspellingOrBadGrammar(bool checkGrammar, bool& outIsSpelling, int& outFirstFoundOffset, GrammarDetail& outGrammarDetail)
 {
-#if PLATFORM(MAC) && !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
+#if USE(UNIFIED_TEXT_CHECKING)
     String firstFoundItem;
     String misspelledWord;
     String badGrammarPhrase;
@@ -350,12 +350,12 @@ String TextCheckingHelper::findFirstMisspellingOrBadGrammar(bool checkGrammar, b
     UNUSED_PARAM(outFirstFoundOffset);
     UNUSED_PARAM(outGrammarDetail);
     return "";
-#endif
+#endif // USE(UNIFIED_TEXT_CHECKING)
 }
 
 int TextCheckingHelper::findFirstGrammarDetail(const Vector<GrammarDetail>& grammarDetails, int badGrammarPhraseLocation, int /*badGrammarPhraseLength*/, int startOffset, int endOffset, bool markAll)
 {
-#ifndef BUILDING_ON_TIGER
+#if USE(GRAMMAR_CHECKING)
     // Found some bad grammar. Find the earliest detail range that starts in our search range (if any).
     // Optionally add a DocumentMarker for each detail in the range.
     int earliestDetailLocationSoFar = -1;
@@ -402,7 +402,7 @@ int TextCheckingHelper::findFirstGrammarDetail(const Vector<GrammarDetail>& gram
 
 String TextCheckingHelper::findFirstBadGrammar(GrammarDetail& outGrammarDetail, int& outGrammarPhraseOffset, bool markAll)
 {
-#ifndef BUILDING_ON_TIGER
+    ASSERT(WTF_USE_GRAMMAR_CHECKING);
     // Initialize out parameters; these will be updated if we find something to return.
     outGrammarDetail.location = -1;
     outGrammarDetail.length = 0;
@@ -458,18 +458,12 @@ String TextCheckingHelper::findFirstBadGrammar(GrammarDetail& outGrammarDetail,
     }
     
     return firstBadGrammarPhrase;
-#else
-    ASSERT_NOT_REACHED();
-    UNUSED_PARAM(outGrammarDetail);
-    UNUSED_PARAM(outGrammarPhraseOffset);
-    UNUSED_PARAM(markAll);
-#endif
 }
 
 
 bool TextCheckingHelper::isUngrammatical(Vector<String>& guessesVector) const
 {
-#ifndef BUILDING_ON_TIGER
+    ASSERT(WTF_USE_GRAMMAR_CHECKING);
     if (!m_client)
         return false;
 
@@ -511,16 +505,11 @@ bool TextCheckingHelper::isUngrammatical(Vector<String>& guessesVector) const
     m_client->updateSpellingUIWithGrammarString(badGrammarPhrase, grammarDetail);
     
     return true;
-#else
-    ASSERT_NOT_REACHED();
-    UNUSED_PARAM(guessesVector);
-    return true;
-#endif
 }
 
 Vector<String> TextCheckingHelper::guessesForMisspelledOrUngrammaticalRange(bool checkGrammar, bool& misspelled, bool& ungrammatical) const
 {
-#if PLATFORM(MAC) && !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
+#if USE(UNIFIED_TEXT_CHECKING)
     Vector<String> guesses;
     ExceptionCode ec;
     misspelled = false;
@@ -578,7 +567,7 @@ Vector<String> TextCheckingHelper::guessesForMisspelledOrUngrammaticalRange(bool
     UNUSED_PARAM(misspelled);
     UNUSED_PARAM(ungrammatical);
     return Vector<String>();
-#endif
+#endif // USE(UNIFIED_TEXT_CHECKING)
 }
 
 
@@ -592,15 +581,12 @@ void TextCheckingHelper::markAllMisspellings(RefPtr<Range>& firstMisspellingRang
 
 void TextCheckingHelper::markAllBadGrammar()
 {
-#ifndef BUILDING_ON_TIGER
-    // Use the "markAll" feature of findFirstBadGrammar. Ignore the return value and "out parameters"; all we need to
+    ASSERT(WTF_USE_GRAMMAR_CHECKING);
+    // Use the "markAll" feature of ofindFirstBadGrammar. Ignore the return value and "out parameters"; all we need to
     // do is mark every instance.
     GrammarDetail ignoredGrammarDetail;
     int ignoredOffset;
     findFirstBadGrammar(ignoredGrammarDetail, ignoredOffset, true);
-#else
-    ASSERT_NOT_REACHED();
-#endif
 }
 
 }
diff --git a/Source/WebCore/editing/TextIterator.cpp b/Source/WebCore/editing/TextIterator.cpp
index a9546b8..1b25c87 100644
--- a/Source/WebCore/editing/TextIterator.cpp
+++ b/Source/WebCore/editing/TextIterator.cpp
@@ -2320,7 +2320,7 @@ PassRefPtr<Range> TextIterator::rangeFromLocationAndLength(Element* scope, int r
                     Position runEnd = VisiblePosition(runStart).next().deepEquivalent();
                     if (runEnd.isNotNull()) {
                         ExceptionCode ec = 0;
-                        textRunRange->setEnd(runEnd.deprecatedNode(), runEnd.deprecatedEditingOffset(), ec);
+                        textRunRange->setEnd(runEnd.containerNode(), runEnd.computeOffsetInContainerNode(), ec);
                         ASSERT(!ec);
                     }
                 }
@@ -2512,11 +2512,6 @@ tryAgain:
     return matchLength;
 }
 
-PassRefPtr<Range> findPlainText(const Range* range, const String& target, bool forward, bool caseSensitive)
-{
-    return findPlainText(range, target, (forward ? 0 : Backwards) | (caseSensitive ? 0 : CaseInsensitive));
-}
-
 PassRefPtr<Range> findPlainText(const Range* range, const String& target, FindOptions options)
 {
     // First, find the text.
diff --git a/Source/WebCore/editing/TextIterator.h b/Source/WebCore/editing/TextIterator.h
index b0c310a..0f1a6fd 100644
--- a/Source/WebCore/editing/TextIterator.h
+++ b/Source/WebCore/editing/TextIterator.h
@@ -60,8 +60,6 @@ inline bool isCollapsibleWhitespace(UChar c)
 String plainText(const Range*, TextIteratorBehavior defaultBehavior = TextIteratorDefaultBehavior);
 UChar* plainTextToMallocAllocatedBuffer(const Range*, unsigned& bufferLength, bool isDisplayString, TextIteratorBehavior = TextIteratorDefaultBehavior);
 PassRefPtr<Range> findPlainText(const Range*, const String&, FindOptions);
-// FIXME: Switch callers over to the FindOptions version and retire this one.
-PassRefPtr<Range> findPlainText(const Range*, const String&, bool forward, bool caseSensitive);
 
 class BitStack {
 public:
diff --git a/Source/WebCore/editing/TypingCommand.cpp b/Source/WebCore/editing/TypingCommand.cpp
index 3b42915..aedda31 100644
--- a/Source/WebCore/editing/TypingCommand.cpp
+++ b/Source/WebCore/editing/TypingCommand.cpp
@@ -47,6 +47,14 @@ namespace WebCore {
 
 using namespace HTMLNames;
 
+static bool canAppendNewLineFeed(const VisibleSelection& selection)
+{
+    ExceptionCode ec = 0;
+    RefPtr<BeforeTextInsertedEvent> event = BeforeTextInsertedEvent::create(String("\n"));
+    selection.rootEditableElement()->dispatchEvent(event, ec);
+    return event->text().length();
+}
+
 TypingCommand::TypingCommand(Document *document, ETypingCommand commandType, const String &textToInsert, TypingCommandOptions options, TextGranularity granularity, TextCompositionType compositionType)
     : CompositeEditCommand(document)
     , m_commandType(commandType)
@@ -403,12 +411,18 @@ void TypingCommand::insertTextRunWithoutNewlines(const String &text, bool select
 
 void TypingCommand::insertLineBreak()
 {
+    if (!canAppendNewLineFeed(endingSelection()))
+        return;
+
     applyCommandToComposite(InsertLineBreakCommand::create(document()));
     typingAddedToOpenCommand(InsertLineBreak);
 }
 
 void TypingCommand::insertParagraphSeparator()
 {
+    if (!canAppendNewLineFeed(endingSelection()))
+        return;
+
     applyCommandToComposite(InsertParagraphSeparatorCommand::create(document()));
     typingAddedToOpenCommand(InsertParagraphSeparator);
 }
@@ -429,7 +443,7 @@ void TypingCommand::insertParagraphSeparatorInQuotedContent()
 bool TypingCommand::makeEditableRootEmpty()
 {
     Element* root = endingSelection().rootEditableElement();
-    if (!root->firstChild())
+    if (!root || !root->firstChild())
         return false;
 
     if (root->firstChild() == root->lastChild() && root->firstElementChild() && root->firstElementChild()->hasTagName(brTag)) {
@@ -474,14 +488,14 @@ void TypingCommand::deleteKeyPressed(TextGranularity granularity, bool killRing)
         if (killRing && selection.isCaret() && granularity != CharacterGranularity)
             selection.modify(SelectionController::AlterationExtend, DirectionBackward, CharacterGranularity);
 
-        if (endingSelection().visibleStart().previous(true).isNull()) {
+        if (endingSelection().visibleStart().previous(CannotCrossEditingBoundary).isNull()) {
             // When the caret is at the start of the editable area in an empty list item, break out of the list item.
             if (breakOutOfEmptyListItem()) {
                 typingAddedToOpenCommand(DeleteKey);
                 return;
             }
             // When there are no visible positions in the editing root, delete its entire contents.
-            if (endingSelection().visibleStart().next(true).isNull() && makeEditableRootEmpty()) {
+            if (endingSelection().visibleStart().next(CannotCrossEditingBoundary).isNull() && makeEditableRootEmpty()) {
                 typingAddedToOpenCommand(DeleteKey);
                 return;
             }
@@ -493,7 +507,7 @@ void TypingCommand::deleteKeyPressed(TextGranularity granularity, bool killRing)
             return;
 
         // If the caret is at the start of a paragraph after a table, move content into the last table cell.
-        if (isStartOfParagraph(visibleStart) && isFirstPositionAfterTable(visibleStart.previous(true))) {
+        if (isStartOfParagraph(visibleStart) && isFirstPositionAfterTable(visibleStart.previous(CannotCrossEditingBoundary))) {
             // Unless the caret is just before a table.  We don't want to move a table into the last table cell.
             if (isLastPositionBeforeTable(visibleStart))
                 return;
@@ -574,10 +588,10 @@ void TypingCommand::forwardDeleteKeyPressed(TextGranularity granularity, bool ki
         Position downstreamEnd = endingSelection().end().downstream();
         VisiblePosition visibleEnd = endingSelection().visibleEnd();
         if (visibleEnd == endOfParagraph(visibleEnd))
-            downstreamEnd = visibleEnd.next(true).deepEquivalent().downstream();
+            downstreamEnd = visibleEnd.next(CannotCrossEditingBoundary).deepEquivalent().downstream();
         // When deleting tables: Select the table first, then perform the deletion
         if (downstreamEnd.deprecatedNode() && downstreamEnd.deprecatedNode()->renderer() && downstreamEnd.deprecatedNode()->renderer()->isTable() && !downstreamEnd.deprecatedEditingOffset()) {
-            setEndingSelection(VisibleSelection(endingSelection().end(), lastDeepEditingPositionForNode(downstreamEnd.deprecatedNode()), DOWNSTREAM));
+            setEndingSelection(VisibleSelection(endingSelection().end(), positionAfterNode(downstreamEnd.deprecatedNode()), DOWNSTREAM));
             typingAddedToOpenCommand(ForwardDeleteKey);
             return;
         }
diff --git a/Source/WebCore/editing/VisiblePosition.cpp b/Source/WebCore/editing/VisiblePosition.cpp
index 10798ad..c3c05fd 100644
--- a/Source/WebCore/editing/VisiblePosition.cpp
+++ b/Source/WebCore/editing/VisiblePosition.cpp
@@ -59,18 +59,22 @@ void VisiblePosition::init(const Position& position, EAffinity affinity)
         m_affinity = DOWNSTREAM;
 }
 
-VisiblePosition VisiblePosition::next(bool stayInEditableContent) const
+VisiblePosition VisiblePosition::next(EditingBoundaryCrossingRule rule) const
 {
+    // FIXME: Support CanSkipEditingBoundary
+    ASSERT(rule == CanCrossEditingBoundary || rule == CannotCrossEditingBoundary);
     VisiblePosition next(nextVisuallyDistinctCandidate(m_deepPosition), m_affinity);
-    
-    if (!stayInEditableContent)
+
+    if (rule == CanCrossEditingBoundary)
         return next;
-    
+
     return honorEditableBoundaryAtOrAfter(next);
 }
 
-VisiblePosition VisiblePosition::previous(bool stayInEditableContent) const
+VisiblePosition VisiblePosition::previous(EditingBoundaryCrossingRule rule) const
 {
+    // FIXME: Support CanSkipEditingBoundary
+    ASSERT(rule == CanCrossEditingBoundary || rule == CannotCrossEditingBoundary);
     // find first previous DOM position that is visible
     Position pos = previousVisuallyDistinctCandidate(m_deepPosition);
     
@@ -91,7 +95,7 @@ VisiblePosition VisiblePosition::previous(bool stayInEditableContent) const
     }
 #endif
 
-    if (!stayInEditableContent)
+    if (rule == CanCrossEditingBoundary)
         return prev;
     
     return honorEditableBoundaryAtOrBefore(prev);
@@ -469,7 +473,7 @@ Position VisiblePosition::canonicalPosition(const Position& passedPosition)
 
     // The new position must be in the same editable element. Enforce that first.
     // Unless the descent is from a non-editable html element to an editable body.
-    if (node && node->hasTagName(htmlTag) && !node->isContentEditable() && node->document()->body() && node->document()->body()->isContentEditable())
+    if (node && node->hasTagName(htmlTag) && !node->rendererIsEditable() && node->document()->body() && node->document()->body()->rendererIsEditable())
         return next.isNotNull() ? next : prev;
 
     Node* editingRoot = editableRootForPosition(position);
diff --git a/Source/WebCore/editing/VisiblePosition.h b/Source/WebCore/editing/VisiblePosition.h
index 008d676..505c914 100644
--- a/Source/WebCore/editing/VisiblePosition.h
+++ b/Source/WebCore/editing/VisiblePosition.h
@@ -26,6 +26,7 @@
 #ifndef VisiblePosition_h
 #define VisiblePosition_h
 
+#include "EditingBoundary.h"
 #include "Node.h"
 #include "Position.h"
 #include "TextDirection.h"
@@ -47,8 +48,6 @@ namespace WebCore {
 
 class InlineBox;
 
-enum StayInEditableContent { MayLeaveEditableContent, MustStayInEditableContent };
-
 class VisiblePosition {
 public:
     // NOTE: UPSTREAM affinity will be used only if pos is at end of a wrapped line,
@@ -69,8 +68,8 @@ public:
     // FIXME: Change the following functions' parameter from a boolean to StayInEditableContent.
 
     // next() and previous() will increment/decrement by a character cluster.
-    VisiblePosition next(bool stayInEditableContent = false) const;
-    VisiblePosition previous(bool stayInEditableContent = false) const;
+    VisiblePosition next(EditingBoundaryCrossingRule = CanCrossEditingBoundary) const;
+    VisiblePosition previous(EditingBoundaryCrossingRule = CanCrossEditingBoundary) const;
     VisiblePosition honorEditableBoundaryAtOrBefore(const VisiblePosition&) const;
     VisiblePosition honorEditableBoundaryAtOrAfter(const VisiblePosition&) const;
 
diff --git a/Source/WebCore/editing/VisibleSelection.cpp b/Source/WebCore/editing/VisibleSelection.cpp
index 75531ca..5633c90 100644
--- a/Source/WebCore/editing/VisibleSelection.cpp
+++ b/Source/WebCore/editing/VisibleSelection.cpp
@@ -89,7 +89,8 @@ VisibleSelection::VisibleSelection(const Range* range, EAffinity affinity)
 
 VisibleSelection VisibleSelection::selectionFromContentsOfNode(Node* node)
 {
-    return VisibleSelection(firstDeepEditingPositionForNode(node), lastDeepEditingPositionForNode(node), DOWNSTREAM);
+    ASSERT(!editingIgnoresContent(node));
+    return VisibleSelection(firstPositionInNode(node), lastPositionInNode(node), DOWNSTREAM);
 }
 
 void VisibleSelection::setBase(const Position& position)
@@ -172,8 +173,8 @@ PassRefPtr<Range> VisibleSelection::toNormalizedRange() const
         s = s.parentAnchoredEquivalent();
         e = e.parentAnchoredEquivalent();
     }
-    
-    if (s.isNull() || e.isNull())
+
+    if (!s.containerNode() || !e.containerNode())
         return 0;
 
     // VisibleSelections are supposed to always be valid.  This constructor will ASSERT
@@ -208,7 +209,7 @@ static PassRefPtr<Range> makeSearchRange(const Position& pos)
 
     Position start(pos.parentAnchoredEquivalent());
     searchRange->selectNodeContents(boundary, ec);
-    searchRange->setStart(start.deprecatedNode(), start.deprecatedEditingOffset(), ec);
+    searchRange->setStart(start.containerNode(), start.offsetInContainerNode(), ec);
 
     ASSERT(!ec);
     if (ec)
@@ -217,9 +218,9 @@ static PassRefPtr<Range> makeSearchRange(const Position& pos)
     return searchRange.release();
 }
 
-bool VisibleSelection::isAll(StayInEditableContent stayInEditableContent) const
+bool VisibleSelection::isAll(EditingBoundaryCrossingRule rule) const
 {
-    return !shadowTreeRootNode() && visibleStart().previous(stayInEditableContent).isNull() && visibleEnd().next(stayInEditableContent).isNull();
+    return !shadowTreeRootNode() && visibleStart().previous(rule).isNull() && visibleEnd().next(rule).isNull();
 }
 
 void VisibleSelection::appendTrailingWhitespace()
@@ -305,7 +306,7 @@ void VisibleSelection::setStartAndEndFromBaseAndExtentRespectingGranularity(Text
                     // The paragraph break after the last paragraph in the last cell of a block table ends
                     // at the start of the paragraph after the table.
                     if (isBlock(table))
-                        end = end.next(true);
+                        end = end.next(CannotCrossEditingBoundary);
                     else
                         end = wordEnd;
                 }
@@ -355,7 +356,7 @@ void VisibleSelection::setStartAndEndFromBaseAndExtentRespectingGranularity(Text
                 // The paragraph break after the last paragraph in the last cell of a block table ends
                 // at the start of the paragraph after the table, not at the position just after the table.
                 if (isBlock(table))
-                    end = end.next(true);
+                    end = end.next(CannotCrossEditingBoundary);
                 // There is no parargraph break after the last paragraph in the last cell of an inline table.
                 else
                     end = visibleParagraphEnd;
@@ -457,7 +458,7 @@ void VisibleSelection::adjustSelectionToAvoidCrossingEditingBoundaries()
     Node* startRoot = highestEditableRoot(m_start);
     Node* endRoot = highestEditableRoot(m_end);
     
-    Node* baseEditableAncestor = lowestEditableAncestor(m_base.deprecatedNode());
+    Node* baseEditableAncestor = lowestEditableAncestor(m_base.containerNode());
     
     // The base, start and end are all in the same region.  No adjustment necessary.
     if (baseRoot == startRoot && baseRoot == endRoot)
@@ -492,19 +493,19 @@ void VisibleSelection::adjustSelectionToAvoidCrossingEditingBoundaries()
     
         // The selection ends in editable content or non-editable content inside a different editable ancestor, 
         // move backward until non-editable content inside the same lowest editable ancestor is reached.
-        Node* endEditableAncestor = lowestEditableAncestor(m_end.deprecatedNode());
+        Node* endEditableAncestor = lowestEditableAncestor(m_end.containerNode());
         if (endRoot || endEditableAncestor != baseEditableAncestor) {
             
             Position p = previousVisuallyDistinctCandidate(m_end);
             Node* shadowAncestor = endRoot ? endRoot->shadowAncestorNode() : 0;
             if (p.isNull() && endRoot && (shadowAncestor != endRoot))
-                p = lastDeepEditingPositionForNode(shadowAncestor);
-            while (p.isNotNull() && !(lowestEditableAncestor(p.deprecatedNode()) == baseEditableAncestor && !isEditablePosition(p))) {
+                p = positionAfterNode(shadowAncestor);
+            while (p.isNotNull() && !(lowestEditableAncestor(p.containerNode()) == baseEditableAncestor && !isEditablePosition(p))) {
                 Node* root = editableRootForPosition(p);
                 shadowAncestor = root ? root->shadowAncestorNode() : 0;
-                p = isAtomicNode(p.deprecatedNode()) ? positionInParentBeforeNode(p.deprecatedNode()) : previousVisuallyDistinctCandidate(p);
+                p = isAtomicNode(p.containerNode()) ? positionInParentBeforeNode(p.containerNode()) : previousVisuallyDistinctCandidate(p);
                 if (p.isNull() && (shadowAncestor != root))
-                    p = lastDeepEditingPositionForNode(shadowAncestor);
+                    p = positionAfterNode(shadowAncestor);
             }
             VisiblePosition previous(p);
 
@@ -522,16 +523,16 @@ void VisibleSelection::adjustSelectionToAvoidCrossingEditingBoundaries()
 
         // The selection starts in editable content or non-editable content inside a different editable ancestor, 
         // move forward until non-editable content inside the same lowest editable ancestor is reached.
-        Node* startEditableAncestor = lowestEditableAncestor(m_start.deprecatedNode());      
+        Node* startEditableAncestor = lowestEditableAncestor(m_start.containerNode());      
         if (startRoot || startEditableAncestor != baseEditableAncestor) {
             Position p = nextVisuallyDistinctCandidate(m_start);
             Node* shadowAncestor = startRoot ? startRoot->shadowAncestorNode() : 0;
             if (p.isNull() && startRoot && (shadowAncestor != startRoot))
                 p = positionBeforeNode(shadowAncestor);
-            while (p.isNotNull() && !(lowestEditableAncestor(p.deprecatedNode()) == baseEditableAncestor && !isEditablePosition(p))) {
+            while (p.isNotNull() && !(lowestEditableAncestor(p.containerNode()) == baseEditableAncestor && !isEditablePosition(p))) {
                 Node* root = editableRootForPosition(p);
                 shadowAncestor = root ? root->shadowAncestorNode() : 0;
-                p = isAtomicNode(p.deprecatedNode()) ? positionInParentAfterNode(p.deprecatedNode()) : nextVisuallyDistinctCandidate(p);
+                p = isAtomicNode(p.containerNode()) ? positionInParentAfterNode(p.containerNode()) : nextVisuallyDistinctCandidate(p);
                 if (p.isNull() && (shadowAncestor != root))
                     p = positionBeforeNode(shadowAncestor);
             }
@@ -551,7 +552,7 @@ void VisibleSelection::adjustSelectionToAvoidCrossingEditingBoundaries()
     }
     
     // Correct the extent if necessary.
-    if (baseEditableAncestor != lowestEditableAncestor(m_extent.deprecatedNode()))
+    if (baseEditableAncestor != lowestEditableAncestor(m_extent.containerNode()))
         m_extent = m_baseIsFirst ? m_end : m_start;
 }
 
diff --git a/Source/WebCore/editing/VisibleSelection.h b/Source/WebCore/editing/VisibleSelection.h
index 5d52a08..a352c20 100644
--- a/Source/WebCore/editing/VisibleSelection.h
+++ b/Source/WebCore/editing/VisibleSelection.h
@@ -79,7 +79,7 @@ public:
 
     bool isBaseFirst() const { return m_baseIsFirst; }
 
-    bool isAll(StayInEditableContent) const;
+    bool isAll(EditingBoundaryCrossingRule) const;
 
     void appendTrailingWhitespace();
 
diff --git a/Source/WebCore/editing/WrapContentsInDummySpanCommand.cpp b/Source/WebCore/editing/WrapContentsInDummySpanCommand.cpp
index 5fa0b39..51f744c 100644
--- a/Source/WebCore/editing/WrapContentsInDummySpanCommand.cpp
+++ b/Source/WebCore/editing/WrapContentsInDummySpanCommand.cpp
@@ -64,7 +64,7 @@ void WrapContentsInDummySpanCommand::doUnapply()
 {
     ASSERT(m_element);
 
-    if (!m_dummySpan || !m_element->isContentEditable())
+    if (!m_dummySpan || !m_element->rendererIsEditable())
         return;
 
     Vector<RefPtr<Node> > children;
@@ -84,7 +84,7 @@ void WrapContentsInDummySpanCommand::doReapply()
 {
     ASSERT(m_element);
     
-    if (!m_dummySpan || !m_element->isContentEditable())
+    if (!m_dummySpan || !m_element->rendererIsEditable())
         return;
 
     executeApply();
diff --git a/Source/WebCore/editing/htmlediting.cpp b/Source/WebCore/editing/htmlediting.cpp
index a078d91..564eff6 100644
--- a/Source/WebCore/editing/htmlediting.cpp
+++ b/Source/WebCore/editing/htmlediting.cpp
@@ -34,6 +34,7 @@
 #include "HTMLInterchange.h"
 #include "HTMLLIElement.h"
 #include "HTMLNames.h"
+#include "HTMLObjectElement.h"
 #include "HTMLOListElement.h"
 #include "HTMLUListElement.h"
 #include "PositionIterator.h"
@@ -73,22 +74,20 @@ bool editingIgnoresContent(const Node* node)
 
 bool canHaveChildrenForEditing(const Node* node)
 {
-    return !node->hasTagName(hrTag) &&
-           !node->hasTagName(brTag) &&
-           !node->hasTagName(imgTag) &&
-           !node->hasTagName(buttonTag) &&
-           !node->hasTagName(inputTag) &&
-           !node->hasTagName(textareaTag) &&
-           !node->hasTagName(objectTag) &&
-           !node->hasTagName(iframeTag) &&
-           !node->hasTagName(embedTag) &&
-           !node->hasTagName(appletTag) &&
-           !node->hasTagName(selectTag) &&
-           !node->hasTagName(datagridTag) &&
+    return !node->isTextNode()
+        && !node->hasTagName(brTag)
+        && !node->hasTagName(imgTag)
+        && !node->hasTagName(inputTag)
+        && !node->hasTagName(textareaTag)
+        && (!node->hasTagName(objectTag) || static_cast<const HTMLObjectElement*>(node)->useFallbackContent())
+        && !node->hasTagName(iframeTag)
+        && !node->hasTagName(embedTag)
+        && !node->hasTagName(appletTag)
+        && !node->hasTagName(selectTag)
 #if ENABLE(WML)
-           !node->hasTagName(WMLNames::doTag) &&
+        && !node->hasTagName(WMLNames::doTag)
 #endif
-           !node->isTextNode();
+        && ((!node->hasTagName(hrTag) && !node->hasTagName(datagridTag)) || node->hasChildNodes());
 }
 
 // Compare two positions, taking into account the possibility that one or both
@@ -144,7 +143,7 @@ Node* highestEditableRoot(const Position& position)
     
     node = highestRoot;
     while (node) {
-        if (node->isContentEditable())
+        if (node->rendererIsEditable())
             highestRoot = node;
         if (node->hasTagName(bodyTag))
             break;
@@ -161,7 +160,7 @@ Node* lowestEditableAncestor(Node* node)
     
     Node *lowestRoot = 0;
     while (node) {
-        if (node->isContentEditable())
+        if (node->rendererIsEditable())
             return node->rootEditableElement();
         if (node->hasTagName(bodyTag))
             break;
@@ -180,7 +179,7 @@ bool isEditablePosition(const Position& p)
     if (node->renderer() && node->renderer()->isTable())
         node = node->parentNode();
     
-    return node->isContentEditable();
+    return node->rendererIsEditable();
 }
 
 bool isAtUnsplittableElement(const Position& pos)
@@ -199,7 +198,7 @@ bool isRichlyEditablePosition(const Position& p)
     if (node->renderer() && node->renderer()->isTable())
         node = node->parentNode();
     
-    return node->isContentRichlyEditable();
+    return node->rendererIsRichlyEditable();
 }
 
 Element* editableRootForPosition(const Position& p)
@@ -221,7 +220,7 @@ Element* unsplittableElementForPosition(const Position& p)
 {
     // Since enclosingNodeOfType won't search beyond the highest root editable node,
     // this code works even if the closest table cell was outside of the root editable node.
-    Element* enclosingCell = static_cast<Element*>(enclosingNodeOfType(p, &isTableCell, true));
+    Element* enclosingCell = static_cast<Element*>(enclosingNodeOfType(p, &isTableCell));
     if (enclosingCell)
         return enclosingCell;
 
@@ -277,14 +276,14 @@ Position previousVisuallyDistinctCandidate(const Position& position)
 VisiblePosition firstEditablePositionAfterPositionInRoot(const Position& position, Node* highestRoot)
 {
     // position falls before highestRoot.
-    if (comparePositions(position, firstDeepEditingPositionForNode(highestRoot)) == -1 && highestRoot->isContentEditable())
-        return firstDeepEditingPositionForNode(highestRoot);
+    if (comparePositions(position, firstPositionInNode(highestRoot)) == -1 && highestRoot->rendererIsEditable())
+        return firstPositionInNode(highestRoot);
 
     Position p = position;
     
     if (Node* shadowAncestor = p.deprecatedNode()->shadowAncestorNode())
         if (shadowAncestor != p.deprecatedNode())
-            p = lastDeepEditingPositionForNode(shadowAncestor);
+            p = positionAfterNode(shadowAncestor);
     
     while (p.deprecatedNode() && !isEditablePosition(p) && p.deprecatedNode()->isDescendantOf(highestRoot))
         p = isAtomicNode(p.deprecatedNode()) ? positionInParentAfterNode(p.deprecatedNode()) : nextVisuallyDistinctCandidate(p);
@@ -298,14 +297,15 @@ VisiblePosition firstEditablePositionAfterPositionInRoot(const Position& positio
 VisiblePosition lastEditablePositionBeforePositionInRoot(const Position& position, Node* highestRoot)
 {
     // When position falls after highestRoot, the result is easy to compute.
-    if (comparePositions(position, lastDeepEditingPositionForNode(highestRoot)) == 1)
-        return lastDeepEditingPositionForNode(highestRoot);
+    if (comparePositions(position, lastPositionInNode(highestRoot)) == 1)
+        return lastPositionInNode(highestRoot);
 
     Position p = position;
-    
-    if (Node* shadowAncestor = p.deprecatedNode()->shadowAncestorNode())
+
+    if (Node* shadowAncestor = p.deprecatedNode()->shadowAncestorNode()) {
         if (shadowAncestor != p.deprecatedNode())
-            p = firstDeepEditingPositionForNode(shadowAncestor);
+            p = firstPositionInOrBeforeNode(shadowAncestor);
+    }
     
     while (p.deprecatedNode() && !isEditablePosition(p) && p.deprecatedNode()->isDescendantOf(highestRoot))
         p = isAtomicNode(p.deprecatedNode()) ? positionInParentBeforeNode(p.deprecatedNode()) : previousVisuallyDistinctCandidate(p);
@@ -327,9 +327,18 @@ bool isBlock(const Node* node)
 // FIXME: Pass a position to this function.  The enclosing block of [table, x] for example, should be the 
 // block that contains the table and not the table, and this function should be the only one responsible for 
 // knowing about these kinds of special cases.
-Node* enclosingBlock(Node* node)
+Node* enclosingBlock(Node* node, EditingBoundaryCrossingRule rule)
 {
-    return static_cast<Element*>(enclosingNodeOfType(firstPositionInOrBeforeNode(node), isBlock));
+    return static_cast<Element*>(enclosingNodeOfType(firstPositionInOrBeforeNode(node), isBlock, rule));
+}
+
+TextDirection directionOfEnclosingBlock(const Position& position)
+{
+    Node* enclosingBlockNode = enclosingBlock(position.containerNode());
+    if (!enclosingBlockNode)
+        return LTR;
+    RenderObject* renderer = enclosingBlockNode->renderer();
+    return renderer ? renderer->style()->direction() : LTR;
 }
 
 // This method is used to create positions in the DOM. It returns the maximum valid offset
@@ -561,7 +570,7 @@ PassRefPtr<Range> extendRangeToWrappingNodes(PassRefPtr<Range> range, const Rang
     Node* ancestor = range->commonAncestorContainer(ec);// find the cloeset common ancestor
     Node* highestNode = 0;
     // traverse through ancestors as long as they are contained within the range, content-editable, and below rootNode (could be =0).
-    while (ancestor && ancestor->isContentEditable() && isNodeVisiblyContainedWithin(ancestor, maximumRange) && ancestor != rootNode) {
+    while (ancestor && ancestor->rendererIsEditable() && isNodeVisiblyContainedWithin(ancestor, maximumRange) && ancestor != rootNode) {
         highestNode = ancestor;
         ancestor = ancestor->parentNode();
     }
@@ -592,7 +601,7 @@ Node* enclosingNodeWithTag(const Position& p, const QualifiedName& tagName)
         
     Node* root = highestEditableRoot(p);
     for (Node* n = p.deprecatedNode(); n; n = n->parentNode()) {
-        if (root && !n->isContentEditable())
+        if (root && !n->rendererIsEditable())
             continue;
         if (n->hasTagName(tagName))
             return n;
@@ -603,18 +612,20 @@ Node* enclosingNodeWithTag(const Position& p, const QualifiedName& tagName)
     return 0;
 }
 
-Node* enclosingNodeOfType(const Position& p, bool (*nodeIsOfType)(const Node*), bool onlyReturnEditableNodes)
+Node* enclosingNodeOfType(const Position& p, bool (*nodeIsOfType)(const Node*), EditingBoundaryCrossingRule rule)
 {
+    // FIXME: support CanSkipCrossEditingBoundary
+    ASSERT(rule == CanCrossEditingBoundary || rule == CannotCrossEditingBoundary);
     if (p.isNull())
         return 0;
         
-    Node* root = highestEditableRoot(p);
+    Node* root = rule == CannotCrossEditingBoundary ? highestEditableRoot(p) : 0;
     for (Node* n = p.deprecatedNode(); n; n = n->parentNode()) {
         // Don't return a non-editable node if the input position was editable, since
         // the callers from editing will no doubt want to perform editing inside the returned node.
-        if (root && !n->isContentEditable() && onlyReturnEditableNodes)
+        if (root && !n->rendererIsEditable())
             continue;
-        if ((*nodeIsOfType)(n))
+        if (nodeIsOfType(n))
             return n;
         if (n == root)
             return 0;
@@ -623,12 +634,14 @@ Node* enclosingNodeOfType(const Position& p, bool (*nodeIsOfType)(const Node*),
     return 0;
 }
 
-Node* highestEnclosingNodeOfType(const Position& p, bool (*nodeIsOfType)(const Node*))
+Node* highestEnclosingNodeOfType(const Position& p, bool (*nodeIsOfType)(const Node*), EditingBoundaryCrossingRule rule)
 {
     Node* highest = 0;
-    Node* root = highestEditableRoot(p);
+    Node* root = rule == CannotCrossEditingBoundary ? highestEditableRoot(p) : 0;
     for (Node* n = p.deprecatedNode(); n; n = n->parentNode()) {
-        if ((*nodeIsOfType)(n))
+        if (root && !n->rendererIsEditable())
+            continue;
+        if (nodeIsOfType(n))
             highest = n;
         if (n == root)
             break;
@@ -721,8 +734,8 @@ Node* enclosingEmptyListItem(const VisiblePosition& visiblePos)
     if (!listChildNode || !isStartOfParagraph(visiblePos) || !isEndOfParagraph(visiblePos))
         return 0;
 
-    VisiblePosition firstInListChild(firstDeepEditingPositionForNode(listChildNode));
-    VisiblePosition lastInListChild(lastDeepEditingPositionForNode(listChildNode));
+    VisiblePosition firstInListChild(firstPositionInOrBeforeNode(listChildNode));
+    VisiblePosition lastInListChild(lastPositionInOrAfterNode(listChildNode));
 
     if (firstInListChild != visiblePos || lastInListChild != visiblePos)
         return 0;
@@ -754,7 +767,7 @@ bool canMergeLists(Element* firstList, Element* secondList)
         return false;
 
     return firstList->hasTagName(secondList->tagQName())// make sure the list types match (ol vs. ul)
-    && firstList->isContentEditable() && secondList->isContentEditable()// both lists are editable
+    && firstList->rendererIsEditable() && secondList->rendererIsEditable() // both lists are editable
     && firstList->rootEditableElement() == secondList->rootEditableElement()// don't cross editing boundaries
     && isVisiblyAdjacent(positionInParentAfterNode(firstList), positionInParentBeforeNode(secondList));
     // Make sure there is no visible content between this li and the previous list
@@ -932,15 +945,6 @@ bool isNodeRendered(const Node *node)
     return renderer->style()->visibility() == VISIBLE;
 }
 
-Node *nearestMailBlockquote(const Node *node)
-{
-    for (Node *n = const_cast<Node *>(node); n; n = n->parentNode()) {
-        if (isMailBlockquote(n))
-            return n;
-    }
-    return 0;
-}
-
 unsigned numEnclosingMailBlockquotes(const Position& p)
 {
     unsigned num = 0;
@@ -1016,7 +1020,7 @@ VisibleSelection selectionForParagraphIteration(const VisibleSelection& original
     // (a table is itself a paragraph).
     if (Node* table = isFirstPositionAfterTable(endOfSelection))
         if (startOfSelection.deepEquivalent().deprecatedNode()->isDescendantOf(table))
-            newSelection = VisibleSelection(startOfSelection, endOfSelection.previous(true));
+            newSelection = VisibleSelection(startOfSelection, endOfSelection.previous(CannotCrossEditingBoundary));
     
     // If the start of the selection to modify is just before a table,
     // and if the end of the selection is inside that table, then the first paragraph
@@ -1024,7 +1028,7 @@ VisibleSelection selectionForParagraphIteration(const VisibleSelection& original
     // containing the table itself.
     if (Node* table = isLastPositionBeforeTable(startOfSelection))
         if (endOfSelection.deepEquivalent().deprecatedNode()->isDescendantOf(table))
-            newSelection = VisibleSelection(startOfSelection.next(true), endOfSelection);
+            newSelection = VisibleSelection(startOfSelection.next(CannotCrossEditingBoundary), endOfSelection);
     
     return newSelection;
 }
diff --git a/Source/WebCore/editing/htmlediting.h b/Source/WebCore/editing/htmlediting.h
index b71e879..cb2b2a4 100644
--- a/Source/WebCore/editing/htmlediting.h
+++ b/Source/WebCore/editing/htmlediting.h
@@ -26,9 +26,11 @@
 #ifndef htmlediting_h
 #define htmlediting_h
 
+#include "EditingBoundary.h"
 #include "ExceptionCode.h"
 #include "HTMLNames.h"
 #include "Position.h"
+#include "TextDirection.h"
 #include <wtf/Forward.h>
 #include <wtf/unicode/CharacterNames.h>
 
@@ -54,18 +56,17 @@ class VisibleSelection;
 
 Node* highestAncestor(Node*);
 Node* highestEditableRoot(const Position&);
-Node* highestEnclosingNodeOfType(const Position&, bool (*nodeIsOfType)(const Node*));
+Node* highestEnclosingNodeOfType(const Position&, bool (*nodeIsOfType)(const Node*), EditingBoundaryCrossingRule = CannotCrossEditingBoundary);
 Node* lowestEditableAncestor(Node*);   
 
-Node* enclosingBlock(Node*);
+Node* enclosingBlock(Node*, EditingBoundaryCrossingRule = CannotCrossEditingBoundary);
 Node* enclosingTableCell(const Position&);
 Node* enclosingEmptyListItem(const VisiblePosition&);
 Node* enclosingAnchorElement(const Position&);
 Node* enclosingNodeWithTag(const Position&, const QualifiedName&);
-Node* enclosingNodeOfType(const Position&, bool (*nodeIsOfType)(const Node*), bool onlyReturnEditableNodes = true);
+Node* enclosingNodeOfType(const Position&, bool (*nodeIsOfType)(const Node*), EditingBoundaryCrossingRule = CannotCrossEditingBoundary);
 
 Node* tabSpanNode(const Node*);
-Node* nearestMailBlockquote(const Node*);
 Node* isLastPositionBeforeTable(const VisiblePosition&);
 Node* isFirstPositionAfterTable(const VisiblePosition&);
 
@@ -96,6 +97,8 @@ bool isNodeVisiblyContainedWithin(Node*, const Range*);
 bool isRenderedAsNonInlineTableImageOrHR(const Node*);
 bool isNodeInTextFormControl(Node* node);
     
+TextDirection directionOfEnclosingBlock(const Position&);
+
 // -------------------------------------------------------------------------
 // Position
 // -------------------------------------------------------------------------
@@ -115,34 +118,18 @@ Position positionOutsideContainingSpecialElement(const Position&, Node** contain
 
 inline Position firstPositionInOrBeforeNode(Node* node)
 {
+    if (!node)
+        return Position();
     return editingIgnoresContent(node) ? positionBeforeNode(node) : firstPositionInNode(node);
 }
 
 inline Position lastPositionInOrAfterNode(Node* node)
 {
+    if (!node)
+        return Position();
     return editingIgnoresContent(node) ? positionAfterNode(node) : lastPositionInNode(node);
 }
 
-// Position creation functions are inline to prevent ref-churn.
-// Other Position creation functions are in Position.h
-// but these depend on lastOffsetForEditing which is defined in htmlediting.h.
-
-// NOTE: first/lastDeepEditingPositionForNode return legacy editing positions (like [img, 0])
-// for elements which editing ignores.  The rest of the editing code will treat [img, 0]
-// as "the last position before the img".
-// New code should use the creation functions in Position.h instead.
-inline Position firstDeepEditingPositionForNode(Node* anchorNode)
-{
-    ASSERT(anchorNode);
-    return Position(anchorNode, 0);
-}
-
-inline Position lastDeepEditingPositionForNode(Node* anchorNode)
-{
-    ASSERT(anchorNode);
-    return Position(anchorNode, lastOffsetForEditing(anchorNode));
-}
-       
 // comparision functions on Position
     
 int comparePositions(const Position&, const Position&);
@@ -237,7 +224,7 @@ inline bool isWhitespace(UChar c)
 {
     return c == noBreakSpace || c == ' ' || c == '\n' || c == '\t';
 }
-String stringWithRebalancedWhitespace(const String&, bool, bool);
+String stringWithRebalancedWhitespace(const String&, bool startIsStartOfParagraph, bool endIsEndOfParagraph);
 const String& nonBreakingSpaceString();
 
 }
diff --git a/Source/WebCore/editing/mac/EditorMac.mm b/Source/WebCore/editing/mac/EditorMac.mm
index 4c617c0..60bfe6c 100644
--- a/Source/WebCore/editing/mac/EditorMac.mm
+++ b/Source/WebCore/editing/mac/EditorMac.mm
@@ -216,4 +216,13 @@ void Editor::writeSelectionToPasteboard(const String& pasteboardName, const Vect
     Pasteboard::writeSelection([NSPasteboard pasteboardWithName:pasteboardName], types.get(), selectedRange().get(), true, m_frame);
 }
     
+void Editor::readSelectionFromPasteboard(const String& pasteboardName)
+{
+    Pasteboard pasteboard([NSPasteboard pasteboardWithName:pasteboardName]);
+    if (m_frame->selection()->isContentRichlyEditable())
+        pasteWithPasteboard(&pasteboard, true);
+    else
+        pasteAsPlainTextWithPasteboard(&pasteboard);   
+}
+
 } // namespace WebCore
diff --git a/Source/WebCore/editing/markup.cpp b/Source/WebCore/editing/markup.cpp
index 9d97b3f..316cec7 100644
--- a/Source/WebCore/editing/markup.cpp
+++ b/Source/WebCore/editing/markup.cpp
@@ -488,10 +488,8 @@ static Node* highestAncestorToWrapMarkup(const Range* range, Node* fullySelected
         specialCommonAncestor = ancestorToRetainStructureAndAppearance(commonAncestor);
 
         // Retain the Mail quote level by including all ancestor mail block quotes.
-        for (Node* ancestor = range->firstNode(); ancestor; ancestor = ancestor->parentNode()) {
-            if (isMailBlockquote(ancestor))
-                specialCommonAncestor = ancestor;
-        }
+        if (Node* highestMailBlockquote = highestEnclosingNodeOfType(firstPositionInOrBeforeNode(range->firstNode()), isMailBlockquote, CanCrossEditingBoundary))
+            specialCommonAncestor = highestMailBlockquote;
     }
 
     Node* checkAncestor = specialCommonAncestor ? specialCommonAncestor : commonAncestor;
@@ -634,7 +632,7 @@ String createMarkup(const Range* range, Vector<Node*>* nodes, EAnnotateForInterc
         // Styles that Mail blockquotes contribute should only be placed on the Mail blockquote, to help
         // us differentiate those styles from ones that the user has applied.  This helps us
         // get the color of content pasted into blockquotes right.
-        style->removeStyleAddedByNode(nearestMailBlockquote(parentOfLastClosed));
+        style->removeStyleAddedByNode(enclosingNodeOfType(firstPositionInNode(parentOfLastClosed), isMailBlockquote, CanCrossEditingBoundary));
 
         // Document default styles will be added on another wrapper span.
         if (document && document->documentElement())
diff --git a/Source/WebCore/editing/visible_units.cpp b/Source/WebCore/editing/visible_units.cpp
index 0baacf2..c9ca8c0 100644
--- a/Source/WebCore/editing/visible_units.cpp
+++ b/Source/WebCore/editing/visible_units.cpp
@@ -126,6 +126,7 @@ static VisiblePosition previousBoundary(const VisiblePosition& c, BoundarySearch
     // Use the character iterator to translate the next value into a DOM position.
     BackwardsCharacterIterator charIt(searchRange.get());
     charIt.advance(string.size() - suffixLength - next);
+    // FIXME: charIt can get out of shadow host.
     return VisiblePosition(charIt.range()->endPosition(), DOWNSTREAM);
 }
 
@@ -377,8 +378,8 @@ static VisiblePosition startPositionForLine(const VisiblePosition& c)
         startBox = startBox->nextLeafChild();
     }
     
-    VisiblePosition visPos = startBox->isInlineTextBox() ? VisiblePosition(Position(startNode, static_cast<InlineTextBox *>(startBox)->start(), Position::PositionIsOffsetInAnchor), DOWNSTREAM)
-                                                         : VisiblePosition(positionBeforeNode(startNode), DOWNSTREAM);
+    VisiblePosition visPos = startNode->isTextNode() ? VisiblePosition(Position(startNode, static_cast<InlineTextBox *>(startBox)->start(), Position::PositionIsOffsetInAnchor), DOWNSTREAM)
+                                                     : VisiblePosition(positionBeforeNode(startNode), DOWNSTREAM);
     return positionAvoidingFirstPositionInTable(visPos);
 }
 
@@ -476,10 +477,10 @@ bool isEndOfLine(const VisiblePosition &p)
 // The first leaf before node that has the same editability as node.
 static Node* previousLeafWithSameEditability(Node* node)
 {
-    bool editable = node->isContentEditable();
+    bool editable = node->rendererIsEditable();
     Node* n = node->previousLeafNode();
     while (n) {
-        if (editable == n->isContentEditable())
+        if (editable == n->rendererIsEditable())
             return n;
         n = n->previousLeafNode();
     }
@@ -571,18 +572,20 @@ VisiblePosition previousLinePosition(const VisiblePosition &visiblePosition, int
     // Could not find a previous line. This means we must already be on the first line.
     // Move to the start of the content in this block, which effectively moves us
     // to the start of the line we're on.
-    Element* rootElement = node->isContentEditable() ? node->rootEditableElement() : node->document()->documentElement();
+    Element* rootElement = node->rendererIsEditable() ? node->rootEditableElement() : node->document()->documentElement();
+    if (!rootElement)
+        return VisiblePosition();
     return VisiblePosition(firstPositionInNode(rootElement), DOWNSTREAM);
 }
 
 static Node* nextLeafWithSameEditability(Node* node, int offset)
 {
-    bool editable = node->isContentEditable();
+    bool editable = node->rendererIsEditable();
     ASSERT(offset >= 0);
     Node* child = node->childNode(offset);
     Node* n = child ? child->nextLeafNode() : node->lastDescendant()->nextLeafNode();
     while (n) {
-        if (editable == n->isContentEditable())
+        if (editable == n->rendererIsEditable())
             return n;
         n = n->nextLeafNode();
     }
@@ -594,10 +597,10 @@ static Node* nextLeafWithSameEditability(Node* node)
     if (!node)
         return 0;
     
-    bool editable = node->isContentEditable();
+    bool editable = node->rendererIsEditable();
     Node* n = node->nextLeafNode();
     while (n) {
-        if (editable == n->isContentEditable())
+        if (editable == n->rendererIsEditable())
             return n;
         n = n->nextLeafNode();
     }
@@ -676,7 +679,9 @@ VisiblePosition nextLinePosition(const VisiblePosition &visiblePosition, int x)
     // Could not find a next line. This means we must already be on the last line.
     // Move to the end of the content in this block, which effectively moves us
     // to the end of the line we're on.
-    Element* rootElement = node->isContentEditable() ? node->rootEditableElement() : node->document()->documentElement();
+    Element* rootElement = node->rendererIsEditable() ? node->rootEditableElement() : node->document()->documentElement();
+    if (!rootElement)
+        return VisiblePosition();
     return VisiblePosition(lastPositionInNode(rootElement), DOWNSTREAM);
 }
 
@@ -743,18 +748,25 @@ VisiblePosition startOfParagraph(const VisiblePosition& c, EditingBoundaryCrossi
         return VisiblePosition();
     
     if (isRenderedAsNonInlineTableImageOrHR(startNode))
-        return firstDeepEditingPositionForNode(startNode);
+        return positionBeforeNode(startNode);
 
     Node* startBlock = enclosingBlock(startNode);
 
-    Node *node = startNode;
+    Node* node = startNode;
+    Node* highestRoot = highestEditableRoot(p);
     int offset = p.deprecatedEditingOffset();
     Position::AnchorType type = p.anchorType();
 
-    Node *n = startNode;
+    Node* n = startNode;
     while (n) {
-        if (boundaryCrossingRule == CannotCrossEditingBoundary && n->isContentEditable() != startNode->isContentEditable())
+        if (boundaryCrossingRule == CannotCrossEditingBoundary && n->rendererIsEditable() != startNode->rendererIsEditable())
             break;
+        if (boundaryCrossingRule == CanSkipOverEditingBoundary) {
+            while (n && n->rendererIsEditable() != startNode->rendererIsEditable())
+                n = n->traversePreviousNodePostOrder(startBlock);
+            if (!n || !n->isDescendantOf(highestRoot))
+                break;
+        }
         RenderObject *r = n->renderer();
         if (!r) {
             n = n->traversePreviousNodePostOrder(startBlock);
@@ -807,19 +819,27 @@ VisiblePosition endOfParagraph(const VisiblePosition &c, EditingBoundaryCrossing
     Node* startNode = p.deprecatedNode();
 
     if (isRenderedAsNonInlineTableImageOrHR(startNode))
-        return lastDeepEditingPositionForNode(startNode);
+        return positionAfterNode(startNode);
     
     Node* startBlock = enclosingBlock(startNode);
-    Node *stayInsideBlock = startBlock;
+    Node* stayInsideBlock = startBlock;
     
-    Node *node = startNode;
+    Node* node = startNode;
+    Node* highestRoot = highestEditableRoot(p);
     int offset = p.deprecatedEditingOffset();
     Position::AnchorType type = p.anchorType();
 
-    Node *n = startNode;
+    Node* n = startNode;
     while (n) {
-        if (boundaryCrossingRule == CannotCrossEditingBoundary && n->isContentEditable() != startNode->isContentEditable())
+        if (boundaryCrossingRule == CannotCrossEditingBoundary && n->rendererIsEditable() != startNode->rendererIsEditable())
             break;
+        if (boundaryCrossingRule == CanSkipOverEditingBoundary) {
+            while (n && n->rendererIsEditable() != startNode->rendererIsEditable())
+                n = n->traverseNextNode(stayInsideBlock);
+            if (!n || !n->isDescendantOf(highestRoot))
+                break;
+        }
+
         RenderObject *r = n->renderer();
         if (!r) {
             n = n->traverseNextNode(stayInsideBlock);
@@ -862,20 +882,21 @@ VisiblePosition endOfParagraph(const VisiblePosition &c, EditingBoundaryCrossing
     return VisiblePosition(Position(node, type), DOWNSTREAM);
 }
 
+// FIXME: isStartOfParagraph(startOfNextParagraph(pos)) is not always true
 VisiblePosition startOfNextParagraph(const VisiblePosition& visiblePosition)
 {
-    VisiblePosition paragraphEnd(endOfParagraph(visiblePosition));
-    VisiblePosition afterParagraphEnd(paragraphEnd.next(true));
+    VisiblePosition paragraphEnd(endOfParagraph(visiblePosition, CanSkipOverEditingBoundary));
+    VisiblePosition afterParagraphEnd(paragraphEnd.next(CannotCrossEditingBoundary));
     // The position after the last position in the last cell of a table
     // is not the start of the next paragraph.
     if (isFirstPositionAfterTable(afterParagraphEnd))
-        return afterParagraphEnd.next(true);
+        return afterParagraphEnd.next(CannotCrossEditingBoundary);
     return afterParagraphEnd;
 }
 
-bool inSameParagraph(const VisiblePosition &a, const VisiblePosition &b)
+bool inSameParagraph(const VisiblePosition &a, const VisiblePosition &b, EditingBoundaryCrossingRule boundaryCrossingRule)
 {
-    return a.isNotNull() && startOfParagraph(a) == startOfParagraph(b);
+    return a.isNotNull() && startOfParagraph(a, boundaryCrossingRule) == startOfParagraph(b, boundaryCrossingRule);
 }
 
 bool isStartOfParagraph(const VisiblePosition &pos, EditingBoundaryCrossingRule boundaryCrossingRule)
@@ -914,41 +935,37 @@ VisiblePosition nextParagraphPosition(const VisiblePosition& p, int x)
 
 // ---------
 
-VisiblePosition startOfBlock(const VisiblePosition &c)
+VisiblePosition startOfBlock(const VisiblePosition& visiblePosition, EditingBoundaryCrossingRule rule)
 {
-    Position p = c.deepEquivalent();
-    Node* startNode = p.deprecatedNode();
-    if (!startNode)
+    Position position = visiblePosition.deepEquivalent();
+    Node* startBlock;
+    if (!position.containerNode() || !(startBlock = enclosingBlock(position.containerNode(), rule)))
         return VisiblePosition();
-    return VisiblePosition(firstPositionInNode(startNode->enclosingBlockFlowElement()), DOWNSTREAM);
+    return firstPositionInNode(startBlock);
 }
 
-VisiblePosition endOfBlock(const VisiblePosition &c)
+VisiblePosition endOfBlock(const VisiblePosition& visiblePosition, EditingBoundaryCrossingRule rule)
 {
-    Position p = c.deepEquivalent();
-
-    Node* startNode = p.deprecatedNode();
-    if (!startNode)
+    Position position = visiblePosition.deepEquivalent();
+    Node* endBlock;
+    if (!position.containerNode() || !(endBlock = enclosingBlock(position.containerNode(), rule)))
         return VisiblePosition();
-
-    Node *startBlock = startNode->enclosingBlockFlowElement();
-    
-    return VisiblePosition(lastPositionInNode(startBlock), VP_DEFAULT_AFFINITY);   
+    return lastPositionInNode(endBlock);
 }
 
 bool inSameBlock(const VisiblePosition &a, const VisiblePosition &b)
 {
-    return !a.isNull() && enclosingBlockFlowElement(a) == enclosingBlockFlowElement(b);
+    return !a.isNull() && enclosingBlock(a.deepEquivalent().containerNode()) == enclosingBlock(b.deepEquivalent().containerNode());
 }
 
 bool isStartOfBlock(const VisiblePosition &pos)
 {
-    return pos.isNotNull() && pos == startOfBlock(pos);
+    return pos.isNotNull() && pos == startOfBlock(pos, CanCrossEditingBoundary);
 }
 
 bool isEndOfBlock(const VisiblePosition &pos)
 {
-    return pos.isNotNull() && pos == endOfBlock(pos);
+    return pos.isNotNull() && pos == endOfBlock(pos, CanCrossEditingBoundary);
 }
 
 // ---------
@@ -1012,7 +1029,7 @@ VisiblePosition startOfEditableContent(const VisiblePosition& visiblePosition)
     if (!highestRoot)
         return VisiblePosition();
 
-    return firstDeepEditingPositionForNode(highestRoot);
+    return firstPositionInNode(highestRoot);
 }
 
 VisiblePosition endOfEditableContent(const VisiblePosition& visiblePosition)
@@ -1021,88 +1038,7 @@ VisiblePosition endOfEditableContent(const VisiblePosition& visiblePosition)
     if (!highestRoot)
         return VisiblePosition();
 
-    return lastDeepEditingPositionForNode(highestRoot);
-}
-
-static void getLeafBoxesInLogicalOrder(RootInlineBox* rootBox, Vector<InlineBox*>& leafBoxesInLogicalOrder)
-{
-    unsigned char minLevel = 128;
-    unsigned char maxLevel = 0;
-    unsigned count = 0;
-    InlineBox* r = rootBox->firstLeafChild();
-    // First find highest and lowest levels,
-    // and initialize leafBoxesInLogicalOrder with the leaf boxes in visual order.
-    while (r) {
-        if (r->bidiLevel() > maxLevel)
-            maxLevel = r->bidiLevel();
-        if (r->bidiLevel() < minLevel)
-            minLevel = r->bidiLevel();
-        leafBoxesInLogicalOrder.append(r);
-        r = r->nextLeafChild();
-        ++count;
-    }
-
-    if (rootBox->renderer()->style()->visuallyOrdered())
-        return;
-    // Reverse of reordering of the line (L2 according to Bidi spec):
-    // L2. From the highest level found in the text to the lowest odd level on each line,
-    // reverse any contiguous sequence of characters that are at that level or higher.
-
-    // Reversing the reordering of the line is only done up to the lowest odd level.
-    if (!(minLevel % 2))
-        minLevel++;
-    
-    InlineBox** end = leafBoxesInLogicalOrder.end();
-    while (minLevel <= maxLevel) {
-        InlineBox** iter = leafBoxesInLogicalOrder.begin();
-        while (iter != end) {
-            while (iter != end) {
-                if ((*iter)->bidiLevel() >= minLevel)
-                    break;
-                ++iter;
-            }
-            InlineBox** first = iter;
-            while (iter != end) {
-                if ((*iter)->bidiLevel() < minLevel)
-                    break;
-                ++iter;
-            }
-            InlineBox** last = iter;
-            std::reverse(first, last);
-        }                
-        ++minLevel;
-    }
-}
-
-static void getLogicalStartBoxAndNode(RootInlineBox* rootBox, InlineBox*& startBox, Node*& startNode)
-{
-    Vector<InlineBox*> leafBoxesInLogicalOrder;
-    getLeafBoxesInLogicalOrder(rootBox, leafBoxesInLogicalOrder);
-    startBox = 0;
-    startNode = 0;
-    for (size_t i = 0; i < leafBoxesInLogicalOrder.size(); ++i) {
-        startBox = leafBoxesInLogicalOrder[i];
-        startNode = startBox->renderer()->node();
-        if (startNode)
-            return; 
-    }
-}
-
-static void getLogicalEndBoxAndNode(RootInlineBox* rootBox, InlineBox*& endBox, Node*& endNode)
-{
-    Vector<InlineBox*> leafBoxesInLogicalOrder;
-    getLeafBoxesInLogicalOrder(rootBox, leafBoxesInLogicalOrder);
-    endBox = 0;
-    endNode = 0;
-    // Generated content (e.g. list markers and CSS :before and :after
-    // pseudoelements) have no corresponding DOM element, and so cannot be
-    // represented by a VisiblePosition.  Use whatever precedes instead.
-    for (size_t i = leafBoxesInLogicalOrder.size(); i > 0; --i) { 
-        endBox = leafBoxesInLogicalOrder[i - 1];
-        endNode = endBox->renderer()->node();
-        if (endNode)
-            return;
-    }
+    return lastPositionInNode(highestRoot);
 }
 
 static VisiblePosition logicalStartPositionForLine(const VisiblePosition& c)
@@ -1122,8 +1058,7 @@ static VisiblePosition logicalStartPositionForLine(const VisiblePosition& c)
     }
     
     InlineBox* logicalStartBox;
-    Node* logicalStartNode;
-    getLogicalStartBoxAndNode(rootBox, logicalStartBox, logicalStartNode);
+    Node* logicalStartNode = rootBox->getLogicalStartBoxWithNode(logicalStartBox);
 
     if (!logicalStartNode)
         return VisiblePosition();
@@ -1158,8 +1093,8 @@ static VisiblePosition logicalEndPositionForLine(const VisiblePosition& c)
     }
     
     InlineBox* logicalEndBox;
-    Node* logicalEndNode;
-    getLogicalEndBoxAndNode(rootBox, logicalEndBox, logicalEndNode);
+    Node* logicalEndNode = rootBox->getLogicalEndBoxWithNode(logicalEndBox);
+
     if (!logicalEndNode)
         return VisiblePosition();
     
diff --git a/Source/WebCore/editing/visible_units.h b/Source/WebCore/editing/visible_units.h
index 167bd2c..18b9665 100644
--- a/Source/WebCore/editing/visible_units.h
+++ b/Source/WebCore/editing/visible_units.h
@@ -32,6 +32,7 @@
 
 namespace WebCore {
 
+class RootInlineBox;
 class VisiblePosition;
 
 enum EWordSide { RightWordIfOnBoundary = false, LeftWordIfOnBoundary = true };
@@ -70,11 +71,11 @@ VisiblePosition previousParagraphPosition(const VisiblePosition &, int x);
 VisiblePosition nextParagraphPosition(const VisiblePosition &, int x);
 bool isStartOfParagraph(const VisiblePosition &, EditingBoundaryCrossingRule = CannotCrossEditingBoundary);
 bool isEndOfParagraph(const VisiblePosition &, EditingBoundaryCrossingRule = CannotCrossEditingBoundary);
-bool inSameParagraph(const VisiblePosition &, const VisiblePosition &);
+bool inSameParagraph(const VisiblePosition &, const VisiblePosition &, EditingBoundaryCrossingRule = CannotCrossEditingBoundary);
 
 // blocks (true paragraphs; line break elements don't break blocks)
-VisiblePosition startOfBlock(const VisiblePosition &);
-VisiblePosition endOfBlock(const VisiblePosition &);
+VisiblePosition startOfBlock(const VisiblePosition &, EditingBoundaryCrossingRule = CannotCrossEditingBoundary);
+VisiblePosition endOfBlock(const VisiblePosition &, EditingBoundaryCrossingRule = CannotCrossEditingBoundary);
 bool inSameBlock(const VisiblePosition &, const VisiblePosition &);
 bool isStartOfBlock(const VisiblePosition &);
 bool isEndOfBlock(const VisiblePosition &);
diff --git a/Source/WebCore/features.pri b/Source/WebCore/features.pri
index 8c5bf2f..8fbcfee 100644
--- a/Source/WebCore/features.pri
+++ b/Source/WebCore/features.pri
@@ -135,7 +135,7 @@ contains(MOBILITY_CONFIG, sensors) {
 symbian|maemo5|maemo6 {
     !CONFIG(QTDIR_build):!contains(DEFINES, ENABLE_QT_USERAGENT_DEVICEMODEL=.) {
         contains(MOBILITY_CONFIG, systeminfo) {
-            DEFINES += QT_USERAGENT_DEVICEMODEL=1
+            DEFINES += ENABLE_QT_USERAGENT_DEVICEMODEL=1
         }
     }
 }
@@ -214,6 +214,9 @@ contains(DEFINES, ENABLE_WCSS=1): FEATURE_DEFINES_JAVASCRIPT += ENABLE_WCSS=1
 contains(DEFINES, ENABLE_WML=1): FEATURE_DEFINES_JAVASCRIPT += ENABLE_WML=1
 contains(DEFINES, ENABLE_XHTMLMP=1): FEATURE_DEFINES_JAVASCRIPT += ENABLE_XHTMLMP=1
 contains(DEFINES, ENABLE_SVG=1): FEATURE_DEFINES_JAVASCRIPT += ENABLE_SVG=1
+contains(DEFINES, ENABLE_SVG_ANIMATION=1): FEATURE_DEFINES_JAVASCRIPT += ENABLE_SVG_ANIMATION=1
+contains(DEFINES, ENABLE_SVG_FONTS=1): FEATURE_DEFINES_JAVASCRIPT += ENABLE_SVG_FONTS=1
+contains(DEFINES, ENABLE_SVG_FOREIGN_OBJECT=1): FEATURE_DEFINES_JAVASCRIPT += ENABLE_SVG_FOREIGN_OBJECT=1
 contains(DEFINES, ENABLE_JAVASCRIPT_DEBUGGER=1): FEATURE_DEFINES_JAVASCRIPT += ENABLE_JAVASCRIPT_DEBUGGER=1
 contains(DEFINES, ENABLE_OFFLINE_WEB_APPLICATIONS=1): FEATURE_DEFINES_JAVASCRIPT += ENABLE_OFFLINE_WEB_APPLICATIONS=1
 contains(DEFINES, ENABLE_WEB_SOCKETS=1): FEATURE_DEFINES_JAVASCRIPT += ENABLE_WEB_SOCKETS=1
diff --git a/Source/WebCore/fileapi/BlobURL.cpp b/Source/WebCore/fileapi/BlobURL.cpp
index 47ebe8d..5d79141 100644
--- a/Source/WebCore/fileapi/BlobURL.cpp
+++ b/Source/WebCore/fileapi/BlobURL.cpp
@@ -52,16 +52,6 @@ KURL BlobURL::createInternalURL()
     return createBlobURL("blobinternal://");
 }
 
-KURL BlobURL::getOrigin(const KURL& url)
-{
-    ASSERT(url.protocolIs(kBlobProtocol));
-
-    unsigned startIndex = url.pathStart();
-    unsigned afterEndIndex = url.pathAfterLastSlash();
-    String origin = url.string().substring(startIndex, afterEndIndex - startIndex);
-    return KURL(ParsedURLString, decodeURLEscapeSequences(origin));
-}
-
 String BlobURL::getIdentifier(const KURL& url)
 {
     ASSERT(url.protocolIs(kBlobProtocol));
@@ -72,6 +62,9 @@ String BlobURL::getIdentifier(const KURL& url)
 
 KURL BlobURL::createBlobURL(const String& originString)
 {
+    ASSERT(!originString.isEmpty());
+    if (originString == "null")
+        return KURL();
     String urlString = kBlobProtocol;
     urlString += ":";
     urlString += encodeWithURLEscapeSequences(originString);
diff --git a/Source/WebCore/fileapi/BlobURL.h b/Source/WebCore/fileapi/BlobURL.h
index 4526e63..4ea59fe 100644
--- a/Source/WebCore/fileapi/BlobURL.h
+++ b/Source/WebCore/fileapi/BlobURL.h
@@ -50,7 +50,6 @@ class BlobURL {
 public:
     static KURL createPublicURL(SecurityOrigin*);
     static KURL createInternalURL();
-    static KURL getOrigin(const KURL&);
     static String getIdentifier(const KURL&);
     static const char* blobProtocol() { return kBlobProtocol; }
 
diff --git a/Source/WebCore/fileapi/DOMFileSystem.cpp b/Source/WebCore/fileapi/DOMFileSystem.cpp
index c1710cd..01d56d5 100644
--- a/Source/WebCore/fileapi/DOMFileSystem.cpp
+++ b/Source/WebCore/fileapi/DOMFileSystem.cpp
@@ -39,6 +39,7 @@
 #include "ErrorCallback.h"
 #include "File.h"
 #include "FileEntry.h"
+#include "FileMetadata.h"
 #include "FileSystemCallbacks.h"
 #include "FileWriter.h"
 #include "FileWriterBaseCallback.h"
@@ -111,12 +112,46 @@ void DOMFileSystem::createWriter(const FileEntry* fileEntry, PassRefPtr<FileWrit
     m_asyncFileSystem->createWriter(fileWriter.get(), platformPath, callbacks.release());
 }
 
-void DOMFileSystem::createFile(const FileEntry* fileEntry, PassRefPtr<FileCallback> successCallback, PassRefPtr<ErrorCallback>)
+namespace {
+
+class GetPathCallback : public FileSystemCallbacksBase {
+public:
+    static PassOwnPtr<GetPathCallback> create(PassRefPtr<DOMFileSystem> filesystem, const String& path, PassRefPtr<FileCallback> successCallback, PassRefPtr<ErrorCallback> errorCallback)
+    {
+        return adoptPtr(new GetPathCallback(filesystem, path, successCallback, errorCallback));
+    }
+
+    virtual void didReadMetadata(const FileMetadata& metadata)
+    {
+        if (!metadata.platformPath.isEmpty())
+            m_path = metadata.platformPath;
+
+        m_filesystem->scheduleCallback(m_successCallback.release(), File::create(m_path));
+    }
+
+private:
+    GetPathCallback(PassRefPtr<DOMFileSystem> filesystem, const String& path, PassRefPtr<FileCallback> successCallback, PassRefPtr<ErrorCallback> errorCallback)
+        : FileSystemCallbacksBase(errorCallback)
+        , m_filesystem(filesystem)
+        , m_path(path)
+        , m_successCallback(successCallback)
+    {
+    }
+
+    RefPtr<DOMFileSystem> m_filesystem;
+    String m_path;
+    RefPtr<FileCallback> m_successCallback;
+};
+
+} // namespace
+
+void DOMFileSystem::createFile(const FileEntry* fileEntry, PassRefPtr<FileCallback> successCallback, PassRefPtr<ErrorCallback> errorCallback)
 {
     String platformPath = m_asyncFileSystem->virtualToPlatformPath(fileEntry->fullPath());
-    scheduleCallback(successCallback, File::create(platformPath));
+
+    m_asyncFileSystem->readMetadata(platformPath, GetPathCallback::create(this, platformPath, successCallback, errorCallback));
 }
 
-} // namespace
+} // namespace WebCore
 
 #endif // ENABLE(FILE_SYSTEM)
diff --git a/Source/WebCore/fileapi/DOMFileSystemSync.cpp b/Source/WebCore/fileapi/DOMFileSystemSync.cpp
index 5ae7545..0d26bb6 100644
--- a/Source/WebCore/fileapi/DOMFileSystemSync.cpp
+++ b/Source/WebCore/fileapi/DOMFileSystemSync.cpp
@@ -33,6 +33,8 @@
 
 #if ENABLE(FILE_SYSTEM)
 
+#include "AsyncFileSystem.h"
+#include "AsyncFileWriter.h"
 #include "DOMFilePath.h"
 #include "DirectoryEntrySync.h"
 #include "ErrorCallback.h"
@@ -40,6 +42,7 @@
 #include "FileEntrySync.h"
 #include "FileError.h"
 #include "FileException.h"
+#include "FileMetadata.h"
 #include "FileSystemCallbacks.h"
 #include "FileWriterBaseCallback.h"
 #include "FileWriterSync.h"
@@ -67,10 +70,105 @@ PassRefPtr<DirectoryEntrySync> DOMFileSystemSync::root()
     return DirectoryEntrySync::create(this, DOMFilePath::root);
 }
 
+namespace {
+
+class GetPathHelper : public AsyncFileSystemCallbacks {
+public:
+    class GetPathResult : public RefCounted<GetPathResult> {
+      public:
+        static PassRefPtr<GetPathResult> create()
+        {
+            return adoptRef(new GetPathResult());
+        }
+
+        bool m_failed;
+        int m_code;
+        String m_path;
+
+      private:
+        GetPathResult()
+            : m_failed(false)
+            , m_code(0)
+        {
+        }
+
+        ~GetPathResult()
+        {
+        }
+        friend class WTF::RefCounted<GetPathResult>;
+    };
+
+    static PassOwnPtr<GetPathHelper> create(PassRefPtr<GetPathResult> result)
+    {
+        return adoptPtr(new GetPathHelper(result));
+    }
+
+    virtual void didSucceed()
+    {
+        ASSERT_NOT_REACHED();
+    }
+
+    virtual void didOpenFileSystem(const String&, PassOwnPtr<AsyncFileSystem>)
+    {
+        ASSERT_NOT_REACHED();
+    }
+
+    virtual void didReadDirectoryEntry(const String&, bool)
+    {
+        ASSERT_NOT_REACHED();
+    }
+
+    virtual void didReadDirectoryEntries(bool)
+    {
+        ASSERT_NOT_REACHED();
+    }
+
+    virtual void didCreateFileWriter(PassOwnPtr<AsyncFileWriter>, long long)
+    {
+        ASSERT_NOT_REACHED();
+    }
+
+    virtual void didFail(int code)
+    {
+        m_result->m_failed = true;
+        m_result->m_code = code;
+    }
+
+    virtual ~GetPathHelper()
+    {
+    }
+
+    void didReadMetadata(const FileMetadata& metadata)
+    {
+        m_result->m_path = metadata.platformPath;
+    }
+private:
+    GetPathHelper(PassRefPtr<GetPathResult> result)
+        : m_result(result)
+    {
+    }
+
+    RefPtr<GetPathResult> m_result;
+};
+
+} // namespace
+
 PassRefPtr<File> DOMFileSystemSync::createFile(const FileEntrySync* fileEntry, ExceptionCode& ec)
 {
     ec = 0;
     String platformPath = m_asyncFileSystem->virtualToPlatformPath(fileEntry->fullPath());
+    RefPtr<GetPathHelper::GetPathResult> result(GetPathHelper::GetPathResult::create());
+    m_asyncFileSystem->readMetadata(platformPath, GetPathHelper::create(result));
+    if (!m_asyncFileSystem->waitForOperationToComplete()) {
+        ec = FileException::ABORT_ERR;
+        return 0;
+    }
+    if (result->m_failed) {
+        ec = result->m_code;
+        return 0;
+    }
+    if (!result->m_path.isEmpty())
+        platformPath = result->m_path;
     return File::create(platformPath);
 }
 
diff --git a/Source/WebCore/fileapi/Entry.idl b/Source/WebCore/fileapi/Entry.idl
index f144b31..557ade4 100644
--- a/Source/WebCore/fileapi/Entry.idl
+++ b/Source/WebCore/fileapi/Entry.idl
@@ -43,7 +43,7 @@ module storage {
         void getMetadata(in [Optional, Callback] MetadataCallback successCallback, in [Optional, Callback] ErrorCallback errorCallback);
         void moveTo(in DirectoryEntry parent, in [Optional, ConvertUndefinedOrNullToNullString] DOMString name, in [Optional, Callback] EntryCallback successCallback, in [Optional, Callback] ErrorCallback errorCallback);
         void copyTo(in DirectoryEntry parent, in [Optional, ConvertUndefinedOrNullToNullString] DOMString name, in [Optional, Callback] EntryCallback successCallback, in [Optional, Callback] ErrorCallback errorCallback);
-        DOMString toURI();
+        DOMString toURL();
         void remove(in [Optional, Callback] VoidCallback successCallback, in [Optional, Callback] ErrorCallback errorCallback);
         void getParent(in [Optional, Callback] EntryCallback successCallback, in [Optional, Callback] ErrorCallback errorCallback);
     };
diff --git a/Source/WebCore/fileapi/EntryBase.cpp b/Source/WebCore/fileapi/EntryBase.cpp
index ad3bec0..e10964a 100644
--- a/Source/WebCore/fileapi/EntryBase.cpp
+++ b/Source/WebCore/fileapi/EntryBase.cpp
@@ -54,11 +54,15 @@ EntryBase::~EntryBase()
 {
 }
 
-String EntryBase::toURI()
+String EntryBase::toURL()
 {
+    String originString = m_fileSystem->securityOrigin()->toString();
+    ASSERT(!originString.isEmpty());
+    if (originString == "null")
+        return String();
     StringBuilder result;
     result.append("filesystem:");
-    result.append(m_fileSystem->securityOrigin()->toString());
+    result.append(originString);
     result.append("/");
     result.append(m_fileSystem->asyncFileSystem()->type() == AsyncFileSystem::Temporary ? DOMFileSystemBase::kTemporaryPathPrefix : DOMFileSystemBase::kPersistentPathPrefix);
     result.append(m_fullPath);
diff --git a/Source/WebCore/fileapi/EntryBase.h b/Source/WebCore/fileapi/EntryBase.h
index babd295..a34a914 100644
--- a/Source/WebCore/fileapi/EntryBase.h
+++ b/Source/WebCore/fileapi/EntryBase.h
@@ -55,7 +55,7 @@ public:
     const String& fullPath() const { return m_fullPath; }
     const String& name() const { return m_name; }
 
-    String toURI();
+    String toURL();
 
 protected:
     EntryBase(PassRefPtr<DOMFileSystemBase>, const String& fullPath);
diff --git a/Source/WebCore/fileapi/EntrySync.idl b/Source/WebCore/fileapi/EntrySync.idl
index 0a180e8..459a014 100644
--- a/Source/WebCore/fileapi/EntrySync.idl
+++ b/Source/WebCore/fileapi/EntrySync.idl
@@ -43,7 +43,7 @@ module storage {
         Metadata getMetadata() raises (FileException);
         EntrySync moveTo(in DirectoryEntrySync parent, in [ConvertUndefinedOrNullToNullString] DOMString name) raises (FileException);
         EntrySync copyTo(in DirectoryEntrySync parent, in [ConvertUndefinedOrNullToNullString] DOMString name) raises (FileException);
-        DOMString toURI();
+        DOMString toURL();
         void remove() raises (FileException);
         DirectoryEntrySync getParent();
     };
diff --git a/Source/WebCore/fileapi/FileReaderLoader.cpp b/Source/WebCore/fileapi/FileReaderLoader.cpp
index 07b32a6..918ffba 100644
--- a/Source/WebCore/fileapi/FileReaderLoader.cpp
+++ b/Source/WebCore/fileapi/FileReaderLoader.cpp
@@ -75,6 +75,10 @@ void FileReaderLoader::start(ScriptExecutionContext* scriptExecutionContext, Blo
 {
     // The blob is read by routing through the request handling layer given a temporary public url.
     m_urlForReading = BlobURL::createPublicURL(scriptExecutionContext->securityOrigin());
+    if (m_urlForReading.isEmpty()) {
+        failed(FileError::SECURITY_ERR);
+        return;
+    }
     ThreadableBlobRegistry::registerBlobURL(m_urlForReading, blob->url());
 
     // Construct and load the request.
diff --git a/Source/WebCore/fileapi/FileThread.h b/Source/WebCore/fileapi/FileThread.h
index 45205c4..9c1d267 100644
--- a/Source/WebCore/fileapi/FileThread.h
+++ b/Source/WebCore/fileapi/FileThread.h
@@ -42,7 +42,7 @@ namespace WebCore {
 
 class FileStream;
 
-class FileThread : public ThreadSafeShared<FileThread> {
+class FileThread : public ThreadSafeRefCounted<FileThread> {
 public:
     static PassRefPtr<FileThread> create()
     {
diff --git a/Source/WebCore/fileapi/LocalFileSystem.cpp b/Source/WebCore/fileapi/LocalFileSystem.cpp
index 688d155..955d723 100644
--- a/Source/WebCore/fileapi/LocalFileSystem.cpp
+++ b/Source/WebCore/fileapi/LocalFileSystem.cpp
@@ -81,7 +81,7 @@ static void openFileSystem(ScriptExecutionContext*, const String& basePath, cons
     AsyncFileSystem::openFileSystem(basePath, identifier, type, create, callbacks);
 }
 
-void LocalFileSystem::readFileSystem(ScriptExecutionContext* context, AsyncFileSystem::Type type, PassOwnPtr<AsyncFileSystemCallbacks> callbacks)
+void LocalFileSystem::readFileSystem(ScriptExecutionContext* context, AsyncFileSystem::Type type, PassOwnPtr<AsyncFileSystemCallbacks> callbacks, bool)
 {
     // AsyncFileSystem::openFileSystem calls callbacks synchronously, so the method needs to be called asynchronously.
     context->postTask(createCallbackTask(&openFileSystem, fileSystemBasePath(), context->securityOrigin()->databaseIdentifier(), type, false, callbacks));
diff --git a/Source/WebCore/fileapi/LocalFileSystem.h b/Source/WebCore/fileapi/LocalFileSystem.h
index baf72d9..2eabd7a 100644
--- a/Source/WebCore/fileapi/LocalFileSystem.h
+++ b/Source/WebCore/fileapi/LocalFileSystem.h
@@ -54,7 +54,7 @@ public:
     static LocalFileSystem& localFileSystem();
 
     // Does not create the root path for file system, just reads it if available.
-    void readFileSystem(ScriptExecutionContext*, AsyncFileSystem::Type, PassOwnPtr<AsyncFileSystemCallbacks>);
+    void readFileSystem(ScriptExecutionContext*, AsyncFileSystem::Type, PassOwnPtr<AsyncFileSystemCallbacks>, bool synchronous = false);
 
     void requestFileSystem(ScriptExecutionContext*, AsyncFileSystem::Type, long long size, PassOwnPtr<AsyncFileSystemCallbacks>, bool synchronous = false);
 
diff --git a/Source/WebCore/gyp/WebCore.gyp b/Source/WebCore/gyp/WebCore.gyp
index b811b52..ce78b67 100644
--- a/Source/WebCore/gyp/WebCore.gyp
+++ b/Source/WebCore/gyp/WebCore.gyp
@@ -3,7 +3,26 @@
     '../../gyp/common.gypi',
     '../WebCore.gypi',
   ],
-  'xcode_config_file': '../Configurations/DebugRelease.xcconfig',
+  'configurations': {
+    'Production': {
+      'xcode_config_file': '<(project_dir)/Configurations/Base.xcconfig',
+    },
+    'Release': {
+      'xcode_config_file': '<(project_dir)/Configurations/DebugRelease.xcconfig',
+      'xcode_settings': {
+        'STRIP_INSTALLED_PRODUCT': 'NO',
+      },
+    },
+    'Debug': {
+      'xcode_config_file': '<(project_dir)/Configurations/DebugRelease.xcconfig',
+      'xcode_settings': {
+        'DEAD_CODE_STRIPPING': '$(DEAD_CODE_STRIPPING_debug)',
+        'DEBUG_DEFINES': '$(DEBUG_DEFINES_debug)',
+        'GCC_OPTIMIZATION_LEVEL': '$(GCC_OPTIMIZATION_LEVEL_debug)',
+        'STRIP_INSTALLED_PRODUCT': '$(STRIP_INSTALLED_PRODUCT_debug)',
+      },
+    },
+  },
   'targets': [
     {
       'target_name': 'WebCore',
@@ -16,14 +35,16 @@
         # FIXME: Add 'Copy Inspector Resources',
       ],
       'include_dirs': [
-        '<(DEPTH)/WebCore/icu',
-        '<(DEPTH)/WebCore/ForwardingHeaders',
+        '<(project_dir)',
+        '<(project_dir)/icu',
+        '<(project_dir)/ForwardingHeaders',
         '<(PRODUCT_DIR)/usr/local/include',
         '/usr/include/libxml2',
+        '<(PRODUCT_DIR)/DerivedSources',
+        '<(PRODUCT_DIR)/DerivedSources/WebCore',
       ],
       'sources': [
         '<@(webcore_files)',
-        '<@(webcore_publicheader_files)',
         '<@(webcore_privateheader_files)',
         '<@(webcore_derived_source_files)',
         '$(SDKROOT)/System/Library/Frameworks/Accelerate.framework',
@@ -44,105 +65,121 @@
         'libz.dylib',
       ],
       'sources/': [
-        ['exclude', 'accessibility/[^/]+/'],
-        ['include', 'accessibility/mac/'],
         ['exclude', 'bindings/[^/]+/'],
         ['include', 'bindings/generic/'],
         ['include', 'bindings/js/'],
         ['include', 'bindings/objc/'],
-        ['exclude', 'bridge/jni/v8/'],
-        ['exclude', 'bridge/qt/'],
-        # FIXME: These files shouldn't be in this directory.
-        ['exclude', 'bridge/testbindings\.cpp'],
-        ['exclude', 'bridge/testbindings\.mm'],
-        ['exclude', 'bridge/testqtbindings\.cpp'],
-        ['exclude', 'editing/[^/]+/'],
-        ['include', 'editing/mac/'],
-        ['exclude', 'history/[^/]+/'],
-        ['include', 'history/cf/'],
-        ['include', 'history/mac/'],
-        ['exclude', 'loader/[^/]+/'],
-        ['include', 'loader/appcache/'],
-        ['include', 'loader/archive/'],
-        ['include', 'loader/cache/'],
-        ['include', 'loader/cf/'],
-        ['include', 'loader/icon/'],
-        ['include', 'loader/mac/'],
-        ['exclude', 'page/[^/]+/'],
-        ['include', 'page/animation/'],
-        ['include', 'page/mac/'],
-        ['exclude', 'platform/[^/]+/'],
-        ['include', 'platform/animation/'],
-        ['include', 'platform/audio/'],
-        ['exclude', 'platform/audio/[^/]+/'],
-        ['include', 'platform/audio/mac/'],
-        ['include', 'platform/audio/fftw/'], # FIXME: Is this correct? mkl is the other choice.
-        ['include', 'platform/audio/resources/'],
-        ['include', 'platform/cf/'],
-        ['include', 'platform/cocoa/'],
-        ['include', 'platform/graphics/'],
-        ['exclude', 'platform/graphics/[^/]+/'],
-        ['include', 'platform/graphics/ca/'],
-        ['include', 'platform/graphics/cg/'],
-        # FIXME: This file appears to be misplaced.
-        ['exclude', 'platform/graphics/cg/FontPlatformData\.h'],
-        ['include', 'platform/graphics/cocoa/'],
-        ['include', 'platform/graphics/filters/'],
-        ['include', 'platform/graphics/gpu/'],
-        ['include', 'platform/graphics/mac/'],
-        ['include', 'platform/graphics/opengl/'],
-        ['include', 'platform/graphics/transforms/'],
-        ['include', 'platform/mac/'],
-        ['include', 'platform/mock/'],
-        ['include', 'platform/network/'],
-        ['exclude', 'platform/network/[^/]+/'],
-        ['include', 'platform/network/cf'],
-        ['include', 'platform/network/mac'],
-        ['include', 'platform/posix/'],
-        ['include', 'platform/sql/'],
-        ['exclude', 'platform/sql/chromium'],
-        ['include', 'platform/text/'],
-        ['exclude', 'platform/text/[^/]+/'],
-        ['include', 'platform/text/cf'],
-        ['include', 'platform/text/mac'],
-        ['include', 'platform/text/transcoder'],
-        ['exclude', 'DerivedSources\.cpp$'],
-        # FIXME: Consider using one or more AllInOne files.
-        ['exclude', '(Chromium|Win|Qt)\.cpp$'],
-        ['exclude', 'AllInOne\.cpp$'],
-        ['exclude', 'WebCore\.gyp/mac/Empty\.cpp$']
-      ],
-      'mac_framework_headers': [
-        '<@(webcore_publicheader_files)',
+
+        # FIXME: This could should move to Source/ThirdParty.
+        ['exclude', 'thirdparty/'],
+
+        # FIXME: Figure out how to store these patterns in a variable.
+        ['exclude', '(android|brew|cairo|chromium|curl|efl|freetype|fftw|gstreamer|gtk|haiku|linux|mkl|openvg|pango|qt|skia|soup|symbian|texmap|iphone|v8|win|wince|wx)/'],
+        ['exclude', '(Android|Brew|Cairo|Curl|Chromium|Efl|Haiku|Gtk|Linux|OpenType|Qt|Safari|Soup|Symbian|V8|Win|WinCE|Wx)\\.(cpp|mm?)$'],
+        ['exclude', 'Chromium[^/]*\\.(cpp|mm?)$'],
+
+        ['exclude', 'platform/image-decoders/'],
+        ['exclude', 'platform/image-encoders/'],
+
+        ['exclude', 'bridge/testbindings\\.cpp$'], # Remove from GYPI?
+        ['exclude', 'bridge/testbindings\\.mm$'], # Remove from GYPI?
+        ['exclude', 'bridge/testqtbindings\\.cpp$'], # Remove from GYPI?
+        ['exclude', 'platform/KillRingNone\\.cpp$'],
+        ['exclude', 'platform/graphics/cg/FontPlatformData\\.h$'],
+        ['exclude', 'platform/graphics/gpu/LoopBlinnPathProcessor\\.(cpp|h)$'],
+        ['exclude', 'platform/graphics/gpu/LoopBlinnLocalTriangulator\\.(cpp|h)$'],
+        ['exclude', 'platform/graphics/gpu/LoopBlinnPathCache\\.(cpp|h)$'],
+        ['exclude', 'platform/graphics/gpu/LoopBlinnShader\\.(cpp|h)$'],
+        ['exclude', 'platform/graphics/gpu/LoopBlinnSolidFillShader\\.(cpp|h)$'],
+        # FIXME: Consider excluding GL as a suffix.
+        ['exclude', 'platform/graphics/ImageSource\\.cpp$'],
+        ['exclude', 'platform/graphics/opengl/TextureMapperGL\\.cpp$'],
+        ['exclude', 'platform/graphics/opentype/OpenTypeUtilities\\.(cpp|h)$'],
+        ['exclude', 'platform/posix/SharedBufferPOSIX\\.cpp$'],
+        ['exclude', 'platform/text/Hyphenation\\.cpp$'],
+        ['exclude', 'platform/text/LocalizedNumberICU\\.cpp$'],
+        ['exclude', 'platform/text/LocalizedNumberNone\\.cpp$'],
+        ['exclude', 'platform/text/TextEncodingDetectorNone\\.cpp$'],
+        ['exclude', 'plugins/PluginDataNone\\.cpp$'],
+        ['exclude', 'plugins/PluginDatabase\\.cpp$'],
+        ['exclude', 'plugins/PluginPackageNone\\.cpp$'],
+        ['exclude', 'plugins/PluginPackage\\.cpp$'],
+        ['exclude', 'plugins/PluginStream\\.cpp$'],
+        ['exclude', 'plugins/PluginView\\.cpp$'],
+        ['exclude', 'plugins/mac/PluginPackageMac\\.cpp$'],
+        ['exclude', 'plugins/mac/PluginViewMac\\.mm$'],
+        ['exclude', 'plugins/npapi\\.cpp$'],
+
+        # FIXME: Check whether we need to build these derived source files.
+        ['exclude', 'JSAbstractView\\.(cpp|h)'],
+        ['exclude', 'JSElementTimeControl\\.(cpp|h)'],
+        ['exclude', 'JSMathMLElementWrapperFactory\\.(cpp|h)'],
+        ['exclude', 'JSSVGExternalResourcesRequired\\.(cpp|h)'],
+        ['exclude', 'JSSVGFilterPrimitiveStandardAttributes\\.(cpp|h)'],
+        ['exclude', 'JSSVGFitToViewBox\\.(cpp|h)'],
+        ['exclude', 'JSSVGLangSpace\\.(cpp|h)'],
+        ['exclude', 'JSSVGLocatable\\.(cpp|h)'],
+        ['exclude', 'JSSVGStylable\\.(cpp|h)'],
+        ['exclude', 'JSSVGTests\\.(cpp|h)'],
+        ['exclude', 'JSSVGTransformable\\.(cpp|h)'],
+        ['exclude', 'JSSVGURIReference\\.(cpp|h)'],
+        ['exclude', 'JSSVGZoomAndPan\\.(cpp|h)'],
+        ['exclude', 'tokenizer\\.cpp'],
+
+        ['exclude', 'AllInOne\\.cpp$'],
+
+        ['exclude', 'rendering/svg/[^/]+\\.cpp'],
+        ['include', 'rendering/svg/RenderSVGAllInOne\\.cpp$'],
       ],
       'mac_framework_private_headers': [
         '<@(webcore_privateheader_files)',
       ],
-      'xcode_config_file': '../Configurations/WebCore.xcconfig',
+      'mac_bundle_resources': [
+        '<@(webcore_resource_files)',
+      ],
+      'xcode_config_file': '<(project_dir)/Configurations/WebCore.xcconfig',
       # FIXME: A number of these actions aren't supposed to run if "${ACTION}" = "installhdrs"
       'postbuilds': [
         {
           'postbuild_name': 'Check For Global Initializers',
           'action': [
-            'sh', '<(DEPTH)/gyp/run-if-exists.sh', '<(DEPTH)/../Tools/Scripts/check-for-global-initializers'
+            'sh', '<(project_dir)/gyp/run-if-exists.sh', '<(DEPTH)/../Tools/Scripts/check-for-global-initializers'
           ],
         },
         {
           'postbuild_name': 'Check For Exit Time Destructors',
           'action': [
-            'sh', '<(DEPTH)/gyp/run-if-exists.sh', '<(DEPTH)/../Tools/Scripts/check-for-exit-time-destructors'
+            'sh', '<(project_dir)/gyp/run-if-exists.sh', '<(DEPTH)/../Tools/Scripts/check-for-exit-time-destructors'
           ],
         },
         {
           'postbuild_name': 'Check For Weak VTables and Externals',
           'action': [
-            'sh', '<(DEPTH)/gyp/run-if-exists.sh', '<(DEPTH)/../Tools/Scripts/check-for-weak-vtables-and-externals'
+            'sh', '<(project_dir)/gyp/run-if-exists.sh', '<(DEPTH)/../Tools/Scripts/check-for-weak-vtables-and-externals'
+          ],
+        },
+        {
+          'postbuild_name': 'Copy Forwarding and ICU Headers',
+          'action': [
+            'sh', '<(project_dir)/gyp/copy-forwarding-and-icu-headers.sh'
+          ],
+        },
+        {
+          'postbuild_name': 'Copy Inspector Resources',
+          'action': [
+            'sh', '<(project_dir)/gyp/copy-inspector-resources.sh'
+          ],
+        },
+        {
+          'postbuild_name': 'Streamline Inspector Source',
+          'action': [
+            'sh', '<(project_dir)/gyp/streamline-inspector-source.sh'
           ],
         },
         {
           'postbuild_name': 'Check For Inappropriate Files in Framework',
           'action': [
-            'sh', '<(DEPTH)/gyp/run-if-exists.sh', '<(DEPTH)/../Tools/Scripts/check-for-inappropriate-files-in-framework'
+            'sh', '<(project_dir)/gyp/run-if-exists.sh', '<(DEPTH)/../Tools/Scripts/check-for-inappropriate-files-in-framework'
           ],
         },
       ],
@@ -152,8 +189,9 @@
           'xcode_settings': {
             # FIXME: Remove these overrides once WebCore.xcconfig is
             # used only by this project.
-            'GCC_PREFIX_HEADER': '<(DEPTH)/WebCore/WebCorePrefix.h',
-            'INFOPLIST_FILE': '<(DEPTH)/WebCore/Info.plist',
+            'GCC_PREFIX_HEADER': '<(project_dir)/WebCorePrefix.h',
+            'INFOPLIST_FILE': '<(project_dir)/Info.plist',
+            'ALWAYS_SEARCH_USER_PATHS': 'NO',
           },
         }],
       ],
@@ -161,6 +199,10 @@
     {
       'target_name': 'Derived Sources',
       'type': 'none',
+      'dependencies': [
+        'WebCoreExportFileGenerator',
+      ],
+      'xcode_config_file': '<(project_dir)/Configurations/WebCore.xcconfig',
       'actions': [{
         'action_name': 'Generate Derived Sources',
         'inputs': [],
@@ -178,10 +220,76 @@
         'inputs': [],
          'outputs': [],
          'action': [
-           'sh', '<(DEPTH)/gyp/update-info-plist.sh', '<(DEPTH)/WebCore/Info.plist'
+           'sh', '<(project_dir)/gyp/update-info-plist.sh', '<(project_dir)/Info.plist'
           ]
       }],
     },
-    # FIXME: Add WebCoreExportFileGenerator
+    {
+      'target_name': 'WebCoreExportFileGenerator Generator',
+      'type': 'none',
+      'actions': [{
+        'action_name': 'Generate Export File Generator',
+        'inputs': [
+          '<(project_dir)/WebCore.exp.in',
+        ],
+        'outputs': [
+          '<@(export_file_generator_files)',
+        ],
+        'action': [
+          'sh', '<(project_dir)/gyp/generate-webcore-export-file-generator.sh',
+        ],
+      }],
+    },
+    {
+      'target_name': 'WebCoreExportFileGenerator',
+      'type': 'executable',
+      'dependencies': [
+        'WebCoreExportFileGenerator Generator',
+      ],
+      'include_dirs': [
+        '<(project_dir)/ForwardingHeaders',
+      ],
+      'xcode_config_file': '<(project_dir)/Configurations/WebCore.xcconfig',
+      'configurations': {
+        'Production': {
+            'EXPORTED_SYMBOLS_FILE': '',
+            'GCC_OPTIMIZATION_LEVEL': '0',
+            'INSTALL_PATH': '/usr/local/bin',
+            'OTHER_LDFLAGS': '',
+            'SKIP_INSTALL': 'YES',
+        },
+        'Release': {
+          'xcode_settings': {
+            'EXPORTED_SYMBOLS_FILE': '',
+            'GCC_OPTIMIZATION_LEVEL': '0',
+            'INSTALL_PATH': '/usr/local/bin',
+            'OTHER_LDFLAGS': '',
+            'SKIP_INSTALL': 'YES',
+          },
+        },
+        'Debug': {
+          'xcode_settings': {
+            'EXPORTED_SYMBOLS_FILE': '',
+            'GCC_OPTIMIZATION_LEVEL': '0',
+            'INSTALL_PATH': '/usr/local/bin',
+            'OTHER_LDFLAGS': '',
+            'SKIP_INSTALL': 'YES',
+          },
+        },
+      },
+      'sources': [
+        '<@(export_file_generator_files)',
+      ],
+      'conditions': [
+        ['OS=="mac"', {
+          'xcode_settings': {
+            # FIXME: Remove these overrides once WebCore.xcconfig is
+            # used only by this project.
+            'GCC_PREFIX_HEADER': '<(project_dir)/WebCorePrefix.h',
+            'INFOPLIST_FILE': '<(project_dir)/Info.plist',
+          },
+        }],
+      ],
+    },
   ], # targets
 }
diff --git a/Source/WebCore/gyp/copy-forwarding-and-icu-headers.sh b/Source/WebCore/gyp/copy-forwarding-and-icu-headers.sh
new file mode 100755
index 0000000..8f19f09
--- /dev/null
+++ b/Source/WebCore/gyp/copy-forwarding-and-icu-headers.sh
@@ -0,0 +1,4 @@
+#!/bin/sh
+
+rsync -aq --exclude ".svn" --exclude ".DS_Store" "$SRCROOT/../ForwardingHeaders" "$BUILT_PRODUCTS_DIR/$PRIVATE_HEADERS_FOLDER_PATH"
+rsync -aq --exclude ".svn" --exclude ".DS_Store" "$SRCROOT/../icu" "$BUILT_PRODUCTS_DIR/$PRIVATE_HEADERS_FOLDER_PATH"
diff --git a/Source/WebCore/gyp/copy-inspector-resources.sh b/Source/WebCore/gyp/copy-inspector-resources.sh
new file mode 100755
index 0000000..9795624
--- /dev/null
+++ b/Source/WebCore/gyp/copy-inspector-resources.sh
@@ -0,0 +1,14 @@
+#!/bin/sh
+
+# Copy all the Inspector front-end resources.
+ditto "${SRCROOT}/../inspector/front-end" "${TARGET_BUILD_DIR}/${UNLOCALIZED_RESOURCES_FOLDER_PATH}/inspector"
+ditto "${BUILT_PRODUCTS_DIR}/DerivedSources/WebCore/InspectorBackendStub.js" "${TARGET_BUILD_DIR}/${UNLOCALIZED_RESOURCES_FOLDER_PATH}/inspector"
+
+# Remove the WebKit.qrc file since it is not used on the Mac (this file is for Qt).
+rm -f "${TARGET_BUILD_DIR}/${UNLOCALIZED_RESOURCES_FOLDER_PATH}/inspector/WebKit.qrc"
+
+# Remove *.re2js files, they are only used to generate some .js files.
+rm -f "${TARGET_BUILD_DIR}/${UNLOCALIZED_RESOURCES_FOLDER_PATH}/inspector/"*.re2js
+
+# Remove any .svn directories that may have been copied over.
+find "${TARGET_BUILD_DIR}/${UNLOCALIZED_RESOURCES_FOLDER_PATH}/inspector" -name ".svn" -type d | xargs rm -rf
diff --git a/Source/WebCore/gyp/generate-webcore-export-file-generator.sh b/Source/WebCore/gyp/generate-webcore-export-file-generator.sh
new file mode 100755
index 0000000..f93f916
--- /dev/null
+++ b/Source/WebCore/gyp/generate-webcore-export-file-generator.sh
@@ -0,0 +1,5 @@
+#!/bin/sh
+
+OUTPUT_DIR="${BUILT_PRODUCTS_DIR}/DerivedSources/${PROJECT_NAME}"
+mkdir -p "${OUTPUT_DIR}"
+"${SRCROOT}"/../make-export-file-generator "${SRCROOT}/../WebCore.exp.in" "${OUTPUT_DIR}/ExportFileGenerator.cpp"
diff --git a/Source/WebCore/gyp/run-if-exists.sh b/Source/WebCore/gyp/run-if-exists.sh
new file mode 100755
index 0000000..242ffc8
--- /dev/null
+++ b/Source/WebCore/gyp/run-if-exists.sh
@@ -0,0 +1,5 @@
+#!/bin/sh
+
+if [ -f $1 ]; then
+    $1 || exit $?;
+fi
diff --git a/Source/WebCore/gyp/streamline-inspector-source.sh b/Source/WebCore/gyp/streamline-inspector-source.sh
new file mode 100755
index 0000000..330d6ed
--- /dev/null
+++ b/Source/WebCore/gyp/streamline-inspector-source.sh
@@ -0,0 +1,19 @@
+#!/bin/sh
+
+# Don't do anything for Debug builds, so the Inspector is easier to debug.
+if [[ ${CONFIGURATION:=Debug} == "Debug" ]]; then
+    exit
+fi
+
+# Combine all script resources in the inspector.html file.
+"$SRCROOT/../combine-javascript-resources" --input-html "${SRCROOT}/../inspector/front-end/inspector.html" --generated-scripts-dir ${BUILT_PRODUCTS_DIR}/DerivedSources/WebCore --output-dir "${DERIVED_FILE_DIR}/WebCore" --output-script-name inspector.js
+
+if [ -d "${TARGET_BUILD_DIR}/${UNLOCALIZED_RESOURCES_FOLDER_PATH}/inspector" ]; then
+    # Remove any JavaScript files, since they will be replaced with the combined file.
+    cd "${TARGET_BUILD_DIR}/${UNLOCALIZED_RESOURCES_FOLDER_PATH}/inspector"
+    rm *.js
+
+    # Copy the modified HTML file and the combined script.
+    cp "${DERIVED_FILE_DIR}/WebCore/inspector.html" inspector.html
+    cp "${DERIVED_FILE_DIR}/WebCore/inspector.js" inspector.js
+fi
diff --git a/Source/WebCore/gyp/update-info-plist.sh b/Source/WebCore/gyp/update-info-plist.sh
new file mode 100755
index 0000000..d02ecce
--- /dev/null
+++ b/Source/WebCore/gyp/update-info-plist.sh
@@ -0,0 +1,4 @@
+# Touch Info.plist to let Xcode know it needs to copy it into the built product
+if [[ "${CONFIGURATION}" != "Production" ]]; then
+    touch "$1";
+fi
diff --git a/Source/WebCore/history/CachedFrame.cpp b/Source/WebCore/history/CachedFrame.cpp
index 558a191..215bfaf 100644
--- a/Source/WebCore/history/CachedFrame.cpp
+++ b/Source/WebCore/history/CachedFrame.cpp
@@ -83,8 +83,6 @@ void CachedFrameBase::restore()
 {
     ASSERT(m_document->view() == m_view);
 
-    m_view->setIsRestoringFromBackForward(true);
-
     Frame* frame = m_view->frame();
     m_cachedFrameScriptData->restore(frame);
 
diff --git a/Source/WebCore/history/HistoryItem.cpp b/Source/WebCore/history/HistoryItem.cpp
index c31aa86..363e1aa 100644
--- a/Source/WebCore/history/HistoryItem.cpp
+++ b/Source/WebCore/history/HistoryItem.cpp
@@ -31,6 +31,7 @@
 #include "IconDatabase.h"
 #include "PageCache.h"
 #include "ResourceRequest.h"
+#include "SharedBuffer.h"
 #include <stdio.h>
 #include <wtf/CurrentTime.h>
 #include <wtf/Decoder.h>
@@ -230,12 +231,6 @@ const String& HistoryItem::alternateTitle() const
     return m_displayTitle;
 }
 
-Image* HistoryItem::icon() const
-{
-    Image* result = iconDatabase().iconForPageURL(m_urlString, IntSize(16, 16));
-    return result ? result : iconDatabase().defaultIcon(IntSize(16, 16));
-}
-
 double HistoryItem::lastVisitedTime() const
 {
     return m_lastVisitedTime;
diff --git a/Source/WebCore/history/HistoryItem.h b/Source/WebCore/history/HistoryItem.h
index 235f756..b9c9983 100644
--- a/Source/WebCore/history/HistoryItem.h
+++ b/Source/WebCore/history/HistoryItem.h
@@ -105,8 +105,6 @@ public:
     void setAlternateTitle(const String& alternateTitle);
     const String& alternateTitle() const;
     
-    Image* icon() const;
-    
     const String& parent() const;
     KURL url() const;
     KURL originalURL() const;
diff --git a/Source/WebCore/html/CollectionCache.h b/Source/WebCore/html/CollectionCache.h
index 8e4a066..d160db2 100644
--- a/Source/WebCore/html/CollectionCache.h
+++ b/Source/WebCore/html/CollectionCache.h
@@ -49,7 +49,7 @@ public:
 
     typedef HashMap<AtomicStringImpl*, Vector<Element*>*> NodeCacheMap;
 
-    unsigned version;
+    uint64_t version;
     Element* current;
     unsigned position;
     unsigned length;
diff --git a/Source/WebCore/html/FormAssociatedElement.cpp b/Source/WebCore/html/FormAssociatedElement.cpp
index 3571744..ea36b2a 100644
--- a/Source/WebCore/html/FormAssociatedElement.cpp
+++ b/Source/WebCore/html/FormAssociatedElement.cpp
@@ -132,7 +132,7 @@ void FormAssociatedElement::resetFormOwner(HTMLFormElement* form)
         m_form->removeFormElement(this);
     }
     m_form = 0;
-    if (!formId.isNull()) {
+    if (!formId.isNull() && element->inDocument()) {
         // The HTML5 spec says that the element should be associated with
         // the first element in the document to have an ID that equal to
         // the value of form attribute, so we put the result of
diff --git a/Source/WebCore/html/HTMLAnchorElement.cpp b/Source/WebCore/html/HTMLAnchorElement.cpp
index 0c10022..60f5b4a 100644
--- a/Source/WebCore/html/HTMLAnchorElement.cpp
+++ b/Source/WebCore/html/HTMLAnchorElement.cpp
@@ -72,7 +72,7 @@ static unsigned parsePortFromStringPosition(const String& value, unsigned portSt
 
 bool HTMLAnchorElement::supportsFocus() const
 {
-    if (isContentEditable())
+    if (rendererIsEditable())
         return HTMLElement::supportsFocus();
     // If not a link we should still be able to focus the element if it has tabIndex.
     return isLink() || HTMLElement::supportsFocus();
@@ -154,7 +154,7 @@ void HTMLAnchorElement::defaultEventHandler(Event* event)
             return;
         }
 
-        if (isContentEditable()) {
+        if (rendererIsEditable()) {
             // This keeps track of the editable block that the selection was in (if it was in one) just before the link was clicked
             // for the LiveWhenNotFocused editable link behavior
             if (event->type() == eventNames().mousedownEvent && event->isMouseEvent() && static_cast<MouseEvent*>(event)->button() != RightButton && document()->frame() && document()->frame()->selection()) {
@@ -174,7 +174,7 @@ void HTMLAnchorElement::defaultEventHandler(Event* event)
 
 void HTMLAnchorElement::setActive(bool down, bool pause)
 {
-    if (isContentEditable()) {
+    if (rendererIsEditable()) {
         EditableLinkBehavior editableLinkBehavior = EditableLinkDefaultBehavior;
         if (Settings* settings = document()->settings())
             editableLinkBehavior = settings->editableLinkBehavior();
@@ -247,7 +247,7 @@ bool HTMLAnchorElement::canStartSelection() const
     // FIXME: We probably want this same behavior in SVGAElement too
     if (!isLink())
         return HTMLElement::canStartSelection();
-    return isContentEditable();
+    return rendererIsEditable();
 }
 
 bool HTMLAnchorElement::draggable() const
@@ -501,7 +501,7 @@ HTMLAnchorElement::EventType HTMLAnchorElement::eventType(Event* event)
 
 bool HTMLAnchorElement::treatLinkAsLiveForEventType(EventType eventType) const
 {
-    if (!isContentEditable())
+    if (!rendererIsEditable())
         return true;
 
     Settings* settings = document()->settings();
diff --git a/Source/WebCore/html/HTMLAnchorElement.idl b/Source/WebCore/html/HTMLAnchorElement.idl
index 432df69..8f09e41 100644
--- a/Source/WebCore/html/HTMLAnchorElement.idl
+++ b/Source/WebCore/html/HTMLAnchorElement.idl
@@ -27,6 +27,7 @@ module html {
         attribute [Reflect, URL] DOMString href;
         attribute [Reflect] DOMString hreflang;
         attribute [Reflect] DOMString name;
+        attribute [Reflect] DOMString ping;
         attribute [Reflect] DOMString rel;
         attribute [Reflect] DOMString rev;
         attribute [Reflect] DOMString shape;
diff --git a/Source/WebCore/html/HTMLAreaElement.cpp b/Source/WebCore/html/HTMLAreaElement.cpp
index 9832d06..4cb2748 100644
--- a/Source/WebCore/html/HTMLAreaElement.cpp
+++ b/Source/WebCore/html/HTMLAreaElement.cpp
@@ -175,7 +175,7 @@ Path HTMLAreaElement::getRegion(const IntSize& size) const
 HTMLImageElement* HTMLAreaElement::imageElement() const
 {
     Node* mapElement = parentNode();
-    if (!mapElement->hasTagName(mapTag))
+    if (!mapElement || !mapElement->hasTagName(mapTag))
         return 0;
     
     return static_cast<HTMLMapElement*>(mapElement)->imageElement();
diff --git a/Source/WebCore/html/HTMLAreaElement.idl b/Source/WebCore/html/HTMLAreaElement.idl
index a77e615..3358c05 100644
--- a/Source/WebCore/html/HTMLAreaElement.idl
+++ b/Source/WebCore/html/HTMLAreaElement.idl
@@ -26,6 +26,7 @@ module html {
         attribute [Reflect] DOMString coords;
         attribute [Reflect, URL] DOMString href;
         attribute [Reflect] boolean noHref;
+        attribute [Reflect] DOMString ping;
         attribute [Reflect] DOMString shape;
         attribute [Reflect] DOMString target;
 
diff --git a/Source/WebCore/html/HTMLAttributeNames.in b/Source/WebCore/html/HTMLAttributeNames.in
index 956812d..3a6fea4 100644
--- a/Source/WebCore/html/HTMLAttributeNames.in
+++ b/Source/WebCore/html/HTMLAttributeNames.in
@@ -298,6 +298,7 @@ version
 viewsource
 vlink
 vspace
+webkitallowfullscreen
 webkitdirectory
 width
 wrap
diff --git a/Source/WebCore/html/HTMLBodyElement.cpp b/Source/WebCore/html/HTMLBodyElement.cpp
index 3cc4cd8..9cf8730 100644
--- a/Source/WebCore/html/HTMLBodyElement.cpp
+++ b/Source/WebCore/html/HTMLBodyElement.cpp
@@ -233,7 +233,7 @@ bool HTMLBodyElement::isURLAttribute(Attribute *attr) const
 
 bool HTMLBodyElement::supportsFocus() const
 {
-    return isContentEditable() || HTMLElement::supportsFocus();
+    return rendererIsEditable() || HTMLElement::supportsFocus();
 }
 
 String HTMLBodyElement::aLink() const
diff --git a/Source/WebCore/html/HTMLCanvasElement.cpp b/Source/WebCore/html/HTMLCanvasElement.cpp
index 79ebdad..fbedbf2 100644
--- a/Source/WebCore/html/HTMLCanvasElement.cpp
+++ b/Source/WebCore/html/HTMLCanvasElement.cpp
@@ -41,6 +41,7 @@
 #include "GraphicsContext.h"
 #include "HTMLNames.h"
 #include "ImageBuffer.h"
+#include "ImageData.h"
 #include "MIMETypeRegistry.h"
 #include "Page.h"
 #include "RenderHTMLCanvas.h"
@@ -76,6 +77,7 @@ static const float MaxSkiaDim = 32767.0F; // Maximum width/height in CSS pixels.
 HTMLCanvasElement::HTMLCanvasElement(const QualifiedName& tagName, Document* document)
     : HTMLElement(tagName, document)
     , m_size(DefaultWidth, DefaultHeight)
+    , m_rendererIsCanvas(false)
     , m_ignoreReset(false)
     , m_pageScaleFactor(document->frame() ? document->frame()->page()->chrome()->scaleFactor() : 1)
     , m_originClean(true)
@@ -173,7 +175,7 @@ CanvasRenderingContext* HTMLCanvasElement::getContext(const String& type, Canvas
 #if ENABLE(WEBGL)    
     Settings* settings = document()->settings();
     if (settings && settings->webGLEnabled()
-#if !PLATFORM(CHROMIUM) && !PLATFORM(QT)
+#if !PLATFORM(CHROMIUM)
         && settings->acceleratedCompositingEnabled()
 #endif
         ) {
@@ -275,15 +277,22 @@ void HTMLCanvasElement::paint(GraphicsContext* context, const IntRect& r)
     if (hasCreatedImageBuffer()) {
         ImageBuffer* imageBuffer = buffer();
         if (imageBuffer) {
-            if (imageBuffer->drawsUsingCopy())
+            if (m_presentedImage)
+                context->drawImage(m_presentedImage.get(), ColorSpaceDeviceRGB, r);
+            else if (imageBuffer->drawsUsingCopy())
                 context->drawImage(copiedImage(), ColorSpaceDeviceRGB, r);
             else
                 context->drawImageBuffer(imageBuffer, ColorSpaceDeviceRGB, r);
         }
     }
-}
 
 #if ENABLE(WEBGL)    
+    if (is3D())
+        static_cast<WebGLRenderingContext*>(m_context.get())->markLayerComposited();
+#endif
+}
+
+#if ENABLE(WEBGL)
 bool HTMLCanvasElement::is3D() const
 {
     return m_context && m_context->is3d();
@@ -296,6 +305,19 @@ void HTMLCanvasElement::makeRenderingResultsAvailable()
         m_context->paintRenderingResultsToCanvas();
 }
 
+void HTMLCanvasElement::makePresentationCopy()
+{
+    if (!m_presentedImage) {
+        // The buffer contains the last presented data, so save a copy of it.
+        m_presentedImage = buffer()->copyImage();
+    }
+}
+
+void HTMLCanvasElement::clearPresentationCopy()
+{
+    m_presentedImage.clear();
+}
+
 void HTMLCanvasElement::attach()
 {
     HTMLElement::attach();
@@ -337,15 +359,37 @@ String HTMLCanvasElement::toDataURL(const String& mimeType, const double* qualit
 
     String lowercaseMimeType = mimeType.lower();
 
-    makeRenderingResultsAvailable();
-
     // FIXME: Make isSupportedImageMIMETypeForEncoding threadsafe (to allow this method to be used on a worker thread).
     if (mimeType.isNull() || !MIMETypeRegistry::isSupportedImageMIMETypeForEncoding(lowercaseMimeType))
-        return buffer()->toDataURL("image/png");
+        lowercaseMimeType = "image/png";
 
+#if PLATFORM(CG) || USE(SKIA)
+    // Try to get ImageData first, as that may avoid lossy conversions.
+    RefPtr<ImageData> imageData = getImageData();
+
+    if (imageData)
+        return ImageDataToDataURL(*imageData, lowercaseMimeType, quality);
+#endif
+
+    makeRenderingResultsAvailable();
+      
     return buffer()->toDataURL(lowercaseMimeType, quality);
 }
 
+PassRefPtr<ImageData> HTMLCanvasElement::getImageData()
+{
+    if (!m_context || !m_context->is3d())
+       return 0;
+
+#if ENABLE(WEBGL)    
+    WebGLRenderingContext* ctx = static_cast<WebGLRenderingContext*>(m_context.get());
+
+    return ctx->paintRenderingResultsToImageData();
+#else
+    return 0;
+#endif
+}
+
 IntRect HTMLCanvasElement::convertLogicalToDevice(const FloatRect& logicalRect) const
 {
     float left = floorf(logicalRect.x() * m_pageScaleFactor);
@@ -399,7 +443,10 @@ void HTMLCanvasElement::createImageBuffer() const
         return;
 
 #if USE(IOSURFACE_CANVAS_BACKING_STORE)
-    m_imageBuffer = ImageBuffer::create(size, ColorSpaceDeviceRGB, Accelerated);
+    if (document()->settings()->canvasUsesAcceleratedDrawing())
+        m_imageBuffer = ImageBuffer::create(size, ColorSpaceDeviceRGB, Accelerated);
+    else
+        m_imageBuffer = ImageBuffer::create(size, ColorSpaceDeviceRGB, Unaccelerated);
 #else
     m_imageBuffer = ImageBuffer::create(size);
 #endif
@@ -434,11 +481,8 @@ ImageBuffer* HTMLCanvasElement::buffer() const
 Image* HTMLCanvasElement::copiedImage() const
 {
     if (!m_copiedImage && buffer()) {
-        if (m_context) {
-            // If we're not rendering to the ImageBuffer, copy the rendering results to it.
-            if (!m_context->paintsIntoCanvasBuffer())
-                m_context->paintRenderingResultsToCanvas();
-        }
+        if (m_context)
+            m_context->paintRenderingResultsToCanvas();
         m_copiedImage = buffer()->copyImage();
     }
     return m_copiedImage.get();
diff --git a/Source/WebCore/html/HTMLCanvasElement.h b/Source/WebCore/html/HTMLCanvasElement.h
index 5c8ac9a..6fdd222 100644
--- a/Source/WebCore/html/HTMLCanvasElement.h
+++ b/Source/WebCore/html/HTMLCanvasElement.h
@@ -47,6 +47,7 @@ class CanvasRenderingContext;
 class GraphicsContext;
 class HTMLCanvasElement;
 class Image;
+class ImageData;
 class ImageBuffer;
 class IntSize;
 
@@ -105,6 +106,9 @@ public:
     ImageBuffer* buffer() const;
     Image* copiedImage() const;
     void clearCopiedImage();
+    PassRefPtr<ImageData> getImageData();
+    void makePresentationCopy();
+    void clearPresentationCopy();
 
     IntRect convertLogicalToDevice(const FloatRect&) const;
     IntSize convertLogicalToDevice(const FloatSize&) const;
@@ -175,6 +179,7 @@ private:
     mutable bool m_hasCreatedImageBuffer;
     mutable OwnPtr<ImageBuffer> m_imageBuffer;
     
+    mutable RefPtr<Image> m_presentedImage;
     mutable RefPtr<Image> m_copiedImage; // FIXME: This is temporary for platforms that have to copy the image buffer to render (and for CSSCanvasValue).
 };
 
diff --git a/Source/WebCore/html/HTMLCollection.cpp b/Source/WebCore/html/HTMLCollection.cpp
index 7d776d1..2782e50 100644
--- a/Source/WebCore/html/HTMLCollection.cpp
+++ b/Source/WebCore/html/HTMLCollection.cpp
@@ -67,7 +67,7 @@ HTMLCollection::~HTMLCollection()
 
 void HTMLCollection::resetCollectionInfo() const
 {
-    unsigned docversion = static_cast<HTMLDocument*>(m_base->document())->domTreeVersion();
+    uint64_t docversion = static_cast<HTMLDocument*>(m_base->document())->domTreeVersion();
 
     if (!m_info) {
         m_info = new CollectionCache;
diff --git a/Source/WebCore/html/HTMLDetailsElement.cpp b/Source/WebCore/html/HTMLDetailsElement.cpp
index 0bcae0b..f9c2f6c 100644
--- a/Source/WebCore/html/HTMLDetailsElement.cpp
+++ b/Source/WebCore/html/HTMLDetailsElement.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies)
+ * Copyright (C) 2010, 2011 Nokia Corporation and/or its subsidiary(-ies)
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -21,7 +21,10 @@
 #include "config.h"
 #include "HTMLDetailsElement.h"
 
+#include "Frame.h"
 #include "HTMLNames.h"
+#include "MouseEvent.h"
+#include "PlatformMouseEvent.h"
 #include "RenderDetails.h"
 
 namespace WebCore {
@@ -35,6 +38,8 @@ PassRefPtr<HTMLDetailsElement> HTMLDetailsElement::create(const QualifiedName& t
 
 HTMLDetailsElement::HTMLDetailsElement(const QualifiedName& tagName, Document* document)
     : HTMLElement(tagName, document)
+    , m_mainSummary(0)
+    , m_isOpen(false)
 {
     ASSERT(hasTagName(detailsTag));
 }
@@ -44,4 +49,88 @@ RenderObject* HTMLDetailsElement::createRenderer(RenderArena* arena, RenderStyle
     return new (arena) RenderDetails(this);
 }
 
+void HTMLDetailsElement::findMainSummary()
+{
+    m_mainSummary = 0;
+
+    for (Node* child = firstChild(); child; child = child->nextSibling()) {
+        if (child->hasTagName(summaryTag)) {
+            m_mainSummary = child;
+            break;
+        }
+    }
+}
+
+void HTMLDetailsElement::childrenChanged(bool changedByParser, Node* beforeChange, Node* afterChange, int childCountDelta)
+{
+    HTMLElement::childrenChanged(changedByParser, beforeChange, afterChange, childCountDelta);
+    if (!changedByParser) {
+        Node* oldSummary = m_mainSummary;
+        findMainSummary();
+
+        if (oldSummary != m_mainSummary && !m_isOpen && attached()) {
+            if (oldSummary && oldSummary->attached())
+                oldSummary->detach();
+            if (m_mainSummary && childCountDelta < 0 && !m_mainSummary->renderer()) {
+                // If childCountDelta is less then zero and the main summary has changed it must be because previous main
+                // summary was removed. The new main summary was then inside the unrevealed content and needs to be
+                // reattached to create its renderer. If childCountDelta is not less then zero then a new <summary> element
+                // has been added and it will be attached without our help.
+                m_mainSummary->detach();
+                m_mainSummary->attach();
+            }
+        }
+    }
+}
+
+void HTMLDetailsElement::finishParsingChildren()
+{
+    HTMLElement::finishParsingChildren();
+    findMainSummary();
+    if (attached() && m_mainSummary && !m_mainSummary->renderer()) {
+        m_mainSummary->detach();
+        m_mainSummary->attach();
+    }
+}
+
+void HTMLDetailsElement::parseMappedAttribute(Attribute* attr)
+{
+    if (attr->name() == openAttr) {
+        bool oldValue = m_isOpen;
+        m_isOpen =  !attr->value().isNull();
+        if (attached() && oldValue != m_isOpen) {
+            detach();
+            attach();
+        }
+    } else
+        HTMLElement::parseMappedAttribute(attr);
+}
+
+bool HTMLDetailsElement::childShouldCreateRenderer(Node* child) const
+{
+    return m_isOpen || child == m_mainSummary;
+}
+
+void HTMLDetailsElement::defaultEventHandler(Event* event)
+{
+    HTMLElement::defaultEventHandler(event);
+
+    if (!renderer() || !renderer()->isDetails() || !event->isMouseEvent() || event->type() != eventNames().clickEvent || event->defaultHandled())
+        return;
+
+    MouseEvent* mouseEvent = static_cast<MouseEvent*>(event);
+    if (mouseEvent->button() != LeftButton)
+        return;
+
+    RenderDetails* renderDetails = static_cast<RenderDetails*>(renderer());
+
+    float factor = document() && document()->frame() ? document()->frame()->pageZoomFactor() : 1.0f;
+    FloatPoint pos = renderDetails->absoluteToLocal(FloatPoint(mouseEvent->pageX() * factor, mouseEvent->pageY() * factor));
+
+    if (renderDetails->interactiveArea().contains(pos.x(), pos.y())) {
+        setAttribute(openAttr, m_isOpen ? String() : String(""));
+        event->setDefaultHandled();
+    }
+}
+
 }
diff --git a/Source/WebCore/html/HTMLDetailsElement.h b/Source/WebCore/html/HTMLDetailsElement.h
index 16427ef..45a9035 100644
--- a/Source/WebCore/html/HTMLDetailsElement.h
+++ b/Source/WebCore/html/HTMLDetailsElement.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies)
+ * Copyright (C) 2010, 2011 Nokia Corporation and/or its subsidiary(-ies)
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -28,11 +28,23 @@ namespace WebCore {
 class HTMLDetailsElement : public HTMLElement {
 public:
     static PassRefPtr<HTMLDetailsElement> create(const QualifiedName& tagName, Document* document);
+    Node* mainSummary() const { return m_mainSummary; }
 
 private:
     HTMLDetailsElement(const QualifiedName&, Document*);
 
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
+    virtual void childrenChanged(bool changedByParser, Node* beforeChange, Node* afterChange, int childCountDelta);
+    virtual void finishParsingChildren();
+
+    void parseMappedAttribute(Attribute*);
+    bool childShouldCreateRenderer(Node*) const;
+    void defaultEventHandler(Event*);
+
+    void findMainSummary();
+
+    Node* m_mainSummary;
+    bool m_isOpen;
 
 };
 
diff --git a/Source/WebCore/html/HTMLElement.cpp b/Source/WebCore/html/HTMLElement.cpp
index b3981c8..e3b5043 100644
--- a/Source/WebCore/html/HTMLElement.cpp
+++ b/Source/WebCore/html/HTMLElement.cpp
@@ -654,44 +654,15 @@ void HTMLElement::addHTMLAlignmentToStyledElement(StyledElement* element, Attrib
 
 bool HTMLElement::supportsFocus() const
 {
-    return Element::supportsFocus() || (isContentEditable() && parentNode() && !parentNode()->isContentEditable());
+    return Element::supportsFocus() || (rendererIsEditable() && parentNode() && !parentNode()->rendererIsEditable());
 }
 
-bool HTMLElement::isContentEditable() const 
+bool HTMLElement::isContentEditable() const
 {
-    if (document()->inDesignMode())
-        return true;
-
-    // Ideally we'd call ASSERT!needsStyleRecalc()) here, but
-    // ContainerNode::setFocus() calls setNeedsStyleRecalc(), so the assertion
-    // would fire in the middle of Document::setFocusedNode().
-
-    if (!renderer()) {
-        if (parentNode())
-            return parentNode()->isContentEditable();
-        else
-            return false;
-    }
-    
-    return renderer()->style()->userModify() == READ_WRITE || renderer()->style()->userModify() == READ_WRITE_PLAINTEXT_ONLY;
-}
-
-bool HTMLElement::isContentRichlyEditable() const
-{
-    if (document()->inDesignMode())
-        return true;
-
-    if (!renderer()) {
-        if (parentNode())
-            return parentNode()->isContentEditable();
-        else
-            return false;
-    }
-    
-    return renderer()->style()->userModify() == READ_WRITE;
+    return rendererIsEditable();
 }
 
-String HTMLElement::contentEditable() const 
+String HTMLElement::contentEditable() const
 {
     const AtomicString& value = fastGetAttribute(contenteditableAttr);
 
diff --git a/Source/WebCore/html/HTMLElement.h b/Source/WebCore/html/HTMLElement.h
index 73517df..077b1c3 100644
--- a/Source/WebCore/html/HTMLElement.h
+++ b/Source/WebCore/html/HTMLElement.h
@@ -56,9 +56,8 @@ public:
     void insertAdjacentText(const String& where, const String& text, ExceptionCode&);
 
     virtual bool supportsFocus() const;
-    
-    virtual bool isContentEditable() const;
-    virtual bool isContentRichlyEditable() const;
+
+    bool isContentEditable() const;
 
     String contentEditable() const;
     void setContentEditable(const String&, ExceptionCode&);
diff --git a/Source/WebCore/html/HTMLEmbedElement.cpp b/Source/WebCore/html/HTMLEmbedElement.cpp
index f419e2a..851deb8 100644
--- a/Source/WebCore/html/HTMLEmbedElement.cpp
+++ b/Source/WebCore/html/HTMLEmbedElement.cpp
@@ -2,7 +2,7 @@
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2000 Stefan Schimanski (1Stein@gmx.de)
- * Copyright (C) 2004, 2005, 2006, 2008, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2004, 2005, 2006, 2008, 2009, 2011 Apple Inc. All rights reserved.
  * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
  *
  * This library is free software; you can redistribute it and/or
@@ -46,7 +46,7 @@ namespace WebCore {
 using namespace HTMLNames;
 
 inline HTMLEmbedElement::HTMLEmbedElement(const QualifiedName& tagName, Document* document, bool createdByParser)
-    : HTMLPlugInImageElement(tagName, document, createdByParser)
+    : HTMLPlugInImageElement(tagName, document, createdByParser, ShouldPreferPlugInsForImages)
 {
     ASSERT(hasTagName(embedTag));
 }
@@ -217,6 +217,10 @@ bool HTMLEmbedElement::rendererIsNeeded(RenderStyle* style)
 
 void HTMLEmbedElement::insertedIntoDocument()
 {
+    HTMLPlugInImageElement::insertedIntoDocument();
+    if (!inDocument())
+        return;
+
     if (document()->isHTMLDocument())
         static_cast<HTMLDocument*>(document())->addNamedItem(m_name);
 
@@ -233,8 +237,6 @@ void HTMLEmbedElement::insertedIntoDocument()
                 static_cast<HTMLObjectElement*>(n)->setAttribute(heightAttr, height);
         }
     }
-
-    HTMLPlugInImageElement::insertedIntoDocument();
 }
 
 void HTMLEmbedElement::removedFromDocument()
diff --git a/Source/WebCore/html/HTMLFormControlElement.cpp b/Source/WebCore/html/HTMLFormControlElement.cpp
index 4b3c48a..af061fe 100644
--- a/Source/WebCore/html/HTMLFormControlElement.cpp
+++ b/Source/WebCore/html/HTMLFormControlElement.cpp
@@ -141,7 +141,7 @@ void HTMLFormControlElement::attach()
 
     if (autofocus() && renderer() && !document()->ignoreAutofocus() && !isReadOnlyFormControl() &&
             ((hasTagName(inputTag) && !isInputTypeHidden) || hasTagName(selectTag) ||
-              hasTagName(buttonTag) || hasTagName(textareaTag)))
+              hasTagName(keygenTag) || hasTagName(buttonTag) || hasTagName(textareaTag)))
          focus();
 }
 
@@ -547,6 +547,12 @@ HTMLTextFormControlElement::~HTMLTextFormControlElement()
 {
 }
 
+void HTMLTextFormControlElement::insertedIntoDocument()
+{
+    HTMLFormControlElement::insertedIntoDocument();
+    setTextAsOfLastFormControlChangeEvent(value());
+}
+
 void HTMLTextFormControlElement::dispatchFocusEvent()
 {
     if (supportsPlaceholder())
@@ -629,6 +635,15 @@ void HTMLTextFormControlElement::select()
     setSelectionRange(0, numeric_limits<int>::max());
 }
 
+void HTMLTextFormControlElement::dispatchFormControlChangeEvent()
+{
+    if (m_textAsOfLastFormControlChangeEvent != value()) {
+        HTMLElement::dispatchChangeEvents();
+        setTextAsOfLastFormControlChangeEvent(value());
+    }
+    setChangedSinceLastFormControlChangeEvent(false);
+}
+
 void HTMLTextFormControlElement::setSelectionRange(int start, int end)
 {
     WebCore::setSelectionRange(this, start, end);
diff --git a/Source/WebCore/html/HTMLFormControlElement.h b/Source/WebCore/html/HTMLFormControlElement.h
index 120313d..ede3299 100644
--- a/Source/WebCore/html/HTMLFormControlElement.h
+++ b/Source/WebCore/html/HTMLFormControlElement.h
@@ -194,6 +194,8 @@ public:
 
     virtual ~HTMLTextFormControlElement();
 
+    virtual void insertedIntoDocument();
+
     // The derived class should return true if placeholder processing is needed.
     virtual bool supportsPlaceholder() const = 0;
     String strippedPlaceholder() const;
@@ -207,6 +209,8 @@ public:
     void setSelectionRange(int start, int end);
     PassRefPtr<Range> selection() const;
 
+    virtual void dispatchFormControlChangeEvent();
+
     virtual int maxLength() const = 0;
     virtual String value() const = 0;
 
@@ -216,6 +220,7 @@ protected:
     void updatePlaceholderVisibility(bool);
 
     virtual void parseMappedAttribute(Attribute*);
+    virtual void setTextAsOfLastFormControlChangeEvent(String text) { m_textAsOfLastFormControlChangeEvent = text; }
 
 private:
     virtual void dispatchFocusEvent();
@@ -236,6 +241,8 @@ private:
     virtual void handleBlurEvent() { }
 
     RenderTextControl* textRendererAfterUpdateLayout();
+
+    String m_textAsOfLastFormControlChangeEvent;
 };
 
 } // namespace
diff --git a/Source/WebCore/html/HTMLFormElement.cpp b/Source/WebCore/html/HTMLFormElement.cpp
index 8535027..f051ea1 100644
--- a/Source/WebCore/html/HTMLFormElement.cpp
+++ b/Source/WebCore/html/HTMLFormElement.cpp
@@ -223,7 +223,12 @@ bool HTMLFormElement::validateInteractively(Event* event)
     Vector<RefPtr<FormAssociatedElement> > unhandledInvalidControls;
     if (!checkInvalidControlsAndCollectUnhandled(unhandledInvalidControls))
         return true;
-    // If the form has invalid controls, abort submission.
+    // Because the form has invalid controls, we abort the form submission and
+    // show a validation message on a focusable form control.
+
+    // Needs to update layout now because we'd like to call isFocusable(), which
+    // has !renderer()->needsLayout() assertion.
+    document()->updateLayoutIgnorePendingStylesheets();
 
     RefPtr<HTMLFormElement> protector(this);
     // Focus on the first focusable control and show a validation message.
diff --git a/Source/WebCore/html/HTMLFrameElementBase.cpp b/Source/WebCore/html/HTMLFrameElementBase.cpp
index cf079ea..08b6a64 100644
--- a/Source/WebCore/html/HTMLFrameElementBase.cpp
+++ b/Source/WebCore/html/HTMLFrameElementBase.cpp
@@ -283,4 +283,11 @@ void HTMLFrameElementBase::willRemove()
     HTMLFrameOwnerElement::willRemove();
 }
 
+#if ENABLE(FULLSCREEN_API)
+bool HTMLFrameElementBase::allowFullScreen() const
+{
+    return hasAttribute(webkitallowfullscreenAttr);
+}
+#endif
+
 } // namespace WebCore
diff --git a/Source/WebCore/html/HTMLFrameElementBase.h b/Source/WebCore/html/HTMLFrameElementBase.h
index e5f9c46..9922fd1 100644
--- a/Source/WebCore/html/HTMLFrameElementBase.h
+++ b/Source/WebCore/html/HTMLFrameElementBase.h
@@ -43,6 +43,9 @@ public:
     int height() const;
 
     void setRemainsAliveOnRemovalFromTree(bool);
+#if ENABLE(FULLSCREEN_API)
+    virtual bool allowFullScreen() const;
+#endif
 
 protected:
     HTMLFrameElementBase(const QualifiedName&, Document*);
diff --git a/Source/WebCore/html/HTMLFrameSetElement.cpp b/Source/WebCore/html/HTMLFrameSetElement.cpp
index 50f921b..0affef6 100644
--- a/Source/WebCore/html/HTMLFrameSetElement.cpp
+++ b/Source/WebCore/html/HTMLFrameSetElement.cpp
@@ -49,9 +49,9 @@ HTMLFrameSetElement::HTMLFrameSetElement(const QualifiedName& tagName, Document*
     , m_border(6)
     , m_borderSet(false)
     , m_borderColorSet(false)
-    , frameborder(true)
-    , frameBorderSet(false)
-    , noresize(false)
+    , m_frameborder(true)
+    , m_frameborderSet(false)
+    , m_noresize(false)
 {
     ASSERT(hasTagName(framesetTag));
 }
@@ -87,21 +87,21 @@ void HTMLFrameSetElement::parseMappedAttribute(Attribute* attr)
         if (!attr->isNull()) {
             // false or "no" or "0"..
             if (attr->value().toInt() == 0) {
-                frameborder = false;
+                m_frameborder = false;
                 m_border = 0;
             }
-            frameBorderSet = true;
+            m_frameborderSet = true;
         } else {
-            frameborder = false;
-            frameBorderSet = false;
+            m_frameborder = false;
+            m_frameborderSet = false;
         }
     } else if (attr->name() == noresizeAttr) {
-        noresize = true;
+        m_noresize = true;
     } else if (attr->name() == borderAttr) {
         if (!attr->isNull()) {
             m_border = attr->value().toInt();
             if (!m_border)
-                frameborder = false;
+                m_frameborder = false;
             m_borderSet = true;
         } else
             m_borderSet = false;
@@ -169,16 +169,16 @@ void HTMLFrameSetElement::attach()
     for (ContainerNode* node = parentNode(); node; node = node->parentNode()) {
         if (node->hasTagName(framesetTag)) {
             HTMLFrameSetElement* frameset = static_cast<HTMLFrameSetElement*>(node);
-            if (!frameBorderSet)
-                frameborder = frameset->hasFrameBorder();
-            if (frameborder) {
+            if (!m_frameborderSet)
+                m_frameborder = frameset->hasFrameBorder();
+            if (m_frameborder) {
                 if (!m_borderSet)
                     m_border = frameset->border();
                 if (!m_borderColorSet)
                     m_borderColorSet = frameset->hasBorderColor();
             }
-            if (!noresize)
-                noresize = frameset->noResize();
+            if (!m_noresize)
+                m_noresize = frameset->noResize();
             break;
         }
     }
@@ -188,7 +188,7 @@ void HTMLFrameSetElement::attach()
 
 void HTMLFrameSetElement::defaultEventHandler(Event* evt)
 {
-    if (evt->isMouseEvent() && !noresize && renderer() && renderer()->isFrameSet()) {
+    if (evt->isMouseEvent() && !m_noresize && renderer() && renderer()->isFrameSet()) {
         if (toRenderFrameSet(renderer())->userResize(static_cast<MouseEvent*>(evt))) {
             evt->setDefaultHandled();
             return;
diff --git a/Source/WebCore/html/HTMLFrameSetElement.h b/Source/WebCore/html/HTMLFrameSetElement.h
index bdbec6a..f2f8439 100644
--- a/Source/WebCore/html/HTMLFrameSetElement.h
+++ b/Source/WebCore/html/HTMLFrameSetElement.h
@@ -33,8 +33,8 @@ class HTMLFrameSetElement : public HTMLElement {
 public:
     static PassRefPtr<HTMLFrameSetElement> create(const QualifiedName&, Document*);
 
-    bool hasFrameBorder() const { return frameborder; }
-    bool noResize() const { return noresize; }
+    bool hasFrameBorder() const { return m_frameborder; }
+    bool noResize() const { return m_noresize; }
 
     int totalRows() const { return m_totalRows; }
     int totalCols() const { return m_totalCols; }
@@ -92,9 +92,9 @@ private:
     
     bool m_borderColorSet;
 
-    bool frameborder;
-    bool frameBorderSet;
-    bool noresize;
+    bool m_frameborder;
+    bool m_frameborderSet;
+    bool m_noresize;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/html/HTMLInputElement.cpp b/Source/WebCore/html/HTMLInputElement.cpp
index c5f1ebc..7ae6ad9 100644
--- a/Source/WebCore/html/HTMLInputElement.cpp
+++ b/Source/WebCore/html/HTMLInputElement.cpp
@@ -154,6 +154,17 @@ void HTMLInputElement::updateCheckedRadioButtons()
         renderer()->theme()->stateChanged(renderer(), CheckedState);
 }
 
+bool HTMLInputElement::lastChangeWasUserEdit() const
+{
+    if (!isTextField())
+        return false;
+    
+    if (!renderer())
+        return false;
+
+    return toRenderTextControl(renderer())->lastChangeWasUserEdit();
+}
+
 bool HTMLInputElement::isValidValue(const String& value) const
 {
     if (!m_inputType->canSetStringValue()) {
@@ -751,6 +762,7 @@ void HTMLInputElement::reset()
     if (m_inputType->storesValueSeparateFromAttribute())
         setValue(String());
 
+    setAutofilled(false);
     setChecked(hasAttribute(checkedAttr));
     m_reflectsCheckedAttribute = true;
 }
@@ -790,8 +802,10 @@ void HTMLInputElement::setChecked(bool nowChecked, bool sendChangeEvent)
     // unchecked to match other browsers. DOM is not a useful standard for this
     // because it says only to fire change events at "lose focus" time, which is
     // definitely wrong in practice for these types of elements.
-    if (sendChangeEvent && inDocument() && m_inputType->shouldSendChangeEventAfterCheckedChanged())
+    if (sendChangeEvent && inDocument() && m_inputType->shouldSendChangeEventAfterCheckedChanged()) {
+        setTextAsOfLastFormControlChangeEvent(String());
         dispatchFormControlChangeEvent();
+    }
 }
 
 void HTMLInputElement::setIndeterminate(bool newValue)
@@ -916,6 +930,9 @@ void HTMLInputElement::setValue(const String& value, bool sendChangeEvent)
             dispatchFormControlChangeEvent();
     }
 
+    if (isText() && (!focused() || !sendChangeEvent))
+        setTextAsOfLastFormControlChangeEvent(value);
+
     InputElement::notifyFormStateChanged(this);
 }
 
diff --git a/Source/WebCore/html/HTMLInputElement.h b/Source/WebCore/html/HTMLInputElement.h
index 27d556b..f2c2625 100644
--- a/Source/WebCore/html/HTMLInputElement.h
+++ b/Source/WebCore/html/HTMLInputElement.h
@@ -42,6 +42,8 @@ public:
 
     DEFINE_ATTRIBUTE_EVENT_LISTENER(webkitspeechchange);
 
+    virtual InputElement* toInputElement() { return this; }
+
     bool autoComplete() const;
 
     // For ValidityState
@@ -197,6 +199,8 @@ public:
     void handleBeforeTextInsertedEvent(Event*);
     void updateCheckedRadioButtons();
 
+    bool lastChangeWasUserEdit() const;
+    
 protected:
     HTMLInputElement(const QualifiedName&, Document*, HTMLFormElement*, bool createdByParser);
 
diff --git a/Source/WebCore/html/HTMLLinkElement.cpp b/Source/WebCore/html/HTMLLinkElement.cpp
index 04cfda4..67262d9 100644
--- a/Source/WebCore/html/HTMLLinkElement.cpp
+++ b/Source/WebCore/html/HTMLLinkElement.cpp
@@ -145,6 +145,8 @@ void HTMLLinkElement::parseMappedAttribute(Attribute* attr)
 #if ENABLE(LINK_PREFETCH)
     else if (attr->name() == onloadAttr)
         setAttributeEventListener(eventNames().loadEvent, createAttributeEventListener(this, attr));
+    else if (attr->name() == onerrorAttr)
+        setAttributeEventListener(eventNames().errorEvent, createAttributeEventListener(this, attr));
 #endif
     else {
         if (attr->name() == titleAttr && m_sheet)
@@ -203,6 +205,17 @@ void HTMLLinkElement::tokenizeRelAttribute(const AtomicString& rel, RelAttribute
     }
 }
 
+bool HTMLLinkElement::checkBeforeLoadEvent()
+{
+    RefPtr<Document> originalDocument = document();
+    if (!dispatchBeforeLoadEvent(m_url))
+        return false;
+    // A beforeload handler might have removed us from the document or changed the document.
+    if (!inDocument() || document() != originalDocument)
+        return false;
+    return true;
+}
+
 void HTMLLinkElement::process()
 {
     if (!inDocument() || m_isInShadowTree) {
@@ -214,8 +227,11 @@ void HTMLLinkElement::process()
 
     // IE extension: location of small icon for locationbar / bookmarks
     // We'll record this URL per document, even if we later only use it in top level frames
-    if (m_relAttribute.m_isIcon && m_url.isValid() && !m_url.isEmpty())
+    if (m_relAttribute.m_isIcon && m_url.isValid() && !m_url.isEmpty()) {
+        if (!checkBeforeLoadEvent()) 
+            return;
         document()->setIconURL(m_url.string(), type);
+    }
 
 #ifdef ANDROID_APPLE_TOUCH_ICON
     if ((m_relAttribute.m_isTouchIcon || m_relAttribute.m_isPrecomposedTouchIcon) && m_url.isValid()
@@ -235,6 +251,8 @@ void HTMLLinkElement::process()
 
 #if ENABLE(LINK_PREFETCH)
     if (m_relAttribute.m_isLinkPrefetch && m_url.isValid() && document()->frame()) {
+        if (!checkBeforeLoadEvent())
+            return;
         m_cachedLinkPrefetch = document()->cachedResourceLoader()->requestLinkPrefetch(m_url);
         if (m_cachedLinkPrefetch)
             m_cachedLinkPrefetch->addClient(this);
@@ -256,11 +274,7 @@ void HTMLLinkElement::process()
             m_cachedSheet = 0;
         }
 
-        RefPtr<Document> originalDocument = document();
-        if (!dispatchBeforeLoadEvent(m_url))
-            return;
-        // A beforeload handler might have removed us from the document or changed the document.
-        if (!inDocument() || document() != originalDocument)
+        if (!checkBeforeLoadEvent())
             return;
 
         m_loading = true;
@@ -413,16 +427,19 @@ bool HTMLLinkElement::isLoading() const
 void HTMLLinkElement::onloadTimerFired(Timer<HTMLLinkElement>* timer)
 {
     ASSERT_UNUSED(timer, timer == &m_onloadTimer);
-    dispatchEvent(Event::create(eventNames().loadEvent, false, false));
+    if (m_cachedLinkPrefetch->errorOccurred())
+        dispatchEvent(Event::create(eventNames().errorEvent, false, false));
+    else
+        dispatchEvent(Event::create(eventNames().loadEvent, false, false));
+
+    m_cachedLinkPrefetch->removeClient(this);
+    m_cachedLinkPrefetch = 0;
 }
 
 void HTMLLinkElement::notifyFinished(CachedResource* resource)
 {
     m_onloadTimer.startOneShot(0);
-    if (m_cachedLinkPrefetch.get() == resource) {
-        m_cachedLinkPrefetch->removeClient(this);
-        m_cachedLinkPrefetch = 0;
-    }
+    ASSERT(m_cachedLinkPrefetch.get() == resource);
 }
 #endif
 
diff --git a/Source/WebCore/html/HTMLLinkElement.h b/Source/WebCore/html/HTMLLinkElement.h
index 3798c33..d31feeb 100644
--- a/Source/WebCore/html/HTMLLinkElement.h
+++ b/Source/WebCore/html/HTMLLinkElement.h
@@ -86,6 +86,7 @@ private:
 #if ENABLE(LINK_PREFETCH)
     void onloadTimerFired(Timer<HTMLLinkElement>*);
 #endif
+    bool checkBeforeLoadEvent();
     void process();
     static void processCallback(Node*);
 
diff --git a/Source/WebCore/html/HTMLMediaElement.cpp b/Source/WebCore/html/HTMLMediaElement.cpp
index ad0fdef..29c0cb8 100644
--- a/Source/WebCore/html/HTMLMediaElement.cpp
+++ b/Source/WebCore/html/HTMLMediaElement.cpp
@@ -227,8 +227,8 @@ void HTMLMediaElement::attributeChanged(Attribute* attr, bool preserveDecls)
             detach();
             attach();
         }
-        if (renderer())
-            renderer()->updateFromElement();
+        if (hasMediaControls())
+            mediaControls()->reset();
 #else
         if (m_player)
             m_player->setControls(controls());
@@ -907,6 +907,7 @@ void HTMLMediaElement::setNetworkState(MediaPlayer::NetworkState state)
         if (m_networkState > NETWORK_IDLE) {
             m_progressEventTimer.stop();
             scheduleEvent(eventNames().suspendEvent);
+            setShouldDelayLoadEvent(false);
         }
         m_networkState = NETWORK_IDLE;
     }
@@ -1038,6 +1039,7 @@ void HTMLMediaElement::progressEventTimerFired(Timer<HTMLMediaElement>*)
         if (timedelta > 3.0 && !m_sentStalledEvent) {
             scheduleEvent(eventNames().stalledEvent);
             m_sentStalledEvent = true;
+            setShouldDelayLoadEvent(false);
         }
     } else {
         scheduleEvent(eventNames().progressEvent);
@@ -1311,7 +1313,7 @@ void HTMLMediaElement::setDefaultPlaybackRate(float rate)
 
 float HTMLMediaElement::playbackRate() const
 {
-    return m_player ? m_player->rate() : 0;
+    return m_playbackRate;
 }
 
 void HTMLMediaElement::setPlaybackRate(float rate)
@@ -1421,8 +1423,6 @@ void HTMLMediaElement::playInternal()
         seek(0, unused);
     }
     
-    setPlaybackRate(defaultPlaybackRate());
-    
     if (m_paused) {
         m_paused = false;
         invalidateCachedTime();
@@ -1536,8 +1536,8 @@ void HTMLMediaElement::setMuted(bool muted)
         if (!processingMediaPlayerCallback()) {
             if (m_player) {
                 m_player->setMuted(m_muted);
-                if (renderer())
-                    renderer()->updateFromElement();
+                if (hasMediaControls())
+                    mediaControls()->changedMute();
             }
         }
         scheduleEvent(eventNames().volumechangeEvent);
@@ -1550,9 +1550,10 @@ void HTMLMediaElement::togglePlayState()
 
     // We can safely call the internal play/pause methods, which don't check restrictions, because
     // this method is only called from the built-in media controller
-    if (canPlay())
+    if (canPlay()) {
+        setPlaybackRate(defaultPlaybackRate());
         playInternal();
-    else 
+    } else 
         pauseInternal();
 }
 
@@ -1604,7 +1605,9 @@ void HTMLMediaElement::playbackProgressTimerFired(Timer<HTMLMediaElement>*)
         return;
 
     scheduleTimeupdateEvent(true);
-    
+    if (hasMediaControls())
+        mediaControls()->playbackProgressed();
+
     // FIXME: deal with cue ranges here
 }
 
@@ -1929,7 +1932,7 @@ void HTMLMediaElement::mediaPlayerPlaybackStateChanged(MediaPlayer*)
 {
     LOG(Media, "HTMLMediaElement::mediaPlayerPlaybackStateChanged");
 
-    if (!m_player)
+    if (!m_player || m_pausedInternal)
         return;
 
     beginProcessingMediaPlayerCallback();
@@ -2111,9 +2114,9 @@ void HTMLMediaElement::updateVolume()
         m_player->setMuted(m_muted);
         m_player->setVolume(m_volume * volumeMultiplier);
     }
-    
-    if (renderer())
-        renderer()->updateFromElement();
+
+    if (hasMediaControls())
+        mediaControls()->changedVolume();
 }
 
 void HTMLMediaElement::updatePlayState()
@@ -2126,6 +2129,8 @@ void HTMLMediaElement::updatePlayState()
             m_player->pause();
         refreshCachedTime();
         m_playbackProgressTimer.stop();
+        if (hasMediaControls())
+            mediaControls()->playbackStopped();
         return;
     }
     
@@ -2149,6 +2154,8 @@ void HTMLMediaElement::updatePlayState()
             m_player->play();
         }
 
+        if (hasMediaControls())
+            mediaControls()->playbackStarted();
         startPlaybackProgressTimer();
         m_playing = true;
 
@@ -2165,6 +2172,9 @@ void HTMLMediaElement::updatePlayState()
 
         if (couldPlayIfEnoughData())
             m_player->prepareToPlay();
+
+        if (hasMediaControls())
+            mediaControls()->playbackStopped();
     }
     
     if (renderer())
@@ -2313,8 +2323,8 @@ void HTMLMediaElement::defaultEventHandler(Event* event)
     if (widget)
         widget->handleEvent(event);
 #else
-    if (renderer() && renderer()->isMedia())
-        toRenderMedia(renderer())->controls()->forwardEvent(event);
+    if (hasMediaControls())
+        mediaControls()->forwardEvent(event);
     if (event->defaultHandled())
         return;
     HTMLElement::defaultEventHandler(event);
@@ -2433,6 +2443,19 @@ void HTMLMediaElement::updateWidget(PluginCreationOption)
 
 #endif // ENABLE(PLUGIN_PROXY_FOR_VIDEO)
 
+bool HTMLMediaElement::isFullscreen() const
+{
+    if (m_isFullscreen)
+        return true;
+    
+#if ENABLE(FULLSCREEN_API)
+    if (document()->webkitIsFullScreen() && document()->webkitCurrentFullScreenElement() == this)
+        return true;
+#endif
+    
+    return false;
+}
+
 void HTMLMediaElement::enterFullscreen()
 {
     LOG(Media, "HTMLMediaElement::enterFullscreen");
@@ -2490,8 +2513,8 @@ void HTMLMediaElement::setClosedCaptionsVisible(bool closedCaptionVisible)
 
     m_closedCaptionsVisible = closedCaptionVisible;
     m_player->setClosedCaptionsVisible(closedCaptionVisible);
-    if (renderer())
-        renderer()->updateFromElement();
+    if (hasMediaControls())
+        mediaControls()->changedClosedCaptionsVisibility();
 }
 
 void HTMLMediaElement::setWebkitClosedCaptionsVisible(bool visible)
@@ -2581,6 +2604,17 @@ void HTMLMediaElement::privateBrowsingStateDidChange()
     m_player->setPrivateBrowsingMode(privateMode);
 }
 
+MediaControls* HTMLMediaElement::mediaControls()
+{
+    ASSERT(renderer());
+    return toRenderMedia(renderer())->controls();
+}
+
+bool HTMLMediaElement::hasMediaControls() const
+{
+    return renderer() && renderer()->isMedia();
+}
+
 }
 
 #endif
diff --git a/Source/WebCore/html/HTMLMediaElement.h b/Source/WebCore/html/HTMLMediaElement.h
index f870586..ea958fa 100644
--- a/Source/WebCore/html/HTMLMediaElement.h
+++ b/Source/WebCore/html/HTMLMediaElement.h
@@ -41,6 +41,7 @@ namespace WebCore {
 
 class Event;
 class HTMLSourceElement;
+class MediaControls;
 class MediaError;
 class KURL;
 class TimeRanges;
@@ -163,7 +164,7 @@ public:
 
     bool hasSingleSecurityOrigin() const { return !m_player || m_player->hasSingleSecurityOrigin(); }
     
-    bool isFullscreen() const { return m_isFullscreen; }
+    bool isFullscreen() const;
     void enterFullscreen();
     void exitFullscreen();
 
@@ -171,6 +172,8 @@ public:
     bool closedCaptionsVisible() const;
     void setClosedCaptionsVisible(bool);
 
+    MediaControls* mediaControls();
+
     bool processingUserGesture() const;
 
     void sourceWillBeRemoved(HTMLSourceElement*);
@@ -179,13 +182,14 @@ public:
     void privateBrowsingStateDidChange();
 
     // Restrictions to change default behaviors.
-    enum BehaviorRestrictions {
+    enum BehaviorRestrictionFlags {
         NoRestrictions = 0,
         RequireUserGestureForLoadRestriction = 1 << 0,
         RequireUserGestureForRateChangeRestriction = 1 << 1,
         RequireUserGestureForFullScreenRestriction = 1 << 2
     };
-
+    typedef unsigned BehaviorRestrictions;
+    
     bool requireUserGestureForLoad() const { return m_restrictions & RequireUserGestureForLoadRestriction; }
     bool requireUserGestureForRateChange() const { return m_restrictions & RequireUserGestureForRateChangeRestriction; }
     bool requireUserGestureForFullScreen() const { return m_restrictions & RequireUserGestureForFullScreenRestriction; }
@@ -319,6 +323,8 @@ private:
     void invalidateCachedTime();
     void refreshCachedTime() const;
 
+    bool hasMediaControls() const;
+
     Timer<HTMLMediaElement> m_loadTimer;
     Timer<HTMLMediaElement> m_asyncEventTimer;
     Timer<HTMLMediaElement> m_progressEventTimer;
diff --git a/Source/WebCore/html/HTMLObjectElement.cpp b/Source/WebCore/html/HTMLObjectElement.cpp
index 0f05a3a..4f4d0a1 100644
--- a/Source/WebCore/html/HTMLObjectElement.cpp
+++ b/Source/WebCore/html/HTMLObjectElement.cpp
@@ -2,7 +2,7 @@
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2000 Stefan Schimanski (1Stein@gmx.de)
- * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2011 Apple Inc. All rights reserved.
  * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
  *
  * This library is free software; you can redistribute it and/or
@@ -48,7 +48,7 @@ namespace WebCore {
 using namespace HTMLNames;
 
 inline HTMLObjectElement::HTMLObjectElement(const QualifiedName& tagName, Document* document, HTMLFormElement* form, bool createdByParser) 
-    : HTMLPlugInImageElement(tagName, document, createdByParser)
+    : HTMLPlugInImageElement(tagName, document, createdByParser, ShouldNotPreferPlugInsForImages)
     , FormAssociatedElement(form)
     , m_docNamedItem(true)
     , m_useFallbackContent(false)
@@ -217,7 +217,7 @@ void HTMLObjectElement::parametersForPlugin(Vector<String>& paramNames, Vector<S
     // if we know that resource points to a plug-in.
     if (url.isEmpty() && !urlParameter.isEmpty()) {
         SubframeLoader* loader = document()->frame()->loader()->subframeLoader();
-        if (loader->resourceWillUsePlugin(urlParameter, serviceType))
+        if (loader->resourceWillUsePlugin(urlParameter, serviceType, shouldPreferPlugInsForImages()))
             url = urlParameter;
     }
 }
@@ -311,13 +311,16 @@ bool HTMLObjectElement::rendererIsNeeded(RenderStyle* style)
 
 void HTMLObjectElement::insertedIntoDocument()
 {
+    HTMLPlugInImageElement::insertedIntoDocument();
+    if (!inDocument())
+        return;
+
     if (isDocNamedItem() && document()->isHTMLDocument()) {
         HTMLDocument* document = static_cast<HTMLDocument*>(this->document());
         document->addNamedItem(m_name);
         document->addExtraNamedItem(m_id);
     }
 
-    HTMLPlugInImageElement::insertedIntoDocument();
     FormAssociatedElement::insertedIntoDocument();
 }
 
diff --git a/Source/WebCore/html/HTMLPlugInElement.cpp b/Source/WebCore/html/HTMLPlugInElement.cpp
index bf2722b..9d724d5 100644
--- a/Source/WebCore/html/HTMLPlugInElement.cpp
+++ b/Source/WebCore/html/HTMLPlugInElement.cpp
@@ -166,7 +166,7 @@ void HTMLPlugInElement::defaultEventHandler(Event* event)
 
     if (!r || !r->isWidget())
         return;
-    Widget* widget = toRenderWidget(r)->widget();
+    RefPtr<Widget> widget = toRenderWidget(r)->widget();
     if (!widget)
         return;
     widget->handleEvent(event);
diff --git a/Source/WebCore/html/HTMLPlugInImageElement.cpp b/Source/WebCore/html/HTMLPlugInImageElement.cpp
index db07334..f3a99dd 100644
--- a/Source/WebCore/html/HTMLPlugInImageElement.cpp
+++ b/Source/WebCore/html/HTMLPlugInImageElement.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2008, 2011 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -25,6 +25,7 @@
 #include "FrameLoader.h"
 #include "FrameLoaderClient.h"
 #include "HTMLImageLoader.h"
+#include "HTMLNames.h"
 #include "Image.h"
 #include "Page.h"
 #include "RenderEmbeddedObject.h"
@@ -32,13 +33,14 @@
 
 namespace WebCore {
 
-HTMLPlugInImageElement::HTMLPlugInImageElement(const QualifiedName& tagName, Document* document, bool createdByParser)
+HTMLPlugInImageElement::HTMLPlugInImageElement(const QualifiedName& tagName, Document* document, bool createdByParser, PreferPlugInsForImagesOption preferPlugInsForImagesOption)
     : HTMLPlugInElement(tagName, document)
     // m_needsWidgetUpdate(!createdByParser) allows HTMLObjectElement to delay
     // widget updates until after all children are parsed.  For HTMLEmbedElement
     // this delay is unnecessary, but it is simpler to make both classes share
     // the same codepath in this class.
     , m_needsWidgetUpdate(!createdByParser)
+    , m_shouldPreferPlugInsForImages(preferPlugInsForImagesOption == ShouldPreferPlugInsForImages)
 {
 }
 
@@ -58,7 +60,7 @@ bool HTMLPlugInImageElement::isImageType()
 
     if (Frame* frame = document()->frame()) {
         KURL completedURL = frame->loader()->completeURL(m_url);
-        return frame->loader()->client()->objectContentType(completedURL, m_serviceType) == ObjectContentImage;
+        return frame->loader()->client()->objectContentType(completedURL, m_serviceType, shouldPreferPlugInsForImages()) == ObjectContentImage;
     }
 
     return Image::supportsType(m_serviceType);
@@ -99,7 +101,7 @@ bool HTMLPlugInImageElement::wouldLoadAsNetscapePlugin(const String& url, const
     if (!url.isEmpty())
         completedURL = frameLoader->completeURL(url);
 
-    if (frameLoader->client()->objectContentType(completedURL, serviceType) == ObjectContentNetscapePlugin)
+    if (frameLoader->client()->objectContentType(completedURL, serviceType, shouldPreferPlugInsForImages()) == ObjectContentNetscapePlugin)
         return true;
     return false;
 }
diff --git a/Source/WebCore/html/HTMLPlugInImageElement.h b/Source/WebCore/html/HTMLPlugInImageElement.h
index 364262b..c27c0f8 100644
--- a/Source/WebCore/html/HTMLPlugInImageElement.h
+++ b/Source/WebCore/html/HTMLPlugInImageElement.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2008, 2009, 2011 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -33,6 +33,11 @@ enum PluginCreationOption {
     CreateAnyWidgetType,
     CreateOnlyNonNetscapePlugins,
 };
+    
+enum PreferPlugInsForImagesOption {
+    ShouldPreferPlugInsForImages,
+    ShouldNotPreferPlugInsForImages
+};
 
 // Base class for HTMLObjectElement and HTMLEmbedElement
 class HTMLPlugInImageElement : public HTMLPlugInElement {
@@ -43,9 +48,10 @@ public:
 
     const String& serviceType() const { return m_serviceType; }
     const String& url() const { return m_url; }
+    bool shouldPreferPlugInsForImages() const { return m_shouldPreferPlugInsForImages; }
 
 protected:
-    HTMLPlugInImageElement(const QualifiedName& tagName, Document*, bool createdByParser);
+    HTMLPlugInImageElement(const QualifiedName& tagName, Document*, bool createdByParser, PreferPlugInsForImagesOption);
 
     bool isImageType();
 
@@ -75,6 +81,7 @@ private:
     virtual bool useFallbackContent() const { return false; }
     
     bool m_needsWidgetUpdate;
+    bool m_shouldPreferPlugInsForImages;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/html/HTMLScriptElement.cpp b/Source/WebCore/html/HTMLScriptElement.cpp
index 8e708d1..b56b375 100644
--- a/Source/WebCore/html/HTMLScriptElement.cpp
+++ b/Source/WebCore/html/HTMLScriptElement.cpp
@@ -58,6 +58,13 @@ void HTMLScriptElement::childrenChanged(bool changedByParser, Node* beforeChange
     HTMLElement::childrenChanged(changedByParser, beforeChange, afterChange, childCountDelta);
 }
 
+void HTMLScriptElement::attributeChanged(Attribute* attr, bool preserveDecls)
+{
+    if (attr->name() == asyncAttr)
+        handleAsyncAttribute();
+    HTMLElement::attributeChanged(attr, preserveDecls);
+}
+
 void HTMLScriptElement::parseMappedAttribute(Attribute* attr)
 {
     const QualifiedName& attrName = attr->name();
@@ -102,6 +109,17 @@ void HTMLScriptElement::setText(const String &value)
     appendChild(document()->createTextNode(value.impl()), ec);
 }
 
+void HTMLScriptElement::setAsync(bool async)
+{
+    setBooleanAttribute(asyncAttr, async);
+    handleAsyncAttribute();
+}
+
+bool HTMLScriptElement::async() const
+{
+    return fastHasAttribute(asyncAttr) || forceAsync();
+}
+
 KURL HTMLScriptElement::src() const
 {
     return document()->completeURL(sourceAttributeValue());
diff --git a/Source/WebCore/html/HTMLScriptElement.h b/Source/WebCore/html/HTMLScriptElement.h
index efe6a6a..cbe7258 100644
--- a/Source/WebCore/html/HTMLScriptElement.h
+++ b/Source/WebCore/html/HTMLScriptElement.h
@@ -38,6 +38,9 @@ public:
 
     KURL src() const;
 
+    void setAsync(bool);
+    bool async() const;
+
 private:
     HTMLScriptElement(const QualifiedName&, Document*, bool wasInsertedByParser, bool alreadyStarted);
 
@@ -45,6 +48,7 @@ private:
     virtual void insertedIntoDocument();
     virtual void removedFromDocument();
     virtual void childrenChanged(bool changedByParser = false, Node* beforeChange = 0, Node* afterChange = 0, int childCountDelta = 0);
+    virtual void attributeChanged(Attribute*, bool preserveDecls = false);
 
     virtual bool isURLAttribute(Attribute*) const;
 
diff --git a/Source/WebCore/html/HTMLScriptElement.idl b/Source/WebCore/html/HTMLScriptElement.idl
index 20b7331..fa799cb 100644
--- a/Source/WebCore/html/HTMLScriptElement.idl
+++ b/Source/WebCore/html/HTMLScriptElement.idl
@@ -24,7 +24,7 @@ module html {
         attribute [Reflect=for] DOMString htmlFor;
         attribute [Reflect] DOMString event;
         attribute [Reflect] DOMString charset;
-        attribute [Reflect] boolean async;
+        attribute boolean async;
         attribute [Reflect] boolean defer;
         attribute [Reflect, URL] DOMString src;
         attribute [Reflect] DOMString type;
diff --git a/Source/WebCore/html/HTMLSelectElement.cpp b/Source/WebCore/html/HTMLSelectElement.cpp
index d23e56a..69d3ffe 100644
--- a/Source/WebCore/html/HTMLSelectElement.cpp
+++ b/Source/WebCore/html/HTMLSelectElement.cpp
@@ -434,7 +434,12 @@ void HTMLSelectElement::accessKeySetSelectedIndex(int index)
     
 void HTMLSelectElement::setMultiple(bool multiple)
 {
+    int oldSelectedIndex = selectedIndex();
     setAttribute(multipleAttr, multiple ? "" : 0);
+
+    // Restore selectedIndex after changing the multiple flag to preserve
+    // selection as single-line and multi-line has different defaults.
+    setSelectedIndex(oldSelectedIndex);
 }
 
 void HTMLSelectElement::setSize(int size)
diff --git a/Source/WebCore/html/HTMLSummaryElement.cpp b/Source/WebCore/html/HTMLSummaryElement.cpp
index 96e3d74..9c2222a 100644
--- a/Source/WebCore/html/HTMLSummaryElement.cpp
+++ b/Source/WebCore/html/HTMLSummaryElement.cpp
@@ -21,7 +21,9 @@
 #include "config.h"
 #include "HTMLSummaryElement.h"
 
+#include "HTMLDetailsElement.h"
 #include "HTMLNames.h"
+#include "RenderSummary.h"
 
 namespace WebCore {
 
@@ -38,4 +40,9 @@ HTMLSummaryElement::HTMLSummaryElement(const QualifiedName& tagName, Document* d
     ASSERT(hasTagName(summaryTag));
 }
 
+RenderObject* HTMLSummaryElement::createRenderer(RenderArena* arena, RenderStyle*)
+{
+    return new (arena) RenderSummary(this);
+}
+
 }
diff --git a/Source/WebCore/html/HTMLSummaryElement.h b/Source/WebCore/html/HTMLSummaryElement.h
index 1b24c67..1a93ee9 100644
--- a/Source/WebCore/html/HTMLSummaryElement.h
+++ b/Source/WebCore/html/HTMLSummaryElement.h
@@ -31,6 +31,8 @@ public:
 
 private:
     HTMLSummaryElement(const QualifiedName&, Document*);
+
+    virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
 };
 
 }
diff --git a/Source/WebCore/html/HTMLTextAreaElement.cpp b/Source/WebCore/html/HTMLTextAreaElement.cpp
index b8b04de..c8ec9ab 100644
--- a/Source/WebCore/html/HTMLTextAreaElement.cpp
+++ b/Source/WebCore/html/HTMLTextAreaElement.cpp
@@ -295,6 +295,7 @@ void HTMLTextAreaElement::setValue(const String& value)
     setValueCommon(value);
     m_isDirty = true;
     setNeedsValidityCheck();
+    setTextAsOfLastFormControlChangeEvent(value);
 }
 
 void HTMLTextAreaElement::setNonDirtyValue(const String& value)
@@ -302,6 +303,7 @@ void HTMLTextAreaElement::setNonDirtyValue(const String& value)
     setValueCommon(value);
     m_isDirty = false;
     setNeedsValidityCheck();
+    setTextAsOfLastFormControlChangeEvent(value);
 }
 
 void HTMLTextAreaElement::setValueCommon(const String& value)
@@ -429,6 +431,13 @@ void HTMLTextAreaElement::setRows(int rows)
     setAttribute(rowsAttr, String::number(rows));
 }
 
+bool HTMLTextAreaElement::lastChangeWasUserEdit() const
+{
+    if (!renderer())
+        return false;
+    return toRenderTextControl(renderer())->lastChangeWasUserEdit();
+}
+
 bool HTMLTextAreaElement::shouldUseInputMethod() const
 {
     return true;
diff --git a/Source/WebCore/html/HTMLTextAreaElement.h b/Source/WebCore/html/HTMLTextAreaElement.h
index 21b5880..40193a0 100644
--- a/Source/WebCore/html/HTMLTextAreaElement.h
+++ b/Source/WebCore/html/HTMLTextAreaElement.h
@@ -55,7 +55,9 @@ public:
     
     void setCols(int);
     void setRows(int);
-    
+
+    bool lastChangeWasUserEdit() const;
+
     void cacheSelection(int s, int e) { m_cachedSelectionStart = s; m_cachedSelectionEnd = e; };
 
 private:
diff --git a/Source/WebCore/html/HTMLTitleElement.cpp b/Source/WebCore/html/HTMLTitleElement.cpp
index 776c37c..78c8b6a 100644
--- a/Source/WebCore/html/HTMLTitleElement.cpp
+++ b/Source/WebCore/html/HTMLTitleElement.cpp
@@ -46,7 +46,7 @@ PassRefPtr<HTMLTitleElement> HTMLTitleElement::create(const QualifiedName& tagNa
 void HTMLTitleElement::insertedIntoDocument()
 {
     HTMLElement::insertedIntoDocument();
-    document()->setTitle(m_title, this);
+    document()->setTitleElement(m_title, this);
 }
 
 void HTMLTitleElement::removedFromDocument()
@@ -57,12 +57,9 @@ void HTMLTitleElement::removedFromDocument()
 
 void HTMLTitleElement::childrenChanged(bool changedByParser, Node* beforeChange, Node* afterChange, int childCountDelta)
 {
-    m_title = "";
-    for (Node* c = firstChild(); c != 0; c = c->nextSibling())
-        if (c->nodeType() == TEXT_NODE || c->nodeType() == CDATA_SECTION_NODE)
-            m_title += c->nodeValue();
+    m_title = text();
     if (inDocument())
-        document()->setTitle(m_title, this);
+        document()->setTitleElement(m_title, this);
     HTMLElement::childrenChanged(changedByParser, beforeChange, afterChange, childCountDelta);
 }
 
diff --git a/Source/WebCore/html/NumberInputType.cpp b/Source/WebCore/html/NumberInputType.cpp
index 3397248..af30345 100644
--- a/Source/WebCore/html/NumberInputType.cpp
+++ b/Source/WebCore/html/NumberInputType.cpp
@@ -223,8 +223,9 @@ String NumberInputType::visibleValue() const
     if (currentValue.isEmpty())
         return currentValue;
     double doubleValue = numeric_limits<double>::quiet_NaN();
-    parseToDoubleForNumberType(currentValue, &doubleValue);
-    String localized = formatLocalizedNumber(doubleValue);
+    unsigned decimalPlace;
+    parseToDoubleForNumberTypeWithDecimalPlaces(currentValue, &doubleValue, &decimalPlace);
+    String localized = formatLocalizedNumber(doubleValue, decimalPlace);
     return localized.isEmpty() ? currentValue : localized;
 }
 
diff --git a/Source/WebCore/html/RangeInputType.cpp b/Source/WebCore/html/RangeInputType.cpp
index be7e0c6..cbec740 100644
--- a/Source/WebCore/html/RangeInputType.cpp
+++ b/Source/WebCore/html/RangeInputType.cpp
@@ -261,7 +261,7 @@ void RangeInputType::minOrMaxAttributeChanged()
 
 void RangeInputType::valueChanged()
 {
-    element()->shadowRoot()->setNeedsStyleRecalc();
+    toSliderThumbElement(element()->shadowRoot())->setPositionFromValue();
 }
 
 String RangeInputType::fallbackValue()
diff --git a/Source/WebCore/html/ValidationMessage.cpp b/Source/WebCore/html/ValidationMessage.cpp
index 70aa02d..59a1467 100644
--- a/Source/WebCore/html/ValidationMessage.cpp
+++ b/Source/WebCore/html/ValidationMessage.cpp
@@ -31,11 +31,15 @@
 #include "config.h"
 #include "ValidationMessage.h"
 
+#include "CSSPropertyNames.h"
 #include "CSSStyleSelector.h"
+#include "CSSValueKeywords.h"
 #include "FormAssociatedElement.h"
 #include "HTMLBRElement.h"
 #include "HTMLNames.h"
+#include "Page.h"
 #include "RenderObject.h"
+#include "Settings.h"
 #include "Text.h"
 #include <wtf/PassOwnPtr.h>
 
@@ -90,8 +94,13 @@ void ValidationMessage::setMessageDOMAndStartTimer(Timer<ValidationMessage>*)
         }
     }
 
-    m_timer.set(new Timer<ValidationMessage>(this, &ValidationMessage::deleteBubbleTree));
-    m_timer->startOneShot(max(5.0, m_message.length() / 20.0));
+    int magnification = doc->page() ? doc->page()->settings()->validationMessageTimerMaginification() : -1;
+    if (magnification <= 0)
+        m_timer.clear();
+    else {
+        m_timer.set(new Timer<ValidationMessage>(this, &ValidationMessage::deleteBubbleTree));
+        m_timer->startOneShot(max(5.0, static_cast<double>(m_message.length()) * magnification / 1000));
+    }
 }
 
 class ElementWithPseudoId : public HTMLElement {
@@ -116,6 +125,9 @@ void ValidationMessage::buildBubbleTree(Timer<ValidationMessage>*)
     HTMLElement* host = toHTMLElement(m_element);
     Document* doc = host->document();
     m_bubble = ElementWithPseudoId::create(doc, "-webkit-validation-bubble");
+    // Need to force position:absolute because RenderMenuList doesn't assume it
+    // contains non-absolute or non-fixed renderers as children.
+    m_bubble->getInlineStyleDecl()->setProperty(CSSPropertyPosition, CSSValueAbsolute);
     ExceptionCode ec = 0;
     // FIXME: We need a way to host multiple shadow roots in a single node, or
     // to inherit an existing shadow tree.
@@ -124,8 +136,9 @@ void ValidationMessage::buildBubbleTree(Timer<ValidationMessage>*)
     else
         host->setShadowRoot(m_bubble);
 
-    m_bubble->appendChild(ElementWithPseudoId::create(doc, "-webkit-validation-bubble-top-outer-arrow"), ec);
-    m_bubble->appendChild(ElementWithPseudoId::create(doc, "-webkit-validation-bubble-top-inner-arrow"), ec);
+    RefPtr<HTMLElement> clipper = ElementWithPseudoId::create(doc, "-webkit-validation-bubble-arrow-clipper");
+    clipper->appendChild(ElementWithPseudoId::create(doc, "-webkit-validation-bubble-arrow"), ec);
+    m_bubble->appendChild(clipper.release(), ec);
     m_bubbleMessage = ElementWithPseudoId::create(doc, "-webkit-validation-bubble-message");
     m_bubble->appendChild(m_bubbleMessage, ec);
 
diff --git a/Source/WebCore/html/canvas/CanvasRenderingContext2D.cpp b/Source/WebCore/html/canvas/CanvasRenderingContext2D.cpp
index a549782..f5ff078 100644
--- a/Source/WebCore/html/canvas/CanvasRenderingContext2D.cpp
+++ b/Source/WebCore/html/canvas/CanvasRenderingContext2D.cpp
@@ -146,7 +146,7 @@ CanvasRenderingContext2D::~CanvasRenderingContext2D()
 bool CanvasRenderingContext2D::isAccelerated() const
 {
 #if USE(IOSURFACE_CANVAS_BACKING_STORE)
-    return true;
+    return canvas()->document()->page()->settings()->canvasUsesAcceleratedDrawing();
 #elif ENABLE(ACCELERATED_2D_CANVAS)
     return m_context3D;
 #else
diff --git a/Source/WebCore/html/canvas/WebGLContextAttributes.cpp b/Source/WebCore/html/canvas/WebGLContextAttributes.cpp
index 6a47ea9..e36e04e 100644
--- a/Source/WebCore/html/canvas/WebGLContextAttributes.cpp
+++ b/Source/WebCore/html/canvas/WebGLContextAttributes.cpp
@@ -107,6 +107,16 @@ void WebGLContextAttributes::setPremultipliedAlpha(bool premultipliedAlpha)
     m_attrs.premultipliedAlpha = premultipliedAlpha;
 }
 
+bool WebGLContextAttributes::preserveDrawingBuffer() const
+{
+    return m_attrs.preserveDrawingBuffer;
+}
+
+void WebGLContextAttributes::setPreserveDrawingBuffer(bool preserveDrawingBuffer)
+{
+    m_attrs.preserveDrawingBuffer = preserveDrawingBuffer;
+}
+
 GraphicsContext3D::Attributes WebGLContextAttributes::attributes() const
 {
     return m_attrs;
diff --git a/Source/WebCore/html/canvas/WebGLContextAttributes.h b/Source/WebCore/html/canvas/WebGLContextAttributes.h
index a108605..5391a2b 100644
--- a/Source/WebCore/html/canvas/WebGLContextAttributes.h
+++ b/Source/WebCore/html/canvas/WebGLContextAttributes.h
@@ -65,6 +65,11 @@ class WebGLContextAttributes : public CanvasContextAttributes {
     bool premultipliedAlpha() const;
     void setPremultipliedAlpha(bool premultipliedAlpha);
 
+    // Whether or not to preserve the drawing buffer after presentation to the
+    // screen; default=false
+    bool preserveDrawingBuffer() const;
+    void setPreserveDrawingBuffer(bool);
+
     // Fetches a copy of the attributes stored in this object in a
     // form that can be used to initialize a GraphicsContext3D.
     GraphicsContext3D::Attributes attributes() const;
diff --git a/Source/WebCore/html/canvas/WebGLContextAttributes.idl b/Source/WebCore/html/canvas/WebGLContextAttributes.idl
index 0fa0c2c..56da1c6 100644
--- a/Source/WebCore/html/canvas/WebGLContextAttributes.idl
+++ b/Source/WebCore/html/canvas/WebGLContextAttributes.idl
@@ -34,5 +34,6 @@ module html {
         attribute boolean stencil;
         attribute boolean antialias;
         attribute boolean premultipliedAlpha;
+        attribute boolean preserveDrawingBuffer;
     };
 }
diff --git a/Source/WebCore/html/canvas/WebGLRenderingContext.cpp b/Source/WebCore/html/canvas/WebGLRenderingContext.cpp
index cc7a23b..aa40a64 100644
--- a/Source/WebCore/html/canvas/WebGLRenderingContext.cpp
+++ b/Source/WebCore/html/canvas/WebGLRenderingContext.cpp
@@ -412,6 +412,13 @@ void WebGLRenderingContext::initializeNewContext()
     m_stencilFuncRefBack = 0;
     m_stencilFuncMask = 0xFFFFFFFF;
     m_stencilFuncMaskBack = 0xFFFFFFFF;
+    m_layerCleared = false;
+    
+    m_clearColor[0] = m_clearColor[1] = m_clearColor[2] = m_clearColor[3] = 0;
+    m_scissorEnabled = false;
+    m_clearDepth = 1;
+    m_clearStencil = 0;
+    m_colorMask[0] = m_colorMask[1] = m_colorMask[2] = m_colorMask[3] = true;
 
     GC3Dint numCombinedTextureImageUnits = 0;
     m_context->getIntegerv(GraphicsContext3D::MAX_COMBINED_TEXTURE_IMAGE_UNITS, &numCombinedTextureImageUnits);
@@ -472,6 +479,10 @@ WebGLRenderingContext::~WebGLRenderingContext()
 
 void WebGLRenderingContext::markContextChanged()
 {
+    if (m_framebufferBinding)
+        return;
+    m_context->markContextChanged();
+    m_layerCleared = false;
 #if USE(ACCELERATED_COMPOSITING)
     RenderBox* renderBox = canvas()->renderBox();
     if (renderBox && renderBox->hasLayer() && renderBox->layer()->hasAcceleratedCompositing())
@@ -486,15 +497,81 @@ void WebGLRenderingContext::markContextChanged()
     m_markedCanvasDirty = true;
 }
 
+bool WebGLRenderingContext::clearIfComposited(GC3Dbitfield mask)
+{
+    if (isContextLost()) 
+        return false;
+
+    RefPtr<WebGLContextAttributes> contextAttributes = getContextAttributes();
+
+    if (!m_context->layerComposited() || m_layerCleared
+        || m_attributes.preserveDrawingBuffer || m_framebufferBinding)
+        return false;
+
+    // Determine if it's possible to combine the clear the user asked for and this clear.
+    bool combinedClear = mask && !m_scissorEnabled;
+
+    m_context->disable(GraphicsContext3D::SCISSOR_TEST);
+    if (combinedClear && (mask & GraphicsContext3D::COLOR_BUFFER_BIT))
+        m_context->clearColor(m_colorMask[0] ? m_clearColor[0] : 0,
+                              m_colorMask[1] ? m_clearColor[1] : 0,
+                              m_colorMask[2] ? m_clearColor[2] : 0,
+                              m_colorMask[3] ? m_clearColor[3] : 0);
+    else
+        m_context->clearColor(0, 0, 0, 0);
+    m_context->colorMask(true, true, true, true);
+    if (contextAttributes->depth() && (!combinedClear || !(mask & GraphicsContext3D::DEPTH_BUFFER_BIT)))
+        m_context->clearDepth(1.0f);
+    if (contextAttributes->stencil() && (!combinedClear || !(mask & GraphicsContext3D::STENCIL_BUFFER_BIT)))
+        m_context->clearStencil(0);
+    GC3Dbitfield clearMask = GraphicsContext3D::COLOR_BUFFER_BIT;
+    if (contextAttributes->depth())
+        clearMask |= GraphicsContext3D::DEPTH_BUFFER_BIT;
+    if (contextAttributes->stencil())
+        clearMask |= GraphicsContext3D::STENCIL_BUFFER_BIT;
+    m_context->clear(clearMask);
+
+    // Restore the state that the context set.
+    if (m_scissorEnabled)
+        m_context->enable(GraphicsContext3D::SCISSOR_TEST);
+    m_context->clearColor(m_clearColor[0], m_clearColor[1],
+                          m_clearColor[2], m_clearColor[3]);
+    m_context->colorMask(m_colorMask[0], m_colorMask[1],
+                         m_colorMask[2], m_colorMask[3]);
+    m_context->clearDepth(m_clearDepth);
+    m_context->clearStencil(m_clearStencil);
+    m_layerCleared = true;
+
+    return combinedClear;
+}
+
+void WebGLRenderingContext::markLayerComposited()
+{
+    m_context->markLayerComposited();
+}
+
 void WebGLRenderingContext::paintRenderingResultsToCanvas()
 {
-    if (!m_markedCanvasDirty)
+    // Until the canvas is written to by the application, the clear that
+    // happened after it was composited should be ignored by the compositor.
+    if (m_context->layerComposited() && !m_attributes.preserveDrawingBuffer)
+        canvas()->makePresentationCopy();
+    else
+        canvas()->clearPresentationCopy();
+    clearIfComposited();
+    if (!m_markedCanvasDirty && !m_layerCleared)
         return;
     canvas()->clearCopiedImage();
     m_markedCanvasDirty = false;
     m_context->paintRenderingResultsToCanvas(this);
 }
 
+PassRefPtr<ImageData> WebGLRenderingContext::paintRenderingResultsToImageData()
+{
+    clearIfComposited();
+    return m_context->paintRenderingResultsToImageData();
+}
+
 bool WebGLRenderingContext::paintsIntoCanvasBuffer() const
 {
     return m_context->paintsIntoCanvasBuffer();
@@ -885,7 +962,8 @@ void WebGLRenderingContext::clear(GC3Dbitfield mask)
         m_context->synthesizeGLError(GraphicsContext3D::INVALID_FRAMEBUFFER_OPERATION);
         return;
     }
-    m_context->clear(mask);
+    if (!clearIfComposited(mask))
+        m_context->clear(mask);
     cleanupAfterGraphicsCall(true);
 }
 
@@ -901,6 +979,10 @@ void WebGLRenderingContext::clearColor(GC3Dfloat r, GC3Dfloat g, GC3Dfloat b, GC
         b = 0;
     if (isnan(a))
         a = 1;
+    m_clearColor[0] = r;
+    m_clearColor[1] = g;
+    m_clearColor[2] = b;
+    m_clearColor[3] = a;
     m_context->clearColor(r, g, b, a);
     cleanupAfterGraphicsCall(false);
 }
@@ -909,6 +991,7 @@ void WebGLRenderingContext::clearDepth(GC3Dfloat depth)
 {
     if (isContextLost())
         return;
+    m_clearDepth = depth;
     m_context->clearDepth(depth);
     cleanupAfterGraphicsCall(false);
 }
@@ -917,6 +1000,7 @@ void WebGLRenderingContext::clearStencil(GC3Dint s)
 {
     if (isContextLost())
         return;
+    m_clearStencil = s;
     m_context->clearStencil(s);
     cleanupAfterGraphicsCall(false);
 }
@@ -925,6 +1009,10 @@ void WebGLRenderingContext::colorMask(GC3Dboolean red, GC3Dboolean green, GC3Dbo
 {
     if (isContextLost())
         return;
+    m_colorMask[0] = red;
+    m_colorMask[1] = green;
+    m_colorMask[2] = blue;
+    m_colorMask[3] = alpha;
     m_context->colorMask(red, green, blue, alpha);
     cleanupAfterGraphicsCall(false);
 }
@@ -959,6 +1047,7 @@ void WebGLRenderingContext::copyTexImage2D(GC3Denum target, GC3Dint level, GC3De
         m_context->synthesizeGLError(GraphicsContext3D::INVALID_FRAMEBUFFER_OPERATION);
         return;
     }
+    clearIfComposited();
     if (isResourceSafe())
         m_context->copyTexImage2D(target, level, internalformat, x, y, width, height, border);
     else {
@@ -1002,6 +1091,7 @@ void WebGLRenderingContext::copyTexSubImage2D(GC3Denum target, GC3Dint level, GC
         m_context->synthesizeGLError(GraphicsContext3D::INVALID_FRAMEBUFFER_OPERATION);
         return;
     }
+    clearIfComposited();
     if (isResourceSafe())
         m_context->copyTexSubImage2D(target, level, xoffset, yoffset, x, y, width, height);
     else {
@@ -1234,6 +1324,8 @@ void WebGLRenderingContext::disable(GC3Denum cap)
 {
     if (isContextLost() || !validateCapability(cap))
         return;
+    if (cap == GraphicsContext3D::SCISSOR_TEST)
+        m_scissorEnabled = false;
     m_context->disable(cap);
     cleanupAfterGraphicsCall(false);
 }
@@ -1479,6 +1571,8 @@ void WebGLRenderingContext::drawArrays(GC3Denum mode, GC3Dint first, GC3Dsizei c
         return;
     }
 
+    clearIfComposited();
+
     bool vertexAttrib0Simulated = false;
     if (!isGLES2Compliant())
         vertexAttrib0Simulated = simulateVertexAttrib0(first + count - 1);
@@ -1550,6 +1644,7 @@ void WebGLRenderingContext::drawElements(GC3Denum mode, GC3Dsizei count, GC3Denu
         m_context->synthesizeGLError(GraphicsContext3D::INVALID_FRAMEBUFFER_OPERATION);
         return;
     }
+    clearIfComposited();
 
     bool vertexAttrib0Simulated = false;
     if (!isGLES2Compliant()) {
@@ -1571,6 +1666,8 @@ void WebGLRenderingContext::enable(GC3Denum cap)
 {
     if (isContextLost() || !validateCapability(cap))
         return;
+    if (cap == GraphicsContext3D::SCISSOR_TEST)
+        m_scissorEnabled = true;
     m_context->enable(cap);
     cleanupAfterGraphicsCall(false);
 }
@@ -1597,7 +1694,7 @@ void WebGLRenderingContext::finish()
     if (isContextLost())
         return;
     m_context->finish();
-    cleanupAfterGraphicsCall(true);
+    cleanupAfterGraphicsCall(false);
 }
 
 void WebGLRenderingContext::flush()
@@ -1605,7 +1702,7 @@ void WebGLRenderingContext::flush()
     if (isContextLost())
         return;
     m_context->flush();
-    cleanupAfterGraphicsCall(true);
+    cleanupAfterGraphicsCall(false);
 }
 
 void WebGLRenderingContext::framebufferRenderbuffer(GC3Denum target, GC3Denum attachment, GC3Denum renderbuffertarget, WebGLRenderbuffer* buffer, ExceptionCode& ec)
@@ -2752,6 +2849,7 @@ void WebGLRenderingContext::readPixels(GC3Dint x, GC3Dint y, GC3Dsizei width, GC
         m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
         return;
     }
+    clearIfComposited();
     void* data = pixels->baseAddress();
     m_context->readPixels(x, y, width, height, format, type, data);
 #if OS(DARWIN)
@@ -3062,8 +3160,12 @@ void WebGLRenderingContext::texImage2D(GC3Denum target, GC3Dint level, GC3Denum
         return;
     }
     checkOrigin(canvas);
-    texImage2DImpl(target, level, internalformat, format, type, canvas->copiedImage(),
-                   m_unpackFlipY, m_unpackPremultiplyAlpha, ec);
+    RefPtr<ImageData> imageData = canvas->getImageData();
+    if (imageData)
+        texImage2D(target, level, internalformat, format, type, imageData.get(), ec);
+    else
+        texImage2DImpl(target, level, internalformat, format, type, canvas->copiedImage(),
+                       m_unpackFlipY, m_unpackPremultiplyAlpha, ec);
 }
 
 #if ENABLE(VIDEO)
@@ -3252,8 +3354,12 @@ void WebGLRenderingContext::texSubImage2D(GC3Denum target, GC3Dint level, GC3Din
         return;
     }
     checkOrigin(canvas);
-    texSubImage2DImpl(target, level, xoffset, yoffset, format, type, canvas->copiedImage(),
-                      m_unpackFlipY, m_unpackPremultiplyAlpha, ec);
+    RefPtr<ImageData> imageData = canvas->getImageData();
+    if (imageData)
+        texSubImage2D(target, level, xoffset, yoffset, format, type, imageData.get(), ec);
+    else
+        texSubImage2DImpl(target, level, xoffset, yoffset, format, type, canvas->copiedImage(),
+                          m_unpackFlipY, m_unpackPremultiplyAlpha, ec);
 }
 
 #if ENABLE(VIDEO)
diff --git a/Source/WebCore/html/canvas/WebGLRenderingContext.h b/Source/WebCore/html/canvas/WebGLRenderingContext.h
index 13145c8..f716efb 100644
--- a/Source/WebCore/html/canvas/WebGLRenderingContext.h
+++ b/Source/WebCore/html/canvas/WebGLRenderingContext.h
@@ -285,7 +285,9 @@ public:
 
     void reshape(int width, int height);
 
+    void markLayerComposited();
     virtual void paintRenderingResultsToCanvas();
+    virtual PassRefPtr<ImageData> paintRenderingResultsToImageData();
 
     void removeObject(WebGLObject*);
     
@@ -443,6 +445,13 @@ public:
     bool m_contextLost;
     GraphicsContext3D::Attributes m_attributes;
 
+    bool m_layerCleared;
+    GC3Dfloat m_clearColor[4];
+    bool m_scissorEnabled;
+    GC3Dfloat m_clearDepth;
+    GC3Dint m_clearStencil;
+    GC3Dboolean m_colorMask[4];
+
     long m_stencilBits;
     GC3Duint m_stencilMask, m_stencilMaskBack;
     GC3Dint m_stencilFuncRef, m_stencilFuncRefBack; // Note that these are the user specified values, not the internal clamped value.
@@ -469,6 +478,11 @@ public:
     WebGLGetInfo getWebGLFloatArrayParameter(GC3Denum);
     WebGLGetInfo getWebGLIntArrayParameter(GC3Denum);
 
+    // Clear the backbuffer if it was composited since the last operation.
+    // clearMask is set to the bitfield of any clear that would happen anyway at this time
+    // and the function returns true if that clear is now unnecessary.
+    bool clearIfComposited(GC3Dbitfield clearMask = 0);
+
     void texImage2DBase(GC3Denum target, GC3Dint level, GC3Denum internalformat,
                         GC3Dsizei width, GC3Dsizei height, GC3Dint border,
                         GC3Denum format, GC3Denum type, void* pixels, ExceptionCode&);
diff --git a/Source/WebCore/html/parser/HTMLDocumentParser.cpp b/Source/WebCore/html/parser/HTMLDocumentParser.cpp
index e79a97a..88db3c2 100644
--- a/Source/WebCore/html/parser/HTMLDocumentParser.cpp
+++ b/Source/WebCore/html/parser/HTMLDocumentParser.cpp
@@ -26,6 +26,7 @@
 #include "config.h"
 #include "HTMLDocumentParser.h"
 
+#include "ContentSecurityPolicy.h"
 #include "DocumentFragment.h"
 #include "Element.h"
 #include "Frame.h"
@@ -216,6 +217,13 @@ bool HTMLDocumentParser::canTakeNextToken(SynchronousMode mode, PumpSession& ses
 
     // The parser will pause itself when waiting on a script to load or run.
     if (m_treeBuilder->isPaused()) {
+        if (mode == AllowYield)
+            m_parserScheduler->checkForYieldBeforeScript(session);
+
+        // If we don't run the script, we cannot allow the next token to be taken.
+        if (session.needsYield)
+            return false;
+
         // If we're paused waiting for a script, we try to execute scripts before continuing.
         bool shouldContinueParsing = runScriptsForPausedTreeBuilder();
         m_treeBuilder->setPaused(!shouldContinueParsing);
@@ -242,7 +250,6 @@ bool HTMLDocumentParser::canTakeNextToken(SynchronousMode mode, PumpSession& ses
 void HTMLDocumentParser::pumpTokenizer(SynchronousMode mode)
 {
     ASSERT(!isStopped());
-    ASSERT(!m_treeBuilder->isPaused());
     ASSERT(!isScheduledForResume());
     // ASSERT that this object is both attached to the Document and protected.
     ASSERT(refCount() >= 2);
@@ -485,11 +492,6 @@ void HTMLDocumentParser::stopWatchingForLoad(CachedResource* cachedScript)
     cachedScript->removeClient(this);
 }
 
-bool HTMLDocumentParser::shouldLoadExternalScriptFromSrc(const AtomicString& srcValue)
-{
-    return document()->contentSecurityPolicy()->canLoadExternalScriptFromSrc(srcValue);
-}
-
 void HTMLDocumentParser::notifyFinished(CachedResource* cachedResource)
 {
     // pumpTokenizer can cause this parser to be detached from the Document,
diff --git a/Source/WebCore/html/parser/HTMLDocumentParser.h b/Source/WebCore/html/parser/HTMLDocumentParser.h
index 4bc33e4..a016cf3 100644
--- a/Source/WebCore/html/parser/HTMLDocumentParser.h
+++ b/Source/WebCore/html/parser/HTMLDocumentParser.h
@@ -108,7 +108,6 @@ private:
     // HTMLScriptRunnerHost
     virtual void watchForLoad(CachedResource*);
     virtual void stopWatchingForLoad(CachedResource*);
-    virtual bool shouldLoadExternalScriptFromSrc(const AtomicString&);
     virtual HTMLInputStream& inputStream() { return m_input; }
 
     // CachedResourceClient
diff --git a/Source/WebCore/html/parser/HTMLElementStack.cpp b/Source/WebCore/html/parser/HTMLElementStack.cpp
index 6f5f9ed..a4a7383 100644
--- a/Source/WebCore/html/parser/HTMLElementStack.cpp
+++ b/Source/WebCore/html/parser/HTMLElementStack.cpp
@@ -50,7 +50,7 @@ inline bool isNumberedHeaderElement(ContainerNode* node)
         || node->hasTagName(h6Tag);
 }
     
-inline bool isRootMarker(ContainerNode* node)
+inline bool isRootNode(ContainerNode* node)
 {
     return node->nodeType() == Node::DOCUMENT_FRAGMENT_NODE
         || node->hasTagName(htmlTag);
@@ -74,7 +74,7 @@ inline bool isScopeMarker(ContainerNode* node)
         || node->hasTagName(SVGNames::foreignObjectTag)
         || node->hasTagName(SVGNames::descTag)
         || node->hasTagName(SVGNames::titleTag)
-        || isRootMarker(node);
+        || isRootNode(node);
 }
 
 inline bool isListItemScopeMarker(ContainerNode* node)
@@ -87,7 +87,7 @@ inline bool isListItemScopeMarker(ContainerNode* node)
 inline bool isTableScopeMarker(ContainerNode* node)
 {
     return node->hasTagName(tableTag)
-        || isRootMarker(node);
+        || isRootNode(node);
 }
 
 inline bool isTableBodyScopeMarker(ContainerNode* node)
@@ -95,26 +95,26 @@ inline bool isTableBodyScopeMarker(ContainerNode* node)
     return node->hasTagName(tbodyTag)
         || node->hasTagName(tfootTag)
         || node->hasTagName(theadTag)
-        || isRootMarker(node);
+        || isRootNode(node);
 }
 
 inline bool isTableRowScopeMarker(ContainerNode* node)
 {
     return node->hasTagName(trTag)
-        || isRootMarker(node);
+        || isRootNode(node);
 }
 
-inline bool isForeignContentScopeMarker(Element* element)
+inline bool isForeignContentScopeMarker(ContainerNode* node)
 {
-    return element->hasTagName(MathMLNames::miTag)
-        || element->hasTagName(MathMLNames::moTag)
-        || element->hasTagName(MathMLNames::mnTag)
-        || element->hasTagName(MathMLNames::msTag)
-        || element->hasTagName(MathMLNames::mtextTag)
-        || element->hasTagName(SVGNames::foreignObjectTag)
-        || element->hasTagName(SVGNames::descTag)
-        || element->hasTagName(SVGNames::titleTag)
-        || element->namespaceURI() == HTMLNames::xhtmlNamespaceURI;
+    return node->hasTagName(MathMLNames::miTag)
+        || node->hasTagName(MathMLNames::moTag)
+        || node->hasTagName(MathMLNames::mnTag)
+        || node->hasTagName(MathMLNames::msTag)
+        || node->hasTagName(MathMLNames::mtextTag)
+        || node->hasTagName(SVGNames::foreignObjectTag)
+        || node->hasTagName(SVGNames::descTag)
+        || node->hasTagName(SVGNames::titleTag)
+        || isInHTMLNamespace(node);
 }
 
 inline bool isButtonScopeMarker(ContainerNode* node)
@@ -275,7 +275,7 @@ void HTMLElementStack::popUntilTableRowScopeMarker()
 
 void HTMLElementStack::popUntilForeignContentScopeMarker()
 {
-    while (!isForeignContentScopeMarker(top()))
+    while (!isForeignContentScopeMarker(topNode()))
         pop();
 }
     
@@ -434,10 +434,10 @@ bool inScopeCommon(HTMLElementStack::ElementRecord* top, const AtomicString& tar
 bool HTMLElementStack::hasOnlyHTMLElementsInScope() const
 {
     for (ElementRecord* record = m_top.get(); record; record = record->next()) {
-        Element* element = record->element();
-        if (element->namespaceURI() != xhtmlNamespaceURI)
+        ContainerNode* node = record->node();
+        if (!isInHTMLNamespace(node))
             return false;
-        if (isScopeMarker(element))
+        if (isScopeMarker(node))
             return true;
     }
     ASSERT_NOT_REACHED(); // <html> is always on the stack and is a scope marker.
@@ -460,10 +460,10 @@ bool HTMLElementStack::hasNumberedHeaderElementInScope() const
 bool HTMLElementStack::inScope(Element* targetElement) const
 {
     for (ElementRecord* pos = m_top.get(); pos; pos = pos->next()) {
-        Element* element = pos->element();
-        if (element == targetElement)
+        ContainerNode* node = pos->node();
+        if (node == targetElement)
             return true;
-        if (isScopeMarker(element))
+        if (isScopeMarker(node))
             return false;
     }
     ASSERT_NOT_REACHED(); // <html> is always on the stack and is a scope marker.
diff --git a/Source/WebCore/html/parser/HTMLElementStack.h b/Source/WebCore/html/parser/HTMLElementStack.h
index a710932..fd0e494 100644
--- a/Source/WebCore/html/parser/HTMLElementStack.h
+++ b/Source/WebCore/html/parser/HTMLElementStack.h
@@ -28,6 +28,7 @@
 #define HTMLElementStack_h
 
 #include "Element.h"
+#include "HTMLNames.h"
 #include <wtf/Forward.h>
 #include <wtf/Noncopyable.h>
 #include <wtf/OwnPtr.h>
@@ -167,6 +168,15 @@ private:
     Element* m_headElement;
     Element* m_bodyElement;
 };
+    
+inline bool isInHTMLNamespace(Node* node)
+{
+    // A DocumentFragment takes the place of the document element when parsing
+    // fragments and should be considered in the HTML namespace.
+    return node->namespaceURI() == HTMLNames::xhtmlNamespaceURI
+        || node->nodeType() == Node::DOCUMENT_FRAGMENT_NODE;
+}
+
 
 } // namespace WebCore
 
diff --git a/Source/WebCore/html/parser/HTMLParserScheduler.cpp b/Source/WebCore/html/parser/HTMLParserScheduler.cpp
index c4525c8..393c4be 100644
--- a/Source/WebCore/html/parser/HTMLParserScheduler.cpp
+++ b/Source/WebCore/html/parser/HTMLParserScheduler.cpp
@@ -86,6 +86,16 @@ void HTMLParserScheduler::continueNextChunkTimerFired(Timer<HTMLParserScheduler>
     m_parser->resumeParsingAfterYield();
 }
 
+void HTMLParserScheduler::checkForYieldBeforeScript(PumpSession& session)
+{
+    // If we've never painted before and a layout is pending, yield prior to running
+    // scripts to give the page a chance to paint earlier.
+    Document* document = m_parser->document();
+    bool needsFirstPaint = document->view() && !document->view()->hasEverPainted();
+    if (needsFirstPaint && document->isLayoutTimerActive())
+        session.needsYield = true;
+}
+
 void HTMLParserScheduler::scheduleForResume()
 {
     m_continueNextChunkTimer.startOneShot(0);
diff --git a/Source/WebCore/html/parser/HTMLParserScheduler.h b/Source/WebCore/html/parser/HTMLParserScheduler.h
index 9aa12eb..730b52b 100644
--- a/Source/WebCore/html/parser/HTMLParserScheduler.h
+++ b/Source/WebCore/html/parser/HTMLParserScheduler.h
@@ -70,6 +70,7 @@ public:
         }
         ++session.processedTokens;
     }
+    void checkForYieldBeforeScript(PumpSession&);
 
     void scheduleForResume();
     bool isScheduledForResume() const { return m_isSuspendedWithActiveTimer || m_continueNextChunkTimer.isActive(); }
diff --git a/Source/WebCore/html/parser/HTMLPreloadScanner.cpp b/Source/WebCore/html/parser/HTMLPreloadScanner.cpp
index d23542f..5514597 100644
--- a/Source/WebCore/html/parser/HTMLPreloadScanner.cpp
+++ b/Source/WebCore/html/parser/HTMLPreloadScanner.cpp
@@ -30,6 +30,7 @@
 
 #include "CachedResourceLoader.h"
 #include "Document.h"
+#include "InputType.h"
 #include "HTMLDocumentParser.h"
 #include "HTMLTokenizer.h"
 #include "HTMLLinkElement.h"
@@ -50,13 +51,17 @@ public:
         : m_tagName(token.name().data(), token.name().size())
         , m_linkIsStyleSheet(false)
         , m_linkMediaAttributeIsScreen(true)
+        , m_inputIsImage(false)
     {
         processAttributes(token.attributes());
     }
 
     void processAttributes(const HTMLToken::AttributeList& attributes)
     {
-        if (m_tagName != scriptTag && m_tagName != imgTag && m_tagName != linkTag)
+        if (m_tagName != imgTag
+            && m_tagName != inputTag
+            && m_tagName != linkTag
+            && m_tagName != scriptTag)
             return;
 
         for (HTMLToken::AttributeList::const_iterator iter = attributes.begin();
@@ -77,6 +82,11 @@ public:
                     m_linkIsStyleSheet = relAttributeIsStyleSheet(attributeValue);
                 else if (attributeName == mediaAttr)
                     m_linkMediaAttributeIsScreen = linkMediaAttributeIsScreen(attributeValue);
+            } else if (m_tagName == inputTag) {
+                if (attributeName == srcAttr)
+                    setUrlToLoad(attributeValue);
+                else if (attributeName == typeAttr)
+                    m_inputIsImage = equalIgnoringCase(attributeValue, InputTypeNames::image());
             }
         }
     }
@@ -87,7 +97,7 @@ public:
         HTMLLinkElement::tokenizeRelAttribute(attributeValue, rel);
         return rel.m_isStyleSheet && !rel.m_isAlternate && !rel.m_isIcon && !rel.m_isDNSPrefetch;
     }
-    
+
     static bool linkMediaAttributeIsScreen(const String& attributeValue)
     {
         if (attributeValue.isEmpty())
@@ -118,7 +128,7 @@ public:
         CachedResourceLoader* cachedResourceLoader = document->cachedResourceLoader();
         if (m_tagName == scriptTag)
             cachedResourceLoader->preload(CachedResource::Script, m_urlToLoad, m_charset, scanningBody);
-        else if (m_tagName == imgTag) 
+        else if (m_tagName == imgTag || (m_tagName == inputTag && m_inputIsImage))
             cachedResourceLoader->preload(CachedResource::ImageResource, m_urlToLoad, String(), scanningBody);
         else if (m_tagName == linkTag && m_linkIsStyleSheet && m_linkMediaAttributeIsScreen) 
             cachedResourceLoader->preload(CachedResource::CSSStyleSheet, m_urlToLoad, m_charset, scanningBody);
@@ -132,6 +142,7 @@ private:
     String m_charset;
     bool m_linkIsStyleSheet;
     bool m_linkMediaAttributeIsScreen;
+    bool m_inputIsImage;
 };
 
 } // namespace
diff --git a/Source/WebCore/html/parser/HTMLScriptRunnerHost.h b/Source/WebCore/html/parser/HTMLScriptRunnerHost.h
index 5b40a931..454bc6f 100644
--- a/Source/WebCore/html/parser/HTMLScriptRunnerHost.h
+++ b/Source/WebCore/html/parser/HTMLScriptRunnerHost.h
@@ -44,8 +44,6 @@ public:
     // Implementors must call cachedResource->removeClient() immediately.
     virtual void stopWatchingForLoad(CachedResource*) = 0;
 
-    // Implementors can block certain script loads (for XSSAuditor, etc.)
-    virtual bool shouldLoadExternalScriptFromSrc(const AtomicString&) = 0;
     virtual HTMLInputStream& inputStream() = 0;
 };
 
diff --git a/Source/WebCore/html/parser/HTMLToken.h b/Source/WebCore/html/parser/HTMLToken.h
index aa16ab2..49ec312 100644
--- a/Source/WebCore/html/parser/HTMLToken.h
+++ b/Source/WebCore/html/parser/HTMLToken.h
@@ -398,27 +398,7 @@ public:
         case HTMLToken::EndTag: {
             m_selfClosing = token.selfClosing();
             m_name = AtomicString(token.name().data(), token.name().size());
-            const HTMLToken::AttributeList& attributes = token.attributes();
-            for (HTMLToken::AttributeList::const_iterator iter = attributes.begin();
-                 iter != attributes.end(); ++iter) {
-                if (!iter->m_name.isEmpty()) {
-                    String name(iter->m_name.data(), iter->m_name.size());
-                    String value(iter->m_value.data(), iter->m_value.size());
-                    ASSERT(iter->m_nameRange.m_start);
-                    ASSERT(iter->m_nameRange.m_end);
-                    ASSERT(iter->m_valueRange.m_start);
-                    ASSERT(iter->m_valueRange.m_end);
-                    RefPtr<Attribute> mappedAttribute = Attribute::createMapped(name, value);
-                    if (!m_attributes) {
-                        m_attributes = NamedNodeMap::create();
-                        // Reserving capacity here improves the parser
-                        // benchmark.  It might be worth experimenting with
-                        // the constant to see where the optimal point is.
-                        m_attributes->reserveInitialCapacity(10);
-                    }
-                    m_attributes->insertAttribute(mappedAttribute.release(), false);
-                }
-            }
+            initializeAttributes(token.attributes());
             break;
         }
         case HTMLToken::Comment:
@@ -513,6 +493,8 @@ public:
 private:
     HTMLToken::Type m_type;
 
+    void initializeAttributes(const HTMLToken::AttributeList& attributes);
+    
     bool usesName() const
     {
         return m_type == HTMLToken::StartTag || m_type == HTMLToken::EndTag || m_type == HTMLToken::DOCTYPE;
@@ -548,6 +530,30 @@ private:
     RefPtr<NamedNodeMap> m_attributes;
 };
 
+inline void AtomicHTMLToken::initializeAttributes(const HTMLToken::AttributeList& attributes)
+{
+    size_t size = attributes.size();
+    if (!size)
+        return;
+
+    m_attributes = NamedNodeMap::create();
+    m_attributes->reserveInitialCapacity(size);
+    for (size_t i = 0; i < size; ++i) {
+        const HTMLToken::Attribute& attribute = attributes[i];
+        if (attribute.m_name.isEmpty())
+            continue;
+
+        ASSERT(attribute.m_nameRange.m_start);
+        ASSERT(attribute.m_nameRange.m_end);
+        ASSERT(attribute.m_valueRange.m_start);
+        ASSERT(attribute.m_valueRange.m_end);
+
+        String name(attribute.m_name.data(), attribute.m_name.size());
+        String value(attribute.m_value.data(), attribute.m_value.size());
+        m_attributes->insertAttribute(Attribute::createMapped(name, value), false);
+    }
+}
+
 }
 
 #endif
diff --git a/Source/WebCore/html/parser/HTMLTreeBuilder.cpp b/Source/WebCore/html/parser/HTMLTreeBuilder.cpp
index 8f9e3e1..6db09de 100644
--- a/Source/WebCore/html/parser/HTMLTreeBuilder.cpp
+++ b/Source/WebCore/html/parser/HTMLTreeBuilder.cpp
@@ -125,7 +125,7 @@ bool isSpecialNode(Node* node)
         return true;
     if (node->nodeType() == Node::DOCUMENT_FRAGMENT_NODE)
         return true;
-    if (node->namespaceURI() != xhtmlNamespaceURI)
+    if (!isInHTMLNamespace(node))
         return false;
     const AtomicString& tagName = node->localName();
     return tagName == addressTag
@@ -445,7 +445,7 @@ void HTMLTreeBuilder::constructTreeFromAtomicToken(AtomicHTMLToken& token)
     // the U+0000 characters into replacement characters has compatibility
     // problems.
     m_parser->tokenizer()->setForceNullCharacterReplacement(m_insertionMode == TextMode || m_insertionMode == InForeignContentMode);
-    m_parser->tokenizer()->setShouldAllowCDATA(m_insertionMode == InForeignContentMode && m_tree.currentNode()->namespaceURI() != xhtmlNamespaceURI);
+    m_parser->tokenizer()->setShouldAllowCDATA(m_insertionMode == InForeignContentMode && !isInHTMLNamespace(m_tree.currentNode()));
 }
 
 void HTMLTreeBuilder::processToken(AtomicHTMLToken& token)
@@ -984,7 +984,7 @@ void HTMLTreeBuilder::processStartTagForInBody(AtomicHTMLToken& token)
         adjustMathMLAttributes(token);
         adjustForeignAttributes(token);
         m_tree.insertForeignElement(token, MathMLNames::mathmlNamespaceURI);
-        if (m_insertionMode != InForeignContentMode)
+        if (m_insertionMode != InForeignContentMode && !token.selfClosing())
             setInsertionMode(InForeignContentMode);
         return;
     }
@@ -993,7 +993,7 @@ void HTMLTreeBuilder::processStartTagForInBody(AtomicHTMLToken& token)
         adjustSVGAttributes(token);
         adjustForeignAttributes(token);
         m_tree.insertForeignElement(token, SVGNames::svgNamespaceURI);
-        if (m_insertionMode != InForeignContentMode)
+        if (m_insertionMode != InForeignContentMode && !token.selfClosing())
             setInsertionMode(InForeignContentMode);
         return;
     }
@@ -1125,7 +1125,7 @@ bool shouldProcessForeignContentUsingInBodyInsertionMode(AtomicHTMLToken& token,
         || currentElement->hasTagName(SVGNames::descTag)
         || currentElement->hasTagName(SVGNames::titleTag))
         return true;
-    return currentElement->namespaceURI() == HTMLNames::xhtmlNamespaceURI;
+    return isInHTMLNamespace(currentElement);
 }
 
 }
@@ -1451,7 +1451,7 @@ void HTMLTreeBuilder::processStartTag(AtomicHTMLToken& token)
         processStartTag(token);
         break;
     case InForeignContentMode: {
-        if (shouldProcessForeignContentUsingInBodyInsertionMode(token, m_tree.currentElement())) {
+        if (shouldProcessForeignContentUsingInBodyInsertionMode(token, m_tree.currentNode())) {
             processForeignContentUsingInBodyModeAndResetMode(token);
             return;
         }
@@ -2297,7 +2297,7 @@ void HTMLTreeBuilder::processEndTag(AtomicHTMLToken& token)
             notImplemented();
             return;
         }
-        if (m_tree.currentNode()->namespaceURI() != xhtmlNamespaceURI) {
+        if (!isInHTMLNamespace(m_tree.currentNode())) {
             // FIXME: This code just wants an Element* iterator, instead of an ElementRecord*
             HTMLElementStack::ElementRecord* nodeRecord = m_tree.openElements()->topRecord();
             if (!nodeRecord->node()->hasLocalName(token.name()))
@@ -2310,12 +2310,7 @@ void HTMLTreeBuilder::processEndTag(AtomicHTMLToken& token)
                 }
                 nodeRecord = nodeRecord->next();
                 
-                if (nodeRecord->node()->nodeType() == Node::DOCUMENT_FRAGMENT_NODE) {
-                    ASSERT(isParsingFragment());
-                    break;
-                }
-                
-                if (nodeRecord->node()->namespaceURI() == xhtmlNamespaceURI)
+                if (isInHTMLNamespace(nodeRecord->node()))
                     break;
             }
         }
diff --git a/Source/WebCore/html/shadow/MediaControls.cpp b/Source/WebCore/html/shadow/MediaControls.cpp
index 61a3684..20f1abb 100644
--- a/Source/WebCore/html/shadow/MediaControls.cpp
+++ b/Source/WebCore/html/shadow/MediaControls.cpp
@@ -52,12 +52,10 @@ namespace WebCore {
 
 using namespace HTMLNames;
 
-static const double cTimeUpdateRepeatDelay = 0.2;
 static const double cOpacityAnimationRepeatDelay = 0.05;
 
 MediaControls::MediaControls(HTMLMediaElement* mediaElement)
     : m_mediaElement(mediaElement)
-    , m_timeUpdateTimer(this, &MediaControls::timeUpdateTimerFired)
     , m_opacityAnimationTimer(this, &MediaControls::opacityAnimationTimerFired)
     , m_opacityAnimationStartTime(0)
     , m_opacityAnimationDuration(0)
@@ -70,6 +68,137 @@ MediaControls::MediaControls(HTMLMediaElement* mediaElement)
 {
 }
 
+// FIXME: This will turn into the standard element factory method once shadow DOM conversion is complete.
+// (see https://bugs.webkit.org/show_bug.cgi?id=53020)
+PassRefPtr<MediaControlShadowRootElement> MediaControls::create(HTMLMediaElement* mediaElement)
+{
+    ASSERT(!m_panel);
+    ASSERT(!m_muteButton);
+    ASSERT(!m_playButton);
+    ASSERT(!m_returnToRealtimeButton);
+    ASSERT(!m_statusDisplay);
+    ASSERT(!m_timelineContainer);
+    ASSERT(!m_currentTimeDisplay);
+    ASSERT(!m_timeline);
+    ASSERT(!m_timeRemainingDisplay);
+    ASSERT(!m_seekBackButton);
+    ASSERT(!m_seekForwardButton);
+    ASSERT(!m_toggleClosedCaptionsButton);
+    ASSERT(!m_fullscreenButton);
+    ASSERT(!m_muteButton);
+    ASSERT(!m_volumeSliderContainer);
+    ASSERT(!m_volumeSlider);
+    ASSERT(!m_volumeSliderMuteButton);
+    ASSERT(!m_fullScreenMinVolumeButton);
+    ASSERT(!m_fullScreenMaxVolumeButton);
+    ASSERT(!m_fullScreenVolumeSlider);
+
+    RefPtr<MediaControlShadowRootElement> controls = MediaControlShadowRootElement::create(mediaElement);
+
+    m_panel = MediaControlPanelElement::create(mediaElement);
+
+    m_rewindButton = MediaControlRewindButtonElement::create(mediaElement);
+    m_rewindButton->attachToParent(m_panel.get());
+
+    m_playButton = MediaControlPlayButtonElement::create(mediaElement);
+    m_playButton->attachToParent(m_panel.get());
+
+    m_returnToRealtimeButton = MediaControlReturnToRealtimeButtonElement::create(mediaElement);
+    m_returnToRealtimeButton->attachToParent(m_panel.get());
+
+    m_statusDisplay = MediaControlStatusDisplayElement::create(mediaElement);
+    m_statusDisplay->attachToParent(m_panel.get());
+
+    m_timelineContainer = MediaControlTimelineContainerElement::create(mediaElement);
+
+    m_currentTimeDisplay = MediaControlCurrentTimeDisplayElement::create(mediaElement);
+    m_currentTimeDisplay->attachToParent(m_timelineContainer.get());
+
+    m_timeline = MediaControlTimelineElement::create(mediaElement);
+    m_timeline->attachToParent(m_timelineContainer.get());
+
+    m_timeRemainingDisplay = MediaControlTimeRemainingDisplayElement::create(mediaElement);
+    m_timeRemainingDisplay->attachToParent(m_timelineContainer.get());
+
+    m_timelineContainer->attachToParent(m_panel.get());
+
+    m_seekBackButton = MediaControlSeekBackButtonElement::create(mediaElement);
+    m_seekBackButton->attachToParent(m_panel.get());
+
+    m_seekForwardButton = MediaControlSeekForwardButtonElement::create(mediaElement);
+    m_seekForwardButton->attachToParent(m_panel.get());
+
+    m_toggleClosedCaptionsButton = MediaControlToggleClosedCaptionsButtonElement::create(mediaElement);
+    m_toggleClosedCaptionsButton->attachToParent(m_panel.get());
+
+    m_fullscreenButton = MediaControlFullscreenButtonElement::create(mediaElement);
+    m_fullscreenButton->attachToParent(m_panel.get());
+
+    m_muteButton = MediaControlPanelMuteButtonElement::create(mediaElement);
+    m_muteButton->attachToParent(m_panel.get());
+
+    m_volumeSliderContainer = MediaControlVolumeSliderContainerElement::create(mediaElement);
+
+    m_volumeSlider = MediaControlVolumeSliderElement::create(mediaElement);
+    m_volumeSlider->attachToParent(m_volumeSliderContainer.get());
+
+    m_volumeSliderMuteButton = MediaControlVolumeSliderMuteButtonElement::create(mediaElement);
+    m_volumeSliderMuteButton->attachToParent(m_volumeSliderContainer.get());
+
+    m_volumeSliderContainer->attachToParent(m_panel.get());
+    
+    // FIXME: These controls, and others, should be created dynamically when needed, instead of 
+    // always created.  <http://webkit.org/b/57163>
+    m_fullScreenMinVolumeButton = MediaControlFullscreenVolumeMinButtonElement::create(mediaElement);
+    m_fullScreenMinVolumeButton->attachToParent(m_panel.get());
+    
+    m_fullScreenVolumeSlider = MediaControlFullscreenVolumeSliderElement::create(mediaElement);
+    m_fullScreenVolumeSlider->attachToParent(m_panel.get());
+    
+    m_fullScreenMaxVolumeButton = MediaControlFullscreenVolumeMaxButtonElement::create(mediaElement);
+    m_fullScreenMaxVolumeButton->attachToParent(m_panel.get());
+    
+    m_panel->attachToParent(controls.get());
+    return controls.release();
+}
+
+void MediaControls::reset()
+{
+    update();
+}
+
+void MediaControls::playbackProgressed()
+{
+    if (m_timeline)
+        m_timeline->update(false);
+    updateTimeDisplay();
+}
+
+void MediaControls::playbackStarted()
+{
+    playbackProgressed();
+}
+
+void MediaControls::playbackStopped()
+{
+    playbackProgressed();
+}
+
+void MediaControls::changedMute()
+{
+    update();
+}
+
+void MediaControls::changedVolume()
+{
+    update();
+}
+
+void MediaControls::changedClosedCaptionsVisibility()
+{
+    update();
+}
+
 void MediaControls::updateStyle()
 {
     if (!m_controlsShadowRoot)
@@ -109,6 +238,12 @@ void MediaControls::updateStyle()
         m_volumeSliderMuteButton->updateStyle();
     if (m_volumeSlider)
         m_volumeSlider->updateStyle();
+    if (m_fullScreenMinVolumeButton)
+        m_fullScreenMinVolumeButton->updateStyle();
+    if (m_fullScreenVolumeSlider)
+        m_fullScreenVolumeSlider->updateStyle();
+    if (m_fullScreenMaxVolumeButton)
+        m_fullScreenMaxVolumeButton->updateStyle();
 }
 
 void MediaControls::destroy()
@@ -151,46 +286,19 @@ void MediaControls::update()
             m_volumeSliderMuteButton = 0;
             m_controlsShadowRoot = 0;
             m_toggleClosedCaptionsButton = 0;
+            m_fullScreenMinVolumeButton = 0;
+            m_fullScreenVolumeSlider = 0;
+            m_fullScreenMaxVolumeButton = 0;
         }
         m_opacityAnimationTo = 1.0f;
         m_opacityAnimationTimer.stop();
-        m_timeUpdateTimer.stop();
         return;
     }
 
     if (!m_controlsShadowRoot) {
-        createControlsShadowRoot();
-        createPanel();
-        if (m_panel) {
-            createRewindButton();
-            createPlayButton();
-            createReturnToRealtimeButton();
-            createStatusDisplay();
-            createTimelineContainer();
-            if (m_timelineContainer) {
-                createCurrentTimeDisplay();
-                createTimeline();
-                createTimeRemainingDisplay();
-            }
-            createSeekBackButton();
-            createSeekForwardButton();
-            createToggleClosedCaptionsButton();
-            createFullscreenButton();
-            createMuteButton();
-            createVolumeSliderContainer();
-            if (m_volumeSliderContainer) {
-                createVolumeSlider();
-                createVolumeSliderMuteButton();
-            }
-            m_panel->attach();
-        }
-    }
-
-    if (media->canPlay()) {
-        if (m_timeUpdateTimer.isActive())
-            m_timeUpdateTimer.stop();
-    } else if (media->renderer()->style()->visibility() == VISIBLE && m_timeline && m_timeline->renderer() && m_timeline->renderer()->style()->display() != NONE) {
-        m_timeUpdateTimer.startRepeating(cTimeUpdateRepeatDelay);
+        m_controlsShadowRoot = create(m_mediaElement);
+        m_mediaElement->renderer()->addChild(m_controlsShadowRoot->renderer());
+        m_panel->attach();
     }
 
     if (m_panel) {
@@ -232,148 +340,16 @@ void MediaControls::update()
         m_volumeSlider->update();
     if (m_volumeSliderMuteButton)
         m_volumeSliderMuteButton->update();
-
+    if (m_fullScreenMinVolumeButton)
+        m_fullScreenMinVolumeButton->update();
+    if (m_fullScreenVolumeSlider)
+        m_fullScreenVolumeSlider->update();
+    if (m_fullScreenMaxVolumeButton)
+        m_fullScreenMaxVolumeButton->update();
     updateTimeDisplay();
     updateControlVisibility();
 }
 
-void MediaControls::createControlsShadowRoot()
-{
-    ASSERT(!m_controlsShadowRoot);
-    m_controlsShadowRoot = MediaControlShadowRootElement::create(m_mediaElement);
-    m_mediaElement->renderer()->addChild(m_controlsShadowRoot->renderer());
-}
-
-void MediaControls::createPanel()
-{
-    ASSERT(!m_panel);
-    m_panel = MediaControlPanelElement::create(m_mediaElement);
-    m_panel->attachToParent(m_controlsShadowRoot.get());
-}
-
-void MediaControls::createMuteButton()
-{
-    ASSERT(!m_muteButton);
-    m_muteButton = MediaControlPanelMuteButtonElement::create(m_mediaElement);
-    m_muteButton->attachToParent(m_panel.get());
-}
-
-void MediaControls::createPlayButton()
-{
-    ASSERT(!m_playButton);
-    m_playButton = MediaControlPlayButtonElement::create(m_mediaElement);
-    m_playButton->attachToParent(m_panel.get());
-}
-
-void MediaControls::createSeekBackButton()
-{
-    ASSERT(!m_seekBackButton);
-    m_seekBackButton = MediaControlSeekBackButtonElement::create(m_mediaElement);
-    m_seekBackButton->attachToParent(m_panel.get());
-}
-
-void MediaControls::createSeekForwardButton()
-{
-    ASSERT(!m_seekForwardButton);
-    m_seekForwardButton = MediaControlSeekForwardButtonElement::create(m_mediaElement);
-    m_seekForwardButton->attachToParent(m_panel.get());
-}
-
-void MediaControls::createRewindButton()
-{
-    ASSERT(!m_rewindButton);
-    m_rewindButton = MediaControlRewindButtonElement::create(m_mediaElement);
-    m_rewindButton->attachToParent(m_panel.get());
-}
-
-void MediaControls::createReturnToRealtimeButton()
-{
-    ASSERT(!m_returnToRealtimeButton);
-    m_returnToRealtimeButton = MediaControlReturnToRealtimeButtonElement::create(m_mediaElement);
-    m_returnToRealtimeButton->attachToParent(m_panel.get());
-}
-
-void MediaControls::createToggleClosedCaptionsButton()
-{
-    ASSERT(!m_toggleClosedCaptionsButton);
-    m_toggleClosedCaptionsButton = MediaControlToggleClosedCaptionsButtonElement::create(m_mediaElement);
-    m_toggleClosedCaptionsButton->attachToParent(m_panel.get());
-}
-
-void MediaControls::createStatusDisplay()
-{
-    ASSERT(!m_statusDisplay);
-    m_statusDisplay = MediaControlStatusDisplayElement::create(m_mediaElement);
-    m_statusDisplay->attachToParent(m_panel.get());
-}
-
-void MediaControls::createTimelineContainer()
-{
-    ASSERT(!m_timelineContainer);
-    m_timelineContainer = MediaControlTimelineContainerElement::create(m_mediaElement);
-    m_timelineContainer->attachToParent(m_panel.get());
-}
-
-void MediaControls::createTimeline()
-{
-    ASSERT(!m_timeline);
-    m_timeline = MediaControlTimelineElement::create(m_mediaElement);
-    m_timeline->setAttribute(precisionAttr, "float");
-    m_timeline->attachToParent(m_timelineContainer.get());
-}
-
-void MediaControls::createVolumeSliderContainer()
-{
-    ASSERT(!m_volumeSliderContainer);
-    m_volumeSliderContainer = MediaControlVolumeSliderContainerElement::create(m_mediaElement);
-    m_volumeSliderContainer->attachToParent(m_panel.get());
-}
-
-void MediaControls::createVolumeSlider()
-{
-    ASSERT(!m_volumeSlider);
-    m_volumeSlider = MediaControlVolumeSliderElement::create(m_mediaElement);
-    m_volumeSlider->setAttribute(precisionAttr, "float");
-    m_volumeSlider->setAttribute(maxAttr, "1");
-    m_volumeSlider->setAttribute(valueAttr, String::number(m_mediaElement->volume()));
-    m_volumeSlider->attachToParent(m_volumeSliderContainer.get());
-}
-
-void MediaControls::createVolumeSliderMuteButton()
-{
-    ASSERT(!m_volumeSliderMuteButton);
-    m_volumeSliderMuteButton = MediaControlVolumeSliderMuteButtonElement::create(m_mediaElement);
-    m_volumeSliderMuteButton->attachToParent(m_volumeSliderContainer.get());
-}
-
-void MediaControls::createCurrentTimeDisplay()
-{
-    ASSERT(!m_currentTimeDisplay);
-    m_currentTimeDisplay = MediaControlCurrentTimeDisplayElement::create(m_mediaElement);
-    m_currentTimeDisplay->attachToParent(m_timelineContainer.get());
-}
-
-void MediaControls::createTimeRemainingDisplay()
-{
-    ASSERT(!m_timeRemainingDisplay);
-    m_timeRemainingDisplay = MediaControlTimeRemainingDisplayElement::create(m_mediaElement);
-    m_timeRemainingDisplay->attachToParent(m_timelineContainer.get());
-}
-
-void MediaControls::createFullscreenButton()
-{
-    ASSERT(!m_fullscreenButton);
-    m_fullscreenButton = MediaControlFullscreenButtonElement::create(m_mediaElement);
-    m_fullscreenButton->attachToParent(m_panel.get());
-}
-
-void MediaControls::timeUpdateTimerFired(Timer<MediaControls>*)
-{
-    if (m_timeline)
-        m_timeline->update(false);
-    updateTimeDisplay();
-}
-
 void MediaControls::updateTimeDisplay()
 {
     ASSERT(m_mediaElement->renderer());
@@ -480,13 +456,6 @@ void MediaControls::updateVolumeSliderContainer(bool visible)
             return;
 
         RefPtr<RenderStyle> s = m_volumeSliderContainer->styleForElement();
-        int height = s->height().isPercent() ? 0 : s->height().value();
-        int width = s->width().isPercent() ? 0 : s->width().value();
-        IntPoint offset = m_mediaElement->document()->page()->theme()->volumeSliderOffsetFromMuteButton(m_muteButton->renderBox(), IntSize(width, height));
-        int x = offset.x() + m_muteButton->renderBox()->offsetLeft();
-        int y = offset.y() + m_muteButton->renderBox()->offsetTop();
-
-        m_volumeSliderContainer->setPosition(x, y);
         m_volumeSliderContainer->setVisible(true);
         m_volumeSliderContainer->update();
         m_volumeSlider->update();
@@ -588,6 +557,7 @@ void MediaControls::forwardEvent(Event* event)
 #endif
 }
 
+<<<<<<< HEAD
 // We want the timeline slider to be at least 100 pixels wide.
 static const int minWidthToDisplayTimeDisplays = 16 + 16 + 45 + 100 + 45 + 16 + 1;
 
@@ -612,6 +582,8 @@ void MediaControls::updateLastTouch()
 }
 #endif
 
+=======
+>>>>>>> webkit.org at r82507
 }
 
 #endif
diff --git a/Source/WebCore/html/shadow/MediaControls.h b/Source/WebCore/html/shadow/MediaControls.h
index a4fbbd6..726573e 100644
--- a/Source/WebCore/html/shadow/MediaControls.h
+++ b/Source/WebCore/html/shadow/MediaControls.h
@@ -53,6 +53,9 @@ class MediaControlStatusDisplayElement;
 class MediaControlTimelineContainerElement;
 class MediaControlVolumeSliderContainerElement;
 class MediaControlElement;
+class MediaControlFullscreenVolumeMinButtonElement;
+class MediaControlFullscreenVolumeSliderElement;
+class MediaControlFullscreenVolumeMaxButtonElement;
 class MediaPlayer;
 
 class RenderBox;
@@ -62,12 +65,21 @@ class MediaControls {
 public:
     MediaControls(HTMLMediaElement*);
 
+    void reset();
+
+    void playbackProgressed();
+    void playbackStarted();
+    void playbackStopped();
+
+    void changedMute();
+    void changedVolume();
+    void changedClosedCaptionsVisibility();
+
     void destroy();
     void update();
     void updateStyle();
     void forwardEvent(Event*);
     void updateTimeDisplay();
-    void updateTimeDisplayVisibility();
 
     // FIXME: This is temporary to allow RenderMedia::layout tweak the position of controls.
     // Once shadow DOM refactoring is complete, the tweaking will be in MediaControlsShadowRoot and this accessor will no longer be necessary.
@@ -78,27 +90,7 @@ public:
 #endif
 
 private:
-    void createControlsShadowRoot();
-    void destroyControlsShadowRoot();
-    void createPanel();
-    void createMuteButton();
-    void createPlayButton();
-    void createSeekBackButton();
-    void createSeekForwardButton();
-    void createRewindButton();
-    void createReturnToRealtimeButton();
-    void createToggleClosedCaptionsButton();
-    void createStatusDisplay();
-    void createTimelineContainer();
-    void createTimeline();
-    void createVolumeSliderContainer();
-    void createVolumeSlider();
-    void createVolumeSliderMuteButton();
-    void createCurrentTimeDisplay();
-    void createTimeRemainingDisplay();
-    void createFullscreenButton();
-
-    void timeUpdateTimerFired(Timer<MediaControls>*);
+    PassRefPtr<MediaControlShadowRootElement> create(HTMLMediaElement*);
 
     void updateControlVisibility();
     void changeOpacity(HTMLElement*, float opacity);
@@ -125,9 +117,11 @@ private:
     RefPtr<MediaControlTimeDisplayElement> m_currentTimeDisplay;
     RefPtr<MediaControlTimeDisplayElement> m_timeRemainingDisplay;
     RefPtr<MediaControlStatusDisplayElement> m_statusDisplay;
+    RefPtr<MediaControlFullscreenVolumeMinButtonElement> m_fullScreenMinVolumeButton;
+    RefPtr<MediaControlFullscreenVolumeSliderElement> m_fullScreenVolumeSlider;
+    RefPtr<MediaControlFullscreenVolumeMaxButtonElement> m_fullScreenMaxVolumeButton;
 
     HTMLMediaElement* m_mediaElement;
-    Timer<MediaControls> m_timeUpdateTimer;
     Timer<MediaControls> m_opacityAnimationTimer;
 
     double m_opacityAnimationStartTime;
diff --git a/Source/WebCore/html/shadow/SliderThumbElement.cpp b/Source/WebCore/html/shadow/SliderThumbElement.cpp
index 2c049cb..d1aa15e 100644
--- a/Source/WebCore/html/shadow/SliderThumbElement.cpp
+++ b/Source/WebCore/html/shadow/SliderThumbElement.cpp
@@ -56,6 +56,8 @@ namespace WebCore {
 class RenderSliderThumb : public RenderBlock {
 public:
     RenderSliderThumb(Node*);
+
+private:
     virtual void layout();
 };
 
@@ -85,6 +87,16 @@ void RenderSliderThumb::layout()
     RenderBlock::layout();
 }
 
+void SliderThumbElement::setPositionFromValue()
+{
+    // Since today the code to calculate position is in the RenderSlider layout
+    // path, we don't actually update the value here. Instead, we poke at the
+    // renderer directly to trigger layout.
+    // FIXME: Move the logic of positioning the thumb here.
+    if (renderer())
+        renderer()->setNeedsLayout(true);
+}
+
 RenderObject* SliderThumbElement::createRenderer(RenderArena* arena, RenderStyle*)
 {
     return new (arena) RenderSliderThumb(this);
@@ -92,11 +104,11 @@ RenderObject* SliderThumbElement::createRenderer(RenderArena* arena, RenderStyle
 
 void SliderThumbElement::dragFrom(const IntPoint& point)
 {
-    setPosition(point);
+    setPositionFromPoint(point);
     startDragging();
 }
 
-void SliderThumbElement::setPosition(const IntPoint& point)
+void SliderThumbElement::setPositionFromPoint(const IntPoint& point)
 {
     HTMLInputElement* input = static_cast<HTMLInputElement*>(shadowHost());
     ASSERT(input);
@@ -212,6 +224,7 @@ void SliderThumbElement::defaultEventHandler(Event* event)
 #endif
             ) {
         if (m_inDragMode)
+<<<<<<< HEAD
 #if PLATFORM(ANDROID) && ENABLE(TOUCH_EVENTS)
         {
             if (event->isMouseEvent()) {
@@ -233,6 +246,9 @@ void SliderThumbElement::defaultEventHandler(Event* event)
 
         }
 #endif
+=======
+            setPositionFromPoint(mouseEvent->absoluteLocation());
+>>>>>>> webkit.org at r82507
         return;
     }
 
diff --git a/Source/WebCore/html/shadow/SliderThumbElement.h b/Source/WebCore/html/shadow/SliderThumbElement.h
index 7c4c179..9414ac4 100644
--- a/Source/WebCore/html/shadow/SliderThumbElement.h
+++ b/Source/WebCore/html/shadow/SliderThumbElement.h
@@ -49,6 +49,7 @@ public:
     static PassRefPtr<SliderThumbElement> create(Document*);
 
     bool inDragMode() const { return m_inDragMode; }
+    void setPositionFromValue();
 
     void dragFrom(const IntPoint&);
     virtual void defaultEventHandler(Event*);
@@ -60,7 +61,7 @@ private:
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
     void startDragging();
     void stopDragging();
-    void setPosition(const IntPoint&);
+    void setPositionFromPoint(const IntPoint&);
 
     FloatPoint m_offsetToThumb;
     bool m_inDragMode;
diff --git a/Source/WebCore/inspector/CodeGeneratorInspector.pm b/Source/WebCore/inspector/CodeGeneratorInspector.pm
index 70eb61d..ea65f2e 100644
--- a/Source/WebCore/inspector/CodeGeneratorInspector.pm
+++ b/Source/WebCore/inspector/CodeGeneratorInspector.pm
@@ -13,71 +13,77 @@ my %typeTransform;
 $typeTransform{"ApplicationCache"} = {
     "forward" => "InspectorApplicationCacheAgent",
     "header" => "InspectorApplicationCacheAgent.h",
-    "domainAccessor" => "m_inspectorAgent->applicationCacheAgent()",
+    "domainAccessor" => "m_applicationCacheAgent",
 };
 $typeTransform{"CSS"} = {
     "forward" => "InspectorCSSAgent",
     "header" => "InspectorCSSAgent.h",
-    "domainAccessor" => "m_inspectorAgent->cssAgent()",
+    "domainAccessor" => "m_cssAgent",
 };
 $typeTransform{"Console"} = {
     "forward" => "InspectorConsoleAgent",
     "header" => "InspectorConsoleAgent.h",
-    "domainAccessor" => "m_inspectorAgent->consoleAgent()",
+    "domainAccessor" => "m_consoleAgent",
+};
+$typeTransform{"Page"} = {
+    "forward" => "InspectorPageAgent",
+    "header" => "InspectorPageAgent.h",
+    "domainAccessor" => "m_pageAgent",
 };
 $typeTransform{"Debugger"} = {
     "forward" => "InspectorDebuggerAgent",
     "header" => "InspectorDebuggerAgent.h",
-    "domainAccessor" => "m_inspectorAgent->debuggerAgent()",
+    "domainAccessor" => "m_debuggerAgent",
 };
 $typeTransform{"BrowserDebugger"} = {
     "forward" => "InspectorBrowserDebuggerAgent",
     "header" => "InspectorBrowserDebuggerAgent.h",
-    "domainAccessor" => "m_inspectorAgent->browserDebuggerAgent()",
+    "domainAccessor" => "m_browserDebuggerAgent",
 };
 $typeTransform{"Database"} = {
     "forward" => "InspectorDatabaseAgent",
     "header" => "InspectorDatabaseAgent.h",
-    "domainAccessor" => "m_inspectorAgent->databaseAgent()",
+    "domainAccessor" => "m_databaseAgent",
 };
 $typeTransform{"DOM"} = {
     "forward" => "InspectorDOMAgent",
     "header" => "InspectorDOMAgent.h",
-    "domainAccessor" => "m_inspectorAgent->domAgent()",
+    "domainAccessor" => "m_domAgent",
 };
 $typeTransform{"DOMStorage"} = {
     "forward" => "InspectorDOMStorageAgent",
     "header" => "InspectorDOMStorageAgent.h",
-    "domainAccessor" => "m_inspectorAgent->domStorageAgent()",
+    "domainAccessor" => "m_domStorageAgent",
 };
 $typeTransform{"FileSystem"} = {
     "forward" => "InspectorFileSystemAgent",
     "header" => "InspectorFileSystemAgent.h",
-    "domainAccessor" => "m_inspectorAgent->fileSystemAgent()",
+    "domainAccessor" => "m_fileSystemAgent",
 };
 $typeTransform{"Inspector"} = {
-    "forwardHeader" => "InspectorAgent.h",
+    "forward" => "InspectorAgent",
+    "header" => "InspectorAgent.h",
     "domainAccessor" => "m_inspectorAgent",
 };
 $typeTransform{"Network"} = {
     "forward" => "InspectorResourceAgent",
     "header" => "InspectorResourceAgent.h",
-    "domainAccessor" => "m_inspectorAgent->resourceAgent()",
+    "domainAccessor" => "m_resourceAgent",
 };
 $typeTransform{"Profiler"} = {
     "forward" => "InspectorProfilerAgent",
     "header" => "InspectorProfilerAgent.h",
-    "domainAccessor" => "m_inspectorAgent->profilerAgent()",
+    "domainAccessor" => "m_profilerAgent",
 };
 $typeTransform{"Runtime"} = {
     "forward" => "InspectorRuntimeAgent",
     "header" => "InspectorRuntimeAgent.h",
-    "domainAccessor" => "m_inspectorAgent->runtimeAgent()",
+    "domainAccessor" => "m_runtimeAgent",
 };
 $typeTransform{"Timeline"} = {
     "forward" => "InspectorTimelineAgent",
     "header" => "InspectorTimelineAgent.h",
-    "domainAccessor" => "m_inspectorAgent->timelineAgent()",
+    "domainAccessor" => "m_timelineAgent",
 };
 
 $typeTransform{"Frontend"} = {
@@ -215,8 +221,9 @@ my %backendMethodSignatures;
 my $backendConstructor;
 my @backendConstantDeclarations;
 my @backendConstantDefinitions;
-my $backendFooter;
+my @backendFooter;
 my @backendJSStubs;
+my %backendDomains;
 
 my $frontendClassName;
 my %frontendTypes;
@@ -269,13 +276,6 @@ sub GenerateModule
 
     $backendClassName = "InspectorBackendDispatcher";
     $backendJSStubName = "InspectorBackendStub";
-    my @backendHead;
-    push(@backendHead, "    ${backendClassName}(InspectorAgent* inspectorAgent) : m_inspectorAgent(inspectorAgent) { }");
-    push(@backendHead, "    void reportProtocolError(const long callId, const String& errorText) const;");
-    push(@backendHead, "    void dispatch(const String& message);");
-    push(@backendHead, "    static bool getCommandName(const String& message, String* result);");
-    $backendConstructor = join("\n", @backendHead);
-    $backendFooter = "    InspectorAgent* m_inspectorAgent;";
     $backendTypes{"Inspector"} = 1;
     $backendTypes{"InspectorClient"} = 1;
     $backendTypes{"PassRefPtr"} = 1;
@@ -418,7 +418,6 @@ sub generateDocumentationEvent
 
     push(@lines, "<pre style='background: lightGrey; padding: 10px'>");
     push(@lines, "{");
-    push(@lines, "    seq: &lt;number&gt;,");
     push(@lines, "    type: \"event\",");
     push(@lines, "    domain: \"$domain\",");
     if (scalar(@argsFiltered)) {
@@ -476,12 +475,16 @@ sub generateBackendFunction
     my $domain = $interface->name;
     my $domainAccessor = typeTraits($domain, "domainAccessor");
     $backendTypes{$domain} = 1;
+    $backendDomains{$domain} = 1;
     push(@function, "    if (!$domainAccessor)");
     push(@function, "        protocolErrors->pushString(\"Protocol Error: $domain handler is not available.\");");
     push(@function, "");
 
     # declare local variables for out arguments.
     push(@function, map("    " . typeTraits($_->type, "variable") . " " . $_->name . " = " . typeTraits($_->type, "defaultValue") . ";", @outArgs));
+    push(@function, "");
+    push(@function, "    ErrorString error;");
+    push(@function, "");
 
     my $indent = "";
     if (scalar(@inArgs)) {
@@ -497,12 +500,9 @@ sub generateBackendFunction
         $indent = "    ";
     }
 
-    push(@function, "$indent    ErrorString error;");
     my $args = join(", ", ("&error", map($_->name, @inArgs), map("&" . $_->name, @outArgs)));
     push(@function, "$indent    if (!protocolErrors->length())");
     push(@function, "$indent        $domainAccessor->$functionName($args);");
-    push(@function, "$indent    if (error.length())");
-    push(@function, "$indent        protocolErrors->pushString(error);");
     if (scalar(@inArgs)) {
         push(@function, "    } else {");
         push(@function, "        protocolErrors->pushString(\"Protocol Error: 'arguments' property with type 'object' was not found.\");");
@@ -510,20 +510,22 @@ sub generateBackendFunction
     }
 
     push(@function, "    // use InspectorFrontend as a marker of WebInspector availability");
-    push(@function, "    if ((callId || protocolErrors->length()) && m_inspectorAgent->hasFrontend()) {");
+    push(@function, "    if (callId || protocolErrors->length()) {");
     push(@function, "        RefPtr<InspectorObject> responseMessage = InspectorObject::create();");
-    push(@function, "        responseMessage->setNumber(\"seq\", callId);");
+    push(@function, "        responseMessage->setNumber(\"requestId\", callId);");
     push(@function, "");
     push(@function, "        if (protocolErrors->length())");
-    push(@function, "            responseMessage->setArray(\"errors\", protocolErrors);");
+    push(@function, "            responseMessage->setArray(\"protocolErrors\", protocolErrors);");
     if (scalar(@outArgs)) {
         push(@function, "        else {");
+        push(@function, "            if (error.length())");
+        push(@function, "                responseMessage->setString(\"error\", error);");
         push(@function, "            RefPtr<InspectorObject> responseBody = InspectorObject::create();");
         push(@function, map("            responseBody->set" . typeTraits($_->type, "JSONType") . "(\"" . $_->name . "\", " . $_->name . ");", @outArgs));
         push(@function, "            responseMessage->setObject(\"body\", responseBody);");
         push(@function, "        }");
     }
-    push(@function, "        m_inspectorAgent->inspectorClient()->sendMessageToFrontend(responseMessage->toJSONString());");
+    push(@function, "        m_inspectorClient->sendMessageToFrontend(responseMessage->toJSONString());");
     push(@function, "    }");
 
 
@@ -551,7 +553,7 @@ sub generateDocumentationCommand
     my @inArgs = grep($_->direction eq "in" && !($_->name eq "callId") , @{$function->parameters});
     push(@lines, "<pre style='background: lightGrey; padding: 10px'>");
     push(@lines, "request: {");
-    push(@lines, "    seq: &lt;number&gt;,");
+    push(@lines, "    id: &lt;number&gt;,");
     push(@lines, "    type: \"request\",");
     push(@lines, "    domain: \"" . $interface->name . "\",");
     if (scalar(@inArgs)) {
@@ -571,7 +573,7 @@ sub generateDocumentationCommand
     my @outArgs = grep($_->direction eq "out", @{$function->parameters});    
     push(@lines, "");
     push(@lines, "response: {");
-    push(@lines, "    seq: &lt;number&gt;,");
+    push(@lines, "    requestId: &lt;number&gt;,");
     if (scalar(@outArgs)) {
         push(@lines, "    type: \"response\",");
         push(@lines, "    body: {");
@@ -597,11 +599,11 @@ sub generateBackendReportProtocolError
 void ${backendClassName}::reportProtocolError(const long callId, const String& errorText) const
 {
     RefPtr<InspectorObject> message = InspectorObject::create();
-    message->setNumber("seq", callId);
+    message->setNumber("requestId", callId);
     RefPtr<InspectorArray> errors = InspectorArray::create();
     errors->pushString(errorText);
-    message->setArray("errors", errors);
-    m_inspectorAgent->inspectorClient()->sendMessageToFrontend(message->toJSONString());
+    message->setArray("protocolErrors", errors);
+    m_inspectorClient->sendMessageToFrontend(message->toJSONString());
 }
 EOF
     return split("\n", $reportProtocolError);
@@ -700,14 +702,14 @@ $mapEntries
         return;
     }
 
-    RefPtr<InspectorValue> callIdValue = messageObject->get("seq");
+    RefPtr<InspectorValue> callIdValue = messageObject->get("id");
     if (!callIdValue) {
-        reportProtocolError(callId, "Protocol Error: Invalid message format. 'seq' property was not found in the request.");
+        reportProtocolError(callId, "Protocol Error: Invalid message format. 'id' property was not found in the request.");
         return;
     }
 
     if (!callIdValue->asNumber(&callId)) {
-        reportProtocolError(callId, "Protocol Error: Invalid message format. The type of 'seq' property should be number.");
+        reportProtocolError(callId, "Protocol Error: Invalid message format. The type of 'id' property should be number.");
         return;
     }
 
@@ -761,7 +763,7 @@ sub collectBackendJSStubFunctions
         my $name = $function->signature->name;
         my $argumentNames = join(",", map("\"" . $_->name . "\": \"" . typeTraits($_->type, "JSType") . "\"", grep($_->direction eq "in", @{$function->parameters})));
         push(@backendJSStubs, "    this._registerDelegate('{" .
-            "\"seq\": 0, " .
+            "\"id\": 0, " .
             "\"domain\": \"$domain\", " .
             "\"command\": \"$name\", " .
             "\"arguments\": {$argumentNames}" .
@@ -827,7 +829,7 @@ InspectorBackendStub.prototype = {
             }
             callback = args[0];
         }
-        request.seq = this._wrap(callback || function() {});
+        request.id = this._wrap(callback || function() {});
 
         if (window.dumpInspectorProtocolMessages)
             console.log("frontend: " + JSON.stringify(request));
@@ -855,14 +857,19 @@ InspectorBackendStub.prototype = {
             for (var key in messageObject.body)
                 arguments.push(messageObject.body[key]);
 
-        if ("seq" in messageObject) { // just a response for some request
-            if (!messageObject.errors)
-                this._callbacks[messageObject.seq].apply(null, arguments);
-            else
+        if ("requestId" in messageObject) { // just a response for some request
+            if (messageObject.protocolErrors)
                 this.reportProtocolError(messageObject);
 
-            --this._pendingResponsesCount;
-            delete this._callbacks[messageObject.seq];
+            var callback = this._callbacks[messageObject.requestId];
+            if (callback) {
+                if (!messageObject.protocolErrors) {
+                    arguments.unshift(messageObject.error);
+                    callback.apply(null, arguments);
+                }
+                --this._pendingResponsesCount;
+                delete this._callbacks[messageObject.requestId];
+            }
 
             if (this._scripts && !this._pendingResponsesCount)
                 this.runAfterPendingDispatches();
@@ -880,15 +887,16 @@ InspectorBackendStub.prototype = {
                 console.error("Protocol Error: Attempted to dispatch an unimplemented method '" + messageObject.domain + "." + messageObject.event + "'");
                 return;
             }
+
             dispatcher[messageObject.event].apply(dispatcher, arguments);
         }
     },
 
     reportProtocolError: function(messageObject)
     {
-        console.error("Protocol Error: InspectorBackend request with seq = " + messageObject.seq + " failed.");
-        for (var i = 0; i < messageObject.errors.length; ++i)
-            console.error("    " + messageObject.errors[i]);
+        console.error("Protocol Error: InspectorBackend request with id = " + messageObject.requestId + " failed.");
+        for (var i = 0; i < messageObject.protocolErrors.length; ++i)
+            console.error("    " + messageObject.protocolErrors[i]);
     },
 
     runAfterPendingDispatches: function(script)
@@ -1032,6 +1040,39 @@ sub parameterDocLine
     return $result;
 }
 
+sub generateBackendAgentFieldsAndConstructor
+{
+    my @arguments;
+    my @fieldInitializers;
+
+    push(@arguments, "InspectorClient* inspectorClient");
+    push(@fieldInitializers, "        : m_inspectorClient(inspectorClient)");
+    push(@backendFooter, "    InspectorClient* m_inspectorClient;");
+
+    foreach my $domain (sort keys %backendDomains) {
+        # Add agent field declaration to the footer.
+        my $agentClassName = typeTraits($domain, "forward");
+        my $field = typeTraits($domain, "domainAccessor");
+        push(@backendFooter, "    ${agentClassName}* ${field};");
+
+        # Add agent parameter and initializer.
+        my $arg = substr($field, 2);
+        push(@fieldInitializers, "        , ${field}(${arg})");
+        push(@arguments, "${agentClassName}* ${arg}");
+    }
+
+    my $argumentString = join(", ", @arguments);
+
+    my @backendHead;
+    push(@backendHead, "    ${backendClassName}(${argumentString})");
+    push(@backendHead, @fieldInitializers);
+    push(@backendHead, "    { }");
+    push(@backendHead, "    void reportProtocolError(const long callId, const String& errorText) const;");
+    push(@backendHead, "    void dispatch(const String& message);");
+    push(@backendHead, "    static bool getCommandName(const String& message, String* result);");
+    $backendConstructor = join("\n", @backendHead);
+}
+
 sub finish
 {
     my $object = shift;
@@ -1059,6 +1100,7 @@ sub finish
             push(@backendMethodsImpl, generateArgumentGetters($type));
         }
     }
+    generateBackendAgentFieldsAndConstructor();
 
     push(@backendMethodsImpl, generateBackendMessageParser());
     push(@backendMethodsImpl, "");
@@ -1071,7 +1113,7 @@ sub finish
     undef($SOURCE);
 
     open($HEADER, ">$outputHeadersDir/$backendClassName.h") || die "Couldn't open file $outputHeadersDir/$backendClassName.h";
-    print $HEADER join("\n", generateHeader($backendClassName, \%backendTypes, $backendConstructor, \@backendConstantDeclarations, \@backendMethods, $backendFooter));
+    print $HEADER join("\n", generateHeader($backendClassName, \%backendTypes, $backendConstructor, \@backendConstantDeclarations, \@backendMethods, join("\n", @backendFooter)));
     close($HEADER);
     undef($HEADER);
 
diff --git a/Source/WebCore/inspector/ConsoleMessage.cpp b/Source/WebCore/inspector/ConsoleMessage.cpp
index 63fb020..de61ef8 100644
--- a/Source/WebCore/inspector/ConsoleMessage.cpp
+++ b/Source/WebCore/inspector/ConsoleMessage.cpp
@@ -35,7 +35,7 @@
 
 #include "Console.h"
 #include "InjectedScript.h"
-#include "InjectedScriptHost.h"
+#include "InjectedScriptManager.h"
 #include "InspectorFrontend.h"
 #include "InspectorValues.h"
 #include "ScriptArguments.h"
@@ -86,7 +86,7 @@ ConsoleMessage::~ConsoleMessage()
 {
 }
 
-void ConsoleMessage::addToFrontend(InspectorFrontend::Console* frontend, InjectedScriptHost* injectedScriptHost)
+void ConsoleMessage::addToFrontend(InspectorFrontend::Console* frontend, InjectedScriptManager* injectedScriptManager)
 {
     RefPtr<InspectorObject> jsonObj = InspectorObject::create();
     jsonObj->setNumber("source", static_cast<int>(m_source));
@@ -99,7 +99,7 @@ void ConsoleMessage::addToFrontend(InspectorFrontend::Console* frontend, Injecte
     if (m_type == NetworkErrorMessageType) 
         jsonObj->setNumber("requestId", m_requestId);
     if (m_arguments && m_arguments->argumentCount()) {
-        InjectedScript injectedScript = injectedScriptHost->injectedScriptFor(m_arguments->globalState());
+        InjectedScript injectedScript = injectedScriptManager->injectedScriptFor(m_arguments->globalState());
         if (!injectedScript.hasNoValue()) {
             RefPtr<InspectorArray> jsonArgs = InspectorArray::create();
             for (unsigned i = 0; i < m_arguments->argumentCount(); ++i) {
@@ -114,13 +114,13 @@ void ConsoleMessage::addToFrontend(InspectorFrontend::Console* frontend, Injecte
         }
     }
     if (m_callStack)
-        jsonObj->setArray("stackTrace", m_callStack->buildInspectorObject());
-    frontend->addConsoleMessage(jsonObj);
+        jsonObj->setArray("stackTrace", m_callStack->buildInspectorArray());
+    frontend->consoleMessage(jsonObj);
 }
 
 void ConsoleMessage::updateRepeatCountInConsole(InspectorFrontend::Console* frontend)
 {
-    frontend->updateConsoleMessageRepeatCount(m_repeatCount);
+    frontend->consoleMessageRepeatCountUpdated(m_repeatCount);
 }
 
 bool ConsoleMessage::isEqual(ConsoleMessage* msg) const
diff --git a/Source/WebCore/inspector/ConsoleMessage.h b/Source/WebCore/inspector/ConsoleMessage.h
index 26e5675..4e6f115 100644
--- a/Source/WebCore/inspector/ConsoleMessage.h
+++ b/Source/WebCore/inspector/ConsoleMessage.h
@@ -39,7 +39,7 @@
 #include <wtf/Vector.h>
 
 namespace WebCore {
-class InjectedScriptHost;
+class InjectedScriptManager;
 class InspectorFrontend;
 class InspectorObject;
 class ScriptArguments;
@@ -55,13 +55,14 @@ public:
     ConsoleMessage(MessageSource, MessageType, MessageLevel, const String& m, const String& responseUrl, unsigned long identifier);
     ~ConsoleMessage();
 
-    void addToFrontend(InspectorFrontend::Console*, InjectedScriptHost*);
+    void addToFrontend(InspectorFrontend::Console*, InjectedScriptManager*);
     void updateRepeatCountInConsole(InspectorFrontend::Console*);
     void incrementCount() { ++m_repeatCount; }
     bool isEqual(ConsoleMessage* msg) const;
 
     MessageSource source() const { return m_source; }
     const String& message() const { return m_message; }
+    MessageType type() const { return m_type; }
 
 private:
     MessageSource m_source;
diff --git a/Source/WebCore/inspector/DOMNodeHighlighter.cpp b/Source/WebCore/inspector/DOMNodeHighlighter.cpp
new file mode 100644
index 0000000..c87649b
--- /dev/null
+++ b/Source/WebCore/inspector/DOMNodeHighlighter.cpp
@@ -0,0 +1,292 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "DOMNodeHighlighter.h"
+
+#if ENABLE(INSPECTOR)
+
+#include "Element.h"
+#include "Frame.h"
+#include "FrameView.h"
+#include "GraphicsContext.h"
+#include "Page.h"
+#include "Range.h"
+#include "RenderInline.h"
+#include "Settings.h"
+#include "StyledElement.h"
+#include "TextRun.h"
+
+namespace WebCore {
+
+namespace {
+
+Path quadToPath(const FloatQuad& quad)
+{
+    Path quadPath;
+    quadPath.moveTo(quad.p1());
+    quadPath.addLineTo(quad.p2());
+    quadPath.addLineTo(quad.p3());
+    quadPath.addLineTo(quad.p4());
+    quadPath.closeSubpath();
+    return quadPath;
+}
+
+void drawOutlinedQuad(GraphicsContext& context, const FloatQuad& quad, const Color& fillColor)
+{
+    static const int outlineThickness = 2;
+    static const Color outlineColor(62, 86, 180, 228);
+
+    Path quadPath = quadToPath(quad);
+
+    // Clip out the quad, then draw with a 2px stroke to get a pixel
+    // of outline (because inflating a quad is hard)
+    {
+        context.save();
+        context.clipOut(quadPath);
+
+        context.setStrokeThickness(outlineThickness);
+        context.setStrokeColor(outlineColor, ColorSpaceDeviceRGB);
+        context.strokePath(quadPath);
+
+        context.restore();
+    }
+
+    // Now do the fill
+    context.setFillColor(fillColor, ColorSpaceDeviceRGB);
+    context.fillPath(quadPath);
+}
+
+void drawOutlinedQuadWithClip(GraphicsContext& context, const FloatQuad& quad, const FloatQuad& clipQuad, const Color& fillColor)
+{
+    context.save();
+    Path clipQuadPath = quadToPath(clipQuad);
+    context.clipOut(clipQuadPath);
+    drawOutlinedQuad(context, quad, fillColor);
+    context.restore();
+}
+
+void drawHighlightForBox(GraphicsContext& context, const FloatQuad& contentQuad, const FloatQuad& paddingQuad, const FloatQuad& borderQuad, const FloatQuad& marginQuad)
+{
+    static const Color contentBoxColor(125, 173, 217, 128);
+    static const Color paddingBoxColor(125, 173, 217, 160);
+    static const Color borderBoxColor(125, 173, 217, 192);
+    static const Color marginBoxColor(125, 173, 217, 228);
+
+    if (marginQuad != borderQuad)
+        drawOutlinedQuadWithClip(context, marginQuad, borderQuad, marginBoxColor);
+    if (borderQuad != paddingQuad)
+        drawOutlinedQuadWithClip(context, borderQuad, paddingQuad, borderBoxColor);
+    if (paddingQuad != contentQuad)
+        drawOutlinedQuadWithClip(context, paddingQuad, contentQuad, paddingBoxColor);
+
+    drawOutlinedQuad(context, contentQuad, contentBoxColor);
+}
+
+void drawHighlightForLineBoxesOrSVGRenderer(GraphicsContext& context, const Vector<FloatQuad>& lineBoxQuads)
+{
+    static const Color lineBoxColor(125, 173, 217, 128);
+
+    for (size_t i = 0; i < lineBoxQuads.size(); ++i)
+        drawOutlinedQuad(context, lineBoxQuads[i], lineBoxColor);
+}
+
+inline IntSize frameToMainFrameOffset(Frame* frame)
+{
+    IntPoint mainFramePoint = frame->page()->mainFrame()->view()->windowToContents(frame->view()->contentsToWindow(IntPoint()));
+    return mainFramePoint - IntPoint();
+}
+
+void drawElementTitle(GraphicsContext& context, Node* node, const IntRect& boundingBox, const IntRect& anchorBox, const FloatRect& overlayRect, WebCore::Settings* settings)
+{
+    static const int rectInflatePx = 4;
+    static const int fontHeightPx = 12;
+    static const int borderWidthPx = 1;
+    static const Color tooltipBackgroundColor(255, 255, 194, 255);
+    static const Color tooltipBorderColor(Color::black);
+    static const Color tooltipFontColor(Color::black);
+
+    Element* element = static_cast<Element*>(node);
+    bool isXHTML = element->document()->isXHTMLDocument();
+    String nodeTitle = isXHTML ? element->nodeName() : element->nodeName().lower();
+    const AtomicString& idValue = element->getIdAttribute();
+    if (!idValue.isNull() && !idValue.isEmpty()) {
+        nodeTitle += "#";
+        nodeTitle += idValue;
+    }
+    if (element->hasClass() && element->isStyledElement()) {
+        const SpaceSplitString& classNamesString = static_cast<StyledElement*>(element)->classNames();
+        size_t classNameCount = classNamesString.size();
+        if (classNameCount) {
+            HashSet<AtomicString> usedClassNames;
+            for (size_t i = 0; i < classNameCount; ++i) {
+                const AtomicString& className = classNamesString[i];
+                if (usedClassNames.contains(className))
+                    continue;
+                usedClassNames.add(className);
+                nodeTitle += ".";
+                nodeTitle += className;
+            }
+        }
+    }
+
+    nodeTitle += " [";
+    nodeTitle += String::number(boundingBox.width());
+    nodeTitle.append(static_cast<UChar>(0x00D7)); // &times;
+    nodeTitle += String::number(boundingBox.height());
+    nodeTitle += "]";
+
+    FontDescription desc;
+    FontFamily family;
+    family.setFamily(settings->fixedFontFamily());
+    desc.setFamily(family);
+    desc.setComputedSize(fontHeightPx);
+    Font font = Font(desc, 0, 0);
+    font.update(0);
+
+    TextRun nodeTitleRun(nodeTitle);
+    IntPoint titleBasePoint = IntPoint(anchorBox.x(), anchorBox.maxY() - 1);
+    titleBasePoint.move(rectInflatePx, rectInflatePx);
+    IntRect titleRect = enclosingIntRect(font.selectionRectForText(nodeTitleRun, titleBasePoint, fontHeightPx));
+    titleRect.inflate(rectInflatePx);
+
+    // The initial offsets needed to compensate for a 1px-thick border stroke (which is not a part of the rectangle).
+    int dx = -borderWidthPx;
+    int dy = borderWidthPx;
+
+    // If the tip sticks beyond the right of overlayRect, right-align the tip with the said boundary.
+    if (titleRect.maxX() > overlayRect.maxX())
+        dx = overlayRect.maxX() - titleRect.maxX();
+
+    // If the tip sticks beyond the left of overlayRect, left-align the tip with the said boundary.
+    if (titleRect.x() + dx < overlayRect.x())
+        dx = overlayRect.x() - titleRect.x() - borderWidthPx;
+
+    // If the tip sticks beyond the bottom of overlayRect, show the tip at top of bounding box.
+    if (titleRect.maxY() > overlayRect.maxY()) {
+        dy = anchorBox.y() - titleRect.maxY() - borderWidthPx;
+        // If the tip still sticks beyond the bottom of overlayRect, bottom-align the tip with the said boundary.
+        if (titleRect.maxY() + dy > overlayRect.maxY())
+            dy = overlayRect.maxY() - titleRect.maxY();
+    }
+
+    // If the tip sticks beyond the top of overlayRect, show the tip at top of overlayRect.
+    if (titleRect.y() + dy < overlayRect.y())
+        dy = overlayRect.y() - titleRect.y() + borderWidthPx;
+
+    titleRect.move(dx, dy);
+    context.setStrokeColor(tooltipBorderColor, ColorSpaceDeviceRGB);
+    context.setStrokeThickness(borderWidthPx);
+    context.setFillColor(tooltipBackgroundColor, ColorSpaceDeviceRGB);
+    context.drawRect(titleRect);
+    context.setFillColor(tooltipFontColor, ColorSpaceDeviceRGB);
+    context.drawText(font, nodeTitleRun, IntPoint(titleRect.x() + rectInflatePx, titleRect.y() + font.fontMetrics().height()));
+}
+
+} // anonymous namespace
+
+namespace DOMNodeHighlighter {
+
+void DrawNodeHighlight(GraphicsContext& context, Node* node)
+{
+    RenderObject* renderer = node->renderer();
+    Frame* containingFrame = node->document()->frame();
+
+    if (!renderer || !containingFrame)
+        return;
+
+    IntSize mainFrameOffset = frameToMainFrameOffset(containingFrame);
+    IntRect boundingBox = renderer->absoluteBoundingBoxRect(true);
+
+    boundingBox.move(mainFrameOffset);
+
+    IntRect titleAnchorBox = boundingBox;
+
+    FrameView* view = containingFrame->page()->mainFrame()->view();
+    FloatRect overlayRect = view->visibleContentRect();
+    if (!overlayRect.contains(boundingBox) && !boundingBox.contains(enclosingIntRect(overlayRect)))
+        overlayRect = view->visibleContentRect();
+    context.translate(-overlayRect.x(), -overlayRect.y());
+
+    // RenderSVGRoot should be highlighted through the isBox() code path, all other SVG elements should just dump their absoluteQuads().
+#if ENABLE(SVG)
+    bool isSVGRenderer = renderer->node() && renderer->node()->isSVGElement() && !renderer->isSVGRoot();
+#else
+    bool isSVGRenderer = false;
+#endif
+
+    if (renderer->isBox() && !isSVGRenderer) {
+        RenderBox* renderBox = toRenderBox(renderer);
+
+        IntRect contentBox = renderBox->contentBoxRect();
+
+        IntRect paddingBox(contentBox.x() - renderBox->paddingLeft(), contentBox.y() - renderBox->paddingTop(),
+                           contentBox.width() + renderBox->paddingLeft() + renderBox->paddingRight(), contentBox.height() + renderBox->paddingTop() + renderBox->paddingBottom());
+        IntRect borderBox(paddingBox.x() - renderBox->borderLeft(), paddingBox.y() - renderBox->borderTop(),
+                          paddingBox.width() + renderBox->borderLeft() + renderBox->borderRight(), paddingBox.height() + renderBox->borderTop() + renderBox->borderBottom());
+        IntRect marginBox(borderBox.x() - renderBox->marginLeft(), borderBox.y() - renderBox->marginTop(),
+                          borderBox.width() + renderBox->marginLeft() + renderBox->marginRight(), borderBox.height() + renderBox->marginTop() + renderBox->marginBottom());
+
+
+        FloatQuad absContentQuad = renderBox->localToAbsoluteQuad(FloatRect(contentBox));
+        FloatQuad absPaddingQuad = renderBox->localToAbsoluteQuad(FloatRect(paddingBox));
+        FloatQuad absBorderQuad = renderBox->localToAbsoluteQuad(FloatRect(borderBox));
+        FloatQuad absMarginQuad = renderBox->localToAbsoluteQuad(FloatRect(marginBox));
+
+        absContentQuad.move(mainFrameOffset);
+        absPaddingQuad.move(mainFrameOffset);
+        absBorderQuad.move(mainFrameOffset);
+        absMarginQuad.move(mainFrameOffset);
+
+        titleAnchorBox = absMarginQuad.enclosingBoundingBox();
+
+        drawHighlightForBox(context, absContentQuad, absPaddingQuad, absBorderQuad, absMarginQuad);
+    } else if (renderer->isRenderInline() || isSVGRenderer) {
+        // FIXME: We should show margins/padding/border for inlines.
+        Vector<FloatQuad> lineBoxQuads;
+        renderer->absoluteQuads(lineBoxQuads);
+        for (unsigned i = 0; i < lineBoxQuads.size(); ++i)
+            lineBoxQuads[i] += mainFrameOffset;
+
+        drawHighlightForLineBoxesOrSVGRenderer(context, lineBoxQuads);
+    }
+
+    // Draw node title if necessary.
+
+    if (!node->isElementNode())
+        return;
+
+    WebCore::Settings* settings = containingFrame->settings();
+    drawElementTitle(context, node, boundingBox, titleAnchorBox, overlayRect, settings);
+}
+
+} // namespace DOMNodeHighlighter
+
+} // namespace WebCore
+
+#endif // ENABLE(INSPECTOR)
diff --git a/Source/WebKit/win/DOMCreateInstance.h b/Source/WebCore/inspector/DOMNodeHighlighter.h
index a733e84..1de1eec 100644
--- a/Source/WebKit/win/DOMCreateInstance.h
+++ b/Source/WebCore/inspector/DOMNodeHighlighter.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007 Apple Inc. All rights reserved.
+ * Copyright (C) 2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -26,13 +26,21 @@
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef DOMCreateInstance_h
-#define DOMCreateInstance_h
+#ifndef DOMNodeHighlighter_h
+#define DOMNodeHighlighter_h
 
-class GEN_DOMObject;
+namespace WebCore {
 
-GEN_DOMObject* getDOMWrapper(void* objectHandle);
-void setDOMWrapper(void* objectHandle, GEN_DOMObject* wrapper);
-void removeDOMWrapper(void* objectHandle);
+class GraphicsContext;
+class Node;
 
-#endif // DOMCreateInstance_h
+namespace DOMNodeHighlighter {
+
+void DrawNodeHighlight(GraphicsContext&, Node*);
+
+} // namespace DOMNodeHighlighter
+
+} // namespace WebCore
+
+
+#endif // DOMNodeHighlighter_h
diff --git a/Source/WebCore/inspector/InjectedScript.cpp b/Source/WebCore/inspector/InjectedScript.cpp
index 6c115d0..ee2e35a 100644
--- a/Source/WebCore/inspector/InjectedScript.cpp
+++ b/Source/WebCore/inspector/InjectedScript.cpp
@@ -35,6 +35,7 @@
 
 #include "Frame.h"
 #include "InjectedScriptHost.h"
+#include "InjectedScriptManager.h"
 #include "InspectorValues.h"
 #include "Node.h"
 #include "PlatformString.h"
@@ -47,50 +48,56 @@ InjectedScript::InjectedScript(ScriptObject injectedScriptObject)
 {
 }
 
-void InjectedScript::evaluate(const String& expression, const String& objectGroup, bool includeCommandLineAPI, RefPtr<InspectorValue>* result)
+void InjectedScript::evaluate(ErrorString* errorString, const String& expression, const String& objectGroup, bool includeCommandLineAPI, RefPtr<InspectorObject>* result)
 {
     ScriptFunctionCall function(m_injectedScriptObject, "evaluate");
     function.appendArgument(expression);
     function.appendArgument(objectGroup);
     function.appendArgument(includeCommandLineAPI);
-    makeCall(function, result);
+    makeObjectCall(errorString, function, result);
 }
 
-void InjectedScript::evaluateOn(PassRefPtr<InspectorObject> objectId, const String& expression, RefPtr<InspectorValue>* result)
+void InjectedScript::evaluateOn(ErrorString* errorString, const String& objectId, const String& expression, RefPtr<InspectorObject>* result)
 {
     ScriptFunctionCall function(m_injectedScriptObject, "evaluateOn");
-    function.appendArgument(objectId->toJSONString());
+    function.appendArgument(objectId);
     function.appendArgument(expression);
-    makeCall(function, result);
+    makeObjectCall(errorString, function, result);
 }
 
-void InjectedScript::evaluateOnCallFrame(PassRefPtr<InspectorObject> callFrameId, const String& expression, const String& objectGroup, bool includeCommandLineAPI, RefPtr<InspectorValue>* result)
+void InjectedScript::evaluateOnCallFrame(ErrorString* errorString, const String& callFrameId, const String& expression, const String& objectGroup, bool includeCommandLineAPI, RefPtr<InspectorObject>* result)
 {
     ScriptFunctionCall function(m_injectedScriptObject, "evaluateOnCallFrame");
-    function.appendArgument(callFrameId->toJSONString());
+    function.appendArgument(callFrameId);
     function.appendArgument(expression);
     function.appendArgument(objectGroup);
     function.appendArgument(includeCommandLineAPI);
-    makeCall(function, result);
+    makeObjectCall(errorString, function, result);
 }
 
-void InjectedScript::getProperties(PassRefPtr<InspectorObject> objectId, bool ignoreHasOwnProperty, bool abbreviate, RefPtr<InspectorValue>* result)
+void InjectedScript::getProperties(ErrorString* errorString, const String& objectId, bool ignoreHasOwnProperty, bool abbreviate, RefPtr<InspectorArray>* properties)
 {
     ScriptFunctionCall function(m_injectedScriptObject, "getProperties");
-    String objectIdString = objectId->toJSONString();
-    function.appendArgument(objectIdString);
+    function.appendArgument(objectId);
     function.appendArgument(ignoreHasOwnProperty);
     function.appendArgument(abbreviate);
-    makeCall(function, result);
+
+    RefPtr<InspectorValue> result; 
+    makeCall(function, &result);
+    if (!result || result->type() != InspectorValue::TypeArray) {
+        *errorString = "Internal error.";
+        return;
+    }
+    *properties = result->asArray();
 }
 
-Node* InjectedScript::nodeForObjectId(PassRefPtr<InspectorObject> objectId)
+Node* InjectedScript::nodeForObjectId(const String& objectId)
 {
     if (hasNoValue() || !canAccessInspectedWindow())
         return 0;
 
     ScriptFunctionCall function(m_injectedScriptObject, "nodeForObjectId");
-    function.appendArgument(objectId->toJSONString());
+    function.appendArgument(objectId);
 
     bool hadException = false;
     ScriptValue resultValue = function.call(hadException);
@@ -99,37 +106,35 @@ Node* InjectedScript::nodeForObjectId(PassRefPtr<InspectorObject> objectId)
     return InjectedScriptHost::scriptValueAsNode(resultValue);
 }
 
-void InjectedScript::resolveNode(long nodeId, RefPtr<InspectorValue>* result)
-{
-    ScriptFunctionCall function(m_injectedScriptObject, "resolveNode");
-    function.appendArgument(nodeId);
-    makeCall(function, result);
-}
-
-void InjectedScript::setPropertyValue(PassRefPtr<InspectorObject> objectId, const String& propertyName, const String& expression, RefPtr<InspectorValue>* result)
+void InjectedScript::setPropertyValue(ErrorString* errorString, const String& objectId, const String& propertyName, const String& expression)
 {
     ScriptFunctionCall function(m_injectedScriptObject, "setPropertyValue");
-    function.appendArgument(objectId->toJSONString());
+    function.appendArgument(objectId);
     function.appendArgument(propertyName);
     function.appendArgument(expression);
-    makeCall(function, result);
+    RefPtr<InspectorValue> result;
+    makeCall(function, &result);
+    result->asString(errorString);
 }
 
-void InjectedScript::releaseObject(PassRefPtr<InspectorObject> objectId)
+void InjectedScript::releaseObject(const String& objectId)
 {
     ScriptFunctionCall function(m_injectedScriptObject, "releaseObject");
-    function.appendArgument(objectId->toJSONString());
+    function.appendArgument(objectId);
     RefPtr<InspectorValue> result;
     makeCall(function, &result);
 }
 
 #if ENABLE(JAVASCRIPT_DEBUGGER)
-PassRefPtr<InspectorValue> InjectedScript::callFrames()
+PassRefPtr<InspectorArray> InjectedScript::callFrames()
 {
     ASSERT(!hasNoValue());
     ScriptFunctionCall function(m_injectedScriptObject, "callFrames");
     ScriptValue callFramesValue = function.call();
-    return callFramesValue.toInspectorValue(m_injectedScriptObject.scriptState());
+    RefPtr<InspectorValue> result = callFramesValue.toInspectorValue(m_injectedScriptObject.scriptState());
+    if (result->type() == InspectorValue::TypeArray)
+        return result->asArray();
+    return InspectorArray::create();
 }
 #endif
 
@@ -150,9 +155,9 @@ PassRefPtr<InspectorObject> InjectedScript::wrapObject(ScriptValue value, const
     return r.toInspectorValue(m_injectedScriptObject.scriptState())->asObject();
 }
 
-PassRefPtr<InspectorObject> InjectedScript::wrapNode(Node* node, const String& groupName)
+PassRefPtr<InspectorObject> InjectedScript::wrapNode(Node* node)
 {
-    return wrapObject(nodeAsScriptValue(node), groupName);
+    return wrapObject(nodeAsScriptValue(node), "");
 }
 
 void InjectedScript::inspectNode(Node* node)
@@ -174,7 +179,7 @@ void InjectedScript::releaseObjectGroup(const String& objectGroup)
 
 bool InjectedScript::canAccessInspectedWindow()
 {
-    return InjectedScriptHost::canAccessInspectedWindow(m_injectedScriptObject.scriptState());
+    return InjectedScriptManager::canAccessInspectedWindow(m_injectedScriptObject.scriptState());
 }
 
 void InjectedScript::makeCall(ScriptFunctionCall& function, RefPtr<InspectorValue>* result)
@@ -191,7 +196,23 @@ void InjectedScript::makeCall(ScriptFunctionCall& function, RefPtr<InspectorValu
     if (!hadException)
         *result = resultValue.toInspectorValue(m_injectedScriptObject.scriptState());
     else
-        *result = InspectorValue::null();
+        *result = InspectorString::create("Exception while making a call.");
+}
+
+void InjectedScript::makeObjectCall(ErrorString* errorString, ScriptFunctionCall& function, RefPtr<InspectorObject>* objectResult)
+{
+    RefPtr<InspectorValue> result;
+    makeCall(function, &result);
+    if (result && result->type() == InspectorValue::TypeString) {
+        result->asString(errorString);
+        return;
+    }
+
+    if (!result || result->type() != InspectorValue::TypeObject) {
+        *errorString = "Internal error.";
+        return;
+    }
+    *objectResult = result->asObject();
 }
 
 ScriptValue InjectedScript::nodeAsScriptValue(Node* node)
diff --git a/Source/WebCore/inspector/InjectedScript.h b/Source/WebCore/inspector/InjectedScript.h
index 33d5411..e165e9c 100644
--- a/Source/WebCore/inspector/InjectedScript.h
+++ b/Source/WebCore/inspector/InjectedScript.h
@@ -31,7 +31,7 @@
 #ifndef InjectedScript_h
 #define InjectedScript_h
 
-#include "InjectedScriptHost.h"
+#include "InjectedScriptManager.h"
 #include "ScriptObject.h"
 #include <wtf/Forward.h>
 #include <wtf/Noncopyable.h>
@@ -40,10 +40,14 @@
 
 namespace WebCore {
 
+class InspectorArray;
+class InspectorObject;
 class InspectorValue;
 class Node;
 class ScriptFunctionCall;
 
+typedef String ErrorString;
+
 class InjectedScript {
 public:
     InjectedScript() { }
@@ -51,31 +55,31 @@ public:
 
     bool hasNoValue() const { return m_injectedScriptObject.hasNoValue(); }
 
-    void evaluate(const String& expression, const String& objectGroup, bool includeCommandLineAPI, RefPtr<InspectorValue>* result);
-    void evaluateOn(PassRefPtr<InspectorObject> objectId, const String& expression, RefPtr<InspectorValue>* result);
-    void evaluateOnCallFrame(PassRefPtr<InspectorObject> callFrameId, const String& expression, const String& objectGroup, bool includeCommandLineAPI, RefPtr<InspectorValue>* result);
-    void getProperties(PassRefPtr<InspectorObject> objectId, bool ignoreHasOwnProperty, bool abbreviate, RefPtr<InspectorValue>* result);
-    Node* nodeForObjectId(PassRefPtr<InspectorObject> objectId);
-    void resolveNode(long nodeId, RefPtr<InspectorValue>* result);
-    void setPropertyValue(PassRefPtr<InspectorObject> objectId, const String& propertyName, const String& expression, RefPtr<InspectorValue>* result);
-    void releaseObject(PassRefPtr<InspectorObject> objectId);
-    
+    void evaluate(ErrorString*, const String& expression, const String& objectGroup, bool includeCommandLineAPI, RefPtr<InspectorObject>* result);
+    void evaluateOn(ErrorString*, const String& objectId, const String& expression, RefPtr<InspectorObject>* result);
+    void evaluateOnCallFrame(ErrorString*, const String& callFrameId, const String& expression, const String& objectGroup, bool includeCommandLineAPI, RefPtr<InspectorObject>* result);
+    void getProperties(ErrorString*, const String& objectId, bool ignoreHasOwnProperty, bool abbreviate, RefPtr<InspectorArray>* result);
+    Node* nodeForObjectId(const String& objectId);
+    void setPropertyValue(ErrorString*, const String& objectId, const String& propertyName, const String& expression);
+    void releaseObject(const String& objectId);
+
 #if ENABLE(JAVASCRIPT_DEBUGGER)
-    PassRefPtr<InspectorValue> callFrames();
+    PassRefPtr<InspectorArray> callFrames();
 #endif
 
     PassRefPtr<InspectorObject> wrapObject(ScriptValue, const String& groupName);
-    PassRefPtr<InspectorObject> wrapNode(Node*, const String& groupName);
+    PassRefPtr<InspectorObject> wrapNode(Node*);
     void inspectNode(Node*);
     void releaseObjectGroup(const String&);
     ScriptState* scriptState() const { return m_injectedScriptObject.scriptState(); }
 
 private:
-    friend InjectedScript InjectedScriptHost::injectedScriptFor(ScriptState*);
+    friend InjectedScript InjectedScriptManager::injectedScriptFor(ScriptState*);
     explicit InjectedScript(ScriptObject);
 
     bool canAccessInspectedWindow();
     void makeCall(ScriptFunctionCall&, RefPtr<InspectorValue>* result);
+    void makeObjectCall(ErrorString*, ScriptFunctionCall&, RefPtr<InspectorObject>* result);
     ScriptValue nodeAsScriptValue(Node*);
 
     ScriptObject m_injectedScriptObject;
diff --git a/Source/WebCore/inspector/InjectedScriptHost.cpp b/Source/WebCore/inspector/InjectedScriptHost.cpp
index ad4df45..a0bafdf 100644
--- a/Source/WebCore/inspector/InjectedScriptHost.cpp
+++ b/Source/WebCore/inspector/InjectedScriptHost.cpp
@@ -38,7 +38,6 @@
 #include "FrameLoader.h"
 #include "HTMLFrameOwnerElement.h"
 #include "InjectedScript.h"
-#include "InjectedScriptSource.h"
 #include "InspectorAgent.h"
 #include "InspectorClient.h"
 #include "InspectorConsoleAgent.h"
@@ -69,29 +68,40 @@ using namespace std;
 
 namespace WebCore {
 
-InjectedScriptHost::InjectedScriptHost(InspectorAgent* inspectorAgent)
-    : m_inspectorAgent(inspectorAgent)
-    , m_nextInjectedScriptId(1)
-    , m_lastWorkerId(1 << 31) // Distinguish ids of fake workers from real ones, to minimize the chances they overlap.
+PassRefPtr<InjectedScriptHost> InjectedScriptHost::create()
 {
+    return adoptRef(new InjectedScriptHost());
 }
 
-InjectedScriptHost::~InjectedScriptHost()
+InjectedScriptHost::InjectedScriptHost()
+    : m_inspectorAgent(0)
+    , m_consoleAgent(0)
+#if ENABLE(DATABASE)
+    , m_databaseAgent(0)
+#endif
+#if ENABLE(DOM_STORAGE)
+    , m_domStorageAgent(0)
+#endif
+    , m_frontend(0)
+    , m_lastWorkerId(1 << 31) // Distinguish ids of fake workers from real ones, to minimize the chances they overlap.
 {
 }
 
-void InjectedScriptHost::inspectImpl(PassRefPtr<InspectorValue> objectId, PassRefPtr<InspectorValue> hints)
+InjectedScriptHost::~InjectedScriptHost()
 {
-    if (InspectorFrontend* fe = frontend())
-        fe->inspector()->inspect(objectId->asObject(), hints->asObject());
 }
 
-void InjectedScriptHost::clearConsoleMessages()
+void InjectedScriptHost::disconnect()
 {
-    if (m_inspectorAgent) {
-        ErrorString error;
-        m_inspectorAgent->consoleAgent()->clearConsoleMessages(&error);
-    }
+    m_inspectorAgent = 0;
+    m_consoleAgent = 0;
+#if ENABLE(DATABASE)
+    m_databaseAgent = 0;
+#endif
+#if ENABLE(DOM_STORAGE)
+    m_domStorageAgent = 0;
+#endif
+    m_frontend = 0;
 }
 
 void InjectedScriptHost::addInspectedNode(Node* node)
@@ -106,12 +116,26 @@ void InjectedScriptHost::clearInspectedNodes()
     m_inspectedNodes.clear();
 }
 
+void InjectedScriptHost::inspectImpl(PassRefPtr<InspectorValue> object, PassRefPtr<InspectorValue> hints)
+{
+    if (m_frontend)
+        m_frontend->inspector()->inspect(object->asObject(), hints->asObject());
+}
+
+void InjectedScriptHost::clearConsoleMessages()
+{
+    if (m_consoleAgent) {
+        ErrorString error;
+        m_consoleAgent->clearConsoleMessages(&error);
+    }
+}
+
 void InjectedScriptHost::copyText(const String& text)
 {
     Pasteboard::generalPasteboard()->writePlainText(text);
 }
 
-Node* InjectedScriptHost::inspectedNode(unsigned long num)
+Node* InjectedScriptHost::inspectedNode(unsigned int num)
 {
     if (num < m_inspectedNodes.size())
         return m_inspectedNodes[num].get();
@@ -119,81 +143,23 @@ Node* InjectedScriptHost::inspectedNode(unsigned long num)
 }
 
 #if ENABLE(DATABASE)
-long InjectedScriptHost::databaseIdImpl(Database* database)
+int InjectedScriptHost::databaseIdImpl(Database* database)
 {
-    if (m_inspectorAgent && m_inspectorAgent->databaseAgent())
-        return m_inspectorAgent->databaseAgent()->databaseId(database);
+    if (m_databaseAgent)
+        return m_databaseAgent->databaseId(database);
     return 0;
 }
 #endif
 
 #if ENABLE(DOM_STORAGE)
-long InjectedScriptHost::storageIdImpl(Storage* storage)
+int InjectedScriptHost::storageIdImpl(Storage* storage)
 {
-    if (m_inspectorAgent && m_inspectorAgent->domStorageAgent())
-        return m_inspectorAgent->domStorageAgent()->storageId(storage);
+    if (m_domStorageAgent)
+        return m_domStorageAgent->storageId(storage);
     return 0;
 }
 #endif
 
-InjectedScript InjectedScriptHost::injectedScriptForId(long id)
-{
-    return m_idToInjectedScript.get(id);
-}
-
-InjectedScript InjectedScriptHost::injectedScriptForObjectId(InspectorObject* objectId)
-{
-    long injectedScriptId = 0;
-    bool success = objectId->getNumber("injectedScriptId", &injectedScriptId);
-    if (success)
-        return injectedScriptForId(injectedScriptId);
-    return InjectedScript();
-}
-
-InjectedScript InjectedScriptHost::injectedScriptForMainFrame()
-{
-    return injectedScriptFor(mainWorldScriptState(m_inspectorAgent->inspectedPage()->mainFrame()));
-}
-
-void InjectedScriptHost::discardInjectedScripts()
-{
-    IdToInjectedScriptMap::iterator end = m_idToInjectedScript.end();
-    for (IdToInjectedScriptMap::iterator it = m_idToInjectedScript.begin(); it != end; ++it)
-        discardInjectedScript(it->second.scriptState());
-    m_idToInjectedScript.clear();
-}
-
-void InjectedScriptHost::releaseObjectGroup(long injectedScriptId, const String& objectGroup)
-{
-    if (injectedScriptId) {
-         InjectedScript injectedScript = m_idToInjectedScript.get(injectedScriptId);
-         if (!injectedScript.hasNoValue())
-             injectedScript.releaseObjectGroup(objectGroup);
-    } else {
-         // Iterate over all injected scripts if injectedScriptId is not specified.
-         for (IdToInjectedScriptMap::iterator it = m_idToInjectedScript.begin(); it != m_idToInjectedScript.end(); ++it)
-              it->second.releaseObjectGroup(objectGroup);
-    }
-}
-
-InspectorFrontend* InjectedScriptHost::frontend()
-{
-    if (!m_inspectorAgent)
-        return 0;
-    return m_inspectorAgent->frontend();
-}
-
-String InjectedScriptHost::injectedScriptSource()
-{
-    return String(reinterpret_cast<char*>(InjectedScriptSource_js), sizeof(InjectedScriptSource_js));
-}
-
-pair<long, ScriptObject> InjectedScriptHost::injectScript(const String& source, ScriptState* scriptState)
-{
-    long id = m_nextInjectedScriptId++;
-    return std::make_pair(id, createInjectedScript(source, scriptState, id));
-}
-
 #if ENABLE(WORKERS)
 long InjectedScriptHost::nextWorkerId()
 {
@@ -203,13 +169,13 @@ long InjectedScriptHost::nextWorkerId()
 void InjectedScriptHost::didCreateWorker(long id, const String& url, bool isSharedWorker)
 {
     if (m_inspectorAgent)
-        m_inspectorAgent->didCreateWorker(id, url, isSharedWorker);
+        m_inspectorAgent->didCreateWorker(static_cast<int>(id), url, isSharedWorker);
 }
 
 void InjectedScriptHost::didDestroyWorker(long id)
 {
     if (m_inspectorAgent)
-        m_inspectorAgent->didDestroyWorker(id);
+        m_inspectorAgent->didDestroyWorker(static_cast<int>(id));
 }
 #endif // ENABLE(WORKERS)
 
diff --git a/Source/WebCore/inspector/InjectedScriptHost.h b/Source/WebCore/inspector/InjectedScriptHost.h
index cdb1e64..89a5031 100644
--- a/Source/WebCore/inspector/InjectedScriptHost.h
+++ b/Source/WebCore/inspector/InjectedScriptHost.h
@@ -43,6 +43,11 @@ namespace WebCore {
 
 class Database;
 class InjectedScript;
+class InspectorAgent;
+class InspectorConsoleAgent;
+class InspectorDOMStorageAgent;
+class InspectorDatabaseAgent;
+class InspectorDebuggerAgent;
 class InspectorFrontend;
 class InspectorObject;
 class Node;
@@ -53,62 +58,80 @@ class Storage;
 class InjectedScriptHost : public RefCounted<InjectedScriptHost>
 {
 public:
-    static PassRefPtr<InjectedScriptHost> create(InspectorAgent* inspectorAgent)
+    static PassRefPtr<InjectedScriptHost> create();
+    ~InjectedScriptHost();
+
+    void init(InspectorAgent* inspectorAgent
+            , InspectorConsoleAgent* consoleAgent
+#if ENABLE(DATABASE)
+            , InspectorDatabaseAgent* databaseAgent
+#endif
+#if ENABLE(DOM_STORAGE)
+            , InspectorDOMStorageAgent* domStorageAgent
+#endif
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+            , InspectorDebuggerAgent* debuggerAgent
+#endif
+        )
     {
-        return adoptRef(new InjectedScriptHost(inspectorAgent));
+        m_inspectorAgent = inspectorAgent;
+        m_consoleAgent = consoleAgent;
+#if ENABLE(DATABASE)
+        m_databaseAgent = databaseAgent;
+#endif
+#if ENABLE(DOM_STORAGE)
+        m_domStorageAgent = domStorageAgent;
+#endif
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+        m_debuggerAgent = debuggerAgent;
+#endif
     }
+    void setFrontend(InspectorFrontend* frontend) { m_frontend = frontend; }
+    void clearFrontend() { m_frontend = 0; }
 
     static Node* scriptValueAsNode(ScriptValue);
     static ScriptValue nodeAsScriptValue(ScriptState*, Node*);
 
-    ~InjectedScriptHost();
-
-    InspectorAgent* inspectorAgent() { return m_inspectorAgent; }
-    void disconnectController() { m_inspectorAgent = 0; }
-
-    void inspectImpl(PassRefPtr<InspectorValue> objectId, PassRefPtr<InspectorValue> hints);
-    void clearConsoleMessages();
+    void disconnect();
 
     void addInspectedNode(Node*);
     void clearInspectedNodes();
 
+    void inspectImpl(PassRefPtr<InspectorValue> objectToInspect, PassRefPtr<InspectorValue> hints);
+    void clearConsoleMessages();
     void copyText(const String& text);
-    Node* inspectedNode(unsigned long num);
-
+    Node* inspectedNode(unsigned int num);
 #if ENABLE(DATABASE)
-    long databaseIdImpl(Database*);
+    int databaseIdImpl(Database*);
 #endif
 #if ENABLE(DOM_STORAGE)
-    long storageIdImpl(Storage*);
+    int storageIdImpl(Storage*);
 #endif
 #if ENABLE(WORKERS)
     long nextWorkerId();
     void didCreateWorker(long id, const String& url, bool isSharedWorker);
     void didDestroyWorker(long id);
 #endif
-
-    pair<long, ScriptObject> injectScript(const String& source, ScriptState*);
-    InjectedScript injectedScriptFor(ScriptState*);
-    InjectedScript injectedScriptForId(long);
-    InjectedScript injectedScriptForObjectId(InspectorObject* objectId);
-    InjectedScript injectedScriptForMainFrame();
-    void discardInjectedScripts();
-    void releaseObjectGroup(long injectedScriptId, const String& objectGroup);
-
-    static bool canAccessInspectedWindow(ScriptState*);
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+    InspectorDebuggerAgent* debuggerAgent() { return m_debuggerAgent; }
+#endif
 
 private:
-    InjectedScriptHost(InspectorAgent*);
-    InspectorFrontend* frontend();
-    String injectedScriptSource();
-    ScriptObject createInjectedScript(const String& source, ScriptState* scriptState, long id);
-    void discardInjectedScript(ScriptState*);
+    InjectedScriptHost();
 
     InspectorAgent* m_inspectorAgent;
-    long m_nextInjectedScriptId;
+    InspectorConsoleAgent* m_consoleAgent;
+#if ENABLE(DATABASE)
+    InspectorDatabaseAgent* m_databaseAgent;
+#endif
+#if ENABLE(DOM_STORAGE)
+    InspectorDOMStorageAgent* m_domStorageAgent;
+#endif
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+    InspectorDebuggerAgent* m_debuggerAgent;
+#endif
+    InspectorFrontend* m_frontend;
     long m_lastWorkerId;
-    typedef HashMap<long, InjectedScript> IdToInjectedScriptMap;
-    IdToInjectedScriptMap m_idToInjectedScript;
     Vector<RefPtr<Node> > m_inspectedNodes;
 };
 
diff --git a/Source/WebCore/inspector/InjectedScriptHost.idl b/Source/WebCore/inspector/InjectedScriptHost.idl
index 0d5c500..fc60813 100644
--- a/Source/WebCore/inspector/InjectedScriptHost.idl
+++ b/Source/WebCore/inspector/InjectedScriptHost.idl
@@ -36,12 +36,12 @@ module core {
 
         void copyText(in DOMString text);
         [Custom] void inspect(in DOMObject objectId, in DOMObject hints);
-        [Custom] DOMObject inspectedNode(in unsigned long num);
+        [Custom] DOMObject inspectedNode(in int num);
         [Custom] DOMObject internalConstructorName(in DOMObject object);
 
         [Custom] DOMObject currentCallFrame();
-        [Custom] long databaseId(in DOMObject database);
-        [Custom] long storageId(in DOMObject storage);
+        [Custom] int databaseId(in DOMObject database);
+        [Custom] int storageId(in DOMObject storage);
 
 #if defined(ENABLE_WORKERS) && ENABLE_WORKERS
         void didCreateWorker(in long id, in DOMString url, in boolean isFakeWorker);
diff --git a/Source/WebCore/inspector/InjectedScriptManager.cpp b/Source/WebCore/inspector/InjectedScriptManager.cpp
new file mode 100644
index 0000000..5c21802
--- /dev/null
+++ b/Source/WebCore/inspector/InjectedScriptManager.cpp
@@ -0,0 +1,117 @@
+/*
+ * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2008 Matt Lilek <webkit@mattlilek.com>
+ * Copyright (C) 2010-2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "InjectedScriptManager.h"
+
+#if ENABLE(INSPECTOR)
+
+#include "InjectedScript.h"
+#include "InjectedScriptHost.h"
+#include "InjectedScriptSource.h"
+#include "InspectorValues.h"
+#include <wtf/PassOwnPtr.h>
+#include <wtf/StdLibExtras.h>
+
+using namespace std;
+
+namespace WebCore {
+
+PassOwnPtr<InjectedScriptManager> InjectedScriptManager::create()
+{
+    return adoptPtr(new InjectedScriptManager());
+}
+
+InjectedScriptManager::InjectedScriptManager()
+    : m_nextInjectedScriptId(1)
+    , m_injectedScriptHost(InjectedScriptHost::create())
+{
+}
+
+InjectedScriptManager::~InjectedScriptManager()
+{
+}
+
+void InjectedScriptManager::disconnect()
+{
+    m_injectedScriptHost->disconnect();
+    m_injectedScriptHost.clear();
+}
+
+InjectedScriptHost* InjectedScriptManager::injectedScriptHost()
+{
+    return m_injectedScriptHost.get();
+}
+
+InjectedScript InjectedScriptManager::injectedScriptForId(long id)
+{
+    return m_idToInjectedScript.get(id);
+}
+
+InjectedScript InjectedScriptManager::injectedScriptForObjectId(const String& objectId)
+{
+    RefPtr<InspectorValue> parsedObjectId = InspectorValue::parseJSON(objectId);
+    if (parsedObjectId && parsedObjectId->type() == InspectorValue::TypeObject) {
+        long injectedScriptId = 0;
+        bool success = parsedObjectId->asObject()->getNumber("injectedScriptId", &injectedScriptId);
+        if (success)
+            return injectedScriptForId(injectedScriptId);
+    }
+    return InjectedScript();
+}
+
+void InjectedScriptManager::discardInjectedScripts()
+{
+    IdToInjectedScriptMap::iterator end = m_idToInjectedScript.end();
+    for (IdToInjectedScriptMap::iterator it = m_idToInjectedScript.begin(); it != end; ++it)
+        discardInjectedScript(it->second.scriptState());
+    m_idToInjectedScript.clear();
+}
+
+void InjectedScriptManager::releaseObjectGroup(const String& objectGroup)
+{
+    for (IdToInjectedScriptMap::iterator it = m_idToInjectedScript.begin(); it != m_idToInjectedScript.end(); ++it)
+        it->second.releaseObjectGroup(objectGroup);
+}
+
+String InjectedScriptManager::injectedScriptSource()
+{
+    return String(reinterpret_cast<const char*>(InjectedScriptSource_js), sizeof(InjectedScriptSource_js));
+}
+
+pair<long, ScriptObject> InjectedScriptManager::injectScript(const String& source, ScriptState* scriptState)
+{
+    long id = m_nextInjectedScriptId++;
+    return std::make_pair(id, createInjectedScript(source, scriptState, id));
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(INSPECTOR)
diff --git a/Source/WebKit/win/GEN_DOMObject.cpp b/Source/WebCore/inspector/InjectedScriptManager.h
index c8d0e3c..2896e8f 100644
--- a/Source/WebKit/win/GEN_DOMObject.cpp
+++ b/Source/WebCore/inspector/InjectedScriptManager.h
@@ -1,18 +1,19 @@
 /*
  * Copyright (C) 2007 Apple Inc. All rights reserved.
+ * Copyright (C) 2009-2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  *
  * 1.  Redistributions of source code must retain the above copyright
- *     notice, this list of conditions and the following disclaimer.
+ *     notice, this list of conditions and the following disclaimer. 
  * 2.  Redistributions in binary form must reproduce the above copyright
  *     notice, this list of conditions and the following disclaimer in the
- *     documentation and/or other materials provided with the distribution.
+ *     documentation and/or other materials provided with the distribution. 
  * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
  *     its contributors may be used to endorse or promote products derived
- *     from this software without specific prior written permission.
+ *     from this software without specific prior written permission. 
  *
  * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
  * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
@@ -26,54 +27,54 @@
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#include "config.h"
-#include "GEN_DOMObject.h"
+#ifndef InjectedScriptManager_h
+#define InjectedScriptManager_h
 
-#include "WebKitDLL.h"
+#include "PlatformString.h"
+#include "ScriptState.h"
 
-#include <wtf/Assertions.h>
+#include <wtf/Forward.h>
+#include <wtf/HashMap.h>
 
-// DOMObject ------------------------------------------------------------
+namespace WebCore {
 
-GEN_DOMObject::GEN_DOMObject()
-    : m_refCount(0)
-{
-    gClassCount++;
-    gClassNameCount.add("GEN_DOMObject");
-}
+class InjectedScript;
+class InjectedScriptHost;
+class InspectorObject;
+class ScriptObject;
 
-GEN_DOMObject::~GEN_DOMObject()
-{
-    gClassCount--;
-    gClassNameCount.remove("GEN_DOMObject");
-}
+class InjectedScriptManager {
+    WTF_MAKE_NONCOPYABLE(InjectedScriptManager);
+public:
+    static PassOwnPtr<InjectedScriptManager> create();
+    ~InjectedScriptManager();
 
-// IUnknown -------------------------------------------------------------------
+    void disconnect();
 
-HRESULT STDMETHODCALLTYPE GEN_DOMObject::QueryInterface(REFIID riid, void** ppvObject)
-{
-    *ppvObject = 0;
-    if (IsEqualGUID(riid, IID_IUnknown))
-        *ppvObject = static_cast<IGEN_DOMObject*>(this);
-    else if (IsEqualGUID(riid, IID_IGEN_DOMObject))
-        *ppvObject = static_cast<GEN_DOMObject*>(this);
-    else
-        return E_NOINTERFACE;
+    InjectedScriptHost* injectedScriptHost();
 
-    AddRef();
-    return S_OK;
-}
+    pair<long, ScriptObject> injectScript(const String& source, ScriptState*);
+    InjectedScript injectedScriptFor(ScriptState*);
+    InjectedScript injectedScriptForId(long);
+    InjectedScript injectedScriptForObjectId(const String& objectId);
+    void discardInjectedScripts();
+    void releaseObjectGroup(const String& objectGroup);
 
-ULONG STDMETHODCALLTYPE GEN_DOMObject::AddRef()
-{
-    return ++m_refCount;
-}
+    static bool canAccessInspectedWindow(ScriptState*);
 
-ULONG STDMETHODCALLTYPE GEN_DOMObject::Release()
-{
-    ULONG newRef = --m_refCount;
-    if (!newRef)
-        delete this;
+private:
+    InjectedScriptManager();
 
-    return newRef;
-}
+    String injectedScriptSource();
+    ScriptObject createInjectedScript(const String& source, ScriptState*, long id);
+    void discardInjectedScript(ScriptState*);
+
+    long m_nextInjectedScriptId;
+    typedef HashMap<long, InjectedScript> IdToInjectedScriptMap;
+    IdToInjectedScriptMap m_idToInjectedScript;
+    RefPtr<InjectedScriptHost> m_injectedScriptHost;
+};
+
+} // namespace WebCore
+
+#endif // !defined(InjectedScriptManager_h)
diff --git a/Source/WebCore/inspector/InjectedScriptSource.js b/Source/WebCore/inspector/InjectedScriptSource.js
index 9c662e8..f499a17 100644
--- a/Source/WebCore/inspector/InjectedScriptSource.js
+++ b/Source/WebCore/inspector/InjectedScriptSource.js
@@ -46,6 +46,7 @@ var InjectedScript = function()
 {
     this._lastBoundObjectId = 1;
     this._idToWrappedObject = {};
+    this._idToObjectGroupName = {};
     this._objectGroups = {};
 }
 
@@ -95,8 +96,7 @@ InjectedScript.prototype = {
             if (typeof object === "object" || typeof object === "function" || this._isHTMLAllCollection(object)) {
                 var id = this._lastBoundObjectId++;
                 this._idToWrappedObject[id] = object;
-                var objectId = { injectedScriptId: injectedScriptId, id: id };
-    
+                var objectId = "{\"injectedScriptId\":" + injectedScriptId + ",\"id\":" + id + "}";    
                 if (objectGroupName) {
                     var group = this._objectGroups[objectGroupName];
                     if (!group) {
@@ -104,7 +104,7 @@ InjectedScript.prototype = {
                         this._objectGroups[objectGroupName] = group;
                     }
                     group.push(id);
-                    objectId.groupName = objectGroupName;
+                    this._idToObjectGroupName[id] = objectGroupName;
                 }
             }
             return InjectedScript.RemoteObject.fromObject(object, objectId, abbreviate);
@@ -124,7 +124,7 @@ InjectedScript.prototype = {
         if (!group)
             return;
         for (var i = 0; i < group.length; i++)
-            delete this._idToWrappedObject[group[i]];
+            this._releaseObject(group[i]);
         delete this._objectGroups[objectGroupName];
     },
 
@@ -143,6 +143,7 @@ InjectedScript.prototype = {
     {
         var parsedObjectId = this._parseObjectId(objectId);
         var object = this._objectForId(parsedObjectId);
+        var objectGroupName = this._idToObjectGroupName[parsedObjectId.id];
 
         if (!this._isDefined(object))
             return false;
@@ -161,7 +162,7 @@ InjectedScript.prototype = {
             var isGetter = object["__lookupGetter__"] && object.__lookupGetter__(propertyName);
             if (!isGetter) {
                 try {
-                    property.value = this._wrapObject(object[propertyName], parsedObjectId.groupName, abbreviate);
+                    property.value = this._wrapObject(object[propertyName], objectGroupName, abbreviate);
                 } catch(e) {
                     property.value = new InjectedScript.RemoteObject.fromException(e);
                 }
@@ -180,12 +181,12 @@ InjectedScript.prototype = {
         var parsedObjectId = this._parseObjectId(objectId);
         var object = this._objectForId(parsedObjectId);
         if (!this._isDefined(object))
-            return false;
+            return "Object with given id not found";
     
         var expressionLength = expression.length;
         if (!expressionLength) {
             delete object[propertyName];
-            return !(propertyName in object);
+            return propertyName in object ? "Cound not delete property." : undefined;
         }
     
         try {
@@ -198,14 +199,12 @@ InjectedScript.prototype = {
             var result = inspectedWindow.eval("(" + expression + ")");
             // Store the result in the property.
             object[propertyName] = result;
-            return true;
         } catch(e) {
             try {
                 var result = inspectedWindow.eval("\"" + expression.replace(/"/g, "\\\"") + "\"");
                 object[propertyName] = result;
-                return true;
             } catch(e) {
-                return false;
+                return e.toString();
             }
         }
     },
@@ -213,7 +212,13 @@ InjectedScript.prototype = {
     releaseObject: function(objectId)
     {
         var parsedObjectId = this._parseObjectId(objectId);
-        delete this._idToWrappedObject[parsedObjectId.id];
+        this._releaseObject(parsedObjectId.id);
+    },
+
+    _releaseObject: function(id)
+    {
+        delete this._idToWrappedObject[id];
+        delete this._idToObjectGroupName[id];
     },
 
     _populatePropertyNames: function(object, resultSet)
@@ -245,7 +250,7 @@ InjectedScript.prototype = {
         var parsedObjectId = this._parseObjectId(objectId);
         var object = this._objectForId(parsedObjectId);
         if (!object)
-            return false;
+            return "Could not find object with given id";
         try {
             inspectedWindow.console._objectToEvaluateOn = object;
             return this._evaluateAndWrap(inspectedWindow.eval, inspectedWindow, "(function() {" + expression + "}).call(window.console._objectToEvaluateOn)", parsedObjectId.objectGroup, false, false);
@@ -308,7 +313,7 @@ InjectedScript.prototype = {
     {
         var callFrame = this._callFrameForId(callFrameId);
         if (!callFrame)
-            return false;
+            return "Could not find call frame with given id";
         return this._evaluateAndWrap(callFrame.evaluate, callFrame, expression, objectGroup, true, injectCommandLineAPI);
     },
 
@@ -336,11 +341,6 @@ InjectedScript.prototype = {
         return object;
     },
 
-    resolveNode: function(node)
-    {
-        return this._wrapObject(node);
-    },
-
     _isDefined: function(object)
     {
         return object || this._isHTMLAllCollection(object);
@@ -385,10 +385,14 @@ InjectedScript.prototype = {
         if (obj instanceof inspectedWindow.RegExp)
             return "regexp";
         // FireBug's array detection.
-        if (isFinite(obj.length) && typeof obj.splice === "function")
-            return "array";
-        if (isFinite(obj.length) && typeof obj.callee === "function") // arguments.
-            return "array";
+        try {
+            if (isFinite(obj.length) && typeof obj.splice === "function")
+                return "array";
+            if (isFinite(obj.length) && typeof obj.callee === "function") // arguments.
+                return "array";
+        } catch (e) {
+            return type;
+        }
         if (obj instanceof inspectedWindow.NodeList)
             return "array";
         if (obj instanceof inspectedWindow.HTMLCollection)
@@ -420,11 +424,9 @@ InjectedScript.prototype = {
                 className += "[" + obj.length + "]";
             return className;
         case "string":
-            if (!abbreviated)
-                return obj;
-            if (obj.length > 100)
-                return "\"" + obj.substring(0, 100) + "\u2026\"";
-            return "\"" + obj + "\"";
+            if (abbreviated && obj.length > 100)
+                return obj.substring(0, 100) + "\u2026";
+            return obj;
         case "function":
             var objectText = this._toString(obj);
             if (abbreviated)
@@ -446,10 +448,12 @@ var injectedScript = new InjectedScript();
 
 InjectedScript.RemoteObject = function(objectId, type, description, hasChildren)
 {
-    this.objectId = objectId;
+    if (objectId) {
+        this.objectId = objectId;
+        this.hasChildren = hasChildren;
+    }
     this.type = type;
     this.description = description;
-    this.hasChildren = hasChildren;
 }
 
 InjectedScript.RemoteObject.fromException = function(e)
@@ -473,7 +477,7 @@ InjectedScript.RemoteObject.fromObject = function(object, objectId, abbreviate)
 
 InjectedScript.CallFrameProxy = function(ordinal, callFrame)
 {
-    this.id = { ordinal: ordinal, injectedScriptId: injectedScriptId };
+    this.id = "{\"ordinal\":" + ordinal + ",\"injectedScriptId\":" + injectedScriptId + "}";
     this.type = callFrame.type;
     this.functionName = (this.type === "function" ? callFrame.functionName : "");
     this.sourceID = callFrame.sourceID;
diff --git a/Source/WebCore/inspector/Inspector.idl b/Source/WebCore/inspector/Inspector.idl
deleted file mode 100644
index 216d4b1..0000000
--- a/Source/WebCore/inspector/Inspector.idl
+++ /dev/null
@@ -1,275 +0,0 @@
-/*
- * Copyright (C) 2010 Apple Inc. All rights reserved.
- * Copyright (C) 2011 Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions are
- * met:
- *
- *     * Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- *     * Redistributions in binary form must reproduce the above
- * copyright notice, this list of conditions and the following disclaimer
- * in the documentation and/or other materials provided with the
- * distribution.
- *     * Neither the name of Google Inc. nor the names of its
- * contributors may be used to endorse or promote products derived from
- * this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
- * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-module core {
-    interface [Conditional=INSPECTOR] Inspector {
-        void addScriptToEvaluateOnLoad(in String scriptSource);
-        void removeAllScriptsToEvaluateOnLoad();
-        void reloadPage(in boolean ignoreCache);
-        void populateScriptObjects();
-
-        void openInInspectedWindow(in String url);
-        void setSearchingForNode(in boolean enabled, out boolean newState);
-        [event] void frontendReused();
-        [event] void bringToFront();
-        [event] void disconnectFromBackend();
-        [event] void inspectedURLChanged(out String url);
-        [event] void domContentEventFired(out double time);
-        [event] void loadEventFired(out double time);
-        [event] void reset();
-        [event] void showPanel(out String panel);
-
-        [event] void evaluateForTestInFrontend(out long testCallId, out String script);
-        void didEvaluateForTestInFrontend(in long testCallId, in String jsonResult);
-
-        void highlightDOMNode(in long nodeId);
-        void hideDOMNodeHighlight();
-        void highlightFrame(in unsigned long frameId);
-        void hideFrameHighlight();
-
-        void setUserAgentOverride(in String userAgent);
-
-        void getCookies(out Array cookies, out String cookiesString);
-        void deleteCookie(in String cookieName, in String domain);
-
-        [event] void inspect(out Object objectId, out Object hints);
-
-        // FIXME: dispatch on agents.
-#if defined(ENABLE_JAVASCRIPT_DEBUGGER) && ENABLE_JAVASCRIPT_DEBUGGER
-        void enableProfiler();
-        void disableProfiler();
-        void startProfiling();
-        void stopProfiling();
-#endif // ENABLE_JAVASCRIPT_DEBUGGER
-    };
-
-    interface [Conditional=INSPECTOR] Runtime {
-        void evaluate(in String expression, in String objectGroup, in boolean includeCommandLineAPI, out Value result);
-        void evaluateOn(in Object objectId, in String expression, out Value result);
-        void getProperties(in Object objectId, in boolean ignoreHasOwnProperty, in boolean abbreviate, out Value result);
-        void setPropertyValue(in Object objectId, in String propertyName, in String expression, out Value result);
-        void releaseObject(in Object objectId);
-        void releaseObjectGroup(in long injectedScriptId, in String objectGroup);
-    };
-
-    interface [Conditional=INSPECTOR] Console {
-        void setConsoleMessagesEnabled(in boolean enabled, out boolean newState);
-        [event] void addConsoleMessage(out Object messageObj);
-        [event] void updateConsoleMessageExpiredCount(out unsigned long count);
-        [event] void updateConsoleMessageRepeatCount(out unsigned long count);
-        void clearConsoleMessages();
-        [event] void consoleMessagesCleared();
-        void setMonitoringXHREnabled(in boolean enabled);
-    };
-
-    interface [Conditional=INSPECTOR] Network {
-        void enable(out Object resources);
-        void disable();
-        void resourceContent(in unsigned long frameId, in String url, in boolean base64Encode, out boolean success, out String content);
-        void setExtraHeaders(in Object headers);
-
-        [event] void frameDetachedFromParent(out unsigned long frameId);
-        [event] void identifierForInitialRequest(out long identifier, out String url, out Object loader, out Value callStack);
-        [event] void willSendRequest(out long identifier, out double time, out Object request, out Object redirectResponse);
-        [event] void markResourceAsCached(out long identifier);
-        [event] void didReceiveResponse(out long identifier, out double time, out String resourceType, out Object response);
-        [event] void didReceiveContentLength(out long identifier, out double time, out long lengthReceived);
-        [event] void didFinishLoading(out long identifier, out double finishTime);
-        [event] void didFailLoading(out long identifier, out double time, out String localizedDescription);
-        [event] void didLoadResourceFromMemoryCache(out double time, out Object resource);
-        [event] void setInitialContent(out long identifier, out String sourceString, out String type);
-        [event] void didCommitLoadForFrame(out Object frame, out Object loader);
-        [event] void didCreateWebSocket(out unsigned long identifier, out String requestURL);
-        [event] void willSendWebSocketHandshakeRequest(out unsigned long identifier, out double time, out Object request);
-        [event] void didReceiveWebSocketHandshakeResponse(out unsigned long identifier, out double time, out Object response);
-        [event] void didCloseWebSocket(out unsigned long identifier, out double time);
-    };
-
-#if defined(ENABLE_DATABASE) && ENABLE_DATABASE
-    interface [Conditional=INSPECTOR] Database {
-        void getDatabaseTableNames(in long databaseId, out Array tableNames);
-        void executeSQL(in long databaseId, in String query, out boolean success, out long transactionId);
-
-        [event] void addDatabase(out Object database);
-        [event] void sqlTransactionSucceeded(out long transactionId, out Value columnNames, out Value values);
-        [event] void sqlTransactionFailed(out long transactionId, out Value sqlError);
-    };
-#endif
-
-#if defined(ENABLE_DOM_STORAGE) && ENABLE_DOM_STORAGE
-    interface [Conditional=INSPECTOR] DOMStorage {
-        void getDOMStorageEntries(in long storageId, out Array entries);
-        void setDOMStorageItem(in long storageId, in String key, in String value, out boolean success);
-        void removeDOMStorageItem(in long storageId, in String key, out boolean success);
-        [event] void addDOMStorage(out Object storage);
-        [event] void updateDOMStorage(out int storageId);
-    };
-#endif
-
-#if defined(ENABLE_OFFLINE_WEB_APPLICATIONS) && ENABLE_OFFLINE_WEB_APPLICATIONS
-    interface [Conditional=INSPECTOR] ApplicationCache {
-        void getApplicationCaches(out Value applicationCaches);
-        [event] void updateApplicationCacheStatus(out int status);
-        [event] void updateNetworkState(out boolean isNowOnline);
-    };
-#endif
-
-    interface [Conditional=INSPECTOR] DOM {
-        void getDocument(out Object root);
-        void getChildNodes(in long nodeId);
-        void querySelector(in long nodeId, in String selectors, in boolean documentWide, out long elementId);
-        void querySelectorAll(in long nodeId, in String selectors, in boolean documentWide, out Array result);
-        void setAttribute(in long elementId, in String name, in String value, out boolean success);
-        void removeAttribute(in long elementId, in String name, out boolean success);
-        void setTextNodeValue(in long nodeId, in String value, out boolean success);
-        void getEventListenersForNode(in long nodeId, out long outNodeId, out Array listenersArray);
-        void copyNode(in long nodeId);
-        void removeNode(in long nodeId, out long outNodeId);
-        void changeTagName(in long nodeId, in String newTagName, out long outNodeId);
-        void getOuterHTML(in long nodeId, out String outerHTML);
-        void setOuterHTML(in long nodeId, in String outerHTML, out long outNodeId);
-        void addInspectedNode(in long nodeId);
-        void performSearch(in String query, in boolean runSynchronously);
-        void searchCanceled();
-        void pushNodeByPathToFrontend(in String path, out long nodeId);
-        void resolveNode(in long nodeId, in String objectGroup, out Value result);
-        void pushNodeToFrontend(in Object objectId, out long nodeId);
-
-        [event] void addNodesToSearchResult(out Array nodeIds);
-        [event] void documentUpdated();
-        [event] void setChildNodes(out long parentId, out Array nodes);
-        [event] void attributesUpdated(out long id, out Array attributes);
-        [event] void characterDataModified(out long id, out String newValue);
-        [event] void setDetachedRoot(out Object root);
-        [event] void childNodeCountUpdated(out long id, out int newValue);
-        [event] void childNodeInserted(out long parentId, out long prevId, out Object node);
-        [event] void childNodeRemoved(out long parentId, out long id);
-    };
-
-    interface [Conditional=INSPECTOR] CSS {
-        void getStylesForNode(in long nodeId, out Value styles);
-        void getComputedStyleForNode(in long nodeId, out Value style);
-        void getInlineStyleForNode(in long nodeId, out Value style);
-        void getAllStyles(out Array styleSheetIds);
-        void getStyleSheet(in String styleSheetId, out Value styleSheet);
-        void getStyleSheetText(in String styleSheetId, out String url, out String text);
-        void setStyleSheetText(in String styleSheetId, in String text, out boolean success);
-        void setPropertyText(in Object styleId, in long propertyIndex, in String text, in boolean overwrite, out Value style);
-        void toggleProperty(in Object styleId, in long propertyIndex, in boolean disable, out Value style);
-        void setRuleSelector(in Object ruleId, in String selector, out Value rule);
-        void addRule(in long contextNodeId, in String selector, out Value rule);
-        void getSupportedCSSProperties(out Array cssProperties);
-    };
-
-    interface [Conditional=INSPECTOR] Timeline {
-        void start();
-        void stop();
-        [event] void timelineProfilerWasStarted();
-        [event] void timelineProfilerWasStopped();
-        [event] void addRecordToTimeline(out Object record);
-    };
-
-#if defined(ENABLE_JAVASCRIPT_DEBUGGER) && ENABLE_JAVASCRIPT_DEBUGGER
-    interface [Conditional=INSPECTOR] Debugger {
-        void enable();
-        void disable();
-        [event] void debuggerWasEnabled();
-        [event] void debuggerWasDisabled();
-
-        [event] void parsedScriptSource(out String sourceID, out String url, out int lineOffset, out int columnOffset, out int length, out int scriptWorldType);
-        [event] void failedToParseScriptSource(out String url, out String data, out int firstLine, out int errorLine, out String errorMessage);
-
-        void activateBreakpoints();
-        void deactivateBreakpoints();
-
-        void setJavaScriptBreakpoint(in String url, in int lineNumber, in int columnNumber, in String condition, in boolean enabled, out String breakpointId, out Array locations);
-        void setJavaScriptBreakpointBySourceId(in String sourceId, in int lineNumber, in int columnNumber, in String condition, in boolean enabled, out String breakpointId, out int actualLineNumber, out int actualColumnNumber);
-        void removeJavaScriptBreakpoint(in String breakpointId);
-        [event] void breakpointResolved(out String breakpointId, out String sourceId, out int lineNumber, out int columnNumber);
-        void continueToLocation(in String sourceId, in int lineNumber, in int columnNumber);
-
-        void stepOver();
-        void stepInto();
-        void stepOut();
-        void pause();
-        [event] void pausedScript(out Object details);
-        void resume();
-        [event] void resumedScript(); // FIXME: Make this out parameter of resume if possible.
-
-        void editScriptSource(in String sourceID, in String newContent, out boolean success, out String result, out Value newCallFrames);
-        void getScriptSource(in String sourceID, out String scriptSource);
-
-        void setPauseOnExceptionsState(in long pauseOnExceptionsState, out long newState);
-
-        void evaluateOnCallFrame(in Object callFrameId, in String expression, in String objectGroup, in boolean includeCommandLineAPI, out Value result);
-
-#if defined(ENABLE_WORKERS) && ENABLE_WORKERS
-        [event] void didCreateWorker(out long id, out String url, out boolean isShared);
-        [event] void didDestroyWorker(out long id);
-#endif // ENABLE_WORKERS
-
-    };
-#endif // ENABLE_JAVASCRIPT_DEBUGGER
-
-#if defined(ENABLE_JAVASCRIPT_DEBUGGER) && ENABLE_JAVASCRIPT_DEBUGGER
-    interface [Conditional=INSPECTOR] BrowserDebugger {
-        void setAllBrowserBreakpoints(in Object breakpoints);
-        void setDOMBreakpoint(in long nodeId, in long type);
-        void removeDOMBreakpoint(in long nodeId, in long type);
-        void setEventListenerBreakpoint(in String eventName);
-        void removeEventListenerBreakpoint(in String eventName);
-        void setXHRBreakpoint(in String url);
-        void removeXHRBreakpoint(in String url);
-    };
-#endif // ENABLE_JAVASCRIPT_DEBUGGER
-
-#if defined(ENABLE_JAVASCRIPT_DEBUGGER) && ENABLE_JAVASCRIPT_DEBUGGER
-    interface [Conditional=INSPECTOR] Profiler {
-        [event] void profilerWasEnabled();
-        [event] void profilerWasDisabled();
-
-        void getProfileHeaders(out Array headers);
-        void getProfile(in String type, in unsigned long uid, out Object profile);
-        void removeProfile(in String type, in unsigned long uid);
-        void clearProfiles();
-
-        // FIXME: split into Profiler and HeapProfiler.
-        void takeHeapSnapshot(in boolean detailed);
-        void getExactHeapSnapshotNodeRetainedSize(in unsigned long uid, in unsigned long nodeId, out long size);
-        [event] void addProfileHeader(out Object header);
-        [event] void addHeapSnapshotChunk(out unsigned long uid, out String chunk);
-        [event] void finishHeapSnapshot(out unsigned long uid);
-        [event] void setRecordingProfile(out boolean isProfiling);
-        [event] void resetProfiles();
-        [event] void reportHeapSnapshotProgress(out int done, out int total);
-    };
-#endif // ENABLE_JAVASCRIPT_DEBUGGER
-}
diff --git a/Source/WebCore/inspector/Inspector.json b/Source/WebCore/inspector/Inspector.json
new file mode 100644
index 0000000..ed5929e
--- /dev/null
+++ b/Source/WebCore/inspector/Inspector.json
@@ -0,0 +1,1445 @@
+[
+    {
+        "domain": "Inspector",
+        "types": [],
+        "commands": [
+            {
+                "name": "didEvaluateForTestInFrontend",
+                "parameters": [
+                    { "name": "testCallId", "type": "integer" },
+                    { "name": "jsonResult", "type": "string" }
+                ]
+            }
+        ],
+        "events": [
+            {
+                "name": "frontendReused"
+            },
+            {
+                "name": "bringToFront"
+            },
+            {
+                "name": "disconnectFromBackend"
+            },
+            {
+                "name": "reset"
+            },
+            {
+                "name": "showPanel",
+                "parameters": [
+                    { "name": "panel", "type": "string" }
+                ]
+            },
+            {
+                "name": "startUserInitiatedDebugging"
+            },
+            {
+                "name": "evaluateForTestInFrontend",
+                "parameters": [
+                    { "name": "testCallId", "type": "integer" },
+                    { "name": "script", "type": "string" }
+                ]
+            },
+            {
+                "name": "inspect",
+                "parameters": [
+                    { "name": "object", "$ref": "RemoteObject" },
+                    { "name": "hints", "type": "object" }
+                ]
+            },
+            {
+                "name": "didCreateWorker",
+                "parameters": [
+                    { "name": "id", "type": "integer" },
+                    { "name": "url", "type": "string" },
+                    { "name": "isShared", "type": "boolean" }
+                ]
+            },
+            {
+                "name": "didDestroyWorker",
+                "parameters": [
+                    { "name": "id", "type": "integer" }
+                ]
+            }
+        ]
+    },
+    {
+        "domain": "Page",
+        "types": [],
+        "commands": [
+            {
+                "name": "addScriptToEvaluateOnLoad",
+                "parameters": [
+                    { "name": "scriptSource", "type": "string" }
+                ]
+            },
+            {
+                "name": "removeAllScriptsToEvaluateOnLoad"
+            },
+            {
+                "name": "reloadPage",
+                "parameters": [
+                    { "name": "ignoreCache", "type": "boolean" }
+                ]
+            },
+            {
+                "name": "openInInspectedWindow",
+                "parameters": [
+                    { "name": "url", "type": "string" }
+                ]
+            },
+            {
+                "name": "setUserAgentOverride",
+                "parameters": [
+                    { "name": "userAgent", "type": "string" }
+                ]
+            },
+            {
+                "name": "getCookies",
+                "returns": [
+                    { "name": "cookies", "type": "array", "items": { "$ref" : "Cookie"} },
+                    { "name": "cookiesString", "type": "string" }
+                ]
+            },
+            {
+                "name": "deleteCookie",
+                "parameters": [
+                    { "name": "cookieName", "type": "string" },
+                    { "name": "domain", "type": "string" }
+                ]
+            }
+        ],
+        "events": [
+            {
+                "name": "inspectedURLChanged",
+                "parameters": [
+                    { "name": "url", "type": "string" }
+                ]
+            },
+            {
+                "name": "domContentEventFired",
+                "parameters": [
+                    { "name": "time", "type": "number" }
+                ]
+            },
+            {
+                "name": "loadEventFired",
+                "parameters": [
+                    { "name": "time", "type": "number" }
+                ]
+            }
+        ]
+    },
+    {
+        "domain": "Runtime",
+        "types": [],
+        "commands": [
+            {
+                "name": "evaluate",
+                "parameters": [
+                    { "name": "expression", "type": "string" },
+                    { "name": "objectGroup", "type": "string" },
+                    { "name": "includeCommandLineAPI", "type": "boolean" }
+                ],
+                "returns": [
+                    { "name": "result", "$ref": "RuntimeObject" }
+                ]
+            },
+            {
+                "name": "evaluateOn",
+                "parameters": [
+                    { "name": "objectId", "type": "string" },
+                    { "name": "expression", "type": "string" }
+                ],
+                "returns": [
+                    { "name": "result", "$ref": "RuntimeObject" }
+                ]
+            },
+            {
+                "name": "getProperties",
+                "parameters": [
+                    { "name": "objectId", "type": "string" },
+                    { "name": "ignoreHasOwnProperty", "type": "boolean" },
+                    { "name": "abbreviate", "type": "boolean" }
+                ],
+                "returns": [
+                    { "name": "result", "type": "array", "items": { "$ref" : "RuntimeProperty"} }
+                ]
+            },
+            {
+                "name": "setPropertyValue",
+                "parameters": [
+                    { "name": "objectId", "type": "string" },
+                    { "name": "propertyName", "type": "string" },
+                    { "name": "expression", "type": "string" }
+                ]
+            },
+            {
+                "name": "releaseObject",
+                "parameters": [
+                    { "name": "objectId", "type": "string" }
+                ]
+            },
+            {
+                "name": "releaseObjectGroup",
+                "parameters": [
+                    { "name": "objectGroup", "type": "string" }
+                ]
+            }
+        ]
+    },
+    {
+        "domain": "Console",
+        "types": [],
+        "commands": [
+            {
+                "name": "enable",
+                "returns": [
+                   { "name": "expiredMessagesCount", "type": "integer" }
+                ]
+            },
+            {
+                "name": "disable"
+           },
+            {
+                "name": "clearConsoleMessages"
+            },
+            {
+                "name": "setMonitoringXHREnabled",
+                "parameters": [
+                    { "name": "enabled", "type": "boolean" }
+                ]
+            },
+            {
+                "name": "addInspectedNode",
+                "parameters": [
+                    { "name": "nodeId", "type": "integer" }
+                ]
+            }
+        ],
+        "events": [
+            {
+                "name": "consoleMessage",
+                "parameters": [
+                    { "name": "messageObj", "$ref": "ConsoleMessage" }
+                ]
+            },
+           {
+                "name": "consoleMessageRepeatCountUpdated",
+                "parameters": [
+                    { "name": "count", "type": "integer" }
+                ]
+            },
+            {
+                "name": "consoleMessagesCleared"
+            }
+        ]
+    },
+    {
+        "domain": "Network",
+        "description": "Network domain allows tracking network activities of the page. It exposes information about HTTP and WebSocket requests and responses, their headers, bodies, timing, etc. It also allows getting the tree of the Frames on the page along with information about their resources.",
+        "types": [
+            {
+                "id": "ResourceTiming",
+                "type": "object",
+                "description": "Timing information for the request.",
+                "properties": {
+                    "requestTime": { "type": "number", "description": "Timing's requestTime is a baseline in seconds, while the other numbers are ticks in milliseconds relatively to this requestTime." },
+                    "proxyStart": { "type": "number", "description": "Started resolving proxy." },
+                    "proxyEnd": { "type": "number", "description": "Finished resolving proxy." },
+                    "dnsStart": { "type": "number", "description": "Started DNS address resolve." },
+                    "dnsEnd": { "type": "number", "description": "Finished DNS address resolve." },
+                    "connectStart": { "type": "number", "description": "Started connecting to the remote host." },
+                    "connectEnd": { "type": "number", "description": "Connected to the remote host." },
+                    "sslStart": { "type": "number", "description": "Started SSL handshake." },
+                    "sslEnd": { "type": "number", "description": "Finished SSL handshake." },
+                    "sendStart": { "type": "number", "description": "Started sending request." },
+                    "sendEnd": { "type": "number", "description": "Finished sending request." },
+                    "receiveHeadersEnd": { "type": "number", "description": "Finished receiving response headers." }
+                }
+            },
+            {
+                "id": "ResourceRequest",
+                "type": "object",
+                "description": "HTTP request data.",
+                "properties": {
+                    "url": { "type": "string", "description": "Request URL." },
+                    "method": { "type": "string", "description": "HTTP request method." },
+                    "headers": { "type": "object", "description": "HTTP request headers." },
+                    "postData": { "type": "string", "optional": true, "description": "HTTP POST request data." }
+                }
+            },
+            {
+                "id": "ResourceResponse",
+                "type": "object",
+                "description": "HTTP response data.",
+                "properties": {
+                    "status": { "type": "number", "description": "HTTP response status code." },
+                    "statusText": { "type": "string", "description": "HTTP response status text." },
+                    "headers": { "type": "object", "description": "HTTP response headers." },
+                    "mimeType": { "type": "string", "description": "Resource mimeType as determined by the browser." },
+                    "requestHeaders": { "type": "object", "optional": true, "description": "Refined HTTP request headers that were actually transmitted over the network." },
+                    "connectionReused": { "type": "boolean", "description": "Specifies whether physical connection was actually reused for this request." },
+                    "connectionID": { "type": "number", "description": "Physical connection id that was actually used for this request." },
+                    "fromDiskCache": { "type": "boolean", "optional": true, "description": "Specifies that the resource was loaded from the disk cache." },
+                    "timing": { "$ref": "ResourceTiming", "optional": true, "description": "Timing information for the given request." }
+                }
+            },
+            {
+                "id": "CachedResource",
+                "type": "object",
+                "description": "Information about the cached resource.",
+                "properties": {
+                    "url": { "type": "string", "description": "Resource URL." },
+                    "type": { "type": "string", "description": "Type of this resource. // FIXME" },
+                    "response": { "$ref": "ResourceResponse", "description": "Cached response data." },
+                    "bodySize": { "type": "number", "description": "Cached response body size." }
+                }
+            },
+            {
+                "id": "Frame",
+                "type": "object",
+                "description": "Information about the Frame on the page.",
+                "properties": {
+                    "id": { "type": "string", "description": "Frame unique identifier." },
+                    "parentId": { "type": "string", "description": "Parent frame identifier." },
+                    "loaderId": { "type": "string", "description": "Identifier of the loader associated with this frame." },
+                    "name": { "type": "string", "optional": true, "description": "Frame's name as specified in the tag." },
+                    "url": { "type": "string", "description": "Frame document's URL." }
+                }
+            },
+            {
+                "id": "FrameResourceTree",
+                "type": "object",
+                "description": "Information about the Frame hierarchy along with their cached resources.",
+                "properties": {
+                    "frame": { "$ref": "Frame", "description": "Frame information for this tree item." },
+                    "childFrames": { "type": "array", "optional": true, "items": { "$ref": "FrameResourceTree" }, "description": "Child frames." },
+                    "resources": { "type": "array",
+                        "items": {
+                            "type": "object",
+                            "properties": {
+                                "url": { "type": "string", "description": "Resource URL." },
+                                "type": { "type": "string", "description": "Type of this resource. // FIXME" }
+                            }
+                        },
+                        "description": "Information about frame resources."
+                    }
+                }
+            }
+        ],
+        "commands": [
+            {
+                "name": "enable",
+                "description": "Enables network tracking, network events will now be delivered to the client."
+            },
+            {
+                "name": "disable",
+                "description": "Disables network tracking, prevents network events from being sent to the client."
+            },
+            {
+                "name": "getCachedResources",
+                "description": "Returns present frame / resource tree structure.",
+                "returns": [
+                    { "name": "frameTree", "$ref": "FrameResourceTree", "description": "Present frame / resource tree structure." }
+                ]
+            },
+            {
+                "name": "getResourceContent",
+                "description": "Returns content of the given resource.",
+                "parameters": [
+                    { "name": "frameId", "type": "string", "description": "Frame id to get resource for."  },
+                    { "name": "url", "type": "string", "description": "URL of the resource to get content for."  },
+                    { "name": "base64Encode", "type": "boolean", "optional": true, "description": "Requests that resource content is served as base64."  }
+                ],
+                "returns": [
+                    { "name": "content", "type": "string", "description": "Resource content." }
+                ]
+            },
+            {
+                "name": "setExtraHeaders",
+                "description": "Allows sending extra HTTP headers with the requests from this page.",
+                "parameters": [
+                    { "name": "headers", "type": "object", "description": "Map with extra HTTP headers." }
+                ]
+            }
+        ],
+        "events": [
+            {
+                "name": "frameDetached",
+                "description": "Fired when frame has been detached from its parent.",
+                "parameters": [
+                    { "name": "frameId", "type": "string", "description": "If of the frame that has been detached." }
+                ]
+            },
+            {
+                "name": "requestWillBeSent",
+                "description": "Fired when page is about to send HTTP request.",
+                "parameters": [
+                    { "name": "identifier", "type": "integer", "description": "Request identifier." },
+                    { "name": "frameId", "type": "string", "description": "Frame identifier." },
+                    { "name": "loaderId", "type": "string", "description": "Loader identifier." },
+                    { "name": "documentURL", "type": "string", "description": "URL of the document this resource is loaded for." },
+                    { "name": "request", "$ref": "ResourceRequest", "description": "Request data." },
+                    { "name": "redirectResponse", "$ref": "ResourceResponse", "description": "Redirect response data." },
+                    { "name": "time", "type": "number", "description": "Timestamp." },
+                    { "name": "callStack", "type": "array", "items": { "$ref" : "DebuggerStackFrame"}, "description": "JavaScript stack trace upon issuing this request." }
+                ]
+            },
+            {
+                "name": "resourceMarkedAsCached",
+                "description": "Fired when request is known to be served from memory cache.",
+                "parameters": [
+                    { "name": "identifier", "type": "integer", "description": "Request identifier." }
+                ]
+            },
+            {
+                "name": "responseReceived",
+                "description": "Fired when HTTP response is available.",
+                "parameters": [
+                    { "name": "identifier", "type": "integer", "description": "Request identifier." },
+                    { "name": "time", "type": "number", "description": "Timestamp." },
+                    { "name": "resourceType", "type": "string", "description": "Resource type. // FIXME" },
+                    { "name": "response", "$ref": "ResourceResponse", "description": "Response data." }
+                ]
+            },
+            {
+                "name": "dataReceived",
+                "description": "Fired when data chunk was received over the network.",
+                "parameters": [
+                    { "name": "identifier", "type": "integer", "description": "Request identifier." },
+                    { "name": "time", "type": "number", "description": "Timestamp." },
+                    { "name": "dataLength", "type": "integer", "description": "Data chunk length." },
+                    { "name": "lengthReceived", "type": "integer", "description": "Actual bytes received (might be less than dataLength for compressed encodings)." }
+                ]
+            },
+            {
+                "name": "loadingFinished",
+                "description": "Fired when HTTP request has finished loading.",
+                "parameters": [
+                    { "name": "identifier", "type": "integer", "description": "Request identifier." },
+                    { "name": "finishTime", "type": "number", "description": "Timestamp." }
+                ]
+            },
+            {
+                "name": "loadingFailed",
+                "description": "Fired when HTTP request has failed to load.",
+                "parameters": [
+                    { "name": "identifier", "type": "integer", "description": "Request identifier." },
+                    { "name": "time", "type": "number", "description": "Timestamp." },
+                    { "name": "errorText", "type": "string", "description": "User friendly error message." }
+                ]
+            },
+            {
+                "name": "resourceLoadedFromMemoryCache",
+                "description": "Fired when HTTP request has been served from memory cache.",
+                "parameters": [
+                    { "name": "frameId", "type": "string", "description": "Frame identifier." },
+                    { "name": "loaderId", "type": "string", "description": "Loader identifier." },
+                    { "name": "documentURL", "type": "string", "description": "URL of the document this resource is loaded for." },
+                    { "name": "time", "type": "number", "description": "Timestamp." },
+                    { "name": "resource", "$ref": "CachedResource", "description": "Cached resource data." }
+                ]
+            },
+            {
+                "name": "initialContentSet",
+                "description": "Fired for XMLHttpRequests when their content becomes available.",
+                "parameters": [
+                    { "name": "identifier", "type": "integer", "description": "Request identifier." },
+                    { "name": "content", "type": "string", "description": "Resource content." },
+                    { "name": "type", "type": "string", "description": "Resource type. // FIXME" }
+                ]
+            },
+            {
+                "name": "frameNavigated",
+                "description": "Fired once navigation of the frame has completed. Frame is now associated with the new loader.",
+                "parameters": [
+                    { "name": "frame", "$ref": "Frame", "description": "Frame identifier." },
+                    { "name": "loaderId", "type": "string", "description": "Loader identifier." }
+                ]
+            },
+            {
+                "name": "webSocketWillSendHandshakeRequest",
+                "description": "Fired when WebSocket is about to initiate handshake.",
+                "parameters": [
+                    { "name": "identifier", "type": "integer", "description": "Request identifier." },
+                    { "name": "time", "type": "number", "description": "Timestamp." },
+                    { "name": "request", "type": "object", "description": "WebSocket request data." }
+                ]
+            },
+            {
+                "name": "webSocketHandshakeResponseReceived",
+                "description": "Fired when WebSocket handshake response becomes available.",
+                "parameters": [
+                    { "name": "identifier", "type": "integer", "description": "Request identifier." },
+                    { "name": "time", "type": "number", "description": "Timestamp." },
+                    { "name": "response", "type": "object", "description": "WebSocket response data." }
+                ]
+            },
+            {
+                "name": "webSocketCreated",
+                "description": "Fired upon WebSocket creation.",
+                "parameters": [
+                    { "name": "identifier", "type": "integer", "description": "Request identifier." },
+                    { "name": "url", "type": "string", "description": "WebSocket request URL." }
+                ]
+            },
+            {
+                "name": "webSocketClosed",
+                "description": "Fired when WebSocket is closed.",
+                "parameters": [
+                    { "name": "identifier", "type": "integer", "description": "Request identifier." },
+                    { "name": "time", "type": "number", "description": "Timestamp." }
+                ]
+            }
+        ]
+    },
+    {
+        "domain": "Database",
+        "types": [],
+        "commands": [
+            {
+                "name": "getDatabaseTableNames",
+                "parameters": [
+                    { "name": "databaseId", "type": "integer" }
+                ],
+                "returns": [
+                    { "name": "tableNames", "type": "array", "items": { "type": "string" } }
+                ]
+            },
+            {
+                "name": "executeSQL",
+                "parameters": [
+                    { "name": "databaseId", "type": "integer" },
+                    { "name": "query", "type": "string" }
+                ],
+                "returns": [
+                    { "name": "success", "type": "boolean" },
+                    { "name": "transactionId", "type": "integer" }
+                ]
+            }
+        ],
+        "events": [
+            {
+                "name": "addDatabase",
+                "parameters": [
+                    { "name": "database", "$ref": "DatabaseDatabase" }
+                ]
+            },
+            {
+                "name": "sqlTransactionSucceeded",
+                "parameters": [
+                    { "name": "transactionId", "type": "integer" },
+                    { "name": "columnNames", "type": "array", "items": { "type": "string" } },
+                    { "name": "values", "type": "array", "items": { "type": "string or number" }}
+                ]
+            },
+            {
+                "name": "sqlTransactionFailed",
+                "parameters": [
+                    { "name": "transactionId", "type": "integer" },
+                    { "name": "sqlError", "$ref": "DatabaseError" }
+                ]
+            }
+        ]
+    },
+    {
+        "domain": "DOMStorage",
+        "types": [],
+        "commands": [
+            {
+                "name": "getDOMStorageEntries",
+                "parameters": [
+                    { "name": "storageId", "type": "integer" }
+                ],
+                "returns": [
+                    { "name": "entries", "type": "array", "items": { "$ref" : "DOMStorageEntry"} }
+                ]
+            },
+            {
+                "name": "setDOMStorageItem",
+                "parameters": [
+                    { "name": "storageId", "type": "integer" },
+                    { "name": "key", "type": "string" },
+                    { "name": "value", "type": "string" }
+                ],
+                "returns": [
+                    { "name": "success", "type": "boolean" }
+                ]
+            },
+            {
+                "name": "removeDOMStorageItem",
+                "parameters": [
+                    { "name": "storageId", "type": "integer" },
+                    { "name": "key", "type": "string" }
+                ],
+                "returns": [
+                    { "name": "success", "type": "boolean" }
+                ]
+            }
+        ],
+        "events": [
+            {
+                "name": "addDOMStorage",
+                "parameters": [
+                    { "name": "storage", "$ref": "DOMStorageStorage" }
+                ]
+            },
+            {
+                "name": "updateDOMStorage",
+                "parameters": [
+                    { "name": "storageId", "type": "integer" }
+                ]
+            }
+        ]
+    },
+    {
+        "domain": "ApplicationCache",
+        "types": [],
+        "commands": [
+            {
+                "name": "getApplicationCaches",
+                "returns": [
+                    { "name": "applicationCaches", "$ref": "AppCache" }
+                ]
+            }
+        ],
+        "events": [
+            {
+                "name": "updateApplicationCacheStatus",
+                "parameters": [
+                    { "name": "status", "type": "integer" }
+                ]
+            },
+            {
+                "name": "updateNetworkState",
+                "parameters": [
+                    { "name": "isNowOnline", "type": "boolean" }
+                ]
+            }
+        ]
+    },
+    {
+        "domain": "DOM",
+        "description": "This domain exposes DOM read/write operations. Each DOM Node is represented with its mirror object that has an <code>id</code>. This <code>id</code> can be used to get additional information on the Node, convert it into the JavaScript object, etc. It is important that client receives DOM events only for the nodes that are known to the client. Backend keeps track of the nodes that were sent to the client and never sends the same node twice. It is client's responsibility to collect information about the nodes that were sent to the client.",
+        "types": [
+            {
+                "id": "DOMNode",
+                "type": "object",
+                "properties": {
+                    "id": { "type": "integer", "description": "Node identifier that is passed into the rest of the DOM messages as the <code>nodeId</code>. Backend will only push node with given <code>id</code> once. It is aware of all requested nodes and will only fire DOM events for nodes known to the client." },
+                    "nodeType": { "type": "integer",  "description": "<code>Node</code>'s nodeType." },
+                    "nodeName": { "type": "string", "description": "<code>Node</code>'s nodeName." },
+                    "localName": { "type": "string", "description": "<code>Node</code>'s localName." },
+                    "nodeValue": { "type": "string", "description": "<code>Node</code>'s nodeValue." },
+                    "childNodeCount": { "type": "integer", "optional": true, "description": "Child count for <code>Container</code> nodes." },
+                    "children": { "type": "array", "optional": true, "items": { "$ref" : "DOMNode" }, "description": "Child nodes of this node when requested with children." },
+                    "attributes": { "type": "array", "optional": true, "items": { "type" : "string" }, "description": "Attributes of the <code>Element</code> node in the form of flat array <code>[name1, value1, name2, value2]</code>." },
+                    "documentURL": { "type": "string", "optional": true, "description": "Document URL that <code>Document</code> or <code>FrameOwner</code> node points to." },
+                    "publicId": { "type": "string", "optional": true, "description": "<code>DocumentType</code>'s publicId. // FIXME" },
+                    "systemId": { "type": "string", "optional": true, "description": "<code>DocumentType</code>'s systemId. // FIXME" },
+                    "internalSubset": { "type": "string", "optional": true, "description": "<code>DocumentType</code>'s internalSubset. // FIXME" },
+                    "name": { "type": "string", "optional": true, "description": "<code>Attr</code>'s name. // FIXME" },
+                    "value": { "type": "string", "optional": true, "description": "<code>Attr</code>'s value. // FIXME" }
+                },
+                "description": "DOM interaction is implemented in terms of mirror objects that represent the actual DOM nodes. DOMNode is a base node mirror type."
+            },
+            {
+                "id": "DOMEventListener",
+                "type": "object",
+                "properties": {
+                    "type": { "type": "string", "description": "<code>EventListener</code>'s type." },
+                    "useCapture": { "type": "boolean", "description": "<code>EventListener</code>'s useCapture." },
+                    "isAttribute": { "type": "boolean", "description": "<code>EventListener</code>'s isAttribute." },
+                    "nodeId": { "type": "integer",  "description": "Target <code>DOMNode</code> id." },
+                    "listenerBody": { "type": "string", "description": "Listener function body." },
+                    "sourceName": { "type": "string", "optional" : true, "description": "Handler location source name." },
+                    "lineNumber": { "type": "number", "optional" : true, "description": "Handler location line number." }
+                },
+                "description": "DOM interaction is implemented in terms of mirror objects that represent the actual DOM nodes. DOMNode is a base node mirror type."
+            }
+        ],
+        "commands": [
+            {
+                "name": "getDocument",
+                "returns": [
+                    { "name": "root", "$ref": "DOMNode", "description": "Resulting node." }
+                ],
+                "description": "Returns the root DOM node to the caller."
+            },
+            {
+                "name": "getChildNodes",
+                "parameters": [
+                    { "name": "nodeId", "type": "integer", "description": "Id of the node to get children for." }
+                ],
+                "description": "Requests that children of the node with given id are returned to the caller in form of <code>setChildNodes</code> events."
+            },
+            {
+                "name": "querySelector",
+                "parameters": [
+                    { "name": "nodeId", "type": "integer", "description": "Id of the node to query upon." },
+                    { "name": "selectors", "type": "string", "description": "Selector string." },
+                    { "name": "documentWide", "type": "boolean", "description": "Set to true to start querying from the node's document." }
+                ],
+                "returns": [
+                    { "name": "elementId", "type": "integer", "description": "Query selector result." }
+                ],
+                "description": "Executes <code>querySelector</code> on a given node. Setting <code>documentWide</code> to true starts selecting from the document node."
+            },
+            {
+                "name": "querySelectorAll",
+                "parameters": [
+                    { "name": "nodeId", "type": "integer", "description": "Id of the node to query upon." },
+                    { "name": "selectors", "type": "string", "description": "Selector string." },
+                    { "name": "documentWide", "type": "boolean", "description": "Set to true to start querying from the node's document." }
+                ],
+                "returns": [
+                    { "name": "nodeIds", "type": "array", "items": { "type": "integer" }, "description": "Query selector result."  }
+                ],
+                "description": "Executes <code>querySelectorAll</code> on a given node. Setting <code>documentWide</code> to true starts selecting from the document node."
+            },
+            {
+                "name": "setNodeName",
+                "parameters": [
+                    { "name": "nodeId", "type": "integer", "description": "Id of the node to set name for."  },
+                    { "name": "name", "type": "string", "description": "New node's name." }
+                ],
+                "returns": [
+                    { "name": "outNodeId", "type": "integer", "description": "New node's id." }
+                ],
+                "description": "Sets node name for a node with given id."
+            },
+            {
+                "name": "setNodeValue",
+                "parameters": [
+                    { "name": "nodeId", "type": "integer", "description": "Id of the node to set value for." },
+                    { "name": "value", "type": "string", "description": "New node's value." }
+                ],
+                "description": "Sets node value for a node with given id."
+            },
+            {
+                "name": "removeNode",
+                "parameters": [
+                    { "name": "nodeId", "type": "integer", "description": "Id of the node to remove." }
+                ],
+                "description": "Removes node with given id."
+            },
+            {
+                "name": "setAttribute",
+                "parameters": [
+                    { "name": "elementId", "type": "integer", "description": "Id of the element to set attribute for." },
+                    { "name": "name", "type": "string", "description": "Attribute name." },
+                    { "name": "value", "type": "string", "description": "Attribute value." }
+                ],
+                "description": "Sets attribute for an element with given id."
+            },
+            {
+                "name": "removeAttribute",
+                "parameters": [
+                    { "name": "elementId", "type": "integer", "description": "Id of the element to remove attribute from." },
+                    { "name": "name", "type": "string", "description": "Name of the attribute to remove." }
+                ],
+                "description": "Removes attribute with given name from an element with given id."
+            },
+            {
+                "name": "getEventListenersForNode",
+                "parameters": [
+                    { "name": "nodeId", "type": "integer", "description": "Id of the node to get listeners for." }
+                ],
+                "returns": [
+                    { "name": "listenersArray", "type": "array", "items": { "$ref" : "DOMEventListener"}, "description": "Array of relevant listeners." }
+                ],
+                "description": "Returns event listeners relevant to the node."
+            },
+            {
+                "name": "copyNode",
+                "parameters": [
+                    { "name": "nodeId", "type": "integer", "description": "Id of the node to copy." }
+                ],
+                "description": "Copies node's HTML markup into the clipboard."
+            },
+            {
+                "name": "getOuterHTML",
+                "parameters": [
+                    { "name": "nodeId", "type": "integer", "description": "Id of the node to get markup for." }
+                ],
+                "returns": [
+                    { "name": "outerHTML", "type": "string", "description": "Outer HTML markup." }
+                ],
+                "description": "Returns node's HTML markup."
+            },
+            {
+                "name": "setOuterHTML",
+                "parameters": [
+                    { "name": "nodeId", "type": "integer", "description": "Id of the node to set markup for." },
+                    { "name": "outerHTML", "type": "string", "description": "Outer HTML markup to set." }
+                ],
+                "returns": [
+                    { "name": "outNodeId", "type": "integer", "description": "Setting outer HTML can change node's id." }
+                ],
+                "description": "Sets node HTML markup, returns new node id."
+            },
+            {
+                "name": "performSearch",
+                "parameters": [
+                    { "name": "query", "type": "string", "description": "Plain text or query selector or XPath search query." },
+                    { "name": "runSynchronously", "type": "boolean", "description": "When set to true, performing search synchronously (can block user interaction)." }
+                ],
+                "description": "Starts asynchronous search for a given string in the DOM tree. Use <code>cancelSearch</code> to stop given asynchronous search task."
+            },
+            {
+                "name": "cancelSearch",
+                "description": "Cancels asynchronous search started with <code>performSearch</code>."
+            },
+            {
+                "name": "pushNodeToFrontend",
+                "parameters": [
+                    { "name": "objectId", "type": "string", "description": "JavaScript object id to convert into node." }
+                ],
+                "returns": [
+                    { "name": "nodeId", "type": "integer", "description": "Node id for given object." }
+                ],
+                "description": "Requests that the node is sent to the caller given the JavaScript node object reference."
+            },
+            {
+                "name": "setSearchingForNode",
+                "parameters": [
+                    { "name": "enabled", "type": "boolean" }
+                ],
+                "returns": [
+                    { "name": "newState", "type": "boolean" }
+                ]
+            },
+            {
+                "name": "highlightDOMNode",
+                "parameters": [
+                    { "name": "nodeId", "type": "integer" }
+                ]
+            },
+            {
+                "name": "hideDOMNodeHighlight"
+            },
+            {
+                "name": "highlightFrame",
+                "parameters": [
+                    { "name": "frameId", "type": "string" }
+                ]
+            },
+            {
+                "name": "hideFrameHighlight"
+            },
+
+            {
+                "name": "pushNodeByPathToFrontend",
+                "parameters": [
+                    { "name": "path", "type": "string", "description": "Path to node in the proprietary format." }
+                ],
+                "returns": [
+                    { "name": "nodeId", "type": "integer", "description": "Id of the node for given path." }
+                ],
+                "description": "Requests that the node is sent to the caller given its path. // FIXME, use XPath"
+            },
+            {
+                "name": "resolveNode",
+                "parameters": [
+                    { "name": "nodeId", "type": "integer", "description": "Id of the node to resolve." }
+                ],
+                "returns": [
+                    { "name": "object", "$ref": "Object", "description": "JavaScript object wrapper for given node." }
+                ],
+                "description": "Resolves JavaScript node object for given node id."
+            }
+        ],
+        "events": [
+            {
+                "name": "documentUpdated",
+                "description": "Fired when <code>Document</code> has been totally updated. Node ids are no longer valid."
+            },
+            {
+                "name": "setChildNodes",
+                "parameters": [
+                    { "name": "parentId", "type": "integer", "description": "Parent node id to populate with children." },
+                    { "name": "nodes", "type": "array", "items": { "$ref" : "DOMNode"}, "description": "Child nodes array." }
+                ],
+                "description": "Fired when backend wants to provide client with the missing DOM structure. This happens upon most of the calls requesting node ids."
+            },
+            {
+                "name": "attributesUpdated",
+                "parameters": [
+                    { "name": "id", "type": "integer", "description": "Id of the node that has changed." },
+                    { "name": "attributes", "type": "array", "items": { "$ref" : "DOMAttribute"}, "description": "New attributes value." }
+                ],
+                "description": "Fired when <code>Element</code>'s attributes are updated."
+            },
+            {
+                "name": "characterDataModified",
+                "parameters": [
+                    { "name": "id", "type": "integer", "description": "Id of the node that has changed." },
+                    { "name": "newValue", "type": "string", "description": "New text value." }
+                ],
+                "description": "Mirrors <code>DOMCharacterDataModified</code> event."
+            },
+            {
+                "name": "childNodeCountUpdated",
+                "parameters": [
+                    { "name": "id", "type": "integer", "description": "Id of the node that has changed." },
+                    { "name": "newValue", "type": "integer", "description": "New node count." }
+                ],
+                "description": "Fired when <code>Container</code>'s child node count has changed."
+            },
+            {
+                "name": "childNodeInserted",
+                "parameters": [
+                    { "name": "parentId", "type": "integer", "description": "Id of the node that has changed." },
+                    { "name": "prevId", "type": "integer", "description": "If of the previous siblint." },
+                    { "name": "node", "$ref": "DOMNode", "description": "Inserted node data." }
+                ],
+                "description": "Mirrors <code>DOMNodeInserted</code> event."
+            },
+            {
+                "name": "childNodeRemoved",
+                "parameters": [
+                    { "name": "parentId", "type": "integer", "description": "Parent id." },
+                    { "name": "id", "type": "integer", "description": "Id of the node that has been removed." }
+                ],
+                "description": "Mirrors <code>DOMNodeRemoved</code> event."
+            },
+            {
+                "name": "searchResults",
+                "parameters": [
+                    { "name": "nodeIds", "type": "array", "items": { "type": "integer" }, "description": "Ids of the search result nodes." }
+                ],
+                "description": "Pushes search results initiated using <code>performSearch</code> to the client."
+            }
+        ]
+    },
+    {
+        "domain": "CSS",
+        "types": [],
+        "commands": [
+            {
+                "name": "getStylesForNode",
+                "parameters": [
+                    { "name": "nodeId", "type": "integer" }
+                ],
+                "returns": [
+                    { "name": "styles", "$ref": "CSSNodeStyles" }
+                ]
+            },
+            {
+                "name": "getComputedStyleForNode",
+                "parameters": [
+                    { "name": "nodeId", "type": "integer" }
+                ],
+                "returns": [
+                    { "name": "style", "$ref": "CSSComputedStyle" }
+                ]
+            },
+            {
+                "name": "getInlineStyleForNode",
+                "parameters": [
+                    { "name": "nodeId", "type": "integer" }
+                ],
+                "returns": [
+                    { "name": "style", "$ref": "CSSStyle" }
+                ]
+            },
+            {
+                "name": "getAllStyleSheets",
+                "returns": [
+                    { "name": "styleSheetInfos", "type": "array", "items": { "$ref": "CSSStyleSheetInfo" } }
+                ]
+            },
+            {
+                "name": "getStyleSheet",
+                "parameters": [
+                    { "name": "styleSheetId", "type": "string" }
+                ],
+                "returns": [
+                    { "name": "styleSheet", "$ref": "CSSStyleSheet" }
+                ]
+            },
+            {
+                "name": "getStyleSheetText",
+                "parameters": [
+                    { "name": "styleSheetId", "type": "string" }
+                ],
+                "returns": [
+                    { "name": "url", "type": "string" },
+                    { "name": "text", "type": "string" }
+                ]
+            },
+            {
+                "name": "setStyleSheetText",
+                "parameters": [
+                    { "name": "styleSheetId", "type": "string" },
+                    { "name": "text", "type": "string" }
+                ],
+                "returns": [
+                    { "name": "success", "type": "boolean" }
+                ]
+            },
+            {
+                "name": "setPropertyText",
+                "parameters": [
+                    { "name": "styleId", "$ref": "CSSStyleId" },
+                    { "name": "propertyIndex", "type": "integer" },
+                    { "name": "text", "type": "string" },
+                    { "name": "overwrite", "type": "boolean" }
+                ],
+                "returns": [
+                    { "name": "style", "$ref": "CSSStyle" }
+                ]
+            },
+            {
+                "name": "toggleProperty",
+                "parameters": [
+                    { "name": "styleId", "$ref": "CSSStyleId" },
+                    { "name": "propertyIndex", "type": "integer" },
+                    { "name": "disable", "type": "boolean" }
+                ],
+                "returns": [
+                    { "name": "style", "$ref": "CSSStyle" }
+                ]
+            },
+            {
+                "name": "setRuleSelector",
+                "parameters": [
+                    { "name": "ruleId", "$ref": "CSSRuleId" },
+                    { "name": "selector", "type": "string" }
+                ],
+                "returns": [
+                    { "name": "rule", "$ref": "CSSRule" }
+                ]
+            },
+            {
+                "name": "addRule",
+                "parameters": [
+                    { "name": "contextNodeId", "type": "integer" },
+                    { "name": "selector", "type": "string" }
+                ],
+                "returns": [
+                    { "name": "rule", "$ref": "CSSRule" }
+                ]
+            },
+            {
+                "name": "getSupportedCSSProperties",
+                "returns": [
+                    { "name": "cssProperties", "type": "array", "items": { "type": "string" } }
+                ]
+            }
+        ]
+    },
+    {
+        "domain": "Timeline",
+        "description": "Timeline provides its clients with instrumentation records that are generated during the page runtime. Timeline instrumentation can be started and stopped using corresponding commands. While timeline is started, it is generating timeline event records.",
+        "types": [
+            {
+                "id": "TimelineRecord",
+                "type": "object",
+                "properties": {
+                    "type": { "type": "string", "description": "Event type." },
+                    "data": { "type": "object", "description": "Event data." },
+                    "children": { "type": "array", "optional" : true, "items": { "$ref": "TimelineRecord" }, "description": "Nested records." }
+                },
+                "description": "Timeline record contains information about the recorded activity."
+            }
+        ],
+        "commands": [
+            {
+                "name": "start",
+                "description": "Starts capturing instrumentation events."
+            },
+            {
+                "name": "stop",
+                "description": "Stops capturing instrumentation events."
+            }
+        ],
+        "events": [
+            {
+                "name": "started",
+                "description": "Fired when timeline has been started."
+            },
+            {
+                "name": "stopped",
+                "description": "Fired when timeline has been stopped."
+            },
+            {
+                "name": "eventRecorded",
+                "parameters": [
+                    { "name": "record", "$ref": "TimelineRecord", "description": "Timeline record data." }
+                ],
+                "description": "Fired for every instrumentation event while timeline is started."
+            }
+        ]
+    },
+    {
+        "domain": "Debugger",
+        "description": "Debugger domain exposes JavaScript debugging functions. It allows setting and removing breakpoints, stepping through execution, exploring stack traces, etc.",
+        "types": [
+            {
+                "id": "Location",
+                "type": "object",
+                "properties": {
+                    "sourceID": { "type": "string",  "description": "Script identifier as reported by the <code>scriptParsed</code>" },
+                    "lineNumber": { "type": "integer", "description": "Line number in the script." },
+                    "columnNumber": { "type": "integer", "description": "Column number in the script." }
+                },
+                "description": "Location in the source code."
+            },
+            {
+                "id": "CallFrame",
+                "type": "object",
+                "properties": {
+                    "id": { "type": "string",  "description": "Call frame identifier" },
+                    "type": { "type": "string", "description": "Call frame type. // FIXME" },
+                    "functionName": { "type": "string", "description": "Name of the function called on this frame." },
+                    "sourceID": { "type": "string", "description": "Script identifier." },
+                    "line": { "type": "integer", "description": "Line number in the script." },
+                    "column": { "type": "integer", "description": "Column number in the script." },
+                    "scopeChain": { "type": "array", "items": { "type": "object" }, "description": "Scope chain for given call frame. // FIXME" }
+                },
+                "description": "Debugger call frame. Array of call frames form call stack."
+            }
+        ],
+        "commands": [
+            {
+                "name": "enable",
+                "description": "Enables debugger for given page."
+            },
+            {
+                "name": "disable",
+                "description": "Disables debugger for given page."
+            },
+            {
+                "name": "setBreakpointsActive",
+                "parameters": [
+                    { "name": "active", "type": "boolean", "description": "New value for breakpoints active state." }
+                ],
+                "description": "Activates / deactivates all breakpoints on the page."
+            },
+            {
+                "name": "setBreakpointByUrl",
+                "parameters": [
+                    { "name": "url", "type": "string", "description": "URL of the resource to set breakpoint on." },
+                    { "name": "lineNumber", "type": "integer", "description": "Line number to set breakpoint at." },
+                    { "name": "columnNumber", "type": "integer", "optional": true, "description": "Offset in the line to set breakpoint at." },
+                    { "name": "condition", "type": "string", "optional": true, "description": "Expression to use as a breakpoint condition. When specified, debugger will only stop on the breakpoint if this expression evaluates to true." },
+                    { "name": "enabled", "type": "boolean", "optional": true, "description": "Determines initial state for the breakpoint." }
+                ],
+                "returns": [
+                    { "name": "breakpointId", "type": "string", "description": "Id of the created breakpoint for further manipulations." },
+                    { "name": "locations", "type": "array", "items": { "$ref" : "Location"}, "description": "List of the locations this breakpoint resolved into."  }
+                ],
+                "description": "Sets JavaScript breakpoint at a given location specified by URL. This breakpoint will survive page reload."
+            },
+            {
+                "name": "setBreakpoint",
+                "parameters": [
+                    { "name": "sourceId", "type": "string", "description": "Source ID of the resource to set breakpoint on (as reported by <code>scriptParsed</code>)." },
+                    { "name": "lineNumber", "type": "integer", "description": "Line number to set breakpoint at." },
+                    { "name": "columnNumber", "type": "integer", "optional": true, "description": "Offset in the line to set breakpoint at." },
+                    { "name": "condition", "type": "string", "optional": true, "description": "Expression to use as a breakpoint condition. When specified, debugger will only stop on the breakpoint if this expression evaluates to true." },
+                    { "name": "enabled", "type": "boolean", "optional": true, "description": "Determines initial state for the breakpoint." }
+                ],
+                "returns": [
+                    { "name": "breakpointId", "type": "string", "description": "Id of the created breakpoint for further manipulations." },
+                    { "name": "actualLineNumber", "type": "integer", "description": "Line number in the script." },
+                    { "name": "actualColumnNumber", "type": "integer", "description": "Column number in the script." }
+                ],
+                "description": "Sets JavaScript breakpoint at a given location."
+            },
+            {
+                "name": "removeBreakpoint",
+                "parameters": [
+                    { "name": "breakpointId", "type": "string" }
+                ],
+                "description": "Removes JavaScript breakpoint."
+            },
+            {
+                "name": "continueToLocation",
+                "parameters": [
+                    { "name": "sourceId", "type": "string", "description": "Source ID of the resource to continue to (as reported by <code>scriptParsed</code>)." },
+                    { "name": "lineNumber", "type": "integer", "description": "Line number to stop at." },
+                    { "name": "columnNumber", "type": "integer", "description": "Column number to stop at." }
+                ],
+                "description": "Continues execution until specific location is reached."
+            },
+            {
+                "name": "stepOver",
+                "description": "Steps over the statement."
+            },
+            {
+                "name": "stepInto",
+                "description": "Steps into the statement."
+            },
+            {
+                "name": "stepOut",
+                "description": "Steps out of the function."
+            },
+            {
+                "name": "pause",
+                "description": "Stops on the next JavaScript statement."
+            },
+            {
+                "name": "resume",
+                "description": "Resumes JavaScript execution."
+            },
+            {
+                "name": "editScriptSource",
+                "parameters": [
+                    { "name": "sourceID", "type": "string", "description": "Id of the script to edit." },
+                    { "name": "newContent", "type": "string", "description": "New content of the script." }
+                ],
+                "returns": [
+                    { "name": "result", "type": "string", "description": "New content of the script." },
+                    { "name": "stackFrames", "type": "array", "items": { "$ref" : "CallFrame"}, "description": "New stack trace in case editing has happened while VM was stopped." }
+                ],
+                "description": "Edits JavaScript script live."
+            },
+            {
+                "name": "getScriptSource",
+                "parameters": [
+                    { "name": "sourceID", "type": "string", "description": "Id of the script to get source for." }
+                ],
+                "returns": [
+                    { "name": "scriptSource", "type": "string", "description": "Script source." }
+                ],
+                "description": "Returns source for the script with given ID."
+            },
+            {
+                "name": "setPauseOnExceptionsState",
+                "parameters": [
+                    { "name": "pauseOnExceptionsState", "type": "integer", "description": "Pause on exceptions mode. // FIXME, make enumerable." }
+                ],
+                "description": "Defines pause on exceptions state. Can be set to stop on all exceptions, uncaught exceptions or no exceptions."
+            },
+            {
+                "name": "evaluateOnCallFrame",
+                "parameters": [
+                    { "name": "callFrameId", "type": "string", "description": "Call frame identifier to evaluate on. This identifier is a part of backtrace reported by the <code>pausedScript</code>." },
+                    { "name": "expression", "type": "string", "description": "Expression to evaluate." },
+                    { "name": "objectGroup", "type": "string", "description": "String object group name to put result into (allows rapid releasing resulting object handles using <code>releaseObjectGroup</code>)." },
+                    { "name": "includeCommandLineAPI", "type": "boolean", "optional": true, "description": "Specifies whether command line API should be available to the evaluated expression, defaults to false." }
+                ],
+                "returns": [
+                    { "name": "result", "$ref": "Object", "description": "Object wrapper for the evaluation result." }
+                ],
+                "description": "Evaluates expression on a given call frame."
+            }
+        ],
+        "events": [
+            {
+                "name": "debuggerWasEnabled",
+                "description": "Fired when debugger gets enabled."
+            },
+            {
+                "name": "debuggerWasDisabled",
+                "description": "Fired when debugger gets disabled."
+            },
+            {
+                "name": "scriptParsed",
+                "parameters": [
+                    { "name": "sourceID", "type": "string", "description": "Identifier of the script parsed." },
+                    { "name": "url", "type": "string", "description": "URL of the script parsed (if any)." },
+                    { "name": "lineOffset", "type": "integer", "description": "Line offset of the script within the resource with given URL (for script tags)." },
+                    { "name": "columnOffset", "type": "integer", "description": "Column offset of the script within the resource with given URL." },
+                    { "name": "length", "type": "integer", "description": "Length of the script" },
+                    { "name": "scriptWorldType", "type": "integer", "description": "Script type. // FIXME." }
+                ],
+                "description": "Fired when virtual machine parses script. This even is also fired for all known scripts upon enabling debugger."
+            },
+            {
+                "name": "scriptFailedToParse",
+                "parameters": [
+                    { "name": "url", "type": "string", "description": "URL of the script that failed to parse." },
+                    { "name": "data", "type": "string", "description": "Source text of the script that failed to parse." },
+                    { "name": "firstLine", "type": "integer", "description": "Line offset of the script within the resource." },
+                    { "name": "errorLine", "type": "integer", "description": "Line with error." },
+                    { "name": "errorMessage", "type": "string", "description": "Parse error message." }
+                ],
+                "description": "Fired when virtual machine fails to parse the script."
+            },
+            {
+                "name": "breakpointResolved",
+                "parameters": [
+                    { "name": "breakpointId", "type": "string", "description": "Breakpoint unique identifier." },
+                    { "name": "sourceId", "type": "string", "description": "Identifier of the script breakpoint is set in." },
+                    { "name": "lineNumber", "type": "integer", "description": "Line number of the statement breakpoint is set on." },
+                    { "name": "columnNumber", "type": "integer", "description": "Column offset of the statement breakpoint is set on." }
+                ],
+                "description": "Fired when breakpoint is resolved to an actual script and location."
+            },
+            {
+                "name": "paused",
+                "parameters": [
+                    { 
+                        "name": "details",
+                        "type": "object",
+                        "properties": {
+                            "callFrames": { "type": "array", "items": { "$ref": "CallFrame" }, "description": "Call stack the virtual machine stopped on." }
+                        },
+                        "description": "Call stack information."
+                    }
+                ],
+                "description": "Fired when the virtual machine stopped on breakpoint or exception or any other stop criteria."
+            },
+            {
+                "name": "resumed",
+                "description": "Fired when the virtual machine resumed execution."
+            }
+        ]
+    },
+    {
+        "domain": "BrowserDebugger",
+        "description": "Browser debugging allows setting breakpoints on particular DOM operations and events. JavaScript execution will stop on these operations as if there was a regular breakpoint set.",
+        "commands": [
+            {
+                "name": "setDOMBreakpoint",
+                "parameters": [
+                    { "name": "nodeId", "type": "integer", "description": "Identifier of the node to set breakpoint on." },
+                    { "name": "type", "type": "integer", "description": "Type of the operation to stop upon." }
+                ],
+                "description": "Sets breakpoint on particular operation with DOM. "
+            },
+            {
+                "name": "removeDOMBreakpoint",
+                "parameters": [
+                    { "name": "nodeId", "type": "integer", "description": "Identifier of the node to remove breakpoint from." },
+                    { "name": "type", "type": "integer", "description": "Type of the breakpoint to remove." }
+                ],
+                "description": "Removes DOM breakpoint that was set using <code>setDOMBreakpoint</code>."
+            },
+            {
+                "name": "setEventListenerBreakpoint",
+                "parameters": [
+                    { "name": "eventName", "type": "string", "description": "Event name to stop on (any DOM event will do)." }
+                ],
+                "description": "Sets breakpoint on particular DOM event."
+            },
+            {
+                "name": "removeEventListenerBreakpoint",
+                "parameters": [
+                    { "name": "eventName", "type": "string", "description": "Event name." }
+                ],
+                "description": "Removes breakpoint on particular DOM event."
+            },
+            {
+                "name": "setXHRBreakpoint",
+                "parameters": [
+                    { "name": "url", "type": "string", "description": "Resource URL substring. All XHRs having this substring in the URL will get stopped upon." }
+                ],
+                "description": "Sets breakpoint on XMLHttpRequest."
+            },
+            {
+                "name": "removeXHRBreakpoint",
+                "parameters": [
+                    { "name": "url", "type": "string", "description": "Resource URL substring." }
+                ],
+                "description": "Removes breakpoint from XMLHttpRequest."
+            }
+        ]
+    },
+    {
+        "domain": "Profiler",
+        "types": [],
+        "commands": [
+            {
+                "name": "enable"
+            },
+            {
+                "name": "disable"
+            },
+            {
+                "name": "isEnabled",
+                "returns": [
+                    { "name": "state", "type": "boolean" }
+                ]
+            },
+            {
+                "name": "start"
+            },
+            {
+                "name": "stop"
+            },
+            {
+                "name": "getProfileHeaders",
+                "returns": [
+                    { "name": "headers", "type": "array", "items": { "$ref" : "ProfileHeader"} }
+                ]
+            },
+            {
+                "name": "getProfile",
+                "parameters": [
+                    { "name": "type", "type": "string" },
+                    { "name": "uid", "type": "integer" }
+                ],
+                "returns": [
+                    { "name": "profile", "$ref": "Profile" }
+                ]
+            },
+            {
+                "name": "removeProfile",
+                "parameters": [
+                    { "name": "type", "type": "string" },
+                    { "name": "uid", "type": "integer" }
+                ]
+            },
+            {
+                "name": "clearProfiles"
+            },
+            {
+                "name": "takeHeapSnapshot",
+                "parameters": [
+                    { "name": "detailed", "type": "boolean" }
+                ]
+            },
+            {
+                "name": "collectGarbage"
+            }
+        ],
+        "events": [
+            {
+                "name": "profilerWasEnabled"
+            },
+            {
+                "name": "profilerWasDisabled"
+            },
+            {
+                "name": "addProfileHeader",
+                "parameters": [
+                    { "name": "header", "$ref": "ProfileHeader" }
+                ]
+            },
+            {
+                "name": "addHeapSnapshotChunk",
+                "parameters": [
+                    { "name": "uid", "type": "integer" },
+                    { "name": "chunk", "type": "string" }
+                ]
+            },
+            {
+                "name": "finishHeapSnapshot",
+                "parameters": [
+                    { "name": "uid", "type": "integer" }
+                ]
+            },
+            {
+                "name": "setRecordingProfile",
+                "parameters": [
+                    { "name": "isProfiling", "type": "boolean" }
+                ]
+            },
+            {
+                "name": "resetProfiles"
+            },
+            {
+                "name": "reportHeapSnapshotProgress",
+                "parameters": [
+                    { "name": "done", "type": "integer" },
+                    { "name": "total", "type": "integer" }
+                ]
+            }
+        ]
+    }
+]
diff --git a/Source/WebCore/inspector/InspectorAgent.cpp b/Source/WebCore/inspector/InspectorAgent.cpp
index 15ceba0..beac507 100644
--- a/Source/WebCore/inspector/InspectorAgent.cpp
+++ b/Source/WebCore/inspector/InspectorAgent.cpp
@@ -1,6 +1,7 @@
 /*
  * Copyright (C) 2007, 2008, 2009, 2010 Apple Inc. All rights reserved.
  * Copyright (C) 2008 Matt Lilek <webkit@mattlilek.com>
+ * Copyright (C) 2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -32,40 +33,21 @@
 
 #if ENABLE(INSPECTOR)
 
-#include "CachedResource.h"
-#include "CachedResourceLoader.h"
-#include "Chrome.h"
-#include "Cookie.h"
-#include "CookieJar.h"
-#include "DOMWindow.h"
-#include "DOMWrapperWorld.h"
 #include "Document.h"
 #include "DocumentLoader.h"
-#include "Element.h"
-#include "FloatConversion.h"
-#include "FloatQuad.h"
-#include "FloatRect.h"
 #include "Frame.h"
-#include "FrameLoadRequest.h"
-#include "FrameLoader.h"
-#include "FrameTree.h"
-#include "FrameView.h"
 #include "GraphicsContext.h"
-#include "HTMLFrameOwnerElement.h"
-#include "HTTPHeaderMap.h"
-#include "HitTestResult.h"
-#include "InjectedScript.h"
 #include "InjectedScriptHost.h"
+#include "InjectedScriptManager.h"
 #include "InspectorBrowserDebuggerAgent.h"
 #include "InspectorCSSAgent.h"
 #include "InspectorClient.h"
 #include "InspectorConsoleAgent.h"
 #include "InspectorController.h"
 #include "InspectorDOMAgent.h"
-#include "InspectorDebuggerAgent.h"
 #include "InspectorFrontend.h"
-#include "InspectorFrontendClient.h"
 #include "InspectorInstrumentation.h"
+#include "InspectorPageAgent.h"
 #include "InspectorProfilerAgent.h"
 #include "InspectorResourceAgent.h"
 #include "InspectorRuntimeAgent.h"
@@ -74,35 +56,13 @@
 #include "InspectorValues.h"
 #include "InspectorWorkerResource.h"
 #include "InstrumentingAgents.h"
-#include "IntRect.h"
 #include "Page.h"
-#include "ProgressTracker.h"
-#include "Range.h"
-#include "RenderInline.h"
+#include "PageDebuggerAgent.h"
 #include "ResourceRequest.h"
-#include "ResourceResponse.h"
-#include "ScriptArguments.h"
-#include "ScriptCallStack.h"
 #include "ScriptFunctionCall.h"
 #include "ScriptObject.h"
-#include "ScriptProfile.h"
-#include "ScriptProfiler.h"
-#include "ScriptSourceCode.h"
 #include "ScriptState.h"
-#include "SecurityOrigin.h"
 #include "Settings.h"
-#include "SharedBuffer.h"
-#include "TextEncoding.h"
-#include "TextIterator.h"
-#include "TextRun.h"
-#include "UserGestureIndicator.h"
-#include "WindowFeatures.h"
-#include <wtf/CurrentTime.h>
-#include <wtf/ListHashSet.h>
-#include <wtf/RefCounted.h>
-#include <wtf/StdLibExtras.h>
-#include <wtf/UnusedParam.h>
-#include <wtf/text/StringConcatenate.h>
 
 #if ENABLE(DATABASE)
 #include "InspectorDatabaseAgent.h"
@@ -121,25 +81,23 @@ using namespace std;
 namespace WebCore {
 
 namespace InspectorAgentState {
-static const char searchingForNode[] = "searchingForNode";
 static const char timelineProfilerEnabled[] = "timelineProfilerEnabled";
-static const char userInitiatedProfiling[] = "userInitiatedProfiling";
 static const char debuggerEnabled[] = "debuggerEnabled";
-static const char profilerEnabled[] = "profilerEnabled";
 }
 
 static const char scriptsPanelName[] = "scripts";
 static const char consolePanelName[] = "console";
 static const char profilesPanelName[] = "profiles";
 
-InspectorAgent::InspectorAgent(Page* page, InspectorClient* client)
+InspectorAgent::InspectorAgent(Page* page, InspectorClient* client, InjectedScriptManager* injectedScriptManager)
     : m_inspectedPage(page)
     , m_client(client)
     , m_frontend(0)
     , m_instrumentingAgents(new InstrumentingAgents())
-    , m_injectedScriptHost(InjectedScriptHost::create(this))
+    , m_injectedScriptManager(injectedScriptManager)
     , m_state(new InspectorState(client))
-    , m_domAgent(InspectorDOMAgent::create(m_instrumentingAgents.get(), m_state.get(), m_injectedScriptHost.get()))
+    , m_pageAgent(InspectorPageAgent::create(m_instrumentingAgents.get(), page, injectedScriptManager))
+    , m_domAgent(InspectorDOMAgent::create(m_instrumentingAgents.get(), page, m_client, m_state.get(), injectedScriptManager))
     , m_cssAgent(new InspectorCSSAgent(m_instrumentingAgents.get(), m_domAgent.get()))
 #if ENABLE(DATABASE)
     , m_databaseAgent(InspectorDatabaseAgent::create(m_instrumentingAgents.get()))
@@ -152,25 +110,40 @@ InspectorAgent::InspectorAgent(Page* page, InspectorClient* client)
     , m_applicationCacheAgent(new InspectorApplicationCacheAgent(m_instrumentingAgents.get(), page))
 #endif
     , m_resourceAgent(InspectorResourceAgent::create(m_instrumentingAgents.get(), page, m_state.get()))
-    , m_consoleAgent(new InspectorConsoleAgent(m_instrumentingAgents.get(), this, m_state.get(), m_injectedScriptHost.get(), m_domAgent.get()))
+    , m_consoleAgent(new InspectorConsoleAgent(m_instrumentingAgents.get(), this, m_state.get(), injectedScriptManager, m_domAgent.get()))
 #if ENABLE(JAVASCRIPT_DEBUGGER)
-    , m_debuggerAgent(InspectorDebuggerAgent::create(m_instrumentingAgents.get(), m_state.get(), page, m_injectedScriptHost.get()))
+    , m_debuggerAgent(PageDebuggerAgent::create(m_instrumentingAgents.get(), m_state.get(), page, injectedScriptManager))
     , m_browserDebuggerAgent(InspectorBrowserDebuggerAgent::create(m_instrumentingAgents.get(), m_state.get(), m_domAgent.get(), m_debuggerAgent.get(), this))
-    , m_profilerAgent(InspectorProfilerAgent::create(m_instrumentingAgents.get(), m_consoleAgent.get(), page))
+    , m_profilerAgent(InspectorProfilerAgent::create(m_instrumentingAgents.get(), m_consoleAgent.get(), page, m_state.get()))
 #endif
     , m_canIssueEvaluateForTestInFrontend(false)
 {
     ASSERT_ARG(page, page);
     ASSERT_ARG(client, client);
     InspectorInstrumentation::bindInspectorAgent(m_inspectedPage, this);
+    m_instrumentingAgents->setInspectorAgent(this);
+
+    m_injectedScriptManager->injectedScriptHost()->init(this
+        , m_consoleAgent.get()
+#if ENABLE(DATABASE)
+        , m_databaseAgent.get()
+#endif
+#if ENABLE(DOM_STORAGE)
+        , m_domStorageAgent.get()
+#endif
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+        , m_debuggerAgent.get()
+#endif
+    );
 }
 
 InspectorAgent::~InspectorAgent()
 {
+    m_instrumentingAgents->setInspectorAgent(0);
+
     // These should have been cleared in inspectedPageDestroyed().
     ASSERT(!m_client);
     ASSERT(!m_inspectedPage);
-    ASSERT(!m_highlightedNode);
 }
 
 void InspectorAgent::inspectedPageDestroyed()
@@ -180,9 +153,6 @@ void InspectorAgent::inspectedPageDestroyed()
         disconnectFrontend();
     }
 
-    ErrorString error;
-    hideHighlight(&error);
-
 #if ENABLE(JAVASCRIPT_DEBUGGER)
     m_browserDebuggerAgent.clear();
     m_debuggerAgent.clear();
@@ -193,172 +163,36 @@ void InspectorAgent::inspectedPageDestroyed()
     m_inspectedPage = 0;
 
     releaseFrontendLifetimeAgents();
-    m_injectedScriptHost->disconnectController();
+    m_injectedScriptManager->disconnect();
 
     m_client->inspectorDestroyed();
     m_client = 0;
 }
 
-bool InspectorAgent::searchingForNodeInPage() const
-{
-    return m_state->getBoolean(InspectorAgentState::searchingForNode);
-}
-
 void InspectorAgent::restoreInspectorStateFromCookie(const String& inspectorStateCookie)
 {
     m_state->loadFromCookie(inspectorStateCookie);
 
     m_frontend->inspector()->frontendReused();
-    m_frontend->inspector()->inspectedURLChanged(inspectedURL().string());
-    pushDataCollectedOffline();
+    m_pageAgent->restore();
 
+    m_domAgent->restore();
     m_resourceAgent->restore();
     m_timelineAgent->restore();
 
 #if ENABLE(JAVASCRIPT_DEBUGGER)
     m_debuggerAgent->restore();
-    restoreProfiler(ProfilerRestoreResetAgent);
-    if (m_state->getBoolean(InspectorAgentState::userInitiatedProfiling))
-        startUserInitiatedProfiling();
+    m_profilerAgent->restore();
 #endif
 }
 
-void InspectorAgent::inspect(Node* node)
-{
-    if (node->nodeType() != Node::ELEMENT_NODE && node->nodeType() != Node::DOCUMENT_NODE)
-        node = node->parentNode();
-    m_nodeToFocus = node;
-
-    if (!m_frontend)
-        return;
-
-    focusNode();
-}
-
-void InspectorAgent::focusNode()
-{
-    if (!enabled())
-        return;
-
-    ASSERT(m_frontend);
-    ASSERT(m_nodeToFocus);
-
-    RefPtr<Node> node = m_nodeToFocus.get();
-    m_nodeToFocus = 0;
-
-    Document* document = node->ownerDocument();
-    if (!document)
-        return;
-    Frame* frame = document->frame();
-    if (!frame)
-        return;
-
-    InjectedScript injectedScript = m_injectedScriptHost->injectedScriptFor(mainWorldScriptState(frame));
-    if (injectedScript.hasNoValue())
-        return;
-
-    injectedScript.inspectNode(node.get());
-}
-
-void InspectorAgent::highlight(ErrorString*, Node* node)
-{
-    if (!enabled())
-        return;
-    ASSERT_ARG(node, node);
-    m_highlightedNode = node;
-    m_client->highlight(node);
-}
-
-void InspectorAgent::highlightDOMNode(ErrorString* error, long nodeId)
-{
-    Node* node = 0;
-    if (m_domAgent && (node = m_domAgent->nodeForId(nodeId)))
-        highlight(error, node);
-}
-
-void InspectorAgent::highlightFrame(ErrorString* error, unsigned long frameId)
-{
-    Frame* mainFrame = m_inspectedPage->mainFrame();
-    for (Frame* frame = mainFrame; frame; frame = frame->tree()->traverseNext(mainFrame)) {
-        if (reinterpret_cast<uintptr_t>(frame) == frameId && frame->ownerElement()) {
-            highlight(error, frame->ownerElement());
-            return;
-        }
-    }
-}
-
-void InspectorAgent::hideHighlight(ErrorString*)
-{
-    if (!enabled())
-        return;
-    m_highlightedNode = 0;
-    m_client->hideHighlight();
-}
-
-void InspectorAgent::mouseDidMoveOverElement(const HitTestResult& result, unsigned)
-{
-    if (!enabled() || !searchingForNodeInPage())
-        return;
-
-    Node* node = result.innerNode();
-    while (node && node->nodeType() == Node::TEXT_NODE)
-        node = node->parentNode();
-    if (node) {
-        ErrorString error;
-        highlight(&error, node);
-    }
-}
-
-bool InspectorAgent::handleMousePress()
-{
-    if (!enabled() || !searchingForNodeInPage())
-        return false;
-
-    if (m_highlightedNode) {
-        RefPtr<Node> node = m_highlightedNode;
-        setSearchingForNode(false);
-        inspect(node.get());
-    }
-    return true;
-}
-
 void InspectorAgent::didClearWindowObjectInWorld(Frame* frame, DOMWrapperWorld* world)
 {
     if (world != mainThreadNormalWorld())
         return;
 
-    if (enabled()) {
-        if (m_frontend && frame == m_inspectedPage->mainFrame())
-            m_injectedScriptHost->discardInjectedScripts();
-
-        if (m_scriptsToEvaluateOnLoad.size()) {
-            ScriptState* scriptState = mainWorldScriptState(frame);
-            for (Vector<String>::iterator it = m_scriptsToEvaluateOnLoad.begin();
-                  it != m_scriptsToEvaluateOnLoad.end(); ++it) {
-                m_injectedScriptHost->injectScript(*it, scriptState);
-            }
-        }
-    }
-
     if (!m_inspectorExtensionAPI.isEmpty())
-        m_injectedScriptHost->injectScript(m_inspectorExtensionAPI, mainWorldScriptState(frame));
-}
-
-void InspectorAgent::setSearchingForNode(bool enabled)
-{
-    if (searchingForNodeInPage() == enabled)
-        return;
-    m_state->setBoolean(InspectorAgentState::searchingForNode, enabled);
-    if (!enabled) {
-        ErrorString error;
-        hideHighlight(&error);
-    }
-}
-
-void InspectorAgent::setSearchingForNode(ErrorString*, bool enabled, bool* newState)
-{
-    *newState = enabled;
-    setSearchingForNode(enabled);
+        m_injectedScriptManager->injectScript(m_inspectorExtensionAPI, mainWorldScriptState(frame));
 }
 
 void InspectorAgent::setFrontend(InspectorFrontend* inspectorFrontend)
@@ -372,13 +206,14 @@ void InspectorAgent::setFrontend(InspectorFrontend* inspectorFrontend)
 #if ENABLE(OFFLINE_WEB_APPLICATIONS)
     m_applicationCacheAgent->setFrontend(m_frontend);
 #endif
+    m_pageAgent->setFrontend(m_frontend);
     m_domAgent->setFrontend(m_frontend);
     m_consoleAgent->setFrontend(m_frontend);
     m_timelineAgent->setFrontend(m_frontend);
     m_resourceAgent->setFrontend(m_frontend);
 #if ENABLE(JAVASCRIPT_DEBUGGER)
     m_debuggerAgent->setFrontend(m_frontend);
-    m_browserDebuggerAgent->setFrontend(m_frontend);
+    m_profilerAgent->setFrontend(m_frontend);
 #endif
 #if ENABLE(DATABASE)
     m_databaseAgent->setFrontend(m_frontend);
@@ -386,8 +221,20 @@ void InspectorAgent::setFrontend(InspectorFrontend* inspectorFrontend)
 #if ENABLE(DOM_STORAGE)
     m_domStorageAgent->setFrontend(m_frontend);
 #endif
-    // Initialize Web Inspector title.
-    m_frontend->inspector()->inspectedURLChanged(inspectedURL().string());
+
+    if (!m_showPanelAfterVisible.isEmpty()) {
+        m_frontend->inspector()->showPanel(m_showPanelAfterVisible);
+        m_showPanelAfterVisible = String();
+    }
+#if ENABLE(JAVASCRIPT_DEBUGGER) && ENABLE(WORKERS)
+    WorkersMap::iterator workersEnd = m_workers.end();
+    for (WorkersMap::iterator it = m_workers.begin(); it != workersEnd; ++it) {
+        InspectorWorkerResource* worker = it->second.get();
+        m_frontend->inspector()->didCreateWorker(worker->id(), worker->url(), worker->isSharedWorker());
+    }
+#endif
+    // Dispatch pending frontend commands
+    issueEvaluateForTestCommands();
 }
 
 void InspectorAgent::disconnectFrontend()
@@ -404,19 +251,12 @@ void InspectorAgent::disconnectFrontend()
 
     m_frontend = 0;
 
-    ErrorString error;
 #if ENABLE(JAVASCRIPT_DEBUGGER)
     m_debuggerAgent->clearFrontend();
     m_browserDebuggerAgent->clearFrontend();
-#endif
-    setSearchingForNode(false);
-
-    hideHighlight(&error);
-
-#if ENABLE(JAVASCRIPT_DEBUGGER)
     m_profilerAgent->clearFrontend();
-    m_profilerAgent->stopUserInitiatedProfiling(true);
 #endif
+
 #if ENABLE(OFFLINE_WEB_APPLICATIONS)
     m_applicationCacheAgent->clearFrontend();
 #endif
@@ -431,14 +271,14 @@ void InspectorAgent::disconnectFrontend()
 #if ENABLE(DOM_STORAGE)
     m_domStorageAgent->clearFrontend();
 #endif
+    m_pageAgent->clearFrontend();
 
     releaseFrontendLifetimeAgents();
-    m_userAgentOverride = "";
 }
 
 void InspectorAgent::createFrontendLifetimeAgents()
 {
-    m_runtimeAgent = InspectorRuntimeAgent::create(m_injectedScriptHost.get());
+    m_runtimeAgent = InspectorRuntimeAgent::create(m_injectedScriptManager, m_inspectedPage);
 }
 
 void InspectorAgent::releaseFrontendLifetimeAgents()
@@ -446,103 +286,20 @@ void InspectorAgent::releaseFrontendLifetimeAgents()
     m_runtimeAgent.clear();
 }
 
-void InspectorAgent::populateScriptObjects(ErrorString*)
-{
-    ASSERT(m_frontend);
-    if (!m_frontend)
-        return;
-
-#if ENABLE(JAVASCRIPT_DEBUGGER)
-    if (m_profilerAgent->enabled())
-        m_frontend->profiler()->profilerWasEnabled();
-#endif
-
-    pushDataCollectedOffline();
-
-    if (m_nodeToFocus)
-        focusNode();
-
-    if (!m_showPanelAfterVisible.isEmpty()) {
-        m_frontend->inspector()->showPanel(m_showPanelAfterVisible);
-        m_showPanelAfterVisible = "";
-    }
-
-#if ENABLE(JAVASCRIPT_DEBUGGER)
-    m_debuggerAgent->enableDebuggerAfterShown();
-#endif
-    restoreProfiler(ProfilerRestoreNoAction);
-
-    // Dispatch pending frontend commands
-    issueEvaluateForTestCommands();
-}
-
-void InspectorAgent::pushDataCollectedOffline()
-{
-    m_domAgent->setDocument(m_inspectedPage->mainFrame()->document());
-
-#if ENABLE(JAVASCRIPT_DEBUGGER) && ENABLE(WORKERS)
-    WorkersMap::iterator workersEnd = m_workers.end();
-    for (WorkersMap::iterator it = m_workers.begin(); it != workersEnd; ++it) {
-        InspectorWorkerResource* worker = it->second.get();
-        m_frontend->debugger()->didCreateWorker(worker->id(), worker->url(), worker->isSharedWorker());
-    }
-#endif
-}
-
-void InspectorAgent::restoreProfiler(ProfilerRestoreAction action)
-{
-    ASSERT(m_frontend);
-#if ENABLE(JAVASCRIPT_DEBUGGER)
-    m_profilerAgent->setFrontend(m_frontend);
-    if (m_state->getBoolean(InspectorAgentState::profilerEnabled)) {
-        ErrorString error;
-        enableProfiler(&error);
-    }
-    if (action == ProfilerRestoreResetAgent)
-        m_profilerAgent->resetFrontendProfiles();
-#endif
-}
-
-void InspectorAgent::didCommitLoad(DocumentLoader* loader)
+void InspectorAgent::didCommitLoad()
 {
-    if (m_frontend) {
-        m_frontend->inspector()->inspectedURLChanged(loader->url().string());
+    if (m_frontend)
         m_frontend->inspector()->reset();
-    }
-    m_injectedScriptHost->discardInjectedScripts();
+
+    m_injectedScriptManager->discardInjectedScripts();
 #if ENABLE(WORKERS)
     m_workers.clear();
 #endif
 }
 
-void InspectorAgent::domContentLoadedEventFired(DocumentLoader* loader, const KURL& url)
+void InspectorAgent::domContentLoadedEventFired()
 {
-    if (!enabled() || !isMainResourceLoader(loader, url))
-        return;
-
-    if (InspectorDOMAgent* domAgent = m_instrumentingAgents->inspectorDOMAgent())
-        domAgent->mainFrameDOMContentLoaded();
-    if (InspectorTimelineAgent* timelineAgent = m_instrumentingAgents->inspectorTimelineAgent())
-        timelineAgent->didMarkDOMContentEvent();
-    if (m_frontend)
-        m_frontend->inspector()->domContentEventFired(currentTime());
-}
-
-void InspectorAgent::loadEventFired(DocumentLoader* loader, const KURL& url)
-{
-    if (!enabled())
-        return;
-
-    if (InspectorDOMAgent* domAgent = m_instrumentingAgents->inspectorDOMAgent())
-        domAgent->loadEventFired(loader->frame()->document());
-
-    if (!isMainResourceLoader(loader, url))
-        return;
-
-    if (InspectorTimelineAgent* timelineAgent = m_instrumentingAgents->inspectorTimelineAgent())
-        timelineAgent->didMarkLoadEvent();
-    if (m_frontend)
-        m_frontend->inspector()->loadEventFired(currentTime());
+    m_injectedScriptManager->injectedScriptHost()->clearInspectedNodes();
 }
 
 bool InspectorAgent::isMainResourceLoader(DocumentLoader* loader, const KURL& requestUrl)
@@ -550,17 +307,6 @@ bool InspectorAgent::isMainResourceLoader(DocumentLoader* loader, const KURL& re
     return loader->frame() == m_inspectedPage->mainFrame() && requestUrl == loader->requestURL();
 }
 
-void InspectorAgent::setUserAgentOverride(ErrorString*, const String& userAgent)
-{
-    m_userAgentOverride = userAgent;
-}
-
-void InspectorAgent::applyUserAgentOverride(String* userAgent) const
-{
-    if (!m_userAgentOverride.isEmpty())
-        *userAgent = m_userAgentOverride;
-}
-
 #if ENABLE(WORKERS)
 class PostWorkerNotificationToFrontendTask : public ScriptExecutionContext::Task {
 public:
@@ -596,10 +342,10 @@ void InspectorAgent::postWorkerNotificationToFrontend(const InspectorWorkerResou
 #if ENABLE(JAVASCRIPT_DEBUGGER)
     switch (action) {
     case InspectorAgent::WorkerCreated:
-        m_frontend->debugger()->didCreateWorker(worker.id(), worker.url(), worker.isSharedWorker());
+        m_frontend->inspector()->didCreateWorker(worker.id(), worker.url(), worker.isSharedWorker());
         break;
     case InspectorAgent::WorkerDestroyed:
-        m_frontend->debugger()->didDestroyWorker(worker.id());
+        m_frontend->inspector()->didDestroyWorker(worker.id());
         break;
     }
 #endif
@@ -630,136 +376,11 @@ void InspectorAgent::didDestroyWorker(intptr_t id)
 }
 #endif // ENABLE(WORKERS)
 
-void InspectorAgent::getCookies(ErrorString*, RefPtr<InspectorArray>* cookies, WTF::String* cookiesString)
-{
-    // If we can get raw cookies.
-    ListHashSet<Cookie> rawCookiesList;
-
-    // If we can't get raw cookies - fall back to String representation
-    String stringCookiesList;
-
-    // Return value to getRawCookies should be the same for every call because
-    // the return value is platform/network backend specific, and the call will
-    // always return the same true/false value.
-    bool rawCookiesImplemented = false;
-
-    for (Frame* frame = m_inspectedPage->mainFrame(); frame; frame = frame->tree()->traverseNext(m_inspectedPage->mainFrame())) {
-        Document* document = frame->document();
-        const CachedResourceLoader::DocumentResourceMap& allResources = document->cachedResourceLoader()->allCachedResources();
-        CachedResourceLoader::DocumentResourceMap::const_iterator end = allResources.end();
-        for (CachedResourceLoader::DocumentResourceMap::const_iterator it = allResources.begin(); it != end; ++it) {
-            Vector<Cookie> docCookiesList;
-            rawCookiesImplemented = getRawCookies(document, KURL(ParsedURLString, it->second->url()), docCookiesList);
-
-            if (!rawCookiesImplemented) {
-                // FIXME: We need duplication checking for the String representation of cookies.
-                ExceptionCode ec = 0;
-                stringCookiesList += document->cookie(ec);
-                // Exceptions are thrown by cookie() in sandboxed frames. That won't happen here
-                // because "document" is the document of the main frame of the page.
-                ASSERT(!ec);
-            } else {
-                int cookiesSize = docCookiesList.size();
-                for (int i = 0; i < cookiesSize; i++) {
-                    if (!rawCookiesList.contains(docCookiesList[i]))
-                        rawCookiesList.add(docCookiesList[i]);
-                }
-            }
-        }
-    }
-
-    if (rawCookiesImplemented)
-        *cookies = buildArrayForCookies(rawCookiesList);
-    else
-        *cookiesString = stringCookiesList;
-}
-
-PassRefPtr<InspectorArray> InspectorAgent::buildArrayForCookies(ListHashSet<Cookie>& cookiesList)
-{
-    RefPtr<InspectorArray> cookies = InspectorArray::create();
-
-    ListHashSet<Cookie>::iterator end = cookiesList.end();
-    ListHashSet<Cookie>::iterator it = cookiesList.begin();
-    for (int i = 0; it != end; ++it, i++)
-        cookies->pushObject(buildObjectForCookie(*it));
-
-    return cookies;
-}
-
-PassRefPtr<InspectorObject> InspectorAgent::buildObjectForCookie(const Cookie& cookie)
-{
-    RefPtr<InspectorObject> value = InspectorObject::create();
-    value->setString("name", cookie.name);
-    value->setString("value", cookie.value);
-    value->setString("domain", cookie.domain);
-    value->setString("path", cookie.path);
-    value->setNumber("expires", cookie.expires);
-    value->setNumber("size", (cookie.name.length() + cookie.value.length()));
-    value->setBoolean("httpOnly", cookie.httpOnly);
-    value->setBoolean("secure", cookie.secure);
-    value->setBoolean("session", cookie.session);
-    return value;
-}
-
-void InspectorAgent::deleteCookie(ErrorString*, const String& cookieName, const String& domain)
-{
-    for (Frame* frame = m_inspectedPage->mainFrame(); frame; frame = frame->tree()->traverseNext(m_inspectedPage->mainFrame())) {
-        Document* document = frame->document();
-        if (document->url().host() != domain)
-            continue;
-        const CachedResourceLoader::DocumentResourceMap& allResources = document->cachedResourceLoader()->allCachedResources();
-        CachedResourceLoader::DocumentResourceMap::const_iterator end = allResources.end();
-        for (CachedResourceLoader::DocumentResourceMap::const_iterator it = allResources.begin(); it != end; ++it)
-            WebCore::deleteCookie(document, KURL(ParsedURLString, it->second->url()), cookieName);
-    }
-}
-
 #if ENABLE(JAVASCRIPT_DEBUGGER)
-bool InspectorAgent::isRecordingUserInitiatedProfile() const
-{
-    return m_profilerAgent->isRecordingUserInitiatedProfile();
-}
-
-void InspectorAgent::startUserInitiatedProfiling()
+void InspectorAgent::showProfilesPanel()
 {
-    if (!enabled())
-        return;
-    m_profilerAgent->startUserInitiatedProfiling();
-    m_state->setBoolean(InspectorAgentState::userInitiatedProfiling, true);
-}
-
-void InspectorAgent::stopUserInitiatedProfiling()
-{
-    m_profilerAgent->stopUserInitiatedProfiling();
-    m_state->setBoolean(InspectorAgentState::userInitiatedProfiling, false);
     showPanel(profilesPanelName);
 }
-
-bool InspectorAgent::profilerEnabled() const
-{
-    return enabled() && m_profilerAgent->enabled();
-}
-
-void InspectorAgent::enableProfiler(ErrorString*)
-{
-    if (profilerEnabled())
-        return;
-    m_state->setBoolean(InspectorAgentState::profilerEnabled, true);
-    m_profilerAgent->enable(false);
-}
-
-void InspectorAgent::disableProfiler(ErrorString*)
-{
-    m_state->setBoolean(InspectorAgentState::profilerEnabled, false);
-    m_profilerAgent->disable();
-}
-#endif
-
-#if ENABLE(JAVASCRIPT_DEBUGGER)
-void InspectorAgent::showScriptsPanel()
-{
-    showPanel(scriptsPanelName);
-}
 #endif
 
 void InspectorAgent::evaluateForTestInFrontend(long callId, const String& script)
@@ -780,277 +401,6 @@ void InspectorAgent::didEvaluateForTestInFrontend(ErrorString*, long callId, con
     function.call();
 }
 
-static Path quadToPath(const FloatQuad& quad)
-{
-    Path quadPath;
-    quadPath.moveTo(quad.p1());
-    quadPath.addLineTo(quad.p2());
-    quadPath.addLineTo(quad.p3());
-    quadPath.addLineTo(quad.p4());
-    quadPath.closeSubpath();
-    return quadPath;
-}
-
-static void drawOutlinedQuad(GraphicsContext& context, const FloatQuad& quad, const Color& fillColor)
-{
-    static const int outlineThickness = 2;
-    static const Color outlineColor(62, 86, 180, 228);
-
-    Path quadPath = quadToPath(quad);
-
-    // Clip out the quad, then draw with a 2px stroke to get a pixel
-    // of outline (because inflating a quad is hard)
-    {
-        context.save();
-        context.clipOut(quadPath);
-
-        context.setStrokeThickness(outlineThickness);
-        context.setStrokeColor(outlineColor, ColorSpaceDeviceRGB);
-        context.strokePath(quadPath);
-
-        context.restore();
-    }
-
-    // Now do the fill
-    context.setFillColor(fillColor, ColorSpaceDeviceRGB);
-    context.fillPath(quadPath);
-}
-
-static void drawOutlinedQuadWithClip(GraphicsContext& context, const FloatQuad& quad, const FloatQuad& clipQuad, const Color& fillColor)
-{
-    context.save();
-    Path clipQuadPath = quadToPath(clipQuad);
-    context.clipOut(clipQuadPath);
-    drawOutlinedQuad(context, quad, fillColor);
-    context.restore();
-}
-
-static void drawHighlightForBox(GraphicsContext& context, const FloatQuad& contentQuad, const FloatQuad& paddingQuad, const FloatQuad& borderQuad, const FloatQuad& marginQuad)
-{
-    static const Color contentBoxColor(125, 173, 217, 128);
-    static const Color paddingBoxColor(125, 173, 217, 160);
-    static const Color borderBoxColor(125, 173, 217, 192);
-    static const Color marginBoxColor(125, 173, 217, 228);
-
-    if (marginQuad != borderQuad)
-        drawOutlinedQuadWithClip(context, marginQuad, borderQuad, marginBoxColor);
-    if (borderQuad != paddingQuad)
-        drawOutlinedQuadWithClip(context, borderQuad, paddingQuad, borderBoxColor);
-    if (paddingQuad != contentQuad)
-        drawOutlinedQuadWithClip(context, paddingQuad, contentQuad, paddingBoxColor);
-
-    drawOutlinedQuad(context, contentQuad, contentBoxColor);
-}
-
-static void drawHighlightForLineBoxesOrSVGRenderer(GraphicsContext& context, const Vector<FloatQuad>& lineBoxQuads)
-{
-    static const Color lineBoxColor(125, 173, 217, 128);
-
-    for (size_t i = 0; i < lineBoxQuads.size(); ++i)
-        drawOutlinedQuad(context, lineBoxQuads[i], lineBoxColor);
-}
-
-static inline void convertFromFrameToMainFrame(Frame* frame, IntRect& rect)
-{
-    rect = frame->page()->mainFrame()->view()->windowToContents(frame->view()->contentsToWindow(rect));
-}
-
-static inline IntSize frameToMainFrameOffset(Frame* frame)
-{
-    IntPoint mainFramePoint = frame->page()->mainFrame()->view()->windowToContents(frame->view()->contentsToWindow(IntPoint()));
-    return mainFramePoint - IntPoint();
-}
-
-void InspectorAgent::drawNodeHighlight(GraphicsContext& context) const
-{
-    if (!m_highlightedNode)
-        return;
-
-    RenderObject* renderer = m_highlightedNode->renderer();
-    Frame* containingFrame = m_highlightedNode->document()->frame();
-    if (!renderer || !containingFrame)
-        return;
-
-    IntSize mainFrameOffset = frameToMainFrameOffset(containingFrame);
-    IntRect boundingBox = renderer->absoluteBoundingBoxRect(true);
-    boundingBox.move(mainFrameOffset);
-
-    IntRect titleAnchorBox = boundingBox;
-
-    ASSERT(m_inspectedPage);
-
-    FrameView* view = m_inspectedPage->mainFrame()->view();
-    FloatRect overlayRect = view->visibleContentRect();
-    if (!overlayRect.contains(boundingBox) && !boundingBox.contains(enclosingIntRect(overlayRect)))
-        overlayRect = view->visibleContentRect();
-    context.translate(-overlayRect.x(), -overlayRect.y());
-
-    // RenderSVGRoot should be highlighted through the isBox() code path, all other SVG elements should just dump their absoluteQuads().
-#if ENABLE(SVG)
-    bool isSVGRenderer = renderer->node() && renderer->node()->isSVGElement() && !renderer->isSVGRoot();
-#else
-    bool isSVGRenderer = false;
-#endif
-
-    if (renderer->isBox() && !isSVGRenderer) {
-        RenderBox* renderBox = toRenderBox(renderer);
-
-        IntRect contentBox = renderBox->contentBoxRect();
-
-        IntRect paddingBox(contentBox.x() - renderBox->paddingLeft(), contentBox.y() - renderBox->paddingTop(),
-                           contentBox.width() + renderBox->paddingLeft() + renderBox->paddingRight(), contentBox.height() + renderBox->paddingTop() + renderBox->paddingBottom());
-        IntRect borderBox(paddingBox.x() - renderBox->borderLeft(), paddingBox.y() - renderBox->borderTop(),
-                          paddingBox.width() + renderBox->borderLeft() + renderBox->borderRight(), paddingBox.height() + renderBox->borderTop() + renderBox->borderBottom());
-        IntRect marginBox(borderBox.x() - renderBox->marginLeft(), borderBox.y() - renderBox->marginTop(),
-                          borderBox.width() + renderBox->marginLeft() + renderBox->marginRight(), borderBox.height() + renderBox->marginTop() + renderBox->marginBottom());
-
-
-        FloatQuad absContentQuad = renderBox->localToAbsoluteQuad(FloatRect(contentBox));
-        FloatQuad absPaddingQuad = renderBox->localToAbsoluteQuad(FloatRect(paddingBox));
-        FloatQuad absBorderQuad = renderBox->localToAbsoluteQuad(FloatRect(borderBox));
-        FloatQuad absMarginQuad = renderBox->localToAbsoluteQuad(FloatRect(marginBox));
-
-        absContentQuad.move(mainFrameOffset);
-        absPaddingQuad.move(mainFrameOffset);
-        absBorderQuad.move(mainFrameOffset);
-        absMarginQuad.move(mainFrameOffset);
-
-        titleAnchorBox = absMarginQuad.enclosingBoundingBox();
-
-        drawHighlightForBox(context, absContentQuad, absPaddingQuad, absBorderQuad, absMarginQuad);
-    } else if (renderer->isRenderInline() || isSVGRenderer) {
-        // FIXME: We should show margins/padding/border for inlines.
-        Vector<FloatQuad> lineBoxQuads;
-        renderer->absoluteQuads(lineBoxQuads);
-        for (unsigned i = 0; i < lineBoxQuads.size(); ++i)
-            lineBoxQuads[i] += mainFrameOffset;
-
-        drawHighlightForLineBoxesOrSVGRenderer(context, lineBoxQuads);
-    }
-
-    // Draw node title if necessary.
-
-    if (!m_highlightedNode->isElementNode())
-        return;
-
-    WebCore::Settings* settings = containingFrame->settings();
-    drawElementTitle(context, boundingBox, titleAnchorBox, overlayRect, settings);
-}
-
-void InspectorAgent::drawElementTitle(GraphicsContext& context, const IntRect& boundingBox, const IntRect& anchorBox, const FloatRect& overlayRect, WebCore::Settings* settings) const
-{
-    static const int rectInflatePx = 4;
-    static const int fontHeightPx = 12;
-    static const int borderWidthPx = 1;
-    static const Color tooltipBackgroundColor(255, 255, 194, 255);
-    static const Color tooltipBorderColor(Color::black);
-    static const Color tooltipFontColor(Color::black);
-
-    Element* element = static_cast<Element*>(m_highlightedNode.get());
-    bool isXHTML = element->document()->isXHTMLDocument();
-    String nodeTitle = isXHTML ? element->nodeName() : element->nodeName().lower();
-    const AtomicString& idValue = element->getIdAttribute();
-    if (!idValue.isNull() && !idValue.isEmpty()) {
-        nodeTitle += "#";
-        nodeTitle += idValue;
-    }
-    if (element->hasClass() && element->isStyledElement()) {
-        const SpaceSplitString& classNamesString = static_cast<StyledElement*>(element)->classNames();
-        size_t classNameCount = classNamesString.size();
-        if (classNameCount) {
-            HashSet<AtomicString> usedClassNames;
-            for (size_t i = 0; i < classNameCount; ++i) {
-                const AtomicString& className = classNamesString[i];
-                if (usedClassNames.contains(className))
-                    continue;
-                usedClassNames.add(className);
-                nodeTitle += ".";
-                nodeTitle += className;
-            }
-        }
-    }
-
-    nodeTitle += " [";
-    nodeTitle += String::number(boundingBox.width());
-    nodeTitle.append(static_cast<UChar>(0x00D7)); // &times;
-    nodeTitle += String::number(boundingBox.height());
-    nodeTitle += "]";
-
-    FontDescription desc;
-    FontFamily family;
-    family.setFamily(settings->fixedFontFamily());
-    desc.setFamily(family);
-    desc.setComputedSize(fontHeightPx);
-    Font font = Font(desc, 0, 0);
-    font.update(0);
-
-    TextRun nodeTitleRun(nodeTitle);
-    IntPoint titleBasePoint = IntPoint(anchorBox.x(), anchorBox.maxY() - 1);
-    titleBasePoint.move(rectInflatePx, rectInflatePx);
-    IntRect titleRect = enclosingIntRect(font.selectionRectForText(nodeTitleRun, titleBasePoint, fontHeightPx));
-    titleRect.inflate(rectInflatePx);
-
-    // The initial offsets needed to compensate for a 1px-thick border stroke (which is not a part of the rectangle).
-    int dx = -borderWidthPx;
-    int dy = borderWidthPx;
-
-    // If the tip sticks beyond the right of overlayRect, right-align the tip with the said boundary.
-    if (titleRect.maxX() > overlayRect.maxX())
-        dx = overlayRect.maxX() - titleRect.maxX();
-
-    // If the tip sticks beyond the left of overlayRect, left-align the tip with the said boundary.
-    if (titleRect.x() + dx < overlayRect.x())
-        dx = overlayRect.x() - titleRect.x() - borderWidthPx;
-
-    // If the tip sticks beyond the bottom of overlayRect, show the tip at top of bounding box.
-    if (titleRect.maxY() > overlayRect.maxY()) {
-        dy = anchorBox.y() - titleRect.maxY() - borderWidthPx;
-        // If the tip still sticks beyond the bottom of overlayRect, bottom-align the tip with the said boundary.
-        if (titleRect.maxY() + dy > overlayRect.maxY())
-            dy = overlayRect.maxY() - titleRect.maxY();
-    }
-
-    // If the tip sticks beyond the top of overlayRect, show the tip at top of overlayRect.
-    if (titleRect.y() + dy < overlayRect.y())
-        dy = overlayRect.y() - titleRect.y() + borderWidthPx;
-
-    titleRect.move(dx, dy);
-    context.setStrokeColor(tooltipBorderColor, ColorSpaceDeviceRGB);
-    context.setStrokeThickness(borderWidthPx);
-    context.setFillColor(tooltipBackgroundColor, ColorSpaceDeviceRGB);
-    context.drawRect(titleRect);
-    context.setFillColor(tooltipFontColor, ColorSpaceDeviceRGB);
-    context.drawText(font, nodeTitleRun, IntPoint(titleRect.x() + rectInflatePx, titleRect.y() + font.fontMetrics().height()));
-}
-
-void InspectorAgent::openInInspectedWindow(ErrorString*, const String& url)
-{
-    Frame* mainFrame = m_inspectedPage->mainFrame();
-
-    FrameLoadRequest request(mainFrame->document()->securityOrigin(), ResourceRequest(), "_blank");
-
-    bool created;
-    WindowFeatures windowFeatures;
-    Frame* newFrame = WebCore::createWindow(mainFrame, mainFrame, request, windowFeatures, created);
-    if (!newFrame)
-        return;
-
-    UserGestureIndicator indicator(DefinitelyProcessingUserGesture);
-    newFrame->loader()->setOpener(mainFrame);
-    newFrame->page()->setOpenedByDOM();
-    newFrame->loader()->changeLocation(mainFrame->document()->securityOrigin(), newFrame->loader()->completeURL(url), "", false, false);
-}
-
-void InspectorAgent::addScriptToEvaluateOnLoad(ErrorString*, const String& source)
-{
-    m_scriptsToEvaluateOnLoad.append(source);
-}
-
-void InspectorAgent::removeAllScriptsToEvaluateOnLoad(ErrorString*)
-{
-    m_scriptsToEvaluateOnLoad.clear();
-}
-
 void InspectorAgent::setInspectorExtensionAPI(const String& source)
 {
     m_inspectorExtensionAPI = source;
@@ -1068,11 +418,6 @@ KURL InspectorAgent::inspectedURLWithoutFragment() const
     return url;
 }
 
-void InspectorAgent::reloadPage(ErrorString*, bool ignoreCache)
-{
-    m_inspectedPage->mainFrame()->loader()->reload(ignoreCache);
-}
-
 bool InspectorAgent::enabled() const
 {
     if (!m_inspectedPage)
diff --git a/Source/WebCore/inspector/InspectorAgent.h b/Source/WebCore/inspector/InspectorAgent.h
index 151dba5..cda9137 100644
--- a/Source/WebCore/inspector/InspectorAgent.h
+++ b/Source/WebCore/inspector/InspectorAgent.h
@@ -31,30 +31,24 @@
 
 #include "CharacterData.h"
 #include "Console.h"
-#include "Cookie.h"
 #include "Page.h"
 #include "PlatformString.h"
 #include <wtf/HashMap.h>
-#include <wtf/HashSet.h>
-#include <wtf/ListHashSet.h>
 #include <wtf/RefCounted.h>
 #include <wtf/Vector.h>
 #include <wtf/text/StringHash.h>
 
 namespace WebCore {
 
-class CachedResource;
 class CharacterData;
 class Database;
 class DOMWrapperWorld;
 class Document;
 class DocumentLoader;
 class FloatRect;
-class GraphicsContext;
 class HTTPHeaderMap;
-class HitTestResult;
 class InjectedScript;
-class InjectedScriptHost;
+class InjectedScriptManager;
 class InspectorArray;
 class InspectorBrowserDebuggerAgent;
 class InspectorClient;
@@ -68,6 +62,7 @@ class InspectorDebuggerAgent;
 class InspectorFrontend;
 class InspectorFrontendClient;
 class InspectorObject;
+class InspectorPageAgent;
 class InspectorProfilerAgent;
 class InspectorResourceAgent;
 class InspectorRuntimeAgent;
@@ -100,11 +95,10 @@ class InspectorAgent {
     WTF_MAKE_NONCOPYABLE(InspectorAgent);
     WTF_MAKE_FAST_ALLOCATED;
 public:
-    InspectorAgent(Page*, InspectorClient*);
+    InspectorAgent(Page*, InspectorClient*, InjectedScriptManager*);
     virtual ~InspectorAgent();
 
     InspectorClient* inspectorClient() { return m_client; }
-    InjectedScriptHost* injectedScriptHost() { return m_injectedScriptHost.get(); }
 
     void inspectedPageDestroyed();
 
@@ -113,27 +107,18 @@ public:
     Page* inspectedPage() const { return m_inspectedPage; }
     KURL inspectedURL() const;
     KURL inspectedURLWithoutFragment() const;
-    void reloadPage(ErrorString* error, bool ignoreCache);
+    void reloadPage(ErrorString*, bool ignoreCache);
     void showConsole();
 
     void restoreInspectorStateFromCookie(const String& inspectorCookie);
 
-    void highlight(ErrorString* error, Node*);
-    void hideHighlight(ErrorString* error);
-    void inspect(Node*);
-    void highlightDOMNode(ErrorString* error, long nodeId);
-    void hideDOMNodeHighlight(ErrorString* error) { hideHighlight(error); }
-
-    void highlightFrame(ErrorString* error, unsigned long frameId);
-    void hideFrameHighlight(ErrorString* error) { hideHighlight(error); }
-
     void setFrontend(InspectorFrontend*);
     InspectorFrontend* frontend() const { return m_frontend; }
     void disconnectFrontend();
 
     InstrumentingAgents* instrumentingAgents() const { return m_instrumentingAgents.get(); }
 
-    InspectorAgent* inspectorAgent() { return this; }
+    InspectorPageAgent* pageAgent() { return m_pageAgent.get(); }
     InspectorConsoleAgent* consoleAgent() { return m_consoleAgent.get(); }
     InspectorCSSAgent* cssAgent() { return m_cssAgent.get(); }
     InspectorDOMAgent* domAgent() { return m_domAgent.get(); }
@@ -155,19 +140,10 @@ public:
     InspectorApplicationCacheAgent* applicationCacheAgent() { return m_applicationCacheAgent.get(); }
 #endif
 
-    bool handleMousePress();
-    bool searchingForNodeInPage() const;
-    void mouseDidMoveOverElement(const HitTestResult&, unsigned modifierFlags);
-
     void didClearWindowObjectInWorld(Frame*, DOMWrapperWorld*);
 
-    void didCommitLoad(DocumentLoader*);
-
-    void getCookies(ErrorString* error, RefPtr<InspectorArray>* cookies, WTF::String* cookiesString);
-    void deleteCookie(ErrorString* error, const String& cookieName, const String& domain);
-
-    void domContentLoadedEventFired(DocumentLoader*, const KURL&);
-    void loadEventFired(DocumentLoader*, const KURL&);
+    void didCommitLoad();
+    void domContentLoadedEventFired();
 
 #if ENABLE(WORKERS)
     enum WorkerAction { WorkerCreated, WorkerDestroyed };
@@ -179,28 +155,14 @@ public:
 
     bool hasFrontend() const { return m_frontend; }
 
-    void drawNodeHighlight(GraphicsContext&) const;
-    void openInInspectedWindow(ErrorString* error, const String& url);
-    void drawElementTitle(GraphicsContext&, const IntRect& boundingBox, const IntRect& anchorBox, const FloatRect& overlayRect, WebCore::Settings*) const;
 
 #if ENABLE(JAVASCRIPT_DEBUGGER)
-    bool isRecordingUserInitiatedProfile() const;
-    void startProfiling(ErrorString*) { startUserInitiatedProfiling(); }
-    void startUserInitiatedProfiling();
-    void stopProfiling(ErrorString*) { stopUserInitiatedProfiling(); }
-    void stopUserInitiatedProfiling();
-    void enableProfiler(ErrorString* error);
-    void disableProfiler(ErrorString* error);
-    bool profilerEnabled() const;
-
-    void showScriptsPanel();
+    void showProfilesPanel();
 #endif
 
     // Generic code called from custom implementations.
     void evaluateForTestInFrontend(long testCallId, const String& script);
 
-    void addScriptToEvaluateOnLoad(ErrorString* error, const String& source);
-    void removeAllScriptsToEvaluateOnLoad(ErrorString* error);
     void setInspectorExtensionAPI(const String& source);
 
     InspectorState* state() { return m_state.get(); }
@@ -208,24 +170,12 @@ public:
     // InspectorAgent API
     void getInspectorState(RefPtr<InspectorObject>* state);
     void setMonitoringXHREnabled(bool enabled, bool* newState);
-    void populateScriptObjects(ErrorString* error);
     // Following are used from InspectorBackend and internally.
-    void setSearchingForNode(ErrorString* error, bool enabled, bool* newState);
-    void didEvaluateForTestInFrontend(ErrorString* error, long callId, const String& jsonResult);
-
-    void setUserAgentOverride(ErrorString* error, const String& userAgent);
-    void applyUserAgentOverride(String* userAgent) const;
+    void didEvaluateForTestInFrontend(ErrorString*, long callId, const String& jsonResult);
 
 private:
     void showPanel(const String& panel);
-    void pushDataCollectedOffline();
-    enum ProfilerRestoreAction {
-        ProfilerRestoreNoAction = 0,
-        ProfilerRestoreResetAgent = 1
-    };
-    void restoreProfiler(ProfilerRestoreAction);
     void unbindAllResources();
-    void setSearchingForNode(bool enabled);
 
     void releaseFrontendLifetimeAgents();
     void createFrontendLifetimeAgents();
@@ -234,10 +184,6 @@ private:
     void toggleRecordButton(bool);
 #endif
 
-    PassRefPtr<InspectorObject> buildObjectForCookie(const Cookie&);
-    PassRefPtr<InspectorArray> buildArrayForCookies(ListHashSet<Cookie>&);
-
-    void focusNode();
     bool isMainResourceLoader(DocumentLoader*, const KURL& requestUrl);
     void issueEvaluateForTestCommands();
 
@@ -245,8 +191,9 @@ private:
     InspectorClient* m_client;
     InspectorFrontend* m_frontend;
     OwnPtr<InstrumentingAgents> m_instrumentingAgents;
-    RefPtr<InjectedScriptHost> m_injectedScriptHost;
+    InjectedScriptManager* m_injectedScriptManager;
     OwnPtr<InspectorState> m_state;
+    OwnPtr<InspectorPageAgent> m_pageAgent;
     OwnPtr<InspectorDOMAgent> m_domAgent;
     OwnPtr<InspectorCSSAgent> m_cssAgent;
 
@@ -264,8 +211,6 @@ private:
     OwnPtr<InspectorApplicationCacheAgent> m_applicationCacheAgent;
 #endif
 
-    RefPtr<Node> m_highlightedNode;
-    RefPtr<Node> m_nodeToFocus;
     RefPtr<InspectorResourceAgent> m_resourceAgent;
     OwnPtr<InspectorRuntimeAgent> m_runtimeAgent;
 
@@ -273,14 +218,12 @@ private:
 
     Vector<pair<long, String> > m_pendingEvaluateTestCommands;
     String m_showPanelAfterVisible;
-    Vector<String> m_scriptsToEvaluateOnLoad;
     String m_inspectorExtensionAPI;
 #if ENABLE(JAVASCRIPT_DEBUGGER)
     OwnPtr<InspectorDebuggerAgent> m_debuggerAgent;
     OwnPtr<InspectorBrowserDebuggerAgent> m_browserDebuggerAgent;
     OwnPtr<InspectorProfilerAgent> m_profilerAgent;
 #endif
-    String m_userAgentOverride;
 #if ENABLE(WORKERS)
     typedef HashMap<intptr_t, RefPtr<InspectorWorkerResource> > WorkersMap;
     WorkersMap m_workers;
diff --git a/Source/WebCore/inspector/InspectorApplicationCacheAgent.cpp b/Source/WebCore/inspector/InspectorApplicationCacheAgent.cpp
index 625f53d..705a640 100644
--- a/Source/WebCore/inspector/InspectorApplicationCacheAgent.cpp
+++ b/Source/WebCore/inspector/InspectorApplicationCacheAgent.cpp
@@ -73,7 +73,7 @@ void InspectorApplicationCacheAgent::networkStateChanged()
     m_frontend->updateNetworkState(isNowOnline);
 }
 
-void InspectorApplicationCacheAgent::getApplicationCaches(ErrorString*, RefPtr<InspectorValue>* applicationCaches)
+void InspectorApplicationCacheAgent::getApplicationCaches(ErrorString*, RefPtr<InspectorObject>* applicationCaches)
 {
     DocumentLoader* documentLoader = m_inspectedPage->mainFrame()->loader()->documentLoader();
     if (!documentLoader)
diff --git a/Source/WebCore/inspector/InspectorApplicationCacheAgent.h b/Source/WebCore/inspector/InspectorApplicationCacheAgent.h
index 34abf81..04b9533 100644
--- a/Source/WebCore/inspector/InspectorApplicationCacheAgent.h
+++ b/Source/WebCore/inspector/InspectorApplicationCacheAgent.h
@@ -60,7 +60,7 @@ public:
     void networkStateChanged();
 
     // From Frontend
-    void getApplicationCaches(ErrorString* error, RefPtr<InspectorValue>* applicationCaches);
+    void getApplicationCaches(ErrorString*, RefPtr<InspectorObject>* applicationCaches);
 
 private:
     PassRefPtr<InspectorObject> buildObjectForApplicationCache(const ApplicationCacheHost::ResourceInfoList&, const ApplicationCacheHost::CacheInfo&);
diff --git a/Source/WebCore/inspector/InspectorBrowserDebuggerAgent.cpp b/Source/WebCore/inspector/InspectorBrowserDebuggerAgent.cpp
index 0cba775..1cf2a25 100644
--- a/Source/WebCore/inspector/InspectorBrowserDebuggerAgent.cpp
+++ b/Source/WebCore/inspector/InspectorBrowserDebuggerAgent.cpp
@@ -35,12 +35,13 @@
 #if ENABLE(INSPECTOR) && ENABLE(JAVASCRIPT_DEBUGGER)
 
 #include "HTMLElement.h"
+#include "InspectorAgent.h"
 #include "InspectorDOMAgent.h"
 #include "InspectorDebuggerAgent.h"
 #include "InspectorState.h"
 #include "InspectorValues.h"
 #include "InstrumentingAgents.h"
-#include <wtf/text/CString.h>
+#include <wtf/text/StringConcatenate.h>
 
 namespace {
 
@@ -63,7 +64,9 @@ const int domBreakpointDerivedTypeShift = 16;
 namespace WebCore {
 
 namespace BrowserDebuggerAgentState {
-static const char browserBreakpoints[] = "browserBreakpoints";
+static const char eventListenerBreakpoints[] = "eventListenerBreakpoints";
+static const char pauseOnAllXHRs[] = "pauseOnAllXHRs";
+static const char xhrBreakpoints[] = "xhrBreakpoints";
 }
 
 PassOwnPtr<InspectorBrowserDebuggerAgent> InspectorBrowserDebuggerAgent::create(InstrumentingAgents* instrumentingAgents, InspectorState* inspectorState, InspectorDOMAgent* domAgent, InspectorDebuggerAgent* debuggerAgent, InspectorAgent* inspectorAgent)
@@ -77,7 +80,6 @@ InspectorBrowserDebuggerAgent::InspectorBrowserDebuggerAgent(InstrumentingAgents
     , m_domAgent(domAgent)
     , m_debuggerAgent(debuggerAgent)
     , m_inspectorAgent(inspectorAgent)
-    , m_hasXHRBreakpointWithEmptyURL(false)
 {
     m_debuggerAgent->setListener(this);
 }
@@ -105,84 +107,38 @@ void InspectorBrowserDebuggerAgent::disable()
     clear();
 }
 
-void InspectorBrowserDebuggerAgent::setFrontend(InspectorFrontend*)
-{
-    // Erase sticky breakpoints. If we are restoring from a cookie setFrontend msut be called
-    // before the state is loaded from the cookie.
-    m_inspectorState->setObject(BrowserDebuggerAgentState::browserBreakpoints, InspectorObject::create());
-}
-
 void InspectorBrowserDebuggerAgent::clearFrontend()
 {
     disable();
 }
 
-void InspectorBrowserDebuggerAgent::setAllBrowserBreakpoints(ErrorString*, PassRefPtr<InspectorObject> breakpoints)
-{
-    m_inspectorState->setObject(BrowserDebuggerAgentState::browserBreakpoints, breakpoints);
-    // FIXME: remove this call to inspector agent and dependency on the inspector agent.
-    inspectedURLChanged(m_inspectorAgent->inspectedURLWithoutFragment());
-}
-
-void InspectorBrowserDebuggerAgent::inspectedURLChanged(const String& url)
+void InspectorBrowserDebuggerAgent::discardBindings()
 {
-    m_eventListenerBreakpoints.clear();
-    m_XHRBreakpoints.clear();
-    m_hasXHRBreakpointWithEmptyURL = false;
-
-    RefPtr<InspectorObject> allBreakpoints = m_inspectorState->getObject(BrowserDebuggerAgentState::browserBreakpoints);
-    RefPtr<InspectorArray> breakpoints = allBreakpoints->getArray(url);
-    if (!breakpoints)
-        return;
-    for (unsigned i = 0; i < breakpoints->length(); ++i)
-        restoreStickyBreakpoint(breakpoints->get(i)->asObject());
+    m_domBreakpoints.clear();
 }
 
-void InspectorBrowserDebuggerAgent::restoreStickyBreakpoint(PassRefPtr<InspectorObject> breakpoint)
+void InspectorBrowserDebuggerAgent::setEventListenerBreakpoint(ErrorString* error, const String& eventName)
 {
-    if (!breakpoint)
-        return;
-    String type;
-    if (!breakpoint->getString("type", &type))
-        return;
-    bool enabled;
-    if (!breakpoint->getBoolean("enabled", &enabled))
+    if (eventName.isEmpty()) {
+        *error = "Event name is empty";
         return;
-    RefPtr<InspectorObject> condition = breakpoint->getObject("condition");
-    if (!condition)
-        return;
-
-    ErrorString error;
-    if (type == eventListenerNativeBreakpointType) {
-        if (!enabled)
-            return;
-        String eventName;
-        if (!condition->getString("eventName", &eventName))
-            return;
-        setEventListenerBreakpoint(&error, eventName);
-    } else if (type == xhrNativeBreakpointType) {
-        if (!enabled)
-            return;
-        String url;
-        if (!condition->getString("url", &url))
-            return;
-        setXHRBreakpoint(&error, url);
     }
-}
 
-void InspectorBrowserDebuggerAgent::discardBindings()
-{
-    m_domBreakpoints.clear();
+    RefPtr<InspectorObject> eventListenerBreakpoints = m_inspectorState->getObject(BrowserDebuggerAgentState::eventListenerBreakpoints);
+    eventListenerBreakpoints->setBoolean(eventName, true);
+    m_inspectorState->setObject(BrowserDebuggerAgentState::eventListenerBreakpoints, eventListenerBreakpoints);
 }
 
-void InspectorBrowserDebuggerAgent::setEventListenerBreakpoint(ErrorString*, const String& eventName)
+void InspectorBrowserDebuggerAgent::removeEventListenerBreakpoint(ErrorString* error, const String& eventName)
 {
-    m_eventListenerBreakpoints.add(eventName);
-}
+    if (eventName.isEmpty()) {
+        *error = "Event name is empty";
+        return;
+    }
 
-void InspectorBrowserDebuggerAgent::removeEventListenerBreakpoint(ErrorString*, const String& eventName)
-{
-    m_eventListenerBreakpoints.remove(eventName);
+    RefPtr<InspectorObject> eventListenerBreakpoints = m_inspectorState->getObject(BrowserDebuggerAgentState::eventListenerBreakpoints);
+    eventListenerBreakpoints->remove(eventName);
+    m_inspectorState->setObject(BrowserDebuggerAgentState::eventListenerBreakpoints, eventListenerBreakpoints);
 }
 
 void InspectorBrowserDebuggerAgent::didInsertDOMNode(Node* node)
@@ -213,7 +169,7 @@ void InspectorBrowserDebuggerAgent::didRemoveDOMNode(Node* node)
     }
 }
 
-void InspectorBrowserDebuggerAgent::setDOMBreakpoint(ErrorString*, long nodeId, long type)
+void InspectorBrowserDebuggerAgent::setDOMBreakpoint(ErrorString*, int nodeId, int type)
 {
     Node* node = m_domAgent->nodeForId(nodeId);
     if (!node)
@@ -227,7 +183,7 @@ void InspectorBrowserDebuggerAgent::setDOMBreakpoint(ErrorString*, long nodeId,
     }
 }
 
-void InspectorBrowserDebuggerAgent::removeDOMBreakpoint(ErrorString*, long nodeId, long type)
+void InspectorBrowserDebuggerAgent::removeDOMBreakpoint(ErrorString*, int nodeId, int type)
 {
     Node* node = m_domAgent->nodeForId(nodeId);
     if (!node)
@@ -266,12 +222,13 @@ void InspectorBrowserDebuggerAgent::willRemoveDOMNode(Node* node)
     if (!debuggerAgent)
         return;
 
+    Node* parentNode = InspectorDOMAgent::innerParentNode(node);
     if (hasBreakpoint(node, NodeRemoved)) {
         RefPtr<InspectorObject> eventData = InspectorObject::create();
         descriptionForDOMEvent(node, NodeRemoved, false, eventData.get());
         eventData->setString("breakpointType", domNativeBreakpointType);
         debuggerAgent->breakProgram(NativeBreakpointDebuggerEventType, eventData.release());
-    } else if (hasBreakpoint(InspectorDOMAgent::innerParentNode(node), SubtreeModified)) {
+    } else if (parentNode && hasBreakpoint(parentNode, SubtreeModified)) {
         RefPtr<InspectorObject> eventData = InspectorObject::create();
         descriptionForDOMEvent(node, SubtreeModified, false, eventData.get());
         eventData->setString("breakpointType", domNativeBreakpointType);
@@ -293,7 +250,7 @@ void InspectorBrowserDebuggerAgent::willModifyDOMAttr(Element* element)
     }
 }
 
-void InspectorBrowserDebuggerAgent::descriptionForDOMEvent(Node* target, long breakpointType, bool insertion, InspectorObject* description)
+void InspectorBrowserDebuggerAgent::descriptionForDOMEvent(Node* target, int breakpointType, bool insertion, InspectorObject* description)
 {
     ASSERT(hasBreakpoint(target, breakpointType));
 
@@ -301,7 +258,7 @@ void InspectorBrowserDebuggerAgent::descriptionForDOMEvent(Node* target, long br
     if ((1 << breakpointType) & inheritableDOMBreakpointTypesMask) {
         // For inheritable breakpoint types, target node isn't always the same as the node that owns a breakpoint.
         // Target node may be unknown to frontend, so we need to push it first.
-        RefPtr<InspectorObject> targetNodeObject = m_domAgent->resolveNode(target, "");
+        RefPtr<InspectorObject> targetNodeObject = m_domAgent->resolveNode(target);
         description->setObject("targetNode", targetNodeObject);
 
         // Find breakpoint owner node.
@@ -317,13 +274,13 @@ void InspectorBrowserDebuggerAgent::descriptionForDOMEvent(Node* target, long br
             description->setBoolean("insertion", insertion);
     }
 
-    long breakpointOwnerNodeId = m_domAgent->boundNodeId(breakpointOwner);
+    int breakpointOwnerNodeId = m_domAgent->boundNodeId(breakpointOwner);
     ASSERT(breakpointOwnerNodeId);
     description->setNumber("nodeId", breakpointOwnerNodeId);
     description->setNumber("type", breakpointType);
 }
 
-bool InspectorBrowserDebuggerAgent::hasBreakpoint(Node* node, long type)
+bool InspectorBrowserDebuggerAgent::hasBreakpoint(Node* node, int type)
 {
     uint32_t rootBit = 1 << type;
     uint32_t derivedBit = rootBit << domBreakpointDerivedTypeShift;
@@ -354,8 +311,9 @@ void InspectorBrowserDebuggerAgent::pauseOnNativeEventIfNeeded(const String& cat
     if (!debuggerAgent)
         return;
 
-    String fullEventName = String::format("%s:%s", categoryType.utf8().data(), eventName.utf8().data());
-    if (!m_eventListenerBreakpoints.contains(fullEventName))
+    String fullEventName = makeString(categoryType, ":", eventName);
+    RefPtr<InspectorObject> eventListenerBreakpoints = m_inspectorState->getObject(BrowserDebuggerAgentState::eventListenerBreakpoints);
+    if (eventListenerBreakpoints->find(fullEventName) == eventListenerBreakpoints->end())
         return;
 
     RefPtr<InspectorObject> eventData = InspectorObject::create();
@@ -369,18 +327,26 @@ void InspectorBrowserDebuggerAgent::pauseOnNativeEventIfNeeded(const String& cat
 
 void InspectorBrowserDebuggerAgent::setXHRBreakpoint(ErrorString*, const String& url)
 {
-    if (url.isEmpty())
-        m_hasXHRBreakpointWithEmptyURL = true;
-    else
-        m_XHRBreakpoints.add(url);
+    if (url.isEmpty()) {
+        m_inspectorState->setBoolean(BrowserDebuggerAgentState::pauseOnAllXHRs, true);
+        return;
+    }
+
+    RefPtr<InspectorObject> xhrBreakpoints = m_inspectorState->getObject(BrowserDebuggerAgentState::xhrBreakpoints);
+    xhrBreakpoints->setBoolean(url, true);
+    m_inspectorState->setObject(BrowserDebuggerAgentState::xhrBreakpoints, xhrBreakpoints);
 }
 
 void InspectorBrowserDebuggerAgent::removeXHRBreakpoint(ErrorString*, const String& url)
 {
-    if (url.isEmpty())
-        m_hasXHRBreakpointWithEmptyURL = false;
-    else
-        m_XHRBreakpoints.remove(url);
+    if (url.isEmpty()) {
+        m_inspectorState->setBoolean(BrowserDebuggerAgentState::pauseOnAllXHRs, false);
+        return;
+    }
+
+    RefPtr<InspectorObject> xhrBreakpoints = m_inspectorState->getObject(BrowserDebuggerAgentState::xhrBreakpoints);
+    xhrBreakpoints->remove(url);
+    m_inspectorState->setObject(BrowserDebuggerAgentState::xhrBreakpoints, xhrBreakpoints);
 }
 
 void InspectorBrowserDebuggerAgent::willSendXMLHttpRequest(const String& url)
@@ -390,12 +356,13 @@ void InspectorBrowserDebuggerAgent::willSendXMLHttpRequest(const String& url)
         return;
 
     String breakpointURL;
-    if (m_hasXHRBreakpointWithEmptyURL)
+    if (m_inspectorState->getBoolean(BrowserDebuggerAgentState::pauseOnAllXHRs))
         breakpointURL = "";
     else {
-        for (HashSet<String>::iterator it = m_XHRBreakpoints.begin(); it != m_XHRBreakpoints.end(); ++it) {
-            if (url.contains(*it)) {
-                breakpointURL = *it;
+        RefPtr<InspectorObject> xhrBreakpoints = m_inspectorState->getObject(BrowserDebuggerAgentState::xhrBreakpoints);
+        for (InspectorObject::iterator it = xhrBreakpoints->begin(); it != xhrBreakpoints->end(); ++it) {
+            if (url.contains(it->first)) {
+                breakpointURL = it->first;
                 break;
             }
         }
@@ -414,9 +381,6 @@ void InspectorBrowserDebuggerAgent::willSendXMLHttpRequest(const String& url)
 void InspectorBrowserDebuggerAgent::clear()
 {
     m_domBreakpoints.clear();
-    m_eventListenerBreakpoints.clear();
-    m_XHRBreakpoints.clear();
-    m_hasXHRBreakpointWithEmptyURL = false;
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/inspector/InspectorBrowserDebuggerAgent.h b/Source/WebCore/inspector/InspectorBrowserDebuggerAgent.h
index 7c0bc8d..add0c05 100644
--- a/Source/WebCore/inspector/InspectorBrowserDebuggerAgent.h
+++ b/Source/WebCore/inspector/InspectorBrowserDebuggerAgent.h
@@ -36,10 +36,8 @@
 #include "InspectorDebuggerAgent.h"
 #include "PlatformString.h"
 #include <wtf/HashMap.h>
-#include <wtf/HashSet.h>
 #include <wtf/PassOwnPtr.h>
 #include <wtf/RefCounted.h>
-#include <wtf/text/StringHash.h>
 
 namespace WebCore {
 
@@ -62,19 +60,15 @@ public:
 
     virtual ~InspectorBrowserDebuggerAgent();
 
-    void setFrontend(InspectorFrontend*);
     void clearFrontend();
 
-    void setAllBrowserBreakpoints(ErrorString* error, PassRefPtr<InspectorObject>);
-    void inspectedURLChanged(const String& url);
-
     // BrowserDebugger API for InspectorFrontend
-    void setXHRBreakpoint(ErrorString* error, const String& url);
-    void removeXHRBreakpoint(ErrorString* error, const String& url);
-    void setEventListenerBreakpoint(ErrorString* error, const String& eventName);
-    void removeEventListenerBreakpoint(ErrorString* error, const String& eventName);
-    void setDOMBreakpoint(ErrorString* error, long nodeId, long type);
-    void removeDOMBreakpoint(ErrorString* error, long nodeId, long type);
+    void setXHRBreakpoint(ErrorString*, const String& url);
+    void removeXHRBreakpoint(ErrorString*, const String& url);
+    void setEventListenerBreakpoint(ErrorString*, const String& eventName);
+    void removeEventListenerBreakpoint(ErrorString*, const String& eventName);
+    void setDOMBreakpoint(ErrorString*, int nodeId, int type);
+    void removeDOMBreakpoint(ErrorString*, int nodeId, int type);
 
     // InspectorInstrumentation API
     void willInsertDOMNode(Node*, Node* parent);
@@ -93,11 +87,9 @@ private:
     virtual void debuggerWasDisabled();
     void disable();
 
-    void restoreStickyBreakpoint(PassRefPtr<InspectorObject> breakpoint);
-
-    void descriptionForDOMEvent(Node* target, long breakpointType, bool insertion, InspectorObject* description);
+    void descriptionForDOMEvent(Node* target, int breakpointType, bool insertion, InspectorObject* description);
     void updateSubtreeBreakpoints(Node*, uint32_t rootMask, bool set);
-    bool hasBreakpoint(Node*, long type);
+    bool hasBreakpoint(Node*, int type);
     void discardBindings();
 
     void clear();
@@ -108,9 +100,6 @@ private:
     InspectorDebuggerAgent* m_debuggerAgent;
     InspectorAgent* m_inspectorAgent;
     HashMap<Node*, uint32_t> m_domBreakpoints;
-    HashSet<String> m_eventListenerBreakpoints;
-    HashSet<String> m_XHRBreakpoints;
-    bool m_hasXHRBreakpointWithEmptyURL;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/inspector/InspectorCSSAgent.cpp b/Source/WebCore/inspector/InspectorCSSAgent.cpp
index b96071d..980fcf2 100644
--- a/Source/WebCore/inspector/InspectorCSSAgent.cpp
+++ b/Source/WebCore/inspector/InspectorCSSAgent.cpp
@@ -104,17 +104,21 @@
 //    selectorRange: { start: <number>, end: <number> } // Optional - for source-based rules only
 // }
 //
+// cssStyleSheetInfo = {
+//    styleSheetId : <number>
+//    sourceURL    : <string>
+//    title        : <string>
+//    disabled     : <boolean>
+// }
+//
 // cssStyleSheet = {
-//    styleSheetId   : <number>
-//    sourceURL      : <string>
-//    title          : <string>
-//    disabled       : <boolean>
-//    rules          : [
-//                         #cssRule,
-//                         ...
-//                         #cssRule
-//                     ]
-//    text           : <string> // Optional - whenever the text is available for a text-based stylesheet
+//    styleSheetId : <number>
+//    rules        : [
+//                       #cssRule,
+//                       ...
+//                       #cssRule
+//                   ]
+//    text         : <string> // Optional - whenever the text is available for a text-based stylesheet
 // }
 
 namespace WebCore {
@@ -171,9 +175,9 @@ void InspectorCSSAgent::reset()
     m_documentToInspectorStyleSheet.clear();
 }
 
-void InspectorCSSAgent::getStylesForNode(ErrorString*, long nodeId, RefPtr<InspectorValue>* result)
+void InspectorCSSAgent::getStylesForNode(ErrorString* errorString, int nodeId, RefPtr<InspectorObject>* result)
 {
-    Element* element = elementForId(nodeId);
+    Element* element = elementForId(errorString, nodeId);
     if (!element)
         return;
 
@@ -191,7 +195,7 @@ void InspectorCSSAgent::getStylesForNode(ErrorString*, long nodeId, RefPtr<Inspe
     RefPtr<CSSRuleList> matchedRules = selector->styleRulesForElement(element, false, true);
     resultObject->setArray("matchedCSSRules", buildArrayForRuleList(matchedRules.get()));
 
-    resultObject->setObject("styleAttributes", buildObjectForAttributeStyles(element));
+    resultObject->setArray("styleAttributes", buildArrayForAttributeStyles(element));
 
     RefPtr<InspectorArray> pseudoElements = InspectorArray::create();
     for (PseudoId pseudoId = FIRST_PUBLIC_PSEUDOID; pseudoId < AFTER_LAST_INTERNAL_PSEUDOID; pseudoId = static_cast<PseudoId>(pseudoId + 1)) {
@@ -226,9 +230,9 @@ void InspectorCSSAgent::getStylesForNode(ErrorString*, long nodeId, RefPtr<Inspe
     *result = resultObject.release();
 }
 
-void InspectorCSSAgent::getInlineStyleForNode(ErrorString*, long nodeId, RefPtr<InspectorValue>* style)
+void InspectorCSSAgent::getInlineStyleForNode(ErrorString* errorString, int nodeId, RefPtr<InspectorObject>* style)
 {
-    Element* element = elementForId(nodeId);
+    Element* element = elementForId(errorString, nodeId);
     if (!element)
         return;
 
@@ -239,9 +243,9 @@ void InspectorCSSAgent::getInlineStyleForNode(ErrorString*, long nodeId, RefPtr<
     *style = styleSheet->buildObjectForStyle(element->style());
 }
 
-void InspectorCSSAgent::getComputedStyleForNode(ErrorString*, long nodeId, RefPtr<InspectorValue>* style)
+void InspectorCSSAgent::getComputedStyleForNode(ErrorString* errorString, int nodeId, RefPtr<InspectorObject>* style)
 {
-    Element* element = elementForId(nodeId);
+    Element* element = elementForId(errorString, nodeId);
     if (!element)
         return;
 
@@ -250,7 +254,7 @@ void InspectorCSSAgent::getComputedStyleForNode(ErrorString*, long nodeId, RefPt
     *style = inspectorStyle->buildObjectForStyle();
 }
 
-void InspectorCSSAgent::getAllStyles(ErrorString*, RefPtr<InspectorArray>* styles)
+void InspectorCSSAgent::getAllStyleSheets(ErrorString*, RefPtr<InspectorArray>* styleInfos)
 {
     Vector<Document*> documents = m_domAgent->documents();
     for (Vector<Document*>::iterator it = documents.begin(); it != documents.end(); ++it) {
@@ -259,33 +263,33 @@ void InspectorCSSAgent::getAllStyles(ErrorString*, RefPtr<InspectorArray>* style
             StyleSheet* styleSheet = list->item(i);
             if (styleSheet->isCSSStyleSheet()) {
                 InspectorStyleSheet* inspectorStyleSheet = bindStyleSheet(static_cast<CSSStyleSheet*>(styleSheet));
-                (*styles)->pushString(inspectorStyleSheet->id());
+                (*styleInfos)->pushObject(inspectorStyleSheet->buildObjectForStyleSheetInfo());
             }
         }
     }
 }
 
-void InspectorCSSAgent::getStyleSheet(ErrorString*, const String& styleSheetId, RefPtr<InspectorValue>* styleSheetObject)
+void InspectorCSSAgent::getStyleSheet(ErrorString* errorString, const String& styleSheetId, RefPtr<InspectorObject>* styleSheetObject)
 {
-    InspectorStyleSheet* inspectorStyleSheet = styleSheetForId(styleSheetId);
+    InspectorStyleSheet* inspectorStyleSheet = styleSheetForId(errorString, styleSheetId);
     if (!inspectorStyleSheet)
         return;
 
     *styleSheetObject = inspectorStyleSheet->buildObjectForStyleSheet();
 }
 
-void InspectorCSSAgent::getStyleSheetText(ErrorString*, const String& styleSheetId, String* url, String* result)
+void InspectorCSSAgent::getStyleSheetText(ErrorString* errorString, const String& styleSheetId, String* url, String* result)
 {
-    InspectorStyleSheet* inspectorStyleSheet = styleSheetForId(styleSheetId);
+    InspectorStyleSheet* inspectorStyleSheet = styleSheetForId(errorString, styleSheetId);
     if (!inspectorStyleSheet)
         return;
     *url = inspectorStyleSheet->finalURL();
     inspectorStyleSheet->text(result);
 }
 
-void InspectorCSSAgent::setStyleSheetText(ErrorString*, const String& styleSheetId, const String& text, bool* success)
+void InspectorCSSAgent::setStyleSheetText(ErrorString* errorString, const String& styleSheetId, const String& text, bool* success)
 {
-    InspectorStyleSheet* inspectorStyleSheet = styleSheetForId(styleSheetId);
+    InspectorStyleSheet* inspectorStyleSheet = styleSheetForId(errorString, styleSheetId);
     if (!inspectorStyleSheet) {
         *success = false;
         return;
@@ -296,12 +300,12 @@ void InspectorCSSAgent::setStyleSheetText(ErrorString*, const String& styleSheet
         inspectorStyleSheet->reparseStyleSheet(text);
 }
 
-void InspectorCSSAgent::setPropertyText(ErrorString*, const RefPtr<InspectorObject>& fullStyleId, long propertyIndex, const String& text, bool overwrite, RefPtr<InspectorValue>* result)
+void InspectorCSSAgent::setPropertyText(ErrorString* errorString, const RefPtr<InspectorObject>& fullStyleId, int propertyIndex, const String& text, bool overwrite, RefPtr<InspectorObject>* result)
 {
     InspectorCSSId compoundId(fullStyleId);
     ASSERT(!compoundId.isEmpty());
 
-    InspectorStyleSheet* inspectorStyleSheet = styleSheetForId(compoundId.styleSheetId());
+    InspectorStyleSheet* inspectorStyleSheet = styleSheetForId(errorString, compoundId.styleSheetId());
     if (!inspectorStyleSheet)
         return;
 
@@ -310,12 +314,12 @@ void InspectorCSSAgent::setPropertyText(ErrorString*, const RefPtr<InspectorObje
         *result = inspectorStyleSheet->buildObjectForStyle(inspectorStyleSheet->styleForId(compoundId));
 }
 
-void InspectorCSSAgent::toggleProperty(ErrorString*, const RefPtr<InspectorObject>& fullStyleId, long propertyIndex, bool disable, RefPtr<InspectorValue>* result)
+void InspectorCSSAgent::toggleProperty(ErrorString* errorString, const RefPtr<InspectorObject>& fullStyleId, int propertyIndex, bool disable, RefPtr<InspectorObject>* result)
 {
     InspectorCSSId compoundId(fullStyleId);
     ASSERT(!compoundId.isEmpty());
 
-    InspectorStyleSheet* inspectorStyleSheet = styleSheetForId(compoundId.styleSheetId());
+    InspectorStyleSheet* inspectorStyleSheet = styleSheetForId(errorString, compoundId.styleSheetId());
     if (!inspectorStyleSheet)
         return;
 
@@ -324,12 +328,12 @@ void InspectorCSSAgent::toggleProperty(ErrorString*, const RefPtr<InspectorObjec
         *result = inspectorStyleSheet->buildObjectForStyle(inspectorStyleSheet->styleForId(compoundId));
 }
 
-void InspectorCSSAgent::setRuleSelector(ErrorString*, const RefPtr<InspectorObject>& fullRuleId, const String& selector, RefPtr<InspectorValue>* result)
+void InspectorCSSAgent::setRuleSelector(ErrorString* errorString, const RefPtr<InspectorObject>& fullRuleId, const String& selector, RefPtr<InspectorObject>* result)
 {
     InspectorCSSId compoundId(fullRuleId);
     ASSERT(!compoundId.isEmpty());
 
-    InspectorStyleSheet* inspectorStyleSheet = styleSheetForId(compoundId.styleSheetId());
+    InspectorStyleSheet* inspectorStyleSheet = styleSheetForId(errorString, compoundId.styleSheetId());
     if (!inspectorStyleSheet)
         return;
 
@@ -340,7 +344,7 @@ void InspectorCSSAgent::setRuleSelector(ErrorString*, const RefPtr<InspectorObje
     *result = inspectorStyleSheet->buildObjectForRule(inspectorStyleSheet->ruleForId(compoundId));
 }
 
-void InspectorCSSAgent::addRule(ErrorString*, const long contextNodeId, const String& selector, RefPtr<InspectorValue>* result)
+void InspectorCSSAgent::addRule(ErrorString*, const int contextNodeId, const String& selector, RefPtr<InspectorObject>* result)
 {
     Node* node = m_domAgent->nodeForId(contextNodeId);
     if (!node)
@@ -394,10 +398,18 @@ InspectorStyleSheetForInlineStyle* InspectorCSSAgent::asInspectorStyleSheet(Elem
     return it->second.get();
 }
 
-Element* InspectorCSSAgent::elementForId(long nodeId)
+Element* InspectorCSSAgent::elementForId(ErrorString* errorString, int nodeId)
 {
     Node* node = m_domAgent->nodeForId(nodeId);
-    return (!node || node->nodeType() != Node::ELEMENT_NODE) ? 0 : static_cast<Element*>(node);
+    if (!node) {
+        *errorString = "No node with given id found.";
+        return 0;
+    }
+    if (node->nodeType() != Node::ELEMENT_NODE) {
+        *errorString = "Not an element node.";
+        return 0;
+    }
+    return static_cast<Element*>(node);
 }
 
 InspectorStyleSheet* InspectorCSSAgent::bindStyleSheet(CSSStyleSheet* styleSheet)
@@ -453,10 +465,14 @@ InspectorStyleSheet* InspectorCSSAgent::viaInspectorStyleSheet(Document* documen
     return inspectorStyleSheet.get();
 }
 
-InspectorStyleSheet* InspectorCSSAgent::styleSheetForId(const String& styleSheetId)
+InspectorStyleSheet* InspectorCSSAgent::styleSheetForId(ErrorString* errorString, const String& styleSheetId)
 {
     IdToInspectorStyleSheet::iterator it = m_idToInspectorStyleSheet.find(styleSheetId);
-    return it == m_idToInspectorStyleSheet.end() ? 0 : it->second.get();
+    if (it == m_idToInspectorStyleSheet.end()) {
+        *errorString = "No style sheet with given id found.";
+        return 0;
+    }
+    return it->second.get();
 }
 
 String InspectorCSSAgent::detectOrigin(CSSStyleSheet* pageStyleSheet, Document* ownerDocument)
@@ -496,20 +512,23 @@ PassRefPtr<InspectorArray> InspectorCSSAgent::buildArrayForRuleList(CSSRuleList*
     return result.release();
 }
 
-PassRefPtr<InspectorObject> InspectorCSSAgent::buildObjectForAttributeStyles(Element* element)
+PassRefPtr<InspectorArray> InspectorCSSAgent::buildArrayForAttributeStyles(Element* element)
 {
-    RefPtr<InspectorObject> styleAttributes = InspectorObject::create();
+    RefPtr<InspectorArray> attrStyles = InspectorArray::create();
     NamedNodeMap* attributes = element->attributes();
     for (unsigned i = 0; attributes && i < attributes->length(); ++i) {
         Attribute* attribute = attributes->attributeItem(i);
         if (attribute->style()) {
+            RefPtr<InspectorObject> attrStyleObject = InspectorObject::create();
             String attributeName = attribute->localName();
             RefPtr<InspectorStyle> inspectorStyle = InspectorStyle::create(InspectorCSSId(), attribute->style(), 0);
-            styleAttributes->setObject(attributeName.utf8().data(), inspectorStyle->buildObjectForStyle());
+            attrStyleObject->setString("name", attributeName.utf8().data());
+            attrStyleObject->setObject("style", inspectorStyle->buildObjectForStyle());
+            attrStyles->pushObject(attrStyleObject.release());
         }
     }
 
-    return styleAttributes;
+    return attrStyles.release();
 }
 
 void InspectorCSSAgent::didRemoveDocument(Document* document)
diff --git a/Source/WebCore/inspector/InspectorCSSAgent.h b/Source/WebCore/inspector/InspectorCSSAgent.h
index 4e3f57a..40bc2ab 100644
--- a/Source/WebCore/inspector/InspectorCSSAgent.h
+++ b/Source/WebCore/inspector/InspectorCSSAgent.h
@@ -61,18 +61,18 @@ public:
     ~InspectorCSSAgent();
 
     void reset();
-    void getStylesForNode(ErrorString* error, long nodeId, RefPtr<InspectorValue>* result);
-    void getInlineStyleForNode(ErrorString* error, long nodeId, RefPtr<InspectorValue>* style);
-    void getComputedStyleForNode(ErrorString* error, long nodeId, RefPtr<InspectorValue>* style);
-    void getAllStyles(ErrorString* error, RefPtr<InspectorArray>* styles);
-    void getStyleSheet(ErrorString* error, const String& styleSheetId, RefPtr<InspectorValue>* result);
-    void getStyleSheetText(ErrorString* error, const String& styleSheetId, String* url, String* result);
-    void setStyleSheetText(ErrorString* error, const String& styleSheetId, const String& text, bool* success);
-    void setPropertyText(ErrorString* error, const RefPtr<InspectorObject>& styleId, long propertyIndex, const String& text, bool overwrite, RefPtr<InspectorValue>* result);
-    void toggleProperty(ErrorString* error, const RefPtr<InspectorObject>& styleId, long propertyIndex, bool disable, RefPtr<InspectorValue>* result);
-    void setRuleSelector(ErrorString* error, const RefPtr<InspectorObject>& ruleId, const String& selector, RefPtr<InspectorValue>* result);
-    void addRule(ErrorString* error, const long contextNodeId, const String& selector, RefPtr<InspectorValue>* result);
-    void getSupportedCSSProperties(ErrorString* error, RefPtr<InspectorArray>* result);
+    void getStylesForNode(ErrorString*, int nodeId, RefPtr<InspectorObject>* result);
+    void getInlineStyleForNode(ErrorString*, int nodeId, RefPtr<InspectorObject>* style);
+    void getComputedStyleForNode(ErrorString*, int nodeId, RefPtr<InspectorObject>* style);
+    void getAllStyleSheets(ErrorString*, RefPtr<InspectorArray>* styleSheetInfos);
+    void getStyleSheet(ErrorString*, const String& styleSheetId, RefPtr<InspectorObject>* result);
+    void getStyleSheetText(ErrorString*, const String& styleSheetId, String* url, String* result);
+    void setStyleSheetText(ErrorString*, const String& styleSheetId, const String& text, bool* success);
+    void setPropertyText(ErrorString*, const RefPtr<InspectorObject>& styleId, int propertyIndex, const String& text, bool overwrite, RefPtr<InspectorObject>* result);
+    void toggleProperty(ErrorString*, const RefPtr<InspectorObject>& styleId, int propertyIndex, bool disable, RefPtr<InspectorObject>* result);
+    void setRuleSelector(ErrorString*, const RefPtr<InspectorObject>& ruleId, const String& selector, RefPtr<InspectorObject>* result);
+    void addRule(ErrorString*, const int contextNodeId, const String& selector, RefPtr<InspectorObject>* result);
+    void getSupportedCSSProperties(ErrorString*, RefPtr<InspectorArray>* result);
 
 private:
     typedef HashMap<String, RefPtr<InspectorStyleSheet> > IdToInspectorStyleSheet;
@@ -83,15 +83,15 @@ private:
     static Element* inlineStyleElement(CSSStyleDeclaration*);
 
     InspectorStyleSheetForInlineStyle* asInspectorStyleSheet(Element* element);
-    Element* elementForId(long nodeId);
+    Element* elementForId(ErrorString*, int nodeId);
 
     InspectorStyleSheet* bindStyleSheet(CSSStyleSheet*);
     InspectorStyleSheet* viaInspectorStyleSheet(Document*, bool createIfAbsent);
-    InspectorStyleSheet* styleSheetForId(const String&);
+    InspectorStyleSheet* styleSheetForId(ErrorString*, const String&);
     String detectOrigin(CSSStyleSheet* pageStyleSheet, Document* ownerDocument);
 
     PassRefPtr<InspectorArray> buildArrayForRuleList(CSSRuleList* ruleList);
-    PassRefPtr<InspectorObject> buildObjectForAttributeStyles(Element* element);
+    PassRefPtr<InspectorArray> buildArrayForAttributeStyles(Element*);
 
     // InspectorDOMAgent::DOMListener interface
     virtual void didRemoveDocument(Document*);
@@ -106,9 +106,9 @@ private:
     NodeToInspectorStyleSheet m_nodeToInspectorStyleSheet;
     DocumentToViaInspectorStyleSheet m_documentToInspectorStyleSheet;
 
-    long m_lastStyleSheetId;
-    long m_lastRuleId;
-    long m_lastStyleId;
+    int m_lastStyleSheetId;
+    int m_lastRuleId;
+    int m_lastStyleId;
 };
 
 #endif
diff --git a/Source/WebCore/inspector/InspectorConsoleAgent.cpp b/Source/WebCore/inspector/InspectorConsoleAgent.cpp
index 0379590..47cd2d5 100644
--- a/Source/WebCore/inspector/InspectorConsoleAgent.cpp
+++ b/Source/WebCore/inspector/InspectorConsoleAgent.cpp
@@ -31,6 +31,7 @@
 #include "Console.h"
 #include "ConsoleMessage.h"
 #include "InjectedScriptHost.h"
+#include "InjectedScriptManager.h"
 #include "InspectorAgent.h"
 #include "InspectorDOMAgent.h"
 #include "InspectorFrontend.h"
@@ -48,18 +49,18 @@
 namespace WebCore {
 
 static const unsigned maximumConsoleMessages = 1000;
-static const unsigned expireConsoleMessagesStep = 100;
+static const int expireConsoleMessagesStep = 100;
 
 namespace ConsoleAgentState {
 static const char monitoringXHR[] = "monitoringXHR";
 static const char consoleMessagesEnabled[] = "consoleMessagesEnabled";
 }
 
-InspectorConsoleAgent::InspectorConsoleAgent(InstrumentingAgents* instrumentingAgents, InspectorAgent* inspectorAgent, InspectorState* state, InjectedScriptHost* injectedScriptHost, InspectorDOMAgent* domAgent)
+InspectorConsoleAgent::InspectorConsoleAgent(InstrumentingAgents* instrumentingAgents, InspectorAgent* inspectorAgent, InspectorState* state, InjectedScriptManager* injectedScriptManager, InspectorDOMAgent* domAgent)
     : m_instrumentingAgents(instrumentingAgents)
     , m_inspectorAgent(inspectorAgent)
     , m_inspectorState(state)
-    , m_injectedScriptHost(injectedScriptHost)
+    , m_injectedScriptManager(injectedScriptManager)
     , m_inspectorDOMAgent(domAgent)
     , m_frontend(0)
     , m_previousMessage(0)
@@ -74,14 +75,24 @@ InspectorConsoleAgent::~InspectorConsoleAgent()
     m_instrumentingAgents = 0;
     m_inspectorAgent = 0;
     m_inspectorState = 0;
-    m_injectedScriptHost = 0;
+    m_injectedScriptManager = 0;
     m_inspectorDOMAgent = 0;
 }
 
-void InspectorConsoleAgent::setConsoleMessagesEnabled(ErrorString*, bool enabled, bool* newState)
+void InspectorConsoleAgent::enable(ErrorString*, int* consoleMessageExpireCount)
 {
-    *newState = enabled;
-    setConsoleMessagesEnabled(enabled);
+    *consoleMessageExpireCount = m_expiredConsoleMessageCount;
+
+    m_inspectorState->setBoolean(ConsoleAgentState::consoleMessagesEnabled, true);
+
+    size_t messageCount = m_consoleMessages.size();
+    for (size_t i = 0; i < messageCount; ++i)
+        m_consoleMessages[i]->addToFrontend(m_frontend, m_injectedScriptManager);
+}
+
+void InspectorConsoleAgent::disable(ErrorString*)
+{
+    m_inspectorState->setBoolean(ConsoleAgentState::consoleMessagesEnabled, false);
 }
 
 void InspectorConsoleAgent::clearConsoleMessages(ErrorString*)
@@ -89,9 +100,8 @@ void InspectorConsoleAgent::clearConsoleMessages(ErrorString*)
     m_consoleMessages.clear();
     m_expiredConsoleMessageCount = 0;
     m_previousMessage = 0;
-    m_injectedScriptHost->releaseObjectGroup(0 /* release the group in all scripts */, "console");
-    if (InspectorDOMAgent* domAgent = m_inspectorAgent->domAgent())
-        domAgent->releaseDanglingNodes();
+    m_injectedScriptManager->releaseObjectGroup("console");
+    m_inspectorDOMAgent->releaseDanglingNodes();
     if (m_frontend)
         m_frontend->consoleMessagesCleared();
 }
@@ -205,7 +215,8 @@ void InspectorConsoleAgent::didFailLoading(unsigned long identifier, const Resou
 {
     if (!m_inspectorAgent->enabled())
         return;
-
+    if (error.isCancellation()) // Report failures only.
+        return;
     String message = "Failed to load resource";
     if (!error.localizedDescription().isEmpty())
         message += ": " + error.localizedDescription();
@@ -217,17 +228,12 @@ void InspectorConsoleAgent::setMonitoringXHREnabled(ErrorString*, bool enabled)
     m_inspectorState->setBoolean(ConsoleAgentState::monitoringXHR, enabled);
 }
 
-void InspectorConsoleAgent::setConsoleMessagesEnabled(bool enabled)
+void InspectorConsoleAgent::addInspectedNode(ErrorString*, int nodeId)
 {
-    m_inspectorState->setBoolean(ConsoleAgentState::consoleMessagesEnabled, enabled);
-    if (!enabled || !m_frontend)
+    Node* node = m_inspectorDOMAgent->nodeForId(nodeId);
+    if (!node)
         return;
-
-    if (m_expiredConsoleMessageCount)
-        m_frontend->updateConsoleMessageExpiredCount(m_expiredConsoleMessageCount);
-    unsigned messageCount = m_consoleMessages.size();
-    for (unsigned i = 0; i < messageCount; ++i)
-        m_consoleMessages[i]->addToFrontend(m_frontend, m_injectedScriptHost);
+    m_injectedScriptManager->injectedScriptHost()->addInspectedNode(node);
 }
 
 void InspectorConsoleAgent::addConsoleMessage(PassOwnPtr<ConsoleMessage> consoleMessage)
@@ -235,7 +241,7 @@ void InspectorConsoleAgent::addConsoleMessage(PassOwnPtr<ConsoleMessage> console
     ASSERT(m_inspectorAgent->enabled());
     ASSERT_ARG(consoleMessage, consoleMessage);
 
-    if (m_previousMessage && m_previousMessage->isEqual(consoleMessage.get())) {
+    if (m_previousMessage && m_previousMessage->type() != EndGroupMessageType && m_previousMessage->isEqual(consoleMessage.get())) {
         m_previousMessage->incrementCount();
         if (m_inspectorState->getBoolean(ConsoleAgentState::consoleMessagesEnabled) && m_frontend)
             m_previousMessage->updateRepeatCountInConsole(m_frontend);
@@ -243,7 +249,7 @@ void InspectorConsoleAgent::addConsoleMessage(PassOwnPtr<ConsoleMessage> console
         m_previousMessage = consoleMessage.get();
         m_consoleMessages.append(consoleMessage);
         if (m_inspectorState->getBoolean(ConsoleAgentState::consoleMessagesEnabled) && m_frontend)
-            m_previousMessage->addToFrontend(m_frontend, m_injectedScriptHost);
+            m_previousMessage->addToFrontend(m_frontend, m_injectedScriptManager);
     }
 
     if (!m_frontend && m_consoleMessages.size() >= maximumConsoleMessages) {
diff --git a/Source/WebCore/inspector/InspectorConsoleAgent.h b/Source/WebCore/inspector/InspectorConsoleAgent.h
index 8d3a570..2b753b5 100644
--- a/Source/WebCore/inspector/InspectorConsoleAgent.h
+++ b/Source/WebCore/inspector/InspectorConsoleAgent.h
@@ -42,7 +42,7 @@ class InspectorAgent;
 class InspectorDOMAgent;
 class InspectorFrontend;
 class InspectorState;
-class InjectedScriptHost;
+class InjectedScriptManager;
 class InstrumentingAgents;
 class ResourceError;
 class ResourceResponse;
@@ -55,10 +55,11 @@ typedef String ErrorString;
 class InspectorConsoleAgent {
     WTF_MAKE_NONCOPYABLE(InspectorConsoleAgent);
 public:
-    InspectorConsoleAgent(InstrumentingAgents*, InspectorAgent*, InspectorState*, InjectedScriptHost*, InspectorDOMAgent*);
+    InspectorConsoleAgent(InstrumentingAgents*, InspectorAgent*, InspectorState*, InjectedScriptManager*, InspectorDOMAgent*);
     ~InspectorConsoleAgent();
 
-    void setConsoleMessagesEnabled(ErrorString* error, bool enabled, bool* newState);
+    void enable(ErrorString*, int* consoleMessageExpireCount);
+    void disable(ErrorString*);
     void clearConsoleMessages(ErrorString* error);
     void reset();
     void setFrontend(InspectorFrontend*);
@@ -79,20 +80,20 @@ public:
     void addStartProfilingMessageToConsole(const String& title, unsigned lineNumber, const String& sourceURL);
 #endif
     void setMonitoringXHREnabled(ErrorString* error, bool enabled);
+    void addInspectedNode(ErrorString*, int nodeId);
 
 private:
-    void setConsoleMessagesEnabled(bool);
     void addConsoleMessage(PassOwnPtr<ConsoleMessage>);
 
     InstrumentingAgents* m_instrumentingAgents;
     InspectorAgent* m_inspectorAgent;
     InspectorState* m_inspectorState;
-    InjectedScriptHost* m_injectedScriptHost;
+    InjectedScriptManager* m_injectedScriptManager;
     InspectorDOMAgent* m_inspectorDOMAgent;
     InspectorFrontend::Console* m_frontend;
     ConsoleMessage* m_previousMessage;
     Vector<OwnPtr<ConsoleMessage> > m_consoleMessages;
-    unsigned m_expiredConsoleMessageCount;
+    int m_expiredConsoleMessageCount;
     HashMap<String, unsigned> m_counts;
     HashMap<String, double> m_times;
 };
diff --git a/Source/WebCore/inspector/InspectorController.cpp b/Source/WebCore/inspector/InspectorController.cpp
index 2f1bea2..62b22ee 100644
--- a/Source/WebCore/inspector/InspectorController.cpp
+++ b/Source/WebCore/inspector/InspectorController.cpp
@@ -36,14 +36,17 @@
 #include "Frame.h"
 #include "GraphicsContext.h"
 #include "InjectedScriptHost.h"
+#include "InjectedScriptManager.h"
 #include "InspectorAgent.h"
 #include "InspectorBackendDispatcher.h"
 #include "InspectorBrowserDebuggerAgent.h"
 #include "InspectorDebuggerAgent.h"
 #include "InspectorClient.h"
+#include "InspectorDOMAgent.h"
 #include "InspectorFrontend.h"
 #include "InspectorFrontendClient.h"
 #include "InspectorInstrumentation.h"
+#include "InspectorProfilerAgent.h"
 #include "InspectorTimelineAgent.h"
 #include "Page.h"
 #include "ScriptObject.h"
@@ -52,10 +55,11 @@
 namespace WebCore {
 
 InspectorController::InspectorController(Page* page, InspectorClient* inspectorClient)
-    : m_inspectorAgent(new InspectorAgent(page, inspectorClient))
-    , m_inspectorBackendDispatcher(new InspectorBackendDispatcher(m_inspectorAgent.get()))
+    : m_injectedScriptManager(InjectedScriptManager::create())
+    , m_inspectorAgent(new InspectorAgent(page, inspectorClient, m_injectedScriptManager.get()))
     , m_inspectorClient(inspectorClient)
     , m_openingFrontend(false)
+    , m_startUserInitiatedDebuggingWhenFrontedIsConnected(false)
 {
 }
 
@@ -100,19 +104,57 @@ void InspectorController::connectFrontend()
 {
     m_openingFrontend = false;
     m_inspectorFrontend = new InspectorFrontend(m_inspectorClient);
+    m_injectedScriptManager->injectedScriptHost()->setFrontend(m_inspectorFrontend.get());
     m_inspectorAgent->setFrontend(m_inspectorFrontend.get());
 
     if (!InspectorInstrumentation::hasFrontends())
         ScriptController::setCaptureCallStackForUncaughtExceptions(true);
     InspectorInstrumentation::frontendCreated();
+
+    ASSERT(m_inspectorClient);
+    m_inspectorBackendDispatcher = new InspectorBackendDispatcher(
+        m_inspectorClient,
+#if ENABLE(OFFLINE_WEB_APPLICATIONS)
+        m_inspectorAgent->applicationCacheAgent(),
+#endif
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+        m_inspectorAgent->browserDebuggerAgent(),
+#endif
+        m_inspectorAgent->cssAgent(),
+        m_inspectorAgent->consoleAgent(),
+        m_inspectorAgent->domAgent(),
+#if ENABLE(DOM_STORAGE)
+        m_inspectorAgent->domStorageAgent(),
+#endif
+#if ENABLE(DATABASE)
+        m_inspectorAgent->databaseAgent(),
+#endif
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+        m_inspectorAgent->debuggerAgent(),
+#endif
+        m_inspectorAgent.get(),
+        m_inspectorAgent->resourceAgent(),
+        m_inspectorAgent->pageAgent(),
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+        m_inspectorAgent->profilerAgent(),
+#endif
+        m_inspectorAgent->runtimeAgent(),
+        m_inspectorAgent->timelineAgent());
+
+    if (m_startUserInitiatedDebuggingWhenFrontedIsConnected) {
+        m_inspectorFrontend->inspector()->startUserInitiatedDebugging();
+        m_startUserInitiatedDebuggingWhenFrontedIsConnected = false;
+    }
 }
 
 void InspectorController::disconnectFrontend()
 {
     if (!m_inspectorFrontend)
         return;
+    m_inspectorBackendDispatcher.clear();
 
     m_inspectorAgent->disconnectFrontend();
+    m_injectedScriptManager->injectedScriptHost()->clearFrontend();
 
     m_inspectorFrontend.clear();
 
@@ -160,7 +202,7 @@ void InspectorController::evaluateForTestInFrontend(long callId, const String& s
 
 void InspectorController::drawNodeHighlight(GraphicsContext& context) const
 {
-    m_inspectorAgent->drawNodeHighlight(context);
+    m_inspectorAgent->domAgent()->drawNodeHighlight(context);
 }
 
 void InspectorController::showConsole()
@@ -178,7 +220,7 @@ void InspectorController::inspect(Node* node)
 
     show();
 
-    m_inspectorAgent->inspect(node);
+    m_inspectorAgent->domAgent()->inspect(node);
 }
 
 bool InspectorController::enabled() const
@@ -203,31 +245,32 @@ void InspectorController::setInspectorExtensionAPI(const String& source)
 
 void InspectorController::dispatchMessageFromFrontend(const String& message)
 {
-    m_inspectorBackendDispatcher->dispatch(message);
+    if (m_inspectorBackendDispatcher)
+        m_inspectorBackendDispatcher->dispatch(message);
 }
 
 void InspectorController::hideHighlight()
 {
     ErrorString error;
-    m_inspectorAgent->hideHighlight(&error);
+    m_inspectorAgent->domAgent()->hideHighlight(&error);
 }
 
 #if ENABLE(JAVASCRIPT_DEBUGGER)
 void InspectorController::enableProfiler()
 {
     ErrorString error;
-    m_inspectorAgent->enableProfiler(&error);
+    m_inspectorAgent->profilerAgent()->enable(&error);
 }
 
 void InspectorController::disableProfiler()
 {
     ErrorString error;
-    m_inspectorAgent->disableProfiler(&error);
+    m_inspectorAgent->profilerAgent()->disable(&error);
 }
 
 bool InspectorController::profilerEnabled()
 {
-    return m_inspectorAgent->profilerEnabled();
+    return m_inspectorAgent->profilerAgent()->enabled();
 }
 
 bool InspectorController::debuggerEnabled()
@@ -240,8 +283,11 @@ void InspectorController::showAndEnableDebugger()
     if (!enabled())
         return;
     show();
-    m_inspectorAgent->showScriptsPanel();
-    m_inspectorAgent->debuggerAgent()->startUserInitiatedDebugging();
+
+    if (m_inspectorFrontend)
+        m_inspectorFrontend->inspector()->startUserInitiatedDebugging();
+    else
+        m_startUserInitiatedDebuggingWhenFrontedIsConnected = true;
 }
 
 void InspectorController::disableDebugger()
@@ -251,7 +297,7 @@ void InspectorController::disableDebugger()
 
 void InspectorController::startUserInitiatedProfiling()
 {
-    m_inspectorAgent->startUserInitiatedProfiling();
+    m_inspectorAgent->profilerAgent()->startUserInitiatedProfiling();
 }
 
 void InspectorController::stopUserInitiatedProfiling()
@@ -259,12 +305,13 @@ void InspectorController::stopUserInitiatedProfiling()
     if (!enabled())
         return;
     show();
-    m_inspectorAgent->stopUserInitiatedProfiling();
+    m_inspectorAgent->profilerAgent()->stopUserInitiatedProfiling();
+    m_inspectorAgent->showProfilesPanel();
 }
 
 bool InspectorController::isRecordingUserInitiatedProfile() const
 {
-    return m_inspectorAgent->isRecordingUserInitiatedProfile();
+    return m_inspectorAgent->profilerAgent()->isRecordingUserInitiatedProfile();
 }
 
 void InspectorController::resume()
diff --git a/Source/WebCore/inspector/InspectorController.h b/Source/WebCore/inspector/InspectorController.h
index 7db024c..f38eb3d 100644
--- a/Source/WebCore/inspector/InspectorController.h
+++ b/Source/WebCore/inspector/InspectorController.h
@@ -41,6 +41,7 @@ namespace WebCore {
 class DOMWrapperWorld;
 class Frame;
 class GraphicsContext;
+class InjectedScriptManager;
 class InspectorAgent;
 class InspectorBackendDispatcher;
 class InspectorClient;
@@ -102,12 +103,14 @@ public:
 private:
     friend class PostWorkerNotificationToFrontendTask;
 
+    OwnPtr<InjectedScriptManager> m_injectedScriptManager;
     OwnPtr<InspectorAgent> m_inspectorAgent;
     OwnPtr<InspectorBackendDispatcher> m_inspectorBackendDispatcher;
     OwnPtr<InspectorFrontendClient> m_inspectorFrontendClient;
     OwnPtr<InspectorFrontend> m_inspectorFrontend;
     InspectorClient* m_inspectorClient;
     bool m_openingFrontend;
+    bool m_startUserInitiatedDebuggingWhenFrontedIsConnected;
 };
 
 }
diff --git a/Source/WebCore/inspector/InspectorDOMAgent.cpp b/Source/WebCore/inspector/InspectorDOMAgent.cpp
index 3edd72c..06c5977 100644
--- a/Source/WebCore/inspector/InspectorDOMAgent.cpp
+++ b/Source/WebCore/inspector/InspectorDOMAgent.cpp
@@ -1,6 +1,6 @@
 /*
  * Copyright (C) 2009 Apple Inc. All rights reserved.
- * Copyright (C) 2009 Google Inc. All rights reserved.
+ * Copyright (C) 2009-2011 Google Inc. All rights reserved.
  * Copyright (C) 2009 Joseph Pecoraro
  *
  * Redistribution and use in source and binary forms, with or without
@@ -47,6 +47,7 @@
 #include "ContainerNode.h"
 #include "Cookie.h"
 #include "CookieJar.h"
+#include "DOMNodeHighlighter.h"
 #include "DOMWindow.h"
 #include "Document.h"
 #include "DocumentType.h"
@@ -57,15 +58,19 @@
 #include "EventTarget.h"
 #include "Frame.h"
 #include "FrameTree.h"
+#include "HitTestResult.h"
 #include "HTMLElement.h"
 #include "HTMLFrameOwnerElement.h"
-#include "InjectedScriptHost.h"
+#include "InjectedScriptManager.h"
+#include "InspectorClient.h"
 #include "InspectorFrontend.h"
+#include "InspectorResourceAgent.h"
 #include "InspectorState.h"
 #include "InstrumentingAgents.h"
 #include "MutationEvent.h"
 #include "Node.h"
 #include "NodeList.h"
+#include "Page.h"
 #include "Pasteboard.h"
 #include "PlatformString.h"
 #include "RenderStyle.h"
@@ -206,8 +211,12 @@ public:
         unsigned long size = result->snapshotLength(ec);
         for (unsigned long i = 0; !ec && i < size; ++i) {
             Node* node = result->snapshotItem(i, ec);
-            if (!ec)
-                resultCollector.add(node);
+            if (ec)
+                break;
+
+            if (node->nodeType() == Node::ATTRIBUTE_NODE)
+                node = static_cast<Attr*>(node)->ownerElement();
+            resultCollector.add(node);
         }
 #else
         UNUSED_PARAM(resultCollector);
@@ -248,20 +257,25 @@ void RevalidateStyleAttributeTask::onTimer(Timer<RevalidateStyleAttributeTask>*)
     m_elements.clear();
 }
 
-InspectorDOMAgent::InspectorDOMAgent(InstrumentingAgents* instrumentingAgents, InspectorState* inspectorState, InjectedScriptHost* injectedScriptHost)
+InspectorDOMAgent::InspectorDOMAgent(InstrumentingAgents* instrumentingAgents, Page* inspectedPage, InspectorClient* client, InspectorState* inspectorState, InjectedScriptManager* injectedScriptManager)
     : m_instrumentingAgents(instrumentingAgents)
+    , m_inspectedPage(inspectedPage)
+    , m_client(client)
     , m_inspectorState(inspectorState)
-    , m_injectedScriptHost(injectedScriptHost)
+    , m_injectedScriptManager(injectedScriptManager)
     , m_frontend(0)
     , m_domListener(0)
     , m_lastNodeId(1)
     , m_matchJobsTimer(this, &InspectorDOMAgent::onMatchJobsTimer)
+    , m_searchingForNode(false)
 {
 }
 
 InspectorDOMAgent::~InspectorDOMAgent()
 {
     reset();
+    ASSERT(!m_highlightedNode);
+    ASSERT(!m_searchingForNode);
 }
 
 void InspectorDOMAgent::setFrontend(InspectorFrontend* frontend)
@@ -269,17 +283,33 @@ void InspectorDOMAgent::setFrontend(InspectorFrontend* frontend)
     ASSERT(!m_frontend);
     m_frontend = frontend->dom();
     m_instrumentingAgents->setInspectorDOMAgent(this);
+    m_document = m_inspectedPage->mainFrame()->document();
+
+    if (m_nodeToFocus)
+        focusNode();
 }
 
 void InspectorDOMAgent::clearFrontend()
 {
     ASSERT(m_frontend);
+    setSearchingForNode(false);
+
+    ErrorString error;
+    hideHighlight(&error);
+
     m_frontend = 0;
     m_instrumentingAgents->setInspectorDOMAgent(0);
     m_inspectorState->setBoolean(DOMAgentState::documentRequested, false);
     reset();
 }
 
+void InspectorDOMAgent::restore()
+{
+    // Reset document to avoid early return from setDocument.
+    m_document = 0;
+    setDocument(m_inspectedPage->mainFrame()->document());
+}
+
 Vector<Document*> InspectorDOMAgent::documents()
 {
     Vector<Document*> result;
@@ -295,7 +325,7 @@ Vector<Document*> InspectorDOMAgent::documents()
 void InspectorDOMAgent::reset()
 {
     ErrorString error;
-    searchCanceled(&error);
+    cancelSearch(&error);
     discardBindings();
     if (m_revalidateStyleAttrTask)
         m_revalidateStyleAttrTask->reset();
@@ -326,9 +356,9 @@ void InspectorDOMAgent::releaseDanglingNodes()
     m_danglingNodeToIdMaps.clear();
 }
 
-long InspectorDOMAgent::bind(Node* node, NodeToIdMap* nodesMap)
+int InspectorDOMAgent::bind(Node* node, NodeToIdMap* nodesMap)
 {
-    long id = nodesMap->get(node);
+    int id = nodesMap->get(node);
     if (id)
         return id;
     id = m_lastNodeId++;
@@ -346,7 +376,7 @@ void InspectorDOMAgent::unbind(Node* node, NodeToIdMap* nodesMap)
             m_domListener->didRemoveDocument(frameOwner->contentDocument());
     }
 
-    long id = nodesMap->get(node);
+    int id = nodesMap->get(node);
     if (!id)
         return;
     m_idToNode.remove(id);
@@ -363,13 +393,53 @@ void InspectorDOMAgent::unbind(Node* node, NodeToIdMap* nodesMap)
     }
 }
 
-Node* InspectorDOMAgent::nodeToSelectOn(long nodeId, bool documentWide)
+Node* InspectorDOMAgent::assertNode(ErrorString* errorString, int nodeId)
+{
+    Node* node = nodeForId(nodeId);
+    if (!node) {
+        *errorString = "Could not find node with given id.";
+        return 0;
+    }
+    return node;
+}
+
+Element* InspectorDOMAgent::assertElement(ErrorString* errorString, int nodeId)
+{
+    Node* node = assertNode(errorString, nodeId);
+    if (!node)
+        return 0;
+
+    if (node->nodeType() != Node::ELEMENT_NODE) {
+        *errorString = "Node is not an Element.";
+        return 0;
+    }
+    return toElement(node);
+}
+
+
+HTMLElement* InspectorDOMAgent::assertHTMLElement(ErrorString* errorString, int nodeId)
+{
+    Element* element = assertElement(errorString, nodeId);
+    if (!element)
+        return 0;
+
+    if (!element->isHTMLElement()) {
+        *errorString = "Node is not an HTML Element.";
+        return 0;
+    }
+    return toHTMLElement(element);
+}
+
+Node* InspectorDOMAgent::nodeToSelectOn(ErrorString* errorString, int nodeId, bool documentWide)
 {
     Node* node;
-    if (!nodeId)
+    if (!nodeId) {
         node = m_document.get();
-    else
-        node = nodeForId(nodeId);
+        if (!node)
+            *errorString = "No document to query on.";
+    } else
+        node = assertNode(errorString, nodeId);
+
     if (!node)
         return 0;
 
@@ -394,7 +464,7 @@ void InspectorDOMAgent::getDocument(ErrorString*, RefPtr<InspectorObject>* root)
         *root = buildObjectForNode(m_document.get(), 2, &m_documentNodeToIdMap);
 }
 
-void InspectorDOMAgent::pushChildNodesToFrontend(long nodeId)
+void InspectorDOMAgent::pushChildNodesToFrontend(int nodeId)
 {
     Node* node = nodeForId(nodeId);
     if (!node || (node->nodeType() != Node::ELEMENT_NODE && node->nodeType() != Node::DOCUMENT_NODE && node->nodeType() != Node::DOCUMENT_FRAGMENT_NODE))
@@ -414,57 +484,60 @@ void InspectorDOMAgent::discardBindings()
     m_idToNode.clear();
     releaseDanglingNodes();
     m_childrenRequested.clear();
-    m_injectedScriptHost->clearInspectedNodes();
 }
 
-Node* InspectorDOMAgent::nodeForId(long id)
+Node* InspectorDOMAgent::nodeForId(int id)
 {
     if (!id)
         return 0;
 
-    HashMap<long, Node*>::iterator it = m_idToNode.find(id);
+    HashMap<int, Node*>::iterator it = m_idToNode.find(id);
     if (it != m_idToNode.end())
         return it->second;
     return 0;
 }
 
-void InspectorDOMAgent::getChildNodes(ErrorString*, long nodeId)
+void InspectorDOMAgent::getChildNodes(ErrorString*, int nodeId)
 {
     pushChildNodesToFrontend(nodeId);
 }
 
-void InspectorDOMAgent::querySelector(ErrorString*, long nodeId, const String& selectors, bool documentWide, long* elementId)
+void InspectorDOMAgent::querySelector(ErrorString* errorString, int nodeId, const String& selectors, bool documentWide, int* elementId)
 {
     *elementId = 0;
-    Node* node = nodeToSelectOn(nodeId, documentWide);
+    Node* node = nodeToSelectOn(errorString, nodeId, documentWide);
     if (!node)
         return;
 
     ExceptionCode ec = 0;
     RefPtr<Element> element = node->querySelector(selectors, ec);
-    if (ec)
+    if (ec) {
+        *errorString = "DOM Error while querying.";
         return;
+    }
 
     if (element)
         *elementId = pushNodePathToFrontend(element.get());
 }
 
-void InspectorDOMAgent::querySelectorAll(ErrorString*, long nodeId, const String& selectors, bool documentWide, RefPtr<InspectorArray>* result)
+void InspectorDOMAgent::querySelectorAll(ErrorString* errorString, int nodeId, const String& selectors, bool documentWide, RefPtr<InspectorArray>* result)
 {
-    Node* node = nodeToSelectOn(nodeId, documentWide);
+    Node* node = nodeToSelectOn(errorString, nodeId, documentWide);
     if (!node)
         return;
 
     ExceptionCode ec = 0;
     RefPtr<NodeList> nodes = node->querySelectorAll(selectors, ec);
-    if (ec)
+    if (ec) {
+        *errorString = "DOM Error while querying.";
         return;
+    }
 
     for (unsigned i = 0; i < nodes->length(); ++i)
         (*result)->pushNumber(pushNodePathToFrontend(nodes->item(i)));
 }
 
-long InspectorDOMAgent::pushNodePathToFrontend(Node* nodeToPush)
+int InspectorDOMAgent::pushNodePathToFrontend(Node* nodeToPush)
 {
     ASSERT(nodeToPush);  // Invalid input
 
@@ -474,7 +547,7 @@ long InspectorDOMAgent::pushNodePathToFrontend(Node* nodeToPush)
         return 0;
 
     // Return id in case the node is known.
-    long result = m_documentNodeToIdMap.get(nodeToPush);
+    int result = m_documentNodeToIdMap.get(nodeToPush);
     if (result)
         return result;
 
@@ -503,60 +576,62 @@ long InspectorDOMAgent::pushNodePathToFrontend(Node* nodeToPush)
 
     NodeToIdMap* map = danglingMap ? danglingMap : &m_documentNodeToIdMap;
     for (int i = path.size() - 1; i >= 0; --i) {
-        long nodeId = map->get(path.at(i));
+        int nodeId = map->get(path.at(i));
         ASSERT(nodeId);
         pushChildNodesToFrontend(nodeId);
     }
     return map->get(nodeToPush);
 }
 
-long InspectorDOMAgent::boundNodeId(Node* node)
+int InspectorDOMAgent::boundNodeId(Node* node)
 {
     return m_documentNodeToIdMap.get(node);
 }
 
-void InspectorDOMAgent::setAttribute(ErrorString*, long elementId, const String& name, const String& value, bool* success)
+void InspectorDOMAgent::setAttribute(ErrorString* errorString, int elementId, const String& name, const String& value)
 {
-    Node* node = nodeForId(elementId);
-    if (node && (node->nodeType() == Node::ELEMENT_NODE)) {
-        Element* element = static_cast<Element*>(node);
+    Element* element = assertElement(errorString, elementId);
+    if (element) {
         ExceptionCode ec = 0;
         element->setAttribute(name, value, ec);
-        *success = !ec;
+        if (ec)
+            *errorString = "Exception while setting attribute value.";
     }
 }
 
-void InspectorDOMAgent::removeAttribute(ErrorString*, long elementId, const String& name, bool* success)
+void InspectorDOMAgent::removeAttribute(ErrorString* errorString, int elementId, const String& name)
 {
-    Node* node = nodeForId(elementId);
-    if (node && (node->nodeType() == Node::ELEMENT_NODE)) {
-        Element* element = static_cast<Element*>(node);
+    Element* element = assertElement(errorString, elementId);
+    if (element) {
         ExceptionCode ec = 0;
         element->removeAttribute(name, ec);
-        *success = !ec;
+        if (ec)
+            *errorString = "Exception while removing attribute.";
     }
 }
 
-void InspectorDOMAgent::removeNode(ErrorString*, long nodeId, long* outNodeId)
+void InspectorDOMAgent::removeNode(ErrorString* errorString, int nodeId)
 {
-    Node* node = nodeForId(nodeId);
+    Node* node = assertNode(errorString, nodeId);
     if (!node)
         return;
 
     ContainerNode* parentNode = node->parentNode();
-    if (!parentNode)
+    if (!parentNode) {
+        *errorString = "Can not remove detached node.";
         return;
+    }
 
     ExceptionCode ec = 0;
     parentNode->removeChild(node, ec);
     if (ec)
-        return;
-
-    *outNodeId = nodeId;
+        *errorString = "Could not remove node due to DOM exception.";
 }
 
-void InspectorDOMAgent::changeTagName(ErrorString*, long nodeId, const String& tagName, long* newId)
+void InspectorDOMAgent::setNodeName(ErrorString*, int nodeId, const String& tagName, int* newId)
 {
+    *newId = 0;
+
     Node* oldNode = nodeForId(nodeId);
     if (!oldNode || !oldNode->isElementNode())
         return;
@@ -590,28 +665,25 @@ void InspectorDOMAgent::changeTagName(ErrorString*, long nodeId, const String& t
         pushChildNodesToFrontend(*newId);
 }
 
-void InspectorDOMAgent::getOuterHTML(ErrorString*, long nodeId, WTF::String* outerHTML)
+void InspectorDOMAgent::getOuterHTML(ErrorString* errorString, int nodeId, WTF::String* outerHTML)
 {
-    Node* node = nodeForId(nodeId);
-    if (!node || !node->isHTMLElement())
-        return;
-
-    *outerHTML = toHTMLElement(node)->outerHTML();
+    HTMLElement* element = assertHTMLElement(errorString, nodeId);
+    if (element)
+        *outerHTML = element->outerHTML();
 }
 
-void InspectorDOMAgent::setOuterHTML(ErrorString*, long nodeId, const String& outerHTML, long* newId)
+void InspectorDOMAgent::setOuterHTML(ErrorString* errorString, int nodeId, const String& outerHTML, int* newId)
 {
-    Node* node = nodeForId(nodeId);
-    if (!node || !node->isHTMLElement())
+    HTMLElement* htmlElement = assertHTMLElement(errorString, nodeId);
+    if (!htmlElement)
         return;
 
-    bool requiresTotalUpdate = node->nodeName() == "HTML" || node->nodeName() == "BODY" || node->nodeName() == "HEAD";
+    bool requiresTotalUpdate = htmlElement->tagName() == "HTML" || htmlElement->tagName() == "BODY" || htmlElement->tagName() == "HEAD";
 
     bool childrenRequested = m_childrenRequested.contains(nodeId);
-    Node* previousSibling = node->previousSibling();
-    ContainerNode* parentNode = node->parentNode();
+    Node* previousSibling = htmlElement->previousSibling();
+    ContainerNode* parentNode = htmlElement->parentNode();
 
-    HTMLElement* htmlElement = toHTMLElement(node);
     ExceptionCode ec = 0;
     htmlElement->setOuterHTML(outerHTML, ec);
     if (ec)
@@ -637,21 +709,27 @@ void InspectorDOMAgent::setOuterHTML(ErrorString*, long nodeId, const String& ou
         pushChildNodesToFrontend(*newId);
 }
 
-void InspectorDOMAgent::setTextNodeValue(ErrorString*, long nodeId, const String& value, bool* success)
+void InspectorDOMAgent::setNodeValue(ErrorString* errorString, int nodeId, const String& value)
 {
-    Node* node = nodeForId(nodeId);
-    if (node && (node->nodeType() == Node::TEXT_NODE)) {
-        Text* text_node = static_cast<Text*>(node);
-        ExceptionCode ec = 0;
-        text_node->replaceWholeText(value, ec);
-        *success = !ec;
+    Node* node = assertNode(errorString, nodeId);
+    if (!node)
+        return;
+
+    if (node->nodeType() != Node::TEXT_NODE) {
+        *errorString = "Can only set value of text nodes.";
+        return;
     }
+
+    Text* textNode = static_cast<Text*>(node);
+    ExceptionCode ec = 0;
+    textNode->replaceWholeText(value, ec);
+    if (ec)
+        *errorString = "DOM Error while setting the node value.";
 }
 
-void InspectorDOMAgent::getEventListenersForNode(ErrorString*, long nodeId, long* outNodeId, RefPtr<InspectorArray>* listenersArray)
+void InspectorDOMAgent::getEventListenersForNode(ErrorString*, int nodeId, RefPtr<InspectorArray>* listenersArray)
 {
     Node* node = nodeForId(nodeId);
-    *outNodeId = nodeId;
     EventTargetData* d;
 
     // Quick break if a null node or no listeners at all
@@ -670,18 +748,19 @@ void InspectorDOMAgent::getEventListenersForNode(ErrorString*, long nodeId, long
     if (!eventTypesLength)
         return;
 
-    // The Node's Event Ancestors (not including self)
-    Vector<EventContext> ancestors;
-    node->getEventAncestors(ancestors, node);
+    // The Node's Ancestors (not including self)
+    Vector<ContainerNode*> ancestors;
+    for (ContainerNode* ancestor = node->parentOrHostNode(); ancestor; ancestor = ancestor->parentOrHostNode())
+        ancestors.append(ancestor);
 
     // Nodes and their Listeners for the concerned event types (order is top to bottom)
     Vector<EventListenerInfo> eventInformation;
     for (size_t i = ancestors.size(); i; --i) {
-        Node* ancestor = ancestors[i - 1].node();
+        ContainerNode* ancestor = ancestors[i - 1];
         for (size_t j = 0; j < eventTypesLength; ++j) {
             AtomicString& type = eventTypes[j];
             if (ancestor->hasEventListeners(type))
-                eventInformation.append(EventListenerInfo(static_cast<Node*>(ancestor), type, ancestor->getEventListeners(type)));
+                eventInformation.append(EventListenerInfo(ancestor, type, ancestor->getEventListeners(type)));
         }
     }
 
@@ -715,14 +794,6 @@ void InspectorDOMAgent::getEventListenersForNode(ErrorString*, long nodeId, long
     }
 }
 
-void InspectorDOMAgent::addInspectedNode(ErrorString*, long nodeId)
-{
-    Node* node = nodeForId(nodeId);
-    if (!node)
-        return;
-    m_injectedScriptHost->addInspectedNode(node);
-}
-
 void InspectorDOMAgent::performSearch(ErrorString* error, const String& whitespaceTrimmedQuery, bool runSynchronously)
 {
     // FIXME: Few things are missing here:
@@ -750,7 +821,7 @@ void InspectorDOMAgent::performSearch(ErrorString* error, const String& whitespa
     escapedTagNameQuery.replace("'", "\\'");
 
     // Clear pending jobs.
-    searchCanceled(error);
+    cancelSearch(error);
 
     // Find all frames, iframes and object elements to search their documents.
     Vector<Document*> docs = documents();
@@ -804,13 +875,13 @@ void InspectorDOMAgent::performSearch(ErrorString* error, const String& whitespa
         for (Deque<MatchJob*>::iterator it = m_pendingMatchJobs.begin(); it != m_pendingMatchJobs.end(); ++it)
             (*it)->match(resultCollector);
         reportNodesAsSearchResults(resultCollector);
-        searchCanceled(error);
+        cancelSearch(error);
         return;
     }
     m_matchJobsTimer.startOneShot(0);
 }
 
-void InspectorDOMAgent::searchCanceled(ErrorString*)
+void InspectorDOMAgent::cancelSearch(ErrorString*)
 {
     if (m_matchJobsTimer.isActive())
         m_matchJobsTimer.stop();
@@ -819,19 +890,122 @@ void InspectorDOMAgent::searchCanceled(ErrorString*)
     m_searchResults.clear();
 }
 
-void InspectorDOMAgent::resolveNode(ErrorString* error, long nodeId, const String& objectGroup, RefPtr<InspectorValue>* result)
+bool InspectorDOMAgent::handleMousePress()
+{
+    if (!m_searchingForNode)
+        return false;
+
+    if (m_highlightedNode) {
+        RefPtr<Node> node = m_highlightedNode;
+        setSearchingForNode(false);
+        inspect(node.get());
+    }
+    return true;
+}
+
+void InspectorDOMAgent::inspect(Node* node)
+{
+    if (node->nodeType() != Node::ELEMENT_NODE && node->nodeType() != Node::DOCUMENT_NODE)
+        node = node->parentNode();
+    m_nodeToFocus = node;
+
+    focusNode();
+}
+
+void InspectorDOMAgent::focusNode()
+{
+    if (!m_frontend)
+        return;
+
+    ASSERT(m_nodeToFocus);
+
+    RefPtr<Node> node = m_nodeToFocus.get();
+    m_nodeToFocus = 0;
+
+    Document* document = node->ownerDocument();
+    if (!document)
+        return;
+    Frame* frame = document->frame();
+    if (!frame)
+        return;
+
+    InjectedScript injectedScript = m_injectedScriptManager->injectedScriptFor(mainWorldScriptState(frame));
+    if (injectedScript.hasNoValue())
+        return;
+
+    injectedScript.inspectNode(node.get());
+}
+
+void InspectorDOMAgent::mouseDidMoveOverElement(const HitTestResult& result, unsigned)
+{
+    if (!m_searchingForNode)
+        return;
+
+    Node* node = result.innerNode();
+    while (node && node->nodeType() == Node::TEXT_NODE)
+        node = node->parentNode();
+    if (node) {
+        ErrorString error;
+        highlight(&error, node);
+    }
+}
+
+void InspectorDOMAgent::setSearchingForNode(bool enabled)
+{
+    if (m_searchingForNode == enabled)
+        return;
+    m_searchingForNode = enabled;
+    if (!enabled) {
+        ErrorString error;
+        hideHighlight(&error);
+    }
+}
+
+void InspectorDOMAgent::setSearchingForNode(ErrorString*, bool enabled, bool* newState)
+{
+    *newState = enabled;
+    setSearchingForNode(enabled);
+}
+
+void InspectorDOMAgent::highlight(ErrorString*, Node* node)
+{
+    ASSERT_ARG(node, node);
+    m_highlightedNode = node;
+    m_client->highlight(node);
+}
+
+void InspectorDOMAgent::highlightDOMNode(ErrorString* error, int nodeId)
+{
+    if (Node* node = nodeForId(nodeId))
+        highlight(error, node);
+}
+
+void InspectorDOMAgent::highlightFrame(ErrorString* error, const String& frameId)
+{
+    Frame* frame = m_instrumentingAgents->inspectorResourceAgent()->frameForId(frameId);
+    if (frame && frame->ownerElement())
+        highlight(error, frame->ownerElement());
+}
+
+void InspectorDOMAgent::hideHighlight(ErrorString*)
+{
+    m_highlightedNode = 0;
+    m_client->hideHighlight();
+}
+
+void InspectorDOMAgent::resolveNode(ErrorString* error, int nodeId, RefPtr<InspectorObject>* result)
 {
     Node* node = nodeForId(nodeId);
     if (!node) {
         *error = "No node with given id found.";
         return;
     }
-    *result = resolveNode(node, objectGroup);
+    *result = resolveNode(node);
 }
 
-void InspectorDOMAgent::pushNodeToFrontend(ErrorString*, PassRefPtr<InspectorObject> objectId, long* nodeId)
+void InspectorDOMAgent::pushNodeToFrontend(ErrorString*, const String& objectId, int* nodeId)
 {
-    InjectedScript injectedScript = m_injectedScriptHost->injectedScriptForObjectId(objectId.get());
+    InjectedScript injectedScript = m_injectedScriptManager->injectedScriptForObjectId(objectId);
     Node* node = injectedScript.nodeForObjectId(objectId);
     if (node)
         *nodeId = pushNodePathToFrontend(node);
@@ -850,7 +1024,7 @@ PassRefPtr<InspectorObject> InspectorDOMAgent::buildObjectForNode(Node* node, in
 {
     RefPtr<InspectorObject> value = InspectorObject::create();
 
-    long id = bind(node, nodesMap);
+    int id = bind(node, nodesMap);
     String nodeName;
     String localName;
     String nodeValue;
@@ -1036,7 +1210,7 @@ void InspectorDOMAgent::loadEventFired(Document* document)
     if (!frameOwner)
         return;
 
-    long frameOwnerId = m_documentNodeToIdMap.get(frameOwner);
+    int frameOwnerId = m_documentNodeToIdMap.get(frameOwner);
     if (!frameOwnerId)
         return;
 
@@ -1045,11 +1219,11 @@ void InspectorDOMAgent::loadEventFired(Document* document)
         m_frontend->childNodeCountUpdated(frameOwnerId, innerChildNodeCount(frameOwner));
     } else {
         // Re-add frame owner element together with its new children.
-        long parentId = m_documentNodeToIdMap.get(innerParentNode(frameOwner));
+        int parentId = m_documentNodeToIdMap.get(innerParentNode(frameOwner));
         m_frontend->childNodeRemoved(parentId, frameOwnerId);
         RefPtr<InspectorObject> value = buildObjectForNode(frameOwner, 0, &m_documentNodeToIdMap);
         Node* previousSibling = innerPreviousSibling(frameOwner);
-        long prevId = previousSibling ? m_documentNodeToIdMap.get(previousSibling) : 0;
+        int prevId = previousSibling ? m_documentNodeToIdMap.get(previousSibling) : 0;
         m_frontend->childNodeInserted(parentId, prevId, value.release());
         // Invalidate children requested flag for the element.
         m_childrenRequested.remove(m_childrenRequested.find(frameOwnerId));
@@ -1065,7 +1239,7 @@ void InspectorDOMAgent::didInsertDOMNode(Node* node)
     unbind(node, &m_documentNodeToIdMap);
 
     ContainerNode* parent = node->parentNode();
-    long parentId = m_documentNodeToIdMap.get(parent);
+    int parentId = m_documentNodeToIdMap.get(parent);
     // Return if parent is not mapped yet.
     if (!parentId)
         return;
@@ -1076,7 +1250,7 @@ void InspectorDOMAgent::didInsertDOMNode(Node* node)
     } else {
         // Children have been requested -> return value of a new child.
         Node* prevSibling = innerPreviousSibling(node);
-        long prevId = prevSibling ? m_documentNodeToIdMap.get(prevSibling) : 0;
+        int prevId = prevSibling ? m_documentNodeToIdMap.get(prevSibling) : 0;
         RefPtr<InspectorObject> value = buildObjectForNode(node, 0, &m_documentNodeToIdMap);
         m_frontend->childNodeInserted(parentId, prevId, value.release());
     }
@@ -1088,7 +1262,7 @@ void InspectorDOMAgent::didRemoveDOMNode(Node* node)
         return;
 
     ContainerNode* parent = node->parentNode();
-    long parentId = m_documentNodeToIdMap.get(parent);
+    int parentId = m_documentNodeToIdMap.get(parent);
     // If parent is not mapped yet -> ignore the event.
     if (!parentId)
         return;
@@ -1107,7 +1281,7 @@ void InspectorDOMAgent::didRemoveDOMNode(Node* node)
 
 void InspectorDOMAgent::didModifyDOMAttr(Element* element)
 {
-    long id = m_documentNodeToIdMap.get(element);
+    int id = m_documentNodeToIdMap.get(element);
     // If node is not mapped yet -> ignore the event.
     if (!id)
         return;
@@ -1120,7 +1294,7 @@ void InspectorDOMAgent::didModifyDOMAttr(Element* element)
 
 void InspectorDOMAgent::characterDataModified(CharacterData* characterData)
 {
-    long id = m_documentNodeToIdMap.get(characterData);
+    int id = m_documentNodeToIdMap.get(characterData);
     if (!id)
         return;
     m_frontend->characterDataModified(id, characterData->data());
@@ -1128,7 +1302,7 @@ void InspectorDOMAgent::characterDataModified(CharacterData* characterData)
 
 void InspectorDOMAgent::didInvalidateStyleAttr(Node* node)
 {
-    long id = m_documentNodeToIdMap.get(node);
+    int id = m_documentNodeToIdMap.get(node);
     // If node is not mapped yet -> ignore the event.
     if (!id)
         return;
@@ -1181,7 +1355,7 @@ void InspectorDOMAgent::onMatchJobsTimer(Timer<InspectorDOMAgent>*)
 {
     if (!m_pendingMatchJobs.size()) {
         ErrorString error;
-        searchCanceled(&error);
+        cancelSearch(&error);
         return;
     }
 
@@ -1202,12 +1376,12 @@ void InspectorDOMAgent::reportNodesAsSearchResults(ListHashSet<Node*>& resultCol
         if (m_searchResults.contains(*it))
             continue;
         m_searchResults.add(*it);
-        nodeIds->pushNumber(static_cast<long long>(pushNodePathToFrontend(*it)));
+        nodeIds->pushNumber(pushNodePathToFrontend(*it));
     }
-    m_frontend->addNodesToSearchResult(nodeIds.release());
+    m_frontend->searchResults(nodeIds.release());
 }
 
-void InspectorDOMAgent::copyNode(ErrorString*, long nodeId)
+void InspectorDOMAgent::copyNode(ErrorString*, int nodeId)
 {
     Node* node = nodeForId(nodeId);
     if (!node)
@@ -1216,24 +1390,32 @@ void InspectorDOMAgent::copyNode(ErrorString*, long nodeId)
     Pasteboard::generalPasteboard()->writePlainText(markup);
 }
 
-void InspectorDOMAgent::pushNodeByPathToFrontend(ErrorString*, const String& path, long* nodeId)
+void InspectorDOMAgent::pushNodeByPathToFrontend(ErrorString*, const String& path, int* nodeId)
 {
     if (Node* node = nodeForPath(path))
         *nodeId = pushNodePathToFrontend(node);
 }
 
-PassRefPtr<InspectorObject> InspectorDOMAgent::resolveNode(Node* node, const String& objectGroup)
+PassRefPtr<InspectorObject> InspectorDOMAgent::resolveNode(Node* node)
 {
     Document* document = node->ownerDocument();
     Frame* frame = document ? document->frame() : 0;
     if (!frame)
         return 0;
 
-    InjectedScript injectedScript = m_injectedScriptHost->injectedScriptFor(mainWorldScriptState(frame));
+    InjectedScript injectedScript = m_injectedScriptManager->injectedScriptFor(mainWorldScriptState(frame));
     if (injectedScript.hasNoValue())
         return 0;
 
-    return injectedScript.wrapNode(node, objectGroup);
+    return injectedScript.wrapNode(node);
+}
+
+void InspectorDOMAgent::drawNodeHighlight(GraphicsContext& context) const
+{
+    if (!m_highlightedNode)
+        return;
+
+    DOMNodeHighlighter::DrawNodeHighlight(context, m_highlightedNode.get());
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/inspector/InspectorDOMAgent.h b/Source/WebCore/inspector/InspectorDOMAgent.h
index 0368880..8aeb66b 100644
--- a/Source/WebCore/inspector/InspectorDOMAgent.h
+++ b/Source/WebCore/inspector/InspectorDOMAgent.h
@@ -1,6 +1,6 @@
 /*
  * Copyright (C) 2009 Apple Inc. All rights reserved.
- * Copyright (C) 2009 Google Inc. All rights reserved.
+ * Copyright (C) 2009-2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -30,8 +30,9 @@
 #ifndef InspectorDOMAgent_h
 #define InspectorDOMAgent_h
 
+#include "EventTarget.h"
 #include "InjectedScript.h"
-#include "InjectedScriptHost.h"
+#include "InjectedScriptManager.h"
 #include "InspectorFrontend.h"
 #include "InspectorValues.h"
 #include "Timer.h"
@@ -52,9 +53,13 @@ class CharacterData;
 class Document;
 class Element;
 class Event;
+class GraphicsContext;
+class InspectorClient;
 class InspectorDOMAgent;
 class InspectorFrontend;
+class HitTestResult;
 class MatchJob;
+class HTMLElement;
 class InspectorState;
 class InstrumentingAgents;
 class NameNodeMap;
@@ -91,38 +96,44 @@ public:
         virtual void didModifyDOMAttr(Element*) = 0;
     };
 
-    static PassOwnPtr<InspectorDOMAgent> create(InstrumentingAgents* instrumentingAgents, InspectorState* inspectorState, InjectedScriptHost* injectedScriptHost)
+    static PassOwnPtr<InspectorDOMAgent> create(InstrumentingAgents* instrumentingAgents, Page* page, InspectorClient* client, InspectorState* inspectorState, InjectedScriptManager* injectedScriptManager)
     {
-        return adoptPtr(new InspectorDOMAgent(instrumentingAgents, inspectorState, injectedScriptHost));
+        return adoptPtr(new InspectorDOMAgent(instrumentingAgents, page, client, inspectorState, injectedScriptManager));
     }
 
     ~InspectorDOMAgent();
 
     void setFrontend(InspectorFrontend*);
     void clearFrontend();
+    void restore();
 
     Vector<Document*> documents();
     void reset();
 
     // Methods called from the frontend for DOM nodes inspection.
-    void querySelector(ErrorString*, long nodeId, const String& selectors, bool documentWide, long* elementId);
-    void querySelectorAll(ErrorString*, long nodeId, const String& selectors, bool documentWide, RefPtr<InspectorArray>* result);
+    void querySelector(ErrorString*, int nodeId, const String& selectors, bool documentWide, int* elementId);
+    void querySelectorAll(ErrorString*, int nodeId, const String& selectors, bool documentWide, RefPtr<InspectorArray>* result);
     void getDocument(ErrorString*, RefPtr<InspectorObject>* root);
-    void getChildNodes(ErrorString*, long nodeId);
-    void setAttribute(ErrorString*, long elementId, const String& name, const String& value, bool* success);
-    void removeAttribute(ErrorString*, long elementId, const String& name, bool* success);
-    void removeNode(ErrorString*, long nodeId, long* outNodeId);
-    void changeTagName(ErrorString*, long nodeId, const String& tagName, long* newId);
-    void getOuterHTML(ErrorString*, long nodeId, WTF::String* outerHTML);
-    void setOuterHTML(ErrorString*, long nodeId, const String& outerHTML, long* newId);
-    void setTextNodeValue(ErrorString*, long nodeId, const String& value, bool* success);
-    void getEventListenersForNode(ErrorString*, long nodeId, long* outNodeId, RefPtr<InspectorArray>* listenersArray);
-    void addInspectedNode(ErrorString*, long nodeId);
+    void getChildNodes(ErrorString*, int nodeId);
+    void setAttribute(ErrorString*, int elementId, const String& name, const String& value);
+    void removeAttribute(ErrorString*, int elementId, const String& name);
+    void removeNode(ErrorString*, int nodeId);
+    void setNodeName(ErrorString*, int nodeId, const String& name, int* newId);
+    void getOuterHTML(ErrorString*, int nodeId, WTF::String* outerHTML);
+    void setOuterHTML(ErrorString*, int nodeId, const String& outerHTML, int* newId);
+    void setNodeValue(ErrorString*, int nodeId, const String& value);
+    void getEventListenersForNode(ErrorString*, int nodeId, RefPtr<InspectorArray>* listenersArray);
     void performSearch(ErrorString*, const String& whitespaceTrimmedQuery, bool runSynchronously);
-    void searchCanceled(ErrorString*);
-    void resolveNode(ErrorString*, long nodeId, const String& objectGroup, RefPtr<InspectorValue>* result);
-    void pushNodeToFrontend(ErrorString*, PassRefPtr<InspectorObject> objectId, long* nodeId);
-    void pushNodeByPathToFrontend(ErrorString*, const String& path, long* nodeId);
+    void cancelSearch(ErrorString*);
+    void resolveNode(ErrorString*, int nodeId, RefPtr<InspectorObject>* result);
+    void setSearchingForNode(ErrorString*, bool enabled, bool* newState);
+    void pushNodeToFrontend(ErrorString*, const String& objectId, int* nodeId);
+    void pushNodeByPathToFrontend(ErrorString*, const String& path, int* nodeId);
+    void hideHighlight(ErrorString*);
+    void highlightDOMNode(ErrorString*, int nodeId);
+    void hideDOMNodeHighlight(ErrorString* error) { hideHighlight(error); }
+    void highlightFrame(ErrorString*, const String& frameId);
+    void hideFrameHighlight(ErrorString* error) { hideHighlight(error); }
 
     // Methods called from the InspectorInstrumentation.
     void setDocument(Document*);
@@ -137,14 +148,21 @@ public:
     void characterDataModified(CharacterData*);
     void didInvalidateStyleAttr(Node*);
 
-    Node* nodeForId(long nodeId);
-    long boundNodeId(Node*);
-    void copyNode(ErrorString*, long nodeId);
+    Node* nodeForId(int nodeId);
+    int boundNodeId(Node*);
+    void copyNode(ErrorString*, int nodeId);
     void setDOMListener(DOMListener*);
 
     String documentURLString(Document*) const;
 
-    PassRefPtr<InspectorObject> resolveNode(Node*, const String& objectGroup);
+    PassRefPtr<InspectorObject> resolveNode(Node*);
+    bool handleMousePress();
+    bool searchingForNodeInPage() const;
+    void mouseDidMoveOverElement(const HitTestResult&, unsigned modifierFlags);
+    void inspect(Node*);
+    void focusNode();
+
+    void drawNodeHighlight(GraphicsContext&) const;
 
     // We represent embedded doms as a part of the same hierarchy. Hence we treat children of frame owners differently.
     // We also skip whitespace text nodes conditionally. Following methods encapsulate these specifics.
@@ -156,21 +174,26 @@ public:
     static bool isWhitespace(Node*);
 
 private:
-    InspectorDOMAgent(InstrumentingAgents*, InspectorState*, InjectedScriptHost*);
+    InspectorDOMAgent(InstrumentingAgents*, Page*, InspectorClient*, InspectorState*, InjectedScriptManager*);
+
+    void setSearchingForNode(bool enabled);
+    void highlight(ErrorString*, Node*);
 
     // Node-related methods.
-    typedef HashMap<RefPtr<Node>, long> NodeToIdMap;
-    long bind(Node*, NodeToIdMap*);
+    typedef HashMap<RefPtr<Node>, int> NodeToIdMap;
+    int bind(Node*, NodeToIdMap*);
     void unbind(Node*, NodeToIdMap*);
+    Node* assertNode(ErrorString*, int nodeId);
+    Element* assertElement(ErrorString*, int nodeId);
+    HTMLElement* assertHTMLElement(ErrorString*, int nodeId);
+    Node* nodeToSelectOn(ErrorString*, int nodeId, bool documentWide);
 
-    Node* nodeToSelectOn(long nodeId, bool documentWide);
-
-    long pushNodePathToFrontend(Node*);
-    void pushChildNodesToFrontend(long nodeId);
+    int pushNodePathToFrontend(Node*);
+    void pushChildNodesToFrontend(int nodeId);
 
-    bool hasBreakpoint(Node*, long type);
+    bool hasBreakpoint(Node*, int type);
     void updateSubtreeBreakpoints(Node* root, uint32_t rootMask, bool value);
-    void descriptionForDOMEvent(Node* target, long breakpointType, bool insertion, PassRefPtr<InspectorObject> description);
+    void descriptionForDOMEvent(Node* target, int breakpointType, bool insertion, PassRefPtr<InspectorObject> description);
 
     PassRefPtr<InspectorObject> buildObjectForNode(Node*, int depth, NodeToIdMap*);
     PassRefPtr<InspectorArray> buildArrayForElementAttributes(Element*);
@@ -186,22 +209,27 @@ private:
     void discardBindings();
 
     InstrumentingAgents* m_instrumentingAgents;
+    Page* m_inspectedPage;
+    InspectorClient* m_client;
     InspectorState* m_inspectorState;
-    InjectedScriptHost* m_injectedScriptHost;
+    InjectedScriptManager* m_injectedScriptManager;
     InspectorFrontend::DOM* m_frontend;
     DOMListener* m_domListener;
     NodeToIdMap m_documentNodeToIdMap;
     // Owns node mappings for dangling nodes.
     Vector<NodeToIdMap*> m_danglingNodeToIdMaps;
-    HashMap<long, Node*> m_idToNode;
-    HashMap<long, NodeToIdMap*> m_idToNodesMap;
-    HashSet<long> m_childrenRequested;
-    long m_lastNodeId;
+    HashMap<int, Node*> m_idToNode;
+    HashMap<int, NodeToIdMap*> m_idToNodesMap;
+    HashSet<int> m_childrenRequested;
+    int m_lastNodeId;
     RefPtr<Document> m_document;
     Deque<MatchJob*> m_pendingMatchJobs;
     Timer<InspectorDOMAgent> m_matchJobsTimer;
     HashSet<RefPtr<Node> > m_searchResults;
     OwnPtr<RevalidateStyleAttributeTask> m_revalidateStyleAttrTask;
+    RefPtr<Node> m_highlightedNode;
+    RefPtr<Node> m_nodeToFocus;
+    bool m_searchingForNode;
 };
 
 #endif // ENABLE(INSPECTOR)
diff --git a/Source/WebCore/inspector/InspectorDOMStorageAgent.cpp b/Source/WebCore/inspector/InspectorDOMStorageAgent.cpp
index 6ea72f6..c44bbd8 100644
--- a/Source/WebCore/inspector/InspectorDOMStorageAgent.cpp
+++ b/Source/WebCore/inspector/InspectorDOMStorageAgent.cpp
@@ -79,7 +79,7 @@ void InspectorDOMStorageAgent::clearFrontend()
     m_frontend = 0;
 }
 
-void InspectorDOMStorageAgent::getDOMStorageEntries(ErrorString*, long storageId, RefPtr<InspectorArray>* entries)
+void InspectorDOMStorageAgent::getDOMStorageEntries(ErrorString*, int storageId, RefPtr<InspectorArray>* entries)
 {
     InspectorDOMStorageResource* storageResource = getDOMStorageResourceForId(storageId);
     if (storageResource) {
@@ -96,7 +96,7 @@ void InspectorDOMStorageAgent::getDOMStorageEntries(ErrorString*, long storageId
     }
 }
 
-void InspectorDOMStorageAgent::setDOMStorageItem(ErrorString*, long storageId, const String& key, const String& value, bool* success)
+void InspectorDOMStorageAgent::setDOMStorageItem(ErrorString*, int storageId, const String& key, const String& value, bool* success)
 {
     InspectorDOMStorageResource* storageResource = getDOMStorageResourceForId(storageId);
     if (storageResource) {
@@ -106,7 +106,7 @@ void InspectorDOMStorageAgent::setDOMStorageItem(ErrorString*, long storageId, c
     }
 }
 
-void InspectorDOMStorageAgent::removeDOMStorageItem(ErrorString*, long storageId, const String& key, bool* success)
+void InspectorDOMStorageAgent::removeDOMStorageItem(ErrorString*, int storageId, const String& key, bool* success)
 {
     InspectorDOMStorageResource* storageResource = getDOMStorageResourceForId(storageId);
     if (storageResource) {
@@ -115,7 +115,7 @@ void InspectorDOMStorageAgent::removeDOMStorageItem(ErrorString*, long storageId
     }
 }
 
-long InspectorDOMStorageAgent::storageId(Storage* storage)
+int InspectorDOMStorageAgent::storageId(Storage* storage)
 {
     ASSERT(storage);
     Frame* frame = storage->frame();
@@ -129,7 +129,7 @@ long InspectorDOMStorageAgent::storageId(Storage* storage)
     return 0;
 }
 
-InspectorDOMStorageResource* InspectorDOMStorageAgent::getDOMStorageResourceForId(long storageId)
+InspectorDOMStorageResource* InspectorDOMStorageAgent::getDOMStorageResourceForId(int storageId)
 {
     DOMStorageResourcesMap::iterator it = m_resources.find(storageId);
     if (it == m_resources.end())
diff --git a/Source/WebCore/inspector/InspectorDOMStorageAgent.h b/Source/WebCore/inspector/InspectorDOMStorageAgent.h
index adae9b2..567a713 100644
--- a/Source/WebCore/inspector/InspectorDOMStorageAgent.h
+++ b/Source/WebCore/inspector/InspectorDOMStorageAgent.h
@@ -59,12 +59,12 @@ public:
     void clearResources();
 
     // Called from the front-end.
-    void getDOMStorageEntries(ErrorString*, long storageId, RefPtr<InspectorArray>* entries);
-    void setDOMStorageItem(ErrorString*, long storageId, const String& key, const String& value, bool* success);
-    void removeDOMStorageItem(ErrorString*, long storageId, const String& key, bool* success);
+    void getDOMStorageEntries(ErrorString*, int storageId, RefPtr<InspectorArray>* entries);
+    void setDOMStorageItem(ErrorString*, int storageId, const String& key, const String& value, bool* success);
+    void removeDOMStorageItem(ErrorString*, int storageId, const String& key, bool* success);
 
     // Called from the injected script.
-    long storageId(Storage*);
+    int storageId(Storage*);
 
     // Called from InspectorInstrumentation
     void didUseDOMStorage(StorageArea*, bool isLocalStorage, Frame*);
@@ -72,10 +72,10 @@ public:
 private:
     explicit InspectorDOMStorageAgent(InstrumentingAgents*);
 
-    InspectorDOMStorageResource* getDOMStorageResourceForId(long storageId);
+    InspectorDOMStorageResource* getDOMStorageResourceForId(int storageId);
 
     InstrumentingAgents* m_instrumentingAgents;
-    typedef HashMap<long, RefPtr<InspectorDOMStorageResource> > DOMStorageResourcesMap;
+    typedef HashMap<int, RefPtr<InspectorDOMStorageResource> > DOMStorageResourcesMap;
     DOMStorageResourcesMap m_resources;
     InspectorFrontend* m_frontend;
 };
diff --git a/Source/WebCore/inspector/InspectorDOMStorageResource.cpp b/Source/WebCore/inspector/InspectorDOMStorageResource.cpp
index 6ff6418..d618eb5 100644
--- a/Source/WebCore/inspector/InspectorDOMStorageResource.cpp
+++ b/Source/WebCore/inspector/InspectorDOMStorageResource.cpp
@@ -46,7 +46,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-long InspectorDOMStorageResource::s_nextUnusedId = 1;
+int InspectorDOMStorageResource::s_nextUnusedId = 1;
 
 InspectorDOMStorageResource::InspectorDOMStorageResource(Storage* domStorage, bool isLocalStorage, Frame* frame)
     :  EventListener(InspectorDOMStorageResourceType)
diff --git a/Source/WebCore/inspector/InspectorDOMStorageResource.h b/Source/WebCore/inspector/InspectorDOMStorageResource.h
index 9ad5b91..eb75113 100644
--- a/Source/WebCore/inspector/InspectorDOMStorageResource.h
+++ b/Source/WebCore/inspector/InspectorDOMStorageResource.h
@@ -66,7 +66,7 @@ namespace WebCore {
         virtual bool operator==(const EventListener& listener);
 
         bool isSameHostAndType(Frame*, bool isLocalStorage) const;
-        long id() const { return m_id; }
+        int id() const { return m_id; }
         Storage* domStorage() const { return m_domStorage.get(); }
 
     private:
@@ -77,10 +77,10 @@ namespace WebCore {
         bool m_isLocalStorage;
         RefPtr<Frame> m_frame;
         InspectorFrontend::DOMStorage* m_frontend;
-        long m_id;
+        int m_id;
         bool m_reportingChangesToFrontend;
 
-        static long s_nextUnusedId;
+        static int s_nextUnusedId;
     };
 
 } // namespace WebCore
diff --git a/Source/WebCore/inspector/InspectorDatabaseAgent.cpp b/Source/WebCore/inspector/InspectorDatabaseAgent.cpp
index 45ec42a..7f6e379 100644
--- a/Source/WebCore/inspector/InspectorDatabaseAgent.cpp
+++ b/Source/WebCore/inspector/InspectorDatabaseAgent.cpp
@@ -70,9 +70,9 @@ private:
 
 namespace {
 
-long lastTransactionId = 0;
+int lastTransactionId = 0;
 
-void reportTransactionFailed(InspectorFrontend::Database* frontend, long transactionId, SQLError* error)
+void reportTransactionFailed(InspectorFrontend::Database* frontend, int transactionId, SQLError* error)
 {
     if (!frontend)
         return;
@@ -84,7 +84,7 @@ void reportTransactionFailed(InspectorFrontend::Database* frontend, long transac
 
 class StatementCallback : public SQLStatementCallback {
 public:
-    static PassRefPtr<StatementCallback> create(long transactionId, PassRefPtr<InspectorDatabaseAgent::FrontendProvider> frontendProvider)
+    static PassRefPtr<StatementCallback> create(int transactionId, PassRefPtr<InspectorDatabaseAgent::FrontendProvider> frontendProvider)
     {
         return adoptRef(new StatementCallback(transactionId, frontendProvider));
     }
@@ -118,16 +118,16 @@ public:
     }
 
 private:
-    StatementCallback(long transactionId, PassRefPtr<InspectorDatabaseAgent::FrontendProvider> frontendProvider)
+    StatementCallback(int transactionId, PassRefPtr<InspectorDatabaseAgent::FrontendProvider> frontendProvider)
         : m_transactionId(transactionId)
         , m_frontendProvider(frontendProvider) { }
-    long m_transactionId;
+    int m_transactionId;
     RefPtr<InspectorDatabaseAgent::FrontendProvider> m_frontendProvider;
 };
 
 class StatementErrorCallback : public SQLStatementErrorCallback {
 public:
-    static PassRefPtr<StatementErrorCallback> create(long transactionId, PassRefPtr<InspectorDatabaseAgent::FrontendProvider> frontendProvider)
+    static PassRefPtr<StatementErrorCallback> create(int transactionId, PassRefPtr<InspectorDatabaseAgent::FrontendProvider> frontendProvider)
     {
         return adoptRef(new StatementErrorCallback(transactionId, frontendProvider));
     }
@@ -141,16 +141,16 @@ public:
     }
 
 private:
-    StatementErrorCallback(long transactionId, PassRefPtr<InspectorDatabaseAgent::FrontendProvider> frontendProvider)
+    StatementErrorCallback(int transactionId, PassRefPtr<InspectorDatabaseAgent::FrontendProvider> frontendProvider)
         : m_transactionId(transactionId)
         , m_frontendProvider(frontendProvider) { }
-    long m_transactionId;
+    int m_transactionId;
     RefPtr<InspectorDatabaseAgent::FrontendProvider> m_frontendProvider;
 };
 
 class TransactionCallback : public SQLTransactionCallback {
 public:
-    static PassRefPtr<TransactionCallback> create(const String& sqlStatement, long transactionId, PassRefPtr<InspectorDatabaseAgent::FrontendProvider> frontendProvider)
+    static PassRefPtr<TransactionCallback> create(const String& sqlStatement, int transactionId, PassRefPtr<InspectorDatabaseAgent::FrontendProvider> frontendProvider)
     {
         return adoptRef(new TransactionCallback(sqlStatement, transactionId, frontendProvider));
     }
@@ -170,18 +170,18 @@ public:
         return true;
     }
 private:
-    TransactionCallback(const String& sqlStatement, long transactionId, PassRefPtr<InspectorDatabaseAgent::FrontendProvider> frontendProvider)
+    TransactionCallback(const String& sqlStatement, int transactionId, PassRefPtr<InspectorDatabaseAgent::FrontendProvider> frontendProvider)
         : m_sqlStatement(sqlStatement)
         , m_transactionId(transactionId)
         , m_frontendProvider(frontendProvider) { }
     String m_sqlStatement;
-    long m_transactionId;
+    int m_transactionId;
     RefPtr<InspectorDatabaseAgent::FrontendProvider> m_frontendProvider;
 };
 
 class TransactionErrorCallback : public SQLTransactionErrorCallback {
 public:
-    static PassRefPtr<TransactionErrorCallback> create(long transactionId, PassRefPtr<InspectorDatabaseAgent::FrontendProvider> frontendProvider)
+    static PassRefPtr<TransactionErrorCallback> create(int transactionId, PassRefPtr<InspectorDatabaseAgent::FrontendProvider> frontendProvider)
     {
         return adoptRef(new TransactionErrorCallback(transactionId, frontendProvider));
     }
@@ -194,10 +194,10 @@ public:
         return true;
     }
 private:
-    TransactionErrorCallback(long transactionId, PassRefPtr<InspectorDatabaseAgent::FrontendProvider> frontendProvider)
+    TransactionErrorCallback(int transactionId, PassRefPtr<InspectorDatabaseAgent::FrontendProvider> frontendProvider)
         : m_transactionId(transactionId)
         , m_frontendProvider(frontendProvider) { }
-    long m_transactionId;
+    int m_transactionId;
     RefPtr<InspectorDatabaseAgent::FrontendProvider> m_frontendProvider;
 };
 
@@ -257,7 +257,7 @@ void InspectorDatabaseAgent::clearFrontend()
     m_frontendProvider.clear();
 }
 
-void InspectorDatabaseAgent::getDatabaseTableNames(ErrorString*, long databaseId, RefPtr<InspectorArray>* names)
+void InspectorDatabaseAgent::getDatabaseTableNames(ErrorString*, int databaseId, RefPtr<InspectorArray>* names)
 {
     Database* database = databaseForId(databaseId);
     if (database) {
@@ -268,7 +268,7 @@ void InspectorDatabaseAgent::getDatabaseTableNames(ErrorString*, long databaseId
     }
 }
 
-void InspectorDatabaseAgent::executeSQL(ErrorString*, long databaseId, const String& query, bool* success, long* transactionId)
+void InspectorDatabaseAgent::executeSQL(ErrorString*, int databaseId, const String& query, bool* success, int* transactionId)
 {
     Database* database = databaseForId(databaseId);
     if (!database) {
@@ -284,7 +284,7 @@ void InspectorDatabaseAgent::executeSQL(ErrorString*, long databaseId, const Str
     *success = true;
 }
 
-long InspectorDatabaseAgent::databaseId(Database* database)
+int InspectorDatabaseAgent::databaseId(Database* database)
 {
     for (DatabaseResourcesMap::iterator it = m_resources.begin(); it != m_resources.end(); ++it) {
         if (it->second->database() == database)
@@ -293,7 +293,7 @@ long InspectorDatabaseAgent::databaseId(Database* database)
     return 0;
 }
 
-Database* InspectorDatabaseAgent::databaseForId(long databaseId)
+Database* InspectorDatabaseAgent::databaseForId(int databaseId)
 {
     DatabaseResourcesMap::iterator it = m_resources.find(databaseId);
     if (it == m_resources.end())
diff --git a/Source/WebCore/inspector/InspectorDatabaseAgent.h b/Source/WebCore/inspector/InspectorDatabaseAgent.h
index 7e42211..45fbfa4 100644
--- a/Source/WebCore/inspector/InspectorDatabaseAgent.h
+++ b/Source/WebCore/inspector/InspectorDatabaseAgent.h
@@ -59,17 +59,17 @@ public:
     void clearResources();
 
     // Called from the front-end.
-    void getDatabaseTableNames(ErrorString* error, long databaseId, RefPtr<InspectorArray>* names);
-    void executeSQL(ErrorString* error, long databaseId, const String& query, bool* success, long* transactionId);
+    void getDatabaseTableNames(ErrorString*, int databaseId, RefPtr<InspectorArray>* names);
+    void executeSQL(ErrorString*, int databaseId, const String& query, bool* success, int* transactionId);
 
     // Called from the injected script.
-    long databaseId(Database*);
+    int databaseId(Database*);
 
     void didOpenDatabase(PassRefPtr<Database>, const String& domain, const String& name, const String& version);
 private:
     explicit InspectorDatabaseAgent(InstrumentingAgents*);
 
-    Database* databaseForId(long databaseId);
+    Database* databaseForId(int databaseId);
 
     InstrumentingAgents* m_instrumentingAgents;
     typedef HashMap<int, RefPtr<InspectorDatabaseResource> > DatabaseResourcesMap;
diff --git a/Source/WebCore/inspector/InspectorDatabaseResource.cpp b/Source/WebCore/inspector/InspectorDatabaseResource.cpp
index 41342a4..852370e 100644
--- a/Source/WebCore/inspector/InspectorDatabaseResource.cpp
+++ b/Source/WebCore/inspector/InspectorDatabaseResource.cpp
@@ -38,7 +38,7 @@
 
 namespace WebCore {
 
-static long nextUnusedId = 1;
+static int nextUnusedId = 1;
 
 PassRefPtr<InspectorDatabaseResource> InspectorDatabaseResource::create(PassRefPtr<Database> database, const String& domain, const String& name, const String& version)
 {
diff --git a/Source/WebCore/inspector/InspectorDatabaseResource.h b/Source/WebCore/inspector/InspectorDatabaseResource.h
index 550fcd8..9fa7ebd 100644
--- a/Source/WebCore/inspector/InspectorDatabaseResource.h
+++ b/Source/WebCore/inspector/InspectorDatabaseResource.h
@@ -48,13 +48,13 @@ public:
 
     void bind(InspectorFrontend::Database*);
     Database* database() { return m_database.get(); }
-    long id() const { return m_id; }
+    int id() const { return m_id; }
 
 private:
     InspectorDatabaseResource(PassRefPtr<Database>, const String& domain, const String& name, const String& version);
 
     RefPtr<Database> m_database;
-    long m_id;
+    int m_id;
     String m_domain;
     String m_name;
     String m_version;
diff --git a/Source/WebCore/inspector/InspectorDebuggerAgent.cpp b/Source/WebCore/inspector/InspectorDebuggerAgent.cpp
index 0cdc2b0..56bc7b7 100644
--- a/Source/WebCore/inspector/InspectorDebuggerAgent.cpp
+++ b/Source/WebCore/inspector/InspectorDebuggerAgent.cpp
@@ -1,6 +1,6 @@
 /*
  * Copyright (C) 2010 Apple Inc. All rights reserved.
- * Copyright (C) 2010 Google Inc. All rights reserved.
+ * Copyright (C) 2010-2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -32,7 +32,7 @@
 
 #if ENABLE(JAVASCRIPT_DEBUGGER) && ENABLE(INSPECTOR)
 #include "InjectedScript.h"
-#include "InjectedScriptHost.h"
+#include "InjectedScriptManager.h"
 #include "InspectorFrontend.h"
 #include "InspectorState.h"
 #include "InspectorValues.h"
@@ -45,20 +45,13 @@ namespace WebCore {
 
 namespace DebuggerAgentState {
 static const char debuggerEnabled[] = "debuggerEnabled";
-static const char enableWhenShown[] = "debuggerEnableWhenShown";
 static const char javaScriptBreakpoints[] = "javaScriptBreakopints";
 };
 
-PassOwnPtr<InspectorDebuggerAgent> InspectorDebuggerAgent::create(InstrumentingAgents* instrumentingAgents, InspectorState* inspectorState, Page* inspectedPage, InjectedScriptHost* injectedScriptHost)
-{
-    return adoptPtr(new InspectorDebuggerAgent(instrumentingAgents, inspectorState, inspectedPage, injectedScriptHost));
-}
-
-InspectorDebuggerAgent::InspectorDebuggerAgent(InstrumentingAgents* instrumentingAgents, InspectorState* inspectorState, Page* inspectedPage, InjectedScriptHost* injectedScriptHost)
+InspectorDebuggerAgent::InspectorDebuggerAgent(InstrumentingAgents* instrumentingAgents, InspectorState* inspectorState, InjectedScriptManager* injectedScriptManager)
     : m_instrumentingAgents(instrumentingAgents)
     , m_inspectorState(inspectorState)
-    , m_inspectedPage(inspectedPage)
-    , m_injectedScriptHost(injectedScriptHost)
+    , m_injectedScriptManager(injectedScriptManager)
     , m_frontend(0)
     , m_pausedScriptState(0)
     , m_javaScriptPauseScheduled(false)
@@ -71,14 +64,6 @@ InspectorDebuggerAgent::~InspectorDebuggerAgent()
     ASSERT(!m_instrumentingAgents->inspectorDebuggerAgent());
 }
 
-void InspectorDebuggerAgent::startUserInitiatedDebugging()
-{
-    if (m_frontend)
-        enable(false);
-    else
-        m_inspectorState->setBoolean(DebuggerAgentState::enableWhenShown, true);
-}
-
 void InspectorDebuggerAgent::enable(bool restoringFromState)
 {
     ASSERT(m_frontend);
@@ -87,10 +72,10 @@ void InspectorDebuggerAgent::enable(bool restoringFromState)
     m_inspectorState->setBoolean(DebuggerAgentState::debuggerEnabled, true);
     m_instrumentingAgents->setInspectorDebuggerAgent(this);
 
-    ScriptDebugServer::shared().clearBreakpoints();
+    scriptDebugServer().clearBreakpoints();
     // FIXME(WK44513): breakpoints activated flag should be synchronized between all front-ends
-    ScriptDebugServer::shared().setBreakpointsActivated(true);
-    ScriptDebugServer::shared().addListener(this, m_inspectedPage);
+    scriptDebugServer().setBreakpointsActivated(true);
+    startListeningScriptDebugServer();
 
     m_frontend->debuggerWasEnabled();
     if (m_listener)
@@ -102,9 +87,10 @@ void InspectorDebuggerAgent::disable()
     if (!enabled())
         return;
     m_inspectorState->setBoolean(DebuggerAgentState::debuggerEnabled, false);
+    m_inspectorState->setObject(DebuggerAgentState::javaScriptBreakpoints, InspectorObject::create());
     m_instrumentingAgents->setInspectorDebuggerAgent(0);
 
-    ScriptDebugServer::shared().removeListener(this, m_inspectedPage);
+    stopListeningScriptDebugServer();
     clear();
 
     if (m_frontend)
@@ -129,17 +115,6 @@ void InspectorDebuggerAgent::setFrontend(InspectorFrontend* frontend)
     m_frontend = frontend->debugger();
 }
 
-void InspectorDebuggerAgent::enableDebuggerAfterShown()
-{
-    // Erase sticky breakpoints. If we are restoring from a cookie setFrontend msut be called
-    // before the state is loaded from the cookie.
-    m_inspectorState->setObject(DebuggerAgentState::javaScriptBreakpoints, InspectorObject::create());
-    if (m_inspectorState->getBoolean(DebuggerAgentState::enableWhenShown)) {
-        m_inspectorState->setBoolean(DebuggerAgentState::enableWhenShown, false);
-        enable(false);
-    }
-}
-
 void InspectorDebuggerAgent::clearFrontend()
 {
     m_frontend = 0;
@@ -150,17 +125,14 @@ void InspectorDebuggerAgent::clearFrontend()
     // remember this state to re-enable debugger on the next window
     // opening.
     disable();
-    m_inspectorState->setBoolean(DebuggerAgentState::enableWhenShown, true);
 }
 
-void InspectorDebuggerAgent::activateBreakpoints(ErrorString*)
+void InspectorDebuggerAgent::setBreakpointsActive(ErrorString*, bool active)
 {
-    ScriptDebugServer::shared().activateBreakpoints();
-}
-
-void InspectorDebuggerAgent::deactivateBreakpoints(ErrorString*)
-{
-    ScriptDebugServer::shared().deactivateBreakpoints();
+    if (active)
+        scriptDebugServer().activateBreakpoints();
+    else
+        scriptDebugServer().deactivateBreakpoints();
 }
 
 void InspectorDebuggerAgent::inspectedURLChanged(const String&)
@@ -169,7 +141,7 @@ void InspectorDebuggerAgent::inspectedURLChanged(const String&)
     m_breakpointIdToDebugServerBreakpointIds.clear();
 }
 
-void InspectorDebuggerAgent::setJavaScriptBreakpoint(ErrorString*, const String& url, int lineNumber, int columnNumber, const String& condition, bool enabled, String* outBreakpointId, RefPtr<InspectorArray>* locations)
+void InspectorDebuggerAgent::setBreakpointByUrl(ErrorString*, const String& url, int lineNumber, int columnNumber, const String& condition, bool enabled, String* outBreakpointId, RefPtr<InspectorArray>* locations)
 {
     String breakpointId = makeString(url, ":", String::number(lineNumber), ":", String::number(columnNumber));
     RefPtr<InspectorObject> breakpointsCookie = m_inspectorState->getObject(DebuggerAgentState::javaScriptBreakpoints);
@@ -200,7 +172,7 @@ void InspectorDebuggerAgent::setJavaScriptBreakpoint(ErrorString*, const String&
     *outBreakpointId = breakpointId;
 }
 
-void InspectorDebuggerAgent::setJavaScriptBreakpointBySourceId(ErrorString*, const String& sourceId, int lineNumber, int columnNumber, const String& condition, bool enabled, String* outBreakpointId, int* actualLineNumber, int* actualColumnNumber)
+void InspectorDebuggerAgent::setBreakpoint(ErrorString*, const String& sourceId, int lineNumber, int columnNumber, const String& condition, bool enabled, String* outBreakpointId, int* actualLineNumber, int* actualColumnNumber)
 {
     String breakpointId = makeString(sourceId, ":", String::number(lineNumber), ":", String::number(columnNumber));
     if (m_breakpointIdToDebugServerBreakpointIds.find(breakpointId) != m_breakpointIdToDebugServerBreakpointIds.end())
@@ -211,7 +183,7 @@ void InspectorDebuggerAgent::setJavaScriptBreakpointBySourceId(ErrorString*, con
     *outBreakpointId = breakpointId;
 }
 
-void InspectorDebuggerAgent::removeJavaScriptBreakpoint(ErrorString*, const String& breakpointId)
+void InspectorDebuggerAgent::removeBreakpoint(ErrorString*, const String& breakpointId)
 {
     RefPtr<InspectorObject> breakpointsCookie = m_inspectorState->getObject(DebuggerAgentState::javaScriptBreakpoints);
     breakpointsCookie->remove(breakpointId);
@@ -221,18 +193,18 @@ void InspectorDebuggerAgent::removeJavaScriptBreakpoint(ErrorString*, const Stri
     if (debugServerBreakpointIdsIterator == m_breakpointIdToDebugServerBreakpointIds.end())
         return;
     for (size_t i = 0; i < debugServerBreakpointIdsIterator->second.size(); ++i)
-        ScriptDebugServer::shared().removeBreakpoint(debugServerBreakpointIdsIterator->second[i]);
+        scriptDebugServer().removeBreakpoint(debugServerBreakpointIdsIterator->second[i]);
     m_breakpointIdToDebugServerBreakpointIds.remove(debugServerBreakpointIdsIterator);
 }
 
 void InspectorDebuggerAgent::continueToLocation(ErrorString* error, const String& sourceId, int lineNumber, int columnNumber)
 {
     if (!m_continueToLocationBreakpointId.isEmpty()) {
-        ScriptDebugServer::shared().removeBreakpoint(m_continueToLocationBreakpointId);
+        scriptDebugServer().removeBreakpoint(m_continueToLocationBreakpointId);
         m_continueToLocationBreakpointId = "";
     }
     ScriptBreakpoint breakpoint(lineNumber, columnNumber, "", true);
-    m_continueToLocationBreakpointId = ScriptDebugServer::shared().setBreakpoint(sourceId, breakpoint, &lineNumber, &columnNumber);
+    m_continueToLocationBreakpointId = scriptDebugServer().setBreakpoint(sourceId, breakpoint, &lineNumber, &columnNumber);
     resume(error);
 }
 
@@ -254,7 +226,7 @@ bool InspectorDebuggerAgent::resolveBreakpoint(const String& breakpointId, const
     if (breakpoint.lineNumber >= script.lineOffset + script.linesCount)
         return false;
 
-    String debugServerBreakpointId = ScriptDebugServer::shared().setBreakpoint(sourceId, breakpoint, actualLineNumber, actualColumnNumber);
+    String debugServerBreakpointId = scriptDebugServer().setBreakpoint(sourceId, breakpoint, actualLineNumber, actualColumnNumber);
     if (debugServerBreakpointId.isEmpty())
         return false;
 
@@ -266,10 +238,14 @@ bool InspectorDebuggerAgent::resolveBreakpoint(const String& breakpointId, const
     return true;
 }
 
-void InspectorDebuggerAgent::editScriptSource(ErrorString*, const String& sourceID, const String& newContent, bool* success, String* result, RefPtr<InspectorValue>* newCallFrames)
+void InspectorDebuggerAgent::editScriptSource(ErrorString* errorString, const String& sourceID, const String& newContent, String* result, RefPtr<InspectorArray>* newCallFrames)
 {
-    if ((*success = ScriptDebugServer::shared().editScriptSource(sourceID, newContent, *result)))
+    String editResult;
+    if (scriptDebugServer().editScriptSource(sourceID, newContent, editResult)) {
         *newCallFrames = currentCallFrames();
+        *result = editResult;
+    } else
+        *errorString = editResult;
 }
 
 void InspectorDebuggerAgent::getScriptSource(ErrorString*, const String& sourceID, String* scriptSource)
@@ -284,7 +260,7 @@ void InspectorDebuggerAgent::schedulePauseOnNextStatement(DebuggerEventType type
     m_breakProgramDetails = InspectorObject::create();
     m_breakProgramDetails->setNumber("eventType", type);
     m_breakProgramDetails->setValue("eventData", data);
-    ScriptDebugServer::shared().setPauseOnNextStatement(true);
+    scriptDebugServer().setPauseOnNextStatement(true);
 }
 
 void InspectorDebuggerAgent::cancelPauseOnNextStatement()
@@ -292,7 +268,7 @@ void InspectorDebuggerAgent::cancelPauseOnNextStatement()
     if (m_javaScriptPauseScheduled)
         return;
     m_breakProgramDetails = 0;
-    ScriptDebugServer::shared().setPauseOnNextStatement(false);
+    scriptDebugServer().setPauseOnNextStatement(false);
 }
 
 void InspectorDebuggerAgent::pause(ErrorString*)
@@ -303,45 +279,46 @@ void InspectorDebuggerAgent::pause(ErrorString*)
 
 void InspectorDebuggerAgent::resume(ErrorString*)
 {
-    ScriptDebugServer::shared().continueProgram();
+    scriptDebugServer().continueProgram();
 }
 
 void InspectorDebuggerAgent::stepOver(ErrorString*)
 {
-    ScriptDebugServer::shared().stepOverStatement();
+    scriptDebugServer().stepOverStatement();
 }
 
 void InspectorDebuggerAgent::stepInto(ErrorString*)
 {
-    ScriptDebugServer::shared().stepIntoStatement();
+    scriptDebugServer().stepIntoStatement();
 }
 
 void InspectorDebuggerAgent::stepOut(ErrorString*)
 {
-    ScriptDebugServer::shared().stepOutOfFunction();
+    scriptDebugServer().stepOutOfFunction();
 }
 
-void InspectorDebuggerAgent::setPauseOnExceptionsState(ErrorString*, long pauseState, long* newState)
+void InspectorDebuggerAgent::setPauseOnExceptionsState(ErrorString* errorString, int pauseState)
 {
-    ScriptDebugServer::shared().setPauseOnExceptionsState(static_cast<ScriptDebugServer::PauseOnExceptionsState>(pauseState));
-    *newState = ScriptDebugServer::shared().pauseOnExceptionsState();
+    scriptDebugServer().setPauseOnExceptionsState(static_cast<ScriptDebugServer::PauseOnExceptionsState>(pauseState));
+    if (scriptDebugServer().pauseOnExceptionsState() != pauseState)
+        *errorString = "Internal error. Could not change pause on exceptions state.";
 }
 
-void InspectorDebuggerAgent::evaluateOnCallFrame(ErrorString*, PassRefPtr<InspectorObject> callFrameId, const String& expression, const String& objectGroup, bool includeCommandLineAPI, RefPtr<InspectorValue>* result)
+void InspectorDebuggerAgent::evaluateOnCallFrame(ErrorString* errorString, const String& callFrameId, const String& expression, const String& objectGroup, bool includeCommandLineAPI, RefPtr<InspectorObject>* result)
 {
-    InjectedScript injectedScript = m_injectedScriptHost->injectedScriptForObjectId(callFrameId.get());
+    InjectedScript injectedScript = m_injectedScriptManager->injectedScriptForObjectId(callFrameId);
     if (!injectedScript.hasNoValue())
-        injectedScript.evaluateOnCallFrame(callFrameId, expression, objectGroup, includeCommandLineAPI, result);
+        injectedScript.evaluateOnCallFrame(errorString, callFrameId, expression, objectGroup, includeCommandLineAPI, result);
 }
 
-PassRefPtr<InspectorValue> InspectorDebuggerAgent::currentCallFrames()
+PassRefPtr<InspectorArray> InspectorDebuggerAgent::currentCallFrames()
 {
     if (!m_pausedScriptState)
-        return InspectorValue::null();
-    InjectedScript injectedScript = m_injectedScriptHost->injectedScriptFor(m_pausedScriptState);
+        return InspectorArray::create();
+    InjectedScript injectedScript = m_injectedScriptManager->injectedScriptFor(m_pausedScriptState);
     if (injectedScript.hasNoValue()) {
         ASSERT_NOT_REACHED();
-        return InspectorValue::null();
+        return InspectorArray::create();
     }
     return injectedScript.callFrames();
 }
@@ -351,7 +328,7 @@ PassRefPtr<InspectorValue> InspectorDebuggerAgent::currentCallFrames()
 void InspectorDebuggerAgent::didParseSource(const String& sourceID, const String& url, const String& data, int lineOffset, int columnOffset, ScriptWorldType worldType)
 {
     // Don't send script content to the front end until it's really needed.
-    m_frontend->parsedScriptSource(sourceID, url, lineOffset, columnOffset, data.length(), worldType);
+    m_frontend->scriptParsed(sourceID, url, lineOffset, columnOffset, data.length(), worldType);
 
     m_scripts.set(sourceID, Script(url, data, lineOffset, columnOffset));
 
@@ -378,7 +355,7 @@ void InspectorDebuggerAgent::didParseSource(const String& sourceID, const String
 
 void InspectorDebuggerAgent::failedToParseSource(const String& url, const String& data, int firstLine, int errorLine, const String& errorMessage)
 {
-    m_frontend->failedToParseScriptSource(url, data, firstLine, errorLine, errorMessage);
+    m_frontend->scriptFailedToParse(url, data, firstLine, errorLine, errorMessage);
 }
 
 void InspectorDebuggerAgent::didPause(ScriptState* scriptState)
@@ -390,11 +367,11 @@ void InspectorDebuggerAgent::didPause(ScriptState* scriptState)
         m_breakProgramDetails = InspectorObject::create();
     m_breakProgramDetails->setValue("callFrames", currentCallFrames());
 
-    m_frontend->pausedScript(m_breakProgramDetails);
+    m_frontend->paused(m_breakProgramDetails);
     m_javaScriptPauseScheduled = false;
 
     if (!m_continueToLocationBreakpointId.isEmpty()) {
-        ScriptDebugServer::shared().removeBreakpoint(m_continueToLocationBreakpointId);
+        scriptDebugServer().removeBreakpoint(m_continueToLocationBreakpointId);
         m_continueToLocationBreakpointId = "";
     }
 }
@@ -403,7 +380,7 @@ void InspectorDebuggerAgent::didContinue()
 {
     m_pausedScriptState = 0;
     m_breakProgramDetails = 0;
-    m_frontend->resumedScript();
+    m_frontend->resumed();
 }
 
 void InspectorDebuggerAgent::breakProgram(DebuggerEventType type, PassRefPtr<InspectorValue> data)
@@ -411,7 +388,7 @@ void InspectorDebuggerAgent::breakProgram(DebuggerEventType type, PassRefPtr<Ins
     m_breakProgramDetails = InspectorObject::create();
     m_breakProgramDetails->setNumber("eventType", type);
     m_breakProgramDetails->setValue("eventData", data);
-    ScriptDebugServer::shared().breakProgram();
+    scriptDebugServer().breakProgram();
 }
 
 void InspectorDebuggerAgent::clear()
diff --git a/Source/WebCore/inspector/InspectorDebuggerAgent.h b/Source/WebCore/inspector/InspectorDebuggerAgent.h
index 394034a..d5726e7 100644
--- a/Source/WebCore/inspector/InspectorDebuggerAgent.h
+++ b/Source/WebCore/inspector/InspectorDebuggerAgent.h
@@ -1,6 +1,6 @@
 /*
  * Copyright (C) 2010 Apple Inc. All rights reserved.
- * Copyright (C) 2010 Google Inc. All rights reserved.
+ * Copyright (C) 2010-2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -44,13 +44,14 @@
 
 namespace WebCore {
 
-class InjectedScriptHost;
+class InjectedScriptManager;
 class InspectorFrontend;
+class InspectorArray;
 class InspectorObject;
 class InspectorState;
 class InspectorValue;
 class InstrumentingAgents;
-class Page;
+class ScriptDebugServer;
 
 typedef String ErrorString;
 
@@ -63,42 +64,38 @@ enum DebuggerEventType {
 class InspectorDebuggerAgent : public ScriptDebugListener {
     WTF_MAKE_NONCOPYABLE(InspectorDebuggerAgent); WTF_MAKE_FAST_ALLOCATED;
 public:
-    static PassOwnPtr<InspectorDebuggerAgent> create(InstrumentingAgents*, InspectorState*, Page*, InjectedScriptHost*);
     virtual ~InspectorDebuggerAgent();
 
-    void startUserInitiatedDebugging();
     void enable(ErrorString*) { enable(false); }
     void disable(ErrorString*) { disable(); }
     void disable();
     bool enabled();
     void restore();
     void setFrontend(InspectorFrontend*);
-    void enableDebuggerAfterShown();
     void clearFrontend();
 
     void inspectedURLChanged(const String& url);
 
     // Part of the protocol.
-    void activateBreakpoints(ErrorString* error);
-    void deactivateBreakpoints(ErrorString* error);
+    void setBreakpointsActive(ErrorString*, bool active);
 
-    void setJavaScriptBreakpoint(ErrorString* error, const String& url, int lineNumber, int columnNumber, const String& condition, bool enabled, String* breakpointId, RefPtr<InspectorArray>* locations);
-    void setJavaScriptBreakpointBySourceId(ErrorString* error, const String& sourceId, int lineNumber, int columnNumber, const String& condition, bool enabled, String* breakpointId, int* actualLineNumber, int* actualColumnNumber);
-    void removeJavaScriptBreakpoint(ErrorString* error, const String& breakpointId);
-    void continueToLocation(ErrorString* error, const String& sourceId, int lineNumber, int columnNumber);
+    void setBreakpointByUrl(ErrorString*, const String& url, int lineNumber, int columnNumber, const String& condition, bool enabled, String* breakpointId, RefPtr<InspectorArray>* locations);
+    void setBreakpoint(ErrorString*, const String& sourceId, int lineNumber, int columnNumber, const String& condition, bool enabled, String* breakpointId, int* actualLineNumber, int* actualColumnNumber);
+    void removeBreakpoint(ErrorString*, const String& breakpointId);
+    void continueToLocation(ErrorString*, const String& sourceId, int lineNumber, int columnNumber);
 
-    void editScriptSource(ErrorString* error, const String& sourceID, const String& newContent, bool* success, String* result, RefPtr<InspectorValue>* newCallFrames);
-    void getScriptSource(ErrorString* error, const String& sourceID, String* scriptSource);
+    void editScriptSource(ErrorString*, const String& sourceID, const String& newContent, String* result, RefPtr<InspectorArray>* newCallFrames);
+    void getScriptSource(ErrorString*, const String& sourceID, String* scriptSource);
     void schedulePauseOnNextStatement(DebuggerEventType type, PassRefPtr<InspectorValue> data);
     void cancelPauseOnNextStatement();
     void breakProgram(DebuggerEventType type, PassRefPtr<InspectorValue> data);
-    void pause(ErrorString* error);
-    void resume(ErrorString* error);
-    void stepOver(ErrorString* error);
-    void stepInto(ErrorString* error);
-    void stepOut(ErrorString* error);
-    void setPauseOnExceptionsState(ErrorString* error, long pauseState, long* newState);
-    void evaluateOnCallFrame(ErrorString* error, PassRefPtr<InspectorObject> callFrameId, const String& expression, const String& objectGroup, bool includeCommandLineAPI, RefPtr<InspectorValue>* result);
+    void pause(ErrorString*);
+    void resume(ErrorString*);
+    void stepOver(ErrorString*);
+    void stepInto(ErrorString*);
+    void stepOut(ErrorString*);
+    void setPauseOnExceptionsState(ErrorString*, int pauseState);
+    void evaluateOnCallFrame(ErrorString*, const String& callFrameId, const String& expression, const String& objectGroup, bool includeCommandLineAPI, RefPtr<InspectorObject>* result);
 
     class Listener {
     public:
@@ -108,12 +105,18 @@ public:
     };
     void setListener(Listener* listener) { m_listener = listener; }
 
-private:
-    InspectorDebuggerAgent(InstrumentingAgents*, InspectorState*, Page*, InjectedScriptHost*);
+    virtual ScriptDebugServer& scriptDebugServer() = 0;
+
+protected:
+    InspectorDebuggerAgent(InstrumentingAgents*, InspectorState*, InjectedScriptManager*);
 
+    virtual void startListeningScriptDebugServer() = 0;
+    virtual void stopListeningScriptDebugServer() = 0;
+
+private:
     void enable(bool restoringFromState);
 
-    PassRefPtr<InspectorValue> currentCallFrames();
+    PassRefPtr<InspectorArray> currentCallFrames();
 
     virtual void didParseSource(const String& sourceID, const String& url, const String& data, int lineOffset, int columnOffset, ScriptWorldType);
     virtual void failedToParseSource(const String& url, const String& data, int firstLine, int errorLine, const String& errorMessage);
@@ -153,8 +156,7 @@ private:
 
     InstrumentingAgents* m_instrumentingAgents;
     InspectorState* m_inspectorState;
-    Page* m_inspectedPage;
-    InjectedScriptHost* m_injectedScriptHost;
+    InjectedScriptManager* m_injectedScriptManager;
     InspectorFrontend::Debugger* m_frontend;
     ScriptState* m_pausedScriptState;
     ScriptsMap m_scripts;
diff --git a/Source/WebCore/inspector/InspectorFrontendClient.h b/Source/WebCore/inspector/InspectorFrontendClient.h
index 31f52b7..d5eeafb 100644
--- a/Source/WebCore/inspector/InspectorFrontendClient.h
+++ b/Source/WebCore/inspector/InspectorFrontendClient.h
@@ -62,6 +62,9 @@ public:
     virtual void inspectedURLChanged(const String&) = 0;
 
     virtual void sendMessageToBackend(const String&) = 0;
+
+    virtual void saveSessionSetting(const String&, const String&) {}
+    virtual void loadSessionSetting(const String&, String*) {}
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/inspector/InspectorFrontendHost.cpp b/Source/WebCore/inspector/InspectorFrontendHost.cpp
index f2e66bc..7450d35 100644
--- a/Source/WebCore/inspector/InspectorFrontendHost.cpp
+++ b/Source/WebCore/inspector/InspectorFrontendHost.cpp
@@ -220,6 +220,20 @@ void InspectorFrontendHost::copyText(const String& text)
     Pasteboard::generalPasteboard()->writePlainText(text);
 }
 
+void InspectorFrontendHost::saveSessionSetting(const String& key, const String& value)
+{
+    if (m_client)
+        m_client->saveSessionSetting(key, value);
+}
+
+String InspectorFrontendHost::loadSessionSetting(const String& key)
+{
+    String value;
+    if (m_client)
+        m_client->loadSessionSetting(key, &value);
+    return value;
+}
+
 void InspectorFrontendHost::sendMessageToBackend(const String& message)
 {
     m_client->sendMessageToBackend(message);
diff --git a/Source/WebCore/inspector/InspectorFrontendHost.h b/Source/WebCore/inspector/InspectorFrontendHost.h
index 03c55a9..05d555a 100644
--- a/Source/WebCore/inspector/InspectorFrontendHost.h
+++ b/Source/WebCore/inspector/InspectorFrontendHost.h
@@ -75,6 +75,9 @@ public:
 
     void copyText(const String& text);
 
+    void saveSessionSetting(const String& key, const String& value);
+    String loadSessionSetting(const String& key);
+
     // Called from [Custom] implementations.
     void showContextMenu(Event*, const Vector<ContextMenuItem*>& items);
     void sendMessageToBackend(const String& message);
diff --git a/Source/WebCore/inspector/InspectorFrontendHost.idl b/Source/WebCore/inspector/InspectorFrontendHost.idl
index 6853c7d..0703a8e 100644
--- a/Source/WebCore/inspector/InspectorFrontendHost.idl
+++ b/Source/WebCore/inspector/InspectorFrontendHost.idl
@@ -47,6 +47,9 @@ module core {
         DOMString localizedStringsURL();
         DOMString hiddenPanels();
 
+        void saveSessionSetting(in DOMString key, in DOMString value);
+        DOMString loadSessionSetting(in DOMString key);
+
         void copyText(in DOMString text);
 
         [Custom] DOMString platform();
diff --git a/Source/WebCore/inspector/InspectorInstrumentation.cpp b/Source/WebCore/inspector/InspectorInstrumentation.cpp
index dfe1c28..6d3b4ad 100644
--- a/Source/WebCore/inspector/InspectorInstrumentation.cpp
+++ b/Source/WebCore/inspector/InspectorInstrumentation.cpp
@@ -47,6 +47,7 @@
 #include "InspectorDOMAgent.h"
 #include "InspectorDOMStorageAgent.h"
 #include "InspectorDebuggerAgent.h"
+#include "InspectorPageAgent.h"
 #include "InspectorProfilerAgent.h"
 #include "InspectorResourceAgent.h"
 #include "InspectorTimelineAgent.h"
@@ -92,6 +93,8 @@ static bool eventHasListeners(const AtomicString& eventType, DOMWindow* window,
 
 void InspectorInstrumentation::didClearWindowObjectInWorldImpl(InspectorAgent* inspectorAgent, Frame* frame, DOMWrapperWorld* world)
 {
+    if (InspectorPageAgent* pageAgent = inspectorAgent->instrumentingAgents()->inspectorPageAgent())
+        pageAgent->didClearWindowObjectInWorld(frame, world);
     inspectorAgent->didClearWindowObjectInWorld(frame, world);
 }
 
@@ -158,12 +161,15 @@ void InspectorInstrumentation::didInvalidateStyleAttrImpl(InspectorAgent* inspec
 
 void InspectorInstrumentation::mouseDidMoveOverElementImpl(InspectorAgent* inspectorAgent, const HitTestResult& result, unsigned modifierFlags)
 {
-    inspectorAgent->mouseDidMoveOverElement(result, modifierFlags);
+    if (InspectorDOMAgent* domAgent = inspectorAgent->instrumentingAgents()->inspectorDOMAgent())
+        domAgent->mouseDidMoveOverElement(result, modifierFlags);
 }
 
 bool InspectorInstrumentation::handleMousePressImpl(InspectorAgent* inspectorAgent)
 {
-    return inspectorAgent->handleMousePress();
+    if (InspectorDOMAgent* domAgent = inspectorAgent->instrumentingAgents()->inspectorDOMAgent())
+        return domAgent->handleMousePress();
+    return false;
 }
 
 void InspectorInstrumentation::characterDataModifiedImpl(InspectorAgent* inspectorAgent, CharacterData* characterData)
@@ -382,26 +388,18 @@ void InspectorInstrumentation::didRecalculateStyleImpl(const InspectorInstrument
         timelineAgent->didRecalculateStyle();
 }
 
-void InspectorInstrumentation::identifierForInitialRequestImpl(InspectorAgent* inspectorAgent, unsigned long identifier, DocumentLoader* loader, const ResourceRequest& request)
-{
-    if (!inspectorAgent->enabled())
-        return;
-
-    if (InspectorResourceAgent* resourceAgent = retrieveResourceAgent(inspectorAgent))
-        resourceAgent->identifierForInitialRequest(identifier, request.url(), loader);
-}
-
 void InspectorInstrumentation::applyUserAgentOverrideImpl(InspectorAgent* inspectorAgent, String* userAgent)
 {
-    inspectorAgent->applyUserAgentOverride(userAgent);
+    if (InspectorPageAgent* pageAgent = retrievePageAgent(inspectorAgent))
+        pageAgent->applyUserAgentOverride(userAgent);
 }
 
-void InspectorInstrumentation::willSendRequestImpl(InspectorAgent* inspectorAgent, unsigned long identifier, ResourceRequest& request, const ResourceResponse& redirectResponse)
+void InspectorInstrumentation::willSendRequestImpl(InspectorAgent* inspectorAgent, unsigned long identifier, DocumentLoader* loader, ResourceRequest& request, const ResourceResponse& redirectResponse)
 {
     if (InspectorTimelineAgent* timelineAgent = retrieveTimelineAgent(inspectorAgent))
         timelineAgent->willSendResourceRequest(identifier, request);
     if (InspectorResourceAgent* resourceAgent = retrieveResourceAgent(inspectorAgent))
-        resourceAgent->willSendRequest(identifier, request, redirectResponse);
+        resourceAgent->willSendRequest(identifier, loader, request, redirectResponse);
 }
 
 void InspectorInstrumentation::markResourceAsCachedImpl(InspectorAgent* inspectorAgent, unsigned long identifier)
@@ -448,18 +446,21 @@ InspectorInstrumentationCookie InspectorInstrumentation::willReceiveResourceResp
 
 void InspectorInstrumentation::didReceiveResourceResponseImpl(const InspectorInstrumentationCookie& cookie, unsigned long identifier, DocumentLoader* loader, const ResourceResponse& response)
 {
-    InspectorAgent* inspectorAgent = cookie.first;
-    if (InspectorResourceAgent* resourceAgent = retrieveResourceAgent(inspectorAgent))
-        resourceAgent->didReceiveResponse(identifier, loader, response);
-    inspectorAgent->consoleAgent()->didReceiveResponse(identifier, response);
     if (InspectorTimelineAgent* timelineAgent = retrieveTimelineAgent(cookie))
         timelineAgent->didReceiveResourceResponse();
+    if (!loader)
+        return;
+    if (InspectorAgent* inspectorAgent = inspectorAgentForFrame(loader->frame())) {
+        if (InspectorResourceAgent* resourceAgent = retrieveResourceAgent(inspectorAgent))
+            resourceAgent->didReceiveResponse(identifier, loader, response);
+        inspectorAgent->consoleAgent()->didReceiveResponse(identifier, response); // This should come AFTER resource notification, front-end relies on this.
+    }
 }
 
-void InspectorInstrumentation::didReceiveContentLengthImpl(InspectorAgent* inspectorAgent, unsigned long identifier, int lengthReceived)
+void InspectorInstrumentation::didReceiveContentLengthImpl(InspectorAgent* inspectorAgent, unsigned long identifier, int dataLength, int lengthReceived)
 {
     if (InspectorResourceAgent* resourceAgent = retrieveResourceAgent(inspectorAgent))
-        resourceAgent->didReceiveContentLength(identifier, lengthReceived);
+        resourceAgent->didReceiveContentLength(identifier, dataLength, lengthReceived);
 }
 
 void InspectorInstrumentation::didFinishLoadingImpl(InspectorAgent* inspectorAgent, unsigned long identifier, double finishTime)
@@ -472,11 +473,11 @@ void InspectorInstrumentation::didFinishLoadingImpl(InspectorAgent* inspectorAge
 
 void InspectorInstrumentation::didFailLoadingImpl(InspectorAgent* inspectorAgent, unsigned long identifier, const ResourceError& error)
 {
-    inspectorAgent->consoleAgent()->didFailLoading(identifier, error);
     if (InspectorTimelineAgent* timelineAgent = retrieveTimelineAgent(inspectorAgent))
         timelineAgent->didFinishLoadingResource(identifier, true, 0);
     if (InspectorResourceAgent* resourceAgent = retrieveResourceAgent(inspectorAgent))
         resourceAgent->didFailLoading(identifier, error);
+    inspectorAgent->consoleAgent()->didFailLoading(identifier, error); // This should come AFTER resource notification, front-end relies on this.
 }
 
 void InspectorInstrumentation::resourceRetrievedByXMLHttpRequestImpl(InspectorAgent* inspectorAgent, unsigned long identifier, const String& sourceString, const String& url, const String& sendURL, unsigned sendLineNumber)
@@ -494,12 +495,40 @@ void InspectorInstrumentation::scriptImportedImpl(InspectorAgent* inspectorAgent
 
 void InspectorInstrumentation::domContentLoadedEventFiredImpl(InspectorAgent* inspectorAgent, Frame* frame, const KURL& url)
 {
-    inspectorAgent->domContentLoadedEventFired(frame->loader()->documentLoader(), url);
+    DocumentLoader* documentLoader = frame->loader()->documentLoader();
+    ASSERT(documentLoader);
+
+    if (frame->page()->mainFrame() != frame || url != documentLoader->requestURL())
+        return;
+
+    inspectorAgent->domContentLoadedEventFired();
+
+    if (InspectorDOMAgent* domAgent = inspectorAgent->instrumentingAgents()->inspectorDOMAgent())
+        domAgent->mainFrameDOMContentLoaded();
+
+    if (InspectorTimelineAgent* timelineAgent = inspectorAgent->instrumentingAgents()->inspectorTimelineAgent())
+        timelineAgent->didMarkDOMContentEvent();
+
+    if (InspectorPageAgent* pageAgent = inspectorAgent->instrumentingAgents()->inspectorPageAgent())
+        pageAgent->domContentEventFired();
 }
 
 void InspectorInstrumentation::loadEventFiredImpl(InspectorAgent* inspectorAgent, Frame* frame, const KURL& url)
 {
-    inspectorAgent->loadEventFired(frame->loader()->documentLoader(), url);
+    DocumentLoader* documentLoader = frame->loader()->documentLoader();
+    ASSERT(documentLoader);
+
+    if (InspectorDOMAgent* domAgent = inspectorAgent->instrumentingAgents()->inspectorDOMAgent())
+        domAgent->loadEventFired(documentLoader->frame()->document());
+
+    if (frame->page()->mainFrame() != frame || url != documentLoader->requestURL())
+        return;
+
+    if (InspectorTimelineAgent* timelineAgent = inspectorAgent->instrumentingAgents()->inspectorTimelineAgent())
+        timelineAgent->didMarkLoadEvent();
+
+    if (InspectorPageAgent* pageAgent = inspectorAgent->instrumentingAgents()->inspectorPageAgent())
+        pageAgent->loadEventFired();
 }
 
 void InspectorInstrumentation::frameDetachedFromParentImpl(InspectorAgent* inspectorAgent, Frame* frame)
@@ -527,8 +556,6 @@ void InspectorInstrumentation::didCommitLoadImpl(Page* page, InspectorAgent* ins
     if (InspectorDebuggerAgent* debuggerAgent = instrumentingAgents->inspectorDebuggerAgent()) {
         KURL url = inspectorAgent->inspectedURLWithoutFragment();
         debuggerAgent->inspectedURLChanged(url);
-        if (InspectorBrowserDebuggerAgent* browserDebuggerAgent = instrumentingAgents->inspectorBrowserDebuggerAgent())
-            browserDebuggerAgent->inspectedURLChanged(url);
     }
 #endif
 #if ENABLE(JAVASCRIPT_DEBUGGER) && USE(JSC)
@@ -549,7 +576,11 @@ void InspectorInstrumentation::didCommitLoadImpl(Page* page, InspectorAgent* ins
 #endif
     if (InspectorDOMAgent* domAgent = instrumentingAgents->inspectorDOMAgent())
         domAgent->setDocument(mainFrame->document());
-    inspectorAgent->didCommitLoad(loader);
+
+    if (InspectorPageAgent* pageAgent = instrumentingAgents->inspectorPageAgent())
+        pageAgent->inspectedURLChanged(loader->url().string());
+
+    inspectorAgent->didCommitLoad();
 }
 
 InspectorInstrumentationCookie InspectorInstrumentation::willWriteHTMLImpl(InspectorAgent* inspectorAgent, unsigned int length, unsigned int startLine)
@@ -627,7 +658,7 @@ String InspectorInstrumentation::getCurrentUserInitiatedProfileNameImpl(Inspecto
 
 bool InspectorInstrumentation::profilerEnabledImpl(InspectorAgent* inspectorAgent)
 {
-    return inspectorAgent->profilerEnabled();
+    return inspectorAgent->instrumentingAgents()->inspectorProfilerAgent()->enabled();
 }
 #endif
 
@@ -733,6 +764,8 @@ InspectorTimelineAgent* InspectorInstrumentation::retrieveTimelineAgent(Inspecto
 
 InspectorTimelineAgent* InspectorInstrumentation::retrieveTimelineAgent(const InspectorInstrumentationCookie& cookie)
 {
+    if (!cookie.first)
+        return 0;
     InspectorTimelineAgent* timelineAgent = retrieveTimelineAgent(cookie.first);
     if (timelineAgent && timelineAgent->id() == cookie.second)
         return timelineAgent;
@@ -744,6 +777,11 @@ InspectorResourceAgent* InspectorInstrumentation::retrieveResourceAgent(Inspecto
     return inspectorAgent->instrumentingAgents()->inspectorResourceAgent();
 }
 
+InspectorPageAgent* InspectorInstrumentation::retrievePageAgent(InspectorAgent* inspectorAgent)
+{
+    return inspectorAgent->instrumentingAgents()->inspectorPageAgent();
+}
+
 } // namespace WebCore
 
 #endif // !ENABLE(INSPECTOR)
diff --git a/Source/WebCore/inspector/InspectorInstrumentation.h b/Source/WebCore/inspector/InspectorInstrumentation.h
index 2ea4e4f..77c464e 100644
--- a/Source/WebCore/inspector/InspectorInstrumentation.h
+++ b/Source/WebCore/inspector/InspectorInstrumentation.h
@@ -48,6 +48,7 @@ class EventContext;
 class DocumentLoader;
 class HitTestResult;
 class InspectorAgent;
+class InspectorPageAgent;
 class InspectorResourceAgent;
 class InspectorTimelineAgent;
 class KURL;
@@ -110,15 +111,14 @@ public:
     static void didRecalculateStyle(const InspectorInstrumentationCookie&);
 
     static void applyUserAgentOverride(Frame*, String*);
-    static void identifierForInitialRequest(Frame*, unsigned long identifier, DocumentLoader*, const ResourceRequest&);
-    static void willSendRequest(Frame*, unsigned long identifier, ResourceRequest&, const ResourceResponse& redirectResponse);
+    static void willSendRequest(Frame*, unsigned long identifier, DocumentLoader*, ResourceRequest&, const ResourceResponse& redirectResponse);
     static void markResourceAsCached(Page*, unsigned long identifier);
     static void didLoadResourceFromMemoryCache(Page*, DocumentLoader*, const CachedResource*);
     static InspectorInstrumentationCookie willReceiveResourceData(Frame*, unsigned long identifier);
     static void didReceiveResourceData(const InspectorInstrumentationCookie&);
     static InspectorInstrumentationCookie willReceiveResourceResponse(Frame*, unsigned long identifier, const ResourceResponse&);
     static void didReceiveResourceResponse(const InspectorInstrumentationCookie&, unsigned long identifier, DocumentLoader*, const ResourceResponse&);
-    static void didReceiveContentLength(Frame*, unsigned long identifier, int lengthReceived);
+    static void didReceiveContentLength(Frame*, unsigned long identifier, int dataLength, int lengthReceived);
     static void didFinishLoading(Frame*, unsigned long identifier, double finishTime);
     static void didFailLoading(Frame*, unsigned long identifier, const ResourceError&);
     static void resourceRetrievedByXMLHttpRequest(ScriptExecutionContext*, unsigned long identifier, const String& sourceString, const String& url, const String& sendURL, unsigned sendLineNumber);
@@ -227,15 +227,14 @@ private:
     static void didRecalculateStyleImpl(const InspectorInstrumentationCookie&);
 
     static void applyUserAgentOverrideImpl(InspectorAgent*, String*);
-    static void identifierForInitialRequestImpl(InspectorAgent*, unsigned long identifier, DocumentLoader*, const ResourceRequest&);
-    static void willSendRequestImpl(InspectorAgent*, unsigned long identifier, ResourceRequest&, const ResourceResponse& redirectResponse);
+    static void willSendRequestImpl(InspectorAgent*, unsigned long identifier, DocumentLoader*, ResourceRequest&, const ResourceResponse& redirectResponse);
     static void markResourceAsCachedImpl(InspectorAgent*, unsigned long identifier);
     static void didLoadResourceFromMemoryCacheImpl(InspectorAgent*, DocumentLoader*, const CachedResource*);
     static InspectorInstrumentationCookie willReceiveResourceDataImpl(InspectorAgent*, unsigned long identifier);
     static void didReceiveResourceDataImpl(const InspectorInstrumentationCookie&);
     static InspectorInstrumentationCookie willReceiveResourceResponseImpl(InspectorAgent*, unsigned long identifier, const ResourceResponse&);
     static void didReceiveResourceResponseImpl(const InspectorInstrumentationCookie&, unsigned long identifier, DocumentLoader*, const ResourceResponse&);
-    static void didReceiveContentLengthImpl(InspectorAgent*, unsigned long identifier, int lengthReceived);
+    static void didReceiveContentLengthImpl(InspectorAgent*, unsigned long identifier, int dataLength, int lengthReceived);
     static void didFinishLoadingImpl(InspectorAgent*, unsigned long identifier, double finishTime);
     static void didFailLoadingImpl(InspectorAgent*, unsigned long identifier, const ResourceError&);
     static void resourceRetrievedByXMLHttpRequestImpl(InspectorAgent*, unsigned long identifier, const String& sourceString, const String& url, const String& sendURL, unsigned sendLineNumber);
@@ -301,6 +300,7 @@ private:
     static InspectorTimelineAgent* retrieveTimelineAgent(InspectorAgent*);
     static InspectorTimelineAgent* retrieveTimelineAgent(const InspectorInstrumentationCookie&);
     static InspectorResourceAgent* retrieveResourceAgent(InspectorAgent*);
+    static InspectorPageAgent* retrievePageAgent(InspectorAgent*);
 
     static HashMap<Page*, InspectorAgent*>& inspectorAgents();
     static int s_frontendCounter;
@@ -601,17 +601,6 @@ inline void InspectorInstrumentation::didRecalculateStyle(const InspectorInstrum
 #endif
 }
 
-inline void InspectorInstrumentation::identifierForInitialRequest(Frame* frame, unsigned long identifier, DocumentLoader* loader, const ResourceRequest& request)
-{
-#if ENABLE(INSPECTOR)
-    // This notification should be procecessed even in cases there is no frontend.
-    if (!frame)
-        return;
-    if (InspectorAgent* ic = inspectorAgentForPage(frame->page()))
-        identifierForInitialRequestImpl(ic, identifier, loader, request);
-#endif
-}
-
 inline void InspectorInstrumentation::applyUserAgentOverride(Frame* frame, String* userAgent)
 {
 #if ENABLE(INSPECTOR)
@@ -620,11 +609,11 @@ inline void InspectorInstrumentation::applyUserAgentOverride(Frame* frame, Strin
 #endif
 }
 
-inline void InspectorInstrumentation::willSendRequest(Frame* frame, unsigned long identifier, ResourceRequest& request, const ResourceResponse& redirectResponse)
+inline void InspectorInstrumentation::willSendRequest(Frame* frame, unsigned long identifier, DocumentLoader* loader, ResourceRequest& request, const ResourceResponse& redirectResponse)
 {
 #if ENABLE(INSPECTOR)
     if (InspectorAgent* ic = inspectorAgentWithFrontendForFrame(frame))
-        willSendRequestImpl(ic, identifier, request, redirectResponse);
+        willSendRequestImpl(ic, identifier, loader, request, redirectResponse);
 #endif
 }
 
@@ -671,16 +660,16 @@ inline InspectorInstrumentationCookie InspectorInstrumentation::willReceiveResou
 inline void InspectorInstrumentation::didReceiveResourceResponse(const InspectorInstrumentationCookie& cookie, unsigned long identifier, DocumentLoader* loader, const ResourceResponse& response)
 {
 #if ENABLE(INSPECTOR)
-    if (hasFrontends() && cookie.first)
-        didReceiveResourceResponseImpl(cookie, identifier, loader, response);
+    // Call this unconditionally so that we're able to log to console with no front-end attached.
+    didReceiveResourceResponseImpl(cookie, identifier, loader, response);
 #endif
 }
 
-inline void InspectorInstrumentation::didReceiveContentLength(Frame* frame, unsigned long identifier, int lengthReceived)
+inline void InspectorInstrumentation::didReceiveContentLength(Frame* frame, unsigned long identifier, int dataLength, int lengthReceived)
 {
 #if ENABLE(INSPECTOR)
     if (InspectorAgent* inspectorAgent = inspectorAgentWithFrontendForFrame(frame))
-        didReceiveContentLengthImpl(inspectorAgent, identifier, lengthReceived);
+        didReceiveContentLengthImpl(inspectorAgent, identifier, dataLength, lengthReceived);
 #endif
 }
 
@@ -695,7 +684,7 @@ inline void InspectorInstrumentation::didFinishLoading(Frame* frame, unsigned lo
 inline void InspectorInstrumentation::didFailLoading(Frame* frame, unsigned long identifier, const ResourceError& error)
 {
 #if ENABLE(INSPECTOR)
-    if (InspectorAgent* inspectorAgent = inspectorAgentWithFrontendForFrame(frame))
+    if (InspectorAgent* inspectorAgent = inspectorAgentForFrame(frame))
         didFailLoadingImpl(inspectorAgent, identifier, error);
 #endif
 }
diff --git a/Source/WebCore/inspector/InspectorPageAgent.cpp b/Source/WebCore/inspector/InspectorPageAgent.cpp
new file mode 100644
index 0000000..af053c9
--- /dev/null
+++ b/Source/WebCore/inspector/InspectorPageAgent.cpp
@@ -0,0 +1,258 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#include "InspectorPageAgent.h"
+
+#if ENABLE(INSPECTOR) && ENABLE(JAVASCRIPT_DEBUGGER)
+
+#include "CachedResourceLoader.h"
+#include "Cookie.h"
+#include "CookieJar.h"
+#include "DocumentLoader.h"
+#include "Frame.h"
+#include "FrameLoadRequest.h"
+#include "InjectedScriptManager.h"
+#include "InspectorFrontend.h"
+#include "InspectorValues.h"
+#include "InstrumentingAgents.h"
+#include "Page.h"
+#include "ScriptObject.h"
+#include "UserGestureIndicator.h"
+#include "WindowFeatures.h"
+#include <wtf/CurrentTime.h>
+#include <wtf/ListHashSet.h>
+
+namespace WebCore {
+
+PassOwnPtr<InspectorPageAgent> InspectorPageAgent::create(InstrumentingAgents* instrumentingAgents, Page* inspectedPage, InjectedScriptManager* injectedScriptManager)
+{
+    return adoptPtr(new InspectorPageAgent(instrumentingAgents, inspectedPage, injectedScriptManager));
+}
+
+InspectorPageAgent::InspectorPageAgent(InstrumentingAgents* instrumentingAgents, Page* inspectedPage, InjectedScriptManager* injectedScriptManager)
+    : m_instrumentingAgents(instrumentingAgents)
+    , m_inspectedPage(inspectedPage)
+    , m_injectedScriptManager(injectedScriptManager)
+    , m_frontend(0)
+{
+}
+
+void InspectorPageAgent::setFrontend(InspectorFrontend* frontend)
+{
+    m_frontend = frontend;
+    m_instrumentingAgents->setInspectorPageAgent(this);
+
+    // Initialize Web Inspector title.
+    m_frontend->page()->inspectedURLChanged(m_inspectedPage->mainFrame()->document()->url().string());
+
+}
+
+void InspectorPageAgent::clearFrontend()
+{
+    m_instrumentingAgents->setInspectorPageAgent(0);
+    m_userAgentOverride = "";
+    m_frontend = 0;
+}
+
+void InspectorPageAgent::addScriptToEvaluateOnLoad(ErrorString*, const String& source)
+{
+    m_scriptsToEvaluateOnLoad.append(source);
+}
+
+void InspectorPageAgent::removeAllScriptsToEvaluateOnLoad(ErrorString*)
+{
+    m_scriptsToEvaluateOnLoad.clear();
+}
+
+void InspectorPageAgent::reloadPage(ErrorString*, bool ignoreCache)
+{
+    m_inspectedPage->mainFrame()->loader()->reload(ignoreCache);
+}
+
+void InspectorPageAgent::openInInspectedWindow(ErrorString*, const String& url)
+{
+    Frame* mainFrame = m_inspectedPage->mainFrame();
+
+    FrameLoadRequest request(mainFrame->document()->securityOrigin(), ResourceRequest(), "_blank");
+
+    bool created;
+    WindowFeatures windowFeatures;
+    Frame* newFrame = WebCore::createWindow(mainFrame, mainFrame, request, windowFeatures, created);
+    if (!newFrame)
+        return;
+
+    UserGestureIndicator indicator(DefinitelyProcessingUserGesture);
+    newFrame->loader()->setOpener(mainFrame);
+    newFrame->page()->setOpenedByDOM();
+    newFrame->loader()->changeLocation(mainFrame->document()->securityOrigin(), newFrame->loader()->completeURL(url), "", false, false);
+}
+
+void InspectorPageAgent::setUserAgentOverride(ErrorString*, const String& userAgent)
+{
+    m_userAgentOverride = userAgent;
+}
+
+void InspectorPageAgent::applyUserAgentOverride(String* userAgent) const
+{
+    if (!m_userAgentOverride.isEmpty())
+        *userAgent = m_userAgentOverride;
+}
+
+static PassRefPtr<InspectorObject> buildObjectForCookie(const Cookie& cookie)
+{
+    RefPtr<InspectorObject> value = InspectorObject::create();
+    value->setString("name", cookie.name);
+    value->setString("value", cookie.value);
+    value->setString("domain", cookie.domain);
+    value->setString("path", cookie.path);
+    value->setNumber("expires", cookie.expires);
+    value->setNumber("size", (cookie.name.length() + cookie.value.length()));
+    value->setBoolean("httpOnly", cookie.httpOnly);
+    value->setBoolean("secure", cookie.secure);
+    value->setBoolean("session", cookie.session);
+    return value;
+}
+
+static PassRefPtr<InspectorArray> buildArrayForCookies(ListHashSet<Cookie>& cookiesList)
+{
+    RefPtr<InspectorArray> cookies = InspectorArray::create();
+
+    ListHashSet<Cookie>::iterator end = cookiesList.end();
+    ListHashSet<Cookie>::iterator it = cookiesList.begin();
+    for (int i = 0; it != end; ++it, i++)
+        cookies->pushObject(buildObjectForCookie(*it));
+
+    return cookies;
+}
+
+void InspectorPageAgent::getCookies(ErrorString*, RefPtr<InspectorArray>* cookies, WTF::String* cookiesString)
+{
+    // If we can get raw cookies.
+    ListHashSet<Cookie> rawCookiesList;
+
+    // If we can't get raw cookies - fall back to String representation
+    String stringCookiesList;
+
+    // Return value to getRawCookies should be the same for every call because
+    // the return value is platform/network backend specific, and the call will
+    // always return the same true/false value.
+    bool rawCookiesImplemented = false;
+
+    for (Frame* frame = m_inspectedPage->mainFrame(); frame; frame = frame->tree()->traverseNext(m_inspectedPage->mainFrame())) {
+        Document* document = frame->document();
+        const CachedResourceLoader::DocumentResourceMap& allResources = document->cachedResourceLoader()->allCachedResources();
+        CachedResourceLoader::DocumentResourceMap::const_iterator end = allResources.end();
+        for (CachedResourceLoader::DocumentResourceMap::const_iterator it = allResources.begin(); it != end; ++it) {
+            Vector<Cookie> docCookiesList;
+            rawCookiesImplemented = getRawCookies(document, KURL(ParsedURLString, it->second->url()), docCookiesList);
+
+            if (!rawCookiesImplemented) {
+                // FIXME: We need duplication checking for the String representation of cookies.
+                ExceptionCode ec = 0;
+                stringCookiesList += document->cookie(ec);
+                // Exceptions are thrown by cookie() in sandboxed frames. That won't happen here
+                // because "document" is the document of the main frame of the page.
+                ASSERT(!ec);
+            } else {
+                int cookiesSize = docCookiesList.size();
+                for (int i = 0; i < cookiesSize; i++) {
+                    if (!rawCookiesList.contains(docCookiesList[i]))
+                        rawCookiesList.add(docCookiesList[i]);
+                }
+            }
+        }
+    }
+
+    if (rawCookiesImplemented)
+        *cookies = buildArrayForCookies(rawCookiesList);
+    else
+        *cookiesString = stringCookiesList;
+}
+
+void InspectorPageAgent::deleteCookie(ErrorString*, const String& cookieName, const String& domain)
+{
+    for (Frame* frame = m_inspectedPage->mainFrame(); frame; frame = frame->tree()->traverseNext(m_inspectedPage->mainFrame())) {
+        Document* document = frame->document();
+        if (document->url().host() != domain)
+            continue;
+        const CachedResourceLoader::DocumentResourceMap& allResources = document->cachedResourceLoader()->allCachedResources();
+        CachedResourceLoader::DocumentResourceMap::const_iterator end = allResources.end();
+        for (CachedResourceLoader::DocumentResourceMap::const_iterator it = allResources.begin(); it != end; ++it)
+            WebCore::deleteCookie(document, KURL(ParsedURLString, it->second->url()), cookieName);
+    }
+}
+
+void InspectorPageAgent::inspectedURLChanged(const String& url)
+{
+    m_frontend->page()->inspectedURLChanged(url);
+}
+
+void InspectorPageAgent::restore()
+{
+    inspectedURLChanged(m_inspectedPage->mainFrame()->document()->url().string());
+}
+
+void InspectorPageAgent::didCommitLoad(const String& url)
+{
+    inspectedURLChanged(url);
+}
+
+void InspectorPageAgent::domContentEventFired()
+{
+     m_frontend->page()->domContentEventFired(currentTime());
+}
+
+void InspectorPageAgent::loadEventFired()
+{
+     m_frontend->page()->loadEventFired(currentTime());
+}
+
+void InspectorPageAgent::didClearWindowObjectInWorld(Frame* frame, DOMWrapperWorld* world)
+{
+    if (world != mainThreadNormalWorld())
+        return;
+
+    if (frame == m_inspectedPage->mainFrame())
+        m_injectedScriptManager->discardInjectedScripts();
+
+    if (m_scriptsToEvaluateOnLoad.size()) {
+        ScriptState* scriptState = mainWorldScriptState(frame);
+        for (Vector<String>::iterator it = m_scriptsToEvaluateOnLoad.begin();
+             it != m_scriptsToEvaluateOnLoad.end(); ++it) {
+            m_injectedScriptManager->injectScript(*it, scriptState);
+        }
+    }
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(INSPECTOR) && ENABLE(JAVASCRIPT_DEBUGGER)
diff --git a/Source/WebCore/inspector/InspectorPageAgent.h b/Source/WebCore/inspector/InspectorPageAgent.h
new file mode 100644
index 0000000..bb6b96f
--- /dev/null
+++ b/Source/WebCore/inspector/InspectorPageAgent.h
@@ -0,0 +1,95 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef InspectorPageAgent_h
+#define InspectorPageAgent_h
+
+#if ENABLE(JAVASCRIPT_DEBUGGER) && ENABLE(INSPECTOR)
+
+#include "PlatformString.h"
+#include <wtf/RefCounted.h>
+#include <wtf/Vector.h>
+
+namespace WebCore {
+
+class DOMWrapperWorld;
+class Frame;
+class Frontend;
+class InjectedScriptManager;
+class InspectorArray;
+class InspectorFrontend;
+class InstrumentingAgents;
+class Page;
+
+typedef String ErrorString;
+
+class InspectorPageAgent {
+    WTF_MAKE_NONCOPYABLE(InspectorPageAgent);
+public:
+    static PassOwnPtr<InspectorPageAgent> create(InstrumentingAgents*, Page*, InjectedScriptManager*);
+
+    // Page API for InspectorFrontend
+    void addScriptToEvaluateOnLoad(ErrorString*, const String& source);
+    void removeAllScriptsToEvaluateOnLoad(ErrorString*);
+    void reloadPage(ErrorString*, bool ignoreCache);
+    void openInInspectedWindow(ErrorString*, const String& url);
+    void setUserAgentOverride(ErrorString*, const String& userAgent);
+    void getCookies(ErrorString*, RefPtr<InspectorArray>* cookies, WTF::String* cookiesString);
+    void deleteCookie(ErrorString*, const String& cookieName, const String& domain);
+
+    // InspectorInstrumentation API
+    void inspectedURLChanged(const String& url);
+    void didCommitLoad(const String& url);
+    void didClearWindowObjectInWorld(Frame*, DOMWrapperWorld*);
+    void domContentEventFired();
+    void loadEventFired();
+
+    void setFrontend(InspectorFrontend*);
+    void clearFrontend();
+    void restore();
+    void applyUserAgentOverride(String* userAgent) const;
+
+private:
+    InspectorPageAgent(InstrumentingAgents*, Page*, InjectedScriptManager*);
+
+    InstrumentingAgents* m_instrumentingAgents;
+    Page* m_inspectedPage;
+    InjectedScriptManager* m_injectedScriptManager;
+    InspectorFrontend* m_frontend;
+    Vector<String> m_scriptsToEvaluateOnLoad;
+    String m_userAgentOverride;
+};
+
+
+} // namespace WebCore
+
+#endif // ENABLE(JAVASCRIPT_DEBUGGER) && ENABLE(INSPECTOR)
+
+#endif // !defined(InspectorPageAgent_h)
diff --git a/Source/WebCore/inspector/InspectorProfilerAgent.cpp b/Source/WebCore/inspector/InspectorProfilerAgent.cpp
index 8867023..870a120 100644
--- a/Source/WebCore/inspector/InspectorProfilerAgent.cpp
+++ b/Source/WebCore/inspector/InspectorProfilerAgent.cpp
@@ -33,14 +33,15 @@
 #if ENABLE(JAVASCRIPT_DEBUGGER) && ENABLE(INSPECTOR)
 
 #include "Console.h"
-#include "InspectorAgent.h"
 #include "InspectorConsoleAgent.h"
 #include "InspectorFrontend.h"
+#include "InspectorState.h"
 #include "InspectorValues.h"
 #include "InstrumentingAgents.h"
 #include "KURL.h"
 #include "Page.h"
-#include "ScriptDebugServer.h"
+#include "PageScriptDebugServer.h"
+#include "ScriptController.h"
 #include "ScriptHeapSnapshot.h"
 #include "ScriptProfile.h"
 #include "ScriptProfiler.h"
@@ -53,19 +54,25 @@
 
 namespace WebCore {
 
+namespace ProfilerAgentState {
+static const char userInitiatedProfiling[] = "userInitiatedProfiling";
+static const char profilerEnabled[] = "profilerEnabled";
+}
+
 static const char* const UserInitiatedProfileName = "org.webkit.profiles.user-initiated";
 static const char* const CPUProfileType = "CPU";
 static const char* const HeapProfileType = "HEAP";
 
-PassOwnPtr<InspectorProfilerAgent> InspectorProfilerAgent::create(InstrumentingAgents* instrumentingAgents, InspectorConsoleAgent* consoleAgent, Page* inspectedPage)
+PassOwnPtr<InspectorProfilerAgent> InspectorProfilerAgent::create(InstrumentingAgents* instrumentingAgents, InspectorConsoleAgent* consoleAgent, Page* inspectedPage, InspectorState* inspectorState)
 {
-    return adoptPtr(new InspectorProfilerAgent(instrumentingAgents, consoleAgent, inspectedPage));
+    return adoptPtr(new InspectorProfilerAgent(instrumentingAgents, consoleAgent, inspectedPage, inspectorState));
 }
 
-InspectorProfilerAgent::InspectorProfilerAgent(InstrumentingAgents* instrumentingAgents, InspectorConsoleAgent* consoleAgent, Page* inspectedPage)
+InspectorProfilerAgent::InspectorProfilerAgent(InstrumentingAgents* instrumentingAgents, InspectorConsoleAgent* consoleAgent, Page* inspectedPage, InspectorState* inspectorState)
     : m_instrumentingAgents(instrumentingAgents)
     , m_consoleAgent(consoleAgent)
     , m_inspectedPage(inspectedPage)
+    , m_inspectorState(inspectorState)
     , m_frontend(0)
     , m_enabled(false)
     , m_recordingUserInitiatedProfile(false)
@@ -108,6 +115,11 @@ void InspectorProfilerAgent::addStartProfilingMessageToConsole(const String& tit
     m_consoleAgent->addMessageToConsole(JSMessageSource, LogMessageType, LogMessageLevel, message, lineNumber, sourceURL);
 }
 
+void InspectorProfilerAgent::collectGarbage(WebCore::ErrorString*)
+{
+    ScriptProfiler::collectGarbage();
+}
+
 PassRefPtr<InspectorObject> InspectorProfilerAgent::createProfileHeader(const ScriptProfile& profile)
 {
     RefPtr<InspectorObject> header = InspectorObject::create();
@@ -126,12 +138,26 @@ PassRefPtr<InspectorObject> InspectorProfilerAgent::createSnapshotHeader(const S
     return header;
 }
 
+void InspectorProfilerAgent::enable(ErrorString*)
+{
+    if (enabled())
+        return;
+    m_inspectorState->setBoolean(ProfilerAgentState::profilerEnabled, true);
+    enable(false);
+}
+
+void InspectorProfilerAgent::disable(ErrorString*)
+{
+    m_inspectorState->setBoolean(ProfilerAgentState::profilerEnabled, false);
+    disable();
+}
+
 void InspectorProfilerAgent::disable()
 {
     if (!m_enabled)
         return;
     m_enabled = false;
-    ScriptDebugServer::shared().recompileAllJSFunctionsSoon();
+    PageScriptDebugServer::shared().recompileAllJSFunctionsSoon();
     if (m_frontend)
         m_frontend->profilerWasDisabled();
 }
@@ -142,7 +168,7 @@ void InspectorProfilerAgent::enable(bool skipRecompile)
         return;
     m_enabled = true;
     if (!skipRecompile)
-        ScriptDebugServer::shared().recompileAllJSFunctionsSoon();
+        PageScriptDebugServer::shared().recompileAllJSFunctionsSoon();
     if (m_frontend)
         m_frontend->profilerWasEnabled();
 }
@@ -155,16 +181,6 @@ String InspectorProfilerAgent::getCurrentUserInitiatedProfileName(bool increment
     return makeString(UserInitiatedProfileName, '.', String::number(m_currentUserInitiatedProfileNumber));
 }
 
-void InspectorProfilerAgent::getExactHeapSnapshotNodeRetainedSize(ErrorString*, unsigned long uid, unsigned long nodeId, long* size)
-{
-    HeapSnapshotsMap::iterator it = m_snapshots.find(uid);
-    if (it != m_snapshots.end()) {
-        RefPtr<ScriptHeapSnapshot> snapshot = it->second;
-        *size = snapshot->exactRetainedSize(nodeId);
-    } else
-        *size = -1;
-}
-
 void InspectorProfilerAgent::getProfileHeaders(ErrorString*, RefPtr<InspectorArray>* headers)
 {
     ProfilesMap::iterator profilesEnd = m_profiles.end();
@@ -179,13 +195,13 @@ namespace {
 
 class OutputStream : public ScriptHeapSnapshot::OutputStream {
 public:
-    OutputStream(InspectorFrontend::Profiler* frontend, unsigned long uid)
+    OutputStream(InspectorFrontend::Profiler* frontend, unsigned uid)
         : m_frontend(frontend), m_uid(uid) { }
     void Write(const String& chunk) { m_frontend->addHeapSnapshotChunk(m_uid, chunk); }
     void Close() { m_frontend->finishHeapSnapshot(m_uid); }
 private:
     InspectorFrontend::Profiler* m_frontend;
-    unsigned long m_uid;
+    int m_uid;
 };
 
 } // namespace
@@ -224,6 +240,7 @@ void InspectorProfilerAgent::removeProfile(ErrorString*, const String& type, uns
 
 void InspectorProfilerAgent::resetState()
 {
+    stopUserInitiatedProfiling();
     m_profiles.clear();
     m_snapshots.clear();
     m_currentUserInitiatedProfileNumber = 1;
@@ -240,13 +257,44 @@ void InspectorProfilerAgent::resetFrontendProfiles()
         m_frontend->resetProfiles();
 }
 
+void InspectorProfilerAgent::setFrontend(InspectorFrontend* frontend)
+{
+    m_frontend = frontend->profiler();
+    restoreEnablement();
+}
+
+void InspectorProfilerAgent::clearFrontend()
+{
+    m_frontend = 0;
+    stopUserInitiatedProfiling();
+}
+
+void InspectorProfilerAgent::restore()
+{
+    // Need to restore enablement state here as in setFrontend m_inspectorState wasn't loaded yet.
+    restoreEnablement();
+
+    // Revisit this.
+    resetFrontendProfiles();
+    if (m_inspectorState->getBoolean(ProfilerAgentState::userInitiatedProfiling))
+        startUserInitiatedProfiling();
+}
+
+void InspectorProfilerAgent::restoreEnablement()
+{
+    if (m_inspectorState->getBoolean(ProfilerAgentState::profilerEnabled)) {
+        ErrorString error;
+        enable(&error);
+    }
+}
+
 void InspectorProfilerAgent::startUserInitiatedProfiling()
 {
     if (m_recordingUserInitiatedProfile)
         return;
     if (!enabled()) {
         enable(true);
-        ScriptDebugServer::shared().recompileAllJSFunctions();
+        PageScriptDebugServer::shared().recompileAllJSFunctions(0);
     }
     m_recordingUserInitiatedProfile = true;
     String title = getCurrentUserInitiatedProfileName(true);
@@ -258,6 +306,7 @@ void InspectorProfilerAgent::startUserInitiatedProfiling()
     ScriptProfiler::start(scriptState, title);
     addStartProfilingMessageToConsole(title, 0, String());
     toggleRecordButton(true);
+    m_inspectorState->setBoolean(ProfilerAgentState::userInitiatedProfiling, true);
 }
 
 void InspectorProfilerAgent::stopUserInitiatedProfiling(bool ignoreProfile)
@@ -281,6 +330,7 @@ void InspectorProfilerAgent::stopUserInitiatedProfiling(bool ignoreProfile)
             addProfileFinishedMessageToConsole(profile, 0, String());
     }
     toggleRecordButton(false);
+    m_inspectorState->setBoolean(ProfilerAgentState::userInitiatedProfiling, false);
 }
 
 namespace {
diff --git a/Source/WebCore/inspector/InspectorProfilerAgent.h b/Source/WebCore/inspector/InspectorProfilerAgent.h
index 839d801..6c5cf4c 100644
--- a/Source/WebCore/inspector/InspectorProfilerAgent.h
+++ b/Source/WebCore/inspector/InspectorProfilerAgent.h
@@ -45,6 +45,7 @@ class InspectorArray;
 class InspectorConsoleAgent;
 class InspectorFrontend;
 class InspectorObject;
+class InspectorState;
 class InstrumentingAgents;
 class Page;
 class ScriptHeapSnapshot;
@@ -55,26 +56,35 @@ typedef String ErrorString;
 class InspectorProfilerAgent {
     WTF_MAKE_NONCOPYABLE(InspectorProfilerAgent); WTF_MAKE_FAST_ALLOCATED;
 public:
-    static PassOwnPtr<InspectorProfilerAgent> create(InstrumentingAgents*, InspectorConsoleAgent*, Page*);
+    static PassOwnPtr<InspectorProfilerAgent> create(InstrumentingAgents*, InspectorConsoleAgent*, Page*, InspectorState*);
     virtual ~InspectorProfilerAgent();
 
     void addProfile(PassRefPtr<ScriptProfile> prpProfile, unsigned lineNumber, const String& sourceURL);
     void addProfileFinishedMessageToConsole(PassRefPtr<ScriptProfile>, unsigned lineNumber, const String& sourceURL);
     void addStartProfilingMessageToConsole(const String& title, unsigned lineNumber, const String& sourceURL);
+    void collectGarbage(ErrorString*);
     void clearProfiles(ErrorString*) { resetState(); }
+    void resetState();
+
+    void enable(ErrorString*);
+    void disable(ErrorString*);
+    void isEnabled(ErrorString*, bool* result) { *result = enabled(); }
+    void start(ErrorString*) { startUserInitiatedProfiling(); }
+    void stop(ErrorString*) { stopUserInitiatedProfiling(); }
+
     void disable();
     void enable(bool skipRecompile);
     bool enabled() { return m_enabled; }
     String getCurrentUserInitiatedProfileName(bool incrementProfileNumber = false);
-    void getExactHeapSnapshotNodeRetainedSize(ErrorString*, unsigned long uid, unsigned long nodeId, long* size);
     void getProfileHeaders(ErrorString* error, RefPtr<InspectorArray>* headers);
     void getProfile(ErrorString* error, const String& type, unsigned uid, RefPtr<InspectorObject>* profileObject);
     bool isRecordingUserInitiatedProfile() { return m_recordingUserInitiatedProfile; }
     void removeProfile(ErrorString* error, const String& type, unsigned uid);
-    void resetState();
-    void resetFrontendProfiles();
-    void setFrontend(InspectorFrontend* frontend) { m_frontend = frontend->profiler(); }
-    void clearFrontend() { m_frontend = 0; }
+
+    void setFrontend(InspectorFrontend*);
+    void clearFrontend();
+    void restore();
+
     void startUserInitiatedProfiling();
     void stopUserInitiatedProfiling(bool ignoreProfile = false);
     void takeHeapSnapshot(ErrorString* error, bool detailed);
@@ -84,13 +94,17 @@ private:
     typedef HashMap<unsigned int, RefPtr<ScriptProfile> > ProfilesMap;
     typedef HashMap<unsigned int, RefPtr<ScriptHeapSnapshot> > HeapSnapshotsMap;
 
-    InspectorProfilerAgent(InstrumentingAgents*, InspectorConsoleAgent*, Page*);
+    void resetFrontendProfiles();
+    void restoreEnablement();
+
+    InspectorProfilerAgent(InstrumentingAgents*, InspectorConsoleAgent*, Page*, InspectorState*);
     PassRefPtr<InspectorObject> createProfileHeader(const ScriptProfile& profile);
     PassRefPtr<InspectorObject> createSnapshotHeader(const ScriptHeapSnapshot& snapshot);
 
     InstrumentingAgents* m_instrumentingAgents;
     InspectorConsoleAgent* m_consoleAgent;
     Page* m_inspectedPage;
+    InspectorState* m_inspectorState;
     InspectorFrontend::Profiler* m_frontend;
     bool m_enabled;
     bool m_recordingUserInitiatedProfile;
diff --git a/Source/WebCore/inspector/InspectorResourceAgent.cpp b/Source/WebCore/inspector/InspectorResourceAgent.cpp
index db41640..1e2c16d 100644
--- a/Source/WebCore/inspector/InspectorResourceAgent.cpp
+++ b/Source/WebCore/inspector/InspectorResourceAgent.cpp
@@ -62,9 +62,10 @@
 #include "WebSocketHandshakeResponse.h"
 
 #include <wtf/CurrentTime.h>
+#include <wtf/HexNumber.h>
 #include <wtf/ListHashSet.h>
 #include <wtf/RefPtr.h>
-#include <wtf/text/StringBuffer.h>
+#include <wtf/text/StringBuilder.h>
 
 namespace WebCore {
 
@@ -90,10 +91,12 @@ void InspectorResourceAgent::restore()
         enable();
 }
 
-bool InspectorResourceAgent::resourceContent(Frame* frame, const KURL& url, String* result)
+void InspectorResourceAgent::resourceContent(ErrorString* errorString, Frame* frame, const KURL& url, String* result)
 {
-    if (!frame)
-        return false;
+    if (!frame) {
+        *errorString = "No frame to get resource content for."; 
+        return;
+    }
 
     String textEncodingName;
     RefPtr<SharedBuffer> buffer = InspectorResourceAgent::resourceData(frame, url, &textEncodingName);
@@ -103,23 +106,22 @@ bool InspectorResourceAgent::resourceContent(Frame* frame, const KURL& url, Stri
         if (!encoding.isValid())
             encoding = WindowsLatin1Encoding();
         *result = encoding.decode(buffer->data(), buffer->size());
-        return true;
+        return;
     }
-
-    return false;
+    *errorString = "No resource with given URL found."; 
 }
 
-bool InspectorResourceAgent::resourceContentBase64(Frame* frame, const KURL& url, String* result)
+void InspectorResourceAgent::resourceContentBase64(ErrorString* errorString, Frame* frame, const KURL& url, String* result)
 {
     String textEncodingName;
     RefPtr<SharedBuffer> data = InspectorResourceAgent::resourceData(frame, url, &textEncodingName);
     if (!data) {
         *result = String();
-        return false;
+        *errorString = "No resource with given URL found."; 
+        return;
     }
 
     *result = base64Encode(data->data(), data->size());
-    return true;
 }
 
 PassRefPtr<SharedBuffer> InspectorResourceAgent::resourceData(Frame* frame, const KURL& url, String* textEncodingName)
@@ -193,69 +195,41 @@ static PassRefPtr<InspectorObject> buildObjectForResourceRequest(const ResourceR
 {
     RefPtr<InspectorObject> requestObject = InspectorObject::create();
     requestObject->setString("url", request.url().string());
-    requestObject->setString("httpMethod", request.httpMethod());
-    requestObject->setObject("httpHeaderFields", buildObjectForHeaders(request.httpHeaderFields()));
+    requestObject->setString("method", request.httpMethod());
+    requestObject->setObject("headers", buildObjectForHeaders(request.httpHeaderFields()));
     if (request.httpBody() && !request.httpBody()->isEmpty())
-        requestObject->setString("requestFormData", request.httpBody()->flattenToString());
+        requestObject->setString("postData", request.httpBody()->flattenToString());
     return requestObject;
 }
 
 static PassRefPtr<InspectorObject> buildObjectForResourceResponse(const ResourceResponse& response)
 {
     RefPtr<InspectorObject> responseObject = InspectorObject::create();
-    if (response.isNull()) {
-        responseObject->setBoolean("isNull", true);
+    if (response.isNull())
         return responseObject;
-    }
-    responseObject->setString("url", response.url().string());
+
+    responseObject->setNumber("status", response.resourceLoadInfo() ? response.resourceLoadInfo()->httpStatusCode : response.httpStatusCode());
+    responseObject->setString("statusText", response.resourceLoadInfo() ? response.resourceLoadInfo()->httpStatusText : response.httpStatusText());
+    responseObject->setObject("headers", buildObjectForHeaders(response.resourceLoadInfo() ? response.resourceLoadInfo()->responseHeaders : response.httpHeaderFields()));
+
     responseObject->setString("mimeType", response.mimeType());
-    responseObject->setNumber("expectedContentLength", response.expectedContentLength());
-    responseObject->setString("textEncodingName", response.textEncodingName());
-    responseObject->setString("suggestedFilename", response.suggestedFilename());
-    responseObject->setNumber("httpStatusCode", response.httpStatusCode());
-    responseObject->setString("httpStatusText", response.httpStatusText());
-    responseObject->setObject("httpHeaderFields", buildObjectForHeaders(response.httpHeaderFields()));
     responseObject->setBoolean("connectionReused", response.connectionReused());
     responseObject->setNumber("connectionID", response.connectionID());
-    responseObject->setBoolean("wasCached", response.wasCached());
+    responseObject->setBoolean("fromDiskCache", response.wasCached());
     if (response.resourceLoadTiming())
         responseObject->setObject("timing", buildObjectForTiming(*response.resourceLoadTiming()));
-    if (response.resourceLoadInfo()) {
-        RefPtr<InspectorObject> loadInfoObject = InspectorObject::create();
-        loadInfoObject->setNumber("httpStatusCode", response.resourceLoadInfo()->httpStatusCode);
-        loadInfoObject->setString("httpStatusText", response.resourceLoadInfo()->httpStatusText);
-        loadInfoObject->setObject("requestHeaders", buildObjectForHeaders(response.resourceLoadInfo()->requestHeaders));
-        loadInfoObject->setObject("responseHeaders", buildObjectForHeaders(response.resourceLoadInfo()->responseHeaders));
-        responseObject->setObject("loadInfo", loadInfoObject);
-    }
-    return responseObject;
-}
 
-static unsigned long frameId(Frame* frame)
-{
-    return reinterpret_cast<uintptr_t>(frame);
-}
+    if (response.resourceLoadInfo())
+        responseObject->setObject("requestHeaders", buildObjectForHeaders(response.resourceLoadInfo()->requestHeaders));
 
-static PassRefPtr<InspectorObject> buildObjectForDocumentLoader(DocumentLoader* loader)
-{
-    RefPtr<InspectorObject> documentLoaderObject = InspectorObject::create();
-    documentLoaderObject->setNumber("frameId", frameId(loader->frame()));
-    documentLoaderObject->setNumber("loaderId", reinterpret_cast<uintptr_t>(loader));
-    documentLoaderObject->setString("url", loader->requestURL().string());
-    return documentLoaderObject;
+    return responseObject;
 }
 
-static PassRefPtr<InspectorObject> buildObjectForFrameResource(Frame* frame)
+static String pointerAsId(void* pointer)
 {
-    FrameLoader* frameLoader = frame->loader();
-    DocumentLoader* loader = frameLoader->documentLoader();
-
-    RefPtr<InspectorObject> resourceObject = InspectorObject::create();
-    resourceObject->setString("url", loader->url().string());
-    resourceObject->setObject("loader", buildObjectForDocumentLoader(loader));
-    resourceObject->setObject("request", buildObjectForResourceRequest(loader->request()));
-    resourceObject->setObject("response", buildObjectForResourceResponse(loader->response()));
-    return resourceObject;
+    unsigned long long address = reinterpret_cast<uintptr_t>(pointer);
+    // We want 0 to be "", so that JavaScript checks for if (frameId) worked.
+    return String::format("%.0llX", address);
 }
 
 static String cachedResourceTypeString(const CachedResource& cachedResource)
@@ -279,56 +253,22 @@ static String cachedResourceTypeString(const CachedResource& cachedResource)
     return "Other";
 }
 
-static PassRefPtr<InspectorObject> buildObjectForCachedResource(DocumentLoader* loader, const CachedResource& cachedResource)
+static PassRefPtr<InspectorObject> buildObjectForCachedResource(const CachedResource& cachedResource)
 {
     RefPtr<InspectorObject> resourceObject = InspectorObject::create();
     resourceObject->setString("url", cachedResource.url());
     resourceObject->setString("type", cachedResourceTypeString(cachedResource));
-    resourceObject->setNumber("encodedSize", cachedResource.encodedSize());
+    resourceObject->setNumber("bodySize", cachedResource.encodedSize());
     resourceObject->setObject("response", buildObjectForResourceResponse(cachedResource.response()));
-    resourceObject->setObject("loader", buildObjectForDocumentLoader(loader));
     return resourceObject;
 }
 
-static void populateObjectWithFrameResources(Frame* frame, PassRefPtr<InspectorObject> frameResources)
-{
-    frameResources->setObject("resource", buildObjectForFrameResource(frame));
-    RefPtr<InspectorArray> subresources = InspectorArray::create();
-    frameResources->setArray("subresources", subresources);
-
-    const CachedResourceLoader::DocumentResourceMap& allResources = frame->document()->cachedResourceLoader()->allCachedResources();
-    CachedResourceLoader::DocumentResourceMap::const_iterator end = allResources.end();
-    for (CachedResourceLoader::DocumentResourceMap::const_iterator it = allResources.begin(); it != end; ++it) {
-        CachedResource* cachedResource = it->second.get();
-        RefPtr<InspectorObject> cachedResourceObject = buildObjectForCachedResource(frame->loader()->documentLoader(), *cachedResource);
-        subresources->pushValue(cachedResourceObject);
-    }
-}
-
 InspectorResourceAgent::~InspectorResourceAgent()
 {
     ASSERT(!m_instrumentingAgents->inspectorResourceAgent());
 }
 
-void InspectorResourceAgent::identifierForInitialRequest(unsigned long identifier, const KURL& url, DocumentLoader* loader)
-{
-    RefPtr<InspectorObject> loaderObject = buildObjectForDocumentLoader(loader);
-    RefPtr<ScriptCallStack> callStack = createScriptCallStack(ScriptCallStack::maxCallStackSizeToCapture, true);
-    RefPtr<InspectorValue> callStackValue;
-    if (callStack)
-        callStackValue = callStack->buildInspectorObject();
-    else
-        callStackValue = InspectorValue::null();
-    m_frontend->identifierForInitialRequest(identifier, url.string(), loaderObject, callStackValue);
-}
-
-void InspectorResourceAgent::setExtraHeaders(ErrorString*, PassRefPtr<InspectorObject> headers)
-{
-    m_state->setObject(ResourceAgentState::extraRequestHeaders, headers);
-}
-
-
-void InspectorResourceAgent::willSendRequest(unsigned long identifier, ResourceRequest& request, const ResourceResponse& redirectResponse)
+void InspectorResourceAgent::willSendRequest(unsigned long identifier, DocumentLoader* loader, ResourceRequest& request, const ResourceResponse& redirectResponse)
 {
     RefPtr<InspectorObject> headers = m_state->getObject(ResourceAgentState::extraRequestHeaders);
 
@@ -344,12 +284,18 @@ void InspectorResourceAgent::willSendRequest(unsigned long identifier, ResourceR
     request.setReportLoadTiming(true);
     request.setReportRawHeaders(true);
 
-    m_frontend->willSendRequest(identifier, currentTime(), buildObjectForResourceRequest(request), buildObjectForResourceResponse(redirectResponse));
+    RefPtr<ScriptCallStack> callStack = createScriptCallStack(ScriptCallStack::maxCallStackSizeToCapture, true);
+    RefPtr<InspectorArray> callStackValue;
+    if (callStack)
+        callStackValue = callStack->buildInspectorArray();
+    else
+        callStackValue = InspectorArray::create();
+    m_frontend->requestWillBeSent(static_cast<int>(identifier), pointerAsId(loader->frame()), pointerAsId(loader), loader->url().string(), buildObjectForResourceRequest(request), buildObjectForResourceResponse(redirectResponse), currentTime(), callStackValue);
 }
 
 void InspectorResourceAgent::markResourceAsCached(unsigned long identifier)
 {
-    m_frontend->markResourceAsCached(identifier);
+    m_frontend->resourceMarkedAsCached(static_cast<int>(identifier));
 }
 
 void InspectorResourceAgent::didReceiveResponse(unsigned long identifier, DocumentLoader* loader, const ResourceResponse& response)
@@ -372,16 +318,16 @@ void InspectorResourceAgent::didReceiveResponse(unsigned long identifier, Docume
         else if (equalIgnoringFragmentIdentifier(response.url(), loader->url()) && type == "Other")
             type = "Document";
     }
-    m_frontend->didReceiveResponse(identifier, currentTime(), type, resourceResponse);
+    m_frontend->responseReceived(static_cast<int>(identifier), currentTime(), type, resourceResponse);
     // If we revalidated the resource and got Not modified, send content length following didReceiveResponse
     // as there will be no calls to didReceiveContentLength from the network stack.
     if (cachedResourceSize && response.httpStatusCode() == 304)
-        didReceiveContentLength(identifier, cachedResourceSize);
+        didReceiveContentLength(identifier, cachedResourceSize, 0);
 }
 
-void InspectorResourceAgent::didReceiveContentLength(unsigned long identifier, int lengthReceived)
+void InspectorResourceAgent::didReceiveContentLength(unsigned long identifier, int dataLength, int lengthReceived)
 {
-    m_frontend->didReceiveContentLength(identifier, currentTime(), lengthReceived);
+    m_frontend->dataReceived(static_cast<int>(identifier), currentTime(), dataLength, lengthReceived);
 }
 
 void InspectorResourceAgent::didFinishLoading(unsigned long identifier, double finishTime)
@@ -389,29 +335,29 @@ void InspectorResourceAgent::didFinishLoading(unsigned long identifier, double f
     if (!finishTime)
         finishTime = currentTime();
 
-    m_frontend->didFinishLoading(identifier, finishTime);
+    m_frontend->loadingFinished(static_cast<int>(identifier), finishTime);
 }
 
 void InspectorResourceAgent::didFailLoading(unsigned long identifier, const ResourceError& error)
 {
-    m_frontend->didFailLoading(identifier, currentTime(), error.localizedDescription());
+    m_frontend->loadingFailed(static_cast<int>(identifier), currentTime(), error.localizedDescription());
 }
 
 void InspectorResourceAgent::didLoadResourceFromMemoryCache(DocumentLoader* loader, const CachedResource* resource)
 {
-    m_frontend->didLoadResourceFromMemoryCache(currentTime(), buildObjectForCachedResource(loader, *resource));
+    m_frontend->resourceLoadedFromMemoryCache(pointerAsId(loader->frame()), pointerAsId(loader), loader->url().string(), currentTime(), buildObjectForCachedResource(*resource));
 }
 
 void InspectorResourceAgent::setInitialContent(unsigned long identifier, const String& sourceString, const String& type)
 {
-    m_frontend->setInitialContent(identifier, sourceString, type);
+    m_frontend->initialContentSet(static_cast<int>(identifier), sourceString, type);
 }
 
 static PassRefPtr<InspectorObject> buildObjectForFrame(Frame* frame)
 {
     RefPtr<InspectorObject> frameObject = InspectorObject::create();
-    frameObject->setNumber("id", frameId(frame));
-    frameObject->setNumber("parentId", frameId(frame->tree()->parent()));
+    frameObject->setString("id", pointerAsId(frame));
+    frameObject->setString("parentId", pointerAsId(frame->tree()->parent()));
     if (frame->ownerElement()) {
         String name = frame->ownerElement()->getAttribute(HTMLNames::nameAttr);
         if (name.isEmpty())
@@ -419,34 +365,48 @@ static PassRefPtr<InspectorObject> buildObjectForFrame(Frame* frame)
         frameObject->setString("name", name);
     }
     frameObject->setString("url", frame->document()->url().string());
+    frameObject->setString("loaderId", pointerAsId(frame->loader()->documentLoader()));
+
     return frameObject;
 }
 
-static PassRefPtr<InspectorObject> buildObjectForFrameTree(Frame* frame, bool dumpResources)
+static PassRefPtr<InspectorObject> buildObjectForFrameTree(Frame* frame)
 {
+    RefPtr<InspectorObject> result = InspectorObject::create();
     RefPtr<InspectorObject> frameObject = buildObjectForFrame(frame);
+    result->setObject("frame", frameObject);
+
+    RefPtr<InspectorArray> subresources = InspectorArray::create();
+    result->setArray("resources", subresources);
+    const CachedResourceLoader::DocumentResourceMap& allResources = frame->document()->cachedResourceLoader()->allCachedResources();
+    CachedResourceLoader::DocumentResourceMap::const_iterator end = allResources.end();
+    for (CachedResourceLoader::DocumentResourceMap::const_iterator it = allResources.begin(); it != end; ++it) {
+        CachedResource* cachedResource = it->second.get();
+        RefPtr<InspectorObject> resourceObject = InspectorObject::create();
+        resourceObject->setString("url", cachedResource->url());
+        resourceObject->setString("type", cachedResourceTypeString(*cachedResource));
+        subresources->pushValue(resourceObject);
+    }
 
-    if (dumpResources)
-        populateObjectWithFrameResources(frame, frameObject);
     RefPtr<InspectorArray> childrenArray;
     for (Frame* child = frame->tree()->firstChild(); child; child = child->tree()->nextSibling()) {
         if (!childrenArray) {
             childrenArray = InspectorArray::create();
-            frameObject->setArray("children", childrenArray);
+            result->setArray("childFrames", childrenArray);
         }
-        childrenArray->pushObject(buildObjectForFrameTree(child, dumpResources));
+        childrenArray->pushObject(buildObjectForFrameTree(child));
     }
-    return frameObject;
+    return result;
 }
 
 void InspectorResourceAgent::didCommitLoad(DocumentLoader* loader)
 {
-    m_frontend->didCommitLoadForFrame(buildObjectForFrame(loader->frame()), buildObjectForDocumentLoader(loader));
+    m_frontend->frameNavigated(buildObjectForFrame(loader->frame()), pointerAsId(loader));
 }
 
 void InspectorResourceAgent::frameDetachedFromParent(Frame* frame)
 {
-    m_frontend->frameDetachedFromParent(frameId(frame));
+    m_frontend->frameDetached(pointerAsId(frame));
 }
 
 #if ENABLE(WEB_SOCKETS)
@@ -456,63 +416,58 @@ void InspectorResourceAgent::frameDetachedFromParent(Frame* frame)
 static String createReadableStringFromBinary(const unsigned char* value, size_t length)
 {
     ASSERT(length > 0);
-    static const char hexDigits[17] = "0123456789ABCDEF";
-    size_t bufferSize = length * 3 - 1;
-    StringBuffer buffer(bufferSize);
-    size_t index = 0;
+    StringBuilder builder;
+    builder.reserveCapacity(length * 3 - 1);
     for (size_t i = 0; i < length; ++i) {
         if (i > 0)
-            buffer[index++] = ':';
-        buffer[index++] = hexDigits[value[i] >> 4];
-        buffer[index++] = hexDigits[value[i] & 0xF];
+            builder.append(':');
+        appendByteAsHex(value[i], builder);
     }
-    ASSERT(index == bufferSize);
-    return String::adopt(buffer);
+    return builder.toString();
 }
 
 void InspectorResourceAgent::didCreateWebSocket(unsigned long identifier, const KURL& requestURL)
 {
-    m_frontend->didCreateWebSocket(identifier, requestURL.string());
+    m_frontend->webSocketCreated(static_cast<int>(identifier), requestURL.string());
 }
 
 void InspectorResourceAgent::willSendWebSocketHandshakeRequest(unsigned long identifier, const WebSocketHandshakeRequest& request)
 {
     RefPtr<InspectorObject> requestObject = InspectorObject::create();
-    requestObject->setObject("webSocketHeaderFields", buildObjectForHeaders(request.headerFields()));
-    requestObject->setString("webSocketRequestKey3", createReadableStringFromBinary(request.key3().value, sizeof(request.key3().value)));
-    m_frontend->willSendWebSocketHandshakeRequest(identifier, currentTime(), requestObject);
+    requestObject->setObject("headers", buildObjectForHeaders(request.headerFields()));
+    requestObject->setString("requestKey3", createReadableStringFromBinary(request.key3().value, sizeof(request.key3().value)));
+    m_frontend->webSocketWillSendHandshakeRequest(static_cast<int>(identifier), currentTime(), requestObject);
 }
 
 void InspectorResourceAgent::didReceiveWebSocketHandshakeResponse(unsigned long identifier, const WebSocketHandshakeResponse& response)
 {
     RefPtr<InspectorObject> responseObject = InspectorObject::create();
-    responseObject->setNumber("statusCode", response.statusCode());
+    responseObject->setNumber("status", response.statusCode());
     responseObject->setString("statusText", response.statusText());
-    responseObject->setObject("webSocketHeaderFields", buildObjectForHeaders(response.headerFields()));
-    responseObject->setString("webSocketChallengeResponse", createReadableStringFromBinary(response.challengeResponse().value, sizeof(response.challengeResponse().value)));
-    m_frontend->didReceiveWebSocketHandshakeResponse(identifier, currentTime(), responseObject);
+    responseObject->setObject("headers", buildObjectForHeaders(response.headerFields()));
+    responseObject->setString("challengeResponse", createReadableStringFromBinary(response.challengeResponse().value, sizeof(response.challengeResponse().value)));
+    m_frontend->webSocketHandshakeResponseReceived(static_cast<int>(identifier), currentTime(), responseObject);
 }
 
 void InspectorResourceAgent::didCloseWebSocket(unsigned long identifier)
 {
-    m_frontend->didCloseWebSocket(identifier, currentTime());
+    m_frontend->webSocketClosed(static_cast<int>(identifier), currentTime());
 }
 #endif // ENABLE(WEB_SOCKETS)
 
-Frame* InspectorResourceAgent::frameForId(unsigned long frameId)
+Frame* InspectorResourceAgent::frameForId(const String& frameId)
 {
     Frame* mainFrame = m_page->mainFrame();
     for (Frame* frame = mainFrame; frame; frame = frame->tree()->traverseNext(mainFrame)) {
-        if (reinterpret_cast<uintptr_t>(frame) == frameId)
+        if (pointerAsId(frame) == frameId)
             return frame;
     }
     return 0;
 }
 
-void InspectorResourceAgent::enable(ErrorString*, RefPtr<InspectorObject>* object)
+void InspectorResourceAgent::enable(ErrorString*)
 {
     enable();
-    *object = buildObjectForFrameTree(m_page->mainFrame(), true);
 }
 
 void InspectorResourceAgent::enable()
@@ -529,17 +484,27 @@ void InspectorResourceAgent::disable(ErrorString*)
     m_instrumentingAgents->setInspectorResourceAgent(0);
 }
 
-void InspectorResourceAgent::resourceContent(ErrorString*, unsigned long frameId, const String& url, bool base64Encode, bool* success, String* content)
+void InspectorResourceAgent::getCachedResources(ErrorString*, RefPtr<InspectorObject>* object)
+{
+    *object = buildObjectForFrameTree(m_page->mainFrame());
+}
+
+void InspectorResourceAgent::getResourceContent(ErrorString* errorString, const String& frameId, const String& url, bool base64Encode, String* content)
 {
     Frame* frame = frameForId(frameId);
     if (!frame) {
-        *success = false;
+        *errorString = "No frame for given id found.";
         return;
     }
     if (base64Encode)
-        *success = InspectorResourceAgent::resourceContentBase64(frame, KURL(ParsedURLString, url), content);
+        InspectorResourceAgent::resourceContentBase64(errorString, frame, KURL(ParsedURLString, url), content);
     else
-        *success = InspectorResourceAgent::resourceContent(frame, KURL(ParsedURLString, url), content);
+        InspectorResourceAgent::resourceContent(errorString, frame, KURL(ParsedURLString, url), content);
+}
+
+void InspectorResourceAgent::setExtraHeaders(ErrorString*, PassRefPtr<InspectorObject> headers)
+{
+    m_state->setObject(ResourceAgentState::extraRequestHeaders, headers);
 }
 
 InspectorResourceAgent::InspectorResourceAgent(InstrumentingAgents* instrumentingAgents, Page* page, InspectorState* state)
diff --git a/Source/WebCore/inspector/InspectorResourceAgent.h b/Source/WebCore/inspector/InspectorResourceAgent.h
index f1b3d46..c919469 100644
--- a/Source/WebCore/inspector/InspectorResourceAgent.h
+++ b/Source/WebCore/inspector/InspectorResourceAgent.h
@@ -81,18 +81,17 @@ public:
 
     static PassRefPtr<InspectorResourceAgent> restore(Page*, InspectorState*, InspectorFrontend*);
 
-    static bool resourceContent(Frame*, const KURL&, String* result);
-    static bool resourceContentBase64(Frame*, const KURL&, String* result);
+    static void resourceContent(ErrorString*, Frame*, const KURL&, String* result);
+    static void resourceContentBase64(ErrorString*, Frame*, const KURL&, String* result);
     static PassRefPtr<SharedBuffer> resourceData(Frame*, const KURL&, String* textEncodingName);
     static CachedResource* cachedResource(Frame*, const KURL&);
 
     ~InspectorResourceAgent();
 
-    void identifierForInitialRequest(unsigned long identifier, const KURL&, DocumentLoader*);
-    void willSendRequest(unsigned long identifier, ResourceRequest&, const ResourceResponse& redirectResponse);
+    void willSendRequest(unsigned long identifier, DocumentLoader*, ResourceRequest&, const ResourceResponse& redirectResponse);
     void markResourceAsCached(unsigned long identifier);
     void didReceiveResponse(unsigned long identifier, DocumentLoader* laoder, const ResourceResponse&);
-    void didReceiveContentLength(unsigned long identifier, int lengthReceived);
+    void didReceiveContentLength(unsigned long identifier, int dataLength, int lengthReceived);
     void didFinishLoading(unsigned long identifier, double finishTime);
     void didFailLoading(unsigned long identifier, const ResourceError&);
     void didLoadResourceFromMemoryCache(DocumentLoader*, const CachedResource*);
@@ -107,12 +106,13 @@ public:
     void didCloseWebSocket(unsigned long identifier);
 #endif
 
-    Frame* frameForId(unsigned long);
+    Frame* frameForId(const String& frameId);
 
     // Called from frontend 
-    void enable(ErrorString*, RefPtr<InspectorObject>*);
+    void enable(ErrorString*);
     void disable(ErrorString*);
-    void resourceContent(ErrorString*, unsigned long frameId, const String& url, bool base64Encode, bool* resourceFound, String* content);
+    void getCachedResources(ErrorString*, RefPtr<InspectorObject>*);
+    void getResourceContent(ErrorString*, const String& frameId, const String& url, bool base64Encode, String* content);
     void setExtraHeaders(ErrorString*, PassRefPtr<InspectorObject>);
 
 private:
diff --git a/Source/WebCore/inspector/InspectorRuntimeAgent.cpp b/Source/WebCore/inspector/InspectorRuntimeAgent.cpp
index badd8e1..04fed9d 100644
--- a/Source/WebCore/inspector/InspectorRuntimeAgent.cpp
+++ b/Source/WebCore/inspector/InspectorRuntimeAgent.cpp
@@ -33,56 +33,71 @@
 
 #if ENABLE(INSPECTOR)
 
-#include "InjectedScriptHost.h"
+#include "InjectedScript.h"
+#include "InjectedScriptManager.h"
 #include "InspectorValues.h"
+#include "Page.h"
+#include <wtf/PassOwnPtr.h>
+#include <wtf/PassRefPtr.h>
 
 namespace WebCore {
 
-InspectorRuntimeAgent::InspectorRuntimeAgent(InjectedScriptHost* injectedScriptHost)
-    : m_injectedScriptHost(injectedScriptHost)
+PassOwnPtr<InspectorRuntimeAgent> InspectorRuntimeAgent::create(InjectedScriptManager* injectedScriptManager, Page* inspectedPage)
 {
+    return adoptPtr(new InspectorRuntimeAgent(injectedScriptManager, inspectedPage));
 }
 
-InspectorRuntimeAgent::~InspectorRuntimeAgent() { }
+InspectorRuntimeAgent::InspectorRuntimeAgent(InjectedScriptManager* injectedScriptManager, Page* inspectedPage)
+    : m_injectedScriptManager(injectedScriptManager)
+    , m_inspectedPage(inspectedPage)
+{
+}
+
+InspectorRuntimeAgent::~InspectorRuntimeAgent()
+{
+}
 
-void InspectorRuntimeAgent::evaluate(ErrorString*, const String& expression, const String& objectGroup, bool includeCommandLineAPI, RefPtr<InspectorValue>* result)
+void InspectorRuntimeAgent::evaluate(ErrorString* errorString, const String& expression, const String& objectGroup, bool includeCommandLineAPI, RefPtr<InspectorObject>* result)
 {
-    InjectedScript injectedScript = m_injectedScriptHost->injectedScriptForMainFrame();
+    ScriptState* scriptState = mainWorldScriptState(m_inspectedPage->mainFrame());
+    InjectedScript injectedScript = m_injectedScriptManager->injectedScriptFor(scriptState);
     if (!injectedScript.hasNoValue())
-        injectedScript.evaluate(expression, objectGroup, includeCommandLineAPI, result);
+        injectedScript.evaluate(errorString, expression, objectGroup, includeCommandLineAPI, result);
 }
 
-void InspectorRuntimeAgent::evaluateOn(ErrorString*, PassRefPtr<InspectorObject> objectId, const String& expression, RefPtr<InspectorValue>* result)
+void InspectorRuntimeAgent::evaluateOn(ErrorString* errorString, const String& objectId, const String& expression, RefPtr<InspectorObject>* result)
 {
-    InjectedScript injectedScript = m_injectedScriptHost->injectedScriptForObjectId(objectId.get());
+    InjectedScript injectedScript = m_injectedScriptManager->injectedScriptForObjectId(objectId);
     if (!injectedScript.hasNoValue())
-        injectedScript.evaluateOn(objectId, expression, result);
+        injectedScript.evaluateOn(errorString, objectId, expression, result);
 }
 
-void InspectorRuntimeAgent::getProperties(ErrorString*, PassRefPtr<InspectorObject> objectId, bool ignoreHasOwnProperty, bool abbreviate, RefPtr<InspectorValue>* result)
+void InspectorRuntimeAgent::getProperties(ErrorString* errorString, const String& objectId, bool ignoreHasOwnProperty, bool abbreviate, RefPtr<InspectorArray>* result)
 {
-    InjectedScript injectedScript = m_injectedScriptHost->injectedScriptForObjectId(objectId.get());
+    InjectedScript injectedScript = m_injectedScriptManager->injectedScriptForObjectId(objectId);
     if (!injectedScript.hasNoValue())
-        injectedScript.getProperties(objectId, ignoreHasOwnProperty, abbreviate, result);
+        injectedScript.getProperties(errorString, objectId, ignoreHasOwnProperty, abbreviate, result);
 }
 
-void InspectorRuntimeAgent::setPropertyValue(ErrorString*, PassRefPtr<InspectorObject> objectId, const String& propertyName, const String& expression, RefPtr<InspectorValue>* result)
+void InspectorRuntimeAgent::setPropertyValue(ErrorString* errorString, const String& objectId, const String& propertyName, const String& expression)
 {
-    InjectedScript injectedScript = m_injectedScriptHost->injectedScriptForObjectId(objectId.get());
+    InjectedScript injectedScript = m_injectedScriptManager->injectedScriptForObjectId(objectId);
     if (!injectedScript.hasNoValue())
-        injectedScript.setPropertyValue(objectId, propertyName, expression, result);
+        injectedScript.setPropertyValue(errorString, objectId, propertyName, expression);
+    else
+        *errorString = "No injected script found.";
 }
 
-void InspectorRuntimeAgent::releaseObject(ErrorString*, PassRefPtr<InspectorObject> objectId)
+void InspectorRuntimeAgent::releaseObject(ErrorString*, const String& objectId)
 {
-    InjectedScript injectedScript = m_injectedScriptHost->injectedScriptForObjectId(objectId.get());
+    InjectedScript injectedScript = m_injectedScriptManager->injectedScriptForObjectId(objectId);
     if (!injectedScript.hasNoValue())
         injectedScript.releaseObject(objectId);
 }
 
-void InspectorRuntimeAgent::releaseObjectGroup(ErrorString*, long injectedScriptId, const String& objectGroup)
+void InspectorRuntimeAgent::releaseObjectGroup(ErrorString*, const String& objectGroup)
 {
-    m_injectedScriptHost->releaseObjectGroup(injectedScriptId, objectGroup);
+    m_injectedScriptManager->releaseObjectGroup(objectGroup);
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/inspector/InspectorRuntimeAgent.h b/Source/WebCore/inspector/InspectorRuntimeAgent.h
index 4274eea..48f3670 100644
--- a/Source/WebCore/inspector/InspectorRuntimeAgent.h
+++ b/Source/WebCore/inspector/InspectorRuntimeAgent.h
@@ -33,43 +33,38 @@
 
 #if ENABLE(INSPECTOR)
 
-#include "InjectedScript.h"
-#include "PlatformString.h"
-
+#include <wtf/Forward.h>
 #include <wtf/Noncopyable.h>
-#include <wtf/PassOwnPtr.h>
-#include <wtf/PassRefPtr.h>
 
 namespace WebCore {
 
-class InjectedScriptHost;
+class InjectedScriptManager;
+class InspectorArray;
 class InspectorObject;
 class InspectorValue;
+class Page;
 
 typedef String ErrorString;
 
 class InspectorRuntimeAgent {
     WTF_MAKE_NONCOPYABLE(InspectorRuntimeAgent);
 public:
-    static PassOwnPtr<InspectorRuntimeAgent> create(InjectedScriptHost* injectedScriptHost)
-    {
-        return adoptPtr(new InspectorRuntimeAgent(injectedScriptHost));
-    }
-
+    static PassOwnPtr<InspectorRuntimeAgent> create(InjectedScriptManager*, Page*);
     ~InspectorRuntimeAgent();
 
     // Part of the protocol.
-    void evaluate(ErrorString*, const String& expression, const String& objectGroup, bool includeCommandLineAPI, RefPtr<InspectorValue>* result);
-    void evaluateOn(ErrorString*, PassRefPtr<InspectorObject> objectId, const String& expression, RefPtr<InspectorValue>* result);
-    void releaseObject(ErrorString*, PassRefPtr<InspectorObject> objectId);
-    void getProperties(ErrorString*, PassRefPtr<InspectorObject> objectId, bool ignoreHasOwnProperty, bool abbreviate, RefPtr<InspectorValue>* result);
-    void setPropertyValue(ErrorString*, PassRefPtr<InspectorObject> objectId, const String& propertyName, const String& expression, RefPtr<InspectorValue>* result);
-    void releaseObjectGroup(ErrorString*, long injectedScriptId, const String& objectGroup);
+    void evaluate(ErrorString*, const String& expression, const String& objectGroup, bool includeCommandLineAPI, RefPtr<InspectorObject>* result);
+    void evaluateOn(ErrorString*, const String& objectId, const String& expression, RefPtr<InspectorObject>* result);
+    void releaseObject(ErrorString*, const String& objectId);
+    void getProperties(ErrorString*, const String& objectId, bool ignoreHasOwnProperty, bool abbreviate, RefPtr<InspectorArray>* result);
+    void setPropertyValue(ErrorString*, const String& objectId, const String& propertyName, const String& expression);
+    void releaseObjectGroup(ErrorString*, const String& objectGroup);
 
 private:
-    InspectorRuntimeAgent(InjectedScriptHost*);
+    InspectorRuntimeAgent(InjectedScriptManager*, Page*);
 
-    InjectedScriptHost* m_injectedScriptHost;
+    InjectedScriptManager* m_injectedScriptManager;
+    Page* m_inspectedPage;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/inspector/InspectorStyleSheet.cpp b/Source/WebCore/inspector/InspectorStyleSheet.cpp
index 45e6e43..342cf54 100644
--- a/Source/WebCore/inspector/InspectorStyleSheet.cpp
+++ b/Source/WebCore/inspector/InspectorStyleSheet.cpp
@@ -450,13 +450,19 @@ void InspectorStyle::populateObjectWithStyleProperties(InspectorObject* result)
 
         RefPtr<InspectorObject> property = InspectorObject::create();
         propertiesObject->pushObject(property);
-        property->setString("status", it->disabled ? "disabled" : "active");
-        property->setBoolean("parsedOk", propertyEntry.parsedOk);
+        String status = it->disabled ? "disabled" : "active";
+
+        // Default "parsedOk" == true.
+        if (!propertyEntry.parsedOk)
+            property->setBoolean("parsedOk", false);
         if (it->hasRawText())
             property->setString("text", it->rawText);
         property->setString("name", name);
         property->setString("value", propertyEntry.value);
-        property->setString("priority", propertyEntry.important ? "important" : "");
+
+        // Default "priority" == "".
+        if (propertyEntry.important)
+            property->setString("priority", "important");
         if (!it->disabled) {
             if (it->hasSource) {
                 property->setBoolean("implicit", false);
@@ -481,25 +487,35 @@ void InspectorStyle::populateObjectWithStyleProperties(InspectorObject* result)
 
                 if (shouldInactivate) {
                     activeIt->second->setString("status", "inactive");
-                    activeIt->second->setString("shorthandName", "");
+                    activeIt->second->remove("shorthandName");
                     propertyNameToPreviousActiveProperty.set(name, property);
                 }
             } else {
-                property->setBoolean("implicit", m_style->isPropertyImplicit(name));
-                property->setString("status", "style");
+                bool implicit = m_style->isPropertyImplicit(name);
+                // Default "implicit" == false.
+                if (implicit)
+                    property->setBoolean("implicit", true);
+                status = "";
             }
         }
 
+        // Default "status" == "style".
+        if (!status.isEmpty())
+            property->setString("status", status);
+
         if (propertyEntry.parsedOk) {
             // Both for style-originated and parsed source properties.
             String shorthand = m_style->getPropertyShorthand(name);
-            property->setString("shorthandName", shorthand);
-            if (!shorthand.isEmpty() && !foundShorthands.contains(shorthand)) {
-                foundShorthands.add(shorthand);
-                shorthandValues->setString(shorthand, shorthandValue(shorthand));
+            if (!shorthand.isEmpty()) {
+                // Default "shorthandName" == "".
+                property->setString("shorthandName", shorthand);
+                if (!foundShorthands.contains(shorthand)) {
+                    foundShorthands.add(shorthand);
+                    shorthandValues->setString(shorthand, shorthandValue(shorthand));
+                }
             }
-        } else
-            property->setString("shorthandName", "");
+        }
+        // else shorthandName is not set
     }
 
     result->setArray("cssProperties", propertiesObject);
@@ -692,9 +708,7 @@ PassRefPtr<InspectorObject> InspectorStyleSheet::buildObjectForStyleSheet()
         return 0;
 
     RefPtr<InspectorObject> result = InspectorObject::create();
-    result->setBoolean("disabled", styleSheet->disabled());
-    result->setString("sourceURL", finalURL());
-    result->setString("title", styleSheet->title());
+    result->setString("styleSheetId", id());
     RefPtr<CSSRuleList> cssRuleList = CSSRuleList::create(styleSheet, true);
     RefPtr<InspectorArray> cssRules = buildArrayForRuleList(cssRuleList.get());
     result->setArray("rules", cssRules.release());
@@ -704,8 +718,20 @@ PassRefPtr<InspectorObject> InspectorStyleSheet::buildObjectForStyleSheet()
     if (success)
         result->setString("text", styleSheetText);
 
-    result->setString("styleSheetId", id());
+    return result.release();
+}
+
+PassRefPtr<InspectorObject> InspectorStyleSheet::buildObjectForStyleSheetInfo()
+{
+    CSSStyleSheet* styleSheet = pageStyleSheet();
+    if (!styleSheet)
+        return 0;
 
+    RefPtr<InspectorObject> result = InspectorObject::create();
+    result->setString("styleSheetId", id());
+    result->setBoolean("disabled", styleSheet->disabled());
+    result->setString("sourceURL", finalURL());
+    result->setString("title", styleSheet->title());
     return result.release();
 }
 
@@ -1017,7 +1043,9 @@ bool InspectorStyleSheet::resourceStyleSheetText(String* result) const
     if (!m_pageStyleSheet || !ownerDocument())
         return false;
 
-    return InspectorResourceAgent::resourceContent(ownerDocument()->frame(), m_pageStyleSheet->finalURL(), result);
+    String error;
+    InspectorResourceAgent::resourceContent(&error, ownerDocument()->frame(), m_pageStyleSheet->finalURL(), result);
+    return error.isEmpty();
 }
 
 bool InspectorStyleSheet::inlineStyleSheetText(String* result) const
diff --git a/Source/WebCore/inspector/InspectorStyleSheet.h b/Source/WebCore/inspector/InspectorStyleSheet.h
index 92318cb..3048b1b 100644
--- a/Source/WebCore/inspector/InspectorStyleSheet.h
+++ b/Source/WebCore/inspector/InspectorStyleSheet.h
@@ -168,6 +168,7 @@ public:
     CSSStyleRule* addRule(const String& selector);
     CSSStyleRule* ruleForId(const InspectorCSSId&) const;
     PassRefPtr<InspectorObject> buildObjectForStyleSheet();
+    PassRefPtr<InspectorObject> buildObjectForStyleSheetInfo();
     PassRefPtr<InspectorObject> buildObjectForRule(CSSStyleRule*);
     PassRefPtr<InspectorObject> buildObjectForStyle(CSSStyleDeclaration*);
     bool setPropertyText(const InspectorCSSId&, unsigned propertyIndex, const String& text, bool overwrite);
diff --git a/Source/WebCore/inspector/InspectorTimelineAgent.cpp b/Source/WebCore/inspector/InspectorTimelineAgent.cpp
index d45a507..2faad67 100644
--- a/Source/WebCore/inspector/InspectorTimelineAgent.cpp
+++ b/Source/WebCore/inspector/InspectorTimelineAgent.cpp
@@ -50,6 +50,36 @@ namespace TimelineAgentState {
 static const char timelineAgentEnabled[] = "timelineAgentEnabled";
 }
 
+namespace TimelineRecordType {
+static const char EventDispatch[] = "EventDispatch";
+static const char Layout[] = "Layout";
+static const char RecalculateStyles[] = "RecalculateStyles";
+static const char Paint[] = "Paint";
+static const char ParseHTML[] = "ParseHTML";
+
+static const char TimerInstall[] = "TimerInstall";
+static const char TimerRemove[] = "TimerRemove";
+static const char TimerFire[] = "TimerFire";
+
+static const char EvaluateScript[] = "EvaluateScript";
+
+static const char MarkLoad[] = "MarkLoad";
+static const char MarkDOMContent[] = "MarkDOMContent";
+static const char MarkTimeline[] = "MarkTimeline";
+
+static const char ScheduleResourceRequest[] = "ScheduleResourceRequest";
+static const char ResourceSendRequest[] = "ResourceSendRequest";
+static const char ResourceReceiveResponse[] = "ResourceReceiveResponse";
+static const char ResourceReceivedData[] = "ResourceReceivedData";
+static const char ResourceFinish[] = "ResourceFinish";
+
+static const char XHRReadyStateChange[] = "XHRReadyStateChange";
+static const char XHRLoad[] = "XHRLoad";
+
+static const char FunctionCall[] = "FunctionCall";
+static const char GCEvent[] = "GCEvent";
+}
+
 void InspectorTimelineAgent::pushGCEventRecords()
 {
     if (!m_gcEvents.size())
@@ -61,7 +91,7 @@ void InspectorTimelineAgent::pushGCEventRecords()
         RefPtr<InspectorObject> record = TimelineRecordFactory::createGenericRecord(i->startTime);
         record->setObject("data", TimelineRecordFactory::createGCEventData(i->collectedBytes));
         record->setNumber("endTime", i->endTime);
-        addRecordToTimeline(record.release(), GCEventTimelineRecordType);
+        addRecordToTimeline(record.release(), TimelineRecordType::GCEvent);
     }
 }
 
@@ -101,7 +131,7 @@ void InspectorTimelineAgent::start(ErrorString*)
         return;
     m_instrumentingAgents->setInspectorTimelineAgent(this);
     ScriptGCEvent::addEventListener(this);
-    m_frontend->timelineProfilerWasStarted();
+    m_frontend->started();
     m_state->setBoolean(TimelineAgentState::timelineAgentEnabled, true);
 }
 
@@ -111,7 +141,7 @@ void InspectorTimelineAgent::stop(ErrorString*)
         return;
     m_instrumentingAgents->setInspectorTimelineAgent(0);
     if (m_frontend)
-        m_frontend->timelineProfilerWasStopped();
+        m_frontend->stopped();
     ScriptGCEvent::removeEventListener(this);
 
     clearRecordStack();
@@ -127,58 +157,58 @@ bool InspectorTimelineAgent::started() const
 
 void InspectorTimelineAgent::willCallFunction(const String& scriptName, int scriptLine)
 {
-    pushCurrentRecord(TimelineRecordFactory::createFunctionCallData(scriptName, scriptLine), FunctionCallTimelineRecordType);
+    pushCurrentRecord(TimelineRecordFactory::createFunctionCallData(scriptName, scriptLine), TimelineRecordType::FunctionCall);
 }
 
 void InspectorTimelineAgent::didCallFunction()
 {
-    didCompleteCurrentRecord(FunctionCallTimelineRecordType);
+    didCompleteCurrentRecord(TimelineRecordType::FunctionCall);
 }
 
 void InspectorTimelineAgent::willDispatchEvent(const Event& event)
 {
     pushCurrentRecord(TimelineRecordFactory::createEventDispatchData(event),
-        EventDispatchTimelineRecordType);
+        TimelineRecordType::EventDispatch);
 }
 
 void InspectorTimelineAgent::didDispatchEvent()
 {
-    didCompleteCurrentRecord(EventDispatchTimelineRecordType);
+    didCompleteCurrentRecord(TimelineRecordType::EventDispatch);
 }
 
 void InspectorTimelineAgent::willLayout()
 {
-    pushCurrentRecord(InspectorObject::create(), LayoutTimelineRecordType);
+    pushCurrentRecord(InspectorObject::create(), TimelineRecordType::Layout);
 }
 
 void InspectorTimelineAgent::didLayout()
 {
-    didCompleteCurrentRecord(LayoutTimelineRecordType);
+    didCompleteCurrentRecord(TimelineRecordType::Layout);
 }
 
 void InspectorTimelineAgent::willRecalculateStyle()
 {
-    pushCurrentRecord(InspectorObject::create(), RecalculateStylesTimelineRecordType);
+    pushCurrentRecord(InspectorObject::create(), TimelineRecordType::RecalculateStyles);
 }
 
 void InspectorTimelineAgent::didRecalculateStyle()
 {
-    didCompleteCurrentRecord(RecalculateStylesTimelineRecordType);
+    didCompleteCurrentRecord(TimelineRecordType::RecalculateStyles);
 }
 
 void InspectorTimelineAgent::willPaint(const IntRect& rect)
 {
-    pushCurrentRecord(TimelineRecordFactory::createPaintData(rect), PaintTimelineRecordType);
+    pushCurrentRecord(TimelineRecordFactory::createPaintData(rect), TimelineRecordType::Paint);
 }
 
 void InspectorTimelineAgent::didPaint()
 {
-    didCompleteCurrentRecord(PaintTimelineRecordType);
+    didCompleteCurrentRecord(TimelineRecordType::Paint);
 }
 
 void InspectorTimelineAgent::willWriteHTML(unsigned int length, unsigned int startLine)
 {
-    pushCurrentRecord(TimelineRecordFactory::createParseHTMLData(length, startLine), ParseHTMLTimelineRecordType);
+    pushCurrentRecord(TimelineRecordFactory::createParseHTMLData(length, startLine), TimelineRecordType::ParseHTML);
 }
 
 void InspectorTimelineAgent::didWriteHTML(unsigned int endLine)
@@ -186,7 +216,7 @@ void InspectorTimelineAgent::didWriteHTML(unsigned int endLine)
     if (!m_recordStack.isEmpty()) {
         TimelineRecordEntry entry = m_recordStack.last();
         entry.data->setNumber("endLine", endLine);
-        didCompleteCurrentRecord(ParseHTMLTimelineRecordType);
+        didCompleteCurrentRecord(TimelineRecordType::ParseHTML);
     }
 }
 
@@ -195,7 +225,7 @@ void InspectorTimelineAgent::didInstallTimer(int timerId, int timeout, bool sing
     pushGCEventRecords();
     RefPtr<InspectorObject> record = TimelineRecordFactory::createGenericRecord(WTF::currentTimeMS());
     record->setObject("data", TimelineRecordFactory::createTimerInstallData(timerId, timeout, singleShot));
-    addRecordToTimeline(record.release(), TimerInstallTimelineRecordType);
+    addRecordToTimeline(record.release(), TimelineRecordType::TimerInstall);
 }
 
 void InspectorTimelineAgent::didRemoveTimer(int timerId)
@@ -203,47 +233,47 @@ void InspectorTimelineAgent::didRemoveTimer(int timerId)
     pushGCEventRecords();
     RefPtr<InspectorObject> record = TimelineRecordFactory::createGenericRecord(WTF::currentTimeMS());
     record->setObject("data", TimelineRecordFactory::createGenericTimerData(timerId));
-    addRecordToTimeline(record.release(), TimerRemoveTimelineRecordType);
+    addRecordToTimeline(record.release(), TimelineRecordType::TimerRemove);
 }
 
 void InspectorTimelineAgent::willFireTimer(int timerId)
 {
-    pushCurrentRecord(TimelineRecordFactory::createGenericTimerData(timerId), TimerFireTimelineRecordType);
+    pushCurrentRecord(TimelineRecordFactory::createGenericTimerData(timerId), TimelineRecordType::TimerFire);
 }
 
 void InspectorTimelineAgent::didFireTimer()
 {
-    didCompleteCurrentRecord(TimerFireTimelineRecordType);
+    didCompleteCurrentRecord(TimelineRecordType::TimerFire);
 }
 
 void InspectorTimelineAgent::willChangeXHRReadyState(const String& url, int readyState)
 {
-    pushCurrentRecord(TimelineRecordFactory::createXHRReadyStateChangeData(url, readyState), XHRReadyStateChangeRecordType);
+    pushCurrentRecord(TimelineRecordFactory::createXHRReadyStateChangeData(url, readyState), TimelineRecordType::XHRReadyStateChange);
 }
 
 void InspectorTimelineAgent::didChangeXHRReadyState()
 {
-    didCompleteCurrentRecord(XHRReadyStateChangeRecordType);
+    didCompleteCurrentRecord(TimelineRecordType::XHRReadyStateChange);
 }
 
 void InspectorTimelineAgent::willLoadXHR(const String& url) 
 {
-    pushCurrentRecord(TimelineRecordFactory::createXHRLoadData(url), XHRLoadRecordType);
+    pushCurrentRecord(TimelineRecordFactory::createXHRLoadData(url), TimelineRecordType::XHRLoad);
 }
 
 void InspectorTimelineAgent::didLoadXHR()
 {
-    didCompleteCurrentRecord(XHRLoadRecordType);
+    didCompleteCurrentRecord(TimelineRecordType::XHRLoad);
 }
 
 void InspectorTimelineAgent::willEvaluateScript(const String& url, int lineNumber)
 {
-    pushCurrentRecord(TimelineRecordFactory::createEvaluateScriptData(url, lineNumber), EvaluateScriptTimelineRecordType);
+    pushCurrentRecord(TimelineRecordFactory::createEvaluateScriptData(url, lineNumber), TimelineRecordType::EvaluateScript);
 }
     
 void InspectorTimelineAgent::didEvaluateScript()
 {
-    didCompleteCurrentRecord(EvaluateScriptTimelineRecordType);
+    didCompleteCurrentRecord(TimelineRecordType::EvaluateScript);
 }
 
 void InspectorTimelineAgent::didScheduleResourceRequest(const String& url)
@@ -251,8 +281,8 @@ void InspectorTimelineAgent::didScheduleResourceRequest(const String& url)
     pushGCEventRecords();
     RefPtr<InspectorObject> record = TimelineRecordFactory::createGenericRecord(WTF::currentTimeMS());
     record->setObject("data", TimelineRecordFactory::createScheduleResourceRequestData(url));
-    record->setNumber("type", ScheduleResourceRequestTimelineRecordType);
-    addRecordToTimeline(record.release(), ScheduleResourceRequestTimelineRecordType);
+    record->setString("type", TimelineRecordType::ScheduleResourceRequest);
+    addRecordToTimeline(record.release(), TimelineRecordType::ScheduleResourceRequest);
 }
 
 void InspectorTimelineAgent::willSendResourceRequest(unsigned long identifier, const ResourceRequest& request)
@@ -260,29 +290,29 @@ void InspectorTimelineAgent::willSendResourceRequest(unsigned long identifier, c
     pushGCEventRecords();
     RefPtr<InspectorObject> record = TimelineRecordFactory::createGenericRecord(WTF::currentTimeMS());
     record->setObject("data", TimelineRecordFactory::createResourceSendRequestData(identifier, request));
-    record->setNumber("type", ResourceSendRequestTimelineRecordType);
+    record->setString("type", TimelineRecordType::ResourceSendRequest);
     setHeapSizeStatistic(record.get());
-    m_frontend->addRecordToTimeline(record.release());
+    m_frontend->eventRecorded(record.release());
 }
 
 void InspectorTimelineAgent::willReceiveResourceData(unsigned long identifier)
 {
-    pushCurrentRecord(TimelineRecordFactory::createReceiveResourceData(identifier), ReceiveResourceDataTimelineRecordType);
+    pushCurrentRecord(TimelineRecordFactory::createReceiveResourceData(identifier), TimelineRecordType::ResourceReceivedData);
 }
 
 void InspectorTimelineAgent::didReceiveResourceData()
 {
-    didCompleteCurrentRecord(ReceiveResourceDataTimelineRecordType);
+    didCompleteCurrentRecord(TimelineRecordType::ResourceReceivedData);
 }
     
 void InspectorTimelineAgent::willReceiveResourceResponse(unsigned long identifier, const ResourceResponse& response)
 {
-    pushCurrentRecord(TimelineRecordFactory::createResourceReceiveResponseData(identifier, response), ResourceReceiveResponseTimelineRecordType);
+    pushCurrentRecord(TimelineRecordFactory::createResourceReceiveResponseData(identifier, response), TimelineRecordType::ResourceReceiveResponse);
 }
 
 void InspectorTimelineAgent::didReceiveResourceResponse()
 {
-    didCompleteCurrentRecord(ResourceReceiveResponseTimelineRecordType);
+    didCompleteCurrentRecord(TimelineRecordType::ResourceReceiveResponse);
 }
 
 void InspectorTimelineAgent::didFinishLoadingResource(unsigned long identifier, bool didFail, double finishTime)
@@ -291,9 +321,9 @@ void InspectorTimelineAgent::didFinishLoadingResource(unsigned long identifier,
     // Sometimes network stack can provide for us exact finish loading time. In the other case we will use currentTime.
     RefPtr<InspectorObject> record = TimelineRecordFactory::createGenericRecord(WTF::currentTimeMS());
     record->setObject("data", TimelineRecordFactory::createResourceFinishData(identifier, didFail, finishTime * 1000));
-    record->setNumber("type", ResourceFinishTimelineRecordType);
+    record->setString("type", TimelineRecordType::ResourceFinish);
     setHeapSizeStatistic(record.get());
-    m_frontend->addRecordToTimeline(record.release());
+    m_frontend->eventRecorded(record.release());
 }
 
 void InspectorTimelineAgent::didMarkTimeline(const String& message)
@@ -301,21 +331,21 @@ void InspectorTimelineAgent::didMarkTimeline(const String& message)
     pushGCEventRecords();
     RefPtr<InspectorObject> record = TimelineRecordFactory::createGenericRecord(WTF::currentTimeMS());
     record->setObject("data", TimelineRecordFactory::createMarkTimelineData(message));
-    addRecordToTimeline(record.release(), MarkTimelineRecordType);
+    addRecordToTimeline(record.release(), TimelineRecordType::MarkTimeline);
 }
 
 void InspectorTimelineAgent::didMarkDOMContentEvent()
 {
     pushGCEventRecords();
     RefPtr<InspectorObject> record = TimelineRecordFactory::createGenericRecord(WTF::currentTimeMS());
-    addRecordToTimeline(record.release(), MarkDOMContentEventType);
+    addRecordToTimeline(record.release(), TimelineRecordType::MarkDOMContent);
 }
 
 void InspectorTimelineAgent::didMarkLoadEvent()
 {
     pushGCEventRecords();
     RefPtr<InspectorObject> record = TimelineRecordFactory::createGenericRecord(WTF::currentTimeMS());
-    addRecordToTimeline(record.release(), MarkLoadEventType);
+    addRecordToTimeline(record.release(), TimelineRecordType::MarkLoad);
 }
 
 void InspectorTimelineAgent::didCommitLoad()
@@ -323,13 +353,13 @@ void InspectorTimelineAgent::didCommitLoad()
     clearRecordStack();
 }
 
-void InspectorTimelineAgent::addRecordToTimeline(PassRefPtr<InspectorObject> prpRecord, TimelineRecordType type)
+void InspectorTimelineAgent::addRecordToTimeline(PassRefPtr<InspectorObject> prpRecord, const String& type)
 {
     RefPtr<InspectorObject> record(prpRecord);
-    record->setNumber("type", type);
+    record->setString("type", type);
     setHeapSizeStatistic(record.get());
     if (m_recordStack.isEmpty())
-        m_frontend->addRecordToTimeline(record.release());
+        m_frontend->eventRecorded(record.release());
     else {
         TimelineRecordEntry parent = m_recordStack.last();
         parent.children->pushObject(record.release());
@@ -346,7 +376,7 @@ void InspectorTimelineAgent::setHeapSizeStatistic(InspectorObject* record)
     record->setNumber("totalHeapSize", totalHeapSize);
 }
 
-void InspectorTimelineAgent::didCompleteCurrentRecord(TimelineRecordType type)
+void InspectorTimelineAgent::didCompleteCurrentRecord(const String& type)
 {
     // An empty stack could merely mean that the timeline agent was turned on in the middle of
     // an event.  Don't treat as an error.
@@ -370,7 +400,7 @@ InspectorTimelineAgent::InspectorTimelineAgent(InstrumentingAgents* instrumentin
 {
 }
 
-void InspectorTimelineAgent::pushCurrentRecord(PassRefPtr<InspectorObject> data, TimelineRecordType type)
+void InspectorTimelineAgent::pushCurrentRecord(PassRefPtr<InspectorObject> data, const String& type)
 {
     pushGCEventRecords();
     RefPtr<InspectorObject> record = TimelineRecordFactory::createGenericRecord(WTF::currentTimeMS());
diff --git a/Source/WebCore/inspector/InspectorTimelineAgent.h b/Source/WebCore/inspector/InspectorTimelineAgent.h
index c4c0f3b..3d8e973 100644
--- a/Source/WebCore/inspector/InspectorTimelineAgent.h
+++ b/Source/WebCore/inspector/InspectorTimelineAgent.h
@@ -51,31 +51,6 @@ class ResourceResponse;
 
 typedef String ErrorString;
 
-// Must be kept in sync with TimelineAgent.js
-enum TimelineRecordType {
-    EventDispatchTimelineRecordType = 0,
-    LayoutTimelineRecordType = 1,
-    RecalculateStylesTimelineRecordType = 2,
-    PaintTimelineRecordType = 3,
-    ParseHTMLTimelineRecordType = 4,
-    TimerInstallTimelineRecordType = 5,
-    TimerRemoveTimelineRecordType = 6,
-    TimerFireTimelineRecordType = 7,
-    XHRReadyStateChangeRecordType = 8,
-    XHRLoadRecordType = 9,
-    EvaluateScriptTimelineRecordType = 10,
-    MarkTimelineRecordType = 11,
-    ResourceSendRequestTimelineRecordType = 12,
-    ResourceReceiveResponseTimelineRecordType = 13,
-    ResourceFinishTimelineRecordType = 14,
-    FunctionCallTimelineRecordType = 15,
-    ReceiveResourceDataTimelineRecordType = 16,
-    GCEventTimelineRecordType = 17,
-    MarkDOMContentEventType = 18,
-    MarkLoadEventType = 19,
-    ScheduleResourceRequestTimelineRecordType = 20
-};
-
 class InspectorTimelineAgent : ScriptGCEventListener {
     WTF_MAKE_NONCOPYABLE(InspectorTimelineAgent);
 public:
@@ -148,24 +123,24 @@ public:
 
 private:
     struct TimelineRecordEntry {
-        TimelineRecordEntry(PassRefPtr<InspectorObject> record, PassRefPtr<InspectorObject> data, PassRefPtr<InspectorArray> children, TimelineRecordType type)
+        TimelineRecordEntry(PassRefPtr<InspectorObject> record, PassRefPtr<InspectorObject> data, PassRefPtr<InspectorArray> children, const String& type)
             : record(record), data(data), children(children), type(type)
         {
         }
         RefPtr<InspectorObject> record;
         RefPtr<InspectorObject> data;
         RefPtr<InspectorArray> children;
-        TimelineRecordType type;
+        String type;
     };
         
     InspectorTimelineAgent(InstrumentingAgents*, InspectorState*);
 
-    void pushCurrentRecord(PassRefPtr<InspectorObject>, TimelineRecordType);
+    void pushCurrentRecord(PassRefPtr<InspectorObject>, const String& type);
     void setHeapSizeStatistic(InspectorObject* record);
         
-    void didCompleteCurrentRecord(TimelineRecordType);
+    void didCompleteCurrentRecord(const String& type);
 
-    void addRecordToTimeline(PassRefPtr<InspectorObject>, TimelineRecordType);
+    void addRecordToTimeline(PassRefPtr<InspectorObject>, const String& type);
 
     void pushGCEventRecords();
     void clearRecordStack();
diff --git a/Source/WebCore/inspector/InstrumentingAgents.h b/Source/WebCore/inspector/InstrumentingAgents.h
index c53ef00..3b67edd 100644
--- a/Source/WebCore/inspector/InstrumentingAgents.h
+++ b/Source/WebCore/inspector/InstrumentingAgents.h
@@ -36,7 +36,9 @@
 
 namespace WebCore {
 
+class InspectorAgent;
 class InspectorApplicationCacheAgent;
+class InspectorPageAgent;
 class InspectorBrowserDebuggerAgent;
 class InspectorCSSAgent;
 class InspectorConsoleAgent;
@@ -54,7 +56,9 @@ class InstrumentingAgents {
     WTF_MAKE_FAST_ALLOCATED;
 public:
     InstrumentingAgents()
-        : m_inspectorCSSAgent(0)
+        : m_inspectorAgent(0)
+        , m_inspectorPageAgent(0)
+        , m_inspectorCSSAgent(0)
         , m_inspectorConsoleAgent(0)
         , m_inspectorDOMAgent(0)
         , m_inspectorResourceAgent(0)
@@ -77,6 +81,12 @@ public:
     { }
     ~InstrumentingAgents() { }
 
+    InspectorAgent* inspectorAgent() const { return m_inspectorAgent; }
+    void setInspectorAgent(InspectorAgent* agent) { m_inspectorAgent = agent; }
+
+    InspectorPageAgent* inspectorPageAgent() const { return m_inspectorPageAgent; }
+    void setInspectorPageAgent(InspectorPageAgent* agent) { m_inspectorPageAgent = agent; }
+
     InspectorCSSAgent* inspectorCSSAgent() const { return m_inspectorCSSAgent; }
     void setInspectorCSSAgent(InspectorCSSAgent* agent) { m_inspectorCSSAgent = agent; }
 
@@ -119,6 +129,8 @@ public:
 #endif
 
 private:
+    InspectorAgent* m_inspectorAgent;
+    InspectorPageAgent* m_inspectorPageAgent;
     InspectorCSSAgent* m_inspectorCSSAgent;
     InspectorConsoleAgent* m_inspectorConsoleAgent;
     InspectorDOMAgent* m_inspectorDOMAgent;
diff --git a/Source/WebCore/inspector/PageDebuggerAgent.cpp b/Source/WebCore/inspector/PageDebuggerAgent.cpp
new file mode 100755
index 0000000..6b86232
--- /dev/null
+++ b/Source/WebCore/inspector/PageDebuggerAgent.cpp
@@ -0,0 +1,72 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "PageDebuggerAgent.h"
+
+#if ENABLE(JAVASCRIPT_DEBUGGER) && ENABLE(INSPECTOR)
+
+#include "PageScriptDebugServer.h"
+
+namespace WebCore {
+
+PassOwnPtr<PageDebuggerAgent> PageDebuggerAgent::create(InstrumentingAgents* instrumentingAgents, InspectorState* inspectorState, Page* inspectedPage, InjectedScriptManager* injectedScriptManager)
+{
+    return adoptPtr(new PageDebuggerAgent(instrumentingAgents, inspectorState, inspectedPage, injectedScriptManager));
+}
+
+PageDebuggerAgent::PageDebuggerAgent(InstrumentingAgents* instrumentingAgents, InspectorState* inspectorState, Page* inspectedPage, InjectedScriptManager* injectedScriptManager)
+    : InspectorDebuggerAgent(instrumentingAgents, inspectorState, injectedScriptManager)
+    , m_inspectedPage(inspectedPage)
+{
+}
+
+PageDebuggerAgent::~PageDebuggerAgent()
+{
+}
+
+void PageDebuggerAgent::startListeningScriptDebugServer()
+{
+    scriptDebugServer().addListener(this, m_inspectedPage);
+}
+
+void PageDebuggerAgent::stopListeningScriptDebugServer()
+{
+    scriptDebugServer().removeListener(this, m_inspectedPage);
+}
+
+PageScriptDebugServer& PageDebuggerAgent::scriptDebugServer()
+{
+    return PageScriptDebugServer::shared();
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(JAVASCRIPT_DEBUGGER) && ENABLE(INSPECTOR)
diff --git a/Source/WebCore/inspector/PageDebuggerAgent.h b/Source/WebCore/inspector/PageDebuggerAgent.h
new file mode 100755
index 0000000..7d6af6c
--- /dev/null
+++ b/Source/WebCore/inspector/PageDebuggerAgent.h
@@ -0,0 +1,63 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef PageDebuggerAgent_h
+#define PageDebuggerAgent_h
+
+#if ENABLE(JAVASCRIPT_DEBUGGER) && ENABLE(INSPECTOR)
+#include "InspectorDebuggerAgent.h"
+#include "PageScriptDebugServer.h"
+
+namespace WebCore {
+
+class Page;
+class PageScriptDebugServer;
+
+class PageDebuggerAgent : public InspectorDebuggerAgent {
+    WTF_MAKE_NONCOPYABLE(PageDebuggerAgent);
+    WTF_MAKE_FAST_ALLOCATED;
+public:
+    static PassOwnPtr<PageDebuggerAgent> create(InstrumentingAgents*, InspectorState*, Page*, InjectedScriptManager*);
+    virtual ~PageDebuggerAgent();
+
+private:
+    virtual void startListeningScriptDebugServer();
+    virtual void stopListeningScriptDebugServer();
+    virtual PageScriptDebugServer& scriptDebugServer();
+
+    PageDebuggerAgent(InstrumentingAgents*, InspectorState*, Page*, InjectedScriptManager*);
+    Page* const m_inspectedPage;
+};
+
+} // namespace WebCore
+
+#endif // ENABLE(JAVASCRIPT_DEBUGGER) && ENABLE(INSPECTOR)
+
+#endif // !defined(PageDebuggerAgent_h)
diff --git a/Source/WebCore/inspector/ScriptCallStack.cpp b/Source/WebCore/inspector/ScriptCallStack.cpp
index 70229e5..06b5e30 100644
--- a/Source/WebCore/inspector/ScriptCallStack.cpp
+++ b/Source/WebCore/inspector/ScriptCallStack.cpp
@@ -78,7 +78,7 @@ bool ScriptCallStack::isEqual(ScriptCallStack* o) const
 }
 
 #if ENABLE(INSPECTOR)
-PassRefPtr<InspectorArray> ScriptCallStack::buildInspectorObject() const
+PassRefPtr<InspectorArray> ScriptCallStack::buildInspectorArray() const
 {
     RefPtr<InspectorArray> frames = InspectorArray::create();
     for (size_t i = 0; i < m_frames.size(); i++)
diff --git a/Source/WebCore/inspector/ScriptCallStack.h b/Source/WebCore/inspector/ScriptCallStack.h
index 4cb152f..df67006 100644
--- a/Source/WebCore/inspector/ScriptCallStack.h
+++ b/Source/WebCore/inspector/ScriptCallStack.h
@@ -52,7 +52,7 @@ public:
     size_t size() const;
 
     bool isEqual(ScriptCallStack*) const;
-    PassRefPtr<InspectorArray> buildInspectorObject() const;
+    PassRefPtr<InspectorArray> buildInspectorArray() const;
 
 private:
     ScriptCallStack(Vector<ScriptCallFrame>&);
diff --git a/Source/WebCore/inspector/TimelineRecordFactory.cpp b/Source/WebCore/inspector/TimelineRecordFactory.cpp
index dd7f2be..ff47ed4 100644
--- a/Source/WebCore/inspector/TimelineRecordFactory.cpp
+++ b/Source/WebCore/inspector/TimelineRecordFactory.cpp
@@ -50,7 +50,7 @@ PassRefPtr<InspectorObject> TimelineRecordFactory::createGenericRecord(double st
 
     RefPtr<ScriptCallStack> stackTrace = createScriptCallStack(5, true);
     if (stackTrace && stackTrace->size())
-        record->setArray("stackTrace", stackTrace->buildInspectorObject());
+        record->setArray("stackTrace", stackTrace->buildInspectorArray());
     return record.release();
 }
 
@@ -144,7 +144,6 @@ PassRefPtr<InspectorObject> TimelineRecordFactory::createResourceReceiveResponse
     data->setNumber("identifier", identifier);
     data->setNumber("statusCode", response.httpStatusCode());
     data->setString("mimeType", response.mimeType());
-    data->setNumber("expectedContentLength", response.expectedContentLength());
     return data.release();
 }
 
diff --git a/Source/WebCore/inspector/WorkerDebuggerAgent.cpp b/Source/WebCore/inspector/WorkerDebuggerAgent.cpp
new file mode 100755
index 0000000..afd00a5
--- /dev/null
+++ b/Source/WebCore/inspector/WorkerDebuggerAgent.cpp
@@ -0,0 +1,70 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WorkerDebuggerAgent.h"
+
+#if ENABLE(JAVASCRIPT_DEBUGGER) && ENABLE(INSPECTOR) && ENABLE(WORKERS)
+#include "ScriptDebugServer.h"
+#include "WorkerContext.h"
+
+namespace WebCore {
+
+PassOwnPtr<WorkerDebuggerAgent> WorkerDebuggerAgent::create(InstrumentingAgents* instrumentingAgents, InspectorState* inspectorState, WorkerContext* inspectedWorkerContext, InjectedScriptManager* injectedScriptManager)
+{
+    return adoptPtr(new WorkerDebuggerAgent(instrumentingAgents, inspectorState, inspectedWorkerContext, injectedScriptManager));
+}
+
+WorkerDebuggerAgent::WorkerDebuggerAgent(InstrumentingAgents* instrumentingAgents, InspectorState* inspectorState, WorkerContext* inspectedWorkerContext, InjectedScriptManager* injectedScriptManager)
+    : InspectorDebuggerAgent(instrumentingAgents, inspectorState, injectedScriptManager)
+    , m_inspectedWorkerContext(inspectedWorkerContext)
+{
+}
+
+WorkerDebuggerAgent::~WorkerDebuggerAgent()
+{
+}
+
+void WorkerDebuggerAgent::startListeningScriptDebugServer()
+{
+}
+
+void WorkerDebuggerAgent::stopListeningScriptDebugServer()
+{
+}
+
+WorkerScriptDebugServer& WorkerDebuggerAgent::scriptDebugServer()
+{
+    return m_scriptDebugServer;
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(JAVASCRIPT_DEBUGGER) && ENABLE(INSPECTOR) && ENABLE(WORKERS)
diff --git a/Source/WebCore/inspector/WorkerDebuggerAgent.h b/Source/WebCore/inspector/WorkerDebuggerAgent.h
new file mode 100755
index 0000000..e88fd89
--- /dev/null
+++ b/Source/WebCore/inspector/WorkerDebuggerAgent.h
@@ -0,0 +1,64 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WorkerDebuggerAgent_h
+#define WorkerDebuggerAgent_h
+
+#if ENABLE(JAVASCRIPT_DEBUGGER) && ENABLE(INSPECTOR) && ENABLE(WORKERS)
+#include "InspectorDebuggerAgent.h"
+#include "WorkerScriptDebugServer.h"
+
+namespace WebCore {
+
+class WorkerContext;
+
+class WorkerDebuggerAgent : public InspectorDebuggerAgent {
+    WTF_MAKE_NONCOPYABLE(WorkerDebuggerAgent);
+    WTF_MAKE_FAST_ALLOCATED;
+public:
+    static PassOwnPtr<WorkerDebuggerAgent> create(InstrumentingAgents*, InspectorState*, WorkerContext*, InjectedScriptManager*);
+    virtual ~WorkerDebuggerAgent();
+
+private:
+    WorkerDebuggerAgent(InstrumentingAgents*, InspectorState*, WorkerContext*, InjectedScriptManager*);
+
+    virtual void startListeningScriptDebugServer();
+    virtual void stopListeningScriptDebugServer();
+    virtual WorkerScriptDebugServer& scriptDebugServer();
+
+    WorkerScriptDebugServer m_scriptDebugServer;
+    WorkerContext* m_inspectedWorkerContext;
+};
+
+} // namespace WebCore
+
+#endif // ENABLE(JAVASCRIPT_DEBUGGER) && ENABLE(INSPECTOR) && ENABLE(WORKERS)
+
+#endif // !defined(WorkerDebuggerAgent_h)
diff --git a/Source/WebCore/inspector/front-end/ApplicationCacheItemsView.js b/Source/WebCore/inspector/front-end/ApplicationCacheItemsView.js
index b345749..f181907 100644
--- a/Source/WebCore/inspector/front-end/ApplicationCacheItemsView.js
+++ b/Source/WebCore/inspector/front-end/ApplicationCacheItemsView.js
@@ -268,3 +268,33 @@ WebInspector.ApplicationCacheItemsView.prototype = {
 }
 
 WebInspector.ApplicationCacheItemsView.prototype.__proto__ = WebInspector.View.prototype;
+
+WebInspector.ApplicationCacheDispatcher = function()
+{
+}
+
+WebInspector.ApplicationCacheDispatcher.getApplicationCachesAsync = function(callback)
+{
+    function mycallback(error, applicationCaches)
+    {
+        // FIXME: Currently, this list only returns a single application cache.
+        if (!error && applicationCaches)
+            callback(applicationCaches);
+    }
+
+    ApplicationCacheAgent.getApplicationCaches(mycallback);
+}
+
+WebInspector.ApplicationCacheDispatcher.prototype = {
+    updateApplicationCacheStatus: function(status)
+    {
+        WebInspector.panels.resources.updateApplicationCacheStatus(status);
+    },
+
+    updateNetworkState: function(isNowOnline)
+    {
+        WebInspector.panels.resources.updateNetworkState(isNowOnline);
+    }
+}
+
+InspectorBackend.registerDomainDispatcher("ApplicationCache", new WebInspector.ApplicationCacheDispatcher());
diff --git a/Source/WebCore/inspector/front-end/AuditFormatters.js b/Source/WebCore/inspector/front-end/AuditFormatters.js
index 1bc1803..6545dd4 100644
--- a/Source/WebCore/inspector/front-end/AuditFormatters.js
+++ b/Source/WebCore/inspector/front-end/AuditFormatters.js
@@ -66,7 +66,7 @@ WebInspector.AuditFormatters = {
     snippet: function(snippetText)
     {
         var div = document.createElement("div");
-        div.innerText = snippetText;
+        div.textContent = snippetText;
         div.className = "source-code";
         return div;
     },
diff --git a/Source/WebCore/inspector/front-end/AuditRules.js b/Source/WebCore/inspector/front-end/AuditRules.js
index 803e9e0..ddab1df 100644
--- a/Source/WebCore/inspector/front-end/AuditRules.js
+++ b/Source/WebCore/inspector/front-end/AuditRules.js
@@ -65,9 +65,9 @@ WebInspector.AuditRules.getDomainToResourcesMap = function(resources, types, nee
 
 WebInspector.AuditRules.evaluateInTargetWindow = function(func, args, callback)
 {
-    function mycallback(result)
+    function mycallback(error, result)
     {
-        if (result)
+        if (!error && result)
             callback(JSON.parse(result.description));
         else
             callback(null);
@@ -377,24 +377,28 @@ WebInspector.AuditRules.UnusedCssRule.prototype = {
             WebInspector.AuditRules.evaluateInTargetWindow(routine, [selectors], selectorsCallback.bind(null, callback, styleSheets, testedSelectors));
         }
 
-        function styleSheetCallback(styleSheets, continuation, styleSheet)
+        function styleSheetCallback(styleSheets, sourceURL, continuation, styleSheet)
         {
-            if (styleSheet)
+            if (styleSheet) {
+                styleSheet.sourceURL = sourceURL;
                 styleSheets.push(styleSheet);
+            }
             if (continuation)
                 continuation(styleSheets);
         }
 
-        function allStylesCallback(styleSheetIds)
+        function allStylesCallback(error, styleSheetInfos)
         {
-            if (!styleSheetIds || !styleSheetIds.length)
+            if (error || !styleSheetInfos || !styleSheetInfos.length)
                 return evalCallback([]);
             var styleSheets = [];
-            for (var i = 0; i < styleSheetIds.length; ++i)
-                WebInspector.CSSStyleSheet.createForId(styleSheetIds[i], styleSheetCallback.bind(null, styleSheets, i == styleSheetIds.length - 1 ? evalCallback : null));
+            for (var i = 0; i < styleSheetInfos.length; ++i) {
+                var info = styleSheetInfos[i];
+                WebInspector.CSSStyleSheet.createForId(info.styleSheetId, styleSheetCallback.bind(null, styleSheets, info.sourceURL, i == styleSheetInfos.length - 1 ? evalCallback : null));
+            }
         }
 
-        CSSAgent.getAllStyles(allStylesCallback);
+        CSSAgent.getAllStyleSheets(allStylesCallback);
     }
 }
 
@@ -717,13 +721,20 @@ WebInspector.AuditRules.ImageDimensionsRule.prototype = {
                 doneCallback();
         }
 
-        function getStyles(nodeIds)
+        function getStyles(error, nodeIds)
         {
+            if (error)
+                return;
             for (var i = 0; i < nodeIds.length; ++i)
                 WebInspector.cssModel.getStylesAsync(nodeIds[i], imageStylesReady.bind(this, nodeIds[i], i === nodeIds.length - 1));
         }
 
-        DOMAgent.querySelectorAll(0, "img[src]", true, getStyles);
+        function getImages()
+        {
+            DOMAgent.querySelectorAll(0, "img[src]", true, getStyles);
+        }
+
+        WebInspector.domAgent.requestDocument(getImages);
     }
 }
 
diff --git a/Source/WebCore/inspector/front-end/AuditsPanel.js b/Source/WebCore/inspector/front-end/AuditsPanel.js
index 3144c78..7f56f41 100644
--- a/Source/WebCore/inspector/front-end/AuditsPanel.js
+++ b/Source/WebCore/inspector/front-end/AuditsPanel.js
@@ -192,7 +192,7 @@ WebInspector.AuditsPanel.prototype = {
     _reloadResources: function(callback)
     {
         this._pageReloadCallback = callback;
-        InspectorAgent.reloadPage(false);
+        PageAgent.reloadPage(false);
     },
 
     _didMainResourceLoad: function()
diff --git a/Source/WebCore/inspector/front-end/BreakpointManager.js b/Source/WebCore/inspector/front-end/BreakpointManager.js
index b62820e..76348ff 100644
--- a/Source/WebCore/inspector/front-end/BreakpointManager.js
+++ b/Source/WebCore/inspector/front-end/BreakpointManager.js
@@ -51,8 +51,6 @@ WebInspector.BreakpointManager.BreakpointTypes = {
 
 WebInspector.BreakpointManager.Events = {
     DOMBreakpointAdded: "dom-breakpoint-added",
-    EventListenerBreakpointAdded: "event-listener-breakpoint-added",
-    XHRBreakpointAdded: "xhr-breakpoint-added",
     ProjectChanged: "project-changed"
 }
 
@@ -81,42 +79,6 @@ WebInspector.BreakpointManager.prototype = {
         this.dispatchEventToListeners(WebInspector.BreakpointManager.Events.DOMBreakpointAdded, breakpoint.view);
     },
 
-    createEventListenerBreakpoint: function(eventName)
-    {
-        this._createEventListenerBreakpoint(eventName, true, false);
-    },
-
-    _createEventListenerBreakpoint: function(eventName, enabled, restored)
-    {
-        var breakpointId = this._createEventListenerBreakpointId(eventName);
-        if (breakpointId in this._breakpoints)
-            return;
-
-        var breakpoint = new WebInspector.EventListenerBreakpoint(eventName);
-        this._setBreakpoint(breakpointId, breakpoint, enabled, restored);
-
-        breakpoint.view = new WebInspector.EventListenerBreakpointView(this, breakpointId, enabled, eventName);
-        this.dispatchEventToListeners(WebInspector.BreakpointManager.Events.EventListenerBreakpointAdded, breakpoint.view);
-    },
-
-    createXHRBreakpoint: function(url)
-    {
-        this._createXHRBreakpoint(url, true, false);
-    },
-
-    _createXHRBreakpoint: function(url, enabled, restored)
-    {
-        var breakpointId = this._createXHRBreakpointId(url);
-        if (breakpointId in this._breakpoints)
-            return;
-
-        var breakpoint = new WebInspector.XHRBreakpoint(url);
-        this._setBreakpoint(breakpointId, breakpoint, enabled, restored);
-
-        breakpoint.view = new WebInspector.XHRBreakpointView(this, breakpointId, enabled, url);
-        this.dispatchEventToListeners(WebInspector.BreakpointManager.Events.XHRBreakpointAdded, breakpoint.view);
-    },
-
     _setBreakpoint: function(breakpointId, breakpoint, enabled, restored)
     {
         this._breakpoints[breakpointId] = breakpoint;
@@ -155,10 +117,6 @@ WebInspector.BreakpointManager.prototype = {
         var breakpointId;
         if (eventData.breakpointType === WebInspector.BreakpointManager.BreakpointTypes.DOM)
             breakpointId = this._createDOMBreakpointId(eventData.nodeId, eventData.type);
-        else if (eventData.breakpointType === WebInspector.BreakpointManager.BreakpointTypes.EventListener)
-            breakpointId = this._createEventListenerBreakpointId(eventData.eventName);
-        else if (eventData.breakpointType === WebInspector.BreakpointManager.BreakpointTypes.XHR)
-            breakpointId = this._createXHRBreakpointId(eventData.breakpointURL);
         else
             return;
 
@@ -196,20 +154,6 @@ WebInspector.BreakpointManager.prototype = {
         this._breakpoints = {};
         this._domBreakpointsRestored = false;
         this.dispatchEventToListeners(WebInspector.BreakpointManager.Events.ProjectChanged);
-
-        var breakpoints = this._stickyBreakpoints[WebInspector.settings.projectId] || [];
-        for (var i = 0; i < breakpoints.length; ++i) {
-            var breakpoint = breakpoints[i];
-            if (breakpoint.type === WebInspector.BreakpointManager.BreakpointTypes.EventListener)
-                this._createEventListenerBreakpoint(breakpoint.condition.eventName, breakpoint.enabled, true);
-            else if (breakpoint.type === WebInspector.BreakpointManager.BreakpointTypes.XHR)
-                this._createXHRBreakpoint(breakpoint.condition.url, breakpoint.enabled, true);
-        }
-
-        if (!this._breakpointsPushedToFrontend) {
-            BrowserDebuggerAgent.setAllBrowserBreakpoints(this._stickyBreakpoints);
-            this._breakpointsPushedToFrontend = true;
-        }
     },
 
     restoreDOMBreakpoints: function()
@@ -271,7 +215,6 @@ WebInspector.BreakpointManager.prototype = {
         WebInspector.settings.nativeBreakpoints = breakpoints;
 
         this._stickyBreakpoints[WebInspector.settings.projectId] = breakpoints;
-        BrowserDebuggerAgent.setAllBrowserBreakpoints(this._stickyBreakpoints);
     },
 
     _validateBreakpoints: function(persistentBreakpoints)
@@ -288,16 +231,9 @@ WebInspector.BreakpointManager.prototype = {
                 if (typeof condition.path !== "string" || typeof condition.type !== "number")
                     continue;
                 id += condition.path + ":" + condition.type;
-            } else if (breakpoint.type === WebInspector.BreakpointManager.BreakpointTypes.EventListener) {
-                if (typeof condition.eventName !== "string")
-                    continue;
-                id += condition.eventName;
-            } else if (breakpoint.type === WebInspector.BreakpointManager.BreakpointTypes.XHR) {
-                if (typeof condition.url !== "string")
-                    continue;
-                id += condition.url;
             } else
                 continue;
+
             if (id in breakpointsSet)
                 continue;
             breakpointsSet[id] = true;
@@ -309,16 +245,6 @@ WebInspector.BreakpointManager.prototype = {
     _createDOMBreakpointId: function(nodeId, type)
     {
         return "dom:" + nodeId + ":" + type;
-    },
-
-    _createEventListenerBreakpointId: function(eventName)
-    {
-        return "eventListner:" + eventName;
-    },
-
-    _createXHRBreakpointId: function(url)
-    {
-        return "xhr:" + url;
     }
 }
 
@@ -349,54 +275,6 @@ WebInspector.DOMBreakpoint.prototype = {
     }
 }
 
-WebInspector.EventListenerBreakpoint = function(eventName)
-{
-    this._eventName = eventName;
-}
-
-WebInspector.EventListenerBreakpoint.prototype = {
-    _enable: function()
-    {
-        BrowserDebuggerAgent.setEventListenerBreakpoint(this._eventName);
-    },
-
-    _disable: function()
-    {
-        BrowserDebuggerAgent.removeEventListenerBreakpoint(this._eventName);
-    },
-
-    _serializeToJSON: function()
-    {
-        var type = WebInspector.BreakpointManager.BreakpointTypes.EventListener;
-        return { type: type, condition: { eventName: this._eventName } };
-    }
-}
-
-WebInspector.XHRBreakpoint = function(url)
-{
-    this._url = url;
-}
-
-WebInspector.XHRBreakpoint.prototype = {
-    _enable: function()
-    {
-        BrowserDebuggerAgent.setXHRBreakpoint(this._url);
-    },
-
-    _disable: function()
-    {
-        BrowserDebuggerAgent.removeXHRBreakpoint(this._url);
-    },
-
-    _serializeToJSON: function()
-    {
-        var type = WebInspector.BreakpointManager.BreakpointTypes.XHR;
-        return { type: type, condition: { url: this._url } };
-    }
-}
-
-
-
 WebInspector.NativeBreakpointView = function(manager, id, enabled)
 {
     this._manager = manager;
@@ -487,7 +365,7 @@ WebInspector.DOMBreakpointView.prototype = {
                 if (!targetNodeId)
                     return;
 
-                RuntimeAgent.releaseObject(eventData.targetNode);
+                targetNodeObject.release();
                 var targetNode = WebInspector.panels.elements.linkifyNodeById(targetNodeId);
                 if (eventData.insertion) {
                     if (targetNodeId !== this._nodeId)
@@ -530,91 +408,6 @@ WebInspector.DOMBreakpointView.prototype = {
 
 WebInspector.DOMBreakpointView.prototype.__proto__ = WebInspector.NativeBreakpointView.prototype;
 
-WebInspector.EventListenerBreakpointView = function(manager, id, enabled, eventName)
-{
-    WebInspector.NativeBreakpointView.call(this, manager, id, enabled);
-    this._eventName = eventName;
-}
-
-WebInspector.EventListenerBreakpointView.eventNameForUI = function(eventName)
-{
-    if (!WebInspector.EventListenerBreakpointView._eventNamesForUI) {
-        WebInspector.EventListenerBreakpointView._eventNamesForUI = {
-            "instrumentation:setTimer": WebInspector.UIString("Set Timer"),
-            "instrumentation:clearTimer": WebInspector.UIString("Clear Timer"),
-            "instrumentation:timerFired": WebInspector.UIString("Timer Fired")
-        };
-    }
-    return WebInspector.EventListenerBreakpointView._eventNamesForUI[eventName] || eventName.substring(eventName.indexOf(":") + 1);
-}
-
-WebInspector.EventListenerBreakpointView.prototype = {
-    get eventName()
-    {
-        return this._eventName;
-    },
-
-    compareTo: function(other)
-    {
-        return this._compare(this._eventName, other._eventName);
-    },
-
-    populateLabelElement: function(element)
-    {
-        element.appendChild(document.createTextNode(this._uiEventName()));
-    },
-
-    populateStatusMessageElement: function(element, eventData)
-    {
-        var status = WebInspector.UIString("Paused on a \"%s\" Event Listener.", this._uiEventName());
-        element.appendChild(document.createTextNode(status));
-    },
-
-    _uiEventName: function()
-    {
-        return WebInspector.EventListenerBreakpointView.eventNameForUI(this._eventName);
-    }
-}
-
-WebInspector.EventListenerBreakpointView.prototype.__proto__ = WebInspector.NativeBreakpointView.prototype;
-
-WebInspector.XHRBreakpointView = function(manager, id, enabled, url)
-{
-    WebInspector.NativeBreakpointView.call(this, manager, id, enabled);
-    this._url = url;
-}
-
-WebInspector.XHRBreakpointView.prototype = {
-    compareTo: function(other)
-    {
-        return this._compare(this._url, other._url);
-    },
-
-    populateEditElement: function(element)
-    {
-        element.textContent = this._url;
-    },
-
-    populateLabelElement: function(element)
-    {
-        var label;
-        if (!this._url.length)
-            label = WebInspector.UIString("Any XHR");
-        else
-            label = WebInspector.UIString("URL contains \"%s\"", this._url);
-        element.appendChild(document.createTextNode(label));
-        element.addStyleClass("cursor-auto");
-    },
-
-    populateStatusMessageElement: function(element)
-    {
-        var status = WebInspector.UIString("Paused on a XMLHttpRequest.");
-        element.appendChild(document.createTextNode(status));
-    }
-}
-
-WebInspector.XHRBreakpointView.prototype.__proto__ = WebInspector.NativeBreakpointView.prototype;
-
 WebInspector.DOMBreakpointTypes = {
     SubtreeModified: 0,
     AttributeModified: 1,
diff --git a/Source/WebCore/inspector/front-end/BreakpointsSidebarPane.js b/Source/WebCore/inspector/front-end/BreakpointsSidebarPane.js
index 0c46463..63a6e2a 100644
--- a/Source/WebCore/inspector/front-end/BreakpointsSidebarPane.js
+++ b/Source/WebCore/inspector/front-end/BreakpointsSidebarPane.js
@@ -23,10 +23,12 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-WebInspector.JavaScriptBreakpointsSidebarPane = function(title)
+WebInspector.JavaScriptBreakpointsSidebarPane = function(model)
 {
     WebInspector.SidebarPane.call(this, WebInspector.UIString("Breakpoints"));
 
+    this._model = model;
+
     this.listElement = document.createElement("ol");
     this.listElement.className = "breakpoint-list";
 
@@ -37,36 +39,37 @@ WebInspector.JavaScriptBreakpointsSidebarPane = function(title)
     this.bodyElement.appendChild(this.emptyElement);
 
     this._items = {};
-
-    WebInspector.debuggerModel.addEventListener(WebInspector.DebuggerModel.Events.BreakpointAdded, this._breakpointAdded, this);
-    WebInspector.debuggerModel.addEventListener(WebInspector.DebuggerModel.Events.BreakpointRemoved, this._breakpointRemoved, this);
-    WebInspector.debuggerModel.addEventListener(WebInspector.DebuggerModel.Events.BreakpointResolved, this._breakpointResolved, this);
-    WebInspector.debuggerModel.addEventListener(WebInspector.DebuggerModel.Events.ParsedScriptSource, this._parsedScriptSource, this);
-    WebInspector.debuggerModel.addEventListener(WebInspector.DebuggerModel.Events.DebuggerPaused, this._debuggerPaused, this);
-    WebInspector.debuggerModel.addEventListener(WebInspector.DebuggerModel.Events.DebuggerResumed, this._debuggerResumed, this);
-    WebInspector.breakpointManager.addEventListener(WebInspector.BreakpointManager.Events.ProjectChanged, this._projectChanged, this);
 }
 
 WebInspector.JavaScriptBreakpointsSidebarPane.prototype = {
-    _breakpointAdded: function(event)
+    addBreakpoint: function(breakpoint)
     {
-        var breakpoint = event.data;
-        var breakpointId = breakpoint.id;
-
-        if (breakpoint.url && !WebInspector.debuggerModel.scriptsForURL(breakpoint.url).length)
-            return;
-
         var element = document.createElement("li");
+        element.addStyleClass("cursor-pointer");
+        element.addEventListener("contextmenu", this._contextMenu.bind(this, breakpoint), true);
+        element.addEventListener("click", this._breakpointClicked.bind(this, breakpoint), false);
 
         var checkbox = document.createElement("input");
         checkbox.className = "checkbox-elem";
         checkbox.type = "checkbox";
         checkbox.checked = breakpoint.enabled;
-        checkbox.addEventListener("click", this._breakpointItemCheckboxClicked.bind(this, breakpointId), false);
+        checkbox.addEventListener("click", this._breakpointCheckboxClicked.bind(this, breakpoint), false);
         element.appendChild(checkbox);
 
-        var label = document.createElement("span");
-        element.appendChild(label);
+        var displayName = breakpoint.url ? WebInspector.displayNameForURL(breakpoint.url) : WebInspector.UIString("(program)");
+        var labelElement = document.createTextNode(displayName + ":" + (breakpoint.lineNumber + 1));
+        element.appendChild(labelElement);
+
+        var snippetElement = document.createElement("div");
+        snippetElement.className = "source-text monospace";
+        element.appendChild(snippetElement);
+        if (breakpoint.loadSnippet) {
+            function didLoadSnippet(snippet)
+            {
+                snippetElement.textContent = snippet;
+            }
+            breakpoint.loadSnippet(didLoadSnippet);
+        }
 
         element._data = breakpoint;
         var currentElement = this.listElement.firstChild;
@@ -77,88 +80,68 @@ WebInspector.JavaScriptBreakpointsSidebarPane.prototype = {
         }
         this._addListElement(element, currentElement);
 
-        element.addEventListener("contextmenu", this._contextMenuEventFired.bind(this, breakpointId), true);
-
-        this._setupBreakpointElement(breakpoint, element);
-
         var breakpointItem = {};
         breakpointItem.element = element;
         breakpointItem.checkbox = checkbox;
-        this._items[breakpointId] = breakpointItem;
+        this._items[this._createBreakpointItemId(breakpoint.sourceFileId, breakpoint.lineNumber)] = breakpointItem;
 
         if (!this.expanded)
             this.expanded = true;
     },
 
-    _breakpointRemoved: function(event)
+    removeBreakpoint: function(sourceFileId, lineNumber)
     {
-        var breakpointId = event.data;
-        var breakpointItem = this._items[breakpointId];
-        if (breakpointItem) {
-            delete this._items[breakpointId];
-            this._removeListElement(breakpointItem.element);
-        }
+        var breakpointItemId = this._createBreakpointItemId(sourceFileId, lineNumber);
+        var breakpointItem = this._items[breakpointItemId];
+        if (!breakpointItem)
+            return;
+        delete this._items[breakpointItemId];
+        this._removeListElement(breakpointItem.element);
     },
 
-    _breakpointResolved: function(event)
+    highlightBreakpoint: function(sourceFileId, lineNumber)
     {
-        var breakpoint = event.data;
-        this._breakpointRemoved({ data: breakpoint.id });
-        this._breakpointAdded({ data: breakpoint });
+        var breakpointItem = this._items[this._createBreakpointItemId(sourceFileId, lineNumber)];
+        if (!breakpointItem)
+            return;
+        breakpointItem.element.addStyleClass("breakpoint-hit");
+        this._highlightedBreakpointItem = breakpointItem;
     },
 
-    _parsedScriptSource: function(event)
+    clearBreakpointHighlight: function()
     {
-        var url = event.data.sourceURL;
-        var breakpoints = WebInspector.debuggerModel.breakpoints;
-        for (var id in breakpoints) {
-            if (!(id in this._items))
-                this._breakpointAdded({ data: breakpoints[id] });
+        if (this._highlightedBreakpointItem) {
+            this._highlightedBreakpointItem.element.removeStyleClass("breakpoint-hit");
+            delete this._highlightedBreakpointItem;
         }
     },
 
-    _breakpointEnableChanged: function(enabled, event)
+    _createBreakpointItemId: function(sourceFileId, lineNumber)
     {
-        var breakpointId = event.data;
-        var breakpointItem = this._items[breakpointId];
-        if (breakpointItem)
-            breakpointItem.checkbox.checked = enabled;
+        return sourceFileId + ":" + lineNumber;
     },
 
-    _breakpointItemCheckboxClicked: function(breakpointId, event)
+    _breakpointClicked: function(breakpoint, event)
     {
-        var breakpoint = WebInspector.debuggerModel.breakpointForId(breakpointId);
-        WebInspector.debuggerModel.updateBreakpoint(breakpointId, breakpoint.condition, event.target.checked);
+        WebInspector.panels.scripts.showSourceLine(breakpoint.sourceFileId, breakpoint.lineNumber + 1);
+    },
 
-        // Breakpoint element may have it's own click handler.
+    _breakpointCheckboxClicked: function(breakpoint, event)
+    {
+        // Breakpoint element has it's own click handler.
         event.stopPropagation();
+
+        this._model.setBreakpointEnabled(breakpoint.sourceFileId, breakpoint.lineNumber, event.target.checked);
     },
 
-    _contextMenuEventFired: function(breakpointId, event)
+    _contextMenu: function(breakpoint, event)
     {
         var contextMenu = new WebInspector.ContextMenu();
-        contextMenu.appendItem(WebInspector.UIString("Remove Breakpoint"), this._removeBreakpoint.bind(this, breakpointId));
-        contextMenu.show(event);
-    },
 
-    _debuggerPaused: function(event)
-    {
-        var breakpoint = event.data.breakpoint;
-        if (!breakpoint)
-            return;
-        var breakpointItem = this._items[breakpoint.id];
-        if (!breakpointItem)
-            return;
-        breakpointItem.element.addStyleClass("breakpoint-hit");
-        this._lastHitBreakpointItem = breakpointItem;
-    },
+        var removeHandler = this._model.removeBreakpoint.bind(this._model, breakpoint.sourceFileId, breakpoint.lineNumber);
+        contextMenu.appendItem(WebInspector.UIString("Remove Breakpoint"), removeHandler);
 
-    _debuggerResumed: function()
-    {
-        if (this._lastHitBreakpointItem) {
-            this._lastHitBreakpointItem.element.removeStyleClass("breakpoint-hit");
-            delete this._lastHitBreakpointItem;
-        }
+        contextMenu.show(event);
     },
 
     _addListElement: function(element, beforeElement)
@@ -183,16 +166,6 @@ WebInspector.JavaScriptBreakpointsSidebarPane.prototype = {
         }
     },
 
-    _projectChanged: function()
-    {
-        this.listElement.removeChildren();
-        if (this.listElement.parentElement) {
-            this.bodyElement.removeChild(this.listElement);
-            this.bodyElement.appendChild(this.emptyElement);
-        }
-        this._items = {};
-    },
-
     _compare: function(x, y)
     {
         if (x !== y)
@@ -205,40 +178,14 @@ WebInspector.JavaScriptBreakpointsSidebarPane.prototype = {
         return this._compare(b1.url, b2.url) || this._compare(b1.lineNumber, b2.lineNumber);
     },
 
-    _setupBreakpointElement: function(data, element)
+    reset: function()
     {
-        var sourceID;
-        var lineNumber = data.lineNumber;
-        if (data.locations.length) {
-            sourceID = data.locations[0].sourceID;
-            lineNumber = data.locations[0].lineNumber;
-        }
-
-        var displayName = data.url ? WebInspector.displayNameForURL(data.url) : WebInspector.UIString("(program)");
-        var labelElement = document.createTextNode(displayName + ":" + (lineNumber + 1));
-        element.appendChild(labelElement);
-
-        var sourceTextElement = document.createElement("div");
-        sourceTextElement.className = "source-text monospace";
-        element.appendChild(sourceTextElement);
-
-        if (sourceID) {
-            function didGetSourceLine(text)
-            {
-                sourceTextElement.textContent = text;
-            }
-            var script = WebInspector.debuggerModel.scriptForSourceID(sourceID);
-            script.sourceLine(lineNumber, didGetSourceLine.bind(this));
+        this.listElement.removeChildren();
+        if (this.listElement.parentElement) {
+            this.bodyElement.removeChild(this.listElement);
+            this.bodyElement.appendChild(this.emptyElement);
         }
-
-        element.addStyleClass("cursor-pointer");
-        var clickHandler = WebInspector.panels.scripts.showSourceLine.bind(WebInspector.panels.scripts, data.url, lineNumber + 1);
-        element.addEventListener("click", clickHandler, false);
-    },
-
-    _removeBreakpoint: function(breakpointId)
-    {
-        WebInspector.debuggerModel.removeBreakpoint(breakpointId);
+        this._items = {};
     }
 }
 
@@ -329,61 +276,177 @@ WebInspector.XHRBreakpointsSidebarPane = function()
 {
     WebInspector.NativeBreakpointsSidebarPane.call(this, WebInspector.UIString("XHR Breakpoints"));
 
-    function addButtonClicked(event)
-    {
-        event.stopPropagation();
-        this._startEditingBreakpoint(null);
-    }
+    this._breakpointElements = {};
 
     var addButton = document.createElement("button");
     addButton.className = "add";
-    addButton.addEventListener("click", addButtonClicked.bind(this), false);
+    addButton.addEventListener("click", this._addButtonClicked.bind(this), false);
     this.titleElement.appendChild(addButton);
+
+    this._restoreBreakpoints();
 }
 
 WebInspector.XHRBreakpointsSidebarPane.prototype = {
-    addBreakpointItem: function(breakpointItem)
+    _addButtonClicked: function(event)
     {
-        WebInspector.NativeBreakpointsSidebarPane.prototype.addBreakpointItem.call(this, breakpointItem);
-        breakpointItem._labelElement.addEventListener("dblclick", this._startEditingBreakpoint.bind(this, breakpointItem), false);
+        event.stopPropagation();
+
+        this.expanded = true;
+
+        var inputElement = document.createElement("span");
+        inputElement.className = "breakpoint-condition editing";
+        this._addListElement(inputElement, this.listElement.firstChild);
+
+        function finishEditing(accept, e, text)
+        {
+            this._removeListElement(inputElement);
+            if (accept) {
+                this._setBreakpoint(text, true);
+                this._saveBreakpoints();
+            }
+        }
+
+        WebInspector.startEditing(inputElement, {
+            commitHandler: finishEditing.bind(this, true),
+            cancelHandler: finishEditing.bind(this, false)
+        });
     },
 
-    _startEditingBreakpoint: function(breakpointItem)
+    _setBreakpoint: function(url, enabled)
     {
-        if (this._editingBreakpoint)
+        if (url in this._breakpointElements)
             return;
-        this._editingBreakpoint = true;
 
-        if (!this.expanded)
-            this.expanded = true;
+        var element = document.createElement("li");
+        element._url = url;
+        element.addEventListener("contextmenu", this._contextMenu.bind(this, url), true);
+
+        var checkboxElement = document.createElement("input");
+        checkboxElement.className = "checkbox-elem";
+        checkboxElement.type = "checkbox";
+        checkboxElement.checked = enabled;
+        checkboxElement.addEventListener("click", this._checkboxClicked.bind(this, url), false);
+        element._checkboxElement = checkboxElement;
+        element.appendChild(checkboxElement);
+
+        var labelElement = document.createElement("span");
+        if (!url)
+            labelElement.textContent = WebInspector.UIString("Any XHR");
+        else
+            labelElement.textContent = WebInspector.UIString("URL contains \"%s\"", url);
+        labelElement.addStyleClass("cursor-auto");
+        labelElement.addEventListener("dblclick", this._labelClicked.bind(this, url), false);
+        element.appendChild(labelElement);
+
+        var currentElement = this.listElement.firstChild;
+        while (currentElement) {
+            if (currentElement._url && currentElement._url < element._url)
+                break;
+            currentElement = currentElement.nextSibling;
+        }
+        this._addListElement(element, currentElement);
+        this._breakpointElements[url] = element;
+        if (enabled)
+            BrowserDebuggerAgent.setXHRBreakpoint(url);
+    },
+
+    _removeBreakpoint: function(url)
+    {
+        var element = this._breakpointElements[url];
+        if (!element)
+            return;
+
+        this._removeListElement(element);
+        delete this._breakpointElements[url];
+        if (element._checkboxElement.checked)
+            BrowserDebuggerAgent.removeXHRBreakpoint(url);
+    },
+
+    _contextMenu: function(url, event)
+    {
+        var contextMenu = new WebInspector.ContextMenu();
+        function removeBreakpoint()
+        {
+            this._removeBreakpoint(url);
+            this._saveBreakpoints();
+        }
+        contextMenu.appendItem(WebInspector.UIString("Remove Breakpoint"), removeBreakpoint.bind(this));
+        contextMenu.show(event);
+    },
+
+    _checkboxClicked: function(url, event)
+    {
+        if (event.target.checked)
+            WebInspector.breakpointManager.setXHRBreakpoint(url);
+        else
+            WebInspector.breakpointManager.removeXHRBreakpoint(url);
+        this._saveBreakpoints();
+    },
 
+    _labelClicked: function(url)
+    {
+        var element = this._breakpointElements[url];
         var inputElement = document.createElement("span");
         inputElement.className = "breakpoint-condition editing";
-        if (breakpointItem) {
-            breakpointItem.populateEditElement(inputElement);
-            this.listElement.insertBefore(inputElement, breakpointItem.element);
-            breakpointItem.element.addStyleClass("hidden");
-        } else
-            this._addListElement(inputElement, this.listElement.firstChild);
+        inputElement.textContent = url;
+        this.listElement.insertBefore(inputElement, element);
+        element.addStyleClass("hidden");
+
+        function finishEditing(accept, e, text)
+        {
+            this._removeListElement(inputElement);
+            if (accept) {
+                this._removeBreakpoint(url);
+                this._setBreakpoint(text, element._checkboxElement.checked);
+                this._saveBreakpoints();
+            } else
+                element.removeStyleClass("hidden");
+        }
 
-        var commitHandler = this._hideEditBreakpointDialog.bind(this, inputElement, true, breakpointItem);
-        var cancelHandler = this._hideEditBreakpointDialog.bind(this, inputElement, false, breakpointItem);
         WebInspector.startEditing(inputElement, {
-            commitHandler: commitHandler,
-            cancelHandler: cancelHandler
+            commitHandler: finishEditing.bind(this, true),
+            cancelHandler: finishEditing.bind(this, false)
         });
     },
 
-    _hideEditBreakpointDialog: function(inputElement, accept, breakpointItem)
+    highlightBreakpoint: function(url)
+    {
+        var element = this._breakpointElements[url];
+        if (!element)
+            return;
+        this.expanded = true;
+        element.addStyleClass("breakpoint-hit");
+        this._highlightedElement = element;
+    },
+
+    clearBreakpointHighlight: function()
+    {
+        if (this._highlightedElement) {
+            this._highlightedElement.removeStyleClass("breakpoint-hit");
+            delete this._highlightedElement;
+        }
+    },
+
+    _saveBreakpoints: function()
+    {
+        var breakpoints = [];
+        for (var url in this._breakpointElements)
+            breakpoints.push({ url: url, enabled: this._breakpointElements[url]._checkboxElement.checked });
+        WebInspector.settings.xhrBreakpoints = breakpoints;
+    },
+
+    _restoreBreakpoints: function()
+    {
+        var breakpoints = WebInspector.settings.xhrBreakpoints;
+        for (var i = 0; i < breakpoints.length; ++i) {
+            var breakpoint = breakpoints[i];
+            if (breakpoint && typeof breakpoint.url === "string")
+                this._setBreakpoint(breakpoint.url, breakpoint.enabled);
+        }
+    },
+
+    _projectChanged: function()
     {
-        this._removeListElement(inputElement);
-        this._editingBreakpoint = false;
-        if (accept) {
-            if (breakpointItem)
-                breakpointItem.remove();
-            WebInspector.breakpointManager.createXHRBreakpoint(inputElement.textContent.toLowerCase());
-        } else if (breakpointItem)
-            breakpointItem.element.removeStyleClass("hidden");
     }
 }
 
@@ -478,13 +541,11 @@ WebInspector.EventListenerBreakpointsSidebarPane = function()
 
     this.categoriesElement = document.createElement("ol");
     this.categoriesElement.tabIndex = 0;
-    this.categoriesElement.addStyleClass("properties-tree event-listener-breakpoints");
+    this.categoriesElement.addStyleClass("properties-tree");
+    this.categoriesElement.addStyleClass("event-listener-breakpoints");
     this.categoriesTreeOutline = new TreeOutline(this.categoriesElement);
     this.bodyElement.appendChild(this.categoriesElement);
 
-    WebInspector.breakpointManager.addEventListener(WebInspector.BreakpointManager.Events.ProjectChanged, this._projectChanged, this);
-    WebInspector.breakpointManager.addEventListener(WebInspector.BreakpointManager.Events.EventListenerBreakpointAdded, this._breakpointAdded, this);
-
     this._breakpointItems = {};
     this._createCategory(WebInspector.UIString("Keyboard"), "listener", ["keydown", "keyup", "keypress", "textInput"]);
     this._createCategory(WebInspector.UIString("Mouse"), "listener", ["click", "dblclick", "mousedown", "mouseup", "mouseover", "mousemove", "mouseout", "mousewheel"]);
@@ -497,6 +558,20 @@ WebInspector.EventListenerBreakpointsSidebarPane = function()
     this._createCategory(WebInspector.UIString("DOM Mutation"), "listener", ["DOMActivate", "DOMFocusIn", "DOMFocusOut", "DOMAttrModified", "DOMCharacterDataModified", "DOMNodeInserted", "DOMNodeInsertedIntoDocument", "DOMNodeRemoved", "DOMNodeRemovedFromDocument", "DOMSubtreeModified", "DOMContentLoaded"]);
     this._createCategory(WebInspector.UIString("Device"), "listener", ["deviceorientation", "devicemotion"]);
     this._createCategory(WebInspector.UIString("Timer"), "instrumentation", ["setTimer", "clearTimer", "timerFired"]);
+
+    this._restoreBreakpoints();
+}
+
+WebInspector.EventListenerBreakpointsSidebarPane.eventNameForUI = function(eventName)
+{
+    if (!WebInspector.EventListenerBreakpointsSidebarPane._eventNamesForUI) {
+        WebInspector.EventListenerBreakpointsSidebarPane._eventNamesForUI = {
+            "instrumentation:setTimer": WebInspector.UIString("Set Timer"),
+            "instrumentation:clearTimer": WebInspector.UIString("Clear Timer"),
+            "instrumentation:timerFired": WebInspector.UIString("Timer Fired")
+        };
+    }
+    return WebInspector.EventListenerBreakpointsSidebarPane._eventNamesForUI[eventName] || eventName.substring(eventName.indexOf(":") + 1);
 }
 
 WebInspector.EventListenerBreakpointsSidebarPane.prototype = {
@@ -516,7 +591,7 @@ WebInspector.EventListenerBreakpointsSidebarPane.prototype = {
             var eventName = type + ":" + eventNames[i];
 
             var breakpointItem = {};
-            var title = WebInspector.EventListenerBreakpointView.eventNameForUI(eventName);
+            var title = WebInspector.EventListenerBreakpointsSidebarPane.eventNameForUI(eventName);
             breakpointItem.element = new TreeElement(title);
             categoryItem.element.appendChild(breakpointItem.element);
             var hitMarker = document.createElement("div");
@@ -526,9 +601,8 @@ WebInspector.EventListenerBreakpointsSidebarPane.prototype = {
             breakpointItem.element.selectable = true;
 
             breakpointItem.checkbox = this._createCheckbox(breakpointItem.element);
-            breakpointItem.checkbox.addEventListener("click", this._breakpointCheckboxClicked.bind(this, breakpointItem), true);
+            breakpointItem.checkbox.addEventListener("click", this._breakpointCheckboxClicked.bind(this, eventName), true);
             breakpointItem.parent = categoryItem;
-            breakpointItem.eventName = eventName;
 
             this._breakpointItems[eventName] = breakpointItem;
             categoryItem.children[eventName] = breakpointItem;
@@ -549,54 +623,47 @@ WebInspector.EventListenerBreakpointsSidebarPane.prototype = {
         var checked = categoryItem.checkbox.checked;
         for (var eventName in categoryItem.children) {
             var breakpointItem = categoryItem.children[eventName];
-            if (breakpointItem.checkbox.checked !== checked) {
-                breakpointItem.checkbox.checked = checked;
-                this._breakpointCheckboxClicked(breakpointItem);
-            }
+            if (breakpointItem.checkbox.checked === checked)
+                continue;
+            if (checked)
+                this._setBreakpoint(eventName);
+            else
+                this._removeBreakpoint(eventName);
         }
+        this._saveBreakpoints();
     },
 
-    _breakpointCheckboxClicked: function(breakpointItem)
+    _breakpointCheckboxClicked: function(eventName, event)
     {
-        if (breakpointItem.checkbox.checked)
-            WebInspector.breakpointManager.createEventListenerBreakpoint(breakpointItem.eventName);
+        if (event.target.checked)
+            this._setBreakpoint(eventName);
         else
-            breakpointItem.breakpoint.remove();
+            this._removeBreakpoint(eventName);
+        this._saveBreakpoints();
     },
 
-    _breakpointAdded: function(event)
+    _setBreakpoint: function(eventName)
     {
-        var breakpoint = event.data;
-
-        var breakpointItem = this._breakpointItems[breakpoint.eventName];
-        breakpointItem.breakpoint = breakpoint;
-        breakpoint.addEventListener("hit-state-changed", this._breakpointHitStateChanged.bind(this, breakpointItem));
-        breakpoint.addEventListener("removed", this._breakpointRemoved.bind(this, breakpointItem));
+        var breakpointItem = this._breakpointItems[eventName];
+        if (!breakpointItem)
+            return;
         breakpointItem.checkbox.checked = true;
-        this._updateCategoryCheckbox(breakpointItem);
+        BrowserDebuggerAgent.setEventListenerBreakpoint(eventName);
+        this._updateCategoryCheckbox(breakpointItem.parent);
     },
 
-    _breakpointHitStateChanged: function(breakpointItem, event)
+    _removeBreakpoint: function(eventName)
     {
-        if (event.target.hit) {
-            this.expanded = true;
-            var categoryItem = breakpointItem.parent;
-            categoryItem.element.expand();
-            breakpointItem.element.listItemElement.addStyleClass("breakpoint-hit");
-        } else
-            breakpointItem.element.listItemElement.removeStyleClass("breakpoint-hit");
-    },
-
-    _breakpointRemoved: function(breakpointItem)
-    {
-        breakpointItem.breakpoint = null;
+        var breakpointItem = this._breakpointItems[eventName];
+        if (!breakpointItem)
+            return;
         breakpointItem.checkbox.checked = false;
-        this._updateCategoryCheckbox(breakpointItem);
+        BrowserDebuggerAgent.removeEventListenerBreakpoint(eventName);
+        this._updateCategoryCheckbox(breakpointItem.parent);
     },
 
-    _updateCategoryCheckbox: function(breakpointItem)
+    _updateCategoryCheckbox: function(categoryItem)
     {
-        var categoryItem = breakpointItem.parent;
         var hasEnabled = false, hasDisabled = false;
         for (var eventName in categoryItem.children) {
             var breakpointItem = categoryItem.children[eventName];
@@ -609,13 +676,42 @@ WebInspector.EventListenerBreakpointsSidebarPane.prototype = {
         categoryItem.checkbox.indeterminate = hasEnabled && hasDisabled;
     },
 
-    _projectChanged: function()
+    highlightBreakpoint: function(eventName)
     {
+        var breakpointItem = this._breakpointItems[eventName];
+        if (!breakpointItem)
+            return;
+        this.expanded = true;
+        breakpointItem.parent.element.expand();
+        breakpointItem.element.listItemElement.addStyleClass("breakpoint-hit");
+        this._highlightedElement = breakpointItem.element.listItemElement;
+    },
+
+    clearBreakpointHighlight: function()
+    {
+        if (this._highlightedElement) {
+            this._highlightedElement.removeStyleClass("breakpoint-hit");
+            delete this._highlightedElement;
+        }
+    },
+
+    _saveBreakpoints: function()
+    {
+        var breakpoints = [];
         for (var eventName in this._breakpointItems) {
-            var breakpointItem = this._breakpointItems[eventName];
-            breakpointItem.breakpoint = null;
-            breakpointItem.checkbox.checked = false;
-            this._updateCategoryCheckbox(breakpointItem);
+            if (this._breakpointItems[eventName].checkbox.checked)
+                breakpoints.push({ eventName: eventName });
+        }
+        WebInspector.settings.eventListenerBreakpoints = breakpoints;
+    },
+
+    _restoreBreakpoints: function()
+    {
+        var breakpoints = WebInspector.settings.eventListenerBreakpoints;
+        for (var i = 0; i < breakpoints.length; ++i) {
+            var breakpoint = breakpoints[i];
+            if (breakpoint && typeof breakpoint.eventName === "string")
+                this._setBreakpoint(breakpoint.eventName);
         }
     }
 }
diff --git a/Source/WebCore/inspector/front-end/CSSStyleModel.js b/Source/WebCore/inspector/front-end/CSSStyleModel.js
index 700417e..148bfd8 100644
--- a/Source/WebCore/inspector/front-end/CSSStyleModel.js
+++ b/Source/WebCore/inspector/front-end/CSSStyleModel.js
@@ -43,9 +43,9 @@ WebInspector.CSSStyleModel.parseRuleArrayPayload = function(ruleArray)
 WebInspector.CSSStyleModel.prototype = {
     getStylesAsync: function(nodeId, userCallback)
     {
-        function callback(userCallback, payload)
+        function callback(userCallback, error, payload)
         {
-            if (!payload) {
+            if (error) {
                 if (userCallback)
                     userCallback(null);
                 return;
@@ -59,8 +59,11 @@ WebInspector.CSSStyleModel.prototype = {
             result.matchedCSSRules = WebInspector.CSSStyleModel.parseRuleArrayPayload(payload.matchedCSSRules);
 
             result.styleAttributes = {};
-            for (var name in payload.styleAttributes)
-                result.styleAttributes[name] = WebInspector.CSSStyleDeclaration.parsePayload(payload.styleAttributes[name]);
+            var payloadStyleAttributes = payload.styleAttributes;
+            for (var i = 0; i < payloadStyleAttributes.length; ++i) {
+                var name = payloadStyleAttributes[i].name;
+                result.styleAttributes[name] = WebInspector.CSSStyleDeclaration.parsePayload(payloadStyleAttributes[i].style);
+            }
 
             result.pseudoElements = [];
             for (var i = 0; i < payload.pseudoElements.length; ++i) {
@@ -88,9 +91,9 @@ WebInspector.CSSStyleModel.prototype = {
 
     getComputedStyleAsync: function(nodeId, userCallback)
     {
-        function callback(userCallback, stylePayload)
+        function callback(userCallback, error, stylePayload)
         {
-            if (!stylePayload)
+            if (error)
                 userCallback(null);
             else
                 userCallback(WebInspector.CSSStyleDeclaration.parsePayload(stylePayload));
@@ -101,9 +104,9 @@ WebInspector.CSSStyleModel.prototype = {
 
     getInlineStyleAsync: function(nodeId, userCallback)
     {
-        function callback(userCallback, stylePayload)
+        function callback(userCallback, error, stylePayload)
         {
-            if (!stylePayload)
+            if (error)
                 userCallback(null);
             else
                 userCallback(WebInspector.CSSStyleDeclaration.parsePayload(stylePayload));
@@ -114,28 +117,31 @@ WebInspector.CSSStyleModel.prototype = {
 
     setRuleSelector: function(ruleId, nodeId, newSelector, successCallback, failureCallback)
     {
-        function checkAffectsCallback(nodeId, successCallback, rulePayload, selectedNodeIds)
+        function checkAffectsCallback(nodeId, successCallback, rulePayload, error, selectedNodeIds)
         {
+            if (error)
+                return;
             var doesAffectSelectedNode = (selectedNodeIds.indexOf(nodeId) >= 0);
             var rule = WebInspector.CSSRule.parsePayload(rulePayload);
             successCallback(rule, doesAffectSelectedNode);
             this._styleSheetChanged(rule.id.styleSheetId, true);
         }
 
-        function callback(nodeId, successCallback, failureCallback, newSelector, rulePayload)
+        function callback(nodeId, successCallback, failureCallback, error, newSelector, rulePayload)
         {
-            if (!rulePayload)
+            // FIXME: looks like rulePayload is always null.
+            if (error)
                 failureCallback();
             else
                 DOMAgent.querySelectorAll(nodeId, newSelector, true, checkAffectsCallback.bind(this, nodeId, successCallback, rulePayload));
         }
 
-        CSSAgent.setRuleSelector(ruleId, newSelector, callback.bind(this, nodeId, successCallback, failureCallback));
+        CSSAgent.setRuleSelector(ruleId, newSelector, callback.bind(this, nodeId, successCallback, failureCallback, newSelector));
     },
 
     addRule: function(nodeId, selector, successCallback, failureCallback)
     {
-        function checkAffectsCallback(nodeId, successCallback, rulePayload, selectedNodeIds)
+        function checkAffectsCallback(nodeId, successCallback, rulePayload, error, selectedNodeIds)
         {
             var doesAffectSelectedNode = (selectedNodeIds.indexOf(nodeId) >= 0);
             var rule = WebInspector.CSSRule.parsePayload(rulePayload);
@@ -143,9 +149,9 @@ WebInspector.CSSStyleModel.prototype = {
             this._styleSheetChanged(rule.id.styleSheetId, true);
         }
 
-        function callback(successCallback, failureCallback, selector, rulePayload)
+        function callback(successCallback, failureCallback, selector, error, rulePayload)
         {
-            if (!rulePayload) {
+            if (error) {
                 // Invalid syntax for a selector
                 failureCallback();
             } else
@@ -160,21 +166,26 @@ WebInspector.CSSStyleModel.prototype = {
         if (!majorChange || !styleSheetId)
             return;
 
-        function callback(href, content)
+        function callback(error, href, content)
         {
+            if (error)
+                return;
             var resource = WebInspector.resourceForURL(href);
-            if (resource && resource.type === WebInspector.Resource.Type.Stylesheet)
+            if (resource && resource.type === WebInspector.Resource.Type.Stylesheet) {
                 resource.setContent(content, this._onRevert.bind(this, styleSheetId));
+                this.dispatchEventToListeners("stylesheet changed");
+            }
         }
         CSSAgent.getStyleSheetText(styleSheetId, callback.bind(this));
     },
 
     _onRevert: function(styleSheetId, contentToRevertTo)
     {
-        function callback(success)
+        function callback(error, success)
         {
+            if (error)
+                return;
             this._styleSheetChanged(styleSheetId, true);
-            this.dispatchEventToListeners("stylesheet changed");
         }
         CSSAgent.setStyleSheetText(styleSheetId, contentToRevertTo, callback.bind(this));
     }
@@ -335,12 +346,12 @@ WebInspector.CSSStyleDeclaration.prototype = {
 
     insertPropertyAt: function(index, name, value, userCallback)
     {
-        function callback(userCallback, payload)
+        function callback(userCallback, error, payload)
         {
             if (!userCallback)
                 return;
 
-            if (!payload)
+            if (error)
                 userCallback(null);
             else {
                 userCallback(WebInspector.CSSStyleDeclaration.parsePayload(payload));
@@ -412,8 +423,14 @@ WebInspector.CSSProperty = function(ownerStyle, index, name, value, priority, st
 
 WebInspector.CSSProperty.parsePayload = function(ownerStyle, index, payload)
 {
+    // The following default field values are used in the payload:
+    // priority: ""
+    // parsedOk: true
+    // implicit: false
+    // status: "style"
+    // shorthandName: ""
     var result = new WebInspector.CSSProperty(
-        ownerStyle, index, payload.name, payload.value, payload.priority, payload.status, payload.parsedOk, payload.implicit, payload.shorthandName, payload.text);
+        ownerStyle, index, payload.name, payload.value, payload.priority || "", payload.status || "style", ("parsedOk" in payload) ? payload.parsedOk : true, !!payload.implicit, payload.shorthandName || "", payload.text);
     return result;
 }
 
@@ -464,9 +481,9 @@ WebInspector.CSSProperty.prototype = {
                 userCallback(style);
         }
 
-        function callback(stylePayload)
+        function callback(error, stylePayload)
         {
-            if (stylePayload) {
+            if (!error && stylePayload) {
                 this.text = propertyText;
                 var style = WebInspector.CSSStyleDeclaration.parsePayload(stylePayload);
                 var newProperty = style.allProperties[this.index];
@@ -504,11 +521,11 @@ WebInspector.CSSProperty.prototype = {
         if (disabled === this.disabled && userCallback)
             userCallback(this.ownerStyle);
 
-        function callback(stylePayload)
+        function callback(error, stylePayload)
         {
             if (!userCallback)
                 return;
-            if (!stylePayload)
+            if (error)
                 userCallback(null);
             else {
                 var style = WebInspector.CSSStyleDeclaration.parsePayload(stylePayload);
@@ -524,9 +541,6 @@ WebInspector.CSSProperty.prototype = {
 WebInspector.CSSStyleSheet = function(payload)
 {
     this.id = payload.styleSheetId;
-    this.sourceURL = payload.sourceURL;
-    this.title = payload.title;
-    this.disabled = payload.disabled;
     this.rules = [];
     this.styles = {};
     for (var i = 0; i < payload.rules.length; ++i) {
@@ -541,9 +555,9 @@ WebInspector.CSSStyleSheet = function(payload)
 
 WebInspector.CSSStyleSheet.createForId = function(styleSheetId, userCallback)
 {
-    function callback(styleSheetPayload)
+    function callback(error, styleSheetPayload)
     {
-        if (!styleSheetPayload)
+        if (error)
             userCallback(null);
         else
             userCallback(new WebInspector.CSSStyleSheet(styleSheetPayload));
@@ -559,14 +573,12 @@ WebInspector.CSSStyleSheet.prototype = {
 
     setText: function(newText, userCallback)
     {
-        function callback(styleSheetPayload)
+        function callback(error, isChangeSuccessful)
         {
-            if (!styleSheetPayload)
-                userCallback(null);
-            else {
-                userCallback(new WebInspector.CSSStyleSheet(styleSheetPayload));
-                WebInspector.cssModel._styleSheetChanged(this.id, true);
-            }
+             if (userCallback)
+                 userCallback(isChangeSuccessful);
+             if (isChangeSuccessful)
+                 WebInspector.cssModel._styleSheetChanged(this.id, true);
         }
 
         CSSAgent.setStyleSheetText(this.id, newText, callback.bind(this));
diff --git a/Source/WebCore/inspector/front-end/CallStackSidebarPane.js b/Source/WebCore/inspector/front-end/CallStackSidebarPane.js
index e1618b2..3d71101 100644
--- a/Source/WebCore/inspector/front-end/CallStackSidebarPane.js
+++ b/Source/WebCore/inspector/front-end/CallStackSidebarPane.js
@@ -27,16 +27,18 @@ WebInspector.CallStackSidebarPane = function(model)
 {
     WebInspector.SidebarPane.call(this, WebInspector.UIString("Call Stack"));
     this._model = model;
+
+    this.bodyElement.addEventListener("contextmenu", this._contextMenu.bind(this), true);
 }
 
 WebInspector.CallStackSidebarPane.prototype = {
-    update: function(details)
+    update: function(callFrames, details)
     {
         this.bodyElement.removeChildren();
 
         this.placards = [];
 
-        if (!details) {
+        if (!callFrames) {
             var infoElement = document.createElement("div");
             infoElement.className = "info";
             infoElement.textContent = WebInspector.UIString("Not Paused");
@@ -44,7 +46,6 @@ WebInspector.CallStackSidebarPane.prototype = {
             return;
         }
 
-        var callFrames = details.callFrames;
         var title;
         var subtitle;
         var script;
@@ -60,36 +61,38 @@ WebInspector.CallStackSidebarPane.prototype = {
                 break;
             }
 
-            script = WebInspector.debuggerModel.scriptForSourceID(callFrame.sourceID);
-            if (script)
-                subtitle = WebInspector.displayNameForURL(script.sourceURL);
+            var subtitle;
+            if (!callFrame.isInternalScript)
+                subtitle = WebInspector.displayNameForURL(callFrame.url);
             else
                 subtitle = WebInspector.UIString("(internal script)");
 
-            if (subtitle)
-                subtitle += ":" + (callFrame.line + 1);
-            else
-                subtitle = WebInspector.UIString("line %d", callFrame.line + 1);
-
             var placard = new WebInspector.Placard(title, subtitle);
             placard.callFrame = callFrame;
-
-            placard.element.addEventListener("click", this._placardSelected.bind(this), false);
+            placard.element.addEventListener("click", this._placardSelected.bind(this, placard), false);
+
+            function didGetSourceLocation(placard, sourceFileId, lineNumber, columnNumber)
+            {
+                if (placard.subtitle)
+                    placard.subtitle += ":" + (lineNumber + 1);
+                else
+                    placard.subtitle = WebInspector.UIString("line %d", lineNumber + 1);
+                placard._text = WebInspector.UIString("%s() at %s", placard.title, placard.subtitle);
+            }
+            callFrame.sourceLocation(didGetSourceLocation.bind(this, placard));
 
             this.placards.push(placard);
             this.bodyElement.appendChild(placard.element);
         }
 
-        if (details.breakpoint)
-            this._scriptBreakpointHit();
-        else if (details.eventType === WebInspector.DebuggerEventTypes.NativeBreakpoint)
-            this._nativeBreakpointHit(details.eventData);
+        if (details.eventType === WebInspector.DebuggerEventTypes.NativeBreakpoint) {
+            if (details.eventData.breakpointType === WebInspector.BreakpointManager.BreakpointTypes.DOM)
+                this._domBreakpointHit(details.eventData);
+        }
     },
 
     set selectedCallFrame(x)
     {
-        this._model.selectedCallFrame = x;
-
         for (var i = 0; i < this.placards.length; ++i) {
             var placard = this.placards[i];
             placard.selected = (placard.callFrame === x);
@@ -142,10 +145,27 @@ WebInspector.CallStackSidebarPane.prototype = {
         return -1;
     },
 
-    _placardSelected: function(event)
+    _placardSelected: function(placard, event)
+    {
+        this._model.selectedCallFrame = placard.callFrame;
+    },
+
+    _contextMenu: function(event)
+    {
+        if (!this.placards.length)
+            return;
+
+        var contextMenu = new WebInspector.ContextMenu();
+        contextMenu.appendItem(WebInspector.UIString("Copy Stack Trace"), this._copyStackTrace.bind(this));
+        contextMenu.show(event);
+    },
+
+    _copyStackTrace: function()
     {
-        var placardElement = event.target.enclosingNodeOrSelfWithClass("placard");
-        this.selectedCallFrame = placardElement.placard.callFrame;
+        var text = "";
+        for (var i = 0; i < this.placards.length; ++i)
+            text += this.placards[i]._text;
+        InspectorFrontendHost.copyText(text);
     },
 
     registerShortcuts: function(section)
@@ -163,15 +183,15 @@ WebInspector.CallStackSidebarPane.prototype = {
         section.addRelatedKeys([ nextCallFrame.name, prevCallFrame.name ], WebInspector.UIString("Next/previous call frame"));
     },
 
-    _scriptBreakpointHit: function()
+    setStatus: function(status)
     {
         var statusMessageElement = document.createElement("div");
         statusMessageElement.className = "info";
-        statusMessageElement.appendChild(document.createTextNode(WebInspector.UIString("Paused on a JavaScript breakpoint.")));
+        statusMessageElement.textContent = status;
         this.bodyElement.appendChild(statusMessageElement);
     },
 
-    _nativeBreakpointHit: function(eventData)
+    _domBreakpointHit: function(eventData)
     {
         var breakpoint = WebInspector.breakpointManager.breakpointViewForEventData(eventData);
         if (!breakpoint)
diff --git a/Source/WebCore/inspector/front-end/Color.js b/Source/WebCore/inspector/front-end/Color.js
index 5e7314c..73e47d4 100644
--- a/Source/WebCore/inspector/front-end/Color.js
+++ b/Source/WebCore/inspector/front-end/Color.js
@@ -597,7 +597,7 @@ WebInspector.Color.Nicknames = {
     "mediumaquamarine": "66CDAA",
     "mediumblue": "0000CD",
     "mediumorchid": "BA55D3",
-    "mediumpurple": "9370D8",
+    "mediumpurple": "9370DB",
     "mediumseagreen": "3CB371",
     "mediumslateblue": "7B68EE",
     "mediumspringgreen": "00FA9A",
@@ -618,7 +618,7 @@ WebInspector.Color.Nicknames = {
     "palegoldenrod": "EEE8AA",
     "palegreen": "98FB98",
     "paleturquoise": "AFEEEE",
-    "palevioletred": "D87093",
+    "palevioletred": "DB7093",
     "papayawhip": "FFEFD5",
     "peachpuff": "FFDAB9",
     "peru": "CD853F",
diff --git a/Source/WebCore/inspector/front-end/ConsoleView.js b/Source/WebCore/inspector/front-end/ConsoleView.js
index f59d87f..f3e3425 100644
--- a/Source/WebCore/inspector/front-end/ConsoleView.js
+++ b/Source/WebCore/inspector/front-end/ConsoleView.js
@@ -105,7 +105,7 @@ WebInspector.ConsoleView.prototype = {
     _registerConsoleDomainDispatcher: function() {
         var console = this;
         var dispatcher = {
-            addConsoleMessage: function(payload)
+            consoleMessage: function(payload)
             {
                 var consoleMessage = new WebInspector.ConsoleMessage(
                     payload.source,
@@ -121,13 +121,7 @@ WebInspector.ConsoleView.prototype = {
                 console.addMessage(consoleMessage);
             },
 
-            updateConsoleMessageExpiredCount: function(count)
-            {
-                var message = String.sprintf(WebInspector.UIString("%d console messages are not shown."), count);
-                console.addMessage(WebInspector.ConsoleMessage.createTextMessage(message, WebInspector.ConsoleMessage.MessageLevel.Warning));
-            },
-
-            updateConsoleMessageRepeatCount: function(count)
+            consoleMessageRepeatCountUpdated: function(count)
             {
                 var msg = console.previousMessage;
                 var prevRepeatCount = msg.totalRepeatCount;
@@ -154,6 +148,14 @@ WebInspector.ConsoleView.prototype = {
         InspectorBackend.registerDomainDispatcher("Console", dispatcher);
     },
 
+    setConsoleMessageExpiredCount: function(count)
+    {
+        if (count) {
+            var message = String.sprintf(WebInspector.UIString("%d console messages are not shown."), count);
+            this.addMessage(WebInspector.ConsoleMessage.createTextMessage(message, WebInspector.ConsoleMessage.MessageLevel.Warning));
+        }
+    },
+
     _updateFilter: function(e)
     {
         var isMac = WebInspector.isMac();
@@ -298,7 +300,8 @@ WebInspector.ConsoleView.prototype = {
             this.currentGroup.addMessage(msg);
         }
 
-        if (shouldScrollToLastMessage)
+        // Always scroll when command result arrives.
+        if (shouldScrollToLastMessage || (msg instanceof WebInspector.ConsoleCommandResult))
             this._scheduleScrollIntoView();
     },
 
@@ -364,7 +367,7 @@ WebInspector.ConsoleView.prototype = {
 
         function evaluatedProperties(properties)
         {
-            RuntimeAgent.releaseObjectGroup(0, "completion");
+            RuntimeAgent.releaseObjectGroup("completion");
             var propertyNames = [];
             for (var i = 0; properties && i < properties.length; ++i)
                 propertyNames.push(properties[i].name);
@@ -531,9 +534,10 @@ WebInspector.ConsoleView.prototype = {
             expression = "this";
         }
 
-        function evalCallback(result)
+        function evalCallback(error, result)
         {
-            callback(WebInspector.RemoteObject.fromPayload(result));
+            if (!error)
+                callback(WebInspector.RemoteObject.fromPayload(result));
         }
         RuntimeAgent.evaluate(expression, objectGroup, includeCommandLineAPI, evalCallback);
     },
diff --git a/Source/WebCore/inspector/front-end/CookieItemsView.js b/Source/WebCore/inspector/front-end/CookieItemsView.js
index c8187bb..6bf3326 100644
--- a/Source/WebCore/inspector/front-end/CookieItemsView.js
+++ b/Source/WebCore/inspector/front-end/CookieItemsView.js
@@ -140,7 +140,7 @@ WebInspector.CookieItemsView.prototype = {
 
     _deleteCookie: function(cookie)
     {
-        InspectorAgent.deleteCookie(cookie.name, this._cookieDomain);
+        PageAgent.deleteCookie(cookie.name, this._cookieDomain);
         this._update();
     },
 
@@ -199,3 +199,57 @@ WebInspector.SimpleCookiesTable.prototype = {
             this._dataGrid.updateWidths();
     }
 }
+
+
+WebInspector.Cookies = {}
+
+WebInspector.Cookies.getCookiesAsync = function(callback)
+{
+    function mycallback(error, cookies, cookiesString)
+    {
+        if (error)
+            return;
+        if (cookiesString)
+            callback(WebInspector.Cookies.buildCookiesFromString(cookiesString), false);
+        else
+            callback(cookies, true);
+    }
+
+    PageAgent.getCookies(mycallback);
+}
+
+WebInspector.Cookies.buildCookiesFromString = function(rawCookieString)
+{
+    var rawCookies = rawCookieString.split(/;\s*/);
+    var cookies = [];
+
+    if (!(/^\s*$/.test(rawCookieString))) {
+        for (var i = 0; i < rawCookies.length; ++i) {
+            var cookie = rawCookies[i];
+            var delimIndex = cookie.indexOf("=");
+            var name = cookie.substring(0, delimIndex);
+            var value = cookie.substring(delimIndex + 1);
+            var size = name.length + value.length;
+            cookies.push({ name: name, value: value, size: size });
+        }
+    }
+
+    return cookies;
+}
+
+WebInspector.Cookies.cookieMatchesResourceURL = function(cookie, resourceURL)
+{
+    var url = resourceURL.asParsedURL();
+    if (!url || !this.cookieDomainMatchesResourceDomain(cookie.domain, url.host))
+        return false;
+    return (url.path.indexOf(cookie.path) === 0
+        && (!cookie.port || url.port == cookie.port)
+        && (!cookie.secure || url.scheme === "https"));
+}
+
+WebInspector.Cookies.cookieDomainMatchesResourceDomain = function(cookieDomain, resourceDomain)
+{
+    if (cookieDomain.charAt(0) !== '.')
+        return resourceDomain === cookieDomain;
+    return !!resourceDomain.match(new RegExp("^([^\\.]+\\.)?" + cookieDomain.substring(1).escapeForRegExp() + "$"), "i");
+}
diff --git a/Source/WebCore/inspector/front-end/DOMAgent.js b/Source/WebCore/inspector/front-end/DOMAgent.js
index cb28aba..a2a9c2d 100644
--- a/Source/WebCore/inspector/front-end/DOMAgent.js
+++ b/Source/WebCore/inspector/front-end/DOMAgent.js
@@ -33,13 +33,12 @@ WebInspector.DOMNode = function(doc, payload) {
     this.ownerDocument = doc;
 
     this.id = payload.id;
-    this.nodeType = payload.nodeType;
-    this.nodeName = payload.nodeName;
-    this.localName = payload.localName;
+    this._nodeType = payload.nodeType;
+    this._nodeName = payload.nodeName;
+    this._localName = payload.localName;
     this._nodeValue = payload.nodeValue;
-    this.textContent = this.nodeValue;
 
-    this.attributes = [];
+    this._attributes = [];
     this._attributesMap = {};
     if (payload.attributes)
         this._setAttributesPayload(payload.attributes);
@@ -62,21 +61,21 @@ WebInspector.DOMNode = function(doc, payload) {
 
     this.breakpoints = {};
 
-    if (this.nodeType === Node.ELEMENT_NODE) {
+    if (this._nodeType === Node.ELEMENT_NODE) {
         // HTML and BODY from internal iframes should not overwrite top-level ones.
-        if (!this.ownerDocument.documentElement && this.nodeName === "HTML")
+        if (!this.ownerDocument.documentElement && this._nodeName === "HTML")
             this.ownerDocument.documentElement = this;
-        if (!this.ownerDocument.body && this.nodeName === "BODY")
+        if (!this.ownerDocument.body && this._nodeName === "BODY")
             this.ownerDocument.body = this;
         if (payload.documentURL)
             this.documentURL = payload.documentURL;
-    } else if (this.nodeType === Node.DOCUMENT_TYPE_NODE) {
+    } else if (this._nodeType === Node.DOCUMENT_TYPE_NODE) {
         this.publicId = payload.publicId;
         this.systemId = payload.systemId;
         this.internalSubset = payload.internalSubset;
-    } else if (this.nodeType === Node.DOCUMENT_NODE) {
+    } else if (this._nodeType === Node.DOCUMENT_NODE) {
         this.documentURL = payload.documentURL;
-    } else if (this.nodeType === Node.ATTRIBUTE_NODE) {
+    } else if (this._nodeType === Node.ATTRIBUTE_NODE) {
         this.name = payload.name;
         this.value = payload.value;
     }
@@ -85,7 +84,7 @@ WebInspector.DOMNode = function(doc, payload) {
 WebInspector.DOMNode.prototype = {
     hasAttributes: function()
     {
-        return this.attributes.length > 0;
+        return this._attributes.length > 0;
     },
 
     hasChildNodes: function()
@@ -93,14 +92,34 @@ WebInspector.DOMNode.prototype = {
         return this._childNodeCount > 0;
     },
 
-    get nodeValue() {
+    nodeType: function()
+    {
+        return this._nodeType;
+    },
+
+    nodeName: function()
+    {
+        return this._nodeName;
+    },
+
+    setNodeName: function(name, callback)
+    {
+        DOMAgent.setNodeName(this.id, name, callback);
+    },
+
+    localName: function()
+    {
+        return this._localName;
+    },
+
+    nodeValue: function()
+    {
         return this._nodeValue;
     },
 
-    set nodeValue(value) {
-        if (this.nodeType != Node.TEXT_NODE)
-            return;
-        this.ownerDocument._domAgent.setTextNodeValueAsync(this, value, function() {});
+    setNodeValue: function(value, callback)
+    {
+        DOMAgent.setNodeValue(this.id, value, callback);
     },
 
     getAttribute: function(name)
@@ -109,42 +128,95 @@ WebInspector.DOMNode.prototype = {
         return attr ? attr.value : undefined;
     },
 
-    setAttribute: function(name, value)
+    setAttribute: function(name, value, callback)
     {
-        var self = this;
-        var callback = function()
+        function mycallback(error)
         {
-            var attr = self._attributesMap[name];
-            if (attr)
-                attr.value = value;
-            else
-                attr = self._addAttribute(name, value);
-        };
-        this.ownerDocument._domAgent.setAttributeAsync(this, name, value, callback);
+            if (!error) {
+                var attr = this._attributesMap[name];
+                if (attr)
+                    attr.value = value;
+                else
+                    attr = this._addAttribute(name, value);
+            }
+
+            if (callback)
+                callback();
+        }
+        DOMAgent.setAttribute(this.id, name, value, mycallback.bind(this));
     },
 
-    removeAttribute: function(name)
+    attributes: function()
     {
-        var self = this;
-        var callback = function()
+        return this._attributes;
+    },
+
+    removeAttribute: function(name, callback)
+    {
+        function mycallback(error, success)
         {
-            delete self._attributesMap[name];
-            for (var i = 0;  i < self.attributes.length; ++i) {
-                if (self.attributes[i].name == name) {
-                    self.attributes.splice(i, 1);
-                    break;
+            if (!error) {
+                delete this._attributesMap[name];
+                for (var i = 0;  i < this._attributes.length; ++i) {
+                    if (this._attributes[i].name === name) {
+                        this._attributes.splice(i, 1);
+                        break;
+                    }
                 }
             }
-        };
-        this.ownerDocument._domAgent.removeAttributeAsync(this, name, callback);
+
+            if (callback)
+                callback();
+        }
+        DOMAgent.removeAttribute(this.id, name, mycallback.bind(this));
+    },
+
+    getChildNodes: function(callback)
+    {
+        if (this.children) {
+            if (callback)
+                callback(this.children);
+            return;
+        }
+
+        function mycallback(error) {
+            if (!error && callback)
+                callback(this.children);
+        }
+        DOMAgent.getChildNodes(this.id, mycallback.bind(this));
+    },
+
+    getOuterHTML: function(callback)
+    {
+        DOMAgent.getOuterHTML(this.id, callback);
+    },
+
+    setOuterHTML: function(html, callback)
+    {
+        DOMAgent.setOuterHTML(this.id, html, callback);
+    },
+
+    removeNode: function(callback)
+    {
+        DOMAgent.removeNode(this.id, callback);
+    },
+
+    copyNode: function(callback)
+    {
+        DOMAgent.copyNode(this.id, callback);
+    },
+
+    eventListeners: function(callback)
+    {
+        DOMAgent.getEventListenersForNode(this.id, callback);
     },
 
     path: function()
     {
         var path = [];
         var node = this;
-        while (node && "index" in node && node.nodeName.length) {
-            path.push([node.index, node.nodeName]);
+        while (node && "index" in node && node._nodeName.length) {
+            path.push([node.index, node._nodeName]);
             node = node.parentNode;
         }
         path.reverse();
@@ -153,7 +225,7 @@ WebInspector.DOMNode.prototype = {
 
     _setAttributesPayload: function(attrs)
     {
-        this.attributes = [];
+        this._attributes = [];
         this._attributesMap = {};
         for (var i = 0; i < attrs.length; i += 2)
             this._addAttribute(attrs[i], attrs[i + 1]);
@@ -219,7 +291,7 @@ WebInspector.DOMNode.prototype = {
             "_node": this
         };
         this._attributesMap[name] = attr;
-        this.attributes.push(attr);
+        this._attributes.push(attr);
     }
 }
 
@@ -230,42 +302,6 @@ WebInspector.DOMDocument = function(domAgent, payload)
     this._domAgent = domAgent;
 }
 
-WebInspector.DOMDocument.prototype = {
-
-    addEventListener: function(name, callback)
-    {
-        var listeners = this._listeners[name];
-        if (!listeners) {
-            listeners = [];
-            this._listeners[name] = listeners;
-        }
-        listeners.push(callback);
-    },
-
-    removeEventListener: function(name, callback)
-    {
-        var listeners = this._listeners[name];
-        if (!listeners)
-            return;
-
-        var index = listeners.indexOf(callback);
-        if (index != -1)
-            listeners.splice(index, 1);
-    },
-
-    _fireDomEvent: function(name, event)
-    {
-        var listeners = this._listeners[name];
-        if (!listeners)
-            return;
-
-        for (var i = 0; i < listeners.length; ++i) {
-            var listener = listeners[i];
-            listener.call(this, event);
-        }
-    }
-}
-
 WebInspector.DOMDocument.prototype.__proto__ = WebInspector.DOMNode.prototype;
 
 WebInspector.DOMAgent = function() {
@@ -274,101 +310,84 @@ WebInspector.DOMAgent = function() {
     InspectorBackend.registerDomainDispatcher("DOM", new WebInspector.DOMDispatcher(this));
 }
 
+WebInspector.DOMAgent.Events = {
+    AttrModified: "AttrModified",
+    CharacterDataModified: "CharacterDataModified",
+    NodeInserted: "NodeInserted",
+    NodeRemoved: "NodeRemoved",
+    DocumentUpdated: "DocumentUpdated",
+    ChildNodeCountUpdated: "ChildNodeCountUpdated"
+}
+
 WebInspector.DOMAgent.prototype = {
     requestDocument: function(callback)
     {
         if (this._document) {
             if (callback)
                 callback(this._document);
-        } else
-            this._documentUpdated(callback);
+            return;
+        }
+
+        function mycallback(error, root)
+        {
+            if (!error)
+                this._setDocument(root);
+
+            if (callback)
+                callback(this._document);
+        }
+        DOMAgent.getDocument(mycallback.bind(this));
     },
 
     pushNodeToFrontend: function(objectId, callback)
     {
+        function callbackWrapper(error, nodeId)
+        {
+            if (callback)
+                callback(error ? 0 : nodeId);
+        }
+
         function mycallback()
         {
             if (this._document)
-                DOMAgent.pushNodeToFrontend(objectId, callback);
-            else {
-                if (callback)
-                    callback(0);
-            }
+                DOMAgent.pushNodeToFrontend(objectId, callbackWrapper);
+            else
+                callbackWrapper("No document");
         }
+
         this.requestDocument(mycallback.bind(this));
     },
 
     pushNodeByPathToFrontend: function(path, callback)
     {
+        function callbackWrapper(error, nodeId)
+        {
+            if (callback)
+                callback(error ? 0 : nodeId);
+        }
+
         function mycallback()
         {
             if (this._document)
-                DOMAgent.pushNodeByPathToFrontend(path, callback);
-            else {
-                if (callback)
-                    callback(0);
-            }
+                DOMAgent.pushNodeByPathToFrontend(path, callbackWrapper);
+            else
+                callbackWrapper("No document");
         }
         this.requestDocument(mycallback.bind(this));
     },
 
-    getChildNodesAsync: function(parent, callback)
-    {
-        var children = parent.children;
-        if (children) {
-            callback(children);
-            return;
-        }
-        function mycallback() {
-            callback(parent.children);
-        }
-        DOMAgent.getChildNodes(parent.id, mycallback);
-    },
-
-    setAttributeAsync: function(node, name, value, callback)
-    {
-        var mycallback = this._didApplyDomChange.bind(this, node, callback);
-        DOMAgent.setAttribute(node.id, name, value, mycallback);
-    },
-
-    removeAttributeAsync: function(node, name, callback)
-    {
-        var mycallback = this._didApplyDomChange.bind(this, node, callback);
-        DOMAgent.removeAttribute(node.id, name, mycallback);
-    },
-
-    setTextNodeValueAsync: function(node, text, callback)
-    {
-        var mycallback = this._didApplyDomChange.bind(this, node, callback);
-        DOMAgent.setTextNodeValue(node.id, text, mycallback);
-    },
-
-    _didApplyDomChange: function(node, callback, success)
-    {
-        if (!success)
-            return;
-        callback();
-        // TODO(pfeldman): Fix this hack.
-        var elem = WebInspector.panels.elements.treeOutline.findTreeElement(node);
-        if (elem)
-            elem.updateTitle();
-    },
-
     _attributesUpdated: function(nodeId, attrsArray)
     {
         var node = this._idToDOMNode[nodeId];
         node._setAttributesPayload(attrsArray);
-        var event = {target: node};
-        this._document._fireDomEvent("DOMAttrModified", event);
+        this.dispatchEventToListeners(WebInspector.DOMAgent.Events.AttrModified, node);
     },
 
     _characterDataModified: function(nodeId, newValue)
     {
         var node = this._idToDOMNode[nodeId];
         node._nodeValue = newValue;
-        node.textContent = newValue;
-        var event = { target : node };
-        this._document._fireDomEvent("DOMCharacterDataModified", event);
+        this.dispatchEventToListeners(WebInspector.DOMAgent.Events.CharacterDataModified, node);
     },
 
     nodeForId: function(nodeId)
@@ -376,15 +395,10 @@ WebInspector.DOMAgent.prototype = {
         return this._idToDOMNode[nodeId];
     },
 
-    _documentUpdated: function(callback)
+    _documentUpdated: function()
     {
-        function mycallback(root)
-        {
-            this._setDocument(root);
-            if (callback)
-                callback(this._document);
-        }
-        DOMAgent.getDocument(mycallback.bind(this));
+        this._setDocument(null);
+        this.requestDocument();
     },
 
     _setDocument: function(payload)
@@ -393,11 +407,11 @@ WebInspector.DOMAgent.prototype = {
         if (payload && "id" in payload) {
             this._document = new WebInspector.DOMDocument(this, payload);
             this._idToDOMNode[payload.id] = this._document;
-            this._bindNodes(this._document.children);
-            WebInspector.breakpointManager.restoreDOMBreakpoints();
+            if (this._document.children)
+                this._bindNodes(this._document.children);
         } else
             this._document = null;
-        WebInspector.panels.elements.setDocument(this._document);
+        this.dispatchEventToListeners(WebInspector.DOMAgent.Events.DocumentUpdated, this._document);
     },
 
     _setDetachedRoot: function(payload)
@@ -432,10 +446,7 @@ WebInspector.DOMAgent.prototype = {
     {
         var node = this._idToDOMNode[nodeId];
         node._childNodeCount = newValue;
-        var outline = WebInspector.panels.elements.treeOutline;
-        var treeElement = outline.findTreeElement(node);
-        if (treeElement)
-            treeElement.hasChildren = newValue;
+        this.dispatchEventToListeners(WebInspector.DOMAgent.Events.ChildNodeCountUpdated, node);
     },
 
     _childNodeInserted: function(parentId, prevId, payload)
@@ -444,8 +455,7 @@ WebInspector.DOMAgent.prototype = {
         var prev = this._idToDOMNode[prevId];
         var node = parent._insertChild(prev, payload);
         this._idToDOMNode[node.id] = node;
-        var event = { target : node, relatedNode : parent };
-        this._document._fireDomEvent("DOMNodeInserted", event);
+        this.dispatchEventToListeners(WebInspector.DOMAgent.Events.NodeInserted, node);
     },
 
     _childNodeRemoved: function(parentId, nodeId)
@@ -453,8 +463,7 @@ WebInspector.DOMAgent.prototype = {
         var parent = this._idToDOMNode[parentId];
         var node = this._idToDOMNode[nodeId];
         parent.removeChild_(node);
-        var event = { target : node, relatedNode : parent };
-        this._document._fireDomEvent("DOMNodeRemoved", event);
+        this.dispatchEventToListeners(WebInspector.DOMAgent.Events.NodeRemoved, {node:node, parent:parent});
         delete this._idToDOMNode[nodeId];
         this._removeBreakpoints(node);
     },
@@ -467,9 +476,23 @@ WebInspector.DOMAgent.prototype = {
             return;
         for (var i = 0; i < node.children.length; ++i)
             this._removeBreakpoints(node.children[i]);
+    },
+
+    performSearch: function(query, searchResultCollector, searchSynchronously)
+    {
+        this._searchResultCollector = searchResultCollector;
+        DOMAgent.performSearch(query, !!searchSynchronously);
+    },
+
+    cancelSearch: function()
+    {
+        delete this._searchResultCollector;
+        DOMAgent.cancelSearch();
     }
 }
 
+WebInspector.DOMAgent.prototype.__proto__ = WebInspector.Object.prototype;
+
 WebInspector.DOMDispatcher = function(domAgent)
 {
     this._domAgent = domAgent;
@@ -516,98 +539,9 @@ WebInspector.DOMDispatcher.prototype = {
         WebInspector.updateFocusedNode(nodeId);
     },
 
-    addNodesToSearchResult: function(nodeIds)
+    searchResults: function(nodeIds)
     {
-        WebInspector.panels.elements.addNodesToSearchResult(nodeIds);
+        if (this._domAgent._searchResultCollector)
+            this._domAgent._searchResultCollector(nodeIds);
     }
 }
-
-WebInspector.ApplicationCacheDispatcher = function()
-{
-}
-
-WebInspector.ApplicationCacheDispatcher.getApplicationCachesAsync = function(callback)
-{
-    function mycallback(applicationCaches)
-    {
-        // FIXME: Currently, this list only returns a single application cache.
-        if (applicationCaches)
-            callback(applicationCaches);
-    }
-
-    ApplicationCacheAgent.getApplicationCaches(mycallback);
-}
-
-WebInspector.ApplicationCacheDispatcher.prototype = {
-    updateApplicationCacheStatus: function(status)
-    {
-        WebInspector.panels.resources.updateApplicationCacheStatus(status);
-    },
-
-    updateNetworkState: function(isNowOnline)
-    {
-        WebInspector.panels.resources.updateNetworkState(isNowOnline);
-    }
-}
-
-InspectorBackend.registerDomainDispatcher("ApplicationCache", new WebInspector.ApplicationCacheDispatcher());
-
-WebInspector.Cookies = {}
-
-WebInspector.Cookies.getCookiesAsync = function(callback)
-{
-    function mycallback(cookies, cookiesString)
-    {
-        if (cookiesString)
-            callback(WebInspector.Cookies.buildCookiesFromString(cookiesString), false);
-        else
-            callback(cookies, true);
-    }
-
-    InspectorAgent.getCookies(mycallback);
-}
-
-WebInspector.Cookies.buildCookiesFromString = function(rawCookieString)
-{
-    var rawCookies = rawCookieString.split(/;\s*/);
-    var cookies = [];
-
-    if (!(/^\s*$/.test(rawCookieString))) {
-        for (var i = 0; i < rawCookies.length; ++i) {
-            var cookie = rawCookies[i];
-            var delimIndex = cookie.indexOf("=");
-            var name = cookie.substring(0, delimIndex);
-            var value = cookie.substring(delimIndex + 1);
-            var size = name.length + value.length;
-            cookies.push({ name: name, value: value, size: size });
-        }
-    }
-
-    return cookies;
-}
-
-WebInspector.Cookies.cookieMatchesResourceURL = function(cookie, resourceURL)
-{
-    var url = resourceURL.asParsedURL();
-    if (!url || !this.cookieDomainMatchesResourceDomain(cookie.domain, url.host))
-        return false;
-    return (url.path.indexOf(cookie.path) === 0
-        && (!cookie.port || url.port == cookie.port)
-        && (!cookie.secure || url.scheme === "https"));
-}
-
-WebInspector.Cookies.cookieDomainMatchesResourceDomain = function(cookieDomain, resourceDomain)
-{
-    if (cookieDomain.charAt(0) !== '.')
-        return resourceDomain === cookieDomain;
-    return !!resourceDomain.match(new RegExp("^([^\\.]+\\.)?" + cookieDomain.substring(1).escapeForRegExp() + "$"), "i");
-}
-
-WebInspector.EventListeners = {}
-
-WebInspector.EventListeners.getEventListenersForNodeAsync = function(node, callback)
-{
-    if (!node)
-        return;
-    DOMAgent.getEventListenersForNode(node.id, callback);
-}
diff --git a/Source/WebCore/inspector/front-end/DOMStorageItemsView.js b/Source/WebCore/inspector/front-end/DOMStorageItemsView.js
index dbd736b..b63bc96 100644
--- a/Source/WebCore/inspector/front-end/DOMStorageItemsView.js
+++ b/Source/WebCore/inspector/front-end/DOMStorageItemsView.js
@@ -61,12 +61,14 @@ WebInspector.DOMStorageItemsView.prototype = {
     update: function()
     {
         this.element.removeChildren();
-        var callback = this._showDOMStorageEntries.bind(this);
-        this.domStorage.getEntries(callback);
+        this.domStorage.getEntries(this._showDOMStorageEntries.bind(this));
     },
 
-    _showDOMStorageEntries: function(entries)
+    _showDOMStorageEntries: function(error, entries)
     {
+        if (error)
+            return;
+
         this._dataGrid = this._dataGridForDOMStorageEntries(entries);
         this.element.appendChild(this._dataGrid.element);
         this._dataGrid.autoSizeColumns(10);
diff --git a/Source/WebCore/inspector/front-end/Database.js b/Source/WebCore/inspector/front-end/Database.js
index e4bafea..685c288 100644
--- a/Source/WebCore/inspector/front-end/Database.js
+++ b/Source/WebCore/inspector/front-end/Database.js
@@ -77,17 +77,22 @@ WebInspector.Database.prototype = {
 
     getTableNames: function(callback)
     {
-        function sortingCallback(names)
+        function sortingCallback(error, names)
         {
-            callback(names.sort());
+            if (!error)
+                callback(names.sort());
         }
         DatabaseAgent.getDatabaseTableNames(this._id, sortingCallback);
     },
     
     executeSql: function(query, onSuccess, onError)
     {
-        function callback(success, transactionId)
+        function callback(error, success, transactionId)
         {
+            if (error) {
+                onError(error);
+                return;
+            }
             if (!success) {
                 onError(WebInspector.UIString("Database not found."));
                 return;
diff --git a/Source/WebCore/inspector/front-end/DebuggerModel.js b/Source/WebCore/inspector/front-end/DebuggerModel.js
index d31ff24..c1d59b1 100644
--- a/Source/WebCore/inspector/front-end/DebuggerModel.js
+++ b/Source/WebCore/inspector/front-end/DebuggerModel.js
@@ -30,8 +30,7 @@
 
 WebInspector.DebuggerModel = function()
 {
-    this._paused = false;
-    this._callFrames = [];
+    this._debuggerPausedDetails = {};
     this._breakpoints = {};
     this._scripts = {};
 
@@ -39,31 +38,20 @@ WebInspector.DebuggerModel = function()
 }
 
 WebInspector.DebuggerModel.Events = {
+    DebuggerWasEnabled: "debugger-was-enabled",
+    DebuggerWasDisabled: "debugger-was-disabled",
     DebuggerPaused: "debugger-paused",
     DebuggerResumed: "debugger-resumed",
     ParsedScriptSource: "parsed-script-source",
     FailedToParseScriptSource: "failed-to-parse-script-source",
-    ScriptSourceChanged: "script-source-changed",
-    BreakpointAdded: "breakpoint-added",
-    BreakpointRemoved: "breakpoint-removed",
-    BreakpointResolved: "breakpoint-resolved"
+    BreakpointResolved: "breakpoint-resolved",
+    Reset: "reset"
 }
 
 WebInspector.DebuggerModel.prototype = {
     enableDebugger: function()
     {
         DebuggerAgent.enable();
-        if (this._breakpointsPushedToBackend)
-            return;
-        var breakpoints = WebInspector.settings.breakpoints;
-        for (var i = 0; i < breakpoints.length; ++i) {
-            var breakpoint = breakpoints[i];
-            if (typeof breakpoint.url !== "string" || typeof breakpoint.lineNumber !== "number" || typeof breakpoint.columnNumber !== "number" ||
-                typeof breakpoint.condition !== "string" || typeof breakpoint.enabled !== "boolean")
-                continue;
-            this.setBreakpoint(breakpoint.url, breakpoint.lineNumber, breakpoint.columnNumber, breakpoint.condition, breakpoint.enabled);
-        }
-        this._breakpointsPushedToBackend = true;
     },
 
     disableDebugger: function()
@@ -71,120 +59,98 @@ WebInspector.DebuggerModel.prototype = {
         DebuggerAgent.disable();
     },
 
+    _debuggerWasEnabled: function()
+    {
+        this.dispatchEventToListeners(WebInspector.DebuggerModel.Events.DebuggerWasEnabled);
+    },
+
+    _debuggerWasDisabled: function()
+    {
+        this._breakpoints = {};
+        this.dispatchEventToListeners(WebInspector.DebuggerModel.Events.DebuggerWasDisabled);
+    },
+
     continueToLocation: function(sourceID, lineNumber, columnNumber)
     {
         DebuggerAgent.continueToLocation(sourceID, lineNumber, columnNumber);
     },
 
-    setBreakpoint: function(url, lineNumber, columnNumber, condition, enabled)
+    setBreakpoint: function(url, lineNumber, columnNumber, condition, enabled, callback)
     {
-        function didSetBreakpoint(breakpointsPushedToBackend, breakpointId, locations)
+        // Adjust column if needed.
+        var minColumnNumber = 0;
+        for (var id in this._scripts) {
+            var script = this._scripts[id];
+            if (url === script.sourceURL && lineNumber === script.lineOffset)
+                minColumnNumber = minColumnNumber ? Math.min(minColumnNumber, script.columnOffset) : script.columnOffset;
+        }
+        columnNumber = Math.max(columnNumber, minColumnNumber);
+
+        function didSetBreakpoint(error, breakpointId, locations)
         {
-            if (!breakpointId)
-                return;
-            var breakpoint = new WebInspector.Breakpoint(breakpointId, url, "", lineNumber, columnNumber, condition, enabled);
-            breakpoint.locations = locations;
-            this._breakpoints[breakpointId] = breakpoint;
-            if (breakpointsPushedToBackend)
-                this._saveBreakpoints();
-            this.dispatchEventToListeners(WebInspector.DebuggerModel.Events.BreakpointAdded, breakpoint);
+            var breakpoint;
+            if (!error && breakpointId) {
+                breakpoint = new WebInspector.Breakpoint(breakpointId, url, "", lineNumber, columnNumber, condition, enabled);
+                breakpoint.locations = locations;
+                this._breakpoints[breakpointId] = breakpoint;
+            }
+            if (callback)
+                callback(breakpoint);
         }
-        DebuggerAgent.setJavaScriptBreakpoint(url, lineNumber, columnNumber, condition, enabled, didSetBreakpoint.bind(this, this._breakpointsPushedToBackend));
+        DebuggerAgent.setBreakpointByUrl(url, lineNumber, columnNumber, condition, enabled, didSetBreakpoint.bind(this));
     },
 
-    setBreakpointBySourceId: function(sourceID, lineNumber, columnNumber, condition, enabled)
+    setBreakpointBySourceId: function(sourceID, lineNumber, columnNumber, condition, enabled, callback)
     {
-        function didSetBreakpoint(breakpointId, actualLineNumber, actualColumnNumber)
+        function didSetBreakpoint(error, breakpointId, actualLineNumber, actualColumnNumber)
         {
-            if (!breakpointId)
-                return;
-            var breakpoint = new WebInspector.Breakpoint(breakpointId, "", sourceID, lineNumber, columnNumber, condition, enabled);
-            breakpoint.addLocation(sourceID, actualLineNumber, actualColumnNumber);
-            this._breakpoints[breakpointId] = breakpoint;
-            this.dispatchEventToListeners(WebInspector.DebuggerModel.Events.BreakpointAdded, breakpoint);
+            var breakpoint;
+            if (!error && breakpointId) {
+                breakpoint = new WebInspector.Breakpoint(breakpointId, "", sourceID, lineNumber, columnNumber, condition, enabled);
+                breakpoint.addLocation(sourceID, actualLineNumber, actualColumnNumber);
+                this._breakpoints[breakpointId] = breakpoint;
+            }
+            if (callback)
+                callback(breakpoint);
         }
-        DebuggerAgent.setJavaScriptBreakpointBySourceId(sourceID, lineNumber, columnNumber, condition, enabled, didSetBreakpoint.bind(this));
+        DebuggerAgent.setBreakpoint(sourceID, lineNumber, columnNumber, condition, enabled, didSetBreakpoint.bind(this));
     },
 
     removeBreakpoint: function(breakpointId)
     {
-        DebuggerAgent.removeJavaScriptBreakpoint(breakpointId);
-        var breakpoint = this._breakpoints[breakpointId];
+        DebuggerAgent.removeBreakpoint(breakpointId);
         delete this._breakpoints[breakpointId];
-        this._saveBreakpoints();
-        this.dispatchEventToListeners(WebInspector.DebuggerModel.Events.BreakpointRemoved, breakpointId);
-    },
-
-    updateBreakpoint: function(breakpointId, condition, enabled)
-    {
-        var breakpoint = this._breakpoints[breakpointId];
-        this.removeBreakpoint(breakpointId);
-        if (breakpoint.url)
-            this.setBreakpoint(breakpoint.url, breakpoint.lineNumber, breakpoint.columnNumber, condition, enabled);
-        else
-            this.setBreakpointBySourceId(breakpoint.sourceID, breakpoint.lineNumber, breakpoint.columnNumber, condition, enabled);
     },
 
     _breakpointResolved: function(breakpointId, sourceID, lineNumber, columnNumber)
     {
         var breakpoint = this._breakpoints[breakpointId];
-        if (!breakpoint)
-            return;
         breakpoint.addLocation(sourceID, lineNumber, columnNumber);
         this.dispatchEventToListeners(WebInspector.DebuggerModel.Events.BreakpointResolved, breakpoint);
     },
 
-    _saveBreakpoints: function()
-    {
-        var serializedBreakpoints = [];
-        for (var id in this._breakpoints) {
-            var breakpoint = this._breakpoints[id];
-            if (!breakpoint.url)
-                continue;
-            var serializedBreakpoint = {};
-            serializedBreakpoint.url = breakpoint.url;
-            serializedBreakpoint.lineNumber = breakpoint.lineNumber;
-            serializedBreakpoint.columnNumber = breakpoint.columnNumber;
-            serializedBreakpoint.condition = breakpoint.condition;
-            serializedBreakpoint.enabled = breakpoint.enabled;
-            serializedBreakpoints.push(serializedBreakpoint);
-        }
-        WebInspector.settings.breakpoints = serializedBreakpoints;
-    },
-
     get breakpoints()
     {
         return this._breakpoints;
     },
 
-    breakpointForId: function(breakpointId)
-    {
-        return this._breakpoints[breakpointId];
-    },
-
-    queryBreakpoints: function(filter)
-    {
-        var breakpoints = [];
-        for (var id in this._breakpoints) {
-           var breakpoint = this._breakpoints[id];
-           if (filter(breakpoint))
-               breakpoints.push(breakpoint);
-        }
-        return breakpoints;
-    },
-
     reset: function()
     {
-        this._paused = false;
-        this._callFrames = [];
+        this._debuggerPausedDetails = {};
         for (var id in this._breakpoints) {
             var breakpoint = this._breakpoints[id];
             if (!breakpoint.url)
-                this.removeBreakpoint(id);
+                delete this._breakpoints[id];
             else
                 breakpoint.locations = [];
         }
         this._scripts = {};
+        this.dispatchEventToListeners(WebInspector.DebuggerModel.Events.Reset);
+    },
+
+    get scripts()
+    {
+        return this._scripts;
     },
 
     scriptForSourceID: function(sourceID)
@@ -208,101 +174,42 @@ WebInspector.DebuggerModel.prototype = {
         return scripts;
     },
 
-    editScriptSource: function(sourceID, scriptSource)
+    editScriptSource: function(sourceID, newSource, callback)
     {
-        function didEditScriptSource(success, newBodyOrErrorMessage, callFrames)
-        {
-            if (success) {
-                if (callFrames && callFrames.length)
-                    this._callFrames = callFrames;
-                this._updateScriptSource(sourceID, newBodyOrErrorMessage);
-            } else
-                WebInspector.log(newBodyOrErrorMessage, WebInspector.ConsoleMessage.MessageLevel.Warning);
-        }
-        DebuggerAgent.editScriptSource(sourceID, scriptSource, didEditScriptSource.bind(this));
+        DebuggerAgent.editScriptSource(sourceID, newSource, this._didEditScriptSource.bind(this, sourceID, callback));
     },
 
-    _updateScriptSource: function(sourceID, scriptSource)
+    _didEditScriptSource: function(sourceID, callback, error, newBody, callFrames)
     {
-        var script = this._scripts[sourceID];
-        var oldSource = script.source;
-        script.source = scriptSource;
-
-        // Clear and re-create breakpoints according to text diff.
-        var diff = Array.diff(oldSource.split("\n"), script.source.split("\n"));
-        for (var id in this._breakpoints) {
-            var breakpoint = this._breakpoints[id];
-            if (breakpoint.url) {
-                if (breakpoint.url !== script.sourceURL)
-                    continue;
-            } else {
-                if (breakpoint.sourceID !== sourceID)
-                    continue;
-            }
-            this.removeBreakpoint(breakpoint.id);
-            var lineNumber = breakpoint.lineNumber;
-            var newLineNumber = diff.left[lineNumber].row;
-            if (newLineNumber === undefined) {
-                for (var i = lineNumber - 1; i >= 0; --i) {
-                    if (diff.left[i].row === undefined)
-                        continue;
-                    var shiftedLineNumber = diff.left[i].row + lineNumber - i;
-                    if (shiftedLineNumber < diff.right.length) {
-                        var originalLineNumber = diff.right[shiftedLineNumber].row;
-                        if (originalLineNumber === lineNumber || originalLineNumber === undefined)
-                            newLineNumber = shiftedLineNumber;
-                    }
-                    break;
-                }
-            }
-            if (newLineNumber === undefined)
-                continue;
-            if (breakpoint.url)
-                this.setBreakpoint(breakpoint.url, newLineNumber, breakpoint.columnNumber, breakpoint.condition, breakpoint.enabled);
-            else
-                this.setBreakpointBySourceId(sourceID, newLineNumber, breakpoint.columnNumber, breakpoint.condition, breakpoint.enabled);
-        }
-
-        this.dispatchEventToListeners(WebInspector.DebuggerModel.Events.ScriptSourceChanged, { sourceID: sourceID, oldSource: oldSource });
+        callback(!error, error || newBody);
+        if (error)
+            return;
+        this._scripts[sourceID].source = newBody;
+        this._debuggerPausedDetails.callFrames = callFrames;
     },
 
     get callFrames()
     {
-        return this._callFrames;
+        return this._debuggerPausedDetails.callFrames;
+    },
+
+    get debuggerPausedDetails()
+    {
+        return this._debuggerPausedDetails;
     },
 
     _pausedScript: function(details)
     {
-        this._paused = true;
-        this._callFrames = details.callFrames;
-        details.breakpoint = this._breakpointForCallFrame(details.callFrames[0]);
+        this._debuggerPausedDetails = details;
         this.dispatchEventToListeners(WebInspector.DebuggerModel.Events.DebuggerPaused, details);
     },
 
     _resumedScript: function()
     {
-        this._paused = false;
-        this._callFrames = [];
+        this._debuggerPausedDetails = {};
         this.dispatchEventToListeners(WebInspector.DebuggerModel.Events.DebuggerResumed);
     },
 
-    _breakpointForCallFrame: function(callFrame)
-    {
-        function match(location)
-        {
-            if (location.sourceID != callFrame.sourceID)
-                return false;
-            return location.lineNumber === callFrame.line && location.columnNumber === callFrame.column;
-        }
-        for (var id in this._breakpoints) {
-            var breakpoint = this._breakpoints[id];
-            for (var i = 0; i < breakpoint.locations.length; ++i) {
-                if (match(breakpoint.locations[i]))
-                    return breakpoint;
-            }
-        }
-    },
-
     _parsedScriptSource: function(sourceID, sourceURL, lineOffset, columnOffset, length, scriptWorldType)
     {
         var script = new WebInspector.Script(sourceID, sourceURL, "", lineOffset, columnOffset, length, undefined, undefined, scriptWorldType);
@@ -331,32 +238,32 @@ WebInspector.DebuggerDispatcher = function(debuggerModel)
 }
 
 WebInspector.DebuggerDispatcher.prototype = {
-    pausedScript: function(details)
+    paused: function(details)
     {
         this._debuggerModel._pausedScript(details);
     },
 
-    resumedScript: function()
+    resumed: function()
     {
         this._debuggerModel._resumedScript();
     },
 
     debuggerWasEnabled: function()
     {
-        WebInspector.panels.scripts.debuggerWasEnabled();
+        this._debuggerModel._debuggerWasEnabled();
     },
 
     debuggerWasDisabled: function()
     {
-        WebInspector.panels.scripts.debuggerWasDisabled();
+        this._debuggerModel._debuggerWasDisabled();
     },
 
-    parsedScriptSource: function(sourceID, sourceURL, lineOffset, columnOffset, length, scriptWorldType)
+    scriptParsed: function(sourceID, sourceURL, lineOffset, columnOffset, length, scriptWorldType)
     {
         this._debuggerModel._parsedScriptSource(sourceID, sourceURL, lineOffset, columnOffset, length, scriptWorldType);
     },
 
-    failedToParseScriptSource: function(sourceURL, source, startingLine, errorLine, errorMessage)
+    scriptFailedToParse: function(sourceURL, source, startingLine, errorLine, errorMessage)
     {
         this._debuggerModel._failedToParseScriptSource(sourceURL, source, startingLine, errorLine, errorMessage);
     },
@@ -364,17 +271,5 @@ WebInspector.DebuggerDispatcher.prototype = {
     breakpointResolved: function(breakpointId, sourceID, lineNumber, columnNumber)
     {
         this._debuggerModel._breakpointResolved(breakpointId, sourceID, lineNumber, columnNumber);
-    },
-
-    didCreateWorker: function()
-    {
-        var workersPane = WebInspector.panels.scripts.sidebarPanes.workers;
-        workersPane.addWorker.apply(workersPane, arguments);
-    },
-
-    didDestroyWorker: function()
-    {
-        var workersPane = WebInspector.panels.scripts.sidebarPanes.workers;
-        workersPane.removeWorker.apply(workersPane, arguments);
     }
 }
diff --git a/Source/WebCore/inspector/front-end/DebuggerPresentationModel.js b/Source/WebCore/inspector/front-end/DebuggerPresentationModel.js
index a97db34..d12affe 100644
--- a/Source/WebCore/inspector/front-end/DebuggerPresentationModel.js
+++ b/Source/WebCore/inspector/front-end/DebuggerPresentationModel.js
@@ -30,102 +30,549 @@
 
 WebInspector.DebuggerPresentationModel = function()
 {
-    this._breakpoints = {};
-    this._sourceLocationToBreakpointId = {};
+    this._sourceFiles = {};
+    this._messages = [];
+    this._presentationBreakpoints = {};
+    this._presentationCallFrames = [];
+    this._selectedCallFrameIndex = 0;
 
-    WebInspector.debuggerModel.addEventListener(WebInspector.DebuggerModel.Events.BreakpointAdded, this._breakpointAdded, this);
-    WebInspector.debuggerModel.addEventListener(WebInspector.DebuggerModel.Events.BreakpointRemoved, this._breakpointRemoved, this);
+    WebInspector.debuggerModel.addEventListener(WebInspector.DebuggerModel.Events.DebuggerWasEnabled, this._debuggerWasEnabled, this);
+    WebInspector.debuggerModel.addEventListener(WebInspector.DebuggerModel.Events.ParsedScriptSource, this._parsedScriptSource, this);
+    WebInspector.debuggerModel.addEventListener(WebInspector.DebuggerModel.Events.FailedToParseScriptSource, this._failedToParseScriptSource, this);
     WebInspector.debuggerModel.addEventListener(WebInspector.DebuggerModel.Events.BreakpointResolved, this._breakpointResolved, this);
+    WebInspector.debuggerModel.addEventListener(WebInspector.DebuggerModel.Events.DebuggerPaused, this._debuggerPaused, this);
+    WebInspector.debuggerModel.addEventListener(WebInspector.DebuggerModel.Events.DebuggerResumed, this._debuggerResumed, this);
+    WebInspector.debuggerModel.addEventListener(WebInspector.DebuggerModel.Events.Reset, this._reset, this);
 }
 
 WebInspector.DebuggerPresentationModel.Events = {
+    SourceFileAdded: "source-file-added",
+    SourceFileChanged: "source-file-changed",
+    ConsoleMessageAdded: "console-message-added",
     BreakpointAdded: "breakpoint-added",
-    BreakpointRemoved: "breakpoint-removed"
+    BreakpointRemoved: "breakpoint-removed",
+    DebuggerPaused: "debugger-paused",
+    DebuggerResumed: "debugger-resumed",
+    CallFrameSelected: "call-frame-selected"
 }
 
 WebInspector.DebuggerPresentationModel.prototype = {
+    _debuggerWasEnabled: function()
+    {
+        this._restoreBreakpoints();
+    },
+
+    sourceFile: function(sourceFileId)
+    {
+        return this._sourceFiles[sourceFileId];
+    },
+
+    requestSourceFileContent: function(sourceFileId, callback)
+    {
+        this._sourceFiles[sourceFileId].requestContent(callback);
+    },
+
+    _parsedScriptSource: function(event)
+    {
+        this._addScript(event.data);
+        this._refreshBreakpoints();
+    },
+
+    _failedToParseScriptSource: function(event)
+    {
+        this._addScript(event.data);
+        this._refreshBreakpoints();
+    },
+
+    _addScript: function(script)
+    {
+        var sourceFileId = script.sourceURL || script.sourceID;
+        var sourceFile = this._sourceFiles[sourceFileId];
+        if (sourceFile) {
+            sourceFile.addScript(script);
+            return;
+        }
+
+        function contentChanged(sourceFile)
+        {
+            this.dispatchEventToListeners(WebInspector.DebuggerPresentationModel.Events.SourceFileChanged, this._sourceFiles[sourceFileId]);
+        }
+        if (!this._formatSourceFiles)
+            sourceFile = new WebInspector.SourceFile(sourceFileId, script, contentChanged.bind(this));
+        else
+            sourceFile = new WebInspector.FormattedSourceFile(sourceFileId, script, contentChanged.bind(this), this._formatter);
+        this._sourceFiles[sourceFileId] = sourceFile;
+        this.dispatchEventToListeners(WebInspector.DebuggerPresentationModel.Events.SourceFileAdded, sourceFile);
+    },
+
+    _refreshBreakpoints: function()
+    {
+        var breakpoints = WebInspector.debuggerModel.breakpoints;
+        for (var id in breakpoints) {
+            if (!(id in this._presentationBreakpoints))
+                this._breakpointAdded(breakpoints[id]);
+        }
+    },
+
+    canEditScriptSource: function(sourceFileId)
+    {
+        if (!Preferences.canEditScriptSource)
+            return false;
+        var script = this._scriptForSourceFileId(sourceFileId);
+        return  !script.lineOffset && !script.columnOffset;
+    },
+
+    editScriptSource: function(sourceFileId, text, callback)
+    {
+        var script = this._scriptForSourceFileId(sourceFileId);
+        var sourceFile = this._sourceFiles[sourceFileId];
+        var oldSource = sourceFile.content;
+        function didEditScriptSource(success, newBodyOrErrorMessage)
+        {
+            if (!success) {
+                callback(false, newBodyOrErrorMessage);
+                return;
+            }
+
+            var newSource = newBodyOrErrorMessage;
+            this._updateBreakpointsAfterLiveEdit(sourceFileId, oldSource, newSource);
+
+            var resource = WebInspector.resourceForURL(script.sourceURL);
+            if (resource) {
+                var revertHandle = this.editScriptSource.bind(this, sourceFileId, oldSource, sourceFile.reload.bind(sourceFile));
+                resource.setContent(newSource, revertHandle);
+            }
+
+            callback(true, newSource);
+
+            if (WebInspector.debuggerModel.callFrames)
+                this._debuggerPaused();
+        }
+        WebInspector.debuggerModel.editScriptSource(script.sourceID, text, didEditScriptSource.bind(this));
+    },
+
+    _updateBreakpointsAfterLiveEdit: function(sourceFileId, oldSource, newSource)
+    {
+        // Clear and re-create breakpoints according to text diff.
+        var diff = Array.diff(oldSource.split("\n"), newSource.split("\n"));
+        for (var id in this._presentationBreakpoints) {
+            var breakpoint = this._presentationBreakpoints[id];
+            if (breakpoint.sourceFileId !== sourceFileId)
+                continue;
+            var lineNumber = breakpoint.lineNumber;
+            this.removeBreakpoint(sourceFileId, lineNumber);
+
+            var newLineNumber = diff.left[lineNumber].row;
+            if (newLineNumber === undefined) {
+                for (var i = lineNumber - 1; i >= 0; --i) {
+                    if (diff.left[i].row === undefined)
+                        continue;
+                    var shiftedLineNumber = diff.left[i].row + lineNumber - i;
+                    if (shiftedLineNumber < diff.right.length) {
+                        var originalLineNumber = diff.right[shiftedLineNumber].row;
+                        if (originalLineNumber === lineNumber || originalLineNumber === undefined)
+                            newLineNumber = shiftedLineNumber;
+                    }
+                    break;
+                }
+            }
+            if (newLineNumber !== undefined)
+                this.setBreakpoint(sourceFileId, newLineNumber, breakpoint.condition, breakpoint.enabled);
+        }
+    },
+
+    toggleFormatSourceFiles: function()
+    {
+        this._formatSourceFiles = !this._formatSourceFiles;
+        if (this._formatSourceFiles && !this._formatter)
+            this._formatter = new WebInspector.ScriptFormatter();
+
+        var messages = this._messages;
+        this._sourceFiles = {};
+        this._messages = [];
+        this._presentationBreakpoints = {};
+
+        var scripts = WebInspector.debuggerModel.scripts;
+        for (var id in scripts)
+            this._addScript(scripts[id]);
+
+        for (var i = 0; i < messages.length; ++i)
+            this.addConsoleMessage(messages[i]);
+
+        this._refreshBreakpoints();
+
+        if (WebInspector.debuggerModel.callFrames)
+            this._debuggerPaused();
+    },
+
+    addConsoleMessage: function(message)
+    {
+        this._messages.push(message);
+
+        var sourceFile = this._sourceFileForScriptURL(message.url);
+        if (!sourceFile)
+            return;
+
+        function didRequestSourceMapping(mapping)
+        {
+            var presentationMessage = {};
+            presentationMessage.sourceFileId = sourceFile.id;
+            presentationMessage.lineNumber = mapping.scriptLocationToSourceLocation(message.line - 1, 0).lineNumber;
+            presentationMessage.originalMessage = message;
+            sourceFile.messages.push(presentationMessage);
+            this.dispatchEventToListeners(WebInspector.DebuggerPresentationModel.Events.ConsoleMessageAdded, presentationMessage);
+        }
+        sourceFile.requestSourceMapping(didRequestSourceMapping.bind(this));
+    },
+
+    clearConsoleMessages: function()
+    {
+        this._messages = [];
+        for (var id in this._sourceFiles)
+            this._sourceFiles[id].messages = [];
+    },
+
+    continueToLine: function(sourceFileId, lineNumber)
+    {
+        function didRequestSourceMapping(mapping)
+        {
+            var location = mapping.sourceLocationToScriptLocation(lineNumber, 0);
+            WebInspector.debuggerModel.continueToLocation(location.scriptId, location.lineNumber, location.columnNumber);
+        }
+        this._sourceFiles[sourceFileId].requestSourceMapping(didRequestSourceMapping.bind(this));
+    },
+
     breakpointsForSourceFileId: function(sourceFileId)
     {
+        var sourceFile = this.sourceFile(sourceFileId);
+        if (!sourceFile)
+            return [];
         var breakpoints = [];
-        for (var id in this._breakpoints) {
-            var breakpoint = this._breakpoints[id];
-            if (breakpoint.sourceFileId === sourceFileId)
-                breakpoints.push(breakpoint);
-        }
+        for (var lineNumber in sourceFile.breakpoints)
+            breakpoints.push(sourceFile.breakpoints[lineNumber]);
         return breakpoints;
     },
 
-    _breakpointAdded: function(event)
+    setBreakpoint: function(sourceFileId, lineNumber, condition, enabled)
     {
-        var breakpoint = event.data;
-        var location = breakpoint.locations.length ? breakpoint.locations[0] : breakpoint;
-        var sourceLocation = this._actualLocationToSourceLocation(breakpoint.url || breakpoint.sourceID, location.lineNumber, location.columnNumber);
+        function didSetBreakpoint(breakpoint)
+        {
+            if (breakpoint) {
+                this._breakpointAdded(breakpoint);
+                this._saveBreakpoints();
+            }
+        }
 
-        var encodedSourceLocation = this._encodeSourceLocation(sourceLocation.sourceFileId, sourceLocation.lineNumber);
-        if (encodedSourceLocation in this._sourceLocationToBreakpointId) {
-            // We can't show more than one breakpoint on a single source frame line. Remove newly added breakpoint.
-            WebInspector.debuggerModel.removeBreakpoint(breakpoint.id);
-            return;
+        function didRequestSourceMapping(mapping)
+        {
+            var location = mapping.sourceLocationToScriptLocation(lineNumber, 0);
+            var script = WebInspector.debuggerModel.scriptForSourceID(location.scriptId);
+            if (script.sourceURL)
+                WebInspector.debuggerModel.setBreakpoint(script.sourceURL, location.lineNumber, location.columnNumber, condition, enabled, didSetBreakpoint.bind(this));
+            else
+                WebInspector.debuggerModel.setBreakpointBySourceId(script.sourceID, location.lineNumber, location.columnNumber, condition, enabled, didSetBreakpoint.bind(this));
         }
+        this._sourceFiles[sourceFileId].requestSourceMapping(didRequestSourceMapping.bind(this));
+    },
 
-        var presentationBreakpoint = {
-            sourceFileId: sourceLocation.sourceFileId,
-            lineNumber: sourceLocation.lineNumber,
-            url: breakpoint.url,
-            resolved: !!breakpoint.locations.length,
-            condition: breakpoint.condition,
-            enabled: breakpoint.enabled
-        };
+    setBreakpointEnabled: function(sourceFileId, lineNumber, enabled)
+    {
+        var breakpoint = this.removeBreakpoint(sourceFileId, lineNumber);
+        this.setBreakpoint(sourceFileId, lineNumber, breakpoint.condition, enabled);
+    },
 
-        this._sourceLocationToBreakpointId[encodedSourceLocation] = breakpoint.id;
-        this._breakpoints[breakpoint.id] = presentationBreakpoint;
+    updateBreakpoint: function(sourceFileId, lineNumber, condition, enabled)
+    {
+        this.removeBreakpoint(sourceFileId, lineNumber);
+        this.setBreakpoint(sourceFileId, lineNumber, condition, enabled);
+    },
 
-        this.dispatchEventToListeners(WebInspector.DebuggerPresentationModel.Events.BreakpointAdded, presentationBreakpoint);
+    removeBreakpoint: function(sourceFileId, lineNumber)
+    {
+        var breakpoint = this.findBreakpoint(sourceFileId, lineNumber);
+        WebInspector.debuggerModel.removeBreakpoint(breakpoint._id);
+        this._breakpointRemoved(breakpoint._id);
+        this._saveBreakpoints();
+        return breakpoint;
+    },
+
+    findBreakpoint: function(sourceFileId, lineNumber)
+    {
+        var sourceFile = this.sourceFile(sourceFileId);
+        if (sourceFile)
+            return sourceFile.breakpoints[lineNumber];
     },
 
-    _breakpointRemoved: function(event)
+    _breakpointAdded: function(breakpoint)
     {
-        var breakpointId = event.data;
-        var breakpoint = this._breakpoints[breakpointId];
-        var encodedSourceLocation = this._encodeSourceLocation(breakpoint.sourceFileId, breakpoint.lineNumber);
-        delete this._breakpoints[breakpointId];
-        delete this._sourceLocationToBreakpointId[encodedSourceLocation];
+        var script;
+        if (breakpoint.url)
+            script = WebInspector.debuggerModel.scriptsForURL(breakpoint.url)[0];
+        else
+            script = WebInspector.debuggerModel.scriptForSourceID(breakpoint.sourceID);
+        if (!script)
+            return;
+
+        function didRequestSourceMapping(mapping)
+        {
+            var scriptLocation = breakpoint.locations.length ? breakpoint.locations[0] : breakpoint;
+            var sourceLocation = mapping.scriptLocationToSourceLocation(scriptLocation.lineNumber, scriptLocation.columnNumber);
+            var lineNumber = sourceLocation.lineNumber;
+
+            if (this.findBreakpoint(sourceFile.id, lineNumber)) {
+                // We can't show more than one breakpoint on a single source file line.
+                WebInspector.debuggerModel.removeBreakpoint(breakpoint.id);
+                return;
+            }
+
+            var presentationBreakpoint = new WebInspector.PresentationBreakpoint(breakpoint, sourceFile, lineNumber);
+            presentationBreakpoint._id = breakpoint.id;
+            this._presentationBreakpoints[breakpoint.id] = presentationBreakpoint;
+            sourceFile.breakpoints[lineNumber] = presentationBreakpoint;
+            this.dispatchEventToListeners(WebInspector.DebuggerPresentationModel.Events.BreakpointAdded, presentationBreakpoint);
+        }
+        var sourceFile = this._sourceFileForScript(script);
+        sourceFile.requestSourceMapping(didRequestSourceMapping.bind(this));
+    },
+
+    _breakpointRemoved: function(breakpointId)
+    {
+        var breakpoint = this._presentationBreakpoints[breakpointId];
+        delete this._presentationBreakpoints[breakpointId];
+        var sourceFile = this.sourceFile(breakpoint.sourceFileId);
+        delete sourceFile.breakpoints[breakpoint.lineNumber];
         this.dispatchEventToListeners(WebInspector.DebuggerPresentationModel.Events.BreakpointRemoved, breakpoint);
     },
 
     _breakpointResolved: function(event)
     {
         var breakpoint = event.data;
-        this._breakpointRemoved({ data: breakpoint.id });
-        this._breakpointAdded({ data: breakpoint });
+        if (!(breakpoint.id in this._presentationBreakpoints))
+            return;
+        this._breakpointRemoved(breakpoint.id);
+        this._breakpointAdded(breakpoint);
+    },
+
+    _restoreBreakpoints: function()
+    {
+        function didSetBreakpoint(breakpoint)
+        {
+            if (breakpoint)
+                this._breakpointAdded(breakpoint);
+        }
+        var breakpoints = WebInspector.settings.breakpoints;
+        for (var i = 0; i < breakpoints.length; ++i) {
+            var breakpoint = breakpoints[i];
+            WebInspector.debuggerModel.setBreakpoint(breakpoint.url, breakpoint.lineNumber, breakpoint.columnNumber, breakpoint.condition, breakpoint.enabled, didSetBreakpoint.bind(this));
+        }
     },
 
-    _encodeSourceLocation: function(sourceFileId, lineNumber)
+    _saveBreakpoints: function()
     {
-        return sourceFileId + ":" + lineNumber;
+        var serializedBreakpoints = [];
+        var breakpoints = WebInspector.debuggerModel.breakpoints;
+        for (var id in breakpoints) {
+            var breakpoint = breakpoints[id];
+            if (!breakpoint.url)
+                continue;
+            var serializedBreakpoint = {};
+            serializedBreakpoint.url = breakpoint.url;
+            serializedBreakpoint.lineNumber = breakpoint.lineNumber;
+            serializedBreakpoint.columnNumber = breakpoint.columnNumber;
+            serializedBreakpoint.condition = breakpoint.condition;
+            serializedBreakpoint.enabled = breakpoint.enabled;
+            serializedBreakpoints.push(serializedBreakpoint);
+        }
+        WebInspector.settings.breakpoints = serializedBreakpoints;
     },
 
-    set selectedCallFrame(callFrame)
+    _debuggerPaused: function()
     {
-        this._selectedCallFrame = callFrame;
-        if (!callFrame)
-            return;
+        var callFrames = WebInspector.debuggerModel.callFrames;
+        this._presentationCallFrames = [];
+        for (var i = 0; i < callFrames.length; ++i) {
+            var callFrame = callFrames[i];
+            var sourceFile;
+            var script = WebInspector.debuggerModel.scriptForSourceID(callFrame.sourceID);
+            if (script)
+                sourceFile = this._sourceFileForScript(script);
+            this._presentationCallFrames.push(new WebInspector.PresenationCallFrame(callFrame, i, sourceFile));
+        }
+        var details = WebInspector.debuggerModel.debuggerPausedDetails;
+        this.dispatchEventToListeners(WebInspector.DebuggerPresentationModel.Events.DebuggerPaused, { callFrames: this._presentationCallFrames, details: details });
+
+        this.selectedCallFrame = this._presentationCallFrames[this._selectedCallFrameIndex];
+    },
+
+    _debuggerResumed: function()
+    {
+        this._presentationCallFrames = [];
+        this._selectedCallFrameIndex = 0;
+        this.dispatchEventToListeners(WebInspector.DebuggerPresentationModel.Events.DebuggerResumed);
+    },
 
-        var script = WebInspector.debuggerModel.scriptForSourceID(callFrame.sourceID);
-        callFrame.sourceLocation = this._actualLocationToSourceLocation(script.sourceURL || script.sourceID, callFrame.line, callFrame.column);
+    set selectedCallFrame(callFrame)
+    {
+        this._selectedCallFrameIndex = callFrame.index;
+        callFrame.select();
         this.dispatchEventToListeners(WebInspector.DebuggerPresentationModel.Events.CallFrameSelected, callFrame);
     },
 
     get selectedCallFrame()
     {
-        return this._selectedCallFrame;
+        return this._presentationCallFrames[this._selectedCallFrameIndex];
+    },
+
+    _sourceFileForScript: function(script)
+    {
+        return this._sourceFiles[script.sourceURL || script.sourceID];
+    },
+
+    _sourceFileForScriptURL: function(scriptURL)
+    {
+        return this._sourceFiles[scriptURL];
+    },
+
+    _scriptForSourceFileId: function(sourceFileId)
+    {
+        function filter(script)
+        {
+            return (script.sourceURL || script.sourceID) === sourceFileId;
+        }
+        return WebInspector.debuggerModel.queryScripts(filter)[0];
     },
 
-    _actualLocationToSourceLocation: function(sourceID, lineNumber, columnNumber)
+    _reset: function()
     {
-        // TODO: use source mapping to obtain source location.
-        return { sourceFileId: sourceID, lineNumber: lineNumber, columnNumber: columnNumber };
+        this._sourceFiles = {};
+        this._messages = [];
+        this._presentationBreakpoints = {};
+        this._presentationCallFrames = [];
+        this._selectedCallFrameIndex = 0;
     }
 }
 
 WebInspector.DebuggerPresentationModel.prototype.__proto__ = WebInspector.Object.prototype;
+
+WebInspector.PresentationBreakpoint = function(breakpoint, sourceFile, lineNumber)
+{
+    this._breakpoint = breakpoint;
+    this._sourceFile = sourceFile;
+    this._lineNumber = lineNumber;
+}
+
+WebInspector.PresentationBreakpoint.prototype = {
+    get sourceFileId()
+    {
+        return this._sourceFile.id;
+    },
+
+    get lineNumber()
+    {
+        return this._lineNumber;
+    },
+
+    get condition()
+    {
+        return this._breakpoint.condition;
+    },
+
+    get enabled()
+    {
+        return this._breakpoint.enabled;
+    },
+
+    get url()
+    {
+        return this._sourceFile.url;
+    },
+
+    get resolved()
+    {
+        return !!this._breakpoint.locations.length
+    },
+
+    loadSnippet: function(callback)
+    {
+        function didRequestContent(mimeType, content)
+        {
+            var lineEndings = content.lineEndings();
+            var snippet = "";
+            if (this.lineNumber < lineEndings.length)
+                snippet = content.substring(lineEndings[this.lineNumber - 1], lineEndings[this.lineNumber]);
+            callback(snippet);
+        }
+        this._sourceFile.requestContent(didRequestContent.bind(this));
+    }
+}
+
+WebInspector.PresenationCallFrame = function(callFrame, index, sourceFile)
+{
+    this._callFrame = callFrame;
+    this._index = index;
+    this._sourceFile = sourceFile;
+    this._script = WebInspector.debuggerModel.scriptForSourceID(callFrame.sourceID);
+}
+
+WebInspector.PresenationCallFrame.prototype = {
+    get functionName()
+    {
+        return this._callFrame.functionName;
+    },
+
+    get type()
+    {
+        return this._callFrame.type;
+    },
+
+    get isInternalScript()
+    {
+        return !this._script;
+    },
+
+    get url()
+    {
+        if (this._sourceFile)
+            return this._sourceFile.url;
+    },
+
+    get scopeChain()
+    {
+        return this._callFrame.scopeChain;
+    },
+
+    get index()
+    {
+        return this._index;
+    },
+
+    select: function()
+    {
+        if (this._sourceFile)
+            this._sourceFile.forceLoadContent(this._script);
+    },
+
+    evaluate: function(code, objectGroup, includeCommandLineAPI, callback)
+    {
+        function didEvaluateOnCallFrame(error, result)
+        {
+            callback(WebInspector.RemoteObject.fromPayload(result));
+        }
+        DebuggerAgent.evaluateOnCallFrame(this._callFrame.id, code, objectGroup, includeCommandLineAPI, didEvaluateOnCallFrame.bind(this));
+    },
+
+    sourceLocation: function(callback)
+    {
+        if (!this._sourceFile) {
+            callback(undefined, this._callFrame.line, this._callFrame.column);
+            return;
+        }
+
+        function didRequestSourceMapping(mapping)
+        {
+            var sourceLocation = mapping.scriptLocationToSourceLocation(this._callFrame.line, this._callFrame.column);
+            callback(this._sourceFile.id, sourceLocation.lineNumber, sourceLocation.columnNumber);
+        }
+        this._sourceFile.requestSourceMapping(didRequestSourceMapping.bind(this));
+    }
+}
diff --git a/Source/WebCore/inspector/front-end/DetailedHeapshotGridNodes.js b/Source/WebCore/inspector/front-end/DetailedHeapshotGridNodes.js
index 14ba142..4fc1844 100644
--- a/Source/WebCore/inspector/front-end/DetailedHeapshotGridNodes.js
+++ b/Source/WebCore/inspector/front-end/DetailedHeapshotGridNodes.js
@@ -61,8 +61,8 @@ WebInspector.HeapSnapshotGridNode.prototype = {
     populateChildren: function(provider, howMany, atIndex)
     {
         if (!howMany && provider) {
-            howMany = provider.instancesCount;
-            provider.resetInstancesCount();
+            howMany = provider.instanceCount;
+            provider.instanceCount = 0;
         }
         provider = provider || this._provider;
         howMany = howMany || this._defaultPopulateCount;
@@ -75,7 +75,7 @@ WebInspector.HeapSnapshotGridNode.prototype = {
                 break;
             }
         }
-        for ( ; howMany > 0 && provider.hasNext(); provider.next(), provider.incInstancesCount(), --howMany) {
+        for ( ; howMany > 0 && provider.hasNext(); provider.next(), ++provider.instanceCount, --howMany) {
             var item = provider.item;
             if (haveSavedChildren) {
                 var hash = this._childHashForEntity(item);
@@ -131,7 +131,6 @@ WebInspector.HeapSnapshotGenericObjectNode = function(tree, node, hasChildren, p
     this._type = node.type;
     this._shallowSize = node.selfSize;
     this._retainedSize = node.retainedSize;
-    this._retainedSizeExact = this._shallowSize === this._retainedSize;
     this.snapshotNodeId = node.id;
     this.snapshotNodeIndex = node.nodeIndex;
 };
@@ -168,7 +167,7 @@ WebInspector.HeapSnapshotGenericObjectNode.prototype = {
 
     get _countPercent()
     {
-        return this._count / this.tree.snapshot.nodesCount * 100.0;
+        return this._count / this.tree.snapshot.nodeCount * 100.0;
     },
 
     get data()
@@ -204,18 +203,11 @@ WebInspector.HeapSnapshotGenericObjectNode.prototype = {
 
         var view = this.dataGrid.snapshotView;
         data["shallowSize"] = view.showShallowSizeAsPercent ? WebInspector.UIString("%.2f%%", this._shallowSizePercent) : Number.bytesToString(this._shallowSize);
-        data["retainedSize"] = (this._retainedSizeExact ? "" : "\u2248") + (view.showRetainedSizeAsPercent ? WebInspector.UIString("%.2f%%", this._retainedSizePercent) : Number.bytesToString(this._retainedSize));
+        data["retainedSize"] = view.showRetainedSizeAsPercent ? WebInspector.UIString("%.2f%%", this._retainedSizePercent) : Number.bytesToString(this._retainedSize);
 
         return this._enhanceData ? this._enhanceData(data) : data;
     },
 
-    set exactRetainedSize(size)
-    {
-        this._retainedSize = size;
-        this._retainedSizeExact = true;
-        this.refresh();
-    },
-
     get _retainedSizePercent()
     {
         return this._retainedSize / this.dataGrid.snapshot.totalSize * 100.0;
@@ -231,9 +223,8 @@ WebInspector.HeapSnapshotGenericObjectNode.prototype.__proto__ = WebInspector.He
 
 WebInspector.HeapSnapshotObjectNode = function(tree, edge)
 {
-    var node = edge.node;
-    var provider = this._createProvider(tree.snapshot, node.rawEdges);
-    WebInspector.HeapSnapshotGenericObjectNode.call(this, tree, node, !provider.isEmpty, 100);
+    var provider = this._createProvider(tree.snapshot, edge.nodeIndex);
+    WebInspector.HeapSnapshotGenericObjectNode.call(this, tree, edge.node, !provider.isEmpty, 100);
     this._referenceName = edge.name;
     this._referenceType = edge.type;
     this._provider = provider;
@@ -245,12 +236,12 @@ WebInspector.HeapSnapshotObjectNode.prototype = {
         return new WebInspector.HeapSnapshotObjectNode(this.dataGrid, provider.item);
     },
 
-    _createProvider: function(snapshot, rawEdges)
+    _createProvider: function(snapshot, nodeIndex)
     {
         var showHiddenData = WebInspector.DetailedHeapshotView.prototype.showHiddenData;
         return new WebInspector.HeapSnapshotEdgesProvider(
             snapshot,
-            rawEdges,
+            nodeIndex,
             function(edge) {
                 return !edge.isInvisible
                     && (showHiddenData || (!edge.isHidden && !edge.node.isHidden));
@@ -321,7 +312,7 @@ WebInspector.HeapSnapshotObjectNode.prototype.__proto__ = WebInspector.HeapSnaps
 
 WebInspector.HeapSnapshotInstanceNode = function(tree, baseSnapshot, snapshot, node)
 {
-    var provider = this._createProvider(baseSnapshot || snapshot, node.rawEdges);  
+    var provider = this._createProvider(baseSnapshot || snapshot, node.nodeIndex);  
     WebInspector.HeapSnapshotGenericObjectNode.call(this, tree, node, !provider.isEmpty, 100);
     this._isDeletedNode = !!baseSnapshot;
     this._provider = provider;    
@@ -333,12 +324,12 @@ WebInspector.HeapSnapshotInstanceNode.prototype = {
         return new WebInspector.HeapSnapshotObjectNode(this.dataGrid, provider.item);
     },
 
-    _createProvider: function(snapshot, rawEdges)
+    _createProvider: function(snapshot, nodeIndex)
     {
         var showHiddenData = WebInspector.DetailedHeapshotView.prototype.showHiddenData;
         return new WebInspector.HeapSnapshotEdgesProvider(
             snapshot,
-            rawEdges,
+            nodeIndex,
             function(edge) {
                 return !edge.isInvisible
                     && (showHiddenData || (!edge.isHidden && !edge.node.isHidden));
@@ -394,14 +385,14 @@ WebInspector.HeapSnapshotInstanceNode.prototype = {
 
 WebInspector.HeapSnapshotInstanceNode.prototype.__proto__ = WebInspector.HeapSnapshotGenericObjectNode.prototype;
 
-WebInspector.HeapSnapshotConstructorNode = function(tree, constructor, aggregate)
+WebInspector.HeapSnapshotConstructorNode = function(tree, className, aggregate)
 {
     WebInspector.HeapSnapshotGridNode.call(this, tree, aggregate.count > 0, 100);
-    this._name = constructor;
+    this._name = className;
     this._count = aggregate.count;
     this._shallowSize = aggregate.self;
     this._retainedSize = aggregate.maxRet;
-    this._provider = this._createNodesProvider(tree.snapshot, aggregate.type, aggregate.name);
+    this._provider = this._createNodesProvider(tree.snapshot, aggregate.type, className);
 }
 
 WebInspector.HeapSnapshotConstructorNode.prototype = {
@@ -410,14 +401,13 @@ WebInspector.HeapSnapshotConstructorNode.prototype = {
         return new WebInspector.HeapSnapshotInstanceNode(this.dataGrid, null, this.dataGrid.snapshot, provider.item);
     },
 
-    _createNodesProvider: function(snapshot, nodeType, nodeName)
+    _createNodesProvider: function(snapshot, nodeType, nodeClassName)
     {
         return new WebInspector.HeapSnapshotNodesProvider(
             snapshot,
-            snapshot.allNodes,
             function (node) {
                  return node.type === nodeType
-                     && (nodeName === null || node.name === nodeName);
+                    && (nodeClassName === null || node.className === nodeClassName);
             });
     },
 
@@ -456,7 +446,7 @@ WebInspector.HeapSnapshotConstructorNode.prototype = {
 
     get _countPercent()
     {
-        return this._count / this.dataGrid.snapshot.nodesCount * 100.0;
+        return this._count / this.dataGrid.snapshot.nodeCount * 100.0;
     },
 
     get _retainedSizePercent()
@@ -485,12 +475,6 @@ WebInspector.HeapSnapshotIteratorsTuple.prototype = {
         this._it2.first();
     },
 
-    resetInstancesCount: function()
-    {
-        this._it1.resetInstancesCount();
-        this._it2.resetInstancesCount();
-    },
-
     sort: function(comparator)
     {
         this._it1.sort(comparator);
@@ -498,16 +482,16 @@ WebInspector.HeapSnapshotIteratorsTuple.prototype = {
     }
 };
 
-WebInspector.HeapSnapshotDiffNode = function(tree, constructor, baseAggregate, aggregate)
+WebInspector.HeapSnapshotDiffNode = function(tree, className, baseAggregate, aggregate)
 {
     if (!baseAggregate)
         baseAggregate = { count: 0, self: 0, maxRet: 0, type:aggregate.type, name:aggregate.name, idxs: [] };
     if (!aggregate)
         aggregate = { count: 0, self: 0, maxRet: 0, type:baseAggregate.type, name:baseAggregate.name, idxs: [] };
     WebInspector.HeapSnapshotGridNode.call(this, tree, true, 50);
-    this._name = constructor;
+    this._name = className;
     this._calculateDiff(tree.baseSnapshot, tree.snapshot, baseAggregate.idxs, aggregate.idxs);
-    this._provider = this._createNodesProvider(tree.baseSnapshot, tree.snapshot, aggregate.type, aggregate.name);
+    this._provider = this._createNodesProvider(tree.baseSnapshot, tree.snapshot, aggregate.type, className);
 }
 
 WebInspector.HeapSnapshotDiffNode.prototype = {
@@ -559,7 +543,7 @@ WebInspector.HeapSnapshotDiffNode.prototype = {
             return new WebInspector.HeapSnapshotInstanceNode(this.dataGrid, provider.snapshot, null, provider.item);
     },
 
-    _createNodesProvider: function(baseSnapshot, snapshot, nodeType, nodeName)
+    _createNodesProvider: function(baseSnapshot, snapshot, nodeType, nodeClassName)
     {
         return new WebInspector.HeapSnapshotIteratorsTuple(
             createProvider(snapshot, baseSnapshot), createProvider(baseSnapshot, snapshot));
@@ -568,11 +552,10 @@ WebInspector.HeapSnapshotDiffNode.prototype = {
         {
             return new WebInspector.HeapSnapshotNodesProvider(
                 snapshot,
-                snapshot.allNodes,
                 function (node) {
                      return node.type === nodeType
-                         && (nodeName === null || node.name === nodeName)
-                         && !(node.id in otherSnapshot.idsMap);
+                         && (nodeClassName === null || node.className === nodeClassName)
+                         && !otherSnapshot.hasId(node.id);
                 });
         }
     },
@@ -655,9 +638,8 @@ WebInspector.HeapSnapshotDominatorObjectNode.prototype = {
         var showHiddenData = WebInspector.DetailedHeapshotView.prototype.showHiddenData;
         return new WebInspector.HeapSnapshotNodesProvider(
             snapshot,
-            snapshot.allNodes,
             function (node) {
-                 var dominatorIndex = node.dominatorIndex();
+                 var dominatorIndex = node.dominatorIndex;
                  return dominatorIndex === nodeIndex
                      && dominatorIndex !== node.nodeIndex
                      && (showHiddenData || !node.isHidden);
diff --git a/Source/WebCore/inspector/front-end/DetailedHeapshotView.js b/Source/WebCore/inspector/front-end/DetailedHeapshotView.js
index ffce1dd..21d0fa9 100644
--- a/Source/WebCore/inspector/front-end/DetailedHeapshotView.js
+++ b/Source/WebCore/inspector/front-end/DetailedHeapshotView.js
@@ -45,8 +45,8 @@ WebInspector.HeapSnapshotContainmentDataGrid.prototype = {
     {
         this.snapshotView = snapshotView;
         this.snapshot = snapshot;
-        this.snapshotNodeIndex = this.snapshot._rootNodeIndex;
-        this._provider = this._createProvider(snapshot, snapshot.rootNode.rawEdges);
+        this.snapshotNodeIndex = this.snapshot.rootNodeIndex;
+        this._provider = this._createProvider(snapshot, this.snapshotNodeIndex);
         this.sort();
     }
 };
@@ -227,7 +227,7 @@ WebInspector.HeapSnapshotDominatorsDataGrid.prototype = {
     {
         this.snapshotView = snapshotView;
         this.snapshot = snapshot;
-        this.snapshotNodeIndex = this.snapshot._rootNodeIndex;
+        this.snapshotNodeIndex = this.snapshot.rootNodeIndex;
         this._provider = this._createProvider(snapshot, this.snapshotNodeIndex);
         this.sort();
     }
@@ -263,11 +263,21 @@ WebInspector.HeapSnapshotRetainingPathsList.prototype = {
             this.searchCancelled();
 
         this.pathFinder = new WebInspector.HeapSnapshotPathFinder(snapshot, nodeIndex);
+        this._setRootChildrenForFinder();
 
         this.removeChildren();
 
         this._counter = 0;
-        this.showNext(10);
+        this.showNext(100);
+    },
+
+    refresh: function()
+    {
+        this.removeChildren();
+        this._counter = 0;
+        delete this._cancel;
+        this._setRootChildrenForFinder();
+        this.showNext(100);
     },
 
     showNext: function(pathsCount)
@@ -283,7 +293,7 @@ WebInspector.HeapSnapshotRetainingPathsList.prototype = {
                     if (result === null) {
                         WebInspector.PleaseWaitMessage.prototype.hide();
                         if (!this.children.length)
-                            this.appendChild(new WebInspector.DataGridNode({path:WebInspector.UIString("This object is either only accessible via hidden properties, or current path search depth isn't enough."), len:""}, false));
+                            this.appendChild(new WebInspector.DataGridNode({path:WebInspector.UIString("Can't find any paths."), len:""}, false));
                         return;
                     } else if (result !== false) {
                         if (this._prefix)
@@ -311,6 +321,19 @@ WebInspector.HeapSnapshotRetainingPathsList.prototype = {
         }
     },
 
+    _setRootChildrenForFinder: function()
+    {
+        function FilterDOMWindow(node)
+        {
+            return node.name === "DOMWindow";
+        }
+
+        if (this.snapshotView.isTracingToWindowObjects)
+            this.pathFinder.updateRoots(FilterDOMWindow);
+        else
+            this.pathFinder.updateRoots();
+    },
+
     _performSorting: function(sortFunction)
     {
         function DataExtractorWrapper(nodeA, nodeB)
@@ -341,7 +364,6 @@ WebInspector.DetailedHeapshotView = function(parent, profile)
     this.containmentView.element.addStyleClass("view");
     this.containmentDataGrid = new WebInspector.HeapSnapshotContainmentDataGrid();
     this.containmentDataGrid.element.addEventListener("click", this._mouseClickInContainmentGrid.bind(this), true);
-    this.containmentDataGrid.element.addEventListener("dblclick", this._dblClickInContainmentGrid.bind(this), true);
     this.containmentView.element.appendChild(this.containmentDataGrid.element);
     this.element.appendChild(this.containmentView.element);
 
@@ -349,7 +371,6 @@ WebInspector.DetailedHeapshotView = function(parent, profile)
     this.constructorsView.element.addStyleClass("view");
     this.constructorsDataGrid = new WebInspector.HeapSnapshotConstructorsDataGrid();
     this.constructorsDataGrid.element.addEventListener("click", this._mouseClickInContainmentGrid.bind(this), true);
-    this.constructorsDataGrid.element.addEventListener("dblclick", this._dblClickInContainmentGrid.bind(this), true);
     this.constructorsView.element.appendChild(this.constructorsDataGrid.element);
     this.element.appendChild(this.constructorsView.element);
 
@@ -357,7 +378,6 @@ WebInspector.DetailedHeapshotView = function(parent, profile)
     this.diffView.element.addStyleClass("view");
     this.diffDataGrid = new WebInspector.HeapSnapshotDiffDataGrid();
     this.diffDataGrid.element.addEventListener("click", this._mouseClickInContainmentGrid.bind(this), true);
-    this.diffDataGrid.element.addEventListener("dblclick", this._dblClickInContainmentGrid.bind(this), true);
     this.diffView.element.appendChild(this.diffDataGrid.element);
     this.element.appendChild(this.diffView.element);
 
@@ -365,17 +385,27 @@ WebInspector.DetailedHeapshotView = function(parent, profile)
     this.dominatorView.element.addStyleClass("view");
     this.dominatorDataGrid = new WebInspector.HeapSnapshotDominatorsDataGrid();
     this.dominatorDataGrid.element.addEventListener("click", this._mouseClickInContainmentGrid.bind(this), true);
-    this.dominatorDataGrid.element.addEventListener("dblclick", this._dblClickInContainmentGrid.bind(this), true);
     this.dominatorView.element.appendChild(this.dominatorDataGrid.element);
     this.element.appendChild(this.dominatorView.element);
 
     var retainmentView = new WebInspector.View();
-    retainmentView.element.addStyleClass("view retaining-paths-view");
+    retainmentView.element.addStyleClass("view");
+    retainmentView.element.addStyleClass("retaining-paths-view");
     var retainingPathsTitleDiv = document.createElement("div");
     retainingPathsTitleDiv.className = "title";
     var retainingPathsTitle = document.createElement("span");
-    retainingPathsTitle.textContent = WebInspector.UIString("Retaining paths of the selected object");
+    retainingPathsTitle.textContent = WebInspector.UIString("Paths from the selected object");
+    this.retainingPathsRoot = document.createElement("select");
+    this.retainingPathsRoot.className = "status-bar-item";
+    this.retainingPathsRoot.addEventListener("change", this._changeRetainingPathsRoot.bind(this), false);
+    var toGCRootsTraceOption = document.createElement("option");
+    toGCRootsTraceOption.label = WebInspector.UIString("to GC roots");
+    var toWindowObjectsTraceOption = document.createElement("option");
+    toWindowObjectsTraceOption.label = WebInspector.UIString("to window objects");
+    this.retainingPathsRoot.appendChild(toGCRootsTraceOption);
+    this.retainingPathsRoot.appendChild(toWindowObjectsTraceOption);
     retainingPathsTitleDiv.appendChild(retainingPathsTitle);
+    retainingPathsTitleDiv.appendChild(this.retainingPathsRoot);
     retainmentView.element.appendChild(retainingPathsTitleDiv);
     this.retainmentDataGrid = new WebInspector.HeapSnapshotRetainingPathsList();
     retainmentView.element.appendChild(this.retainmentDataGrid.element);
@@ -416,6 +446,8 @@ WebInspector.DetailedHeapshotView = function(parent, profile)
     this.helpButton = new WebInspector.StatusBarButton("", "heapshot-help-status-bar-item status-bar-item");
     this.helpButton.addEventListener("click", this._helpClicked.bind(this), false);
 
+    var popoverHelper = new WebInspector.PopoverHelper(this.element, this._getHoverAnchor.bind(this), this._showStringContentPopup.bind(this));
+
     this._loadProfile(this._profileUid, profileCallback.bind(this));
 
     function profileCallback(profile)
@@ -714,24 +746,10 @@ WebInspector.DetailedHeapshotView.prototype = {
         profile.sideBarElement.subtitle = Number.bytesToString(s.totalSize);
     },
 
-    _dblClickInContainmentGrid: function(event)
-    {
-        var cell = event.target.enclosingNodeOrSelfWithNodeName("td");
-        if (!cell || (!cell.hasStyleClass("retainedSize-column")))
-            return;
-        var nodeItem = event.target.enclosingNodeOrSelfWithNodeName("tr")._dataGridNode;
-        ProfilerAgent.getExactHeapSnapshotNodeRetainedSize(this._profileUid, nodeItem.snapshotNodeId, setExactRetainedSize);
-
-        function setExactRetainedSize(exactSize) {
-            if (exactSize && exactSize != -1)
-                nodeItem.exactRetainedSize = exactSize;
-        }
-    },
-
     _mouseClickInContainmentGrid: function(event)
     {
         var cell = event.target.enclosingNodeOrSelfWithNodeName("td");
-        if (!cell || !(cell.hasStyleClass("object-column") ||  cell.hasStyleClass("shallowSize-column")))
+        if (!cell || (!cell.hasStyleClass("object-column") && !cell.hasStyleClass("shallowSize-column") && !cell.hasStyleClass("retainedSize-column")))
             return;
         var row = event.target.enclosingNodeOrSelfWithNodeName("tr");
         if (!row)
@@ -794,6 +812,33 @@ WebInspector.DetailedHeapshotView.prototype = {
         this.performSearch(this.currentQuery, this._searchFinishedCallback);
     },
 
+    _changeRetainingPathsRoot: function(event)
+    {
+        if (!event)
+            return;
+        this.retainmentDataGrid.refresh();
+    },
+
+    _getHoverAnchor: function(target)
+    {
+        var span = target.enclosingNodeOrSelfWithNodeName("span");
+        if (!span || !span.hasStyleClass("console-formatted-string"))
+            return;
+        var row = target.enclosingNodeOrSelfWithNodeName("tr");
+        if (!row)
+            return;
+        var gridNode = row._dataGridNode;
+        if (!gridNode.snapshotNodeIndex)
+            return;
+        span.snapshotNodeIndex = gridNode.snapshotNodeIndex;
+        return span;
+    },
+
+    get isTracingToWindowObjects()
+    {
+        return this.retainingPathsRoot.selectedIndex === 1;
+    },
+
     get _isShowingAsPercent()
     {
         return this.showCountAsPercent && this.showShallowSizeAsPercent && this.showRetainedSizeAsPercent;
@@ -808,6 +853,18 @@ WebInspector.DetailedHeapshotView.prototype = {
         this.refreshShowAsPercents();
     },
 
+    _showStringContentPopup: function(span)
+    {
+        var snapshotNode = new WebInspector.HeapSnapshotNode(this.profileWrapper, span.snapshotNodeIndex);
+        var stringContentElement = document.createElement("span");
+        stringContentElement.className = "monospace console-formatted-string";
+        stringContentElement.style.whiteSpace = "pre";
+        stringContentElement.textContent = "\"" + snapshotNode.name + "\"";
+        var popover = new WebInspector.Popover(stringContentElement);
+        popover.show(span);
+        return popover;
+    },
+
     _helpClicked: function(event)
     {
         if (!this.helpPopover) {
diff --git a/Source/WebCore/inspector/front-end/ElementsPanel.js b/Source/WebCore/inspector/front-end/ElementsPanel.js
index 246abe8..724e0e2 100644
--- a/Source/WebCore/inspector/front-end/ElementsPanel.js
+++ b/Source/WebCore/inspector/front-end/ElementsPanel.js
@@ -35,6 +35,10 @@ WebInspector.ElementsPanel = function()
     this.contentElement = document.createElement("div");
     this.contentElement.id = "elements-content";
     this.contentElement.className = "outline-disclosure source-code";
+    if (!WebInspector.settings.domWordWrap)
+        this.contentElement.classList.add("nowrap");
+
+    this.element.addEventListener("contextmenu", this._contextMenuEventFired.bind(this), true);
 
     this.treeOutline = new WebInspector.ElementsTreeOutline();
     this.treeOutline.panel = this;
@@ -57,7 +61,7 @@ WebInspector.ElementsPanel = function()
         this.panel.updateEventListeners();
 
         if (this._focusedDOMNode) {
-            DOMAgent.addInspectedNode(this._focusedDOMNode.id);
+            ConsoleAgent.addInspectedNode(this._focusedDOMNode.id);
             WebInspector.extensionServer.notifyObjectSelected(this.panel.name);
         }
     };
@@ -109,7 +113,14 @@ WebInspector.ElementsPanel = function()
 
     this._registerShortcuts();
 
-    this.reset();
+    WebInspector.domAgent.addEventListener(WebInspector.DOMAgent.Events.NodeInserted, this._nodeInserted, this);
+    WebInspector.domAgent.addEventListener(WebInspector.DOMAgent.Events.NodeRemoved, this._nodeRemoved, this);
+    WebInspector.domAgent.addEventListener(WebInspector.DOMAgent.Events.AttrModified, this._attributesUpdated, this);
+    WebInspector.domAgent.addEventListener(WebInspector.DOMAgent.Events.CharacterDataModified, this._characterDataModified, this);
+    WebInspector.domAgent.addEventListener(WebInspector.DOMAgent.Events.DocumentUpdated, this._documentUpdated, this);
+    WebInspector.domAgent.addEventListener(WebInspector.DOMAgent.Events.ChildNodeCountUpdated, this._childNodeCountUpdated, this);
+
+    this.recentlyModifiedNodes = [];
 }
 
 WebInspector.ElementsPanel.prototype = {
@@ -160,7 +171,7 @@ WebInspector.ElementsPanel.prototype = {
         this.updateBreadcrumbSizes();
     },
 
-    reset: function()
+    _reset: function()
     {
         if (this.focusedDOMNode)
             this._selectedPathOnReset = this.focusedDOMNode.path();
@@ -175,18 +186,21 @@ WebInspector.ElementsPanel.prototype = {
         delete this.currentQuery;
     },
 
-    setDocument: function(inspectedRootDocument)
+    _documentUpdated: function(event)
+    {
+        this._setDocument(event.data);
+    },
+
+    _setDocument: function(inspectedRootDocument)
     {
-        this.reset();
+        this._reset();
         this.searchCanceled();
 
         if (!inspectedRootDocument)
             return;
 
-        inspectedRootDocument.addEventListener("DOMNodeInserted", this._nodeInserted.bind(this));
-        inspectedRootDocument.addEventListener("DOMNodeRemoved", this._nodeRemoved.bind(this));
-        inspectedRootDocument.addEventListener("DOMAttrModified", this._attributesUpdated.bind(this));
-        inspectedRootDocument.addEventListener("DOMCharacterDataModified", this._characterDataModified.bind(this));
+        WebInspector.breakpointManager.restoreDOMBreakpoints();
+
 
         this.rootDOMNode = inspectedRootDocument;
 
@@ -229,7 +243,7 @@ WebInspector.ElementsPanel.prototype = {
 
         delete this._currentSearchResultIndex;
         this._searchResults = [];
-        DOMAgent.searchCanceled();
+        WebInspector.domAgent.cancelSearch();
     },
 
     performSearch: function(query)
@@ -245,7 +259,34 @@ WebInspector.ElementsPanel.prototype = {
         this._matchesCountUpdateTimeout = null;
         this._searchQuery = query;
 
-        DOMAgent.performSearch(whitespaceTrimmedQuery, false);
+        WebInspector.domAgent.performSearch(whitespaceTrimmedQuery, this._addNodesToSearchResult.bind(this));
+    },
+
+    _contextMenuEventFired: function(event)
+    {
+        function isTextWrapped()
+        {
+            return !this.contentElement.hasStyleClass("nowrap");
+        }
+
+        function toggleWordWrap()
+        {
+            this.contentElement.classList.toggle("nowrap");
+            WebInspector.settings.domWordWrap = !this.contentElement.classList.contains("nowrap");
+
+            var treeElement = this.treeOutline.findTreeElement(this.focusedDOMNode);
+            if (treeElement)
+                treeElement.updateSelection(); // Recalculate selection highlight dimensions.
+        }
+
+        var contextMenu = new WebInspector.ContextMenu();
+
+        var populated = this.treeOutline.populateContextMenu(contextMenu, event);
+        if (populated)
+            contextMenu.appendSeparator();
+        contextMenu.appendCheckboxItem(WebInspector.UIString("Word Wrap"), toggleWordWrap.bind(this), isTextWrapped.call(this));
+
+        contextMenu.show(event);
     },
 
     populateHrefContextMenu: function(contextMenu, event, anchorElement)
@@ -289,7 +330,7 @@ WebInspector.ElementsPanel.prototype = {
         this._matchesCountUpdateTimeout = setTimeout(this._updateMatchesCount.bind(this), 500);
     },
 
-    addNodesToSearchResult: function(nodeIds)
+    _addNodesToSearchResult: function(nodeIds)
     {
         if (!nodeIds.length)
             return;
@@ -379,35 +420,42 @@ WebInspector.ElementsPanel.prototype = {
 
     _attributesUpdated: function(event)
     {
-        this.recentlyModifiedNodes.push({node: event.target, updated: true});
+        this.recentlyModifiedNodes.push({node: event.data, updated: true});
         if (this.visible)
             this._updateModifiedNodesSoon();
 
-        if (!this.sidebarPanes.styles.isModifyingStyle && event.target === this.focusedDOMNode)
+        if (!this.sidebarPanes.styles.isModifyingStyle && event.data === this.focusedDOMNode)
             this._styleSheetChanged();
     },
 
     _characterDataModified: function(event)
     {
-        this.recentlyModifiedNodes.push({node: event.target, updated: true});
+        this.recentlyModifiedNodes.push({node: event.data, updated: true});
         if (this.visible)
             this._updateModifiedNodesSoon();
     },
 
     _nodeInserted: function(event)
     {
-        this.recentlyModifiedNodes.push({node: event.target, parent: event.relatedNode, inserted: true});
+        this.recentlyModifiedNodes.push({node: event.data, parent: event.data.parentNode, inserted: true});
         if (this.visible)
             this._updateModifiedNodesSoon();
     },
 
     _nodeRemoved: function(event)
     {
-        this.recentlyModifiedNodes.push({node: event.target, parent: event.relatedNode, removed: true});
+        this.recentlyModifiedNodes.push({node: event.data.node, parent: event.data.parent, removed: true});
         if (this.visible)
             this._updateModifiedNodesSoon();
     },
 
+    _childNodeCountUpdated: function(event)
+    {
+        var treeElement = this.treeOutline.findTreeElement(event.data);
+        if (treeElement)
+            treeElement.hasChildren = event.data.hasChildNodes();
+    },
+
     _updateModifiedNodesSoon: function()
     {
         if ("_updateModifiedNodesTimeout" in this)
@@ -426,7 +474,6 @@ WebInspector.ElementsPanel.prototype = {
         var updateBreadcrumbs = false;
 
         for (var i = 0; i < this.recentlyModifiedNodes.length; ++i) {
-            var replaced = this.recentlyModifiedNodes[i].replaced;
             var parent = this.recentlyModifiedNodes[i].parent;
             var node = this.recentlyModifiedNodes[i].node;
 
@@ -442,7 +489,7 @@ WebInspector.ElementsPanel.prototype = {
 
             var parentNodeItem = this.treeOutline.findTreeElement(parent);
             if (parentNodeItem && !parentNodeItem.alreadyUpdatedChildren) {
-                parentNodeItem.updateChildren(replaced);
+                parentNodeItem.updateChildren();
                 parentNodeItem.alreadyUpdatedChildren = true;
                 updatedParentTreeElements.push(parentNodeItem);
             }
@@ -577,7 +624,7 @@ WebInspector.ElementsPanel.prototype = {
 
         foundRoot = false;
         for (var current = this.focusedDOMNode; current; current = current.parentNode) {
-            if (current.nodeType === Node.DOCUMENT_NODE)
+            if (current.nodeType() === Node.DOCUMENT_NODE)
                 continue;
 
             if (current === this.rootDOMNode)
@@ -589,7 +636,7 @@ WebInspector.ElementsPanel.prototype = {
             crumb.addEventListener("mousedown", selectCrumbFunction, false);
 
             var crumbTitle;
-            switch (current.nodeType) {
+            switch (current.nodeType()) {
                 case Node.ELEMENT_NODE:
                     this.decorateNodeLabel(current, crumb);
                     break;
@@ -610,7 +657,7 @@ WebInspector.ElementsPanel.prototype = {
                     break;
 
                 default:
-                    crumbTitle = this.treeOutline.nodeNameToCorrectCase(current.nodeName);
+                    crumbTitle = this.treeOutline.nodeNameToCorrectCase(current.nodeName());
             }
 
             if (!crumb.childNodes.length) {
@@ -638,7 +685,7 @@ WebInspector.ElementsPanel.prototype = {
 
     decorateNodeLabel: function(node, parentElement)
     {
-        var title = this.treeOutline.nodeNameToCorrectCase(node.nodeName);
+        var title = this.treeOutline.nodeNameToCorrectCase(node.nodeName());
 
         var nameElement = document.createElement("span");
         nameElement.textContent = title;
@@ -1033,7 +1080,7 @@ WebInspector.ElementsPanel.prototype = {
             return;
         event.clipboardData.clearData();
         event.preventDefault();
-        DOMAgent.copyNode(this.focusedDOMNode.id);
+        this.focusedDOMNode.copyNode();
     },
 
     rightSidebarResizerDragStart: function(event)
@@ -1073,14 +1120,15 @@ WebInspector.ElementsPanel.prototype = {
         this._nodeSearchButton.toggled = false;
     },
 
-    _setSearchingForNode: function(enabled)
+    _setSearchingForNode: function(error, enabled)
     {
-        this._nodeSearchButton.toggled = enabled;
+        if (!error)
+            this._nodeSearchButton.toggled = enabled;
     },
 
     setSearchingForNode: function(enabled)
     {
-        InspectorAgent.setSearchingForNode(enabled, this._setSearchingForNode.bind(this));
+        DOMAgent.setSearchingForNode(enabled, this._setSearchingForNode.bind(this));
     },
 
     toggleSearchingForNode: function()
diff --git a/Source/WebCore/inspector/front-end/ElementsTreeOutline.js b/Source/WebCore/inspector/front-end/ElementsTreeOutline.js
index 7b5ff2f..dd99db1 100644
--- a/Source/WebCore/inspector/front-end/ElementsTreeOutline.js
+++ b/Source/WebCore/inspector/front-end/ElementsTreeOutline.js
@@ -41,8 +41,6 @@ WebInspector.ElementsTreeOutline = function() {
     this.showInElementsPanelEnabled = false;
     this.rootDOMNode = null;
     this.focusedDOMNode = null;
-
-    this.element.addEventListener("contextmenu", this._contextMenuEventFired.bind(this), true);
 }
 
 WebInspector.ElementsTreeOutline.prototype = {
@@ -144,7 +142,7 @@ WebInspector.ElementsTreeOutline.prototype = {
     findTreeElement: function(node)
     {
         var treeElement = TreeOutline.prototype.findTreeElement.call(this, node, isAncestorNode, parentNode);
-        if (!treeElement && node.nodeType === Node.TEXT_NODE) {
+        if (!treeElement && node.nodeType() === Node.TEXT_NODE) {
             // The text node might have been inlined if it was short, so try to find the parent element.
             treeElement = TreeOutline.prototype.findTreeElement.call(this, node.parentNode, isAncestorNode, parentNode);
         }
@@ -189,11 +187,13 @@ WebInspector.ElementsTreeOutline.prototype = {
 
     _treeElementFromEvent: function(event)
     {
-        var root = this.element;
+        var scrollContainer = this.element.parentElement;
 
         // We choose this X coordinate based on the knowledge that our list
-        // items extend nearly to the right edge of the outer <ol>.
-        var x = root.totalOffsetLeft + root.offsetWidth - 20;
+        // items extend at least to the right edge of the outer <ol> container.
+        // In the no-word-wrap mode the outer <ol> may be wider than the tree container
+        // (and partially hidden), in which case we are left to use only its right boundary.
+        var x = scrollContainer.totalOffsetLeft + scrollContainer.offsetWidth - 36;
 
         var y = event.pageY;
 
@@ -258,37 +258,40 @@ WebInspector.ElementsTreeOutline.prototype = {
         WebInspector.highlightDOMNode(0);
     },
 
-    _contextMenuEventFired: function(event)
+    populateContextMenu: function(contextMenu, event)
     {
         var listItem = event.target.enclosingNodeOrSelfWithNodeName("LI");
         if (!listItem || !listItem.treeElement)
-            return;
+            return false;
 
-        var contextMenu = new WebInspector.ContextMenu();
+        var populated;
         if (this.showInElementsPanelEnabled) {
             function focusElement()
             {
                 WebInspector.panels.elements.switchToAndFocus(listItem.treeElement.representedObject);
             }
             contextMenu.appendItem(WebInspector.UIString("Reveal in Elements Panel"), focusElement.bind(this));
+            populated = true;
         } else {
             var href = event.target.enclosingNodeOrSelfWithClass("webkit-html-resource-link") || event.target.enclosingNodeOrSelfWithClass("webkit-html-external-link");
             var tag = event.target.enclosingNodeOrSelfWithClass("webkit-html-tag");
             var textNode = event.target.enclosingNodeOrSelfWithClass("webkit-html-text-node");
-            var needSeparator;
             if (href)
-                needSeparator = WebInspector.panels.elements.populateHrefContextMenu(contextMenu, event, href);
+                populated = WebInspector.panels.elements.populateHrefContextMenu(contextMenu, event, href);
             if (tag && listItem.treeElement._populateTagContextMenu) {
-                if (needSeparator)
+                if (populated)
                     contextMenu.appendSeparator();
                 listItem.treeElement._populateTagContextMenu(contextMenu, event);
+                populated = true;
             } else if (textNode && listItem.treeElement._populateTextContextMenu) {
-                if (needSeparator)
+                if (populated)
                     contextMenu.appendSeparator();
                 listItem.treeElement._populateTextContextMenu(contextMenu, textNode);
+                populated = true;
             }
         }
-        contextMenu.show(event);
+
+        return populated;
     }
 }
 
@@ -302,7 +305,7 @@ WebInspector.ElementsTreeElement = function(node, elementCloseTag)
     // The title will be updated in onattach.
     TreeElement.call(this, "", node, hasChildrenOverride);
 
-    if (this.representedObject.nodeType == Node.ELEMENT_NODE && !elementCloseTag)
+    if (this.representedObject.nodeType() == Node.ELEMENT_NODE && !elementCloseTag)
         this._canAddAttributes = true;
     this._searchQuery = null;
     this._expandedChildrenLimit = WebInspector.ElementsTreeElement.InitialChildrenLimit;
@@ -400,12 +403,12 @@ WebInspector.ElementsTreeElement.prototype = {
     _createTooltipForNode: function()
     {
         var node = this.representedObject;
-        if (!node.nodeName || node.nodeName.toLowerCase() !== "img")
+        if (!node.nodeName() || node.nodeName().toLowerCase() !== "img")
             return;
 
-        function setTooltip(result)
+        function setTooltip(error, result)
         {
-            if (!result || result.type !== "string")
+            if (error || !result || result.type !== "string")
                 return;
 
             try {
@@ -423,15 +426,15 @@ WebInspector.ElementsTreeElement.prototype = {
             }
         }
 
-        function resolvedNode(objectPayload)
+        function resolvedNode(object)
         {
-            if (!objectPayload)
+            if (!object)
                 return;
 
-            var object = WebInspector.RemoteObject.fromPayload(objectPayload);
             object.evaluate("return '[' + this.offsetWidth + ',' + this.offsetHeight + ',' + this.naturalWidth + ',' + this.naturalHeight + ']'", setTooltip.bind(this));
+            object.release();
         }
-        DOMAgent.resolveNode(node.id, "", resolvedNode.bind(this));
+        WebInspector.RemoteObject.resolveNode(node, resolvedNode.bind(this));
     },
 
     updateSelection: function()
@@ -489,8 +492,7 @@ WebInspector.ElementsTreeElement.prototype = {
     {
         if (this._elementCloseTag)
             return;
-
-        WebInspector.domAgent.getChildNodesAsync(this.representedObject, this._updateChildren.bind(this, fullRefresh));
+        this.representedObject.getChildNodes(this._updateChildren.bind(this, fullRefresh));
     },
 
     insertChildElement: function(child, index, closingTag)
@@ -587,7 +589,7 @@ WebInspector.ElementsTreeElement.prototype = {
         this.adjustCollapsedRange(false);
 
         var lastChild = this.children[this.children.length - 1];
-        if (this.representedObject.nodeType == Node.ELEMENT_NODE && (!lastChild || !lastChild._elementCloseTag))
+        if (this.representedObject.nodeType() == Node.ELEMENT_NODE && (!lastChild || !lastChild._elementCloseTag))
             this.insertChildElement(this.representedObject, this.children.length, true);
 
         // We want to restore the original selection and tree scroll position after a full refresh, if possible.
@@ -660,8 +662,13 @@ WebInspector.ElementsTreeElement.prototype = {
 
     onreveal: function()
     {
-        if (this.listItemElement)
-            this.listItemElement.scrollIntoViewIfNeeded(false);
+        if (this.listItemElement) {
+            var tagSpans = this.listItemElement.getElementsByClassName("webkit-html-tag-name");
+            if (tagSpans.length)
+                tagSpans[0].scrollIntoViewIfNeeded(false);
+            else
+                this.listItemElement.scrollIntoViewIfNeeded(false);
+        }
     },
 
     onselect: function(treeElement, selectedByUser)
@@ -743,7 +750,7 @@ WebInspector.ElementsTreeElement.prototype = {
         if (this.treeOutline.focusedDOMNode != this.representedObject)
             return;
 
-        if (this.representedObject.nodeType != Node.ELEMENT_NODE && this.representedObject.nodeType != Node.TEXT_NODE)
+        if (this.representedObject.nodeType() != Node.ELEMENT_NODE && this.representedObject.nodeType() != Node.TEXT_NODE)
             return false;
 
         var textNode = eventTarget.enclosingNodeOrSelfWithClass("webkit-html-text-node");
@@ -824,7 +831,7 @@ WebInspector.ElementsTreeElement.prototype = {
             return this._addNewAttribute();
         }
 
-        if (this.representedObject.nodeType === Node.TEXT_NODE) {
+        if (this.representedObject.nodeType() === Node.TEXT_NODE) {
             var textNode = listItem.getElementsByClassName("webkit-html-text-node")[0];
             if (textNode)
                 return this._startEditingTextNode(textNode);
@@ -872,7 +879,7 @@ WebInspector.ElementsTreeElement.prototype = {
         if (!attributeNameElement)
             return false;
 
-        var attributeName = attributeNameElement.innerText;
+        var attributeName = attributeNameElement.textContent;
 
         function removeZeroWidthSpaceRecursive(node)
         {
@@ -962,10 +969,12 @@ WebInspector.ElementsTreeElement.prototype = {
         return true;
     },
 
-    _startEditingAsHTML: function(commitCallback, initialValue)
+    _startEditingAsHTML: function(commitCallback, error, initialValue)
     {
+        if (error)
+            return;
         if (this._htmlEditElement && WebInspector.isBeingEdited(this._htmlEditElement))
-            return true;
+            return;
 
         this._htmlEditElement = document.createElement("div");
         this._htmlEditElement.className = "source-code elements-tree-editor";
@@ -1030,7 +1039,7 @@ WebInspector.ElementsTreeElement.prototype = {
             var found = false;
 
             // Search for the attribute's position, and then decide where to move to.
-            var attributes = this.representedObject.attributes;
+            var attributes = this.representedObject.attributes();
             for (var i = 0; i < attributes.length; ++i) {
                 if (attributes[i].name === attributeName) {
                     found = true;
@@ -1095,7 +1104,7 @@ WebInspector.ElementsTreeElement.prototype = {
         }
 
         if (!parseElement.hasAttributes()) {
-            this.representedObject.removeAttribute(attributeName);
+            this.representedObject.removeAttribute(attributeName, this.updateTitle.bind(this));
             this.treeOutline.focusedNodeChanged(true);
             moveToNextAttributeIfNeeded.call(this);
             return;
@@ -1106,13 +1115,13 @@ WebInspector.ElementsTreeElement.prototype = {
             var attr = parseElement.attributes[i];
             foundOriginalAttribute = foundOriginalAttribute || attr.name === attributeName;
             try {
-                this.representedObject.setAttribute(attr.name, attr.value);
+                this.representedObject.setAttribute(attr.name, attr.value, this.updateTitle.bind(this));
                 regenerateStyledAttribute.call(this, attr.name, attr.value);
             } catch(e) {} // ignore invalid attribute (innerHTML doesn't throw errors, but this can)
         }
 
         if (!foundOriginalAttribute)
-            this.representedObject.removeAttribute(attributeName);
+            this.representedObject.removeAttribute(attributeName, this.updateTitle.bind(this));
 
         this.treeOutline.focusedNodeChanged(true);
 
@@ -1141,7 +1150,7 @@ WebInspector.ElementsTreeElement.prototype = {
                 return;
             }
 
-            var attributes = this.representedObject.attributes;
+            var attributes = this.representedObject.attributes();
             if (attributes.length > 0)
                 this._triggerEditAttribute(attributes[0].name);
             else
@@ -1157,9 +1166,9 @@ WebInspector.ElementsTreeElement.prototype = {
         var treeOutline = this.treeOutline;
         var wasExpanded = this.expanded;
 
-        function changeTagNameCallback(nodeId)
+        function changeTagNameCallback(error, nodeId)
         {
-            if (!nodeId) {
+            if (error || !nodeId) {
                 cancel();
                 return;
             }
@@ -1175,7 +1184,7 @@ WebInspector.ElementsTreeElement.prototype = {
             moveToNextAttributeIfNeeded.call(newTreeItem);
         }
 
-        DOMAgent.changeTagName(this.representedObject.id, newText, changeTagNameCallback);
+        this.representedObject.setNodeName(newText, changeTagNameCallback);
     },
 
     _textNodeEditingCommitted: function(element, newText)
@@ -1183,14 +1192,14 @@ WebInspector.ElementsTreeElement.prototype = {
         delete this._editing;
 
         var textNode;
-        if (this.representedObject.nodeType === Node.ELEMENT_NODE) {
+        if (this.representedObject.nodeType() === Node.ELEMENT_NODE) {
             // We only show text nodes inline in elements if the element only
             // has a single child, and that child is a text node.
             textNode = this.representedObject.firstChild;
-        } else if (this.representedObject.nodeType == Node.TEXT_NODE)
+        } else if (this.representedObject.nodeType() == Node.TEXT_NODE)
             textNode = this.representedObject;
 
-        textNode.nodeValue = newText;
+        textNode.setNodeValue(newText, this.updateTitle.bind(this));
     },
 
     _editingCancelled: function(element, context)
@@ -1250,7 +1259,7 @@ WebInspector.ElementsTreeElement.prototype = {
         if (linkify && (name === "src" || name === "href")) {
             var rewrittenHref = WebInspector.resourceURLForRelatedNode(node, value);
             value = value.replace(/([\/;:\)\]\}])/g, "$1\u200B");
-            html += linkify(rewrittenHref, value, "webkit-html-attribute-value", node.nodeName.toLowerCase() === "a");
+            html += linkify(rewrittenHref, value, "webkit-html-attribute-value", node.nodeName().toLowerCase() === "a");
         } else {
             value = value.escapeHTML().replace(/([\/;:\)\]\}])/g, "$1&#8203;");
             html += "<span class=\"webkit-html-attribute-value\">" + value + "</span>";
@@ -1269,8 +1278,9 @@ WebInspector.ElementsTreeElement.prototype = {
         var result = "<span class=\"webkit-html-tag" + (isClosingTag && isDistinctTreeElement ? " close" : "")  + "\">&lt;";
         result += "<span " + (isClosingTag ? "" : "class=\"webkit-html-tag-name\"") + ">" + (isClosingTag ? "/" : "") + tagName + "</span>";
         if (!isClosingTag && node.hasAttributes()) {
-            for (var i = 0; i < node.attributes.length; ++i) {
-                var attr = node.attributes[i];
+            var attributes = node.attributes();
+            for (var i = 0; i < attributes.length; ++i) {
+                var attr = attributes[i];
                 result += " " + this._attributeHTML(attr.name, attr.value, node, linkify);
             }
         }
@@ -1284,7 +1294,7 @@ WebInspector.ElementsTreeElement.prototype = {
         var node = this.representedObject;
         var info = {titleHTML: "", hasChildren: this.hasChildren};
 
-        switch (node.nodeType) {
+        switch (node.nodeType()) {
             case Node.DOCUMENT_NODE:
                 info.titleHTML = "Document";
                 break;
@@ -1299,7 +1309,7 @@ WebInspector.ElementsTreeElement.prototype = {
                 break;
 
             case Node.ELEMENT_NODE:
-                var tagName = this.treeOutline.nodeNameToCorrectCase(node.nodeName).escapeHTML();
+                var tagName = this.treeOutline.nodeNameToCorrectCase(node.nodeName()).escapeHTML();
                 if (this._elementCloseTag) {
                     info.titleHTML = this._tagHTML(tagName, true, true);
                     info.hasChildren = false;
@@ -1308,8 +1318,8 @@ WebInspector.ElementsTreeElement.prototype = {
 
                 var titleHTML = this._tagHTML(tagName, false, false, linkify);
 
-                var textChild = onlyTextChild.call(node);
-                var showInlineText = textChild && textChild.textContent.length < Preferences.maxInlineTextChildLength;
+                var textChild = this._singleTextChild(node);
+                var showInlineText = textChild && textChild.nodeValue().length < Preferences.maxInlineTextChildLength;
 
                 if (!this.expanded && (!showInlineText && (this.treeOutline.isXMLMimeType || !WebInspector.ElementsTreeElement.ForbiddenClosingTagElements[tagName]))) {
                     if (this.hasChildren)
@@ -1321,7 +1331,7 @@ WebInspector.ElementsTreeElement.prototype = {
                 // just show that text and the closing tag inline rather than
                 // create a subtree for them
                 if (showInlineText) {
-                    titleHTML += "<span class=\"webkit-html-text-node\">" + textChild.nodeValue.escapeHTML() + "</span>&#8203;" + this._tagHTML(tagName, true, false);
+                    titleHTML += "<span class=\"webkit-html-text-node\">" + textChild.nodeValue().escapeHTML() + "</span>&#8203;" + this._tagHTML(tagName, true, false);
                     info.hasChildren = false;
                 }
                 info.titleHTML = titleHTML;
@@ -1331,33 +1341,33 @@ WebInspector.ElementsTreeElement.prototype = {
                 if (isNodeWhitespace.call(node))
                     info.titleHTML = "(whitespace)";
                 else {
-                    if (node.parentNode && node.parentNode.nodeName.toLowerCase() === "script") {
+                    if (node.parentNode && node.parentNode.nodeName().toLowerCase() === "script") {
                         var newNode = document.createElement("span");
-                        newNode.textContent = node.textContent;
+                        newNode.textContent = node.nodeValue();
 
                         var javascriptSyntaxHighlighter = new WebInspector.DOMSyntaxHighlighter("text/javascript");
                         javascriptSyntaxHighlighter.syntaxHighlightNode(newNode);
 
                         info.titleHTML = "<span class=\"webkit-html-text-node webkit-html-js-node\">" + newNode.innerHTML.replace(/^[\n\r]*/, "").replace(/\s*$/, "") + "</span>";
-                    } else if (node.parentNode && node.parentNode.nodeName.toLowerCase() === "style") {
+                    } else if (node.parentNode && node.parentNode.nodeName().toLowerCase() === "style") {
                         var newNode = document.createElement("span");
-                        newNode.textContent = node.textContent;
+                        newNode.textContent = node.nodeValue();
 
                         var cssSyntaxHighlighter = new WebInspector.DOMSyntaxHighlighter("text/css");
                         cssSyntaxHighlighter.syntaxHighlightNode(newNode);
 
                         info.titleHTML = "<span class=\"webkit-html-text-node webkit-html-css-node\">" + newNode.innerHTML.replace(/^[\n\r]*/, "").replace(/\s*$/, "") + "</span>";
                     } else
-                        info.titleHTML = "\"<span class=\"webkit-html-text-node\">" + node.nodeValue.escapeHTML() + "</span>\"";
+                        info.titleHTML = "\"<span class=\"webkit-html-text-node\">" + node.nodeValue().escapeHTML() + "</span>\"";
                 }
                 break;
 
             case Node.COMMENT_NODE:
-                info.titleHTML = "<span class=\"webkit-html-comment\">&lt;!--" + node.nodeValue.escapeHTML() + "--&gt;</span>";
+                info.titleHTML = "<span class=\"webkit-html-comment\">&lt;!--" + node.nodeValue().escapeHTML() + "--&gt;</span>";
                 break;
 
             case Node.DOCUMENT_TYPE_NODE:
-                var titleHTML = "<span class=\"webkit-html-doctype\">&lt;!DOCTYPE " + node.nodeName;
+                var titleHTML = "<span class=\"webkit-html-doctype\">&lt;!DOCTYPE " + node.nodeName();
                 if (node.publicId) {
                     titleHTML += " PUBLIC \"" + node.publicId + "\"";
                     if (node.systemId)
@@ -1371,20 +1381,33 @@ WebInspector.ElementsTreeElement.prototype = {
                 break;
 
             case Node.CDATA_SECTION_NODE:
-                info.titleHTML = "<span class=\"webkit-html-text-node\">&lt;![CDATA[" + node.nodeValue.escapeHTML() + "]]&gt;</span>";
+                info.titleHTML = "<span class=\"webkit-html-text-node\">&lt;![CDATA[" + node.nodeValue().escapeHTML() + "]]&gt;</span>";
                 break;
             default:
-                info.titleHTML = this.treeOutline.nodeNameToCorrectCase(node.nodeName).collapseWhitespace().escapeHTML();
+                info.titleHTML = this.treeOutline.nodeNameToCorrectCase(node.nodeName()).collapseWhitespace().escapeHTML();
         }
 
         return info;
     },
 
+    _singleTextChild: function(node)
+    {
+        if (!node)
+            return null;
+
+        var firstChild = node.firstChild;
+        if (!firstChild || firstChild.nodeType() !== Node.TEXT_NODE)
+            return null;
+
+        var sibling = firstChild.nextSibling;
+        return sibling ? null : firstChild;
+    },
+
     _showInlineText: function(node)
     {
-        if (node.nodeType === Node.ELEMENT_NODE) {
-            var textChild = onlyTextChild.call(node);
-            if (textChild && textChild.textContent.length < Preferences.maxInlineTextChildLength)
+        if (node.nodeType() === Node.ELEMENT_NODE) {
+            var textChild = this._singleTextChild(node);
+            if (textChild && textChild.nodeValue().length < Preferences.maxInlineTextChildLength)
                 return true;
         }
         return false;
@@ -1397,18 +1420,16 @@ WebInspector.ElementsTreeElement.prototype = {
             return;
 
         var self = this;
-        function removeNodeCallback(removedNodeId)
+        function removeNodeCallback(error, removedNodeId)
         {
-            // -1 is an error code, which means removing the node from the DOM failed,
-            // so we shouldn't remove it from the tree.
-            if (removedNodeId === -1)
+            if (error)
                 return;
 
             parentElement.removeChild(self);
             parentElement.adjustCollapsedRange(true);
         }
 
-        DOMAgent.removeNode(this.representedObject.id, removeNodeCallback);
+        this.representedObject.removeNode(removeNodeCallback);
     },
 
     _editAsHTML: function()
@@ -1417,9 +1438,9 @@ WebInspector.ElementsTreeElement.prototype = {
         var node = this.representedObject;
         var wasExpanded = this.expanded;
 
-        function selectNode(nodeId)
+        function selectNode(error, nodeId)
         {
-            if (!nodeId)
+            if (error || !nodeId)
                 return;
 
             // Select it and expand if necessary. We force tree update so that it processes dom events and is up to date.
@@ -1435,15 +1456,15 @@ WebInspector.ElementsTreeElement.prototype = {
 
         function commitChange(value)
         {
-            DOMAgent.setOuterHTML(node.id, value, selectNode);
+            node.setOuterHTML(value, selectNode);
         }
 
-        DOMAgent.getOuterHTML(node.id, this._startEditingAsHTML.bind(this, commitChange));
+        node.getOuterHTML(this._startEditingAsHTML.bind(this, commitChange));
     },
 
     _copyHTML: function()
     {
-        DOMAgent.copyNode(this.representedObject.id);
+        this.representedObject.copyNode();
     },
 
     _highlightSearchResults: function()
@@ -1468,6 +1489,11 @@ WebInspector.ElementsTreeElement.prototype = {
             matchRanges.push({ offset: match.index, length: match[0].length });
             match = regexObject.exec(text);
         }
+
+        // Fall back for XPath, etc. matches.
+        if (!matchRanges.length)
+            matchRanges.push({ offset: 0, length: text.length });
+
         highlightSearchResults(this.listItemElement, matchRanges);
         this._searchHighlightedHTML = this.listItemElement.innerHTML;
     }
diff --git a/Source/WebCore/inspector/front-end/EventListenersSidebarPane.js b/Source/WebCore/inspector/front-end/EventListenersSidebarPane.js
index bc8bb12..00576f1 100644
--- a/Source/WebCore/inspector/front-end/EventListenersSidebarPane.js
+++ b/Source/WebCore/inspector/front-end/EventListenersSidebarPane.js
@@ -65,7 +65,10 @@ WebInspector.EventListenersSidebarPane.prototype = {
         this.sections = [];
 
         var self = this;
-        function callback(nodeId, eventListeners) {
+        function callback(error, eventListeners) {
+            if (error)
+                return;
+
             var sectionNames = [];
             var sectionMap = {};
             for (var i = 0; i < eventListeners.length; ++i) {
@@ -77,7 +80,7 @@ WebInspector.EventListenersSidebarPane.prototype = {
                 var type = eventListener.type;
                 var section = sectionMap[type];
                 if (!section) {
-                    section = new WebInspector.EventListenersSection(type, nodeId);
+                    section = new WebInspector.EventListenersSection(type, node.id);
                     sectionMap[type] = section;
                     sectionNames.push(type);
                     self.sections.push(section);
@@ -101,7 +104,8 @@ WebInspector.EventListenersSidebarPane.prototype = {
             }
         }
 
-        WebInspector.EventListeners.getEventListenersForNodeAsync(node, callback);
+        if (node)
+            node.eventListeners(callback);
     },
 
     _changeSetting: function(event)
@@ -190,6 +194,8 @@ WebInspector.EventListenerBar.prototype = {
                 properties.push(new WebInspector.RemoteObjectProperty(propertyName, value));
             }
             this.updateProperties(properties);
+            if (nodeObject)
+                nodeObject.release();
         }
         var node = this.eventListener.node;
         delete this.eventListener.node;
@@ -202,7 +208,7 @@ WebInspector.EventListenerBar.prototype = {
         if (!node)
             return;
 
-        if (node.nodeType === Node.DOCUMENT_NODE) {
+        if (node.nodeType() === Node.DOCUMENT_NODE) {
             this.titleElement.textContent = "document";
             return;
         }
diff --git a/Source/WebCore/inspector/front-end/ExtensionAPI.js b/Source/WebCore/inspector/front-end/ExtensionAPI.js
index 6a11d62..ea7324c 100644
--- a/Source/WebCore/inspector/front-end/ExtensionAPI.js
+++ b/Source/WebCore/inspector/front-end/ExtensionAPI.js
@@ -516,5 +516,7 @@ var WatchExpressionSidebarPane = declareInterfaceClass(WatchExpressionSidebarPan
 var extensionServer = new ExtensionServerClient();
 
 webInspector = new InspectorExtensionAPI();
+experimental = window.experimental || {};
+experimental.webInspector = webInspector;
 
 }
diff --git a/Source/WebCore/inspector/front-end/ExtensionAPISchema.json b/Source/WebCore/inspector/front-end/ExtensionAPISchema.json
index 28084ba..0aa7aa8 100755
--- a/Source/WebCore/inspector/front-end/ExtensionAPISchema.json
+++ b/Source/WebCore/inspector/front-end/ExtensionAPISchema.json
@@ -1,57 +1,5 @@
 [
   {
-    "namespace": "experimental.webInspector.inspectedWindow",
-    "description": "Provides access to the window being inspected.",
-    "functions": [
-      {
-        "name": "eval",
-        "type": "function",
-        "description": "Evaluates a JavaScript expression in the context of inspected page (NOTE: the expression must evaluate to a JSON-compliant object, otherwise the exception is thrown)",
-        "parameters": [
-          {
-            "name": "expression",
-            "type": "string",
-            "description": "An expression to evaluate."
-          },
-          {
-            "name": "callback",
-            "type": "function",
-            "description": "A function called when evaluation completes.",
-            "parameters": [
-              {
-                "name": "result",
-                "type": "object",
-                "description": "The result of evaluation"
-              },
-              {
-                "name": "isException",
-                "type": "boolean",
-                "description": "Set if an exception was caught while evaluating the expression"
-              }
-            ]
-          }
-        ]
-      }
-    ],
-    "events": [
-      {
-        "name": "onDOMContentLoaded",
-        "type": "function",
-        "description": "Fired after DOMContentLoaded event on inspected page is fired."
-      },
-      {
-        "name": "onLoaded",
-        "type": "function",
-        "description": "Fired after load event on inspected page is fired."
-      },
-      {
-        "name": "onNavigated",
-        "type": "function",
-        "description": "Fired when navigation occurs in the window being inspected."
-      }
-    ]
-  },
-  {
     "namespace": "experimental.webInspector.panels",
     "types": [
       {
@@ -150,7 +98,7 @@
               }
             ]
           }
-       	]
+        ]
       },
       {
         "id": "ExtensionSidebarPane",
diff --git a/Source/WebCore/inspector/front-end/ExtensionPanel.js b/Source/WebCore/inspector/front-end/ExtensionPanel.js
index 142b8c1..4249b2c 100644
--- a/Source/WebCore/inspector/front-end/ExtensionPanel.js
+++ b/Source/WebCore/inspector/front-end/ExtensionPanel.js
@@ -98,9 +98,10 @@ WebInspector.ExtensionWatchSidebarPane.prototype = {
         RuntimeAgent.evaluate(expression, "extension-watch", false, this._onEvaluate.bind(this, title));
     },
 
-    _onEvaluate: function(title, result)
+    _onEvaluate: function(title, error, result)
     {
-        this._setObject(WebInspector.RemoteObject.fromPayload(result), title);
+        if (!error)
+            this._setObject(WebInspector.RemoteObject.fromPayload(result), title);
     },
 
     _setObject: function(object, title)
diff --git a/Source/WebCore/inspector/front-end/ExtensionServer.js b/Source/WebCore/inspector/front-end/ExtensionServer.js
index f9af7dc..9554dfa 100644
--- a/Source/WebCore/inspector/front-end/ExtensionServer.js
+++ b/Source/WebCore/inspector/front-end/ExtensionServer.js
@@ -118,7 +118,13 @@ WebInspector.ExtensionServer.prototype = {
     _notifyResourceFinished: function(event)
     {
         var resource = event.data;
-        this._postNotification("resource-finished", this._resourceId(resource), (new WebInspector.HAREntry(resource)).build());
+        if (this._hasSubscribers("resource-finished"))
+            this._postNotification("resource-finished", this._resourceId(resource), (new WebInspector.HAREntry(resource)).build());
+    },
+
+    _hasSubscribers: function(type)
+    {
+        return !!this._subscribers[type];
     },
 
     _postNotification: function(type, details)
@@ -261,16 +267,18 @@ WebInspector.ExtensionServer.prototype = {
     _onReload: function(message)
     {
         if (typeof message.userAgent === "string")
-            InspectorAgent.setUserAgentOverride(message.userAgent);
+            PageAgent.setUserAgentOverride(message.userAgent);
 
-        InspectorAgent.reloadPage(false);
+        PageAgent.reloadPage(false);
         return this._status.OK();
     },
 
     _onEvaluateOnInspectedPage: function(message, port)
     {
-        function callback(resultPayload)
+        function callback(error, resultPayload)
         {
+            if (error)
+                return;
             var resultObject = WebInspector.RemoteObject.fromPayload(resultPayload);
             var result = {};
             if (resultObject.isError())
diff --git a/Source/WebCore/inspector/front-end/GoToLineDialog.js b/Source/WebCore/inspector/front-end/GoToLineDialog.js
index f246159..9f4504d 100644
--- a/Source/WebCore/inspector/front-end/GoToLineDialog.js
+++ b/Source/WebCore/inspector/front-end/GoToLineDialog.js
@@ -40,7 +40,7 @@ WebInspector.GoToLineDialog = function(view)
 
     var dialogWindow = this._element;
 
-    dialogWindow.createChild("label").innerText = WebInspector.UIString("Go to line: ");
+    dialogWindow.createChild("label").textContent = WebInspector.UIString("Go to line: ");
 
     this._input = dialogWindow.createChild("input");
     this._input.setAttribute("type", "text");
@@ -53,7 +53,7 @@ WebInspector.GoToLineDialog = function(view)
     
 
     var go = dialogWindow.createChild("button");
-    go.innerText = WebInspector.UIString("Go");
+    go.textContent = WebInspector.UIString("Go");
     go.addEventListener("click", this._onClick.bind(this), false);
     go.addEventListener("mousedown", function(e) {
         // Ok button click will close the dialog, removing onBlur listener
diff --git a/Source/WebCore/inspector/front-end/HeapSnapshot.js b/Source/WebCore/inspector/front-end/HeapSnapshot.js
index 215f31c..c9d1e30 100644
--- a/Source/WebCore/inspector/front-end/HeapSnapshot.js
+++ b/Source/WebCore/inspector/front-end/HeapSnapshot.js
@@ -197,6 +197,134 @@ WebInspector.HeapSnapshotEdgeIterator.prototype = {
     }
 };
 
+WebInspector.HeapSnapshotRetainerEdge = function(snapshot, retainers, retainerIndex)
+{
+    this._snapshot = snapshot;
+    this._retainers = retainers;
+    this.retainerIndex = retainerIndex || 0;
+}
+
+WebInspector.HeapSnapshotRetainerEdge.prototype = {
+    clone: function()
+    {
+        return new WebInspector.HeapSnapshotRetainerEdge(this._snapshot, this._retainers, this.retainerIndex);
+    },
+
+    get hasStringName()
+    {
+        return this._edge.hasStringName;
+    },
+
+    get isElement()
+    {
+        return this._edge.isElement;
+    },
+
+    get isHidden()
+    {
+        return this._edge.isHidden;
+    },
+
+    get isInternal()
+    {
+        return this._edge.isInternal;
+    },
+
+    get isInvisible()
+    {
+        return this._edge.isInvisible;
+    },
+
+    get isShortcut()
+    {
+        return this._edge.isShortcut;
+    },
+
+    get name()
+    {
+        return this._edge.name;
+    },
+
+    get node()
+    {
+        return this._node;
+    },
+
+    get nodeIndex()
+    {
+        return this._nodeIndex;
+    },
+
+    get retainerIndex()
+    {
+        return this._retainerIndex;
+    },
+
+    set retainerIndex(newIndex)
+    {
+        if (newIndex !== this._retainerIndex) {
+            this._retainerIndex = newIndex;
+            this._setupEdge();
+        }
+    },
+
+    _setupEdge: function()
+    {
+        var globalEdgeIndex = this._retainers.item(this._retainerIndex);
+        this._nodeIndex = this._snapshot._findNearestNodeIndex(globalEdgeIndex);
+        this._node = new WebInspector.HeapSnapshotNode(this._snapshot, this._nodeIndex);
+        var edgeIndex = globalEdgeIndex - this._nodeIndex - this._snapshot._firstEdgeOffset;
+        this._edge = new WebInspector.HeapSnapshotEdge(this._snapshot, this._node.rawEdges, edgeIndex);
+    },
+
+    toString: function()
+    {
+        return this._edge.toString();
+    },
+
+    get type()
+    {
+        return this._edge.type;
+    }
+}
+
+WebInspector.HeapSnapshotRetainerEdgeIterator = function(retainer)
+{
+    this.retainer = retainer;
+}
+
+WebInspector.HeapSnapshotRetainerEdgeIterator.prototype = {
+    first: function()
+    {
+        this.retainer.retainerIndex = 0;
+    },
+
+    hasNext: function()
+    {
+        return this.retainer.retainerIndex < this.retainer._retainers.length;
+    },
+
+    get index()
+    {
+        return this.retainer.retainerIndex;
+    },
+
+    set index(newIndex)
+    {
+        this.retainer.retainerIndex = newIndex;
+    },
+
+    get item()
+    {
+        return this.retainer;
+    },
+
+    next: function()
+    {
+        ++this.retainer.retainerIndex;
+    }
+};
+
 WebInspector.HeapSnapshotNode = function(snapshot, nodeIndex)
 {
     this._snapshot = snapshot;
@@ -212,6 +340,10 @@ WebInspector.HeapSnapshotNode.prototype = {
             return WebInspector.UIString("(system)");
         case "object":
             return this.name;
+        case "native": {
+            var entitiesCountPos = this.name.indexOf("/");
+            return entitiesCountPos !== -1 ? this.name.substring(0, entitiesCountPos).trimRight() : this.name;
+        }
         case "code":
             return WebInspector.UIString("(compiled code)");
         default:
@@ -219,7 +351,7 @@ WebInspector.HeapSnapshotNode.prototype = {
         }
     },
 
-    dominatorIndex: function()
+    get dominatorIndex()
     {
         return this._nodes[this.nodeIndex + this._snapshot._dominatorOffset];
     },
@@ -272,7 +404,7 @@ WebInspector.HeapSnapshotNode.prototype = {
 
     get retainers()
     {
-        return new WebInspector.HeapSnapshotEdgeIterator(new WebInspector.HeapSnapshotEdge(this._snapshot, this._snapshot.retainers(this)));
+        return new WebInspector.HeapSnapshotRetainerEdgeIterator(new WebInspector.HeapSnapshotRetainerEdge(this._snapshot, this._snapshot._retainersForNode(this)));
     },
 
     get selfSize()
@@ -350,6 +482,7 @@ WebInspector.HeapSnapshotNodeIterator.prototype = {
 
 WebInspector.HeapSnapshot = function(profile)
 {
+    this.uid = profile.uid;
     this._nodes = profile.nodes;
     this._strings = profile.strings;
 
@@ -393,32 +526,30 @@ WebInspector.HeapSnapshot.prototype = {
     {
         delete this._nodes;
         delete this._strings;
-        if (this._idsMap)
-            delete this._idsMap;
-        if (this._retainers) {
-            delete this._retainers;
-            delete this._nodesToRetainers;
-        }
+        delete this._idsList;
+        delete this._retainers;
+        delete this._retainerIndex;
+        delete this._nodeIndex;
         if (this._aggregates) {
             delete this._aggregates;
             this._aggregatesWithIndexes = false;
         }
     },
 
-    get allNodes()
+    get _allNodes()
     {
         return new WebInspector.HeapSnapshotNodeIterator(this.rootNode);
     },
 
-    get nodesCount()
+    get nodeCount()
     {
-        if (this._nodesCount)
-            return this._nodesCount;
+        if (this._nodeCount)
+            return this._nodeCount;
 
-        this._nodesCount = 0;
-        for (var iter = this.allNodes; iter.hasNext(); iter.next())
-            ++this._nodesCount;
-        return this._nodesCount;
+        this._nodeCount = 0;
+        for (var iter = this._allNodes; iter.hasNext(); iter.next())
+            ++this._nodeCount;
+        return this._nodeCount;
     },
 
     restore: function(profile)
@@ -432,30 +563,35 @@ WebInspector.HeapSnapshot.prototype = {
         return new WebInspector.HeapSnapshotNode(this, this._rootNodeIndex);
     },
 
+    get rootNodeIndex()
+    {
+        return this._rootNodeIndex;
+    },
+
     get totalSize()
     {
         return this.rootNode.retainedSize;
     },
 
-    get idsMap()
+    hasId: function(id)
     {
-        if (this._idsMap)
-            return this._idsMap;
+        return this.nodeIds.binaryIndexOf(id, this._numbersComparator) >= 0;
+    },
 
-        this._idsMap = [];
-        for (var iter = this.allNodes; iter.hasNext(); iter.next()) {
-            this._idsMap[iter.node.id] = true;
-        }
-        return this._idsMap;
+    get nodeIds()
+    {
+        if (!this._idsList)
+            this._buildIdsList();
+        return this._idsList;
     },
 
-    retainers: function(node)
+    _retainersForNode: function(node)
     {
         if (!this._retainers)
             this._buildRetainers();
 
-        var retIndexFrom = this._nodesToRetainers[node.nodeIndex];
-        var retIndexTo = this._nodesToRetainers[node._nextNodeIndex];
+        var retIndexFrom = this._getRetainerIndex(node.nodeIndex);
+        var retIndexTo = this._getRetainerIndex(node._nextNodeIndex);
         return new WebInspector.HeapSnapshotArraySlice(this, "_retainers", retIndexFrom, retIndexTo);
     },
 
@@ -470,51 +606,39 @@ WebInspector.HeapSnapshot.prototype = {
 
     _buildRetainers: function()
     {
-        this._nodesToRetainers = [];
-        for (var nodesIter = this.allNodes; nodesIter.hasNext(); nodesIter.next()) {
+        if (!this._nodeIndex)
+            this._buildNodeIndex();
+
+        this._retainerIndex = new Array(this._nodeIndex.length);
+        for (var i = 0, l = this._retainerIndex.length; i < l; ++i)
+            this._retainerIndex[i] = 0;
+        for (var nodesIter = this._allNodes; nodesIter.hasNext(); nodesIter.next()) {
             var node = nodesIter.node;
-            if (!(node.nodeIndex in this._nodesToRetainers))
-                this._nodesToRetainers[node.nodeIndex] = 0;
             for (var edgesIter = node.edges; edgesIter.hasNext(); edgesIter.next()) {
                 var edge = edgesIter.edge;
                 var nodeIndex = edge.nodeIndex;
-                if (!(nodeIndex in this._nodesToRetainers))
-                    this._nodesToRetainers[nodeIndex] = 0;
-                this._nodesToRetainers[nodeIndex] += this._edgeFieldsCount;
+                var position = this._findNodePositionInIndex(nodeIndex);
+                ++this._retainerIndex[position];
             }
         }
-        nodesIter = this.allNodes;
-        var node = nodesIter.node;
-        var prevIndex = this._nodesToRetainers[node.nodeIndex] = 0;
-        var prevRetsCount = this._nodesToRetainers[node.nodeIndex];
-        nodesIter.next();
-        for (; nodesIter.hasNext(); nodesIter.next()) {
-            node = nodesIter.node;
-            var savedRefsCount = this._nodesToRetainers[node.nodeIndex];
-            this._nodesToRetainers[node.nodeIndex] = prevIndex + prevRetsCount;
-            prevIndex = this._nodesToRetainers[node.nodeIndex];
-            prevRetsCount = savedRefsCount;
-        }
-        this._retainers = new Array(prevIndex + prevRetsCount);
-        this._nodesToRetainers[this._nodes.length] = this._retainers.length;
-        for (nodesIter = this.allNodes; nodesIter.hasNext(); nodesIter.next()) {
-            node = nodesIter.node;
-            var retsCount = this._nodesToRetainers[node._nextNodeIndex] - this._nodesToRetainers[node.nodeIndex];
-            if (retsCount > 0) {
-                this._retainers[this._nodesToRetainers[node.nodeIndex]] = retsCount;
-            }
+        var retainerCount = 0;
+        for (i = 0, l = this._retainerIndex.length; i < l; ++i)
+            retainerCount += this._retainerIndex[i];
+        this._retainers = new Array(retainerCount + 1);
+        var retainerPosition = 0;
+        for (i = 0, l = this._retainerIndex.length; i < l; ++i) {
+            retainerCount = this._retainers[retainerPosition] = this._retainerIndex[i];
+            this._retainerIndex[i] = retainerPosition;
+            retainerPosition += retainerCount;
         }
-        for (nodesIter = this.allNodes; nodesIter.hasNext(); nodesIter.next()) {
-            node = nodesIter.node;
+        for (nodesIter = this._allNodes; nodesIter.hasNext(); nodesIter.next()) {
+            var node = nodesIter.node;
             for (var edgesIter = node.edges; edgesIter.hasNext(); edgesIter.next()) {
                 var edge = edgesIter.edge;
                 var nodeIndex = edge.nodeIndex;
-                var retIndex = this._nodesToRetainers[nodeIndex];
-                this._retainers[retIndex] -= this._edgeFieldsCount;
-                var idx = retIndex + this._retainers[retIndex];
-                this._retainers[idx + this._edgeTypeOffset] = edge._type();
-                this._retainers[idx + this._edgeNameOffset] = edge._nameOrIndex;
-                this._retainers[idx + this._edgeToNodeOffset] = node.nodeIndex;
+                var retIndex = this._getRetainerIndex(nodeIndex);
+                var idx = retIndex + (--this._retainers[retIndex]);
+                this._retainers[idx] = node.nodeIndex + this._firstEdgeOffset + edge.edgeIndex;
             }
         }
     },
@@ -522,11 +646,11 @@ WebInspector.HeapSnapshot.prototype = {
     _buildAggregates: function()
     {
         this._aggregates = {};
-        for (var iter = this.allNodes; iter.hasNext(); iter.next()) {
+        for (var iter = this._allNodes; iter.hasNext(); iter.next()) {
             var node = iter.node;
             var className = node.className;
-            var nameMatters = node.type === "object";
-            if (node.selfSize === 0)
+            var nameMatters = node.type === "object" || node.type === "native";
+            if (node.type !== "native" && node.selfSize === 0)
                 continue;
             if (!(className in this._aggregates))
                 this._aggregates[className] = { count: 0, self: 0, maxRet: 0, type: node.type, name: nameMatters ? node.name : null, idxs: [] };
@@ -540,7 +664,7 @@ WebInspector.HeapSnapshot.prototype = {
 
     _buildAggregatesIndexes: function()
     {
-        for (var iter = this.allNodes; iter.hasNext(); iter.next()) {
+        for (var iter = this._allNodes; iter.hasNext(); iter.next()) {
             var node = iter.node;
             var className = node.className;
             var clss = this._aggregates[className];
@@ -561,6 +685,53 @@ WebInspector.HeapSnapshot.prototype = {
         this._aggregatesWithIndexes = true;
     },
 
+    _buildIdsList: function()
+    {
+        var count = 0;
+        for (var nodesIter = this._allNodes; nodesIter.hasNext(); nodesIter.next(), ++count);
+        this._idsList = new Array(count);
+        count = 0;
+        for (nodesIter = this._allNodes; nodesIter.hasNext(); nodesIter.next(), ++count)
+            this._idsList[count] = nodesIter.node.id;
+        this._idsList.sort(this._numbersComparator);
+    },
+
+    _buildNodeIndex: function()
+    {
+        var count = 0;
+        for (var nodesIter = this._allNodes; nodesIter.hasNext(); nodesIter.next(), ++count);
+        this._nodeIndex = new Array(count + 1);
+        count = 0;
+        for (nodesIter = this._allNodes; nodesIter.hasNext(); nodesIter.next(), ++count)
+            this._nodeIndex[count] = nodesIter.index;
+        this._nodeIndex[count] = this._nodes.length;
+    },
+
+    _findNodePositionInIndex: function(index)
+    {
+        return binarySearch(index, this._nodeIndex, this._numbersComparator);
+    },
+
+    _findNearestNodeIndex: function(index)
+    {
+        var result = this._findNodePositionInIndex(index);
+        if (result < 0) {
+            result = -result - 1;
+            nodeIndex = this._nodeIndex[result];
+            // Binary search can return either maximum lower value, or minimum higher value.
+            if (nodeIndex > index)
+                nodeIndex = this._nodeIndex[result - 1];
+        } else
+            var nodeIndex = this._nodeIndex[result];
+        return nodeIndex;
+    },
+
+    _getRetainerIndex: function(nodeIndex)
+    {
+        var nodePosition = this._findNodePositionInIndex(nodeIndex);
+        return this._retainerIndex[nodePosition];
+    },
+  
     _markInvisibleEdges: function()
     {
         // Mark hidden edges of global objects as invisible.
@@ -586,6 +757,11 @@ WebInspector.HeapSnapshot.prototype = {
                     this._nodes[globalObjEdge._edges._start + globalObjEdge.edgeIndex + this._edgeTypeOffset] = this._edgeInvisibleType;
             }
         }
+    },
+
+    _numbersComparator: function(a, b)
+    {
+        return a < b ? -1 : (a > b ? 1 : 0);
     }
 };
 
@@ -596,7 +772,6 @@ WebInspector.HeapSnapshotFilteredOrderedIterator = function(iterator, filter)
     this._iterationOrder = null;
     this._position = 0;
     this._lastComparator = null;
-    this._instancesCount = 0;
 }
 
 WebInspector.HeapSnapshotFilteredOrderedIterator.prototype = {
@@ -625,16 +800,6 @@ WebInspector.HeapSnapshotFilteredOrderedIterator.prototype = {
         return this._position < this._iterationOrder.length;
     },
 
-    incInstancesCount: function()
-    {
-        ++this._instancesCount;
-    },
-
-    get instancesCount()
-    {
-        return this._instancesCount;
-    },
-
     get isEmpty()
     {
         if (this._iterationOrder)
@@ -655,11 +820,6 @@ WebInspector.HeapSnapshotFilteredOrderedIterator.prototype = {
         return this._iterator.item;
     },
 
-    get lastComparator()
-    {
-        return this._lastComparator;
-    },
-
     get length()
     {
         if (!this._iterationOrder)
@@ -671,11 +831,6 @@ WebInspector.HeapSnapshotFilteredOrderedIterator.prototype = {
     {
         ++this._position;
     },
-
-    resetInstancesCount: function()
-    {
-        this._instancesCount = 0;
-    }
 }
 
 WebInspector.HeapSnapshotFilteredOrderedIterator.prototype.createComparator = function(fieldNames)
@@ -683,10 +838,11 @@ WebInspector.HeapSnapshotFilteredOrderedIterator.prototype.createComparator = fu
     return {fieldName1:fieldNames[0], ascending1:fieldNames[1], fieldName2:fieldNames[2], ascending2:fieldNames[3]};
 }
 
-WebInspector.HeapSnapshotEdgesProvider = function(snapshot, rawEdges, filter)
+WebInspector.HeapSnapshotEdgesProvider = function(snapshot, nodeIndex, filter)
 {
     this.snapshot = snapshot;
-    WebInspector.HeapSnapshotFilteredOrderedIterator.call(this, new WebInspector.HeapSnapshotEdgeIterator(new WebInspector.HeapSnapshotEdge(snapshot, rawEdges)), filter);
+    var node = new WebInspector.HeapSnapshotNode(snapshot, nodeIndex);
+    WebInspector.HeapSnapshotFilteredOrderedIterator.call(this, new WebInspector.HeapSnapshotEdgeIterator(new WebInspector.HeapSnapshotEdge(snapshot, node.rawEdges)), filter);
 }
 
 WebInspector.HeapSnapshotEdgesProvider.prototype = {
@@ -766,10 +922,10 @@ WebInspector.HeapSnapshotEdgesProvider.prototype = {
 
 WebInspector.HeapSnapshotEdgesProvider.prototype.__proto__ = WebInspector.HeapSnapshotFilteredOrderedIterator.prototype;
 
-WebInspector.HeapSnapshotNodesProvider = function(snapshot, nodes, filter)
+WebInspector.HeapSnapshotNodesProvider = function(snapshot, filter)
 {
     this.snapshot = snapshot;
-    WebInspector.HeapSnapshotFilteredOrderedIterator.call(this, nodes, filter);
+    WebInspector.HeapSnapshotFilteredOrderedIterator.call(this, snapshot._allNodes, filter);
 }
 
 WebInspector.HeapSnapshotNodesProvider.prototype = {
@@ -842,11 +998,18 @@ WebInspector.HeapSnapshotPathFinder.prototype = {
         return false;
     },
 
-    _fillRootChildren: function()
+    updateRoots: function(filter)
+    {
+        this._rootChildren = this._fillRootChildren(filter);  
+    },
+
+    _fillRootChildren: function(filter)
     {
         var result = [];
-        for (var iter = this._snapshot.rootNode.edges; iter.hasNext(); iter.next())
-            result[iter.edge.nodeIndex] = true;
+        for (var iter = this._snapshot.rootNode.edges; iter.hasNext(); iter.next()) {
+            if (!filter || filter(iter.edge.node))
+                result[iter.edge.nodeIndex] = true;
+        }
         return result;
     },
 
@@ -881,7 +1044,7 @@ WebInspector.HeapSnapshotPathFinder.prototype = {
 
     get _lastEdge()
     {
-        return this._lastEdgeIter.edge;
+        return this._lastEdgeIter.item;
     },
 
     _skipEdge: function(edge)
@@ -894,7 +1057,7 @@ WebInspector.HeapSnapshotPathFinder.prototype = {
     _nextEdgeIter: function()
     {
         var iter = this._lastEdgeIter;
-        while (this._skipEdge(iter.edge) && iter.hasNext())
+        while (this._skipEdge(iter.item) && iter.hasNext())
             iter.next();
         return iter;
     },
@@ -917,7 +1080,7 @@ WebInspector.HeapSnapshotPathFinder.prototype = {
                             while (this._currentPath.length < this._maxLength) {
                                 iter = this._nextEdgeIter();
                                 if (iter.hasNext())
-                                    this._appendToCurrentPath(iter.edge.node.retainers);
+                                    this._appendToCurrentPath(iter.item.node.retainers);
                                 else
                                     return true;
                             }
@@ -934,7 +1097,7 @@ WebInspector.HeapSnapshotPathFinder.prototype = {
             while (this._currentPath.length < this._maxLength) {
                 var iter = this._nextEdgeIter();
                 if (iter.hasNext())
-                    this._appendToCurrentPath(iter.edge.node.retainers);
+                    this._appendToCurrentPath(iter.item.node.retainers);
                 else
                     break;
             }
@@ -956,8 +1119,8 @@ WebInspector.HeapSnapshotPathFinder.prototype = {
             return "";
         var sPath = [];
         for (var j = 0; j < path.length; ++j)
-            sPath.push(path[j].edge.toString());
-        sPath.push(this._nodeToString(path[path.length - 1].edge.node));
+            sPath.push(path[j].item.toString());
+        sPath.push(this._nodeToString(path[path.length - 1].item.node));
         sPath.reverse();
         return sPath.join("");
     }
diff --git a/Source/WebCore/inspector/front-end/HelpScreen.js b/Source/WebCore/inspector/front-end/HelpScreen.js
index a1bbf1e..aa47712 100644
--- a/Source/WebCore/inspector/front-end/HelpScreen.js
+++ b/Source/WebCore/inspector/front-end/HelpScreen.js
@@ -40,9 +40,9 @@ WebInspector.HelpScreen = function(title)
     this.contentElement = mainWindow.createChild("div", "help-content");
     this.contentElement.tabIndex = 0;
     this.contentElement.addEventListener("blur", this._onBlur.bind(this), false);
-    captionWindow.createChild("h1", "help-window-title").innerText = title;
+    captionWindow.createChild("h1", "help-window-title").textContent = title;
 
-    closeButton.innerText = "\u2716"; // Code stands for HEAVY MULTIPLICATION X.
+    closeButton.textContent = "\u2716"; // Code stands for HEAVY MULTIPLICATION X.
     closeButton.addEventListener("click", this._hide.bind(this), false);
     this._closeKeys = [
         WebInspector.KeyboardShortcut.Keys.Enter.code,
diff --git a/Source/WebCore/inspector/front-end/Images/applicationCache.png b/Source/WebCore/inspector/front-end/Images/applicationCache.png
index 50bad87..fb18e75 100644
--- a/Source/WebCore/inspector/front-end/Images/applicationCache.png
+++ b/Source/WebCore/inspector/front-end/Images/applicationCache.png
diff --git a/Source/WebCore/inspector/front-end/Images/auditsIcon.png b/Source/WebCore/inspector/front-end/Images/auditsIcon.png
index ebeafdc..9f9dd8b 100644
--- a/Source/WebCore/inspector/front-end/Images/auditsIcon.png
+++ b/Source/WebCore/inspector/front-end/Images/auditsIcon.png
diff --git a/Source/WebCore/inspector/front-end/Images/back.png b/Source/WebCore/inspector/front-end/Images/back.png
index 9363960..b1c0c19 100644
--- a/Source/WebCore/inspector/front-end/Images/back.png
+++ b/Source/WebCore/inspector/front-end/Images/back.png
diff --git a/Source/WebCore/inspector/front-end/Images/breakpointBorder.png b/Source/WebCore/inspector/front-end/Images/breakpointBorder.png
index 0b1b550..a4c74d5 100644
--- a/Source/WebCore/inspector/front-end/Images/breakpointBorder.png
+++ b/Source/WebCore/inspector/front-end/Images/breakpointBorder.png
diff --git a/Source/WebCore/inspector/front-end/Images/breakpointConditionalBorder.png b/Source/WebCore/inspector/front-end/Images/breakpointConditionalBorder.png
index 430e37e..5fda706 100644
--- a/Source/WebCore/inspector/front-end/Images/breakpointConditionalBorder.png
+++ b/Source/WebCore/inspector/front-end/Images/breakpointConditionalBorder.png
diff --git a/Source/WebCore/inspector/front-end/Images/breakpointConditionalCounterBorder.png b/Source/WebCore/inspector/front-end/Images/breakpointConditionalCounterBorder.png
index b4a5030..a173c9d 100644
--- a/Source/WebCore/inspector/front-end/Images/breakpointConditionalCounterBorder.png
+++ b/Source/WebCore/inspector/front-end/Images/breakpointConditionalCounterBorder.png
diff --git a/Source/WebCore/inspector/front-end/Images/breakpointCounterBorder.png b/Source/WebCore/inspector/front-end/Images/breakpointCounterBorder.png
index 8b77b61..d078545 100644
--- a/Source/WebCore/inspector/front-end/Images/breakpointCounterBorder.png
+++ b/Source/WebCore/inspector/front-end/Images/breakpointCounterBorder.png
diff --git a/Source/WebCore/inspector/front-end/Images/breakpointsActivateButtonGlyph.png b/Source/WebCore/inspector/front-end/Images/breakpointsActivateButtonGlyph.png
index ce49aac..6307d13 100644
--- a/Source/WebCore/inspector/front-end/Images/breakpointsActivateButtonGlyph.png
+++ b/Source/WebCore/inspector/front-end/Images/breakpointsActivateButtonGlyph.png
diff --git a/Source/WebCore/inspector/front-end/Images/breakpointsDeactivateButtonGlyph.png b/Source/WebCore/inspector/front-end/Images/breakpointsDeactivateButtonGlyph.png
index 5c5fcf6..bf1c5bb 100644
--- a/Source/WebCore/inspector/front-end/Images/breakpointsDeactivateButtonGlyph.png
+++ b/Source/WebCore/inspector/front-end/Images/breakpointsDeactivateButtonGlyph.png
diff --git a/Source/WebCore/inspector/front-end/Images/checker.png b/Source/WebCore/inspector/front-end/Images/checker.png
index 8349908..816a4ec 100644
--- a/Source/WebCore/inspector/front-end/Images/checker.png
+++ b/Source/WebCore/inspector/front-end/Images/checker.png
diff --git a/Source/WebCore/inspector/front-end/Images/clearConsoleButtonGlyph.png b/Source/WebCore/inspector/front-end/Images/clearConsoleButtonGlyph.png
index b1f9465..c243f7d 100644
--- a/Source/WebCore/inspector/front-end/Images/clearConsoleButtonGlyph.png
+++ b/Source/WebCore/inspector/front-end/Images/clearConsoleButtonGlyph.png
diff --git a/Source/WebCore/inspector/front-end/Images/closeButtons.png b/Source/WebCore/inspector/front-end/Images/closeButtons.png
index 28158a4..a574061 100644
--- a/Source/WebCore/inspector/front-end/Images/closeButtons.png
+++ b/Source/WebCore/inspector/front-end/Images/closeButtons.png
diff --git a/Source/WebCore/inspector/front-end/Images/consoleButtonGlyph.png b/Source/WebCore/inspector/front-end/Images/consoleButtonGlyph.png
index d10d43c..7ae29c2 100644
--- a/Source/WebCore/inspector/front-end/Images/consoleButtonGlyph.png
+++ b/Source/WebCore/inspector/front-end/Images/consoleButtonGlyph.png
diff --git a/Source/WebCore/inspector/front-end/Images/consoleIcon.png b/Source/WebCore/inspector/front-end/Images/consoleIcon.png
index 94ffa95..24bb164 100644
--- a/Source/WebCore/inspector/front-end/Images/consoleIcon.png
+++ b/Source/WebCore/inspector/front-end/Images/consoleIcon.png
diff --git a/Source/WebCore/inspector/front-end/Images/cookie.png b/Source/WebCore/inspector/front-end/Images/cookie.png
index 90c3c15..69af785 100644
--- a/Source/WebCore/inspector/front-end/Images/cookie.png
+++ b/Source/WebCore/inspector/front-end/Images/cookie.png
diff --git a/Source/WebCore/inspector/front-end/Images/database.png b/Source/WebCore/inspector/front-end/Images/database.png
index 339efa6..5ffb12e 100644
--- a/Source/WebCore/inspector/front-end/Images/database.png
+++ b/Source/WebCore/inspector/front-end/Images/database.png
diff --git a/Source/WebCore/inspector/front-end/Images/databaseTable.png b/Source/WebCore/inspector/front-end/Images/databaseTable.png
index 3718708..2359352 100644
--- a/Source/WebCore/inspector/front-end/Images/databaseTable.png
+++ b/Source/WebCore/inspector/front-end/Images/databaseTable.png
diff --git a/Source/WebCore/inspector/front-end/Images/debuggerContinue.png b/Source/WebCore/inspector/front-end/Images/debuggerContinue.png
index d90a855..01d99ee 100644
--- a/Source/WebCore/inspector/front-end/Images/debuggerContinue.png
+++ b/Source/WebCore/inspector/front-end/Images/debuggerContinue.png
diff --git a/Source/WebCore/inspector/front-end/Images/debuggerPause.png b/Source/WebCore/inspector/front-end/Images/debuggerPause.png
index 97f958a..c173868 100644
--- a/Source/WebCore/inspector/front-end/Images/debuggerPause.png
+++ b/Source/WebCore/inspector/front-end/Images/debuggerPause.png
diff --git a/Source/WebCore/inspector/front-end/Images/debuggerStepInto.png b/Source/WebCore/inspector/front-end/Images/debuggerStepInto.png
index 277f126..68ec92f 100644
--- a/Source/WebCore/inspector/front-end/Images/debuggerStepInto.png
+++ b/Source/WebCore/inspector/front-end/Images/debuggerStepInto.png
diff --git a/Source/WebCore/inspector/front-end/Images/debuggerStepOut.png b/Source/WebCore/inspector/front-end/Images/debuggerStepOut.png
index 3032e32..caf1394 100644
--- a/Source/WebCore/inspector/front-end/Images/debuggerStepOut.png
+++ b/Source/WebCore/inspector/front-end/Images/debuggerStepOut.png
diff --git a/Source/WebCore/inspector/front-end/Images/debuggerStepOver.png b/Source/WebCore/inspector/front-end/Images/debuggerStepOver.png
index 7d47245..94f116d 100644
--- a/Source/WebCore/inspector/front-end/Images/debuggerStepOver.png
+++ b/Source/WebCore/inspector/front-end/Images/debuggerStepOver.png
diff --git a/Source/WebCore/inspector/front-end/Images/disclosureTriangleSmallDown.png b/Source/WebCore/inspector/front-end/Images/disclosureTriangleSmallDown.png
index cffc835..02ecfa4 100644
--- a/Source/WebCore/inspector/front-end/Images/disclosureTriangleSmallDown.png
+++ b/Source/WebCore/inspector/front-end/Images/disclosureTriangleSmallDown.png
diff --git a/Source/WebCore/inspector/front-end/Images/disclosureTriangleSmallDownBlack.png b/Source/WebCore/inspector/front-end/Images/disclosureTriangleSmallDownBlack.png
index 4b49c13..e100043 100644
--- a/Source/WebCore/inspector/front-end/Images/disclosureTriangleSmallDownBlack.png
+++ b/Source/WebCore/inspector/front-end/Images/disclosureTriangleSmallDownBlack.png
diff --git a/Source/WebCore/inspector/front-end/Images/disclosureTriangleSmallDownWhite.png b/Source/WebCore/inspector/front-end/Images/disclosureTriangleSmallDownWhite.png
index aebae12..38a7aff 100644
--- a/Source/WebCore/inspector/front-end/Images/disclosureTriangleSmallDownWhite.png
+++ b/Source/WebCore/inspector/front-end/Images/disclosureTriangleSmallDownWhite.png
diff --git a/Source/WebCore/inspector/front-end/Images/disclosureTriangleSmallRight.png b/Source/WebCore/inspector/front-end/Images/disclosureTriangleSmallRight.png
index a3102ea..b21f351 100644
--- a/Source/WebCore/inspector/front-end/Images/disclosureTriangleSmallRight.png
+++ b/Source/WebCore/inspector/front-end/Images/disclosureTriangleSmallRight.png
diff --git a/Source/WebCore/inspector/front-end/Images/disclosureTriangleSmallRightBlack.png b/Source/WebCore/inspector/front-end/Images/disclosureTriangleSmallRightBlack.png
index 2c45859..5bc717f 100644
--- a/Source/WebCore/inspector/front-end/Images/disclosureTriangleSmallRightBlack.png
+++ b/Source/WebCore/inspector/front-end/Images/disclosureTriangleSmallRightBlack.png
diff --git a/Source/WebCore/inspector/front-end/Images/disclosureTriangleSmallRightDown.png b/Source/WebCore/inspector/front-end/Images/disclosureTriangleSmallRightDown.png
index 035c069..be65ed7 100644
--- a/Source/WebCore/inspector/front-end/Images/disclosureTriangleSmallRightDown.png
+++ b/Source/WebCore/inspector/front-end/Images/disclosureTriangleSmallRightDown.png
diff --git a/Source/WebCore/inspector/front-end/Images/disclosureTriangleSmallRightDownBlack.png b/Source/WebCore/inspector/front-end/Images/disclosureTriangleSmallRightDownBlack.png
index 86f67bd..44f304f 100644
--- a/Source/WebCore/inspector/front-end/Images/disclosureTriangleSmallRightDownBlack.png
+++ b/Source/WebCore/inspector/front-end/Images/disclosureTriangleSmallRightDownBlack.png
diff --git a/Source/WebCore/inspector/front-end/Images/disclosureTriangleSmallRightDownWhite.png b/Source/WebCore/inspector/front-end/Images/disclosureTriangleSmallRightDownWhite.png
index 972d794..71ee8cc 100644
--- a/Source/WebCore/inspector/front-end/Images/disclosureTriangleSmallRightDownWhite.png
+++ b/Source/WebCore/inspector/front-end/Images/disclosureTriangleSmallRightDownWhite.png
diff --git a/Source/WebCore/inspector/front-end/Images/disclosureTriangleSmallRightWhite.png b/Source/WebCore/inspector/front-end/Images/disclosureTriangleSmallRightWhite.png
index a10168f..f4e705c 100644
--- a/Source/WebCore/inspector/front-end/Images/disclosureTriangleSmallRightWhite.png
+++ b/Source/WebCore/inspector/front-end/Images/disclosureTriangleSmallRightWhite.png
diff --git a/Source/WebCore/inspector/front-end/Images/dockButtonGlyph.png b/Source/WebCore/inspector/front-end/Images/dockButtonGlyph.png
index 7052f4b..29e511d 100644
--- a/Source/WebCore/inspector/front-end/Images/dockButtonGlyph.png
+++ b/Source/WebCore/inspector/front-end/Images/dockButtonGlyph.png
diff --git a/Source/WebCore/inspector/front-end/Images/elementsIcon.png b/Source/WebCore/inspector/front-end/Images/elementsIcon.png
index fde3db9..4f3dbcc 100644
--- a/Source/WebCore/inspector/front-end/Images/elementsIcon.png
+++ b/Source/WebCore/inspector/front-end/Images/elementsIcon.png
diff --git a/Source/WebCore/inspector/front-end/Images/enableOutlineButtonGlyph.png b/Source/WebCore/inspector/front-end/Images/enableOutlineButtonGlyph.png
index 85e0bd6..84e44d2 100644
--- a/Source/WebCore/inspector/front-end/Images/enableOutlineButtonGlyph.png
+++ b/Source/WebCore/inspector/front-end/Images/enableOutlineButtonGlyph.png
diff --git a/Source/WebCore/inspector/front-end/Images/enableSolidButtonGlyph.png b/Source/WebCore/inspector/front-end/Images/enableSolidButtonGlyph.png
index 25b2e96..7fb146b 100644
--- a/Source/WebCore/inspector/front-end/Images/enableSolidButtonGlyph.png
+++ b/Source/WebCore/inspector/front-end/Images/enableSolidButtonGlyph.png
diff --git a/Source/WebCore/inspector/front-end/Images/errorIcon.png b/Source/WebCore/inspector/front-end/Images/errorIcon.png
index c697263..a921076 100644
--- a/Source/WebCore/inspector/front-end/Images/errorIcon.png
+++ b/Source/WebCore/inspector/front-end/Images/errorIcon.png
diff --git a/Source/WebCore/inspector/front-end/Images/errorMediumIcon.png b/Source/WebCore/inspector/front-end/Images/errorMediumIcon.png
index 6ca32bb..e0d05d6 100644
--- a/Source/WebCore/inspector/front-end/Images/errorMediumIcon.png
+++ b/Source/WebCore/inspector/front-end/Images/errorMediumIcon.png
diff --git a/Source/WebCore/inspector/front-end/Images/errorRedDot.png b/Source/WebCore/inspector/front-end/Images/errorRedDot.png
index 6f0b164..2acc65d 100644
--- a/Source/WebCore/inspector/front-end/Images/errorRedDot.png
+++ b/Source/WebCore/inspector/front-end/Images/errorRedDot.png
diff --git a/Source/WebCore/inspector/front-end/Images/excludeButtonGlyph.png b/Source/WebCore/inspector/front-end/Images/excludeButtonGlyph.png
index 5128576..0dd3e19 100644
--- a/Source/WebCore/inspector/front-end/Images/excludeButtonGlyph.png
+++ b/Source/WebCore/inspector/front-end/Images/excludeButtonGlyph.png
diff --git a/Source/WebCore/inspector/front-end/Images/focusButtonGlyph.png b/Source/WebCore/inspector/front-end/Images/focusButtonGlyph.png
index b71807c..7f331b5 100644
--- a/Source/WebCore/inspector/front-end/Images/focusButtonGlyph.png
+++ b/Source/WebCore/inspector/front-end/Images/focusButtonGlyph.png
diff --git a/Source/WebCore/inspector/front-end/Images/forward.png b/Source/WebCore/inspector/front-end/Images/forward.png
index ad70f3e..843392b 100644
--- a/Source/WebCore/inspector/front-end/Images/forward.png
+++ b/Source/WebCore/inspector/front-end/Images/forward.png
diff --git a/Source/WebCore/inspector/front-end/Images/frame.png b/Source/WebCore/inspector/front-end/Images/frame.png
index 0d1953c..27f5ea4 100644
--- a/Source/WebCore/inspector/front-end/Images/frame.png
+++ b/Source/WebCore/inspector/front-end/Images/frame.png
diff --git a/Source/WebCore/inspector/front-end/Images/garbageCollectButtonGlyph.png b/Source/WebCore/inspector/front-end/Images/garbageCollectButtonGlyph.png
new file mode 100644
index 0000000..699f5ee
--- /dev/null
+++ b/Source/WebCore/inspector/front-end/Images/garbageCollectButtonGlyph.png
diff --git a/Source/WebCore/inspector/front-end/Images/gearButtonGlyph.png b/Source/WebCore/inspector/front-end/Images/gearButtonGlyph.png
index 19659c9..4b59250 100644
--- a/Source/WebCore/inspector/front-end/Images/gearButtonGlyph.png
+++ b/Source/WebCore/inspector/front-end/Images/gearButtonGlyph.png
diff --git a/Source/WebCore/inspector/front-end/Images/glossyHeader.png b/Source/WebCore/inspector/front-end/Images/glossyHeader.png
index 6cbefb7..e85c596 100644
--- a/Source/WebCore/inspector/front-end/Images/glossyHeader.png
+++ b/Source/WebCore/inspector/front-end/Images/glossyHeader.png
diff --git a/Source/WebCore/inspector/front-end/Images/glossyHeaderPressed.png b/Source/WebCore/inspector/front-end/Images/glossyHeaderPressed.png
index 1153506..01872cd 100644
--- a/Source/WebCore/inspector/front-end/Images/glossyHeaderPressed.png
+++ b/Source/WebCore/inspector/front-end/Images/glossyHeaderPressed.png
diff --git a/Source/WebCore/inspector/front-end/Images/glossyHeaderSelected.png b/Source/WebCore/inspector/front-end/Images/glossyHeaderSelected.png
index 71d5af6..f7d615c 100644
--- a/Source/WebCore/inspector/front-end/Images/glossyHeaderSelected.png
+++ b/Source/WebCore/inspector/front-end/Images/glossyHeaderSelected.png
diff --git a/Source/WebCore/inspector/front-end/Images/glossyHeaderSelectedPressed.png b/Source/WebCore/inspector/front-end/Images/glossyHeaderSelectedPressed.png
index 7047dbe..75d37fb 100644
--- a/Source/WebCore/inspector/front-end/Images/glossyHeaderSelectedPressed.png
+++ b/Source/WebCore/inspector/front-end/Images/glossyHeaderSelectedPressed.png
diff --git a/Source/WebCore/inspector/front-end/Images/goArrow.png b/Source/WebCore/inspector/front-end/Images/goArrow.png
index f318a56..980e159 100644
--- a/Source/WebCore/inspector/front-end/Images/goArrow.png
+++ b/Source/WebCore/inspector/front-end/Images/goArrow.png
diff --git a/Source/WebCore/inspector/front-end/Images/graphLabelCalloutLeft.png b/Source/WebCore/inspector/front-end/Images/graphLabelCalloutLeft.png
index 6426dbd..f80dccf 100644
--- a/Source/WebCore/inspector/front-end/Images/graphLabelCalloutLeft.png
+++ b/Source/WebCore/inspector/front-end/Images/graphLabelCalloutLeft.png
diff --git a/Source/WebCore/inspector/front-end/Images/graphLabelCalloutRight.png b/Source/WebCore/inspector/front-end/Images/graphLabelCalloutRight.png
index 8c87eae..3ee8221 100644
--- a/Source/WebCore/inspector/front-end/Images/graphLabelCalloutRight.png
+++ b/Source/WebCore/inspector/front-end/Images/graphLabelCalloutRight.png
diff --git a/Source/WebCore/inspector/front-end/Images/helpButtonGlyph.png b/Source/WebCore/inspector/front-end/Images/helpButtonGlyph.png
index 92fe59a..83f0425 100644
--- a/Source/WebCore/inspector/front-end/Images/helpButtonGlyph.png
+++ b/Source/WebCore/inspector/front-end/Images/helpButtonGlyph.png
diff --git a/Source/WebCore/inspector/front-end/Images/largerResourcesButtonGlyph.png b/Source/WebCore/inspector/front-end/Images/largerResourcesButtonGlyph.png
index 71256d6..4884c8c 100644
--- a/Source/WebCore/inspector/front-end/Images/largerResourcesButtonGlyph.png
+++ b/Source/WebCore/inspector/front-end/Images/largerResourcesButtonGlyph.png
diff --git a/Source/WebCore/inspector/front-end/Images/localStorage.png b/Source/WebCore/inspector/front-end/Images/localStorage.png
index 44a3019..0e615ce 100644
--- a/Source/WebCore/inspector/front-end/Images/localStorage.png
+++ b/Source/WebCore/inspector/front-end/Images/localStorage.png
diff --git a/Source/WebCore/inspector/front-end/Images/networkIcon.png b/Source/WebCore/inspector/front-end/Images/networkIcon.png
index ba10bba..f34338e 100644
--- a/Source/WebCore/inspector/front-end/Images/networkIcon.png
+++ b/Source/WebCore/inspector/front-end/Images/networkIcon.png
diff --git a/Source/WebCore/inspector/front-end/Images/nodeSearchButtonGlyph.png b/Source/WebCore/inspector/front-end/Images/nodeSearchButtonGlyph.png
index faf5df2..bcaf651 100644
--- a/Source/WebCore/inspector/front-end/Images/nodeSearchButtonGlyph.png
+++ b/Source/WebCore/inspector/front-end/Images/nodeSearchButtonGlyph.png
diff --git a/Source/WebCore/inspector/front-end/Images/paneAddButtons.png b/Source/WebCore/inspector/front-end/Images/paneAddButtons.png
index f1c0047..8790f53 100644
--- a/Source/WebCore/inspector/front-end/Images/paneAddButtons.png
+++ b/Source/WebCore/inspector/front-end/Images/paneAddButtons.png
diff --git a/Source/WebCore/inspector/front-end/Images/paneBottomGrow.png b/Source/WebCore/inspector/front-end/Images/paneBottomGrow.png
index d55b865..c215657 100644
--- a/Source/WebCore/inspector/front-end/Images/paneBottomGrow.png
+++ b/Source/WebCore/inspector/front-end/Images/paneBottomGrow.png
diff --git a/Source/WebCore/inspector/front-end/Images/paneBottomGrowActive.png b/Source/WebCore/inspector/front-end/Images/paneBottomGrowActive.png
index ef3f259..5a8d068 100644
--- a/Source/WebCore/inspector/front-end/Images/paneBottomGrowActive.png
+++ b/Source/WebCore/inspector/front-end/Images/paneBottomGrowActive.png
diff --git a/Source/WebCore/inspector/front-end/Images/paneGrowHandleLine.png b/Source/WebCore/inspector/front-end/Images/paneGrowHandleLine.png
index 4eaf61b..87cc2c4 100644
--- a/Source/WebCore/inspector/front-end/Images/paneGrowHandleLine.png
+++ b/Source/WebCore/inspector/front-end/Images/paneGrowHandleLine.png
diff --git a/Source/WebCore/inspector/front-end/Images/paneSettingsButtons.png b/Source/WebCore/inspector/front-end/Images/paneSettingsButtons.png
index 36a6244..1288b89 100644
--- a/Source/WebCore/inspector/front-end/Images/paneSettingsButtons.png
+++ b/Source/WebCore/inspector/front-end/Images/paneSettingsButtons.png
diff --git a/Source/WebCore/inspector/front-end/Images/pauseOnExceptionButtonGlyph.png b/Source/WebCore/inspector/front-end/Images/pauseOnExceptionButtonGlyph.png
index c3cec5f..13bd54e 100644
--- a/Source/WebCore/inspector/front-end/Images/pauseOnExceptionButtonGlyph.png
+++ b/Source/WebCore/inspector/front-end/Images/pauseOnExceptionButtonGlyph.png
diff --git a/Source/WebCore/inspector/front-end/Images/percentButtonGlyph.png b/Source/WebCore/inspector/front-end/Images/percentButtonGlyph.png
index 0ace3b7..cdbc120 100644
--- a/Source/WebCore/inspector/front-end/Images/percentButtonGlyph.png
+++ b/Source/WebCore/inspector/front-end/Images/percentButtonGlyph.png
diff --git a/Source/WebCore/inspector/front-end/Images/popoverArrows.png b/Source/WebCore/inspector/front-end/Images/popoverArrows.png
index ccefa16..a1fc766 100644
--- a/Source/WebCore/inspector/front-end/Images/popoverArrows.png
+++ b/Source/WebCore/inspector/front-end/Images/popoverArrows.png
diff --git a/Source/WebCore/inspector/front-end/Images/popoverBackground.png b/Source/WebCore/inspector/front-end/Images/popoverBackground.png
index f20c988..fd8fc99 100644
--- a/Source/WebCore/inspector/front-end/Images/popoverBackground.png
+++ b/Source/WebCore/inspector/front-end/Images/popoverBackground.png
diff --git a/Source/WebCore/inspector/front-end/Images/profileGroupIcon.png b/Source/WebCore/inspector/front-end/Images/profileGroupIcon.png
index 44616d4..a25de24 100644
--- a/Source/WebCore/inspector/front-end/Images/profileGroupIcon.png
+++ b/Source/WebCore/inspector/front-end/Images/profileGroupIcon.png
diff --git a/Source/WebCore/inspector/front-end/Images/profileIcon.png b/Source/WebCore/inspector/front-end/Images/profileIcon.png
index 8008f9b..015c791 100644
--- a/Source/WebCore/inspector/front-end/Images/profileIcon.png
+++ b/Source/WebCore/inspector/front-end/Images/profileIcon.png
diff --git a/Source/WebCore/inspector/front-end/Images/profileSmallIcon.png b/Source/WebCore/inspector/front-end/Images/profileSmallIcon.png
index 7935520..cbdcac2 100644
--- a/Source/WebCore/inspector/front-end/Images/profileSmallIcon.png
+++ b/Source/WebCore/inspector/front-end/Images/profileSmallIcon.png
diff --git a/Source/WebCore/inspector/front-end/Images/profilesIcon.png b/Source/WebCore/inspector/front-end/Images/profilesIcon.png
index ecd5b04..91630ae 100644
--- a/Source/WebCore/inspector/front-end/Images/profilesIcon.png
+++ b/Source/WebCore/inspector/front-end/Images/profilesIcon.png
diff --git a/Source/WebCore/inspector/front-end/Images/profilesSilhouette.png b/Source/WebCore/inspector/front-end/Images/profilesSilhouette.png
index 42bb966..42daec2 100644
--- a/Source/WebCore/inspector/front-end/Images/profilesSilhouette.png
+++ b/Source/WebCore/inspector/front-end/Images/profilesSilhouette.png
diff --git a/Source/WebCore/inspector/front-end/Images/programCounterBorder.png b/Source/WebCore/inspector/front-end/Images/programCounterBorder.png
index fed2f3e..5e7717e 100644
--- a/Source/WebCore/inspector/front-end/Images/programCounterBorder.png
+++ b/Source/WebCore/inspector/front-end/Images/programCounterBorder.png
diff --git a/Source/WebCore/inspector/front-end/Images/radioDot.png b/Source/WebCore/inspector/front-end/Images/radioDot.png
index 609878f..1a99f93 100644
--- a/Source/WebCore/inspector/front-end/Images/radioDot.png
+++ b/Source/WebCore/inspector/front-end/Images/radioDot.png
diff --git a/Source/WebCore/inspector/front-end/Images/recordButtonGlyph.png b/Source/WebCore/inspector/front-end/Images/recordButtonGlyph.png
index bfdad1a..9ffac9a 100644
--- a/Source/WebCore/inspector/front-end/Images/recordButtonGlyph.png
+++ b/Source/WebCore/inspector/front-end/Images/recordButtonGlyph.png
diff --git a/Source/WebCore/inspector/front-end/Images/recordToggledButtonGlyph.png b/Source/WebCore/inspector/front-end/Images/recordToggledButtonGlyph.png
index 2c22f87..ee02021 100644
--- a/Source/WebCore/inspector/front-end/Images/recordToggledButtonGlyph.png
+++ b/Source/WebCore/inspector/front-end/Images/recordToggledButtonGlyph.png
diff --git a/Source/WebCore/inspector/front-end/Images/reloadButtonGlyph.png b/Source/WebCore/inspector/front-end/Images/reloadButtonGlyph.png
index 28e047a..c8739f2 100644
--- a/Source/WebCore/inspector/front-end/Images/reloadButtonGlyph.png
+++ b/Source/WebCore/inspector/front-end/Images/reloadButtonGlyph.png
diff --git a/Source/WebCore/inspector/front-end/Images/resourceCSSIcon.png b/Source/WebCore/inspector/front-end/Images/resourceCSSIcon.png
index aead6a7..3782125 100644
--- a/Source/WebCore/inspector/front-end/Images/resourceCSSIcon.png
+++ b/Source/WebCore/inspector/front-end/Images/resourceCSSIcon.png
diff --git a/Source/WebCore/inspector/front-end/Images/resourceDocumentIcon.png b/Source/WebCore/inspector/front-end/Images/resourceDocumentIcon.png
index 1683a09..5ef6559 100644
--- a/Source/WebCore/inspector/front-end/Images/resourceDocumentIcon.png
+++ b/Source/WebCore/inspector/front-end/Images/resourceDocumentIcon.png
diff --git a/Source/WebCore/inspector/front-end/Images/resourceDocumentIconSmall.png b/Source/WebCore/inspector/front-end/Images/resourceDocumentIconSmall.png
index 468ced9..b70bd50 100644
--- a/Source/WebCore/inspector/front-end/Images/resourceDocumentIconSmall.png
+++ b/Source/WebCore/inspector/front-end/Images/resourceDocumentIconSmall.png
diff --git a/Source/WebCore/inspector/front-end/Images/resourceJSIcon.png b/Source/WebCore/inspector/front-end/Images/resourceJSIcon.png
index 9ef6ed0..73bc05d 100644
--- a/Source/WebCore/inspector/front-end/Images/resourceJSIcon.png
+++ b/Source/WebCore/inspector/front-end/Images/resourceJSIcon.png
diff --git a/Source/WebCore/inspector/front-end/Images/resourcePlainIcon.png b/Source/WebCore/inspector/front-end/Images/resourcePlainIcon.png
index 0ed37b6..2cd9e06 100644
--- a/Source/WebCore/inspector/front-end/Images/resourcePlainIcon.png
+++ b/Source/WebCore/inspector/front-end/Images/resourcePlainIcon.png
diff --git a/Source/WebCore/inspector/front-end/Images/resourcePlainIconSmall.png b/Source/WebCore/inspector/front-end/Images/resourcePlainIconSmall.png
index 0fa967d..1adf8ac 100644
--- a/Source/WebCore/inspector/front-end/Images/resourcePlainIconSmall.png
+++ b/Source/WebCore/inspector/front-end/Images/resourcePlainIconSmall.png
diff --git a/Source/WebCore/inspector/front-end/Images/resourcesIcon.png b/Source/WebCore/inspector/front-end/Images/resourcesIcon.png
index 982424d..c472dbd 100644
--- a/Source/WebCore/inspector/front-end/Images/resourcesIcon.png
+++ b/Source/WebCore/inspector/front-end/Images/resourcesIcon.png
diff --git a/Source/WebCore/inspector/front-end/Images/resourcesSizeGraphIcon.png b/Source/WebCore/inspector/front-end/Images/resourcesSizeGraphIcon.png
index e60dbe5..4765e02 100644
--- a/Source/WebCore/inspector/front-end/Images/resourcesSizeGraphIcon.png
+++ b/Source/WebCore/inspector/front-end/Images/resourcesSizeGraphIcon.png
diff --git a/Source/WebCore/inspector/front-end/Images/resourcesTimeGraphIcon.png b/Source/WebCore/inspector/front-end/Images/resourcesTimeGraphIcon.png
index c6953e9..27acd35 100644
--- a/Source/WebCore/inspector/front-end/Images/resourcesTimeGraphIcon.png
+++ b/Source/WebCore/inspector/front-end/Images/resourcesTimeGraphIcon.png
diff --git a/Source/WebCore/inspector/front-end/Images/scriptsIcon.png b/Source/WebCore/inspector/front-end/Images/scriptsIcon.png
index 213b31e..4cda81f 100644
--- a/Source/WebCore/inspector/front-end/Images/scriptsIcon.png
+++ b/Source/WebCore/inspector/front-end/Images/scriptsIcon.png
diff --git a/Source/WebCore/inspector/front-end/Images/scriptsSilhouette.png b/Source/WebCore/inspector/front-end/Images/scriptsSilhouette.png
index 206396f..09c4fcc 100644
--- a/Source/WebCore/inspector/front-end/Images/scriptsSilhouette.png
+++ b/Source/WebCore/inspector/front-end/Images/scriptsSilhouette.png
diff --git a/Source/WebCore/inspector/front-end/Images/searchSmallBlue.png b/Source/WebCore/inspector/front-end/Images/searchSmallBlue.png
index 9c990f4..08350f7 100644
--- a/Source/WebCore/inspector/front-end/Images/searchSmallBlue.png
+++ b/Source/WebCore/inspector/front-end/Images/searchSmallBlue.png
diff --git a/Source/WebCore/inspector/front-end/Images/searchSmallBrightBlue.png b/Source/WebCore/inspector/front-end/Images/searchSmallBrightBlue.png
index b1d8055..09813af 100644
--- a/Source/WebCore/inspector/front-end/Images/searchSmallBrightBlue.png
+++ b/Source/WebCore/inspector/front-end/Images/searchSmallBrightBlue.png
diff --git a/Source/WebCore/inspector/front-end/Images/searchSmallGray.png b/Source/WebCore/inspector/front-end/Images/searchSmallGray.png
index 4f3c068..7780820 100644
--- a/Source/WebCore/inspector/front-end/Images/searchSmallGray.png
+++ b/Source/WebCore/inspector/front-end/Images/searchSmallGray.png
diff --git a/Source/WebCore/inspector/front-end/Images/searchSmallWhite.png b/Source/WebCore/inspector/front-end/Images/searchSmallWhite.png
index 85f430d..8b57eaa 100644
--- a/Source/WebCore/inspector/front-end/Images/searchSmallWhite.png
+++ b/Source/WebCore/inspector/front-end/Images/searchSmallWhite.png
diff --git a/Source/WebCore/inspector/front-end/Images/segment.png b/Source/WebCore/inspector/front-end/Images/segment.png
index 759266e..735ec1a 100644
--- a/Source/WebCore/inspector/front-end/Images/segment.png
+++ b/Source/WebCore/inspector/front-end/Images/segment.png
diff --git a/Source/WebCore/inspector/front-end/Images/segmentEnd.png b/Source/WebCore/inspector/front-end/Images/segmentEnd.png
index 72672ff..a262b7d 100644
--- a/Source/WebCore/inspector/front-end/Images/segmentEnd.png
+++ b/Source/WebCore/inspector/front-end/Images/segmentEnd.png
diff --git a/Source/WebCore/inspector/front-end/Images/segmentHover.png b/Source/WebCore/inspector/front-end/Images/segmentHover.png
index c5017f4..ffe99ee 100644
--- a/Source/WebCore/inspector/front-end/Images/segmentHover.png
+++ b/Source/WebCore/inspector/front-end/Images/segmentHover.png
diff --git a/Source/WebCore/inspector/front-end/Images/segmentHoverEnd.png b/Source/WebCore/inspector/front-end/Images/segmentHoverEnd.png
index d51363d..c2c27fa 100644
--- a/Source/WebCore/inspector/front-end/Images/segmentHoverEnd.png
+++ b/Source/WebCore/inspector/front-end/Images/segmentHoverEnd.png
diff --git a/Source/WebCore/inspector/front-end/Images/segmentSelected.png b/Source/WebCore/inspector/front-end/Images/segmentSelected.png
index c92f584..114ffc9 100644
--- a/Source/WebCore/inspector/front-end/Images/segmentSelected.png
+++ b/Source/WebCore/inspector/front-end/Images/segmentSelected.png
diff --git a/Source/WebCore/inspector/front-end/Images/segmentSelectedEnd.png b/Source/WebCore/inspector/front-end/Images/segmentSelectedEnd.png
index be5e085..6cb3ac5 100644
--- a/Source/WebCore/inspector/front-end/Images/segmentSelectedEnd.png
+++ b/Source/WebCore/inspector/front-end/Images/segmentSelectedEnd.png
diff --git a/Source/WebCore/inspector/front-end/Images/sessionStorage.png b/Source/WebCore/inspector/front-end/Images/sessionStorage.png
index 4d50e35..144ef65 100644
--- a/Source/WebCore/inspector/front-end/Images/sessionStorage.png
+++ b/Source/WebCore/inspector/front-end/Images/sessionStorage.png
diff --git a/Source/WebCore/inspector/front-end/Images/splitviewDimple.png b/Source/WebCore/inspector/front-end/Images/splitviewDimple.png
index 584ffd4..23b88b5 100644
--- a/Source/WebCore/inspector/front-end/Images/splitviewDimple.png
+++ b/Source/WebCore/inspector/front-end/Images/splitviewDimple.png
diff --git a/Source/WebCore/inspector/front-end/Images/splitviewDividerBackground.png b/Source/WebCore/inspector/front-end/Images/splitviewDividerBackground.png
index 1120a7f..2e48b06 100644
--- a/Source/WebCore/inspector/front-end/Images/splitviewDividerBackground.png
+++ b/Source/WebCore/inspector/front-end/Images/splitviewDividerBackground.png
diff --git a/Source/WebCore/inspector/front-end/Images/statusbarButtons.png b/Source/WebCore/inspector/front-end/Images/statusbarButtons.png
index e8090cb..163d7b5 100644
--- a/Source/WebCore/inspector/front-end/Images/statusbarButtons.png
+++ b/Source/WebCore/inspector/front-end/Images/statusbarButtons.png
diff --git a/Source/WebCore/inspector/front-end/Images/statusbarMenuButton.png b/Source/WebCore/inspector/front-end/Images/statusbarMenuButton.png
index 9b3abdd..8904217 100644
--- a/Source/WebCore/inspector/front-end/Images/statusbarMenuButton.png
+++ b/Source/WebCore/inspector/front-end/Images/statusbarMenuButton.png
diff --git a/Source/WebCore/inspector/front-end/Images/statusbarMenuButtonSelected.png b/Source/WebCore/inspector/front-end/Images/statusbarMenuButtonSelected.png
index 8189c43..74fe953 100644
--- a/Source/WebCore/inspector/front-end/Images/statusbarMenuButtonSelected.png
+++ b/Source/WebCore/inspector/front-end/Images/statusbarMenuButtonSelected.png
diff --git a/Source/WebCore/inspector/front-end/Images/statusbarResizerHorizontal.png b/Source/WebCore/inspector/front-end/Images/statusbarResizerHorizontal.png
index 56deeab..674b895 100644
--- a/Source/WebCore/inspector/front-end/Images/statusbarResizerHorizontal.png
+++ b/Source/WebCore/inspector/front-end/Images/statusbarResizerHorizontal.png
diff --git a/Source/WebCore/inspector/front-end/Images/statusbarResizerVertical.png b/Source/WebCore/inspector/front-end/Images/statusbarResizerVertical.png
index 7fc1452..bf84d1e 100644
--- a/Source/WebCore/inspector/front-end/Images/statusbarResizerVertical.png
+++ b/Source/WebCore/inspector/front-end/Images/statusbarResizerVertical.png
diff --git a/Source/WebCore/inspector/front-end/Images/successGreenDot.png b/Source/WebCore/inspector/front-end/Images/successGreenDot.png
index 8b9319c..8a3232a 100644
--- a/Source/WebCore/inspector/front-end/Images/successGreenDot.png
+++ b/Source/WebCore/inspector/front-end/Images/successGreenDot.png
diff --git a/Source/WebCore/inspector/front-end/Images/thumbActiveHoriz.png b/Source/WebCore/inspector/front-end/Images/thumbActiveHoriz.png
index a6ee561..8648eb1 100644
--- a/Source/WebCore/inspector/front-end/Images/thumbActiveHoriz.png
+++ b/Source/WebCore/inspector/front-end/Images/thumbActiveHoriz.png
diff --git a/Source/WebCore/inspector/front-end/Images/thumbActiveVert.png b/Source/WebCore/inspector/front-end/Images/thumbActiveVert.png
index a3eabe8..10b71b7 100644
--- a/Source/WebCore/inspector/front-end/Images/thumbActiveVert.png
+++ b/Source/WebCore/inspector/front-end/Images/thumbActiveVert.png
diff --git a/Source/WebCore/inspector/front-end/Images/thumbHoriz.png b/Source/WebCore/inspector/front-end/Images/thumbHoriz.png
index c16559a..f4b8694 100644
--- a/Source/WebCore/inspector/front-end/Images/thumbHoriz.png
+++ b/Source/WebCore/inspector/front-end/Images/thumbHoriz.png
diff --git a/Source/WebCore/inspector/front-end/Images/thumbHoverHoriz.png b/Source/WebCore/inspector/front-end/Images/thumbHoverHoriz.png
index 0fe8d6a..74e43b8 100644
--- a/Source/WebCore/inspector/front-end/Images/thumbHoverHoriz.png
+++ b/Source/WebCore/inspector/front-end/Images/thumbHoverHoriz.png
diff --git a/Source/WebCore/inspector/front-end/Images/thumbHoverVert.png b/Source/WebCore/inspector/front-end/Images/thumbHoverVert.png
index 30e315a..140ab8e 100644
--- a/Source/WebCore/inspector/front-end/Images/thumbHoverVert.png
+++ b/Source/WebCore/inspector/front-end/Images/thumbHoverVert.png
diff --git a/Source/WebCore/inspector/front-end/Images/thumbVert.png b/Source/WebCore/inspector/front-end/Images/thumbVert.png
index 61fbc06..460815e 100644
--- a/Source/WebCore/inspector/front-end/Images/thumbVert.png
+++ b/Source/WebCore/inspector/front-end/Images/thumbVert.png
diff --git a/Source/WebCore/inspector/front-end/Images/timelineBarBlue.png b/Source/WebCore/inspector/front-end/Images/timelineBarBlue.png
index 22641b5..5af3195 100644
--- a/Source/WebCore/inspector/front-end/Images/timelineBarBlue.png
+++ b/Source/WebCore/inspector/front-end/Images/timelineBarBlue.png
diff --git a/Source/WebCore/inspector/front-end/Images/timelineBarGray.png b/Source/WebCore/inspector/front-end/Images/timelineBarGray.png
index f66cf43..4e11aa4 100644
--- a/Source/WebCore/inspector/front-end/Images/timelineBarGray.png
+++ b/Source/WebCore/inspector/front-end/Images/timelineBarGray.png
diff --git a/Source/WebCore/inspector/front-end/Images/timelineBarGreen.png b/Source/WebCore/inspector/front-end/Images/timelineBarGreen.png
index cc59082..ec1955c 100644
--- a/Source/WebCore/inspector/front-end/Images/timelineBarGreen.png
+++ b/Source/WebCore/inspector/front-end/Images/timelineBarGreen.png
diff --git a/Source/WebCore/inspector/front-end/Images/timelineBarOrange.png b/Source/WebCore/inspector/front-end/Images/timelineBarOrange.png
index e5ae6f5..435b0f1 100644
--- a/Source/WebCore/inspector/front-end/Images/timelineBarOrange.png
+++ b/Source/WebCore/inspector/front-end/Images/timelineBarOrange.png
diff --git a/Source/WebCore/inspector/front-end/Images/timelineBarPurple.png b/Source/WebCore/inspector/front-end/Images/timelineBarPurple.png
index f891252..02649cd 100644
--- a/Source/WebCore/inspector/front-end/Images/timelineBarPurple.png
+++ b/Source/WebCore/inspector/front-end/Images/timelineBarPurple.png
diff --git a/Source/WebCore/inspector/front-end/Images/timelineBarRed.png b/Source/WebCore/inspector/front-end/Images/timelineBarRed.png
index b850037..9c47280 100644
--- a/Source/WebCore/inspector/front-end/Images/timelineBarRed.png
+++ b/Source/WebCore/inspector/front-end/Images/timelineBarRed.png
diff --git a/Source/WebCore/inspector/front-end/Images/timelineBarYellow.png b/Source/WebCore/inspector/front-end/Images/timelineBarYellow.png
index 2b3e9a7..39716ea 100644
--- a/Source/WebCore/inspector/front-end/Images/timelineBarYellow.png
+++ b/Source/WebCore/inspector/front-end/Images/timelineBarYellow.png
diff --git a/Source/WebCore/inspector/front-end/Images/timelineCheckmarks.png b/Source/WebCore/inspector/front-end/Images/timelineCheckmarks.png
index 9afa9bb..1b32449 100644
--- a/Source/WebCore/inspector/front-end/Images/timelineCheckmarks.png
+++ b/Source/WebCore/inspector/front-end/Images/timelineCheckmarks.png
diff --git a/Source/WebCore/inspector/front-end/Images/timelineDots.png b/Source/WebCore/inspector/front-end/Images/timelineDots.png
index e9ba4d3..325f2ab 100644
--- a/Source/WebCore/inspector/front-end/Images/timelineDots.png
+++ b/Source/WebCore/inspector/front-end/Images/timelineDots.png
diff --git a/Source/WebCore/inspector/front-end/Images/timelineHollowPillBlue.png b/Source/WebCore/inspector/front-end/Images/timelineHollowPillBlue.png
index c7c273b..92f7f72 100644
--- a/Source/WebCore/inspector/front-end/Images/timelineHollowPillBlue.png
+++ b/Source/WebCore/inspector/front-end/Images/timelineHollowPillBlue.png
diff --git a/Source/WebCore/inspector/front-end/Images/timelineHollowPillGray.png b/Source/WebCore/inspector/front-end/Images/timelineHollowPillGray.png
index 9ff37ef..fd8afe1 100644
--- a/Source/WebCore/inspector/front-end/Images/timelineHollowPillGray.png
+++ b/Source/WebCore/inspector/front-end/Images/timelineHollowPillGray.png
diff --git a/Source/WebCore/inspector/front-end/Images/timelineHollowPillGreen.png b/Source/WebCore/inspector/front-end/Images/timelineHollowPillGreen.png
index cc5a8f3..af34c30 100644
--- a/Source/WebCore/inspector/front-end/Images/timelineHollowPillGreen.png
+++ b/Source/WebCore/inspector/front-end/Images/timelineHollowPillGreen.png
diff --git a/Source/WebCore/inspector/front-end/Images/timelineHollowPillOrange.png b/Source/WebCore/inspector/front-end/Images/timelineHollowPillOrange.png
index 08a81e4..b46edde 100644
--- a/Source/WebCore/inspector/front-end/Images/timelineHollowPillOrange.png
+++ b/Source/WebCore/inspector/front-end/Images/timelineHollowPillOrange.png
diff --git a/Source/WebCore/inspector/front-end/Images/timelineHollowPillPurple.png b/Source/WebCore/inspector/front-end/Images/timelineHollowPillPurple.png
index 565a05c..6ce6640 100644
--- a/Source/WebCore/inspector/front-end/Images/timelineHollowPillPurple.png
+++ b/Source/WebCore/inspector/front-end/Images/timelineHollowPillPurple.png
diff --git a/Source/WebCore/inspector/front-end/Images/timelineHollowPillRed.png b/Source/WebCore/inspector/front-end/Images/timelineHollowPillRed.png
index c3a1b9b..67cccfd 100644
--- a/Source/WebCore/inspector/front-end/Images/timelineHollowPillRed.png
+++ b/Source/WebCore/inspector/front-end/Images/timelineHollowPillRed.png
diff --git a/Source/WebCore/inspector/front-end/Images/timelineHollowPillYellow.png b/Source/WebCore/inspector/front-end/Images/timelineHollowPillYellow.png
index 780045b..9e71a9a 100644
--- a/Source/WebCore/inspector/front-end/Images/timelineHollowPillYellow.png
+++ b/Source/WebCore/inspector/front-end/Images/timelineHollowPillYellow.png
diff --git a/Source/WebCore/inspector/front-end/Images/timelineIcon.png b/Source/WebCore/inspector/front-end/Images/timelineIcon.png
index 09bcf30..6ab8621 100644
--- a/Source/WebCore/inspector/front-end/Images/timelineIcon.png
+++ b/Source/WebCore/inspector/front-end/Images/timelineIcon.png
diff --git a/Source/WebCore/inspector/front-end/Images/timelinePillBlue.png b/Source/WebCore/inspector/front-end/Images/timelinePillBlue.png
index c897faa..aef3652 100644
--- a/Source/WebCore/inspector/front-end/Images/timelinePillBlue.png
+++ b/Source/WebCore/inspector/front-end/Images/timelinePillBlue.png
diff --git a/Source/WebCore/inspector/front-end/Images/timelinePillGray.png b/Source/WebCore/inspector/front-end/Images/timelinePillGray.png
index 2128896..82ea80a 100644
--- a/Source/WebCore/inspector/front-end/Images/timelinePillGray.png
+++ b/Source/WebCore/inspector/front-end/Images/timelinePillGray.png
diff --git a/Source/WebCore/inspector/front-end/Images/timelinePillGreen.png b/Source/WebCore/inspector/front-end/Images/timelinePillGreen.png
index 9b66125..6973fdb 100644
--- a/Source/WebCore/inspector/front-end/Images/timelinePillGreen.png
+++ b/Source/WebCore/inspector/front-end/Images/timelinePillGreen.png
diff --git a/Source/WebCore/inspector/front-end/Images/timelinePillOrange.png b/Source/WebCore/inspector/front-end/Images/timelinePillOrange.png
index dd944fb..09cfa4a 100644
--- a/Source/WebCore/inspector/front-end/Images/timelinePillOrange.png
+++ b/Source/WebCore/inspector/front-end/Images/timelinePillOrange.png
diff --git a/Source/WebCore/inspector/front-end/Images/timelinePillPurple.png b/Source/WebCore/inspector/front-end/Images/timelinePillPurple.png
index 21b96f7..6fb5b35 100644
--- a/Source/WebCore/inspector/front-end/Images/timelinePillPurple.png
+++ b/Source/WebCore/inspector/front-end/Images/timelinePillPurple.png
diff --git a/Source/WebCore/inspector/front-end/Images/timelinePillRed.png b/Source/WebCore/inspector/front-end/Images/timelinePillRed.png
index f5e213b..64234f7 100644
--- a/Source/WebCore/inspector/front-end/Images/timelinePillRed.png
+++ b/Source/WebCore/inspector/front-end/Images/timelinePillRed.png
diff --git a/Source/WebCore/inspector/front-end/Images/timelinePillYellow.png b/Source/WebCore/inspector/front-end/Images/timelinePillYellow.png
index ae2a5a2..a2deee6 100644
--- a/Source/WebCore/inspector/front-end/Images/timelinePillYellow.png
+++ b/Source/WebCore/inspector/front-end/Images/timelinePillYellow.png
diff --git a/Source/WebCore/inspector/front-end/Images/toolbarItemSelected.png b/Source/WebCore/inspector/front-end/Images/toolbarItemSelected.png
index bd681f1..dab787e 100644
--- a/Source/WebCore/inspector/front-end/Images/toolbarItemSelected.png
+++ b/Source/WebCore/inspector/front-end/Images/toolbarItemSelected.png
diff --git a/Source/WebCore/inspector/front-end/Images/trackHoriz.png b/Source/WebCore/inspector/front-end/Images/trackHoriz.png
index 517d306..541dd11 100644
--- a/Source/WebCore/inspector/front-end/Images/trackHoriz.png
+++ b/Source/WebCore/inspector/front-end/Images/trackHoriz.png
diff --git a/Source/WebCore/inspector/front-end/Images/trackVert.png b/Source/WebCore/inspector/front-end/Images/trackVert.png
index d49620d..1375a14 100644
--- a/Source/WebCore/inspector/front-end/Images/trackVert.png
+++ b/Source/WebCore/inspector/front-end/Images/trackVert.png
diff --git a/Source/WebCore/inspector/front-end/Images/treeDownTriangleBlack.png b/Source/WebCore/inspector/front-end/Images/treeDownTriangleBlack.png
index 0821112..f797585 100644
--- a/Source/WebCore/inspector/front-end/Images/treeDownTriangleBlack.png
+++ b/Source/WebCore/inspector/front-end/Images/treeDownTriangleBlack.png
diff --git a/Source/WebCore/inspector/front-end/Images/treeDownTriangleWhite.png b/Source/WebCore/inspector/front-end/Images/treeDownTriangleWhite.png
index 1667b51..24d3d55 100644
--- a/Source/WebCore/inspector/front-end/Images/treeDownTriangleWhite.png
+++ b/Source/WebCore/inspector/front-end/Images/treeDownTriangleWhite.png
diff --git a/Source/WebCore/inspector/front-end/Images/treeRightTriangleBlack.png b/Source/WebCore/inspector/front-end/Images/treeRightTriangleBlack.png
index 90de820..9b4c2f1 100644
--- a/Source/WebCore/inspector/front-end/Images/treeRightTriangleBlack.png
+++ b/Source/WebCore/inspector/front-end/Images/treeRightTriangleBlack.png
diff --git a/Source/WebCore/inspector/front-end/Images/treeRightTriangleWhite.png b/Source/WebCore/inspector/front-end/Images/treeRightTriangleWhite.png
index 2b6a82f..fcb2eb6 100644
--- a/Source/WebCore/inspector/front-end/Images/treeRightTriangleWhite.png
+++ b/Source/WebCore/inspector/front-end/Images/treeRightTriangleWhite.png
diff --git a/Source/WebCore/inspector/front-end/Images/treeUpTriangleBlack.png b/Source/WebCore/inspector/front-end/Images/treeUpTriangleBlack.png
index ef69dbc..91bde8a 100644
--- a/Source/WebCore/inspector/front-end/Images/treeUpTriangleBlack.png
+++ b/Source/WebCore/inspector/front-end/Images/treeUpTriangleBlack.png
diff --git a/Source/WebCore/inspector/front-end/Images/treeUpTriangleWhite.png b/Source/WebCore/inspector/front-end/Images/treeUpTriangleWhite.png
index 43ce4be..c49a0ae 100644
--- a/Source/WebCore/inspector/front-end/Images/treeUpTriangleWhite.png
+++ b/Source/WebCore/inspector/front-end/Images/treeUpTriangleWhite.png
diff --git a/Source/WebCore/inspector/front-end/Images/undockButtonGlyph.png b/Source/WebCore/inspector/front-end/Images/undockButtonGlyph.png
index eed2b65..bf0a081 100644
--- a/Source/WebCore/inspector/front-end/Images/undockButtonGlyph.png
+++ b/Source/WebCore/inspector/front-end/Images/undockButtonGlyph.png
diff --git a/Source/WebCore/inspector/front-end/Images/userInputIcon.png b/Source/WebCore/inspector/front-end/Images/userInputIcon.png
index 325023f..d00819f 100644
--- a/Source/WebCore/inspector/front-end/Images/userInputIcon.png
+++ b/Source/WebCore/inspector/front-end/Images/userInputIcon.png
diff --git a/Source/WebCore/inspector/front-end/Images/userInputPreviousIcon.png b/Source/WebCore/inspector/front-end/Images/userInputPreviousIcon.png
index 068d572..779f815 100644
--- a/Source/WebCore/inspector/front-end/Images/userInputPreviousIcon.png
+++ b/Source/WebCore/inspector/front-end/Images/userInputPreviousIcon.png
diff --git a/Source/WebCore/inspector/front-end/Images/userInputResultIcon.png b/Source/WebCore/inspector/front-end/Images/userInputResultIcon.png
index 794a5ca..9f77181 100644
--- a/Source/WebCore/inspector/front-end/Images/userInputResultIcon.png
+++ b/Source/WebCore/inspector/front-end/Images/userInputResultIcon.png
diff --git a/Source/WebCore/inspector/front-end/Images/warningIcon.png b/Source/WebCore/inspector/front-end/Images/warningIcon.png
index d5e4c82..3637420 100644
--- a/Source/WebCore/inspector/front-end/Images/warningIcon.png
+++ b/Source/WebCore/inspector/front-end/Images/warningIcon.png
diff --git a/Source/WebCore/inspector/front-end/Images/warningMediumIcon.png b/Source/WebCore/inspector/front-end/Images/warningMediumIcon.png
index 291e111..6a92f67 100644
--- a/Source/WebCore/inspector/front-end/Images/warningMediumIcon.png
+++ b/Source/WebCore/inspector/front-end/Images/warningMediumIcon.png
diff --git a/Source/WebCore/inspector/front-end/Images/warningOrangeDot.png b/Source/WebCore/inspector/front-end/Images/warningOrangeDot.png
index 8c8b635..a193712 100644
--- a/Source/WebCore/inspector/front-end/Images/warningOrangeDot.png
+++ b/Source/WebCore/inspector/front-end/Images/warningOrangeDot.png
diff --git a/Source/WebCore/inspector/front-end/Images/warningsErrors.png b/Source/WebCore/inspector/front-end/Images/warningsErrors.png
index 878b593..c005698 100644
--- a/Source/WebCore/inspector/front-end/Images/warningsErrors.png
+++ b/Source/WebCore/inspector/front-end/Images/warningsErrors.png
diff --git a/Source/WebCore/inspector/front-end/InspectorFrontendHostStub.js b/Source/WebCore/inspector/front-end/InspectorFrontendHostStub.js
index 07f392d..c0bc273 100644
--- a/Source/WebCore/inspector/front-end/InspectorFrontendHostStub.js
+++ b/Source/WebCore/inspector/front-end/InspectorFrontendHostStub.js
@@ -122,6 +122,10 @@ WebInspector.InspectorFrontendHostStub.prototype = {
 
     sendMessageToBackend: function(message)
     {
+    },
+
+    loadSessionSetting: function()
+    {
     }
 }
 
diff --git a/Source/WebCore/inspector/front-end/MetricsSidebarPane.js b/Source/WebCore/inspector/front-end/MetricsSidebarPane.js
index 14039ef..1288973 100644
--- a/Source/WebCore/inspector/front-end/MetricsSidebarPane.js
+++ b/Source/WebCore/inspector/front-end/MetricsSidebarPane.js
@@ -40,7 +40,7 @@ WebInspector.MetricsSidebarPane.prototype = {
         else
             node = this.node;
 
-        if (!node || node.nodeType !== Node.ELEMENT_NODE) {
+        if (!node || node.nodeType() !== Node.ELEMENT_NODE) {
             this.bodyElement.removeChildren();
             return;
         }
diff --git a/Source/WebCore/inspector/front-end/NetworkItemView.js b/Source/WebCore/inspector/front-end/NetworkItemView.js
index 418f559..0e5d14c 100644
--- a/Source/WebCore/inspector/front-end/NetworkItemView.js
+++ b/Source/WebCore/inspector/front-end/NetworkItemView.js
@@ -40,15 +40,26 @@ WebInspector.NetworkItemView = function(resource)
 
     this._tabbedPane = new WebInspector.TabbedPane(this.element);
     this._tabbedPane.appendTab("headers", WebInspector.UIString("Headers"), this._headersView);
+
     if (contentView.hasContent()) {
         // Reusing this view, so hide it at first.
         contentView.visible = false;
         this._tabbedPane.appendTab("content", WebInspector.UIString("Content"), contentView);
     }
+
+    if (resource.type === WebInspector.Resource.Type.XHR && resource.content) {
+        var parsedJSON = WebInspector.ResourceJSONView.parseJSON(resource.content);
+        if (parsedJSON) {
+            var jsonView = new WebInspector.ResourceJSONView(resource, parsedJSON);
+            this._tabbedPane.appendTab("json", WebInspector.UIString("JSON"), jsonView);
+        }
+    }
+
     if (Preferences.showCookiesTab) {
         this._cookiesView = new WebInspector.ResourceCookiesView(resource);
         this._tabbedPane.appendTab("cookies", WebInspector.UIString("Cookies"), this._cookiesView);
     }
+
     if (Preferences.showTimingTab) {
         var timingView = new WebInspector.ResourceTimingView(resource);
         this._tabbedPane.appendTab("timing", WebInspector.UIString("Timing"), timingView);
diff --git a/Source/WebCore/inspector/front-end/NetworkManager.js b/Source/WebCore/inspector/front-end/NetworkManager.js
index 246b53c..98aa060 100644
--- a/Source/WebCore/inspector/front-end/NetworkManager.js
+++ b/Source/WebCore/inspector/front-end/NetworkManager.js
@@ -28,43 +28,34 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-WebInspector.NetworkManager = function(resourceTreeModel)
+WebInspector.NetworkManager = function()
 {
     WebInspector.Object.call(this);
-    this._resourceTreeModel = resourceTreeModel;
-    this._dispatcher = new WebInspector.NetworkDispatcher(resourceTreeModel, this);
-    NetworkAgent.enable(this._processCachedResources.bind(this));
+    this._dispatcher = new WebInspector.NetworkDispatcher(this);
+    NetworkAgent.enable();
 }
 
 WebInspector.NetworkManager.EventTypes = {
     ResourceStarted: "ResourceStarted",
     ResourceUpdated: "ResourceUpdated",
     ResourceFinished: "ResourceFinished",
-    MainResourceCommitLoad: "MainResourceCommitLoad"
+    FrameCommittedLoad: "FrameCommittedLoad",
+    FrameDetached: "FrameDetached"
 }
 
 WebInspector.NetworkManager.prototype = {
     frontendReused: function()
     {
-        WebInspector.panels.network.clear();
-        this._resourceTreeModel.reset();
-        NetworkAgent.enable(this._processCachedResources.bind(this));
+        NetworkAgent.enable();
     },
 
     requestContent: function(resource, base64Encode, callback)
     {
-        function callbackWrapper(success, content)
+        function callbackWrapper(error, content)
         {
-            callback(success ? content : null);
+            callback(!error ? content : null);
         }
-        NetworkAgent.resourceContent(resource.loader.frameId, resource.url, base64Encode, callbackWrapper);
-    },
-
-    _processCachedResources: function(mainFramePayload)
-    {
-        var mainResource = this._dispatcher._addFramesRecursively(mainFramePayload);
-        WebInspector.mainResource = mainResource;
-        mainResource.isMainResource = true;
+        NetworkAgent.getResourceContent(resource.frameId, resource.url, base64Encode, callbackWrapper);
     },
 
     inflightResourceForURL: function(url)
@@ -75,12 +66,11 @@ WebInspector.NetworkManager.prototype = {
 
 WebInspector.NetworkManager.prototype.__proto__ = WebInspector.Object.prototype;
 
-WebInspector.NetworkDispatcher = function(resourceTreeModel, manager)
+WebInspector.NetworkDispatcher = function(manager)
 {
     this._manager = manager;
     this._inflightResourcesById = {};
     this._inflightResourcesByURL = {};
-    this._resourceTreeModel = resourceTreeModel;
     this._lastIdentifierForCachedResource = 0;
     InspectorBackend.registerDomainDispatcher("Network", this);
 }
@@ -88,78 +78,55 @@ WebInspector.NetworkDispatcher = function(resourceTreeModel, manager)
 WebInspector.NetworkDispatcher.prototype = {
     _updateResourceWithRequest: function(resource, request)
     {
-        resource.requestMethod = request.httpMethod;
-        resource.requestHeaders = request.httpHeaderFields;
-        resource.requestFormData = request.requestFormData;
+        resource.requestMethod = request.method;
+        resource.requestHeaders = request.headers;
+        resource.requestFormData = request.postData;
     },
 
     _updateResourceWithResponse: function(resource, response)
     {
-        if (resource.isNull)
+        if (!("status" in response))
             return;
 
         resource.mimeType = response.mimeType;
-        resource.expectedContentLength = response.expectedContentLength;
-        resource.textEncodingName = response.textEncodingName;
-        resource.suggestedFilename = response.suggestedFilename;
-        resource.statusCode = response.httpStatusCode;
-        resource.statusText = response.httpStatusText;
+        resource.statusCode = response.status;
+        resource.statusText = response.statusText;
+        resource.responseHeaders = response.headers;
+        // Raw request headers can be a part of response as well.
+        if (response.requestHeaders)
+            resource.requestHeaders = response.requestHeaders;
 
-        resource.responseHeaders = response.httpHeaderFields;
         resource.connectionReused = response.connectionReused;
         resource.connectionID = response.connectionID;
 
-        if (response.wasCached)
+        if (response.fromDiskCache)
             resource.cached = true;
         else
             resource.timing = response.timing;
-
-        if (response.loadInfo) {
-            if (response.loadInfo.httpStatusCode)
-                resource.statusCode = response.loadInfo.httpStatusCode;
-            if (response.loadInfo.httpStatusText)
-                resource.statusText = response.loadInfo.httpStatusText;
-            resource.requestHeaders = response.loadInfo.requestHeaders;
-            resource.responseHeaders = response.loadInfo.responseHeaders;
-        }
     },
 
     _updateResourceWithCachedResource: function(resource, cachedResource)
     {
         resource.type = WebInspector.Resource.Type[cachedResource.type];
-        resource.resourceSize = cachedResource.encodedSize;
+        resource.resourceSize = cachedResource.bodySize;
         this._updateResourceWithResponse(resource, cachedResource.response);
     },
 
-    identifierForInitialRequest: function(identifier, url, loader, callStack)
-    {
-        this._startResource(this._createResource(identifier, url, loader, callStack));
-    },
-
-    willSendRequest: function(identifier, time, request, redirectResponse)
+    requestWillBeSent: function(identifier, frameId, loaderId, documentURL, request, redirectResponse, time, callStack)
     {
         var resource = this._inflightResourcesById[identifier];
-        if (!resource)
-            return;
-
-        // Redirect may have empty URL and we'd like to not crash with invalid HashMap entry.
-        // See http/tests/misc/will-send-request-returns-null-on-redirect.html
-        var isRedirect = !redirectResponse.isNull && request.url.length;
-        if (isRedirect) {
-            this.didReceiveResponse(identifier, time, "Other", redirectResponse);
-            resource = this._appendRedirect(resource.identifier, time, request.url);
-        }
-
+        if (resource) {
+            this.responseReceived(identifier, time, "Other", redirectResponse);
+            resource = this._appendRedirect(identifier, time, request.url);
+        } else
+            resource = this._createResource(identifier, frameId, loaderId, request.url, documentURL, callStack);
         this._updateResourceWithRequest(resource, request);
         resource.startTime = time;
 
-        if (isRedirect)
-            this._startResource(resource);
-        else
-            this._updateResource(resource);
+        this._startResource(resource);
     },
 
-    markResourceAsCached: function(identifier)
+    resourceMarkedAsCached: function(identifier)
     {
         var resource = this._inflightResourcesById[identifier];
         if (!resource)
@@ -169,7 +136,7 @@ WebInspector.NetworkDispatcher.prototype = {
         this._updateResource(resource);
     },
 
-    didReceiveResponse: function(identifier, time, resourceType, response)
+    responseReceived: function(identifier, time, resourceType, response)
     {
         var resource = this._inflightResourcesById[identifier];
         if (!resource)
@@ -181,22 +148,23 @@ WebInspector.NetworkDispatcher.prototype = {
         this._updateResourceWithResponse(resource, response);
 
         this._updateResource(resource);
-        this._resourceTreeModel.addResourceToFrame(resource.loader.frameId, resource);
     },
 
-    didReceiveContentLength: function(identifier, time, lengthReceived)
+    dataReceived: function(identifier, time, dataLength, lengthReceived)
     {
         var resource = this._inflightResourcesById[identifier];
         if (!resource)
             return;
 
-        resource.resourceSize += lengthReceived;
+        resource.resourceSize += dataLength;
+        if (lengthReceived != -1)
+            resource.increaseTransferSize(lengthReceived);
         resource.endTime = time;
 
         this._updateResource(resource);
     },
 
-    didFinishLoading: function(identifier, finishTime)
+    loadingFinished: function(identifier, finishTime)
     {
         var resource = this._inflightResourcesById[identifier];
         if (!resource)
@@ -205,7 +173,7 @@ WebInspector.NetworkDispatcher.prototype = {
         this._finishResource(resource, finishTime);
     },
 
-    didFailLoading: function(identifier, time, localizedDescription)
+    loadingFailed: function(identifier, time, localizedDescription)
     {
         var resource = this._inflightResourcesById[identifier];
         if (!resource)
@@ -216,24 +184,23 @@ WebInspector.NetworkDispatcher.prototype = {
         this._finishResource(resource, time);
     },
 
-    didLoadResourceFromMemoryCache: function(time, cachedResource)
+    resourceLoadedFromMemoryCache: function(frameId, loaderId, documentURL, time, cachedResource)
     {
-        var resource = this._createResource("cached:" + ++this._lastIdentifierForCachedResource, cachedResource.url, cachedResource.loader);
+        var resource = this._createResource("cached:" + ++this._lastIdentifierForCachedResource, frameId, loaderId, cachedResource.url, documentURL);
         this._updateResourceWithCachedResource(resource, cachedResource);
         resource.cached = true;
         resource.requestMethod = "GET";
         this._startResource(resource);
         resource.startTime = resource.responseReceivedTime = time;
         this._finishResource(resource, time);
-        this._resourceTreeModel.addResourceToFrame(resource.loader.frameId, resource);
     },
 
-    frameDetachedFromParent: function(frameId)
+    frameDetached: function(frameId)
     {
-        this._resourceTreeModel.frameDetachedFromParent(frameId);
+        this._dispatchEventToListeners(WebInspector.NetworkManager.EventTypes.FrameDetached, frameId);
     },
 
-    setInitialContent: function(identifier, sourceString, type)
+    initialContentSet: function(identifier, sourceString, type)
     {
         var resource = WebInspector.networkResourceById(identifier);
         if (!resource)
@@ -244,56 +211,48 @@ WebInspector.NetworkDispatcher.prototype = {
         this._updateResource(resource);
     },
 
-    didCommitLoadForFrame: function(frame, loader)
+    frameNavigated: function(frame, loaderId)
     {
-        this._resourceTreeModel.didCommitLoadForFrame(frame, loader);
-        if (!frame.parentId) {
-            var mainResource = this._resourceTreeModel.resourceForURL(frame.url);
-            if (mainResource) {
-                WebInspector.mainResource = mainResource;
-                mainResource.isMainResource = true;
-                this._dispatchEventToListeners(WebInspector.NetworkManager.EventTypes.MainResourceCommitLoad, mainResource);
-            }
-        }
+        this._dispatchEventToListeners(WebInspector.NetworkManager.EventTypes.FrameCommittedLoad, { frame: frame, loaderId: loaderId });
     },
 
-    didCreateWebSocket: function(identifier, requestURL)
+    webSocketCreated: function(identifier, requestURL)
     {
-        var resource = this._createResource(identifier, requestURL);
+        var resource = this._createResource(identifier, null, null, requestURL);
         resource.type = WebInspector.Resource.Type.WebSocket;
         this._startResource(resource);
     },
 
-    willSendWebSocketHandshakeRequest: function(identifier, time, request)
+    webSocketWillSendHandshakeRequest: function(identifier, time, request)
     {
         var resource = this._inflightResourcesById[identifier];
         if (!resource)
             return;
 
         resource.requestMethod = "GET";
-        resource.requestHeaders = request.webSocketHeaderFields;
-        resource.webSocketRequestKey3 = request.webSocketRequestKey3;
+        resource.requestHeaders = request.headers;
+        resource.webSocketRequestKey3 = request.requestKey3;
         resource.startTime = time;
 
         this._updateResource(resource);
     },
 
-    didReceiveWebSocketHandshakeResponse: function(identifier, time, response)
+    webSocketHandshakeResponseReceived: function(identifier, time, response)
     {
         var resource = this._inflightResourcesById[identifier];
         if (!resource)
             return;
 
-        resource.statusCode = response.statusCode;
+        resource.statusCode = response.status;
         resource.statusText = response.statusText;
-        resource.responseHeaders = response.webSocketHeaderFields;
-        resource.webSocketChallengeResponse = response.webSocketChallengeResponse;
+        resource.responseHeaders = response.headers;
+        resource.webSocketChallengeResponse = response.challengeResponse;
         resource.responseReceivedTime = time;
 
         this._updateResource(resource);
     },
 
-    didCloseWebSocket: function(identifier, time)
+    webSocketClosed: function(identifier, time)
     {
         var resource = this._inflightResourcesById[identifier];
         if (!resource)
@@ -308,7 +267,8 @@ WebInspector.NetworkDispatcher.prototype = {
         originalResource.identifier = "redirected:" + identifier + "." + previousRedirects.length;
         delete originalResource.redirects;
         this._finishResource(originalResource, time);
-        var newResource = this._createResource(identifier, redirectURL, originalResource.loader, originalResource.stackTrace);
+        var newResource = this._createResource(identifier, originalResource.frameId, originalResource.loaderId,
+             redirectURL, originalResource.documentURL, originalResource.stackTrace);
         newResource.redirects = previousRedirects.concat(originalResource);
         return newResource;
     },
@@ -334,44 +294,17 @@ WebInspector.NetworkDispatcher.prototype = {
         delete this._inflightResourcesByURL[resource.url];
     },
 
-    _addFramesRecursively: function(framePayload)
-    {
-        var frameResource = this._createResource(null, framePayload.resource.url, framePayload.resource.loader);
-        this._updateResourceWithRequest(frameResource, framePayload.resource.request);
-        this._updateResourceWithResponse(frameResource, framePayload.resource.response);
-        frameResource.type = WebInspector.Resource.Type["Document"];
-        frameResource.finished = true;
-
-        this._resourceTreeModel.addOrUpdateFrame(framePayload);
-        this._resourceTreeModel.addResourceToFrame(framePayload.id, frameResource);
-
-        for (var i = 0; framePayload.children && i < framePayload.children.length; ++i)
-            this._addFramesRecursively(framePayload.children[i]);
-
-        if (!framePayload.subresources)
-            return;
-
-        for (var i = 0; i < framePayload.subresources.length; ++i) {
-            var cachedResource = framePayload.subresources[i];
-            var resource = this._createResource(null, cachedResource.url, cachedResource.loader);
-            this._updateResourceWithCachedResource(resource, cachedResource);
-            resource.finished = true;
-            this._resourceTreeModel.addResourceToFrame(framePayload.id, resource);
-        }
-        return frameResource;
-    },
-
     _dispatchEventToListeners: function(eventType, resource)
     {
         this._manager.dispatchEventToListeners(eventType, resource);
     },
 
-    _createResource: function(identifier, url, loader, stackTrace)
+    _createResource: function(identifier, frameId, loaderId, url, documentURL, stackTrace)
     {
         var resource = new WebInspector.Resource(identifier, url);
-        resource.loader = loader;
-        if (loader)
-            resource.documentURL = loader.url;
+        resource.documentURL = documentURL;
+        resource.frameId = frameId;
+        resource.loaderId = loaderId;
         resource.stackTrace = stackTrace;
         return resource;
     }
diff --git a/Source/WebCore/inspector/front-end/NetworkPanel.js b/Source/WebCore/inspector/front-end/NetworkPanel.js
index 06983f0..3c497d6 100644
--- a/Source/WebCore/inspector/front-end/NetworkPanel.js
+++ b/Source/WebCore/inspector/front-end/NetworkPanel.js
@@ -40,6 +40,7 @@ WebInspector.NetworkPanel = function()
     this._resourcesByURL = {};
     this._staleResources = [];
     this._resourceGridNodes = {};
+    this._lastResourceGridNodeId = 0;
     this._mainResourceLoadTime = -1;
     this._mainResourceDOMContentTime = -1;
     this._hiddenCategories = {};
@@ -82,7 +83,7 @@ WebInspector.NetworkPanel = function()
     WebInspector.networkManager.addEventListener(WebInspector.NetworkManager.EventTypes.ResourceStarted, this._onResourceStarted, this);
     WebInspector.networkManager.addEventListener(WebInspector.NetworkManager.EventTypes.ResourceUpdated, this._onResourceUpdated, this);
     WebInspector.networkManager.addEventListener(WebInspector.NetworkManager.EventTypes.ResourceFinished, this._onResourceUpdated, this);
-    WebInspector.networkManager.addEventListener(WebInspector.NetworkManager.EventTypes.MainResourceCommitLoad, this._onMainResourceCommitLoad, this);
+    WebInspector.networkManager.addEventListener(WebInspector.NetworkManager.EventTypes.FrameCommittedLoad, this._onFrameCommitLoad, this);
 }
 
 WebInspector.NetworkPanel.prototype = {
@@ -367,7 +368,7 @@ WebInspector.NetworkPanel.prototype = {
         for (var i = 0; i < this._resources.length; ++i) {
             var resource = this._resources[i];
             transferSize += (resource.cached || !resource.transferSize) ? 0 : resource.transferSize;
-            if (resource.isMainResource)
+            if (resource === WebInspector.mainResource)
                 baseTime = resource.startTime;
             if (resource.endTime > maxTime)
                 maxTime = resource.endTime;
@@ -564,7 +565,15 @@ WebInspector.NetworkPanel.prototype = {
 
     _resourceGridNode: function(resource)
     {
-        return this._resourceGridNodes[resource.identifier];
+        return this._resourceGridNodes[resource.__gridNodeId];
+    },
+
+    _createResourceGridNode: function(resource)
+    {
+        var node = new WebInspector.NetworkDataGridNode(this, resource);
+        resource.__gridNodeId = this._lastResourceGridNodeId++;
+        this._resourceGridNodes[resource.__gridNodeId] = node;
+        return node;
     },
 
     revealAndSelectItem: function(resource)
@@ -671,8 +680,7 @@ WebInspector.NetworkPanel.prototype = {
             var node = this._resourceGridNode(resource);
             if (!node) {
                 // Create the timeline tree element and graph.
-                node = new WebInspector.NetworkDataGridNode(this, resource);
-                this._resourceGridNodes[resource.identifier] = node;
+                node = this._createResourceGridNode(resource);
                 this._dataGrid.appendChild(node);
             }
             node.refreshResource();
@@ -794,15 +802,29 @@ WebInspector.NetworkPanel.prototype = {
         this._reset();
     },
 
-    _onMainResourceCommitLoad: function()
+    _onFrameCommitLoad: function(event)
     {
+        if (event.data.frame.parentId)
+            return;
+
+        // Main frame committed load.
         if (this._preserveLogToggle.toggled)
             return;
 
+        // Preserve provisional load resources.
+        var loaderId = event.data.loaderId;
+        var resourcesToPreserve = [];
+        for (var i = 0; i < this._resources.length; ++i) {
+            var resource = this._resources[i];
+            if (resource.loaderId === loaderId)
+                resourcesToPreserve.push(resource);
+        }
+
         this._reset();
-        // Now resurrect the main resource along with all redirects that lead to it.
-        var resourcesToAppend = (WebInspector.mainResource.redirects || []).concat(WebInspector.mainResource);
-        resourcesToAppend.forEach(this._appendResource, this);
+
+        // Restore preserved items.
+        for (var i = 0; i < resourcesToPreserve.length; ++i)
+            this._appendResource(resourcesToPreserve[i]);
     },
 
     canShowSourceLine: function(url, line)
@@ -972,16 +994,12 @@ WebInspector.NetworkPanel.prototype = {
 
     _contextMenu: function(event)
     {
-        // createBlobURL is enabled conditionally, do not expose resource export if it's not available.
-        if ((window.webkitURL && typeof window.webkitURL.createObjectURL !== "function") || !Preferences.resourceExportEnabled)
-            return;
-
         var contextMenu = new WebInspector.ContextMenu();
         var gridNode = this._dataGrid.dataGridNodeFromNode(event.target);
         var resource = gridNode && gridNode._resource;
         if (resource)
-            contextMenu.appendItem(WebInspector.UIString("Export to HAR"), this._exportResource.bind(this, resource));
-        contextMenu.appendItem(WebInspector.UIString("Export all to HAR"), this._exportAll.bind(this));
+            contextMenu.appendItem(WebInspector.UIString("Copy entry as HAR"), this._exportResource.bind(this, resource));
+        contextMenu.appendItem(WebInspector.UIString("Copy network log as HAR"), this._exportAll.bind(this));
         contextMenu.show(event);
     },
 
@@ -1359,7 +1377,7 @@ WebInspector.NetworkDataGridNode.prototype = {
 
     _openInNewTab: function()
     {
-        InspectorAgent.openInInspectedWindow(this._resource.url);
+        PageAgent.openInInspectedWindow(this._resource.url);
     },
 
     get selectable()
diff --git a/Source/WebCore/inspector/front-end/ObjectPropertiesSection.js b/Source/WebCore/inspector/front-end/ObjectPropertiesSection.js
index 88fddd6..1795843 100644
--- a/Source/WebCore/inspector/front-end/ObjectPropertiesSection.js
+++ b/Source/WebCore/inspector/front-end/ObjectPropertiesSection.js
@@ -184,7 +184,7 @@ WebInspector.ObjectPropertyTreeElement.prototype = {
         var description = this.property.value.description;
         // Render \n as a nice unicode cr symbol.
         if (this.property.value.type === "string" && typeof description === "string")
-            description = description.replace(/\n/g, "\u21B5");
+            description = "\"" + description.replace(/\n/g, "\u21B5") + "\"";
         this.valueElement.textContent = description;
 
         if (this.property.isGetter)
@@ -278,23 +278,23 @@ WebInspector.ObjectPropertyTreeElement.prototype = {
     {
         expression = expression.trim();
         var expressionLength = expression.length;
-        var self = this;
-        var callback = function(success) {
+        function callback(error)
+        {
             if (!updateInterface)
                 return;
 
-            if (!success)
-                self.update();
+            if (error)
+                this.update();
 
             if (!expressionLength) {
                 // The property was deleted, so remove this tree element.
-                self.parent.removeChild(this);
+                this.parent.removeChild(this);
             } else {
                 // Call updateSiblings since their value might be based on the value that just changed.
-                self.updateSiblings();
+                this.updateSiblings();
             }
         };
-        this.property.parentObject.setPropertyValue(this.property.name, expression.trim(), callback);
+        this.property.parentObject.setPropertyValue(this.property.name, expression.trim(), callback.bind(this));
     }
 }
 
diff --git a/Source/WebCore/inspector/front-end/ProfileView.js b/Source/WebCore/inspector/front-end/ProfileView.js
index 335bf03..a8c5ff4 100644
--- a/Source/WebCore/inspector/front-end/ProfileView.js
+++ b/Source/WebCore/inspector/front-end/ProfileView.js
@@ -81,8 +81,10 @@ WebInspector.CPUProfileView = function(profile)
     this.profile = profile;
 
     var self = this;
-    function profileCallback(profile)
+    function profileCallback(error, profile)
     {
+        if (error)
+            return;
         self.profile.head = profile.head;
         self._assignParentsInProfile();
       
@@ -593,9 +595,9 @@ WebInspector.CPUProfileType.prototype = {
         this._recording = !this._recording;
 
         if (this._recording)
-            InspectorAgent.startProfiling();
+            ProfilerAgent.start();
         else
-            InspectorAgent.stopProfiling();
+            ProfilerAgent.stop();
     },
 
     get welcomeMessage()
diff --git a/Source/WebCore/inspector/front-end/ProfilesPanel.js b/Source/WebCore/inspector/front-end/ProfilesPanel.js
index e5fb49e..ea5327b 100644
--- a/Source/WebCore/inspector/front-end/ProfilesPanel.js
+++ b/Source/WebCore/inspector/front-end/ProfilesPanel.js
@@ -124,7 +124,26 @@ WebInspector.ProfilesPanel = function()
     this._profiles = [];
     this._profilerEnabled = Preferences.profilerAlwaysEnabled;
     this._reset();
+
+    this._registerProfileType(new WebInspector.CPUProfileType());
+    if (Preferences.heapProfilerPresent) {
+        if (!Preferences.detailedHeapProfiles)
+            this._registerProfileType(new WebInspector.HeapSnapshotProfileType());
+        else
+            this._registerProfileType(new WebInspector.DetailedHeapshotProfileType());
+    }
+
     InspectorBackend.registerDomainDispatcher("Profiler", new WebInspector.ProfilerDispatcher(this));
+
+    if (Preferences.profilerAlwaysEnabled || WebInspector.settings.profilerEnabled)
+        ProfilerAgent.enable();
+    else {
+        function onProfilerEnebled(error, value) {
+            if (value)
+                this._profilerWasEnabled();
+        }
+        ProfilerAgent.isEnabled(onProfilerEnebled.bind(this));
+    }
 }
 
 WebInspector.ProfilesPanel.prototype = {
@@ -230,7 +249,7 @@ WebInspector.ProfilesPanel.prototype = {
         this._reset();
     },
 
-    registerProfileType: function(profileType)
+    _registerProfileType: function(profileType)
     {
         this._profileTypesByIdMap[profileType.id] = profileType;
         profileType.treeElement = new WebInspector.SidebarSectionTreeElement(profileType.name, null, true);
@@ -614,10 +633,10 @@ WebInspector.ProfilesPanel.prototype = {
     {
         if (this._profilerEnabled) {
             WebInspector.settings.profilerEnabled = false;
-            InspectorAgent.disableProfiler(true);
+            ProfilerAgent.disable();
         } else {
             WebInspector.settings.profilerEnabled = !!optionalAlways;
-            InspectorAgent.enableProfiler();
+            ProfilerAgent.enable();
         }
     },
 
@@ -626,7 +645,9 @@ WebInspector.ProfilesPanel.prototype = {
         if (!this._profilerEnabled || this._profilesWereRequested)
             return;
 
-        function populateCallback(profileHeaders) {
+        function populateCallback(error, profileHeaders) {
+            if (error)
+                return;
             profileHeaders.sort(function(a, b) { return a.uid - b.uid; });
             var profileHeadersLength = profileHeaders.length;
             for (var i = 0; i < profileHeadersLength; ++i)
diff --git a/Source/WebCore/inspector/front-end/PropertiesSidebarPane.js b/Source/WebCore/inspector/front-end/PropertiesSidebarPane.js
index 0c314bc..4df313c 100644
--- a/Source/WebCore/inspector/front-end/PropertiesSidebarPane.js
+++ b/Source/WebCore/inspector/front-end/PropertiesSidebarPane.js
@@ -42,20 +42,19 @@ WebInspector.PropertiesSidebarPane.prototype = {
             return;
         }
 
-        RuntimeAgent.releaseObjectGroup(0, "dom-selection");
         WebInspector.RemoteObject.resolveNode(node, nodeResolved.bind(this));
 
-        function nodeResolved(objectPayload)
+        function nodeResolved(object)
         {
-            if (!objectPayload)
+            if (!object)
                 return;
-            var object = WebInspector.RemoteObject.fromPayload(objectPayload);
             object.evaluate("var proto = this; result = {}; var counter = 1; while (proto) { result[counter++] = proto; proto = proto.__proto__ }; return result;", nodePrototypesReady.bind(this));
+            object.release();
         }
 
-        function nodePrototypesReady(objectPayload)
+        function nodePrototypesReady(error, objectPayload)
         {
-            if (!objectPayload)
+            if (error || !objectPayload)
                 return;
             var object = WebInspector.RemoteObject.fromPayload(objectPayload);
             object.getOwnProperties(false, fillSection.bind(this));
diff --git a/Source/WebCore/inspector/front-end/RemoteObject.js b/Source/WebCore/inspector/front-end/RemoteObject.js
index 4a20cf1..294be50 100644
--- a/Source/WebCore/inspector/front-end/RemoteObject.js
+++ b/Source/WebCore/inspector/front-end/RemoteObject.js
@@ -48,11 +48,17 @@ WebInspector.RemoteObject.fromLocalObject = function(value)
 
 WebInspector.RemoteObject.resolveNode = function(node, callback)
 {
-    function mycallback(object)
+    function mycallback(error, object)
     {
-        callback(object ? WebInspector.RemoteObject.fromPayload(object) : null);
+        if (!callback)
+            return;
+
+        if (error || !object)
+            callback(null);
+        else
+            callback(WebInspector.RemoteObject.fromPayload(object));
     }
-    DOMAgent.resolveNode(node.id, "dom-selection", mycallback);
+    DOMAgent.resolveNode(node.id, mycallback);
 }
 
 WebInspector.RemoteObject.fromPayload = function(payload)
@@ -112,8 +118,10 @@ WebInspector.RemoteObject.prototype = {
             callback([]);
             return;
         }
-        function remoteObjectBinder(properties)
+        function remoteObjectBinder(error, properties)
         {
+            if (error)
+                return;
             for (var i = 0; properties && i < properties.length; ++i)
                 properties[i].value = WebInspector.RemoteObject.fromPayload(properties[i].value);
             callback(properties);
@@ -124,7 +132,7 @@ WebInspector.RemoteObject.prototype = {
     setPropertyValue: function(name, value, callback)
     {
         if (!this._objectId) {
-            callback(false);
+            callback("Can't get a property of non-object.");
             return;
         }
         RuntimeAgent.setPropertyValue(this._objectId, name, value, callback);
@@ -141,6 +149,11 @@ WebInspector.RemoteObject.prototype = {
     evaluate: function(expression, callback)
     {
         RuntimeAgent.evaluateOn(this._objectId, expression, callback);
+    },
+
+    release: function()
+    {
+        RuntimeAgent.releaseObject(this._objectId);
     }
 }
 
@@ -164,15 +177,50 @@ WebInspector.LocalJSONObject = function(value)
 WebInspector.LocalJSONObject.prototype = {
     get description()
     {
+        if (this._cachedDescription)
+            return this._cachedDescription;
+
         var type = this.type;
+
         switch (type) {
             case "array":
-                return "[" + this._value.length + "]";
+                function formatArrayItem(property)
+                {
+                    return property.value.description;
+                }
+                this._cachedDescription = this._concatenate("[", "]", formatArrayItem);
+                break;
             case "object":
-                return this.hasChildren ? "{...}" : "{ }";
+                function formatObjectItem(property)
+                {
+                    return property.name + ":" + property.value.description;
+                }
+                this._cachedDescription = this._concatenate("{", "}", formatObjectItem);
+                break;
             default:
-                return JSON.stringify(this._value);
+                this._cachedDescription = String(this._value);
         }
+        return this._cachedDescription;
+    },
+
+    _concatenate: function(prefix, suffix, formatProperty)
+    {
+        const previewChars = 100;
+
+        var buffer = prefix;
+        var children = this._children();
+        for (var i = 0; i < children.length; ++i) {
+            var itemDescription = formatProperty(children[i]);
+            if (buffer.length + itemDescription.length > previewChars) {
+                buffer += ",\u2026";
+                break;
+            }
+            if (i)
+                buffer += ", ";
+            buffer += itemDescription;
+        }
+        buffer += suffix;
+        return buffer;
     },
 
     get type()
@@ -196,11 +244,18 @@ WebInspector.LocalJSONObject.prototype = {
 
     getProperties: function(ignoreHasOwnProperty, abbreviate, callback)
     {
+        callback(this._children());
+    },
+
+    _children: function()
+    {
         function buildProperty(propName)
         {
             return new WebInspector.RemoteObjectProperty(propName, new WebInspector.LocalJSONObject(this._value[propName]));
         }
-        callback(Object.keys(this._value).map(buildProperty.bind(this)));
+        if (!this._cachedChildren)
+            this._cachedChildren = Object.keys(this._value).map(buildProperty.bind(this));
+        return this._cachedChildren;
     },
 
     isError: function()
diff --git a/Source/WebCore/inspector/front-end/Resource.js b/Source/WebCore/inspector/front-end/Resource.js
index 6cf5b9c..8035fd8 100644
--- a/Source/WebCore/inspector/front-end/Resource.js
+++ b/Source/WebCore/inspector/front-end/Resource.js
@@ -241,7 +241,10 @@ WebInspector.Resource.prototype = {
             return 0;
         if (this.statusCode === 304) // Not modified
             return this._responseHeadersSize;
-        // FIXME: We prefer using Content-Length over resourceSize as
+        if (this._transferSize !== undefined)
+            return this._transferSize;
+        // If we did not receive actual transfer size from network
+        // stack, we prefer using Content-Length over resourceSize as
         // resourceSize may differ from actual transfer size if platform's
         // network stack performed decoding (e.g. gzip decompression).
         // The Content-Length, though, is expected to come from raw
@@ -249,19 +252,14 @@ WebInspector.Resource.prototype = {
         // This won't work for chunked content encoding, so fall back to
         // resourceSize when we don't have Content-Length. This still won't
         // work for chunks with non-trivial encodings. We need a way to
-        // get actaul transfer size from the network stack.
+        // get actual transfer size from the network stack.
         var bodySize = Number(this.responseHeaders["Content-Length"] || this.resourceSize);
         return this._responseHeadersSize + bodySize;
     },
 
-    get expectedContentLength()
+    increaseTransferSize: function(x)
     {
-        return this._expectedContentLength || 0;
-    },
-
-    set expectedContentLength(x)
-    {
-        this._expectedContentLength = x;
+        this._transferSize = (this._transferSize || 0) + x;
     },
 
     get finished()
diff --git a/Source/WebCore/inspector/front-end/ResourceJSONView.js b/Source/WebCore/inspector/front-end/ResourceJSONView.js
new file mode 100644
index 0000000..694b100
--- /dev/null
+++ b/Source/WebCore/inspector/front-end/ResourceJSONView.js
@@ -0,0 +1,75 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+WebInspector.ResourceJSONView = function(resource, parsedJSON)
+{
+    WebInspector.ResourceView.call(this, resource);
+    this._parsedJSON = parsedJSON;
+    this.element.addStyleClass("json");
+}
+
+WebInspector.ResourceJSONView.parseJSON = function(text)
+{
+    // Trim while(1), for(;;), weird numbers, etc. We need JSON start.
+    var start = /[{[]/.exec(text);
+    if (start && start.index)
+        text = text.substring(start.index);
+
+    try {
+        return JSON.parse(text);
+    } catch (e) {
+        return;
+    }
+}
+
+WebInspector.ResourceJSONView.prototype = {
+    hasContent: function()
+    {
+        return true;
+    },
+
+    show: function(parentElement)
+    {
+        WebInspector.ResourceView.prototype.show.call(this, parentElement);
+        this._initialize();
+    },
+
+    _initialize: function()
+    {
+        if (this._initialized)
+            return;
+        this._initialized = true;
+
+        var obj = WebInspector.RemoteObject.fromLocalObject(this._parsedJSON);
+        this.element.appendChild(new WebInspector.ObjectPropertiesSection(obj, obj.description, null, true).element);
+    }
+}
+
+WebInspector.ResourceJSONView.prototype.__proto__ = WebInspector.ResourceView.prototype;
diff --git a/Source/WebCore/inspector/front-end/ResourceTreeModel.js b/Source/WebCore/inspector/front-end/ResourceTreeModel.js
index da2d47a..fa2c44e 100644
--- a/Source/WebCore/inspector/front-end/ResourceTreeModel.js
+++ b/Source/WebCore/inspector/front-end/ResourceTreeModel.js
@@ -29,62 +29,131 @@
  */
 
 
-WebInspector.ResourceTreeModel = function()
+WebInspector.ResourceTreeModel = function(networkManager)
 {
-    this.reset();
+    WebInspector.networkManager.addEventListener(WebInspector.NetworkManager.EventTypes.ResourceFinished, this._onResourceUpdated, this);
+    WebInspector.networkManager.addEventListener(WebInspector.NetworkManager.EventTypes.ResourceUpdated, this._onResourceUpdated, this);
+    WebInspector.networkManager.addEventListener(WebInspector.NetworkManager.EventTypes.FrameDetached, this._onFrameDetachedFromParent, this);
+    WebInspector.networkManager.addEventListener(WebInspector.NetworkManager.EventTypes.FrameCommittedLoad, this._onCommitLoad, this);
+
+    this.frontendReused();
+}
+
+WebInspector.ResourceTreeModel.EventTypes = {
+    FrameAdded: "FrameAdded",
+    FrameNavigated: "FrameNavigated",
+    FrameDetached: "FrameDetached",
+    ResourceAdded: "ResourceAdded"
 }
 
 WebInspector.ResourceTreeModel.prototype = {
-    reset: function()
+    frontendReused: function()
     {
         this._resourcesByURL = {};
         this._resourcesByFrameId = {};
         this._subframes = {};
-        if (WebInspector.panels)
-            WebInspector.panels.resources.clear();
+        NetworkAgent.getCachedResources(this._processCachedResources.bind(this));
+    },
+
+    _processCachedResources: function(error, mainFramePayload)
+    {
+        if (error)
+            return;
+
+        this.dispatchEventToListeners(WebInspector.ResourceTreeModel.EventTypes.FrameNavigated, 0);
+
+        WebInspector.mainResource = this._addFramesRecursively(mainFramePayload);
+        this._cachedResourcesProcessed = true;
     },
 
-    addOrUpdateFrame: function(frame)
+    _addOrUpdateFrame: function(frame)
     {
-        var tmpResource = new WebInspector.Resource(null, frame.url);
-        WebInspector.panels.resources.addOrUpdateFrame(frame.parentId, frame.id, frame.name, tmpResource.displayName);
+        this.dispatchEventToListeners(WebInspector.ResourceTreeModel.EventTypes.FrameAdded, frame);
+
         var subframes = this._subframes[frame.parentId];
         if (!subframes) {
-            subframes = {};
+            subframes = [];
             this._subframes[frame.parentId || 0] = subframes;
         }
-        subframes[frame.id] = true;
+        subframes.push(frame);
     },
 
-    didCommitLoadForFrame: function(frame, loader)
+    frames: function(parentFrameId)
     {
+        return this._subframes[parentFrameId] || [];
+    },
+
+    subframes: function(parentFrameId)
+    {
+        return this._subframes[parentFrameId] || [];
+    },
+
+    resources: function(frameId)
+    {
+        var result = [];
+        var resources = this._resourcesByFrameId[frameId] || {};
+        for (var url in resources)
+            result.push(resources[url]);
+        return result;
+    },
+
+    _onCommitLoad: function(event)
+    {
+        if (!this._cachedResourcesProcessed)
+            return;
+
+        var frame = event.data.frame;
+        var loaderId = event.data.loaderId;
+        var isMainFrame = !frame.parentId;
+
         // frame.parentId === 0 is when main frame navigation happens.
-        this._clearChildFramesAndResources(frame.parentId ? frame.id : 0, loader.loaderId);
+        this._clearChildFramesAndResources(isMainFrame ? 0 : frame.id, loaderId);
 
-        this.addOrUpdateFrame(frame);
+        this._addOrUpdateFrame(frame);
 
         var resourcesForFrame = this._resourcesByFrameId[frame.id];
-        for (var i = 0; resourcesForFrame && i < resourcesForFrame.length; ++i)
-            WebInspector.panels.resources.addResourceToFrame(frame.id, resourcesForFrame[i]);
+        if (resourcesForFrame) {
+            for (var url in resourcesForFrame)
+                this.dispatchEventToListeners(WebInspector.ResourceTreeModel.EventTypes.ResourceAdded, resourcesForFrame[url]);
+        }
+
+        if (isMainFrame && this.resourceForURL(frame.url))
+            WebInspector.mainResource = this.resourceForURL(frame.url);
     },
 
-    frameDetachedFromParent: function(frameId)
+    _onFrameDetachedFromParent: function(event)
     {
+        if (!this._cachedResourcesProcessed)
+            return;
+
+        var frameId = event.data;
         this._clearChildFramesAndResources(frameId, 0);
-        WebInspector.panels.resources.removeFrame(frameId);
+        this.dispatchEventToListeners(WebInspector.ResourceTreeModel.EventTypes.FrameDetached, frameId);
+    },
+
+    _onResourceUpdated: function(event)
+    {
+        if (!this._cachedResourcesProcessed)
+            return;
+        this._addResourceToFrame(event.data);
     },
 
-    addResourceToFrame: function(frameId, resource)
+    _addResourceToFrame: function(resource)
     {
+        var frameId = resource.frameId;
         var resourcesForFrame = this._resourcesByFrameId[frameId];
         if (!resourcesForFrame) {
-            resourcesForFrame = [];
+            resourcesForFrame = {};
             this._resourcesByFrameId[frameId] = resourcesForFrame;
         }
-        resourcesForFrame.push(resource);
-        this._bindResourceURL(resource);
+        if (resourcesForFrame[resource.url] === resource) {
+            // Already in the tree, we just got an extra update.
+            return;
+        }
 
-        WebInspector.panels.resources.addResourceToFrame(frameId, resource);
+        resourcesForFrame[resource.url] = resource;
+        this._bindResourceURL(resource);
+        this.dispatchEventToListeners(WebInspector.ResourceTreeModel.EventTypes.ResourceAdded, resource);
     },
 
     forAllResources: function(callback)
@@ -108,7 +177,7 @@ WebInspector.ResourceTreeModel.prototype = {
         }
 
         var view = WebInspector.ResourceView.resourceViewForResource(resource);
-        if (view.addMessage)
+        if (view.addMessage && msg.isErrorOrWarning() && msg.message)
             view.addMessage(msg);
     },
 
@@ -123,36 +192,23 @@ WebInspector.ResourceTreeModel.prototype = {
 
     resourceForURL: function(url)
     {
-        // FIXME: receive frameId here.
-        var entry = this._resourcesByURL[url];
-        if (entry instanceof Array)
-            return entry[0];
-        return entry;
+        return this._resourcesByURL[url];
     },
 
     _bindResourceURL: function(resource)
     {
-        var resourceForURL = this._resourcesByURL[resource.url];
-        if (!resourceForURL)
-            this._resourcesByURL[resource.url] = resource;
-        else if (resourceForURL instanceof Array)
-            resourceForURL.push(resource);
-        else
-            this._resourcesByURL[resource.url] = [resourceForURL, resource];
+        this._resourcesByURL[resource.url] = resource;
     },
 
-    _clearChildFramesAndResources: function(frameId, loaderId)
+    _clearChildFramesAndResources: function(frameId, loaderToPreserveId)
     {
-        WebInspector.panels.resources.removeResourcesFromFrame(frameId);
+        this.dispatchEventToListeners(WebInspector.ResourceTreeModel.EventTypes.FrameNavigated, frameId);
 
-        this._clearResources(frameId, loaderId);
+        this._clearResources(frameId, loaderToPreserveId);
         var subframes = this._subframes[frameId];
-        if (!subframes)
-            return;
-
-        for (var childFrameId in subframes) {
-            WebInspector.panels.resources.removeFrame(childFrameId);
-            this._clearChildFramesAndResources(childFrameId, loaderId);
+        for (var i = 0; subframes && i < subframes.length; ++ i) {
+            this.dispatchEventToListeners(WebInspector.ResourceTreeModel.EventTypes.FrameRemoved, subframes[i].id);
+            this._clearChildFramesAndResources(subframes[i].id, loaderToPreserveId);
         }
         delete this._subframes[frameId];
     },
@@ -164,51 +220,81 @@ WebInspector.ResourceTreeModel.prototype = {
             return;
 
         var preservedResourcesForFrame = [];
-        for (var i = 0; i < resourcesForFrame.length; ++i) {
-            var resource = resourcesForFrame[i];
-            if (resource.loader.loaderId === loaderToPreserveId) {
-                preservedResourcesForFrame.push(resource);
+        for (var url in resourcesForFrame) {
+            var resource = resourcesForFrame[url];
+            if (resource.loaderId === loaderToPreserveId) {
+                preservedResourcesForFrame[url] = resource;
                 continue;
             }
             this._unbindResourceURL(resource);
         }
 
         delete this._resourcesByFrameId[frameId];
-        if (preservedResourcesForFrame.length)
+        if (preservedResourcesForFrame.length) {
             this._resourcesByFrameId[frameId] = preservedResourcesForFrame;
+        }
     },
 
     _callForFrameResources: function(frameId, callback)
     {
         var resources = this._resourcesByFrameId[frameId];
-        for (var i = 0; resources && i < resources.length; ++i) {
-            if (callback(resources[i]))
+        if (!resources)
+            return;
+
+        for (var url in resources) {
+            if (callback(resources[url]))
                 return true;
         }
         
         var frames = this._subframes[frameId];
-        if (frames) {
-            for (var id in frames) {
-                if (this._callForFrameResources(id, callback))
-                    return true;
-            }
+        for (var i = 0; frames && i < frames.length; ++i) {
+            if (this._callForFrameResources(frames[i].id, callback))
+                return true;
         }
         return false;
     },
 
     _unbindResourceURL: function(resource)
     {
-        var resourceForURL = this._resourcesByURL[resource.url];
-        if (!resourceForURL)
-            return;
+        delete this._resourcesByURL[resource.url];
+    },
+
+    _addFramesRecursively: function(frameTreePayload)
+    {
+        var framePayload = frameTreePayload.frame;
+
+        // Create frame resource.
+        var frameResource = this._createResource(framePayload, framePayload.url);
+        frameResource.type = WebInspector.Resource.Type.Document;
+        frameResource.finished = true;
+
+        this._addOrUpdateFrame(framePayload);
+        this._addResourceToFrame(frameResource);
 
-        if (resourceForURL instanceof Array) {
-            resourceForURL.remove(resource, true);
-            if (resourceForURL.length === 1)
-                this._resourcesByURL[resource.url] = resourceForURL[0];
+        for (var i = 0; frameTreePayload.childFrames && i < frameTreePayload.childFrames.length; ++i)
+            this._addFramesRecursively(frameTreePayload.childFrames[i]);
+
+        if (!frameTreePayload.resources)
             return;
+
+        // Create frame subresources.
+        for (var i = 0; i < frameTreePayload.resources.length; ++i) {
+            var subresource = frameTreePayload.resources[i];
+            var resource = this._createResource(framePayload, subresource.url);
+            resource.type = WebInspector.Resource.Type[subresource.type];
+            resource.finished = true;
+            this._addResourceToFrame(resource);
         }
+        return frameResource;
+    },
 
-        delete this._resourcesByURL[resource.url];
+    _createResource: function(frame, url)
+    {
+        var resource = new WebInspector.Resource(null, url);
+        resource.frameId = frame.id;
+        resource.loaderId = frame.loaderId;
+        return resource;
     }
 }
+
+WebInspector.ResourceTreeModel.prototype.__proto__ = WebInspector.Object.prototype;
diff --git a/Source/WebCore/inspector/front-end/ResourceView.js b/Source/WebCore/inspector/front-end/ResourceView.js
index 83cf99d5..ffd9062 100644
--- a/Source/WebCore/inspector/front-end/ResourceView.js
+++ b/Source/WebCore/inspector/front-end/ResourceView.js
@@ -45,15 +45,20 @@ WebInspector.ResourceView.prototype.__proto__ = WebInspector.View.prototype;
 
 WebInspector.ResourceView.createResourceView = function(resource)
 {
+    function sourceFrameForDelegateAndURL(delegate, url)
+    {
+        var view = new WebInspector.SourceFrame(delegate, url);
+        view.resource = resource;
+        return view;
+    }
+
     switch (resource.category) {
     case WebInspector.resourceCategories.documents:
-    case WebInspector.resourceCategories.stylesheets:
     case WebInspector.resourceCategories.scripts:
     case WebInspector.resourceCategories.xhr:
-        var delegate = new WebInspector.SourceFrameDelegateForResourcesPanel(resource);
-        var view = new WebInspector.SourceFrame(delegate, resource.url);
-        view.resource = resource;
-        return view;
+        return sourceFrameForDelegateAndURL(new WebInspector.SourceFrameDelegateForResourcesPanel(resource), resource.url);
+    case WebInspector.resourceCategories.stylesheets:
+        return sourceFrameForDelegateAndURL(new WebInspector.CSSSourceFrameDelegateForResourcesPanel(resource), resource.url);
     case WebInspector.resourceCategories.images:
         return new WebInspector.ImageView(resource);
     case WebInspector.resourceCategories.fonts:
@@ -147,3 +152,56 @@ WebInspector.SourceFrameDelegateForResourcesPanel.prototype = {
 }
 
 WebInspector.SourceFrameDelegateForResourcesPanel.prototype.__proto__ = WebInspector.SourceFrameDelegate.prototype;
+
+
+WebInspector.CSSSourceFrameDelegateForResourcesPanel = function(resource)
+{
+    WebInspector.SourceFrameDelegateForResourcesPanel.call(this, resource);
+}
+
+WebInspector.CSSSourceFrameDelegateForResourcesPanel.prototype = {
+    canEditScriptSource: function()
+    {
+        return true;
+    },
+
+    editScriptSource: function(newText)
+    {
+        function handleStyleSheet(newText, styleSheet)
+        {
+            this._styleSheet = styleSheet;
+            this._saveStyleSheet(newText);
+        }
+
+        function handleInfos(newText, error, infos)
+        {
+            if (error)
+                return;
+            for (var i = 0; i < infos.length; ++i) {
+                var info = infos[i];
+                if (info.sourceURL === this._resource.url) {
+                    WebInspector.CSSStyleSheet.createForId(info.styleSheetId, handleStyleSheet.bind(this, newText));
+                    break;
+                }
+            }
+        }
+
+        if (this._styleSheet)
+            this._saveStyleSheet(newText);
+        else
+            CSSAgent.getAllStyleSheets(handleInfos.bind(this, newText));
+    },
+
+    _saveStyleSheet: function(newText)
+    {
+        function callback(success)
+        {
+            if (!success)
+                console.error("Failed to save modified stylesheet %s", this._resource.url);
+        }
+
+        this._styleSheet.setText(newText, callback.bind(this));
+    }
+}
+
+WebInspector.CSSSourceFrameDelegateForResourcesPanel.prototype.__proto__ = WebInspector.SourceFrameDelegateForResourcesPanel.prototype;
diff --git a/Source/WebCore/inspector/front-end/ResourcesPanel.js b/Source/WebCore/inspector/front-end/ResourcesPanel.js
index 3c85892..c65e6b7 100644
--- a/Source/WebCore/inspector/front-end/ResourcesPanel.js
+++ b/Source/WebCore/inspector/front-end/ResourcesPanel.js
@@ -34,26 +34,28 @@ WebInspector.ResourcesPanel = function(database)
     WebInspector.settings.installApplicationSetting("resourcesLastSelectedItem", {});
 
     this.createSidebar();
-    this.sidebarElement.addStyleClass("outline-disclosure filter-all children small");
+    this.sidebarElement.addStyleClass("outline-disclosure");
+    this.sidebarElement.addStyleClass("filter-all");
+    this.sidebarElement.addStyleClass("children");
+    this.sidebarElement.addStyleClass("small");
     this.sidebarTreeElement.removeStyleClass("sidebar-tree");
 
-    this.resourcesListTreeElement = new WebInspector.StorageCategoryTreeElement(this, WebInspector.UIString("Frames"), "Frames", "frame-storage-tree-item");
+    this.resourcesListTreeElement = new WebInspector.StorageCategoryTreeElement(this, WebInspector.UIString("Frames"), "Frames", ["frame-storage-tree-item"]);
     this.sidebarTree.appendChild(this.resourcesListTreeElement);
-    this._treeElementForFrameId = {};
 
-    this.databasesListTreeElement = new WebInspector.StorageCategoryTreeElement(this, WebInspector.UIString("Databases"), "Databases", "database-storage-tree-item");
+    this.databasesListTreeElement = new WebInspector.StorageCategoryTreeElement(this, WebInspector.UIString("Databases"), "Databases", ["database-storage-tree-item"]);
     this.sidebarTree.appendChild(this.databasesListTreeElement);
 
-    this.localStorageListTreeElement = new WebInspector.StorageCategoryTreeElement(this, WebInspector.UIString("Local Storage"), "LocalStorage", "domstorage-storage-tree-item local-storage");
+    this.localStorageListTreeElement = new WebInspector.StorageCategoryTreeElement(this, WebInspector.UIString("Local Storage"), "LocalStorage", ["domstorage-storage-tree-item", "local-storage"]);
     this.sidebarTree.appendChild(this.localStorageListTreeElement);
 
-    this.sessionStorageListTreeElement = new WebInspector.StorageCategoryTreeElement(this, WebInspector.UIString("Session Storage"), "SessionStorage", "domstorage-storage-tree-item session-storage");
+    this.sessionStorageListTreeElement = new WebInspector.StorageCategoryTreeElement(this, WebInspector.UIString("Session Storage"), "SessionStorage", ["domstorage-storage-tree-item", "session-storage"]);
     this.sidebarTree.appendChild(this.sessionStorageListTreeElement);
 
-    this.cookieListTreeElement = new WebInspector.StorageCategoryTreeElement(this, WebInspector.UIString("Cookies"), "Cookies", "cookie-storage-tree-item");
+    this.cookieListTreeElement = new WebInspector.StorageCategoryTreeElement(this, WebInspector.UIString("Cookies"), "Cookies", ["cookie-storage-tree-item"]);
     this.sidebarTree.appendChild(this.cookieListTreeElement);
 
-    this.applicationCacheListTreeElement = new WebInspector.StorageCategoryTreeElement(this, WebInspector.UIString("Application Cache"), "ApplicationCache", "application-cache-storage-tree-item");
+    this.applicationCacheListTreeElement = new WebInspector.StorageCategoryTreeElement(this, WebInspector.UIString("Application Cache"), "ApplicationCache", ["application-cache-storage-tree-item"]);
     this.sidebarTree.appendChild(this.applicationCacheListTreeElement);
 
     this.storageViews = document.createElement("div");
@@ -96,10 +98,10 @@ WebInspector.ResourcesPanel.prototype = {
     {
         WebInspector.Panel.prototype.show.call(this);
 
+        this._populateResourceTree();
+
         if (this.visibleView && this.visibleView.resource)
             this._showResourceView(this.visibleView.resource);
-
-        this._initDefaultSelection();
     },
 
     loadEventFired: function()
@@ -165,15 +167,42 @@ WebInspector.ResourcesPanel.prototype = {
             this.sidebarTree.selectedTreeElement.deselect();
     },
 
-    clear: function()
+    _populateResourceTree: function()
     {
-        this.resourcesListTreeElement.removeChildren();
+        if (this._treeElementForFrameId)
+            return;
+
         this._treeElementForFrameId = {};
-        this.reset();
+        WebInspector.resourceTreeModel.addEventListener(WebInspector.ResourceTreeModel.EventTypes.FrameAdded, this._frameAdded, this);
+        WebInspector.resourceTreeModel.addEventListener(WebInspector.ResourceTreeModel.EventTypes.FrameNavigated, this._frameNavigated, this);
+        WebInspector.resourceTreeModel.addEventListener(WebInspector.ResourceTreeModel.EventTypes.FrameDetached, this._frameDetached, this);
+        WebInspector.resourceTreeModel.addEventListener(WebInspector.ResourceTreeModel.EventTypes.ResourceAdded, this._resourceAdded, this);
+
+        function populateFrame(frameId)
+        {
+            var subframes = WebInspector.resourceTreeModel.subframes(frameId);
+            for (var i = 0; i < subframes.length; ++i) {
+                this._frameAdded({data:subframes[i]});
+                populateFrame.call(this, subframes[i].id);
+            }
+
+            var resources = WebInspector.resourceTreeModel.resources(frameId);
+            for (var i = 0; i < resources.length; ++i)
+                this._resourceAdded({data:resources[i]});
+        }
+        populateFrame.call(this, 0);
+        this._initDefaultSelection();
     },
 
-    addOrUpdateFrame: function(parentFrameId, frameId, title, subtitle)
+    _frameAdded: function(event)
     {
+        var frame = event.data;
+        var frameId = frame.id;
+        var parentFrameId = frame.parentId;
+        var title = frame.name;
+        var subtitle = new WebInspector.Resource(null, frame.url).displayName;
+        this.addDocumentURL(frame.url);
+        
         var frameTreeElement = this._treeElementForFrameId[frameId];
         if (frameTreeElement) {
             frameTreeElement.setTitles(title, subtitle);
@@ -182,7 +211,7 @@ WebInspector.ResourcesPanel.prototype = {
 
         var parentTreeElement = parentFrameId ? this._treeElementForFrameId[parentFrameId] : this.resourcesListTreeElement;
         if (!parentTreeElement) {
-            console.warning("No frame with id:" + parentFrameId + " to route " + displayName + " to.")
+            console.warn("No frame with id:" + parentFrameId + " to route " + title + "/" + subtitle + " to.")
             return;
         }
 
@@ -205,8 +234,9 @@ WebInspector.ResourcesPanel.prototype = {
         parentTreeElement.appendChild(frameTreeElement);
     },
 
-    removeFrame: function(frameId)
+    _frameDetached: function(event)
     {
+        var frameId = event.data;
         var frameTreeElement = this._treeElementForFrameId[frameId];
         if (!frameTreeElement)
             return;
@@ -215,9 +245,10 @@ WebInspector.ResourcesPanel.prototype = {
             frameTreeElement.parent.removeChild(frameTreeElement);
     },
 
-    addResourceToFrame: function(frameId, resource)
+    _resourceAdded: function(event)
     {
-        this.addDocumentURL(resource.documentURL);
+        var resource = event.data;
+        var frameId = resource.frameId;
 
         if (resource.statusCode >= 301 && resource.statusCode <= 303)
             return;
@@ -247,11 +278,20 @@ WebInspector.ResourcesPanel.prototype = {
         frameTreeElement.appendChild(resourceTreeElement);
     },
 
-    removeResourcesFromFrame: function(frameId)
+    _frameNavigated: function(event)
     {
+        var frameId = event.data;
+        if (!frameId) {
+            // Total update.
+            this.resourcesListTreeElement.removeChildren();
+            this._treeElementForFrameId = {};
+            this.reset();
+            return;
+        }
+
         var frameTreeElement = this._treeElementForFrameId[frameId];
         if (frameTreeElement)
-            frameTreeElement.removeChildren();
+            frameTreeElement.removeChildren();        
     },
 
     _refreshResource: function(event)
@@ -379,8 +419,8 @@ WebInspector.ResourcesPanel.prototype = {
     },
 
     _applyDiffMarkup: function(view, baseContent, newContent) {
-        var oldLines = baseContent.split("\n");
-        var newLines = newContent.split("\n");
+        var oldLines = baseContent.split(/\r?\n/);
+        var newLines = newContent.split(/\r?\n/);
 
         var diff = Array.diff(oldLines, newLines);
 
@@ -770,19 +810,22 @@ WebInspector.ResourcesPanel.prototype = {
 
 WebInspector.ResourcesPanel.prototype.__proto__ = WebInspector.Panel.prototype;
 
-WebInspector.BaseStorageTreeElement = function(storagePanel, representedObject, title, iconClass, hasChildren)
+WebInspector.BaseStorageTreeElement = function(storagePanel, representedObject, title, iconClasses, hasChildren)
 {
     TreeElement.call(this, "", representedObject, hasChildren);
     this._storagePanel = storagePanel;
     this._titleText = title;
-    this._iconClass = iconClass;
+    this._iconClasses = iconClasses;
 }
 
 WebInspector.BaseStorageTreeElement.prototype = {
     onattach: function()
     {
         this.listItemElement.removeChildren();
-        this.listItemElement.addStyleClass(this._iconClass);
+        if (this._iconClasses) {
+            for (var i = 0; i < this._iconClasses.length; ++i)
+                this.listItemElement.addStyleClass(this._iconClasses[i]);
+        }
 
         var selectionElement = document.createElement("div");
         selectionElement.className = "selection";
@@ -836,9 +879,9 @@ WebInspector.BaseStorageTreeElement.prototype = {
 
 WebInspector.BaseStorageTreeElement.prototype.__proto__ = TreeElement.prototype;
 
-WebInspector.StorageCategoryTreeElement = function(storagePanel, categoryName, settingsKey, iconClass)
+WebInspector.StorageCategoryTreeElement = function(storagePanel, categoryName, settingsKey, iconClasses)
 {
-    WebInspector.BaseStorageTreeElement.call(this, storagePanel, null, categoryName, iconClass, true);
+    WebInspector.BaseStorageTreeElement.call(this, storagePanel, null, categoryName, iconClasses, true);
     this._expandedSettingKey = "resources" + settingsKey + "Expanded";
     WebInspector.settings.installApplicationSetting(this._expandedSettingKey, settingsKey === "Frames");
     this._categoryName = categoryName;
@@ -877,7 +920,7 @@ WebInspector.StorageCategoryTreeElement.prototype.__proto__ = WebInspector.BaseS
 
 WebInspector.FrameTreeElement = function(storagePanel, frameId, title, subtitle)
 {
-    WebInspector.BaseStorageTreeElement.call(this, storagePanel, null, "", "frame-storage-tree-item");
+    WebInspector.BaseStorageTreeElement.call(this, storagePanel, null, "", ["frame-storage-tree-item"]);
     this._frameId = frameId;
     this.setTitles(title, subtitle);
 }
@@ -904,7 +947,7 @@ WebInspector.FrameTreeElement.prototype = {
         this._storagePanel.showCategoryView(this._displayName);
 
         this.listItemElement.removeStyleClass("hovered");
-        InspectorAgent.hideFrameHighlight();
+        DOMAgent.hideFrameHighlight();
     },
 
     get displayName()
@@ -916,10 +959,8 @@ WebInspector.FrameTreeElement.prototype = {
     {
         this._displayName = "";
         if (this.parent) {
-            if (title) {
-                this.titleElement.textContent = title;
-                this._displayName = title;
-            }
+            this.titleElement.textContent = title || "";
+            this._displayName = title || "";
             if (subtitle) {
                 var subtitleElement = document.createElement("span");
                 subtitleElement.className = "base-storage-tree-element-subtitle";
@@ -937,10 +978,10 @@ WebInspector.FrameTreeElement.prototype = {
     {
         if (hovered) {
             this.listItemElement.addStyleClass("hovered");
-            InspectorAgent.highlightFrame(this._frameId);
+            DOMAgent.highlightFrame(this._frameId);
         } else {
             this.listItemElement.removeStyleClass("hovered");
-            InspectorAgent.hideFrameHighlight();
+            DOMAgent.hideFrameHighlight();
         }
     }
 }
@@ -948,7 +989,7 @@ WebInspector.FrameTreeElement.prototype.__proto__ = WebInspector.BaseStorageTree
 
 WebInspector.FrameResourceTreeElement = function(storagePanel, resource)
 {
-    WebInspector.BaseStorageTreeElement.call(this, storagePanel, resource, resource.displayName, "resource-sidebar-tree-item resources-category-" + resource.category.name);
+    WebInspector.BaseStorageTreeElement.call(this, storagePanel, resource, resource.displayName, ["resource-sidebar-tree-item", "resources-category-" + resource.category.name]);
     this._resource = resource;
     this._resource.addEventListener("errors-warnings-updated", this._errorsWarningsUpdated, this);
     this._resource.addEventListener("content-changed", this._contentChanged, this);
@@ -969,7 +1010,7 @@ WebInspector.FrameResourceTreeElement.prototype = {
 
     ondblclick: function(event)
     {
-        InspectorAgent.openInInspectedWindow(this._resource.url);
+        PageAgent.openInInspectedWindow(this._resource.url);
     },
 
     onattach: function()
@@ -1070,7 +1111,7 @@ WebInspector.FrameResourceTreeElement.prototype = {
         if (oldView) {
             var newView = WebInspector.ResourceView.recreateResourceView(this._resource);
             if (oldView === this._storagePanel.visibleView)
-                this._storagePanel.visibleView = newView;
+                this._storagePanel._showResourceView(this._resource);
         }
     }
 }
@@ -1079,7 +1120,7 @@ WebInspector.FrameResourceTreeElement.prototype.__proto__ = WebInspector.BaseSto
 
 WebInspector.DatabaseTreeElement = function(storagePanel, database)
 {
-    WebInspector.BaseStorageTreeElement.call(this, storagePanel, null, database.name, "database-storage-tree-item", true);
+    WebInspector.BaseStorageTreeElement.call(this, storagePanel, null, database.name, ["database-storage-tree-item"], true);
     this._database = database;
 }
 
@@ -1120,7 +1161,7 @@ WebInspector.DatabaseTreeElement.prototype.__proto__ = WebInspector.BaseStorageT
 
 WebInspector.DatabaseTableTreeElement = function(storagePanel, database, tableName)
 {
-    WebInspector.BaseStorageTreeElement.call(this, storagePanel, null, tableName, "database-storage-tree-item");
+    WebInspector.BaseStorageTreeElement.call(this, storagePanel, null, tableName, ["database-storage-tree-item"]);
     this._database = database;
     this._tableName = tableName;
 }
@@ -1141,7 +1182,7 @@ WebInspector.DatabaseTableTreeElement.prototype.__proto__ = WebInspector.BaseSto
 
 WebInspector.DOMStorageTreeElement = function(storagePanel, domStorage, className)
 {
-    WebInspector.BaseStorageTreeElement.call(this, storagePanel, null, domStorage.domain ? domStorage.domain : WebInspector.UIString("Local Files"), "domstorage-storage-tree-item " + className);
+    WebInspector.BaseStorageTreeElement.call(this, storagePanel, null, domStorage.domain ? domStorage.domain : WebInspector.UIString("Local Files"), ["domstorage-storage-tree-item", className]);
     this._domStorage = domStorage;
 }
 
@@ -1161,7 +1202,7 @@ WebInspector.DOMStorageTreeElement.prototype.__proto__ = WebInspector.BaseStorag
 
 WebInspector.CookieTreeElement = function(storagePanel, cookieDomain)
 {
-    WebInspector.BaseStorageTreeElement.call(this, storagePanel, null, cookieDomain ? cookieDomain : WebInspector.UIString("Local Files"), "cookie-storage-tree-item");
+    WebInspector.BaseStorageTreeElement.call(this, storagePanel, null, cookieDomain ? cookieDomain : WebInspector.UIString("Local Files"), ["cookie-storage-tree-item"]);
     this._cookieDomain = cookieDomain;
 }
 
@@ -1181,7 +1222,7 @@ WebInspector.CookieTreeElement.prototype.__proto__ = WebInspector.BaseStorageTre
 
 WebInspector.ApplicationCacheTreeElement = function(storagePanel, appcacheDomain)
 {
-    WebInspector.BaseStorageTreeElement.call(this, storagePanel, null, appcacheDomain ? appcacheDomain : WebInspector.UIString("Local Files"), "application-cache-storage-tree-item");
+    WebInspector.BaseStorageTreeElement.call(this, storagePanel, null, appcacheDomain ? appcacheDomain : WebInspector.UIString("Local Files"), ["application-cache-storage-tree-item"]);
     this._appcacheDomain = appcacheDomain;
 }
 
@@ -1202,7 +1243,7 @@ WebInspector.ApplicationCacheTreeElement.prototype.__proto__ = WebInspector.Base
 WebInspector.ResourceRevisionTreeElement = function(storagePanel, revision)
 {
     var title = revision.timestamp ? revision.timestamp.toLocaleTimeString() : WebInspector.UIString("(original)");
-    WebInspector.BaseStorageTreeElement.call(this, storagePanel, null, title, "resource-sidebar-tree-item resources-category-" + revision.category.name);
+    WebInspector.BaseStorageTreeElement.call(this, storagePanel, null, title, ["resource-sidebar-tree-item", "resources-category-" + revision.category.name]);
     if (revision.timestamp)
         this.tooltip = revision.timestamp.toLocaleString();
     this._resource = revision;
diff --git a/Source/WebCore/inspector/front-end/Script.js b/Source/WebCore/inspector/front-end/Script.js
index 3f27485..805e191 100644
--- a/Source/WebCore/inspector/front-end/Script.js
+++ b/Source/WebCore/inspector/front-end/Script.js
@@ -115,8 +115,10 @@ WebInspector.Script.prototype = {
             return;
         }
 
-        function didGetScriptSource(source)
+        function didGetScriptSource(error, source)
         {
+            if (error)
+                return;
             this._source = source;
             callback(this._source);
         }
diff --git a/Source/WebCore/inspector/front-end/ScriptFormatter.js b/Source/WebCore/inspector/front-end/ScriptFormatter.js
index f70d6c6..2e166f4 100644
--- a/Source/WebCore/inspector/front-end/ScriptFormatter.js
+++ b/Source/WebCore/inspector/front-end/ScriptFormatter.js
@@ -69,25 +69,15 @@ WebInspector.ScriptFormatter.findScriptRanges = function(lineEndings, scripts)
 }
 
 WebInspector.ScriptFormatter.prototype = {
-    formatContent: function(content, callback)
+    formatContent: function(text, scripts, callback)
     {
-        var chunks = this._splitContentIntoChunks(content.text, content.scriptRanges);
+        var scriptRanges = WebInspector.ScriptFormatter.findScriptRanges(text.lineEndings(), scripts);
+        var chunks = this._splitContentIntoChunks(text, scriptRanges);
 
         function didFormatChunks()
         {
             var result = this._buildContentFromChunks(chunks);
-
-            var sourceMapping = new WebInspector.SourceMappingForFormattedScript(content.text.lineEndings(), result.text.lineEndings(), result.mapping);
-            var formattedScriptRanges = [];
-            for (var i = 0; i < content.scriptRanges.length; ++i) {
-                var scriptRange = content.scriptRanges[i];
-                formattedScriptRange = {};
-                formattedScriptRange.start = sourceMapping.originalPositionToFormattedLocation(scriptRange.start.position);
-                formattedScriptRange.end = sourceMapping.originalPositionToFormattedLocation(scriptRange.end.position);
-                formattedScriptRange.sourceID = scriptRange.sourceID;
-                formattedScriptRanges.push(formattedScriptRange);
-            }
-            callback(new WebInspector.SourceFrameContent(result.text, sourceMapping, formattedScriptRanges));
+            callback(result.text, result.mapping);
         }
         this._formatChunks(chunks, 0, didFormatChunks.bind(this));
     },
@@ -186,48 +176,3 @@ WebInspector.ScriptFormatter.prototype = {
         task.callback(task.source, { original: [], formatted: [] });
     }
 }
-
-
-WebInspector.SourceMappingForFormattedScript = function(originalLineEndings, formattedLineEndings, mapping)
-{
-    WebInspector.SourceMapping.call(this);
-    this._originalLineEndings = originalLineEndings;
-    this._formattedLineEndings = formattedLineEndings;
-    this._mapping = mapping;
-}
-
-WebInspector.SourceMappingForFormattedScript.prototype = {
-    actualLocationToSourceLocation: function(lineNumber, columnNumber)
-    {
-        var position = WebInspector.ScriptFormatter.locationToPosition(this._originalLineEndings, lineNumber, columnNumber);
-        return this.originalPositionToFormattedLocation(position);
-    },
-
-    sourceLocationToActualLocation: function(lineNumber, columnNumber)
-    {
-        var formattedPosition = WebInspector.ScriptFormatter.locationToPosition(this._formattedLineEndings, lineNumber, columnNumber);
-        var position = this._convertPosition(this._mapping.formatted, this._mapping.original, formattedPosition);
-        return WebInspector.ScriptFormatter.positionToLocation(this._originalLineEndings, position);
-    },
-
-    originalPositionToFormattedLocation: function(position)
-    {
-        var formattedPosition = this._convertPosition(this._mapping.original, this._mapping.formatted, position);
-        var location = WebInspector.ScriptFormatter.positionToLocation(this._formattedLineEndings, formattedPosition);
-        location.position = formattedPosition;
-        return location;
-    },
-
-    _convertPosition: function(positions1, positions2, position)
-    {
-        var index = positions1.upperBound(position);
-        var range1 = positions1[index] - positions1[index - 1];
-        var range2 = positions2[index] - positions2[index - 1];
-        var position2 = positions2[index - 1];
-        if (range1)
-            position2 += Math.round((position - positions1[index - 1]) * range2 / range1);
-        return position2;
-    }
-}
-
-WebInspector.SourceMappingForFormattedScript.prototype.__proto__ = WebInspector.SourceMapping.prototype;
diff --git a/Source/WebCore/inspector/front-end/ScriptsPanel.js b/Source/WebCore/inspector/front-end/ScriptsPanel.js
index 2647cee..7547c36 100644
--- a/Source/WebCore/inspector/front-end/ScriptsPanel.js
+++ b/Source/WebCore/inspector/front-end/ScriptsPanel.js
@@ -70,7 +70,7 @@ WebInspector.ScriptsPanel = function()
     this.formatButton.id = "format-script";
     this.formatButton.title = WebInspector.UIString("Format script.");
     this.formatButton.appendChild(document.createElement("img"));
-    this.formatButton.addEventListener("click", this._formatScript.bind(this), false);
+    this.formatButton.addEventListener("click", this._toggleFormatSourceFiles.bind(this), false);
     if (Preferences.debugMode)
         this.topStatusBar.appendChild(this.formatButton);
 
@@ -142,10 +142,10 @@ WebInspector.ScriptsPanel = function()
     this.sidebarPanes.watchExpressions = new WebInspector.WatchExpressionsSidebarPane();
     this.sidebarPanes.callstack = new WebInspector.CallStackSidebarPane(this._presentationModel);
     this.sidebarPanes.scopechain = new WebInspector.ScopeChainSidebarPane();
-    this.sidebarPanes.jsBreakpoints = new WebInspector.JavaScriptBreakpointsSidebarPane();
+    this.sidebarPanes.jsBreakpoints = new WebInspector.JavaScriptBreakpointsSidebarPane(this._presentationModel);
     if (Preferences.nativeInstrumentationEnabled) {
         this.sidebarPanes.domBreakpoints = WebInspector.createDOMBreakpointsSidebarPane();
-        this.sidebarPanes.xhrBreakpoints = WebInspector.createXHRBreakpointsSidebarPane();
+        this.sidebarPanes.xhrBreakpoints = new WebInspector.XHRBreakpointsSidebarPane();
         this.sidebarPanes.eventListenerBreakpoints = new WebInspector.EventListenerBreakpointsSidebarPane();
     }
 
@@ -185,14 +185,21 @@ WebInspector.ScriptsPanel = function()
 
     this.reset();
 
-    WebInspector.debuggerModel.addEventListener(WebInspector.DebuggerModel.Events.ParsedScriptSource, this._parsedScriptSource, this);
-    WebInspector.debuggerModel.addEventListener(WebInspector.DebuggerModel.Events.FailedToParseScriptSource, this._failedToParseScriptSource, this);
-    WebInspector.debuggerModel.addEventListener(WebInspector.DebuggerModel.Events.ScriptSourceChanged, this._scriptSourceChanged, this);
-    WebInspector.debuggerModel.addEventListener(WebInspector.DebuggerModel.Events.DebuggerPaused, this._debuggerPaused, this);
-    WebInspector.debuggerModel.addEventListener(WebInspector.DebuggerModel.Events.DebuggerResumed, this._debuggerResumed, this);
+    WebInspector.debuggerModel.addEventListener(WebInspector.DebuggerModel.Events.DebuggerWasEnabled, this._debuggerWasEnabled, this);
+    WebInspector.debuggerModel.addEventListener(WebInspector.DebuggerModel.Events.DebuggerWasDisabled, this._debuggerWasDisabled, this);
+
+    this._presentationModel.addEventListener(WebInspector.DebuggerPresentationModel.Events.SourceFileAdded, this._sourceFileAdded, this)
+    this._presentationModel.addEventListener(WebInspector.DebuggerPresentationModel.Events.SourceFileChanged, this._sourceFileChanged, this);
+    this._presentationModel.addEventListener(WebInspector.DebuggerPresentationModel.Events.ConsoleMessageAdded, this._consoleMessageAdded, this);
     this._presentationModel.addEventListener(WebInspector.DebuggerPresentationModel.Events.BreakpointAdded, this._breakpointAdded, this);
     this._presentationModel.addEventListener(WebInspector.DebuggerPresentationModel.Events.BreakpointRemoved, this._breakpointRemoved, this);
+    this._presentationModel.addEventListener(WebInspector.DebuggerPresentationModel.Events.DebuggerPaused, this._debuggerPaused, this);
+    this._presentationModel.addEventListener(WebInspector.DebuggerPresentationModel.Events.DebuggerResumed, this._debuggerResumed, this);
     this._presentationModel.addEventListener(WebInspector.DebuggerPresentationModel.Events.CallFrameSelected, this._callFrameSelected, this);
+
+    var enableDebugger = Preferences.debuggerAlwaysEnabled || WebInspector.settings.debuggerEnabled;
+    if (enableDebugger || InspectorFrontendHost.loadSessionSetting("debugger-enabled") === "true")
+        WebInspector.debuggerModel.enableDebugger();
 }
 
 // Keep these in sync with WebCore::ScriptDebugServer
@@ -244,115 +251,36 @@ WebInspector.ScriptsPanel.prototype = {
         return this.toggleBreakpointsButton.toggled;
     },
 
-    _parsedScriptSource: function(event)
-    {
-        this._addScript(event.data);
-    },
-
-    _failedToParseScriptSource: function(event)
-    {
-        this._addScript(event.data);
-    },
-
-    _scriptSourceChanged: function(event)
+    _sourceFileAdded: function(event)
     {
-        var sourceID = event.data.sourceID;
-        var oldSource = event.data.oldSource;
-
-        var script = WebInspector.debuggerModel.scriptForSourceID(sourceID);
-        if (script.resource) {
-            var revertHandle = WebInspector.debuggerModel.editScriptSource.bind(WebInspector.debuggerModel, sourceID, oldSource);
-            script.resource.setContent(script.source, revertHandle);
-        }
-
-        var sourceFileId = this._sourceFileIdForScript(script);
-        this._recreateSourceFrame(sourceFileId);
+        var sourceFile = event.data;
 
-        var callFrames = WebInspector.debuggerModel.callFrames;
-        if (callFrames.length)
-            this._debuggerPaused({ data: { callFrames: callFrames } });
-    },
-
-    _addScript: function(script)
-    {
-        if (!script.sourceURL) {
-            // Anonymous scripts are shown only when stepping.
+        if (!sourceFile.url) {
+            // Anonymous sources are shown only when stepping.
             return;
         }
 
-        var resource = this._resourceForURL(script.sourceURL);
-        if (resource) {
-            if (resource.finished) {
-                // Resource is finished, bind the script right away.
-                script.resource = resource;
-
-                // Add resource url to files select if not already added while debugging inlined scripts.
-                if (!(resource.url in this._sourceFileIdToFilesSelectOption))
-                    this._addOptionToFilesSelectAndShowSourceFrameIfNeeded(resource.url);
-            } else {
-                // Resource is not finished, bind the script later.
-                if (!resource._scriptsPendingResourceLoad) {
-                    resource._scriptsPendingResourceLoad = [];
-                    resource.addEventListener("finished", this._resourceLoadingFinished, this);
-                }
-                resource._scriptsPendingResourceLoad.push(script);
-
-                // Source frame content is outdated since we have new script parsed.
-                this._recreateSourceFrame(script.sourceURL);
-            }
-        } else if (!(script.sourceURL in this._sourceFileIdToFilesSelectOption)) {
-            // This is a dynamic script with "//@ sourceURL=" comment.
-            this._addOptionToFilesSelectAndShowSourceFrameIfNeeded(script.sourceURL);
-        }
-    },
-
-    _resourceForURL: function(url)
-    {
-        return WebInspector.networkManager.inflightResourceForURL(url) || WebInspector.resourceForURL(url);
-    },
-
-    _resourceLoadingFinished: function(e)
-    {
-        var resource = e.target;
-
-        // Bind scripts to resource.
-        for (var i = 0; i < resource._scriptsPendingResourceLoad.length; ++i) {
-            var script = resource._scriptsPendingResourceLoad[i];
-            script.resource = resource;
-        }
-        delete resource._scriptsPendingResourceLoad;
-
-        // Recreate source frame to show resource content.
-        this._recreateSourceFrame(resource.url);
-
-        // Add resource url to files select if not already added while debugging inlined scripts.
-        if (!(resource.url in this._sourceFileIdToFilesSelectOption))
-            this._addOptionToFilesSelectAndShowSourceFrameIfNeeded(resource.url);
-    },
-
-    _addOptionToFilesSelectAndShowSourceFrameIfNeeded: function(url)
-    {
-        this._addOptionToFilesSelect(url);
+        this._addOptionToFilesSelect(sourceFile.id);
 
         var lastViewedURL = WebInspector.settings.lastViewedScriptFile;
         if (this._filesSelectElement.length === 1) {
             // Option we just added is the only option in files select.
             // We have to show corresponding source frame immediately.
-            this._showSourceFrameAndAddToHistory(url);
+            this._showSourceFrameAndAddToHistory(sourceFile.id);
             // Restore original value of lastViewedScriptFile because
             // source frame was shown as a result of initial load.
             WebInspector.settings.lastViewedScriptFile = lastViewedURL;
-        } else if (url === lastViewedURL)
-            this._showSourceFrameAndAddToHistory(url);
+        } else if (sourceFile.url === lastViewedURL)
+            this._showSourceFrameAndAddToHistory(sourceFile.id);
     },
 
     _addOptionToFilesSelect: function(sourceFileId)
     {
-        var script = this._scriptForSourceFileId(sourceFileId);
+        var sourceFile = this._presentationModel.sourceFile(sourceFileId);
         var select = this._filesSelectElement;
         var option = document.createElement("option");
-        option.text = script.sourceURL ? WebInspector.displayNameForURL(script.sourceURL) : WebInspector.UIString("(program)");
-        if (script.worldType === WebInspector.Script.WorldType.EXTENSIONS_WORLD)
+        option.text = sourceFile.url ? WebInspector.displayNameForURL(sourceFile.url) : WebInspector.UIString("(program)");
+        if (sourceFile.isExtensionScript)
             option.addStyleClass("extension-script");
         function optionCompare(a, b)
         {
@@ -370,19 +298,37 @@ WebInspector.ScriptsPanel.prototype = {
         this._sourceFileIdToFilesSelectOption[sourceFileId] = option;
     },
 
+    setScriptSourceIsBeingEdited: function(sourceFileId, inEditMode)
+    {
+        var option = this._sourceFileIdToFilesSelectOption[sourceFileId];
+        if (!option)
+            return;
+        if (inEditMode)
+            option.text = option.text.replace(/[^*]$/, "$&*");
+        else
+            option.text = option.text.replace(/[*]$/, "");
+    },
+
     addConsoleMessage: function(message)
     {
-        this._messages.push(message);
-        var sourceFrame = this._sourceFileIdToSourceFrame[message.url];
-        if (sourceFrame)
-            sourceFrame.addMessage(message);
+        if (message.isErrorOrWarning() && message.message)
+            this._presentationModel.addConsoleMessage(message);
     },
 
     clearConsoleMessages: function()
     {
-        this._messages = [];
-        for (var url in this._sourceFileIdToSourceFrame)
-            this._sourceFileIdToSourceFrame[url].clearMessages();
+        this._presentationModel.clearConsoleMessages();
+        for (var sourceFileId in this._sourceFileIdToSourceFrame)
+            this._sourceFileIdToSourceFrame[sourceFileId].clearMessages();
+    },
+
+    _consoleMessageAdded: function(event)
+    {
+        var message = event.data;
+
+        var sourceFrame = this._sourceFileIdToSourceFrame[message.sourceFileId];
+        if (sourceFrame && sourceFrame.loaded)
+            sourceFrame.addMessageToSource(message.lineNumber, message.originalMessage);
     },
 
     _breakpointAdded: function(event)
@@ -392,6 +338,8 @@ WebInspector.ScriptsPanel.prototype = {
         var sourceFrame = this._sourceFileIdToSourceFrame[breakpoint.sourceFileId];
         if (sourceFrame && sourceFrame.loaded)
             sourceFrame.addBreakpoint(breakpoint.lineNumber, breakpoint.resolved, breakpoint.condition, breakpoint.enabled);
+
+        this.sidebarPanes.jsBreakpoints.addBreakpoint(breakpoint);
     },
 
     _breakpointRemoved: function(event)
@@ -401,25 +349,20 @@ WebInspector.ScriptsPanel.prototype = {
         var sourceFrame = this._sourceFileIdToSourceFrame[breakpoint.sourceFileId];
         if (sourceFrame && sourceFrame.loaded)
             sourceFrame.removeBreakpoint(breakpoint.lineNumber);
+
+        this.sidebarPanes.jsBreakpoints.removeBreakpoint(breakpoint.sourceFileId, breakpoint.lineNumber);
     },
 
     evaluateInSelectedCallFrame: function(code, objectGroup, includeCommandLineAPI, callback)
     {
         var selectedCallFrame = this._presentationModel.selectedCallFrame;
-        if (!this._paused || !selectedCallFrame)
-            return;
-
-        function updatingCallbackWrapper(result)
-        {
-            if (result)
-                callback(WebInspector.RemoteObject.fromPayload(result));
-        }
-        DebuggerAgent.evaluateOnCallFrame(selectedCallFrame.id, code, objectGroup, includeCommandLineAPI, updatingCallbackWrapper.bind(this));
+        selectedCallFrame.evaluate(code, objectGroup, includeCommandLineAPI, callback);
     },
 
     _debuggerPaused: function(event)
     {
         var callFrames = event.data.callFrames;
+        var details = event.data.details;
 
         this._paused = true;
         this._waitingToPause = false;
@@ -429,8 +372,32 @@ WebInspector.ScriptsPanel.prototype = {
 
         WebInspector.currentPanel = this;
 
-        this.sidebarPanes.callstack.update(event.data);
-        this.sidebarPanes.callstack.selectedCallFrame = callFrames[0];
+        this.sidebarPanes.callstack.update(callFrames, details);
+        this.sidebarPanes.callstack.selectedCallFrame = this._presentationModel.selectedCallFrame;
+
+        var status;
+        if (details.eventType === WebInspector.DebuggerEventTypes.NativeBreakpoint) {
+            if (details.eventData.breakpointType === WebInspector.BreakpointManager.BreakpointTypes.EventListener) {
+                var eventName = details.eventData.eventName;
+                this.sidebarPanes.eventListenerBreakpoints.highlightBreakpoint(details.eventData.eventName);
+                var eventNameForUI = WebInspector.EventListenerBreakpointsSidebarPane.eventNameForUI(eventName);
+                status = WebInspector.UIString("Paused on a \"%s\" Event Listener.", eventNameForUI);
+            } else if (details.eventData.breakpointType === WebInspector.BreakpointManager.BreakpointTypes.XHR) {
+                this.sidebarPanes.xhrBreakpoints.highlightBreakpoint(details.eventData.breakpointURL);
+                status = WebInspector.UIString("Paused on a XMLHttpRequest.");
+            }
+        } else {
+            function didGetSourceLocation(sourceFileId, lineNumber, columnNumber)
+            {
+                if (!sourceFileId || !this._presentationModel.findBreakpoint(sourceFileId, lineNumber))
+                    return;
+                this.sidebarPanes.jsBreakpoints.highlightBreakpoint(sourceFileId, lineNumber);
+                status = WebInspector.UIString("Paused on a JavaScript breakpoint.");
+            }
+            callFrames[0].sourceLocation(didGetSourceLocation.bind(this));
+        }
+        if (status)
+            this.sidebarPanes.callstack.setStatus(status);
 
         window.focus();
         InspectorFrontendHost.bringToFront();
@@ -438,8 +405,6 @@ WebInspector.ScriptsPanel.prototype = {
 
     _debuggerResumed: function()
     {
-        this._presentationModel.selectedCallFrame = null;
-
         this._paused = false;
         this._waitingToPause = false;
         this._stepping = false;
@@ -447,21 +412,24 @@ WebInspector.ScriptsPanel.prototype = {
         this._clearInterface();
     },
 
-    debuggerWasEnabled: function()
+    _debuggerWasEnabled: function()
     {
         this._setPauseOnExceptions(WebInspector.settings.pauseOnExceptionState);
 
         if (this._debuggerEnabled)
             return;
+
+        InspectorFrontendHost.saveSessionSetting("debugger-enabled", "true");
         this._debuggerEnabled = true;
         this.reset(true);
     },
 
-    debuggerWasDisabled: function()
+    _debuggerWasDisabled: function()
     {
         if (!this._debuggerEnabled)
             return;
 
+        InspectorFrontendHost.saveSessionSetting("debugger-enabled", "false");
         this._debuggerEnabled = false;
         this.reset(true);
     },
@@ -481,11 +449,11 @@ WebInspector.ScriptsPanel.prototype = {
 
         this._sourceFileIdToSourceFrame = {};
         this._sourceFileIdToFilesSelectOption = {};
-        this._messages = [];
         this._filesSelectElement.removeChildren();
         this.functionsSelectElement.removeChildren();
         this.viewsContainerElement.removeChildren();
 
+        this.sidebarPanes.jsBreakpoints.reset();
         this.sidebarPanes.watchExpressions.refreshExpressions();
         if (!preserveItems)
             this.sidebarPanes.workers.reset();
@@ -564,9 +532,9 @@ WebInspector.ScriptsPanel.prototype = {
         var sourceFrame = this._sourceFrameForSourceFileId(sourceFileId);
         this.visibleView = sourceFrame;
 
-        var script = this._scriptForSourceFileId(sourceFileId);
-        if (script.sourceURL)
-            WebInspector.settings.lastViewedScriptFile = script.sourceURL;
+        var sourceFile = this._presentationModel.sourceFile(sourceFileId);
+        if (sourceFile.url)
+            WebInspector.settings.lastViewedScriptFile = sourceFile.url;
 
         return sourceFrame;
     },
@@ -579,23 +547,24 @@ WebInspector.ScriptsPanel.prototype = {
 
     _createSourceFrame: function(sourceFileId)
     {
-        var script = this._scriptForSourceFileId(sourceFileId);
-        var delegate = new WebInspector.SourceFrameDelegateForScriptsPanel(script);
-        var sourceFrame = new WebInspector.SourceFrame(delegate, script.sourceURL);
+        var sourceFile = this._presentationModel.sourceFile(sourceFileId);
+        var delegate = new WebInspector.SourceFrameDelegateForScriptsPanel(this._presentationModel, sourceFileId);
+        var sourceFrame = new WebInspector.SourceFrame(delegate, sourceFile.url);
         sourceFrame._sourceFileId = sourceFileId;
         sourceFrame.addEventListener(WebInspector.SourceFrame.Events.Loaded, this._sourceFrameLoaded, this);
         this._sourceFileIdToSourceFrame[sourceFileId] = sourceFrame;
         return sourceFrame;
     },
 
-    _recreateSourceFrame: function(sourceFileId)
+    _sourceFileChanged: function(event)
     {
+        var sourceFileId = event.data.id;
+
         var oldSourceFrame = this._sourceFileIdToSourceFrame[sourceFileId];
         if (!oldSourceFrame)
             return;
         oldSourceFrame.removeEventListener(WebInspector.SourceFrame.Events.Loaded, this._sourceFrameLoaded, this);
         delete this._sourceFileIdToSourceFrame[sourceFileId];
-        oldSourceFrame.removeEventListener(WebInspector.SourceFrame.Events.Loaded, this._sourceFrameLoaded, this);
         if (this.visibleView !== oldSourceFrame)
             return;
 
@@ -608,11 +577,12 @@ WebInspector.ScriptsPanel.prototype = {
     {
         var sourceFrame = event.target;
         var sourceFileId = sourceFrame._sourceFileId;
+        var sourceFile = this._presentationModel.sourceFile(sourceFileId);
 
-        for (var i = 0; i < this._messages.length; ++i) {
-            var message = this._messages[i];
-            if (message.url === sourceFileId)
-                sourceFrame.addMessage(message);
+        var messages = sourceFile.messages;
+        for (var i = 0; i < messages.length; ++i) {
+            var message = messages[i];
+            sourceFrame.addMessageToSource(message.lineNumber, message.originalMessage);
         }
 
         var breakpoints = this._presentationModel.breakpointsForSourceFileId(sourceFileId);
@@ -620,28 +590,6 @@ WebInspector.ScriptsPanel.prototype = {
             var breakpoint = breakpoints[i];
             sourceFrame.addBreakpoint(breakpoint.lineNumber, breakpoint.resolved, breakpoint.condition, breakpoint.enabled);
         }
-
-        var selectedCallFrame = this._presentationModel.selectedCallFrame;
-        if (selectedCallFrame) {
-            if (selectedCallFrame.sourceLocation.sourceFileId === sourceFileId) {
-                sourceFrame.setExecutionLine(selectedCallFrame.sourceLocation.lineNumber);
-                this._executionSourceFrame = sourceFrame;
-            }
-        }
-    },
-
-    _sourceFileIdForScript: function(script)
-    {
-        return script.sourceURL || script.sourceID;
-    },
-
-    _scriptForSourceFileId: function(sourceFileId)
-    {
-        function filter(script)
-        {
-            return (script.sourceURL || script.sourceID) === sourceFileId;
-        }
-        return WebInspector.debuggerModel.queryScripts(filter)[0];
     },
 
     _clearCurrentExecutionLine: function()
@@ -662,19 +610,22 @@ WebInspector.ScriptsPanel.prototype = {
 
         this.sidebarPanes.scopechain.update(callFrame);
         this.sidebarPanes.watchExpressions.refreshExpressions();
+        this.sidebarPanes.callstack.selectedCallFrame = this._presentationModel.selectedCallFrame;
 
-        var sourceFileId = callFrame.sourceLocation.sourceFileId;
-        if (!(sourceFileId in this._sourceFileIdToFilesSelectOption)) {
-            // This happens in two cases:
-            // 1) Current call frame function is defined in anonymous script (anonymous scripts aren't added to files select by default)
-            // 2) We are debugging synchronously executed inlined script and there is no resource so far
-            this._addOptionToFilesSelect(sourceFileId);
-        }
-        var sourceFrame = this._showSourceFrameAndAddToHistory(sourceFileId);
-        if (sourceFrame.loaded) {
-            sourceFrame.setExecutionLine(callFrame.sourceLocation.lineNumber);
+        function didGetSourceLocation(sourceFileId, lineNumber, columnNumber)
+        {
+            if (!sourceFileId)
+                return;
+
+            if (!(sourceFileId in this._sourceFileIdToFilesSelectOption)) {
+                // Anonymous scripts are not added to files select by default.
+                this._addOptionToFilesSelect(sourceFileId);
+            }
+            var sourceFrame = this._showSourceFrameAndAddToHistory(sourceFileId);
+            sourceFrame.setExecutionLine(lineNumber);
             this._executionSourceFrame = sourceFrame;
         }
+        callFrame.sourceLocation(didGetSourceLocation.bind(this));
     },
 
     _filesSelectChanged: function()
@@ -721,8 +672,10 @@ WebInspector.ScriptsPanel.prototype = {
 
     _setPauseOnExceptions: function(pauseOnExceptionsState)
     {
-        function callback(pauseOnExceptionsState)
+        function callback(error)
         {
+            if (error)
+                return;
             if (pauseOnExceptionsState == WebInspector.ScriptsPanel.PauseOnExceptionsState.DontPauseOnExceptions)
                 this._pauseOnExceptionButton.title = WebInspector.UIString("Don't pause on exceptions.\nClick to Pause on all exceptions.");
             else if (pauseOnExceptionsState == WebInspector.ScriptsPanel.PauseOnExceptionsState.PauseOnAllExceptions)
@@ -786,6 +739,11 @@ WebInspector.ScriptsPanel.prototype = {
     {
         this.sidebarPanes.callstack.update(null);
         this.sidebarPanes.scopechain.update(null);
+        this.sidebarPanes.jsBreakpoints.clearBreakpointHighlight();
+        if (Preferences.nativeInstrumentationEnabled) {
+            this.sidebarPanes.eventListenerBreakpoints.clearBreakpointHighlight();
+            this.sidebarPanes.xhrBreakpoints.clearBreakpointHighlight();
+        }
 
         this._clearCurrentExecutionLine();
         this._updateDebuggerButtons();
@@ -813,10 +771,10 @@ WebInspector.ScriptsPanel.prototype = {
         this._updateBackAndForwardButtons();
     },
 
-    _formatScript: function()
+    _toggleFormatSourceFiles: function()
     {
-        if (this.visibleView)
-            this.visibleView.formatSource();
+        this.reset();
+        this._presentationModel.toggleFormatSourceFiles();
     },
 
     _enableDebugging: function()
@@ -895,11 +853,11 @@ WebInspector.ScriptsPanel.prototype = {
     {
         this.toggleBreakpointsButton.toggled = !this.toggleBreakpointsButton.toggled;
         if (this.toggleBreakpointsButton.toggled) {
-            DebuggerAgent.activateBreakpoints();
+            DebuggerAgent.setBreakpointsActive(true);
             this.toggleBreakpointsButton.title = WebInspector.UIString("Deactivate all breakpoints.");
             document.getElementById("main-panels").removeStyleClass("breakpoints-deactivated");
         } else {
-            DebuggerAgent.deactivateBreakpoints();
+            DebuggerAgent.setBreakpointsActive(false);
             this.toggleBreakpointsButton.title = WebInspector.UIString("Activate all breakpoints.");
             document.getElementById("main-panels").addStyleClass("breakpoints-deactivated");
         }
@@ -1039,119 +997,22 @@ WebInspector.ScriptsPanel.prototype = {
 WebInspector.ScriptsPanel.prototype.__proto__ = WebInspector.Panel.prototype;
 
 
-WebInspector.SourceFrameDelegateForScriptsPanel = function(script)
+WebInspector.SourceFrameDelegateForScriptsPanel = function(model, sourceFileId)
 {
     WebInspector.SourceFrameDelegate.call(this);
-    this._script = script;
+    this._model = model;
+    this._sourceFileId = sourceFileId;
     this._popoverObjectGroup = "popover";
 }
 
 WebInspector.SourceFrameDelegateForScriptsPanel.prototype = {
     requestContent: function(callback)
     {
-        function didGetTextAndScriptRanges(mimeType, text, scriptRanges)
-        {
-            this._content = new WebInspector.SourceFrameContent(text, new WebInspector.IdenticalSourceMapping(), scriptRanges);
-            callback(mimeType, this._content);
-        }
-
-        if (this._script.resource)
-            this._loadResourceContent(this._script.resource, didGetTextAndScriptRanges.bind(this));
-        else
-            this._loadAndConcatenateScriptsContent(didGetTextAndScriptRanges.bind(this));
-    },
-
-    _loadResourceContent: function(resource, callback)
-    {
-        function didRequestContent(text)
+        function didRequestSourceFileContent(mimeType, text)
         {
-            var mimeType = "text/javascript";
-            if (resource.type !== WebInspector.Resource.Type.Script) {
-                mimeType = "text/html";
-                // WebKit html lexer normalizes line endings and scripts are passed to VM with "\n" line endings.
-                // However, resource content has original line endings, so we have to normalize line endings here.
-                text = text.replace(/\r\n/g, "\n");
-            }
-            var scripts = this._scripts();
-            var scriptRanges = WebInspector.ScriptFormatter.findScriptRanges(text.lineEndings(), scripts);
-            callback(mimeType, text, scriptRanges);
+            callback(mimeType, { text: text });
         }
-        resource.requestContent(didRequestContent.bind(this));
-    },
-
-    _loadAndConcatenateScriptsContent: function(callback)
-    {
-        var scripts = this._scripts();
-        var scriptsLeft = scripts.length;
-        var sources = [];
-        function didRequestSource(index, source)
-        {
-            sources[index] = source;
-            if (--scriptsLeft)
-                return;
-            var result = this._buildSource(scripts, sources);
-            callback(result.mimeType, result.source, result.scriptRanges);
-        }
-        for (var i = 0; i < scripts.length; ++i)
-            scripts[i].requestSource(didRequestSource.bind(this, i));
-    },
-
-    _buildSource: function(scripts, sources)
-    {
-        var source = "";
-        var lineNumber = 0;
-        var columnNumber = 0;
-        var scriptRanges = [];
-        function appendChunk(chunk, script)
-        {
-            var start = { lineNumber: lineNumber, columnNumber: columnNumber };
-            source += chunk;
-            var lineEndings = chunk.lineEndings();
-            var lineCount = lineEndings.length;
-            if (lineCount === 1)
-                columnNumber += chunk.length;
-            else {
-                lineNumber += lineCount - 1;
-                columnNumber = lineEndings[lineCount - 1] - lineEndings[lineCount - 2] - 1;
-            }
-            var end = { lineNumber: lineNumber, columnNumber: columnNumber };
-            if (script)
-                scriptRanges.push({ start: start, end: end, sourceID: script.sourceID });
-        }
-
-        var mimeType;
-        if (scripts.length === 1 && !scripts[0].lineOffset && !scripts[0].columnOffset) {
-            // Single script source.
-            mimeType = "text/javascript";
-            appendChunk(sources[0], scripts[0]);
-        } else {
-            // Scripts inlined in html document.
-            mimeType = "text/html";
-            var scriptOpenTag = "<script>";
-            var scriptCloseTag = "</script>";
-            for (var i = 0; i < scripts.length; ++i) {
-                // Fill the gap with whitespace characters.
-                while (lineNumber < scripts[i].lineOffset)
-                    appendChunk("\n");
-                while (columnNumber < scripts[i].columnOffset - scriptOpenTag.length)
-                    appendChunk(" ");
-
-                // Add script tag.
-                appendChunk(scriptOpenTag);
-                appendChunk(sources[i], scripts[i]);
-                appendChunk(scriptCloseTag);
-            }
-        }
-        return { mimeType: mimeType, source: source, scriptRanges: scriptRanges };
-    },
-
-    _scripts: function()
-    {
-        var scripts = [this._script];
-        if (this._script.sourceURL)
-            scripts = WebInspector.debuggerModel.scriptsForURL(this._script.sourceURL);
-        scripts.sort(function(x, y) { return x.lineOffset - y.lineOffset || x.columnOffset - y.columnOffset; });
-        return scripts;
+        this._model.requestSourceFileContent(this._sourceFileId, didRequestSourceFileContent.bind(this));
     },
 
     debuggingSupported: function()
@@ -1161,62 +1022,45 @@ WebInspector.SourceFrameDelegateForScriptsPanel.prototype = {
 
     setBreakpoint: function(lineNumber, condition, enabled)
     {
-        var location = this._content.sourceFrameLineNumberToActualLocation(lineNumber);
-        if (this._script.sourceURL)
-            WebInspector.debuggerModel.setBreakpoint(this._script.sourceURL, location.lineNumber, location.columnNumber, condition, enabled);
-        else if (location.sourceID)
-            WebInspector.debuggerModel.setBreakpointBySourceId(location.sourceID, location.lineNumber, location.columnNumber, condition, enabled);
-        else
-            return;
+        this._model.setBreakpoint(this._sourceFileId, lineNumber, condition, enabled);
 
         if (!WebInspector.panels.scripts.breakpointsActivated)
             WebInspector.panels.scripts.toggleBreakpointsClicked();
     },
 
-    removeBreakpoint: function(breakpointId)
+    updateBreakpoint: function(lineNumber, condition, enabled)
     {
-        WebInspector.debuggerModel.removeBreakpoint(breakpointId);
+        this._model.updateBreakpoint(this._sourceFileId, lineNumber, condition, enabled);
     },
 
-    updateBreakpoint: function(breakpointId, condition, enabled)
+    removeBreakpoint: function(lineNumber)
     {
-        WebInspector.debuggerModel.updateBreakpoint(breakpointId, condition, enabled);
+        this._model.removeBreakpoint(this._sourceFileId, lineNumber);
     },
 
     findBreakpoint: function(lineNumber)
     {
-        var url = this._script.sourceURL;
-        var location = this._content.sourceFrameLineNumberToActualLocation(lineNumber);
-        function filter(breakpoint)
-        {
-            if (breakpoint.url) {
-                if (breakpoint.url !== url)
-                    return false;
-            } else {
-                if (breakpoint.sourceID !== location.sourceID)
-                    return false;
-            }
-            var lineNumber = breakpoint.locations.length ? breakpoint.locations[0].lineNumber : breakpoint.lineNumber;
-            return lineNumber === location.lineNumber;
-        }
-        return WebInspector.debuggerModel.queryBreakpoints(filter)[0];
+        return this._model.findBreakpoint(this._sourceFileId, lineNumber);
     },
 
     continueToLine: function(lineNumber)
     {
-        var location = this._content.sourceFrameLineNumberToActualLocation(lineNumber);
-        if (location.sourceID)
-            WebInspector.debuggerModel.continueToLocation(location.sourceID, location.lineNumber, location.columnNumber);
+        this._model.continueToLine(this._sourceFileId, lineNumber);
     },
 
     canEditScriptSource: function()
     {
-        return Preferences.canEditScriptSource && !this._script.lineOffset && !this._script.columnOffset;
+        return this._model.canEditScriptSource(this._sourceFileId);
+    },
+
+    editScriptSource: function(text, callback)
+    {
+        this._model.editScriptSource(this._sourceFileId, text, callback);
     },
 
-    editScriptSource: function(text)
+    setScriptSourceIsBeingEdited: function(inEditMode)
     {
-        WebInspector.debuggerModel.editScriptSource(this._script.sourceID, text);
+        WebInspector.panels.scripts.setScriptSourceIsBeingEdited(this._sourceFileId, inEditMode);
     },
 
     debuggerPaused: function()
@@ -1226,17 +1070,12 @@ WebInspector.SourceFrameDelegateForScriptsPanel.prototype = {
 
     evaluateInSelectedCallFrame: function(string, callback)
     {
-        function didEvaluateInSelectedCallFrame(result)
-        {
-            if (!result.isError() && this.debuggerPaused())
-                callback(result);
-        }
-        WebInspector.panels.scripts.evaluateInSelectedCallFrame(string, this._popoverObjectGroup, false, didEvaluateInSelectedCallFrame.bind(this));
+        WebInspector.panels.scripts.evaluateInSelectedCallFrame(string, this._popoverObjectGroup, false, callback);
     },
 
     releaseEvaluationResult: function()
     {
-        RuntimeAgent.releaseObjectGroup(0, this._popoverObjectGroup);
+        RuntimeAgent.releaseObjectGroup(this._popoverObjectGroup);
     }
 }
 
diff --git a/Source/WebCore/inspector/front-end/Section.js b/Source/WebCore/inspector/front-end/Section.js
index 5caa78b..623e537 100644
--- a/Source/WebCore/inspector/front-end/Section.js
+++ b/Source/WebCore/inspector/front-end/Section.js
@@ -45,7 +45,7 @@ WebInspector.Section = function(title, subtitle)
     this.headerElement.appendChild(this.subtitleElement);
     this.headerElement.appendChild(this.titleElement);
 
-    this.headerElement.addEventListener("click", this.toggleExpanded.bind(this), false);
+    this.headerElement.addEventListener("click", this.handleClick.bind(this), false);
     this.element.appendChild(this.headerElement);
 
     this.title = title;
@@ -168,5 +168,11 @@ WebInspector.Section.prototype = {
     toggleExpanded: function()
     {
         this.expanded = !this.expanded;
+    },
+
+    handleClick: function(e)
+    {
+        this.toggleExpanded();
+        e.stopPropagation();
     }
 }
diff --git a/Source/WebCore/inspector/front-end/Settings.js b/Source/WebCore/inspector/front-end/Settings.js
index 68b81a5..9995ca2 100644
--- a/Source/WebCore/inspector/front-end/Settings.js
+++ b/Source/WebCore/inspector/front-end/Settings.js
@@ -44,7 +44,6 @@ var Preferences = {
     profilerAlwaysEnabled: false,
     onlineDetectionEnabled: true,
     nativeInstrumentationEnabled: false,
-    resourceExportEnabled: false,
     useDataURLForResourceImageIcons: true,
     showTimingTab: false,
     showCookiesTab: false,
@@ -58,6 +57,7 @@ WebInspector.Settings = function()
     this.installApplicationSetting("colorFormat", "hex");
     this.installApplicationSetting("consoleHistory", []);
     this.installApplicationSetting("debuggerEnabled", false);
+    this.installApplicationSetting("domWordWrap", true);
     this.installApplicationSetting("profilerEnabled", false);
     this.installApplicationSetting("eventListenersFilter", "all");
     this.installApplicationSetting("lastActivePanel", "elements");
@@ -71,6 +71,8 @@ WebInspector.Settings = function()
     this.installApplicationSetting("showUserAgentStyles", true);
     this.installApplicationSetting("watchExpressions", []);
     this.installApplicationSetting("breakpoints", []);
+    this.installApplicationSetting("eventListenerBreakpoints", []);
+    this.installApplicationSetting("xhrBreakpoints", []);
 
     this.installProjectSetting("nativeBreakpoints", []);
 }
@@ -112,6 +114,9 @@ WebInspector.Settings.prototype = {
     findSettingForAllProjects: function(key)
     {
         var result = {};
+        if (window.localStorage == null)
+            return result;
+
         var regexp = "^" + key + ":(.*)";
         for (var i = 0; i < window.localStorage.length; ++i) {
             var fullKey =  window.localStorage.key(i);
@@ -129,7 +134,7 @@ WebInspector.Settings.prototype = {
 
     _get: function(key, defaultValue)
     {
-        if (key in window.localStorage) {
+        if (window.localStorage != null && key in window.localStorage) {
             try {
                 return JSON.parse(window.localStorage[key]);
             } catch(e) {
@@ -141,7 +146,8 @@ WebInspector.Settings.prototype = {
 
     _set: function(key, value)
     {
-        window.localStorage[key] = JSON.stringify(value);
+        if (window.localStorage != null)
+            window.localStorage[key] = JSON.stringify(value);
     },
 
     _getProjectSetting: function(key, defaultValue)
diff --git a/Source/WebCore/inspector/front-end/ShortcutsHelp.js b/Source/WebCore/inspector/front-end/ShortcutsHelp.js
index 004ed48..ab395c8 100644
--- a/Source/WebCore/inspector/front-end/ShortcutsHelp.js
+++ b/Source/WebCore/inspector/front-end/ShortcutsHelp.js
@@ -125,7 +125,7 @@ WebInspector.ShortcutsSection.prototype = {
         for (var line = 0; line < this._lines.length; ++line) {
             var tr = parent.createChild("tr");
             tr.createChild("td", "help-key-cell").innerHTML = this._lines[line].key + " : ";
-            tr.createChild("td").innerText = this._lines[line].text;
+            tr.createChild("td").textContent = this._lines[line].text;
         }
     },
 
@@ -134,7 +134,7 @@ WebInspector.ShortcutsSection.prototype = {
         var trHead = parent.createChild("tr");
  
         trHead.createChild("th");
-        trHead.createChild("th").innerText = this.name;
+        trHead.createChild("th").textContent = this.name;
     },
 
     _renderSequence: function(sequence, delimiter)
diff --git a/Source/WebCore/inspector/front-end/SourceFile.js b/Source/WebCore/inspector/front-end/SourceFile.js
new file mode 100644
index 0000000..4f56c00
--- /dev/null
+++ b/Source/WebCore/inspector/front-end/SourceFile.js
@@ -0,0 +1,311 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+WebInspector.SourceFile = function(id, script, contentChangedDelegate)
+{
+    this._scripts = [script];
+    this._contentChangedDelegate = contentChangedDelegate;
+    if (script.sourceURL)
+        this._resource = WebInspector.networkManager.inflightResourceForURL(script.sourceURL) || WebInspector.resourceForURL(script.sourceURL);
+    this._requestContentCallbacks = [];
+
+    this.id = id;
+    this.url = script.sourceURL;
+    this.isExtensionScript = script.worldType === WebInspector.Script.WorldType.EXTENSIONS_WORLD;
+    this.messages = [];
+    this.breakpoints = {};
+
+    if (this._hasPendingResource())
+        this._resource.addEventListener("finished", this.reload.bind(this));
+}
+
+WebInspector.SourceFile.prototype = {
+    addScript: function(script)
+    {
+        this._scripts.push(script);
+    },
+
+    requestContent: function(callback)
+    {
+        if (this._contentLoaded) {
+            callback(this._mimeType, this._content);
+            return;
+        }
+
+        this._requestContentCallbacks.push(callback);
+        this._requestContent();
+    },
+
+    get content()
+    {
+        return this._content;
+    },
+
+    requestSourceMapping: function(callback)
+    {
+        if (!this._mapping)
+            this._mapping = new WebInspector.SourceMapping(this._scripts);
+        callback(this._mapping);
+    },
+
+    forceLoadContent: function(script)
+    {
+        if (!this._hasPendingResource())
+            return;
+
+        if (!this._concatenatedScripts)
+            this._concatenatedScripts = {};
+        if (this._concatenatedScripts[script.sourceID])
+            return;
+        for (var i = 0; i < this._scripts.length; ++i)
+            this._concatenatedScripts[this._scripts[i].sourceID] = true;
+
+        this.reload();
+
+        if (!this._contentRequested) {
+            this._contentRequested = true;
+            this._loadAndConcatenateScriptsContent();
+        }
+    },
+
+    reload: function()
+    {
+        if (this._contentLoaded) {
+            this._contentLoaded = false;
+            this._contentChangedDelegate();
+        } else if (this._contentRequested)
+            this._reloadContent = true;
+        else if (this._requestContentCallbacks.length)
+            this._requestContent();
+    },
+
+    _requestContent: function()
+    {
+        if (this._contentRequested)
+            return;
+
+        this._contentRequested = true;
+        if (this._resource && this._resource.finished)
+            this._loadResourceContent(this._resource);
+        else if (!this._resource)
+            this._loadScriptContent();
+        else if (this._concatenatedScripts)
+            this._loadAndConcatenateScriptsContent();
+        else
+            this._contentRequested = false;
+    },
+
+    _loadResourceContent: function(resource)
+    {
+        function didRequestContent(text)
+        {
+            if (resource.type === WebInspector.Resource.Type.Script)
+                this._didRequestContent("text/javascript", text);
+            else {
+                // WebKit html lexer normalizes line endings and scripts are passed to VM with "\n" line endings.
+                // However, resource content has original line endings, so we have to normalize line endings here.
+                this._didRequestContent("text/html", text.replace(/\r\n/g, "\n"));
+            }
+        }
+        resource.requestContent(didRequestContent.bind(this));
+    },
+
+    _loadScriptContent: function()
+    {
+        this._scripts[0].requestSource(this._didRequestContent.bind(this, "text/javascript"));
+    },
+
+    _loadAndConcatenateScriptsContent: function()
+    {
+        var scripts = this._scripts.slice();
+        scripts.sort(function(x, y) { return x.lineOffset - y.lineOffset || x.columnOffset - y.columnOffset; });
+        var sources = [];
+        function didRequestSource(source)
+        {
+            sources.push(source);
+            if (sources.length === scripts.length)
+                this._concatenateScriptsContent(scripts, sources);
+        }
+        for (var i = 0; i < scripts.length; ++i)
+            scripts[i].requestSource(didRequestSource.bind(this));
+    },
+
+    _concatenateScriptsContent: function(scripts, sources)
+    {
+        var content = "";
+        var lineNumber = 0;
+        var columnNumber = 0;
+        var scriptRanges = [];
+        function appendChunk(chunk, script)
+        {
+            var start = { lineNumber: lineNumber, columnNumber: columnNumber };
+            content += chunk;
+            var lineEndings = chunk.lineEndings();
+            var lineCount = lineEndings.length;
+            if (lineCount === 1)
+                columnNumber += chunk.length;
+            else {
+                lineNumber += lineCount - 1;
+                columnNumber = lineEndings[lineCount - 1] - lineEndings[lineCount - 2] - 1;
+            }
+            var end = { lineNumber: lineNumber, columnNumber: columnNumber };
+            if (script)
+                scriptRanges.push({ start: start, end: end, sourceID: script.sourceID });
+        }
+
+        var scriptOpenTag = "<script>";
+        var scriptCloseTag = "</script>";
+        for (var i = 0; i < scripts.length; ++i) {
+            // Fill the gap with whitespace characters.
+            while (lineNumber < scripts[i].lineOffset)
+                appendChunk("\n");
+            while (columnNumber < scripts[i].columnOffset - scriptOpenTag.length)
+                appendChunk(" ");
+
+            // Add script tag.
+            appendChunk(scriptOpenTag);
+            appendChunk(sources[i], scripts[i]);
+            appendChunk(scriptCloseTag);
+        }
+
+        this._didRequestContent("text/html", content);
+    },
+
+    _didRequestContent: function(mimeType, content)
+    {
+        this._contentLoaded = true;
+        this._contentRequested = false;
+        this._mimeType = mimeType;
+        this._content = content;
+
+        for (var i = 0; i < this._requestContentCallbacks.length; ++i)
+            this._requestContentCallbacks[i](mimeType, content);
+        this._requestContentCallbacks = [];
+
+        if (this._reloadContent)
+            this.reload();
+    },
+
+    _hasPendingResource: function()
+    {
+        return this._resource && !this._resource.finished;
+    }
+}
+
+WebInspector.FormattedSourceFile = function(sourceFileId, script, contentChangedDelegate, formatter)
+{
+    WebInspector.SourceFile.call(this, sourceFileId, script, contentChangedDelegate);
+    this._formatter = formatter;
+}
+
+WebInspector.FormattedSourceFile.prototype = {
+    requestSourceMapping: function(callback)
+    {
+        function didRequestContent()
+        {
+            callback(this._mapping);
+        }
+        this.requestContent(didRequestContent.bind(this));
+    },
+
+    _didRequestContent: function(mimeType, text)
+    {
+        function didFormatContent(formattedText, mapping)
+        {
+            this._mapping = new WebInspector.FormattedSourceMapping(this._scripts, text, formattedText, mapping);
+            WebInspector.SourceFile.prototype._didRequestContent.call(this, mimeType, formattedText);
+        }
+        this._formatter.formatContent(text, this._scripts, didFormatContent.bind(this));
+    }
+}
+
+WebInspector.FormattedSourceFile.prototype.__proto__ = WebInspector.SourceFile.prototype;
+
+WebInspector.SourceMapping = function(sortedScripts)
+{
+    this._sortedScripts = sortedScripts;
+}
+
+WebInspector.SourceMapping.prototype = {
+    scriptLocationToSourceLocation: function(lineNumber, columnNumber)
+    {
+        return { lineNumber: lineNumber, columnNumber: columnNumber };
+    },
+
+    sourceLocationToScriptLocation: function(lineNumber, columnNumber)
+    {
+        var closestScript = this._sortedScripts[0];
+        for (var i = 1; i < this._sortedScripts.length; ++i) {
+            script = this._sortedScripts[i];
+            if (script.lineOffset > lineNumber || (script.lineOffset === lineNumber && script.columnOffset > columnNumber))
+                break;
+            closestScript = script;
+        }
+        return { scriptId: closestScript.sourceID, lineNumber: lineNumber, columnNumber: columnNumber };
+    }
+}
+
+WebInspector.FormattedSourceMapping = function(sortedScripts, originalText, formattedText, mapping)
+{
+    WebInspector.SourceMapping.call(this, sortedScripts);
+    this._originalLineEndings = originalText.lineEndings();
+    this._formattedLineEndings = formattedText.lineEndings();
+    this._mapping = mapping;
+}
+
+WebInspector.FormattedSourceMapping.prototype = {
+    scriptLocationToSourceLocation: function(lineNumber, columnNumber)
+    {
+        var originalPosition = WebInspector.ScriptFormatter.locationToPosition(this._originalLineEndings, lineNumber, columnNumber);
+        var formattedPosition = this._convertPosition(this._mapping.original, this._mapping.formatted, originalPosition);
+        return WebInspector.ScriptFormatter.positionToLocation(this._formattedLineEndings, formattedPosition);
+    },
+
+    sourceLocationToScriptLocation: function(lineNumber, columnNumber)
+    {
+        var formattedPosition = WebInspector.ScriptFormatter.locationToPosition(this._formattedLineEndings, lineNumber, columnNumber);
+        var originalPosition = this._convertPosition(this._mapping.formatted, this._mapping.original, formattedPosition);
+        var originalLocation = WebInspector.ScriptFormatter.positionToLocation(this._originalLineEndings, originalPosition);
+        return WebInspector.SourceMapping.prototype.sourceLocationToScriptLocation.call(this, originalLocation.lineNumber, originalLocation.columnNumber);
+    },
+
+    _convertPosition: function(positions1, positions2, position)
+    {
+        var index = positions1.upperBound(position);
+        var range1 = positions1[index] - positions1[index - 1];
+        var range2 = positions2[index] - positions2[index - 1];
+        var position2 = positions2[index - 1];
+        if (range1)
+            position2 += Math.round((position - positions1[index - 1]) * range2 / range1);
+        return position2;
+    }
+}
+
+WebInspector.FormattedSourceMapping.prototype.__proto__ = WebInspector.SourceMapping.prototype;
diff --git a/Source/WebCore/inspector/front-end/SourceFrame.js b/Source/WebCore/inspector/front-end/SourceFrame.js
index 3120159..7482f34 100644
--- a/Source/WebCore/inspector/front-end/SourceFrame.js
+++ b/Source/WebCore/inspector/front-end/SourceFrame.js
@@ -46,6 +46,9 @@ WebInspector.SourceFrame = function(delegate, url)
     this._messages = [];
     this._rowMessages = {};
     this._messageBubbles = {};
+
+    this._registerShortcuts();
+    this.element.addEventListener("keydown", this._handleKeyDown.bind(this), false);
 }
 
 WebInspector.SourceFrame.Events = {
@@ -116,12 +119,9 @@ WebInspector.SourceFrame.prototype = {
 
     addMessage: function(msg)
     {
-        // Don't add the message if there is no message or valid line or if the msg isn't an error or warning.
-        if (!msg.message || msg.line <= 0 || !msg.isErrorOrWarning())
-            return;
         this._messages.push(msg);
         if (this._textViewer)
-            this._addMessageToSource(msg);
+            this.addMessageToSource(msg.line - 1, msg);
     },
 
     clearMessages: function()
@@ -173,6 +173,11 @@ WebInspector.SourceFrame.prototype = {
 
     _startEditing: function()
     {
+        if (this._originalTextModelContent === undefined) {
+            this._originalTextModelContent = this._textModel.text;
+            this._delegate.setScriptSourceIsBeingEdited(true);
+        }
+
         WebInspector.searchController.cancelSearch();
         this.clearMessages();
     },
@@ -196,9 +201,12 @@ WebInspector.SourceFrame.prototype = {
             element.addEventListener("contextmenu", this._contextMenu.bind(this), true);
             element.addEventListener("mousedown", this._mouseDown.bind(this), true);
             element.addEventListener("mousemove", this._mouseMove.bind(this), true);
-            element.addEventListener("dblclick", this._doubleClick.bind(this), true);
             element.addEventListener("scroll", this._scroll.bind(this), true);
         }
+
+        if (this._delegate.canEditScriptSource())
+            element.addEventListener("dblclick", this._doubleClick.bind(this), true);
+
         this.element.appendChild(element);
 
         this._textViewer.beginUpdates();
@@ -206,6 +214,9 @@ WebInspector.SourceFrame.prototype = {
         this._textViewer.mimeType = mimeType;
         this._setTextViewerDecorations();
 
+        if ("_executionLineNumber" in this)
+            this.setExecutionLine(this._executionLineNumber);
+
         if (this._lineNumberToReveal) {
             this.revealLine(this._lineNumberToReveal);
             delete this._lineNumberToReveal;
@@ -357,13 +368,16 @@ WebInspector.SourceFrame.prototype = {
     setExecutionLine: function(lineNumber)
     {
         this._executionLineNumber = lineNumber;
-        this._textViewer.addDecoration(lineNumber, "webkit-execution-line");
-        this._textViewer.revealLine(lineNumber);
+        if (this._textViewer) {
+            this._textViewer.addDecoration(lineNumber, "webkit-execution-line");
+            this._textViewer.revealLine(lineNumber);
+        }
     },
 
     clearExecutionLine: function()
     {
-        this._textViewer.removeDecoration(this._executionLineNumber, "webkit-execution-line");
+        if (this._textViewer)
+            this._textViewer.removeDecoration(this._executionLineNumber, "webkit-execution-line");
         delete this._executionLineNumber;
     },
 
@@ -398,26 +412,26 @@ WebInspector.SourceFrame.prototype = {
     {
         var length = this._messages.length;
         for (var i = 0; i < length; ++i)
-            this._addMessageToSource(this._messages[i]);
+            this.addMessageToSource(this._messages[i].line - 1, this._messages[i]);
     },
 
-    _addMessageToSource: function(msg)
+    addMessageToSource: function(lineNumber, msg)
     {
-        if (msg.line > this._textModel.linesCount)
+        if (lineNumber >= this._textModel.linesCount)
             return;
 
-        var messageBubbleElement = this._messageBubbles[msg.line];
+        var messageBubbleElement = this._messageBubbles[lineNumber];
         if (!messageBubbleElement || messageBubbleElement.nodeType !== Node.ELEMENT_NODE || !messageBubbleElement.hasStyleClass("webkit-html-message-bubble")) {
             messageBubbleElement = document.createElement("div");
             messageBubbleElement.className = "webkit-html-message-bubble";
-            this._messageBubbles[msg.line] = messageBubbleElement;
-            this._textViewer.addDecoration(msg.line - 1, messageBubbleElement);
+            this._messageBubbles[lineNumber] = messageBubbleElement;
+            this._textViewer.addDecoration(lineNumber, messageBubbleElement);
         }
 
-        var rowMessages = this._rowMessages[msg.line];
+        var rowMessages = this._rowMessages[lineNumber];
         if (!rowMessages) {
             rowMessages = [];
-            this._rowMessages[msg.line] = rowMessages;
+            this._rowMessages[lineNumber] = rowMessages;
         }
 
         for (var i = 0; i < rowMessages.length; ++i) {
@@ -505,20 +519,20 @@ WebInspector.SourceFrame.prototype = {
             contextMenu.appendItem(WebInspector.UIString("Add Conditional Breakpoint…"), addConditionalBreakpoint.bind(this));
         } else {
             // This row has a breakpoint, we want to show edit and remove breakpoint, and either disable or enable.
-            contextMenu.appendItem(WebInspector.UIString("Remove Breakpoint"), this._delegate.removeBreakpoint.bind(this._delegate, breakpoint.id));
+            contextMenu.appendItem(WebInspector.UIString("Remove Breakpoint"), this._delegate.removeBreakpoint.bind(this._delegate, lineNumber));
             function editBreakpointCondition()
             {
                 function didEditBreakpointCondition(committed, condition)
                 {
                     if (committed)
-                        this._delegate.updateBreakpoint(breakpoint.id, condition, breakpoint.enabled);
+                        this._delegate.updateBreakpoint(lineNumber, condition, breakpoint.enabled);
                 }
                 this._editBreakpointCondition(lineNumber, breakpoint.condition, didEditBreakpointCondition.bind(this));
             }
             contextMenu.appendItem(WebInspector.UIString("Edit Breakpoint…"), editBreakpointCondition.bind(this));
             function setBreakpointEnabled(enabled)
             {
-                this._delegate.updateBreakpoint(breakpoint.id, breakpoint.condition, enabled);
+                this._delegate.updateBreakpoint(lineNumber, breakpoint.condition, enabled);
             }
             if (breakpoint.enabled)
                 contextMenu.appendItem(WebInspector.UIString("Disable Breakpoint"), setBreakpointEnabled.bind(this, false));
@@ -547,9 +561,9 @@ WebInspector.SourceFrame.prototype = {
         var breakpoint = this._delegate.findBreakpoint(lineNumber);
         if (breakpoint) {
             if (event.shiftKey)
-                this._delegate.updateBreakpoint(breakpoint.id, breakpoint.condition, !breakpoint.enabled);
+                this._delegate.updateBreakpoint(lineNumber, breakpoint.condition, !breakpoint.enabled);
             else
-                this._delegate.removeBreakpoint(breakpoint.id);
+                this._delegate.removeBreakpoint(lineNumber);
         } else
             this._delegate.setBreakpoint(lineNumber, "", true);
         event.preventDefault();
@@ -648,6 +662,9 @@ WebInspector.SourceFrame.prototype = {
 
     _showPopup: function(element)
     {
+        if (!this._delegate.debuggerPaused())
+            return;
+
         function killHidePopupTimer()
         {
             if (this._hidePopupTimer) {
@@ -662,6 +679,9 @@ WebInspector.SourceFrame.prototype = {
 
         function showObjectPopup(result)
         {
+            if (result.isError() || !this._delegate.debuggerPaused())
+                return;
+
             var popupContentElement = null;
             if (result.type !== "object" && result.type !== "node" && result.type !== "array") {
                 popupContentElement = document.createElement("span");
@@ -763,6 +783,71 @@ WebInspector.SourceFrame.prototype = {
         formatter.formatContent(this._content, didFormat.bind(this))
     },
 
+    _registerShortcuts: function()
+    {
+        this._shortcuts = {};
+        var handleSaveCallback = this._handleSave.bind(this);
+        this._shortcuts[WebInspector.KeyboardShortcut.makeKey("s", WebInspector.KeyboardShortcut.Modifiers.CtrlOrMeta)] = handleSaveCallback;
+        this._shortcuts[WebInspector.KeyboardShortcut.makeKey(WebInspector.KeyboardShortcut.Keys.Enter.code, WebInspector.KeyboardShortcut.Modifiers.CtrlOrMeta)] = handleSaveCallback;
+        this._shortcuts[WebInspector.KeyboardShortcut.makeKey(WebInspector.KeyboardShortcut.Keys.Esc.code)] = this._handleRevertEditing.bind(this);
+    },
+
+    _handleKeyDown: function(e)
+    {
+        var shortcutKey = WebInspector.KeyboardShortcut.makeKeyFromEvent(e);
+        var handler = this._shortcuts[shortcutKey];
+        if (handler && handler.call(this)) {
+            e.preventDefault();
+            e.stopPropagation();
+        }
+    },
+
+    _handleSave: function()
+    {
+        if (this._textViewer.readOnly || !this._delegate.canEditScriptSource())
+            return false;
+
+        if (this._originalTextModelContent === undefined) {
+            // No editing was actually done.
+            this._textViewer.readOnly = true;
+            this._delegate.setScriptSourceIsBeingEdited(false);
+            return true;
+        }
+
+        var originalTextModelContent = this._originalTextModelContent;
+        var newSource = this._textModel.text;
+
+        delete this._originalTextModelContent;
+        this._textViewer.readOnly = true;
+        this._delegate.setScriptSourceIsBeingEdited(false);
+
+        function didEditScriptSource(success, newBodyOrErrorMessage)
+        {
+            if (!success && this._originalTextModelContent === undefined && this._textModel.text === newSource) {
+                this._originalTextModelContent = originalTextModelContent;
+                this._textViewer.readOnly = false;
+                this._delegate.setScriptSourceIsBeingEdited(true);
+                WebInspector.log(newBodyOrErrorMessage, WebInspector.ConsoleMessage.MessageLevel.Error);
+                WebInspector.showConsole();
+            }
+        }
+        this._delegate.editScriptSource(newSource, didEditScriptSource.bind(this));
+        return true;
+    },
+
+    _handleRevertEditing: function()
+    {
+        if (this._textViewer.readOnly)
+            return false;
+
+        if (this._originalTextModelContent !== undefined)
+            this._textModel.setText(null, this._originalTextModelContent);
+        delete this._originalTextModelContent;
+        this._textViewer.readOnly = true;
+        this._delegate.setScriptSourceIsBeingEdited(false);
+        return true;
+    },
+
     _doubleClick: function(event)
     {
         if (!this._delegate.canEditScriptSource())
@@ -772,20 +857,10 @@ WebInspector.SourceFrame.prototype = {
         if (!lineRow)
             return;  // Do not trigger editing from line numbers.
 
-        this._textViewer.editLine(lineRow, this._didEditLine.bind(this, lineRow.lineNumber));
-    },
-
-    _didEditLine: function(lineNumber, newContent)
-    {
-        var lines = [];
-        var oldLines = this._content.text.split('\n');
-        for (var i = 0; i < oldLines.length; ++i) {
-            if (i === lineNumber)
-                lines.push(newContent);
-            else
-                lines.push(oldLines[i]);
+        if (this._textViewer.readOnly) {
+            this._textViewer.readOnly = false;
+            window.getSelection().collapseToStart();
         }
-        this._delegate.editScriptSource(lines.join("\n"));
     }
 }
 
@@ -812,12 +887,12 @@ WebInspector.SourceFrameDelegate.prototype = {
         // Should be implemented by subclasses.
     },
 
-    removeBreakpoint: function(breakpointId)
+    removeBreakpoint: function(lineNumber)
     {
         // Should be implemented by subclasses.
     },
 
-    updateBreakpoint: function(breakpointId, condition, enabled)
+    updateBreakpoint: function(lineNumber, condition, enabled)
     {
         // Should be implemented by subclasses.
     },
@@ -837,7 +912,12 @@ WebInspector.SourceFrameDelegate.prototype = {
         return false;
     },
 
-    editScriptSource: function(text)
+    editScriptSource: function(text, callback)
+    {
+        // Should be implemented by subclasses.
+    },
+
+    setScriptSourceIsBeingEdited: function(inEditMode)
     {
         // Should be implemented by subclasses.
     },
diff --git a/Source/WebCore/inspector/front-end/SourceFrameContent.js b/Source/WebCore/inspector/front-end/SourceFrameContent.js
index 91b397b..3f3a8e9 100644
--- a/Source/WebCore/inspector/front-end/SourceFrameContent.js
+++ b/Source/WebCore/inspector/front-end/SourceFrameContent.js
@@ -48,18 +48,7 @@ WebInspector.SourceFrameContent.prototype = {
 
     sourceFrameLineNumberToActualLocation: function(lineNumber)
     {
-        // Script content may start right after <script> tag without new line (e.g. "<script>function f()...").
-        // In that case, column number should be equal to script column offset.
-        var columnNumber = 0;
-        for (var i = 0; i < this._scriptRanges.length; ++i) {
-            var scriptRange = this._scriptRanges[i];
-            if (scriptRange.start.lineNumber < lineNumber)
-                continue;
-            if (scriptRange.start.lineNumber === lineNumber)
-                columnNumber = scriptRange.start.columnNumber;
-            break;
-        }
-        var location = this._mapping.sourceLocationToActualLocation(lineNumber, columnNumber);
+        var location = this._mapping.sourceLocationToActualLocation(lineNumber, 0);
         location.sourceID = this._sourceIDForSourceFrameLineNumber(lineNumber);
         return location;
     },
diff --git a/Source/WebCore/inspector/front-end/StylesSidebarPane.js b/Source/WebCore/inspector/front-end/StylesSidebarPane.js
index c7d151a..29d0317 100644
--- a/Source/WebCore/inspector/front-end/StylesSidebarPane.js
+++ b/Source/WebCore/inspector/front-end/StylesSidebarPane.js
@@ -132,10 +132,10 @@ WebInspector.StylesSidebarPane.prototype = {
         if (!forceUpdate && (!node || node === this.node))
             refresh = true;
 
-        if (node && node.nodeType === Node.TEXT_NODE && node.parentNode)
+        if (node && node.nodeType() === Node.TEXT_NODE && node.parentNode)
             node = node.parentNode;
 
-        if (node && node.nodeType !== Node.ELEMENT_NODE)
+        if (node && node.nodeType() !== Node.ELEMENT_NODE)
             node = null;
 
         if (node)
@@ -244,7 +244,7 @@ WebInspector.StylesSidebarPane.prototype = {
         var styleAttributes = {};
         for (var name in styles.styleAttributes) {
             var attrStyle = { style: styles.styleAttributes[name], editable: false };
-            attrStyle.selectorText = WebInspector.panels.elements.treeOutline.nodeNameToCorrectCase(node.nodeName) + "[" + name;
+            attrStyle.selectorText = WebInspector.panels.elements.treeOutline.nodeNameToCorrectCase(node.nodeName()) + "[" + name;
             if (node.getAttribute(name))
                 attrStyle.selectorText += "=" + node.getAttribute(name);
             attrStyle.selectorText += "]";
@@ -252,7 +252,7 @@ WebInspector.StylesSidebarPane.prototype = {
         }
 
         // Show element's Style Attributes
-        if (styles.inlineStyle && node.nodeType === Node.ELEMENT_NODE) {
+        if (styles.inlineStyle && node.nodeType() === Node.ELEMENT_NODE) {
             var inlineStyle = { selectorText: "element.style", style: styles.inlineStyle, isAttribute: true };
             styleRules.push(inlineStyle);
         }
@@ -1964,6 +1964,9 @@ WebInspector.StylesSidebarPane.CSSPropertyPrompt.prototype = {
     _buildPropertyCompletions: function(wordRange, bestMatchOnly, completionsReadyCallback)
     {
         var prefix = wordRange.toString().toLowerCase();
+        if (!prefix && bestMatchOnly)
+            return;
+
         var results;
         if (bestMatchOnly) {
             results = [];
diff --git a/Source/WebCore/inspector/front-end/TextEditorHighlighter.js b/Source/WebCore/inspector/front-end/TextEditorHighlighter.js
index 9bdcc82..75453fa 100644
--- a/Source/WebCore/inspector/front-end/TextEditorHighlighter.js
+++ b/Source/WebCore/inspector/front-end/TextEditorHighlighter.js
@@ -35,17 +35,14 @@ WebInspector.TextEditorHighlighter = function(textModel, damageCallback)
     this._tokenizer = WebInspector.SourceTokenizer.Registry.getInstance().getTokenizer("text/html");
     this._damageCallback = damageCallback;
     this._highlightChunkLimit = 1000;
-    this.reset();
 }
 
 WebInspector.TextEditorHighlighter.prototype = {
     set mimeType(mimeType)
     {
         var tokenizer = WebInspector.SourceTokenizer.Registry.getInstance().getTokenizer(mimeType);
-        if (tokenizer) {
+        if (tokenizer)
             this._tokenizer = tokenizer;
-            this._tokenizerConditionStringified = JSON.stringify(this._tokenizer.initialCondition);
-        }
     },
 
     set highlightChunkLimit(highlightChunkLimit)
@@ -53,18 +50,14 @@ WebInspector.TextEditorHighlighter.prototype = {
         this._highlightChunkLimit = highlightChunkLimit;
     },
 
-    reset: function()
-    {
-        this._lastHighlightedLine = 0;
-        this._lastHighlightedColumn = 0;
-        this._tokenizerConditionStringified = JSON.stringify(this._tokenizer.initialCondition);
-    },
-
     highlight: function(endLine, opt_forceRun)
     {
         // First check if we have work to do.
-        if (endLine <= this._lastHighlightedLine)
+        var state = this._textModel.getAttribute(endLine - 1, "highlight");
+        if (state && state.postConditionStringified) {
+            // Last line is highlighted, just exit.
             return;
+        }
 
         this._requestedEndLine = endLine;
 
@@ -73,77 +66,63 @@ WebInspector.TextEditorHighlighter.prototype = {
             return;
         }
 
-        // Do small highlight synchronously. This will provide instant highlight on PageUp / PageDown, gentle scrolling.
-        this._highlightInChunks(endLine);
+        // We will be highlighting. First rewind to the last highlighted line to gain proper highlighter context.
+        var startLine = endLine;
+        while (startLine > 0) {
+            var state = this._textModel.getAttribute(startLine - 1, "highlight");
+            if (state && state.postConditionStringified)
+                break;
+            startLine--;
+        }
 
-        // Schedule tail highlight if necessary.
-        if (this._lastHighlightedLine < endLine)
-            this._highlightTimer = setTimeout(this._highlightInChunks.bind(this, endLine), 100);
+        // Do small highlight synchronously. This will provide instant highlight on PageUp / PageDown, gentle scrolling.
+        this._highlightInChunks(startLine, endLine);
     },
 
     updateHighlight: function(startLine, endLine)
     {
-        if (this._lastHighlightedLine < startLine) {
-            // Highlighter did not reach this point yet, nothing to update. It will reach it on subsequent timer tick and do the job.
-            return false;
-        }
-
-        var savedLastHighlightedLine = this._lastHighlightedLine;
-        var savedLastHighlightedColumn = this._lastHighlightedColumn;
-        var savedTokenizerCondition = this._tokenizerConditionStringified;
-
-        this._lastHighlightedLine = startLine;
-        this._lastHighlightedColumn = 0;
-
-        // Restore highlighter context taken from the previous line.
-        var attributes = this._textModel.getAttribute(startLine - 1, "highlight") || {};
-        this._tokenizerConditionStringified = attributes.postConditionStringified || JSON.stringify(this._tokenizer.initialCondition);
-
-        // Try to update highlight synchronously.
-        this._highlightLines(endLine);
-
-        if (this._lastHighlightedLine >= this._textModel.linesCount) {
-            // All is done up to the end.
-            return true;
+        // Start line was edited, we should highlight everything until endLine.
+        this._clearHighlightState(startLine);
+
+        if (startLine) {
+            var state = this._textModel.getAttribute(startLine - 1, "highlight");
+            if (!state || !state.postConditionStringified) {
+                // Highlighter did not reach this point yet, nothing to update. It will reach it on subsequent timer tick and do the job.
+                return false;
+            }
         }
 
-        var attributes1 = this._textModel.getAttribute(this._lastHighlightedLine - 1, "highlight") || {};
-        var attributes2 = this._textModel.getAttribute(this._lastHighlightedLine, "highlight") || {};
-        if (this._lastHighlightedColumn === 0 && attributes2.preConditionStringified && attributes1.postConditionStringified === attributes2.preConditionStringified) {
-            // Highlighting ended ahead of time. Restore previously saved state, unless we have done more than it was before.
-            if (savedLastHighlightedLine >= this._lastHighlightedLine) {
-                this._lastHighlightedLine = savedLastHighlightedLine;
-                this._lastHighlightedColumn = savedLastHighlightedColumn;
-                this._tokenizerConditionStringified = savedTokenizerCondition;
-            }
-            return true;
-        } else {
-            // If failed to update highlight synchronously, invalidate highlight data for the subsequent lines.
-            if (this._lastHighlightedColumn === 0)
-                this._textModel.removeAttribute(this._lastHighlightedLine, "highlight");
-            for (var i = this._lastHighlightedLine + 1; i < this._textModel.linesCount; ++i)
+        var restored = this._highlightLines(startLine, endLine);
+        if (!restored) {
+            for (var i = this._lastHighlightedLine; i < this._textModel.linesCount; ++i) {
+                var state = this._textModel.getAttribute(i, "highlight");
+                if (!state && i > endLine)
+                    break;
+                this._textModel.setAttribute(i, "highlight-outdated", state);
                 this._textModel.removeAttribute(i, "highlight");
+            }
 
-            // Continue highlighting on subsequent timer ticks.
-            this._requestedEndLine = endLine;
-            if (!this._highlightTimer)
-                this._highlightTimer = setTimeout(this._highlightInChunks.bind(this, endLine), 100);
-
-            return false;
+            if (this._highlightTimer) {
+                clearTimeout(this._highlightTimer);
+                this._requestedEndLine = endLine;
+                this._highlightTimer = setTimeout(this._highlightInChunks.bind(this, this._lastHighlightedLine, this._requestedEndLine), 10);
+            }
         }
+        return restored;
     },
 
-    _highlightInChunks: function(endLine)
+    _highlightInChunks: function(startLine, endLine)
     {
         delete this._highlightTimer;
 
         // First we always check if we have work to do. Could be that user scrolled back and we can quit.
-        if (this._requestedEndLine <= this._lastHighlightedLine)
+        var state = this._textModel.getAttribute(this._requestedEndLine - 1, "highlight");
+        if (state && state.postConditionStringified)
             return;
 
         if (this._requestedEndLine !== endLine) {
             // User keeps updating the job in between of our timer ticks. Just reschedule self, don't eat CPU (they must be scrolling).
-            this._highlightTimer = setTimeout(this._highlightInChunks.bind(this, this._requestedEndLine), 100);
+            this._highlightTimer = setTimeout(this._highlightInChunks.bind(this, startLine, this._requestedEndLine), 100);
             return;
         }
 
@@ -151,58 +130,109 @@ WebInspector.TextEditorHighlighter.prototype = {
         if (this._requestedEndLine > this._textModel.linesCount)
             this._requestedEndLine = this._textModel.linesCount;
 
-        this._highlightLines(this._requestedEndLine);
+        this._highlightLines(startLine, this._requestedEndLine);
 
         // Schedule tail highlight if necessary.
         if (this._lastHighlightedLine < this._requestedEndLine)
-            this._highlightTimer = setTimeout(this._highlightInChunks.bind(this, this._requestedEndLine), 10);
+            this._highlightTimer = setTimeout(this._highlightInChunks.bind(this, this._lastHighlightedLine, this._requestedEndLine), 10);
     },
 
-    _highlightLines: function(endLine)
+    _highlightLines: function(startLine, endLine)
     {
-        // Tokenizer is stateless and reused across viewers, restore its condition before highlight and save it after.
-        this._tokenizer.condition = JSON.parse(this._tokenizerConditionStringified);
-        var tokensCount = 0;
-        for (var lineNumber = this._lastHighlightedLine; lineNumber < endLine; ++lineNumber) {
-            var line = this._textModel.line(lineNumber);
-            this._tokenizer.line = line;
-
-            if (this._lastHighlightedColumn === 0) {
-                var attributes = {};
-                attributes.preConditionStringified = JSON.stringify(this._tokenizer.condition);
-                this._textModel.setAttribute(lineNumber, "highlight", attributes);
-            } else
-                var attributes = this._textModel.getAttribute(lineNumber, "highlight");
-
-            // Highlight line.
-            do {
-                var newColumn = this._tokenizer.nextToken(this._lastHighlightedColumn);
-                var tokenType = this._tokenizer.tokenType;
-                if (tokenType)
-                    attributes[this._lastHighlightedColumn] = { length: newColumn - this._lastHighlightedColumn, tokenType: tokenType };
-                this._lastHighlightedColumn = newColumn;
-                if (++tokensCount > this._highlightChunkLimit)
-                    break;
-            } while (this._lastHighlightedColumn < line.length);
+        // Restore highlighter context taken from previous line.
+        var state = this._textModel.getAttribute(startLine - 1, "highlight");
+        var postConditionStringified = state ? state.postConditionStringified : JSON.stringify(this._tokenizer.initialCondition);
 
-            if (this._lastHighlightedColumn < line.length) {
-                // Too much work for single chunk - exit.
-                break;
+        var tokensCount = 0;
+        for (var lineNumber = startLine; lineNumber < endLine; ++lineNumber) {
+            var state = this._selectHighlightState(lineNumber, postConditionStringified);
+            if (state.postConditionStringified) {
+                // This line is already highlighted.
+                postConditionStringified = state.postConditionStringified;
             } else {
-                this._lastHighlightedColumn = 0;
-                attributes.postConditionStringified = JSON.stringify(this._tokenizer.condition);
+                var lastHighlightedColumn = 0;
+                if (state.midConditionStringified) {
+                    lastHighlightedColumn = state.lastHighlightedColumn;
+                    postConditionStringified = state.midConditionStringified;
+                }
 
-                var nextAttributes = this._textModel.getAttribute(lineNumber + 1, "highlight") || {};
-                if (nextAttributes.preConditionStringified === attributes.postConditionStringified) {
-                    // Following lines are up to date, no need to re-highlight.
-                    ++lineNumber;
+                var line = this._textModel.line(lineNumber);
+                this._tokenizer.line = line;
+                this._tokenizer.condition = JSON.parse(postConditionStringified);
+
+                // Highlight line.
+                do {
+                    var newColumn = this._tokenizer.nextToken(lastHighlightedColumn);
+                    var tokenType = this._tokenizer.tokenType;
+                    if (tokenType)
+                        state[lastHighlightedColumn] = { length: newColumn - lastHighlightedColumn, tokenType: tokenType };
+                    lastHighlightedColumn = newColumn;
+                    if (++tokensCount > this._highlightChunkLimit)
+                        break;
+                } while (lastHighlightedColumn < line.length);
+
+                postConditionStringified = JSON.stringify(this._tokenizer.condition);
+
+                if (lastHighlightedColumn < line.length) {
+                    // Too much work for single chunk - exit.
+                    state.lastHighlightedColumn = lastHighlightedColumn;
+                    state.midConditionStringified = postConditionStringified;
                     break;
+                } else {
+                    delete state.lastHighlightedColumn;
+                    delete state.midConditionStringified;
+                    state.postConditionStringified = postConditionStringified;
+                }
+            }
+
+            var nextLineState = this._textModel.getAttribute(lineNumber + 1, "highlight");
+            if (nextLineState && nextLineState.preConditionStringified === state.postConditionStringified) {
+                // Following lines are up to date, no need re-highlight.
+                ++lineNumber;
+                this._damageCallback(startLine, lineNumber);
+
+                // Advance the "pointer" to the last highlighted line within the given chunk.
+                for (; lineNumber < endLine; ++lineNumber) {
+                    var state = this._textModel.getAttribute(lineNumber, "highlight");
+                    if (!state || !state.postConditionStringified)
+                        break;
                 }
+                this._lastHighlightedLine = lineNumber;
+                return true;
             }
         }
 
-        this._damageCallback(this._lastHighlightedLine, lineNumber);
-        this._tokenizerConditionStringified = JSON.stringify(this._tokenizer.condition);
+        this._damageCallback(startLine, lineNumber);
         this._lastHighlightedLine = lineNumber;
+        return false;
+    },
+
+    _selectHighlightState: function(lineNumber, preConditionStringified)
+    {
+        var state = this._textModel.getAttribute(lineNumber, "highlight");
+        if (state && state.preConditionStringified === preConditionStringified)
+            return state;
+
+        var outdatedState = this._textModel.getAttribute(lineNumber, "highlight-outdated");
+        if (outdatedState && outdatedState.preConditionStringified === preConditionStringified) {
+            // Swap states.
+            this._textModel.setAttribute(lineNumber, "highlight", outdatedState);
+            this._textModel.setAttribute(lineNumber, "highlight-outdated", state);
+            return outdatedState;
+        }
+
+        if (state)
+            this._textModel.setAttribute(lineNumber, "highlight-outdated", state);
+
+        state = {};
+        state.preConditionStringified = preConditionStringified;
+        this._textModel.setAttribute(lineNumber, "highlight", state);
+        return state;
+    },
+
+    _clearHighlightState: function(lineNumber)
+    {
+        this._textModel.removeAttribute(lineNumber, "highlight");
+        this._textModel.removeAttribute(lineNumber, "highlight-outdated");
     }
 }
diff --git a/Source/WebCore/inspector/front-end/TextEditorModel.js b/Source/WebCore/inspector/front-end/TextEditorModel.js
index f23ce76..b14a3b7 100644
--- a/Source/WebCore/inspector/front-end/TextEditorModel.js
+++ b/Source/WebCore/inspector/front-end/TextEditorModel.js
@@ -72,6 +72,11 @@ WebInspector.TextEditorModel.prototype = {
         return this._lines.length;
     },
 
+    get text()
+    {
+        return this._lines.join("\n");
+    },
+
     line: function(lineNumber)
     {
         if (lineNumber >= this._lines.length)
diff --git a/Source/WebCore/inspector/front-end/TextViewer.js b/Source/WebCore/inspector/front-end/TextViewer.js
index 65b4724..43b34f6 100644
--- a/Source/WebCore/inspector/front-end/TextViewer.js
+++ b/Source/WebCore/inspector/front-end/TextViewer.js
@@ -45,6 +45,11 @@ WebInspector.TextViewer = function(textModel, platform, url)
     this._gutterPanel = new WebInspector.TextEditorGutterPanel(this._textModel, syncDecorationsForLineListener);
     this.element.appendChild(this._mainPanel.element);
     this.element.appendChild(this._gutterPanel.element);
+
+    // Forward mouse wheel events from the unscrollable gutter to the main panel.
+    this._gutterPanel.element.addEventListener("mousewheel", function(e) {
+        this._mainPanel.element.dispatchEvent(e);
+    }.bind(this), false)
 }
 
 WebInspector.TextViewer.prototype = {
@@ -58,6 +63,11 @@ WebInspector.TextViewer.prototype = {
         this._mainPanel.readOnly = readOnly;
     },
 
+    get readOnly()
+    {
+        return this._mainPanel.readOnly;
+    },
+
     set startEditingListener(startEditingListener)
     {
         this._startEditingListener = startEditingListener;
@@ -111,11 +121,6 @@ WebInspector.TextViewer.prototype = {
         this._gutterPanel.freeCachedElements();
     },
 
-    editLine: function(lineRow, callback)
-    {
-        this._mainPanel.editLine(lineRow, callback);
-    },
-
     get scrollTop()
     {
         return this._mainPanel.element.scrollTop;
@@ -395,15 +400,19 @@ WebInspector.TextEditorChunkedPanel.prototype = {
         return this._textChunks[this._chunkNumberForLine(lineNumber)];
     },
 
-    _findVisibleChunks: function(visibleFrom, visibleTo)
+    _findFirstVisibleChunkNumber: function(visibleFrom)
     {
         function compareOffsetTops(value, chunk)
         {
             return value < chunk.offsetTop ? -1 : 1;
         }
         var insertBefore = insertionIndexForObjectInListSortedByFunction(visibleFrom, this._textChunks, compareOffsetTops);
+        return insertBefore - 1;
+    },
 
-        var from = insertBefore - 1;
+    _findVisibleChunks: function(visibleFrom, visibleTo)
+    {
+        var from = this._findFirstVisibleChunkNumber(visibleFrom);
         for (var to = from + 1; to < this._textChunks.length; ++to) {
             if (this._textChunks[to].offsetTop >= visibleTo)
                 break;
@@ -411,6 +420,26 @@ WebInspector.TextEditorChunkedPanel.prototype = {
         return { start: from, end: to };
     },
 
+    _findFirstVisibleLineNumber: function(visibleFrom)
+    {
+        var chunk = this._textChunks[this._findFirstVisibleChunkNumber(visibleFrom)];
+        if (!chunk.expanded)
+            return chunk.startLine;
+
+        var lineNumbers = [];
+        for (var i = 0; i < chunk.linesCount; ++i) {
+            lineNumbers.push(chunk.startLine + i);
+        }
+
+        function compareLineRowOffsetTops(value, lineNumber)
+        {
+            var lineRow = chunk.getExpandedLineRow(lineNumber);
+            return value < lineRow.offsetTop ? -1 : 1;
+        }
+        var insertBefore = insertionIndexForObjectInListSortedByFunction(visibleFrom, lineNumbers, compareLineRowOffsetTops);
+        return lineNumbers[insertBefore - 1];
+    },
+
     _repaintAll: function()
     {
         delete this._repaintAllTimer;
@@ -430,6 +459,17 @@ WebInspector.TextEditorChunkedPanel.prototype = {
         }
     },
 
+    _expandChunks: function(fromIndex, toIndex)
+    {
+        // First collapse chunks to collect the DOM elements into a cache to reuse them later.
+        for (var i = 0; i < fromIndex; ++i)
+            this._textChunks[i].expanded = false;
+        for (var i = toIndex; i < this._textChunks.length; ++i)
+            this._textChunks[i].expanded = false;
+        for (var i = fromIndex; i < toIndex; ++i)
+            this._textChunks[i].expanded = true;
+    },
+
     _totalHeight: function(firstElement, lastElement)
     {
         lastElement = (lastElement || firstElement).nextElementSibling;
@@ -484,12 +524,6 @@ WebInspector.TextEditorGutterPanel.prototype = {
         return new WebInspector.TextEditorGutterChunk(this, startLine, endLine);
     },
 
-    _expandChunks: function(fromIndex, toIndex)
-    {
-        for (var i = 0; i < this._textChunks.length; ++i)
-            this._textChunks[i].expanded = (fromIndex <= i && i < toIndex);
-    },
-
     textChanged: function(oldRange, newRange)
     {
         if (!this._textChunks) {
@@ -689,10 +723,6 @@ WebInspector.TextEditorMainPanel = function(textModel, url, syncScrollListener,
 
     this.element.addEventListener("scroll", this._scroll.bind(this), false);
 
-    // FIXME: Remove old live editing functionality and Preferences.sourceEditorEnabled flag.
-    if (!Preferences.sourceEditorEnabled)
-        this._container.addEventListener("keydown", this._handleKeyDown.bind(this), false);
-
     // In WebKit the DOMNodeRemoved event is fired AFTER the node is removed, thus it should be
     // attached to all DOM nodes that we want to track. Instead, we attach the DOMNodeRemoved
     // listeners only on the line rows, and use DOMSubtreeModified to track node removals inside
@@ -714,10 +744,6 @@ WebInspector.TextEditorMainPanel.prototype = {
 
     set readOnly(readOnly)
     {
-        // FIXME: Remove the Preferences.sourceEditorEnabled flag.
-        if (!Preferences.sourceEditorEnabled)
-            return;
-
         this.beginDomUpdates();
         this._readOnly = readOnly;
         if (this._readOnly)
@@ -727,6 +753,11 @@ WebInspector.TextEditorMainPanel.prototype = {
         this.endDomUpdates();
     },
 
+    get readOnly()
+    {
+        return this._readOnly;
+    },
+
     markAndRevealRange: function(range)
     {
         if (this._rangeToMark) {
@@ -768,58 +799,8 @@ WebInspector.TextEditorMainPanel.prototype = {
         this._cachedRows = [];
     },
 
-    _handleKeyDown: function()
-    {
-        if (this._editingLine || event.metaKey || event.shiftKey || event.ctrlKey || event.altKey)
-            return;
-
-        var scrollValue = 0;
-        if (event.keyCode === WebInspector.KeyboardShortcut.Keys.Up.code)
-            scrollValue = -1;
-        else if (event.keyCode == WebInspector.KeyboardShortcut.Keys.Down.code)
-            scrollValue = 1;
-
-        if (scrollValue) {
-            event.preventDefault();
-            event.stopPropagation();
-            this.element.scrollByLines(scrollValue);
-            return;
-        }
-
-        scrollValue = 0;
-        if (event.keyCode === WebInspector.KeyboardShortcut.Keys.Left.code)
-            scrollValue = -40;
-        else if (event.keyCode == WebInspector.KeyboardShortcut.Keys.Right.code)
-            scrollValue = 40;
-
-        if (scrollValue) {
-            event.preventDefault();
-            event.stopPropagation();
-            this.element.scrollLeft += scrollValue;
-        }
-    },
-
-    editLine: function(lineRow, callback)
-    {
-        var oldContent = lineRow.innerHTML;
-        function finishEditing(committed, e, newContent)
-        {
-            if (committed)
-                callback(newContent);
-            lineRow.innerHTML = oldContent;
-            delete this._editingLine;
-        }
-        this._editingLine = WebInspector.startEditing(lineRow, {
-            context: null,
-            commitHandler: finishEditing.bind(this, true),
-            cancelHandler: finishEditing.bind(this, false),
-            multiline: true
-        });
-    },
-
     _buildChunks: function()
     {
-        this._highlighter.reset();
         for (var i = 0; i < this._textModel.linesCount; ++i)
             this._textModel.removeAttribute(i, "highlight");
 
@@ -842,8 +823,8 @@ WebInspector.TextEditorMainPanel.prototype = {
         this._highlighter.highlight(lastVisibleLine);
         delete this._muteHighlightListener;
 
-        for (var i = 0; i < this._textChunks.length; ++i)
-            this._textChunks[i].expanded = (fromIndex <= i && i < toIndex);
+        this._restorePaintLinesOperationsCredit();
+        WebInspector.TextEditorChunkedPanel.prototype._expandChunks.call(this, fromIndex, toIndex);
 
         this._restoreSelection(selection);
     },
@@ -852,64 +833,118 @@ WebInspector.TextEditorMainPanel.prototype = {
     {
         if (this._muteHighlightListener)
             return;
+        this._restorePaintLinesOperationsCredit();
         this._paintLines(fromLine, toLine, true /*restoreSelection*/);
     },
 
-    _markSkippedPaintLines: function(startLine, endLine)
+    _schedulePaintLines: function(startLine, endLine)
     {
-        if (!this._skippedPaintLines)
-            this._skippedPaintLines = [ { startLine: startLine, endLine: endLine } ];
-        else {
-            for (var i = 0; i < this._skippedPaintLines.length; ++i) {
-                var chunk = this._skippedPaintLines[i];
+        if (startLine >= endLine)
+            return;
+
+        if (!this._scheduledPaintLines) {
+            this._scheduledPaintLines = [ { startLine: startLine, endLine: endLine } ];
+            this._paintScheduledLinesTimer = setTimeout(this._paintScheduledLines.bind(this), 10);
+        } else {
+            for (var i = 0; i < this._scheduledPaintLines.length; ++i) {
+                var chunk = this._scheduledPaintLines[i];
                 if (chunk.startLine <= endLine && chunk.endLine >= startLine) {
                     chunk.startLine = Math.min(chunk.startLine, startLine);
                     chunk.endLine = Math.max(chunk.endLine, endLine);
                     return;
                 }
+                if (chunk.startLine > endLine) {
+                    this._scheduledPaintLines.splice(i, 0, { startLine: startLine, endLine: endLine });
+                    return;
+                }
             }
-            this._skippedPaintLines.push({ startLine: startLine, endLine: endLine });
+            this._scheduledPaintLines.push({ startLine: startLine, endLine: endLine });
         }
     },
 
-    _paintSkippedLines: function()
+    _paintScheduledLines: function(skipRestoreSelection)
     {
-        if (!this._skippedPaintLines || this._dirtyLines)
+        if (this._paintScheduledLinesTimer)
+            clearTimeout(this._paintScheduledLinesTimer);
+        delete this._paintScheduledLinesTimer;
+
+        if (!this._scheduledPaintLines)
+            return;
+
+        // Reschedule the timer if we can not paint the lines yet, or the user is scrolling.
+        if (this._dirtyLines || this._repaintAllTimer) {
+            this._paintScheduledLinesTimer = setTimeout(this._paintScheduledLines.bind(this), 50);
             return;
-        for (var i = 0; i < this._skippedPaintLines.length; ++i) {
-            var chunk = this._skippedPaintLines[i];
-            this._paintLines(chunk.startLine, chunk.endLine);
         }
-        delete this._skippedPaintLines;
+
+        var scheduledPaintLines = this._scheduledPaintLines;
+        delete this._scheduledPaintLines;
+        
+        this._restorePaintLinesOperationsCredit();
+        this._paintLineChunks(scheduledPaintLines, !skipRestoreSelection);
+    },
+
+    _restorePaintLinesOperationsCredit: function()
+    {
+        this._paintLinesOperationsCredit = 250;
     },
 
     _paintLines: function(fromLine, toLine, restoreSelection)
     {
-        if (this._dirtyLines) {
-            this._markSkippedPaintLines(fromLine, toLine);
-            return;
-        }
+        this._paintLineChunks([ { startLine: fromLine, endLine: toLine } ], restoreSelection);
+    },
+
+    _paintLineChunks: function(lineChunks, restoreSelection)
+    {
+        // First, paint visible lines, so that in case of long lines we should start highlighting
+        // the visible area immediately, instead of waiting for the lines above the visible area.
+        var visibleFrom = this.element.scrollTop;
+        var firstVisibleLineNumber = this._findFirstVisibleLineNumber(visibleFrom);
 
+        var chunk;
         var selection;
-        var chunk = this.chunkForLine(fromLine);
-        for (var i = fromLine; i < toLine; ++i) {
-            if (i >= chunk.startLine + chunk.linesCount)
-                chunk = this.chunkForLine(i);
-            var lineRow = chunk.getExpandedLineRow(i);
-            if (!lineRow)
+        var invisibleLineRows = [];
+        for (var i = 0; i < lineChunks.length; ++i) {
+            var lineChunk = lineChunks[i];
+            if (this._dirtyLines || this._scheduledPaintLines) {
+                this._schedulePaintLines(lineChunk.startLine, lineChunk.endLine);
                 continue;
+            }
+            for (var lineNumber = lineChunk.startLine; lineNumber < lineChunk.endLine; ++lineNumber) {
+                if (!chunk || lineNumber < chunk.startLine || lineNumber >= chunk.startLine + chunk.linesCount)
+                    chunk = this.chunkForLine(lineNumber);
+                var lineRow = chunk.getExpandedLineRow(lineNumber);
+                if (!lineRow)
+                    continue;
+                if (lineNumber < firstVisibleLineNumber) {
+                    invisibleLineRows.push(lineRow);
+                    continue;
+                }
+                if (restoreSelection && !selection)
+                    selection = this._getSelection();
+                this._paintLine(lineRow);
+                if (this._paintLinesOperationsCredit < 0) {
+                    this._schedulePaintLines(lineNumber + 1, lineChunk.endLine);
+                    break;
+                }
+            }
+        }
+
+        for (var i = 0; i < invisibleLineRows.length; ++i) {
             if (restoreSelection && !selection)
                 selection = this._getSelection();
-            this._paintLine(lineRow, i);
+            this._paintLine(invisibleLineRows[i]);
         }
+
         if (restoreSelection)
             this._restoreSelection(selection);
     },
 
-    _paintLine: function(lineRow, lineNumber)
+    _paintLine: function(lineRow)
     {
-        if (this._dirtyLines) {
-            this._markSkippedPaintLines(lineNumber, lineNumber + 1);
+        var lineNumber = lineRow.lineNumber;
+        if (this._dirtyLines || this._scheduledPaintLines || this._paintLinesOperationsCredit < 0) {
+            this._schedulePaintLines(lineNumber, lineNumber + 1);
             return;
         }
 
@@ -944,13 +979,17 @@ WebInspector.TextEditorMainPanel.prototype = {
                     if (plainTextStart !== -1) {
                         this._appendTextNode(lineRow, line.substring(plainTextStart, j));
                         plainTextStart = -1;
+                        --this._paintLinesOperationsCredit;
                     }
                     this._appendSpan(lineRow, line.substring(j, j + attribute.length), attribute.tokenType);
                     j += attribute.length;
+                    --this._paintLinesOperationsCredit;
                 }
             }
-            if (plainTextStart !== -1)
+            if (plainTextStart !== -1) {
                 this._appendTextNode(lineRow, line.substring(plainTextStart, line.length));
+                --this._paintLinesOperationsCredit;
+            }
             if (this._rangeToMark && this._rangeToMark.startLine === lineNumber)
                 this._markedRangeElement = highlightSearchResult(lineRow, this._rangeToMark.startColumn, this._rangeToMark.endColumn - this._rangeToMark.startColumn);
             if (lineRow.decorationsElement)
@@ -1141,12 +1180,37 @@ WebInspector.TextEditorMainPanel.prototype = {
         if (this._readOnly)
             return;
 
-        var lineNumber = lineRow.lineNumber;
+        if (target === lineRow && e.type === "DOMNodeInserted") {
+            // Ensure that the newly inserted line row has no lineNumber.
+            delete lineRow.lineNumber;
+        }
+
+        var startLine = 0;
+        for (var row = lineRow; row; row = row.previousSibling) {
+            if (typeof row.lineNumber === "number") {
+                startLine = row.lineNumber;
+                break;
+            }
+        }
+
+        var endLine = startLine + 1;
+        for (var row = lineRow.nextSibling; row; row = row.nextSibling) {
+            if (typeof row.lineNumber === "number") {
+                endLine = row.lineNumber;
+                break;
+            }
+        }
+
+        if (target === lineRow && e.type === "DOMNodeRemoved") {
+            // Now this will no longer be valid.
+            delete lineRow.lineNumber;
+        }
+ 
         if (this._dirtyLines) {
-            this._dirtyLines.start = Math.min(this._dirtyLines.start, lineNumber);
-            this._dirtyLines.end = Math.max(this._dirtyLines.end, lineNumber + 1);
+            this._dirtyLines.start = Math.min(this._dirtyLines.start, startLine);
+            this._dirtyLines.end = Math.max(this._dirtyLines.end, endLine);
         } else {
-            this._dirtyLines = { start: lineNumber, end: lineNumber + 1 };
+            this._dirtyLines = { start: startLine, end: endLine };
             setTimeout(this._applyDomUpdates.bind(this), 0);
             // Remove marked ranges, if any.
             this.markAndRevealRange(null);
@@ -1227,7 +1291,7 @@ WebInspector.TextEditorMainPanel.prototype = {
         this._removeDecorationsInRange(oldRange);
         this._updateChunksForRanges(oldRange, newRange);
         this._updateHighlightsForRange(newRange);
-        this._paintSkippedLines();
+        this._paintScheduledLines(true);
         this.endDomUpdates();
 
         this._restoreSelection(selection);
@@ -1348,7 +1412,8 @@ WebInspector.TextEditorMainPanel.prototype = {
         var chunk = this._textChunks[result.end - 1];
         var lastVisibleLine = chunk.startLine + chunk.linesCount;
 
-        lastVisibleLine = Math.max(lastVisibleLine, range.endLine);
+        lastVisibleLine = Math.max(lastVisibleLine, range.endLine + 1);
+        lastVisibleLine = Math.min(lastVisibleLine, this._textModel.linesCount);
 
         var updated = this._highlighter.updateHighlight(range.startLine, lastVisibleLine);
         if (!updated) {
@@ -1479,7 +1544,7 @@ WebInspector.TextEditorMainChunk.prototype = {
 
         if (this.linesCount === 1) {
             if (expanded)
-                this._textViewer._paintLine(this.element, this.startLine);
+                this._textViewer._paintLine(this.element);
             return;
         }
 
@@ -1492,9 +1557,9 @@ WebInspector.TextEditorMainChunk.prototype = {
                 var lineRow = this._createRow(i);
                 parentElement.insertBefore(lineRow, this.element);
                 this._expandedLineRows.push(lineRow);
-                this._textViewer._paintLine(lineRow, i);
             }
             parentElement.removeChild(this.element);
+            this._textViewer._paintLines(this.startLine, this.startLine + this.linesCount);
         } else {
             var elementInserted = false;
             for (var i = 0; i < this._expandedLineRows.length; ++i) {
diff --git a/Source/WebCore/inspector/front-end/TimelineAgent.js b/Source/WebCore/inspector/front-end/TimelineAgent.js
index 97b8e42..5c5ca41 100644
--- a/Source/WebCore/inspector/front-end/TimelineAgent.js
+++ b/Source/WebCore/inspector/front-end/TimelineAgent.js
@@ -34,25 +34,30 @@ WebInspector.TimelineAgent = function() {
 
 // Must be kept in sync with TimelineItem.h
 WebInspector.TimelineAgent.RecordType = {
-    EventDispatch : 0,
-    Layout : 1,
-    RecalculateStyles : 2,
-    Paint : 3,
-    ParseHTML : 4,
-    TimerInstall : 5,
-    TimerRemove : 6,
-    TimerFire : 7,
-    XHRReadyStateChange : 8,
-    XHRLoad : 9,
-    EvaluateScript : 10,
-    MarkTimeline : 11,
-    ResourceSendRequest : 12,
-    ResourceReceiveResponse : 13,
-    ResourceFinish : 14,
-    FunctionCall : 15,
-    ResourceReceiveData: 16,
-    GCEvent : 17,
-    MarkDOMContentEventType : 18,
-    MarkLoadEventType : 19,
-    ScheduleResourceRequest : 20
+    EventDispatch: "EventDispatch",
+    Layout: "Layout",
+    RecalculateStyles: "RecalculateStyles",
+    Paint: "Paint",
+    ParseHTML: "ParseHTML",
+
+    TimerInstall: "TimerInstall",
+    TimerRemove: "TimerRemove",
+    TimerFire: "TimerFire",
+
+    XHRReadyStateChange: "XHRReadyStateChange",
+    XHRLoad: "XHRLoad",
+    EvaluateScript: "EvaluateScript",
+
+    MarkTimeline: "MarkTimeline",
+    MarkLoad: "MarkLoad",
+    MarkDOMContent: "MarkDOMContent",
+
+    ScheduleResourceRequest: "ScheduleResourceRequest",
+    ResourceSendRequest: "ResourceSendRequest",
+    ResourceReceiveResponse: "ResourceReceiveResponse",
+    ResourceReceivedData: "ResourceReceivedData",
+    ResourceFinish: "ResourceFinish",
+
+    FunctionCall: "FunctionCall",
+    GCEvent: "GCEvent"
 };
diff --git a/Source/WebCore/inspector/front-end/TimelinePanel.js b/Source/WebCore/inspector/front-end/TimelinePanel.js
index 62c5de0..2f30876 100644
--- a/Source/WebCore/inspector/front-end/TimelinePanel.js
+++ b/Source/WebCore/inspector/front-end/TimelinePanel.js
@@ -147,7 +147,7 @@ WebInspector.TimelinePanel.prototype = {
 
     get statusBarItems()
     {
-        return [this.toggleFilterButton.element, this.toggleTimelineButton.element, this.clearButton.element, this._overviewPane.statusBarFilters];
+        return [this.toggleFilterButton.element, this.toggleTimelineButton.element, this.garbageCollectButton.element, this.clearButton.element, this._overviewPane.statusBarFilters];
     },
 
     get categories()
@@ -188,10 +188,10 @@ WebInspector.TimelinePanel.prototype = {
             recordStyles[recordTypes.ResourceReceiveResponse] = { title: WebInspector.UIString("Receive Response"), category: this.categories.loading };
             recordStyles[recordTypes.ResourceFinish] = { title: WebInspector.UIString("Finish Loading"), category: this.categories.loading };
             recordStyles[recordTypes.FunctionCall] = { title: WebInspector.UIString("Function Call"), category: this.categories.scripting };
-            recordStyles[recordTypes.ResourceReceiveData] = { title: WebInspector.UIString("Receive Data"), category: this.categories.loading };
+            recordStyles[recordTypes.ResourceReceivedData] = { title: WebInspector.UIString("Receive Data"), category: this.categories.loading };
             recordStyles[recordTypes.GCEvent] = { title: WebInspector.UIString("GC Event"), category: this.categories.scripting };
-            recordStyles[recordTypes.MarkDOMContentEventType] = { title: WebInspector.UIString("DOMContent event"), category: this.categories.scripting };
-            recordStyles[recordTypes.MarkLoadEventType] = { title: WebInspector.UIString("Load event"), category: this.categories.scripting };
+            recordStyles[recordTypes.MarkDOMContent] = { title: WebInspector.UIString("DOMContent event"), category: this.categories.scripting };
+            recordStyles[recordTypes.MarkLoad] = { title: WebInspector.UIString("Load event"), category: this.categories.scripting };
             recordStyles[recordTypes.ScheduleResourceRequest] = { title: WebInspector.UIString("Schedule Request"), category: this.categories.loading };
             this._recordStylesArray = recordStyles;
         }
@@ -209,6 +209,9 @@ WebInspector.TimelinePanel.prototype = {
         this.toggleFilterButton = new WebInspector.StatusBarButton(this._hideShortRecordsTitleText, "timeline-filter-status-bar-item");
         this.toggleFilterButton.addEventListener("click", this._toggleFilterButtonClicked.bind(this), false);
 
+        this.garbageCollectButton = new WebInspector.StatusBarButton(WebInspector.UIString("Collect Garbage"), "garbage-collect-status-bar-item");
+        this.garbageCollectButton.addEventListener("click", this._garbageCollectButtonClicked.bind(this), false);
+
         this.recordsCounter = document.createElement("span");
         this.recordsCounter.className = "timeline-records-counter";
     },
@@ -247,9 +250,9 @@ WebInspector.TimelinePanel.prototype = {
         eventDividerPadding.className = "resources-event-divider-padding";
         eventDividerPadding.title = record.title;
 
-        if (record.type === recordTypes.MarkDOMContentEventType)
+        if (record.type === recordTypes.MarkDOMContent)
             eventDivider.className += " resources-blue-divider";
-        else if (record.type === recordTypes.MarkLoadEventType)
+        else if (record.type === recordTypes.MarkLoad)
             eventDivider.className += " resources-red-divider";
         else if (record.type === recordTypes.MarkTimeline) {
             eventDivider.className += " resources-orange-divider";
@@ -284,6 +287,11 @@ WebInspector.TimelinePanel.prototype = {
         this.toggleFilterButton.element.title = this._calculator._showShortEvents ? this._hideShortRecordsTitleText : this._showShortRecordsTitleText;
         this._scheduleRefresh(true);
     },
+    
+    _garbageCollectButtonClicked: function()
+    {
+        ProfilerAgent.collectGarbage();
+    },
 
     _timelineProfilerWasStarted: function()
     {
@@ -317,7 +325,7 @@ WebInspector.TimelinePanel.prototype = {
         var parentRecord;
         if (record.type === recordTypes.ResourceReceiveResponse ||
             record.type === recordTypes.ResourceFinish ||
-            record.type === recordTypes.ResourceReceiveData)
+            record.type === recordTypes.ResourceReceivedData)
             parentRecord = this._sendRequestRecords[record.data.identifier];
         else if (record.type === recordTypes.TimerFire)
             parentRecord = this._timerRecords[record.data.timerId];
@@ -330,7 +338,7 @@ WebInspector.TimelinePanel.prototype = {
     {
         var connectedToOldRecord = false;
         var recordTypes = WebInspector.TimelineAgent.RecordType;
-        if (record.type === recordTypes.MarkDOMContentEventType || record.type === recordTypes.MarkLoadEventType)
+        if (record.type === recordTypes.MarkDOMContent || record.type === recordTypes.MarkLoad)
             parentRecord = null; // No bar entry for load events.
         else if (parentRecord === this._rootRecord) {
             var newParentRecord = this._findParentRecord(record);
@@ -352,7 +360,7 @@ WebInspector.TimelinePanel.prototype = {
 
         var formattedRecord = new WebInspector.TimelinePanel.FormattedRecord(record, parentRecord, this);
 
-        if (record.type === recordTypes.MarkDOMContentEventType || record.type === recordTypes.MarkLoadEventType) {
+        if (record.type === recordTypes.MarkDOMContent || record.type === recordTypes.MarkLoad) {
             this._markTimelineRecords.push(formattedRecord);
             return;
         }
@@ -649,17 +657,17 @@ WebInspector.TimelineDispatcher = function(timelinePanel)
 }
 
 WebInspector.TimelineDispatcher.prototype = {
-    timelineProfilerWasStarted: function()
+    started: function()
     {
         this._timelinePanel._timelineProfilerWasStarted();
     },
 
-    timelineProfilerWasStopped: function()
+    stopped: function()
     {
         this._timelinePanel._timelineProfilerWasStopped();
     },
 
-    addRecordToTimeline: function(record)
+    eventRecorded: function(record)
     {
         this._timelinePanel._addRecordToTimeline(record);
     }
@@ -853,7 +861,6 @@ WebInspector.TimelinePanel.FormattedRecord = function(record, parentRecord, pane
 {
     var recordTypes = WebInspector.TimelineAgent.RecordType;
     var style = panel._recordStyles[record.type];
-
     this.parent = parentRecord;
     if (parentRecord)
         parentRecord.children.push(this);
@@ -884,7 +891,7 @@ WebInspector.TimelinePanel.FormattedRecord = function(record, parentRecord, pane
             if (sendRequestRecord.parent !== panel._rootRecord && sendRequestRecord.parent.type === recordTypes.ScheduleResourceRequest)
                 sendRequestRecord.parent.details = this._getRecordDetails(sendRequestRecord, panel._sendRequestRecords);
         }
-    } else if (record.type === recordTypes.ResourceReceiveData) {
+    } else if (record.type === recordTypes.ResourceReceivedData) {
         var sendRequestRecord = panel._sendRequestRecords[record.data.identifier];
         if (sendRequestRecord) // False for main resource.
             record.data.url = sendRequestRecord.data.url;
@@ -968,7 +975,7 @@ WebInspector.TimelinePanel.FormattedRecord.prototype = {
             case recordTypes.ScheduleResourceRequest:
             case recordTypes.ResourceSendRequest:
             case recordTypes.ResourceReceiveResponse:
-            case recordTypes.ResourceReceiveData:
+            case recordTypes.ResourceReceivedData:
             case recordTypes.ResourceFinish:
                 contentHelper._appendLinkRow(WebInspector.UIString("Resource"), this.data.url);
                 if (this.data.requestMethod)
@@ -977,8 +984,6 @@ WebInspector.TimelinePanel.FormattedRecord.prototype = {
                     contentHelper._appendTextRow(WebInspector.UIString("Status Code"), this.data.statusCode);
                 if (this.data.mimeType)
                     contentHelper._appendTextRow(WebInspector.UIString("MIME Type"), this.data.mimeType);
-                if (typeof this.data.expectedContentLength === "number" && this.data.expectedContentLength !== -1)
-                    contentHelper._appendTextRow(WebInspector.UIString("Expected Content Length"), this.data.expectedContentLength);
                 break;
             case recordTypes.EvaluateScript:
                 if (this.data && this.data.url)
@@ -1035,7 +1040,7 @@ WebInspector.TimelinePanel.FormattedRecord.prototype = {
             case WebInspector.TimelineAgent.RecordType.XHRLoad:
             case WebInspector.TimelineAgent.RecordType.ScheduleResourceRequest:
             case WebInspector.TimelineAgent.RecordType.ResourceSendRequest:
-            case WebInspector.TimelineAgent.RecordType.ResourceReceiveData:
+            case WebInspector.TimelineAgent.RecordType.ResourceReceivedData:
             case WebInspector.TimelineAgent.RecordType.ResourceReceiveResponse:
             case WebInspector.TimelineAgent.RecordType.ResourceFinish:
                 return WebInspector.displayNameForURL(record.data.url);
diff --git a/Source/WebCore/inspector/front-end/WatchExpressionsSidebarPane.js b/Source/WebCore/inspector/front-end/WatchExpressionsSidebarPane.js
index bb3460d..23247fc 100644
--- a/Source/WebCore/inspector/front-end/WatchExpressionsSidebarPane.js
+++ b/Source/WebCore/inspector/front-end/WatchExpressionsSidebarPane.js
@@ -103,7 +103,7 @@ WebInspector.WatchExpressionsSection.prototype = {
             // last property, and then call the superclass's updateProperties() 
             // method to get all the properties refreshed at once.
             properties.push(property);
-            
+
             if (properties.length == propertyCount) {
                 this.updateProperties(properties, WebInspector.WatchExpressionTreeElement, WebInspector.WatchExpressionsSection.CompareProperties);
 
@@ -120,7 +120,7 @@ WebInspector.WatchExpressionsSection.prototype = {
         }
 
         // TODO: pass exact injected script id.
-        RuntimeAgent.releaseObjectGroup(0, this._watchObjectGroupId)
+        RuntimeAgent.releaseObjectGroup(this._watchObjectGroupId)
         var properties = [];
 
         // Count the properties, so we known when to call this.updateProperties()
diff --git a/Source/WebCore/inspector/front-end/WebKit.qrc b/Source/WebCore/inspector/front-end/WebKit.qrc
index 91d72d8..0777a19 100644
--- a/Source/WebCore/inspector/front-end/WebKit.qrc
+++ b/Source/WebCore/inspector/front-end/WebKit.qrc
@@ -32,6 +32,7 @@
     <file>DataGrid.js</file>
     <file>DebuggerModel.js</file>
     <file>DebuggerPresentationModel.js</file>
+    <file>SourceFile.js</file>
     <file>DOMAgent.js</file>
     <file>DOMStorage.js</file>
     <file>DOMStorageItemsView.js</file>
@@ -77,6 +78,7 @@
     <file>Resource.js</file>
     <file>ResourceCategory.js</file>
     <file>ResourceCookiesView.js</file>
+    <file>ResourceJSONView.js</file>
     <file>ResourceHeadersView.js</file>
     <file>ResourceTimingView.js</file>
     <file>ResourceTreeModel.js</file>
@@ -174,6 +176,7 @@
     <file>Images/focusButtonGlyph.png</file>
     <file>Images/forward.png</file>
     <file>Images/frame.png</file>
+    <file>Images/garbageCollectButtonGlyph.png</file>
     <file>Images/gearButtonGlyph.png</file>
     <file>Images/glossyHeader.png</file>
     <file>Images/glossyHeaderPressed.png</file>
@@ -285,6 +288,5 @@
     <file>Images/warningMediumIcon.png</file>
     <file>Images/warningOrangeDot.png</file>
     <file>Images/warningsErrors.png</file>
-    <file alias="DebuggerScript.js">../../bindings/v8/DebuggerScript.js</file>
 </qresource>
 </RCC>
diff --git a/Source/WebCore/inspector/front-end/WorkersSidebarPane.js b/Source/WebCore/inspector/front-end/WorkersSidebarPane.js
index efdb936..e70db44 100644
--- a/Source/WebCore/inspector/front-end/WorkersSidebarPane.js
+++ b/Source/WebCore/inspector/front-end/WorkersSidebarPane.js
@@ -74,9 +74,9 @@ WebInspector.WorkersSidebarPane.prototype = {
 
     setInstrumentation: function(enabled)
     {
-        InspectorAgent.removeAllScriptsToEvaluateOnLoad();
+        PageAgent.removeAllScriptsToEvaluateOnLoad();
         if (enabled)
-            InspectorAgent.addScriptToEvaluateOnLoad("(" + InjectedFakeWorker + ")");
+            PageAgent.addScriptToEvaluateOnLoad("(" + InjectedFakeWorker + ")");
     },
 
     reset: function()
diff --git a/Source/WebCore/inspector/front-end/heapProfiler.css b/Source/WebCore/inspector/front-end/heapProfiler.css
index add02a1..ceeafca 100644
--- a/Source/WebCore/inspector/front-end/heapProfiler.css
+++ b/Source/WebCore/inspector/front-end/heapProfiler.css
@@ -207,6 +207,18 @@
     position: static;
 }
 
+.detailed-heapshot-view .console-formatted-string {
+    white-space: nowrap;
+}
+
+.detailed-heapshot-view .data-grid tr.selected * {
+    color: inherit;
+}
+
+.detailed-heapshot-view .data-grid:focus tr.selected * {
+    color: white;
+}
+
 .detailed-heapshot-view .delimiter {
     height: 24px;
     background-color: #d6dde5;
@@ -228,8 +240,15 @@
 }
 
 .detailed-heapshot-view .retaining-paths-view .title > span {
+    display: inline-block;
+    padding-top: 3px;
     vertical-align: middle;
     margin-left: 4px;
+    margin-right: 8px;
+}
+
+.detailed-heapshot-view .retaining-paths-to-windows {
+    
 }
 
 .heapshot-help-status-bar-item .glyph {
diff --git a/Source/WebCore/inspector/front-end/inspector.css b/Source/WebCore/inspector/front-end/inspector.css
index a7bd3b3..0311f22 100644
--- a/Source/WebCore/inspector/front-end/inspector.css
+++ b/Source/WebCore/inspector/front-end/inspector.css
@@ -872,6 +872,7 @@ body.platform-linux .monospace, body.platform-linux .source-code {
 
 .console-formatted-string, .console-formatted-regexp {
     color: rgb(196, 26, 22);
+    white-space: pre-wrap;
 }
 
 .console-formatted-null, .console-formatted-undefined {
@@ -1022,6 +1023,14 @@ body.platform-linux .monospace, body.platform-linux .source-code {
     bottom: 0;
 }
 
+#elements-content.nowrap {
+    white-space: nowrap;
+}
+
+#elements-content > ol {
+    display: inline-block;
+}
+
 #elements-sidebar {
     position: absolute;
     top: 0;
@@ -3926,6 +3935,10 @@ body.inactive li.selected .bubble.search-matches {
     background-color: rgb(66, 129, 235) !important;
 }
 
+.garbage-collect-status-bar-item .glyph {
+    -webkit-mask-image: url(Images/garbageCollectButtonGlyph.png);
+}
+
 .timeline-records-counter, .storage-application-cache-status, .storage-application-cache-connectivity {
     font-size: 11px;
     text-shadow: white 0 1px 0;
@@ -4442,3 +4455,7 @@ a.worker-item:hover {
     font-weight: bold;
     z-index: 10000;
 }
+
+.resource-view.json {
+    padding: 5px;
+}
diff --git a/Source/WebCore/inspector/front-end/inspector.html b/Source/WebCore/inspector/front-end/inspector.html
index d6c810e..9ba1dca 100644
--- a/Source/WebCore/inspector/front-end/inspector.html
+++ b/Source/WebCore/inspector/front-end/inspector.html
@@ -122,6 +122,7 @@ THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
     <script type="text/javascript" src="ResourceHeadersView.js"></script>
     <script type="text/javascript" src="ResourceCookiesView.js"></script>
     <script type="text/javascript" src="ResourceTimingView.js"></script>
+    <script type="text/javascript" src="ResourceJSONView.js"></script>
     <script type="text/javascript" src="NetworkItemView.js"></script>
     <script type="text/javascript" src="ScriptFormatter.js"></script>
     <script type="text/javascript" src="DOMSyntaxHighlighter.js"></script>
@@ -146,6 +147,7 @@ THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
     <script type="text/javascript" src="DetailedHeapshotView.js"></script>
     <script type="text/javascript" src="DebuggerModel.js"></script>
     <script type="text/javascript" src="DebuggerPresentationModel.js"></script>
+    <script type="text/javascript" src="SourceFile.js"></script>
     <script type="text/javascript" src="DOMAgent.js"></script>
     <script type="text/javascript" src="TimelineAgent.js"></script>
     <script type="text/javascript" src="TimelinePanel.js"></script>
diff --git a/Source/WebCore/inspector/front-end/inspector.js b/Source/WebCore/inspector/front-end/inspector.js
index b4c3fda..59171db 100644
--- a/Source/WebCore/inspector/front-end/inspector.js
+++ b/Source/WebCore/inspector/front-end/inspector.js
@@ -141,7 +141,7 @@ var WebInspector = {
     resetFocusElement: function()
     {
         this.currentFocusElement = null;
-        this._previousFocusElement = null;        
+        this._previousFocusElement = null;
     },
 
     get currentPanel()
@@ -182,17 +182,6 @@ var WebInspector = {
         return pane;
     },
 
-    createXHRBreakpointsSidebarPane: function()
-    {
-        var pane = new WebInspector.XHRBreakpointsSidebarPane();
-        function breakpointAdded(event)
-        {
-            pane.addBreakpointItem(new WebInspector.BreakpointItem(event.data));
-        }
-        WebInspector.breakpointManager.addEventListener(WebInspector.BreakpointManager.Events.XHRBreakpointAdded, breakpointAdded);
-        return pane;
-    },
-
     _createPanels: function()
     {
         var hiddenPanels = (InspectorFrontendHost.hiddenPanels() || "").split(',');
@@ -206,16 +195,8 @@ var WebInspector = {
             this.panels.scripts = new WebInspector.ScriptsPanel();
         if (hiddenPanels.indexOf("timeline") === -1)
             this.panels.timeline = new WebInspector.TimelinePanel();
-        if (hiddenPanels.indexOf("profiles") === -1) {
+        if (hiddenPanels.indexOf("profiles") === -1)
             this.panels.profiles = new WebInspector.ProfilesPanel();
-            this.panels.profiles.registerProfileType(new WebInspector.CPUProfileType());
-            if (Preferences.heapProfilerPresent) {
-                if (!Preferences.detailedHeapProfiles)
-                    this.panels.profiles.registerProfileType(new WebInspector.HeapSnapshotProfileType());
-                else
-                    this.panels.profiles.registerProfileType(new WebInspector.DetailedHeapshotProfileType());
-            }
-        }
         if (hiddenPanels.indexOf("audits") === -1)
             this.panels.audits = new WebInspector.AuditsPanel();
         if (hiddenPanels.indexOf("console") === -1)
@@ -247,7 +228,7 @@ var WebInspector = {
             dockToggleButton.title = WebInspector.UIString("Dock to main window.");
         }
 
-        // This may be called before onLoadedDone, hence the bulk of inspector objects may 
+        // This may be called before onLoadedDone, hence the bulk of inspector objects may
         // not be created yet.
         if (WebInspector.searchController)
             WebInspector.searchController.updateSearchLabel();
@@ -347,9 +328,9 @@ var WebInspector = {
 
         this._highlightedDOMNodeId = nodeId;
         if (nodeId)
-            InspectorAgent.highlightDOMNode(nodeId);
+            DOMAgent.highlightDOMNode(nodeId);
         else
-            InspectorAgent.hideDOMNodeHighlight();
+            DOMAgent.hideDOMNodeHighlight();
     },
 
     highlightDOMNodeForTwoSeconds: function(nodeId)
@@ -458,11 +439,12 @@ WebInspector.doLoadedDone = function()
     this.drawer = new WebInspector.Drawer();
     this.console = new WebInspector.ConsoleView(this.drawer);
     this.drawer.visibleView = this.console;
+    this.networkManager = new WebInspector.NetworkManager();
     this.resourceTreeModel = new WebInspector.ResourceTreeModel();
-    this.networkManager = new WebInspector.NetworkManager(this.resourceTreeModel);
     this.domAgent = new WebInspector.DOMAgent();
 
     InspectorBackend.registerDomainDispatcher("Inspector", this);
+    InspectorBackend.registerDomainDispatcher("Page", this);
 
     this.resourceCategories = {
         documents: new WebInspector.ResourceCategory("documents", WebInspector.UIString("Documents"), "rgb(47,102,236)"),
@@ -522,25 +504,16 @@ WebInspector.doLoadedDone = function()
 
     this.extensionServer.initExtensions();
 
-    function onPopulateScriptObjects()
-    {
-        if (!WebInspector.currentPanel)
-            WebInspector.showPanel(WebInspector.settings.lastActivePanel);
-    }
-    InspectorAgent.populateScriptObjects(onPopulateScriptObjects);
-
-    if (Preferences.debuggerAlwaysEnabled || WebInspector.settings.debuggerEnabled)
-        this.debuggerModel.enableDebugger();
-    if (Preferences.profilerAlwaysEnabled || WebInspector.settings.profilerEnabled)
-        InspectorAgent.enableProfiler();
     if (WebInspector.settings.monitoringXHREnabled)
         ConsoleAgent.setMonitoringXHREnabled(true);
+    ConsoleAgent.enable(this.console.setConsoleMessageExpiredCount.bind(this.console));
 
-    ConsoleAgent.setConsoleMessagesEnabled(true);
+    WebInspector.showPanel(WebInspector.settings.lastActivePanel);
 
-    function propertyNamesCallback(names)
+    function propertyNamesCallback(error, names)
     {
-        WebInspector.cssNameCompletions = new WebInspector.CSSCompletions(names);
+        if (!error)
+            WebInspector.cssNameCompletions = new WebInspector.CSSCompletions(names);
     }
     // As a DOMAgent method, this needs to happen after the frontend has loaded and the agent is available.
     CSSAgent.getSupportedCSSProperties(propertyNamesCallback);
@@ -702,7 +675,7 @@ WebInspector.openResource = function(resourceURL, inResourcesPanel)
         WebInspector.panels.resources.showResource(resource);
         WebInspector.showPanel("resources");
     } else
-        InspectorAgent.openInInspectedWindow(resource ? resource.url : resourceURL);
+        PageAgent.openInInspectedWindow(resource ? resource.url : resourceURL);
 }
 
 WebInspector._registerShortcuts = function()
@@ -826,13 +799,13 @@ WebInspector.documentKeyDown = function(event)
 
         case "U+0052": // R key
             if ((event.metaKey && isMac) || (event.ctrlKey && !isMac)) {
-                InspectorAgent.reloadPage(event.shiftKey);
+                PageAgent.reloadPage(event.shiftKey);
                 event.preventDefault();
             }
             break;
         case "F5":
             if (!isMac)
-                InspectorAgent.reloadPage(event.ctrlKey || event.shiftKey);
+                PageAgent.reloadPage(event.ctrlKey || event.shiftKey);
             break;
     }
 }
@@ -1013,6 +986,12 @@ WebInspector.showPanel = function(panel)
     this.currentPanel = this.panels[panel];
 }
 
+WebInspector.startUserInitiatedDebugging = function()
+{
+    this.currentPanel = this.panels.scripts;
+    WebInspector.debuggerModel.enableDebugger();
+}
+
 WebInspector.domContentEventFired = function(time)
 {
     this.panels.audits.mainResourceDOMContentTime = time;
@@ -1070,6 +1049,18 @@ WebInspector.inspectedURLChanged = function(url)
     this.extensionServer.notifyInspectedURLChanged();
 }
 
+WebInspector.didCreateWorker = function()
+{
+    var workersPane = WebInspector.panels.scripts.sidebarPanes.workers;
+    workersPane.addWorker.apply(workersPane, arguments);
+}
+
+WebInspector.didDestroyWorker = function()
+{
+    var workersPane = WebInspector.panels.scripts.sidebarPanes.workers;
+    workersPane.removeWorker.apply(workersPane, arguments);
+}
+
 WebInspector.log = function(message, messageLevel)
 {
     // remember 'this' for setInterval() callback
@@ -1185,13 +1176,16 @@ WebInspector.drawLoadingPieChart = function(canvas, percent) {
     g.fill();
 }
 
-WebInspector.inspect = function(objectId, hints)
+WebInspector.inspect = function(payload, hints)
 {
-    var object = WebInspector.RemoteObject.fromPayload(objectId);
+    var object = WebInspector.RemoteObject.fromPayload(payload);
     if (object.type === "node") {
         // Request node from backend and focus it.
-        object.pushNodeToFrontend(WebInspector.updateFocusedNode.bind(WebInspector));
-    } else if (hints.databaseId) {
+        object.pushNodeToFrontend(WebInspector.updateFocusedNode.bind(WebInspector), object.release.bind(object));
+        return;
+    }
+
+    if (hints.databaseId) {
         WebInspector.currentPanel = WebInspector.panels.resources;
         WebInspector.panels.resources.selectDatabase(hints.databaseId);
     } else if (hints.domStorageId) {
@@ -1199,7 +1193,7 @@ WebInspector.inspect = function(objectId, hints)
         WebInspector.panels.resources.selectDOMStorage(hints.domStorageId);
     }
 
-    RuntimeAgent.releaseObject(objectId);
+    object.release();
 }
 
 WebInspector.updateFocusedNode = function(nodeId)
@@ -1416,6 +1410,8 @@ WebInspector.addMainEventListeners = function(doc)
 WebInspector.frontendReused = function()
 {
     this.networkManager.frontendReused();
+    this.resourceTreeModel.frontendReused();
+    WebInspector.panels.network.clear();
     this.reset();
 }
 
@@ -1541,7 +1537,7 @@ WebInspector.startEditing = function(element, config)
         var isMetaOrCtrl = WebInspector.isMac() ?
             event.metaKey && !event.shiftKey && !event.ctrlKey && !event.altKey :
             event.ctrlKey && !event.shiftKey && !event.metaKey && !event.altKey;
-        if (isEnterKey(event) && (!config.multiline || isMetaOrCtrl))
+        if (isEnterKey(event) && (event.isMetaOrCtrlForTest || !config.multiline || isMetaOrCtrl))
             return "commit";
         else if (event.keyCode === WebInspector.KeyboardShortcut.Keys.Esc.code)
             return "cancel";
diff --git a/Source/WebCore/inspector/front-end/utilities.js b/Source/WebCore/inspector/front-end/utilities.js
index 31a5f0c..fbfdfbb 100644
--- a/Source/WebCore/inspector/front-end/utilities.js
+++ b/Source/WebCore/inspector/front-end/utilities.js
@@ -156,19 +156,7 @@ Node.prototype.rangeBoundaryForOffset = function(offset)
 
 Element.prototype.removeStyleClass = function(className) 
 {
-    // Test for the simple case first.
-    if (this.className === className) {
-        this.className = "";
-        return;
-    }
-
-    var index = this.className.indexOf(className);
-    if (index === -1)
-        return;
-
-    this.className = this.className.split(" ").filter(function(s) {
-        return s && s !== className;
-    }).join(" ");
+    this.classList.remove(className);
 }
 
 Element.prototype.removeMatchingStyleClasses = function(classNameRegex)
@@ -180,23 +168,12 @@ Element.prototype.removeMatchingStyleClasses = function(classNameRegex)
 
 Element.prototype.addStyleClass = function(className) 
 {
-    if (className && !this.hasStyleClass(className))
-        this.className += (this.className.length ? " " + className : className);
+    this.classList.add(className);
 }
 
 Element.prototype.hasStyleClass = function(className) 
 {
-    if (!className)
-        return false;
-    // Test for the simple case
-    if (this.className === className)
-        return true;
-
-    var index = this.className.indexOf(className);
-    if (index === -1)
-        return false;
-    var toTest = " " + this.className + " ";
-    return toTest.indexOf(" " + className + " ", index) !== -1;
+    return this.classList.contains(className);
 }
 
 Element.prototype.positionAt = function(x, y)
@@ -380,7 +357,6 @@ Node.prototype.isAncestor = function(node)
 Node.prototype.isDescendant = isDescendantNode;
 Node.prototype.traverseNextNode = traverseNextNode;
 Node.prototype.traversePreviousNode = traversePreviousNode;
-Node.prototype.onlyTextChild = onlyTextChild;
 
 String.prototype.hasSubstring = function(string, caseInsensitive)
 {
@@ -616,19 +592,6 @@ function traversePreviousNode(stayWithin)
     return this.parentNode;
 }
 
-function onlyTextChild()
-{
-    if (!this)
-        return null;
-
-    var firstChild = this.firstChild;
-    if (!firstChild || firstChild.nodeType !== Node.TEXT_NODE)
-        return null;
-
-    var sibling = firstChild.nextSibling;
-    return sibling ? null : firstChild;
-}
-
 function appropriateSelectorForNode(node, justSelector)
 {
     if (!node)
@@ -822,31 +785,44 @@ Array.convert = function(list)
     return Array.prototype.slice.call(list);
 }
 
-function insertionIndexForObjectInListSortedByFunction(anObject, aList, aFunction)
+function binarySearch(object, array, comparator)
 {
     var first = 0;
-    var last = aList.length - 1;
-    var floor = Math.floor;
-    var mid, c;
+    var last = array.length - 1;
 
     while (first <= last) {
-        mid = floor((first + last) / 2);
-        c = aFunction(anObject, aList[mid]);
-
+        var mid = (first + last) >> 1;
+        var c = comparator(object, array[mid]);
         if (c > 0)
             first = mid + 1;
         else if (c < 0)
             last = mid - 1;
-        else {
-            // Return the first occurance of an item in the list.
-            while (mid > 0 && aFunction(anObject, aList[mid - 1]) === 0)
-                mid--;
-            first = mid;
-            break;
-        }
+        else
+            return mid;
     }
 
-    return first;
+    // Return the nearest lesser index, "-1" means "0, "-2" means "1", etc.
+    return -(first + 1);
+}
+
+Object.defineProperty(Array.prototype, "binaryIndexOf", { value: function(value, comparator)
+{
+    var result = binarySearch(value, this, comparator);
+    return result >= 0 ? result : -1;
+}});
+
+function insertionIndexForObjectInListSortedByFunction(anObject, aList, aFunction)
+{
+    var index = binarySearch(anObject, aList, aFunction);
+    if (index < 0)
+        // See binarySearch implementation.
+        return -index - 1;
+    else {
+        // Return the first occurance of an item in the list.
+        while (index > 0 && aFunction(anObject, aList[index - 1]) === 0)
+            index--;
+        return index;        
+    }
 }
 
 String.sprintf = function(format)
diff --git a/Source/WebCore/inspector/generate-inspector-idl b/Source/WebCore/inspector/generate-inspector-idl
new file mode 100755
index 0000000..f2f0e35
--- /dev/null
+++ b/Source/WebCore/inspector/generate-inspector-idl
@@ -0,0 +1,125 @@
+#!/usr/bin/env python
+# Copyright (c) 2011 Google Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are
+# met:
+# 
+#     * Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+#     * Redistributions in binary form must reproduce the above
+# copyright notice, this list of conditions and the following disclaimer
+# in the documentation and/or other materials provided with the
+# distribution.
+#     * Neither the name of Google Inc. nor the names of its
+# contributors may be used to endorse or promote products derived from
+# this software without specific prior written permission.
+# 
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+import os.path
+import sys
+
+program_name = os.path.basename(__file__)
+if len(sys.argv) < 4 or sys.argv[1] != "-o":
+    sys.stderr.write("Usage: %s -o OUTPUT_FILE INPUT_FILE\n" % program_name)
+    exit(1)
+
+output_path = sys.argv[2]
+input_path = sys.argv[3]
+
+input_file = open(input_path, "r")
+json_string = input_file.read()
+json_string = json_string.replace(": true", ": True")
+json_string = json_string.replace(": false", ": false")
+json_api = eval(json_string)
+
+output_file = open(output_path, "w")
+output_file.write("""/*
+ * Copyright (C) 2011 Google, Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+ 
+module core {""")
+
+type_traits = {
+    "string": "String",
+    "integer": "int",
+    "number": "double",
+    "boolean": "boolean",
+    "array": "Array",
+    "object": "Object"
+}
+
+macro_traits = {
+    "Database": "DATABASE",
+    "DOMStorage": "DOM_STORAGE",
+    "ApplicationCache": "OFFLINE_WEB_APPLICATIONS",
+    "Debugger": "JAVASCRIPT_DEBUGGER",
+    "BrowserDebugger": "JAVASCRIPT_DEBUGGER",
+    "Profiler": "JAVASCRIPT_DEBUGGER"
+}
+
+def param_type(param):
+    if "type" in param:
+        return type_traits[param["type"]];
+    if "$ref" in param:
+        return "Object"
+
+for domain in json_api:
+    domain_name = domain["domain"]
+    if domain_name in macro_traits:
+        output_file.write("\n#if defined(ENABLE_%s) && ENABLE_%s" % (macro_traits[domain_name], macro_traits[domain_name]))
+    output_file.write("\n    interface [Conditional=INSPECTOR] %s {" % domain_name)
+    if "commands" in domain:
+        for command in domain["commands"]:
+            params = [];
+            if ("parameters" in command):
+                for in_param in command["parameters"]:
+                    params.append("in %s %s" % (param_type(in_param), in_param["name"]))
+            if ("returns" in command):
+                for out_param in command["returns"]:
+                    params.append("out %s %s" % (param_type(out_param), out_param["name"]))
+            output_file.write("\n        void %s(%s);" % (command["name"], ", ".join(params)))
+    if "events" in domain:
+        for event in domain["events"]:
+            params = [];
+            if ("parameters" in event):
+                for in_param in event["parameters"]:
+                    params.append("out %s %s" % (param_type(in_param), in_param["name"]))
+            output_file.write("\n        [event] void %s(%s);" % (event["name"], ", ".join(params)))
+    output_file.write("\n    };")
+    if domain["domain"] in macro_traits:
+        output_file.write("\n#endif // ENABLE_%s" % macro_traits[domain["domain"]])
+output_file.write("\n}\n")
+output_file.close()
diff --git a/Source/WebCore/inspector/xxd.pl b/Source/WebCore/inspector/xxd.pl
index 42cf4a2..5ee08a5 100644
--- a/Source/WebCore/inspector/xxd.pl
+++ b/Source/WebCore/inspector/xxd.pl
@@ -1,45 +1,45 @@
-#! /usr/bin/perl

-

-# Copyright (C) 2010 Google Inc. All rights reserved.

-#

-# Redistribution and use in source and binary forms, with or without

-# modification, are permitted provided that the following conditions are

-# met:

-#

-#    # Redistributions of source code must retain the above copyright

-# notice, this list of conditions and the following disclaimer.

-#    # Redistributions in binary form must reproduce the above

-# copyright notice, this list of conditions and the following disclaimer

-# in the documentation and/or other materials provided with the

-# distribution.

-#    # Neither the name of Google Inc. nor the names of its

-# contributors may be used to endorse or promote products derived from

-# this software without specific prior written permission.

-#

-# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS

-# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT

-# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR

-# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT

-# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,

-# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT

-# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,

-# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY

-# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT

-# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE

-# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

-#

-

-$varname = shift;

-$fname = shift;

-$output = shift;

-

-open($input, '<', $fname) or die "Can't open file for read: $fname $!";

-$/ = undef;

-$text = <$input>;

-close($input);

-

-$text = join(', ', map('0x' . unpack("H*", $_), split(undef, $text)));

-

-open($output, '>', $output) or die "Can't open file for write: $output $!";

-print $output "unsigned char $varname\[\] = {\n$text\n};\n";

-close($output);

+#! /usr/bin/perl
+
+# Copyright (C) 2010-2011 Google Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are
+# met:
+#
+#    # Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+#    # Redistributions in binary form must reproduce the above
+# copyright notice, this list of conditions and the following disclaimer
+# in the documentation and/or other materials provided with the
+# distribution.
+#    # Neither the name of Google Inc. nor the names of its
+# contributors may be used to endorse or promote products derived from
+# this software without specific prior written permission.
+#
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+#
+
+$varname = shift;
+$fname = shift;
+$output = shift;
+
+open($input, '<', $fname) or die "Can't open file for read: $fname $!";
+$/ = undef;
+$text = <$input>;
+close($input);
+
+$text = join(', ', map('0x' . unpack("H*", $_), split(undef, $text)));
+
+open($output, '>', $output) or die "Can't open file for write: $output $!";
+print $output "const unsigned char $varname\[\] = {\n$text\n};\n";
+close($output);
diff --git a/Source/WebCore/loader/DocumentLoader.cpp b/Source/WebCore/loader/DocumentLoader.cpp
index e223765..121045b 100644
--- a/Source/WebCore/loader/DocumentLoader.cpp
+++ b/Source/WebCore/loader/DocumentLoader.cpp
@@ -112,6 +112,10 @@ FrameLoader* DocumentLoader::frameLoader() const
 DocumentLoader::~DocumentLoader()
 {
     ASSERT(!m_frame || frameLoader()->activeDocumentLoader() != this || !frameLoader()->isLoading());
+    if (m_iconLoadDecisionCallback)
+        m_iconLoadDecisionCallback->invalidate();
+    if (m_iconDataCallback)
+        m_iconDataCallback->invalidate();
 }
 
 PassRefPtr<SharedBuffer> DocumentLoader::mainResourceData() const
@@ -836,7 +840,41 @@ void DocumentLoader::transferLoadingResourcesFromPage(Page* oldPage)
 void DocumentLoader::iconLoadDecisionAvailable()
 {
     if (m_frame)
-        m_frame->loader()->iconLoadDecisionAvailable();
+        m_frame->loader()->iconLoadDecisionReceived(iconDatabase().synchronousLoadDecisionForIconURL(KURL(frameLoader()->iconURL()), this));
 }
 
+static void iconLoadDecisionCallback(IconLoadDecision decision, void* context)
+{
+    static_cast<DocumentLoader*>(context)->continueIconLoadWithDecision(decision);
+}
+
+void DocumentLoader::getIconLoadDecisionForIconURL(const String& urlString)
+{
+    if (m_iconLoadDecisionCallback)
+        m_iconLoadDecisionCallback->invalidate();
+    m_iconLoadDecisionCallback = IconLoadDecisionCallback::create(this, iconLoadDecisionCallback);
+    iconDatabase().loadDecisionForIconURL(urlString, m_iconLoadDecisionCallback);
+}
+
+void DocumentLoader::continueIconLoadWithDecision(IconLoadDecision decision)
+{
+    ASSERT(m_iconLoadDecisionCallback);
+    m_iconLoadDecisionCallback = 0;
+    if (m_frame)
+        m_frame->loader()->continueIconLoadWithDecision(decision);
+}
+
+static void iconDataCallback(SharedBuffer*, void*)
+{
+    // FIXME: Implement this once we know what parts of WebCore actually need the icon data returned.
 }
+
+void DocumentLoader::getIconDataForIconURL(const String& urlString)
+{   
+    if (m_iconDataCallback)
+        m_iconDataCallback->invalidate();
+    m_iconDataCallback = IconDataCallback::create(this, iconDataCallback);
+    iconDatabase().iconDataForIconURL(urlString, m_iconDataCallback);
+}
+
+} // namespace WebCore
diff --git a/Source/WebCore/loader/DocumentLoader.h b/Source/WebCore/loader/DocumentLoader.h
index 8e9ab8f..1f88272 100644
--- a/Source/WebCore/loader/DocumentLoader.h
+++ b/Source/WebCore/loader/DocumentLoader.h
@@ -31,6 +31,7 @@
 
 #include "DocumentLoadTiming.h"
 #include "DocumentWriter.h"
+#include "IconDatabaseBase.h"
 #include "NavigationAction.h"
 #include "ResourceError.h"
 #include "ResourceRequest.h"
@@ -182,7 +183,7 @@ namespace WebCore {
         String clientRedirectDestinationForHistory() const { return urlForHistory(); }
         void setClientRedirectSourceForHistory(const String& clientedirectSourceForHistory) { m_clientRedirectSourceForHistory = clientedirectSourceForHistory; }
         
-        String serverRedirectSourceForHistory() const { return urlForHistory() == url() ? String() : urlForHistory(); } // null if no server redirect occurred.
+        String serverRedirectSourceForHistory() const { return urlForHistory() == url() ? String() : urlForHistory().string(); } // null if no server redirect occurred.
         String serverRedirectDestinationForHistory() const { return url(); }
 
         bool didCreateGlobalHistoryEntry() const { return m_didCreateGlobalHistoryEntry; }
@@ -193,8 +194,14 @@ namespace WebCore {
         bool startLoadingMainResource(unsigned long identifier);
         void cancelMainResourceLoad(const ResourceError&);
         
+        // Support iconDatabase in synchronous mode.
         void iconLoadDecisionAvailable();
         
+        // Support iconDatabase in asynchronous mode.
+        void continueIconLoadWithDecision(IconLoadDecision);
+        void getIconLoadDecisionForIconURL(const String&);
+        void getIconDataForIconURL(const String&);
+        
         bool isLoadingMainResource() const;
         bool isLoadingSubresources() const;
         bool isLoadingPlugIns() const;
@@ -326,6 +333,9 @@ namespace WebCore {
         bool m_didCreateGlobalHistoryEntry;
 
         DocumentLoadTiming m_documentLoadTiming;
+    
+        RefPtr<IconLoadDecisionCallback> m_iconLoadDecisionCallback;
+        RefPtr<IconDataCallback> m_iconDataCallback;
 
 #if ENABLE(OFFLINE_WEB_APPLICATIONS)
         friend class ApplicationCacheHost;  // for substitute resource delivery
diff --git a/Source/WebCore/loader/DocumentThreadableLoader.cpp b/Source/WebCore/loader/DocumentThreadableLoader.cpp
index 732a84e..73c3e80 100644
--- a/Source/WebCore/loader/DocumentThreadableLoader.cpp
+++ b/Source/WebCore/loader/DocumentThreadableLoader.cpp
@@ -51,27 +51,30 @@ namespace WebCore {
 void DocumentThreadableLoader::loadResourceSynchronously(Document* document, const ResourceRequest& request, ThreadableLoaderClient& client, const ThreadableLoaderOptions& options)
 {
     // The loader will be deleted as soon as this function exits.
-    RefPtr<DocumentThreadableLoader> loader = adoptRef(new DocumentThreadableLoader(document, &client, LoadSynchronously, request, options));
+    RefPtr<DocumentThreadableLoader> loader = adoptRef(new DocumentThreadableLoader(document, &client, LoadSynchronously, request, options, String()));
     ASSERT(loader->hasOneRef());
 }
 
-PassRefPtr<DocumentThreadableLoader> DocumentThreadableLoader::create(Document* document, ThreadableLoaderClient* client, const ResourceRequest& request, const ThreadableLoaderOptions& options)
+PassRefPtr<DocumentThreadableLoader> DocumentThreadableLoader::create(Document* document, ThreadableLoaderClient* client, const ResourceRequest& request, const ThreadableLoaderOptions& options, const String& optionalOutgoingReferrer)
 {
-    RefPtr<DocumentThreadableLoader> loader = adoptRef(new DocumentThreadableLoader(document, client, LoadAsynchronously, request, options));
+    RefPtr<DocumentThreadableLoader> loader = adoptRef(new DocumentThreadableLoader(document, client, LoadAsynchronously, request, options, optionalOutgoingReferrer));
     if (!loader->m_loader)
         loader = 0;
     return loader.release();
 }
 
-DocumentThreadableLoader::DocumentThreadableLoader(Document* document, ThreadableLoaderClient* client, BlockingBehavior blockingBehavior, const ResourceRequest& request, const ThreadableLoaderOptions& options)
+DocumentThreadableLoader::DocumentThreadableLoader(Document* document, ThreadableLoaderClient* client, BlockingBehavior blockingBehavior, const ResourceRequest& request, const ThreadableLoaderOptions& options, const String& optionalOutgoingReferrer)
     : m_client(client)
     , m_document(document)
     , m_options(options)
+    , m_optionalOutgoingReferrer(optionalOutgoingReferrer)
     , m_sameOriginRequest(document->securityOrigin()->canRequest(request.url()))
     , m_async(blockingBehavior == LoadAsynchronously)
 {
     ASSERT(document);
     ASSERT(client);
+    // Setting an outgoing referer is only supported in the async code path.
+    ASSERT(m_async || m_optionalOutgoingReferrer.isEmpty());
 
     if (m_sameOriginRequest || m_options.crossOriginRequestPolicy == AllowCrossOriginRequests) {
         loadRequest(request, DoSecurityCheck);
@@ -346,7 +349,8 @@ void DocumentThreadableLoader::loadRequest(const ResourceRequest& request, Secur
 
         // Clear the loader so that any callbacks from SubresourceLoader::create will not have the old loader.
         m_loader = 0;
-        m_loader = resourceLoadScheduler()->scheduleSubresourceLoad(m_document->frame(), this, request, ResourceLoadPriorityMedium, securityCheck, sendLoadCallbacks, sniffContent);
+        m_loader = resourceLoadScheduler()->scheduleSubresourceLoad(m_document->frame(), this, request, ResourceLoadPriorityMedium, securityCheck, sendLoadCallbacks,
+                                                                    sniffContent, m_optionalOutgoingReferrer);
         return;
     }
     
diff --git a/Source/WebCore/loader/DocumentThreadableLoader.h b/Source/WebCore/loader/DocumentThreadableLoader.h
index 94884ce..c511306 100644
--- a/Source/WebCore/loader/DocumentThreadableLoader.h
+++ b/Source/WebCore/loader/DocumentThreadableLoader.h
@@ -39,6 +39,7 @@
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefCounted.h>
 #include <wtf/RefPtr.h>
+#include <wtf/text/WTFString.h>
 
 namespace WebCore {
     class Document;
@@ -50,7 +51,7 @@ namespace WebCore {
         WTF_MAKE_FAST_ALLOCATED;
     public:
         static void loadResourceSynchronously(Document*, const ResourceRequest&, ThreadableLoaderClient&, const ThreadableLoaderOptions&);
-        static PassRefPtr<DocumentThreadableLoader> create(Document*, ThreadableLoaderClient*, const ResourceRequest&, const ThreadableLoaderOptions&);
+        static PassRefPtr<DocumentThreadableLoader> create(Document*, ThreadableLoaderClient*, const ResourceRequest&, const ThreadableLoaderOptions&, const String& optionalOutgoingReferrer = String());
         virtual ~DocumentThreadableLoader();
 
         virtual void cancel();
@@ -69,7 +70,7 @@ namespace WebCore {
             LoadAsynchronously
         };
 
-        DocumentThreadableLoader(Document*, ThreadableLoaderClient*, BlockingBehavior blockingBehavior, const ResourceRequest&, const ThreadableLoaderOptions& options);
+        DocumentThreadableLoader(Document*, ThreadableLoaderClient*, BlockingBehavior, const ResourceRequest&, const ThreadableLoaderOptions&, const String& optionalOutgoingReferrer);
 
         virtual void willSendRequest(SubresourceLoader*, ResourceRequest&, const ResourceResponse& redirectResponse);
         virtual void didSendData(SubresourceLoader*, unsigned long long bytesSent, unsigned long long totalBytesToBeSent);
@@ -97,6 +98,7 @@ namespace WebCore {
         ThreadableLoaderClient* m_client;
         Document* m_document;
         ThreadableLoaderOptions m_options;
+        String m_optionalOutgoingReferrer;
         bool m_sameOriginRequest;
         bool m_async;
         OwnPtr<ResourceRequest> m_actualRequest;  // non-null during Access Control preflight checks
diff --git a/Source/WebCore/loader/DocumentThreadableLoaderClient.h b/Source/WebCore/loader/DocumentThreadableLoaderClient.h
index 4551b84..146a166 100644
--- a/Source/WebCore/loader/DocumentThreadableLoaderClient.h
+++ b/Source/WebCore/loader/DocumentThreadableLoaderClient.h
@@ -45,6 +45,9 @@ public:
     virtual bool isDocumentThreadableLoaderClient() { return true; }
 
     virtual void willSendRequest(ResourceRequest& /*newRequest*/, const ResourceResponse& /*redirectResponse*/) { }
+
+protected:
+    DocumentThreadableLoaderClient() { }
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/loader/EmptyClients.h b/Source/WebCore/loader/EmptyClients.h
index 41a5df7..cabb4ae 100644
--- a/Source/WebCore/loader/EmptyClients.h
+++ b/Source/WebCore/loader/EmptyClients.h
@@ -1,6 +1,6 @@
 /*
  * Copyright (C) 2006 Eric Seidel (eric@webkit.org)
- * Copyright (C) 2008, 2009, 2010 Apple Inc. All rights reserved.
+ * Copyright (C) 2008, 2009, 2010, 2011 Apple Inc. All rights reserved.
  * Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies).
  *
  * Redistribution and use in source and binary forms, with or without
@@ -165,7 +165,7 @@ public:
     virtual void invalidateContentsForSlowScroll(const IntRect&, bool) {};
     virtual void scroll(const IntSize&, const IntRect&, const IntRect&) { }
 #if ENABLE(TILED_BACKING_STORE)
-    virtual void delegatedScrollRequested(const IntSize&) { }
+    virtual void delegatedScrollRequested(const IntPoint&) { }
 #endif
 #if ENABLE(REQUEST_ANIMATION_FRAME)
     virtual void scheduleAnimation() { }
@@ -374,7 +374,7 @@ public:
     virtual void showMediaPlayerProxyPlugin(Widget*) { }
 #endif
 
-    virtual ObjectContentType objectContentType(const KURL&, const String&) { return ObjectContentType(); }
+    virtual ObjectContentType objectContentType(const KURL&, const String&, bool) { return ObjectContentType(); }
     virtual String overrideMediaType() const { return String(); }
 
     virtual void redirectDataToPlugin(Widget*) { }
@@ -414,7 +414,7 @@ public:
     virtual String getAutoCorrectSuggestionForMisspelledWord(const String&) { return String(); }
     virtual void checkGrammarOfString(const UChar*, int, Vector<GrammarDetail>&, int*, int*) { }
 
-#if PLATFORM(MAC) && !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
+#if USE(UNIFIED_TEXT_CHECKING)
     virtual void checkTextOfParagraph(const UChar*, int, uint64_t, Vector<TextCheckingResult>&) { };
 #endif
 
@@ -519,9 +519,9 @@ public:
     TextCheckerClient* textChecker() { return &m_textCheckerClient; }
 
 #if SUPPORT_AUTOCORRECTION_PANEL
-    virtual void showCorrectionPanel(CorrectionPanelInfo::PanelType, const FloatRect&, const String&, const String&, const Vector<String>&, Editor*) { }
+    virtual void showCorrectionPanel(CorrectionPanelInfo::PanelType, const FloatRect&, const String&, const String&, const Vector<String>&) { }
     virtual void dismissCorrectionPanel(ReasonForDismissingCorrectionPanel) { }
-    virtual bool isShowingCorrectionPanel() { return false; }
+    virtual String dismissCorrectionPanelSoon(ReasonForDismissingCorrectionPanel) { return String(); }
     virtual void recordAutocorrectionResponse(AutocorrectionResponseType, const String&, const String&) { }
 #endif
     virtual void updateSpellingUIWithGrammarString(const String&, const GrammarDetail&) { }
diff --git a/Source/WebCore/loader/FrameLoader.cpp b/Source/WebCore/loader/FrameLoader.cpp
index 61f421f..6819e71 100644
--- a/Source/WebCore/loader/FrameLoader.cpp
+++ b/Source/WebCore/loader/FrameLoader.cpp
@@ -1,9 +1,10 @@
 /*
- * Copyright (C) 2006, 2007, 2008, 2009, 2010 Apple Inc. All rights reserved.
+ * Copyright (C) 2006, 2007, 2008, 2009, 2010, 2011 Apple Inc. All rights reserved.
  * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
  * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  * Copyright (C) 2008 Alp Toker <alp@atoker.com>
  * Copyright (C) Research In Motion Limited 2009. All rights reserved.
+ * Copyright (C) 2011 Kris Jordan <krisjordan@gmail.com>
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -40,6 +41,7 @@
 #include "CachedPage.h"
 #include "CachedResourceLoader.h"
 #include "Chrome.h"
+#include "ContentSecurityPolicy.h"
 #include "DOMImplementation.h"
 #include "DOMWindow.h"
 #include "Document.h"
@@ -83,6 +85,7 @@
 #include "ResourceHandle.h"
 #include "ResourceRequest.h"
 #include "SchemeRegistry.h"
+#include "ScrollAnimator.h"
 #include "ScriptController.h"
 #include "ScriptSourceCode.h"
 #include "SecurityOrigin.h"
@@ -130,9 +133,9 @@ using namespace SVGNames;
 #endif
 
 #if ENABLE(XHTMLMP)
-static const char defaultAcceptHeader[] = "application/xml,application/vnd.wap.xhtml+xml,application/xhtml+xml;profile='http://www.wapforum.org/xhtml',text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5";
+static const char defaultAcceptHeader[] = "application/vnd.wap.xhtml+xml,application/xhtml+xml;profile='http://www.wapforum.org/xhtml',text/html,application/xml;q=0.9,*/*;q=0.8";
 #else
-static const char defaultAcceptHeader[] = "application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5";
+static const char defaultAcceptHeader[] = "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8";
 #endif
 
 static double storedTimeOfLastCompletedLoad;
@@ -258,13 +261,6 @@ void FrameLoader::setDefersLoading(bool defers)
         m_frame->navigationScheduler()->startTimer();
         startCheckCompleteTimer();
     }
-
-    // This code is not logically part of load deferring, but we do not want JS code executed beneath modal
-    // windows or sheets, which is exactly when PageGroupLoadDeferrer is used.
-    if (defers)
-        m_frame->document()->suspendScheduledTasks();
-    else
-        m_frame->document()->resumeScheduledTasks();
 }
 
 bool FrameLoader::canHandleRequest(const ResourceRequest& request)
@@ -691,12 +687,13 @@ void FrameLoader::didEndDocument()
     m_isLoadingMainResource = false;
 }
 
-void FrameLoader::iconLoadDecisionAvailable()
+// Callback for the old-style synchronous IconDatabase interface.
+void FrameLoader::iconLoadDecisionReceived(IconLoadDecision iconLoadDecision)
 {
     if (!m_mayLoadIconLater)
         return;
     LOG(IconDatabase, "FrameLoader %p was told a load decision is available for its icon", this);
-    startIconLoader();
+    continueIconLoadWithDecision(iconLoadDecision);
     m_mayLoadIconLater = false;
 }
 
@@ -715,48 +712,77 @@ void FrameLoader::startIconLoader()
     if (urlString.isEmpty())
         return;
 
-    // If we're not reloading and the icon database doesn't say to load now then bail before we actually start the load
-    if (loadType() != FrameLoadTypeReload && loadType() != FrameLoadTypeReloadFromOrigin) {
-        IconLoadDecision decision = iconDatabase().loadDecisionForIconURL(urlString, m_documentLoader.get());
-        if (decision == IconLoadNo) {
-            LOG(IconDatabase, "FrameLoader::startIconLoader() - Told not to load this icon, committing iconURL %s to database for pageURL mapping", urlString.ascii().data());
-            commitIconURLToIconDatabase(url);
-            
-            // We were told not to load this icon - that means this icon is already known by the database
-            // If the icon data hasn't been read in from disk yet, kick off the read of the icon from the database to make sure someone
-            // has done it.  This is after registering for the notification so the WebView can call the appropriate delegate method.
-            // Otherwise if the icon data *is* available, notify the delegate
-            if (!iconDatabase().iconDataKnownForIconURL(urlString)) {
-                LOG(IconDatabase, "Told not to load icon %s but icon data is not yet available - registering for notification and requesting load from disk", urlString.ascii().data());
-                m_client->registerForIconNotification();
-                iconDatabase().iconForPageURL(m_frame->document()->url().string(), IntSize(0, 0));
-                iconDatabase().iconForPageURL(originalRequestURL().string(), IntSize(0, 0));
-            } else
-                m_client->dispatchDidReceiveIcon();
-                
-            return;
-        } 
-        
-        if (decision == IconLoadUnknown) {
-            // In this case, we may end up loading the icon later, but we still want to commit the icon url mapping to the database
-            // just in case we don't end up loading later - if we commit the mapping a second time after the load, that's no big deal
-            // We also tell the client to register for the notification that the icon is received now so it isn't missed in case the 
-            // icon is later read in from disk
-            LOG(IconDatabase, "FrameLoader %p might load icon %s later", this, urlString.ascii().data());
-            m_mayLoadIconLater = true;    
-            m_client->registerForIconNotification();
-            commitIconURLToIconDatabase(url);
-            return;
-        }
-    }
-
     // People who want to avoid loading images generally want to avoid loading all images.
     // Now that we've accounted for URL mapping, avoid starting the network load if images aren't set to display automatically.
     Settings* settings = m_frame->settings();
     if (settings && !settings->loadsImagesAutomatically())
         return;
 
-    // This is either a reload or the icon database said "yes, load the icon", so kick off the load!
+    // If we're reloading the page, always start the icon load now.
+    if (loadType() == FrameLoadTypeReload && loadType() == FrameLoadTypeReloadFromOrigin) {
+        continueIconLoadWithDecision(IconLoadYes);
+        return;
+    }
+
+    if (iconDatabase().supportsAsynchronousMode()) {
+        m_documentLoader->getIconLoadDecisionForIconURL(urlString);
+        // Commit the icon url mapping to the database just in case we don't end up loading later.
+        commitIconURLToIconDatabase(url);
+        return;
+    }
+    
+    IconLoadDecision decision = iconDatabase().synchronousLoadDecisionForIconURL(urlString, m_documentLoader.get());
+
+    if (decision == IconLoadUnknown) {
+        // In this case, we may end up loading the icon later, but we still want to commit the icon url mapping to the database
+        // just in case we don't end up loading later - if we commit the mapping a second time after the load, that's no big deal
+        // We also tell the client to register for the notification that the icon is received now so it isn't missed in case the 
+        // icon is later read in from disk
+        LOG(IconDatabase, "FrameLoader %p might load icon %s later", this, urlString.ascii().data());
+        m_mayLoadIconLater = true;    
+        m_client->registerForIconNotification();
+        commitIconURLToIconDatabase(url);
+        return;
+    }
+
+    continueIconLoadWithDecision(decision);
+}
+
+void FrameLoader::continueIconLoadWithDecision(IconLoadDecision iconLoadDecision)
+{
+    ASSERT(iconLoadDecision != IconLoadUnknown);
+    
+    //  FIXME (<rdar://problem/9168605>) - We should support in-memory-only private browsing icons in asynchronous icon database mode.
+    if (iconDatabase().supportsAsynchronousMode() && m_frame->page()->settings()->privateBrowsingEnabled())
+        return;
+        
+    if (iconLoadDecision == IconLoadNo) {
+        KURL url(iconURL());
+        String urlString(url.string());
+        
+        LOG(IconDatabase, "FrameLoader::startIconLoader() - Told not to load this icon, committing iconURL %s to database for pageURL mapping", urlString.ascii().data());
+        commitIconURLToIconDatabase(url);
+        
+        if (iconDatabase().supportsAsynchronousMode()) {
+            m_documentLoader->getIconDataForIconURL(urlString);
+            return;
+        }
+        
+        // We were told not to load this icon - that means this icon is already known by the database
+        // If the icon data hasn't been read in from disk yet, kick off the read of the icon from the database to make sure someone
+        // has done it. This is after registering for the notification so the WebView can call the appropriate delegate method.
+        // Otherwise if the icon data *is* available, notify the delegate
+        if (!iconDatabase().synchronousIconDataKnownForIconURL(urlString)) {
+            LOG(IconDatabase, "Told not to load icon %s but icon data is not yet available - registering for notification and requesting load from disk", urlString.ascii().data());
+            m_client->registerForIconNotification();
+            iconDatabase().synchronousIconForPageURL(m_frame->document()->url().string(), IntSize(0, 0));
+            iconDatabase().synchronousIconForPageURL(originalRequestURL().string(), IntSize(0, 0));
+        } else
+            m_client->dispatchDidReceiveIcon();
+            
+        return;
+    } 
+    
     if (!m_iconLoader)
         m_iconLoader = IconLoader::create(m_frame);
         
@@ -966,7 +992,7 @@ void FrameLoader::loadArchive(PassRefPtr<Archive> prpArchive)
 }
 #endif // ENABLE(WEB_ARCHIVE)
 
-ObjectContentType FrameLoader::defaultObjectContentType(const KURL& url, const String& mimeTypeIn)
+ObjectContentType FrameLoader::defaultObjectContentType(const KURL& url, const String& mimeTypeIn, bool shouldPreferPlugInsForImages)
 {
     String mimeType = mimeTypeIn;
     String extension = url.path().substring(url.path().reverseFind('.') + 1);
@@ -983,13 +1009,17 @@ ObjectContentType FrameLoader::defaultObjectContentType(const KURL& url, const S
     if (mimeType.isEmpty())
         return ObjectContentFrame; // Go ahead and hope that we can display the content.
 
+#if !PLATFORM(MAC) && !PLATFORM(CHROMIUM) && !PLATFORM(EFL) // Mac has no PluginDatabase, nor does Chromium or EFL
+    bool plugInSupportsMIMEType = PluginDatabase::installedPlugins()->isMIMETypeRegistered(mimeType);
+#else
+    bool plugInSupportsMIMEType = false;
+#endif
+
     if (MIMETypeRegistry::isSupportedImageMIMEType(mimeType))
-        return WebCore::ObjectContentImage;
+        return shouldPreferPlugInsForImages && plugInSupportsMIMEType ? WebCore::ObjectContentNetscapePlugin : WebCore::ObjectContentImage;
 
-#if !PLATFORM(MAC) && !PLATFORM(CHROMIUM) && !PLATFORM(EFL) // Mac has no PluginDatabase, nor does Chromium or EFL
-    if (PluginDatabase::installedPlugins()->isMIMETypeRegistered(mimeType))
+    if (plugInSupportsMIMEType)
         return WebCore::ObjectContentNetscapePlugin;
-#endif
 
     if (MIMETypeRegistry::isSupportedNonImageMIMEType(mimeType))
         return WebCore::ObjectContentFrame;
@@ -1392,7 +1422,7 @@ void FrameLoader::load(const ResourceRequest& request, const SubstituteData& sub
     m_loadType = FrameLoadTypeStandard;
     RefPtr<DocumentLoader> loader = m_client->createDocumentLoader(request, substituteData);
     if (lockHistory && m_documentLoader)
-        loader->setClientRedirectSourceForHistory(m_documentLoader->didCreateGlobalHistoryEntry() ? m_documentLoader->urlForHistory() : m_documentLoader->clientRedirectSourceForHistory());
+        loader->setClientRedirectSourceForHistory(m_documentLoader->didCreateGlobalHistoryEntry() ? m_documentLoader->urlForHistory().string() : m_documentLoader->clientRedirectSourceForHistory());
     load(loader.get());
 }
 
@@ -1416,7 +1446,7 @@ void FrameLoader::loadWithNavigationAction(const ResourceRequest& request, const
 {
     RefPtr<DocumentLoader> loader = m_client->createDocumentLoader(request, SubstituteData());
     if (lockHistory && m_documentLoader)
-        loader->setClientRedirectSourceForHistory(m_documentLoader->didCreateGlobalHistoryEntry() ? m_documentLoader->urlForHistory() : m_documentLoader->clientRedirectSourceForHistory());
+        loader->setClientRedirectSourceForHistory(m_documentLoader->didCreateGlobalHistoryEntry() ? m_documentLoader->urlForHistory().string() : m_documentLoader->clientRedirectSourceForHistory());
 
     loader->setTriggeringAction(action);
     if (m_documentLoader)
@@ -1530,7 +1560,7 @@ bool FrameLoader::willLoadMediaElementURL(KURL& url)
     unsigned long identifier;
     ResourceError error;
     requestFromDelegate(request, identifier, error);
-    notifier()->sendRemainingDelegateMessages(m_documentLoader.get(), identifier, ResourceResponse(url, String(), -1, String(), String()), -1, error);
+    notifier()->sendRemainingDelegateMessages(m_documentLoader.get(), identifier, ResourceResponse(url, String(), -1, String(), String()), -1, -1, error);
 
     url = request.url();
 
@@ -1947,7 +1977,7 @@ void FrameLoader::commitProvisionalLoad()
             // FIXME: If we get a resource with more than 2B bytes, this code won't do the right thing.
             // However, with today's computers and networking speeds, this won't happen in practice.
             // Could be an issue with a giant local file.
-            notifier()->sendRemainingDelegateMessages(m_documentLoader.get(), identifier, response, static_cast<int>(response.expectedContentLength()), error);
+            notifier()->sendRemainingDelegateMessages(m_documentLoader.get(), identifier, response, static_cast<int>(response.expectedContentLength()), 0, error);
         }
         
         pageCache()->remove(history()->currentItem());
@@ -1967,6 +1997,9 @@ void FrameLoader::transitionToCommitted(PassRefPtr<CachedPage> cachedPage)
     if (m_state != FrameStateProvisional)
         return;
 
+    if (m_frame->view())
+        m_frame->view()->scrollAnimator()->cancelAnimations();
+
     m_client->setCopiesOnScroll();
     history()->updateForCommit();
 
@@ -2178,8 +2211,11 @@ void FrameLoader::open(CachedFrameBase& cachedFrame)
     view->setWasScrolledByUser(false);
 
     // Use the current ScrollView's frame rect.
-    if (m_frame->view())
-        view->setFrameRect(m_frame->view()->frameRect());
+    if (m_frame->view()) {
+        IntRect rect = m_frame->view()->frameRect();
+        view->setFrameRect(rect);
+        view->setBoundsSize(rect.size());
+    }
     m_frame->setView(view);
     
     m_frame->setDocument(document);
@@ -2338,12 +2374,9 @@ CachePolicy FrameLoader::subresourceCachePolicy() const
             return parentCachePolicy;
     }
 
-    // FIXME: POST documents are always Reloads, but their subresources should still be Revalidate.
-    // If we bring the CachePolicy.h and ResourceRequest cache policy enums in sync with each other and
-    // remember "Revalidate" in ResourceRequests, we can remove this "POST" check and return either "Reload" 
-    // or "Revalidate" if the DocumentLoader was requested with either.
     const ResourceRequest& request(documentLoader()->request());
-    if (request.cachePolicy() == ReloadIgnoringCacheData && !equalIgnoringCase(request.httpMethod(), "post"))
+    Settings* settings = m_frame->settings();
+    if (settings && settings->useQuickLookResourceCachingQuirks() && request.cachePolicy() == ReloadIgnoringCacheData && !equalIgnoringCase(request.httpMethod(), "post"))
         return CachePolicyRevalidate;
 
     if (m_loadType == FrameLoadTypeReload)
@@ -2382,16 +2415,15 @@ void FrameLoader::checkLoadCompleteForThisFrame()
                 
             // Only reset if we aren't already going to a new provisional item.
             bool shouldReset = !history()->provisionalItem();
-            if (!(pdl->isLoadingInAPISense() && !pdl->isStopping())) {
+            if (!pdl->isLoadingInAPISense() || pdl->isStopping()) {
                 m_delegateIsHandlingProvisionalLoadError = true;
                 m_client->dispatchDidFailProvisionalLoad(error);
                 m_delegateIsHandlingProvisionalLoadError = false;
 
-                // FIXME: can stopping loading here possibly have any effect, if isLoading is false,
-                // which it must be to be in this branch of the if? And is it OK to just do a full-on
-                // stopAllLoaders instead of stopLoadingSubframes?
-                stopLoadingSubframes(ShouldNotClearProvisionalItem);
-                pdl->stopLoading();
+                ASSERT(!pdl->isLoading());
+                ASSERT(!pdl->isLoadingMainResource());
+                ASSERT(!pdl->isLoadingSubresources());
+                ASSERT(!pdl->isLoadingPlugIns());
 
                 // If we're in the middle of loading multipart data, we need to restore the document loader.
                 if (isReplacing() && !m_documentLoader.get())
@@ -2741,12 +2773,6 @@ void FrameLoader::loadPostRequest(const ResourceRequest& inRequest, const String
 {
     RefPtr<FormState> formState = prpFormState;
 
-    // When posting, use the NSURLRequestReloadIgnoringCacheData load flag.
-    // This prevents a potential bug which may cause a page with a form that uses itself
-    // as an action to be returned from the cache without submitting.
-
-    // FIXME: Where's the code that implements what the comment above says?
-
     // Previously when this method was reached, the original FrameLoadRequest had been deconstructed to build a 
     // bunch of parameters that would come in here and then be built back up to a ResourceRequest.  In case
     // any caller depends on the immutability of the original ResourceRequest, I'm rebuilding a ResourceRequest
@@ -2813,8 +2839,7 @@ unsigned long FrameLoader::loadResourceSynchronously(const ResourceRequest& requ
         }
 #endif
     }
-
-    notifier()->sendRemainingDelegateMessages(m_documentLoader.get(), identifier, response, data.size(), error);
+    notifier()->sendRemainingDelegateMessages(m_documentLoader.get(), identifier, response, data.size(), static_cast<int>(response.expectedContentLength()), error);
     return identifier;
 }
 
@@ -3007,7 +3032,7 @@ void FrameLoader::continueLoadAfterNavigationPolicy(const ResourceRequest&, Pass
     if (!m_frame->page())
         return;
 
-#if ENABLE(JAVASCRIPT_DEBUGGER) && USE(JSC)
+#if ENABLE(JAVASCRIPT_DEBUGGER) && USE(JSC) && ENABLE(INSPECTOR)
     if (Page* page = m_frame->page()) {
         if (page->mainFrame() == m_frame)
             m_frame->page()->inspectorController()->resume();
@@ -3107,7 +3132,7 @@ void FrameLoader::loadedResourceFromMemoryCache(const CachedResource* resource)
     ResourceError error;
     requestFromDelegate(request, identifier, error);
     InspectorInstrumentation::markResourceAsCached(page, identifier);
-    notifier()->sendRemainingDelegateMessages(m_documentLoader.get(), identifier, resource->response(), resource->encodedSize(), error);
+    notifier()->sendRemainingDelegateMessages(m_documentLoader.get(), identifier, resource->response(), resource->encodedSize(), 0, error);
 }
 
 void FrameLoader::applyUserAgent(ResourceRequest& request)
diff --git a/Source/WebCore/loader/FrameLoader.h b/Source/WebCore/loader/FrameLoader.h
index d59eb16..1fb9e3c 100644
--- a/Source/WebCore/loader/FrameLoader.h
+++ b/Source/WebCore/loader/FrameLoader.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2006, 2007, 2008, 2009, 2011 Apple Inc. All rights reserved.
  * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  * Copyright (C) Research In Motion Limited 2009. All rights reserved.
  *
@@ -35,6 +35,7 @@
 #include "FrameLoaderStateMachine.h"
 #include "FrameLoaderTypes.h"
 #include "HistoryController.h"
+#include "IconDatabaseBase.h"
 #include "PolicyChecker.h"
 #include "ResourceLoadNotifier.h"
 #include "SubframeLoader.h"
@@ -289,13 +290,13 @@ public:
 
     FrameLoaderStateMachine* stateMachine() const { return &m_stateMachine; }
 
-    void iconLoadDecisionAvailable();
+    void startIconLoader();
+    void iconLoadDecisionReceived(IconLoadDecision);
+    void continueIconLoadWithDecision(IconLoadDecision);
 
     bool shouldAllowNavigation(Frame* targetFrame) const;
     Frame* findFrameForNavigation(const AtomicString& name);
 
-    void startIconLoader();
-
     void applyUserAgent(ResourceRequest& request);
 
     bool shouldInterruptLoadForXFrameOptions(const String&, const KURL&);
@@ -322,7 +323,7 @@ public:
     
     bool suppressOpenerInNewFrame() const { return m_suppressOpenerInNewFrame; }
 
-    static ObjectContentType defaultObjectContentType(const KURL& url, const String& mimeType);
+    static ObjectContentType defaultObjectContentType(const KURL&, const String& mimeType, bool shouldPreferPlugInsForImages);
 
     void clear(bool clearWindowProperties = true, bool clearScriptObjects = true, bool clearFrameView = true);
 
diff --git a/Source/WebCore/loader/FrameLoaderClient.h b/Source/WebCore/loader/FrameLoaderClient.h
index 4a0bcbf..e89056d 100644
--- a/Source/WebCore/loader/FrameLoaderClient.h
+++ b/Source/WebCore/loader/FrameLoaderClient.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2007, 2008, 2009, 2010 Apple Inc. All rights reserved.
+ * Copyright (C) 2006, 2007, 2008, 2009, 2010, 2011 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -259,7 +259,7 @@ namespace WebCore {
         virtual void showMediaPlayerProxyPlugin(Widget*) = 0;
 #endif
 
-        virtual ObjectContentType objectContentType(const KURL& url, const String& mimeType) = 0;
+        virtual ObjectContentType objectContentType(const KURL&, const String& mimeType, bool shouldPreferPlugInsForImages) = 0;
         virtual String overrideMediaType() const = 0;
 
         virtual void dispatchDidClearWindowObjectInWorld(DOMWrapperWorld*) = 0;
diff --git a/Source/WebCore/loader/FrameLoaderTypes.h b/Source/WebCore/loader/FrameLoaderTypes.h
index 79c05dc..d13f375 100644
--- a/Source/WebCore/loader/FrameLoaderTypes.h
+++ b/Source/WebCore/loader/FrameLoaderTypes.h
@@ -42,7 +42,7 @@ namespace WebCore {
     enum PolicyAction {
         PolicyUse,
         PolicyDownload,
-        PolicyIgnore,
+        PolicyIgnore
     };
 
     // NOTE: Keep in sync with WebKit/mac/WebView/WebFramePrivate.h and WebKit/win/Interfaces/IWebFramePrivate.idl
diff --git a/Source/WebCore/loader/MainResourceLoader.cpp b/Source/WebCore/loader/MainResourceLoader.cpp
index c3c8d62..0cdbc21 100644
--- a/Source/WebCore/loader/MainResourceLoader.cpp
+++ b/Source/WebCore/loader/MainResourceLoader.cpp
@@ -118,7 +118,9 @@ ResourceError MainResourceLoader::interruptionForPolicyChangeError() const
 
 void MainResourceLoader::stopLoadingForPolicyChange()
 {
-    cancel(interruptionForPolicyChangeError());
+    ResourceError error = interruptionForPolicyChangeError();
+    error.setIsCancellation(true);
+    cancel(error);
 }
 
 void MainResourceLoader::callContinueAfterNavigationPolicy(void* argument, const ResourceRequest& request, PassRefPtr<FormState>, bool shouldContinue)
diff --git a/Source/WebCore/loader/PolicyCallback.cpp b/Source/WebCore/loader/PolicyCallback.cpp
index 4ec2c84..45fdbb0 100644
--- a/Source/WebCore/loader/PolicyCallback.cpp
+++ b/Source/WebCore/loader/PolicyCallback.cpp
@@ -42,6 +42,7 @@ PolicyCallback::PolicyCallback()
     : m_navigationFunction(0)
     , m_newWindowFunction(0)
     , m_contentFunction(0)
+    , m_argument(0)
 {
 }
 
diff --git a/Source/WebCore/loader/ResourceLoadNotifier.cpp b/Source/WebCore/loader/ResourceLoadNotifier.cpp
index c928557..3a02aa3 100644
--- a/Source/WebCore/loader/ResourceLoadNotifier.cpp
+++ b/Source/WebCore/loader/ResourceLoadNotifier.cpp
@@ -74,12 +74,12 @@ void ResourceLoadNotifier::didReceiveResponse(ResourceLoader* loader, const Reso
     dispatchDidReceiveResponse(loader->documentLoader(), loader->identifier(), r);
 }
 
-void ResourceLoadNotifier::didReceiveData(ResourceLoader* loader, const char* data, int length, int lengthReceived)
+void ResourceLoadNotifier::didReceiveData(ResourceLoader* loader, const char* data, int dataLength, int lengthReceived)
 {
     if (Page* page = m_frame->page())
-        page->progress()->incrementProgress(loader->identifier(), data, length);
+        page->progress()->incrementProgress(loader->identifier(), data, dataLength);
 
-    dispatchDidReceiveContentLength(loader->documentLoader(), loader->identifier(), lengthReceived);
+    dispatchDidReceiveContentLength(loader->documentLoader(), loader->identifier(), dataLength, lengthReceived);
 }
 
 void ResourceLoadNotifier::didFinishLoad(ResourceLoader* loader, double finishTime)
@@ -103,8 +103,6 @@ void ResourceLoadNotifier::didFailToLoad(ResourceLoader* loader, const ResourceE
 void ResourceLoadNotifier::assignIdentifierToInitialRequest(unsigned long identifier, DocumentLoader* loader, const ResourceRequest& request)
 {
     m_frame->loader()->client()->assignIdentifierToInitialRequest(identifier, loader, request);
-
-    InspectorInstrumentation::identifierForInitialRequest(m_frame, identifier, loader, request);
 }
 
 void ResourceLoadNotifier::dispatchWillSendRequest(DocumentLoader* loader, unsigned long identifier, ResourceRequest& request, const ResourceResponse& redirectResponse)
@@ -118,7 +116,7 @@ void ResourceLoadNotifier::dispatchWillSendRequest(DocumentLoader* loader, unsig
     if (!request.isNull() && oldRequestURL != request.url().string().impl())
         m_frame->loader()->documentLoader()->didTellClientAboutLoad(request.url());
 
-    InspectorInstrumentation::willSendRequest(m_frame, identifier, request, redirectResponse);
+    InspectorInstrumentation::willSendRequest(m_frame, identifier, loader, request, redirectResponse);
 
     // Report WebTiming for all frames.
     if (loader && !request.isNull() && request.url() == loader->requestURL())
@@ -132,11 +130,11 @@ void ResourceLoadNotifier::dispatchDidReceiveResponse(DocumentLoader* loader, un
     InspectorInstrumentation::didReceiveResourceResponse(cookie, identifier, loader, r);
 }
 
-void ResourceLoadNotifier::dispatchDidReceiveContentLength(DocumentLoader* loader, unsigned long identifier, int length)
+void ResourceLoadNotifier::dispatchDidReceiveContentLength(DocumentLoader* loader, unsigned long identifier, int dataLength, int lengthReceived)
 {
-    m_frame->loader()->client()->dispatchDidReceiveContentLength(loader, identifier, length);
+    m_frame->loader()->client()->dispatchDidReceiveContentLength(loader, identifier, dataLength);
 
-    InspectorInstrumentation::didReceiveContentLength(m_frame, identifier, length);
+    InspectorInstrumentation::didReceiveContentLength(m_frame, identifier, dataLength, lengthReceived);
 }
 
 void ResourceLoadNotifier::dispatchDidFinishLoading(DocumentLoader* loader, unsigned long identifier, double finishTime)
@@ -154,13 +152,13 @@ void ResourceLoadNotifier::dispatchTransferLoadingResourceFromPage(unsigned long
     oldPage->progress()->completeProgress(identifier);
 }
 
-void ResourceLoadNotifier::sendRemainingDelegateMessages(DocumentLoader* loader, unsigned long identifier, const ResourceResponse& response, int length, const ResourceError& error)
+void ResourceLoadNotifier::sendRemainingDelegateMessages(DocumentLoader* loader, unsigned long identifier, const ResourceResponse& response, int dataLength, int lengthReceived, const ResourceError& error)
 {
     if (!response.isNull())
         dispatchDidReceiveResponse(loader, identifier, response);
 
-    if (length > 0)
-        dispatchDidReceiveContentLength(loader, identifier, length);
+    if (dataLength > 0)
+        dispatchDidReceiveContentLength(loader, identifier, dataLength, lengthReceived);
 
     if (error.isNull())
         dispatchDidFinishLoading(loader, identifier, 0);
diff --git a/Source/WebCore/loader/ResourceLoadNotifier.h b/Source/WebCore/loader/ResourceLoadNotifier.h
index a6d92fb..5753c28 100644
--- a/Source/WebCore/loader/ResourceLoadNotifier.h
+++ b/Source/WebCore/loader/ResourceLoadNotifier.h
@@ -53,18 +53,18 @@ public:
 
     void willSendRequest(ResourceLoader*, ResourceRequest&, const ResourceResponse& redirectResponse);
     void didReceiveResponse(ResourceLoader*, const ResourceResponse&);
-    void didReceiveData(ResourceLoader*, const char*, int, int lengthReceived);
+    void didReceiveData(ResourceLoader*, const char*, int dataLength, int lengthReceived);
     void didFinishLoad(ResourceLoader*, double finishTime);
     void didFailToLoad(ResourceLoader*, const ResourceError&);
 
     void assignIdentifierToInitialRequest(unsigned long identifier, DocumentLoader*, const ResourceRequest&);
     void dispatchWillSendRequest(DocumentLoader*, unsigned long identifier, ResourceRequest&, const ResourceResponse& redirectResponse);
     void dispatchDidReceiveResponse(DocumentLoader*, unsigned long identifier, const ResourceResponse&);
-    void dispatchDidReceiveContentLength(DocumentLoader*, unsigned long identifier, int length);
+    void dispatchDidReceiveContentLength(DocumentLoader*, unsigned long identifier, int dataLength, int lengthReceived);
     void dispatchDidFinishLoading(DocumentLoader*, unsigned long identifier, double finishTime);
     void dispatchTransferLoadingResourceFromPage(unsigned long, DocumentLoader*, const ResourceRequest&, Page*);
 
-    void sendRemainingDelegateMessages(DocumentLoader*, unsigned long identifier, const ResourceResponse&, int length, const ResourceError&);
+    void sendRemainingDelegateMessages(DocumentLoader*, unsigned long identifier, const ResourceResponse&, int dataLength, int lengthReceived, const ResourceError&);
 
 private:
     Frame* m_frame;
diff --git a/Source/WebCore/loader/ResourceLoadScheduler.cpp b/Source/WebCore/loader/ResourceLoadScheduler.cpp
index dbb6914..7cceff7 100644
--- a/Source/WebCore/loader/ResourceLoadScheduler.cpp
+++ b/Source/WebCore/loader/ResourceLoadScheduler.cpp
@@ -83,12 +83,13 @@ ResourceLoadScheduler::ResourceLoadScheduler()
 #endif
 }
 
-PassRefPtr<SubresourceLoader> ResourceLoadScheduler::scheduleSubresourceLoad(Frame* frame, SubresourceLoaderClient* client, const ResourceRequest& request, ResourceLoadPriority priority, SecurityCheckPolicy securityCheck, bool sendResourceLoadCallbacks, bool shouldContentSniff)
+PassRefPtr<SubresourceLoader> ResourceLoadScheduler::scheduleSubresourceLoad(Frame* frame, SubresourceLoaderClient* client, const ResourceRequest& request, ResourceLoadPriority priority, SecurityCheckPolicy securityCheck,
+                                                                             bool sendResourceLoadCallbacks, bool shouldContentSniff, const String& optionalOutgoingReferrer)
 {
-    PassRefPtr<SubresourceLoader> loader = SubresourceLoader::create(frame, client, request, securityCheck, sendResourceLoadCallbacks, shouldContentSniff);
+    RefPtr<SubresourceLoader> loader = SubresourceLoader::create(frame, client, request, securityCheck, sendResourceLoadCallbacks, shouldContentSniff, optionalOutgoingReferrer);
     if (loader)
         scheduleLoad(loader.get(), priority);
-    return loader;
+    return loader.release();
 }
 
 PassRefPtr<NetscapePlugInStreamLoader> ResourceLoadScheduler::schedulePluginStreamLoad(Frame* frame, NetscapePlugInStreamLoaderClient* client, const ResourceRequest& request)
diff --git a/Source/WebCore/loader/ResourceLoadScheduler.h b/Source/WebCore/loader/ResourceLoadScheduler.h
index f2e627f..49a4546 100644
--- a/Source/WebCore/loader/ResourceLoadScheduler.h
+++ b/Source/WebCore/loader/ResourceLoadScheduler.h
@@ -32,6 +32,7 @@
 #include <wtf/HashSet.h>
 #include <wtf/Noncopyable.h>
 #include <wtf/text/StringHash.h>
+#include <wtf/text/WTFString.h>
 
 namespace WebCore {
 
@@ -49,7 +50,7 @@ class ResourceLoadScheduler {
 public:
     friend ResourceLoadScheduler* resourceLoadScheduler();
 
-    PassRefPtr<SubresourceLoader> scheduleSubresourceLoad(Frame*, SubresourceLoaderClient*, const ResourceRequest&, ResourceLoadPriority = ResourceLoadPriorityLow, SecurityCheckPolicy = DoSecurityCheck, bool sendResourceLoadCallbacks = true, bool shouldContentSniff = true);
+    PassRefPtr<SubresourceLoader> scheduleSubresourceLoad(Frame*, SubresourceLoaderClient*, const ResourceRequest&, ResourceLoadPriority = ResourceLoadPriorityLow, SecurityCheckPolicy = DoSecurityCheck, bool sendResourceLoadCallbacks = true, bool shouldContentSniff = true, const String& optionalOutgoingReferrer = String());
     PassRefPtr<NetscapePlugInStreamLoader> schedulePluginStreamLoad(Frame*, NetscapePlugInStreamLoaderClient*, const ResourceRequest&);
     void addMainResourceLoad(ResourceLoader*);
     void remove(ResourceLoader*);
diff --git a/Source/WebCore/loader/ResourceLoader.h b/Source/WebCore/loader/ResourceLoader.h
index e5c5d3f..339b130 100644
--- a/Source/WebCore/loader/ResourceLoader.h
+++ b/Source/WebCore/loader/ResourceLoader.h
@@ -88,6 +88,9 @@ namespace WebCore {
         void willStopBufferingData(const char*, int);
         virtual void didFinishLoading(double finishTime);
         virtual void didFail(const ResourceError&);
+#if HAVE(CFNETWORK_DATA_ARRAY_CALLBACK)
+        virtual void didReceiveDataArray(CFArrayRef dataArray);
+#endif
 
         virtual bool shouldUseCredentialStorage();
         virtual void didReceiveAuthenticationChallenge(const AuthenticationChallenge&);
@@ -111,6 +114,9 @@ namespace WebCore {
         virtual bool shouldUseCredentialStorage(ResourceHandle*) { return shouldUseCredentialStorage(); }
         virtual void didReceiveAuthenticationChallenge(ResourceHandle*, const AuthenticationChallenge& challenge) { didReceiveAuthenticationChallenge(challenge); } 
         virtual void didCancelAuthenticationChallenge(ResourceHandle*, const AuthenticationChallenge& challenge) { didCancelAuthenticationChallenge(challenge); } 
+#if HAVE(CFNETWORK_DATA_ARRAY_CALLBACK)
+        virtual void didReceiveDataArray(ResourceHandle*, CFArrayRef dataArray);
+#endif
 #if USE(PROTECTION_SPACE_AUTH_CALLBACK)
         virtual bool canAuthenticateAgainstProtectionSpace(ResourceHandle*, const ProtectionSpace& protectionSpace) { return canAuthenticateAgainstProtectionSpace(protectionSpace); }
 #endif
diff --git a/Source/WebCore/loader/SubframeLoader.cpp b/Source/WebCore/loader/SubframeLoader.cpp
index 8bfd474..e7f851f 100644
--- a/Source/WebCore/loader/SubframeLoader.cpp
+++ b/Source/WebCore/loader/SubframeLoader.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2007, 2008, 2009, 2010 Apple Inc. All rights reserved.
+ * Copyright (C) 2006, 2007, 2008, 2009, 2010, 2011 Apple Inc. All rights reserved.
  * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
  * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  * Copyright (C) 2008 Alp Toker <alp@atoker.com>
@@ -88,17 +88,35 @@ bool SubframeLoader::requestFrame(HTMLFrameOwnerElement* ownerElement, const Str
     return true;
 }
     
-bool SubframeLoader::resourceWillUsePlugin(const String& url, const String& mimeType)
+bool SubframeLoader::resourceWillUsePlugin(const String& url, const String& mimeType, bool shouldPreferPlugInsForImages)
 {
     KURL completedURL;
     if (!url.isEmpty())
         completedURL = completeURL(url);
+
     bool useFallback;
-    return shouldUsePlugin(completedURL, mimeType, false, useFallback);
+    return shouldUsePlugin(completedURL, mimeType, shouldPreferPlugInsForImages, false, useFallback);
 }
 
-bool SubframeLoader::requestObject(HTMLPlugInImageElement* ownerElement, const String& url, const AtomicString& frameName,
-    const String& mimeType, const Vector<String>& paramNames, const Vector<String>& paramValues)
+bool SubframeLoader::requestPlugin(HTMLPlugInImageElement* ownerElement, const KURL& url, const String& mimeType, const Vector<String>& paramNames, const Vector<String>& paramValues, bool useFallback)
+{
+    Settings* settings = m_frame->settings();
+    if ((!allowPlugins(AboutToInstantiatePlugin)
+         // Application plug-ins are plug-ins implemented by the user agent, for example Qt plug-ins,
+         // as opposed to third-party code such as Flash. The user agent decides whether or not they are
+         // permitted, rather than WebKit.
+         && !MIMETypeRegistry::isApplicationPluginMIMEType(mimeType))
+        || (!settings->isJavaEnabled() && MIMETypeRegistry::isJavaAppletMIMEType(mimeType)))
+        return false;
+
+    if (m_frame->document() && m_frame->document()->securityOrigin()->isSandboxed(SandboxPlugins))
+        return false;
+
+    ASSERT(ownerElement->hasTagName(objectTag) || ownerElement->hasTagName(embedTag));
+    return loadPlugin(ownerElement, url, mimeType, paramNames, paramValues, useFallback);
+}
+ 
+bool SubframeLoader::requestObject(HTMLPlugInImageElement* ownerElement, const String& url, const AtomicString& frameName, const String& mimeType, const Vector<String>& paramNames, const Vector<String>& paramValues)
 {
     if (url.isEmpty() && mimeType.isEmpty())
         return false;
@@ -114,23 +132,8 @@ bool SubframeLoader::requestObject(HTMLPlugInImageElement* ownerElement, const S
         completedURL = completeURL(url);
 
     bool useFallback;
-    if (shouldUsePlugin(completedURL, mimeType, renderer->hasFallbackContent(), useFallback)) {
-        Settings* settings = m_frame->settings();
-        if ((!allowPlugins(AboutToInstantiatePlugin)
-             // Application plugins are plugins implemented by the user agent, for example Qt plugins,
-             // as opposed to third-party code such as flash. The user agent decides whether or not they are
-             // permitted, rather than WebKit.
-             && !MIMETypeRegistry::isApplicationPluginMIMEType(mimeType))
-            || (!settings->isJavaEnabled() && MIMETypeRegistry::isJavaAppletMIMEType(mimeType)))
-            return false;
-        if (m_frame->document() && m_frame->document()->securityOrigin()->isSandboxed(SandboxPlugins))
-            return false;
-
-        ASSERT(ownerElement->hasTagName(objectTag) || ownerElement->hasTagName(embedTag));
-        HTMLPlugInImageElement* pluginElement = static_cast<HTMLPlugInImageElement*>(ownerElement);
-
-        return loadPlugin(pluginElement, completedURL, mimeType, paramNames, paramValues, useFallback);
-    }
+    if (shouldUsePlugin(completedURL, mimeType, ownerElement->shouldPreferPlugInsForImages(), renderer->hasFallbackContent(), useFallback))
+        return requestPlugin(ownerElement, completedURL, mimeType, paramNames, paramValues, useFallback);
 
     // If the plug-in element already contains a subframe, loadOrRedirectSubframe will re-use it. Otherwise,
     // it will create a new frame and set it as the RenderPart's widget, causing what was previously 
@@ -289,7 +292,7 @@ bool SubframeLoader::allowPlugins(ReasonForCallingAllowPlugins reason)
     return allowed;
 }
 
-bool SubframeLoader::shouldUsePlugin(const KURL& url, const String& mimeType, bool hasFallback, bool& useFallback)
+bool SubframeLoader::shouldUsePlugin(const KURL& url, const String& mimeType, bool shouldPreferPlugInsForImages, bool hasFallback, bool& useFallback)
 {
     if (m_frame->loader()->client()->shouldUsePluginDocument(mimeType)) {
         useFallback = false;
@@ -305,7 +308,7 @@ bool SubframeLoader::shouldUsePlugin(const KURL& url, const String& mimeType, bo
             return true;
     }
         
-    ObjectContentType objectType = m_frame->loader()->client()->objectContentType(url, mimeType);
+    ObjectContentType objectType = m_frame->loader()->client()->objectContentType(url, mimeType, shouldPreferPlugInsForImages);
     // If an object's content can't be handled and it has no fallback, let
     // it be handled as a plugin to show the broken plugin icon.
     useFallback = objectType == ObjectContentNone && hasFallback;
diff --git a/Source/WebCore/loader/SubframeLoader.h b/Source/WebCore/loader/SubframeLoader.h
index ba63a5c..01c59e6 100644
--- a/Source/WebCore/loader/SubframeLoader.h
+++ b/Source/WebCore/loader/SubframeLoader.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2006, 2007, 2008, 2009, 2011 Apple Inc. All rights reserved.
  * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  * Copyright (C) Research In Motion Limited 2009. All rights reserved.
  *
@@ -77,15 +77,16 @@ public:
 
     bool containsPlugins() const { return m_containsPlugins; }
     
-    bool resourceWillUsePlugin(const String& url, const String& mimeType);
+    bool resourceWillUsePlugin(const String& url, const String& mimeType, bool shouldPreferPlugInsForImages);
 
 private:
+    bool requestPlugin(HTMLPlugInImageElement*, const KURL&, const String& serviceType, const Vector<String>& paramNames, const Vector<String>& paramValues, bool useFallback);
     Frame* loadOrRedirectSubframe(HTMLFrameOwnerElement*, const KURL&, const AtomicString& frameName, bool lockHistory, bool lockBackForwardList);
     Frame* loadSubframe(HTMLFrameOwnerElement*, const KURL&, const String& name, const String& referrer);
     bool loadPlugin(HTMLPlugInImageElement*, const KURL&, const String& mimeType,
         const Vector<String>& paramNames, const Vector<String>& paramValues, bool useFallback);
 
-    bool shouldUsePlugin(const KURL&, const String& mimeType, bool hasFallback, bool& useFallback);
+    bool shouldUsePlugin(const KURL&, const String& mimeType, bool shouldPreferPlugInsForImages, bool hasFallback, bool& useFallback);
 
     Document* document() const;
 
diff --git a/Source/WebCore/loader/SubresourceLoader.cpp b/Source/WebCore/loader/SubresourceLoader.cpp
index f948ec3..cfe8d0a 100644
--- a/Source/WebCore/loader/SubresourceLoader.cpp
+++ b/Source/WebCore/loader/SubresourceLoader.cpp
@@ -60,7 +60,7 @@ SubresourceLoader::~SubresourceLoader()
 #endif
 }
 
-PassRefPtr<SubresourceLoader> SubresourceLoader::create(Frame* frame, SubresourceLoaderClient* client, const ResourceRequest& request, SecurityCheckPolicy securityCheck, bool sendResourceLoadCallbacks, bool shouldContentSniff)
+PassRefPtr<SubresourceLoader> SubresourceLoader::create(Frame* frame, SubresourceLoaderClient* client, const ResourceRequest& request, SecurityCheckPolicy securityCheck, bool sendResourceLoadCallbacks, bool shouldContentSniff, const String& optionalOutgoingReferrer)
 {
     if (!frame)
         return 0;
@@ -75,12 +75,22 @@ PassRefPtr<SubresourceLoader> SubresourceLoader::create(Frame* frame, Subresourc
         FrameLoader::reportLocalLoadFailed(frame, request.url().string());
         return 0;
     }
-    
-    if (SecurityOrigin::shouldHideReferrer(request.url(), fl->outgoingReferrer()))
+
+    String outgoingReferrer;
+    String outgoingOrigin;
+    if (optionalOutgoingReferrer.isNull()) {
+        outgoingReferrer = fl->outgoingReferrer();
+        outgoingOrigin = fl->outgoingOrigin();
+    } else {
+        outgoingReferrer = optionalOutgoingReferrer;
+        outgoingOrigin = SecurityOrigin::createFromString(outgoingReferrer)->toString();
+    }
+
+    if (SecurityOrigin::shouldHideReferrer(request.url(), outgoingReferrer))
         newRequest.clearHTTPReferrer();
     else if (!request.httpReferrer())
-        newRequest.setHTTPReferrer(fl->outgoingReferrer());
-    FrameLoader::addHTTPOriginIfNeeded(newRequest, fl->outgoingOrigin());
+        newRequest.setHTTPReferrer(outgoingReferrer);
+    FrameLoader::addHTTPOriginIfNeeded(newRequest, outgoingOrigin);
 
     fl->addExtraFieldsToSubresourceRequest(newRequest);
 
diff --git a/Source/WebCore/loader/SubresourceLoader.h b/Source/WebCore/loader/SubresourceLoader.h
index cb7ed81..b3aefb6 100644
--- a/Source/WebCore/loader/SubresourceLoader.h
+++ b/Source/WebCore/loader/SubresourceLoader.h
@@ -31,6 +31,8 @@
 
 #include "FrameLoaderTypes.h"
 #include "ResourceLoader.h"
+
+#include <wtf/text/WTFString.h>
  
 namespace WebCore {
 
@@ -39,7 +41,7 @@ namespace WebCore {
     
     class SubresourceLoader : public ResourceLoader {
     public:
-        static PassRefPtr<SubresourceLoader> create(Frame*, SubresourceLoaderClient*, const ResourceRequest&, SecurityCheckPolicy = DoSecurityCheck, bool sendResourceLoadCallbacks = true, bool shouldContentSniff = true);
+        static PassRefPtr<SubresourceLoader> create(Frame*, SubresourceLoaderClient*, const ResourceRequest&, SecurityCheckPolicy = DoSecurityCheck, bool sendResourceLoadCallbacks = true, bool shouldContentSniff = true, const String& optionalOutgoingReferrer = String());
 
         void clearClient() { m_client = 0; }
 
@@ -59,6 +61,11 @@ namespace WebCore {
         virtual void receivedCancellation(const AuthenticationChallenge&);        
         virtual void didCancel(const ResourceError&);
 
+#if HAVE(CFNETWORK_DATA_ARRAY_CALLBACK)
+        virtual bool supportsDataArray() { return true; }
+        virtual void didReceiveDataArray(CFArrayRef);
+#endif
+
         SubresourceLoaderClient* m_client;
         bool m_loadingMultipartContent;
     };
diff --git a/Source/WebCore/loader/ThreadableLoaderClientWrapper.h b/Source/WebCore/loader/ThreadableLoaderClientWrapper.h
index 664e0b3..d765fa0 100644
--- a/Source/WebCore/loader/ThreadableLoaderClientWrapper.h
+++ b/Source/WebCore/loader/ThreadableLoaderClientWrapper.h
@@ -38,85 +38,85 @@
 
 namespace WebCore {
 
-    class ThreadableLoaderClientWrapper : public ThreadSafeShared<ThreadableLoaderClientWrapper> {
-    public:
-        static PassRefPtr<ThreadableLoaderClientWrapper> create(ThreadableLoaderClient* client)
-        {
-            return adoptRef(new ThreadableLoaderClientWrapper(client));
-        }
-
-        void clearClient()
-        {
-            m_done = true;
-            m_client = 0;
-        }
-
-        bool done() const
-        {
-            return m_done;
-        }
-
-        void didSendData(unsigned long long bytesSent, unsigned long long totalBytesToBeSent)
-        {
-            if (m_client)
-                m_client->didSendData(bytesSent, totalBytesToBeSent);
-        }
-
-        void didReceiveResponse(const ResourceResponse& response)
-        {
-            if (m_client)
-                m_client->didReceiveResponse(response);
-        }
-
-        void didReceiveData(const char* data, int dataLength)
-        {
-            if (m_client)
-                m_client->didReceiveData(data, dataLength);
-        }
-
-        void didReceiveCachedMetadata(const char* data, int dataLength)
-        {
-            if (m_client)
-                m_client->didReceiveCachedMetadata(data, dataLength);
-        }
-
-        void didFinishLoading(unsigned long identifier, double finishTime)
-        {
-            m_done = true;
-            if (m_client)
-                m_client->didFinishLoading(identifier, finishTime);
-        }
-
-        void didFail(const ResourceError& error)
-        {
-            m_done = true;
-            if (m_client)
-                m_client->didFail(error);
-        }
-
-        void didFailRedirectCheck()
-        {
-            m_done = true;
-            if (m_client)
-                m_client->didFailRedirectCheck();
-        }
-
-        void didReceiveAuthenticationCancellation(const ResourceResponse& response)
-        {
-            if (m_client)
-                m_client->didReceiveResponse(response);
-        }
-
-    protected:
-        ThreadableLoaderClientWrapper(ThreadableLoaderClient* client)
-            : m_client(client)
-            , m_done(false)
-        {
-        }
-
-        ThreadableLoaderClient* m_client;
-        bool m_done;
-    };
+class ThreadableLoaderClientWrapper : public ThreadSafeRefCounted<ThreadableLoaderClientWrapper> {
+public:
+    static PassRefPtr<ThreadableLoaderClientWrapper> create(ThreadableLoaderClient* client)
+    {
+        return adoptRef(new ThreadableLoaderClientWrapper(client));
+    }
+
+    void clearClient()
+    {
+        m_done = true;
+        m_client = 0;
+    }
+
+    bool done() const
+    {
+        return m_done;
+    }
+
+    void didSendData(unsigned long long bytesSent, unsigned long long totalBytesToBeSent)
+    {
+        if (m_client)
+            m_client->didSendData(bytesSent, totalBytesToBeSent);
+    }
+
+    void didReceiveResponse(const ResourceResponse& response)
+    {
+        if (m_client)
+            m_client->didReceiveResponse(response);
+    }
+
+    void didReceiveData(const char* data, int dataLength)
+    {
+        if (m_client)
+            m_client->didReceiveData(data, dataLength);
+    }
+
+    void didReceiveCachedMetadata(const char* data, int dataLength)
+    {
+        if (m_client)
+            m_client->didReceiveCachedMetadata(data, dataLength);
+    }
+
+    void didFinishLoading(unsigned long identifier, double finishTime)
+    {
+        m_done = true;
+        if (m_client)
+            m_client->didFinishLoading(identifier, finishTime);
+    }
+
+    void didFail(const ResourceError& error)
+    {
+        m_done = true;
+        if (m_client)
+            m_client->didFail(error);
+    }
+
+    void didFailRedirectCheck()
+    {
+        m_done = true;
+        if (m_client)
+            m_client->didFailRedirectCheck();
+    }
+
+    void didReceiveAuthenticationCancellation(const ResourceResponse& response)
+    {
+        if (m_client)
+            m_client->didReceiveResponse(response);
+    }
+
+protected:
+    ThreadableLoaderClientWrapper(ThreadableLoaderClient* client)
+        : m_client(client)
+        , m_done(false)
+    {
+    }
+
+    ThreadableLoaderClient* m_client;
+    bool m_done;
+};
 
 } // namespace WebCore
 
diff --git a/Source/WebCore/loader/WorkerThreadableLoader.cpp b/Source/WebCore/loader/WorkerThreadableLoader.cpp
index 6c61318..d753ecb 100644
--- a/Source/WebCore/loader/WorkerThreadableLoader.cpp
+++ b/Source/WebCore/loader/WorkerThreadableLoader.cpp
@@ -34,6 +34,8 @@
 
 #include "WorkerThreadableLoader.h"
 
+#include "Document.h"
+#include "DocumentThreadableLoader.h"
 #include "CrossThreadTask.h"
 #include "ResourceError.h"
 #include "ResourceRequest.h"
@@ -55,7 +57,7 @@ static const char loadResourceSynchronouslyMode[] = "loadResourceSynchronouslyMo
 WorkerThreadableLoader::WorkerThreadableLoader(WorkerContext* workerContext, ThreadableLoaderClient* client, const String& taskMode, const ResourceRequest& request, const ThreadableLoaderOptions& options)
     : m_workerContext(workerContext)
     , m_workerClientWrapper(ThreadableLoaderClientWrapper::create(client))
-    , m_bridge(*(new MainThreadBridge(m_workerClientWrapper, m_workerContext->thread()->workerLoaderProxy(), taskMode, request, options)))
+    , m_bridge(*(new MainThreadBridge(m_workerClientWrapper, m_workerContext->thread()->workerLoaderProxy(), taskMode, request, options, workerContext->url().strippedForUseAsReferrer())))
 {
 }
 
@@ -87,32 +89,30 @@ void WorkerThreadableLoader::cancel()
 }
 
 WorkerThreadableLoader::MainThreadBridge::MainThreadBridge(PassRefPtr<ThreadableLoaderClientWrapper> workerClientWrapper, WorkerLoaderProxy& loaderProxy, const String& taskMode,
-                                                           const ResourceRequest& request, const ThreadableLoaderOptions& options)
+                                                           const ResourceRequest& request, const ThreadableLoaderOptions& options, const String& outgoingReferrer)
     : m_workerClientWrapper(workerClientWrapper)
     , m_loaderProxy(loaderProxy)
     , m_taskMode(taskMode.crossThreadString())
 {
     ASSERT(m_workerClientWrapper.get());
-    m_loaderProxy.postTaskToLoader(createCallbackTask(&MainThreadBridge::mainThreadCreateLoader, this, request, options));
+    m_loaderProxy.postTaskToLoader(createCallbackTask(&MainThreadBridge::mainThreadCreateLoader, this, request, options, outgoingReferrer));
 }
 
 WorkerThreadableLoader::MainThreadBridge::~MainThreadBridge()
 {
 }
 
-void WorkerThreadableLoader::MainThreadBridge::mainThreadCreateLoader(ScriptExecutionContext* context, MainThreadBridge* thisPtr, PassOwnPtr<CrossThreadResourceRequestData> requestData, ThreadableLoaderOptions options)
+void WorkerThreadableLoader::MainThreadBridge::mainThreadCreateLoader(ScriptExecutionContext* context, MainThreadBridge* thisPtr, PassOwnPtr<CrossThreadResourceRequestData> requestData, ThreadableLoaderOptions options, const String& outgoingReferrer)
 {
     ASSERT(isMainThread());
     ASSERT(context->isDocument());
+    Document* document = static_cast<Document*>(context);
 
-    // FIXME: the created loader has no knowledge of the origin of the worker doing the load request.
-    // Basically every setting done in SubresourceLoader::create (including the contents of addExtraFieldsToRequest)
-    // needs to be examined for how it should take into account a different originator.
     OwnPtr<ResourceRequest> request(ResourceRequest::adopt(requestData));
     // FIXME: If the a site requests a local resource, then this will return a non-zero value but the sync path
     // will return a 0 value.  Either this should return 0 or the other code path should do a callback with
     // a failure.
-    thisPtr->m_mainThreadLoader = ThreadableLoader::create(context, thisPtr, *request, options);
+    thisPtr->m_mainThreadLoader = DocumentThreadableLoader::create(document, thisPtr, *request, options, outgoingReferrer);
     ASSERT(thisPtr->m_mainThreadLoader);
 }
 
diff --git a/Source/WebCore/loader/WorkerThreadableLoader.h b/Source/WebCore/loader/WorkerThreadableLoader.h
index 2477f19..7685eed 100644
--- a/Source/WebCore/loader/WorkerThreadableLoader.h
+++ b/Source/WebCore/loader/WorkerThreadableLoader.h
@@ -98,7 +98,7 @@ namespace WebCore {
         class MainThreadBridge : public ThreadableLoaderClient {
         public:
             // All executed on the worker context's thread.
-            MainThreadBridge(PassRefPtr<ThreadableLoaderClientWrapper>, WorkerLoaderProxy&, const String& taskMode, const ResourceRequest&, const ThreadableLoaderOptions&);
+            MainThreadBridge(PassRefPtr<ThreadableLoaderClientWrapper>, WorkerLoaderProxy&, const String& taskMode, const ResourceRequest&, const ThreadableLoaderOptions&, const String& outgoingReferrer);
             void cancel();
             void destroy();
 
@@ -110,7 +110,7 @@ namespace WebCore {
             static void mainThreadDestroy(ScriptExecutionContext*, MainThreadBridge*);
             ~MainThreadBridge();
 
-            static void mainThreadCreateLoader(ScriptExecutionContext*, MainThreadBridge*, PassOwnPtr<CrossThreadResourceRequestData>, ThreadableLoaderOptions);
+            static void mainThreadCreateLoader(ScriptExecutionContext*, MainThreadBridge*, PassOwnPtr<CrossThreadResourceRequestData>, ThreadableLoaderOptions, const String& outgoingReferrer);
             static void mainThreadCancel(ScriptExecutionContext*, MainThreadBridge*);
             virtual void didSendData(unsigned long long bytesSent, unsigned long long totalBytesToBeSent);
             virtual void didReceiveResponse(const ResourceResponse&);
diff --git a/Source/WebCore/loader/appcache/ApplicationCache.cpp b/Source/WebCore/loader/appcache/ApplicationCache.cpp
index 450fa10..f3479b4 100644
--- a/Source/WebCore/loader/appcache/ApplicationCache.cpp
+++ b/Source/WebCore/loader/appcache/ApplicationCache.cpp
@@ -32,6 +32,7 @@
 #include "ApplicationCacheResource.h"
 #include "ApplicationCacheStorage.h"
 #include "ResourceRequest.h"
+#include "SecurityOrigin.h"
 #include <wtf/text/CString.h>
 #include <stdio.h>
 
@@ -182,7 +183,29 @@ void ApplicationCache::clearStorageID()
     ResourceMap::const_iterator end = m_resources.end();
     for (ResourceMap::const_iterator it = m_resources.begin(); it != end; ++it)
         it->second->clearStorageID();
-}    
+}
+    
+void ApplicationCache::deleteCacheForOrigin(SecurityOrigin* origin)
+{
+    Vector<KURL> urls;
+    if (!cacheStorage().manifestURLs(&urls)) {
+        LOG_ERROR("Failed to retrieve ApplicationCache manifest URLs");
+        return;
+    }
+
+    KURL originURL(KURL(), origin->toString());
+
+    size_t count = urls.size();
+    for (size_t i = 0; i < count; ++i) {
+        if (protocolHostAndPortAreEqual(urls[i], originURL)) {
+            ApplicationCacheGroup* group = cacheStorage().findInMemoryCacheGroup(urls[i]);
+            if (group)
+                group->makeObsolete();
+            else
+                cacheStorage().deleteCacheGroup(urls[i]);
+        }
+    }
+}
     
 #ifndef NDEBUG
 void ApplicationCache::dump()
diff --git a/Source/WebCore/loader/appcache/ApplicationCache.h b/Source/WebCore/loader/appcache/ApplicationCache.h
index f073499..9d20361 100644
--- a/Source/WebCore/loader/appcache/ApplicationCache.h
+++ b/Source/WebCore/loader/appcache/ApplicationCache.h
@@ -42,12 +42,16 @@ class ApplicationCacheResource;
 class DocumentLoader;
 class KURL;
 class ResourceRequest;
+class SecurityOrigin;
 
 typedef Vector<std::pair<KURL, KURL> > FallbackURLVector;
 
 class ApplicationCache : public RefCounted<ApplicationCache> {
 public:
     static PassRefPtr<ApplicationCache> create() { return adoptRef(new ApplicationCache); }
+    
+    static void deleteCacheForOrigin(SecurityOrigin*);
+    
     ~ApplicationCache();
 
     void addResource(PassRefPtr<ApplicationCacheResource> resource);
diff --git a/Source/WebCore/loader/appcache/ApplicationCacheGroup.cpp b/Source/WebCore/loader/appcache/ApplicationCacheGroup.cpp
index 514ef19..aab8927 100644
--- a/Source/WebCore/loader/appcache/ApplicationCacheGroup.cpp
+++ b/Source/WebCore/loader/appcache/ApplicationCacheGroup.cpp
@@ -474,9 +474,8 @@ PassRefPtr<ResourceHandle> ApplicationCacheGroup::createResourceHandle(const KUR
     // Because willSendRequest only gets called during redirects, we initialize
     // the identifier and the first willSendRequest here.
     m_currentResourceIdentifier = m_frame->page()->progress()->createUniqueIdentifier();
-    InspectorInstrumentation::identifierForInitialRequest(m_frame, m_currentResourceIdentifier, m_frame->loader()->documentLoader(), handle->firstRequest());
     ResourceResponse redirectResponse = ResourceResponse();
-    InspectorInstrumentation::willSendRequest(m_frame, m_currentResourceIdentifier, request, redirectResponse);
+    InspectorInstrumentation::willSendRequest(m_frame, m_currentResourceIdentifier, m_frame->loader()->documentLoader(), request, redirectResponse);
 #endif
     return handle;
 }
@@ -512,7 +511,7 @@ void ApplicationCacheGroup::didReceiveResponse(ResourceHandle* handle, const Res
     if (m_newestCache && response.httpStatusCode() == 304) { // Not modified.
         ApplicationCacheResource* newestCachedResource = m_newestCache->resourceForURL(url);
         if (newestCachedResource) {
-            m_cacheBeingUpdated->addResource(ApplicationCacheResource::create(url, newestCachedResource->response(), type, newestCachedResource->data()));
+            m_cacheBeingUpdated->addResource(ApplicationCacheResource::create(url, newestCachedResource->response(), type, newestCachedResource->data(), newestCachedResource->path()));
             m_pendingEntries.remove(m_currentHandle->firstRequest().url());
             m_currentHandle->cancel();
             m_currentHandle = 0;
@@ -540,7 +539,7 @@ void ApplicationCacheGroup::didReceiveResponse(ResourceHandle* handle, const Res
             ASSERT(m_newestCache);
             ApplicationCacheResource* newestCachedResource = m_newestCache->resourceForURL(handle->firstRequest().url());
             ASSERT(newestCachedResource);
-            m_cacheBeingUpdated->addResource(ApplicationCacheResource::create(url, newestCachedResource->response(), type, newestCachedResource->data()));
+            m_cacheBeingUpdated->addResource(ApplicationCacheResource::create(url, newestCachedResource->response(), type, newestCachedResource->data(), newestCachedResource->path()));
             m_pendingEntries.remove(m_currentHandle->firstRequest().url());
             m_currentHandle->cancel();
             m_currentHandle = 0;
@@ -555,8 +554,10 @@ void ApplicationCacheGroup::didReceiveResponse(ResourceHandle* handle, const Res
 
 void ApplicationCacheGroup::didReceiveData(ResourceHandle* handle, const char* data, int length, int lengthReceived)
 {
+    UNUSED_PARAM(lengthReceived);
+
 #if ENABLE(INSPECTOR)
-    InspectorInstrumentation::didReceiveContentLength(m_frame, m_currentResourceIdentifier, lengthReceived);
+    InspectorInstrumentation::didReceiveContentLength(m_frame, m_currentResourceIdentifier, length, 0);
 #endif
 
     if (handle == m_manifestHandle) {
@@ -642,7 +643,7 @@ void ApplicationCacheGroup::didFail(ResourceHandle* handle, const ResourceError&
         ASSERT(m_newestCache);
         ApplicationCacheResource* newestCachedResource = m_newestCache->resourceForURL(url);
         ASSERT(newestCachedResource);
-        m_cacheBeingUpdated->addResource(ApplicationCacheResource::create(url, newestCachedResource->response(), type, newestCachedResource->data()));
+        m_cacheBeingUpdated->addResource(ApplicationCacheResource::create(url, newestCachedResource->response(), type, newestCachedResource->data(), newestCachedResource->path()));
         // Load the next resource, if any.
         startLoadingEntry();
     }
@@ -866,7 +867,7 @@ void ApplicationCacheGroup::checkIfLoadIsComplete()
         }
 
         ApplicationCacheStorage::FailureReason failureReason;
-        RefPtr<ApplicationCache> oldNewestCache = (m_newestCache == m_cacheBeingUpdated) ? 0 : m_newestCache;
+        RefPtr<ApplicationCache> oldNewestCache = (m_newestCache == m_cacheBeingUpdated) ? RefPtr<ApplicationCache>() : m_newestCache;
         setNewestCache(m_cacheBeingUpdated.release());
         if (cacheStorage().storeNewestCache(this, oldNewestCache.get(), failureReason)) {
             // New cache stored, now remove the old cache.
diff --git a/Source/WebCore/loader/appcache/ApplicationCacheHost.h b/Source/WebCore/loader/appcache/ApplicationCacheHost.h
index a1f2841..56a5f57 100644
--- a/Source/WebCore/loader/appcache/ApplicationCacheHost.h
+++ b/Source/WebCore/loader/appcache/ApplicationCacheHost.h
@@ -156,6 +156,11 @@ namespace WebCore {
         CacheInfo applicationCacheInfo();
 #endif
 
+#if !PLATFORM(CHROMIUM)
+        bool shouldLoadResourceFromApplicationCache(const ResourceRequest&, ApplicationCacheResource*&);
+        bool getApplicationCacheFallbackResource(const ResourceRequest&, ApplicationCacheResource*&, ApplicationCache* = 0);
+#endif
+
     private:
         bool isApplicationCacheEnabled();
         DocumentLoader* documentLoader() const { return m_documentLoader; }
@@ -182,8 +187,6 @@ namespace WebCore {
         friend class ApplicationCacheStorage;
 
         bool scheduleLoadFallbackResourceFromApplicationCache(ResourceLoader*, ApplicationCache* = 0);
-        bool shouldLoadResourceFromApplicationCache(const ResourceRequest&, ApplicationCacheResource*&);
-        bool getApplicationCacheFallbackResource(const ResourceRequest&, ApplicationCacheResource*&, ApplicationCache* = 0);
         void setCandidateApplicationCacheGroup(ApplicationCacheGroup* group);
         ApplicationCacheGroup* candidateApplicationCacheGroup() const { return m_candidateApplicationCacheGroup; }
         void setApplicationCache(PassRefPtr<ApplicationCache> applicationCache);
diff --git a/Source/WebCore/loader/appcache/ApplicationCacheResource.cpp b/Source/WebCore/loader/appcache/ApplicationCacheResource.cpp
index 03c5c83..c0df573 100644
--- a/Source/WebCore/loader/appcache/ApplicationCacheResource.cpp
+++ b/Source/WebCore/loader/appcache/ApplicationCacheResource.cpp
@@ -31,11 +31,12 @@
 
 namespace WebCore {
 
-ApplicationCacheResource::ApplicationCacheResource(const KURL& url, const ResourceResponse& response, unsigned type, PassRefPtr<SharedBuffer> data)
+ApplicationCacheResource::ApplicationCacheResource(const KURL& url, const ResourceResponse& response, unsigned type, PassRefPtr<SharedBuffer> data, const String& path)
     : SubstituteResource(url, response, data)
     , m_type(type)
     , m_storageID(0)
     , m_estimatedSizeInStorage(0)
+    , m_path(path)
 {
 }
 
diff --git a/Source/WebCore/loader/appcache/ApplicationCacheResource.h b/Source/WebCore/loader/appcache/ApplicationCacheResource.h
index 2ca7846..6633c6c 100644
--- a/Source/WebCore/loader/appcache/ApplicationCacheResource.h
+++ b/Source/WebCore/loader/appcache/ApplicationCacheResource.h
@@ -42,10 +42,10 @@ public:
         Fallback = 1 << 4
     };
         
-    static PassRefPtr<ApplicationCacheResource> create(const KURL& url, const ResourceResponse& response, unsigned type, PassRefPtr<SharedBuffer> buffer = SharedBuffer::create())
+    static PassRefPtr<ApplicationCacheResource> create(const KURL& url, const ResourceResponse& response, unsigned type, PassRefPtr<SharedBuffer> buffer = SharedBuffer::create(), const String& path = String())
     {
         ASSERT(!url.hasFragmentIdentifier());
-        return adoptRef(new ApplicationCacheResource(url, response, type, buffer));
+        return adoptRef(new ApplicationCacheResource(url, response, type, buffer, path));
     }
 
     unsigned type() const { return m_type; }
@@ -56,16 +56,20 @@ public:
     void clearStorageID() { m_storageID = 0; }
     int64_t estimatedSizeInStorage();
 
+    const String& path() const { return m_path; }
+    void setPath(const String& path) { m_path = path; }
+
 #ifndef NDEBUG
     static void dumpType(unsigned type);
 #endif
     
 private:
-    ApplicationCacheResource(const KURL& url, const ResourceResponse& response, unsigned type, PassRefPtr<SharedBuffer> buffer);
+    ApplicationCacheResource(const KURL&, const ResourceResponse&, unsigned type, PassRefPtr<SharedBuffer>, const String& path);
 
     unsigned m_type;
     unsigned m_storageID;
     int64_t m_estimatedSizeInStorage;
+    String m_path;
 };
     
 } // namespace WebCore
diff --git a/Source/WebCore/loader/appcache/ApplicationCacheStorage.cpp b/Source/WebCore/loader/appcache/ApplicationCacheStorage.cpp
index 5c6937e..a126f8a 100644
--- a/Source/WebCore/loader/appcache/ApplicationCacheStorage.cpp
+++ b/Source/WebCore/loader/appcache/ApplicationCacheStorage.cpp
@@ -38,6 +38,7 @@
 #include "SQLiteStatement.h"
 #include "SQLiteTransaction.h"
 #include "SecurityOrigin.h"
+#include "UUID.h"
 #include <wtf/text/CString.h>
 #include <wtf/StdLibExtras.h>
 #include <wtf/StringExtras.h>
@@ -46,6 +47,8 @@ using namespace std;
 
 namespace WebCore {
 
+static const char flatFileSubdirectory[] = "ApplicationCache";
+
 template <class T>
 class StorageIDJournal {
 public:  
@@ -90,7 +93,7 @@ static unsigned urlHostHash(const KURL& url)
     unsigned hostStart = url.hostStart();
     unsigned hostEnd = url.hostEnd();
     
-    return AlreadyHashed::avoidDeletedValue(WTF::StringHasher::createHash(url.string().characters() + hostStart, hostEnd - hostStart));
+    return AlreadyHashed::avoidDeletedValue(StringHasher::computeHash(url.string().characters() + hostStart, hostEnd - hostStart));
 }
 
 ApplicationCacheGroup* ApplicationCacheStorage::loadCacheGroup(const KURL& manifestURL)
@@ -153,6 +156,11 @@ ApplicationCacheGroup* ApplicationCacheStorage::findOrCreateCacheGroup(const KUR
     return group;
 }
 
+ApplicationCacheGroup* ApplicationCacheStorage::findInMemoryCacheGroup(const KURL& manifestURL) const
+{
+    return m_cachesInMemory.get(manifestURL);
+}
+
 void ApplicationCacheStorage::loadManifestHostHashes()
 {
     static bool hasLoadedHashes = false;
@@ -389,7 +397,7 @@ int64_t ApplicationCacheStorage::spaceNeeded(int64_t cacheToSave)
     if (!getFileSize(m_cacheFile, fileSize))
         return 0;
 
-    int64_t currentSize = fileSize;
+    int64_t currentSize = fileSize + flatFileAreaSize();
 
     // Determine the amount of free space we have available.
     int64_t totalAvailableSize = 0;
@@ -555,7 +563,7 @@ bool ApplicationCacheStorage::executeSQLCommand(const String& sql)
 // Update the schemaVersion when the schema of any the Application Cache
 // SQLite tables changes. This allows the database to be rebuilt when
 // a new, incompatible change has been introduced to the database schema.
-static const int schemaVersion = 6;
+static const int schemaVersion = 7;
     
 void ApplicationCacheStorage::verifySchemaVersion()
 {
@@ -563,7 +571,7 @@ void ApplicationCacheStorage::verifySchemaVersion()
     if (version == schemaVersion)
         return;
 
-    m_database.clearAllTables();
+    deleteTables();
 
     // Update user version.
     SQLiteTransaction setDatabaseVersion(m_database);
@@ -613,7 +621,8 @@ void ApplicationCacheStorage::openDatabase(bool createIfDoesNotExist)
     executeSQLCommand("CREATE TABLE IF NOT EXISTS CacheEntries (cache INTEGER NOT NULL ON CONFLICT FAIL, type INTEGER, resource INTEGER NOT NULL)");
     executeSQLCommand("CREATE TABLE IF NOT EXISTS CacheResources (id INTEGER PRIMARY KEY AUTOINCREMENT, url TEXT NOT NULL ON CONFLICT FAIL, "
                       "statusCode INTEGER NOT NULL, responseURL TEXT NOT NULL, mimeType TEXT, textEncodingName TEXT, headers TEXT, data INTEGER NOT NULL ON CONFLICT FAIL)");
-    executeSQLCommand("CREATE TABLE IF NOT EXISTS CacheResourceData (id INTEGER PRIMARY KEY AUTOINCREMENT, data BLOB)");
+    executeSQLCommand("CREATE TABLE IF NOT EXISTS CacheResourceData (id INTEGER PRIMARY KEY AUTOINCREMENT, data BLOB, path TEXT)");
+    executeSQLCommand("CREATE TABLE IF NOT EXISTS DeletedCacheResources (id INTEGER PRIMARY KEY AUTOINCREMENT, path TEXT)");
     executeSQLCommand("CREATE TABLE IF NOT EXISTS Origins (origin TEXT UNIQUE ON CONFLICT IGNORE, quota INTEGER NOT NULL ON CONFLICT FAIL)");
 
     // When a cache is deleted, all its entries and its whitelist should be deleted.
@@ -636,6 +645,15 @@ void ApplicationCacheStorage::openDatabase(bool createIfDoesNotExist)
                       " FOR EACH ROW BEGIN"
                       "  DELETE FROM CacheResourceData WHERE id = OLD.data;"
                       " END");
+    
+    // When a cache resource is deleted, if it contains a non-empty path, that path should
+    // be added to the DeletedCacheResources table so the flat file at that path can
+    // be deleted at a later time.
+    executeSQLCommand("CREATE TRIGGER IF NOT EXISTS CacheResourceDataDeleted AFTER DELETE ON CacheResourceData"
+                      " FOR EACH ROW"
+                      " WHEN OLD.path NOT NULL BEGIN"
+                      "  INSERT INTO DeletedCacheResources (path) values (OLD.path);"
+                      " END");
 }
 
 bool ApplicationCacheStorage::executeStatement(SQLiteStatement& statement)
@@ -767,15 +785,43 @@ bool ApplicationCacheStorage::store(ApplicationCacheResource* resource, unsigned
         return false;
 
     // First, insert the data
-    SQLiteStatement dataStatement(m_database, "INSERT INTO CacheResourceData (data) VALUES (?)");
+    SQLiteStatement dataStatement(m_database, "INSERT INTO CacheResourceData (data, path) VALUES (?, ?)");
     if (dataStatement.prepare() != SQLResultOk)
         return false;
     
-    if (resource->data()->size())
-        dataStatement.bindBlob(1, resource->data()->data(), resource->data()->size());
+
+    String fullPath;
+    if (!resource->path().isEmpty())
+        dataStatement.bindText(2, pathGetFileName(resource->path()));
+    else if (shouldStoreResourceAsFlatFile(resource)) {
+        // First, check to see if creating the flat file would violate the maximum total quota. We don't need
+        // to check the per-origin quota here, as it was already checked in storeNewestCache().
+        if (m_database.totalSize() + flatFileAreaSize() + resource->data()->size() > m_maximumSize) {
+            m_isMaximumSizeReached = true;
+            return false;
+        }
+        
+        String flatFileDirectory = pathByAppendingComponent(m_cacheDirectory, flatFileSubdirectory);
+        makeAllDirectories(flatFileDirectory);
+        String path;
+        if (!writeDataToUniqueFileInDirectory(resource->data(), flatFileDirectory, path))
+            return false;
+        
+        fullPath = pathByAppendingComponent(flatFileDirectory, path);
+        resource->setPath(fullPath);
+        dataStatement.bindText(2, path);
+    } else {
+        if (resource->data()->size())
+            dataStatement.bindBlob(1, resource->data()->data(), resource->data()->size());
+    }
     
-    if (!dataStatement.executeCommand())
+    if (!dataStatement.executeCommand()) {
+        // Clean up the file which we may have written to:
+        if (!fullPath.isEmpty())
+            deleteFile(fullPath);
+
         return false;
+    }
 
     unsigned dataId = static_cast<unsigned>(m_database.lastInsertRowID());
 
@@ -826,6 +872,12 @@ bool ApplicationCacheStorage::store(ApplicationCacheResource* resource, unsigned
     if (!executeStatement(entryStatement))
         return false;
     
+    // Did we successfully write the resource data to a file? If so,
+    // release the resource's data and free up a potentially large amount
+    // of memory:
+    if (!fullPath.isEmpty())
+        resource->data()->clear();
+
     resource->setStorageID(resourceId);
     return true;
 }
@@ -856,7 +908,7 @@ bool ApplicationCacheStorage::store(ApplicationCacheResource* resource, Applicat
         return false;
  
     m_isMaximumSizeReached = false;
-    m_database.setMaximumSize(m_maximumSize);
+    m_database.setMaximumSize(m_maximumSize - flatFileAreaSize());
 
     SQLiteTransaction storeResourceTransaction(m_database);
     storeResourceTransaction.begin();
@@ -903,7 +955,7 @@ bool ApplicationCacheStorage::storeNewestCache(ApplicationCacheGroup* group, App
         return false;
 
     m_isMaximumSizeReached = false;
-    m_database.setMaximumSize(m_maximumSize);
+    m_database.setMaximumSize(m_maximumSize - flatFileAreaSize());
 
     SQLiteTransaction storeCacheTransaction(m_database);
     
@@ -1003,7 +1055,7 @@ static inline void parseHeaders(const String& headers, ResourceResponse& respons
 PassRefPtr<ApplicationCache> ApplicationCacheStorage::loadCache(unsigned storageID)
 {
     SQLiteStatement cacheStatement(m_database, 
-                                   "SELECT url, type, mimeType, textEncodingName, headers, CacheResourceData.data FROM CacheEntries INNER JOIN CacheResources ON CacheEntries.resource=CacheResources.id "
+                                   "SELECT url, type, mimeType, textEncodingName, headers, CacheResourceData.data, CacheResourceData.path FROM CacheEntries INNER JOIN CacheResources ON CacheEntries.resource=CacheResources.id "
                                    "INNER JOIN CacheResourceData ON CacheResourceData.id=CacheResources.data WHERE CacheEntries.cache=?");
     if (cacheStatement.prepare() != SQLResultOk) {
         LOG_ERROR("Could not prepare cache statement, error \"%s\"", m_database.lastErrorMsg());
@@ -1013,7 +1065,9 @@ PassRefPtr<ApplicationCache> ApplicationCacheStorage::loadCache(unsigned storage
     cacheStatement.bindInt64(1, storageID);
 
     RefPtr<ApplicationCache> cache = ApplicationCache::create();
-    
+
+    String flatFileDirectory = pathByAppendingComponent(m_cacheDirectory, flatFileSubdirectory);
+
     int result;
     while ((result = cacheStatement.step()) == SQLResultRow) {
         KURL url(ParsedURLString, cacheStatement.getColumnText(0));
@@ -1025,15 +1079,24 @@ PassRefPtr<ApplicationCache> ApplicationCacheStorage::loadCache(unsigned storage
         
         RefPtr<SharedBuffer> data = SharedBuffer::adoptVector(blob);
         
+        String path = cacheStatement.getColumnText(6);
+        long long size = 0;
+        if (path.isEmpty())
+            size = data->size();
+        else {
+            path = pathByAppendingComponent(flatFileDirectory, path);
+            getFileSize(path, size);
+        }
+        
         String mimeType = cacheStatement.getColumnText(2);
         String textEncodingName = cacheStatement.getColumnText(3);
         
-        ResourceResponse response(url, mimeType, data->size(), textEncodingName, "");
+        ResourceResponse response(url, mimeType, size, textEncodingName, "");
 
         String headers = cacheStatement.getColumnText(4);
         parseHeaders(headers, response);
         
-        RefPtr<ApplicationCacheResource> resource = ApplicationCacheResource::create(url, response, type, data.release());
+        RefPtr<ApplicationCacheResource> resource = ApplicationCacheResource::create(url, response, type, data.release(), path);
 
         if (type & ApplicationCacheResource::Manifest)
             cache->setManifestResource(resource.release());
@@ -1127,6 +1190,8 @@ void ApplicationCacheStorage::remove(ApplicationCache* cache)
 
         cache->group()->clearStorageID();
     }
+    
+    checkForDeletedResources();
 }    
 
 void ApplicationCacheStorage::empty()
@@ -1147,7 +1212,51 @@ void ApplicationCacheStorage::empty()
     CacheGroupMap::const_iterator end = m_cachesInMemory.end();
     for (CacheGroupMap::const_iterator it = m_cachesInMemory.begin(); it != end; ++it)
         it->second->clearStorageID();
-}    
+    
+    checkForDeletedResources();
+}
+    
+void ApplicationCacheStorage::deleteTables()
+{
+    empty();
+    m_database.clearAllTables();
+}
+    
+bool ApplicationCacheStorage::shouldStoreResourceAsFlatFile(ApplicationCacheResource* resource)
+{
+    return resource->response().mimeType().startsWith("audio/", false) 
+        || resource->response().mimeType().startsWith("video/", false);
+}
+    
+bool ApplicationCacheStorage::writeDataToUniqueFileInDirectory(SharedBuffer* data, const String& directory, String& path)
+{
+    String fullPath;
+    
+    do {
+        path = encodeForFileName(createCanonicalUUIDString());
+        // Guard against the above function being called on a platform which does not implement
+        // createCanonicalUUIDString().
+        ASSERT(!path.isEmpty());
+        if (path.isEmpty())
+            return false;
+        
+        fullPath = pathByAppendingComponent(directory, path);
+    } while (directoryName(fullPath) != directory || fileExists(fullPath));
+    
+    PlatformFileHandle handle = openFile(fullPath, OpenForWrite);
+    if (!handle)
+        return false;
+    
+    int64_t writtenBytes = writeToFile(handle, data->data(), data->size());
+    closeFile(handle);
+    
+    if (writtenBytes != static_cast<int64_t>(data->size())) {
+        deleteFile(fullPath);
+        return false;
+    }
+    
+    return true;
+}
 
 bool ApplicationCacheStorage::storeCopyOfCache(const String& cacheDirectory, ApplicationCacheHost* cacheHost)
 {
@@ -1166,7 +1275,7 @@ bool ApplicationCacheStorage::storeCopyOfCache(const String& cacheDirectory, App
     for (ApplicationCache::ResourceMap::const_iterator it = cache->begin(); it != end; ++it) {
         ApplicationCacheResource* resource = it->second.get();
         
-        RefPtr<ApplicationCacheResource> resourceCopy = ApplicationCacheResource::create(resource->url(), resource->response(), resource->type(), resource->data());
+        RefPtr<ApplicationCacheResource> resourceCopy = ApplicationCacheResource::create(resource->url(), resource->response(), resource->type(), resource->data(), resource->path());
         
         cacheCopy->addResource(resourceCopy.release());
     }
@@ -1274,6 +1383,9 @@ bool ApplicationCacheStorage::deleteCacheGroup(const String& manifestURL)
     }
 
     deleteTransaction.commit();
+    
+    checkForDeletedResources();
+    
     return true;
 }
 
@@ -1291,25 +1403,73 @@ void ApplicationCacheStorage::checkForMaxSizeReached()
     if (m_database.lastError() == SQLResultFull)
         m_isMaximumSizeReached = true;
 }
-
-void ApplicationCacheStorage::getOriginsWithCache(HashSet<RefPtr<SecurityOrigin>, SecurityOriginHash>& origins)
+    
+void ApplicationCacheStorage::checkForDeletedResources()
 {
-    Vector<KURL> urls;
-    if (!manifestURLs(&urls)) {
-        LOG_ERROR("Failed to retrieve ApplicationCache manifest URLs");
+    openDatabase(false);
+    if (!m_database.isOpen())
         return;
+
+    // Select only the paths in DeletedCacheResources that do not also appear in CacheResourceData:
+    SQLiteStatement selectPaths(m_database, "SELECT DeletedCacheResources.path "
+        "FROM DeletedCacheResources "
+        "LEFT JOIN CacheResourceData "
+        "ON DeletedCacheResources.path = CacheResourceData.path "
+        "WHERE (SELECT DeletedCacheResources.path == CacheResourceData.path) IS NULL");
+    
+    if (selectPaths.prepare() != SQLResultOk)
+        return;
+    
+    if (selectPaths.step() != SQLResultRow)
+        return;
+    
+    do {
+        String path = selectPaths.getColumnText(0);
+        if (path.isEmpty())
+            continue;
+        
+        String flatFileDirectory = pathByAppendingComponent(m_cacheDirectory, flatFileSubdirectory);
+        String fullPath = pathByAppendingComponent(flatFileDirectory, path);
+        
+        // Don't exit the flatFileDirectory! This should only happen if the "path" entry contains a directory 
+        // component, but protect against it regardless.
+        if (directoryName(fullPath) != flatFileDirectory)
+            continue;
+        
+        deleteFile(fullPath);
+    } while (selectPaths.step() == SQLResultRow);
+    
+    executeSQLCommand("DELETE FROM DeletedCacheResources");
+}
+    
+long long ApplicationCacheStorage::flatFileAreaSize()
+{
+    openDatabase(false);
+    if (!m_database.isOpen())
+        return 0;
+    
+    SQLiteStatement selectPaths(m_database, "SELECT path FROM CacheResourceData WHERE path NOT NULL");
+
+    if (selectPaths.prepare() != SQLResultOk) {
+        LOG_ERROR("Could not load flat file cache resource data, error \"%s\"", m_database.lastErrorMsg());
+        return 0;
     }
 
-    // Multiple manifest URLs might share the same SecurityOrigin, so we might be creating extra, wasted origins here.
-    // The current schema doesn't allow for a more efficient way of building this list.
-    size_t count = urls.size();
-    for (size_t i = 0; i < count; ++i) {
-        RefPtr<SecurityOrigin> origin = SecurityOrigin::create(urls[i]);
-        origins.add(origin);
+    long long totalSize = 0;
+    String flatFileDirectory = pathByAppendingComponent(m_cacheDirectory, flatFileSubdirectory);
+    while (selectPaths.step() == SQLResultRow) {
+        String path = selectPaths.getColumnText(0);
+        String fullPath = pathByAppendingComponent(flatFileDirectory, path);
+        long long pathSize = 0;
+        if (!getFileSize(fullPath, pathSize))
+            continue;
+        totalSize += pathSize;
     }
+    
+    return totalSize;
 }
 
-void ApplicationCacheStorage::deleteEntriesForOrigin(SecurityOrigin* origin)
+void ApplicationCacheStorage::getOriginsWithCache(HashSet<RefPtr<SecurityOrigin>, SecurityOriginHash>& origins)
 {
     Vector<KURL> urls;
     if (!manifestURLs(&urls)) {
@@ -1318,12 +1478,11 @@ void ApplicationCacheStorage::deleteEntriesForOrigin(SecurityOrigin* origin)
     }
 
     // Multiple manifest URLs might share the same SecurityOrigin, so we might be creating extra, wasted origins here.
-    // The current schema doesn't allow for a more efficient way of deleting by origin.
+    // The current schema doesn't allow for a more efficient way of building this list.
     size_t count = urls.size();
     for (size_t i = 0; i < count; ++i) {
-        RefPtr<SecurityOrigin> manifestOrigin = SecurityOrigin::create(urls[i]);
-        if (manifestOrigin->isSameSchemeHostPort(origin))
-            deleteCacheGroup(urls[i]);
+        RefPtr<SecurityOrigin> origin = SecurityOrigin::create(urls[i]);
+        origins.add(origin);
     }
 }
 
diff --git a/Source/WebCore/loader/appcache/ApplicationCacheStorage.h b/Source/WebCore/loader/appcache/ApplicationCacheStorage.h
index f283670..3136b52 100644
--- a/Source/WebCore/loader/appcache/ApplicationCacheStorage.h
+++ b/Source/WebCore/loader/appcache/ApplicationCacheStorage.h
@@ -74,6 +74,7 @@ public:
     ApplicationCacheGroup* fallbackCacheGroupForURL(const KURL&); // Cache that has a fallback entry to load a main resource from if normal loading fails.
 
     ApplicationCacheGroup* findOrCreateCacheGroup(const KURL& manifestURL);
+    ApplicationCacheGroup* findInMemoryCacheGroup(const KURL& manifestURL) const;
     void cacheGroupDestroyed(ApplicationCacheGroup*);
     void cacheGroupMadeObsolete(ApplicationCacheGroup*);
         
@@ -95,7 +96,6 @@ public:
     void vacuumDatabaseFile();
 
     void getOriginsWithCache(HashSet<RefPtr<SecurityOrigin>, SecurityOriginHash>&);
-    void deleteEntriesForOrigin(SecurityOrigin*);
     void deleteAllEntries();
 
     static int64_t unknownQuota() { return -1; }
@@ -113,6 +113,9 @@ private:
     bool store(ApplicationCacheResource*, unsigned cacheStorageID);
 
     bool ensureOriginRecord(const SecurityOrigin*);
+    bool shouldStoreResourceAsFlatFile(ApplicationCacheResource*);
+    void deleteTables();
+    bool writeDataToUniqueFileInDirectory(SharedBuffer*, const String& directory, String& outFilename);
 
     void loadManifestHostHashes();
     
@@ -124,6 +127,8 @@ private:
     bool executeSQLCommand(const String&);
 
     void checkForMaxSizeReached();
+    void checkForDeletedResources();
+    long long flatFileAreaSize();
     
     String m_cacheDirectory;
     String m_cacheFile;
diff --git a/Source/WebCore/loader/archive/cf/LegacyWebArchive.cpp b/Source/WebCore/loader/archive/cf/LegacyWebArchive.cpp
index 7979423..6e0a1eb 100644
--- a/Source/WebCore/loader/archive/cf/LegacyWebArchive.cpp
+++ b/Source/WebCore/loader/archive/cf/LegacyWebArchive.cpp
@@ -546,9 +546,9 @@ PassRefPtr<LegacyWebArchive> LegacyWebArchive::create(const String& markupString
 
     // Add favicon if one exists for this page, if we are archiving the entire page.
     if (nodesSize && nodes[0]->isDocumentNode() && iconDatabase().isEnabled()) {
-        const String& iconURL = iconDatabase().iconURLForPageURL(responseURL);
-        if (!iconURL.isEmpty() && iconDatabase().iconDataKnownForIconURL(iconURL)) {
-            if (Image* iconImage = iconDatabase().iconForPageURL(responseURL, IntSize(16, 16))) {
+        const String& iconURL = iconDatabase().synchronousIconURLForPageURL(responseURL);
+        if (!iconURL.isEmpty() && iconDatabase().synchronousIconDataKnownForIconURL(iconURL)) {
+            if (Image* iconImage = iconDatabase().synchronousIconForPageURL(responseURL, IntSize(16, 16))) {
                 if (RefPtr<ArchiveResource> resource = ArchiveResource::create(iconImage->data(), KURL(ParsedURLString, iconURL), "image/x-icon", "", ""))
                     subresources.append(resource.release());
             }
diff --git a/Source/WebCore/loader/cache/CachedFont.cpp b/Source/WebCore/loader/cache/CachedFont.cpp
index 19eb3ba..ea2ee14 100644
--- a/Source/WebCore/loader/cache/CachedFont.cpp
+++ b/Source/WebCore/loader/cache/CachedFont.cpp
@@ -117,7 +117,7 @@ bool CachedFont::ensureCustomFontData()
     return m_fontData;
 }
 
-FontPlatformData CachedFont::platformDataFromCustomData(float size, bool bold, bool italic, FontOrientation orientation, FontWidthVariant widthVariant, FontRenderingMode renderingMode)
+FontPlatformData CachedFont::platformDataFromCustomData(float size, bool bold, bool italic, FontOrientation orientation, TextOrientation textOrientation, FontWidthVariant widthVariant, FontRenderingMode renderingMode)
 {
 #if ENABLE(SVG_FONTS)
     if (m_externalSVGDocument)
@@ -125,7 +125,7 @@ FontPlatformData CachedFont::platformDataFromCustomData(float size, bool bold, b
 #endif
 #ifdef STORE_FONT_CUSTOM_PLATFORM_DATA
     ASSERT(m_fontData);
-    return m_fontData->fontPlatformData(static_cast<int>(size), bold, italic, orientation, widthVariant, renderingMode);
+    return m_fontData->fontPlatformData(static_cast<int>(size), bold, italic, orientation, textOrientation, widthVariant, renderingMode);
 #else
     return FontPlatformData();
 #endif
diff --git a/Source/WebCore/loader/cache/CachedFont.h b/Source/WebCore/loader/cache/CachedFont.h
index cdc32ba..d677f7b 100644
--- a/Source/WebCore/loader/cache/CachedFont.h
+++ b/Source/WebCore/loader/cache/CachedFont.h
@@ -30,6 +30,7 @@
 #include "FontOrientation.h"
 #include "FontRenderingMode.h"
 #include "FontWidthVariant.h"
+#include "TextOrientation.h"
 #include <wtf/Vector.h>
 
 #if ENABLE(SVG_FONTS)
@@ -64,7 +65,7 @@ public:
     void beginLoadIfNeeded(CachedResourceLoader* dl);
 
     bool ensureCustomFontData();
-    FontPlatformData platformDataFromCustomData(float size, bool bold, bool italic, FontOrientation = Horizontal, FontWidthVariant = RegularWidth, FontRenderingMode = NormalRenderingMode);
+    FontPlatformData platformDataFromCustomData(float size, bool bold, bool italic, FontOrientation = Horizontal, TextOrientation = TextOrientationVerticalRight, FontWidthVariant = RegularWidth, FontRenderingMode = NormalRenderingMode);
 
 #if ENABLE(SVG_FONTS)
     bool isSVGFont() const { return m_isSVGFont; }
diff --git a/Source/WebCore/loader/cache/CachedImage.cpp b/Source/WebCore/loader/cache/CachedImage.cpp
index b309ae6..cc49415 100644
--- a/Source/WebCore/loader/cache/CachedImage.cpp
+++ b/Source/WebCore/loader/cache/CachedImage.cpp
@@ -325,16 +325,6 @@ void CachedImage::error(CachedResource::Status status)
     checkNotify();
 }
 
-void CachedImage::checkNotify()
-{
-    if (isLoading())
-        return;
-
-    CachedResourceClientWalker w(m_clients);
-    while (CachedResourceClient* c = w.next())
-        c->notifyFinished(this);
-}
-
 void CachedImage::destroyDecodedData()
 {
     bool canDeleteImage = !m_image || (m_image->hasOneRef() && m_image->isBitmapImage());
diff --git a/Source/WebCore/loader/cache/CachedImage.h b/Source/WebCore/loader/cache/CachedImage.h
index 3242409..42c7814 100644
--- a/Source/WebCore/loader/cache/CachedImage.h
+++ b/Source/WebCore/loader/cache/CachedImage.h
@@ -71,8 +71,6 @@ public:
     // For compatibility, images keep loading even if there are HTTP errors.
     virtual bool shouldIgnoreHTTPStatusCodeErrors() const { return true; }
 
-    void checkNotify();
-    
     virtual bool isImage() const { return true; }
 
     void clear();
diff --git a/Source/WebCore/loader/cache/CachedResource.cpp b/Source/WebCore/loader/cache/CachedResource.cpp
index 0f9ff45..9413472 100644
--- a/Source/WebCore/loader/cache/CachedResource.cpp
+++ b/Source/WebCore/loader/cache/CachedResource.cpp
@@ -93,8 +93,8 @@ CachedResource::CachedResource(const String& url, Type type)
     , m_loading(false)
     , m_type(type)
     , m_status(Pending)
-    , m_deleted(false)
 #ifndef NDEBUG
+    , m_deleted(false)
     , m_lruIndex(0)
 #endif
     , m_nextInAllResourcesList(0)
@@ -118,13 +118,8 @@ CachedResource::~CachedResource()
     ASSERT(!m_deleted);
     ASSERT(url().isNull() || memoryCache()->resourceForURL(KURL(ParsedURLString, url())) != this);
     
-    if (m_deleted) {
-        // FIXME: Remove when http://webkit.org/b/53045 is fixed.
-        CRASH();
-    }
-    
-    m_deleted = true;
 #ifndef NDEBUG
+    m_deleted = true;
     cachedResourceLeakCounter.decrement();
 #endif
 
@@ -139,15 +134,33 @@ void CachedResource::load(CachedResourceLoader* cachedResourceLoader, bool incre
     m_loading = true;
 }
 
+void CachedResource::checkNotify()
+{
+    if (isLoading())
+        return;
+
+    CachedResourceClientWalker w(m_clients);
+    while (CachedResourceClient* c = w.next())
+        c->notifyFinished(this);
+}
+
 void CachedResource::data(PassRefPtr<SharedBuffer>, bool allDataReceived)
 {
     if (!allDataReceived)
         return;
     
     setLoading(false);
-    CachedResourceClientWalker w(m_clients);
-    while (CachedResourceClient* c = w.next())
-        c->notifyFinished(this);
+    checkNotify();
+}
+
+void CachedResource::error(CachedResource::Status status)
+{
+    setStatus(status);
+    ASSERT(errorOccurred());
+    m_data.clear();
+
+    setLoading(false);
+    checkNotify();
 }
 
 void CachedResource::finish()
diff --git a/Source/WebCore/loader/cache/CachedResource.h b/Source/WebCore/loader/cache/CachedResource.h
index 3379f8c..16920a5 100644
--- a/Source/WebCore/loader/cache/CachedResource.h
+++ b/Source/WebCore/loader/cache/CachedResource.h
@@ -86,7 +86,7 @@ public:
     virtual void setEncoding(const String&) { }
     virtual String encoding() const { return String(); }
     virtual void data(PassRefPtr<SharedBuffer> data, bool allDataReceived);
-    virtual void error(CachedResource::Status) { }
+    virtual void error(CachedResource::Status);
 
     virtual bool shouldIgnoreHTTPStatusCodeErrors() const { return false; }
 
@@ -217,6 +217,8 @@ public:
     void updateResponseAfterRevalidation(const ResourceResponse& validatingResponse);
 
 protected:
+    void checkNotify();
+
     void setEncodedSize(unsigned);
     void setDecodedSize(unsigned);
     void didAccessDecodedData(double timeStamp);
@@ -266,9 +268,8 @@ private:
     unsigned m_type : 3; // Type
     unsigned m_status : 3; // Status
 
-    // FIXME: Move m_deleted back inside NDEBUG when http://webkit.org/b/53045 is fixed.
-    bool m_deleted;
 #ifndef NDEBUG
+    bool m_deleted;
     unsigned m_lruIndex;
 #endif
 
diff --git a/Source/WebCore/loader/cache/CachedResourceLoader.cpp b/Source/WebCore/loader/cache/CachedResourceLoader.cpp
index 56715c6..3b6a0b2 100644
--- a/Source/WebCore/loader/cache/CachedResourceLoader.cpp
+++ b/Source/WebCore/loader/cache/CachedResourceLoader.cpp
@@ -34,6 +34,7 @@
 #include "CachedScript.h"
 #include "CachedXSLStyleSheet.h"
 #include "Console.h"
+#include "ContentSecurityPolicy.h"
 #include "DOMWindow.h"
 #include "Document.h"
 #include "Frame.h"
@@ -41,7 +42,6 @@
 #include "FrameLoaderClient.h"
 #include "HTMLElement.h"
 #include "Logging.h"
-#include "NestingLevelIncrementer.h"
 #include "MemoryCache.h"
 #include "PingLoader.h"
 #include "ResourceLoadScheduler.h"
@@ -85,21 +85,18 @@ CachedResourceLoader::CachedResourceLoader(Document* document)
     , m_autoLoadImages(true)
     , m_loadFinishing(false)
     , m_allowStaleResources(false)
+<<<<<<< HEAD
 #ifdef ANDROID_BLOCK_NETWORK_IMAGE
     , m_blockNetworkImage(false)
 #endif
     , m_isInMethod(0)
+=======
+>>>>>>> webkit.org at r82507
 {
 }
 
 CachedResourceLoader::~CachedResourceLoader()
 {
-    // Try to catch https://bugs.webkit.org/show_bug.cgi?id=54486
-    // Crashes under CachedResourceLoader::revalidateResource
-    // FIXME: Remove this and the related code when it has served its purpose.
-    if (m_isInMethod)
-        CRASH();
-
     m_document = 0;
 
     cancelRequests();
@@ -131,7 +128,6 @@ Frame* CachedResourceLoader::frame() const
 
 CachedImage* CachedResourceLoader::requestImage(const String& url)
 {
-    NestingLevelIncrementer debugIncrementer(m_isInMethod);
     if (Frame* f = frame()) {
         Settings* settings = f->settings();
         if (!f->loader()->client()->allowImages(!settings || settings->areImagesEnabled()))
@@ -169,7 +165,6 @@ CachedCSSStyleSheet* CachedResourceLoader::requestCSSStyleSheet(const String& ur
 
 CachedCSSStyleSheet* CachedResourceLoader::requestUserCSSStyleSheet(const String& requestURL, const String& charset)
 {
-    NestingLevelIncrementer debugIncrementer(m_isInMethod);
     KURL url = MemoryCache::removeFragmentIdentifierIfNeeded(KURL(KURL(), requestURL));
 
     if (CachedResource* existing = memoryCache()->resourceForURL(url)) {
@@ -235,9 +230,6 @@ bool CachedResourceLoader::canRequest(CachedResource::Type type, const KURL& url
         }
         break;
 #endif
-    default:
-        ASSERT_NOT_REACHED();
-        break;
     }
 
     // Given that the load is allowed by the same-origin policy, we should
@@ -271,17 +263,17 @@ bool CachedResourceLoader::canRequest(CachedResource::Type type, const KURL& url
         // Prefetch cannot affect the current document.
         break;
 #endif
-    default:
-        ASSERT_NOT_REACHED();
-        break;
     }
     // FIXME: Consider letting the embedder block mixed content loads.
+
+    if (type == CachedResource::Script && !m_document->contentSecurityPolicy()->allowScriptFromSource(url))
+        return false;
+
     return true;
 }
 
 CachedResource* CachedResourceLoader::requestResource(CachedResource::Type type, const String& resourceURL, const String& charset, ResourceLoadPriority priority, bool forPreload)
 {
-    NestingLevelIncrementer debugIncrementer(m_isInMethod);
     KURL url = m_document->completeURL(resourceURL);
     
     LOG(ResourceLoading, "CachedResourceLoader::requestResource '%s', charset '%s', priority=%d, forPreload=%u", url.string().latin1().data(), charset.latin1().data(), priority, forPreload);
@@ -348,7 +340,8 @@ CachedResource* CachedResourceLoader::revalidateResource(CachedResource* resourc
     ASSERT(resource->canUseCacheValidator());
     ASSERT(!resource->resourceToRevalidate());
     
-    const String& url = resource->url();
+    // Copy the URL out of the resource to be revalidated in case it gets deleted by the remove() call below.
+    String url = resource->url();
     CachedResource* newResource = createResource(resource->type(), KURL(ParsedURLString, url), resource->encoding());
     
     LOG(ResourceLoading, "Resource %p created to revalidate %p", newResource, resource);
@@ -489,7 +482,6 @@ void CachedResourceLoader::printAccessDeniedMessage(const KURL& url) const
 
 void CachedResourceLoader::setAutoLoadImages(bool enable)
 {
-    NestingLevelIncrementer debugIncrementer(m_isInMethod);
     if (enable == m_autoLoadImages)
         return;
 
@@ -566,7 +558,6 @@ void CachedResourceLoader::removeCachedResource(CachedResource* resource) const
 
 void CachedResourceLoader::load(CachedResource* resource, bool incremental, SecurityCheckPolicy securityCheck, bool sendResourceLoadCallbacks)
 {
-    NestingLevelIncrementer debugIncrementer(m_isInMethod);
     incrementRequestCount(resource);
 
     RefPtr<CachedResourceRequest> request = CachedResourceRequest::load(this, resource, incremental, securityCheck, sendResourceLoadCallbacks);
@@ -576,7 +567,6 @@ void CachedResourceLoader::load(CachedResource* resource, bool incremental, Secu
 
 void CachedResourceLoader::loadDone(CachedResourceRequest* request)
 {
-    NestingLevelIncrementer debugIncrementer(m_isInMethod);
     m_loadFinishing = false;
     RefPtr<CachedResourceRequest> protect(request);
     if (request)
@@ -653,7 +643,6 @@ int CachedResourceLoader::requestCount()
     
 void CachedResourceLoader::preload(CachedResource::Type type, const String& url, const String& charset, bool referencedFromBody)
 {
-    NestingLevelIncrementer debugIncrementer(m_isInMethod);
     bool hasRendering = m_document->body() && m_document->body()->renderer();
     if (!hasRendering && (referencedFromBody || type == CachedResource::ImageResource)) {
         // Don't preload images or body resources before we have something to draw. This prevents
@@ -680,7 +669,6 @@ void CachedResourceLoader::checkForPendingPreloads()
 
 void CachedResourceLoader::requestPreload(CachedResource::Type type, const String& url, const String& charset)
 {
-    NestingLevelIncrementer debugIncrementer(m_isInMethod);
     String encoding;
     if (type == CachedResource::Script || type == CachedResource::CSSStyleSheet)
         encoding = charset.isEmpty() ? m_document->charset() : charset;
diff --git a/Source/WebCore/loader/cache/CachedResourceLoader.h b/Source/WebCore/loader/cache/CachedResourceLoader.h
index 0302010..a68ebd3 100644
--- a/Source/WebCore/loader/cache/CachedResourceLoader.h
+++ b/Source/WebCore/loader/cache/CachedResourceLoader.h
@@ -153,12 +153,15 @@ private:
     bool m_autoLoadImages : 1;
     bool m_loadFinishing : 1;
     bool m_allowStaleResources : 1;
+<<<<<<< HEAD
 #ifdef ANDROID_BLOCK_NETWORK_IMAGE
     bool m_blockNetworkImage : 1;
 #endif
     
     // FIME: For debugging, remove.
     unsigned m_isInMethod;
+=======
+>>>>>>> webkit.org at r82507
 };
 
 }
diff --git a/Source/WebCore/loader/cache/CachedScript.cpp b/Source/WebCore/loader/cache/CachedScript.cpp
index bfd39c5..e1a8a32 100644
--- a/Source/WebCore/loader/cache/CachedScript.cpp
+++ b/Source/WebCore/loader/cache/CachedScript.cpp
@@ -88,6 +88,8 @@ const String& CachedScript::script()
         m_script += m_decoder->flush();
         setDecodedSize(m_script.length() * sizeof(UChar));
     }
+    m_decodedDataDeletionTimer.startOneShot(0);
+    
     return m_script;
 }
 
@@ -102,16 +104,6 @@ void CachedScript::data(PassRefPtr<SharedBuffer> data, bool allDataReceived)
     checkNotify();
 }
 
-void CachedScript::checkNotify()
-{
-    if (isLoading())
-        return;
-
-    CachedResourceClientWalker w(m_clients);
-    while (CachedResourceClient* c = w.next())
-        c->notifyFinished(this);
-}
-
 void CachedScript::error(CachedResource::Status status)
 {
     setStatus(status);
@@ -125,7 +117,7 @@ void CachedScript::destroyDecodedData()
     m_script = String();
     unsigned extraSize = 0;
 #if USE(JSC)
-    if (m_sourceProviderCache)
+    if (m_sourceProviderCache && m_clients.isEmpty())
         m_sourceProviderCache->clear();
 
     extraSize = m_sourceProviderCache ? m_sourceProviderCache->byteSize() : 0;
diff --git a/Source/WebCore/loader/cache/CachedScript.h b/Source/WebCore/loader/cache/CachedScript.h
index 85c3805..a4ea453 100644
--- a/Source/WebCore/loader/cache/CachedScript.h
+++ b/Source/WebCore/loader/cache/CachedScript.h
@@ -55,8 +55,6 @@ namespace WebCore {
         virtual void data(PassRefPtr<SharedBuffer> data, bool allDataReceived);
         virtual void error(Status);
 
-        void checkNotify();
-
         virtual void destroyDecodedData();
 #if USE(JSC)        
         // Allows JSC to cache additional information about the source.
diff --git a/Source/WebCore/loader/cf/SubresourceLoaderCF.cpp b/Source/WebCore/loader/cf/SubresourceLoaderCF.cpp
new file mode 100644
index 0000000..f6ce93f
--- /dev/null
+++ b/Source/WebCore/loader/cf/SubresourceLoaderCF.cpp
@@ -0,0 +1,53 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "SubresourceLoader.h"
+
+#include "SubresourceLoaderClient.h"
+
+namespace WebCore {
+
+#if HAVE(CFNETWORK_DATA_ARRAY_CALLBACK)
+void SubresourceLoader::didReceiveDataArray(CFArrayRef dataArray)
+{
+    // Reference the object in this method since the additional processing can do
+    // anything including removing the last reference to this object; one example of this is 3266216.
+    RefPtr<SubresourceLoader> protect(this);
+
+    ResourceLoader::didReceiveDataArray(dataArray);
+
+    // A subresource loader does not load multipart sections progressively.
+    // So don't deliver any data to the loader yet.
+    if (!m_loadingMultipartContent && m_client) {
+        CFIndex arrayCount = CFArrayGetCount(dataArray);
+        for (CFIndex i = 0; i < arrayCount; ++i)  {
+            CFDataRef data = reinterpret_cast<CFDataRef>(CFArrayGetValueAtIndex(dataArray, i));
+            m_client->didReceiveData(this, reinterpret_cast<const char *>(CFDataGetBytePtr(data)), static_cast<int>(CFDataGetLength(data)));
+        }
+    }
+}
+#endif
+
+}
diff --git a/Source/WebCore/loader/icon/IconDatabase.cpp b/Source/WebCore/loader/icon/IconDatabase.cpp
index 26f3bb7..e5578e0 100644
--- a/Source/WebCore/loader/icon/IconDatabase.cpp
+++ b/Source/WebCore/loader/icon/IconDatabase.cpp
@@ -58,7 +58,6 @@
 
 namespace WebCore {
 
-static IconDatabase* sharedIconDatabase = 0;
 static int databaseCleanupCounter = 0;
 
 // This version number is in the DB and marks the current generation of the schema
@@ -85,21 +84,22 @@ static String urlForLogging(const String& url)
 }
 #endif
 
+class DefaultIconDatabaseClient : public IconDatabaseClient {
+public:
+    virtual bool performImport() { return true; }
+    virtual void didImportIconURLForPageURL(const String&) { } 
+    virtual void didImportIconDataForPageURL(const String&) { }
+    virtual void didChangeIconForPageURL(const String&) { }
+    virtual void didRemoveAllIcons() { }
+    virtual void didFinishURLImport() { }
+};
+
 static IconDatabaseClient* defaultClient() 
 {
-    static IconDatabaseClient* defaultClient = new IconDatabaseClient();
+    static IconDatabaseClient* defaultClient = new DefaultIconDatabaseClient();
     return defaultClient;
 }
 
-IconDatabase& iconDatabase()
-{
-    if (!sharedIconDatabase) {
-        ScriptController::initializeThreading();
-        sharedIconDatabase = new IconDatabase;
-    }
-    return *sharedIconDatabase;
-}
-
 // ************************
 // *** Main Thread Only ***
 // ************************
@@ -117,7 +117,7 @@ void IconDatabase::setClient(IconDatabaseClient* client)
     m_client = client;
 }
 
-bool IconDatabase::open(const String& databasePath)
+bool IconDatabase::open(const String& directory, const String& filename)
 {
     ASSERT_NOT_SYNC_THREAD();
 
@@ -129,10 +129,10 @@ bool IconDatabase::open(const String& databasePath)
         return false;
     }
 
-    m_databaseDirectory = databasePath.crossThreadString();
+    m_databaseDirectory = directory.crossThreadString();
 
     // Formulate the full path for the database file
-    m_completeDatabasePath = pathByAppendingComponent(m_databaseDirectory, defaultDatabaseFilename());
+    m_completeDatabasePath = pathByAppendingComponent(m_databaseDirectory, filename);
 
     // Lock here as well as first thing in the thread so the thread doesn't actually commence until the createThread() call 
     // completes and m_syncThreadRunning is properly set
@@ -217,7 +217,7 @@ void IconDatabase::removeAllIcons()
     wakeSyncThread();
 }
 
-Image* IconDatabase::iconForPageURL(const String& pageURLOriginal, const IntSize& size)
+Image* IconDatabase::synchronousIconForPageURL(const String& pageURLOriginal, const IntSize& size)
 {   
     ASSERT_NOT_SYNC_THREAD();
 
@@ -301,10 +301,10 @@ void IconDatabase::readIconForPageURLFromDisk(const String& pageURL)
     // The effect of asking for an Icon for a pageURL automatically queues it to be read from disk
     // if it hasn't already been set in memory.  The special IntSize (0, 0) is a special way of telling 
     // that method "I don't care about the actual Image, i just want you to make sure you're getting it from disk.
-    iconForPageURL(pageURL, IntSize(0,0));
+    synchronousIconForPageURL(pageURL, IntSize(0, 0));
 }
 
-String IconDatabase::iconURLForPageURL(const String& pageURLOriginal)
+String IconDatabase::synchronousIconURLForPageURL(const String& pageURLOriginal)
 {    
     ASSERT_NOT_SYNC_THREAD(); 
         
@@ -565,7 +565,7 @@ void IconDatabase::setIconDataForIconURL(PassRefPtr<SharedBuffer> dataOriginal,
 
         for (unsigned i = 0; i < pageURLs.size(); ++i) {
             LOG(IconDatabase, "Dispatching notification that retaining pageURL %s has a new icon", urlForLogging(pageURLs[i]).ascii().data());
-            m_client->dispatchDidAddIconForPageURL(pageURLs[i]);
+            m_client->didChangeIconForPageURL(pageURLs[i]);
 
             pool.cycle();
         }
@@ -637,11 +637,11 @@ void IconDatabase::setIconURLForPageURL(const String& iconURLOriginal, const Str
         
         LOG(IconDatabase, "Dispatching notification that we changed an icon mapping for url %s", urlForLogging(pageURL).ascii().data());
         AutodrainedPool pool;
-        m_client->dispatchDidAddIconForPageURL(pageURL);
+        m_client->didChangeIconForPageURL(pageURL);
     }
 }
 
-IconLoadDecision IconDatabase::loadDecisionForIconURL(const String& iconURL, DocumentLoader* notificationDocumentLoader)
+IconLoadDecision IconDatabase::synchronousLoadDecisionForIconURL(const String& iconURL, DocumentLoader* notificationDocumentLoader)
 {
     ASSERT_NOT_SYNC_THREAD();
 
@@ -667,12 +667,13 @@ IconLoadDecision IconDatabase::loadDecisionForIconURL(const String& iconURL, Doc
     // Otherwise - since we refuse to perform I/O on the main thread to find out for sure - we return the answer that says
     // "You might be asked to load this later, so flag that"
     LOG(IconDatabase, "Don't know if we should load %s or not - adding %p to the set of document loaders waiting on a decision", iconURL.ascii().data(), notificationDocumentLoader);
-    m_loadersPendingDecision.add(notificationDocumentLoader);    
+    if (notificationDocumentLoader)
+        m_loadersPendingDecision.add(notificationDocumentLoader);    
 
     return IconLoadUnknown;
 }
 
-bool IconDatabase::iconDataKnownForIconURL(const String& iconURL)
+bool IconDatabase::synchronousIconDataKnownForIconURL(const String& iconURL)
 {
     ASSERT_NOT_SYNC_THREAD();
     
@@ -775,6 +776,7 @@ IconDatabase::IconDatabase()
     , m_imported(false)
     , m_isImportedSet(false)
 {
+    LOG(IconDatabase, "Creating IconDatabase %p", this);
     ASSERT(isMainThread());
 }
 
@@ -1257,7 +1259,7 @@ void IconDatabase::performURLImport()
         {
             MutexLocker locker(m_pendingReadingLock);
             if (m_pageURLsPendingImport.contains(pageURL)) {
-                m_client->dispatchDidAddIconForPageURL(pageURL);
+                dispatchDidImportIconURLForPageURLOnMainThread(pageURL);
                 m_pageURLsPendingImport.remove(pageURL);
             
                 pool.cycle();
@@ -1292,7 +1294,6 @@ void IconDatabase::performURLImport()
     // Loop through the urls pending import
     // Remove unretained ones if database cleanup is allowed
     // Keep a set of ones that are retained and pending notification
-    
     {
         MutexLocker locker(m_urlAndIconLock);
         
@@ -1331,13 +1332,16 @@ void IconDatabase::performURLImport()
     // Now that we don't hold any locks, perform the actual notifications
     for (unsigned i = 0; i < urlsToNotify.size(); ++i) {
         LOG(IconDatabase, "Notifying icon info known for pageURL %s", urlsToNotify[i].ascii().data());
-        m_client->dispatchDidAddIconForPageURL(urlsToNotify[i]);
+        dispatchDidImportIconURLForPageURLOnMainThread(urlsToNotify[i]);
         if (shouldStopThreadActivity())
             return;
 
         pool.cycle();
     }
     
+    // Notify the client that the URL import is complete in case it's managing its own pending notifications.
+    dispatchDidFinishURLImportOnMainThread();
+    
     // Notify all DocumentLoaders that were waiting for an icon load decision on the main thread
     callOnMainThread(notifyPendingLoadDecisionsOnMainThread, this);
 }
@@ -1540,7 +1544,7 @@ bool IconDatabase::readFromDatabase()
         HashSet<String>::iterator end = urlsToNotify.end();
         for (unsigned iteration = 0; iter != end; ++iter, ++iteration) {
             LOG(IconDatabase, "Notifying icon received for pageURL %s", urlForLogging(*iter).ascii().data());
-            m_client->dispatchDidAddIconForPageURL(*iter);
+            dispatchDidImportIconDataForPageURLOnMainThread(*iter);
             if (shouldStopThreadActivity())
                 return didAnyWork;
             
@@ -1738,7 +1742,7 @@ void IconDatabase::removeAllIconsOnThread()
     createDatabaseTables(m_syncDB);
     
     LOG(IconDatabase, "Dispatching notification that we removed all icons");
-    m_client->dispatchDidRemoveAllIcons();    
+    dispatchDidRemoveAllIconsOnMainThread();    
 }
 
 void IconDatabase::deleteAllPreparedStatements()
@@ -2111,6 +2115,132 @@ void IconDatabase::setWasExcludedFromBackup()
     SQLiteStatement(m_syncDB, "INSERT INTO IconDatabaseInfo (key, value) VALUES ('ExcludedFromBackup', 1)").executeCommand();
 }
 
+class ClientWorkItem {
+public:
+    ClientWorkItem(IconDatabaseClient* client)
+        : m_client(client)
+    { }
+    virtual void performWork() = 0;
+    virtual ~ClientWorkItem() { }
+
+protected:
+    IconDatabaseClient* m_client;
+};
+
+class ImportedIconURLForPageURLWorkItem : public ClientWorkItem {
+public:
+    ImportedIconURLForPageURLWorkItem(IconDatabaseClient* client, const String& pageURL)
+        : ClientWorkItem(client)
+        , m_pageURL(new String(pageURL.threadsafeCopy()))
+    { }
+    
+    virtual ~ImportedIconURLForPageURLWorkItem()
+    {
+        delete m_pageURL;
+    }
+
+    virtual void performWork()
+    {
+        ASSERT(m_client);
+        m_client->didImportIconURLForPageURL(*m_pageURL);
+        m_client = 0;
+    }
+    
+private:
+    String* m_pageURL;
+};
+
+class ImportedIconDataForPageURLWorkItem : public ClientWorkItem {
+public:
+    ImportedIconDataForPageURLWorkItem(IconDatabaseClient* client, const String& pageURL)
+        : ClientWorkItem(client)
+        , m_pageURL(new String(pageURL.threadsafeCopy()))
+    { }
+    
+    virtual ~ImportedIconDataForPageURLWorkItem()
+    {
+        delete m_pageURL;
+    }
+
+    virtual void performWork()
+    {
+        ASSERT(m_client);
+        m_client->didImportIconDataForPageURL(*m_pageURL);
+        m_client = 0;
+    }
+    
+private:
+    String* m_pageURL;
+};
+
+class RemovedAllIconsWorkItem : public ClientWorkItem {
+public:
+    RemovedAllIconsWorkItem(IconDatabaseClient* client)
+        : ClientWorkItem(client)
+    { }
+
+    virtual void performWork()
+    {
+        ASSERT(m_client);
+        m_client->didRemoveAllIcons();
+        m_client = 0;
+    }
+};
+
+class FinishedURLImport : public ClientWorkItem {
+public:
+    FinishedURLImport(IconDatabaseClient* client)
+        : ClientWorkItem(client)
+    { }
+
+    virtual void performWork()
+    {
+        ASSERT(m_client);
+        m_client->didFinishURLImport();
+        m_client = 0;
+    }
+};
+
+static void performWorkItem(void* context)
+{
+    ClientWorkItem* item = static_cast<ClientWorkItem*>(context);
+    item->performWork();
+    delete item;
+}
+
+void IconDatabase::dispatchDidImportIconURLForPageURLOnMainThread(const String& pageURL)
+{
+    ASSERT_ICON_SYNC_THREAD();
+
+    ImportedIconURLForPageURLWorkItem* work = new ImportedIconURLForPageURLWorkItem(m_client, pageURL);
+    callOnMainThread(performWorkItem, work);
+}
+
+void IconDatabase::dispatchDidImportIconDataForPageURLOnMainThread(const String& pageURL)
+{
+    ASSERT_ICON_SYNC_THREAD();
+
+    ImportedIconDataForPageURLWorkItem* work = new ImportedIconDataForPageURLWorkItem(m_client, pageURL);
+    callOnMainThread(performWorkItem, work);
+}
+
+void IconDatabase::dispatchDidRemoveAllIconsOnMainThread()
+{
+    ASSERT_ICON_SYNC_THREAD();
+
+    RemovedAllIconsWorkItem* work = new RemovedAllIconsWorkItem(m_client);
+    callOnMainThread(performWorkItem, work);
+}
+
+void IconDatabase::dispatchDidFinishURLImportOnMainThread()
+{
+    ASSERT_ICON_SYNC_THREAD();
+
+    FinishedURLImport* work = new FinishedURLImport(m_client);
+    callOnMainThread(performWorkItem, work);
+}
+
+
 } // namespace WebCore
 
 #endif // ENABLE(ICONDATABASE)
diff --git a/Source/WebCore/loader/icon/IconDatabase.h b/Source/WebCore/loader/icon/IconDatabase.h
index 8617430..7392245 100644
--- a/Source/WebCore/loader/icon/IconDatabase.h
+++ b/Source/WebCore/loader/icon/IconDatabase.h
@@ -27,17 +27,20 @@
 #ifndef IconDatabase_h
 #define IconDatabase_h
 
+#include "IconDatabaseBase.h"
 #include "Timer.h"
 #include <wtf/HashMap.h>
 #include <wtf/HashSet.h>
 #include <wtf/Noncopyable.h>
 #include <wtf/OwnPtr.h>
+#include <wtf/PassOwnPtr.h>
 #include <wtf/text/StringHash.h>
+#include <wtf/text/WTFString.h>
 
 #if ENABLE(ICONDATABASE)
 #include "SQLiteDatabase.h"
 #include <wtf/Threading.h>
-#endif
+#endif // ENABLE(ICONDATABASE)
 
 namespace WebCore { 
 
@@ -56,41 +59,48 @@ class SharedBuffer;
 class SQLTransaction;
 #endif
 
-enum IconLoadDecision {
-    IconLoadYes,
-    IconLoadNo,
-    IconLoadUnknown
+#if !ENABLE(ICONDATABASE)
+// For builds with IconDatabase disabled, they'll just use a default derivation of IconDatabaseBase. Which does nothing.
+class IconDatabase : public IconDatabaseBase {
+public:
+    static void delayDatabaseCleanup() { }
+    static String defaultDatabaseFilename() { return "WebpageIcons.db"; }
 };
+#else 
 
-class IconDatabase {
-    WTF_MAKE_NONCOPYABLE(IconDatabase); WTF_MAKE_FAST_ALLOCATED;
+class IconDatabase : public IconDatabaseBase {
+    WTF_MAKE_FAST_ALLOCATED;
+    
 // *** Main Thread Only ***
 public:
-    void setClient(IconDatabaseClient*);
+    static PassOwnPtr<IconDatabase> create() { return new IconDatabase; }
+    ~IconDatabase();
+
+    virtual void setClient(IconDatabaseClient*);
 
-    bool open(const String& path);
-    void close();
+    virtual bool open(const String& directory, const String& filename);
+    virtual void close();
             
-    void removeAllIcons();
+    virtual void removeAllIcons();
 
-    Image* iconForPageURL(const String&, const IntSize&);
     void readIconForPageURLFromDisk(const String&);
-    String iconURLForPageURL(const String&);
-    Image* defaultIcon(const IntSize&);
 
-    void retainIconForPageURL(const String&);
-    void releaseIconForPageURL(const String&);
+    virtual Image* defaultIcon(const IntSize&);
 
-    void setIconDataForIconURL(PassRefPtr<SharedBuffer> data, const String&);
-    void setIconURLForPageURL(const String& iconURL, const String& pageURL);
+    virtual void retainIconForPageURL(const String&);
+    virtual void releaseIconForPageURL(const String&);
+    virtual void setIconDataForIconURL(PassRefPtr<SharedBuffer> data, const String&);
+    virtual void setIconURLForPageURL(const String& iconURL, const String& pageURL);
 
-    IconLoadDecision loadDecisionForIconURL(const String&, DocumentLoader*);
-    bool iconDataKnownForIconURL(const String&);
+    virtual Image* synchronousIconForPageURL(const String&, const IntSize&);
+    virtual String synchronousIconURLForPageURL(const String&);
+    virtual bool synchronousIconDataKnownForIconURL(const String&);
+    virtual IconLoadDecision synchronousLoadDecisionForIconURL(const String&, DocumentLoader*);    
     
-    void setEnabled(bool enabled);
-    bool isEnabled() const;
+    virtual void setEnabled(bool);
+    virtual bool isEnabled() const;
     
-    void setPrivateBrowsingEnabled(bool flag);
+    virtual void setPrivateBrowsingEnabled(bool flag);
     bool isPrivateBrowsingEnabled() const;
     
     static void delayDatabaseCleanup();
@@ -98,17 +108,15 @@ public:
     static void checkIntegrityBeforeOpening();
         
     // Support for WebCoreStatistics in WebKit
-    size_t pageURLMappingCount();
-    size_t retainedPageURLCount();
-    size_t iconRecordCount();
-    size_t iconRecordCountWithData();
+    virtual size_t pageURLMappingCount();
+    virtual size_t retainedPageURLCount();
+    virtual size_t iconRecordCount();
+    virtual size_t iconRecordCountWithData();
 
 private:
     IconDatabase();
-    ~IconDatabase();
-    friend IconDatabase& iconDatabase();
+    friend IconDatabaseBase& iconDatabase();
 
-#if ENABLE(ICONDATABASE)
     static void notifyPendingLoadDecisionsOnMainThread(void*);
     void notifyPendingLoadDecisions();
 
@@ -123,15 +131,13 @@ private:
     HashSet<RefPtr<DocumentLoader> > m_loadersPendingDecision;
 
     RefPtr<IconRecord> m_defaultIconRecord;
-#endif // ENABLE(ICONDATABASE)
 
 // *** Any Thread ***
 public:
-    bool isOpen() const;
-    String databasePath() const;
+    virtual bool isOpen() const;
+    virtual String databasePath() const;
     static String defaultDatabaseFilename();
 
-#if ENABLE(ICONDATABASE)
 private:
     PassRefPtr<IconRecord> getOrCreateIconRecord(const String& iconURL);
     PageURLRecord* getOrCreatePageURLRecord(const String& pageURL);
@@ -166,17 +172,15 @@ private:
     HashSet<String> m_pageURLsPendingImport;
     HashSet<String> m_pageURLsInterestedInIcons;
     HashSet<IconRecord*> m_iconsPendingReading;
-#endif // ENABLE(ICONDATABASE)
 
 // *** Sync Thread Only ***
 public:
     // Should be used only on the sync thread and only by the Safari 2 Icons import procedure
-    void importIconURLForPageURL(const String& iconURL, const String& pageURL);
-    void importIconDataForIconURL(PassRefPtr<SharedBuffer> data, const String& iconURL);
+    virtual void importIconURLForPageURL(const String& iconURL, const String& pageURL);
+    virtual void importIconDataForIconURL(PassRefPtr<SharedBuffer> data, const String& iconURL);
     
-    bool shouldStopThreadActivity() const;
+    virtual bool shouldStopThreadActivity() const;
 
-#if ENABLE(ICONDATABASE)
 private:    
     static void* iconDatabaseSyncThreadStart(void *);
     void* iconDatabaseSyncThread();
@@ -213,6 +217,12 @@ private:
     void removeIconFromSQLDatabase(const String& iconURL);
     void writeIconSnapshotToSQLDatabase(const IconSnapshot&);    
     
+    // Methods to dispatch client callbacks on the main thread
+    void dispatchDidImportIconURLForPageURLOnMainThread(const String&);
+    void dispatchDidImportIconDataForPageURLOnMainThread(const String&);
+    void dispatchDidRemoveAllIconsOnMainThread();
+    void dispatchDidFinishURLImportOnMainThread();
+    
     // The client is set by the main thread before the thread starts, and from then on is only used by the sync thread
     IconDatabaseClient* m_client;
     
@@ -236,11 +246,9 @@ private:
     OwnPtr<SQLiteStatement> m_updateIconDataStatement;
     OwnPtr<SQLiteStatement> m_setIconInfoStatement;
     OwnPtr<SQLiteStatement> m_setIconDataStatement;
-#endif // ENABLE(ICONDATABASE)
 };
 
-// Function to obtain the global icon database.
-IconDatabase& iconDatabase();
+#endif // !ENABLE(ICONDATABASE)
 
 } // namespace WebCore
 
diff --git a/Source/WebCore/platform/mac/SSLKeyGeneratorMac.mm b/Source/WebCore/loader/icon/IconDatabaseBase.cpp
index dd76b59..f552412 100644
--- a/Source/WebCore/platform/mac/SSLKeyGeneratorMac.mm
+++ b/Source/WebCore/loader/icon/IconDatabaseBase.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2003, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -23,27 +23,47 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
-#import "config.h"
-#import "SSLKeyGenerator.h"
+#include "config.h"
+#include "IconDatabaseBase.h"
 
-#import "KURL.h"
-#import "WebCoreKeyGenerator.h"
+#include "IconDatabase.h"
+#include "SharedBuffer.h"
 
 namespace WebCore {
 
-void getSupportedKeySizes(Vector<String>& supportedKeySizes)
-{ 
-    NSEnumerator *enumerator = [[[WebCoreKeyGenerator sharedGenerator] strengthMenuItemTitles] objectEnumerator];
-    NSString *string;
-    while ((string = [enumerator nextObject]) != nil)
-        supportedKeySizes.append(string);
+String IconDatabaseBase::synchronousIconURLForPageURL(const String&)
+{
+    return String();
 }
 
-String signedPublicKeyAndChallengeString(unsigned keySizeIndex, const String& challengeString, const KURL& url)
-{   
-    return [[WebCoreKeyGenerator sharedGenerator] signedPublicKeyAndChallengeStringWithStrengthIndex:keySizeIndex 
-                                                                                           challenge:challengeString
-                                                                                             pageURL:url];
+String IconDatabaseBase::databasePath() const
+{
+    return String();
 }
 
+bool IconDatabaseBase::open(const String&, const String&)
+{
+    return false;
 }
+
+static IconDatabaseBase* globalDatabase = 0;
+
+// Functions to get/set the global icon database.
+IconDatabaseBase& iconDatabase()
+{
+    if (globalDatabase)
+        return *globalDatabase;
+
+    static IconDatabaseBase* defaultDatabase = 0;        
+    if (!defaultDatabase)
+        defaultDatabase = new IconDatabase;
+
+    return *defaultDatabase;
+}
+
+void setGlobalIconDatabase(IconDatabaseBase* newGlobalDatabase)
+{
+    globalDatabase = newGlobalDatabase;
+}
+
+} // namespace WebCore
diff --git a/Source/WebCore/loader/icon/IconDatabaseBase.h b/Source/WebCore/loader/icon/IconDatabaseBase.h
new file mode 100644
index 0000000..bc665ba
--- /dev/null
+++ b/Source/WebCore/loader/icon/IconDatabaseBase.h
@@ -0,0 +1,221 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+ 
+#ifndef IconDatabaseBase_h
+#define IconDatabaseBase_h
+
+#include "SharedBuffer.h"
+
+#include <wtf/Forward.h>
+#include <wtf/Noncopyable.h>
+#include <wtf/PassRefPtr.h>
+
+namespace WebCore { 
+
+class DocumentLoader;
+class IconDatabaseClient;
+class Image;
+class IntSize;
+
+enum IconLoadDecision {
+    IconLoadYes,
+    IconLoadNo,
+    IconLoadUnknown
+};
+
+class CallbackBase : public RefCounted<CallbackBase> {
+public:
+    virtual ~CallbackBase()
+    {
+    }
+
+    uint64_t callbackID() const { return m_callbackID; }
+
+protected:
+    CallbackBase(void* context)
+        : m_context(context)
+        , m_callbackID(generateCallbackID())
+    {
+    }
+
+    void* context() const { return m_context; }
+
+private:
+    static uint64_t generateCallbackID()
+    {
+        static uint64_t uniqueCallbackID = 1;
+        return uniqueCallbackID++;
+    }
+
+    void* m_context;
+    uint64_t m_callbackID;
+};
+
+template<typename EnumType> 
+class EnumCallback : public CallbackBase {
+public:
+    typedef void (*CallbackFunction)(EnumType, void*);
+
+    static PassRefPtr<EnumCallback> create(void* context, CallbackFunction callback)
+    {
+        return adoptRef(new EnumCallback(context, callback));
+    }
+
+    virtual ~EnumCallback()
+    {
+        ASSERT(!m_callback);
+    }
+
+    void performCallback(EnumType result)
+    {
+        if (!m_callback)
+            return;
+        m_callback(result, context());
+        m_callback = 0;
+    }
+    
+    void invalidate()
+    {
+        m_callback = 0;
+    }
+
+private:
+    EnumCallback(void* context, CallbackFunction callback)
+        : CallbackBase(context)
+        , m_callback(callback)
+    {
+        ASSERT(m_callback);
+    }
+
+    CallbackFunction m_callback;
+};
+
+template<typename ObjectType> 
+class ObjectCallback : public CallbackBase {
+public:
+    typedef void (*CallbackFunction)(ObjectType, void*);
+
+    static PassRefPtr<ObjectCallback> create(void* context, CallbackFunction callback)
+    {
+        return adoptRef(new ObjectCallback(context, callback));
+    }
+
+    virtual ~ObjectCallback()
+    {
+        ASSERT(!m_callback);
+    }
+
+    void performCallback(ObjectType result)
+    {
+        if (!m_callback)
+            return;
+        m_callback(result, context());
+        m_callback = 0;
+    }
+    
+    void invalidate()
+    {
+        m_callback = 0;
+    }
+
+private:
+    ObjectCallback(void* context, CallbackFunction callback)
+        : CallbackBase(context)
+        , m_callback(callback)
+    {
+        ASSERT(m_callback);
+    }
+
+    CallbackFunction m_callback;
+};
+
+typedef EnumCallback<IconLoadDecision> IconLoadDecisionCallback;
+typedef ObjectCallback<SharedBuffer*> IconDataCallback;
+
+class IconDatabaseBase {
+    WTF_MAKE_NONCOPYABLE(IconDatabaseBase);
+
+protected:
+    IconDatabaseBase() { }
+
+public:
+    virtual ~IconDatabaseBase() { }
+
+    // Used internally by WebCore
+    virtual bool isEnabled() const { return false; }
+        
+    virtual void retainIconForPageURL(const String&) { }
+    virtual void releaseIconForPageURL(const String&) { }
+
+    virtual void setIconURLForPageURL(const String&, const String&) { }
+    virtual void setIconDataForIconURL(PassRefPtr<SharedBuffer>, const String&) { }
+
+    // Synchronous calls used internally by WebCore.
+    // Usage should be replaced by asynchronous calls.
+    virtual String synchronousIconURLForPageURL(const String&);
+    virtual bool synchronousIconDataKnownForIconURL(const String&) { return false; }
+    virtual IconLoadDecision synchronousLoadDecisionForIconURL(const String&, DocumentLoader*) { return IconLoadNo; }
+    virtual Image* synchronousIconForPageURL(const String&, const IntSize&) { return 0; }
+    
+    // Asynchronous calls we should use to replace the above when supported.
+    virtual bool supportsAsynchronousMode() { return false; }
+    virtual void loadDecisionForIconURL(const String&, PassRefPtr<IconLoadDecisionCallback>) { }
+    virtual void iconDataForIconURL(const String&, PassRefPtr<IconDataCallback>) { }
+    
+
+    // Used within one or more WebKit ports.
+    // We should try to remove these dependencies from the IconDatabaseBase class.
+    virtual void setEnabled(bool) { }
+
+    virtual Image* defaultIcon(const IntSize&) { return 0; }
+
+    virtual size_t pageURLMappingCount() { return 0; }
+    virtual size_t retainedPageURLCount() { return 0; }
+    virtual size_t iconRecordCount() { return 0; }
+    virtual size_t iconRecordCountWithData() { return 0; }
+
+    virtual void importIconURLForPageURL(const String&, const String&) { }
+    virtual void importIconDataForIconURL(PassRefPtr<SharedBuffer>, const String&) { }
+    virtual bool shouldStopThreadActivity() const { return true; }
+
+    virtual bool open(const String& directory, const String& filename);
+    virtual void close() { }
+    virtual void removeAllIcons() { }
+
+    virtual void setPrivateBrowsingEnabled(bool) { }
+    virtual void setClient(IconDatabaseClient*) { }
+    
+    virtual bool isOpen() const { return false; }
+    virtual String databasePath() const;
+
+};
+
+// Functions to get/set the global icon database.
+IconDatabaseBase& iconDatabase();
+void setGlobalIconDatabase(IconDatabaseBase*);
+
+} // namespace WebCore
+
+#endif // IconDatabaseBase_h
diff --git a/Source/WebCore/loader/icon/IconDatabaseClient.h b/Source/WebCore/loader/icon/IconDatabaseClient.h
index f97a2a8..3d5f349 100644
--- a/Source/WebCore/loader/icon/IconDatabaseClient.h
+++ b/Source/WebCore/loader/icon/IconDatabaseClient.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007 Apple Inc. All rights reserved.
+ * Copyright (C) 2007, 2011 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -29,23 +29,20 @@
 #ifndef IconDatabaseClient_h
 #define IconDatabaseClient_h
 
-#include <wtf/FastAllocBase.h>
 #include <wtf/Forward.h>
-#include <wtf/Noncopyable.h>
-
-// All of these client methods will be called from a non-main thread
-// Take appropriate measures
  
 namespace WebCore {
 
 class IconDatabaseClient {
-    WTF_MAKE_NONCOPYABLE(IconDatabaseClient); WTF_MAKE_FAST_ALLOCATED;
 public:
-    IconDatabaseClient() { }
     virtual ~IconDatabaseClient() { }
-    virtual bool performImport() { return true; }
-    virtual void dispatchDidRemoveAllIcons() { }
-    virtual void dispatchDidAddIconForPageURL(const String& /*pageURL*/) { }
+
+    virtual bool performImport() = 0;
+    virtual void didImportIconURLForPageURL(const String&) = 0;
+    virtual void didImportIconDataForPageURL(const String&) = 0;
+    virtual void didChangeIconForPageURL(const String&) = 0;
+    virtual void didRemoveAllIcons() = 0;
+    virtual void didFinishURLImport() = 0;
 };
  
 } // namespace WebCore 
diff --git a/Source/WebCore/loader/icon/IconDatabaseNone.cpp b/Source/WebCore/loader/icon/IconDatabaseNone.cpp
deleted file mode 100644
index de28cdd..0000000
--- a/Source/WebCore/loader/icon/IconDatabaseNone.cpp
+++ /dev/null
@@ -1,218 +0,0 @@
-/*
- * Copyright (C) 2006 Apple Computer, Inc.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#include "config.h"
-#include "IconDatabase.h"
-
-#if !ENABLE(ICONDATABASE)
-
-#include "PlatformString.h"
-#include "SharedBuffer.h"
-#include <wtf/StdLibExtras.h>
-
-namespace WebCore {
-
-static IconDatabase* sharedIconDatabase = 0;
-
-// This version number is in the DB and marks the current generation of the schema
-// Theoretically once the switch is flipped this should never change
-// Currently, an out-of-date schema causes the DB to be wiped and reset.  This isn't 
-// so bad during development but in the future, we would need to write a conversion
-// function to advance older released schemas to "current"
-const int currentDatabaseVersion = 5;
-
-// Icons expire once a day
-const int iconExpirationTime = 60*60*24; 
-// Absent icons are rechecked once a week
-const int missingIconExpirationTime = 60*60*24*7; 
-
-const int updateTimerDelay = 5; 
-
-String IconDatabase::defaultDatabaseFilename()
-{
-    DEFINE_STATIC_LOCAL(String, defaultDatabaseFilename, ("Icons.db"));
-    return defaultDatabaseFilename.threadsafeCopy();
-}
-
-IconDatabase& iconDatabase()
-{
-    if (!sharedIconDatabase)
-        sharedIconDatabase = new IconDatabase;
-    return *sharedIconDatabase;
-}
-
-IconDatabase::IconDatabase()
-{
-}
-
-bool IconDatabase::open(const String& /*databasePath*/)
-{
-    return false;
-}
-
-bool IconDatabase::isOpen() const
-{
-    return false;
-}
-
-void IconDatabase::close()
-{
-}
-
-String IconDatabase::databasePath() const
-{
-    return String();
-}
-
-void IconDatabase::removeAllIcons()
-{
-}
-
-void IconDatabase::setPrivateBrowsingEnabled(bool /*flag*/)
-{
-}
-
-bool IconDatabase::isPrivateBrowsingEnabled() const
-{
-    return false;
-}
-
-void IconDatabase::readIconForPageURLFromDisk(const String&)
-{
-
-}
-
-Image* IconDatabase::iconForPageURL(const String& /*pageURL*/, const IntSize& size)
-{
-    return defaultIcon(size);
-}
-
-
-IconLoadDecision IconDatabase::loadDecisionForIconURL(const String&, DocumentLoader*)
-{
-    return IconLoadNo;
-}
-
-bool IconDatabase::iconDataKnownForIconURL(const String&)
-{
-    return false;
-}
-
-String IconDatabase::iconURLForPageURL(const String& /*pageURL*/)
-{
-    return String();
-}
-
-Image* IconDatabase::defaultIcon(const IntSize& /*size*/)
-{
-    return 0;
-}
-
-void IconDatabase::retainIconForPageURL(const String& /*pageURL*/)
-{
-}
-
-void IconDatabase::releaseIconForPageURL(const String& /*pageURL*/)
-{
-}
-
-void IconDatabase::setIconDataForIconURL(PassRefPtr<SharedBuffer> /*data*/, const String& /*iconURL*/)
-{
-}
-
-void IconDatabase::setIconURLForPageURL(const String& /*iconURL*/, const String& /*pageURL*/)
-{
-}
-
-void IconDatabase::setEnabled(bool /*enabled*/)
-{
-}
-
-bool IconDatabase::isEnabled() const
-{
-    return false;
-}
-
-IconDatabase::~IconDatabase()
-{
-    ASSERT_NOT_REACHED();
-}
-
-void IconDatabase::checkIntegrityBeforeOpening()
-{
-}
-
-void IconDatabase::delayDatabaseCleanup()
-{
-}
-
-void IconDatabase::allowDatabaseCleanup()
-{
-}
-
-size_t IconDatabase::pageURLMappingCount()
-{
-    return 0;
-}
-
-size_t IconDatabase::retainedPageURLCount()
-{
-    return 0;
-}
-
-size_t IconDatabase::iconRecordCount()
-{
-    return 0;
-}
-
-size_t IconDatabase::iconRecordCountWithData()
-{
-    return 0;
-}
-
-void IconDatabase::setClient(IconDatabaseClient*)
-{
-}
-
-// ************************
-// *** Sync Thread Only ***
-// ************************
-
-void IconDatabase::importIconURLForPageURL(const String&, const String&)
-{
-}
-
-void IconDatabase::importIconDataForIconURL(PassRefPtr<SharedBuffer>, const String&)
-{
-}
-
-bool IconDatabase::shouldStopThreadActivity() const
-{
-    return true;
-}
-
-} // namespace WebCore
-
-#endif // !ENABLE(ICONDATABASE)
diff --git a/Source/WebCore/loader/mac/ResourceLoaderMac.mm b/Source/WebCore/loader/mac/ResourceLoaderMac.mm
index 3835517..b42f8e0 100644
--- a/Source/WebCore/loader/mac/ResourceLoaderMac.mm
+++ b/Source/WebCore/loader/mac/ResourceLoaderMac.mm
@@ -35,6 +35,10 @@
 #include "FrameLoaderClient.h"
 #include "ResourceHandle.h"
 
+#if HAVE(CFNETWORK_DATA_ARRAY_CALLBACK)
+#include "InspectorInstrumentation.h"
+#endif
+
 namespace WebCore {
 
 NSCachedURLResponse* ResourceLoader::willCacheResponse(ResourceHandle*, NSCachedURLResponse* response)
@@ -44,6 +48,44 @@ NSCachedURLResponse* ResourceLoader::willCacheResponse(ResourceHandle*, NSCached
     return frameLoader()->client()->willCacheResponse(documentLoader(), identifier(), response);
 }
 
+#if HAVE(CFNETWORK_DATA_ARRAY_CALLBACK)
+
+void ResourceLoader::didReceiveDataArray(CFArrayRef dataArray)
+{
+    // Protect this in this delegate method since the additional processing can do
+    // anything including possibly derefing this; one example of this is Radar 3266216.
+    RefPtr<ResourceLoader> protector(this);
+
+    if (!m_shouldBufferData)
+        return;
+
+    if (!m_resourceData)
+        m_resourceData = SharedBuffer::create();
+
+    CFIndex arrayCount = CFArrayGetCount(dataArray);
+    for (CFIndex i = 0; i < arrayCount; ++i) {
+        CFDataRef data = static_cast<CFDataRef>(CFArrayGetValueAtIndex(dataArray, i));
+        int dataLen = static_cast<int>(CFDataGetLength(data));
+
+        m_resourceData->append(data);
+
+        // FIXME: If we get a resource with more than 2B bytes, this code won't do the right thing.
+        // However, with today's computers and networking speeds, this won't happen in practice.
+        // Could be an issue with a giant local file.
+        if (m_sendResourceLoadCallbacks && m_frame)
+            frameLoader()->notifier()->didReceiveData(this, reinterpret_cast<const char*>(CFDataGetBytePtr(data)), dataLen, dataLen);
+    }
+}
+
+void ResourceLoader::didReceiveDataArray(ResourceHandle*, CFArrayRef dataArray)
+{
+    InspectorInstrumentationCookie cookie = InspectorInstrumentation::willReceiveResourceData(m_frame.get(), identifier());
+    didReceiveDataArray(dataArray);
+    InspectorInstrumentation::didReceiveResourceData(cookie);
+}
+
+#endif
+
 }
 
 #endif // !USE(CFNETWORK)
diff --git a/Source/WebCore/manual-tests/autocorrection/close-window-when-correction-is-shown.html b/Source/WebCore/manual-tests/autocorrection/close-window-when-correction-is-shown.html
new file mode 100644
index 0000000..5c82a20
--- /dev/null
+++ b/Source/WebCore/manual-tests/autocorrection/close-window-when-correction-is-shown.html
@@ -0,0 +1,48 @@
+<html>
+<head>
+
+<style>
+.editing {
+    border: 2px solid red;
+    padding: 12px;
+    font-size: 24px;
+}
+</style>
+<script src=../../../../LayoutTests/editing/editing.js language="JavaScript" type="text/JavaScript" ></script>
+
+<script>
+function editingTest() {
+    typeCharacterCommand('t');
+    typeCharacterCommand('h');
+    typeCharacterCommand('e');
+    typeCharacterCommand(' ');
+    typeCharacterCommand('m');
+    typeCharacterCommand('e');
+    typeCharacterCommand('s');
+    typeCharacterCommand('a');
+    typeCharacterCommand('e');
+    typeCharacterCommand('g');
+    typeCharacterCommand('e');
+    typeCharacterCommand('e');
+    typeCharacterCommand(' ');
+    execMoveSelectionBackwardByCharacterCommand();
+}
+
+</script>
+
+<title>Testing closing window when correction suggestion is shown</title>
+</head>
+<body>
+<div><p>This test verifies that when correction suggestion is visible, closing window doesn't hang or crash.</p>
+<p>After seeing the panel with multiple candidates, close the window.</p>
+<div contenteditable id="root" class="editing">
+<span id="test"></span>
+</div>
+
+
+<script>
+runEditingTest();
+</script>
+
+</body>
+</html>
diff --git a/Source/WebCore/manual-tests/database-callback-deferred.html b/Source/WebCore/manual-tests/database-callback-deferred.html
deleted file mode 100644
index cf3d03a..0000000
--- a/Source/WebCore/manual-tests/database-callback-deferred.html
+++ /dev/null
@@ -1,17 +0,0 @@
-<html>
-<script>
-function test() {
-    function transactionCallback()
-    {
-        document.getElementById("result").innerHTML = "Callback was called. Test passed";
-    }
-    var db = openDatabase("DatabaseCallbackDeferred", "1.0", "", 1);
-    db.transaction(function(tx) { tx.executeSql("CREATE TABLE IF NOT EXISTS CallbackDeferredTest (randomData)", []); }, transactionCallback, transactionCallback);
-
-    alert("Wait for a few seconds and close it");
-}
-</script>
-<body onload="test()">
-<p id="result">Wait...</p>
-</body>
-</html>
diff --git a/Source/WebCore/manual-tests/input-number-localization.html b/Source/WebCore/manual-tests/input-number-localization.html
index 4647aa5..294022a 100644
--- a/Source/WebCore/manual-tests/input-number-localization.html
+++ b/Source/WebCore/manual-tests/input-number-localization.html
@@ -12,9 +12,9 @@
 <body>
 <div id="console"></div>
 
-<p>Output test: The following text field should have a localized representation for "-1234.56".
-e.g. "-1,234.56" for en_US locale, "-1.234,56" for fr_FR locale.</p>
-<div><input type=number value="-1234.56" step=any></div>
+<p>Output test: The following text field should have a localized representation for "-1234.5678".
+e.g. "-1,234.5678" for en_US locale, "-1.234,5678" for fr_FR locale.</p>
+<div><input type=number value="-1234.5678" step=any></div>
 
 <p>Input test: Type a localized representation of a number into the following text field.
 You'll see an equivalent number in the standard format on the bottom of the text field.</p>
diff --git a/Source/WebCore/manual-tests/media-default-playback-rate.html b/Source/WebCore/manual-tests/media-default-playback-rate.html
new file mode 100644
index 0000000..b980edc
--- /dev/null
+++ b/Source/WebCore/manual-tests/media-default-playback-rate.html
@@ -0,0 +1,90 @@
+
+<html>
+    <head>
+        <!-- LayoutTests location is hard-coded to avoid duplication of code. -->
+        <script src="http://svn.webkit.org/repository/webkit/trunk/LayoutTests/media/media-file.js"></script>
+        <script src="http://svn.webkit.org/repository/webkit/trunk/LayoutTests/media/video-test.js"></script>
+
+        <script>
+            var expectedRates = { "defaultPlaybackRate" : 1, "playbackRate" : 1};
+            var playingFromScript = false;
+            var changedRate = false;
+
+            function absoluteUrl(url)
+            {
+                var a = document.createElement('a');
+                a.href = url;
+                return a.href;
+            }
+
+            function testRates()
+            {
+                consoleWrite("");
+                var playWithControllerButton = !changedRate && !playingFromScript;
+                testExpected("video.playbackRate", playWithControllerButton ? expectedRates['defaultPlaybackRate'] : expectedRates['playbackRate']);
+                testExpected("video.defaultPlaybackRate", expectedRates['defaultPlaybackRate']);
+                changedRate = false;
+            }
+
+            function playing()
+            {
+                consoleWrite("<br>'playing' event");
+                expectedRates['playbackRate'] = playingFromScript ? video.playbackRate : video.defaultPlaybackRate;
+                testRates();
+                playingFromScript = false;
+            }
+
+            function ratechange()
+            {
+                consoleWrite("<br>'ratechange' event");
+                testRates();
+            }
+
+            function start()
+            {
+                findMediaElement();
+                video.addEventListener('ratechange', ratechange);
+                video.addEventListener('playing', playing);
+
+                // Use the video file from the svn repository to avoid duplicating the file.
+                video.src = absoluteUrl(findMediaFile('video', 'http://svn.webkit.org/repository/webkit/trunk/LayoutTests/media/content/test'));
+                testRates();
+            }
+
+            function play()
+            {
+                playingFromScript = true;
+                video.play();
+            }
+
+            function setRate(which, rate)
+            {
+                changedRate = true;
+                video[which] = rate;
+                expectedRates[which] = rate;
+            }
+
+        </script>
+    </head>
+
+    <body onload="start()">
+        
+        <video controls > </video>
+        <ul>
+            <li>The current 'playbackRate' and 'defaultPlaybackRate' should be logged every time either changes.</li>
+            <li>'playbackRate' should be set to 'defaultPlaybackRate' when the Play button in the built-in controls is pressed</li>
+            <li>'playbackRate' should NOT when play() is called from script.</li>
+        </ul>
+        <div>
+            <button id="controls" onclick="setRate('defaultPlaybackRate', 2)">defaultPlaybackRate = 2</button>
+            <button id="controls" onclick="setRate('defaultPlaybackRate', 1)">defaultPlaybackRate = 1</button>
+            <button id="controls" onclick="setRate('playbackRate', 2)">playbackRate = 2</button>
+            <button id="controls" onclick="setRate('playbackRate', 1)">playbackRate = 1</button>
+        </div>
+        <div>
+            <button id="controls" onclick="play()">play()</button>
+            <button id="controls" onclick="video.pause()">pause()</button>
+        </div>
+        <br>
+    </body>
+</html>
diff --git a/Source/WebCore/manual-tests/print-after-window-close.html b/Source/WebCore/manual-tests/print-after-window-close.html
new file mode 100644
index 0000000..f7467e1
--- /dev/null
+++ b/Source/WebCore/manual-tests/print-after-window-close.html
@@ -0,0 +1,8 @@
+<script>
+function crash() {
+    var w = window.open("data:text/html,foo");
+    w.print();
+    w.close();
+}
+</script>
+<button onclick="crash()">Crash</button>
diff --git a/Source/WebCore/manual-tests/selection-start-after-inserting-line-break-in-textarea.html b/Source/WebCore/manual-tests/selection-start-after-inserting-line-break-in-textarea.html
new file mode 100644
index 0000000..0203199
--- /dev/null
+++ b/Source/WebCore/manual-tests/selection-start-after-inserting-line-break-in-textarea.html
@@ -0,0 +1,25 @@
+<!DOCTYPE html>
+<html>
+<body>
+<p>This tests selectionStart is updated properly when inserting LF into textarea. To test, press Enter several times inside textarea and click the log button. This bug does not reproduce when new lines are added by execCommand or eventSender.</p>
+<textarea cols="20" rows="20"></textarea>
+<button id="button" onclick="verify()">verify</button>
+<div id="console"></div>
+<script>
+
+function verify() {
+    var console = document.getElementById('console');
+    if (textarea.value.match(/[^\n]/))
+        console.innerHTML = 'textarea contains unexpected character. You can only type LF in this test.';
+    else if (textarea.selectionStart != textarea.value.length)
+        console.innerHTML = 'FAIL: expected ' + textarea.value.length + ' but got ' + textarea.selectionStart;
+    else
+        console.innerHTML = 'PASS: ' + textarea.value.length + ' LFs';
+}
+
+var textarea = document.getElementsByTagName('textarea')[0];
+textarea.focus();
+
+</script>
+</body>
+</html>
diff --git a/Source/WebCore/page/Chrome.cpp b/Source/WebCore/page/Chrome.cpp
index 26ea33b..5881d5e 100644
--- a/Source/WebCore/page/Chrome.cpp
+++ b/Source/WebCore/page/Chrome.cpp
@@ -88,9 +88,9 @@ void Chrome::scroll(const IntSize& scrollDelta, const IntRect& rectToScroll, con
 }
 
 #if ENABLE(TILED_BACKING_STORE)
-void Chrome::delegatedScrollRequested(const IntSize& scrollDelta)
+void Chrome::delegatedScrollRequested(const IntPoint& scrollPoint)
 {
-    m_client->delegatedScrollRequested(scrollDelta);
+    m_client->delegatedScrollRequested(scrollPoint);
 }
 #endif
 
diff --git a/Source/WebCore/page/Chrome.h b/Source/WebCore/page/Chrome.h
index 4d16214..9984a7c 100644
--- a/Source/WebCore/page/Chrome.h
+++ b/Source/WebCore/page/Chrome.h
@@ -71,7 +71,7 @@ namespace WebCore {
         virtual void invalidateContentsForSlowScroll(const IntRect&, bool);
         virtual void scroll(const IntSize&, const IntRect&, const IntRect&);
 #if ENABLE(TILED_BACKING_STORE)
-        virtual void delegatedScrollRequested(const IntSize& scrollDelta);
+        virtual void delegatedScrollRequested(const IntPoint& scrollPoint);
 #endif
         virtual IntPoint screenToWindow(const IntPoint&) const;
         virtual IntRect windowToScreen(const IntRect&) const;
diff --git a/Source/WebCore/page/ChromeClient.h b/Source/WebCore/page/ChromeClient.h
index 7fcec2e..73fe904 100644
--- a/Source/WebCore/page/ChromeClient.h
+++ b/Source/WebCore/page/ChromeClient.h
@@ -49,6 +49,7 @@ namespace WebCore {
     class FloatRect;
     class Frame;
     class Geolocation;
+    class GraphicsLayer;
     class HitTestResult;
     class IntRect;
     class NavigationAction;
@@ -143,7 +144,7 @@ namespace WebCore {
         virtual void invalidateContentsForSlowScroll(const IntRect&, bool) = 0;
         virtual void scroll(const IntSize&, const IntRect&, const IntRect&) = 0;
 #if ENABLE(TILED_BACKING_STORE)
-        virtual void delegatedScrollRequested(const IntSize&) = 0;
+        virtual void delegatedScrollRequested(const IntPoint&) = 0;
 #endif
         virtual IntPoint screenToWindow(const IntPoint&) const = 0;
         virtual IntRect windowToScreen(const IntRect&) const = 0;
@@ -263,10 +264,11 @@ namespace WebCore {
         virtual bool requiresFullscreenForVideoPlayback() { return false; } 
 
 #if ENABLE(FULLSCREEN_API)
-        virtual bool supportsFullScreenForElement(const Element*) { return false; }
+        virtual bool supportsFullScreenForElement(const Element*, bool) { return false; }
         virtual void enterFullScreenForElement(Element*) { }
         virtual void exitFullScreenForElement(Element*) { }
         virtual void fullScreenRendererChanged(RenderBox*) { }
+        virtual void setRootFullScreenLayer(GraphicsLayer*) { }
 #endif
         
 #if ENABLE(TILED_BACKING_STORE)
diff --git a/Source/WebCore/page/ContentSecurityPolicy.cpp b/Source/WebCore/page/ContentSecurityPolicy.cpp
index 97cd447..6bcf99c 100644
--- a/Source/WebCore/page/ContentSecurityPolicy.cpp
+++ b/Source/WebCore/page/ContentSecurityPolicy.cpp
@@ -25,28 +25,390 @@
 
 #include "config.h"
 #include "ContentSecurityPolicy.h"
+
 #include "Document.h"
+#include "NotImplemented.h"
+#include "SecurityOrigin.h"
 
 namespace WebCore {
 
-class CSPDirective {
+// Normally WebKit uses "static" for internal linkage, but using "static" for
+// these functions causes a compile error because these functions are used as
+// template parameters.
+namespace {
+
+bool isDirectiveNameCharacter(UChar c)
+{
+    return isASCIIAlphanumeric(c) || c == '-';
+}
+
+bool isDirectiveValueCharacter(UChar c)
+{
+    return isASCIISpace(c) || (c >= 0x21 && c <= 0x7e); // Whitespace + VCHAR
+}
+
+bool isSourceCharacter(UChar c)
+{
+    return !isASCIISpace(c);
+}
+
+bool isHostCharacter(UChar c)
+{
+    return isASCIIAlphanumeric(c) || c == '-';
+}
+
+bool isSchemeContinuationCharacter(UChar c)
+{
+    return isASCIIAlphanumeric(c) || c == '+' || c == '-' || c == '.';
+}
+
+} // namespace
+
+static bool skipExactly(const UChar*& position, const UChar* end, UChar delimiter)
+{
+    if (position < end && *position == delimiter) {
+        ++position;
+        return true;
+    }
+    return false;
+}
+
+template<bool characterPredicate(UChar)>
+static bool skipExactly(const UChar*& position, const UChar* end)
+{
+    if (position < end && characterPredicate(*position)) {
+        ++position;
+        return true;
+    }
+    return false;
+}
+
+static void skipUtil(const UChar*& position, const UChar* end, UChar delimiter)
+{
+    while (position < end && *position != delimiter)
+        ++position;
+}
+
+template<bool characterPredicate(UChar)>
+static void skipWhile(const UChar*& position, const UChar* end)
+{
+    while (position < end && characterPredicate(*position))
+        ++position;
+}
+
+class CSPSource {
 public:
-    explicit CSPDirective(const String& value)
-        : m_value(value)
+    CSPSource(const String& scheme, const String& host, int port, bool hostHasWildcard, bool portHasWildcard)
+        : m_scheme(scheme)
+        , m_host(host)
+        , m_port(port)
+        , m_hostHasWildcard(hostHasWildcard)
+        , m_portHasWildcard(portHasWildcard)
+    {
+    }
+
+    bool matches(const KURL& url) const
+    {
+        if (!schemeMatches(url))
+            return false;
+        if (isSchemeOnly())
+            return true;
+        return hostMatches(url) && portMatches(url);
+    }
+
+private:
+    bool schemeMatches(const KURL& url) const
+    {
+        return equalIgnoringCase(url.protocol(), m_scheme);
+    }
+
+    bool hostMatches(const KURL& url) const
     {
+        if (m_hostHasWildcard)
+            notImplemented();
+
+        return equalIgnoringCase(url.host(), m_host);
     }
 
-    bool allows(const KURL&)
+    bool portMatches(const KURL& url) const
     {
+        if (m_portHasWildcard)
+            return true;
+
+        // FIXME: Handle explicit default ports correctly.
+        return url.port() == m_port;
+    }
+
+    bool isSchemeOnly() const { return m_host.isEmpty(); }
+
+    String m_scheme;
+    String m_host;
+    int m_port;
+
+    bool m_hostHasWildcard;
+    bool m_portHasWildcard;
+};
+
+class CSPSourceList {
+public:
+    explicit CSPSourceList(SecurityOrigin*);
+
+    void parse(const String&);
+    bool matches(const KURL&);
+
+private:
+    void parse(const UChar* begin, const UChar* end);
+
+    bool parseSource(const UChar* begin, const UChar* end, String& scheme, String& host, int& port, bool& hostHasWildcard, bool& portHasWildcard);
+    bool parseScheme(const UChar* begin, const UChar* end, String& scheme);
+    bool parseHost(const UChar* begin, const UChar* end, String& host, bool& hostHasWildcard);
+    bool parsePort(const UChar* begin, const UChar* end, int& port, bool& portHasWildcard);
+
+    void addSourceSelf();
+
+    SecurityOrigin* m_origin;
+    Vector<CSPSource> m_list;
+};
+
+CSPSourceList::CSPSourceList(SecurityOrigin* origin)
+    : m_origin(origin)
+{
+}
+
+void CSPSourceList::parse(const String& value)
+{
+    parse(value.characters(), value.characters() + value.length());
+}
+
+bool CSPSourceList::matches(const KURL& url)
+{
+    for (size_t i = 0; i < m_list.size(); ++i) {
+        if (m_list[i].matches(url))
+            return true;
+    }
+    return false;
+}
+
+// source-list       = *WSP [ source *( 1*WSP source ) *WSP ]
+//                   / *WSP "'none'" *WSP
+//
+void CSPSourceList::parse(const UChar* begin, const UChar* end)
+{
+    const UChar* position = begin;
+
+    bool isFirstSourceInList = true;
+    while (position < end) {
+        skipWhile<isASCIISpace>(position, end);
+        const UChar* beginSource = position;
+        skipWhile<isSourceCharacter>(position, end);
+
+        if (isFirstSourceInList && equalIgnoringCase("'none'", beginSource, position - beginSource))
+            return; // We represent 'none' as an empty m_list.
+        isFirstSourceInList = false;
+
+        String scheme, host;
+        int port = 0;
+        bool hostHasWildcard = false;
+        bool portHasWildcard = false;
+
+        if (parseSource(beginSource, position, scheme, host, port, hostHasWildcard, portHasWildcard)) {
+            if (scheme.isEmpty())
+                scheme = m_origin->protocol();
+            m_list.append(CSPSource(scheme, host, port, hostHasWildcard, portHasWildcard));
+        }
+
+        ASSERT(position == end || isASCIISpace(*position));
+     }
+}
+
+// source            = scheme ":"
+//                   / ( [ scheme "://" ] host [ port ] )
+//                   / "'self'"
+//
+bool CSPSourceList::parseSource(const UChar* begin, const UChar* end,
+                                String& scheme, String& host, int& port,
+                                bool& hostHasWildcard, bool& portHasWildcard)
+{
+    if (begin == end)
+        return false;
+
+    if (equalIgnoringCase("'self'", begin, end - begin)) {
+        addSourceSelf();
         return false;
     }
 
+    const UChar* position = begin;
+
+    const UChar* beginHost = begin;
+    skipUtil(position, end, ':');
+
+    if (position == end) {
+        // This must be a host-only source.
+        if (!parseHost(beginHost, position, host, hostHasWildcard))
+            return false;
+        return true;
+    }
+
+    if (end - position == 1) {
+        ASSERT(*position == ':');
+        // This must be a scheme-only source.
+        if (!parseScheme(begin, position, scheme))
+            return false;
+        return true;
+    }
+
+    ASSERT(end - position >= 2);
+    if (position[1] == '/') {
+        if (!parseScheme(begin, position, scheme)
+            || !skipExactly(position, end, ':')
+            || !skipExactly(position, end, '/')
+            || !skipExactly(position, end, '/'))
+            return false;
+        beginHost = position;
+        skipUtil(position, end, ':');
+    }
+
+    if (position == beginHost)
+        return false;
+
+    if (!parseHost(beginHost, position, host, hostHasWildcard))
+        return false;
+
+    if (position == end) {
+        port = 0;
+        return true;
+    }
+
+    if (!skipExactly(position, end, ':'))
+        ASSERT_NOT_REACHED();
+
+    if (!parsePort(position, end, port, portHasWildcard))
+        return false;
+
+    return true;
+}
+
+//                     ; <scheme> production from RFC 3986
+// scheme      = ALPHA *( ALPHA / DIGIT / "+" / "-" / "." )
+//
+bool CSPSourceList::parseScheme(const UChar* begin, const UChar* end, String& scheme)
+{
+    ASSERT(begin <= end);
+    ASSERT(scheme.isEmpty());
+
+    if (begin == end)
+        return false;
+
+    const UChar* position = begin;
+
+    if (!skipExactly<isASCIIAlpha>(position, end))
+        return false;
+
+    skipWhile<isSchemeContinuationCharacter>(position, end);
+
+    if (position != end)
+        return false;
+
+    scheme = String(begin, end - begin);
+    return true;
+}
+
+// host              = [ "*." ] 1*host-char *( "." 1*host-char )
+//                   / "*"
+// host-char         = ALPHA / DIGIT / "-"
+//
+bool CSPSourceList::parseHost(const UChar* begin, const UChar* end, String& host, bool& hostHasWildcard)
+{
+    ASSERT(begin <= end);
+    ASSERT(host.isEmpty());
+    ASSERT(!hostHasWildcard);
+
+    if (begin == end)
+        return false;
+
+    const UChar* position = begin;
+
+    if (skipExactly(position, end, '*')) {
+        hostHasWildcard = true;
+
+        if (position == end)
+            return true;
+
+        if (!skipExactly(position, end, '.'))
+            return false;
+    }
+
+    const UChar* hostBegin = position;
+
+    while (position < end) {
+        if (!skipExactly<isHostCharacter>(position, end))
+            return false;
+
+        skipWhile<isHostCharacter>(position, end);
+
+        if (position < end && !skipExactly(position, end, '.'))
+            return false;
+    }
+
+    ASSERT(position == end);
+    host = String(hostBegin, end - hostBegin);
+    return true;
+}
+
+// port              = ":" ( 1*DIGIT / "*" )
+//
+bool CSPSourceList::parsePort(const UChar* begin, const UChar* end, int& port, bool& portHasWildcard)
+{
+    ASSERT(begin <= end);
+    ASSERT(!port);
+    ASSERT(!portHasWildcard);
+
+    if (begin == end)
+        return false;
+
+    if (end - begin == 1 && *begin == '*') {
+        port = 0;
+        portHasWildcard = true;
+        return true;
+    }
+
+    const UChar* position = begin;
+    skipWhile<isASCIIDigit>(position, end);
+
+    if (position != end)
+        return false;
+
+    bool ok;
+    port = charactersToIntStrict(begin, end - begin, &ok);
+    return ok;
+}
+
+void CSPSourceList::addSourceSelf()
+{
+    // FIXME: Inherit the scheme, host, and port from the current URL.
+    notImplemented();
+}
+
+class CSPDirective {
+public:
+    CSPDirective(const String& value, SecurityOrigin* origin)
+        : m_sourceList(origin)
+    {
+        m_sourceList.parse(value);
+    }
+
+    bool allows(const KURL& url)
+    {
+        return m_sourceList.matches(url);
+    }
+
 private:
-    String m_value;
+    CSPSourceList m_sourceList;
 };
 
-ContentSecurityPolicy::ContentSecurityPolicy()
+ContentSecurityPolicy::ContentSecurityPolicy(SecurityOrigin* origin)
     : m_havePolicy(false)
+    , m_origin(origin)
 {
 }
 
@@ -68,11 +430,19 @@ bool ContentSecurityPolicy::allowJavaScriptURLs() const
     return !m_scriptSrc;
 }
 
-bool ContentSecurityPolicy::canLoadExternalScriptFromSrc(const String& url) const
+bool ContentSecurityPolicy::allowInlineEventHandlers() const
+{
+    return !m_scriptSrc;
+}
+
+bool ContentSecurityPolicy::allowScriptFromSource(const KURL& url) const
 {
-    return !m_scriptSrc || m_scriptSrc->allows(KURL(ParsedURLString, url));
+    return !m_scriptSrc || m_scriptSrc->allows(url);
 }
 
+// policy            = directive-list
+// directive-list    = [ directive *( ";" [ directive ] ) ]
+//
 void ContentSecurityPolicy::parse(const String& policy)
 {
     ASSERT(!m_havePolicy);
@@ -80,75 +450,75 @@ void ContentSecurityPolicy::parse(const String& policy)
     if (policy.isEmpty())
         return;
 
-    const UChar* pos = policy.characters();
-    const UChar* end = pos + policy.length();
+    const UChar* position = policy.characters();
+    const UChar* end = position + policy.length();
 
-    while (pos < end) {
-        Vector<UChar, 32> name;
-        Vector<UChar, 64> value;
+    while (position < end) {
+        const UChar* directiveBegin = position;
+        skipUtil(position, end, ';');
 
-        parseDirective(pos, end, name, value);
-        if (name.isEmpty())
-            continue;
+        String name, value;
+        if (parseDirective(directiveBegin, position, name, value)) {
+            ASSERT(!name.isEmpty());
+            addDirective(name, value);
+        }
 
-        // We use a copy here instead of String::adopt because we expect
-        // the name and the value to be relatively short, so the copy will
-        // be cheaper than the extra malloc.
-        emitDirective(String(name), String(value));
+        ASSERT(position == end || *position == ';');
+        skipExactly(position, end, ';');
     }
 }
 
-void ContentSecurityPolicy::parseDirective(const UChar*& pos, const UChar* end, Vector<UChar, 32>& name, Vector<UChar, 64>& value)
+// directive         = *WSP [ directive-name [ WSP directive-value ] ]
+// directive-name    = 1*( ALPHA / DIGIT / "-" )
+// directive-value   = *( WSP / <VCHAR except ";"> )
+//
+bool ContentSecurityPolicy::parseDirective(const UChar* begin, const UChar* end, String& name, String& value)
 {
-    ASSERT(pos < end);
     ASSERT(name.isEmpty());
     ASSERT(value.isEmpty());
 
-    enum {
-        BeforeDirectiveName,
-        DirectiveName,
-        AfterDirectiveName,
-        DirectiveValue,
-    } state = BeforeDirectiveName;
-
-    while (pos < end) {
-        UChar currentCharacter = *pos++;
-        switch (state) {
-        case BeforeDirectiveName:
-            if (isASCIISpace(currentCharacter))
-                continue;
-            state = DirectiveName;
-            // Fall through.
-        case DirectiveName:
-            if (!isASCIISpace(currentCharacter)) {
-                name.append(currentCharacter);
-                continue;
-            }
-            state = AfterDirectiveName;
-            // Fall through.
-        case AfterDirectiveName:
-            if (isASCIISpace(currentCharacter))
-                continue;
-            state = DirectiveValue;
-            // Fall through.
-        case DirectiveValue:
-            if (currentCharacter != ';') {
-                value.append(currentCharacter);
-                continue;
-            }
-            return;
-        }
-    }
+    const UChar* position = begin;
+    skipWhile<isASCIISpace>(position, end);
+
+    const UChar* nameBegin = position;
+    skipWhile<isDirectiveNameCharacter>(position, end);
+
+    // The directive-name must be non-empty.
+    if (nameBegin == position)
+        return false;
+
+    name = String(nameBegin, position - nameBegin);
+
+    if (position == end)
+        return true;
+
+    if (!skipExactly<isASCIISpace>(position, end))
+        return false;
+
+    skipWhile<isASCIISpace>(position, end);
+
+    const UChar* valueBegin = position;
+    skipWhile<isDirectiveValueCharacter>(position, end);
+
+    if (position != end)
+        return false;
+
+    // The directive-value may be empty.
+    if (valueBegin == position)
+        return true;
+
+    value = String(valueBegin, position - valueBegin);
+    return true;
 }
 
-void ContentSecurityPolicy::emitDirective(const String& name, const String& value)
+void ContentSecurityPolicy::addDirective(const String& name, const String& value)
 {
     DEFINE_STATIC_LOCAL(String, scriptSrc, ("script-src"));
 
     ASSERT(!name.isEmpty());
 
     if (!m_scriptSrc && equalIgnoringCase(name, scriptSrc))
-        m_scriptSrc = adoptPtr(new CSPDirective(value));
+        m_scriptSrc = adoptPtr(new CSPDirective(value, m_origin.get()));
 }
 
 }
diff --git a/Source/WebCore/page/ContentSecurityPolicy.h b/Source/WebCore/page/ContentSecurityPolicy.h
index 0eebd05..a7cd216 100644
--- a/Source/WebCore/page/ContentSecurityPolicy.h
+++ b/Source/WebCore/page/ContentSecurityPolicy.h
@@ -32,26 +32,32 @@
 namespace WebCore {
 
 class CSPDirective;
+class KURL;
+class SecurityOrigin;
 
 class ContentSecurityPolicy : public RefCounted<ContentSecurityPolicy> {
 public:
-    static PassRefPtr<ContentSecurityPolicy> create() { return adoptRef(new ContentSecurityPolicy); }
+    static PassRefPtr<ContentSecurityPolicy> create(SecurityOrigin* origin = 0)
+    {
+        return adoptRef(new ContentSecurityPolicy(origin));
+    }
     ~ContentSecurityPolicy();
 
     void didReceiveHeader(const String&);
 
     bool allowJavaScriptURLs() const;
-    // FIXME: Rename canLoadExternalScriptFromSrc to allowScriptFromURL.
-    bool canLoadExternalScriptFromSrc(const String& url) const;
+    bool allowInlineEventHandlers() const;
+    bool allowScriptFromSource(const KURL&) const;
 
 private:
-    ContentSecurityPolicy();
+    explicit ContentSecurityPolicy(SecurityOrigin*);
 
     void parse(const String&);
-    void parseDirective(const UChar*& pos, const UChar* end, Vector<UChar, 32>& name, Vector<UChar, 64>& value);
-    void emitDirective(const String& name, const String& value);
+    bool parseDirective(const UChar* begin, const UChar* end, String& name, String& value);
+    void addDirective(const String& name, const String& value);
 
     bool m_havePolicy;
+    RefPtr<SecurityOrigin> m_origin;
     OwnPtr<CSPDirective> m_scriptSrc;
 };
 
diff --git a/Source/WebCore/page/ContextMenuController.cpp b/Source/WebCore/page/ContextMenuController.cpp
index c807d7a..a0e64b8 100644
--- a/Source/WebCore/page/ContextMenuController.cpp
+++ b/Source/WebCore/page/ContextMenuController.cpp
@@ -63,6 +63,7 @@
 #include "SelectionController.h"
 #include "Settings.h"
 #include "TextIterator.h"
+#include "UserTypingGestureIndicator.h"
 #include "WindowFeatures.h"
 #include "markup.h"
 #include <wtf/unicode/Unicode.h>
@@ -259,10 +260,10 @@ void ContextMenuController::contextMenuItemSelected(ContextMenuItem* item)
         frame->loader()->reload();
         break;
     case ContextMenuItemTagCut:
-        frame->editor()->cut();
+        frame->editor()->command("Cut").execute();
         break;
     case ContextMenuItemTagPaste:
-        frame->editor()->paste();
+        frame->editor()->command("Paste").execute();
         break;
 #if PLATFORM(GTK)
     case ContextMenuItemTagDelete:
@@ -632,6 +633,14 @@ static bool selectionContainsPossibleWord(Frame* frame)
     return false;
 }
 
+#if PLATFORM(MAC)
+#if defined(BUILDING_ON_TIGER) || defined(BUILDING_ON_LEOPARD) || defined(BUILDING_ON_SNOW_LEOPARD)
+#define INCLUDE_SPOTLIGHT_CONTEXT_MENU_ITEM 1
+#else
+#define INCLUDE_SPOTLIGHT_CONTEXT_MENU_ITEM 0
+#endif
+#endif
+
 void ContextMenuController::populate()
 {
     ContextMenuItem OpenLinkItem(ActionType, ContextMenuItemTagOpenLink, contextMenuItemTagOpenLink());
@@ -667,8 +676,6 @@ void ContextMenuController::populate()
 #if PLATFORM(MAC)
     ContextMenuItem SearchSpotlightItem(ActionType, ContextMenuItemTagSearchInSpotlight, 
         contextMenuItemTagSearchInSpotlight());
-    ContextMenuItem LookInDictionaryItem(ActionType, ContextMenuItemTagLookUpInDictionary, 
-        contextMenuItemTagLookUpInDictionary());
 #endif
 #if !PLATFORM(GTK)
     ContextMenuItem SearchWebItem(ActionType, ContextMenuItemTagSearchWeb, contextMenuItemTagSearchWeb());
@@ -758,20 +765,31 @@ void ContextMenuController::populate()
             if (m_hitTestResult.isSelected()) {
                 if (selectionContainsPossibleWord(frame)) {
 #if PLATFORM(MAC)
+                    String selectedString = frame->displayStringModifiedByEncoding(frame->editor()->selectedText());
+                    ContextMenuItem LookUpInDictionaryItem(ActionType, ContextMenuItemTagLookUpInDictionary, contextMenuItemTagLookUpInDictionary(selectedString));
+
+#if INCLUDE_SPOTLIGHT_CONTEXT_MENU_ITEM
                     appendItem(SearchSpotlightItem, m_contextMenu.get());
+#else
+                    appendItem(LookUpInDictionaryItem, m_contextMenu.get());
+#endif
 #endif
+
 #if !PLATFORM(GTK)
                     appendItem(SearchWebItem, m_contextMenu.get());
                     appendItem(*separatorItem(), m_contextMenu.get());
 #endif
-#if PLATFORM(MAC)
-                    appendItem(LookInDictionaryItem, m_contextMenu.get());
+
+#if PLATFORM(MAC) && INCLUDE_SPOTLIGHT_CONTEXT_MENU_ITEM
+                    appendItem(LookUpInDictionaryItem, m_contextMenu.get());
                     appendItem(*separatorItem(), m_contextMenu.get());
 #endif
                 }
+
                 appendItem(CopyItem, m_contextMenu.get());
 #if PLATFORM(MAC)
                 appendItem(*separatorItem(), m_contextMenu.get());
+
                 ContextMenuItem SpeechMenuItem(SubmenuType, ContextMenuItemTagSpeechMenu, contextMenuItemTagSpeechMenu());
                 createAndAppendSpeechSubMenu(SpeechMenuItem);
                 appendItem(SpeechMenuItem, m_contextMenu.get());
@@ -813,7 +831,7 @@ void ContextMenuController::populate()
         SelectionController* selection = frame->selection();
         bool inPasswordField = selection->isInPasswordField();
         bool spellCheckingEnabled = frame->editor()->isSpellCheckingEnabledFor(node);
-        
+
         if (!inPasswordField && spellCheckingEnabled) {
             // Consider adding spelling-related or grammar-related context menu items (never both, since a single selected range
             // is never considered a misspelling and bad grammar at the same time)
@@ -873,15 +891,23 @@ void ContextMenuController::populate()
 
         if (m_hitTestResult.isSelected() && !inPasswordField && selectionContainsPossibleWord(frame)) {
 #if PLATFORM(MAC)
+            String selectedString = frame->displayStringModifiedByEncoding(frame->editor()->selectedText());
+            ContextMenuItem LookUpInDictionaryItem(ActionType, ContextMenuItemTagLookUpInDictionary, contextMenuItemTagLookUpInDictionary(selectedString));
+
+#if INCLUDE_SPOTLIGHT_CONTEXT_MENU_ITEM
             appendItem(SearchSpotlightItem, m_contextMenu.get());
+#else
+            appendItem(LookUpInDictionaryItem, m_contextMenu.get());
+#endif
 #endif
+
 #if !PLATFORM(GTK)
             appendItem(SearchWebItem, m_contextMenu.get());
             appendItem(*separatorItem(), m_contextMenu.get());
 #endif
-     
-#if PLATFORM(MAC)
-            appendItem(LookInDictionaryItem, m_contextMenu.get());
+
+#if PLATFORM(MAC) && INCLUDE_SPOTLIGHT_CONTEXT_MENU_ITEM
+            appendItem(LookUpInDictionaryItem, m_contextMenu.get());
             appendItem(*separatorItem(), m_contextMenu.get());
 #endif
         }
diff --git a/Source/WebCore/page/DOMSelection.cpp b/Source/WebCore/page/DOMSelection.cpp
index 67c87d2..31ab956 100644
--- a/Source/WebCore/page/DOMSelection.cpp
+++ b/Source/WebCore/page/DOMSelection.cpp
@@ -101,7 +101,7 @@ Node* DOMSelection::anchorNode() const
         return 0;
     if (Node* shadowAncestor = selectionShadowAncestor(m_frame))
         return shadowAncestor->parentNodeGuaranteedHostFree();
-    return anchorPosition(visibleSelection()).deprecatedNode();
+    return anchorPosition(visibleSelection()).containerNode();
 }
 
 int DOMSelection::anchorOffset() const
@@ -110,7 +110,7 @@ int DOMSelection::anchorOffset() const
         return 0;
     if (Node* shadowAncestor = selectionShadowAncestor(m_frame))
         return shadowAncestor->nodeIndex();
-    return anchorPosition(visibleSelection()).deprecatedEditingOffset();
+    return anchorPosition(visibleSelection()).offsetInContainerNode();
 }
 
 Node* DOMSelection::focusNode() const
@@ -119,7 +119,7 @@ Node* DOMSelection::focusNode() const
         return 0;
     if (Node* shadowAncestor = selectionShadowAncestor(m_frame))
         return shadowAncestor->parentNodeGuaranteedHostFree();
-    return focusPosition(visibleSelection()).deprecatedNode();
+    return focusPosition(visibleSelection()).containerNode();
 }
 
 int DOMSelection::focusOffset() const
@@ -128,7 +128,7 @@ int DOMSelection::focusOffset() const
         return 0;
     if (Node* shadowAncestor = selectionShadowAncestor(m_frame))
         return shadowAncestor->nodeIndex();
-    return focusPosition(visibleSelection()).deprecatedEditingOffset();
+    return focusPosition(visibleSelection()).offsetInContainerNode();
 }
 
 Node* DOMSelection::baseNode() const
@@ -137,7 +137,7 @@ Node* DOMSelection::baseNode() const
         return 0;
     if (Node* shadowAncestor = selectionShadowAncestor(m_frame))
         return shadowAncestor->parentNodeGuaranteedHostFree();
-    return basePosition(visibleSelection()).deprecatedNode();
+    return basePosition(visibleSelection()).containerNode();
 }
 
 int DOMSelection::baseOffset() const
@@ -146,7 +146,7 @@ int DOMSelection::baseOffset() const
         return 0;
     if (Node* shadowAncestor = selectionShadowAncestor(m_frame))
         return shadowAncestor->nodeIndex();
-    return basePosition(visibleSelection()).deprecatedEditingOffset();
+    return basePosition(visibleSelection()).offsetInContainerNode();
 }
 
 Node* DOMSelection::extentNode() const
@@ -155,7 +155,7 @@ Node* DOMSelection::extentNode() const
         return 0;
     if (Node* shadowAncestor = selectionShadowAncestor(m_frame))
         return shadowAncestor->parentNodeGuaranteedHostFree();
-    return extentPosition(visibleSelection()).deprecatedNode();
+    return extentPosition(visibleSelection()).containerNode();
 }
 
 int DOMSelection::extentOffset() const
@@ -164,7 +164,7 @@ int DOMSelection::extentOffset() const
         return 0;
     if (Node* shadowAncestor = selectionShadowAncestor(m_frame))
         return shadowAncestor->nodeIndex();
-    return extentPosition(visibleSelection()).deprecatedEditingOffset();
+    return extentPosition(visibleSelection()).offsetInContainerNode();
 }
 
 bool DOMSelection::isCollapsed() const
diff --git a/Source/WebCore/page/DOMTimer.cpp b/Source/WebCore/page/DOMTimer.cpp
index eaca8f2..0a94e7e 100644
--- a/Source/WebCore/page/DOMTimer.cpp
+++ b/Source/WebCore/page/DOMTimer.cpp
@@ -30,6 +30,7 @@
 #include "InspectorInstrumentation.h"
 #include "ScheduledAction.h"
 #include "ScriptExecutionContext.h"
+#include "UserGestureIndicator.h"
 #include <wtf/HashSet.h>
 #include <wtf/StdLibExtras.h>
 
@@ -37,29 +38,41 @@ using namespace std;
 
 namespace WebCore {
 
+static const int maxIntervalForUserGestureForwarding = 1000; // One second matches Gecko.
 static const int maxTimerNestingLevel = 5;
 static const double oneMillisecond = 0.001;
 double DOMTimer::s_minDefaultTimerInterval = 0.010; // 10 milliseconds
 
 static int timerNestingLevel = 0;
-
-DOMTimer::DOMTimer(ScriptExecutionContext* context, PassOwnPtr<ScheduledAction> action, int timeout, bool singleShot)
-    : SuspendableTimer(context)
-    , m_action(action)
-    , m_originalTimeout(timeout)
+    
+static int timeoutId()
 {
     static int lastUsedTimeoutId = 0;
     ++lastUsedTimeoutId;
     // Avoid wraparound going negative on us.
     if (lastUsedTimeoutId <= 0)
         lastUsedTimeoutId = 1;
-    m_timeoutId = lastUsedTimeoutId;
-
-    m_nestingLevel = timerNestingLevel + 1;
+    return lastUsedTimeoutId;
+}
+    
+static inline bool shouldForwardUserGesture(int interval, int nestingLevel)
+{
+    return UserGestureIndicator::processingUserGesture()
+        && interval <= maxIntervalForUserGestureForwarding
+        && nestingLevel == 1; // Gestures should not be forwarded to nested timers.
+}
 
+DOMTimer::DOMTimer(ScriptExecutionContext* context, PassOwnPtr<ScheduledAction> action, int interval, bool singleShot)
+    : SuspendableTimer(context)
+    , m_timeoutId(timeoutId())
+    , m_nestingLevel(timerNestingLevel + 1)
+    , m_action(action)
+    , m_originalInterval(interval)
+    , m_shouldForwardUserGesture(shouldForwardUserGesture(interval, m_nestingLevel))
+{
     scriptExecutionContext()->addTimeout(m_timeoutId, this);
 
-    double intervalMilliseconds = intervalClampedToMinimum(timeout, context->minimumTimerInterval());
+    double intervalMilliseconds = intervalClampedToMinimum(interval, context->minimumTimerInterval());
     if (singleShot)
         startOneShot(intervalMilliseconds);
     else
@@ -101,6 +114,11 @@ void DOMTimer::fired()
 {
     ScriptExecutionContext* context = scriptExecutionContext();
     timerNestingLevel = m_nestingLevel;
+    
+    UserGestureIndicator gestureIndicator(m_shouldForwardUserGesture ? DefinitelyProcessingUserGesture : PossiblyProcessingUserGesture);
+    
+    // Only the first execution of a multi-shot timer should get an affirmative user gesture indicator.
+    m_shouldForwardUserGesture = false;
 
     InspectorInstrumentationCookie cookie = InspectorInstrumentation::willFireTimer(context, m_timeoutId);
 
@@ -155,14 +173,14 @@ void DOMTimer::adjustMinimumTimerInterval(double oldMinimumTimerInterval)
         return;
 
     double newMinimumInterval = scriptExecutionContext()->minimumTimerInterval();
-    double newClampedInterval = intervalClampedToMinimum(m_originalTimeout, newMinimumInterval);
+    double newClampedInterval = intervalClampedToMinimum(m_originalInterval, newMinimumInterval);
 
     if (repeatInterval()) {
         augmentRepeatInterval(newClampedInterval - repeatInterval());
         return;
     }
 
-    double previousClampedInterval = intervalClampedToMinimum(m_originalTimeout, oldMinimumTimerInterval);
+    double previousClampedInterval = intervalClampedToMinimum(m_originalInterval, oldMinimumTimerInterval);
     augmentFireInterval(newClampedInterval - previousClampedInterval);
 }
 
diff --git a/Source/WebCore/page/DOMTimer.h b/Source/WebCore/page/DOMTimer.h
index ba260e0..b917406 100644
--- a/Source/WebCore/page/DOMTimer.h
+++ b/Source/WebCore/page/DOMTimer.h
@@ -55,7 +55,7 @@ namespace WebCore {
         void adjustMinimumTimerInterval(double oldMinimumTimerInterval);
 
     private:
-        DOMTimer(ScriptExecutionContext*, PassOwnPtr<ScheduledAction>, int timeout, bool singleShot);
+        DOMTimer(ScriptExecutionContext*, PassOwnPtr<ScheduledAction>, int interval, bool singleShot);
         virtual void fired();
 
         double intervalClampedToMinimum(int timeout, double minimumTimerInterval) const;
@@ -68,7 +68,8 @@ namespace WebCore {
         int m_timeoutId;
         int m_nestingLevel;
         OwnPtr<ScheduledAction> m_action;
-        int m_originalTimeout;
+        int m_originalInterval;
+        bool m_shouldForwardUserGesture;
         static double s_minDefaultTimerInterval;
     };
 
diff --git a/Source/WebCore/page/DOMWindow.cpp b/Source/WebCore/page/DOMWindow.cpp
index 269c109..90458ff 100644
--- a/Source/WebCore/page/DOMWindow.cpp
+++ b/Source/WebCore/page/DOMWindow.cpp
@@ -394,6 +394,7 @@ bool DOMWindow::canShowModalDialogNow(const Frame* frame)
 DOMWindow::DOMWindow(Frame* frame)
     : m_shouldPrintWhenFinishedLoading(false)
     , m_frame(frame)
+    , m_printTimer(this, &DOMWindow::printTimerFired)
 {
 }
 
@@ -711,6 +712,13 @@ void DOMWindow::pageDestroyed()
 #endif
 }
 
+void DOMWindow::resetGeolocation()
+{
+    // Geolocation should cancel activities and permission requests when the page is detached.
+    if (m_navigator)
+        m_navigator->resetGeolocation();
+}
+
 #if ENABLE(INDEXED_DATABASE)
 IDBFactory* DOMWindow::webkitIndexedDB() const
 {
@@ -755,14 +763,14 @@ void DOMWindow::requestFileSystem(int type, long long size, PassRefPtr<FileSyste
     LocalFileSystem::localFileSystem().requestFileSystem(document, fileSystemType, size, FileSystemCallbacks::create(successCallback, errorCallback, document), false);
 }
 
-void DOMWindow::resolveLocalFileSystemURI(const String& uri, PassRefPtr<EntryCallback> successCallback, PassRefPtr<ErrorCallback> errorCallback)
+void DOMWindow::resolveLocalFileSystemURL(const String& url, PassRefPtr<EntryCallback> successCallback, PassRefPtr<ErrorCallback> errorCallback)
 {
     Document* document = this->document();
     if (!document)
         return;
 
     SecurityOrigin* securityOrigin = document->securityOrigin();
-    KURL completedURL = document->completeURL(uri);
+    KURL completedURL = document->completeURL(url);
     if (!AsyncFileSystem::isAvailable() || !securityOrigin->canAccessFileSystem() || !securityOrigin->canRequest(completedURL)) {
         DOMFileSystem::scheduleCallback(document, errorCallback, FileError::create(FileError::SECURITY_ERR));
         return;
@@ -771,7 +779,7 @@ void DOMWindow::resolveLocalFileSystemURI(const String& uri, PassRefPtr<EntryCal
     AsyncFileSystem::Type type;
     String filePath;
     if (!completedURL.isValid() || !DOMFileSystemBase::crackFileSystemURL(completedURL, type, filePath)) {
-        DOMFileSystem::scheduleCallback(document, errorCallback, FileError::create(FileError::SYNTAX_ERR));
+        DOMFileSystem::scheduleCallback(document, errorCallback, FileError::create(FileError::ENCODING_ERR));
         return;
     }
 
@@ -943,6 +951,12 @@ void DOMWindow::print()
     page->chrome()->print(m_frame);
 }
 
+void DOMWindow::printTimerFired(Timer<DOMWindow>* timer)
+{
+    ASSERT_UNUSED(timer, timer == &m_printTimer);
+    print();
+}
+
 void DOMWindow::stop()
 {
     if (!m_frame)
@@ -1571,11 +1585,8 @@ void DOMWindow::dispatchLoadEvent()
     // This is a DOM extension and is independent of bubbling/capturing rules of
     // the DOM.
     Element* ownerElement = m_frame ? m_frame->ownerElement() : 0;
-    if (ownerElement) {
-        RefPtr<Event> ownerEvent = Event::create(eventNames().loadEvent, false, false);
-        ownerEvent->setTarget(ownerElement);
-        ownerElement->dispatchGenericEvent(ownerEvent.release());
-    }
+    if (ownerElement)
+        ownerElement->dispatchEvent(Event::create(eventNames().loadEvent, false, false));
 
     InspectorInstrumentation::loadEventFired(frame(), url());
 }
@@ -1636,7 +1647,9 @@ void DOMWindow::finishedLoading()
 {
     if (m_shouldPrintWhenFinishedLoading) {
         m_shouldPrintWhenFinishedLoading = false;
-        print();
+
+        m_printTimer.stop();
+        m_printTimer.startOneShot(0);
     }
 }
 
diff --git a/Source/WebCore/page/DOMWindow.h b/Source/WebCore/page/DOMWindow.h
index b365f53..404f40f 100644
--- a/Source/WebCore/page/DOMWindow.h
+++ b/Source/WebCore/page/DOMWindow.h
@@ -30,6 +30,7 @@
 #include "KURL.h"
 #include "MessagePort.h"
 #include "SecurityOrigin.h"
+#include "Timer.h"
 
 namespace WebCore {
 
@@ -222,6 +223,7 @@ namespace WebCore {
         String crossDomainAccessErrorMessage(DOMWindow* activeWindow);
 
         void pageDestroyed();
+        void resetGeolocation();
 
         void postMessage(PassRefPtr<SerializedScriptValue> message, const MessagePortArray*, const String& targetOrigin, DOMWindow* source, ExceptionCode&);
         // FIXME: remove this when we update the ObjC bindings (bug #28774).
@@ -391,7 +393,7 @@ namespace WebCore {
             PERSISTENT,
         };
         void requestFileSystem(int type, long long size, PassRefPtr<FileSystemCallback>, PassRefPtr<ErrorCallback>);
-        void resolveLocalFileSystemURI(const String&, PassRefPtr<EntryCallback>, PassRefPtr<ErrorCallback>);
+        void resolveLocalFileSystemURL(const String&, PassRefPtr<EntryCallback>, PassRefPtr<ErrorCallback>);
 #endif
 
 #if ENABLE(INDEXED_DATABASE)
@@ -436,6 +438,8 @@ namespace WebCore {
         virtual EventTargetData* eventTargetData();
         virtual EventTargetData* ensureEventTargetData();
 
+        void printTimerFired(Timer<DOMWindow>*);
+
         static Frame* createWindow(const String& urlString, const AtomicString& frameName, const WindowFeatures&,
             DOMWindow* activeWindow, Frame* firstFrame, Frame* openerFrame,
             PrepareDialogFunction = 0, void* functionContext = 0);
@@ -461,6 +465,8 @@ namespace WebCore {
         mutable RefPtr<Location> m_location;
         mutable RefPtr<StyleMedia> m_media;
 
+        Timer<DOMWindow> m_printTimer;
+
         EventTargetData m_eventTargetData;
 
         String m_status;
diff --git a/Source/WebCore/page/DOMWindow.idl b/Source/WebCore/page/DOMWindow.idl
index 530c4ad..8c6e929 100644
--- a/Source/WebCore/page/DOMWindow.idl
+++ b/Source/WebCore/page/DOMWindow.idl
@@ -195,7 +195,7 @@ module window {
         const unsigned short TEMPORARY = 0;
         const unsigned short PERSISTENT = 1;
         [EnabledAtRuntime=FileSystem] void requestFileSystem(in unsigned short type, in long long size, in [Callback, Optional] FileSystemCallback successCallback, in [Callback, Optional] ErrorCallback errorCallback);
-        [EnabledAtRuntime=FileSystem] void resolveLocalFileSystemURI(in DOMString uri, in [Callback, Optional] EntryCallback successCallback, in [Callback, Optional] ErrorCallback errorCallback);
+        [EnabledAtRuntime=FileSystem] void resolveLocalFileSystemURL(in DOMString url, in [Callback, Optional] EntryCallback successCallback, in [Callback, Optional] ErrorCallback errorCallback);
 
         attribute [EnabledAtRuntime=FileSystem] FlagsConstructor Flags;
 #endif
@@ -491,15 +491,15 @@ module window {
         attribute CanvasGradientConstructor CanvasGradient;
         attribute CanvasRenderingContext2DConstructor CanvasRenderingContext2D;
         attribute ImageDataConstructor ImageData;
-        attribute [Conditional=WEBGL,EnabledAtRuntime] WebGLActiveInfoConstructor WebGLActiveInfo;
-        attribute [Conditional=WEBGL,EnabledAtRuntime] WebGLBufferConstructor WebGLBuffer;
-        attribute [Conditional=WEBGL,EnabledAtRuntime] WebGLFramebufferConstructor WebGLFramebuffer;
-        attribute [Conditional=WEBGL,EnabledAtRuntime] WebGLProgramConstructor WebGLProgram;
-        attribute [Conditional=WEBGL,EnabledAtRuntime] WebGLRenderbufferConstructor WebGLRenderbuffer;
-        attribute [Conditional=WEBGL,EnabledAtRuntime] WebGLRenderingContextConstructor WebGLRenderingContext;
-        attribute [Conditional=WEBGL,EnabledAtRuntime] WebGLShaderConstructor WebGLShader;
-        attribute [Conditional=WEBGL,EnabledAtRuntime] WebGLTextureConstructor WebGLTexture;
-        attribute [Conditional=WEBGL,EnabledAtRuntime] WebGLUniformLocationConstructor WebGLUniformLocation;
+        attribute [Conditional=WEBGL] WebGLActiveInfoConstructor WebGLActiveInfo;
+        attribute [Conditional=WEBGL] WebGLBufferConstructor WebGLBuffer;
+        attribute [Conditional=WEBGL] WebGLFramebufferConstructor WebGLFramebuffer;
+        attribute [Conditional=WEBGL] WebGLProgramConstructor WebGLProgram;
+        attribute [Conditional=WEBGL] WebGLRenderbufferConstructor WebGLRenderbuffer;
+        attribute [Conditional=WEBGL] WebGLRenderingContextConstructor WebGLRenderingContext;
+        attribute [Conditional=WEBGL] WebGLShaderConstructor WebGLShader;
+        attribute [Conditional=WEBGL] WebGLTextureConstructor WebGLTexture;
+        attribute [Conditional=WEBGL] WebGLUniformLocationConstructor WebGLUniformLocation;
         attribute TextMetricsConstructor TextMetrics;
 
         attribute DOMStringMapConstructor DOMStringMap;
@@ -606,6 +606,9 @@ module window {
         attribute [Conditional=VIDEO, EnabledAtRuntime] MediaErrorConstructor MediaError;
         attribute [Conditional=VIDEO, EnabledAtRuntime] TimeRangesConstructor TimeRanges;
 
+        attribute WebKitAnimationConstructor WebKitAnimation;
+        attribute WebKitAnimationListConstructor WebKitAnimationList;
+
 #if defined(ENABLE_XPATH) && ENABLE_XPATH
         attribute XPathEvaluatorConstructor XPathEvaluator;
         attribute XPathResultConstructor XPathResult;
@@ -721,7 +724,7 @@ module window {
         attribute SVGSetElementConstructor SVGSetElement;
 #endif
 
-#if ENABLE_SVG_FONTS && ENABLE_SVG_FONTS
+#if defined(ENABLE_SVG_FONTS) && ENABLE_SVG_FONTS
 //      attribute SVGAltGlyphDefElementConstructor SVGAltGlyphDefElement;
         attribute SVGAltGlyphElementConstructor SVGAltGlyphElement;
 //      attribute SVGAltGlyphItemElementConstructor SVGAltGlyphItemElement;
diff --git a/Source/WebCore/page/DragController.cpp b/Source/WebCore/page/DragController.cpp
index 6a4bb70..342ad19 100644
--- a/Source/WebCore/page/DragController.cpp
+++ b/Source/WebCore/page/DragController.cpp
@@ -353,7 +353,7 @@ DragOperation DragController::operationForLoad(DragData* dragData)
 {
     ASSERT(dragData);
     Document* doc = m_page->mainFrame()->documentAtPoint(dragData->clientPosition());
-    if (doc && (m_didInitiateDrag || doc->isPluginDocument() || doc->inDesignMode()))
+    if (doc && (m_didInitiateDrag || doc->isPluginDocument() || doc->rendererIsEditable()))
         return DragOperationNone;
     return dragOperation(dragData);
 }
@@ -371,6 +371,7 @@ static bool setSelectionToDragCaret(Frame* frame, VisibleSelection& dragCaret, R
 
 bool DragController::dispatchTextInputEventFor(Frame* innerFrame, DragData* dragData)
 {
+    ASSERT(!m_page->dragCaretController()->isNone());
     VisibleSelection dragCaret(m_page->dragCaretController()->selection());
     String text = dragCaret.isContentRichlyEditable() ? "" : dragData->asPlainText(innerFrame);
     Node* target = innerFrame->editor()->findEventTargetFrom(dragCaret);
@@ -393,7 +394,7 @@ bool DragController::concludeEditDrag(DragData* dragData)
     Frame* innerFrame = element->ownerDocument()->frame();
     ASSERT(innerFrame);
 
-    if (!dispatchTextInputEventFor(innerFrame, dragData))
+    if (!m_page->dragCaretController()->isNone() && !dispatchTextInputEventFor(innerFrame, dragData))
         return true;
 
     if (dragData->containsColor()) {
@@ -510,7 +511,7 @@ bool DragController::canProcessDrag(DragData* dragData)
     if (dragData->containsFiles() && asFileInput(result.innerNonSharedNode()))
         return true;
 
-    if (!result.innerNonSharedNode()->isContentEditable())
+    if (!result.innerNonSharedNode()->rendererIsEditable())
         return false;
 
     if (m_didInitiateDrag && m_documentUnderMouse == m_dragInitiator && result.isSelected())
diff --git a/Source/WebCore/page/DragController.h b/Source/WebCore/page/DragController.h
index 0f176b1..693189a 100644
--- a/Source/WebCore/page/DragController.h
+++ b/Source/WebCore/page/DragController.h
@@ -66,7 +66,6 @@ namespace WebCore {
         void setIsHandlingDrag(bool handling) { m_isHandlingDrag = handling; }
         bool isHandlingDrag() const { return m_isHandlingDrag; }
         DragOperation sourceDragOperation() const { return m_sourceDragOperation; }
-        void setDraggingImageURL(const KURL& url) { m_draggingImageURL = url; }
         const KURL& draggingImageURL() const { return m_draggingImageURL; }
         void setDragOffset(const IntPoint& offset) { m_dragOffset = offset; }
         const IntPoint& dragOffset() const { return m_dragOffset; }
diff --git a/Source/WebCore/page/EditorClient.h b/Source/WebCore/page/EditorClient.h
index d5de6a4..aeda844 100644
--- a/Source/WebCore/page/EditorClient.h
+++ b/Source/WebCore/page/EditorClient.h
@@ -158,14 +158,15 @@ public:
 
     virtual TextCheckerClient* textChecker() = 0;
 
-#if SUPPORT_AUTOCORRECTION_PANEL
     enum AutocorrectionResponseType {
         AutocorrectionEdited,
         AutocorrectionReverted
     };
-    virtual void showCorrectionPanel(CorrectionPanelInfo::PanelType, const FloatRect& boundingBoxOfReplacedString, const String& replacedString, const String& replacmentString, const Vector<String>& alternativeReplacementStrings, Editor*) = 0;
+
+#if SUPPORT_AUTOCORRECTION_PANEL
+    virtual void showCorrectionPanel(CorrectionPanelInfo::PanelType, const FloatRect& boundingBoxOfReplacedString, const String& replacedString, const String& replacmentString, const Vector<String>& alternativeReplacementStrings) = 0;
     virtual void dismissCorrectionPanel(ReasonForDismissingCorrectionPanel) = 0;
-    virtual bool isShowingCorrectionPanel() = 0;
+    virtual String dismissCorrectionPanelSoon(ReasonForDismissingCorrectionPanel) = 0;
     virtual void recordAutocorrectionResponse(AutocorrectionResponseType, const String& replacedString, const String& replacementString) = 0;
 #endif
 
diff --git a/Source/WebCore/page/EventHandler.cpp b/Source/WebCore/page/EventHandler.cpp
index ef2ffb3..f05e8b2 100644
--- a/Source/WebCore/page/EventHandler.cpp
+++ b/Source/WebCore/page/EventHandler.cpp
@@ -98,8 +98,13 @@
 #include "TouchEvent.h"
 #endif
 
+<<<<<<< HEAD
 #if defined(ANDROID_PLUGINS)
 #include "WebViewCore.h"
+=======
+#if ENABLE(GESTURE_RECOGNIZER)
+#include "PlatformGestureRecognizer.h"
+>>>>>>> webkit.org at r82507
 #endif
 
 namespace WebCore {
@@ -209,6 +214,9 @@ EventHandler::EventHandler(Frame* frame)
 #if ENABLE(TOUCH_EVENTS)
     , m_touchPressed(false)
 #endif
+#if ENABLE(GESTURE_RECOGNIZER)
+    , m_gestureRecognizer(PlatformGestureRecognizer::create())
+#endif
 {
 }
 
@@ -260,6 +268,20 @@ void EventHandler::clear()
 #endif
 }
 
+static void setSelectionIfNeeded(SelectionController* selection, const VisibleSelection& newSelection)
+{
+    ASSERT(selection);
+    if (selection->selection() != newSelection && selection->shouldChangeSelection(newSelection))
+        selection->setSelection(newSelection);
+}
+
+static void setNonDirectionalSelectionIfNeeded(SelectionController* selection, const VisibleSelection& newSelection, TextGranularity granularity)
+{
+    ASSERT(selection);
+    if (selection->selection() != newSelection && selection->shouldChangeSelection(newSelection))
+        selection->setSelection(newSelection, granularity, MakeNonDirectionalSelection);
+}
+
 void EventHandler::selectClosestWordFromMouseEvent(const MouseEventWithHitTestResults& result)
 {
     Node* innerNode = result.targetNode();
@@ -279,9 +301,8 @@ void EventHandler::selectClosestWordFromMouseEvent(const MouseEventWithHitTestRe
             if (result.event().clickCount() == 2 && m_frame->editor()->isSelectTrailingWhitespaceEnabled()) 
                 newSelection.appendTrailingWhitespace();            
         }
-        
-        if (m_frame->selection()->shouldChangeSelection(newSelection))
-            m_frame->selection()->setSelection(newSelection, granularity, MakeNonDirectionalSelection);
+
+        setNonDirectionalSelectionIfNeeded(m_frame->selection(), newSelection, granularity);
     }
 }
 
@@ -305,8 +326,7 @@ void EventHandler::selectClosestWordOrLinkFromMouseEvent(const MouseEventWithHit
             m_beganSelectingText = true;
         }
 
-        if (m_frame->selection()->shouldChangeSelection(newSelection))
-            m_frame->selection()->setSelection(newSelection, granularity, MakeNonDirectionalSelection);
+        setNonDirectionalSelectionIfNeeded(m_frame->selection(), newSelection, granularity);
     }
 }
 
@@ -349,9 +369,8 @@ bool EventHandler::handleMousePressEventTripleClick(const MouseEventWithHitTestR
         granularity = ParagraphGranularity;
         m_beganSelectingText = true;
     }
-    
-    if (m_frame->selection()->shouldChangeSelection(newSelection))
-        m_frame->selection()->setSelection(newSelection, granularity, MakeNonDirectionalSelection);
+
+    setNonDirectionalSelectionIfNeeded(m_frame->selection(), newSelection, granularity);
 
     return true;
 }
@@ -416,9 +435,8 @@ bool EventHandler::handleMousePressEventSingleClick(const MouseEventWithHitTestR
         m_beganSelectingText = true;
     } else
         newSelection = VisibleSelection(visiblePos);
-    
-    if (m_frame->selection()->shouldChangeSelection(newSelection))
-        m_frame->selection()->setSelection(newSelection, granularity, MakeNonDirectionalSelection);
+
+    setNonDirectionalSelectionIfNeeded(m_frame->selection(), newSelection, granularity);
 
     return true;
 }
@@ -555,7 +573,13 @@ bool EventHandler::handleMouseDraggedEvent(const MouseEventWithHitTestResults& e
         
         m_mouseDownMayStartAutoscroll = false;
     }
-    
+
+    if (!m_beganSelectingText) {
+        HitTestRequest request(HitTestRequest::ReadOnly | HitTestRequest::Active);
+        HitTestResult result(m_mouseDownPos);
+        m_frame->document()->renderView()->layer()->hitTest(request, result);
+        updateSelectionForMouseDrag(result.innerNode(), result.localPoint());
+    }
     updateSelectionForMouseDrag(targetNode, event.localPoint());
     return true;
 }
@@ -653,10 +677,7 @@ void EventHandler::updateSelectionForMouseDrag(Node* targetNode, const IntPoint&
     if (m_frame->selection()->granularity() != CharacterGranularity)
         newSelection.expandUsingGranularity(m_frame->selection()->granularity());
 
-    if (m_frame->selection()->shouldChangeSelection(newSelection)) {
-        m_frame->selection()->setIsDirectional(false);
-        m_frame->selection()->setSelection(newSelection, m_frame->selection()->granularity(), MakeNonDirectionalSelection);
-    }
+    setNonDirectionalSelectionIfNeeded(m_frame->selection(), newSelection, m_frame->selection()->granularity());
 }
 #endif // ENABLE(DRAG_SUPPORT)
 
@@ -713,12 +734,12 @@ bool EventHandler::handleMouseReleaseEvent(const MouseEventWithHitTestResults& e
         VisibleSelection newSelection;
         Node* node = event.targetNode();
         bool caretBrowsing = m_frame->settings()->caretBrowsingEnabled();
-        if (node && (caretBrowsing || node->isContentEditable()) && node->renderer()) {
+        if (node && (caretBrowsing || node->rendererIsEditable()) && node->renderer()) {
             VisiblePosition pos = node->renderer()->positionForPoint(event.localPoint());
             newSelection = VisibleSelection(pos);
         }
-        if (m_frame->selection()->shouldChangeSelection(newSelection))
-            m_frame->selection()->setSelection(newSelection);
+
+        setSelectionIfNeeded(m_frame->selection(), newSelection);
 
         handled = true;
     }
@@ -1165,7 +1186,7 @@ Cursor EventHandler::selectCursor(const MouseEventWithHitTestResults& event, Scr
 
     switch (style ? style->cursor() : CURSOR_AUTO) {
     case CURSOR_AUTO: {
-        bool editable = (node && node->isContentEditable());
+        bool editable = (node && node->rendererIsEditable());
         bool editableLinkEnabled = false;
 
         // If the link is editable, then we need to check the settings to see whether or not the link should be followed
@@ -1456,6 +1477,22 @@ bool EventHandler::handleMouseDoubleClickEvent(const PlatformMouseEvent& mouseEv
     return swallowMouseUpEvent || swallowClickEvent || swallowMouseReleaseEvent;
 }
 
+static RenderLayer* layerForNode(Node* node)
+{
+    if (!node)
+        return 0;
+
+    RenderObject* renderer = node->renderer();
+    if (!renderer)
+        return 0;
+
+    RenderLayer* layer = renderer->enclosingLayer();
+    if (!layer)
+        return 0;
+
+    return layer;
+}
+
 bool EventHandler::mouseMoved(const PlatformMouseEvent& event)
 {
     HitTestResult hoveredNode = HitTestResult(IntPoint());
@@ -1465,6 +1502,11 @@ bool EventHandler::mouseMoved(const PlatformMouseEvent& event)
     if (!page)
         return result;
 
+    if (RenderLayer* layer = layerForNode(hoveredNode.innerNode())) {
+        if (page->containsScrollableArea(layer))
+            layer->scrollAnimator()->mouseMovedInContentArea();
+    }
+
     if (FrameView* frameView = m_frame->view())
         frameView->scrollAnimator()->mouseMovedInContentArea();  
 
@@ -1889,21 +1931,32 @@ void EventHandler::updateMouseEventTargetNode(Node* targetNode, const PlatformMo
 
     // Fire mouseout/mouseover if the mouse has shifted to a different node.
     if (fireMouseOverOut) {
-        // FIXME: This code will only correctly handle transitions between frames with scrollbars,
-        // not transitions between overflow regions, or transitions between two frames
-        // that don't have scrollbars contained within a frame that does.
+        RenderLayer* layerForLastNode = layerForNode(m_lastNodeUnderMouse.get());
+        RenderLayer* layerForNodeUnderMouse = layerForNode(m_nodeUnderMouse.get());
+        Page* page = m_frame->page();
+
         if (m_lastNodeUnderMouse && (!m_nodeUnderMouse || m_nodeUnderMouse->document() != m_frame->document())) {
+            // The mouse has moved between frames.
             if (Frame* frame = m_lastNodeUnderMouse->document()->frame()) {
                 if (FrameView* frameView = frame->view())
                     frameView->scrollAnimator()->mouseExitedContentArea();
             }
+        } else if (page && (layerForLastNode && (!layerForNodeUnderMouse || layerForNodeUnderMouse != layerForLastNode))) {
+            // The mouse has moved between layers.
+            if (page->containsScrollableArea(layerForLastNode))
+                layerForLastNode->scrollAnimator()->mouseExitedContentArea();
         }
         
         if (m_nodeUnderMouse && (!m_lastNodeUnderMouse || m_lastNodeUnderMouse->document() != m_frame->document())) {
+            // The mouse has moved between frames.
             if (Frame* frame = m_nodeUnderMouse->document()->frame()) {
                 if (FrameView* frameView = frame->view())
                     frameView->scrollAnimator()->mouseEnteredContentArea();
             }
+        } else if (page && (layerForNodeUnderMouse && (!layerForLastNode || layerForNodeUnderMouse != layerForLastNode))) {
+            // The mouse has moved between layers.
+            if (page->containsScrollableArea(layerForNodeUnderMouse))
+                layerForNodeUnderMouse->scrollAnimator()->mouseEnteredContentArea();
         }
         
         if (m_lastNodeUnderMouse && m_lastNodeUnderMouse->document() != m_frame->document()) {
@@ -2360,6 +2413,8 @@ bool EventHandler::needsKeyboardEventDisambiguationQuirks() const
 
 bool EventHandler::keyEvent(const PlatformKeyboardEvent& initialKeyEvent)
 {
+    RefPtr<FrameView> protector(m_frame->view()); 
+
 #if ENABLE(PAN_SCROLLING)
     if (Page* page = m_frame->page()) {
         if (page->mainFrame()->eventHandler()->panScrollInProgress() || m_autoscrollInProgress) {
@@ -3123,6 +3178,11 @@ bool EventHandler::handleTouchEvent(const PlatformTouchEvent& event)
         }
     }
 
+#if ENABLE(GESTURE_RECOGNIZER)
+    if (m_gestureRecognizer)
+        m_gestureRecognizer->processTouchEventForGesture(event, this, defaultPrevented);
+#endif
+
     return defaultPrevented;
 }
 #endif
diff --git a/Source/WebCore/page/EventHandler.h b/Source/WebCore/page/EventHandler.h
index e20e43c..70d6194 100644
--- a/Source/WebCore/page/EventHandler.h
+++ b/Source/WebCore/page/EventHandler.h
@@ -34,6 +34,7 @@
 #include "TextEventInputType.h"
 #include "Timer.h"
 #include <wtf/Forward.h>
+#include <wtf/OwnPtr.h>
 #include <wtf/RefPtr.h>
 
 #if PLATFORM(MAC) && !defined(__OBJC__)
@@ -76,6 +77,10 @@ class Widget;
 class PlatformGestureEvent;
 #endif
 
+#if ENABLE(GESTURE_RECOGNIZER)
+class PlatformGestureRecognizer;
+#endif
+
 #if ENABLE(DRAG_SUPPORT)
 extern const int LinkDragHysteresis;
 extern const int ImageDragHysteresis;
@@ -456,6 +461,9 @@ private:
     RefPtr<Node> m_capturingTouchEventsNode;
 #endif
 #endif
+#if ENABLE(GESTURE_RECOGNIZER)
+    OwnPtr<PlatformGestureRecognizer> m_gestureRecognizer;
+#endif
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/page/FocusController.cpp b/Source/WebCore/page/FocusController.cpp
index 10901c5..41cfee4 100644
--- a/Source/WebCore/page/FocusController.cpp
+++ b/Source/WebCore/page/FocusController.cpp
@@ -301,7 +301,7 @@ bool FocusController::advanceFocusInDocumentOrder(FocusDirection direction, Keyb
 static bool relinquishesEditingFocus(Node *node)
 {
     ASSERT(node);
-    ASSERT(node->isContentEditable());
+    ASSERT(node->rendererIsEditable());
 
     Node* root = node->rootEditableElement();
     Frame* frame = node->document()->frame();
@@ -410,11 +410,16 @@ void FocusController::setActive(bool active)
             view->updateLayoutAndStyleIfNeededRecursive();
             view->updateControlTints();
         }
-        // FIXME: This should propogate to all ScrollableAreas.
-        if (!active)
-            view->scrollAnimator()->contentAreaDidHide();
-        else
-            view->scrollAnimator()->contentAreaDidShow();
+
+        if (const HashSet<ScrollableArea*>* scrollableAreas = m_page->scrollableAreaSet()) {
+            HashSet<ScrollableArea*>::const_iterator end = scrollableAreas->end(); 
+            for (HashSet<ScrollableArea*>::const_iterator it = scrollableAreas->begin(); it != end; ++it) {
+                if (!active)
+                    (*it)->scrollAnimator()->contentAreaDidHide();
+                else
+                    (*it)->scrollAnimator()->contentAreaDidShow();
+            }
+        }
     }
 
     focusedOrMainFrame()->selection()->pageActivationChanged();
diff --git a/Source/WebCore/page/Frame.cpp b/Source/WebCore/page/Frame.cpp
index 9a562a1..3652c9a 100644
--- a/Source/WebCore/page/Frame.cpp
+++ b/Source/WebCore/page/Frame.cpp
@@ -690,8 +690,10 @@ void Frame::pageDestroyed()
     if (Frame* parent = tree()->parent())
         parent->loader()->checkLoadComplete();
 
-    if (m_domWindow)
+    if (m_domWindow) {
+        m_domWindow->resetGeolocation();
         m_domWindow->pageDestroyed();
+    }
 
     // FIXME: It's unclear as to why this is called more than once, but it is,
     // so page() could be NULL.
@@ -736,6 +738,13 @@ void Frame::transferChildFrameToNewDocument()
              m_page->decrementFrameCount();
         }
 
+        // FIXME: We should ideally allow existing Geolocation activities to continue
+        // when the Geolocation's iframe is reparented.
+        // See https://bugs.webkit.org/show_bug.cgi?id=55577
+        // and https://bugs.webkit.org/show_bug.cgi?id=52877
+        if (m_domWindow)
+            m_domWindow->resetGeolocation();
+
         m_page = newPage;
 
         if (newPage)
@@ -901,7 +910,7 @@ Color Frame::tiledBackingStoreBackgroundColor() const
 }
 #endif
 
-String Frame::layerTreeAsText() const
+String Frame::layerTreeAsText(bool showDebugInfo) const
 {
 #if USE(ACCELERATED_COMPOSITING)
     document()->updateLayout();
@@ -909,7 +918,7 @@ String Frame::layerTreeAsText() const
     if (!contentRenderer())
         return String();
 
-    return contentRenderer()->compositor()->layerTreeAsText();
+    return contentRenderer()->compositor()->layerTreeAsText(showDebugInfo);
 #else
     return String();
 #endif
diff --git a/Source/WebCore/page/Frame.h b/Source/WebCore/page/Frame.h
index 25f8aac..f22fcb8 100644
--- a/Source/WebCore/page/Frame.h
+++ b/Source/WebCore/page/Frame.h
@@ -127,7 +127,7 @@ namespace WebCore {
 
         void injectUserScripts(UserScriptInjectionTime);
         
-        String layerTreeAsText() const;
+        String layerTreeAsText(bool showDebugInfo = false) const;
 
         // Unlike most accessors in this class, domWindow() always creates a new DOMWindow if m_domWindow is null.
         // Callers that don't need a new DOMWindow to be created should use existingDOMWindow().
diff --git a/Source/WebCore/page/FrameView.cpp b/Source/WebCore/page/FrameView.cpp
index 8ab19ab..9cf2c57 100644
--- a/Source/WebCore/page/FrameView.cpp
+++ b/Source/WebCore/page/FrameView.cpp
@@ -141,13 +141,19 @@ FrameView::FrameView(Frame* frame)
     , m_shouldUpdateWhileOffscreen(true)
     , m_deferSetNeedsLayouts(0)
     , m_setNeedsLayoutWasDeferred(false)
-    , m_isRestoringFromBackForward(false)
     , m_scrollCorner(0)
 #if ENABLE(ANDROID_OVERFLOW_SCROLL)
     , m_hasOverflowScroll(false)
 #endif
 {
     init();
+
+    if (m_frame) {
+        if (Page* page = m_frame->page()) {
+            m_page = page;
+            m_page->addScrollableArea(this);
+        }
+    }
 }
 
 PassRefPtr<FrameView> FrameView::create(Frame* frame)
@@ -188,6 +194,9 @@ FrameView::~FrameView()
     ASSERT(!m_scrollCorner);
     ASSERT(m_actionScheduler->isEmpty());
 
+    if (m_page)
+        m_page->removeScrollableArea(this);
+
     if (m_frame) {
         ASSERT(m_frame->view() != this || !m_frame->contentRenderer());
         RenderPart* renderer = m_frame->ownerRenderer();
@@ -229,7 +238,6 @@ void FrameView::reset()
     m_isPainting = false;
     m_isVisuallyNonEmpty = false;
     m_firstVisuallyNonEmptyLayoutCallbackPending = true;
-    m_isRestoringFromBackForward = false;
     m_maintainScrollPositionAnchor = 0;
 }
 
@@ -255,6 +263,15 @@ void FrameView::resetScrollbars()
     setScrollbarsSuppressed(false);
 }
 
+void FrameView::resetScrollbarsAndClearContentsSize()
+{
+    resetScrollbars();
+
+    setScrollbarsSuppressed(true);
+    setContentsSize(IntSize());
+    setScrollbarsSuppressed(false);
+}
+
 void FrameView::init()
 {
     reset();
@@ -854,12 +871,7 @@ void FrameView::layout(bool allowSubtree)
 
         if (m_firstLayout || (hMode != currentHMode || vMode != currentVMode)) {
             if (m_firstLayout) {
-                if (!m_isRestoringFromBackForward)
-                    setScrollbarsSuppressed(true);
-                else {
-                    setScrollbarsSuppressed(false);
-                    m_isRestoringFromBackForward = false;
-                }
+                setScrollbarsSuppressed(true);
 
                 m_firstLayout = false;
                 m_firstLayoutCallbackPending = true;
@@ -931,8 +943,10 @@ void FrameView::layout(bool allowSubtree)
     // Now update the positions of all layers.
     beginDeferredRepaints();
     IntPoint cachedOffset;
-    layer->updateLayerPositions((m_doFullRepaint ? RenderLayer::DoFullRepaint : 0)
-                                | RenderLayer::CheckForRepaint
+    if (m_doFullRepaint)
+        root->view()->repaint(); // FIXME: This isn't really right, since the RenderView doesn't fully encompass the visibleContentRect(). It just happens
+                                 // to work out most of the time, since first layouts and printing don't have you scrolled anywhere.
+    layer->updateLayerPositions((m_doFullRepaint ? 0 : RenderLayer::CheckForRepaint)
                                 | RenderLayer::IsCompositingUpdateRoot
                                 | RenderLayer::UpdateCompositingLayers,
                                 subtree ? 0 : &cachedOffset);
@@ -2125,6 +2139,28 @@ void FrameView::didCompleteRubberBand(const IntSize& initialOverhang) const
     return page->chrome()->client()->didCompleteRubberBandForMainFrame(initialOverhang);
 }
 
+void FrameView::scrollbarStyleChanged()
+{
+    m_frame->page()->setNeedsRecalcStyleInAllFrames();
+}
+
+bool FrameView::shouldSuspendScrollAnimations() const
+{
+    return m_frame->loader()->state() != FrameStateComplete;
+}
+
+void FrameView::notifyPageThatContentAreaWillPaint() const
+{
+    Page* page = m_frame->page();
+    const HashSet<ScrollableArea*>* scrollableAreas = page->scrollableAreaSet();
+    if (!scrollableAreas)
+        return;
+
+    HashSet<ScrollableArea*>::const_iterator end = scrollableAreas->end(); 
+    for (HashSet<ScrollableArea*>::const_iterator it = scrollableAreas->begin(); it != end; ++it)
+        (*it)->scrollAnimator()->contentAreaWillPaint();
+}
+
 #if ENABLE(DASHBOARD_SUPPORT)
 void FrameView::updateDashboardRegions()
 {
@@ -2339,8 +2375,12 @@ void FrameView::paintContents(GraphicsContext* p, const IntRect& rect)
 
     // m_nodeToDraw is used to draw only one element (and its descendants)
     RenderObject* eltRenderer = m_nodeToDraw ? m_nodeToDraw->renderer() : 0;
+    RenderLayer* rootLayer = contentRenderer->layer();
 
-    contentRenderer->layer()->paint(p, rect, m_paintBehavior, eltRenderer);
+    rootLayer->paint(p, rect, m_paintBehavior, eltRenderer);
+
+    if (rootLayer->containsDirtyOverlayScrollbars())
+        rootLayer->paintOverlayScrollbars(p, rect, m_paintBehavior, eltRenderer);
 
     m_isPainting = false;
 
@@ -2468,7 +2508,6 @@ void FrameView::forceLayoutForPagination(const FloatSize& pageSize, float maximu
             root->setLogicalWidth(flooredPageLogicalWidth);
             root->setNeedsLayoutAndPrefWidthsRecalc();
             forceLayout();
-            root->clearLayoutOverflow();
             int docLogicalHeight = root->style()->isHorizontalWritingMode() ? root->docHeight() : root->docWidth();
             int docLogicalTop = root->style()->isHorizontalWritingMode() ? root->docTop() : root->docLeft();
             int docLogicalRight = root->style()->isHorizontalWritingMode() ? root->docRight() : root->docBottom();
@@ -2478,6 +2517,7 @@ void FrameView::forceLayoutForPagination(const FloatSize& pageSize, float maximu
             IntRect overflow(clippedLogicalLeft, docLogicalTop, flooredPageLogicalWidth, docLogicalHeight);
             if (!root->style()->isHorizontalWritingMode())
                 overflow = overflow.transposedRect();
+            root->clearLayoutOverflow();
             root->addLayoutOverflow(overflow); // This is how we clip in case we overflow again.
         }
     }
diff --git a/Source/WebCore/page/FrameView.h b/Source/WebCore/page/FrameView.h
index 8e79a3a..9af0552 100644
--- a/Source/WebCore/page/FrameView.h
+++ b/Source/WebCore/page/FrameView.h
@@ -138,6 +138,7 @@ public:
     void willMoveOffscreen();
 
     void resetScrollbars();
+    void resetScrollbarsAndClearContentsSize();
     void detachCustomScrollbars();
 
     void clear();
@@ -213,6 +214,7 @@ public:
     void setPaintBehavior(PaintBehavior);
     PaintBehavior paintBehavior() const;
     bool isPainting() const;
+    bool hasEverPainted() const { return m_lastPaintTime; }
     void setNodeToDraw(Node*);
 
     virtual void paintOverhangAreas(GraphicsContext*, const IntRect& horizontalOverhangArea, const IntRect& verticalOverhangArea, const IntRect& dirtyRect);
@@ -274,8 +276,7 @@ public:
     // FIXME: Remove this method once plugin loading is decoupled from layout.
     void flushAnyPendingPostLayoutTasks();
 
-    void setIsRestoringFromBackForward(bool isRestoring) { m_isRestoringFromBackForward = isRestoring; }
-    bool isRestoringFromBackForward() const { return m_isRestoringFromBackForward; }
+    virtual bool shouldSuspendScrollAnimations() const;
 
 protected:
     virtual bool scrollContentsFastPath(const IntSize& scrollDelta, const IntRect& rectToScroll, const IntRect& clipRect);
@@ -322,6 +323,10 @@ private:
     virtual void getTickmarks(Vector<IntRect>&) const;
     virtual void scrollTo(const IntSize&);
     virtual void didCompleteRubberBand(const IntSize&) const;
+    virtual void scrollbarStyleChanged();
+
+    virtual void notifyPageThatContentAreaWillPaint() const;
+    virtual void disconnectFromPage() { m_page = 0; }
 
     void deferredRepaintTimerFired(Timer<FrameView>*);
     void doDeferredRepaints();
@@ -415,13 +420,13 @@ private:
     bool m_isVisuallyNonEmpty;
     bool m_firstVisuallyNonEmptyLayoutCallbackPending;
 
-    bool m_isRestoringFromBackForward;
-
     RefPtr<Node> m_maintainScrollPositionAnchor;
 
     // Renderer to hold our custom scroll corner.
     RenderScrollbarPart* m_scrollCorner;
 
+    Page* m_page;
+
     static double s_deferredRepaintDelay;
     static double s_initialDeferredRepaintDelayDuringLoading;
     static double s_maxDeferredRepaintDelayDuringLoading;
diff --git a/Source/WebCore/page/Geolocation.cpp b/Source/WebCore/page/Geolocation.cpp
index 354dde3..f0dd76a 100644
--- a/Source/WebCore/page/Geolocation.cpp
+++ b/Source/WebCore/page/Geolocation.cpp
@@ -231,19 +231,35 @@ Geolocation::Geolocation(Frame* frame)
 
 Geolocation::~Geolocation()
 {
+    ASSERT(m_allowGeolocation != InProgress);
+    ASSERT(!m_frame);
 }
 
-void Geolocation::disconnectFrame()
+Page* Geolocation::page() const
+{
+    return m_frame ? m_frame->page() : 0;
+}
+
+void Geolocation::reset()
 {
-    if (m_frame && m_frame->page() && m_allowGeolocation == InProgress) {
+    Page* page = this->page();
+    if (page && m_allowGeolocation == InProgress) {
 #if ENABLE(CLIENT_BASED_GEOLOCATION)
-        m_frame->page()->geolocationController()->cancelPermissionRequest(this);
+        page->geolocationController()->cancelPermissionRequest(this);
 #else
-        m_frame->page()->chrome()->cancelGeolocationPermissionRequestForFrame(m_frame, this);
+        page->chrome()->cancelGeolocationPermissionRequestForFrame(m_frame, this);
 #endif
     }
+    // The frame may be moving to a new page and we want to get the permissions from the new page's client.
+    m_allowGeolocation = Unknown;
     cancelAllRequests();
     stopUpdating();
+}
+
+void Geolocation::disconnectFrame()
+{
+    // Once we are disconnected from the Frame, it is no longer possible to perform any operations.
+    reset();
     if (m_frame && m_frame->document())
         m_frame->document()->setUsingGeolocation(false);
     m_frame = 0;
@@ -252,10 +268,7 @@ void Geolocation::disconnectFrame()
 Geoposition* Geolocation::lastPosition()
 {
 #if ENABLE(CLIENT_BASED_GEOLOCATION)
-    if (!m_frame)
-        return 0;
-
-    Page* page = m_frame->page();
+    Page* page = this->page();
     if (!page)
         return 0;
 
@@ -594,10 +607,7 @@ void Geolocation::requestPermission()
     if (m_allowGeolocation > Unknown)
         return;
 
-    if (!m_frame)
-        return;
-
-    Page* page = m_frame->page();
+    Page* page = this->page();
     if (!page)
         return;
 
@@ -691,10 +701,7 @@ void Geolocation::geolocationServiceErrorOccurred(GeolocationService* service)
 bool Geolocation::startUpdating(GeoNotifier* notifier)
 {
 #if ENABLE(CLIENT_BASED_GEOLOCATION)
-    if (!m_frame)
-        return false;
-
-    Page* page = m_frame->page();
+    Page* page = this->page();
     if (!page)
         return false;
 
@@ -720,10 +727,7 @@ bool Geolocation::startUpdating(GeoNotifier* notifier)
 void Geolocation::stopUpdating()
 {
 #if ENABLE(CLIENT_BASED_GEOLOCATION)
-    if (!m_frame)
-        return;
-
-    Page* page = m_frame->page();
+    Page* page = this->page();
     if (!page)
         return;
 
@@ -764,6 +768,8 @@ namespace WebCore {
 
 void Geolocation::clearWatch(int) {}
 
+void Geolocation::reset() {}
+
 void Geolocation::disconnectFrame() {}
 
 Geolocation::Geolocation(Frame*) {}
diff --git a/Source/WebCore/page/Geolocation.h b/Source/WebCore/page/Geolocation.h
index 7c06ae4..b52ad45 100644
--- a/Source/WebCore/page/Geolocation.h
+++ b/Source/WebCore/page/Geolocation.h
@@ -58,6 +58,7 @@ public:
 
     ~Geolocation();
 
+    void reset();
     void disconnectFrame();
     
     void getCurrentPosition(PassRefPtr<PositionCallback>, PassRefPtr<PositionErrorCallback>, PassRefPtr<PositionOptions>);
@@ -86,6 +87,8 @@ private:
     
     Geolocation(Frame*);
 
+    Page* page() const;
+
     class GeoNotifier : public RefCounted<GeoNotifier> {
     public:
         static PassRefPtr<GeoNotifier> create(Geolocation* geolocation, PassRefPtr<PositionCallback> positionCallback, PassRefPtr<PositionErrorCallback> positionErrorCallback, PassRefPtr<PositionOptions> options) { return adoptRef(new GeoNotifier(geolocation, positionCallback, positionErrorCallback, options)); }
diff --git a/Source/WebCore/page/GeolocationController.cpp b/Source/WebCore/page/GeolocationController.cpp
index 764b913..b9533ca 100644
--- a/Source/WebCore/page/GeolocationController.cpp
+++ b/Source/WebCore/page/GeolocationController.cpp
@@ -41,12 +41,10 @@ GeolocationController::GeolocationController(Page* page, GeolocationClient* clie
 
 GeolocationController::~GeolocationController()
 {
-    if (m_client) {
-        if (!m_observers.isEmpty())
-            m_client->stopUpdating();
+    ASSERT(m_observers.isEmpty());
 
+    if (m_client)
         m_client->geolocationDestroyed();
-    }
 }
 
 void GeolocationController::addObserver(Geolocation* observer, bool enableHighAccuracy)
diff --git a/Source/WebCore/page/Navigator.cpp b/Source/WebCore/page/Navigator.cpp
index 53563b4..9526536 100644
--- a/Source/WebCore/page/Navigator.cpp
+++ b/Source/WebCore/page/Navigator.cpp
@@ -61,6 +61,12 @@ Navigator::~Navigator()
     disconnectFrame();
 }
 
+void Navigator::resetGeolocation()
+{
+    if (m_geolocation)
+        m_geolocation->reset();
+}
+
 void Navigator::disconnectFrame()
 {
     if (m_plugins) {
diff --git a/Source/WebCore/page/Navigator.h b/Source/WebCore/page/Navigator.h
index f7dc543..8514279 100644
--- a/Source/WebCore/page/Navigator.h
+++ b/Source/WebCore/page/Navigator.h
@@ -49,6 +49,7 @@ public:
     static PassRefPtr<Navigator> create(Frame* frame) { return adoptRef(new Navigator(frame)); }
     virtual ~Navigator();
 
+    void resetGeolocation();
     void disconnectFrame();
     Frame* frame() const { return m_frame; }
 
diff --git a/Source/WebCore/page/NavigatorBase.cpp b/Source/WebCore/page/NavigatorBase.cpp
index ca51a29..3ff195a 100644
--- a/Source/WebCore/page/NavigatorBase.cpp
+++ b/Source/WebCore/page/NavigatorBase.cpp
@@ -57,7 +57,7 @@
 #endif // ifndef WEBCORE_NAVIGATOR_PRODUCT_SUB
 
 #ifndef WEBCORE_NAVIGATOR_VENDOR
-#define WEBCORE_NAVIGATOR_VENDOR "Apple Computer, Inc."
+#define WEBCORE_NAVIGATOR_VENDOR "Apple Inc."
 #endif // ifndef WEBCORE_NAVIGATOR_VENDOR
 
 #ifndef WEBCORE_NAVIGATOR_VENDOR_SUB
diff --git a/Source/WebCore/page/Page.cpp b/Source/WebCore/page/Page.cpp
index f8d6168..63227e4 100644
--- a/Source/WebCore/page/Page.cpp
+++ b/Source/WebCore/page/Page.cpp
@@ -177,6 +177,7 @@ Page::Page(const PageClients& pageClients)
     , m_canStartMedia(true)
     , m_viewMode(ViewModeWindowed)
     , m_minimumTimerInterval(Settings::defaultMinDOMTimerInterval())
+    , m_isEditable(false)
 {
     if (!allPages) {
         allPages = new HashSet<Page*>;
@@ -209,6 +210,12 @@ Page::~Page()
     for (Frame* frame = mainFrame(); frame; frame = frame->tree()->traverseNext())
         frame->pageDestroyed();
 
+    if (m_scrollableAreaSet) {
+        ScrollableAreaSet::const_iterator end = m_scrollableAreaSet->end(); 
+        for (ScrollableAreaSet::const_iterator it = m_scrollableAreaSet->begin(); it != end; ++it)
+            (*it)->disconnectFromPage();
+    }
+
     m_editorClient->pageDestroyed();
 
     InspectorInstrumentation::inspectedPageDestroyed(this);
@@ -402,6 +409,12 @@ void Page::scheduleForcedStyleRecalcForAllPages()
             frame->document()->scheduleForcedStyleRecalc();
 }
 
+void Page::setNeedsRecalcStyleInAllFrames()
+{
+    for (Frame* frame = mainFrame(); frame; frame = frame->tree()->traverseNext())
+        frame->document()->styleSelectorChanged(DeferRecalcStyle);
+}
+
 void Page::updateViewportArguments()
 {
     if (!mainFrame() || !mainFrame()->document() || mainFrame()->document()->viewportArguments() == m_viewportArguments)
@@ -910,6 +923,27 @@ void Page::didStopPlugin(HaltablePlugin* obj)
         m_pluginHalter->didStopPlugin(obj);
 }
 
+void Page::addScrollableArea(ScrollableArea* scrollableArea)
+{
+    if (!m_scrollableAreaSet)
+        m_scrollableAreaSet = adoptPtr(new ScrollableAreaSet);
+    m_scrollableAreaSet->add(scrollableArea);
+}
+
+void Page::removeScrollableArea(ScrollableArea* scrollableArea)
+{
+    if (!m_scrollableAreaSet)
+        return;
+    m_scrollableAreaSet->remove(scrollableArea);
+}
+
+bool Page::containsScrollableArea(ScrollableArea* scrollableArea) const
+{
+    if (!m_scrollableAreaSet)
+        return false;
+    return m_scrollableAreaSet->contains(scrollableArea);
+}
+
 #if !ASSERT_DISABLED
 void Page::checkFrameCountConsistency() const
 {
diff --git a/Source/WebCore/page/Page.h b/Source/WebCore/page/Page.h
index 4498d36..8307123 100644
--- a/Source/WebCore/page/Page.h
+++ b/Source/WebCore/page/Page.h
@@ -70,6 +70,7 @@ namespace WebCore {
     class ProgressTracker;
     class RenderTheme;
     class VisibleSelection;
+    class ScrollableArea;
     class SelectionController;
     class Settings;
     class SharedGraphicsContext3D;
@@ -118,6 +119,8 @@ namespace WebCore {
         Page(const PageClients&);
         ~Page();
 
+        void setNeedsRecalcStyleInAllFrames();
+
         RenderTheme* theme() const { return m_theme.get(); };
 
         ViewportArguments viewportArguments() const { return m_viewportArguments; }
@@ -279,11 +282,21 @@ namespace WebCore {
         void setJavaScriptURLsAreAllowed(bool);
         bool javaScriptURLsAreAllowed() const;
 
+        typedef HashSet<ScrollableArea*> ScrollableAreaSet;
+        void addScrollableArea(ScrollableArea*);
+        void removeScrollableArea(ScrollableArea*);
+        bool containsScrollableArea(ScrollableArea*) const;
+        const ScrollableAreaSet* scrollableAreaSet() const { return m_scrollableAreaSet.get(); }
+
         // Don't allow more than a certain number of frames in a page.
         // This seems like a reasonable upper bound, and otherwise mutually
         // recursive frameset pages can quickly bring the program to its knees
         // with exponential growth in the number of frames.
         static const int maxNumberOfFrames = 1000;
+
+        void setEditable(bool isEditable) { m_isEditable = isEditable; }
+        bool isEditable() { return m_isEditable; }
+
     private:
         void initGroup();
 
@@ -386,6 +399,10 @@ namespace WebCore {
         ViewportArguments m_viewportArguments;
 
         double m_minimumTimerInterval;
+
+        OwnPtr<ScrollableAreaSet> m_scrollableAreaSet;
+
+        bool m_isEditable;
     };
 
 } // namespace WebCore
diff --git a/Source/WebCore/page/PageGroup.cpp b/Source/WebCore/page/PageGroup.cpp
index 96e7301..d53de08 100644
--- a/Source/WebCore/page/PageGroup.cpp
+++ b/Source/WebCore/page/PageGroup.cpp
@@ -33,6 +33,7 @@
 #include "GroupSettings.h"
 #include "IDBFactoryBackendInterface.h"
 #include "Page.h"
+#include "SecurityOrigin.h"
 #include "Settings.h"
 #include "StorageNamespace.h"
 
@@ -115,12 +116,19 @@ void PageGroup::closeLocalStorage()
 #endif
 }
 
+<<<<<<< HEAD
 #if ENABLE(DOM_STORAGE) && defined(ANDROID)
 void PageGroup::clearDomStorage()
+=======
+#if ENABLE(DOM_STORAGE)
+
+void PageGroup::clearLocalStorageForAllOrigins()
+>>>>>>> webkit.org at r82507
 {
     if (!pageGroups)
         return;
 
+<<<<<<< HEAD
 
     PageGroupMap::iterator end = pageGroups->end();
 
@@ -198,6 +206,47 @@ void PageGroup::removeLocalStorage()
 
     m_localStorage = 0;
 }
+=======
+    PageGroupMap::iterator end = pageGroups->end();
+    for (PageGroupMap::iterator it = pageGroups->begin(); it != end; ++it) {
+        if (it->second->hasLocalStorage())
+            it->second->localStorage()->clearAllOriginsForDeletion();
+    }
+}
+
+void PageGroup::clearLocalStorageForOrigin(SecurityOrigin* origin)
+{
+    if (!pageGroups)
+        return;
+
+    PageGroupMap::iterator end = pageGroups->end();
+    for (PageGroupMap::iterator it = pageGroups->begin(); it != end; ++it) {
+        if (it->second->hasLocalStorage())
+            it->second->localStorage()->clearOriginForDeletion(origin);
+    }    
+}
+    
+void PageGroup::syncLocalStorage()
+{
+    if (!pageGroups)
+        return;
+
+    PageGroupMap::iterator end = pageGroups->end();
+    for (PageGroupMap::iterator it = pageGroups->begin(); it != end; ++it) {
+        if (it->second->hasLocalStorage())
+            it->second->localStorage()->sync();
+    }
+}
+
+unsigned PageGroup::numberOfPageGroups()
+{
+    if (!pageGroups)
+        return 0;
+
+    return pageGroups->size();
+}
+
+>>>>>>> webkit.org at r82507
 #endif
 
 void PageGroup::addPage(Page* page)
@@ -299,6 +348,7 @@ StorageNamespace* PageGroup::localStorage()
 
     return m_localStorage.get();
 }
+
 #endif
 
 #if ENABLE(INDEXED_DATABASE)
diff --git a/Source/WebCore/page/PageGroup.h b/Source/WebCore/page/PageGroup.h
index aa600a5..71e22a1 100644
--- a/Source/WebCore/page/PageGroup.h
+++ b/Source/WebCore/page/PageGroup.h
@@ -39,6 +39,7 @@ namespace WebCore {
     class GroupSettings;
     class IDBFactoryBackendInterface;
     class Page;
+    class SecurityOrigin;
     class StorageNamespace;
 
     class PageGroup {
@@ -49,7 +50,16 @@ namespace WebCore {
         ~PageGroup();
 
         static PageGroup* pageGroup(const String& groupName);
+
         static void closeLocalStorage();
+
+#if ENABLE(DOM_STORAGE)
+        static void clearLocalStorageForAllOrigins();
+        static void clearLocalStorageForOrigin(SecurityOrigin*);
+        // DumpRenderTree helper that triggers a StorageArea sync.
+        static void syncLocalStorage();
+#endif
+        static unsigned numberOfPageGroups();
         
 #if ENABLE(DOM_STORAGE) && defined(ANDROID)
         static void clearDomStorage();
diff --git a/Source/WebCore/page/PageGroupLoadDeferrer.cpp b/Source/WebCore/page/PageGroupLoadDeferrer.cpp
index 292b4cd..dfbb244 100644
--- a/Source/WebCore/page/PageGroupLoadDeferrer.cpp
+++ b/Source/WebCore/page/PageGroupLoadDeferrer.cpp
@@ -21,11 +21,11 @@
 #include "config.h"
 #include "PageGroupLoadDeferrer.h"
 
-#include "AsyncScriptRunner.h"
 #include "DocumentParser.h"
 #include "Frame.h"
 #include "Page.h"
 #include "PageGroup.h"
+#include "ScriptRunner.h"
 #include <wtf/HashSet.h>
 
 namespace WebCore {
@@ -39,8 +39,23 @@ PageGroupLoadDeferrer::PageGroupLoadDeferrer(Page* page, bool deferSelf)
     HashSet<Page*>::const_iterator end = pages.end();
     for (HashSet<Page*>::const_iterator it = pages.begin(); it != end; ++it) {
         Page* otherPage = *it;
-        if ((deferSelf || otherPage != page) && !otherPage->defersLoading())
-            m_deferredFrames.append(otherPage->mainFrame());
+        if ((deferSelf || otherPage != page)) {
+            if (!otherPage->defersLoading()) {
+                m_deferredFrames.append(otherPage->mainFrame());
+
+                // This code is not logically part of load deferring, but we do not want JS code executed beneath modal
+                // windows or sheets, which is exactly when PageGroupLoadDeferrer is used.
+                // NOTE: if PageGroupLoadDeferrer is ever used for tasks other than showing a modal window or sheet,
+                // the constructor will need to take a ActiveDOMObject::ReasonForSuspension.
+                for (Frame* frame = otherPage->mainFrame(); frame; frame = frame->tree()->traverseNext()) {
+                    frame->document()->suspendScriptedAnimationControllerCallbacks();
+                    frame->document()->suspendActiveDOMObjects(ActiveDOMObject::WillShowDialog);
+                    frame->document()->scriptRunner()->suspend();
+                    if (DocumentParser* parser = frame->document()->parser())
+                        parser->suspendScheduledTasks();
+                }
+            }
+        }
     }
 
     size_t count = m_deferredFrames.size();
@@ -52,8 +67,17 @@ PageGroupLoadDeferrer::PageGroupLoadDeferrer(Page* page, bool deferSelf)
 PageGroupLoadDeferrer::~PageGroupLoadDeferrer()
 {
     for (size_t i = 0; i < m_deferredFrames.size(); ++i) {
-        if (Page* page = m_deferredFrames[i]->page())
+        if (Page* page = m_deferredFrames[i]->page()) {
             page->setDefersLoading(false);
+
+            for (Frame* frame = page->mainFrame(); frame; frame = frame->tree()->traverseNext()) {
+                frame->document()->resumeActiveDOMObjects();
+                frame->document()->resumeScriptedAnimationControllerCallbacks();
+                frame->document()->scriptRunner()->resume();
+                if (DocumentParser* parser = frame->document()->parser())
+                    parser->resumeScheduledTasks();
+            }
+        }
     }
 }
 
diff --git a/Source/WebCore/page/PrintContext.cpp b/Source/WebCore/page/PrintContext.cpp
index da29f0e..6c8b312 100644
--- a/Source/WebCore/page/PrintContext.cpp
+++ b/Source/WebCore/page/PrintContext.cpp
@@ -282,16 +282,16 @@ String PrintContext::pageProperty(Frame* frame, const char* propertyName, int pa
     if (!strcmp(propertyName, "margin-left")) {
         if (style->marginLeft().isAuto())
             return String("auto");
-        return String::number(style->marginLeft().rawValue());
+        return String::number(style->marginLeft().value());
     }
     if (!strcmp(propertyName, "line-height"))
-        return String::number(style->lineHeight().rawValue());
+        return String::number(style->lineHeight().value());
     if (!strcmp(propertyName, "font-size"))
         return String::number(style->fontDescription().computedPixelSize());
     if (!strcmp(propertyName, "font-family"))
         return style->fontDescription().family().family().string();
     if (!strcmp(propertyName, "size"))
-        return makeString(String::number(style->pageSize().width().rawValue()), ' ', String::number(style->pageSize().height().rawValue()));
+        return makeString(String::number(style->pageSize().width().value()), ' ', String::number(style->pageSize().height().value()));
 
     return makeString("pageProperty() unimplemented for: ", propertyName);
 }
diff --git a/Source/WebCore/page/SecurityOrigin.cpp b/Source/WebCore/page/SecurityOrigin.cpp
index 977e860..ddd42ea 100644
--- a/Source/WebCore/page/SecurityOrigin.cpp
+++ b/Source/WebCore/page/SecurityOrigin.cpp
@@ -79,8 +79,17 @@ SecurityOrigin::SecurityOrigin(const KURL& url, SandboxFlags sandboxFlags)
     if (m_protocol == "about" || m_protocol == "javascript")
         m_protocol = "";
 
+#if ENABLE(BLOB) || ENABLE(FILE_SYSTEM)
+    bool isBlobOrFileSystemProtocol = false;
+#if ENABLE(BLOB)
+    if (m_protocol == BlobURL::blobProtocol())
+        isBlobOrFileSystemProtocol = true;
+#endif
 #if ENABLE(FILE_SYSTEM)
-    if (m_protocol == "filesystem") {
+    if (m_protocol == "filesystem")
+        isBlobOrFileSystemProtocol = true;
+#endif
+    if (isBlobOrFileSystemProtocol) {
         KURL originURL(ParsedURLString, url.path());
         if (originURL.isValid()) {
             m_protocol = originURL.protocol().lower();
@@ -102,7 +111,13 @@ SecurityOrigin::SecurityOrigin(const KURL& url, SandboxFlags sandboxFlags)
     m_canLoadLocalResources = isLocal();
     if (m_canLoadLocalResources) {
         // Directories should never be readable.
-        if (!url.hasPath() || url.path().endsWith("/"))
+        // Note that we do not do this check for blob or filesystem url because its origin is file:/// when it is created from local file urls.
+#if ENABLE(BLOB) || ENABLE(FILE_SYSTEM)
+        bool doDirectoryCheck = !isBlobOrFileSystemProtocol;
+#else
+        bool doDirectoryCheck = true;
+#endif
+        if (doDirectoryCheck && (!url.hasPath() || url.path().endsWith("/")))
             m_isUnique = true;
         // Store the path in case we are doing per-file origin checking.
         m_filePath = url.path();
@@ -137,10 +152,6 @@ PassRefPtr<SecurityOrigin> SecurityOrigin::create(const KURL& url, SandboxFlags
 {
     if (!url.isValid())
         return adoptRef(new SecurityOrigin(KURL(), sandboxFlags));
-#if ENABLE(BLOB)
-    if (url.protocolIs(BlobURL::blobProtocol()))
-        return adoptRef(new SecurityOrigin(BlobURL::getOrigin(url), sandboxFlags));
-#endif
     return adoptRef(new SecurityOrigin(url, sandboxFlags));
 }
 
@@ -253,12 +264,7 @@ bool SecurityOrigin::canRequest(const KURL& url) const
 
     RefPtr<SecurityOrigin> targetOrigin = SecurityOrigin::create(url);
 
-    bool doUniqueOriginCheck = true;
-#if ENABLE(BLOB)
-    // For blob scheme, we want to ignore this check.
-    doUniqueOriginCheck = !url.protocolIs(BlobURL::blobProtocol());
-#endif
-    if (doUniqueOriginCheck && targetOrigin->isUnique())
+    if (targetOrigin->isUnique())
         return false;
 
     // We call isSameSchemeHostPort here instead of canAccess because we want
diff --git a/Source/WebCore/page/SecurityOrigin.h b/Source/WebCore/page/SecurityOrigin.h
index f27c593..262dd8d 100644
--- a/Source/WebCore/page/SecurityOrigin.h
+++ b/Source/WebCore/page/SecurityOrigin.h
@@ -31,14 +31,14 @@
 
 #include "FrameLoaderTypes.h"
 #include "PlatformString.h"
-#include <wtf/ThreadSafeShared.h>
+#include <wtf/ThreadSafeRefCounted.h>
 
 namespace WebCore {
 
 class Document;
 class KURL;
 
-class SecurityOrigin : public ThreadSafeShared<SecurityOrigin> {
+class SecurityOrigin : public ThreadSafeRefCounted<SecurityOrigin> {
 public:
     static PassRefPtr<SecurityOrigin> createFromDatabaseIdentifier(const String&);
     static PassRefPtr<SecurityOrigin> createFromString(const String&);
diff --git a/Source/WebCore/page/SecurityOriginHash.h b/Source/WebCore/page/SecurityOriginHash.h
index c2ebdd1..db3845c 100644
--- a/Source/WebCore/page/SecurityOriginHash.h
+++ b/Source/WebCore/page/SecurityOriginHash.h
@@ -43,7 +43,7 @@ struct SecurityOriginHash {
             origin->host().impl() ? origin->host().impl()->hash() : 0,
             origin->port()
         };
-        return WTF::StringHasher::createBlobHash<sizeof(hashCodes)>(hashCodes);
+        return StringHasher::hashMemory<sizeof(hashCodes)>(hashCodes);
     }
     static unsigned hash(const RefPtr<SecurityOrigin>& origin)
     {
diff --git a/Source/WebCore/page/Settings.cpp b/Source/WebCore/page/Settings.cpp
index f0b489a..eb8c903 100644
--- a/Source/WebCore/page/Settings.cpp
+++ b/Source/WebCore/page/Settings.cpp
@@ -45,12 +45,6 @@ using namespace std;
 
 namespace WebCore {
 
-static void setNeedsRecalcStyleInAllFrames(Page* page)
-{
-    for (Frame* frame = page->mainFrame(); frame; frame = frame->tree()->traverseNext())
-        frame->document()->styleSelectorChanged(DeferRecalcStyle);
-}
-
 static void setLoadsImagesAutomaticallyInAllFrames(Page* page)
 {
     for (Frame* frame = page->mainFrame(); frame; frame = frame->tree()->traverseNext())
@@ -94,6 +88,7 @@ Settings::Settings(Page* page)
     , m_minimumLogicalFontSize(0)
     , m_defaultFontSize(0)
     , m_defaultFixedFontSize(0)
+    , m_validationMessageTimerMagnification(50)
     , m_maximumDecodedImageSize(numeric_limits<size_t>::max())
 #if ENABLE(DOM_STORAGE)
     , m_sessionStorageQuota(StorageMap::noQuota)
@@ -146,6 +141,7 @@ Settings::Settings(Page* page)
     , m_enforceCSSMIMETypeInNoQuirksMode(true)
     , m_usesEncodingDetector(false)
     , m_allowScriptsToCloseWindows(false)
+    , m_canvasUsesAcceleratedDrawing(false)
     , m_acceleratedDrawingEnabled(false)
     // FIXME: This should really be disabled by default as it makes platforms that don't support the feature download files
     // they can't use by. Leaving enabled for now to not change existing behavior.
@@ -177,6 +173,7 @@ Settings::Settings(Page* page)
     , m_usePreHTML5ParserQuirks(false)
     , m_hyperlinkAuditingEnabled(false)
     , m_crossOriginCheckInGetMatchedCSSRulesDisabled(false)
+<<<<<<< HEAD
 #ifdef ANDROID_LAYOUT
     , m_useWideViewport(false)
 #endif
@@ -192,6 +189,10 @@ Settings::Settings(Page* page)
 #ifdef ANDROID_PLUGINS
     , m_pluginsOnDemand(false)
 #endif
+=======
+    , m_useQuickLookResourceCachingQuirks(false)
+    , m_forceCompositingMode(false)
+>>>>>>> webkit.org at r82507
 {
     // A Frame may not have been created yet, so we initialize the AtomicString 
     // hash before trying to use it.
@@ -208,7 +209,7 @@ void Settings::setStandardFontFamily(const AtomicString& standardFontFamily)
         return;
 
     m_standardFontFamily = standardFontFamily;
-    setNeedsRecalcStyleInAllFrames(m_page);
+    m_page->setNeedsRecalcStyleInAllFrames();
 }
 
 void Settings::setFixedFontFamily(const AtomicString& fixedFontFamily)
@@ -217,7 +218,7 @@ void Settings::setFixedFontFamily(const AtomicString& fixedFontFamily)
         return;
         
     m_fixedFontFamily = fixedFontFamily;
-    setNeedsRecalcStyleInAllFrames(m_page);
+    m_page->setNeedsRecalcStyleInAllFrames();
 }
 
 void Settings::setSerifFontFamily(const AtomicString& serifFontFamily)
@@ -226,7 +227,7 @@ void Settings::setSerifFontFamily(const AtomicString& serifFontFamily)
         return;
         
     m_serifFontFamily = serifFontFamily;
-    setNeedsRecalcStyleInAllFrames(m_page);
+    m_page->setNeedsRecalcStyleInAllFrames();
 }
 
 void Settings::setSansSerifFontFamily(const AtomicString& sansSerifFontFamily)
@@ -235,7 +236,7 @@ void Settings::setSansSerifFontFamily(const AtomicString& sansSerifFontFamily)
         return;
         
     m_sansSerifFontFamily = sansSerifFontFamily; 
-    setNeedsRecalcStyleInAllFrames(m_page);
+    m_page->setNeedsRecalcStyleInAllFrames();
 }
 
 void Settings::setCursiveFontFamily(const AtomicString& cursiveFontFamily)
@@ -244,7 +245,7 @@ void Settings::setCursiveFontFamily(const AtomicString& cursiveFontFamily)
         return;
         
     m_cursiveFontFamily = cursiveFontFamily;
-    setNeedsRecalcStyleInAllFrames(m_page);
+    m_page->setNeedsRecalcStyleInAllFrames();
 }
 
 void Settings::setFantasyFontFamily(const AtomicString& fantasyFontFamily)
@@ -253,7 +254,7 @@ void Settings::setFantasyFontFamily(const AtomicString& fantasyFontFamily)
         return;
         
     m_fantasyFontFamily = fantasyFontFamily;
-    setNeedsRecalcStyleInAllFrames(m_page);
+    m_page->setNeedsRecalcStyleInAllFrames();
 }
 
 void Settings::setMinimumFontSize(int minimumFontSize)
@@ -262,7 +263,7 @@ void Settings::setMinimumFontSize(int minimumFontSize)
         return;
 
     m_minimumFontSize = minimumFontSize;
-    setNeedsRecalcStyleInAllFrames(m_page);
+    m_page->setNeedsRecalcStyleInAllFrames();
 }
 
 void Settings::setMinimumLogicalFontSize(int minimumLogicalFontSize)
@@ -271,7 +272,7 @@ void Settings::setMinimumLogicalFontSize(int minimumLogicalFontSize)
         return;
 
     m_minimumLogicalFontSize = minimumLogicalFontSize;
-    setNeedsRecalcStyleInAllFrames(m_page);
+    m_page->setNeedsRecalcStyleInAllFrames();
 }
 
 void Settings::setDefaultFontSize(int defaultFontSize)
@@ -280,7 +281,7 @@ void Settings::setDefaultFontSize(int defaultFontSize)
         return;
 
     m_defaultFontSize = defaultFontSize;
-    setNeedsRecalcStyleInAllFrames(m_page);
+    m_page->setNeedsRecalcStyleInAllFrames();
 }
 
 void Settings::setDefaultFixedFontSize(int defaultFontSize)
@@ -289,7 +290,7 @@ void Settings::setDefaultFixedFontSize(int defaultFontSize)
         return;
 
     m_defaultFixedFontSize = defaultFontSize;
-    setNeedsRecalcStyleInAllFrames(m_page);
+    m_page->setNeedsRecalcStyleInAllFrames();
 }
 
 #ifdef ANDROID_BLOCK_NETWORK_IMAGE
@@ -414,7 +415,7 @@ void Settings::setTextAreasAreResizable(bool textAreasAreResizable)
         return;
 
     m_textAreasAreResizable = textAreasAreResizable;
-    setNeedsRecalcStyleInAllFrames(m_page);
+    m_page->setNeedsRecalcStyleInAllFrames();
 }
 
 void Settings::setEditableLinkBehavior(EditableLinkBehavior editableLinkBehavior)
@@ -708,7 +709,7 @@ void Settings::setAuthorAndUserStylesEnabled(bool authorAndUserStylesEnabled)
         return;
 
     m_authorAndUserStylesEnabled = authorAndUserStylesEnabled;
-    setNeedsRecalcStyleInAllFrames(m_page);
+    m_page->setNeedsRecalcStyleInAllFrames();
 }
 
 void Settings::setFontRenderingMode(FontRenderingMode mode)
@@ -716,7 +717,7 @@ void Settings::setFontRenderingMode(FontRenderingMode mode)
     if (fontRenderingMode() == mode)
         return;
     m_fontRenderingMode = mode;
-    setNeedsRecalcStyleInAllFrames(m_page);
+    m_page->setNeedsRecalcStyleInAllFrames();
 }
 
 FontRenderingMode Settings::fontRenderingMode() const
@@ -818,7 +819,12 @@ void Settings::setAcceleratedCompositingEnabled(bool enabled)
         return;
         
     m_acceleratedCompositingEnabled = enabled;
-    setNeedsRecalcStyleInAllFrames(m_page);
+    m_page->setNeedsRecalcStyleInAllFrames();
+}
+
+void Settings::setCanvasUsesAcceleratedDrawing(bool enabled)
+{
+    m_canvasUsesAcceleratedDrawing = enabled;
 }
 
 void Settings::setAcceleratedDrawingEnabled(bool enabled)
@@ -857,7 +863,7 @@ void Settings::setShowDebugBorders(bool enabled)
         return;
         
     m_showDebugBorders = enabled;
-    setNeedsRecalcStyleInAllFrames(m_page);
+    m_page->setNeedsRecalcStyleInAllFrames();
 }
 
 void Settings::setShowRepaintCounter(bool enabled)
@@ -866,7 +872,7 @@ void Settings::setShowRepaintCounter(bool enabled)
         return;
         
     m_showRepaintCounter = enabled;
-    setNeedsRecalcStyleInAllFrames(m_page);
+    m_page->setNeedsRecalcStyleInAllFrames();
 }
 
 void Settings::setExperimentalNotificationsEnabled(bool enabled)
diff --git a/Source/WebCore/page/Settings.h b/Source/WebCore/page/Settings.h
index 0e93249..e8e791a 100644
--- a/Source/WebCore/page/Settings.h
+++ b/Source/WebCore/page/Settings.h
@@ -351,6 +351,9 @@ namespace WebCore {
         void setXSSAuditorEnabled(bool);
         bool xssAuditorEnabled() const { return m_xssAuditorEnabled; }
 
+        void setCanvasUsesAcceleratedDrawing(bool);
+        bool canvasUsesAcceleratedDrawing() const { return m_canvasUsesAcceleratedDrawing; }
+
         void setAcceleratedDrawingEnabled(bool);
         bool acceleratedDrawingEnabled() const { return m_acceleratedDrawingEnabled; }
         
@@ -427,6 +430,14 @@ namespace WebCore {
         // and http://webkit.org/b/40908
         void setInteractiveFormValidationEnabled(bool flag) { m_interactiveFormValidation = flag; }
         bool interactiveFormValidationEnabled() const { return m_interactiveFormValidation; }
+
+        // Sets the maginication value for validation message timer.
+        // If the maginication value is N, a validation message disappears
+        // automatically after <message length> * N / 1000 seconds. If N is
+        // equal to or less than 0, a validation message doesn't disappears
+        // automaticaly. The default value is 50.
+        void setValidationMessageTimerMagnification(int newValue) { m_validationMessageTimerMagnification = newValue; }
+        int validationMessageTimerMaginification() const { return m_validationMessageTimerMagnification; }
         
         void setUsePreHTML5ParserQuirks(bool flag) { m_usePreHTML5ParserQuirks = flag; }
         bool usePreHTML5ParserQuirks() const { return m_usePreHTML5ParserQuirks; }
@@ -436,6 +447,12 @@ namespace WebCore {
 
         void setCrossOriginCheckInGetMatchedCSSRulesDisabled(bool flag) { m_crossOriginCheckInGetMatchedCSSRulesDisabled = flag; }
         bool crossOriginCheckInGetMatchedCSSRulesDisabled() const { return m_crossOriginCheckInGetMatchedCSSRulesDisabled; }
+        
+        void setUseQuickLookResourceCachingQuirks(bool flag) { m_useQuickLookResourceCachingQuirks = flag; }
+        bool useQuickLookResourceCachingQuirks() const { return m_useQuickLookResourceCachingQuirks; }
+
+        void setForceCompositingMode(bool flag) { m_forceCompositingMode = flag; }
+        bool forceCompositingMode() { return m_forceCompositingMode; }
 
 #if ENABLE(WEB_AUTOFILL)
         void setAutoFillEnabled(bool flag) { m_autoFillEnabled = flag; }
@@ -461,6 +478,7 @@ namespace WebCore {
         int m_minimumLogicalFontSize;
         int m_defaultFontSize;
         int m_defaultFixedFontSize;
+        int m_validationMessageTimerMagnification;
         size_t m_maximumDecodedImageSize;
 #if ENABLE(DOM_STORAGE)
         unsigned m_sessionStorageQuota;
@@ -527,6 +545,7 @@ namespace WebCore {
         bool m_enforceCSSMIMETypeInNoQuirksMode : 1;
         bool m_usesEncodingDetector : 1;
         bool m_allowScriptsToCloseWindows : 1;
+        bool m_canvasUsesAcceleratedDrawing : 1;
         bool m_acceleratedDrawingEnabled : 1;
         bool m_downloadableBinaryFontsEnabled : 1;
         bool m_xssAuditorEnabled : 1;
@@ -556,6 +575,7 @@ namespace WebCore {
         bool m_usePreHTML5ParserQuirks: 1;
         bool m_hyperlinkAuditingEnabled : 1;
         bool m_crossOriginCheckInGetMatchedCSSRulesDisabled : 1;
+<<<<<<< HEAD
 #ifdef ANDROID_META_SUPPORT
         // default is yes
         bool m_viewport_user_scalable : 1;
@@ -585,6 +605,10 @@ namespace WebCore {
 #ifdef ANDROID_PLUGINS
         bool m_pluginsOnDemand : 1;
 #endif
+=======
+        bool m_useQuickLookResourceCachingQuirks : 1;
+        bool m_forceCompositingMode : 1;
+>>>>>>> webkit.org at r82507
 
 #if USE(SAFARI_THEME)
         static bool gShouldPaintNativeControls;
diff --git a/Source/WebCore/page/WebKitAnimation.cpp b/Source/WebCore/page/WebKitAnimation.cpp
new file mode 100644
index 0000000..ff7102f
--- /dev/null
+++ b/Source/WebCore/page/WebKitAnimation.cpp
@@ -0,0 +1,120 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "WebKitAnimation.h"
+
+#include "Animation.h"
+#include "AnimationBase.h"
+#include "RenderStyle.h"
+
+using namespace std;
+
+namespace WebCore {
+
+WebKitAnimation::WebKitAnimation(PassRefPtr<KeyframeAnimation> keyframeAnimation)
+    : m_keyframeAnimation(keyframeAnimation)
+{
+}
+
+String WebKitAnimation::name() const
+{
+    return m_keyframeAnimation->animation()->name();
+}
+
+double WebKitAnimation::duration() const
+{
+    return m_keyframeAnimation->duration();
+}
+
+double WebKitAnimation::elapsedTime() const
+{
+    return m_keyframeAnimation->getElapsedTime();
+}
+
+void WebKitAnimation::setElapsedTime(double time)
+{
+    m_keyframeAnimation->setElapsedTime(time);
+}
+
+double WebKitAnimation::delay() const
+{
+    return m_keyframeAnimation->animation()->delay();
+}
+
+int WebKitAnimation::iterationCount() const
+{
+    return m_keyframeAnimation->animation()->iterationCount();
+}
+
+bool WebKitAnimation::paused() const
+{
+    return m_keyframeAnimation->paused();
+}
+
+bool WebKitAnimation::ended() const
+{
+    int iterations = iterationCount();
+    if (iterations == Animation::IterationCountInfinite)
+        return false;
+    return m_keyframeAnimation->getElapsedTime() > (m_keyframeAnimation->duration() * iterations);
+}
+
+WebKitAnimation::Direction WebKitAnimation::direction() const
+{
+    if (m_keyframeAnimation->animation()->direction() == Animation::AnimationDirectionNormal)
+        return DIRECTION_NORMAL;
+    return DIRECTION_ALTERNATE;
+}
+
+WebKitAnimation::FillMode WebKitAnimation::fillMode() const
+{
+    switch (m_keyframeAnimation->animation()->fillMode()) {
+    case AnimationFillModeNone:
+        return FILL_NONE;
+        break;
+    case AnimationFillModeForwards:
+        return FILL_FORWARDS;
+        break;
+    case AnimationFillModeBackwards:
+        return FILL_BACKWARDS;
+        break;
+    default:
+        return FILL_BOTH;
+        break;
+    }
+}
+
+void WebKitAnimation::pause()
+{
+    m_keyframeAnimation->pause();
+}
+
+void WebKitAnimation::play()
+{
+    m_keyframeAnimation->play();
+}
+
+}
diff --git a/Source/WebCore/page/WebKitAnimation.h b/Source/WebCore/page/WebKitAnimation.h
new file mode 100644
index 0000000..6bea1e5
--- /dev/null
+++ b/Source/WebCore/page/WebKitAnimation.h
@@ -0,0 +1,81 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef WebKitAnimation_h
+#define WebKitAnimation_h
+
+#include "Animation.h"
+#include "AnimationBase.h"
+#include "KeyframeAnimation.h"
+#include "RenderStyle.h"
+
+namespace WebCore {
+
+class WebKitAnimation : public RefCounted<WebKitAnimation> {
+public:
+
+    static PassRefPtr<WebKitAnimation> create(PassRefPtr<KeyframeAnimation> keyframeAnimation)
+    {
+        return adoptRef(new WebKitAnimation(keyframeAnimation));
+    }
+
+    virtual ~WebKitAnimation() { }
+
+    // DOM API
+
+    String name() const;
+
+    double duration() const;
+
+    double elapsedTime() const;
+    void setElapsedTime(double);
+
+    double delay() const;
+    int iterationCount() const;
+
+    bool paused() const;
+    bool ended() const;
+
+    // direction
+    enum Direction { DIRECTION_NORMAL, DIRECTION_ALTERNATE };
+    Direction direction() const;
+
+    // fill mode
+    enum FillMode { FILL_NONE, FILL_BACKWARDS, FILL_FORWARDS, FILL_BOTH };
+    FillMode fillMode() const;
+
+    void play();
+    void pause();
+
+protected:
+    WebKitAnimation(PassRefPtr<KeyframeAnimation>);
+
+private:
+    RefPtr<KeyframeAnimation> m_keyframeAnimation;
+};
+
+} // namespace
+
+#endif
diff --git a/Source/WebKit/win/GEN_DOMObject.h b/Source/WebCore/page/WebKitAnimation.idl
index bb654fb..4fba2e8 100644
--- a/Source/WebKit/win/GEN_DOMObject.h
+++ b/Source/WebCore/page/WebKitAnimation.idl
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007 Apple Inc. All rights reserved.
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -26,23 +26,33 @@
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef GEN_DOMObject_h
-#define GEN_DOMObject_h
+module html {
 
-#include "WebKit.h"
+    interface WebKitAnimation {
 
-class GEN_DOMObject : public IGEN_DOMObject {
-public:
-    // IUnknown
-    virtual HRESULT STDMETHODCALLTYPE QueryInterface(REFIID, void** ppvObject);
-    virtual ULONG STDMETHODCALLTYPE AddRef();
-    virtual ULONG STDMETHODCALLTYPE Release();
+        readonly attribute DOMString name;
 
-protected:
-    GEN_DOMObject();
-    virtual ~GEN_DOMObject();
+        readonly attribute double duration;
+        attribute double elapsedTime;
 
-    ULONG m_refCount;
-};
+        readonly attribute double delay;
+        readonly attribute [Custom] int iterationCount;
 
-#endif // GEN_DOMObject_h
+        readonly attribute boolean paused;
+        readonly attribute boolean ended;
+
+        const unsigned short DIRECTION_NORMAL = 0;
+        const unsigned short DIRECTION_ALTERNATE = 1;
+        readonly attribute unsigned short direction;
+
+        const unsigned short FILL_NONE = 0;
+        const unsigned short FILL_BACKWARDS = 1;
+        const unsigned short FILL_FORWARDS = 2;
+        const unsigned short FILL_BOTH = 3;
+        readonly attribute unsigned short fillMode;
+
+        void play();
+        void pause();
+    };
+
+}
diff --git a/Source/WebCore/page/WebKitAnimationList.cpp b/Source/WebCore/page/WebKitAnimationList.cpp
new file mode 100644
index 0000000..31e46d7
--- /dev/null
+++ b/Source/WebCore/page/WebKitAnimationList.cpp
@@ -0,0 +1,82 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "WebKitAnimationList.h"
+
+#include "Animation.h"
+#include "AnimationBase.h"
+#include "RenderStyle.h"
+#include "WebKitAnimation.h"
+
+namespace WebCore {
+    
+WebKitAnimationList::WebKitAnimationList()
+{
+}
+
+WebKitAnimationList::~WebKitAnimationList()
+{
+}
+
+unsigned WebKitAnimationList::length() const
+{
+    return m_animations.size();
+}
+
+WebKitAnimation* WebKitAnimationList::item(unsigned index)
+{
+    if (index < m_animations.size())
+        return m_animations[index].get();
+    return 0;
+}
+
+void WebKitAnimationList::deleteAnimation(unsigned index)
+{
+    if (index >= m_animations.size())
+        return;
+
+    m_animations.remove(index);
+}
+
+void WebKitAnimationList::append(RefPtr<WebKitAnimation> animation)
+{
+    m_animations.append(animation);
+}
+
+unsigned WebKitAnimationList::insertAnimation(RefPtr<WebKitAnimation> animation, unsigned index)
+{
+    if (!animation)
+        return 0;
+
+    if (index > m_animations.size())
+        return 0;
+
+    m_animations.insert(index, animation);
+    return index;
+}
+
+} // namespace WebCore
+
diff --git a/Source/WebCore/page/WebKitAnimationList.h b/Source/WebCore/page/WebKitAnimationList.h
new file mode 100644
index 0000000..b82e38a
--- /dev/null
+++ b/Source/WebCore/page/WebKitAnimationList.h
@@ -0,0 +1,61 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef WebKitAnimationList_h
+#define WebKitAnimationList_h
+
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+#include <wtf/RefPtr.h>
+#include <wtf/Vector.h>
+
+namespace WebCore {
+  
+class WebKitAnimation;
+
+class WebKitAnimationList : public RefCounted<WebKitAnimationList> {
+public:
+    static PassRefPtr<WebKitAnimationList> create()
+    {
+        return adoptRef(new WebKitAnimationList());
+    }
+    ~WebKitAnimationList();
+
+    unsigned length() const;
+    WebKitAnimation* item(unsigned index);
+
+    unsigned insertAnimation(RefPtr<WebKitAnimation>, unsigned index);
+    void deleteAnimation(unsigned index);
+    void append(RefPtr<WebKitAnimation>);
+
+private:
+    WebKitAnimationList();
+
+    Vector<RefPtr<WebKitAnimation> > m_animations;
+};
+
+} // namespace WebCore
+
+#endif // WebKitAnimationList_h
diff --git a/Source/WebCore/page/WebKitAnimationList.idl b/Source/WebCore/page/WebKitAnimationList.idl
new file mode 100644
index 0000000..4c376e6
--- /dev/null
+++ b/Source/WebCore/page/WebKitAnimationList.idl
@@ -0,0 +1,36 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+module html {
+
+    interface [
+        CustomMarkFunction,
+        HasIndexGetter
+    ] WebKitAnimationList {
+        readonly attribute unsigned long length;
+        WebKitAnimation item(in unsigned long index);
+    };
+
+}
diff --git a/Source/WebCore/page/animation/AnimationBase.cpp b/Source/WebCore/page/animation/AnimationBase.cpp
index 9a906e2..0fe98be 100644
--- a/Source/WebCore/page/animation/AnimationBase.cpp
+++ b/Source/WebCore/page/animation/AnimationBase.cpp
@@ -113,7 +113,7 @@ static inline Color blendFunc(const AnimationBase* anim, const Color& from, cons
 
 static inline Length blendFunc(const AnimationBase*, const Length& from, const Length& to, double progress)
 {  
-    return to.blend(from, progress);
+    return to.blend(from, narrowPrecisionToFloat(progress));
 }
 
 static inline LengthSize blendFunc(const AnimationBase* anim, const LengthSize& from, const LengthSize& to, double progress)
@@ -798,7 +798,6 @@ AnimationBase::AnimationBase(const Animation* transition, RenderObject* renderer
     , m_isAccelerated(false)
     , m_transformFunctionListValid(false)
     , m_nextIterationDuration(-1)
-    , m_next(0)
 {
     // Compute the total duration
     m_totalDuration = -1;
@@ -806,12 +805,6 @@ AnimationBase::AnimationBase(const Animation* transition, RenderObject* renderer
         m_totalDuration = m_animation->duration() * m_animation->iterationCount();
 }
 
-AnimationBase::~AnimationBase()
-{
-    m_compAnim->animationController()->removeFromStyleAvailableWaitList(this);
-    m_compAnim->animationController()->removeFromStartTimeResponseWaitList(this);
-}
-
 bool AnimationBase::propertiesEqual(int prop, const RenderStyle* a, const RenderStyle* b)
 {
     ensurePropertyMap();
@@ -936,7 +929,7 @@ void AnimationBase::updateStateMachine(AnimStateInput input, double param)
     // If we get AnimationStateInputRestartAnimation then we force a new animation, regardless of state.
     if (input == AnimationStateInputMakeNew) {
         if (m_animState == AnimationStateStartWaitStyleAvailable)
-            m_compAnim->animationController()->removeFromStyleAvailableWaitList(this);
+            m_compAnim->animationController()->removeFromAnimationsWaitingForStyle(this);
         m_animState = AnimationStateNew;
         m_startTime = 0;
         m_pauseTime = -1;
@@ -948,7 +941,7 @@ void AnimationBase::updateStateMachine(AnimStateInput input, double param)
 
     if (input == AnimationStateInputRestartAnimation) {
         if (m_animState == AnimationStateStartWaitStyleAvailable)
-            m_compAnim->animationController()->removeFromStyleAvailableWaitList(this);
+            m_compAnim->animationController()->removeFromAnimationsWaitingForStyle(this);
         m_animState = AnimationStateNew;
         m_startTime = 0;
         m_pauseTime = -1;
@@ -963,7 +956,7 @@ void AnimationBase::updateStateMachine(AnimStateInput input, double param)
 
     if (input == AnimationStateInputEndAnimation) {
         if (m_animState == AnimationStateStartWaitStyleAvailable)
-            m_compAnim->animationController()->removeFromStyleAvailableWaitList(this);
+            m_compAnim->animationController()->removeFromAnimationsWaitingForStyle(this);
         m_animState = AnimationStateDone;
         endAnimation();
         return;
@@ -1003,7 +996,7 @@ void AnimationBase::updateStateMachine(AnimStateInput input, double param)
                 ASSERT(param >= 0);
                 // Start timer has fired, tell the animation to start and wait for it to respond with start time
                 m_animState = AnimationStateStartWaitStyleAvailable;
-                m_compAnim->animationController()->addToStyleAvailableWaitList(this);
+                m_compAnim->animationController()->addToAnimationsWaitingForStyle(this);
 
                 // Trigger a render so we can start the animation
                 if (m_object)
@@ -1038,7 +1031,7 @@ void AnimationBase::updateStateMachine(AnimStateInput input, double param)
                         timeOffset = -m_animation->delay();
                     bool started = startAnimation(timeOffset);
 
-                    m_compAnim->animationController()->addToStartTimeResponseWaitList(this, started);
+                    m_compAnim->animationController()->addToAnimationsWaitingForStartTimeResponse(this, started);
                     m_isAccelerated = started;
                 }
             } else {
@@ -1072,7 +1065,7 @@ void AnimationBase::updateStateMachine(AnimStateInput input, double param)
             } else {
                 // We are pausing while waiting for a start response. Cancel the animation and wait. When 
                 // we unpause, we will act as though the start timer just fired
-                m_pauseTime = -1;
+                m_pauseTime = beginAnimationUpdateTime();
                 pauseAnimation(beginAnimationUpdateTime() - m_startTime);
                 m_animState = AnimationStatePausedWaitResponse;
             }
@@ -1167,7 +1160,7 @@ void AnimationBase::updateStateMachine(AnimStateInput input, double param)
                         m_isAccelerated = true;
                     } else {
                         bool started = startAnimation(beginAnimationUpdateTime() - m_startTime);
-                        m_compAnim->animationController()->addToStartTimeResponseWaitList(this, started);
+                        m_compAnim->animationController()->addToAnimationsWaitingForStartTimeResponse(this, started);
                         m_isAccelerated = started;
                     }
                 }
@@ -1397,5 +1390,21 @@ double AnimationBase::getElapsedTime() const
 
     return beginAnimationUpdateTime() - m_startTime;
 }
-    
+
+void AnimationBase::setElapsedTime(double time)
+{
+    // FIXME: implement this method
+    UNUSED_PARAM(time);
+}
+
+void AnimationBase::play()
+{
+    // FIXME: implement this method
+}
+
+void AnimationBase::pause()
+{
+    // FIXME: implement this method
+}
+
 } // namespace WebCore
diff --git a/Source/WebCore/page/animation/AnimationBase.h b/Source/WebCore/page/animation/AnimationBase.h
index 877d649..1ab14e3 100644
--- a/Source/WebCore/page/animation/AnimationBase.h
+++ b/Source/WebCore/page/animation/AnimationBase.h
@@ -51,7 +51,7 @@ class AnimationBase : public RefCounted<AnimationBase> {
 
 public:
     AnimationBase(const Animation* transition, RenderObject* renderer, CompositeAnimation* compAnim);
-    virtual ~AnimationBase();
+    virtual ~AnimationBase() { }
 
     RenderObject* renderer() const { return m_object; }
     void clearRenderer() { m_object = 0; }
@@ -163,13 +163,16 @@ public:
     
     // Freeze the animation; used by DumpRenderTree.
     void freezeAtTime(double t);
+
+    // Play and pause API
+    void play();
+    void pause();
     
     double beginAnimationUpdateTime() const;
     
     double getElapsedTime() const;
-    
-    AnimationBase* next() const { return m_next; }
-    void setNext(AnimationBase* animation) { m_next = animation; }
+    // Setting the elapsed time will adjust the start time and possibly pause time.
+    void setElapsedTime(double);
     
     void styleAvailable() 
     {
@@ -182,7 +185,9 @@ public:
 #endif
 
     static HashSet<int> animatableShorthandsAffectingProperty(int property);
-    
+
+    const Animation* animation() const { return m_animation.get(); }
+
 protected:
     virtual void overrideAnimations() { }
     virtual void resumeOverriddenAnimations() { }
@@ -230,8 +235,6 @@ protected:
     bool m_transformFunctionListValid;
     double m_totalDuration, m_nextIterationDuration;
     
-    AnimationBase* m_next;
-    
 private:
     static void ensurePropertyMap();
 };
diff --git a/Source/WebCore/page/animation/AnimationController.cpp b/Source/WebCore/page/animation/AnimationController.cpp
index dcdea03..5b166d4 100644
--- a/Source/WebCore/page/animation/AnimationController.cpp
+++ b/Source/WebCore/page/animation/AnimationController.cpp
@@ -37,12 +37,14 @@
 #include "Frame.h"
 #include "RenderView.h"
 #include "WebKitAnimationEvent.h"
+#include "WebKitAnimationList.h"
 #include "WebKitTransitionEvent.h"
 #include <wtf/CurrentTime.h>
 #include <wtf/UnusedParam.h>
 
 namespace WebCore {
 
+// FIXME: Why isn't this set to 60fps or something?
 static const double cAnimationTimerDelay = 0.025;
 static const double cBeginAnimationUpdateTimeNotSet = -1;
 
@@ -51,11 +53,9 @@ AnimationControllerPrivate::AnimationControllerPrivate(Frame* frame)
     , m_updateStyleIfNeededDispatcher(this, &AnimationControllerPrivate::updateStyleIfNeededDispatcherFired)
     , m_frame(frame)
     , m_beginAnimationUpdateTime(cBeginAnimationUpdateTimeNotSet)
-    , m_styleAvailableWaiters(0)
-    , m_lastStyleAvailableWaiter(0)
-    , m_startTimeResponseWaiters(0)
-    , m_lastStartTimeResponseWaiter(0)
-    , m_waitingForStartTimeResponse(false)
+    , m_animationsWaitingForStyle()
+    , m_animationsWaitingForStartTimeResponse()
+    , m_waitingForAsyncStartNotification(false)
 {
 }
 
@@ -323,13 +323,13 @@ double AnimationControllerPrivate::beginAnimationUpdateTime()
 void AnimationControllerPrivate::endAnimationUpdate()
 {
     styleAvailable();
-    if (!m_waitingForStartTimeResponse)
+    if (!m_waitingForAsyncStartNotification)
         startTimeResponse(beginAnimationUpdateTime());
 }
 
 void AnimationControllerPrivate::receivedStartTimeResponse(double time)
 {
-    m_waitingForStartTimeResponse = false;
+    m_waitingForAsyncStartNotification = false;
     startTimeResponse(time);
 }
 
@@ -365,52 +365,31 @@ unsigned AnimationControllerPrivate::numberOfActiveAnimations() const
     return count;
 }
 
-void AnimationControllerPrivate::addToStyleAvailableWaitList(AnimationBase* animation)
+void AnimationControllerPrivate::addToAnimationsWaitingForStyle(AnimationBase* animation)
 {
-    ASSERT(!animation->next());
-    
-    if (m_styleAvailableWaiters)
-        m_lastStyleAvailableWaiter->setNext(animation);
-    else
-        m_styleAvailableWaiters = animation;
-        
-    m_lastStyleAvailableWaiter = animation;
-    animation->setNext(0);
-}
-
-void AnimationControllerPrivate::removeFromStyleAvailableWaitList(AnimationBase* animationToRemove)
-{
-    AnimationBase* prevAnimation = 0;
-    for (AnimationBase* animation = m_styleAvailableWaiters; animation; animation = animation->next()) {
-        if (animation == animationToRemove) {
-            if (prevAnimation)
-                prevAnimation->setNext(animation->next());
-            else
-                m_styleAvailableWaiters = animation->next();
-            
-            if (m_lastStyleAvailableWaiter == animation)
-                m_lastStyleAvailableWaiter = prevAnimation;
-                
-            animationToRemove->setNext(0);
-        }
-    }
+    // Make sure this animation is not in the start time waiters
+    m_animationsWaitingForStartTimeResponse.remove(animation);
+
+    m_animationsWaitingForStyle.add(animation);
+}
+
+void AnimationControllerPrivate::removeFromAnimationsWaitingForStyle(AnimationBase* animationToRemove)
+{
+    m_animationsWaitingForStyle.remove(animationToRemove);
 }
 
 void AnimationControllerPrivate::styleAvailable()
 {
     // Go through list of waiters and send them on their way
-    for (AnimationBase* animation = m_styleAvailableWaiters; animation; ) {
-        AnimationBase* nextAnimation = animation->next();
-        animation->setNext(0);
-        animation->styleAvailable();
-        animation = nextAnimation;
-    }
-    
-    m_styleAvailableWaiters = 0;
-    m_lastStyleAvailableWaiter = 0;
+    WaitingAnimationsSet::const_iterator it = m_animationsWaitingForStyle.begin();
+    WaitingAnimationsSet::const_iterator end = m_animationsWaitingForStyle.end();
+    for (; it != end; ++it)
+        (*it)->styleAvailable();
+
+    m_animationsWaitingForStyle.clear();
 }
 
-void AnimationControllerPrivate::addToStartTimeResponseWaitList(AnimationBase* animation, bool willGetResponse)
+void AnimationControllerPrivate::addToAnimationsWaitingForStartTimeResponse(AnimationBase* animation, bool willGetResponse)
 {
     // If willGetResponse is true, it means this animation is actually waiting for a response
     // (which will come in as a call to notifyAnimationStarted()).
@@ -429,54 +408,48 @@ void AnimationControllerPrivate::addToStartTimeResponseWaitList(AnimationBase* a
     // This will synchronize all software and accelerated animations started in the same 
     // updateStyleIfNeeded cycle.
     //
-    ASSERT(!animation->next());
     
     if (willGetResponse)
-        m_waitingForStartTimeResponse = true;
+        m_waitingForAsyncStartNotification = true;
     
-    if (m_startTimeResponseWaiters)
-        m_lastStartTimeResponseWaiter->setNext(animation);
-    else
-        m_startTimeResponseWaiters = animation;
-        
-    m_lastStartTimeResponseWaiter = animation;
-    animation->setNext(0);
-}
-
-void AnimationControllerPrivate::removeFromStartTimeResponseWaitList(AnimationBase* animationToRemove)
-{
-    AnimationBase* prevAnimation = 0;
-    for (AnimationBase* animation = m_startTimeResponseWaiters; animation; animation = animation->next()) {
-        if (animation == animationToRemove) {
-            if (prevAnimation)
-                prevAnimation->setNext(animation->next());
-            else
-                m_startTimeResponseWaiters = animation->next();
-            
-            if (m_lastStartTimeResponseWaiter == animation)
-                m_lastStartTimeResponseWaiter = prevAnimation;
-                
-            animationToRemove->setNext(0);
-        }
-        prevAnimation = animation;
-    }
+    m_animationsWaitingForStartTimeResponse.add(animation);
+}
+
+void AnimationControllerPrivate::removeFromAnimationsWaitingForStartTimeResponse(AnimationBase* animationToRemove)
+{
+    m_animationsWaitingForStartTimeResponse.remove(animationToRemove);
     
-    if (!m_startTimeResponseWaiters)
-        m_waitingForStartTimeResponse = false;
+    if (m_animationsWaitingForStartTimeResponse.isEmpty())
+        m_waitingForAsyncStartNotification = false;
 }
 
 void AnimationControllerPrivate::startTimeResponse(double time)
 {
     // Go through list of waiters and send them on their way
-    for (AnimationBase* animation = m_startTimeResponseWaiters; animation; ) {
-        AnimationBase* nextAnimation = animation->next();
-        animation->setNext(0);
-        animation->onAnimationStartResponse(time);
-        animation = nextAnimation;
-    }
+
+    WaitingAnimationsSet::const_iterator it = m_animationsWaitingForStartTimeResponse.begin();
+    WaitingAnimationsSet::const_iterator end = m_animationsWaitingForStartTimeResponse.end();
+    for (; it != end; ++it)
+        (*it)->onAnimationStartResponse(time);
     
-    m_startTimeResponseWaiters = 0;
-    m_lastStartTimeResponseWaiter = 0;
+    m_animationsWaitingForStartTimeResponse.clear();
+    m_waitingForAsyncStartNotification = false;
+}
+
+void AnimationControllerPrivate::animationWillBeRemoved(AnimationBase* animation)
+{
+    removeFromAnimationsWaitingForStyle(animation);
+    removeFromAnimationsWaitingForStartTimeResponse(animation);
+}
+
+PassRefPtr<WebKitAnimationList> AnimationControllerPrivate::animationsForRenderer(RenderObject* renderer) const
+{
+    RefPtr<CompositeAnimation> animation = m_compositeAnimations.get(renderer);
+
+    if (!animation)
+        return 0;
+
+    return animation->animations();
 }
 
 AnimationController::AnimationController(Frame* frame)
@@ -612,4 +585,9 @@ bool AnimationController::supportsAcceleratedAnimationOfProperty(CSSPropertyID p
 #endif
 }
 
+PassRefPtr<WebKitAnimationList> AnimationController::animationsForRenderer(RenderObject* renderer) const
+{
+    return m_data->animationsForRenderer(renderer);
+}
+
 } // namespace WebCore
diff --git a/Source/WebCore/page/animation/AnimationController.h b/Source/WebCore/page/animation/AnimationController.h
index 5279467..a355f87 100644
--- a/Source/WebCore/page/animation/AnimationController.h
+++ b/Source/WebCore/page/animation/AnimationController.h
@@ -42,6 +42,7 @@ class Frame;
 class Node;
 class RenderObject;
 class RenderStyle;
+class WebKitAnimationList;
 
 class AnimationController {
 public:
@@ -73,6 +74,8 @@ public:
     
     static bool supportsAcceleratedAnimationOfProperty(CSSPropertyID);
 
+    PassRefPtr<WebKitAnimationList> animationsForRenderer(RenderObject*) const;
+
 private:
     AnimationControllerPrivate* m_data;
 };
diff --git a/Source/WebCore/page/animation/AnimationControllerPrivate.h b/Source/WebCore/page/animation/AnimationControllerPrivate.h
index 186dd7d..1146eba 100644
--- a/Source/WebCore/page/animation/AnimationControllerPrivate.h
+++ b/Source/WebCore/page/animation/AnimationControllerPrivate.h
@@ -33,6 +33,7 @@
 #include "PlatformString.h"
 #include "Timer.h"
 #include <wtf/HashMap.h>
+#include <wtf/HashSet.h>
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefPtr.h>
 #include <wtf/Vector.h>
@@ -48,6 +49,7 @@ class Frame;
 class Node;
 class RenderObject;
 class RenderStyle;
+class WebKitAnimationList;
 
 class AnimationControllerPrivate {
     WTF_MAKE_NONCOPYABLE(AnimationControllerPrivate); WTF_MAKE_FAST_ALLOCATED;
@@ -87,11 +89,15 @@ public:
     void endAnimationUpdate();
     void receivedStartTimeResponse(double);
     
-    void addToStyleAvailableWaitList(AnimationBase*);
-    void removeFromStyleAvailableWaitList(AnimationBase*);    
-    
-    void addToStartTimeResponseWaitList(AnimationBase*, bool willGetResponse);
-    void removeFromStartTimeResponseWaitList(AnimationBase*);    
+    void addToAnimationsWaitingForStyle(AnimationBase*);
+    void removeFromAnimationsWaitingForStyle(AnimationBase*);
+
+    void addToAnimationsWaitingForStartTimeResponse(AnimationBase*, bool willGetResponse);
+    void removeFromAnimationsWaitingForStartTimeResponse(AnimationBase*);
+
+    void animationWillBeRemoved(AnimationBase*);
+
+    PassRefPtr<WebKitAnimationList> animationsForRenderer(RenderObject*) const;
     
 private:
     void animationTimerFired(Timer<AnimationControllerPrivate>*);
@@ -119,12 +125,11 @@ private:
     Vector<RefPtr<Node> > m_nodeChangesToDispatch;
     
     double m_beginAnimationUpdateTime;
-    AnimationBase* m_styleAvailableWaiters;
-    AnimationBase* m_lastStyleAvailableWaiter;
-    
-    AnimationBase* m_startTimeResponseWaiters;
-    AnimationBase* m_lastStartTimeResponseWaiter;
-    bool m_waitingForStartTimeResponse;
+
+    typedef HashSet<RefPtr<AnimationBase> > WaitingAnimationsSet;
+    WaitingAnimationsSet m_animationsWaitingForStyle;
+    WaitingAnimationsSet m_animationsWaitingForStartTimeResponse;
+    bool m_waitingForAsyncStartNotification;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/page/animation/CompositeAnimation.cpp b/Source/WebCore/page/animation/CompositeAnimation.cpp
index 602491e..27409d9 100644
--- a/Source/WebCore/page/animation/CompositeAnimation.cpp
+++ b/Source/WebCore/page/animation/CompositeAnimation.cpp
@@ -36,6 +36,8 @@
 #include "KeyframeAnimation.h"
 #include "RenderObject.h"
 #include "RenderStyle.h"
+#include "WebKitAnimation.h"
+#include "WebKitAnimationList.h"
 
 namespace WebCore {
 
@@ -54,6 +56,7 @@ void CompositeAnimation::clearRenderer()
         CSSPropertyTransitionsMap::const_iterator transitionsEnd = m_transitions.end();
         for (CSSPropertyTransitionsMap::const_iterator it = m_transitions.begin(); it != transitionsEnd; ++it) {
             ImplicitAnimation* transition = it->second.get();
+            animationController()->animationWillBeRemoved(transition);
             transition->clearRenderer();
         }
     }
@@ -62,6 +65,7 @@ void CompositeAnimation::clearRenderer()
         AnimationNameMap::const_iterator animationsEnd = m_keyframeAnimations.end();
         for (AnimationNameMap::const_iterator it = m_keyframeAnimations.begin(); it != animationsEnd; ++it) {
             KeyframeAnimation* anim = it->second.get();
+            animationController()->animationWillBeRemoved(anim);
             anim->clearRenderer();
         }
     }
@@ -173,8 +177,10 @@ void CompositeAnimation::updateTransitions(RenderObject* renderer, RenderStyle*
     end = m_transitions.end();
     for (CSSPropertyTransitionsMap::const_iterator it = m_transitions.begin(); it != end; ++it) {
         ImplicitAnimation* anim = it->second.get();
-        if (!anim->active())
+        if (!anim->active()) {
+            animationController()->animationWillBeRemoved(anim);
             toBeRemoved.append(anim->animatingProperty());
+        }
     }
 
     // Now remove the transitions from the list
@@ -252,8 +258,11 @@ void CompositeAnimation::updateKeyframeAnimations(RenderObject* renderer, Render
     kfend = m_keyframeAnimations.end();
     for (AnimationNameMap::const_iterator it = m_keyframeAnimations.begin(); it != kfend; ++it) {
         KeyframeAnimation* keyframeAnim = it->second.get();
-        if (keyframeAnim->index() < 0)
+        if (keyframeAnim->index() < 0) {
             animsToBeRemoved.append(keyframeAnim->name().impl());
+            animationController()->animationWillBeRemoved(keyframeAnim);
+            keyframeAnim->clearRenderer();
+        }
     }
     
     // Now remove the animations from the list.
@@ -560,4 +569,20 @@ unsigned CompositeAnimation::numberOfActiveAnimations() const
     return count;
 }
 
+PassRefPtr<WebKitAnimationList> CompositeAnimation::animations() const
+{
+    RefPtr<WebKitAnimationList> animations = WebKitAnimationList::create();
+    if (!m_keyframeAnimations.isEmpty()) {
+        m_keyframeAnimations.checkConsistency();
+        for (Vector<AtomicStringImpl*>::const_iterator it = m_keyframeAnimationOrderMap.begin(); it != m_keyframeAnimationOrderMap.end(); ++it) {
+            RefPtr<KeyframeAnimation> keyframeAnimation = m_keyframeAnimations.get(*it);
+            if (keyframeAnimation) {
+                RefPtr<WebKitAnimation> anim = WebKitAnimation::create(keyframeAnimation);
+                animations->append(anim);
+            }
+        }
+    }
+    return animations;
+}
+
 } // namespace WebCore
diff --git a/Source/WebCore/page/animation/CompositeAnimation.h b/Source/WebCore/page/animation/CompositeAnimation.h
index 249f4c3..1bfe585 100644
--- a/Source/WebCore/page/animation/CompositeAnimation.h
+++ b/Source/WebCore/page/animation/CompositeAnimation.h
@@ -41,6 +41,7 @@ class AnimationControllerPrivate;
 class AnimationController;
 class RenderObject;
 class RenderStyle;
+class WebKitAnimationList;
 
 // A CompositeAnimation represents a collection of animations that are running
 // on a single RenderObject, such as a number of properties transitioning at once.
@@ -80,6 +81,8 @@ public:
     bool pauseTransitionAtTime(int property, double t);
     unsigned numberOfActiveAnimations() const;
 
+    PassRefPtr<WebKitAnimationList> animations() const;
+
 private:
     CompositeAnimation(AnimationControllerPrivate* animationController)
         : m_animationController(animationController)
diff --git a/Source/WebCore/page/mac/WebCoreViewFactory.m b/Source/WebCore/page/mac/WebCoreViewFactory.m
index 5398989..17a7a29 100644
--- a/Source/WebCore/page/mac/WebCoreViewFactory.m
+++ b/Source/WebCore/page/mac/WebCoreViewFactory.m
@@ -37,7 +37,7 @@ static WebCoreViewFactory *sharedFactory;
 
 - init
 {
-    [super init];
+    self = [super init];
     
     ASSERT(!sharedFactory);
     sharedFactory = [self retain];
diff --git a/Source/WebCore/platform/ColorData.gperf b/Source/WebCore/platform/ColorData.gperf
index 2a72237..277d83e 100644
--- a/Source/WebCore/platform/ColorData.gperf
+++ b/Source/WebCore/platform/ColorData.gperf
@@ -107,7 +107,7 @@ maroon, 0xff800000
 mediumaquamarine, 0xff66cdaa
 mediumblue, 0xff0000cd
 mediumorchid, 0xffba55d3
-mediumpurple, 0xff9370d8
+mediumpurple, 0xff9370db
 mediumseagreen, 0xff3cb371
 mediumslateblue, 0xff7b68ee
 mediumspringgreen, 0xff00fa9a
@@ -128,7 +128,7 @@ orchid, 0xffda70d6
 palegoldenrod, 0xffeee8aa
 palegreen, 0xff98fb98
 paleturquoise, 0xffafeeee
-palevioletred, 0xffd87093
+palevioletred, 0xffdb7093
 papayawhip, 0xffffefd5
 peachpuff, 0xffffdab9
 peru, 0xffcd853f
diff --git a/Source/WebCore/platform/CrossThreadCopier.h b/Source/WebCore/platform/CrossThreadCopier.h
index 5eb40ee..a25d6fa 100644
--- a/Source/WebCore/platform/CrossThreadCopier.h
+++ b/Source/WebCore/platform/CrossThreadCopier.h
@@ -56,7 +56,7 @@ namespace WebCore {
         }
     };
 
-    template<bool isConvertibleToInteger, bool isThreadsafeShared, typename T> struct CrossThreadCopierBase;
+    template<bool isConvertibleToInteger, bool isThreadSafeRefCounted, typename T> struct CrossThreadCopierBase;
 
     // Integers get passed through without any changes.
     template<typename T> struct CrossThreadCopierBase<true, false, T> : public CrossThreadCopierPassThrough<T> {
@@ -114,8 +114,8 @@ namespace WebCore {
     };
 
     template<typename T> struct CrossThreadCopier : public CrossThreadCopierBase<WTF::IsConvertibleToInteger<T>::value,
-                                                                                 WTF::IsSubclassOfTemplate<typename WTF::RemoveTemplate<T, RefPtr>::Type, ThreadSafeShared>::value
-                                                                                     || WTF::IsSubclassOfTemplate<typename WTF::RemoveTemplate<T, PassRefPtr>::Type, ThreadSafeShared>::value,
+                                                                                 WTF::IsSubclassOfTemplate<typename WTF::RemoveTemplate<T, RefPtr>::Type, ThreadSafeRefCounted>::value
+                                                                                     || WTF::IsSubclassOfTemplate<typename WTF::RemoveTemplate<T, PassRefPtr>::Type, ThreadSafeRefCounted>::value,
                                                                                  T> {
     };
 
diff --git a/Source/WebCore/platform/DefaultLocalizationStrategy.cpp b/Source/WebCore/platform/DefaultLocalizationStrategy.cpp
new file mode 100644
index 0000000..1a50c3c
--- /dev/null
+++ b/Source/WebCore/platform/DefaultLocalizationStrategy.cpp
@@ -0,0 +1,874 @@
+/*
+ * Copyright (C) 2010, 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "DefaultLocalizationStrategy.h"
+
+#if USE(PLATFORM_STRATEGIES)
+
+#include "IntSize.h"
+#include "LocalizedStrings.h"
+#include "NotImplemented.h"
+#include <wtf/MathExtras.h>
+#include <wtf/text/CString.h>
+#include <wtf/UnusedParam.h>
+
+#if USE(CF)
+#include <wtf/RetainPtr.h>
+#endif
+
+namespace WebCore {
+
+// We can't use String::format for two reasons:
+//  1) It doesn't handle non-ASCII characters in the format string.
+//  2) It doesn't handle the %2$d syntax.
+// Note that because |format| is used as the second parameter to va_start, it cannot be a reference
+// type according to section 18.7/3 of the C++ N1905 standard.
+static String formatLocalizedString(String format, ...)
+{
+#if USE(CF)
+    va_list arguments;
+    va_start(arguments, format);
+    RetainPtr<CFStringRef> formatCFString(AdoptCF, format.createCFString());
+    RetainPtr<CFStringRef> result(AdoptCF, CFStringCreateWithFormatAndArguments(0, 0, formatCFString.get(), arguments));
+    va_end(arguments);
+    return result.get();
+#elif PLATFORM(QT)
+    va_list arguments;
+    va_start(arguments, format);
+    QString result;
+    result.vsprintf(format.latin1().data(), arguments);
+    va_end(arguments);
+    return result;
+#else
+    notImplemented();
+    return format;
+#endif
+}
+
+DefaultLocalizationStrategy::DefaultLocalizationStrategy()
+{
+}
+
+String DefaultLocalizationStrategy::inputElementAltText()
+{
+    return UI_STRING_KEY("Submit", "Submit (input element)", "alt text for <input> elements with no alt, title, or value");
+}
+
+String DefaultLocalizationStrategy::resetButtonDefaultLabel()
+{
+    return UI_STRING("Reset", "default label for Reset buttons in forms on web pages");
+}
+
+String DefaultLocalizationStrategy::searchableIndexIntroduction()
+{
+    return UI_STRING("This is a searchable index. Enter search keywords: ",
+        "text that appears at the start of nearly-obsolete web pages in the form of a 'searchable index'");
+}
+
+String DefaultLocalizationStrategy::submitButtonDefaultLabel()
+{
+    return UI_STRING("Submit", "default label for Submit buttons in forms on web pages");
+}
+
+String DefaultLocalizationStrategy::fileButtonChooseFileLabel()
+{
+    return UI_STRING("Choose File", "title for file button used in HTML forms");
+}
+
+String DefaultLocalizationStrategy::fileButtonNoFileSelectedLabel()
+{
+    return UI_STRING("no file selected", "text to display in file button used in HTML forms when no file is selected");
+}
+
+String DefaultLocalizationStrategy::defaultDetailsSummaryText()
+{
+    return UI_STRING("Details", "text to display in <details> tag when it has no <summary> child");
+}
+
+#if PLATFORM(MAC)
+String DefaultLocalizationStrategy::copyImageUnknownFileLabel()
+{
+    return UI_STRING("unknown", "Unknown filename");
+}
+#endif
+
+#if ENABLE(CONTEXT_MENUS)
+
+String DefaultLocalizationStrategy::contextMenuItemTagOpenLinkInNewWindow()
+{
+    return UI_STRING("Open Link in New Window", "Open in New Window context menu item");
+}
+
+String DefaultLocalizationStrategy::contextMenuItemTagDownloadLinkToDisk()
+{
+    return UI_STRING("Download Linked File", "Download Linked File context menu item");
+}
+
+String DefaultLocalizationStrategy::contextMenuItemTagCopyLinkToClipboard()
+{
+    return UI_STRING("Copy Link", "Copy Link context menu item");
+}
+
+String DefaultLocalizationStrategy::contextMenuItemTagOpenImageInNewWindow()
+{
+    return UI_STRING("Open Image in New Window", "Open Image in New Window context menu item");
+}
+
+String DefaultLocalizationStrategy::contextMenuItemTagDownloadImageToDisk()
+{
+    return UI_STRING("Download Image", "Download Image context menu item");
+}
+
+String DefaultLocalizationStrategy::contextMenuItemTagCopyImageToClipboard()
+{
+    return UI_STRING("Copy Image", "Copy Image context menu item");
+}
+
+#if PLATFORM(QT)
+String DefaultLocalizationStrategy::contextMenuItemTagCopyImageUrlToClipboard()
+{
+    return UI_STRING("Copy Image Address", "Copy Image Address menu item");
+}
+#endif
+
+String DefaultLocalizationStrategy::contextMenuItemTagOpenVideoInNewWindow()
+{
+    return UI_STRING("Open Video in New Window", "Open Video in New Window context menu item");
+}
+
+String DefaultLocalizationStrategy::contextMenuItemTagOpenAudioInNewWindow()
+{
+    return UI_STRING("Open Audio in New Window", "Open Audio in New Window context menu item");
+}
+
+String DefaultLocalizationStrategy::contextMenuItemTagCopyVideoLinkToClipboard()
+{
+    return UI_STRING("Copy Video Address", "Copy Video Address Location context menu item");
+}
+
+String DefaultLocalizationStrategy::contextMenuItemTagCopyAudioLinkToClipboard()
+{
+    return UI_STRING("Copy Audio Address", "Copy Audio Address Location context menu item");
+}
+
+String DefaultLocalizationStrategy::contextMenuItemTagToggleMediaControls()
+{
+    return UI_STRING("Controls", "Media Controls context menu item");
+}
+
+String DefaultLocalizationStrategy::contextMenuItemTagToggleMediaLoop()
+{
+    return UI_STRING("Loop", "Media Loop context menu item");
+}
+
+String DefaultLocalizationStrategy::contextMenuItemTagEnterVideoFullscreen()
+{
+    return UI_STRING("Enter Fullscreen", "Video Enter Fullscreen context menu item");
+}
+
+String DefaultLocalizationStrategy::contextMenuItemTagMediaPlay()
+{
+    return UI_STRING("Play", "Media Play context menu item");
+}
+
+String DefaultLocalizationStrategy::contextMenuItemTagMediaPause()
+{
+    return UI_STRING("Pause", "Media Pause context menu item");
+}
+
+String DefaultLocalizationStrategy::contextMenuItemTagMediaMute()
+{
+    return UI_STRING("Mute", "Media Mute context menu item");
+}
+
+String DefaultLocalizationStrategy::contextMenuItemTagOpenFrameInNewWindow()
+{
+    return UI_STRING("Open Frame in New Window", "Open Frame in New Window context menu item");
+}
+
+String DefaultLocalizationStrategy::contextMenuItemTagCopy()
+{
+    return UI_STRING("Copy", "Copy context menu item");
+}
+
+String DefaultLocalizationStrategy::contextMenuItemTagGoBack()
+{
+    return UI_STRING("Back", "Back context menu item");
+}
+
+String DefaultLocalizationStrategy::contextMenuItemTagGoForward()
+{
+    return UI_STRING("Forward", "Forward context menu item");
+}
+
+String DefaultLocalizationStrategy::contextMenuItemTagStop()
+{
+    return UI_STRING("Stop", "Stop context menu item");
+}
+
+String DefaultLocalizationStrategy::contextMenuItemTagReload()
+{
+    return UI_STRING("Reload", "Reload context menu item");
+}
+
+String DefaultLocalizationStrategy::contextMenuItemTagCut()
+{
+    return UI_STRING("Cut", "Cut context menu item");
+}
+
+String DefaultLocalizationStrategy::contextMenuItemTagPaste()
+{
+    return UI_STRING("Paste", "Paste context menu item");
+}
+
+#if PLATFORM(GTK)
+
+String DefaultLocalizationStrategy::contextMenuItemTagDelete()
+{
+    notImplemented();
+    return "Delete";
+}
+
+String DefaultLocalizationStrategy::contextMenuItemTagInputMethods()
+{
+    notImplemented();
+    return "Input Methods";
+}
+
+String DefaultLocalizationStrategy::contextMenuItemTagUnicode()
+{
+    notImplemented();
+    return "Unicode";
+}
+
+#endif
+
+#if PLATFORM(GTK) || PLATFORM(QT)
+
+String DefaultLocalizationStrategy::contextMenuItemTagSelectAll()
+{
+    notImplemented();
+    return "Select All";
+}
+
+#endif
+
+String DefaultLocalizationStrategy::contextMenuItemTagNoGuessesFound()
+{
+    return UI_STRING("No Guesses Found", "No Guesses Found context menu item");
+}
+
+String DefaultLocalizationStrategy::contextMenuItemTagIgnoreSpelling()
+{
+    return UI_STRING("Ignore Spelling", "Ignore Spelling context menu item");
+}
+
+String DefaultLocalizationStrategy::contextMenuItemTagLearnSpelling()
+{
+    return UI_STRING("Learn Spelling", "Learn Spelling context menu item");
+}
+
+String DefaultLocalizationStrategy::contextMenuItemTagSearchWeb()
+{
+    return UI_STRING("Search in Google", "Search in Google context menu item");
+}
+
+String DefaultLocalizationStrategy::contextMenuItemTagLookUpInDictionary(const String& selectedString)
+{
+#if defined(BUILDING_ON_TIGER) || defined(BUILDING_ON_LEOPARD) || defined(BUILDING_ON_SNOW_LEOPARD)
+    UNUSED_PARAM(selectedString);
+    return UI_STRING("Look Up in Dictionary", "Look Up in Dictionary context menu item");
+#else
+    return UI_STRING("Look Up “<selection>�", "Look Up context menu item with selected word").replace("<selection>", selectedString);
+#endif
+}
+
+String DefaultLocalizationStrategy::contextMenuItemTagOpenLink()
+{
+    return UI_STRING("Open Link", "Open Link context menu item");
+}
+
+String DefaultLocalizationStrategy::contextMenuItemTagIgnoreGrammar()
+{
+    return UI_STRING("Ignore Grammar", "Ignore Grammar context menu item");
+}
+
+String DefaultLocalizationStrategy::contextMenuItemTagSpellingMenu()
+{
+    return UI_STRING("Spelling and Grammar", "Spelling and Grammar context sub-menu item");
+}
+
+String DefaultLocalizationStrategy::contextMenuItemTagShowSpellingPanel(bool show)
+{
+    if (show)
+        return UI_STRING("Show Spelling and Grammar", "menu item title");
+    return UI_STRING("Hide Spelling and Grammar", "menu item title");
+}
+
+String DefaultLocalizationStrategy::contextMenuItemTagCheckSpelling()
+{
+    return UI_STRING("Check Document Now", "Check spelling context menu item");
+}
+
+String DefaultLocalizationStrategy::contextMenuItemTagCheckSpellingWhileTyping()
+{
+    return UI_STRING("Check Spelling While Typing", "Check spelling while typing context menu item");
+}
+
+String DefaultLocalizationStrategy::contextMenuItemTagCheckGrammarWithSpelling()
+{
+    return UI_STRING("Check Grammar With Spelling", "Check grammar with spelling context menu item");
+}
+
+String DefaultLocalizationStrategy::contextMenuItemTagFontMenu()
+{
+    return UI_STRING("Font", "Font context sub-menu item");
+}
+
+String DefaultLocalizationStrategy::contextMenuItemTagBold()
+{
+    return UI_STRING("Bold", "Bold context menu item");
+}
+
+String DefaultLocalizationStrategy::contextMenuItemTagItalic()
+{
+    return UI_STRING("Italic", "Italic context menu item");
+}
+
+String DefaultLocalizationStrategy::contextMenuItemTagUnderline()
+{
+    return UI_STRING("Underline", "Underline context menu item");
+}
+
+String DefaultLocalizationStrategy::contextMenuItemTagOutline()
+{
+    return UI_STRING("Outline", "Outline context menu item");
+}
+
+String DefaultLocalizationStrategy::contextMenuItemTagWritingDirectionMenu()
+{
+    return UI_STRING("Paragraph Direction", "Paragraph direction context sub-menu item");
+}
+
+String DefaultLocalizationStrategy::contextMenuItemTagTextDirectionMenu()
+{
+    return UI_STRING("Selection Direction", "Selection direction context sub-menu item");
+}
+
+String DefaultLocalizationStrategy::contextMenuItemTagDefaultDirection()
+{
+    return UI_STRING("Default", "Default writing direction context menu item");
+}
+
+String DefaultLocalizationStrategy::contextMenuItemTagLeftToRight()
+{
+    return UI_STRING("Left to Right", "Left to Right context menu item");
+}
+
+String DefaultLocalizationStrategy::contextMenuItemTagRightToLeft()
+{
+    return UI_STRING("Right to Left", "Right to Left context menu item");
+}
+
+#if PLATFORM(MAC)
+
+String DefaultLocalizationStrategy::contextMenuItemTagSearchInSpotlight()
+{
+    return UI_STRING("Search in Spotlight", "Search in Spotlight context menu item");
+}
+
+String DefaultLocalizationStrategy::contextMenuItemTagShowFonts()
+{
+    return UI_STRING("Show Fonts", "Show fonts context menu item");
+}
+
+String DefaultLocalizationStrategy::contextMenuItemTagStyles()
+{
+    return UI_STRING("Styles...", "Styles context menu item");
+}
+
+String DefaultLocalizationStrategy::contextMenuItemTagShowColors()
+{
+    return UI_STRING("Show Colors", "Show colors context menu item");
+}
+
+String DefaultLocalizationStrategy::contextMenuItemTagSpeechMenu()
+{
+    return UI_STRING("Speech", "Speech context sub-menu item");
+}
+
+String DefaultLocalizationStrategy::contextMenuItemTagStartSpeaking()
+{
+    return UI_STRING("Start Speaking", "Start speaking context menu item");
+}
+
+String DefaultLocalizationStrategy::contextMenuItemTagStopSpeaking()
+{
+    return UI_STRING("Stop Speaking", "Stop speaking context menu item");
+}
+
+String DefaultLocalizationStrategy::contextMenuItemTagCorrectSpellingAutomatically()
+{
+    return UI_STRING("Correct Spelling Automatically", "Correct Spelling Automatically context menu item");
+}
+
+String DefaultLocalizationStrategy::contextMenuItemTagSubstitutionsMenu()
+{
+    return UI_STRING("Substitutions", "Substitutions context sub-menu item");
+}
+
+String DefaultLocalizationStrategy::contextMenuItemTagShowSubstitutions(bool show)
+{
+    if (show) 
+        return UI_STRING("Show Substitutions", "menu item title");
+    return UI_STRING("Hide Substitutions", "menu item title");
+}
+
+String DefaultLocalizationStrategy::contextMenuItemTagSmartCopyPaste()
+{
+    return UI_STRING("Smart Copy/Paste", "Smart Copy/Paste context menu item");
+}
+
+String DefaultLocalizationStrategy::contextMenuItemTagSmartQuotes()
+{
+    return UI_STRING("Smart Quotes", "Smart Quotes context menu item");
+}
+
+String DefaultLocalizationStrategy::contextMenuItemTagSmartDashes()
+{
+    return UI_STRING("Smart Dashes", "Smart Dashes context menu item");
+}
+
+String DefaultLocalizationStrategy::contextMenuItemTagSmartLinks()
+{
+    return UI_STRING("Smart Links", "Smart Links context menu item");
+}
+
+String DefaultLocalizationStrategy::contextMenuItemTagTextReplacement()
+{
+    return UI_STRING("Text Replacement", "Text Replacement context menu item");
+}
+
+String DefaultLocalizationStrategy::contextMenuItemTagTransformationsMenu()
+{
+    return UI_STRING("Transformations", "Transformations context sub-menu item");
+}
+
+String DefaultLocalizationStrategy::contextMenuItemTagMakeUpperCase()
+{
+    return UI_STRING("Make Upper Case", "Make Upper Case context menu item");
+}
+
+String DefaultLocalizationStrategy::contextMenuItemTagMakeLowerCase()
+{
+    return UI_STRING("Make Lower Case", "Make Lower Case context menu item");
+}
+
+String DefaultLocalizationStrategy::contextMenuItemTagCapitalize()
+{
+    return UI_STRING("Capitalize", "Capitalize context menu item");
+}
+
+String DefaultLocalizationStrategy::contextMenuItemTagChangeBack(const String& replacedString)
+{
+    notImplemented();
+    return replacedString;
+}
+
+#endif
+
+String DefaultLocalizationStrategy::contextMenuItemTagInspectElement()
+{
+    return UI_STRING("Inspect Element", "Inspect Element context menu item");
+}
+
+#endif // ENABLE(CONTEXT_MENUS)
+
+String DefaultLocalizationStrategy::searchMenuNoRecentSearchesText()
+{
+    return UI_STRING("No recent searches", "Label for only item in menu that appears when clicking on the search field image, when no searches have been performed");
+}
+
+String DefaultLocalizationStrategy::searchMenuRecentSearchesText()
+{
+    return UI_STRING("Recent Searches", "label for first item in the menu that appears when clicking on the search field image, used as embedded menu title");
+}
+
+String DefaultLocalizationStrategy::searchMenuClearRecentSearchesText()
+{
+    return UI_STRING("Clear Recent Searches", "menu item in Recent Searches menu that empties menu's contents");
+}
+
+String DefaultLocalizationStrategy::AXWebAreaText()
+{
+    return UI_STRING("HTML content", "accessibility role description for web area");
+}
+
+String DefaultLocalizationStrategy::AXLinkText()
+{
+    return UI_STRING("link", "accessibility role description for link");
+}
+
+String DefaultLocalizationStrategy::AXListMarkerText()
+{
+    return UI_STRING("list marker", "accessibility role description for list marker");
+}
+
+String DefaultLocalizationStrategy::AXImageMapText()
+{
+    return UI_STRING("image map", "accessibility role description for image map");
+}
+
+String DefaultLocalizationStrategy::AXHeadingText()
+{
+    return UI_STRING("heading", "accessibility role description for headings");
+}
+
+String DefaultLocalizationStrategy::AXDefinitionListTermText()
+{
+    return UI_STRING("term", "term word of a definition");
+}
+
+String DefaultLocalizationStrategy::AXDefinitionListDefinitionText()
+{
+    return UI_STRING("definition", "definition phrase");
+}
+
+#if PLATFORM(MAC)
+String DefaultLocalizationStrategy::AXARIAContentGroupText(const String& ariaType)
+{
+    if (ariaType == "ARIAApplicationAlert")
+        return UI_STRING("alert", "An ARIA accessibility group that acts as an alert.");
+    if (ariaType == "ARIAApplicationAlertDialog")
+        return UI_STRING("alert dialog", "An ARIA accessibility group that acts as an alert dialog.");
+    if (ariaType == "ARIAApplicationDialog")
+        return UI_STRING("dialog", "An ARIA accessibility group that acts as an dialog.");
+    if (ariaType == "ARIAApplicationLog")
+        return UI_STRING("log", "An ARIA accessibility group that acts as a console log.");
+    if (ariaType == "ARIAApplicationMarquee")
+        return UI_STRING("marquee", "An ARIA accessibility group that acts as a marquee.");    
+    if (ariaType == "ARIAApplicationStatus")
+        return UI_STRING("application status", "An ARIA accessibility group that acts as a status update.");    
+    if (ariaType == "ARIAApplicationTimer")
+        return UI_STRING("timer", "An ARIA accessibility group that acts as an updating timer.");    
+    if (ariaType == "ARIADocument")
+        return UI_STRING("document", "An ARIA accessibility group that acts as a document.");    
+    if (ariaType == "ARIADocumentArticle")
+        return UI_STRING("article", "An ARIA accessibility group that acts as an article.");    
+    if (ariaType == "ARIADocumentNote")
+        return UI_STRING("note", "An ARIA accessibility group that acts as a note in a document.");    
+    if (ariaType == "ARIADocumentRegion")
+        return UI_STRING("region", "An ARIA accessibility group that acts as a distinct region in a document.");    
+    if (ariaType == "ARIALandmarkApplication")
+        return UI_STRING("application", "An ARIA accessibility group that acts as an application.");    
+    if (ariaType == "ARIALandmarkBanner")
+        return UI_STRING("banner", "An ARIA accessibility group that acts as a banner.");    
+    if (ariaType == "ARIALandmarkComplementary")
+        return UI_STRING("complementary", "An ARIA accessibility group that acts as a region of complementary information.");    
+    if (ariaType == "ARIALandmarkContentInfo")
+        return UI_STRING("content", "An ARIA accessibility group that contains content.");    
+    if (ariaType == "ARIALandmarkMain")
+        return UI_STRING("main", "An ARIA accessibility group that is the main portion of the website.");    
+    if (ariaType == "ARIALandmarkNavigation")
+        return UI_STRING("navigation", "An ARIA accessibility group that contains the main navigation elements of a website.");    
+    if (ariaType == "ARIALandmarkSearch")
+        return UI_STRING("search", "An ARIA accessibility group that contains a search feature of a website.");    
+    if (ariaType == "ARIAUserInterfaceTooltip")
+        return UI_STRING("tooltip", "An ARIA accessibility group that acts as a tooltip.");    
+    if (ariaType == "ARIATabPanel")
+        return UI_STRING("tab panel", "An ARIA accessibility group that contains the content of a tab.");
+    if (ariaType == "ARIADocumentMath")
+        return UI_STRING("math", "An ARIA accessibility group that contains mathematical symbols.");
+    return String();
+}
+#endif
+
+String DefaultLocalizationStrategy::AXButtonActionVerb()
+{
+    return UI_STRING("press", "Verb stating the action that will occur when a button is pressed, as used by accessibility");
+}
+
+String DefaultLocalizationStrategy::AXRadioButtonActionVerb() 
+{
+    return UI_STRING("select", "Verb stating the action that will occur when a radio button is clicked, as used by accessibility");
+}
+
+String DefaultLocalizationStrategy::AXTextFieldActionVerb()
+{
+    return UI_STRING("activate", "Verb stating the action that will occur when a text field is selected, as used by accessibility");
+}
+
+String DefaultLocalizationStrategy::AXCheckedCheckBoxActionVerb()
+{
+    return UI_STRING("uncheck", "Verb stating the action that will occur when a checked checkbox is clicked, as used by accessibility");
+}
+
+String DefaultLocalizationStrategy::AXUncheckedCheckBoxActionVerb()
+{
+    return UI_STRING("check", "Verb stating the action that will occur when an unchecked checkbox is clicked, as used by accessibility");
+}
+
+String DefaultLocalizationStrategy::AXMenuListActionVerb()
+{
+    notImplemented();
+    return "select";
+}
+
+String DefaultLocalizationStrategy::AXMenuListPopupActionVerb()
+{
+    notImplemented();
+    return "select";
+}
+
+String DefaultLocalizationStrategy::AXLinkActionVerb()
+{
+    return UI_STRING("jump", "Verb stating the action that will occur when a link is clicked, as used by accessibility");
+}
+
+String DefaultLocalizationStrategy::missingPluginText()
+{
+    return UI_STRING("Missing Plug-in", "Label text to be used when a plugin is missing");
+}
+
+String DefaultLocalizationStrategy::crashedPluginText()
+{
+    return UI_STRING("Plug-in Failure", "Label text to be used if plugin host process has crashed");
+}
+
+String DefaultLocalizationStrategy::multipleFileUploadText(unsigned numberOfFiles)
+{
+    return formatLocalizedString(UI_STRING("%d files", "Label to describe the number of files selected in a file upload control that allows multiple files"), numberOfFiles);
+}
+
+String DefaultLocalizationStrategy::unknownFileSizeText()
+{
+    return UI_STRING("Unknown", "Unknown filesize FTP directory listing item");
+}
+
+#if PLATFORM(WIN)
+
+String DefaultLocalizationStrategy::uploadFileText()
+{
+    notImplemented();
+    return "upload";
+}
+
+String DefaultLocalizationStrategy::allFilesText()
+{
+    notImplemented();
+    return "all files";
+}
+
+#endif
+
+#if PLATFORM(MAC)
+
+String DefaultLocalizationStrategy::keygenMenuItem512()
+{
+    return UI_STRING("512 (Low Grade)", "Menu item title for KEYGEN pop-up menu");
+}
+
+String DefaultLocalizationStrategy::keygenMenuItem1024()
+{
+    return UI_STRING("1024 (Medium Grade)", "Menu item title for KEYGEN pop-up menu");
+}
+
+String DefaultLocalizationStrategy::keygenMenuItem2048()
+{
+    return UI_STRING("2048 (High Grade)", "Menu item title for KEYGEN pop-up menu");
+}
+
+String DefaultLocalizationStrategy::keygenKeychainItemName(const String& host)
+{
+    return UI_STRING("Key from <hostname>", "Name of keychain key generated by the KEYGEN tag").replace("<hostname>", host);
+}
+
+#endif
+
+String DefaultLocalizationStrategy::imageTitle(const String& filename, const IntSize& size)
+{
+    // FIXME: This should format the numbers correctly. In Mac WebKit, we used +[NSNumberFormatter localizedStringFromNumber:numberStyle:].
+    return formatLocalizedString(UI_STRING("<filename> %d×%d pixels", "window title suffix for a standalone image (uses multiplication symbol, not x)"), size.width(), size.height()).replace("<filename>", filename);
+}
+
+String DefaultLocalizationStrategy::mediaElementLoadingStateText()
+{
+    return UI_STRING("Loading...", "Media controller status message when the media is loading");
+}
+
+String DefaultLocalizationStrategy::mediaElementLiveBroadcastStateText()
+{
+    return UI_STRING("Live Broadcast", "Media controller status message when watching a live broadcast");
+}
+
+String DefaultLocalizationStrategy::localizedMediaControlElementString(const String& name)
+{
+    if (name == "AudioElement")
+        return UI_STRING("audio element controller", "accessibility role description for audio element controller");
+    if (name == "VideoElement")
+        return UI_STRING("video element controller", "accessibility role description for video element controller");
+    if (name == "MuteButton")
+        return UI_STRING("mute", "accessibility role description for mute button");
+    if (name == "UnMuteButton")
+        return UI_STRING("unmute", "accessibility role description for turn mute off button");
+    if (name == "PlayButton")
+        return UI_STRING("play", "accessibility role description for play button");
+    if (name == "PauseButton")
+        return UI_STRING("pause", "accessibility role description for pause button");
+    if (name == "Slider")
+        return UI_STRING("movie time", "accessibility role description for timeline slider");
+    if (name == "SliderThumb")
+        return UI_STRING("timeline slider thumb", "accessibility role description for timeline thumb");
+    if (name == "RewindButton")
+        return UI_STRING("back 30 seconds", "accessibility role description for seek back 30 seconds button");
+    if (name == "ReturnToRealtimeButton")
+        return UI_STRING("return to realtime", "accessibility role description for return to real time button");
+    if (name == "CurrentTimeDisplay")
+        return UI_STRING("elapsed time", "accessibility role description for elapsed time display");
+    if (name == "TimeRemainingDisplay")
+        return UI_STRING("remaining time", "accessibility role description for time remaining display");
+    if (name == "StatusDisplay")
+        return UI_STRING("status", "accessibility role description for movie status");
+    if (name == "FullscreenButton")
+        return UI_STRING("fullscreen", "accessibility role description for enter fullscreen button");
+    if (name == "SeekForwardButton")
+        return UI_STRING("fast forward", "accessibility role description for fast forward button");
+    if (name == "SeekBackButton")
+        return UI_STRING("fast reverse", "accessibility role description for fast reverse button");
+    if (name == "ShowClosedCaptionsButton")
+        return UI_STRING("show closed captions", "accessibility role description for show closed captions button");
+    if (name == "HideClosedCaptionsButton")
+        return UI_STRING("hide closed captions", "accessibility role description for hide closed captions button");
+
+    // FIXME: the ControlsPanel container should never be visible in the accessibility hierarchy.
+    if (name == "ControlsPanel")
+        return String();
+
+    ASSERT_NOT_REACHED();
+    return String();
+}
+
+String DefaultLocalizationStrategy::localizedMediaControlElementHelpText(const String& name)
+{
+    if (name == "AudioElement")
+        return UI_STRING("audio element playback controls and status display", "accessibility role description for audio element controller");
+    if (name == "VideoElement")
+        return UI_STRING("video element playback controls and status display", "accessibility role description for video element controller");
+    if (name == "MuteButton")
+        return UI_STRING("mute audio tracks", "accessibility help text for mute button");
+    if (name == "UnMuteButton")
+        return UI_STRING("unmute audio tracks", "accessibility help text for un mute button");
+    if (name == "PlayButton")
+        return UI_STRING("begin playback", "accessibility help text for play button");
+    if (name == "PauseButton")
+        return UI_STRING("pause playback", "accessibility help text for pause button");
+    if (name == "Slider")
+        return UI_STRING("movie time scrubber", "accessibility help text for timeline slider");
+    if (name == "SliderThumb")
+        return UI_STRING("movie time scrubber thumb", "accessibility help text for timeline slider thumb");
+    if (name == "RewindButton")
+        return UI_STRING("seek movie back 30 seconds", "accessibility help text for jump back 30 seconds button");
+    if (name == "ReturnToRealtimeButton")
+        return UI_STRING("return streaming movie to real time", "accessibility help text for return streaming movie to real time button");
+    if (name == "CurrentTimeDisplay")
+        return UI_STRING("current movie time in seconds", "accessibility help text for elapsed time display");
+    if (name == "TimeRemainingDisplay")
+        return UI_STRING("number of seconds of movie remaining", "accessibility help text for remaining time display");
+    if (name == "StatusDisplay")
+        return UI_STRING("current movie status", "accessibility help text for movie status display");
+    if (name == "SeekBackButton")
+        return UI_STRING("seek quickly back", "accessibility help text for fast rewind button");
+    if (name == "SeekForwardButton")
+        return UI_STRING("seek quickly forward", "accessibility help text for fast forward button");
+    if (name == "FullscreenButton")
+        return UI_STRING("Play movie in fullscreen mode", "accessibility help text for enter fullscreen button");
+    if (name == "ShowClosedCaptionsButton")
+        return UI_STRING("start displaying closed captions", "accessibility help text for show closed captions button");
+    if (name == "HideClosedCaptionsButton")
+        return UI_STRING("stop displaying closed captions", "accessibility help text for hide closed captions button");
+
+    ASSERT_NOT_REACHED();
+    return String();
+}
+
+String DefaultLocalizationStrategy::localizedMediaTimeDescription(float time)
+{
+    if (!isfinite(time))
+        return UI_STRING("indefinite time", "accessibility help text for an indefinite media controller time value");
+
+    int seconds = static_cast<int>(fabsf(time)); 
+    int days = seconds / (60 * 60 * 24);
+    int hours = seconds / (60 * 60);
+    int minutes = (seconds / 60) % 60;
+    seconds %= 60;
+
+    if (days)
+        return formatLocalizedString(UI_STRING("%1$d days %2$d hours %3$d minutes %4$d seconds", "accessibility help text for media controller time value >= 1 day"), days, hours, minutes, seconds);
+    if (hours)
+        return formatLocalizedString(UI_STRING("%1$d hours %2$d minutes %3$d seconds", "accessibility help text for media controller time value >= 60 minutes"), hours, minutes, seconds);
+    if (minutes)
+        return formatLocalizedString(UI_STRING("%1$d minutes %2$d seconds", "accessibility help text for media controller time value >= 60 seconds"), minutes, seconds);
+    return formatLocalizedString(UI_STRING("%1$d seconds", "accessibility help text for media controller time value < 60 seconds"), seconds);
+}
+
+String DefaultLocalizationStrategy::validationMessageValueMissingText()
+{
+    return UI_STRING("value missing", "Validation message for required form control elements that have no value");
+}
+
+String DefaultLocalizationStrategy::validationMessageTypeMismatchText()
+{
+    return UI_STRING("type mismatch", "Validation message for input form controls with a value not matching type");
+}
+
+String DefaultLocalizationStrategy::validationMessagePatternMismatchText()
+{
+    return UI_STRING("pattern mismatch", "Validation message for input form controls requiring a constrained value according to pattern");
+}
+
+String DefaultLocalizationStrategy::validationMessageTooLongText()
+{
+    return UI_STRING("too long", "Validation message for form control elements with a value longer than maximum allowed length");
+}
+
+String DefaultLocalizationStrategy::validationMessageRangeUnderflowText()
+{
+    return UI_STRING("range underflow", "Validation message for input form controls with value lower than allowed minimum");
+}
+
+String DefaultLocalizationStrategy::validationMessageRangeOverflowText()
+{
+    return UI_STRING("range overflow", "Validation message for input form controls with value higher than allowed maximum");
+}
+
+String DefaultLocalizationStrategy::validationMessageStepMismatchText()
+{
+    return UI_STRING("step mismatch", "Validation message for input form controls with value not respecting the step attribute");
+}
+
+} // namespace WebCore
+
+#endif // USE(PLATFORM_STRATEGIES)
diff --git a/Source/WebCore/platform/DefaultLocalizationStrategy.h b/Source/WebCore/platform/DefaultLocalizationStrategy.h
new file mode 100644
index 0000000..56120e0
--- /dev/null
+++ b/Source/WebCore/platform/DefaultLocalizationStrategy.h
@@ -0,0 +1,187 @@
+/*
+ * Copyright (C) 2010, 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef DefaultLocalizationStrategy_h
+#define DefaultLocalizationStrategy_h
+
+#if USE(PLATFORM_STRATEGIES)
+
+#include "LocalizationStrategy.h"
+#include <wtf/text/WTFString.h>
+
+namespace WebCore {
+
+class DefaultLocalizationStrategy : public LocalizationStrategy {
+public:
+    DefaultLocalizationStrategy();
+
+private:
+    virtual String inputElementAltText();
+    virtual String resetButtonDefaultLabel();
+    virtual String searchableIndexIntroduction();
+    virtual String submitButtonDefaultLabel();
+    virtual String fileButtonChooseFileLabel();
+    virtual String fileButtonNoFileSelectedLabel();
+    virtual String defaultDetailsSummaryText();
+#if PLATFORM(MAC)
+    virtual String copyImageUnknownFileLabel();
+#endif
+#if ENABLE(CONTEXT_MENUS)
+    virtual String contextMenuItemTagOpenLinkInNewWindow();
+    virtual String contextMenuItemTagDownloadLinkToDisk();
+    virtual String contextMenuItemTagCopyLinkToClipboard();
+    virtual String contextMenuItemTagOpenImageInNewWindow();
+    virtual String contextMenuItemTagDownloadImageToDisk();
+    virtual String contextMenuItemTagCopyImageToClipboard();
+#if PLATFORM(QT)
+    virtual String contextMenuItemTagCopyImageUrlToClipboard();
+#endif
+    virtual String contextMenuItemTagOpenFrameInNewWindow();
+    virtual String contextMenuItemTagCopy();
+    virtual String contextMenuItemTagGoBack();
+    virtual String contextMenuItemTagGoForward();
+    virtual String contextMenuItemTagStop();
+    virtual String contextMenuItemTagReload();
+    virtual String contextMenuItemTagCut();
+    virtual String contextMenuItemTagPaste();
+#if PLATFORM(GTK)
+    virtual String contextMenuItemTagDelete();
+    virtual String contextMenuItemTagInputMethods();
+    virtual String contextMenuItemTagUnicode();
+#endif
+#if PLATFORM(GTK) || PLATFORM(QT)
+    virtual String contextMenuItemTagSelectAll();
+#endif
+    virtual String contextMenuItemTagNoGuessesFound();
+    virtual String contextMenuItemTagIgnoreSpelling();
+    virtual String contextMenuItemTagLearnSpelling();
+    virtual String contextMenuItemTagSearchWeb();
+    virtual String contextMenuItemTagLookUpInDictionary(const String& selectedString);
+    virtual String contextMenuItemTagOpenLink();
+    virtual String contextMenuItemTagIgnoreGrammar();
+    virtual String contextMenuItemTagSpellingMenu();
+    virtual String contextMenuItemTagShowSpellingPanel(bool show);
+    virtual String contextMenuItemTagCheckSpelling();
+    virtual String contextMenuItemTagCheckSpellingWhileTyping();
+    virtual String contextMenuItemTagCheckGrammarWithSpelling();
+    virtual String contextMenuItemTagFontMenu();
+    virtual String contextMenuItemTagBold();
+    virtual String contextMenuItemTagItalic();
+    virtual String contextMenuItemTagUnderline();
+    virtual String contextMenuItemTagOutline();
+    virtual String contextMenuItemTagWritingDirectionMenu();
+    virtual String contextMenuItemTagTextDirectionMenu();
+    virtual String contextMenuItemTagDefaultDirection();
+    virtual String contextMenuItemTagLeftToRight();
+    virtual String contextMenuItemTagRightToLeft();
+#if PLATFORM(MAC)
+    virtual String contextMenuItemTagSearchInSpotlight();
+    virtual String contextMenuItemTagShowFonts();
+    virtual String contextMenuItemTagStyles();
+    virtual String contextMenuItemTagShowColors();
+    virtual String contextMenuItemTagSpeechMenu();
+    virtual String contextMenuItemTagStartSpeaking();
+    virtual String contextMenuItemTagStopSpeaking();
+    virtual String contextMenuItemTagCorrectSpellingAutomatically();
+    virtual String contextMenuItemTagSubstitutionsMenu();
+    virtual String contextMenuItemTagShowSubstitutions(bool show);
+    virtual String contextMenuItemTagSmartCopyPaste();
+    virtual String contextMenuItemTagSmartQuotes();
+    virtual String contextMenuItemTagSmartDashes();
+    virtual String contextMenuItemTagSmartLinks();
+    virtual String contextMenuItemTagTextReplacement();
+    virtual String contextMenuItemTagTransformationsMenu();
+    virtual String contextMenuItemTagMakeUpperCase();
+    virtual String contextMenuItemTagMakeLowerCase();
+    virtual String contextMenuItemTagCapitalize();
+    virtual String contextMenuItemTagChangeBack(const String& replacedString);
+#endif
+    virtual String contextMenuItemTagInspectElement();
+    virtual String contextMenuItemTagOpenVideoInNewWindow();
+    virtual String contextMenuItemTagOpenAudioInNewWindow();
+    virtual String contextMenuItemTagCopyVideoLinkToClipboard();
+    virtual String contextMenuItemTagCopyAudioLinkToClipboard();
+    virtual String contextMenuItemTagToggleMediaControls();
+    virtual String contextMenuItemTagToggleMediaLoop();
+    virtual String contextMenuItemTagEnterVideoFullscreen();
+    virtual String contextMenuItemTagMediaPlay();
+    virtual String contextMenuItemTagMediaPause();
+    virtual String contextMenuItemTagMediaMute();
+#endif // ENABLE(CONTEXT_MENUS)
+    virtual String searchMenuNoRecentSearchesText();
+    virtual String searchMenuRecentSearchesText();
+    virtual String searchMenuClearRecentSearchesText();
+    virtual String AXWebAreaText();
+    virtual String AXLinkText();
+    virtual String AXListMarkerText();
+    virtual String AXImageMapText();
+    virtual String AXHeadingText();
+    virtual String AXDefinitionListTermText();
+    virtual String AXDefinitionListDefinitionText();
+#if PLATFORM(MAC)
+    virtual String AXARIAContentGroupText(const String& ariaType);
+#endif
+    virtual String AXButtonActionVerb();
+    virtual String AXRadioButtonActionVerb();
+    virtual String AXTextFieldActionVerb();
+    virtual String AXCheckedCheckBoxActionVerb();
+    virtual String AXUncheckedCheckBoxActionVerb();
+    virtual String AXMenuListActionVerb();
+    virtual String AXMenuListPopupActionVerb();
+    virtual String AXLinkActionVerb();
+    virtual String missingPluginText();
+    virtual String crashedPluginText();
+    virtual String multipleFileUploadText(unsigned numberOfFiles);
+    virtual String unknownFileSizeText();
+#if PLATFORM(WIN)
+    virtual String uploadFileText();
+    virtual String allFilesText();
+#endif
+#if PLATFORM(MAC)
+    virtual String keygenMenuItem512();
+    virtual String keygenMenuItem1024();
+    virtual String keygenMenuItem2048();
+    virtual String keygenKeychainItemName(const String& host);
+#endif
+    virtual String imageTitle(const String& filename, const IntSize&);
+    virtual String mediaElementLoadingStateText();
+    virtual String mediaElementLiveBroadcastStateText();
+    virtual String localizedMediaControlElementString(const String&);
+    virtual String localizedMediaControlElementHelpText(const String&);
+    virtual String localizedMediaTimeDescription(float);
+    virtual String validationMessageValueMissingText();
+    virtual String validationMessageTypeMismatchText();
+    virtual String validationMessagePatternMismatchText();
+    virtual String validationMessageTooLongText();
+    virtual String validationMessageRangeUnderflowText();
+    virtual String validationMessageRangeOverflowText();
+    virtual String validationMessageStepMismatchText();
+};
+
+} // namespace WebCore
+
+#endif // USE(PLATFORM_STRATEGIES)
+
+#endif // DefaultLocalizationStrategy_h
diff --git a/Source/WebCore/platform/FileMetadata.h b/Source/WebCore/platform/FileMetadata.h
index 9b7d09b..99fe2f3 100644
--- a/Source/WebCore/platform/FileMetadata.h
+++ b/Source/WebCore/platform/FileMetadata.h
@@ -31,6 +31,8 @@
 #ifndef FileMetadata_h
 #define FileMetadata_h
 
+#include <wtf/text/WTFString.h>
+
 #if ENABLE(FILE_SYSTEM)
 
 namespace WebCore {
@@ -52,6 +54,8 @@ struct FileMetadata {
 
     Type type;
 
+    String platformPath;
+
     FileMetadata() : modificationTime(0.0), length(-1), type(TypeUnknown) { }
 };
 
diff --git a/Source/WebCore/platform/FileSystem.cpp b/Source/WebCore/platform/FileSystem.cpp
index 0f69b7f..cc2e904 100644
--- a/Source/WebCore/platform/FileSystem.cpp
+++ b/Source/WebCore/platform/FileSystem.cpp
@@ -26,6 +26,8 @@
 #include "config.h"
 #include "FileSystem.h"
 
+#include <wtf/HexNumber.h>
+
 namespace WebCore {
 
 // The following lower-ASCII characters need escaping to be used in a filename
@@ -75,8 +77,6 @@ static inline bool shouldEscapeUChar(UChar c)
     return c > 127 ? false : needsEscaping[c];
 }
 
-static const char hexDigits[17] = "0123456789ABCDEF";
-
 String encodeForFileName(const String& inputStr)
 {
     unsigned length = inputStr.length();
@@ -90,8 +90,7 @@ String encodeForFileName(const String& inputStr)
         UChar c = *str++;
         if (shouldEscapeUChar(c)) {
             *p++ = '%';
-            *p++ = hexDigits[(c >> 4) & 0xF];
-            *p++ = hexDigits[c & 0xF];
+            placeByteAsHex(c, p);
         } else
             *p++ = c;
     }
diff --git a/Source/WebCore/platform/FileSystem.h b/Source/WebCore/platform/FileSystem.h
index 8b7d0f0..49a78e8 100644
--- a/Source/WebCore/platform/FileSystem.h
+++ b/Source/WebCore/platform/FileSystem.h
@@ -172,7 +172,7 @@ CString fileSystemRepresentation(const String&);
 inline bool isHandleValid(const PlatformFileHandle& handle) { return handle != invalidPlatformFileHandle; }
 
 // Prefix is what the filename should be prefixed with, not the full path.
-CString openTemporaryFile(const char* prefix, PlatformFileHandle&);
+String openTemporaryFile(const String& prefix, PlatformFileHandle&);
 PlatformFileHandle openFile(const String& path, FileOpenMode);
 void closeFile(PlatformFileHandle&);
 // Returns the resulting offset from the beginning of the file if successful, -1 otherwise.
diff --git a/Source/WebCore/platform/HostWindow.h b/Source/WebCore/platform/HostWindow.h
index 0d19356..316f043 100644
--- a/Source/WebCore/platform/HostWindow.h
+++ b/Source/WebCore/platform/HostWindow.h
@@ -52,7 +52,7 @@ public:
 
 #if ENABLE(TILED_BACKING_STORE)
     // Requests the host to do the actual scrolling. This is only used in combination with a tiled backing store.
-    virtual void delegatedScrollRequested(const IntSize& scrollDelta) = 0;
+    virtual void delegatedScrollRequested(const IntPoint& scrollPoint) = 0;
 #endif
 
     // Methods for doing coordinate conversions to and from screen coordinates.
diff --git a/Source/WebCore/platform/KURL.cpp b/Source/WebCore/platform/KURL.cpp
index 0032f09..88ad3d9 100644
--- a/Source/WebCore/platform/KURL.cpp
+++ b/Source/WebCore/platform/KURL.cpp
@@ -30,6 +30,7 @@
 #include "TextEncoding.h"
 #include <wtf/text/CString.h>
 #include <wtf/HashMap.h>
+#include <wtf/HexNumber.h>
 #include <wtf/StdLibExtras.h>
 #include <wtf/text/StringHash.h>
 
@@ -89,8 +90,6 @@ enum URLCharacterClasses {
     BadChar = 1 << 6
 };
 
-static const char hexDigits[17] = "0123456789ABCDEF";
-
 static const unsigned char characterClassTable[256] = {
     /* 0 nul */ PathSegmentEndChar,    /* 1 soh */ BadChar,
     /* 2 stx */ BadChar,    /* 3 etx */ BadChar,
@@ -221,7 +220,6 @@ static const unsigned char characterClassTable[256] = {
 static int copyPathRemovingDots(char* dst, const char* src, int srcStart, int srcEnd);
 static void encodeRelativeString(const String& rel, const TextEncoding&, CharBuffer& ouput);
 static String substituteBackslashes(const String&);
-static bool isValidProtocol(const String&);
 
 static inline bool isSchemeFirstChar(char c) { return characterClassTable[static_cast<unsigned char>(c)] & SchemeFirstChar; }
 static inline bool isSchemeFirstChar(UChar c) { return c <= 0xff && (characterClassTable[c] & SchemeFirstChar); }
@@ -861,7 +859,11 @@ void KURL::setPath(const String& s)
 
     // FIXME: encodeWithURLEscapeSequences does not correctly escape '#' and '?', so fragment and query parts
     // may be inadvertently affected.
-    parse(m_string.left(m_portEnd) + encodeWithURLEscapeSequences(s) + m_string.substring(m_pathEnd));
+    String path = s;
+    if (path.isEmpty() || path[0] != '/')
+        path = "/" + path;
+
+    parse(m_string.left(m_portEnd) + encodeWithURLEscapeSequences(path) + m_string.substring(m_pathEnd));
 }
 
 String KURL::prettyURL() const
@@ -971,8 +973,7 @@ String decodeURLEscapeSequences(const String& str, const TextEncoding& encoding)
 static void appendEscapedChar(char*& buffer, unsigned char c)
 {
     *buffer++ = '%';
-    *buffer++ = hexDigits[c >> 4];
-    *buffer++ = hexDigits[c & 0xF];
+    placeByteAsHex(c, buffer);
 }
 
 static void appendEscapingBadChars(char*& buffer, const char* strStart, size_t length)
@@ -1131,6 +1132,11 @@ static inline bool isDefaultPortForScheme(const char* port, size_t portLength, c
     return false;
 }
 
+static inline bool hostPortIsEmptyButCredentialsArePresent(int hostStart, int portEnd, char userEndChar)
+{
+    return userEndChar == '@' && hostStart == portEnd;
+}
+
 void KURL::parse(const char* url, const String* originalString)
 {
     if (!url || url[0] == '\0') {
@@ -1256,6 +1262,12 @@ void KURL::parse(const char* url, const String* originalString)
             return;
         }
 
+        if (hostPortIsEmptyButCredentialsArePresent(hostStart, portEnd, url[userEnd])) {
+            // in this circumstance, act as if there is an erroneous hostname containing an '@'
+            userEnd = userStart;
+            hostStart = userEnd;
+        }
+
         if (userStart == portEnd && !m_protocolInHTTPFamily && !isFile) {
             // No authority found, which means that this is not a net_path, but rather an abs_path whose first two
             // path segments are empty. For file, http and https only, an empty authority is allowed.
diff --git a/Source/WebCore/platform/KURL.h b/Source/WebCore/platform/KURL.h
index be72824..5764494 100644
--- a/Source/WebCore/platform/KURL.h
+++ b/Source/WebCore/platform/KURL.h
@@ -279,6 +279,8 @@ bool protocolIsJavaScript(const String& url);
 bool isDefaultPortForProtocol(unsigned short port, const String& protocol);
 bool portAllowed(const KURL&); // Blacklist ports that should never be used for Web resources.
 
+bool isValidProtocol(const String&);
+
 String mimeTypeFromDataURL(const String& url);
 
 // Unescapes the given string using URL escaping rules, given an optional
diff --git a/Source/WebCore/platform/KURLGoogle.cpp b/Source/WebCore/platform/KURLGoogle.cpp
index 231c43d..88120a8 100644
--- a/Source/WebCore/platform/KURLGoogle.cpp
+++ b/Source/WebCore/platform/KURLGoogle.cpp
@@ -133,6 +133,22 @@ static inline bool isSchemeChar(char c)
     return isSchemeFirstChar(c) || (c >= '0' && c <= '9') || c == '.' || c == '-' || c == '*';
 }
 
+bool isValidProtocol(const String& protocol)
+{
+    // NOTE This is a copy of the function in KURL.cpp.
+    // RFC3986: ALPHA *( ALPHA / DIGIT / "+" / "-" / "." )
+    if (protocol.isEmpty())
+        return false;
+    if (!isSchemeFirstChar(protocol[0]))
+        return false;
+    unsigned protocolLength = protocol.length();
+    for (unsigned i = 1; i < protocolLength; i++) {
+        if (!isSchemeChar(protocol[i]))
+            return false;
+    }
+    return true;
+}
+
 
 // KURLGooglePrivate -----------------------------------------------------------
 
diff --git a/Source/WebCore/platform/KillRingNone.cpp b/Source/WebCore/platform/KillRingNone.cpp
index 35098aa..310aa08 100644
--- a/Source/WebCore/platform/KillRingNone.cpp
+++ b/Source/WebCore/platform/KillRingNone.cpp
@@ -28,11 +28,11 @@
 
 namespace WebCore {
 
-void KillRing::append(const String& string)
+void KillRing::append(const String&)
 {
 }
 
-void KillRing::prepend(const String& string)
+void KillRing::prepend(const String&)
 {
 }
 
diff --git a/Source/WebCore/platform/Length.h b/Source/WebCore/platform/Length.h
index 886dfec..2b11a5f 100644
--- a/Source/WebCore/platform/Length.h
+++ b/Source/WebCore/platform/Length.h
@@ -1,6 +1,7 @@
 /*
     Copyright (C) 1999 Lars Knoll (knoll@kde.org)
     Copyright (C) 2006, 2008 Apple Inc. All rights reserved.
+    Copyright (C) 2011 Rik Cabanier (cabanier@adobe.com)
 
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
@@ -30,7 +31,6 @@
 namespace WebCore {
 
 const int undefinedLength = -1;
-const int percentScaleFactor = 128;
 const int intMaxForLength = 0x7ffffff; // max value for a 28-bit int
 const int intMinForLength = (-0x7ffffff - 1); // min value for a 28-bit int
 
@@ -40,72 +40,79 @@ struct Length {
     WTF_MAKE_FAST_ALLOCATED;
 public:
     Length()
-        : m_value(0)
+        :  m_intValue(0), m_quirk(false), m_type(Auto), m_isFloat(false)
     {
     }
 
     Length(LengthType t)
-        : m_value(t)
+        : m_intValue(0), m_quirk(false), m_type(t), m_isFloat(false)
     {
     }
 
     Length(int v, LengthType t, bool q = false)
-        : m_value((v * 16) | (q << 3) | t) // FIXME: Doesn't work if the passed-in value is very large!
+        : m_intValue(v), m_quirk(q), m_type(t), m_isFloat(false)
     {
-        ASSERT(t != Percent);
+    }
+    
+    Length(float v, LengthType t, bool q = false)
+    : m_floatValue(v), m_quirk(q), m_type(t), m_isFloat(true)
+    {            
     }
 
     Length(double v, LengthType t, bool q = false)
-        : m_value(static_cast<int>(v * percentScaleFactor) * 16 | (q << 3) | t)
-    {
-        ASSERT(t == Percent);
+        : m_quirk(q), m_type(t), m_isFloat(true)
+    {           
+        m_floatValue = static_cast<float>(v);    
     }
 
-    bool operator==(const Length& o) const { return m_value == o.m_value; }
-    bool operator!=(const Length& o) const { return m_value != o.m_value; }
+    bool operator==(const Length& o) const { return (getFloatValue() == o.getFloatValue()) && (m_type == o.m_type) && (m_quirk == o.m_quirk); }
+    bool operator!=(const Length& o) const { return (getFloatValue() != o.getFloatValue()) || (m_type != o.m_type) || (m_quirk != o.m_quirk); }
 
+    const Length& operator*=(float v)
+    {        
+        if (m_isFloat)
+            m_floatValue = static_cast<float>(m_floatValue * v);
+        else        
+            m_intValue = static_cast<int>(m_intValue * v);
+        
+        return *this;
+    }
+    
     int value() const {
-        ASSERT(type() != Percent);
-        return rawValue();
+        return getIntValue();
     }
 
-    int rawValue() const { return (m_value & ~0xF) / 16; }
-
-    double percent() const
+    float percent() const
     {
         ASSERT(type() == Percent);
-        return static_cast<double>(rawValue()) / percentScaleFactor;
+        return getFloatValue();
     }
 
-    LengthType type() const { return static_cast<LengthType>(m_value & 7); }
-    bool quirk() const { return (m_value >> 3) & 1; }
+    LengthType type() const { return static_cast<LengthType>(m_type); }
+    bool quirk() const { return m_quirk; }
 
     void setValue(LengthType t, int value)
     {
-        ASSERT(t != Percent);
-        setRawValue(t, value);
+        m_type = t;
+        m_intValue = value;
+        m_isFloat = false;
     }
 
-    void setRawValue(LengthType t, int value) { m_value = value * 16 | (m_value & 0x8) | t; }
-
     void setValue(int value)
     {
-        ASSERT(!value || type() != Percent);
-        setRawValue(value);
+        setValue(Fixed, value);
     }
 
-    void setRawValue(int value) { m_value = value * 16 | (m_value & 0xF); }
-
-    void setValue(LengthType t, double value)
+    void setValue(LengthType t, float value)
     {
-        ASSERT(t == Percent);
-        m_value = static_cast<int>(value * percentScaleFactor) * 16 | (m_value & 0x8) | t;
+        m_type = t;
+        m_floatValue = value;
+        m_isFloat = true;    
     }
 
-    void setValue(double value)
+    void setValue(float value)
     {
-        ASSERT(type() == Percent);
-        m_value = static_cast<int>(value * percentScaleFactor) * 16 | (m_value & 0xF);
+        *this = Length(value, Fixed);
     }
 
     // note: works only for certain types, returns undefinedLength otherwise
@@ -113,11 +120,8 @@ public:
     {
         switch (type()) {
             case Fixed:
-                return value();
             case Percent:
-                if (roundPercentages)
-                    return static_cast<int>(round(maxValue * percent() / 100.0));
-                return maxValue * rawValue() / (100 * percentScaleFactor);
+                return calcMinValue(maxValue, roundPercentages);
             case Auto:
                 return maxValue;
             default:
@@ -132,8 +136,9 @@ public:
                 return value();
             case Percent:
                 if (roundPercentages)
-                    return static_cast<int>(round(maxValue * percent() / 100.0));
-                return maxValue * rawValue() / (100 * percentScaleFactor);
+                    return static_cast<int>(round(maxValue * percent() / 100.0f));
+                // Don't remove the extra cast to float. It is needed for rounding on 32-bit Intel machines that use the FPU stack.
+                return static_cast<int>(static_cast<float>(maxValue * percent() / 100.0f));
             case Auto:
             default:
                 return 0;
@@ -144,9 +149,9 @@ public:
     {
         switch (type()) {
             case Fixed:
-                return static_cast<float>(value());
+                return getFloatValue();
             case Percent:
-                return static_cast<float>(maxValue * percent() / 100.0);
+                return static_cast<float>(maxValue * percent() / 100.0f);
             case Auto:
                 return static_cast<float>(maxValue);
             default:
@@ -154,10 +159,14 @@ public:
         }
     }
 
-    bool isUndefined() const { return rawValue() == undefinedLength; }
-    bool isZero() const { return !(m_value & ~0xF); }
-    bool isPositive() const { return rawValue() > 0; }
-    bool isNegative() const { return rawValue() < 0; }
+    bool isUndefined() const { return value() == undefinedLength; }
+    bool isZero() const 
+    { 
+        return m_isFloat ? !m_floatValue : !m_intValue;
+    }
+    
+    bool isPositive() const { return getFloatValue() > 0; }
+    bool isNegative() const { return getFloatValue() < 0; }
 
     bool isAuto() const { return type() == Auto; }
     bool isRelative() const { return type() == Relative; }
@@ -165,7 +174,7 @@ public:
     bool isFixed() const { return type() == Fixed; }
     bool isIntrinsicOrAuto() const { return type() == Auto || type() == MinIntrinsic || type() == Intrinsic; }
 
-    Length blend(const Length& from, double progress) const
+    Length blend(const Length& from, float progress) const
     {
         // Blend two lengths to produce a new length that is in between them.  Used for animation.
         if (!from.isZero() && !isZero() && from.type() != type())
@@ -179,18 +188,34 @@ public:
             resultType = from.type();
         
         if (resultType == Percent) {
-            double fromPercent = from.isZero() ? 0. : from.percent();
-            double toPercent = isZero() ? 0. : percent();
+            float fromPercent = from.isZero() ? 0 : from.percent();
+            float toPercent = isZero() ? 0 : percent();
             return Length(fromPercent + (toPercent - fromPercent) * progress, Percent);
         } 
             
-        int fromValue = from.isZero() ? 0 : from.value();
-        int toValue = isZero() ? 0 : value();
-        return Length(int(fromValue + (toValue - fromValue) * progress), resultType);
+        float fromValue = from.isZero() ? 0 : from.value();
+        float toValue = isZero() ? 0 : value();
+        return Length(fromValue + (toValue - fromValue) * progress, resultType);
     }
 
 private:
-    int m_value;
+    int getIntValue() const
+    {
+        return m_isFloat ? static_cast<int>(m_floatValue) : m_intValue;
+    }
+
+    float getFloatValue() const
+    {
+        return m_isFloat ? m_floatValue : m_intValue;
+    }
+
+    union {
+        int m_intValue;
+        float m_floatValue;
+    };
+    bool m_quirk;
+    unsigned char m_type;
+    bool m_isFloat;
 };
 
 PassOwnArrayPtr<Length> newCoordsArray(const String&, int& len);
diff --git a/Source/WebCore/platform/LinkHash.cpp b/Source/WebCore/platform/LinkHash.cpp
index a2acad1..29671a0 100644
--- a/Source/WebCore/platform/LinkHash.cpp
+++ b/Source/WebCore/platform/LinkHash.cpp
@@ -197,7 +197,7 @@ static inline bool needsTrailingSlash(const UChar* characters, unsigned length)
 
 static ALWAYS_INLINE LinkHash visitedLinkHashInline(const UChar* url, unsigned length)
 {
-    return AlreadyHashed::avoidDeletedValue(WTF::StringHasher::createHash(url, length));
+    return AlreadyHashed::avoidDeletedValue(StringHasher::computeHash(url, length));
 }
 
 LinkHash visitedLinkHash(const UChar* url, unsigned length)
diff --git a/Source/WebCore/platform/LocalizationStrategy.h b/Source/WebCore/platform/LocalizationStrategy.h
index eba0e7c..f883893 100644
--- a/Source/WebCore/platform/LocalizationStrategy.h
+++ b/Source/WebCore/platform/LocalizationStrategy.h
@@ -79,7 +79,7 @@ public:
     virtual String contextMenuItemTagIgnoreSpelling() = 0;
     virtual String contextMenuItemTagLearnSpelling() = 0;
     virtual String contextMenuItemTagSearchWeb() = 0;
-    virtual String contextMenuItemTagLookUpInDictionary() = 0;
+    virtual String contextMenuItemTagLookUpInDictionary(const String& selectedString) = 0;
     virtual String contextMenuItemTagOpenLink() = 0;
     virtual String contextMenuItemTagIgnoreGrammar() = 0;
     virtual String contextMenuItemTagSpellingMenu() = 0;
@@ -167,6 +167,13 @@ public:
     virtual String allFilesText() = 0;
 #endif
 
+#if PLATFORM(MAC)
+    virtual String keygenMenuItem512() = 0;
+    virtual String keygenMenuItem1024() = 0;
+    virtual String keygenMenuItem2048() = 0;
+    virtual String keygenKeychainItemName(const String& host) = 0;
+#endif
+
     virtual String imageTitle(const String& filename, const IntSize& size) = 0;
 
     virtual String mediaElementLoadingStateText() = 0;
diff --git a/Source/WebCore/platform/LocalizedStrings.cpp b/Source/WebCore/platform/LocalizedStrings.cpp
index 9656dbe..f5ad0b7 100644
--- a/Source/WebCore/platform/LocalizedStrings.cpp
+++ b/Source/WebCore/platform/LocalizedStrings.cpp
@@ -190,9 +190,9 @@ String contextMenuItemTagSearchWeb()
     return platformStrategies()->localizationStrategy()->contextMenuItemTagSearchWeb();
 }
 
-String contextMenuItemTagLookUpInDictionary()
+String contextMenuItemTagLookUpInDictionary(const String& selectedString)
 {
-    return platformStrategies()->localizationStrategy()->contextMenuItemTagLookUpInDictionary();
+    return platformStrategies()->localizationStrategy()->contextMenuItemTagLookUpInDictionary(selectedString);
 }
 
 String contextMenuItemTagOpenLink()
@@ -569,6 +569,29 @@ String allFilesText()
 }
 #endif
 
+#if PLATFORM(MAC)
+String keygenMenuItem512()
+{
+    return platformStrategies()->localizationStrategy()->keygenMenuItem512();
+}
+
+String keygenMenuItem1024()
+{
+    return platformStrategies()->localizationStrategy()->keygenMenuItem1024();
+}
+
+String keygenMenuItem2048()
+{
+    return platformStrategies()->localizationStrategy()->keygenMenuItem2048();
+}
+
+String keygenKeychainItemName(const String& host)
+{
+    return platformStrategies()->localizationStrategy()->keygenKeychainItemName(host);
+}
+
+#endif
+
 String imageTitle(const String& filename, const IntSize& size)
 {
     return platformStrategies()->localizationStrategy()->imageTitle(filename, size);
@@ -676,4 +699,11 @@ String validationMessageStepMismatchText(const String&, const String&)
 
 #endif // USE(PLATFORM_STRATEGIES)
 
+#if !PLATFORM(MAC) && !PLATFORM(WIN)
+String localizedString(const char* key)
+{
+    return String::fromUTF8(key, strlen(key));
+}
+#endif
+
 } // namespace WebCore
diff --git a/Source/WebCore/platform/LocalizedStrings.h b/Source/WebCore/platform/LocalizedStrings.h
index f22c975..3885439 100644
--- a/Source/WebCore/platform/LocalizedStrings.h
+++ b/Source/WebCore/platform/LocalizedStrings.h
@@ -75,7 +75,7 @@ namespace WebCore {
     String contextMenuItemTagIgnoreSpelling();
     String contextMenuItemTagLearnSpelling();
     String contextMenuItemTagSearchWeb();
-    String contextMenuItemTagLookUpInDictionary();
+    String contextMenuItemTagLookUpInDictionary(const String& selectedString);
     String contextMenuItemTagOpenLink();
     String contextMenuItemTagIgnoreGrammar();
     String contextMenuItemTagSpellingMenu();
@@ -163,6 +163,13 @@ namespace WebCore {
     String allFilesText();
 #endif
 
+#if PLATFORM(MAC)
+    String keygenMenuItem512();
+    String keygenMenuItem1024();
+    String keygenMenuItem2048();
+    String keygenKeychainItemName(const String& host);
+#endif
+
     String imageTitle(const String& filename, const IntSize& size);
 
     String mediaElementLoadingStateText();
@@ -187,9 +194,11 @@ namespace WebCore {
     String validationMessageRangeOverflowText(const String& maximum);
     String validationMessageStepMismatchText(const String& base, const String& step);
 
-#if PLATFORM(MAC)
+
+#define UI_STRING(string, description) WebCore::localizedString(string)
+#define UI_STRING_KEY(string, key, description) WebCore::localizedString(key)
+
     String localizedString(const char* key);
-#endif
 
 } // namespace WebCore
 
diff --git a/Source/WebCore/platform/MIMETypeRegistry.cpp b/Source/WebCore/platform/MIMETypeRegistry.cpp
index e76906e..d0ad985 100644
--- a/Source/WebCore/platform/MIMETypeRegistry.cpp
+++ b/Source/WebCore/platform/MIMETypeRegistry.cpp
@@ -55,6 +55,7 @@ static HashSet<String>* supportedImageMIMETypesForEncoding;
 static HashSet<String>* supportedJavaScriptMIMETypes;
 static HashSet<String>* supportedNonImageMIMETypes;
 static HashSet<String>* supportedMediaMIMETypes;
+static HashSet<String>* unsupportedTextMIMETypes;
 
 typedef HashMap<String, Vector<String>*, CaseFoldingHash> MediaMIMETypeMap;
     
@@ -419,6 +420,27 @@ static void initializeSupportedMediaMIMETypes()
 #endif
 }
 
+static void initializeUnsupportedTextMIMETypes()
+{
+    static const char* types[] = {
+        "text/calendar",
+        "text/x-calendar",
+        "text/x-vcalendar",
+        "text/vcalendar",
+        "text/vcard",
+        "text/x-vcard",
+        "text/directory",
+        "text/ldif",
+        "text/qif",
+        "text/x-qif",
+        "text/x-csv",
+        "text/x-vcf",
+        "text/rtf",
+    };
+    for (size_t i = 0; i < WTF_ARRAY_LENGTH(types); ++i)
+      unsupportedTextMIMETypes->add(types[i]);
+}
+
 static void initializeMIMETypeRegistry()
 {
     supportedJavaScriptMIMETypes = new HashSet<String>;
@@ -430,6 +452,9 @@ static void initializeMIMETypeRegistry()
     supportedImageResourceMIMETypes = new HashSet<String>;
     supportedImageMIMETypes = new HashSet<String>;
     initializeSupportedImageMIMETypes();
+
+    unsupportedTextMIMETypes = new HashSet<String>;
+    initializeUnsupportedTextMIMETypes();
 }
 
 String MIMETypeRegistry::getMIMETypeForPath(const String& path)
@@ -500,6 +525,15 @@ bool MIMETypeRegistry::isSupportedMediaMIMEType(const String& mimeType)
     return supportedMediaMIMETypes->contains(mimeType);
 }
 
+bool MIMETypeRegistry::isUnsupportedTextMIMEType(const String& mimeType)
+{
+    if (mimeType.isEmpty())
+        return false;
+    if (!unsupportedTextMIMETypes)
+        initializeMIMETypeRegistry();
+    return unsupportedTextMIMETypes->contains(mimeType);
+}
+
 bool MIMETypeRegistry::isJavaAppletMIMEType(const String& mimeType)
 {
     // Since this set is very limited and is likely to remain so we won't bother with the overhead
@@ -546,6 +580,13 @@ HashSet<String>& MIMETypeRegistry::getSupportedMediaMIMETypes()
     return *supportedMediaMIMETypes;
 }
 
+HashSet<String>& MIMETypeRegistry::getUnsupportedTextMIMETypes()
+{
+    if (!unsupportedTextMIMETypes)
+        initializeMIMETypeRegistry();
+    return *unsupportedTextMIMETypes;
+}
+
 const String& defaultMIMEType()
 {
     DEFINE_STATIC_LOCAL(const String, defaultMIMEType, ("application/octet-stream"));
diff --git a/Source/WebCore/platform/MIMETypeRegistry.h b/Source/WebCore/platform/MIMETypeRegistry.h
index d069035..19d1b4b 100644
--- a/Source/WebCore/platform/MIMETypeRegistry.h
+++ b/Source/WebCore/platform/MIMETypeRegistry.h
@@ -68,6 +68,10 @@ public:
     // Check to see if a mime type is suitable for being loaded using <video> and <audio>
     static bool isSupportedMediaMIMEType(const String& mimeType); 
 
+    // Check to see if the mime type is not suitable for being loaded as a text
+    // document in a frame. Only valid for mime types begining with "text/".
+    static bool isUnsupportedTextMIMEType(const String& mimeType);
+
     // Check to see if a mime type is a valid Java applet mime type
     static bool isJavaAppletMIMEType(const String& mimeType);
 
@@ -80,6 +84,7 @@ public:
     static HashSet<String>& getSupportedImageMIMETypesForEncoding();
     static HashSet<String>& getSupportedNonImageMIMETypes();
     static HashSet<String>& getSupportedMediaMIMETypes();
+    static HashSet<String>& getUnsupportedTextMIMETypes();
 };
 
 const String& defaultMIMEType();
diff --git a/Source/WebCore/platform/PlatformGestureRecognizer.cpp b/Source/WebCore/platform/PlatformGestureRecognizer.cpp
new file mode 100644
index 0000000..38fc3fe
--- /dev/null
+++ b/Source/WebCore/platform/PlatformGestureRecognizer.cpp
@@ -0,0 +1,46 @@
+/*
+ * Copyright (c) 2011, Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "PlatformGestureRecognizer.h"
+
+namespace WebCore {
+
+PlatformGestureRecognizer::PlatformGestureRecognizer() { }
+PlatformGestureRecognizer::~PlatformGestureRecognizer() { }
+
+// To get a useful GestureRecognizer, a specific platform should return something
+// here that meets its needs. EventHandler will ignore null GestureRecognizers.
+PlatformGestureRecognizer* PlatformGestureRecognizer::create()
+{
+    return 0;
+}
+
+} // namespace WebCore
diff --git a/Source/WebCore/platform/PlatformGestureRecognizer.h b/Source/WebCore/platform/PlatformGestureRecognizer.h
new file mode 100644
index 0000000..f6e85a5
--- /dev/null
+++ b/Source/WebCore/platform/PlatformGestureRecognizer.h
@@ -0,0 +1,64 @@
+/*
+ * Copyright (c) 2011, Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef PlatformGestureRecognizer_h
+#define PlatformGestureRecognizer_h
+
+namespace WebCore {
+
+class EventHandler;
+class PlatformGestureRecognizer;
+class PlatformTouchEvent;
+
+// A GestureRecognizer detects gestures occurring in the touch event.
+// In response to a given touch event, the GestureRecognizer, updates
+// its internal state and optionally dispatches synthetic events to the
+// invoking EventHandler instance.
+class PlatformGestureRecognizer {
+protected:
+    PlatformGestureRecognizer();
+
+public:
+    virtual ~PlatformGestureRecognizer();
+
+    // Invoked for each touch event that could contribute to the current gesture.
+    // Takes a PlatformTouchEvent and the EventHandler that originated it and which will also
+    // be the target of any generated synthetic event. Finally, |handled|
+    // specifies if the |event| was actually handled by |source| (by the JavaScript)
+    // Returns true if the event resulted in firing a synthetic event.
+    virtual bool processTouchEventForGesture(const PlatformTouchEvent&, EventHandler*, bool handled) = 0;
+
+    // Factory method for GestureManagers.
+    static PlatformGestureRecognizer* create();
+};
+
+} // namespace WebCore
+
+#endif // PlatformGestureRecognizer_h
diff --git a/Source/WebCore/platform/PlatformKeyboardEvent.h b/Source/WebCore/platform/PlatformKeyboardEvent.h
index fcca8bd..a3127c7 100644
--- a/Source/WebCore/platform/PlatformKeyboardEvent.h
+++ b/Source/WebCore/platform/PlatformKeyboardEvent.h
@@ -96,7 +96,7 @@ namespace WebCore {
             AltKey = 1 << 0,
             CtrlKey = 1 << 1,
             MetaKey = 1 << 2,
-            ShiftKey = 1 << 3,
+            ShiftKey = 1 << 3
         };
 
         PlatformKeyboardEvent()
diff --git a/Source/WebCore/platform/PlatformStrategies.cpp b/Source/WebCore/platform/PlatformStrategies.cpp
index e0baa70..9623108 100644
--- a/Source/WebCore/platform/PlatformStrategies.cpp
+++ b/Source/WebCore/platform/PlatformStrategies.cpp
@@ -29,6 +29,8 @@
 
 #include "PlatformStrategies.h"
 
+#include "DefaultLocalizationStrategy.h"
+
 namespace WebCore {
 
 static PlatformStrategies* s_platformStrategies;
@@ -51,7 +53,12 @@ void setPlatformStrategies(PlatformStrategies* platformStrategies)
     // throw an exception here in release builds.
     ASSERT(platformStrategies != s_platformStrategies);
 }
-    
+
+LocalizationStrategy* PlatformStrategies::createLocalizationStrategy()
+{
+    return new DefaultLocalizationStrategy;
+}
+
 } // namespace WebCore
 
 #endif // USE(PLATFORM_STRATEGIES)
diff --git a/Source/WebCore/platform/PlatformStrategies.h b/Source/WebCore/platform/PlatformStrategies.h
index bda7c90..6768658 100644
--- a/Source/WebCore/platform/PlatformStrategies.h
+++ b/Source/WebCore/platform/PlatformStrategies.h
@@ -81,7 +81,7 @@ protected:
 private:
     virtual CookiesStrategy* createCookiesStrategy() = 0;
     virtual PluginStrategy* createPluginStrategy() = 0;
-    virtual LocalizationStrategy* createLocalizationStrategy() = 0;
+    virtual LocalizationStrategy* createLocalizationStrategy();
     virtual VisitedLinkStrategy* createVisitedLinkStrategy() = 0;
 
     CookiesStrategy* m_cookiesStrategy;
diff --git a/Source/WebCore/platform/ScrollAnimator.h b/Source/WebCore/platform/ScrollAnimator.h
index 060511c..6698b63 100644
--- a/Source/WebCore/platform/ScrollAnimator.h
+++ b/Source/WebCore/platform/ScrollAnimator.h
@@ -68,6 +68,8 @@ public:
 
     FloatPoint currentPosition() const;
 
+    virtual void cancelAnimations() { }
+
     virtual void contentAreaWillPaint() const { }
     virtual void mouseEnteredContentArea() const { }
     virtual void mouseExitedContentArea() const { }
diff --git a/Source/WebCore/platform/ScrollTypes.h b/Source/WebCore/platform/ScrollTypes.h
index f07fb1a..1f8e095 100644
--- a/Source/WebCore/platform/ScrollTypes.h
+++ b/Source/WebCore/platform/ScrollTypes.h
@@ -119,7 +119,7 @@ namespace WebCore {
     enum ScrollbarControlStateMask {
         ActiveScrollbarState = 1,
         EnabledScrollbarState = 1 << 1,
-        PressedScrollbarState = 1 << 2,
+        PressedScrollbarState = 1 << 2
     };
 
     enum ScrollbarPart {
@@ -133,7 +133,7 @@ namespace WebCore {
         ForwardButtonEndPart = 1 << 6,
         ScrollbarBGPart = 1 << 7,
         TrackBGPart = 1 << 8,
-        AllParts = 0xffffffff,
+        AllParts = 0xffffffff
     };
 
     enum ScrollbarButtonsPlacement {
diff --git a/Source/WebCore/platform/ScrollView.cpp b/Source/WebCore/platform/ScrollView.cpp
index baf2e32..58615fb 100644
--- a/Source/WebCore/platform/ScrollView.cpp
+++ b/Source/WebCore/platform/ScrollView.cpp
@@ -124,7 +124,7 @@ void ScrollView::setHasVerticalScrollbar(bool hasBar)
         axObjectCache()->handleScrollbarUpdate(this);
 }
 
-#if !PLATFORM(GTK)
+#if !USE(NATIVE_GTK_MAIN_FRAME_SCROLLBAR)
 PassRefPtr<Scrollbar> ScrollView::createScrollbar(ScrollbarOrientation orientation)
 {
     return Scrollbar::createNativeScrollbar(this, orientation, RegularScrollbar);
@@ -224,7 +224,7 @@ void ScrollView::setDelegatesScrolling(bool delegatesScrolling)
     m_delegatesScrolling = delegatesScrolling;
 }
 
-#if !PLATFORM(GTK)
+#if !USE(NATIVE_GTK_MAIN_FRAME_SCROLLBAR)
 IntRect ScrollView::visibleContentRect(bool includeScrollbars) const
 {
     if (platformWidget())
@@ -357,6 +357,10 @@ void ScrollView::didCompleteRubberBand(const IntSize&) const
 {
 }
 
+void ScrollView::notifyPageThatContentAreaWillPaint() const
+{
+}
+
 void ScrollView::setScrollOffset(const IntPoint& offset)
 {
     int horizontalOffset = offset.x();
@@ -408,7 +412,7 @@ void ScrollView::setScrollPosition(const IntPoint& scrollPoint)
 
 #if ENABLE(TILED_BACKING_STORE)
     if (delegatesScrolling()) {
-        hostWindow()->delegatedScrollRequested(IntSize(scrollPoint.x(), scrollPoint.y()));
+        hostWindow()->delegatedScrollRequested(scrollPoint);
         if (!m_actualVisibleContentRect.isEmpty())
             m_actualVisibleContentRect.setLocation(scrollPoint);
         return;
@@ -439,15 +443,18 @@ bool ScrollView::logicalScroll(ScrollLogicalDirection direction, ScrollGranulari
 IntSize ScrollView::overhangAmount() const
 {
     IntSize stretch;
-    if (scrollY() < 0)
-        stretch.setHeight(scrollY());
-    else if (scrollY() > contentsHeight() - visibleContentRect().height())
-        stretch.setHeight(scrollY() - (contentsHeight() - visibleContentRect().height()));
 
-    if (scrollX() < 0)
-        stretch.setWidth(scrollX());
-    else if (scrollX() > contentsWidth() - visibleContentRect().width())
-        stretch.setWidth(scrollX() - (contentsWidth() - visibleContentRect().width()));
+    int physicalScrollY = scrollPosition().y() + m_scrollOrigin.y();
+    if (physicalScrollY < 0)
+        stretch.setHeight(physicalScrollY);
+    else if (physicalScrollY > contentsHeight() - visibleContentRect().height())
+        stretch.setHeight(physicalScrollY - (contentsHeight() - visibleContentRect().height()));
+
+    int physicalScrollX = scrollPosition().x() + m_scrollOrigin.x();
+    if (physicalScrollX < 0)
+        stretch.setWidth(physicalScrollX);
+    else if (physicalScrollX > contentsWidth() - visibleContentRect().width())
+        stretch.setWidth(physicalScrollX - (contentsWidth() - visibleContentRect().width()));
 
     return stretch;
 }
@@ -947,7 +954,7 @@ void ScrollView::paint(GraphicsContext* context, const IntRect& rect)
     if (context->paintingDisabled() && !context->updatingControlTints())
         return;
 
-    scrollAnimator()->contentAreaWillPaint();
+    notifyPageThatContentAreaWillPaint();
     
     IntRect documentDirtyRect = rect;
     documentDirtyRect.intersect(frameRect());
@@ -1000,26 +1007,28 @@ void ScrollView::calculateOverhangAreasForPainting(IntRect& horizontalOverhangRe
     int horizontalScrollbarHeight = (horizontalScrollbar() && !horizontalScrollbar()->isOverlayScrollbar())
         ? horizontalScrollbar()->height() : 0;
 
-    if (scrollY() < 0) {
+    int physicalScrollY = scrollPosition().y() + m_scrollOrigin.y();
+    if (physicalScrollY < 0) {
         horizontalOverhangRect = frameRect();
-        horizontalOverhangRect.setHeight(-scrollY());
-    } else if (scrollY() > contentsHeight() - visibleContentRect().height()) {
-        int height = scrollY() - (contentsHeight() - visibleContentRect().height());
+        horizontalOverhangRect.setHeight(-physicalScrollY);
+    } else if (physicalScrollY > contentsHeight() - visibleContentRect().height()) {
+        int height = physicalScrollY - (contentsHeight() - visibleContentRect().height());
         horizontalOverhangRect = frameRect();
         horizontalOverhangRect.setY(frameRect().maxY() - height - horizontalScrollbarHeight);
         horizontalOverhangRect.setHeight(height);
     }
 
-    if (scrollX() < 0) {
-        verticalOverhangRect.setWidth(-scrollX());
+    int physicalScrollX = scrollPosition().x() + m_scrollOrigin.x();
+    if (physicalScrollX < 0) {
+        verticalOverhangRect.setWidth(-physicalScrollX);
         verticalOverhangRect.setHeight(frameRect().height() - horizontalOverhangRect.height());
         verticalOverhangRect.setX(frameRect().x());
         if (horizontalOverhangRect.y() == frameRect().y())
             verticalOverhangRect.setY(frameRect().y() + horizontalOverhangRect.height());
         else
             verticalOverhangRect.setY(frameRect().y());
-    } else if (scrollX() > contentsWidth() - visibleContentRect().width()) {
-        int width = scrollX() - (contentsWidth() - visibleContentRect().width());
+    } else if (physicalScrollX > contentsWidth() - visibleContentRect().width()) {
+        int width = physicalScrollX - (contentsWidth() - visibleContentRect().width());
         verticalOverhangRect.setWidth(width);
         verticalOverhangRect.setHeight(frameRect().height() - horizontalOverhangRect.height());
         verticalOverhangRect.setX(frameRect().maxX() - width - verticalScrollbarWidth);
@@ -1195,7 +1204,7 @@ void ScrollView::setScrollOrigin(const IntPoint& origin, bool updatePositionAtAl
         updateScrollbars(scrollOffset());
 }
 
-#if !PLATFORM(WX) && !PLATFORM(GTK) && !PLATFORM(EFL)
+#if !PLATFORM(WX) && !USE(NATIVE_GTK_MAIN_FRAME_SCROLLBAR) && !PLATFORM(EFL)
 
 void ScrollView::platformInit()
 {
diff --git a/Source/WebCore/platform/ScrollView.h b/Source/WebCore/platform/ScrollView.h
index 1d6fba5..bff77d5 100644
--- a/Source/WebCore/platform/ScrollView.h
+++ b/Source/WebCore/platform/ScrollView.h
@@ -62,6 +62,7 @@ public:
     virtual int scrollPosition(Scrollbar*) const;
     virtual void setScrollOffset(const IntPoint&);
     virtual void didCompleteRubberBand(const IntSize&) const;
+    virtual void notifyPageThatContentAreaWillPaint() const;
 
     // NOTE: This should only be called by the overriden setScrollOffset from ScrollableArea.
     virtual void scrollTo(const IntSize& newOffset);
@@ -354,19 +355,6 @@ private:
     bool m_clipsRepaints;
     bool m_delegatesScrolling;
 
-    // There are 8 possible combinations of writing mode and direction.  Scroll origin will be non-zero in the x or y axis
-    // if there is any reversed direction or writing-mode.  The combinations are:
-    // writing-mode / direction     scrollOrigin.x() set    scrollOrigin.y() set
-    // horizontal-tb / ltr          NO                      NO
-    // horizontal-tb / rtl          YES                     NO
-    // horizontal-bt / ltr          NO                      YES
-    // horizontal-bt / rtl          YES                     YES
-    // vertical-lr / ltr            NO                      NO
-    // vertical-lr / rtl            NO                      YES
-    // vertical-rl / ltr            YES                     NO
-    // vertical-rl / rtl            YES                     YES
-    IntPoint m_scrollOrigin;
-
     IntSize m_boundsSize;
 
     void init();
diff --git a/Source/WebCore/platform/ScrollableArea.h b/Source/WebCore/platform/ScrollableArea.h
index f1c1308..d08de00 100644
--- a/Source/WebCore/platform/ScrollableArea.h
+++ b/Source/WebCore/platform/ScrollableArea.h
@@ -69,6 +69,7 @@ public:
     bool hasOverlayScrollbars() const;
 
     ScrollAnimator* scrollAnimator() const { return m_scrollAnimator.get(); }
+    const IntPoint& scrollOrigin() const { return m_scrollOrigin; }
 
     virtual int scrollSize(ScrollbarOrientation) const = 0;
     virtual int scrollPosition(Scrollbar*) const = 0;
@@ -114,6 +115,10 @@ public:
     virtual IntSize overhangAmount() const { ASSERT_NOT_REACHED(); return IntSize(); }
     virtual IntPoint currentMousePosition() const { return IntPoint(); }
     virtual void didCompleteRubberBand(const IntSize&) const { ASSERT_NOT_REACHED(); }
+    virtual bool shouldSuspendScrollAnimations() const { return true; }
+    virtual void scrollbarStyleChanged() { }
+
+    virtual void disconnectFromPage() { }
 
 private:
     // NOTE: Only called from the ScrollAnimator.
@@ -124,6 +129,20 @@ private:
     bool m_constrainsScrollingToContentEdge;
 
     bool m_inLiveResize;
+
+protected:
+    // There are 8 possible combinations of writing mode and direction. Scroll origin will be non-zero in the x or y axis
+    // if there is any reversed direction or writing-mode. The combinations are:
+    // writing-mode / direction     scrollOrigin.x() set    scrollOrigin.y() set
+    // horizontal-tb / ltr          NO                      NO
+    // horizontal-tb / rtl          YES                     NO
+    // horizontal-bt / ltr          NO                      YES
+    // horizontal-bt / rtl          YES                     YES
+    // vertical-lr / ltr            NO                      NO
+    // vertical-lr / rtl            NO                      YES
+    // vertical-rl / ltr            YES                     NO
+    // vertical-rl / rtl            YES                     YES
+    IntPoint m_scrollOrigin;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/SharedBuffer.cpp b/Source/WebCore/platform/SharedBuffer.cpp
index 34553ec..0900ae4 100644
--- a/Source/WebCore/platform/SharedBuffer.cpp
+++ b/Source/WebCore/platform/SharedBuffer.cpp
@@ -167,6 +167,9 @@ void SharedBuffer::clear()
 
     m_buffer.clear();
     m_purgeableBuffer.clear();
+#if HAVE(CFNETWORK_DATA_ARRAY_CALLBACK)
+    m_dataArray.clear();
+#endif
 }
 
 PassRefPtr<SharedBuffer> SharedBuffer::copy() const
@@ -206,6 +209,9 @@ const Vector<char>& SharedBuffer::buffer() const
             freeSegment(m_segments[i]);
         }
         m_segments.clear();
+#if HAVE(CFNETWORK_DATA_ARRAY_CALLBACK)
+        copyDataArrayAndClear(destination, bytesLeft);
+#endif
     }
     return m_buffer;
 }
diff --git a/Source/WebCore/platform/SharedBuffer.h b/Source/WebCore/platform/SharedBuffer.h
index dfde5a1..f7318e3 100644
--- a/Source/WebCore/platform/SharedBuffer.h
+++ b/Source/WebCore/platform/SharedBuffer.h
@@ -97,6 +97,10 @@ public:
     const char* platformData() const;
     unsigned platformDataSize() const;
 
+#if HAVE(CFNETWORK_DATA_ARRAY_CALLBACK)
+    void append(CFDataRef);
+#endif
+
     PassRefPtr<SharedBuffer> copy() const;
     
     bool hasPurgeableBuffer() const { return m_purgeableBuffer.get(); }
@@ -138,6 +142,10 @@ private:
     mutable Vector<char> m_buffer;
     mutable Vector<char*> m_segments;
     OwnPtr<PurgeableBuffer> m_purgeableBuffer;
+#if HAVE(CFNETWORK_DATA_ARRAY_CALLBACK)
+    mutable Vector<RetainPtr<CFDataRef> > m_dataArray;
+    void copyDataArrayAndClear(char *destination, unsigned bytesToCopy) const;
+#endif
 #if USE(CF)
     SharedBuffer(CFDataRef);
     RetainPtr<CFDataRef> m_cfData;
diff --git a/Source/WebCore/platform/UUID.cpp b/Source/WebCore/platform/UUID.cpp
index 7f59081..fce0645 100644
--- a/Source/WebCore/platform/UUID.cpp
+++ b/Source/WebCore/platform/UUID.cpp
@@ -44,6 +44,7 @@
 #elif OS(LINUX) && !PLATFORM(CHROMIUM)
 #include <stdio.h>
 #elif (OS(LINUX) && PLATFORM(CHROMIUM)) || (OS(DARWIN) && !USE(CF))
+#include <wtf/HexNumber.h>
 #include <wtf/RandomNumber.h>
 #include <wtf/text/StringBuilder.h>
 #endif
@@ -100,17 +101,18 @@ String createCanonicalUUIDString()
 
     // Format as Version 4 UUID.
     StringBuilder builder;
-    builder.append(String::format("%08x", randomData[0]));
+    appendUnsignedAsHexFixedSize(randomData[0], builder, 8, Lowercase);
     builder.append("-");
-    builder.append(String::format("%04x", randomData[1] >> 16));
+    appendUnsignedAsHexFixedSize(randomData[1] >> 16, builder, 4, Lowercase);
     builder.append("-4");
-    builder.append(String::format("%03x", randomData[1] & 0x00000fff));
+    appendUnsignedAsHexFixedSize(randomData[1] & 0x00000fff, builder, 3, Lowercase);
     builder.append("-");
-    builder.append(String::format("%x", (randomData[2] >> 30) | 0x8)); // Condense this byte to 8, 9, a, and b.
-    builder.append(String::format("%03x", (randomData[2] >> 16) & 0x00000fff));
+    appendUnsignedAsHexFixedSize((randomData[2] >> 30) | 0x8, builder, 1, Lowercase);
+    appendUnsignedAsHexFixedSize((randomData[2] >> 16) & 0x00000fff, builder, 3, Lowercase);
     builder.append("-");
-    builder.append(String::format("%04x", randomData[2] & 0x0000ffff));
-    builder.append(String::format("%08x", randomData[3]));
+    appendUnsignedAsHexFixedSize(randomData[2] & 0x0000ffff, builder, 4, Lowercase);
+    appendUnsignedAsHexFixedSize(randomData[3], builder, 8, Lowercase);
+    builder.append("\n");
     return builder.toString();
 #else
     notImplemented();
diff --git a/Source/WebCore/platform/android/FileSystemAndroid.cpp b/Source/WebCore/platform/android/FileSystemAndroid.cpp
index 9ed43f0..30dc1d3 100644
--- a/Source/WebCore/platform/android/FileSystemAndroid.cpp
+++ b/Source/WebCore/platform/android/FileSystemAndroid.cpp
@@ -55,26 +55,25 @@ CString fileSystemRepresentation(const String& path)
     return path.utf8();
 }
 
-CString openTemporaryFile(const char* prefix, PlatformFileHandle& handle)
+String openTemporaryFile(const String& prefix, PlatformFileHandle& handle)
 {
     int number = rand() % 10000 + 1;
-    CString filename;
+    String filename;
     do {
         StringBuilder builder;
         builder.append(sPluginPath);
         builder.append('/');
         builder.append(prefix);
         builder.append(String::number(number));
-        filename = builder.toString().utf8();
-        const char* fstr = filename.data();
-        handle = open(filename.data(), O_WRONLY | O_CREAT | O_EXCL, S_IRUSR | S_IWUSR);
+        filename = builder.toString();
+        handle = open(filename.utf8().data(), O_WRONLY | O_CREAT | O_EXCL, S_IRUSR | S_IWUSR);
         number++;
         
         if (handle != -1)
             return filename;
     } while (errno == EEXIST);
     
-    return CString();
+    return String();
 }
 
 bool unloadModule(PlatformModule module)
diff --git a/Source/WebCore/platform/android/LocalizedStringsAndroid.cpp b/Source/WebCore/platform/android/LocalizedStringsAndroid.cpp
index 5a96cf6..e5a733a 100644
--- a/Source/WebCore/platform/android/LocalizedStringsAndroid.cpp
+++ b/Source/WebCore/platform/android/LocalizedStringsAndroid.cpp
@@ -230,7 +230,7 @@ String contextMenuItemTagSearchWeb()
     return String();
 }
 
-String contextMenuItemTagLookUpInDictionary()
+String contextMenuItemTagLookUpInDictionary(const String&)
 {
     notImplemented();
     return String();
diff --git a/Source/WebCore/platform/audio/AudioBus.cpp b/Source/WebCore/platform/audio/AudioBus.cpp
index dd4746d..6f74471 100644
--- a/Source/WebCore/platform/audio/AudioBus.cpp
+++ b/Source/WebCore/platform/audio/AudioBus.cpp
@@ -32,6 +32,9 @@
 
 #include "AudioBus.h"
 
+#if !PLATFORM(MAC)
+#include "SincResampler.h"
+#endif
 #include "VectorMath.h"
 #include <algorithm>
 #include <assert.h>
@@ -360,6 +363,90 @@ void AudioBus::sumWithGainFrom(const AudioBus &sourceBus, double* lastMixGain, d
     processWithGainFrom(sourceBus, lastMixGain, targetGain, true);
 }
 
+#if !PLATFORM(MAC)
+PassOwnPtr<AudioBus> AudioBus::createBySampleRateConverting(AudioBus* sourceBus, bool mixToMono, double newSampleRate)
+{
+    // sourceBus's sample-rate must be known.
+    ASSERT(sourceBus && sourceBus->sampleRate());
+    if (!sourceBus || !sourceBus->sampleRate())
+        return 0;
+
+    double sourceSampleRate = sourceBus->sampleRate();
+    double destinationSampleRate = newSampleRate;
+    unsigned numberOfSourceChannels = sourceBus->numberOfChannels();
+
+    if (numberOfSourceChannels == 1)
+        mixToMono = false; // already mono
+        
+    if (sourceSampleRate == destinationSampleRate) {
+        // No sample-rate conversion is necessary.
+        if (mixToMono)
+            return AudioBus::createByMixingToMono(sourceBus);
+
+        // Return exact copy.
+        return AudioBus::createBufferFromRange(sourceBus, 0, sourceBus->length());
+    }
+    
+    // First, mix to mono (if necessary) then sample-rate convert.
+    AudioBus* resamplerSourceBus;
+    OwnPtr<AudioBus> mixedMonoBus;
+    if (mixToMono) {
+        mixedMonoBus = AudioBus::createByMixingToMono(sourceBus);
+        resamplerSourceBus = mixedMonoBus.get();
+    } else {
+        // Directly resample without down-mixing.
+        resamplerSourceBus = sourceBus;
+    }
+
+    // Calculate destination length based on the sample-rates.
+    double sampleRateRatio = sourceSampleRate / destinationSampleRate;
+    int sourceLength = resamplerSourceBus->length();
+    int destinationLength = sourceLength / sampleRateRatio;
+
+    // Create destination bus with same number of channels.
+    unsigned numberOfDestinationChannels = resamplerSourceBus->numberOfChannels();
+    OwnPtr<AudioBus> destinationBus(adoptPtr(new AudioBus(numberOfDestinationChannels, destinationLength)));
+
+    // Sample-rate convert each channel.
+    for (unsigned i = 0; i < numberOfDestinationChannels; ++i) {
+        float* source = resamplerSourceBus->channel(i)->data();
+        float* destination = destinationBus->channel(i)->data();
+
+        SincResampler resampler(sampleRateRatio);
+        resampler.process(source, destination, sourceLength);
+    }
+
+    return destinationBus.release();
+}
+#endif // !PLATFORM(MAC)
+
+PassOwnPtr<AudioBus> AudioBus::createByMixingToMono(AudioBus* sourceBus)
+{
+    switch (sourceBus->numberOfChannels()) {
+    case 1:
+        // Simply create an exact copy.
+        return AudioBus::createBufferFromRange(sourceBus, 0, sourceBus->length());
+    case 2:
+        {
+            unsigned n = sourceBus->length();
+            OwnPtr<AudioBus> destinationBus(adoptPtr(new AudioBus(1, n)));
+
+            float* sourceL = sourceBus->channel(0)->data();
+            float* sourceR = sourceBus->channel(1)->data();
+            float* destination = destinationBus->channel(0)->data();
+        
+            // Do the mono mixdown.
+            for (unsigned i = 0; i < n; ++i)
+                destination[i] = 0.5 * (sourceL[i] + sourceR[i]);
+
+            return destinationBus.release();
+        }
+    }
+
+    ASSERT_NOT_REACHED();
+    return 0;
+}
+
 } // WebCore
 
 #endif // ENABLE(WEB_AUDIO)
diff --git a/Source/WebCore/platform/audio/AudioBus.h b/Source/WebCore/platform/audio/AudioBus.h
index 888f6bf..1943c0d 100644
--- a/Source/WebCore/platform/audio/AudioBus.h
+++ b/Source/WebCore/platform/audio/AudioBus.h
@@ -89,6 +89,18 @@ public:
     // 0 may be returned if the range does not fit in the sourceBuffer
     static PassOwnPtr<AudioBus> createBufferFromRange(AudioBus* sourceBuffer, unsigned startFrame, unsigned endFrame);
 
+
+#if !PLATFORM(MAC)
+    // Creates a new AudioBus by sample-rate converting sourceBus to the newSampleRate.
+    // setSampleRate() must have been previously called on sourceBus.
+    // Note: sample-rate conversion is already handled in the file-reading code for the mac port, so we don't need this.
+    static PassOwnPtr<AudioBus> createBySampleRateConverting(AudioBus* sourceBus, bool mixToMono, double newSampleRate);
+#endif
+
+    // Creates a new AudioBus by mixing all the channels down to mono.
+    // If sourceBus is already mono, then the returned AudioBus will simply be a copy.
+    static PassOwnPtr<AudioBus> createByMixingToMono(AudioBus* sourceBus);
+
     // Scales all samples by the same amount.
     void scale(double scale);
 
diff --git a/Source/WebCore/platform/audio/HRTFKernel.cpp b/Source/WebCore/platform/audio/HRTFKernel.cpp
index 22d4b12..9db35ba 100644
--- a/Source/WebCore/platform/audio/HRTFKernel.cpp
+++ b/Source/WebCore/platform/audio/HRTFKernel.cpp
@@ -45,17 +45,18 @@ namespace WebCore {
 // This represents the initial delay before the most energetic part of the impulse response.
 // The sample-frame delay is removed from the impulseP impulse response, and this value  is returned.
 // the length of the passed in AudioChannel must be a power of 2.
-static double extractAverageGroupDelay(AudioChannel* channel)
+static double extractAverageGroupDelay(AudioChannel* channel, size_t analysisFFTSize)
 {
     ASSERT(channel);
         
     float* impulseP = channel->data();
-    size_t length = channel->length();
     
-    // Check that length is power-of-2;
-    ASSERT(1UL << static_cast<unsigned>(log2(length)) == length);
+    ASSERT(channel->length() >= analysisFFTSize);
+    
+    // Check for power-of-2.
+    ASSERT(1UL << static_cast<unsigned>(log2(analysisFFTSize)) == analysisFFTSize);
 
-    FFTFrame estimationFrame(length);
+    FFTFrame estimationFrame(analysisFFTSize);
     estimationFrame.doFFT(impulseP);
 
     double frameDelay = estimationFrame.extractAverageGroupDelay();
@@ -71,7 +72,7 @@ HRTFKernel::HRTFKernel(AudioChannel* channel, size_t fftSize, double sampleRate,
     ASSERT(channel);
 
     // Determine the leading delay (average group delay) for the response.
-    m_frameDelay = extractAverageGroupDelay(channel);
+    m_frameDelay = extractAverageGroupDelay(channel, fftSize / 2);
 
     float* impulseResponse = channel->data();
     size_t responseLength = channel->length();
diff --git a/Source/WebCore/platform/audio/SincResampler.cpp b/Source/WebCore/platform/audio/SincResampler.cpp
new file mode 100644
index 0000000..e6f34b4
--- /dev/null
+++ b/Source/WebCore/platform/audio/SincResampler.cpp
@@ -0,0 +1,342 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(WEB_AUDIO)
+
+#include "SincResampler.h"
+
+#include <wtf/MathExtras.h>
+
+using namespace std;
+
+// Input buffer layout, dividing the total buffer into regions (r0 - r5):
+//
+// |----------------|----------------------------------------------------------------|----------------|
+//
+//                                              blockSize + kernelSize / 2                           
+//                   <-------------------------------------------------------------------------------->
+//                                                  r0
+//
+//   kernelSize / 2   kernelSize / 2                                 kernelSize / 2     kernelSize / 2 
+// <---------------> <--------------->                              <---------------> <--------------->
+//         r1                r2                                             r3                r4
+// 
+//                                              blockSize                           
+//                                     <-------------------------------------------------------------->
+//                                                  r5
+
+// The Algorithm:
+//
+// 1) Consume input frames into r0 (r1 is zero-initialized).
+// 2) Position kernel centered at start of r0 (r2) and generate output frames until kernel is centered at start of r4.
+//    or we've finished generating all the output frames.
+// 3) Copy r3 to r1 and r4 to r2.
+// 4) Consume input frames into r5 (zero-pad if we run out of input).
+// 5) Goto (2) until all of input is consumed.
+//
+// note: we're glossing over how the sub-sample handling works with m_virtualSourceIndex, etc.
+
+namespace WebCore {
+
+SincResampler::SincResampler(double scaleFactor, unsigned kernelSize, unsigned numberOfKernelOffsets)
+    : m_scaleFactor(scaleFactor)
+    , m_kernelSize(kernelSize)
+    , m_numberOfKernelOffsets(numberOfKernelOffsets)
+    , m_kernelStorage(m_kernelSize * (m_numberOfKernelOffsets + 1))
+    , m_virtualSourceIndex(0.0)
+    , m_blockSize(512)
+    , m_inputBuffer(m_blockSize + m_kernelSize) // See input buffer layout above.
+    , m_source(0)
+    , m_sourceFramesAvailable(0)
+{
+    initializeKernel();
+}
+
+void SincResampler::initializeKernel()
+{
+    // Blackman window parameters.
+    double alpha = 0.16;
+    double a0 = 0.5 * (1.0 - alpha);
+    double a1 = 0.5;
+    double a2 = 0.5 * alpha;
+
+    // sincScaleFactor is basically the normalized cutoff frequency of the low-pass filter.
+    double sincScaleFactor = m_scaleFactor > 1.0 ? 1.0 / m_scaleFactor : 1.0;
+
+    // The sinc function is an idealized brick-wall filter, but since we're windowing it the
+    // transition from pass to stop does not happen right away. So we should adjust the
+    // lowpass filter cutoff slightly downward to avoid some aliasing at the very high-end.
+    // FIXME: this value is empirical and to be more exact should vary depending on m_kernelSize.
+    sincScaleFactor *= 0.9;
+
+    int n = m_kernelSize;
+    int halfSize = n / 2;
+
+    // Generates a set of windowed sinc() kernels.
+    // We generate a range of sub-sample offsets from 0.0 to 1.0.
+    for (unsigned offsetIndex = 0; offsetIndex <= m_numberOfKernelOffsets; ++offsetIndex) {
+        double subsampleOffset = static_cast<double>(offsetIndex) / m_numberOfKernelOffsets;
+
+        for (int i = 0; i < n; ++i) {
+            // Compute the sinc() with offset.
+            double s = sincScaleFactor * piDouble * (i - halfSize - subsampleOffset);
+            double sinc = !s ? 1.0 : sin(s) / s;
+            sinc *= sincScaleFactor;
+
+            // Compute Blackman window, matching the offset of the sinc().
+            double x = (i - subsampleOffset) / n;
+            double window = a0 - a1 * cos(2.0 * piDouble * x) + a2 * cos(4.0 * piDouble * x);
+
+            // Window the sinc() function and store at the correct offset.
+            m_kernelStorage[i + offsetIndex * m_kernelSize] = sinc * window;
+        }
+    }
+}
+
+void SincResampler::consumeSource(float* buffer, unsigned numberOfSourceFrames)
+{
+    ASSERT(m_source);
+    if (!m_source)
+        return;
+    
+    // Clamp to number of frames available and zero-pad.
+    unsigned framesToCopy = min(m_sourceFramesAvailable, numberOfSourceFrames);
+    memcpy(buffer, m_source, sizeof(float) * framesToCopy);
+    
+    // Zero-pad if necessary.
+    if (framesToCopy < numberOfSourceFrames)
+        memset(buffer + framesToCopy, 0, sizeof(float) * (numberOfSourceFrames - framesToCopy));
+    
+    m_sourceFramesAvailable -= framesToCopy;
+    m_source += numberOfSourceFrames;
+}
+
+void SincResampler::process(float* source, float* destination, unsigned numberOfSourceFrames)
+{
+    ASSERT(m_blockSize > m_kernelSize);
+    ASSERT(m_inputBuffer.size() >= m_blockSize + m_kernelSize);
+    ASSERT(!(m_kernelSize % 2));
+    
+    // Setup various region pointers in the buffer (see diagram above).
+    float* r0 = m_inputBuffer.data() + m_kernelSize / 2;
+    float* r1 = m_inputBuffer.data();
+    float* r2 = r0;
+    float* r3 = r0 + m_blockSize - m_kernelSize / 2;
+    float* r4 = r0 + m_blockSize;
+    float* r5 = r0 + m_kernelSize / 2;
+
+    m_source = source;
+    m_sourceFramesAvailable = numberOfSourceFrames;
+
+    unsigned numberOfDestinationFrames = static_cast<unsigned>(numberOfSourceFrames / m_scaleFactor);
+
+    // Step (1)
+    // Prime the input buffer.
+    consumeSource(r0, m_blockSize + m_kernelSize / 2);
+    
+    // Step (2)
+    m_virtualSourceIndex = 0;
+
+    while (numberOfDestinationFrames) {
+        while (m_virtualSourceIndex < m_blockSize) {
+            // m_virtualSourceIndex lies in between two kernel offsets so figure out what they are.
+            int sourceIndexI = static_cast<int>(m_virtualSourceIndex);
+            double subsampleRemainder = m_virtualSourceIndex - sourceIndexI;
+
+            double virtualOffsetIndex = subsampleRemainder * m_numberOfKernelOffsets;
+            int offsetIndex = static_cast<int>(virtualOffsetIndex);
+            
+            float* k1 = m_kernelStorage.data() + offsetIndex * m_kernelSize;
+            float* k2 = k1 + m_kernelSize;
+
+            // Initialize input pointer based on quantized m_virtualSourceIndex.
+            float* inputP = r1 + sourceIndexI;
+
+            // We'll compute "convolutions" for the two kernels which straddle m_virtualSourceIndex
+            float sum1 = 0;
+            float sum2 = 0;
+
+            // Figure out how much to weight each kernel's "convolution".
+            double kernelInterpolationFactor = virtualOffsetIndex - offsetIndex;
+
+            // Generate a single output sample. 
+            int n = m_kernelSize;
+
+            // FIXME: add SIMD optimizations for the following. The scalar code-path can probably also be optimized better.
+
+#define CONVOLVE_ONE_SAMPLE      \
+            input = *inputP++;   \
+            sum1 += input * *k1; \
+            sum2 += input * *k2; \
+            ++k1;                \
+            ++k2;
+
+            {
+                float input;
+                
+                // Optimize size 32 and size 64 kernels by unrolling the while loop.
+                // A 20 - 30% speed improvement was measured in some cases by using this approach.
+                
+                if (n == 32) {
+                    CONVOLVE_ONE_SAMPLE // 1
+                    CONVOLVE_ONE_SAMPLE // 2
+                    CONVOLVE_ONE_SAMPLE // 3
+                    CONVOLVE_ONE_SAMPLE // 4
+                    CONVOLVE_ONE_SAMPLE // 5
+                    CONVOLVE_ONE_SAMPLE // 6
+                    CONVOLVE_ONE_SAMPLE // 7
+                    CONVOLVE_ONE_SAMPLE // 8
+                    CONVOLVE_ONE_SAMPLE // 9
+                    CONVOLVE_ONE_SAMPLE // 10
+                    CONVOLVE_ONE_SAMPLE // 11
+                    CONVOLVE_ONE_SAMPLE // 12
+                    CONVOLVE_ONE_SAMPLE // 13
+                    CONVOLVE_ONE_SAMPLE // 14
+                    CONVOLVE_ONE_SAMPLE // 15
+                    CONVOLVE_ONE_SAMPLE // 16
+                    CONVOLVE_ONE_SAMPLE // 17
+                    CONVOLVE_ONE_SAMPLE // 18
+                    CONVOLVE_ONE_SAMPLE // 19
+                    CONVOLVE_ONE_SAMPLE // 20
+                    CONVOLVE_ONE_SAMPLE // 21
+                    CONVOLVE_ONE_SAMPLE // 22
+                    CONVOLVE_ONE_SAMPLE // 23
+                    CONVOLVE_ONE_SAMPLE // 24
+                    CONVOLVE_ONE_SAMPLE // 25
+                    CONVOLVE_ONE_SAMPLE // 26
+                    CONVOLVE_ONE_SAMPLE // 27
+                    CONVOLVE_ONE_SAMPLE // 28
+                    CONVOLVE_ONE_SAMPLE // 29
+                    CONVOLVE_ONE_SAMPLE // 30
+                    CONVOLVE_ONE_SAMPLE // 31
+                    CONVOLVE_ONE_SAMPLE // 32
+                } else if (n == 64) {
+                    CONVOLVE_ONE_SAMPLE // 1
+                    CONVOLVE_ONE_SAMPLE // 2
+                    CONVOLVE_ONE_SAMPLE // 3
+                    CONVOLVE_ONE_SAMPLE // 4
+                    CONVOLVE_ONE_SAMPLE // 5
+                    CONVOLVE_ONE_SAMPLE // 6
+                    CONVOLVE_ONE_SAMPLE // 7
+                    CONVOLVE_ONE_SAMPLE // 8
+                    CONVOLVE_ONE_SAMPLE // 9
+                    CONVOLVE_ONE_SAMPLE // 10
+                    CONVOLVE_ONE_SAMPLE // 11
+                    CONVOLVE_ONE_SAMPLE // 12
+                    CONVOLVE_ONE_SAMPLE // 13
+                    CONVOLVE_ONE_SAMPLE // 14
+                    CONVOLVE_ONE_SAMPLE // 15
+                    CONVOLVE_ONE_SAMPLE // 16
+                    CONVOLVE_ONE_SAMPLE // 17
+                    CONVOLVE_ONE_SAMPLE // 18
+                    CONVOLVE_ONE_SAMPLE // 19
+                    CONVOLVE_ONE_SAMPLE // 20
+                    CONVOLVE_ONE_SAMPLE // 21
+                    CONVOLVE_ONE_SAMPLE // 22
+                    CONVOLVE_ONE_SAMPLE // 23
+                    CONVOLVE_ONE_SAMPLE // 24
+                    CONVOLVE_ONE_SAMPLE // 25
+                    CONVOLVE_ONE_SAMPLE // 26
+                    CONVOLVE_ONE_SAMPLE // 27
+                    CONVOLVE_ONE_SAMPLE // 28
+                    CONVOLVE_ONE_SAMPLE // 29
+                    CONVOLVE_ONE_SAMPLE // 30
+                    CONVOLVE_ONE_SAMPLE // 31
+                    CONVOLVE_ONE_SAMPLE // 32
+                    CONVOLVE_ONE_SAMPLE // 33
+                    CONVOLVE_ONE_SAMPLE // 34
+                    CONVOLVE_ONE_SAMPLE // 35
+                    CONVOLVE_ONE_SAMPLE // 36
+                    CONVOLVE_ONE_SAMPLE // 37
+                    CONVOLVE_ONE_SAMPLE // 38
+                    CONVOLVE_ONE_SAMPLE // 39
+                    CONVOLVE_ONE_SAMPLE // 40
+                    CONVOLVE_ONE_SAMPLE // 41
+                    CONVOLVE_ONE_SAMPLE // 42
+                    CONVOLVE_ONE_SAMPLE // 43
+                    CONVOLVE_ONE_SAMPLE // 44
+                    CONVOLVE_ONE_SAMPLE // 45
+                    CONVOLVE_ONE_SAMPLE // 46
+                    CONVOLVE_ONE_SAMPLE // 47
+                    CONVOLVE_ONE_SAMPLE // 48
+                    CONVOLVE_ONE_SAMPLE // 49
+                    CONVOLVE_ONE_SAMPLE // 50
+                    CONVOLVE_ONE_SAMPLE // 51
+                    CONVOLVE_ONE_SAMPLE // 52
+                    CONVOLVE_ONE_SAMPLE // 53
+                    CONVOLVE_ONE_SAMPLE // 54
+                    CONVOLVE_ONE_SAMPLE // 55
+                    CONVOLVE_ONE_SAMPLE // 56
+                    CONVOLVE_ONE_SAMPLE // 57
+                    CONVOLVE_ONE_SAMPLE // 58
+                    CONVOLVE_ONE_SAMPLE // 59
+                    CONVOLVE_ONE_SAMPLE // 60
+                    CONVOLVE_ONE_SAMPLE // 61
+                    CONVOLVE_ONE_SAMPLE // 62
+                    CONVOLVE_ONE_SAMPLE // 63
+                    CONVOLVE_ONE_SAMPLE // 64
+                } else {
+                    while (n--) {
+                        // Non-optimized using actual while loop.
+                        CONVOLVE_ONE_SAMPLE
+                    }
+                }
+            }
+
+            // Linearly interpolate the two "convolutions".
+            double result = (1.0 - kernelInterpolationFactor) * sum1 + kernelInterpolationFactor * sum2;
+
+            *destination++ = result;
+
+            --numberOfDestinationFrames;
+            if (!numberOfDestinationFrames)
+                return;
+
+            // Advance the virtual index.
+            m_virtualSourceIndex += m_scaleFactor;
+        }
+
+        // Wrap back around to the start.
+        m_virtualSourceIndex -= m_blockSize;
+
+        // Step (3) Copy r3 to r1 and r4 to r2.
+        // This wraps the last input frames back to the start of the buffer.
+        memcpy(r1, r3, sizeof(float) * (m_kernelSize / 2));
+        memcpy(r2, r4, sizeof(float) * (m_kernelSize / 2));
+
+        // Step (4)
+        // Refresh the buffer with more input.
+        consumeSource(r5, m_blockSize);
+    }
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(WEB_AUDIO)
diff --git a/Source/WebCore/platform/audio/SincResampler.h b/Source/WebCore/platform/audio/SincResampler.h
new file mode 100644
index 0000000..92adb95
--- /dev/null
+++ b/Source/WebCore/platform/audio/SincResampler.h
@@ -0,0 +1,79 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef SincResampler_h
+#define SincResampler_h
+
+#include "AudioArray.h"
+
+namespace WebCore {
+
+// SincResampler is a high-quality sample-rate converter.
+
+class SincResampler {
+public:   
+    // scaleFactor == sourceSampleRate / destinationSampleRate
+    // kernelSize can be adjusted for quality (higher is better)
+    // numberOfKernelOffsets is used for interpolation and is the number of sub-sample kernel shifts.
+    SincResampler(double scaleFactor, unsigned kernelSize = 64, unsigned numberOfKernelOffsets = 32);
+    
+    // Processes numberOfSourceFrames from source to produce numberOfSourceFrames / scaleFactor frames in destination.
+    void process(float* source, float* destination, unsigned numberOfSourceFrames);
+    
+    // FIXME: we can add a process() method which takes an input source callback function for streaming applications
+    // where the entire input buffer is not all available.
+    
+protected:
+    void initializeKernel();
+    void consumeSource(float* buffer, unsigned numberOfSourceFrames);
+    
+    double m_scaleFactor;
+    unsigned m_kernelSize;
+    unsigned m_numberOfKernelOffsets;
+
+    // m_kernelStorage has m_numberOfKernelOffsets kernels back-to-back, each of size m_kernelSize.
+    // The kernel offsets are sub-sample shifts of a windowed sinc() shifted from 0.0 to 1.0 sample.
+    AudioFloatArray m_kernelStorage;
+    
+    // m_virtualSourceIndex is an index on the source input buffer with sub-sample precision.
+    // It must be double precision to avoid drift.
+    double m_virtualSourceIndex;
+    
+    // This is the number of destination frames we generate per processing pass on the buffer.
+    unsigned m_blockSize;
+
+    // Source is copied into this buffer for each processing pass.
+    AudioFloatArray m_inputBuffer;
+
+    float* m_source;
+    unsigned m_sourceFramesAvailable;
+};
+
+} // namespace WebCore
+
+#endif // SincResampler_h
diff --git a/Source/WebCore/platform/audio/chromium/AudioBusChromium.cpp b/Source/WebCore/platform/audio/chromium/AudioBusChromium.cpp
index de44b1c..f34dc77 100644
--- a/Source/WebCore/platform/audio/chromium/AudioBusChromium.cpp
+++ b/Source/WebCore/platform/audio/chromium/AudioBusChromium.cpp
@@ -36,22 +36,30 @@ namespace WebCore {
 
 PassOwnPtr<AudioBus> AudioBus::loadPlatformResource(const char* name, double sampleRate)
 {
-    return PlatformBridge::loadPlatformAudioResource(name, sampleRate);
+    // FIXME: the sampleRate parameter is ignored. It should be removed from the API.
+    OwnPtr<AudioBus> audioBus = PlatformBridge::loadPlatformAudioResource(name, sampleRate);
+    if (!audioBus.get())
+        return 0;
+    
+    // If the bus is already at the requested sample-rate then return as is.
+    if (audioBus->sampleRate() == sampleRate)
+        return audioBus.release();
+    
+    return AudioBus::createBySampleRateConverting(audioBus.get(), false, sampleRate);
 }
 
 PassOwnPtr<AudioBus> createBusFromInMemoryAudioFile(const void* data, size_t dataSize, bool mixToMono, double sampleRate)
 {
+    // FIXME: the sampleRate parameter is ignored. It should be removed from the API.
     OwnPtr<AudioBus> audioBus = PlatformBridge::decodeAudioFileData(static_cast<const char*>(data), dataSize, sampleRate);
-    if (audioBus.get() && audioBus->numberOfChannels() == 2 && mixToMono) {
-        OwnPtr<AudioBus> monoAudioBus = adoptPtr(new AudioBus(1, audioBus->length()));
-
-        // FIXME: AudioBus::copyFrom() should be able to do a downmix to mono.
-        // for now simply copy the left channel.
-        monoAudioBus->channel(0)->copyFrom(audioBus->channel(0));
-        return monoAudioBus.release();
-    }
+    if (!audioBus.get())
+      return 0;
+      
+    // If the bus needs no conversion then return as is.
+    if ((!mixToMono || audioBus->numberOfChannels() == 1) && audioBus->sampleRate() == sampleRate)
+        return audioBus.release();
     
-    return audioBus.release();
+    return AudioBus::createBySampleRateConverting(audioBus.get(), mixToMono, sampleRate);    
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/audio/mac/AudioDestinationMac.cpp b/Source/WebCore/platform/audio/mac/AudioDestinationMac.cpp
index 523729f..d4ecaba 100644
--- a/Source/WebCore/platform/audio/mac/AudioDestinationMac.cpp
+++ b/Source/WebCore/platform/audio/mac/AudioDestinationMac.cpp
@@ -51,8 +51,8 @@ double AudioDestination::hardwareSampleRate()
     AudioDeviceID deviceID = kAudioDeviceUnknown;
     UInt32 infoSize = sizeof(deviceID);
 
-    AudioObjectPropertyAddress defaultInputDeviceAddress = { kAudioHardwarePropertyDefaultInputDevice, kAudioObjectPropertyScopeGlobal, kAudioObjectPropertyElementMaster };
-    OSStatus result = AudioObjectGetPropertyData(kAudioObjectSystemObject, &defaultInputDeviceAddress, 0, 0, &infoSize, (void*)&deviceID);
+    AudioObjectPropertyAddress defaultOutputDeviceAddress = { kAudioHardwarePropertyDefaultOutputDevice, kAudioObjectPropertyScopeGlobal, kAudioObjectPropertyElementMaster };
+    OSStatus result = AudioObjectGetPropertyData(kAudioObjectSystemObject, &defaultOutputDeviceAddress, 0, 0, &infoSize, (void*)&deviceID);
     if (result)
         return 0.0; // error
 
diff --git a/Source/WebCore/platform/brew/FileSystemBrew.cpp b/Source/WebCore/platform/brew/FileSystemBrew.cpp
index 61d568d..251c004 100644
--- a/Source/WebCore/platform/brew/FileSystemBrew.cpp
+++ b/Source/WebCore/platform/brew/FileSystemBrew.cpp
@@ -186,7 +186,7 @@ String directoryName(const String& path)
     return dirName;
 }
 
-CString openTemporaryFile(const char* prefix, PlatformFileHandle& handle)
+String openTemporaryFile(const String& prefix, PlatformFileHandle& handle)
 {
     // BREW does not have a system-wide temporary directory,
     // use "fs:/~/tmp" as our temporary directory.
@@ -199,24 +199,24 @@ CString openTemporaryFile(const char* prefix, PlatformFileHandle& handle)
 
     // Loop until we find a temporary filename that does not exist.
     int number = static_cast<int>(randomNumber() * 10000);
-    CString filename;
+    String filename;
     do {
         StringBuilder builder;
         builder.append(tempPath);
         builder.append('/');
         builder.append(prefix);
         builder.append(String::number(number));
-        filename = builder.toString().utf8();
+        filename = builder.toString();
         number++;
-    } while (IFILEMGR_Test(fileMgr.get(), filename.data()) == SUCCESS);
+    } while (IFILEMGR_Test(fileMgr.get(), filename.utf8().data()) == SUCCESS);
 
-    IFile* tempFile = IFILEMGR_OpenFile(fileMgr.get(), filename.data(), _OFM_CREATE);
+    IFile* tempFile = IFILEMGR_OpenFile(fileMgr.get(), filename.utf8().data(), _OFM_CREATE);
     if (tempFile) {
         handle = tempFile;
         return filename;
     }
 
-    return CString();
+    return String();
 }
 
 void closeFile(PlatformFileHandle& handle)
diff --git a/Source/WebCore/platform/brew/LocalizedStringsBrew.cpp b/Source/WebCore/platform/brew/LocalizedStringsBrew.cpp
index c4dac1a..ba5d4a9 100644
--- a/Source/WebCore/platform/brew/LocalizedStringsBrew.cpp
+++ b/Source/WebCore/platform/brew/LocalizedStringsBrew.cpp
@@ -206,7 +206,7 @@ String contextMenuItemTagSearchWeb()
     return "Search web";
 }
 
-String contextMenuItemTagLookUpInDictionary()
+String contextMenuItemTagLookUpInDictionary(const String&)
 {
     return "Lookup in dictionary";
 }
diff --git a/Source/WebCore/platform/cf/BinaryPropertyList.cpp b/Source/WebCore/platform/cf/BinaryPropertyList.cpp
index 41769e8..65be70a 100644
--- a/Source/WebCore/platform/cf/BinaryPropertyList.cpp
+++ b/Source/WebCore/platform/cf/BinaryPropertyList.cpp
@@ -92,7 +92,7 @@ struct IntegerArrayHash {
 
 unsigned IntegerArrayHash::hash(const IntegerArray& array)
 {
-    return WTF::StringHasher::createBlobHash(array.integers(), array.size());
+    return StringHasher::hashMemory(array.integers(), array.size() * sizeof(int));
 }
 
 bool IntegerArrayHash::equal(const IntegerArray& a, const IntegerArray& b)
diff --git a/Source/WebCore/platform/cf/SchedulePair.h b/Source/WebCore/platform/cf/SchedulePair.h
index 8361856..cb34d7d 100644
--- a/Source/WebCore/platform/cf/SchedulePair.h
+++ b/Source/WebCore/platform/cf/SchedulePair.h
@@ -73,7 +73,7 @@ struct SchedulePairHash {
     static unsigned hash(const RefPtr<SchedulePair>& pair)
     {
         uintptr_t hashCodes[2] = { reinterpret_cast<uintptr_t>(pair->runLoop()), pair->mode() ? CFHash(pair->mode()) : 0 };
-        return WTF::StringHasher::createBlobHash<sizeof(hashCodes)>(hashCodes);
+        return StringHasher::hashMemory<sizeof(hashCodes)>(hashCodes);
     }
 
     static bool equal(const RefPtr<SchedulePair>& a, const RefPtr<SchedulePair>& b) { return a == b; }
diff --git a/Source/WebCore/platform/cf/SharedBufferCF.cpp b/Source/WebCore/platform/cf/SharedBufferCF.cpp
index 18a65c2..319f484 100644
--- a/Source/WebCore/platform/cf/SharedBufferCF.cpp
+++ b/Source/WebCore/platform/cf/SharedBufferCF.cpp
@@ -91,4 +91,30 @@ void SharedBuffer::clearPlatformData()
     m_cfData = 0;
 }
 
+#if HAVE(CFNETWORK_DATA_ARRAY_CALLBACK)
+void SharedBuffer::append(CFDataRef data)
+{
+    ASSERT(data);
+    m_dataArray.append(data);
+    m_size += CFDataGetLength(data);
+}
+
+void SharedBuffer::copyDataArrayAndClear(char *destination, unsigned bytesToCopy) const
+{
+    if (m_dataArray.isEmpty())
+        return;
+
+    CFIndex bytesLeft = bytesToCopy;
+    Vector<RetainPtr<CFDataRef> >::const_iterator end = m_dataArray.end();
+    for (Vector<RetainPtr<CFDataRef> >::const_iterator it = m_dataArray.begin(); it != end; ++it) {
+        CFIndex dataLen = CFDataGetLength(it->get());
+        ASSERT(bytesLeft >= dataLen);
+        memcpy(destination, CFDataGetBytePtr(it->get()), dataLen);
+        destination += dataLen;
+        bytesLeft -= dataLen;
+    }
+    m_dataArray.clear();
+}
+#endif
+
 }
diff --git a/Source/WebCore/platform/cf/win/CertificateCFWin.cpp b/Source/WebCore/platform/cf/win/CertificateCFWin.cpp
new file mode 100644
index 0000000..88ea933
--- /dev/null
+++ b/Source/WebCore/platform/cf/win/CertificateCFWin.cpp
@@ -0,0 +1,52 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "CertificateCFWin.h"
+
+namespace WebCore {
+
+static void deallocCertContext(void* ptr, void* info)
+{
+    if (ptr)
+        CertFreeCertificateContext(static_cast<PCCERT_CONTEXT>(ptr));
+}
+
+static CFAllocatorRef createCertContextDeallocator()
+{
+    CFAllocatorContext allocContext = {
+        0, 0, 0, 0, 0, 0, 0, deallocCertContext, 0
+    };
+    return CFAllocatorCreate(kCFAllocatorDefault, &allocContext);
+}
+
+RetainPtr<CFDataRef> copyCertificateToData(PCCERT_CONTEXT certificate)
+{
+    static CFAllocatorRef certDealloc = createCertContextDeallocator();
+    PCCERT_CONTEXT certificateCopy = CertDuplicateCertificateContext(certificate);
+    return RetainPtr<CFDataRef>(AdoptCF, CFDataCreateWithBytesNoCopy(kCFAllocatorDefault, reinterpret_cast<const UInt8*>(certificateCopy), sizeof(*certificateCopy), certDealloc));
+}
+
+} // namespace WebCore
diff --git a/Source/WebCore/platform/cf/win/CertificateCFWin.h b/Source/WebCore/platform/cf/win/CertificateCFWin.h
new file mode 100644
index 0000000..b3ada0d
--- /dev/null
+++ b/Source/WebCore/platform/cf/win/CertificateCFWin.h
@@ -0,0 +1,38 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef CertificateCFWin_h
+#define CertificateCFWin_h
+
+#include <windows.h>
+#include <wtf/RetainPtr.h>
+
+namespace WebCore {
+
+RetainPtr<CFDataRef> copyCertificateToData(PCCERT_CONTEXT);
+
+} // namespace WebCore
+
+#endif // CertificateCFWin_h
diff --git a/Source/WebCore/platform/chromium/ClipboardChromium.cpp b/Source/WebCore/platform/chromium/ClipboardChromium.cpp
index 7e58f03..6756313 100644
--- a/Source/WebCore/platform/chromium/ClipboardChromium.cpp
+++ b/Source/WebCore/platform/chromium/ClipboardChromium.cpp
@@ -31,6 +31,7 @@
 #include "ChromiumDataObject.h"
 #include "ClipboardMimeTypes.h"
 #include "ClipboardUtilitiesChromium.h"
+#include "DataTransferItemsChromium.h"
 #include "Document.h"
 #include "DragData.h"
 #include "Element.h"
@@ -342,4 +343,22 @@ bool ClipboardChromium::hasData()
     return m_dataObject->hasData();
 }
 
+#if ENABLE(DATA_TRANSFER_ITEMS)
+PassRefPtr<DataTransferItems> ClipboardChromium::items()
+{
+    RefPtr<DataTransferItemsChromium> items = DataTransferItemsChromium::create(this, m_frame->document()->scriptExecutionContext());
+
+    if (!m_dataObject)
+        return items;
+
+    if (isForCopyAndPaste() && policy() == ClipboardReadable) {
+        // Iterate through the types and add them.
+        HashSet<String> types = m_dataObject->types();
+        for (HashSet<String>::const_iterator it = types.begin(); it != types.end(); ++it)
+            items->addPasteboardItem(*it);
+    }
+    return items;
+}
+#endif
+
 } // namespace WebCore
diff --git a/Source/WebCore/platform/chromium/ClipboardChromium.h b/Source/WebCore/platform/chromium/ClipboardChromium.h
index d30a1c4..61db0a5 100644
--- a/Source/WebCore/platform/chromium/ClipboardChromium.h
+++ b/Source/WebCore/platform/chromium/ClipboardChromium.h
@@ -80,6 +80,10 @@ namespace WebCore {
 
         virtual bool hasData();
 
+#if ENABLE(DATA_TRANSFER_ITEMS)
+        virtual PassRefPtr<DataTransferItems> items();
+#endif
+
     private:
         ClipboardChromium(ClipboardType, PassRefPtr<ChromiumDataObject>, ClipboardAccessPolicy, Frame*);
 
diff --git a/Source/WebCore/platform/chromium/DataTransferItemChromium.cpp b/Source/WebCore/platform/chromium/DataTransferItemChromium.cpp
new file mode 100644
index 0000000..7857336
--- /dev/null
+++ b/Source/WebCore/platform/chromium/DataTransferItemChromium.cpp
@@ -0,0 +1,108 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "DataTransferItemChromium.h"
+
+#if ENABLE(DATA_TRANSFER_ITEMS)
+
+#include "Clipboard.h"
+#include "ClipboardMimeTypes.h"
+#include "PlatformBridge.h"
+#include "StringCallback.h"
+
+namespace WebCore {
+
+PassRefPtr<DataTransferItemChromium> DataTransferItemChromium::createFromPasteboard(PassRefPtr<Clipboard> owner, ScriptExecutionContext* context, const String& type)
+{
+    if (type == mimeTypeTextPlain || type == mimeTypeTextHTML)
+        return adoptRef(new DataTransferItemChromium(owner, context, PasteboardSource, DataTransferItem::kindString, type, ""));
+    return adoptRef(new DataTransferItemChromium(owner, context, PasteboardSource, DataTransferItem::kindFile, type, ""));
+}
+
+PassRefPtr<DataTransferItemChromium> DataTransferItemChromium::create(PassRefPtr<Clipboard> owner,
+                                                                      ScriptExecutionContext* context,
+                                                                      const String& data,
+                                                                      const String& type)
+{
+    return adoptRef(new DataTransferItemChromium(owner, context, InternalSource, DataTransferItem::kindString, type, data));
+}
+
+DataTransferItemChromium::DataTransferItemChromium(PassRefPtr<Clipboard> owner, ScriptExecutionContext* context, DataSource source, const String& kind, const String& type, const String& data)
+    : m_owner(owner)
+    , m_context(context)
+    , m_source(source)
+    , m_kind(kind)
+    , m_type(type)
+    , m_data(data)
+{
+}
+
+String DataTransferItemChromium::kind() const
+{
+    if (m_owner->policy() == ClipboardNumb)
+        return String();
+    return m_kind;
+}
+
+String DataTransferItemChromium::type() const
+{
+    if (m_owner->policy() == ClipboardNumb)
+        return String();
+    return m_type;
+}
+
+void DataTransferItemChromium::getAsString(PassRefPtr<StringCallback> callback)
+{
+    if ((m_owner->policy() != ClipboardReadable && m_owner->policy() != ClipboardWritable)
+        || m_kind != kindString)
+        return;
+    if (m_source == InternalSource) {
+        callback->scheduleCallback(m_context, m_data);
+        return;
+    }
+    // This is ugly but there's no real alternative.
+    if (m_type == mimeTypeTextPlain) {
+        callback->scheduleCallback(m_context, PlatformBridge::clipboardReadPlainText(PasteboardPrivate::StandardBuffer));
+        return;
+    }
+    if (m_type == mimeTypeTextHTML) {
+        String html;
+        KURL ignoredSourceURL;
+        PlatformBridge::clipboardReadHTML(PasteboardPrivate::StandardBuffer, &html, &ignoredSourceURL);
+        callback->scheduleCallback(m_context, html);
+        return;
+    }
+    ASSERT_NOT_REACHED();
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(DATA_TRANSFER_ITEMS)
diff --git a/Source/WebCore/platform/chromium/DataTransferItemChromium.h b/Source/WebCore/platform/chromium/DataTransferItemChromium.h
new file mode 100644
index 0000000..77f74f2
--- /dev/null
+++ b/Source/WebCore/platform/chromium/DataTransferItemChromium.h
@@ -0,0 +1,75 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef DataTransferItemChromium_h
+#define DataTransferItemChromium_h
+
+#if ENABLE(DATA_TRANSFER_ITEMS)
+
+#include "DataTransferItem.h"
+#include <wtf/RefPtr.h>
+#include <wtf/text/WTFString.h>
+
+namespace WebCore {
+
+class Clipboard;
+class ScriptExecutionContext;
+
+class DataTransferItemChromium : public DataTransferItem {
+public:
+    static PassRefPtr<DataTransferItemChromium> createFromPasteboard(PassRefPtr<Clipboard> owner, ScriptExecutionContext*, const String& type);
+    static PassRefPtr<DataTransferItemChromium> create(PassRefPtr<Clipboard> owner, ScriptExecutionContext*, const String& data, const String& type);
+
+    virtual String kind() const;
+    virtual String type() const;
+
+    virtual void getAsString(PassRefPtr<StringCallback>);
+
+private:
+    enum DataSource {
+        PasteboardSource,
+        InternalSource,
+    };
+
+    DataTransferItemChromium(PassRefPtr<Clipboard> owner, ScriptExecutionContext*, DataSource, const String& kind, const String& type, const String& data);
+
+    const RefPtr<Clipboard> m_owner;
+    ScriptExecutionContext* m_context;
+    const DataSource m_source;
+    const String m_kind;
+    const String m_type;
+    const String m_data;
+};
+
+} // namespace WebCore
+
+#endif // ENABLE(DATA_TRANSFER_ITEMS)
+
+#endif // DataTransferItem_h
diff --git a/Source/WebCore/platform/chromium/DataTransferItemsChromium.cpp b/Source/WebCore/platform/chromium/DataTransferItemsChromium.cpp
new file mode 100644
index 0000000..418b8b5
--- /dev/null
+++ b/Source/WebCore/platform/chromium/DataTransferItemsChromium.cpp
@@ -0,0 +1,111 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "DataTransferItemsChromium.h"
+
+#if ENABLE(DATA_TRANSFER_ITEMS)
+
+#include "Clipboard.h"
+#include "DataTransferItemChromium.h"
+#include "ExceptionCode.h"
+
+namespace WebCore {
+
+PassRefPtr<DataTransferItemsChromium> DataTransferItemsChromium::create(PassRefPtr<Clipboard> owner, ScriptExecutionContext* context)
+{
+    return adoptRef(new DataTransferItemsChromium(owner, context));
+}
+
+DataTransferItemsChromium::DataTransferItemsChromium(PassRefPtr<Clipboard> owner, ScriptExecutionContext* context)
+    : m_owner(owner)
+    , m_context(context)
+{
+}
+
+unsigned long DataTransferItemsChromium::length() const
+{
+    if (m_owner->policy() == ClipboardNumb)
+        return 0;
+    return m_items.size();
+}
+
+PassRefPtr<DataTransferItem> DataTransferItemsChromium::item(unsigned long index) const
+{
+    if (m_owner->policy() == ClipboardNumb || index >= length())
+        return 0;
+    return m_items[index];
+}
+
+void DataTransferItemsChromium::deleteItem(unsigned long index, ExceptionCode& ec)
+{
+    if (m_owner->policy() != ClipboardWritable) {
+        ec = INVALID_STATE_ERR;
+        return;
+    }
+
+    if (index >= length())
+        return;
+
+    m_items.remove(index);
+}
+
+void DataTransferItemsChromium::clear()
+{
+    if (m_owner->policy() != ClipboardWritable)
+        return;
+
+    m_items.clear();
+}
+
+void DataTransferItemsChromium::add(const String& data, const String& type, ExceptionCode& ec)
+{
+    if (m_owner->policy() != ClipboardWritable)
+        return;
+
+    // Only one 'string' item with a given type is allowed in the collection.
+    for (size_t i = 0; i < m_items.size(); ++i) {
+        if (m_items[i]->type() == type && m_items[i]->kind() == DataTransferItem::kindString) {
+            ec = INVALID_STATE_ERR;
+            return;
+        }
+    }
+
+    m_items.append(DataTransferItemChromium::create(m_owner, m_context, data, type));
+}
+
+void DataTransferItemsChromium::addPasteboardItem(const String& type)
+{
+    m_items.append(DataTransferItemChromium::createFromPasteboard(m_owner, m_context, type));
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(DATA_TRANSFER_ITEMS)
diff --git a/Source/WebCore/platform/chromium/DataTransferItemsChromium.h b/Source/WebCore/platform/chromium/DataTransferItemsChromium.h
new file mode 100644
index 0000000..51c4fdb
--- /dev/null
+++ b/Source/WebCore/platform/chromium/DataTransferItemsChromium.h
@@ -0,0 +1,77 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef DataTransferItemsChromium_h
+#define DataTransferItemsChromium_h
+
+#if ENABLE(DATA_TRANSFER_ITEMS)
+
+#include "DataTransferItems.h"
+#include <wtf/RefPtr.h>
+#include <wtf/Vector.h>
+
+namespace WebCore {
+
+class Clipboard;
+class DataTransferItemChromium;
+class ScriptExecutionContext;
+
+typedef int ExceptionCode;
+
+class DataTransferItemsChromium : public DataTransferItems {
+public:
+    static PassRefPtr<DataTransferItemsChromium> create(PassRefPtr<Clipboard>, ScriptExecutionContext*);
+
+    virtual unsigned long length() const;
+    virtual PassRefPtr<DataTransferItem> item(unsigned long index) const;
+    virtual void deleteItem(unsigned long index, ExceptionCode&);
+    virtual void clear();
+
+    virtual void add(const String& data, const String& type, ExceptionCode&);
+
+private:
+    friend class ClipboardChromium;
+
+    DataTransferItemsChromium(PassRefPtr<Clipboard>, ScriptExecutionContext*);
+
+    virtual void addPasteboardItem(const String& type);
+
+    RefPtr<Clipboard> m_owner;
+    // Indirectly owned by our parent.
+    ScriptExecutionContext* m_context;
+    Vector<RefPtr<DataTransferItemChromium> > m_items;
+};
+
+} // namespace WebCore
+
+#endif // ENABLE(DATA_TRANSFER_ITEMS)
+
+#endif // DataTransferItemsChromium_h
+
diff --git a/Source/WebCore/platform/chromium/FileSystemChromium.cpp b/Source/WebCore/platform/chromium/FileSystemChromium.cpp
index faf5e92..5e03c5b 100644
--- a/Source/WebCore/platform/chromium/FileSystemChromium.cpp
+++ b/Source/WebCore/platform/chromium/FileSystemChromium.cpp
@@ -112,4 +112,11 @@ int writeToFile(PlatformFileHandle handle, const char* data, int length)
     return PlatformBridge::writeToFile(handle, data, length);
 }
 
+Vector<String> listDirectory(const String& path, const String& filter)
+{
+    notImplemented();
+
+    return Vector<String>();
+}
+
 } // namespace WebCore
diff --git a/Source/WebCore/platform/chromium/PasteboardPrivate.h b/Source/WebCore/platform/chromium/PasteboardPrivate.h
index 1de7fe3..5f167ba 100644
--- a/Source/WebCore/platform/chromium/PasteboardPrivate.h
+++ b/Source/WebCore/platform/chromium/PasteboardPrivate.h
@@ -36,6 +36,7 @@ namespace WebCore {
     class PasteboardPrivate {
     public:
         enum ClipboardFormat {
+            PlainTextFormat,
             HTMLFormat,
             BookmarkFormat,
             WebSmartPasteFormat,
diff --git a/Source/WebCore/platform/chromium/ScrollbarThemeChromiumWin.cpp b/Source/WebCore/platform/chromium/ScrollbarThemeChromiumWin.cpp
index 29e8b44..7229c51 100644
--- a/Source/WebCore/platform/chromium/ScrollbarThemeChromiumWin.cpp
+++ b/Source/WebCore/platform/chromium/ScrollbarThemeChromiumWin.cpp
@@ -35,7 +35,7 @@
 #include "PlatformContextSkia.h"
 #include "PlatformMouseEvent.h"
 #include "Scrollbar.h"
-#include "WindowsVersion.h"
+#include "SystemInfo.h"
 
 namespace WebCore {
 
@@ -70,7 +70,7 @@ int ScrollbarThemeChromiumWin::scrollbarThickness(ScrollbarControlSize controlSi
 
 bool ScrollbarThemeChromiumWin::invalidateOnMouseEnterExit()
 {
-    return isVistaOrNewer();
+    return windowsVersion() >= WindowsVista;
 }
 
 bool ScrollbarThemeChromiumWin::shouldSnapBackToDragOrigin(Scrollbar* scrollbar, const PlatformMouseEvent& evt)
@@ -160,12 +160,12 @@ int ScrollbarThemeChromiumWin::getThemeState(Scrollbar* scrollbar, ScrollbarPart
     if (scrollbar->pressedPart() == ThumbPart) {
         if (part == ThumbPart)
             return SCRBS_PRESSED;
-        return isVistaOrNewer() ? SCRBS_HOVER : SCRBS_NORMAL;
+        return (windowsVersion() < WindowsVista) ? SCRBS_NORMAL : SCRBS_HOVER;
     }
     if (!scrollbar->enabled())
         return SCRBS_DISABLED;
     if (scrollbar->hoveredPart() != part || part == BackTrackPart || part == ForwardTrackPart)
-        return (scrollbar->hoveredPart() == NoPart || !isVistaOrNewer()) ? SCRBS_NORMAL : SCRBS_HOVER;
+        return (scrollbar->hoveredPart() == NoPart || (windowsVersion() < WindowsVista)) ? SCRBS_NORMAL : SCRBS_HOVER;
     if (scrollbar->pressedPart() == NoPart)
         return SCRBS_HOT;
     return (scrollbar->pressedPart() == part) ? SCRBS_PRESSED : SCRBS_NORMAL;
@@ -179,43 +179,43 @@ int ScrollbarThemeChromiumWin::getThemeArrowState(Scrollbar* scrollbar, Scrollba
     if (part == BackButtonStartPart || part == ForwardButtonStartPart) {
         if (scrollbar->orientation() == HorizontalScrollbar) {
             if (scrollbar->pressedPart() == ThumbPart)
-                return !isVistaOrNewer() ? ABS_LEFTNORMAL : ABS_LEFTHOVER;
+                return (windowsVersion() < WindowsVista) ? ABS_LEFTNORMAL : ABS_LEFTHOVER;
             if (!scrollbar->enabled())
                 return ABS_LEFTDISABLED;
             if (scrollbar->hoveredPart() != part)
-                return ((scrollbar->hoveredPart() == NoPart) || !isVistaOrNewer()) ? ABS_LEFTNORMAL : ABS_LEFTHOVER;
+                return ((scrollbar->hoveredPart() == NoPart) || (windowsVersion() < WindowsVista)) ? ABS_LEFTNORMAL : ABS_LEFTHOVER;
             if (scrollbar->pressedPart() == NoPart)
                 return ABS_LEFTHOT;
             return (scrollbar->pressedPart() == part) ?
                 ABS_LEFTPRESSED : ABS_LEFTNORMAL;
         }
         if (scrollbar->pressedPart() == ThumbPart)
-            return !isVistaOrNewer() ? ABS_UPNORMAL : ABS_UPHOVER;
+            return (windowsVersion() < WindowsVista) ? ABS_UPNORMAL : ABS_UPHOVER;
         if (!scrollbar->enabled())
             return ABS_UPDISABLED;
         if (scrollbar->hoveredPart() != part)
-            return ((scrollbar->hoveredPart() == NoPart) || !isVistaOrNewer()) ? ABS_UPNORMAL : ABS_UPHOVER;
+            return ((scrollbar->hoveredPart() == NoPart) || (windowsVersion() < WindowsVista)) ? ABS_UPNORMAL : ABS_UPHOVER;
         if (scrollbar->pressedPart() == NoPart)
             return ABS_UPHOT;
         return (scrollbar->pressedPart() == part) ? ABS_UPPRESSED : ABS_UPNORMAL;
     }
     if (scrollbar->orientation() == HorizontalScrollbar) {
         if (scrollbar->pressedPart() == ThumbPart)
-            return !isVistaOrNewer() ? ABS_RIGHTNORMAL : ABS_RIGHTHOVER;
+            return (windowsVersion() < WindowsVista) ? ABS_RIGHTNORMAL : ABS_RIGHTHOVER;
         if (!scrollbar->enabled())
             return ABS_RIGHTDISABLED;
         if (scrollbar->hoveredPart() != part)
-            return ((scrollbar->hoveredPart() == NoPart) || !isVistaOrNewer()) ? ABS_RIGHTNORMAL : ABS_RIGHTHOVER;
+            return ((scrollbar->hoveredPart() == NoPart) || (windowsVersion() < WindowsVista)) ? ABS_RIGHTNORMAL : ABS_RIGHTHOVER;
         if (scrollbar->pressedPart() == NoPart)
             return ABS_RIGHTHOT;
         return (scrollbar->pressedPart() == part) ? ABS_RIGHTPRESSED : ABS_RIGHTNORMAL;
     }
     if (scrollbar->pressedPart() == ThumbPart)
-        return !isVistaOrNewer() ? ABS_DOWNNORMAL : ABS_DOWNHOVER;
+        return (windowsVersion() < WindowsVista) ? ABS_DOWNNORMAL : ABS_DOWNHOVER;
     if (!scrollbar->enabled())
         return ABS_DOWNDISABLED;
     if (scrollbar->hoveredPart() != part)
-        return ((scrollbar->hoveredPart() == NoPart) || !isVistaOrNewer()) ? ABS_DOWNNORMAL : ABS_DOWNHOVER;
+        return ((scrollbar->hoveredPart() == NoPart) || (windowsVersion() < WindowsVista)) ? ABS_DOWNNORMAL : ABS_DOWNHOVER;
     if (scrollbar->pressedPart() == NoPart)
         return ABS_DOWNHOT;
     return (scrollbar->pressedPart() == part) ? ABS_DOWNPRESSED : ABS_DOWNNORMAL;
diff --git a/Source/WebCore/platform/chromium/TraceEvent.h b/Source/WebCore/platform/chromium/TraceEvent.h
new file mode 100644
index 0000000..9b92d58
--- /dev/null
+++ b/Source/WebCore/platform/chromium/TraceEvent.h
@@ -0,0 +1,74 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+#ifndef TraceEvent_h
+#define TraceEvent_h
+
+#include "PlatformBridge.h"
+
+// Implementation detail: trace event macros create temporary variables
+// to keep instrumentation overhead low. These macros give each temporary
+// variable a unique name based on the line number to prevent name collissions.
+#define TRACE_EVENT_MAKE_UNIQUE_IDENTIFIER3(a, b) a##b
+#define TRACE_EVENT_MAKE_UNIQUE_IDENTIFIER2(a, b) TRACE_EVENT_MAKE_UNIQUE_IDENTIFIER3(a, b)
+#define TRACE_EVENT_MAKE_UNIQUE_IDENTIFIER(name_prefix) TRACE_EVENT_MAKE_UNIQUE_IDENTIFIER2(name_prefix, __LINE__)
+
+// Issues PlatformBridge::traceEventBegin and traceEventEnd calls for the enclosing scope
+#define TRACE_EVENT(name, id, extra) WebCore::internal::ScopeTracer TRACE_EVENT_MAKE_UNIQUE_IDENTIFIER(__traceEventScope)(name, id, extra);
+
+namespace WebCore {
+
+namespace internal {
+
+// Used by TRACE_EVENT macro. Do not use directly.
+class ScopeTracer {
+public:
+    ScopeTracer(const char* name, void*, const char* extra);
+    ~ScopeTracer();
+
+private:
+    const char* m_name;
+    void* m_id;
+    OwnPtr<char*> m_extra;
+};
+
+inline ScopeTracer::ScopeTracer(const char* name, void* id, const char* extra)
+    : m_name(name)
+    , m_id(id)
+{
+    PlatformBridge::traceEventBegin(name, id, extra); \
+    if (extra)
+        m_extra = adoptPtr(strdup(extra));
+}
+
+inline ScopeTracer::~ScopeTracer()
+{
+    PlatformBridge::traceEventEnd(m_name, m_id, m_extra.get());
+}
+
+} // namespace internal
+
+} // namespace WebCore
+
+#endif
diff --git a/Source/WebCore/platform/chromium/WindowsVersion.cpp b/Source/WebCore/platform/chromium/WindowsVersion.cpp
deleted file mode 100644
index a9632cb..0000000
--- a/Source/WebCore/platform/chromium/WindowsVersion.cpp
+++ /dev/null
@@ -1,52 +0,0 @@
-// Copyright (c) 2008, Google Inc. All rights reserved.
-// 
-// Redistribution and use in source and binary forms, with or without
-// modification, are permitted provided that the following conditions are
-// met:
-// 
-//     * Redistributions of source code must retain the above copyright
-// notice, this list of conditions and the following disclaimer.
-//     * Redistributions in binary form must reproduce the above
-// copyright notice, this list of conditions and the following disclaimer
-// in the documentation and/or other materials provided with the
-// distribution.
-//     * Neither the name of Google Inc. nor the names of its
-// contributors may be used to endorse or promote products derived from
-// this software without specific prior written permission.
-// 
-// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-
-#include "config.h"
-#include "WindowsVersion.h"
-
-#include <windows.h>
-
-namespace WebCore {
-
-bool isVistaOrNewer()
-{
-    // Cache the result to avoid asking every time.
-    static bool haveResult = false;
-    static bool result = false;
-    if (!haveResult) {
-        OSVERSIONINFO versionInfo;
-        versionInfo.dwOSVersionInfoSize = sizeof(versionInfo);
-        GetVersionEx(&versionInfo);
-
-        haveResult = true;
-        result = versionInfo.dwMajorVersion >= 6;
-    }
-    return result;
-}
-
-} // namespace WebCore
diff --git a/Source/WebCore/platform/efl/ContextMenuEfl.cpp b/Source/WebCore/platform/efl/ContextMenuEfl.cpp
index a5c6524..45d1758 100644
--- a/Source/WebCore/platform/efl/ContextMenuEfl.cpp
+++ b/Source/WebCore/platform/efl/ContextMenuEfl.cpp
@@ -2,7 +2,7 @@
  *  Copyright (C) 2007 Holger Hans Peter Freyther
  *  Copyright (C) 2008 INdT - Instituto Nokia de Tecnologia
  *  Copyright (C) 2009-2010 ProFUSION embedded systems
- *  Copyright (C) 2009-2010 Samsung Electronics
+ *  Copyright (C) 2011 Samsung Electronics
  *
  *  This library is free software; you can redistribute it and/or
  *  modify it under the terms of the GNU Lesser General Public
@@ -26,16 +26,12 @@
 
 namespace WebCore {
 
+#if USE(CROSS_PLATFORM_CONTEXT_MENUS)
 ContextMenu::ContextMenu(void* menu)
 {
     getContextMenuItems(menu, m_items);
 }
 
-ContextMenu::ContextMenu()
-{
-    notImplemented();
-}
-
 void ContextMenu::getContextMenuItems(void* menu, Vector<ContextMenuItem>& items)
 {
     notImplemented();
@@ -51,5 +47,11 @@ void* ContextMenu::nativeMenu() const
 {
     return createNativeMenuFromItems(m_items);
 }
+#else
+ContextMenu::ContextMenu()
+{
+    notImplemented();
+}
+#endif
 
 }
diff --git a/Source/WebCore/platform/efl/ContextMenuItemEfl.cpp b/Source/WebCore/platform/efl/ContextMenuItemEfl.cpp
index 5ce8fab..425c6a6 100644
--- a/Source/WebCore/platform/efl/ContextMenuItemEfl.cpp
+++ b/Source/WebCore/platform/efl/ContextMenuItemEfl.cpp
@@ -3,7 +3,7 @@
  * Copyright (C) 2007 Staikos Computing Services Inc. <info@staikos.net>
  * Copyright (C) 2008 INdT - Instituto Nokia de Tecnologia
  * Copyright (C) 2009-2010 ProFUSION embedded systems
- * Copyright (C) 2009-2010 Samsung Electronics
+ * Copyright (C) 2011 Samsung Electronics
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -34,11 +34,13 @@
 
 namespace WebCore {
 
-ContextMenuItem::ContextMenuItem(void* const&)
+#if USE(CROSS_PLATFORM_CONTEXT_MENUS)
+void* ContextMenuItem::nativeMenuItem() const
 {
     notImplemented();
+    return 0;
 }
-
+#else
 ContextMenuItem::ContextMenuItem(ContextMenuItemType, ContextMenuAction, const String&, ContextMenu*)
 {
     notImplemented();
@@ -49,12 +51,6 @@ ContextMenuItem::~ContextMenuItem()
     notImplemented();
 }
 
-void* ContextMenuItem::nativeMenuItem() const
-{
-    notImplemented();
-    return 0;
-}
-
 ContextMenuItemType ContextMenuItem::type() const
 {
     notImplemented();
@@ -98,5 +94,5 @@ void ContextMenuItem::setSubMenu(ContextMenu*)
 {
     notImplemented();
 }
-
+#endif
 }
diff --git a/Source/WebCore/platform/efl/FileSystemEfl.cpp b/Source/WebCore/platform/efl/FileSystemEfl.cpp
index cb117bc..01c6c67 100644
--- a/Source/WebCore/platform/efl/FileSystemEfl.cpp
+++ b/Source/WebCore/platform/efl/FileSystemEfl.cpp
@@ -67,7 +67,7 @@ CString fileSystemRepresentation(const String& path)
 #endif
 }
 
-CString openTemporaryFile(const char* prefix, PlatformFileHandle& handle)
+String openTemporaryFile(const String& prefix, PlatformFileHandle& handle)
 {
     char buffer[PATH_MAX];
     const char* tmpDir = getenv("TMPDIR");
@@ -75,18 +75,18 @@ CString openTemporaryFile(const char* prefix, PlatformFileHandle& handle)
     if (!tmpDir)
         tmpDir = "/tmp";
 
-    if (snprintf(buffer, PATH_MAX, "%s/%sXXXXXX", tmpDir, prefix) >= PATH_MAX)
+    if (snprintf(buffer, PATH_MAX, "%s/%sXXXXXX", tmpDir, prefix.utf8().data()) >= PATH_MAX)
         goto end;
 
     handle = mkstemp(buffer);
     if (handle < 0)
         goto end;
 
-    return CString(buffer);
+    return String::fromUTF8(buffer);
 
 end:
     handle = invalidPlatformFileHandle;
-    return CString();
+    return String();
 }
 
 bool unloadModule(PlatformModule module)
diff --git a/Source/WebCore/platform/efl/GeolocationServiceEfl.cpp b/Source/WebCore/platform/efl/GeolocationServiceEfl.cpp
new file mode 100644
index 0000000..0c0e744
--- /dev/null
+++ b/Source/WebCore/platform/efl/GeolocationServiceEfl.cpp
@@ -0,0 +1,80 @@
+/*
+ * Copyright (C) 2008 Holger Hans Peter Freyther
+ * Copyright (C) 2011 Samsung Electronics
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#include "config.h"
+#include "GeolocationServiceEfl.h"
+
+#if ENABLE(GEOLOCATION)
+#include "NotImplemented.h"
+#include "PositionOptions.h"
+#include <wtf/text/CString.h>
+
+namespace WebCore {
+
+GeolocationService::FactoryFunction* GeolocationService::s_factoryFunction = &GeolocationServiceEfl::create;
+
+GeolocationService* GeolocationServiceEfl::create(GeolocationServiceClient* client)
+{
+    return new GeolocationServiceEfl(client);
+}
+
+GeolocationServiceEfl::GeolocationServiceEfl(GeolocationServiceClient* client)
+    : GeolocationService(client)
+{
+}
+
+GeolocationServiceEfl::~GeolocationServiceEfl()
+{
+    notImplemented();
+}
+
+bool GeolocationServiceEfl::startUpdating(PositionOptions* options)
+{
+    notImplemented();
+    return false;
+}
+
+void GeolocationServiceEfl::stopUpdating()
+{
+    notImplemented();
+}
+
+void GeolocationServiceEfl::suspend()
+{
+    notImplemented();
+}
+
+void GeolocationServiceEfl::resume()
+{
+    notImplemented();
+}
+
+Geoposition* GeolocationServiceEfl::lastPosition() const
+{
+    return m_lastPosition.get();
+}
+
+PositionError* GeolocationServiceEfl::lastError() const
+{
+    return m_lastError.get();
+}
+
+}
+#endif // ENABLE(GEOLOCATION)
diff --git a/Source/WebCore/platform/efl/GeolocationServiceEfl.h b/Source/WebCore/platform/efl/GeolocationServiceEfl.h
new file mode 100644
index 0000000..e7ac66c
--- /dev/null
+++ b/Source/WebCore/platform/efl/GeolocationServiceEfl.h
@@ -0,0 +1,56 @@
+/*
+ * Copyright (C) 2008 Holger Hans Peter Freyther
+ * Copyright (C) 2011 Samsung Electronics
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#ifndef GeolocationServiceEfl_h
+#define GeolocationServiceEfl_h
+
+#if ENABLE(GEOLOCATION)
+#include "GeolocationService.h"
+#include "Geoposition.h"
+#include "PositionError.h"
+#include "RefPtr.h"
+
+namespace WebCore {
+
+class GeolocationServiceEfl : public GeolocationService {
+public:
+    static GeolocationService* create(GeolocationServiceClient*);
+    ~GeolocationServiceEfl();
+
+    virtual bool startUpdating(PositionOptions*);
+    virtual void stopUpdating();
+
+    virtual void suspend();
+    virtual void resume();
+
+    virtual Geoposition* lastPosition() const;
+    virtual PositionError* lastError() const;
+
+private:
+    GeolocationServiceEfl(GeolocationServiceClient*);
+
+    RefPtr<Geoposition> m_lastPosition;
+    RefPtr<PositionError> m_lastError;
+
+};
+
+}
+#endif // ENABLE(GEOLOCATION)
+#endif
diff --git a/Source/WebCore/platform/efl/LocalizedStringsEfl.cpp b/Source/WebCore/platform/efl/LocalizedStringsEfl.cpp
index 7e852f4..36a9f01 100644
--- a/Source/WebCore/platform/efl/LocalizedStringsEfl.cpp
+++ b/Source/WebCore/platform/efl/LocalizedStringsEfl.cpp
@@ -241,7 +241,7 @@ String contextMenuItemTagSearchWeb()
     return String::fromUTF8("Search the Web");
 }
 
-String contextMenuItemTagLookUpInDictionary()
+String contextMenuItemTagLookUpInDictionary(const String&)
 {
     return String::fromUTF8("Look Up in Dictionary");
 }
diff --git a/Source/WebCore/platform/efl/PlatformKeyboardEventEfl.cpp b/Source/WebCore/platform/efl/PlatformKeyboardEventEfl.cpp
index 2888b22..10121df 100644
--- a/Source/WebCore/platform/efl/PlatformKeyboardEventEfl.cpp
+++ b/Source/WebCore/platform/efl/PlatformKeyboardEventEfl.cpp
@@ -188,15 +188,15 @@ static int windowsKeyCodeForEvasKeyName(String& keyName)
     return 0;
 }
 
-PlatformKeyboardEvent::PlatformKeyboardEvent(const Evas_Event_Key_Down* ev)
+PlatformKeyboardEvent::PlatformKeyboardEvent(const Evas_Event_Key_Down* event)
     : m_type(KeyDown)
-    , m_text(String::fromUTF8(ev->string))
-    , m_shiftKey(evas_key_modifier_is_set(ev->modifiers, "Shift"))
-    , m_ctrlKey(evas_key_modifier_is_set(ev->modifiers, "Control"))
-    , m_altKey(evas_key_modifier_is_set(ev->modifiers, "Alt"))
-    , m_metaKey(evas_key_modifier_is_set(ev->modifiers, "Meta"))
+    , m_text(String::fromUTF8(event->string))
+    , m_shiftKey(evas_key_modifier_is_set(event->modifiers, "Shift"))
+    , m_ctrlKey(evas_key_modifier_is_set(event->modifiers, "Control"))
+    , m_altKey(evas_key_modifier_is_set(event->modifiers, "Alt"))
+    , m_metaKey(evas_key_modifier_is_set(event->modifiers, "Meta"))
 {
-    String keyName = String(ev->key);
+    String keyName = String(event->key);
     m_keyIdentifier = keyIdentifierForEvasKeyName(keyName);
     m_windowsVirtualKeyCode = windowsKeyCodeForEvasKeyName(keyName);
 
@@ -205,15 +205,15 @@ PlatformKeyboardEvent::PlatformKeyboardEvent(const Evas_Event_Key_Down* ev)
     m_autoRepeat = false;
 }
 
-PlatformKeyboardEvent::PlatformKeyboardEvent(const Evas_Event_Key_Up* ev)
+PlatformKeyboardEvent::PlatformKeyboardEvent(const Evas_Event_Key_Up* event)
     : m_type(KeyUp)
-    , m_text(String::fromUTF8(ev->string))
-    , m_shiftKey(evas_key_modifier_is_set(ev->modifiers, "Shift"))
-    , m_ctrlKey(evas_key_modifier_is_set(ev->modifiers, "Control"))
-    , m_altKey(evas_key_modifier_is_set(ev->modifiers, "Alt"))
-    , m_metaKey(evas_key_modifier_is_set(ev->modifiers, "Meta"))
+    , m_text(String::fromUTF8(event->string))
+    , m_shiftKey(evas_key_modifier_is_set(event->modifiers, "Shift"))
+    , m_ctrlKey(evas_key_modifier_is_set(event->modifiers, "Control"))
+    , m_altKey(evas_key_modifier_is_set(event->modifiers, "Alt"))
+    , m_metaKey(evas_key_modifier_is_set(event->modifiers, "Meta"))
 {
-    String keyName = String(ev->key);
+    String keyName = String(event->key);
     m_keyIdentifier = keyIdentifierForEvasKeyName(keyName);
     m_windowsVirtualKeyCode = windowsKeyCodeForEvasKeyName(keyName);
 
diff --git a/Source/WebCore/platform/efl/PlatformMouseEventEfl.cpp b/Source/WebCore/platform/efl/PlatformMouseEventEfl.cpp
index 53de522..172b493 100644
--- a/Source/WebCore/platform/efl/PlatformMouseEventEfl.cpp
+++ b/Source/WebCore/platform/efl/PlatformMouseEventEfl.cpp
@@ -47,44 +47,44 @@ void PlatformMouseEvent::setClickCount(unsigned int flags)
         m_clickCount = 1;
 }
 
-PlatformMouseEvent::PlatformMouseEvent(const Evas_Event_Mouse_Down* ev, IntPoint pos)
-    : m_position(IntPoint(ev->canvas.x - pos.x(), ev->canvas.y - pos.y()))
-    , m_globalPosition(IntPoint(ev->canvas.x, ev->canvas.y))
-    , m_button(MouseButton(ev->button - 1))
+PlatformMouseEvent::PlatformMouseEvent(const Evas_Event_Mouse_Down* event, IntPoint position)
+    : m_position(IntPoint(event->canvas.x - position.x(), event->canvas.y - position.y()))
+    , m_globalPosition(IntPoint(event->canvas.x, event->canvas.y))
+    , m_button(MouseButton(event->button - 1))
     , m_eventType(MouseEventPressed)
-    , m_shiftKey(evas_key_modifier_is_set(ev->modifiers, "Shift"))
-    , m_ctrlKey(evas_key_modifier_is_set(ev->modifiers, "Control"))
-    , m_altKey(evas_key_modifier_is_set(ev->modifiers, "Alt"))
-    , m_metaKey(evas_key_modifier_is_set(ev->modifiers, "Meta"))
+    , m_shiftKey(evas_key_modifier_is_set(event->modifiers, "Shift"))
+    , m_ctrlKey(evas_key_modifier_is_set(event->modifiers, "Control"))
+    , m_altKey(evas_key_modifier_is_set(event->modifiers, "Alt"))
+    , m_metaKey(evas_key_modifier_is_set(event->modifiers, "Meta"))
     , m_timestamp(currentTime())
 {
-    setClickCount(ev->flags);
+    setClickCount(event->flags);
 }
 
-PlatformMouseEvent::PlatformMouseEvent(const Evas_Event_Mouse_Up* ev, IntPoint pos)
-    : m_position(IntPoint(ev->canvas.x - pos.x(), ev->canvas.y - pos.y()))
-    , m_globalPosition(IntPoint(ev->canvas.x, ev->canvas.y))
-    , m_button(MouseButton(ev->button - 1))
+PlatformMouseEvent::PlatformMouseEvent(const Evas_Event_Mouse_Up* event, IntPoint position)
+    : m_position(IntPoint(event->canvas.x - position.x(), event->canvas.y - position.y()))
+    , m_globalPosition(IntPoint(event->canvas.x, event->canvas.y))
+    , m_button(MouseButton(event->button - 1))
     , m_eventType(MouseEventReleased)
-    , m_shiftKey(evas_key_modifier_is_set(ev->modifiers, "Shift"))
-    , m_ctrlKey(evas_key_modifier_is_set(ev->modifiers, "Control"))
-    , m_altKey(evas_key_modifier_is_set(ev->modifiers, "Alt"))
-    , m_metaKey(evas_key_modifier_is_set(ev->modifiers, "Meta"))
+    , m_shiftKey(evas_key_modifier_is_set(event->modifiers, "Shift"))
+    , m_ctrlKey(evas_key_modifier_is_set(event->modifiers, "Control"))
+    , m_altKey(evas_key_modifier_is_set(event->modifiers, "Alt"))
+    , m_metaKey(evas_key_modifier_is_set(event->modifiers, "Meta"))
     , m_timestamp(currentTime())
 {
-    setClickCount(ev->flags);
+    setClickCount(event->flags);
 }
 
-PlatformMouseEvent::PlatformMouseEvent(const Evas_Event_Mouse_Move* ev, IntPoint pos)
-    : m_position(IntPoint(ev->cur.canvas.x - pos.x(), ev->cur.canvas.y - pos.y()))
-    , m_globalPosition(IntPoint(ev->cur.canvas.x, ev->cur.canvas.y))
-    , m_button(MouseButton(ev->buttons - 1))
+PlatformMouseEvent::PlatformMouseEvent(const Evas_Event_Mouse_Move* event, IntPoint position)
+    : m_position(IntPoint(event->cur.canvas.x - position.x(), event->cur.canvas.y - position.y()))
+    , m_globalPosition(IntPoint(event->cur.canvas.x, event->cur.canvas.y))
+    , m_button(MouseButton(event->buttons - 1))
     , m_eventType(MouseEventMoved)
     , m_clickCount(0)
-    , m_shiftKey(evas_key_modifier_is_set(ev->modifiers, "Shift"))
-    , m_ctrlKey(evas_key_modifier_is_set(ev->modifiers, "Control"))
-    , m_altKey(evas_key_modifier_is_set(ev->modifiers, "Alt"))
-    , m_metaKey(evas_key_modifier_is_set(ev->modifiers, "Meta"))
+    , m_shiftKey(evas_key_modifier_is_set(event->modifiers, "Shift"))
+    , m_ctrlKey(evas_key_modifier_is_set(event->modifiers, "Control"))
+    , m_altKey(evas_key_modifier_is_set(event->modifiers, "Alt"))
+    , m_metaKey(evas_key_modifier_is_set(event->modifiers, "Meta"))
     , m_timestamp(currentTime())
 {
 }
diff --git a/Source/WebCore/platform/efl/RenderThemeEfl.cpp b/Source/WebCore/platform/efl/RenderThemeEfl.cpp
index 3e8a646..439e377 100644
--- a/Source/WebCore/platform/efl/RenderThemeEfl.cpp
+++ b/Source/WebCore/platform/efl/RenderThemeEfl.cpp
@@ -38,11 +38,21 @@
 #include "RenderObject.h"
 #include "RenderProgress.h"
 #include "RenderSlider.h"
+#include "UserAgentStyleSheets.h"
 #include <wtf/text/CString.h>
 
 #include <Ecore_Evas.h>
 #include <Edje.h>
+
+#if ENABLE(VIDEO)
+#include "HTMLMediaElement.h"
+#include "HTMLNames.h"
+#endif
+
 namespace WebCore {
+#if ENABLE(VIDEO)
+using namespace HTMLNames;
+#endif
 
 // TODO: change from object count to ecore_evas size (bytes)
 // TODO: as objects are webpage/user defined and they can be very large.
@@ -273,7 +283,7 @@ bool RenderThemeEfl::paintThemePart(RenderObject* object, FormType type, const P
 
     applyEdjeStateFromForm(entry->o, controlStatesForRenderer(object));
 
-    cairo = info.context->platformContext();
+    cairo = info.context->platformContext()->cr();
     ASSERT(cairo);
 
     // Currently, only sliders needs this message; if other widget ever needs special
@@ -592,6 +602,10 @@ const char* RenderThemeEfl::edjeGroupFromFormType(FormType type) const
         W("search/cancel_button"),
         W("slider/vertical"),
         W("slider/horizontal"),
+#if ENABLE(VIDEO)
+        W("mediacontrol/playpause_button"),
+        W("mediacontrol/mute_button"),
+#endif
 #undef W
         0
     };
@@ -1044,10 +1058,32 @@ bool RenderThemeEfl::paintProgressBar(RenderObject* object, const PaintInfo& inf
 #endif
 
 #if ENABLE(VIDEO)
+bool RenderThemeEfl::emitMediaButtonSignal(FormType formType, MediaControlElementType mediaElementType, const IntRect& rect)
+{
+    ThemePartCacheEntry* entry;
+
+    entry = cacheThemePartGet(formType, rect.size());
+    ASSERT(entry);
+    if (!entry)
+        return false;
+
+    if (mediaElementType == MediaPlayButton)
+        edje_object_signal_emit(entry->o, "play", "");
+    else if (mediaElementType == MediaPauseButton)
+        edje_object_signal_emit(entry->o, "pause", "");
+    else if (mediaElementType == MediaMuteButton)
+        edje_object_signal_emit(entry->o, "mute", "");
+    else if (mediaElementType == MediaUnMuteButton)
+        edje_object_signal_emit(entry->o, "sound", "");
+    else 
+        return false;
+
+    return true;
+}
+
 String RenderThemeEfl::extraMediaControlsStyleSheet()
 {
-    notImplemented();
-    return String();
+    return String(mediaControlsEflUserAgentStyleSheet, sizeof(mediaControlsEflUserAgentStyleSheet));
 }
 
 String RenderThemeEfl::formatMediaControlsCurrentTime(float currentTime, float duration) const
@@ -1064,14 +1100,29 @@ bool RenderThemeEfl::paintMediaFullscreenButton(RenderObject* object, const Pain
 
 bool RenderThemeEfl::paintMediaMuteButton(RenderObject* object, const PaintInfo& info, const IntRect& rect)
 {
-    notImplemented();
-    return false;
+    Node* mediaNode = object->node() ? object->node()->shadowAncestorNode() : 0;
+    if (!mediaNode || (!mediaNode->hasTagName(videoTag) && !mediaNode->hasTagName(audioTag)))
+        return false;
+
+    HTMLMediaElement* mediaElement = static_cast<HTMLMediaElement*>(mediaNode);
+
+    if (!emitMediaButtonSignal(MediaMuteUnMuteButton, mediaElement->muted() ? MediaMuteButton : MediaUnMuteButton, rect))
+        return false;
+
+    return paintThemePart(object, MediaMuteUnMuteButton, info, rect);
 }
 
 bool RenderThemeEfl::paintMediaPlayButton(RenderObject* object, const PaintInfo& info, const IntRect& rect)
 {
-    notImplemented();
-    return false;
+    Node* node = object->node();
+    if (!node)
+        return false;
+
+    MediaControlPlayButtonElement* button = static_cast<MediaControlPlayButtonElement*>(node);
+    if (!emitMediaButtonSignal(MediaPlayPauseButton, button->displayType(), rect))
+        return false;
+
+    return paintThemePart(object, MediaPlayPauseButton, info, rect);
 }
 
 bool RenderThemeEfl::paintMediaSeekBackButton(RenderObject* object, const PaintInfo& info, const IntRect& rect)
diff --git a/Source/WebCore/platform/efl/RenderThemeEfl.h b/Source/WebCore/platform/efl/RenderThemeEfl.h
index 9970096..fe8e2d2 100644
--- a/Source/WebCore/platform/efl/RenderThemeEfl.h
+++ b/Source/WebCore/platform/efl/RenderThemeEfl.h
@@ -30,6 +30,9 @@
 #ifndef RenderThemeEfl_h
 #define RenderThemeEfl_h
 
+#if ENABLE(VIDEO)
+#include "MediaControlElements.h"
+#endif
 #include "RenderTheme.h"
 
 #include <cairo.h>
@@ -55,6 +58,10 @@ enum FormType { // KEEP IN SYNC WITH edjeGroupFromFormType()
     SearchFieldCancelButton,
     SliderVertical,
     SliderHorizontal,
+#if ENABLE(VIDEO)
+    MediaPlayPauseButton,
+    MediaMuteUnMuteButton,
+#endif
     FormTypeLast
 };
 
@@ -182,6 +189,10 @@ private:
     void applyEdjeStateFromForm(Evas_Object*, ControlStates);
     bool paintThemePart(RenderObject*, FormType, const PaintInfo&, const IntRect&);
 
+#if ENABLE(VIDEO)
+    bool emitMediaButtonSignal(FormType, MediaControlElementType, const IntRect&);
+#endif
+
     Page* m_page;
     Color m_activeSelectionBackgroundColor;
     Color m_activeSelectionForegroundColor;
diff --git a/Source/WebCore/platform/efl/ScrollbarEfl.cpp b/Source/WebCore/platform/efl/ScrollbarEfl.cpp
index e71d1e3..162c2a1 100644
--- a/Source/WebCore/platform/efl/ScrollbarEfl.cpp
+++ b/Source/WebCore/platform/efl/ScrollbarEfl.cpp
@@ -64,50 +64,50 @@ ScrollbarEfl::~ScrollbarEfl()
     setEvasObject(0);
 }
 
-static void scrollbarEflEdjeMessage(void* data, Evas_Object* o, Edje_Message_Type type, int id, void* msg)
+static void scrollbarEflEdjeMessage(void* data, Evas_Object* object, Edje_Message_Type messageType, int id, void* message)
 {
     ScrollbarEfl* that = static_cast<ScrollbarEfl*>(data);
-    Edje_Message_Float* m;
-    int v;
+    Edje_Message_Float* messageFloat;
+    int value;
 
     if (!id) {
         EINA_LOG_ERR("Unknown message id '%d' from scroll bar theme.", id);
         return;
     }
 
-    if (type != EDJE_MESSAGE_FLOAT) {
+    if (messageType != EDJE_MESSAGE_FLOAT) {
         EINA_LOG_ERR("Message id '%d' of incorrect type from scroll bar theme. "
                      "Expected '%d', got '%d'.",
-                     id, EDJE_MESSAGE_FLOAT, type);
+                     id, EDJE_MESSAGE_FLOAT, messageType);
         return;
     }
 
-    m = static_cast<Edje_Message_Float*>(msg);
-    v = m->val * (that->totalSize() - that->visibleSize());
-    that->scrollableArea()->scrollToOffsetWithoutAnimation(that->orientation(), v);
+    messageFloat = static_cast<Edje_Message_Float*>(message);
+    value = messageFloat->val * (that->totalSize() - that->visibleSize());
+    that->scrollableArea()->scrollToOffsetWithoutAnimation(that->orientation(), value);
 }
 
 void ScrollbarEfl::setParent(ScrollView* view)
 {
-    Evas_Object* o = evasObject();
+    Evas_Object* object = evasObject();
     Evas_Coord w, h;
 
     Widget::setParent(view);
 
-    if (!o) {
+    if (!object) {
         if (!view)
             return;
 
-        o = edje_object_add(view->evas());
-        if (!o) {
+        object = edje_object_add(view->evas());
+        if (!object) {
             EINA_LOG_ERR("Could not create edje object for view=%p (evas=%p)",
                          view, view->evas());
             return;
         }
-        edje_object_message_handler_set(o, scrollbarEflEdjeMessage, this);
-        setEvasObject(o);
+        edje_object_message_handler_set(object, scrollbarEflEdjeMessage, this);
+        setEvasObject(object);
     } else if (!view) {
-        evas_object_hide(o);
+        evas_object_hide(object);
         return;
     }
 
@@ -117,23 +117,23 @@ void ScrollbarEfl::setParent(ScrollView* view)
 
     if (theme.isEmpty()) {
         EINA_LOG_ERR("Could not load theme '%s': no theme path set.", group);
-        evas_object_hide(o);
+        evas_object_hide(object);
         return;
     }
 
-    if (!edje_object_file_set(o, theme.utf8().data(), group)) {
-        Edje_Load_Error err = edje_object_load_error_get(o);
-        const char* errmsg = edje_load_error_str(err);
+    if (!edje_object_file_set(object, theme.utf8().data(), group)) {
+        Edje_Load_Error err = edje_object_load_error_get(object);
+        const char* errmessage = edje_load_error_str(err);
         EINA_LOG_ERR("Could not load theme '%s' from file '%s': #%d '%s'",
-                     group, theme.utf8().data(), err, errmsg);
+                     group, theme.utf8().data(), err, errmessage);
         return;
     }
 
-    setPlatformWidget(o);
-    evas_object_smart_member_add(o, view->evasObject());
-    evas_object_show(o);
+    setPlatformWidget(object);
+    evas_object_smart_member_add(object, view->evasObject());
+    evas_object_show(object);
 
-    edje_object_size_min_get(o, &w, &h);
+    edje_object_size_min_get(object, &w, &h);
 
     IntRect rect = frameRect();
     rect.setSize(IntSize(w, h));
@@ -168,21 +168,21 @@ void ScrollbarEfl::updateThumbPositionAndProportion()
     m_lastTotalSize = tSize;
     m_lastVisibleSize = vSize;
 
-    Edje_Message_Float_Set* msg = static_cast<Edje_Message_Float_Set*>
+    Edje_Message_Float_Set* message = static_cast<Edje_Message_Float_Set*>
         (alloca(sizeof(Edje_Message_Float_Set) + sizeof(float)));
-    msg->count = 2;
+    message->count = 2;
 
     if (tSize - vSize > 0)
-        msg->val[0] = pos / (float)(tSize - vSize);
+        message->val[0] = pos / static_cast<float>(tSize - vSize);
     else
-        msg->val[0] = 0.0;
+        message->val[0] = 0.0;
 
     if (tSize > 0)
-        msg->val[1] = vSize / (float)tSize;
+        message->val[1] = vSize / static_cast<float>(tSize);
     else
-        msg->val[1] = 0.0;
+        message->val[1] = 0.0;
 
-    edje_object_message_send(platformWidget(), EDJE_MESSAGE_FLOAT_SET, 0, msg);
+    edje_object_message_send(platformWidget(), EDJE_MESSAGE_FLOAT_SET, 0, message);
 }
 
 void ScrollbarEfl::setFrameRect(const IntRect& rect)
@@ -193,10 +193,10 @@ void ScrollbarEfl::setFrameRect(const IntRect& rect)
 
 void ScrollbarEfl::frameRectsChanged()
 {
-    Evas_Object* o = platformWidget();
+    Evas_Object* object = platformWidget();
     Evas_Coord x, y;
 
-    if (!parent() || !o)
+    if (!parent() || !object)
         return;
 
     IntRect rect = frameRect();
@@ -206,11 +206,11 @@ void ScrollbarEfl::frameRectsChanged()
         rect.setLocation(parent()->contentsToWindow(rect.location()));
 
     evas_object_geometry_get(root()->evasObject(), &x, &y, 0, 0);
-    evas_object_move(o, x + rect.x(), y + rect.y());
-    evas_object_resize(o, rect.width(), rect.height());
+    evas_object_move(object, x + rect.x(), y + rect.y());
+    evas_object_resize(object, rect.width(), rect.height());
 }
 
-void ScrollbarEfl::paint(GraphicsContext* context, const IntRect& rect)
+void ScrollbarEfl::paint(GraphicsContext* graphicsContext, const IntRect& damageRect)
 {
 }
 
diff --git a/Source/WebCore/platform/efl/ScrollbarEfl.h b/Source/WebCore/platform/efl/ScrollbarEfl.h
index 09dc64f..1f67d2f 100644
--- a/Source/WebCore/platform/efl/ScrollbarEfl.h
+++ b/Source/WebCore/platform/efl/ScrollbarEfl.h
@@ -49,7 +49,7 @@ public:
 
     virtual void frameRectsChanged();
 
-    virtual void paint(GraphicsContext* context, const IntRect& damageRect);
+    virtual void paint(GraphicsContext*, const IntRect&);
 
 protected:
     ScrollbarEfl(ScrollableArea*, ScrollbarOrientation, ScrollbarControlSize);
@@ -58,7 +58,7 @@ protected:
     virtual void updateThumbPosition();
     virtual void updateThumbProportion();
 
-    virtual void setParent(ScrollView* view);
+    virtual void setParent(ScrollView*);
 
 private:
     int m_lastPos;
diff --git a/Source/WebCore/platform/efl/WidgetEfl.cpp b/Source/WebCore/platform/efl/WidgetEfl.cpp
index 640e6e3..45d4792 100644
--- a/Source/WebCore/platform/efl/WidgetEfl.cpp
+++ b/Source/WebCore/platform/efl/WidgetEfl.cpp
@@ -183,10 +183,10 @@ void Widget::setFrameRect(const IntRect& rect)
 
 void Widget::frameRectsChanged()
 {
-    Evas_Object* o = evasObject();
+    Evas_Object* object = evasObject();
     Evas_Coord x, y;
 
-    if (!parent() || !o)
+    if (!parent() || !object)
         return;
 
     IntRect rect = frameRect();
@@ -196,8 +196,8 @@ void Widget::frameRectsChanged()
         rect.setLocation(parent()->contentsToWindow(rect.location()));
 
     evas_object_geometry_get(root()->evasObject(), &x, &y, 0, 0);
-    evas_object_move(o, x + rect.x(), y + rect.y());
-    evas_object_resize(o, rect.width(), rect.height());
+    evas_object_move(object, x + rect.x(), y + rect.y());
+    evas_object_resize(object, rect.width(), rect.height());
 }
 
 void Widget::setFocus(bool focused)
@@ -332,14 +332,14 @@ Ecore_Evas* Widget::ecoreEvas() const
     return static_cast<Ecore_Evas*>(evas_data_attach_get(evas()));
 }
 
-void Widget::setEvasObject(Evas_Object *o)
+void Widget::setEvasObject(Evas_Object *object)
 {
     // FIXME: study platformWidget() and use it
     // FIXME: right now platformWidget() requires implementing too much
-    if (m_data->m_evasObject == o)
+    if (m_data->m_evasObject == object)
         return;
-    m_data->m_evasObject = o;
-    if (!o) {
+    m_data->m_evasObject = object;
+    if (!object) {
         m_data->m_evas = 0;
 #ifdef HAVE_ECORE_X
         m_data->m_isUsingEcoreX = false;
@@ -347,7 +347,7 @@ void Widget::setEvasObject(Evas_Object *o)
         return;
     }
 
-    m_data->m_evas = evas_object_evas_get(o);
+    m_data->m_evas = evas_object_evas_get(object);
 
 #ifdef HAVE_ECORE_X
     const char *engine = ecore_evas_engine_name_get(ecoreEvas());
diff --git a/Source/WebCore/platform/graphics/BitmapImage.h b/Source/WebCore/platform/graphics/BitmapImage.h
index 14a3094..c8cf0ab 100644
--- a/Source/WebCore/platform/graphics/BitmapImage.h
+++ b/Source/WebCore/platform/graphics/BitmapImage.h
@@ -165,7 +165,7 @@ protected:
     enum RepetitionCountStatus {
       Unknown,    // We haven't checked the source's repetition count.
       Uncertain,  // We have a repetition count, but it might be wrong (some GIFs have a count after the image data, and will report "loop once" until all data has been decoded).
-      Certain,    // The repetition count is known to be correct.
+      Certain     // The repetition count is known to be correct.
     };
 
     BitmapImage(NativeImagePtr, ImageObserver* = 0);
diff --git a/Source/WebCore/platform/graphics/Color.cpp b/Source/WebCore/platform/graphics/Color.cpp
index a1c5cd7..7dea765 100644
--- a/Source/WebCore/platform/graphics/Color.cpp
+++ b/Source/WebCore/platform/graphics/Color.cpp
@@ -27,13 +27,12 @@
 #include "Color.h"
 
 #include "HashTools.h"
-#include "PlatformString.h"
-#include <math.h>
 #include <wtf/Assertions.h>
+#include <wtf/HexNumber.h>
 #include <wtf/MathExtras.h>
+#include <wtf/text/StringBuilder.h>
 
 using namespace std;
-using namespace WTF;
 
 namespace WebCore {
 
@@ -180,14 +179,6 @@ Color::Color(const char* name)
     }
 }
 
-static inline void appendHexNumber(UChar* destination, uint8_t number)
-{
-    static const char hexDigits[17] = "0123456789abcdef";
-
-    destination[0] = hexDigits[number >> 4];
-    destination[1] = hexDigits[number & 0xF];
-}
-
 String Color::serialized() const
 {
     DEFINE_STATIC_LOCAL(const String, commaSpace, (", "));
@@ -195,13 +186,13 @@ String Color::serialized() const
     DEFINE_STATIC_LOCAL(const String, zeroPointZero, ("0.0"));
 
     if (!hasAlpha()) {
-        UChar* characters;
-        String result = String::createUninitialized(7, characters);
-        characters[0] = '#';
-        appendHexNumber(characters + 1, red());
-        appendHexNumber(characters + 3, green());
-        appendHexNumber(characters + 5, blue());
-        return result;
+        StringBuilder builder;
+        builder.reserveCapacity(7);
+        builder.append('#');
+        appendByteAsHex(red(), builder, Lowercase);
+        appendByteAsHex(green(), builder, Lowercase);
+        appendByteAsHex(blue(), builder, Lowercase);
+        return builder.toString();
     }
 
     Vector<UChar> result;
diff --git a/Source/WebCore/platform/graphics/ContextShadow.h b/Source/WebCore/platform/graphics/ContextShadow.h
index c0571f0..850d489 100644
--- a/Source/WebCore/platform/graphics/ContextShadow.h
+++ b/Source/WebCore/platform/graphics/ContextShadow.h
@@ -32,7 +32,7 @@
 #include "Color.h"
 #include "FloatRect.h"
 #include "IntRect.h"
-#include "RefCounted.h"
+#include <wtf/RefCounted.h>
 
 #if PLATFORM(CAIRO)
 typedef struct _cairo cairo_t;
diff --git a/Source/WebCore/platform/graphics/Font.cpp b/Source/WebCore/platform/graphics/Font.cpp
index ee85e45..72e3e3b 100644
--- a/Source/WebCore/platform/graphics/Font.cpp
+++ b/Source/WebCore/platform/graphics/Font.cpp
@@ -177,7 +177,7 @@ float Font::width(const TextRun& run, HashSet<const SimpleFontData*>* fallbackFo
         // If the complex text implementation cannot return fallback fonts, avoid
         // returning them for simple text as well.
         static bool returnFallbackFonts = canReturnFallbackFontsForComplexText();
-        return floatWidthForSimpleText(run, 0, returnFallbackFonts ? fallbackFonts : 0, codePathToUse == SimpleWithGlyphOverflow ? glyphOverflow : 0);
+        return floatWidthForSimpleText(run, 0, returnFallbackFonts ? fallbackFonts : 0, codePathToUse == SimpleWithGlyphOverflow || (glyphOverflow && glyphOverflow->computeBounds) ? glyphOverflow : 0);
     }
 
     return floatWidthForComplexText(run, fallbackFonts, glyphOverflow);
diff --git a/Source/WebCore/platform/graphics/Font.h b/Source/WebCore/platform/graphics/Font.h
index ce03aed..554f8a0 100644
--- a/Source/WebCore/platform/graphics/Font.h
+++ b/Source/WebCore/platform/graphics/Font.h
@@ -61,6 +61,7 @@ struct GlyphOverflow {
         , right(0)
         , top(0)
         , bottom(0)
+        , computeBounds(false)
     {
     }
 
@@ -68,8 +69,10 @@ struct GlyphOverflow {
     int right;
     int top;
     int bottom;
+    bool computeBounds;
 };
 
+
 class Font {
 public:
     Font();
@@ -138,8 +141,6 @@ public:
     const FontData* fontDataAt(unsigned) const;
     GlyphData glyphDataForCharacter(UChar32, bool mirror, FontDataVariant = AutoVariant) const;
     bool primaryFontHasGlyphForCharacter(UChar32) const;
-    // Used for complex text, and does not utilize the glyph map cache.
-    const FontData* fontDataForCharacters(const UChar*, int length) const;
 
     static bool isCJKIdeograph(UChar32);
     static bool isCJKIdeographOrSymbol(UChar32);
@@ -255,12 +256,6 @@ inline const FontData* Font::fontDataAt(unsigned index) const
     return m_fontList->fontDataAt(this, index);
 }
 
-inline const FontData* Font::fontDataForCharacters(const UChar* characters, int length) const
-{
-    ASSERT(m_fontList);
-    return m_fontList->fontDataForCharacters(this, characters, length);
-}
-
 inline bool Font::isFixedPitch() const
 {
     ASSERT(m_fontList);
diff --git a/Source/WebCore/platform/graphics/FontCache.cpp b/Source/WebCore/platform/graphics/FontCache.cpp
index 5b508be..8c5edfe 100644
--- a/Source/WebCore/platform/graphics/FontCache.cpp
+++ b/Source/WebCore/platform/graphics/FontCache.cpp
@@ -57,7 +57,8 @@ struct FontPlatformDataCacheKey {
     WTF_MAKE_FAST_ALLOCATED;
 public:
     FontPlatformDataCacheKey(const AtomicString& family = AtomicString(), unsigned size = 0, unsigned weight = 0, bool italic = false,
-                             bool isPrinterFont = false, FontRenderingMode renderingMode = NormalRenderingMode, FontOrientation orientation = Horizontal, FontWidthVariant widthVariant = RegularWidth)
+                             bool isPrinterFont = false, FontRenderingMode renderingMode = NormalRenderingMode, FontOrientation orientation = Horizontal,
+                             TextOrientation textOrientation = TextOrientationVerticalRight, FontWidthVariant widthVariant = RegularWidth)
         : m_size(size)
         , m_weight(weight)
         , m_family(family)
@@ -65,6 +66,7 @@ public:
         , m_printerFont(isPrinterFont)
         , m_renderingMode(renderingMode)
         , m_orientation(orientation)
+        , m_textOrientation(textOrientation)
         , m_widthVariant(widthVariant)
     {
     }
@@ -76,7 +78,7 @@ public:
     {
         return equalIgnoringCase(m_family, other.m_family) && m_size == other.m_size && 
                m_weight == other.m_weight && m_italic == other.m_italic && m_printerFont == other.m_printerFont &&
-               m_renderingMode == other.m_renderingMode && m_orientation == other.m_orientation && m_widthVariant == other.m_widthVariant;
+               m_renderingMode == other.m_renderingMode && m_orientation == other.m_orientation && m_textOrientation == other.m_textOrientation && m_widthVariant == other.m_widthVariant;
     }
 
     unsigned m_size;
@@ -86,6 +88,7 @@ public:
     bool m_printerFont;
     FontRenderingMode m_renderingMode;
     FontOrientation m_orientation;
+    TextOrientation m_textOrientation;
     FontWidthVariant m_widthVariant;
 
 private:
@@ -99,9 +102,9 @@ inline unsigned computeHash(const FontPlatformDataCacheKey& fontKey)
         fontKey.m_size,
         fontKey.m_weight,
         fontKey.m_widthVariant,
-        static_cast<unsigned>(fontKey.m_orientation) << 3 | static_cast<unsigned>(fontKey.m_italic) << 2 | static_cast<unsigned>(fontKey.m_printerFont) << 1 | static_cast<unsigned>(fontKey.m_renderingMode)
+        static_cast<unsigned>(fontKey.m_textOrientation) << 4 | static_cast<unsigned>(fontKey.m_orientation) << 3 | static_cast<unsigned>(fontKey.m_italic) << 2 | static_cast<unsigned>(fontKey.m_printerFont) << 1 | static_cast<unsigned>(fontKey.m_renderingMode)
     };
-    return WTF::StringHasher::createBlobHash<sizeof(hashCodes)>(hashCodes);
+    return StringHasher::hashMemory<sizeof(hashCodes)>(hashCodes);
 }
 
 struct FontPlatformDataCacheKeyHash {
@@ -198,7 +201,8 @@ FontPlatformData* FontCache::getCachedFontPlatformData(const FontDescription& fo
     }
 
     FontPlatformDataCacheKey key(familyName, fontDescription.computedPixelSize(), fontDescription.weight(), fontDescription.italic(),
-                                 fontDescription.usePrinterFont(), fontDescription.renderingMode(), fontDescription.orientation(), fontDescription.widthVariant());
+                                 fontDescription.usePrinterFont(), fontDescription.renderingMode(), fontDescription.orientation(),
+                                 fontDescription.textOrientation(), fontDescription.widthVariant());
     FontPlatformData* result = 0;
     bool foundResult;
     FontPlatformDataCache::iterator it = gFontPlatformDataCache->find(key);
diff --git a/Source/WebCore/platform/graphics/FontDescription.h b/Source/WebCore/platform/graphics/FontDescription.h
index 283d297..5b05f14 100644
--- a/Source/WebCore/platform/graphics/FontDescription.h
+++ b/Source/WebCore/platform/graphics/FontDescription.h
@@ -31,6 +31,7 @@
 #include "FontSmoothingMode.h"
 #include "FontTraitsMask.h"
 #include "FontWidthVariant.h"
+#include "TextOrientation.h"
 #include "TextRenderingMode.h"
 
 namespace WebCore {
@@ -58,6 +59,7 @@ public:
         : m_specifiedSize(0)
         , m_computedSize(0)
         , m_orientation(Horizontal)
+        , m_textOrientation(TextOrientationVerticalRight)
         , m_widthVariant(RegularWidth)
         , m_italic(false)
         , m_smallCaps(false)
@@ -99,6 +101,7 @@ public:
     FontTraitsMask traitsMask() const;
     bool isSpecifiedFont() const { return m_isSpecifiedFont; }
     FontOrientation orientation() const { return m_orientation; }
+    TextOrientation textOrientation() const { return m_textOrientation; }
     FontWidthVariant widthVariant() const { return m_widthVariant; }
 
     void setFamily(const FontFamily& family) { m_familyList = family; }
@@ -120,6 +123,7 @@ public:
     void setTextRenderingMode(TextRenderingMode rendering) { m_textRendering = rendering; }
     void setIsSpecifiedFont(bool isSpecifiedFont) { m_isSpecifiedFont = isSpecifiedFont; }
     void setOrientation(FontOrientation orientation) { m_orientation = orientation; }
+    void setTextOrientation(TextOrientation textOrientation) { m_textOrientation = textOrientation; }
     void setWidthVariant(FontWidthVariant widthVariant) { m_widthVariant = widthVariant; }
 
 private:
@@ -129,8 +133,9 @@ private:
                              // rounding, minimum font sizes, and zooming.
     float m_computedSize;    // Computed size adjusted for the minimum font size and the zoom factor.  
 
-    FontOrientation m_orientation;
-    
+    FontOrientation m_orientation; // Whether the font is rendering on a horizontal line or a vertical line.
+    TextOrientation m_textOrientation; // Only used by vertical text. Determines the default orientation for non-ideograph glyphs.
+
     FontWidthVariant m_widthVariant;
 
     bool m_italic : 1;
@@ -169,6 +174,7 @@ inline bool FontDescription::operator==(const FontDescription& other) const
         && m_textRendering == other.m_textRendering
         && m_isSpecifiedFont == other.m_isSpecifiedFont
         && m_orientation == other.m_orientation
+        && m_textOrientation == other.m_textOrientation
         && m_widthVariant == other.m_widthVariant;
 }
 
diff --git a/Source/WebCore/platform/graphics/FontFallbackList.cpp b/Source/WebCore/platform/graphics/FontFallbackList.cpp
index 649c117..7df58d9 100644
--- a/Source/WebCore/platform/graphics/FontFallbackList.cpp
+++ b/Source/WebCore/platform/graphics/FontFallbackList.cpp
@@ -111,23 +111,6 @@ const FontData* FontFallbackList::fontDataAt(const Font* font, unsigned realized
     return result;
 }
 
-const FontData* FontFallbackList::fontDataForCharacters(const Font* font, const UChar* characters, int length) const
-{
-    // This method is only called when the primary font does not contain the characters we need.
-    // Begin our search at position 1.
-    unsigned realizedFontIndex = 1;
-    const FontData* fontData = fontDataAt(font, realizedFontIndex);
-    while (fontData && !fontData->containsCharacters(characters, length))
-        fontData = fontDataAt(font, ++realizedFontIndex);
-    
-    if (!fontData) {
-        ASSERT(fontCache()->generation() == m_generation);
-        fontData = fontCache()->getFontDataForCharacters(*font, characters, length);
-    }
-
-    return fontData;
-}
-
 void FontFallbackList::setPlatformFont(const FontPlatformData& platformData)
 {
     m_familyIndex = cAllFamiliesScanned;
diff --git a/Source/WebCore/platform/graphics/FontFallbackList.h b/Source/WebCore/platform/graphics/FontFallbackList.h
index a10f5af..e18477c 100644
--- a/Source/WebCore/platform/graphics/FontFallbackList.h
+++ b/Source/WebCore/platform/graphics/FontFallbackList.h
@@ -65,8 +65,7 @@ private:
 
     const FontData* primaryFontData(const Font* f) const { return fontDataAt(f, 0); }
     const FontData* fontDataAt(const Font*, unsigned index) const;
-    const FontData* fontDataForCharacters(const Font*, const UChar*, int length) const;
-    
+
     void setPlatformFont(const FontPlatformData&);
 
     void releaseFontData();
diff --git a/Source/WebCore/platform/graphics/FontFastPath.cpp b/Source/WebCore/platform/graphics/FontFastPath.cpp
index e62df61..b741ca0 100644
--- a/Source/WebCore/platform/graphics/FontFastPath.cpp
+++ b/Source/WebCore/platform/graphics/FontFastPath.cpp
@@ -77,17 +77,57 @@ GlyphData Font::glyphDataForCharacter(UChar32 c, bool mirror, FontDataVariant va
             page = node->page();
             if (page) {
                 GlyphData data = page->glyphDataForCharacter(c);
+                if (data.fontData && (data.fontData->platformData().orientation() == Horizontal || data.fontData->isTextOrientationFallback()))
+                    return data;
+                
                 if (data.fontData) {
-                    if (data.fontData->platformData().orientation() == Vertical && data.fontData->orientation() == Horizontal && Font::isCJKIdeographOrSymbol(c)) {
-                        const SimpleFontData* ideographFontData = data.fontData->brokenIdeographFontData();
-                        GlyphPageTreeNode* ideographNode = GlyphPageTreeNode::getRootChild(ideographFontData, pageNumber);
-                        const GlyphPage* ideographPage = ideographNode->page();
-                        if (ideographPage) {
-                            GlyphData data = ideographPage->glyphDataForCharacter(c);
-                            if (data.fontData)
-                                return data;
+                    if (isCJKIdeographOrSymbol(c)) {
+                        if (!data.fontData->hasVerticalGlyphs()) {
+                            // Use the broken ideograph font data. The broken ideograph font will use the horizontal width of glyphs
+                            // to make sure you get a square (even for broken glyphs like symbols used for punctuation).
+                            const SimpleFontData* brokenIdeographFontData = data.fontData->brokenIdeographFontData();
+                            GlyphPageTreeNode* brokenIdeographNode = GlyphPageTreeNode::getRootChild(brokenIdeographFontData, pageNumber);
+                            const GlyphPage* brokenIdeographPage = brokenIdeographNode->page();
+                            if (brokenIdeographPage) {
+                                GlyphData brokenIdeographData = brokenIdeographPage->glyphDataForCharacter(c);
+                                if (brokenIdeographData.fontData)
+                                    return brokenIdeographData;
+                            }
+                            
+                            // Shouldn't be possible to even reach this point.
+                            ASSERT_NOT_REACHED();
+                        }
+                    } else {
+                        if (m_fontDescription.textOrientation() == TextOrientationVerticalRight) {
+                            const SimpleFontData* verticalRightFontData = data.fontData->verticalRightOrientationFontData();
+                            GlyphPageTreeNode* verticalRightNode = GlyphPageTreeNode::getRootChild(verticalRightFontData, pageNumber);
+                            const GlyphPage* verticalRightPage = verticalRightNode->page();
+                            if (verticalRightPage) {
+                                GlyphData verticalRightData = verticalRightPage->glyphDataForCharacter(c);
+                                // If the glyphs are distinct, we will make the assumption that the font has a vertical-right glyph baked
+                                // into it.
+                                if (data.glyph != verticalRightData.glyph)
+                                    return data;
+                                // The glyphs are identical, meaning that we should just use the horizontal glyph.
+                                if (verticalRightData.fontData)
+                                    return verticalRightData;
+                            }
+                        } else if (m_fontDescription.textOrientation() == TextOrientationUpright) {
+                            const SimpleFontData* uprightFontData = data.fontData->uprightOrientationFontData();
+                            GlyphPageTreeNode* uprightNode = GlyphPageTreeNode::getRootChild(uprightFontData, pageNumber);
+                            const GlyphPage* uprightPage = uprightNode->page();
+                            if (uprightPage) {
+                                GlyphData uprightData = uprightPage->glyphDataForCharacter(c);
+                                // If the glyphs are the same, then we know we can just use the horizontal glyph rotated vertically to be upright.
+                                if (data.glyph == uprightData.glyph)
+                                    return data;
+                                // The glyphs are distinct, meaning that the font has a vertical-right glyph baked into it. We can't use that
+                                // glyph, so we fall back to the upright data and use the horizontal glyph.
+                                if (uprightData.fontData)
+                                    return uprightData;
+                            }
                         }
-                        
+
                         // Shouldn't be possible to even reach this point.
                         ASSERT_NOT_REACHED();
                     }
@@ -364,7 +404,7 @@ void Font::drawGlyphBuffer(GraphicsContext* context, const GlyphBuffer& glyphBuf
 
 inline static float offsetToMiddleOfGlyph(const SimpleFontData* fontData, Glyph glyph)
 {
-    if (fontData->orientation() == Horizontal) {
+    if (fontData->platformData().orientation() == Horizontal) {
         FloatRect bounds = fontData->boundsForGlyph(glyph);
         return bounds.x() + bounds.width() / 2;
     }
@@ -412,8 +452,8 @@ float Font::floatWidthForSimpleText(const TextRun& run, GlyphBuffer* glyphBuffer
     it.advance(run.length(), glyphBuffer);
 
     if (glyphOverflow) {
-        glyphOverflow->top = max<int>(glyphOverflow->top, ceilf(-it.minGlyphBoundingBoxY()) - fontMetrics().ascent());
-        glyphOverflow->bottom = max<int>(glyphOverflow->bottom, ceilf(it.maxGlyphBoundingBoxY()) - fontMetrics().descent());
+        glyphOverflow->top = max<int>(glyphOverflow->top, ceilf(-it.minGlyphBoundingBoxY()) - (glyphOverflow->computeBounds ? 0 : fontMetrics().ascent()));
+        glyphOverflow->bottom = max<int>(glyphOverflow->bottom, ceilf(it.maxGlyphBoundingBoxY()) - (glyphOverflow->computeBounds ? 0 : fontMetrics().descent()));
         glyphOverflow->left = ceilf(it.firstGlyphOverflow());
         glyphOverflow->right = ceilf(it.lastGlyphOverflow());
     }
diff --git a/Source/WebCore/platform/graphics/FontPlatformData.cpp b/Source/WebCore/platform/graphics/FontPlatformData.cpp
new file mode 100644
index 0000000..5a61cdf
--- /dev/null
+++ b/Source/WebCore/platform/graphics/FontPlatformData.cpp
@@ -0,0 +1,63 @@
+/*
+ * Copyright (C) 2011 Brent Fulgham
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ *
+ */
+
+#include "config.h"
+#include "FontPlatformData.h"
+
+#include "PlatformString.h"
+#include <wtf/HashMap.h>
+#include <wtf/RetainPtr.h>
+#include <wtf/Vector.h>
+#include <wtf/text/StringHash.h>
+
+using namespace std;
+
+namespace WebCore {
+
+FontPlatformData::FontPlatformData(const FontPlatformData& source)
+    : m_syntheticBold(source.m_syntheticBold)
+    , m_syntheticOblique(source.m_syntheticOblique)
+    , m_orientation(source.m_orientation)
+    , m_textOrientation(source.m_textOrientation)
+    , m_size(source.m_size)
+    , m_widthVariant(source.m_widthVariant)
+    , m_isColorBitmapFont(source.m_isColorBitmapFont)
+{
+    platformDataInit(source);
+}
+
+const FontPlatformData& FontPlatformData::operator=(const FontPlatformData& other)
+{
+    // Check for self-assignment.
+    if (this == &other)
+        return *this;
+
+    m_syntheticBold = other.m_syntheticBold;
+    m_syntheticOblique = other.m_syntheticOblique;
+    m_orientation = other.m_orientation;
+    m_textOrientation = other.m_textOrientation;
+    m_size = other.m_size;
+    m_widthVariant = other.m_widthVariant;
+    m_isColorBitmapFont = other.m_isColorBitmapFont;
+
+    return platformDataAssign(other);
+}
+
+}
diff --git a/Source/WebCore/platform/graphics/FontPlatformData.h b/Source/WebCore/platform/graphics/FontPlatformData.h
new file mode 100644
index 0000000..78c86ef
--- /dev/null
+++ b/Source/WebCore/platform/graphics/FontPlatformData.h
@@ -0,0 +1,359 @@
+/*
+ * Copyright (C) 2006, 2007, 2008, 2010 Apple Inc.
+ * Copyright (C) 2006 Michael Emmel mike.emmel@gmail.com
+ * Copyright (C) 2007 Holger Hans Peter Freyther
+ * Copyright (C) 2007 Pioneer Research Center USA, Inc.
+ * Copyright (C) 2010, 2011 Brent Fulgham <bfulgham@webkit.org>
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ *
+ */
+
+// FIXME: This is temporary until all ports switch to using this file.
+#if PLATFORM(CHROMIUM) && !OS(DARWIN)
+#include "chromium/FontPlatformData.h"
+#elif PLATFORM(QT)
+#include "qt/FontPlatformData.h"
+#elif PLATFORM(WIN) && OS(WINCE)
+#include "wince/FontPlatformData.h"
+#elif PLATFORM(WX)
+#include "wx/FontPlatformData.h"
+#elif (PLATFORM(EFL) || PLATFORM(GTK)) && USE(FREETYPE)
+#include "freetype/FontPlatformData.h"
+#elif (PLATFORM(EFL) || PLATFORM(GTK)) && USE(PANGO)
+#include "pango/FontPlatformData.h"
+#else
+
+#ifndef FontPlatformData_h
+#define FontPlatformData_h
+
+#include "FontOrientation.h"
+#include "FontWidthVariant.h"
+#include "GlyphBuffer.h"
+#include "TextOrientation.h"
+
+#if PLATFORM(WIN)
+#include "RefCountedGDIHandle.h"
+#endif
+
+#if PLATFORM(CAIRO)
+#include "HashFunctions.h"
+#include <cairo.h>
+#endif
+
+#if OS(DARWIN)
+#ifdef __OBJC__
+@class NSFont;
+#else
+class NSFont;
+#endif
+
+typedef struct CGFont* CGFontRef;
+#ifndef BUILDING_ON_TIGER
+typedef const struct __CTFont* CTFontRef;
+#endif
+
+#include <CoreFoundation/CFBase.h>
+#include <objc/objc-auto.h>
+#endif
+
+#include <wtf/Forward.h>
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+#include <wtf/RetainPtr.h>
+#include <wtf/text/StringImpl.h>
+
+#if PLATFORM(CHROMIUM) && OS(DARWIN)
+#include "CrossProcessFontLoading.h"  
+#endif
+
+#if PLATFORM(WIN)
+typedef struct HFONT__* HFONT;
+#endif
+
+#if PLATFORM(CG)
+typedef struct CGFont* CGFontRef;
+#if OS(DARWIN)
+#ifndef BUILDING_ON_TIGER
+typedef const struct __CTFont* CTFontRef;
+typedef UInt32 ATSUFontID;
+typedef UInt32 ATSFontRef;
+#endif
+#endif
+#endif
+
+namespace WebCore {
+
+class FontDescription;
+
+#if OS(DARWIN) && !defined(BUILDING_ON_TIGER)
+inline CTFontRef toCTFontRef(NSFont *nsFont) { return reinterpret_cast<CTFontRef>(nsFont); }
+#endif
+
+class FontPlatformData {
+public:
+    FontPlatformData(WTF::HashTableDeletedValueType)
+        : m_syntheticBold(false)
+        , m_syntheticOblique(false)
+        , m_orientation(Horizontal)
+        , m_textOrientation(TextOrientationVerticalRight)
+        , m_size(0)
+        , m_widthVariant(RegularWidth)
+#if PLATFORM(WIN)
+        , m_font(WTF::HashTableDeletedValue)
+#elif OS(DARWIN)
+        , m_font(hashTableDeletedFontValue())
+#endif
+#if PLATFORM(CG) && (defined(BUILDING_ON_TIGER) || PLATFORM(WIN))
+        , m_cgFont(0)
+#elif PLATFORM(CAIRO)
+        , m_scaledFont(hashTableDeletedFontValue())
+#endif
+        , m_isColorBitmapFont(false)
+#if PLATFORM(WIN)
+        , m_useGDI(false)
+#endif
+        {
+        }
+
+    FontPlatformData()
+        : m_syntheticBold(false)
+        , m_syntheticOblique(false)
+        , m_orientation(Horizontal)
+        , m_textOrientation(TextOrientationVerticalRight)
+        , m_size(0)
+        , m_widthVariant(RegularWidth)
+#if OS(DARWIN)
+        , m_font(0)
+#endif
+#if PLATFORM(CG) && (defined(BUILDING_ON_TIGER) || PLATFORM(WIN))
+        , m_cgFont(0)
+#elif PLATFORM(CAIRO)
+        , m_scaledFont(0)
+#endif
+        , m_isColorBitmapFont(false)
+#if PLATFORM(WIN)
+        , m_useGDI(false)
+#endif
+    {
+    }
+
+    FontPlatformData(const FontPlatformData&);
+    FontPlatformData(const FontDescription&, const AtomicString& family);
+    FontPlatformData(float size, bool syntheticBold, bool syntheticOblique, FontOrientation orientation = Horizontal,
+                     TextOrientation textOrientation = TextOrientationVerticalRight, FontWidthVariant widthVariant = RegularWidth)
+        : m_syntheticBold(syntheticBold)
+        , m_syntheticOblique(syntheticOblique)
+        , m_orientation(orientation)
+        , m_textOrientation(textOrientation)
+        , m_size(size)
+        , m_widthVariant(widthVariant)
+#if OS(DARWIN)
+        , m_font(0)
+#endif
+#if PLATFORM(CG) && (defined(BUILDING_ON_TIGER) || PLATFORM(WIN))
+        , m_cgFont(0)
+#elif PLATFORM(CAIRO)
+        , m_scaledFont(0)
+#endif
+        , m_isColorBitmapFont(false)
+#if PLATFORM(WIN)
+        , m_useGDI(false)
+#endif
+    {
+    }
+
+#if OS(DARWIN)
+    FontPlatformData(NSFont*, float size, bool syntheticBold = false, bool syntheticOblique = false, FontOrientation = Horizontal,
+                     TextOrientation = TextOrientationVerticalRight, FontWidthVariant = RegularWidth);
+    FontPlatformData(CGFontRef cgFont, float size, bool syntheticBold, bool syntheticOblique, FontOrientation orientation,
+                     TextOrientation textOrientation, FontWidthVariant widthVariant)
+        : m_syntheticBold(syntheticBold)
+        , m_syntheticOblique(syntheticOblique)
+        , m_orientation(orientation)
+        , m_textOrientation(textOrientation)
+        , m_size(size)
+        , m_widthVariant(widthVariant)
+        , m_font(0)
+        , m_cgFont(cgFont)
+        , m_isColorBitmapFont(false)
+    {
+    }
+#endif
+#if PLATFORM(WIN)
+    FontPlatformData(HFONT, float size, bool syntheticBold, bool syntheticOblique, bool useGDI);
+#if PLATFORM(CG)
+    FontPlatformData(HFONT, CGFontRef, float size, bool syntheticBold, bool syntheticOblique, bool useGDI);
+#endif
+#endif
+#if PLATFORM(CAIRO)
+    FontPlatformData(cairo_font_face_t*, float size, bool bold, bool italic);
+#endif
+
+    ~FontPlatformData();
+
+#if PLATFORM(WIN)
+    HFONT hfont() const { return m_font ? m_font->handle() : 0; }
+    bool useGDI() const { return m_useGDI; }
+#elif OS(DARWIN)
+    NSFont* font() const { return m_font; }
+    void setFont(NSFont*);
+#endif
+
+#if PLATFORM(CG)
+#if OS(DARWIN)
+#ifndef BUILDING_ON_TIGER
+    CGFontRef cgFont() const { return m_cgFont.get(); }
+#else
+    CGFontRef cgFont() const { return m_cgFont; }
+#endif
+    CTFontRef ctFont() const;
+
+    bool roundsGlyphAdvances() const;
+    bool allowsLigatures() const;
+#else
+    CGFontRef cgFont() const { return m_cgFont.get(); }
+#endif
+#endif
+
+    bool isFixedPitch() const;
+    float size() const { return m_size; }
+    void setSize(float size) { m_size = size; }
+    bool syntheticBold() const { return m_syntheticBold; }
+    bool syntheticOblique() const { return m_syntheticOblique; }
+    bool isColorBitmapFont() const { return m_isColorBitmapFont; }
+    FontOrientation orientation() const { return m_orientation; }
+    TextOrientation textOrientation() const { return m_textOrientation; }
+    FontWidthVariant widthVariant() const { return m_widthVariant; }
+
+    void setOrientation(FontOrientation orientation) { m_orientation = orientation; }
+
+#if PLATFORM(CAIRO)
+    cairo_scaled_font_t* scaledFont() const { return m_scaledFont; }
+#endif
+
+    unsigned hash() const
+    {
+#if PLATFORM(WIN) && !PLATFORM(CAIRO)
+        return m_font ? m_font->hash() : 0;
+#elif OS(DARWIN)
+        ASSERT(m_font || !m_cgFont);
+        uintptr_t hashCodes[3] = { (uintptr_t)m_font, m_widthVariant, m_textOrientation << 3 | m_orientation << 2 | m_syntheticBold << 1 | m_syntheticOblique };
+        return StringHasher::hashMemory<sizeof(hashCodes)>(hashCodes);
+#elif PLATFORM(CAIRO)
+        return PtrHash<cairo_scaled_font_t*>::hash(m_scaledFont);
+#endif
+    }
+
+    const FontPlatformData& operator=(const FontPlatformData&);
+
+    bool operator==(const FontPlatformData& other) const
+    {
+        return platformIsEqual(other)
+            && m_size == other.m_size
+            && m_syntheticBold == other.m_syntheticBold
+            && m_syntheticOblique == other.m_syntheticOblique
+            && m_isColorBitmapFont == other.m_isColorBitmapFont
+            && m_orientation == other.m_orientation
+            && m_textOrientation == other.m_textOrientation
+            && m_widthVariant == other.m_widthVariant;
+    }
+
+    bool isHashTableDeletedValue() const
+    {
+#if PLATFORM(WIN) && !PLATFORM(CAIRO)
+        return m_font.isHashTableDeletedValue();
+#elif OS(DARWIN)
+        return m_font == hashTableDeletedFontValue();
+#elif PLATFORM(CAIRO)
+        return m_scaledFont == hashTableDeletedFontValue();
+#endif
+    }
+
+
+#ifndef NDEBUG
+    String description() const;
+#endif
+
+private:
+    bool platformIsEqual(const FontPlatformData&) const;
+    void platformDataInit(const FontPlatformData&);
+    const FontPlatformData& platformDataAssign(const FontPlatformData&);
+#if OS(DARWIN)
+    // Load various data about the font specified by |nsFont| with the size fontSize into the following output paramters:
+    // Note: Callers should always take into account that for the Chromium port, |outNSFont| isn't necessarily the same
+    // font as |nsFont|. This because the sandbox may block loading of the original font.
+    // * outNSFont - The font that was actually loaded, for the Chromium port this may be different than nsFont.
+    // The caller is responsible for calling CFRelease() on this parameter when done with it.
+    // * cgFont - CGFontRef representing the input font at the specified point size.
+    void loadFont(NSFont*, float fontSize, NSFont*& outNSFont, CGFontRef&);
+    static NSFont* hashTableDeletedFontValue() { return reinterpret_cast<NSFont *>(-1); }
+#elif PLATFORM(WIN)
+    void platformDataInit(HFONT, float size, HDC, WCHAR* faceName);
+#endif
+
+#if PLATFORM(CAIRO)
+    static cairo_scaled_font_t* hashTableDeletedFontValue() { return reinterpret_cast<cairo_scaled_font_t*>(-1); }
+#endif
+
+public:
+    bool m_syntheticBold;
+    bool m_syntheticOblique;
+    FontOrientation m_orientation;
+    TextOrientation m_textOrientation;
+    float m_size;
+    FontWidthVariant m_widthVariant;
+
+private:
+#if OS(DARWIN)
+    NSFont* m_font;
+#elif PLATFORM(WIN)
+    RefPtr<RefCountedGDIHandle<HFONT> > m_font;
+#endif
+
+#if PLATFORM(CG)
+#if PLATFORM(WIN)
+    RetainPtr<CGFontRef> m_cgFont;
+#else
+#ifndef BUILDING_ON_TIGER
+    RetainPtr<CGFontRef> m_cgFont;
+#else
+    CGFontRef m_cgFont; // It is not necessary to refcount this, since either an NSFont owns it or some CachedFont has it referenced.
+#endif
+    mutable RetainPtr<CTFontRef> m_CTFont;
+#endif
+#endif
+
+#if PLATFORM(CAIRO)
+    cairo_scaled_font_t* m_scaledFont;
+#endif
+
+#if PLATFORM(CHROMIUM) && OS(DARWIN)
+    RefPtr<MemoryActivatedFont> m_inMemoryFont;
+#endif
+
+    bool m_isColorBitmapFont;
+
+#if PLATFORM(WIN)
+    bool m_useGDI;
+#endif
+};
+
+} // namespace WebCore
+
+#endif // FontPlatformData_h
+
+#endif
diff --git a/Source/WebCore/platform/graphics/GraphicsContext.h b/Source/WebCore/platform/graphics/GraphicsContext.h
index 5eafa16..c555a5f 100644
--- a/Source/WebCore/platform/graphics/GraphicsContext.h
+++ b/Source/WebCore/platform/graphics/GraphicsContext.h
@@ -42,8 +42,9 @@ typedef struct CGContext PlatformGraphicsContext;
 #elif PLATFORM(CAIRO)
 namespace WebCore {
 class ContextShadow;
+class PlatformContextCairo;
 }
-typedef struct _cairo PlatformGraphicsContext;
+typedef WebCore::PlatformContextCairo PlatformGraphicsContext;
 #elif PLATFORM(OPENVG)
 namespace WebCore {
 class SurfaceOpenVG;
@@ -279,6 +280,9 @@ namespace WebCore {
         
         void setIsCALayerContext(bool);
         bool isCALayerContext() const;
+
+        void setIsAcceleratedContext(bool);
+        bool isAcceleratedContext() const;
 #endif
 
 #if PLATFORM(ANDROID)
@@ -522,6 +526,7 @@ namespace WebCore {
 #endif
 
 #if PLATFORM(CAIRO)
+        GraphicsContext(cairo_t*);
         void pushImageMask(cairo_surface_t*, const FloatRect&);
 #endif
 
diff --git a/Source/WebCore/platform/graphics/GraphicsContext3D.h b/Source/WebCore/platform/graphics/GraphicsContext3D.h
index a9db650..351b445 100644
--- a/Source/WebCore/platform/graphics/GraphicsContext3D.h
+++ b/Source/WebCore/platform/graphics/GraphicsContext3D.h
@@ -51,8 +51,8 @@
 @class CALayer;
 @class WebGLLayer;
 #else
-typedef void* CALayer;
-typedef void* WebGLLayer;
+class CALayer;
+class WebGLLayer;
 #endif
 #elif PLATFORM(QT)
 QT_BEGIN_NAMESPACE
@@ -420,6 +420,7 @@ public:
             , antialias(true)
             , premultipliedAlpha(true)
             , canRecoverFromContextLoss(true)
+            , preserveDrawingBuffer(false)
         {
         }
 
@@ -429,6 +430,7 @@ public:
         bool antialias;
         bool premultipliedAlpha;
         bool canRecoverFromContextLoss;
+        bool preserveDrawingBuffer;
     };
 
     enum RenderStyle {
@@ -449,8 +451,8 @@ public:
 
 #if PLATFORM(MAC)
     PlatformGraphicsContext3D platformGraphicsContext3D() const { return m_contextObj; }
-    Platform3DObject platformTexture() const { return m_texture; }
-    CALayer* platformLayer() const { return static_cast<CALayer*>(m_webGLLayer.get()); }
+    Platform3DObject platformTexture() const { return m_compositorTexture; }
+    CALayer* platformLayer() const { return reinterpret_cast<CALayer*>(m_webGLLayer.get()); }
 #elif PLATFORM(CHROMIUM)
     PlatformGraphicsContext3D platformGraphicsContext3D() const;
     Platform3DObject platformTexture() const;
@@ -461,7 +463,7 @@ public:
     PlatformGraphicsContext3D platformGraphicsContext3D();
     Platform3DObject platformTexture() const;
 #if USE(ACCELERATED_COMPOSITING)
-    PlatformLayer* platformLayer() const { return 0; }
+    PlatformLayer* platformLayer() const;
 #endif
 #else
     PlatformGraphicsContext3D platformGraphicsContext3D() const { return NullPlatformGraphicsContext3D; }
@@ -756,10 +758,14 @@ public:
                        int canvasWidth, int canvasHeight, CGContextRef context);
 #endif
 
+    void markContextChanged();
+    void markLayerComposited();
+    bool layerComposited() const;
+
     void paintRenderingResultsToCanvas(CanvasRenderingContext* context);
+    PassRefPtr<ImageData> paintRenderingResultsToImageData();
 
 #if PLATFORM(QT)
-    void paint(QPainter* painter, const QRect& rect) const;
     bool paintsIntoCanvasBuffer() const { return true; }
 #elif PLATFORM(CHROMIUM)
     bool paintsIntoCanvasBuffer() const;
@@ -859,6 +865,10 @@ public:
     // could not be honored based on the capabilities of the OpenGL
     // implementation.
     void validateAttributes();
+
+    // Read rendering results into a pixel array with the same format as the
+    // backbuffer.
+    void readRenderingResults(unsigned char* pixels, int pixelsSize);
 #endif
 
     int m_currentWidth, m_currentHeight;
@@ -881,12 +891,16 @@ public:
 
     CGLContextObj m_contextObj;
     RetainPtr<WebGLLayer> m_webGLLayer;
-    GC3Duint m_texture;
+    GC3Duint m_texture, m_compositorTexture;
     GC3Duint m_fbo;
     GC3Duint m_depthStencilBuffer;
+    bool m_layerComposited;
+    GC3Duint m_internalColorFormat;
 
-    // For tracking which FBO is bound
+    // For tracking which FBO/texture is bound
     GC3Duint m_boundFBO;
+    GC3Denum m_activeTexture;
+    GC3Duint m_boundTexture0;
 
     // For multisampling
     GC3Duint m_multisampleFBO;
diff --git a/Source/WebCore/platform/graphics/GraphicsLayer.h b/Source/WebCore/platform/graphics/GraphicsLayer.h
index e3a62b6..4f234d4 100644
--- a/Source/WebCore/platform/graphics/GraphicsLayer.h
+++ b/Source/WebCore/platform/graphics/GraphicsLayer.h
@@ -46,12 +46,11 @@
 
 #if PLATFORM(MAC)
 #ifdef __OBJC__
-@class WebLayer;
 @class CALayer;
-typedef CALayer PlatformLayer;
 #else
-typedef void* PlatformLayer;
+class CALayer;
 #endif
+typedef CALayer PlatformLayer;
 #elif PLATFORM(WIN)
 typedef struct _CACFLayer PlatformLayer;
 #elif PLATFORM(QT)
diff --git a/Source/WebCore/platform/graphics/ImageBuffer.h b/Source/WebCore/platform/graphics/ImageBuffer.h
index 48878da..860f574 100644
--- a/Source/WebCore/platform/graphics/ImageBuffer.h
+++ b/Source/WebCore/platform/graphics/ImageBuffer.h
@@ -132,6 +132,10 @@ namespace WebCore {
         ImageBuffer(const IntSize&, ColorSpace colorSpace, RenderingMode renderingMode, bool& success);
     };
 
+#if PLATFORM(CG) || USE(SKIA)
+    String ImageDataToDataURL(const ImageData& input, const String& mimeType, const double* quality);
+#endif
+
 } // namespace WebCore
 
 #endif // ImageBuffer_h
diff --git a/Source/WebCore/platform/graphics/MediaPlayer.cpp b/Source/WebCore/platform/graphics/MediaPlayer.cpp
index 70576a5..03004b6 100644
--- a/Source/WebCore/platform/graphics/MediaPlayer.cpp
+++ b/Source/WebCore/platform/graphics/MediaPlayer.cpp
@@ -47,6 +47,9 @@
 
 #if PLATFORM(MAC)
 #include "MediaPlayerPrivateQTKit.h"
+#if USE(AVFOUNDATION)
+#include "MediaPlayerPrivateAVFoundationObjC.h"
+#endif
 #define PlatformMediaEngineClassName MediaPlayerPrivateQTKit
 #elif OS(WINCE) && !PLATFORM(QT)
 #include "MediaPlayerPrivateWinCE.h"
@@ -82,7 +85,7 @@ public:
 
     virtual void load(const String&) { }
     virtual void cancelLoad() { }
-    
+
     virtual void prepareToPlay() { }
     virtual void play() { }
     virtual void pause() { }    
@@ -189,11 +192,15 @@ static Vector<MediaPlayerFactory*>& installedMediaEngines()
         MediaPlayerPrivateGStreamer::registerMediaEngine(addMediaEngine);
 #endif
 
+#if USE(AVFOUNDATION) && PLATFORM(MAC)
+        MediaPlayerPrivateAVFoundationObjC::registerMediaEngine(addMediaEngine);
+#endif
+
 #if !PLATFORM(GTK) && !PLATFORM(EFL) && !(PLATFORM(QT) && USE(GSTREAMER))
         PlatformMediaEngineClassName::registerMediaEngine(addMediaEngine);
 #endif
     }
-    
+
     return installedEngines;
 }
 
@@ -241,7 +248,7 @@ static MediaPlayerFactory* bestMediaEngineForTypeAndCodecs(const String& type, c
         if (!codecs.isEmpty())
             return 0;
     }
-    
+
     MediaPlayerFactory* engine = 0;
     MediaPlayer::SupportsType supported = MediaPlayer::IsNotSupported;
     unsigned count = engines.size();
@@ -292,6 +299,7 @@ MediaPlayer::MediaPlayer(MediaPlayerClient* client)
     , m_muted(false)
     , m_preservesPitch(true)
     , m_privateBrowsing(false)
+    , m_shouldPrepareToRender(false)
 #if ENABLE(PLUGIN_PROXY_FOR_VIDEO)
     , m_playerProxy(0)
 #endif
@@ -351,7 +359,7 @@ void MediaPlayer::loadWithNextMediaEngine(MediaPlayerFactory* current)
         engine = nextMediaEngine(current);
     else
         engine = bestMediaEngineForTypeAndCodecs(m_contentMIMEType, m_contentTypeCodecs, current);
-    
+
     // Don't delete and recreate the player unless it comes from a different engine.
     if (!engine) {
         m_currentMediaEngine = engine;
@@ -368,6 +376,8 @@ void MediaPlayer::loadWithNextMediaEngine(MediaPlayerFactory* current)
         m_private->setPrivateBrowsingMode(m_privateBrowsing);
         m_private->setPreload(m_preload);
         m_private->setPreservesPitch(preservesPitch());
+        if (m_shouldPrepareToRender)
+            m_private->prepareForRendering();
     }
 
     if (m_private)
@@ -383,17 +393,18 @@ bool MediaPlayer::hasAvailableVideoFrame() const
 {
     return m_private->hasAvailableVideoFrame();
 }
-    
+
 void MediaPlayer::prepareForRendering()
 {
-    return m_private->prepareForRendering();
+    m_shouldPrepareToRender = true;
+    m_private->prepareForRendering();
 }
-    
+
 bool MediaPlayer::canLoadPoster() const
 {
     return m_private->canLoadPoster();
 }
-    
+
 void MediaPlayer::setPoster(const String& url)
 {
     m_private->setPoster(url);
@@ -408,7 +419,7 @@ void MediaPlayer::prepareToPlay()
 {
     m_private->prepareToPlay();
 }
-    
+
 void MediaPlayer::play()
 {
     m_private->play();
@@ -478,7 +489,7 @@ bool MediaPlayer::inMediaDocument()
 {
     Frame* frame = m_frameView ? m_frameView->frame() : 0;
     Document* document = frame ? frame->document() : 0;
-    
+
     return document && document->isMediaDocument();
 }
 
diff --git a/Source/WebCore/platform/graphics/MediaPlayer.h b/Source/WebCore/platform/graphics/MediaPlayer.h
index f41af01..5872c88 100644
--- a/Source/WebCore/platform/graphics/MediaPlayer.h
+++ b/Source/WebCore/platform/graphics/MediaPlayer.h
@@ -46,8 +46,10 @@
 #endif
 
 #ifdef __OBJC__
+@class AVPlayer;
 @class QTMovie;
 #else
+class AVPlayer;
 class QTMovie;
 #endif
 class QTMovieGWorld;
@@ -71,6 +73,7 @@ struct PlatformMedia {
         GStreamerGWorldType,
         ChromiumMediaPlayerType,
         QtMediaPlayerType,
+        AVFoundationMediaPlayerType,
     } type;
 
     union {
@@ -80,6 +83,7 @@ struct PlatformMedia {
         GStreamerGWorld* gstreamerGWorld;
         MediaPlayerPrivateInterface* chromiumMediaPlayer;
         MediaPlayerPrivateInterface* qtMediaPlayer;
+        AVPlayer* avfMediaPlayer;
     } media;
 };
 
@@ -115,10 +119,10 @@ public:
 
     // time has jumped, eg. not as a result of normal playback
     virtual void mediaPlayerTimeChanged(MediaPlayer*) { }
-    
+
     // the media file duration has changed, or is now known
     virtual void mediaPlayerDurationChanged(MediaPlayer*) { }
-    
+
     // the playback rate has changed
     virtual void mediaPlayerRateChanged(MediaPlayer*) { }
 
@@ -178,49 +182,53 @@ public:
     IntSize naturalSize();
     bool hasVideo() const;
     bool hasAudio() const;
+<<<<<<< HEAD
 #if PLATFORM(ANDROID)
     enum MediaElementType { Video, Audio };
     void setMediaElementType(MediaElementType type) { m_mediaElementType = type; }
     MediaElementType mediaElementType() { return m_mediaElementType; }
 #endif
     
+=======
+
+>>>>>>> webkit.org at r82507
     void setFrameView(FrameView* frameView) { m_frameView = frameView; }
     FrameView* frameView() { return m_frameView; }
     bool inMediaDocument();
-    
+
     IntSize size() const { return m_size; }
     void setSize(const IntSize& size);
-    
+
     void load(const String& url, const ContentType&);
     void cancelLoad();
-    
+
     bool visible() const;
     void setVisible(bool);
-    
+
     void prepareToPlay();
     void play();
     void pause();    
-    
+
     bool paused() const;
     bool seeking() const;
-    
+
     float duration() const;
     float currentTime() const;
     void seek(float time);
 
     float startTime() const;
-    
+
     float rate() const;
     void setRate(float);
 
     bool preservesPitch() const;    
     void setPreservesPitch(bool);
-    
+
     PassRefPtr<TimeRanges> buffered();
     float maxTimeSeekable();
 
     unsigned bytesLoaded();
-    
+
     float volume() const;
     void setVolume(float);
 
@@ -235,13 +243,13 @@ public:
 
     void paint(GraphicsContext*, const IntRect&);
     void paintCurrentFrameInContext(GraphicsContext*, const IntRect&);
-    
+
     enum NetworkState { Empty, Idle, Loading, Loaded, FormatError, NetworkError, DecodeError };
     NetworkState networkState();
 
     enum ReadyState  { HaveNothing, HaveMetadata, HaveCurrentData, HaveFutureData, HaveEnoughData };
     ReadyState readyState();
-    
+
     enum MovieLoadType { Unknown, Download, StoredStream, LiveStream };
     MovieLoadType movieLoadType() const;
 
@@ -320,6 +328,7 @@ private:
     bool m_muted;
     bool m_preservesPitch;
     bool m_privateBrowsing;
+    bool m_shouldPrepareToRender;
 #if ENABLE(PLUGIN_PROXY_FOR_VIDEO)
     WebMediaPlayerProxy* m_playerProxy;    // not owned or used, passed to m_private
 #endif
diff --git a/Source/WebCore/platform/graphics/Path.cpp b/Source/WebCore/platform/graphics/Path.cpp
index 55760b1..f7aedbe 100644
--- a/Source/WebCore/platform/graphics/Path.cpp
+++ b/Source/WebCore/platform/graphics/Path.cpp
@@ -83,14 +83,14 @@ static void pathLengthApplierFunction(void* info, const PathElement* element)
     }
 }
 
-float Path::length()
+float Path::length() const
 {
     PathTraversalState traversalState(PathTraversalState::TraversalTotalLength);
     apply(&traversalState, pathLengthApplierFunction);
     return traversalState.m_totalLength;
 }
 
-FloatPoint Path::pointAtLength(float length, bool& ok)
+FloatPoint Path::pointAtLength(float length, bool& ok) const
 {
     PathTraversalState traversalState(PathTraversalState::TraversalPointAtLength);
     traversalState.m_desiredLength = length;
@@ -99,10 +99,10 @@ FloatPoint Path::pointAtLength(float length, bool& ok)
     return traversalState.m_current;
 }
 
-float Path::normalAngleAtLength(float length, bool& ok)
+float Path::normalAngleAtLength(float length, bool& ok) const
 {
     PathTraversalState traversalState(PathTraversalState::TraversalNormalAngleAtLength);
-    traversalState.m_desiredLength = length;
+    traversalState.m_desiredLength = length ? length : std::numeric_limits<float>::epsilon();
     apply(&traversalState, pathLengthApplierFunction);
     ok = traversalState.m_success;
     return traversalState.m_normalAngle;
diff --git a/Source/WebCore/platform/graphics/Path.h b/Source/WebCore/platform/graphics/Path.h
index 31f2cd6..c2ca576 100644
--- a/Source/WebCore/platform/graphics/Path.h
+++ b/Source/WebCore/platform/graphics/Path.h
@@ -112,11 +112,11 @@ namespace WebCore {
         bool contains(const FloatPoint&, WindRule rule = RULE_NONZERO) const;
         bool strokeContains(StrokeStyleApplier*, const FloatPoint&) const;
         FloatRect boundingRect() const;
-        FloatRect strokeBoundingRect(StrokeStyleApplier* = 0);
+        FloatRect strokeBoundingRect(StrokeStyleApplier* = 0) const;
         
-        float length();
-        FloatPoint pointAtLength(float length, bool& ok);
-        float normalAngleAtLength(float length, bool& ok);
+        float length() const;
+        FloatPoint pointAtLength(float length, bool& ok) const;
+        float normalAngleAtLength(float length, bool& ok) const;
 
         void clear();
         bool isEmpty() const;
diff --git a/Source/WebCore/platform/graphics/SimpleFontData.cpp b/Source/WebCore/platform/graphics/SimpleFontData.cpp
index aaab666..82f770d 100644
--- a/Source/WebCore/platform/graphics/SimpleFontData.cpp
+++ b/Source/WebCore/platform/graphics/SimpleFontData.cpp
@@ -47,15 +47,16 @@ using namespace std;
 
 namespace WebCore {
 
-SimpleFontData::SimpleFontData(const FontPlatformData& platformData, bool isCustomFont, bool isLoading)
+SimpleFontData::SimpleFontData(const FontPlatformData& platformData, bool isCustomFont, bool isLoading, bool isTextOrientationFallback)
     : m_maxCharWidth(-1)
     , m_avgCharWidth(-1)
-    , m_orientation(platformData.orientation())
     , m_platformData(platformData)
     , m_treatAsFixedPitch(false)
     , m_isCustomFont(isCustomFont)
     , m_isLoading(isLoading)
-    , m_isBrokenIdeographFont(false)
+    , m_isTextOrientationFallback(isTextOrientationFallback)
+    , m_isBrokenIdeographFallback(false)
+    , m_hasVerticalGlyphs(false)
 {
     platformInit();
     platformGlyphInit();
@@ -64,13 +65,14 @@ SimpleFontData::SimpleFontData(const FontPlatformData& platformData, bool isCust
 
 #if ENABLE(SVG_FONTS)
 SimpleFontData::SimpleFontData(PassOwnPtr<SVGFontData> svgFontData, int size, bool syntheticBold, bool syntheticItalic)
-    : m_orientation(Horizontal)
-    , m_platformData(FontPlatformData(size, syntheticBold, syntheticItalic))
+    : m_platformData(FontPlatformData(size, syntheticBold, syntheticItalic))
     , m_treatAsFixedPitch(false)
     , m_svgFontData(svgFontData)
     , m_isCustomFont(true)
     , m_isLoading(false)
-    , m_isBrokenIdeographFont(false)
+    , m_isTextOrientationFallback(false)
+    , m_isBrokenIdeographFallback(false)
+    , m_hasVerticalGlyphs(false)
 {
     SVGFontFaceElement* svgFontFaceElement = m_svgFontData->svgFontFaceElement();
     unsigned unitsPerEm = svgFontFaceElement->unitsPerEm();
@@ -202,14 +204,34 @@ bool SimpleFontData::isSegmented() const
     return false;
 }
 
+SimpleFontData* SimpleFontData::verticalRightOrientationFontData() const
+{
+    if (!m_derivedFontData)
+        m_derivedFontData = DerivedFontData::create(isCustomFont());
+    if (!m_derivedFontData->verticalRightOrientation) {
+        FontPlatformData verticalRightPlatformData(m_platformData);
+        verticalRightPlatformData.setOrientation(Horizontal);
+        m_derivedFontData->verticalRightOrientation = new SimpleFontData(verticalRightPlatformData, isCustomFont(), false, true);
+    }
+    return m_derivedFontData->verticalRightOrientation.get();
+}
+
+SimpleFontData* SimpleFontData::uprightOrientationFontData() const
+{
+    if (!m_derivedFontData)
+        m_derivedFontData = DerivedFontData::create(isCustomFont());
+    if (!m_derivedFontData->uprightOrientation)
+        m_derivedFontData->uprightOrientation = new SimpleFontData(m_platformData, isCustomFont(), false, true);
+    return m_derivedFontData->uprightOrientation.get();
+}
+
 SimpleFontData* SimpleFontData::brokenIdeographFontData() const
 {
     if (!m_derivedFontData)
         m_derivedFontData = DerivedFontData::create(isCustomFont());
     if (!m_derivedFontData->brokenIdeograph) {
         m_derivedFontData->brokenIdeograph = new SimpleFontData(m_platformData, isCustomFont(), false);
-        m_derivedFontData->brokenIdeograph->m_orientation = Vertical;
-        m_derivedFontData->brokenIdeograph->m_isBrokenIdeographFont = true;
+        m_derivedFontData->brokenIdeograph->m_isBrokenIdeographFallback = true;
     }
     return m_derivedFontData->brokenIdeograph.get();
 }
@@ -242,6 +264,10 @@ SimpleFontData::DerivedFontData::~DerivedFontData()
         GlyphPageTreeNode::pruneTreeCustomFontData(emphasisMark.get());
     if (brokenIdeograph)
         GlyphPageTreeNode::pruneTreeCustomFontData(brokenIdeograph.get());
+    if (verticalRightOrientation)
+        GlyphPageTreeNode::pruneTreeCustomFontData(verticalRightOrientation.get());
+    if (uprightOrientation)
+        GlyphPageTreeNode::pruneTreeCustomFontData(uprightOrientation.get());
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/graphics/SimpleFontData.h b/Source/WebCore/platform/graphics/SimpleFontData.h
index 93d33bb..dfb4be3 100644
--- a/Source/WebCore/platform/graphics/SimpleFontData.h
+++ b/Source/WebCore/platform/graphics/SimpleFontData.h
@@ -71,7 +71,7 @@ enum Pitch { UnknownPitch, FixedPitch, VariablePitch };
 
 class SimpleFontData : public FontData {
 public:
-    SimpleFontData(const FontPlatformData&, bool isCustomFont = false, bool isLoading = false);
+    SimpleFontData(const FontPlatformData&, bool isCustomFont = false, bool isLoading = false, bool isTextOrientationFallback = false);
 #if ENABLE(SVG_FONTS)
     SimpleFontData(PassOwnPtr<SVGFontData>, int size, bool syntheticBold, bool syntheticItalic);
 #endif
@@ -97,11 +97,13 @@ public:
         return const_cast<SimpleFontData*>(this);
     }
 
+    SimpleFontData* verticalRightOrientationFontData() const;
+    SimpleFontData* uprightOrientationFontData() const;
     SimpleFontData* brokenIdeographFontData() const;
-    
-    // FIXME: Use the actual metrics for fonts with vertical tables instead of just hard-coding.  If the font is horizontally oriented or
-    // a broken ideographic font, then just hard-code to split ascent/descent down the middle.  Otherwise we should actually use the metrics
-    // from the font itself.
+
+    bool hasVerticalGlyphs() const { return m_hasVerticalGlyphs; }
+    bool isTextOrientationFallback() const { return m_isTextOrientationFallback; }
+
     const FontMetrics& fontMetrics() const { return m_fontMetrics; }
     float maxCharWidth() const { return m_maxCharWidth; }
     float avgCharWidth() const { return m_avgCharWidth; }
@@ -137,8 +139,6 @@ public:
     virtual bool isLoading() const { return m_isLoading; }
     virtual bool isSegmented() const;
 
-    bool isBrokenIdeographFont() const { return m_isBrokenIdeographFont; }
-
     const GlyphData& missingGlyphData() const { return m_missingGlyphData; }
 
 #ifndef NDEBUG
@@ -152,7 +152,7 @@ public:
 #endif
 
 #if PLATFORM(MAC) || USE(CORE_TEXT)
-    CFDictionaryRef getCFStringAttributes(TypesettingFeatures) const;
+    CFDictionaryRef getCFStringAttributes(TypesettingFeatures, FontOrientation) const;
 #endif
 
 #if USE(ATSUI)
@@ -183,8 +183,6 @@ public:
     wxFont* getWxFont() const { return m_platformData.font(); }
 #endif
 
-    FontOrientation orientation() const { return m_orientation; }
-
 private:
     void platformInit();
     void platformGlyphInit();
@@ -209,9 +207,6 @@ private:
     float m_maxCharWidth;
     float m_avgCharWidth;
     
-    FontOrientation m_orientation; // This is our supported orientation according to the tables in the font.  FontPlatformData will just always have the desired orientation.
-                                   // This value represents what we actually support.
-
     FontPlatformData m_platformData;
 
     mutable OwnPtr<GlyphMetricsMap<FloatRect> > m_glyphToBoundsMap;
@@ -225,8 +220,11 @@ private:
 
     bool m_isCustomFont;  // Whether or not we are custom font loaded via @font-face
     bool m_isLoading; // Whether or not this custom font is still in the act of loading.
-    bool m_isBrokenIdeographFont;
-
+    
+    bool m_isTextOrientationFallback;
+    bool m_isBrokenIdeographFallback;
+    bool m_hasVerticalGlyphs;
+    
     Glyph m_spaceGlyph;
     float m_spaceWidth;
 
@@ -242,6 +240,8 @@ private:
         OwnPtr<SimpleFontData> smallCaps;
         OwnPtr<SimpleFontData> emphasisMark;
         OwnPtr<SimpleFontData> brokenIdeograph;
+        OwnPtr<SimpleFontData> verticalRightOrientation;
+        OwnPtr<SimpleFontData> uprightOrientation;
 
     private:
         DerivedFontData(bool custom)
diff --git a/Source/WebCore/platform/graphics/TextRun.h b/Source/WebCore/platform/graphics/TextRun.h
index 4e0980b..ec763b9 100644
--- a/Source/WebCore/platform/graphics/TextRun.h
+++ b/Source/WebCore/platform/graphics/TextRun.h
@@ -33,17 +33,21 @@ class RenderSVGResource;
 
 class TextRun {
 public:
-    enum TrailingExpansionBehavior {
-        AllowTrailingExpansion,
-        ForbidTrailingExpansion
+    enum ExpansionBehaviorFlags {
+        ForbidTrailingExpansion = 0 << 0,
+        AllowTrailingExpansion = 1 << 0,
+        ForbidLeadingExpansion = 0 << 1,
+        AllowLeadingExpansion = 1 << 1,
     };
 
-    TextRun(const UChar* c, int len, bool allowTabs = false, float xpos = 0, float expansion = 0, TrailingExpansionBehavior trailingExpansionBehavior = AllowTrailingExpansion, bool rtl = false, bool directionalOverride = false)
+    typedef unsigned ExpansionBehavior;
+
+    TextRun(const UChar* c, int len, bool allowTabs = false, float xpos = 0, float expansion = 0, ExpansionBehavior expansionBehavior = AllowTrailingExpansion | ForbidLeadingExpansion, bool rtl = false, bool directionalOverride = false)
         : m_characters(c)
         , m_len(len)
         , m_xpos(xpos)
         , m_expansion(expansion)
-        , m_trailingExpansionBehavior(trailingExpansionBehavior)
+        , m_expansionBehavior(expansionBehavior)
 #if ENABLE(SVG)
         , m_horizontalGlyphStretch(1)
 #endif
@@ -58,12 +62,12 @@ public:
     {
     }
 
-    TextRun(const String& s, bool allowTabs = false, float xpos = 0, float expansion = 0, TrailingExpansionBehavior trailingExpansionBehavior = AllowTrailingExpansion, bool rtl = false, bool directionalOverride = false)
+    TextRun(const String& s, bool allowTabs = false, float xpos = 0, float expansion = 0, ExpansionBehavior expansionBehavior = AllowTrailingExpansion | ForbidLeadingExpansion, bool rtl = false, bool directionalOverride = false)
         : m_characters(s.characters())
         , m_len(s.length())
         , m_xpos(xpos)
         , m_expansion(expansion)
-        , m_trailingExpansionBehavior(trailingExpansionBehavior)
+        , m_expansionBehavior(expansionBehavior)
 #if ENABLE(SVG)
         , m_horizontalGlyphStretch(1)
 #endif
@@ -94,7 +98,8 @@ public:
     bool allowTabs() const { return m_allowTabs; }
     float xPos() const { return m_xpos; }
     float expansion() const { return m_expansion; }
-    bool allowsTrailingExpansion() const { return m_trailingExpansionBehavior == AllowTrailingExpansion; }
+    bool allowsLeadingExpansion() const { return m_expansionBehavior & AllowLeadingExpansion; }
+    bool allowsTrailingExpansion() const { return m_expansionBehavior & AllowTrailingExpansion; }
     bool rtl() const { return m_rtl; }
     bool ltr() const { return !m_rtl; }
     bool directionalOverride() const { return m_directionalOverride; }
@@ -121,7 +126,7 @@ private:
     // the text line is not the same as left start of the containing block.
     float m_xpos;  
     float m_expansion;
-    TrailingExpansionBehavior m_trailingExpansionBehavior;
+    ExpansionBehavior m_expansionBehavior;
 #if ENABLE(SVG)
     float m_horizontalGlyphStretch;
 #endif
diff --git a/Source/WebCore/platform/graphics/Tile.h b/Source/WebCore/platform/graphics/Tile.h
index c623ec9..02076d2 100644
--- a/Source/WebCore/platform/graphics/Tile.h
+++ b/Source/WebCore/platform/graphics/Tile.h
@@ -49,7 +49,7 @@ public:
     
     bool isDirty() const;
     void invalidate(const IntRect&);
-    void updateBackBuffer();
+    Vector<IntRect> updateBackBuffer();
     void swapBackBufferToFront();
     bool isReadyToPaint() const;
     void paint(GraphicsContext*, const IntRect&);
diff --git a/Source/WebCore/platform/graphics/TiledBackingStore.cpp b/Source/WebCore/platform/graphics/TiledBackingStore.cpp
index 4d69334..ac7e9c6 100644
--- a/Source/WebCore/platform/graphics/TiledBackingStore.cpp
+++ b/Source/WebCore/platform/graphics/TiledBackingStore.cpp
@@ -102,8 +102,6 @@ void TiledBackingStore::updateTileBuffers()
         if (!it->second->isDirty())
             continue;
         dirtyTiles.append(it->second);
-        // FIXME: should not request system repaint for the full tile.
-        paintedArea.append(mapToContents(it->second->rect()));
     }
     
     if (dirtyTiles.isEmpty()) {
@@ -115,11 +113,11 @@ void TiledBackingStore::updateTileBuffers()
     // one by one and then swapped to front in one go. This would minimize the time spent
     // blocking on tile updates.
     unsigned size = dirtyTiles.size();
-    for (unsigned n = 0; n < size; ++n)
-        dirtyTiles[n]->updateBackBuffer();
-
-    for (unsigned n = 0; n < size; ++n)
+    for (unsigned n = 0; n < size; ++n) {
+        Vector<IntRect> paintedRects = dirtyTiles[n]->updateBackBuffer();
+        paintedArea.append(paintedRects);
         dirtyTiles[n]->swapBackBufferToFront();
+    }
 
     m_client->tiledBackingStorePaintEnd(paintedArea);
 }
diff --git a/Source/WebCore/platform/graphics/WOFFFileFormat.cpp b/Source/WebCore/platform/graphics/WOFFFileFormat.cpp
index b1400ba..80a6dcb 100644
--- a/Source/WebCore/platform/graphics/WOFFFileFormat.cpp
+++ b/Source/WebCore/platform/graphics/WOFFFileFormat.cpp
@@ -248,7 +248,7 @@ bool convertWOFFToSfnt(SharedBuffer* woff, Vector<char>& sfnt)
 
     return sfnt.size() == totalSfntSize;
 }
+    
+} // namespace WebCore
 
 #endif // !ENABLE(OPENTYPE_SANITIZER)
-
-} // namespace WebCore
diff --git a/Source/WebCore/platform/graphics/WidthIterator.cpp b/Source/WebCore/platform/graphics/WidthIterator.cpp
index 27b0627..750a4ac 100644
--- a/Source/WebCore/platform/graphics/WidthIterator.cpp
+++ b/Source/WebCore/platform/graphics/WidthIterator.cpp
@@ -47,7 +47,7 @@ WidthIterator::WidthIterator(const Font* font, const TextRun& run, HashSet<const
     , m_end(run.length())
     , m_currentCharacter(0)
     , m_runWidthSoFar(0)
-    , m_isAfterExpansion(true)
+    , m_isAfterExpansion(!run.allowsLeadingExpansion())
     , m_fallbackFonts(fallbackFonts)
     , m_accountForGlyphBounds(accountForGlyphBounds)
     , m_maxGlyphBoundingBoxY(numeric_limits<float>::min())
@@ -62,7 +62,7 @@ WidthIterator::WidthIterator(const Font* font, const TextRun& run, HashSet<const
     if (!m_expansion)
         m_expansionPerOpportunity = 0;
     else {
-        bool isAfterExpansion = true;
+        bool isAfterExpansion = m_isAfterExpansion;
         unsigned expansionOpportunityCount = Font::expansionOpportunityCount(m_run.characters(), m_end, m_run.ltr() ? LTR : RTL, isAfterExpansion);
         if (isAfterExpansion && !m_run.allowsTrailingExpansion())
             expansionOpportunityCount--;
@@ -164,18 +164,24 @@ void WidthIterator::advance(int offset, GlyphBuffer* glyphBuffer)
             bool treatAsSpace = Font::treatAsSpace(c);
             if (treatAsSpace || (expandAroundIdeographs && Font::isCJKIdeographOrSymbol(c))) {
                 // Distribute the run's total expansion evenly over all expansion opportunities in the run.
-                if (m_expansion && (m_run.allowsTrailingExpansion() || (m_run.ltr() && currentCharacter + clusterLength < static_cast<size_t>(m_run.length()))
-                    || (m_run.rtl() && currentCharacter))) {
+                if (m_expansion) {
                     if (!treatAsSpace && !m_isAfterExpansion) {
                         // Take the expansion opportunity before this ideograph.
                         m_expansion -= m_expansionPerOpportunity;
                         m_runWidthSoFar += m_expansionPerOpportunity;
-                        if (glyphBuffer)
-                            glyphBuffer->expandLastAdvance(m_expansionPerOpportunity);
+                        if (glyphBuffer) {
+                            if (glyphBuffer->isEmpty())
+                                glyphBuffer->add(fontData->spaceGlyph(), fontData, m_expansionPerOpportunity);
+                            else
+                                glyphBuffer->expandLastAdvance(m_expansionPerOpportunity);
+                        }
+                    }
+                    if (m_run.allowsTrailingExpansion() || (m_run.ltr() && currentCharacter + clusterLength < static_cast<size_t>(m_run.length()))
+                        || (m_run.rtl() && currentCharacter)) {
+                        m_expansion -= m_expansionPerOpportunity;
+                        width += m_expansionPerOpportunity;
+                        m_isAfterExpansion = true;
                     }
-                    m_expansion -= m_expansionPerOpportunity;
-                    width += m_expansionPerOpportunity;
-                    m_isAfterExpansion = true;
                 } else
                     m_isAfterExpansion = false;
 
diff --git a/Source/WebCore/platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.cpp b/Source/WebCore/platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.cpp
new file mode 100644
index 0000000..eb96532
--- /dev/null
+++ b/Source/WebCore/platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.cpp
@@ -0,0 +1,731 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(VIDEO) && USE(AVFOUNDATION)
+
+#include "MediaPlayerPrivateAVFoundation.h"
+
+#include "ApplicationCacheHost.h"
+#include "DocumentLoader.h"
+#include "FrameView.h"
+#include "GraphicsContext.h"
+#include "GraphicsLayer.h"
+#include "KURL.h"
+#include "Logging.h"
+#include "SoftLinking.h"
+#include "TimeRanges.h"
+#include <CoreMedia/CoreMedia.h>
+#include <wtf/UnusedParam.h>
+
+using namespace std;
+
+namespace WebCore {
+
+static const float invalidTime = -1.0f;
+
+MediaPlayerPrivateAVFoundation::MediaPlayerPrivateAVFoundation(MediaPlayer* player)
+    : m_player(player)
+    , m_queuedNotifications()
+    , m_queueMutex()
+    , m_mainThreadCallPending(false)
+    , m_networkState(MediaPlayer::Empty)
+    , m_readyState(MediaPlayer::HaveNothing)
+    , m_preload(MediaPlayer::Auto)
+    , m_scaleFactor(1, 1)
+    , m_cachedMaxTimeLoaded(0)
+    , m_cachedMaxTimeSeekable(0)
+    , m_cachedDuration(invalidTime)
+    , m_reportedDuration(invalidTime)
+    , m_seekTo(invalidTime)
+    , m_requestedRate(1)
+    , m_delayCallbacks(false)
+    , m_havePreparedToPlay(false)
+    , m_assetIsPlayable(false)
+    , m_visible(false)
+    , m_videoFrameHasDrawn(false)
+    , m_loadingMetadata(false)
+    , m_delayingLoad(false)
+    , m_isAllowedToRender(false)
+    , m_cachedHasAudio(false)
+    , m_cachedHasVideo(false)
+    , m_cachedHasCaptions(false)
+    , m_ignoreLoadStateChanges(false)
+{
+    LOG(Media, "MediaPlayerPrivateAVFoundation::MediaPlayerPrivateAVFoundation(%p)", this);
+}
+
+MediaPlayerPrivateAVFoundation::~MediaPlayerPrivateAVFoundation()
+{
+    LOG(Media, "MediaPlayerPrivateAVFoundation::~MediaPlayerPrivateAVFoundation(%p)", this);
+    cancelCallOnMainThread(mainThreadCallback, this);
+}
+
+MediaPlayerPrivateAVFoundation::MediaRenderingMode MediaPlayerPrivateAVFoundation::currentRenderingMode() const
+{
+#if USE(ACCELERATED_COMPOSITING)
+    if (platformLayer())
+        return MediaRenderingToLayer;
+#endif
+
+    if (hasContextRenderer())
+        return MediaRenderingToContext;
+
+    return MediaRenderingNone;
+}
+
+MediaPlayerPrivateAVFoundation::MediaRenderingMode MediaPlayerPrivateAVFoundation::preferredRenderingMode() const
+{
+    if (!m_player->visible() || !m_player->frameView() || assetStatus() == MediaPlayerAVAssetStatusUnknown)
+        return MediaRenderingNone;
+
+#if USE(ACCELERATED_COMPOSITING)
+    if (supportsAcceleratedRendering() && m_player->mediaPlayerClient()->mediaPlayerRenderingCanBeAccelerated(m_player))
+        return MediaRenderingToLayer;
+#endif
+
+    return MediaRenderingToContext;
+}
+
+void MediaPlayerPrivateAVFoundation::setUpVideoRendering()
+{
+    if (!isReadyForVideoSetup())
+        return;
+
+    MediaRenderingMode currentMode = currentRenderingMode();
+    MediaRenderingMode preferredMode = preferredRenderingMode();
+    if (currentMode == preferredMode && currentMode != MediaRenderingNone)
+        return;
+
+    LOG(Media, "MediaPlayerPrivateAVFoundation::setUpVideoRendering(%p) - current mode = %d, preferred mode = %d", 
+        this, static_cast<int>(currentMode), static_cast<int>(preferredMode));
+
+    if (currentMode != MediaRenderingNone)  
+        tearDownVideoRendering();
+
+    switch (preferredMode) {
+    case MediaRenderingNone:
+    case MediaRenderingToContext:
+        createContextVideoRenderer();
+        break;
+        
+#if USE(ACCELERATED_COMPOSITING)
+    case MediaRenderingToLayer:
+        createVideoLayer();
+        break;
+#endif
+    }
+
+#if USE(ACCELERATED_COMPOSITING)
+    // If using a movie layer, inform the client so the compositing tree is updated.
+    if (currentMode == MediaRenderingToLayer || preferredMode == MediaRenderingToLayer) {
+        LOG(Media, "MediaPlayerPrivateAVFoundation::setUpVideoRendering(%p) - calling mediaPlayerRenderingModeChanged()", this);
+        m_player->mediaPlayerClient()->mediaPlayerRenderingModeChanged(m_player);
+    }
+#endif
+}
+
+void MediaPlayerPrivateAVFoundation::tearDownVideoRendering()
+{
+    LOG(Media, "MediaPlayerPrivateAVFoundation::tearDownVideoRendering(%p)", this);
+
+    destroyContextVideoRenderer();
+
+#if USE(ACCELERATED_COMPOSITING)
+    if (platformLayer())
+        destroyVideoLayer();
+#endif
+}
+
+bool MediaPlayerPrivateAVFoundation::hasSetUpVideoRendering() const
+{
+    return hasLayerRenderer() || hasContextRenderer();
+}
+
+void MediaPlayerPrivateAVFoundation::resumeLoad()
+{
+    LOG(Media, "MediaPlayerPrivateAVFoundation::resumeLoad(%p)", this);
+
+    ASSERT(m_delayingLoad);
+    m_delayingLoad = false;
+
+    if (m_assetURL.length())
+        prepareToPlay();
+}
+
+void MediaPlayerPrivateAVFoundation::load(const String& url)
+{
+    LOG(Media, "MediaPlayerPrivateAVFoundation::load(%p)", this);
+
+    if (m_networkState != MediaPlayer::Loading) {
+        m_networkState = MediaPlayer::Loading;
+        m_player->networkStateChanged();
+    }
+    if (m_readyState != MediaPlayer::HaveNothing) {
+        m_readyState = MediaPlayer::HaveNothing;
+        m_player->readyStateChanged();
+    }
+
+    m_videoFrameHasDrawn = false;
+    m_assetURL = url;
+
+    // Don't do any more work if the url is empty.
+    if (!url.length())
+        return;
+
+    if (m_preload == MediaPlayer::None) {
+        LOG(Media, "MediaPlayerPrivateAVFoundation::load(%p) - preload==none so returning", this);
+        m_delayingLoad = true;
+        return;
+    }
+
+    prepareToPlay();
+}
+
+void MediaPlayerPrivateAVFoundation::playabilityKnown()
+{
+    LOG(Media, "MediaPlayerPrivateAVFoundation::playabilityKnown(%p)", this);
+
+    updateStates();
+    if (m_assetIsPlayable)
+        return;
+
+    // Nothing more to do if we already have all of the item's metadata.
+    if (assetStatus() > MediaPlayerAVAssetStatusLoading) {
+        LOG(Media, "MediaPlayerPrivateAVFoundation::playabilityKnown(%p) - all metadata loaded", this);
+        return;
+    }
+
+    // At this point we are supposed to load metadata. It is OK to ask the asset to load the same 
+    // information multiple times, because if it has already been loaded the completion handler 
+    // will just be called synchronously.
+    m_loadingMetadata = true;
+    beginLoadingMetadata();
+}
+
+void MediaPlayerPrivateAVFoundation::prepareToPlay()
+{
+    LOG(Media, "MediaPlayerPrivateAVFoundation::prepareToPlay(%p)", this);
+
+    m_preload = MediaPlayer::Auto;
+    if (m_havePreparedToPlay)
+        return;
+    m_havePreparedToPlay = true;
+
+    m_delayingLoad = false;
+#if ENABLE(OFFLINE_WEB_APPLICATIONS)
+    Frame* frame = m_player->frameView() ? m_player->frameView()->frame() : 0;
+    ApplicationCacheHost* cacheHost = frame ? frame->loader()->documentLoader()->applicationCacheHost() : 0;
+    ApplicationCacheResource* resource = 0;
+    if (cacheHost && cacheHost->shouldLoadResourceFromApplicationCache(ResourceRequest(m_assetURL), resource) && resource)
+        createAVPlayerForCacheResource(resource);
+    else
+#endif    
+    createAVPlayerForURL(m_assetURL);
+    checkPlayability();
+}
+
+void MediaPlayerPrivateAVFoundation::paint(GraphicsContext*, const IntRect&)
+{
+    // This is the base class, only need to remember that a frame has been drawn.
+    m_videoFrameHasDrawn = true;
+}
+
+float MediaPlayerPrivateAVFoundation::duration() const
+{
+    if (!metaDataAvailable())
+        return 0;
+
+    if (m_cachedDuration == invalidTime) {
+        m_cachedDuration = platformDuration();
+        LOG(Media, "MediaPlayerPrivateAVFMac::duration(%p) - caching %f", this, m_cachedDuration);
+    }
+
+    return m_cachedDuration;
+}
+
+void MediaPlayerPrivateAVFoundation::seek(float time)
+{
+    LOG(Media, "MediaPlayerPrivateAVFoundation::seek(%p) - seeking to %f", this, time);
+    if (!metaDataAvailable())
+        return;
+
+    if (time > duration())
+        time = duration();
+
+    m_seekTo = time;
+
+    seekToTime(time);
+}
+
+void MediaPlayerPrivateAVFoundation::setRate(float rate)
+{
+    LOG(Media, "MediaPlayerPrivateAVFoundation::setRate(%p) - seting to %f", this, rate);
+    m_requestedRate = rate;
+}
+
+bool MediaPlayerPrivateAVFoundation::paused() const
+{
+    if (!metaDataAvailable())
+        return true;
+
+    return rate() == 0;
+}
+
+bool MediaPlayerPrivateAVFoundation::seeking() const
+{
+    if (!metaDataAvailable())
+        return false;
+
+    return m_seekTo != invalidTime;
+}
+
+IntSize MediaPlayerPrivateAVFoundation::naturalSize() const
+{
+    if (!metaDataAvailable())
+        return IntSize();
+
+    // In spite of the name of this method, return the natural size transformed by the 
+    // initial movie scale because the spec says intrinsic size is:
+    //
+    //    ... the dimensions of the resource in CSS pixels after taking into account the resource's 
+    //    dimensions, aspect ratio, clean aperture, resolution, and so forth, as defined for the 
+    //    format used by the resource
+
+    return m_cachedNaturalSize;
+}
+
+void MediaPlayerPrivateAVFoundation::setNaturalSize(IntSize size)
+{
+    IntSize oldSize = m_cachedNaturalSize;
+    m_cachedNaturalSize = size;
+    if (oldSize != m_cachedNaturalSize)
+        m_player->sizeChanged();
+}
+
+PassRefPtr<TimeRanges> MediaPlayerPrivateAVFoundation::buffered() const
+{
+    if (!m_cachedLoadedTimeRanges)
+        m_cachedLoadedTimeRanges = platformBufferedTimeRanges();
+
+    return m_cachedLoadedTimeRanges->copy();
+}
+
+float MediaPlayerPrivateAVFoundation::maxTimeSeekable() const
+{
+    if (!metaDataAvailable())
+        return 0;
+
+    if (!m_cachedMaxTimeSeekable)
+        m_cachedMaxTimeSeekable = platformMaxTimeSeekable();
+
+    LOG(Media, "MediaPlayerPrivateAVFoundation::maxTimeSeekable(%p) - returning %f", this, m_cachedMaxTimeSeekable);
+    return m_cachedMaxTimeSeekable;   
+}
+
+float MediaPlayerPrivateAVFoundation::maxTimeLoaded() const
+{
+    if (!metaDataAvailable())
+        return 0;
+
+    if (!m_cachedMaxTimeLoaded)
+        m_cachedMaxTimeLoaded = platformMaxTimeLoaded();
+
+    return m_cachedMaxTimeLoaded;   
+}
+
+unsigned MediaPlayerPrivateAVFoundation::bytesLoaded() const
+{
+    float dur = duration();
+    if (!dur)
+        return 0;
+    unsigned loaded = totalBytes() * maxTimeLoaded() / dur;
+    LOG(Media, "MediaPlayerPrivateAVFoundation::bytesLoaded(%p) - returning %i", this, loaded);
+    return loaded;
+}
+
+bool MediaPlayerPrivateAVFoundation::isReadyForVideoSetup() const
+{
+    return m_isAllowedToRender && m_readyState >= MediaPlayer::HaveMetadata && m_player->visible();
+}
+
+void MediaPlayerPrivateAVFoundation::prepareForRendering()
+{
+    if (m_isAllowedToRender)
+        return;
+    m_isAllowedToRender = true;
+
+    setUpVideoRendering();
+
+    if (currentRenderingMode() == MediaRenderingToLayer || preferredRenderingMode() == MediaRenderingToLayer)
+        m_player->mediaPlayerClient()->mediaPlayerRenderingModeChanged(m_player);
+}
+
+bool MediaPlayerPrivateAVFoundation::supportsFullscreen() const
+{
+#if ENABLE(FULLSCREEN_API)
+    return true;
+#else
+    // FIXME: WebVideoFullscreenController assumes a QTKit/QuickTime media engine
+    return false;
+#endif
+}
+
+void MediaPlayerPrivateAVFoundation::updateStates()
+{
+    MediaPlayer::NetworkState oldNetworkState = m_networkState;
+    MediaPlayer::ReadyState oldReadyState = m_readyState;
+
+    LOG(Media, "MediaPlayerPrivateAVFoundation::updateStates(%p) - entering with networkState = %i, readyState = %i", 
+        this, static_cast<int>(m_networkState), static_cast<int>(m_readyState));
+
+    if (m_loadingMetadata)
+        m_networkState = MediaPlayer::Loading;
+    else {
+        // -loadValuesAsynchronouslyForKeys:completionHandler: has invoked its handler; test status of keys and determine state.
+        AVAssetStatus avAssetStatus = assetStatus();
+        ItemStatus itemStatus = playerItemStatus();
+        
+        m_assetIsPlayable = (avAssetStatus == MediaPlayerAVAssetStatusPlayable);
+        if (m_readyState < MediaPlayer::HaveMetadata && avAssetStatus > MediaPlayerAVAssetStatusLoading) {
+            if (m_assetIsPlayable) {
+                if (itemStatus == MediaPlayerAVPlayerItemStatusUnknown) {
+                    if (avAssetStatus == MediaPlayerAVAssetStatusFailed || m_preload > MediaPlayer::MetaData) {
+                        // We may have a playable asset that doesn't support inspection prior to playback; go ahead 
+                        // and create the AVPlayerItem now. When the AVPlayerItem becomes ready to play, we will 
+                        // have access to its metadata. Or we may have been asked to become ready to play immediately.
+                        m_networkState = MediaPlayer::Loading;
+                        prepareToPlay();
+                    } else
+                        m_networkState = MediaPlayer::Idle;
+                }
+                if (avAssetStatus == MediaPlayerAVAssetStatusLoaded)
+                    m_readyState = MediaPlayer::HaveMetadata;
+            } else {
+                // FIX ME: fetch the error associated with the @"playable" key to distinguish between format 
+                // and network errors.
+                m_networkState = MediaPlayer::FormatError;
+            }
+        }
+        
+        if (avAssetStatus >= MediaPlayerAVAssetStatusLoaded && itemStatus > MediaPlayerAVPlayerItemStatusUnknown) {
+            if (seeking())
+                m_readyState = m_readyState >= MediaPlayer::HaveMetadata ? MediaPlayer::HaveMetadata : MediaPlayer::HaveNothing;
+            else {
+                float maxLoaded = maxTimeLoaded();
+                switch (itemStatus) {
+                case MediaPlayerAVPlayerItemStatusUnknown:
+                    break;
+                case MediaPlayerAVPlayerItemStatusFailed:
+                    m_networkState = MediaPlayer::DecodeError;
+                    break;
+                case MediaPlayerAVPlayerItemStatusPlaybackLikelyToKeepUp:
+                    m_readyState = MediaPlayer::HaveEnoughData;
+                    break;
+                case MediaPlayerAVPlayerItemStatusReadyToPlay:
+                case MediaPlayerAVPlayerItemStatusPlaybackBufferEmpty:
+                case MediaPlayerAVPlayerItemStatusPlaybackBufferFull:
+                    if (maxLoaded > currentTime())
+                        m_readyState = MediaPlayer::HaveFutureData;
+                    else
+                        m_readyState = MediaPlayer::HaveCurrentData;
+                    break;
+                }
+
+                if (itemStatus >= MediaPlayerAVPlayerItemStatusReadyToPlay)
+                    m_networkState = (maxLoaded == duration()) ? MediaPlayer::Loaded : MediaPlayer::Loading;
+            }
+        }
+    }
+
+    if (isReadyForVideoSetup() && currentRenderingMode() != preferredRenderingMode())
+        setUpVideoRendering();
+
+    if (m_networkState != oldNetworkState)
+        m_player->networkStateChanged();
+
+    if (m_readyState != oldReadyState)
+        m_player->readyStateChanged();
+
+    LOG(Media, "MediaPlayerPrivateAVFoundation::updateStates(%p) - exiting with networkState = %i, readyState = %i", 
+        this, static_cast<int>(m_networkState), static_cast<int>(m_readyState));
+}
+
+void MediaPlayerPrivateAVFoundation::setSize(const IntSize&) 
+{ 
+}
+
+void MediaPlayerPrivateAVFoundation::setVisible(bool visible)
+{
+    if (m_visible == visible)
+        return;
+
+    m_visible = visible;
+    if (visible)
+        setUpVideoRendering();
+    else
+        tearDownVideoRendering();
+}
+
+bool MediaPlayerPrivateAVFoundation::hasAvailableVideoFrame() const
+{
+    if (currentRenderingMode() == MediaRenderingToLayer)
+        return videoLayerIsReadyToDisplay();
+
+    // When using the software renderer we hope someone will signal that a frame is available so we might as well
+    // wait until we know that a frame has been drawn.
+    return m_videoFrameHasDrawn;
+}
+
+void MediaPlayerPrivateAVFoundation::acceleratedRenderingStateChanged()
+{
+    // Set up or change the rendering path if necessary.
+    setUpVideoRendering();
+}
+
+void MediaPlayerPrivateAVFoundation::metadataLoaded()
+{
+    m_loadingMetadata = false;
+    updateStates();
+}
+
+void MediaPlayerPrivateAVFoundation::loadStateChanged()
+{
+    if (m_ignoreLoadStateChanges)
+        return;
+    updateStates();
+}
+
+void MediaPlayerPrivateAVFoundation::rateChanged()
+{
+    updateStates();
+    m_player->rateChanged();
+}
+
+void MediaPlayerPrivateAVFoundation::loadedTimeRangesChanged()
+{
+    m_cachedLoadedTimeRanges = 0;
+    m_cachedMaxTimeLoaded = 0;
+    updateStates();
+
+    // For some media files, reported duration is estimated and updated as media is loaded
+    // so report duration changed when the estimate is upated.
+    float dur = duration();
+    if (dur != m_reportedDuration) {
+        if (m_reportedDuration != invalidTime)
+            m_player->durationChanged();
+        m_reportedDuration = dur;
+    }
+}
+
+void MediaPlayerPrivateAVFoundation::seekableTimeRangesChanged()
+{
+    m_cachedMaxTimeSeekable = 0;
+}
+
+void MediaPlayerPrivateAVFoundation::timeChanged(double time)
+{
+    LOG(Media, "MediaPlayerPrivateAVFoundation::timeChanged(%p) - time = %f", this, time);
+
+    if (m_seekTo == invalidTime)
+        return;
+
+    // AVFoundation may call our observer more than once during a seek, and we can't currently tell
+    // if we will be able to seek to an exact time, so assume that we are done seeking if we are
+    // "close enough" to the seek time.
+    const double smallSeekDelta = 1.0 / 100;
+
+    float currentRate = rate();
+    if ((currentRate > 0 && time >= m_seekTo) || (currentRate < 0 && time <= m_seekTo) || (abs(m_seekTo - time) <= smallSeekDelta)) {
+        m_seekTo = invalidTime;
+        updateStates();
+        m_player->timeChanged();
+    }
+}
+
+void MediaPlayerPrivateAVFoundation::didEnd()
+{
+    // Hang onto the current time and use it as duration from now on since we are definitely at
+    // the end of the movie. Do this because the initial duration is sometimes an estimate.
+    float now = currentTime();
+    if (now > 0)
+        m_cachedDuration = now;
+
+    updateStates();
+    m_player->timeChanged();
+}
+
+void MediaPlayerPrivateAVFoundation::repaint()
+{
+    m_videoFrameHasDrawn = true;
+    m_player->repaint();
+}
+
+MediaPlayer::MovieLoadType MediaPlayerPrivateAVFoundation::movieLoadType() const
+{
+    if (!metaDataAvailable() || assetStatus() == MediaPlayerAVAssetStatusUnknown)
+        return MediaPlayer::Unknown;
+
+    if (isinf(duration()))
+        return MediaPlayer::LiveStream;
+
+    return MediaPlayer::Download;
+}
+
+void MediaPlayerPrivateAVFoundation::setPreload(MediaPlayer::Preload preload)
+{
+    m_preload = preload;
+    if (m_delayingLoad && m_preload != MediaPlayer::None)
+        resumeLoad();
+}
+
+void MediaPlayerPrivateAVFoundation::setDelayCallbacks(bool delay)
+{
+    MutexLocker lock(m_queueMutex);
+    if (delay)
+        ++m_delayCallbacks;
+    else {
+        ASSERT(m_delayCallbacks);
+        --m_delayCallbacks;
+    }
+}
+
+void MediaPlayerPrivateAVFoundation::mainThreadCallback(void* context)
+{
+    LOG(Media, "MediaPlayerPrivateAVFoundation::mainThreadCallback(%p)", context);
+    MediaPlayerPrivateAVFoundation* player = static_cast<MediaPlayerPrivateAVFoundation*>(context);
+    player->clearMainThreadPendingFlag();
+    player->dispatchNotification();
+}
+
+void MediaPlayerPrivateAVFoundation::clearMainThreadPendingFlag()
+{
+    MutexLocker lock(m_queueMutex);
+    m_mainThreadCallPending = false;
+}
+
+void MediaPlayerPrivateAVFoundation::scheduleMainThreadNotification(Notification::Type type, double time)
+{
+    LOG(Media, "MediaPlayerPrivateAVFoundation::scheduleMainThreadNotification(%p) - notification %d", this, static_cast<int>(type));
+    m_queueMutex.lock();
+
+    // It is important to always process the properties in the order that we are notified, 
+    // so always go through the queue because notifications happen on different threads.
+    m_queuedNotifications.append(Notification(type, time));
+
+    bool delayDispatch = m_delayCallbacks || !isMainThread();
+    if (delayDispatch && !m_mainThreadCallPending) {
+        m_mainThreadCallPending = true;
+        callOnMainThread(mainThreadCallback, this);
+    }
+
+    m_queueMutex.unlock();
+
+    if (delayDispatch) {
+        LOG(Media, "MediaPlayerPrivateAVFoundation::scheduleMainThreadNotification(%p) - early return", this);
+        return;
+    }
+
+    dispatchNotification();
+}
+
+void MediaPlayerPrivateAVFoundation::dispatchNotification()
+{
+    ASSERT(isMainThread());
+
+    Notification notification = Notification();
+    {
+        MutexLocker lock(m_queueMutex);
+        
+        if (m_queuedNotifications.isEmpty())
+            return;
+        
+        if (!m_delayCallbacks) {
+            // Only dispatch one notification callback per invocation because they can cause recursion.
+            notification = m_queuedNotifications.first();
+            m_queuedNotifications.remove(0);
+        }
+        
+        if (!m_queuedNotifications.isEmpty() && !m_mainThreadCallPending)
+            callOnMainThread(mainThreadCallback, this);
+        
+        if (!notification.isValid())
+            return;
+    }
+
+    LOG(Media, "MediaPlayerPrivateAVFoundation::dispatchNotification(%p) - dispatching %d", this, static_cast<int>(notification.type()));
+
+    switch (notification.type()) {
+    case Notification::ItemDidPlayToEndTime:
+        didEnd();
+        break;
+    case Notification::ItemTracksChanged:
+        tracksChanged();
+        break;
+    case Notification::ItemStatusChanged:
+        loadStateChanged();
+        break;
+    case Notification::ItemSeekableTimeRangesChanged:
+        seekableTimeRangesChanged();
+        loadStateChanged();
+        break;
+    case Notification::ItemLoadedTimeRangesChanged:
+        loadedTimeRangesChanged();
+        loadStateChanged();
+        break;
+    case Notification::ItemPresentationSizeChanged:
+        sizeChanged();
+        break;
+    case Notification::ItemIsPlaybackLikelyToKeepUpChanged:
+        loadStateChanged();
+        break;
+    case Notification::ItemIsPlaybackBufferEmptyChanged:
+        loadStateChanged();
+        break;
+    case Notification::ItemIsPlaybackBufferFullChanged:
+        loadStateChanged();
+        break;
+    case Notification::PlayerRateChanged:
+        rateChanged();
+        break;
+    case Notification::PlayerTimeChanged:
+        timeChanged(notification.time());
+        break;
+    case Notification::AssetMetadataLoaded:
+        metadataLoaded();
+        break;
+    case Notification::AssetPlayabilityKnown:
+        playabilityKnown();
+        break;
+    case Notification::None:
+        ASSERT_NOT_REACHED();
+        break;
+    }
+}
+
+} // namespace WebCore
+
+#endif
diff --git a/Source/WebCore/platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.h b/Source/WebCore/platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.h
new file mode 100644
index 0000000..a768ab4
--- /dev/null
+++ b/Source/WebCore/platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.h
@@ -0,0 +1,262 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef MediaPlayerPrivateAVFoundation_h
+#define MediaPlayerPrivateAVFoundation_h
+
+#if ENABLE(VIDEO) && USE(AVFOUNDATION)
+
+#include "FloatSize.h"
+#include "MediaPlayerPrivate.h"
+#include "Timer.h"
+#include <wtf/RetainPtr.h>
+
+namespace WebCore {
+
+class ApplicationCacheResource;
+
+class MediaPlayerPrivateAVFoundation : public MediaPlayerPrivateInterface {
+public:
+
+    virtual void repaint();
+    virtual void metadataLoaded();
+    virtual void loadStateChanged();
+    virtual void playabilityKnown();
+    virtual void rateChanged();
+    virtual void loadedTimeRangesChanged();
+    virtual void seekableTimeRangesChanged();
+    virtual void timeChanged(double);
+    virtual void didEnd();
+
+    class Notification {
+    public:
+        enum Type {
+            None,
+            ItemDidPlayToEndTime,
+            ItemTracksChanged,
+            ItemStatusChanged,
+            ItemSeekableTimeRangesChanged,
+            ItemLoadedTimeRangesChanged,
+            ItemPresentationSizeChanged,
+            ItemIsPlaybackLikelyToKeepUpChanged,
+            ItemIsPlaybackBufferEmptyChanged,
+            ItemIsPlaybackBufferFullChanged,
+            AssetMetadataLoaded,
+            AssetPlayabilityKnown,
+            PlayerRateChanged,
+            PlayerTimeChanged
+        };
+        
+        Notification()
+            : m_type(None)
+            , m_time(0)
+        {
+        }
+
+        Notification(Type type, double time)
+            : m_type(type)
+            , m_time(time)
+        {
+        }
+        
+        Type type() { return m_type; }
+        bool isValid() { return m_type != None; }
+        double time() { return m_time; }
+        
+    private:
+        Type m_type;
+        double m_time;
+    };
+
+    void scheduleMainThreadNotification(Notification::Type, double time = 0);
+    void dispatchNotification();
+    void clearMainThreadPendingFlag();
+
+protected:
+    MediaPlayerPrivateAVFoundation(MediaPlayer*);
+    virtual ~MediaPlayerPrivateAVFoundation();
+
+    // MediaPlayerPrivatePrivateInterface overrides.
+    virtual void load(const String& url);
+    virtual void cancelLoad() = 0;
+
+    virtual void prepareToPlay();
+    virtual PlatformMedia platformMedia() const = 0;
+
+    virtual void play() = 0;
+    virtual void pause() = 0;
+
+    virtual IntSize naturalSize() const;
+    virtual bool hasVideo() const { return m_cachedHasVideo; }
+    virtual bool hasAudio() const { return m_cachedHasAudio; }
+    virtual void setVisible(bool);
+    virtual float duration() const;
+    virtual float currentTime() const = 0;
+    virtual void seek(float);
+    virtual bool seeking() const;
+    virtual void setRate(float);
+    virtual bool paused() const;
+    virtual void setVolume(float) = 0;
+    virtual bool hasClosedCaptions() const { return m_cachedHasCaptions; }
+    virtual void setClosedCaptionsVisible(bool) = 0;
+    virtual MediaPlayer::NetworkState networkState() const { return m_networkState; }
+    virtual MediaPlayer::ReadyState readyState() const { return m_readyState; }
+    virtual float maxTimeSeekable() const;
+    virtual PassRefPtr<TimeRanges> buffered() const;
+    virtual unsigned bytesLoaded() const;
+    virtual void setSize(const IntSize&);
+    virtual void paint(GraphicsContext*, const IntRect&);
+    virtual void paintCurrentFrameInContext(GraphicsContext*, const IntRect&) = 0;
+    virtual void setPreload(MediaPlayer::Preload);
+    virtual bool hasAvailableVideoFrame() const;
+#if USE(ACCELERATED_COMPOSITING)
+    virtual PlatformLayer* platformLayer() const { return 0; }
+    virtual bool supportsAcceleratedRendering() const = 0;
+    virtual void acceleratedRenderingStateChanged();
+#endif
+    virtual bool hasSingleSecurityOrigin() const { return true; }
+    virtual MediaPlayer::MovieLoadType movieLoadType() const;
+    virtual void prepareForRendering();
+    virtual float mediaTimeForTimeValue(float) const = 0;
+
+    virtual bool supportsFullscreen() const;
+
+    // Required interfaces for concrete derived classes.
+    virtual void createAVPlayerForURL(const String& url) = 0;
+#if ENABLE(OFFLINE_WEB_APPLICATIONS)
+    virtual void createAVPlayerForCacheResource(ApplicationCacheResource*) = 0;
+#endif
+
+    enum ItemStatus {
+        MediaPlayerAVPlayerItemStatusUnknown,
+        MediaPlayerAVPlayerItemStatusFailed,
+        MediaPlayerAVPlayerItemStatusReadyToPlay,
+        MediaPlayerAVPlayerItemStatusPlaybackBufferEmpty,
+        MediaPlayerAVPlayerItemStatusPlaybackBufferFull,
+        MediaPlayerAVPlayerItemStatusPlaybackLikelyToKeepUp,
+    };
+    virtual ItemStatus playerItemStatus() const = 0;
+
+    enum AVAssetStatus {
+        MediaPlayerAVAssetStatusUnknown,
+        MediaPlayerAVAssetStatusLoading,
+        MediaPlayerAVAssetStatusFailed,
+        MediaPlayerAVAssetStatusCancelled,
+        MediaPlayerAVAssetStatusLoaded,
+        MediaPlayerAVAssetStatusPlayable,
+    };
+    virtual AVAssetStatus assetStatus() const = 0;
+
+    virtual void checkPlayability() = 0;
+    virtual float rate() const = 0;
+    virtual void seekToTime(float time) = 0;
+    virtual unsigned totalBytes() const = 0;
+    virtual PassRefPtr<TimeRanges> platformBufferedTimeRanges() const = 0;
+    virtual float platformMaxTimeSeekable() const = 0;
+    virtual float platformMaxTimeLoaded() const = 0;
+    virtual float platformDuration() const = 0;
+
+    virtual void beginLoadingMetadata() = 0;
+    virtual void tracksChanged() = 0;
+    virtual void sizeChanged() = 0;
+
+    virtual void createContextVideoRenderer() = 0;
+    virtual void destroyContextVideoRenderer() = 0;
+
+    virtual void createVideoLayer() = 0;
+    virtual void destroyVideoLayer() = 0;
+    virtual bool videoLayerIsReadyToDisplay() const = 0;
+
+    virtual bool hasContextRenderer() const = 0;
+    virtual bool hasLayerRenderer() const = 0;
+
+protected:
+    void resumeLoad();
+    void updateStates();
+
+    void setHasVideo(bool b) { m_cachedHasVideo = b; };
+    void setHasAudio(bool b) { m_cachedHasAudio = b; }
+    void setHasClosedCaptions(bool b) { m_cachedHasCaptions = b; }
+    void setDelayCallbacks(bool);
+    void setIgnoreLoadStateChanges(bool delay) { m_ignoreLoadStateChanges = delay; }
+    void setNaturalSize(IntSize);
+
+    enum MediaRenderingMode { MediaRenderingNone, MediaRenderingToContext, MediaRenderingToLayer };
+    MediaRenderingMode currentRenderingMode() const;
+    MediaRenderingMode preferredRenderingMode() const;
+
+    bool metaDataAvailable() const { return m_readyState >= MediaPlayer::HaveMetadata; }
+    float requestedRate() const { return m_requestedRate; }
+    float maxTimeLoaded() const;
+    bool isReadyForVideoSetup() const;
+    virtual void setUpVideoRendering();
+    virtual void tearDownVideoRendering();
+    bool hasSetUpVideoRendering() const;
+
+    static void mainThreadCallback(void*);
+
+private:
+
+    MediaPlayer* m_player;
+
+    Vector<Notification> m_queuedNotifications;
+    Mutex m_queueMutex;
+    bool m_mainThreadCallPending;
+
+    mutable RefPtr<TimeRanges> m_cachedLoadedTimeRanges;
+
+    MediaPlayer::NetworkState m_networkState;
+    MediaPlayer::ReadyState m_readyState;
+
+    String m_assetURL;
+    MediaPlayer::Preload m_preload;
+    FloatSize m_scaleFactor;
+
+    IntSize m_cachedNaturalSize;
+    mutable float m_cachedMaxTimeLoaded;
+    mutable float m_cachedMaxTimeSeekable;
+    mutable float m_cachedDuration;
+    float m_reportedDuration;
+
+    float m_seekTo;
+    float m_requestedRate;
+    int m_delayCallbacks;
+    bool m_havePreparedToPlay;
+    bool m_assetIsPlayable;
+    bool m_visible;
+    bool m_videoFrameHasDrawn;
+    bool m_loadingMetadata;
+    bool m_delayingLoad;
+    bool m_isAllowedToRender;
+    bool m_cachedHasAudio;
+    bool m_cachedHasVideo;
+    bool m_cachedHasCaptions;
+    bool m_ignoreLoadStateChanges;
+};
+
+}
+
+#endif
+#endif
diff --git a/Source/WebCore/platform/graphics/avfoundation/MediaPlayerPrivateAVFoundationObjC.h b/Source/WebCore/platform/graphics/avfoundation/MediaPlayerPrivateAVFoundationObjC.h
new file mode 100644
index 0000000..cc00c15
--- /dev/null
+++ b/Source/WebCore/platform/graphics/avfoundation/MediaPlayerPrivateAVFoundationObjC.h
@@ -0,0 +1,131 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef MediaPlayerPrivateAVFoundationObjC_h
+#define MediaPlayerPrivateAVFoundationObjC_h
+
+#if ENABLE(VIDEO) && USE(AVFOUNDATION)
+
+#include "MediaPlayerPrivateAVFoundation.h"
+
+#ifdef __OBJC__
+@class AVAsset;
+@class AVPlayer;
+@class AVPlayerItem;
+@class AVPlayerLayer;
+@class AVAssetImageGenerator;
+@class WebCoreAVFMovieObserver;
+#else
+class AVAsset;
+class AVPlayer;
+class AVPlayerItem;
+class AVPlayerLayer;
+class AVAssetImageGenerator;
+class WebCoreAVFMovieObserver;
+typedef struct objc_object *id;
+#endif
+
+namespace WebCore {
+
+class ApplicationCacheResource;
+
+class MediaPlayerPrivateAVFoundationObjC : public MediaPlayerPrivateAVFoundation {
+public:
+
+    static void registerMediaEngine(MediaEngineRegistrar);
+
+    void setAsset(id);
+    virtual void tracksChanged();
+
+private:
+    MediaPlayerPrivateAVFoundationObjC(MediaPlayer*);
+    ~MediaPlayerPrivateAVFoundationObjC();
+
+    // engine support
+    static MediaPlayerPrivateInterface* create(MediaPlayer* player);
+    static void getSupportedTypes(HashSet<String>& types);
+    static MediaPlayer::SupportsType supportsType(const String& type, const String& codecs);
+    static bool isAvailable();
+
+    virtual void cancelLoad();
+
+    virtual PlatformMedia platformMedia() const;
+
+    virtual void play();
+    virtual void pause();
+    virtual float currentTime() const;
+    virtual void setVolume(float);
+    virtual void setClosedCaptionsVisible(bool);
+    virtual void paint(GraphicsContext*, const IntRect&);
+    virtual void paintCurrentFrameInContext(GraphicsContext*, const IntRect&);
+    virtual PlatformLayer* platformLayer() const;
+    virtual bool supportsAcceleratedRendering() const { return true; }
+    virtual float mediaTimeForTimeValue(float) const;
+
+    virtual void createAVPlayer();
+    virtual void createAVPlayerForURL(const String& url);
+#if ENABLE(OFFLINE_WEB_APPLICATIONS)
+    virtual void createAVPlayerForCacheResource(ApplicationCacheResource*);
+#endif
+    virtual MediaPlayerPrivateAVFoundation::ItemStatus playerItemStatus() const;
+    virtual MediaPlayerPrivateAVFoundation::AVAssetStatus assetStatus() const;
+
+    virtual void checkPlayability();
+    virtual float rate() const;
+    virtual void seekToTime(float time);
+    virtual unsigned totalBytes() const;
+    virtual PassRefPtr<TimeRanges> platformBufferedTimeRanges() const;
+    virtual float platformMaxTimeSeekable() const;
+    virtual float platformDuration() const;
+    virtual float platformMaxTimeLoaded() const;
+    virtual void beginLoadingMetadata();
+    virtual void sizeChanged();
+
+    virtual void createContextVideoRenderer();
+    virtual void destroyContextVideoRenderer();
+
+    virtual void createVideoLayer();
+    virtual void destroyVideoLayer();
+    virtual bool videoLayerIsReadyToDisplay() const;
+
+    virtual bool hasContextRenderer() const;
+    virtual bool hasLayerRenderer() const;
+
+    RetainPtr<CGImageRef> createImageForTimeInRect(float, const IntRect&);
+
+    MediaPlayer* m_player;
+    RetainPtr<AVAsset> m_avAsset;
+    RetainPtr<AVPlayer> m_avPlayer;
+    RetainPtr<AVPlayerItem> m_avPlayerItem;
+    RetainPtr<AVPlayerLayer> m_videoLayer;
+    RetainPtr<WebCoreAVFMovieObserver> m_objcObserver;
+    RetainPtr<AVAssetImageGenerator> m_imageGenerator;
+    id m_timeObserver;
+};
+
+}
+
+#endif
+#endif
diff --git a/Source/WebCore/platform/graphics/avfoundation/MediaPlayerPrivateAVFoundationObjC.mm b/Source/WebCore/platform/graphics/avfoundation/MediaPlayerPrivateAVFoundationObjC.mm
new file mode 100644
index 0000000..55eb433
--- /dev/null
+++ b/Source/WebCore/platform/graphics/avfoundation/MediaPlayerPrivateAVFoundationObjC.mm
@@ -0,0 +1,811 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#import "config.h"
+
+#if ENABLE(VIDEO) && USE(AVFOUNDATION)
+
+#import "MediaPlayerPrivateAVFoundationObjC.h"
+
+#import "ApplicationCacheResource.h"
+#import "BlockExceptions.h"
+#import "FloatConversion.h"
+#import "FrameView.h"
+#import "FloatConversion.h"
+#import "GraphicsContext.h"
+#import "KURL.h"
+#import "Logging.h"
+#import "SoftLinking.h"
+#import "TimeRanges.h"
+#import "WebCoreSystemInterface.h"
+#import <objc/objc-runtime.h>
+#import <wtf/UnusedParam.h>
+
+#import <CoreMedia/CoreMedia.h>
+#import <AVFoundation/AVFoundation.h>
+
+SOFT_LINK_FRAMEWORK(AVFoundation)
+SOFT_LINK_FRAMEWORK(CoreMedia)
+
+SOFT_LINK(CoreMedia, CMTimeCompare, int32_t, (CMTime time1, CMTime time2), (time1, time2))
+SOFT_LINK(CoreMedia, CMTimeMakeWithSeconds, CMTime, (Float64 seconds, int32_t preferredTimeScale), (seconds, preferredTimeScale))
+SOFT_LINK(CoreMedia, CMTimeGetSeconds, Float64, (CMTime time), (time))
+SOFT_LINK(CoreMedia, CMTimeRangeGetEnd, CMTime, (CMTimeRange range), (range))
+
+SOFT_LINK_CLASS(AVFoundation, AVPlayer)
+SOFT_LINK_CLASS(AVFoundation, AVPlayerItem)
+SOFT_LINK_CLASS(AVFoundation, AVPlayerLayer)
+SOFT_LINK_CLASS(AVFoundation, AVURLAsset)
+SOFT_LINK_CLASS(AVFoundation, AVAssetImageGenerator)
+
+SOFT_LINK_POINTER(AVFoundation, AVMediaCharacteristicVisual, NSString *)
+SOFT_LINK_POINTER(AVFoundation, AVMediaCharacteristicAudible, NSString *)
+SOFT_LINK_POINTER(AVFoundation, AVMediaTypeClosedCaption, NSString *)
+SOFT_LINK_POINTER(AVFoundation, AVPlayerItemDidPlayToEndTimeNotification, NSString *)
+SOFT_LINK_POINTER(AVFoundation, AVAssetImageGeneratorApertureModeCleanAperture, NSString *)
+
+SOFT_LINK_CONSTANT(CoreMedia, kCMTimeZero, CMTime)
+
+#define AVPlayer getAVPlayerClass()
+#define AVPlayerItem getAVPlayerItemClass()
+#define AVPlayerLayer getAVPlayerLayerClass()
+#define AVURLAsset getAVURLAssetClass()
+#define AVAssetImageGenerator getAVAssetImageGeneratorClass()
+
+#define AVMediaCharacteristicVisual getAVMediaCharacteristicVisual()
+#define AVMediaCharacteristicAudible getAVMediaCharacteristicAudible()
+#define AVMediaTypeClosedCaption getAVMediaTypeClosedCaption()
+#define AVPlayerItemDidPlayToEndTimeNotification getAVPlayerItemDidPlayToEndTimeNotification()
+#define AVAssetImageGeneratorApertureModeCleanAperture getAVAssetImageGeneratorApertureModeCleanAperture()
+
+#define kCMTimeZero getkCMTimeZero()
+
+using namespace WebCore;
+using namespace std;
+
+enum MediaPlayerAVFoundationObservationContext {
+    MediaPlayerAVFoundationObservationContextPlayerItem,
+    MediaPlayerAVFoundationObservationContextPlayer
+};
+
+@interface WebCoreAVFMovieObserver : NSObject
+{
+    MediaPlayerPrivateAVFoundationObjC* m_callback;
+    int m_delayCallbacks;
+}
+-(id)initWithCallback:(MediaPlayerPrivateAVFoundationObjC*)callback;
+-(void)disconnect;
+-(void)playableKnown;
+-(void)metadataLoaded;
+-(void)timeChanged:(double)time;
+-(void)didEnd:(NSNotification *)notification;
+-(void)observeValueForKeyPath:keyPath ofObject:(id)object change:(NSDictionary *)change context:(MediaPlayerAVFoundationObservationContext)context;
+@end
+
+namespace WebCore {
+
+static NSArray *assetMetadataKeyNames();
+static NSArray *itemKVOProperties();
+
+#if !LOG_DISABLED
+static const char *boolString(bool val)
+{
+    return val ? "true" : "false";
+}
+#endif
+
+static const float invalidTime = -1.0f;
+
+MediaPlayerPrivateInterface* MediaPlayerPrivateAVFoundationObjC::create(MediaPlayer* player) 
+{ 
+    return new MediaPlayerPrivateAVFoundationObjC(player);
+}
+
+void MediaPlayerPrivateAVFoundationObjC::registerMediaEngine(MediaEngineRegistrar registrar)
+{
+    if (isAvailable())
+        registrar(create, getSupportedTypes, supportsType, 0, 0, 0);
+}
+
+MediaPlayerPrivateAVFoundationObjC::MediaPlayerPrivateAVFoundationObjC(MediaPlayer* player)
+    : MediaPlayerPrivateAVFoundation(player)
+    , m_objcObserver(AdoptNS, [[WebCoreAVFMovieObserver alloc] initWithCallback:this])
+    , m_timeObserver(0)
+{
+}
+
+MediaPlayerPrivateAVFoundationObjC::~MediaPlayerPrivateAVFoundationObjC()
+{
+    cancelLoad();
+    [m_objcObserver.get() disconnect];
+}
+
+void MediaPlayerPrivateAVFoundationObjC::cancelLoad()
+{
+    LOG(Media, "MediaPlayerPrivateAVFoundationObjC::cancelLoad(%p)", this);
+    tearDownVideoRendering();
+
+    [[NSNotificationCenter defaultCenter] removeObserver:m_objcObserver.get()];
+
+    // Tell our observer to do nothing when our cancellation of pending loading calls its completion handler.
+    setIgnoreLoadStateChanges(true);
+    if (m_avAsset) {
+        [m_avAsset.get() cancelLoading];
+        m_avAsset = nil;
+    }
+    if (m_avPlayerItem) {
+        for (NSString *keyName in itemKVOProperties())
+            [m_avPlayerItem.get() removeObserver:m_objcObserver.get() forKeyPath:keyName];
+        
+        m_avPlayerItem = nil;
+    }
+    if (m_avPlayer) {
+        if (m_timeObserver)
+            [m_avPlayer.get() removeTimeObserver:m_timeObserver];
+        [m_avPlayer.get() removeObserver:m_objcObserver.get() forKeyPath:@"rate"];
+        m_avPlayer = nil;
+    }
+    setIgnoreLoadStateChanges(false);
+}
+
+bool MediaPlayerPrivateAVFoundationObjC::hasLayerRenderer() const
+{
+    return m_videoLayer;
+}
+
+bool MediaPlayerPrivateAVFoundationObjC::hasContextRenderer() const
+{
+    return m_imageGenerator;
+}
+
+void MediaPlayerPrivateAVFoundationObjC::createContextVideoRenderer()
+{
+    LOG(Media, "MediaPlayerPrivateAVFoundationObjC::createContextVideoRenderer(%p)", this);
+
+    if (!m_avAsset || m_imageGenerator)
+        return;
+
+    m_imageGenerator = [AVAssetImageGenerator assetImageGeneratorWithAsset:m_avAsset.get()];
+
+    [m_imageGenerator.get() setApertureMode:AVAssetImageGeneratorApertureModeCleanAperture];
+    [m_imageGenerator.get() setAppliesPreferredTrackTransform:YES];
+
+    LOG(Media, "MediaPlayerPrivateAVFoundationObjC::createImageGenerator(%p) - returning %p", this, m_imageGenerator.get());
+}
+
+void MediaPlayerPrivateAVFoundationObjC::destroyContextVideoRenderer()
+{
+    if (!m_imageGenerator)
+        return;
+
+    LOG(Media, "MediaPlayerPrivateAVFoundationObjC::destroyContextVideoRenderer(%p) - destroying", this, m_imageGenerator.get());
+
+    m_imageGenerator = 0;
+}
+
+void MediaPlayerPrivateAVFoundationObjC::createVideoLayer()
+{
+    if (!m_avPlayer)
+        return;
+
+    if (!m_videoLayer) {
+        m_videoLayer.adoptNS([[AVPlayerLayer alloc] init]);
+        [m_videoLayer.get() setPlayer:m_avPlayer.get()];
+        LOG(Media, "MediaPlayerPrivateAVFoundationObjC::createVideoLayer(%p) - returning", this, m_videoLayer.get());
+    }
+}
+
+void MediaPlayerPrivateAVFoundationObjC::destroyVideoLayer()
+{
+    if (!m_videoLayer)
+        return;
+
+    LOG(Media, "MediaPlayerPrivateAVFoundationObjC::destroyVideoLayer(%p) - destroying", this, m_videoLayer.get());
+
+    [m_videoLayer.get() setPlayer:nil];
+
+    m_videoLayer = 0;
+}
+
+bool MediaPlayerPrivateAVFoundationObjC::videoLayerIsReadyToDisplay() const
+{
+    return (m_videoLayer && [m_videoLayer.get() isReadyForDisplay]);
+}
+
+void MediaPlayerPrivateAVFoundationObjC::createAVPlayerForURL(const String& url)
+{
+    setDelayCallbacks(true);
+
+    if (!m_avAsset) {
+        NSURL *cocoaURL = KURL(ParsedURLString, url);
+        m_avAsset.adoptNS([[AVURLAsset alloc] initWithURL:cocoaURL options:nil]);
+    }
+    
+    createAVPlayer();
+}
+
+#if ENABLE(OFFLINE_WEB_APPLICATIONS)
+void MediaPlayerPrivateAVFoundationObjC::createAVPlayerForCacheResource(ApplicationCacheResource* resource)
+{
+    // AVFoundation can't open arbitrary data pointers, so if this ApplicationCacheResource doesn't 
+    // have a valid local path, just open the resource's original URL.
+    if (resource->path().isEmpty()) {
+        createAVPlayerForURL(resource->url());
+        return;
+    }
+    
+    setDelayCallbacks(true);
+
+    if (!m_avAsset) {
+        NSURL* localURL = [NSURL fileURLWithPath:resource->path()];
+        m_avAsset.adoptNS([[AVURLAsset alloc] initWithURL:localURL options:nil]);
+    }
+
+    createAVPlayer();
+}
+#endif
+
+void MediaPlayerPrivateAVFoundationObjC::createAVPlayer()
+{
+    if (!m_avPlayer) {
+        m_avPlayer.adoptNS([[AVPlayer alloc] init]);
+        
+        [m_avPlayer.get() addObserver:m_objcObserver.get() forKeyPath:@"rate" options:nil context:(void *)MediaPlayerAVFoundationObservationContextPlayer];
+        
+        // Add a time observer, ask to be called infrequently because we don't really want periodic callbacks but
+        // our observer will also be called whenever a seek happens.
+        const double veryLongInterval = 60*60*60*24*30;
+        WebCoreAVFMovieObserver *observer = m_objcObserver.get();
+        m_timeObserver = [m_avPlayer.get() addPeriodicTimeObserverForInterval:CMTimeMakeWithSeconds(veryLongInterval, 10) queue:nil usingBlock:^(CMTime time){
+            [observer timeChanged:CMTimeGetSeconds(time)];
+        }];
+    }
+
+    if (!m_avPlayerItem) {
+        // Create the player item so we can media data. 
+        m_avPlayerItem.adoptNS([[AVPlayerItem alloc] initWithAsset:m_avAsset.get()]);
+        
+        [[NSNotificationCenter defaultCenter] addObserver:m_objcObserver.get()selector:@selector(didEnd:) name:AVPlayerItemDidPlayToEndTimeNotification object:m_avPlayerItem.get()];
+
+        for (NSString *keyName in itemKVOProperties())
+            [m_avPlayerItem.get() addObserver:m_objcObserver.get() forKeyPath:keyName options:nil context:(void *)MediaPlayerAVFoundationObservationContextPlayerItem];
+
+        [m_avPlayer.get() replaceCurrentItemWithPlayerItem:m_avPlayerItem.get()];
+    }
+
+    setDelayCallbacks(false);
+}
+
+void MediaPlayerPrivateAVFoundationObjC::checkPlayability()
+{
+    LOG(Media, "MediaPlayerPrivateAVFoundationObjC::checkPlayability(%p)", this);
+
+    [m_avAsset.get() loadValuesAsynchronouslyForKeys:[NSArray arrayWithObject:@"playable"] completionHandler:^{
+        [m_objcObserver.get() playableKnown];
+    }];
+}
+
+void MediaPlayerPrivateAVFoundationObjC::beginLoadingMetadata()
+{
+    LOG(Media, "MediaPlayerPrivateAVFoundationObjC::playabilityKnown(%p) - requesting metadata loading", this);
+    [m_avAsset.get() loadValuesAsynchronouslyForKeys:[assetMetadataKeyNames() retain] completionHandler:^{
+        [m_objcObserver.get() metadataLoaded];
+    }];
+}
+
+MediaPlayerPrivateAVFoundation::ItemStatus MediaPlayerPrivateAVFoundationObjC::playerItemStatus() const
+{
+    if (!m_avPlayerItem)
+        return MediaPlayerPrivateAVFoundation::MediaPlayerAVPlayerItemStatusUnknown;
+
+    AVPlayerItemStatus status = [m_avPlayerItem.get() status];
+    if (status == AVPlayerItemStatusUnknown)
+        return MediaPlayerPrivateAVFoundation::MediaPlayerAVPlayerItemStatusUnknown;
+    if (status == AVPlayerItemStatusFailed)
+        return MediaPlayerPrivateAVFoundation::MediaPlayerAVPlayerItemStatusFailed;
+    if ([m_avPlayerItem.get() isPlaybackLikelyToKeepUp])
+        return MediaPlayerPrivateAVFoundation::MediaPlayerAVPlayerItemStatusPlaybackLikelyToKeepUp;
+    if ([m_avPlayerItem.get() isPlaybackBufferFull])
+        return MediaPlayerPrivateAVFoundation::MediaPlayerAVPlayerItemStatusPlaybackBufferFull;
+    if ([m_avPlayerItem.get() isPlaybackBufferEmpty])
+        return MediaPlayerPrivateAVFoundation::MediaPlayerAVPlayerItemStatusPlaybackBufferEmpty;
+
+    return MediaPlayerPrivateAVFoundation::MediaPlayerAVPlayerItemStatusReadyToPlay;
+}
+
+PlatformMedia MediaPlayerPrivateAVFoundationObjC::platformMedia() const
+{
+    LOG(Media, "MediaPlayerPrivateAVFoundationObjC::platformMedia(%p)", this);
+    PlatformMedia pm;
+    pm.type = PlatformMedia::AVFoundationMediaPlayerType;
+    pm.media.avfMediaPlayer = m_avPlayer.get();
+    return pm;
+}
+
+PlatformLayer* MediaPlayerPrivateAVFoundationObjC::platformLayer() const
+{
+    LOG(Media, "MediaPlayerPrivateAVFoundationObjC::platformLayer(%p)", this);
+    return m_videoLayer.get();
+}
+
+void MediaPlayerPrivateAVFoundationObjC::play()
+{
+    LOG(Media, "MediaPlayerPrivateAVFoundationObjC::play(%p)", this);
+    if (!metaDataAvailable())
+        return;
+
+    setDelayCallbacks(true);
+    [m_avPlayer.get() setRate:requestedRate()];
+    setDelayCallbacks(false);
+}
+
+void MediaPlayerPrivateAVFoundationObjC::pause()
+{
+    LOG(Media, "MediaPlayerPrivateAVFoundationObjC::pause(%p)", this);
+    if (!metaDataAvailable())
+        return;
+
+    setDelayCallbacks(true);
+    [m_avPlayer.get() setRate:nil];
+    setDelayCallbacks(false);
+}
+
+float MediaPlayerPrivateAVFoundationObjC::platformDuration() const
+{
+    if (!metaDataAvailable() || !m_avPlayerItem)
+        return 0;
+    
+    float duration;
+    CMTime cmDuration = [m_avPlayerItem.get() duration];
+    if (CMTIME_IS_NUMERIC(cmDuration))
+        duration = narrowPrecisionToFloat(CMTimeGetSeconds(cmDuration));
+    else if (CMTIME_IS_INDEFINITE(cmDuration))
+        duration = numeric_limits<float>::infinity();
+    else {
+        LOG(Media, "MediaPlayerPrivateAVFoundationObjC::duration(%p) - invalid duration, returning 0", this);
+        return 0;
+    }
+
+    return duration;
+}
+
+float MediaPlayerPrivateAVFoundationObjC::currentTime() const
+{
+    if (!metaDataAvailable() || !m_avPlayerItem)
+        return 0;
+
+    CMTime itemTime = [m_avPlayerItem.get() currentTime];
+    if (CMTIME_IS_NUMERIC(itemTime))
+        return narrowPrecisionToFloat(CMTimeGetSeconds(itemTime));
+
+    return 0;
+}
+
+void MediaPlayerPrivateAVFoundationObjC::seekToTime(float time)
+{
+    // setCurrentTime generates several event callbacks, update afterwards.
+    setDelayCallbacks(true);
+
+    float now = currentTime();
+    if (time != now)
+        [m_avPlayerItem.get() seekToTime:CMTimeMakeWithSeconds(time, 600) toleranceBefore:kCMTimeZero toleranceAfter:kCMTimeZero];
+    else {
+        // Force a call to the "time changed" notifier manually because a seek to the current time is a noop 
+        // so the seek will never seem to complete.
+        [m_objcObserver.get() timeChanged:now];
+    }
+
+    setDelayCallbacks(false);
+}
+
+void MediaPlayerPrivateAVFoundationObjC::setVolume(float volume)
+{
+    if (!metaDataAvailable())
+        return;
+
+    [m_avPlayer.get() setVolume:volume];
+}
+
+void MediaPlayerPrivateAVFoundationObjC::setClosedCaptionsVisible(bool closedCaptionsVisible)
+{
+    if (!metaDataAvailable())
+        return;
+
+    LOG(Media, "MediaPlayerPrivateAVFoundationObjC::setClosedCaptionsVisible(%p) - setting to %s", this, boolString(closedCaptionsVisible));
+    [m_avPlayer.get() setClosedCaptionDisplayEnabled:closedCaptionsVisible];
+}
+
+float MediaPlayerPrivateAVFoundationObjC::rate() const
+{
+    if (!metaDataAvailable())
+        return 0;
+
+    return [m_avPlayer.get() rate];
+}
+
+PassRefPtr<TimeRanges> MediaPlayerPrivateAVFoundationObjC::platformBufferedTimeRanges() const
+{
+    RefPtr<TimeRanges> timeRanges = TimeRanges::create();
+
+    if (!m_avPlayerItem)
+        return timeRanges.release();
+
+    NSArray *loadedRanges = [m_avPlayerItem.get() loadedTimeRanges];
+    for (NSValue *thisRangeValue in loadedRanges) {
+        CMTimeRange timeRange = [thisRangeValue CMTimeRangeValue];
+        if (CMTIMERANGE_IS_VALID(timeRange) && !CMTIMERANGE_IS_EMPTY(timeRange)) {
+            float rangeStart = narrowPrecisionToFloat(CMTimeGetSeconds(timeRange.start));
+            float rangeEnd = narrowPrecisionToFloat(CMTimeGetSeconds(CMTimeRangeGetEnd(timeRange)));
+            timeRanges->add(rangeStart, rangeEnd);
+        }
+    }
+    return timeRanges.release();
+}
+
+float MediaPlayerPrivateAVFoundationObjC::platformMaxTimeSeekable() const
+{
+    NSArray *seekableRanges = [m_avPlayerItem.get() seekableTimeRanges];
+    if (!seekableRanges)
+        return 0;
+
+    float maxTimeSeekable = 0;
+    for (NSValue *thisRangeValue in seekableRanges) {
+        CMTimeRange timeRange = [thisRangeValue CMTimeRangeValue];
+        if (!CMTIMERANGE_IS_VALID(timeRange) || CMTIMERANGE_IS_EMPTY(timeRange))
+            continue;
+        
+        float endOfRange = narrowPrecisionToFloat(CMTimeGetSeconds(CMTimeRangeGetEnd(timeRange)));
+        if (maxTimeSeekable < endOfRange)
+            maxTimeSeekable = endOfRange;
+    }
+    return maxTimeSeekable;   
+}
+
+float MediaPlayerPrivateAVFoundationObjC::platformMaxTimeLoaded() const
+{
+    NSArray *loadedRanges = [m_avPlayerItem.get() loadedTimeRanges];
+    if (!loadedRanges)
+        return 0;
+
+    float maxTimeLoaded = 0;
+    for (NSValue *thisRangeValue in loadedRanges) {
+        CMTimeRange timeRange = [thisRangeValue CMTimeRangeValue];
+        if (!CMTIMERANGE_IS_VALID(timeRange) || CMTIMERANGE_IS_EMPTY(timeRange))
+            continue;
+        
+        float endOfRange = narrowPrecisionToFloat(CMTimeGetSeconds(CMTimeRangeGetEnd(timeRange)));
+        if (maxTimeLoaded < endOfRange)
+            maxTimeLoaded = endOfRange;
+    }
+
+    return maxTimeLoaded;   
+}
+
+unsigned MediaPlayerPrivateAVFoundationObjC::totalBytes() const
+{
+    if (!metaDataAvailable())
+        return 0;
+
+    long long totalMediaSize = 0;
+    NSArray *tracks = [m_avAsset.get() tracks];
+    for (AVAssetTrack *thisTrack in tracks)
+        totalMediaSize += [thisTrack totalSampleDataLength];
+
+    return static_cast<unsigned>(totalMediaSize);
+}
+
+void MediaPlayerPrivateAVFoundationObjC::setAsset(id asset)
+{
+    m_avAsset = asset;
+}
+
+MediaPlayerPrivateAVFoundation::AVAssetStatus MediaPlayerPrivateAVFoundationObjC::assetStatus() const
+{
+    if (!m_avAsset)
+        return MediaPlayerAVAssetStatusUnknown;
+
+    for (NSString *keyName in assetMetadataKeyNames()) {
+        AVKeyValueStatus keyStatus = [m_avAsset.get() statusOfValueForKey:keyName error:nil];
+        if (keyStatus < AVKeyValueStatusLoaded)
+            return MediaPlayerAVAssetStatusLoading;// At least one key is not loaded yet.
+        
+        if (keyStatus == AVKeyValueStatusFailed)
+            return MediaPlayerAVAssetStatusFailed; // At least one key could not be loaded.
+        if (keyStatus == AVKeyValueStatusCancelled)
+            return MediaPlayerAVAssetStatusCancelled; // Loading of at least one key was cancelled.
+    }
+
+    if ([[m_avAsset.get() valueForKey:@"playable"] boolValue])
+        return MediaPlayerAVAssetStatusPlayable;
+
+    return MediaPlayerAVAssetStatusLoaded;
+}
+
+void MediaPlayerPrivateAVFoundationObjC::paintCurrentFrameInContext(GraphicsContext* context, const IntRect& rect)
+{
+    if (!metaDataAvailable() || context->paintingDisabled())
+        return;
+
+    paint(context, rect);
+}
+
+void MediaPlayerPrivateAVFoundationObjC::paint(GraphicsContext* context, const IntRect& rect)
+{
+    if (!metaDataAvailable() || context->paintingDisabled())
+        return;
+
+    setDelayCallbacks(true);
+    BEGIN_BLOCK_OBJC_EXCEPTIONS;
+
+    RetainPtr<CGImageRef> image = createImageForTimeInRect(currentTime(), rect);
+    if (image) {
+        context->save();
+        context->translate(rect.x(), rect.y() + rect.height());
+        context->scale(FloatSize(1.0f, -1.0f));
+        context->setImageInterpolationQuality(InterpolationLow);
+        IntRect paintRect(IntPoint(0, 0), IntSize(rect.width(), rect.height()));
+        CGContextDrawImage(context->platformContext(), CGRectMake(0, 0, paintRect.width(), paintRect.height()), image.get());
+        context->restore();
+        image = 0;
+    }
+
+    END_BLOCK_OBJC_EXCEPTIONS;
+    setDelayCallbacks(false);
+
+    MediaPlayerPrivateAVFoundation::paint(context, rect);
+}
+
+static HashSet<String> mimeTypeCache()
+{
+    DEFINE_STATIC_LOCAL(HashSet<String>, cache, ());
+    static bool typeListInitialized = false;
+
+    if (typeListInitialized)
+        return cache;
+    typeListInitialized = true;
+
+    NSArray *types = [AVURLAsset audiovisualMIMETypes];
+    for (NSString *mimeType in types)
+        cache.add(mimeType);
+
+    return cache;
+} 
+
+RetainPtr<CGImageRef> MediaPlayerPrivateAVFoundationObjC::createImageForTimeInRect(float time, const IntRect& rect)
+{
+    if (!m_imageGenerator)
+        createContextVideoRenderer();
+    ASSERT(m_imageGenerator);
+
+#if !LOG_DISABLED
+    double start = WTF::currentTime();
+#endif
+
+    [m_imageGenerator.get() setMaximumSize:CGSize(rect.size())];
+    CGImageRef image = [m_imageGenerator.get() copyCGImageAtTime:CMTimeMakeWithSeconds(time, 600) actualTime:nil error:nil];
+
+#if !LOG_DISABLED
+    double duration = WTF::currentTime() - start;
+    LOG(Media, "MediaPlayerPrivateAVFoundationObjC::createImageForTimeInRect(%p) - creating image took %.4f", this, narrowPrecisionToFloat(duration));
+#endif
+
+    return image;
+}
+
+void MediaPlayerPrivateAVFoundationObjC::getSupportedTypes(HashSet<String>& supportedTypes)
+{
+    supportedTypes = mimeTypeCache();
+} 
+
+MediaPlayer::SupportsType MediaPlayerPrivateAVFoundationObjC::supportsType(const String& type, const String& codecs)
+{
+    // Only return "IsSupported" if there is no codecs parameter for now as there is no way to ask if it supports an
+    // extended MIME type until rdar://6220037 is fixed.
+    if (mimeTypeCache().contains(type))
+        return codecs.isEmpty() ? MediaPlayer::MayBeSupported : MediaPlayer::IsSupported;
+
+    return MediaPlayer::IsNotSupported;
+}
+
+bool MediaPlayerPrivateAVFoundationObjC::isAvailable()
+{
+    return true;
+}
+
+float MediaPlayerPrivateAVFoundationObjC::mediaTimeForTimeValue(float timeValue) const
+{
+    if (!metaDataAvailable())
+        return timeValue;
+
+    // FIXME - impossible to implement until rdar://8721510 is fixed.
+    return timeValue;
+}
+
+void MediaPlayerPrivateAVFoundationObjC::tracksChanged()
+{
+    // This is called whenever the tracks collection changes so cache hasVideo and hasAudio since we get
+    // asked about those fairly fequently.
+    setHasVideo([[m_avAsset.get() tracksWithMediaCharacteristic:AVMediaCharacteristicVisual] count]);
+    setHasAudio([[m_avAsset.get() tracksWithMediaCharacteristic:AVMediaCharacteristicAudible] count]);
+    setHasClosedCaptions([[m_avAsset.get() tracksWithMediaType:AVMediaTypeClosedCaption] count]);
+
+    sizeChanged();
+}
+
+void MediaPlayerPrivateAVFoundationObjC::sizeChanged()
+{
+    NSArray *tracks = [m_avAsset.get() tracks];
+
+    // Some assets don't report track properties until they are completely ready to play, but we
+    // want to report a size as early as possible so use presentationSize when an asset has no tracks.
+    if (![tracks count]) {
+        setNaturalSize(IntSize([m_avPlayerItem.get() presentationSize]));
+        return;
+    }
+
+    // AVAsset's 'naturalSize' property only considers the movie's first video track, so we need to compute
+    // the union of all visual track rects.
+    CGRect trackUnionRect = CGRectZero;
+    for (AVAssetTrack *track in tracks) {
+        CGSize trackSize = [track naturalSize];
+        CGRect trackRect = CGRectMake(0, 0, trackSize.width, trackSize.height);
+        trackUnionRect = CGRectUnion(trackUnionRect, CGRectApplyAffineTransform(trackRect, [track preferredTransform]));
+    }
+
+    // The movie is always displayed at 0,0 so move the track rect to the origin before using width and height.
+    trackUnionRect = CGRectOffset(trackUnionRect, trackUnionRect.origin.x, trackUnionRect.origin.y);
+    
+    // Also look at the asset's preferred transform so we account for a movie matrix.
+    CGSize naturalSize = CGSizeApplyAffineTransform(trackUnionRect.size, [m_avAsset.get() preferredTransform]);
+
+    // Cache the natural size (setNaturalSize will notify the player if it has changed).
+    setNaturalSize(IntSize(naturalSize));
+}
+
+NSArray* assetMetadataKeyNames()
+{
+    static NSArray* keys;
+    if (!keys) {
+        keys = [[NSArray alloc] initWithObjects:@"duration",
+                    @"naturalSize",
+                    @"preferredTransform",
+                    @"preferredVolume",
+                    @"preferredRate",
+                    @"playable",
+                    @"tracks",
+                   nil];
+    }
+    return keys;
+}
+
+NSArray* itemKVOProperties()
+{
+    static NSArray* keys;
+    if (!keys) {
+        keys = [[NSArray alloc] initWithObjects:@"presentationSize",
+                @"status",
+                @"asset",
+                @"tracks",
+                @"seekableTimeRanges",
+                @"loadedTimeRanges",
+                @"playbackLikelyToKeepUp",
+                @"playbackBufferFull",
+                @"playbackBufferEmpty",
+                nil];
+    }
+    return keys;
+}
+
+} // namespace WebCore
+
+@implementation WebCoreAVFMovieObserver
+
+- (id)initWithCallback:(MediaPlayerPrivateAVFoundationObjC*)callback
+{
+    m_callback = callback;
+    return [super init];
+}
+
+- (void)disconnect
+{
+    [NSObject cancelPreviousPerformRequestsWithTarget:self];
+    m_callback = 0;
+}
+
+- (void)metadataLoaded
+{
+    if (!m_callback)
+        return;
+
+    m_callback->scheduleMainThreadNotification(MediaPlayerPrivateAVFoundation::Notification::AssetMetadataLoaded);
+}
+
+- (void)playableKnown
+{
+    if (!m_callback)
+        return;
+
+    m_callback->scheduleMainThreadNotification(MediaPlayerPrivateAVFoundation::Notification::AssetPlayabilityKnown);
+}
+
+- (void)timeChanged:(double)time
+{
+    if (!m_callback)
+        return;
+
+    m_callback->scheduleMainThreadNotification(MediaPlayerPrivateAVFoundation::Notification::PlayerTimeChanged, time);
+}
+
+- (void)didEnd:(NSNotification *)unusedNotification
+{
+    UNUSED_PARAM(unusedNotification);
+    if (!m_callback)
+        return;
+    m_callback->scheduleMainThreadNotification(MediaPlayerPrivateAVFoundation::Notification::ItemDidPlayToEndTime);
+}
+
+- (void)observeValueForKeyPath:keyPath ofObject:(id)object change:(NSDictionary *)change context:(MediaPlayerAVFoundationObservationContext)context
+{
+    UNUSED_PARAM(change);
+
+    LOG(Media, "WebCoreAVFMovieObserver:observeValueForKeyPath(%p) - keyPath = %s", self, [keyPath UTF8String]);
+
+    if (!m_callback)
+        return;
+
+    if (context == MediaPlayerAVFoundationObservationContextPlayerItem) {
+        // A value changed for an AVPlayerItem
+        if ([keyPath isEqualToString:@"status"])
+            m_callback->scheduleMainThreadNotification(MediaPlayerPrivateAVFoundation::Notification::ItemStatusChanged);
+        else if ([keyPath isEqualToString:@"playbackLikelyToKeepUp"])
+            m_callback->scheduleMainThreadNotification(MediaPlayerPrivateAVFoundation::Notification::ItemIsPlaybackLikelyToKeepUpChanged);
+        else if ([keyPath isEqualToString:@"playbackBufferEmpty"])
+            m_callback->scheduleMainThreadNotification(MediaPlayerPrivateAVFoundation::Notification::ItemIsPlaybackBufferEmptyChanged);
+        else if ([keyPath isEqualToString:@"playbackBufferFull"])
+            m_callback->scheduleMainThreadNotification(MediaPlayerPrivateAVFoundation::Notification::ItemIsPlaybackBufferFullChanged);
+        else if ([keyPath isEqualToString:@"asset"])
+            m_callback->setAsset([object asset]);
+        else if ([keyPath isEqualToString:@"loadedTimeRanges"])
+            m_callback->scheduleMainThreadNotification(MediaPlayerPrivateAVFoundation::Notification::ItemLoadedTimeRangesChanged);
+        else if ([keyPath isEqualToString:@"seekableTimeRanges"])
+            m_callback->scheduleMainThreadNotification(MediaPlayerPrivateAVFoundation::Notification::ItemSeekableTimeRangesChanged);
+        else if ([keyPath isEqualToString:@"tracks"])
+            m_callback->scheduleMainThreadNotification(MediaPlayerPrivateAVFoundation::Notification::ItemTracksChanged);
+        else if ([keyPath isEqualToString:@"presentationSize"])
+            m_callback->scheduleMainThreadNotification(MediaPlayerPrivateAVFoundation::Notification::ItemPresentationSizeChanged);
+
+        return;
+    }
+
+    if (context == MediaPlayerAVFoundationObservationContextPlayer) {
+        // A value changed for an AVPlayer.
+        if ([keyPath isEqualToString:@"rate"])
+            m_callback->scheduleMainThreadNotification(MediaPlayerPrivateAVFoundation::Notification::PlayerRateChanged);
+}
+}
+
+@end
+
+#endif
diff --git a/Source/WebCore/platform/graphics/ca/GraphicsLayerCA.cpp b/Source/WebCore/platform/graphics/ca/GraphicsLayerCA.cpp
index e9663a6..427c7bf 100644
--- a/Source/WebCore/platform/graphics/ca/GraphicsLayerCA.cpp
+++ b/Source/WebCore/platform/graphics/ca/GraphicsLayerCA.cpp
@@ -550,11 +550,17 @@ void GraphicsLayerCA::setNeedsDisplay()
     setNeedsDisplayInRect(hugeRect);
 }
 
-void GraphicsLayerCA::setNeedsDisplayInRect(const FloatRect& rect)
+void GraphicsLayerCA::setNeedsDisplayInRect(const FloatRect& r)
 {
     if (!drawsContent())
         return;
 
+    FloatRect rect(r);
+    FloatRect layerBounds(FloatPoint(), m_size);
+    rect.intersect(layerBounds);
+    if (rect.isEmpty())
+        return;
+    
     const size_t maxDirtyRects = 32;
     
     for (size_t i = 0; i < m_dirtyRects.size(); ++i) {
@@ -1601,9 +1607,11 @@ bool GraphicsLayerCA::createTransformAnimationsFromKeyframes(const KeyframeValue
         TransformOperation::OperationType transformOp = isMatrixAnimation ? TransformOperation::MATRIX_3D : functionList[animationIndex];
         RefPtr<PlatformCAAnimation> caAnimation;
 
-#if defined(BUILDING_ON_LEOPARD) || defined(BUILDING_ON_SNOW_LEOPARD)
+#if defined(BUILDING_ON_LEOPARD) || defined(BUILDING_ON_SNOW_LEOPARD) || PLATFORM(WIN)
         // CA applies animations in reverse order (<rdar://problem/7095638>) so we need the last one we add (per property)
         // to be non-additive.
+        // FIXME: This fix has not been added to QuartzCore on Windows yet (<rdar://problem/9112233>) so we expect the
+        // reversed animation behavior
         bool additive = animationIndex < (numAnimations - 1);
 #else
         bool additive = animationIndex > 0;
diff --git a/Source/WebCore/platform/graphics/ca/PlatformCAAnimation.h b/Source/WebCore/platform/graphics/ca/PlatformCAAnimation.h
index a8528fd..8b5a460 100644
--- a/Source/WebCore/platform/graphics/ca/PlatformCAAnimation.h
+++ b/Source/WebCore/platform/graphics/ca/PlatformCAAnimation.h
@@ -38,11 +38,10 @@
 #if PLATFORM(MAC)
 #ifdef __OBJC__
 @class CAPropertyAnimation;
-typedef CAPropertyAnimation* PlatformAnimationRef;
 #else
-typedef void* CAPropertyAnimation; // So the m_animation declaration works
-typedef void* PlatformAnimationRef;
+class CAPropertyAnimation;
 #endif
+typedef CAPropertyAnimation* PlatformAnimationRef;
 #elif PLATFORM(WIN)
 typedef struct _CACFAnimation* CACFAnimationRef;
 typedef CACFAnimationRef PlatformAnimationRef;
diff --git a/Source/WebCore/platform/graphics/ca/win/CACFLayerTreeHost.cpp b/Source/WebCore/platform/graphics/ca/win/CACFLayerTreeHost.cpp
index f2e1950..75f4a10 100644
--- a/Source/WebCore/platform/graphics/ca/win/CACFLayerTreeHost.cpp
+++ b/Source/WebCore/platform/graphics/ca/win/CACFLayerTreeHost.cpp
@@ -307,13 +307,14 @@ void CACFLayerTreeHost::contextDidChange()
 
 void CACFLayerTreeHost::notifyAnimationsStarted()
 {
+    // Send currentTime to the pending animations. This function is called by CACF in a callback
+    // which occurs after the drawInContext calls. So currentTime is very close to the time
+    // the animations actually start
     double currentTime = WTF::currentTime();
-    double time = currentTime + lastCommitTime() - CACurrentMediaTime();
-    ASSERT(time <= currentTime);
 
     HashSet<RefPtr<PlatformCALayer> >::iterator end = m_pendingAnimatedLayers.end();
     for (HashSet<RefPtr<PlatformCALayer> >::iterator it = m_pendingAnimatedLayers.begin(); it != end; ++it)
-        (*it)->animationStarted(time);
+        (*it)->animationStarted(currentTime);
 
     m_pendingAnimatedLayers.clear();
 }
diff --git a/Source/WebCore/platform/graphics/cairo/ContextShadowCairo.cpp b/Source/WebCore/platform/graphics/cairo/ContextShadowCairo.cpp
index b0588d6..0f90ce4 100644
--- a/Source/WebCore/platform/graphics/cairo/ContextShadowCairo.cpp
+++ b/Source/WebCore/platform/graphics/cairo/ContextShadowCairo.cpp
@@ -34,6 +34,7 @@
 #include "GraphicsContext.h"
 #include "OwnPtrCairo.h"
 #include "Path.h"
+#include "PlatformContextCairo.h"
 #include "Timer.h"
 #include <cairo.h>
 
@@ -88,7 +89,7 @@ PlatformContext ContextShadow::beginShadowLayer(GraphicsContext* context, const
     adjustBlurDistance(context);
 
     double x1, x2, y1, y2;
-    cairo_clip_extents(context->platformContext(), &x1, &y1, &x2, &y2);
+    cairo_clip_extents(context->platformContext()->cr(), &x1, &y1, &x2, &y2);
     IntRect layerRect = calculateLayerBoundingRect(context, layerArea, IntRect(x1, y1, x2 - x1, y2 - y1));
 
     // Don't paint if we are totally outside the clip region.
@@ -120,7 +121,7 @@ void ContextShadow::endShadowLayer(GraphicsContext* context)
         cairo_surface_mark_dirty(m_layerImage);
     }
 
-    cairo_t* cr = context->platformContext();
+    cairo_t* cr = context->platformContext()->cr();
     cairo_save(cr);
     setSourceRGBAFromColor(cr, m_color);
     cairo_mask_surface(cr, m_layerImage, m_layerOrigin.x(), m_layerOrigin.y());
@@ -198,7 +199,7 @@ void ContextShadow::drawRectShadow(GraphicsContext* context, const IntRect& rect
     int internalShadowHeight = radiusTwice + max(topLeftRadius.height(), topRightRadius.height()) +
         max(bottomLeftRadius.height(), bottomRightRadius.height());
 
-    cairo_t* cr = context->platformContext();
+    cairo_t* cr = context->platformContext()->cr();
 
     // drawShadowedRect still does not work with rotations.
     // https://bugs.webkit.org/show_bug.cgi?id=45042
diff --git a/Source/WebCore/platform/graphics/cairo/FontCairo.cpp b/Source/WebCore/platform/graphics/cairo/FontCairo.cpp
index 2d79499..58a7fd2 100644
--- a/Source/WebCore/platform/graphics/cairo/FontCairo.cpp
+++ b/Source/WebCore/platform/graphics/cairo/FontCairo.cpp
@@ -36,6 +36,7 @@
 #include "GlyphBuffer.h"
 #include "Gradient.h"
 #include "GraphicsContext.h"
+#include "PlatformContextCairo.h"
 #include "ImageBuffer.h"
 #include "Pattern.h"
 #include "SimpleFontData.h"
@@ -64,7 +65,7 @@ static void drawGlyphsToContext(cairo_t* context, const SimpleFontData* font, Gl
     }
 }
 
-static void drawGlyphsShadow(GraphicsContext* graphicsContext, cairo_t* context, const FloatPoint& point, const SimpleFontData* font, GlyphBufferGlyph* glyphs, int numGlyphs)
+static void drawGlyphsShadow(GraphicsContext* graphicsContext, const FloatPoint& point, const SimpleFontData* font, GlyphBufferGlyph* glyphs, int numGlyphs)
 {
     ContextShadow* shadow = graphicsContext->contextShadow();
     ASSERT(shadow);
@@ -74,6 +75,7 @@ static void drawGlyphsShadow(GraphicsContext* graphicsContext, cairo_t* context,
 
     if (!shadow->mustUseContextShadow(graphicsContext)) {
         // Optimize non-blurry shadows, by just drawing text without the ContextShadow.
+        cairo_t* context = graphicsContext->platformContext()->cr();
         cairo_save(context);
         cairo_translate(context, shadow->m_offset.width(), shadow->m_offset.height());
         setSourceRGBAFromColor(context, shadow->m_color);
@@ -106,9 +108,10 @@ void Font::drawGlyphs(GraphicsContext* context, const SimpleFontData* font, cons
         offset += glyphBuffer.advanceAt(from + i);
     }
 
-    cairo_t* cr = context->platformContext();
-    drawGlyphsShadow(context, cr, point, font, glyphs, numGlyphs);
+    PlatformContextCairo* platformContext = context->platformContext();
+    drawGlyphsShadow(context, point, font, glyphs, numGlyphs);
 
+    cairo_t* cr = platformContext->cr();
     cairo_save(cr);
     prepareContextForGlyphDrawing(cr, font, point);
     if (context->textDrawingMode() & TextModeFill) {
diff --git a/Source/WebCore/platform/graphics/cairo/FontCustomPlatformData.h b/Source/WebCore/platform/graphics/cairo/FontCustomPlatformData.h
index 5807102..f8f3c99 100644
--- a/Source/WebCore/platform/graphics/cairo/FontCustomPlatformData.h
+++ b/Source/WebCore/platform/graphics/cairo/FontCustomPlatformData.h
@@ -25,6 +25,7 @@
 #include "FontOrientation.h"
 #include "FontRenderingMode.h"
 #include "FontWidthVariant.h"
+#include "TextOrientation.h"
 #include <wtf/Forward.h>
 #include <wtf/Noncopyable.h>
 
@@ -41,7 +42,7 @@ struct FontCustomPlatformData {
 public:
     FontCustomPlatformData(FT_Face, SharedBuffer*);
     ~FontCustomPlatformData();
-    FontPlatformData fontPlatformData(int size, bool bold, bool italic, FontOrientation = Horizontal, FontWidthVariant = RegularWidth, FontRenderingMode = NormalRenderingMode);
+    FontPlatformData fontPlatformData(int size, bool bold, bool italic, FontOrientation = Horizontal, TextOrientation = TextOrientationVerticalRight, FontWidthVariant = RegularWidth, FontRenderingMode = NormalRenderingMode);
     static bool supportsFormat(const String&);
 
 private:
diff --git a/Source/WebCore/platform/graphics/cairo/GradientCairo.cpp b/Source/WebCore/platform/graphics/cairo/GradientCairo.cpp
index 4e6ed07..225046a 100644
--- a/Source/WebCore/platform/graphics/cairo/GradientCairo.cpp
+++ b/Source/WebCore/platform/graphics/cairo/GradientCairo.cpp
@@ -29,6 +29,7 @@
 
 #include "CSSParser.h"
 #include "GraphicsContext.h"
+#include "PlatformContextCairo.h"
 #include <cairo.h>
 
 namespace WebCore {
@@ -87,7 +88,7 @@ void Gradient::setPlatformGradientSpaceTransform(const AffineTransform& gradient
 
 void Gradient::fill(GraphicsContext* context, const FloatRect& rect)
 {
-    cairo_t* cr = context->platformContext();
+    cairo_t* cr = context->platformContext()->cr();
 
     context->save();
     cairo_set_source(cr, platformGradient());
diff --git a/Source/WebCore/platform/graphics/cairo/GraphicsContextCairo.cpp b/Source/WebCore/platform/graphics/cairo/GraphicsContextCairo.cpp
index e69a7a5..0fc94df 100644
--- a/Source/WebCore/platform/graphics/cairo/GraphicsContextCairo.cpp
+++ b/Source/WebCore/platform/graphics/cairo/GraphicsContextCairo.cpp
@@ -47,6 +47,7 @@
 #include "NotImplemented.h"
 #include "Path.h"
 #include "Pattern.h"
+#include "PlatformContextCairo.h"
 #include "RefPtrCairo.h"
 #include "SimpleFontData.h"
 #include <cairo.h>
@@ -148,7 +149,7 @@ static inline void drawPathShadow(GraphicsContext* context, PathDrawingStyle dra
         return;
 
     // Calculate the extents of the rendered solid paths.
-    cairo_t* cairoContext = context->platformContext();
+    cairo_t* cairoContext = context->platformContext()->cr();
     OwnPtr<cairo_path_t> path(cairo_copy_path(cairoContext));
 
     FloatRect solidFigureExtents;
@@ -199,12 +200,18 @@ static void strokeCurrentCairoPath(GraphicsContext* context,  cairo_t* cairoCont
     cairo_new_path(cairoContext);
 }
 
-void GraphicsContext::platformInit(PlatformGraphicsContext* cr)
+GraphicsContext::GraphicsContext(cairo_t* cr)
 {
-    m_data = new GraphicsContextPlatformPrivate;
-    m_data->cr = cairo_reference(cr);
-    m_data->syncContext(cr);
-    setPaintingDisabled(!cr);
+    m_data = new GraphicsContextPlatformPrivate(new PlatformContextCairo(cr));
+}
+
+void GraphicsContext::platformInit(PlatformContextCairo* platformContext)
+{
+    m_data = new GraphicsContextPlatformPrivate(platformContext);
+    if (platformContext)
+        m_data->syncContext(platformContext->cr());
+    else
+        setPaintingDisabled(true);
 }
 
 void GraphicsContext::platformDestroy()
@@ -214,20 +221,20 @@ void GraphicsContext::platformDestroy()
 
 AffineTransform GraphicsContext::getCTM() const
 {
-    cairo_t* cr = platformContext();
+    cairo_t* cr = platformContext()->cr();
     cairo_matrix_t m;
     cairo_get_matrix(cr, &m);
     return AffineTransform(m.xx, m.yx, m.xy, m.yy, m.x0, m.y0);
 }
 
-cairo_t* GraphicsContext::platformContext() const
+PlatformContextCairo* GraphicsContext::platformContext() const
 {
-    return m_data->cr;
+    return m_data->platformContext;
 }
 
 void GraphicsContext::savePlatformState()
 {
-    cairo_save(m_data->cr);
+    cairo_save(platformContext()->cr());
     m_data->save();
     m_data->shadowStack.append(m_data->shadow);
     m_data->maskImageStack.append(ImageMaskInformation());
@@ -235,7 +242,8 @@ void GraphicsContext::savePlatformState()
 
 void GraphicsContext::restorePlatformState()
 {
-    cairo_t* cr = m_data->cr;
+    cairo_t* cr = platformContext()->cr();
+
     const ImageMaskInformation& maskInformation = m_data->maskImageStack.last();
     if (maskInformation.isValid()) {
         const FloatRect& maskRect = maskInformation.maskRect();
@@ -251,7 +259,7 @@ void GraphicsContext::restorePlatformState()
         m_data->shadowStack.removeLast();
     }
 
-    cairo_restore(m_data->cr);
+    cairo_restore(cr);
     m_data->restore();
 }
 
@@ -261,7 +269,7 @@ void GraphicsContext::drawRect(const IntRect& rect)
     if (paintingDisabled())
         return;
 
-    cairo_t* cr = m_data->cr;
+    cairo_t* cr = platformContext()->cr();
     cairo_save(cr);
 
     if (fillColor().alpha())
@@ -289,7 +297,7 @@ void GraphicsContext::drawLine(const IntPoint& point1, const IntPoint& point2)
     if (style == NoStroke)
         return;
 
-    cairo_t* cr = m_data->cr;
+    cairo_t* cr = platformContext()->cr();
     cairo_save(cr);
 
     float width = strokeThickness();
@@ -376,7 +384,7 @@ void GraphicsContext::drawEllipse(const IntRect& rect)
     if (paintingDisabled())
         return;
 
-    cairo_t* cr = m_data->cr;
+    cairo_t* cr = platformContext()->cr();
     cairo_save(cr);
     float yRadius = .5 * rect.height();
     float xRadius = .5 * rect.width();
@@ -415,7 +423,7 @@ void GraphicsContext::strokeArc(const IntRect& rect, int startAngle, int angleSp
     float fa = startAngle;
     float falen =  fa + angleSpan;
 
-    cairo_t* cr = m_data->cr;
+    cairo_t* cr = platformContext()->cr();
     cairo_save(cr);
 
     if (w != h)
@@ -492,7 +500,7 @@ void GraphicsContext::drawConvexPolygon(size_t npoints, const FloatPoint* points
     if (npoints <= 1)
         return;
 
-    cairo_t* cr = m_data->cr;
+    cairo_t* cr = platformContext()->cr();
 
     cairo_save(cr);
     cairo_set_antialias(cr, shouldAntialias ? CAIRO_ANTIALIAS_DEFAULT : CAIRO_ANTIALIAS_NONE);
@@ -522,7 +530,7 @@ void GraphicsContext::clipConvexPolygon(size_t numPoints, const FloatPoint* poin
     if (numPoints <= 1)
         return;
 
-    cairo_t* cr = m_data->cr;
+    cairo_t* cr = platformContext()->cr();
 
     cairo_new_path(cr);
     cairo_fill_rule_t savedFillRule = cairo_get_fill_rule(cr);
@@ -542,7 +550,7 @@ void GraphicsContext::fillPath(const Path& path)
     if (paintingDisabled())
         return;
 
-    cairo_t* cr = m_data->cr;
+    cairo_t* cr = platformContext()->cr();
     setPathOnCairoContext(cr, path.platformPath()->context());
     fillCurrentCairoPath(this, cr);
 }
@@ -552,7 +560,7 @@ void GraphicsContext::strokePath(const Path& path)
     if (paintingDisabled())
         return;
 
-    cairo_t* cr = m_data->cr;
+    cairo_t* cr = platformContext()->cr();
     setPathOnCairoContext(cr, path.platformPath()->context());
     strokeCurrentCairoPath(this, cr);
 }
@@ -562,7 +570,7 @@ void GraphicsContext::fillRect(const FloatRect& rect)
     if (paintingDisabled())
         return;
 
-    cairo_t* cr = m_data->cr;
+    cairo_t* cr = platformContext()->cr();
     cairo_save(cr);
     cairo_rectangle(cr, rect.x(), rect.y(), rect.width(), rect.height());
     fillCurrentCairoPath(this, cr);
@@ -578,7 +586,7 @@ void GraphicsContext::fillRect(const FloatRect& rect, const Color& color, ColorS
         m_data->shadow.drawRectShadow(this, enclosingIntRect(rect));
 
     if (color.alpha())
-        fillRectSourceOver(m_data->cr, rect, color);
+        fillRectSourceOver(platformContext()->cr(), rect, color);
 }
 
 void GraphicsContext::clip(const FloatRect& rect)
@@ -586,7 +594,7 @@ void GraphicsContext::clip(const FloatRect& rect)
     if (paintingDisabled())
         return;
 
-    cairo_t* cr = m_data->cr;
+    cairo_t* cr = platformContext()->cr();
     cairo_rectangle(cr, rect.x(), rect.y(), rect.width(), rect.height());
     cairo_fill_rule_t savedFillRule = cairo_get_fill_rule(cr);
     cairo_set_fill_rule(cr, CAIRO_FILL_RULE_WINDING);
@@ -600,7 +608,7 @@ void GraphicsContext::clipPath(const Path& path, WindRule clipRule)
     if (paintingDisabled())
         return;
 
-    cairo_t* cr = m_data->cr;
+    cairo_t* cr = platformContext()->cr();
     setPathOnCairoContext(cr, path.platformPath()->context());
     cairo_set_fill_rule(cr, clipRule == RULE_EVENODD ? CAIRO_FILL_RULE_EVEN_ODD : CAIRO_FILL_RULE_WINDING);
     cairo_clip(cr);
@@ -638,7 +646,7 @@ void GraphicsContext::drawFocusRing(const Path& path, int width, int /* offset *
     adjustFocusRingColor(ringColor);
     adjustFocusRingLineWidth(width);
 
-    cairo_t* cr = m_data->cr;
+    cairo_t* cr = platformContext()->cr();
     cairo_save(cr);
     appendWebCorePathToCairoContext(cr, path);
     setSourceRGBAFromColor(cr, ringColor);
@@ -655,7 +663,7 @@ void GraphicsContext::drawFocusRing(const Vector<IntRect>& rects, int width, int
 
     unsigned rectCount = rects.size();
 
-    cairo_t* cr = m_data->cr;
+    cairo_t* cr = platformContext()->cr();
     cairo_save(cr);
     cairo_push_group(cr);
     cairo_new_path(cr);
@@ -732,7 +740,7 @@ void GraphicsContext::drawLineForTextChecking(const FloatPoint& origin, float wi
     if (paintingDisabled())
         return;
 
-    cairo_t* cr = m_data->cr;
+    cairo_t* cr = platformContext()->cr();
     cairo_save(cr);
 
     switch (style) {
@@ -762,7 +770,7 @@ FloatRect GraphicsContext::roundToDevicePixels(const FloatRect& frect)
     FloatRect result;
     double x = frect.x();
     double y = frect.y();
-    cairo_t* cr = m_data->cr;
+    cairo_t* cr = platformContext()->cr();
     cairo_user_to_device(cr, &x, &y);
     x = round(x);
     y = round(y);
@@ -799,7 +807,7 @@ void GraphicsContext::translate(float x, float y)
     if (paintingDisabled())
         return;
 
-    cairo_t* cr = m_data->cr;
+    cairo_t* cr = platformContext()->cr();
     cairo_translate(cr, x, y);
     m_data->translate(x, y);
 }
@@ -821,7 +829,7 @@ void GraphicsContext::setPlatformStrokeThickness(float strokeThickness)
     if (paintingDisabled())
         return;
 
-    cairo_set_line_width(m_data->cr, strokeThickness);
+    cairo_set_line_width(platformContext()->cr(), strokeThickness);
 }
 
 void GraphicsContext::setPlatformStrokeStyle(StrokeStyle strokeStyle)
@@ -835,16 +843,16 @@ void GraphicsContext::setPlatformStrokeStyle(StrokeStyle strokeStyle)
     switch (strokeStyle) {
     case NoStroke:
         // FIXME: is it the right way to emulate NoStroke?
-        cairo_set_line_width(m_data->cr, 0);
+        cairo_set_line_width(platformContext()->cr(), 0);
         break;
     case SolidStroke:
-        cairo_set_dash(m_data->cr, 0, 0, 0);
+        cairo_set_dash(platformContext()->cr(), 0, 0, 0);
         break;
     case DottedStroke:
-        cairo_set_dash(m_data->cr, dotPattern, 2, 0);
+        cairo_set_dash(platformContext()->cr(), dotPattern, 2, 0);
         break;
     case DashedStroke:
-        cairo_set_dash(m_data->cr, dashPattern, 2, 0);
+        cairo_set_dash(platformContext()->cr(), dashPattern, 2, 0);
         break;
     }
 }
@@ -859,7 +867,7 @@ void GraphicsContext::concatCTM(const AffineTransform& transform)
     if (paintingDisabled())
         return;
 
-    cairo_t* cr = m_data->cr;
+    cairo_t* cr = platformContext()->cr();
     const cairo_matrix_t matrix = cairo_matrix_t(transform);
     cairo_transform(cr, &matrix);
     m_data->concatCTM(transform);
@@ -870,7 +878,7 @@ void GraphicsContext::setCTM(const AffineTransform& transform)
     if (paintingDisabled())
         return;
 
-    cairo_t* cr = m_data->cr;
+    cairo_t* cr = platformContext()->cr();
     const cairo_matrix_t matrix = cairo_matrix_t(transform);
     cairo_set_matrix(cr, &matrix);
     m_data->setCTM(transform);
@@ -881,7 +889,7 @@ void GraphicsContext::addInnerRoundedRectClip(const IntRect& rect, int thickness
     if (paintingDisabled())
         return;
 
-    cairo_t* cr = m_data->cr;
+    cairo_t* cr = platformContext()->cr();
     clip(rect);
 
     Path p;
@@ -928,7 +936,7 @@ void GraphicsContext::beginTransparencyLayer(float opacity)
     if (paintingDisabled())
         return;
 
-    cairo_t* cr = m_data->cr;
+    cairo_t* cr = platformContext()->cr();
     cairo_push_group(cr);
     m_data->layers.append(opacity);
     m_data->beginTransparencyLayer();
@@ -939,7 +947,7 @@ void GraphicsContext::endTransparencyLayer()
     if (paintingDisabled())
         return;
 
-    cairo_t* cr = m_data->cr;
+    cairo_t* cr = platformContext()->cr();
 
     cairo_pop_group_to_source(cr);
     cairo_paint_with_alpha(cr, m_data->layers.last());
@@ -952,7 +960,7 @@ void GraphicsContext::clearRect(const FloatRect& rect)
     if (paintingDisabled())
         return;
 
-    cairo_t* cr = m_data->cr;
+    cairo_t* cr = platformContext()->cr();
 
     cairo_save(cr);
     cairo_rectangle(cr, rect.x(), rect.y(), rect.width(), rect.height());
@@ -966,7 +974,7 @@ void GraphicsContext::strokeRect(const FloatRect& rect, float width)
     if (paintingDisabled())
         return;
 
-    cairo_t* cr = m_data->cr;
+    cairo_t* cr = platformContext()->cr();
     cairo_save(cr);
     cairo_rectangle(cr, rect.x(), rect.y(), rect.width(), rect.height());
     cairo_set_line_width(cr, width);
@@ -991,12 +999,12 @@ void GraphicsContext::setLineCap(LineCap lineCap)
         cairoCap = CAIRO_LINE_CAP_SQUARE;
         break;
     }
-    cairo_set_line_cap(m_data->cr, cairoCap);
+    cairo_set_line_cap(platformContext()->cr(), cairoCap);
 }
 
 void GraphicsContext::setLineDash(const DashArray& dashes, float dashOffset)
 {
-    cairo_set_dash(m_data->cr, dashes.data(), dashes.size(), dashOffset);
+    cairo_set_dash(platformContext()->cr(), dashes.data(), dashes.size(), dashOffset);
 }
 
 void GraphicsContext::setLineJoin(LineJoin lineJoin)
@@ -1016,7 +1024,7 @@ void GraphicsContext::setLineJoin(LineJoin lineJoin)
         cairoJoin = CAIRO_LINE_JOIN_BEVEL;
         break;
     }
-    cairo_set_line_join(m_data->cr, cairoJoin);
+    cairo_set_line_join(platformContext()->cr(), cairoJoin);
 }
 
 void GraphicsContext::setMiterLimit(float miter)
@@ -1024,7 +1032,7 @@ void GraphicsContext::setMiterLimit(float miter)
     if (paintingDisabled())
         return;
 
-    cairo_set_miter_limit(m_data->cr, miter);
+    cairo_set_miter_limit(platformContext()->cr(), miter);
 }
 
 void GraphicsContext::setAlpha(float alpha)
@@ -1042,7 +1050,7 @@ void GraphicsContext::setPlatformCompositeOperation(CompositeOperator op)
     if (paintingDisabled())
         return;
 
-    cairo_set_operator(m_data->cr, toCairoOperator(op));
+    cairo_set_operator(platformContext()->cr(), toCairoOperator(op));
 }
 
 void GraphicsContext::clip(const Path& path)
@@ -1050,7 +1058,7 @@ void GraphicsContext::clip(const Path& path)
     if (paintingDisabled())
         return;
 
-    cairo_t* cr = m_data->cr;
+    cairo_t* cr = platformContext()->cr();
     OwnPtr<cairo_path_t> p(cairo_copy_path(path.platformPath()->context()));
     cairo_append_path(cr, p.get());
     cairo_fill_rule_t savedFillRule = cairo_get_fill_rule(cr);
@@ -1070,7 +1078,7 @@ void GraphicsContext::clipOut(const Path& path)
     if (paintingDisabled())
         return;
 
-    cairo_t* cr = m_data->cr;
+    cairo_t* cr = platformContext()->cr();
     double x1, y1, x2, y2;
     cairo_clip_extents(cr, &x1, &y1, &x2, &y2);
     cairo_rectangle(cr, x1, y1, x2 - x1, y2 - y1);
@@ -1087,7 +1095,7 @@ void GraphicsContext::rotate(float radians)
     if (paintingDisabled())
         return;
 
-    cairo_rotate(m_data->cr, radians);
+    cairo_rotate(platformContext()->cr(), radians);
     m_data->rotate(radians);
 }
 
@@ -1096,7 +1104,7 @@ void GraphicsContext::scale(const FloatSize& size)
     if (paintingDisabled())
         return;
 
-    cairo_scale(m_data->cr, size.width(), size.height());
+    cairo_scale(platformContext()->cr(), size.width(), size.height());
     m_data->scale(size);
 }
 
@@ -1105,7 +1113,7 @@ void GraphicsContext::clipOut(const IntRect& r)
     if (paintingDisabled())
         return;
 
-    cairo_t* cr = m_data->cr;
+    cairo_t* cr = platformContext()->cr();
     double x1, y1, x2, y2;
     cairo_clip_extents(cr, &x1, &y1, &x2, &y2);
     cairo_rectangle(cr, x1, y1, x2 - x1, y2 - y1);
@@ -1132,7 +1140,7 @@ void GraphicsContext::fillRoundedRect(const IntRect& r, const IntSize& topLeft,
     if (hasShadow())
         m_data->shadow.drawRectShadow(this, r, topLeft, topRight, bottomLeft, bottomRight);
 
-    cairo_t* cr = m_data->cr;
+    cairo_t* cr = platformContext()->cr();
     cairo_save(cr);
     Path path;
     path.addRoundedRect(r, topLeft, topRight, bottomLeft, bottomRight);
@@ -1170,7 +1178,7 @@ void GraphicsContext::setPlatformShouldAntialias(bool enable)
     // When true, use the default Cairo backend antialias mode (usually this
     // enables standard 'grayscale' antialiasing); false to explicitly disable
     // antialiasing. This is the same strategy as used in drawConvexPolygon().
-    cairo_set_antialias(m_data->cr, enable ? CAIRO_ANTIALIAS_DEFAULT : CAIRO_ANTIALIAS_NONE);
+    cairo_set_antialias(platformContext()->cr(), enable ? CAIRO_ANTIALIAS_DEFAULT : CAIRO_ANTIALIAS_NONE);
 }
 
 void GraphicsContext::setImageInterpolationQuality(InterpolationQuality)
@@ -1196,7 +1204,7 @@ void GraphicsContext::pushImageMask(cairo_surface_t* surface, const FloatRect& r
     // We want to allow the clipped elements to composite with the surface as it
     // is now, but they are isolated in another group. To make this work, we're
     // going to blit the current surface contents onto the new group once we push it.
-    cairo_t* cr = m_data->cr;
+    cairo_t* cr = platformContext()->cr();
     cairo_surface_t* currentTarget = cairo_get_target(cr);
     cairo_surface_flush(currentTarget);
 
diff --git a/Source/WebCore/platform/graphics/cairo/GraphicsContextPlatformPrivateCairo.h b/Source/WebCore/platform/graphics/cairo/GraphicsContextPlatformPrivateCairo.h
index 924f69a..2bc290b 100644
--- a/Source/WebCore/platform/graphics/cairo/GraphicsContextPlatformPrivateCairo.h
+++ b/Source/WebCore/platform/graphics/cairo/GraphicsContextPlatformPrivateCairo.h
@@ -31,6 +31,7 @@
 #include "GraphicsContext.h"
 
 #include "ContextShadow.h"
+#include "PlatformContextCairo.h"
 #include "RefPtrCairo.h"
 #include <cairo.h>
 #include <math.h>
@@ -67,8 +68,8 @@ private:
 
 class GraphicsContextPlatformPrivate {
 public:
-    GraphicsContextPlatformPrivate()
-        : cr(0)
+    GraphicsContextPlatformPrivate(PlatformContextCairo* newPlatformContext)
+        : platformContext(newPlatformContext)
 #if PLATFORM(GTK)
         , expose(0)
 #elif PLATFORM(WIN)
@@ -82,7 +83,6 @@ public:
 
     ~GraphicsContextPlatformPrivate()
     {
-        cairo_destroy(cr);
     }
 
 #if PLATFORM(WIN)
@@ -99,7 +99,7 @@ public:
     void setCTM(const AffineTransform&);
     void beginTransparencyLayer() { m_transparencyCount++; }
     void endTransparencyLayer() { m_transparencyCount--; }
-    void syncContext(PlatformGraphicsContext* cr);
+    void syncContext(cairo_t* cr);
 #else
     // On everything else, we do nothing.
     void save() {}
@@ -114,12 +114,11 @@ public:
     void setCTM(const AffineTransform&) {}
     void beginTransparencyLayer() {}
     void endTransparencyLayer() {}
-    void syncContext(PlatformGraphicsContext* cr) {}
+    void syncContext(cairo_t* cr) {}
 #endif
 
-    cairo_t* cr;
+    PlatformContextCairo* platformContext;
     Vector<float> layers;
-
     ContextShadow shadow;
     Vector<ContextShadow> shadowStack;
     Vector<ImageMaskInformation> maskImageStack;
@@ -133,6 +132,23 @@ public:
 #endif
 };
 
+// This is a specialized private section for the Cairo GraphicsContext, which knows how
+// to clean up the heap allocated PlatformContextCairo that we must use for the top-level
+// GraphicsContext.
+class GraphicsContextPlatformPrivateToplevel : public GraphicsContextPlatformPrivate {
+public:
+    GraphicsContextPlatformPrivateToplevel(PlatformContextCairo* platformContext)
+        : GraphicsContextPlatformPrivate(platformContext)
+    {
+    }
+
+    ~GraphicsContextPlatformPrivateToplevel()
+    {
+        delete platformContext;
+    }
+};
+
+
 } // namespace WebCore
 
 #endif // GraphicsContextPlatformPrivateCairo_h
diff --git a/Source/WebCore/platform/graphics/cairo/ImageBufferCairo.cpp b/Source/WebCore/platform/graphics/cairo/ImageBufferCairo.cpp
index 9ee8a94..1d5d492 100644
--- a/Source/WebCore/platform/graphics/cairo/ImageBufferCairo.cpp
+++ b/Source/WebCore/platform/graphics/cairo/ImageBufferCairo.cpp
@@ -37,7 +37,9 @@
 #include "MIMETypeRegistry.h"
 #include "NotImplemented.h"
 #include "Pattern.h"
+#include "PlatformContextCairo.h"
 #include "PlatformString.h"
+#include "RefPtrCairo.h"
 #include <cairo.h>
 #include <wtf/Vector.h>
 
@@ -66,6 +68,7 @@ namespace WebCore {
 
 ImageBufferData::ImageBufferData(const IntSize& size)
     : m_surface(0)
+    , m_platformContext(0)
 {
 }
 
@@ -80,9 +83,9 @@ ImageBuffer::ImageBuffer(const IntSize& size, ColorSpace, RenderingMode, bool& s
     if (cairo_surface_status(m_data.m_surface) != CAIRO_STATUS_SUCCESS)
         return;  // create will notice we didn't set m_initialized and fail.
 
-    cairo_t* cr = cairo_create(m_data.m_surface);
-    m_context.set(new GraphicsContext(cr));
-    cairo_destroy(cr);  // The context is now owned by the GraphicsContext.
+    RefPtr<cairo_t> cr = adoptRef(cairo_create(m_data.m_surface));
+    m_data.m_platformContext.setCr(cr.get());
+    m_context.set(new GraphicsContext(&m_data.m_platformContext));
     success = true;
 }
 
@@ -301,7 +304,7 @@ static cairo_status_t writeFunction(void* closure, const unsigned char* data, un
 
 String ImageBuffer::toDataURL(const String& mimeType, const double*) const
 {
-    cairo_surface_t* image = cairo_get_target(context()->platformContext());
+    cairo_surface_t* image = cairo_get_target(context()->platformContext()->cr());
     if (!image)
         return "data:,";
 
diff --git a/Source/WebCore/platform/graphics/cairo/ImageBufferData.h b/Source/WebCore/platform/graphics/cairo/ImageBufferData.h
index 49f15df..42867d1 100644
--- a/Source/WebCore/platform/graphics/cairo/ImageBufferData.h
+++ b/Source/WebCore/platform/graphics/cairo/ImageBufferData.h
@@ -26,7 +26,9 @@
 #ifndef ImageBufferData_h
 #define ImageBufferData_h
 
-#include "cairo.h"
+#include "PlatformContextCairo.h"
+
+typedef struct _cairo_surface cairo_surface_t;
 
 namespace WebCore {
 
@@ -37,6 +39,7 @@ public:
     ImageBufferData(const IntSize&);
 
     cairo_surface_t* m_surface;
+    PlatformContextCairo m_platformContext;
 };
 
 }  // namespace WebCore
diff --git a/Source/WebCore/platform/graphics/cairo/ImageCairo.cpp b/Source/WebCore/platform/graphics/cairo/ImageCairo.cpp
index e51d65a..d3a52ce 100644
--- a/Source/WebCore/platform/graphics/cairo/ImageCairo.cpp
+++ b/Source/WebCore/platform/graphics/cairo/ImageCairo.cpp
@@ -36,6 +36,7 @@
 #include "ContextShadow.h"
 #include "FloatRect.h"
 #include "GraphicsContext.h"
+#include "PlatformContextCairo.h"
 #include "ImageBuffer.h"
 #include "ImageObserver.h"
 #include "RefPtrCairo.h"
@@ -114,7 +115,7 @@ void BitmapImage::draw(GraphicsContext* context, const FloatRect& dst, const Flo
 
     IntSize selfSize = size();
 
-    cairo_t* cr = context->platformContext();
+    cairo_t* cr = context->platformContext()->cr();
     context->save();
 
     // Set the compositing operation.
@@ -169,8 +170,7 @@ void Image::drawPattern(GraphicsContext* context, const FloatRect& tileRect, con
     if (!image) // If it's too early we won't have an image yet.
         return;
 
-    cairo_t* cr = context->platformContext();
-
+    cairo_t* cr = context->platformContext()->cr();
     drawPatternToCairoContext(cr, image, size(), tileRect, patternTransform, phase, toCairoOperator(op), destRect);
 
     if (imageObserver())
diff --git a/Source/WebCore/platform/graphics/cairo/OwnPtrCairo.cpp b/Source/WebCore/platform/graphics/cairo/OwnPtrCairo.cpp
index 94f6809..1594e7b 100644
--- a/Source/WebCore/platform/graphics/cairo/OwnPtrCairo.cpp
+++ b/Source/WebCore/platform/graphics/cairo/OwnPtrCairo.cpp
@@ -20,7 +20,7 @@
 #include "config.h"
 #include "OwnPtrCairo.h"
 
-#if defined(USE_FREETYPE)
+#if USE(FREETYPE)
 #include <cairo-ft.h>
 #include <fontconfig/fcfreetype.h>
 #endif
@@ -29,7 +29,7 @@
 
 namespace WTF {
 
-#if defined(USE_FREETYPE)
+#if USE(FREETYPE)
 template <> void deleteOwnedPtr<FcObjectSet>(FcObjectSet* ptr)
 {
     if (ptr)
diff --git a/Source/WebCore/platform/graphics/cairo/OwnPtrCairo.h b/Source/WebCore/platform/graphics/cairo/OwnPtrCairo.h
index 035d80e..e1dd370 100644
--- a/Source/WebCore/platform/graphics/cairo/OwnPtrCairo.h
+++ b/Source/WebCore/platform/graphics/cairo/OwnPtrCairo.h
@@ -22,7 +22,7 @@
 
 #include "OwnPtr.h"
 
-#if defined(USE_FREETYPE)
+#if USE(FREETYPE)
 typedef struct _FcObjectSet FcObjectSet;
 typedef struct _FcFontSet FcFontSet;
 #endif
@@ -31,7 +31,7 @@ typedef struct cairo_path cairo_path_t;
 
 namespace WTF {
 
-#if defined(USE_FREETYPE)
+#if USE(FREETYPE)
 template <> void deleteOwnedPtr<FcObjectSet>(FcObjectSet*);
 template <> void deleteOwnedPtr<FcFontSet>(FcFontSet*);
 #endif
diff --git a/Source/WebCore/platform/graphics/cairo/PathCairo.cpp b/Source/WebCore/platform/graphics/cairo/PathCairo.cpp
index 7a09a52..533df10 100644
--- a/Source/WebCore/platform/graphics/cairo/PathCairo.cpp
+++ b/Source/WebCore/platform/graphics/cairo/PathCairo.cpp
@@ -281,7 +281,7 @@ FloatRect Path::boundingRect() const
     return FloatRect(x0, y0, x1 - x0, y1 - y0);
 }
 
-FloatRect Path::strokeBoundingRect(StrokeStyleApplier* applier)
+FloatRect Path::strokeBoundingRect(StrokeStyleApplier* applier) const
 {
     cairo_t* cr = platformPath()->context();
     if (applier) {
diff --git a/Source/WebCore/platform/mac/WebCoreKeyGenerator.h b/Source/WebCore/platform/graphics/cairo/PlatformContextCairo.cpp
index c9260e1..ba75162 100644
--- a/Source/WebCore/platform/mac/WebCoreKeyGenerator.h
+++ b/Source/WebCore/platform/graphics/cairo/PlatformContextCairo.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2003 Apple Computer, Inc.  All rights reserved.
+ * Copyright (C) 2011 Igalia S.L.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -23,10 +23,16 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
-@interface WebCoreKeyGenerator : NSObject
+#include "config.h"
+#include "PlatformContextCairo.h"
 
-+ (WebCoreKeyGenerator *)sharedGenerator;
-- (NSArray *)strengthMenuItemTitles;
-- (NSString *)signedPublicKeyAndChallengeStringWithStrengthIndex:(unsigned)index challenge:(NSString *)challenge pageURL:(NSURL *)pageURL;
+#include <cairo.h>
 
-@end
+namespace WebCore {
+
+PlatformContextCairo::PlatformContextCairo(cairo_t* cr)
+    : m_cr(cr)
+{
+}
+
+} // namespace WebCore
diff --git a/Source/WebCore/platform/graphics/cairo/PlatformContextCairo.h b/Source/WebCore/platform/graphics/cairo/PlatformContextCairo.h
new file mode 100644
index 0000000..c6cceda
--- /dev/null
+++ b/Source/WebCore/platform/graphics/cairo/PlatformContextCairo.h
@@ -0,0 +1,52 @@
+/*
+ * Copyright (C) 2011 Igalia S.L.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef PlatformContextCairo_h
+#define PlatformContextCairo_h
+
+#include "ContextShadow.h"
+#include "RefPtrCairo.h"
+
+namespace WebCore {
+
+// Much like PlatformContextSkia in the Skia port, this class holds information that
+// would normally be private to GraphicsContext, except that we want to allow access
+// to it in Font and Image code. This allows us to separate the concerns of Cairo-specific
+// code from the platform-independent GraphicsContext.
+
+class PlatformContextCairo {
+    WTF_MAKE_NONCOPYABLE(PlatformContextCairo);
+public:
+    PlatformContextCairo(cairo_t*);
+    cairo_t* cr() { return m_cr.get(); }
+    void setCr(cairo_t* cr) { m_cr = cr; }
+
+private:
+    RefPtr<cairo_t> m_cr;
+};
+
+} // namespace WebCore
+
+#endif // PlatformContextCairo_h
diff --git a/Source/WebCore/platform/graphics/cairo/RefPtrCairo.cpp b/Source/WebCore/platform/graphics/cairo/RefPtrCairo.cpp
index c8b242c..1792002 100644
--- a/Source/WebCore/platform/graphics/cairo/RefPtrCairo.cpp
+++ b/Source/WebCore/platform/graphics/cairo/RefPtrCairo.cpp
@@ -21,7 +21,7 @@
 
 #include <cairo.h>
 
-#if defined(USE_FREETYPE)
+#if USE(FREETYPE)
 #include <cairo-ft.h>
 #include <fontconfig/fcfreetype.h>
 #endif
@@ -88,7 +88,7 @@ template<> void derefIfNotNull(cairo_pattern_t* ptr)
         cairo_pattern_destroy(ptr);
 }
 
-#if defined(USE_FREETYPE)
+#if USE(FREETYPE)
 template<> void refIfNotNull(FcPattern* ptr)
 {
     if (LIKELY(ptr != 0))
diff --git a/Source/WebCore/platform/graphics/cairo/RefPtrCairo.h b/Source/WebCore/platform/graphics/cairo/RefPtrCairo.h
index 204d1e3..540f9dc 100644
--- a/Source/WebCore/platform/graphics/cairo/RefPtrCairo.h
+++ b/Source/WebCore/platform/graphics/cairo/RefPtrCairo.h
@@ -28,7 +28,7 @@ typedef struct _cairo_font_face cairo_font_face_t;
 typedef struct _cairo_scaled_font cairo_scaled_font_t;
 typedef struct _cairo_pattern cairo_pattern_t;
 
-#if defined(USE_FREETYPE)
+#if USE(FREETYPE)
 typedef struct _FcPattern FcPattern;
 #endif
 
@@ -49,7 +49,7 @@ template<> void derefIfNotNull(cairo_scaled_font_t* ptr);
 template<> void refIfNotNull(cairo_pattern_t*);
 template<> void derefIfNotNull(cairo_pattern_t*);
 
-#if defined(USE_FREETYPE)
+#if USE(FREETYPE)
 template<> void refIfNotNull(FcPattern* ptr);
 template<> void derefIfNotNull(FcPattern* ptr);
 #endif
diff --git a/Source/WebCore/platform/graphics/cg/FontPlatformData.h b/Source/WebCore/platform/graphics/cg/FontPlatformData.h
deleted file mode 100644
index e21b444..0000000
--- a/Source/WebCore/platform/graphics/cg/FontPlatformData.h
+++ /dev/null
@@ -1,105 +0,0 @@
-/*
- * This file is part of the internal font implementation.  It should not be included by anyone other than
- * FontMac.cpp, FontWin.cpp and Font.cpp.
- *
- * Copyright (C) 2006, 2007, 2008, 2010 Apple Inc.
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Library General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Library General Public License for more details.
- *
- * You should have received a copy of the GNU Library General Public License
- * along with this library; see the file COPYING.LIB.  If not, write to
- * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- * Boston, MA 02110-1301, USA.
- *
- */
-
-#ifndef FontPlatformData_h
-#define FontPlatformData_h
-
-#include "FontOrientation.h"
-#include "RefCountedGDIHandle.h"
-#include "StringImpl.h"
-#include <wtf/Forward.h>
-#include <wtf/PassRefPtr.h>
-#include <wtf/RefCounted.h>
-#include <wtf/RetainPtr.h>
-
-typedef struct HFONT__* HFONT;
-typedef struct CGFont* CGFontRef;
-
-namespace WebCore {
-
-class FontDescription;
-
-class FontPlatformData {
-public:
-    FontPlatformData()
-        : m_size(0)
-        , m_syntheticBold(false)
-        , m_syntheticOblique(false)
-        , m_useGDI(false)
-    {
-    }
-
-    FontPlatformData(HFONT, float size, bool bold, bool oblique, bool useGDI);
-    FontPlatformData(float size, bool bold, bool oblique);
-
-    FontPlatformData(HFONT, CGFontRef, float size, bool bold, bool oblique, bool useGDI);
-    ~FontPlatformData();
-
-    FontPlatformData(WTF::HashTableDeletedValueType) : m_font(WTF::HashTableDeletedValue) { }
-    bool isHashTableDeletedValue() const { return m_font.isHashTableDeletedValue(); }
-
-    HFONT hfont() const { return m_font->handle(); }
-    CGFontRef cgFont() const { return m_cgFont.get(); }
-
-    float size() const { return m_size; }
-    void setSize(float size) { m_size = size; }
-    bool syntheticBold() const { return m_syntheticBold; }
-    bool syntheticOblique() const { return m_syntheticOblique; }
-    bool useGDI() const { return m_useGDI; }
-
-    FontOrientation orientation() const { return Horizontal; } // FIXME: Implement.
-
-    unsigned hash() const
-    {
-        return m_font->hash();
-    }
-
-    bool operator==(const FontPlatformData& other) const
-    { 
-        return m_font == other.m_font
-            && m_cgFont == other.m_cgFont
-            && m_size == other.m_size
-            && m_syntheticBold == other.m_syntheticBold
-            && m_syntheticOblique == other.m_syntheticOblique
-            && m_useGDI == other.m_useGDI;
-    }
-
-#ifndef NDEBUG
-    String description() const;
-#endif
-
-private:
-    void platformDataInit(HFONT, float size, HDC, WCHAR* faceName);
-
-    RefPtr<RefCountedGDIHandle<HFONT> > m_font;
-    RetainPtr<CGFontRef> m_cgFont;
-
-    float m_size;
-    bool m_syntheticBold;
-    bool m_syntheticOblique;
-    bool m_useGDI;
-};
-
-} // namespace WebCore
-
-#endif
diff --git a/Source/WebCore/platform/graphics/cg/GraphicsContextCG.cpp b/Source/WebCore/platform/graphics/cg/GraphicsContextCG.cpp
index dbcab45..7799137 100644
--- a/Source/WebCore/platform/graphics/cg/GraphicsContextCG.cpp
+++ b/Source/WebCore/platform/graphics/cg/GraphicsContextCG.cpp
@@ -695,7 +695,7 @@ void GraphicsContext::fillRect(const FloatRect& rect)
     if (m_state.fillPattern)
         applyFillPattern();
 
-    bool drawOwnShadow = hasBlurredShadow(m_state) && !m_state.shadowsIgnoreTransforms; // Don't use ShadowBlur for canvas yet.
+    bool drawOwnShadow = !isAcceleratedContext() && hasBlurredShadow(m_state) && !m_state.shadowsIgnoreTransforms; // Don't use ShadowBlur for canvas yet.
     if (drawOwnShadow) {
         float shadowBlur = m_state.shadowsUseLegacyRadius ? radiusToLegacyRadius(m_state.shadowBlur) : m_state.shadowBlur;
         // Turn off CG shadows.
@@ -724,7 +724,7 @@ void GraphicsContext::fillRect(const FloatRect& rect, const Color& color, ColorS
     if (oldFillColor != color || oldColorSpace != colorSpace)
         setCGFillColor(context, color, colorSpace);
 
-    bool drawOwnShadow = hasBlurredShadow(m_state) && !m_state.shadowsIgnoreTransforms; // Don't use ShadowBlur for canvas yet.
+    bool drawOwnShadow = !isAcceleratedContext() && hasBlurredShadow(m_state) && !m_state.shadowsIgnoreTransforms; // Don't use ShadowBlur for canvas yet.
     if (drawOwnShadow) {
         float shadowBlur = m_state.shadowsUseLegacyRadius ? radiusToLegacyRadius(m_state.shadowBlur) : m_state.shadowBlur;
         // Turn off CG shadows.
@@ -759,7 +759,7 @@ void GraphicsContext::fillRoundedRect(const IntRect& rect, const IntSize& topLef
     Path path;
     path.addRoundedRect(rect, topLeft, topRight, bottomLeft, bottomRight);
 
-    bool drawOwnShadow = hasBlurredShadow(m_state) && !m_state.shadowsIgnoreTransforms; // Don't use ShadowBlur for canvas yet.
+    bool drawOwnShadow = !isAcceleratedContext() && hasBlurredShadow(m_state) && !m_state.shadowsIgnoreTransforms; // Don't use ShadowBlur for canvas yet.
     if (drawOwnShadow) {
         float shadowBlur = m_state.shadowsUseLegacyRadius ? radiusToLegacyRadius(m_state.shadowBlur) : m_state.shadowBlur;
 
@@ -803,7 +803,7 @@ void GraphicsContext::fillRectWithRoundedHole(const IntRect& rect, const Rounded
     setFillColor(color, colorSpace);
 
     // fillRectWithRoundedHole() assumes that the edges of rect are clipped out, so we only care about shadows cast around inside the hole.
-    bool drawOwnShadow = hasBlurredShadow(m_state) && !m_state.shadowsIgnoreTransforms;
+    bool drawOwnShadow = !isAcceleratedContext() && hasBlurredShadow(m_state) && !m_state.shadowsIgnoreTransforms;
     if (drawOwnShadow) {
         float shadowBlur = m_state.shadowsUseLegacyRadius ? radiusToLegacyRadius(m_state.shadowBlur) : m_state.shadowBlur;
 
@@ -929,8 +929,7 @@ void GraphicsContext::setPlatformShadow(const FloatSize& offset, float blur, con
 
         CGFloat smallEigenvalue = narrowPrecisionToCGFloat(sqrt(0.5 * ((A + D) - sqrt(4 * B * C + (A - D) * (A - D)))));
 
-        // Extreme "blur" values can make text drawing crash or take crazy long times, so clamp
-        blurRadius = min(blur * smallEigenvalue, narrowPrecisionToCGFloat(1000.0));
+        blurRadius = blur * smallEigenvalue;
 
         CGSize offsetInBaseSpace = CGSizeApplyAffineTransform(offset, userToBaseCTM);
 
@@ -938,6 +937,9 @@ void GraphicsContext::setPlatformShadow(const FloatSize& offset, float blur, con
         yOffset = offsetInBaseSpace.height;
     }
 
+    // Extreme "blur" values can make text drawing crash or take crazy long times, so clamp
+    blurRadius = min(blurRadius, narrowPrecisionToCGFloat(1000.0));
+
     // Work around <rdar://problem/5539388> by ensuring that the offsets will get truncated
     // to the desired integer.
     static const CGFloat extraShadowOffset = narrowPrecisionToCGFloat(1.0 / 128);
@@ -1343,14 +1345,30 @@ void GraphicsContext::setAllowsFontSmoothing(bool allowsFontSmoothing)
 #endif
 }
 
-void GraphicsContext::setIsCALayerContext(bool)
+void GraphicsContext::setIsCALayerContext(bool isLayerContext)
 {
-    m_data->m_isCALayerContext = true;
+    if (isLayerContext)
+        m_data->m_contextFlags |= IsLayerCGContext;
+    else
+        m_data->m_contextFlags &= ~IsLayerCGContext;
 }
 
 bool GraphicsContext::isCALayerContext() const
 {
-    return m_data->m_isCALayerContext;
+    return m_data->m_contextFlags & IsLayerCGContext;
+}
+
+void GraphicsContext::setIsAcceleratedContext(bool isAccelerated)
+{
+    if (isAccelerated)
+        m_data->m_contextFlags |= IsAcceleratedCGContext;
+    else
+        m_data->m_contextFlags &= ~IsAcceleratedCGContext;
+}
+
+bool GraphicsContext::isAcceleratedContext() const
+{
+    return m_data->m_contextFlags & IsAcceleratedCGContext;
 }
 
 void GraphicsContext::setPlatformTextDrawingMode(TextDrawingModeFlags mode)
diff --git a/Source/WebCore/platform/graphics/cg/GraphicsContextPlatformPrivateCG.h b/Source/WebCore/platform/graphics/cg/GraphicsContextPlatformPrivateCG.h
index f9255df..722f5a0 100644
--- a/Source/WebCore/platform/graphics/cg/GraphicsContextPlatformPrivateCG.h
+++ b/Source/WebCore/platform/graphics/cg/GraphicsContextPlatformPrivateCG.h
@@ -31,9 +31,16 @@
 
 namespace WebCore {
 
+enum GraphicsContextCGFlag {
+    IsLayerCGContext = 1 << 0,
+    IsAcceleratedCGContext = 1 << 1
+};
+
+typedef unsigned GraphicsContextCGFlags;
+
 class GraphicsContextPlatformPrivate {
 public:
-    GraphicsContextPlatformPrivate(CGContextRef cgContext, bool isLayerContext = false)
+    GraphicsContextPlatformPrivate(CGContextRef cgContext, GraphicsContextCGFlags flags = 0)
         : m_cgContext(cgContext)
 #if PLATFORM(WIN)
         , m_hdc(0)
@@ -41,7 +48,7 @@ public:
         , m_shouldIncludeChildWindows(false)
 #endif
         , m_userToDeviceTransformKnownToBeIdentity(false)
-        , m_isCALayerContext(isLayerContext)
+        , m_contextFlags(flags)
     {
     }
     
@@ -87,7 +94,7 @@ public:
 
     RetainPtr<CGContextRef> m_cgContext;
     bool m_userToDeviceTransformKnownToBeIdentity;
-    bool m_isCALayerContext;
+    GraphicsContextCGFlags m_contextFlags;
 };
 
 }
diff --git a/Source/WebCore/platform/graphics/cg/ImageBufferCG.cpp b/Source/WebCore/platform/graphics/cg/ImageBufferCG.cpp
index 7c8e313..3c8f959 100644
--- a/Source/WebCore/platform/graphics/cg/ImageBufferCG.cpp
+++ b/Source/WebCore/platform/graphics/cg/ImageBufferCG.cpp
@@ -32,6 +32,7 @@
 #include "BitmapImage.h"
 #include "GraphicsContext.h"
 #include "GraphicsContextCG.h"
+#include "ImageData.h"
 #include "MIMETypeRegistry.h"
 #include <ApplicationServices/ApplicationServices.h>
 #include <wtf/Assertions.h>
@@ -498,21 +499,8 @@ static RetainPtr<CFStringRef> utiFromMIMEType(const String& mimeType)
 #endif
 }
 
-String ImageBuffer::toDataURL(const String& mimeType, const double* quality) const
+static String CGImageToDataURL(CGImageRef image, const String& mimeType, const double* quality)
 {
-    ASSERT(MIMETypeRegistry::isSupportedImageMIMETypeForEncoding(mimeType));
-
-    RetainPtr<CGImageRef> image;
-    if (!m_accelerateRendering)
-        image.adoptCF(CGBitmapContextCreateImage(context()->platformContext()));
-#if USE(IOSURFACE_CANVAS_BACKING_STORE)
-    else
-        image.adoptCF(wkIOSurfaceContextCreateImage(context()->platformContext()));
-#endif
-
-    if (!image)
-        return "data:,";
-
     RetainPtr<CFMutableDataRef> data(AdoptCF, CFDataCreateMutable(kCFAllocatorDefault, 0));
     if (!data)
         return "data:,";
@@ -533,7 +521,7 @@ String ImageBuffer::toDataURL(const String& mimeType, const double* quality) con
         imageProperties.adoptCF(CFDictionaryCreate(0, &key, &value, 1, &kCFTypeDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks));
     }
 
-    CGImageDestinationAddImage(destination.get(), image.get(), imageProperties.get());
+    CGImageDestinationAddImage(destination.get(), image, imageProperties.get());
     CGImageDestinationFinalize(destination.get());
 
     Vector<char> out;
@@ -541,4 +529,46 @@ String ImageBuffer::toDataURL(const String& mimeType, const double* quality) con
 
     return makeString("data:", mimeType, ";base64,", out);
 }
+
+String ImageBuffer::toDataURL(const String& mimeType, const double* quality) const
+{
+    ASSERT(MIMETypeRegistry::isSupportedImageMIMETypeForEncoding(mimeType));
+
+    RetainPtr<CGImageRef> image;
+    if (!m_accelerateRendering)
+        image.adoptCF(CGBitmapContextCreateImage(context()->platformContext()));
+#if USE(IOSURFACE_CANVAS_BACKING_STORE)
+    else
+        image.adoptCF(wkIOSurfaceContextCreateImage(context()->platformContext()));
+#endif
+
+    if (!image)
+        return "data:,";
+
+    return CGImageToDataURL(image.get(), mimeType, quality);
+}
+
+String ImageDataToDataURL(const ImageData& source, const String& mimeType, const double* quality)
+{
+    ASSERT(MIMETypeRegistry::isSupportedImageMIMETypeForEncoding(mimeType));
+        
+    RetainPtr<CGImageRef> image;
+    RetainPtr<CGDataProviderRef> dataProvider;
+    
+    dataProvider.adoptCF(CGDataProviderCreateWithData(0, source.data()->data()->data(),
+                                                      4 * source.width() * source.height(), 0));
+    
+    if (!dataProvider)
+        return "data:,";
+
+    image.adoptCF(CGImageCreate(source.width(), source.height(), 8, 32, 4 * source.width(),
+                                CGColorSpaceCreateDeviceRGB(), kCGBitmapByteOrderDefault | kCGImageAlphaLast,
+                                dataProvider.get(), 0, false, kCGRenderingIntentDefault));
+                                
+        
+    if (!image)
+        return "data:,";
+
+    return CGImageToDataURL(image.get(), mimeType, quality);
+}
 } // namespace WebCore
diff --git a/Source/WebCore/platform/graphics/cg/PathCG.cpp b/Source/WebCore/platform/graphics/cg/PathCG.cpp
index d6a1e6e..b8fc7d4 100644
--- a/Source/WebCore/platform/graphics/cg/PathCG.cpp
+++ b/Source/WebCore/platform/graphics/cg/PathCG.cpp
@@ -166,7 +166,7 @@ FloatRect Path::boundingRect() const
     return CGPathGetBoundingBox(m_path);
 }
 
-FloatRect Path::strokeBoundingRect(StrokeStyleApplier* applier)
+FloatRect Path::strokeBoundingRect(StrokeStyleApplier* applier) const
 {
     CGContextRef context = scratchContext();
 
diff --git a/Source/WebCore/platform/graphics/chromium/Canvas2DLayerChromium.cpp b/Source/WebCore/platform/graphics/chromium/Canvas2DLayerChromium.cpp
index ad961aa..4cb119a 100644
--- a/Source/WebCore/platform/graphics/chromium/Canvas2DLayerChromium.cpp
+++ b/Source/WebCore/platform/graphics/chromium/Canvas2DLayerChromium.cpp
@@ -56,7 +56,7 @@ Canvas2DLayerChromium::~Canvas2DLayerChromium()
         layerRendererContext()->deleteTexture(m_textureId);
 }
 
-void Canvas2DLayerChromium::updateContentsIfDirty()
+void Canvas2DLayerChromium::updateCompositorResources()
 {
     if (!m_contentsDirty || !m_drawingBuffer)
         return;
diff --git a/Source/WebCore/platform/graphics/chromium/Canvas2DLayerChromium.h b/Source/WebCore/platform/graphics/chromium/Canvas2DLayerChromium.h
index a14cb98..81b118c 100644
--- a/Source/WebCore/platform/graphics/chromium/Canvas2DLayerChromium.h
+++ b/Source/WebCore/platform/graphics/chromium/Canvas2DLayerChromium.h
@@ -46,7 +46,7 @@ public:
     static PassRefPtr<Canvas2DLayerChromium> create(DrawingBuffer*, GraphicsLayerChromium* owner);
     virtual ~Canvas2DLayerChromium();
     virtual bool drawsContent() const { return true; }
-    virtual void updateContentsIfDirty();
+    virtual void updateCompositorResources();
 
     void setTextureChanged();
     unsigned textureId() const;
@@ -55,8 +55,6 @@ public:
 private:
     explicit Canvas2DLayerChromium(DrawingBuffer*, GraphicsLayerChromium* owner);
     DrawingBuffer* m_drawingBuffer;
-
-    static unsigned m_shaderProgramId;
 };
 
 }
diff --git a/Source/WebCore/platform/graphics/chromium/CanvasLayerChromium.cpp b/Source/WebCore/platform/graphics/chromium/CanvasLayerChromium.cpp
index 0264868..f306207 100644
--- a/Source/WebCore/platform/graphics/chromium/CanvasLayerChromium.cpp
+++ b/Source/WebCore/platform/graphics/chromium/CanvasLayerChromium.cpp
@@ -40,8 +40,6 @@
 
 namespace WebCore {
 
-unsigned CanvasLayerChromium::m_shaderProgramId = 0;
-
 CanvasLayerChromium::CanvasLayerChromium(GraphicsLayerChromium* owner)
     : LayerChromium(owner)
     , m_textureChanged(true)
@@ -54,22 +52,18 @@ CanvasLayerChromium::~CanvasLayerChromium()
 {
 }
 
-void CanvasLayerChromium::draw()
+PassRefPtr<CCLayerImpl> CanvasLayerChromium::createCCLayerImpl()
 {
-    ASSERT(layerRenderer());
-    const CanvasLayerChromium::Program* program = layerRenderer()->canvasLayerProgram();
-    ASSERT(program && program->initialized());
-    GraphicsContext3D* context = layerRendererContext();
-    GLC(context, context->activeTexture(GraphicsContext3D::TEXTURE0));
-    GLC(context, context->bindTexture(GraphicsContext3D::TEXTURE_2D, m_textureId));
-    GC3Denum sfactor = m_premultipliedAlpha ? GraphicsContext3D::ONE : GraphicsContext3D::SRC_ALPHA;
-    GLC(context, context->blendFunc(sfactor, GraphicsContext3D::ONE_MINUS_SRC_ALPHA));
-    layerRenderer()->useShader(program->program());
-    GLC(context, context->uniform1i(program->fragmentShader().samplerLocation(), 0));
-    drawTexturedQuad(context, layerRenderer()->projectionMatrix(), ccLayerImpl()->drawTransform(),
-                     bounds().width(), bounds().height(), ccLayerImpl()->drawOpacity(),
-                     program->vertexShader().matrixLocation(),
-                     program->fragmentShader().alphaLocation());
+    return CCCanvasLayerImpl::create(this);
+}
+
+void CanvasLayerChromium::pushPropertiesTo(CCLayerImpl* layer)
+{
+    LayerChromium::pushPropertiesTo(layer);
+
+    CCCanvasLayerImpl* canvasLayer = static_cast<CCCanvasLayerImpl*>(layer);
+    canvasLayer->setTextureId(m_textureId);
+    canvasLayer->setPremultipliedAlpha(m_premultipliedAlpha);
 }
 
 }
diff --git a/Source/WebCore/platform/graphics/chromium/CanvasLayerChromium.h b/Source/WebCore/platform/graphics/chromium/CanvasLayerChromium.h
index ed3a06f..cb2ccc9 100644
--- a/Source/WebCore/platform/graphics/chromium/CanvasLayerChromium.h
+++ b/Source/WebCore/platform/graphics/chromium/CanvasLayerChromium.h
@@ -43,9 +43,9 @@ class CanvasLayerChromium : public LayerChromium {
 public:
     virtual ~CanvasLayerChromium();
 
-    virtual void draw();
+    virtual PassRefPtr<CCLayerImpl> createCCLayerImpl();
 
-    typedef ProgramBinding<VertexShaderPosTex, FragmentShaderRGBATexFlipAlpha> Program;
+    virtual void pushPropertiesTo(CCLayerImpl*);
 
 protected:
     explicit CanvasLayerChromium(GraphicsLayerChromium* owner);
@@ -55,9 +55,6 @@ protected:
     bool m_textureChanged;
     unsigned m_textureId;
     bool m_premultipliedAlpha;
-
-private:
-    static unsigned m_shaderProgramId;
 };
 
 }
diff --git a/Source/WebCore/platform/graphics/chromium/ContentLayerChromium.cpp b/Source/WebCore/platform/graphics/chromium/ContentLayerChromium.cpp
index 78f93d5..4ea9c92 100644
--- a/Source/WebCore/platform/graphics/chromium/ContentLayerChromium.cpp
+++ b/Source/WebCore/platform/graphics/chromium/ContentLayerChromium.cpp
@@ -66,7 +66,7 @@ void ContentLayerChromium::cleanupResources()
     m_contentsTexture.clear();
 }
 
-bool ContentLayerChromium::requiresClippedUpdateRect() const
+bool ContentLayerChromium::requiresClippedUpdateRect()
 {
     // To avoid allocating excessively large textures, switch into "large layer mode" if
     // one of the layer's dimensions is larger than 2000 pixels or the size of
@@ -77,7 +77,7 @@ bool ContentLayerChromium::requiresClippedUpdateRect() const
             || !layerRenderer()->checkTextureSize(bounds()));
 }
 
-void ContentLayerChromium::updateContentsIfDirty()
+void ContentLayerChromium::paintContentsIfDirty()
 {
     RenderLayerBacking* backing = static_cast<RenderLayerBacking*>(m_owner->client());
     if (!backing || backing->paintingGoesToWindow())
@@ -93,34 +93,25 @@ void ContentLayerChromium::updateContentsIfDirty()
 
     // FIXME: Remove this test when tiled layers are implemented.
     if (requiresClippedUpdateRect()) {
-        // A layer with 3D transforms could require an arbitrarily large number
-        // of texels to be repainted, so ignore these layers until tiling is
-        // implemented.
-        if (!ccLayerImpl()->drawTransform().isIdentityOrTranslation()) {
-            m_skipsDraw = true;
-            return;
-        }
-
         // Calculate the region of this layer that is currently visible.
         const IntRect clipRect = ccLayerImpl()->targetRenderSurface()->contentRect();
 
         TransformationMatrix layerOriginTransform = ccLayerImpl()->drawTransform();
         layerOriginTransform.translate3d(-0.5 * bounds().width(), -0.5 * bounds().height(), 0);
 
-        // For now we apply the large layer treatment only for layers that are either untransformed
-        // or are purely translated. Their matrix is expected to be invertible.
-        ASSERT(layerOriginTransform.isInvertible());
-
+        // We compute the visible portion of the layer by back-mapping the current RenderSurface
+        // content area to the layer. To do that, we invert the drawing matrix of the layer
+        // and project the content area rectangle to it. If the layer transform is not invertible
+        // then we skip rendering the layer.
+        if (!layerOriginTransform.isInvertible()) {
+            m_skipsDraw = true;
+            return;
+        }
         TransformationMatrix targetToLayerMatrix = layerOriginTransform.inverse();
-        IntRect visibleRectInLayerCoords = targetToLayerMatrix.mapRect(clipRect);
+        FloatQuad mappedClipToLayer = targetToLayerMatrix.projectQuad(FloatRect(clipRect));
+        IntRect visibleRectInLayerCoords = mappedClipToLayer.enclosingBoundingBox();
         visibleRectInLayerCoords.intersect(IntRect(0, 0, bounds().width(), bounds().height()));
 
-        // For normal layers, the center of the texture corresponds with the center of the layer.
-        // In large layers the center of the texture is the center of the visible region so we have
-        // to keep track of the offset in order to render correctly.
-        IntRect visibleRectInSurfaceCoords = layerOriginTransform.mapRect(visibleRectInLayerCoords);
-        m_layerCenterInSurfaceCoords = FloatRect(visibleRectInSurfaceCoords).center();
-
         // If this is still too large to render, then skip the layer completely.
         if (!layerRenderer()->checkTextureSize(visibleRectInLayerCoords.size())) {
             m_skipsDraw = true;
@@ -256,9 +247,14 @@ void ContentLayerChromium::draw()
     GLC(context, context->blendFunc(GraphicsContext3D::ONE, GraphicsContext3D::ONE_MINUS_SRC_ALPHA));
 
     if (requiresClippedUpdateRect()) {
-        float m43 = ccLayerImpl()->drawTransform().m43();
-        TransformationMatrix transform;
-        transform.translate3d(m_layerCenterInSurfaceCoords.x(), m_layerCenterInSurfaceCoords.y(), m43);
+        // Compute the offset between the layer's center point and the center of the visible portion
+        // of the layer.
+        FloatPoint visibleRectCenterOffset = FloatRect(m_visibleRectInLayerCoords).center();
+        visibleRectCenterOffset.move(-0.5 * bounds().width(), -0.5 * bounds().height());
+
+        TransformationMatrix transform = ccLayerImpl()->drawTransform();
+        transform.translate(visibleRectCenterOffset.x(), visibleRectCenterOffset.y());
+
         drawTexturedQuad(context, layerRenderer()->projectionMatrix(),
                          transform, m_visibleRectInLayerCoords.width(),
                          m_visibleRectInLayerCoords.height(), ccLayerImpl()->drawOpacity(),
@@ -273,6 +269,11 @@ void ContentLayerChromium::draw()
     unreserveContentsTexture();
 }
 
+void ContentLayerChromium::updateCompositorResources()
+{
+    updateTextureIfNeeded();
+}
+
 void ContentLayerChromium::unreserveContentsTexture()
 {
     if (!m_skipsDraw && m_contentsTexture)
@@ -281,8 +282,6 @@ void ContentLayerChromium::unreserveContentsTexture()
 
 void ContentLayerChromium::bindContentsTexture()
 {
-    updateTextureIfNeeded();
-
     if (!m_skipsDraw && m_contentsTexture)
         m_contentsTexture->bindTexture();
 }
diff --git a/Source/WebCore/platform/graphics/chromium/ContentLayerChromium.h b/Source/WebCore/platform/graphics/chromium/ContentLayerChromium.h
index 6f070c2..cf296ab 100644
--- a/Source/WebCore/platform/graphics/chromium/ContentLayerChromium.h
+++ b/Source/WebCore/platform/graphics/chromium/ContentLayerChromium.h
@@ -50,7 +50,8 @@ public:
 
     virtual ~ContentLayerChromium();
 
-    virtual void updateContentsIfDirty();
+    virtual void paintContentsIfDirty();
+    virtual void updateCompositorResources();
     virtual void unreserveContentsTexture();
     virtual void bindContentsTexture();
 
@@ -63,7 +64,7 @@ protected:
     explicit ContentLayerChromium(GraphicsLayerChromium* owner);
 
     virtual void cleanupResources();
-    bool requiresClippedUpdateRect() const;
+    bool requiresClippedUpdateRect();
     void resizeUploadBuffer(const IntSize&);
 
     virtual const char* layerTypeAsString() const { return "ContentLayer"; }
@@ -82,7 +83,6 @@ private:
     PlatformCanvas m_canvas;
 
     IntRect m_visibleRectInLayerCoords;
-    FloatPoint m_layerCenterInSurfaceCoords;
 };
 
 }
diff --git a/Source/WebCore/platform/graphics/chromium/CrossProcessFontLoading.mm b/Source/WebCore/platform/graphics/chromium/CrossProcessFontLoading.mm
index 227fbe4..b442d53 100644
--- a/Source/WebCore/platform/graphics/chromium/CrossProcessFontLoading.mm
+++ b/Source/WebCore/platform/graphics/chromium/CrossProcessFontLoading.mm
@@ -29,7 +29,7 @@
 #import "config.h"
 #import "CrossProcessFontLoading.h"
 
-#import "../graphics/cocoa/FontPlatformData.h"
+#import "../graphics/FontPlatformData.h"
 #import "PlatformBridge.h"
 #import <AppKit/NSFont.h>
 #import <wtf/HashMap.h>
diff --git a/Source/WebCore/platform/graphics/chromium/DrawingBufferChromium.cpp b/Source/WebCore/platform/graphics/chromium/DrawingBufferChromium.cpp
index d956841..e559edb 100644
--- a/Source/WebCore/platform/graphics/chromium/DrawingBufferChromium.cpp
+++ b/Source/WebCore/platform/graphics/chromium/DrawingBufferChromium.cpp
@@ -46,10 +46,6 @@
 
 namespace WebCore {
 
-#if ENABLE(SKIA_GPU)
-extern GrContext* GetGlobalGrContext();
-#endif
-
 struct DrawingBufferInternal {
     unsigned offscreenColorTexture;
 #if USE(ACCELERATED_COMPOSITING)
@@ -91,6 +87,9 @@ DrawingBuffer::DrawingBuffer(GraphicsContext3D* context,
     , m_multisampleFBO(0)
     , m_multisampleColorBuffer(0)
     , m_internal(new DrawingBufferInternal)
+#if ENABLE(SKIA_GPU)
+    , m_grContext(0)
+#endif
 {
     if (!m_context->getExtensions()->supports("GL_CHROMIUM_copy_texture_to_parent_texture")) {
         m_context.clear();
@@ -137,7 +136,8 @@ void DrawingBuffer::publishToPlatformLayer()
     // would insert a fence into the child command stream that the compositor could wait for.
     m_context->makeContextCurrent();
 #if ENABLE(SKIA_GPU)
-    GetGlobalGrContext()->flush(false);
+    if (m_grContext)
+        m_grContext->flush(0);
 #endif
     static_cast<Extensions3DChromium*>(m_context->getExtensions())->copyTextureToParentTextureCHROMIUM(m_colorBuffer, parentTexture);
     m_context->flush();
@@ -166,4 +166,13 @@ Platform3DObject DrawingBuffer::platformColorBuffer() const
     return m_colorBuffer;
 }
 
+#if ENABLE(SKIA_GPU)
+void DrawingBuffer::setGrContext(GrContext* context)
+{
+    // We just take a ptr without referencing it, as we require that we never outlive
+    // the SharedGraphicsContext3D object that is giving us the context.
+    m_grContext = context;
+}
+#endif
+
 }
diff --git a/Source/WebCore/platform/graphics/chromium/FontCacheLinux.cpp b/Source/WebCore/platform/graphics/chromium/FontCacheLinux.cpp
index bbe6d62..598ae86 100644
--- a/Source/WebCore/platform/graphics/chromium/FontCacheLinux.cpp
+++ b/Source/WebCore/platform/graphics/chromium/FontCacheLinux.cpp
@@ -153,7 +153,8 @@ FontPlatformData* FontCache::createFontPlatformData(const FontDescription& fontD
                              fontDescription.computedSize(),
                              (style & SkTypeface::kBold) && !tf->isBold(),
                              (style & SkTypeface::kItalic) && !tf->isItalic(),
-                             fontDescription.orientation());
+                             fontDescription.orientation(),
+                             fontDescription.textOrientation());
     tf->unref();
     return result;
 }
diff --git a/Source/WebCore/platform/graphics/chromium/FontChromiumWin.cpp b/Source/WebCore/platform/graphics/chromium/FontChromiumWin.cpp
index e57a84c..3c254dc 100644
--- a/Source/WebCore/platform/graphics/chromium/FontChromiumWin.cpp
+++ b/Source/WebCore/platform/graphics/chromium/FontChromiumWin.cpp
@@ -196,7 +196,7 @@ class TransparencyAwareGlyphPainter : public TransparencyAwareFontPainter {
     // left of m_point. We express it this way so that if we're using the Skia
     // drawing path we can use floating-point positioning, even though we have
     // to use integer positioning in the GDI path.
-    bool drawGlyphs(int numGlyphs, const WORD* glyphs, const int* advances, int startAdvance) const;
+    bool drawGlyphs(int numGlyphs, const WORD* glyphs, const int* advances, float startAdvance) const;
 
  private:
     virtual IntRect estimateTextBounds();
@@ -256,11 +256,11 @@ IntRect TransparencyAwareGlyphPainter::estimateTextBounds()
 bool TransparencyAwareGlyphPainter::drawGlyphs(int numGlyphs,
                                                const WORD* glyphs,
                                                const int* advances,
-                                               int startAdvance) const
+                                               float startAdvance) const
 {
     if (!m_useGDI) {
         SkPoint origin = m_point;
-        origin.fX += startAdvance;
+        origin.fX += SkFloatToScalar(startAdvance);
         return paintSkiaText(m_graphicsContext, m_font->platformData().hfont(),
                              numGlyphs, glyphs, advances, 0, &origin);
     }
@@ -400,17 +400,25 @@ void Font::drawGlyphs(GraphicsContext* graphicsContext,
     Vector<WORD, kMaxBufferLength> glyphs;
     Vector<int, kMaxBufferLength> advances;
     int glyphIndex = 0;  // The starting glyph of the current chunk.
-    int curAdvance = 0;  // How far from the left the current chunk is.
+
+    // In order to round all offsets to the correct pixel boundary, this code keeps track of the absolute position
+    // of each glyph in floating point units and rounds to integer advances at the last possible moment.
+
+    float horizontalOffset = point.x(); // The floating point offset of the left side of the current glyph.
+    int lastHorizontalOffsetRounded = lroundf(horizontalOffset); // The rounded offset of the left side of the last glyph rendered.
     while (glyphIndex < numGlyphs) {
         // How many chars will be in this chunk?
         int curLen = std::min(kMaxBufferLength, numGlyphs - glyphIndex);
         glyphs.resize(curLen);
         advances.resize(curLen);
 
-        int curWidth = 0;
+        float currentWidth = 0;
         for (int i = 0; i < curLen; ++i, ++glyphIndex) {
             glyphs[i] = glyphBuffer.glyphAt(from + glyphIndex);
-            advances[i] = static_cast<int>(glyphBuffer.advanceAt(from + glyphIndex));
+            horizontalOffset += glyphBuffer.advanceAt(from + glyphIndex);
+            advances[i] = lroundf(horizontalOffset) - lastHorizontalOffsetRounded;
+            lastHorizontalOffsetRounded += advances[i];
+            currentWidth += glyphBuffer.advanceAt(from + glyphIndex);
             
             // Bug 26088 - very large positive or negative runs can fail to
             // render so we clamp the size here. In the specs, negative
@@ -420,15 +428,14 @@ void Font::drawGlyphs(GraphicsContext* graphicsContext,
             // -32830, so we give ourselves a little breathing room.
             const int maxNegativeRun = -32768;
             const int maxPositiveRun =  32768;
-            if ((curWidth + advances[i] < maxNegativeRun) || (curWidth + advances[i] > maxPositiveRun)) 
+            if ((currentWidth + advances[i] < maxNegativeRun) || (currentWidth + advances[i] > maxPositiveRun)) 
                 advances[i] = 0;
-            curWidth += advances[i];
         }
 
         // Actually draw the glyphs (with retry on failure).
         bool success = false;
         for (int executions = 0; executions < 2; ++executions) {
-            success = painter.drawGlyphs(curLen, &glyphs[0], &advances[0], curAdvance);
+            success = painter.drawGlyphs(curLen, &glyphs[0], &advances[0], horizontalOffset - point.x() - currentWidth);
             if (!success && executions == 0) {
                 // Ask the browser to load the font for us and retry.
                 PlatformBridge::ensureFontLoaded(font->platformData().hfont());
@@ -439,8 +446,6 @@ void Font::drawGlyphs(GraphicsContext* graphicsContext,
 
         if (!success)
             LOG_ERROR("Unable to draw the glyphs after second attempt");
-
-        curAdvance += curWidth;
     }
 }
 
@@ -509,8 +514,7 @@ void Font::drawComplexText(GraphicsContext* graphicsContext,
 
     // Uniscribe counts the coordinates from the upper left, while WebKit uses
     // the baseline, so we have to subtract off the ascent.
-    state.draw(graphicsContext, hdc, static_cast<int>(point.x()),
-               static_cast<int>(point.y() - fontMetrics().ascent()), from, to);
+    state.draw(graphicsContext, hdc, lroundf(point.x()), lroundf(point.y() - fontMetrics().ascent()), from, to);
 
     context->canvas()->endPlatformPaint();
 }
diff --git a/Source/WebCore/platform/graphics/chromium/FontLinux.cpp b/Source/WebCore/platform/graphics/chromium/FontLinux.cpp
index 823dbc9..3c4a494 100644
--- a/Source/WebCore/platform/graphics/chromium/FontLinux.cpp
+++ b/Source/WebCore/platform/graphics/chromium/FontLinux.cpp
@@ -98,7 +98,7 @@ void Font::drawGlyphs(GraphicsContext* gc, const SimpleFontData* font,
     SkPoint* vPosBegin = storage2.get();
     SkPoint* vPosEnd = storage3.get();
 
-    bool isVertical = font->orientation() == Vertical;
+    bool isVertical = font->platformData().orientation() == Vertical;
     for (int i = 0; i < numGlyphs; i++) {
         SkScalar myWidth = SkFloatToScalar(adv[i].width());
         pos[i].set(x, y);
diff --git a/Source/WebCore/platform/graphics/chromium/FontPlatformDataChromiumWin.h b/Source/WebCore/platform/graphics/chromium/FontPlatformDataChromiumWin.h
index b6ebb2e..84edebc 100644
--- a/Source/WebCore/platform/graphics/chromium/FontPlatformDataChromiumWin.h
+++ b/Source/WebCore/platform/graphics/chromium/FontPlatformDataChromiumWin.h
@@ -71,6 +71,7 @@ public:
     float size() const { return m_size; }
 
     FontOrientation orientation() const { return Horizontal; } // FIXME: Implement.
+    void setOrientation(FontOrientation) { } // FIXME: Implement.
 
     unsigned hash() const
     { 
@@ -105,7 +106,7 @@ private:
         HFONT hfont() const { return m_hfont; }
         unsigned hash() const
         {
-            return WTF::StringHasher::createBlobHash<sizeof(HFONT)>(&m_hfont);
+            return StringHasher::hashMemory<sizeof(HFONT)>(&m_hfont);
         }
 
         bool operator==(const RefCountedHFONT& other) const
diff --git a/Source/WebCore/platform/graphics/chromium/FontPlatformDataLinux.cpp b/Source/WebCore/platform/graphics/chromium/FontPlatformDataLinux.cpp
index 6f9009f..c3edfac 100644
--- a/Source/WebCore/platform/graphics/chromium/FontPlatformDataLinux.cpp
+++ b/Source/WebCore/platform/graphics/chromium/FontPlatformDataLinux.cpp
@@ -76,13 +76,14 @@ FontPlatformData::FontPlatformData(const FontPlatformData& src)
     , m_fakeBold(src.m_fakeBold)
     , m_fakeItalic(src.m_fakeItalic)
     , m_orientation(src.m_orientation)
+    , m_textOrientation(src.m_textOrientation)
     , m_style(src.m_style)
     , m_harfbuzzFace(src.m_harfbuzzFace)
 {
     SkSafeRef(m_typeface);
 }
 
-FontPlatformData::FontPlatformData(SkTypeface* tf, const char* family, float textSize, bool fakeBold, bool fakeItalic, FontOrientation orientation)
+FontPlatformData::FontPlatformData(SkTypeface* tf, const char* family, float textSize, bool fakeBold, bool fakeItalic, FontOrientation orientation, TextOrientation textOrientation)
     : m_typeface(tf)
     , m_family(family)
     , m_textSize(textSize)
@@ -90,6 +91,7 @@ FontPlatformData::FontPlatformData(SkTypeface* tf, const char* family, float tex
     , m_fakeBold(fakeBold)
     , m_fakeItalic(fakeItalic)
     , m_orientation(orientation)
+    , m_textOrientation(textOrientation)
 {
     SkSafeRef(m_typeface);
     querySystemForRenderStyle();
@@ -102,6 +104,8 @@ FontPlatformData::FontPlatformData(const FontPlatformData& src, float textSize)
     , m_emSizeInFontUnits(src.m_emSizeInFontUnits)
     , m_fakeBold(src.m_fakeBold)
     , m_fakeItalic(src.m_fakeItalic)
+    , m_orientation(src.m_orientation)
+    , m_textOrientation(src.m_textOrientation)
     , m_harfbuzzFace(src.m_harfbuzzFace)
 {
     SkSafeRef(m_typeface);
@@ -134,6 +138,7 @@ FontPlatformData& FontPlatformData::operator=(const FontPlatformData& src)
     m_fakeItalic = src.m_fakeItalic;
     m_harfbuzzFace = src.m_harfbuzzFace;
     m_orientation = src.m_orientation;
+    m_textOrientation = src.m_textOrientation;
     m_style = src.m_style;
     m_emSizeInFontUnits = src.m_emSizeInFontUnits;
 
@@ -199,13 +204,14 @@ bool FontPlatformData::operator==(const FontPlatformData& a) const
         && m_fakeBold == a.m_fakeBold
         && m_fakeItalic == a.m_fakeItalic
         && m_orientation == a.m_orientation
+        && m_textOrientation == a.m_textOrientation
         && m_style == a.m_style;
 }
 
 unsigned FontPlatformData::hash() const
 {
     unsigned h = SkTypeface::UniqueID(m_typeface);
-    h ^= 0x01010101 * ((static_cast<int>(m_orientation) << 2) | (static_cast<int>(m_fakeBold) << 1) | static_cast<int>(m_fakeItalic));
+    h ^= 0x01010101 * ((static_cast<int>(m_textOrientation) << 3) | (static_cast<int>(m_orientation) << 2) | (static_cast<int>(m_fakeBold) << 1) | static_cast<int>(m_fakeItalic));
 
     // This memcpy is to avoid a reinterpret_cast that breaks strict-aliasing
     // rules. Memcpy is generally optimized enough so that performance doesn't
diff --git a/Source/WebCore/platform/graphics/chromium/FontPlatformDataLinux.h b/Source/WebCore/platform/graphics/chromium/FontPlatformDataLinux.h
index d9ebb61..541aa86 100644
--- a/Source/WebCore/platform/graphics/chromium/FontPlatformDataLinux.h
+++ b/Source/WebCore/platform/graphics/chromium/FontPlatformDataLinux.h
@@ -33,6 +33,7 @@
 
 #include "FontOrientation.h"
 #include "FontRenderStyle.h"
+#include "TextOrientation.h"
 #include <wtf/Forward.h>
 #include <wtf/RefPtr.h>
 #include <wtf/text/CString.h>
@@ -66,6 +67,8 @@ public:
         , m_emSizeInFontUnits(0)
         , m_fakeBold(false)
         , m_fakeItalic(false)
+        , m_orientation(Horizontal)
+        , m_textOrientation(TextOrientationVerticalRight)
         { }
 
     FontPlatformData()
@@ -75,6 +78,7 @@ public:
         , m_fakeBold(false)
         , m_fakeItalic(false)
         , m_orientation(Horizontal)
+        , m_textOrientation(TextOrientationVerticalRight)
         { }
 
     FontPlatformData(float textSize, bool fakeBold, bool fakeItalic)
@@ -84,10 +88,11 @@ public:
         , m_fakeBold(fakeBold)
         , m_fakeItalic(fakeItalic)
         , m_orientation(Horizontal)
+        , m_textOrientation(TextOrientationVerticalRight)
         { }
 
     FontPlatformData(const FontPlatformData&);
-    FontPlatformData(SkTypeface*, const char* name, float textSize, bool fakeBold, bool fakeItalic, FontOrientation orientation = Horizontal);
+    FontPlatformData(SkTypeface*, const char* name, float textSize, bool fakeBold, bool fakeItalic, FontOrientation = Horizontal, TextOrientation = TextOrientationVerticalRight);
     FontPlatformData(const FontPlatformData& src, float textSize);
     ~FontPlatformData();
 
@@ -113,7 +118,8 @@ public:
     int emSizeInFontUnits() const;
 
     FontOrientation orientation() const { return m_orientation; }
-
+    void setOrientation(FontOrientation orientation) { m_orientation = orientation; }
+    
     bool operator==(const FontPlatformData&) const;
     FontPlatformData& operator=(const FontPlatformData&);
     bool isHashTableDeletedValue() const { return m_typeface == hashTableDeletedFontValue(); }
@@ -161,6 +167,7 @@ private:
     bool m_fakeBold;
     bool m_fakeItalic;
     FontOrientation m_orientation;
+    TextOrientation m_textOrientation;
     FontRenderStyle m_style;
     mutable RefPtr<RefCountedHarfbuzzFace> m_harfbuzzFace;
 
diff --git a/Source/WebCore/platform/graphics/chromium/GLES2Canvas.cpp b/Source/WebCore/platform/graphics/chromium/GLES2Canvas.cpp
index 2ff6b8b..cc5a060 100644
--- a/Source/WebCore/platform/graphics/chromium/GLES2Canvas.cpp
+++ b/Source/WebCore/platform/graphics/chromium/GLES2Canvas.cpp
@@ -62,29 +62,51 @@ typedef void (GLAPIENTRY *TESSCB)();
 typedef WTF::Vector<float> FloatVector;
 typedef WTF::Vector<double> DoubleVector;
 
+struct PathAndTransform {
+    PathAndTransform(const Path& p, const AffineTransform& t)
+        : path(p)
+        , transform(t)
+    {
+    }
+    Path path;
+    AffineTransform transform;
+};
+
 struct GLES2Canvas::State {
     State()
         : m_fillColor(0, 0, 0, 255)
+        , m_shadowColor(0, 0, 0, 0)
         , m_alpha(1.0f)
         , m_compositeOp(CompositeSourceOver)
-        , m_clippingEnabled(false)
+        , m_numClippingPaths(0)
+        , m_shadowOffset(0, 0)
+        , m_shadowBlur(0)
+        , m_shadowsIgnoreTransforms(false)
     {
     }
     State(const State& other)
         : m_fillColor(other.m_fillColor)
+        , m_shadowColor(other.m_shadowColor)
         , m_alpha(other.m_alpha)
         , m_compositeOp(other.m_compositeOp)
         , m_ctm(other.m_ctm)
         , m_clippingPaths() // Don't copy; clipping paths are tracked per-state.
-        , m_clippingEnabled(other.m_clippingEnabled)
+        , m_numClippingPaths(other.m_numClippingPaths)
+        , m_shadowOffset(other.m_shadowOffset)
+        , m_shadowBlur(other.m_shadowBlur)
+        , m_shadowsIgnoreTransforms(other.m_shadowsIgnoreTransforms)
     {
     }
     Color m_fillColor;
+    Color m_shadowColor;
     float m_alpha;
     CompositeOperator m_compositeOp;
     AffineTransform m_ctm;
-    WTF::Vector<Path> m_clippingPaths;
-    bool m_clippingEnabled;
+    WTF::Vector<PathAndTransform> m_clippingPaths;
+    int m_numClippingPaths;
+    FloatSize m_shadowOffset;
+    float m_shadowBlur;
+    bool m_shadowsIgnoreTransforms;
 
     // Helper function for applying the state's alpha value to the given input
     // color to produce a new output color. The logic is the same as
@@ -100,7 +122,11 @@ struct GLES2Canvas::State {
         int a = (c.alpha() * s) >> 8;
         return Color(c.red(), c.green(), c.blue(), a);
     }
-
+    bool shadowActive() const
+    {
+        return m_shadowColor.alpha() > 0 && (m_shadowBlur || m_shadowOffset.width() || m_shadowOffset.height());
+    }
+    bool clippingEnabled() { return m_numClippingPaths > 0; }
 };
 
 static inline FloatPoint operator*(const FloatPoint& f, float scale)
@@ -193,12 +219,8 @@ void GLES2Canvas::bindFramebuffer()
 void GLES2Canvas::clearRect(const FloatRect& rect)
 {
     bindFramebuffer();
-    if (m_state->m_ctm.isIdentity() && !m_state->m_clippingEnabled) {
-        m_context->scissor(rect.x(), m_size.height() - rect.height() - rect.y(), rect.width(), rect.height());
-        m_context->enable(GraphicsContext3D::SCISSOR_TEST);
-        m_context->clearColor(Color(RGBA32(0)));
-        m_context->clear(GraphicsContext3D::COLOR_BUFFER_BIT);
-        m_context->disable(GraphicsContext3D::SCISSOR_TEST);
+    if (m_state->m_ctm.isIdentity() && !m_state->clippingEnabled()) {
+        scissorClear(rect.x(), rect.y(), rect.width(), rect.height());
     } else {
         save();
         setCompositeOperation(CompositeClear);
@@ -207,35 +229,66 @@ void GLES2Canvas::clearRect(const FloatRect& rect)
     }
 }
 
+void GLES2Canvas::scissorClear(float x, float y, float width, float height)
+{
+    int intX = static_cast<int>(x + 0.5f);
+    int intY = static_cast<int>(y + 0.5f);
+    int intWidth = static_cast<int>(x + width + 0.5f) - intX;
+    int intHeight = static_cast<int>(y + height + 0.5f) - intY;
+    m_context->scissor(intX, m_size.height() - intHeight - intY, intWidth, intHeight);
+    m_context->enable(GraphicsContext3D::SCISSOR_TEST);
+    m_context->clearColor(Color(RGBA32(0)));
+    m_context->clear(GraphicsContext3D::COLOR_BUFFER_BIT);
+    m_context->disable(GraphicsContext3D::SCISSOR_TEST);
+}
+
 void GLES2Canvas::fillPath(const Path& path)
 {
+    if (m_state->shadowActive()) {
+        beginShadowDraw();
+        fillPathInternal(path, m_state->m_shadowColor);
+        endShadowDraw(path.boundingRect());
+    }
+
+    bindFramebuffer();
     m_context->applyCompositeOperator(m_state->m_compositeOp);
-    applyClipping(m_state->m_clippingEnabled);
-    fillPath(path, m_state->applyAlpha(m_state->m_fillColor));
+    applyClipping(m_state->clippingEnabled());
+
+    fillPathInternal(path, m_state->applyAlpha(m_state->m_fillColor));
 }
 
 void GLES2Canvas::fillRect(const FloatRect& rect, const Color& color, ColorSpace colorSpace)
 {
+    if (m_state->shadowActive()) {
+        beginShadowDraw();
+        fillRectInternal(rect, m_state->m_shadowColor);
+        endShadowDraw(rect);
+    }
+
+    bindFramebuffer();
     m_context->applyCompositeOperator(m_state->m_compositeOp);
-    applyClipping(m_state->m_clippingEnabled);
-    m_context->useQuadVertices();
+    applyClipping(m_state->clippingEnabled());
+
+    fillRectInternal(rect, color);
+}
+
+void GLES2Canvas::fillRect(const FloatRect& rect)
+{
+    fillRect(rect, m_state->applyAlpha(m_state->m_fillColor), ColorSpaceDeviceRGB);
+}
 
+void GLES2Canvas::fillRectInternal(const FloatRect& rect, const Color& color)
+{
     AffineTransform matrix(m_flipMatrix);
     matrix *= m_state->m_ctm;
     matrix.translate(rect.x(), rect.y());
     matrix.scale(rect.width(), rect.height());
 
+    m_context->useQuadVertices();
     m_context->useFillSolidProgram(matrix, color);
-
-    bindFramebuffer();
     m_context->drawArrays(GraphicsContext3D::TRIANGLE_STRIP, 0, 4);
 }
 
-void GLES2Canvas::fillRect(const FloatRect& rect)
-{
-    fillRect(rect, m_state->applyAlpha(m_state->m_fillColor), ColorSpaceDeviceRGB);
-}
-
 void GLES2Canvas::setFillColor(const Color& color, ColorSpace colorSpace)
 {
     m_state->m_fillColor = color;
@@ -246,6 +299,26 @@ void GLES2Canvas::setAlpha(float alpha)
     m_state->m_alpha = alpha;
 }
 
+void GLES2Canvas::setShadowColor(const Color& color, ColorSpace)
+{
+    m_state->m_shadowColor = color;
+}
+
+void GLES2Canvas::setShadowOffset(const FloatSize& offset)
+{
+    m_state->m_shadowOffset = offset;
+}
+
+void GLES2Canvas::setShadowBlur(float shadowBlur)
+{
+    m_state->m_shadowBlur = shadowBlur;
+}
+
+void GLES2Canvas::setShadowsIgnoreTransforms(bool shadowsIgnoreTransforms)
+{
+    m_state->m_shadowsIgnoreTransforms = shadowsIgnoreTransforms;
+}
+
 void GLES2Canvas::translate(float x, float y)
 {
     m_state->m_ctm.translate(x, y);
@@ -275,12 +348,12 @@ void GLES2Canvas::clipPath(const Path& path)
 {
     bindFramebuffer();
     checkGLError("bindFramebuffer");
-    beginStencilDraw();
+    beginStencilDraw(GraphicsContext3D::INCR);
     // Red is used so we can see it if it ends up in the color buffer.
     Color red(255, 0, 0, 255);
-    fillPath(path, red);
-    m_state->m_clippingPaths.append(path);
-    m_state->m_clippingEnabled = true;
+    fillPathInternal(path, red);
+    m_state->m_clippingPaths.append(PathAndTransform(path, m_state->m_ctm));
+    m_state->m_numClippingPaths++;
 }
 
 void GLES2Canvas::clipOut(const Path& path)
@@ -297,53 +370,48 @@ void GLES2Canvas::save()
 void GLES2Canvas::restore()
 {
     ASSERT(!m_stateStack.isEmpty());
-    bool hadClippingPaths = !m_state->m_clippingPaths.isEmpty();
-    m_stateStack.removeLast();
-    m_state = &m_stateStack.last();
-    if (hadClippingPaths) {
-        m_context->clear(GraphicsContext3D::STENCIL_BUFFER_BIT);
-        beginStencilDraw();
-        StateVector::const_iterator iter;
-        for (iter = m_stateStack.begin(); iter < m_stateStack.end(); ++iter) {
-            const State& state = *iter;
-            const Vector<Path>& clippingPaths = state.m_clippingPaths;
-            Vector<Path>::const_iterator pathIter;
-            for (pathIter = clippingPaths.begin(); pathIter < clippingPaths.end(); ++pathIter) {
-                // Red is used so we can see it if it ends up in the color buffer.
-                Color red(255, 0, 0, 255);
-                fillPath(*pathIter, red);
-            }
+    const Vector<PathAndTransform>& clippingPaths = m_state->m_clippingPaths;
+    if (!clippingPaths.isEmpty()) {
+        beginStencilDraw(GraphicsContext3D::DECR);
+        WTF::Vector<PathAndTransform>::const_iterator pathIter;
+        for (pathIter = clippingPaths.begin(); pathIter < clippingPaths.end(); ++pathIter) {
+            m_state->m_ctm = pathIter->transform;
+            // Red is used so we can see it if it ends up in the color buffer.
+            Color red(255, 0, 0, 255);
+            fillPathInternal(pathIter->path, red);
         }
     }
+    m_stateStack.removeLast();
+    m_state = &m_stateStack.last();
 }
 
 void GLES2Canvas::drawTexturedRect(unsigned texture, const IntSize& textureSize, const FloatRect& srcRect, const FloatRect& dstRect, ColorSpace colorSpace, CompositeOperator compositeOp)
 {
+    bindFramebuffer();
     m_context->applyCompositeOperator(compositeOp);
     applyClipping(false);
 
-    m_context->useQuadVertices();
     m_context->setActiveTexture(GraphicsContext3D::TEXTURE0);
 
     m_context->bindTexture(GraphicsContext3D::TEXTURE_2D, texture);
 
-    drawQuad(textureSize, srcRect, dstRect, m_state->m_ctm, m_state->m_alpha);
+    drawTexturedQuad(textureSize, srcRect, dstRect, m_state->m_ctm, m_state->m_alpha);
 }
 
 void GLES2Canvas::drawTexturedRect(Texture* texture, const FloatRect& srcRect, const FloatRect& dstRect, ColorSpace colorSpace, CompositeOperator compositeOp)
 {
-    drawTexturedRect(texture, srcRect, dstRect, m_state->m_ctm, m_state->m_alpha, colorSpace, compositeOp, m_state->m_clippingEnabled);
+    drawTexturedRect(texture, srcRect, dstRect, m_state->m_ctm, m_state->m_alpha, colorSpace, compositeOp, m_state->clippingEnabled());
 }
 
 
 void GLES2Canvas::drawTexturedRect(Texture* texture, const FloatRect& srcRect, const FloatRect& dstRect, const AffineTransform& transform, float alpha, ColorSpace colorSpace, CompositeOperator compositeOp, bool clip)
 {
+    bindFramebuffer();
     m_context->applyCompositeOperator(compositeOp);
     applyClipping(clip);
     const TilingData& tiles = texture->tiles();
     IntRect tileIdxRect = tiles.overlappedTileIndices(srcRect);
 
-    m_context->useQuadVertices();
     m_context->setActiveTexture(GraphicsContext3D::TEXTURE0);
 
     for (int y = tileIdxRect.y(); y <= tileIdxRect.maxY(); y++) {
@@ -367,13 +435,18 @@ void GLES2Canvas::drawTexturedRectTile(Texture* texture, int tile, const FloatRe
 
     IntRect tileBoundsWithBorder = tiles.tileBoundsWithBorder(tile);
 
-    drawQuad(tileBoundsWithBorder.size(), srcRectClippedInTileSpace, dstRectIntersected, transform, alpha);
+    drawTexturedQuad(tileBoundsWithBorder.size(), srcRectClippedInTileSpace, dstRectIntersected, transform, alpha);
 }
 
-void GLES2Canvas::drawQuad(const IntSize& textureSize, const FloatRect& srcRect, const FloatRect& dstRect, const AffineTransform& transform, float alpha)
+void GLES2Canvas::convolveRect(unsigned texture, const IntSize& textureSize, const FloatRect& srcRect, const FloatRect& dstRect, float imageIncrement[2], const float* kernel, int kernelWidth)
 {
+    m_context->bindTexture(GraphicsContext3D::TEXTURE_2D, texture);
+    m_context->texParameteri(GraphicsContext3D::TEXTURE_2D, GraphicsContext3D::TEXTURE_WRAP_S, GraphicsContext3D::CLAMP_TO_EDGE);
+    m_context->texParameteri(GraphicsContext3D::TEXTURE_2D, GraphicsContext3D::TEXTURE_WRAP_T, GraphicsContext3D::CLAMP_TO_EDGE);
+    m_context->texParameteri(GraphicsContext3D::TEXTURE_2D, GraphicsContext3D::TEXTURE_MIN_FILTER, GraphicsContext3D::NEAREST);
+    m_context->texParameteri(GraphicsContext3D::TEXTURE_2D, GraphicsContext3D::TEXTURE_MAG_FILTER, GraphicsContext3D::NEAREST);
+
     AffineTransform matrix(m_flipMatrix);
-    matrix *= transform;
     matrix.translate(dstRect.x(), dstRect.y());
     matrix.scale(dstRect.width(), dstRect.height());
 
@@ -382,13 +455,79 @@ void GLES2Canvas::drawQuad(const IntSize& textureSize, const FloatRect& srcRect,
     texMatrix.translate(srcRect.x(), srcRect.y());
     texMatrix.scale(srcRect.width(), srcRect.height());
 
-    bindFramebuffer();
+    m_context->useQuadVertices();
+    m_context->useConvolutionProgram(matrix, texMatrix, kernel, kernelWidth, imageIncrement);
+    m_context->drawArrays(GraphicsContext3D::TRIANGLE_STRIP, 0, 4);
+    checkGLError("glDrawArrays");
+}
 
+static float gauss(float x, float sigma)
+{
+    return exp(- (x * x) / (2.0f * sigma * sigma));
+}
+
+static void buildKernel(float sigma, float* kernel, int kernelWidth)
+{
+    float halfWidth = (kernelWidth - 1.0f) / 2.0f;
+    float sum = 0.0f;
+    for (int i = 0; i < kernelWidth; ++i) {
+        kernel[i] = gauss(i - halfWidth, sigma);
+        sum += kernel[i];
+    }
+    // Normalize the kernel
+    float scale = 1.0f / sum;
+    for (int i = 0; i < kernelWidth; ++i)
+        kernel[i] *= scale;
+}
+
+void GLES2Canvas::drawTexturedQuad(const IntSize& textureSize, const FloatRect& srcRect, const FloatRect& dstRect, const AffineTransform& transform, float alpha)
+{
+    AffineTransform matrix(m_flipMatrix);
+    matrix *= transform;
+    matrix.translate(dstRect.x(), dstRect.y());
+    matrix.scale(dstRect.width(), dstRect.height());
+
+    AffineTransform texMatrix;
+    texMatrix.scale(1.0f / textureSize.width(), 1.0f / textureSize.height());
+    texMatrix.translate(srcRect.x(), srcRect.y());
+    texMatrix.scale(srcRect.width(), srcRect.height());
+
+    m_context->useQuadVertices();
     m_context->useTextureProgram(matrix, texMatrix, alpha);
     m_context->drawArrays(GraphicsContext3D::TRIANGLE_STRIP, 0, 4);
     checkGLError("glDrawArrays");
 }
 
+void GLES2Canvas::drawTexturedQuadMitchell(const IntSize& textureSize, const FloatRect& srcRect, const FloatRect& dstRect, const AffineTransform& transform, float alpha)
+{
+    static const float mitchellCoefficients[16] = {
+         0.0f / 18.0f,   1.0f / 18.0f,  16.0f / 18.0f,   1.0f / 18.0f,
+         0.0f / 18.0f,   9.0f / 18.0f,   0.0f / 18.0f,  -9.0f / 18.0f,
+        -6.0f / 18.0f,  27.0f / 18.0f, -36.0f / 18.0f,  15.0f / 18.0f,
+         7.0f / 18.0f, -21.0f / 18.0f,  21.0f / 18.0f,  -7.0f / 18.0f,
+    };
+
+    AffineTransform matrix(m_flipMatrix);
+    matrix *= transform;
+    matrix.translate(dstRect.x(), dstRect.y());
+    matrix.scale(dstRect.width(), dstRect.height());
+
+    float imageIncrement[2] = { 1.0f / textureSize.width(), 1.0f / textureSize.height() };
+
+    AffineTransform texMatrix;
+    texMatrix.scale(imageIncrement[0], imageIncrement[1]);
+    texMatrix.translate(srcRect.x(), srcRect.y());
+    texMatrix.scale(srcRect.width(), srcRect.height());
+
+    m_context->texParameteri(GraphicsContext3D::TEXTURE_2D, GraphicsContext3D::TEXTURE_MIN_FILTER, GraphicsContext3D::NEAREST);
+    m_context->texParameteri(GraphicsContext3D::TEXTURE_2D, GraphicsContext3D::TEXTURE_MAG_FILTER, GraphicsContext3D::NEAREST);
+
+    m_context->useQuadVertices();
+    m_context->useBicubicProgram(matrix, texMatrix, mitchellCoefficients, imageIncrement, alpha);
+    m_context->drawArrays(GraphicsContext3D::TRIANGLE_STRIP, 0, 4);
+    checkGLError("glDrawArrays");
+}
+
 void GLES2Canvas::setCompositeOperation(CompositeOperator op)
 {
     m_state->m_compositeOp = op;
@@ -554,12 +693,9 @@ void GLES2Canvas::createVertexBufferFromPath(const Path& path, int* count, unsig
     *count = indices.size();
 }
 
-void GLES2Canvas::fillPath(const Path& path, const Color& color)
+void GLES2Canvas::fillPathInternal(const Path& path, const Color& color)
 {
     if (SharedGraphicsContext3D::useLoopBlinnForPathRendering()) {
-        bindFramebuffer();
-        m_context->applyCompositeOperator(m_state->m_compositeOp);
-
         m_pathCache.clear();
         LoopBlinnPathProcessor processor;
         processor.process(path, m_pathCache);
@@ -590,18 +726,18 @@ void GLES2Canvas::fillPath(const Path& path, const Color& color)
         int count;
         unsigned vertexBuffer, indexBuffer;
         createVertexBufferFromPath(path, &count, &vertexBuffer, &indexBuffer);
+
+        AffineTransform matrix(m_flipMatrix);
+        matrix *= m_state->m_ctm;
+
         m_context->graphicsContext3D()->bindBuffer(GraphicsContext3D::ARRAY_BUFFER, vertexBuffer);
         checkGLError("bindBuffer");
         m_context->graphicsContext3D()->bindBuffer(GraphicsContext3D::ELEMENT_ARRAY_BUFFER, indexBuffer);
         checkGLError("bindBuffer");
 
-        AffineTransform matrix(m_flipMatrix);
-        matrix *= m_state->m_ctm;
-
         m_context->useFillSolidProgram(matrix, color);
         checkGLError("useFillSolidProgram");
 
-        bindFramebuffer();
         m_context->graphicsContext3D()->drawElements(GraphicsContext3D::TRIANGLES, count, GraphicsContext3D::UNSIGNED_SHORT, 0);
         checkGLError("drawArrays");
 
@@ -613,7 +749,141 @@ void GLES2Canvas::fillPath(const Path& path, const Color& color)
     }
 }
 
-void GLES2Canvas::beginStencilDraw()
+FloatRect GLES2Canvas::flipRect(const FloatRect& rect)
+{
+    FloatRect flippedRect(rect);
+    flippedRect.setY(m_size.height() - rect.y());
+    flippedRect.setHeight(-rect.height());
+    return flippedRect;
+}
+
+void GLES2Canvas::clearBorders(const FloatRect& rect, int width)
+{
+    scissorClear(rect.x(), rect.y() - width, rect.width() + width, width);
+    scissorClear(rect.maxX(), rect.y(), width, rect.height() + width);
+    scissorClear(rect.x() - width, rect.maxY(), rect.width() + width, width);
+    scissorClear(rect.x() - width, rect.y() - width, width, rect.height() + width);
+}
+
+void GLES2Canvas::beginShadowDraw()
+{
+    float offsetX = m_state->m_shadowOffset.width();
+    float offsetY = m_state->m_shadowOffset.height();
+    save();
+    if (m_state->m_shadowsIgnoreTransforms) {
+        AffineTransform newCTM;
+        newCTM.translate(offsetX, -offsetY);
+        newCTM *= m_state->m_ctm;
+        m_state->m_ctm = newCTM;
+    } else
+        m_state->m_ctm.translate(offsetX, offsetY);
+
+    if (m_state->m_shadowBlur > 0) {
+        // Draw hard shadow to offscreen buffer 0.
+        DrawingBuffer* dstBuffer = m_context->getOffscreenBuffer(0, m_size);
+        dstBuffer->bind();
+        m_context->applyCompositeOperator(CompositeCopy);
+        applyClipping(false);
+        m_context->clearColor(Color(RGBA32(0)));
+        m_context->clear(GraphicsContext3D::COLOR_BUFFER_BIT);
+    } else {
+        bindFramebuffer();
+        m_context->applyCompositeOperator(m_state->m_compositeOp);
+        applyClipping(m_state->clippingEnabled());
+    }
+}
+
+void GLES2Canvas::endShadowDraw(const FloatRect& boundingBox)
+{
+    if (m_state->m_shadowBlur > 0) {
+        // Buffer 0 contains the primitive drawn with a hard shadow.
+        DrawingBuffer* srcBuffer = m_context->getOffscreenBuffer(0, m_size);
+        DrawingBuffer* dstBuffer = m_context->getOffscreenBuffer(1, m_size);
+
+        float sigma = m_state->m_shadowBlur * 0.333333f;
+        FloatRect shadowBoundingBox(m_state->m_ctm.mapRect(boundingBox));
+        FloatRect rect(FloatPoint(0, 0), m_size);
+        FloatRect srcRect(shadowBoundingBox);
+
+        int scaleFactor = 1;
+        while (sigma > cMaxSigma) {
+            srcRect.scale(0.5f);
+            scaleFactor *= 2;
+            sigma *= 0.5f;
+        }
+        srcRect = enclosingIntRect(srcRect);
+        srcRect.scale(scaleFactor);
+        for (int i = 1; i < scaleFactor; i *= 2) {
+            dstBuffer->bind();
+            m_context->bindTexture(GraphicsContext3D::TEXTURE_2D, srcBuffer->colorBuffer());
+            m_context->texParameteri(GraphicsContext3D::TEXTURE_2D, GraphicsContext3D::TEXTURE_WRAP_S, GraphicsContext3D::CLAMP_TO_EDGE);
+            m_context->texParameteri(GraphicsContext3D::TEXTURE_2D, GraphicsContext3D::TEXTURE_WRAP_T, GraphicsContext3D::CLAMP_TO_EDGE);
+            m_context->texParameteri(GraphicsContext3D::TEXTURE_2D, GraphicsContext3D::TEXTURE_MIN_FILTER, GraphicsContext3D::LINEAR);
+            m_context->texParameteri(GraphicsContext3D::TEXTURE_2D, GraphicsContext3D::TEXTURE_MAG_FILTER, GraphicsContext3D::LINEAR);
+            FloatRect dstRect(srcRect);
+            dstRect.scale(0.5f);
+            // Clear out 1 pixel border for linear filtering.
+            clearBorders(dstRect, 1);
+            drawTexturedQuad(srcBuffer->size(), flipRect(srcRect), dstRect, AffineTransform(), 1.0);
+            srcRect = dstRect;
+            std::swap(srcBuffer, dstBuffer);
+        }
+
+        int halfWidth = static_cast<int>(sigma * 3.0f);
+        int kernelWidth = halfWidth * 2 + 1;
+        OwnArrayPtr<float> kernel = adoptArrayPtr(new float[kernelWidth]);
+        buildKernel(sigma, kernel.get(), kernelWidth);
+
+        if (scaleFactor > 1) {
+            scissorClear(srcRect.maxX(), srcRect.y(), kernelWidth, srcRect.height());
+            scissorClear(srcRect.x() - kernelWidth, srcRect.y(), kernelWidth, srcRect.height());
+        }
+
+        // Blur in X offscreen.
+        dstBuffer->bind();
+        srcRect.inflateX(halfWidth);
+        srcRect.intersect(rect);
+        float imageIncrementX[2] = {1.0f / srcBuffer->size().width(), 0.0f};
+        convolveRect(srcBuffer->colorBuffer(), srcBuffer->size(), flipRect(srcRect), srcRect, imageIncrementX, kernel.get(), kernelWidth);
+
+        if (scaleFactor > 1) {
+            scissorClear(srcRect.x(), srcRect.maxY(), srcRect.width(), kernelWidth);
+            scissorClear(srcRect.x(), srcRect.y() - kernelWidth, srcRect.width(), kernelWidth);
+        }
+        srcRect.inflateY(halfWidth);
+        srcRect.intersect(rect);
+        std::swap(srcBuffer, dstBuffer);
+
+        float imageIncrementY[2] = {0.0f, 1.0f / srcBuffer->size().height()};
+        if (scaleFactor > 1) {
+            // Blur in Y offscreen.
+            dstBuffer->bind();
+            convolveRect(srcBuffer->colorBuffer(), srcBuffer->size(), flipRect(srcRect), srcRect, imageIncrementY, kernel.get(), kernelWidth);
+            // Clear out 2 pixel border for bicubic filtering.
+            clearBorders(srcRect, 2);
+            std::swap(srcBuffer, dstBuffer);
+
+            // Upsample srcBuffer -> main framebuffer using bicubic filtering.
+            bindFramebuffer();
+            m_context->applyCompositeOperator(m_state->m_compositeOp);
+            applyClipping(m_state->clippingEnabled());
+            m_context->bindTexture(GraphicsContext3D::TEXTURE_2D, srcBuffer->colorBuffer());
+            FloatRect dstRect = srcRect;
+            dstRect.scale(scaleFactor);
+            drawTexturedQuadMitchell(srcBuffer->size(), flipRect(srcRect), dstRect, AffineTransform(), 1.0);
+        } else {
+            // Blur in Y directly to framebuffer.
+            bindFramebuffer();
+            m_context->applyCompositeOperator(m_state->m_compositeOp);
+            applyClipping(m_state->clippingEnabled());
+
+            convolveRect(srcBuffer->colorBuffer(), srcBuffer->size(), flipRect(srcRect), srcRect, imageIncrementY, kernel.get(), kernelWidth);
+        }
+    }
+    restore();
+}
+
+void GLES2Canvas::beginStencilDraw(unsigned op)
 {
     // Turn on stencil test.
     m_context->enableStencil(true);
@@ -624,9 +894,7 @@ void GLES2Canvas::beginStencilDraw()
     checkGLError("stencilFunc");
 
     // All writes incremement the stencil buffer.
-    m_context->graphicsContext3D()->stencilOp(GraphicsContext3D::INCR,
-                                              GraphicsContext3D::INCR,
-                                              GraphicsContext3D::INCR);
+    m_context->graphicsContext3D()->stencilOp(op, op, op);
     checkGLError("stencilOp");
 }
 
@@ -635,7 +903,7 @@ void GLES2Canvas::applyClipping(bool enable)
     m_context->enableStencil(enable);
     if (enable) {
         // Enable drawing only where stencil is non-zero.
-        m_context->graphicsContext3D()->stencilFunc(GraphicsContext3D::EQUAL, m_state->m_clippingPaths.size() % 256, 1);
+        m_context->graphicsContext3D()->stencilFunc(GraphicsContext3D::EQUAL, m_state->m_numClippingPaths, -1);
         checkGLError("stencilFunc");
         // Keep all stencil values the same.
         m_context->graphicsContext3D()->stencilOp(GraphicsContext3D::KEEP,
diff --git a/Source/WebCore/platform/graphics/chromium/GLES2Canvas.h b/Source/WebCore/platform/graphics/chromium/GLES2Canvas.h
index 8887a16..f6a8bcf 100644
--- a/Source/WebCore/platform/graphics/chromium/GLES2Canvas.h
+++ b/Source/WebCore/platform/graphics/chromium/GLES2Canvas.h
@@ -64,6 +64,10 @@ public:
     void clearRect(const FloatRect&);
     void setFillColor(const Color&, ColorSpace);
     void setAlpha(float alpha);
+    void setShadowColor(const Color&, ColorSpace);
+    void setShadowOffset(const FloatSize&);
+    void setShadowBlur(float);
+    void setShadowsIgnoreTransforms(bool);
     void setCompositeOperation(CompositeOperator);
     void translate(float x, float y);
     void rotate(float angleInRadians);
@@ -96,12 +100,21 @@ public:
     DrawingBuffer* drawingBuffer() const { return m_drawingBuffer; }
 
 private:
+    void scissorClear(float x, float y, float width, float height);
     void drawTexturedRectTile(Texture* texture, int tile, const FloatRect& srcRect, const FloatRect& dstRect, const AffineTransform&, float alpha);
-    void drawQuad(const IntSize& textureSize, const FloatRect& srcRect, const FloatRect& dstRect, const AffineTransform&, float alpha);
+    void drawTexturedQuad(const IntSize& textureSize, const FloatRect& srcRect, const FloatRect& dstRect, const AffineTransform&, float alpha);
+    void drawTexturedQuadMitchell(const IntSize& textureSize, const FloatRect& srcRect, const FloatRect& dstRect, const AffineTransform&, float alpha);
+    void convolveRect(unsigned texture, const IntSize& textureSize, const FloatRect& srcRect, const FloatRect& dstRect, float imageIncrement[2], const float* kernel, int kernelWidth);
+
     void applyCompositeOperator(CompositeOperator);
     void createVertexBufferFromPath(const Path&, int* count, unsigned* vertexBuffer, unsigned* indexBuffer);
-    void fillPath(const Path&, const Color&);
-    void beginStencilDraw();
+    void fillPathInternal(const Path&, const Color&);
+    void fillRectInternal(const FloatRect&, const Color&);
+    FloatRect flipRect(const FloatRect&);
+    void clearBorders(const FloatRect&, int width);
+    void beginShadowDraw();
+    void endShadowDraw(const FloatRect& boundingBox);
+    void beginStencilDraw(unsigned op);
     void applyClipping(bool enable);
     void checkGLError(const char* header);
 
diff --git a/Source/WebCore/platform/graphics/chromium/GlyphPageTreeNodeChromiumWin.cpp b/Source/WebCore/platform/graphics/chromium/GlyphPageTreeNodeChromiumWin.cpp
index ee2b5ab..cfc1754 100644
--- a/Source/WebCore/platform/graphics/chromium/GlyphPageTreeNodeChromiumWin.cpp
+++ b/Source/WebCore/platform/graphics/chromium/GlyphPageTreeNodeChromiumWin.cpp
@@ -36,8 +36,8 @@
 #include "GlyphPageTreeNode.h"
 #include "PlatformBridge.h"
 #include "SimpleFontData.h"
+#include "SystemInfo.h"
 #include "UniscribeHelperTextRun.h"
-#include "WindowsVersion.h"
 
 namespace WebCore {
 
@@ -134,7 +134,7 @@ static bool fillBMPGlyphs(unsigned offset,
     bool haveGlyphs = false;
     int invalidGlyph = 0xFFFF;
     const DWORD cffTableTag = 0x20464643; // 4-byte identifier for OpenType CFF table ('CFF ').
-    if (!isVistaOrNewer() && !(tm.tmPitchAndFamily & TMPF_TRUETYPE) && (GetFontData(dc, cffTableTag, 0, 0, 0) == GDI_ERROR))
+    if ((windowsVersion() < WindowsVista) && !(tm.tmPitchAndFamily & TMPF_TRUETYPE) && (GetFontData(dc, cffTableTag, 0, 0, 0) == GDI_ERROR))
         invalidGlyph = 0x1F;
 
     Glyph spaceGlyph = 0;  // Glyph for a space. Lazily filled.
diff --git a/Source/WebCore/platform/graphics/chromium/ImageLayerChromium.cpp b/Source/WebCore/platform/graphics/chromium/ImageLayerChromium.cpp
index 7c42366..60c1332 100644
--- a/Source/WebCore/platform/graphics/chromium/ImageLayerChromium.cpp
+++ b/Source/WebCore/platform/graphics/chromium/ImageLayerChromium.cpp
@@ -60,7 +60,7 @@ void ImageLayerChromium::setContents(Image* contents)
     setNeedsDisplay();
 }
 
-void ImageLayerChromium::updateContentsIfDirty()
+void ImageLayerChromium::paintContentsIfDirty()
 {
     ASSERT(layerRenderer());
 
@@ -68,7 +68,7 @@ void ImageLayerChromium::updateContentsIfDirty()
     if (requiresClippedUpdateRect()) {
         // Use the base version of updateContents which draws a subset of the
         // image to a bitmap, as the pixel contents can't be uploaded directly.
-        ContentLayerChromium::updateContentsIfDirty();
+        ContentLayerChromium::paintContentsIfDirty();
         return;
     }
 
diff --git a/Source/WebCore/platform/graphics/chromium/ImageLayerChromium.h b/Source/WebCore/platform/graphics/chromium/ImageLayerChromium.h
index cc9064d..6addabc 100644
--- a/Source/WebCore/platform/graphics/chromium/ImageLayerChromium.h
+++ b/Source/WebCore/platform/graphics/chromium/ImageLayerChromium.h
@@ -50,7 +50,7 @@ class ImageLayerChromium : public ContentLayerChromium {
 public:
     static PassRefPtr<ImageLayerChromium> create(GraphicsLayerChromium* owner = 0);
 
-    virtual void updateContentsIfDirty();
+    virtual void paintContentsIfDirty();
     virtual bool drawsContent() const { return m_contents; }
 
     void setContents(Image* image);
diff --git a/Source/WebCore/platform/graphics/chromium/LayerChromium.cpp b/Source/WebCore/platform/graphics/chromium/LayerChromium.cpp
index 95b7386..bc28239 100644
--- a/Source/WebCore/platform/graphics/chromium/LayerChromium.cpp
+++ b/Source/WebCore/platform/graphics/chromium/LayerChromium.cpp
@@ -62,6 +62,7 @@ LayerChromium::LayerChromium(GraphicsLayerChromium* owner)
     : m_owner(owner)
     , m_contentsDirty(false)
     , m_maskLayer(0)
+    , m_ccLayerImpl(0)
     , m_superlayer(0)
 #ifndef NDEBUG
     , m_debugID(s_nextLayerDebugID++)
@@ -77,7 +78,7 @@ LayerChromium::LayerChromium(GraphicsLayerChromium* owner)
     , m_opaque(true)
     , m_geometryFlipped(false)
     , m_needsDisplayOnBoundsChange(false)
-    , m_ccLayerImpl(CCLayerImpl::create(this))
+    , m_doubleSided(true)
     , m_replicaLayer(0)
 {
 }
@@ -94,7 +95,8 @@ LayerChromium::~LayerChromium()
 
 void LayerChromium::cleanupResources()
 {
-    m_ccLayerImpl->cleanupResources();
+    if (m_ccLayerImpl)
+        m_ccLayerImpl->cleanupResources();
 }
 
 void LayerChromium::setLayerRenderer(LayerRendererChromium* renderer)
@@ -105,8 +107,7 @@ void LayerChromium::setLayerRenderer(LayerRendererChromium* renderer)
         cleanupResources();
         setNeedsDisplay();
     }
-
-    m_ccLayerImpl->setLayerRenderer(renderer);
+    m_layerRenderer = renderer;
 }
 
 void LayerChromium::setNeedsCommit()
@@ -188,7 +189,7 @@ void LayerChromium::setBounds(const IntSize& size)
 
     bool firstResize = !bounds().width() && !bounds().height() && size.width() && size.height();
 
-    m_ccLayerImpl->setBounds(size);
+    m_bounds = size;
 
     if (firstResize)
         setNeedsDisplay(FloatRect(0, 0, bounds().width(), bounds().height()));
@@ -240,7 +241,6 @@ LayerChromium* LayerChromium::superlayer() const
 void LayerChromium::setName(const String& name)
 {
     m_name = name;
-    m_ccLayerImpl->setName(name);
 }
 
 void LayerChromium::setNeedsDisplay(const FloatRect& dirtyRect)
@@ -288,6 +288,29 @@ void LayerChromium::toGLMatrix(float* flattened, const TransformationMatrix& m)
     flattened[15] = m.m44();
 }
 
+void LayerChromium::pushPropertiesTo(CCLayerImpl* layer)
+{
+    layer->setAnchorPoint(m_anchorPoint);
+    layer->setAnchorPointZ(m_anchorPointZ);
+    layer->setBounds(m_bounds);
+    layer->setDebugBorderColor(m_debugBorderColor);
+    layer->setDebugBorderWidth(m_debugBorderWidth);
+    layer->setDoubleSided(m_doubleSided);
+    layer->setLayerRenderer(m_layerRenderer.get());
+    layer->setMasksToBounds(m_masksToBounds);
+    layer->setName(m_name);
+    layer->setOpacity(m_opacity);
+    layer->setPosition(m_position);
+    layer->setPreserves3D(preserves3D());
+    layer->setSublayerTransform(m_sublayerTransform);
+    layer->setTransform(m_transform);
+
+    if (maskLayer())
+        maskLayer()->pushPropertiesTo(layer->maskLayer());
+    if (replicaLayer())
+        replicaLayer()->pushPropertiesTo(layer->replicaLayer());
+}
+
 GraphicsContext3D* LayerChromium::layerRendererContext() const
 {
     ASSERT(layerRenderer());
@@ -316,31 +339,6 @@ void LayerChromium::drawTexturedQuad(GraphicsContext3D* context, const Transform
     GLC(context, context->drawElements(GraphicsContext3D::TRIANGLES, 6, GraphicsContext3D::UNSIGNED_SHORT, 0));
 }
 
-
-
-// Returns true if any of the layer's descendants has drawable content.
-bool LayerChromium::descendantsDrawContent()
-{
-    const Vector<RefPtr<LayerChromium> >& sublayers = getSublayers();
-    for (size_t i = 0; i < sublayers.size(); ++i)
-        if (sublayers[i]->descendantsDrawContentRecursive())
-            return true;
-    return false;
-}
-
-// Returns true if either this layer or one of its descendants has drawable content.
-bool LayerChromium::descendantsDrawContentRecursive()
-{
-    if (drawsContent())
-        return true;
-
-    const Vector<RefPtr<LayerChromium> >& sublayers = getSublayers();
-    for (size_t i = 0; i < sublayers.size(); ++i)
-        if (sublayers[i]->descendantsDrawContentRecursive())
-            return true;
-    return false;
-}
-
 String LayerChromium::layerTreeAsText() const
 {
     TextStream ts;
@@ -359,7 +357,8 @@ void LayerChromium::dumpLayer(TextStream& ts, int indent) const
     writeIndent(ts, indent);
     ts << layerTypeAsString() << "(" << m_name << ")\n";
     dumpLayerProperties(ts, indent+2);
-    m_ccLayerImpl->dumpLayerProperties(ts, indent+2);
+    if (m_ccLayerImpl)
+        m_ccLayerImpl->dumpLayerProperties(ts, indent+2);
     if (m_replicaLayer) {
         writeIndent(ts, indent+2);
         ts << "Replica:\n";
@@ -385,48 +384,38 @@ void LayerChromium::dumpLayerProperties(TextStream& ts, int indent) const
 
 }
 
-// Begin calls that forward to the CCLayerImpl.
-// ==============================================
-// These exists just for debugging (via drawDebugBorder()).
-void LayerChromium::setBorderColor(const Color& color)
+PassRefPtr<CCLayerImpl> LayerChromium::createCCLayerImpl()
 {
-    m_ccLayerImpl->setDebugBorderColor(color);
-    setNeedsCommit();
+    return CCLayerImpl::create(this);
 }
 
-Color LayerChromium::borderColor() const
+void LayerChromium::createCCLayerImplIfNeeded()
 {
-    return m_ccLayerImpl->debugBorderColor();
+    if (!m_ccLayerImpl)
+        m_ccLayerImpl = createCCLayerImpl();
 }
 
-void LayerChromium::setBorderWidth(float width)
+CCLayerImpl* LayerChromium::ccLayerImpl()
 {
-    m_ccLayerImpl->setDebugBorderWidth(width);
-    setNeedsCommit();
+    return m_ccLayerImpl.get();
 }
 
-float LayerChromium::borderWidth() const
-{
-    return m_ccLayerImpl->debugBorderWidth();
-}
-
-LayerRendererChromium* LayerChromium::layerRenderer() const
+void LayerChromium::setBorderColor(const Color& color)
 {
-    return m_ccLayerImpl->layerRenderer();
+    m_debugBorderColor = color;
+    setNeedsCommit();
 }
 
-void LayerChromium::setDoubleSided(bool doubleSided)
+void LayerChromium::setBorderWidth(float width)
 {
-    m_ccLayerImpl->setDoubleSided(doubleSided);
+    m_debugBorderWidth = width;
     setNeedsCommit();
 }
 
-const IntSize& LayerChromium::bounds() const
+LayerRendererChromium* LayerChromium::layerRenderer() const
 {
-    return m_ccLayerImpl->bounds();
+    return m_layerRenderer.get();
 }
-// ==============================================
-// End calls that forward to the CCLayerImpl.
 
 }
 #endif // USE(ACCELERATED_COMPOSITING)
diff --git a/Source/WebCore/platform/graphics/chromium/LayerChromium.h b/Source/WebCore/platform/graphics/chromium/LayerChromium.h
index 29a2165..428ce61 100644
--- a/Source/WebCore/platform/graphics/chromium/LayerChromium.h
+++ b/Source/WebCore/platform/graphics/chromium/LayerChromium.h
@@ -89,6 +89,9 @@ public:
     void setBackgroundColor(const Color& color) { m_backgroundColor = color; setNeedsCommit(); }
     Color backgroundColor() const { return m_backgroundColor; }
 
+    void setBounds(const IntSize&);
+    const IntSize& bounds() const { return m_bounds; }
+
     void setClearsContext(bool clears) { m_clearsContext = clears; setNeedsCommit(); }
     bool clearsContext() const { return m_clearsContext; }
 
@@ -133,6 +136,9 @@ public:
     void setTransform(const TransformationMatrix& transform) { m_transform = transform; setNeedsCommit(); }
     const TransformationMatrix& transform() const { return m_transform; }
 
+    bool doubleSided() const { return m_doubleSided; }
+    void setDoubleSided(bool doubleSided) { m_doubleSided = doubleSided; setNeedsCommit(); }
+
     // FIXME: This setting is currently ignored.
     void setGeometryFlipped(bool flipped) { m_geometryFlipped = flipped; setNeedsCommit(); }
     bool geometryFlipped() const { return m_geometryFlipped; }
@@ -143,9 +149,6 @@ public:
     // in the LayerRendererChromium.
     virtual void setLayerRenderer(LayerRendererChromium*);
 
-    // Returns true if any of the layer's descendants has content to draw.
-    bool descendantsDrawContent();
-
     void setOwner(GraphicsLayerChromium* owner) { m_owner = owner; }
 
     void setReplicaLayer(LayerChromium* layer) { m_replicaLayer = layer; }
@@ -153,14 +156,14 @@ public:
 
     // These methods typically need to be overwritten by derived classes.
     virtual bool drawsContent() const { return false; }
-    virtual void updateContentsIfDirty() { }
+    virtual void paintContentsIfDirty() { }
+    virtual void updateCompositorResources() { }
     virtual void unreserveContentsTexture() { }
     virtual void bindContentsTexture() { }
     virtual void draw() { }
 
     // These exists just for debugging (via drawDebugBorder()).
     void setBorderColor(const Color&);
-    Color borderColor() const;
 
 #ifndef NDEBUG
     int debugID() const { return m_debugID; }
@@ -170,21 +173,19 @@ public:
     String layerTreeAsText() const;
 
     void setBorderWidth(float);
-    float borderWidth() const;
 
     // Everything from here down in the public section will move to CCLayerImpl.
-
-    CCLayerImpl* ccLayerImpl() const { return m_ccLayerImpl.get(); }
+    CCLayerImpl* ccLayerImpl();
+    void createCCLayerImplIfNeeded();
 
     static void drawTexturedQuad(GraphicsContext3D*, const TransformationMatrix& projectionMatrix, const TransformationMatrix& layerMatrix,
                                  float width, float height, float opacity,
                                  int matrixLocation, int alphaLocation);
 
+    virtual void pushPropertiesTo(CCLayerImpl*);
+
     // Begin calls that forward to the CCLayerImpl.
     LayerRendererChromium* layerRenderer() const;
-    void setDoubleSided(bool);
-    void setBounds(const IntSize&);
-    const IntSize& bounds() const;
     // End calls that forward to the CCLayerImpl.
 
     typedef ProgramBinding<VertexShaderPos, FragmentShaderColor> BorderProgram;
@@ -217,6 +218,11 @@ protected:
     static const unsigned s_positionAttribLocation;
     static const unsigned s_texCoordAttribLocation;
 
+    // Constructs a CCLayerImpl of the correct runtime type for this LayerChromium type.
+    virtual PassRefPtr<CCLayerImpl> createCCLayerImpl();
+
+    // For now, the LayerChromium directly owns its CCLayerImpl.
+    RefPtr<CCLayerImpl> m_ccLayerImpl;
 private:
     void setNeedsCommit();
 
@@ -233,19 +239,22 @@ private:
     // This should only be called from removeFromSuperlayer.
     void removeSublayer(LayerChromium*);
 
-    bool descendantsDrawContentRecursive();
-
     Vector<RefPtr<LayerChromium> > m_sublayers;
     LayerChromium* m_superlayer;
 
+    RefPtr<LayerRendererChromium> m_layerRenderer;
+
 #ifndef NDEBUG
     int m_debugID;
 #endif
 
     // Layer properties.
+    IntSize m_bounds;
     FloatPoint m_position;
     FloatPoint m_anchorPoint;
     Color m_backgroundColor;
+    Color m_debugBorderColor;
+    float m_debugBorderWidth;
     float m_opacity;
     float m_zPosition;
     float m_anchorPointZ;
@@ -255,13 +264,12 @@ private:
     bool m_opaque;
     bool m_geometryFlipped;
     bool m_needsDisplayOnBoundsChange;
+    bool m_doubleSided;
 
     TransformationMatrix m_transform;
     TransformationMatrix m_sublayerTransform;
 
     FloatRect m_frame;
-    // For now, the LayerChromium directly owns its CCLayerImpl.
-    RefPtr<CCLayerImpl> m_ccLayerImpl;
 
     // Replica layer used for reflections.
     LayerChromium* m_replicaLayer;
diff --git a/Source/WebCore/platform/graphics/chromium/LayerRendererChromium.cpp b/Source/WebCore/platform/graphics/chromium/LayerRendererChromium.cpp
index e7b299f..fc15abd 100644
--- a/Source/WebCore/platform/graphics/chromium/LayerRendererChromium.cpp
+++ b/Source/WebCore/platform/graphics/chromium/LayerRendererChromium.cpp
@@ -36,6 +36,7 @@
 
 #include "cc/CCLayerImpl.h"
 #include "Canvas2DLayerChromium.h"
+#include "FloatQuad.h"
 #include "GeometryBinding.h"
 #include "GraphicsContext3D.h"
 #include "LayerChromium.h"
@@ -43,6 +44,7 @@
 #include "NotImplemented.h"
 #include "TextStream.h"
 #include "TextureManager.h"
+#include "TraceEvent.h"
 #include "WebGLLayerChromium.h"
 #include "cc/CCLayerImpl.h"
 #if USE(SKIA)
@@ -91,21 +93,23 @@ bool LayerRendererChromium::compareLayerZ(const CCLayerImpl* a, const CCLayerImp
     return a->drawDepth() < b->drawDepth();
 }
 
-PassRefPtr<LayerRendererChromium> LayerRendererChromium::create(PassRefPtr<GraphicsContext3D> context)
+PassRefPtr<LayerRendererChromium> LayerRendererChromium::create(PassRefPtr<GraphicsContext3D> context, PassOwnPtr<TilePaintInterface> contentPaint, PassOwnPtr<TilePaintInterface> scrollbarPaint)
 {
     if (!context)
         return 0;
 
-    RefPtr<LayerRendererChromium> layerRenderer(adoptRef(new LayerRendererChromium(context)));
+    RefPtr<LayerRendererChromium> layerRenderer(adoptRef(new LayerRendererChromium(context, contentPaint, scrollbarPaint)));
     if (!layerRenderer->hardwareCompositing())
         return 0;
 
     return layerRenderer.release();
 }
 
-LayerRendererChromium::LayerRendererChromium(PassRefPtr<GraphicsContext3D> context)
-    : m_rootLayer(0)
-    , m_scrollPosition(IntPoint(-1, -1))
+LayerRendererChromium::LayerRendererChromium(PassRefPtr<GraphicsContext3D> context, PassOwnPtr<TilePaintInterface> contentPaint, PassOwnPtr<TilePaintInterface> scrollbarPaint)
+    : m_viewportScrollPosition(IntPoint(-1, -1))
+    , m_rootLayer(0)
+    , m_rootLayerContentPaint(contentPaint)
+    , m_rootLayerScrollbarPaint(scrollbarPaint)
     , m_currentShader(0)
     , m_currentRenderSurface(0)
     , m_offscreenFramebufferId(0)
@@ -114,8 +118,8 @@ LayerRendererChromium::LayerRendererChromium(PassRefPtr<GraphicsContext3D> conte
     , m_defaultRenderSurface(0)
 {
     m_hardwareCompositing = initializeSharedObjects();
-    m_rootLayerTiler = LayerTilerChromium::create(this, IntSize(256, 256), LayerTilerChromium::NoBorderTexels);
-    ASSERT(m_rootLayerTiler);
+    m_rootLayerContentTiler = LayerTilerChromium::create(this, IntSize(256, 256), LayerTilerChromium::NoBorderTexels);
+    ASSERT(m_rootLayerContentTiler);
 
     m_headsUpDisplay = CCHeadsUpDisplay::create(this);
 }
@@ -146,129 +150,149 @@ void LayerRendererChromium::useShader(unsigned programId)
     }
 }
 
-IntRect LayerRendererChromium::verticalScrollbarRect(const IntRect& visibleRect, const IntRect& contentRect)
+IntRect LayerRendererChromium::verticalScrollbarRect() const
 {
-    IntRect verticalScrollbar(IntPoint(contentRect.maxX(), contentRect.y()), IntSize(visibleRect.width() - contentRect.width(), visibleRect.height()));
+    IntRect verticalScrollbar(IntPoint(m_viewportContentRect.maxX(), m_viewportContentRect.y()), IntSize(m_viewportVisibleRect.width() - m_viewportContentRect.width(), m_viewportVisibleRect.height()));
     return verticalScrollbar;
 }
 
-IntRect LayerRendererChromium::horizontalScrollbarRect(const IntRect& visibleRect, const IntRect& contentRect)
+IntRect LayerRendererChromium::horizontalScrollbarRect() const
 {
-    IntRect horizontalScrollbar(IntPoint(contentRect.x(), contentRect.maxY()), IntSize(visibleRect.width(), visibleRect.height() - contentRect.height()));
+    IntRect horizontalScrollbar(IntPoint(m_viewportContentRect.x(), m_viewportContentRect.maxY()), IntSize(m_viewportVisibleRect.width(), m_viewportVisibleRect.height() - m_viewportContentRect.height()));
     return horizontalScrollbar;
 }
 
-void LayerRendererChromium::invalidateRootLayerRect(const IntRect& dirtyRect, const IntRect& visibleRect, const IntRect& contentRect)
+void LayerRendererChromium::invalidateRootLayerRect(const IntRect& dirtyRect)
 {
-    m_rootLayerTiler->invalidateRect(dirtyRect);
+    m_rootLayerContentTiler->invalidateRect(dirtyRect);
+
+    // Scrollbars never need to render beyond the fold, so clip to the viewport.
+    IntRect visibleDirtyRect = dirtyRect;
+    visibleDirtyRect.intersect(m_viewportVisibleRect);
+
     if (m_horizontalScrollbarTiler) {
-        IntRect scrollbar = horizontalScrollbarRect(visibleRect, contentRect);
-        if (dirtyRect.intersects(scrollbar)) {
+        IntRect scrollbar = horizontalScrollbarRect();
+        if (visibleDirtyRect.intersects(scrollbar)) {
             m_horizontalScrollbarTiler->setLayerPosition(scrollbar.location());
-            m_horizontalScrollbarTiler->invalidateRect(dirtyRect);
+            m_horizontalScrollbarTiler->invalidateRect(visibleDirtyRect);
         }
     }
     if (m_verticalScrollbarTiler) {
-        IntRect scrollbar = verticalScrollbarRect(visibleRect, contentRect);
-        if (dirtyRect.intersects(scrollbar)) {
+        IntRect scrollbar = verticalScrollbarRect();
+        if (visibleDirtyRect.intersects(scrollbar)) {
             m_verticalScrollbarTiler->setLayerPosition(scrollbar.location());
-            m_verticalScrollbarTiler->invalidateRect(dirtyRect);
+            m_verticalScrollbarTiler->invalidateRect(visibleDirtyRect);
         }
     }
 }
 
-void LayerRendererChromium::updateRootLayerContents(TilePaintInterface& tilePaint, const IntRect& visibleRect)
+void LayerRendererChromium::updateRootLayerContents()
 {
-    m_rootLayerTiler->update(tilePaint, visibleRect);
+    TRACE_EVENT("LayerRendererChromium::updateRootLayerContents", this, 0);
+    m_rootLayerContentTiler->update(*m_rootLayerContentPaint, m_viewportVisibleRect);
 }
 
-void LayerRendererChromium::updateRootLayerScrollbars(TilePaintInterface& scrollbarPaint, const IntRect& visibleRect, const IntRect& contentRect)
+void LayerRendererChromium::updateRootLayerScrollbars()
 {
-    if (visibleRect.width() > contentRect.width()) {
-        IntRect verticalScrollbar = verticalScrollbarRect(visibleRect, contentRect);
+    TRACE_EVENT("LayerRendererChromium::updateRootLayerScrollbars", this, 0);
+    if (m_viewportVisibleRect.width() > m_viewportContentRect.width()) {
+        IntRect verticalScrollbar = verticalScrollbarRect();
         IntSize tileSize = verticalScrollbar.size().shrunkTo(IntSize(m_maxTextureSize, m_maxTextureSize));
         if (!m_verticalScrollbarTiler)
             m_verticalScrollbarTiler = LayerTilerChromium::create(this, tileSize, LayerTilerChromium::NoBorderTexels);
         else
             m_verticalScrollbarTiler->setTileSize(tileSize);
         m_verticalScrollbarTiler->setLayerPosition(verticalScrollbar.location());
-        m_verticalScrollbarTiler->update(scrollbarPaint, visibleRect);
+        m_verticalScrollbarTiler->update(*m_rootLayerScrollbarPaint, m_viewportVisibleRect);
     } else
         m_verticalScrollbarTiler.clear();
 
-    if (visibleRect.height() > contentRect.height()) {
-        IntRect horizontalScrollbar = horizontalScrollbarRect(visibleRect, contentRect);
+    if (m_viewportVisibleRect.height() > m_viewportContentRect.height()) {
+        IntRect horizontalScrollbar = horizontalScrollbarRect();
         IntSize tileSize = horizontalScrollbar.size().shrunkTo(IntSize(m_maxTextureSize, m_maxTextureSize));
         if (!m_horizontalScrollbarTiler)
             m_horizontalScrollbarTiler = LayerTilerChromium::create(this, tileSize, LayerTilerChromium::NoBorderTexels);
         else
             m_horizontalScrollbarTiler->setTileSize(tileSize);
         m_horizontalScrollbarTiler->setLayerPosition(horizontalScrollbar.location());
-        m_horizontalScrollbarTiler->update(scrollbarPaint, visibleRect);
+        m_horizontalScrollbarTiler->update(*m_rootLayerScrollbarPaint, m_viewportVisibleRect);
     } else
         m_horizontalScrollbarTiler.clear();
 }
 
 void LayerRendererChromium::drawRootLayer()
 {
-    m_rootLayerTiler->draw(m_visibleRect);
+    m_rootLayerContentTiler->draw(m_viewportVisibleRect);
 
     if (m_verticalScrollbarTiler)
-        m_verticalScrollbarTiler->draw(m_visibleRect);
+        m_verticalScrollbarTiler->draw(m_viewportVisibleRect);
 
     if (m_horizontalScrollbarTiler)
-        m_horizontalScrollbarTiler->draw(m_visibleRect);
+        m_horizontalScrollbarTiler->draw(m_viewportVisibleRect);
+}
+
+void LayerRendererChromium::setViewport(const IntRect& visibleRect, const IntRect& contentRect, const IntPoint& scrollPosition)
+{
+    bool visibleRectChanged = m_viewportVisibleRect.size() != visibleRect.size();
+
+    m_viewportVisibleRect = visibleRect;
+    m_viewportContentRect = contentRect;
+    m_viewportScrollPosition = scrollPosition;
+
+    if (visibleRectChanged) {
+        // Reset the current render surface to force an update of the viewport and
+        // projection matrix next time useRenderSurface is called.
+        m_currentRenderSurface = 0;
+
+        m_rootLayerContentTiler->invalidateEntireLayer();
+        if (m_horizontalScrollbarTiler)
+            m_horizontalScrollbarTiler->invalidateEntireLayer();
+        if (m_verticalScrollbarTiler)
+            m_verticalScrollbarTiler->invalidateEntireLayer();
+    }
 }
 
-void LayerRendererChromium::updateAndDrawLayers(const IntRect& visibleRect, const IntRect& contentRect, const IntPoint& scrollPosition,
-                                                TilePaintInterface& tilePaint, TilePaintInterface& scrollbarPaint)
+void LayerRendererChromium::updateAndDrawLayers()
 {
     ASSERT(m_hardwareCompositing);
 
     if (!m_rootLayer)
         return;
 
-    updateRootLayerContents(tilePaint, visibleRect);
+    updateRootLayerContents();
+
     // Recheck that we still have a root layer. This may become null if
     // compositing gets turned off during a paint operation.
     if (!m_rootLayer)
         return;
 
-    updateRootLayerScrollbars(scrollbarPaint, visibleRect, contentRect);
+    updateRootLayerScrollbars();
 
     Vector<CCLayerImpl*> renderSurfaceLayerList;
-    updateLayers(visibleRect, contentRect, scrollPosition, renderSurfaceLayerList);
+    updateLayers(renderSurfaceLayerList);
 
     drawLayers(renderSurfaceLayerList);
+
+    if (isCompositingOffscreen())
+        copyOffscreenTextureToDisplay();
 }
 
-void LayerRendererChromium::updateLayers(const IntRect& visibleRect, const IntRect& contentRect, const IntPoint& scrollPosition,
-                                         Vector<CCLayerImpl*>& renderSurfaceLayerList)
+void LayerRendererChromium::updateLayers(Vector<CCLayerImpl*>& renderSurfaceLayerList)
 {
+    TRACE_EVENT("LayerRendererChromium::updateLayers", this, 0);
+    m_rootLayer->createCCLayerImplIfNeeded();
     CCLayerImpl* rootDrawLayer = m_rootLayer->ccLayerImpl();
 
     if (!rootDrawLayer->renderSurface())
         rootDrawLayer->createRenderSurface();
     ASSERT(rootDrawLayer->renderSurface());
 
-    // If the size of the visible area has changed then allocate a new texture
-    // to store the contents of the root layer and adjust the projection matrix
-    // and viewport.
-
-    rootDrawLayer->renderSurface()->m_contentRect = IntRect(IntPoint(0, 0), visibleRect.size());
+    rootDrawLayer->renderSurface()->m_contentRect = IntRect(IntPoint(0, 0), m_viewportVisibleRect.size());
 
-    if (visibleRect.size() != m_visibleRect.size()) {
-        // Reset the current render surface to force an update of the viewport and
-        // projection matrix next time useRenderSurface is called.
-        m_currentRenderSurface = 0;
-    }
-    m_visibleRect = visibleRect;
-
-    m_scrollPosition = scrollPosition;
     // Scissor out the scrollbars to avoid rendering on top of them.
-    IntRect rootScissorRect(contentRect);
+    IntRect rootScissorRect(m_viewportContentRect);
     // The scissorRect should not include the scroll offset.
-    rootScissorRect.move(-m_scrollPosition.x(), -m_scrollPosition.y());
+    rootScissorRect.move(-m_viewportScrollPosition.x(), -m_viewportScrollPosition.y());
     rootDrawLayer->setScissorRect(rootScissorRect);
 
     m_defaultRenderSurface = rootDrawLayer->renderSurface();
@@ -283,16 +307,19 @@ void LayerRendererChromium::updateLayers(const IntRect& visibleRect, const IntRe
     // concept of a large content layer.
     updatePropertiesAndRenderSurfaces(m_rootLayer.get(), identityMatrix, renderSurfaceLayerList, m_defaultRenderSurface->m_layerList);
 
-    updateContentsRecursive(m_rootLayer.get());
+    paintContentsRecursive(m_rootLayer.get());
+
+    updateCompositorResourcesRecursive(m_rootLayer.get());
 }
 
 void LayerRendererChromium::drawLayers(const Vector<CCLayerImpl*>& renderSurfaceLayerList)
 {
+    TRACE_EVENT("LayerRendererChromium::drawLayers", this, 0);
     CCLayerImpl* rootDrawLayer = m_rootLayer->ccLayerImpl();
     makeContextCurrent();
 
     // The GL viewport covers the entire visible area, including the scrollbars.
-    GLC(m_context.get(), m_context->viewport(0, 0, m_visibleRect.width(), m_visibleRect.height()));
+    GLC(m_context.get(), m_context->viewport(0, 0, m_viewportVisibleRect.width(), m_viewportVisibleRect.height()));
 
     // Bind the common vertex attributes used for drawing all the layers.
     m_sharedGeometry->prepareForDraw();
@@ -363,11 +390,13 @@ void LayerRendererChromium::drawLayers(const Vector<CCLayerImpl*>& renderSurface
 
 void LayerRendererChromium::finish()
 {
+    TRACE_EVENT("LayerRendererChromium::finish", this, 0);
     m_context->finish();
 }
 
 void LayerRendererChromium::present()
 {
+    TRACE_EVENT("LayerRendererChromium::present", this, 0);
     // We're done! Time to swapbuffers!
 
     // Note that currently this has the same effect as swapBuffers; we should
@@ -382,7 +411,7 @@ void LayerRendererChromium::setRootLayer(PassRefPtr<LayerChromium> layer)
     m_rootLayer = layer;
     if (m_rootLayer)
         m_rootLayer->setLayerRenderer(this);
-    m_rootLayerTiler->invalidateEntireLayer();
+    m_rootLayerContentTiler->invalidateEntireLayer();
     if (m_horizontalScrollbarTiler)
         m_horizontalScrollbarTiler->invalidateEntireLayer();
     if (m_verticalScrollbarTiler)
@@ -391,7 +420,7 @@ void LayerRendererChromium::setRootLayer(PassRefPtr<LayerChromium> layer)
 
 void LayerRendererChromium::getFramebufferPixels(void *pixels, const IntRect& rect)
 {
-    ASSERT(rect.maxX() <= visibleRectSize().width() && rect.maxY() <= visibleRectSize().height());
+    ASSERT(rect.maxX() <= m_viewportVisibleRect.width() && rect.maxY() <= m_viewportVisibleRect.height());
 
     if (!pixels)
         return;
@@ -446,8 +475,29 @@ bool LayerRendererChromium::isLayerVisible(LayerChromium* layer, const Transform
 // necessary transformations, scissor rectangles, render surfaces, etc.
 void LayerRendererChromium::updatePropertiesAndRenderSurfaces(LayerChromium* layer, const TransformationMatrix& parentMatrix, Vector<CCLayerImpl*>& renderSurfaceLayerList, Vector<CCLayerImpl*>& layerList)
 {
+    // Make sure we have CCLayerImpls for this subtree.
+    layer->createCCLayerImplIfNeeded();
     layer->setLayerRenderer(this);
+    if (layer->maskLayer()) {
+        layer->maskLayer()->createCCLayerImplIfNeeded();
+        layer->maskLayer()->setLayerRenderer(this);
+    }
+    if (layer->replicaLayer()) {
+        layer->replicaLayer()->createCCLayerImplIfNeeded();
+        layer->replicaLayer()->setLayerRenderer(this);
+    }
+    if (layer->replicaLayer() && layer->replicaLayer()->maskLayer()) {
+        layer->replicaLayer()->maskLayer()->createCCLayerImplIfNeeded();
+        layer->replicaLayer()->maskLayer()->setLayerRenderer(this);
+    }
+
     CCLayerImpl* drawLayer = layer->ccLayerImpl();
+    // Currently we're calling pushPropertiesTo() twice - once here and once in updateCompositorResourcesRecursive().
+    // We should only call pushPropertiesTo() in commit, but because we rely on the draw layer state to update
+    // RenderSurfaces and we rely on RenderSurfaces being up to date in order to paint contents we have
+    // to update the draw layers twice.
+    // FIXME: Remove this call once layer updates no longer depend on render surfaces.
+    layer->pushPropertiesTo(drawLayer);
 
     // Compute the new matrix transformation that will be applied to this layer and
     // all its sublayers. It's important to remember that the layer's position
@@ -467,9 +517,9 @@ void LayerRendererChromium::updatePropertiesAndRenderSurfaces(LayerChromium* lay
     // Where: P is the projection matrix
     //        M is the layer's matrix computed above
     //        S is the scale adjustment (to scale up to the layer size)
-    IntSize bounds = layer->bounds();
-    FloatPoint anchorPoint = layer->anchorPoint();
-    FloatPoint position = layer->position();
+    IntSize bounds = drawLayer->bounds();
+    FloatPoint anchorPoint = drawLayer->anchorPoint();
+    FloatPoint position = drawLayer->position();
 
     // Offset between anchor point and the center of the quad.
     float centerOffsetX = (0.5 - anchorPoint.x()) * bounds.width();
@@ -477,16 +527,16 @@ void LayerRendererChromium::updatePropertiesAndRenderSurfaces(LayerChromium* lay
 
     TransformationMatrix layerLocalTransform;
     // LT = Tr[l]
-    layerLocalTransform.translate3d(position.x(), position.y(), layer->anchorPointZ());
+    layerLocalTransform.translate3d(position.x(), position.y(), drawLayer->anchorPointZ());
     // LT = Tr[l] * M[l]
-    layerLocalTransform.multiply(layer->transform());
+    layerLocalTransform.multiply(drawLayer->transform());
     // LT = Tr[l] * M[l] * Tr[c]
-    layerLocalTransform.translate3d(centerOffsetX, centerOffsetY, -layer->anchorPointZ());
+    layerLocalTransform.translate3d(centerOffsetX, centerOffsetY, -drawLayer->anchorPointZ());
 
     TransformationMatrix combinedTransform = parentMatrix;
     combinedTransform = combinedTransform.multiply(layerLocalTransform);
 
-    FloatRect layerRect(-0.5 * layer->bounds().width(), -0.5 * layer->bounds().height(), layer->bounds().width(), layer->bounds().height());
+    FloatRect layerRect(-0.5 * drawLayer->bounds().width(), -0.5 * drawLayer->bounds().height(), drawLayer->bounds().width(), drawLayer->bounds().height());
     IntRect transformedLayerRect;
 
     // The layer and its descendants render on a new RenderSurface if any of
@@ -498,12 +548,11 @@ void LayerRendererChromium::updatePropertiesAndRenderSurfaces(LayerChromium* lay
     // If a layer preserves-3d then we don't create a RenderSurface for it to avoid flattening
     // out its children. The opacity value of the children layers is multiplied by the opacity
     // of their parent.
-    bool useSurfaceForClipping = layer->masksToBounds() && !isScaleOrTranslation(combinedTransform);
-    bool useSurfaceForOpacity = layer->opacity() != 1 && !layer->preserves3D();
-    bool useSurfaceForMasking = layer->maskDrawLayer();
-    bool useSurfaceForReflection = layer->replicaLayer();
-    if (((useSurfaceForClipping || useSurfaceForOpacity) && layer->descendantsDrawContent())
-        || useSurfaceForMasking || useSurfaceForReflection) {
+    bool useSurfaceForClipping = drawLayer->masksToBounds() && !isScaleOrTranslation(combinedTransform);
+    bool useSurfaceForOpacity = drawLayer->opacity() != 1 && !drawLayer->preserves3D();
+    bool useSurfaceForMasking = drawLayer->maskLayer();
+    bool useSurfaceForReflection = drawLayer->replicaLayer();
+    if (useSurfaceForMasking || useSurfaceForReflection || ((useSurfaceForClipping || useSurfaceForOpacity) && drawLayer->descendantsDrawsContent())) {
         RenderSurfaceChromium* renderSurface = drawLayer->renderSurface();
         if (!renderSurface)
             renderSurface = drawLayer->createRenderSurface();
@@ -516,15 +565,15 @@ void LayerRendererChromium::updatePropertiesAndRenderSurfaces(LayerChromium* lay
         transformedLayerRect = IntRect(0, 0, bounds.width(), bounds.height());
 
         // Layer's opacity will be applied when drawing the render surface.
-        renderSurface->m_drawOpacity = layer->opacity();
-        if (layer->superlayer() && layer->superlayer()->preserves3D())
+        renderSurface->m_drawOpacity = drawLayer->opacity();
+        if (drawLayer->superlayer() && drawLayer->superlayer()->preserves3D())
             renderSurface->m_drawOpacity *= drawLayer->superlayer()->drawOpacity();
         drawLayer->setDrawOpacity(1);
 
         TransformationMatrix layerOriginTransform = combinedTransform;
         layerOriginTransform.translate3d(-0.5 * bounds.width(), -0.5 * bounds.height(), 0);
         renderSurface->m_originTransform = layerOriginTransform;
-        if (layerOriginTransform.isInvertible() && layer->superlayer()) {
+        if (layerOriginTransform.isInvertible() && drawLayer->superlayer()) {
             TransformationMatrix parentToLayer = layerOriginTransform.inverse();
 
             drawLayer->setScissorRect(parentToLayer.mapRect(drawLayer->superlayer()->scissorRect()));
@@ -538,17 +587,14 @@ void LayerRendererChromium::updatePropertiesAndRenderSurfaces(LayerChromium* lay
 
         renderSurface->m_layerList.clear();
 
-        if (layer->maskDrawLayer()) {
-            renderSurface->m_maskLayer = layer->maskDrawLayer();
-            layer->maskDrawLayer()->setLayerRenderer(this);
-            layer->maskDrawLayer()->setTargetRenderSurface(renderSurface);
+        if (drawLayer->maskLayer()) {
+            renderSurface->m_maskLayer = drawLayer->maskLayer();
+            drawLayer->maskLayer()->setTargetRenderSurface(renderSurface);
         } else
             renderSurface->m_maskLayer = 0;
 
-        if (layer->replicaLayer() && layer->replicaLayer()->maskDrawLayer()) {
-            layer->replicaLayer()->maskDrawLayer()->setLayerRenderer(this);
-            layer->replicaLayer()->maskDrawLayer()->setTargetRenderSurface(renderSurface);
-        }
+        if (drawLayer->replicaLayer() && drawLayer->replicaLayer()->maskLayer())
+            drawLayer->replicaLayer()->maskLayer()->setTargetRenderSurface(renderSurface);
 
         renderSurfaceLayerList.append(drawLayer);
     } else {
@@ -556,10 +602,10 @@ void LayerRendererChromium::updatePropertiesAndRenderSurfaces(LayerChromium* lay
         drawLayer->setDrawTransform(combinedTransform);
         transformedLayerRect = enclosingIntRect(drawLayer->drawTransform().mapRect(layerRect));
 
-        drawLayer->setDrawOpacity(layer->opacity());
+        drawLayer->setDrawOpacity(drawLayer->opacity());
 
-        if (layer->superlayer()) {
-            if (layer->superlayer()->preserves3D())
+        if (drawLayer->superlayer()) {
+            if (drawLayer->superlayer()->preserves3D())
                drawLayer->setDrawOpacity(drawLayer->drawOpacity() * drawLayer->superlayer()->drawOpacity());
 
             // Layers inherit the scissor rect from their superlayer.
@@ -571,7 +617,7 @@ void LayerRendererChromium::updatePropertiesAndRenderSurfaces(LayerChromium* lay
         if (layer != m_rootLayer)
             drawLayer->clearRenderSurface();
 
-        if (layer->masksToBounds()) {
+        if (drawLayer->masksToBounds()) {
             IntRect scissor = drawLayer->scissorRect();
             scissor.intersect(transformedLayerRect);
             drawLayer->setScissorRect(scissor);
@@ -581,7 +627,7 @@ void LayerRendererChromium::updatePropertiesAndRenderSurfaces(LayerChromium* lay
     if (drawLayer->renderSurface())
         drawLayer->setTargetRenderSurface(drawLayer->renderSurface());
     else {
-        ASSERT(layer->superlayer());
+        ASSERT(drawLayer->superlayer());
         drawLayer->setTargetRenderSurface(drawLayer->superlayer()->targetRenderSurface());
     }
 
@@ -595,7 +641,7 @@ void LayerRendererChromium::updatePropertiesAndRenderSurfaces(LayerChromium* lay
     TransformationMatrix sublayerMatrix = drawLayer->drawTransform();
 
     // Flatten to 2D if the layer doesn't preserve 3D.
-    if (!layer->preserves3D()) {
+    if (!drawLayer->preserves3D()) {
         sublayerMatrix.setM13(0);
         sublayerMatrix.setM23(0);
         sublayerMatrix.setM31(0);
@@ -606,7 +652,7 @@ void LayerRendererChromium::updatePropertiesAndRenderSurfaces(LayerChromium* lay
     }
 
     // Apply the sublayer transform at the center of the layer.
-    sublayerMatrix.multiply(layer->sublayerTransform());
+    sublayerMatrix.multiply(drawLayer->sublayerTransform());
 
     // The origin of the sublayers is the top left corner of the layer, not the
     // center. The matrix passed down to the sublayers is therefore:
@@ -619,6 +665,7 @@ void LayerRendererChromium::updatePropertiesAndRenderSurfaces(LayerChromium* lay
 
     const Vector<RefPtr<LayerChromium> >& sublayers = layer->getSublayers();
     for (size_t i = 0; i < sublayers.size(); ++i) {
+        sublayers[i]->createCCLayerImplIfNeeded();
         CCLayerImpl* sublayer = sublayers[i]->ccLayerImpl();
         updatePropertiesAndRenderSurfaces(sublayers[i].get(), sublayerMatrix, renderSurfaceLayerList, descendants);
 
@@ -635,7 +682,7 @@ void LayerRendererChromium::updatePropertiesAndRenderSurfaces(LayerChromium* lay
         }
     }
 
-    if (layer->masksToBounds() || useSurfaceForMasking) {
+    if (drawLayer->masksToBounds() || useSurfaceForMasking) {
         IntRect drawableContentRect = drawLayer->drawableContentRect();
         drawableContentRect.intersect(transformedLayerRect);
         drawLayer->setDrawableContentRect(drawableContentRect);
@@ -651,7 +698,7 @@ void LayerRendererChromium::updatePropertiesAndRenderSurfaces(LayerChromium* lay
 
         // Don't clip if the layer is reflected as the reflection shouldn't be
         // clipped.
-        if (!layer->replicaLayer()) {
+        if (!drawLayer->replicaLayer()) {
             renderSurface->m_contentRect.intersect(drawLayer->scissorRect());
             FloatPoint clippedSurfaceCenter = renderSurface->contentRectCenter();
             centerOffsetDueToClipping = clippedSurfaceCenter - surfaceCenter;
@@ -675,10 +722,10 @@ void LayerRendererChromium::updatePropertiesAndRenderSurfaces(LayerChromium* lay
 
         // Compute the transformation matrix used to draw the replica of the render
         // surface.
-        if (layer->replicaLayer()) {
+        if (drawLayer->replicaLayer()) {
             renderSurface->m_replicaDrawTransform = renderSurface->m_originTransform;
-            renderSurface->m_replicaDrawTransform.translate3d(layer->replicaLayer()->position().x(), layer->replicaLayer()->position().y(), 0);
-            renderSurface->m_replicaDrawTransform.multiply(layer->replicaLayer()->transform());
+            renderSurface->m_replicaDrawTransform.translate3d(drawLayer->replicaLayer()->position().x(), drawLayer->replicaLayer()->position().y(), 0);
+            renderSurface->m_replicaDrawTransform.multiply(drawLayer->replicaLayer()->transform());
             renderSurface->m_replicaDrawTransform.translate3d(surfaceCenter.x() - anchorPoint.x() * bounds.width(), surfaceCenter.y() - anchorPoint.y() * bounds.height(), 0);
         }
     }
@@ -686,8 +733,8 @@ void LayerRendererChromium::updatePropertiesAndRenderSurfaces(LayerChromium* lay
     // Compute the depth value of the center of the layer which will be used when
     // sorting the layers for the preserves-3d property.
     const TransformationMatrix& layerDrawMatrix = drawLayer->renderSurface() ? drawLayer->renderSurface()->m_drawTransform : drawLayer->drawTransform();
-    if (layer->superlayer()) {
-        if (!layer->superlayer()->preserves3D())
+    if (drawLayer->superlayer()) {
+        if (!drawLayer->superlayer()->preserves3D())
             drawLayer->setDrawDepth(drawLayer->superlayer()->drawDepth());
         else
             drawLayer->setDrawDepth(layerDrawMatrix.m43());
@@ -697,24 +744,50 @@ void LayerRendererChromium::updatePropertiesAndRenderSurfaces(LayerChromium* lay
     // If preserves-3d then sort all the descendants by the Z coordinate of their
     // center. If the preserves-3d property is also set on the superlayer then
     // skip the sorting as the superlayer will sort all the descendants anyway.
-    if (layer->preserves3D() && (!layer->superlayer() || !layer->superlayer()->preserves3D()))
+    if (drawLayer->preserves3D() && (!drawLayer->superlayer() || !drawLayer->superlayer()->preserves3D()))
         std::stable_sort(&descendants.at(thisLayerIndex), descendants.end(), compareLayerZ);
 }
 
-void LayerRendererChromium::updateContentsRecursive(LayerChromium* layer)
+void LayerRendererChromium::paintContentsRecursive(LayerChromium* layer)
 {
     const Vector<RefPtr<LayerChromium> >& sublayers = layer->getSublayers();
     for (size_t i = 0; i < sublayers.size(); ++i)
-        updateContentsRecursive(sublayers[i].get());
+        paintContentsRecursive(sublayers[i].get());
+
+    if (layer->bounds().isEmpty())
+        return;
 
     if (layer->drawsContent())
-        layer->updateContentsIfDirty();
+        layer->paintContentsIfDirty();
     if (layer->maskLayer() && layer->maskLayer()->drawsContent())
-        layer->maskLayer()->updateContentsIfDirty();
+        layer->maskLayer()->paintContentsIfDirty();
     if (layer->replicaLayer() && layer->replicaLayer()->drawsContent())
-        layer->replicaLayer()->updateContentsIfDirty();
+        layer->replicaLayer()->paintContentsIfDirty();
     if (layer->replicaLayer() && layer->replicaLayer()->maskLayer() && layer->replicaLayer()->maskLayer()->drawsContent())
-        layer->replicaLayer()->maskLayer()->updateContentsIfDirty();
+        layer->replicaLayer()->maskLayer()->paintContentsIfDirty();
+}
+
+void LayerRendererChromium::updateCompositorResourcesRecursive(LayerChromium* layer)
+{
+    const Vector<RefPtr<LayerChromium> >& sublayers = layer->getSublayers();
+    for (size_t i = 0; i < sublayers.size(); ++i)
+        updateCompositorResourcesRecursive(sublayers[i].get());
+
+    if (layer->bounds().isEmpty())
+        return;
+
+    CCLayerImpl* drawLayer = layer->ccLayerImpl();
+
+    if (drawLayer->drawsContent())
+        drawLayer->updateCompositorResources();
+    if (drawLayer->maskLayer() && drawLayer->maskLayer()->drawsContent())
+        drawLayer->maskLayer()->updateCompositorResources();
+    if (drawLayer->replicaLayer() && drawLayer->replicaLayer()->drawsContent())
+        drawLayer->replicaLayer()->updateCompositorResources();
+    if (drawLayer->replicaLayer() && drawLayer->replicaLayer()->maskLayer() && drawLayer->replicaLayer()->maskLayer()->drawsContent())
+        drawLayer->replicaLayer()->maskLayer()->updateCompositorResources();
+
+    layer->pushPropertiesTo(drawLayer);
 }
 
 void LayerRendererChromium::setCompositeOffscreen(bool compositeOffscreen)
@@ -788,22 +861,38 @@ void LayerRendererChromium::drawLayer(CCLayerImpl* layer, RenderSurfaceChromium*
         return;
     }
 
-    if (layer->bounds().isEmpty())
+    if (layer->bounds().isEmpty()) {
+        layer->unreserveContentsTexture();
         return;
+    }
 
     setScissorToRect(layer->scissorRect());
 
     // Check if the layer falls within the visible bounds of the page.
     IntRect layerRect = layer->getDrawRect();
     bool isLayerVisible = layer->scissorRect().intersects(layerRect);
-    if (!isLayerVisible)
+    if (!isLayerVisible) {
+        layer->unreserveContentsTexture();
         return;
+    }
 
     // FIXME: Need to take into account the commulative render surface transforms all the way from
     //        the default render surface in order to determine visibility.
-    TransformationMatrix combinedDrawMatrix = (layer->renderSurface() ? layer->renderSurface()->drawTransform().multiply(layer->drawTransform()) : layer->drawTransform());
-    if (!layer->doubleSided() && combinedDrawMatrix.m33() < 0)
-         return;
+    TransformationMatrix combinedDrawMatrix = (layer->targetRenderSurface() ? layer->targetRenderSurface()->drawTransform().multiply(layer->drawTransform()) : layer->drawTransform());
+    
+    if (!layer->doubleSided()) {
+        FloatRect layerRect(FloatPoint(0, 0), FloatSize(layer->bounds()));
+        FloatQuad mappedLayer = combinedDrawMatrix.mapQuad(FloatQuad(layerRect));
+        FloatSize horizontalDir = mappedLayer.p2() - mappedLayer.p1();
+        FloatSize verticalDir = mappedLayer.p4() - mappedLayer.p1();
+        FloatPoint3D xAxis(horizontalDir.width(), horizontalDir.height(), 0);
+        FloatPoint3D yAxis(verticalDir.width(), verticalDir.height(), 0);
+        FloatPoint3D zAxis = xAxis.cross(yAxis);
+        if (zAxis.z() < 0) {
+            layer->unreserveContentsTexture();
+            return;
+        }
+    }
 
     if (layer->drawsContent())
         layer->draw();
@@ -880,10 +969,10 @@ bool LayerRendererChromium::initializeSharedObjects()
     m_sharedGeometry = adoptPtr(new GeometryBinding(m_context.get()));
     m_borderProgram = adoptPtr(new LayerChromium::BorderProgram(m_context.get()));
     m_contentLayerProgram = adoptPtr(new ContentLayerChromium::Program(m_context.get()));
-    m_canvasLayerProgram = adoptPtr(new CanvasLayerChromium::Program(m_context.get()));
-    m_videoLayerRGBAProgram = adoptPtr(new VideoLayerChromium::RGBAProgram(m_context.get()));
-    m_videoLayerYUVProgram = adoptPtr(new VideoLayerChromium::YUVProgram(m_context.get()));
-    m_pluginLayerProgram = adoptPtr(new PluginLayerChromium::Program(m_context.get()));
+    m_canvasLayerProgram = adoptPtr(new CCCanvasLayerImpl::Program(m_context.get()));
+    m_videoLayerRGBAProgram = adoptPtr(new CCVideoLayerImpl::RGBAProgram(m_context.get()));
+    m_videoLayerYUVProgram = adoptPtr(new CCVideoLayerImpl::YUVProgram(m_context.get()));
+    m_pluginLayerProgram = adoptPtr(new CCPluginLayerImpl::Program(m_context.get()));
     m_renderSurfaceProgram = adoptPtr(new RenderSurfaceChromium::Program(m_context.get()));
     m_renderSurfaceMaskProgram = adoptPtr(new RenderSurfaceChromium::MaskProgram(m_context.get()));
     m_tilerProgram = adoptPtr(new LayerTilerChromium::Program(m_context.get()));
@@ -920,7 +1009,7 @@ void LayerRendererChromium::cleanupSharedObjects()
         GLC(m_context.get(), m_context->deleteFramebuffer(m_offscreenFramebufferId));
 
     // Clear tilers before the texture manager, as they have references to textures.
-    m_rootLayerTiler.clear();
+    m_rootLayerContentTiler.clear();
     m_horizontalScrollbarTiler.clear();
     m_verticalScrollbarTiler.clear();
 
diff --git a/Source/WebCore/platform/graphics/chromium/LayerRendererChromium.h b/Source/WebCore/platform/graphics/chromium/LayerRendererChromium.h
index 7e8850a..667ede2 100644
--- a/Source/WebCore/platform/graphics/chromium/LayerRendererChromium.h
+++ b/Source/WebCore/platform/graphics/chromium/LayerRendererChromium.h
@@ -34,16 +34,17 @@
 
 #if USE(ACCELERATED_COMPOSITING)
 
-#include "CanvasLayerChromium.h"
 #include "ContentLayerChromium.h"
 #include "IntRect.h"
 #include "LayerChromium.h"
 #include "LayerTilerChromium.h"
-#include "PluginLayerChromium.h"
 #include "RenderSurfaceChromium.h"
 #include "SkBitmap.h"
 #include "VideoLayerChromium.h"
+#include "cc/CCCanvasLayerImpl.h"
 #include "cc/CCHeadsUpDisplay.h"
+#include "cc/CCPluginLayerImpl.h"
+#include "cc/CCVideoLayerImpl.h"
 #include <wtf/HashMap.h>
 #include <wtf/Noncopyable.h>
 #include <wtf/PassOwnPtr.h>
@@ -66,17 +67,18 @@ class CCHeadsUpDisplay;
 // Class that handles drawing of composited render layers using GL.
 class LayerRendererChromium : public RefCounted<LayerRendererChromium> {
 public:
-    static PassRefPtr<LayerRendererChromium> create(PassRefPtr<GraphicsContext3D> graphicsContext3D);
+    static PassRefPtr<LayerRendererChromium> create(PassRefPtr<GraphicsContext3D>, PassOwnPtr<TilePaintInterface> contentPaint, PassOwnPtr<TilePaintInterface> scrollbarPaint);
 
     ~LayerRendererChromium();
 
     GraphicsContext3D* context();
 
-    void invalidateRootLayerRect(const IntRect& dirtyRect, const IntRect& visibleRect, const IntRect& contentRect);
+    void invalidateRootLayerRect(const IntRect& dirtyRect);
+
+    void setViewport(const IntRect& visibleRect, const IntRect& contentRect, const IntPoint& scrollPosition);
 
     // updates and draws the current layers onto the backbuffer
-    void updateAndDrawLayers(const IntRect& visibleRect, const IntRect& contentRect, const IntPoint& scrollPosition,
-                             TilePaintInterface&, TilePaintInterface& scrollbarPaint);
+    void updateAndDrawLayers();
 
     // waits for rendering to finish
     void finish();
@@ -84,7 +86,7 @@ public:
     // puts backbuffer onscreen
     void present();
 
-    IntSize visibleRectSize() const { return m_visibleRect.size(); }
+    IntSize viewportSize() const { return m_viewportVisibleRect.size(); }
 
     void setRootLayer(PassRefPtr<LayerChromium> layer);
     LayerChromium* rootLayer() { return m_rootLayer.get(); }
@@ -94,8 +96,6 @@ public:
 
     void setCompositeOffscreen(bool);
     bool isCompositingOffscreen() const { return m_compositeOffscreen; }
-    LayerTexture* getOffscreenLayerTexture();
-    void copyOffscreenTextureToDisplay();
 
     unsigned createLayerTexture();
     void deleteLayerTexture(unsigned);
@@ -111,13 +111,13 @@ public:
     const GeometryBinding* sharedGeometry() const { return m_sharedGeometry.get(); }
     const LayerChromium::BorderProgram* borderProgram() const { return m_borderProgram.get(); }
     const ContentLayerChromium::Program* contentLayerProgram() const { return m_contentLayerProgram.get(); }
-    const CanvasLayerChromium::Program* canvasLayerProgram() const { return m_canvasLayerProgram.get(); }
-    const VideoLayerChromium::RGBAProgram* videoLayerRGBAProgram() const { return m_videoLayerRGBAProgram.get(); }
-    const VideoLayerChromium::YUVProgram* videoLayerYUVProgram() const { return m_videoLayerYUVProgram.get(); }
-    const PluginLayerChromium::Program* pluginLayerProgram() const { return m_pluginLayerProgram.get(); }
     const RenderSurfaceChromium::Program* renderSurfaceProgram() const { return m_renderSurfaceProgram.get(); }
     const RenderSurfaceChromium::MaskProgram* renderSurfaceMaskProgram() const { return m_renderSurfaceMaskProgram.get(); }
     const LayerTilerChromium::Program* tilerProgram() const { return m_tilerProgram.get(); }
+    const CCCanvasLayerImpl::Program* canvasLayerProgram() const { return m_canvasLayerProgram.get(); }
+    const CCPluginLayerImpl::Program* pluginLayerProgram() const { return m_pluginLayerProgram.get(); }
+    const CCVideoLayerImpl::RGBAProgram* videoLayerRGBAProgram() const { return m_videoLayerRGBAProgram.get(); }
+    const CCVideoLayerImpl::YUVProgram* videoLayerYUVProgram() const { return m_videoLayerYUVProgram.get(); }
 
     void resizeOnscreenContent(const IntSize&);
 
@@ -132,19 +132,21 @@ public:
     String layerTreeAsText() const;
 
 private:
-    explicit LayerRendererChromium(PassRefPtr<GraphicsContext3D> graphicsContext3D);
+    explicit LayerRendererChromium(PassRefPtr<GraphicsContext3D>, PassOwnPtr<TilePaintInterface> contentPaint, PassOwnPtr<TilePaintInterface> scrollbarPaint);
 
-    void updateLayers(const IntRect& visibleRect, const IntRect& contentRect, const IntPoint& scrollPosition,
-                     Vector<CCLayerImpl*>& renderSurfaceLayerList);
-    void updateRootLayerContents(TilePaintInterface&, const IntRect& visibleRect);
-    void updateRootLayerScrollbars(TilePaintInterface& scrollbarPaint, const IntRect& visibleRect, const IntRect& contentRect);
+    void updateLayers(Vector<CCLayerImpl*>& renderSurfaceLayerList);
+    void updateRootLayerContents();
+    void updateRootLayerScrollbars();
     void updatePropertiesAndRenderSurfaces(LayerChromium*, const TransformationMatrix& parentMatrix, Vector<CCLayerImpl*>& renderSurfaceLayerList, Vector<CCLayerImpl*>& layerList);
-    void updateContentsRecursive(LayerChromium*);
+    void paintContentsRecursive(LayerChromium*);
+    void updateCompositorResourcesRecursive(LayerChromium*);
 
     void drawLayers(const Vector<CCLayerImpl*>& renderSurfaceLayerList);
     void drawLayer(CCLayerImpl*, RenderSurfaceChromium*);
 
     void drawRootLayer();
+    LayerTexture* getOffscreenLayerTexture();
+    void copyOffscreenTextureToDisplay();
 
     bool isLayerVisible(LayerChromium*, const TransformationMatrix&, const IntRect& visibleRect);
 
@@ -161,19 +163,22 @@ private:
     bool initializeSharedObjects();
     void cleanupSharedObjects();
 
-    static IntRect verticalScrollbarRect(const IntRect& visibleRect, const IntRect& contentRect);
-    static IntRect horizontalScrollbarRect(const IntRect& visibleRect, const IntRect& contentRect);
+    IntRect verticalScrollbarRect() const;
+    IntRect horizontalScrollbarRect() const;
 
-    IntRect m_visibleRect;
+    IntRect m_viewportVisibleRect;
+    IntRect m_viewportContentRect;
+    IntPoint m_viewportScrollPosition;
 
     TransformationMatrix m_projectionMatrix;
 
     RefPtr<LayerChromium> m_rootLayer;
-    OwnPtr<LayerTilerChromium> m_rootLayerTiler;
+    OwnPtr<TilePaintInterface> m_rootLayerContentPaint;
+    OwnPtr<TilePaintInterface> m_rootLayerScrollbarPaint;
+    OwnPtr<LayerTilerChromium> m_rootLayerContentTiler;
     OwnPtr<LayerTilerChromium> m_horizontalScrollbarTiler;
     OwnPtr<LayerTilerChromium> m_verticalScrollbarTiler;
 
-    IntPoint m_scrollPosition;
     bool m_hardwareCompositing;
 
     unsigned m_currentShader;
@@ -202,13 +207,13 @@ private:
     OwnPtr<GeometryBinding> m_sharedGeometry;
     OwnPtr<LayerChromium::BorderProgram> m_borderProgram;
     OwnPtr<ContentLayerChromium::Program> m_contentLayerProgram;
-    OwnPtr<CanvasLayerChromium::Program> m_canvasLayerProgram;
-    OwnPtr<VideoLayerChromium::RGBAProgram> m_videoLayerRGBAProgram;
-    OwnPtr<VideoLayerChromium::YUVProgram> m_videoLayerYUVProgram;
-    OwnPtr<PluginLayerChromium::Program> m_pluginLayerProgram;
     OwnPtr<RenderSurfaceChromium::Program> m_renderSurfaceProgram;
     OwnPtr<RenderSurfaceChromium::MaskProgram> m_renderSurfaceMaskProgram;
     OwnPtr<LayerTilerChromium::Program> m_tilerProgram;
+    OwnPtr<CCCanvasLayerImpl::Program> m_canvasLayerProgram;
+    OwnPtr<CCVideoLayerImpl::RGBAProgram> m_videoLayerRGBAProgram;
+    OwnPtr<CCVideoLayerImpl::YUVProgram> m_videoLayerYUVProgram;
+    OwnPtr<CCPluginLayerImpl::Program> m_pluginLayerProgram;
 
     OwnPtr<TextureManager> m_textureManager;
 
diff --git a/Source/WebCore/platform/graphics/chromium/LayerTilerChromium.cpp b/Source/WebCore/platform/graphics/chromium/LayerTilerChromium.cpp
index 86592a6..bc37201 100644
--- a/Source/WebCore/platform/graphics/chromium/LayerTilerChromium.cpp
+++ b/Source/WebCore/platform/graphics/chromium/LayerTilerChromium.cpp
@@ -34,6 +34,7 @@
 #include "GraphicsContext3D.h"
 #include "LayerRendererChromium.h"
 #include "LayerTexture.h"
+#include "TraceEvent.h"
 
 #include <wtf/PassOwnArrayPtr.h>
 
@@ -84,58 +85,50 @@ void LayerTilerChromium::reset()
 {
     m_tiles.clear();
     m_unusedTiles.clear();
-
     m_tilingData.setTotalSize(0, 0);
-    m_lastUpdateLayerRect = IntRect();
 }
 
 LayerTilerChromium::Tile* LayerTilerChromium::createTile(int i, int j)
 {
-    const int index = tileIndex(i, j);
-    ASSERT(!m_tiles[index]);
+    ASSERT(!tileAt(i, j));
 
+    RefPtr<Tile> tile;
     if (m_unusedTiles.size() > 0) {
-        m_tiles[index] = m_unusedTiles.last().release();
+        tile = m_unusedTiles.last().release();
         m_unusedTiles.removeLast();
+        ASSERT(tile->refCount() == 1);
     } else {
         GraphicsContext3D* context = layerRendererContext();
         TextureManager* manager = layerRenderer()->textureManager();
-        OwnPtr<Tile> tile = adoptPtr(new Tile(LayerTexture::create(context, manager)));
-        m_tiles[index] = tile.release();
+        tile = adoptRef(new Tile(LayerTexture::create(context, manager)));
     }
+    m_tiles.add(make_pair(i, j), tile);
+
+    tile->moveTo(i, j);
+    tile->m_dirtyLayerRect = tileLayerRect(tile.get());
 
-    m_tiles[index]->m_dirtyLayerRect = tileLayerRect(i, j);
-    return m_tiles[index].get();
+    return tile.get();
 }
 
-void LayerTilerChromium::invalidateTiles(const IntRect& oldLayerRect, const IntRect& newLayerRect)
+void LayerTilerChromium::invalidateTiles(const IntRect& contentRect)
 {
     if (!m_tiles.size())
         return;
 
-    IntRect oldContentRect = layerRectToContentRect(oldLayerRect);
-    int oldLeft, oldTop, oldRight, oldBottom;
-    contentRectToTileIndices(oldContentRect, oldLeft, oldTop, oldRight, oldBottom);
-
-    IntRect newContentRect = layerRectToContentRect(newLayerRect);
-    int newLeft, newTop, newRight, newBottom;
-    contentRectToTileIndices(newContentRect, newLeft, newTop, newRight, newBottom);
-
-    // Iterating through just the old tile indices is an optimization to avoid
-    // iterating through the entire m_tiles array.
-    for (int j = oldTop; j <= oldBottom; ++j) {
-        for (int i = oldLeft; i <= oldRight; ++i) {
-            if (i >= newLeft && i <= newRight && j >= newTop && j <= newBottom)
-                continue;
-
-            const int index = tileIndex(i, j);
-            if (m_tiles[index])
-                m_unusedTiles.append(m_tiles[index].release());
-        }
+    Vector<TileMapKey> removeKeys;
+    for (TileMap::iterator iter = m_tiles.begin(); iter != m_tiles.end(); ++iter) {
+        Tile* tile = iter->second.get();
+        IntRect tileRect = tileContentRect(tile);
+        if (tileRect.intersects(contentRect))
+            continue;
+        removeKeys.append(iter->first);
     }
+
+    for (size_t i = 0; i < removeKeys.size(); ++i)
+        m_unusedTiles.append(m_tiles.take(removeKeys[i]));
 }
 
-void LayerTilerChromium::contentRectToTileIndices(const IntRect& contentRect, int &left, int &top, int &right, int &bottom) const
+void LayerTilerChromium::contentRectToTileIndices(const IntRect& contentRect, int& left, int& top, int& right, int& bottom) const
 {
     const IntRect layerRect = contentRectToLayerRect(contentRect);
 
@@ -163,36 +156,28 @@ IntRect LayerTilerChromium::layerRectToContentRect(const IntRect& layerRect) con
     return contentRect;
 }
 
-int LayerTilerChromium::tileIndex(int i, int j) const
+LayerTilerChromium::Tile* LayerTilerChromium::tileAt(int i, int j) const
 {
-    return m_tilingData.tileIndex(i, j);
+    Tile* tile = m_tiles.get(make_pair(i, j)).get();
+    ASSERT(!tile || tile->refCount() == 1);
+    return tile;
 }
 
-IntRect LayerTilerChromium::tileContentRect(int i, int j) const
+IntRect LayerTilerChromium::tileContentRect(const Tile* tile) const
 {
-    IntRect contentRect = tileLayerRect(i, j);
+    IntRect contentRect = tileLayerRect(tile);
     contentRect.move(m_layerPosition.x(), m_layerPosition.y());
     return contentRect;
 }
 
-IntRect LayerTilerChromium::tileLayerRect(int i, int j) const
+IntRect LayerTilerChromium::tileLayerRect(const Tile* tile) const
 {
-    const int index = m_tilingData.tileIndex(i, j);
+    const int index = m_tilingData.tileIndex(tile->i(), tile->j());
     IntRect layerRect = m_tilingData.tileBoundsWithBorder(index);
     layerRect.setSize(m_tileSize);
     return layerRect;
 }
 
-IntSize LayerTilerChromium::layerSize() const
-{
-    return IntSize(m_tilingData.totalSizeX(), m_tilingData.totalSizeY());
-}
-
-IntSize LayerTilerChromium::layerTileSize() const
-{
-    return IntSize(m_tilingData.numTilesX(), m_tilingData.numTilesY());
-}
-
 void LayerTilerChromium::invalidateRect(const IntRect& contentRect)
 {
     if (contentRect.isEmpty())
@@ -202,16 +187,16 @@ void LayerTilerChromium::invalidateRect(const IntRect& contentRect)
 
     // Dirty rects are always in layer space, as the layer could be repositioned
     // after invalidation.
-    IntRect layerRect = contentRectToLayerRect(contentRect);
+    const IntRect layerRect = contentRectToLayerRect(contentRect);
 
     int left, top, right, bottom;
     contentRectToTileIndices(contentRect, left, top, right, bottom);
     for (int j = top; j <= bottom; ++j) {
         for (int i = left; i <= right; ++i) {
-            Tile* tile = m_tiles[tileIndex(i, j)].get();
+            Tile* tile = tileAt(i, j);
             if (!tile)
                 continue;
-            IntRect bound = tileLayerRect(i, j);
+            IntRect bound = tileLayerRect(tile);
             bound.intersect(layerRect);
             tile->m_dirtyLayerRect.unite(bound);
         }
@@ -220,14 +205,13 @@ void LayerTilerChromium::invalidateRect(const IntRect& contentRect)
 
 void LayerTilerChromium::invalidateEntireLayer()
 {
-    for (size_t i = 0; i < m_tiles.size(); ++i) {
-        if (m_tiles[i])
-            m_unusedTiles.append(m_tiles[i].release());
+    for (TileMap::iterator iter = m_tiles.begin(); iter != m_tiles.end(); ++iter) {
+        ASSERT(iter->second->refCount() == 1);
+        m_unusedTiles.append(iter->second.release());
     }
     m_tiles.clear();
 
     m_tilingData.setTotalSize(0, 0);
-    m_lastUpdateLayerRect = IntRect();
 }
 
 void LayerTilerChromium::update(TilePaintInterface& painter, const IntRect& contentRect)
@@ -237,10 +221,7 @@ void LayerTilerChromium::update(TilePaintInterface& painter, const IntRect& cont
 
     // Invalidate old tiles that were previously used but aren't in use this
     // frame so that they can get reused for new tiles.
-    IntRect layerRect = contentRectToLayerRect(contentRect);
-    invalidateTiles(m_lastUpdateLayerRect, layerRect);
-    m_lastUpdateLayerRect = layerRect;
-
+    invalidateTiles(contentRect);
     growLayerToContain(contentRect);
 
     // Create tiles as needed, expanding a dirty rect to contain all
@@ -250,11 +231,11 @@ void LayerTilerChromium::update(TilePaintInterface& painter, const IntRect& cont
     contentRectToTileIndices(contentRect, left, top, right, bottom);
     for (int j = top; j <= bottom; ++j) {
         for (int i = left; i <= right; ++i) {
-            Tile* tile = m_tiles[tileIndex(i, j)].get();
+            Tile* tile = tileAt(i, j);
             if (!tile)
                 tile = createTile(i, j);
             if (!tile->texture()->isValid(m_tileSize, GraphicsContext3D::RGBA))
-                tile->m_dirtyLayerRect = tileLayerRect(i, j);
+                tile->m_dirtyLayerRect = tileLayerRect(tile);
             dirtyLayerRect.unite(tile->m_dirtyLayerRect);
         }
     }
@@ -267,10 +248,16 @@ void LayerTilerChromium::update(TilePaintInterface& painter, const IntRect& cont
     m_canvas.resize(paintRect.size());
     PlatformCanvas::Painter canvasPainter(&m_canvas);
     canvasPainter.context()->translate(-paintRect.x(), -paintRect.y());
-    painter.paint(*canvasPainter.context(), paintRect);
+    {
+        TRACE_EVENT("LayerTilerChromium::update::paint", this, 0);
+        painter.paint(*canvasPainter.context(), paintRect);
+    }
 
     PlatformCanvas::AutoLocker locker(&m_canvas);
-    updateFromPixels(paintRect, locker.pixels());
+    {
+        TRACE_EVENT("LayerTilerChromium::updateFromPixels", this, 0);
+        updateFromPixels(paintRect, locker.pixels());
+    }
 }
 
 void LayerTilerChromium::updateFromPixels(const IntRect& paintRect, const uint8_t* paintPixels)
@@ -285,14 +272,14 @@ void LayerTilerChromium::updateFromPixels(const IntRect& paintRect, const uint8_
     contentRectToTileIndices(paintRect, left, top, right, bottom);
     for (int j = top; j <= bottom; ++j) {
         for (int i = left; i <= right; ++i) {
-            Tile* tile = m_tiles[tileIndex(i, j)].get();
+            Tile* tile = tileAt(i, j);
             if (!tile)
                 CRASH();
             if (!tile->dirty())
                 continue;
 
             // Calculate page-space rectangle to copy from.
-            IntRect sourceRect = tileContentRect(i, j);
+            IntRect sourceRect = tileContentRect(tile);
             const IntPoint anchor = sourceRect.location();
             sourceRect.intersect(layerRectToContentRect(tile->m_dirtyLayerRect));
             if (sourceRect.isEmpty())
@@ -366,8 +353,7 @@ void LayerTilerChromium::draw(const IntRect& contentRect)
     contentRectToTileIndices(contentRect, left, top, right, bottom);
     for (int j = top; j <= bottom; ++j) {
         for (int i = left; i <= right; ++i) {
-            const int index = tileIndex(i, j);
-            Tile* tile = m_tiles[index].get();
+            Tile* tile = tileAt(i, j);
             ASSERT(tile);
 
             tile->texture()->bindTexture();
@@ -376,11 +362,11 @@ void LayerTilerChromium::draw(const IntRect& contentRect)
 
             // Don't use tileContentRect here, as that contains the full
             // rect with border texels which shouldn't be drawn.
-            IntRect tileRect = m_tilingData.tileBounds(index);
+            IntRect tileRect = m_tilingData.tileBounds(m_tilingData.tileIndex(tile->i(), tile->j()));
             tileRect.move(m_layerPosition.x(), m_layerPosition.y());
             tileMatrix.translate3d(tileRect.x() - contentRect.x() + tileRect.width() / 2.0, tileRect.y() - contentRect.y() + tileRect.height() / 2.0, 0);
 
-            IntPoint texOffset = m_tilingData.textureOffset(i, j);
+            IntPoint texOffset = m_tilingData.textureOffset(tile->i(), tile->j());
             float tileWidth = static_cast<float>(m_tileSize.width());
             float tileHeight = static_cast<float>(m_tileSize.height());
             float texTranslateX = texOffset.x() / tileWidth;
@@ -395,37 +381,15 @@ void LayerTilerChromium::draw(const IntRect& contentRect)
     }
 }
 
-void LayerTilerChromium::resizeLayer(const IntSize& size)
-{
-    if (layerSize() == size)
-        return;
-
-    const IntSize oldTileSize = layerTileSize();
-    m_tilingData.setTotalSize(size.width(), size.height());
-    const IntSize newTileSize = layerTileSize();
-
-    if (oldTileSize == newTileSize)
-        return;
-
-    if (newTileSize.height() && (newTileSize.width() > INT_MAX / newTileSize.height()))
-        CRASH();
-
-    Vector<OwnPtr<Tile> > newTiles;
-    newTiles.resize(newTileSize.width() * newTileSize.height());
-    for (int j = 0; j < oldTileSize.height(); ++j)
-        for (int i = 0; i < oldTileSize.width(); ++i)
-            newTiles[i + j * newTileSize.width()].swap(m_tiles[i + j * oldTileSize.width()]);
-    m_tiles.swap(newTiles);
-}
-
 void LayerTilerChromium::growLayerToContain(const IntRect& contentRect)
 {
     // Grow the tile array to contain this content rect.
     IntRect layerRect = contentRectToLayerRect(contentRect);
     IntSize rectSize = IntSize(layerRect.maxX(), layerRect.maxY());
 
-    IntSize newSize = rectSize.expandedTo(layerSize());
-    resizeLayer(newSize);
+    IntSize oldLayerSize(m_tilingData.totalSizeX(), m_tilingData.totalSizeY());
+    IntSize newSize = rectSize.expandedTo(oldLayerSize);
+    m_tilingData.setTotalSize(newSize.width(), newSize.height());
 }
 
 void LayerTilerChromium::drawTexturedQuad(GraphicsContext3D* context, const TransformationMatrix& projectionMatrix, const TransformationMatrix& drawMatrix,
diff --git a/Source/WebCore/platform/graphics/chromium/LayerTilerChromium.h b/Source/WebCore/platform/graphics/chromium/LayerTilerChromium.h
index bdb35a5..2f356e4 100644
--- a/Source/WebCore/platform/graphics/chromium/LayerTilerChromium.h
+++ b/Source/WebCore/platform/graphics/chromium/LayerTilerChromium.h
@@ -33,7 +33,9 @@
 #include "LayerTexture.h"
 #include "PlatformCanvas.h"
 #include "TilingData.h"
+#include <wtf/HashTraits.h>
 #include <wtf/OwnArrayPtr.h>
+#include <wtf/RefCounted.h>
 
 namespace WebCore {
 
@@ -70,20 +72,26 @@ public:
 private:
     LayerTilerChromium(LayerRendererChromium*, const IntSize& tileSize, BorderTexelOption);
 
-    class Tile {
+    class Tile : public RefCounted<Tile> {
         WTF_MAKE_NONCOPYABLE(Tile);
     public:
-        explicit Tile(PassOwnPtr<LayerTexture> tex) : m_tex(tex) {}
+        explicit Tile(PassOwnPtr<LayerTexture> tex) : m_tex(tex), m_i(-1), m_j(-1) {}
 
         LayerTexture* texture() { return m_tex.get(); }
 
         bool dirty() const { return !m_dirtyLayerRect.isEmpty(); }
         void clearDirty() { m_dirtyLayerRect = IntRect(); }
 
+        int i() const { return m_i; }
+        int j() const { return m_j; }
+        void moveTo(int i, int j) { m_i = i; m_j = j; }
+
         // Layer-space dirty rectangle that needs to be repainted.
         IntRect m_dirtyLayerRect;
     private:
         OwnPtr<LayerTexture> m_tex;
+        int m_i;
+        int m_j;
     };
 
     void drawTexturedQuad(GraphicsContext3D*, const TransformationMatrix& projectionMatrix, const TransformationMatrix& drawMatrix,
@@ -92,40 +100,45 @@ private:
                           float texScaleX, float texScaleY,
                           const LayerTilerChromium::Program*);
 
-    void resizeLayer(const IntSize& size);
     // Grow layer size to contain this rectangle.
     void growLayerToContain(const IntRect& contentRect);
 
     LayerRendererChromium* layerRenderer() const { return m_layerRenderer; }
     GraphicsContext3D* layerRendererContext() const;
     Tile* createTile(int i, int j);
-    // Invalidate any tiles which do not intersect with the newLayerRect.
-    void invalidateTiles(const IntRect& oldLayerRect, const IntRect& newLayerRect);
+    // Invalidate any tiles which do not intersect with the contentRect
+    void invalidateTiles(const IntRect& contentRect);
     void reset();
     void contentRectToTileIndices(const IntRect& contentRect, int &left, int &top, int &right, int &bottom) const;
     IntRect contentRectToLayerRect(const IntRect& contentRect) const;
     IntRect layerRectToContentRect(const IntRect& layerRect) const;
 
-    // Returns the index into m_tiles for a given tile location.
-    int tileIndex(int i, int j) const;
-    // Returns the bounds in content space for a given tile location.
-    IntRect tileContentRect(int i, int j) const;
-    // Returns the bounds in layer space for a given tile location.
-    IntRect tileLayerRect(int i, int j) const;
-
-    IntSize layerSize() const;
-    IntSize layerTileSize() const;
+    Tile* tileAt(int, int) const;
+    IntRect tileContentRect(const Tile*) const;
+    IntRect tileLayerRect(const Tile*) const;
 
     IntSize m_tileSize;
-    IntRect m_lastUpdateLayerRect;
     IntPoint m_layerPosition;
 
     bool m_skipsDraw;
 
-    // Logical 2D array of tiles (dimensions of m_layerTileSize)
-    Vector<OwnPtr<Tile> > m_tiles;
-    // Linear array of unused tiles.
-    Vector<OwnPtr<Tile> > m_unusedTiles;
+    // Default hash key traits for integers disallow 0 and -1 as a key, so
+    // use a custom hash trait which disallows -1 and -2 instead.
+    typedef std::pair<int, int> TileMapKey;
+    struct TileMapKeyTraits : HashTraits<TileMapKey> {
+        static const bool emptyValueIsZero = false;
+        static const bool needsDestruction = false;
+        static TileMapKey emptyValue() { return std::make_pair(-1, -1); }
+        static void constructDeletedValue(TileMapKey& slot) { slot = std::make_pair(-2, -2); }
+        static bool isDeletedValue(TileMapKey value) { return value.first == -2 && value.second == -2; }
+    };
+    // FIXME: The mapped value in TileMap should really be an OwnPtr, as the
+    // refcount of a Tile should never be more than 1. However, HashMap
+    // doesn't easily support OwnPtr as a value.
+    typedef HashMap<TileMapKey, RefPtr<Tile>, DefaultHash<TileMapKey>::Hash, TileMapKeyTraits> TileMap;
+    TileMap m_tiles;
+    // Tightly packed set of unused tiles.
+    Vector<RefPtr<Tile> > m_unusedTiles;
 
     PlatformCanvas m_canvas;
 
diff --git a/Source/WebCore/platform/graphics/chromium/PluginLayerChromium.cpp b/Source/WebCore/platform/graphics/chromium/PluginLayerChromium.cpp
index 5d595ad..3667fbb 100644
--- a/Source/WebCore/platform/graphics/chromium/PluginLayerChromium.cpp
+++ b/Source/WebCore/platform/graphics/chromium/PluginLayerChromium.cpp
@@ -29,10 +29,10 @@
 
 #include "PluginLayerChromium.h"
 
-#include "cc/CCLayerImpl.h"
 #include "GraphicsContext3D.h"
 #include "LayerRendererChromium.h"
-#include <GLES2/gl2.h>
+#include "cc/CCLayerImpl.h"
+#include "cc/CCPluginLayerImpl.h"
 
 namespace WebCore {
 
@@ -43,40 +43,26 @@ PassRefPtr<PluginLayerChromium> PluginLayerChromium::create(GraphicsLayerChromiu
 
 PluginLayerChromium::PluginLayerChromium(GraphicsLayerChromium* owner)
     : LayerChromium(owner)
+    , m_textureId(0)
 {
 }
 
-void PluginLayerChromium::setTextureId(unsigned id)
+PassRefPtr<CCLayerImpl> PluginLayerChromium::createCCLayerImpl()
 {
-    m_textureId = id;
+    return CCPluginLayerImpl::create(this);
 }
 
-void PluginLayerChromium::updateContentsIfDirty()
+void PluginLayerChromium::setTextureId(unsigned id)
 {
+    m_textureId = id;
 }
 
-void PluginLayerChromium::draw()
+void PluginLayerChromium::pushPropertiesTo(CCLayerImpl* layer)
 {
-    ASSERT(layerRenderer());
-    const PluginLayerChromium::Program* program = layerRenderer()->pluginLayerProgram();
-    ASSERT(program && program->initialized());
-    GraphicsContext3D* context = layerRendererContext();
-    GLC(context, context->activeTexture(GL_TEXTURE0));
-    GLC(context, context->bindTexture(GL_TEXTURE_2D, m_textureId));
-    
-    // FIXME: setting the texture parameters every time is redundant. Move this code somewhere
-    // where it will only happen once per texture.
-    GLC(context, context->texParameteri(GL_TEXTURE_2D, GL_TEXTURE_MIN_FILTER, GL_LINEAR));
-    GLC(context, context->texParameteri(GL_TEXTURE_2D, GL_TEXTURE_MAG_FILTER, GL_LINEAR));
-    GLC(context, context->texParameteri(GL_TEXTURE_2D, GL_TEXTURE_WRAP_S, GL_CLAMP_TO_EDGE));
-    GLC(context, context->texParameteri(GL_TEXTURE_2D, GL_TEXTURE_WRAP_T, GL_CLAMP_TO_EDGE));
-    
-    layerRenderer()->useShader(program->program());
-    GLC(context, context->uniform1i(program->fragmentShader().samplerLocation(), 0));
-    drawTexturedQuad(context, layerRenderer()->projectionMatrix(), ccLayerImpl()->drawTransform(),
-                     bounds().width(), bounds().height(), ccLayerImpl()->drawOpacity(),
-                     program->vertexShader().matrixLocation(),
-                     program->fragmentShader().alphaLocation());
+    LayerChromium::pushPropertiesTo(layer);
+
+    CCPluginLayerImpl* pluginLayer = static_cast<CCPluginLayerImpl*>(layer);
+    pluginLayer->setTextureId(m_textureId);
 }
 
 }
diff --git a/Source/WebCore/platform/graphics/chromium/PluginLayerChromium.h b/Source/WebCore/platform/graphics/chromium/PluginLayerChromium.h
index 8d66f5f..852dc2e 100644
--- a/Source/WebCore/platform/graphics/chromium/PluginLayerChromium.h
+++ b/Source/WebCore/platform/graphics/chromium/PluginLayerChromium.h
@@ -38,18 +38,19 @@ class PluginLayerChromium : public LayerChromium {
 public:
     static PassRefPtr<PluginLayerChromium> create(GraphicsLayerChromium* owner = 0);
     virtual bool drawsContent() const { return true; }
-    virtual void updateContentsIfDirty();
-    virtual void draw();
-    
+
+    virtual PassRefPtr<CCLayerImpl> createCCLayerImpl();
+
     void setTextureId(unsigned textureId);
-        
-    typedef ProgramBinding<VertexShaderPosTex, FragmentShaderRGBATexFlipAlpha> Program;
+    unsigned textureId() const { return m_textureId; }
+
+    virtual void pushPropertiesTo(CCLayerImpl*);
 
 protected:
     virtual const char* layerTypeAsString() const { return "PluginLayer"; }
 
 private:
-    PluginLayerChromium(GraphicsLayerChromium* owner);
+    explicit PluginLayerChromium(GraphicsLayerChromium* owner);
     unsigned m_textureId;
 };
 
diff --git a/Source/WebCore/platform/graphics/chromium/ShaderChromium.cpp b/Source/WebCore/platform/graphics/chromium/ShaderChromium.cpp
index 49b3462..b7f447b 100644
--- a/Source/WebCore/platform/graphics/chromium/ShaderChromium.cpp
+++ b/Source/WebCore/platform/graphics/chromium/ShaderChromium.cpp
@@ -248,7 +248,7 @@ FragmentShaderYUVVideo::FragmentShaderYUVVideo()
     , m_vTextureLocation(-1)
     , m_alphaLocation(-1)
     , m_ccMatrixLocation(-1)
-    , m_signAdjLocation(-1)
+    , m_yuvAdjLocation(-1)
 {
 }
 
@@ -259,10 +259,10 @@ bool FragmentShaderYUVVideo::init(GraphicsContext3D* context, unsigned program)
     m_vTextureLocation = context->getUniformLocation(program, "v_texture");
     m_alphaLocation = context->getUniformLocation(program, "alpha");
     m_ccMatrixLocation = context->getUniformLocation(program, "cc_matrix");
-    m_signAdjLocation = context->getUniformLocation(program, "adj");
+    m_yuvAdjLocation = context->getUniformLocation(program, "yuv_adj");
 
     return m_yTextureLocation != -1 && m_uTextureLocation != -1 && m_vTextureLocation != -1
-           && m_alphaLocation != -1 && m_ccMatrixLocation != -1 && m_signAdjLocation != -1;
+           && m_alphaLocation != -1 && m_ccMatrixLocation != -1 && m_yuvAdjLocation != -1;
 }
 
 String FragmentShaderYUVVideo::getShaderString() const
@@ -276,14 +276,15 @@ String FragmentShaderYUVVideo::getShaderString() const
         uniform sampler2D u_texture;
         uniform sampler2D v_texture;
         uniform float alpha;
-        uniform float adj;
+        uniform vec3 yuv_adj;
         uniform mat3 cc_matrix;
         void main()
         {
-            float y = texture2D(y_texture, y_texCoord).x;
-            float u = texture2D(u_texture, uv_texCoord).x - adj;
-            float v = texture2D(v_texture, uv_texCoord).x - adj;
-            vec3 rgb = cc_matrix * vec3(y, u, v);
+            float y_raw = texture2D(y_texture, y_texCoord).x;
+            float u_unsigned = texture2D(u_texture, uv_texCoord).x;
+            float v_unsigned = texture2D(v_texture, uv_texCoord).x;
+            vec3 yuv = vec3(y_raw, u_unsigned, v_unsigned) + yuv_adj;
+            vec3 rgb = cc_matrix * yuv;
             gl_FragColor = vec4(rgb, float(1)) * alpha;
         }
     );
diff --git a/Source/WebCore/platform/graphics/chromium/ShaderChromium.h b/Source/WebCore/platform/graphics/chromium/ShaderChromium.h
index 758c62b..3a3e175 100644
--- a/Source/WebCore/platform/graphics/chromium/ShaderChromium.h
+++ b/Source/WebCore/platform/graphics/chromium/ShaderChromium.h
@@ -158,7 +158,7 @@ public:
     int vTextureLocation() const { return m_vTextureLocation; }
     int alphaLocation() const { return m_alphaLocation; }
     int ccMatrixLocation() const { return m_ccMatrixLocation; }
-    int signAdjLocation() const { return m_signAdjLocation; }
+    int yuvAdjLocation() const { return m_yuvAdjLocation; }
 
 private:
     int m_yTextureLocation;
@@ -166,7 +166,7 @@ private:
     int m_vTextureLocation;
     int m_alphaLocation;
     int m_ccMatrixLocation;
-    int m_signAdjLocation;
+    int m_yuvAdjLocation;
 };
 
 class FragmentShaderColor {
diff --git a/Source/WebCore/platform/graphics/chromium/SimpleFontDataLinux.cpp b/Source/WebCore/platform/graphics/chromium/SimpleFontDataLinux.cpp
index 9423d1e..7cd47fe 100644
--- a/Source/WebCore/platform/graphics/chromium/SimpleFontDataLinux.cpp
+++ b/Source/WebCore/platform/graphics/chromium/SimpleFontDataLinux.cpp
@@ -113,13 +113,13 @@ void SimpleFontData::platformInit()
     m_fontMetrics.setXHeight(xHeight);
     m_fontMetrics.setLineSpacing(lroundf(ascent) + lroundf(descent) + lroundf(lineGap));
 
-    if (m_orientation == Vertical) {
+    if (platformData().orientation() == Vertical && !isTextOrientationFallback()) {
         static const uint32_t vheaTag = SkSetFourByteTag('v', 'h', 'e', 'a');
         static const uint32_t vorgTag = SkSetFourByteTag('V', 'O', 'R', 'G');
         size_t vheaSize = SkFontHost::GetTableSize(fontID, vheaTag);
         size_t vorgSize = SkFontHost::GetTableSize(fontID, vorgTag);
-        if ((vheaSize <= 0) && (vorgSize <= 0))
-            m_orientation = Horizontal;
+        if ((vheaSize > 0) || (vorgSize > 0))
+            m_hasVerticalGlyphs = true;
     }
 
     // In WebKit/WebCore/platform/graphics/SimpleFontData.cpp, m_spaceWidth is
diff --git a/Source/WebCore/platform/graphics/chromium/VideoLayerChromium.cpp b/Source/WebCore/platform/graphics/chromium/VideoLayerChromium.cpp
index 5d7a6e7..182e730 100644
--- a/Source/WebCore/platform/graphics/chromium/VideoLayerChromium.cpp
+++ b/Source/WebCore/platform/graphics/chromium/VideoLayerChromium.cpp
@@ -33,7 +33,6 @@
 #if USE(ACCELERATED_COMPOSITING)
 #include "VideoLayerChromium.h"
 
-#include "cc/CCLayerImpl.h"
 #include "Extensions3DChromium.h"
 #include "GraphicsContext3D.h"
 #include "LayerRendererChromium.h"
@@ -41,17 +40,11 @@
 #include "RenderLayerBacking.h"
 #include "VideoFrameChromium.h"
 #include "VideoFrameProvider.h"
+#include "cc/CCLayerImpl.h"
+#include "cc/CCVideoLayerImpl.h"
 
 namespace WebCore {
 
-// These values are magic numbers that are used in the transformation
-// from YUV to RGB color values.
-const float VideoLayerChromium::yuv2RGB[9] = {
-    1.f, 1.f, 1.f,
-    0.f, -.344f, 1.772f,
-    1.403f, -.714f, 0.f,
-};
-
 PassRefPtr<VideoLayerChromium> VideoLayerChromium::create(GraphicsLayerChromium* owner,
                                                           VideoFrameProvider* provider)
 {
@@ -71,23 +64,37 @@ VideoLayerChromium::VideoLayerChromium(GraphicsLayerChromium* owner, VideoFrameP
 VideoLayerChromium::~VideoLayerChromium()
 {
     cleanupResources();
+    deleteTexturesInUse();
 }
 
-void VideoLayerChromium::cleanupResources()
+PassRefPtr<CCLayerImpl> VideoLayerChromium::createCCLayerImpl()
+{
+    return CCVideoLayerImpl::create(this);
+}
+
+void VideoLayerChromium::deleteTexturesInUse()
 {
-    LayerChromium::cleanupResources();
-    releaseCurrentFrame();
     if (!layerRenderer())
         return;
 
     GraphicsContext3D* context = layerRendererContext();
     for (unsigned plane = 0; plane < VideoFrameChromium::maxPlanes; plane++) {
-        if (m_textures[plane])
-            GLC(context, context->deleteTexture(m_textures[plane]));
+        Texture texture = m_textures[plane];
+        if (!texture.isEmpty && texture.ownedByLayerRenderer)
+            GLC(context, context->deleteTexture(texture.id));
     }
 }
 
-void VideoLayerChromium::updateContentsIfDirty()
+void VideoLayerChromium::cleanupResources()
+{
+    LayerChromium::cleanupResources();
+    if (m_currentFrame)
+        releaseCurrentFrame();
+    else
+        resetFrameParameters();
+}
+
+void VideoLayerChromium::updateCompositorResources()
 {
     if (!m_contentsDirty)
         return;
@@ -116,6 +123,9 @@ void VideoLayerChromium::updateContentsIfDirty()
         return;
     }
 
+    // If the incoming frame is backed by a texture (i.e. decoded in hardware),
+    // then we do not need to allocate a texture via the layer renderer. Instead
+    // we save the texture data then exit.
     if (frame->surfaceType() == VideoFrameChromium::TypeTexture) {
         releaseCurrentFrame();
         saveCurrentFrame(frame);
@@ -136,8 +146,9 @@ void VideoLayerChromium::updateContentsIfDirty()
 
     // Update texture planes.
     for (unsigned plane = 0; plane < frame->planes(); plane++) {
-        ASSERT(frame->requiredTextureSize(plane) == m_textureSizes[plane]);
-        updateTexture(context, m_textures[plane], frame->requiredTextureSize(plane), textureFormat, frame->data(plane));
+        Texture texture = m_textures[plane];
+        ASSERT(frame->requiredTextureSize(plane) == texture.size);
+        updateTexture(context, texture.id, texture.size, textureFormat, frame->data(plane));
     }
 
     m_dirtyRect.setSize(FloatSize());
@@ -146,7 +157,19 @@ void VideoLayerChromium::updateContentsIfDirty()
     m_provider->putCurrentFrame(frame);
 }
 
-unsigned VideoLayerChromium::determineTextureFormat(VideoFrameChromium* frame)
+void VideoLayerChromium::pushPropertiesTo(CCLayerImpl* layer)
+{
+    LayerChromium::pushPropertiesTo(layer);
+
+    CCVideoLayerImpl* videoLayer = static_cast<CCVideoLayerImpl*>(layer);
+    videoLayer->setSkipsDraw(m_skipsDraw);
+    videoLayer->setFrameFormat(m_frameFormat);
+    for (size_t i = 0; i < 3; ++i)
+        videoLayer->setTexture(i, m_textures[i]);
+}
+
+
+unsigned VideoLayerChromium::determineTextureFormat(const VideoFrameChromium* frame)
 {
     switch (frame->format()) {
     case VideoFrameChromium::YV12:
@@ -160,56 +183,68 @@ unsigned VideoLayerChromium::determineTextureFormat(VideoFrameChromium* frame)
     return GraphicsContext3D::INVALID_VALUE;
 }
 
-bool VideoLayerChromium::allocateTexturesIfNeeded(GraphicsContext3D* context, VideoFrameChromium* frame, unsigned textureFormat)
+bool VideoLayerChromium::allocateTexturesIfNeeded(GraphicsContext3D* context, const VideoFrameChromium* frame, unsigned textureFormat)
 {
     ASSERT(context);
     ASSERT(frame);
 
     for (unsigned plane = 0; plane < frame->planes(); plane++) {
-        IntSize planeTextureSize = frame->requiredTextureSize(plane);
+        IntSize requiredTextureSize = frame->requiredTextureSize(plane);
+        Texture texture = m_textures[plane];
 
         // If the renderer cannot handle this large of a texture, return false.
         // FIXME: Remove this test when tiled layers are implemented.
-        if (!layerRenderer()->checkTextureSize(planeTextureSize))
+        if (!layerRenderer()->checkTextureSize(requiredTextureSize))
             return false;
 
-        if (!m_textures[plane])
-            m_textures[plane] = layerRenderer()->createLayerTexture();
-
-        if (!planeTextureSize.isZero() && planeTextureSize != m_textureSizes[plane]) {
-            allocateTexture(context, m_textures[plane], planeTextureSize, textureFormat);
-            m_textureSizes[plane] = planeTextureSize;
-            int frameWidth = frame->width(plane);
-            int frameHeight = frame->height(plane);
-            // When there are dead pixels at the edge of the texture, decrease
-            // the frame width by 1 to prevent the rightmost pixels from
-            // interpolating with the dead pixels.
-            if (frame->hasPaddingBytes(plane))
-                --frameWidth;
-            m_frameSizes[plane] = IntSize(frameWidth, frameHeight);
+        if (texture.isEmpty) {
+            texture.id = layerRenderer()->createLayerTexture();
+            texture.ownedByLayerRenderer = true;
+            texture.isEmpty = false;
+        }
+
+        if (!requiredTextureSize.isZero() && requiredTextureSize != texture.size) {
+            allocateTexture(context, texture.id, requiredTextureSize, textureFormat);
+            texture.size = requiredTextureSize;
+            texture.visibleSize = computeVisibleSize(frame, plane);
         }
+        m_textures[plane] = texture;
     }
 
+    return true;
+}
+
+IntSize VideoLayerChromium::computeVisibleSize(const VideoFrameChromium* frame, unsigned plane)
+{
+    int visibleWidth = frame->width(plane);
+    int visibleHeight = frame->height(plane);
+    // When there are dead pixels at the edge of the texture, decrease
+    // the frame width by 1 to prevent the rightmost pixels from
+    // interpolating with the dead pixels.
+    if (frame->hasPaddingBytes(plane))
+        --visibleWidth;
+
     // In YV12, every 2x2 square of Y values corresponds to one U and
     // one V value. If we decrease the width of the UV plane, we must decrease the
     // width of the Y texture by 2 for proper alignment. This must happen
     // always, even if Y's texture does not have padding bytes.
-    if (frame->format() == VideoFrameChromium::YV12) {
-        int yPlaneOriginalWidth = frame->width(VideoFrameChromium::yPlane);
-        if (frame->hasPaddingBytes(VideoFrameChromium::uPlane))
-            m_frameSizes[VideoFrameChromium::yPlane].setWidth(yPlaneOriginalWidth - 2);
+    if (plane == VideoFrameChromium::yPlane && frame->format() == VideoFrameChromium::YV12) {
+        if (frame->hasPaddingBytes(VideoFrameChromium::uPlane)) {
+            int originalWidth = frame->width(plane);
+            visibleWidth = originalWidth - 2;
+        }
     }
 
-    return true;
+    return IntSize(visibleWidth, visibleHeight);
 }
 
-void VideoLayerChromium::allocateTexture(GraphicsContext3D* context, unsigned textureId, const IntSize& dimensions, unsigned textureFormat)
+void VideoLayerChromium::allocateTexture(GraphicsContext3D* context, unsigned textureId, const IntSize& dimensions, unsigned textureFormat) const
 {
     GLC(context, context->bindTexture(GraphicsContext3D::TEXTURE_2D, textureId));
     GLC(context, context->texImage2DResourceSafe(GraphicsContext3D::TEXTURE_2D, 0, textureFormat, dimensions.width(), dimensions.height(), 0, textureFormat, GraphicsContext3D::UNSIGNED_BYTE));
 }
 
-void VideoLayerChromium::updateTexture(GraphicsContext3D* context, unsigned textureId, const IntSize& dimensions, unsigned format, const void* data)
+void VideoLayerChromium::updateTexture(GraphicsContext3D* context, unsigned textureId, const IntSize& dimensions, unsigned format, const void* data) const
 {
     ASSERT(context);
     GLC(context, context->bindTexture(GraphicsContext3D::TEXTURE_2D, textureId));
@@ -225,33 +260,6 @@ void VideoLayerChromium::updateTexture(GraphicsContext3D* context, unsigned text
     }
 }
 
-void VideoLayerChromium::draw()
-{
-    if (m_skipsDraw)
-        return;
-
-    ASSERT(layerRenderer());
-    const RGBAProgram* rgbaProgram = layerRenderer()->videoLayerRGBAProgram();
-    ASSERT(rgbaProgram && rgbaProgram->initialized());
-    const YUVProgram* yuvProgram = layerRenderer()->videoLayerYUVProgram();
-    ASSERT(yuvProgram && yuvProgram->initialized());
-
-    switch (m_frameFormat) {
-    case VideoFrameChromium::YV12:
-    case VideoFrameChromium::YV16:
-        drawYUV(yuvProgram);
-        break;
-    case VideoFrameChromium::RGBA:
-        drawRGBA(rgbaProgram);
-        break;
-    default:
-        // FIXME: Implement other paths.
-        notImplemented();
-        break;
-    }
-    releaseCurrentFrame();
-}
-
 void VideoLayerChromium::releaseCurrentFrame()
 {
     if (!m_currentFrame)
@@ -262,86 +270,29 @@ void VideoLayerChromium::releaseCurrentFrame()
     resetFrameParameters();
 }
 
-void VideoLayerChromium::drawYUV(const VideoLayerChromium::YUVProgram* program)
-{
-    GraphicsContext3D* context = layerRendererContext();
-    GLC(context, context->activeTexture(GraphicsContext3D::TEXTURE1));
-    GLC(context, context->bindTexture(GraphicsContext3D::TEXTURE_2D, m_textures[VideoFrameChromium::yPlane]));
-    GLC(context, context->activeTexture(GraphicsContext3D::TEXTURE2));
-    GLC(context, context->bindTexture(GraphicsContext3D::TEXTURE_2D, m_textures[VideoFrameChromium::uPlane]));
-    GLC(context, context->activeTexture(GraphicsContext3D::TEXTURE3));
-    GLC(context, context->bindTexture(GraphicsContext3D::TEXTURE_2D, m_textures[VideoFrameChromium::vPlane]));
-
-    layerRenderer()->useShader(program->program());
-    unsigned yFrameWidth = m_frameSizes[VideoFrameChromium::yPlane].width();
-    unsigned yTextureWidth = m_textureSizes[VideoFrameChromium::yPlane].width();
-    // Arbitrarily take the u sizes because u and v dimensions are identical.
-    unsigned uvFrameWidth = m_frameSizes[VideoFrameChromium::uPlane].width();
-    unsigned uvTextureWidth = m_textureSizes[VideoFrameChromium::uPlane].width();
-
-    float yWidthScaleFactor = static_cast<float>(yFrameWidth) / yTextureWidth;
-    float uvWidthScaleFactor = static_cast<float>(uvFrameWidth) / uvTextureWidth;
-    GLC(context, context->uniform1f(program->vertexShader().yWidthScaleFactorLocation(), yWidthScaleFactor));
-    GLC(context, context->uniform1f(program->vertexShader().uvWidthScaleFactorLocation(), uvWidthScaleFactor));
-
-    GLC(context, context->uniform1i(program->fragmentShader().yTextureLocation(), 1));
-    GLC(context, context->uniform1i(program->fragmentShader().uTextureLocation(), 2));
-    GLC(context, context->uniform1i(program->fragmentShader().vTextureLocation(), 3));
-
-    // This value of 0.5 maps to 128. It is used in the YUV to RGB conversion
-    // formula to turn unsigned u and v values to signed u and v values.
-    // This is loaded as a uniform because certain drivers have problems
-    // reading literal float values.
-    GLC(context, context->uniform1f(program->fragmentShader().signAdjLocation(), 0.5));
-
-    GLC(context, context->uniformMatrix3fv(program->fragmentShader().ccMatrixLocation(), 0, const_cast<float*>(yuv2RGB), 1));
-
-    drawTexturedQuad(context, layerRenderer()->projectionMatrix(), ccLayerImpl()->drawTransform(),
-                     bounds().width(), bounds().height(), ccLayerImpl()->drawOpacity(),
-                     program->vertexShader().matrixLocation(),
-                     program->fragmentShader().alphaLocation());
-
-    // Reset active texture back to texture 0.
-    GLC(context, context->activeTexture(GraphicsContext3D::TEXTURE0));
-}
-
-void VideoLayerChromium::drawRGBA(const VideoLayerChromium::RGBAProgram* program)
-{
-    GraphicsContext3D* context = layerRendererContext();
-    GLC(context, context->activeTexture(GraphicsContext3D::TEXTURE0));
-    GLC(context, context->bindTexture(GraphicsContext3D::TEXTURE_2D, m_textures[VideoFrameChromium::rgbPlane]));
-
-    layerRenderer()->useShader(program->program());
-    unsigned frameWidth = m_frameSizes[VideoFrameChromium::rgbPlane].width();
-    unsigned textureWidth = m_textureSizes[VideoFrameChromium::rgbPlane].width();
-    float widthScaleFactor = static_cast<float>(frameWidth) / textureWidth;
-    GLC(context, context->uniform4f(program->vertexShader().texTransformLocation(), 0, 0, widthScaleFactor, 1));
-
-    GLC(context, context->uniform1i(program->fragmentShader().samplerLocation(), 0));
-
-    drawTexturedQuad(context, layerRenderer()->projectionMatrix(), ccLayerImpl()->drawTransform(),
-                     bounds().width(), bounds().height(), ccLayerImpl()->drawOpacity(),
-                     program->vertexShader().matrixLocation(),
-                     program->fragmentShader().alphaLocation());
-}
-
 void VideoLayerChromium::resetFrameParameters()
 {
+    deleteTexturesInUse();
     for (unsigned plane = 0; plane < VideoFrameChromium::maxPlanes; plane++) {
-        m_textures[plane] = 0;
-        m_textureSizes[plane] = IntSize();
-        m_frameSizes[plane] = IntSize();
+        m_textures[plane].id = 0;
+        m_textures[plane].size = IntSize();
+        m_textures[plane].visibleSize = IntSize();
+        m_textures[plane].ownedByLayerRenderer = false;
+        m_textures[plane].isEmpty = true;
     }
 }
 
 void VideoLayerChromium::saveCurrentFrame(VideoFrameChromium* frame)
 {
     ASSERT(!m_currentFrame);
+    deleteTexturesInUse();
     m_currentFrame = frame;
     for (unsigned plane = 0; plane < frame->planes(); plane++) {
-        m_textures[plane] = frame->texture(plane);
-        m_textureSizes[plane] = frame->requiredTextureSize(plane);
-        m_frameSizes[plane] = m_textureSizes[plane];
+        m_textures[plane].id = frame->texture(plane);
+        m_textures[plane].size = frame->requiredTextureSize(plane);
+        m_textures[plane].visibleSize = computeVisibleSize(frame, plane);
+        m_textures[plane].ownedByLayerRenderer = false;
+        m_textures[plane].isEmpty = false;
     }
 }
 
diff --git a/Source/WebCore/platform/graphics/chromium/VideoLayerChromium.h b/Source/WebCore/platform/graphics/chromium/VideoLayerChromium.h
index 2170e13..ef08bd8 100644
--- a/Source/WebCore/platform/graphics/chromium/VideoLayerChromium.h
+++ b/Source/WebCore/platform/graphics/chromium/VideoLayerChromium.h
@@ -42,19 +42,28 @@ namespace WebCore {
 // A Layer that contains a Video element.
 class VideoLayerChromium : public LayerChromium {
 public:
+    struct Texture {
+        unsigned id;
+        IntSize size;
+        IntSize visibleSize;
+        bool ownedByLayerRenderer;
+        bool isEmpty;
+    };
+
     static PassRefPtr<VideoLayerChromium> create(GraphicsLayerChromium* owner = 0,
                                                  VideoFrameProvider* = 0);
     virtual ~VideoLayerChromium();
-    virtual void updateContentsIfDirty();
+
+    virtual PassRefPtr<CCLayerImpl> createCCLayerImpl();
+
+    virtual void updateCompositorResources();
     virtual bool drawsContent() const { return true; }
-    virtual void draw();
 
     // This function is called by VideoFrameProvider. When this method is called
     // putCurrentFrame() must be called to return the frame currently held.
     void releaseCurrentFrame();
 
-    typedef ProgramBinding<VertexShaderPosTexTransform, FragmentShaderRGBATexFlipAlpha> RGBAProgram;
-    typedef ProgramBinding<VertexShaderPosTexYUVStretch, FragmentShaderYUVVideo> YUVProgram;
+    virtual void pushPropertiesTo(CCLayerImpl*);
 
 protected:
     virtual void cleanupResources();
@@ -63,27 +72,27 @@ protected:
 private:
     VideoLayerChromium(GraphicsLayerChromium* owner, VideoFrameProvider*);
 
-    static unsigned determineTextureFormat(VideoFrameChromium*);
-    bool allocateTexturesIfNeeded(GraphicsContext3D*, VideoFrameChromium*, unsigned textureFormat);
-    void updateYUVContents(GraphicsContext3D*, const VideoFrameChromium*);
-    void updateRGBAContents(GraphicsContext3D*, const VideoFrameChromium*);
-    void allocateTexture(GraphicsContext3D*, unsigned textureId, const IntSize& dimensions, unsigned textureFormat);
-    void updateTexture(GraphicsContext3D*, unsigned textureId, const IntSize& dimensions, unsigned textureFormat, const void* data);
-    void drawYUV(const YUVProgram*);
-    void drawRGBA(const RGBAProgram*);
+    static unsigned determineTextureFormat(const VideoFrameChromium*);
+    static IntSize computeVisibleSize(const VideoFrameChromium*, unsigned plane);
+    void deleteTexturesInUse();
+
+    bool allocateTexturesIfNeeded(GraphicsContext3D*, const VideoFrameChromium*, unsigned textureFormat);
+    void allocateTexture(GraphicsContext3D*, unsigned textureId, const IntSize& dimensions, unsigned textureFormat) const;
+
+    void updateTexture(GraphicsContext3D*, unsigned textureId, const IntSize& dimensions, unsigned textureFormat, const void* data) const;
+
     void resetFrameParameters();
     void saveCurrentFrame(VideoFrameChromium*);
 
-    static const float yuv2RGB[9];
-
     bool m_skipsDraw;
     VideoFrameChromium::Format m_frameFormat;
     VideoFrameProvider* m_provider;
-    VideoFrameChromium* m_currentFrame;
 
-    unsigned m_textures[3];
-    IntSize m_textureSizes[3];
-    IntSize m_frameSizes[3];
+    Texture m_textures[3];
+
+    // This will be null for the entire duration of video playback if hardware
+    // decoding is not being used.
+    VideoFrameChromium* m_currentFrame;
 };
 
 }
diff --git a/Source/WebCore/platform/graphics/chromium/WebGLLayerChromium.cpp b/Source/WebCore/platform/graphics/chromium/WebGLLayerChromium.cpp
index e83d045..652e752 100644
--- a/Source/WebCore/platform/graphics/chromium/WebGLLayerChromium.cpp
+++ b/Source/WebCore/platform/graphics/chromium/WebGLLayerChromium.cpp
@@ -47,10 +47,11 @@ PassRefPtr<WebGLLayerChromium> WebGLLayerChromium::create(GraphicsLayerChromium*
 WebGLLayerChromium::WebGLLayerChromium(GraphicsLayerChromium* owner)
     : CanvasLayerChromium(owner)
     , m_context(0)
+    , m_textureUpdated(false)
 {
 }
 
-void WebGLLayerChromium::updateContentsIfDirty()
+void WebGLLayerChromium::updateCompositorResources()
 {
     if (!m_contentsDirty)
         return;
@@ -68,19 +69,28 @@ void WebGLLayerChromium::updateContentsIfDirty()
         m_textureChanged = false;
     }
     // Update the contents of the texture used by the compositor.
-    if (m_contentsDirty) {
+    if (m_contentsDirty && m_textureUpdated) {
         m_context->prepareTexture();
+        m_context->markLayerComposited();
         m_contentsDirty = false;
+        m_textureUpdated = false;
     }
 }
 
+void WebGLLayerChromium::setTextureUpdated()
+{
+    m_textureUpdated = true;
+}
+
 void WebGLLayerChromium::setContext(const GraphicsContext3D* context)
 {
     m_context = const_cast<GraphicsContext3D*>(context);
 
     unsigned int textureId = m_context->platformTexture();
-    if (textureId != m_textureId)
+    if (textureId != m_textureId) {
         m_textureChanged = true;
+        m_textureUpdated = true;
+    }
     m_textureId = textureId;
     m_premultipliedAlpha = m_context->getContextAttributes().premultipliedAlpha;
 }
diff --git a/Source/WebCore/platform/graphics/chromium/WebGLLayerChromium.h b/Source/WebCore/platform/graphics/chromium/WebGLLayerChromium.h
index 70be876..33db730 100644
--- a/Source/WebCore/platform/graphics/chromium/WebGLLayerChromium.h
+++ b/Source/WebCore/platform/graphics/chromium/WebGLLayerChromium.h
@@ -45,7 +45,8 @@ class WebGLLayerChromium : public CanvasLayerChromium {
 public:
     static PassRefPtr<WebGLLayerChromium> create(GraphicsLayerChromium* owner = 0);
     virtual bool drawsContent() const { return m_context; }
-    virtual void updateContentsIfDirty();
+    virtual void updateCompositorResources();
+    void setTextureUpdated();
 
     void setContext(const GraphicsContext3D* context);
 
@@ -55,6 +56,7 @@ protected:
 private:
     explicit WebGLLayerChromium(GraphicsLayerChromium* owner);
     GraphicsContext3D* m_context;
+    bool m_textureUpdated;
 };
 
 }
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCCanvasLayerImpl.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCCanvasLayerImpl.cpp
new file mode 100644
index 0000000..649d049
--- /dev/null
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCCanvasLayerImpl.cpp
@@ -0,0 +1,80 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if USE(ACCELERATED_COMPOSITING)
+
+#include "cc/CCCanvasLayerImpl.h"
+
+#include "CanvasLayerChromium.h"
+#include "GraphicsContext3D.h"
+#include "LayerRendererChromium.h"
+#include <wtf/text/WTFString.h>
+
+namespace WebCore {
+
+CCCanvasLayerImpl::CCCanvasLayerImpl(LayerChromium* owner)
+    : CCLayerImpl(owner)
+    , m_textureId(0)
+    , m_premultipliedAlpha(true)
+{
+}
+
+CCCanvasLayerImpl::~CCCanvasLayerImpl()
+{
+}
+
+void CCCanvasLayerImpl::draw()
+{
+    ASSERT(layerRenderer());
+    const CCCanvasLayerImpl::Program* program = layerRenderer()->canvasLayerProgram();
+    ASSERT(program && program->initialized());
+    GraphicsContext3D* context = layerRenderer()->context();
+    GLC(context, context->activeTexture(GraphicsContext3D::TEXTURE0));
+    GLC(context, context->bindTexture(GraphicsContext3D::TEXTURE_2D, m_textureId));
+    GC3Denum sfactor = m_premultipliedAlpha ? GraphicsContext3D::ONE : GraphicsContext3D::SRC_ALPHA;
+    GLC(context, context->blendFunc(sfactor, GraphicsContext3D::ONE_MINUS_SRC_ALPHA));
+    layerRenderer()->useShader(program->program());
+    GLC(context, context->uniform1i(program->fragmentShader().samplerLocation(), 0));
+    LayerChromium::drawTexturedQuad(context, layerRenderer()->projectionMatrix(), drawTransform(),
+                                    bounds().width(), bounds().height(), drawOpacity(),
+                                    program->vertexShader().matrixLocation(),
+                                    program->fragmentShader().alphaLocation());
+
+}
+
+
+void CCCanvasLayerImpl::dumpLayerProperties(TextStream& ts, int indent) const
+{
+    writeIndent(ts, indent);
+    ts << "canvas layer texture id: " << m_textureId << " premultiplied: " << m_premultipliedAlpha << "\n";
+    CCLayerImpl::dumpLayerProperties(ts, indent);
+}
+
+}
+
+#endif // USE(ACCELERATED_COMPOSITING)
+
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCCanvasLayerImpl.h b/Source/WebCore/platform/graphics/chromium/cc/CCCanvasLayerImpl.h
new file mode 100644
index 0000000..8cbf8d1
--- /dev/null
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCCanvasLayerImpl.h
@@ -0,0 +1,61 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef CCCanvasLayerImpl_h
+#define CCCanvasLayerImpl_h
+
+#include "ProgramBinding.h"
+#include "ShaderChromium.h"
+#include "cc/CCLayerImpl.h"
+
+namespace WebCore {
+
+class CCCanvasLayerImpl : public CCLayerImpl {
+public:
+    static PassRefPtr<CCCanvasLayerImpl> create(LayerChromium* owner)
+    {
+        return adoptRef(new CCCanvasLayerImpl(owner));
+    }
+    virtual ~CCCanvasLayerImpl();
+
+    typedef ProgramBinding<VertexShaderPosTex, FragmentShaderRGBATexFlipAlpha> Program;
+
+    virtual void draw();
+
+    virtual void dumpLayerProperties(TextStream&, int indent) const;
+
+    void setTextureId(unsigned id) { m_textureId = id; }
+    void setPremultipliedAlpha(bool premultipliedAlpha) { m_premultipliedAlpha = premultipliedAlpha; }
+private:
+    explicit CCCanvasLayerImpl(LayerChromium*);
+
+    unsigned m_textureId;
+    bool m_premultipliedAlpha;
+};
+
+}
+
+#endif // CCCanvasLayerImpl_h
+
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCHeadsUpDisplay.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCHeadsUpDisplay.cpp
index 604ef61..404944b 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCHeadsUpDisplay.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCHeadsUpDisplay.cpp
@@ -66,8 +66,8 @@ void CCHeadsUpDisplay::draw()
     // Use a fullscreen texture only if we need to...
     IntSize hudSize;
     if (m_showPlatformLayerTree) {
-        hudSize.setWidth(min(2048, m_layerRenderer->visibleRectSize().width()));
-        hudSize.setHeight(min(2048, m_layerRenderer->visibleRectSize().height()));
+        hudSize.setWidth(min(2048, m_layerRenderer->viewportSize().width()));
+        hudSize.setHeight(min(2048, m_layerRenderer->viewportSize().height()));
     } else {
         hudSize.setWidth(512);
         hudSize.setHeight(128);
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCHeadsUpDisplay.h b/Source/WebCore/platform/graphics/chromium/cc/CCHeadsUpDisplay.h
index dbac22a..d56f8ab 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCHeadsUpDisplay.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCHeadsUpDisplay.h
@@ -53,7 +53,7 @@ public:
     void setShowPlatformLayerTree(bool enable) { m_showPlatformLayerTree = enable; }
     bool showPlatformLayerTree() const { return m_showPlatformLayerTree; }
 
-    bool enabled() const { return true || m_showPlatformLayerTree || m_showFPSCounter; }
+    bool enabled() const { return m_showPlatformLayerTree || m_showFPSCounter; }
     void draw();
 
 private:
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCLayerImpl.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCLayerImpl.cpp
index a0ad0fb..9411e5a 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCLayerImpl.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCLayerImpl.cpp
@@ -62,13 +62,18 @@ namespace WebCore {
 
 CCLayerImpl::CCLayerImpl(LayerChromium* owner)
     : m_owner(owner)
+    , m_anchorPoint(0.5, 0.5)
+    , m_anchorPointZ(0)
+    , m_doubleSided(true)
+    , m_masksToBounds(false)
+    , m_opacity(1.0)
+    , m_preserves3D(false)
 #ifndef NDEBUG
     , m_debugID(owner->debugID())
 #endif
     , m_targetRenderSurface(0)
     , m_drawDepth(0)
     , m_drawOpacity(0)
-    , m_doubleSided(true)
     , m_debugBorderColor(0, 0, 0, 0)
     , m_debugBorderWidth(0)
     , m_renderSurface(0)
@@ -107,7 +112,18 @@ RenderSurfaceChromium* CCLayerImpl::createRenderSurface()
     return m_renderSurface.get();
 }
 
-// These belong on CCLayerImpl, but should be subclased by each type and not defer to the LayerChromium subtypes.
+bool CCLayerImpl::descendantsDrawsContent()
+{
+    const Vector<RefPtr<LayerChromium> >& sublayers = m_owner->getSublayers();
+    for (size_t i = 0; i < sublayers.size(); ++i) {
+        sublayers[i]->createCCLayerImplIfNeeded();
+        if (sublayers[i]->ccLayerImpl()->drawsContent() || sublayers[i]->ccLayerImpl()->descendantsDrawsContent())
+            return true;
+    }
+    return false;
+}
+
+// These belong on CCLayerImpl, but should be overridden by each type and not defer to the LayerChromium subtypes.
 bool CCLayerImpl::drawsContent() const
 {
     return m_owner->drawsContent();
@@ -118,6 +134,11 @@ void CCLayerImpl::draw()
     return m_owner->draw();
 }
 
+void CCLayerImpl::updateCompositorResources()
+{
+    return m_owner->updateCompositorResources();
+}
+
 void CCLayerImpl::unreserveContentsTexture()
 {
     m_owner->unreserveContentsTexture();
@@ -167,7 +188,7 @@ void CCLayerImpl::drawDebugBorder()
     GLC(context, context->drawElements(GraphicsContext3D::LINE_LOOP, 4, GraphicsContext3D::UNSIGNED_SHORT, 6 * sizeof(unsigned short)));
 }
 
-static void writeIndent(TextStream& ts, int indent)
+void CCLayerImpl::writeIndent(TextStream& ts, int indent)
 {
     for (int i = 0; i != indent; ++i)
         ts << "  ";
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCLayerImpl.h b/Source/WebCore/platform/graphics/chromium/cc/CCLayerImpl.h
index 6892976..96c4f1b 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCLayerImpl.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCLayerImpl.h
@@ -49,7 +49,7 @@ public:
         return adoptRef(new CCLayerImpl(owner));
     }
     // When this class gets subclasses, remember to add 'virtual' here.
-    ~CCLayerImpl();
+    virtual ~CCLayerImpl();
 
 #ifndef NDEBUG
     int debugID() const { return m_debugID; }
@@ -59,13 +59,43 @@ public:
     CCLayerImpl* maskLayer() const;
     CCLayerImpl* replicaLayer() const;
 
-    void draw();
-    bool drawsContent() const;
+    virtual void draw();
+    virtual void updateCompositorResources();
     void unreserveContentsTexture();
     void bindContentsTexture();
 
+    // Returns true if this layer has content to draw.
+    virtual bool drawsContent() const;
+
+    // Returns true if any of the layer's descendants has content to draw.
+    bool descendantsDrawsContent();
+
     void cleanupResources();
 
+    void setAnchorPoint(const FloatPoint& anchorPoint) { m_anchorPoint = anchorPoint; }
+    const FloatPoint& anchorPoint() const { return m_anchorPoint; }
+
+    void setAnchorPointZ(float anchorPointZ) { m_anchorPointZ = anchorPointZ; }
+    float anchorPointZ() const { return m_anchorPointZ; }
+
+    void setMasksToBounds(bool masksToBounds) { m_masksToBounds = masksToBounds; }
+    bool masksToBounds() const { return m_masksToBounds; }
+
+    void setOpacity(float opacity) { m_opacity = opacity; }
+    float opacity() const { return m_opacity; }
+
+    void setPosition(const FloatPoint& position) { m_position = position; }
+    const FloatPoint& position() const { return m_position; }
+
+    void setPreserves3D(bool preserves3D) { m_preserves3D = preserves3D; }
+    bool preserves3D() const { return m_preserves3D; }
+
+    void setSublayerTransform(const TransformationMatrix& sublayerTransform) { m_sublayerTransform = sublayerTransform; }
+    const TransformationMatrix& sublayerTransform() const { return m_sublayerTransform; }
+
+    void setTransform(const TransformationMatrix& transform) { m_transform = transform; }
+    const TransformationMatrix& transform() const { return m_transform; }
+
     void setName(const String& name) { m_name = name; }
     const String& name() const { return m_name; }
 
@@ -108,11 +138,30 @@ public:
 
     virtual void dumpLayerProperties(TextStream&, int indent) const;
 
-private:
+protected:
     // For now, CCLayers are owned directly by a LayerChromium.
     LayerChromium* m_owner;
     explicit CCLayerImpl(LayerChromium*);
 
+    static void writeIndent(TextStream&, int indent);
+
+private:
+    // Properties synchronized from the associated LayerChromium.
+    FloatPoint m_anchorPoint;
+    float m_anchorPointZ;
+    IntSize m_bounds;
+
+    // Whether the "back" of this layer should draw.
+    bool m_doubleSided;
+
+    bool m_masksToBounds;
+    float m_opacity;
+    FloatPoint m_position;
+    bool m_preserves3D;
+    TransformationMatrix m_sublayerTransform;
+    TransformationMatrix m_transform;
+
+    // Properties owned exclusively by this CCLayerImpl.
     // Debugging.
 #ifndef NDEBUG
     int m_debugID;
@@ -131,17 +180,12 @@ private:
     float m_drawDepth;
     float m_drawOpacity;
 
-    // Whether the "back" of this layer should draw.
-    bool m_doubleSided;
-
     // Debug borders.
     Color m_debugBorderColor;
     float m_debugBorderWidth;
 
     TransformationMatrix m_drawTransform;
 
-    IntSize m_bounds;
-
     // The scissor rectangle that should be used when this layer is drawn.
     // Inherited by the parent layer and further restricted if this layer masks
     // to bounds.
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCPluginLayerImpl.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCPluginLayerImpl.cpp
new file mode 100644
index 0000000..4aef639
--- /dev/null
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCPluginLayerImpl.cpp
@@ -0,0 +1,84 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if USE(ACCELERATED_COMPOSITING)
+
+#include "cc/CCPluginLayerImpl.h"
+
+#include "GraphicsContext3D.h"
+#include "LayerRendererChromium.h"
+#include "PluginLayerChromium.h"
+#include <wtf/text/WTFString.h>
+
+namespace WebCore {
+
+CCPluginLayerImpl::CCPluginLayerImpl(LayerChromium* owner)
+    : CCLayerImpl(owner)
+    , m_textureId(0)
+{
+}
+
+CCPluginLayerImpl::~CCPluginLayerImpl()
+{
+}
+
+void CCPluginLayerImpl::draw()
+{
+    ASSERT(layerRenderer());
+    const CCPluginLayerImpl::Program* program = layerRenderer()->pluginLayerProgram();
+    ASSERT(program && program->initialized());
+    GraphicsContext3D* context = layerRenderer()->context();
+    GLC(context, context->activeTexture(GraphicsContext3D::TEXTURE0));
+    GLC(context, context->bindTexture(GraphicsContext3D::TEXTURE_2D, m_textureId));
+
+    // FIXME: setting the texture parameters every time is redundant. Move this code somewhere
+    // where it will only happen once per texture.
+    GLC(context, context->texParameteri(GraphicsContext3D::TEXTURE_2D, GraphicsContext3D::TEXTURE_MIN_FILTER, GraphicsContext3D::LINEAR));
+    GLC(context, context->texParameteri(GraphicsContext3D::TEXTURE_2D, GraphicsContext3D::TEXTURE_MAG_FILTER, GraphicsContext3D::LINEAR));
+    GLC(context, context->texParameteri(GraphicsContext3D::TEXTURE_2D, GraphicsContext3D::TEXTURE_WRAP_S, GraphicsContext3D::CLAMP_TO_EDGE));
+    GLC(context, context->texParameteri(GraphicsContext3D::TEXTURE_2D, GraphicsContext3D::TEXTURE_WRAP_T, GraphicsContext3D::CLAMP_TO_EDGE));
+
+    layerRenderer()->useShader(program->program());
+    GLC(context, context->uniform1i(program->fragmentShader().samplerLocation(), 0));
+    LayerChromium::drawTexturedQuad(context, layerRenderer()->projectionMatrix(), drawTransform(),
+                                    bounds().width(), bounds().height(), drawOpacity(),
+                                    program->vertexShader().matrixLocation(),
+                                    program->fragmentShader().alphaLocation());
+}
+
+
+void CCPluginLayerImpl::dumpLayerProperties(TextStream& ts, int indent) const
+{
+    writeIndent(ts, indent);
+    ts << "plugin layer texture id: " << m_textureId << "\n";
+    CCLayerImpl::dumpLayerProperties(ts, indent);
+}
+
+}
+
+#endif // USE(ACCELERATED_COMPOSITING)
+
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCPluginLayerImpl.h b/Source/WebCore/platform/graphics/chromium/cc/CCPluginLayerImpl.h
new file mode 100644
index 0000000..65eb5b7
--- /dev/null
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCPluginLayerImpl.h
@@ -0,0 +1,60 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef CCPluginLayerImpl_h
+#define CCPluginLayerImpl_h
+
+#include "ProgramBinding.h"
+#include "ShaderChromium.h"
+#include "cc/CCLayerImpl.h"
+
+namespace WebCore {
+
+class CCPluginLayerImpl : public CCLayerImpl {
+public:
+    static PassRefPtr<CCPluginLayerImpl> create(LayerChromium* owner)
+    {
+        return adoptRef(new CCPluginLayerImpl(owner));
+    }
+    virtual ~CCPluginLayerImpl();
+
+    typedef ProgramBinding<VertexShaderPosTex, FragmentShaderRGBATexFlipAlpha> Program;
+
+    virtual void draw();
+
+    virtual void dumpLayerProperties(TextStream&, int indent) const;
+
+    void setTextureId(unsigned id) { m_textureId = id; }
+
+private:
+    explicit CCPluginLayerImpl(LayerChromium*);
+
+    unsigned m_textureId;
+};
+
+}
+
+#endif // CCPluginLayerImpl_h
+
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCVideoLayerImpl.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCVideoLayerImpl.cpp
new file mode 100644
index 0000000..eb3612b
--- /dev/null
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCVideoLayerImpl.cpp
@@ -0,0 +1,173 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if USE(ACCELERATED_COMPOSITING)
+
+#include "cc/CCVideoLayerImpl.h"
+
+#include "GraphicsContext3D.h"
+#include "LayerRendererChromium.h"
+#include "NotImplemented.h"
+#include "VideoLayerChromium.h"
+#include <wtf/text/WTFString.h>
+
+namespace WebCore {
+
+// These values are magic numbers that are used in the transformation
+// from YUV to RGB color values.
+// They are taken from the following webpage:
+// http://www.fourcc.org/fccyvrgb.php
+const float CCVideoLayerImpl::yuv2RGB[9] = {
+    1.164f, 1.164f, 1.164f,
+    0.f, -.391f, 2.018f,
+    1.596f, -.813f, 0.f,
+};
+
+// These values map to 16, 128, and 128 respectively, and are computed
+// as a fraction over 256 (e.g. 16 / 256 = 0.0625).
+// They are used in the YUV to RGBA conversion formula:
+//   Y - 16   : Gives 16 values of head and footroom for overshooting
+//   U - 128  : Turns unsigned U into signed U [-128,127]
+//   V - 128  : Turns unsigned V into signed V [-128,127]
+const float CCVideoLayerImpl::yuvAdjust[3] = {
+    -0.0625f,
+    -0.5f,
+    -0.5f,
+};
+
+CCVideoLayerImpl::CCVideoLayerImpl(LayerChromium* owner)
+    : CCLayerImpl(owner)
+{
+}
+
+CCVideoLayerImpl::~CCVideoLayerImpl()
+{
+    cleanupResources();
+}
+
+void CCVideoLayerImpl::setTexture(size_t i, VideoLayerChromium::Texture texture)
+{
+    ASSERT(i < 3);
+    m_textures[i] = texture;
+}
+
+void CCVideoLayerImpl::draw()
+{
+    if (m_skipsDraw)
+        return;
+
+    ASSERT(layerRenderer());
+    const RGBAProgram* rgbaProgram = layerRenderer()->videoLayerRGBAProgram();
+    ASSERT(rgbaProgram && rgbaProgram->initialized());
+    const YUVProgram* yuvProgram = layerRenderer()->videoLayerYUVProgram();
+    ASSERT(yuvProgram && yuvProgram->initialized());
+
+    switch (m_frameFormat) {
+    case VideoFrameChromium::YV12:
+    case VideoFrameChromium::YV16:
+        drawYUV(yuvProgram);
+        break;
+    case VideoFrameChromium::RGBA:
+        drawRGBA(rgbaProgram);
+        break;
+    default:
+        // FIXME: Implement other paths.
+        notImplemented();
+        break;
+    }
+}
+
+void CCVideoLayerImpl::drawYUV(const CCVideoLayerImpl::YUVProgram* program) const
+{
+    GraphicsContext3D* context = layerRenderer()->context();
+    VideoLayerChromium::Texture yTexture = m_textures[VideoFrameChromium::yPlane];
+    VideoLayerChromium::Texture uTexture = m_textures[VideoFrameChromium::uPlane];
+    VideoLayerChromium::Texture vTexture = m_textures[VideoFrameChromium::vPlane];
+
+    GLC(context, context->activeTexture(GraphicsContext3D::TEXTURE1));
+    GLC(context, context->bindTexture(GraphicsContext3D::TEXTURE_2D, yTexture.id));
+    GLC(context, context->activeTexture(GraphicsContext3D::TEXTURE2));
+    GLC(context, context->bindTexture(GraphicsContext3D::TEXTURE_2D, uTexture.id));
+    GLC(context, context->activeTexture(GraphicsContext3D::TEXTURE3));
+    GLC(context, context->bindTexture(GraphicsContext3D::TEXTURE_2D, vTexture.id));
+
+    layerRenderer()->useShader(program->program());
+
+    float yWidthScaleFactor = static_cast<float>(yTexture.visibleSize.width()) / yTexture.size.width();
+    // Arbitrarily take the u sizes because u and v dimensions are identical.
+    float uvWidthScaleFactor = static_cast<float>(uTexture.visibleSize.width()) / uTexture.size.width();
+    GLC(context, context->uniform1f(program->vertexShader().yWidthScaleFactorLocation(), yWidthScaleFactor));
+    GLC(context, context->uniform1f(program->vertexShader().uvWidthScaleFactorLocation(), uvWidthScaleFactor));
+
+    GLC(context, context->uniform1i(program->fragmentShader().yTextureLocation(), 1));
+    GLC(context, context->uniform1i(program->fragmentShader().uTextureLocation(), 2));
+    GLC(context, context->uniform1i(program->fragmentShader().vTextureLocation(), 3));
+
+    GLC(context, context->uniformMatrix3fv(program->fragmentShader().ccMatrixLocation(), 0, const_cast<float*>(yuv2RGB), 1));
+    GLC(context, context->uniform3fv(program->fragmentShader().yuvAdjLocation(), const_cast<float*>(yuvAdjust), 1));
+
+    LayerChromium::drawTexturedQuad(context, layerRenderer()->projectionMatrix(), drawTransform(),
+                                    bounds().width(), bounds().height(), drawOpacity(),
+                                    program->vertexShader().matrixLocation(),
+                                    program->fragmentShader().alphaLocation());
+
+    // Reset active texture back to texture 0.
+    GLC(context, context->activeTexture(GraphicsContext3D::TEXTURE0));
+}
+
+void CCVideoLayerImpl::drawRGBA(const CCVideoLayerImpl::RGBAProgram* program) const
+{
+    GraphicsContext3D* context = layerRenderer()->context();
+    VideoLayerChromium::Texture texture = m_textures[VideoFrameChromium::rgbPlane];
+
+    GLC(context, context->activeTexture(GraphicsContext3D::TEXTURE0));
+    GLC(context, context->bindTexture(GraphicsContext3D::TEXTURE_2D, texture.id));
+
+    layerRenderer()->useShader(program->program());
+    float widthScaleFactor = static_cast<float>(texture.visibleSize.width()) / texture.size.width();
+    GLC(context, context->uniform4f(program->vertexShader().texTransformLocation(), 0, 0, widthScaleFactor, 1));
+
+    GLC(context, context->uniform1i(program->fragmentShader().samplerLocation(), 0));
+
+    LayerChromium::drawTexturedQuad(context, layerRenderer()->projectionMatrix(), drawTransform(),
+                                    bounds().width(), bounds().height(), drawOpacity(),
+                                    program->vertexShader().matrixLocation(),
+                                    program->fragmentShader().alphaLocation());
+}
+
+
+void CCVideoLayerImpl::dumpLayerProperties(TextStream& ts, int indent) const
+{
+    writeIndent(ts, indent);
+    ts << "video layer\n";
+    CCLayerImpl::dumpLayerProperties(ts, indent);
+}
+
+}
+
+#endif // USE(ACCELERATED_COMPOSITING)
+
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCVideoLayerImpl.h b/Source/WebCore/platform/graphics/chromium/cc/CCVideoLayerImpl.h
new file mode 100644
index 0000000..62f8778
--- /dev/null
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCVideoLayerImpl.h
@@ -0,0 +1,75 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef CCVideoLayerImpl_h
+#define CCVideoLayerImpl_h
+
+#include "ProgramBinding.h"
+#include "ShaderChromium.h"
+#include "VideoFrameChromium.h"
+#include "VideoLayerChromium.h"
+#include "cc/CCLayerImpl.h"
+
+namespace WebCore {
+
+class VideoFrameProvider;
+
+class CCVideoLayerImpl : public CCLayerImpl {
+public:
+    static PassRefPtr<CCVideoLayerImpl> create(LayerChromium* owner)
+    {
+        return adoptRef(new CCVideoLayerImpl(owner));
+    }
+    virtual ~CCVideoLayerImpl();
+
+    typedef ProgramBinding<VertexShaderPosTexTransform, FragmentShaderRGBATexFlipAlpha> RGBAProgram;
+    typedef ProgramBinding<VertexShaderPosTexYUVStretch, FragmentShaderYUVVideo> YUVProgram;
+
+    virtual void draw();
+
+    virtual void dumpLayerProperties(TextStream&, int indent) const;
+
+    void setSkipsDraw(bool skipsDraw) { m_skipsDraw = skipsDraw; }
+    void setFrameFormat(VideoFrameChromium::Format format) { m_frameFormat = format; }
+    void setTexture(size_t, VideoLayerChromium::Texture);
+
+private:
+    explicit CCVideoLayerImpl(LayerChromium*);
+
+    void drawYUV(const YUVProgram*) const;
+    void drawRGBA(const RGBAProgram*) const;
+
+    static const float yuv2RGB[9];
+    static const float yuvAdjust[3];
+
+    bool m_skipsDraw;
+    VideoFrameChromium::Format m_frameFormat;
+    VideoLayerChromium::Texture m_textures[3];
+};
+
+}
+
+#endif // CCVideoLayerImpl_h
+
diff --git a/Source/WebCore/platform/graphics/cocoa/FontPlatformData.h b/Source/WebCore/platform/graphics/cocoa/FontPlatformData.h
deleted file mode 100644
index ca38029..0000000
--- a/Source/WebCore/platform/graphics/cocoa/FontPlatformData.h
+++ /dev/null
@@ -1,176 +0,0 @@
-/*
- * This file is part of the internal font implementation.
- * It should not be included by source files outside of it.
- *
- * Copyright (C) 2006, 2007, 2008, 2009, 2010 Apple Inc. All rights reserved.
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Library General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Library General Public License for more details.
- *
- * You should have received a copy of the GNU Library General Public License
- * along with this library; see the file COPYING.LIB.  If not, write to
- * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- * Boston, MA 02110-1301, USA.
- *
- */
-
-#ifndef FontPlatformData_h
-#define FontPlatformData_h
-
-#include "FontOrientation.h"
-#include "FontWidthVariant.h"
-#include <wtf/text/StringImpl.h>
-
-#ifdef __OBJC__
-@class NSFont;
-#else
-class NSFont;
-#endif
-
-typedef struct CGFont* CGFontRef;
-#ifndef BUILDING_ON_TIGER
-typedef const struct __CTFont* CTFontRef;
-#endif
-
-#include <CoreFoundation/CFBase.h>
-#include <objc/objc-auto.h>
-#include <wtf/Forward.h>
-#include <wtf/RetainPtr.h>
-
-#if PLATFORM(CHROMIUM) && OS(DARWIN)
-#include "CrossProcessFontLoading.h"  
-#endif
-
-
-typedef UInt32 ATSUFontID;
-typedef UInt32 ATSFontRef;
-
-namespace WebCore {
-
-#ifndef BUILDING_ON_TIGER
-inline CTFontRef toCTFontRef(NSFont *nsFont) { return reinterpret_cast<CTFontRef>(nsFont); }
-#endif
-
-class FontPlatformData {
-  public:
-    FontPlatformData(float size, bool syntheticBold, bool syntheticOblique, FontOrientation orientation = Horizontal, FontWidthVariant widthVariant = RegularWidth)
-        : m_syntheticBold(syntheticBold)
-        , m_syntheticOblique(syntheticOblique)
-        , m_orientation(orientation)
-        , m_size(size)
-        , m_widthVariant(widthVariant)
-        , m_font(0)
-#ifdef BUILDING_ON_TIGER
-        , m_cgFont(0)
-#endif
-        , m_isColorBitmapFont(false)
-    {
-    }
-
-    FontPlatformData(NSFont*, float size, bool syntheticBold = false, bool syntheticOblique = false, FontOrientation = Horizontal, FontWidthVariant = RegularWidth);
-    
-    FontPlatformData(CGFontRef cgFont, float size, bool syntheticBold, bool syntheticOblique, FontOrientation orientation, FontWidthVariant widthVariant)
-        : m_syntheticBold(syntheticBold)
-        , m_syntheticOblique(syntheticOblique)
-        , m_orientation(orientation)
-        , m_size(size)
-        , m_widthVariant(widthVariant)
-        , m_font(0)
-        , m_cgFont(cgFont)
-        , m_isColorBitmapFont(false)
-    {
-    }
-
-    FontPlatformData(const FontPlatformData&);
-    
-    ~FontPlatformData();
-
-    FontPlatformData(WTF::HashTableDeletedValueType) : m_font(hashTableDeletedFontValue()) { }
-    bool isHashTableDeletedValue() const { return m_font == hashTableDeletedFontValue(); }
-
-    float size() const { return m_size; }
-    bool syntheticBold() const { return m_syntheticBold; }
-    bool syntheticOblique() const { return m_syntheticOblique; }
-    FontOrientation orientation() const { return m_orientation; }
-    FontWidthVariant widthVariant() const { return m_widthVariant; }
-
-    bool m_syntheticBold;
-    bool m_syntheticOblique;
-    FontOrientation m_orientation;
-
-    float m_size;
-    
-    FontWidthVariant m_widthVariant;
-
-    unsigned hash() const
-    {
-        ASSERT(m_font != 0 || m_cgFont == 0);
-        uintptr_t hashCodes[3] = { (uintptr_t)m_font, m_widthVariant, m_orientation << 2 | m_syntheticBold << 1 | m_syntheticOblique };
-        return WTF::StringHasher::createBlobHash<sizeof(hashCodes)>(hashCodes);
-    }
-
-    const FontPlatformData& operator=(const FontPlatformData& f);
-
-    bool operator==(const FontPlatformData& other) const
-    { 
-        return m_font == other.m_font && m_syntheticBold == other.m_syntheticBold && m_syntheticOblique == other.m_syntheticOblique && 
-               m_cgFont == other.m_cgFont && m_size == other.m_size && m_orientation == other.m_orientation && m_widthVariant == other.m_widthVariant;
-    }
-
-    NSFont *font() const { return m_font; }
-    void setFont(NSFont *font);
-
-    CTFontRef ctFont() const;
-
-    bool roundsGlyphAdvances() const;
-    bool allowsLigatures() const;
-    bool isColorBitmapFont() const { return m_isColorBitmapFont; }
-
-#ifndef BUILDING_ON_TIGER
-    CGFontRef cgFont() const { return m_cgFont.get(); }
-#else
-    CGFontRef cgFont() const { return m_cgFont; }
-#endif
-
-#ifndef NDEBUG
-    String description() const;
-#endif
-
-private:
-    static NSFont *hashTableDeletedFontValue() { return reinterpret_cast<NSFont *>(-1); }
-    
-    // Load various data about the font specified by |nsFont| with the size fontSize into the following output paramters:
-    // Note: Callers should always take into account that for the Chromium port, |outNSFont| isn't necessarily the same
-    // font as |nsFont|.  This because the sandbox may block loading of the original font.
-    // * outNSFont - The font that was actually loaded, for the Chromium port this may be different than nsFont.
-    // The caller is responsible for calling CFRelease() on this parameter when done with it.
-    // * cgFont - CGFontRef representing the input font at the specified point size.
-    void loadFont(NSFont* nsFont, float fontSize, NSFont*& outNSFont, CGFontRef& cgFont);
-
-    NSFont *m_font;
-
-#ifndef BUILDING_ON_TIGER
-    RetainPtr<CGFontRef> m_cgFont;
-#else
-    CGFontRef m_cgFont; // It is not necessary to refcount this, since either an NSFont owns it or some CachedFont has it referenced.
-#endif
-
-    mutable RetainPtr<CTFontRef> m_CTFont;
-
-    bool m_isColorBitmapFont;
-    
-#if PLATFORM(CHROMIUM) && OS(DARWIN)
-    RefPtr<MemoryActivatedFont> m_inMemoryFont;
-#endif
-};
-
-} // namespace WebCore
-
-#endif
diff --git a/Source/WebCore/platform/graphics/cocoa/FontPlatformDataCocoa.mm b/Source/WebCore/platform/graphics/cocoa/FontPlatformDataCocoa.mm
index b40f698..6a17707 100644
--- a/Source/WebCore/platform/graphics/cocoa/FontPlatformDataCocoa.mm
+++ b/Source/WebCore/platform/graphics/cocoa/FontPlatformDataCocoa.mm
@@ -45,9 +45,12 @@ void FontPlatformData::loadFont(NSFont* nsFont, float, NSFont*& outNSFont, CGFon
 }
 #endif  // PLATFORM(MAC)
 
-FontPlatformData::FontPlatformData(NSFont *nsFont, float size, bool syntheticBold, bool syntheticOblique, FontOrientation orientation, FontWidthVariant widthVariant)
+FontPlatformData::FontPlatformData(NSFont *nsFont, float size, bool syntheticBold, bool syntheticOblique, FontOrientation orientation,
+                                   TextOrientation textOrientation, FontWidthVariant widthVariant)
     : m_syntheticBold(syntheticBold)
     , m_syntheticOblique(syntheticOblique)
+    , m_orientation(orientation)
+    , m_textOrientation(textOrientation)
     , m_size(size)
     , m_widthVariant(widthVariant)
     , m_font(nsFont)
@@ -64,8 +67,6 @@ FontPlatformData::FontPlatformData(NSFont *nsFont, float size, bool syntheticBol
     CGFontRef cgFont = 0;
     loadFont(nsFont, size, m_font, cgFont);
 
-    m_orientation = orientation;
-
     if (m_font)
         CFRetain(m_font);
 
@@ -76,35 +77,26 @@ FontPlatformData::FontPlatformData(NSFont *nsFont, float size, bool syntheticBol
 #endif
 }
 
-FontPlatformData::FontPlatformData(const FontPlatformData& f)
+FontPlatformData:: ~FontPlatformData()
+{
+    if (m_font && m_font != reinterpret_cast<NSFont *>(-1))
+        CFRelease(m_font);
+}
+
+void FontPlatformData::platformDataInit(const FontPlatformData& f)
 {
     m_font = f.m_font && f.m_font != reinterpret_cast<NSFont *>(-1) ? const_cast<NSFont *>(static_cast<const NSFont *>(CFRetain(f.m_font))) : f.m_font;
 
-    m_syntheticBold = f.m_syntheticBold;
-    m_syntheticOblique = f.m_syntheticOblique;
-    m_size = f.m_size;
-    m_widthVariant = f.m_widthVariant;
     m_cgFont = f.m_cgFont;
-    m_isColorBitmapFont = f.m_isColorBitmapFont;
-    m_orientation = f.m_orientation;
     m_CTFont = f.m_CTFont;
+
 #if PLATFORM(CHROMIUM) && OS(DARWIN)
     m_inMemoryFont = f.m_inMemoryFont;
 #endif
 }
 
-FontPlatformData:: ~FontPlatformData()
+const FontPlatformData& FontPlatformData::platformDataAssign(const FontPlatformData& f)
 {
-    if (m_font && m_font != reinterpret_cast<NSFont *>(-1))
-        CFRelease(m_font);
-}
-
-const FontPlatformData& FontPlatformData::operator=(const FontPlatformData& f)
-{
-    m_syntheticBold = f.m_syntheticBold;
-    m_syntheticOblique = f.m_syntheticOblique;
-    m_size = f.m_size;
-    m_widthVariant = f.m_widthVariant;
     m_cgFont = f.m_cgFont;
     if (m_font == f.m_font)
         return *this;
@@ -113,8 +105,6 @@ const FontPlatformData& FontPlatformData::operator=(const FontPlatformData& f)
     if (m_font && m_font != reinterpret_cast<NSFont *>(-1))
         CFRelease(m_font);
     m_font = f.m_font;
-    m_isColorBitmapFont = f.m_isColorBitmapFont;
-    m_orientation = f.m_orientation;
     m_CTFont = f.m_CTFont;
 #if PLATFORM(CHROMIUM) && OS(DARWIN)
     m_inMemoryFont = f.m_inMemoryFont;
@@ -122,6 +112,12 @@ const FontPlatformData& FontPlatformData::operator=(const FontPlatformData& f)
     return *this;
 }
 
+bool FontPlatformData::platformIsEqual(const FontPlatformData& other) const
+{
+    return m_font == other.m_font
+        && m_cgFont == other.m_cgFont;
+}
+
 void FontPlatformData::setFont(NSFont *font)
 {
     ASSERT_ARG(font, font);
diff --git a/Source/WebCore/platform/graphics/freetype/FontCustomPlatformDataFreeType.cpp b/Source/WebCore/platform/graphics/freetype/FontCustomPlatformDataFreeType.cpp
index 841c8a3..b1cf96b 100644
--- a/Source/WebCore/platform/graphics/freetype/FontCustomPlatformDataFreeType.cpp
+++ b/Source/WebCore/platform/graphics/freetype/FontCustomPlatformDataFreeType.cpp
@@ -59,7 +59,7 @@ FontCustomPlatformData::~FontCustomPlatformData()
     cairo_font_face_destroy(m_fontFace);
 }
 
-FontPlatformData FontCustomPlatformData::fontPlatformData(int size, bool bold, bool italic, FontOrientation, FontWidthVariant, FontRenderingMode)
+FontPlatformData FontCustomPlatformData::fontPlatformData(int size, bool bold, bool italic, FontOrientation, TextOrientation, FontWidthVariant, FontRenderingMode)
 {
     return FontPlatformData(m_fontFace, size, bold, italic);
 }
diff --git a/Source/WebCore/platform/graphics/freetype/FontPlatformData.h b/Source/WebCore/platform/graphics/freetype/FontPlatformData.h
index 2841b14..d1cb605 100644
--- a/Source/WebCore/platform/graphics/freetype/FontPlatformData.h
+++ b/Source/WebCore/platform/graphics/freetype/FontPlatformData.h
@@ -71,6 +71,7 @@ public:
     bool hasCompatibleCharmap();
 
     FontOrientation orientation() const { return Horizontal; } // FIXME: Implement.
+    void setOrientation(FontOrientation) { } // FIXME: Implement.
 
     cairo_scaled_font_t* scaledFont() const { return m_scaledFont; }
 
diff --git a/Source/WebCore/platform/graphics/gpu/BicubicShader.cpp b/Source/WebCore/platform/graphics/gpu/BicubicShader.cpp
new file mode 100644
index 0000000..40c9843
--- /dev/null
+++ b/Source/WebCore/platform/graphics/gpu/BicubicShader.cpp
@@ -0,0 +1,137 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(ACCELERATED_2D_CANVAS)
+
+#include "BicubicShader.h"
+
+#include "GraphicsContext3D.h"
+
+namespace WebCore {
+
+BicubicShader::BicubicShader(GraphicsContext3D* context, unsigned program)
+    : Shader(context, program)
+    , m_matrixLocation(context->getUniformLocation(program, "matrix"))
+    , m_texMatrixLocation(context->getUniformLocation(program, "texMatrix"))
+    , m_coefficientsLocation(context->getUniformLocation(program, "coefficients"))
+    , m_imageIncrementLocation(context->getUniformLocation(program, "imageIncrement"))
+    , m_imageLocation(context->getUniformLocation(program, "image"))
+    , m_alphaLocation(context->getUniformLocation(program, "alpha"))
+    , m_positionLocation(context->getAttribLocation(program, "position"))
+{
+}
+
+PassOwnPtr<BicubicShader> BicubicShader::create(GraphicsContext3D* context)
+{
+    static const char* vertexShaderSource =
+        "uniform mat3 matrix;\n"
+        "uniform mat3 texMatrix;\n"
+        "attribute vec3 position;\n"
+        "varying vec2 texCoord;\n"
+        "void main() {\n"
+        "    texCoord = (texMatrix * position).xy;\n"
+        "    gl_Position = vec4(matrix * position, 1.0);\n"
+        "}\n";
+    static const char* fragmentShaderSource =
+        "#ifdef GL_ES\n"
+        "precision mediump float;\n"
+        "#endif\n"
+        "uniform sampler2D image;\n"
+        "uniform vec2 imageIncrement;\n"
+        "uniform mat4 coefficients;\n"
+        "uniform float alpha;\n"
+        "varying vec2 texCoord;\n"
+        "vec4 cubicBlend(float t, vec4 c0, vec4 c1, vec4 c2, vec4 c3) {\n"
+        "    vec4 ts = vec4(1.0, t, t * t, t * t * t);\n"
+        "    vec4 result = coefficients * ts;\n"
+        "    return result.w * c0 + result.z * c1 + result.y * c2 + result.x * c3;\n"
+        "}\n"
+        "void main() {\n"
+        "    vec2 imageCoord = texCoord;\n"
+        "    vec2 f = fract(imageCoord / imageIncrement) - vec2(0.5, 0.5);\n"
+        "    vec4 t00 = texture2D(image, imageCoord + imageIncrement * vec2(-1, -1));\n"
+        "    vec4 t10 = texture2D(image, imageCoord + imageIncrement * vec2( 0, -1));\n"
+        "    vec4 t20 = texture2D(image, imageCoord + imageIncrement * vec2( 1, -1));\n"
+        "    vec4 t30 = texture2D(image, imageCoord + imageIncrement * vec2( 2, -1));\n"
+        "    vec4 t0 = cubicBlend(f.x, t00, t10, t20, t30);\n"
+        "    vec4 t01 = texture2D(image, imageCoord + imageIncrement * vec2(-1, 0));\n"
+        "    vec4 t11 = texture2D(image, imageCoord + imageIncrement * vec2( 0, 0));\n"
+        "    vec4 t21 = texture2D(image, imageCoord + imageIncrement * vec2( 1, 0));\n"
+        "    vec4 t31 = texture2D(image, imageCoord + imageIncrement * vec2( 2, 0));\n"
+        "    vec4 t1 = cubicBlend(f.x, t01, t11, t21, t31);\n"
+        "    vec4 t02 = texture2D(image, imageCoord + imageIncrement * vec2(-1, 1));\n"
+        "    vec4 t12 = texture2D(image, imageCoord + imageIncrement * vec2( 0, 1));\n"
+        "    vec4 t22 = texture2D(image, imageCoord + imageIncrement * vec2( 1, 1));\n"
+        "    vec4 t32 = texture2D(image, imageCoord + imageIncrement * vec2( 2, 1));\n"
+        "    vec4 t2 = cubicBlend(f.x, t02, t12, t22, t32);\n"
+        "    vec4 t03 = texture2D(image, imageCoord + imageIncrement * vec2(-1, 2));\n"
+        "    vec4 t13 = texture2D(image, imageCoord + imageIncrement * vec2( 0, 2));\n"
+        "    vec4 t23 = texture2D(image, imageCoord + imageIncrement * vec2( 1, 2));\n"
+        "    vec4 t33 = texture2D(image, imageCoord + imageIncrement * vec2( 2, 2));\n"
+        "    vec4 t3 = cubicBlend(f.x, t03, t13, t23, t33);\n"
+        "    gl_FragColor = cubicBlend(f.y, t0, t1, t2, t3);\n"
+        "}\n";
+
+    unsigned program = loadProgram(context, vertexShaderSource, fragmentShaderSource);
+    if (!program)
+        return 0;
+
+    return new BicubicShader(context, program);
+}
+
+void BicubicShader::use(const AffineTransform& transform, const AffineTransform& texTransform, const float coefficients[16], const float imageIncrement[2], float alpha)
+{
+    m_context->useProgram(m_program);
+    float matrix[9];
+    affineTo3x3(transform, matrix);
+    m_context->uniformMatrix3fv(m_matrixLocation, false /*transpose*/, matrix, 1 /*count*/);
+
+    float texMatrix[9];
+    affineTo3x3(texTransform, texMatrix);
+    m_context->uniformMatrix3fv(m_texMatrixLocation, false /*transpose*/, texMatrix, 1 /*count*/);
+    m_context->uniformMatrix4fv(m_coefficientsLocation, false /*transpose*/, const_cast<float *>(coefficients), 1 /*count*/);
+
+    m_context->uniform2f(m_imageIncrementLocation, imageIncrement[0], imageIncrement[1]);
+
+    // For now, we always use texture unit 0. If that ever changes, we should
+    // expose this parameter to the caller.
+    m_context->uniform1i(m_imageLocation, 0);
+    m_context->uniform1f(m_alphaLocation, alpha);
+
+    m_context->vertexAttribPointer(m_positionLocation, 3, GraphicsContext3D::FLOAT, false, 0, 0);
+
+    m_context->enableVertexAttribArray(m_positionLocation);
+}
+
+}
+
+#endif
diff --git a/Source/WebCore/platform/graphics/gpu/BicubicShader.h b/Source/WebCore/platform/graphics/gpu/BicubicShader.h
new file mode 100644
index 0000000..f7522f4
--- /dev/null
+++ b/Source/WebCore/platform/graphics/gpu/BicubicShader.h
@@ -0,0 +1,58 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef BicubicShader_h
+#define BicubicShader_h
+
+#include "Shader.h"
+
+namespace WebCore {
+
+class BicubicShader : public Shader {
+public:
+    static PassOwnPtr<BicubicShader> create(GraphicsContext3D*);
+
+    void use(const AffineTransform&, const AffineTransform& texTransform, const float coefficients[16], const float imageIncrement[2], float alpha);
+
+private:
+    BicubicShader(GraphicsContext3D*, unsigned program);
+
+    int m_matrixLocation;
+    int m_texMatrixLocation;
+    int m_coefficientsLocation;
+    int m_imageIncrementLocation;
+    int m_imageLocation;
+    int m_alphaLocation;
+    int m_positionLocation;
+};
+
+}
+
+#endif // BicubicShader_h
diff --git a/Source/WebCore/platform/graphics/gpu/ConvolutionShader.cpp b/Source/WebCore/platform/graphics/gpu/ConvolutionShader.cpp
new file mode 100644
index 0000000..f0b6bd9
--- /dev/null
+++ b/Source/WebCore/platform/graphics/gpu/ConvolutionShader.cpp
@@ -0,0 +1,125 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(ACCELERATED_2D_CANVAS)
+
+#include "ConvolutionShader.h"
+
+#include "GraphicsContext3D.h"
+#include "StringExtras.h"
+
+namespace WebCore {
+
+ConvolutionShader::ConvolutionShader(GraphicsContext3D* context, unsigned program, int kernelWidth)
+    : Shader(context, program)
+    , m_kernelWidth(kernelWidth)
+    , m_matrixLocation(context->getUniformLocation(program, "matrix"))
+    , m_texMatrixLocation(context->getUniformLocation(program, "texMatrix"))
+    , m_kernelLocation(context->getUniformLocation(program, "kernel"))
+    , m_imageLocation(context->getUniformLocation(program, "image"))
+    , m_imageIncrementLocation(context->getUniformLocation(program, "imageIncrement"))
+    , m_positionLocation(context->getAttribLocation(program, "position"))
+{
+}
+
+PassOwnPtr<ConvolutionShader> ConvolutionShader::create(GraphicsContext3D* context, int kernelWidth)
+{
+    static const char* vertexShaderRaw =
+        "#define KERNEL_WIDTH %d\n"
+        "uniform mat3 matrix;\n"
+        "uniform mat3 texMatrix;\n"
+        "uniform vec2 imageIncrement;\n"
+        "attribute vec3 position;\n"
+        "varying vec2 imageCoord;\n"
+        "void main() {\n"
+        "    // Offset image coords by half of kernel width, in image texels\n"
+        "    gl_Position = vec4(matrix * position, 1.0);\n"
+        "    float scale = (float(KERNEL_WIDTH) - 1.0) / 2.0;\n"
+        "    imageCoord = (texMatrix * position).xy - vec2(scale, scale) * imageIncrement;\n"
+        "}\n";
+    char vertexShaderSource[1024];
+    snprintf(vertexShaderSource, sizeof(vertexShaderSource), vertexShaderRaw, kernelWidth);
+    static const char* fragmentShaderRaw =
+        "#ifdef GL_ES\n"
+        "precision mediump float;\n"
+        "#endif\n"
+        "#define KERNEL_WIDTH %d\n"
+        "uniform sampler2D image;\n"
+        "uniform float kernel[KERNEL_WIDTH];\n"
+        "uniform vec2 imageIncrement;\n"
+        "varying vec2 imageCoord;\n"
+        "void main() {\n"
+        "    vec2 coord = imageCoord;\n"
+        "    vec4 sum = vec4(0, 0, 0, 0);\n"
+        "    for (int i = 0; i < KERNEL_WIDTH; i++) {\n"
+        "      sum += texture2D(image, coord) * kernel[i];\n"
+        "      coord += imageIncrement;\n"
+        "    }\n"
+        "    gl_FragColor = sum;\n"
+        "}\n";
+    char fragmentShaderSource[1024];
+    snprintf(fragmentShaderSource, sizeof(fragmentShaderSource), fragmentShaderRaw, kernelWidth);
+
+    unsigned program = loadProgram(context, vertexShaderSource, fragmentShaderSource);
+    if (!program)
+        return 0;
+    return new ConvolutionShader(context, program, kernelWidth);
+}
+
+void ConvolutionShader::use(const AffineTransform& transform, const AffineTransform& texTransform, const float* kernel, int kernelWidth, float imageIncrement[2])
+{
+    m_context->useProgram(m_program);
+    float matrix[9];
+    affineTo3x3(transform, matrix);
+    m_context->uniformMatrix3fv(m_matrixLocation, false /*transpose*/, matrix, 1 /*count*/);
+
+    float texMatrix[9];
+    affineTo3x3(texTransform, texMatrix);
+    m_context->uniformMatrix3fv(m_texMatrixLocation, false /*transpose*/, texMatrix, 1 /*count*/);
+
+    m_context->uniform2f(m_imageIncrementLocation, imageIncrement[0], imageIncrement[1]);
+
+    // For now, we always use texture unit 0. If that ever changes, we should
+    // expose this parameter to the caller.
+    m_context->uniform1i(m_imageLocation, 0);
+    if (kernelWidth > m_kernelWidth)
+        kernelWidth = m_kernelWidth;
+    m_context->uniform1fv(m_kernelLocation, const_cast<float*>(kernel), kernelWidth);
+
+    m_context->vertexAttribPointer(m_positionLocation, 3, GraphicsContext3D::FLOAT, false, 0, 0);
+
+    m_context->enableVertexAttribArray(m_positionLocation);
+}
+
+}
+
+#endif
diff --git a/Source/WebCore/platform/graphics/gpu/ConvolutionShader.h b/Source/WebCore/platform/graphics/gpu/ConvolutionShader.h
new file mode 100644
index 0000000..533e0f5
--- /dev/null
+++ b/Source/WebCore/platform/graphics/gpu/ConvolutionShader.h
@@ -0,0 +1,58 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef ConvolutionShader_h
+#define ConvolutionShader_h
+
+#include "Shader.h"
+
+namespace WebCore {
+
+class ConvolutionShader : public Shader {
+public:
+    static PassOwnPtr<ConvolutionShader> create(GraphicsContext3D*, int kernelWidth);
+
+    void use(const AffineTransform&, const AffineTransform& texTransform, const float* kernel, int kernelWidth, float imageIncrement[2]);
+
+private:
+    ConvolutionShader(GraphicsContext3D*, unsigned program, int kernelWidth);
+
+    int m_kernelWidth;
+    int m_matrixLocation;
+    int m_texMatrixLocation;
+    int m_kernelLocation;
+    int m_imageLocation;
+    int m_imageIncrementLocation;
+    int m_positionLocation;
+};
+
+}
+
+#endif // ConvolutionShader_h
diff --git a/Source/WebCore/platform/graphics/gpu/DrawingBuffer.h b/Source/WebCore/platform/graphics/gpu/DrawingBuffer.h
index 49ae114..606484e 100644
--- a/Source/WebCore/platform/graphics/gpu/DrawingBuffer.h
+++ b/Source/WebCore/platform/graphics/gpu/DrawingBuffer.h
@@ -42,6 +42,10 @@
 #include <wtf/RetainPtr.h>
 #endif
 
+#if ENABLE(SKIA_GPU)
+class GrContext;
+#endif
+
 namespace WebCore {
 
 #if PLATFORM(CHROMIUM)
@@ -59,6 +63,7 @@ public:
     void reset(const IntSize&);
     void bind();
     IntSize size() const { return m_size; }
+    Platform3DObject colorBuffer() const { return m_colorBuffer; }
 
     // Clear all resources from this object, as well as context. Called when context is destroyed
     // to prevent invalid accesses to the resources.
@@ -94,6 +99,10 @@ public:
     void setWillPublishCallback(PassOwnPtr<WillPublishCallback> callback) { m_callback = callback; }
 #endif
 
+#if ENABLE(SKIA_GPU)
+    void setGrContext(GrContext* ctx);
+#endif
+
     PassRefPtr<GraphicsContext3D> graphicsContext3D() const { return m_context; }
 
 private:
@@ -130,6 +139,10 @@ private:
 #if PLATFORM(MAC)
     RetainPtr<WebGLLayer> m_platformLayer;
 #endif
+
+#if ENABLE(SKIA_GPU)
+    GrContext* m_grContext;
+#endif
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/graphics/gpu/LoopBlinnPathProcessor.cpp b/Source/WebCore/platform/graphics/gpu/LoopBlinnPathProcessor.cpp
index 5439885..a96213c 100644
--- a/Source/WebCore/platform/graphics/gpu/LoopBlinnPathProcessor.cpp
+++ b/Source/WebCore/platform/graphics/gpu/LoopBlinnPathProcessor.cpp
@@ -42,6 +42,8 @@
 #include <algorithm>
 #include <wtf/Assertions.h>
 #include <wtf/FastMalloc.h>
+#include <wtf/UnusedParam.h>
+
 
 #if USE(SKIA)
 #include "SkGeometry.h"
@@ -701,6 +703,7 @@ void LoopBlinnPathProcessor::buildContours(const Path& path)
         }
     } while (verb != SkPath::kDone_Verb);
 #else // !USE(SKIA)
+    UNUSED_PARAM(path);
     // Must port to your platform.
     ASSERT_NOT_REACHED();
 #endif
@@ -1145,6 +1148,8 @@ static void combineCallback(GLdouble coords[3], void* vertexData[4],
                             GLfloat weight[4], void** outData,
                             void* polygonData)
 {
+    UNUSED_PARAM(vertexData);
+    UNUSED_PARAM(weight);
     TessellationState* state = static_cast<TessellationState*>(polygonData);
     GLdouble* outVertex = static_cast<GLdouble*>(fastMalloc(3 * sizeof(GLdouble)));
     state->allocatedPointers.append(outVertex);
diff --git a/Source/WebCore/platform/graphics/gpu/PODRedBlackTree.h b/Source/WebCore/platform/graphics/gpu/PODRedBlackTree.h
index bd08988..7dd9ddd 100644
--- a/Source/WebCore/platform/graphics/gpu/PODRedBlackTree.h
+++ b/Source/WebCore/platform/graphics/gpu/PODRedBlackTree.h
@@ -257,7 +257,7 @@ private:
     // properly update such summary information based only on the values
     // in the left and right children. This method should return true if
     // the node's summary information changed.
-    virtual bool updateNode(Node* node) { return false; }
+    virtual bool updateNode(Node*) { return false; }
 
     //----------------------------------------------------------------------
     // Generic binary search tree operations
@@ -713,7 +713,7 @@ private:
     }
 
 #ifdef NDEBUG
-    void logIfVerbose(const char* output) const { }
+    void logIfVerbose(const char*) const { }
 #else
     void logIfVerbose(const char* output) const
     {
diff --git a/Source/WebCore/platform/graphics/gpu/SharedGraphicsContext3D.cpp b/Source/WebCore/platform/graphics/gpu/SharedGraphicsContext3D.cpp
index ea8bc71..662d6a8 100644
--- a/Source/WebCore/platform/graphics/gpu/SharedGraphicsContext3D.cpp
+++ b/Source/WebCore/platform/graphics/gpu/SharedGraphicsContext3D.cpp
@@ -35,7 +35,10 @@
 #include "SharedGraphicsContext3D.h"
 
 #include "AffineTransform.h"
+#include "BicubicShader.h"
 #include "Color.h"
+#include "ConvolutionShader.h"
+#include "DrawingBuffer.h"
 #include "Extensions3D.h"
 #include "FloatRect.h"
 #include "IntSize.h"
@@ -43,6 +46,15 @@
 #include "SolidFillShader.h"
 #include "TexShader.h"
 
+#if ENABLE(SKIA_GPU)
+#include "GrContext.h"
+// Limit the number of textures we hold in the bitmap->texture cache.
+static const int maxTextureCacheCount = 512;
+// Limit the bytes allocated toward textures in the bitmap->texture cache.
+static const size_t maxTextureCacheBytes = 50 * 1024 * 1024;
+#endif
+
+#include <wtf/OwnArrayPtr.h>
 #include <wtf/text/CString.h>
 #include <wtf/text/WTFString.h>
 
@@ -65,16 +77,30 @@ PassRefPtr<SharedGraphicsContext3D> SharedGraphicsContext3D::create(HostWindow*
     OwnPtr<TexShader> texShader = TexShader::create(context.get());
     if (!texShader)
         return 0;
-    return adoptRef(new SharedGraphicsContext3D(context.release(), solidFillShader.release(), texShader.release()));
+    OwnPtr<BicubicShader> bicubicShader = BicubicShader::create(context.get());
+    if (!bicubicShader)
+        return 0;
+    OwnArrayPtr<OwnPtr<ConvolutionShader> > convolutionShaders = adoptArrayPtr(new OwnPtr<ConvolutionShader>[cMaxKernelWidth]);
+    for (int i = 0; i < cMaxKernelWidth; ++i) {
+        convolutionShaders[i] = ConvolutionShader::create(context.get(), i + 1);
+        if (!convolutionShaders[i])
+            return 0;
+    }
+    return adoptRef(new SharedGraphicsContext3D(context.release(), solidFillShader.release(), texShader.release(), bicubicShader.release(), convolutionShaders.release()));
 }
 
-SharedGraphicsContext3D::SharedGraphicsContext3D(PassRefPtr<GraphicsContext3D> context, PassOwnPtr<SolidFillShader> solidFillShader, PassOwnPtr<TexShader> texShader)
+SharedGraphicsContext3D::SharedGraphicsContext3D(PassRefPtr<GraphicsContext3D> context, PassOwnPtr<SolidFillShader> solidFillShader, PassOwnPtr<TexShader> texShader, PassOwnPtr<BicubicShader> bicubicShader, PassOwnArrayPtr<OwnPtr<ConvolutionShader> > convolutionShaders)
     : m_context(context)
     , m_bgraSupported(false)
     , m_quadVertices(0)
     , m_solidFillShader(solidFillShader)
     , m_texShader(texShader)
+    , m_bicubicShader(bicubicShader)
+    , m_convolutionShaders(convolutionShaders)
     , m_oesStandardDerivativesSupported(false)
+#if ENABLE(SKIA_GPU)
+    , m_grContext(0)
+#endif
 {
     allContexts()->add(this);
     Extensions3D* extensions = m_context->getExtensions();
@@ -92,6 +118,9 @@ SharedGraphicsContext3D::~SharedGraphicsContext3D()
 {
     m_context->deleteBuffer(m_quadVertices);
     allContexts()->remove(this);
+#if ENABLE(SKIA_GPU)
+    GrSafeUnref(m_grContext);
+#endif
 }
 
 void SharedGraphicsContext3D::makeContextCurrent()
@@ -369,6 +398,17 @@ void SharedGraphicsContext3D::useTextureProgram(const AffineTransform& transform
     m_texShader->use(transform, texTransform, 0, alpha);
 }
 
+void SharedGraphicsContext3D::useBicubicProgram(const AffineTransform& transform, const AffineTransform& texTransform, const float coefficients[16], const float imageIncrement[2], float alpha)
+{
+    m_bicubicShader->use(transform, texTransform, coefficients, imageIncrement, alpha);
+}
+
+void SharedGraphicsContext3D::useConvolutionProgram(const AffineTransform& transform, const AffineTransform& texTransform, const float* kernel, int kernelWidth, float imageIncrement[2])
+{
+    ASSERT(kernelWidth >= 1 && kernelWidth <= cMaxKernelWidth);
+    m_convolutionShaders[kernelWidth - 1]->use(transform, texTransform, kernel, kernelWidth, imageIncrement);
+}
+
 void SharedGraphicsContext3D::bindFramebuffer(Platform3DObject framebuffer)
 {
     m_context->bindFramebuffer(GraphicsContext3D::FRAMEBUFFER, framebuffer);
@@ -411,6 +451,31 @@ void SharedGraphicsContext3D::useLoopBlinnExteriorProgram(unsigned vertexOffset,
     m_loopBlinnExteriorShader->use(vertexOffset, klmOffset, transform, color);
 }
 
+DrawingBuffer* SharedGraphicsContext3D::getOffscreenBuffer(unsigned index, const IntSize& size)
+{
+    if (index >= m_offscreenBuffers.size())
+        m_offscreenBuffers.resize(index + 1);
+
+    if (!m_offscreenBuffers[index])
+        m_offscreenBuffers[index] = m_context->createDrawingBuffer(size);
+
+    if (size.width() != m_offscreenBuffers[index]->size().width()
+        || size.height() != m_offscreenBuffers[index]->size().height())
+        m_offscreenBuffers[index]->reset(size);
+    return m_offscreenBuffers[index].get();
+}
+
+#if ENABLE(SKIA_GPU)
+GrContext* SharedGraphicsContext3D::grContext()
+{
+    if (!m_grContext) {
+        m_grContext = GrContext::CreateGLShaderContext();
+        m_grContext->setTextureCacheLimits(maxTextureCacheCount, maxTextureCacheBytes);
+    }
+    return m_grContext;
+}
+#endif
+
 } // namespace WebCore
 
 #endif
diff --git a/Source/WebCore/platform/graphics/gpu/SharedGraphicsContext3D.h b/Source/WebCore/platform/graphics/gpu/SharedGraphicsContext3D.h
index 707fd24..8fb3d50 100644
--- a/Source/WebCore/platform/graphics/gpu/SharedGraphicsContext3D.h
+++ b/Source/WebCore/platform/graphics/gpu/SharedGraphicsContext3D.h
@@ -38,14 +38,22 @@
 
 #include <wtf/HashMap.h>
 #include <wtf/HashSet.h>
+#include <wtf/OwnArrayPtr.h>
 #include <wtf/OwnPtr.h>
 #include <wtf/RefCounted.h>
 #include <wtf/RefPtr.h>
 
+#if ENABLE(SKIA_GPU)
+class GrContext;
+#endif
+
 namespace WebCore {
 
 class AffineTransform;
+class BicubicShader;
 class Color;
+class ConvolutionShader;
+class DrawingBuffer;
 class FloatRect;
 class HostWindow;
 class IntSize;
@@ -101,6 +109,8 @@ public:
 
     void useFillSolidProgram(const AffineTransform&, const Color&);
     void useTextureProgram(const AffineTransform&, const AffineTransform&, float alpha);
+    void useBicubicProgram(const AffineTransform&, const AffineTransform&, const float coefficients[16], const float imageIncrement[2], float alpha);
+    void useConvolutionProgram(const AffineTransform&, const AffineTransform& texTransform, const float* kernel, int kernelWidth, float imageIncrement[2]);
 
     void setActiveTexture(GC3Denum textureUnit);
     void bindTexture(GC3Denum target, Platform3DObject texture);
@@ -127,9 +137,14 @@ public:
     static bool useLoopBlinnForPathRendering();
     void useLoopBlinnInteriorProgram(unsigned vertexOffset, const AffineTransform&, const Color&);
     void useLoopBlinnExteriorProgram(unsigned vertexOffset, unsigned klmOffset, const AffineTransform&, const Color&);
+    DrawingBuffer* getOffscreenBuffer(unsigned index, const IntSize&);
+
+#if ENABLE(SKIA_GPU)
+    GrContext* grContext();
+#endif
 
 private:
-    SharedGraphicsContext3D(PassRefPtr<GraphicsContext3D>, PassOwnPtr<SolidFillShader>, PassOwnPtr<TexShader>);
+    SharedGraphicsContext3D(PassRefPtr<GraphicsContext3D>, PassOwnPtr<SolidFillShader>, PassOwnPtr<TexShader>, PassOwnPtr<BicubicShader>, PassOwnArrayPtr<OwnPtr<ConvolutionShader> >);
 
     // Used to implement removeTexturesFor(), see the comment above.
     static HashSet<SharedGraphicsContext3D*>* allContexts();
@@ -142,6 +157,8 @@ private:
 
     OwnPtr<SolidFillShader> m_solidFillShader;
     OwnPtr<TexShader> m_texShader;
+    OwnPtr<BicubicShader> m_bicubicShader;
+    OwnArrayPtr<OwnPtr<ConvolutionShader> > m_convolutionShaders;
 
     TextureHashMap m_textures;
 
@@ -150,8 +167,17 @@ private:
     OwnPtr<LoopBlinnSolidFillShader> m_loopBlinnInteriorShader;
     OwnPtr<LoopBlinnSolidFillShader> m_loopBlinnExteriorShader;
     bool m_oesStandardDerivativesSupported;
+
+    WTF::Vector<RefPtr<DrawingBuffer> > m_offscreenBuffers;
+
+#if ENABLE(SKIA_GPU)
+    GrContext* m_grContext;
+#endif
 };
 
+const float cMaxSigma = 4.0f;
+const int cMaxKernelWidth = 25;
+
 } // namespace WebCore
 
 #endif // SharedGraphicsContext3D_h
diff --git a/Source/WebCore/platform/graphics/gpu/TilingData.cpp b/Source/WebCore/platform/graphics/gpu/TilingData.cpp
index dd540b3..1370543 100644
--- a/Source/WebCore/platform/graphics/gpu/TilingData.cpp
+++ b/Source/WebCore/platform/graphics/gpu/TilingData.cpp
@@ -66,7 +66,7 @@ void TilingData::setTotalSize(int totalSizeX, int totalSizeY)
 
 void TilingData::setMaxTextureSize(int maxTextureSize)
 {
-    m_maxTextureSize = m_maxTextureSize;
+    m_maxTextureSize = maxTextureSize;
     recomputeNumTiles();
 }
 
diff --git a/Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp b/Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp
index 3763ef7..2fb4cef 100644
--- a/Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp
+++ b/Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp
@@ -117,6 +117,13 @@ gboolean mediaPlayerPrivateMessageCallback(GstBus* bus, GstMessage* message, gpo
             || err->code == GST_RESOURCE_ERROR_NOT_FOUND)
             error = MediaPlayer::FormatError;
         else if (err->domain == GST_STREAM_ERROR) {
+            // Let the mediaPlayerClient handle the stream error, in
+            // this case the HTMLMediaElement will emit a stalled
+            // event.
+            if (err->code == GST_STREAM_ERROR_TYPE_NOT_FOUND) {
+                LOG_VERBOSE(Media, "Decode error, let the Media element emit a stalled event.");
+                break;
+            }
             error = MediaPlayer::DecodeError;
             attemptNextLocation = true;
         } else if (err->domain == GST_RESOURCE_ERROR)
@@ -495,7 +502,7 @@ float MediaPlayerPrivateGStreamer::currentTime() const
         return 0.0f;
 
     if (m_seeking)
-        return static_cast<float>(m_seekTime);
+        return m_seekTime;
 
     return playbackPosition(m_playBin);
 
@@ -513,17 +520,28 @@ void MediaPlayerPrivateGStreamer::seek(float time)
     if (m_errorOccured)
         return;
 
-    GstClockTime sec = (GstClockTime)(static_cast<float>(time * GST_SECOND));
-    LOG_VERBOSE(Media, "Seek: %" GST_TIME_FORMAT, GST_TIME_ARGS(sec));
+    // Extract the integer part of the time (seconds) and the
+    // fractional part (microseconds). Attempt to round the
+    // microseconds so no floating point precision is lost and we can
+    // perform an accurate seek.
+    float seconds;
+    float microSeconds = modf(time, &seconds) * 1000000;
+    GTimeVal timeValue;
+    timeValue.tv_sec = static_cast<glong>(seconds);
+    timeValue.tv_usec = static_cast<glong>(roundf(microSeconds / 10000) * 10000);
+
+    GstClockTime clockTime = GST_TIMEVAL_TO_TIME(timeValue);
+    LOG_VERBOSE(Media, "Seek: %" GST_TIME_FORMAT, GST_TIME_ARGS(clockTime));
+
     if (!gst_element_seek(m_playBin, m_player->rate(),
             GST_FORMAT_TIME,
-            (GstSeekFlags)(GST_SEEK_FLAG_FLUSH),
-            GST_SEEK_TYPE_SET, sec,
+            (GstSeekFlags)(GST_SEEK_FLAG_FLUSH | GST_SEEK_FLAG_ACCURATE),
+            GST_SEEK_TYPE_SET, clockTime,
             GST_SEEK_TYPE_NONE, GST_CLOCK_TIME_NONE))
         LOG_VERBOSE(Media, "Seek to %f failed", time);
     else {
         m_seeking = true;
-        m_seekTime = sec;
+        m_seekTime = time;
     }
 }
 
@@ -1046,15 +1064,9 @@ void MediaPlayerPrivateGStreamer::updateStates()
         if (!m_isStreaming && !m_buffering)
             return;
 
-        // Resume playback if a seek was performed in a live pipeline
-        // or during progressive download. That second use-case
-        // happens when the seek is performed to a region of the media
-        // that hasn't been downloaded yet.
         if (m_seeking) {
             shouldUpdateAfterSeek = true;
             m_seeking = false;
-            if (m_paused)
-                gst_element_set_state(m_playBin, GST_STATE_PLAYING);
         }
         break;
     case GST_STATE_CHANGE_FAILURE:
diff --git a/Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h b/Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h
index 11eb81b..8003887 100644
--- a/Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h
+++ b/Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h
@@ -161,7 +161,7 @@ class MediaPlayerPrivateGStreamer : public MediaPlayerPrivateInterface {
             GstElement* m_videoSinkBin;
             GstElement* m_fpsSink;
             GstElement* m_source;
-            GstClockTime m_seekTime;
+            float m_seekTime;
             bool m_changingRate;
             float m_endTime;
             bool m_isEndReached;
diff --git a/Source/WebCore/platform/graphics/gstreamer/WebKitWebSourceGStreamer.cpp b/Source/WebCore/platform/graphics/gstreamer/WebKitWebSourceGStreamer.cpp
index 86e3e7a..66ea9ba 100644
--- a/Source/WebCore/platform/graphics/gstreamer/WebKitWebSourceGStreamer.cpp
+++ b/Source/WebCore/platform/graphics/gstreamer/WebKitWebSourceGStreamer.cpp
@@ -352,7 +352,7 @@ static void webKitWebSrcStop(WebKitWebSrc* src, bool seeking)
     }
     priv->resourceHandle = 0;
 
-    if (priv->frame)
+    if (priv->frame && !seeking)
         priv->frame.release();
 
     GST_OBJECT_LOCK(src);
diff --git a/Source/WebCore/platform/graphics/gtk/FontGtk.cpp b/Source/WebCore/platform/graphics/gtk/FontGtk.cpp
index 216fb56..d14b052 100644
--- a/Source/WebCore/platform/graphics/gtk/FontGtk.cpp
+++ b/Source/WebCore/platform/graphics/gtk/FontGtk.cpp
@@ -35,6 +35,7 @@
 
 #include "CairoUtilities.h"
 #include "ContextShadow.h"
+#include "PlatformContextCairo.h"
 #include "GraphicsContext.h"
 #include "NotImplemented.h"
 #include "SimpleFontData.h"
@@ -44,7 +45,7 @@
 #include <pango/pango.h>
 #include <pango/pangocairo.h>
 
-#if defined(USE_FREETYPE)
+#if USE(FREETYPE)
 #include <pango/pangofc-fontmap.h>
 #endif
 
@@ -171,13 +172,13 @@ static gchar* convertUniCharToUTF8(const UChar* characters, gint length, int fro
 
 static void setPangoAttributes(const Font* font, const TextRun& run, PangoLayout* layout)
 {
-#if defined(USE_FREETYPE)
+#if USE(FREETYPE)
     if (font->primaryFont()->platformData().m_pattern) {
         PangoFontDescription* desc = pango_fc_font_description_from_pattern(font->primaryFont()->platformData().m_pattern.get(), FALSE);
         pango_layout_set_font_description(layout, desc);
         pango_font_description_free(desc);
     }
-#elif defined(USE_PANGO)
+#elif USE(PANGO)
     if (font->primaryFont()->platformData().m_font) {
         PangoFontDescription* desc = pango_font_describe(font->primaryFont()->platformData().m_font);
         pango_layout_set_font_description(layout, desc);
@@ -220,7 +221,7 @@ bool Font::canExpandAroundIdeographsInComplexText()
     return false;
 }
 
-static void drawGlyphsShadow(GraphicsContext* graphicsContext, cairo_t* context, const FloatPoint& point, PangoLayoutLine* layoutLine, PangoRegionType renderRegion)
+static void drawGlyphsShadow(GraphicsContext* graphicsContext, const FloatPoint& point, PangoLayoutLine* layoutLine, PangoRegionType renderRegion)
 {
     ContextShadow* shadow = graphicsContext->contextShadow();
     ASSERT(shadow);
@@ -232,6 +233,7 @@ static void drawGlyphsShadow(GraphicsContext* graphicsContext, cairo_t* context,
 
     // Optimize non-blurry shadows, by just drawing text without the ContextShadow.
     if (!shadow->mustUseContextShadow(graphicsContext)) {
+        cairo_t* context = graphicsContext->platformContext()->cr();
         cairo_save(context);
         cairo_translate(context, totalOffset.x(), totalOffset.y());
 
@@ -255,6 +257,7 @@ static void drawGlyphsShadow(GraphicsContext* graphicsContext, cairo_t* context,
         // because we don't want any bits and pieces of characters out of range to be
         // drawn. Since ContextShadow expects a consistent transform, we have to undo the
         // translation before calling endShadowLayer as well.
+        cairo_t* context = graphicsContext->platformContext()->cr();
         cairo_save(context);
         cairo_translate(context, totalOffset.x(), totalOffset.y());
         gdk_cairo_region(context, renderRegion);
@@ -268,14 +271,14 @@ static void drawGlyphsShadow(GraphicsContext* graphicsContext, cairo_t* context,
 
 void Font::drawComplexText(GraphicsContext* context, const TextRun& run, const FloatPoint& point, int from, int to) const
 {
-#if defined(USE_FREETYPE)
+#if USE(FREETYPE)
     if (!primaryFont()->platformData().m_pattern) {
         drawSimpleText(context, run, point, from, to);
         return;
     }
 #endif
 
-    cairo_t* cr = context->platformContext();
+    cairo_t* cr = context->platformContext()->cr();
     PangoLayout* layout = pango_cairo_create_layout(cr);
     setPangoAttributes(this, run, layout);
 
@@ -294,7 +297,7 @@ void Font::drawComplexText(GraphicsContext* context, const TextRun& run, const F
     int ranges[] = {start - utf8, end - utf8};
     partialRegion = gdk_pango_layout_line_get_clip_region(layoutLine, 0, 0, ranges, 1);
 
-    drawGlyphsShadow(context, cr, point, layoutLine, partialRegion);
+    drawGlyphsShadow(context, point, layoutLine, partialRegion);
 
     cairo_save(cr);
     cairo_translate(cr, point.x(), point.y());
@@ -348,7 +351,7 @@ static PangoLayout* getDefaultPangoLayout(const TextRun& run)
 
 float Font::floatWidthForComplexText(const TextRun& run, HashSet<const SimpleFontData*>* fallbackFonts, GlyphOverflow* overflow) const
 {
-#if defined(USE_FREETYPE)
+#if USE(FREETYPE)
     if (!primaryFont()->platformData().m_pattern)
         return floatWidthForSimpleText(run, 0, fallbackFonts, overflow);
 #endif
@@ -373,7 +376,7 @@ float Font::floatWidthForComplexText(const TextRun& run, HashSet<const SimpleFon
 
 int Font::offsetForPositionForComplexText(const TextRun& run, float xFloat, bool includePartialGlyphs) const
 {
-#if defined(USE_FREETYPE)
+#if USE(FREETYPE)
     if (!primaryFont()->platformData().m_pattern)
         return offsetForPositionForSimpleText(run, xFloat, includePartialGlyphs);
 #endif
@@ -401,7 +404,7 @@ int Font::offsetForPositionForComplexText(const TextRun& run, float xFloat, bool
 
 FloatRect Font::selectionRectForComplexText(const TextRun& run, const FloatPoint& point, int h, int from, int to) const
 {
-#if defined(USE_FREETYPE)
+#if USE(FREETYPE)
     if (!primaryFont()->platformData().m_pattern)
         return selectionRectForSimpleText(run, point, h, from, to);
 #endif
diff --git a/Source/WebCore/platform/graphics/gtk/IconGtk.cpp b/Source/WebCore/platform/graphics/gtk/IconGtk.cpp
index d56b52d..7fdc1f6 100644
--- a/Source/WebCore/platform/graphics/gtk/IconGtk.cpp
+++ b/Source/WebCore/platform/graphics/gtk/IconGtk.cpp
@@ -33,9 +33,9 @@
 #include "GraphicsContext.h"
 #include "MIMETypeRegistry.h"
 #include "PassRefPtr.h"
-#include <wtf/text/CString.h>
-
+#include "PlatformContextCairo.h"
 #include <gtk/gtk.h>
+#include <wtf/text/CString.h>
 
 namespace WebCore {
 
@@ -117,7 +117,7 @@ void Icon::paint(GraphicsContext* context, const IntRect& rect)
         return;
 
     // TODO: Scale/clip the image if necessary.
-    cairo_t* cr = context->platformContext();
+    cairo_t* cr = context->platformContext()->cr();
     cairo_save(cr);
     gdk_cairo_set_source_pixbuf(cr, m_icon, rect.x(), rect.y());
     cairo_paint(cr);
diff --git a/Source/WebCore/platform/graphics/gtk/ImageBufferGtk.cpp b/Source/WebCore/platform/graphics/gtk/ImageBufferGtk.cpp
index 2aa016e..3da0f9b 100644
--- a/Source/WebCore/platform/graphics/gtk/ImageBufferGtk.cpp
+++ b/Source/WebCore/platform/graphics/gtk/ImageBufferGtk.cpp
@@ -54,7 +54,7 @@ String ImageBuffer::toDataURL(const String& mimeType, const double* quality) con
     GError* error = 0;
     gboolean success = FALSE;
     if (type == "jpeg" && quality && *quality >= 0.0 && *quality <= 1.0) {
-        String qualityString = String::format("%f", *quality);
+        String qualityString = String::format("%f", *quality * 100.0);
         success = gdk_pixbuf_save_to_buffer(pixbuf.get(), &buffer.outPtr(), &bufferSize,
             type.utf8().data(), &error, "quality", qualityString.utf8().data(), NULL);
     } else {
diff --git a/Source/WebCore/platform/graphics/gtk/ImageGtk.cpp b/Source/WebCore/platform/graphics/gtk/ImageGtk.cpp
index 623ace6..9dd82a9 100644
--- a/Source/WebCore/platform/graphics/gtk/ImageGtk.cpp
+++ b/Source/WebCore/platform/graphics/gtk/ImageGtk.cpp
@@ -152,7 +152,10 @@ PassRefPtr<Image> Image::loadPlatformThemeIcon(const char* name, int size)
 
 GdkPixbuf* BitmapImage::getGdkPixbuf()
 {
-    return cairoImageSurfaceToGdkPixbuf(frameAtIndex(currentFrame()));
+    cairo_surface_t* frame = frameAtIndex(currentFrame());
+    if (!frame)
+        return 0;
+    return cairoImageSurfaceToGdkPixbuf(frame);
 }
 
 }
diff --git a/Source/WebCore/platform/graphics/haiku/FontCustomPlatformData.cpp b/Source/WebCore/platform/graphics/haiku/FontCustomPlatformData.cpp
index 017b1e4..352de67 100644
--- a/Source/WebCore/platform/graphics/haiku/FontCustomPlatformData.cpp
+++ b/Source/WebCore/platform/graphics/haiku/FontCustomPlatformData.cpp
@@ -31,7 +31,7 @@ FontCustomPlatformData::~FontCustomPlatformData()
 {
 }
 
-FontPlatformData FontCustomPlatformData::fontPlatformData(int size, bool bold, bool italic, FontOrientation, FontWidthVariant, FontRenderingMode)
+FontPlatformData FontCustomPlatformData::fontPlatformData(int size, bool bold, bool italic, FontOrientation, TextOrientation, FontWidthVariant, FontRenderingMode)
 {
     return FontPlatformData(size, bold, italic);
 }
diff --git a/Source/WebCore/platform/graphics/haiku/FontCustomPlatformData.h b/Source/WebCore/platform/graphics/haiku/FontCustomPlatformData.h
index 7ffe89a..a319ce5 100644
--- a/Source/WebCore/platform/graphics/haiku/FontCustomPlatformData.h
+++ b/Source/WebCore/platform/graphics/haiku/FontCustomPlatformData.h
@@ -24,6 +24,7 @@
 #include "FontOrientation.h"
 #include "FontRenderingMode.h"
 #include "FontWidthVariant.h"
+#include "TextOrientation.h"
 #include <wtf/Forward.h>
 
 namespace WebCore {
@@ -39,7 +40,7 @@ namespace WebCore {
 
         static bool supportsFormat(const String&);
 
-        FontPlatformData fontPlatformData(int size, bool bold, bool italic, FontOrientation = Horizontal, FontWidthVariant = RegularWidth, FontRenderingMode = NormalRenderingMode);
+        FontPlatformData fontPlatformData(int size, bool bold, bool italic, FontOrientation = Horizontal, TextOrientation = TextOrientationVerticalRight, FontWidthVariant = RegularWidth, FontRenderingMode = NormalRenderingMode);
     };
 
     FontCustomPlatformData* createFontCustomPlatformData(SharedBuffer*);
diff --git a/Source/WebCore/platform/graphics/mac/ComplexTextController.cpp b/Source/WebCore/platform/graphics/mac/ComplexTextController.cpp
index 1a56664..07bc3ec 100644
--- a/Source/WebCore/platform/graphics/mac/ComplexTextController.cpp
+++ b/Source/WebCore/platform/graphics/mac/ComplexTextController.cpp
@@ -63,7 +63,8 @@ ComplexTextController::ComplexTextController(const Font* font, const TextRun& ru
     , m_glyphInCurrentRun(0)
     , m_characterInCurrentGlyph(0)
     , m_expansion(run.expansion())
-    , m_afterExpansion(true)
+    , m_leadingExpansion(0)
+    , m_afterExpansion(!run.allowsLeadingExpansion())
     , m_fallbackFonts(fallbackFonts)
     , m_minGlyphBoundingBoxX(numeric_limits<float>::max())
     , m_maxGlyphBoundingBoxX(numeric_limits<float>::min())
@@ -73,7 +74,7 @@ ComplexTextController::ComplexTextController(const Font* font, const TextRun& ru
     if (!m_expansion)
         m_expansionPerOpportunity = 0;
     else {
-        bool isAfterExpansion = true;
+        bool isAfterExpansion = m_afterExpansion;
         unsigned expansionOpportunityCount = Font::expansionOpportunityCount(m_run.characters(), m_end, m_run.ltr() ? LTR : RTL, isAfterExpansion);
         if (isAfterExpansion && !m_run.allowsTrailingExpansion())
             expansionOpportunityCount--;
@@ -86,12 +87,16 @@ ComplexTextController::ComplexTextController(const Font* font, const TextRun& ru
 
     collectComplexTextRuns();
     adjustGlyphsAndAdvances();
+
+    m_runWidthSoFar = m_leadingExpansion;
 }
 
 int ComplexTextController::offsetForPosition(float h, bool includePartialGlyphs)
 {
     if (h >= m_totalWidth)
         return m_run.ltr() ? m_end : 0;
+
+    h -= m_leadingExpansion;
     if (h < 0)
         return m_run.ltr() ? 0 : m_end;
 
@@ -472,16 +477,21 @@ void ComplexTextController::adjustGlyphsAndAdvances()
                 // Handle justification and word-spacing.
                 if (treatAsSpace || Font::isCJKIdeographOrSymbol(ch)) {
                     // Distribute the run's total expansion evenly over all expansion opportunities in the run.
-                    if (m_expansion && (!lastGlyph || m_run.allowsTrailingExpansion())) {
+                    if (m_expansion) {
                         if (!treatAsSpace && !m_afterExpansion) {
                             // Take the expansion opportunity before this ideograph.
                             m_expansion -= m_expansionPerOpportunity;
                             m_totalWidth += m_expansionPerOpportunity;
-                            m_adjustedAdvances.last().width += m_expansionPerOpportunity;
+                            if (m_adjustedAdvances.isEmpty())
+                                m_leadingExpansion = m_expansionPerOpportunity;
+                            else
+                                m_adjustedAdvances.last().width += m_expansionPerOpportunity;
+                        }
+                        if (!lastGlyph || m_run.allowsTrailingExpansion()) {
+                            m_expansion -= m_expansionPerOpportunity;
+                            advance.width += m_expansionPerOpportunity;
+                            m_afterExpansion = true;
                         }
-                        m_expansion -= m_expansionPerOpportunity;
-                        advance.width += m_expansionPerOpportunity;
-                        m_afterExpansion = true;
                     } else
                         m_afterExpansion = false;
 
diff --git a/Source/WebCore/platform/graphics/mac/ComplexTextController.h b/Source/WebCore/platform/graphics/mac/ComplexTextController.h
index 7373bfe..44a7994 100644
--- a/Source/WebCore/platform/graphics/mac/ComplexTextController.h
+++ b/Source/WebCore/platform/graphics/mac/ComplexTextController.h
@@ -175,6 +175,7 @@ private:
     unsigned m_characterInCurrentGlyph;
     float m_expansion;
     float m_expansionPerOpportunity;
+    float m_leadingExpansion;
     bool m_afterExpansion;
 
     HashSet<const SimpleFontData*>* m_fallbackFonts;
diff --git a/Source/WebCore/platform/graphics/mac/ComplexTextControllerATSUI.cpp b/Source/WebCore/platform/graphics/mac/ComplexTextControllerATSUI.cpp
index b367fdf..d965ada 100644
--- a/Source/WebCore/platform/graphics/mac/ComplexTextControllerATSUI.cpp
+++ b/Source/WebCore/platform/graphics/mac/ComplexTextControllerATSUI.cpp
@@ -264,7 +264,7 @@ static void disableLigatures(const SimpleFontData* fontData, ATSUStyle atsuStyle
     // Don't be too aggressive: if the font doesn't contain 'a', then assume that any ligatures it contains are
     // in characters that always go through ATSUI, and therefore allow them. Geeza Pro is an example.
     // See bugzilla 5166.
-    if ((typesettingFeatures & Ligatures) || (fontData->orientation() == Horizontal && fontData->platformData().allowsLigatures()))
+    if ((typesettingFeatures & Ligatures) || (fontData->platformData().orientation() == Horizontal && fontData->platformData().allowsLigatures()))
         return;
 
     ATSUFontFeatureType featureTypes[] = { kLigaturesType };
diff --git a/Source/WebCore/platform/graphics/mac/ComplexTextControllerCoreText.cpp b/Source/WebCore/platform/graphics/mac/ComplexTextControllerCoreText.cpp
index 239113f..d2fbaf5 100644
--- a/Source/WebCore/platform/graphics/mac/ComplexTextControllerCoreText.cpp
+++ b/Source/WebCore/platform/graphics/mac/ComplexTextControllerCoreText.cpp
@@ -144,17 +144,17 @@ void ComplexTextController::collectComplexTextRunsForCharactersCoreText(const UC
         static CFDictionaryRef rtlTypesetterOptions = CFDictionaryCreate(kCFAllocatorDefault, optionKeys, rtlOptionValues, WTF_ARRAY_LENGTH(optionKeys), &kCFCopyStringDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks);
 
 #if !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD) && !defined(BUILDING_ON_SNOW_LEOPARD)
-        ProviderInfo info = { cp, length, fontData->getCFStringAttributes(m_font.typesettingFeatures()) };
+        ProviderInfo info = { cp, length, fontData->getCFStringAttributes(m_font.typesettingFeatures(), fontData->platformData().orientation()) };
         RetainPtr<CTTypesetterRef> typesetter(AdoptCF, wkCreateCTTypesetterWithUniCharProviderAndOptions(&provideStringAndAttributes, 0, &info, m_run.ltr() ? ltrTypesetterOptions : rtlTypesetterOptions));
 #else
         RetainPtr<CFStringRef> string(AdoptCF, CFStringCreateWithCharactersNoCopy(kCFAllocatorDefault, cp, length, kCFAllocatorNull));
-        RetainPtr<CFAttributedStringRef> attributedString(AdoptCF, CFAttributedStringCreate(kCFAllocatorDefault, string.get(), fontData->getCFStringAttributes(m_font.typesettingFeatures())));
+        RetainPtr<CFAttributedStringRef> attributedString(AdoptCF, CFAttributedStringCreate(kCFAllocatorDefault, string.get(), fontData->getCFStringAttributes(m_font.typesettingFeatures(), fontData->platformData().orientation())));
         RetainPtr<CTTypesetterRef> typesetter(AdoptCF, CTTypesetterCreateWithAttributedStringAndOptions(attributedString.get(), m_run.ltr() ? ltrTypesetterOptions : rtlTypesetterOptions));
 #endif
 
         line.adoptCF(CTTypesetterCreateLine(typesetter.get(), CFRangeMake(0, 0)));
     } else {
-        ProviderInfo info = { cp, length, fontData->getCFStringAttributes(m_font.typesettingFeatures()) };
+        ProviderInfo info = { cp, length, fontData->getCFStringAttributes(m_font.typesettingFeatures(), fontData->platformData().orientation()) };
 
         line.adoptCF(wkCreateCTLineWithUniCharProvider(&provideStringAndAttributes, 0, &info));
     }
diff --git a/Source/WebCore/platform/graphics/mac/FontCacheMac.mm b/Source/WebCore/platform/graphics/mac/FontCacheMac.mm
index c254906..f7ae6b7 100644
--- a/Source/WebCore/platform/graphics/mac/FontCacheMac.mm
+++ b/Source/WebCore/platform/graphics/mac/FontCacheMac.mm
@@ -211,7 +211,7 @@ FontPlatformData* FontCache::createFontPlatformData(const FontDescription& fontD
     bool syntheticBold = isAppKitFontWeightBold(weight) && !isAppKitFontWeightBold(actualWeight);
     bool syntheticOblique = (traits & NSFontItalicTrait) && !(actualTraits & NSFontItalicTrait);
 
-    return new FontPlatformData(platformFont, size, syntheticBold, syntheticOblique, fontDescription.orientation(), fontDescription.widthVariant());
+    return new FontPlatformData(platformFont, size, syntheticBold, syntheticOblique, fontDescription.orientation(), fontDescription.textOrientation(), fontDescription.widthVariant());
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/graphics/mac/FontComplexTextMac.cpp b/Source/WebCore/platform/graphics/mac/FontComplexTextMac.cpp
index eed49a5..fe2a22c 100644
--- a/Source/WebCore/platform/graphics/mac/FontComplexTextMac.cpp
+++ b/Source/WebCore/platform/graphics/mac/FontComplexTextMac.cpp
@@ -111,8 +111,8 @@ float Font::floatWidthForComplexText(const TextRun& run, HashSet<const SimpleFon
 {
     ComplexTextController controller(this, run, true, fallbackFonts);
     if (glyphOverflow) {
-        glyphOverflow->top = max<int>(glyphOverflow->top, ceilf(-controller.minGlyphBoundingBoxY()) - fontMetrics().ascent());
-        glyphOverflow->bottom = max<int>(glyphOverflow->bottom, ceilf(controller.maxGlyphBoundingBoxY()) - fontMetrics().descent());
+        glyphOverflow->top = max<int>(glyphOverflow->top, ceilf(-controller.minGlyphBoundingBoxY()) - (glyphOverflow->computeBounds ? 0 : fontMetrics().ascent()));
+        glyphOverflow->bottom = max<int>(glyphOverflow->bottom, ceilf(controller.maxGlyphBoundingBoxY()) - (glyphOverflow->computeBounds ? 0 : fontMetrics().descent()));
         glyphOverflow->left = max<int>(0, ceilf(-controller.minGlyphBoundingBoxX()));
         glyphOverflow->right = max<int>(0, ceilf(controller.maxGlyphBoundingBoxX() - controller.totalWidth()));
     }
diff --git a/Source/WebCore/platform/graphics/mac/FontCustomPlatformData.cpp b/Source/WebCore/platform/graphics/mac/FontCustomPlatformData.cpp
index f2bc33d..383adef 100644
--- a/Source/WebCore/platform/graphics/mac/FontCustomPlatformData.cpp
+++ b/Source/WebCore/platform/graphics/mac/FontCustomPlatformData.cpp
@@ -38,9 +38,9 @@ FontCustomPlatformData::~FontCustomPlatformData()
     CGFontRelease(m_cgFont);
 }
 
-FontPlatformData FontCustomPlatformData::fontPlatformData(int size, bool bold, bool italic, FontOrientation orientation, FontWidthVariant widthVariant, FontRenderingMode)
+FontPlatformData FontCustomPlatformData::fontPlatformData(int size, bool bold, bool italic, FontOrientation orientation, TextOrientation textOrientation, FontWidthVariant widthVariant, FontRenderingMode)
 {
-    return FontPlatformData(m_cgFont, size, bold, italic, orientation, widthVariant);
+    return FontPlatformData(m_cgFont, size, bold, italic, orientation, textOrientation, widthVariant);
 }
 
 FontCustomPlatformData* createFontCustomPlatformData(SharedBuffer* buffer)
diff --git a/Source/WebCore/platform/graphics/mac/FontCustomPlatformData.h b/Source/WebCore/platform/graphics/mac/FontCustomPlatformData.h
index c7ae1ca..c625304 100644
--- a/Source/WebCore/platform/graphics/mac/FontCustomPlatformData.h
+++ b/Source/WebCore/platform/graphics/mac/FontCustomPlatformData.h
@@ -24,6 +24,7 @@
 #include "FontOrientation.h"
 #include "FontRenderingMode.h"
 #include "FontWidthVariant.h"
+#include "TextOrientation.h"
 #include <CoreFoundation/CFBase.h>
 #include <wtf/Forward.h>
 #include <wtf/Noncopyable.h>
@@ -48,7 +49,7 @@ public:
 
     ~FontCustomPlatformData();
 
-    FontPlatformData fontPlatformData(int size, bool bold, bool italic, FontOrientation = Horizontal, FontWidthVariant = RegularWidth, FontRenderingMode = NormalRenderingMode);
+    FontPlatformData fontPlatformData(int size, bool bold, bool italic, FontOrientation = Horizontal, TextOrientation = TextOrientationVerticalRight, FontWidthVariant = RegularWidth, FontRenderingMode = NormalRenderingMode);
 
     static bool supportsFormat(const String&);
 
diff --git a/Source/WebCore/platform/graphics/mac/FontMac.mm b/Source/WebCore/platform/graphics/mac/FontMac.mm
index acd7562..4c28ead 100644
--- a/Source/WebCore/platform/graphics/mac/FontMac.mm
+++ b/Source/WebCore/platform/graphics/mac/FontMac.mm
@@ -52,28 +52,72 @@ bool Font::canExpandAroundIdeographsInComplexText()
     return true;
 }
 
-static void showGlyphsWithAdvances(const SimpleFontData* font, CGContextRef context, const CGGlyph* glyphs, const CGSize* advances, size_t count)
+// CTFontGetVerticalTranslationsForGlyphs is different on Snow Leopard.  It returns values for a font-size of 1
+// without unitsPerEm applied.  We have to apply a transform that scales up to the point size and that also 
+// divides by unitsPerEm.
+static bool hasBrokenCTFontGetVerticalTranslationsForGlyphs()
 {
+// Chromium runs the same binary on both Leopard and Snow Leopard, so the check has to happen at runtime.
+#if PLATFORM(CHROMIUM)
+    static bool isCached = false;
+    static bool result;
+    
+    if (!isCached) {
+        SInt32 majorVersion = 0;
+        SInt32 minorVersion = 0;
+        Gestalt(gestaltSystemVersionMajor, &majorVersion);
+        Gestalt(gestaltSystemVersionMinor, &minorVersion);
+        result = majorVersion == 10 && minorVersion == 6;
+        isCached = true;
+    }
+    return result;
+#elif defined(BUILDING_ON_SNOW_LEOPARD)
+    return true;
+#else
+    return false;
+#endif
+}
+
+static void showGlyphsWithAdvances(const FloatPoint& point, const SimpleFontData* font, CGContextRef context, const CGGlyph* glyphs, const CGSize* advances, size_t count)
+{
+    CGContextSetTextPosition(context, point.x(), point.y());
+
     const FontPlatformData& platformData = font->platformData();
     if (!platformData.isColorBitmapFont()) {
         CGAffineTransform savedMatrix;
-        bool isVertical = font->orientation() == Vertical;
-
+        bool isVertical = font->platformData().orientation() == Vertical;
         if (isVertical) {
             CGAffineTransform rotateLeftTransform = CGAffineTransformMake(0, -1, 1, 0, 0, 0);
-
             savedMatrix = CGContextGetTextMatrix(context);
             CGAffineTransform runMatrix = CGAffineTransformConcat(savedMatrix, rotateLeftTransform);
-            // Move start point to put glyphs into original region.
-            runMatrix.tx = savedMatrix.tx + font->fontMetrics().ascent();
-            runMatrix.ty = savedMatrix.ty + font->fontMetrics().descent();
             CGContextSetTextMatrix(context, runMatrix);
-        }
-
-        CGContextShowGlyphsWithAdvances(context, glyphs, advances, count);
-
-        if (isVertical)
+            
+            CGAffineTransform translationsTransform;
+            if (hasBrokenCTFontGetVerticalTranslationsForGlyphs()) {
+                translationsTransform = CGAffineTransformMake(platformData.m_size, 0, 0, platformData.m_size, 0, 0);
+                translationsTransform = CGAffineTransformConcat(translationsTransform, rotateLeftTransform);
+                CGFloat unitsPerEm = CGFontGetUnitsPerEm(platformData.cgFont());
+                translationsTransform = CGAffineTransformConcat(translationsTransform, CGAffineTransformMakeScale(1 / unitsPerEm, 1 / unitsPerEm));
+            } else {
+                translationsTransform = rotateLeftTransform;
+            }
+            Vector<CGSize, 256> translations(count);
+            CTFontGetVerticalTranslationsForGlyphs(platformData.ctFont(), glyphs, translations.data(), count);
+            
+            CGAffineTransform transform = CGAffineTransformInvert(CGContextGetTextMatrix(context));
+
+            CGPoint position = FloatPoint(point.x(), point.y() + font->fontMetrics().floatAscent(IdeographicBaseline) - font->fontMetrics().floatAscent());
+            Vector<CGPoint, 256> positions(count);
+            for (size_t i = 0; i < count; ++i) {
+                CGSize translation = CGSizeApplyAffineTransform(translations[i], translationsTransform);
+                positions[i] = CGPointApplyAffineTransform(CGPointMake(position.x - translation.width, position.y + translation.height), transform);
+                position.x += advances[i].width;
+                position.y += advances[i].height;
+            }
+            CGContextShowGlyphsAtPositions(context, glyphs, positions.data(), count);
             CGContextSetTextMatrix(context, savedMatrix);
+        } else
+            CGContextShowGlyphsWithAdvances(context, glyphs, advances, count);
     }
 #if !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD) && !defined(BUILDING_ON_SNOW_LEOPARD)
     else {
@@ -188,21 +232,15 @@ void Font::drawGlyphs(GraphicsContext* context, const SimpleFontData* font, cons
         float shadowTextX = point.x() + shadowOffset.width();
         // If shadows are ignoring transforms, then we haven't applied the Y coordinate flip yet, so down is negative.
         float shadowTextY = point.y() + shadowOffset.height() * (context->shadowsIgnoreTransforms() ? -1 : 1);
-        CGContextSetTextPosition(cgContext, shadowTextX, shadowTextY);
-        showGlyphsWithAdvances(font, cgContext, glyphBuffer.glyphs(from), glyphBuffer.advances(from), numGlyphs);
-        if (font->syntheticBoldOffset()) {
-            CGContextSetTextPosition(cgContext, shadowTextX + font->syntheticBoldOffset(), shadowTextY);
-            showGlyphsWithAdvances(font, cgContext, glyphBuffer.glyphs(from), glyphBuffer.advances(from), numGlyphs);
-        }
+        showGlyphsWithAdvances(FloatPoint(shadowTextX, shadowTextY), font, cgContext, glyphBuffer.glyphs(from), glyphBuffer.advances(from), numGlyphs);
+        if (font->syntheticBoldOffset())
+            showGlyphsWithAdvances(FloatPoint(shadowTextX + font->syntheticBoldOffset(), shadowTextY), font, cgContext, glyphBuffer.glyphs(from), glyphBuffer.advances(from), numGlyphs);
         context->setFillColor(fillColor, fillColorSpace);
     }
 
-    CGContextSetTextPosition(cgContext, point.x(), point.y());
-    showGlyphsWithAdvances(font, cgContext, glyphBuffer.glyphs(from), glyphBuffer.advances(from), numGlyphs);
-    if (font->syntheticBoldOffset()) {
-        CGContextSetTextPosition(cgContext, point.x() + font->syntheticBoldOffset(), point.y());
-        showGlyphsWithAdvances(font, cgContext, glyphBuffer.glyphs(from), glyphBuffer.advances(from), numGlyphs);
-    }
+    showGlyphsWithAdvances(point, font, cgContext, glyphBuffer.glyphs(from), glyphBuffer.advances(from), numGlyphs);
+    if (font->syntheticBoldOffset())
+        showGlyphsWithAdvances(FloatPoint(point.x() + font->syntheticBoldOffset(), point.y()), font, cgContext, glyphBuffer.glyphs(from), glyphBuffer.advances(from), numGlyphs);
 
     if (hasSimpleShadow)
         context->setShadow(shadowOffset, shadowBlur, shadowColor, shadowColorSpace);
diff --git a/Source/WebCore/platform/graphics/mac/GlyphPageTreeNodeMac.cpp b/Source/WebCore/platform/graphics/mac/GlyphPageTreeNodeMac.cpp
index fe2b33a..18d0dc5 100644
--- a/Source/WebCore/platform/graphics/mac/GlyphPageTreeNodeMac.cpp
+++ b/Source/WebCore/platform/graphics/mac/GlyphPageTreeNodeMac.cpp
@@ -39,7 +39,7 @@ namespace WebCore {
 #ifndef BUILDING_ON_TIGER
 static bool shouldUseCoreText(UChar* buffer, unsigned bufferLength, const SimpleFontData* fontData)
 {
-    if (fontData->platformData().widthVariant() != RegularWidth || (fontData->orientation() == Vertical && !fontData->isBrokenIdeographFont())) {
+    if (fontData->platformData().widthVariant() != RegularWidth || fontData->hasVerticalGlyphs()) {
         // Ideographs don't have a vertical variant or width variants.
         for (unsigned i = 0; i < bufferLength; ++i) {
             if (!Font::isCJKIdeograph(buffer[i]))
@@ -70,7 +70,7 @@ bool GlyphPage::fill(unsigned offset, unsigned length, UChar* buffer, unsigned b
     } else {
         // We ask CoreText for possible vertical variant glyphs
         RetainPtr<CFStringRef> string(AdoptCF, CFStringCreateWithCharactersNoCopy(kCFAllocatorDefault, buffer, bufferLength, kCFAllocatorNull));
-        RetainPtr<CFAttributedStringRef> attributedString(AdoptCF, CFAttributedStringCreate(kCFAllocatorDefault, string.get(), fontData->getCFStringAttributes(0)));
+        RetainPtr<CFAttributedStringRef> attributedString(AdoptCF, CFAttributedStringCreate(kCFAllocatorDefault, string.get(), fontData->getCFStringAttributes(0, fontData->hasVerticalGlyphs() ? Vertical : Horizontal)));
         RetainPtr<CTLineRef> line(AdoptCF, CTLineCreateWithAttributedString(attributedString.get()));
 
         CFArrayRef runArray = CTLineGetGlyphRuns(line.get());
diff --git a/Source/WebCore/platform/graphics/mac/GraphicsContext3DMac.mm b/Source/WebCore/platform/graphics/mac/GraphicsContext3DMac.mm
index aaa250b..997c976 100644
--- a/Source/WebCore/platform/graphics/mac/GraphicsContext3DMac.mm
+++ b/Source/WebCore/platform/graphics/mac/GraphicsContext3DMac.mm
@@ -93,9 +93,14 @@ GraphicsContext3D::GraphicsContext3D(GraphicsContext3D::Attributes attrs, HostWi
     , m_attrs(attrs)
     , m_contextObj(0)
     , m_texture(0)
+    , m_compositorTexture(0)
     , m_fbo(0)
     , m_depthStencilBuffer(0)
+    , m_layerComposited(false)
+    , m_internalColorFormat(0)
     , m_boundFBO(0)
+    , m_activeTexture(0)
+    , m_boundTexture0(0)
     , m_multisampleFBO(0)
     , m_multisampleDepthStencilBuffer(0)
     , m_multisampleColorBuffer(0)
@@ -166,6 +171,12 @@ GraphicsContext3D::GraphicsContext3D(GraphicsContext3D::Attributes attrs, HostWi
     ::glTexParameterf(GL_TEXTURE_2D, GL_TEXTURE_MIN_FILTER, GL_LINEAR);
     ::glTexParameteri(GL_TEXTURE_2D, GL_TEXTURE_WRAP_S, GL_CLAMP);
     ::glTexParameteri(GL_TEXTURE_2D, GL_TEXTURE_WRAP_T, GL_CLAMP);
+    ::glGenTextures(1, &m_compositorTexture);
+    ::glBindTexture(GL_TEXTURE_2D, m_compositorTexture);
+    ::glTexParameterf(GL_TEXTURE_2D, GL_TEXTURE_MAG_FILTER, GL_LINEAR);
+    ::glTexParameterf(GL_TEXTURE_2D, GL_TEXTURE_MIN_FILTER, GL_LINEAR);
+    ::glTexParameteri(GL_TEXTURE_2D, GL_TEXTURE_WRAP_S, GL_CLAMP);
+    ::glTexParameteri(GL_TEXTURE_2D, GL_TEXTURE_WRAP_T, GL_CLAMP);
     ::glBindTexture(GL_TEXTURE_2D, 0);
     
     // create an FBO
@@ -215,6 +226,7 @@ GraphicsContext3D::~GraphicsContext3D()
     if (m_contextObj) {
         CGLSetCurrentContext(m_contextObj);
         ::glDeleteTextures(1, &m_texture);
+        ::glDeleteTextures(1, &m_compositorTexture);
         if (m_attrs.antialias) {
             ::glDeleteRenderbuffersEXT(1, &m_multisampleColorBuffer);
             if (m_attrs.stencil || m_attrs.depth)
diff --git a/Source/WebCore/platform/graphics/mac/MediaPlayerPrivateQTKit.h b/Source/WebCore/platform/graphics/mac/MediaPlayerPrivateQTKit.h
index 80bc94e..7bdc064 100644
--- a/Source/WebCore/platform/graphics/mac/MediaPlayerPrivateQTKit.h
+++ b/Source/WebCore/platform/graphics/mac/MediaPlayerPrivateQTKit.h
@@ -54,6 +54,8 @@ class WebCoreMovieObserver;
 #endif
 
 namespace WebCore {
+    
+class ApplicationCacheResource;
 
 class MediaPlayerPrivateQTKit : public MediaPlayerPrivateInterface {
 public:
@@ -139,6 +141,7 @@ private:
 
     void createQTMovie(const String& url);
     void createQTMovie(NSURL *, NSDictionary *movieAttributes);
+    void createQTMovie(ApplicationCacheResource*);
 
     enum MediaRenderingMode { MediaRenderingNone, MediaRenderingMovieView, MediaRenderingSoftwareRenderer, MediaRenderingMovieLayer };
     MediaRenderingMode currentRenderingMode() const;
@@ -178,6 +181,8 @@ private:
     virtual double maximumDurationToCacheMediaTime() const { return 5; }
 
     virtual void setPrivateBrowsingMode(bool);
+    
+    NSMutableDictionary* commonMovieAttributes();
 
     MediaPlayer* m_player;
     RetainPtr<QTMovie> m_qtMovie;
@@ -211,6 +216,7 @@ private:
     double m_timeStartedPlaying;
     double m_timeStoppedPlaying;
 #endif
+    mutable FloatSize m_cachedNaturalSize;
 };
 
 }
diff --git a/Source/WebCore/platform/graphics/mac/MediaPlayerPrivateQTKit.mm b/Source/WebCore/platform/graphics/mac/MediaPlayerPrivateQTKit.mm
index ecb7d9f..400fdfb 100644
--- a/Source/WebCore/platform/graphics/mac/MediaPlayerPrivateQTKit.mm
+++ b/Source/WebCore/platform/graphics/mac/MediaPlayerPrivateQTKit.mm
@@ -29,11 +29,18 @@
 
 #import "MediaPlayerPrivateQTKit.h"
 
+#if ENABLE(OFFLINE_WEB_APPLICATIONS)
+#include "ApplicationCacheHost.h"
+#include "ApplicationCacheResource.h"
+#include "DocumentLoader.h"
+#endif
+
 #ifdef BUILDING_ON_TIGER
 #import "AutodrainedPool.h"
 #endif
 
 #import "BlockExceptions.h"
+#import "DocumentLoader.h"
 #import "FrameView.h"
 #import "GraphicsContext.h"
 #import "KURL.h"
@@ -83,6 +90,7 @@ SOFT_LINK_POINTER(QTKit, QTMediaTypeText, NSString *)
 SOFT_LINK_POINTER(QTKit, QTMediaTypeVideo, NSString *)
 SOFT_LINK_POINTER(QTKit, QTMovieAskUnresolvedDataRefsAttribute, NSString *)
 SOFT_LINK_POINTER(QTKit, QTMovieLoopsAttribute, NSString *)
+SOFT_LINK_POINTER(QTKit, QTMovieDataAttribute, NSString *)
 SOFT_LINK_POINTER(QTKit, QTMovieDataSizeAttribute, NSString *)
 SOFT_LINK_POINTER(QTKit, QTMovieDidEndNotification, NSString *)
 SOFT_LINK_POINTER(QTKit, QTMovieHasVideoAttribute, NSString *)
@@ -120,6 +128,7 @@ SOFT_LINK_POINTER(QTKit, QTMovieApertureModeAttribute, NSString *)
 #define QTMediaTypeVideo getQTMediaTypeVideo()
 #define QTMovieAskUnresolvedDataRefsAttribute getQTMovieAskUnresolvedDataRefsAttribute()
 #define QTMovieLoopsAttribute getQTMovieLoopsAttribute()
+#define QTMovieDataAttribute getQTMovieDataAttribute()
 #define QTMovieDataSizeAttribute getQTMovieDataSizeAttribute()
 #define QTMovieDidEndNotification getQTMovieDidEndNotification()
 #define QTMovieHasVideoAttribute getQTMovieHasVideoAttribute()
@@ -241,21 +250,26 @@ MediaPlayerPrivateQTKit::~MediaPlayerPrivateQTKit()
     [m_objcObserver.get() disconnect];
 }
 
-void MediaPlayerPrivateQTKit::createQTMovie(const String& url)
+NSMutableDictionary* MediaPlayerPrivateQTKit::commonMovieAttributes() 
 {
-    NSURL *cocoaURL = KURL(ParsedURLString, url);
-    NSMutableDictionary *movieAttributes = [NSMutableDictionary dictionaryWithObjectsAndKeys:
-                       cocoaURL, QTMovieURLAttribute,
-                       [NSNumber numberWithBool:m_player->preservesPitch()], QTMovieRateChangesPreservePitchAttribute,
-                       [NSNumber numberWithBool:YES], QTMoviePreventExternalURLLinksAttribute,
-                       [NSNumber numberWithBool:YES], QTSecurityPolicyNoCrossSiteAttribute,
-                       [NSNumber numberWithBool:NO], QTMovieAskUnresolvedDataRefsAttribute,
-                       [NSNumber numberWithBool:NO], QTMovieLoopsAttribute,
-                       [NSNumber numberWithBool:!m_privateBrowsing], @"QTMovieAllowPersistentCacheAttribute",
+    return [NSMutableDictionary dictionaryWithObjectsAndKeys:
+            [NSNumber numberWithBool:m_player->preservesPitch()], QTMovieRateChangesPreservePitchAttribute,
+            [NSNumber numberWithBool:YES], QTMoviePreventExternalURLLinksAttribute,
+            [NSNumber numberWithBool:YES], QTSecurityPolicyNoCrossSiteAttribute,
+            [NSNumber numberWithBool:NO], QTMovieAskUnresolvedDataRefsAttribute,
+            [NSNumber numberWithBool:NO], QTMovieLoopsAttribute,
+            [NSNumber numberWithBool:!m_privateBrowsing], @"QTMovieAllowPersistentCacheAttribute",
 #ifndef BUILDING_ON_TIGER
-                       QTMovieApertureModeClean, QTMovieApertureModeAttribute,
+            QTMovieApertureModeClean, QTMovieApertureModeAttribute,
 #endif
-                       nil];
+            nil];
+}
+
+void MediaPlayerPrivateQTKit::createQTMovie(const String& url)
+{
+    NSURL *cocoaURL = KURL(ParsedURLString, url);
+    NSMutableDictionary *movieAttributes = commonMovieAttributes();    
+    [movieAttributes setValue:cocoaURL forKey:QTMovieURLAttribute];
 
 #if !defined(BUILDING_ON_LEOPARD)
     CFDictionaryRef proxySettings = CFNetworkCopySystemProxySettings();
@@ -291,6 +305,33 @@ void MediaPlayerPrivateQTKit::createQTMovie(const String& url)
     createQTMovie(cocoaURL, movieAttributes);
 }
 
+void MediaPlayerPrivateQTKit::createQTMovie(ApplicationCacheResource* resource)
+{
+#if ENABLE(OFFLINE_WEB_APPLICATIONS)
+    ASSERT(resource);
+
+    NSMutableDictionary *movieAttributes = commonMovieAttributes();    
+    [movieAttributes setObject:[NSNumber numberWithBool:YES] forKey:@"QTMovieOpenForPlaybackAttribute"];
+    
+    // ApplicationCacheResources can supply either a data pointer, or a path to a locally cached 
+    // flat file.  We would prefer the path over the data, but QTKit can handle either:
+    String localPath = resource->path();
+    NSURL* cocoaURL = !localPath.isEmpty() ? [NSURL fileURLWithPath:localPath isDirectory:NO] : nil;
+    if (cocoaURL)
+        [movieAttributes setValue:cocoaURL forKey:QTMovieURLAttribute];
+    else {
+        NSData* movieData = resource->data()->createNSData();
+        [movieAttributes setValue:movieData forKey:QTMovieDataAttribute];
+        [movieData release];
+    }
+    
+    createQTMovie(cocoaURL, movieAttributes);
+    
+#else
+    ASSERT_NOT_REACHED();
+#endif
+}
+
 static void disableComponentsOnce()
 {
     static bool sComponentsDisabled = false;
@@ -658,6 +699,14 @@ void MediaPlayerPrivateQTKit::loadInternal(const String& url)
     
     [m_objcObserver.get() setDelayCallbacks:YES];
 
+#if ENABLE(OFFLINE_WEB_APPLICATIONS)
+    Frame* frame = m_player->frameView() ? m_player->frameView()->frame() : NULL;
+    ApplicationCacheHost* cacheHost = frame ? frame->loader()->documentLoader()->applicationCacheHost() : NULL;
+    ApplicationCacheResource* resource = NULL;
+    if (cacheHost && cacheHost->shouldLoadResourceFromApplicationCache(ResourceRequest(url), resource) && resource)
+        createQTMovie(resource);
+    else
+#endif    
     createQTMovie(url);
 
     [m_objcObserver.get() loadStateChanged:nil];
@@ -827,8 +876,19 @@ IntSize MediaPlayerPrivateQTKit::naturalSize() const
     //    dimensions, aspect ratio, clean aperture, resolution, and so forth, as defined for the 
     //    format used by the resource
     
-    NSSize naturalSize = [[m_qtMovie.get() attributeForKey:QTMovieNaturalSizeAttribute] sizeValue];
-    return IntSize(naturalSize.width * m_scaleFactor.width(), naturalSize.height * m_scaleFactor.height());
+    FloatSize naturalSize([[m_qtMovie.get() attributeForKey:QTMovieNaturalSizeAttribute] sizeValue]);
+    if (naturalSize.isEmpty() && m_isStreaming) {
+        // HTTP Live Streams will occasionally return {0,0} natural sizes while scrubbing.
+        // Work around this problem (<rdar://problem/9078563>) by returning the last valid 
+        // cached natural size:
+        naturalSize = m_cachedNaturalSize;
+    } else {
+        // Unfortunately, due to another QTKit bug (<rdar://problem/9082071>) we won't get a sizeChanged
+        // event when this happens, so we must cache the last valid naturalSize here:
+        m_cachedNaturalSize = naturalSize;
+    }
+        
+    return IntSize(naturalSize.width() * m_scaleFactor.width(), naturalSize.height() * m_scaleFactor.height());
 }
 
 bool MediaPlayerPrivateQTKit::hasVideo() const
diff --git a/Source/WebCore/platform/graphics/mac/SimpleFontDataCoreText.cpp b/Source/WebCore/platform/graphics/mac/SimpleFontDataCoreText.cpp
index 452bd54..832bb9d 100644
--- a/Source/WebCore/platform/graphics/mac/SimpleFontDataCoreText.cpp
+++ b/Source/WebCore/platform/graphics/mac/SimpleFontDataCoreText.cpp
@@ -39,15 +39,17 @@ using namespace std;
 
 namespace WebCore {
 
-CFDictionaryRef SimpleFontData::getCFStringAttributes(TypesettingFeatures typesettingFeatures) const
+CFDictionaryRef SimpleFontData::getCFStringAttributes(TypesettingFeatures typesettingFeatures, FontOrientation orientation) const
 {
     unsigned key = typesettingFeatures + 1;
     pair<HashMap<unsigned, RetainPtr<CFDictionaryRef> >::iterator, bool> addResult = m_CFStringAttributes.add(key, RetainPtr<CFDictionaryRef>());
     RetainPtr<CFDictionaryRef>& attributesDictionary = addResult.first->second;
     if (!addResult.second)
         return attributesDictionary.get();
+    
+    bool treatLineAsVertical = orientation == Vertical;
 
-    bool allowLigatures = (orientation() == Horizontal && platformData().allowsLigatures()) || (typesettingFeatures & Ligatures);
+    bool allowLigatures = (!treatLineAsVertical && platformData().allowsLigatures()) || (typesettingFeatures & Ligatures);
 
     static const int ligaturesNotAllowedValue = 0;
     static CFNumberRef ligaturesNotAllowed = CFNumberCreate(kCFAllocatorDefault, kCFNumberIntType, &ligaturesNotAllowedValue);
@@ -60,13 +62,13 @@ CFDictionaryRef SimpleFontData::getCFStringAttributes(TypesettingFeatures typese
         static CFNumberRef kerningAdjustment = CFNumberCreate(kCFAllocatorDefault, kCFNumberFloatType, &kerningAdjustmentValue);
         static const void* keysWithKerningDisabled[] = { kCTFontAttributeName, kCTKernAttributeName, kCTLigatureAttributeName, kCTVerticalFormsAttributeName };
         const void* valuesWithKerningDisabled[] = { platformData().ctFont(), kerningAdjustment, allowLigatures
-            ? ligaturesAllowed : ligaturesNotAllowed, orientation() == Vertical ? kCFBooleanTrue : kCFBooleanFalse };
+            ? ligaturesAllowed : ligaturesNotAllowed, treatLineAsVertical ? kCFBooleanTrue : kCFBooleanFalse };
         attributesDictionary.adoptCF(CFDictionaryCreate(0, keysWithKerningDisabled, valuesWithKerningDisabled,
             WTF_ARRAY_LENGTH(keysWithKerningDisabled), &kCFCopyStringDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks));
     } else {
         // By omitting the kCTKernAttributeName attribute, we get Core Text's standard kerning.
         static const void* keysWithKerningEnabled[] = { kCTFontAttributeName, kCTLigatureAttributeName, kCTVerticalFormsAttributeName };
-        const void* valuesWithKerningEnabled[] = { platformData().ctFont(), allowLigatures ? ligaturesAllowed : ligaturesNotAllowed, orientation() == Vertical ? kCFBooleanTrue : kCFBooleanFalse };
+        const void* valuesWithKerningEnabled[] = { platformData().ctFont(), allowLigatures ? ligaturesAllowed : ligaturesNotAllowed, treatLineAsVertical ? kCFBooleanTrue : kCFBooleanFalse };
         attributesDictionary.adoptCF(CFDictionaryCreate(0, keysWithKerningEnabled, valuesWithKerningEnabled,
             WTF_ARRAY_LENGTH(keysWithKerningEnabled), &kCFCopyStringDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks));
     }
diff --git a/Source/WebCore/platform/graphics/mac/SimpleFontDataMac.mm b/Source/WebCore/platform/graphics/mac/SimpleFontDataMac.mm
index 3094498..cd34000 100644
--- a/Source/WebCore/platform/graphics/mac/SimpleFontDataMac.mm
+++ b/Source/WebCore/platform/graphics/mac/SimpleFontDataMac.mm
@@ -259,49 +259,32 @@ void SimpleFontData::platformInit()
         descent = 3;
     }
     
-    if (m_orientation == Vertical) {
-        // Ignore vertical orientation when the font doesn't support vertical metrics.
+    if (platformData().orientation() == Vertical && !isTextOrientationFallback()) {
         // The check doesn't look neat but this is what AppKit does for vertical writing...
         RetainPtr<CFArrayRef> tableTags(AdoptCF, CTFontCopyAvailableTables(m_platformData.ctFont(), kCTFontTableOptionExcludeSynthetic));
         CFIndex numTables = CFArrayGetCount(tableTags.get());
-        bool found = false;
         for (CFIndex index = 0; index < numTables; ++index) {
             CTFontTableTag tag = (CTFontTableTag)(uintptr_t)CFArrayGetValueAtIndex(tableTags.get(), index);
             if (tag == kCTFontTableVhea || tag == kCTFontTableVORG) {
-                found = true;
+                m_hasVerticalGlyphs = true;
                 break;
             }
         }
-
-        if (found == false)
-            m_orientation = Horizontal;
     }
 
     float xHeight;
 
-    // Measure the actual character "x", because AppKit synthesizes X height rather than getting it from the font.
-    // Unfortunately, NSFont will round this for us so we don't quite get the right value.
-    GlyphPage* glyphPageZero = GlyphPageTreeNode::getRootChild(this, 0)->page();
-    NSGlyph xGlyph = glyphPageZero ? glyphPageZero->glyphDataForCharacter('x').glyph : 0;
-    if (xGlyph) {
-        CGRect xBox = platformBoundsForGlyph(xGlyph);
-        // Use the maximum of either width or height because "x" is nearly square
-        // and web pages that foolishly use this metric for width will be laid out
-        // poorly if we return an accurate height. Classic case is Times 13 point,
-        // which has an "x" that is 7x6 pixels.
-        xHeight = static_cast<float>(max(CGRectGetMaxX(xBox), -CGRectGetMinY(xBox)));
-    } else {
-#ifndef BUILDING_ON_TIGER
-        xHeight = static_cast<float>(CGFontGetXHeight(m_platformData.cgFont())) / unitsPerEm;
-#else
-        xHeight = m_platformData.font() ? [m_platformData.font() xHeight] : 0;
-#endif
-        // CGFontGetXHeight() returns a wrong value for "Apple Symbols" font (a float close to 0, but not strictly 0).
-        // The following code makes a guess for xHeight in that case.
-        // The int cast is a workaround for the "almost" zero value returned by CGFontGetXHeight().
-        if (!static_cast<int>(xHeight) && ascent)
-            xHeight = 2 * ascent / 3;
-    }
+    if (platformData().orientation() == Horizontal) {
+        // Measure the actual character "x", since it's possible for it to extend below the baseline, and we need the
+        // reported x-height to only include the portion of the glyph that is above the baseline.
+        GlyphPage* glyphPageZero = GlyphPageTreeNode::getRootChild(this, 0)->page();
+        NSGlyph xGlyph = glyphPageZero ? glyphPageZero->glyphDataForCharacter('x').glyph : 0;
+        if (xGlyph)
+            xHeight = -CGRectGetMinY(platformBoundsForGlyph(xGlyph));
+        else
+            xHeight = scaleEmToUnits(CGFontGetXHeight(m_platformData.cgFont()), unitsPerEm) * pointSize;
+    } else
+        xHeight = verticalRightOrientationFontData()->fontMetrics().xHeight();
 
     m_fontMetrics.setUnitsPerEm(unitsPerEm);
     m_fontMetrics.setAscent(ascent);
@@ -474,17 +457,8 @@ void SimpleFontData::determinePitch()
 FloatRect SimpleFontData::platformBoundsForGlyph(Glyph glyph) const
 {
     FloatRect boundingBox;
-#ifndef BUILDING_ON_TIGER
-    boundingBox = CTFontGetBoundingRectsForGlyphs(m_platformData.ctFont(),
-                    orientation() == Vertical ? kCTFontVerticalOrientation : kCTFontHorizontalOrientation, &glyph, 0, 1);
+    boundingBox = CTFontGetBoundingRectsForGlyphs(m_platformData.ctFont(), platformData().orientation() == Vertical ? kCTFontVerticalOrientation : kCTFontHorizontalOrientation, &glyph, 0, 1);
     boundingBox.setY(-boundingBox.maxY());
-#else
-    // FIXME: Custom fonts don't have NSFonts, so this function doesn't compute correct bounds for these on Tiger.
-    if (!m_platformData.font())
-        return boundingBox;
-    boundingBox = [m_platformData.font() boundingRectForGlyph:glyph];
-    boundingBox.setY(-boundingBox.maxY());
-#endif
     if (m_syntheticBoldOffset)
         boundingBox.setWidth(boundingBox.width() + m_syntheticBoldOffset);
 
@@ -494,7 +468,7 @@ FloatRect SimpleFontData::platformBoundsForGlyph(Glyph glyph) const
 float SimpleFontData::platformWidthForGlyph(Glyph glyph) const
 {
     CGSize advance;
-    if (orientation() == Horizontal || m_isBrokenIdeographFont) {
+    if (platformData().orientation() == Horizontal || m_isBrokenIdeographFallback) {
         NSFont* font = platformData().font();
         float pointSize = platformData().m_size;
         CGAffineTransform m = CGAffineTransformMakeScale(pointSize, pointSize);
diff --git a/Source/WebCore/platform/graphics/mac/WebLayer.h b/Source/WebCore/platform/graphics/mac/WebLayer.h
index 30bf55b..2e9bea0 100644
--- a/Source/WebCore/platform/graphics/mac/WebLayer.h
+++ b/Source/WebCore/platform/graphics/mac/WebLayer.h
@@ -32,6 +32,7 @@
 
 namespace WebCore {
     class GraphicsLayer;
+    class PlatformCALayer;
     class PlatformCALayerClient;
 }
 
@@ -48,7 +49,7 @@ namespace WebCore {
 @end
 
 // Functions allows us to share implementation across WebTiledLayer and WebLayer
-void drawLayerContents(CGContextRef, CALayer *, WebCore::PlatformCALayerClient*);
+void drawLayerContents(CGContextRef, CALayer *, WebCore::PlatformCALayer*);
 void setLayerNeedsDisplayInRect(CALayer *, WebCore::PlatformCALayerClient*, CGRect);
 
 #endif // USE(ACCELERATED_COMPOSITING)
diff --git a/Source/WebCore/platform/graphics/mac/WebLayer.mm b/Source/WebCore/platform/graphics/mac/WebLayer.mm
index 414a75f..c9705d0 100644
--- a/Source/WebCore/platform/graphics/mac/WebLayer.mm
+++ b/Source/WebCore/platform/graphics/mac/WebLayer.mm
@@ -40,8 +40,9 @@ using namespace WebCore;
 
 @implementation WebLayer
 
-void drawLayerContents(CGContextRef context, CALayer *layer, WebCore::PlatformCALayerClient* layerContents)
+void drawLayerContents(CGContextRef context, CALayer *layer, WebCore::PlatformCALayer* platformLayer)
 {
+    WebCore::PlatformCALayerClient* layerContents = platformLayer->owner();
     if (!layerContents)
         return;
 
@@ -62,6 +63,7 @@ void drawLayerContents(CGContextRef context, CALayer *layer, WebCore::PlatformCA
 
     GraphicsContext graphicsContext(context);
     graphicsContext.setIsCALayerContext(true);
+    graphicsContext.setIsAcceleratedContext(platformLayer->acceleratesDrawing());
 
     if (!layerContents->platformCALayerContentsOpaque()) {
         // Turn off font smoothing to improve the appearance of text rendered onto a transparent background.
@@ -167,7 +169,7 @@ void setLayerNeedsDisplayInRect(CALayer *layer, WebCore::PlatformCALayerClient*
 {
     PlatformCALayer* layer = PlatformCALayer::platformCALayer(self);
     if (layer)
-        drawLayerContents(context, self, layer->owner());
+        drawLayerContents(context, self, layer);
 }
 
 @end // implementation WebLayer
diff --git a/Source/WebCore/platform/graphics/mac/WebTiledLayer.mm b/Source/WebCore/platform/graphics/mac/WebTiledLayer.mm
index e9fa5b7..9bcdd54 100644
--- a/Source/WebCore/platform/graphics/mac/WebTiledLayer.mm
+++ b/Source/WebCore/platform/graphics/mac/WebTiledLayer.mm
@@ -83,7 +83,7 @@ using namespace WebCore;
 {
     PlatformCALayer* layer = PlatformCALayer::platformCALayer(self);
     if (layer)
-        drawLayerContents(context, self, layer->owner());
+        drawLayerContents(context, self, layer);
 }
 
 @end // implementation WebTiledLayer
diff --git a/Source/WebCore/platform/graphics/opengl/GraphicsContext3DOpenGL.cpp b/Source/WebCore/platform/graphics/opengl/GraphicsContext3DOpenGL.cpp
index c224e20..f831550 100644
--- a/Source/WebCore/platform/graphics/opengl/GraphicsContext3DOpenGL.cpp
+++ b/Source/WebCore/platform/graphics/opengl/GraphicsContext3DOpenGL.cpp
@@ -38,6 +38,7 @@
 #include "GraphicsContext.h"
 #include "HTMLCanvasElement.h"
 #include "ImageBuffer.h"
+#include "ImageData.h"
 #include "Int32Array.h"
 #include "NotImplemented.h"
 #include "Uint8Array.h"
@@ -53,11 +54,12 @@ namespace WebCore {
 
 void GraphicsContext3D::validateAttributes()
 {
-    const char* extensions = reinterpret_cast<const char*>(::glGetString(GL_EXTENSIONS));
+    Extensions3D* extensions = getExtensions();
     if (m_attrs.stencil) {
-        if (std::strstr(extensions, "GL_EXT_packed_depth_stencil")) {
-            if (!m_attrs.depth)
-                m_attrs.depth = true;
+        if (extensions->supports("GL_EXT_packed_depth_stencil")) {
+            extensions->ensureEnabled("GL_EXT_packed_depth_stencil");
+            // Force depth if stencil is true.
+            m_attrs.depth = true;
         } else
             m_attrs.stencil = false;
     }
@@ -67,24 +69,16 @@ void GraphicsContext3D::validateAttributes()
         const char* vendor = reinterpret_cast<const char*>(::glGetString(GL_VENDOR));
         if (!std::strstr(vendor, "NVIDIA"))
             isValidVendor = false;
-        if (!isValidVendor || !std::strstr(extensions, "GL_EXT_framebuffer_multisample"))
+        if (!isValidVendor || !extensions->supports("GL_ANGLE_framebuffer_multisample"))
             m_attrs.antialias = false;
+        else
+            extensions->ensureEnabled("GL_ANGLE_framebuffer_multisample");
     }
-    // FIXME: instead of enforcing premultipliedAlpha = true, implement the
-    // correct behavior when premultipliedAlpha = false is requested.
-    m_attrs.premultipliedAlpha = true;
 }
 
-void GraphicsContext3D::paintRenderingResultsToCanvas(CanvasRenderingContext* context)
+void GraphicsContext3D::readRenderingResults(unsigned char *pixels, int pixelsSize)
 {
-    HTMLCanvasElement* canvas = context->canvas();
-    ImageBuffer* imageBuffer = canvas->buffer();
-
-    int rowBytes = m_currentWidth * 4;
-    int totalBytes = rowBytes * m_currentHeight;
-
-    OwnArrayPtr<unsigned char> pixels = adoptArrayPtr(new unsigned char[totalBytes]);
-    if (!pixels)
+    if (pixelsSize < m_currentWidth * m_currentHeight * 4)
         return;
 
     makeContextCurrent();
@@ -111,18 +105,62 @@ void GraphicsContext3D::paintRenderingResultsToCanvas(CanvasRenderingContext* co
         mustRestorePackAlignment = true;
     }
 
-    ::glReadPixels(0, 0, m_currentWidth, m_currentHeight, GL_BGRA, GL_UNSIGNED_INT_8_8_8_8_REV, pixels.get());
+    ::glReadPixels(0, 0, m_currentWidth, m_currentHeight, GL_BGRA, GL_UNSIGNED_INT_8_8_8_8_REV, pixels);
 
     if (mustRestorePackAlignment)
         ::glPixelStorei(GL_PACK_ALIGNMENT, packAlignment);
 
     if (mustRestoreFBO)
         ::glBindFramebufferEXT(GL_FRAMEBUFFER_EXT, m_boundFBO);
+}
+
+void GraphicsContext3D::paintRenderingResultsToCanvas(CanvasRenderingContext* context)
+{
+    HTMLCanvasElement* canvas = context->canvas();
+    ImageBuffer* imageBuffer = canvas->buffer();
+
+    int rowBytes = m_currentWidth * 4;
+    int totalBytes = rowBytes * m_currentHeight;
+
+    OwnArrayPtr<unsigned char> pixels = adoptArrayPtr(new unsigned char[totalBytes]);
+    if (!pixels)
+        return;
+
+    readRenderingResults(pixels.get(), totalBytes);
+
+    if (!m_attrs.premultipliedAlpha) {
+        for (int i = 0; i < totalBytes; i += 4) {
+            // Premultiply alpha
+            pixels[i + 0] = std::min(255, pixels[i + 0] * pixels[i + 3] / 255);
+            pixels[i + 1] = std::min(255, pixels[i + 1] * pixels[i + 3] / 255);
+            pixels[i + 2] = std::min(255, pixels[i + 2] * pixels[i + 3] / 255);
+        }
+    }
 
     paintToCanvas(pixels.get(), m_currentWidth, m_currentHeight,
                   canvas->width(), canvas->height(), imageBuffer->context()->platformContext());
 }
 
+PassRefPtr<ImageData> GraphicsContext3D::paintRenderingResultsToImageData()
+{
+    // Reading premultiplied alpha would involve unpremultiplying, which is
+    // lossy
+    if (m_attrs.premultipliedAlpha)
+        return 0;
+
+    RefPtr<ImageData> imageData = ImageData::create(IntSize(m_currentWidth, m_currentHeight));
+    unsigned char* pixels = imageData->data()->data()->data();
+    int totalBytes = 4 * m_currentWidth * m_currentHeight;
+
+    readRenderingResults(pixels, totalBytes);
+
+    // Convert to RGBA
+    for (int i = 0; i < totalBytes; i += 4)
+        std::swap(pixels[i], pixels[i + 2]);
+
+    return imageData.release();
+}
+
 void GraphicsContext3D::reshape(int width, int height)
 {
     if (!m_contextObj)
@@ -135,19 +173,23 @@ void GraphicsContext3D::reshape(int width, int height)
     m_currentHeight = height;
     
     makeContextCurrent();
-    
-    GLuint internalColorFormat, colorFormat, internalDepthStencilFormat = 0;
+    validateAttributes();
+
+    GLuint colorFormat, internalDepthStencilFormat = 0;
     if (m_attrs.alpha) {
-        internalColorFormat = GL_RGBA8;
+        m_internalColorFormat = GL_RGBA8;
         colorFormat = GL_RGBA;
     } else {
-        internalColorFormat = GL_RGB8;
+        m_internalColorFormat = GL_RGB8;
         colorFormat = GL_RGB;
     }
     if (m_attrs.stencil || m_attrs.depth) {
         // We don't allow the logic where stencil is required and depth is not.
-        // See GraphicsContext3D constructor.
-        if (m_attrs.stencil && m_attrs.depth)
+        // See GraphicsContext3D::validateAttributes.
+
+        Extensions3D* extensions = getExtensions();
+        // Use a 24 bit depth buffer where we know we have it
+        if (extensions->supports("GL_EXT_packed_depth_stencil"))
             internalDepthStencilFormat = GL_DEPTH24_STENCIL8_EXT;
         else
             internalDepthStencilFormat = GL_DEPTH_COMPONENT;
@@ -167,7 +209,7 @@ void GraphicsContext3D::reshape(int width, int height)
             mustRestoreFBO = true;
         }
         ::glBindRenderbufferEXT(GL_RENDERBUFFER_EXT, m_multisampleColorBuffer);
-        ::glRenderbufferStorageMultisampleEXT(GL_RENDERBUFFER_EXT, sampleCount, internalColorFormat, width, height);
+        ::glRenderbufferStorageMultisampleEXT(GL_RENDERBUFFER_EXT, sampleCount, m_internalColorFormat, width, height);
         ::glFramebufferRenderbufferEXT(GL_FRAMEBUFFER_EXT, GL_COLOR_ATTACHMENT0_EXT, GL_RENDERBUFFER_EXT, m_multisampleColorBuffer);
         if (m_attrs.stencil || m_attrs.depth) {
             ::glBindRenderbufferEXT(GL_RENDERBUFFER_EXT, m_multisampleDepthStencilBuffer);
@@ -190,8 +232,10 @@ void GraphicsContext3D::reshape(int width, int height)
         ::glBindFramebufferEXT(GL_FRAMEBUFFER_EXT, m_fbo);
     }
     ::glBindTexture(GL_TEXTURE_2D, m_texture);
-    ::glTexImage2D(GL_TEXTURE_2D, 0, internalColorFormat, width, height, 0, colorFormat, GL_UNSIGNED_BYTE, 0);
+    ::glTexImage2D(GL_TEXTURE_2D, 0, m_internalColorFormat, width, height, 0, colorFormat, GL_UNSIGNED_BYTE, 0);
     ::glFramebufferTexture2DEXT(GL_FRAMEBUFFER_EXT, GL_COLOR_ATTACHMENT0_EXT, GL_TEXTURE_2D, m_texture, 0);
+    ::glBindTexture(GL_TEXTURE_2D, m_compositorTexture);
+    ::glTexImage2D(GL_TEXTURE_2D, 0, m_internalColorFormat, width, height, 0, colorFormat, GL_UNSIGNED_BYTE, 0);
     ::glBindTexture(GL_TEXTURE_2D, 0);
     if (!m_attrs.antialias && (m_attrs.stencil || m_attrs.depth)) {
         ::glBindRenderbufferEXT(GL_RENDERBUFFER_EXT, m_depthStencilBuffer);
@@ -278,19 +322,29 @@ IntSize GraphicsContext3D::getInternalFramebufferSize()
 
 void GraphicsContext3D::prepareTexture()
 {
+    if (m_layerComposited)
+        return;
     makeContextCurrent();
     if (m_attrs.antialias) {
         ::glBindFramebufferEXT(GL_READ_FRAMEBUFFER_EXT, m_multisampleFBO);
         ::glBindFramebufferEXT(GL_DRAW_FRAMEBUFFER_EXT, m_fbo);
         ::glBlitFramebufferEXT(0, 0, m_currentWidth, m_currentHeight, 0, 0, m_currentWidth, m_currentHeight, GL_COLOR_BUFFER_BIT, GL_LINEAR);
-        ::glBindFramebufferEXT(GL_FRAMEBUFFER_EXT, m_boundFBO);
     }
+    ::glBindFramebufferEXT(GL_FRAMEBUFFER_EXT, m_fbo);
+    ::glActiveTexture(0);
+    ::glBindTexture(GL_TEXTURE_2D, m_compositorTexture);
+    ::glCopyTexImage2D(GL_TEXTURE_2D, 0, m_internalColorFormat, 0, 0, m_currentWidth, m_currentHeight, 0);
+    ::glBindTexture(GL_TEXTURE_2D, m_boundTexture0);
+    ::glActiveTexture(m_activeTexture);
+    ::glBindFramebufferEXT(GL_FRAMEBUFFER_EXT, m_boundFBO);
     ::glFinish();
+    m_layerComposited = true;
 }
 
 void GraphicsContext3D::activeTexture(GC3Denum texture)
 {
     makeContextCurrent();
+    m_activeTexture = texture;
     ::glActiveTexture(texture);
 }
 
@@ -340,6 +394,8 @@ void GraphicsContext3D::bindRenderbuffer(GC3Denum target, Platform3DObject rende
 void GraphicsContext3D::bindTexture(GC3Denum target, Platform3DObject texture)
 {
     makeContextCurrent();
+    if (m_activeTexture && target == GL_TEXTURE_2D)
+        m_boundTexture0 = texture;
     ::glBindTexture(target, texture);
 }
 
@@ -1442,6 +1498,21 @@ void GraphicsContext3D::synthesizeGLError(GC3Denum error)
     m_syntheticErrors.add(error);
 }
 
+void GraphicsContext3D::markContextChanged()
+{
+    m_layerComposited = false;
+}
+
+void GraphicsContext3D::markLayerComposited()
+{
+    m_layerComposited = true;
+}
+
+bool GraphicsContext3D::layerComposited() const
+{
+    return m_layerComposited;
+}
+
 Extensions3D* GraphicsContext3D::getExtensions()
 {
     if (!m_extensions)
diff --git a/Source/WebCore/platform/graphics/opengl/TextureMapperGL.cpp b/Source/WebCore/platform/graphics/opengl/TextureMapperGL.cpp
index 2e2082d..9765937 100644
--- a/Source/WebCore/platform/graphics/opengl/TextureMapperGL.cpp
+++ b/Source/WebCore/platform/graphics/opengl/TextureMapperGL.cpp
@@ -21,11 +21,11 @@
 #include "TextureMapperGL.h"
 
 #include "GraphicsContext.h"
-#include "HashMap.h"
 #include "Image.h"
-#include "PassRefPtr.h"
-#include "RefCounted.h"
 #include "Timer.h"
+#include <wtf/HashMap.h>
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
 
 #if defined(TEXMAP_OPENGL_ES_2)
 #include <GLES2/gl2.h>
diff --git a/Source/WebCore/platform/graphics/opengl/TextureMapperGL.h b/Source/WebCore/platform/graphics/opengl/TextureMapperGL.h
index 8035abf..92c5198 100644
--- a/Source/WebCore/platform/graphics/opengl/TextureMapperGL.h
+++ b/Source/WebCore/platform/graphics/opengl/TextureMapperGL.h
@@ -24,8 +24,8 @@
 
 #include "FloatQuad.h"
 #include "IntSize.h"
+#include "TextureMapper.h"
 #include "TransformationMatrix.h"
-#include "texmap/TextureMapper.h"
 
 namespace WebCore {
 
diff --git a/Source/WebCore/platform/graphics/openvg/PathOpenVG.cpp b/Source/WebCore/platform/graphics/openvg/PathOpenVG.cpp
index 39a4b06..95df242 100644
--- a/Source/WebCore/platform/graphics/openvg/PathOpenVG.cpp
+++ b/Source/WebCore/platform/graphics/openvg/PathOpenVG.cpp
@@ -169,7 +169,7 @@ FloatRect Path::boundingRect() const
     return FloatRect(FloatPoint(minX, minY), FloatSize(width, height));
 }
 
-FloatRect Path::strokeBoundingRect(StrokeStyleApplier* applier)
+FloatRect Path::strokeBoundingRect(StrokeStyleApplier* applier) const
 {
     notImplemented();
 
@@ -464,7 +464,7 @@ void Path::transform(const AffineTransform& transformation)
 // functions and Path::apply() doesn't really work as long as we rely on VGPath
 // as primary path storage.
 
-float Path::length()
+float Path::length() const
 {
     m_path->makeCompatibleContextCurrent();
     VGfloat length = vgPathLength(m_path->vgPath(), 0, vgGetParameteri(m_path->vgPath(), VG_PATH_NUM_SEGMENTS));
@@ -472,7 +472,7 @@ float Path::length()
     return length;
 }
 
-FloatPoint Path::pointAtLength(float length, bool& ok)
+FloatPoint Path::pointAtLength(float length, bool& ok) const
 {
     VGfloat x = 0, y = 0;
     m_path->makeCompatibleContextCurrent();
@@ -483,7 +483,7 @@ FloatPoint Path::pointAtLength(float length, bool& ok)
     return FloatPoint(x, y);
 }
 
-float Path::normalAngleAtLength(float length, bool& ok)
+float Path::normalAngleAtLength(float length, bool& ok) const
 {
     VGfloat tangentX, tangentY;
     m_path->makeCompatibleContextCurrent();
diff --git a/Source/WebCore/platform/graphics/pango/FontCustomPlatformDataPango.cpp b/Source/WebCore/platform/graphics/pango/FontCustomPlatformDataPango.cpp
index f9d36d3..deff9f7 100644
--- a/Source/WebCore/platform/graphics/pango/FontCustomPlatformDataPango.cpp
+++ b/Source/WebCore/platform/graphics/pango/FontCustomPlatformDataPango.cpp
@@ -30,7 +30,7 @@ FontCustomPlatformData::~FontCustomPlatformData()
 {
 }
 
-FontPlatformData FontCustomPlatformData::fontPlatformData(int size, bool bold, bool italic, FontOrientation, FontWidthVariant, FontRenderingMode)
+FontPlatformData FontCustomPlatformData::fontPlatformData(int size, bool bold, bool italic, FontOrientation, TextOrientation, FontWidthVariant, FontRenderingMode)
 {
     return FontPlatformData(m_fontFace, size, bold, italic);
 }
diff --git a/Source/WebCore/platform/graphics/pango/FontPlatformData.h b/Source/WebCore/platform/graphics/pango/FontPlatformData.h
index 2929a3f..180d23b 100644
--- a/Source/WebCore/platform/graphics/pango/FontPlatformData.h
+++ b/Source/WebCore/platform/graphics/pango/FontPlatformData.h
@@ -74,7 +74,7 @@ public:
     unsigned hash() const
     {
         uintptr_t hashCodes[1] = { reinterpret_cast<uintptr_t>(m_scaledFont) };
-        return WTF::StringHasher::createBlobHash<sizeof(hashCodes)>(hashCodes);
+        return StringHasher::hashMemory<sizeof(hashCodes)>(hashCodes);
     }
 
     bool operator==(const FontPlatformData&) const;
diff --git a/Source/WebCore/platform/graphics/qt/Extensions3DQt.cpp b/Source/WebCore/platform/graphics/qt/Extensions3DQt.cpp
index dcea72f..3adc93f 100644
--- a/Source/WebCore/platform/graphics/qt/Extensions3DQt.cpp
+++ b/Source/WebCore/platform/graphics/qt/Extensions3DQt.cpp
@@ -30,6 +30,7 @@
 #include "Extensions3DQt.h"
 
 #include "GraphicsContext3D.h"
+#include <QGLContext>
 
 namespace WebCore {
 
diff --git a/Source/WebCore/platform/graphics/qt/FontCustomPlatformData.h b/Source/WebCore/platform/graphics/qt/FontCustomPlatformData.h
index e8441d2..3996d22 100644
--- a/Source/WebCore/platform/graphics/qt/FontCustomPlatformData.h
+++ b/Source/WebCore/platform/graphics/qt/FontCustomPlatformData.h
@@ -25,6 +25,7 @@
 #include "FontOrientation.h"
 #include "FontRenderingMode.h"
 #include "FontWidthVariant.h"
+#include "TextOrientation.h"
 #include <wtf/FastAllocBase.h>
 #include <wtf/Forward.h>
 #include <wtf/Noncopyable.h>
@@ -43,7 +44,8 @@ public:
     // for use with QFontDatabase::addApplicationFont/removeApplicationFont
     int m_handle;
 
-    FontPlatformData fontPlatformData(int size, bool bold, bool italic, FontOrientation = Horizontal, FontWidthVariant = RegularWidth, FontRenderingMode = NormalRenderingMode);
+    FontPlatformData fontPlatformData(int size, bool bold, bool italic, FontOrientation = Horizontal, TextOrientation = TextOrientationVerticalRight,
+                                      FontWidthVariant = RegularWidth, FontRenderingMode = NormalRenderingMode);
 
     static bool supportsFormat(const String&);
 };
diff --git a/Source/WebCore/platform/graphics/qt/FontCustomPlatformDataQt.cpp b/Source/WebCore/platform/graphics/qt/FontCustomPlatformDataQt.cpp
index ec8747d..20f161a 100644
--- a/Source/WebCore/platform/graphics/qt/FontCustomPlatformDataQt.cpp
+++ b/Source/WebCore/platform/graphics/qt/FontCustomPlatformDataQt.cpp
@@ -34,7 +34,7 @@ FontCustomPlatformData::~FontCustomPlatformData()
     QFontDatabase::removeApplicationFont(m_handle);
 }
 
-FontPlatformData FontCustomPlatformData::fontPlatformData(int size, bool bold, bool italic, FontOrientation, FontWidthVariant, FontRenderingMode)
+FontPlatformData FontCustomPlatformData::fontPlatformData(int size, bool bold, bool italic, FontOrientation, TextOrientation, FontWidthVariant, FontRenderingMode)
 {
     QFont font;
     font.setFamily(QFontDatabase::applicationFontFamilies(m_handle)[0]);
diff --git a/Source/WebCore/platform/graphics/qt/FontPlatformData.h b/Source/WebCore/platform/graphics/qt/FontPlatformData.h
index 32e8a2d..4a92acf 100644
--- a/Source/WebCore/platform/graphics/qt/FontPlatformData.h
+++ b/Source/WebCore/platform/graphics/qt/FontPlatformData.h
@@ -141,6 +141,7 @@ public:
     }
     
     FontOrientation orientation() const { return Horizontal; } // FIXME: Implement.
+    void setOrientation(FontOrientation) { } // FIXME: Implement.
 
     unsigned hash() const;
 
diff --git a/Source/WebCore/platform/graphics/qt/FontPlatformDataQt.cpp b/Source/WebCore/platform/graphics/qt/FontPlatformDataQt.cpp
index 185ae85..95dabd5 100644
--- a/Source/WebCore/platform/graphics/qt/FontPlatformDataQt.cpp
+++ b/Source/WebCore/platform/graphics/qt/FontPlatformDataQt.cpp
@@ -73,9 +73,7 @@ FontPlatformData::FontPlatformData(const FontDescription& description, const Ato
     font.setLetterSpacing(QFont::AbsoluteSpacing, letterSpacing);
     const bool smallCaps = description.smallCaps();
     font.setCapitalization(smallCaps ? QFont::SmallCaps : QFont::MixedCase);
-#if QT_VERSION >= QT_VERSION_CHECK(4, 7, 0)
     font.setStyleStrategy(QFont::ForceIntegerMetrics);
-#endif
 
     m_data->bold = font.bold();
     // WebKit allows font size zero but QFont does not. We will return
diff --git a/Source/WebCore/platform/graphics/qt/FontQt.cpp b/Source/WebCore/platform/graphics/qt/FontQt.cpp
index 646cd0e..3fe90a4 100644
--- a/Source/WebCore/platform/graphics/qt/FontQt.cpp
+++ b/Source/WebCore/platform/graphics/qt/FontQt.cpp
@@ -169,21 +169,16 @@ static void drawTextCommon(GraphicsContext* ctx, const TextRun& run, const Float
             p->restore();
             return;
         }
-#if QT_VERSION >= QT_VERSION_CHECK(4, 7, 0)
         int skipWidth = QFontMetrics(font).width(string, from, Qt::TextBypassShaping);
         pt.setX(pt.x() + skipWidth);
         string = fromRawDataWithoutRef(sanitized, from, to - from);
-#endif
     }
 
     p->setFont(font);
 
     int flags = run.rtl() ? Qt::TextForceRightToLeft : Qt::TextForceLeftToRight;
-#if QT_VERSION >= QT_VERSION_CHECK(4, 7, 0)
-    // See QWebPagePrivate::QWebPagePrivate() where the default path is set to Complex for Qt 4.6 and earlier.
     if (!isComplexText && !(ctx->textDrawingMode() & TextModeStroke))
         flags |= Qt::TextBypassShaping;
-#endif
 
     QPainterPath textStrokePath;
     if (ctx->textDrawingMode() & TextModeStroke)
@@ -200,11 +195,7 @@ static void drawTextCommon(GraphicsContext* ctx, const TextRun& run, const Float
                 p->restore();
             } else {
                 QFontMetrics fm(font);
-#if QT_VERSION >= QT_VERSION_CHECK(4, 7, 0)
                 QRectF boundingRect(pt.x(), point.y() - fm.ascent(), fm.width(string, -1, flags), fm.height());
-#else
-                QRectF boundingRect(pt.x(), point.y() - fm.ascent(), fm.width(string), fm.height());
-#endif
                 QPainter* shadowPainter = ctxShadow->beginShadowLayer(ctx, boundingRect);
                 if (shadowPainter) {
                     // Since it will be blurred anyway, we don't care about render hints.
@@ -221,11 +212,7 @@ static void drawTextCommon(GraphicsContext* ctx, const TextRun& run, const Float
                 p->translate(-ctxShadow->offset());
             } else {
                 QFontMetrics fm(font);
-#if QT_VERSION >= QT_VERSION_CHECK(4, 7, 0)
                 QRectF boundingRect(pt.x(), point.y() - fm.ascent(), fm.width(string, -1, flags), fm.height());
-#else
-                QRectF boundingRect(pt.x(), point.y() - fm.ascent(), fm.width(string), fm.height());
-#endif
                 QPainter* shadowPainter = ctxShadow->beginShadowLayer(ctx, boundingRect);
                 if (shadowPainter) {
                     // Since it will be blurred anyway, we don't care about render hints.
@@ -250,11 +237,7 @@ static void drawTextCommon(GraphicsContext* ctx, const TextRun& run, const Float
 
 void Font::drawSimpleText(GraphicsContext* ctx, const TextRun& run, const FloatPoint& point, int from, int to) const
 {
-#if QT_VERSION >= QT_VERSION_CHECK(4, 7, 0)
     drawTextCommon(ctx, run, point, from, to, font(), /* isComplexText = */false);
-#else
-    Q_ASSERT(false);
-#endif
 }
 
 void Font::drawComplexText(GraphicsContext* ctx, const TextRun& run, const FloatPoint& point, int from, int to) const
@@ -295,7 +278,6 @@ float Font::floatWidthForSimpleText(const TextRun& run, GlyphBuffer* glyphBuffer
     if (!primaryFont()->platformData().size())
         return 0;
 
-#if QT_VERSION >= QT_VERSION_CHECK(4, 7, 0)
     if (!run.length())
         return 0;
 
@@ -309,10 +291,6 @@ float Font::floatWidthForSimpleText(const TextRun& run, GlyphBuffer* glyphBuffer
         w -= m_wordSpacing;
 
     return w + run.expansion();
-#else
-    Q_ASSERT(false);
-    return 0;
-#endif
 }
 
 float Font::floatWidthForComplexText(const TextRun& run, HashSet<const SimpleFontData*>*, GlyphOverflow*) const
@@ -339,7 +317,6 @@ float Font::floatWidthForComplexText(const TextRun& run, HashSet<const SimpleFon
 
 int Font::offsetForPositionForSimpleText(const TextRun& run, float position, bool includePartialGlyphs) const
 {
-#if QT_VERSION >= QT_VERSION_CHECK(4, 7, 0)
     String sanitized = Font::normalizeSpaces(run.characters(), run.length());
     QString string = fromRawDataWithoutRef(sanitized);
 
@@ -359,10 +336,6 @@ int Font::offsetForPositionForSimpleText(const TextRun& run, float position, boo
     } while (++curPos < string.size());
 
     return curPos;
-#else
-    Q_ASSERT(false);
-    return 0;
-#endif
 }
 
 int Font::offsetForPositionForComplexText(const TextRun& run, float position, bool) const
@@ -377,7 +350,6 @@ int Font::offsetForPositionForComplexText(const TextRun& run, float position, bo
 
 FloatRect Font::selectionRectForSimpleText(const TextRun& run, const FloatPoint& pt, int h, int from, int to) const
 {
-#if QT_VERSION >= QT_VERSION_CHECK(4, 7, 0)
     String sanitized = Font::normalizeSpaces(run.characters(), run.length());
     QString wholeText = fromRawDataWithoutRef(sanitized);
     QString selectedText = fromRawDataWithoutRef(sanitized, from, qMin(to - from, wholeText.length() - from));
@@ -386,10 +358,6 @@ FloatRect Font::selectionRectForSimpleText(const TextRun& run, const FloatPoint&
     int width = QFontMetrics(font()).width(selectedText, -1, Qt::TextBypassShaping);
 
     return FloatRect(pt.x() + startX, pt.y(), width, h);
-#else
-    Q_ASSERT(false);
-    return FloatRect();
-#endif
 }
 
 FloatRect Font::selectionRectForComplexText(const TextRun& run, const FloatPoint& pt, int h, int from, int to) const
diff --git a/Source/WebCore/platform/graphics/qt/GraphicsContext3DQt.cpp b/Source/WebCore/platform/graphics/qt/GraphicsContext3DQt.cpp
index b849214..4daa4dc 100644
--- a/Source/WebCore/platform/graphics/qt/GraphicsContext3DQt.cpp
+++ b/Source/WebCore/platform/graphics/qt/GraphicsContext3DQt.cpp
@@ -27,10 +27,14 @@
 #include "HTMLCanvasElement.h"
 #include "HostWindow.h"
 #include "ImageBuffer.h"
+#include "ImageData.h"
 #include "NotImplemented.h"
 #include "QWebPageClient.h"
+#include "qwebpage.h"
 #include <QAbstractScrollArea>
+#include <QGraphicsObject>
 #include <QGLContext>
+#include <QStyleOptionGraphicsItem>
 #include <wtf/UnusedParam.h>
 #include <wtf/text/CString.h>
 
@@ -42,6 +46,10 @@ namespace WebCore {
 typedef char GLchar;
 #endif
 
+#if !defined(GL_DEPTH24_STENCIL8)
+#define GL_DEPTH24_STENCIL8 0x88F0
+#endif
+
 #if !defined(APIENTRY)
 #define APIENTRY
 #endif
@@ -145,13 +153,17 @@ typedef void (APIENTRY* glVertexAttrib4fType) (GLuint, const GLfloat, const GLfl
 typedef void (APIENTRY* glVertexAttrib4fvType) (GLuint, const GLfloat*);
 typedef void (APIENTRY* glVertexAttribPointerType) (GLuint, GLint, GLenum, GLboolean, GLsizei, const GLvoid*);
 
-class GraphicsContext3DInternal {
+class GraphicsContext3DInternal : public QGraphicsObject {
 public:
     GraphicsContext3DInternal(GraphicsContext3D::Attributes attrs, HostWindow* hostWindow);
     ~GraphicsContext3DInternal();
 
-    bool isContextValid() { return m_contextValid; }
-    QGLWidget* getOwnerGLWidget(QWebPageClient* webPageClient);
+    bool isValid() { return m_valid; }
+
+    QGLWidget* getViewportGLWidget();
+    void reshape(int width, int height);
+    void paint(QPainter*, const QStyleOptionGraphicsItem*, QWidget*);
+    QRectF boundingRect() const;
 
     glActiveTextureType activeTexture;
     glAttachShaderType attachShader;
@@ -247,11 +259,13 @@ public:
     GraphicsContext3D::Attributes m_attrs;
     HostWindow* m_hostWindow;
     QGLWidget* m_glWidget;
+    QGLWidget* m_viewportGLWidget;
+    QRectF m_boundingRect;
     GLuint m_texture;
-    GLuint m_mainFbo;
+    GLuint m_canvasFbo;
     GLuint m_currentFbo;
     GLuint m_depthBuffer;
-    QImage m_pixels;
+    bool m_layerComposited;
     ListHashSet<unsigned int> m_syntheticErrors;
 
     OwnPtr<Extensions3DQt> m_extensions;
@@ -259,7 +273,7 @@ public:
 private:
 
     void* getProcAddress(const String& proc);
-    bool m_contextValid;
+    bool m_valid;
 };
 
 #if defined (QT_OPENGL_ES_2) 
@@ -281,39 +295,37 @@ GraphicsContext3DInternal::GraphicsContext3DInternal(GraphicsContext3D::Attribut
     : m_attrs(attrs)
     , m_hostWindow(hostWindow)
     , m_glWidget(0)
+    , m_viewportGLWidget(0)
     , m_texture(0)
-    , m_mainFbo(0)
+    , m_canvasFbo(0)
     , m_currentFbo(0)
     , m_depthBuffer(0)
-    , m_contextValid(true)
+    , m_layerComposited(false)
+    , m_valid(true)
 {
-    QWebPageClient* webPageClient = hostWindow->platformPageClient();
-    QGLWidget* ownerGLWidget  = getOwnerGLWidget(webPageClient);
+    m_viewportGLWidget = getViewportGLWidget();
 
-    if (ownerGLWidget) 
-        m_glWidget = new QGLWidget(0, ownerGLWidget);
-    else {
-        QGLFormat format;
-        format.setDepth(true);
-        format.setSampleBuffers(true);
-        format.setStencil(false);
-
-        m_glWidget = new QGLWidget(format);
-    }
+    if (m_viewportGLWidget)
+        m_glWidget = new QGLWidget(0, m_viewportGLWidget);
+    else
+        m_glWidget = new QGLWidget();
 
     if (!m_glWidget->isValid()) {
-        LOG_ERROR("GraphicsContext3D: QGLWidget does not have a valid context");
-        m_contextValid = false;
+        LOG_ERROR("GraphicsContext3D: QGLWidget initialization failed.");
+        m_valid = false;
         return;
     }
- 
-    QGLFormat format = m_glWidget->format();
 
-    m_attrs.alpha = format.alpha();
-    m_attrs.depth = format.depth();
-    m_attrs.stencil = format.stencil();
+    // Geometry can be set to zero because m_glWidget is used only for its QGLContext.
+    m_glWidget->setGeometry(0, 0, 0, 0);
+
+#if defined(QT_OPENGL_ES_2)
+    m_attrs.stencil = false;
+#else
+    if (m_attrs.stencil)
+        m_attrs.depth = true;
+#endif
     m_attrs.antialias = false;
-    m_attrs.premultipliedAlpha = true;
 
     m_glWidget->makeCurrent();
 
@@ -408,60 +420,165 @@ GraphicsContext3DInternal::GraphicsContext3DInternal(GraphicsContext3D::Attribut
     vertexAttrib4fv = GET_PROC_ADDRESS(glVertexAttrib4fv);
     vertexAttribPointer = GET_PROC_ADDRESS(glVertexAttribPointer);
 
-    if (!m_contextValid) {
+    if (!m_valid) {
         LOG_ERROR("GraphicsContext3D: All needed OpenGL extensions are not available");
-        m_contextValid = false;
         return;
     }
 
+    // Create buffers for the canvas FBO.
+    genFramebuffers(/* count */ 1, &m_canvasFbo);
+
     glGenTextures(1, &m_texture);
     glBindTexture(GraphicsContext3D::TEXTURE_2D, m_texture);
     glTexParameterf(GraphicsContext3D::TEXTURE_2D, GraphicsContext3D::TEXTURE_MAG_FILTER, GraphicsContext3D::LINEAR);
     glTexParameterf(GraphicsContext3D::TEXTURE_2D, GraphicsContext3D::TEXTURE_MIN_FILTER, GraphicsContext3D::LINEAR);
     glTexParameteri(GraphicsContext3D::TEXTURE_2D, GraphicsContext3D::TEXTURE_WRAP_S, GraphicsContext3D::CLAMP_TO_EDGE);
     glTexParameteri(GraphicsContext3D::TEXTURE_2D, GraphicsContext3D::TEXTURE_WRAP_T, GraphicsContext3D::CLAMP_TO_EDGE);
-    glTexImage2D(GraphicsContext3D::TEXTURE_2D, 0, GraphicsContext3D::RGBA, 1, 1, 0, GraphicsContext3D::RGBA, GraphicsContext3D::UNSIGNED_BYTE, 0);
     glBindTexture(GraphicsContext3D::TEXTURE_2D, 0);
 
-    genFramebuffers(/* count */ 1, &m_mainFbo);
-    m_currentFbo = m_mainFbo;
+    if (m_attrs.depth)
+        genRenderbuffers(/* count */ 1, &m_depthBuffer);
+
+    // Bind canvas FBO and set initial clear color to black.
+    m_currentFbo = m_canvasFbo;
+    bindFramebuffer(GraphicsContext3D::FRAMEBUFFER, m_canvasFbo);
+    glClearColor(0.0, 0.0, 0.0, 0.0);
+}
+
+GraphicsContext3DInternal::~GraphicsContext3DInternal()
+{
+    delete m_glWidget;
+    m_glWidget = 0;
+}
+
+QGLWidget* GraphicsContext3DInternal::getViewportGLWidget()
+{
+    QWebPageClient* webPageClient = m_hostWindow->platformPageClient();
+    if (!webPageClient)
+        return 0;
+
+    QAbstractScrollArea* scrollArea = qobject_cast<QAbstractScrollArea*>(webPageClient->ownerWidget());
+    if (scrollArea)
+        return qobject_cast<QGLWidget*>(scrollArea->viewport());
+
+    return 0;
+}
+
+static inline quint32 swapBgrToRgb(quint32 pixel)
+{
+    return ((pixel << 16) & 0xff0000) | ((pixel >> 16) & 0xff) | (pixel & 0xff00ff00);
+}
+
+void GraphicsContext3DInternal::reshape(int width, int height)
+{
+    if (width == m_boundingRect.width() && height == m_boundingRect.height())
+        return;
+
+    m_boundingRect = QRectF(QPointF(0, 0), QSizeF(width, height));
+
+    m_glWidget->makeCurrent();
 
-    bindFramebuffer(GraphicsContext3D::FRAMEBUFFER, m_mainFbo);
+    // Create color buffer
+    glBindTexture(GraphicsContext3D::TEXTURE_2D, m_texture);
+    if (m_attrs.alpha)
+        glTexImage2D(GraphicsContext3D::TEXTURE_2D, /* level */ 0, GraphicsContext3D::RGBA, width, height, /* border */ 0, GraphicsContext3D::RGBA, GraphicsContext3D::UNSIGNED_BYTE, /* data */ 0);
+    else
+        glTexImage2D(GraphicsContext3D::TEXTURE_2D, /* level */ 0, GraphicsContext3D::RGB, width, height, /* border */ 0, GraphicsContext3D::RGB, GraphicsContext3D::UNSIGNED_BYTE, /* data */ 0);
+    glBindTexture(GraphicsContext3D::TEXTURE_2D, 0);
 
-    genRenderbuffers(/* count */ 1, &m_depthBuffer);
-    bindRenderbuffer(GraphicsContext3D::RENDERBUFFER, m_depthBuffer);
+    if (m_attrs.depth) {
+        // Create depth and stencil buffers.
+        bindRenderbuffer(GraphicsContext3D::RENDERBUFFER, m_depthBuffer);
 #if defined(QT_OPENGL_ES_2)
-    renderbufferStorage(GraphicsContext3D::RENDERBUFFER, GraphicsContext3D::DEPTH_COMPONENT16, /* width */ 1, /* height */ 1);
+        renderbufferStorage(GraphicsContext3D::RENDERBUFFER, GraphicsContext3D::DEPTH_COMPONENT16, width, height);
 #else
-    renderbufferStorage(GraphicsContext3D::RENDERBUFFER, GraphicsContext3D::DEPTH_COMPONENT, /* width */ 1, /* height */ 1);
+        if (m_attrs.stencil)
+            renderbufferStorage(GraphicsContext3D::RENDERBUFFER, GL_DEPTH24_STENCIL8, width, height);
+        else
+            renderbufferStorage(GraphicsContext3D::RENDERBUFFER, GraphicsContext3D::DEPTH_COMPONENT, width, height);
 #endif
+        bindRenderbuffer(GraphicsContext3D::RENDERBUFFER, 0);
+    }
 
-    bindRenderbuffer(GraphicsContext3D::RENDERBUFFER, 0);
- 
+    // Construct canvas FBO.
+    bindFramebuffer(GraphicsContext3D::FRAMEBUFFER, m_canvasFbo);
     framebufferTexture2D(GraphicsContext3D::FRAMEBUFFER, GraphicsContext3D::COLOR_ATTACHMENT0, GraphicsContext3D::TEXTURE_2D, m_texture, 0);
-    framebufferRenderbuffer(GraphicsContext3D::FRAMEBUFFER, GraphicsContext3D::DEPTH_ATTACHMENT, GraphicsContext3D::RENDERBUFFER, m_depthBuffer);
-    glClearColor(/* red */ 0, /* green */ 0, /* blue */ 0, /* alpha */ 0);
+    if (m_attrs.depth)
+        framebufferRenderbuffer(GraphicsContext3D::FRAMEBUFFER, GraphicsContext3D::DEPTH_ATTACHMENT, GraphicsContext3D::RENDERBUFFER, m_depthBuffer);
+#if !defined(QT_OPENGL_ES_2)
+    if (m_attrs.stencil)
+        framebufferRenderbuffer(GraphicsContext3D::FRAMEBUFFER, GraphicsContext3D::STENCIL_ATTACHMENT, GraphicsContext3D::RENDERBUFFER, m_depthBuffer);
+#endif
 
-    if (checkFramebufferStatus(GraphicsContext3D::FRAMEBUFFER) != GraphicsContext3D::FRAMEBUFFER_COMPLETE) {
-        LOG_ERROR("GraphicsContext3D: Wasn't able to create the main framebuffer");
-        m_contextValid = false;
+    GLenum status = checkFramebufferStatus(GraphicsContext3D::FRAMEBUFFER);
+    if (status != GraphicsContext3D::FRAMEBUFFER_COMPLETE) {
+        LOG_ERROR("GraphicsContext3D: Canvas FBO initialization failed.");
+        return;
     }
-}
 
-GraphicsContext3DInternal::~GraphicsContext3DInternal()
-{
-    delete m_glWidget;
-    m_glWidget = 0;
+    int clearFlags = GraphicsContext3D::COLOR_BUFFER_BIT;
+    if (m_attrs.depth)
+        clearFlags |= GraphicsContext3D::DEPTH_BUFFER_BIT;
+    if (m_attrs.stencil)
+        clearFlags |= GraphicsContext3D::STENCIL_BUFFER_BIT;
+
+    glClear(clearFlags);
+    glFlush();
 }
 
-QGLWidget* GraphicsContext3DInternal::getOwnerGLWidget(QWebPageClient* webPageClient)
+void GraphicsContext3DInternal::paint(QPainter* painter, const QStyleOptionGraphicsItem* option, QWidget* widget)
 {
-    QAbstractScrollArea* scrollArea = qobject_cast<QAbstractScrollArea*>(webPageClient->ownerWidget());
+    Q_UNUSED(widget);
 
-    if (scrollArea) 
-        return qobject_cast<QGLWidget*>(scrollArea->viewport());
+    QRectF rect = option ? option->rect : boundingRect();
 
-    return 0;
+    // Use direct texture mapping if WebGL canvas has a shared OpenGL context
+    // with browsers OpenGL context.
+    QGLWidget* viewportGLWidget = getViewportGLWidget();
+    if (viewportGLWidget && viewportGLWidget == m_viewportGLWidget && viewportGLWidget == painter->device()) {
+        viewportGLWidget->drawTexture(rect, m_texture);
+        return;
+    }
+
+    // Alternatively read pixels to a memory buffer.
+    QImage offscreenImage(rect.width(), rect.height(), QImage::Format_ARGB32);
+    quint32* imagePixels = reinterpret_cast<quint32*>(offscreenImage.bits());
+
+    m_glWidget->makeCurrent();
+    bindFramebuffer(GraphicsContext3D::FRAMEBUFFER, m_canvasFbo);
+    glReadPixels(/* x */ 0, /* y */ 0, rect.width(), rect.height(), GraphicsContext3D::RGBA, GraphicsContext3D::UNSIGNED_BYTE, imagePixels);
+
+    bindFramebuffer(GraphicsContext3D::FRAMEBUFFER, m_currentFbo);
+
+    // OpenGL gives us ABGR on 32 bits, and with the origin at the bottom left
+    // We need RGB32 or ARGB32_PM, with the origin at the top left.
+    quint32* pixelsSrc = imagePixels;
+    const int height = static_cast<int>(rect.height());
+    const int width = static_cast<int>(rect.width());
+    const int halfHeight = height / 2;
+    for (int row = 0; row < halfHeight; ++row) {
+        const int targetIdx = (height - 1 - row) * width;
+        quint32* pixelsDst = imagePixels + targetIdx;
+        for (int column = 0; column < width; ++column) {
+            quint32 tempPixel = *pixelsSrc;
+            *pixelsSrc = swapBgrToRgb(*pixelsDst);
+            *pixelsDst = swapBgrToRgb(tempPixel);
+            ++pixelsSrc;
+            ++pixelsDst;
+        }
+    }
+    if (static_cast<int>(height) % 2) {
+        for (int column = 0; column < width; ++column) {
+            *pixelsSrc = swapBgrToRgb(*pixelsSrc);
+            ++pixelsSrc;
+        }
+    }
+    painter->drawImage(/* x */ 0, /* y */ 0, offscreenImage);
+}
+
+QRectF GraphicsContext3DInternal::boundingRect() const
+{
+    return m_boundingRect;
 }
 
 void* GraphicsContext3DInternal::getProcAddress(const String& proc)
@@ -477,7 +594,7 @@ void* GraphicsContext3DInternal::getProcAddress(const String& proc)
     }
 
     LOG_ERROR("GraphicsContext3D: Did not find GL function %s", proc.utf8().data());
-    m_contextValid = false;
+    m_valid = false;
     return 0;
 }
 
@@ -493,7 +610,7 @@ PassRefPtr<GraphicsContext3D> GraphicsContext3D::create(GraphicsContext3D::Attri
 GraphicsContext3D::GraphicsContext3D(GraphicsContext3D::Attributes attrs, HostWindow* hostWindow, bool)
     : m_internal(new GraphicsContext3DInternal(attrs, hostWindow))
 {
-    if (!m_internal->isContextValid()) 
+    if (!m_internal->isValid())
         m_internal = 0;
 }
 
@@ -511,6 +628,11 @@ Platform3DObject GraphicsContext3D::platformTexture() const
     return m_internal->m_texture;
 }
 
+PlatformLayer* GraphicsContext3D::platformLayer() const
+{
+    return m_internal.get();
+}
+
 void GraphicsContext3D::makeContextCurrent()
 {
     m_internal->m_glWidget->makeCurrent();
@@ -522,62 +644,25 @@ void GraphicsContext3D::paintRenderingResultsToCanvas(CanvasRenderingContext* co
     HTMLCanvasElement* canvas = context->canvas();
     ImageBuffer* imageBuffer = canvas->buffer();
     QPainter* painter = imageBuffer->context()->platformContext();
-    paint(painter, QRect(QPoint(0, 0), QSize(m_currentWidth, m_currentHeight)));
+    m_internal->paint(painter, 0, 0);
 }
 
-void GraphicsContext3D::paint(QPainter* painter, const QRect& rect) const
+PassRefPtr<ImageData> GraphicsContext3D::paintRenderingResultsToImageData()
 {
-#if QT_VERSION >= QT_VERSION_CHECK(4, 7, 0)
-    QWebPageClient* webPageClient = m_internal->m_hostWindow->platformPageClient();
-    QGLWidget* ownerGLWidget  = m_internal->getOwnerGLWidget(webPageClient);
-    if (ownerGLWidget) {
-        ownerGLWidget->drawTexture(rect, m_internal->m_texture);
-        return;
-    } 
-#endif
-    m_internal->m_glWidget->makeCurrent();
-    m_internal->bindFramebuffer(GraphicsContext3D::FRAMEBUFFER, m_internal->m_mainFbo);
-    glReadPixels(/* x */ 0, /* y */ 0, m_currentWidth, m_currentHeight, GraphicsContext3D::RGBA, GraphicsContext3D::UNSIGNED_BYTE, m_internal->m_pixels.bits());
-    painter->drawImage(/* x */ 0, /* y */ 0, m_internal->m_pixels.rgbSwapped().transformed(QMatrix().rotate(180)));
-    m_internal->bindFramebuffer(GraphicsContext3D::FRAMEBUFFER, m_internal->m_currentFbo); 
+    // FIXME: This needs to be implemented for proper non-premultiplied-alpha
+    // support.
+    return 0;
 }
 
 void GraphicsContext3D::reshape(int width, int height)
 {
-    if (((width == m_currentWidth) && (height == m_currentHeight)) || (!m_internal))
+    if (width == m_currentWidth && height == m_currentHeight || (!m_internal))
         return;
-    
+
     m_currentWidth = width;
     m_currentHeight = height;
 
-    m_internal->m_pixels = QImage(m_currentWidth, m_currentHeight, QImage::Format_ARGB32);
-
-    m_internal->m_glWidget->makeCurrent();
-
-    glBindTexture(GraphicsContext3D::TEXTURE_2D, m_internal->m_texture);
-    glTexImage2D(GraphicsContext3D::TEXTURE_2D, /* level */ 0, GraphicsContext3D::RGBA, width, height, /* border */ 0, GraphicsContext3D::RGBA, GraphicsContext3D::UNSIGNED_BYTE, /* data */ 0);
-    glBindTexture(GraphicsContext3D::TEXTURE_2D, 0);
-   
-    m_internal->bindFramebuffer(GraphicsContext3D::FRAMEBUFFER, m_internal->m_mainFbo);
-    m_internal->bindRenderbuffer(GraphicsContext3D::RENDERBUFFER, m_internal->m_depthBuffer);
-#if defined(QT_OPENGL_ES_2)
-    renderbufferStorage(GraphicsContext3D::RENDERBUFFER, GraphicsContext3D::DEPTH_COMPONENT16, width, height);
-#else
-    renderbufferStorage(GraphicsContext3D::RENDERBUFFER, GraphicsContext3D::DEPTH_COMPONENT, width, height);
-#endif
-    m_internal->bindRenderbuffer(GraphicsContext3D::RENDERBUFFER, 0);
-    
-    m_internal->framebufferTexture2D(GraphicsContext3D::FRAMEBUFFER, GraphicsContext3D::COLOR_ATTACHMENT0, GraphicsContext3D::TEXTURE_2D, m_internal->m_texture, 0);
-    m_internal->framebufferRenderbuffer(GraphicsContext3D::FRAMEBUFFER, GraphicsContext3D::DEPTH_ATTACHMENT, GraphicsContext3D::RENDERBUFFER, m_internal->m_depthBuffer);
-
-    GLenum status = m_internal->checkFramebufferStatus(GraphicsContext3D::FRAMEBUFFER);
-    if (status != GraphicsContext3D::FRAMEBUFFER_COMPLETE) {
-        LOG_ERROR("GraphicsContext3D: Wasn't able to reshape the main framebuffer");
-        notImplemented();
-    }
-
-    glClear(GraphicsContext3D::COLOR_BUFFER_BIT);
-    glFlush();
+    m_internal->reshape(width, height);
 }
 
 IntSize GraphicsContext3D::getInternalFramebufferSize()
@@ -626,7 +711,7 @@ void GraphicsContext3D::bindBuffer(GC3Denum target, Platform3DObject buffer)
 void GraphicsContext3D::bindFramebuffer(GC3Denum target, Platform3DObject buffer)
 {
     m_internal->m_glWidget->makeCurrent();
-    m_internal->m_currentFbo = buffer ? buffer : m_internal->m_mainFbo;
+    m_internal->m_currentFbo = buffer ? buffer : m_internal->m_canvasFbo;
     m_internal->bindFramebuffer(target, m_internal->m_currentFbo);
 }
 
@@ -1064,6 +1149,23 @@ void GraphicsContext3D::releaseShaderCompiler()
 void GraphicsContext3D::renderbufferStorage(GC3Denum target, GC3Denum internalformat, GC3Dsizei width, GC3Dsizei height)
 {
     m_internal->m_glWidget->makeCurrent();
+#if !defined(QT_OPENGL_ES_2)
+    switch (internalformat) {
+    case DEPTH_STENCIL:
+        internalformat = GL_DEPTH24_STENCIL8;
+        break;
+    case DEPTH_COMPONENT16:
+        internalformat = DEPTH_COMPONENT;
+        break;
+    case RGBA4:
+    case RGB5_A1:
+        internalformat = RGBA;
+        break;
+    case RGB565:
+        internalformat = RGB;
+        break;
+    }
+#endif
     m_internal->renderbufferStorage(target, internalformat, width, height);
 }
 
@@ -1598,6 +1700,22 @@ void GraphicsContext3D::synthesizeGLError(GC3Denum error)
     m_internal->m_syntheticErrors.add(error);
 }
 
+void GraphicsContext3D::markLayerComposited()
+{
+    m_internal->m_layerComposited = true;
+}
+
+void GraphicsContext3D::markContextChanged()
+{
+    // FIXME: Any accelerated compositor needs to be told to re-read from here.
+    m_internal->m_layerComposited = false;
+}
+
+bool GraphicsContext3D::layerComposited() const
+{
+    return m_internal->m_layerComposited;
+}
+
 Extensions3D* GraphicsContext3D::getExtensions()
 {
     if (!m_internal->m_extensions)
diff --git a/Source/WebCore/platform/graphics/qt/GraphicsContextQt.cpp b/Source/WebCore/platform/graphics/qt/GraphicsContextQt.cpp
index 9742755..e3e0fa6 100644
--- a/Source/WebCore/platform/graphics/qt/GraphicsContextQt.cpp
+++ b/Source/WebCore/platform/graphics/qt/GraphicsContextQt.cpp
@@ -9,6 +9,7 @@
  * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies).
  * Copyright (C) 2008 Dirk Schulze <vbs85@gmx.de>
  * Copyright (C) 2010, 2011 Sencha, Inc.
+ * Copyright (C) 2011 Andreas Kling <kling@webkit.org>
  *
  * All rights reserved.
  *
@@ -672,8 +673,6 @@ void GraphicsContext::fillRect(const FloatRect& rect)
     ContextShadow* shadow = contextShadow();
 
     if (m_state.fillPattern) {
-        AffineTransform affine;
-        QBrush brush(m_state.fillPattern->createPlatformPattern(affine));
         QPixmap* image = m_state.fillPattern->tileImage()->nativeImageForCurrentFrame();
         QPainter* shadowPainter = hasShadow() ? shadow->beginShadowLayer(this, normalizedRect) : 0;
         if (shadowPainter) {
diff --git a/Source/WebCore/platform/graphics/qt/GraphicsLayerQt.cpp b/Source/WebCore/platform/graphics/qt/GraphicsLayerQt.cpp
index f3cfc47..1f77fc2 100644
--- a/Source/WebCore/platform/graphics/qt/GraphicsLayerQt.cpp
+++ b/Source/WebCore/platform/graphics/qt/GraphicsLayerQt.cpp
@@ -310,10 +310,6 @@ public:
         }
     } m_state;
 
-#if ENABLE(WEBGL)
-    const GraphicsContext3D* m_gc3D;
-#endif
-
 #ifndef QT_NO_ANIMATION
     friend class AnimationQtBase;
 #endif
@@ -340,9 +336,6 @@ GraphicsLayerQtImpl::GraphicsLayerQtImpl(GraphicsLayerQt* newLayer)
 #if ENABLE(TILED_BACKING_STORE)
     , m_tiledBackingStore(0)
 #endif
-#if ENABLE(WEBGL)
-    , m_gc3D(0)
-#endif
 {
     // We use graphics-view for compositing-only, not for interactivity.
     setAcceptedMouseButtons(Qt::NoButton);
@@ -665,11 +658,6 @@ void GraphicsLayerQtImpl::paint(QPainter* painter, const QStyleOptionGraphicsIte
     case MediaContentType:
         // we don't need to paint anything: we have a QGraphicsItem from the media element
         break;
-#if ENABLE(WEBGL)
-    case Canvas3DContentType:
-        m_gc3D->paint(painter, option->rect);
-        break;
-#endif
     }
 }
 
@@ -808,16 +796,6 @@ void GraphicsLayerQtImpl::flushChanges(bool recursive, bool forceUpdateTransform
 
             setFlag(ItemHasNoContents, !m_layer->drawsContent());
             break;
-
-#if ENABLE(WEBGL)
-        case Canvas3DContentType:
-            if (m_pendingContent.contentType != m_currentContent.contentType)
-                update();
-
-            setCacheMode(NoCache);
-            setFlag(ItemHasNoContents, false);
-            break;
-#endif
         }
     }
 
@@ -1268,23 +1246,6 @@ void GraphicsLayerQt::setContentsBackgroundColor(const Color& color)
     GraphicsLayer::setContentsBackgroundColor(color);
 }
 
-#if ENABLE(WEBGL)
-void GraphicsLayerQt::setContentsToGraphicsContext3D(const GraphicsContext3D* ctx)
-{
-    if (ctx == m_impl->m_gc3D)
-        return;
-
-    m_impl->m_pendingContent.contentType = GraphicsLayerQtImpl::Canvas3DContentType;
-    m_impl->m_gc3D = ctx;
-    m_impl->notifyChange(GraphicsLayerQtImpl::ContentChange);
-}
-
-void GraphicsLayerQt::setGraphicsContext3DNeedsDisplay()
-{
-    setNeedsDisplay();
-}
-#endif
-
 void GraphicsLayerQt::setContentsToMedia(PlatformLayer* media)
 {
     if (media) {
@@ -1297,6 +1258,11 @@ void GraphicsLayerQt::setContentsToMedia(PlatformLayer* media)
     GraphicsLayer::setContentsToMedia(media);
 }
 
+void GraphicsLayerQt::setContentsToCanvas(PlatformLayer* canvas)
+{
+    setContentsToMedia(canvas);
+}
+
 /* \reimp (GraphicsLayer.h)
 */
 void GraphicsLayerQt::setContentsOrientation(CompositingCoordinatesOrientation orientation)
diff --git a/Source/WebCore/platform/graphics/qt/GraphicsLayerQt.h b/Source/WebCore/platform/graphics/qt/GraphicsLayerQt.h
index 569bd8d..2af98fd 100644
--- a/Source/WebCore/platform/graphics/qt/GraphicsLayerQt.h
+++ b/Source/WebCore/platform/graphics/qt/GraphicsLayerQt.h
@@ -20,9 +20,6 @@
 #ifndef GraphicsLayerQt_h
 #define GraphicsLayerQt_h
 
-#if ENABLE(WEBGL)
-#include "GraphicsContext3D.h"
-#endif
 #include "GraphicsLayer.h"
 #include "GraphicsLayerClient.h"
 
@@ -78,11 +75,8 @@ public:
     virtual void setContentsToImage(Image*);
     virtual void setContentsNeedsDisplay();
     virtual void setContentsToMedia(PlatformLayer*);
+    virtual void setContentsToCanvas(PlatformLayer*);
     virtual void setContentsBackgroundColor(const Color&);
-#if ENABLE(WEBGL)
-    virtual void setContentsToGraphicsContext3D(const GraphicsContext3D*);
-    virtual void setGraphicsContext3DNeedsDisplay();
-#endif
     virtual void setContentsOrientation(CompositingCoordinatesOrientation orientation);
     virtual void distributeOpacity(float);
     virtual float accumulatedOpacity() const;
diff --git a/Source/WebCore/platform/graphics/qt/ImageBufferData.h b/Source/WebCore/platform/graphics/qt/ImageBufferData.h
index aa32253..602197e 100644
--- a/Source/WebCore/platform/graphics/qt/ImageBufferData.h
+++ b/Source/WebCore/platform/graphics/qt/ImageBufferData.h
@@ -42,6 +42,8 @@ class ImageBufferData {
 public:
     ImageBufferData(const IntSize&);
 
+    QImage toQImage() const;
+
     QPixmap m_pixmap;
     OwnPtr<QPainter> m_painter;
     RefPtr<Image> m_image;
diff --git a/Source/WebCore/platform/graphics/qt/ImageBufferQt.cpp b/Source/WebCore/platform/graphics/qt/ImageBufferQt.cpp
index 62f5c3e..f7d63ca 100644
--- a/Source/WebCore/platform/graphics/qt/ImageBufferQt.cpp
+++ b/Source/WebCore/platform/graphics/qt/ImageBufferQt.cpp
@@ -80,6 +80,21 @@ ImageBufferData::ImageBufferData(const IntSize& size)
     m_image = StillImage::createForRendering(&m_pixmap);
 }
 
+QImage ImageBufferData::toQImage() const
+{
+    QPaintEngine* paintEngine = m_pixmap.paintEngine();
+    if (!paintEngine || paintEngine->type() != QPaintEngine::Raster)
+        return m_pixmap.toImage();
+
+    // QRasterPixmapData::toImage() will deep-copy the backing QImage if there's an active QPainter on it.
+    // For performance reasons, we don't want that here, so we temporarily redirect the paint engine.
+    QPaintDevice* currentPaintDevice = paintEngine->paintDevice();
+    paintEngine->setPaintDevice(0);
+    QImage image = m_pixmap.toImage();
+    paintEngine->setPaintDevice(currentPaintDevice);
+    return image;
+}
+
 ImageBuffer::ImageBuffer(const IntSize& size, ColorSpace, RenderingMode, bool& success)
     : m_data(size)
     , m_size(size)
@@ -159,7 +174,7 @@ void ImageBuffer::platformTransformColorSpace(const Vector<int>& lookUpTable)
     if (isPainting)
         m_data.m_painter->end();
 
-    QImage image = m_data.m_pixmap.toImage().convertToFormat(QImage::Format_ARGB32);
+    QImage image = m_data.toQImage().convertToFormat(QImage::Format_ARGB32);
     ASSERT(!image.isNull());
 
     uchar* bits = image.bits();
@@ -214,16 +229,12 @@ PassRefPtr<ByteArray> getImageData(const IntRect& rect, const ImageBufferData& i
     int numRows = endy - originy;
 
     // NOTE: For unmultiplied data, we undo the premultiplication below.
-    QImage image = imageData.m_pixmap.toImage().convertToFormat(QImage::Format_ARGB32_Premultiplied);
+    QImage image = imageData.toQImage().convertToFormat(QImage::Format_ARGB32_Premultiplied);
 
     ASSERT(!image.isNull());
 
     const int bytesPerLine = image.bytesPerLine();
-#if QT_VERSION >= QT_VERSION_CHECK(4, 7, 0)
     const uchar* bits = image.constBits();
-#else
-    const uchar* bits = image.bits();
-#endif
 
     quint32* destRows = reinterpret_cast_ptr<quint32*>(&data[desty * rect.width() * 4 + destx * 4]);
 
diff --git a/Source/WebCore/platform/graphics/qt/ImageDecoderQt.cpp b/Source/WebCore/platform/graphics/qt/ImageDecoderQt.cpp
index 3540994..8cda231 100644
--- a/Source/WebCore/platform/graphics/qt/ImageDecoderQt.cpp
+++ b/Source/WebCore/platform/graphics/qt/ImageDecoderQt.cpp
@@ -194,15 +194,7 @@ void ImageDecoderQt::internalReadImage(size_t frameIndex)
 
 bool ImageDecoderQt::internalHandleCurrentImage(size_t frameIndex)
 {
-    QPixmap pixmap;
-
-#if QT_VERSION >= QT_VERSION_CHECK(4, 7, 0)
-    pixmap = QPixmap::fromImageReader(m_reader.get());
-#else
-    QImage img;
-    if (m_reader->read(&img))
-        pixmap = QPixmap::fromImage(img);
-#endif
+    QPixmap pixmap = QPixmap::fromImageReader(m_reader.get());
 
     if (pixmap.isNull()) {
         frameCount();
diff --git a/Source/WebCore/platform/graphics/qt/MediaPlayerPrivateQt.cpp b/Source/WebCore/platform/graphics/qt/MediaPlayerPrivateQt.cpp
index 001d45b..bc43acf 100644
--- a/Source/WebCore/platform/graphics/qt/MediaPlayerPrivateQt.cpp
+++ b/Source/WebCore/platform/graphics/qt/MediaPlayerPrivateQt.cpp
@@ -74,7 +74,7 @@ void MediaPlayerPrivateQt::getSupportedTypes(HashSet<String> &supported)
 
     for (int i = 0; i < types.size(); i++) {
         QString mime = types.at(i);
-        if (mime.startsWith("audio/") || mime.startsWith("video/"))
+        if (mime.startsWith(QString::fromLatin1("audio/")) || mime.startsWith(QString::fromLatin1("video/")))
             supported.add(mime);
     }
 }
@@ -103,7 +103,6 @@ MediaPlayerPrivateQt::MediaPlayerPrivateQt(MediaPlayer* player)
     , m_isVisible(false)
     , m_isSeeking(false)
     , m_composited(false)
-    , m_queuedSeek(-1)
     , m_preload(MediaPlayer::Auto)
     , m_suppressNextPlaybackChanged(false)
 {
@@ -195,7 +194,7 @@ void MediaPlayerPrivateQt::commitLoad(const String& url)
     HTMLMediaElement* element = static_cast<HTMLMediaElement*>(m_webCorePlayer->mediaPlayerClient());
 
     // Construct the media content with a network request if the resource is http[s]
-    if (scheme == "http" || scheme == "https") {
+    if (scheme == QString::fromLatin1("http") || scheme == QString::fromLatin1("https")) {
         QNetworkRequest request = QNetworkRequest(rUrl);
 
         // Grab the current document
@@ -220,7 +219,7 @@ void MediaPlayerPrivateQt::commitLoad(const String& url)
 
             // Set the refferer, but not when requesting insecure content from a secure page
             QUrl documentUrl = QUrl(QString(document->documentURI()));
-            if (documentUrl.scheme().toLower() == "http" || scheme == "https")
+            if (documentUrl.scheme().toLower() == QString::fromLatin1("http") || scheme == QString::fromLatin1("https"))
                 request.setRawHeader("Referer", documentUrl.toEncoded());
 
             // Set the user agent
@@ -296,32 +295,8 @@ void MediaPlayerPrivateQt::seek(float position)
     if (m_mediaPlayerControl && !m_mediaPlayerControl->availablePlaybackRanges().contains(position * 1000))
         return;
 
-    if (m_isSeeking)
-        return;
-
-    if (position > duration())
-        position = duration();
-
-    // Seeking is most reliable when we're paused.
-    // Webkit will try to pause before seeking, but due to the asynchronous nature
-    // of the backend, the player may not actually be paused yet.
-    // In this case, we should queue the seek and wait until pausing has completed
-    // before attempting to seek.
-    if (m_mediaPlayer->state() == QMediaPlayer::PlayingState) {
-        m_mediaPlayer->pause();
-        m_isSeeking = true;
-        m_queuedSeek = static_cast<qint64>(position * 1000);
-
-        // Set a timeout, so that in the event that we don't get a state changed
-        // signal, we still attempt the seek.
-        QTimer::singleShot(1000, this, SLOT(queuedSeekTimeout()));
-    } else {
-        m_isSeeking = true;
-        m_mediaPlayer->setPosition(static_cast<qint64>(position * 1000));
-
-        // Set a timeout, in case we don't get a position changed signal
-        QTimer::singleShot(10000, this, SLOT(seekTimeout()));
-    }
+    m_isSeeking = true;
+    m_mediaPlayer->setPosition(static_cast<qint64>(position * 1000));
 }
 
 bool MediaPlayerPrivateQt::seeking() const
@@ -443,13 +418,8 @@ void MediaPlayerPrivateQt::handleError(QMediaPlayer::Error)
     updateStates();
 }
 
-void MediaPlayerPrivateQt::stateChanged(QMediaPlayer::State state)
+void MediaPlayerPrivateQt::stateChanged(QMediaPlayer::State)
 {
-    if (state != QMediaPlayer::PlayingState && m_isSeeking && m_queuedSeek >= 0) {
-        m_mediaPlayer->setPosition(m_queuedSeek);
-        m_queuedSeek = -1;
-    }
-
     if (!m_suppressNextPlaybackChanged)
         m_webCorePlayer->playbackStateChanged();
     else
@@ -468,34 +438,12 @@ void MediaPlayerPrivateQt::nativeSizeChanged(const QSizeF& size)
     m_webCorePlayer->sizeChanged();
 }
 
-void MediaPlayerPrivateQt::queuedSeekTimeout()
-{
-    // If we haven't heard anything, assume the player is now paused
-    // and we can attempt the seek
-    if (m_isSeeking && m_queuedSeek >= 0) {
-        m_mediaPlayer->setPosition(m_queuedSeek);
-        m_queuedSeek = -1;
-
-        // Set a timeout, in case we don't get a position changed signal
-        QTimer::singleShot(10000, this, SLOT(seekTimeout()));
-    }
-}
-
-void MediaPlayerPrivateQt::seekTimeout()
-{
-    // If we haven't heard anything, assume the seek succeeded
-    if (m_isSeeking) {
-        m_webCorePlayer->timeChanged();
-        m_isSeeking = false;
-    }
-}
-
 void MediaPlayerPrivateQt::positionChanged(qint64)
 {
     // Only propagate this event if we are seeking
-    if (m_isSeeking && m_queuedSeek == -1) {
-        m_webCorePlayer->timeChanged();
+    if (m_isSeeking) {
         m_isSeeking = false;
+        m_webCorePlayer->timeChanged();
     }
 }
 
@@ -649,7 +597,7 @@ void MediaPlayerPrivateQt::repaint()
 
 #if USE(ACCELERATED_COMPOSITING) && USE(TEXTURE_MAPPER)
 
-class TextureMapperVideoLayerQt : public virtual TextureMapperVideoLayer {
+class TextureMapperVideoLayerQt : public virtual TextureMapperMediaLayer {
 public:
     TextureMapperVideoLayerQt(QGraphicsVideoItem* videoItem)
         : m_videoItem(videoItem)
diff --git a/Source/WebCore/platform/graphics/qt/MediaPlayerPrivateQt.h b/Source/WebCore/platform/graphics/qt/MediaPlayerPrivateQt.h
index 81cdd79..c6398c9 100644
--- a/Source/WebCore/platform/graphics/qt/MediaPlayerPrivateQt.h
+++ b/Source/WebCore/platform/graphics/qt/MediaPlayerPrivateQt.h
@@ -33,7 +33,7 @@ QT_END_NAMESPACE
 
 namespace WebCore {
 
-class TextureMapperVideoLayer;
+class TextureMapperMediaLayer;
 
 class MediaPlayerPrivateQt : public QObject, public MediaPlayerPrivateInterface {
 
@@ -120,8 +120,6 @@ private slots:
     void handleError(QMediaPlayer::Error);
     void stateChanged(QMediaPlayer::State);
     void nativeSizeChanged(const QSizeF&);
-    void queuedSeekTimeout();
-    void seekTimeout();
     void positionChanged(qint64);
     void durationChanged(qint64);
     void bufferStatusChanged(int);
@@ -141,7 +139,7 @@ private:
     QGraphicsVideoItem* m_videoItem;
     QGraphicsScene* m_videoScene;
 #if USE(ACCELERATED_COMPOSITING) && USE(TEXTURE_MAPPER)
-    OwnPtr<TextureMapperVideoLayer> m_platformLayer;
+    OwnPtr<TextureMapperMediaLayer> m_platformLayer;
 #endif
 
     mutable MediaPlayer::NetworkState m_networkState;
@@ -153,7 +151,6 @@ private:
     bool m_isVisible;
     bool m_isSeeking;
     bool m_composited;
-    qint64 m_queuedSeek;
     MediaPlayer::Preload m_preload;
     bool m_delayingLoad;
     String m_mediaUrl;
diff --git a/Source/WebCore/platform/graphics/qt/PathQt.cpp b/Source/WebCore/platform/graphics/qt/PathQt.cpp
index ad482f7..ccc7f3d 100644
--- a/Source/WebCore/platform/graphics/qt/PathQt.cpp
+++ b/Source/WebCore/platform/graphics/qt/PathQt.cpp
@@ -154,7 +154,7 @@ FloatRect Path::boundingRect() const
     return m_path.boundingRect();
 }
 
-FloatRect Path::strokeBoundingRect(StrokeStyleApplier* applier)
+FloatRect Path::strokeBoundingRect(StrokeStyleApplier* applier) const
 {
     GraphicsContext* context = scratchContext();
     QPainterPathStroker stroke;
@@ -398,23 +398,15 @@ void Path::apply(void* info, PathApplierFunction function) const
 void Path::transform(const AffineTransform& transform)
 {
     QTransform qTransform(transform);
-#if QT_VERSION < QT_VERSION_CHECK(4, 7, 0)
-    // Workaround for http://bugreports.qt.nokia.com/browse/QTBUG-11264
-    // QTransform.map doesn't handle the MoveTo element because of the isEmpty issue
-    if (m_path.isEmpty() && m_path.elementCount()) {
-        QPointF point = qTransform.map(m_path.currentPosition());
-        moveTo(point);
-    } else 
-#endif
-        m_path = qTransform.map(m_path);
-}
-
-float Path::length()
+    m_path = qTransform.map(m_path);
+}
+
+float Path::length() const
 {
     return m_path.length();
 }
 
-FloatPoint Path::pointAtLength(float length, bool& ok)
+FloatPoint Path::pointAtLength(float length, bool& ok) const
 {
     ok = (length >= 0 && length <= m_path.length());
 
@@ -424,7 +416,7 @@ FloatPoint Path::pointAtLength(float length, bool& ok)
     return point;
 }
 
-float Path::normalAngleAtLength(float length, bool& ok)
+float Path::normalAngleAtLength(float length, bool& ok) const
 {
     ok = (length >= 0 && length <= m_path.length());
 
diff --git a/Source/WebCore/platform/graphics/qt/TileQt.cpp b/Source/WebCore/platform/graphics/qt/TileQt.cpp
index 096ce14..8723cd4 100644
--- a/Source/WebCore/platform/graphics/qt/TileQt.cpp
+++ b/Source/WebCore/platform/graphics/qt/TileQt.cpp
@@ -91,10 +91,10 @@ void Tile::invalidate(const IntRect& dirtyRect)
     *m_dirtyRegion += tileDirtyRect;
 }
     
-void Tile::updateBackBuffer()
+Vector<IntRect> Tile::updateBackBuffer()
 {
     if (m_buffer && !isDirty())
-        return;
+        return Vector<IntRect>();
 
     if (!m_backBuffer) {
         if (!m_buffer) {
@@ -115,15 +115,19 @@ void Tile::updateBackBuffer()
     GraphicsContext context(&painter);
     context.translate(-m_rect.x(), -m_rect.y());
 
+    Vector<IntRect> updatedRects;
     int size = dirtyRects.size();
     for (int n = 0; n < size; ++n)  {
         context.save();
         IntRect rect = dirtyRects[n];
+        updatedRects.append(rect);
         context.clip(FloatRect(rect));
         context.scale(FloatSize(m_backingStore->m_contentsScale, m_backingStore->m_contentsScale));
         m_backingStore->m_client->tiledBackingStorePaint(&context, m_backingStore->mapToContents(rect));
         context.restore();
     }
+
+    return updatedRects;
 }
 
 void Tile::swapBackBufferToFront()
diff --git a/Source/WebCore/platform/graphics/skia/FontCustomPlatformData.cpp b/Source/WebCore/platform/graphics/skia/FontCustomPlatformData.cpp
index 0e68c21..cc695a5 100644
--- a/Source/WebCore/platform/graphics/skia/FontCustomPlatformData.cpp
+++ b/Source/WebCore/platform/graphics/skia/FontCustomPlatformData.cpp
@@ -65,7 +65,8 @@ FontCustomPlatformData::~FontCustomPlatformData()
 #endif
 }
 
-FontPlatformData FontCustomPlatformData::fontPlatformData(int size, bool bold, bool italic, FontOrientation orientation, FontWidthVariant, FontRenderingMode mode)
+FontPlatformData FontCustomPlatformData::fontPlatformData(int size, bool bold, bool italic, FontOrientation orientation,
+                                                          TextOrientation textOrientation, FontWidthVariant, FontRenderingMode mode)
 {
 #if OS(WINDOWS)
     ASSERT(m_fontReference);
@@ -102,7 +103,7 @@ FontPlatformData FontCustomPlatformData::fontPlatformData(int size, bool bold, b
     return FontPlatformData(hfont, size);
 #elif OS(LINUX) || OS(FREEBSD) || PLATFORM(BREWMP)
     ASSERT(m_fontReference);
-    return FontPlatformData(m_fontReference, "", size, bold && !m_fontReference->isBold(), italic && !m_fontReference->isItalic(), orientation);
+    return FontPlatformData(m_fontReference, "", size, bold && !m_fontReference->isBold(), italic && !m_fontReference->isItalic(), orientation, textOrientation);
 #else
     notImplemented();
     return FontPlatformData();
diff --git a/Source/WebCore/platform/graphics/skia/FontCustomPlatformData.h b/Source/WebCore/platform/graphics/skia/FontCustomPlatformData.h
index 2dee3ab..b68722b 100644
--- a/Source/WebCore/platform/graphics/skia/FontCustomPlatformData.h
+++ b/Source/WebCore/platform/graphics/skia/FontCustomPlatformData.h
@@ -35,6 +35,7 @@
 #include "FontOrientation.h"
 #include "FontRenderingMode.h"
 #include "FontWidthVariant.h"
+#include "TextOrientation.h"
 #include <wtf/Forward.h>
 #include <wtf/Noncopyable.h>
 
@@ -66,8 +67,8 @@ public:
 
     ~FontCustomPlatformData();
 
-    FontPlatformData fontPlatformData(int size, bool bold, bool italic, FontOrientation = Horizontal, FontWidthVariant = RegularWidth,
-                                      FontRenderingMode = NormalRenderingMode);
+    FontPlatformData fontPlatformData(int size, bool bold, bool italic, FontOrientation = Horizontal, TextOrientation = TextOrientationVerticalRight,
+                                      FontWidthVariant = RegularWidth, FontRenderingMode = NormalRenderingMode);
 
     static bool supportsFormat(const String&);
 
diff --git a/Source/WebCore/platform/graphics/skia/GlyphPageTreeNodeSkia.cpp b/Source/WebCore/platform/graphics/skia/GlyphPageTreeNodeSkia.cpp
index 66e6839..f362fa3 100644
--- a/Source/WebCore/platform/graphics/skia/GlyphPageTreeNodeSkia.cpp
+++ b/Source/WebCore/platform/graphics/skia/GlyphPageTreeNodeSkia.cpp
@@ -91,7 +91,7 @@ bool GlyphPage::fill(unsigned offset, unsigned length, UChar* buffer, unsigned b
         return false;
     }
 
-    if ((fontData->orientation() == Vertical) && (!fontData->isBrokenIdeographFont())) {
+    if (fontData->hasVerticalGlyphs()) {
         bool lookVariants = false;
         for (unsigned i = 0; i < bufferLength; ++i) {
             if (!Font::isCJKIdeograph(buffer[i])) {
diff --git a/Source/WebCore/platform/graphics/skia/GraphicsContextSkia.cpp b/Source/WebCore/platform/graphics/skia/GraphicsContextSkia.cpp
index 00afd07..df680eb 100644
--- a/Source/WebCore/platform/graphics/skia/GraphicsContextSkia.cpp
+++ b/Source/WebCore/platform/graphics/skia/GraphicsContextSkia.cpp
@@ -1025,6 +1025,14 @@ void GraphicsContext::setPlatformShadow(const FloatSize& size,
     if (paintingDisabled())
         return;
 
+    if (platformContext()->useGPU()) {
+        GLES2Canvas* canvas = platformContext()->gpuCanvas();
+        canvas->setShadowOffset(size);
+        canvas->setShadowBlur(blurFloat);
+        canvas->setShadowColor(color, colorSpace);
+        canvas->setShadowsIgnoreTransforms(m_state.shadowsIgnoreTransforms);
+    }
+
     // Detect when there's no effective shadow and clear the looper.
     if (!size.width() && !size.height() && !blurFloat) {
         platformContext()->setDrawLooper(0);
@@ -1035,14 +1043,15 @@ void GraphicsContext::setPlatformShadow(const FloatSize& size,
     double height = size.height();
     double blur = blurFloat;
 
-    SkBlurDrawLooper::BlurFlags blurFlags = SkBlurDrawLooper::kNone_BlurFlag;
+    uint32_t blurFlags = SkBlurDrawLooper::kHighQuality_BlurFlag | 
+        SkBlurDrawLooper::kOverrideColor_BlurFlag;
 
     if (m_state.shadowsIgnoreTransforms)  {
         // Currently only the GraphicsContext associated with the
         // CanvasRenderingContext for HTMLCanvasElement have shadows ignore
         // Transforms. So with this flag set, we know this state is associated
         // with a CanvasRenderingContext.
-        blurFlags = SkBlurDrawLooper::kIgnoreTransform_BlurFlag;
+        blurFlags |= SkBlurDrawLooper::kIgnoreTransform_BlurFlag;
         
         // CG uses natural orientation for Y axis, but the HTML5 canvas spec
         // does not.
diff --git a/Source/WebCore/platform/graphics/skia/ImageBufferSkia.cpp b/Source/WebCore/platform/graphics/skia/ImageBufferSkia.cpp
index 2721523..b89c68d 100644
--- a/Source/WebCore/platform/graphics/skia/ImageBufferSkia.cpp
+++ b/Source/WebCore/platform/graphics/skia/ImageBufferSkia.cpp
@@ -341,6 +341,28 @@ void ImageBuffer::putPremultipliedImageData(ByteArray* source, const IntSize& so
     putImageData<Premultiplied>(source, sourceSize, sourceRect, destPoint, context()->platformContext()->canvas()->getDevice(), m_size);
 }
 
+template <typename T>
+static String ImageToDataURL(T& source, const String& mimeType, const double* quality)
+{
+    Vector<unsigned char> encodedImage;
+    if (mimeType == "image/jpeg") {
+        int compressionQuality = JPEGImageEncoder::DefaultCompressionQuality;
+        if (quality && *quality >= 0.0 && *quality <= 1.0)
+            compressionQuality = static_cast<int>(*quality * 100 + 0.5);
+        if (!JPEGImageEncoder::encode(source, compressionQuality, &encodedImage))
+            return "data:,";
+    } else {
+        if (!PNGImageEncoder::encode(source, &encodedImage))
+            return "data:,";
+        ASSERT(mimeType == "image/png");
+    }
+
+    Vector<char> base64Data;
+    base64Encode(*reinterpret_cast<Vector<char>*>(&encodedImage), base64Data);
+
+    return makeString("data:", mimeType, ";base64,", base64Data);
+}
+
 String ImageBuffer::toDataURL(const String& mimeType, const double* quality) const
 {
     ASSERT(MIMETypeRegistry::isSupportedImageMIMETypeForEncoding(mimeType));
@@ -358,23 +380,13 @@ String ImageBuffer::toDataURL(const String& mimeType, const double* quality) con
         if (!device->readPixels(bounds, &bitmap))
             return "data:,";
     }
-    
-    if (mimeType == "image/jpeg") {
-        int compressionQuality = JPEGImageEncoder::DefaultCompressionQuality;
-        if (quality && *quality >= 0.0 && *quality <= 1.0)
-            compressionQuality = static_cast<int>(*quality * 100 + 0.5);
-        if (!JPEGImageEncoder::encode(bitmap, compressionQuality, &encodedImage))
-            return "data:,";
-    } else {
-        if (!PNGImageEncoder::encode(bitmap, &encodedImage))
-            return "data:,";
-        ASSERT(mimeType == "image/png");
-    }
 
-    Vector<char> base64Data;
-    base64Encode(*reinterpret_cast<Vector<char>*>(&encodedImage), base64Data);
+    return ImageToDataURL(bitmap, mimeType, quality);
+}
 
-    return makeString("data:", mimeType, ";base64,", base64Data);
+String ImageDataToDataURL(const ImageData& source, const String& mimeType, const double* quality)
+{
+    return ImageToDataURL(source, mimeType, quality);
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/graphics/skia/ImageSkia.cpp b/Source/WebCore/platform/graphics/skia/ImageSkia.cpp
index 91a4e4f..72bec29 100644
--- a/Source/WebCore/platform/graphics/skia/ImageSkia.cpp
+++ b/Source/WebCore/platform/graphics/skia/ImageSkia.cpp
@@ -260,6 +260,7 @@ static void paintSkBitmap(PlatformContextSkia* platformContext, const NativeImag
     paint.setXfermodeMode(compOp);
     paint.setFilterBitmap(true);
     paint.setAlpha(platformContext->getNormalizedAlpha());
+    paint.setLooper(platformContext->getDrawLooper());
 
     skia::PlatformCanvas* canvas = platformContext->canvas();
 
diff --git a/Source/WebCore/platform/graphics/skia/PathSkia.cpp b/Source/WebCore/platform/graphics/skia/PathSkia.cpp
index 0344086..b037a0d 100644
--- a/Source/WebCore/platform/graphics/skia/PathSkia.cpp
+++ b/Source/WebCore/platform/graphics/skia/PathSkia.cpp
@@ -228,7 +228,7 @@ void Path::transform(const AffineTransform& xform)
     m_path->transform(xform);
 }
 
-FloatRect Path::strokeBoundingRect(StrokeStyleApplier* applier)
+FloatRect Path::strokeBoundingRect(StrokeStyleApplier* applier) const
 {
     GraphicsContext* scratch = scratchContext();
     scratch->save();
diff --git a/Source/WebCore/platform/graphics/skia/PlatformContextSkia.cpp b/Source/WebCore/platform/graphics/skia/PlatformContextSkia.cpp
index eac5e4a..8e1937f 100644
--- a/Source/WebCore/platform/graphics/skia/PlatformContextSkia.cpp
+++ b/Source/WebCore/platform/graphics/skia/PlatformContextSkia.cpp
@@ -68,18 +68,6 @@
 
 namespace WebCore {
 
-#if ENABLE(SKIA_GPU)
-GrContext* GetGlobalGrContext()
-{
-    static GrContext* gGR;
-    if (!gGR) {
-        gGR = GrContext::CreateGLShaderContext();
-        gGR->setTextureCacheLimits(512, 50 * 1024 * 1024);
-    }
-    return gGR;
-}
-#endif
-
 extern bool isPathSkiaSafe(const SkMatrix& transform, const SkPath& path);
 
 // State -----------------------------------------------------------------------
@@ -241,8 +229,14 @@ PlatformContextSkia::PlatformContextSkia(skia::PlatformCanvas* canvas)
 PlatformContextSkia::~PlatformContextSkia()
 {
 #if ENABLE(ACCELERATED_2D_CANVAS)
-    if (m_gpuCanvas)
+    if (m_gpuCanvas) {
+#if ENABLE(SKIA_GPU)
+        // make sure everything related to this platform context has been flushed
+        if (!m_useGPU)
+            m_gpuCanvas->context()->grContext()->flush(0);
+#endif
         m_gpuCanvas->drawingBuffer()->setWillPublishCallback(0);
+    }
 #endif
 }
 
@@ -697,8 +691,7 @@ void PlatformContextSkia::applyAntiAliasedClipPaths(WTF::Vector<SkPath>& paths)
 
 bool PlatformContextSkia::canAccelerate() const
 {
-    return !m_state->m_fillShader // Can't accelerate with a fill gradient or pattern.
-        && !m_state->m_looper; // Can't accelerate with a shadow.
+    return !m_state->m_fillShader; // Can't accelerate with a fill gradient or pattern.
 }
 
 bool PlatformContextSkia::canvasClipApplied() const
@@ -741,8 +734,10 @@ void PlatformContextSkia::setSharedGraphicsContext3D(SharedGraphicsContext3D* co
         context->makeContextCurrent();
         m_gpuCanvas->bindFramebuffer();
 
-        GrContext* gr = GetGlobalGrContext();
+        GrContext* gr = context->grContext();
         gr->resetContext();
+        drawingBuffer->setGrContext(gr);
+
         SkDeviceFactory* factory = new SkGpuDeviceFactory(gr, SkGpuDevice::Current3DApiRenderTarget());
         SkDevice* device = factory->newDevice(m_canvas, SkBitmap::kARGB_8888_Config, drawingBuffer->size().width(), drawingBuffer->size().height(), false, false);
         m_canvas->setDevice(device)->unref();
diff --git a/Source/WebCore/platform/graphics/skia/SkiaFontWin.cpp b/Source/WebCore/platform/graphics/skia/SkiaFontWin.cpp
index 54aa35e..b0cb0c7 100644
--- a/Source/WebCore/platform/graphics/skia/SkiaFontWin.cpp
+++ b/Source/WebCore/platform/graphics/skia/SkiaFontWin.cpp
@@ -380,6 +380,11 @@ bool paintSkiaText(GraphicsContext* context,
         paint.reset();
         platformContext->setupPaintForStroking(&paint, 0, 0);
         paint.setFlags(SkPaint::kAntiAlias_Flag);
+#if ENABLE(SKIA_TEXT)
+        paint.setTextEncoding(SkPaint::kGlyphID_TextEncoding);
+        setupPaintForFont(hfont, &paint);
+#endif
+
         if (didFill) {
             // If there is a shadow and we filled above, there will already be
             // a shadow. We don't want to draw it again or it will be too dark
@@ -390,7 +395,7 @@ bool paintSkiaText(GraphicsContext* context,
             // thing would be to draw to a new layer and then draw that layer
             // with a shadow. But this is a lot of extra work for something
             // that isn't normally an issue.
-            SkSafeUnref(paint.setLooper(0));
+            paint.setLooper(0);
         }
 
         if (!skiaDrawText(hfont, dc, platformContext->canvas(), *origin, &paint,
diff --git a/Source/WebCore/platform/graphics/texmap/GraphicsLayerTextureMapper.cpp b/Source/WebCore/platform/graphics/texmap/GraphicsLayerTextureMapper.cpp
index 4698239..760ba6c 100644
--- a/Source/WebCore/platform/graphics/texmap/GraphicsLayerTextureMapper.cpp
+++ b/Source/WebCore/platform/graphics/texmap/GraphicsLayerTextureMapper.cpp
@@ -336,7 +336,7 @@ void GraphicsLayerTextureMapper::setContentsToMedia(PlatformLayer* media)
     notifyChange(TextureMapperNode::ContentChange);
     m_pendingContent.contentType = media ? TextureMapperNode::MediaContentType : TextureMapperNode::HTMLContentType;
     if (media)
-        m_pendingContent.media = static_cast<TextureMapperVideoLayer*>(media);
+        m_pendingContent.media = static_cast<TextureMapperMediaLayer*>(media);
     else
         m_pendingContent.media = 0;
 }
@@ -366,13 +366,6 @@ void GraphicsLayerTextureMapper::syncCompositingState()
 }
 
 /* \reimp (GraphicsLayer.h)
- */
-NativeLayer GraphicsLayerTextureMapper::nativeLayer() const
-{
-    return m_node.get();
-}
-
-/* \reimp (GraphicsLayer.h)
 */
 PlatformLayer* GraphicsLayerTextureMapper::platformLayer() const
 {
diff --git a/Source/WebCore/platform/graphics/texmap/GraphicsLayerTextureMapper.h b/Source/WebCore/platform/graphics/texmap/GraphicsLayerTextureMapper.h
index 47a27c6..dcf4938 100644
--- a/Source/WebCore/platform/graphics/texmap/GraphicsLayerTextureMapper.h
+++ b/Source/WebCore/platform/graphics/texmap/GraphicsLayerTextureMapper.h
@@ -81,7 +81,6 @@ public:
     virtual void syncCompositingState();
     virtual void syncCompositingStateForThisLayerOnly();
     virtual void setName(const String& name);
-    virtual NativeLayer nativeLayer() const;
     virtual PlatformLayer* platformLayer() const;
 
     virtual bool addAnimation(const KeyframeValueList&, const IntSize& /*boxSize*/, const Animation*, const String& /*keyframesName*/, double /*timeOffset*/) { return false; }
diff --git a/Source/WebCore/platform/graphics/texmap/TextureMapper.h b/Source/WebCore/platform/graphics/texmap/TextureMapper.h
index 589fda1..8e46e3c 100644
--- a/Source/WebCore/platform/graphics/texmap/TextureMapper.h
+++ b/Source/WebCore/platform/graphics/texmap/TextureMapper.h
@@ -31,6 +31,7 @@
 #include "IntRect.h"
 #include "IntSize.h"
 #include "TransformationMatrix.h"
+#include <wtf/UnusedParam.h>
 
 /*
     TextureMapper is a mechanism that enables hardware acceleration of CSS animations (accelerated compositing) without
@@ -68,7 +69,7 @@ public:
         return beginPaint(IntRect(0, 0, size().width(), size().height()));
     }
     virtual void setContentsToImage(Image*) = 0;
-    virtual bool save(const String& filename) { return false; }
+    virtual bool save(const String&) { return false; }
 
     inline void lock() { ++m_lockCount; }
     inline void unlock() { --m_lockCount; }
@@ -101,6 +102,7 @@ public:
     virtual void bindSurface(BitmapTexture* surface) = 0;
     virtual void paintToTarget(const BitmapTexture& texture, const IntSize&, const TransformationMatrix& matrix, float opacity, const IntRect& visibleRect)
     {
+        UNUSED_PARAM(visibleRect);
         drawTexture(texture, IntRect(0, 0, texture.contentSize().width(), texture.contentSize().height()), matrix, opacity, 0);
     }
 
diff --git a/Source/WebCore/platform/graphics/texmap/TextureMapperNode.h b/Source/WebCore/platform/graphics/texmap/TextureMapperNode.h
index 9694043..c5decc1 100644
--- a/Source/WebCore/platform/graphics/texmap/TextureMapperNode.h
+++ b/Source/WebCore/platform/graphics/texmap/TextureMapperNode.h
@@ -20,19 +20,19 @@
 #ifndef TextureMapperNode_h
 #define TextureMapperNode_h
 
-#include "CurrentTime.h"
 #include "FloatRect.h"
 #include "GraphicsContext.h"
 #include "GraphicsLayer.h"
-#include "HashMap.h"
 #include "Image.h"
-#include "RefCounted.h"
 #include "TextureMapper.h"
 #include "TextureMapperPlatformLayer.h"
 #include "Timer.h"
 #include "TransformOperations.h"
 #include "TranslateTransformOperation.h"
 #include "UnitBezier.h"
+#include <wtf/CurrentTime.h>
+#include <wtf/HashMap.h>
+#include <wtf/RefCounted.h>
 
 namespace WebCore {
 
@@ -94,7 +94,7 @@ public:
 
         ContentType contentType;
         RefPtr<Image> image;
-        TextureMapperVideoLayer* media;
+        TextureMapperMediaLayer* media;
 
         ContentData()
             : needsDisplay(false)
diff --git a/Source/WebCore/platform/graphics/texmap/TextureMapperPlatformLayer.h b/Source/WebCore/platform/graphics/texmap/TextureMapperPlatformLayer.h
index 2a38b90..d2d646a 100644
--- a/Source/WebCore/platform/graphics/texmap/TextureMapperPlatformLayer.h
+++ b/Source/WebCore/platform/graphics/texmap/TextureMapperPlatformLayer.h
@@ -43,7 +43,7 @@ class TextureMapperPlatformLayer {
 public:
     enum Type {
         ContentLayer,
-        VideoLayer
+        MediaLayer
     };
 
     virtual Type layerType() const = 0;
@@ -66,13 +66,11 @@ public:
     virtual Type layerType() const { return ContentLayer; }
 };
 
-#if ENABLE(VIDEO)
-class TextureMapperVideoLayer : public TextureMapperPlatformLayer {
+class TextureMapperMediaLayer : public TextureMapperPlatformLayer {
 public:
     virtual void paint(GraphicsContext*) = 0;
-    virtual Type layerType() const { return VideoLayer; }
+    virtual Type layerType() const { return MediaLayer; }
 };
-#endif
 
 }
 
diff --git a/Source/WebCore/platform/graphics/transforms/TranslateTransformOperation.cpp b/Source/WebCore/platform/graphics/transforms/TranslateTransformOperation.cpp
index a8ad131..b1ea99b 100644
--- a/Source/WebCore/platform/graphics/transforms/TranslateTransformOperation.cpp
+++ b/Source/WebCore/platform/graphics/transforms/TranslateTransformOperation.cpp
@@ -21,6 +21,7 @@
 
 #include "config.h"
 #include "TranslateTransformOperation.h"
+#include "FloatConversion.h"
 
 namespace WebCore {
 
@@ -30,15 +31,15 @@ PassRefPtr<TransformOperation> TranslateTransformOperation::blend(const Transfor
         return this;
     
     if (blendToIdentity)
-        return TranslateTransformOperation::create(Length(m_x.type()).blend(m_x, progress), 
-                                                   Length(m_y.type()).blend(m_y, progress), 
-                                                   Length(m_z.type()).blend(m_z, progress), m_type);
+        return TranslateTransformOperation::create(Length(m_x.type()).blend(m_x, narrowPrecisionToFloat(progress)), 
+                                                   Length(m_y.type()).blend(m_y, narrowPrecisionToFloat(progress)), 
+                                                   Length(m_z.type()).blend(m_z, narrowPrecisionToFloat(progress)), m_type);
 
     const TranslateTransformOperation* fromOp = static_cast<const TranslateTransformOperation*>(from);
     Length fromX = fromOp ? fromOp->m_x : Length(m_x.type());
     Length fromY = fromOp ? fromOp->m_y : Length(m_y.type());
     Length fromZ = fromOp ? fromOp->m_z : Length(m_z.type());
-    return TranslateTransformOperation::create(m_x.blend(fromX, progress), m_y.blend(fromY, progress), m_z.blend(fromZ, progress), m_type);
+    return TranslateTransformOperation::create(m_x.blend(fromX, narrowPrecisionToFloat(progress)), m_y.blend(fromY, narrowPrecisionToFloat(progress)), m_z.blend(fromZ, narrowPrecisionToFloat(progress)), m_type);
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/graphics/win/FontCacheWin.cpp b/Source/WebCore/platform/graphics/win/FontCacheWin.cpp
index e800245..5382ef7 100644
--- a/Source/WebCore/platform/graphics/win/FontCacheWin.cpp
+++ b/Source/WebCore/platform/graphics/win/FontCacheWin.cpp
@@ -584,7 +584,7 @@ FontPlatformData* FontCache::createFontPlatformData(const FontDescription& fontD
 #if PLATFORM(CG)
     bool fontCreationFailed = !result->cgFont();
 #elif PLATFORM(CAIRO)
-    bool fontCreationFailed = !result->fontFace();
+    bool fontCreationFailed = !result->scaledFont();
 #endif
 
     if (fontCreationFailed) {
diff --git a/Source/WebCore/platform/graphics/win/FontCustomPlatformData.cpp b/Source/WebCore/platform/graphics/win/FontCustomPlatformData.cpp
index 4aee6cd..8348acb 100644
--- a/Source/WebCore/platform/graphics/win/FontCustomPlatformData.cpp
+++ b/Source/WebCore/platform/graphics/win/FontCustomPlatformData.cpp
@@ -59,7 +59,7 @@ FontCustomPlatformData::~FontCustomPlatformData()
     }
 }
 
-FontPlatformData FontCustomPlatformData::fontPlatformData(int size, bool bold, bool italic, FontOrientation, FontWidthVariant, FontRenderingMode renderingMode)
+FontPlatformData FontCustomPlatformData::fontPlatformData(int size, bool bold, bool italic, FontOrientation, TextOrientation, FontWidthVariant, FontRenderingMode renderingMode)
 {
     ASSERT(m_fontReference);
     ASSERT(T2embedLibrary());
diff --git a/Source/WebCore/platform/graphics/win/FontCustomPlatformData.h b/Source/WebCore/platform/graphics/win/FontCustomPlatformData.h
index abdb356..65388d8 100644
--- a/Source/WebCore/platform/graphics/win/FontCustomPlatformData.h
+++ b/Source/WebCore/platform/graphics/win/FontCustomPlatformData.h
@@ -25,6 +25,7 @@
 #include "FontRenderingMode.h"
 #include "FontWidthVariant.h"
 #include "PlatformString.h"
+#include "TextOrientation.h"
 #include <wtf/Forward.h>
 #include <wtf/Noncopyable.h>
 
@@ -46,7 +47,8 @@ public:
 
     ~FontCustomPlatformData();
 
-    FontPlatformData fontPlatformData(int size, bool bold, bool italic, FontOrientation = Horizontal, FontWidthVariant = RegularWidth, FontRenderingMode = NormalRenderingMode);
+    FontPlatformData fontPlatformData(int size, bool bold, bool italic, FontOrientation = Horizontal, TextOrientation = TextOrientationVerticalRight,
+                                      FontWidthVariant = RegularWidth, FontRenderingMode = NormalRenderingMode);
 
     static bool supportsFormat(const String&);
 
diff --git a/Source/WebCore/platform/graphics/win/FontCustomPlatformDataCairo.cpp b/Source/WebCore/platform/graphics/win/FontCustomPlatformDataCairo.cpp
index fd30a6d..6f9bbf0 100644
--- a/Source/WebCore/platform/graphics/win/FontCustomPlatformDataCairo.cpp
+++ b/Source/WebCore/platform/graphics/win/FontCustomPlatformDataCairo.cpp
@@ -23,8 +23,11 @@
 
 #include "SharedBuffer.h"
 #include "FontPlatformData.h"
+
+#include <cairo-win32.h>
 #include <wtf/RetainPtr.h>
 
+
 namespace WebCore {
 
 FontCustomPlatformData::~FontCustomPlatformData()
@@ -32,7 +35,7 @@ FontCustomPlatformData::~FontCustomPlatformData()
    cairo_font_face_destroy(m_fontFace);
 }
 
-FontPlatformData FontCustomPlatformData::fontPlatformData(int size, bool bold, bool italic, FontOrientation, FontWidthVariant)
+FontPlatformData FontCustomPlatformData::fontPlatformData(int size, bool bold, bool italic, FontOrientation, TextOrientation, FontWidthVariant)
 {
     return FontPlatformData(m_fontFace, size, bold, italic);
 }
diff --git a/Source/WebCore/platform/graphics/win/FontCustomPlatformDataCairo.h b/Source/WebCore/platform/graphics/win/FontCustomPlatformDataCairo.h
index ea3ae38..bd90f18 100644
--- a/Source/WebCore/platform/graphics/win/FontCustomPlatformDataCairo.h
+++ b/Source/WebCore/platform/graphics/win/FontCustomPlatformDataCairo.h
@@ -42,7 +42,7 @@ public:
     }
     ~FontCustomPlatformData();
 
-    FontPlatformData fontPlatformData(int size, bool bold, bool italic, FontOrientation = Horizontal, FontWidthVariant = RegularWidth);
+    FontPlatformData fontPlatformData(int size, bool bold, bool italic, FontOrientation = Horizontal, TextOrientation = TextOrientationVerticalRight, FontWidthVariant = RegularWidth);
 
     static bool supportsFormat(const String&);
 
diff --git a/Source/WebCore/platform/graphics/win/FontPlatformDataCGWin.cpp b/Source/WebCore/platform/graphics/win/FontPlatformDataCGWin.cpp
index 9234229..287121b 100644
--- a/Source/WebCore/platform/graphics/win/FontPlatformDataCGWin.cpp
+++ b/Source/WebCore/platform/graphics/win/FontPlatformDataCGWin.cpp
@@ -115,11 +115,15 @@ void FontPlatformData::platformDataInit(HFONT font, float size, HDC hdc, WCHAR*
 }
 
 FontPlatformData::FontPlatformData(HFONT hfont, CGFontRef font, float size, bool bold, bool oblique, bool useGDI)
-    : m_font(RefCountedGDIHandle<HFONT>::create(hfont))
+    : m_syntheticBold(bold)
+    , m_syntheticOblique(oblique)
+    , m_orientation(Horizontal)
+    , m_textOrientation(TextOrientationVerticalRight)
     , m_size(size)
+    , m_widthVariant(RegularWidth)
+    , m_font(RefCountedGDIHandle<HFONT>::create(hfont))
     , m_cgFont(font)
-    , m_syntheticBold(bold)
-    , m_syntheticOblique(oblique)
+    , m_isColorBitmapFont(false)
     , m_useGDI(useGDI)
 {
 }
@@ -128,4 +132,27 @@ FontPlatformData::~FontPlatformData()
 {
 }
 
+void FontPlatformData::platformDataInit(const FontPlatformData& source)
+{
+    m_font = source.m_font;
+    m_cgFont = source.m_cgFont;
+    m_useGDI = source.m_useGDI;
+}
+
+const FontPlatformData& FontPlatformData::platformDataAssign(const FontPlatformData& other)
+{
+    m_font = other.m_font;
+    m_cgFont = other.m_cgFont;
+    m_useGDI = other.m_useGDI;
+
+    return *this;
+}
+
+bool FontPlatformData::platformIsEqual(const FontPlatformData& other) const
+{
+    return m_font == other.m_font
+        && m_cgFont == other.m_cgFont
+        && m_useGDI == other.m_useGDI;
+}
+
 }
diff --git a/Source/WebCore/platform/graphics/win/FontPlatformDataCairoWin.cpp b/Source/WebCore/platform/graphics/win/FontPlatformDataCairoWin.cpp
index 0f5c365..e60b69b 100644
--- a/Source/WebCore/platform/graphics/win/FontPlatformDataCairoWin.cpp
+++ b/Source/WebCore/platform/graphics/win/FontPlatformDataCairoWin.cpp
@@ -4,7 +4,7 @@
  *
  * Copyright (C) 2006, 2007, 2008 Apple Inc.
  * Copyright (C) 2007 Alp Toker
- * Copyright (C) 2008, 2010 Brent Fulgham
+ * Copyright (C) 2008, 2010, 2011 Brent Fulgham
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -40,7 +40,7 @@ namespace WebCore {
 
 void FontPlatformData::platformDataInit(HFONT font, float size, HDC hdc, WCHAR* faceName)
 {
-    m_fontFace = cairo_win32_font_face_create_for_hfont(font);
+    cairo_font_face_t* fontFace = cairo_win32_font_face_create_for_hfont(font);
 
     cairo_matrix_t sizeMatrix, ctm;
     cairo_matrix_init_identity(&ctm);
@@ -52,14 +52,18 @@ void FontPlatformData::platformDataInit(HFONT font, float size, HDC hdc, WCHAR*
        cairo_font_options_set_antialias(fontOptions, CAIRO_ANTIALIAS_SUBPIXEL);
     }
 
-    m_scaledFont = cairo_scaled_font_create(m_fontFace, &sizeMatrix, &ctm, fontOptions);
+    m_scaledFont = cairo_scaled_font_create(fontFace, &sizeMatrix, &ctm, fontOptions);
+    cairo_font_face_destroy(fontFace);
 }
 
 FontPlatformData::FontPlatformData(cairo_font_face_t* fontFace, float size, bool bold, bool oblique)
     : m_font(0)
     , m_size(size)
-    , m_fontFace(fontFace)
+    , m_orientation(Horizontal)
+    , m_textOrientation(TextOrientationVerticalRight)
+    , m_widthVariant(RegularWidth)
     , m_scaledFont(0)
+    , m_isColorBitmapFont(false)
     , m_syntheticBold(bold)
     , m_syntheticOblique(oblique)
     , m_useGDI(false)
@@ -79,64 +83,39 @@ FontPlatformData::FontPlatformData(cairo_font_face_t* fontFace, float size, bool
    cairo_font_options_destroy(options);
 }
 
-FontPlatformData::FontPlatformData(const FontPlatformData& source)
-    : m_font(source.m_font)
-    , m_size(source.m_size)
-    , m_fontFace(0)
-    , m_scaledFont(0)
-    , m_syntheticBold(source.m_syntheticBold)
-    , m_syntheticOblique(source.m_syntheticOblique)
-    , m_useGDI(source.m_useGDI)
+FontPlatformData::~FontPlatformData()
 {
-    if (source.m_fontFace)
-        m_fontFace = cairo_font_face_reference(source.m_fontFace);
-
-    if (source.m_scaledFont)
-        m_scaledFont = cairo_scaled_font_reference(source.m_scaledFont);
+    if (m_scaledFont && m_scaledFont != hashTableDeletedFontValue())
+        cairo_scaled_font_destroy(m_scaledFont);
 }
 
-
-FontPlatformData::~FontPlatformData()
+void FontPlatformData::platformDataInit(const FontPlatformData& source)
 {
-    cairo_scaled_font_destroy(m_scaledFont);
-    cairo_font_face_destroy(m_fontFace);
+    m_font = source.m_font;
+    m_useGDI = source.m_useGDI;
+    m_scaledFont = 0;
+
+    if (source.m_scaledFont)
+        m_scaledFont = cairo_scaled_font_reference(source.m_scaledFont);
 }
 
-FontPlatformData& FontPlatformData::operator=(const FontPlatformData& other)
+const FontPlatformData& FontPlatformData::platformDataAssign(const FontPlatformData& other)
 {
-    // Check for self-assignment.
-    if (this == &other)
-        return *this;
-
     m_font = other.m_font;
-    m_size = other.m_size;
-    m_syntheticBold = other.m_syntheticBold;
-    m_syntheticOblique = other.m_syntheticOblique;
     m_useGDI = other.m_useGDI;
 
-    if (other.m_fontFace)
-        cairo_font_face_reference(other.m_fontFace);
-    if (m_fontFace)
-        cairo_font_face_destroy(m_fontFace);
-    m_fontFace = other.m_fontFace;
-
-    if (other.m_scaledFont)
-        cairo_scaled_font_reference(other.m_scaledFont);
-    if (m_scaledFont)
+    if (m_scaledFont && m_scaledFont != hashTableDeletedFontValue())
         cairo_scaled_font_destroy(m_scaledFont);
-    m_scaledFont = other.m_scaledFont;
+
+    m_scaledFont = cairo_scaled_font_reference(other.m_scaledFont);
 
     return *this;
 }
 
-bool FontPlatformData::operator==(const FontPlatformData& other) const
-{ 
+bool FontPlatformData::platformIsEqual(const FontPlatformData& other) const
+{
     return m_font == other.m_font
-        && m_fontFace == other.m_fontFace
         && m_scaledFont == other.m_scaledFont
-        && m_size == other.m_size
-        && m_syntheticBold == other.m_syntheticBold
-        && m_syntheticOblique == other.m_syntheticOblique
         && m_useGDI == other.m_useGDI;
 }
 
diff --git a/Source/WebCore/platform/graphics/win/FontPlatformDataWin.cpp b/Source/WebCore/platform/graphics/win/FontPlatformDataWin.cpp
index 09ed4a6..301198d 100644
--- a/Source/WebCore/platform/graphics/win/FontPlatformDataWin.cpp
+++ b/Source/WebCore/platform/graphics/win/FontPlatformDataWin.cpp
@@ -38,12 +38,15 @@ namespace WebCore {
 FontPlatformData::FontPlatformData(HFONT font, float size, bool bold, bool oblique, bool useGDI)
     : m_font(RefCountedGDIHandle<HFONT>::create(font))
     , m_size(size)
+    , m_orientation(Horizontal)
+    , m_textOrientation(TextOrientationVerticalRight)
+    , m_widthVariant(RegularWidth)
 #if PLATFORM(CG)
     , m_cgFont(0)
 #elif PLATFORM(CAIRO)
-    , m_fontFace(0)
     , m_scaledFont(0)
 #endif
+    , m_isColorBitmapFont(false)
     , m_syntheticBold(bold)
     , m_syntheticOblique(oblique)
     , m_useGDI(useGDI)
@@ -71,20 +74,6 @@ FontPlatformData::FontPlatformData(HFONT font, float size, bool bold, bool obliq
     ReleaseDC(0, hdc);
 }
 
-FontPlatformData::FontPlatformData(float size, bool bold, bool oblique)
-    : m_size(size)
-#if PLATFORM(CG)
-    , m_cgFont(0)
-#elif PLATFORM(CAIRO)
-    , m_fontFace(0)
-    , m_scaledFont(0)
-#endif
-    , m_syntheticBold(bold)
-    , m_syntheticOblique(oblique)
-    , m_useGDI(false)
-{
-}
-
 #ifndef NDEBUG
 String FontPlatformData::description() const
 {
diff --git a/Source/WebCore/platform/graphics/win/FontWin.cpp b/Source/WebCore/platform/graphics/win/FontWin.cpp
index 47c44bc..9e31f56 100644
--- a/Source/WebCore/platform/graphics/win/FontWin.cpp
+++ b/Source/WebCore/platform/graphics/win/FontWin.cpp
@@ -127,8 +127,8 @@ float Font::floatWidthForComplexText(const TextRun& run, HashSet<const SimpleFon
     UniscribeController controller(this, run, fallbackFonts);
     controller.advance(run.length());
     if (glyphOverflow) {
-        glyphOverflow->top = max<int>(glyphOverflow->top, ceilf(-controller.minGlyphBoundingBoxY()) - fontMetrics().ascent());
-        glyphOverflow->bottom = max<int>(glyphOverflow->bottom, ceilf(controller.maxGlyphBoundingBoxY()) - fontMetrics().descent());
+        glyphOverflow->top = max<int>(glyphOverflow->top, ceilf(-controller.minGlyphBoundingBoxY()) - (glyphOverflow->computeBounds ? 0 : fontMetrics().ascent()));
+        glyphOverflow->bottom = max<int>(glyphOverflow->bottom, ceilf(controller.maxGlyphBoundingBoxY()) - (glyphOverflow->computeBounds ? 0  : fontMetrics().descent()));
         glyphOverflow->left = max<int>(0, ceilf(-controller.minGlyphBoundingBoxX()));
         glyphOverflow->right = max<int>(0, ceilf(controller.maxGlyphBoundingBoxX() - controller.runWidthSoFar()));
     }
diff --git a/Source/WebCore/platform/graphics/win/GraphicsContextCairoWin.cpp b/Source/WebCore/platform/graphics/win/GraphicsContextCairoWin.cpp
index b2c702f..7ce7ee9 100644
--- a/Source/WebCore/platform/graphics/win/GraphicsContextCairoWin.cpp
+++ b/Source/WebCore/platform/graphics/win/GraphicsContextCairoWin.cpp
@@ -72,18 +72,15 @@ GraphicsContext::GraphicsContext(HDC dc, bool hasAlpha)
 
 void GraphicsContext::platformInit(HDC dc, bool hasAlpha)
 {
-    m_data = new GraphicsContextPlatformPrivate;
-
-    if (dc) {
-        m_data->cr = createCairoContextWithHDC(dc, hasAlpha);
-        m_data->m_hdc = dc;
-    } else {
+    cairo_t* cr = 0;
+    if (dc)
+        cr = createCairoContextWithHDC(dc, hasAlpha);
+    else
         setPaintingDisabled(true);
-        m_data->cr = 0;
-        m_data->m_hdc = 0;
-    }
 
-    if (m_data->cr) {
+    m_data = new GraphicsContextPlatformPrivateTopLevel(new PlatformContextCairo(cr));
+    m_data->m_hdc = dc;
+    if (platformContext()->cr()) {
         // Make sure the context starts in sync with our state.
         setPlatformFillColor(fillColor(), fillColorSpace());
         setPlatformStrokeColor(strokeColor(), strokeColorSpace());
@@ -131,24 +128,25 @@ void GraphicsContext::releaseWindowsContext(HDC hdc, const IntRect& dstRect, boo
     // Scale the target surface to the new image size, and flip it
     // so that when we set the srcImage as the surface it will draw
     // right-side-up.
-    cairo_save(m_data->cr);
-    cairo_translate(m_data->cr, dstRect.x(), dstRect.height() + dstRect.y());
-    cairo_scale(m_data->cr, 1.0, -1.0);
-    cairo_set_source_surface(m_data->cr, image, 0, 0);
+    cairo_t* cr = platformContext()->cr();
+    cairo_save(cr);
+    cairo_translate(cr, dstRect.x(), dstRect.height() + dstRect.y());
+    cairo_scale(cr, 1, -1);
+    cairo_set_source_surface(cr, image, 0, 0);
 
     if (m_data->layers.size())
-        cairo_paint_with_alpha(m_data->cr, m_data->layers.last());
+        cairo_paint_with_alpha(cr, m_data->layers.last());
     else
-        cairo_paint(m_data->cr);
+        cairo_paint(cr);
      
     // Delete all our junk.
     cairo_surface_destroy(image);
     ::DeleteDC(hdc);
     ::DeleteObject(bitmap);
-    cairo_restore(m_data->cr);
+    cairo_restore(cr);
 }
 
-void GraphicsContextPlatformPrivate::syncContext(PlatformGraphicsContext* cr)
+void GraphicsContextPlatformPrivate::syncContext(cairo_t* cr)
 {
     if (!cr)
        return;
diff --git a/Source/WebCore/platform/graphics/win/MediaPlayerPrivateQuickTimeVisualContext.cpp b/Source/WebCore/platform/graphics/win/MediaPlayerPrivateQuickTimeVisualContext.cpp
index 40fe1d1..bac85f7 100644
--- a/Source/WebCore/platform/graphics/win/MediaPlayerPrivateQuickTimeVisualContext.cpp
+++ b/Source/WebCore/platform/graphics/win/MediaPlayerPrivateQuickTimeVisualContext.cpp
@@ -28,8 +28,11 @@
 #if ENABLE(VIDEO)
 #include "MediaPlayerPrivateQuickTimeVisualContext.h"
 
+#include "ApplicationCacheHost.h"
+#include "ApplicationCacheResource.h"
 #include "Cookie.h"
 #include "CookieJar.h"
+#include "DocumentLoader.h"
 #include "Frame.h"
 #include "FrameView.h"
 #include "GraphicsContext.h"
@@ -369,7 +372,16 @@ void MediaPlayerPrivateQuickTimeVisualContext::loadInternal(const String& url)
     setUpCookiesForQuickTime(url);
 
     m_movie = adoptRef(new QTMovie(m_movieClient.get()));
-    m_movie->load(url.characters(), url.length(), m_player->preservesPitch());
+
+#if ENABLE(OFFLINE_WEB_APPLICATIONS)
+    Frame* frame = m_player->frameView() ? m_player->frameView()->frame() : 0;
+    ApplicationCacheHost* cacheHost = frame ? frame->loader()->documentLoader()->applicationCacheHost() : 0;
+    ApplicationCacheResource* resource = 0;
+    if (cacheHost && cacheHost->shouldLoadResourceFromApplicationCache(ResourceRequest(url), resource) && resource && !resource->path().isEmpty())
+        m_movie->load(resource->path().characters(), resource->path().length(), m_player->preservesPitch());
+    else
+#endif
+        m_movie->load(url.characters(), url.length(), m_player->preservesPitch());
     m_movie->setVolume(m_player->volume());
 }
 
diff --git a/Source/WebCore/platform/graphics/win/QTMovie.cpp b/Source/WebCore/platform/graphics/win/QTMovie.cpp
index 05fbb86..6f9c668 100644
--- a/Source/WebCore/platform/graphics/win/QTMovie.cpp
+++ b/Source/WebCore/platform/graphics/win/QTMovie.cpp
@@ -442,6 +442,17 @@ void QTMovie::getNaturalSize(int& width, int& height)
     height = (rect.bottom - rect.top) * m_private->m_heightScaleFactor;
 }
 
+void QTMovie::loadPath(const UChar* url, int len, bool preservesPitch)
+{
+    CFStringRef urlStringRef = CFStringCreateWithCharacters(kCFAllocatorDefault, reinterpret_cast<const UniChar*>(url), len);
+    CFURLRef cfURL = CFURLCreateWithFileSystemPath(kCFAllocatorDefault, urlStringRef, kCFURLWindowsPathStyle, false);
+
+    load(cfURL, preservesPitch);
+
+    CFRelease(cfURL);
+    CFRelease(urlStringRef);
+}
+
 void QTMovie::load(const UChar* url, int len, bool preservesPitch)
 {
     CFStringRef urlStringRef = CFStringCreateWithCharacters(kCFAllocatorDefault, reinterpret_cast<const UniChar*>(url), len);
diff --git a/Source/WebCore/platform/graphics/win/QTMovie.h b/Source/WebCore/platform/graphics/win/QTMovie.h
index e97d16d..38b3473 100644
--- a/Source/WebCore/platform/graphics/win/QTMovie.h
+++ b/Source/WebCore/platform/graphics/win/QTMovie.h
@@ -70,6 +70,7 @@ public:
     void addClient(QTMovieClient*);
     void removeClient(QTMovieClient*);
 
+    void loadPath(const UChar* url, int len, bool preservesPitch);
     void load(const UChar* url, int len, bool preservesPitch);
     void load(CFURLRef, bool preservesPitch);
 
diff --git a/Source/WebCore/platform/graphics/win/SimpleFontDataCGWin.cpp b/Source/WebCore/platform/graphics/win/SimpleFontDataCGWin.cpp
index 30a931e..12f1127 100644
--- a/Source/WebCore/platform/graphics/win/SimpleFontDataCGWin.cpp
+++ b/Source/WebCore/platform/graphics/win/SimpleFontDataCGWin.cpp
@@ -97,18 +97,14 @@ void SimpleFontData::platformInit()
     m_fontMetrics.setLineGap(fLineGap);
     m_fontMetrics.setLineSpacing(lroundf(fAscent) + lroundf(fDescent) + lroundf(fLineGap));
 
-    // Measure the actual character "x", because AppKit synthesizes X height rather than getting it from the font.
-    // Unfortunately, NSFont will round this for us so we don't quite get the right value.
     GlyphPage* glyphPageZero = GlyphPageTreeNode::getRootChild(this, 0)->page();
     Glyph xGlyph = glyphPageZero ? glyphPageZero->glyphDataForCharacter('x').glyph : 0;
     if (xGlyph) {
+        // Measure the actual character "x", since it's possible for it to extend below the baseline, and we need the
+        // reported x-height to only include the portion of the glyph that is above the baseline.
         CGRect xBox;
         CGFontGetGlyphBBoxes(font, &xGlyph, 1, &xBox);
-        // Use the maximum of either width or height because "x" is nearly square
-        // and web pages that foolishly use this metric for width will be laid out
-        // poorly if we return an accurate height. Classic case is Times 13 point,
-        // which has an "x" that is 7x6 pixels.
-        m_fontMetrics.setXHeight(scaleEmToUnits(max(CGRectGetMaxX(xBox), CGRectGetMaxY(xBox)), unitsPerEm) * pointSize);
+        m_fontMetrics.setXHeight(scaleEmToUnits(CGRectGetMaxY(xBox), unitsPerEm) * pointSize);
     } else {
         int iXHeight = CGFontGetXHeight(font);
         m_fontMetrics.setXHeight(scaleEmToUnits(iXHeight, unitsPerEm) * pointSize);
diff --git a/Source/WebCore/platform/graphics/win/cairo/FontPlatformData.h b/Source/WebCore/platform/graphics/win/cairo/FontPlatformData.h
deleted file mode 100644
index d8f538a..0000000
--- a/Source/WebCore/platform/graphics/win/cairo/FontPlatformData.h
+++ /dev/null
@@ -1,114 +0,0 @@
-/*
- * Copyright (C) 2006, 2007, 2008 Apple Inc.
- * Copyright (C) 2006 Michael Emmel mike.emmel@gmail.com
- * Copyright (C) 2007 Holger Hans Peter Freyther
- * Copyright (C) 2007 Pioneer Research Center USA, Inc.
- * Copyright (C) 2010 Brent Fulgham <bfulgham@webkit.org>
- * All rights reserved.
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Library General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Library General Public License for more details.
- *
- * You should have received a copy of the GNU Library General Public License
- * along with this library; see the file COPYING.LIB.  If not, write to
- * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- * Boston, MA 02110-1301, USA.
- *
- */
-
-#ifndef FontPlatformDataCairoWin_h
-#define FontPlatformDataCairoWin_h
-
-#include "FontOrientation.h"
-#include "GlyphBuffer.h"
-#include "RefCountedGDIHandle.h"
-#include "StringImpl.h"
-#include <cairo-win32.h>
-#include <cairo.h>
-#include <wtf/Forward.h>
-
-typedef struct HFONT__* HFONT;
-
-namespace WebCore {
-
-class FontDescription;
-
-class FontPlatformData {
-public:
-    FontPlatformData(WTF::HashTableDeletedValueType)
-        : m_fontFace(0)
-        , m_useGDI(false)
-        , m_font(WTF::HashTableDeletedValue)
-        , m_size(0)
-        , m_syntheticBold(false)
-        , m_syntheticOblique(false)
-        , m_scaledFont(0)
-        { }
-
-    FontPlatformData()
-        : m_fontFace(0)
-        , m_useGDI(false)
-        , m_size(0)
-        , m_syntheticBold(false)
-        , m_syntheticOblique(false)
-        , m_scaledFont(0)
-        { }
-
-    FontPlatformData(HFONT, float size, bool bold, bool oblique, bool useGDI);
-    FontPlatformData(cairo_font_face_t* fontFace, float size, bool bold, bool italic);
-    FontPlatformData(float size, bool bold, bool italic);
-    FontPlatformData(const FontPlatformData&);
-    ~FontPlatformData();
-
-    HFONT hfont() const { return m_font->handle(); }
-    bool useGDI() const { return m_useGDI; }
-    cairo_font_face_t* fontFace() const { return m_fontFace; }
-
-    bool isFixedPitch();
-    float size() const { return m_size; }
-    void setSize(float size) { m_size = size; }
-    bool syntheticBold() const { return m_syntheticBold; }
-    bool syntheticOblique() const { return m_syntheticOblique; }
-
-    FontOrientation orientation() const { return Horizontal; } // FIXME: Implement.
-
-    cairo_scaled_font_t* scaledFont() const { return m_scaledFont; }
-
-    unsigned hash() const
-    {
-        return m_font->hash();
-    }
-
-    bool operator==(const FontPlatformData&) const;
-    FontPlatformData& operator=(const FontPlatformData&);
-    bool isHashTableDeletedValue() const
-    {
-        return m_font.isHashTableDeletedValue();
-    }
-
-#ifndef NDEBUG
-    String description() const;
-#endif
-
-private:
-    void platformDataInit(HFONT, float size, HDC, WCHAR* faceName);
-
-    RefPtr<RefCountedGDIHandle<HFONT> > m_font;
-    cairo_font_face_t* m_fontFace;
-    bool m_useGDI;
-    float m_size;
-    bool m_syntheticBold;
-    bool m_syntheticOblique;
-    cairo_scaled_font_t* m_scaledFont;
-};
-
-}
-
-#endif // FontPlatformDataCairoWin_h
diff --git a/Source/WebCore/platform/graphics/wince/FontCustomPlatformData.cpp b/Source/WebCore/platform/graphics/wince/FontCustomPlatformData.cpp
index fb97fe1..07a8756 100644
--- a/Source/WebCore/platform/graphics/wince/FontCustomPlatformData.cpp
+++ b/Source/WebCore/platform/graphics/wince/FontCustomPlatformData.cpp
@@ -45,7 +45,7 @@ FontCustomPlatformData::~FontCustomPlatformData()
         g_customFontCache->unregisterFont(m_name);
 }
 
-FontPlatformData FontCustomPlatformData::fontPlatformData(int size, bool bold, bool italic, FontOrientation, FontWidthVariant, FontRenderingMode renderingMode)
+FontPlatformData FontCustomPlatformData::fontPlatformData(int size, bool bold, bool italic, FontOrientation, TextOrientation, FontWidthVariant, FontRenderingMode renderingMode)
 {
     FontDescription fontDesc;
     fontDesc.setComputedSize(size);
diff --git a/Source/WebCore/platform/graphics/wince/FontCustomPlatformData.h b/Source/WebCore/platform/graphics/wince/FontCustomPlatformData.h
index fe7ee94..12a86e9 100644
--- a/Source/WebCore/platform/graphics/wince/FontCustomPlatformData.h
+++ b/Source/WebCore/platform/graphics/wince/FontCustomPlatformData.h
@@ -24,6 +24,7 @@
 #include "FontDescription.h"
 #include "FontRenderingMode.h"
 #include "FontWidthVariant.h"
+#include "TextOrientation.h"
 #include "PlatformString.h"
 #include <wtf/Noncopyable.h>
 
@@ -48,7 +49,7 @@ namespace WebCore {
 
         ~FontCustomPlatformData();
 
-        FontPlatformData fontPlatformData(int size, bool bold, bool italic, FontOrientation = Horizontal, FontWidthVariant = RegularWidth, FontRenderingMode = NormalRenderingMode);
+        FontPlatformData fontPlatformData(int size, bool bold, bool italic, FontOrientation = Horizontal, TextOrientation = TextOrientationVerticalRight, FontWidthVariant = RegularWidth, FontRenderingMode = NormalRenderingMode);
 
         static bool supportsFormat(const String&);
 
diff --git a/Source/WebCore/platform/graphics/wince/FontPlatformData.cpp b/Source/WebCore/platform/graphics/wince/FontPlatformData.cpp
index d9d8a72..d767ac7 100644
--- a/Source/WebCore/platform/graphics/wince/FontPlatformData.cpp
+++ b/Source/WebCore/platform/graphics/wince/FontPlatformData.cpp
@@ -148,7 +148,7 @@ struct FixedSizeFontDataKeyHash {
             font.m_weight,
             // static_cast<unsigned>(font.m_italic);
         };
-        return WTF::StringHasher::createBlobHash<sizeof(hashCodes)>(hashCodes);
+        return StringHasher::hashMemory<sizeof(hashCodes)>(hashCodes);
     }
 
     static bool equal(const FixedSizeFontDataKey& a, const FixedSizeFontDataKey& b)
diff --git a/Source/WebCore/platform/graphics/wince/FontPlatformData.h b/Source/WebCore/platform/graphics/wince/FontPlatformData.h
index e73a7b2..9c3f733 100644
--- a/Source/WebCore/platform/graphics/wince/FontPlatformData.h
+++ b/Source/WebCore/platform/graphics/wince/FontPlatformData.h
@@ -79,6 +79,7 @@ namespace WebCore {
         static LONG adjustedGDIFontWeight(LONG gdiFontWeight, const String& family);
 
         FontOrientation orientation() const { return Horizontal; } // FIXME: Implement.
+        void setOrientation(FontOrientation) { } // FIXME: Implement.
 
 #ifndef NDEBUG
         String description() const;
diff --git a/Source/WebCore/platform/graphics/wince/PathWinCE.cpp b/Source/WebCore/platform/graphics/wince/PathWinCE.cpp
index fa4c8fb..9c9112b 100644
--- a/Source/WebCore/platform/graphics/wince/PathWinCE.cpp
+++ b/Source/WebCore/platform/graphics/wince/PathWinCE.cpp
@@ -133,7 +133,7 @@ void Path::transform(const AffineTransform& t)
     m_path->transform(t);
 }
 
-FloatRect Path::strokeBoundingRect(StrokeStyleApplier *)
+FloatRect Path::strokeBoundingRect(StrokeStyleApplier*) const
 {
     notImplemented();
     return FloatRect();
diff --git a/Source/WebCore/platform/graphics/wx/FontPlatformData.h b/Source/WebCore/platform/graphics/wx/FontPlatformData.h
index 3ef0179..8a2c4a0 100644
--- a/Source/WebCore/platform/graphics/wx/FontPlatformData.h
+++ b/Source/WebCore/platform/graphics/wx/FontPlatformData.h
@@ -150,6 +150,7 @@ public:
     bool allowsLigatures() const { return false; }
     
     FontOrientation orientation() const { return Horizontal; } // FIXME: Implement.
+    void setOrientation(FontOrientation) { } // FIXME: Implement.
 
     // We don't support this yet, so just return the default value for now.
     FontWidthVariant widthVariant() const { return RegularWidth; }
diff --git a/Source/WebCore/platform/graphics/wx/FontPlatformDataWx.cpp b/Source/WebCore/platform/graphics/wx/FontPlatformDataWx.cpp
index c125b7c..830cd05 100644
--- a/Source/WebCore/platform/graphics/wx/FontPlatformDataWx.cpp
+++ b/Source/WebCore/platform/graphics/wx/FontPlatformDataWx.cpp
@@ -126,10 +126,10 @@ unsigned FontPlatformData::computeHash() const
         thisFont->GetStyle(),
         thisFont->GetWeight(),
         thisFont->GetUnderlined(), 
-        WTF::StringHasher::createHash(thisFont->GetFaceName().utf8_str().data())
+        StringHasher::computeHash(thisFont->GetFaceName().utf8_str().data())
     };
 
-    return WTF::StringHasher::createBlobHash<sizeof(hashCodes)>(hashCodes);
+    return StringHasher::hashMemory<sizeof(hashCodes)>(hashCodes);
 }
 
 FontPlatformData::~FontPlatformData()
diff --git a/Source/WebCore/platform/graphics/wx/PathWx.cpp b/Source/WebCore/platform/graphics/wx/PathWx.cpp
index f5355f2..a95cc1c 100644
--- a/Source/WebCore/platform/graphics/wx/PathWx.cpp
+++ b/Source/WebCore/platform/graphics/wx/PathWx.cpp
@@ -105,7 +105,7 @@ FloatRect Path::boundingRect() const
     return FloatRect();
 }
 
-FloatRect Path::strokeBoundingRect(StrokeStyleApplier* applier)
+FloatRect Path::strokeBoundingRect(StrokeStyleApplier* applier) const
 {
     notImplemented();
     return FloatRect();
diff --git a/Source/WebCore/platform/gtk/FileSystemGtk.cpp b/Source/WebCore/platform/gtk/FileSystemGtk.cpp
index b3c4c9f..e2b1642 100644
--- a/Source/WebCore/platform/gtk/FileSystemGtk.cpp
+++ b/Source/WebCore/platform/gtk/FileSystemGtk.cpp
@@ -227,16 +227,16 @@ Vector<String> listDirectory(const String& path, const String& filter)
     return entries;
 }
 
-CString openTemporaryFile(const char* prefix, PlatformFileHandle& handle)
+String openTemporaryFile(const String& prefix, PlatformFileHandle& handle)
 {
-    GOwnPtr<gchar> filename(g_strdup_printf("%s%s", prefix, createCanonicalUUIDString().utf8().data()));
+    GOwnPtr<gchar> filename(g_strdup_printf("%s%s", prefix.utf8().data(), createCanonicalUUIDString().utf8().data()));
     GOwnPtr<gchar> tempPath(g_build_filename(g_get_tmp_dir(), filename.get(), NULL));
     GRefPtr<GFile> file = adoptGRef(g_file_new_for_path(tempPath.get()));
 
     handle = g_file_create_readwrite(file.get(), G_FILE_CREATE_NONE, 0, 0);
     if (!isHandleValid(handle))
-        return CString();
-    return tempPath.get();
+        return String();
+    return String::fromUTF8(tempPath.get());
 }
 
 PlatformFileHandle openFile(const String& path, FileOpenMode mode)
diff --git a/Source/WebCore/platform/gtk/LocalizedStringsGtk.cpp b/Source/WebCore/platform/gtk/LocalizedStringsGtk.cpp
index eab0ac6..02f6c47 100644
--- a/Source/WebCore/platform/gtk/LocalizedStringsGtk.cpp
+++ b/Source/WebCore/platform/gtk/LocalizedStringsGtk.cpp
@@ -259,7 +259,7 @@ String contextMenuItemTagSearchWeb()
     return String::fromUTF8(_("_Search the Web"));
 }
 
-String contextMenuItemTagLookUpInDictionary()
+String contextMenuItemTagLookUpInDictionary(const String&)
 {
     return String::fromUTF8(_("_Look Up in Dictionary"));
 }
diff --git a/Source/WebCore/platform/gtk/RenderThemeGtk.cpp b/Source/WebCore/platform/gtk/RenderThemeGtk.cpp
index 1e9f159..9b11c27 100644
--- a/Source/WebCore/platform/gtk/RenderThemeGtk.cpp
+++ b/Source/WebCore/platform/gtk/RenderThemeGtk.cpp
@@ -34,6 +34,7 @@
 #include "HTMLNames.h"
 #include "MediaControlElements.h"
 #include "PaintInfo.h"
+#include "PlatformContextCairo.h"
 #include "RenderBox.h"
 #include "RenderObject.h"
 #include "TimeRanges.h"
@@ -234,7 +235,7 @@ static void paintGdkPixbuf(GraphicsContext* context, const GdkPixbuf* icon, cons
         icon = scaledIcon.get();
     }
 
-    cairo_t* cr = context->platformContext();
+    cairo_t* cr = context->platformContext()->cr();
     cairo_save(cr);
     gdk_cairo_set_source_pixbuf(cr, icon, iconRect.x(), iconRect.y());
     cairo_paint(cr);
diff --git a/Source/WebCore/platform/gtk/RenderThemeGtk.h b/Source/WebCore/platform/gtk/RenderThemeGtk.h
index f5e03a9..191a34b 100644
--- a/Source/WebCore/platform/gtk/RenderThemeGtk.h
+++ b/Source/WebCore/platform/gtk/RenderThemeGtk.h
@@ -214,6 +214,7 @@ private:
     GtkWidget* gtkComboBoxButton() const;
     GtkWidget* gtkComboBoxArrow() const;
     GtkWidget* gtkComboBoxSeparator() const;
+    GtkWidget* gtkSpinButton() const;
 
     GdkColormap* m_colormap;
     mutable GtkWidget* m_gtkWindow;
@@ -232,6 +233,7 @@ private:
     mutable GtkWidget* m_gtkComboBoxSeparator;
     mutable GtkWidget* m_gtkVScrollbar;
     mutable GtkWidget* m_gtkHScrollbar;
+    mutable GtkWidget* m_gtkSpinButton;
     bool m_themePartsHaveRGBAColormap;
     friend class WidgetRenderingContext;
 #endif
diff --git a/Source/WebCore/platform/gtk/RenderThemeGtk2.cpp b/Source/WebCore/platform/gtk/RenderThemeGtk2.cpp
index 534aa97..5149bea 100644
--- a/Source/WebCore/platform/gtk/RenderThemeGtk2.cpp
+++ b/Source/WebCore/platform/gtk/RenderThemeGtk2.cpp
@@ -46,6 +46,9 @@
 
 namespace WebCore {
 
+// This is the default value defined by GTK+, where it was defined as MIN_ARROW_WIDTH in gtkspinbutton.c.
+static const int minSpinButtonArrowSize = 6;
+
 // This is not a static method, because we want to avoid having GTK+ headers in RenderThemeGtk.h.
 extern GtkTextDirection gtkTextDirection(TextDirection);
 
@@ -68,6 +71,7 @@ void RenderThemeGtk::platformInit()
     m_gtkComboBoxSeparator = 0;
     m_gtkVScrollbar = 0;
     m_gtkHScrollbar = 0;
+    m_gtkSpinButton = 0;
 
     m_colormap = gdk_screen_get_rgba_colormap(gdk_screen_get_default());
     if (!m_colormap) {
@@ -117,6 +121,10 @@ void RenderThemeGtk::adjustRepaintRect(const RenderObject* renderObject, IntRect
         adjustRectForFocus(part == CheckboxPart ? gtkCheckButton() : gtkRadioButton(), rect, true);
         return;
     }
+    case InnerSpinButtonPart:
+        // See paintInnerSpinButton for an explanation of why we expand the painting rect.
+        rect.inflateY(2);
+        rect.setWidth(rect.width() + 2);
     default:
         return;
     }
@@ -566,13 +574,84 @@ bool RenderThemeGtk::paintProgressBar(RenderObject* renderObject, const PaintInf
 }
 #endif
 
-void RenderThemeGtk::adjustInnerSpinButtonStyle(CSSStyleSelector*, RenderStyle*, Element*) const
+void RenderThemeGtk::adjustInnerSpinButtonStyle(CSSStyleSelector*, RenderStyle* style, Element*) const
 {
+    GtkStyle* gtkStyle = gtk_widget_get_style(gtkSpinButton());
+    const PangoFontDescription* fontDescription = gtkStyle->font_desc;
+    gint fontSize = pango_font_description_get_size(fontDescription);
+
+    // Force an odd arrow size here. GTK+ 3.x forces even in this case, but
+    // Nodoka-based themes look incorrect with an even arrow size.
+    int width = max(PANGO_PIXELS(fontSize), minSpinButtonArrowSize);
+    width += -((width % 2) - 1) + gtkStyle->xthickness;
+
+    style->setWidth(Length(width, Fixed));
+    style->setMinWidth(Length(width, Fixed));
 }
 
-bool RenderThemeGtk::paintInnerSpinButton(RenderObject*, const PaintInfo&, const IntRect&)
+bool RenderThemeGtk::paintInnerSpinButton(RenderObject* renderObject, const PaintInfo& paintInfo, const IntRect& rect)
 {
-    return true;
+    // We expand the painted area by 2 pixels on the top and bottom and 2 pixels on the right. This
+    // is because GTK+ themes want to draw over the text box borders, but WebCore renders the inner
+    // spin button inside the text box.
+    IntRect expandedRect(rect);
+    expandedRect.inflateY(2);
+    expandedRect.setWidth(rect.width() + 2);
+
+    WidgetRenderingContext widgetContext(paintInfo.context, expandedRect);
+    GtkWidget* widget = gtkSpinButton();
+    gtk_widget_set_direction(widget, gtkTextDirection(renderObject->style()->direction()));
+
+    IntRect fullSpinButtonRect(IntPoint(), expandedRect.size());
+    widgetContext.gtkPaintBox(fullSpinButtonRect, widget, GTK_STATE_NORMAL, GTK_SHADOW_IN, "spinbutton");
+
+    bool upPressed = isSpinUpButtonPartPressed(renderObject);
+    bool upHovered = isSpinUpButtonPartHovered(renderObject);
+    bool controlActive = isEnabled(renderObject) && !isReadOnlyControl(renderObject);
+    GtkShadowType shadowType = upPressed ? GTK_SHADOW_IN : GTK_SHADOW_OUT;
+
+    GtkStateType stateType = GTK_STATE_INSENSITIVE;
+    if (controlActive) {
+        if (isPressed(renderObject) && upPressed)
+            stateType = GTK_STATE_ACTIVE;
+        else if (isHovered(renderObject) && upHovered)
+            stateType = GTK_STATE_PRELIGHT;
+        else
+            stateType = GTK_STATE_NORMAL;
+    }
+    IntRect topRect(IntPoint(), expandedRect.size());
+    topRect.setHeight(expandedRect.height() / 2);
+    widgetContext.gtkPaintBox(topRect, widget, stateType, shadowType, "spinbutton_up");
+
+    // The arrow size/position calculation here is based on the arbitrary gymnastics that happen
+    // in gtkspinbutton.c. It isn't pretty there and it isn't pretty here. This manages to make
+    // the button look native for many themes though.
+    IntRect arrowRect;
+    int arrowSize = (expandedRect.width() - 3) / 2;
+    arrowSize -= (arrowSize % 2) - 1; // Force odd.
+    arrowRect.setWidth(arrowSize);
+    arrowRect.setHeight(arrowSize);
+    arrowRect.move((expandedRect.width() - arrowRect.width()) / 2,
+                   (topRect.height() - arrowRect.height()) / 2 + 1);
+    widgetContext.gtkPaintArrow(arrowRect, widget, stateType, shadowType, GTK_ARROW_UP, "spinbutton");
+
+    shadowType = isPressed(renderObject) && !upPressed ? GTK_SHADOW_IN : GTK_SHADOW_OUT;
+    if (controlActive) {
+        if (isPressed(renderObject) && !upPressed)
+            stateType = GTK_STATE_ACTIVE;
+        else if (isHovered(renderObject) && !upHovered)
+            stateType = GTK_STATE_PRELIGHT;
+        else
+            stateType = GTK_STATE_NORMAL;
+    }
+    IntRect bottomRect(IntPoint(0, expandedRect.height() / 2), expandedRect.size());
+    bottomRect.setHeight(expandedRect.height() - bottomRect.y());
+    widgetContext.gtkPaintBox(bottomRect, widget, stateType, shadowType, "spinbutton_down");
+
+    arrowRect.setY(arrowRect.y() + bottomRect.y() - 1);
+    widgetContext.gtkPaintArrow(arrowRect, widget, stateType, shadowType, GTK_ARROW_DOWN, "spinbutton");
+
+    return false;
 }
 
 GRefPtr<GdkPixbuf> RenderThemeGtk::getStockIcon(GType widgetType, const char* iconName, gint direction, gint state, gint iconSize)
@@ -867,6 +946,15 @@ GtkWidget* RenderThemeGtk::gtkVScrollbar() const
     return m_gtkVScrollbar;
 }
 
+GtkWidget* RenderThemeGtk::gtkSpinButton() const
+{
+    if (m_gtkSpinButton)
+        return m_gtkSpinButton;
+    m_gtkSpinButton = gtk_spin_button_new_with_range(0, 10, 1);
+    setupWidgetAndAddToContainer(m_gtkSpinButton, gtkContainer());
+    return m_gtkSpinButton;
+}
+
 } // namespace WebCore
 
 #endif // GTK_API_VERSION_2
diff --git a/Source/WebCore/platform/gtk/RenderThemeGtk3.cpp b/Source/WebCore/platform/gtk/RenderThemeGtk3.cpp
index 7fa0f04..527de1a 100644
--- a/Source/WebCore/platform/gtk/RenderThemeGtk3.cpp
+++ b/Source/WebCore/platform/gtk/RenderThemeGtk3.cpp
@@ -483,14 +483,14 @@ bool RenderThemeGtk::paintMenuList(RenderObject* renderObject, const PaintInfo&
     gtk_style_context_get_style(arrowStyleContext, "arrow-scaling", &arrowScaling, NULL);
 
     IntSize arrowSize(minArrowSize, innerRect.height());
-    IntPoint arrowPosition = innerRect.location();
+    FloatPoint arrowPosition(innerRect.location());
     if (direction == GTK_TEXT_DIR_LTR)
         arrowPosition.move(innerRect.width() - arrowSize.width(), 0);
 
     // GTK+ actually fetches the xalign and valign values from the widget, but since we
     // don't have a widget here, we are just using the default xalign and valign values of 0.5.
     gint extent = std::min(arrowSize.width(), arrowSize.height()) * arrowScaling;
-    arrowPosition.move(std::floor((arrowSize.width() - extent) / 2), std::floor((arrowSize.height() - extent) / 2));
+    arrowPosition.move((arrowSize.width() - extent) / 2, (arrowSize.height() - extent) / 2);
 
     gtk_style_context_set_state(arrowStyleContext, state);
     gtk_render_arrow(arrowStyleContext, cairoContext, G_PI, arrowPosition.x(), arrowPosition.y(), extent);
diff --git a/Source/WebCore/platform/gtk/ScrollViewGtk.cpp b/Source/WebCore/platform/gtk/ScrollViewGtk.cpp
index c5f32f3..53cacf7 100644
--- a/Source/WebCore/platform/gtk/ScrollViewGtk.cpp
+++ b/Source/WebCore/platform/gtk/ScrollViewGtk.cpp
@@ -31,6 +31,8 @@
 #include "config.h"
 #include "ScrollView.h"
 
+#if USE(NATIVE_GTK_MAIN_FRAME_SCROLLBAR)
+
 #include "ChromeClient.h"
 #include "FloatRect.h"
 #include "Frame.h"
@@ -44,7 +46,6 @@
 #include "PlatformMouseEvent.h"
 #include "PlatformWheelEvent.h"
 #include "ScrollbarTheme.h"
-
 #include <gtk/gtk.h>
 
 using namespace std;
@@ -228,3 +229,5 @@ void ScrollView::setScrollbarModes(ScrollbarMode horizontalMode, ScrollbarMode v
 }
 
 }
+
+#endif // USE(NATIVE_GTK_MAIN_FRAME_SCROLLBAR)
diff --git a/Source/WebCore/platform/gtk/ScrollbarThemeGtk3.cpp b/Source/WebCore/platform/gtk/ScrollbarThemeGtk3.cpp
index d000063..b0b5146 100644
--- a/Source/WebCore/platform/gtk/ScrollbarThemeGtk3.cpp
+++ b/Source/WebCore/platform/gtk/ScrollbarThemeGtk3.cpp
@@ -135,40 +135,16 @@ void ScrollbarThemeGtk::paintButton(GraphicsContext* context, Scrollbar* scrollb
         flags |= GTK_STATE_FLAG_INSENSITIVE;
     gtk_style_context_set_state(m_context, static_cast<GtkStateFlags>(flags));
 
-    guint sides = gtk_style_context_get_junction_sides(m_context);
-    if (scrollbar->orientation() == VerticalScrollbar)
-        sides &= ~(GTK_JUNCTION_TOP | GTK_JUNCTION_BOTTOM);
-    else
-        sides &= ~(GTK_JUNCTION_LEFT | GTK_JUNCTION_RIGHT);
-
-    switch (part) {
-    case BackButtonStartPart:
-        sides |= (scrollbar->orientation() == VerticalScrollbar) ? GTK_JUNCTION_BOTTOM : GTK_JUNCTION_RIGHT;
-        break;
-    case BackButtonEndPart:
-    case ForwardButtonEndPart:
-        sides |= (scrollbar->orientation() == VerticalScrollbar) ?
-                GTK_JUNCTION_TOP | GTK_JUNCTION_BOTTOM : GTK_JUNCTION_RIGHT | GTK_JUNCTION_LEFT;
-        break;
-    case ForwardButtonStartPart:
-        sides |= (scrollbar->orientation() == VerticalScrollbar) ? GTK_JUNCTION_TOP : GTK_JUNCTION_LEFT;
-        break;
-    default:
-        ASSERT_NOT_REACHED();
-    }
-    gtk_style_context_set_junction_sides(m_context, static_cast<GtkJunctionSides>(sides));
     gtk_style_context_add_class(m_context, GTK_STYLE_CLASS_BUTTON);
-
     gtk_render_background(m_context, context->platformContext(), rect.x(), rect.y(), rect.width(), rect.height());
     gtk_render_frame(m_context, context->platformContext(), rect.x(), rect.y(), rect.width(), rect.height());
 
     gfloat arrowScaling;
     gtk_style_context_get_style(m_context, "arrow-scaling", &arrowScaling, NULL);
 
-    IntSize arrowSize = rect.size();
-    arrowSize.scale(arrowScaling);
-    IntPoint arrowPoint(rect.x() + (rect.width() - arrowSize.width()) / 2,
-                        rect.y() + (rect.height() - arrowSize.height()) / 2);
+    double arrowSize = std::min(rect.width(), rect.height()) * arrowScaling;
+    FloatPoint arrowPoint(rect.x() + (rect.width() - arrowSize) / 2,
+                          rect.y() + (rect.height() - arrowSize) / 2);
 
     if (flags & GTK_STATE_FLAG_ACTIVE) {
         gint arrowDisplacementX, arrowDisplacementY;
@@ -179,16 +155,14 @@ void ScrollbarThemeGtk::paintButton(GraphicsContext* context, Scrollbar* scrollb
         arrowPoint.move(arrowDisplacementX, arrowDisplacementY);
     }
 
-    gdouble angle, size;
+    gdouble angle;
     if (scrollbar->orientation() == VerticalScrollbar) {
-        size = arrowSize.width();
         angle = (part == ForwardButtonEndPart || part == ForwardButtonStartPart) ? G_PI : 0;
     } else {
-        size = arrowSize.height();
         angle = (part == ForwardButtonEndPart || part == ForwardButtonStartPart) ? G_PI / 2 : 3 * (G_PI / 2);
     }
 
-    gtk_render_arrow(m_context, context->platformContext(), angle, arrowPoint.x(), arrowPoint.y(), size);
+    gtk_render_arrow(m_context, context->platformContext(), angle, arrowPoint.x(), arrowPoint.y(), arrowSize);
 
     gtk_style_context_restore(m_context);
 }
diff --git a/Source/WebCore/platform/gtk/WidgetGtk.cpp b/Source/WebCore/platform/gtk/WidgetGtk.cpp
index f251772..0ab3940 100644
--- a/Source/WebCore/platform/gtk/WidgetGtk.cpp
+++ b/Source/WebCore/platform/gtk/WidgetGtk.cpp
@@ -41,8 +41,6 @@
 
 namespace WebCore {
 
-static GdkCursor* lastSetCursor;
-
 Widget::Widget(PlatformWidget widget)
 {
     init(widget);
@@ -60,11 +58,6 @@ void Widget::setFocus(bool focused)
         gtk_widget_grab_focus(platformWidget() ? platformWidget() : GTK_WIDGET(root()->hostWindow()->platformPageClient()));
 }
 
-static GdkWindow* gdkWindow(PlatformWidget widget)
-{
-    return widget ? gtk_widget_get_window(widget) : 0;
-}
-    
 void Widget::setCursor(const Cursor& cursor)
 {
     ScrollView* view = root();
diff --git a/Source/WebCore/platform/gtk/WidgetRenderingContext.cpp b/Source/WebCore/platform/gtk/WidgetRenderingContext.cpp
index 9e640f6..6f7389d 100644
--- a/Source/WebCore/platform/gtk/WidgetRenderingContext.cpp
+++ b/Source/WebCore/platform/gtk/WidgetRenderingContext.cpp
@@ -33,6 +33,7 @@
 
 #include "GraphicsContext.h"
 #include "GtkVersioning.h"
+#include "PlatformContextCairo.h"
 #include "RefPtrCairo.h"
 #include "RenderThemeGtk.h"
 #include "Timer.h"
@@ -128,7 +129,7 @@ WidgetRenderingContext::~WidgetRenderingContext()
     }
 
     // FIXME: It's unclear if it is necessary to preserve the current source here.
-    cairo_t* cairoContext = m_graphicsContext->platformContext();
+    cairo_t* cairoContext = m_graphicsContext->platformContext()->cr();
     RefPtr<cairo_pattern_t> previousSource(cairo_get_source(cairoContext));
 
     // The blit rectangle is the original target rectangle adjusted for any extra space.
diff --git a/Source/WebCore/platform/haiku/FileSystemHaiku.cpp b/Source/WebCore/platform/haiku/FileSystemHaiku.cpp
index b0d34f2..7985c54 100644
--- a/Source/WebCore/platform/haiku/FileSystemHaiku.cpp
+++ b/Source/WebCore/platform/haiku/FileSystemHaiku.cpp
@@ -56,11 +56,11 @@ String homeDirectoryPath()
     return String(path.Path());
 }
 
-CString openTemporaryFile(const char* prefix, PlatformFileHandle& handle)
+String openTemporaryFile(const String&, PlatformFileHandle& handle)
 {
     notImplemented();
     handle = invalidPlatformFileHandle;
-    return CString();
+    return String();
 }
 
 void closeFile(PlatformFileHandle&)
diff --git a/Source/WebCore/platform/haiku/LocalizedStringsHaiku.cpp b/Source/WebCore/platform/haiku/LocalizedStringsHaiku.cpp
index 63b9b91..c1f3641 100644
--- a/Source/WebCore/platform/haiku/LocalizedStringsHaiku.cpp
+++ b/Source/WebCore/platform/haiku/LocalizedStringsHaiku.cpp
@@ -213,7 +213,7 @@ String contextMenuItemTagSearchWeb()
     return "Search web";
 }
 
-String contextMenuItemTagLookUpInDictionary()
+String contextMenuItemTagLookUpInDictionary(const String&)
 {
     return "Lookup in dictionary";
 }
diff --git a/Source/WebCore/platform/image-decoders/ImageDecoder.h b/Source/WebCore/platform/image-decoders/ImageDecoder.h
index 2a307c5..801daf3 100644
--- a/Source/WebCore/platform/image-decoders/ImageDecoder.h
+++ b/Source/WebCore/platform/image-decoders/ImageDecoder.h
@@ -62,7 +62,7 @@ namespace WebCore {
             DisposeNotSpecified,      // Leave frame in framebuffer
             DisposeKeep,              // Leave frame in framebuffer
             DisposeOverwriteBgcolor,  // Clear frame to transparent
-            DisposeOverwritePrevious, // Clear frame to previous framebuffer
+            DisposeOverwritePrevious  // Clear frame to previous framebuffer
                                       // contents
         };
 #if USE(SKIA) || PLATFORM(QT)
diff --git a/Source/WebCore/platform/image-decoders/png/PNGImageDecoder.cpp b/Source/WebCore/platform/image-decoders/png/PNGImageDecoder.cpp
index 8edfe36..8419a97 100644
--- a/Source/WebCore/platform/image-decoders/png/PNGImageDecoder.cpp
+++ b/Source/WebCore/platform/image-decoders/png/PNGImageDecoder.cpp
@@ -241,11 +241,11 @@ void PNGImageDecoder::headerAvailable()
 {
     png_structp png = m_reader->pngPtr();
     png_infop info = m_reader->infoPtr();
-    png_uint_32 width = png->width;
-    png_uint_32 height = png->height;
+    png_uint_32 width = png_get_image_width(png, info);
+    png_uint_32 height = png_get_image_height(png, info);
     
     // Protect against large images.
-    if (png->width > cMaxPNGSize || png->height > cMaxPNGSize) {
+    if (width > cMaxPNGSize || height > cMaxPNGSize) {
         longjmp(JMPBUF(png), 1);
         return;
     }
@@ -318,9 +318,14 @@ void PNGImageDecoder::headerAvailable()
     m_reader->setHasAlpha(channels == 4);
 
     if (m_reader->decodingSizeOnly()) {
-        // If we only needed the size, halt the reader.     
+        // If we only needed the size, halt the reader.
+#if defined(PNG_LIBPNG_VER_MAJOR) && defined(PNG_LIBPNG_VER_MINOR) && (PNG_LIBPNG_VER_MAJOR > 1 || (PNG_LIBPNG_VER_MAJOR == 1 && PNG_LIBPNG_VER_MINOR >= 5))
+        // '0' argument to png_process_data_pause means: Do not cache unprocessed data.
+        m_reader->setReadOffset(m_reader->currentBufferSize() - png_process_data_pause(png, 0));
+#else
         m_reader->setReadOffset(m_reader->currentBufferSize() - png->buffer_size);
         png->buffer_size = 0;
+#endif
     }
 }
 
@@ -343,7 +348,7 @@ void PNGImageDecoder::rowAvailable(unsigned char* rowBuffer, unsigned rowIndex,
         // For PNGs, the frame always fills the entire image.
         buffer.setOriginalFrameRect(IntRect(IntPoint(), size()));
 
-        if (m_reader->pngPtr()->interlaced)
+        if (png_get_interlace_type(m_reader->pngPtr(), m_reader->infoPtr()) != PNG_INTERLACE_NONE)
             m_reader->createInterlaceBuffer((m_reader->hasAlpha() ? 4 : 3) * size().width() * size().height());
     }
 
diff --git a/Source/WebCore/platform/image-encoders/skia/JPEGImageEncoder.cpp b/Source/WebCore/platform/image-encoders/skia/JPEGImageEncoder.cpp
index be3c92a..f0ac601 100644
--- a/Source/WebCore/platform/image-encoders/skia/JPEGImageEncoder.cpp
+++ b/Source/WebCore/platform/image-encoders/skia/JPEGImageEncoder.cpp
@@ -31,6 +31,7 @@
 #include "config.h"
 #include "JPEGImageEncoder.h"
 
+#include "ImageData.h"
 #include "IntSize.h"
 #include "SkBitmap.h"
 #include "SkColorPriv.h"
@@ -79,22 +80,29 @@ static void handleError(j_common_ptr common)
     longjmp(*jumpBufferPtr, -1);
 }
 
-static void preMultipliedBGRAtoRGB(const SkPMColor* input, unsigned int pixels, unsigned char* output)
+static void preMultipliedBGRAtoRGB(const void* pixels, unsigned int pixelCount, unsigned char* output)
 {
-    for (; pixels-- > 0; ++input) {
+    const SkPMColor* input = static_cast<const SkPMColor*>(pixels);
+    for (; pixelCount-- > 0; ++input) {
         *output++ = SkGetPackedR32(*input);
         *output++ = SkGetPackedG32(*input);
         *output++ = SkGetPackedB32(*input);
     }
 }
 
-bool JPEGImageEncoder::encode(const SkBitmap& bitmap, int quality, Vector<unsigned char>* output)
+static void RGBAtoRGB(const unsigned char* input, unsigned int pixels, unsigned char* output)
 {
-    if (bitmap.config() != SkBitmap::kARGB_8888_Config)
-        return false; // Only support ARGB 32 bpp skia bitmaps.
+    for (; pixels-- > 0; input += 4) {
+        *output++ = input[0];
+        *output++ = input[1];
+        *output++ = input[2];
+    }
+}
 
-    SkAutoLockPixels bitmapLock(bitmap);
-    IntSize imageSize(bitmap.width(), bitmap.height());
+static bool encodePixels(const IntSize& inputSize, unsigned char* inputPixels,
+                         bool premultiplied, int quality, Vector<unsigned char>* output)
+{
+    IntSize imageSize(inputSize);
     imageSize.clampNegativeToZero();
     JPEGOutputBuffer destination;
     destination.output = output;
@@ -126,12 +134,15 @@ bool JPEGImageEncoder::encode(const SkBitmap& bitmap, int quality, Vector<unsign
     jpeg_set_quality(&cinfo, quality, TRUE);
     jpeg_start_compress(&cinfo, TRUE);
 
-    const SkPMColor* pixels = static_cast<SkPMColor*>(bitmap.getPixels());
+    unsigned char* pixels = inputPixels;
     row.resize(cinfo.image_width * cinfo.input_components);
     while (cinfo.next_scanline < cinfo.image_height) {
-        preMultipliedBGRAtoRGB(pixels, cinfo.image_width, row.data());
+        if (premultiplied)
+            preMultipliedBGRAtoRGB(pixels, cinfo.image_width, row.data());
+        else 
+            RGBAtoRGB(pixels, cinfo.image_width, row.data());
         jpeg_write_scanlines(&cinfo, row.dataSlot(), 1);
-        pixels += cinfo.image_width;
+        pixels += cinfo.image_width * 4;
     }
 
     jpeg_finish_compress(&cinfo);
@@ -139,4 +150,22 @@ bool JPEGImageEncoder::encode(const SkBitmap& bitmap, int quality, Vector<unsign
     return true;
 }
 
+bool JPEGImageEncoder::encode(const SkBitmap& bitmap, int quality, Vector<unsigned char>* output)
+{
+    if (bitmap.config() != SkBitmap::kARGB_8888_Config)
+        return false; // Only support ARGB 32 bpp skia bitmaps.
+
+    SkAutoLockPixels bitmapLock(bitmap);
+    IntSize imageSize(bitmap.width(), bitmap.height());
+
+    return encodePixels(imageSize, static_cast<unsigned char *>(bitmap.getPixels()),
+                        true, quality, output);
+}
+
+bool JPEGImageEncoder::encode(const ImageData& imageData, int quality, Vector<unsigned char>* output)
+{
+    return encodePixels(imageData.size(), imageData.data()->data()->data(),
+                        false, quality, output);
+}
+
 } // namespace WebCore
diff --git a/Source/WebCore/platform/image-encoders/skia/JPEGImageEncoder.h b/Source/WebCore/platform/image-encoders/skia/JPEGImageEncoder.h
index f2ac52d..122725d 100644
--- a/Source/WebCore/platform/image-encoders/skia/JPEGImageEncoder.h
+++ b/Source/WebCore/platform/image-encoders/skia/JPEGImageEncoder.h
@@ -31,16 +31,19 @@
 #ifndef JPEGImageEncoder_h
 #define JPEGImageEncoder_h
 
-#include "Vector.h"
+#include <wtf/Vector.h>
 
 class SkBitmap;
 
 namespace WebCore {
 
+class ImageData;
+
 class JPEGImageEncoder {
 public:
-    // Encode the input bitmap with a compression quality in [0-100].
+    // Encode the input data with a compression quality in [0-100].
     static bool encode(const SkBitmap&, int quality, Vector<unsigned char>*);
+    static bool encode(const ImageData&, int quality, Vector<unsigned char>*);
 
     // For callers: provide a reasonable compression quality default.
     enum Quality { DefaultCompressionQuality = 92 };
diff --git a/Source/WebCore/platform/image-encoders/skia/PNGImageEncoder.cpp b/Source/WebCore/platform/image-encoders/skia/PNGImageEncoder.cpp
index 78f737e..2fc758e 100644
--- a/Source/WebCore/platform/image-encoders/skia/PNGImageEncoder.cpp
+++ b/Source/WebCore/platform/image-encoders/skia/PNGImageEncoder.cpp
@@ -31,6 +31,7 @@
 #include "config.h"
 #include "PNGImageEncoder.h"
 
+#include "ImageData.h"
 #include "IntSize.h"
 #include "SkBitmap.h"
 #include "SkColorPriv.h"
@@ -46,11 +47,12 @@ static void writeOutput(png_structp png, png_bytep data, png_size_t size)
     static_cast<Vector<unsigned char>*>(png->io_ptr)->append(data, size);
 }
 
-static void preMultipliedBGRAtoRGBA(const SkPMColor* input, int pixels, unsigned char* output)
+static void preMultipliedBGRAtoRGBA(const void* pixels, int pixelCount, unsigned char* output)
 {
     static const SkUnPreMultiply::Scale* scale = SkUnPreMultiply::GetScaleTable();
+    const SkPMColor* input = static_cast<const SkPMColor*>(pixels);
 
-    for (; pixels-- > 0; ++input) {
+    for (; pixelCount-- > 0; ++input) {
         const unsigned alpha = SkGetPackedA32(*input);
         if ((alpha != 0) && (alpha != 255)) {
             *output++ = SkUnPreMultiply::ApplyScale(scale[alpha], SkGetPackedR32(*input));
@@ -66,13 +68,10 @@ static void preMultipliedBGRAtoRGBA(const SkPMColor* input, int pixels, unsigned
     }
 }
 
-bool PNGImageEncoder::encode(const SkBitmap& bitmap, Vector<unsigned char>* output)
+static bool encodePixels(const IntSize& inputSize, unsigned char* inputPixels,
+                         bool premultiplied, Vector<unsigned char>* output)
 {
-    if (bitmap.config() != SkBitmap::kARGB_8888_Config)
-        return false; // Only support ARGB 32 bpp skia bitmaps.
-
-    SkAutoLockPixels bitmapLock(bitmap);
-    IntSize imageSize(bitmap.width(), bitmap.height());
+    IntSize imageSize(inputSize);
     imageSize.clampNegativeToZero();
     Vector<unsigned char> row;
 
@@ -100,12 +99,15 @@ bool PNGImageEncoder::encode(const SkBitmap& bitmap, Vector<unsigned char>* outp
                  8, PNG_COLOR_TYPE_RGB_ALPHA, 0, 0, 0);
     png_write_info(png, info);
 
-    const SkPMColor* pixels = static_cast<SkPMColor*>(bitmap.getPixels());
-    row.resize(imageSize.width() * bitmap.bytesPerPixel());
+    unsigned char* pixels = inputPixels;
+    row.resize(imageSize.width() * sizeof(SkPMColor));
     for (int y = 0; y < imageSize.height(); ++y) {
-        preMultipliedBGRAtoRGBA(pixels, imageSize.width(), row.data());
-        png_write_row(png, row.data());
-        pixels += imageSize.width();
+        if (premultiplied) {
+            preMultipliedBGRAtoRGBA(pixels, imageSize.width(), row.data());
+            png_write_row(png, row.data());
+        } else
+            png_write_row(png, pixels);
+        pixels += imageSize.width() * 4;
     }
 
     png_write_end(png, info);
@@ -113,4 +115,19 @@ bool PNGImageEncoder::encode(const SkBitmap& bitmap, Vector<unsigned char>* outp
     return true;
 }
 
+bool PNGImageEncoder::encode(const SkBitmap& bitmap, Vector<unsigned char>* output)
+{
+    if (bitmap.config() != SkBitmap::kARGB_8888_Config)
+        return false; // Only support ARGB 32 bpp skia bitmaps.
+
+    SkAutoLockPixels bitmapLock(bitmap);
+    IntSize imageSize(bitmap.width(), bitmap.height());
+    return encodePixels(imageSize, static_cast<unsigned char*>(bitmap.getPixels()), true, output);
+}
+
+bool PNGImageEncoder::encode(const ImageData& bitmap, Vector<unsigned char>* output)
+{
+    return encodePixels(bitmap.size(), bitmap.data()->data()->data(), false, output);
+}
+
 } // namespace WebCore
diff --git a/Source/WebCore/platform/image-encoders/skia/PNGImageEncoder.h b/Source/WebCore/platform/image-encoders/skia/PNGImageEncoder.h
index b8dfec3..31edad3 100644
--- a/Source/WebCore/platform/image-encoders/skia/PNGImageEncoder.h
+++ b/Source/WebCore/platform/image-encoders/skia/PNGImageEncoder.h
@@ -31,16 +31,19 @@
 #ifndef PNGImageEncoder_h
 #define PNGImageEncoder_h
 
-#include "Vector.h"
+#include <wtf/Vector.h>
 
 class SkBitmap;
 
 namespace WebCore {
 
+class ImageData;
+
 // Interface for encoding PNG data. This is a wrapper around libpng.
 class PNGImageEncoder {
 public:
     static bool encode(const SkBitmap&, Vector<unsigned char>* output);
+    static bool encode(const ImageData&, Vector<unsigned char>* output);
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/mac/FileSystemMac.mm b/Source/WebCore/platform/mac/FileSystemMac.mm
index 8cdd382..a9cbcf4 100644
--- a/Source/WebCore/platform/mac/FileSystemMac.mm
+++ b/Source/WebCore/platform/mac/FileSystemMac.mm
@@ -41,28 +41,29 @@ String homeDirectoryPath()
     return NSHomeDirectory();
 }
 
-CString openTemporaryFile(const char* prefix, PlatformFileHandle& platformFileHandle)
+String openTemporaryFile(const String& prefix, PlatformFileHandle& platformFileHandle)
 {
     platformFileHandle = invalidPlatformFileHandle;
     
     Vector<char> temporaryFilePath(PATH_MAX);
     if (!confstr(_CS_DARWIN_USER_TEMP_DIR, temporaryFilePath.data(), temporaryFilePath.size()))
-        return CString();
+        return String();
 
     // Shrink the vector.   
     temporaryFilePath.shrink(strlen(temporaryFilePath.data()));
     ASSERT(temporaryFilePath.last() == '/');
 
-    // Append the file name.    
-    temporaryFilePath.append(prefix, strlen(prefix));
+    // Append the file name.
+    CString prefixUtf8 = prefix.utf8();
+    temporaryFilePath.append(prefixUtf8.data(), prefixUtf8.length());
     temporaryFilePath.append("XXXXXX", 6);
     temporaryFilePath.append('\0');
 
     platformFileHandle = mkstemp(temporaryFilePath.data());
     if (platformFileHandle == invalidPlatformFileHandle)
-        return CString();
+        return String();
 
-    return CString(temporaryFilePath.data());
+    return String::fromUTF8(temporaryFilePath.data());
 }
 
 bool canExcludeFromBackup()
diff --git a/Source/WebCore/platform/mac/HTMLConverter.h b/Source/WebCore/platform/mac/HTMLConverter.h
new file mode 100644
index 0000000..645c1d7
--- /dev/null
+++ b/Source/WebCore/platform/mac/HTMLConverter.h
@@ -0,0 +1,88 @@
+/*
+ * Copyright (C) 2010 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#import "DOM.h"
+#import "DOMDocument.h"
+#import "DOMRange.h"
+
+namespace WebCore {
+class DocumentLoader;
+}
+
+@interface WebHTMLConverter : NSObject {
+    NSMutableAttributedString *_attrStr;
+    NSURL *_baseURL;
+    DOMDocument *_document;
+    DOMRange *_domRange;
+    NSMutableArray *_domStartAncestors;
+    WebCore::DocumentLoader *_dataSource;
+    NSString *_standardFontFamily;
+    CGFloat _textSizeMultiplier;
+    CGFloat _webViewTextSizeMultiplier;
+    CGFloat _defaultTabInterval;
+    CGFloat _defaultFontSize;
+    CGFloat _minimumFontSize;
+    NSMutableArray *_textLists;
+    NSMutableArray *_textBlocks;
+    NSMutableArray *_textTables;
+    NSMutableDictionary *_textTableFooters;
+    NSMutableArray *_textTableSpacings;
+    NSMutableArray *_textTablePaddings;
+    NSMutableArray *_textTableRows;
+    NSMutableArray *_textTableRowArrays;
+    NSMutableArray *_textTableRowBackgroundColors;
+    NSMutableDictionary *_computedStylesForElements;
+    NSMutableDictionary *_specifiedStylesForElements;
+    NSMutableDictionary *_stringsForNodes;
+    NSMutableDictionary *_floatsForNodes;
+    NSMutableDictionary *_colorsForNodes;
+    NSMutableDictionary *_attributesForElements;
+    NSMutableDictionary *_elementIsBlockLevel;
+    NSMutableDictionary *_fontCache;
+    NSMutableArray *_writingDirectionArray;
+    NSUInteger _domRangeStartIndex;
+    NSInteger _indexingLimit;
+    NSUInteger _thumbnailLimit;
+    NSInteger _errorCode;
+    NSInteger _quoteLevel;
+
+    struct {
+        unsigned int isSoft:1;
+        unsigned int reachedStart:1;
+        unsigned int reachedEnd:1;
+        unsigned int isIndexing:1;
+        unsigned int isTesting:1;
+        unsigned int hasTrailingNewline:1;
+        unsigned int pad:26;
+    } _flags;
+}
+
+- (id)init;
+- (id)initWithDOMRange:(DOMRange *)domRange;
+
+- (NSAttributedString *)attributedString;
+
+@end
+
diff --git a/Source/WebCore/platform/mac/HTMLConverter.mm b/Source/WebCore/platform/mac/HTMLConverter.mm
new file mode 100644
index 0000000..a4864c2
--- /dev/null
+++ b/Source/WebCore/platform/mac/HTMLConverter.mm
@@ -0,0 +1,1682 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#import "config.h"
+#import "HTMLConverter.h"
+
+#import "ArchiveResource.h"
+#import "Document.h"
+#import "DocumentLoader.h"
+#import "DOMDocumentInternal.h"
+#import "DOMElementInternal.h"
+#import "DOMHTMLTableCellElement.h"
+#import "DOMPrivate.h"
+#import "Element.h"
+#import "Frame.h"
+#import "HTMLNames.h"
+#import "HTMLParserIdioms.h"
+#import <wtf/ASCIICType.h>
+
+using namespace WebCore;
+using namespace HTMLNames;
+
+#if !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
+// Additional control Unicode characters
+const unichar WebNextLineCharacter = 0x0085;
+
+@interface NSTextList (TextListPrivate)
++ (NSDictionary *)_standardMarkerAttributesForAttributes:(NSDictionary *)attrs;
+@end
+
+@interface NSTextAttachment (NSIgnoreOrientation)
+- (void)setIgnoresOrientation:(BOOL)flag;
+- (BOOL)ignoresOrientation;
+@end
+
+@interface NSURL (WebDataURL)
++ (NSURL *)_web_uniqueWebDataURL;
++ (NSURL *)_web_uniqueWebDataURLWithRelativeString:(NSString *)string;
++ (NSURL *)_web_URLWithString:(NSString *)string relativeToURL:(NSURL *)baseURL;
+- (NSString *)_web_suggestedFilenameWithMIMEType:(NSString *)MIMEType;
+@end
+
+@interface WebHTMLConverter(WebHTMLConverterPrivate)
+
+- (NSString *)_stringForNode:(DOMNode *)node property:(NSString *)key;
+- (NSColor *)_colorForNode:(DOMNode *)node property:(NSString *)key;
+- (BOOL)_getFloat:(CGFloat *)val forNode:(DOMNode *)node property:(NSString *)key;
+- (void)_traverseNode:(DOMNode *)node depth:(NSInteger)depth embedded:(BOOL)embedded;
+- (void)_traverseFooterNode:(DOMNode *)node depth:(NSInteger)depth;
+
+@end
+
+// Returns the font to be used if the NSFontAttributeName doesn't exist
+static NSFont *WebDefaultFont()
+{
+    static NSFont *defaultFont = nil;
+    
+    if (defaultFont)
+        return defaultFont;
+    
+    NSFont *font = [NSFont fontWithName:@"Helvetica" size:12];    
+    if (!font)
+        font = [NSFont systemFontOfSize:12];
+    
+    defaultFont = [font retain];
+    
+    return defaultFont;
+}
+
+@implementation WebHTMLConverter
+
+static NSFont *_fontForNameAndSize(NSString *fontName, CGFloat size, NSMutableDictionary *cache)
+{
+    NSFontManager *fontManager = [NSFontManager sharedFontManager];
+    NSFont *font = [cache objectForKey:fontName];
+
+    if (font) {
+        font = [fontManager convertFont:font toSize:size];
+        return font;
+    }
+    font = [fontManager fontWithFamily:fontName traits:0 weight:0 size:size];
+    if (!font) {
+        NSArray *availableFamilyNames = [fontManager availableFontFamilies];
+        NSRange dividingRange, dividingSpaceRange = [fontName rangeOfString:@" " options:NSBackwardsSearch], dividingDashRange = [fontName rangeOfString:@"-" options:NSBackwardsSearch];
+        dividingRange = (0 < dividingSpaceRange.length && 0 < dividingDashRange.length) ? (dividingSpaceRange.location > dividingDashRange.location ? dividingSpaceRange : dividingDashRange) : (0 < dividingSpaceRange.length ? dividingSpaceRange : dividingDashRange);
+        while (0 < dividingRange.length) {
+            NSString *familyName = [fontName substringToIndex:dividingRange.location];
+            if ([availableFamilyNames containsObject:familyName]) {
+                NSArray *familyMemberArray;
+                NSString *faceName = [fontName substringFromIndex:(dividingRange.location + dividingRange.length)];
+                NSArray *familyMemberArrays = [fontManager availableMembersOfFontFamily:familyName];
+                NSEnumerator *familyMemberArraysEnum = [familyMemberArrays objectEnumerator];
+                while ((familyMemberArray = [familyMemberArraysEnum nextObject])) {
+                    NSString *familyMemberFaceName = [familyMemberArray objectAtIndex:1];
+                    if ([familyMemberFaceName compare:faceName options:NSCaseInsensitiveSearch] == NSOrderedSame) {
+                        NSFontTraitMask traits = [[familyMemberArray objectAtIndex:3] integerValue];
+                        NSInteger weight = [[familyMemberArray objectAtIndex:2] integerValue];
+                        font = [fontManager fontWithFamily:familyName traits:traits weight:weight size:size];
+                        break;
+                    }
+                }
+                if (!font) {
+                    if (0 < [familyMemberArrays count]) {
+                        NSArray *familyMemberArray = [familyMemberArrays objectAtIndex:0];
+                        NSFontTraitMask traits = [[familyMemberArray objectAtIndex:3] integerValue];
+                        NSInteger weight = [[familyMemberArray objectAtIndex:2] integerValue];
+                        font = [fontManager fontWithFamily:familyName traits:traits weight:weight size:size];
+                    }
+                }
+                break;
+            } else {
+                dividingSpaceRange = [familyName rangeOfString:@" " options:NSBackwardsSearch];
+                dividingDashRange = [familyName rangeOfString:@"-" options:NSBackwardsSearch];
+                dividingRange = (0 < dividingSpaceRange.length && 0 < dividingDashRange.length) ? (dividingSpaceRange.location > dividingDashRange.location ? dividingSpaceRange : dividingDashRange) : (0 < dividingSpaceRange.length ? dividingSpaceRange : dividingDashRange);
+            }
+        }
+    }
+    if (!font) font = [NSFont fontWithName:@"Times" size:size];
+    if (!font) font = [NSFont userFontOfSize:size];
+    if (!font) font = [fontManager convertFont:WebDefaultFont() toSize:size];
+    if (!font) font = WebDefaultFont();
+    [cache setObject:font forKey:fontName];
+    return font;
+}
+
++ (NSParagraphStyle *)defaultParagraphStyle
+{
+    static NSMutableParagraphStyle *defaultParagraphStyle = nil;
+    if (!defaultParagraphStyle) {
+        defaultParagraphStyle = [[NSParagraphStyle defaultParagraphStyle] mutableCopy];
+        [defaultParagraphStyle setDefaultTabInterval:36];
+        [defaultParagraphStyle setTabStops:[NSArray array]];
+    }
+    return defaultParagraphStyle;
+}
+
+- (NSArray *)_childrenForNode:(DOMNode *)node
+{
+    NSMutableArray *array = [NSMutableArray array];
+    DOMNode *child = [node firstChild];
+    while (child) {
+        [array addObject:child];
+        child = [child nextSibling];
+    }
+    return array;
+}
+
+- (DOMCSSStyleDeclaration *)_computedStyleForElement:(DOMElement *)element
+{
+    DOMDocument *document = [element ownerDocument];
+    DOMCSSStyleDeclaration *result = nil;
+    result = [_computedStylesForElements objectForKey:element];
+    if (result) {
+        if ([[NSNull null] isEqual:result]) result = nil;
+    } else {
+        result = [document getComputedStyle:element pseudoElement:@""] ;
+        [_computedStylesForElements setObject:(result ? (id)result : (id)[NSNull null]) forKey:element];
+    }
+    return result;
+}
+
+- (DOMCSSStyleDeclaration *)_specifiedStyleForElement:(DOMElement *)element
+{
+    DOMCSSStyleDeclaration *result = [_specifiedStylesForElements objectForKey:element];
+    if (result) {
+        if ([[NSNull null] isEqual:result]) result = nil;
+    } else {
+        result = [element style];
+        [_specifiedStylesForElements setObject:(result ? (id)result : (id)[NSNull null]) forKey:element];
+    }
+    return result;
+}
+
+- (NSString *)_computedStringForNode:(DOMNode *)node property:(NSString *)key
+{
+    NSString *result = nil;
+    BOOL inherit = YES;
+    DOMElement *element = (DOMElement *)node;    
+    if (element && [element nodeType] == DOM_ELEMENT_NODE) {
+        DOMCSSStyleDeclaration *computedStyle, *specifiedStyle;
+        inherit = NO;
+        if (!result && (computedStyle = [self _computedStyleForElement:element])) {
+            DOMCSSPrimitiveValue *computedValue = (DOMCSSPrimitiveValue *)[computedStyle getPropertyCSSValue:key];
+            if (computedValue) {
+                unsigned short valueType = [computedValue cssValueType];
+                if (valueType == DOM_CSS_PRIMITIVE_VALUE) {
+                    unsigned short primitiveType = [computedValue primitiveType];
+                    if (primitiveType == DOM_CSS_STRING || primitiveType == DOM_CSS_URI || primitiveType == DOM_CSS_IDENT || primitiveType == DOM_CSS_ATTR) {
+                        result = [computedValue getStringValue];
+                        if (result && [result length] == 0) result = nil;
+                    }
+                } else if (valueType == DOM_CSS_VALUE_LIST) {
+                    result = [computedStyle getPropertyValue:key];
+                }
+            }
+        }
+        if (!result && (specifiedStyle = [self _specifiedStyleForElement:element])) {
+            DOMCSSPrimitiveValue *specifiedValue = (DOMCSSPrimitiveValue *)[specifiedStyle getPropertyCSSValue:key];
+            if (specifiedValue) {
+                unsigned short valueType = [specifiedValue cssValueType];
+                if (valueType == DOM_CSS_PRIMITIVE_VALUE) {
+                    unsigned short primitiveType = [specifiedValue primitiveType];
+                    if (primitiveType == DOM_CSS_STRING || primitiveType == DOM_CSS_URI || primitiveType == DOM_CSS_IDENT || primitiveType == DOM_CSS_ATTR) {
+                        result = [specifiedValue getStringValue];
+                        if (result && [result length] == 0) result = nil;
+                        // ??? hack alert
+                        if (!result) {
+                            result = [specifiedStyle getPropertyValue:key];
+                        }
+                    }
+                } else if (valueType == DOM_CSS_INHERIT) {
+                    inherit = YES;
+                } else if (valueType == DOM_CSS_VALUE_LIST) {
+                    result = [specifiedStyle getPropertyValue:key];
+                }
+            }
+        }
+        if (!result) {
+            Element* coreElement = core(element);
+            if ([@"display" isEqualToString:key]) {
+                if (coreElement->hasTagName(headTag) || coreElement->hasTagName(scriptTag) || coreElement->hasTagName(appletTag) || coreElement->hasTagName(noframesTag))
+                    result = @"none";
+                else if (coreElement->hasTagName(addressTag) || coreElement->hasTagName(blockquoteTag) || coreElement->hasTagName(bodyTag) || coreElement->hasTagName(centerTag)
+                         || coreElement->hasTagName(ddTag) || coreElement->hasTagName(dirTag) || coreElement->hasTagName(divTag) || coreElement->hasTagName(dlTag)
+                         || coreElement->hasTagName(dtTag) || coreElement->hasTagName(fieldsetTag) || coreElement->hasTagName(formTag) || coreElement->hasTagName(frameTag)
+                         || coreElement->hasTagName(framesetTag) || coreElement->hasTagName(hrTag) || coreElement->hasTagName(htmlTag) || coreElement->hasTagName(h1Tag)
+                         || coreElement->hasTagName(h2Tag) || coreElement->hasTagName(h3Tag) || coreElement->hasTagName(h4Tag) || coreElement->hasTagName(h5Tag)
+                         || coreElement->hasTagName(h6Tag) || coreElement->hasTagName(iframeTag) || coreElement->hasTagName(menuTag) || coreElement->hasTagName(noscriptTag)
+                         || coreElement->hasTagName(olTag) || coreElement->hasTagName(pTag) || coreElement->hasTagName(preTag) || coreElement->hasTagName(ulTag))
+                    result = @"block";
+                else if (coreElement->hasTagName(liTag))
+                    result = @"list-item";
+                else if (coreElement->hasTagName(tableTag))
+                    result = @"table";
+                else if (coreElement->hasTagName(trTag))
+                    result = @"table-row";
+                else if (coreElement->hasTagName(thTag) || coreElement->hasTagName(tdTag))
+                    result = @"table-cell";
+                else if (coreElement->hasTagName(theadTag))
+                    result = @"table-header-group";
+                else if (coreElement->hasTagName(tbodyTag))
+                    result = @"table-row-group";
+                else if (coreElement->hasTagName(tfootTag))
+                    result = @"table-footer-group";
+                else if (coreElement->hasTagName(colTag))
+                    result = @"table-column";
+                else if (coreElement->hasTagName(colgroupTag))
+                    result = @"table-column-group";
+                else if (coreElement->hasTagName(captionTag))
+                    result = @"table-caption";
+            } else if ([@"white-space" isEqualToString:key]) {
+                if (coreElement->hasTagName(preTag))
+                    result = @"pre";
+                else
+                    inherit = YES;
+            } else if ([@"font-style" isEqualToString:key]) {
+                if (coreElement->hasTagName(iTag) || coreElement->hasTagName(citeTag) || coreElement->hasTagName(emTag) || coreElement->hasTagName(varTag) || coreElement->hasTagName(addressTag))
+                    result = @"italic";
+                else
+                    inherit = YES;
+            } else if ([@"font-weight" isEqualToString:key]) {
+                if (coreElement->hasTagName(bTag) || coreElement->hasTagName(strongTag) || coreElement->hasTagName(thTag))
+                    result = @"bolder";
+                else
+                    inherit = YES;
+            } else if ([@"text-decoration" isEqualToString:key]) {
+                if (coreElement->hasTagName(uTag) || coreElement->hasTagName(insTag))
+                    result = @"underline";
+                else if (coreElement->hasTagName(sTag) || coreElement->hasTagName(strikeTag) || coreElement->hasTagName(delTag))
+                    result = @"line-through";
+                else
+                    inherit = YES; // ??? this is not strictly correct
+            } else if ([@"text-align" isEqualToString:key]) {
+                if (coreElement->hasTagName(centerTag) || coreElement->hasTagName(captionTag) || coreElement->hasTagName(thTag))
+                    result = @"center";
+                else
+                    inherit = YES;
+            } else if ([@"vertical-align" isEqualToString:key]) {
+                if (coreElement->hasTagName(supTag))
+                    result = @"super";
+                else if (coreElement->hasTagName(subTag))
+                    result = @"sub";
+                else if (coreElement->hasTagName(theadTag) || coreElement->hasTagName(tbodyTag) || coreElement->hasTagName(tfootTag))
+                    result = @"middle";
+                else if (coreElement->hasTagName(trTag) || coreElement->hasTagName(thTag) || coreElement->hasTagName(tdTag))
+                    inherit = YES;
+            } else if ([@"font-family" isEqualToString:key] || [@"font-variant" isEqualToString:key] || [@"font-effect" isEqualToString:key]
+                       || [@"text-transform" isEqualToString:key] || [@"text-shadow" isEqualToString:key] || [@"visibility" isEqualToString:key]
+                       || [@"border-collapse" isEqualToString:key] || [@"empty-cells" isEqualToString:key] || [@"word-spacing" isEqualToString:key]
+                       || [@"list-style-type" isEqualToString:key] || [@"direction" isEqualToString:key]) {
+                inherit = YES;
+            }
+        }
+    }
+    if (!result && inherit) {
+        DOMNode *parentNode = [node parentNode];
+        if (parentNode) result = [self _stringForNode:parentNode property:key];
+    }
+    return result ? [result lowercaseString] : nil;
+}
+
+- (NSString *)_stringForNode:(DOMNode *)node property:(NSString *)key
+{
+    NSString *result = nil;
+    NSMutableDictionary *attributeDictionary = [_stringsForNodes objectForKey:node];
+    if (!attributeDictionary) {
+        attributeDictionary = [[NSMutableDictionary alloc] init];
+        [_stringsForNodes setObject:attributeDictionary forKey:node];
+        [attributeDictionary release];
+    }
+    result = [attributeDictionary objectForKey:key];
+    if (result) {
+        if ([@"" isEqualToString:result]) result = nil;
+    } else {
+        result = [self _computedStringForNode:node property:key];
+        [attributeDictionary setObject:(result ? result : @"") forKey:key];
+    }
+    return result;
+}
+
+static inline BOOL _getFloat(DOMCSSPrimitiveValue *primitiveValue, CGFloat *val)
+{
+    if (!val)
+        return NO;
+    switch ([primitiveValue primitiveType]) {
+        case DOM_CSS_PX:
+            *val = [primitiveValue getFloatValue:DOM_CSS_PX];
+            return YES;
+        case DOM_CSS_PT:
+            *val = 4 * [primitiveValue getFloatValue:DOM_CSS_PT] / 3;
+            return YES;
+        case DOM_CSS_PC:
+            *val = 16 * [primitiveValue getFloatValue:DOM_CSS_PC];
+            return YES;
+        case DOM_CSS_CM:
+            *val = 96 * [primitiveValue getFloatValue:DOM_CSS_CM] / (CGFloat)2.54;
+            return YES;
+        case DOM_CSS_MM:
+            *val = 96 * [primitiveValue getFloatValue:DOM_CSS_MM] / (CGFloat)25.4;
+            return YES;
+        case DOM_CSS_IN:
+            *val = 96 * [primitiveValue getFloatValue:DOM_CSS_IN];
+            return YES;
+        default:
+            return NO;
+    }
+}
+
+- (BOOL)_getComputedFloat:(CGFloat *)val forNode:(DOMNode *)node property:(NSString *)key
+{
+    BOOL result = NO, inherit = YES;
+    CGFloat floatVal = 0;
+    DOMElement *element = (DOMElement *)node;    
+    if (element && [element nodeType] == DOM_ELEMENT_NODE) {
+        DOMCSSStyleDeclaration *computedStyle, *specifiedStyle;
+        inherit = NO;
+        if (!result && (computedStyle = [self _computedStyleForElement:element])) {
+            DOMCSSPrimitiveValue *computedValue = (DOMCSSPrimitiveValue *)[computedStyle getPropertyCSSValue:key];
+            if (computedValue && [computedValue cssValueType] == DOM_CSS_PRIMITIVE_VALUE) {
+                result = _getFloat(computedValue, &floatVal);
+            }
+        }
+        if (!result && (specifiedStyle = [self _specifiedStyleForElement:element])) {
+            DOMCSSPrimitiveValue *specifiedValue = (DOMCSSPrimitiveValue *)[specifiedStyle getPropertyCSSValue:key];
+            if (specifiedValue) {
+                unsigned short valueType = [specifiedValue cssValueType];
+                if (valueType == DOM_CSS_PRIMITIVE_VALUE) {
+                    result = _getFloat(specifiedValue, &floatVal);
+                } else if (valueType == DOM_CSS_INHERIT) {
+                    inherit = YES;
+                }
+            }
+        }
+        if (!result) {
+            if ([@"text-indent" isEqualToString:key] || [@"letter-spacing" isEqualToString:key] || [@"word-spacing" isEqualToString:key]
+                || [@"line-height" isEqualToString:key] || [@"widows" isEqualToString:key] || [@"orphans" isEqualToString:key])
+                inherit = YES;
+        }
+    }
+    if (!result && inherit) {
+        DOMNode *parentNode = [node parentNode];
+        if (parentNode) result = [self _getFloat:&floatVal forNode:parentNode property:key];
+    }
+    if (result && val)
+        *val = floatVal;
+    return result;
+}
+
+- (BOOL)_getFloat:(CGFloat *)val forNode:(DOMNode *)node property:(NSString *)key
+{
+    BOOL result = NO;
+    CGFloat floatVal = 0;
+    NSNumber *floatNumber;
+    NSMutableDictionary *attributeDictionary = [_floatsForNodes objectForKey:node];
+    if (!attributeDictionary) {
+        attributeDictionary = [[NSMutableDictionary alloc] init];
+        [_floatsForNodes setObject:attributeDictionary forKey:node];
+        [attributeDictionary release];
+    }
+    floatNumber = [attributeDictionary objectForKey:key];
+    if (floatNumber) {
+        if (![[NSNull null] isEqual:floatNumber]) {
+            result = YES;
+            floatVal = [floatNumber floatValue];
+        }
+    } else {
+        result = [self _getComputedFloat:&floatVal forNode:node property:key];
+        [attributeDictionary setObject:(result ? (id)[NSNumber numberWithDouble:floatVal] : (id)[NSNull null]) forKey:key];
+    }
+    if (result && val) *val = floatVal;
+    return result;
+}
+
+static inline NSColor *_colorForRGBColor(DOMRGBColor *domRGBColor, BOOL ignoreBlack)
+{
+    NSColor *color = [domRGBColor _color];
+    NSColorSpace *colorSpace = [color colorSpace];
+    const CGFloat ColorEpsilon = 1 / (2 * (CGFloat)255.0);
+    
+    if (color) {
+        if ([colorSpace isEqual:[NSColorSpace genericGrayColorSpace]] || [colorSpace isEqual:[NSColorSpace deviceGrayColorSpace]]) {
+            CGFloat white, alpha;
+            [color getWhite:&white alpha:&alpha];
+            if (white < ColorEpsilon && (ignoreBlack || alpha < ColorEpsilon)) color = nil;
+        } else {
+            NSColor *rgbColor = nil;
+            if ([colorSpace isEqual:[NSColorSpace genericRGBColorSpace]] || [colorSpace isEqual:[NSColorSpace deviceRGBColorSpace]]) rgbColor = color;
+            if (!rgbColor) rgbColor = [color colorUsingColorSpaceName:NSDeviceRGBColorSpace];
+            if (rgbColor) {
+                CGFloat red, green, blue, alpha;
+                [rgbColor getRed:&red green:&green blue:&blue alpha:&alpha];
+                if (red < ColorEpsilon && green < ColorEpsilon && blue < ColorEpsilon && (ignoreBlack || alpha < ColorEpsilon)) color = nil;
+            }
+        }
+    }
+    return color;
+}
+
+static inline NSShadow *_shadowForShadowStyle(NSString *shadowStyle)
+{
+    NSShadow *shadow = nil;
+    NSUInteger shadowStyleLength = [shadowStyle length];
+    NSRange openParenRange = [shadowStyle rangeOfString:@"("], closeParenRange = [shadowStyle rangeOfString:@")"], firstRange = NSMakeRange(NSNotFound, 0), secondRange = NSMakeRange(NSNotFound, 0), thirdRange = NSMakeRange(NSNotFound, 0), spaceRange;
+    if (openParenRange.length > 0 && closeParenRange.length > 0 && NSMaxRange(openParenRange) < closeParenRange.location) {
+        NSArray *components = [[shadowStyle substringWithRange:NSMakeRange(NSMaxRange(openParenRange), closeParenRange.location - NSMaxRange(openParenRange))] componentsSeparatedByString:@","];
+        if ([components count] >= 3) {
+            CGFloat red = [[components objectAtIndex:0] floatValue] / 255, green = [[components objectAtIndex:1] floatValue] / 255, blue = [[components objectAtIndex:2] floatValue] / 255, alpha = ([components count] >= 4) ? [[components objectAtIndex:3] floatValue] / 255 : 1;
+            NSColor *shadowColor = [NSColor colorWithCalibratedRed:red green:green blue:blue alpha:alpha];
+            NSSize shadowOffset;
+            CGFloat shadowBlurRadius;
+            firstRange = [shadowStyle rangeOfString:@"px"];
+            if (firstRange.length > 0 && NSMaxRange(firstRange) < shadowStyleLength) secondRange = [shadowStyle rangeOfString:@"px" options:0 range:NSMakeRange(NSMaxRange(firstRange), shadowStyleLength - NSMaxRange(firstRange))];
+            if (secondRange.length > 0 && NSMaxRange(secondRange) < shadowStyleLength) thirdRange = [shadowStyle rangeOfString:@"px" options:0 range:NSMakeRange(NSMaxRange(secondRange), shadowStyleLength - NSMaxRange(secondRange))];
+            if (firstRange.location > 0 && firstRange.length > 0 && secondRange.length > 0 && thirdRange.length > 0) {
+                spaceRange = [shadowStyle rangeOfString:@" " options:NSBackwardsSearch range:NSMakeRange(0, firstRange.location)];
+                if (spaceRange.length == 0) spaceRange = NSMakeRange(0, 0);
+                shadowOffset.width = [[shadowStyle substringWithRange:NSMakeRange(NSMaxRange(spaceRange), firstRange.location - NSMaxRange(spaceRange))] floatValue];
+                spaceRange = [shadowStyle rangeOfString:@" " options:NSBackwardsSearch range:NSMakeRange(0, secondRange.location)];
+                if (spaceRange.length == 0) spaceRange = NSMakeRange(0, 0);
+                shadowOffset.height = -[[shadowStyle substringWithRange:NSMakeRange(NSMaxRange(spaceRange), secondRange.location - NSMaxRange(spaceRange))] floatValue];
+                spaceRange = [shadowStyle rangeOfString:@" " options:NSBackwardsSearch range:NSMakeRange(0, thirdRange.location)];
+                if (spaceRange.length == 0) spaceRange = NSMakeRange(0, 0);
+                shadowBlurRadius = [[shadowStyle substringWithRange:NSMakeRange(NSMaxRange(spaceRange), thirdRange.location - NSMaxRange(spaceRange))] floatValue];
+                shadow = [[[NSShadow alloc] init] autorelease];
+                [shadow setShadowColor:shadowColor];
+                [shadow setShadowOffset:shadowOffset];
+                [shadow setShadowBlurRadius:shadowBlurRadius];
+            }
+        }
+    }
+    return shadow;
+}
+
+- (BOOL)_elementIsBlockLevel:(DOMElement *)element
+{
+    BOOL isBlockLevel = NO;
+    NSNumber *val = nil;
+    val = [_elementIsBlockLevel objectForKey:element];
+    if (val) {
+        isBlockLevel = [val boolValue];
+    } else {
+        NSString *displayVal = [self _stringForNode:element property:@"display"], *floatVal = [self _stringForNode:element property:@"float"];
+        if (floatVal && ([@"left" isEqualToString:floatVal] || [@"right" isEqualToString:floatVal])) {
+            isBlockLevel = YES;
+        } else if (displayVal) {
+            isBlockLevel = ([@"block" isEqualToString:displayVal] || [@"list-item" isEqualToString:displayVal] || [displayVal hasPrefix:@"table"]);
+        }
+        [_elementIsBlockLevel setObject:[NSNumber numberWithBool:isBlockLevel] forKey:element];
+    }
+    return isBlockLevel;
+}
+
+- (BOOL)_elementHasOwnBackgroundColor:(DOMElement *)element
+{
+    // In the text system, text blocks (table elements) and documents (body elements) have their own background colors, which should not be inherited
+    if ([self _elementIsBlockLevel:element]) {
+        Element* coreElement = core(element);
+        NSString *displayVal = [self _stringForNode:element property:@"display"];
+        if (coreElement->hasTagName(htmlTag) || coreElement->hasTagName(bodyTag) || [displayVal hasPrefix:@"table"])
+            return YES;
+    }
+    return NO;
+}
+    
+- (DOMElement *)_blockLevelElementForNode:(DOMNode *)node
+{
+    DOMElement *element = (DOMElement *)node;
+    while (element && [element nodeType] != DOM_ELEMENT_NODE)
+        element = (DOMElement *)[element parentNode];
+    if (element && ![self _elementIsBlockLevel:element])
+        element = [self _blockLevelElementForNode:[element parentNode]];
+    return element;
+}
+
+- (NSColor *)_computedColorForNode:(DOMNode *)node property:(NSString *)key
+{
+    NSColor *result = nil;
+    BOOL inherit = YES, haveResult = NO, isColor = [@"color" isEqualToString:key], isBackgroundColor = [@"background-color" isEqualToString:key];
+    DOMElement *element = (DOMElement *)node;    
+    if (element && [element nodeType] == DOM_ELEMENT_NODE) {
+        DOMCSSStyleDeclaration *computedStyle, *specifiedStyle;
+        inherit = NO;
+        if (!haveResult && (computedStyle = [self _computedStyleForElement:element])) {
+            DOMCSSPrimitiveValue *computedValue = (DOMCSSPrimitiveValue *)[computedStyle getPropertyCSSValue:key];
+            if (computedValue && [computedValue cssValueType] == DOM_CSS_PRIMITIVE_VALUE && [computedValue primitiveType] == DOM_CSS_RGBCOLOR) {
+                result = _colorForRGBColor([computedValue getRGBColorValue], isColor);
+                haveResult = YES;
+            }
+        }
+        if (!haveResult && (specifiedStyle = [self _specifiedStyleForElement:element])) {
+            DOMCSSPrimitiveValue *specifiedValue = (DOMCSSPrimitiveValue *)[specifiedStyle getPropertyCSSValue:key];
+            if (specifiedValue) {
+                unsigned short valueType = [specifiedValue cssValueType];
+                if (valueType == DOM_CSS_PRIMITIVE_VALUE && [specifiedValue primitiveType] == DOM_CSS_RGBCOLOR) {
+                    result = _colorForRGBColor([specifiedValue getRGBColorValue], isColor);
+                    haveResult = YES;
+                } else if (valueType == DOM_CSS_INHERIT) {
+                    inherit = YES;
+                }
+            }
+        }
+        if (!result) {
+            if ((isColor && !haveResult) || (isBackgroundColor && ![self _elementHasOwnBackgroundColor:element])) inherit = YES;
+        }
+    }
+    if (!result && inherit) {
+        DOMNode *parentNode = [node parentNode];
+        if (parentNode && !(isBackgroundColor && [parentNode nodeType] == DOM_ELEMENT_NODE && [self _elementHasOwnBackgroundColor:(DOMElement *)parentNode])) {
+            result = [self _colorForNode:parentNode property:key];
+        }
+    }
+    return result;
+}
+
+- (NSColor *)_colorForNode:(DOMNode *)node property:(NSString *)key
+{
+    NSColor *result = nil;
+    NSMutableDictionary *attributeDictionary = [_colorsForNodes objectForKey:node];
+    if (!attributeDictionary) {
+        attributeDictionary = [[NSMutableDictionary alloc] init];
+        [_colorsForNodes setObject:attributeDictionary forKey:node];
+        [attributeDictionary release];
+    }
+    result = [attributeDictionary objectForKey:key];
+    if (result) {
+        if ([[NSColor clearColor] isEqual:result]) result = nil;
+    } else {
+        result = [self _computedColorForNode:node property:key];
+        [attributeDictionary setObject:(result ? result : [NSColor clearColor]) forKey:key];
+    }
+    return result;
+}
+
+- (NSDictionary *)_computedAttributesForElement:(DOMElement *)element
+{
+    DOMElement *blockElement = [self _blockLevelElementForNode:element];
+    NSMutableDictionary *attrs = [NSMutableDictionary dictionary];
+    NSFontManager *fontManager = [NSFontManager sharedFontManager];
+    NSString *fontEffect = [self _stringForNode:element property:@"font-effect"], *textDecoration = [self _stringForNode:element property:@"text-decoration"], *verticalAlign = [self _stringForNode:element property:@"vertical-align"], *textShadow = [self _stringForNode:element property:@"text-shadow"];
+    CGFloat fontSize = 0, baselineOffset = 0, kerning = 0;
+    NSFont *font = nil, *actualFont = [element _font];
+    NSColor *foregroundColor = [self _colorForNode:element property:@"color"], *backgroundColor = [self _colorForNode:element property:@"background-color"];
+
+    if (![self _getFloat:&fontSize forNode:element property:@"font-size"] || fontSize <= 0.0) fontSize = _defaultFontSize;
+    fontSize *= _textSizeMultiplier;
+    if (fontSize < _minimumFontSize) fontSize = _minimumFontSize;
+    if (fabs(floor(2.0 * fontSize + 0.5) / 2.0 - fontSize) < 0.05) {
+        fontSize = (CGFloat)floor(2.0 * fontSize + 0.5) / 2;
+    } else if (fabs(floor(10.0 * fontSize + 0.5) / 10.0 - fontSize) < 0.005) {
+        fontSize = (CGFloat)floor(10.0 * fontSize + 0.5) / 10;
+    }
+    if (fontSize <= 0.0) fontSize = 12;
+    
+    if (actualFont) font = [fontManager convertFont:actualFont toSize:fontSize];
+    if (!font) {
+        NSString *fontName = [[self _stringForNode:element property:@"font-family"] capitalizedString], *fontStyle = [self _stringForNode:element property:@"font-style"], *fontWeight = [self _stringForNode:element property:@"font-weight"], *fontVariant = [self _stringForNode:element property:@"font-variant"];
+        
+        if (!fontName) fontName = _standardFontFamily;
+        if (fontName) font = _fontForNameAndSize(fontName, fontSize, _fontCache);
+        if (!font) font = [NSFont fontWithName:@"Times" size:fontSize];
+        if ([@"italic" isEqualToString:fontStyle] || [@"oblique" isEqualToString:fontStyle]) {
+            NSFont *originalFont = font;
+            font = [fontManager convertFont:font toHaveTrait:NSItalicFontMask];
+            if (!font) font = originalFont;
+        }
+        if ([fontWeight hasPrefix:@"bold"] || [fontWeight integerValue] >= 700) {
+            // ??? handle weight properly using NSFontManager
+            NSFont *originalFont = font;
+            font = [fontManager convertFont:font toHaveTrait:NSBoldFontMask];
+            if (!font) font = originalFont;
+        }
+        if ([@"small-caps" isEqualToString:fontVariant]) {
+            // ??? synthesize small-caps if [font isEqual:originalFont]
+            NSFont *originalFont = font;
+            font = [fontManager convertFont:font toHaveTrait:NSSmallCapsFontMask];
+            if (!font) font = originalFont;
+        }
+    }
+    if (font) [attrs setObject:font forKey:NSFontAttributeName];
+    if (foregroundColor) [attrs setObject:foregroundColor forKey:NSForegroundColorAttributeName];
+    if (backgroundColor && ![self _elementHasOwnBackgroundColor:element]) [attrs setObject:backgroundColor forKey:NSBackgroundColorAttributeName];
+    if (fontEffect) {
+        if ([fontEffect rangeOfString:@"outline"].location != NSNotFound) [attrs setObject:[NSNumber numberWithDouble:3.0] forKey:NSStrokeWidthAttributeName];
+        if ([fontEffect rangeOfString:@"emboss"].location != NSNotFound) [attrs setObject:[[[NSShadow alloc] init] autorelease] forKey:NSShadowAttributeName];
+    }
+    if (textDecoration && [textDecoration length] > 4) {
+        if ([textDecoration rangeOfString:@"underline"].location != NSNotFound) [attrs setObject:[NSNumber numberWithInteger:NSUnderlineStyleSingle] forKey:NSUnderlineStyleAttributeName];
+        if ([textDecoration rangeOfString:@"line-through"].location != NSNotFound) [attrs setObject:[NSNumber numberWithInteger:NSUnderlineStyleSingle] forKey:NSStrikethroughStyleAttributeName];
+    }
+    if (verticalAlign) {
+        if ([verticalAlign rangeOfString:@"super"].location != NSNotFound) [attrs setObject:[NSNumber numberWithInteger:1] forKey:NSSuperscriptAttributeName];
+        if ([verticalAlign rangeOfString:@"sub"].location != NSNotFound) [attrs setObject:[NSNumber numberWithInteger:-1] forKey:NSSuperscriptAttributeName];
+    }
+    if ([self _getFloat:&baselineOffset forNode:element property:@"vertical-align"]) [attrs setObject:[NSNumber numberWithDouble:baselineOffset] forKey:NSBaselineOffsetAttributeName];
+    if ([self _getFloat:&kerning forNode:element property:@"letter-spacing"]) [attrs setObject:[NSNumber numberWithDouble:kerning] forKey:NSKernAttributeName];
+    if (textShadow && [textShadow length] > 4) {
+        NSShadow *shadow = _shadowForShadowStyle(textShadow);
+        if (shadow) [attrs setObject:shadow forKey:NSShadowAttributeName];
+    }
+    if (element != blockElement && [_writingDirectionArray count] > 0) [attrs setObject:[NSArray arrayWithArray:_writingDirectionArray] forKey:NSWritingDirectionAttributeName];
+    
+    if (blockElement) {
+        NSMutableParagraphStyle *paragraphStyle = [[[self class] defaultParagraphStyle] mutableCopy];
+        NSString *blockTag = [blockElement tagName];
+        BOOL isParagraph = ([@"P" isEqualToString:blockTag] || [@"LI" isEqualToString:blockTag] || ([blockTag hasPrefix:@"H"] && 2 == [blockTag length]));
+        NSString *textAlign = [self _stringForNode:blockElement property:@"text-align"], *direction = [self _stringForNode:blockElement property:@"direction"];
+        CGFloat leftMargin = 0, rightMargin = 0, bottomMargin = 0, textIndent = 0, lineHeight = 0;
+        if (textAlign) {
+            // WebKit can return -khtml-left, -khtml-right, -khtml-center
+            if ([textAlign hasSuffix:@"left"]) [paragraphStyle setAlignment:NSLeftTextAlignment];
+            else if ([textAlign hasSuffix:@"right"]) [paragraphStyle setAlignment:NSRightTextAlignment];
+            else if ([textAlign hasSuffix:@"center"]) [paragraphStyle setAlignment:NSCenterTextAlignment];
+            else if ([textAlign hasSuffix:@"justify"]) [paragraphStyle setAlignment:NSJustifiedTextAlignment];
+        }
+        if (direction) {
+            if ([direction isEqualToString:@"ltr"]) [paragraphStyle setBaseWritingDirection:NSWritingDirectionLeftToRight];
+            else if ([direction isEqualToString:@"rtl"]) [paragraphStyle setBaseWritingDirection:NSWritingDirectionRightToLeft];
+        }
+        if ([blockTag hasPrefix:@"H"] && 2 == [blockTag length]) {
+            NSInteger headerLevel = [blockTag characterAtIndex:1] - '0';
+            if (1 <= headerLevel && headerLevel <= 6) [paragraphStyle setHeaderLevel:headerLevel];            
+        }
+        if (isParagraph) {
+            //if ([self _getFloat:&topMargin forNode:blockElement property:@"margin-top"] && topMargin > 0.0) [paragraphStyle setParagraphSpacingBefore:topMargin];
+            if ([self _getFloat:&leftMargin forNode:blockElement property:@"margin-left"] && leftMargin > 0.0) [paragraphStyle setHeadIndent:leftMargin];
+            if ([self _getFloat:&textIndent forNode:blockElement property:@"text-indent"]) [paragraphStyle setFirstLineHeadIndent:[paragraphStyle headIndent] + textIndent];
+            if ([self _getFloat:&rightMargin forNode:blockElement property:@"margin-right"] && rightMargin > 0.0) [paragraphStyle setTailIndent:-rightMargin];
+            if ([self _getFloat:&bottomMargin forNode:blockElement property:@"margin-bottom"] && bottomMargin > 0.0) [paragraphStyle setParagraphSpacing:bottomMargin];
+        }
+        if (_webViewTextSizeMultiplier > 0.0 && [self _getFloat:&lineHeight forNode:element property:@"line-height"] && lineHeight > 0.0) {
+            [paragraphStyle setMinimumLineHeight:lineHeight / _webViewTextSizeMultiplier];
+        }
+        if ([_textLists count] > 0) [paragraphStyle setTextLists:_textLists];
+        if ([_textBlocks count] > 0) [paragraphStyle setTextBlocks:_textBlocks];
+        [attrs setObject:paragraphStyle forKey:NSParagraphStyleAttributeName];
+        [paragraphStyle release];
+    }
+    return attrs;
+}
+
+- (NSDictionary *)_attributesForElement:(DOMElement *)element
+{
+    NSDictionary *result;
+    if (element) {
+        result = [_attributesForElements objectForKey:element];
+        if (!result) {
+            result = [self _computedAttributesForElement:element];
+            [_attributesForElements setObject:result forKey:element];
+        }
+    } else {
+        result = [NSDictionary dictionary];
+    }
+    return result;
+
+}
+
+- (void)_newParagraphForElement:(DOMElement *)element tag:(NSString *)tag allowEmpty:(BOOL)flag suppressTrailingSpace:(BOOL)suppress
+{
+    NSUInteger textLength = [_attrStr length];
+    unichar lastChar = (textLength > 0) ? [[_attrStr string] characterAtIndex:textLength - 1] : '\n';
+    NSRange rangeToReplace = (suppress && _flags.isSoft && (lastChar == ' ' || lastChar == NSLineSeparatorCharacter)) ? NSMakeRange(textLength - 1, 1) : NSMakeRange(textLength, 0);
+    BOOL needBreak = (flag || lastChar != '\n');
+    if (needBreak) {
+        NSString *string = (([@"BODY" isEqualToString:tag] || [@"HTML" isEqualToString:tag]) ? @"" : @"\n");
+        [_writingDirectionArray removeAllObjects];
+        [_attrStr replaceCharactersInRange:rangeToReplace withString:string];
+        if (rangeToReplace.location < _domRangeStartIndex) _domRangeStartIndex += [string length] - rangeToReplace.length;
+        rangeToReplace.length = [string length];
+        if (!_flags.isIndexing) {
+            NSDictionary *attrs = [self _attributesForElement:element];
+            if (!_flags.isTesting && rangeToReplace.length > 0) [_attrStr setAttributes:attrs range:rangeToReplace];
+        }
+        _flags.isSoft = YES;
+    }
+}
+
+- (void)_newLineForElement:(DOMElement *)element
+{
+    unichar c = NSLineSeparatorCharacter;
+    NSString *string = [[NSString alloc] initWithCharacters:&c length:1];
+    NSUInteger textLength = [_attrStr length];
+    NSRange rangeToReplace = NSMakeRange(textLength, 0);
+    [_attrStr replaceCharactersInRange:rangeToReplace withString:string];
+    rangeToReplace.length = [string length];
+    if (rangeToReplace.location < _domRangeStartIndex) _domRangeStartIndex += rangeToReplace.length;
+    if (!_flags.isIndexing) {
+        NSDictionary *attrs = [self _attributesForElement:element];
+        if (!_flags.isTesting && rangeToReplace.length > 0) [_attrStr setAttributes:attrs range:rangeToReplace];
+    }
+    [string release];
+    _flags.isSoft = YES;
+}
+
+- (void)_newTabForElement:(DOMElement *)element
+{
+    NSString *string = @"\t";
+    NSUInteger textLength = [_attrStr length];
+    unichar lastChar = (textLength > 0) ? [[_attrStr string] characterAtIndex:textLength - 1] : '\n';
+    NSRange rangeToReplace = (_flags.isSoft && lastChar == ' ') ? NSMakeRange(textLength - 1, 1) : NSMakeRange(textLength, 0);
+    [_attrStr replaceCharactersInRange:rangeToReplace withString:string];
+    rangeToReplace.length = [string length];
+    if (rangeToReplace.location < _domRangeStartIndex) _domRangeStartIndex += rangeToReplace.length;
+    if (!_flags.isIndexing) {
+        NSDictionary *attrs = [self _attributesForElement:element];
+        if (!_flags.isTesting && rangeToReplace.length > 0) [_attrStr setAttributes:attrs range:rangeToReplace];
+    }
+    [string release];
+    _flags.isSoft = YES;
+}
+
+static NSFileWrapper *fileWrapperForURL(DocumentLoader *dataSource, NSURL *URL)
+{
+    if ([URL isFileURL]) {
+        NSString *path = [[URL path] stringByResolvingSymlinksInPath];
+        return [[[NSFileWrapper alloc] initWithPath:path] autorelease];
+    }
+    
+    RefPtr<ArchiveResource> resource = dataSource->subresource(URL);
+    if (resource) {
+        NSFileWrapper *wrapper = [[[NSFileWrapper alloc] initRegularFileWithContents:[resource->data()->createNSData() autorelease]] autorelease];
+        NSString *filename = resource->response().suggestedFilename();
+        if (!filename || ![filename length]) {
+            NSURL *URL = resource->url();
+            filename = [URL _web_suggestedFilenameWithMIMEType:resource->mimeType()];
+        }
+        [wrapper setPreferredFilename:filename];
+        return wrapper;
+    }
+    
+    NSMutableURLRequest *request = [[NSMutableURLRequest alloc] initWithURL:URL];
+
+    NSCachedURLResponse *cachedResponse = [[NSURLCache sharedURLCache] cachedResponseForRequest:request];
+    [request release];
+    
+    if (cachedResponse) {
+        NSFileWrapper *wrapper = [[[NSFileWrapper alloc] initRegularFileWithContents:[cachedResponse data]] autorelease];
+        [wrapper setPreferredFilename:[[cachedResponse response] suggestedFilename]];
+        return wrapper;
+    }
+    
+    return nil;
+}
+    
+- (BOOL)_addAttachmentForElement:(DOMElement *)element URL:(NSURL *)url needsParagraph:(BOOL)needsParagraph usePlaceholder:(BOOL)flag
+{
+    BOOL retval = NO, notFound = NO;
+    NSFileWrapper *fileWrapper = nil;
+    static NSImage *missingImage = nil;
+    Frame* frame = core([element ownerDocument])->frame();
+    DocumentLoader *dataSource = frame->loader()->frameHasLoaded() ? frame->loader()->documentLoader() : 0;
+    BOOL ignoreOrientation = YES;
+
+    if (_flags.isIndexing) return NO;
+    if ([url isFileURL]) {
+        NSString *path = [[url path] stringByStandardizingPath];
+        if (path) fileWrapper = [[[NSFileWrapper alloc] initWithPath:path] autorelease];
+    }
+    if (!fileWrapper) {
+        RefPtr<ArchiveResource> resource = dataSource->subresource(url);
+        if (!resource) resource = dataSource->subresource(url);
+        if (flag && resource && [@"text/html" isEqual:resource->mimeType()]) notFound = YES;
+        if (resource && !notFound) {
+            fileWrapper = [[[NSFileWrapper alloc] initRegularFileWithContents:[resource->data()->createNSData() autorelease]] autorelease];
+            [fileWrapper setPreferredFilename:[url _web_suggestedFilenameWithMIMEType:resource->mimeType()]];
+        }
+    }
+    if (!fileWrapper && !notFound) {
+        fileWrapper = fileWrapperForURL(dataSource, url);
+        if (flag && fileWrapper && [[[[fileWrapper preferredFilename] pathExtension] lowercaseString] hasPrefix:@"htm"]) notFound = YES;
+        if (notFound) fileWrapper = nil;
+    }
+    if (!fileWrapper && !notFound) {
+        fileWrapper = fileWrapperForURL(_dataSource, url);
+        if (flag && fileWrapper && [[[[fileWrapper preferredFilename] pathExtension] lowercaseString] hasPrefix:@"htm"]) notFound = YES;
+        if (notFound) fileWrapper = nil;
+    }
+    if (fileWrapper || flag) {
+        NSUInteger textLength = [_attrStr length];
+        NSTextAttachment *attachment = [[NSTextAttachment alloc] initWithFileWrapper:fileWrapper];
+        NSTextAttachmentCell *cell;
+        NSString *string = [[NSString alloc] initWithFormat:(needsParagraph ? @"%C\n" : @"%C"), NSAttachmentCharacter];
+        NSRange rangeToReplace = NSMakeRange(textLength, 0);
+        NSDictionary *attrs;
+        if (fileWrapper) {
+            if (ignoreOrientation) [attachment setIgnoresOrientation:YES];
+        } else {
+            cell = [[NSTextAttachmentCell alloc] initImageCell:missingImage];
+            [attachment setAttachmentCell:cell];
+            [cell release];
+        }
+        [_attrStr replaceCharactersInRange:rangeToReplace withString:string];
+        rangeToReplace.length = [string length];
+        if (rangeToReplace.location < _domRangeStartIndex) _domRangeStartIndex += rangeToReplace.length;
+        attrs = [self _attributesForElement:element];
+        if (!_flags.isTesting && rangeToReplace.length > 0) {
+            [_attrStr setAttributes:attrs range:rangeToReplace];
+            rangeToReplace.length = 1;
+            [_attrStr addAttribute:NSAttachmentAttributeName value:attachment range:rangeToReplace];
+        }
+        [string release];
+        [attachment release];
+        _flags.isSoft = NO;
+        retval = YES;
+    }
+    return retval;
+}
+
+- (void)_addQuoteForElement:(DOMElement *)element opening:(BOOL)opening level:(NSInteger)level
+{
+    unichar c = ((level % 2) == 0) ? (opening ? 0x201c : 0x201d) : (opening ? 0x2018 : 0x2019);
+    NSString *string = [[NSString alloc] initWithCharacters:&c length:1];
+    NSUInteger textLength = [_attrStr length];
+    NSRange rangeToReplace = NSMakeRange(textLength, 0);
+    [_attrStr replaceCharactersInRange:rangeToReplace withString:string];
+    rangeToReplace.length = [string length];
+    if (rangeToReplace.location < _domRangeStartIndex) _domRangeStartIndex += rangeToReplace.length;
+    if (!_flags.isIndexing) {
+        NSDictionary *attrs = [self _attributesForElement:element];
+        if (!_flags.isTesting && rangeToReplace.length > 0) [_attrStr setAttributes:attrs range:rangeToReplace];
+    }
+    [string release];
+    _flags.isSoft = NO;
+}
+
+- (void)_addValue:(NSString *)value forElement:(DOMElement *)element
+{
+    NSUInteger textLength = [_attrStr length], valueLength = [value length];
+    NSRange rangeToReplace = NSMakeRange(textLength, 0);
+    if (valueLength > 0) {
+        [_attrStr replaceCharactersInRange:rangeToReplace withString:value];
+        rangeToReplace.length = valueLength;
+        if (rangeToReplace.location < _domRangeStartIndex) _domRangeStartIndex += rangeToReplace.length;
+        if (!_flags.isIndexing) {
+            NSDictionary *attrs = [self _attributesForElement:element];
+            if (!_flags.isTesting && rangeToReplace.length > 0) [_attrStr setAttributes:attrs range:rangeToReplace];
+        }
+        _flags.isSoft = NO;
+    }
+}
+
+- (void)_fillInBlock:(NSTextBlock *)block forElement:(DOMElement *)element backgroundColor:(NSColor *)backgroundColor extraMargin:(CGFloat)extraMargin extraPadding:(CGFloat)extraPadding isTable:(BOOL)isTable
+{
+    CGFloat val = 0;
+    NSColor *color = nil;
+    BOOL isTableCellElement = [element isKindOfClass:[DOMHTMLTableCellElement class]];
+    NSString *width = isTableCellElement ? [(DOMHTMLTableCellElement *)element width] : [element getAttribute:@"width"];
+
+    if ((width && [width length] > 0) || !isTable) {
+        if ([self _getFloat:&val forNode:element property:@"width"]) [block setValue:val type:NSTextBlockAbsoluteValueType forDimension:NSTextBlockWidth];
+    }
+    
+    if ([self _getFloat:&val forNode:element property:@"min-width"]) [block setValue:val type:NSTextBlockAbsoluteValueType forDimension:NSTextBlockMinimumWidth];
+    if ([self _getFloat:&val forNode:element property:@"max-width"]) [block setValue:val type:NSTextBlockAbsoluteValueType forDimension:NSTextBlockMaximumWidth];
+    if ([self _getFloat:&val forNode:element property:@"min-height"]) [block setValue:val type:NSTextBlockAbsoluteValueType forDimension:NSTextBlockMinimumHeight];
+    if ([self _getFloat:&val forNode:element property:@"max-height"]) [block setValue:val type:NSTextBlockAbsoluteValueType forDimension:NSTextBlockMaximumHeight];
+
+    if ([self _getFloat:&val forNode:element property:@"padding-left"]) [block setWidth:val + extraPadding type:NSTextBlockAbsoluteValueType forLayer:NSTextBlockPadding edge:NSMinXEdge]; else [block setWidth:extraPadding type:NSTextBlockAbsoluteValueType forLayer:NSTextBlockPadding edge:NSMinXEdge];
+    if ([self _getFloat:&val forNode:element property:@"padding-top"]) [block setWidth:val + extraPadding type:NSTextBlockAbsoluteValueType forLayer:NSTextBlockPadding edge:NSMinYEdge]; else [block setWidth:extraPadding type:NSTextBlockAbsoluteValueType forLayer:NSTextBlockPadding edge:NSMinYEdge];
+    if ([self _getFloat:&val forNode:element property:@"padding-right"]) [block setWidth:val + extraPadding type:NSTextBlockAbsoluteValueType forLayer:NSTextBlockPadding edge:NSMaxXEdge]; else [block setWidth:extraPadding type:NSTextBlockAbsoluteValueType forLayer:NSTextBlockPadding edge:NSMaxXEdge];
+    if ([self _getFloat:&val forNode:element property:@"padding-bottom"]) [block setWidth:val + extraPadding type:NSTextBlockAbsoluteValueType forLayer:NSTextBlockPadding edge:NSMaxYEdge]; else [block setWidth:extraPadding type:NSTextBlockAbsoluteValueType forLayer:NSTextBlockPadding edge:NSMaxYEdge];
+    
+    if ([self _getFloat:&val forNode:element property:@"border-left-width"]) [block setWidth:val type:NSTextBlockAbsoluteValueType forLayer:NSTextBlockBorder edge:NSMinXEdge];
+    if ([self _getFloat:&val forNode:element property:@"border-top-width"]) [block setWidth:val type:NSTextBlockAbsoluteValueType forLayer:NSTextBlockBorder edge:NSMinYEdge];
+    if ([self _getFloat:&val forNode:element property:@"border-right-width"]) [block setWidth:val type:NSTextBlockAbsoluteValueType forLayer:NSTextBlockBorder edge:NSMaxXEdge];
+    if ([self _getFloat:&val forNode:element property:@"border-bottom-width"]) [block setWidth:val type:NSTextBlockAbsoluteValueType forLayer:NSTextBlockBorder edge:NSMaxYEdge];
+
+    if ([self _getFloat:&val forNode:element property:@"margin-left"]) [block setWidth:val + extraMargin type:NSTextBlockAbsoluteValueType forLayer:NSTextBlockMargin edge:NSMinXEdge]; else [block setWidth:extraMargin type:NSTextBlockAbsoluteValueType forLayer:NSTextBlockMargin edge:NSMinXEdge];
+    if ([self _getFloat:&val forNode:element property:@"margin-top"]) [block setWidth:val + extraMargin type:NSTextBlockAbsoluteValueType forLayer:NSTextBlockMargin edge:NSMinYEdge]; else [block setWidth:extraMargin type:NSTextBlockAbsoluteValueType forLayer:NSTextBlockMargin edge:NSMinYEdge];
+    if ([self _getFloat:&val forNode:element property:@"margin-right"]) [block setWidth:val + extraMargin type:NSTextBlockAbsoluteValueType forLayer:NSTextBlockMargin edge:NSMaxXEdge]; else [block setWidth:extraMargin type:NSTextBlockAbsoluteValueType forLayer:NSTextBlockMargin edge:NSMaxXEdge];
+    if ([self _getFloat:&val forNode:element property:@"margin-bottom"]) [block setWidth:val + extraMargin type:NSTextBlockAbsoluteValueType forLayer:NSTextBlockMargin edge:NSMaxYEdge]; else [block setWidth:extraMargin type:NSTextBlockAbsoluteValueType forLayer:NSTextBlockMargin edge:NSMaxYEdge];
+
+    if ((color = [self _colorForNode:element property:@"background-color"])) [block setBackgroundColor:color];
+    if (!color && backgroundColor) [block setBackgroundColor:backgroundColor];
+    if ((color = [self _colorForNode:element property:@"border-left-color"])) [block setBorderColor:color forEdge:NSMinXEdge];
+    if ((color = [self _colorForNode:element property:@"border-top-color"])) [block setBorderColor:color forEdge:NSMinYEdge];
+    if ((color = [self _colorForNode:element property:@"border-right-color"])) [block setBorderColor:color forEdge:NSMaxXEdge];
+    if ((color = [self _colorForNode:element property:@"border-bottom-color"])) [block setBorderColor:color forEdge:NSMaxYEdge];
+}
+
+static inline BOOL read2DigitNumber(const char **pp, int8_t *outval)
+{
+    BOOL result = NO;
+    char c1 = *(*pp)++, c2;
+    if (isASCIIDigit(c1)) {
+        c2 = *(*pp)++;
+        if (isASCIIDigit(c2)) {
+            *outval = 10 * (c1 - '0') + (c2 - '0');
+            result = YES;
+        }
+    }
+    return result;
+}
+
+static inline NSDate *_dateForString(NSString *string)
+{
+    CFGregorianDate date;
+    const char *p = [string UTF8String];
+    int8_t secval = 0;
+    BOOL wellFormed = YES;
+
+    date.year = 0;
+    while (*p && isASCIIDigit(*p)) date.year = 10 * date.year + *p++ - '0';
+    if (*p++ != '-') wellFormed = NO;
+    if (!wellFormed || !read2DigitNumber(&p, &date.month) || *p++ != '-') wellFormed = NO;
+    if (!wellFormed || !read2DigitNumber(&p, &date.day) || *p++ != 'T') wellFormed = NO;
+    if (!wellFormed || !read2DigitNumber(&p, &date.hour) || *p++ != ':') wellFormed = NO;
+    if (!wellFormed || !read2DigitNumber(&p, &date.minute) || *p++ != ':') wellFormed = NO;
+    if (!wellFormed || !read2DigitNumber(&p, &secval) || *p++ != 'Z') wellFormed = NO;
+    if (wellFormed) date.second = secval;
+    return wellFormed ? [(NSDate *)CFDateCreate(NULL, CFGregorianDateGetAbsoluteTime(date, NULL)) autorelease] : nil;
+}
+
+static NSInteger _colCompare(id block1, id block2, void *)
+{
+    NSInteger col1 = [(NSTextTableBlock *)block1 startingColumn], col2 = [(NSTextTableBlock *)block2 startingColumn];
+    return ((col1 < col2) ? NSOrderedAscending : ((col1 == col2) ? NSOrderedSame : NSOrderedDescending));
+}
+
+- (BOOL)_enterElement:(DOMElement *)element tag:(NSString *)tag display:(NSString *)displayVal
+{
+    if (!displayVal || !([@"none" isEqualToString:displayVal] || [@"table-column" isEqualToString:displayVal] || [@"table-column-group" isEqualToString:displayVal])) {
+        if ([self _elementIsBlockLevel:element] && ![@"BR" isEqualToString:tag] && !([@"table-cell" isEqualToString:displayVal] && [_textTables count] == 0) 
+            && !([_textLists count] > 0 && [@"block" isEqualToString:displayVal] && ![@"LI" isEqualToString:tag] && ![@"UL" isEqualToString:tag] && ![@"OL" isEqualToString:tag]))
+            [self _newParagraphForElement:element tag:tag allowEmpty:NO suppressTrailingSpace:YES];
+        return YES;
+    }
+    return NO;
+}
+
+- (void)_addTableForElement:(DOMElement *)tableElement
+{
+    NSTextTable *table = [[NSTextTable alloc] init];
+    CGFloat cellSpacingVal = 1, cellPaddingVal = 1;
+    [table setNumberOfColumns:1];
+    [table setLayoutAlgorithm:NSTextTableAutomaticLayoutAlgorithm];
+    [table setCollapsesBorders:NO];
+    [table setHidesEmptyCells:NO];
+    if (tableElement) {
+        NSString *borderCollapse = [self _stringForNode:tableElement property:@"border-collapse"], *emptyCells = [self _stringForNode:tableElement property:@"empty-cells"], *tableLayout = [self _stringForNode:tableElement property:@"table-layout"];
+        if ([tableElement respondsToSelector:@selector(cellSpacing)]) {
+            NSString *cellSpacing = [(DOMHTMLTableElement *)tableElement cellSpacing];
+            if (cellSpacing && [cellSpacing length] > 0 && ![cellSpacing hasSuffix:@"%"]) cellSpacingVal = [cellSpacing floatValue];
+        }
+        if ([tableElement respondsToSelector:@selector(cellPadding)]) {
+            NSString *cellPadding = [(DOMHTMLTableElement *)tableElement cellPadding];
+            if (cellPadding && [cellPadding length] > 0 && ![cellPadding hasSuffix:@"%"]) cellPaddingVal = [cellPadding floatValue];
+        }
+        [self _fillInBlock:table forElement:tableElement backgroundColor:nil extraMargin:0 extraPadding:0 isTable:YES];
+        if ([@"collapse" isEqualToString:borderCollapse]) {
+            [table setCollapsesBorders:YES];
+            cellSpacingVal = 0;
+        }
+        if ([@"hide" isEqualToString:emptyCells]) [table setHidesEmptyCells:YES];
+        if ([@"fixed" isEqualToString:tableLayout]) [table setLayoutAlgorithm:NSTextTableFixedLayoutAlgorithm];
+    }
+    [_textTables addObject:table];
+    [_textTableSpacings addObject:[NSNumber numberWithDouble:cellSpacingVal]];
+    [_textTablePaddings addObject:[NSNumber numberWithDouble:cellPaddingVal]];
+    [_textTableRows addObject:[NSNumber numberWithInteger:0]];
+    [_textTableRowArrays addObject:[NSMutableArray array]];
+    [table release];
+}
+
+- (void)_addTableCellForElement:(DOMElement *)tableCellElement
+{
+    NSTextTable *table = [_textTables lastObject];
+    NSInteger rowNumber = [[_textTableRows lastObject] integerValue], columnNumber = 0, rowSpan = 1, colSpan = 1;
+    NSMutableArray *rowArray = [_textTableRowArrays lastObject];
+    NSUInteger i, count = [rowArray count];
+    NSColor *color = ([_textTableRowBackgroundColors count] > 0) ? [_textTableRowBackgroundColors lastObject] : nil;
+    NSTextTableBlock *block, *previousBlock;
+    CGFloat cellSpacingVal = [[_textTableSpacings lastObject] floatValue];
+    if ([color isEqual:[NSColor clearColor]]) color = nil;
+    for (i = 0; i < count; i++) {
+        previousBlock = [rowArray objectAtIndex:i];
+        if (columnNumber >= [previousBlock startingColumn] && columnNumber < [previousBlock startingColumn] + [previousBlock columnSpan]) columnNumber = [previousBlock startingColumn] + [previousBlock columnSpan];
+    }
+    if (tableCellElement) {
+        if ([tableCellElement respondsToSelector:@selector(rowSpan)]) {
+            rowSpan = [(DOMHTMLTableCellElement *)tableCellElement rowSpan];
+            if (rowSpan < 1) rowSpan = 1;
+        }
+        if ([tableCellElement respondsToSelector:@selector(colSpan)]) {
+            colSpan = [(DOMHTMLTableCellElement *)tableCellElement colSpan];
+            if (colSpan < 1) colSpan = 1;
+        }
+    }
+    block = [[NSTextTableBlock alloc] initWithTable:table startingRow:rowNumber rowSpan:rowSpan startingColumn:columnNumber columnSpan:colSpan];
+    if (tableCellElement) {
+        NSString *verticalAlign = [self _stringForNode:tableCellElement property:@"vertical-align"];
+        [self _fillInBlock:block forElement:tableCellElement backgroundColor:color extraMargin:cellSpacingVal / 2 extraPadding:0 isTable:NO];
+        if ([@"middle" isEqualToString:verticalAlign]) [block setVerticalAlignment:NSTextBlockMiddleAlignment];
+        else if ([@"bottom" isEqualToString:verticalAlign]) [block setVerticalAlignment:NSTextBlockBottomAlignment];
+        else if ([@"baseline" isEqualToString:verticalAlign]) [block setVerticalAlignment:NSTextBlockBaselineAlignment];
+        else if ([@"top" isEqualToString:verticalAlign]) [block setVerticalAlignment:NSTextBlockTopAlignment];
+    }
+    [_textBlocks addObject:block];
+    [rowArray addObject:block];
+    [rowArray sortUsingFunction:_colCompare context:NULL];
+    [block release];
+}
+
+- (BOOL)_processElement:(DOMElement *)element tag:(NSString *)tag display:(NSString *)displayVal depth:(NSInteger)depth
+{
+    BOOL retval = YES, isBlockLevel = [self _elementIsBlockLevel:element];
+    if (isBlockLevel) {
+        [_writingDirectionArray removeAllObjects];
+    } else {
+        NSString *bidi = [self _stringForNode:element property:@"unicode-bidi"];
+        if (bidi && [bidi isEqualToString:@"embed"]) {
+            NSUInteger val = NSTextWritingDirectionEmbedding;
+            NSString *direction = [self _stringForNode:element property:@"direction"];
+            if ([direction isEqualToString:@"rtl"]) val |= NSWritingDirectionRightToLeft;
+            [_writingDirectionArray addObject:[NSNumber numberWithUnsignedInteger:val]];
+        } else if (bidi && [bidi isEqualToString:@"bidi-override"]) {
+            NSUInteger val = NSTextWritingDirectionOverride;
+            NSString *direction = [self _stringForNode:element property:@"direction"];
+            if ([direction isEqualToString:@"rtl"]) val |= NSWritingDirectionRightToLeft;
+            [_writingDirectionArray addObject:[NSNumber numberWithUnsignedInteger:val]];
+        }
+    }
+    if ([@"table" isEqualToString:displayVal] || ([_textTables count] == 0 && [@"table-row-group" isEqualToString:displayVal])) {
+        DOMElement *tableElement = element;
+        if ([@"table-row-group" isEqualToString:displayVal]) {
+            // If we are starting in medias res, the first thing we see may be the tbody, so go up to the table
+            tableElement = [self _blockLevelElementForNode:[element parentNode]];
+            if (![@"table" isEqualToString:[self _stringForNode:tableElement property:@"display"]]) tableElement = element;
+        }
+        while ([_textTables count] > [_textBlocks count]) {
+            [self _addTableCellForElement:nil];
+        }
+        [self _addTableForElement:tableElement];
+    } else if ([@"table-footer-group" isEqualToString:displayVal] && [_textTables count] > 0) {
+        [_textTableFooters setObject:element forKey:[NSValue valueWithNonretainedObject:[_textTables lastObject]]];
+        retval = NO;
+    } else if ([@"table-row" isEqualToString:displayVal] && [_textTables count] > 0) {
+        NSColor *color = [self _colorForNode:element property:@"background-color"];
+        if (!color) color = [NSColor clearColor];
+        [_textTableRowBackgroundColors addObject:color];
+    } else if ([@"table-cell" isEqualToString:displayVal]) {
+        while ([_textTables count] < [_textBlocks count] + 1) {
+            [self _addTableForElement:nil];
+        }
+        [self _addTableCellForElement:element];
+    } else if ([@"IMG" isEqualToString:tag]) {
+        NSString *urlString = [element getAttribute:@"src"];
+        if (urlString && [urlString length] > 0) {
+            NSURL *url = core([element ownerDocument])->completeURL(stripLeadingAndTrailingHTMLSpaces(urlString));
+            if (!url) url = [NSURL _web_URLWithString:[urlString stringByTrimmingCharactersInSet:[NSCharacterSet whitespaceAndNewlineCharacterSet]] relativeToURL:_baseURL];
+            if (url) [self _addAttachmentForElement:element URL:url needsParagraph:isBlockLevel usePlaceholder:YES];
+        }
+        retval = NO;
+    } else if ([@"OBJECT" isEqualToString:tag]) {
+        NSString *baseString = [element getAttribute:@"codebase"], *urlString = [element getAttribute:@"data"], *declareString = [element getAttribute:@"declare"];
+        if (urlString && [urlString length] > 0 && ![@"true" isEqualToString:declareString]) {
+            NSURL *baseURL = nil, *url = nil;
+            if (baseString && [baseString length] > 0) {
+                baseURL = core([element ownerDocument])->completeURL(stripLeadingAndTrailingHTMLSpaces(baseString));
+                if (!baseURL) baseURL = [NSURL _web_URLWithString:[baseString stringByTrimmingCharactersInSet:[NSCharacterSet whitespaceAndNewlineCharacterSet]] relativeToURL:_baseURL];
+            }
+            if (baseURL) url = [NSURL _web_URLWithString:[urlString stringByTrimmingCharactersInSet:[NSCharacterSet whitespaceAndNewlineCharacterSet]] relativeToURL:baseURL];
+            if (!url) url =core([element ownerDocument])->completeURL(stripLeadingAndTrailingHTMLSpaces(urlString));
+            if (!url) url = [NSURL _web_URLWithString:[urlString stringByTrimmingCharactersInSet:[NSCharacterSet whitespaceAndNewlineCharacterSet]] relativeToURL:_baseURL];
+            if (url) retval = ![self _addAttachmentForElement:element URL:url needsParagraph:isBlockLevel usePlaceholder:NO];
+        }
+    } else if ([@"FRAME" isEqualToString:tag]) {
+        if ([element respondsToSelector:@selector(contentDocument)]) {
+            DOMDocument *contentDocument = [(DOMHTMLFrameElement *)element contentDocument];
+            if (contentDocument) [self _traverseNode:contentDocument depth:depth + 1 embedded:YES];
+        }
+        retval = NO;
+    } else if ([@"IFRAME" isEqualToString:tag]) {
+        if ([element respondsToSelector:@selector(contentDocument)]) {
+            DOMDocument *contentDocument = [(DOMHTMLIFrameElement *)element contentDocument];
+            if (contentDocument) {
+                [self _traverseNode:contentDocument depth:depth + 1 embedded:YES];
+                retval = NO;
+            }
+        }
+    } else if ([@"BR" isEqualToString:tag]) {
+        DOMElement *blockElement = [self _blockLevelElementForNode:[element parentNode]];
+        NSString *breakClass = [element getAttribute:@"class"], *blockTag = [blockElement tagName];
+        BOOL isExtraBreak = [@"Apple-interchange-newline" isEqualToString:breakClass], blockElementIsParagraph = ([@"P" isEqualToString:blockTag] || [@"LI" isEqualToString:blockTag] || ([blockTag hasPrefix:@"H"] && 2 == [blockTag length]));
+        if (isExtraBreak) {
+            _flags.hasTrailingNewline = YES;
+        } else {
+            if (blockElement && blockElementIsParagraph) {
+                [self _newLineForElement:element];
+            } else {
+                [self _newParagraphForElement:element tag:tag allowEmpty:YES suppressTrailingSpace:NO];
+            }
+        }
+    } else if ([@"UL" isEqualToString:tag]) {
+        NSTextList *list;
+        NSString *listStyleType = [self _stringForNode:element property:@"list-style-type"];
+        if (!listStyleType || [listStyleType length] == 0) listStyleType = @"disc";
+        list = [[NSTextList alloc] initWithMarkerFormat:[NSString stringWithFormat:@"{%@}", listStyleType] options:0];
+        [_textLists addObject:list];
+        [list release];
+    } else if ([@"OL" isEqualToString:tag]) {
+        NSTextList *list;
+        NSString *listStyleType = [self _stringForNode:element property:@"list-style-type"];
+        if (!listStyleType || [listStyleType length] == 0) listStyleType = @"decimal";
+        list = [[NSTextList alloc] initWithMarkerFormat:[NSString stringWithFormat:@"{%@}.", listStyleType] options:0];
+        if ([element respondsToSelector:@selector(start)]) {
+            NSInteger startingItemNumber = [(DOMHTMLOListElement *)element start];
+            [list setStartingItemNumber:startingItemNumber];
+        }
+        [_textLists addObject:list];
+        [list release];
+    } else if ([@"Q" isEqualToString:tag]) {
+        [self _addQuoteForElement:element opening:YES level:_quoteLevel++];
+    } else if ([@"INPUT" isEqualToString:tag]) {
+        if ([element respondsToSelector:@selector(type)] && [element respondsToSelector:@selector(value)] && [@"text" compare:[(DOMHTMLInputElement *)element type] options:NSCaseInsensitiveSearch] == NSOrderedSame) {
+            NSString *value = [(DOMHTMLInputElement *)element value];
+            if (value && [value length] > 0) [self _addValue:value forElement:element];
+        }
+    } else if ([@"TEXTAREA" isEqualToString:tag]) {
+        if ([element respondsToSelector:@selector(value)]) {
+            NSString *value = [(DOMHTMLTextAreaElement *)element value];
+            if (value && [value length] > 0) [self _addValue:value forElement:element];
+        }
+        retval = NO;
+    }
+    return retval;
+}
+
+- (void)_addMarkersToList:(NSTextList *)list range:(NSRange)range
+{
+    NSInteger itemNum = [list startingItemNumber];
+    NSString *string = [_attrStr string], *stringToInsert;
+    NSDictionary *attrsToInsert = nil;
+    NSFont *font;
+    NSParagraphStyle *paragraphStyle;
+    NSMutableParagraphStyle *newStyle;
+    NSTextTab *tab = nil, *tabToRemove;
+    NSRange paragraphRange, styleRange;
+    NSUInteger textLength = [_attrStr length], listIndex, idx, insertLength, i, count;
+    NSArray *textLists;
+    CGFloat markerLocation, listLocation, pointSize;
+    
+    if (range.length == 0 || range.location >= textLength) return;
+    if (NSMaxRange(range) > textLength) range.length = textLength - range.location;
+    paragraphStyle = [_attrStr attribute:NSParagraphStyleAttributeName atIndex:range.location effectiveRange:NULL];
+    if (paragraphStyle) {
+        textLists = [paragraphStyle textLists];
+        listIndex = [textLists indexOfObject:list];
+        if (textLists && listIndex != NSNotFound) {
+            for (idx = range.location; idx < NSMaxRange(range);) {
+                paragraphRange = [string paragraphRangeForRange:NSMakeRange(idx, 0)];
+                paragraphStyle = [_attrStr attribute:NSParagraphStyleAttributeName atIndex:idx effectiveRange:&styleRange];
+                font = [_attrStr attribute:NSFontAttributeName atIndex:idx effectiveRange:NULL];
+                pointSize = font ? [font pointSize] : 12;
+                if ([[paragraphStyle textLists] count] == listIndex + 1) {
+                    stringToInsert = [NSString stringWithFormat:@"\t%@\t", [list markerForItemNumber:itemNum++]];
+                    insertLength = [stringToInsert length];
+                    if (!_flags.isIndexing && !_flags.isTesting) attrsToInsert = [NSTextList _standardMarkerAttributesForAttributes:[_attrStr attributesAtIndex:paragraphRange.location effectiveRange:NULL]];
+                    [_attrStr replaceCharactersInRange:NSMakeRange(paragraphRange.location, 0) withString:stringToInsert];
+                    if (!_flags.isIndexing && !_flags.isTesting) [_attrStr setAttributes:attrsToInsert range:NSMakeRange(paragraphRange.location, insertLength)];
+                    range.length += insertLength;
+                    paragraphRange.length += insertLength;
+                    if (paragraphRange.location < _domRangeStartIndex) _domRangeStartIndex += insertLength;
+                    
+                    newStyle = [paragraphStyle mutableCopy];
+                    listLocation = (listIndex + 1) * 36;
+                    markerLocation = listLocation - 25;
+                    [newStyle setFirstLineHeadIndent:0];
+                    [newStyle setHeadIndent:listLocation];
+                    while ((count = [[newStyle tabStops] count]) > 0) {
+                        for (i = 0, tabToRemove = nil; !tabToRemove && i < count; i++) {
+                            tab = [[newStyle tabStops] objectAtIndex:i];
+                            if ([tab location] <= listLocation) tabToRemove = tab;
+                        }
+                        if (tabToRemove) [newStyle removeTabStop:tab]; else break;
+                    }
+                    tab = [[NSTextTab alloc] initWithType:NSLeftTabStopType location:markerLocation];
+                    [newStyle addTabStop:tab];
+                    [tab release];
+                    tab = [[NSTextTab alloc] initWithTextAlignment:NSNaturalTextAlignment location:listLocation options:nil];
+                    [newStyle addTabStop:tab];
+                    [tab release];
+                    if (!_flags.isIndexing && !_flags.isTesting) [_attrStr addAttribute:NSParagraphStyleAttributeName value:newStyle range:paragraphRange];
+                    [newStyle release];
+                    
+                    idx = NSMaxRange(paragraphRange);
+                } else {
+                    // skip any deeper-nested lists
+                    idx = NSMaxRange(styleRange);
+                }
+            }
+        }
+    }
+}
+
+- (void)_exitElement:(DOMElement *)element tag:(NSString *)tag display:(NSString *)displayVal depth:(NSInteger)depth startIndex:(NSUInteger)startIndex
+{
+    NSRange range = NSMakeRange(startIndex, [_attrStr length] - startIndex);
+    if (range.length > 0 && [@"A" isEqualToString:tag]) {
+        NSString *urlString = [element getAttribute:@"href"], *strippedString = [urlString stringByTrimmingCharactersInSet:[NSCharacterSet whitespaceAndNewlineCharacterSet]];
+        if (urlString && [urlString length] > 0 && strippedString && [strippedString length] > 0 && ![strippedString hasPrefix:@"#"]) {
+            NSURL *url = core([element ownerDocument])->completeURL(stripLeadingAndTrailingHTMLSpaces(urlString));
+            if (!url) url = core([element ownerDocument])->completeURL(stripLeadingAndTrailingHTMLSpaces(strippedString));
+            if (!url) url = [NSURL _web_URLWithString:strippedString relativeToURL:_baseURL];
+            if (!_flags.isIndexing && !_flags.isTesting) [_attrStr addAttribute:NSLinkAttributeName value:url ? (id)url : (id)urlString range:range];
+        }
+    }
+    if (!_flags.reachedEnd && [self _elementIsBlockLevel:element]) {
+        [_writingDirectionArray removeAllObjects];
+        if ([@"table-cell" isEqualToString:displayVal] && [_textBlocks count] == 0) {
+            [self _newTabForElement:element];
+        } else if ([_textLists count] > 0 && [@"block" isEqualToString:displayVal] && ![@"LI" isEqualToString:tag] && ![@"UL" isEqualToString:tag] && ![@"OL" isEqualToString:tag]) {
+            [self _newLineForElement:element];
+        } else {
+            [self _newParagraphForElement:element tag:tag allowEmpty:(range.length == 0) suppressTrailingSpace:YES];
+        }
+    } else if ([_writingDirectionArray count] > 0) {
+        NSString *bidi = [self _stringForNode:element property:@"unicode-bidi"];
+        if (bidi && ([bidi isEqualToString:@"embed"] || [bidi isEqualToString:@"bidi-override"])) {
+            [_writingDirectionArray removeLastObject];
+        }
+    }
+    range = NSMakeRange(startIndex, [_attrStr length] - startIndex);
+    if ([@"table" isEqualToString:displayVal] && [_textTables count] > 0) {
+        NSValue *key = [NSValue valueWithNonretainedObject:[_textTables lastObject]];
+        DOMNode *footer = [_textTableFooters objectForKey:key];
+        while ([_textTables count] < [_textBlocks count] + 1) {
+            [_textBlocks removeLastObject];
+        }
+        if (footer) {
+            [self _traverseFooterNode:footer depth:depth + 1];
+            [_textTableFooters removeObjectForKey:key];
+        }
+        [_textTables removeLastObject];
+        [_textTableSpacings removeLastObject];
+        [_textTablePaddings removeLastObject];
+        [_textTableRows removeLastObject];
+        [_textTableRowArrays removeLastObject];
+    } else if ([@"table-row" isEqualToString:displayVal] && [_textTables count] > 0) {
+        NSTextTable *table = [_textTables lastObject];
+        NSTextTableBlock *block;
+        NSMutableArray *rowArray = [_textTableRowArrays lastObject], *previousRowArray;
+        NSUInteger i, count;
+        NSInteger numberOfColumns = [table numberOfColumns];
+        NSInteger openColumn;
+        NSInteger rowNumber = [[_textTableRows lastObject] integerValue];
+        do {
+            rowNumber++;
+            previousRowArray = rowArray;
+            rowArray = [NSMutableArray array];
+            count = [previousRowArray count];
+            for (i = 0; i < count; i++) {
+                block = [previousRowArray objectAtIndex:i];
+                if ([block startingColumn] + [block columnSpan] > numberOfColumns) numberOfColumns = [block startingColumn] + [block columnSpan];
+                if ([block startingRow] + [block rowSpan] > rowNumber) [rowArray addObject:block];
+            }
+            count = [rowArray count];
+            openColumn = 0;
+            for (i = 0; i < count; i++) {
+                block = [rowArray objectAtIndex:i];
+                if (openColumn >= [block startingColumn] && openColumn < [block startingColumn] + [block columnSpan]) openColumn = [block startingColumn] + [block columnSpan];
+            }
+        } while (openColumn >= numberOfColumns);
+        if ((NSUInteger)numberOfColumns > [table numberOfColumns]) [table setNumberOfColumns:numberOfColumns];
+        [_textTableRows removeLastObject];
+        [_textTableRows addObject:[NSNumber numberWithInteger:rowNumber]];
+        [_textTableRowArrays removeLastObject];
+        [_textTableRowArrays addObject:rowArray];
+        if ([_textTableRowBackgroundColors count] > 0) [_textTableRowBackgroundColors removeLastObject];
+    } else if ([@"table-cell" isEqualToString:displayVal] && [_textBlocks count] > 0) {
+        while ([_textTables count] > [_textBlocks count]) {
+            [_textTables removeLastObject];
+            [_textTableSpacings removeLastObject];
+            [_textTablePaddings removeLastObject];
+            [_textTableRows removeLastObject];
+            [_textTableRowArrays removeLastObject];
+        }
+        [_textBlocks removeLastObject];
+    } else if (([@"UL" isEqualToString:tag] || [@"OL" isEqualToString:tag]) && [_textLists count] > 0) {
+        NSTextList *list = [_textLists lastObject];
+        [self _addMarkersToList:list range:range];
+        [_textLists removeLastObject];
+    } else if ([@"Q" isEqualToString:tag]) {
+        [self _addQuoteForElement:element opening:NO level:--_quoteLevel];
+    } else if ([@"SPAN" isEqualToString:tag]) {
+        NSString *className = [element getAttribute:@"class"];
+        NSMutableString *mutableString;
+        NSUInteger i, count = 0;
+        unichar c;
+        if ([@"Apple-converted-space" isEqualToString:className]) {
+            mutableString = [_attrStr mutableString];
+            for (i = range.location; i < NSMaxRange(range); i++) {
+                c = [mutableString characterAtIndex:i];
+                if (0xa0 == c) [mutableString replaceCharactersInRange:NSMakeRange(i, 1) withString:@" "];
+            }
+        } else if ([@"Apple-converted-tab" isEqualToString:className]) {
+            mutableString = [_attrStr mutableString];
+            for (i = range.location; i < NSMaxRange(range); i++) {
+                NSRange rangeToReplace = NSMakeRange(NSNotFound, 0);
+                c = [mutableString characterAtIndex:i];
+                if (' ' == c || 0xa0 == c) {
+                    count++;
+                    if (count >= 4 || i + 1 >= NSMaxRange(range)) rangeToReplace = NSMakeRange(i + 1 - count, count);
+                } else {
+                    if (count > 0) rangeToReplace = NSMakeRange(i - count, count);
+                }
+                if (rangeToReplace.length > 0) {
+                    [mutableString replaceCharactersInRange:rangeToReplace withString:@"\t"];
+                    range.length -= (rangeToReplace.length - 1);
+                    i -= (rangeToReplace.length - 1);
+                    if (NSMaxRange(rangeToReplace) <= _domRangeStartIndex) {
+                        _domRangeStartIndex -= (rangeToReplace.length - 1);
+                    } else if (rangeToReplace.location < _domRangeStartIndex) {
+                        _domRangeStartIndex = rangeToReplace.location;
+                    }
+                    count = 0;
+                }
+            }
+        }
+    }
+}
+
+- (void)_processText:(DOMCharacterData *)text
+{
+    NSString *instr = [text data], *outstr = instr, *whitespaceVal, *transformVal;
+    NSUInteger textLength = [_attrStr length], startOffset = 0, endOffset = [instr length];
+    unichar lastChar = (textLength > 0) ? [[_attrStr string] characterAtIndex:textLength - 1] : '\n';
+    BOOL wasSpace = NO, wasLeading = YES, suppressLeadingSpace = ((_flags.isSoft && lastChar == ' ') || lastChar == '\n' || lastChar == '\r' || lastChar == '\t' || lastChar == NSParagraphSeparatorCharacter || lastChar == NSLineSeparatorCharacter || lastChar == NSFormFeedCharacter || lastChar == WebNextLineCharacter);
+    NSRange rangeToReplace = NSMakeRange(textLength, 0);
+    CFMutableStringRef mutstr = NULL;
+    whitespaceVal = [self _stringForNode:text property:@"white-space"];
+    transformVal = [self _stringForNode:text property:@"text-transform"];
+    
+    if (_domRange) {
+        if (text == [_domRange startContainer]) {
+            startOffset = (NSUInteger)[_domRange startOffset];
+            _domRangeStartIndex = [_attrStr length];
+            _flags.reachedStart = YES;
+        }
+        if (text == [_domRange endContainer]) {
+            endOffset = (NSUInteger)[_domRange endOffset];
+            _flags.reachedEnd = YES;
+        }
+        if ((startOffset > 0 || endOffset < [instr length]) && endOffset >= startOffset) {
+            instr = [instr substringWithRange:NSMakeRange(startOffset, endOffset - startOffset)];
+            outstr = instr;
+        }
+    }
+    if ([whitespaceVal hasPrefix:@"pre"]) {
+        if (textLength > 0 && [instr length] > 0 && _flags.isSoft) {
+            unichar c = [instr characterAtIndex:0];
+            if (c == '\n' || c == '\r' || c == NSParagraphSeparatorCharacter || c == NSLineSeparatorCharacter || c == NSFormFeedCharacter || c == WebNextLineCharacter) rangeToReplace = NSMakeRange(textLength - 1, 1);
+        }
+    } else {
+        CFStringInlineBuffer inlineBuffer;
+        const unsigned int TextBufferSize = 255;
+
+        unichar buffer[TextBufferSize + 1];
+        NSUInteger i, count = [instr length], idx = 0;
+
+        mutstr = CFStringCreateMutable(NULL, 0);
+        CFStringInitInlineBuffer((CFStringRef)instr, &inlineBuffer, CFRangeMake(0, count));
+        for (i = 0; i < count; i++) {
+            unichar c = CFStringGetCharacterFromInlineBuffer(&inlineBuffer, i);
+            if (c == ' ' || c == '\n' || c == '\r' || c == '\t' || c == 0xc || c == 0x200b) {
+                wasSpace = (!wasLeading || !suppressLeadingSpace);
+            } else {
+                if (wasSpace) buffer[idx++] = ' ';
+                buffer[idx++] = c;
+                if (idx >= TextBufferSize) {
+                    CFStringAppendCharacters(mutstr, buffer, idx);
+                    idx = 0;
+                }
+                wasSpace = wasLeading = NO;
+            }
+        }
+        if (wasSpace) buffer[idx++] = ' ';
+        if (idx > 0) CFStringAppendCharacters(mutstr, buffer, idx);
+        outstr = (NSString *)mutstr;
+    }
+    if ([outstr length] > 0) {
+        if ([@"capitalize" isEqualToString:transformVal]) {
+            outstr = [outstr capitalizedString];
+        } else if ([@"uppercase" isEqualToString:transformVal]) {
+            outstr = [outstr uppercaseString];
+        } else if ([@"lowercase" isEqualToString:transformVal]) {
+            outstr = [outstr lowercaseString];
+        }
+        [_attrStr replaceCharactersInRange:rangeToReplace withString:outstr];
+        rangeToReplace.length = [outstr length];
+        if (!_flags.isIndexing) {
+            NSDictionary *attrs;
+            DOMElement *element = (DOMElement *)text;
+            while (element && [element nodeType] != DOM_ELEMENT_NODE) element = (DOMElement *)[element parentNode];
+            attrs = [self _attributesForElement:element];
+            if (!_flags.isTesting && rangeToReplace.length > 0) [_attrStr setAttributes:attrs range:rangeToReplace];
+        }
+        _flags.isSoft = wasSpace;
+    }
+    if (mutstr) CFRelease(mutstr);
+}
+
+- (void)_traverseNode:(DOMNode *)node depth:(NSInteger)depth embedded:(BOOL)embedded
+{
+    unsigned short nodeType;
+    NSArray *childNodes;
+    NSUInteger i, count, startOffset, endOffset;
+    BOOL isStart = NO, isEnd = NO;
+
+    if (_flags.reachedEnd) return;
+    if (_domRange && !_flags.reachedStart && _domStartAncestors && ![_domStartAncestors containsObject:node]) return;
+    
+    nodeType = [node nodeType];
+    childNodes = [self _childrenForNode:node];
+    count = [childNodes count];
+    startOffset = 0;
+    endOffset = count;
+
+    if (_domRange) {
+        if (node == [_domRange startContainer]) {
+            startOffset = (NSUInteger)[_domRange startOffset];
+            isStart = YES;
+            _flags.reachedStart = YES;
+        }
+        if (node == [_domRange endContainer]) {
+            endOffset = (NSUInteger)[_domRange endOffset];
+            isEnd = YES;
+        }
+    }
+    
+    if (nodeType == DOM_DOCUMENT_NODE || nodeType == DOM_DOCUMENT_FRAGMENT_NODE) {
+        for (i = 0; i < count; i++) {
+            if (isStart && i == startOffset) _domRangeStartIndex = [_attrStr length];
+            if ((!isStart || startOffset <= i) && (!isEnd || endOffset > i)) [self _traverseNode:[childNodes objectAtIndex:i] depth:depth + 1 embedded:embedded];
+            if (isEnd && i + 1 >= endOffset) _flags.reachedEnd = YES;
+            if (_thumbnailLimit > 0 && [_attrStr length] >= _thumbnailLimit) _flags.reachedEnd = YES;
+            if (_flags.reachedEnd) break;
+        }
+    } else if (nodeType == DOM_ELEMENT_NODE) {
+        DOMElement *element = (DOMElement *)node;
+        NSString *tag = [element tagName], *displayVal = [self _stringForNode:element property:@"display"], *floatVal = [self _stringForNode:element property:@"float"];
+        BOOL isBlockLevel = NO;
+        if (floatVal && ([@"left" isEqualToString:floatVal] || [@"right" isEqualToString:floatVal])) {
+            isBlockLevel = YES;
+        } else if (displayVal) {
+            isBlockLevel = ([@"block" isEqualToString:displayVal] || [@"list-item" isEqualToString:displayVal] || [displayVal hasPrefix:@"table"]);
+        }
+        [_elementIsBlockLevel setObject:[NSNumber numberWithBool:isBlockLevel] forKey:element];
+        if ([self _enterElement:element tag:tag display:displayVal]) {
+            NSUInteger startIndex = [_attrStr length];
+            if ([self _processElement:element tag:tag display:displayVal depth:depth]) {
+                for (i = 0; i < count; i++) {
+                    if (isStart && i == startOffset) _domRangeStartIndex = [_attrStr length];
+                    if ((!isStart || startOffset <= i) && (!isEnd || endOffset > i)) [self _traverseNode:[childNodes objectAtIndex:i] depth:depth + 1 embedded:embedded];
+                    if (isEnd && i + 1 >= endOffset) _flags.reachedEnd = YES;
+                    if (_flags.reachedEnd) break;
+                }
+                [self _exitElement:element tag:tag display:displayVal depth:depth startIndex:startIndex];
+            }
+        }
+    } else if (nodeType == DOM_TEXT_NODE || nodeType == DOM_CDATA_SECTION_NODE) {
+        [self _processText:(DOMCharacterData *)node];
+    }
+    
+    if (isEnd) _flags.reachedEnd = YES;
+}
+
+- (void)_traverseFooterNode:(DOMNode *)node depth:(NSInteger)depth
+{
+    DOMElement *element = (DOMElement *)node;
+    NSArray *childNodes = [self _childrenForNode:node];
+    NSString *tag = @"TBODY", *displayVal = @"table-row-group";
+    NSUInteger i, count = [childNodes count], startOffset = 0, endOffset = count;
+    BOOL isStart = NO, isEnd = NO;
+
+    if (_flags.reachedEnd) return;
+    if (_domRange && !_flags.reachedStart && _domStartAncestors && ![_domStartAncestors containsObject:node]) return;
+    if (_domRange) {
+        if (node == [_domRange startContainer]) {
+            startOffset = (NSUInteger)[_domRange startOffset];
+            isStart = YES;
+            _flags.reachedStart = YES;
+        }
+        if (node == [_domRange endContainer]) {
+            endOffset = (NSUInteger)[_domRange endOffset];
+            isEnd = YES;
+        }
+    }
+    if ([self _enterElement:element tag:tag display:displayVal]) {
+        NSUInteger startIndex = [_attrStr length];
+        if ([self _processElement:element tag:tag display:displayVal depth:depth]) {
+            for (i = 0; i < count; i++) {
+                if (isStart && i == startOffset) _domRangeStartIndex = [_attrStr length];
+                if ((!isStart || startOffset <= i) && (!isEnd || endOffset > i)) [self _traverseNode:[childNodes objectAtIndex:i] depth:depth + 1 embedded:YES];
+                if (isEnd && i + 1 >= endOffset) _flags.reachedEnd = YES;
+                if (_flags.reachedEnd) break;
+            }
+            [self _exitElement:element tag:tag display:displayVal depth:depth startIndex:startIndex];
+        }
+    }
+    if (isEnd) _flags.reachedEnd = YES;
+}
+
+- (void)_adjustTrailingNewline
+{
+    NSUInteger textLength = [_attrStr length];
+    unichar lastChar = (textLength > 0) ? [[_attrStr string] characterAtIndex:textLength - 1] : 0;
+    BOOL alreadyHasTrailingNewline = (lastChar == '\n' || lastChar == '\r' || lastChar == NSParagraphSeparatorCharacter || lastChar == NSLineSeparatorCharacter || lastChar == WebNextLineCharacter);
+    if (_flags.hasTrailingNewline && !alreadyHasTrailingNewline)
+        [_attrStr replaceCharactersInRange:NSMakeRange(textLength, 0) withString:@"\n"];
+}
+
+- (void)_loadFromDOMRange
+{
+    if (-1 == _errorCode) {
+        DOMNode *commonAncestorContainer = [_domRange commonAncestorContainer], *ancestorContainer = [_domRange startContainer];
+        
+        _domStartAncestors = [[NSMutableArray alloc] init];
+        while (ancestorContainer) {
+            [_domStartAncestors addObject:ancestorContainer];
+            if (ancestorContainer == commonAncestorContainer) break;
+            ancestorContainer = [ancestorContainer parentNode];
+        }
+        _document = [commonAncestorContainer ownerDocument];
+        _dataSource = (DocumentLoader *)core(_document)->frame()->loader()->documentLoader();
+        if (_textSizeMultiplier <= 0.0) _textSizeMultiplier = 1;
+        if (_defaultFontSize <= 0.0) _defaultFontSize = 12;
+        if (_minimumFontSize < 1.0) _minimumFontSize = 1;
+        if (_document && _dataSource) {
+            _domRangeStartIndex = 0;
+            _errorCode = 0;
+            [self _traverseNode:commonAncestorContainer depth:0 embedded:NO];
+            if (_domRangeStartIndex > 0 && _domRangeStartIndex <= [_attrStr length]) [_attrStr deleteCharactersInRange:NSMakeRange(0, _domRangeStartIndex)];
+        }
+    }
+}
+
+- (void)dealloc
+{
+    [_attrStr release];
+    [_domRange release];
+    [_domStartAncestors release];
+    [_standardFontFamily release];
+    [_textLists release];
+    [_textBlocks release];
+    [_textTables release];
+    [_textTableFooters release];
+    [_textTableSpacings release];
+    [_textTablePaddings release];
+    [_textTableRows release];
+    [_textTableRowArrays release];
+    [_textTableRowBackgroundColors release];
+    [_computedStylesForElements release];
+    [_specifiedStylesForElements release];
+    [_stringsForNodes release];
+    [_floatsForNodes release];
+    [_colorsForNodes release];
+    [_attributesForElements release];
+    [_elementIsBlockLevel release];
+    [_fontCache release];
+    [_writingDirectionArray release];
+    [super dealloc];
+}
+
+- (id)init
+{
+    self = [super init];
+    if (!self) return nil;
+    
+    _attrStr = [[NSMutableAttributedString alloc] init];
+
+    _textLists = [[NSMutableArray alloc] init];
+    _textBlocks = [[NSMutableArray alloc] init];
+    _textTables = [[NSMutableArray alloc] init];
+    _textTableFooters = [[NSMutableDictionary alloc] init];
+    _textTableSpacings = [[NSMutableArray alloc] init];
+    _textTablePaddings = [[NSMutableArray alloc] init];
+    _textTableRows = [[NSMutableArray alloc] init];
+    _textTableRowArrays = [[NSMutableArray alloc] init];
+    _textTableRowBackgroundColors = [[NSMutableArray alloc] init];
+    _computedStylesForElements = [[NSMutableDictionary alloc] init];
+    _specifiedStylesForElements = [[NSMutableDictionary alloc] init];
+    _stringsForNodes = [[NSMutableDictionary alloc] init];
+    _floatsForNodes = [[NSMutableDictionary alloc] init];
+    _colorsForNodes = [[NSMutableDictionary alloc] init];
+    _attributesForElements = [[NSMutableDictionary alloc] init];
+    _elementIsBlockLevel = [[NSMutableDictionary alloc] init];
+    _fontCache = [[NSMutableDictionary alloc] init];
+    _writingDirectionArray = [[NSMutableArray alloc] init];
+
+    _textSizeMultiplier = 1;
+    _webViewTextSizeMultiplier = 0;
+    _defaultTabInterval = 36;
+    _defaultFontSize = 12;
+    _minimumFontSize = 1;
+    _errorCode = -1;
+    _indexingLimit = 0;
+    _thumbnailLimit = 0;
+
+    _flags.isIndexing = (_indexingLimit > 0);
+    _flags.isTesting = 0;
+    
+    return self;
+}
+
+- (id)initWithDOMRange:(DOMRange *)domRange
+{
+    self = [self init];
+    if (!self) return nil;
+    _domRange = [domRange retain];
+    return self;
+}
+
+- (NSAttributedString *)attributedString
+{
+    [self _loadFromDOMRange];
+    return (0 == _errorCode) ? [[_attrStr retain] autorelease] : nil;
+}
+
+@end
+#endif
diff --git a/Source/WebCore/platform/mac/LoggingMac.mm b/Source/WebCore/platform/mac/LoggingMac.mm
index ee2f39e..168d0cc 100644
--- a/Source/WebCore/platform/mac/LoggingMac.mm
+++ b/Source/WebCore/platform/mac/LoggingMac.mm
@@ -23,6 +23,8 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
+#include "config.h"
+
 #include "Logging.h"
 
 namespace WebCore {
diff --git a/Source/WebCore/platform/mac/PasteboardMac.mm b/Source/WebCore/platform/mac/PasteboardMac.mm
index 8c6610a..da06606 100644
--- a/Source/WebCore/platform/mac/PasteboardMac.mm
+++ b/Source/WebCore/platform/mac/PasteboardMac.mm
@@ -38,6 +38,10 @@
 #import "FrameLoaderClient.h"
 #import "HitTestResult.h"
 #import "HTMLAnchorElement.h"
+#if !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
+#import "HTMLConverter.h"
+#endif
+#import "htmlediting.h"
 #import "HTMLNames.h"
 #import "Image.h"
 #import "KURL.h"
@@ -144,9 +148,30 @@ void Pasteboard::writeSelection(NSPasteboard* pasteboard, NSArray* pasteboardTyp
         Pasteboard::generalPasteboard(); // Initializes pasteboard types.
     ASSERT(selectedRange);
     
+    // If the selection is at the beginning of content inside an anchor tag
+    // we move the selection start to include the anchor.
+    // This way the attributed string will contain the url attribute as well.
+    // See <rdar://problem/9084267>.
+    ExceptionCode ec;
+    Node* commonAncestor = selectedRange->commonAncestorContainer(ec);
+    ASSERT(commonAncestor);
+    Node* enclosingAnchor = enclosingNodeWithTag(firstPositionInNode(commonAncestor), HTMLNames::aTag);
+    if (enclosingAnchor && comparePositions(firstPositionInOrBeforeNode(selectedRange->startPosition().anchorNode()), selectedRange->startPosition()) >= 0)
+        selectedRange->setStart(enclosingAnchor, 0, ec);
+
     // Using different API for WebKit and WebKit2.
-    // FIXME - We need to have a way to create the NSAttributedString for WebKit2 that doesn't require accessing the WebFrame.
-    NSAttributedString *attributedString = (frame->view()->platformWidget()) ? [[[NSAttributedString alloc] _initWithDOMRange:kit(selectedRange)] autorelease] : [[[NSAttributedString alloc] initWithString:selectedRange->text()] autorelease];
+    NSAttributedString *attributedString = nil;
+    if (frame->view()->platformWidget())
+        attributedString = [[[NSAttributedString alloc] _initWithDOMRange:kit(selectedRange)] autorelease];
+#if !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
+    else {
+        // In WebKit2 we are using a different way to create the NSAttributedString from the DOMrange that doesn't require access to the WebView.
+        RetainPtr<WebHTMLConverter> converter = [[WebHTMLConverter alloc] initWithDOMRange:kit(selectedRange)];
+        if (converter)
+            attributedString = [converter.get() attributedString];
+    }
+#endif
+
 #ifdef BUILDING_ON_TIGER
     // 4930197: Mail overrides [WebHTMLView pasteboardTypesForSelection] in order to add another type to the pasteboard
     // after WebKit does.  On Tiger we must call this function so that Mail code will be executed, meaning that 
diff --git a/Source/WebCore/platform/mac/PlatformScreenMac.mm b/Source/WebCore/platform/mac/PlatformScreenMac.mm
index 5dbfcf4..916fc9f 100644
--- a/Source/WebCore/platform/mac/PlatformScreenMac.mm
+++ b/Source/WebCore/platform/mac/PlatformScreenMac.mm
@@ -76,12 +76,21 @@ NSScreen *screenForWindow(NSWindow *window)
     return nil;
 }
 
+static CGFloat windowScaleFactor(NSWindow *window)
+{
+#if !defined(BUILDING_ON_LEOPARD) && !defined(BUILDING_ON_SNOW_LEOPARD)
+    return [window backingScaleFactor];
+#else
+    return [window userSpaceScaleFactor];
+#endif
+}
+
 FloatRect toUserSpace(const NSRect& rect, NSWindow *destination)
 {
     FloatRect userRect = rect;
     userRect.setY(NSMaxY([screenForWindow(destination) frame]) - (userRect.y() + userRect.height())); // flip
     if (destination)
-        userRect.scale(1 / [destination userSpaceScaleFactor]); // scale down
+        userRect.scale(1 / windowScaleFactor(destination)); // scale down
     return userRect;
 }
 
@@ -89,7 +98,7 @@ NSRect toDeviceSpace(const FloatRect& rect, NSWindow *source)
 {
     FloatRect deviceRect = rect;
     if (source)
-        deviceRect.scale([source userSpaceScaleFactor]); // scale up
+        deviceRect.scale(windowScaleFactor(source)); // scale up
     deviceRect.setY(NSMaxY([screenForWindow(source) frame]) - (deviceRect.y() + deviceRect.height())); // flip
     return deviceRect;
 }
diff --git a/Source/WebCore/platform/mac/SSLKeyGeneratorMac.cpp b/Source/WebCore/platform/mac/SSLKeyGeneratorMac.cpp
new file mode 100644
index 0000000..0a1a4d8
--- /dev/null
+++ b/Source/WebCore/platform/mac/SSLKeyGeneratorMac.cpp
@@ -0,0 +1,70 @@
+/*
+ * Copyright (C) 2003, 2005, 2008, 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "SSLKeyGenerator.h"
+
+#include "KURL.h"
+#include "LocalizedStrings.h"
+#include "WebCoreSystemInterface.h"
+#include <wtf/RetainPtr.h>
+
+namespace WebCore {
+
+void getSupportedKeySizes(Vector<String>& supportedKeySizes)
+{
+    ASSERT(supportedKeySizes.isEmpty());
+    supportedKeySizes.append(keygenMenuItem2048());
+    supportedKeySizes.append(keygenMenuItem1024());
+    supportedKeySizes.append(keygenMenuItem512());
+}
+
+String signedPublicKeyAndChallengeString(unsigned keySizeIndex, const String& challengeString, const KURL& url)
+{   
+    // This switch statement must always be synced with the UI strings returned by getSupportedKeySizes.
+    UInt32 keySize;
+    switch (keySizeIndex) {
+    case 0:
+        keySize = 2048;
+        break;
+    case 1:
+        keySize = 1024;
+        break;
+    case 2:
+        keySize = 512;
+        break;
+    default:
+        ASSERT_NOT_REACHED();
+        return String();
+    }
+
+    RetainPtr<CFStringRef> challengeStringCF(AdoptCF, challengeString.createCFString());
+    RetainPtr<CFStringRef> keyDescription(AdoptCF, keygenKeychainItemName(url.host()).createCFString());
+    RetainPtr<CFStringRef> result(AdoptCF, wkSignedPublicKeyAndChallengeString(keySize, challengeStringCF.get(), keyDescription.get()));
+
+    return result.get();
+}
+
+}
diff --git a/Source/WebCore/platform/mac/ScrollAnimatorMac.h b/Source/WebCore/platform/mac/ScrollAnimatorMac.h
index 2bafbf5..f7b6332 100644
--- a/Source/WebCore/platform/mac/ScrollAnimatorMac.h
+++ b/Source/WebCore/platform/mac/ScrollAnimatorMac.h
@@ -30,7 +30,6 @@
 
 #include "FloatPoint.h"
 #include "FloatSize.h"
-#include "HeaderDetection.h"
 #include "ScrollAnimator.h"
 #include "Timer.h"
 #include "WebCoreSystemInterface.h"
@@ -67,6 +66,8 @@ public:
 #endif
 #endif
 
+    virtual void cancelAnimations();
+
     void immediateScrollToPoint(const FloatPoint& newPosition);
     void immediateScrollByDeltaX(float deltaX);
     void immediateScrollByDeltaY(float deltaY);
@@ -74,14 +75,25 @@ public:
     void setIsDrawingIntoLayer(bool b) { m_drawingIntoLayer = b; }
     bool isDrawingIntoLayer() const { return m_drawingIntoLayer; }
 
+    bool haveScrolledSincePageLoad() const { return m_haveScrolledSincePageLoad; }
+
+#if USE(WK_SCROLLBAR_PAINTER)
+    bool scrollbarPaintTimerIsActive() const;
+    void startScrollbarPaintTimer();
+    void stopScrollbarPaintTimer();
+#endif
+
 private:
     RetainPtr<id> m_scrollAnimationHelper;
     RetainPtr<ScrollAnimationHelperDelegate> m_scrollAnimationHelperDelegate;
 
-#if defined(USE_WK_SCROLLBAR_PAINTER_AND_CONTROLLER)
+#if USE(WK_SCROLLBAR_PAINTER)
     RetainPtr<WKScrollbarPainterControllerRef> m_scrollbarPainterController;
     RetainPtr<ScrollbarPainterControllerDelegate> m_scrollbarPainterControllerDelegate;
     RetainPtr<id> m_scrollbarPainterDelegate;
+
+    void initialScrollbarPaintTimerFired(Timer<ScrollAnimatorMac>*);
+    Timer<ScrollAnimatorMac> m_initialScrollbarPaintTimer;
 #endif
     
     virtual void notityPositionChanged();
@@ -131,6 +143,7 @@ private:
     Timer<ScrollAnimatorMac> m_snapRubberBandTimer;
 #endif
     bool m_drawingIntoLayer;
+    bool m_haveScrolledSincePageLoad;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/mac/ScrollAnimatorMac.mm b/Source/WebCore/platform/mac/ScrollAnimatorMac.mm
index 67c0904..5725880 100644
--- a/Source/WebCore/platform/mac/ScrollAnimatorMac.mm
+++ b/Source/WebCore/platform/mac/ScrollAnimatorMac.mm
@@ -141,7 +141,7 @@ static NSSize abs(NSSize size)
 
 @end
 
-#if defined(USE_WK_SCROLLBAR_PAINTER_AND_CONTROLLER)
+#if USE(WK_SCROLLBAR_PAINTER)
 
 @interface ScrollbarPainterControllerDelegate : NSObject
 {
@@ -240,6 +240,13 @@ static NSSize abs(NSSize size)
                                                                                      verticalScrollbar->controlSize(),
                                                                                      false);
         macTheme->setNewPainterForScrollbar(verticalScrollbar, newVerticalPainter);
+        wkSetPainterForPainterController(painterController, newVerticalPainter, false);
+
+        // The different scrollbar styles have different thicknesses, so we must re-set the 
+        // frameRect to the new thickness, and the re-layout below will ensure the position
+        // and length are properly updated.
+        int thickness = macTheme->scrollbarThickness(verticalScrollbar->controlSize());
+        verticalScrollbar->setFrameRect(WebCore::IntRect(0, 0, thickness, thickness));
     }
 
     WKScrollbarPainterRef oldHorizontalPainter = wkHorizontalScrollbarPainterForController(painterController);
@@ -250,9 +257,19 @@ static NSSize abs(NSSize size)
                                                                                        horizontalScrollbar->controlSize(),
                                                                                        true);
         macTheme->setNewPainterForScrollbar(horizontalScrollbar, newHorizontalPainter);
+        wkSetPainterForPainterController(painterController, newHorizontalPainter, true);
+
+        // The different scrollbar styles have different thicknesses, so we must re-set the 
+        // frameRect to the new thickness, and the re-layout below will ensure the position
+        // and length are properly updated.
+        int thickness = macTheme->scrollbarThickness(horizontalScrollbar->controlSize());
+        horizontalScrollbar->setFrameRect(WebCore::IntRect(0, 0, thickness, thickness));
     }
 
     wkSetScrollbarPainterControllerStyle(painterController, newRecommendedScrollerStyle);
+
+    // The different scrollbar styles affect layout, so we must re-layout everything.
+    _animator->scrollableArea()->scrollbarStyleChanged();
 }
 
 @end
@@ -329,6 +346,7 @@ static NSSize abs(NSSize size)
     RetainPtr<ScrollbarPartAnimation> _horizontalTrackAnimation;
 }
 - (id)initWithScrollAnimator:(WebCore::ScrollAnimatorMac*)scrollAnimator;
+- (void)cancelAnimations;
 @end
 
 @implementation ScrollbarPainterDelegate
@@ -343,6 +361,14 @@ static NSSize abs(NSSize size)
     return self;
 }
 
+- (void)cancelAnimations
+{
+    [_verticalKnobAnimation.get() stopAnimation];
+    [_horizontalKnobAnimation.get() stopAnimation];
+    [_verticalTrackAnimation.get() stopAnimation];
+    [_horizontalTrackAnimation.get() stopAnimation];
+}
+
 - (NSRect)convertRectToBacking:(NSRect)aRect
 {
     return aRect;
@@ -367,12 +393,29 @@ static NSSize abs(NSSize size)
 
 - (void)setUpAnimation:(RetainPtr<ScrollbarPartAnimation>&)scrollbarPartAnimation scrollerPainter:(WKScrollbarPainterRef)scrollerPainter part:(WebCore::ScrollbarPart)part animateAlphaTo:(CGFloat)newAlpha duration:(NSTimeInterval)duration
 {
+    // If the user has scrolled the page, then the scrollbars must be animated here. 
+    // This overrides the early returns.
+    bool mustAnimate = _animator->haveScrolledSincePageLoad();
+
+    if (_animator->scrollbarPaintTimerIsActive() && !mustAnimate)
+        return;
+
+    if (_animator->scrollableArea()->shouldSuspendScrollAnimations() && !mustAnimate) {
+        _animator->startScrollbarPaintTimer();
+        return;
+    }
+
+    // At this point, we are definitely going to animate now, so stop the timer.
+    _animator->stopScrollbarPaintTimer();
+
     // If we are currently animating, stop
     if (scrollbarPartAnimation) {
         [scrollbarPartAnimation.get() stopAnimation];
         scrollbarPartAnimation = nil;
     }
-    
+
+    [NSAnimationContext beginGrouping];
+    [[NSAnimationContext currentContext] setDuration:duration];
     scrollbarPartAnimation.adoptNS([[ScrollbarPartAnimation alloc] initWithScrollbarPainter:scrollerPainter 
                                                                     part:part
                                                                     scrollAnimator:_animator 
@@ -380,6 +423,7 @@ static NSSize abs(NSSize size)
                                                                     duration:duration]);
     [scrollbarPartAnimation.get() setAnimationBlockingMode:NSAnimationNonblocking];
     [scrollbarPartAnimation.get() startAnimation];
+    [NSAnimationContext endGrouping];
 }
 
 - (void)scrollerImp:(id)scrollerImp animateKnobAlphaTo:(CGFloat)newKnobAlpha duration:(NSTimeInterval)duration
@@ -388,9 +432,6 @@ static NSSize abs(NSSize size)
         return;
 
     WKScrollbarPainterRef scrollerPainter = (WKScrollbarPainterRef)scrollerImp;
-    if (newKnobAlpha == wkScrollbarPainterKnobAlpha(scrollerPainter))
-        return;
-
     if (wkScrollbarPainterIsHorizontal(scrollerPainter))
         [self setUpAnimation:_horizontalKnobAnimation scrollerPainter:scrollerPainter part:WebCore::ThumbPart animateAlphaTo:newKnobAlpha duration:duration];
     else
@@ -403,9 +444,6 @@ static NSSize abs(NSSize size)
         return;
 
     WKScrollbarPainterRef scrollerPainter = (WKScrollbarPainterRef)scrollerImp;
-    if (newTrackAlpha == wkScrollbarPainterTrackAlpha(scrollerPainter))
-        return;
-
     if (wkScrollbarPainterIsHorizontal(scrollerPainter))
         [self setUpAnimation:_horizontalTrackAnimation scrollerPainter:scrollerPainter part:WebCore::BackTrackPart animateAlphaTo:newTrackAlpha duration:duration];
     else
@@ -414,20 +452,8 @@ static NSSize abs(NSSize size)
 
 - (void)scrollerImp:(id)scrollerImp overlayScrollerStateChangedTo:(NSUInteger)newOverlayScrollerState
 {
-    if (!_animator)
-        return;
-
-    WKScrollbarPainterRef scrollbarPainter = (WKScrollbarPainterRef)scrollerImp;
-    wkScrollbarPainterSetOverlayState(scrollbarPainter, newOverlayScrollerState);
-
-    if (wkScrollbarPainterIsHorizontal(scrollbarPainter)) {
-        WebCore::Scrollbar* horizontalScrollbar = _animator->scrollableArea()->horizontalScrollbar();
-        _animator->scrollableArea()->invalidateScrollbarRect(horizontalScrollbar, WebCore::IntRect(0, 0, horizontalScrollbar->width(), horizontalScrollbar->height()));
-    } else {
-        WebCore::Scrollbar* verticalScrollbar = _animator->scrollableArea()->verticalScrollbar();
-        _animator->scrollableArea()->invalidateScrollbarRect(verticalScrollbar, WebCore::IntRect(0, 0, verticalScrollbar->width(), verticalScrollbar->height()));
-
-    }
+    UNUSED_PARAM(scrollerImp);
+    UNUSED_PARAM(newOverlayScrollerState);
 }
 
 - (void)scrollAnimatorDestroyed
@@ -440,7 +466,8 @@ static NSSize abs(NSSize size)
 }
 
 @end
-#endif // #if defined(USE_WK_SCROLLBAR_PAINTER_AND_CONTROLLER)
+
+#endif // USE(WK_SCROLLBAR_PAINTER)
 
 namespace WebCore {
 
@@ -451,6 +478,9 @@ PassOwnPtr<ScrollAnimator> ScrollAnimator::create(ScrollableArea* scrollableArea
 
 ScrollAnimatorMac::ScrollAnimatorMac(ScrollableArea* scrollableArea)
     : ScrollAnimator(scrollableArea)
+#if USE(WK_SCROLLBAR_PAINTER)
+    , m_initialScrollbarPaintTimer(this, &ScrollAnimatorMac::initialScrollbarPaintTimerFired)
+#endif
 #if ENABLE(RUBBER_BANDING)
     , m_inScrollGesture(false)
     , m_momentumScrollInProgress(false)
@@ -460,11 +490,12 @@ ScrollAnimatorMac::ScrollAnimatorMac(ScrollableArea* scrollableArea)
     , m_snapRubberBandTimer(this, &ScrollAnimatorMac::snapRubberBandTimerFired)
 #endif
     , m_drawingIntoLayer(false)
+    , m_haveScrolledSincePageLoad(false)
 {
     m_scrollAnimationHelperDelegate.adoptNS([[ScrollAnimationHelperDelegate alloc] initWithScrollAnimator:this]);
     m_scrollAnimationHelper.adoptNS([[NSClassFromString(@"NSScrollAnimationHelper") alloc] initWithDelegate:m_scrollAnimationHelperDelegate.get()]);
 
-#if defined(USE_WK_SCROLLBAR_PAINTER_AND_CONTROLLER)
+#if USE(WK_SCROLLBAR_PAINTER)
     m_scrollbarPainterControllerDelegate.adoptNS([[ScrollbarPainterControllerDelegate alloc] initWithScrollAnimator:this]);
     m_scrollbarPainterController = wkMakeScrollbarPainterController(m_scrollbarPainterControllerDelegate.get());
     m_scrollbarPainterDelegate.adoptNS([[ScrollbarPainterDelegate alloc] initWithScrollAnimator:this]);
@@ -473,7 +504,7 @@ ScrollAnimatorMac::ScrollAnimatorMac(ScrollableArea* scrollableArea)
 
 ScrollAnimatorMac::~ScrollAnimatorMac()
 {
-#if defined(USE_WK_SCROLLBAR_PAINTER_AND_CONTROLLER)
+#if USE(WK_SCROLLBAR_PAINTER)
     [m_scrollbarPainterControllerDelegate.get() scrollAnimatorDestroyed];
     [(id)m_scrollbarPainterController.get() setDelegate:nil];
     [m_scrollbarPainterDelegate.get() scrollAnimatorDestroyed];
@@ -483,6 +514,8 @@ ScrollAnimatorMac::~ScrollAnimatorMac()
 
 bool ScrollAnimatorMac::scroll(ScrollbarOrientation orientation, ScrollGranularity granularity, float step, float multiplier)
 {
+    m_haveScrolledSincePageLoad = true;
+
     if (![[NSUserDefaults standardUserDefaults] boolForKey:@"AppleScrollAnimationEnabled"])
         return ScrollAnimator::scroll(orientation, granularity, step, multiplier);
 
@@ -561,7 +594,7 @@ void ScrollAnimatorMac::immediateScrollByDeltaY(float deltaY)
 
 void ScrollAnimatorMac::notityPositionChanged()
 {
-#if defined(USE_WK_SCROLLBAR_PAINTER_AND_CONTROLLER)
+#if USE(WK_SCROLLBAR_PAINTER)
     wkContentAreaScrolled(m_scrollbarPainterController.get());
 #endif
     ScrollAnimator::notityPositionChanged();
@@ -569,70 +602,70 @@ void ScrollAnimatorMac::notityPositionChanged()
 
 void ScrollAnimatorMac::contentAreaWillPaint() const
 {
-#if defined(USE_WK_SCROLLBAR_PAINTER_AND_CONTROLLER)
+#if USE(WK_SCROLLBAR_PAINTER)
     wkContentAreaWillPaint(m_scrollbarPainterController.get());
 #endif
 }
 
 void ScrollAnimatorMac::mouseEnteredContentArea() const
 {
-#if defined(USE_WK_SCROLLBAR_PAINTER_AND_CONTROLLER)
+#if USE(WK_SCROLLBAR_PAINTER)
     wkMouseEnteredContentArea(m_scrollbarPainterController.get());
 #endif
 }
 
 void ScrollAnimatorMac::mouseExitedContentArea() const
 {
-#if defined(USE_WK_SCROLLBAR_PAINTER_AND_CONTROLLER)
+#if USE(WK_SCROLLBAR_PAINTER)
     wkMouseExitedContentArea(m_scrollbarPainterController.get());
 #endif
 }
 
 void ScrollAnimatorMac::mouseMovedInContentArea() const
 {
-#if defined(USE_WK_SCROLLBAR_PAINTER_AND_CONTROLLER)
+#if USE(WK_SCROLLBAR_PAINTER)
     wkMouseMovedInContentArea(m_scrollbarPainterController.get());
 #endif
 }
 
 void ScrollAnimatorMac::willStartLiveResize()
 {
-#if defined(USE_WK_SCROLLBAR_PAINTER_AND_CONTROLLER)
+#if USE(WK_SCROLLBAR_PAINTER)
     wkWillStartLiveResize(m_scrollbarPainterController.get());
 #endif
 }
 
 void ScrollAnimatorMac::contentsResized() const
 {
-#if defined(USE_WK_SCROLLBAR_PAINTER_AND_CONTROLLER)
+#if USE(WK_SCROLLBAR_PAINTER)
     wkContentAreaResized(m_scrollbarPainterController.get());
 #endif
 }
 
 void ScrollAnimatorMac::willEndLiveResize()
 {
-#if defined(USE_WK_SCROLLBAR_PAINTER_AND_CONTROLLER)
+#if USE(WK_SCROLLBAR_PAINTER)
     wkWillEndLiveResize(m_scrollbarPainterController.get());
 #endif
 }
 
 void ScrollAnimatorMac::contentAreaDidShow() const
 {
-#if defined(USE_WK_SCROLLBAR_PAINTER_AND_CONTROLLER)
+#if USE(WK_SCROLLBAR_PAINTER)
     wkContentAreaDidShow(m_scrollbarPainterController.get());
 #endif
 }
 
 void ScrollAnimatorMac::contentAreaDidHide() const
 {
-#if defined(USE_WK_SCROLLBAR_PAINTER_AND_CONTROLLER)
+#if USE(WK_SCROLLBAR_PAINTER)
     wkContentAreaDidHide(m_scrollbarPainterController.get());
 #endif
 }
 
 void ScrollAnimatorMac::didAddVerticalScrollbar(Scrollbar* scrollbar)
 {
-#if defined(USE_WK_SCROLLBAR_PAINTER_AND_CONTROLLER)
+#if USE(WK_SCROLLBAR_PAINTER)
     WKScrollbarPainterRef painter = static_cast<WebCore::ScrollbarThemeMac*>(WebCore::ScrollbarTheme::nativeTheme())->painterForScrollbar(scrollbar);
     wkScrollbarPainterSetDelegate(painter, m_scrollbarPainterDelegate.get());
     wkSetPainterForPainterController(m_scrollbarPainterController.get(), painter, false);
@@ -645,7 +678,7 @@ void ScrollAnimatorMac::didAddVerticalScrollbar(Scrollbar* scrollbar)
 
 void ScrollAnimatorMac::willRemoveVerticalScrollbar(Scrollbar* scrollbar)
 {
-#if defined(USE_WK_SCROLLBAR_PAINTER_AND_CONTROLLER)
+#if USE(WK_SCROLLBAR_PAINTER)
     WKScrollbarPainterRef painter = static_cast<WebCore::ScrollbarThemeMac*>(WebCore::ScrollbarTheme::nativeTheme())->painterForScrollbar(scrollbar);
     wkScrollbarPainterSetDelegate(painter, nil);
     wkSetPainterForPainterController(m_scrollbarPainterController.get(), nil, false);
@@ -656,7 +689,7 @@ void ScrollAnimatorMac::willRemoveVerticalScrollbar(Scrollbar* scrollbar)
 
 void ScrollAnimatorMac::didAddHorizontalScrollbar(Scrollbar* scrollbar)
 {
-#if defined(USE_WK_SCROLLBAR_PAINTER_AND_CONTROLLER)
+#if USE(WK_SCROLLBAR_PAINTER)
     WKScrollbarPainterRef painter = static_cast<WebCore::ScrollbarThemeMac*>(WebCore::ScrollbarTheme::nativeTheme())->painterForScrollbar(scrollbar);
     wkScrollbarPainterSetDelegate(painter, m_scrollbarPainterDelegate.get());
     wkSetPainterForPainterController(m_scrollbarPainterController.get(), painter, true);
@@ -669,7 +702,7 @@ void ScrollAnimatorMac::didAddHorizontalScrollbar(Scrollbar* scrollbar)
 
 void ScrollAnimatorMac::willRemoveHorizontalScrollbar(Scrollbar* scrollbar)
 {
-#if defined(USE_WK_SCROLLBAR_PAINTER_AND_CONTROLLER)
+#if USE(WK_SCROLLBAR_PAINTER)
     WKScrollbarPainterRef painter = static_cast<WebCore::ScrollbarThemeMac*>(WebCore::ScrollbarTheme::nativeTheme())->painterForScrollbar(scrollbar);
     wkScrollbarPainterSetDelegate(painter, nil);
     wkSetPainterForPainterController(m_scrollbarPainterController.get(), nil, true);
@@ -678,6 +711,17 @@ void ScrollAnimatorMac::willRemoveHorizontalScrollbar(Scrollbar* scrollbar)
 #endif
 }
 
+void ScrollAnimatorMac::cancelAnimations()
+{
+    m_haveScrolledSincePageLoad = false;
+
+#if USE(WK_SCROLLBAR_PAINTER)
+    if (scrollbarPaintTimerIsActive())
+        stopScrollbarPaintTimer();
+    [m_scrollbarPainterDelegate.get() cancelAnimations];
+#endif
+}
+
 #if ENABLE(RUBBER_BANDING)
 
 static const float scrollVelocityZeroingTimeout = 0.10f;
@@ -720,6 +764,8 @@ static float scrollWheelMultiplier()
 
 void ScrollAnimatorMac::handleWheelEvent(PlatformWheelEvent& wheelEvent)
 {
+    m_haveScrolledSincePageLoad = true;
+
     if (!wheelEvent.hasPreciseScrollingDeltas()) {
         ScrollAnimator::handleWheelEvent(wheelEvent);
         return;
@@ -751,18 +797,18 @@ bool ScrollAnimatorMac::pinnedInDirection(float deltaX, float deltaY)
     if (fabsf(deltaY) >= fabsf(deltaX)) {
         if (deltaY < 0) {
             // We are trying to scroll up.  Make sure we are not pinned to the top
-            limitDelta.setHeight(m_scrollableArea->visibleContentRect().y());
+            limitDelta.setHeight(m_scrollableArea->visibleContentRect().y() + + m_scrollableArea->scrollOrigin().y());
         } else {
             // We are trying to scroll down.  Make sure we are not pinned to the bottom
-            limitDelta.setHeight(m_scrollableArea->contentsSize().height() - m_scrollableArea->visibleContentRect().maxY());
+            limitDelta.setHeight(m_scrollableArea->contentsSize().height() - (m_scrollableArea->visibleContentRect().maxY() + m_scrollableArea->scrollOrigin().y()));
         }
     } else if (deltaX != 0) {
         if (deltaX < 0) {
             // We are trying to scroll left.  Make sure we are not pinned to the left
-            limitDelta.setWidth(m_scrollableArea->visibleContentRect().x());
+            limitDelta.setWidth(m_scrollableArea->visibleContentRect().x() + m_scrollableArea->scrollOrigin().x());
         } else {
             // We are trying to scroll right.  Make sure we are not pinned to the right
-            limitDelta.setWidth(m_scrollableArea->contentsSize().width() - m_scrollableArea->visibleContentRect().maxX());
+            limitDelta.setWidth(m_scrollableArea->contentsSize().width() - (m_scrollableArea->visibleContentRect().maxX() + m_scrollableArea->scrollOrigin().x()));
         }
     }
     
@@ -793,6 +839,8 @@ bool ScrollAnimatorMac::allowsHorizontalStretching() const
 
 void ScrollAnimatorMac::smoothScrollWithEvent(PlatformWheelEvent& wheelEvent)
 {
+    m_haveScrolledSincePageLoad = true;
+
     float deltaX = m_overflowScrollDelta.width();
     float deltaY = m_overflowScrollDelta.height();
 
@@ -925,7 +973,7 @@ void ScrollAnimatorMac::smoothScrollWithEvent(PlatformWheelEvent& wheelEvent)
             m_stretchScrollForce.setHeight(m_stretchScrollForce.height() + deltaY);
 
             FloatSize dampedDelta(ceilf(elasticDeltaForReboundDelta(m_stretchScrollForce.width())), ceilf(elasticDeltaForReboundDelta(m_stretchScrollForce.height())));
-            FloatPoint origOrigin = m_scrollableArea->visibleContentRect().location() - stretchAmount;
+            FloatPoint origOrigin = (m_scrollableArea->visibleContentRect().location() + m_scrollableArea->scrollOrigin()) - stretchAmount;
             FloatPoint newOrigin = origOrigin + dampedDelta;
 
             if (origOrigin != newOrigin) {
@@ -945,6 +993,7 @@ void ScrollAnimatorMac::smoothScrollWithEvent(PlatformWheelEvent& wheelEvent)
 
 void ScrollAnimatorMac::beginScrollGesture()
 {
+    m_haveScrolledSincePageLoad = true;
     m_inScrollGesture = true;
     m_momentumScrollInProgress = false;
     m_ignoreMomentumScrolls = false;
@@ -1017,7 +1066,7 @@ void ScrollAnimatorMac::snapRubberBandTimerFired(Timer<ScrollAnimatorMac>*)
                 return;
             }
 
-            m_origOrigin = m_scrollableArea->visibleContentRect().location() - m_startStretch;
+            m_origOrigin = (m_scrollableArea->visibleContentRect().location() + m_scrollableArea->scrollOrigin()) - m_startStretch;
             m_origVelocity = m_momentumVelocity;
 
             // Just like normal scrolling, prefer vertical rubberbanding
@@ -1069,6 +1118,28 @@ void ScrollAnimatorMac::snapRubberBandTimerFired(Timer<ScrollAnimatorMac>*)
 }
 #endif
 
+#if USE(WK_SCROLLBAR_PAINTER)
+void ScrollAnimatorMac::startScrollbarPaintTimer()
+{
+    m_initialScrollbarPaintTimer.startOneShot(0.1);
+}
+
+bool ScrollAnimatorMac::scrollbarPaintTimerIsActive() const
+{
+    return m_initialScrollbarPaintTimer.isActive();
+}
+
+void ScrollAnimatorMac::stopScrollbarPaintTimer()
+{
+    m_initialScrollbarPaintTimer.stop();
+}
+
+void ScrollAnimatorMac::initialScrollbarPaintTimerFired(Timer<ScrollAnimatorMac>*)
+{
+    wkScrollbarPainterForceFlashScrollers(m_scrollbarPainterController.get());
+}
+#endif
+
 } // namespace WebCore
 
 #endif // ENABLE(SMOOTH_SCROLLING)
diff --git a/Source/WebCore/platform/mac/ScrollbarThemeMac.h b/Source/WebCore/platform/mac/ScrollbarThemeMac.h
index 844a088..bd56808 100644
--- a/Source/WebCore/platform/mac/ScrollbarThemeMac.h
+++ b/Source/WebCore/platform/mac/ScrollbarThemeMac.h
@@ -26,7 +26,6 @@
 #ifndef ScrollbarThemeMac_h
 #define ScrollbarThemeMac_h
 
-#include "HeaderDetection.h"
 #include "ScrollbarThemeComposite.h"
 #include "WebCoreSystemInterface.h"
 
@@ -52,7 +51,7 @@ public:
     virtual void registerScrollbar(Scrollbar*);
     virtual void unregisterScrollbar(Scrollbar*);
 
-#if defined(USE_WK_SCROLLBAR_PAINTER_AND_CONTROLLER)
+#if USE(WK_SCROLLBAR_PAINTER)
     void setNewPainterForScrollbar(Scrollbar*, WKScrollbarPainterRef);
     WKScrollbarPainterRef painterForScrollbar(Scrollbar*);
 #endif
diff --git a/Source/WebCore/platform/mac/ScrollbarThemeMac.mm b/Source/WebCore/platform/mac/ScrollbarThemeMac.mm
index 5a3796d..5504f5c 100644
--- a/Source/WebCore/platform/mac/ScrollbarThemeMac.mm
+++ b/Source/WebCore/platform/mac/ScrollbarThemeMac.mm
@@ -169,7 +169,7 @@ void ScrollbarThemeMac::unregisterScrollbar(Scrollbar* scrollbar)
     scrollbarMap()->remove(scrollbar);
 }
 
-#if defined(USE_WK_SCROLLBAR_PAINTER_AND_CONTROLLER)
+#if USE(WK_SCROLLBAR_PAINTER)
 void ScrollbarThemeMac::setNewPainterForScrollbar(Scrollbar* scrollbar, WKScrollbarPainterRef newPainter)
 {
     scrollbarMap()->set(scrollbar, newPainter);
@@ -440,7 +440,11 @@ bool ScrollbarThemeMac::paint(Scrollbar* scrollbar, GraphicsContext* context, co
         overhang = scrollbar->currentPos() + scrollbar->visibleSize() - scrollbar->totalSize();
     } else {
         // Within the bounds of the scrollable area.
-        value = scrollbar->currentPos() / scrollbar->maximum();
+        int maximum = scrollbar->maximum();
+        if (maximum > 0)
+            value = scrollbar->currentPos() / maximum;
+        else
+            value = 0;
     }
 
     ScrollAnimatorMac* scrollAnimator = static_cast<ScrollAnimatorMac*>(scrollbar->scrollableArea()->scrollAnimator());
diff --git a/Source/WebCore/platform/mac/ThemeMac.mm b/Source/WebCore/platform/mac/ThemeMac.mm
index e510ea7..918bc07 100644
--- a/Source/WebCore/platform/mac/ThemeMac.mm
+++ b/Source/WebCore/platform/mac/ThemeMac.mm
@@ -52,6 +52,11 @@ using namespace std;
     return nil;
 }
 
+- (BOOL)_automaticFocusRingDisabled
+{
+    return YES;
+}
+
 - (NSRect)_focusRingVisibleRect
 {
     return [self visibleRect];
diff --git a/Source/WebCore/platform/mac/WebCoreObjCExtras.mm b/Source/WebCore/platform/mac/WebCoreObjCExtras.mm
index 05d3e01..5a2d564 100644
--- a/Source/WebCore/platform/mac/WebCoreObjCExtras.mm
+++ b/Source/WebCore/platform/mac/WebCoreObjCExtras.mm
@@ -26,6 +26,11 @@
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
+// This file intentionally calls objc_finalizeOnMainThread, which is deprecated.
+// According to http://gcc.gnu.org/onlinedocs/gcc-4.2.1/gcc/Diagnostic-Pragmas.html#Diagnostic-Pragmas
+// we need to place this directive before any data or functions are defined.
+#pragma GCC diagnostic ignored "-Wdeprecated-declarations"
+
 #include "config.h"
 #include "WebCoreObjCExtras.h"
 
diff --git a/Source/WebCore/platform/mac/WebCoreSystemInterface.h b/Source/WebCore/platform/mac/WebCoreSystemInterface.h
index df65ff2..308a551 100644
--- a/Source/WebCore/platform/mac/WebCoreSystemInterface.h
+++ b/Source/WebCore/platform/mac/WebCoreSystemInterface.h
@@ -86,6 +86,8 @@ class QTMovie;
 class QTMovieView;
 #endif
 
+typedef struct _CFURLResponse *CFURLResponseRef;
+
 extern "C" {
 
 // In alphabetical order.
@@ -115,6 +117,7 @@ extern BOOL (*wkGetGlyphTransformedAdvances)(CGFontRef, NSFont*, CGAffineTransfo
 extern void (*wkDrawMediaSliderTrack)(int themeStyle, CGContextRef context, CGRect rect, float timeLoaded, float currentTime, 
     float duration, unsigned state);
 extern void (*wkDrawMediaUIPart)(int part, int themeStyle, CGContextRef context, CGRect rect, unsigned state);
+extern CFStringRef (*wkSignedPublicKeyAndChallengeString)(unsigned keySize, CFStringRef challenge, CFStringRef keyDescription);
 extern NSString* (*wkGetPreferredExtensionForMIMEType)(NSString*);
 extern NSArray* (*wkGetExtensionsForMIMEType)(NSString*);
 extern NSString* (*wkGetMIMETypeForExtension)(NSString*);
@@ -194,10 +197,13 @@ extern CGContextRef (*wkIOSurfaceContextCreate)(IOSurfaceRef surface, unsigned w
 extern CGImageRef (*wkIOSurfaceContextCreateImage)(CGContextRef context);
 
 typedef struct __WKScrollbarPainter *WKScrollbarPainterRef;
+typedef struct __WKScrollbarPainterController *WKScrollbarPainterControllerRef;
+
 extern WKScrollbarPainterRef (*wkMakeScrollbarPainter)(int controlSize, bool isHorizontal);
 extern WKScrollbarPainterRef (*wkMakeScrollbarReplacementPainter)(WKScrollbarPainterRef oldPainter, int newStyle, int controlSize, bool isHorizontal);
 extern void (*wkScrollbarPainterSetDelegate)(WKScrollbarPainterRef, id scrollbarPainterDelegate);
 extern void (*wkScrollbarPainterPaint)(WKScrollbarPainterRef, bool enabled, double value, CGFloat proportion, CGRect frameRect);
+extern void (*wkScrollbarPainterForceFlashScrollers)(WKScrollbarPainterControllerRef);
 extern int (*wkScrollbarThickness)(int controlSize);
 extern int (*wkScrollbarMinimumThumbLength)(WKScrollbarPainterRef);
 extern int (*wkScrollbarMinimumTotalLengthNeededForThumb)(WKScrollbarPainterRef);
@@ -208,7 +214,6 @@ extern void (*wkSetScrollbarPainterTrackAlpha)(WKScrollbarPainterRef, CGFloat);
 extern bool (*wkScrollbarPainterIsHorizontal)(WKScrollbarPainterRef);
 extern void (*wkScrollbarPainterSetOverlayState)(WKScrollbarPainterRef, int overlayScrollerState);
 
-typedef struct __WKScrollbarPainterController *WKScrollbarPainterControllerRef;
 extern WKScrollbarPainterControllerRef (*wkMakeScrollbarPainterController)(id painterControllerDelegate);
 extern void (*wkSetPainterForPainterController)(WKScrollbarPainterControllerRef, WKScrollbarPainterRef, bool isHorizontal);
 extern WKScrollbarPainterRef (*wkVerticalScrollbarPainterForController)(WKScrollbarPainterControllerRef);
@@ -244,12 +249,18 @@ extern CFURLStorageSessionRef (*wkCreatePrivateStorageSession)(CFStringRef);
 extern NSURLRequest* (*wkCopyRequestWithStorageSession)(CFURLStorageSessionRef, NSURLRequest*);
 
 typedef struct OpaqueCFHTTPCookieStorage* CFHTTPCookieStorageRef;
-extern CFHTTPCookieStorageRef (*wkCreatePrivateInMemoryHTTPCookieStorage)(CFURLStorageSessionRef);
+extern CFHTTPCookieStorageRef (*wkCopyHTTPCookieStorage)(CFURLStorageSessionRef);
 extern unsigned (*wkGetHTTPCookieAcceptPolicy)(CFHTTPCookieStorageRef);
 extern NSArray *(*wkHTTPCookiesForURL)(CFHTTPCookieStorageRef, NSURL *);
 extern void (*wkSetHTTPCookiesForURL)(CFHTTPCookieStorageRef, NSArray *, NSURL *, NSURL *);
 extern void (*wkDeleteHTTPCookie)(CFHTTPCookieStorageRef, NSHTTPCookie *);
 
+extern CFStringRef (*wkGetCFURLResponseMIMEType)(CFURLResponseRef);
+extern CFURLRef (*wkGetCFURLResponseURL)(CFURLResponseRef);
+extern CFHTTPMessageRef (*wkGetCFURLResponseHTTPResponse)(CFURLResponseRef);
+extern CFStringRef (*wkCopyCFURLResponseSuggestedFilename)(CFURLResponseRef);
+extern void (*wkSetCFURLResponseMIMEType)(CFURLResponseRef, CFStringRef mimeType);
+
 }
 
 #endif
diff --git a/Source/WebCore/platform/mac/WebCoreSystemInterface.mm b/Source/WebCore/platform/mac/WebCoreSystemInterface.mm
index 50ac236..ab059bd 100644
--- a/Source/WebCore/platform/mac/WebCoreSystemInterface.mm
+++ b/Source/WebCore/platform/mac/WebCoreSystemInterface.mm
@@ -48,6 +48,7 @@ void (*wkDrawMediaUIPart)(int part, int themeStyle, CGContextRef context, CGRect
 void (*wkMeasureMediaUIPart)(int part, int themeStyle, CGRect *bounds, CGSize *naturalSize);
 BOOL (*wkMediaControllerThemeAvailable)(int themeStyle);
 NSString* (*wkGetPreferredExtensionForMIMEType)(NSString*);
+CFStringRef (*wkSignedPublicKeyAndChallengeString)(unsigned keySize, CFStringRef challenge, CFStringRef keyDescription);
 NSArray* (*wkGetExtensionsForMIMEType)(NSString*);
 NSString* (*wkGetMIMETypeForExtension)(NSString*);
 NSTimeInterval (*wkGetNSURLResponseCalculatedExpiration)(NSURLResponse *response);
@@ -132,6 +133,7 @@ WKScrollbarPainterRef (*wkMakeScrollbarPainter)(int controlSize, bool isHorizont
 WKScrollbarPainterRef (*wkMakeScrollbarReplacementPainter)(WKScrollbarPainterRef oldPainter, int newStyle, int controlSize, bool isHorizontal);
 void (*wkScrollbarPainterSetDelegate)(WKScrollbarPainterRef, id scrollbarPainterDelegate);
 void (*wkScrollbarPainterPaint)(WKScrollbarPainterRef, bool enabled, double value, CGFloat proportion, CGRect frameRect);
+void (*wkScrollbarPainterForceFlashScrollers)(WKScrollbarPainterControllerRef);
 int (*wkScrollbarThickness)(int controlSize);
 int (*wkScrollbarMinimumThumbLength)(WKScrollbarPainterRef);
 int (*wkScrollbarMinimumTotalLengthNeededForThumb)(WKScrollbarPainterRef);
@@ -174,8 +176,14 @@ AXUIElementRef (*wkCreateAXUIElementRef)(id element);
 
 CFURLStorageSessionRef (*wkCreatePrivateStorageSession)(CFStringRef);
 NSURLRequest* (*wkCopyRequestWithStorageSession)(CFURLStorageSessionRef, NSURLRequest*);
-CFHTTPCookieStorageRef (*wkCreatePrivateInMemoryHTTPCookieStorage)(CFURLStorageSessionRef);
+CFHTTPCookieStorageRef (*wkCopyHTTPCookieStorage)(CFURLStorageSessionRef);
 unsigned (*wkGetHTTPCookieAcceptPolicy)(CFHTTPCookieStorageRef);
 NSArray *(*wkHTTPCookiesForURL)(CFHTTPCookieStorageRef, NSURL *);
 void (*wkSetHTTPCookiesForURL)(CFHTTPCookieStorageRef, NSArray *, NSURL *, NSURL *);
 void (*wkDeleteHTTPCookie)(CFHTTPCookieStorageRef, NSHTTPCookie *);
+
+CFStringRef (*wkGetCFURLResponseMIMEType)(CFURLResponseRef);
+CFURLRef (*wkGetCFURLResponseURL)(CFURLResponseRef);
+CFHTTPMessageRef (*wkGetCFURLResponseHTTPResponse)(CFURLResponseRef);
+CFStringRef (*wkCopyCFURLResponseSuggestedFilename)(CFURLResponseRef);
+void (*wkSetCFURLResponseMIMEType)(CFURLResponseRef, CFStringRef mimeType);
diff --git a/Source/WebCore/platform/mac/WidgetMac.mm b/Source/WebCore/platform/mac/WidgetMac.mm
index 96bcde2..f75faaa 100644
--- a/Source/WebCore/platform/mac/WidgetMac.mm
+++ b/Source/WebCore/platform/mac/WidgetMac.mm
@@ -115,10 +115,15 @@ void Widget::setFocus(bool focused)
 
     BEGIN_BLOCK_OBJC_EXCEPTIONS;
  
+    // If there's no platformWidget, WK2 is running. The focus() method needs to be used
+    // to bring focus to the right view on the UIProcess side.
     NSView *view = [platformWidget() _webcore_effectiveFirstResponder];
-    if (Page* page = frame->page())
-        page->chrome()->focusNSView(view);
-    
+    if (Page* page = frame->page()) {
+        if (!platformWidget())
+            page->chrome()->focus();
+        else
+            page->chrome()->focusNSView(view);
+    }
     END_BLOCK_OBJC_EXCEPTIONS;
 }
 
diff --git a/Source/WebCore/platform/mock/GeolocationClientMock.cpp b/Source/WebCore/platform/mock/GeolocationClientMock.cpp
index 5255b34..d067c8a 100644
--- a/Source/WebCore/platform/mock/GeolocationClientMock.cpp
+++ b/Source/WebCore/platform/mock/GeolocationClientMock.cpp
@@ -79,6 +79,11 @@ void GeolocationClientMock::setPermission(bool allowed)
     asyncUpdatePermission();
 }
 
+int GeolocationClientMock::numberOfPendingPermissionRequests() const
+{
+    return m_pendingPermission.size();
+}
+
 void GeolocationClientMock::requestPermission(Geolocation* geolocation)
 {
     m_pendingPermission.add(geolocation);
diff --git a/Source/WebCore/platform/mock/GeolocationClientMock.h b/Source/WebCore/platform/mock/GeolocationClientMock.h
index df35316..b400166 100644
--- a/Source/WebCore/platform/mock/GeolocationClientMock.h
+++ b/Source/WebCore/platform/mock/GeolocationClientMock.h
@@ -59,6 +59,7 @@ public:
     void setError(PassRefPtr<GeolocationError>);
     void setPosition(PassRefPtr<GeolocationPosition>);
     void setPermission(bool allowed);
+    int numberOfPendingPermissionRequests() const;
 
     // GeolocationClient
     virtual void geolocationDestroyed();
diff --git a/Source/WebCore/platform/network/BlobData.h b/Source/WebCore/platform/network/BlobData.h
index c1f5522..f919d64 100644
--- a/Source/WebCore/platform/network/BlobData.h
+++ b/Source/WebCore/platform/network/BlobData.h
@@ -34,11 +34,11 @@
 #include "KURL.h"
 #include "PlatformString.h"
 #include <wtf/Forward.h>
-#include <wtf/ThreadSafeShared.h>
+#include <wtf/ThreadSafeRefCounted.h>
 
 namespace WebCore {
 
-class RawData : public ThreadSafeShared<RawData> {
+class RawData : public ThreadSafeRefCounted<RawData> {
 public:
     static PassRefPtr<RawData> create()
     {
diff --git a/Source/WebCore/platform/network/FormDataBuilder.cpp b/Source/WebCore/platform/network/FormDataBuilder.cpp
index e973f99..3174614 100644
--- a/Source/WebCore/platform/network/FormDataBuilder.cpp
+++ b/Source/WebCore/platform/network/FormDataBuilder.cpp
@@ -32,6 +32,7 @@
 
 #include <limits>
 #include <wtf/Assertions.h>
+#include <wtf/HexNumber.h>
 #include <wtf/text/CString.h>
 #include <wtf/RandomNumber.h>
 
@@ -192,8 +193,6 @@ void FormDataBuilder::addKeyValuePairAsFormData(Vector<char>& buffer, const CStr
 
 void FormDataBuilder::encodeStringAsFormData(Vector<char>& buffer, const CString& string)
 {
-    static const char hexDigits[17] = "0123456789ABCDEF";
-
     // Same safe characters as Netscape for compatibility.
     static const char safeCharacters[] = "-._*";
 
@@ -210,8 +209,7 @@ void FormDataBuilder::encodeStringAsFormData(Vector<char>& buffer, const CString
             append(buffer, "%0D%0A");
         else if (c != '\r') {
             append(buffer, '%');
-            append(buffer, hexDigits[c >> 4]);
-            append(buffer, hexDigits[c & 0xF]);
+            appendByteAsHex(c, buffer);
         }
     }
 }
diff --git a/Source/WebCore/platform/network/ProtectionSpace.h b/Source/WebCore/platform/network/ProtectionSpace.h
index deb59d2..87758e1 100644
--- a/Source/WebCore/platform/network/ProtectionSpace.h
+++ b/Source/WebCore/platform/network/ProtectionSpace.h
@@ -49,7 +49,7 @@ enum ProtectionSpaceAuthenticationScheme {
     ProtectionSpaceAuthenticationSchemeNegotiate = 6,
     ProtectionSpaceAuthenticationSchemeClientCertificateRequested = 7,
     ProtectionSpaceAuthenticationSchemeServerTrustEvaluationRequested = 8,
-    ProtectionSpaceAuthenticationSchemeUnknown = 100,
+    ProtectionSpaceAuthenticationSchemeUnknown = 100
 };
   
 class ProtectionSpace {
diff --git a/Source/WebCore/platform/network/ProtectionSpaceHash.h b/Source/WebCore/platform/network/ProtectionSpaceHash.h
index 9934321..40eb9b6 100644
--- a/Source/WebCore/platform/network/ProtectionSpaceHash.h
+++ b/Source/WebCore/platform/network/ProtectionSpaceHash.h
@@ -46,7 +46,7 @@ struct ProtectionSpaceHash {
         // Ignore realm for proxies.
         if (protectionSpace.isProxy())
             codeCount -= sizeof(hashCodes[0]);
-        return WTF::StringHasher::createBlobHash(hashCodes, codeCount);
+        return StringHasher::hashMemory(hashCodes, codeCount);
     }
     
     static bool equal(const ProtectionSpace& a, const ProtectionSpace& b) { return a == b; }
diff --git a/Source/WebCore/platform/network/ResourceErrorBase.cpp b/Source/WebCore/platform/network/ResourceErrorBase.cpp
index 42bc0de..e1d29e0 100644
--- a/Source/WebCore/platform/network/ResourceErrorBase.cpp
+++ b/Source/WebCore/platform/network/ResourceErrorBase.cpp
@@ -42,6 +42,7 @@ ResourceError ResourceErrorBase::copy() const
     errorCopy.m_localizedDescription = m_localizedDescription.crossThreadString();
     errorCopy.m_isNull = m_isNull;
     errorCopy.m_isCancellation = m_isCancellation;
+    platformCopy(errorCopy);
     return errorCopy;
 }
 
diff --git a/Source/WebCore/platform/network/ResourceErrorBase.h b/Source/WebCore/platform/network/ResourceErrorBase.h
index a6b7c69..2d7be70 100644
--- a/Source/WebCore/platform/network/ResourceErrorBase.h
+++ b/Source/WebCore/platform/network/ResourceErrorBase.h
@@ -74,6 +74,9 @@ protected:
     // The ResourceError subclass may "shadow" this method to lazily initialize platform specific fields
     void platformLazyInit() {}
 
+    // The ResourceError subclass may "shadow" this method to copy platform specific fields
+    void platformCopy(ResourceError&) const {}
+
     // The ResourceError subclass may "shadow" this method to compare platform specific fields
     static bool platformCompare(const ResourceError&, const ResourceError&) { return true; }
 
diff --git a/Source/WebCore/platform/network/ResourceHandleClient.h b/Source/WebCore/platform/network/ResourceHandleClient.h
index d9350ee..e92b376 100644
--- a/Source/WebCore/platform/network/ResourceHandleClient.h
+++ b/Source/WebCore/platform/network/ResourceHandleClient.h
@@ -59,7 +59,7 @@ namespace WebCore {
     enum CacheStoragePolicy {
         StorageAllowed,
         StorageAllowedInMemoryOnly,
-        StorageNotAllowed,
+        StorageNotAllowed
     };
     
     class ResourceHandleClient {
@@ -78,6 +78,11 @@ namespace WebCore {
         virtual void wasBlocked(ResourceHandle*) { }
         virtual void cannotShowURL(ResourceHandle*) { }
 
+#if HAVE(CFNETWORK_DATA_ARRAY_CALLBACK)
+        virtual bool supportsDataArray() { return false; }
+        virtual void didReceiveDataArray(ResourceHandle*, CFArrayRef) { }
+#endif
+
         virtual void willCacheResponse(ResourceHandle*, CacheStoragePolicy&) { }
 
         virtual bool shouldUseCredentialStorage(ResourceHandle*) { return false; }
diff --git a/Source/WebCore/platform/network/ResourceRequestBase.h b/Source/WebCore/platform/network/ResourceRequestBase.h
index ec7e32a..31a1e69 100644
--- a/Source/WebCore/platform/network/ResourceRequestBase.h
+++ b/Source/WebCore/platform/network/ResourceRequestBase.h
@@ -41,7 +41,7 @@ namespace WebCore {
         UseProtocolCachePolicy, // normal load
         ReloadIgnoringCacheData, // reload
         ReturnCacheDataElseLoad, // back/forward or encoding change - allow stale data
-        ReturnCacheDataDontLoad, // results of a post - allow stale data and only use cache
+        ReturnCacheDataDontLoad  // results of a post - allow stale data and only use cache
     };
 
     class ResourceRequest;
diff --git a/Source/WebCore/platform/network/cf/CookieStorageCFNet.cpp b/Source/WebCore/platform/network/cf/CookieStorageCFNet.cpp
index c2a5691..2eac3f6 100644
--- a/Source/WebCore/platform/network/cf/CookieStorageCFNet.cpp
+++ b/Source/WebCore/platform/network/cf/CookieStorageCFNet.cpp
@@ -42,7 +42,7 @@
 
 namespace WebCore {
 
-static RetainPtr<CFHTTPCookieStorageRef>& privateBrowsingCookieStorage()
+static RetainPtr<CFHTTPCookieStorageRef>& privateCookieStorage()
 {
     DEFINE_STATIC_LOCAL(RetainPtr<CFHTTPCookieStorageRef>, cookieStorage, ());
     return cookieStorage;
@@ -52,16 +52,21 @@ CFHTTPCookieStorageRef currentCookieStorage()
 {
     ASSERT(isMainThread());
 
-    if (CFHTTPCookieStorageRef privateCookieStorage = privateBrowsingCookieStorage().get())
-        return privateCookieStorage;
+    if (CFHTTPCookieStorageRef cookieStorage = privateCookieStorage().get())
+        return cookieStorage;
     return wkGetDefaultHTTPCookieStorage();
 }
 
+CFHTTPCookieStorageRef privateBrowsingCookieStorage()
+{
+    return privateCookieStorage().get();
+}
+
 void setCurrentCookieStorage(CFHTTPCookieStorageRef cookieStorage)
 {
     ASSERT(isMainThread());
 
-    privateBrowsingCookieStorage().adoptCF(cookieStorage);
+    privateCookieStorage().adoptCF(cookieStorage);
 }
 
 void setCookieStoragePrivateBrowsingEnabled(bool enabled)
@@ -69,15 +74,21 @@ void setCookieStoragePrivateBrowsingEnabled(bool enabled)
     ASSERT(isMainThread());
 
     if (!enabled) {
-        privateBrowsingCookieStorage() = nullptr;
+        privateCookieStorage() = nullptr;
         return;
     }
 
 #if USE(CFURLSTORAGESESSIONS)
-    privateBrowsingCookieStorage().adoptCF(wkCreatePrivateInMemoryHTTPCookieStorage(ResourceHandle::privateBrowsingStorageSession()));
-#else
-    privateBrowsingCookieStorage().adoptCF(wkCreatePrivateInMemoryHTTPCookieStorage(0));
+    if (CFURLStorageSessionRef privateStorageSession = ResourceHandle::privateBrowsingStorageSession())
+        privateCookieStorage().adoptCF(wkCopyHTTPCookieStorage(privateStorageSession));
+    else
 #endif
+        privateCookieStorage().adoptCF(wkCreateInMemoryHTTPCookieStorage());
+}
+
+CFHTTPCookieStorageRef defaultCookieStorage()
+{
+    return wkGetDefaultHTTPCookieStorage();
 }
 
 static void notifyCookiesChangedOnMainThread(void* context)
diff --git a/Source/WebCore/platform/network/cf/CookieStorageCFNet.h b/Source/WebCore/platform/network/cf/CookieStorageCFNet.h
index 0167587..d33c76e 100644
--- a/Source/WebCore/platform/network/cf/CookieStorageCFNet.h
+++ b/Source/WebCore/platform/network/cf/CookieStorageCFNet.h
@@ -33,6 +33,8 @@ typedef struct OpaqueCFHTTPCookieStorage*  CFHTTPCookieStorageRef;
 namespace WebCore {
 
     CFHTTPCookieStorageRef currentCookieStorage();
+    CFHTTPCookieStorageRef defaultCookieStorage();
+    CFHTTPCookieStorageRef privateBrowsingCookieStorage();
 
     // Needed for WebKit1 API only.
     void setCurrentCookieStorage(CFHTTPCookieStorageRef cookieStorage);
diff --git a/Source/WebCore/platform/network/cf/LoaderRunLoopCF.h b/Source/WebCore/platform/network/cf/LoaderRunLoopCF.h
index e0d3ba4..272acf9 100644
--- a/Source/WebCore/platform/network/cf/LoaderRunLoopCF.h
+++ b/Source/WebCore/platform/network/cf/LoaderRunLoopCF.h
@@ -29,7 +29,7 @@
 #if USE(CFNETWORK)
 
 #if !PLATFORM(WIN)
-#error This code is not needed on platforms other than Windows, because main thread's CFRunLoop can be used.
+#error This code is not needed on platforms other than Windows, because the CFRunLoop from the main thread can be used.
 #endif
 
 typedef struct __CFRunLoop* CFRunLoopRef;
diff --git a/Source/WebCore/platform/network/cf/ResourceError.h b/Source/WebCore/platform/network/cf/ResourceError.h
index aae9a4a..d36903f 100644
--- a/Source/WebCore/platform/network/cf/ResourceError.h
+++ b/Source/WebCore/platform/network/cf/ResourceError.h
@@ -32,6 +32,7 @@
 #if USE(CFNETWORK)
 #include <CoreFoundation/CFStream.h>
 #else
+
 #ifdef __OBJC__
 @class NSError;
 #else
@@ -54,38 +55,38 @@ public:
     {
     }
 
-#if USE(CFNETWORK)
-    ResourceError(CFStreamError error);
-
-    ResourceError(CFErrorRef error)
-        : m_dataIsUpToDate(false)
-        , m_platformError(error)
-    {
-        m_isNull = !error;
-    }
+    ResourceError(CFErrorRef error);
 
+    CFErrorRef cfError() const;
     operator CFErrorRef() const;
+
+#if USE(CFNETWORK)
+#if PLATFORM(WIN)
+    ResourceError(const String& domain, int errorCode, const String& failingURL, const String& localizedDescription, CFDataRef certificate);
+    PCCERT_CONTEXT certificate() const;
+#endif
+    ResourceError(CFStreamError error);
+    CFStreamError cfStreamError() const;
     operator CFStreamError() const;
 #else
-    ResourceError(NSError* error)
-        : m_dataIsUpToDate(false)
-        , m_platformError(error)
-    {
-        m_isNull = !error;
-    }
-
-    operator NSError*() const;
+    ResourceError(NSError *);
+    NSError *nsError() const;
+    operator NSError *() const;
 #endif
 
 private:
     friend class ResourceErrorBase;
 
     void platformLazyInit();
+    void platformCopy(ResourceError&) const;
     static bool platformCompare(const ResourceError& a, const ResourceError& b);
 
     bool m_dataIsUpToDate;
 #if USE(CFNETWORK)
     mutable RetainPtr<CFErrorRef> m_platformError;
+#if PLATFORM(WIN)
+    RetainPtr<CFDataRef> m_certificate;
+#endif
 #else
     mutable RetainPtr<NSError> m_platformError;
 #endif
diff --git a/Source/WebCore/platform/network/cf/ResourceErrorCF.cpp b/Source/WebCore/platform/network/cf/ResourceErrorCF.cpp
index 1eba97e..556ad6e 100644
--- a/Source/WebCore/platform/network/cf/ResourceErrorCF.cpp
+++ b/Source/WebCore/platform/network/cf/ResourceErrorCF.cpp
@@ -24,44 +24,46 @@
  */
 
 #include "config.h"
-#include "KURL.h"
 #include "ResourceError.h"
 
 #if USE(CFNETWORK)
 
-// FIXME: Once <rdar://problem/5050881> is fixed in open source we
-// can remove this extern "C"
-extern "C" { 
-#include <CFNetwork/CFNetworkErrors.h>
-}
-
+#include "KURL.h"
 #include <CoreFoundation/CFError.h>
+#include <CFNetwork/CFNetworkErrors.h>
+#if PLATFORM(WIN)
+#include <WebKitSystemInterface/WebKitSystemInterface.h>
+#endif
 #include <WTF/RetainPtr.h>
 
 namespace WebCore {
 
-const CFStringRef failingURLStringKey = CFSTR("NSErrorFailingURLStringKey");
-const CFStringRef failingURLKey = CFSTR("NSErrorFailingURLKey");
+ResourceError::ResourceError(CFErrorRef cfError)
+    : m_dataIsUpToDate(false)
+    , m_platformError(cfError)
+{
+    m_isNull = !cfError;
+}
 
-// FIXME: Once <rdar://problem/5050841> is fixed we can remove this constructor.
-ResourceError::ResourceError(CFStreamError error)
-    : m_dataIsUpToDate(true)
+#if PLATFORM(WIN)
+ResourceError::ResourceError(const String& domain, int errorCode, const String& failingURL, const String& localizedDescription, CFDataRef certificate)
+    : ResourceErrorBase(domain, errorCode, failingURL, localizedDescription)
+    , m_dataIsUpToDate(true)
+    , m_certificate(certificate)
 {
-    m_isNull = false;
-    m_errorCode = error.error;
+}
 
-    switch(error.domain) {
-    case kCFStreamErrorDomainCustom:
-        m_domain ="NSCustomErrorDomain";
-        break;
-    case kCFStreamErrorDomainPOSIX:
-        m_domain = "NSPOSIXErrorDomain";
-        break;
-    case kCFStreamErrorDomainMacOSStatus:
-        m_domain = "NSOSStatusErrorDomain";
-        break;
-    }
+PCCERT_CONTEXT ResourceError::certificate() const
+{
+    if (!m_certificate)
+        return 0;
+    
+    return reinterpret_cast<PCCERT_CONTEXT>(CFDataGetBytePtr(m_certificate.get()));
 }
+#endif // PLATFORM(WIN)
+
+const CFStringRef failingURLStringKey = CFSTR("NSErrorFailingURLStringKey");
+const CFStringRef failingURLKey = CFSTR("NSErrorFailingURLKey");
 
 void ResourceError::platformLazyInit()
 {
@@ -101,23 +103,34 @@ void ResourceError::platformLazyInit()
             }
         }
         m_localizedDescription = (CFStringRef) CFDictionaryGetValue(userInfo.get(), kCFErrorLocalizedDescriptionKey);
+        
+#if PLATFORM(WIN)
+        m_certificate = wkGetSSLPeerCertificateData(userInfo.get());
+#endif
     }
 
     m_dataIsUpToDate = true;
 }
 
+void ResourceError::platformCopy(ResourceError& errorCopy) const
+{
+#if PLATFORM(WIN)
+    errorCopy.m_certificate = m_certificate;
+#endif
+}
+
 bool ResourceError::platformCompare(const ResourceError& a, const ResourceError& b)
 {
-    return (CFErrorRef)a == (CFErrorRef)b;
+    return a.cfError() == b.cfError();
 }
 
-ResourceError::operator CFErrorRef() const
+CFErrorRef ResourceError::cfError() const
 {
     if (m_isNull) {
         ASSERT(!m_platformError);
         return 0;
     }
-    
+
     if (!m_platformError) {
         RetainPtr<CFMutableDictionaryRef> userInfo(AdoptCF, CFDictionaryCreateMutable(0, 0, &kCFTypeDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks));
 
@@ -133,6 +146,11 @@ ResourceError::operator CFErrorRef() const
             CFDictionarySetValue(userInfo.get(), failingURLKey, url.get());
         }
 
+#if PLATFORM(WIN)
+        if (m_certificate)
+            wkSetSSLPeerCertificateData(userInfo.get(), m_certificate.get());
+#endif
+        
         RetainPtr<CFStringRef> domainString(AdoptCF, m_domain.createCFString());
         m_platformError.adoptCF(CFErrorCreate(0, domainString.get(), m_errorCode, userInfo.get()));
     }
@@ -140,7 +158,32 @@ ResourceError::operator CFErrorRef() const
     return m_platformError.get();
 }
 
-ResourceError::operator CFStreamError() const
+ResourceError::operator CFErrorRef() const
+{
+    return cfError();
+}
+
+// FIXME: Once <rdar://problem/5050841> is fixed we can remove this constructor.
+ResourceError::ResourceError(CFStreamError error)
+    : m_dataIsUpToDate(true)
+{
+    m_isNull = false;
+    m_errorCode = error.error;
+
+    switch(error.domain) {
+    case kCFStreamErrorDomainCustom:
+        m_domain ="NSCustomErrorDomain";
+        break;
+    case kCFStreamErrorDomainPOSIX:
+        m_domain = "NSPOSIXErrorDomain";
+        break;
+    case kCFStreamErrorDomainMacOSStatus:
+        m_domain = "NSOSStatusErrorDomain";
+        break;
+    }
+}
+
+CFStreamError ResourceError::cfStreamError() const
 {
     lazyInit();
 
@@ -159,6 +202,11 @@ ResourceError::operator CFStreamError() const
     return result;
 }
 
+ResourceError::operator CFStreamError() const
+{
+    return cfStreamError();
+}
+
 } // namespace WebCore
 
 #endif // USE(CFNETWORK)
diff --git a/Source/WebCore/platform/network/cf/ResourceRequestCFNet.h b/Source/WebCore/platform/network/cf/ResourceRequestCFNet.h
index 09f4cea..271dcd2 100644
--- a/Source/WebCore/platform/network/cf/ResourceRequestCFNet.h
+++ b/Source/WebCore/platform/network/cf/ResourceRequestCFNet.h
@@ -50,6 +50,8 @@ inline ResourceLoadPriority mapHTTPPipeliningPriorityToResourceLoadPriority(int
         return ResourceLoadPriorityMedium;
     case 2:
         return ResourceLoadPriorityHigh;
+    case 3:
+        return ResourceLoadPriorityUnresolved;
     default:
         ASSERT_NOT_REACHED();
         return ResourceLoadPriorityLowest;
@@ -67,8 +69,7 @@ inline int mapResourceLoadPriorityToHTTPPipeliningPriority(ResourceLoadPriority
     case ResourceLoadPriorityHigh:
         return 2;
     case ResourceLoadPriorityUnresolved:
-        ASSERT_NOT_REACHED();
-        return 0;
+        return 3;
     }
 
     ASSERT_NOT_REACHED();
diff --git a/Source/WebCore/platform/network/cf/ResourceResponse.h b/Source/WebCore/platform/network/cf/ResourceResponse.h
index 33b6ddc..0551ede 100644
--- a/Source/WebCore/platform/network/cf/ResourceResponse.h
+++ b/Source/WebCore/platform/network/cf/ResourceResponse.h
@@ -98,9 +98,9 @@ private:
     static bool platformCompare(const ResourceResponse& a, const ResourceResponse& b);
 
 #if USE(CFNETWORK)
-    RetainPtr<CFURLResponseRef> m_cfResponse;
+    mutable RetainPtr<CFURLResponseRef> m_cfResponse;
 #else
-    RetainPtr<NSURLResponse> m_nsResponse;
+    mutable RetainPtr<NSURLResponse> m_nsResponse;
 #endif
     bool m_isUpToDate;
 };
diff --git a/Source/WebCore/platform/network/cf/ResourceResponseCFNet.cpp b/Source/WebCore/platform/network/cf/ResourceResponseCFNet.cpp
index 167b079..d4a0b31 100644
--- a/Source/WebCore/platform/network/cf/ResourceResponseCFNet.cpp
+++ b/Source/WebCore/platform/network/cf/ResourceResponseCFNet.cpp
@@ -43,7 +43,14 @@ using namespace std;
 namespace WebCore {
 
 CFURLResponseRef ResourceResponse::cfURLResponse() const
-{  
+{
+    if (!m_cfResponse && !m_isNull) {
+        RetainPtr<CFURLRef> url(AdoptCF, m_url.createCFURL());
+        RetainPtr<CFStringRef> mimeType(AdoptCF, m_mimeType.createCFString());
+        RetainPtr<CFStringRef> textEncodingName(AdoptCF, m_textEncodingName.createCFString());
+        m_cfResponse.adoptCF(CFURLResponseCreate(0, url.get(), mimeType.get(), m_expectedContentLength, textEncodingName.get(), kCFURLCacheStorageAllowed));
+    }
+
     return m_cfResponse.get();
 }
 
diff --git a/Source/WebCore/platform/network/cf/SocketStreamHandle.h b/Source/WebCore/platform/network/cf/SocketStreamHandle.h
index 5c1c6ff..4adee70 100644
--- a/Source/WebCore/platform/network/cf/SocketStreamHandle.h
+++ b/Source/WebCore/platform/network/cf/SocketStreamHandle.h
@@ -44,14 +44,14 @@ class AuthenticationChallenge;
 class Credential;
 class SocketStreamHandleClient;
 
-class SocketStreamHandle : public RefCounted<SocketStreamHandle>, public SocketStreamHandleBase, public AuthenticationClient {
+class SocketStreamHandle : public ThreadSafeRefCounted<SocketStreamHandle>, public SocketStreamHandleBase, public AuthenticationClient {
 public:
     static PassRefPtr<SocketStreamHandle> create(const KURL& url, SocketStreamHandleClient* client) { return adoptRef(new SocketStreamHandle(url, client)); }
 
     virtual ~SocketStreamHandle();
 
-    using RefCounted<SocketStreamHandle>::ref;
-    using RefCounted<SocketStreamHandle>::deref;
+    using ThreadSafeRefCounted<SocketStreamHandle>::ref;
+    using ThreadSafeRefCounted<SocketStreamHandle>::deref;
 
 private:
     virtual int platformSend(const char* data, int length);
diff --git a/Source/WebCore/platform/network/cf/SocketStreamHandleCFNet.cpp b/Source/WebCore/platform/network/cf/SocketStreamHandleCFNet.cpp
index d5b1743..ee06c68 100644
--- a/Source/WebCore/platform/network/cf/SocketStreamHandleCFNet.cpp
+++ b/Source/WebCore/platform/network/cf/SocketStreamHandleCFNet.cpp
@@ -117,7 +117,7 @@ CFStringRef SocketStreamHandle::copyPACExecutionDescription(void*)
 
 struct MainThreadPACCallbackInfo {
     MainThreadPACCallbackInfo(SocketStreamHandle* handle, CFArrayRef proxyList) : handle(handle), proxyList(proxyList) { }
-    SocketStreamHandle* handle;
+    RefPtr<SocketStreamHandle> handle;
     CFArrayRef proxyList;
 };
 
@@ -436,7 +436,7 @@ CFStringRef SocketStreamHandle::copyCFStreamDescription(void* info)
 struct MainThreadEventCallbackInfo {
     MainThreadEventCallbackInfo(CFStreamEventType type, SocketStreamHandle* handle) : type(type), handle(handle) { }
     CFStreamEventType type;
-    SocketStreamHandle* handle;
+    RefPtr<SocketStreamHandle> handle;
 };
 
 void SocketStreamHandle::readStreamCallback(CFReadStreamRef stream, CFStreamEventType type, void* clientCallBackInfo)
diff --git a/Source/WebCore/platform/network/mac/CookieStorageMac.mm b/Source/WebCore/platform/network/mac/CookieStorageMac.mm
index db64aae..2696188 100644
--- a/Source/WebCore/platform/network/mac/CookieStorageMac.mm
+++ b/Source/WebCore/platform/network/mac/CookieStorageMac.mm
@@ -92,7 +92,7 @@ void setCookieStoragePrivateBrowsingEnabled(bool enabled)
         return;
 
     if (enabled && ResourceHandle::privateBrowsingStorageSession()) {
-        privateBrowsingCookieStorage().adoptCF(wkCreatePrivateInMemoryHTTPCookieStorage(ResourceHandle::privateBrowsingStorageSession()));
+        privateBrowsingCookieStorage().adoptCF(wkCopyHTTPCookieStorage(ResourceHandle::privateBrowsingStorageSession()));
 
         // FIXME: When Private Browsing is enabled, the Private Browsing Cookie Storage should be
         // observed for changes, not the default Cookie Storage.
@@ -116,7 +116,10 @@ void startObservingCookieChanges()
 
 void stopObservingCookieChanges()
 {
-    ASSERT(cookieStorageAdapter);
+    // cookieStorageAdapter can be nil here, if the WebProcess crashed and was restarted between
+    // when startObservingCookieChanges was called, and stopObservingCookieChanges is currently being called.
+    if (!cookieStorageAdapter)
+        return;
     [cookieStorageAdapter stopListeningForCookieChangeNotifications];
 }
 
diff --git a/Source/WebCore/platform/network/mac/FormDataStreamMac.mm b/Source/WebCore/platform/network/mac/FormDataStreamMac.mm
index eb6f601..f094842 100644
--- a/Source/WebCore/platform/network/mac/FormDataStreamMac.mm
+++ b/Source/WebCore/platform/network/mac/FormDataStreamMac.mm
@@ -192,8 +192,8 @@ static bool advanceCurrentStream(FormStreamFields* form)
         }
 #if ENABLE(BLOB)
         if (nextInput.m_fileStart > 0) {
-            CFNumberRef position = CFNumberCreate(0, kCFNumberLongLongType, &nextInput.m_fileStart);
-            CFReadStreamSetProperty(form->currentStream, kCFStreamPropertyFileCurrentOffset, position);
+            RetainPtr<CFNumberRef> position(AdoptCF, CFNumberCreate(0, kCFNumberLongLongType, &nextInput.m_fileStart));
+            CFReadStreamSetProperty(form->currentStream, kCFStreamPropertyFileCurrentOffset, position.get());
         }
         form->currentStreamRangeLength = nextInput.m_fileLength;
 #endif
diff --git a/Source/WebCore/platform/network/mac/ResourceErrorMac.mm b/Source/WebCore/platform/network/mac/ResourceErrorMac.mm
index 275ca41..0bada1f 100644
--- a/Source/WebCore/platform/network/mac/ResourceErrorMac.mm
+++ b/Source/WebCore/platform/network/mac/ResourceErrorMac.mm
@@ -28,6 +28,7 @@
 
 #import "BlockExceptions.h"
 #import "KURL.h"
+#import <CoreFoundation/CFError.h>
 #import <Foundation/Foundation.h>
 
 @interface NSError (WebExtras)
@@ -36,6 +37,20 @@
 
 namespace WebCore {
 
+ResourceError::ResourceError(NSError *nsError)
+    : m_dataIsUpToDate(false)
+    , m_platformError(nsError)
+{
+    m_isNull = !nsError;
+}
+
+ResourceError::ResourceError(CFErrorRef cfError)
+    : m_dataIsUpToDate(false)
+    , m_platformError((NSError *)cfError)
+{
+    m_isNull = !cfError;
+}
+
 void ResourceError::platformLazyInit()
 {
     if (m_dataIsUpToDate)
@@ -59,10 +74,10 @@ void ResourceError::platformLazyInit()
 
 bool ResourceError::platformCompare(const ResourceError& a, const ResourceError& b)
 {
-    return (NSError*)a == (NSError*)b;
+    return a.nsError() == b.nsError();
 }
 
-ResourceError::operator NSError*() const
+NSError *ResourceError::nsError() const
 {
     if (m_isNull) {
         ASSERT(!m_platformError);
@@ -87,4 +102,19 @@ ResourceError::operator NSError*() const
     return m_platformError.get();
 }
 
+ResourceError::operator NSError *() const
+{
+    return nsError();
+}
+
+CFErrorRef ResourceError::cfError() const
+{
+    return (CFErrorRef)nsError();
+}
+
+ResourceError::operator CFErrorRef() const
+{
+    return cfError();
+}
+
 } // namespace WebCore
diff --git a/Source/WebCore/platform/network/mac/ResourceHandleMac.mm b/Source/WebCore/platform/network/mac/ResourceHandleMac.mm
index 96d561d..b2a89f0 100644
--- a/Source/WebCore/platform/network/mac/ResourceHandleMac.mm
+++ b/Source/WebCore/platform/network/mac/ResourceHandleMac.mm
@@ -886,7 +886,7 @@ String ResourceHandle::privateBrowsingStorageSessionIdentifierDefaultBase()
     // Avoid MIME type sniffing if the response comes back as 304 Not Modified.
     int statusCode = [r respondsToSelector:@selector(statusCode)] ? [(id)r statusCode] : 0;
     if (statusCode != 304)
-        [r adjustMIMETypeIfNecessary];
+        adjustMIMETypeIfNecessary([r _CFURLResponse]);
 
     if ([m_handle->firstRequest().nsURLRequest() _propertyForKey:@"ForceHTMLMIMEType"])
         [r _setMIMEType:@"text/html"];
@@ -910,9 +910,32 @@ String ResourceHandle::privateBrowsingStorageSessionIdentifierDefaultBase()
     m_handle->client()->didReceiveResponse(m_handle, r);
 }
 
+#if HAVE(CFNETWORK_DATA_ARRAY_CALLBACK)
+- (void)connection:(NSURLConnection *)connection didReceiveDataArray:(NSArray *)dataArray
+{
+    UNUSED_PARAM(connection);
+    LOG(Network, "Handle %p delegate connection:%p didReceiveDataArray:%p arraySize:%d", m_handle, connection, dataArray, [dataArray count]);
+
+    if (!dataArray)
+        return;
+
+    if (!m_handle || !m_handle->client())
+        return;
+
+    if (m_handle->client()->supportsDataArray())
+        m_handle->client()->didReceiveDataArray(m_handle, reinterpret_cast<CFArrayRef>(dataArray));
+    else {
+        for (NSData *data in dataArray)
+            m_handle->client()->didReceiveData(m_handle, static_cast<const char*>([data bytes]), [data length], static_cast<int>([data length]));
+    }
+    return;
+}
+#endif
+
 - (void)connection:(NSURLConnection *)connection didReceiveData:(NSData *)data lengthReceived:(long long)lengthReceived
 {
     UNUSED_PARAM(connection);
+    UNUSED_PARAM(lengthReceived);
 
     LOG(Network, "Handle %p delegate connection:%p didReceiveData:%p lengthReceived:%lld", m_handle, connection, data, lengthReceived);
 
@@ -922,7 +945,10 @@ String ResourceHandle::privateBrowsingStorageSessionIdentifierDefaultBase()
     // However, with today's computers and networking speeds, this won't happen in practice.
     // Could be an issue with a giant local file.
     CallbackGuard guard;
-    m_handle->client()->didReceiveData(m_handle, (const char*)[data bytes], [data length], static_cast<int>(lengthReceived));
+    // FIXME: https://bugs.webkit.org/show_bug.cgi?id=19793
+    // -1 means we do not provide any data about transfer size to inspector so it would use
+    // Content-Length headers or content size to show transfer size.
+    m_handle->client()->didReceiveData(m_handle, (const char*)[data bytes], [data length], -1);
 }
 
 - (void)connection:(NSURLConnection *)connection willStopBufferingData:(NSData *)data
diff --git a/Source/WebCore/platform/network/mac/WebCoreURLResponse.h b/Source/WebCore/platform/network/mac/WebCoreURLResponse.h
index 8d43a21..d766b96 100644
--- a/Source/WebCore/platform/network/mac/WebCoreURLResponse.h
+++ b/Source/WebCore/platform/network/mac/WebCoreURLResponse.h
@@ -26,10 +26,15 @@
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-@interface NSURLResponse (WebCoreURLResponse)
--(void)adjustMIMETypeIfNecessary;
-@end
+typedef struct _CFURLResponse* CFURLResponseRef;
 
+#ifdef __OBJC__
 @interface NSURLResponse (Details)
+- (CFURLResponseRef)_CFURLResponse;
 - (void)_setMIMEType:(NSString *)type;
 @end
+#endif
+
+namespace WebCore {
+void adjustMIMETypeIfNecessary(CFURLResponseRef);
+}
diff --git a/Source/WebCore/platform/network/mac/WebCoreURLResponse.mm b/Source/WebCore/platform/network/mac/WebCoreURLResponse.mm
index e287e5f..0960492 100644
--- a/Source/WebCore/platform/network/mac/WebCoreURLResponse.mm
+++ b/Source/WebCore/platform/network/mac/WebCoreURLResponse.mm
@@ -30,308 +30,429 @@
 #import "WebCoreURLResponse.h"
 
 #import "MIMETypeRegistry.h"
-#import <objc/objc-class.h>
+#import "WebCoreSystemInterface.h"
 #import <wtf/Assertions.h>
 #import <wtf/RetainPtr.h>
 
-#ifndef BUILDING_ON_TIGER
+namespace WebCore {
+
 // <rdar://problem/5321972> Plain text document from HTTP server detected as application/octet-stream
 // When we sniff a resource as application/octet-stream but the http response headers had "text/plain",
 // we have a hard decision to make about which of the two generic MIME types to go with.
 // When the URL's extension is a known binary type, we'll go with application/octet-stream.
 // Otherwise, we'll trust the server.
-static NSSet *createBinaryExtensionsSet()
+static CFSetRef createBinaryExtensionsSet()
 {
-    return [[NSSet alloc] initWithObjects:
-        @"3g2",
-        @"3gp",
-        @"ai",
-        @"aif",
-        @"aifc",
-        @"aiff",
-        @"au",
-        @"avi",
-        @"bcpio",
-        @"bin",
-        @"bmp",
-        @"boz",
-        @"bpk",
-        @"bz",
-        @"bz2",
-        @"chm",
-        @"class",
-        @"com",
-        @"cpio",
-        @"dcr",
-        @"dir",
-        @"dist",
-        @"distz",
-        @"dll",
-        @"dmg",
-        @"dms",
-        @"doc",
-        @"dot",
-        @"dump",
-        @"dv",
-        @"dvi",
-        @"dxr",
-        @"elc",
-        @"eot",
-        @"eps",
-        @"exe",
-        @"fgd",
-        @"gif",
-        @"gtar",
-        @"h261",
-        @"h263",
-        @"h264",
-        @"ico",
-        @"ims",
-        @"indd",
-        @"iso",
-        @"jp2",
-        @"jpe",
-        @"jpeg",
-        @"jpg",
-        @"jpgm",
-        @"jpgv",
-        @"jpm",
-        @"kar",
-        @"kmz",
-        @"lha",
-        @"lrm",
-        @"lzh",
-        @"m1v",
-        @"m2a",
-        @"m2v",
-        @"m3a",
-        @"m3u",
-        @"m4a",
-        @"m4p",
-        @"m4v",
-        @"mdb",
-        @"mid",
-        @"midi",
-        @"mj2",
-        @"mjp2",
-        @"mov",
-        @"movie",
-        @"mp2",
-        @"mp2a",
-        @"mp3",
-        @"mp4",
-        @"mp4a",
-        @"mp4s",
-        @"mp4v",
-        @"mpe",
-        @"mpeg",
-        @"mpg",
-        @"mpg4",
-        @"mpga",
-        @"mpp",
-        @"mpt",
-        @"msi",
-        @"ogg",
-        @"otf",
-        @"pct",
-        @"pdf",
-        @"pfa",
-        @"pfb",
-        @"pic",
-        @"pict",
-        @"pkg",
-        @"png",
-        @"pot",
-        @"pps",
-        @"ppt",
-        @"ps",
-        @"psd",
-        @"qt",
-        @"qti",
-        @"qtif",
-        @"qwd",
-        @"qwt",
-        @"qxb",
-        @"qxd",
-        @"qxl",
-        @"qxp",
-        @"qxt",
-        @"ra",
-        @"ram",
-        @"rm",
-        @"rmi",
-        @"rmp",
-        @"scpt",
-        @"sit",
-        @"sitx",
-        @"snd",
-        @"so",
-        @"swf",
-        @"tar",
-        @"tif",
-        @"tiff",
-        @"ttf",
-        @"wav",
-        @"wcm",
-        @"wdb",
-        @"wks",
-        @"wm",
-        @"wma",
-        @"wmd",
-        @"wmf",
-        @"wmv",
-        @"wmx",
-        @"wmz",
-        @"wpd",
-        @"wpl",
-        @"wps",
-        @"wvx",
-        @"xla",
-        @"xlc",
-        @"xlm",
-        @"xls",
-        @"xlt",
-        @"xlw",
-        @"xps",
-        @"zip",
-        nil
-    ];
+    CFStringRef extensions[] = {
+        CFSTR("3g2"),
+        CFSTR("3gp"),
+        CFSTR("ai"),
+        CFSTR("aif"),
+        CFSTR("aifc"),
+        CFSTR("aiff"),
+        CFSTR("au"),
+        CFSTR("avi"),
+        CFSTR("bcpio"),
+        CFSTR("bin"),
+        CFSTR("bmp"),
+        CFSTR("boz"),
+        CFSTR("bpk"),
+        CFSTR("bz"),
+        CFSTR("bz2"),
+        CFSTR("chm"),
+        CFSTR("class"),
+        CFSTR("com"),
+        CFSTR("cpio"),
+        CFSTR("dcr"),
+        CFSTR("dir"),
+        CFSTR("dist"),
+        CFSTR("distz"),
+        CFSTR("dll"),
+        CFSTR("dmg"),
+        CFSTR("dms"),
+        CFSTR("doc"),
+        CFSTR("dot"),
+        CFSTR("dump"),
+        CFSTR("dv"),
+        CFSTR("dvi"),
+        CFSTR("dxr"),
+        CFSTR("elc"),
+        CFSTR("eot"),
+        CFSTR("eps"),
+        CFSTR("exe"),
+        CFSTR("fgd"),
+        CFSTR("gif"),
+        CFSTR("gtar"),
+        CFSTR("h261"),
+        CFSTR("h263"),
+        CFSTR("h264"),
+        CFSTR("ico"),
+        CFSTR("ims"),
+        CFSTR("indd"),
+        CFSTR("iso"),
+        CFSTR("jp2"),
+        CFSTR("jpe"),
+        CFSTR("jpeg"),
+        CFSTR("jpg"),
+        CFSTR("jpgm"),
+        CFSTR("jpgv"),
+        CFSTR("jpm"),
+        CFSTR("kar"),
+        CFSTR("kmz"),
+        CFSTR("lha"),
+        CFSTR("lrm"),
+        CFSTR("lzh"),
+        CFSTR("m1v"),
+        CFSTR("m2a"),
+        CFSTR("m2v"),
+        CFSTR("m3a"),
+        CFSTR("m3u"),
+        CFSTR("m4a"),
+        CFSTR("m4p"),
+        CFSTR("m4v"),
+        CFSTR("mdb"),
+        CFSTR("mid"),
+        CFSTR("midi"),
+        CFSTR("mj2"),
+        CFSTR("mjp2"),
+        CFSTR("mov"),
+        CFSTR("movie"),
+        CFSTR("mp2"),
+        CFSTR("mp2a"),
+        CFSTR("mp3"),
+        CFSTR("mp4"),
+        CFSTR("mp4a"),
+        CFSTR("mp4s"),
+        CFSTR("mp4v"),
+        CFSTR("mpe"),
+        CFSTR("mpeg"),
+        CFSTR("mpg"),
+        CFSTR("mpg4"),
+        CFSTR("mpga"),
+        CFSTR("mpp"),
+        CFSTR("mpt"),
+        CFSTR("msi"),
+        CFSTR("ogg"),
+        CFSTR("otf"),
+        CFSTR("pct"),
+        CFSTR("pdf"),
+        CFSTR("pfa"),
+        CFSTR("pfb"),
+        CFSTR("pic"),
+        CFSTR("pict"),
+        CFSTR("pkg"),
+        CFSTR("png"),
+        CFSTR("pot"),
+        CFSTR("pps"),
+        CFSTR("ppt"),
+        CFSTR("ps"),
+        CFSTR("psd"),
+        CFSTR("qt"),
+        CFSTR("qti"),
+        CFSTR("qtif"),
+        CFSTR("qwd"),
+        CFSTR("qwt"),
+        CFSTR("qxb"),
+        CFSTR("qxd"),
+        CFSTR("qxl"),
+        CFSTR("qxp"),
+        CFSTR("qxt"),
+        CFSTR("ra"),
+        CFSTR("ram"),
+        CFSTR("rm"),
+        CFSTR("rmi"),
+        CFSTR("rmp"),
+        CFSTR("scpt"),
+        CFSTR("sit"),
+        CFSTR("sitx"),
+        CFSTR("snd"),
+        CFSTR("so"),
+        CFSTR("swf"),
+        CFSTR("tar"),
+        CFSTR("tif"),
+        CFSTR("tiff"),
+        CFSTR("ttf"),
+        CFSTR("wav"),
+        CFSTR("wcm"),
+        CFSTR("wdb"),
+        CFSTR("wks"),
+        CFSTR("wm"),
+        CFSTR("wma"),
+        CFSTR("wmd"),
+        CFSTR("wmf"),
+        CFSTR("wmv"),
+        CFSTR("wmx"),
+        CFSTR("wmz"),
+        CFSTR("wpd"),
+        CFSTR("wpl"),
+        CFSTR("wps"),
+        CFSTR("wvx"),
+        CFSTR("xla"),
+        CFSTR("xlc"),
+        CFSTR("xlm"),
+        CFSTR("xls"),
+        CFSTR("xlt"),
+        CFSTR("xlw"),
+        CFSTR("xps"),
+        CFSTR("zip")
+    };
+    return CFSetCreate(kCFAllocatorDefault, (const void **)&extensions, sizeof(extensions)/sizeof(CFStringRef), &kCFTypeSetCallBacks);
 }
-#endif
 
 // <rdar://problem/7007389> CoreTypes UTI map is missing 100+ file extensions that GateKeeper knew about
 // When we disabled content sniffing for file URLs we caused problems with these 100+ extensions that CoreTypes
 // doesn't know about.
 // If CoreTypes is ever brought up to speed we can remove this table and associated code.
-static NSDictionary *createExtensionToMIMETypeMap()
+static CFDictionaryRef createExtensionToMIMETypeMap()
 {
-    return [[NSDictionary alloc] initWithObjectsAndKeys:
-        @"application/postscript", @"ai",
-        @"text/plain", @"asc",
-        @"application/x-bcpio", @"bcpio",
-        @"image/bmp", @"bmp",
-        @"application/x-netcdf", @"cdf",
-        @"application/octet-stream", @"class",
-        @"application/x-gzip", @"cpgz",
-        @"application/x-cpio", @"cpio",
-        @"application/mac-compactpro", @"cpt",
-        @"application/x-csh", @"csh",
-        @"text/css", @"css",
-        @"application/x-director", @"dcr",
-        @"application/x-director", @"dir",
-        @"application/x-diskcopy", @"dmg",
-        @"application/octet-stream", @"dms",
-        @"application/x-dvi", @"dvi",
-        @"application/x-director", @"dxr",
-        @"application/postscript", @"eps",
-        @"text/x-setext", @"etx",
-        @"application/andrew-inset", @"ez",
-        @"application/vnd.fdf", @"fdf",
-        @"application/octet-stream", @"fla",
-        @"application/x-filemaker", @"fp",
-        @"application/x-filemaker", @"fp2",
-        @"application/x-filemaker", @"fp3",
-        @"application/x-filemaker", @"fp4",
-        @"application/x-filemaker", @"fp5",
-        @"application/x-filemaker", @"fp6",
-        @"application/x-hdf", @"hdf",
-        @"x-conference/x-cooltalk", @"ice",
-        @"image/x-icon", @"ico",
-        @"text/calendar", @"ics",
-        @"image/ief", @"ief",
-        @"model/iges", @"iges",
-        @"model/iges", @"igs",
-        @"application/octet-stream", @"iso",
-        @"text/html", @"jhtml",
-        @"application/x-latex", @"latex",
-        @"application/octet-stream", @"lha",
-        @"application/octet-stream", @"lzh",
-        @"audio/x-mpegurl", @"m3u",
-        @"audio/x-m4p", @"m4p",
-        @"image/x-macpaint", @"mac",
-        @"application/x-troff-man", @"man",
-        @"application/x-troff-me", @"me",
-        @"model/mesh", @"mesh",
-        @"application/vnd.mif", @"mif",
-        @"video/x-sgi-movie", @"movie",
-        @"audio/mpeg", @"mp2",
-        @"audio/mpeg", @"mpga",
-        @"application/x-troff-ms", @"ms",
-        @"model/mesh", @"msh",
-        @"video/vnd.mpegurl", @"mxu",
-        @"application/x-netcdf", @"nc",
-        @"application/oda", @"oda",
-        @"image/x-portable-bitmap", @"pbm",
-        @"image/x-pcx", @"pcx",
-        @"chemical/x-pdb", @"pdb",
-        @"image/x-portable-graymap", @"pgm",
-        @"application/x-chess-pgn", @"pgn",
-        @"audio/scpls", @"pls",
-        @"image/x-portable-anymap", @"pnm",
-        @"image/x-macpaint", @"pnt",
-        @"image/x-macpaint", @"pntg",
-        @"image/x-portable-pixmap", @"ppm",
-        @"image/x-cmu-raster", @"ras",
-        @"image/x-rgb", @"rgb",
-        @"application/x-troff", @"roff",
-        @"audio/x-pn-realaudio-plugin", @"rpm",
-        @"text/richtext", @"rtx",
-        @"text/sgml", @"sgm",
-        @"text/sgml", @"sgml",
-        @"application/x-sh", @"sh",
-        @"application/x-shar", @"shar",
-        @"model/mesh", @"silo",
-        @"application/x-koan", @"skd",
-        @"application/x-koan", @"skm",
-        @"application/x-koan", @"skp",
-        @"application/x-koan", @"skt",
-        @"application/x-diskcopy", @"smi",
-        @"application/octet-stream", @"so",
-        @"application/x-futuresplash", @"spl",
-        @"application/x-wais-source", @"src",
-        @"application/x-sv4cpio", @"sv4cpio",
-        @"application/x-sv4crc", @"sv4crc",
-        @"application/x-shockwave-flash", @"swf",
-        @"application/x-troff", @"t",
-        @"image/x-targa", @"targa",
-        @"application/x-tcl", @"tcl",
-        @"application/x-tex", @"tex",
-        @"application/x-texinfo", @"texi",
-        @"application/x-texinfo", @"texinfo",
-        @"application/x-gzip", @"tgz",
-        @"application/x-bittorrent", @"torrent",
-        @"application/x-troff", @"tr",
-        @"text/tab-separated-values", @"tsv",
-        @"application/x-ustar", @"ustar",
-        @"application/x-cdlink", @"vcd",
-        @"model/vrml", @"vrml",
-        @"image/vnd.wap.wbmp", @"wbmp",
-        @"application/vnd.wap.wbxml", @"wbxml",
-        @"application/x-webarchive", @"webarchive",
-        @"application/x-ms-wmd", @"wmd",
-        @"text/vnd.wap.wml", @"wml",
-        @"application/vnd.wap.wmlc", @"wmlc",
-        @"text/vnd.wap.wmlscript", @"wmls",
-        @"application/vnd.wap.wmlscriptc", @"wmlsc",
-        @"model/vrml", @"wrl",
-        @"application/vnd.adobe.xdp+xml", @"xdp",
-        @"application/vnd.adobe.xfd+xml", @"xfd",
-        @"application/vnd.adobe.xfdf", @"xfdf",
-        @"image/x-xpixmap", @"xpm",
-        @"text/xml", @"xsl",
-        @"image/x-xwindowdump", @"xwd",
-        @"chemical/x-xyz", @"xyz",
-        @"application/x-compress", @"z",
-        nil
-    ];
+    CFStringRef keys[] = {
+        CFSTR("ai"),
+        CFSTR("asc"),
+        CFSTR("bcpio"),
+        CFSTR("bmp"),
+        CFSTR("cdf"),
+        CFSTR("class"),
+        CFSTR("cpgz"),
+        CFSTR("cpio"),
+        CFSTR("cpt"),
+        CFSTR("csh"),
+        CFSTR("css"),
+        CFSTR("dcr"),
+        CFSTR("dir"),
+        CFSTR("dmg"),
+        CFSTR("dms"),
+        CFSTR("dvi"),
+        CFSTR("dxr"),
+        CFSTR("eps"),
+        CFSTR("etx"),
+        CFSTR("ez"),
+        CFSTR("fdf"),
+        CFSTR("fla"),
+        CFSTR("fp"),
+        CFSTR("fp2"),
+        CFSTR("fp3"),
+        CFSTR("fp4"),
+        CFSTR("fp5"),
+        CFSTR("fp6"),
+        CFSTR("hdf"),
+        CFSTR("ice"),
+        CFSTR("ico"),
+        CFSTR("ics"),
+        CFSTR("ief"),
+        CFSTR("iges"),
+        CFSTR("igs"),
+        CFSTR("iso"),
+        CFSTR("jhtml"),
+        CFSTR("latex"),
+        CFSTR("lha"),
+        CFSTR("lzh"),
+        CFSTR("m3u"),
+        CFSTR("m4p"),
+        CFSTR("mac"),
+        CFSTR("man"),
+        CFSTR("me"),
+        CFSTR("mesh"),
+        CFSTR("mif"),
+        CFSTR("movie"),
+        CFSTR("mp2"),
+        CFSTR("mpga"),
+        CFSTR("ms"),
+        CFSTR("msh"),
+        CFSTR("mxu"),
+        CFSTR("nc"),
+        CFSTR("oda"),
+        CFSTR("pbm"),
+        CFSTR("pcx"),
+        CFSTR("pdb"),
+        CFSTR("pgm"),
+        CFSTR("pgn"),
+        CFSTR("pls"),
+        CFSTR("pnm"),
+        CFSTR("pnt"),
+        CFSTR("pntg"),
+        CFSTR("ppm"),
+        CFSTR("ras"),
+        CFSTR("rgb"),
+        CFSTR("roff"),
+        CFSTR("rpm"),
+        CFSTR("rtx"),
+        CFSTR("sgm"),
+        CFSTR("sgml"),
+        CFSTR("sh"),
+        CFSTR("shar"),
+        CFSTR("silo"),
+        CFSTR("skd"),
+        CFSTR("skm"),
+        CFSTR("skp"),
+        CFSTR("skt"),
+        CFSTR("smi"),
+        CFSTR("so"),
+        CFSTR("spl"),
+        CFSTR("src"),
+        CFSTR("sv4cpio"),
+        CFSTR("sv4crc"),
+        CFSTR("swf"),
+        CFSTR("t"),
+        CFSTR("targa"),
+        CFSTR("tcl"),
+        CFSTR("tex"),
+        CFSTR("texi"),
+        CFSTR("texinfo"),
+        CFSTR("tgz"),
+        CFSTR("torrent"),
+        CFSTR("tr"),
+        CFSTR("tsv"),
+        CFSTR("ustar"),
+        CFSTR("vcd"),
+        CFSTR("vrml"),
+        CFSTR("wbmp"),
+        CFSTR("wbxml"),
+        CFSTR("webarchive"),
+        CFSTR("wmd"),
+        CFSTR("wml"),
+        CFSTR("wmlc"),
+        CFSTR("wmls"),
+        CFSTR("wmlsc"),
+        CFSTR("wrl"),
+        CFSTR("xdp"),
+        CFSTR("xfd"),
+        CFSTR("xfdf"),
+        CFSTR("xpm"),
+        CFSTR("xsl"),
+        CFSTR("xwd"),
+        CFSTR("xyz"),
+        CFSTR("z")
+    };
+
+    CFStringRef values[] = {
+        CFSTR("application/postscript"),
+        CFSTR("text/plain"),
+        CFSTR("application/x-bcpio"),
+        CFSTR("image/bmp"),
+        CFSTR("application/x-netcdf"),
+        CFSTR("application/octet-stream"),
+        CFSTR("application/x-gzip"),
+        CFSTR("application/x-cpio"),
+        CFSTR("application/mac-compactpro"),
+        CFSTR("application/x-csh"),
+        CFSTR("text/css"),
+        CFSTR("application/x-director"),
+        CFSTR("application/x-director"),
+        CFSTR("application/x-diskcopy"),
+        CFSTR("application/octet-stream"),
+        CFSTR("application/x-dvi"),
+        CFSTR("application/x-director"),
+        CFSTR("application/postscript"),
+        CFSTR("text/x-setext"),
+        CFSTR("application/andrew-inset"),
+        CFSTR("application/vnd.fdf"),
+        CFSTR("application/octet-stream"),
+        CFSTR("application/x-filemaker"),
+        CFSTR("application/x-filemaker"),
+        CFSTR("application/x-filemaker"),
+        CFSTR("application/x-filemaker"),
+        CFSTR("application/x-filemaker"),
+        CFSTR("application/x-filemaker"),
+        CFSTR("application/x-hdf"),
+        CFSTR("x-conference/x-cooltalk"),
+        CFSTR("image/x-icon"),
+        CFSTR("text/calendar"),
+        CFSTR("image/ief"),
+        CFSTR("model/iges"),
+        CFSTR("model/iges"),
+        CFSTR("application/octet-stream"),
+        CFSTR("text/html"),
+        CFSTR("application/x-latex"),
+        CFSTR("application/octet-stream"),
+        CFSTR("application/octet-stream"),
+        CFSTR("audio/x-mpegurl"),
+        CFSTR("audio/x-m4p"),
+        CFSTR("image/x-macpaint"),
+        CFSTR("application/x-troff-man"),
+        CFSTR("application/x-troff-me"),
+        CFSTR("model/mesh"),
+        CFSTR("application/vnd.mif"),
+        CFSTR("video/x-sgi-movie"),
+        CFSTR("audio/mpeg"),
+        CFSTR("audio/mpeg"),
+        CFSTR("application/x-troff-ms"),
+        CFSTR("model/mesh"),
+        CFSTR("video/vnd.mpegurl"),
+        CFSTR("application/x-netcdf"),
+        CFSTR("application/oda"),
+        CFSTR("image/x-portable-bitmap"),
+        CFSTR("image/x-pcx"),
+        CFSTR("chemical/x-pdb"),
+        CFSTR("image/x-portable-graymap"),
+        CFSTR("application/x-chess-pgn"),
+        CFSTR("audio/scpls"),
+        CFSTR("image/x-portable-anymap"),
+        CFSTR("image/x-macpaint"),
+        CFSTR("image/x-macpaint"),
+        CFSTR("image/x-portable-pixmap"),
+        CFSTR("image/x-cmu-raster"),
+        CFSTR("image/x-rgb"),
+        CFSTR("application/x-troff"),
+        CFSTR("audio/x-pn-realaudio-plugin"),
+        CFSTR("text/richtext"),
+        CFSTR("text/sgml"),
+        CFSTR("text/sgml"),
+        CFSTR("application/x-sh"),
+        CFSTR("application/x-shar"),
+        CFSTR("model/mesh"),
+        CFSTR("application/x-koan"),
+        CFSTR("application/x-koan"),
+        CFSTR("application/x-koan"),
+        CFSTR("application/x-koan"),
+        CFSTR("application/x-diskcopy"),
+        CFSTR("application/octet-stream"),
+        CFSTR("application/x-futuresplash"),
+        CFSTR("application/x-wais-source"),
+        CFSTR("application/x-sv4cpio"),
+        CFSTR("application/x-sv4crc"),
+        CFSTR("application/x-shockwave-flash"),
+        CFSTR("application/x-troff"),
+        CFSTR("image/x-targa"),
+        CFSTR("application/x-tcl"),
+        CFSTR("application/x-tex"),
+        CFSTR("application/x-texinfo"),
+        CFSTR("application/x-texinfo"),
+        CFSTR("application/x-gzip"),
+        CFSTR("application/x-bittorrent"),
+        CFSTR("application/x-troff"),
+        CFSTR("text/tab-separated-values"),
+        CFSTR("application/x-ustar"),
+        CFSTR("application/x-cdlink"),
+        CFSTR("model/vrml"),
+        CFSTR("image/vnd.wap.wbmp"),
+        CFSTR("application/vnd.wap.wbxml"),
+        CFSTR("application/x-webarchive"),
+        CFSTR("application/x-ms-wmd"),
+        CFSTR("text/vnd.wap.wml"),
+        CFSTR("application/vnd.wap.wmlc"),
+        CFSTR("text/vnd.wap.wmlscript"),
+        CFSTR("application/vnd.wap.wmlscriptc"),
+        CFSTR("model/vrml"),
+        CFSTR("application/vnd.adobe.xdp+xml"),
+        CFSTR("application/vnd.adobe.xfd+xml"),
+        CFSTR("application/vnd.adobe.xfdf"),
+        CFSTR("image/x-xpixmap"),
+        CFSTR("text/xml"),
+        CFSTR("image/x-xwindowdump"),
+        CFSTR("chemical/x-xyz"),
+        CFSTR("application/x-compress")
+    };
+
+    ASSERT(sizeof(keys) == sizeof(values));
+    return CFDictionaryCreate(kCFAllocatorDefault, (const void**)&keys, (const void**)&values, sizeof(keys)/sizeof(CFStringRef), &kCFTypeDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks);
 }
 
-static RetainPtr<NSString> mimeTypeFromUTITree(CFStringRef uti)
+static RetainPtr<CFStringRef> mimeTypeFromUTITree(CFStringRef uti)
 {
     // Check if this UTI has a MIME type.
     RetainPtr<CFStringRef> mimeType(AdoptCF, UTTypeCopyPreferredTagWithClass(uti, kUTTagClassMIMEType));
     if (mimeType)
-        return (NSString *)mimeType.get();
+        return mimeType.get();
     
     // If not, walk the ancestory of this UTI via its "ConformsTo" tags and return the first MIME type we find.
     RetainPtr<CFDictionaryRef> decl(AdoptCF, UTTypeCopyDeclaration(uti));
@@ -353,7 +474,7 @@ static RetainPtr<NSString> mimeTypeFromUTITree(CFStringRef uti)
             if (CFGetTypeID(object) != CFStringGetTypeID())
                 continue;
 
-            if (RetainPtr<NSString> mimeType = mimeTypeFromUTITree((CFStringRef)object))
+            if (RetainPtr<CFStringRef> mimeType = mimeTypeFromUTITree((CFStringRef)object))
                 return mimeType;
         }
     }
@@ -361,33 +482,29 @@ static RetainPtr<NSString> mimeTypeFromUTITree(CFStringRef uti)
     return nil;
 }
 
-@implementation NSURLResponse (WebCoreURLResponse)
-
--(void)adjustMIMETypeIfNecessary
+void adjustMIMETypeIfNecessary(CFURLResponseRef cfResponse)
 {
-    RetainPtr<NSString> result = [self MIMEType];
-    RetainPtr<NSString> originalResult = result;
-
-#ifdef BUILDING_ON_TIGER
-    // When content sniffing is disabled, Tiger's CFNetwork automatically returns application/octet-stream for certain
-    // extensions even when scouring the UTI maps would end up with a better result, so we'll give a chance for that to happen.
-    if ([[self URL] isFileURL] && [result.get() caseInsensitiveCompare:@"application/octet-stream"] == NSOrderedSame)
-        result = nil;
-#endif
+    RetainPtr<CFStringRef> result = wkGetCFURLResponseMIMEType(cfResponse);
+    RetainPtr<CFStringRef> originalResult = result;
 
     if (!result) {
-        NSURL *url = [self URL];
-        if ([url isFileURL]) {
-            if (NSString *extension = [[url path] pathExtension]) {
+        CFURLRef url = wkGetCFURLResponseURL(cfResponse);
+        NSURL *nsURL = (NSURL *)url;
+        if ([nsURL isFileURL]) {
+            RetainPtr<CFStringRef> extension(AdoptCF, CFURLCopyPathExtension(url));
+            if (extension) {
                 // <rdar://problem/7007389> CoreTypes UTI map is missing 100+ file extensions that GateKeeper knew about
                 // When this radar is resolved, we can remove this file:// url specific code.
-                static NSDictionary *extensionMap = createExtensionToMIMETypeMap();
-                result = [extensionMap objectForKey:[extension lowercaseString]];
+                static CFDictionaryRef extensionMap = createExtensionToMIMETypeMap();
+                CFMutableStringRef mutableExtension = CFStringCreateMutableCopy(kCFAllocatorDefault, 0, extension.get());
+                CFStringLowercase(mutableExtension, NULL);
+                extension.adoptCF(mutableExtension);
+                result = (CFStringRef) CFDictionaryGetValue(extensionMap, extension.get());
                 
                 if (!result) {
                     // If the Gatekeeper-based map doesn't have a MIME type, we'll try to figure out what it should be by
                     // looking up the file extension in the UTI maps.
-                    RetainPtr<CFStringRef> uti(AdoptCF, UTTypeCreatePreferredIdentifierForTag(kUTTagClassFilenameExtension, (CFStringRef)extension, 0));
+                    RetainPtr<CFStringRef> uti(AdoptCF, UTTypeCreatePreferredIdentifierForTag(kUTTagClassFilenameExtension, extension.get(), 0));
                     result = mimeTypeFromUTITree(uti.get());
                 }
             }
@@ -395,29 +512,33 @@ static RetainPtr<NSString> mimeTypeFromUTITree(CFStringRef uti)
     }
     
     if (!result) {
-        static NSString *defaultMIMETypeString = [(NSString *)WebCore::defaultMIMEType() retain];
+        static CFStringRef defaultMIMETypeString = WebCore::defaultMIMEType().createCFString();
         result = defaultMIMETypeString;
     }
 
-#ifndef BUILDING_ON_TIGER
     // <rdar://problem/5321972> Plain text document from HTTP server detected as application/octet-stream
     // Make the best guess when deciding between "generic binary" and "generic text" using a table of known binary MIME types.
-    if ([result.get() isEqualToString:@"application/octet-stream"] && [self respondsToSelector:@selector(allHeaderFields)] && [[[self performSelector:@selector(allHeaderFields)] objectForKey:@"Content-Type"] hasPrefix:@"text/plain"]) {
-        static NSSet *binaryExtensions = createBinaryExtensionsSet();
-        if (![binaryExtensions containsObject:[[[self suggestedFilename] pathExtension] lowercaseString]])
-            result = @"text/plain";
+    if (CFStringCompare(result.get(), CFSTR("application/octet-stream"), 0) == kCFCompareEqualTo) {
+        CFHTTPMessageRef message = wkGetCFURLResponseHTTPResponse(cfResponse);
+        if (message) {
+            RetainPtr<CFStringRef> contentType(AdoptCF, CFHTTPMessageCopyHeaderFieldValue(message, CFSTR("Content-Type")));
+            if (contentType && CFStringHasPrefix(contentType.get(), CFSTR("text/plain"))) {
+                static CFSetRef binaryExtensions = createBinaryExtensionsSet();
+                RetainPtr<NSString> suggestedFilename(AdoptNS, (NSString *)wkCopyCFURLResponseSuggestedFilename(cfResponse));
+                if (!CFSetContainsValue(binaryExtensions, (CFStringRef) [[suggestedFilename.get() pathExtension] lowercaseString]))
+                    result = CFSTR("text/plain");
+            }
+        }
     }
 
-#endif
-
 #ifdef BUILDING_ON_LEOPARD
     // Workaround for <rdar://problem/5539824>
-    if ([result.get() isEqualToString:@"text/xml"])
-        result = @"application/xml";
+    if (CFStringCompare(result.get(), CFSTR("text/xml"), 0) == kCFCompareEqualTo)
+        result = CFSTR("application/xml");
 #endif
 
     if (result != originalResult)
-        [self _setMIMEType:result.get()];
+        wkSetCFURLResponseMIMEType(cfResponse, result.get());
 }
 
-@end
+}
diff --git a/Source/WebCore/platform/network/qt/DnsPrefetchHelper.h b/Source/WebCore/platform/network/qt/DnsPrefetchHelper.h
index 892a3fb..4fcd19c 100644
--- a/Source/WebCore/platform/network/qt/DnsPrefetchHelper.h
+++ b/Source/WebCore/platform/network/qt/DnsPrefetchHelper.h
@@ -32,7 +32,7 @@ namespace WebCore {
     class DnsPrefetchHelper : public QObject {
         Q_OBJECT
     public:
-        DnsPrefetchHelper() : QObject(), currentLookups(0) {};
+        DnsPrefetchHelper() : QObject(), currentLookups(0) { }
 
     public slots:
         void lookup(QString hostname)
@@ -42,26 +42,8 @@ namespace WebCore {
             if (currentLookups >= 10)
                 return; // do not launch more than 10 lookups at the same time
 
-#if QT_VERSION >= QT_VERSION_CHECK(4, 6, 3)
             currentLookups++;
             QHostInfo::lookupHost(hostname, this, SLOT(lookedUp(QHostInfo)));
-#else
-            // This code is only needed for Qt versions that do not have
-            // the small Qt DNS cache yet.
-
-            QTime* entryTime = lookupCache.object(hostname);
-            if (entryTime && entryTime->elapsed() > 300*1000) {
-                // delete knowledge about lookup if it is already 300 seconds old
-                lookupCache.remove(hostname);
-            } else if (!entryTime) {
-                // not in cache yet, can look it up
-                QTime *tmpTime = new QTime();
-                *tmpTime = QTime::currentTime();
-                lookupCache.insert(hostname, tmpTime);
-                currentLookups++;
-                QHostInfo::lookupHost(hostname, this, SLOT(lookedUp(QHostInfo)));
-            }
-#endif
         }
 
         void lookedUp(const QHostInfo&)
@@ -74,9 +56,6 @@ namespace WebCore {
         }
 
     protected:
-#if QT_VERSION < QT_VERSION_CHECK(4, 6, 3)
-        QCache<QString, QTime> lookupCache; // 100 entries
-#endif
         int currentLookups;
     };
 
diff --git a/Source/WebCore/platform/network/qt/NetworkStateNotifierPrivate.h b/Source/WebCore/platform/network/qt/NetworkStateNotifierPrivate.h
index 766dc90..4b8252c 100644
--- a/Source/WebCore/platform/network/qt/NetworkStateNotifierPrivate.h
+++ b/Source/WebCore/platform/network/qt/NetworkStateNotifierPrivate.h
@@ -22,15 +22,9 @@
 
 #include <QObject>
 
-#if QT_VERSION < QT_VERSION_CHECK(4, 7, 0)
-namespace QtMobility {
-class QNetworkConfigurationManager;
-}
-#else
 QT_BEGIN_NAMESPACE
 class QNetworkConfigurationManager;
 QT_END_NAMESPACE
-#endif
 
 namespace WebCore {
 
@@ -46,11 +40,7 @@ public slots:
     void networkAccessPermissionChanged(bool);
 
 public:
-#if QT_VERSION < QT_VERSION_CHECK(4, 7, 0)
-    QtMobility::QNetworkConfigurationManager* m_configurationManager;
-#else
     QNetworkConfigurationManager* m_configurationManager;
-#endif
     bool m_online;
     bool m_networkAccessAllowed;
     NetworkStateNotifier* m_notifier;
diff --git a/Source/WebCore/platform/network/qt/NetworkStateNotifierQt.cpp b/Source/WebCore/platform/network/qt/NetworkStateNotifierQt.cpp
index f3e7023..ced52eb 100644
--- a/Source/WebCore/platform/network/qt/NetworkStateNotifierQt.cpp
+++ b/Source/WebCore/platform/network/qt/NetworkStateNotifierQt.cpp
@@ -25,10 +25,6 @@
 #include "NetworkStateNotifierPrivate.h"
 #include "qnetworkconfigmanager.h"
 
-#if QT_VERSION < QT_VERSION_CHECK(4, 7, 0)
-using namespace QtMobility;
-#endif
-
 namespace WebCore {
 
 NetworkStateNotifierPrivate::NetworkStateNotifierPrivate(NetworkStateNotifier* notifier)
diff --git a/Source/WebCore/platform/network/qt/QNetworkReplyHandler.cpp b/Source/WebCore/platform/network/qt/QNetworkReplyHandler.cpp
index 61fe96c..6e63145 100644
--- a/Source/WebCore/platform/network/qt/QNetworkReplyHandler.cpp
+++ b/Source/WebCore/platform/network/qt/QNetworkReplyHandler.cpp
@@ -41,21 +41,11 @@
 #include <QDebug>
 #include <QCoreApplication>
 
-// What type of connection should be used for the signals of the
-// QNetworkReply? This depends on if Qt has a bugfix for this or not.
-// It is fixed in Qt 4.6.3. See https://bugs.webkit.org/show_bug.cgi?id=32113
-// and https://bugs.webkit.org/show_bug.cgi?id=36755
-#if QT_VERSION > QT_VERSION_CHECK(4, 6, 2)
-#define SIGNAL_CONN Qt::DirectConnection
-#else
-#define SIGNAL_CONN Qt::QueuedConnection
-#endif
-
 // In Qt 4.8, the attribute for sending a request synchronously will be made public,
 // for now, use this hackish solution for setting the internal attribute.
 const QNetworkRequest::Attribute gSynchronousNetworkRequestAttribute = static_cast<QNetworkRequest::Attribute>(QNetworkRequest::HttpPipeliningWasUsedAttribute + 7);
 
-static const int gMaxRecursionLimit = 10;
+static const int gMaxRedirections = 10;
 
 namespace WebCore {
 
@@ -159,6 +149,86 @@ bool FormDataIODevice::isSequential() const
     return true;
 }
 
+QNetworkReplyWrapper::QNetworkReplyWrapper(QNetworkReply* reply, QObject* parent)
+    : QObject(parent)
+    , m_reply(reply)
+{
+    Q_ASSERT(m_reply);
+
+    connect(m_reply, SIGNAL(metaDataChanged()), this, SLOT(receiveMetaData()));
+    connect(m_reply, SIGNAL(readyRead()), this, SLOT(receiveMetaData()));
+    connect(m_reply, SIGNAL(finished()), this, SLOT(receiveMetaData()));
+}
+
+QNetworkReplyWrapper::~QNetworkReplyWrapper()
+{
+    if (m_reply)
+        m_reply->deleteLater();
+}
+
+QNetworkReply* QNetworkReplyWrapper::release()
+{
+    if (!m_reply)
+        return 0;
+
+    resetConnections();
+    QNetworkReply* reply = m_reply;
+    m_reply = 0;
+    reply->setParent(0);
+    return reply;
+}
+
+void QNetworkReplyWrapper::resetConnections()
+{
+    if (m_reply)
+        m_reply->disconnect(this);
+    QCoreApplication::removePostedEvents(this, QEvent::MetaCall);
+}
+
+void QNetworkReplyWrapper::receiveMetaData()
+{
+    // This slot is only used to receive the first signal from the QNetworkReply object.
+    resetConnections();
+
+    m_redirectionTargetUrl = m_reply->attribute(QNetworkRequest::RedirectionTargetAttribute).toUrl();
+    if (m_redirectionTargetUrl.isValid()) {
+        emit metaDataChanged();
+        emit finished();
+        return;
+    }
+
+    WTF::String contentType = m_reply->header(QNetworkRequest::ContentTypeHeader).toString();
+    m_encoding = extractCharsetFromMediaType(contentType);
+    m_advertisedMimeType = extractMIMETypeFromMediaType(contentType);
+
+    bool hasData = m_reply->bytesAvailable();
+    bool isFinished = m_reply->isFinished();
+
+    if (!isFinished) {
+        // If not finished, connect to the slots that will be used from this point on.
+        connect(m_reply, SIGNAL(readyRead()), this, SIGNAL(readyRead()));
+        connect(m_reply, SIGNAL(finished()), this, SLOT(didReceiveFinished()));
+    }
+
+    emit metaDataChanged();
+
+    if (hasData)
+        emit readyRead();
+
+    if (isFinished) {
+        emit finished();
+        return;
+    }
+
+}
+
+void QNetworkReplyWrapper::didReceiveFinished()
+{
+    // Disconnecting will make sure that nothing will happen after emitting the finished signal.
+    resetConnections();
+    emit finished();
+}
+
 String QNetworkReplyHandler::httpMethod() const
 {
     switch (m_method) {
@@ -172,30 +242,24 @@ String QNetworkReplyHandler::httpMethod() const
         return "PUT";
     case QNetworkAccessManager::DeleteOperation:
         return "DELETE";
-#if QT_VERSION >= QT_VERSION_CHECK(4, 7, 0)
     case QNetworkAccessManager::CustomOperation:
         return m_resourceHandle->firstRequest().httpMethod();
-#endif
     default:
         ASSERT_NOT_REACHED();
         return "GET";
     }
 }
 
-QNetworkReplyHandler::QNetworkReplyHandler(ResourceHandle* handle, LoadMode loadMode)
+QNetworkReplyHandler::QNetworkReplyHandler(ResourceHandle* handle, LoadType loadType, bool deferred)
     : QObject(0)
-    , m_reply(0)
+    , m_replyWrapper(0)
     , m_resourceHandle(handle)
-    , m_redirected(false)
-    , m_responseSent(false)
-    , m_responseContainsData(false)
-    , m_loadMode(loadMode)
-    , m_shouldStart(true)
-    , m_shouldFinish(false)
-    , m_shouldSendResponse(false)
-    , m_shouldForwardData(false)
-    , m_redirectionTries(gMaxRecursionLimit)
+    , m_loadType(loadType)
+    , m_deferred(deferred)
+    , m_redirectionTries(gMaxRedirections)
 {
+    resetState();
+
     const ResourceRequest &r = m_resourceHandle->firstRequest();
 
     if (r.httpMethod() == "GET")
@@ -208,13 +272,8 @@ QNetworkReplyHandler::QNetworkReplyHandler(ResourceHandle* handle, LoadMode load
         m_method = QNetworkAccessManager::PutOperation;
     else if (r.httpMethod() == "DELETE")
         m_method = QNetworkAccessManager::DeleteOperation;
-#if QT_VERSION >= QT_VERSION_CHECK(4, 7, 0)
     else
         m_method = QNetworkAccessManager::CustomOperation;
-#else
-    else
-        m_method = QNetworkAccessManager::UnknownOperation;
-#endif
 
     QObject* originatingObject = 0;
     if (m_resourceHandle->getInternal()->m_context)
@@ -222,40 +281,58 @@ QNetworkReplyHandler::QNetworkReplyHandler(ResourceHandle* handle, LoadMode load
 
     m_request = r.toNetworkRequest(originatingObject);
 
-    if (m_loadMode == LoadSynchronously)
-        m_request.setAttribute(gSynchronousNetworkRequestAttribute, true);
-
-    if (m_loadMode == LoadNormal || m_loadMode == LoadSynchronously)
+    if (!m_deferred)
         start();
+}
+
+void QNetworkReplyHandler::resetState()
+{
+    m_redirected = false;
+    m_responseSent = false;
+    m_responseContainsData = false;
+    m_hasStarted = false;
+    m_callFinishOnResume = false;
+    m_callSendResponseIfNeededOnResume = false;
+    m_callForwardDataOnResume = false;
+
+    if (m_replyWrapper) {
+        m_replyWrapper->deleteLater();
+        m_replyWrapper = 0;
+    }
+}
 
-    if (m_loadMode == LoadSynchronously)
-        m_loadMode = LoadNormal;
+void QNetworkReplyHandler::setLoadingDeferred(bool deferred)
+{
+    m_deferred = deferred;
+
+    if (!deferred)
+        resumeDeferredLoad();
 }
 
-void QNetworkReplyHandler::setLoadMode(LoadMode mode)
+void QNetworkReplyHandler::resumeDeferredLoad()
 {
-    // https://bugs.webkit.org/show_bug.cgi?id=26556
-    // We cannot call sendQueuedItems() from here, because the signal that 
-    // caused us to get into deferred mode, might not be processed yet.
-    switch (mode) {
-    case LoadNormal:
-        m_loadMode = LoadResuming;
-        emit processQueuedItems();
-        break;
-    case LoadDeferred:
-        m_loadMode = LoadDeferred;
-        break;
-    case LoadResuming:
-        Q_ASSERT(0); // should never happen
-        break;
-    };
+    if (!m_hasStarted) {
+        ASSERT(!m_callSendResponseIfNeededOnResume);
+        ASSERT(!m_callForwardDataOnResume);
+        ASSERT(!m_callFinishOnResume);
+        start();
+        return;
+    }
+
+    if (m_callSendResponseIfNeededOnResume)
+        sendResponseIfNeeded();
+
+    if (m_callForwardDataOnResume)
+        forwardData();
+
+    if (m_callFinishOnResume)
+        finish();
 }
 
 void QNetworkReplyHandler::abort()
 {
     m_resourceHandle = 0;
-    if (m_reply) {
-        QNetworkReply* reply = release();
+    if (QNetworkReply* reply = release()) {
         reply->abort();
         reply->deleteLater();
     }
@@ -264,20 +341,16 @@ void QNetworkReplyHandler::abort()
 
 QNetworkReply* QNetworkReplyHandler::release()
 {
-    QNetworkReply* reply = m_reply;
-    if (m_reply) {
-        disconnect(m_reply, 0, this, 0);
-        // We have queued connections to the QNetworkReply. Make sure any
-        // posted meta call events that were the result of a signal emission
-        // don't reach the slots in our instance.
-        QCoreApplication::removePostedEvents(this, QEvent::MetaCall);
-        m_reply->setParent(0);
-        m_reply = 0;
-    }
+    if (!m_replyWrapper)
+        return 0;
+
+    QNetworkReply* reply = m_replyWrapper->release();
+    m_replyWrapper->deleteLater();
+    m_replyWrapper = 0;
     return reply;
 }
 
-static bool ignoreHttpError(QNetworkReply* reply, bool receivedData)
+static bool shouldIgnoreHttpError(QNetworkReply* reply, bool receivedData)
 {
     int httpStatusCode = reply->attribute(QNetworkRequest::HttpStatusCodeAttribute).toInt();
 
@@ -292,66 +365,73 @@ static bool ignoreHttpError(QNetworkReply* reply, bool receivedData)
 
 void QNetworkReplyHandler::finish()
 {
-    m_shouldFinish = (m_loadMode != LoadNormal);
-    if (m_shouldFinish)
+    ASSERT(m_hasStarted);
+
+    m_callFinishOnResume = m_deferred;
+    if (m_deferred)
         return;
 
-    if (!m_reply)
+    if (!m_replyWrapper || !m_replyWrapper->reply())
         return;
 
+
     sendResponseIfNeeded();
 
-    if (!m_resourceHandle)
+    if (wasAborted())
         return;
+
     ResourceHandleClient* client = m_resourceHandle->client();
     if (!client) {
-        m_reply->deleteLater();
-        m_reply = 0;
+        m_replyWrapper->deleteLater();
+        m_replyWrapper = 0;
         return;
     }
 
-    if (!m_redirected) {
-        if (!m_reply->error() || ignoreHttpError(m_reply, m_responseContainsData))
-            client->didFinishLoading(m_resourceHandle, 0);
-        else {
-            QUrl url = m_reply->url();
-            int httpStatusCode = m_reply->attribute(QNetworkRequest::HttpStatusCodeAttribute).toInt();
-
-            if (httpStatusCode) {
-                ResourceError error("HTTP", httpStatusCode, url.toString(), m_reply->attribute(QNetworkRequest::HttpReasonPhraseAttribute).toString());
-                client->didFail(m_resourceHandle, error);
-            } else {
-                ResourceError error("QtNetwork", m_reply->error(), url.toString(), m_reply->errorString());
-                client->didFail(m_resourceHandle, error);
-            }
-        }
-        if (m_reply) {
-            m_reply->deleteLater();
-            m_reply = 0;
-        }
-    } else {
-        if (m_reply) {
-            m_reply->deleteLater();
-            m_reply = 0;
-        }
+    if (m_redirected) {
         resetState();
         start();
+        return;
+    }
+
+    if (!m_replyWrapper->reply()->error() || shouldIgnoreHttpError(m_replyWrapper->reply(), m_responseContainsData))
+        client->didFinishLoading(m_resourceHandle, 0);
+    else {
+        QUrl url = m_replyWrapper->reply()->url();
+        int httpStatusCode = m_replyWrapper->reply()->attribute(QNetworkRequest::HttpStatusCodeAttribute).toInt();
+
+        if (httpStatusCode) {
+            ResourceError error("HTTP", httpStatusCode, url.toString(), m_replyWrapper->reply()->attribute(QNetworkRequest::HttpReasonPhraseAttribute).toString());
+            client->didFail(m_resourceHandle, error);
+        } else {
+            ResourceError error("QtNetwork", m_replyWrapper->reply()->error(), url.toString(), m_replyWrapper->reply()->errorString());
+            client->didFail(m_resourceHandle, error);
+        }
+    }
+
+    if (m_replyWrapper) {
+        m_replyWrapper->deleteLater();
+        m_replyWrapper = 0;
     }
 }
 
 void QNetworkReplyHandler::sendResponseIfNeeded()
 {
-    m_shouldSendResponse = (m_loadMode != LoadNormal);
-    if (m_shouldSendResponse)
+    ASSERT(m_hasStarted);
+
+    m_callSendResponseIfNeededOnResume = m_deferred;
+    if (m_deferred)
         return;
 
-    if (!m_reply)
+    if (!m_replyWrapper || !m_replyWrapper->reply())
         return;
 
-    if (m_reply->error() && !ignoreHttpError(m_reply, m_responseContainsData))
+    if (m_replyWrapper->reply()->error() && !shouldIgnoreHttpError(m_replyWrapper->reply(), m_responseContainsData))
         return;
 
-    if (m_responseSent || !m_resourceHandle)
+    if (wasAborted())
+        return;
+
+    if (m_responseSent)
         return;
     m_responseSent = true;
 
@@ -359,18 +439,18 @@ void QNetworkReplyHandler::sendResponseIfNeeded()
     if (!client)
         return;
 
-    WTF::String contentType = m_reply->header(QNetworkRequest::ContentTypeHeader).toString();
+    WTF::String contentType = m_replyWrapper->reply()->header(QNetworkRequest::ContentTypeHeader).toString();
     WTF::String encoding = extractCharsetFromMediaType(contentType);
     WTF::String mimeType = extractMIMETypeFromMediaType(contentType);
 
     if (mimeType.isEmpty()) {
         // let's try to guess from the extension
-        mimeType = MIMETypeRegistry::getMIMETypeForPath(m_reply->url().path());
+        mimeType = MIMETypeRegistry::getMIMETypeForPath(m_replyWrapper->reply()->url().path());
     }
 
-    KURL url(m_reply->url());
+    KURL url(m_replyWrapper->reply()->url());
     ResourceResponse response(url, mimeType.lower(),
-                              m_reply->header(QNetworkRequest::ContentLengthHeader).toLongLong(),
+                              m_replyWrapper->reply()->header(QNetworkRequest::ContentLengthHeader).toLongLong(),
                               encoding, String());
 
     if (url.isLocalFile()) {
@@ -379,10 +459,10 @@ void QNetworkReplyHandler::sendResponseIfNeeded()
     }
 
     // The status code is equal to 0 for protocols not in the HTTP family.
-    int statusCode = m_reply->attribute(QNetworkRequest::HttpStatusCodeAttribute).toInt();
+    int statusCode = m_replyWrapper->reply()->attribute(QNetworkRequest::HttpStatusCodeAttribute).toInt();
 
     if (url.protocolInHTTPFamily()) {
-        String suggestedFilename = filenameFromHTTPContentDisposition(QString::fromAscii(m_reply->rawHeader("Content-Disposition")));
+        String suggestedFilename = filenameFromHTTPContentDisposition(QString::fromLatin1(m_replyWrapper->reply()->rawHeader("Content-Disposition")));
 
         if (!suggestedFilename.isEmpty())
             response.setSuggestedFilename(suggestedFilename);
@@ -390,70 +470,79 @@ void QNetworkReplyHandler::sendResponseIfNeeded()
             response.setSuggestedFilename(url.lastPathComponent());
 
         response.setHTTPStatusCode(statusCode);
-        response.setHTTPStatusText(m_reply->attribute(QNetworkRequest::HttpReasonPhraseAttribute).toByteArray().constData());
+        response.setHTTPStatusText(m_replyWrapper->reply()->attribute(QNetworkRequest::HttpReasonPhraseAttribute).toByteArray().constData());
 
         // Add remaining headers.
-#if QT_VERSION >= QT_VERSION_CHECK(4, 7, 0)
-        foreach (const QNetworkReply::RawHeaderPair& pair, m_reply->rawHeaderPairs())
-            response.setHTTPHeaderField(QString::fromAscii(pair.first), QString::fromAscii(pair.second));
-#else
-        foreach (const QByteArray& headerName, m_reply->rawHeaderList())
-            response.setHTTPHeaderField(QString::fromAscii(headerName), QString::fromAscii(m_reply->rawHeader(headerName)));
-#endif
+        foreach (const QNetworkReply::RawHeaderPair& pair, m_replyWrapper->reply()->rawHeaderPairs())
+            response.setHTTPHeaderField(QString::fromLatin1(pair.first), QString::fromLatin1(pair.second));
     }
 
-    QUrl redirection = m_reply->attribute(QNetworkRequest::RedirectionTargetAttribute).toUrl();
+    QUrl redirection = m_replyWrapper->reply()->attribute(QNetworkRequest::RedirectionTargetAttribute).toUrl();
     if (redirection.isValid()) {
-        QUrl newUrl = m_reply->url().resolved(redirection);
+        redirect(response, redirection);
+        return;
+    }
 
-        m_redirectionTries--;
-        if (m_redirectionTries == 0) { // 10 or more redirections to the same url is considered infinite recursion
-            ResourceError error(newUrl.host(), 400 /*bad request*/,
-                                newUrl.toString(),
-                                QCoreApplication::translate("QWebPage", "Redirection limit reached"));
-            client->didFail(m_resourceHandle, error);
-            return;
-        }
-        m_redirected = true;
+    client->didReceiveResponse(m_resourceHandle, response);
+}
 
+void QNetworkReplyHandler::redirect(ResourceResponse& response, const QUrl& redirection)
+{
+    QUrl newUrl = m_replyWrapper->reply()->url().resolved(redirection);
 
-        //  Status Code 301 (Moved Permanently), 302 (Moved Temporarily), 303 (See Other):
-        //    - If original request is POST convert to GET and redirect automatically
-        //  Status Code 307 (Temporary Redirect) and all other redirect status codes:
-        //    - Use the HTTP method from the previous request
-        if ((statusCode >= 301 && statusCode <= 303) && m_resourceHandle->firstRequest().httpMethod() == "POST")
-            m_method = QNetworkAccessManager::GetOperation;
+    ResourceHandleClient* client = m_resourceHandle->client();
+    ASSERT(client);
+
+    int statusCode = m_replyWrapper->reply()->attribute(QNetworkRequest::HttpStatusCodeAttribute).toInt();
 
-        ResourceRequest newRequest = m_resourceHandle->firstRequest();
-        newRequest.setHTTPMethod(httpMethod());
-        newRequest.setURL(newUrl);
+    m_redirectionTries--;
+    if (!m_redirectionTries) {
+        ResourceError error(newUrl.host(), 400 /*bad request*/,
+                            newUrl.toString(),
+                            QCoreApplication::translate("QWebPage", "Redirection limit reached"));
+        client->didFail(m_resourceHandle, error);
+        return;
+    }
+    m_redirected = true;
 
-        // Should not set Referer after a redirect from a secure resource to non-secure one.
-        if (!newRequest.url().protocolIs("https") && protocolIs(newRequest.httpReferrer(), "https"))
-            newRequest.clearHTTPReferrer();
+    //  Status Code 301 (Moved Permanently), 302 (Moved Temporarily), 303 (See Other):
+    //    - If original request is POST convert to GET and redirect automatically
+    //  Status Code 307 (Temporary Redirect) and all other redirect status codes:
+    //    - Use the HTTP method from the previous request
+    if ((statusCode >= 301 && statusCode <= 303) && m_resourceHandle->firstRequest().httpMethod() == "POST")
+        m_method = QNetworkAccessManager::GetOperation;
 
-        client->willSendRequest(m_resourceHandle, newRequest, response);
-        if (!m_resourceHandle) // network error did cancel the request
-            return;
+    ResourceRequest newRequest = m_resourceHandle->firstRequest();
+    newRequest.setHTTPMethod(httpMethod());
+    newRequest.setURL(newUrl);
 
-        QObject* originatingObject = 0;
-        if (m_resourceHandle->getInternal()->m_context)
-            originatingObject = m_resourceHandle->getInternal()->m_context->originatingObject();
+    // Should not set Referer after a redirect from a secure resource to non-secure one.
+    if (!newRequest.url().protocolIs("https") && protocolIs(newRequest.httpReferrer(), "https"))
+        newRequest.clearHTTPReferrer();
 
-        m_request = newRequest.toNetworkRequest(originatingObject);
+    client->willSendRequest(m_resourceHandle, newRequest, response);
+    if (wasAborted()) // Network error cancelled the request.
         return;
-    }
 
-    client->didReceiveResponse(m_resourceHandle, response);
+    QObject* originatingObject = 0;
+    if (m_resourceHandle->getInternal()->m_context)
+        originatingObject = m_resourceHandle->getInternal()->m_context->originatingObject();
+
+    m_request = newRequest.toNetworkRequest(originatingObject);
 }
 
 void QNetworkReplyHandler::forwardData()
 {
-    m_shouldForwardData = (m_loadMode != LoadNormal);
-    if (m_shouldForwardData)
+    ASSERT(m_hasStarted);
+
+    m_callForwardDataOnResume = m_deferred;
+    if (m_deferred)
         return;
 
-    if (m_reply->bytesAvailable())
+    if (!m_replyWrapper || !m_replyWrapper->reply())
+        return;
+
+    if (m_replyWrapper->reply()->bytesAvailable())
         m_responseContainsData = true;
 
     sendResponseIfNeeded();
@@ -462,22 +551,25 @@ void QNetworkReplyHandler::forwardData()
     if (m_redirected)
         return;
 
-    if (!m_resourceHandle)
+    if (wasAborted())
         return;
 
-    QByteArray data = m_reply->read(m_reply->bytesAvailable());
+    QByteArray data = m_replyWrapper->reply()->read(m_replyWrapper->reply()->bytesAvailable());
 
     ResourceHandleClient* client = m_resourceHandle->client();
     if (!client)
         return;
 
+    // FIXME: https://bugs.webkit.org/show_bug.cgi?id=19793
+    // -1 means we do not provide any data about transfer size to inspector so it would use
+    // Content-Length headers or content size to show transfer size.
     if (!data.isEmpty())
-        client->didReceiveData(m_resourceHandle, data.constData(), data.length(), data.length() /*FixMe*/);
+        client->didReceiveData(m_resourceHandle, data.constData(), data.length(), -1);
 }
 
 void QNetworkReplyHandler::uploadProgress(qint64 bytesSent, qint64 bytesTotal)
 {
-    if (!m_resourceHandle)
+    if (wasAborted())
         return;
 
     ResourceHandleClient* client = m_resourceHandle->client();
@@ -487,9 +579,10 @@ void QNetworkReplyHandler::uploadProgress(qint64 bytesSent, qint64 bytesTotal)
     client->didSendData(m_resourceHandle, bytesSent, bytesTotal);
 }
 
-void QNetworkReplyHandler::start()
+QNetworkReply* QNetworkReplyHandler::sendNetworkRequest()
 {
-    m_shouldStart = false;
+    if (m_loadType == SynchronousLoad)
+        m_request.setAttribute(gSynchronousNetworkRequestAttribute, true);
 
     ResourceHandleInternal* d = m_resourceHandle->getInternal();
 
@@ -498,7 +591,7 @@ void QNetworkReplyHandler::start()
         manager = d->m_context->networkAccessManager();
 
     if (!manager)
-        return;
+        return 0;
 
     const QUrl url = m_request.url();
     const QString scheme = url.scheme();
@@ -511,108 +604,61 @@ void QNetworkReplyHandler::start()
 
     switch (m_method) {
         case QNetworkAccessManager::GetOperation:
-            m_reply = manager->get(m_request);
-            break;
+            return manager->get(m_request);
         case QNetworkAccessManager::PostOperation: {
-            FormDataIODevice* postDevice = new FormDataIODevice(d->m_firstRequest.httpBody()); 
+            FormDataIODevice* postDevice = new FormDataIODevice(d->m_firstRequest.httpBody());
             // We may be uploading files so prevent QNR from buffering data
             m_request.setHeader(QNetworkRequest::ContentLengthHeader, postDevice->getFormDataSize());
             m_request.setAttribute(QNetworkRequest::DoNotBufferUploadDataAttribute, QVariant(true));
-            m_reply = manager->post(m_request, postDevice);
-            postDevice->setParent(m_reply);
-            break;
+            QNetworkReply* result = manager->post(m_request, postDevice);
+            postDevice->setParent(result);
+            return result;
         }
         case QNetworkAccessManager::HeadOperation:
-            m_reply = manager->head(m_request);
-            break;
+            return manager->head(m_request);
         case QNetworkAccessManager::PutOperation: {
-            FormDataIODevice* putDevice = new FormDataIODevice(d->m_firstRequest.httpBody()); 
+            FormDataIODevice* putDevice = new FormDataIODevice(d->m_firstRequest.httpBody());
             // We may be uploading files so prevent QNR from buffering data
             m_request.setHeader(QNetworkRequest::ContentLengthHeader, putDevice->getFormDataSize());
             m_request.setAttribute(QNetworkRequest::DoNotBufferUploadDataAttribute, QVariant(true));
-            m_reply = manager->put(m_request, putDevice);
-            putDevice->setParent(m_reply);
-            break;
+            QNetworkReply* result = manager->put(m_request, putDevice);
+            putDevice->setParent(result);
+            return result;
         }
         case QNetworkAccessManager::DeleteOperation: {
-            m_reply = manager->deleteResource(m_request);
-            break;
+            return manager->deleteResource(m_request);
         }
-#if QT_VERSION >= QT_VERSION_CHECK(4, 7, 0)
         case QNetworkAccessManager::CustomOperation:
-            m_reply = manager->sendCustomRequest(m_request, m_resourceHandle->firstRequest().httpMethod().latin1().data());
-            break;
-#endif
-        case QNetworkAccessManager::UnknownOperation: {
-            m_reply = 0;
-            ResourceHandleClient* client = m_resourceHandle->client();
-            if (client) {
-                ResourceError error(url.host(), 400 /*bad request*/,
-                                    url.toString(),
-                                    QCoreApplication::translate("QWebPage", "Bad HTTP request"));
-                client->didFail(m_resourceHandle, error);
-            }
-            return;
-        }
-    }
-
-    m_reply->setParent(this);
-
-    if (m_loadMode == LoadSynchronously && m_reply->isFinished()) {
-        // If supported, a synchronous request will be finished at this point, no need to hook up the signals.
-        return;
-    }
-
-    connect(m_reply, SIGNAL(finished()),
-            this, SLOT(finish()), SIGNAL_CONN);
-
-    // For http(s) we know that the headers are complete upon metaDataChanged() emission, so we
-    // can send the response as early as possible
-    if (scheme == QLatin1String("http") || scheme == QLatin1String("https"))
-        connect(m_reply, SIGNAL(metaDataChanged()),
-                this, SLOT(sendResponseIfNeeded()), SIGNAL_CONN);
-
-    connect(m_reply, SIGNAL(readyRead()),
-            this, SLOT(forwardData()), SIGNAL_CONN);
-
-    if (m_resourceHandle->firstRequest().reportUploadProgress()) {
-        connect(m_reply, SIGNAL(uploadProgress(qint64, qint64)),
-                this, SLOT(uploadProgress(qint64, qint64)), SIGNAL_CONN);
+            return manager->sendCustomRequest(m_request, m_resourceHandle->firstRequest().httpMethod().latin1().data());
+        case QNetworkAccessManager::UnknownOperation:
+            ASSERT_NOT_REACHED();
+            return 0;
     }
-
-    // Make this a direct function call once we require 4.6.1+.
-    connect(this, SIGNAL(processQueuedItems()),
-            this, SLOT(sendQueuedItems()), SIGNAL_CONN);
+    return 0;
 }
 
-void QNetworkReplyHandler::resetState()
+void QNetworkReplyHandler::start()
 {
-    m_redirected = false;
-    m_responseSent = false;
-    m_responseContainsData = false;
-    m_shouldStart = true;
-    m_shouldFinish = false;
-    m_shouldSendResponse = false;
-    m_shouldForwardData = false;
-}
+    ASSERT(!m_hasStarted);
+    m_hasStarted = true;
 
-void QNetworkReplyHandler::sendQueuedItems()
-{
-    if (m_loadMode != LoadResuming)
+    QNetworkReply* reply = sendNetworkRequest();
+    if (!reply)
         return;
-    m_loadMode = LoadNormal;
 
-    if (m_shouldStart)
-        start();
+    m_replyWrapper = new QNetworkReplyWrapper(reply, this);
 
-    if (m_shouldSendResponse)
-        sendResponseIfNeeded();
+    if (m_loadType == SynchronousLoad && m_replyWrapper->reply()->isFinished()) {
+        // If supported, a synchronous request will be finished at this point, no need to hook up the signals.
+        return;
+    }
 
-    if (m_shouldForwardData)
-        forwardData();
+    connect(m_replyWrapper, SIGNAL(finished()), this, SLOT(finish()));
+    connect(m_replyWrapper, SIGNAL(metaDataChanged()), this, SLOT(sendResponseIfNeeded()));
+    connect(m_replyWrapper, SIGNAL(readyRead()), this, SLOT(forwardData()));
 
-    if (m_shouldFinish)
-        finish(); 
+    if (m_resourceHandle->firstRequest().reportUploadProgress())
+        connect(m_replyWrapper->reply(), SIGNAL(uploadProgress(qint64, qint64)), this, SLOT(uploadProgress(qint64, qint64)));
 }
 
 }
diff --git a/Source/WebCore/platform/network/qt/QNetworkReplyHandler.h b/Source/WebCore/platform/network/qt/QNetworkReplyHandler.h
index 8c9bd08..61694d6 100644
--- a/Source/WebCore/platform/network/qt/QNetworkReplyHandler.h
+++ b/Source/WebCore/platform/network/qt/QNetworkReplyHandler.h
@@ -34,56 +34,90 @@ QT_END_NAMESPACE
 namespace WebCore {
 
 class ResourceHandle;
+class ResourceResponse;
+
+class QNetworkReplyWrapper : public QObject {
+    Q_OBJECT
+public:
+    QNetworkReplyWrapper(QNetworkReply*, QObject* parent = 0);
+    ~QNetworkReplyWrapper();
+
+    QNetworkReply* reply() const { return m_reply; }
+    QNetworkReply* release();
+
+    QUrl redirectionTargetUrl() const { return m_redirectionTargetUrl; }
+    QString encoding() const { return m_encoding; }
+    QString advertisedMimeType() const { return m_advertisedMimeType; }
+
+Q_SIGNALS:
+    void finished();
+    void metaDataChanged();
+    void readyRead();
+    void uploadProgress(qint64 bytesSent, qint64 bytesTotal);
+
+private Q_SLOTS:
+    void receiveMetaData();
+    void didReceiveFinished();
+
+private:
+    void resetConnections();
+
+    QNetworkReply* m_reply;
+    QUrl m_redirectionTargetUrl;
+
+    QString m_encoding;
+    QString m_advertisedMimeType;
+};
 
 class QNetworkReplyHandler : public QObject
 {
     Q_OBJECT
 public:
-    enum LoadMode {
-        LoadNormal,
-        LoadDeferred,
-        LoadResuming,
-        LoadSynchronously
+    enum LoadType {
+        AsynchronousLoad,
+        SynchronousLoad
     };
 
-    QNetworkReplyHandler(ResourceHandle *handle, LoadMode);
-    void setLoadMode(LoadMode);
+    QNetworkReplyHandler(ResourceHandle*, LoadType, bool deferred = false);
+    void setLoadingDeferred(bool);
 
-    QNetworkReply* reply() const { return m_reply; }
+    QNetworkReply* reply() const { return m_replyWrapper ? m_replyWrapper->reply() : 0; }
 
     void abort();
 
     QNetworkReply* release();
 
-signals:
-    void processQueuedItems();
-
 public slots:
     void finish();
     void sendResponseIfNeeded();
     void forwardData();
-    void sendQueuedItems();
     void uploadProgress(qint64 bytesSent, qint64 bytesTotal);
 
 private:
     void start();
     void resetState();
     String httpMethod() const;
+    void resumeDeferredLoad();
+    void redirect(ResourceResponse&, const QUrl&);
+    bool wasAborted() const { return !m_resourceHandle; }
+    QNetworkReply* sendNetworkRequest();
 
-    QNetworkReply* m_reply;
+    QNetworkReplyWrapper* m_replyWrapper;
     ResourceHandle* m_resourceHandle;
     bool m_redirected;
     bool m_responseSent;
     bool m_responseContainsData;
-    LoadMode m_loadMode;
+    LoadType m_loadType;
     QNetworkAccessManager::Operation m_method;
     QNetworkRequest m_request;
 
+    bool m_deferred;
+
     // defer state holding
-    bool m_shouldStart;
-    bool m_shouldFinish;
-    bool m_shouldSendResponse;
-    bool m_shouldForwardData;
+    bool m_hasStarted;
+    bool m_callFinishOnResume;
+    bool m_callSendResponseIfNeededOnResume;
+    bool m_callForwardDataOnResume;
     int m_redirectionTries;
 };
 
diff --git a/Source/WebCore/platform/network/qt/ResourceHandleQt.cpp b/Source/WebCore/platform/network/qt/ResourceHandleQt.cpp
index cd17660..a6da432 100644
--- a/Source/WebCore/platform/network/qt/ResourceHandleQt.cpp
+++ b/Source/WebCore/platform/network/qt/ResourceHandleQt.cpp
@@ -42,9 +42,6 @@
 #include "ResourceHandleInternal.h"
 #include "SharedBuffer.h"
 
-// FIXME: WebCore including these headers from WebKit is a massive layering violation.
-#include "qwebframe_p.h"
-
 #include <QAbstractNetworkCache>
 #include <QCoreApplication>
 #include <QUrl>
@@ -140,7 +137,7 @@ bool ResourceHandle::start(NetworkingContext* context)
 
     getInternal()->m_context = context;
     ResourceHandleInternal *d = getInternal();
-    d->m_job = new QNetworkReplyHandler(this, QNetworkReplyHandler::LoadMode(d->m_defersLoading));
+    d->m_job = new QNetworkReplyHandler(this, QNetworkReplyHandler::AsynchronousLoad, d->m_defersLoading);
     return true;
 }
 
@@ -207,7 +204,7 @@ void ResourceHandle::loadResourceSynchronously(NetworkingContext* context, const
         d->m_firstRequest.setURL(urlWithCredentials);
     }
     d->m_context = context;
-    d->m_job = new QNetworkReplyHandler(handle.get(), QNetworkReplyHandler::LoadSynchronously);
+    d->m_job = new QNetworkReplyHandler(handle.get(), QNetworkReplyHandler::SynchronousLoad);
 
     QNetworkReply* reply = d->m_job->reply();
     // When using synchronous calls, we are finished when reaching this point.
@@ -225,8 +222,9 @@ void ResourceHandle::loadResourceSynchronously(NetworkingContext* context, const
 
 void ResourceHandle::platformSetDefersLoading(bool defers)
 {
-    if (d->m_job)
-        d->m_job->setLoadMode(QNetworkReplyHandler::LoadMode(defers));
+    if (!d->m_job)
+        return;
+    d->m_job->setLoadingDeferred(defers);
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/network/qt/ResourceRequestQt.cpp b/Source/WebCore/platform/network/qt/ResourceRequestQt.cpp
index 7e162ed..498c90a 100644
--- a/Source/WebCore/platform/network/qt/ResourceRequestQt.cpp
+++ b/Source/WebCore/platform/network/qt/ResourceRequestQt.cpp
@@ -83,13 +83,11 @@ QNetworkRequest ResourceRequest::toNetworkRequest(QObject* originatingFrame) con
         break;
     }
 
-#if QT_VERSION >= QT_VERSION_CHECK(4, 7, 0)
     if (!allowCookies()) {
         request.setAttribute(QNetworkRequest::CookieLoadControlAttribute, QNetworkRequest::Manual);
         request.setAttribute(QNetworkRequest::CookieSaveControlAttribute, QNetworkRequest::Manual);
         request.setAttribute(QNetworkRequest::AuthenticationReuseAttribute, QNetworkRequest::Manual);
     }
-#endif
 
     return request;
 }
diff --git a/Source/WebCore/platform/network/soup/ResourceHandleSoup.cpp b/Source/WebCore/platform/network/soup/ResourceHandleSoup.cpp
index d410fa3..e5da0e3 100644
--- a/Source/WebCore/platform/network/soup/ResourceHandleSoup.cpp
+++ b/Source/WebCore/platform/network/soup/ResourceHandleSoup.cpp
@@ -364,7 +364,10 @@ static void gotChunkCallback(SoupMessage* msg, SoupBuffer* chunk, gpointer data)
 
     ASSERT(!d->m_response.isNull());
 
-    client->didReceiveData(handle.get(), chunk->data, chunk->length, chunk->length);
+    // FIXME: https://bugs.webkit.org/show_bug.cgi?id=19793
+    // -1 means we do not provide any data about transfer size to inspector so it would use
+    // Content-Length headers or content size to show transfer size.
+    client->didReceiveData(handle.get(), chunk->data, chunk->length, -1);
 }
 
 static SoupSession* createSoupSession()
diff --git a/Source/WebCore/platform/network/win/ResourceHandleWin.cpp b/Source/WebCore/platform/network/win/ResourceHandleWin.cpp
index f50540c..dc5adc8 100644
--- a/Source/WebCore/platform/network/win/ResourceHandleWin.cpp
+++ b/Source/WebCore/platform/network/win/ResourceHandleWin.cpp
@@ -242,8 +242,11 @@ bool ResourceHandle::onRequestComplete()
                 resourceHandleClient->didReceiveResponse(this, response);
         }
 
+        // FIXME: https://bugs.webkit.org/show_bug.cgi?id=19793
+        // -1 means we do not provide any data about transfer size to inspector so it would use
+        // Content-Length headers or content size to show transfer size.
         if (ResourceHandleClient* resourceHandleClient = client())
-            resourceHandleClient->didReceiveData(this, buffer, buffers.dwBufferLength, 0);
+            resourceHandleClient->didReceiveData(this, buffer, buffers.dwBufferLength, -1);
         buffers.dwBufferLength = bufferSize;
     }
 
@@ -385,8 +388,11 @@ void ResourceHandle::fileLoadTimer(Timer<ResourceHandle>*)
         const int bufferSize = 8192;
         char buffer[bufferSize];
         result = ReadFile(fileHandle, &buffer, bufferSize, &bytesRead, 0);
+        // FIXME: https://bugs.webkit.org/show_bug.cgi?id=19793
+        // -1 means we do not provide any data about transfer size to inspector so it would use
+        // Content-Length headers or content size to show transfer size.
         if (result && bytesRead)
-            client()->didReceiveData(this, buffer, bytesRead, 0);
+            client()->didReceiveData(this, buffer, bytesRead, -1);
         // Check for end of file.
     } while (result && bytesRead);
 
diff --git a/Source/WebCore/platform/posix/FileSystemPOSIX.cpp b/Source/WebCore/platform/posix/FileSystemPOSIX.cpp
index c035310..9ad5f3a 100644
--- a/Source/WebCore/platform/posix/FileSystemPOSIX.cpp
+++ b/Source/WebCore/platform/posix/FileSystemPOSIX.cpp
@@ -30,6 +30,7 @@
 #include "FileSystem.h"
 
 #include "PlatformString.h"
+<<<<<<< HEAD
 #ifdef ANDROID_PLUGINS
 #include <dirent.h>
 #endif
@@ -38,6 +39,12 @@
 #ifdef ANDROID_PLUGINS
 #include <fnmatch.h>
 #endif
+=======
+#include <dirent.h>
+#include <errno.h>
+#include <fcntl.h>
+#include <fnmatch.h>
+>>>>>>> webkit.org at r82507
 #include <libgen.h>
 #include <sys/stat.h>
 #include <sys/types.h>
@@ -235,10 +242,30 @@ String directoryName(const String& path)
     return dirname(fsRep.mutableData());
 }
 
-// OK to not implement listDirectory at the moment, because it's only used for plug-ins, and
-// all platforms that use the shared plug-in implementation have implementations. We'd need
-// to implement it if we wanted to use PluginDatabase.cpp on the Mac. Better to not implement
-// at all and get a link error in case this arises, rather than having a stub here, because
-// with a stub you learn about the problem at runtime instead of link time.
+#if !PLATFORM(EFL)
+Vector<String> listDirectory(const String& path, const String& filter)
+{
+    Vector<String> entries;
+    CString cpath = path.utf8();
+    CString cfilter = filter.utf8();
+    DIR* dir = opendir(cpath.data());
+    if (dir) {
+        struct dirent* dp;
+        while ((dp = readdir(dir))) {
+            const char* name = dp->d_name;
+            if (!strcmp(name, ".") || !strcmp(name, ".."))
+                continue;
+            if (fnmatch(cfilter.data(), name, 0))
+                continue;
+            char filePath[1024];
+            if (static_cast<int>(sizeof(filePath) - 1) < snprintf(filePath, sizeof(filePath), "%s/%s", cpath.data(), name))
+                continue; // buffer overflow
+            entries.append(filePath);
+        }
+        closedir(dir);
+    }
+    return entries;
+}
+#endif
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/qt/CookieJarQt.cpp b/Source/WebCore/platform/qt/CookieJarQt.cpp
index db4a42a..3c4cd42 100644
--- a/Source/WebCore/platform/qt/CookieJarQt.cpp
+++ b/Source/WebCore/platform/qt/CookieJarQt.cpp
@@ -91,8 +91,7 @@ String cookies(const Document* document, const KURL& url)
     foreach (QNetworkCookie networkCookie, cookies) {
         if (networkCookie.isHttpOnly())
             continue;
-        resultCookies.append(QString::fromAscii(
-                             networkCookie.toRawForm(QNetworkCookie::NameAndValueOnly).constData()));
+        resultCookies.append(QString::fromLatin1(networkCookie.toRawForm(QNetworkCookie::NameAndValueOnly).constData()));
     }
 
     return resultCookies.join(QLatin1String("; "));
@@ -110,10 +109,8 @@ String cookieRequestHeaderFieldValue(const Document* document, const KURL &url)
         return String();
 
     QStringList resultCookies;
-    foreach (QNetworkCookie networkCookie, cookies) {
-        resultCookies.append(QString::fromAscii(
-                             networkCookie.toRawForm(QNetworkCookie::NameAndValueOnly).constData()));
-    }
+    foreach (QNetworkCookie networkCookie, cookies)
+        resultCookies.append(QString::fromLatin1(networkCookie.toRawForm(QNetworkCookie::NameAndValueOnly).constData()));
 
     return resultCookies.join(QLatin1String("; "));
 }
diff --git a/Source/WebCore/platform/qt/FileSystemQt.cpp b/Source/WebCore/platform/qt/FileSystemQt.cpp
index d88a967..32644d1 100644
--- a/Source/WebCore/platform/qt/FileSystemQt.cpp
+++ b/Source/WebCore/platform/qt/FileSystemQt.cpp
@@ -114,19 +114,19 @@ Vector<String> listDirectory(const String& path, const String& filter)
     return entries;
 }
 
-CString openTemporaryFile(const char* prefix, PlatformFileHandle& handle)
+String openTemporaryFile(const String& prefix, PlatformFileHandle& handle)
 {
 #ifndef QT_NO_TEMPORARYFILE
-    QTemporaryFile* tempFile = new QTemporaryFile(QDir::tempPath() + QLatin1Char('/') + QLatin1String(prefix));
+    QTemporaryFile* tempFile = new QTemporaryFile(QDir::tempPath() + QLatin1Char('/') + QString(prefix));
     tempFile->setAutoRemove(false);
     QFile* temp = tempFile;
     if (temp->open(QIODevice::ReadWrite)) {
         handle = temp;
-        return String(temp->fileName()).utf8();
+        return temp->fileName();
     }
 #endif
     handle = invalidPlatformFileHandle;
-    return CString();
+    return String();
 }
 
 PlatformFileHandle openFile(const String& path, FileOpenMode mode)
diff --git a/Source/WebCore/platform/qt/LanguageQt.cpp b/Source/WebCore/platform/qt/LanguageQt.cpp
index 71e554f..5a1d707 100644
--- a/Source/WebCore/platform/qt/LanguageQt.cpp
+++ b/Source/WebCore/platform/qt/LanguageQt.cpp
@@ -35,7 +35,7 @@ namespace WebCore {
 String platformDefaultLanguage()
 {
     QLocale locale;
-    return locale.name().replace("_", "-");
+    return locale.name().replace(QLatin1Char('_'), QLatin1Char('-'));
 }
 
 }
diff --git a/Source/WebCore/platform/qt/PasteboardQt.cpp b/Source/WebCore/platform/qt/PasteboardQt.cpp
index 6865fd7..850d68a 100644
--- a/Source/WebCore/platform/qt/PasteboardQt.cpp
+++ b/Source/WebCore/platform/qt/PasteboardQt.cpp
@@ -77,7 +77,7 @@ void Pasteboard::writeSelection(Range* selectedRange, bool canSmartCopyOrDelete,
     QApplication::clipboard()->setMimeData(md, m_selectionMode ? QClipboard::Selection : QClipboard::Clipboard);
 #endif
     if (canSmartCopyOrDelete)
-        md->setData("application/vnd.qtwebkit.smartpaste", QByteArray());
+        md->setData(QLatin1String("application/vnd.qtwebkit.smartpaste"), QByteArray());
 }
 
 bool Pasteboard::canSmartReplace()
diff --git a/Source/WebCore/platform/qt/RenderThemeQt.cpp b/Source/WebCore/platform/qt/RenderThemeQt.cpp
index ca8c6dd..cc654d5 100644
--- a/Source/WebCore/platform/qt/RenderThemeQt.cpp
+++ b/Source/WebCore/platform/qt/RenderThemeQt.cpp
@@ -1368,7 +1368,6 @@ bool RenderThemeQt::paintMediaSliderTrack(RenderObject* o, const PaintInfo& pain
 
     paintMediaBackground(p.painter, r);
 
-#if QT_VERSION >= QT_VERSION_CHECK(4, 7, 0)
     if (MediaPlayer* player = mediaElement->player()) {
         // Get the buffered parts of the media
         PassRefPtr<TimeRanges> buffered = player->buffered();
@@ -1386,7 +1385,6 @@ bool RenderThemeQt::paintMediaSliderTrack(RenderObject* o, const PaintInfo& pain
             }
         }
     }
-#endif
 
     return false;
 }
diff --git a/Source/WebCore/platform/text/BidiContext.cpp b/Source/WebCore/platform/text/BidiContext.cpp
index fb6b8cf..f507514 100644
--- a/Source/WebCore/platform/text/BidiContext.cpp
+++ b/Source/WebCore/platform/text/BidiContext.cpp
@@ -21,48 +21,80 @@
 
 #include "config.h"
 #include "BidiContext.h"
+#include <wtf/Vector.h>
 
 namespace WebCore {
 
 using namespace WTF::Unicode;
 
-inline PassRefPtr<BidiContext> BidiContext::createUncached(unsigned char level, Direction direction, bool override, BidiContext* parent)
+inline PassRefPtr<BidiContext> BidiContext::createUncached(unsigned char level, Direction direction, bool override, BidiEmbeddingSource source, BidiContext* parent)
 {
-    return adoptRef(new BidiContext(level, direction, override, parent));
+    return adoptRef(new BidiContext(level, direction, override, source, parent));
 }
 
-PassRefPtr<BidiContext> BidiContext::create(unsigned char level, Direction direction, bool override, BidiContext* parent)
+PassRefPtr<BidiContext> BidiContext::create(unsigned char level, Direction direction, bool override, BidiEmbeddingSource source, BidiContext* parent)
 {
     ASSERT(direction == (level % 2 ? RightToLeft : LeftToRight));
 
     if (parent)
-        return createUncached(level, direction, override, parent);
+        return createUncached(level, direction, override, source, parent);
 
     ASSERT(level <= 1);
     if (!level) {
         if (!override) {
-            static BidiContext* ltrContext = createUncached(0, LeftToRight, false, 0).releaseRef();
+            static BidiContext* ltrContext = createUncached(0, LeftToRight, false, FromStyleOrDOM, 0).releaseRef();
             return ltrContext;
         }
 
-        static BidiContext* ltrOverrideContext = createUncached(0, LeftToRight, true, 0).releaseRef();
+        static BidiContext* ltrOverrideContext = createUncached(0, LeftToRight, true, FromStyleOrDOM, 0).releaseRef();
         return ltrOverrideContext;
     }
 
     if (!override) {
-        static BidiContext* rtlContext = createUncached(1, RightToLeft, false, 0).releaseRef();
+        static BidiContext* rtlContext = createUncached(1, RightToLeft, false, FromStyleOrDOM, 0).releaseRef();
         return rtlContext;
     }
 
-    static BidiContext* rtlOverrideContext = createUncached(1, RightToLeft, true, 0).releaseRef();
+    static BidiContext* rtlOverrideContext = createUncached(1, RightToLeft, true, FromStyleOrDOM, 0).releaseRef();
     return rtlOverrideContext;
 }
 
+static inline PassRefPtr<BidiContext> copyContextAndRebaselineLevel(BidiContext* context, BidiContext* parent)
+{
+    ASSERT(context);
+    unsigned char newLevel = parent ? parent->level() : 0;
+    if (context->dir() == RightToLeft)
+        newLevel = nextGreaterOddLevel(newLevel);
+    else if (parent)
+        newLevel = nextGreaterEvenLevel(newLevel);
+
+    return BidiContext::create(newLevel, context->dir(), context->override(), context->source(), parent);
+}
+
+// The BidiContext stack must be immutable -- they're re-used for re-layout after
+// DOM modification/editing -- so we copy all the non-unicode contexts, and
+// recalculate their levels.
+PassRefPtr<BidiContext> BidiContext::copyStackRemovingUnicodeEmbeddingContexts()
+{
+    Vector<BidiContext*, 64> contexts;
+    for (BidiContext* iter = this; iter; iter = iter->parent()) {
+        if (iter->source() != FromUnicode)
+            contexts.append(iter);
+    }
+    ASSERT(contexts.size());
+ 
+    RefPtr<BidiContext> topContext = copyContextAndRebaselineLevel(contexts.last(), 0);
+    for (int i = contexts.size() - 1; i > 0; --i)
+        topContext = copyContextAndRebaselineLevel(contexts[i - 1], topContext.get());
+
+    return topContext.release();
+}
+
 bool operator==(const BidiContext& c1, const BidiContext& c2)
 {
     if (&c1 == &c2)
         return true;
-    if (c1.level() != c2.level() || c1.override() != c2.override() || c1.dir() != c2.dir())
+    if (c1.level() != c2.level() || c1.override() != c2.override() || c1.dir() != c2.dir() || c1.source() != c2.source())
         return false;
     if (!c1.parent())
         return !c2.parent();
diff --git a/Source/WebCore/platform/text/BidiContext.h b/Source/WebCore/platform/text/BidiContext.h
index b52815f..9f45d65 100644
--- a/Source/WebCore/platform/text/BidiContext.h
+++ b/Source/WebCore/platform/text/BidiContext.h
@@ -30,33 +30,52 @@
 
 namespace WebCore {
 
+enum BidiEmbeddingSource {
+    FromStyleOrDOM,
+    FromUnicode
+};
+
 // Used to keep track of explicit embeddings.
 class BidiContext : public RefCounted<BidiContext> {
 public:
-    static PassRefPtr<BidiContext> create(unsigned char level, WTF::Unicode::Direction direction, bool override = false, BidiContext* parent = 0);
+    static PassRefPtr<BidiContext> create(unsigned char level, WTF::Unicode::Direction, bool override = false, BidiEmbeddingSource = FromStyleOrDOM, BidiContext* parent = 0);
 
     BidiContext* parent() const { return m_parent.get(); }
     unsigned char level() const { return m_level; }
     WTF::Unicode::Direction dir() const { return static_cast<WTF::Unicode::Direction>(m_direction); }
     bool override() const { return m_override; }
+    BidiEmbeddingSource source() const { return static_cast<BidiEmbeddingSource>(m_source); }
 
+    PassRefPtr<BidiContext> copyStackRemovingUnicodeEmbeddingContexts();
 private:
-    BidiContext(unsigned char level, WTF::Unicode::Direction direction, bool override, BidiContext* parent)
+    BidiContext(unsigned char level, WTF::Unicode::Direction direction, bool override, BidiEmbeddingSource source, BidiContext* parent)
         : m_level(level)
         , m_direction(direction)
         , m_override(override)
+        , m_source(source)
         , m_parent(parent)
     {
     }
 
-    static PassRefPtr<BidiContext> createUncached(unsigned char level, WTF::Unicode::Direction, bool override, BidiContext* parent);
+    static PassRefPtr<BidiContext> createUncached(unsigned char level, WTF::Unicode::Direction, bool override, BidiEmbeddingSource, BidiContext* parent);
 
     unsigned char m_level;
     unsigned m_direction : 5; // Direction
     bool m_override : 1;
+    unsigned m_source : 1; // BidiEmbeddingSource
     RefPtr<BidiContext> m_parent;
 };
 
+inline unsigned char nextGreaterOddLevel(unsigned char level)
+{
+    return (level + 1) | 1;
+}
+
+inline unsigned char nextGreaterEvenLevel(unsigned char level)
+{
+    return (level + 2) & ~1;
+}
+
 bool operator==(const BidiContext&, const BidiContext&);
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/text/BidiResolver.h b/Source/WebCore/platform/text/BidiResolver.h
index 07e9274..5b92ee2 100644
--- a/Source/WebCore/platform/text/BidiResolver.h
+++ b/Source/WebCore/platform/text/BidiResolver.h
@@ -75,6 +75,21 @@ struct BidiStatus {
     RefPtr<BidiContext> context;
 };
 
+class BidiEmbedding {
+public:
+    BidiEmbedding(WTF::Unicode::Direction direction, BidiEmbeddingSource source)
+    : m_direction(direction)
+    , m_source(source)
+    {
+    }
+
+    WTF::Unicode::Direction direction() const { return m_direction; }
+    BidiEmbeddingSource source() const { return m_source; }
+private:
+    WTF::Unicode::Direction m_direction;
+    BidiEmbeddingSource m_source;
+};
+
 inline bool operator==(const BidiStatus& status1, const BidiStatus& status2)
 {
     return status1.eor == status2.eor && status1.last == status2.last && status1.lastStrong == status2.lastStrong && *(status1.context) == *(status2.context);
@@ -134,10 +149,10 @@ enum VisualDirectionOverride {
 
 template <class Iterator, class Run> class BidiResolver {
     WTF_MAKE_NONCOPYABLE(BidiResolver);
-public :
+public:
     BidiResolver()
         : m_direction(WTF::Unicode::OtherNeutral)
-        , reachedEndOfLine(false)
+        , m_reachedEndOfLine(false)
         , emptyRun(true)
         , m_firstRun(0)
         , m_lastRun(0)
@@ -146,10 +161,10 @@ public :
     {
     }
 
-    const Iterator& position() const { return current; }
-    void setPosition(const Iterator& position) { current = position; }
+    const Iterator& position() const { return m_current; }
+    void setPosition(const Iterator& position) { m_current = position; }
 
-    void increment() { current.increment(); }
+    void increment() { m_current.increment(); }
 
     BidiContext* context() const { return m_status.context.get(); }
     void setContext(PassRefPtr<BidiContext> c) { m_status.context = c; }
@@ -166,7 +181,7 @@ public :
 
     MidpointState<Iterator>& midpointState() { return m_midpointState; }
 
-    void embed(WTF::Unicode::Direction);
+    void embed(WTF::Unicode::Direction, BidiEmbeddingSource);
     bool commitExplicitEmbedding();
 
     void createBidiRunsForLine(const Iterator& end, VisualDirectionOverride = NoVisualOverride, bool hardLineBreak = false);
@@ -188,14 +203,16 @@ protected:
     void appendRun();
     void reverseRuns(unsigned start, unsigned end);
 
-    Iterator current;
-    Iterator sor;
-    Iterator eor;
-    Iterator last;
+    Iterator m_current;
+    // sor and eor are "start of run" and "end of run" respectively and correpond
+    // to abreviations used in UBA spec: http://unicode.org/reports/tr9/#BD7
+    Iterator m_sor;
+    Iterator m_eor;
+    Iterator m_last;
     BidiStatus m_status;
     WTF::Unicode::Direction m_direction;
     Iterator endOfLine;
-    bool reachedEndOfLine;
+    bool m_reachedEndOfLine;
     Iterator lastBeforeET;
     bool emptyRun;
 
@@ -210,7 +227,10 @@ private:
     void lowerExplicitEmbeddingLevel(WTF::Unicode::Direction from);
     void checkDirectionInLowerRaiseEmbeddingLevel();
 
-    Vector<WTF::Unicode::Direction, 8> m_currentExplicitEmbeddingSequence;
+    void updateStatusLastFromCurrentDirection(WTF::Unicode::Direction);
+    void reorderRunsFromLevels();
+
+    Vector<BidiEmbedding, 8> m_currentExplicitEmbeddingSequence;
 };
 
 template <class Iterator, class Run>
@@ -286,20 +306,20 @@ inline void BidiResolver<Iterator, Run>::moveRunToBeginning(Run* run)
 template <class Iterator, class Run>
 void BidiResolver<Iterator, Run>::appendRun()
 {
-    if (!emptyRun && !eor.atEnd()) {
-        unsigned startOffset = sor.offset();
-        unsigned endOffset = eor.offset();
+    if (!emptyRun && !m_eor.atEnd()) {
+        unsigned startOffset = m_sor.offset();
+        unsigned endOffset = m_eor.offset();
 
         if (!endOfLine.atEnd() && endOffset >= endOfLine.offset()) {
-            reachedEndOfLine = true;
+            m_reachedEndOfLine = true;
             endOffset = endOfLine.offset();
         }
 
         if (endOffset >= startOffset)
             addRun(new Run(startOffset, endOffset + 1, context(), m_direction));
 
-        eor.increment();
-        sor = eor;
+        m_eor.increment();
+        m_sor = m_eor;
     }
 
     m_direction = WTF::Unicode::OtherNeutral;
@@ -307,12 +327,12 @@ void BidiResolver<Iterator, Run>::appendRun()
 }
 
 template <class Iterator, class Run>
-void BidiResolver<Iterator, Run>::embed(WTF::Unicode::Direction d)
+void BidiResolver<Iterator, Run>::embed(WTF::Unicode::Direction dir, BidiEmbeddingSource source)
 {
     using namespace WTF::Unicode;
 
-    ASSERT(d == PopDirectionalFormat || d == LeftToRightEmbedding || d == LeftToRightOverride || d == RightToLeftEmbedding || d == RightToLeftOverride);
-    m_currentExplicitEmbeddingSequence.append(d);
+    ASSERT(dir == PopDirectionalFormat || dir == LeftToRightEmbedding || dir == LeftToRightOverride || dir == RightToLeftEmbedding || dir == RightToLeftOverride);
+    m_currentExplicitEmbeddingSequence.append(BidiEmbedding(dir, source));
 }
 
 template <class Iterator, class Run>
@@ -320,7 +340,7 @@ void BidiResolver<Iterator, Run>::checkDirectionInLowerRaiseEmbeddingLevel()
 {
     using namespace WTF::Unicode;
 
-    ASSERT(m_status.eor != OtherNeutral || eor.atEnd());
+    ASSERT(m_status.eor != OtherNeutral || m_eor.atEnd());
     ASSERT(m_status.last != NonSpacingMark
         && m_status.last != BoundaryNeutral
         && m_status.last != RightToLeftEmbedding
@@ -337,7 +357,7 @@ void BidiResolver<Iterator, Run>::lowerExplicitEmbeddingLevel(WTF::Unicode::Dire
 {
     using namespace WTF::Unicode;
 
-    if (!emptyRun && eor != last) {
+    if (!emptyRun && m_eor != m_last) {
         checkDirectionInLowerRaiseEmbeddingLevel();
         // bidi.sor ... bidi.eor ... bidi.last eor; need to append the bidi.sor-bidi.eor run or extend it through bidi.last
         if (from == LeftToRight) {
@@ -358,14 +378,14 @@ void BidiResolver<Iterator, Run>::lowerExplicitEmbeddingLevel(WTF::Unicode::Dire
             appendRun();
             m_direction = RightToLeft;
         }
-        eor = last;
+        m_eor = m_last;
     }
     appendRun();
     emptyRun = true;
     // sor for the new run is determined by the higher level (rule X10)
     setLastDir(from);
     setLastStrongDir(from);
-    eor = Iterator();
+    m_eor = Iterator();
 }
 
 template <class Iterator, class Run>
@@ -373,7 +393,7 @@ void BidiResolver<Iterator, Run>::raiseExplicitEmbeddingLevel(WTF::Unicode::Dire
 {
     using namespace WTF::Unicode;
 
-    if (!emptyRun && eor != last) {
+    if (!emptyRun && m_eor != m_last) {
         checkDirectionInLowerRaiseEmbeddingLevel();
         // bidi.sor ... bidi.eor ... bidi.last eor; need to append the bidi.sor-bidi.eor run or extend it through bidi.last
         if (to == LeftToRight) {
@@ -396,13 +416,13 @@ void BidiResolver<Iterator, Run>::raiseExplicitEmbeddingLevel(WTF::Unicode::Dire
             appendRun();
             m_direction = RightToLeft;
         }
-        eor = last;
+        m_eor = m_last;
     }
     appendRun();
     emptyRun = true;
     setLastDir(to);
     setLastStrongDir(to);
-    eor = Iterator();
+    m_eor = Iterator();
 }
 
 template <class Iterator, class Run>
@@ -414,25 +434,20 @@ bool BidiResolver<Iterator, Run>::commitExplicitEmbedding()
     RefPtr<BidiContext> toContext = context();
 
     for (size_t i = 0; i < m_currentExplicitEmbeddingSequence.size(); ++i) {
-        Direction embedding = m_currentExplicitEmbeddingSequence[i];
-        if (embedding == PopDirectionalFormat) {
+        BidiEmbedding embedding = m_currentExplicitEmbeddingSequence[i];
+        if (embedding.direction() == PopDirectionalFormat) {
             if (BidiContext* parentContext = toContext->parent())
                 toContext = parentContext;
         } else {
-            Direction direction = (embedding == RightToLeftEmbedding || embedding == RightToLeftOverride) ? RightToLeft : LeftToRight;
-            bool override = embedding == LeftToRightOverride || embedding == RightToLeftOverride;
+            Direction direction = (embedding.direction() == RightToLeftEmbedding || embedding.direction() == RightToLeftOverride) ? RightToLeft : LeftToRight;
+            bool override = embedding.direction() == LeftToRightOverride || embedding.direction() == RightToLeftOverride;
             unsigned char level = toContext->level();
-            if (direction == RightToLeft) {
-                // Go to the least greater odd integer
-                level += 1;
-                level |= 1;
-            } else {
-                // Go to the least greater even integer
-                level += 2;
-                level &= ~1;
-            }
+            if (direction == RightToLeft)
+                level = nextGreaterOddLevel(level);
+            else
+                level = nextGreaterEvenLevel(level);
             if (level < 61)
-                toContext = BidiContext::create(level, direction, override, toContext.get());
+                toContext = BidiContext::create(level, direction, override, embedding.source(), toContext.get());
         }
     }
 
@@ -520,6 +535,85 @@ void BidiResolver<Iterator, Run>::reverseRuns(unsigned start, unsigned end)
 }
 
 template <class Iterator, class Run>
+inline void BidiResolver<Iterator, Run>::updateStatusLastFromCurrentDirection(WTF::Unicode::Direction dirCurrent)
+{
+    using namespace WTF::Unicode;
+    switch (dirCurrent) {
+    case EuropeanNumberTerminator:
+        if (m_status.last != EuropeanNumber)
+            m_status.last = EuropeanNumberTerminator;
+        break;
+    case EuropeanNumberSeparator:
+    case CommonNumberSeparator:
+    case SegmentSeparator:
+    case WhiteSpaceNeutral:
+    case OtherNeutral:
+        switch (m_status.last) {
+        case LeftToRight:
+        case RightToLeft:
+        case RightToLeftArabic:
+        case EuropeanNumber:
+        case ArabicNumber:
+            m_status.last = dirCurrent;
+            break;
+        default:
+            m_status.last = OtherNeutral;
+        }
+        break;
+    case NonSpacingMark:
+    case BoundaryNeutral:
+    case RightToLeftEmbedding:
+    case LeftToRightEmbedding:
+    case RightToLeftOverride:
+    case LeftToRightOverride:
+    case PopDirectionalFormat:
+        // ignore these
+        break;
+    case EuropeanNumber:
+        // fall through
+    default:
+        m_status.last = dirCurrent;
+    }
+}
+
+template <class Iterator, class Run>
+inline void BidiResolver<Iterator, Run>::reorderRunsFromLevels()
+{
+    unsigned char levelLow = 128;
+    unsigned char levelHigh = 0;
+    for (Run* run = firstRun(); run; run = run->next()) {
+        levelHigh = std::max(run->level(), levelHigh);
+        levelLow = std::min(run->level(), levelLow);
+    }
+
+    // This implements reordering of the line (L2 according to Bidi spec):
+    // http://unicode.org/reports/tr9/#L2
+    // L2. From the highest level found in the text to the lowest odd level on each line,
+    // reverse any contiguous sequence of characters that are at that level or higher.
+
+    // Reversing is only done up to the lowest odd level.
+    if (!(levelLow % 2))
+        levelLow++;
+
+    unsigned count = runCount() - 1;
+
+    while (levelHigh >= levelLow) {
+        unsigned i = 0;
+        Run* run = firstRun();
+        while (i < count) {
+            for (;i < count && run && run->level() < levelHigh; i++)
+                run = run->next();
+            unsigned start = i;
+            for (;i <= count && run && run->level() >= levelHigh; i++)
+                run = run->next();
+            unsigned end = i - 1;
+            reverseRuns(start, end);
+        }
+        levelHigh--;
+    }
+}
+
+template <class Iterator, class Run>
 void BidiResolver<Iterator, Run>::createBidiRunsForLine(const Iterator& end, VisualDirectionOverride override, bool hardLineBreak)
 {
     using namespace WTF::Unicode;
@@ -528,10 +622,10 @@ void BidiResolver<Iterator, Run>::createBidiRunsForLine(const Iterator& end, Vis
 
     if (override != NoVisualOverride) {
         emptyRun = false;
-        sor = current;
-        eor = Iterator();
-        while (current != end && !current.atEnd()) {
-            eor = current;
+        m_sor = m_current;
+        m_eor = Iterator();
+        while (m_current != end && !m_current.atEnd()) {
+            m_eor = m_current;
             increment();
         }
         m_direction = override == VisualLeftToRightOverride ? LeftToRight : RightToLeft;
@@ -544,29 +638,34 @@ void BidiResolver<Iterator, Run>::createBidiRunsForLine(const Iterator& end, Vis
 
     emptyRun = true;
 
-    eor = Iterator();
+    m_eor = Iterator();
 
-    last = current;
+    m_last = m_current;
     bool pastEnd = false;
     BidiResolver<Iterator, Run> stateAtEnd;
 
     while (true) {
         Direction dirCurrent;
-        if (pastEnd && (hardLineBreak || current.atEnd())) {
+        if (pastEnd && (hardLineBreak || m_current.atEnd())) {
             BidiContext* c = context();
-            while (c->parent())
-                c = c->parent();
-            dirCurrent = c->dir();
             if (hardLineBreak) {
                 // A deviation from the Unicode Bidi Algorithm in order to match
-                // Mac OS X text and WinIE: a hard line break resets bidi state.
-                stateAtEnd.setContext(c);
+                // WinIE and user expectations: hard line breaks reset bidi state
+                // coming from unicode bidi control characters, but not those from
+                // DOM nodes with specified directionality
+                stateAtEnd.setContext(c->copyStackRemovingUnicodeEmbeddingContexts());
+
+                dirCurrent = stateAtEnd.context()->dir();
                 stateAtEnd.setEorDir(dirCurrent);
                 stateAtEnd.setLastDir(dirCurrent);
                 stateAtEnd.setLastStrongDir(dirCurrent);
+            } else {
+                while (c->parent())
+                    c = c->parent();
+                dirCurrent = c->dir();
             }
         } else {
-            dirCurrent = current.direction();
+            dirCurrent = m_current.direction();
             if (context()->override()
                     && dirCurrent != RightToLeftEmbedding
                     && dirCurrent != LeftToRightEmbedding
@@ -578,7 +677,7 @@ void BidiResolver<Iterator, Run>::createBidiRunsForLine(const Iterator& end, Vis
                 dirCurrent = m_status.last;
         }
 
-        ASSERT(m_status.eor != OtherNeutral || eor.atEnd());
+        ASSERT(m_status.eor != OtherNeutral || m_eor.atEnd());
         switch (dirCurrent) {
 
         // embedding and overrides (X1-X9 in the Bidi specs)
@@ -587,7 +686,7 @@ void BidiResolver<Iterator, Run>::createBidiRunsForLine(const Iterator& end, Vis
         case RightToLeftOverride:
         case LeftToRightOverride:
         case PopDirectionalFormat:
-            embed(dirCurrent);
+            embed(dirCurrent, FromUnicode);
             commitExplicitEmbedding();
             break;
 
@@ -618,7 +717,7 @@ void BidiResolver<Iterator, Run>::createBidiRunsForLine(const Iterator& end, Vis
                             appendRun();
                             if (context()->dir() != LeftToRight) {
                                 // the neutrals take the embedding direction, which is R
-                                eor = last;
+                                m_eor = m_last;
                                 m_direction = RightToLeft;
                                 appendRun();
                             }
@@ -629,14 +728,14 @@ void BidiResolver<Iterator, Run>::createBidiRunsForLine(const Iterator& end, Vis
                         appendRun();
                         if (context()->dir() != LeftToRight) {
                             // the neutrals take the embedding direction, which is R
-                            eor = last;
+                            m_eor = m_last;
                             m_direction = RightToLeft;
                             appendRun();
                         }
                     } else if (m_status.lastStrong != LeftToRight) {
                         //last stuff takes embedding dir
                         if (context()->dir() == RightToLeft) {
-                            eor = last; 
+                            m_eor = m_last; 
                             m_direction = RightToLeft;
                         }
                         appendRun();
@@ -644,7 +743,7 @@ void BidiResolver<Iterator, Run>::createBidiRunsForLine(const Iterator& end, Vis
                 default:
                     break;
             }
-            eor = current;
+            m_eor = m_current;
             m_status.eor = LeftToRight;
             m_status.lastStrong = LeftToRight;
             m_direction = LeftToRight;
@@ -669,19 +768,19 @@ void BidiResolver<Iterator, Run>::createBidiRunsForLine(const Iterator& end, Vis
                 case OtherNeutral:
                     if (m_status.eor == EuropeanNumber) {
                         if (m_status.lastStrong == LeftToRight && context()->dir() == LeftToRight)
-                            eor = last;
+                            m_eor = m_last;
                         appendRun();
                     } else if (m_status.eor == ArabicNumber)
                         appendRun();
                     else if (m_status.lastStrong == LeftToRight) {
                         if (context()->dir() == LeftToRight)
-                            eor = last;
+                            m_eor = m_last;
                         appendRun();
                     }
                 default:
                     break;
             }
-            eor = current;
+            m_eor = m_current;
             m_status.eor = RightToLeft;
             m_status.lastStrong = dirCurrent;
             m_direction = RightToLeft;
@@ -699,7 +798,7 @@ void BidiResolver<Iterator, Run>::createBidiRunsForLine(const Iterator& end, Vis
                     case RightToLeft:
                     case RightToLeftArabic:
                     case ArabicNumber:
-                        eor = last;
+                        m_eor = m_last;
                         appendRun();
                         m_direction = EuropeanNumber;
                         break;
@@ -719,7 +818,7 @@ void BidiResolver<Iterator, Run>::createBidiRunsForLine(const Iterator& end, Vis
                                 // Terminate the EN run.
                                 appendRun();
                                 // Make an R run.
-                                eor = m_status.last == EuropeanNumberTerminator ? lastBeforeET : last;
+                                m_eor = m_status.last == EuropeanNumberTerminator ? lastBeforeET : m_last;
                                 m_direction = RightToLeft;
                                 appendRun();
                                 // Begin a new EN run.
@@ -730,7 +829,7 @@ void BidiResolver<Iterator, Run>::createBidiRunsForLine(const Iterator& end, Vis
                             appendRun();
                             if (m_status.lastStrong == RightToLeft || context()->dir() == RightToLeft) {
                                 // Make an R run.
-                                eor = m_status.last == EuropeanNumberTerminator ? lastBeforeET : last;
+                                m_eor = m_status.last == EuropeanNumberTerminator ? lastBeforeET : m_last;
                                 m_direction = RightToLeft;
                                 appendRun();
                                 // Begin a new EN run.
@@ -738,7 +837,7 @@ void BidiResolver<Iterator, Run>::createBidiRunsForLine(const Iterator& end, Vis
                             }
                         } else if (m_status.lastStrong == RightToLeft) {
                             // Extend the R run to include the neutrals.
-                            eor = m_status.last == EuropeanNumberTerminator ? lastBeforeET : last;
+                            m_eor = m_status.last == EuropeanNumberTerminator ? lastBeforeET : m_last;
                             m_direction = RightToLeft;
                             appendRun();
                             // Begin a new EN run.
@@ -747,7 +846,7 @@ void BidiResolver<Iterator, Run>::createBidiRunsForLine(const Iterator& end, Vis
                     default:
                         break;
                 }
-                eor = current;
+                m_eor = m_current;
                 m_status.eor = EuropeanNumber;
                 if (m_direction == OtherNeutral)
                     m_direction = LeftToRight;
@@ -765,7 +864,7 @@ void BidiResolver<Iterator, Run>::createBidiRunsForLine(const Iterator& end, Vis
                 case RightToLeft:
                 case RightToLeftArabic:
                 case EuropeanNumber:
-                    eor = last;
+                    m_eor = m_last;
                     appendRun();
                     break;
                 case CommonNumberSeparator:
@@ -787,12 +886,12 @@ void BidiResolver<Iterator, Run>::createBidiRunsForLine(const Iterator& end, Vis
                         m_direction = RightToLeft;
                     } else if (m_direction == OtherNeutral)
                         m_direction = m_status.lastStrong == LeftToRight ? LeftToRight : RightToLeft;
-                    eor = last;
+                    m_eor = m_last;
                     appendRun();
                 default:
                     break;
             }
-            eor = current;
+            m_eor = m_current;
             m_status.eor = ArabicNumber;
             if (m_direction == OtherNeutral)
                 m_direction = ArabicNumber;
@@ -803,16 +902,16 @@ void BidiResolver<Iterator, Run>::createBidiRunsForLine(const Iterator& end, Vis
         case EuropeanNumberTerminator:
             if (m_status.last == EuropeanNumber) {
                 dirCurrent = EuropeanNumber;
-                eor = current;
+                m_eor = m_current;
                 m_status.eor = dirCurrent;
             } else if (m_status.last != EuropeanNumberTerminator)
-                lastBeforeET = emptyRun ? eor : last;
+                lastBeforeET = emptyRun ? m_eor : m_last;
             break;
 
         // boundary neutrals should be ignored
         case BoundaryNeutral:
-            if (eor == last)
-                eor = current;
+            if (m_eor == m_last)
+                m_eor = m_current;
             break;
             // neutrals
         case BlockSeparator:
@@ -829,9 +928,9 @@ void BidiResolver<Iterator, Run>::createBidiRunsForLine(const Iterator& end, Vis
             break;
         }
 
-        if (pastEnd && eor == current) {
-            if (!reachedEndOfLine) {
-                eor = endOfLine;
+        if (pastEnd && m_eor == m_current) {
+            if (!m_reachedEndOfLine) {
+                m_eor = endOfLine;
                 switch (m_status.eor) {
                     case LeftToRight:
                     case RightToLeft:
@@ -846,60 +945,23 @@ void BidiResolver<Iterator, Run>::createBidiRunsForLine(const Iterator& end, Vis
                 }
                 appendRun();
             }
-            current = end;
+            m_current = end;
             m_status = stateAtEnd.m_status;
-            sor = stateAtEnd.sor; 
-            eor = stateAtEnd.eor;
-            last = stateAtEnd.last;
-            reachedEndOfLine = stateAtEnd.reachedEndOfLine;
+            m_sor = stateAtEnd.m_sor; 
+            m_eor = stateAtEnd.m_eor;
+            m_last = stateAtEnd.m_last;
+            m_reachedEndOfLine = stateAtEnd.m_reachedEndOfLine;
             lastBeforeET = stateAtEnd.lastBeforeET;
             emptyRun = stateAtEnd.emptyRun;
             m_direction = OtherNeutral;
             break;
         }
 
-        // set m_status.last as needed.
-        switch (dirCurrent) {
-            case EuropeanNumberTerminator:
-                if (m_status.last != EuropeanNumber)
-                    m_status.last = EuropeanNumberTerminator;
-                break;
-            case EuropeanNumberSeparator:
-            case CommonNumberSeparator:
-            case SegmentSeparator:
-            case WhiteSpaceNeutral:
-            case OtherNeutral:
-                switch(m_status.last) {
-                    case LeftToRight:
-                    case RightToLeft:
-                    case RightToLeftArabic:
-                    case EuropeanNumber:
-                    case ArabicNumber:
-                        m_status.last = dirCurrent;
-                        break;
-                    default:
-                        m_status.last = OtherNeutral;
-                    }
-                break;
-            case NonSpacingMark:
-            case BoundaryNeutral:
-            case RightToLeftEmbedding: 
-            case LeftToRightEmbedding: 
-            case RightToLeftOverride: 
-            case LeftToRightOverride: 
-            case PopDirectionalFormat:
-                // ignore these
-                break;
-            case EuropeanNumber:
-                // fall through
-            default:
-                m_status.last = dirCurrent;
-        }
-
-        last = current;
+        updateStatusLastFromCurrentDirection(dirCurrent);
+        m_last = m_current;
 
         if (emptyRun) {
-            sor = current;
+            m_sor = m_current;
             emptyRun = false;
         }
 
@@ -907,12 +969,12 @@ void BidiResolver<Iterator, Run>::createBidiRunsForLine(const Iterator& end, Vis
         if (!m_currentExplicitEmbeddingSequence.isEmpty()) {
             bool committed = commitExplicitEmbedding();
             if (committed && pastEnd) {
-                current = end;
+                m_current = end;
                 m_status = stateAtEnd.m_status;
-                sor = stateAtEnd.sor; 
-                eor = stateAtEnd.eor;
-                last = stateAtEnd.last;
-                reachedEndOfLine = stateAtEnd.reachedEndOfLine;
+                m_sor = stateAtEnd.m_sor; 
+                m_eor = stateAtEnd.m_eor;
+                m_last = stateAtEnd.m_last;
+                m_reachedEndOfLine = stateAtEnd.m_reachedEndOfLine;
                 lastBeforeET = stateAtEnd.lastBeforeET;
                 emptyRun = stateAtEnd.emptyRun;
                 m_direction = OtherNeutral;
@@ -920,64 +982,23 @@ void BidiResolver<Iterator, Run>::createBidiRunsForLine(const Iterator& end, Vis
             }
         }
 
-        if (!pastEnd && (current == end || current.atEnd())) {
+        if (!pastEnd && (m_current == end || m_current.atEnd())) {
             if (emptyRun)
                 break;
             stateAtEnd.m_status = m_status;
-            stateAtEnd.sor = sor; 
-            stateAtEnd.eor = eor;
-            stateAtEnd.last = last;
-            stateAtEnd.reachedEndOfLine = reachedEndOfLine;
+            stateAtEnd.m_sor = m_sor;
+            stateAtEnd.m_eor = m_eor;
+            stateAtEnd.m_last = m_last;
+            stateAtEnd.m_reachedEndOfLine = m_reachedEndOfLine;
             stateAtEnd.lastBeforeET = lastBeforeET;
             stateAtEnd.emptyRun = emptyRun;
-            endOfLine = last;
+            endOfLine = m_last;
             pastEnd = true;
         }
     }
 
     m_logicallyLastRun = m_lastRun;
-
-    // reorder line according to run structure...
-    // first find highest and lowest levels
-    unsigned char levelLow = 128;
-    unsigned char levelHigh = 0;
-    Run* r = firstRun();
-    while (r) {
-        if (r->m_level > levelHigh)
-            levelHigh = r->m_level;
-        if (r->m_level < levelLow)
-            levelLow = r->m_level;
-        r = r->next();
-    }
-
-    // implements reordering of the line (L2 according to Bidi spec):
-    // L2. From the highest level found in the text to the lowest odd level on each line,
-    // reverse any contiguous sequence of characters that are at that level or higher.
-
-    // reversing is only done up to the lowest odd level
-    if (!(levelLow % 2))
-        levelLow++;
-
-    unsigned count = runCount() - 1;
-
-    while (levelHigh >= levelLow) {
-        unsigned i = 0;
-        Run* currRun = firstRun();
-        while (i < count) {
-            while (i < count && currRun && currRun->m_level < levelHigh) {
-                i++;
-                currRun = currRun->next();
-            }
-            unsigned start = i;
-            while (i <= count && currRun && currRun->m_level >= levelHigh) {
-                i++;
-                currRun = currRun->next();
-            }
-            unsigned end = i - 1;
-            reverseRuns(start, end);
-        }
-        levelHigh--;
-    }
+    reorderRunsFromLevels();
     endOfLine = Iterator();
 }
 
diff --git a/Source/WebCore/platform/text/LocalizedNumber.h b/Source/WebCore/platform/text/LocalizedNumber.h
index d70541f..01d2553 100644
--- a/Source/WebCore/platform/text/LocalizedNumber.h
+++ b/Source/WebCore/platform/text/LocalizedNumber.h
@@ -47,7 +47,9 @@ double parseLocalizedNumber(const String&);
 // current locale.  If an implementation doesn't support localized
 // numbers or the input value is NaN or Infinitiy, the function should
 // return an empty string.
-String formatLocalizedNumber(double);
+// fractionDigits is the maximum length of the fractional parts of the
+// resultant string.
+String formatLocalizedNumber(double, unsigned fractionDigits);
 
 } // namespace WebCore
 
diff --git a/Source/WebCore/platform/text/LocalizedNumberICU.cpp b/Source/WebCore/platform/text/LocalizedNumberICU.cpp
index 189151e..7c4b1cb 100644
--- a/Source/WebCore/platform/text/LocalizedNumberICU.cpp
+++ b/Source/WebCore/platform/text/LocalizedNumberICU.cpp
@@ -34,6 +34,7 @@
 #include <limits>
 #include <unicode/numfmt.h>
 #include <unicode/parsepos.h>
+#include <wtf/MathExtras.h>
 #include <wtf/PassOwnPtr.h>
 
 using namespace std;
@@ -73,12 +74,13 @@ double parseLocalizedNumber(const String& numberString)
     return U_SUCCESS(status) ? numericResult : numeric_limits<double>::quiet_NaN();
 }
 
-String formatLocalizedNumber(double number)
+String formatLocalizedNumber(double number, unsigned fractionDigits)
 {
     NumberFormat* formatter = numberFormatter();
     if (!formatter)
         return String();
     UnicodeString result;
+    formatter->setMaximumFractionDigits(clampToInteger(fractionDigits));
     formatter->format(number, result);
     return String(result.getBuffer(), result.length());
 }
diff --git a/Source/WebCore/platform/text/LocalizedNumberNone.cpp b/Source/WebCore/platform/text/LocalizedNumberNone.cpp
index 729f2f1..c7a8ed2 100644
--- a/Source/WebCore/platform/text/LocalizedNumberNone.cpp
+++ b/Source/WebCore/platform/text/LocalizedNumberNone.cpp
@@ -42,7 +42,7 @@ double parseLocalizedNumber(const String&)
     return numeric_limits<double>::quiet_NaN();
 }
 
-String formatLocalizedNumber(double)
+String formatLocalizedNumber(double, unsigned)
 {
     return String();
 }
diff --git a/Source/WebCore/platform/text/TextCheckerClient.h b/Source/WebCore/platform/text/TextCheckerClient.h
index acaa02c..8abbed4 100644
--- a/Source/WebCore/platform/text/TextCheckerClient.h
+++ b/Source/WebCore/platform/text/TextCheckerClient.h
@@ -28,6 +28,8 @@
 #ifndef TextCheckerClient_h
 #define TextCheckerClient_h
 
+#include "TextChecking.h"
+
 #include <wtf/Forward.h>
 #include <wtf/Vector.h>
 #include <wtf/text/WTFString.h>
@@ -70,7 +72,7 @@ public:
     virtual void checkSpellingOfString(const UChar*, int length, int* misspellingLocation, int* misspellingLength) = 0;
     virtual String getAutoCorrectSuggestionForMisspelledWord(const String& misspelledWord) = 0;
     virtual void checkGrammarOfString(const UChar*, int length, Vector<GrammarDetail>&, int* badGrammarLocation, int* badGrammarLength) = 0;
-#if PLATFORM(MAC) && !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
+#if USE(UNIFIED_TEXT_CHECKING)
     virtual void checkTextOfParagraph(const UChar* text, int length, uint64_t checkingTypes, Vector<TextCheckingResult>& results) = 0;
 #endif
 
diff --git a/Source/WebCore/platform/text/TextChecking.h b/Source/WebCore/platform/text/TextChecking.h
new file mode 100644
index 0000000..022fb82
--- /dev/null
+++ b/Source/WebCore/platform/text/TextChecking.h
@@ -0,0 +1,47 @@
+/*
+ * Copyright (c) 2011 Google Inc. All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ * 
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef TextChecking_h
+#define TextChecking_h
+
+namespace WebCore {
+
+#if !defined(BUILDING_ON_TIGER)
+#define WTF_USE_GRAMMAR_CHECKING 1
+#endif
+
+#if PLATFORM(MAC) && !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
+#define WTF_USE_UNIFIED_TEXT_CHECKING 1
+#define WTF_USE_AUTOMATIC_TEXT_REPLACEMENT 1
+#endif
+
+}
+
+#endif // TextChecking_h
diff --git a/Source/WebCore/platform/text/TextCodec.h b/Source/WebCore/platform/text/TextCodec.h
index 35229a3..0c2a38a 100644
--- a/Source/WebCore/platform/text/TextCodec.h
+++ b/Source/WebCore/platform/text/TextCodec.h
@@ -52,7 +52,7 @@ namespace WebCore {
         // Encodes the character as en entity as above, but escaped
         // non-alphanumeric characters. This is used in URLs.
         // For example, U+6DE would be "%26%231758%3B".
-        URLEncodedEntitiesForUnencodables,
+        URLEncodedEntitiesForUnencodables
     };
 
     typedef char UnencodableReplacementArray[32];
diff --git a/Source/WebCore/platform/text/TextCodecICU.cpp b/Source/WebCore/platform/text/TextCodecICU.cpp
index d07b50e..0d99196 100644
--- a/Source/WebCore/platform/text/TextCodecICU.cpp
+++ b/Source/WebCore/platform/text/TextCodecICU.cpp
@@ -149,13 +149,6 @@ void TextCodecICU::registerEncodingNames(EncodingNameRegistrar registrar)
     registrar("x-windows-949", "windows-949");
     registrar("x-uhc", "windows-949");
     registrar("shift-jis", "Shift_JIS");
-#if !USE(BUILTIN_UTF8_CODEC)
-    registrar("unicode11utf8", "UTF-8");
-    registrar("unicode20utf8", "UTF-8");
-    registrar("x-unicode20utf8", "UTF-8");
-    registrar("utf8", "UTF-8");
-    registrar("UTF-8", "UTF-8");
-#endif
 
     // These aliases are present in modern versions of ICU, but use different codecs, and have no standard names.
     // They are not present in ICU 3.2.
diff --git a/Source/WebCore/platform/text/TextEncodingRegistry.cpp b/Source/WebCore/platform/text/TextEncodingRegistry.cpp
index f604227..d6450b1 100644
--- a/Source/WebCore/platform/text/TextEncodingRegistry.cpp
+++ b/Source/WebCore/platform/text/TextEncodingRegistry.cpp
@@ -223,10 +223,8 @@ static void buildBaseTextCodecMaps()
     TextCodecLatin1::registerEncodingNames(addToTextEncodingNameMap);
     TextCodecLatin1::registerCodecs(addToTextCodecMap);
 
-#if USE(BUILTIN_UTF8_CODEC)
     TextCodecUTF8::registerEncodingNames(addToTextEncodingNameMap);
     TextCodecUTF8::registerCodecs(addToTextCodecMap);
-#endif
 
     TextCodecUTF16::registerEncodingNames(addToTextEncodingNameMap);
     TextCodecUTF16::registerCodecs(addToTextCodecMap);
diff --git a/Source/WebCore/platform/mac/WebCoreKeyGenerator.m b/Source/WebCore/platform/text/TextOrientation.h
index a1e780c..e229f1e 100644
--- a/Source/WebCore/platform/mac/WebCoreKeyGenerator.m
+++ b/Source/WebCore/platform/text/TextOrientation.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2003 Apple Inc. All rights reserved.
+ * Copyright (C) 2011 Apple Computer, Inc.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -23,41 +23,13 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
-#import "config.h"
-#import "WebCoreKeyGenerator.h"
+#ifndef TextOrientation_h
+#define TextOrientation_h
 
-#import <wtf/Assertions.h>
-#import <wtf/UnusedParam.h>
+namespace WebCore {
 
-static WebCoreKeyGenerator *sharedGenerator;
+enum TextOrientation { TextOrientationVerticalRight, TextOrientationUpright };
 
-@implementation WebCoreKeyGenerator
-
-+ (WebCoreKeyGenerator *)sharedGenerator
-{
-    return sharedGenerator;
-}
-
-- init
-{
-    ASSERT(!sharedGenerator);
-    [super init];
-    sharedGenerator = [self retain];
-    return self;
-}
-
-- (NSArray *)strengthMenuItemTitles
-{
-    return nil;
-}
-
-- (NSString *)signedPublicKeyAndChallengeStringWithStrengthIndex:(unsigned)unusedIndex challenge:(NSString *)unusedChallenge pageURL:(NSURL *)unusedPageURL
-{
-    UNUSED_PARAM(unusedIndex);
-    UNUSED_PARAM(unusedChallenge);
-    UNUSED_PARAM(unusedPageURL);
-
-    return nil;
 }
 
-@end
+#endif
diff --git a/Source/WebCore/platform/text/mac/LocalizedNumberMac.mm b/Source/WebCore/platform/text/mac/LocalizedNumberMac.mm
index 8cfe200..826f707 100644
--- a/Source/WebCore/platform/text/mac/LocalizedNumberMac.mm
+++ b/Source/WebCore/platform/text/mac/LocalizedNumberMac.mm
@@ -65,10 +65,12 @@ double parseLocalizedNumber(const String& numberString)
     return [number doubleValue];
 }
 
-String formatLocalizedNumber(double inputNumber)
+String formatLocalizedNumber(double inputNumber, unsigned fractionDigits)
 {
     RetainPtr<NSNumber> number(AdoptNS, [[NSNumber alloc] initWithDouble:inputNumber]);
-    return String([numberFormatter() stringFromNumber:number.get()]);
+    RetainPtr<NSNumberFormatter> formatter = numberFormatter();
+    [formatter.get() setMaximumFractionDigits:fractionDigits];
+    return String([formatter.get() stringFromNumber:number.get()]);
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/text/qt/TextBreakIteratorQt.cpp b/Source/WebCore/platform/text/qt/TextBreakIteratorQt.cpp
index 3fae657..1fe400c 100644
--- a/Source/WebCore/platform/text/qt/TextBreakIteratorQt.cpp
+++ b/Source/WebCore/platform/text/qt/TextBreakIteratorQt.cpp
@@ -22,6 +22,7 @@
 #include "TextBreakIterator.h"
 
 #include <QtCore/qtextboundaryfinder.h>
+#include <algorithm>
 #include <qdebug.h>
 
 // #define DEBUG_TEXT_ITERATORS
@@ -89,7 +90,7 @@ const char* currentTextBreakLocaleID()
         TextBreakIterator* lineBreakIterator = 0;
         if (staticLineBreakIterator) {
             setUpIterator(*staticLineBreakIterator, QTextBoundaryFinder::Line, string, length);
-            swap(staticLineBreakIterator, lineBreakIterator);
+            std::swap(staticLineBreakIterator, lineBreakIterator);
         }
 
         if (!lineBreakIterator && string && length)
diff --git a/Source/WebCore/platform/win/ClipboardUtilitiesWin.cpp b/Source/WebCore/platform/win/ClipboardUtilitiesWin.cpp
index 513992d..33d8ccd 100644
--- a/Source/WebCore/platform/win/ClipboardUtilitiesWin.cpp
+++ b/Source/WebCore/platform/win/ClipboardUtilitiesWin.cpp
@@ -130,7 +130,7 @@ static bool getWebLocData(const DragDataMap* dataObject, String& url, String* ti
     if (!dataObject->contains(cfHDropFormat()->cfFormat))
         return false;
 
-    wcscpy(filename, dataObject->get(cfHDropFormat()->cfFormat)[0].characters());
+    wcscpy(filename, dataObject->get(cfHDropFormat()->cfFormat)[0].charactersWithNullTermination());
     if (_wcsicmp(PathFindExtensionW(filename), L".url"))
         return false;    
 
diff --git a/Source/WebCore/platform/win/CursorWin.cpp b/Source/WebCore/platform/win/CursorWin.cpp
index 0036388..3a8cc09 100644
--- a/Source/WebCore/platform/win/CursorWin.cpp
+++ b/Source/WebCore/platform/win/CursorWin.cpp
@@ -30,6 +30,7 @@
 #include "BitmapInfo.h"
 #include "Image.h"
 #include "IntPoint.h"
+#include "SystemInfo.h"
 
 #include <wtf/OwnPtr.h>
 
@@ -39,20 +40,12 @@
 
 namespace WebCore {
 
-static inline bool supportsAlphaCursors() 
-{
-    OSVERSIONINFO osinfo = {0};
-    osinfo.dwOSVersionInfoSize = sizeof(OSVERSIONINFO);
-    GetVersionEx(&osinfo);
-    return osinfo.dwMajorVersion > 5 || (osinfo.dwMajorVersion == 5 && osinfo.dwMinorVersion > 0);
-}
-
 static PassRefPtr<SharedCursor> createSharedCursor(Image* img, const IntPoint& hotSpot)
 {
     RefPtr<SharedCursor> impl;
 
     IntPoint effectiveHotSpot = determineHotSpot(img, hotSpot);
-    static bool doAlpha = supportsAlphaCursors();
+    static bool doAlpha = windowsVersion() >= WindowsXP;
     BitmapInfo cursorImage = BitmapInfo::create(IntSize(img->width(), img->height()));
 
     HDC dc = GetDC(0);
diff --git a/Source/WebCore/platform/win/FileSystemWin.cpp b/Source/WebCore/platform/win/FileSystemWin.cpp
index 5ee3b8e..03a2eaf 100644
--- a/Source/WebCore/platform/win/FileSystemWin.cpp
+++ b/Source/WebCore/platform/win/FileSystemWin.cpp
@@ -31,9 +31,11 @@
 #include "FileSystem.h"
 
 #include "NotImplemented.h"
+#include "PathWalker.h"
 #include "PlatformString.h"
 #include <wtf/HashMap.h>
 #include <wtf/text/CString.h>
+#include <wtf/text/StringConcatenate.h>
 
 #include <windows.h>
 #include <winbase.h>
@@ -184,18 +186,18 @@ static String cachedStorageDirectory(DWORD pathIdentifier)
     return directory;
 }
 
-CString openTemporaryFile(const char*, PlatformFileHandle& handle)
+String openTemporaryFile(const String&, PlatformFileHandle& handle)
 {
     handle = INVALID_HANDLE_VALUE;
 
     char tempPath[MAX_PATH];
     int tempPathLength = ::GetTempPathA(WTF_ARRAY_LENGTH(tempPath), tempPath);
     if (tempPathLength <= 0 || tempPathLength > WTF_ARRAY_LENGTH(tempPath))
-        return CString();
+        return String();
 
     HCRYPTPROV hCryptProv = 0;
     if (!CryptAcquireContext(&hCryptProv, 0, 0, PROV_RSA_FULL, CRYPT_VERIFYCONTEXT))
-        return CString();
+        return String();
 
     char proposedPath[MAX_PATH];
     while (1) {
@@ -226,9 +228,28 @@ CString openTemporaryFile(const char*, PlatformFileHandle& handle)
     CryptReleaseContext(hCryptProv, 0);
 
     if (!isHandleValid(handle))
-        return CString();
+        return String();
 
-    return proposedPath;
+    return String::fromUTF8(proposedPath);
+}
+
+PlatformFileHandle openFile(const String& path, FileOpenMode mode)
+{
+    DWORD desiredAccess = 0;
+    DWORD creationDisposition = 0;
+    switch (mode) {
+    case OpenForRead:
+        desiredAccess = GENERIC_READ;
+        creationDisposition = OPEN_EXISTING;
+    case OpenForWrite:
+        desiredAccess = GENERIC_WRITE;
+        creationDisposition = CREATE_ALWAYS;
+    default:
+        ASSERT_NOT_REACHED();
+    }
+
+    String destination = path;
+    return CreateFile(destination.charactersWithNullTermination(), desiredAccess, 0, 0, creationDisposition, FILE_ATTRIBUTE_NORMAL, 0);
 }
 
 void closeFile(PlatformFileHandle& handle)
@@ -297,10 +318,21 @@ bool safeCreateFile(const String& path, CFDataRef data)
     return true;
 }
 
-Vector<String> listDirectory(const String& path, const String& filter)
+Vector<String> listDirectory(const String& directory, const String& filter)
 {
     Vector<String> entries;
-    notImplemented();
+
+    PathWalker walker(directory, filter);
+    if (!walker.isValid())
+        return entries;
+
+    do {
+        if (walker.data().dwFileAttributes & FILE_ATTRIBUTE_DIRECTORY)
+            continue;
+
+        entries.append(makeString(directory, "\\", reinterpret_cast<const UChar*>(walker.data().cFileName)));
+    } while (walker.step());
+
     return entries;
 }
 
diff --git a/Source/WebCore/platform/win/LocalizedStringsWin.cpp b/Source/WebCore/platform/win/LocalizedStringsWin.cpp
new file mode 100644
index 0000000..67de0fc
--- /dev/null
+++ b/Source/WebCore/platform/win/LocalizedStringsWin.cpp
@@ -0,0 +1,39 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "LocalizedStrings.h"
+
+#include <wtf/text/WTFString.h>
+
+namespace WebCore {
+
+String localizedString(const char* key)
+{
+    // FIXME: <rdar://problem/9119405> Win: WebKit2 needs to be made localizable
+    return String::fromUTF8(key, strlen(key));
+}
+
+} // namespace WebCore
diff --git a/Source/WebCore/platform/win/PathWalker.cpp b/Source/WebCore/platform/win/PathWalker.cpp
new file mode 100644
index 0000000..cb4fccb
--- /dev/null
+++ b/Source/WebCore/platform/win/PathWalker.cpp
@@ -0,0 +1,51 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "PathWalker.h"
+
+#include <wtf/text/StringConcatenate.h>
+
+namespace WebCore {
+
+PathWalker::PathWalker(const String& directory, const String& pattern)
+{
+    String path = makeString(directory, "\\", pattern);
+    m_handle = ::FindFirstFileW(path.charactersWithNullTermination(), &m_data);
+}
+
+PathWalker::~PathWalker()
+{
+    if (!isValid())
+        return;
+    ::FindClose(m_handle);
+}
+
+bool PathWalker::step()
+{
+    return ::FindNextFileW(m_handle, &m_data);
+}
+
+} // namespace WebCore
diff --git a/Source/WebCore/platform/win/PathWalker.h b/Source/WebCore/platform/win/PathWalker.h
new file mode 100644
index 0000000..219c837
--- /dev/null
+++ b/Source/WebCore/platform/win/PathWalker.h
@@ -0,0 +1,51 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include <Windows.h>
+#include <wtf/Noncopyable.h>
+
+namespace WTF {
+    class String;
+}
+
+namespace WebCore {
+
+class PathWalker {
+    WTF_MAKE_NONCOPYABLE(PathWalker);
+public:
+    PathWalker(const WTF::String& directory, const WTF::String& pattern);
+    ~PathWalker();
+
+    bool isValid() const { return m_handle != INVALID_HANDLE_VALUE; }
+    const WIN32_FIND_DATAW& data() const { return m_data; }
+
+    bool step();
+
+private:
+    HANDLE m_handle;
+    WIN32_FIND_DATAW m_data;
+};
+
+} // namespace WebCore
diff --git a/Source/WebCore/platform/win/SSLKeyGeneratorWin.cpp b/Source/WebCore/platform/win/SSLKeyGeneratorWin.cpp
index 50aee8e..b10961b 100644
--- a/Source/WebCore/platform/win/SSLKeyGeneratorWin.cpp
+++ b/Source/WebCore/platform/win/SSLKeyGeneratorWin.cpp
@@ -30,6 +30,7 @@ namespace WebCore {
 
 void WebCore::getSupportedKeySizes(Vector<String>& v)
 {
+    // FIXME: Strings should be localizable.
     v.append("High Grade");
     v.append("Medium Grade");
 }
diff --git a/Source/WebCore/platform/win/ScrollbarThemeWin.cpp b/Source/WebCore/platform/win/ScrollbarThemeWin.cpp
index ff3aaa4..576cd92 100644
--- a/Source/WebCore/platform/win/ScrollbarThemeWin.cpp
+++ b/Source/WebCore/platform/win/ScrollbarThemeWin.cpp
@@ -100,7 +100,7 @@ ScrollbarThemeWin::ScrollbarThemeWin()
     if (!initialized) {
         initialized = true;
         checkAndInitScrollbarTheme();
-        runningVista = isRunningOnVistaOrLater();
+        runningVista = (windowsVersion() >= WindowsVista);
     }
 }
 
diff --git a/Source/WebCore/platform/win/SystemInfo.cpp b/Source/WebCore/platform/win/SystemInfo.cpp
index f2fe62b..878a6cc 100644
--- a/Source/WebCore/platform/win/SystemInfo.cpp
+++ b/Source/WebCore/platform/win/SystemInfo.cpp
@@ -27,30 +27,155 @@
 #include "SystemInfo.h"
 
 #include <windows.h>
+#include <wtf/text/StringConcatenate.h>
 
 namespace WebCore {
 
-bool isRunningOnVistaOrLater()
+WindowsVersion windowsVersion(int* major, int* minor)
 {
+    static bool initialized = false;
+    static WindowsVersion version;
+    static int majorVersion, minorVersion;
+
+    if (!initialized) {
+        initialized = true;
+#if OS(WINCE)
+        OSVERSIONINFO versionInfo;
+#else
+        OSVERSIONINFOEX versionInfo;
+#endif
+        ZeroMemory(&versionInfo, sizeof(versionInfo));
+        versionInfo.dwOSVersionInfoSize = sizeof(versionInfo);
+        GetVersionEx(reinterpret_cast<OSVERSIONINFO*>(&versionInfo));
+        majorVersion = versionInfo.dwMajorVersion;
+        minorVersion = versionInfo.dwMinorVersion;
+
 #if OS(WINCE)
-    return false;
+        if (majorVersion >= 1 && majorVersion <= 7)
+            version = static_cast<WindowsVersion>(WindowsCE1 + (majorVersion - 1));
+        else
+            version = (majorVersion < 1) ? WindowsCE1 : WindowsCE7;
 #else
-    static bool isVistaOrLater;
-    static bool initialized;
+        if (versionInfo.dwPlatformId == VER_PLATFORM_WIN32s)
+            version = Windows3_1;
+        else if (versionInfo.dwPlatformId == VER_PLATFORM_WIN32_WINDOWS) {
+            if (!minorVersion)
+                version = Windows95;
+            else
+                version = (minorVersion == 10) ? Windows98 : WindowsME;
+        } else {
+            if (majorVersion == 5) {
+                if (!minorVersion)
+                    version = Windows2000;
+                else
+                    version = (minorVersion == 1) ? WindowsXP : WindowsServer2003;
+            } else if (majorVersion >= 6) {
+                if (versionInfo.wProductType == VER_NT_WORKSTATION)
+                    version = (majorVersion == 6 && !minorVersion) ? WindowsVista : Windows7;
+                else
+                    version = WindowsServer2008;
+            } else
+                version = (majorVersion == 4) ? WindowsNT4 : WindowsNT3;
+        }
+#endif
+    }
 
-    if (initialized)
-        return isVistaOrLater;
+    if (major)
+        *major = majorVersion;
+    if (minor)
+        *minor = minorVersion;
+    return version;
+}
+
+static String osVersionForUAString()
+{
+    int major, minor;
+    WindowsVersion version = windowsVersion(&major, &minor);
+    switch (version) {
+    case WindowsCE1:
+    case WindowsCE2:
+    case WindowsCE3:
+        return "Windows CE";
+    case WindowsCE4:
+        return "Windows CE .NET";
+    case Windows3_1:
+        return "Windows 3.1";
+    case Windows95:
+        return "Windows 95";
+    case Windows98:
+        return "Windows 98";
+    case WindowsME:
+        return "Windows 98; Win 9x 4.90";
+    case WindowsNT4:
+        return "WinNT4.0";
+    }
 
-    initialized = true;
+    const char* familyName = (version >= WindowsNT3) ? "Windows NT " : "Windows CE ";
+    return makeString(familyName, String::number(major), '.', String::number(minor));
+}
 
-    OSVERSIONINFOEX vi = {0};
-    vi.dwOSVersionInfoSize = sizeof(OSVERSIONINFOEX);
-    GetVersionEx(reinterpret_cast<OSVERSIONINFO*>(&vi));
+#if !OS(WINCE)
+static bool isWOW64()
+{
+    static bool initialized = false;
+    static bool wow64 = false;
 
-    isVistaOrLater = vi.dwMajorVersion >= 6;
+    if (!initialized) {
+        initialized = true;
+        HMODULE kernel32Module = GetModuleHandleA("kernel32.dll");
+        if (!kernel32Module)
+            return wow64;
+        typedef BOOL (WINAPI* IsWow64ProcessFunc)(HANDLE, PBOOL);
+        IsWow64ProcessFunc isWOW64Process = reinterpret_cast<IsWow64ProcessFunc>(GetProcAddress(kernel32Module, "IsWow64Process"));
+        if (isWOW64Process) {
+            BOOL result = FALSE;
+            wow64 = isWOW64Process(GetCurrentProcess(), &result) && result;
+        }
+    }
 
-    return isVistaOrLater;
+    return wow64;
+}
+
+static WORD processorArchitecture()
+{
+    static bool initialized = false;
+    static WORD architecture = PROCESSOR_ARCHITECTURE_INTEL;
+
+    if (!initialized) {
+        initialized = true;
+        HMODULE kernel32Module = GetModuleHandleA("kernel32.dll");
+        if (!kernel32Module)
+            return architecture;
+        typedef VOID (WINAPI* GetNativeSystemInfoFunc)(LPSYSTEM_INFO);
+        GetNativeSystemInfoFunc getNativeSystemInfo = reinterpret_cast<GetNativeSystemInfoFunc>(GetProcAddress(kernel32Module, "GetNativeSystemInfo"));
+        if (getNativeSystemInfo) {
+            SYSTEM_INFO systemInfo;
+            ZeroMemory(&systemInfo, sizeof(systemInfo));
+            getNativeSystemInfo(&systemInfo);
+            architecture = systemInfo.wProcessorArchitecture;
+        }
+    }
+
+    return architecture;
+}
 #endif
+
+static String architectureTokenForUAString()
+{
+#if !OS(WINCE)
+    if (isWOW64())
+        return "; WOW64";
+    if (processorArchitecture() == PROCESSOR_ARCHITECTURE_AMD64)
+        return "; Win64; x64";
+    if (processorArchitecture() == PROCESSOR_ARCHITECTURE_IA64)
+        return "; Win64; IA64";
+#endif
+    return String();
+}
+
+String windowsVersionForUAString()
+{
+    return makeString(osVersionForUAString(), architectureTokenForUAString());
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/win/SystemInfo.h b/Source/WebCore/platform/win/SystemInfo.h
index 9f2c2a0..2631ace 100644
--- a/Source/WebCore/platform/win/SystemInfo.h
+++ b/Source/WebCore/platform/win/SystemInfo.h
@@ -26,9 +26,44 @@
 #ifndef SystemInfo_h
 #define SystemInfo_h
 
+#include <wtf/text/WTFString.h>
+
 namespace WebCore {
 
-bool isRunningOnVistaOrLater();
+// NOTE: Keep these in order so callers can do things like
+// "if (windowsVersion() >= WindowsVista) ...". It's OK to change or add values,
+// though.
+enum WindowsVersion {
+    // CE-based versions
+    WindowsCE1 = 0,
+    WindowsCE2,
+    WindowsCE3,
+    WindowsCE4,
+    WindowsCE5,
+    WindowsCE6,
+    WindowsCE7,
+    // 3.x-based versions
+    Windows3_1,
+    // 9x-based versions
+    Windows95,
+    Windows98,
+    WindowsME,
+    // NT-based versions
+    WindowsNT3,
+    WindowsNT4,
+    Windows2000,
+    WindowsXP,
+    WindowsServer2003,
+    WindowsVista,
+    WindowsServer2008,
+    Windows7,
+};
+
+// If supplied, |major| and |minor| are set to the OSVERSIONINFO::dwMajorVersion
+// and dwMinorVersion field values, respectively.
+WindowsVersion windowsVersion(int* major = 0, int* minor = 0);
+
+String windowsVersionForUAString();
 
 } // namespace WebCore
 
diff --git a/Source/WebCore/platform/wince/FileSystemWinCE.cpp b/Source/WebCore/platform/wince/FileSystemWinCE.cpp
index 49acf12..3e28a01 100644
--- a/Source/WebCore/platform/wince/FileSystemWinCE.cpp
+++ b/Source/WebCore/platform/wince/FileSystemWinCE.cpp
@@ -187,18 +187,18 @@ String directoryName(const String& path)
     return path.left(pos);
 }
 
-CString openTemporaryFile(const char*, PlatformFileHandle& handle)
+String openTemporaryFile(const String&, PlatformFileHandle& handle)
 {
     handle = INVALID_HANDLE_VALUE;
 
     wchar_t tempPath[MAX_PATH];
     int tempPathLength = ::GetTempPath(WTF_ARRAY_LENGTH(tempPath), tempPath);
     if (tempPathLength <= 0 || tempPathLength > WTF_ARRAY_LENGTH(tempPath))
-        return CString();
+        return String();
 
     HCRYPTPROV hCryptProv = 0;
     if (!CryptAcquireContext(&hCryptProv, 0, 0, PROV_RSA_FULL, CRYPT_VERIFYCONTEXT))
-        return CString();
+        return String();
 
     String proposedPath;
     while (1) {
@@ -229,9 +229,28 @@ CString openTemporaryFile(const char*, PlatformFileHandle& handle)
     CryptReleaseContext(hCryptProv, 0);
 
     if (!isHandleValid(handle))
-        return CString();
+        return String();
+
+    return proposedPath;
+}
+
+PlatformFileHandle openFile(const String& path, FileOpenMode mode)
+{
+    DWORD desiredAccess = 0;
+    DWORD creationDisposition = 0;
+    switch (mode) {
+        case OpenForRead:
+            desiredAccess = GENERIC_READ;
+            creationDisposition = OPEN_EXISTING;
+        case OpenForWrite:
+            desiredAccess = GENERIC_WRITE;
+            creationDisposition = CREATE_ALWAYS;
+        default:
+            ASSERT_NOT_REACHED();
+    }
 
-    return proposedPath.latin1();
+    String destination = path;
+    return CreateFile(destination.charactersWithNullTermination(), desiredAccess, 0, 0, creationDisposition, FILE_ATTRIBUTE_NORMAL, 0);
 }
 
 void closeFile(PlatformFileHandle& handle)
diff --git a/Source/WebCore/platform/wx/FileSystemWx.cpp b/Source/WebCore/platform/wx/FileSystemWx.cpp
index bfcaf88..3c2b453 100644
--- a/Source/WebCore/platform/wx/FileSystemWx.cpp
+++ b/Source/WebCore/platform/wx/FileSystemWx.cpp
@@ -107,11 +107,11 @@ String directoryName(const String& path)
     return wxFileName(path).GetPath();
 }
 
-CString openTemporaryFile(const char* prefix, PlatformFileHandle& handle)
+String openTemporaryFile(const String&, PlatformFileHandle& handle)
 {
     notImplemented();
     handle = invalidPlatformFileHandle;
-    return CString();
+    return String();
 }
 
 void closeFile(PlatformFileHandle&)
diff --git a/Source/WebCore/platform/wx/LocalizedStringsWx.cpp b/Source/WebCore/platform/wx/LocalizedStringsWx.cpp
index 835c3cd..8ec791e 100644
--- a/Source/WebCore/platform/wx/LocalizedStringsWx.cpp
+++ b/Source/WebCore/platform/wx/LocalizedStringsWx.cpp
@@ -212,7 +212,7 @@ String contextMenuItemTagSearchWeb()
     return String("Search Web");
 }
 
-String contextMenuItemTagLookUpInDictionary() 
+String contextMenuItemTagLookUpInDictionary(const String&)
 {
     return String("Look Up in Dictionary");
 }
diff --git a/Source/WebCore/plugins/PluginPackage.cpp b/Source/WebCore/plugins/PluginPackage.cpp
index 10149bf..285f5c5 100644
--- a/Source/WebCore/plugins/PluginPackage.cpp
+++ b/Source/WebCore/plugins/PluginPackage.cpp
@@ -348,7 +348,7 @@ unsigned PluginPackage::hash() const
         m_lastModified
     };
 
-    return WTF::StringHasher::createBlobHash<sizeof(hashCodes)>(hashCodes);
+    return StringHasher::hashMemory<sizeof(hashCodes)>(hashCodes);
 }
 
 bool PluginPackage::equal(const PluginPackage& a, const PluginPackage& b)
diff --git a/Source/WebCore/plugins/PluginStream.cpp b/Source/WebCore/plugins/PluginStream.cpp
index f9021a8..48379f0 100644
--- a/Source/WebCore/plugins/PluginStream.cpp
+++ b/Source/WebCore/plugins/PluginStream.cpp
@@ -34,7 +34,7 @@
 #include "ResourceLoadScheduler.h"
 #include "SharedBuffer.h"
 #include "SubresourceLoader.h"
-#include <StringExtras.h>
+#include <wtf/StringExtras.h>
 #include <wtf/text/CString.h>
 #include <wtf/text/StringConcatenate.h>
 
@@ -257,7 +257,7 @@ void PluginStream::destroyStream()
 
             if (m_loader)
                 m_loader->setDefersLoading(true);
-            m_pluginFuncs->asfile(m_instance, &m_stream, m_path.data());
+            m_pluginFuncs->asfile(m_instance, &m_stream, m_path.utf8().data());
             if (m_loader)
                 m_loader->setDefersLoading(false);
         }
@@ -306,10 +306,8 @@ void PluginStream::destroyStream()
     if (!m_loadManually && m_client)
         m_client->streamDidFinishLoading(this);
 
-    if (!m_path.isNull()) {
-        String tempFilePath = String::fromUTF8(m_path.data());
-        deleteFile(tempFilePath);
-    }
+    if (!m_path.isNull())
+        deleteFile(m_path);
 }
 
 void PluginStream::delayDeliveryTimerFired(Timer<PluginStream>* timer)
diff --git a/Source/WebCore/plugins/PluginStream.h b/Source/WebCore/plugins/PluginStream.h
index ae69539..fe4d038 100644
--- a/Source/WebCore/plugins/PluginStream.h
+++ b/Source/WebCore/plugins/PluginStream.h
@@ -113,8 +113,8 @@ namespace WebCore {
         NPP m_instance;
         uint16_t m_transferMode;
         int32_t m_offset;
-        WTF::CString m_headers;
-        WTF::CString m_path;
+        CString m_headers;
+        String m_path;
         NPReason m_reason;
         NPStream m_stream;
         PluginQuirkSet m_quirks;
diff --git a/Source/WebCore/plugins/PluginViewNone.cpp b/Source/WebCore/plugins/PluginViewNone.cpp
index 383ac49..3bdec6f 100644
--- a/Source/WebCore/plugins/PluginViewNone.cpp
+++ b/Source/WebCore/plugins/PluginViewNone.cpp
@@ -28,6 +28,7 @@
 
 #if USE(JSC)
 #include "BridgeJSC.h"
+#include <runtime/JSObject.h>
 #include <runtime/ScopeChain.h>
 #endif
 
diff --git a/Source/WebCore/plugins/gtk/PluginViewGtk.cpp b/Source/WebCore/plugins/gtk/PluginViewGtk.cpp
index 75a51c5..58a4f2c 100644
--- a/Source/WebCore/plugins/gtk/PluginViewGtk.cpp
+++ b/Source/WebCore/plugins/gtk/PluginViewGtk.cpp
@@ -48,6 +48,7 @@
 #include "KeyboardEvent.h"
 #include "MouseEvent.h"
 #include "Page.h"
+#include "PlatformContextCairo.h"
 #include "PlatformKeyboardEvent.h"
 #include "PlatformMouseEvent.h"
 #include "PluginDebug.h"
@@ -217,7 +218,7 @@ void PluginView::paint(GraphicsContext* context, const IntRect& rect)
             // avoid drawing artifacts.
 
             // This Would not work without double buffering, but we always use it.
-            cairo_set_source_surface(cr.get(), cairo_get_group_target(context->platformContext()),
+            cairo_set_source_surface(cr.get(), cairo_get_group_target(context->platformContext()->cr()),
                                      -m_windowRect.x(), -m_windowRect.y());
             cairo_set_operator(cr.get(), CAIRO_OPERATOR_SOURCE);
         } else
@@ -244,7 +245,7 @@ void PluginView::paint(GraphicsContext* context, const IntRect& rect)
     if (syncX)
         XSync(m_pluginDisplay, false); // sync changes by plugin
 
-    cairo_t* cr = context->platformContext();
+    cairo_t* cr = context->platformContext()->cr();
     cairo_save(cr);
 
     cairo_set_source_surface(cr, drawableSurface.get(), frameRect().x(), frameRect().y());
diff --git a/Source/WebCore/plugins/qt/PluginPackageQt.cpp b/Source/WebCore/plugins/qt/PluginPackageQt.cpp
index ce07faf..19941d6 100644
--- a/Source/WebCore/plugins/qt/PluginPackageQt.cpp
+++ b/Source/WebCore/plugins/qt/PluginPackageQt.cpp
@@ -121,7 +121,7 @@ static void initializeGtk(QLibrary* module = 0)
         }
     }
 
-    QLibrary library("libgtk-x11-2.0.so.0");
+    QLibrary library(QLatin1String("libgtk-x11-2.0.so.0"));
     if (library.load()) {
         typedef void *(*gtk_init_check_ptr)(int*, char***);
         gtk_init_check_ptr gtkInitCheck = (gtk_init_check_ptr)library.resolve("gtk_init_check");
diff --git a/Source/WebCore/plugins/qt/PluginViewQt.cpp b/Source/WebCore/plugins/qt/PluginViewQt.cpp
index 611abb9..dcb805a 100644
--- a/Source/WebCore/plugins/qt/PluginViewQt.cpp
+++ b/Source/WebCore/plugins/qt/PluginViewQt.cpp
@@ -847,7 +847,7 @@ static Display *getPluginDisplay()
     // support gdk based plugins (like flash) that use a different X connection.
     // The code below has the same effect as this one:
     // Display *gdkDisplay = gdk_x11_display_get_xdisplay(gdk_display_get_default());
-    QLibrary library("libgdk-x11-2.0", 0);
+    QLibrary library(QLatin1String("libgdk-x11-2.0"), 0);
     if (!library.load())
         return 0;
 
diff --git a/Source/WebCore/plugins/win/PluginPackageWin.cpp b/Source/WebCore/plugins/win/PluginPackageWin.cpp
index e06d1f4..e835e3c 100644
--- a/Source/WebCore/plugins/win/PluginPackageWin.cpp
+++ b/Source/WebCore/plugins/win/PluginPackageWin.cpp
@@ -74,6 +74,9 @@ bool PluginPackage::isPluginBlacklisted()
     } else if (fileName() == "npmozax.dll") {
         // Bug 15217: Mozilla ActiveX control complains about missing xpcom_core.dll
         return true;
+    } else if (fileName() == "npwpf.dll") {
+        // Bug 57119: Microsoft Windows Presentation Foundation (WPF) plug-in complains about missing xpcom.dll
+        return true;
     } else if (name() == "Yahoo Application State Plugin") {
         // https://bugs.webkit.org/show_bug.cgi?id=26860
         // Bug in Yahoo Application State plug-in earlier than 1.0.0.6 leads to heap corruption. 
@@ -312,7 +315,7 @@ unsigned PluginPackage::hash() const
         m_mimeToExtensions.size()
     };
 
-    return WTF::StringHasher::createBlobHash<sizeof(hashCodes)>(hashCodes);
+    return StringHasher::hashMemory<sizeof(hashCodes)>(hashCodes);
 }
 
 bool PluginPackage::equal(const PluginPackage& a, const PluginPackage& b)
diff --git a/Source/WebCore/plugins/win/PluginViewWin.cpp b/Source/WebCore/plugins/win/PluginViewWin.cpp
index 208121e..f575709 100644
--- a/Source/WebCore/plugins/win/PluginViewWin.cpp
+++ b/Source/WebCore/plugins/win/PluginViewWin.cpp
@@ -83,6 +83,7 @@
 #endif
 
 #if PLATFORM(CAIRO)
+#include "PlatformContextCairo.h"
 #include <cairo-win32.h>
 #endif
 
@@ -572,8 +573,7 @@ void PluginView::paintWindowedPluginIntoContext(GraphicsContext* context, const
     // Must flush drawings up to this point to the backing metafile, otherwise the
     // plugin region will be overwritten with any clear regions specified in the
     // cairo-controlled portions of the rendering.
-    PlatformGraphicsContext* ctx = context->platformContext();
-    cairo_show_page(ctx);
+    cairo_show_page(context->platformContext()->cr());
 #endif
 
     HDC hdc = windowsContext.hdc();
diff --git a/Source/WebCore/rendering/AutoTableLayout.cpp b/Source/WebCore/rendering/AutoTableLayout.cpp
index 9775ec5..4eef95f 100644
--- a/Source/WebCore/rendering/AutoTableLayout.cpp
+++ b/Source/WebCore/rendering/AutoTableLayout.cpp
@@ -81,8 +81,8 @@ void AutoTableLayout::recalcColumn(int effCol)
 
                     Length cellLogicalWidth = cell->styleOrColLogicalWidth();
                     // FIXME: What is this arbitrary value?
-                    if (cellLogicalWidth.rawValue() > 32760)
-                        cellLogicalWidth.setRawValue(32760);
+                    if (cellLogicalWidth.value() > 32760)
+                        cellLogicalWidth.setValue(32760);
                     if (cellLogicalWidth.isNegative())
                         cellLogicalWidth.setValue(0);
                     switch (cellLogicalWidth.type()) {
@@ -105,13 +105,13 @@ void AutoTableLayout::recalcColumn(int effCol)
                         break;
                     case Percent:
                         m_hasPercent = true;
-                        if (cellLogicalWidth.isPositive() && (!columnLayout.logicalWidth.isPercent() || cellLogicalWidth.rawValue() > columnLayout.logicalWidth.rawValue()))
+                        if (cellLogicalWidth.isPositive() && (!columnLayout.logicalWidth.isPercent() || cellLogicalWidth.value() > columnLayout.logicalWidth.value()))
                             columnLayout.logicalWidth = cellLogicalWidth;
                         break;
                     case Relative:
                         // FIXME: Need to understand this case and whether it makes sense to compare values
                         // which are not necessarily of the same type.
-                        if (cellLogicalWidth.isAuto() || (cellLogicalWidth.isRelative() && cellLogicalWidth.value() > columnLayout.logicalWidth.rawValue()))
+                        if (cellLogicalWidth.isAuto() || (cellLogicalWidth.isRelative() && cellLogicalWidth.value() > columnLayout.logicalWidth.value()))
                             columnLayout.logicalWidth = cellLogicalWidth;
                     default:
                         break;
@@ -232,16 +232,16 @@ void AutoTableLayout::computePreferredLogicalWidths(int& minWidth, int& maxWidth
 
     // We substitute 0 percent by (epsilon / percentScaleFactor) percent in two places below to avoid division by zero.
     // FIXME: Handle the 0% cases properly.
-    const int epsilon = 1;
+    const float epsilon = 1 / 128.0f;
 
-    int remainingPercent = 100 * percentScaleFactor;
+    float remainingPercent = 100;
     for (size_t i = 0; i < m_layoutStruct.size(); ++i) {
         minWidth += m_layoutStruct[i].effectiveMinLogicalWidth;
         maxWidth += m_layoutStruct[i].effectiveMaxLogicalWidth;
         if (scaleColumns) {
             if (m_layoutStruct[i].effectiveLogicalWidth.isPercent()) {
-                int percent = min(m_layoutStruct[i].effectiveLogicalWidth.rawValue(), remainingPercent);
-                float logicalWidth = static_cast<float>(m_layoutStruct[i].effectiveMaxLogicalWidth) * 100 * percentScaleFactor / max(percent, epsilon);
+                float percent = min(static_cast<float>(m_layoutStruct[i].effectiveLogicalWidth.percent()), remainingPercent);
+                float logicalWidth = static_cast<float>(m_layoutStruct[i].effectiveMaxLogicalWidth) * 100 / max(percent, epsilon);
                 maxPercent = max(logicalWidth,  maxPercent);
                 remainingPercent -= percent;
             } else
@@ -250,7 +250,7 @@ void AutoTableLayout::computePreferredLogicalWidths(int& minWidth, int& maxWidth
     }
 
     if (scaleColumns) {
-        maxNonPercent = maxNonPercent * 100 * percentScaleFactor / max(remainingPercent, epsilon);
+        maxNonPercent = maxNonPercent * 100 / max(remainingPercent, epsilon);
         maxWidth = max(maxWidth, static_cast<int>(min(maxNonPercent, INT_MAX / 2.0f)));
         maxWidth = max(maxWidth, static_cast<int>(min(maxPercent, INT_MAX / 2.0f)));
     }
@@ -266,6 +266,10 @@ void AutoTableLayout::computePreferredLogicalWidths(int& minWidth, int& maxWidth
         minWidth = max(minWidth, tableLogicalWidth.value());
         maxWidth = minWidth;
     }
+    
+    // if there was no remaining percent, maxWidth is invalid.
+    if (!remainingPercent && maxNonPercent)
+        maxWidth = intMaxForLength;        
 }
 
 /*
@@ -300,7 +304,7 @@ int AutoTableLayout::calcEffectiveLogicalWidth()
         size_t lastCol = effCol;
         int cellMinLogicalWidth = cell->minPreferredLogicalWidth() + spacingInRowDirection;
         float cellMaxLogicalWidth = cell->maxPreferredLogicalWidth() + spacingInRowDirection;
-        int totalPercent = 0;
+        float totalPercent = 0;
         int spanMinLogicalWidth = 0;
         float spanMaxLogicalWidth = 0;
         bool allColsArePercent = true;
@@ -312,7 +316,7 @@ int AutoTableLayout::calcEffectiveLogicalWidth()
             Layout& columnLayout = m_layoutStruct[lastCol];
             switch (columnLayout.logicalWidth.type()) {
             case Percent:
-                totalPercent += columnLayout.logicalWidth.rawValue();
+                totalPercent += columnLayout.logicalWidth.percent();
                 allColsAreFixed = false;
                 break;
             case Fixed:
@@ -339,7 +343,7 @@ int AutoTableLayout::calcEffectiveLogicalWidth()
                     columnLayout.effectiveLogicalWidth = Length();
                     allColsArePercent = false;
                 } else
-                    totalPercent += columnLayout.effectiveLogicalWidth.rawValue();
+                    totalPercent += columnLayout.effectiveLogicalWidth.percent();
                 allColsAreFixed = false;
             }
             if (!columnLayout.emptyCellsOnly)
@@ -354,14 +358,14 @@ int AutoTableLayout::calcEffectiveLogicalWidth()
 
         // adjust table max width if needed
         if (cellLogicalWidth.isPercent()) {
-            if (totalPercent > cellLogicalWidth.rawValue() || allColsArePercent) {
+            if (totalPercent > cellLogicalWidth.percent() || allColsArePercent) {
                 // can't satify this condition, treat as variable
                 cellLogicalWidth = Length();
             } else {
-                maxLogicalWidth = max(maxLogicalWidth, max(spanMaxLogicalWidth, cellMaxLogicalWidth) * 100 * percentScaleFactor / cellLogicalWidth.rawValue());
+                maxLogicalWidth = max(maxLogicalWidth, static_cast<float>(max(spanMaxLogicalWidth, cellMaxLogicalWidth) * 100  / cellLogicalWidth.percent()));
 
                 // all non percent columns in the span get percent values to sum up correctly.
-                int percentMissing = cellLogicalWidth.rawValue() - totalPercent;
+                float percentMissing = cellLogicalWidth.percent() - totalPercent;
                 float totalWidth = 0;
                 for (unsigned pos = effCol; pos < lastCol; ++pos) {
                     if (!m_layoutStruct[pos].effectiveLogicalWidth.isPercent())
@@ -370,11 +374,11 @@ int AutoTableLayout::calcEffectiveLogicalWidth()
 
                 for (unsigned pos = effCol; pos < lastCol && totalWidth > 0; ++pos) {
                     if (!m_layoutStruct[pos].effectiveLogicalWidth.isPercent()) {
-                        int percent = static_cast<int>(percentMissing * static_cast<float>(m_layoutStruct[pos].effectiveMaxLogicalWidth) / totalWidth);
+                        float percent = percentMissing * static_cast<float>(m_layoutStruct[pos].effectiveMaxLogicalWidth) / totalWidth;
                         totalWidth -= m_layoutStruct[pos].effectiveMaxLogicalWidth;
                         percentMissing -= percent;
                         if (percent > 0)
-                            m_layoutStruct[pos].effectiveLogicalWidth.setRawValue(Percent, percent);
+                            m_layoutStruct[pos].effectiveLogicalWidth.setValue(Percent, percent);
                         else
                             m_layoutStruct[pos].effectiveLogicalWidth = Length();
                     }
@@ -495,7 +499,7 @@ void AutoTableLayout::layout()
     int numFixed = 0;
     float totalAuto = 0;
     float totalFixed = 0;
-    int totalPercent = 0;
+    float totalPercent = 0;
     int allocAuto = 0;
     unsigned numAutoEmptyCellsOnly = 0;
 
@@ -508,7 +512,7 @@ void AutoTableLayout::layout()
         switch (logicalWidth.type()) {
         case Percent:
             havePercent = true;
-            totalPercent += logicalWidth.rawValue();
+            totalPercent += logicalWidth.percent();
             break;
         case Relative:
             totalRelative += logicalWidth.value();
@@ -542,9 +546,9 @@ void AutoTableLayout::layout()
                 m_layoutStruct[i].computedLogicalWidth = cellLogicalWidth;
             }
         }
-        if (totalPercent > 100 * percentScaleFactor) {
+        if (totalPercent > 100) {
             // remove overallocated space from the last columns
-            int excess = tableLogicalWidth * (totalPercent - 100 * percentScaleFactor) / (100 * percentScaleFactor);
+            int excess = tableLogicalWidth * (totalPercent - 100) / 100;
             for (int i = nEffCols - 1; i >= 0; --i) {
                 if (m_layoutStruct[i].effectiveLogicalWidth.isPercent()) {
                     int cellLogicalWidth = m_layoutStruct[i].computedLogicalWidth;
@@ -611,13 +615,13 @@ void AutoTableLayout::layout()
     }
 
     // spread over percent colums
-    if (available > 0 && m_hasPercent && totalPercent < 100 * percentScaleFactor) {
+    if (available > 0 && m_hasPercent && totalPercent < 100) {
         for (size_t i = 0; i < nEffCols; ++i) {
             Length& logicalWidth = m_layoutStruct[i].effectiveLogicalWidth;
             if (logicalWidth.isPercent()) {
-                int cellLogicalWidth = available * logicalWidth.rawValue() / totalPercent;
+                int cellLogicalWidth = available * logicalWidth.percent() / totalPercent;
                 available -= cellLogicalWidth;
-                totalPercent -= logicalWidth.rawValue();
+                totalPercent -= logicalWidth.percent();
                 m_layoutStruct[i].computedLogicalWidth += cellLogicalWidth;
                 if (!available || !totalPercent)
                     break;
diff --git a/Source/WebCore/rendering/CounterNode.cpp b/Source/WebCore/rendering/CounterNode.cpp
index eadd386..323f5db 100644
--- a/Source/WebCore/rendering/CounterNode.cpp
+++ b/Source/WebCore/rendering/CounterNode.cpp
@@ -32,7 +32,8 @@ CounterNode::CounterNode(RenderObject* o, bool hasResetType, int value)
     : m_hasResetType(hasResetType)
     , m_value(value)
     , m_countInParent(0)
-    , m_renderer(o)
+    , m_owner(o)
+    , m_rootRenderer(0)
     , m_parent(0)
     , m_previousSibling(0)
     , m_nextSibling(0)
@@ -41,9 +42,14 @@ CounterNode::CounterNode(RenderObject* o, bool hasResetType, int value)
 {
 }
 
-PassRefPtr<CounterNode> CounterNode::create(RenderObject* renderer, bool hasResetType, int value)
+CounterNode::~CounterNode()
 {
-    return adoptRef(new CounterNode(renderer, hasResetType, value));
+    resetRenderers();
+}
+
+PassRefPtr<CounterNode> CounterNode::create(RenderObject* owner, bool hasResetType, int value)
+{
+    return adoptRef(new CounterNode(owner, hasResetType, value));
 }
 
 CounterNode* CounterNode::nextInPreOrderAfterChildren(const CounterNode* stayWithin) const
@@ -102,24 +108,76 @@ int CounterNode::computeCountInParent() const
     return m_parent->m_value + increment;
 }
 
-void CounterNode::resetRenderer(const AtomicString& identifier) const
+void CounterNode::addRenderer(RenderCounter* value)
+{
+    if (!value) {
+        ASSERT_NOT_REACHED();
+        return;
+    }
+    if (value->m_counterNode) {
+        ASSERT_NOT_REACHED();
+        value->m_counterNode->removeRenderer(value);
+    }
+    ASSERT(!value->m_nextForSameCounter);
+    for (RenderCounter* iterator = m_rootRenderer;iterator; iterator = iterator->m_nextForSameCounter) {
+        if (iterator == value) {
+            ASSERT_NOT_REACHED();
+            return;
+        }
+    }
+    value->m_nextForSameCounter = m_rootRenderer;
+    m_rootRenderer = value;
+    if (value->m_counterNode != this) {
+        if (value->m_counterNode) {
+            ASSERT_NOT_REACHED();
+            value->m_counterNode->removeRenderer(value);
+        }
+        value->m_counterNode = this;
+    }
+}
+
+void CounterNode::removeRenderer(RenderCounter* value)
 {
-    if (!m_renderer || m_renderer->documentBeingDestroyed())
+    if (!value) {
+        ASSERT_NOT_REACHED();
         return;
-    if (RenderObjectChildList* children = m_renderer->virtualChildren())
-        children->invalidateCounters(m_renderer, identifier);
+    }
+    if (value->m_counterNode && value->m_counterNode != this) {
+        ASSERT_NOT_REACHED();
+        value->m_counterNode->removeRenderer(value);
+    }
+    RenderCounter* previous = 0;
+    for (RenderCounter* iterator = m_rootRenderer;iterator; iterator = iterator->m_nextForSameCounter) {
+        if (iterator == value) {
+            if (previous)
+                previous->m_nextForSameCounter = value->m_nextForSameCounter;
+            else
+                m_rootRenderer = value->m_nextForSameCounter;
+            value->m_nextForSameCounter = 0;
+            value->m_counterNode = 0;
+            return;
+        }
+        previous = iterator;
+    }
+    ASSERT_NOT_REACHED();
+}
+
+void CounterNode::resetRenderers()
+{
+    while (m_rootRenderer)
+        m_rootRenderer->invalidate(); // This makes m_rootRenderer point to the next renderer if any since it disconnects the m_rootRenderer from this.
 }
 
-void CounterNode::resetRenderers(const AtomicString& identifier) const
+void CounterNode::resetThisAndDescendantsRenderers()
 {
-    const CounterNode* node = this;
+    CounterNode* node = this;
     do {
-        node->resetRenderer(identifier);
+        node->resetRenderers();
         node = node->nextInPreOrder(this);
     } while (node);
 }
 
-void CounterNode::recount(const AtomicString& identifier)
+void CounterNode::recount()
 {
     for (CounterNode* node = this; node; node = node->m_nextSibling) {
         int oldCount = node->m_countInParent;
@@ -127,7 +185,7 @@ void CounterNode::recount(const AtomicString& identifier)
         if (oldCount == newCount)
             break;
         node->m_countInParent = newCount;
-        node->resetRenderers(identifier);
+        node->resetThisAndDescendantsRenderers();
     }
 }
 
@@ -141,7 +199,7 @@ void CounterNode::insertAfter(CounterNode* newChild, CounterNode* refChild, cons
 
     if (newChild->m_hasResetType) {
         while (m_lastChild != refChild)
-            RenderCounter::destroyCounterNode(m_lastChild->renderer(), identifier);
+            RenderCounter::destroyCounterNode(m_lastChild->owner(), identifier);
     }
 
     CounterNode* next;
@@ -168,9 +226,9 @@ void CounterNode::insertAfter(CounterNode* newChild, CounterNode* refChild, cons
         }
 
         newChild->m_countInParent = newChild->computeCountInParent();
-        newChild->resetRenderers(identifier);
+        newChild->resetThisAndDescendantsRenderers();
         if (next)
-            next->recount(identifier);
+            next->recount();
         return;
     }
 
@@ -203,11 +261,11 @@ void CounterNode::insertAfter(CounterNode* newChild, CounterNode* refChild, cons
     newChild->m_firstChild = 0;
     newChild->m_lastChild = 0;
     newChild->m_countInParent = newChild->computeCountInParent();
-    newChild->resetRenderer(identifier);
-    first->recount(identifier);
+    newChild->resetRenderers();
+    first->recount();
 }
 
-void CounterNode::removeChild(CounterNode* oldChild, const AtomicString& identifier)
+void CounterNode::removeChild(CounterNode* oldChild)
 {
     ASSERT(oldChild);
     ASSERT(!oldChild->m_firstChild);
@@ -235,7 +293,7 @@ void CounterNode::removeChild(CounterNode* oldChild, const AtomicString& identif
     }
 
     if (next)
-        next->recount(identifier);
+        next->recount();
 }
 
 #ifndef NDEBUG
@@ -253,8 +311,9 @@ static void showTreeAndMark(const CounterNode* node)
         fprintf(stderr, "%p %s: %d %d P:%p PS:%p NS:%p R:%p\n",
             current, current->actsAsReset() ? "reset____" : "increment", current->value(),
             current->countInParent(), current->parent(), current->previousSibling(),
-            current->nextSibling(), current->renderer());
+            current->nextSibling(), current->owner());
     }
+    fflush(stderr);
 }
 
 #endif
diff --git a/Source/WebCore/rendering/CounterNode.h b/Source/WebCore/rendering/CounterNode.h
index 639946c..7d6def8 100644
--- a/Source/WebCore/rendering/CounterNode.h
+++ b/Source/WebCore/rendering/CounterNode.h
@@ -38,16 +38,22 @@
 namespace WebCore {
 
 class RenderObject;
+class RenderCounter;
 
 class CounterNode : public RefCounted<CounterNode> {
 public:
     static PassRefPtr<CounterNode> create(RenderObject*, bool isReset, int value);
-
+    ~CounterNode();
     bool actsAsReset() const { return m_hasResetType || !m_parent; }
     bool hasResetType() const { return m_hasResetType; }
     int value() const { return m_value; }
     int countInParent() const { return m_countInParent; }
-    RenderObject* renderer() const { return m_renderer; }
+    RenderObject* owner() const { return m_owner; }
+    void addRenderer(RenderCounter*);
+    void removeRenderer(RenderCounter*);
+
+    // Invalidates the text in the renderers of this counter, if any.
+    void resetRenderers();
 
     CounterNode* parent() const { return m_parent; }
     CounterNode* previousSibling() const { return m_previousSibling; }
@@ -62,26 +68,21 @@ public:
     void insertAfter(CounterNode* newChild, CounterNode* beforeChild, const AtomicString& identifier);
 
     // identifier must match the identifier of this counter.
-    void removeChild(CounterNode*, const AtomicString& identifier);
+    void removeChild(CounterNode*);
 
 private:
     CounterNode(RenderObject*, bool isReset, int value);
     int computeCountInParent() const;
-    void recount(const AtomicString& identifier);
-
-    // Invalidates the text in the renderer of this counter, if any.
-    // identifier must match the identifier of this counter.
-    void resetRenderer(const AtomicString& identifier) const;
-
     // Invalidates the text in the renderer of this counter, if any,
     // and in the renderers of all descendants of this counter, if any.
-    // identifier must match the identifier of this counter.
-    void resetRenderers(const AtomicString& identifier) const;
+    void resetThisAndDescendantsRenderers();
+    void recount();
 
     bool m_hasResetType;
     int m_value;
     int m_countInParent;
-    RenderObject* m_renderer;
+    RenderObject* m_owner;
+    RenderCounter* m_rootRenderer;
 
     CounterNode* m_parent;
     CounterNode* m_previousSibling;
diff --git a/Source/WebCore/rendering/FixedTableLayout.cpp b/Source/WebCore/rendering/FixedTableLayout.cpp
index 3285d15..b1a61b5 100644
--- a/Source/WebCore/rendering/FixedTableLayout.cpp
+++ b/Source/WebCore/rendering/FixedTableLayout.cpp
@@ -118,7 +118,8 @@ int FixedTableLayout::calcWidthArray(int)
                     spanInCurrentEffectiveColumn = m_table->spanOfEffCol(currentEffectiveColumn);
                 }
                 if ((w.isFixed() || w.isPercent()) && w.isPositive()) {
-                    m_width[currentEffectiveColumn].setRawValue(w.type(), w.rawValue() * spanInCurrentEffectiveColumn);
+                    m_width[currentEffectiveColumn] = w;
+                    m_width[currentEffectiveColumn] *= spanInCurrentEffectiveColumn;
                     usedWidth += effWidth * spanInCurrentEffectiveColumn;
                 }
                 span -= spanInCurrentEffectiveColumn;
@@ -164,10 +165,11 @@ int FixedTableLayout::calcWidthArray(int)
                 int usedSpan = 0;
                 int i = 0;
                 while (usedSpan < span && cCol + i < nEffCols) {
-                    int eSpan = m_table->spanOfEffCol(cCol + i);
+                    float eSpan = m_table->spanOfEffCol(cCol + i);
                     // Only set if no col element has already set it.
                     if (m_width[cCol + i].isAuto() && w.type() != Auto) {
-                        m_width[cCol + i].setRawValue(w.type(), w.rawValue() * eSpan / span);
+                        m_width[cCol + i] = w;
+                        m_width[cCol + i] *= eSpan / span;
                         usedWidth += effWidth * eSpan / span;
                     }
                     usedSpan += eSpan;
@@ -234,7 +236,7 @@ void FixedTableLayout::layout()
     int autoSpan = 0;
     int totalFixedWidth = 0;
     int totalPercentWidth = 0;
-    int totalRawPercent = 0;
+    float totalPercent = 0;
 
     // Compute requirements and try to satisfy fixed and percent widths.
     // Percentages are of the table's width, so for example
@@ -247,7 +249,7 @@ void FixedTableLayout::layout()
         } else if (m_width[i].isPercent()) {
             calcWidth[i] = m_width[i].calcValue(tableLogicalWidth);
             totalPercentWidth += calcWidth[i];
-            totalRawPercent += m_width[i].rawValue();
+            totalPercent += m_width[i].percent();
         } else if (m_width[i].isAuto()) {
             numAuto++;
             autoSpan += m_table->spanOfEffCol(i);
@@ -270,11 +272,11 @@ void FixedTableLayout::layout()
                     }
                 }
             }
-            if (totalRawPercent) {
+            if (totalPercent) {
                 totalPercentWidth = 0;
                 for (int i = 0; i < nEffCols; i++) {
                     if (m_width[i].isPercent()) {
-                        calcWidth[i] = m_width[i].rawValue() * (tableLogicalWidth - totalFixedWidth) / totalRawPercent;
+                        calcWidth[i] = m_width[i].percent() * (tableLogicalWidth - totalFixedWidth) / totalPercent;
                         totalPercentWidth += calcWidth[i];
                     }
                 }
diff --git a/Source/WebCore/rendering/HitTestResult.cpp b/Source/WebCore/rendering/HitTestResult.cpp
index ba98eff..e5638c9 100644
--- a/Source/WebCore/rendering/HitTestResult.cpp
+++ b/Source/WebCore/rendering/HitTestResult.cpp
@@ -95,16 +95,17 @@ HitTestResult::HitTestResult(const HitTestResult& other)
     , m_scrollbar(other.scrollbar())
     , m_isOverWidget(other.isOverWidget())
 {
-    // Only copy the padding and ListHashSet in case of rect hit test.
+    // Only copy the padding and NodeSet in case of rect hit test.
     // Copying the later is rather expensive.
     if ((m_isRectBased = other.isRectBasedTest())) {
         m_topPadding = other.m_topPadding;
         m_rightPadding = other.m_rightPadding;
         m_bottomPadding = other.m_bottomPadding;
         m_leftPadding = other.m_leftPadding;
-        m_rectBasedTestResult = other.rectBasedTestResult();
     } else
         m_topPadding = m_rightPadding = m_bottomPadding = m_leftPadding = 0;
+
+    m_rectBasedTestResult = adoptPtr(other.m_rectBasedTestResult ? new NodeSet(*other.m_rectBasedTestResult) : 0);
 }
 
 HitTestResult::~HitTestResult()
@@ -120,16 +121,17 @@ HitTestResult& HitTestResult::operator=(const HitTestResult& other)
     m_innerURLElement = other.URLElement();
     m_scrollbar = other.scrollbar();
     m_isOverWidget = other.isOverWidget();
-    // Only copy the padding and ListHashSet in case of rect hit test.
+    // Only copy the padding and NodeSet in case of rect hit test.
     // Copying the later is rather expensive.
     if ((m_isRectBased = other.isRectBasedTest())) {
         m_topPadding = other.m_topPadding;
         m_rightPadding = other.m_rightPadding;
         m_bottomPadding = other.m_bottomPadding;
         m_leftPadding = other.m_leftPadding;
-        m_rectBasedTestResult = other.rectBasedTestResult();
     } else
         m_topPadding = m_rightPadding = m_bottomPadding = m_leftPadding = 0;
+
+    m_rectBasedTestResult = adoptPtr(other.m_rectBasedTestResult ? new NodeSet(*other.m_rectBasedTestResult) : 0);
     return *this;
 }
 
@@ -525,7 +527,7 @@ bool HitTestResult::isContentEditable() const
     if (m_innerNonSharedNode->hasTagName(inputTag))
         return static_cast<HTMLInputElement*>(m_innerNonSharedNode.get())->isTextField();
 
-    return m_innerNonSharedNode->isContentEditable();
+    return m_innerNonSharedNode->rendererIsEditable();
 }
 
 bool HitTestResult::addNodeToRectBasedTestResult(Node* node, int x, int y, const IntRect& rect)
@@ -540,7 +542,7 @@ bool HitTestResult::addNodeToRectBasedTestResult(Node* node, int x, int y, const
         return true;
 
     node = node->shadowAncestorNode();
-    m_rectBasedTestResult.add(node);
+    mutableRectBasedTestResult().add(node);
 
     return !rect.contains(rectForPoint(x, y));
 }
@@ -557,7 +559,7 @@ bool HitTestResult::addNodeToRectBasedTestResult(Node* node, int x, int y, const
         return true;
 
     node = node->shadowAncestorNode();
-    m_rectBasedTestResult.add(node);
+    mutableRectBasedTestResult().add(node);
 
     return !rect.contains(rectForPoint(x, y));
 }
@@ -575,10 +577,11 @@ void HitTestResult::append(const HitTestResult& other)
         m_isOverWidget = other.isOverWidget();
     }
 
-    const ListHashSet<RefPtr<Node> >& list = other.rectBasedTestResult();
-    ListHashSet<RefPtr<Node> >::const_iterator last = list.end();
-    for (ListHashSet<RefPtr<Node> >::const_iterator it = list.begin(); it != last; ++it)
-        m_rectBasedTestResult.add(it->get());
+    if (other.m_rectBasedTestResult) {
+        NodeSet& set = mutableRectBasedTestResult();
+        for (NodeSet::const_iterator it = other.m_rectBasedTestResult->begin(), last = other.m_rectBasedTestResult->end(); it != last; ++it)
+            set.add(it->get());
+    }
 }
 
 IntRect HitTestResult::rectForPoint(const IntPoint& point, unsigned topPadding, unsigned rightPadding, unsigned bottomPadding, unsigned leftPadding)
@@ -593,4 +596,18 @@ IntRect HitTestResult::rectForPoint(const IntPoint& point, unsigned topPadding,
     return IntRect(actualPoint, actualPadding);
 }
 
+const HitTestResult::NodeSet& HitTestResult::rectBasedTestResult() const
+{
+    if (!m_rectBasedTestResult)
+        m_rectBasedTestResult = adoptPtr(new NodeSet);
+    return *m_rectBasedTestResult;
+}
+
+HitTestResult::NodeSet& HitTestResult::mutableRectBasedTestResult()
+{
+    if (!m_rectBasedTestResult)
+        m_rectBasedTestResult = adoptPtr(new NodeSet);
+    return *m_rectBasedTestResult;
+}
+
 } // namespace WebCore
diff --git a/Source/WebCore/rendering/HitTestResult.h b/Source/WebCore/rendering/HitTestResult.h
index 3aa17e3..89b5ea1 100644
--- a/Source/WebCore/rendering/HitTestResult.h
+++ b/Source/WebCore/rendering/HitTestResult.h
@@ -27,6 +27,7 @@
 #include "TextDirection.h"
 #include <wtf/Forward.h>
 #include <wtf/ListHashSet.h>
+#include <wtf/OwnPtr.h>
 #include <wtf/RefPtr.h>
 
 namespace WebCore {
@@ -44,6 +45,8 @@ class Scrollbar;
 
 class HitTestResult {
 public:
+    typedef ListHashSet<RefPtr<Node> > NodeSet;
+
     HitTestResult();
     HitTestResult(const IntPoint&);
     // Pass non-negative padding values to perform a rect-based hit test.
@@ -112,10 +115,15 @@ public:
     // enclosed by the boundaries of a node.
     bool addNodeToRectBasedTestResult(Node*, int x, int y, const IntRect& = IntRect());
     bool addNodeToRectBasedTestResult(Node*, int x, int y, const FloatRect&);
-    const ListHashSet<RefPtr<Node> >& rectBasedTestResult() const { return m_rectBasedTestResult; }
     void append(const HitTestResult&);
 
+    // If m_rectBasedTestResult is 0 then set it to a new NodeSet. Return *m_rectBasedTestResult. Lazy allocation makes
+    // sense because the NodeSet is seldom necessary, and it's somewhat expensive to allocate and initialize. This method does
+    // the same thing as mutableRectBasedTestResult(), but here the return value is const.
+    const NodeSet& rectBasedTestResult() const;
+
 private:
+    NodeSet& mutableRectBasedTestResult(); // See above.
 
 #if ENABLE(VIDEO)
     HTMLMediaElement* mediaElement() const;
@@ -134,7 +142,7 @@ private:
     int m_rightPadding;
     int m_bottomPadding;
     int m_leftPadding;
-    ListHashSet<RefPtr<Node> > m_rectBasedTestResult;
+    mutable OwnPtr<NodeSet> m_rectBasedTestResult;
 };
 
 inline IntRect HitTestResult::rectForPoint(int x, int y) const
diff --git a/Source/WebCore/rendering/InlineBox.cpp b/Source/WebCore/rendering/InlineBox.cpp
index 1f4e244..930071e 100644
--- a/Source/WebCore/rendering/InlineBox.cpp
+++ b/Source/WebCore/rendering/InlineBox.cpp
@@ -154,8 +154,9 @@ void InlineBox::adjustPosition(float dx, float dy)
 {
     m_x += dx;
     m_y += dy;
-    if (m_renderer->isReplaced())
-        toRenderBox(m_renderer)->positionLineBox(this);
+
+    if (m_renderer->isReplaced()) 
+        toRenderBox(m_renderer)->move(dx, dy); 
 }
 
 void InlineBox::paint(PaintInfo& paintInfo, int tx, int ty)
diff --git a/Source/WebCore/rendering/InlineBox.h b/Source/WebCore/rendering/InlineBox.h
index de7b224..9335970 100644
--- a/Source/WebCore/rendering/InlineBox.h
+++ b/Source/WebCore/rendering/InlineBox.h
@@ -53,7 +53,7 @@ public:
 #endif
         , m_isHorizontal(true)
         , m_endsWithBreak(false)
-        , m_hasSelectedChildren(false)
+        , m_hasSelectedChildrenOrCanHaveLeadingExpansion(false)
         , m_hasEllipsisBoxOrHyphen(false)
         , m_dirOverride(false)
         , m_isText(false)
@@ -87,7 +87,7 @@ public:
 #endif
         , m_isHorizontal(isHorizontal)
         , m_endsWithBreak(false)
-        , m_hasSelectedChildren(false)   
+        , m_hasSelectedChildrenOrCanHaveLeadingExpansion(false)   
         , m_hasEllipsisBoxOrHyphen(false)
         , m_dirOverride(false)
         , m_isText(false)
@@ -340,8 +340,9 @@ protected:
 
     // for RootInlineBox
     bool m_endsWithBreak : 1;  // Whether the line ends with a <br>.
-    bool m_hasSelectedChildren : 1; // Whether we have any children selected (this bit will also be set if the <br> that terminates our line is selected).
-    bool m_hasEllipsisBoxOrHyphen : 1; 
+    // shared between RootInlineBox and InlineTextBox
+    bool m_hasSelectedChildrenOrCanHaveLeadingExpansion : 1; // Whether we have any children selected (this bit will also be set if the <br> that terminates our line is selected).
+    bool m_hasEllipsisBoxOrHyphen : 1;
 
     // for InlineTextBox
 public:
diff --git a/Source/WebCore/rendering/InlineFlowBox.cpp b/Source/WebCore/rendering/InlineFlowBox.cpp
index e146dd9..b58a30e 100644
--- a/Source/WebCore/rendering/InlineFlowBox.cpp
+++ b/Source/WebCore/rendering/InlineFlowBox.cpp
@@ -38,7 +38,6 @@
 #include "RenderTableCell.h"
 #include "RootInlineBox.h"
 #include "Text.h"
-#include "VerticalPositionCache.h"
 
 #include <math.h>
 
@@ -97,8 +96,48 @@ void InlineFlowBox::addToLine(InlineBox* child)
     }
     child->setFirstLineStyleBit(m_firstLine);
     child->setIsHorizontal(isHorizontal());
-    if (child->isText())
+    if (child->isText()) {
         m_hasTextChildren = true;
+        m_hasTextDescendants = true;
+    } else if (child->isInlineFlowBox()) {
+        if (static_cast<InlineFlowBox*>(child)->hasTextDescendants())
+            m_hasTextDescendants = true;
+    }
+
+    if (descendantsHaveSameLineHeightAndBaseline() && !child->renderer()->isPositioned()) {
+        RenderStyle* parentStyle = renderer()->style(m_firstLine);
+        RenderStyle* childStyle = child->renderer()->style(m_firstLine);
+        bool shouldClearDescendantsHaveSameLineHeightAndBaseline = false;
+        if (child->renderer()->isReplaced())
+            shouldClearDescendantsHaveSameLineHeightAndBaseline = true;
+        else if (child->isText()) {
+            if (child->renderer()->isBR()) {
+                if (parentStyle->font().fontMetrics().ascent() != childStyle->font().fontMetrics().ascent()
+                    || parentStyle->font().fontMetrics().descent() != childStyle->font().fontMetrics().descent() || parentStyle->lineHeight() != childStyle->lineHeight()
+                    || (parentStyle->verticalAlign() != BASELINE && !isRootInlineBox()) || childStyle->verticalAlign() != BASELINE)
+                    shouldClearDescendantsHaveSameLineHeightAndBaseline = true;
+            } else if (childStyle->hasTextCombine() || childStyle->textEmphasisMark() != TextEmphasisMarkNone)
+                shouldClearDescendantsHaveSameLineHeightAndBaseline = true;
+        } else {
+            if (child->renderer()->isBR()) {
+                // FIXME: This is dumb. We only turn off because current layout test results expect the <br> to be 0-height on the baseline.
+                // Other than making a zillion tests have to regenerate results, there's no reason to ditch the optimization here.
+                shouldClearDescendantsHaveSameLineHeightAndBaseline = true;
+            } else {
+                ASSERT(isInlineFlowBox());
+                InlineFlowBox* childFlowBox = static_cast<InlineFlowBox*>(child);
+                // Check the child's bit, and then also check for differences in font, line-height, vertical-align
+                if (!childFlowBox->descendantsHaveSameLineHeightAndBaseline() || parentStyle->font().fontMetrics().ascent() != childStyle->font().fontMetrics().ascent()
+                    || parentStyle->font().fontMetrics().descent() != childStyle->font().fontMetrics().descent() || parentStyle->lineHeight() != childStyle->lineHeight()
+                    || (parentStyle->verticalAlign() != BASELINE && !isRootInlineBox()) || childStyle->verticalAlign() != BASELINE
+                    || childStyle->hasBorder() || childStyle->hasPadding() || childStyle->hasTextCombine())
+                    shouldClearDescendantsHaveSameLineHeightAndBaseline = true;
+            }
+        }
+
+        if (shouldClearDescendantsHaveSameLineHeightAndBaseline)
+            clearDescendantsHaveSameLineHeightAndBaseline();
+    }
 
     checkConsistency();
 }
@@ -214,7 +253,18 @@ bool InlineFlowBox::onEndChain(RenderObject* endObject)
     return true;
 }
 
-void InlineFlowBox::determineSpacingForFlowBoxes(bool lastLine, RenderObject* endObject)
+static bool isAnsectorAndWithinBlock(RenderObject* ancestor, RenderObject* child)
+{
+    RenderObject* object = child;
+    while (object && !object->isRenderBlock()) {
+        if (object == ancestor)
+            return true;
+        object = object->parent();
+    }
+    return false;
+}
+
+void InlineFlowBox::determineSpacingForFlowBoxes(bool lastLine, RenderObject* endObject, RenderObject* logicallyLastRunRenderer)
 {
     // All boxes start off open.  They will not apply any margins/border/padding on
     // any side.
@@ -234,23 +284,18 @@ void InlineFlowBox::determineSpacingForFlowBoxes(bool lastLine, RenderObject* en
             else if (!ltr && lineBoxList->lastLineBox() == this)
                 includeRightEdge = true;
         }
-    
-        // In order to determine if the inline ends on this line, we check three things:
-        // (1) If we are the last line and we don't have a continuation(), then we can
-        // close up.
-        // (2) If the last line box for the flow has an object following it on the line (ltr,
-        // reverse for rtl), then the inline has closed.
-        // (3) The line may end on the inline.  If we are the last child (climbing up
-        // the end object's chain), then we just closed as well.
+
         if (!lineBoxList->lastLineBox()->isConstructed()) {
             RenderInline* inlineFlow = toRenderInline(renderer());
+            bool isLastObjectOnLine = (endObject && endObject->isText()) ? !isAnsectorAndWithinBlock(renderer(), logicallyLastRunRenderer->parent()) : onEndChain(logicallyLastRunRenderer);
+
             if (ltr) {
-                if (!nextLineBox() &&
-                    ((lastLine && !inlineFlow->continuation()) || nextOnLineExists() || onEndChain(endObject)))
+                if (!nextLineBox()
+                    && ((lastLine || isLastObjectOnLine) && !inlineFlow->continuation()))
                     includeRightEdge = true;
             } else {
-                if ((!prevLineBox() || prevLineBox()->isConstructed()) &&
-                    ((lastLine && !inlineFlow->continuation()) || prevOnLineExists() || onEndChain(endObject)))
+                if ((!prevLineBox() || prevLineBox()->isConstructed())
+                    && ((lastLine || isLastObjectOnLine) && !inlineFlow->continuation()))
                     includeLeftEdge = true;
             }
         }
@@ -262,7 +307,7 @@ void InlineFlowBox::determineSpacingForFlowBoxes(bool lastLine, RenderObject* en
     for (InlineBox* currChild = firstChild(); currChild; currChild = currChild->nextOnLine()) {
         if (currChild->isInlineFlowBox()) {
             InlineFlowBox* currFlow = static_cast<InlineFlowBox*>(currChild);
-            currFlow->determineSpacingForFlowBoxes(lastLine, endObject);
+            currFlow->determineSpacingForFlowBoxes(lastLine, endObject, logicallyLastRunRenderer);
         }
     }
 }
@@ -325,7 +370,8 @@ bool InlineFlowBox::requiresIdeographicBaseline(const GlyphOverflowAndFallbackFo
     if (isHorizontal())
         return false;
     
-    if (renderer()->style(m_firstLine)->font().primaryFont()->orientation() == Vertical)
+    if (renderer()->style(m_firstLine)->fontDescription().textOrientation() == TextOrientationUpright
+        || renderer()->style(m_firstLine)->font().primaryFont()->hasVerticalGlyphs())
         return true;
 
     for (InlineBox* curr = firstChild(); curr; curr = curr->nextOnLine()) {
@@ -336,7 +382,7 @@ bool InlineFlowBox::requiresIdeographicBaseline(const GlyphOverflowAndFallbackFo
             if (static_cast<InlineFlowBox*>(curr)->requiresIdeographicBaseline(textBoxDataMap))
                 return true;
         } else {
-            if (curr->renderer()->style(m_firstLine)->font().primaryFont()->orientation() == Vertical)
+            if (curr->renderer()->style(m_firstLine)->font().primaryFont()->hasVerticalGlyphs())
                 return true;
             
             const Vector<const SimpleFontData*>* usedFonts = 0;
@@ -347,7 +393,7 @@ bool InlineFlowBox::requiresIdeographicBaseline(const GlyphOverflowAndFallbackFo
 
             if (usedFonts) {
                 for (size_t i = 0; i < usedFonts->size(); ++i) {
-                    if (usedFonts->at(i)->orientation() == Vertical)
+                    if (usedFonts->at(i)->hasVerticalGlyphs())
                         return true;
                 }
             }
@@ -384,92 +430,36 @@ void InlineFlowBox::adjustMaxAscentAndDescent(int& maxAscent, int& maxDescent, i
     }
 }
 
-static int verticalPositionForBox(InlineBox* box, FontBaseline baselineType, bool firstLine, VerticalPositionCache& verticalPositionCache)
-{
-    if (box->renderer()->isText())
-        return box->parent()->logicalTop();
-    
-    RenderBoxModelObject* renderer = box->boxModelObject();
-    ASSERT(renderer->isInline());
-    if (!renderer->isInline())
-        return 0;
-
-    // This method determines the vertical position for inline elements.
-    if (firstLine && !renderer->document()->usesFirstLineRules())
-        firstLine = false;
-
-    // Check the cache.
-    bool isRenderInline = renderer->isRenderInline();
-    if (isRenderInline && !firstLine) {
-        int verticalPosition = verticalPositionCache.get(renderer, baselineType);
-        if (verticalPosition != PositionUndefined)
-            return verticalPosition;
-    }
-
-    int verticalPosition = 0;
-    EVerticalAlign verticalAlign = renderer->style()->verticalAlign();
-    if (verticalAlign == TOP || verticalAlign == BOTTOM)
-        return 0;
-   
-    RenderObject* parent = renderer->parent();
-    if (parent->isRenderInline() && parent->style()->verticalAlign() != TOP && parent->style()->verticalAlign() != BOTTOM)
-        verticalPosition = box->parent()->logicalTop();
-    
-    if (verticalAlign != BASELINE) {
-        const Font& font = parent->style(firstLine)->font();
-        const FontMetrics& fontMetrics = font.fontMetrics();
-        int fontSize = font.pixelSize();
-
-        LineDirectionMode lineDirection = parent->style()->isHorizontalWritingMode() ? HorizontalLine : VerticalLine;
-
-        if (verticalAlign == SUB)
-            verticalPosition += fontSize / 5 + 1;
-        else if (verticalAlign == SUPER)
-            verticalPosition -= fontSize / 3 + 1;
-        else if (verticalAlign == TEXT_TOP)
-            verticalPosition += renderer->baselinePosition(baselineType, firstLine, lineDirection) - fontMetrics.ascent(baselineType);
-        else if (verticalAlign == MIDDLE)
-            verticalPosition += -static_cast<int>(fontMetrics.xHeight() / 2) - renderer->lineHeight(firstLine, lineDirection) / 2 + renderer->baselinePosition(baselineType, firstLine, lineDirection);
-        else if (verticalAlign == TEXT_BOTTOM) {
-            verticalPosition += fontMetrics.descent(baselineType);
-            // lineHeight - baselinePosition is always 0 for replaced elements (except inline blocks), so don't bother wasting time in that case.
-            if (!renderer->isReplaced() || renderer->isInlineBlockOrInlineTable())
-                verticalPosition -= (renderer->lineHeight(firstLine, lineDirection) - renderer->baselinePosition(baselineType, firstLine, lineDirection));
-        } else if (verticalAlign == BASELINE_MIDDLE)
-            verticalPosition += -renderer->lineHeight(firstLine, lineDirection) / 2 + renderer->baselinePosition(baselineType, firstLine, lineDirection);
-        else if (verticalAlign == LENGTH)
-            verticalPosition -= renderer->style()->verticalAlignLength().calcValue(renderer->lineHeight(firstLine, lineDirection));
-    }
-
-    // Store the cached value.
-    if (isRenderInline && !firstLine)
-        verticalPositionCache.set(renderer, baselineType, verticalPosition);
-
-    return verticalPosition;
-}
-
-void InlineFlowBox::computeLogicalBoxHeights(int& maxPositionTop, int& maxPositionBottom,
+void InlineFlowBox::computeLogicalBoxHeights(RootInlineBox* rootBox, int& maxPositionTop, int& maxPositionBottom,
                                              int& maxAscent, int& maxDescent, bool& setMaxAscent, bool& setMaxDescent,
                                              bool strictMode, GlyphOverflowAndFallbackFontsMap& textBoxDataMap,
                                              FontBaseline baselineType, VerticalPositionCache& verticalPositionCache)
 {
     // The primary purpose of this function is to compute the maximal ascent and descent values for
-    // a line.
+    // a line. These values are computed based off the block's line-box-contain property, which indicates
+    // what parts of descendant boxes have to fit within the line.
+    //
+    // The maxAscent value represents the distance of the highest point of any box (typically including line-height) from
+    // the root box's baseline. The maxDescent value represents the distance of the lowest point of any box
+    // (also typically including line-height) from the root box baseline. These values can be negative.
     //
-    // The maxAscent value represents the distance of the highest point of any box (including line-height) from
-    // the root box's baseline.  The maxDescent value represents the distance of the lowest point of any box
-    // (also including line-height) from the root box baseline.  These values can be negative.
+    // A secondary purpose of this function is to store the offset of every box's baseline from the root box's
+    // baseline. This information is cached in the logicalTop() of every box. We're effectively just using
+    // the logicalTop() as scratch space.
     //
-    // A secondary purpose of this function is to store the offset of very box's baseline from the root box's
-    // baseline.  This information is cached in the logicalTop() of every box. We're effectively just using
-    // the logicalTop() as scratch space. 
+    // Because a box can be positioned such that it ends up fully above or fully below the
+    // root line box, we only consider it to affect the maxAscent and maxDescent values if some
+    // part of the box (EXCLUDING leading) is above (for ascent) or below (for descent) the root box's baseline.
+    bool affectsAscent = false;
+    bool affectsDescent = false;
+    bool checkChildren = !descendantsHaveSameLineHeightAndBaseline();
+    
     if (isRootInlineBox()) {
         // Examine our root box.
-        int height = lineHeight();
-        int baseline = baselinePosition(baselineType);
-        if (hasTextChildren() || strictMode) {
-            int ascent = baseline;
-            int descent = height - ascent;
+        int ascent = 0;
+        int descent = 0;
+        rootBox->ascentAndDescentForBox(rootBox, textBoxDataMap, ascent, descent, affectsAscent, affectsDescent);
+        if (strictMode || hasTextChildren() || (!checkChildren && hasTextDescendants())) {
             if (maxAscent < ascent || !setMaxAscent) {
                 maxAscent = ascent;
                 setMaxAscent = true;
@@ -481,131 +471,96 @@ void InlineFlowBox::computeLogicalBoxHeights(int& maxPositionTop, int& maxPositi
         }
     }
 
+    if (!checkChildren)
+        return;
+
     for (InlineBox* curr = firstChild(); curr; curr = curr->nextOnLine()) {
         if (curr->renderer()->isPositioned())
             continue; // Positioned placeholders don't affect calculations.
         
-        bool isInlineFlow = curr->isInlineFlowBox();
+        InlineFlowBox* inlineFlowBox = curr->isInlineFlowBox() ? static_cast<InlineFlowBox*>(curr) : 0;
         
-        // Because a box can be positioned such that it ends up fully above or fully below the
-        // root line box, we only consider it to affect the maxAscent and maxDescent values if some
-        // part of the box (EXCLUDING line-height) is above (for ascent) or below (for descent) the root box's baseline.
         bool affectsAscent = false;
         bool affectsDescent = false;
         
         // The verticalPositionForBox function returns the distance between the child box's baseline
         // and the root box's baseline.  The value is negative if the child box's baseline is above the
         // root box's baseline, and it is positive if the child box's baseline is below the root box's baseline.
-        curr->setLogicalTop(verticalPositionForBox(curr, baselineType, m_firstLine, verticalPositionCache));
+        curr->setLogicalTop(rootBox->verticalPositionForBox(curr, verticalPositionCache));
         
-        int lineHeight;
-        int baseline;
-        Vector<const SimpleFontData*>* usedFonts = 0;
-        if (curr->isInlineTextBox()) {
-            GlyphOverflowAndFallbackFontsMap::iterator it = textBoxDataMap.find(static_cast<InlineTextBox*>(curr));
-            usedFonts = it == textBoxDataMap.end() ? 0 : &it->second.first;
-        }
-
-        if (usedFonts && !usedFonts->isEmpty() && curr->renderer()->style(m_firstLine)->lineHeight().isNegative()) {
-            usedFonts->append(curr->renderer()->style(m_firstLine)->font().primaryFont());
-            bool baselineSet = false;
-            baseline = 0;
-            int baselineToBottom = 0;
-            for (size_t i = 0; i < usedFonts->size(); ++i) {
-                const FontMetrics& fontMetrics = usedFonts->at(i)->fontMetrics();
-                int halfLeading = (fontMetrics.lineSpacing() - fontMetrics.height()) / 2;
-                int usedFontBaseline = halfLeading + fontMetrics.ascent(baselineType);
-                int usedFontBaselineToBottom = fontMetrics.lineSpacing() - usedFontBaseline;
-                if (!baselineSet) {
-                    baselineSet = true;
-                    baseline = usedFontBaseline;
-                    baselineToBottom = usedFontBaselineToBottom;
-                } else {
-                    baseline = max(baseline, usedFontBaseline);
-                    baselineToBottom = max(baselineToBottom, usedFontBaselineToBottom);
-                }
-                if (!affectsAscent)
-                    affectsAscent = fontMetrics.ascent() - curr->logicalTop() > 0;
-                if (!affectsDescent)
-                    affectsDescent = fontMetrics.descent() + curr->logicalTop() > 0;
-            }
-            lineHeight = baseline + baselineToBottom;
-        } else {
-            lineHeight = curr->lineHeight();
-            baseline = curr->baselinePosition(baselineType);
-            if (curr->isText() || isInlineFlow) {
-                // Examine the font box for inline flows and text boxes to see if any part of it is above the baseline.
-                // If the top of our font box relative to the root box baseline is above the root box baseline, then
-                // we are contributing to the maxAscent value.
-                const FontMetrics& fontMetrics = curr->renderer()->style(m_firstLine)->fontMetrics();
-                affectsAscent = fontMetrics.ascent(baselineType) - curr->logicalTop() > 0;
-                
-                // Descent is similar.  If any part of our font box is below the root box's baseline, then
-                // we contribute to the maxDescent value.
-                affectsDescent = fontMetrics.descent(baselineType) + curr->logicalTop() > 0;
-            } else {
-                // Replaced elements always affect both the ascent and descent.
-                affectsAscent = true;
-                affectsDescent = true;
-            }
-        }
+        int ascent = 0;
+        int descent = 0;
+        rootBox->ascentAndDescentForBox(curr, textBoxDataMap, ascent, descent, affectsAscent, affectsDescent);
 
+        int boxHeight = ascent + descent;
         if (curr->verticalAlign() == TOP) {
-            if (maxPositionTop < lineHeight)
-                maxPositionTop = lineHeight;
+            if (maxPositionTop < ascent)
+                maxPositionTop = boxHeight;
         } else if (curr->verticalAlign() == BOTTOM) {
-            if (maxPositionBottom < lineHeight)
-                maxPositionBottom = lineHeight;
-        } else if ((!isInlineFlow || static_cast<InlineFlowBox*>(curr)->hasTextChildren()) || curr->boxModelObject()->hasInlineDirectionBordersOrPadding() || strictMode) {
+            if (maxPositionBottom < boxHeight)
+                maxPositionBottom = boxHeight;
+        } else if (!inlineFlowBox || strictMode || inlineFlowBox->hasTextChildren() || (inlineFlowBox->descendantsHaveSameLineHeightAndBaseline() && inlineFlowBox->hasTextDescendants())
+                   || inlineFlowBox->boxModelObject()->hasInlineDirectionBordersOrPadding()) {
             // Note that these values can be negative.  Even though we only affect the maxAscent and maxDescent values
             // if our box (excluding line-height) was above (for ascent) or below (for descent) the root baseline, once you factor in line-height
             // the final box can end up being fully above or fully below the root box's baseline!  This is ok, but what it
             // means is that ascent and descent (including leading), can end up being negative.  The setMaxAscent and
             // setMaxDescent booleans are used to ensure that we're willing to initially set maxAscent/Descent to negative
             // values.
-            int ascent = baseline - curr->logicalTop();
-            int descent = lineHeight - ascent;
+            ascent -= curr->logicalTop();
+            descent += curr->logicalTop();
             if (affectsAscent && (maxAscent < ascent || !setMaxAscent)) {
                 maxAscent = ascent;
                 setMaxAscent = true;
             }
+
             if (affectsDescent && (maxDescent < descent || !setMaxDescent)) {
                 maxDescent = descent;
                 setMaxDescent = true;
             }
         }
 
-        if (curr->isInlineFlowBox())
-            static_cast<InlineFlowBox*>(curr)->computeLogicalBoxHeights(maxPositionTop, maxPositionBottom, maxAscent, maxDescent,
-                                                                        setMaxAscent, setMaxDescent, strictMode, textBoxDataMap,
-                                                                        baselineType, verticalPositionCache);
+        if (inlineFlowBox)
+            inlineFlowBox->computeLogicalBoxHeights(rootBox, maxPositionTop, maxPositionBottom, maxAscent, maxDescent,
+                                                    setMaxAscent, setMaxDescent, strictMode, textBoxDataMap,
+                                                    baselineType, verticalPositionCache);
     }
 }
 
 void InlineFlowBox::placeBoxesInBlockDirection(int top, int maxHeight, int maxAscent, bool strictMode, int& lineTop, int& lineBottom, bool& setLineTop,
                                                int& lineTopIncludingMargins, int& lineBottomIncludingMargins, bool& hasAnnotationsBefore, bool& hasAnnotationsAfter, FontBaseline baselineType)
 {
-    if (isRootInlineBox())
-        setLogicalTop(top + maxAscent - baselinePosition(baselineType)); // Place our root box.
+    bool isRootBox = isRootInlineBox();
+    if (isRootBox) {
+        const FontMetrics& fontMetrics = renderer()->style(m_firstLine)->fontMetrics();
+        setLogicalTop(top + maxAscent - fontMetrics.ascent(baselineType));
+    }
+
+    int adjustmentForChildrenWithSameLineHeightAndBaseline = 0;
+    if (descendantsHaveSameLineHeightAndBaseline()) {
+        adjustmentForChildrenWithSameLineHeightAndBaseline = logicalTop();
+        if (parent())
+            adjustmentForChildrenWithSameLineHeightAndBaseline += (boxModelObject()->borderBefore() + boxModelObject()->paddingBefore());
+    }
 
     for (InlineBox* curr = firstChild(); curr; curr = curr->nextOnLine()) {
         if (curr->renderer()->isPositioned())
             continue; // Positioned placeholders don't affect calculations.
-        
-        // Adjust boxes to use their real box y/height and not the logical height (as dictated by
-        // line-height).
-        bool isInlineFlow = curr->isInlineFlowBox();
-        if (isInlineFlow)
-            static_cast<InlineFlowBox*>(curr)->placeBoxesInBlockDirection(top, maxHeight, maxAscent, strictMode, lineTop, lineBottom, setLineTop,
-                                                                          lineTopIncludingMargins, lineBottomIncludingMargins, hasAnnotationsBefore, hasAnnotationsAfter, baselineType);
 
+        if (descendantsHaveSameLineHeightAndBaseline()) {
+            curr->adjustBlockDirectionPosition(adjustmentForChildrenWithSameLineHeightAndBaseline);
+            continue;
+        }
+
+        InlineFlowBox* inlineFlowBox = curr->isInlineFlowBox() ? static_cast<InlineFlowBox*>(curr) : 0;
         bool childAffectsTopBottomPos = true;
         if (curr->verticalAlign() == TOP)
             curr->setLogicalTop(top);
         else if (curr->verticalAlign() == BOTTOM)
             curr->setLogicalTop(top + maxHeight - curr->lineHeight());
         else {
-            if ((isInlineFlow && !static_cast<InlineFlowBox*>(curr)->hasTextChildren()) && !curr->boxModelObject()->hasInlineDirectionBordersOrPadding() && !strictMode)
+            if (!strictMode && inlineFlowBox && !inlineFlowBox->hasTextChildren() && !curr->boxModelObject()->hasInlineDirectionBordersOrPadding()
+                && !(inlineFlowBox->descendantsHaveSameLineHeightAndBaseline() && inlineFlowBox->hasTextDescendants()))
                 childAffectsTopBottomPos = false;
             int posAdjust = maxAscent - curr->baselinePosition(baselineType);
             curr->setLogicalTop(curr->logicalTop() + top + posAdjust);
@@ -676,13 +631,16 @@ void InlineFlowBox::placeBoxesInBlockDirection(int top, int maxHeight, int maxAs
             lineBottom = max(lineBottom, newLogicalTop + boxHeight);
             lineBottomIncludingMargins = max(lineBottom, max(lineBottomIncludingMargins, newLogicalTopIncludingMargins + boxHeightIncludingMargins));
         }
+        
+        // Adjust boxes to use their real box y/height and not the logical height (as dictated by
+        // line-height).
+        if (inlineFlowBox)
+            inlineFlowBox->placeBoxesInBlockDirection(top, maxHeight, maxAscent, strictMode, lineTop, lineBottom, setLineTop,
+                                                      lineTopIncludingMargins, lineBottomIncludingMargins, hasAnnotationsBefore, hasAnnotationsAfter, baselineType);
     }
 
-    if (isRootInlineBox()) {
-        const FontMetrics& fontMetrics = renderer()->style(m_firstLine)->fontMetrics();
-        setLogicalTop(logicalTop() + baselinePosition(baselineType) - fontMetrics.ascent(baselineType));
-        
-        if (hasTextChildren() || strictMode) {
+    if (isRootBox) {
+        if (strictMode || hasTextChildren() || (descendantsHaveSameLineHeightAndBaseline() && hasTextDescendants())) {
             if (!setLineTop) {
                 setLineTop = true;
                 lineTop = logicalTop();
@@ -919,10 +877,29 @@ bool InlineFlowBox::nodeAtPoint(const HitTestRequest& request, HitTestResult& re
         }
     }
 
-    // Now check ourselves.
-    FloatPoint boxOrigin = locationIncludingFlipping();
-    boxOrigin.move(tx, ty);
-    FloatRect rect(boxOrigin, IntSize(width(), height()));
+    // Now check ourselves. Pixel snap hit testing.
+    IntRect frameRect = roundedFrameRect();
+    int minX = frameRect.x();
+    int minY = frameRect.y();
+    int width = frameRect.width();
+    int height = frameRect.height();
+
+    // Constrain our hit testing to the line top and bottom if necessary.
+    bool noQuirksMode = renderer()->document()->inNoQuirksMode();
+    if (!noQuirksMode && !hasTextChildren() && !(descendantsHaveSameLineHeightAndBaseline() && hasTextDescendants())) {
+        RootInlineBox* rootBox = root();
+        int& top = isHorizontal() ? minY : minX;
+        int& logicalHeight = isHorizontal() ? height : width;
+        int bottom = min(rootBox->lineBottom(), top + logicalHeight);
+        top = max(rootBox->lineTop(), top);
+        logicalHeight = bottom - top;
+    }
+    
+    // Move x/y to our coordinates.
+    IntRect rect(minX, minY, width, height);
+    flipForWritingMode(rect);
+    rect.move(tx, ty);
+
     if (visibleToHitTesting() && rect.intersects(result.rectForPoint(x, y))) {
         renderer()->updateHitTestResult(result, flipForWritingMode(IntPoint(x - tx, y - ty))); // Don't add in m_x or m_y here, we want coords in the containing block's space.
         if (!result.addNodeToRectBasedTestResult(renderer()->node(), x, y, rect))
@@ -1074,7 +1051,7 @@ void InlineFlowBox::paintBoxDecorations(PaintInfo& paintInfo, int tx, int ty)
 
     // Constrain our background/border painting to the line top and bottom if necessary.
     bool noQuirksMode = renderer()->document()->inNoQuirksMode();
-    if (!hasTextChildren() && !noQuirksMode) {
+    if (!noQuirksMode && !hasTextChildren() && !(descendantsHaveSameLineHeightAndBaseline() && hasTextDescendants())) {
         RootInlineBox* rootBox = root();
         int& top = isHorizontal() ? y : x;
         int& logicalHeight = isHorizontal() ? h : w;
@@ -1156,7 +1133,7 @@ void InlineFlowBox::paintMask(PaintInfo& paintInfo, int tx, int ty)
 
     // Constrain our background/border painting to the line top and bottom if necessary.
     bool noQuirksMode = renderer()->document()->inNoQuirksMode();
-    if (!hasTextChildren() && !noQuirksMode) {
+    if (!noQuirksMode && !hasTextChildren() && !(descendantsHaveSameLineHeightAndBaseline() && hasTextDescendants())) {
         RootInlineBox* rootBox = root();
         int& top = isHorizontal() ? y : x;
         int& logicalHeight = isHorizontal() ? h : w;
@@ -1363,6 +1340,59 @@ int InlineFlowBox::computeUnderAnnotationAdjustment(int allowedPosition) const
     return result;
 }
 
+void InlineFlowBox::collectLeafBoxesInLogicalOrder(Vector<InlineBox*>& leafBoxesInLogicalOrder, CustomInlineBoxRangeReverse customReverseImplementation, void* userData) const
+{
+    InlineBox* leaf = firstLeafChild();
+
+    // FIXME: The reordering code is a copy of parts from BidiResolver::createBidiRunsForLine, operating directly on InlineBoxes, instead of BidiRuns.
+    // Investigate on how this code could possibly be shared.
+    unsigned char minLevel = 128;
+    unsigned char maxLevel = 0;
+
+    // First find highest and lowest levels, and initialize leafBoxesInLogicalOrder with the leaf boxes in visual order.
+    for (; leaf; leaf = leaf->nextLeafChild()) {
+        minLevel = min(minLevel, leaf->bidiLevel());
+        maxLevel = max(maxLevel, leaf->bidiLevel());
+        leafBoxesInLogicalOrder.append(leaf);
+    }
+
+    if (renderer()->style()->visuallyOrdered())
+        return;
+
+    // Reverse of reordering of the line (L2 according to Bidi spec):
+    // L2. From the highest level found in the text to the lowest odd level on each line,
+    // reverse any contiguous sequence of characters that are at that level or higher.
+
+    // Reversing the reordering of the line is only done up to the lowest odd level.
+    if (!(minLevel % 2))
+        ++minLevel;
+
+    Vector<InlineBox*>::iterator end = leafBoxesInLogicalOrder.end();
+    while (minLevel <= maxLevel) {
+        Vector<InlineBox*>::iterator it = leafBoxesInLogicalOrder.begin();
+        while (it != end) {
+            while (it != end) {
+                if ((*it)->bidiLevel() >= minLevel)
+                    break;
+                ++it;
+            }
+            Vector<InlineBox*>::iterator first = it;
+            while (it != end) {
+                if ((*it)->bidiLevel() < minLevel)
+                    break;
+                ++it;
+            }
+            Vector<InlineBox*>::iterator last = it;
+            if (customReverseImplementation) {
+                ASSERT(userData);
+                (*customReverseImplementation)(userData, first, last);
+            } else
+                std::reverse(first, last);
+        }                
+        ++minLevel;
+    }
+}
+
 #ifndef NDEBUG
 
 void InlineFlowBox::checkConsistency() const
diff --git a/Source/WebCore/rendering/InlineFlowBox.h b/Source/WebCore/rendering/InlineFlowBox.h
index 918cf5d..9b6f8e4 100644
--- a/Source/WebCore/rendering/InlineFlowBox.h
+++ b/Source/WebCore/rendering/InlineFlowBox.h
@@ -45,6 +45,7 @@ public:
         , m_nextLineBox(0)
         , m_includeLogicalLeftEdge(false)
         , m_includeLogicalRightEdge(false)
+        , m_descendantsHaveSameLineHeightAndBaseline(true)
 #ifndef NDEBUG
         , m_hasBadChildList(false)
 #endif
@@ -55,6 +56,7 @@ public:
         // text children must not apply.  This change also means that gaps will exist between image bullet list items.  Even when the list bullet
         // is an image, the line is still considered to be immune from the quirk.
         m_hasTextChildren = obj->style()->display() == LIST_ITEM;
+        m_hasTextDescendants = m_hasTextChildren;
     }
 
 #ifndef NDEBUG
@@ -74,6 +76,9 @@ public:
     InlineBox* firstLeafChild() const;
     InlineBox* lastLeafChild() const;
 
+    typedef void (*CustomInlineBoxRangeReverse)(void* userData, Vector<InlineBox*>::iterator first, Vector<InlineBox*>::iterator last);
+    void collectLeafBoxesInLogicalOrder(Vector<InlineBox*>&, CustomInlineBoxRangeReverse customReverseImplementation = 0, void* userData = 0) const;
+
     virtual void setConstructed()
     {
         InlineBox::setConstructed();
@@ -154,11 +159,11 @@ public:
     }
 
     // Helper functions used during line construction and placement.
-    void determineSpacingForFlowBoxes(bool lastLine, RenderObject* endObject);
+    void determineSpacingForFlowBoxes(bool lastLine, RenderObject* endObject, RenderObject* logicallyLastRunRenderer);
     int getFlowSpacingLogicalWidth();
     bool onEndChain(RenderObject* endObject);
     float placeBoxesInInlineDirection(float logicalLeft, bool& needsWordSpacing, GlyphOverflowAndFallbackFontsMap&);
-    void computeLogicalBoxHeights(int& maxPositionTop, int& maxPositionBottom,
+    void computeLogicalBoxHeights(RootInlineBox*, int& maxPositionTop, int& maxPositionBottom,
                                   int& maxAscent, int& maxDescent, bool& setMaxAscent, bool& setMaxDescent,
                                   bool strictMode, GlyphOverflowAndFallbackFontsMap&, FontBaseline, VerticalPositionCache&);
     void adjustMaxAscentAndDescent(int& maxAscent, int& maxDescent,
@@ -181,6 +186,7 @@ public:
     virtual float placeEllipsisBox(bool ltr, float blockLeftEdge, float blockRightEdge, float ellipsisWidth, bool&);
 
     bool hasTextChildren() const { return m_hasTextChildren; }
+    bool hasTextDescendants() const { return m_hasTextDescendants; }
 
     void checkConsistency() const;
     void setHasBadChildList();
@@ -226,6 +232,14 @@ public:
     void setLayoutOverflow(const IntRect&);
     void setVisualOverflow(const IntRect&);
 
+    bool descendantsHaveSameLineHeightAndBaseline() const { return m_descendantsHaveSameLineHeightAndBaseline; }
+    void clearDescendantsHaveSameLineHeightAndBaseline()
+    { 
+        m_descendantsHaveSameLineHeightAndBaseline = false;
+        if (parent() && parent()->descendantsHaveSameLineHeightAndBaseline())
+            parent()->clearDescendantsHaveSameLineHeightAndBaseline();
+    }
+
 private:
     void addBoxShadowVisualOverflow(IntRect& logicalVisualOverflow);
     void addTextBoxVisualOverflow(const InlineTextBox*, GlyphOverflowAndFallbackFontsMap&, IntRect& logicalVisualOverflow);
@@ -245,6 +259,8 @@ protected:
     bool m_includeLogicalLeftEdge : 1;
     bool m_includeLogicalRightEdge : 1;
     bool m_hasTextChildren : 1;
+    bool m_hasTextDescendants : 1;
+    bool m_descendantsHaveSameLineHeightAndBaseline : 1;
 
 #ifndef NDEBUG
     bool m_hasBadChildList;
diff --git a/Source/WebCore/rendering/InlineIterator.h b/Source/WebCore/rendering/InlineIterator.h
index 270364f..75d9763 100644
--- a/Source/WebCore/rendering/InlineIterator.h
+++ b/Source/WebCore/rendering/InlineIterator.h
@@ -34,43 +34,89 @@ namespace WebCore {
 class InlineIterator {
 public:
     InlineIterator()
-        : block(0)
-        , obj(0)
-        , pos(0)
-        , nextBreakablePosition(-1)
+        : m_block(0)
+        , m_obj(0)
+        , m_pos(0)
+        , m_nextBreakablePosition(-1)
     {
     }
 
     InlineIterator(RenderBlock* b, RenderObject* o, unsigned p)
-        : block(b)
-        , obj(o)
-        , pos(p)
-        , nextBreakablePosition(-1)
+        : m_block(b)
+        , m_obj(o)
+        , m_pos(p)
+        , m_nextBreakablePosition(-1)
     {
     }
 
+    void clear() { moveTo(0, 0); }
+
+    void moveToStartOf(RenderObject* object)
+    {
+        moveTo(object, 0);
+    }
+
+    void moveTo(RenderObject* object, unsigned offset, int nextBreak = -1)
+    {
+        m_obj = object;
+        m_pos = offset;
+        m_nextBreakablePosition = nextBreak;
+    }
+
     void increment(InlineBidiResolver* resolver = 0);
     bool atEnd() const;
 
     UChar current() const;
     ALWAYS_INLINE WTF::Unicode::Direction direction() const;
 
-    RenderBlock* block;
-    RenderObject* obj;
-    unsigned pos;
-    int nextBreakablePosition;
+    RenderBlock* m_block;
+    RenderObject* m_obj;
+    unsigned m_pos;
+    int m_nextBreakablePosition;
 };
 
 inline bool operator==(const InlineIterator& it1, const InlineIterator& it2)
 {
-    return it1.pos == it2.pos && it1.obj == it2.obj;
+    return it1.m_pos == it2.m_pos && it1.m_obj == it2.m_obj;
 }
 
 inline bool operator!=(const InlineIterator& it1, const InlineIterator& it2)
 {
-    return it1.pos != it2.pos || it1.obj != it2.obj;
+    return it1.m_pos != it2.m_pos || it1.m_obj != it2.m_obj;
+}
+
+static inline WTF::Unicode::Direction embedCharFromDirection(TextDirection dir, EUnicodeBidi unicodeBidi)
+{
+    using namespace WTF::Unicode;
+    if (unicodeBidi == Embed)
+        return dir == RTL ? RightToLeftEmbedding : LeftToRightEmbedding;
+    return dir == RTL ? RightToLeftOverride : LeftToRightOverride;
+}
+
+static inline void notifyResolverEnteredObject(InlineBidiResolver* resolver, RenderObject* object)
+{
+    if (!resolver || !object || !object->isRenderInline())
+        return;
+
+    RenderStyle* style = object->style();
+    EUnicodeBidi unicodeBidi = style->unicodeBidi();
+    if (unicodeBidi == UBNormal)
+        return;
+    resolver->embed(embedCharFromDirection(style->direction(), unicodeBidi), FromStyleOrDOM);
+}
+
+static inline void notifyResolverWillExitObject(InlineBidiResolver* resolver, RenderObject* object)
+{
+    if (!resolver || !object || !object->isRenderInline())
+        return;
+    if (object->style()->unicodeBidi() == UBNormal)
+        return;
+    resolver->embed(WTF::Unicode::PopDirectionalFormat, FromStyleOrDOM);
 }
 
+// FIXME: This function is misleadingly named. It has little to do with bidi.
+// This function will iterate over inlines within a block, optionally notifying
+// a bidi resolver as it enters/exits inlines (so it can push/pop embedding levels).
 static inline RenderObject* bidiNext(RenderBlock* block, RenderObject* current, InlineBidiResolver* resolver = 0, bool skipInlines = true, bool* endOfInlinePtr = 0)
 {
     RenderObject* next = 0;
@@ -81,16 +127,7 @@ static inline RenderObject* bidiNext(RenderBlock* block, RenderObject* current,
         next = 0;
         if (!oldEndOfInline && !current->isFloating() && !current->isReplaced() && !current->isPositioned() && !current->isText()) {
             next = current->firstChild();
-            if (next && resolver && next->isRenderInline()) {
-                EUnicodeBidi ub = next->style()->unicodeBidi();
-                if (ub != UBNormal) {
-                    TextDirection dir = next->style()->direction();
-                    WTF::Unicode::Direction d = (ub == Embed
-                        ? (dir == RTL ? WTF::Unicode::RightToLeftEmbedding : WTF::Unicode::LeftToRightEmbedding)
-                        : (dir == RTL ? WTF::Unicode::RightToLeftOverride : WTF::Unicode::LeftToRightOverride));
-                    resolver->embed(d);
-                }
-            }
+            notifyResolverEnteredObject(resolver, next);
         }
 
         if (!next) {
@@ -101,24 +138,14 @@ static inline RenderObject* bidiNext(RenderBlock* block, RenderObject* current,
             }
 
             while (current && current != block) {
-                if (resolver && current->isRenderInline() && current->style()->unicodeBidi() != UBNormal)
-                    resolver->embed(WTF::Unicode::PopDirectionalFormat);
+                notifyResolverWillExitObject(resolver, current);
 
                 next = current->nextSibling();
                 if (next) {
-                    if (resolver && next->isRenderInline()) {
-                        EUnicodeBidi ub = next->style()->unicodeBidi();
-                        if (ub != UBNormal) {
-                            TextDirection dir = next->style()->direction();
-                            WTF::Unicode::Direction d = (ub == Embed
-                                ? (dir == RTL ? WTF::Unicode::RightToLeftEmbedding: WTF::Unicode::LeftToRightEmbedding)
-                                : (dir == RTL ? WTF::Unicode::RightToLeftOverride : WTF::Unicode::LeftToRightOverride));
-                            resolver->embed(d);
-                        }
-                    }
+                    notifyResolverEnteredObject(resolver, next);
                     break;
                 }
-                
+
                 current = current->parent();
                 if (!skipInlines && current && current != block && current->isRenderInline()) {
                     next = current;
@@ -148,19 +175,10 @@ static inline RenderObject* bidiFirst(RenderBlock* block, InlineBidiResolver* re
 {
     if (!block->firstChild())
         return 0;
-    
+
     RenderObject* o = block->firstChild();
     if (o->isRenderInline()) {
-        if (resolver) {
-            EUnicodeBidi ub = o->style()->unicodeBidi();
-            if (ub != UBNormal) {
-                TextDirection dir = o->style()->direction();
-                WTF::Unicode::Direction d = (ub == Embed
-                    ? (dir == RTL ? WTF::Unicode::RightToLeftEmbedding : WTF::Unicode::LeftToRightEmbedding)
-                    : (dir == RTL ? WTF::Unicode::RightToLeftOverride : WTF::Unicode::LeftToRightOverride));
-                resolver->embed(d);
-            }
-        }
+        notifyResolverEnteredObject(resolver, o);
         if (skipInlines && o->firstChild())
             o = bidiNext(block, o, resolver, skipInlines);
         else {
@@ -181,37 +199,32 @@ static inline RenderObject* bidiFirst(RenderBlock* block, InlineBidiResolver* re
 
 inline void InlineIterator::increment(InlineBidiResolver* resolver)
 {
-    if (!obj)
+    if (!m_obj)
         return;
-    if (obj->isText()) {
-        pos++;
-        if (pos >= toRenderText(obj)->textLength()) {
-            obj = bidiNext(block, obj, resolver);
-            pos = 0;
-            nextBreakablePosition = -1;
-        }
-    } else {
-        obj = bidiNext(block, obj, resolver);
-        pos = 0;
-        nextBreakablePosition = -1;
+    if (m_obj->isText()) {
+        m_pos++;
+        if (m_pos < toRenderText(m_obj)->textLength())
+            return;
     }
+    // bidiNext can return 0, so use moveTo instead of moveToStartOf
+    moveTo(bidiNext(m_block, m_obj, resolver), 0);
 }
 
 inline bool InlineIterator::atEnd() const
 {
-    return !obj;
+    return !m_obj;
 }
 
 inline UChar InlineIterator::current() const
 {
-    if (!obj || !obj->isText())
+    if (!m_obj || !m_obj->isText())
         return 0;
 
-    RenderText* text = toRenderText(obj);
-    if (pos >= text->textLength())
+    RenderText* text = toRenderText(m_obj);
+    if (m_pos >= text->textLength())
         return 0;
 
-    return text->characters()[pos];
+    return text->characters()[m_pos];
 }
 
 ALWAYS_INLINE WTF::Unicode::Direction InlineIterator::direction() const
@@ -219,8 +232,8 @@ ALWAYS_INLINE WTF::Unicode::Direction InlineIterator::direction() const
     if (UChar c = current())
         return WTF::Unicode::direction(c);
 
-    if (obj && obj->isListMarker())
-        return obj->style()->isLeftToRightDirection() ? WTF::Unicode::LeftToRight : WTF::Unicode::RightToLeft;
+    if (m_obj && m_obj->isListMarker())
+        return m_obj->style()->isLeftToRightDirection() ? WTF::Unicode::LeftToRight : WTF::Unicode::RightToLeft;
 
     return WTF::Unicode::OtherNeutral;
 }
@@ -228,33 +241,33 @@ ALWAYS_INLINE WTF::Unicode::Direction InlineIterator::direction() const
 template<>
 inline void InlineBidiResolver::increment()
 {
-    current.increment(this);
+    m_current.increment(this);
 }
 
 template <>
 inline void InlineBidiResolver::appendRun()
 {
-    if (!emptyRun && !eor.atEnd()) {
-        int start = sor.pos;
-        RenderObject *obj = sor.obj;
-        while (obj && obj != eor.obj && obj != endOfLine.obj) {
+    if (!emptyRun && !m_eor.atEnd()) {
+        int start = m_sor.m_pos;
+        RenderObject* obj = m_sor.m_obj;
+        while (obj && obj != m_eor.m_obj && obj != endOfLine.m_obj) {
             RenderBlock::appendRunsForObject(start, obj->length(), obj, *this);        
             start = 0;
-            obj = bidiNext(sor.block, obj);
+            obj = bidiNext(m_sor.m_block, obj);
         }
         if (obj) {
-            unsigned pos = obj == eor.obj ? eor.pos : UINT_MAX;
-            if (obj == endOfLine.obj && endOfLine.pos <= pos) {
-                reachedEndOfLine = true;
-                pos = endOfLine.pos;
+            unsigned pos = obj == m_eor.m_obj ? m_eor.m_pos : UINT_MAX;
+            if (obj == endOfLine.m_obj && endOfLine.m_pos <= pos) {
+                m_reachedEndOfLine = true;
+                pos = endOfLine.m_pos;
             }
             // It's OK to add runs for zero-length RenderObjects, just don't make the run larger than it should be
-            int end = obj->length() ? pos+1 : 0;
+            int end = obj->length() ? pos + 1 : 0;
             RenderBlock::appendRunsForObject(start, end, obj, *this);
         }
         
-        eor.increment();
-        sor = eor;
+        m_eor.increment();
+        m_sor = m_eor;
     }
 
     m_direction = WTF::Unicode::OtherNeutral;
diff --git a/Source/WebCore/rendering/InlineTextBox.cpp b/Source/WebCore/rendering/InlineTextBox.cpp
index 3c3e450..b614f0f 100644
--- a/Source/WebCore/rendering/InlineTextBox.cpp
+++ b/Source/WebCore/rendering/InlineTextBox.cpp
@@ -163,7 +163,7 @@ IntRect InlineTextBox::selectionRect(int tx, int ty, int startPos, int endPos)
         ePos = len;
     }
 
-    IntRect r = enclosingIntRect(f.selectionRectForText(TextRun(characters, len, textObj->allowTabs(), textPos(), m_expansion, trailingExpansionBehavior(), !isLeftToRightDirection(), m_dirOverride),
+    IntRect r = enclosingIntRect(f.selectionRectForText(TextRun(characters, len, textObj->allowTabs(), textPos(), m_expansion, expansionBehavior(), !isLeftToRightDirection(), m_dirOverride),
                                                         IntPoint(), selHeight, sPos, ePos));
                                                         
     int logicalWidth = r.width();
@@ -427,6 +427,14 @@ bool InlineTextBox::getEmphasisMarkPosition(RenderStyle* style, TextEmphasisPosi
     return !rubyText || !rubyText->firstLineBox();
 }
 
+enum RotationDirection { Counterclockwise, Clockwise };
+
+static inline AffineTransform rotation(const FloatRect& boxRect, RotationDirection clockwise)
+{
+    return clockwise ? AffineTransform(0, 1, -1, 0, boxRect.x() + boxRect.maxY(), boxRect.maxY() - boxRect.x())
+        : AffineTransform(0, -1, 1, 0, boxRect.x() - boxRect.maxY(), boxRect.x() + boxRect.maxY());
+}
+
 void InlineTextBox::paint(PaintInfo& paintInfo, int tx, int ty)
 {
     if (isLineBreak() || !paintInfo.shouldPaintWithinRoot(renderer()) || renderer()->style()->visibility() != VISIBLE ||
@@ -485,26 +493,22 @@ void InlineTextBox::paint(PaintInfo& paintInfo, int tx, int ty)
     FloatPoint boxOrigin = locationIncludingFlipping();
     boxOrigin.move(tx, ty);    
     FloatRect boxRect(boxOrigin, IntSize(logicalWidth(), logicalHeight()));
-    FloatPoint textOrigin = FloatPoint(boxOrigin.x(), boxOrigin.y() + styleToUse->fontMetrics().ascent());
 
-    RenderCombineText* combinedText = styleToUse->hasTextCombine() ? toRenderCombineText(textRenderer()) : 0;
-    bool shouldRotate = !isHorizontal() && (!combinedText || !combinedText->isCombined());
-    if (shouldRotate) {
-        context->save();
-        context->translate(boxRect.x(), boxRect.maxY());
-        context->rotate(static_cast<float>(deg2rad(90.)));
-        context->translate(-boxRect.x(), -boxRect.maxY());
-    }
-    
-    
+    RenderCombineText* combinedText = styleToUse->hasTextCombine() && textRenderer()->isCombineText() && toRenderCombineText(textRenderer())->isCombined() ? toRenderCombineText(textRenderer()) : 0;
+
+    bool shouldRotate = !isHorizontal() && !combinedText;
+    if (shouldRotate)
+        context->concatCTM(rotation(boxRect, Clockwise));
+
     // Determine whether or not we have composition underlines to draw.
     bool containsComposition = renderer()->node() && renderer()->frame()->editor()->compositionNode() == renderer()->node();
     bool useCustomUnderlines = containsComposition && renderer()->frame()->editor()->compositionUsesCustomUnderlines();
 
     // Set our font.
-    int d = styleToUse->textDecorationsInEffect();
     const Font& font = styleToUse->font();
 
+    FloatPoint textOrigin = FloatPoint(boxOrigin.x(), boxOrigin.y() + font.fontMetrics().ascent());
+
     if (combinedText)
         combinedText->adjustTextOrigin(textOrigin, boxRect);
 
@@ -618,7 +622,7 @@ void InlineTextBox::paint(PaintInfo& paintInfo, int tx, int ty)
     if (hasHyphen())
         adjustCharactersAndLengthForHyphen(charactersWithHyphen, styleToUse, characters, length);
 
-    TextRun textRun(characters, length, textRenderer()->allowTabs(), textPos(), m_expansion, trailingExpansionBehavior(), !isLeftToRightDirection(), m_dirOverride || styleToUse->visuallyOrdered());
+    TextRun textRun(characters, length, textRenderer()->allowTabs(), textPos(), m_expansion, expansionBehavior(), !isLeftToRightDirection(), m_dirOverride || styleToUse->visuallyOrdered());
 
     int sPos = 0;
     int ePos = 0;
@@ -653,11 +657,21 @@ void InlineTextBox::paint(PaintInfo& paintInfo, int tx, int ty)
 
         if (!emphasisMark.isEmpty()) {
             updateGraphicsContext(context, emphasisMarkColor, textStrokeColor, textStrokeWidth, styleToUse->colorSpace());
+
+            static TextRun objectReplacementCharacterTextRun(&objectReplacementCharacter, 1);
+            TextRun& emphasisMarkTextRun = combinedText ? objectReplacementCharacterTextRun : textRun;
+            FloatPoint emphasisMarkTextOrigin = combinedText ? FloatPoint(boxOrigin.x() + boxRect.width() / 2, boxOrigin.y() + font.fontMetrics().ascent()) : textOrigin;
+            if (combinedText)
+                context->concatCTM(rotation(boxRect, Clockwise));
+
             if (!paintSelectedTextSeparately || ePos <= sPos) {
                 // FIXME: Truncate right-to-left text correctly.
-                paintTextWithShadows(context, font, textRun, emphasisMark, emphasisMarkOffset, 0, length, length, textOrigin, boxRect, textShadow, textStrokeWidth > 0, isHorizontal());
+                paintTextWithShadows(context, combinedText ? combinedText->originalFont() : font, emphasisMarkTextRun, emphasisMark, emphasisMarkOffset, 0, length, length, emphasisMarkTextOrigin, boxRect, textShadow, textStrokeWidth > 0, isHorizontal());
             } else
-                paintTextWithShadows(context, font, textRun, emphasisMark, emphasisMarkOffset, ePos, sPos, length, textOrigin, boxRect, textShadow, textStrokeWidth > 0, isHorizontal());
+                paintTextWithShadows(context, combinedText ? combinedText->originalFont() : font, emphasisMarkTextRun, emphasisMark, emphasisMarkOffset, ePos, sPos, length, emphasisMarkTextOrigin, boxRect, textShadow, textStrokeWidth > 0, isHorizontal());
+
+            if (combinedText)
+                context->concatCTM(rotation(boxRect, Counterclockwise));
         }
 
         if (textStrokeWidth > 0)
@@ -673,16 +687,27 @@ void InlineTextBox::paint(PaintInfo& paintInfo, int tx, int ty)
         paintTextWithShadows(context, font, textRun, nullAtom, 0, sPos, ePos, length, textOrigin, boxRect, selectionShadow, selectionStrokeWidth > 0, isHorizontal());
         if (!emphasisMark.isEmpty()) {
             updateGraphicsContext(context, selectionEmphasisMarkColor, textStrokeColor, textStrokeWidth, styleToUse->colorSpace());
-            paintTextWithShadows(context, font, textRun, emphasisMark, emphasisMarkOffset, sPos, ePos, length, textOrigin, boxRect, selectionShadow, selectionStrokeWidth > 0, isHorizontal());
+
+            static TextRun objectReplacementCharacterTextRun(&objectReplacementCharacter, 1);
+            TextRun& emphasisMarkTextRun = combinedText ? objectReplacementCharacterTextRun : textRun;
+            FloatPoint emphasisMarkTextOrigin = combinedText ? FloatPoint(boxOrigin.x() + boxRect.width() / 2, boxOrigin.y() + font.fontMetrics().ascent()) : textOrigin;
+            if (combinedText)
+                context->concatCTM(rotation(boxRect, Clockwise));
+
+            paintTextWithShadows(context, combinedText ? combinedText->originalFont() : font, emphasisMarkTextRun, emphasisMark, emphasisMarkOffset, sPos, ePos, length, emphasisMarkTextOrigin, boxRect, selectionShadow, selectionStrokeWidth > 0, isHorizontal());
+
+            if (combinedText)
+                context->concatCTM(rotation(boxRect, Counterclockwise));
         }
         if (selectionStrokeWidth > 0)
             context->restore();
     }
 
     // Paint decorations
-    if (d != TDNONE && paintInfo.phase != PaintPhaseSelection) {
+    int textDecorations = styleToUse->textDecorationsInEffect();
+    if (textDecorations != TDNONE && paintInfo.phase != PaintPhaseSelection) {
         updateGraphicsContext(context, textFillColor, textStrokeColor, textStrokeWidth, styleToUse->colorSpace());
-        paintDecoration(context, boxOrigin, d, textShadow);
+        paintDecoration(context, boxOrigin, textDecorations, textShadow);
     }
 
     if (paintInfo.phase == PaintPhaseForeground) {
@@ -715,7 +740,7 @@ void InlineTextBox::paint(PaintInfo& paintInfo, int tx, int ty)
     }
     
     if (shouldRotate)
-        context->restore();
+        context->concatCTM(rotation(boxRect, Counterclockwise));
 }
 
 void InlineTextBox::selectionStartEnd(int& sPos, int& ePos)
@@ -772,7 +797,7 @@ void InlineTextBox::paintSelection(GraphicsContext* context, const FloatPoint& b
     int selHeight = selectionHeight();
     FloatPoint localOrigin(boxOrigin.x(), boxOrigin.y() - deltaY);
     context->clip(FloatRect(localOrigin, FloatSize(m_logicalWidth, selHeight)));
-    context->drawHighlightForText(font, TextRun(characters, length, textRenderer()->allowTabs(), textPos(), m_expansion, trailingExpansionBehavior(), 
+    context->drawHighlightForText(font, TextRun(characters, length, textRenderer()->allowTabs(), textPos(), m_expansion, expansionBehavior(), 
                                   !isLeftToRightDirection(), m_dirOverride || style->visuallyOrdered()),
                                   localOrigin, selHeight, c, style->colorSpace(), sPos, ePos);
     context->restore();
@@ -796,7 +821,7 @@ void InlineTextBox::paintCompositionBackground(GraphicsContext* context, const F
     int deltaY = renderer()->style()->isFlippedLinesWritingMode() ? selectionBottom() - logicalBottom() : logicalTop() - selectionTop();
     int selHeight = selectionHeight();
     FloatPoint localOrigin(boxOrigin.x(), boxOrigin.y() - deltaY);
-    context->drawHighlightForText(font, TextRun(textRenderer()->text()->characters() + m_start, m_len, textRenderer()->allowTabs(), textPos(), m_expansion, trailingExpansionBehavior(),
+    context->drawHighlightForText(font, TextRun(textRenderer()->text()->characters() + m_start, m_len, textRenderer()->allowTabs(), textPos(), m_expansion, expansionBehavior(),
                                   !isLeftToRightDirection(), m_dirOverride || style->visuallyOrdered()),
                                   localOrigin, selHeight, c, style->colorSpace(), sPos, ePos);
     context->restore();
@@ -958,7 +983,7 @@ void InlineTextBox::paintSpellingOrGrammarMarker(GraphicsContext* pt, const Floa
         int deltaY = renderer()->style()->isFlippedLinesWritingMode() ? selectionBottom() - logicalBottom() : logicalTop() - selectionTop();
         int selHeight = selectionHeight();
         FloatPoint startPoint(boxOrigin.x(), boxOrigin.y() - deltaY);
-        TextRun run(textRenderer()->text()->characters() + m_start, m_len, textRenderer()->allowTabs(), textPos(), m_expansion, trailingExpansionBehavior(), !isLeftToRightDirection(), m_dirOverride || style->visuallyOrdered());
+        TextRun run(textRenderer()->text()->characters() + m_start, m_len, textRenderer()->allowTabs(), textPos(), m_expansion, expansionBehavior(), !isLeftToRightDirection(), m_dirOverride || style->visuallyOrdered());
         
         // FIXME: Convert the document markers to float rects.
         IntRect markerRect = enclosingIntRect(font.selectionRectForText(run, startPoint, selHeight, startPosition, endPosition));
@@ -1003,7 +1028,7 @@ void InlineTextBox::paintTextMatchMarker(GraphicsContext* pt, const FloatPoint&
 
     int sPos = max(marker.startOffset - m_start, (unsigned)0);
     int ePos = min(marker.endOffset - m_start, (unsigned)m_len);    
-    TextRun run(textRenderer()->text()->characters() + m_start, m_len, textRenderer()->allowTabs(), textPos(), m_expansion, trailingExpansionBehavior(), !isLeftToRightDirection(), m_dirOverride || style->visuallyOrdered());
+    TextRun run(textRenderer()->text()->characters() + m_start, m_len, textRenderer()->allowTabs(), textPos(), m_expansion, expansionBehavior(), !isLeftToRightDirection(), m_dirOverride || style->visuallyOrdered());
     
     // Always compute and store the rect associated with this marker. The computed rect is in absolute coordinates.
     IntRect markerRect = enclosingIntRect(font.selectionRectForText(run, IntPoint(m_x, selectionTop()), selHeight, sPos, ePos));
@@ -1031,7 +1056,7 @@ void InlineTextBox::computeRectForReplacementMarker(const DocumentMarker& marker
     
     int sPos = max(marker.startOffset - m_start, (unsigned)0);
     int ePos = min(marker.endOffset - m_start, (unsigned)m_len);    
-    TextRun run(textRenderer()->text()->characters() + m_start, m_len, textRenderer()->allowTabs(), textPos(), m_expansion, trailingExpansionBehavior(), !isLeftToRightDirection(), m_dirOverride || style->visuallyOrdered());
+    TextRun run(textRenderer()->text()->characters() + m_start, m_len, textRenderer()->allowTabs(), textPos(), m_expansion, expansionBehavior(), !isLeftToRightDirection(), m_dirOverride || style->visuallyOrdered());
     IntPoint startPoint = IntPoint(m_x, y);
     
     // Compute and store the rect associated with this marker.
@@ -1192,7 +1217,7 @@ int InlineTextBox::offsetForPosition(float lineOffset, bool includePartialGlyphs
     RenderStyle* style = text->style(m_firstLine);
     const Font* f = &style->font();
     int offset = f->offsetForPosition(TextRun(textRenderer()->text()->characters() + m_start, m_len,
-        textRenderer()->allowTabs(), textPos(), m_expansion, trailingExpansionBehavior(), !isLeftToRightDirection(), m_dirOverride || style->visuallyOrdered()),
+        textRenderer()->allowTabs(), textPos(), m_expansion, expansionBehavior(), !isLeftToRightDirection(), m_dirOverride || style->visuallyOrdered()),
         lineOffset - logicalLeft(), includePartialGlyphs);
     if (blockIsInOppositeDirection && (!offset || offset == m_len))
         return !offset ? m_len : 0;
@@ -1212,7 +1237,7 @@ float InlineTextBox::positionForOffset(int offset) const
     int from = !isLeftToRightDirection() ? offset - m_start : 0;
     int to = !isLeftToRightDirection() ? m_len : offset - m_start;
     // FIXME: Do we need to add rightBearing here?
-    return f.selectionRectForText(TextRun(text->text()->characters() + m_start, m_len, textRenderer()->allowTabs(), textPos(), m_expansion, trailingExpansionBehavior(), !isLeftToRightDirection(), m_dirOverride),
+    return f.selectionRectForText(TextRun(text->text()->characters() + m_start, m_len, textRenderer()->allowTabs(), textPos(), m_expansion, expansionBehavior(), !isLeftToRightDirection(), m_dirOverride),
                                   IntPoint(logicalLeft(), 0), 0, from, to).maxX();
 }
 
diff --git a/Source/WebCore/rendering/InlineTextBox.h b/Source/WebCore/rendering/InlineTextBox.h
index d894b85..98a1b78 100644
--- a/Source/WebCore/rendering/InlineTextBox.h
+++ b/Source/WebCore/rendering/InlineTextBox.h
@@ -69,6 +69,10 @@ public:
 
     bool hasHyphen() const { return m_hasEllipsisBoxOrHyphen; }
     void setHasHyphen(bool hasHyphen) { m_hasEllipsisBoxOrHyphen = hasHyphen; }
+
+    bool canHaveLeadingExpansion() const { return m_hasSelectedChildrenOrCanHaveLeadingExpansion; }
+    void setCanHaveLeadingExpansion(bool canHaveLeadingExpansion) { m_hasSelectedChildrenOrCanHaveLeadingExpansion = canHaveLeadingExpansion; }
+
     static inline bool compareByStart(const InlineTextBox* first, const InlineTextBox* second) { return first->start() < second->start(); }
 
     virtual int baselinePosition(FontBaseline) const;
@@ -158,7 +162,11 @@ private:
     void paintTextMatchMarker(GraphicsContext*, const FloatPoint& boxOrigin, const DocumentMarker&, RenderStyle*, const Font&);
     void computeRectForReplacementMarker(const DocumentMarker&, RenderStyle*, const Font&);
 
-    TextRun::TrailingExpansionBehavior trailingExpansionBehavior() const { return m_expansion && nextLeafChild() ? TextRun::AllowTrailingExpansion : TextRun::ForbidTrailingExpansion; }
+    TextRun::ExpansionBehavior expansionBehavior() const
+    {
+        return (canHaveLeadingExpansion() ? TextRun::AllowLeadingExpansion : TextRun::ForbidLeadingExpansion)
+            | (m_expansion && nextLeafChild() ? TextRun::AllowTrailingExpansion : TextRun::ForbidTrailingExpansion);
+    }
 };
 
 inline RenderText* InlineTextBox::textRenderer() const
diff --git a/Source/WebCore/rendering/MediaControlElements.cpp b/Source/WebCore/rendering/MediaControlElements.cpp
index 32aac90..07df4d9 100644
--- a/Source/WebCore/rendering/MediaControlElements.cpp
+++ b/Source/WebCore/rendering/MediaControlElements.cpp
@@ -41,9 +41,11 @@
 #include "MediaControls.h"
 #include "MouseEvent.h"
 #include "Page.h"
+#include "RenderFlexibleBox.h"
 #include "RenderMedia.h"
 #include "RenderSlider.h"
 #include "RenderTheme.h"
+#include "RenderView.h"
 #include "Settings.h"
 
 namespace WebCore {
@@ -250,11 +252,41 @@ const AtomicString& MediaControlTimelineContainerElement::shadowPseudoId() const
 
 // ----------------------------
 
+class RenderMediaVolumeSliderContainer : public RenderBlock {
+public:
+    RenderMediaVolumeSliderContainer(Node*);
+
+private:
+    virtual void layout();
+};
+
+RenderMediaVolumeSliderContainer::RenderMediaVolumeSliderContainer(Node* node)
+    : RenderBlock(node)
+{
+}
+
+void RenderMediaVolumeSliderContainer::layout()
+{
+    RenderBlock::layout();
+    if (style()->display() == NONE || !previousSibling() || !previousSibling()->isBox())
+        return;
+
+    RenderBox* buttonBox = toRenderBox(previousSibling());
+
+    if (view())
+        view()->disableLayoutState();
+
+    IntPoint offset = theme()->volumeSliderOffsetFromMuteButton(buttonBox, IntSize(width(), height()));
+    setX(offset.x() + buttonBox->offsetLeft());
+    setY(offset.y() + buttonBox->offsetTop());
+
+    if (view())
+        view()->enableLayoutState();
+}
+
 inline MediaControlVolumeSliderContainerElement::MediaControlVolumeSliderContainerElement(HTMLMediaElement* mediaElement)
     : MediaControlElement(mediaElement)
     , m_isVisible(false)
-    , m_x(0)
-    , m_y(0)
 {
 }
 
@@ -263,12 +295,15 @@ PassRefPtr<MediaControlVolumeSliderContainerElement> MediaControlVolumeSliderCon
     return adoptRef(new MediaControlVolumeSliderContainerElement(mediaElement));
 }
 
+RenderObject* MediaControlVolumeSliderContainerElement::createRenderer(RenderArena* arena, RenderStyle*)
+{
+    return new (arena) RenderMediaVolumeSliderContainer(this);
+}
+
 PassRefPtr<RenderStyle> MediaControlVolumeSliderContainerElement::styleForElement()
 {
     RefPtr<RenderStyle> style = MediaControlElement::styleForElement();
     style->setPosition(AbsolutePosition);
-    style->setLeft(Length(m_x, Fixed));
-    style->setTop(Length(m_y, Fixed));
     style->setDisplay(m_isVisible ? BLOCK : NONE);
     return style;
 }
@@ -280,14 +315,6 @@ void MediaControlVolumeSliderContainerElement::setVisible(bool visible)
     m_isVisible = visible;
 }
 
-void MediaControlVolumeSliderContainerElement::setPosition(int x, int y)
-{
-    if (x == m_x && y == m_y)
-        return;
-    m_x = x;
-    m_y = y;
-}
-
 bool MediaControlVolumeSliderContainerElement::hitTest(const IntPoint& absPoint)
 {
     if (renderer() && renderer()->style()->hasAppearance())
@@ -776,6 +803,7 @@ PassRefPtr<MediaControlTimelineElement> MediaControlTimelineElement::create(HTML
 {
     RefPtr<MediaControlTimelineElement> timeline = adoptRef(new MediaControlTimelineElement(mediaElement));
     timeline->setType("range");
+    timeline->setAttribute(precisionAttr, "float");
     return timeline.release();
 }
 
@@ -841,6 +869,9 @@ PassRefPtr<MediaControlVolumeSliderElement> MediaControlVolumeSliderElement::cre
 {
     RefPtr<MediaControlVolumeSliderElement> slider = adoptRef(new MediaControlVolumeSliderElement(mediaElement));
     slider->setType("range");
+    slider->setAttribute(precisionAttr, "float");
+    slider->setAttribute(maxAttr, "1");
+    slider->setAttribute(valueAttr, String::number(mediaElement->volume()));
     return slider.release();
 }
 
@@ -882,6 +913,29 @@ const AtomicString& MediaControlVolumeSliderElement::shadowPseudoId() const
 
 // ----------------------------
 
+inline MediaControlFullscreenVolumeSliderElement::MediaControlFullscreenVolumeSliderElement(HTMLMediaElement* mediaElement)
+: MediaControlVolumeSliderElement(mediaElement)
+{
+}
+
+PassRefPtr<MediaControlFullscreenVolumeSliderElement> MediaControlFullscreenVolumeSliderElement::create(HTMLMediaElement* mediaElement)
+{
+    RefPtr<MediaControlFullscreenVolumeSliderElement> slider = adoptRef(new MediaControlFullscreenVolumeSliderElement(mediaElement));
+    slider->setType("range");
+    slider->setAttribute(precisionAttr, "float");
+    slider->setAttribute(maxAttr, "1");
+    slider->setAttribute(valueAttr, String::number(mediaElement->volume()));
+    return slider.release();
+}
+
+const AtomicString& MediaControlFullscreenVolumeSliderElement::shadowPseudoId() const
+{
+    DEFINE_STATIC_LOCAL(AtomicString, id, ("-webkit-media-controls-fullscreen-volume-slider"));
+    return id;
+}
+
+// ----------------------------
+
 inline MediaControlFullscreenButtonElement::MediaControlFullscreenButtonElement(HTMLMediaElement* mediaElement)
     : MediaControlInputElement(mediaElement, MediaFullscreenButton)
 {
@@ -924,36 +978,95 @@ const AtomicString& MediaControlFullscreenButtonElement::shadowPseudoId() const
 
 // ----------------------------
 
-inline MediaControlTimeDisplayElement::MediaControlTimeDisplayElement(HTMLMediaElement* mediaElement)
-    : MediaControlElement(mediaElement)
-    , m_currentValue(0)
-    , m_isVisible(true)
+inline MediaControlFullscreenVolumeMinButtonElement::MediaControlFullscreenVolumeMinButtonElement(HTMLMediaElement* mediaElement)
+: MediaControlInputElement(mediaElement, MediaUnMuteButton)
 {
 }
 
-PassRefPtr<RenderStyle> MediaControlTimeDisplayElement::styleForElement()
+PassRefPtr<MediaControlFullscreenVolumeMinButtonElement> MediaControlFullscreenVolumeMinButtonElement::create(HTMLMediaElement* mediaElement)
 {
-    RefPtr<RenderStyle> style = MediaControlElement::styleForElement();
-    if (!m_isVisible) {
-        style = RenderStyle::clone(style.get());
-        style->setWidth(Length(0, Fixed));
+    RefPtr<MediaControlFullscreenVolumeMinButtonElement> button = adoptRef(new MediaControlFullscreenVolumeMinButtonElement(mediaElement));
+    button->setType("button");
+    return button.release();
+}
+
+void MediaControlFullscreenVolumeMinButtonElement::defaultEventHandler(Event* event)
+{
+    if (event->type() == eventNames().clickEvent) {
+        ExceptionCode code = 0;
+        mediaElement()->setVolume(0, code);
+        event->setDefaultHandled();
     }
-    return style;
+    HTMLInputElement::defaultEventHandler(event);
 }
 
-void MediaControlTimeDisplayElement::setVisible(bool visible)
+const AtomicString& MediaControlFullscreenVolumeMinButtonElement::shadowPseudoId() const
 {
-    if (visible == m_isVisible)
-        return;
-    m_isVisible = visible;
+    DEFINE_STATIC_LOCAL(AtomicString, id, ("-webkit-media-controls-fullscreen-volume-min-button"));
+    return id;
+}
 
-    // This function is used during the RenderMedia::layout()
-    // call, where we cannot change the renderer at this time.
-    if (!renderer() || !renderer()->style())
-        return;
+// ----------------------------
 
-    RefPtr<RenderStyle> style = styleForElement();
-    renderer()->setStyle(style.get());
+inline MediaControlFullscreenVolumeMaxButtonElement::MediaControlFullscreenVolumeMaxButtonElement(HTMLMediaElement* mediaElement)
+: MediaControlInputElement(mediaElement, MediaMuteButton)
+{
+}
+
+PassRefPtr<MediaControlFullscreenVolumeMaxButtonElement> MediaControlFullscreenVolumeMaxButtonElement::create(HTMLMediaElement* mediaElement)
+{
+    RefPtr<MediaControlFullscreenVolumeMaxButtonElement> button = adoptRef(new MediaControlFullscreenVolumeMaxButtonElement(mediaElement));
+    button->setType("button");
+    return button.release();
+}
+
+void MediaControlFullscreenVolumeMaxButtonElement::defaultEventHandler(Event* event)
+{
+    if (event->type() == eventNames().clickEvent) {
+        ExceptionCode code = 0;
+        mediaElement()->setVolume(1, code);
+        event->setDefaultHandled();
+    }
+    HTMLInputElement::defaultEventHandler(event);
+}
+
+const AtomicString& MediaControlFullscreenVolumeMaxButtonElement::shadowPseudoId() const
+{
+    DEFINE_STATIC_LOCAL(AtomicString, id, ("-webkit-media-controls-fullscreen-volume-max-button"));
+    return id;
+}
+
+// ----------------------------
+
+class RenderMediaControlTimeDisplay : public RenderFlexibleBox {
+public:
+    RenderMediaControlTimeDisplay(Node*);
+
+private:
+    virtual void layout();
+};
+
+RenderMediaControlTimeDisplay::RenderMediaControlTimeDisplay(Node* node)
+    : RenderFlexibleBox(node)
+{
+}
+
+// We want the timeline slider to be at least 100 pixels wide.
+// FIXME: Eliminate hard-coded widths altogether.
+static const int minWidthToDisplayTimeDisplays = 45 + 100 + 45;
+
+void RenderMediaControlTimeDisplay::layout()
+{
+    RenderFlexibleBox::layout();
+    RenderBox* timelineContainerBox = parentBox();
+    if (timelineContainerBox && timelineContainerBox->width() < minWidthToDisplayTimeDisplays)
+        setWidth(0);
+}
+
+inline MediaControlTimeDisplayElement::MediaControlTimeDisplayElement(HTMLMediaElement* mediaElement)
+    : MediaControlElement(mediaElement)
+    , m_currentValue(0)
+{
 }
 
 void MediaControlTimeDisplayElement::setCurrentValue(float time)
@@ -961,6 +1074,11 @@ void MediaControlTimeDisplayElement::setCurrentValue(float time)
     m_currentValue = time;
 }
 
+RenderObject* MediaControlTimeDisplayElement::createRenderer(RenderArena* arena, RenderStyle*)
+{
+    return new (arena) RenderMediaControlTimeDisplay(this);
+}
+
 // ----------------------------
 
 PassRefPtr<MediaControlTimeRemainingDisplayElement> MediaControlTimeRemainingDisplayElement::create(HTMLMediaElement* mediaElement)
diff --git a/Source/WebCore/rendering/MediaControlElements.h b/Source/WebCore/rendering/MediaControlElements.h
index 44e8811..77116e3 100644
--- a/Source/WebCore/rendering/MediaControlElements.h
+++ b/Source/WebCore/rendering/MediaControlElements.h
@@ -142,16 +142,16 @@ public:
     virtual PassRefPtr<RenderStyle> styleForElement();
     void setVisible(bool);
     bool isVisible() { return m_isVisible; }
-    void setPosition(int x, int y);
     bool hitTest(const IntPoint& absPoint);
 
 private:
     MediaControlVolumeSliderContainerElement(HTMLMediaElement*);
+
+    virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
     virtual MediaControlElementType displayType() const;
     virtual const AtomicString& shadowPseudoId() const;
 
     bool m_isVisible;
-    int m_x, m_y;
 };
 
 // ----------------------------
@@ -372,9 +372,10 @@ public:
     virtual void defaultEventHandler(Event*);
     void update();
 
-private:
+protected:
     MediaControlVolumeSliderElement(HTMLMediaElement*);
 
+private:
     virtual const AtomicString& shadowPseudoId() const;
 };
 
@@ -394,10 +395,48 @@ private:
 
 // ----------------------------
 
-class MediaControlTimeDisplayElement : public MediaControlElement {
+class MediaControlFullscreenVolumeSliderElement : public MediaControlVolumeSliderElement {
 public:
-    void setVisible(bool);
+    static PassRefPtr<MediaControlFullscreenVolumeSliderElement> create(HTMLMediaElement*);
+    
+private:
+    MediaControlFullscreenVolumeSliderElement(HTMLMediaElement*);
+    
+    virtual const AtomicString& shadowPseudoId() const;
+};
+
+// ----------------------------
+
+class MediaControlFullscreenVolumeMinButtonElement : public MediaControlInputElement {
+public:
+    static PassRefPtr<MediaControlFullscreenVolumeMinButtonElement> create(HTMLMediaElement*);
+    
+    virtual void defaultEventHandler(Event*);
+    
+private:
+    MediaControlFullscreenVolumeMinButtonElement(HTMLMediaElement*);
+    
+    virtual const AtomicString& shadowPseudoId() const;
+};
+
+// ----------------------------
+
+class MediaControlFullscreenVolumeMaxButtonElement : public MediaControlInputElement {
+public:
+    static PassRefPtr<MediaControlFullscreenVolumeMaxButtonElement> create(HTMLMediaElement*);
+    
+    virtual void defaultEventHandler(Event*);
+    
+private:
+    MediaControlFullscreenVolumeMaxButtonElement(HTMLMediaElement*);
+    
+    virtual const AtomicString& shadowPseudoId() const;
+};
+
+// ----------------------------
 
+class MediaControlTimeDisplayElement : public MediaControlElement {
+public:
     void setCurrentValue(float);
     float currentValue() const { return m_currentValue; }
 
@@ -405,9 +444,9 @@ protected:
     MediaControlTimeDisplayElement(HTMLMediaElement*);
 
 private:
-    virtual PassRefPtr<RenderStyle> styleForElement();
+    virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
+
     float m_currentValue;
-    bool m_isVisible;
 };
 
 // ----------------------------
diff --git a/Source/WebCore/rendering/RenderBlock.cpp b/Source/WebCore/rendering/RenderBlock.cpp
index 7488ff5..919e23b 100644
--- a/Source/WebCore/rendering/RenderBlock.cpp
+++ b/Source/WebCore/rendering/RenderBlock.cpp
@@ -34,6 +34,7 @@
 #include "HTMLFormElement.h"
 #include "HTMLNames.h"
 #include "HitTestResult.h"
+#include "InlineIterator.h"
 #include "InlineTextBox.h"
 #include "PaintInfo.h"
 #include "RenderCombineText.h"
@@ -51,6 +52,7 @@
 #include "Settings.h"
 #include "TextRun.h"
 #include "TransformState.h"
+#include "visible_units.h"
 #include <wtf/StdLibExtras.h>
 
 #ifdef ANDROID_LAYOUT
@@ -243,8 +245,7 @@ void RenderBlock::styleDidChange(StyleDifference diff, const RenderStyle* oldSty
     // FIXME: We could save this call when the change only affected non-inherited properties
     for (RenderObject* child = firstChild(); child; child = child->nextSibling()) {
         if (child->isAnonymousBlock()) {
-            RefPtr<RenderStyle> newStyle = RenderStyle::create();
-            newStyle->inheritFrom(style());
+            RefPtr<RenderStyle> newStyle = RenderStyle::createAnonymousStyle(style());
             if (style()->specifiesColumns()) {
                 if (child->style()->specifiesColumns())
                     newStyle->inheritColumnPropertiesFrom(style());
@@ -937,6 +938,9 @@ static bool canMergeContiguousAnonymousBlocks(RenderObject* oldChild, RenderObje
     if (oldChild->documentBeingDestroyed() || oldChild->isInline() || oldChild->virtualContinuation())
         return false;
 
+    if (oldChild->parent() && oldChild->parent()->isDetails())
+        return false;
+
     if ((prev && (!prev->isAnonymousBlock() || toRenderBlock(prev)->continuation() || toRenderBlock(prev)->beingDestroyed()))
         || (next && (!next->isAnonymousBlock() || toRenderBlock(next)->continuation() || toRenderBlock(next)->beingDestroyed())))
         return false;
@@ -979,8 +983,7 @@ void RenderBlock::removeChild(RenderObject* oldChild)
             // to clear out inherited column properties by just making a new style, and to also clear the
             // column span flag if it is set.
             ASSERT(!inlineChildrenBlock->continuation());
-            RefPtr<RenderStyle> newStyle = RenderStyle::create();
-            newStyle->inheritFrom(style());
+            RefPtr<RenderStyle> newStyle = RenderStyle::createAnonymousStyle(style());
             children()->removeChildNode(this, inlineChildrenBlock, inlineChildrenBlock->hasLayer());
             inlineChildrenBlock->setStyle(newStyle);
             
@@ -1136,7 +1139,7 @@ void RenderBlock::layoutBlock(bool relayoutChildren, int pageLogicalHeight)
     if (isInline() && !isInlineBlockOrInlineTable()) // Inline <form>s inside various table elements can
         return;                                      // cause us to come in here.  Just bail.
 
-    if (!relayoutChildren && layoutOnlyPositionedObjects())
+    if (!relayoutChildren && simplifiedLayout())
         return;
 
     LayoutRepainter repainter(*this, m_everHadLayout && checkForRepaintDuringLayout());
@@ -1292,7 +1295,7 @@ void RenderBlock::layoutBlock(bool relayoutChildren, int pageLogicalHeight)
         }
         
         IntRect repaintRect;
-        if (style()->isHorizontalWritingMode())
+        if (isHorizontalWritingMode())
             repaintRect = IntRect(repaintLogicalLeft, repaintLogicalTop, repaintLogicalRight - repaintLogicalLeft, repaintLogicalBottom - repaintLogicalTop);
         else
             repaintRect = IntRect(repaintLogicalTop, repaintLogicalLeft, repaintLogicalBottom - repaintLogicalTop, repaintLogicalRight - repaintLogicalLeft);
@@ -1331,17 +1334,21 @@ void RenderBlock::addOverflowFromChildren()
         ColumnInfo* colInfo = columnInfo();
         if (columnCount(colInfo)) {
             IntRect lastRect = columnRectAt(colInfo, columnCount(colInfo) - 1);
-            if (style()->isHorizontalWritingMode()) {
+            if (isHorizontalWritingMode()) {
                 int overflowLeft = !style()->isLeftToRightDirection() ? min(0, lastRect.x()) : 0;
                 int overflowRight = style()->isLeftToRightDirection() ? max(width(), lastRect.maxX()) : 0;
                 int overflowHeight = borderBefore() + paddingBefore() + colInfo->columnHeight();
                 addLayoutOverflow(IntRect(overflowLeft, 0, overflowRight - overflowLeft, overflowHeight));
+                if (!hasOverflowClip())
+                    addVisualOverflow(IntRect(overflowLeft, 0, overflowRight - overflowLeft, overflowHeight));
             } else {
                 IntRect lastRect = columnRectAt(colInfo, columnCount(colInfo) - 1);
                 int overflowTop = !style()->isLeftToRightDirection() ? min(0, lastRect.y()) : 0;
                 int overflowBottom = style()->isLeftToRightDirection() ? max(height(), lastRect.maxY()) : 0;
                 int overflowWidth = borderBefore() + paddingBefore() + colInfo->columnHeight();
                 addLayoutOverflow(IntRect(0, overflowTop, overflowWidth, overflowBottom - overflowTop));
+                if (!hasOverflowClip())
+                    addVisualOverflow(IntRect(0, overflowTop, overflowWidth, overflowBottom - overflowTop));
             }
         }
     }
@@ -1364,7 +1371,7 @@ void RenderBlock::computeOverflow(int oldClientAfterEdge, bool recomputeFloats)
         // be considered reachable.
         IntRect clientRect(clientBoxRect());
         IntRect rectToApply;
-        if (style()->isHorizontalWritingMode())
+        if (isHorizontalWritingMode())
             rectToApply = IntRect(clientRect.x(), clientRect.y(), 1, max(0, oldClientAfterEdge - clientRect.y()));
         else
             rectToApply = IntRect(clientRect.x(), clientRect.y(), max(0, oldClientAfterEdge - clientRect.x()), 1);
@@ -1422,34 +1429,31 @@ bool RenderBlock::expandsToEncloseOverhangingFloats() const
 
 void RenderBlock::adjustPositionedBlock(RenderBox* child, const MarginInfo& marginInfo)
 {
-    bool isHorizontal = style()->isHorizontalWritingMode();
-    bool hasStaticInlinePosition = child->style()->hasStaticInlinePosition(isHorizontal);
+    bool isHorizontal = isHorizontalWritingMode();
     bool hasStaticBlockPosition = child->style()->hasStaticBlockPosition(isHorizontal);
     RenderLayer* childLayer = child->layer();
         
-    if (hasStaticInlinePosition)
-        childLayer->setStaticInlinePosition(borderAndPaddingStart());
-
-    if (hasStaticBlockPosition) {
-        int logicalTop = logicalHeight();
-        if (!marginInfo.canCollapseWithMarginBefore()) {
-            child->computeBlockDirectionMargins(this);
-            int marginBefore = marginBeforeForChild(child);
-            int collapsedBeforePos = marginInfo.positiveMargin();
-            int collapsedBeforeNeg = marginInfo.negativeMargin();
-            if (marginBefore > 0) {
-                if (marginBefore > collapsedBeforePos)
-                    collapsedBeforePos = marginBefore;
-            } else {
-                if (-marginBefore > collapsedBeforeNeg)
-                    collapsedBeforeNeg = -marginBefore;
-            }
-            logicalTop += (collapsedBeforePos - collapsedBeforeNeg) - marginBefore;
+    childLayer->setStaticInlinePosition(borderAndPaddingStart());
+
+    int logicalTop = logicalHeight();
+    if (!marginInfo.canCollapseWithMarginBefore()) {
+        child->computeBlockDirectionMargins(this);
+        int marginBefore = marginBeforeForChild(child);
+        int collapsedBeforePos = marginInfo.positiveMargin();
+        int collapsedBeforeNeg = marginInfo.negativeMargin();
+        if (marginBefore > 0) {
+            if (marginBefore > collapsedBeforePos)
+                collapsedBeforePos = marginBefore;
+        } else {
+            if (-marginBefore > collapsedBeforeNeg)
+                collapsedBeforeNeg = -marginBefore;
         }
-        if (childLayer->staticBlockPosition() != logicalTop) {
-            childLayer->setStaticBlockPosition(logicalTop);
+        logicalTop += (collapsedBeforePos - collapsedBeforeNeg) - marginBefore;
+    }
+    if (childLayer->staticBlockPosition() != logicalTop) {
+        childLayer->setStaticBlockPosition(logicalTop);
+        if (hasStaticBlockPosition)
             child->setChildNeedsLayout(true, false);
-        }
     }
 }
 
@@ -1818,7 +1822,7 @@ void RenderBlock::handleAfterSideOfBlock(int beforeSide, int afterSide, MarginIn
 
 void RenderBlock::setLogicalLeftForChild(RenderBox* child, int logicalLeft, ApplyLayoutDeltaMode applyDelta)
 {
-    if (style()->isHorizontalWritingMode()) {
+    if (isHorizontalWritingMode()) {
         if (applyDelta == ApplyLayoutDelta)
             view()->addLayoutDelta(IntSize(child->x() - logicalLeft, 0));
         child->setX(logicalLeft);
@@ -1831,7 +1835,7 @@ void RenderBlock::setLogicalLeftForChild(RenderBox* child, int logicalLeft, Appl
 
 void RenderBlock::setLogicalTopForChild(RenderBox* child, int logicalTop, ApplyLayoutDeltaMode applyDelta)
 {
-    if (style()->isHorizontalWritingMode()) {
+    if (isHorizontalWritingMode()) {
         if (applyDelta == ApplyLayoutDelta)
             view()->addLayoutDelta(IntSize(0, child->y() - logicalTop));
         child->setY(logicalTop);
@@ -2080,21 +2084,58 @@ void RenderBlock::layoutBlockChild(RenderBox* child, MarginInfo& marginInfo, int
     ASSERT(oldLayoutDelta == view()->layoutDelta());
 }
 
-bool RenderBlock::layoutOnlyPositionedObjects()
+void RenderBlock::simplifiedNormalFlowLayout()
 {
-    if (!posChildNeedsLayout() || normalChildNeedsLayout() || selfNeedsLayout())
+    if (childrenInline()) {
+        ListHashSet<RootInlineBox*> lineBoxes;
+        bool endOfInline = false;
+        RenderObject* o = bidiFirst(this, 0, false);
+        while (o) {
+            if (!o->isPositioned() && (o->isReplaced() || o->isFloating())) {
+                o->layoutIfNeeded();
+                if (toRenderBox(o)->inlineBoxWrapper()) {
+                    RootInlineBox* box = toRenderBox(o)->inlineBoxWrapper()->root();
+                    lineBoxes.add(box);
+                }
+            } else if (o->isText() || (o->isRenderInline() && !endOfInline))
+                o->setNeedsLayout(false);
+            o = bidiNext(this, o, 0, false, &endOfInline);
+        }
+
+        // FIXME: Glyph overflow will get lost in this case, but not really a big deal.
+        GlyphOverflowAndFallbackFontsMap textBoxDataMap;                  
+        for (ListHashSet<RootInlineBox*>::const_iterator it = lineBoxes.begin(); it != lineBoxes.end(); ++it) {
+            RootInlineBox* box = *it;
+            box->computeOverflow(box->lineTop(), box->lineBottom(), document()->inNoQuirksMode(), textBoxDataMap);
+        }
+    } else {
+        for (RenderBox* box = firstChildBox(); box; box = box->nextSiblingBox()) {
+            if (!box->isPositioned())
+                box->layoutIfNeeded();
+        }
+    }
+}
+
+bool RenderBlock::simplifiedLayout()
+{
+    if ((!posChildNeedsLayout() && !needsSimplifiedNormalFlowLayout()) || normalChildNeedsLayout() || selfNeedsLayout())
         return false;
 
     LayoutStateMaintainer statePusher(view(), this, IntSize(x(), y()), hasColumns() || hasTransform() || hasReflection() || style()->isFlippedBlocksWritingMode());
-
+    
     if (needsPositionedMovementLayout()) {
         tryLayoutDoingPositionedMovementOnly();
         if (needsLayout())
             return false;
     }
 
-    // All we have to is lay out our positioned objects.
-    layoutPositionedObjects(false);
+    // Lay out positioned descendants or objects that just need to recompute overflow.
+    if (needsSimplifiedNormalFlowLayout())
+        simplifiedNormalFlowLayout();
+
+    // Lay out our positioned objects if our positioned child bit is set.
+    if (posChildNeedsLayout())
+        layoutPositionedObjects(false);
 
     // Recompute our overflow information.
     // FIXME: We could do better here by computing a temporary overflow object from layoutPositionedObjects and only
@@ -2137,7 +2178,7 @@ void RenderBlock::layoutPositionedObjects(bool relayoutChildren)
         // non-positioned block.  Rather than trying to detect all of these movement cases, we just always lay out positioned
         // objects that are positioned implicitly like this.  Such objects are rare, and so in typical DHTML menu usage (where everything is
         // positioned explicitly) this should not incur a performance penalty.
-        if (relayoutChildren || (r->style()->hasStaticBlockPosition(style()->isHorizontalWritingMode()) && r->parent() != this && r->parent()->isBlockFlow()))
+        if (relayoutChildren || (r->style()->hasStaticBlockPosition(isHorizontalWritingMode()) && r->parent() != this && r->parent()->isBlockFlow()))
             r->setChildNeedsLayout(true, false);
             
         // If relayoutChildren is set and we have percentage padding, we also need to invalidate the child's pref widths.
@@ -2221,6 +2262,7 @@ void RenderBlock::paint(PaintInfo& paintInfo, int tx, int ty)
     // paints the root's background.
     if (!isRoot()) {
         IntRect overflowBox = visualOverflowRect();
+        flipForWritingMode(overflowBox);
         overflowBox.inflate(maximalOutlineSize(paintInfo.phase));
         overflowBox.move(tx, ty);
         if (!overflowBox.intersects(paintInfo.rect))
@@ -2259,7 +2301,7 @@ void RenderBlock::paintColumnRules(PaintInfo& paintInfo, int tx, int ty)
     for (unsigned i = 0; i < colCount; i++) {
         IntRect colRect = columnRectAt(colInfo, i);
 
-        int inlineDirectionSize = style()->isHorizontalWritingMode() ? colRect.width() : colRect.height();
+        int inlineDirectionSize = isHorizontalWritingMode() ? colRect.width() : colRect.height();
         
         // Move to the next position.
         if (style()->isLeftToRightDirection()) {
@@ -2272,10 +2314,10 @@ void RenderBlock::paintColumnRules(PaintInfo& paintInfo, int tx, int ty)
        
         // Now paint the column rule.
         if (i < colCount - 1) {
-            int ruleLeft = style()->isHorizontalWritingMode() ? tx + ruleLogicalLeft - ruleWidth / 2 + ruleAdd : tx + borderBefore() + paddingBefore();
-            int ruleRight = style()->isHorizontalWritingMode() ? ruleLeft + ruleWidth : ruleLeft + contentWidth();
-            int ruleTop = style()->isHorizontalWritingMode() ? ty + borderTop() + paddingTop() : ty + ruleLogicalLeft - ruleWidth / 2 + ruleAdd;
-            int ruleBottom = style()->isHorizontalWritingMode() ? ruleTop + contentHeight() : ruleTop + ruleWidth;
+            int ruleLeft = isHorizontalWritingMode() ? tx + ruleLogicalLeft - ruleWidth / 2 + ruleAdd : tx + borderBefore() + paddingBefore();
+            int ruleRight = isHorizontalWritingMode() ? ruleLeft + ruleWidth : ruleLeft + contentWidth();
+            int ruleTop = isHorizontalWritingMode() ? ty + borderTop() + paddingTop() : ty + ruleLogicalLeft - ruleWidth / 2 + ruleAdd;
+            int ruleBottom = isHorizontalWritingMode() ? ruleTop + contentHeight() : ruleTop + ruleWidth;
             drawLineForBoxSide(paintInfo.context, ruleLeft, ruleTop, ruleRight, ruleBottom,
                                style()->isLeftToRightDirection() ? BSLeft : BSRight, ruleColor, ruleStyle, 0, 0);
         }
@@ -2297,8 +2339,8 @@ void RenderBlock::paintColumnContents(PaintInfo& paintInfo, int tx, int ty, bool
         // For each rect, we clip to the rect, and then we adjust our coords.
         IntRect colRect = columnRectAt(colInfo, i);
         flipForWritingMode(colRect);
-        int logicalLeftOffset = (style()->isHorizontalWritingMode() ? colRect.x() : colRect.y()) - logicalLeftOffsetForContent();
-        IntSize offset = style()->isHorizontalWritingMode() ? IntSize(logicalLeftOffset, currLogicalTopOffset) : IntSize(currLogicalTopOffset, logicalLeftOffset);
+        int logicalLeftOffset = (isHorizontalWritingMode() ? colRect.x() : colRect.y()) - logicalLeftOffsetForContent();
+        IntSize offset = isHorizontalWritingMode() ? IntSize(logicalLeftOffset, currLogicalTopOffset) : IntSize(currLogicalTopOffset, logicalLeftOffset);
         colRect.move(tx, ty);
         PaintInfo info(paintInfo);
         info.rect.intersect(colRect);
@@ -2321,7 +2363,7 @@ void RenderBlock::paintColumnContents(PaintInfo& paintInfo, int tx, int ty, bool
             context->restore();
         }
 
-        int blockDelta = (style()->isHorizontalWritingMode() ? colRect.height() : colRect.width());
+        int blockDelta = (isHorizontalWritingMode() ? colRect.height() : colRect.width());
         if (style()->isFlippedBlocksWritingMode())
             currLogicalTopOffset += blockDelta;
         else
@@ -2510,7 +2552,7 @@ IntPoint RenderBlock::flipFloatForWritingMode(const FloatingObject* child, const
     // This is similar to the ParentToChildFlippingAdjustment in RenderBox::flipForWritingMode.  We have to subtract out our left/top offsets twice, since
     // it's going to get added back in.  We hide this complication here so that the calling code looks normal for the unflipped
     // case.
-    if (style()->isHorizontalWritingMode())
+    if (isHorizontalWritingMode())
         return IntPoint(point.x(), point.y() + height() - child->renderer()->height() - 2 * yPositionForFloatIncludingMargin(child));
     return IntPoint(point.x() + width() - child->width() - 2 * xPositionForFloatIncludingMargin(child), point.y());
 }
@@ -2738,18 +2780,18 @@ static void clipOutPositionedObjects(const PaintInfo* paintInfo, const IntPoint&
 
 static int blockDirectionOffset(RenderBlock* rootBlock, const IntSize& offsetFromRootBlock)
 {
-    return rootBlock->style()->isHorizontalWritingMode() ? offsetFromRootBlock.height() : offsetFromRootBlock.width();
+    return rootBlock->isHorizontalWritingMode() ? offsetFromRootBlock.height() : offsetFromRootBlock.width();
 }
 
 static int inlineDirectionOffset(RenderBlock* rootBlock, const IntSize& offsetFromRootBlock)
 {
-    return rootBlock->style()->isHorizontalWritingMode() ? offsetFromRootBlock.width() : offsetFromRootBlock.height();
+    return rootBlock->isHorizontalWritingMode() ? offsetFromRootBlock.width() : offsetFromRootBlock.height();
 }
 
 IntRect RenderBlock::logicalRectToPhysicalRect(const IntPoint& rootBlockPhysicalPosition, const IntRect& logicalRect)
 {
     IntRect result;
-    if (style()->isHorizontalWritingMode())
+    if (isHorizontalWritingMode())
         result = logicalRect;
     else
         result = IntRect(logicalRect.y(), logicalRect.x(), logicalRect.height(), logicalRect.width());
@@ -2846,10 +2888,10 @@ GapRects RenderBlock::inlineSelectionGaps(RenderBlock* rootBlock, const IntPoint
                                                  selTop, paintInfo));
         
         IntRect logicalRect(curr->logicalLeft(), selTop, curr->logicalWidth(), selTop + selHeight);
-        logicalRect.move(style()->isHorizontalWritingMode() ? offsetFromRootBlock : IntSize(offsetFromRootBlock.height(), offsetFromRootBlock.width()));
+        logicalRect.move(isHorizontalWritingMode() ? offsetFromRootBlock : IntSize(offsetFromRootBlock.height(), offsetFromRootBlock.width()));
         IntRect physicalRect = rootBlock->logicalRectToPhysicalRect(rootBlockPhysicalPosition, logicalRect);
-        if (!paintInfo || (style()->isHorizontalWritingMode() && physicalRect.y() < paintInfo->rect.maxY() && physicalRect.maxY() > paintInfo->rect.y())
-            || (!style()->isHorizontalWritingMode() && physicalRect.x() < paintInfo->rect.maxX() && physicalRect.maxX() > paintInfo->rect.x()))
+        if (!paintInfo || (isHorizontalWritingMode() && physicalRect.y() < paintInfo->rect.maxY() && physicalRect.maxY() > paintInfo->rect.y())
+            || (!isHorizontalWritingMode() && physicalRect.x() < paintInfo->rect.maxX() && physicalRect.maxX() > paintInfo->rect.x()))
             result.unite(curr->lineSelectionGap(rootBlock, rootBlockPhysicalPosition, offsetFromRootBlock, selTop, selHeight, paintInfo));
 
         lastSelectedLine = curr;
@@ -3294,12 +3336,23 @@ bool RenderBlock::positionNewFloats()
     return true;
 }
 
-bool RenderBlock::positionNewFloatOnLine(FloatingObject* newFloat, FloatingObject* lastFloatFromPreviousLine)
+bool RenderBlock::positionNewFloatOnLine(FloatingObject* newFloat, FloatingObject* lastFloatFromPreviousLine, bool firstLine, int& lineLeftOffset, int& lineRightOffset)
 {
     bool didPosition = positionNewFloats();
-    if (!didPosition || !newFloat->m_paginationStrut)
+    if (!didPosition)
         return didPosition;
+
+    int blockOffset = logicalHeight();
+    if (blockOffset >= logicalTopForFloat(newFloat) && blockOffset < logicalBottomForFloat(newFloat)) {
+        if (newFloat->type() == FloatingObject::FloatLeft)
+            lineLeftOffset = logicalRightForFloat(newFloat);
+        else
+            lineRightOffset = logicalLeftForFloat(newFloat);
+    }
     
+    if (!newFloat->m_paginationStrut)
+        return didPosition;
+     
     FloatingObjectSet& floatingObjectSet = m_floatingObjects->set();
     ASSERT(floatingObjectSet.last() == newFloat);
 
@@ -3329,8 +3382,10 @@ bool RenderBlock::positionNewFloatOnLine(FloatingObject* newFloat, FloatingObjec
         }
     }
         
-    setLogicalHeight(logicalHeight() + paginationStrut);
-    
+    setLogicalHeight(blockOffset + paginationStrut);
+    lineLeftOffset = logicalLeftOffsetForLine(logicalHeight(), firstLine);
+    lineRightOffset = logicalRightOffsetForLine(logicalHeight(), firstLine);
+
     return didPosition;
 }
 
@@ -3416,6 +3471,11 @@ HashSet<RenderBox*>* RenderBlock::percentHeightDescendants() const
     return gPercentHeightDescendantsMap ? gPercentHeightDescendantsMap->get(this) : 0;
 }
 
+// FIXME: The logicalLeftOffsetForLine/logicalRightOffsetForLine functions are very slow if there are many floats
+// present. We need to add a structure to floating objects to represent "lines" of floats.  Then instead of checking
+// each float individually, we'd just walk backwards through the "lines" and stop when we hit a line that is fully above
+// the vertical offset that we'd like to check.  Computing the "lines" would be rather complicated, but could replace the left
+// objects and right objects count hack that is currently used here.
 int RenderBlock::logicalLeftOffsetForLine(int logicalTop, int fixedOffset, bool applyTextIndent, int* heightRemaining) const
 {
     int left = fixedOffset;
@@ -3423,18 +3483,23 @@ int RenderBlock::logicalLeftOffsetForLine(int logicalTop, int fixedOffset, bool
         if (heightRemaining)
             *heightRemaining = 1;
 
+        // We know the list is non-empty, since we have "left" objects to search for.
+        // Therefore we can assume that begin != end, and that we can do at least one
+        // decrement.
         FloatingObjectSet& floatingObjectSet = m_floatingObjects->set();
-        FloatingObjectSetIterator end = floatingObjectSet.end();
-        for (FloatingObjectSetIterator it = floatingObjectSet.begin(); it != end; ++it) {
+        FloatingObjectSetIterator begin = floatingObjectSet.begin();
+        FloatingObjectSetIterator it = floatingObjectSet.end();
+        do {
+            --it;
             FloatingObject* r = *it;
             if (r->isPlaced() && logicalTopForFloat(r) <= logicalTop && logicalBottomForFloat(r) > logicalTop
                 && r->type() == FloatingObject::FloatLeft
                 && logicalRightForFloat(r) > left) {
-                left = logicalRightForFloat(r);
+                left = max(left, logicalRightForFloat(r));
                 if (heightRemaining)
                     *heightRemaining = logicalBottomForFloat(r) - logicalTop;
             }
-        }
+        } while (it != begin);
     }
 
     if (applyTextIndent && style()->isLeftToRightDirection()) {
@@ -3454,18 +3519,24 @@ int RenderBlock::logicalRightOffsetForLine(int logicalTop, int fixedOffset, bool
     if (m_floatingObjects && m_floatingObjects->hasRightObjects()) {
         if (heightRemaining)
             *heightRemaining = 1;
+            
+        // We know the list is non-empty, since we have "right" objects to search for.
+        // Therefore we can assume that begin != end, and that we can do at least one
+        // decrement.
         FloatingObjectSet& floatingObjectSet = m_floatingObjects->set();
-        FloatingObjectSetIterator end = floatingObjectSet.end();
-        for (FloatingObjectSetIterator it = floatingObjectSet.begin(); it != end; ++it) {
+        FloatingObjectSetIterator begin = floatingObjectSet.begin();
+        FloatingObjectSetIterator it = floatingObjectSet.end();
+        do {
+            --it;
             FloatingObject* r = *it;
             if (r->isPlaced() && logicalTopForFloat(r) <= logicalTop && logicalBottomForFloat(r) > logicalTop
                 && r->type() == FloatingObject::FloatRight
                 && logicalLeftForFloat(r) < right) {
-                right = logicalLeftForFloat(r);
+                right = min(right, logicalLeftForFloat(r));
                 if (heightRemaining)
                     *heightRemaining = logicalBottomForFloat(r) - logicalTop;
             }
-        }
+        } while (it != begin);
     }
     
     if (applyTextIndent && !style()->isLeftToRightDirection()) {
@@ -3663,8 +3734,8 @@ int RenderBlock::addOverhangingFloats(RenderBlock* child, int logicalLeftOffset,
         if (logicalBottom > logicalHeight()) {
             // If the object is not in the list, we add it now.
             if (!containsFloat(r->m_renderer)) {
-                int leftOffset = style()->isHorizontalWritingMode() ? logicalLeftOffset : logicalTopOffset;
-                int topOffset = style()->isHorizontalWritingMode() ? logicalTopOffset : logicalLeftOffset;
+                int leftOffset = isHorizontalWritingMode() ? logicalLeftOffset : logicalTopOffset;
+                int topOffset = isHorizontalWritingMode() ? logicalTopOffset : logicalLeftOffset;
                 FloatingObject* floatingObj = new FloatingObject(r->type(), IntRect(r->x() - leftOffset, r->y() - topOffset, r->width(), r->height()));
                 floatingObj->m_renderer = r->m_renderer;
 
@@ -3712,7 +3783,7 @@ void RenderBlock::addIntrudingFloats(RenderBlock* prev, int logicalLeftOffset, i
     if (!prev->m_floatingObjects)
         return;
 
-    logicalLeftOffset += (style()->isHorizontalWritingMode() ? marginLeft() : marginTop());
+    logicalLeftOffset += (isHorizontalWritingMode() ? marginLeft() : marginTop());
 
     FloatingObjectSet& prevSet = prev->m_floatingObjects->set();
     FloatingObjectSetIterator prevEnd = prevSet.end();
@@ -3720,8 +3791,8 @@ void RenderBlock::addIntrudingFloats(RenderBlock* prev, int logicalLeftOffset, i
         FloatingObject* r = *prevIt;
         if (logicalBottomForFloat(r) > logicalTopOffset) {
             if (!m_floatingObjects || !m_floatingObjects->set().contains(r)) {
-                int leftOffset = style()->isHorizontalWritingMode() ? logicalLeftOffset : logicalTopOffset;
-                int topOffset = style()->isHorizontalWritingMode() ? logicalTopOffset : logicalLeftOffset;
+                int leftOffset = isHorizontalWritingMode() ? logicalLeftOffset : logicalTopOffset;
+                int topOffset = isHorizontalWritingMode() ? logicalTopOffset : logicalLeftOffset;
                 
                 FloatingObject* floatingObj = new FloatingObject(r->type(), IntRect(r->x() - leftOffset, r->y() - topOffset, r->width(), r->height()));
 
@@ -3731,7 +3802,7 @@ void RenderBlock::addIntrudingFloats(RenderBlock* prev, int logicalLeftOffset, i
                 // into account.  Only apply this code if prev is the parent, since otherwise the left margin
                 // will get applied twice.
                 if (prev != parent()) {
-                    if (style()->isHorizontalWritingMode())
+                    if (isHorizontalWritingMode())
                         floatingObj->setX(floatingObj->x() + prev->marginLeft());
                     else
                         floatingObj->setY(floatingObj->y() + prev->marginTop());
@@ -3868,7 +3939,7 @@ bool RenderBlock::nodeAtPoint(const HitTestRequest& request, HitTestResult& resu
     bool useOverflowClip = hasOverflowClip() && !hasSelfPaintingLayer();
     bool useClip = (hasControlClip() || useOverflowClip);
     IntRect hitTestArea(result.rectForPoint(_x, _y));
-    bool checkChildren = !useClip || (hasControlClip() ? controlClipRect(tx, ty).intersects(hitTestArea) : overflowClipRect(tx, ty).intersects(hitTestArea));
+    bool checkChildren = !useClip || (hasControlClip() ? controlClipRect(tx, ty).intersects(hitTestArea) : overflowClipRect(tx, ty, IncludeOverlayScrollbarSize).intersects(hitTestArea));
     if (checkChildren) {
         // Hit test descendants first.
         int scrolledX = tx;
@@ -3945,7 +4016,7 @@ bool RenderBlock::hitTestColumns(const HitTestRequest& request, HitTestResult& r
     int logicalLeft = logicalLeftOffsetForContent();
     int currLogicalTopOffset = 0;
     int i;
-    bool isHorizontal = style()->isHorizontalWritingMode();
+    bool isHorizontal = isHorizontalWritingMode();
     for (i = 0; i < colCount; i++) {
         IntRect colRect = columnRectAt(colInfo, i);
         int blockDelta =  (isHorizontal ? colRect.height() : colRect.width());
@@ -4038,12 +4109,12 @@ static VisiblePosition positionForPointRespectingEditingBoundaries(RenderBlock*
         ancestor = ancestor->parent();
 
     // If we can't find an ancestor to check editability on, or editability is unchanged, we recur like normal
-    if (!ancestor || ancestor->node()->isContentEditable() == childNode->isContentEditable())
+    if (!ancestor || ancestor->node()->rendererIsEditable() == childNode->rendererIsEditable())
         return child->positionForPoint(pointInChildCoordinates);
 
     // Otherwise return before or after the child, depending on if the click was to the logical left or logical right of the child
     int childMiddle = parent->logicalWidthForChild(child) / 2;
-    int logicalLeft = parent->style()->isHorizontalWritingMode() ? pointInChildCoordinates.x() : pointInChildCoordinates.y();
+    int logicalLeft = parent->isHorizontalWritingMode() ? pointInChildCoordinates.x() : pointInChildCoordinates.y();
     if (logicalLeft < childMiddle)
         return ancestor->createVisiblePosition(childNode->nodeIndex(), DOWNSTREAM);
     return ancestor->createVisiblePosition(childNode->nodeIndex() + 1, UPSTREAM);
@@ -4090,7 +4161,7 @@ VisiblePosition RenderBlock::positionForPointWithInlineChildren(const IntPoint&
 
         // pass the box a top position that is inside it
         IntPoint point(pointInLogicalContents.x(), closestBox->logicalTop());
-        if (!style()->isHorizontalWritingMode())
+        if (!isHorizontalWritingMode())
             point = point.transposedPoint();
         if (closestBox->renderer()->isReplaced())
             return positionForPointRespectingEditingBoundaries(this, toRenderBox(closestBox->renderer()), point);
@@ -4100,7 +4171,9 @@ VisiblePosition RenderBlock::positionForPointWithInlineChildren(const IntPoint&
     if (lastRootBoxWithChildren) {
         // We hit this case for Mac behavior when the Y coordinate is below the last box.
         ASSERT(moveCaretToBoundary);
-        return VisiblePosition(positionForBox(lastRootBoxWithChildren->lastLeafChild(), false), DOWNSTREAM);
+        InlineBox* logicallyLastBox;
+        if (lastRootBoxWithChildren->getLogicalEndBoxWithNode(logicallyLastBox))
+            return VisiblePosition(positionForBox(logicallyLastBox, false), DOWNSTREAM);
     }
 
     // Can't reach this. We have a root line box, but it has no kids.
@@ -4121,8 +4194,8 @@ VisiblePosition RenderBlock::positionForPoint(const IntPoint& point)
 
     if (isReplaced()) {
         // FIXME: This seems wrong when the object's writing-mode doesn't match the line's writing-mode.
-        int pointLogicalLeft = style()->isHorizontalWritingMode() ? point.x() : point.y();
-        int pointLogicalTop = style()->isHorizontalWritingMode() ? point.y() : point.x();
+        int pointLogicalLeft = isHorizontalWritingMode() ? point.x() : point.y();
+        int pointLogicalTop = isHorizontalWritingMode() ? point.y() : point.x();
 
         if (pointLogicalTop < 0 || (pointLogicalTop < logicalHeight() && pointLogicalLeft < 0))
             return createVisiblePosition(caretMinOffset(), DOWNSTREAM);
@@ -4135,7 +4208,7 @@ VisiblePosition RenderBlock::positionForPoint(const IntPoint& point)
     offsetForContents(contentsX, contentsY);
     IntPoint pointInContents(contentsX, contentsY);
     IntPoint pointInLogicalContents(pointInContents);
-    if (!style()->isHorizontalWritingMode())
+    if (!isHorizontalWritingMode())
         pointInLogicalContents = pointInLogicalContents.transposedPoint();
 
     if (childrenInline())
@@ -4303,7 +4376,7 @@ IntRect RenderBlock::columnRectAt(ColumnInfo* colInfo, unsigned index) const
                           logicalLeftOffsetForContent() + (index * (colLogicalWidth + colGap))
                         : logicalLeftOffsetForContent() + contentLogicalWidth() - colLogicalWidth - (index * (colLogicalWidth + colGap));
     IntRect rect(colLogicalLeft, colLogicalTop, colLogicalWidth, colLogicalHeight);
-    if (style()->isHorizontalWritingMode())
+    if (isHorizontalWritingMode())
         return IntRect(colLogicalLeft, colLogicalTop, colLogicalWidth, colLogicalHeight);
     return IntRect(colLogicalTop, colLogicalLeft, colLogicalHeight, colLogicalWidth);
 }
@@ -4370,7 +4443,7 @@ void RenderBlock::adjustPointToColumnContents(IntPoint& point) const
     for (unsigned i = 0; i < colInfo->columnCount(); i++) {
         // Add in half the column gap to the left and right of the rect.
         IntRect colRect = columnRectAt(colInfo, i);
-        if (style()->isHorizontalWritingMode()) {
+        if (isHorizontalWritingMode()) {
             IntRect gapAndColumnRect(colRect.x() - halfColGap, colRect.y(), colRect.width() + colGap, colRect.height());
             if (point.x() >= gapAndColumnRect.x() && point.x() < gapAndColumnRect.maxX()) {
                 // FIXME: The clamping that follows is not completely right for right-to-left
@@ -4440,7 +4513,7 @@ void RenderBlock::adjustRectForColumns(IntRect& r) const
     for (unsigned i = 0; i < colCount; i++) {
         IntRect colRect = columnRectAt(colInfo, i);
         IntRect repaintRect = r;
-        if (style()->isHorizontalWritingMode()) {
+        if (isHorizontalWritingMode()) {
             int currXOffset = colRect.x() - logicalLeft;
             repaintRect.move(currXOffset, currLogicalOffset);
             currLogicalOffset -= colRect.height();
@@ -4464,7 +4537,7 @@ IntPoint RenderBlock::flipForWritingModeIncludingColumns(const IntPoint& point)
     ColumnInfo* colInfo = columnInfo();
     int columnLogicalHeight = colInfo->columnHeight();
     int expandedLogicalHeight = borderBefore() + paddingBefore() + columnCount(colInfo) * columnLogicalHeight + borderAfter() + paddingAfter() + scrollbarLogicalHeight();
-    if (style()->isHorizontalWritingMode())
+    if (isHorizontalWritingMode())
         return IntPoint(point.x(), expandedLogicalHeight - point.y());
     return IntPoint(expandedLogicalHeight - point.x(), point.y());
 }
@@ -4478,7 +4551,7 @@ void RenderBlock::flipForWritingModeIncludingColumns(IntRect& rect) const
     ColumnInfo* colInfo = columnInfo();
     int columnLogicalHeight = colInfo->columnHeight();
     int expandedLogicalHeight = borderBefore() + paddingBefore() + columnCount(colInfo) * columnLogicalHeight + borderAfter() + paddingAfter() + scrollbarLogicalHeight();
-    if (style()->isHorizontalWritingMode())
+    if (isHorizontalWritingMode())
         rect.setY(expandedLogicalHeight - rect.maxY());
     else
         rect.setX(expandedLogicalHeight - rect.maxX());
@@ -4499,7 +4572,7 @@ void RenderBlock::adjustForColumns(IntSize& offset, const IntPoint& point) const
     for (size_t i = 0; i < colCount; ++i) {
         // Compute the edges for a given column in the block progression direction.
         IntRect sliceRect = IntRect(logicalLeft, borderBefore() + paddingBefore() + i * colLogicalHeight, colLogicalWidth, colLogicalHeight);
-        if (!style()->isHorizontalWritingMode())
+        if (!isHorizontalWritingMode())
             sliceRect = sliceRect.transposedRect();
         
         // If we have a flipped blocks writing mode, then convert the column so that it's coming from the after edge (either top or left edge).
@@ -4508,7 +4581,7 @@ void RenderBlock::adjustForColumns(IntSize& offset, const IntPoint& point) const
         int logicalOffset = style()->isFlippedBlocksWritingMode() ? (colCount - 1 - i) * colLogicalHeight : i * colLogicalHeight;
 
         // Now we're in the same coordinate space as the point.  See if it is inside the rectangle.
-        if (style()->isHorizontalWritingMode()) {
+        if (isHorizontalWritingMode()) {
             if (point.y() >= sliceRect.y() && point.y() < sliceRect.maxY()) {
                 offset.expand(columnRectAt(colInfo, i).x() - logicalLeft, -logicalOffset);
                 return;
@@ -4851,7 +4924,7 @@ void RenderBlock::computeInlinePreferredLogicalWidths()
                     continue;
                 }
 
-                if (t->style()->hasTextCombine())
+                if (t->style()->hasTextCombine() && t->isCombineText())
                     toRenderCombineText(t)->combineText();
 
                 // Determine if we have a breakable character.  Pass in
@@ -5064,7 +5137,7 @@ bool RenderBlock::hasLineIfEmpty() const
     if (!node())
         return false;
     
-    if (node()->isContentEditable() && node()->rootEditableElement() == node())
+    if (node()->rendererIsEditable() && node()->rootEditableElement() == node())
         return true;
     
     if (node()->isShadowRoot() && (node()->shadowHost()->hasTagName(inputTag)))
@@ -5159,7 +5232,7 @@ int RenderBlock::lastLineBoxBaseline() const
     if (!isBlockFlow() || (isWritingModeRoot() && !isRubyRun()))
         return -1;
 
-    LineDirectionMode lineDirection = style()->isHorizontalWritingMode() ? HorizontalLine : VerticalLine;
+    LineDirectionMode lineDirection = isHorizontalWritingMode() ? HorizontalLine : VerticalLine;
 
     if (childrenInline()) {
         if (!firstLineBox() && hasLineIfEmpty()) {
@@ -5766,6 +5839,14 @@ IntRect RenderBlock::localCaretRect(InlineBox* inlineBox, int caretOffset, int*
         case WEBKIT_RIGHT:
             alignment = alignRight;
             break;
+        case TASTART:
+            if (!currentStyle->isLeftToRightDirection())
+                alignment = alignRight;
+            break;
+        case TAEND:
+            if (currentStyle->isLeftToRightDirection())
+                alignment = alignRight;
+            break;
     }
 
     int x = borderLeft() + paddingLeft();
@@ -5857,8 +5938,7 @@ void RenderBlock::addFocusRingRects(Vector<IntRect>& rects, int tx, int ty)
 
 RenderBlock* RenderBlock::createAnonymousBlock(bool isFlexibleBox) const
 {
-    RefPtr<RenderStyle> newStyle = RenderStyle::create();
-    newStyle->inheritFrom(style());
+    RefPtr<RenderStyle> newStyle = RenderStyle::createAnonymousStyle(style());
 
     RenderBlock* newBox = 0;
     if (isFlexibleBox) {
@@ -5884,8 +5964,7 @@ RenderBlock* RenderBlock::createAnonymousBlockWithSameTypeAs(RenderBlock* otherA
 
 RenderBlock* RenderBlock::createAnonymousColumnsBlock() const
 {
-    RefPtr<RenderStyle> newStyle = RenderStyle::create();
-    newStyle->inheritFrom(style());
+    RefPtr<RenderStyle> newStyle = RenderStyle::createAnonymousStyle(style());
     newStyle->inheritColumnPropertiesFrom(style());
     newStyle->setDisplay(BLOCK);
 
@@ -5896,8 +5975,7 @@ RenderBlock* RenderBlock::createAnonymousColumnsBlock() const
 
 RenderBlock* RenderBlock::createAnonymousColumnSpanBlock() const
 {
-    RefPtr<RenderStyle> newStyle = RenderStyle::create();
-    newStyle->inheritFrom(style());
+    RefPtr<RenderStyle> newStyle = RenderStyle::createAnonymousStyle(style());
     newStyle->setColumnSpan(true);
     newStyle->setDisplay(BLOCK);
 
@@ -5915,7 +5993,7 @@ int RenderBlock::nextPageLogicalTop(int logicalOffset) const
     // The logicalOffset is in our coordinate space.  We can add in our pushed offset.
     int pageLogicalHeight = layoutState->m_pageLogicalHeight;
     IntSize delta = layoutState->m_layoutOffset - layoutState->m_pageOffset;
-    int offset = style()->isHorizontalWritingMode() ? delta.height() : delta.width();
+    int offset = isHorizontalWritingMode() ? delta.height() : delta.width();
     int remainingLogicalHeight = (pageLogicalHeight - (offset + logicalOffset) % pageLogicalHeight) % pageLogicalHeight;
     return logicalOffset + remainingLogicalHeight;
 }
@@ -5976,7 +6054,7 @@ int RenderBlock::adjustForUnsplittableChild(RenderBox* child, int logicalOffset,
     if (!pageLogicalHeight || childLogicalHeight > pageLogicalHeight)
         return logicalOffset;
     IntSize delta = layoutState->m_layoutOffset - layoutState->m_pageOffset;
-    int offset = style()->isHorizontalWritingMode() ? delta.height() : delta.width();
+    int offset = isHorizontalWritingMode() ? delta.height() : delta.width();
     int remainingLogicalHeight = (pageLogicalHeight - (offset + logicalOffset) % pageLogicalHeight) % pageLogicalHeight;
     if (remainingLogicalHeight < childLogicalHeight)
         return logicalOffset + remainingLogicalHeight;
@@ -6012,7 +6090,7 @@ void RenderBlock::adjustLinePositionForPagination(RootInlineBox* lineBox, int& d
     if (!pageLogicalHeight || lineHeight > pageLogicalHeight)
         return;
     IntSize offsetDelta = layoutState->m_layoutOffset - layoutState->m_pageOffset;
-    int offset = style()->isHorizontalWritingMode() ? offsetDelta.height() : offsetDelta.width();
+    int offset = isHorizontalWritingMode() ? offsetDelta.height() : offsetDelta.width();
     int remainingLogicalHeight = pageLogicalHeight - (offset + logicalOffset) % pageLogicalHeight;
     if (remainingLogicalHeight < lineHeight) {
         int totalLogicalHeight = lineHeight + max(0, logicalOffset);
@@ -6034,7 +6112,7 @@ int RenderBlock::collapsedMarginBeforeForChild(RenderBox* child) const
     
     // The child has a different directionality.  If the child is parallel, then it's just
     // flipped relative to us.  We can use the collapsed margin for the opposite edge.
-    if (child->style()->isHorizontalWritingMode() == style()->isHorizontalWritingMode())
+    if (child->isHorizontalWritingMode() == isHorizontalWritingMode())
         return child->collapsedMarginAfter();
     
     // The child is perpendicular to us, which means its margins don't collapse but are on the
@@ -6051,7 +6129,7 @@ int RenderBlock::collapsedMarginAfterForChild(RenderBox* child) const
     
     // The child has a different directionality.  If the child is parallel, then it's just
     // flipped relative to us.  We can use the collapsed margin for the opposite edge.
-    if (child->style()->isHorizontalWritingMode() == style()->isHorizontalWritingMode())
+    if (child->isHorizontalWritingMode() == isHorizontalWritingMode())
         return child->collapsedMarginBefore();
     
     // The child is perpendicular to us, which means its margins don't collapse but are on the
@@ -6093,21 +6171,21 @@ int RenderBlock::marginAfterForChild(RenderBoxModelObject* child) const
     
 int RenderBlock::marginStartForChild(RenderBoxModelObject* child) const
 {
-    if (style()->isHorizontalWritingMode())
+    if (isHorizontalWritingMode())
         return style()->isLeftToRightDirection() ? child->marginLeft() : child->marginRight();
     return style()->isLeftToRightDirection() ? child->marginTop() : child->marginBottom();
 }
 
 int RenderBlock::marginEndForChild(RenderBoxModelObject* child) const
 {
-    if (style()->isHorizontalWritingMode())
+    if (isHorizontalWritingMode())
         return style()->isLeftToRightDirection() ? child->marginRight() : child->marginLeft();
     return style()->isLeftToRightDirection() ? child->marginBottom() : child->marginTop();
 }
 
 void RenderBlock::setMarginStartForChild(RenderBox* child, int margin)
 {
-    if (style()->isHorizontalWritingMode()) {
+    if (isHorizontalWritingMode()) {
         if (style()->isLeftToRightDirection())
             child->setMarginLeft(margin);
         else
@@ -6122,7 +6200,7 @@ void RenderBlock::setMarginStartForChild(RenderBox* child, int margin)
 
 void RenderBlock::setMarginEndForChild(RenderBox* child, int margin)
 {
-    if (style()->isHorizontalWritingMode()) {
+    if (isHorizontalWritingMode()) {
         if (style()->isLeftToRightDirection())
             child->setMarginRight(margin);
         else
@@ -6195,7 +6273,7 @@ RenderBlock::MarginValues RenderBlock::marginValuesForChild(RenderBox* child)
             beforeMargin = child->marginBefore();
             afterMargin = child->marginAfter();
         }
-    } else if (child->style()->isHorizontalWritingMode() == style()->isHorizontalWritingMode()) {
+    } else if (child->isHorizontalWritingMode() == isHorizontalWritingMode()) {
         // The child has a different directionality.  If the child is parallel, then it's just
         // flipped relative to us.  We can use the margins for the opposite edges.
         if (childRenderBlock) {
diff --git a/Source/WebCore/rendering/RenderBlock.h b/Source/WebCore/rendering/RenderBlock.h
index 8d054a6..74751e1 100644
--- a/Source/WebCore/rendering/RenderBlock.h
+++ b/Source/WebCore/rendering/RenderBlock.h
@@ -171,9 +171,9 @@ public:
 
     // Accessors for logical width/height and margins in the containing block's block-flow direction.
     enum ApplyLayoutDeltaMode { ApplyLayoutDelta, DoNotApplyLayoutDelta };
-    int logicalWidthForChild(RenderBox* child) { return style()->isHorizontalWritingMode() ? child->width() : child->height(); }
-    int logicalHeightForChild(RenderBox* child) { return style()->isHorizontalWritingMode() ? child->height() : child->width(); }
-    int logicalTopForChild(RenderBox* child) { return style()->isHorizontalWritingMode() ? child->y() : child->x(); }
+    int logicalWidthForChild(RenderBox* child) { return isHorizontalWritingMode() ? child->width() : child->height(); }
+    int logicalHeightForChild(RenderBox* child) { return isHorizontalWritingMode() ? child->height() : child->width(); }
+    int logicalTopForChild(RenderBox* child) { return isHorizontalWritingMode() ? child->y() : child->x(); }
     void setLogicalLeftForChild(RenderBox* child, int logicalLeft, ApplyLayoutDeltaMode = DoNotApplyLayoutDelta);
     void setLogicalTopForChild(RenderBox* child, int logicalTop, ApplyLayoutDeltaMode = DoNotApplyLayoutDelta);
     int marginBeforeForChild(RenderBoxModelObject* child) const;
@@ -218,8 +218,8 @@ public:
 
     virtual void scrollbarsChanged(bool /*horizontalScrollbarChanged*/, bool /*verticalScrollbarChanged*/) { };
 
-    int logicalRightOffsetForContent() const { return style()->isHorizontalWritingMode() ? borderLeft() + paddingLeft() + availableLogicalWidth() : borderTop() + paddingTop() + availableLogicalWidth(); }
-    int logicalLeftOffsetForContent() const { return style()->isHorizontalWritingMode() ? borderLeft() + paddingLeft() : borderTop() + paddingTop(); }
+    int logicalRightOffsetForContent() const { return isHorizontalWritingMode() ? borderLeft() + paddingLeft() + availableLogicalWidth() : borderTop() + paddingTop() + availableLogicalWidth(); }
+    int logicalLeftOffsetForContent() const { return isHorizontalWritingMode() ? borderLeft() + paddingLeft() : borderTop() + paddingTop(); }
 
 protected:
     // These functions are only used internally to manipulate the render tree structure via remove/insert/appendChildNode.
@@ -297,7 +297,9 @@ protected:
     virtual void styleDidChange(StyleDifference, const RenderStyle* oldStyle);
 
     virtual bool hasLineIfEmpty() const;
-    bool layoutOnlyPositionedObjects();
+    
+    bool simplifiedLayout();
+    void simplifiedNormalFlowLayout();
 
     void computeOverflow(int oldClientAfterEdge, bool recomputeFloats = false);
     virtual void addOverflowFromChildren();
@@ -429,35 +431,35 @@ private:
 
     IntPoint flipFloatForWritingMode(const FloatingObject*, const IntPoint&) const;
 
-    int logicalTopForFloat(const FloatingObject* child) const { return style()->isHorizontalWritingMode() ? child->y() : child->x(); }
-    int logicalBottomForFloat(const FloatingObject* child) const { return style()->isHorizontalWritingMode() ? child->maxY() : child->maxX(); }
-    int logicalLeftForFloat(const FloatingObject* child) const { return style()->isHorizontalWritingMode() ? child->x() : child->y(); }
-    int logicalRightForFloat(const FloatingObject* child) const { return style()->isHorizontalWritingMode() ? child->maxX() : child->maxY(); }
-    int logicalWidthForFloat(const FloatingObject* child) const { return style()->isHorizontalWritingMode() ? child->width() : child->height(); }
+    int logicalTopForFloat(const FloatingObject* child) const { return isHorizontalWritingMode() ? child->y() : child->x(); }
+    int logicalBottomForFloat(const FloatingObject* child) const { return isHorizontalWritingMode() ? child->maxY() : child->maxX(); }
+    int logicalLeftForFloat(const FloatingObject* child) const { return isHorizontalWritingMode() ? child->x() : child->y(); }
+    int logicalRightForFloat(const FloatingObject* child) const { return isHorizontalWritingMode() ? child->maxX() : child->maxY(); }
+    int logicalWidthForFloat(const FloatingObject* child) const { return isHorizontalWritingMode() ? child->width() : child->height(); }
     void setLogicalTopForFloat(FloatingObject* child, int logicalTop)
     {
-        if (style()->isHorizontalWritingMode())
+        if (isHorizontalWritingMode())
             child->setY(logicalTop);
         else
             child->setX(logicalTop);
     }
     void setLogicalLeftForFloat(FloatingObject* child, int logicalLeft)
     {
-        if (style()->isHorizontalWritingMode())
+        if (isHorizontalWritingMode())
             child->setX(logicalLeft);
         else
             child->setY(logicalLeft);
     }
     void setLogicalHeightForFloat(FloatingObject* child, int logicalHeight)
     {
-        if (style()->isHorizontalWritingMode())
+        if (isHorizontalWritingMode())
             child->setHeight(logicalHeight);
         else
             child->setWidth(logicalHeight);
     }
     void setLogicalWidthForFloat(FloatingObject* child, int logicalWidth)
     {
-        if (style()->isHorizontalWritingMode())
+        if (isHorizontalWritingMode())
             child->setWidth(logicalWidth);
         else
             child->setHeight(logicalWidth);
@@ -465,7 +467,7 @@ private:
 
     int xPositionForFloatIncludingMargin(const FloatingObject* child) const
     {
-        if (style()->isHorizontalWritingMode())
+        if (isHorizontalWritingMode())
             return child->x() + child->renderer()->marginLeft();
         else
             return child->x() + marginBeforeForChild(child->renderer());
@@ -473,31 +475,32 @@ private:
         
     int yPositionForFloatIncludingMargin(const FloatingObject* child) const
     {
-        if (style()->isHorizontalWritingMode())
+        if (isHorizontalWritingMode())
             return child->y() + marginBeforeForChild(child->renderer());
         else
             return child->y() + child->renderer()->marginTop();
     }
 
     // The following functions' implementations are in RenderBlockLineLayout.cpp.
+    void checkFloatsInCleanLine(RootInlineBox*, Vector<FloatWithRect>&, size_t& floatIndex, bool& encounteredNewFloat, bool& dirtiedByFloat);
     RootInlineBox* determineStartPosition(bool& firstLine, bool& fullLayout, bool& previousLineBrokeCleanly,
                                           InlineBidiResolver&, Vector<FloatWithRect>& floats, unsigned& numCleanFloats,
                                           bool& useRepaintBounds, int& repaintTop, int& repaintBottom);
-    RootInlineBox* determineEndPosition(RootInlineBox* startBox, InlineIterator& cleanLineStart,
-                                        BidiStatus& cleanLineBidiStatus,
-                                        int& yPos);
+    RootInlineBox* determineEndPosition(RootInlineBox* startBox, Vector<FloatWithRect>& floats, size_t floatIndex, InlineIterator& cleanLineStart,
+                                        BidiStatus& cleanLineBidiStatus, int& yPos);
     bool matchedEndLine(const InlineBidiResolver&, const InlineIterator& endLineStart, const BidiStatus& endLineStatus,
                         RootInlineBox*& endLine, int& endYPos, int& repaintBottom, int& repaintTop);
 
     void skipTrailingWhitespace(InlineIterator&, bool isLineEmpty, bool previousLineBrokeCleanly);
-    int skipLeadingWhitespace(InlineBidiResolver&, bool firstLine, bool isLineEmpty, bool previousLineBrokeCleanly, FloatingObject* lastFloatFromPreviousLine);
+    void skipLeadingWhitespace(InlineBidiResolver&, bool firstLine, bool isLineEmpty, bool previousLineBrokeCleanly, FloatingObject* lastFloatFromPreviousLine, int& lineLeftOffset, int& lineRightOffset);
     void fitBelowFloats(float widthToFit, bool firstLine, float& availableWidth);
     typedef std::pair<RenderText*, LazyLineBreakIterator> LineBreakIteratorInfo;
-    InlineIterator findNextLineBreak(InlineBidiResolver&, bool firstLine, bool& isLineEmpty, LineBreakIteratorInfo&, bool& previousLineBrokeCleanly, bool& hyphenated, EClear*, FloatingObject* lastFloatFromPreviousLine);
-    RootInlineBox* constructLine(unsigned runCount, BidiRun* firstRun, BidiRun* lastRun, bool firstLine, bool lastLine, RenderObject* endObject);
-    InlineFlowBox* createLineBoxes(RenderObject*, bool firstLine);
+    InlineIterator findNextLineBreak(InlineBidiResolver&, bool firstLine, bool& isLineEmpty, LineBreakIteratorInfo&, bool& previousLineBrokeCleanly, bool& hyphenated,
+                                     EClear*, FloatingObject* lastFloatFromPreviousLine, Vector<RenderBox*>& positionedObjects);
+    RootInlineBox* constructLine(unsigned runCount, BidiRun* firstRun, BidiRun* lastRun, bool firstLine, bool lastLine, RenderObject* endObject, RenderObject* logicallyLastRunRenderer);
+    InlineFlowBox* createLineBoxes(RenderObject*, bool firstLine, InlineBox* childBox);
 
-    void computeInlineDirectionPositionsForLine(RootInlineBox*, bool firstLine, BidiRun* firstRun, BidiRun* trailingSpaceRun, bool reachedEnd, GlyphOverflowAndFallbackFontsMap&);
+    void computeInlineDirectionPositionsForLine(RootInlineBox*, bool firstLine, BidiRun* firstRun, BidiRun* trailingSpaceRun, bool reachedEnd, GlyphOverflowAndFallbackFontsMap&, VerticalPositionCache&);
     void computeBlockDirectionPositionsForLine(RootInlineBox*, BidiRun*, GlyphOverflowAndFallbackFontsMap&, VerticalPositionCache&);
     void deleteEllipsisLineBoxes();
     void checkLinesForTextOverflow();
@@ -526,7 +529,7 @@ private:
     
     // Positions new floats and also adjust all floats encountered on the line if any of them
     // have to move to the next page/column.
-    bool positionNewFloatOnLine(FloatingObject* newFloat, FloatingObject* lastFloatFromPreviousLine);
+    bool positionNewFloatOnLine(FloatingObject* newFloat, FloatingObject* lastFloatFromPreviousLine, bool firstLine, int& lineLeftOffset, int& lineRightOffset);
 
     void clearFloats();
     int getClearDelta(RenderBox* child, int yPos);
diff --git a/Source/WebCore/rendering/RenderBlockLineLayout.cpp b/Source/WebCore/rendering/RenderBlockLineLayout.cpp
index d1fce88..3a0f016 100644
--- a/Source/WebCore/rendering/RenderBlockLineLayout.cpp
+++ b/Source/WebCore/rendering/RenderBlockLineLayout.cpp
@@ -95,7 +95,7 @@ static void checkMidpoints(LineMidpointState& lineMidpointState, InlineIterator&
     // Check to see if our last midpoint is a start point beyond the line break.  If so,
     // shave it off the list, and shave off a trailing space if the previous end point doesn't
     // preserve whitespace.
-    if (lBreak.obj && lineMidpointState.numMidpoints && !(lineMidpointState.numMidpoints % 2)) {
+    if (lBreak.m_obj && lineMidpointState.numMidpoints && !(lineMidpointState.numMidpoints % 2)) {
         InlineIterator* midpoints = lineMidpointState.midpoints.data();
         InlineIterator& endpoint = midpoints[lineMidpointState.numMidpoints - 2];
         const InlineIterator& startpoint = midpoints[lineMidpointState.numMidpoints - 1];
@@ -105,8 +105,8 @@ static void checkMidpoints(LineMidpointState& lineMidpointState, InlineIterator&
         if (currpoint == lBreak) {
             // We hit the line break before the start point.  Shave off the start point.
             lineMidpointState.numMidpoints--;
-            if (endpoint.obj->style()->collapseWhiteSpace())
-                endpoint.pos--;
+            if (endpoint.m_obj->style()->collapseWhiteSpace())
+                endpoint.m_pos--;
         }
     }    
 }
@@ -132,31 +132,31 @@ void RenderBlock::appendRunsForObject(int start, int end, RenderObject* obj, Inl
     if (haveNextMidpoint)
         nextMidpoint = lineMidpointState.midpoints[lineMidpointState.currentMidpoint];
     if (lineMidpointState.betweenMidpoints) {
-        if (!(haveNextMidpoint && nextMidpoint.obj == obj))
+        if (!(haveNextMidpoint && nextMidpoint.m_obj == obj))
             return;
         // This is a new start point. Stop ignoring objects and 
         // adjust our start.
         lineMidpointState.betweenMidpoints = false;
-        start = nextMidpoint.pos;
+        start = nextMidpoint.m_pos;
         lineMidpointState.currentMidpoint++;
         if (start < end)
             return appendRunsForObject(start, end, obj, resolver);
     } else {
-        if (!haveNextMidpoint || (obj != nextMidpoint.obj)) {
+        if (!haveNextMidpoint || (obj != nextMidpoint.m_obj)) {
             resolver.addRun(new (obj->renderArena()) BidiRun(start, end, obj, resolver.context(), resolver.dir()));
             return;
         }
 
         // An end midpoint has been encountered within our object.  We
         // need to go ahead and append a run with our endpoint.
-        if (static_cast<int>(nextMidpoint.pos + 1) <= end) {
+        if (static_cast<int>(nextMidpoint.m_pos + 1) <= end) {
             lineMidpointState.betweenMidpoints = true;
             lineMidpointState.currentMidpoint++;
-            if (nextMidpoint.pos != UINT_MAX) { // UINT_MAX means stop at the object and don't include any of it.
-                if (static_cast<int>(nextMidpoint.pos + 1) > start)
+            if (nextMidpoint.m_pos != UINT_MAX) { // UINT_MAX means stop at the object and don't include any of it.
+                if (static_cast<int>(nextMidpoint.m_pos + 1) > start)
                     resolver.addRun(new (obj->renderArena())
-                        BidiRun(start, nextMidpoint.pos + 1, obj, resolver.context(), resolver.dir()));
-                return appendRunsForObject(nextMidpoint.pos + 1, end, obj, resolver);
+                        BidiRun(start, nextMidpoint.m_pos + 1, obj, resolver.context(), resolver.dir()));
+                return appendRunsForObject(nextMidpoint.m_pos + 1, end, obj, resolver);
             }
         } else
            resolver.addRun(new (obj->renderArena()) BidiRun(start, end, obj, resolver.context(), resolver.dir()));
@@ -203,14 +203,14 @@ static bool parentIsConstructedOrHaveNext(InlineFlowBox* parentBox)
     return false;
 }
 
-InlineFlowBox* RenderBlock::createLineBoxes(RenderObject* obj, bool firstLine)
+InlineFlowBox* RenderBlock::createLineBoxes(RenderObject* obj, bool firstLine, InlineBox* childBox)
 {
     // See if we have an unconstructed line box for this object that is also
     // the last item on the line.
     unsigned lineDepth = 1;
-    InlineFlowBox* childBox = 0;
     InlineFlowBox* parentBox = 0;
     InlineFlowBox* result = 0;
+    bool hasDefaultLineBoxContain = style()->lineBoxContain() == RenderStyle::initialLineBoxContain();
     do {
         ASSERT(obj->isRenderInline() || obj == this);
         
@@ -230,7 +230,9 @@ InlineFlowBox* RenderBlock::createLineBoxes(RenderObject* obj, bool firstLine)
             ASSERT(newBox->isInlineFlowBox());
             parentBox = static_cast<InlineFlowBox*>(newBox);
             parentBox->setFirstLineStyleBit(firstLine);
-            parentBox->setIsHorizontal(style()->isHorizontalWritingMode());
+            parentBox->setIsHorizontal(isHorizontalWritingMode());
+            if (!hasDefaultLineBoxContain)
+                parentBox->clearDescendantsHaveSameLineHeightAndBaseline();
             constructedNewBox = true;
         }
 
@@ -257,7 +259,7 @@ InlineFlowBox* RenderBlock::createLineBoxes(RenderObject* obj, bool firstLine)
     return result;
 }
 
-RootInlineBox* RenderBlock::constructLine(unsigned runCount, BidiRun* firstRun, BidiRun* lastRun, bool firstLine, bool lastLine, RenderObject* endObject)
+RootInlineBox* RenderBlock::constructLine(unsigned runCount, BidiRun* firstRun, BidiRun* lastRun, bool firstLine, bool lastLine, RenderObject* endObject, RenderObject* logicallyLastRunRenderer)
 {
     ASSERT(firstRun);
 
@@ -284,10 +286,11 @@ RootInlineBox* RenderBlock::constructLine(unsigned runCount, BidiRun* firstRun,
         // run's inline box.
         if (!parentBox || parentBox->renderer() != r->m_object->parent())
             // Create new inline boxes all the way back to the appropriate insertion point.
-            parentBox = createLineBoxes(r->m_object->parent(), firstLine);
-
-        // Append the inline box to this line.
-        parentBox->addToLine(box);
+            parentBox = createLineBoxes(r->m_object->parent(), firstLine, box);
+        else {
+            // Append the inline box to this line.
+            parentBox->addToLine(box);
+        }
 
         bool visuallyOrdered = r->m_object->style()->visuallyOrdered();
         box->setBidiLevel(r->level());
@@ -315,7 +318,7 @@ RootInlineBox* RenderBlock::constructLine(unsigned runCount, BidiRun* firstRun,
     // paint borders/margins/padding.  This knowledge will ultimately be used when
     // we determine the horizontal positions and widths of all the inline boxes on
     // the line.
-    lastLineBox()->determineSpacingForFlowBoxes(lastLine, endObject);
+    lastLineBox()->determineSpacingForFlowBoxes(lastLine, endObject, logicallyLastRunRenderer);
 
     // Now mark the line boxes as being constructed.
     lastLineBox()->setConstructed();
@@ -333,7 +336,60 @@ ETextAlign RenderBlock::textAlignmentForLine(bool endsWithSoftBreak) const
     return alignment;
 }
 
-void RenderBlock::computeInlineDirectionPositionsForLine(RootInlineBox* lineBox, bool firstLine, BidiRun* firstRun, BidiRun* trailingSpaceRun, bool reachedEnd, GlyphOverflowAndFallbackFontsMap& textBoxDataMap)
+static void updateLogicalWidthForLeftAlignedBlock(bool isLeftToRightDirection, BidiRun* trailingSpaceRun, float& logicalLeft, float& totalLogicalWidth, float availableLogicalWidth)
+{
+    // The direction of the block should determine what happens with wide lines.
+    // In particular with RTL blocks, wide lines should still spill out to the left.
+    if (isLeftToRightDirection) {
+        if (totalLogicalWidth > availableLogicalWidth && trailingSpaceRun)
+            trailingSpaceRun->m_box->setLogicalWidth(max<float>(0, trailingSpaceRun->m_box->logicalWidth() - totalLogicalWidth + availableLogicalWidth));
+        return;
+    }
+
+    if (trailingSpaceRun)
+        trailingSpaceRun->m_box->setLogicalWidth(0);
+    else if (totalLogicalWidth > availableLogicalWidth)
+        logicalLeft -= (totalLogicalWidth - availableLogicalWidth);
+}
+
+static void updateLogicalWidthForRightAlignedBlock(bool isLeftToRightDirection, BidiRun* trailingSpaceRun, float& logicalLeft, float& totalLogicalWidth, float availableLogicalWidth)
+{
+    // Wide lines spill out of the block based off direction.
+    // So even if text-align is right, if direction is LTR, wide lines should overflow out of the right
+    // side of the block.
+    if (isLeftToRightDirection) {
+        if (trailingSpaceRun) {
+            totalLogicalWidth -= trailingSpaceRun->m_box->logicalWidth();
+            trailingSpaceRun->m_box->setLogicalWidth(0);
+        }
+        if (totalLogicalWidth < availableLogicalWidth)
+            logicalLeft += availableLogicalWidth - totalLogicalWidth;
+        return;
+    }
+
+    if (totalLogicalWidth > availableLogicalWidth && trailingSpaceRun) {
+        trailingSpaceRun->m_box->setLogicalWidth(max<float>(0, trailingSpaceRun->m_box->logicalWidth() - totalLogicalWidth + availableLogicalWidth));
+        totalLogicalWidth -= trailingSpaceRun->m_box->logicalWidth();
+    } else
+        logicalLeft += availableLogicalWidth - totalLogicalWidth;
+}
+
+static void updateLogicalWidthForCenterAlignedBlock(bool isLeftToRightDirection, BidiRun* trailingSpaceRun, float& logicalLeft, float& totalLogicalWidth, float availableLogicalWidth)
+{
+    float trailingSpaceWidth = 0;
+    if (trailingSpaceRun) {
+        totalLogicalWidth -= trailingSpaceRun->m_box->logicalWidth();
+        trailingSpaceWidth = min(trailingSpaceRun->m_box->logicalWidth(), (availableLogicalWidth - totalLogicalWidth + 1) / 2);
+        trailingSpaceRun->m_box->setLogicalWidth(max<float>(0, trailingSpaceWidth));
+    }
+    if (isLeftToRightDirection)
+        logicalLeft += max<float>((availableLogicalWidth - totalLogicalWidth) / 2, 0);
+    else
+        logicalLeft += totalLogicalWidth > availableLogicalWidth ? (availableLogicalWidth - totalLogicalWidth) : (availableLogicalWidth - totalLogicalWidth) / 2 - trailingSpaceWidth;
+}
+
+void RenderBlock::computeInlineDirectionPositionsForLine(RootInlineBox* lineBox, bool firstLine, BidiRun* firstRun, BidiRun* trailingSpaceRun, bool reachedEnd,
+                                                         GlyphOverflowAndFallbackFontsMap& textBoxDataMap, VerticalPositionCache& verticalPositionCache)
 {
     ETextAlign textAlign = textAlignmentForLine(!reachedEnd && !lineBox->endsWithBreak());
     float logicalLeft = logicalLeftOffsetForLine(logicalHeight(), firstLine);
@@ -354,6 +410,8 @@ void RenderBlock::computeInlineDirectionPositionsForLine(RootInlineBox* lineBox,
             RenderText* rt = toRenderText(r->m_object);
 
             if (textAlign == JUSTIFY && r != trailingSpaceRun) {
+                if (!isAfterExpansion)
+                    static_cast<InlineTextBox*>(r->m_box)->setCanHaveLeadingExpansion(true);
                 unsigned opportunitiesInRun = Font::expansionOpportunityCount(rt->characters() + r->m_start, r->m_stop - r->m_start, r->m_box->direction(), isAfterExpansion);
                 expansionOpportunities.append(opportunitiesInRun);
                 expansionOpportunityCount += opportunitiesInRun;
@@ -366,6 +424,21 @@ void RenderBlock::computeInlineDirectionPositionsForLine(RootInlineBox* lineBox,
             }
             HashSet<const SimpleFontData*> fallbackFonts;
             GlyphOverflow glyphOverflow;
+            
+            // Always compute glyph overflow if the block's line-box-contain value is "glyphs".
+            if (lineBox->fitsToGlyphs()) {
+                // If we don't stick out of the root line's font box, then don't bother computing our glyph overflow. This optimization
+                // will keep us from computing glyph bounds in nearly all cases.
+                bool includeRootLine = lineBox->includesRootLineBoxFontOrLeading();
+                int baselineShift = lineBox->verticalPositionForBox(r->m_box, verticalPositionCache);
+                int rootDescent = includeRootLine ? lineBox->renderer()->style(firstLine)->font().fontMetrics().descent() : 0;
+                int rootAscent = includeRootLine ? lineBox->renderer()->style(firstLine)->font().fontMetrics().ascent() : 0;
+                int boxAscent = rt->style(firstLine)->font().fontMetrics().ascent() - baselineShift;
+                int boxDescent = rt->style(firstLine)->font().fontMetrics().descent() + baselineShift;
+                if (boxAscent > rootDescent ||  boxDescent > rootAscent)
+                    glyphOverflow.computeBounds = true; 
+            }
+
             int hyphenWidth = 0;
             if (static_cast<InlineTextBox*>(r->m_box)->hasHyphen()) {
                 const AtomicString& hyphenString = rt->style()->hyphenString();
@@ -377,6 +450,7 @@ void RenderBlock::computeInlineDirectionPositionsForLine(RootInlineBox* lineBox,
                 GlyphOverflowAndFallbackFontsMap::iterator it = textBoxDataMap.add(static_cast<InlineTextBox*>(r->m_box), make_pair(Vector<const SimpleFontData*>(), GlyphOverflow())).first;
                 ASSERT(it->second.first.isEmpty());
                 copyToVector(fallbackFonts, it->second.first);
+                r->m_box->parent()->clearDescendantsHaveSameLineHeightAndBaseline();
             }
             if ((glyphOverflow.top || glyphOverflow.bottom || glyphOverflow.left || glyphOverflow.right)) {
                 ASSERT(r->m_box->isText());
@@ -408,17 +482,7 @@ void RenderBlock::computeInlineDirectionPositionsForLine(RootInlineBox* lineBox,
     switch (textAlign) {
         case LEFT:
         case WEBKIT_LEFT:
-            // The direction of the block should determine what happens with wide lines.  In
-            // particular with RTL blocks, wide lines should still spill out to the left.
-            if (style()->isLeftToRightDirection()) {
-                if (totalLogicalWidth > availableLogicalWidth && trailingSpaceRun)
-                    trailingSpaceRun->m_box->setLogicalWidth(max<float>(0, trailingSpaceRun->m_box->logicalWidth() - totalLogicalWidth + availableLogicalWidth));
-            } else {
-                if (trailingSpaceRun)
-                    trailingSpaceRun->m_box->setLogicalWidth(0);
-                else if (totalLogicalWidth > availableLogicalWidth)
-                    logicalLeft -= (totalLogicalWidth - availableLogicalWidth);
-            }
+            updateLogicalWidthForLeftAlignedBlock(style()->isLeftToRightDirection(), trailingSpaceRun, logicalLeft, totalLogicalWidth, availableLogicalWidth);
             break;
         case JUSTIFY:
             adjustInlineDirectionLineBounds(expansionOpportunityCount, logicalLeft, availableLogicalWidth);
@@ -439,40 +503,27 @@ void RenderBlock::computeInlineDirectionPositionsForLine(RootInlineBox* lineBox,
             }
         case RIGHT:
         case WEBKIT_RIGHT:
-            // Wide lines spill out of the block based off direction.
-            // So even if text-align is right, if direction is LTR, wide lines should overflow out of the right
-            // side of the block.
-            if (style()->isLeftToRightDirection()) {
-                if (trailingSpaceRun) {
-                    totalLogicalWidth -= trailingSpaceRun->m_box->logicalWidth();
-                    trailingSpaceRun->m_box->setLogicalWidth(0);
-                }
-                if (totalLogicalWidth < availableLogicalWidth)
-                    logicalLeft += availableLogicalWidth - totalLogicalWidth;
-            } else {
-                if (totalLogicalWidth > availableLogicalWidth && trailingSpaceRun) {
-                    trailingSpaceRun->m_box->setLogicalWidth(max<float>(0, trailingSpaceRun->m_box->logicalWidth() - totalLogicalWidth + availableLogicalWidth));
-                    totalLogicalWidth -= trailingSpaceRun->m_box->logicalWidth();
-                } else
-                    logicalLeft += availableLogicalWidth - totalLogicalWidth;
-            }
+            updateLogicalWidthForRightAlignedBlock(style()->isLeftToRightDirection(), trailingSpaceRun, logicalLeft, totalLogicalWidth, availableLogicalWidth);
             break;
         case CENTER:
         case WEBKIT_CENTER:
-            float trailingSpaceWidth = 0;
-            if (trailingSpaceRun) {
-                totalLogicalWidth -= trailingSpaceRun->m_box->logicalWidth();
-                trailingSpaceWidth = min(trailingSpaceRun->m_box->logicalWidth(), (availableLogicalWidth - totalLogicalWidth + 1) / 2);
-                trailingSpaceRun->m_box->setLogicalWidth(max<float>(0, trailingSpaceWidth));
-            }
+            updateLogicalWidthForCenterAlignedBlock(style()->isLeftToRightDirection(), trailingSpaceRun, logicalLeft, totalLogicalWidth, availableLogicalWidth);
+            break;
+        case TASTART:
             if (style()->isLeftToRightDirection())
-                logicalLeft += max<float>((availableLogicalWidth - totalLogicalWidth) / 2, 0);
+                updateLogicalWidthForLeftAlignedBlock(style()->isLeftToRightDirection(), trailingSpaceRun, logicalLeft, totalLogicalWidth, availableLogicalWidth);
             else
-                logicalLeft += totalLogicalWidth > availableLogicalWidth ? (availableLogicalWidth - totalLogicalWidth) : (availableLogicalWidth - totalLogicalWidth) / 2 - trailingSpaceWidth;
+                updateLogicalWidthForRightAlignedBlock(style()->isLeftToRightDirection(), trailingSpaceRun, logicalLeft, totalLogicalWidth, availableLogicalWidth);
+            break;
+        case TAEND:
+            if (style()->isLeftToRightDirection())
+                updateLogicalWidthForRightAlignedBlock(style()->isLeftToRightDirection(), trailingSpaceRun, logicalLeft, totalLogicalWidth, availableLogicalWidth);
+            else
+                updateLogicalWidthForLeftAlignedBlock(style()->isLeftToRightDirection(), trailingSpaceRun, logicalLeft, totalLogicalWidth, availableLogicalWidth);
             break;
     }
 
-    if (expansionOpportunityCount) {
+    if (expansionOpportunityCount && availableLogicalWidth > totalLogicalWidth) {
         size_t i = 0;
         for (BidiRun* r = firstRun; r; r = r->next()) {
             if (!r->m_box || r == trailingSpaceRun)
@@ -543,6 +594,49 @@ static inline bool isCollapsibleSpace(UChar character, RenderText* renderer)
     return false;
 }
 
+
+static void setStaticPositions(RenderBlock* block, RenderBox* child)
+{
+    // FIXME: The math here is actually not really right. It's a best-guess approximation that
+    // will work for the common cases
+    RenderObject* containerBlock = child->container();
+    int blockHeight = block->logicalHeight();
+    if (containerBlock->isRenderInline()) {
+        // A relative positioned inline encloses us. In this case, we also have to determine our
+        // position as though we were an inline. Set |staticInlinePosition| and |staticBlockPosition| on the relative positioned
+        // inline so that we can obtain the value later.
+        toRenderInline(containerBlock)->layer()->setStaticInlinePosition(block->startOffsetForLine(blockHeight, false));
+        toRenderInline(containerBlock)->layer()->setStaticBlockPosition(blockHeight);
+    }
+
+    if (child->style()->isOriginalDisplayInlineType())
+        child->layer()->setStaticInlinePosition(block->startOffsetForLine(blockHeight, false));
+    else
+        child->layer()->setStaticInlinePosition(block->borderAndPaddingStart());
+    child->layer()->setStaticBlockPosition(blockHeight);
+}
+
+static bool reachedEndOfTextRenderer(InlineBidiResolver& resolver)
+{
+    BidiRun* run = resolver.logicallyLastRun();
+    if (!run)
+        return true;
+    unsigned int pos = run->stop();
+    RenderObject* r = run->m_object;
+    if (!r->isText() || r->isBR())
+        return false;
+    RenderText* renderText = toRenderText(r);
+    if (pos >= renderText->textLength())
+        return true;
+
+    while (isASCIISpace(renderText->characters()[pos])) {
+        pos++;
+        if (pos >= renderText->textLength())
+            return true;
+    }
+    return false;
+}
+    
 void RenderBlock::layoutInlineChildren(bool relayoutChildren, int& repaintLogicalTop, int& repaintLogicalBottom)
 {
     bool useRepaintBounds = false;
@@ -748,7 +842,7 @@ void RenderBlock::layoutInlineChildren(bool relayoutChildren, int& repaintLogica
         BidiStatus cleanLineBidiStatus;
         int endLineLogicalTop = 0;
         RootInlineBox* endLine = (fullLayout || !startLine) ? 
-                                 0 : determineEndPosition(startLine, cleanLineStart, cleanLineBidiStatus, endLineLogicalTop);
+                                 0 : determineEndPosition(startLine, floats, floatIndex, cleanLineStart, cleanLineBidiStatus, endLineLogicalTop);
 
         if (startLine) {
             if (!useRepaintBounds) {
@@ -806,10 +900,11 @@ void RenderBlock::layoutInlineChildren(bool relayoutChildren, int& repaintLogica
             
             EClear clear = CNONE;
             bool hyphenated;
+            Vector<RenderBox*> positionedObjects;
             
             InlineIterator oldEnd = end;
             FloatingObject* lastFloatFromPreviousLine = (m_floatingObjects && !m_floatingObjects->set().isEmpty()) ? m_floatingObjects->set().last() : 0;
-            end = findNextLineBreak(resolver, firstLine, isLineEmpty, lineBreakIteratorInfo, previousLineBrokeCleanly, hyphenated, &clear, lastFloatFromPreviousLine);
+            end = findNextLineBreak(resolver, firstLine, isLineEmpty, lineBreakIteratorInfo, previousLineBrokeCleanly, hyphenated, &clear, lastFloatFromPreviousLine, positionedObjects);
             if (resolver.position().atEnd()) {
                 resolver.deleteRuns();
                 checkForFloatsFromLastLine = true;
@@ -817,7 +912,10 @@ void RenderBlock::layoutInlineChildren(bool relayoutChildren, int& repaintLogica
             }
             ASSERT(end != resolver.position());
 
-            if (!isLineEmpty) {
+            if (isLineEmpty) {
+                if (lastRootBox())
+                    lastRootBox()->setLineBreakInfo(end.m_obj, end.m_pos, resolver.status());
+            } else {
                 VisualDirectionOverride override = (style()->visuallyOrdered() ? (style()->direction() == LTR ? VisualLeftToRightOverride : VisualRightToLeftOverride) : NoVisualOverride);
                 resolver.createBidiRunsForLine(end, override, previousLineBrokeCleanly);
                 ASSERT(resolver.position() == end);
@@ -879,7 +977,8 @@ void RenderBlock::layoutInlineChildren(bool relayoutChildren, int& repaintLogica
                 if (resolver.runCount()) {
                     if (hyphenated)
                         resolver.logicallyLastRun()->m_hasHyphen = true;
-                    lineBox = constructLine(resolver.runCount(), resolver.firstRun(), resolver.lastRun(), firstLine, !end.obj, end.obj && !end.pos ? end.obj : 0);
+                    bool lastLine = end.m_obj && end.m_obj->isText() ? reachedEndOfTextRenderer(resolver) : !end.m_obj;
+                    lineBox = constructLine(resolver.runCount(), resolver.firstRun(), resolver.lastRun(), firstLine, lastLine, end.m_obj && !end.m_pos ? end.m_obj : 0, resolver.logicallyLastRun()->m_object);
                     if (lineBox) {
                         lineBox->setEndsWithBreak(previousLineBrokeCleanly);
 
@@ -890,10 +989,10 @@ void RenderBlock::layoutInlineChildren(bool relayoutChildren, int& repaintLogica
 #endif
 
                         GlyphOverflowAndFallbackFontsMap textBoxDataMap;
-
+                    
                         // Now we position all of our text runs horizontally.
                         if (!isSVGRootInlineBox)
-                            computeInlineDirectionPositionsForLine(lineBox, firstLine, resolver.firstRun(), trailingSpaceRun, end.atEnd(), textBoxDataMap);
+                            computeInlineDirectionPositionsForLine(lineBox, firstLine, resolver.firstRun(), trailingSpaceRun, end.atEnd(), textBoxDataMap, verticalPositionCache);
 
                         // Now position our text runs vertically.
                         computeBlockDirectionPositionsForLine(lineBox, resolver.firstRun(), textBoxDataMap, verticalPositionCache);
@@ -924,7 +1023,7 @@ void RenderBlock::layoutInlineChildren(bool relayoutChildren, int& repaintLogica
                 resolver.deleteRuns();
 
                 if (lineBox) {
-                    lineBox->setLineBreakInfo(end.obj, end.pos, resolver.status());
+                    lineBox->setLineBreakInfo(end.m_obj, end.m_pos, resolver.status());
                     if (useRepaintBounds) {
                         repaintLogicalTop = min(repaintLogicalTop, beforeSideVisualOverflowForLine(lineBox));
                         repaintLogicalBottom = max(repaintLogicalBottom, afterSideVisualOverflowForLine(lineBox));
@@ -954,6 +1053,9 @@ void RenderBlock::layoutInlineChildren(bool relayoutChildren, int& repaintLogica
                     }
                 }
 
+                for (size_t i = 0; i < positionedObjects.size(); ++i)
+                    setStaticPositions(this, positionedObjects[i]);
+
                 firstLine = false;
                 newLine(clear);
             }
@@ -1081,7 +1183,7 @@ void RenderBlock::layoutInlineChildren(bool relayoutChildren, int& repaintLogica
     setLogicalHeight(logicalHeight() + lastLineAnnotationsAdjustment + borderAfter() + paddingAfter() + scrollbarLogicalHeight());
 
     if (!firstLineBox() && hasLineIfEmpty())
-        setLogicalHeight(logicalHeight() + lineHeight(true, style()->isHorizontalWritingMode() ? HorizontalLine : VerticalLine, PositionOfInteriorLineBoxes));
+        setLogicalHeight(logicalHeight() + lineHeight(true, isHorizontalWritingMode() ? HorizontalLine : VerticalLine, PositionOfInteriorLineBoxes));
 
     // See if we have any lines that spill out of our block.  If we do, then we will possibly need to
     // truncate text.
@@ -1089,6 +1191,35 @@ void RenderBlock::layoutInlineChildren(bool relayoutChildren, int& repaintLogica
         checkLinesForTextOverflow();
 }
 
+void RenderBlock::checkFloatsInCleanLine(RootInlineBox* line, Vector<FloatWithRect>& floats, size_t& floatIndex, bool& encounteredNewFloat, bool& dirtiedByFloat)
+{
+    Vector<RenderBox*>* cleanLineFloats = line->floatsPtr();
+    if (!cleanLineFloats)
+        return;
+
+    Vector<RenderBox*>::iterator end = cleanLineFloats->end();
+    for (Vector<RenderBox*>::iterator it = cleanLineFloats->begin(); it != end; ++it) {
+        RenderBox* floatingBox = *it;
+        floatingBox->layoutIfNeeded();
+        IntSize newSize(floatingBox->width() + floatingBox->marginLeft() + floatingBox->marginRight(), floatingBox->height() + floatingBox->marginTop() + floatingBox->marginBottom());
+        ASSERT(floatIndex < floats.size());
+        if (floats[floatIndex].object != floatingBox) {
+            encounteredNewFloat = true;
+            return;
+        }
+        if (floats[floatIndex].rect.size() != newSize) {
+            int floatTop = isHorizontalWritingMode() ? floats[floatIndex].rect.y() : floats[floatIndex].rect.x();
+            int floatHeight = isHorizontalWritingMode() ? max(floats[floatIndex].rect.height(), newSize.height()) 
+                                                                 : max(floats[floatIndex].rect.width(), newSize.width());
+            line->markDirty();
+            markLinesDirtyInBlockRange(line->blockLogicalHeight(), floatTop + floatHeight, line);
+            floats[floatIndex].rect.setSize(newSize);
+            dirtiedByFloat = true;
+        }
+        floatIndex++;
+    }
+}
+
 RootInlineBox* RenderBlock::determineStartPosition(bool& firstLine, bool& fullLayout, bool& previousLineBrokeCleanly, 
                                                    InlineBidiResolver& resolver, Vector<FloatWithRect>& floats, unsigned& numCleanFloats,
                                                    bool& useRepaintBounds, int& repaintLogicalTop, int& repaintLogicalBottom)
@@ -1121,32 +1252,9 @@ RootInlineBox* RenderBlock::determineStartPosition(bool& firstLine, bool& fullLa
                     curr->adjustBlockDirectionPosition(paginationDelta);
                 }                
             }
-            
-            if (Vector<RenderBox*>* cleanLineFloats = curr->floatsPtr()) {
-                Vector<RenderBox*>::iterator end = cleanLineFloats->end();
-                for (Vector<RenderBox*>::iterator o = cleanLineFloats->begin(); o != end; ++o) {
-                    RenderBox* f = *o;
-                    f->layoutIfNeeded();
-                    IntSize newSize(f->width() + f->marginLeft() + f->marginRight(), f->height() + f->marginTop() + f->marginBottom());
-                    ASSERT(floatIndex < floats.size());
-                    if (floats[floatIndex].object != f) {
-                        // A new float has been inserted before this line or before its last known float.
-                        // Just do a full layout.
-                        fullLayout = true;
-                        break;
-                    }
-                    if (floats[floatIndex].rect.size() != newSize) {
-                        int floatTop = style()->isHorizontalWritingMode() ? floats[floatIndex].rect.y() : floats[floatIndex].rect.x();
-                        int floatHeight = style()->isHorizontalWritingMode() ? max(floats[floatIndex].rect.height(), newSize.height()) 
-                                                                             : max(floats[floatIndex].rect.width(), newSize.width());
-                        curr->markDirty();
-                        markLinesDirtyInBlockRange(curr->blockLogicalHeight(), floatTop + floatHeight, curr);
-                        floats[floatIndex].rect.setSize(newSize);
-                        dirtiedByFloat = true;
-                    }
-                    floatIndex++;
-                }
-            }
+
+            // If a new float has been inserted before this line or before its last known float,just do a full layout.
+            checkFloatsInCleanLine(curr, floats, floatIndex, fullLayout, dirtiedByFloat);
             if (dirtiedByFloat || fullLayout)
                 break;
         }
@@ -1220,17 +1328,12 @@ RootInlineBox* RenderBlock::determineStartPosition(bool& firstLine, bool& fullLa
         pos = last->lineBreakPos();
         resolver.setStatus(last->lineBreakBidiStatus());
     } else {
-        bool ltr = style()->isLeftToRightDirection()
-    #if ENABLE(SVG)   
-            || (style()->unicodeBidi() == UBNormal && isSVGText())
-    #endif
-            ;
-
+        bool ltr = style()->isLeftToRightDirection();
         Direction direction = ltr ? LeftToRight : RightToLeft;
         resolver.setLastStrongDir(direction);
         resolver.setLastDir(direction);
         resolver.setEorDir(direction);
-        resolver.setContext(BidiContext::create(ltr ? 0 : 1, direction, style()->unicodeBidi() == Override));
+        resolver.setContext(BidiContext::create(ltr ? 0 : 1, direction, style()->unicodeBidi() == Override, FromStyleOrDOM));
 
         startObj = bidiFirst(this, &resolver);
     }
@@ -1240,23 +1343,29 @@ RootInlineBox* RenderBlock::determineStartPosition(bool& firstLine, bool& fullLa
     return curr;
 }
 
-RootInlineBox* RenderBlock::determineEndPosition(RootInlineBox* startLine, InlineIterator& cleanLineStart, BidiStatus& cleanLineBidiStatus, int& logicalTop)
+RootInlineBox* RenderBlock::determineEndPosition(RootInlineBox* startLine, Vector<FloatWithRect>& floats, size_t floatIndex, InlineIterator& cleanLineStart, BidiStatus& cleanLineBidiStatus, int& logicalTop)
 {
     RootInlineBox* last = 0;
-    if (!startLine)
-        last = 0;
-    else {
-        for (RootInlineBox* curr = startLine->nextRootBox(); curr; curr = curr->nextRootBox()) {
-            if (curr->isDirty())
-                last = 0;
-            else if (!last)
-                last = curr;
+    for (RootInlineBox* curr = startLine->nextRootBox(); curr; curr = curr->nextRootBox()) {
+        if (!curr->isDirty()) {
+            bool encounteredNewFloat = false;
+            bool dirtiedByFloat = false;
+            checkFloatsInCleanLine(curr, floats, floatIndex, encounteredNewFloat, dirtiedByFloat);
+            if (encounteredNewFloat)
+                return 0;
         }
+        if (curr->isDirty())
+            last = 0;
+        else if (!last)
+            last = curr;
     }
 
     if (!last)
         return 0;
 
+    // At this point, |last| is the first line in a run of clean lines that ends with the last line
+    // in the block.
+
     RootInlineBox* prev = last->prevRootBox();
     cleanLineStart = InlineIterator(this, prev->lineBreakObj(), prev->lineBreakPos());
     cleanLineBidiStatus = prev->lineBreakBidiStatus();
@@ -1305,7 +1414,7 @@ bool RenderBlock::matchedEndLine(const InlineBidiResolver& resolver, const Inlin
     static int numLines = 8; // The # of lines we're willing to match against.
     RootInlineBox* line = endLine;
     for (int i = 0; i < numLines && line; i++, line = line->nextRootBox()) {
-        if (line->lineBreakObj() == resolver.position().obj && line->lineBreakPos() == resolver.position().pos) {
+        if (line->lineBreakObj() == resolver.position().m_obj && line->lineBreakPos() == resolver.position().m_pos) {
             // We have a match.
             if (line->lineBreakBidiStatus() != resolver.status())
                 return false; // ...but the bidi state doesn't match.
@@ -1356,7 +1465,7 @@ bool RenderBlock::matchedEndLine(const InlineBidiResolver& resolver, const Inlin
 
 static inline bool skipNonBreakingSpace(const InlineIterator& it, bool isLineEmpty, bool previousLineBrokeCleanly)
 {
-    if (it.obj->style()->nbspMode() != SPACE || it.current() != noBreakSpace)
+    if (it.m_obj->style()->nbspMode() != SPACE || it.current() != noBreakSpace)
         return false;
 
     // FIXME: This is bad.  It makes nbsp inconsistent with space and won't work correctly
@@ -1395,17 +1504,17 @@ static bool inlineFlowRequiresLineBox(RenderInline* flow)
 
 bool RenderBlock::requiresLineBox(const InlineIterator& it, bool isLineEmpty, bool previousLineBrokeCleanly)
 {
-    if (it.obj->isFloatingOrPositioned())
+    if (it.m_obj->isFloatingOrPositioned())
         return false;
 
-    if (it.obj->isRenderInline() && !inlineFlowRequiresLineBox(toRenderInline(it.obj)))
+    if (it.m_obj->isRenderInline() && !inlineFlowRequiresLineBox(toRenderInline(it.m_obj)))
         return false;
 
-    if (!shouldCollapseWhiteSpace(it.obj->style(), isLineEmpty, previousLineBrokeCleanly) || it.obj->isBR())
+    if (!shouldCollapseWhiteSpace(it.m_obj->style(), isLineEmpty, previousLineBrokeCleanly) || it.m_obj->isBR())
         return true;
 
     UChar current = it.current();
-    return current != ' ' && current != '\t' && current != softHyphen && (current != '\n' || shouldPreserveNewline(it.obj)) 
+    return current != ' ' && current != '\t' && current != softHyphen && (current != '\n' || shouldPreserveNewline(it.m_obj)) 
             && !skipNonBreakingSpace(it, isLineEmpty, previousLineBrokeCleanly);
 }
 
@@ -1420,34 +1529,6 @@ bool RenderBlock::generatesLineBoxesForInlineChild(RenderObject* inlineObj, bool
     return !it.atEnd();
 }
 
-static void setStaticPositions(RenderBlock* block, RenderBox* child)
-{
-    // FIXME: The math here is actually not really right. It's a best-guess approximation that
-    // will work for the common cases
-    RenderObject* containerBlock = child->container();
-    if (containerBlock->isRenderInline()) {
-        // A relative positioned inline encloses us. In this case, we also have to determine our
-        // position as though we were an inline. Set |staticInlinePosition| and |staticBlockPosition| on the relative positioned
-        // inline so that we can obtain the value later.
-        toRenderInline(containerBlock)->layer()->setStaticInlinePosition(block->startOffsetForLine(block->logicalHeight(), false));
-        toRenderInline(containerBlock)->layer()->setStaticBlockPosition(block->logicalHeight());
-    }
-
-    bool isHorizontal = block->style()->isHorizontalWritingMode();
-    bool hasStaticInlinePosition = child->style()->hasStaticInlinePosition(isHorizontal);
-    bool hasStaticBlockPosition = child->style()->hasStaticBlockPosition(isHorizontal);
-
-    if (hasStaticInlinePosition) {
-        if (child->style()->isOriginalDisplayInlineType())
-            child->layer()->setStaticInlinePosition(block->startOffsetForLine(block->logicalHeight(), false));
-        else
-            child->layer()->setStaticInlinePosition(block->borderAndPaddingStart());
-    }
-
-    if (hasStaticBlockPosition)
-        child->layer()->setStaticBlockPosition(block->logicalHeight());
-}
-
 // FIXME: The entire concept of the skipTrailingWhitespace function is flawed, since we really need to be building
 // line boxes even for containers that may ultimately collapse away.  Otherwise we'll never get positioned
 // elements quite right.  In other words, we need to build this function's work into the normal line
@@ -1457,7 +1538,7 @@ static void setStaticPositions(RenderBlock* block, RenderBox* child)
 void RenderBlock::skipTrailingWhitespace(InlineIterator& iterator, bool isLineEmpty, bool previousLineBrokeCleanly)
 {
     while (!iterator.atEnd() && !requiresLineBox(iterator, isLineEmpty, previousLineBrokeCleanly)) {
-        RenderObject* object = iterator.obj;
+        RenderObject* object = iterator.m_obj;
         if (object->isFloating()) {
             insertFloatingObject(toRenderBox(object));
         } else if (object->isPositioned())
@@ -1466,21 +1547,18 @@ void RenderBlock::skipTrailingWhitespace(InlineIterator& iterator, bool isLineEm
     }
 }
 
-int RenderBlock::skipLeadingWhitespace(InlineBidiResolver& resolver, bool firstLine, bool isLineEmpty, bool previousLineBrokeCleanly,
-                                       FloatingObject* lastFloatFromPreviousLine)
+void RenderBlock::skipLeadingWhitespace(InlineBidiResolver& resolver, bool firstLine, bool isLineEmpty, bool previousLineBrokeCleanly,
+                                       FloatingObject* lastFloatFromPreviousLine, int& lineLeftOffset, int& lineRightOffset)
 {
-    int availableWidth = availableLogicalWidthForLine(logicalHeight(), firstLine);
     while (!resolver.position().atEnd() && !requiresLineBox(resolver.position(), isLineEmpty, previousLineBrokeCleanly)) {
-        RenderObject* object = resolver.position().obj;
-        if (object->isFloating()) {
-            positionNewFloatOnLine(insertFloatingObject(toRenderBox(object)), lastFloatFromPreviousLine);
-            availableWidth = availableLogicalWidthForLine(logicalHeight(), firstLine);
-        } else if (object->isPositioned())
+        RenderObject* object = resolver.position().m_obj;
+        if (object->isFloating())
+            positionNewFloatOnLine(insertFloatingObject(toRenderBox(object)), lastFloatFromPreviousLine, firstLine, lineLeftOffset, lineRightOffset);
+        else if (object->isPositioned())
             setStaticPositions(this, toRenderBox(object));
         resolver.increment();
     }
     resolver.commitExplicitEmbedding();
-    return availableWidth;
 }
 
 // This is currently just used for list markers and inline flows that have line boxes. Neither should 
@@ -1560,7 +1638,7 @@ static void tryHyphenating(RenderText* text, const Font& font, const AtomicStrin
     // FIXME: The following assumes that the character at lastSpace is a space (and therefore should not factor
     // into hyphenate-limit-before) unless lastSpace is 0. This is wrong in the rare case of hyphenating
     // the first word in a text node which has leading whitespace.
-    if (prefixLength - (lastSpace ? 1 : 0) < static_cast<unsigned>(minimumPrefixLength))
+    if (!prefixLength || prefixLength - (lastSpace ? 1 : 0) < static_cast<unsigned>(minimumPrefixLength))
         return;
 
     ASSERT(pos - lastSpace - prefixLength >= static_cast<unsigned>(minimumSuffixLength));
@@ -1572,22 +1650,25 @@ static void tryHyphenating(RenderText* text, const Font& font, const AtomicStrin
     UNUSED_PARAM(isFixedPitch);
 #endif
 
-    lineBreak.obj = text;
-    lineBreak.pos = lastSpace + prefixLength;
-    lineBreak.nextBreakablePosition = nextBreakable;
+    lineBreak.moveTo(text, lastSpace + prefixLength, nextBreakable);
     hyphenated = true;
 }
 
 InlineIterator RenderBlock::findNextLineBreak(InlineBidiResolver& resolver, bool firstLine, bool& isLineEmpty, LineBreakIteratorInfo& lineBreakIteratorInfo, bool& previousLineBrokeCleanly, 
-                                              bool& hyphenated, EClear* clear, FloatingObject* lastFloatFromPreviousLine)
+                                              bool& hyphenated, EClear* clear, FloatingObject* lastFloatFromPreviousLine, Vector<RenderBox*>& positionedBoxes)
 {
-    ASSERT(resolver.position().block == this);
+    ASSERT(resolver.position().m_block == this);
 
-    bool appliedStartWidth = resolver.position().pos > 0;
+    bool appliedStartWidth = resolver.position().m_pos > 0;
     LineMidpointState& lineMidpointState = resolver.midpointState();
     
-    float width = skipLeadingWhitespace(resolver, firstLine, isLineEmpty, previousLineBrokeCleanly, lastFloatFromPreviousLine);
+    int blockOffset = logicalHeight();
+    int lineLeftOffset = logicalLeftOffsetForLine(blockOffset, firstLine);
+    int lineRightOffset = logicalRightOffsetForLine(blockOffset, firstLine);
+    
+    skipLeadingWhitespace(resolver, firstLine, isLineEmpty, previousLineBrokeCleanly, lastFloatFromPreviousLine, lineLeftOffset, lineRightOffset);
 
+    float width = max(0, lineRightOffset - lineLeftOffset);
     float w = 0;
     float tmpW = 0;
 
@@ -1605,13 +1686,16 @@ InlineIterator RenderBlock::findNextLineBreak(InlineBidiResolver& resolver, bool
     bool currentCharacterIsSpace = false;
     bool currentCharacterIsWS = false;
     RenderObject* trailingSpaceObject = 0;
+    Vector<RenderBox*, 4> trailingPositionedBoxes;
 
     InlineIterator lBreak = resolver.position();
 
-    RenderObject* o = resolver.position().obj;
+    // FIXME: It is error-prone to split the position object out like this.
+    // Teach this code to work with objects instead of this split tuple.
+    RenderObject* o = resolver.position().m_obj;
     RenderObject* last = o;
-    unsigned pos = resolver.position().pos;
-    int nextBreakable = resolver.position().nextBreakablePosition;
+    unsigned pos = resolver.position().m_pos;
+    int nextBreakable = resolver.position().m_nextBreakablePosition;
     bool atStart = true;
 
     bool prevLineBrokeCleanly = previousLineBrokeCleanly;
@@ -1646,9 +1730,7 @@ InlineIterator RenderBlock::findNextLineBreak(InlineBidiResolver& resolver, bool
             
         if (o->isBR()) {
             if (w + tmpW <= width) {
-                lBreak.obj = o;
-                lBreak.pos = 0;
-                lBreak.nextBreakablePosition = -1;
+                lBreak.moveToStartOf(o);
                 lBreak.increment();
 
                 // A <br> always breaks a line, so don't let the line be collapsed
@@ -1676,8 +1758,12 @@ InlineIterator RenderBlock::findNextLineBreak(InlineBidiResolver& resolver, bool
                 // If it does, position it now, otherwise, position
                 // it after moving to next line (in newLine() func)
                 if (floatsFitOnLine && logicalWidthForFloat(f) + w + tmpW <= width) {
-                    positionNewFloatOnLine(f, lastFloatFromPreviousLine);
-                    width = availableLogicalWidthForLine(logicalHeight(), firstLine);
+                    positionNewFloatOnLine(f, lastFloatFromPreviousLine, firstLine, lineLeftOffset, lineRightOffset);
+                    width = max(0, lineRightOffset - lineLeftOffset);
+                    if (lBreak.m_obj == o) {
+                        ASSERT(!lBreak.m_pos);
+                        lBreak.increment();
+                    }
                 } else
                     floatsFitOnLine = false;
             } else if (o->isPositioned()) {
@@ -1685,37 +1771,27 @@ InlineIterator RenderBlock::findNextLineBreak(InlineBidiResolver& resolver, bool
                 // go ahead and determine our static inline position now.
                 RenderBox* box = toRenderBox(o);
                 bool isInlineType = box->style()->isOriginalDisplayInlineType();
-                bool needToSetStaticInlinePosition = box->style()->hasStaticInlinePosition(style()->isHorizontalWritingMode());
-                if (needToSetStaticInlinePosition && !isInlineType) {
+                if (!isInlineType)
                     box->layer()->setStaticInlinePosition(borderAndPaddingStart());
-                    needToSetStaticInlinePosition = false;
-                }
-
-                // If our original display was an INLINE type, then we can go ahead
-                // and determine our static y position now.
-                bool needToSetStaticBlockPosition = box->style()->hasStaticBlockPosition(style()->isHorizontalWritingMode());
-                if (needToSetStaticBlockPosition && isInlineType) {
+                else  {
+                    // If our original display was an INLINE type, then we can go ahead
+                    // and determine our static y position now.
                     box->layer()->setStaticBlockPosition(logicalHeight());
-                    needToSetStaticBlockPosition = false;
                 }
                 
-                bool needToCreateLineBox = needToSetStaticInlinePosition || needToSetStaticBlockPosition;
-                RenderObject* c = o->container();
-                if (c->isRenderInline() && (!needToSetStaticInlinePosition || !needToSetStaticBlockPosition))
-                    needToCreateLineBox = true;
-
                 // If we're ignoring spaces, we have to stop and include this object and
                 // then start ignoring spaces again.
-                if (needToCreateLineBox) {
-                    trailingSpaceObject = 0;
-                    ignoreStart.obj = o;
-                    ignoreStart.pos = 0;
+                if (isInlineType || o->container()->isRenderInline()) {
                     if (ignoringSpaces) {
+                        ignoreStart.m_obj = o;
+                        ignoreStart.m_pos = 0;
                         addMidpoint(lineMidpointState, ignoreStart); // Stop ignoring spaces.
                         addMidpoint(lineMidpointState, ignoreStart); // Start ignoring again.
                     }
-                    
-                }
+                    if (trailingSpaceObject)
+                        trailingPositionedBoxes.append(box);
+                } else
+                    positionedBoxes.append(box);
             }
         } else if (o->isRenderInline()) {
             // Right now, we should only encounter empty inlines here.
@@ -1731,9 +1807,10 @@ InlineIterator RenderBlock::findNextLineBreak(InlineBidiResolver& resolver, bool
                 isLineEmpty = false;
                 if (ignoringSpaces) {
                     trailingSpaceObject = 0;
+                    trailingPositionedBoxes.clear();
                     addMidpoint(lineMidpointState, InlineIterator(0, o, 0)); // Stop ignoring spaces.
                     addMidpoint(lineMidpointState, InlineIterator(0, o, 0)); // Start ignoring again.
-                } else if (style()->collapseWhiteSpace() && resolver.position().obj == o
+                } else if (style()->collapseWhiteSpace() && resolver.position().m_obj == o
                     && shouldSkipWhitespaceAfterStartObject(this, o, lineMidpointState)) {
                     // Like with list markers, we start ignoring spaces to make sure that any 
                     // additional spaces we see will be discarded.
@@ -1752,9 +1829,7 @@ InlineIterator RenderBlock::findNextLineBreak(InlineBidiResolver& resolver, bool
             if ((autoWrap || RenderStyle::autoWrap(lastWS)) && (!o->isImage() || allowImagesToBreak)) {
                 w += tmpW;
                 tmpW = 0;
-                lBreak.obj = o;
-                lBreak.pos = 0;
-                lBreak.nextBreakablePosition = -1;
+                lBreak.moveToStartOf(o);
             }
 
             if (ignoringSpaces)
@@ -1765,6 +1840,7 @@ InlineIterator RenderBlock::findNextLineBreak(InlineBidiResolver& resolver, bool
             currentCharacterIsSpace = false;
             currentCharacterIsWS = false;
             trailingSpaceObject = 0;
+            trailingPositionedBoxes.clear();
 
             // Optimize for a common case. If we can't find whitespace after the list
             // item, then this is all moot.
@@ -1792,7 +1868,7 @@ InlineIterator RenderBlock::findNextLineBreak(InlineBidiResolver& resolver, bool
 #endif
 
             RenderStyle* style = t->style(firstLine);
-            if (style->hasTextCombine())
+            if (style->hasTextCombine() && o->isCombineText())
                 toRenderCombineText(o)->combineText();
 
             int strlen = t->textLength();
@@ -1824,9 +1900,7 @@ InlineIterator RenderBlock::findNextLineBreak(InlineBidiResolver& resolver, bool
             if (t->isWordBreak()) {
                 w += tmpW;
                 tmpW = 0;
-                lBreak.obj = o;
-                lBreak.pos = 0;
-                lBreak.nextBreakablePosition = -1;
+                lBreak.moveToStartOf(o);
                 ASSERT(!len);
             }
 
@@ -1922,9 +1996,7 @@ InlineIterator RenderBlock::findNextLineBreak(InlineBidiResolver& resolver, bool
                             // additional whitespace.
                             if (w + tmpW + charWidth > width) {
                                 lineWasTooWide = true;
-                                lBreak.obj = o;
-                                lBreak.pos = pos;
-                                lBreak.nextBreakablePosition = nextBreakable;
+                                lBreak.moveTo(o, pos, nextBreakable);
                                 skipTrailingWhitespace(lBreak, isLineEmpty, previousLineBrokeCleanly);
                             }
                         }
@@ -1934,7 +2006,7 @@ InlineIterator RenderBlock::findNextLineBreak(InlineBidiResolver& resolver, bool
                                 if (hyphenated)
                                     goto end;
                             }
-                            if (lBreak.obj && shouldPreserveNewline(lBreak.obj) && lBreak.obj->isText() && toRenderText(lBreak.obj)->textLength() && !toRenderText(lBreak.obj)->isWordBreak() && toRenderText(lBreak.obj)->characters()[lBreak.pos] == '\n') {
+                            if (lBreak.m_obj && shouldPreserveNewline(lBreak.m_obj) && lBreak.m_obj->isText() && toRenderText(lBreak.m_obj)->textLength() && !toRenderText(lBreak.m_obj)->isWordBreak() && toRenderText(lBreak.m_obj)->characters()[lBreak.m_pos] == '\n') {
                                 if (!stoppedIgnoringSpaces && pos > 0) {
                                     // We need to stop right before the newline and then start up again.
                                     addMidpoint(lineMidpointState, InlineIterator(0, o, pos - 1)); // Stop
@@ -1943,7 +2015,7 @@ InlineIterator RenderBlock::findNextLineBreak(InlineBidiResolver& resolver, bool
                                 lBreak.increment();
                                 previousLineBrokeCleanly = true;
                             }
-                            if (lBreak.obj && lBreak.pos && lBreak.obj->isText() && toRenderText(lBreak.obj)->textLength() && toRenderText(lBreak.obj)->characters()[lBreak.pos - 1] == softHyphen && style->hyphens() != HyphensNone)
+                            if (lBreak.m_obj && lBreak.m_pos && lBreak.m_obj->isText() && toRenderText(lBreak.m_obj)->textLength() && toRenderText(lBreak.m_obj)->characters()[lBreak.m_pos - 1] == softHyphen && style->hyphens() != HyphensNone)
                                 hyphenated = true;
                             goto end; // Didn't fit. Jump to the end.
                         } else {
@@ -1963,9 +2035,7 @@ InlineIterator RenderBlock::findNextLineBreak(InlineBidiResolver& resolver, bool
                             addMidpoint(lineMidpointState, InlineIterator(0, o, pos - 1)); // Stop
                             addMidpoint(lineMidpointState, InlineIterator(0, o, pos)); // Start
                         }
-                        lBreak.obj = o;
-                        lBreak.pos = pos;
-                        lBreak.nextBreakablePosition = nextBreakable;
+                        lBreak.moveTo(o, pos, nextBreakable);
                         lBreak.increment();
                         previousLineBrokeCleanly = true;
                         return lBreak;
@@ -1975,9 +2045,7 @@ InlineIterator RenderBlock::findNextLineBreak(InlineBidiResolver& resolver, bool
                         w += tmpW;
                         wrapW = 0;
                         tmpW = 0;
-                        lBreak.obj = o;
-                        lBreak.pos = pos;
-                        lBreak.nextBreakablePosition = nextBreakable;
+                        lBreak.moveTo(o, pos, nextBreakable);
                         // Auto-wrapping text should not wrap in the middle of a word once it has had an
                         // opportunity to break after a word.
                         breakWords = false;
@@ -1986,9 +2054,7 @@ InlineIterator RenderBlock::findNextLineBreak(InlineBidiResolver& resolver, bool
                     if (midWordBreak) {
                         // Remember this as a breakable position in case
                         // adding the end width forces a break.
-                        lBreak.obj = o;
-                        lBreak.pos = pos;
-                        lBreak.nextBreakablePosition = nextBreakable;
+                        lBreak.moveTo(o, pos, nextBreakable);
                         midWordBreak &= (breakWords || breakAll);
                     }
 
@@ -2020,22 +2086,21 @@ InlineIterator RenderBlock::findNextLineBreak(InlineBidiResolver& resolver, bool
                 }
 
                 if (currentCharacterIsSpace && !previousCharacterIsSpace) {
-                    ignoreStart.obj = o;
-                    ignoreStart.pos = pos;
+                    ignoreStart.m_obj = o;
+                    ignoreStart.m_pos = pos;
                 }
 
                 if (!currentCharacterIsWS && previousCharacterIsWS) {
-                    if (autoWrap && o->style()->breakOnlyAfterWhiteSpace()) {
-                        lBreak.obj = o;
-                        lBreak.pos = pos;
-                        lBreak.nextBreakablePosition = nextBreakable;
-                    }
+                    if (autoWrap && o->style()->breakOnlyAfterWhiteSpace())
+                        lBreak.moveTo(o, pos, nextBreakable);
                 }
                 
                 if (collapseWhiteSpace && currentCharacterIsSpace && !ignoringSpaces)
                     trailingSpaceObject = o;
-                else if (!o->style()->collapseWhiteSpace() || !currentCharacterIsSpace)
+                else if (!o->style()->collapseWhiteSpace() || !currentCharacterIsSpace) {
                     trailingSpaceObject = 0;
+                    trailingPositionedBoxes.clear();
+                }
                     
                 pos++;
                 len--;
@@ -2047,8 +2112,13 @@ InlineIterator RenderBlock::findNextLineBreak(InlineBidiResolver& resolver, bool
             tmpW += additionalTmpW;
             tmpW += inlineLogicalWidth(o, !appliedStartWidth, true);
 
-            if (canHyphenate && w + tmpW > width) {
-                tryHyphenating(t, f, style->locale(), style->hyphenationLimitBefore(), style->hyphenationLimitAfter(), lastSpace, pos, w + tmpW - additionalTmpW, width, isFixedPitch, collapseWhiteSpace, lastSpaceWordSpacing, lBreak, nextBreakable, hyphenated);
+            if (w + tmpW > width) {
+                if (canHyphenate)
+                    tryHyphenating(t, f, style->locale(), style->hyphenationLimitBefore(), style->hyphenationLimitAfter(), lastSpace, pos, w + tmpW - additionalTmpW, width, isFixedPitch, collapseWhiteSpace, lastSpaceWordSpacing, lBreak, nextBreakable, hyphenated);
+                
+                if (!hyphenated && lBreak.m_obj && lBreak.m_pos && lBreak.m_obj->isText() && toRenderText(lBreak.m_obj)->textLength() && toRenderText(lBreak.m_obj)->characters()[lBreak.m_pos - 1] == softHyphen && style->hyphens() != HyphensNone)
+                    hyphenated = true;
+                
                 if (hyphenated)
                     goto end;
             }
@@ -2057,7 +2127,7 @@ InlineIterator RenderBlock::findNextLineBreak(InlineBidiResolver& resolver, bool
 
         RenderObject* next = bidiNext(this, o);
         bool checkForBreak = autoWrap;
-        if (w && w + tmpW > width && lBreak.obj && currWS == NOWRAP)
+        if (w && w + tmpW > width && lBreak.m_obj && currWS == NOWRAP)
             checkForBreak = true;
         else if (next && o->isText() && next->isText() && !next->isBR()) {
             if (autoWrap || (next->style()->autoWrap())) {
@@ -2084,9 +2154,7 @@ InlineIterator RenderBlock::findNextLineBreak(InlineBidiResolver& resolver, bool
                     if (canPlaceOnLine && checkForBreak) {
                         w += tmpW;
                         tmpW = 0;
-                        lBreak.obj = next;
-                        lBreak.pos = 0;
-                        lBreak.nextBreakablePosition = -1;
+                        lBreak.moveToStartOf(next);
                     }
                 }
             }
@@ -2094,8 +2162,10 @@ InlineIterator RenderBlock::findNextLineBreak(InlineBidiResolver& resolver, bool
 
         if (checkForBreak && (w + tmpW > width)) {
             // if we have floats, try to get below them.
-            if (currentCharacterIsSpace && !ignoringSpaces && o->style()->collapseWhiteSpace())
+            if (currentCharacterIsSpace && !ignoringSpaces && o->style()->collapseWhiteSpace()) {
                 trailingSpaceObject = 0;
+                trailingPositionedBoxes.clear();
+            }
 
             if (w)
                 goto end;
@@ -2114,9 +2184,7 @@ InlineIterator RenderBlock::findNextLineBreak(InlineBidiResolver& resolver, bool
             if (last->isReplaced() && autoWrap && (!last->isImage() || allowImagesToBreak) && (!last->isListMarker() || toRenderListMarker(last)->isInside())) {
                 w += tmpW;
                 tmpW = 0;
-                lBreak.obj = next;
-                lBreak.pos = 0;
-                lBreak.nextBreakablePosition = -1;
+                lBreak.moveToStartOf(next);
             }
         }
 
@@ -2133,32 +2201,26 @@ InlineIterator RenderBlock::findNextLineBreak(InlineBidiResolver& resolver, bool
     }
 
     
-    if (w + tmpW <= width || lastWS == NOWRAP) {
-        lBreak.obj = 0;
-        lBreak.pos = 0;
-        lBreak.nextBreakablePosition = -1;
-    }
+    if (w + tmpW <= width || lastWS == NOWRAP)
+        lBreak.clear();
 
  end:
-    if (lBreak == resolver.position() && (!lBreak.obj || !lBreak.obj->isBR())) {
+    if (lBreak == resolver.position() && (!lBreak.m_obj || !lBreak.m_obj->isBR())) {
         // we just add as much as possible
         if (style()->whiteSpace() == PRE) {
             // FIXME: Don't really understand this case.
             if (pos != 0) {
-                lBreak.obj = o;
-                lBreak.pos = pos - 1;
-            } else {
-                lBreak.obj = last;
-                lBreak.pos = last->isText() ? last->length() : 0;
-                lBreak.nextBreakablePosition = -1;
-            }
-        } else if (lBreak.obj) {
+                // FIXME: This should call moveTo which would clear m_nextBreakablePosition
+                // this code as-is is likely wrong.
+                lBreak.m_obj = o;
+                lBreak.m_pos = pos - 1;
+            } else
+                lBreak.moveTo(last, last->isText() ? last->length() : 0);
+        } else if (lBreak.m_obj) {
             // Don't ever break in the middle of a word if we can help it.
             // There's no room at all. We just have to be on this line,
             // even though we'll spill out.
-            lBreak.obj = o;
-            lBreak.pos = pos;
-            lBreak.nextBreakablePosition = -1;
+            lBreak.moveTo(o, pos);
         }
     }
 
@@ -2174,18 +2236,40 @@ InlineIterator RenderBlock::findNextLineBreak(InlineBidiResolver& resolver, bool
         // to be the actual endpoint.  In both cases we just decrease our pos by 1 level to
         // exclude the space, allowing it to - in effect - collapse into the newline.
         if (lineMidpointState.numMidpoints % 2) {
-            InlineIterator* midpoints = lineMidpointState.midpoints.data();
-            midpoints[lineMidpointState.numMidpoints - 1].pos--;
-        }
-        //else if (lBreak.pos > 0)
-        //    lBreak.pos--;
-        else if (lBreak.obj == 0 && trailingSpaceObject->isText()) {
+            // Find the trailing space object's midpoint.
+            int trailingSpaceMidpoint = lineMidpointState.numMidpoints - 1;
+            for ( ; trailingSpaceMidpoint >= 0 && lineMidpointState.midpoints[trailingSpaceMidpoint].m_obj != trailingSpaceObject; --trailingSpaceMidpoint) { }
+            ASSERT(trailingSpaceMidpoint >= 0);
+            lineMidpointState.midpoints[trailingSpaceMidpoint].m_pos--;
+
+            // Now make sure every single trailingPositionedBox following the trailingSpaceMidpoint properly stops and starts 
+            // ignoring spaces.
+            size_t currentMidpoint = trailingSpaceMidpoint + 1;
+            for (size_t i = 0; i < trailingPositionedBoxes.size(); ++i) {
+                if (currentMidpoint >= lineMidpointState.numMidpoints) {
+                    // We don't have a midpoint for this box yet.
+                    InlineIterator ignoreStart(this, trailingPositionedBoxes[i], 0);
+                    addMidpoint(lineMidpointState, ignoreStart); // Stop ignoring.
+                    addMidpoint(lineMidpointState, ignoreStart); // Start ignoring again.
+                } else {
+                    ASSERT(lineMidpointState.midpoints[currentMidpoint].m_obj == trailingPositionedBoxes[i]);
+                    ASSERT(lineMidpointState.midpoints[currentMidpoint + 1].m_obj == trailingPositionedBoxes[i]);
+                }
+                currentMidpoint += 2;
+            }
+        } else if (!lBreak.m_obj && trailingSpaceObject->isText()) {
             // Add a new end midpoint that stops right at the very end.
             RenderText* text = toRenderText(trailingSpaceObject);
             unsigned length = text->textLength();
             unsigned pos = length >= 2 ? length - 2 : UINT_MAX;
             InlineIterator endMid(0, trailingSpaceObject, pos);
             addMidpoint(lineMidpointState, endMid);
+            for (size_t i = 0; i < trailingPositionedBoxes.size(); ++i) {
+                ignoreStart.m_obj = trailingPositionedBoxes[i];
+                ignoreStart.m_pos = 0;
+                addMidpoint(lineMidpointState, ignoreStart); // Stop ignoring spaces.
+                addMidpoint(lineMidpointState, ignoreStart); // Start ignoring again.
+            }
         }
     }
 
@@ -2193,8 +2277,8 @@ InlineIterator RenderBlock::findNextLineBreak(InlineBidiResolver& resolver, bool
     // of the object. Do this adjustment to make it point to the start
     // of the next object instead to avoid confusing the rest of the
     // code.
-    if (lBreak.pos > 0) {
-        lBreak.pos--;
+    if (lBreak.m_pos > 0) {
+        lBreak.m_pos--;
         lBreak.increment();
     }
 
@@ -2205,7 +2289,7 @@ void RenderBlock::addOverflowFromInlineChildren()
 {
     int endPadding = hasOverflowClip() ? paddingEnd() : 0;
     // FIXME: Need to find another way to do this, since scrollbars could show when we don't want them to.
-    if (hasOverflowClip() && !endPadding && node() && node()->isContentEditable() && node() == node()->rootEditableElement() && style()->isLeftToRightDirection())
+    if (hasOverflowClip() && !endPadding && node() && node()->rendererIsEditable() && node() == node()->rootEditableElement() && style()->isLeftToRightDirection())
         endPadding = 1;
     for (RootInlineBox* curr = firstRootBox(); curr; curr = curr->nextRootBox()) {
         addLayoutOverflow(curr->paddedLayoutOverflowRect(endPadding));
@@ -2217,7 +2301,7 @@ void RenderBlock::addOverflowFromInlineChildren()
 int RenderBlock::beforeSideVisualOverflowForLine(RootInlineBox* line) const
 {
     // Overflow is in the block's coordinate space, which means it isn't purely physical.
-    if (style()->isHorizontalWritingMode())
+    if (isHorizontalWritingMode())
         return line->minYVisualOverflow();
     return line->minXVisualOverflow();
 }
@@ -2225,7 +2309,7 @@ int RenderBlock::beforeSideVisualOverflowForLine(RootInlineBox* line) const
 int RenderBlock::afterSideVisualOverflowForLine(RootInlineBox* line) const
 {
     // Overflow is in the block's coordinate space, which means it isn't purely physical.
-    if (style()->isHorizontalWritingMode())
+    if (isHorizontalWritingMode())
         return line->maxYVisualOverflow();
     return line->maxXVisualOverflow();
 }
@@ -2233,7 +2317,7 @@ int RenderBlock::afterSideVisualOverflowForLine(RootInlineBox* line) const
 int RenderBlock::beforeSideLayoutOverflowForLine(RootInlineBox* line) const
 {
     // Overflow is in the block's coordinate space, which means it isn't purely physical.
-    if (style()->isHorizontalWritingMode())
+    if (isHorizontalWritingMode())
         return line->minYLayoutOverflow();
     return line->minXLayoutOverflow();
 }
@@ -2241,7 +2325,7 @@ int RenderBlock::beforeSideLayoutOverflowForLine(RootInlineBox* line) const
 int RenderBlock::afterSideLayoutOverflowForLine(RootInlineBox* line) const
 {
     // Overflow is in the block's coordinate space, which means it isn't purely physical.
-    if (style()->isHorizontalWritingMode())
+    if (isHorizontalWritingMode())
         return line->maxYLayoutOverflow();
     return line->maxXLayoutOverflow();
 }
diff --git a/Source/WebCore/rendering/RenderBox.cpp b/Source/WebCore/rendering/RenderBox.cpp
index 6e7c0f2..28334dd 100644
--- a/Source/WebCore/rendering/RenderBox.cpp
+++ b/Source/WebCore/rendering/RenderBox.cpp
@@ -130,21 +130,21 @@ int RenderBox::marginAfter() const
 
 int RenderBox::marginStart() const
 {
-    if (style()->isHorizontalWritingMode())
+    if (isHorizontalWritingMode())
         return style()->isLeftToRightDirection() ? m_marginLeft : m_marginRight;
     return style()->isLeftToRightDirection() ? m_marginTop : m_marginBottom;
 }
 
 int RenderBox::marginEnd() const
 {
-    if (style()->isHorizontalWritingMode())
+    if (isHorizontalWritingMode())
         return style()->isLeftToRightDirection() ? m_marginRight : m_marginLeft;
     return style()->isLeftToRightDirection() ? m_marginBottom : m_marginTop;
 }
 
 void RenderBox::setMarginStart(int margin)
 {
-    if (style()->isHorizontalWritingMode()) {
+    if (isHorizontalWritingMode()) {
         if (style()->isLeftToRightDirection())
             m_marginLeft = margin;
         else
@@ -159,7 +159,7 @@ void RenderBox::setMarginStart(int margin)
 
 void RenderBox::setMarginEnd(int margin)
 {
-    if (style()->isHorizontalWritingMode()) {
+    if (isHorizontalWritingMode()) {
         if (style()->isLeftToRightDirection())
             m_marginRight = margin;
         else
@@ -216,7 +216,7 @@ void RenderBox::destroy()
     if (hasOverrideSize())
         gOverrideSizeMap->remove(this);
 
-    if (style() && (style()->height().isPercent() || style()->minHeight().isPercent() || style()->maxHeight().isPercent()))
+    if (style() && (style()->logicalHeight().isPercent() || style()->logicalMinHeight().isPercent() || style()->logicalMaxHeight().isPercent()))
         RenderBlock::removePercentHeightDescendant(this);
 
     RenderBoxModelObject::destroy();
@@ -299,8 +299,17 @@ void RenderBox::styleDidChange(StyleDifference diff, const RenderStyle* oldStyle
 {
     RenderBoxModelObject::styleDidChange(diff, oldStyle);
 
-    if (needsLayout() && oldStyle && (oldStyle->height().isPercent() || oldStyle->minHeight().isPercent() || oldStyle->maxHeight().isPercent()))
-        RenderBlock::removePercentHeightDescendant(this);
+    if (needsLayout() && oldStyle) {
+        if (oldStyle && (oldStyle->logicalHeight().isPercent() || oldStyle->logicalMinHeight().isPercent() || oldStyle->logicalMaxHeight().isPercent()))
+            RenderBlock::removePercentHeightDescendant(this);
+
+        // Normally we can do optimized positioning layout for absolute/fixed positioned objects. There is one special case, however, which is
+        // when the positioned object's margin-before is changed. In this case the parent has to get a layout in order to run margin collapsing
+        // to determine the new static position.
+        if (isPositioned() && style()->hasStaticBlockPosition(isHorizontalWritingMode()) && oldStyle->marginBefore() != style()->marginBefore()
+            && parent() && !parent()->normalChildNeedsLayout())
+            parent()->setChildNeedsLayout(true);
+    }
 
     // If our zoom factor changes and we have a defined scrollLeft/Top, we need to adjust that value into the
     // new zoomed coordinate space.
@@ -335,8 +344,11 @@ void RenderBox::styleDidChange(StyleDifference diff, const RenderStyle* oldStyle
 
         if (viewStyle->writingMode() != style()->writingMode() && (isRootRenderer || !document()->writingModeSetOnDocumentElement())) {
             viewStyle->setWritingMode(style()->writingMode());
-            if (isBodyRenderer)
+            viewRenderer->setHorizontalWritingMode(style()->isHorizontalWritingMode());
+            if (isBodyRenderer) {
                 document()->documentElement()->renderer()->style()->setWritingMode(style()->writingMode());
+                document()->documentElement()->renderer()->setHorizontalWritingMode(style()->isHorizontalWritingMode());
+            }
             setNeedsLayoutAndPrefWidthsRecalc();
         }
     }
@@ -621,9 +633,9 @@ bool RenderBox::logicalScroll(ScrollLogicalDirection direction, ScrollGranularit
 #if PLATFORM(MAC)
         // On Mac only we reset the inline direction position when doing a document scroll (e.g., hitting Home/End).
         if (granularity == ScrollByDocument)
-            scrolled = l->scroll(logicalToPhysical(ScrollInlineDirectionBackward, style()->isHorizontalWritingMode(), style()->isFlippedBlocksWritingMode()), ScrollByDocument, multiplier);
+            scrolled = l->scroll(logicalToPhysical(ScrollInlineDirectionBackward, isHorizontalWritingMode(), style()->isFlippedBlocksWritingMode()), ScrollByDocument, multiplier);
 #endif
-        if (l->scroll(logicalToPhysical(direction, style()->isHorizontalWritingMode(), style()->isFlippedBlocksWritingMode()), granularity, multiplier))
+        if (l->scroll(logicalToPhysical(direction, isHorizontalWritingMode(), style()->isFlippedBlocksWritingMode()), granularity, multiplier))
             scrolled = true;
         
         if (scrolled) {
@@ -649,7 +661,7 @@ bool RenderBox::canBeScrolledAndHasScrollableArea() const
     
 bool RenderBox::canBeProgramaticallyScrolled(bool) const
 {
-    return (hasOverflowClip() && (scrollsOverflow() || (node() && node()->isContentEditable()))) || (node() && node()->isDocumentNode());
+    return (hasOverflowClip() && (scrollsOverflow() || (node() && node()->rendererIsEditable()))) || (node() && node()->isDocumentNode());
 }
 
 void RenderBox::autoscroll()
@@ -782,7 +794,7 @@ void RenderBox::paint(PaintInfo& paintInfo, int tx, int ty)
         child->paint(childInfo, tx, ty);
 }
 
-void RenderBox::paintRootBoxDecorations(PaintInfo& paintInfo, int tx, int ty)
+void RenderBox::paintRootBoxFillLayers(const PaintInfo& paintInfo)
 {
     const FillLayer* bgLayer = style()->backgroundLayers();
     Color bgColor = style()->visitedDependentColor(CSSPropertyBackgroundColor);
@@ -803,21 +815,12 @@ void RenderBox::paintRootBoxDecorations(PaintInfo& paintInfo, int tx, int ty)
     // The background of the box generated by the root element covers the entire canvas, so just use
     // the RenderView's docTop/Left/Width/Height accessors.
     paintFillLayers(paintInfo, bgColor, bgLayer, view()->docLeft(), view()->docTop(), view()->docWidth(), view()->docHeight(), CompositeSourceOver, bodyObject);
-
-    if (style()->hasBorder() && style()->display() != INLINE)
-        paintBorder(paintInfo.context, tx, ty, width(), height(), style());
 }
 
 void RenderBox::paintBoxDecorations(PaintInfo& paintInfo, int tx, int ty)
 {
     if (!paintInfo.shouldPaintWithinRoot(this))
         return;
-
-    if (isRoot()) {
-        paintRootBoxDecorations(paintInfo, tx, ty);
-        return;
-    }
-
     return paintBoxDecorationsWithSize(paintInfo, tx, ty, width(), height());
 }
 
@@ -835,11 +838,13 @@ void RenderBox::paintBoxDecorationsWithSize(PaintInfo& paintInfo, int tx, int ty
     // The theme will tell us whether or not we should also paint the CSS background.
     bool themePainted = style()->hasAppearance() && !theme()->paint(this, paintInfo, IntRect(tx, ty, width, height));
     if (!themePainted) {
-        // The <body> only paints its background if the root element has defined a background
-        // independent of the body.  Go through the DOM to get to the root element's render object,
-        // since the root could be inline and wrapped in an anonymous block.
-        if (!isBody() || document()->documentElement()->renderer()->hasBackground())
+        if (isRoot())
+            paintRootBoxFillLayers(paintInfo);
+        else if (!isBody() || document()->documentElement()->renderer()->hasBackground()) {
+            // The <body> only paints its background if the root element has defined a background
+            // independent of the body.
             paintFillLayers(paintInfo, style()->visitedDependentColor(CSSPropertyBackgroundColor), style()->backgroundLayers(), tx, ty, width, height);
+        }
         if (style()->hasAppearance())
             theme()->paintDecorations(this, paintInfo, IntRect(tx, ty, width, height));
     }
@@ -1108,7 +1113,7 @@ void RenderBox::popContentsClip(PaintInfo& paintInfo, PaintPhase originalPhase,
         paintInfo.phase = originalPhase;
 }
 
-IntRect RenderBox::overflowClipRect(int tx, int ty)
+IntRect RenderBox::overflowClipRect(int tx, int ty, OverlayScrollbarSizeRelevancy relevancy)
 {
     // FIXME: When overflow-clip (CSS3) is implemented, we'll obtain the property
     // here.
@@ -1123,8 +1128,8 @@ IntRect RenderBox::overflowClipRect(int tx, int ty)
 
     // Subtract out scrollbars if we have them.
     if (layer()) {
-        clipWidth -= layer()->verticalScrollbarWidth();
-        clipHeight -= layer()->horizontalScrollbarHeight();
+        clipWidth -= layer()->verticalScrollbarWidth(relevancy);
+        clipHeight -= layer()->horizontalScrollbarHeight(relevancy);
     }
 
     return IntRect(clipX, clipY, clipWidth, clipHeight);
@@ -1319,19 +1324,21 @@ void RenderBox::positionLineBox(InlineBox* box)
     if (isPositioned()) {
         // Cache the x position only if we were an INLINE type originally.
         bool wasInline = style()->isOriginalDisplayInlineType();
-        if (wasInline && style()->hasStaticInlinePosition(box->isHorizontal())) {
+        if (wasInline) {
             // The value is cached in the xPos of the box.  We only need this value if
             // our object was inline originally, since otherwise it would have ended up underneath
             // the inlines.
             layer()->setStaticInlinePosition(lroundf(box->logicalLeft()));
-            setChildNeedsLayout(true, false); // Just go ahead and mark the positioned object as needing layout, so it will update its position properly.
-        } else if (!wasInline && style()->hasStaticBlockPosition(box->isHorizontal())) {
+            if (style()->hasStaticInlinePosition(box->isHorizontal()))
+                setChildNeedsLayout(true, false); // Just go ahead and mark the positioned object as needing layout, so it will update its position properly.
+        } else {
             // Our object was a block originally, so we make our normal flow position be
             // just below the line box (as though all the inlines that came before us got
             // wrapped in an anonymous block, which is what would have happened had we been
             // in flow).  This value was cached in the y() of the box.
             layer()->setStaticBlockPosition(box->logicalTop());
-            setChildNeedsLayout(true, false); // Just go ahead and mark the positioned object as needing layout, so it will update its position properly.
+            if (style()->hasStaticBlockPosition(box->isHorizontal()))
+                setChildNeedsLayout(true, false); // Just go ahead and mark the positioned object as needing layout, so it will update its position properly.
         }
 
         // Nuke the box.
@@ -1569,7 +1576,7 @@ void RenderBox::computeLogicalWidth()
 
     RenderBlock* cb = containingBlock();
     int containerLogicalWidth = max(0, containingBlockLogicalWidthForContent());
-    bool hasPerpendicularContainingBlock = cb->style()->isHorizontalWritingMode() != style()->isHorizontalWritingMode();
+    bool hasPerpendicularContainingBlock = cb->isHorizontalWritingMode() != isHorizontalWritingMode();
     int containerWidthInInlineDirection = containerLogicalWidth;
     if (hasPerpendicularContainingBlock)
         containerWidthInInlineDirection = perpendicularContainingBlockLogicalHeight();
@@ -1776,7 +1783,7 @@ void RenderBox::computeLogicalHeight()
         computePositionedLogicalHeight();
     } else {
         RenderBlock* cb = containingBlock();
-        bool hasPerpendicularContainingBlock = cb->style()->isHorizontalWritingMode() != style()->isHorizontalWritingMode();
+        bool hasPerpendicularContainingBlock = cb->isHorizontalWritingMode() != isHorizontalWritingMode();
     
         if (!hasPerpendicularContainingBlock)
             computeBlockDirectionMargins(cb);
@@ -1863,7 +1870,7 @@ void RenderBox::computeLogicalHeight()
         if (document()->printing())
             visHeight = static_cast<int>(view()->pageLogicalHeight());
         else  {
-            if (style()->isHorizontalWritingMode())
+            if (isHorizontalWritingMode())
                 visHeight = view()->viewHeight();
             else
                 visHeight = view()->viewWidth();
@@ -1896,18 +1903,20 @@ int RenderBox::computeLogicalHeightUsing(const Length& h)
 int RenderBox::computePercentageLogicalHeight(const Length& height)
 {
     int result = -1;
+    
+    // In quirks mode, blocks with auto height are skipped, and we keep looking for an enclosing
+    // block that may have a specified height and then use it. In strict mode, this violates the
+    // specification, which states that percentage heights just revert to auto if the containing
+    // block has an auto height. We still skip anonymous containing blocks in both modes, though, and look
+    // only at explicit containers.
     bool skippedAutoHeightContainingBlock = false;
     RenderBlock* cb = containingBlock();
-    if (document()->inQuirksMode()) {
-        // In quirks mode, blocks with auto height are skipped, and we keep looking for an enclosing
-        // block that may have a specified height and then use it.  In strict mode, this violates the
-        // specification, which states that percentage heights just revert to auto if the containing
-        // block has an auto height.
-        while (!cb->isRenderView() && !cb->isBody() && !cb->isTableCell() && !cb->isPositioned() && cb->style()->logicalHeight().isAuto()) {
-            skippedAutoHeightContainingBlock = true;
-            cb = cb->containingBlock();
-            cb->addPercentHeightDescendant(this);
-        }
+    while (!cb->isRenderView() && !cb->isBody() && !cb->isTableCell() && !cb->isPositioned() && cb->style()->logicalHeight().isAuto()) {
+        if (!document()->inQuirksMode() && !cb->isAnonymousBlock())
+            break;
+        skippedAutoHeightContainingBlock = true;
+        cb = cb->containingBlock();
+        cb->addPercentHeightDescendant(this);
     }
 
     // A positioned element that specified both top/bottom or that specifies height should be treated as though it has a height
@@ -2071,7 +2080,7 @@ int RenderBox::availableLogicalHeightUsing(const Length& h) const
         return computeContentBoxLogicalHeight(h.value());
 
     if (isRenderView())
-        return style()->isHorizontalWritingMode() ? toRenderView(this)->frameView()->visibleHeight() : toRenderView(this)->frameView()->visibleWidth();
+        return isHorizontalWritingMode() ? toRenderView(this)->frameView()->visibleHeight() : toRenderView(this)->frameView()->visibleWidth();
 
     // We need to stop here, since we don't want to increase the height of the table
     // artificially.  We're going to rely on this cell getting expanded to some new
@@ -2117,6 +2126,7 @@ void RenderBox::computeBlockDirectionMargins(RenderBlock* containingBlock)
 
 int RenderBox::containingBlockLogicalWidthForPositioned(const RenderBoxModelObject* containingBlock, bool checkForPerpendicularWritingMode) const
 {
+<<<<<<< HEAD
 #if PLATFORM(ANDROID)
     // Fixed element's position should be decided by the visible screen size.
     // That is in the doc coordindate.
@@ -2127,6 +2137,9 @@ int RenderBox::containingBlockLogicalWidthForPositioned(const RenderBoxModelObje
 #endif
 
     if (checkForPerpendicularWritingMode && containingBlock->style()->isHorizontalWritingMode() != style()->isHorizontalWritingMode())
+=======
+    if (checkForPerpendicularWritingMode && containingBlock->isHorizontalWritingMode() != isHorizontalWritingMode())
+>>>>>>> webkit.org at r82507
         return containingBlockLogicalHeightForPositioned(containingBlock, false);
 
     if (containingBlock->isBox())
@@ -2157,6 +2170,7 @@ int RenderBox::containingBlockLogicalWidthForPositioned(const RenderBoxModelObje
 
 int RenderBox::containingBlockLogicalHeightForPositioned(const RenderBoxModelObject* containingBlock, bool checkForPerpendicularWritingMode) const
 {
+<<<<<<< HEAD
 #if PLATFORM(ANDROID)
     // Fixed element's position should be decided by the visible screen size.
     // That is in the doc coordindate.
@@ -2167,6 +2181,9 @@ int RenderBox::containingBlockLogicalHeightForPositioned(const RenderBoxModelObj
 #endif
 
     if (checkForPerpendicularWritingMode && containingBlock->style()->isHorizontalWritingMode() != style()->isHorizontalWritingMode())
+=======
+    if (checkForPerpendicularWritingMode && containingBlock->isHorizontalWritingMode() != isHorizontalWritingMode())
+>>>>>>> webkit.org at r82507
         return containingBlockLogicalWidthForPositioned(containingBlock, false);
 
     if (containingBlock->isBox())
@@ -2184,7 +2201,7 @@ int RenderBox::containingBlockLogicalHeightForPositioned(const RenderBoxModelObj
 
     int heightResult;
     IntRect boundingBox = flow->linesBoundingBox();
-    if (containingBlock->style()->isHorizontalWritingMode())
+    if (containingBlock->isHorizontalWritingMode())
         heightResult = boundingBox.height();
     else
         heightResult = boundingBox.width();
@@ -2201,7 +2218,7 @@ static void computeInlineStaticDistance(Length& logicalLeft, Length& logicalRigh
     // FIXME: The static distance computation has not been patched for mixed writing modes yet.
     if (containerDirection == LTR) {
         int staticPosition = child->layer()->staticInlinePosition() - containerBlock->borderLogicalLeft();
-        for (RenderObject* curr = child->parent(); curr && curr != containerBlock; curr = curr->parent()) {
+        for (RenderObject* curr = child->parent(); curr && curr != containerBlock; curr = curr->container()) {
             if (curr->isBox())
                 staticPosition += toRenderBox(curr)->logicalLeft();
         }
@@ -2210,7 +2227,7 @@ static void computeInlineStaticDistance(Length& logicalLeft, Length& logicalRigh
         RenderBox* enclosingBox = child->parent()->enclosingBox();
         int staticPosition = child->layer()->staticInlinePosition() + containerLogicalWidth + containerBlock->borderLogicalRight();
         staticPosition -= enclosingBox->logicalWidth();
-        for (RenderObject* curr = enclosingBox; curr && curr != containerBlock; curr = curr->parent()) {
+        for (RenderObject* curr = enclosingBox; curr && curr != containerBlock; curr = curr->container()) {
             if (curr->isBox())
                 staticPosition -= toRenderBox(curr)->logicalLeft();
         }
@@ -2260,7 +2277,7 @@ void RenderBox::computePositionedLogicalWidth()
     // instead of the the container block's.
     TextDirection containerDirection = (document()->inQuirksMode()) ? parent()->style()->direction() : containerBlock->style()->direction();
 
-    bool isHorizontal = style()->isHorizontalWritingMode();
+    bool isHorizontal = isHorizontalWritingMode();
     const int bordersPlusPadding = borderAndPaddingLogicalWidth();
     const Length marginLogicalLeft = isHorizontal ? style()->marginLeft() : style()->marginTop();
     const Length marginLogicalRight = isHorizontal ? style()->marginRight() : style()->marginBottom();
@@ -2365,11 +2382,11 @@ static void computeLogicalLeftPositionedOffset(int& logicalLeftPos, const Render
 {
     // Deal with differing writing modes here.  Our offset needs to be in the containing block's coordinate space. If the containing block is flipped
     // along this axis, then we need to flip the coordinate.  This can only happen if the containing block is both a flipped mode and perpendicular to us.
-    if (containerBlock->style()->isHorizontalWritingMode() != child->style()->isHorizontalWritingMode() && containerBlock->style()->isFlippedBlocksWritingMode()) {
+    if (containerBlock->isHorizontalWritingMode() != child->isHorizontalWritingMode() && containerBlock->style()->isFlippedBlocksWritingMode()) {
         logicalLeftPos = containerLogicalWidth - logicalWidthValue - logicalLeftPos;
-        logicalLeftPos += (child->style()->isHorizontalWritingMode() ? containerBlock->borderRight() : containerBlock->borderBottom());
+        logicalLeftPos += (child->isHorizontalWritingMode() ? containerBlock->borderRight() : containerBlock->borderBottom());
     } else
-        logicalLeftPos += (child->style()->isHorizontalWritingMode() ? containerBlock->borderLeft() : containerBlock->borderTop());
+        logicalLeftPos += (child->isHorizontalWritingMode() ? containerBlock->borderLeft() : containerBlock->borderTop());
 }
 
 void RenderBox::computePositionedLogicalWidthUsing(Length logicalWidth, const RenderBoxModelObject* containerBlock, TextDirection containerDirection,
@@ -2552,7 +2569,7 @@ static void computeBlockStaticDistance(Length& logicalTop, Length& logicalBottom
     
     // FIXME: The static distance computation has not been patched for mixed writing modes.
     int staticLogicalTop = child->layer()->staticBlockPosition() - containerBlock->borderBefore();
-    for (RenderObject* curr = child->parent(); curr && curr != containerBlock; curr = curr->parent()) {
+    for (RenderObject* curr = child->parent(); curr && curr != containerBlock; curr = curr->container()) {
         if (curr->isBox() && !curr->isTableRow())
             staticLogicalTop += toRenderBox(curr)->logicalTop();
     }
@@ -2578,7 +2595,7 @@ void RenderBox::computePositionedLogicalHeight()
 
     const int containerLogicalHeight = containingBlockLogicalHeightForPositioned(containerBlock);
 
-    bool isHorizontal = style()->isHorizontalWritingMode();
+    bool isHorizontal = isHorizontalWritingMode();
     bool isFlipped = style()->isFlippedBlocksWritingMode();
     const int bordersPlusPadding = borderAndPaddingLogicalHeight();
     const Length marginBefore = style()->marginBefore();
@@ -2668,18 +2685,18 @@ static void computeLogicalTopPositionedOffset(int& logicalTopPos, const RenderBo
 {
     // Deal with differing writing modes here.  Our offset needs to be in the containing block's coordinate space. If the containing block is flipped
     // along this axis, then we need to flip the coordinate.  This can only happen if the containing block is both a flipped mode and perpendicular to us.
-    if ((child->style()->isFlippedBlocksWritingMode() && child->style()->isHorizontalWritingMode() != containerBlock->style()->isHorizontalWritingMode())
-        || (child->style()->isFlippedBlocksWritingMode() != containerBlock->style()->isFlippedBlocksWritingMode() && child->style()->isHorizontalWritingMode() == containerBlock->style()->isHorizontalWritingMode()))
+    if ((child->style()->isFlippedBlocksWritingMode() && child->isHorizontalWritingMode() != containerBlock->isHorizontalWritingMode())
+        || (child->style()->isFlippedBlocksWritingMode() != containerBlock->style()->isFlippedBlocksWritingMode() && child->isHorizontalWritingMode() == containerBlock->isHorizontalWritingMode()))
         logicalTopPos = containerLogicalHeight - logicalHeightValue - logicalTopPos;
 
     // Our offset is from the logical bottom edge in a flipped environment, e.g., right for vertical-rl and bottom for horizontal-bt.
-    if (containerBlock->style()->isFlippedBlocksWritingMode() && child->style()->isHorizontalWritingMode() == containerBlock->style()->isHorizontalWritingMode()) {
-        if (child->style()->isHorizontalWritingMode())
+    if (containerBlock->style()->isFlippedBlocksWritingMode() && child->isHorizontalWritingMode() == containerBlock->isHorizontalWritingMode()) {
+        if (child->isHorizontalWritingMode())
             logicalTopPos += containerBlock->borderBottom();
         else
             logicalTopPos += containerBlock->borderRight();
     } else {
-        if (child->style()->isHorizontalWritingMode())
+        if (child->isHorizontalWritingMode())
             logicalTopPos += containerBlock->borderTop();
         else
             logicalTopPos += containerBlock->borderLeft();
@@ -2825,7 +2842,7 @@ void RenderBox::computePositionedLogicalWidthReplaced()
     TextDirection containerDirection = (document()->inQuirksMode()) ? parent()->style()->direction() : containerBlock->style()->direction();
 
     // Variables to solve.
-    bool isHorizontal = style()->isHorizontalWritingMode();
+    bool isHorizontal = isHorizontalWritingMode();
     Length logicalLeft = style()->logicalLeft();
     Length logicalRight = style()->logicalRight();
     Length marginLogicalLeft = isHorizontal ? style()->marginLeft() : style()->marginTop();
@@ -2985,7 +3002,7 @@ void RenderBox::computePositionedLogicalHeightReplaced()
     const int containerLogicalHeight = containingBlockLogicalHeightForPositioned(containerBlock);
 
     // Variables to solve.
-    bool isHorizontal = style()->isHorizontalWritingMode();
+    bool isHorizontal = isHorizontalWritingMode();
     bool isFlipped = style()->isFlippedBlocksWritingMode();
     Length marginBefore = style()->marginBefore();
     Length marginAfter = style()->marginAfter();
@@ -3146,7 +3163,7 @@ VisiblePosition RenderBox::positionForPoint(const IntPoint& point)
 {
     // no children...return this render object's element, if there is one, and offset 0
     if (!firstChild())
-        return createVisiblePosition(node() ? firstDeepEditingPositionForNode(node()) : Position(0, 0));
+        return createVisiblePosition(node() ? firstPositionInOrBeforeNode(node()) : Position(0, 0));
 
     int xPos = point.x();
     int yPos = point.y();
@@ -3157,8 +3174,8 @@ VisiblePosition RenderBox::positionForPoint(const IntPoint& point)
         
         if (xPos < 0 || xPos > right || yPos < 0 || yPos > bottom) {
             if (xPos <= right / 2)
-                return createVisiblePosition(firstDeepEditingPositionForNode(node()));
-            return createVisiblePosition(lastDeepEditingPositionForNode(node()));
+                return createVisiblePosition(firstPositionInOrBeforeNode(node()));
+            return createVisiblePosition(lastPositionInOrAfterNode(node()));
         }
     }
 
@@ -3229,7 +3246,7 @@ VisiblePosition RenderBox::positionForPoint(const IntPoint& point)
     if (closestRenderer)
         return closestRenderer->positionForCoordinates(newX - closestRenderer->x(), newY - closestRenderer->y());
     
-    return createVisiblePosition(firstDeepEditingPositionForNode(node()));
+    return createVisiblePosition(firstPositionInOrBeforeNode(node()));
 }
 
 bool RenderBox::shrinkToAvoidFloats() const
@@ -3293,8 +3310,8 @@ void RenderBox::addLayoutOverflow(const IntRect& rect)
         // Overflow is in the block's coordinate space and thus is flipped for horizontal-bt and vertical-rl 
         // writing modes.  At this stage that is actually a simplification, since we can treat horizontal-tb/bt as the same
         // and vertical-lr/rl as the same.
-        bool hasTopOverflow = !style()->isLeftToRightDirection() && !style()->isHorizontalWritingMode();
-        bool hasLeftOverflow = !style()->isLeftToRightDirection() && style()->isHorizontalWritingMode();
+        bool hasTopOverflow = !style()->isLeftToRightDirection() && !isHorizontalWritingMode();
+        bool hasLeftOverflow = !style()->isLeftToRightDirection() && isHorizontalWritingMode();
         
         if (!hasTopOverflow)
             overflowRect.shiftYEdgeTo(max(overflowRect.y(), clientBox.y()));
@@ -3414,13 +3431,14 @@ IntRect RenderBox::layoutOverflowRectForPropagation(RenderStyle* parentStyle) co
     if (!hasOverflowClip())
         rect.unite(layoutOverflowRect());
 
-    if (isRelPositioned() || hasTransform()) {
+    bool hasTransform = hasLayer() && layer()->transform();
+    if (isRelPositioned() || hasTransform) {
         // If we are relatively positioned or if we have a transform, then we have to convert
         // this rectangle into physical coordinates, apply relative positioning and transforms
         // to it, and then convert it back.
         flipForWritingMode(rect);
         
-        if (hasTransform())
+        if (hasTransform)
             rect = layer()->currentTransform().mapRect(rect);
 
         if (isRelPositioned())
@@ -3452,7 +3470,7 @@ IntPoint RenderBox::flipForWritingMode(const RenderBox* child, const IntPoint& p
     
     // The child is going to add in its x() and y(), so we have to make sure it ends up in
     // the right place.
-    if (style()->isHorizontalWritingMode())
+    if (isHorizontalWritingMode())
         return IntPoint(point.x(), point.y() + height() - child->height() - child->y() - (adjustment == ParentToChildFlippingAdjustment ? child->y() : 0));
     return IntPoint(point.x() + width() - child->width() - child->x() - (adjustment == ParentToChildFlippingAdjustment ? child->x() : 0), point.y());
 }
@@ -3462,7 +3480,7 @@ void RenderBox::flipForWritingMode(IntRect& rect) const
     if (!style()->isFlippedBlocksWritingMode())
         return;
 
-    if (style()->isHorizontalWritingMode())
+    if (isHorizontalWritingMode())
         rect.setY(height() - rect.maxY());
     else
         rect.setX(width() - rect.maxX());
@@ -3479,7 +3497,7 @@ IntPoint RenderBox::flipForWritingMode(const IntPoint& position) const
 {
     if (!style()->isFlippedBlocksWritingMode())
         return position;
-    return style()->isHorizontalWritingMode() ? IntPoint(position.x(), height() - position.y()) : IntPoint(width() - position.x(), position.y());
+    return isHorizontalWritingMode() ? IntPoint(position.x(), height() - position.y()) : IntPoint(width() - position.x(), position.y());
 }
 
 IntPoint RenderBox::flipForWritingModeIncludingColumns(const IntPoint& point) const
@@ -3493,14 +3511,14 @@ IntSize RenderBox::flipForWritingMode(const IntSize& offset) const
 {
     if (!style()->isFlippedBlocksWritingMode())
         return offset;
-    return style()->isHorizontalWritingMode() ? IntSize(offset.width(), height() - offset.height()) : IntSize(width() - offset.width(), offset.height());
+    return isHorizontalWritingMode() ? IntSize(offset.width(), height() - offset.height()) : IntSize(width() - offset.width(), offset.height());
 }
 
 FloatPoint RenderBox::flipForWritingMode(const FloatPoint& position) const
 {
     if (!style()->isFlippedBlocksWritingMode())
         return position;
-    return style()->isHorizontalWritingMode() ? FloatPoint(position.x(), height() - position.y()) : FloatPoint(width() - position.x(), position.y());
+    return isHorizontalWritingMode() ? FloatPoint(position.x(), height() - position.y()) : FloatPoint(width() - position.x(), position.y());
 }
 
 void RenderBox::flipForWritingMode(FloatRect& rect) const
@@ -3508,7 +3526,7 @@ void RenderBox::flipForWritingMode(FloatRect& rect) const
     if (!style()->isFlippedBlocksWritingMode())
         return;
 
-    if (style()->isHorizontalWritingMode())
+    if (isHorizontalWritingMode())
         rect.setY(height() - rect.maxY());
     else
         rect.setX(width() - rect.maxX());
diff --git a/Source/WebCore/rendering/RenderBox.h b/Source/WebCore/rendering/RenderBox.h
index f0bd30d..ccedc66 100644
--- a/Source/WebCore/rendering/RenderBox.h
+++ b/Source/WebCore/rendering/RenderBox.h
@@ -33,6 +33,8 @@ struct PaintInfo;
 
 enum LogicalWidthType { LogicalWidth, MinLogicalWidth, MaxLogicalWidth };
 
+enum OverlayScrollbarSizeRelevancy { IgnoreOverlayScrollbarSize, IncludeOverlayScrollbarSize };
+
 class RenderBox : public RenderBoxModelObject {
 public:
     RenderBox(Node*);
@@ -334,7 +336,7 @@ public:
     
     virtual IntRect localCaretRect(InlineBox*, int caretOffset, int* extraWidthToEndOfLine = 0);
 
-    virtual IntRect overflowClipRect(int tx, int ty);
+    virtual IntRect overflowClipRect(int tx, int ty, OverlayScrollbarSizeRelevancy relevancy = IgnoreOverlayScrollbarSize);
     IntRect clipRect(int tx, int ty);
     virtual bool hasControlClip() const { return false; }
     virtual IntRect controlClipRect(int /*tx*/, int /*ty*/) const { return IntRect(); }
@@ -422,11 +424,12 @@ protected:
     virtual void mapLocalToContainer(RenderBoxModelObject* repaintContainer, bool fixed, bool useTransforms, TransformState&) const;
     virtual void mapAbsoluteToLocalPoint(bool fixed, bool useTransforms, TransformState&) const;
 
+    void paintRootBoxFillLayers(const PaintInfo&);
+
 private:
     bool includeVerticalScrollbarSize() const;
     bool includeHorizontalScrollbarSize() const;
 
-    void paintRootBoxDecorations(PaintInfo&, int tx, int ty);
     // Returns true if we did a full repaint
     bool repaintLayerRectsForImage(WrappedImagePtr image, const FillLayer* layers, bool drawingBackground);
    
diff --git a/Source/WebCore/rendering/RenderBoxModelObject.cpp b/Source/WebCore/rendering/RenderBoxModelObject.cpp
index eec048e..3e2974d 100644
--- a/Source/WebCore/rendering/RenderBoxModelObject.cpp
+++ b/Source/WebCore/rendering/RenderBoxModelObject.cpp
@@ -303,7 +303,7 @@ void RenderBoxModelObject::styleWillChange(StyleDifference diff, const RenderSty
                 repaint();
         }
         
-        if (diff == StyleDifferenceLayout) {
+        if (diff == StyleDifferenceLayout || diff == StyleDifferenceSimplifiedLayout) {
             // When a layout hint happens, we go ahead and do a repaint of the layer, since the layer could
             // end up being destroyed.
             if (hasLayer()) {
@@ -346,8 +346,10 @@ void RenderBoxModelObject::styleDidChange(StyleDifference diff, const RenderStyl
             m_layer = new (renderArena()) RenderLayer(this);
             setHasLayer(true);
             m_layer->insertOnlyThisLayer();
-            if (parent() && !needsLayout() && containingBlock())
+            if (parent() && !needsLayout() && containingBlock()) {
+                m_layer->setNeedsFullRepaint();
                 m_layer->updateLayerPositions();
+            }
         }
     } else if (layer() && layer()->parent()) {
         setHasTransform(false); // Either a transform wasn't specified or the object doesn't support transforms, so just null out the bit.
@@ -371,6 +373,7 @@ void RenderBoxModelObject::updateBoxModelInfoFromStyle()
     setHasBoxDecorations(hasBackground() || style()->hasBorder() || style()->hasAppearance() || style()->boxShadow());
     setInline(style()->isDisplayInlineType());
     setRelPositioned(style()->position() == RelativePosition);
+    setHorizontalWritingMode(style()->isHorizontalWritingMode());
 }
 
 int RenderBoxModelObject::relativePositionOffsetX() const
diff --git a/Source/WebCore/rendering/RenderCombineText.cpp b/Source/WebCore/rendering/RenderCombineText.cpp
index 250ec9b..37ca1ed 100644
--- a/Source/WebCore/rendering/RenderCombineText.cpp
+++ b/Source/WebCore/rendering/RenderCombineText.cpp
@@ -37,6 +37,7 @@ RenderCombineText::RenderCombineText(Node* node, PassRefPtr<StringImpl> string)
 
 void RenderCombineText::styleDidChange(StyleDifference diff, const RenderStyle* oldStyle)
 {
+    setStyleInternal(RenderStyle::clone(style()));
     RenderText::styleDidChange(diff, oldStyle);
 
     if (m_isCombined)
@@ -93,12 +94,12 @@ void RenderCombineText::combineText()
         return;
 
     TextRun run = TextRun(String(text()));
-    FontDescription description = style()->font().fontDescription();
+    FontDescription description = originalFont().fontDescription();
     float emWidth = description.computedSize() * textCombineMargin;
     bool shouldUpdateFont = false;
 
     description.setOrientation(Horizontal); // We are going to draw combined text horizontally.
-    m_combinedTextWidth = style()->font().width(run);
+    m_combinedTextWidth = originalFont().width(run);
     m_isCombined = m_combinedTextWidth <= emWidth;
 
     if (m_isCombined)
@@ -122,12 +123,14 @@ void RenderCombineText::combineText()
         }
     }
 
+    if (!m_isCombined)
+        shouldUpdateFont = style()->setFontDescription(originalFont().fontDescription());
+
     if (shouldUpdateFont)
         style()->font().update(style()->font().fontSelector());
 
     if (m_isCombined) {
-        static const UChar newCharacter = objectReplacementCharacter;
-        DEFINE_STATIC_LOCAL(String, objectReplacementCharacterString, (&newCharacter, 1));
+        DEFINE_STATIC_LOCAL(String, objectReplacementCharacterString, (&objectReplacementCharacter, 1));
         RenderText::setTextInternal(objectReplacementCharacterString.impl());
     }
 }
diff --git a/Source/WebCore/rendering/RenderCombineText.h b/Source/WebCore/rendering/RenderCombineText.h
index 3484ab7..406c3f6 100644
--- a/Source/WebCore/rendering/RenderCombineText.h
+++ b/Source/WebCore/rendering/RenderCombineText.h
@@ -34,8 +34,10 @@ public:
     void charactersToRender(int start, const UChar*& characters, int& length) const;
     bool isCombined() const { return m_isCombined; }
     float combinedTextWidth(const Font& font) const { return font.size(); }
+    const Font& originalFont() const { return parent()->style()->font(); }
 
 private:
+    virtual bool isCombineText() const { return true; }
     virtual float width(unsigned from, unsigned length, const Font&, float xPosition, HashSet<const SimpleFontData*>* fallbackFonts = 0, GlyphOverflow* = 0) const;
     virtual const char* renderName() const { return "RenderCombineText"; }
     virtual void styleDidChange(StyleDifference, const RenderStyle* oldStyle);
@@ -48,13 +50,13 @@ private:
 
 inline RenderCombineText* toRenderCombineText(RenderObject* object)
 { 
-    ASSERT(!object || object->isText());
+    ASSERT(!object || object->isCombineText());
     return static_cast<RenderCombineText*>(object);
 }
 
 inline const RenderCombineText* toRenderCombineText(const RenderObject* object)
 { 
-    ASSERT(!object || object->isText());
+    ASSERT(!object || object->isCombineText());
     return static_cast<const RenderCombineText*>(object);
 }
 
diff --git a/Source/WebCore/rendering/RenderCounter.cpp b/Source/WebCore/rendering/RenderCounter.cpp
index f4a8736..9b8c493 100644
--- a/Source/WebCore/rendering/RenderCounter.cpp
+++ b/Source/WebCore/rendering/RenderCounter.cpp
@@ -316,7 +316,7 @@ static bool findPlaceForCounter(RenderObject* counterOwner, const AtomicString&
                             previousSibling = parent ? currentCounter : 0;
                             return parent;
                         }
-                        // We are not a reset node or the previous reset must be on an ancestor of our renderer
+                        // We are not a reset node or the previous reset must be on an ancestor of our owner renderer
                         // hence we must be a child of that reset counter.
                         parent = currentCounter;
                         ASSERT(previousSibling->parent() == currentCounter);
@@ -325,7 +325,7 @@ static bool findPlaceForCounter(RenderObject* counterOwner, const AtomicString&
                     // CurrentCounter, the counter at the EndSearchRenderer, is not reset.
                     if (!isReset || !areRenderersElementsSiblings(currentRenderer, counterOwner)) {
                         // If the node we are placing is not reset or we have found a counter that is attached
-                        // to an ancestor of the placed counter's renderer we know we are a sibling of that node.
+                        // to an ancestor of the placed counter's owner renderer we know we are a sibling of that node.
                         ASSERT(currentCounter->parent() == previousSibling->parent());
                         parent = currentCounter->parent();
                         return true;
@@ -352,9 +352,9 @@ static bool findPlaceForCounter(RenderObject* counterOwner, const AtomicString&
                     previousSibling = currentCounter;
                 }
             }
-            // We come here if the previous sibling or parent of our renderer had no 
+            // We come here if the previous sibling or parent of our owner renderer had no
             // good counter, or we are a reset node and the counter on the previous sibling
-            // of our renderer was not a reset counter.
+            // of our owner renderer was not a reset counter.
             // Set a new goal for the end of the search.
             searchEndRenderer = previousSiblingOrParent(currentRenderer);
         } else {
@@ -450,11 +450,16 @@ RenderCounter::RenderCounter(Document* node, const CounterContent& counter)
     : RenderText(node, StringImpl::empty())
     , m_counter(counter)
     , m_counterNode(0)
+    , m_nextForSameCounter(0)
 {
 }
 
 RenderCounter::~RenderCounter()
 {
+    if (m_counterNode) {
+        m_counterNode->removeRenderer(this);
+        ASSERT(!m_counterNode);
+    }
 }
 
 const char* RenderCounter::renderName() const
@@ -469,12 +474,21 @@ bool RenderCounter::isCounter() const
 
 PassRefPtr<StringImpl> RenderCounter::originalText() const
 {
-    if (!parent())
-        return 0;
-
-    if (!m_counterNode)
-        m_counterNode = makeCounterNode(parent(), m_counter.identifier(), true);
-
+    if (!m_counterNode) {
+        RenderObject* beforeAfterContainer = parent();
+        while (true) {
+            if (!beforeAfterContainer)
+                return 0;
+            if (!beforeAfterContainer->isAnonymous())
+                return 0; // RenderCounters are restricted to before and after pseudo elements
+            PseudoId containerStyle = beforeAfterContainer->style()->styleType();
+            if ((containerStyle == BEFORE) || (containerStyle == AFTER))
+                break;
+            beforeAfterContainer = beforeAfterContainer->parent();
+        }
+        makeCounterNode(beforeAfterContainer, m_counter.identifier(), true)->addRenderer(const_cast<RenderCounter*>(this));
+        ASSERT(m_counterNode);
+    }
     CounterNode* child = m_counterNode;
     int value = child->actsAsReset() ? child->value() : child->countInParent();
 
@@ -499,11 +513,12 @@ void RenderCounter::computePreferredLogicalWidths(float lead)
     RenderText::computePreferredLogicalWidths(lead);
 }
 
-void RenderCounter::invalidate(const AtomicString& identifier)
+void RenderCounter::invalidate()
 {
-    if (m_counter.identifier() != identifier)
+    m_counterNode->removeRenderer(this);
+    ASSERT(!m_counterNode);
+    if (documentBeingDestroyed())
         return;
-    m_counterNode = 0;
     setNeedsLayoutAndPrefWidthsRecalc();
 }
 
@@ -512,28 +527,18 @@ static void destroyCounterNodeWithoutMapRemoval(const AtomicString& identifier,
     CounterNode* previous;
     for (RefPtr<CounterNode> child = node->lastDescendant(); child && child != node; child = previous) {
         previous = child->previousInPreOrder();
-        child->parent()->removeChild(child.get(), identifier);
-        ASSERT(counterMaps().get(child->renderer())->get(identifier.impl()) == child);
-        counterMaps().get(child->renderer())->remove(identifier.impl());
-        if (!child->renderer()->documentBeingDestroyed()) {
-            RenderObjectChildList* children = child->renderer()->virtualChildren();
-            if (children)
-                children->invalidateCounters(child->renderer(), identifier);
-        }
-    }
-    RenderObject* renderer = node->renderer();
-    if (!renderer->documentBeingDestroyed()) {
-        if (RenderObjectChildList* children = renderer->virtualChildren())
-            children->invalidateCounters(renderer, identifier);
+        child->parent()->removeChild(child.get());
+        ASSERT(counterMaps().get(child->owner())->get(identifier.impl()) == child);
+        counterMaps().get(child->owner())->remove(identifier.impl());
     }
     if (CounterNode* parent = node->parent())
-        parent->removeChild(node, identifier);
+        parent->removeChild(node);
 }
 
-void RenderCounter::destroyCounterNodes(RenderObject* renderer)
+void RenderCounter::destroyCounterNodes(RenderObject* owner)
 {
     CounterMaps& maps = counterMaps();
-    CounterMaps::iterator mapsIterator = maps.find(renderer);
+    CounterMaps::iterator mapsIterator = maps.find(owner);
     if (mapsIterator == maps.end())
         return;
     CounterMap* map = mapsIterator->second;
@@ -544,12 +549,12 @@ void RenderCounter::destroyCounterNodes(RenderObject* renderer)
     }
     maps.remove(mapsIterator);
     delete map;
-    renderer->m_hasCounterNodeMap = false;
+    owner->m_hasCounterNodeMap = false;
 }
 
-void RenderCounter::destroyCounterNode(RenderObject* renderer, const AtomicString& identifier)
+void RenderCounter::destroyCounterNode(RenderObject* owner, const AtomicString& identifier)
 {
-    CounterMap* map = counterMaps().get(renderer);
+    CounterMap* map = counterMaps().get(owner);
     if (!map)
         return;
     CounterMap::iterator mapIterator = map->find(identifier.impl());
@@ -600,7 +605,7 @@ static void updateCounters(RenderObject* renderer)
         if (newParent == parent && newPreviousSibling == node->previousSibling())
             continue;
         if (parent)
-            parent->removeChild(node.get(), it->first.get());
+            parent->removeChild(node.get());
         if (newParent)
             newParent->insertAfter(node.get(), newPreviousSibling, it->first.get());
     }
@@ -684,6 +689,7 @@ void showCounterRendererTree(const WebCore::RenderObject* renderer, const char*
             current->nextSibling(), current->m_hasCounterNodeMap?
             counterName ? WebCore::counterMaps().get(current)->get(identifier.impl()).get() : (WebCore::CounterNode*)1 : (WebCore::CounterNode*)0);
     }
+    fflush(stderr);
 }
 
 #endif // NDEBUG
diff --git a/Source/WebCore/rendering/RenderCounter.h b/Source/WebCore/rendering/RenderCounter.h
index 35ffc35..9557ae3 100644
--- a/Source/WebCore/rendering/RenderCounter.h
+++ b/Source/WebCore/rendering/RenderCounter.h
@@ -34,12 +34,6 @@ public:
     RenderCounter(Document*, const CounterContent&);
     virtual ~RenderCounter();
 
-    // Removes the reference to the CounterNode associated with this renderer
-    // if its identifier matches the argument.
-    // This is used to cause a counter display update when the CounterNode
-    // tree for identifier changes.
-    void invalidate(const AtomicString& identifier);
-
     static void destroyCounterNodes(RenderObject*);
     static void destroyCounterNode(RenderObject*, const AtomicString& identifier);
     static void rendererSubtreeAttached(RenderObject*);
@@ -52,8 +46,14 @@ private:
     
     virtual void computePreferredLogicalWidths(float leadWidth);
 
+    // Removes the reference to the CounterNode associated with this renderer.
+    // This is used to cause a counter display update when the CounterNode tree changes.
+    void invalidate();
+
     CounterContent m_counter;
-    mutable CounterNode* m_counterNode;
+    CounterNode* m_counterNode;
+    RenderCounter* m_nextForSameCounter;
+    friend class CounterNode;
 };
 
 inline RenderCounter* toRenderCounter(RenderObject* object)
diff --git a/Source/WebCore/rendering/RenderDataGrid.cpp b/Source/WebCore/rendering/RenderDataGrid.cpp
index c322389..5057a5f 100644
--- a/Source/WebCore/rendering/RenderDataGrid.cpp
+++ b/Source/WebCore/rendering/RenderDataGrid.cpp
@@ -46,10 +46,16 @@ static const int cDefaultWidth = 300;
 RenderDataGrid::RenderDataGrid(Element* elt)
     : RenderBlock(elt)
 {
+    if (Page* page = frame()->page()) {
+        m_page = page;
+        m_page->addScrollableArea(this);
+    }
 }
 
 RenderDataGrid::~RenderDataGrid()
 {
+    if (m_page)
+        m_page->removeScrollableArea(this);
 }
 
 void RenderDataGrid::styleDidChange(StyleDifference diff, const RenderStyle* oldStyle)
@@ -256,6 +262,14 @@ IntPoint RenderDataGrid::convertFromContainingViewToScrollbar(const Scrollbar* s
     return point;
 }
 
+bool RenderDataGrid::shouldSuspendScrollAnimations() const
+{
+    RenderView* view = this->view();
+    if (!view)
+        return true;
+    return view->frameView()->shouldSuspendScrollAnimations();
+}
+
 }
 
 #endif
diff --git a/Source/WebCore/rendering/RenderDataGrid.h b/Source/WebCore/rendering/RenderDataGrid.h
index 852010c..4f897d1 100644
--- a/Source/WebCore/rendering/RenderDataGrid.h
+++ b/Source/WebCore/rendering/RenderDataGrid.h
@@ -77,8 +77,13 @@ private:
     virtual IntRect convertFromContainingViewToScrollbar(const Scrollbar*, const IntRect&) const;
     virtual IntPoint convertFromScrollbarToContainingView(const Scrollbar*, const IntPoint&) const;
     virtual IntPoint convertFromContainingViewToScrollbar(const Scrollbar*, const IntPoint&) const;
+    virtual bool shouldSuspendScrollAnimations() const;
+
+    virtual void disconnectFromPage() { m_page = 0; }
 
     RefPtr<Scrollbar> m_vBar;
+
+    Page* m_page;
 };
 
 }
diff --git a/Source/WebCore/rendering/RenderDetails.cpp b/Source/WebCore/rendering/RenderDetails.cpp
index a1039f9..be2b435 100644
--- a/Source/WebCore/rendering/RenderDetails.cpp
+++ b/Source/WebCore/rendering/RenderDetails.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies)
+ * Copyright (C) 2010, 2011 Nokia Corporation and/or its subsidiary(-ies)
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -21,20 +21,316 @@
 #include "config.h"
 #include "RenderDetails.h"
 
+#include "CSSStyleSelector.h"
+#include "HTMLDetailsElement.h"
+#include "HTMLNames.h"
+#include "LocalizedStrings.h"
+#include "RenderDetailsMarker.h"
+#include "RenderTextFragment.h"
+#include "RenderView.h"
+
 namespace WebCore {
 
-RenderDetails::RenderDetails(Node* element)
-    : RenderBlock(element)
+using namespace HTMLNames;
+
+RenderDetails::RenderDetails(Node* node)
+    : RenderBlock(node)
+    , m_summaryBlock(0)
+    , m_contentBlock(0)
+    , m_defaultSummaryBlock(0)
+    , m_defaultSummaryText(0)
+    , m_marker(0)
+    , m_mainSummary(0)
+{
+}
+
+void RenderDetails::destroy()
+{
+    if (m_marker) {
+        m_marker->destroy();
+        m_marker = 0;
+    }
+
+    RenderBlock::destroy();
+}
+
+RenderBlock* RenderDetails::summaryBlock()
+{
+    if (!m_summaryBlock) {
+        m_summaryBlock = createAnonymousBlock();
+        RenderBlock::addChild(m_summaryBlock, m_contentBlock);
+    }
+    return m_summaryBlock;
+}
+
+RenderBlock* RenderDetails::contentBlock()
 {
+    if (!m_contentBlock) {
+        m_contentBlock = createAnonymousBlock();
+        RenderBlock::addChild(m_contentBlock);
+    }
+    return m_contentBlock;
+}
+
+void RenderDetails::addChild(RenderObject* newChild, RenderObject* beforeChild)
+{
+    if (beforeChild && beforeChild == m_mainSummary)
+        beforeChild = getRenderPosition(m_mainSummary);
+    contentBlock()->addChild(newChild, beforeChild);
+}
+
+void RenderDetails::removeChild(RenderObject* oldChild)
+{
+    if (oldChild == m_summaryBlock) {
+        RenderBlock::removeChild(oldChild);
+        m_summaryBlock = 0;
+        return;
+    }
+
+    if (oldChild == m_contentBlock) {
+        RenderBlock::removeChild(oldChild);
+        m_contentBlock = 0;
+        return;
+    }
+
+    if (oldChild == m_mainSummary && m_summaryBlock) {
+        m_summaryBlock->removeChild(m_mainSummary);
+        return;
+    }
+
+    if (m_contentBlock) {
+        m_contentBlock->removeChild(oldChild);
+        return;
+    }
+
+    ASSERT_NOT_REACHED();
+}
+
+void RenderDetails::setMarkerStyle()
+{
+    if (m_marker) {
+        RefPtr<RenderStyle> markerStyle = RenderStyle::create();
+        markerStyle->inheritFrom(style());
+        m_marker->setStyle(markerStyle.release());
+    }
 }
 
 void RenderDetails::styleDidChange(StyleDifference diff, const RenderStyle* oldStyle)
 {
     RenderBlock::styleDidChange(diff, oldStyle);
 
+    if (m_defaultSummaryBlock) {
+        m_defaultSummaryBlock->setStyle(createSummaryStyle());
+        m_defaultSummaryText->setStyle(m_defaultSummaryBlock->style());
+    }
+
+    setMarkerStyle();
+
     // Ensure that if we ended up being inline that we set our replaced flag
     // so that we're treated like an inline-block.
     setReplaced(isInline());
 }
 
+RenderObject* RenderDetails::getRenderPosition(RenderObject* object)
+{
+    if (!object || !object->node())
+        return 0;
+
+    Node* element = object->node()->nextSibling();
+
+    while (element && !element->renderer())
+        element = element->nextSibling();
+
+    return element ? element->renderer() : 0;
+}
+
+void RenderDetails::markerDestroyed()
+{
+    m_marker = 0;
+}
+
+void RenderDetails::summaryDestroyed(RenderObject* summary)
+{
+    if (summary == m_mainSummary)
+        m_mainSummary = 0;
+}
+
+void RenderDetails::moveSummaryToContents()
+{
+    if (m_defaultSummaryBlock) {
+        ASSERT(!m_mainSummary);
+        m_defaultSummaryBlock->destroy();
+        m_defaultSummaryBlock = 0;
+        m_defaultSummaryText = 0;
+        return;
+    }
+
+    if (!m_mainSummary)
+        return;
+
+    m_mainSummary->remove();
+    contentBlock()->addChild(m_mainSummary, getRenderPosition(m_mainSummary));
+    m_mainSummary = 0;
+}
+
+PassRefPtr<RenderStyle> RenderDetails::createSummaryStyle()
+{
+    RefPtr<HTMLElement> summary(HTMLElement::create(summaryTag, document()));
+    return document()->styleSelector()->styleForElement(summary.get(), style(), true);
+}
+
+void RenderDetails::replaceMainSummary(RenderObject* newSummary)
+{
+    ASSERT(newSummary);
+    if (m_mainSummary == newSummary)
+        return;
+
+    moveSummaryToContents();
+    newSummary->remove();
+    summaryBlock()->addChild(newSummary);
+    m_mainSummary = newSummary;
+}
+
+void RenderDetails::createDefaultSummary()
+{
+    if (m_defaultSummaryBlock)
+        return;
+
+    moveSummaryToContents();
+
+    m_defaultSummaryBlock = summaryBlock()->createAnonymousBlock();
+    m_defaultSummaryBlock->setStyle(createSummaryStyle());
+
+    m_defaultSummaryText = new (renderArena()) RenderTextFragment(document(), defaultDetailsSummaryText().impl());
+    m_defaultSummaryText->setStyle(m_defaultSummaryBlock->style());
+    m_defaultSummaryBlock->addChild(m_defaultSummaryText);
+
+    summaryBlock()->addChild(m_defaultSummaryBlock);
+}
+
+void RenderDetails::checkMainSummary()
+{
+    if (!node() || !node()->hasTagName(detailsTag))
+        return;
+
+    Node* mainSummaryNode = static_cast<HTMLDetailsElement*>(node())->mainSummary();
+
+    if (!mainSummaryNode || !mainSummaryNode->renderer() || mainSummaryNode->renderer()->isFloatingOrPositioned())
+        createDefaultSummary();
+    else
+        replaceMainSummary(mainSummaryNode->renderer());
+
+}
+
+void RenderDetails::layout()
+{
+    ASSERT(needsLayout());
+
+    checkMainSummary();
+    ASSERT(m_summaryBlock);
+
+    if (!m_marker) {
+        m_marker = new (renderArena()) RenderDetailsMarker(this);
+        setMarkerStyle();
+    }
+    updateMarkerLocation();
+
+    RenderBlock::layout();
+
+    m_interactiveArea = m_summaryBlock->frameRect();
+
+    // FIXME: the following code will not be needed once absoluteToLocal get patched to handle flipped blocks writing modes.
+    switch (style()->writingMode()) {
+    case TopToBottomWritingMode:
+    case LeftToRightWritingMode:
+        break;
+    case RightToLeftWritingMode: {
+        m_interactiveArea.setX(width() - m_interactiveArea.x() - m_interactiveArea.width());
+        break;
+    }
+    case BottomToTopWritingMode: {
+        m_interactiveArea.setY(height() - m_interactiveArea.y() - m_interactiveArea.height());
+        break;
+    }
+    }
 }
+
+bool RenderDetails::isOpen() const
+{
+    return node() && node()->isElementNode() ? !static_cast<Element*>(node())->getAttribute(openAttr).isNull() : false;
+}
+
+RenderObject* RenderDetails::getParentOfFirstLineBox(RenderBlock* curr)
+{
+    RenderObject* firstChild = curr->firstChild();
+    if (!firstChild)
+        return 0;
+
+    for (RenderObject* currChild = firstChild; currChild; currChild = currChild->nextSibling()) {
+        if (currChild == m_marker)
+            continue;
+
+        if (currChild->isInline() && (!currChild->isRenderInline() || curr->generatesLineBoxesForInlineChild(currChild)))
+            return curr;
+
+        if (currChild->isFloating() || currChild->isPositioned())
+            continue;
+
+        if (currChild->isTable() || !currChild->isRenderBlock() || (currChild->isBox() && toRenderBox(currChild)->isWritingModeRoot()))
+            break;
+
+        if (currChild->isDetails())
+            break;
+
+        RenderObject* lineBox = getParentOfFirstLineBox(toRenderBlock(currChild));
+        if (lineBox)
+            return lineBox;
+    }
+
+    return 0;
+}
+
+RenderObject* RenderDetails::firstNonMarkerChild(RenderObject* parent)
+{
+    RenderObject* result = parent->firstChild();
+    while (result && result->isDetailsMarker())
+        result = result->nextSibling();
+    return result;
+}
+
+void RenderDetails::updateMarkerLocation()
+{
+    // Sanity check the location of our marker.
+    if (m_marker) {
+        RenderObject* markerPar = m_marker->parent();
+        RenderObject* lineBoxParent = getParentOfFirstLineBox(m_summaryBlock);
+        if (!lineBoxParent) {
+            // If the marker is currently contained inside an anonymous box,
+            // then we are the only item in that anonymous box (since no line box
+            // parent was found). It's ok to just leave the marker where it is
+            // in this case.
+            if (markerPar && markerPar->isAnonymousBlock())
+                lineBoxParent = markerPar;
+            else
+                lineBoxParent = m_summaryBlock;
+        }
+
+        if (markerPar != lineBoxParent || m_marker->preferredLogicalWidthsDirty()) {
+            // Removing and adding the marker can trigger repainting in
+            // containers other than ourselves, so we need to disable LayoutState.
+            view()->disableLayoutState();
+            m_marker->remove();
+            if (!lineBoxParent)
+                lineBoxParent = m_summaryBlock;
+            lineBoxParent->addChild(m_marker, firstNonMarkerChild(lineBoxParent));
+
+            if (m_marker->preferredLogicalWidthsDirty())
+                m_marker->computePreferredLogicalWidths();
+
+            view()->enableLayoutState();
+        }
+    }
+}
+
+} // namespace WebCore
+
diff --git a/Source/WebCore/rendering/RenderDetails.h b/Source/WebCore/rendering/RenderDetails.h
index b8aebab..0b56c13 100644
--- a/Source/WebCore/rendering/RenderDetails.h
+++ b/Source/WebCore/rendering/RenderDetails.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies)
+ * Copyright (C) 2010, 2011 Nokia Corporation and/or its subsidiary(-ies)
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -21,18 +21,65 @@
 #ifndef RenderDetails_h
 #define RenderDetails_h
 
-#include "RenderBlock.h"
+#include "RenderFlexibleBox.h"
+#include "Timer.h"
+#include <wtf/OwnPtr.h>
 
 namespace WebCore {
 
+class RenderDetailsMarker;
+
 class RenderDetails : public RenderBlock {
 public:
     explicit RenderDetails(Node*);
 
-private:
     virtual const char* renderName() const { return "RenderDetails"; }
     virtual bool isDetails() const { return true; }
+
+    bool isOpen() const;
+    IntRect interactiveArea() const { return m_interactiveArea; }
+    void markerDestroyed();
+    void summaryDestroyed(RenderObject*);
+
+private:
     virtual void styleDidChange(StyleDifference, const RenderStyle* oldStyle);
+
+    virtual void addChild(RenderObject* newChild, RenderObject *beforeChild = 0);
+    virtual void removeChild(RenderObject*);
+    virtual void removeLeftoverAnonymousBlock(RenderBlock*) { }
+    virtual bool createsAnonymousWrapper() const { return true; }
+
+    virtual bool requiresForcedStyleRecalcPropagation() const { return true; }
+
+    virtual void layout();
+    virtual void destroy();
+
+    void createDefaultSummary();
+    void replaceMainSummary(RenderObject*);
+    void moveSummaryToContents();
+    void checkMainSummary();
+    RenderObject* getRenderPosition(RenderObject*);
+    PassRefPtr<RenderStyle> createSummaryStyle();
+    void setMarkerStyle();
+
+    RenderBlock* summaryBlock();
+    RenderBlock* contentBlock();
+
+    RenderObject* getParentOfFirstLineBox(RenderBlock* curr);
+    RenderObject* firstNonMarkerChild(RenderObject* parent);
+    void updateMarkerLocation();
+
+    RenderBlock* m_summaryBlock;
+    RenderBlock* m_contentBlock;
+
+    RenderObject* m_defaultSummaryBlock;
+    RenderObject* m_defaultSummaryText;
+
+    IntRect m_interactiveArea;
+
+    RenderDetailsMarker* m_marker;
+
+    RenderObject* m_mainSummary;
 };
 
 inline RenderDetails* toRenderDetails(RenderObject* object)
@@ -44,6 +91,6 @@ inline RenderDetails* toRenderDetails(RenderObject* object)
 // This will catch anyone doing an unnecessary cast.
 void toRenderDetails(const RenderDetails*);
 
-}
+} // namespace WebCore
 
 #endif // RenderDetails_h
diff --git a/Source/WebCore/rendering/RenderDetailsMarker.cpp b/Source/WebCore/rendering/RenderDetailsMarker.cpp
index 26e49d9..e040eb3 100644
--- a/Source/WebCore/rendering/RenderDetailsMarker.cpp
+++ b/Source/WebCore/rendering/RenderDetailsMarker.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies)
+ * Copyright (C) 2010, 2011 Nokia Corporation and/or its subsidiary(-ies)
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -21,11 +21,182 @@
 #include "config.h"
 #include "RenderDetailsMarker.h"
 
+#include "GraphicsContext.h"
+#include "HTMLNames.h"
+#include "PaintInfo.h"
+#include "RenderDetails.h"
+#include "RenderSummary.h"
+
 namespace WebCore {
 
-RenderDetailsMarker::RenderDetailsMarker(Node* element)
-    : RenderBlock(element)
+using namespace HTMLNames;
+
+RenderDetailsMarker::RenderDetailsMarker(RenderDetails* item)
+    : RenderBox(item->document())
+    , m_details(item)
+{
+    setInline(true);
+    setReplaced(true);
+}
+
+void RenderDetailsMarker::destroy()
+{
+    if (m_details)
+        m_details->markerDestroyed();
+
+    RenderBox::destroy();
+}
+
+int RenderDetailsMarker::lineHeight(bool firstLine, LineDirectionMode direction, LinePositionMode) const
+{
+    return m_details->lineHeight(firstLine, direction, PositionOfInteriorLineBoxes);
+}
+
+int RenderDetailsMarker::baselinePosition(FontBaseline baselineType, bool firstLine, LineDirectionMode direction, LinePositionMode) const
+{
+    return m_details->baselinePosition(baselineType, firstLine, direction, PositionOfInteriorLineBoxes);
+}
+
+void RenderDetailsMarker::computePreferredLogicalWidths()
+{
+    ASSERT(preferredLogicalWidthsDirty());
+
+    m_minPreferredLogicalWidth = 2 * style()->fontMetrics().ascent() / 3;
+    m_maxPreferredLogicalWidth = m_minPreferredLogicalWidth;
+
+    setPreferredLogicalWidthsDirty(false);
+}
+
+void RenderDetailsMarker::layout()
+{
+    ASSERT(needsLayout());
+
+    setLogicalWidth(minPreferredLogicalWidth());
+    setLogicalHeight(style()->fontMetrics().height());
+
+    setMarginStart(0);
+    setMarginEnd(style()->fontMetrics().ascent() - minPreferredLogicalWidth() + 1);
+
+    setNeedsLayout(false);
+}
+
+IntRect RenderDetailsMarker::getRelativeMarkerRect() const
+{
+    IntRect relativeRect;
+
+    int bulletWidth = minPreferredLogicalWidth();
+    relativeRect = IntRect((logicalWidth() - bulletWidth) / 2, (logicalHeight() - bulletWidth) / 2, bulletWidth, bulletWidth);
+
+    if (!style()->isHorizontalWritingMode()) {
+        relativeRect = relativeRect.transposedRect();
+        relativeRect.setX(width() - relativeRect.x() - relativeRect.width());
+    }
+
+    return relativeRect;
+}
+
+bool RenderDetailsMarker::isOpen() const
 {
+    return m_details && m_details->isOpen();
+}
+
+static Path createPath(const FloatPoint* path)
+{
+    Path result;
+    result.moveTo(FloatPoint(path[0].x(), path[0].y()));
+    for (int i = 1; i < 4; ++i)
+        result.addLineTo(FloatPoint(path[i].x(), path[i].y()));
+    return result;
+}
+
+static Path createDownArrowPath()
+{
+    FloatPoint points[4] = { FloatPoint(0.0f, 0.07f), FloatPoint(0.5f, 0.93f), FloatPoint(1.0f, 0.07f), FloatPoint(0.0f, 0.07f) };
+    return createPath(points);
+}
+
+static Path createUpArrowPath()
+{
+    FloatPoint points[4] = { FloatPoint(0.0f, 0.93f), FloatPoint(0.5f, 0.07f), FloatPoint(1.0f, 0.93f), FloatPoint(0.0f, 0.93f) };
+    return createPath(points);
+}
+
+static Path createLeftArrowPath()
+{
+    FloatPoint points[4] = { FloatPoint(1.0f, 0.0f), FloatPoint(0.14f, 0.5f), FloatPoint(1.0f, 1.0f), FloatPoint(1.0f, 0.0f) };
+    return createPath(points);
+}
+
+static Path createRightArrowPath()
+{
+    FloatPoint points[4] = { FloatPoint(0.0f, 0.0f), FloatPoint(0.86f, 0.5f), FloatPoint(0.0f, 1.0f), FloatPoint(0.0f, 0.0f) };
+    return createPath(points);
+}
+
+RenderDetailsMarker::Orientation RenderDetailsMarker::orientation() const
+{
+    switch (style()->writingMode()) {
+    case TopToBottomWritingMode:
+        if (style()->isLeftToRightDirection())
+            return isOpen() ? Down : Right;
+        return isOpen() ? Down : Left;
+    case RightToLeftWritingMode:
+        if (style()->isLeftToRightDirection())
+            return isOpen() ? Left : Down;
+        return isOpen() ? Left : Up;
+    case LeftToRightWritingMode:
+        if (style()->isLeftToRightDirection())
+            return isOpen() ? Right : Down;
+        return isOpen() ? Right : Up;
+    case BottomToTopWritingMode:
+        if (style()->isLeftToRightDirection())
+            return isOpen() ? Up : Right;
+        return isOpen() ? Up : Left;
+    }
+    return Right;
+}
+
+Path RenderDetailsMarker::getCanonicalPath() const
+{
+    switch (orientation()) {
+    case Left: return createLeftArrowPath();
+    case Right: return createRightArrowPath();
+    case Up: return createUpArrowPath();
+    case Down: return createDownArrowPath();
+    }
+
+    return Path();
+}
+
+Path RenderDetailsMarker::getPath(const IntPoint& origin) const
+{
+    IntRect rect = getRelativeMarkerRect();
+    Path result = getCanonicalPath();
+    result.transform(AffineTransform().scale(rect.width()));
+    result.translate(FloatSize(origin.x() + rect.x(), origin.y() + rect.y()));
+    return result;
+}
+
+void RenderDetailsMarker::paint(PaintInfo& paintInfo, int tx, int ty)
+{
+    if (paintInfo.phase != PaintPhaseForeground || style()->visibility() != VISIBLE)
+        return;
+
+    IntPoint boxOrigin(tx + x(), ty + y());
+    IntRect overflowRect(visualOverflowRect());
+    overflowRect.move(boxOrigin.x(), boxOrigin.y());
+    overflowRect.inflate(maximalOutlineSize(paintInfo.phase));
+
+    if (!paintInfo.rect.intersects(overflowRect))
+        return;
+
+    const Color color(style()->visitedDependentColor(CSSPropertyColor));
+    paintInfo.context->setStrokeColor(color, style()->colorSpace());
+    paintInfo.context->setStrokeStyle(SolidStroke);
+    paintInfo.context->setStrokeThickness(1.0f);
+    paintInfo.context->setFillColor(color, style()->colorSpace());
+
+    paintInfo.context->fillPath(getPath(boxOrigin));
 }
 
 }
diff --git a/Source/WebCore/rendering/RenderDetailsMarker.h b/Source/WebCore/rendering/RenderDetailsMarker.h
index 08bdbd8..de8f60b 100644
--- a/Source/WebCore/rendering/RenderDetailsMarker.h
+++ b/Source/WebCore/rendering/RenderDetailsMarker.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies)
+ * Copyright (C) 2010, 2011 Nokia Corporation and/or its subsidiary(-ies)
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -21,25 +21,52 @@
 #ifndef RenderDetailsMarker_h
 #define RenderDetailsMarker_h
 
-#include "RenderBlock.h"
+#include "RenderBox.h"
 
 namespace WebCore {
 
-class RenderDetailsMarker : public RenderBlock {
+class RenderDetails;
+
+class RenderDetailsMarker : public RenderBox {
 public:
-    explicit RenderDetailsMarker(Node*);
+    RenderDetailsMarker(RenderDetails*);
+
+    enum Orientation { Up, Down, Left, Right };
+
+    Orientation orientation() const;
+
+    virtual void computePreferredLogicalWidths();
+    virtual void destroy();
 
 private:
     virtual const char* renderName() const { return "RenderDetailsMarker"; }
     virtual bool isDetailsMarker() const { return true; }
+    virtual void paint(PaintInfo&, int tx, int ty);
+    virtual void layout();
+    virtual int lineHeight(bool firstLine, LineDirectionMode, LinePositionMode = PositionOnContainingLine) const;
+    virtual int baselinePosition(FontBaseline, bool firstLine, LineDirectionMode, LinePositionMode = PositionOnContainingLine) const;
+
+    IntRect getRelativeMarkerRect() const;
+
+    bool isOpen() const;
+    Path getCanonicalPath() const;
+    Path getPath(const IntPoint& origin) const;
+
+    RenderDetails* m_details;
 };
 
 inline RenderDetailsMarker* toRenderDetailsMarker(RenderObject* object)
 {
-    ASSERT(!object || object->isDetails());
+    ASSERT(!object || object->isDetailsMarker());
     return static_cast<RenderDetailsMarker*>(object);
 }
 
+inline const RenderDetailsMarker* toRenderDetailsMarker(const RenderObject* object)
+{
+    ASSERT(!object || object->isDetailsMarker());
+    return static_cast<const RenderDetailsMarker*>(object);
+}
+
 // This will catch anyone doing an unnecessary cast.
 void toRenderDetailsMarker(const RenderDetailsMarker*);
 
diff --git a/Source/WebCore/rendering/RenderFlexibleBox.cpp b/Source/WebCore/rendering/RenderFlexibleBox.cpp
index 8241dcd..4d97da0 100644
--- a/Source/WebCore/rendering/RenderFlexibleBox.cpp
+++ b/Source/WebCore/rendering/RenderFlexibleBox.cpp
@@ -214,7 +214,7 @@ void RenderFlexibleBox::layoutBlock(bool relayoutChildren, int /*pageHeight FIXM
 {
     ASSERT(needsLayout());
 
-    if (!relayoutChildren && layoutOnlyPositionedObjects())
+    if (!relayoutChildren && simplifiedLayout())
         return;
 
     LayoutRepainter repainter(*this, checkForRepaintDuringLayout());
@@ -421,13 +421,11 @@ void RenderFlexibleBox::layoutHorizontalBox(bool relayoutChildren)
             if (child->isPositioned()) {
                 child->containingBlock()->insertPositionedObject(child);
                 RenderLayer* childLayer = child->layer();
-                if (child->style()->hasStaticInlinePosition(style()->isHorizontalWritingMode()))
-                    childLayer->setStaticInlinePosition(xPos);
-                if (child->style()->hasStaticBlockPosition(style()->isHorizontalWritingMode())) {
-                    if (childLayer->staticBlockPosition() != yPos) {
-                        childLayer->setStaticBlockPosition(yPos);
+                childLayer->setStaticInlinePosition(xPos);
+                if (childLayer->staticBlockPosition() != yPos) {
+                    childLayer->setStaticBlockPosition(yPos);
+                    if (child->style()->hasStaticBlockPosition(style()->isHorizontalWritingMode()))
                         child->setChildNeedsLayout(true, false);
-                    }
                 }
                 child = iterator.next();
                 continue;
@@ -684,17 +682,11 @@ void RenderFlexibleBox::layoutVerticalBox(bool relayoutChildren)
             if (child->isPositioned()) {
                 child->containingBlock()->insertPositionedObject(child);
                 RenderLayer* childLayer = child->layer();
-                if (child->style()->hasStaticInlinePosition(style()->isHorizontalWritingMode())) {
-                    if (style()->isLeftToRightDirection())
-                        childLayer->setStaticInlinePosition(borderLeft() + paddingLeft());
-                    else
-                        childLayer->setStaticInlinePosition(borderRight() + paddingRight());
-                }
-                if (child->style()->hasStaticBlockPosition(style()->isHorizontalWritingMode())) {
-                    if (childLayer->staticBlockPosition() != height()) {
-                        childLayer->setStaticBlockPosition(height());
+                childLayer->setStaticInlinePosition(borderStart() + paddingStart());
+                if (childLayer->staticBlockPosition() != height()) {
+                    childLayer->setStaticBlockPosition(height());
+                    if (child->style()->hasStaticBlockPosition(style()->isHorizontalWritingMode()))
                         child->setChildNeedsLayout(true, false);
-                    }
                 }
                 child = iterator.next();
                 continue;
diff --git a/Source/WebCore/rendering/RenderFullScreen.cpp b/Source/WebCore/rendering/RenderFullScreen.cpp
index cc53a6e..a685064 100644
--- a/Source/WebCore/rendering/RenderFullScreen.cpp
+++ b/Source/WebCore/rendering/RenderFullScreen.cpp
@@ -64,7 +64,7 @@ PassRefPtr<RenderStyle> RenderFullScreen::createFullScreenStyle()
     
     fullscreenStyle->setBackgroundColor(Color::black);
     
-    return fullscreenStyle;
+    return fullscreenStyle.release();
 }
 
 #endif
diff --git a/Source/WebCore/rendering/RenderInline.cpp b/Source/WebCore/rendering/RenderInline.cpp
index 234d63c..3a27307 100644
--- a/Source/WebCore/rendering/RenderInline.cpp
+++ b/Source/WebCore/rendering/RenderInline.cpp
@@ -201,8 +201,7 @@ void RenderInline::addChildIgnoringContinuation(RenderObject* newChild, RenderOb
         // inline into continuations.  This involves creating an anonymous block box to hold
         // |newChild|.  We then make that block box a continuation of this inline.  We take all of
         // the children after |beforeChild| and put them in a clone of this object.
-        RefPtr<RenderStyle> newStyle = RenderStyle::create();
-        newStyle->inheritFrom(style());
+        RefPtr<RenderStyle> newStyle = RenderStyle::createAnonymousStyle(style());
         newStyle->setDisplay(BLOCK);
 
         RenderBlock* newBox = new (renderArena()) RenderBlock(document() /* anonymous box */);
@@ -485,29 +484,21 @@ static int computeMargin(const RenderInline* renderer, const Length& margin)
 
 int RenderInline::marginLeft() const
 {
-    if (!style()->isHorizontalWritingMode())
-        return 0;
     return computeMargin(this, style()->marginLeft());
 }
 
 int RenderInline::marginRight() const
 {
-    if (!style()->isHorizontalWritingMode())
-        return 0;
     return computeMargin(this, style()->marginRight());
 }
 
 int RenderInline::marginTop() const
 {
-    if (style()->isHorizontalWritingMode())
-        return 0;
     return computeMargin(this, style()->marginTop());
 }
 
 int RenderInline::marginBottom() const
 {
-    if (style()->isHorizontalWritingMode())
-        return 0;
     return computeMargin(this, style()->marginBottom());
 }
 
@@ -521,6 +512,16 @@ int RenderInline::marginEnd() const
     return computeMargin(this, style()->marginEnd());
 }
 
+int RenderInline::marginBefore() const
+{
+    return computeMargin(this, style()->marginBefore());
+}
+
+int RenderInline::marginAfter() const
+{
+    return computeMargin(this, style()->marginAfter());
+}
+
 const char* RenderInline::renderName() const
 {
     if (isRelPositioned())
diff --git a/Source/WebCore/rendering/RenderInline.h b/Source/WebCore/rendering/RenderInline.h
index 18b4a3c..08ac002 100644
--- a/Source/WebCore/rendering/RenderInline.h
+++ b/Source/WebCore/rendering/RenderInline.h
@@ -42,8 +42,8 @@ public:
     virtual int marginRight() const;
     virtual int marginTop() const;
     virtual int marginBottom() const;
-    virtual int marginBefore() const { return 0; }
-    virtual int marginAfter() const { return 0; }
+    virtual int marginBefore() const;
+    virtual int marginAfter() const;
     virtual int marginStart() const;
     virtual int marginEnd() const;
 
diff --git a/Source/WebCore/rendering/RenderLayer.cpp b/Source/WebCore/rendering/RenderLayer.cpp
index bc0d440..1c60500 100644
--- a/Source/WebCore/rendering/RenderLayer.cpp
+++ b/Source/WebCore/rendering/RenderLayer.cpp
@@ -178,9 +178,13 @@ RenderLayer::RenderLayer(RenderBoxModelObject* renderer)
     , m_hasCompositingDescendant(false)
     , m_mustOverlapCompositedLayers(false)
 #endif
+<<<<<<< HEAD
 #if ENABLE(ANDROID_OVERFLOW_SCROLL)
     , m_hasOverflowScroll(false)
 #endif
+=======
+    , m_containsDirtyOverlayScrollbars(false)
+>>>>>>> webkit.org at r82507
     , m_marquee(0)
     , m_staticInlinePosition(0)
     , m_staticBlockPosition(0)
@@ -194,6 +198,13 @@ RenderLayer::RenderLayer(RenderBoxModelObject* renderer)
         m_visibleContentStatusDirty = false;
         m_hasVisibleContent = renderer->style()->visibility() == VISIBLE;
     }
+
+    if (Frame* frame = renderer->frame()) {
+        if (Page* page = frame->page()) {
+            m_page = page;
+            m_page->addScrollableArea(this);
+        }
+    }
 }
 
 RenderLayer::~RenderLayer()
@@ -203,6 +214,9 @@ RenderLayer::~RenderLayer()
             frame->eventHandler()->resizeLayerDestroyed();
     }
 
+    if (m_page)
+        m_page->removeScrollableArea(this);
+
     destroyScrollbar(HorizontalScrollbar);
     destroyScrollbar(VerticalScrollbar);
 
@@ -268,19 +282,6 @@ bool RenderLayer::canRender3DTransforms() const
 
 void RenderLayer::updateLayerPositions(UpdateLayerPositionsFlags flags, IntPoint* cachedOffset)
 {
-    if (flags & DoFullRepaint) {
-        renderer()->repaint();
-#if USE(ACCELERATED_COMPOSITING)
-        flags &= ~CheckForRepaint;
-        // We need the full repaint to propagate to child layers if we are hardware compositing.
-        if (!compositor()->inCompositingMode())
-            flags &= ~DoFullRepaint;
-#else
-        flags &= ~(CheckForRepaint | DoFullRepaint);
-#endif
-    }
-    
-
     updateLayerPosition(); // For relpositioned layers or non-positioned layers,
                            // we need to keep in sync, since we may have shifted relative
                            // to our parent layer.
@@ -1121,6 +1122,7 @@ void RenderLayer::removeOnlyThisLayer()
         RenderLayer* next = current->nextSibling();
         removeChild(current);
         parent->addChild(current, nextSib);
+        current->setNeedsFullRepaint();
         current->updateLayerPositions(); // Depends on hasLayer() already being false for proper layout.
         current = next;
     }
@@ -1806,6 +1808,19 @@ int RenderLayer::visibleWidth() const
     return m_width;
 }
 
+bool RenderLayer::shouldSuspendScrollAnimations() const
+{
+    RenderView* view = renderer()->view();
+    if (!view)
+        return true;
+    return view->frameView()->shouldSuspendScrollAnimations();
+}
+
+IntPoint RenderLayer::currentMousePosition() const
+{
+    return renderer()->frame() ? renderer()->frame()->eventHandler()->currentMousePosition() : IntPoint();
+}
+
 IntSize RenderLayer::scrollbarOffset(const Scrollbar* scrollbar) const
 {
     RenderBox* box = renderBox();
@@ -1915,16 +1930,16 @@ void RenderLayer::setHasVerticalScrollbar(bool hasScrollbar)
 #endif
 }
 
-int RenderLayer::verticalScrollbarWidth() const
+int RenderLayer::verticalScrollbarWidth(OverlayScrollbarSizeRelevancy relevancy) const
 {
-    if (!m_vBar || m_vBar->isOverlayScrollbar())
+    if (!m_vBar || (m_vBar->isOverlayScrollbar() && relevancy == IgnoreOverlayScrollbarSize))
         return 0;
     return m_vBar->width();
 }
 
-int RenderLayer::horizontalScrollbarHeight() const
+int RenderLayer::horizontalScrollbarHeight(OverlayScrollbarSizeRelevancy relevancy) const
 {
-    if (!m_hBar || m_hBar->isOverlayScrollbar())
+    if (!m_hBar || (m_hBar->isOverlayScrollbar() && relevancy == IgnoreOverlayScrollbarSize))
         return 0;
     return m_hBar->height();
 }
@@ -2214,16 +2229,36 @@ void RenderLayer::updateScrollInfoAfterLayout()
 #endif
 }
 
-void RenderLayer::paintOverflowControls(GraphicsContext* context, int tx, int ty, const IntRect& damageRect)
+void RenderLayer::paintOverflowControls(GraphicsContext* context, int tx, int ty, const IntRect& damageRect, bool paintingOverlayControls)
 {
     // Don't do anything if we have no overflow.
     if (!renderer()->hasOverflowClip())
         return;
-    
+
+    // Overlay scrollbars paint in a second pass through the layer tree so that they will paint
+    // on top of everything else. If this is the normal painting pass, paintingOverlayControls
+    // will be false, and we should just tell the root layer that there are overlay scrollbars
+    // that need to be painted. That will cause the second pass through the layer tree to run,
+    // and we'll paint the scrollbars then. In the meantime, cache tx and ty so that the 
+    // second pass doesn't need to re-enter the RenderTree to get it right.
+    if (hasOverlayScrollbars() && !paintingOverlayControls) {
+        RenderLayer* rootLayer = renderer()->view()->layer();
+        rootLayer->setContainsDirtyOverlayScrollbars(true);
+        m_cachedOverlayScrollbarOffset = IntPoint(tx, ty);
+        return;
+    }
+
+    int offsetX = tx;
+    int offsetY = ty;
+    if (paintingOverlayControls) {
+        offsetX = m_cachedOverlayScrollbarOffset.x();
+        offsetY = m_cachedOverlayScrollbarOffset.y();
+    }
+
     // Move the scrollbar widgets if necessary.  We normally move and resize widgets during layout, but sometimes
     // widgets can move without layout occurring (most notably when you scroll a document that
     // contains fixed positioned elements).
-    positionOverflowControls(tx, ty);
+    positionOverflowControls(offsetX, offsetY);
 
     // Now that we're sure the scrollbars are in the right place, paint them.
     if (m_hBar)
@@ -2233,10 +2268,10 @@ void RenderLayer::paintOverflowControls(GraphicsContext* context, int tx, int ty
 
     // We fill our scroll corner with white if we have a scrollbar that doesn't run all the way up to the
     // edge of the box.
-    paintScrollCorner(context, tx, ty, damageRect);
+    paintScrollCorner(context, offsetX, offsetY, damageRect);
     
     // Paint our resizer last, since it sits on top of the scroll corner.
-    paintResizer(context, tx, ty, damageRect);
+    paintResizer(context, offsetX, offsetY, damageRect);
 }
 
 void RenderLayer::paintScrollCorner(GraphicsContext* context, int tx, int ty, const IntRect& damageRect)
@@ -2258,8 +2293,11 @@ void RenderLayer::paintScrollCorner(GraphicsContext* context, int tx, int ty, co
         m_scrollCorner->paintIntoRect(context, tx, ty, absRect);
         return;
     }
-    
-    context->fillRect(absRect, Color::white, box->style()->colorSpace());
+
+    // We don't want to paint white if we have overlay scrollbars, since we need
+    // to see what is behind it.
+    if (!hasOverlayScrollbars())
+        context->fillRect(absRect, Color::white, box->style()->colorSpace());
 }
 
 void RenderLayer::paintResizer(GraphicsContext* context, int tx, int ty, const IntRect& damageRect)
@@ -2376,6 +2414,15 @@ void RenderLayer::paint(GraphicsContext* p, const IntRect& damageRect, PaintBeha
         it->first->setOverlapTestResult(false);
 }
 
+void RenderLayer::paintOverlayScrollbars(GraphicsContext* p, const IntRect& damageRect, PaintBehavior paintBehavior, RenderObject *paintingRoot)
+{
+    if (!m_containsDirtyOverlayScrollbars)
+        return;
+    paintLayer(this, p, damageRect, paintBehavior, paintingRoot, 0, PaintLayerHaveTransparency | PaintLayerTemporaryClipRects 
+               | PaintLayerPaintingOverlayScrollbars);
+    m_containsDirtyOverlayScrollbars = false;
+}
+
 static void setClip(GraphicsContext* p, const IntRect& paintDirtyRect, const IntRect& clipRect)
 {
     if (paintDirtyRect == clipRect)
@@ -2526,9 +2573,11 @@ void RenderLayer::paintLayer(RenderLayer* rootLayer, GraphicsContext* p,
     if (overlapTestRequests && isSelfPaintingLayer())
         performOverlapTests(*overlapTestRequests, rootLayer, this);
 
+    bool paintingOverlayScrollbars = paintFlags & PaintLayerPaintingOverlayScrollbars;
+
     // We want to paint our layer, but only if we intersect the damage rect.
     bool shouldPaint = intersectsDamageRect(layerBounds, damageRect, rootLayer) && m_hasVisibleContent && isSelfPaintingLayer();
-    if (shouldPaint && !selectionOnly && !damageRect.isEmpty()) {
+    if (shouldPaint && !selectionOnly && !damageRect.isEmpty() && !paintingOverlayScrollbars) {
         // Begin transparency layers lazily now that we know we have to paint something.
         if (haveTransparency)
             beginTransparencyLayers(p, rootLayer, paintBehavior);
@@ -2549,7 +2598,7 @@ void RenderLayer::paintLayer(RenderLayer* rootLayer, GraphicsContext* p,
     paintList(m_negZOrderList, rootLayer, p, paintDirtyRect, paintBehavior, paintingRoot, overlapTestRequests, localPaintFlags);
 
     // Now establish the appropriate clip and paint our child RenderObjects.
-    if (shouldPaint && !clipRectToApply.isEmpty()) {
+    if (shouldPaint && !clipRectToApply.isEmpty() && !paintingOverlayScrollbars) {
         // Begin transparency layers lazily now that we know we have to paint something.
         if (haveTransparency)
             beginTransparencyLayers(p, rootLayer, paintBehavior);
@@ -2574,7 +2623,7 @@ void RenderLayer::paintLayer(RenderLayer* rootLayer, GraphicsContext* p,
         restoreClip(p, paintDirtyRect, clipRectToApply);
     }
     
-    if (!outlineRect.isEmpty() && isSelfPaintingLayer()) {
+    if (!outlineRect.isEmpty() && isSelfPaintingLayer() && !paintingOverlayScrollbars) {
         // Paint our own outline
         PaintInfo paintInfo(p, outlineRect, PaintPhaseSelfOutline, false, paintingRootForRenderer, 0);
         setClip(p, paintDirtyRect, outlineRect);
@@ -2588,7 +2637,7 @@ void RenderLayer::paintLayer(RenderLayer* rootLayer, GraphicsContext* p,
     // Now walk the sorted list of children with positive z-indices.
     paintList(m_posZOrderList, rootLayer, p, paintDirtyRect, paintBehavior, paintingRoot, overlapTestRequests, localPaintFlags);
         
-    if (renderer()->hasMask() && shouldPaint && !selectionOnly && !damageRect.isEmpty()) {
+    if (renderer()->hasMask() && shouldPaint && !selectionOnly && !damageRect.isEmpty() && !paintingOverlayScrollbars) {
         setClip(p, paintDirtyRect, damageRect);
 
         // Paint the mask.
@@ -2599,6 +2648,12 @@ void RenderLayer::paintLayer(RenderLayer* rootLayer, GraphicsContext* p,
         restoreClip(p, paintDirtyRect, damageRect);
     }
 
+    if (paintingOverlayScrollbars) {
+        setClip(p, paintDirtyRect, damageRect);
+        paintOverflowControls(p, tx, ty, damageRect, true);
+        restoreClip(p, paintDirtyRect, damageRect);
+    }
+
     // End our transparency layer
     if (haveTransparency && m_usedTransparency && !m_paintingInsideReflection) {
         p->endTransparencyLayer();
diff --git a/Source/WebCore/rendering/RenderLayer.h b/Source/WebCore/rendering/RenderLayer.h
index 7dddbc8..d2d41df 100644
--- a/Source/WebCore/rendering/RenderLayer.h
+++ b/Source/WebCore/rendering/RenderLayer.h
@@ -282,8 +282,8 @@ public:
     Scrollbar* horizontalScrollbar() const { return m_hBar.get(); }
     Scrollbar* verticalScrollbar() const { return m_vBar.get(); }
 
-    int verticalScrollbarWidth() const;
-    int horizontalScrollbarHeight() const;
+    int verticalScrollbarWidth(OverlayScrollbarSizeRelevancy relevancy = IgnoreOverlayScrollbarSize) const;
+    int horizontalScrollbarHeight(OverlayScrollbarSizeRelevancy relevancy = IgnoreOverlayScrollbarSize) const;
 
     bool hasOverflowControls() const;
 #if ENABLE(ANDROID_OVERFLOW_SCROLL)
@@ -295,7 +295,7 @@ public:
     bool hitTestOverflowControls(HitTestResult&, const IntPoint& localPoint);
     IntSize offsetFromResizeCorner(const IntPoint& absolutePoint) const;
 
-    void paintOverflowControls(GraphicsContext*, int tx, int ty, const IntRect& damageRect);
+    void paintOverflowControls(GraphicsContext*, int tx, int ty, const IntRect& damageRect, bool paintingOverlayControls = false);
     void paintScrollCorner(GraphicsContext*, int tx, int ty, const IntRect& damageRect);
     void paintResizer(GraphicsContext*, int tx, int ty, const IntRect& damageRect);
 
@@ -327,14 +327,13 @@ public:
     void updateLayerPosition();
     
     enum UpdateLayerPositionsFlag {
-        DoFullRepaint = 1,
-        CheckForRepaint = 1 << 1,
-        IsCompositingUpdateRoot = 1 << 2,
-        UpdateCompositingLayers = 1 << 3,
-        UpdatePagination = 1 << 4
+        CheckForRepaint = 1,
+        IsCompositingUpdateRoot = 1 << 1,
+        UpdateCompositingLayers = 1 << 2,
+        UpdatePagination = 1 << 3
     };
     typedef unsigned UpdateLayerPositionsFlags;
-    void updateLayerPositions(UpdateLayerPositionsFlags = DoFullRepaint | IsCompositingUpdateRoot | UpdateCompositingLayers, IntPoint* cachedOffset = 0);
+    void updateLayerPositions(UpdateLayerPositionsFlags = CheckForRepaint | IsCompositingUpdateRoot | UpdateCompositingLayers, IntPoint* cachedOffset = 0);
 
     void updateTransform();
 
@@ -409,6 +408,7 @@ public:
     // layers that intersect the point from front to back.
     void paint(GraphicsContext*, const IntRect& damageRect, PaintBehavior = PaintBehaviorNormal, RenderObject* paintingRoot = 0);
     bool hitTest(const HitTestRequest&, HitTestResult&);
+    void paintOverlayScrollbars(GraphicsContext*, const IntRect& damageRect, PaintBehavior, RenderObject* paintingRoot);
 
     // This method figures out our layerBounds in coordinates relative to
     // |rootLayer}.  It also computes our background and foreground clip rects
@@ -491,6 +491,9 @@ public:
 
     bool paintsWithTransform(PaintBehavior) const;
 
+    bool containsDirtyOverlayScrollbars() const { return m_containsDirtyOverlayScrollbars; }
+    void setContainsDirtyOverlayScrollbars(bool dirtyScrollbars) { m_containsDirtyOverlayScrollbars = dirtyScrollbars; }
+
 private:
     // The normal operator new is disallowed on all render objects.
     void* operator new(size_t) throw();
@@ -513,7 +516,8 @@ private:
         PaintLayerHaveTransparency = 1,
         PaintLayerAppliedTransform = 1 << 1,
         PaintLayerTemporaryClipRects = 1 << 2,
-        PaintLayerPaintingReflection = 1 << 3
+        PaintLayerPaintingReflection = 1 << 3,
+        PaintLayerPaintingOverlayScrollbars = 1 << 4
     };
     
     typedef unsigned PaintLayerFlags;
@@ -573,6 +577,10 @@ private:
     virtual IntSize contentsSize() const;
     virtual int visibleHeight() const;
     virtual int visibleWidth() const;
+    virtual IntPoint currentMousePosition() const;
+    virtual bool shouldSuspendScrollAnimations() const;
+
+    virtual void disconnectFromPage() { m_page = 0; }
 
     // NOTE: This should only be called by the overriden setScrollOffset from ScrollableArea.
     void scrollTo(int x, int y);
@@ -666,18 +674,6 @@ protected:
     int m_scrollX;
     int m_scrollY;
     
-    // There are 8 possible combinations of writing mode and direction.  Scroll origin (and its corresponding left/top overflow)
-    // will be non-zero in the x or y axis if there is any reversed direction or writing-mode.  The combinations are:
-    // writing-mode / direction     scrollOrigin.x() set    scrollOrigin.y() set
-    // horizontal-tb / ltr          NO                      NO
-    // horizontal-tb / rtl          YES                     NO
-    // horizontal-bt / ltr          NO                      YES
-    // horizontal-bt / rtl          YES                     YES
-    // vertical-lr / ltr            NO                      NO
-    // vertical-lr / rtl            NO                      YES
-    // vertical-rl / ltr            YES                     NO
-    // vertical-rl / rtl            YES                     YES
-    IntPoint m_scrollOrigin;
     int m_scrollLeftOverflow;
     int m_scrollTopOverflow;
     
@@ -741,6 +737,10 @@ protected:
     bool m_hasOverflowScroll : 1;
 #endif
 
+    bool m_containsDirtyOverlayScrollbars : 1;
+
+    IntPoint m_cachedOverlayScrollbarOffset;
+
     RenderMarquee* m_marquee; // Used by layers with overflow:marquee
     
     // Cached normal flow values for absolute positioned elements with static left/top values.
@@ -762,6 +762,8 @@ private:
 #if USE(ACCELERATED_COMPOSITING)
     OwnPtr<RenderLayerBacking> m_backing;
 #endif
+
+    Page* m_page;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/rendering/RenderLayerBacking.cpp b/Source/WebCore/rendering/RenderLayerBacking.cpp
index bda34ee..ec3b6fd 100644
--- a/Source/WebCore/rendering/RenderLayerBacking.cpp
+++ b/Source/WebCore/rendering/RenderLayerBacking.cpp
@@ -380,6 +380,7 @@ void RenderLayerBacking::updateGraphicsLayerGeometry()
     
     IntSize oldOffsetFromRenderer = m_graphicsLayer->offsetFromRenderer();
     m_graphicsLayer->setOffsetFromRenderer(localCompositingBounds.location() - IntPoint());
+    
     // If the compositing layer offset changes, we need to repaint.
     if (oldOffsetFromRenderer != m_graphicsLayer->offsetFromRenderer())
         m_graphicsLayer->setNeedsDisplay();
@@ -449,10 +450,9 @@ void RenderLayerBacking::updateGraphicsLayerGeometry()
         FloatPoint foregroundPosition;
         FloatSize foregroundSize = newSize;
         IntSize foregroundOffset = m_graphicsLayer->offsetFromRenderer();
-        // If we have a clipping layer (which clips descendants), then the foreground layer is a child of it,
-        // so that it gets correctly sorted with children. In that case, position relative to the clipping layer.
         if (m_clippingLayer) {
-            foregroundPosition = FloatPoint() + (localCompositingBounds.location() - clippingBox.location());
+            // If we have a clipping layer (which clips descendants), then the foreground layer is a child of it,
+            // so that it gets correctly sorted with children. In that case, position relative to the clipping layer.
             foregroundSize = FloatSize(clippingBox.size());
             foregroundOffset = clippingBox.location() - IntPoint();
         }
@@ -930,18 +930,6 @@ IntRect RenderLayerBacking::contentsBox() const
     return contentsRect;
 }
 
-// Map the given point from coordinates in the GraphicsLayer to RenderLayer coordinates.
-FloatPoint RenderLayerBacking::graphicsLayerToContentsCoordinates(const GraphicsLayer* graphicsLayer, const FloatPoint& point)
-{
-    return point + FloatSize(graphicsLayer->offsetFromRenderer());
-}
-
-// Map the given point from coordinates in the RenderLayer to GraphicsLayer coordinates.
-FloatPoint RenderLayerBacking::contentsToGraphicsLayerCoordinates(const GraphicsLayer* graphicsLayer, const FloatPoint& point)
-{
-    return point - FloatSize(graphicsLayer->offsetFromRenderer());
-}
-
 bool RenderLayerBacking::paintingGoesToWindow() const
 {
     if (m_owningLayer->isRootLayer())
@@ -966,21 +954,21 @@ void RenderLayerBacking::setContentsNeedDisplay()
 void RenderLayerBacking::setContentsNeedDisplayInRect(const IntRect& r)
 {
     if (m_graphicsLayer && m_graphicsLayer->drawsContent()) {
-        FloatPoint dirtyOrigin = contentsToGraphicsLayerCoordinates(m_graphicsLayer.get(), FloatPoint(r.x(), r.y()));
-        FloatRect dirtyRect(dirtyOrigin, r.size());
-        FloatRect bounds(FloatPoint(), m_graphicsLayer->size());
-        if (bounds.intersects(dirtyRect))
-            m_graphicsLayer->setNeedsDisplayInRect(dirtyRect);
+        IntRect layerDirtyRect = r;
+        layerDirtyRect.move(-m_graphicsLayer->offsetFromRenderer());
+        m_graphicsLayer->setNeedsDisplayInRect(layerDirtyRect);
     }
 
     if (m_foregroundLayer && m_foregroundLayer->drawsContent()) {
-        // FIXME: do incremental repaint
-        m_foregroundLayer->setNeedsDisplay();
+        IntRect layerDirtyRect = r;
+        layerDirtyRect.move(-m_foregroundLayer->offsetFromRenderer());
+        m_foregroundLayer->setNeedsDisplayInRect(layerDirtyRect);
     }
 
     if (m_maskLayer && m_maskLayer->drawsContent()) {
-        // FIXME: do incremental repaint
-        m_maskLayer->setNeedsDisplay();
+        IntRect layerDirtyRect = r;
+        layerDirtyRect.move(-m_maskLayer->offsetFromRenderer());
+        m_maskLayer->setNeedsDisplayInRect(layerDirtyRect);
     }
 }
 
@@ -1123,10 +1111,11 @@ void RenderLayerBacking::paintIntoLayer(RenderLayer* rootLayer, GraphicsContext*
 }
 
 // Up-call from compositing layer drawing callback.
-void RenderLayerBacking::paintContents(const GraphicsLayer*, GraphicsContext& context, GraphicsLayerPaintingPhase paintingPhase, const IntRect& clip)
+void RenderLayerBacking::paintContents(const GraphicsLayer* graphicsLayer, GraphicsContext& context, GraphicsLayerPaintingPhase paintingPhase, const IntRect& clip)
 {
     InspectorInstrumentationCookie cookie = InspectorInstrumentation::willPaint(m_owningLayer->renderer()->frame(), clip);
 
+<<<<<<< HEAD
     // We have to use the same root as for hit testing, because both methods
     // can compute and cache clipRects.
     IntRect enclosingBBox = compositedBounds();
@@ -1136,19 +1125,19 @@ void RenderLayerBacking::paintContents(const GraphicsLayer*, GraphicsContext& co
     if (m_owningLayer->hasOverflowParent())
         enclosingBBox.setSize(clip.size());
 #endif
+=======
+    IntSize offset = graphicsLayer->offsetFromRenderer();
+    context.translate(-offset);
+>>>>>>> webkit.org at r82507
 
     IntRect clipRect(clip);
-    
-    // Set up the coordinate space to be in the layer's rendering coordinates.
-    context.translate(-enclosingBBox.x(), -enclosingBBox.y());
-
-    // Offset the clip.
-    clipRect.move(enclosingBBox.x(), enclosingBBox.y());
+    clipRect.move(offset);
     
     // The dirtyRect is in the coords of the painting root.
-    IntRect dirtyRect = enclosingBBox;
+    IntRect dirtyRect = compositedBounds();
     dirtyRect.intersect(clipRect);
 
+    // We have to use the same root as for hit testing, because both methods can compute and cache clipRects.
     paintIntoLayer(m_owningLayer, &context, dirtyRect, PaintBehaviorNormal, paintingPhase, renderer());
 
     InspectorInstrumentation::didPaint(cookie);
diff --git a/Source/WebCore/rendering/RenderLayerBacking.h b/Source/WebCore/rendering/RenderLayerBacking.h
index 726b777..8f0927d 100644
--- a/Source/WebCore/rendering/RenderLayerBacking.h
+++ b/Source/WebCore/rendering/RenderLayerBacking.h
@@ -123,9 +123,6 @@ public:
     
     void updateAfterWidgetResize();
 
-    FloatPoint graphicsLayerToContentsCoordinates(const GraphicsLayer*, const FloatPoint&);
-    FloatPoint contentsToGraphicsLayerCoordinates(const GraphicsLayer*, const FloatPoint&);
-
     // GraphicsLayerClient interface
     virtual void notifyAnimationStarted(const GraphicsLayer*, double startTime);
     virtual void notifySyncRequired(const GraphicsLayer*);
diff --git a/Source/WebCore/rendering/RenderLayerCompositor.cpp b/Source/WebCore/rendering/RenderLayerCompositor.cpp
index 4ab274f..6542ffd 100644
--- a/Source/WebCore/rendering/RenderLayerCompositor.cpp
+++ b/Source/WebCore/rendering/RenderLayerCompositor.cpp
@@ -109,11 +109,22 @@ RenderLayerCompositor::RenderLayerCompositor(RenderView* renderView)
     , m_compositing(false)
     , m_compositingLayersNeedRebuild(false)
     , m_flushingLayers(false)
+    , m_forceCompositingMode(false)
     , m_rootLayerAttachment(RootLayerUnattached)
 #if PROFILE_LAYER_REBUILD
     , m_rootLayerUpdateCount(0)
 #endif // PROFILE_LAYER_REBUILD
 {
+    Settings* settings = m_renderView->document()->settings();
+
+    // Even when forcing compositing mode, ignore child frames, or this will trigger
+    // layer creation from the enclosing RenderIFrame.
+    ASSERT(m_renderView->document()->frame());
+    if (settings && settings->forceCompositingMode() && settings->acceleratedCompositingEnabled()
+        && !m_renderView->document()->frame()->tree()->parent()) {
+        m_forceCompositingMode = true;
+        enableCompositingMode();
+    }
 }
 
 RenderLayerCompositor::~RenderLayerCompositor()
@@ -439,7 +450,7 @@ IntRect RenderLayerCompositor::calculateCompositedBounds(const RenderLayer* laye
     if (layer->renderer()->isRoot()) {
         // If the root layer becomes composited (e.g. because some descendant with negative z-index is composited),
         // then it has to be big enough to cover the viewport in order to display the background. This is akin
-        // to the code in RenderBox::paintRootBoxDecorations().
+        // to the code in RenderBox::paintRootBoxFillLayers().
         if (m_renderView->frameView()) {
             int rw = m_renderView->frameView()->contentsWidth();
             int rh = m_renderView->frameView()->contentsHeight();
@@ -770,7 +781,7 @@ void RenderLayerCompositor::computeCompositingRequirements(RenderLayer* layer, O
 
     // If we're back at the root, and no other layers need to be composited, and the root layer itself doesn't need
     // to be composited, then we can drop out of compositing mode altogether.
-    if (layer->isRootLayer() && !childState.m_subtreeIsCompositing && !requiresCompositingLayer(layer)) {
+    if (layer->isRootLayer() && !childState.m_subtreeIsCompositing && !requiresCompositingLayer(layer) && !m_forceCompositingMode) {
         enableCompositingMode(false);
         willBeComposited = false;
     }
@@ -939,7 +950,7 @@ void RenderLayerCompositor::frameViewDidScroll(const IntPoint& scrollPosition)
         m_scrollLayer->setPosition(FloatPoint(-scrollPosition.x(), -scrollPosition.y()));
 }
 
-String RenderLayerCompositor::layerTreeAsText()
+String RenderLayerCompositor::layerTreeAsText(bool showDebugInfo)
 {
     if (compositingLayerUpdatePending())
         updateCompositingLayers();
@@ -949,7 +960,7 @@ String RenderLayerCompositor::layerTreeAsText()
 
     // We skip dumping the scroll and clip layers to keep layerTreeAsText output
     // similar between platforms.
-    return m_rootPlatformLayer->layerTreeAsText();
+    return m_rootPlatformLayer->layerTreeAsText(showDebugInfo ? LayerTreeAsTextDebug : LayerTreeAsTextBehaviorNormal);
 }
 
 RenderLayerCompositor* RenderLayerCompositor::iframeContentsCompositor(RenderIFrame* renderer)
diff --git a/Source/WebCore/rendering/RenderLayerCompositor.h b/Source/WebCore/rendering/RenderLayerCompositor.h
index 1cf9ea9..c3deb3f 100644
--- a/Source/WebCore/rendering/RenderLayerCompositor.h
+++ b/Source/WebCore/rendering/RenderLayerCompositor.h
@@ -175,7 +175,7 @@ public:
     void frameViewDidChangeSize(const IntPoint& contentsOffset = IntPoint());
     void frameViewDidScroll(const IntPoint& = IntPoint());
 
-    String layerTreeAsText();
+    String layerTreeAsText(bool showDebugInfo = false);
 
     // These are named to avoid conflicts with the functions in GraphicsLayerClient
     // These return the actual internal variables.
@@ -277,6 +277,7 @@ private:
     bool m_compositing;
     bool m_compositingLayersNeedRebuild;
     bool m_flushingLayers;
+    bool m_forceCompositingMode;
 
     RootLayerAttachment m_rootLayerAttachment;
 
diff --git a/Source/WebCore/rendering/RenderListBox.cpp b/Source/WebCore/rendering/RenderListBox.cpp
index 4457285..ab3a832 100644
--- a/Source/WebCore/rendering/RenderListBox.cpp
+++ b/Source/WebCore/rendering/RenderListBox.cpp
@@ -82,11 +82,17 @@ RenderListBox::RenderListBox(Element* element)
     , m_optionsWidth(0)
     , m_indexOffset(0)
 {
+    if (Page* page = frame()->page()) {
+        m_page = page;
+        m_page->addScrollableArea(this);
+    }
 }
 
 RenderListBox::~RenderListBox()
 {
     setHasVerticalScrollbar(false);
+    if (m_page)
+        m_page->removeScrollableArea(this);
 }
 
 void RenderListBox::updateFromElement()
@@ -316,6 +322,25 @@ void RenderListBox::paintScrollbar(PaintInfo& paintInfo, int tx, int ty)
     }
 }
 
+static IntSize itemOffsetForAlignment(TextRun textRun, RenderStyle* itemStyle, Font itemFont, IntRect itemBoudingBox)
+{
+    ETextAlign actualAlignment = itemStyle->textAlign();
+    // FIXME: Firefox doesn't respect JUSTIFY. Should we?
+    if (actualAlignment == TAAUTO || actualAlignment == JUSTIFY)
+      actualAlignment = itemStyle->isLeftToRightDirection() ? LEFT : RIGHT;
+
+    IntSize offset = IntSize(0, itemFont.fontMetrics().ascent());
+    if (actualAlignment == RIGHT || actualAlignment == WEBKIT_RIGHT) {
+        float textWidth = itemFont.width(textRun);
+        offset.setWidth(itemBoudingBox.width() - textWidth - optionsSpacingHorizontal);
+    } else if (actualAlignment == CENTER || actualAlignment == WEBKIT_CENTER) {
+        float textWidth = itemFont.width(textRun);
+        offset.setWidth((itemBoudingBox.width() - textWidth) / 2);
+    } else
+        offset.setWidth(optionsSpacingHorizontal);
+    return offset;
+}
+
 void RenderListBox::paintItemForeground(PaintInfo& paintInfo, int tx, int ty, int listIndex)
 {
     SelectElement* select = toSelectElement(static_cast<Element*>(node()));
@@ -323,19 +348,18 @@ void RenderListBox::paintItemForeground(PaintInfo& paintInfo, int tx, int ty, in
     Element* element = listItems[listIndex];
     OptionElement* optionElement = toOptionElement(element);
 
+    RenderStyle* itemStyle = element->renderStyle();
+    if (!itemStyle)
+        itemStyle = style();
+
+    if (itemStyle->visibility() == HIDDEN)
+        return;
+
     String itemText;
     if (optionElement)
         itemText = optionElement->textIndentedToRespectGroupLabel();
     else if (OptionGroupElement* optionGroupElement = toOptionGroupElement(element))
-        itemText = optionGroupElement->groupLabelText();      
-
-    // Determine where the item text should be placed
-    IntRect r = itemBoundingBoxRect(tx, ty, listIndex);
-    r.move(optionsSpacingHorizontal, style()->fontMetrics().ascent());
-
-    RenderStyle* itemStyle = element->renderStyle();
-    if (!itemStyle)
-        itemStyle = style();
+        itemText = optionGroupElement->groupLabelText();
     
     Color textColor = element->renderStyle() ? element->renderStyle()->visitedDependentColor(CSSPropertyColor) : style()->visitedDependentColor(CSSPropertyColor);
     if (optionElement && optionElement->selected()) {
@@ -349,7 +373,13 @@ void RenderListBox::paintItemForeground(PaintInfo& paintInfo, int tx, int ty, in
     ColorSpace colorSpace = itemStyle->colorSpace();
     paintInfo.context->setFillColor(textColor, colorSpace);
 
+    unsigned length = itemText.length();
+    const UChar* string = itemText.characters();
+    TextRun textRun(string, length, false, 0, 0, TextRun::AllowTrailingExpansion, !itemStyle->isLeftToRightDirection(), itemStyle->unicodeBidi() == Override);
     Font itemFont = style()->font();
+    IntRect r = itemBoundingBoxRect(tx, ty, listIndex);
+    r.move(itemOffsetForAlignment(textRun, itemStyle, itemFont, r));
+
     if (isOptionGroupElement(element)) {
         FontDescription d = itemFont.fontDescription();
         d.setWeight(d.bolderWeight());
@@ -357,10 +387,6 @@ void RenderListBox::paintItemForeground(PaintInfo& paintInfo, int tx, int ty, in
         itemFont.update(document()->styleSelector()->fontSelector());
     }
 
-    unsigned length = itemText.length();
-    const UChar* string = itemText.characters();
-    TextRun textRun(string, length, false, 0, 0, TextRun::AllowTrailingExpansion, !itemStyle->isLeftToRightDirection(), itemStyle->unicodeBidi() == Override);
-
     // Draw the item text
     if (itemStyle->visibility() != HIDDEN)
         paintInfo.context->drawBidiText(itemFont, textRun, r.location());
@@ -747,6 +773,14 @@ IntPoint RenderListBox::currentMousePosition() const
     return view->frameView()->currentMousePosition();
 }
 
+bool RenderListBox::shouldSuspendScrollAnimations() const
+{
+    RenderView* view = this->view();
+    if (!view)
+        return true;
+    return view->frameView()->shouldSuspendScrollAnimations();
+}
+
 PassRefPtr<Scrollbar> RenderListBox::createScrollbar()
 {
     RefPtr<Scrollbar> widget;
diff --git a/Source/WebCore/rendering/RenderListBox.h b/Source/WebCore/rendering/RenderListBox.h
index faeede1..0e2cfd6 100644
--- a/Source/WebCore/rendering/RenderListBox.h
+++ b/Source/WebCore/rendering/RenderListBox.h
@@ -112,6 +112,9 @@ private:
     virtual int visibleHeight() const;
     virtual int visibleWidth() const;
     virtual IntPoint currentMousePosition() const;
+    virtual bool shouldSuspendScrollAnimations() const;
+
+    virtual void disconnectFromPage() { m_page = 0; }
 
     // NOTE: This should only be called by the overriden setScrollOffset from ScrollableArea.
     void scrollTo(int newOffset);
@@ -138,6 +141,8 @@ private:
     int m_indexOffset;
 
     RefPtr<Scrollbar> m_vBar;
+
+    Page* m_page;
 };
 
 inline RenderListBox* toRenderListBox(RenderObject* object)
diff --git a/Source/WebCore/rendering/RenderMedia.cpp b/Source/WebCore/rendering/RenderMedia.cpp
index bbb5880..69d71ec 100644
--- a/Source/WebCore/rendering/RenderMedia.cpp
+++ b/Source/WebCore/rendering/RenderMedia.cpp
@@ -89,8 +89,6 @@ void RenderMedia::layout()
     // and this method will be called many times per second during playback, use a LayoutStateMaintainer:
     LayoutStateMaintainer statePusher(view(), this, IntSize(x(), y()), hasTransform() || hasReflection() || style()->isFlippedBlocksWritingMode());
 
-    m_controls->updateTimeDisplayVisibility();
-
     controlsRenderer->setLocation(borderLeft() + paddingLeft(), borderTop() + paddingTop());
     controlsRenderer->style()->setHeight(Length(newSize.height(), Fixed));
     controlsRenderer->style()->setWidth(Length(newSize.width(), Fixed));
diff --git a/Source/WebCore/rendering/RenderMenuList.cpp b/Source/WebCore/rendering/RenderMenuList.cpp
index 8c11959..f155614 100644
--- a/Source/WebCore/rendering/RenderMenuList.cpp
+++ b/Source/WebCore/rendering/RenderMenuList.cpp
@@ -110,6 +110,7 @@ void RenderMenuList::addChild(RenderObject* newChild, RenderObject* beforeChild)
 {
     createInnerBlock();
     m_innerBlock->addChild(newChild, beforeChild);
+    ASSERT(m_innerBlock == firstChild());
 }
 
 void RenderMenuList::removeChild(RenderObject* oldChild)
diff --git a/Source/WebCore/rendering/RenderObject.cpp b/Source/WebCore/rendering/RenderObject.cpp
index d06db14..7cc6f1f 100644
--- a/Source/WebCore/rendering/RenderObject.cpp
+++ b/Source/WebCore/rendering/RenderObject.cpp
@@ -194,6 +194,7 @@ RenderObject::RenderObject(Node* node)
     , m_needsPositionedMovementLayout(false)
     , m_normalChildNeedsLayout(false)
     , m_posChildNeedsLayout(false)
+    , m_needsSimplifiedNormalFlowLayout(false)
     , m_preferredLogicalWidthsDirty(false)
     , m_floating(false)
     , m_positioned(false)
@@ -204,6 +205,7 @@ RenderObject::RenderObject(Node* node)
     , m_isBox(false)
     , m_inline(true)
     , m_replaced(false)
+    , m_horizontalWritingMode(true)
     , m_isDragging(false)
     , m_hasLayer(false)
     , m_hasOverflowClip(false)
@@ -218,7 +220,6 @@ RenderObject::RenderObject(Node* node)
     , m_hasMarkupTruncation(false)
     , m_selectionState(SelectionNone)
     , m_hasColumns(false)
-    , m_cellWidthChanged(false)
 {
 #ifndef NDEBUG
     renderObjectCounter.increment();
@@ -904,7 +905,7 @@ IntRect RenderObject::borderInnerRect(const IntRect& borderRect, unsigned short
 }
 
 #if HAVE(PATH_BASED_BORDER_RADIUS_DRAWING)
-void RenderObject::drawBoxSideFromPath(GraphicsContext* graphicsContext, IntRect borderRect, Path borderPath, 
+void RenderObject::drawBoxSideFromPath(GraphicsContext* graphicsContext, const IntRect& borderRect, const Path& borderPath,
                                     float thickness, float drawThickness, BoxSide s, const RenderStyle* style, 
                                     Color c, EBorderStyle borderStyle)
 {
@@ -1051,7 +1052,7 @@ void RenderObject::drawBoxSideFromPath(GraphicsContext* graphicsContext, IntRect
     graphicsContext->drawRect(borderRect);
 }
 #else
-void RenderObject::drawArcForBoxSide(GraphicsContext* graphicsContext, int x, int y, float thickness, IntSize radius,
+void RenderObject::drawArcForBoxSide(GraphicsContext* graphicsContext, int x, int y, float thickness, const IntSize& radius,
                                      int angleStart, int angleSpan, BoxSide s, Color c,
                                      EBorderStyle style, bool firstCorner)
 {
@@ -1689,9 +1690,12 @@ StyleDifference RenderObject::adjustStyleDifference(StyleDifference diff, unsign
         // Text nodes share style with their parents but transforms don't apply to them,
         // hence the !isText() check.
         // FIXME: when transforms are taken into account for overflow, we will need to do a layout.
-        if (!isText() && (!hasLayer() || !toRenderBoxModelObject(this)->layer()->isComposited()))
-            diff = StyleDifferenceLayout;
-        else if (diff < StyleDifferenceRecompositeLayer)
+        if (!isText() && (!hasLayer() || !toRenderBoxModelObject(this)->layer()->isComposited())) {
+            if (!hasLayer())
+                diff = StyleDifferenceLayout; // FIXME: Do this for now since SimplifiedLayout cannot handle updating floating objects lists.
+            else if (diff < StyleDifferenceSimplifiedLayout)
+                diff = StyleDifferenceSimplifiedLayout;
+        } else if (diff < StyleDifferenceRecompositeLayer)
             diff = StyleDifferenceRecompositeLayer;
     }
 
@@ -1770,6 +1774,8 @@ void RenderObject::setStyle(PassRefPtr<RenderStyle> style)
             setNeedsLayoutAndPrefWidthsRecalc();
         else if (updatedDiff == StyleDifferenceLayoutPositionedMovementOnly)
             setNeedsPositionedMovementLayout();
+        else if (updatedDiff == StyleDifferenceSimplifiedLayout)
+            setNeedsSimplifiedNormalFlowLayout();
     }
     
     if (updatedDiff == StyleDifferenceRepaintLayer || updatedDiff == StyleDifferenceRepaint) {
@@ -1835,6 +1841,7 @@ void RenderObject::styleWillChange(StyleDifference diff, const RenderStyle* newS
             m_positioned = false;
             m_relPositioned = false;
         }
+        m_horizontalWritingMode = true;
         m_paintBackground = false;
         m_hasOverflowClip = false;
         m_hasTransform = false;
@@ -1882,7 +1889,7 @@ void RenderObject::styleDidChange(StyleDifference diff, const RenderStyle* oldSt
     if (!m_parent)
         return;
     
-    if (diff == StyleDifferenceLayout) {
+    if (diff == StyleDifferenceLayout || diff == StyleDifferenceSimplifiedLayout) {
         RenderCounter::rendererStyleChanged(this, oldStyle, m_style.get());
 
         // If the object already needs layout, then setNeedsLayout won't do
@@ -1893,7 +1900,10 @@ void RenderObject::styleDidChange(StyleDifference diff, const RenderStyle* oldSt
         if (m_needsLayout && oldStyle->position() != m_style->position())
             markContainingBlocksForLayout();
 
-        setNeedsLayoutAndPrefWidthsRecalc();
+        if (diff == StyleDifferenceLayout)
+            setNeedsLayoutAndPrefWidthsRecalc();
+        else
+            setNeedsSimplifiedNormalFlowLayout();
     } else if (diff == StyleDifferenceLayoutPositionedMovementOnly)
         setNeedsPositionedMovementLayout();
 
@@ -1939,7 +1949,7 @@ IntRect RenderObject::viewRect() const
     return view()->viewRect();
 }
 
-FloatPoint RenderObject::localToAbsolute(FloatPoint localPoint, bool fixed, bool useTransforms) const
+FloatPoint RenderObject::localToAbsolute(const FloatPoint& localPoint, bool fixed, bool useTransforms) const
 {
     TransformState transformState(TransformState::ApplyTransformDirection, localPoint);
     mapLocalToContainer(0, fixed, useTransforms, transformState);
@@ -1948,7 +1958,7 @@ FloatPoint RenderObject::localToAbsolute(FloatPoint localPoint, bool fixed, bool
     return transformState.lastPlanarPoint();
 }
 
-FloatPoint RenderObject::absoluteToLocal(FloatPoint containerPoint, bool fixed, bool useTransforms) const
+FloatPoint RenderObject::absoluteToLocal(const FloatPoint& containerPoint, bool fixed, bool useTransforms) const
 {
     TransformState transformState(TransformState::UnapplyInverseTransformDirection, containerPoint);
     mapAbsoluteToLocalPoint(fixed, useTransforms, transformState);
@@ -2613,11 +2623,11 @@ RenderBoxModelObject* RenderObject::offsetParent() const
     //     * The computed value of the position property of A is static and the ancestor
     //       is one of the following HTML elements: td, th, or table.
     //     * Our own extension: if there is a difference in the effective zoom
+
     bool skipTables = isPositioned() || isRelPositioned();
     float currZoom = style()->effectiveZoom();
     RenderObject* curr = parent();
-    while (curr && (!curr->node() ||
-                    (!curr->isPositioned() && !curr->isRelPositioned() && !curr->isBody()))) {
+    while (curr && (!curr->node() || (!curr->isPositioned() && !curr->isRelPositioned() && !curr->isBody()))) {
         Node* element = curr->node();
         if (!skipTables && element) {
             bool isTableElement = element->hasTagName(tableTag) ||
@@ -2647,14 +2657,14 @@ VisiblePosition RenderObject::createVisiblePosition(int offset, EAffinity affini
 {
     // If this is a non-anonymous renderer in an editable area, then it's simple.
     if (Node* node = this->node()) {
-        if (!node->isContentEditable()) {
+        if (!node->rendererIsEditable()) {
             // If it can be found, we prefer a visually equivalent position that is editable. 
             Position position(node, offset);
             Position candidate = position.downstream(CanCrossEditingBoundary);
-            if (candidate.deprecatedNode()->isContentEditable())
+            if (candidate.deprecatedNode()->rendererIsEditable())
                 return VisiblePosition(candidate, affinity);
             candidate = position.upstream(CanCrossEditingBoundary);
-            if (candidate.deprecatedNode()->isContentEditable())
+            if (candidate.deprecatedNode()->rendererIsEditable())
                 return VisiblePosition(candidate, affinity);
         }
         // FIXME: Eliminate legacy editing positions
diff --git a/Source/WebCore/rendering/RenderObject.h b/Source/WebCore/rendering/RenderObject.h
index 8b9fa38..41564dd 100644
--- a/Source/WebCore/rendering/RenderObject.h
+++ b/Source/WebCore/rendering/RenderObject.h
@@ -320,8 +320,6 @@ public:
     void setChildrenInline(bool b = true) { m_childrenInline = b; }
     bool hasColumns() const { return m_hasColumns; }
     void setHasColumns(bool b = true) { m_hasColumns = b; }
-    bool cellWidthChanged() const { return m_cellWidthChanged; }
-    void setCellWidthChanged(bool b = true) { m_cellWidthChanged = b; }
 
     virtual bool requiresForcedStyleRecalcPropagation() const { return false; }
 
@@ -388,7 +386,11 @@ public:
     void setIsAnonymous(bool b) { m_isAnonymous = b; }
     bool isAnonymousBlock() const
     {
-        return m_isAnonymous && style()->display() == BLOCK && style()->styleType() == NOPSEUDO && !isListMarker();
+        // This function is kept in sync with anonymous block creation conditions in
+        // RenderBlock::createAnonymousBlock(). This includes creating an anonymous
+        // RenderBlock having a BLOCK or BOX display. Other classes such as RenderTextFragment
+        // are not RenderBlocks and will return false. See https://bugs.webkit.org/show_bug.cgi?id=56709. 
+        return m_isAnonymous && (style()->display() == BLOCK || style()->display() == BOX) && style()->styleType() == NOPSEUDO && isRenderBlock() && !isListMarker();
     }
     bool isAnonymousColumnsBlock() const { return style()->specifiesColumns() && isAnonymousBlock(); }
     bool isAnonymousColumnSpanBlock() const { return style()->columnSpan() && isAnonymousBlock(); }
@@ -406,17 +408,19 @@ public:
     bool isRunIn() const { return style()->display() == RUN_IN; } // run-in object
     bool isDragging() const { return m_isDragging; }
     bool isReplaced() const { return m_replaced; } // a "replaced" element (see CSS)
-    
+    bool isHorizontalWritingMode() const { return m_horizontalWritingMode; }
+
     bool hasLayer() const { return m_hasLayer; }
     
     bool hasBoxDecorations() const { return m_paintBackground; }
     bool mustRepaintBackgroundOrBorder() const;
     bool hasBackground() const { return style()->hasBackground(); }
-    bool needsLayout() const { return m_needsLayout || m_normalChildNeedsLayout || m_posChildNeedsLayout || m_needsPositionedMovementLayout; }
+    bool needsLayout() const { return m_needsLayout || m_normalChildNeedsLayout || m_posChildNeedsLayout || m_needsSimplifiedNormalFlowLayout || m_needsPositionedMovementLayout; }
     bool selfNeedsLayout() const { return m_needsLayout; }
     bool needsPositionedMovementLayout() const { return m_needsPositionedMovementLayout; }
-    bool needsPositionedMovementLayoutOnly() const { return m_needsPositionedMovementLayout && !m_needsLayout && !m_normalChildNeedsLayout && !m_posChildNeedsLayout; }
+    bool needsPositionedMovementLayoutOnly() const { return m_needsPositionedMovementLayout && !m_needsLayout && !m_normalChildNeedsLayout && !m_posChildNeedsLayout && !m_needsSimplifiedNormalFlowLayout; }
     bool posChildNeedsLayout() const { return m_posChildNeedsLayout; }
+    bool needsSimplifiedNormalFlowLayout() const { return m_needsSimplifiedNormalFlowLayout; }
     bool normalChildNeedsLayout() const { return m_normalChildNeedsLayout; }
     
     bool preferredLogicalWidthsDirty() const { return m_preferredLogicalWidthsDirty; }
@@ -432,13 +436,13 @@ public:
     void drawLineForBoxSide(GraphicsContext*, int x1, int y1, int x2, int y2, BoxSide,
                             Color, EBorderStyle, int adjbw1, int adjbw2);
 #if HAVE(PATH_BASED_BORDER_RADIUS_DRAWING)
-    void drawBoxSideFromPath(GraphicsContext*, IntRect, Path, 
+    void drawBoxSideFromPath(GraphicsContext*, const IntRect&, const Path&,
                             float thickness, float drawThickness, BoxSide, const RenderStyle*, 
                             Color, EBorderStyle);
 #else
     // FIXME: This function should be removed when all ports implement GraphicsContext::clipConvexPolygon()!!
     // At that time, everyone can use RenderObject::drawBoxSideFromPath() instead. This should happen soon.
-    void drawArcForBoxSide(GraphicsContext*, int x, int y, float thickness, IntSize radius, int angleStart,
+    void drawArcForBoxSide(GraphicsContext*, int x, int y, float thickness, const IntSize& radius, int angleStart,
                            int angleSpan, BoxSide, Color, EBorderStyle, bool firstCorner);
 #endif
 
@@ -485,6 +489,7 @@ public:
     void setNeedsLayout(bool b, bool markParents = true);
     void setChildNeedsLayout(bool b, bool markParents = true);
     void setNeedsPositionedMovementLayout();
+    void setNeedsSimplifiedNormalFlowLayout();
     void setPreferredLogicalWidthsDirty(bool, bool markParents = true);
     void invalidateContainerPreferredLogicalWidths();
     
@@ -502,6 +507,7 @@ public:
     void setIsText() { m_isText = true; }
     void setIsBox() { m_isBox = true; }
     void setReplaced(bool b = true) { m_replaced = b; }
+    void setHorizontalWritingMode(bool b = true) { m_horizontalWritingMode = b; }
     void setHasOverflowClip(bool b = true) { m_hasOverflowClip = b; }
     void setHasLayer(bool b = true) { m_hasLayer = b; }
     void setHasTransform(bool b = true) { m_hasTransform = b; }
@@ -557,8 +563,8 @@ public:
 
     // Convert the given local point to absolute coordinates
     // FIXME: Temporary. If useTransforms is true, take transforms into account. Eventually localToAbsolute() will always be transform-aware.
-    FloatPoint localToAbsolute(FloatPoint localPoint = FloatPoint(), bool fixed = false, bool useTransforms = false) const;
-    FloatPoint absoluteToLocal(FloatPoint, bool fixed = false, bool useTransforms = false) const;
+    FloatPoint localToAbsolute(const FloatPoint& localPoint = FloatPoint(), bool fixed = false, bool useTransforms = false) const;
+    FloatPoint absoluteToLocal(const FloatPoint&, bool fixed = false, bool useTransforms = false) const;
 
     // Convert a local quad to absolute coordinates, taking transforms into account.
     FloatQuad localToAbsoluteQuad(const FloatQuad& quad, bool fixed = false) const
@@ -730,6 +736,8 @@ public:
     virtual bool isFlexingChildren() const { return false; }
     virtual bool isStretchingChildren() const { return false; }
 
+    virtual bool isCombineText() const { return false; }
+
     virtual int caretMinOffset() const;
     virtual int caretMaxOffset() const;
     virtual unsigned caretMaxRenderedOffset() const;
@@ -840,6 +848,7 @@ private:
     bool m_needsPositionedMovementLayout :1;
     bool m_normalChildNeedsLayout    : 1;
     bool m_posChildNeedsLayout       : 1;
+    bool m_needsSimplifiedNormalFlowLayout  : 1;
     bool m_preferredLogicalWidthsDirty           : 1;
     bool m_floating                  : 1;
 
@@ -853,6 +862,7 @@ private:
     bool m_isBox                     : 1;
     bool m_inline                    : 1;
     bool m_replaced                  : 1;
+    bool m_horizontalWritingMode : 1;
     bool m_isDragging                : 1;
 
     bool m_hasLayer                  : 1;
@@ -924,6 +934,7 @@ inline void RenderObject::setNeedsLayout(bool b, bool markParents)
     } else {
         m_everHadLayout = true;
         m_posChildNeedsLayout = false;
+        m_needsSimplifiedNormalFlowLayout = false;
         m_normalChildNeedsLayout = false;
         m_needsPositionedMovementLayout = false;
     }
@@ -939,6 +950,7 @@ inline void RenderObject::setChildNeedsLayout(bool b, bool markParents)
             markContainingBlocksForLayout();
     } else {
         m_posChildNeedsLayout = false;
+        m_needsSimplifiedNormalFlowLayout = false;
         m_normalChildNeedsLayout = false;
         m_needsPositionedMovementLayout = false;
     }
@@ -955,6 +967,17 @@ inline void RenderObject::setNeedsPositionedMovementLayout()
     }
 }
 
+inline void RenderObject::setNeedsSimplifiedNormalFlowLayout()
+{
+    bool alreadyNeededLayout = needsLayout();
+    m_needsSimplifiedNormalFlowLayout = true;
+    if (!alreadyNeededLayout) {
+        markContainingBlocksForLayout();
+        if (hasLayer())
+            setLayerNeedsFullRepaint();
+    }
+}
+
 inline bool objectIsRelayoutBoundary(const RenderObject *obj) 
 {
     // FIXME: In future it may be possible to broaden this condition in order to improve performance.
@@ -975,6 +998,8 @@ inline void RenderObject::markContainingBlocksForLayout(bool scheduleRelayout, R
     RenderObject* o = container();
     RenderObject* last = this;
 
+    bool simplifiedNormalFlowLayout = needsSimplifiedNormalFlowLayout() && !selfNeedsLayout() && !normalChildNeedsLayout();
+
     while (o) {
         // Don't mark the outermost object of an unrooted subtree. That object will be 
         // marked when the subtree is added to the document.
@@ -982,17 +1007,15 @@ inline void RenderObject::markContainingBlocksForLayout(bool scheduleRelayout, R
         if (!container && !o->isRenderView())
             return;
         if (!last->isText() && (last->style()->position() == FixedPosition || last->style()->position() == AbsolutePosition)) {
-            if (last->style()->top().isAuto() && last->style()->bottom().isAuto()) {
-                RenderObject* parent = last->parent();
-                if (!parent->normalChildNeedsLayout()) {
-                    parent->setChildNeedsLayout(true, false);
-                    if (parent != newRoot)
-                        parent->markContainingBlocksForLayout(scheduleRelayout, newRoot);
-                }
-            }
             if (o->m_posChildNeedsLayout)
                 return;
             o->m_posChildNeedsLayout = true;
+            simplifiedNormalFlowLayout = true;
+            ASSERT(!o->isSetNeedsLayoutForbidden());
+        } else if (simplifiedNormalFlowLayout) {
+            if (o->m_needsSimplifiedNormalFlowLayout)
+                return;
+            o->m_needsSimplifiedNormalFlowLayout = true;
             ASSERT(!o->isSetNeedsLayoutForbidden());
         } else {
             if (o->m_normalChildNeedsLayout)
diff --git a/Source/WebCore/rendering/RenderObjectChildList.cpp b/Source/WebCore/rendering/RenderObjectChildList.cpp
index 4df7180..617067a 100644
--- a/Source/WebCore/rendering/RenderObjectChildList.cpp
+++ b/Source/WebCore/rendering/RenderObjectChildList.cpp
@@ -262,31 +262,6 @@ static RenderObject* findBeforeAfterParent(RenderObject* object)
     return beforeAfterParent;
 }
 
-static void invalidateCountersInContainer(RenderObject* container, const AtomicString& identifier)
-{
-    if (!container)
-        return;
-    container = findBeforeAfterParent(container);
-    if (!container)
-        return;
-    // Sometimes the counter is attached directly on the container.
-    if (container->isCounter()) {
-        toRenderCounter(container)->invalidate(identifier);
-        return;
-    }
-    for (RenderObject* content = container->firstChild(); content; content = content->nextSibling()) {
-        if (content->isCounter())
-            toRenderCounter(content)->invalidate(identifier);
-    }
-}
-
-void RenderObjectChildList::invalidateCounters(const RenderObject* owner, const AtomicString& identifier)
-{
-    ASSERT(!owner->documentBeingDestroyed());
-    invalidateCountersInContainer(beforePseudoElementRenderer(owner), identifier);
-    invalidateCountersInContainer(afterPseudoElementRenderer(owner), identifier);
-}
-
 RenderObject* RenderObjectChildList::beforePseudoElementRenderer(const RenderObject* owner) const
 {
     // An anonymous (generated) inline run-in that has PseudoId BEFORE must come from a grandparent.
diff --git a/Source/WebCore/rendering/RenderObjectChildList.h b/Source/WebCore/rendering/RenderObjectChildList.h
index 087adfb..c8fc978 100644
--- a/Source/WebCore/rendering/RenderObjectChildList.h
+++ b/Source/WebCore/rendering/RenderObjectChildList.h
@@ -58,7 +58,6 @@ public:
     void updateBeforeAfterContent(RenderObject* owner, PseudoId type, const RenderObject* styledObject = 0);
     RenderObject* beforePseudoElementRenderer(const RenderObject* owner) const;
     RenderObject* afterPseudoElementRenderer(const RenderObject* owner) const;
-    void invalidateCounters(const RenderObject* owner, const AtomicString& identifier);
 
 private:
     RenderObject* m_firstChild;
diff --git a/Source/WebCore/rendering/RenderRubyRun.cpp b/Source/WebCore/rendering/RenderRubyRun.cpp
index 016c2a1..3504ccf 100644
--- a/Source/WebCore/rendering/RenderRubyRun.cpp
+++ b/Source/WebCore/rendering/RenderRubyRun.cpp
@@ -194,8 +194,7 @@ void RenderRubyRun::removeChild(RenderObject* child)
 RenderRubyBase* RenderRubyRun::createRubyBase() const
 {
     RenderRubyBase* rb = new (renderArena()) RenderRubyBase(document() /* anonymous */);
-    RefPtr<RenderStyle> newStyle = RenderStyle::create();
-    newStyle->inheritFrom(style());
+    RefPtr<RenderStyle> newStyle = RenderStyle::createAnonymousStyle(style());
     newStyle->setDisplay(BLOCK);
     newStyle->setTextAlign(CENTER); // FIXME: use WEBKIT_CENTER?
     rb->setStyle(newStyle.release());
@@ -206,8 +205,7 @@ RenderRubyRun* RenderRubyRun::staticCreateRubyRun(const RenderObject* parentRuby
 {
     ASSERT(parentRuby && parentRuby->isRuby());
     RenderRubyRun* rr = new (parentRuby->renderArena()) RenderRubyRun(parentRuby->document() /* anonymous */);
-    RefPtr<RenderStyle> newStyle = RenderStyle::create();
-    newStyle->inheritFrom(parentRuby->style());
+    RefPtr<RenderStyle> newStyle = RenderStyle::createAnonymousStyle(parentRuby->style());
     newStyle->setDisplay(INLINE_BLOCK);
     rr->setStyle(newStyle.release());
     return rr;
diff --git a/Source/WebCore/rendering/RenderSlider.cpp b/Source/WebCore/rendering/RenderSlider.cpp
index 49da396..1661b7a 100644
--- a/Source/WebCore/rendering/RenderSlider.cpp
+++ b/Source/WebCore/rendering/RenderSlider.cpp
@@ -156,7 +156,7 @@ void RenderSlider::layout()
         if (oldSize != size())
             thumb->setChildNeedsLayout(true, false);
 
-        LayoutStateMaintainer statePusher(view(), this, size(), style()->isFlippedBlocksWritingMode());
+        LayoutStateMaintainer statePusher(view(), this, IntSize(x(), y()), style()->isFlippedBlocksWritingMode());
 
         IntRect oldThumbRect = thumb->frameRect();
 
diff --git a/Source/WebCore/rendering/RenderSummary.cpp b/Source/WebCore/rendering/RenderSummary.cpp
index 8fccf66..cfde231 100644
--- a/Source/WebCore/rendering/RenderSummary.cpp
+++ b/Source/WebCore/rendering/RenderSummary.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies)
+ * Copyright (C) 2010, 2011 Nokia Corporation and/or its subsidiary(-ies)
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -21,11 +21,41 @@
 #include "config.h"
 #include "RenderSummary.h"
 
+#include "RenderDetails.h"
+
 namespace WebCore {
 
-RenderSummary::RenderSummary(Node* element)
-    : RenderBlock(element)
+RenderSummary::RenderSummary(Node* node)
+    : RenderBlock(node)
+{
+}
+
+void RenderSummary::destroy()
+{
+    RenderDetails* details = parentDetails();
+    if (details)
+        details->summaryDestroyed(this);
+
+    RenderBlock::destroy();
+}
+
+RenderDetails* RenderSummary::parentDetails()
 {
+    RenderObject* obj = parent();
+    while (obj && !obj->isDetails())
+        obj = obj->parent();
+
+    return static_cast<RenderDetails*>(obj);
+}
+
+void RenderSummary::styleDidChange(StyleDifference diff, const RenderStyle* oldStyle)
+{
+    RenderBlock::styleDidChange(diff, oldStyle);
+
+
+    // Ensure that if we ended up being inline that we set our replaced flag
+    // so that we're treated like an inline-block.
+    setReplaced(isInline());
 }
 
 }
diff --git a/Source/WebCore/rendering/RenderSummary.h b/Source/WebCore/rendering/RenderSummary.h
index afc18fa..94850df 100644
--- a/Source/WebCore/rendering/RenderSummary.h
+++ b/Source/WebCore/rendering/RenderSummary.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies)
+ * Copyright (C) 2010, 2011 Nokia Corporation and/or its subsidiary(-ies)
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -25,13 +25,20 @@
 
 namespace WebCore {
 
+class RenderDetails;
+
 class RenderSummary : public RenderBlock {
 public:
     explicit RenderSummary(Node*);
 
+    virtual void destroy();
+
 private:
     virtual const char* renderName() const { return "RenderSummary"; }
     virtual bool isSummary() const { return true; }
+    virtual void styleDidChange(StyleDifference, const RenderStyle* oldStyle);
+
+    RenderDetails* parentDetails();
 };
 
 inline RenderSummary* toRenderSummary(RenderObject* object)
diff --git a/Source/WebCore/rendering/RenderTable.cpp b/Source/WebCore/rendering/RenderTable.cpp
index 69c073c..187ffd7 100644
--- a/Source/WebCore/rendering/RenderTable.cpp
+++ b/Source/WebCore/rendering/RenderTable.cpp
@@ -277,7 +277,7 @@ void RenderTable::layout()
 {
     ASSERT(needsLayout());
 
-    if (layoutOnlyPositionedObjects())
+    if (simplifiedLayout())
         return;
 
     recalcSectionsIfNeeded();
@@ -510,11 +510,14 @@ void RenderTable::paint(PaintInfo& paintInfo, int tx, int ty)
 
     PaintPhase paintPhase = paintInfo.phase;
 
-    int os = 2 * maximalOutlineSize(paintPhase);
-    if (ty + minYVisualOverflow() >= paintInfo.rect.maxY() + os || ty + maxYVisualOverflow() <= paintInfo.rect.y() - os)
-        return;
-    if (tx + minXVisualOverflow() >= paintInfo.rect.maxX() + os || tx + maxXVisualOverflow() <= paintInfo.rect.x() - os)
-        return;
+    if (!isRoot()) {
+        IntRect overflowBox = visualOverflowRect();
+        flipForWritingMode(overflowBox);
+        overflowBox.inflate(maximalOutlineSize(paintInfo.phase));
+        overflowBox.move(tx, ty);
+        if (!overflowBox.intersects(paintInfo.rect))
+            return;
+    }
 
     bool pushedClip = pushContentsClip(paintInfo, tx, ty);    
     paintObject(paintInfo, tx, ty);
@@ -609,7 +612,13 @@ void RenderTable::paintBoxDecorations(PaintInfo& paintInfo, int tx, int ty)
 
     paintBoxShadow(paintInfo.context, rect.x(), rect.y(), rect.width(), rect.height(), style(), Normal);
     
-    paintFillLayers(paintInfo, style()->visitedDependentColor(CSSPropertyBackgroundColor), style()->backgroundLayers(), rect.x(), rect.y(), rect.width(), rect.height());
+    if (isRoot())
+        paintRootBoxFillLayers(paintInfo);
+    else if (!isBody() || document()->documentElement()->renderer()->hasBackground())
+        // The <body> only paints its background if the root element has defined a background
+        // independent of the body.
+        paintFillLayers(paintInfo, style()->visitedDependentColor(CSSPropertyBackgroundColor), style()->backgroundLayers(), rect.x(), rect.y(), rect.width(), rect.height());
+
     paintBoxShadow(paintInfo.context, rect.x(), rect.y(), rect.width(), rect.height(), style(), Inset);
 
     if (style()->hasBorder() && !collapseBorders())
@@ -1199,9 +1208,9 @@ int RenderTable::firstLineBoxBaseline() const
     return firstNonEmptySection->logicalTop() + firstNonEmptySection->firstLineBoxBaseline();
 }
 
-IntRect RenderTable::overflowClipRect(int tx, int ty)
+IntRect RenderTable::overflowClipRect(int tx, int ty, OverlayScrollbarSizeRelevancy relevancy)
 {
-    IntRect rect = RenderBlock::overflowClipRect(tx, ty);
+    IntRect rect = RenderBlock::overflowClipRect(tx, ty, relevancy);
     
     // If we have a caption, expand the clip to include the caption.
     // FIXME: Technically this is wrong, but it's virtually impossible to fix this
diff --git a/Source/WebCore/rendering/RenderTable.h b/Source/WebCore/rendering/RenderTable.h
index 67a311c..d781e95 100644
--- a/Source/WebCore/rendering/RenderTable.h
+++ b/Source/WebCore/rendering/RenderTable.h
@@ -236,7 +236,7 @@ private:
 
     virtual void computeLogicalWidth();
 
-    virtual IntRect overflowClipRect(int tx, int ty);
+    virtual IntRect overflowClipRect(int tx, int ty, OverlayScrollbarSizeRelevancy relevancy = IgnoreOverlayScrollbarSize);
 
     virtual void addOverflowFromChildren();
 
diff --git a/Source/WebCore/rendering/RenderTableCell.cpp b/Source/WebCore/rendering/RenderTableCell.cpp
index 2293bac..c9d8837 100644
--- a/Source/WebCore/rendering/RenderTableCell.cpp
+++ b/Source/WebCore/rendering/RenderTableCell.cpp
@@ -52,6 +52,7 @@ RenderTableCell::RenderTableCell(Node* node)
     , m_column(-1)
     , m_rowSpan(1)
     , m_columnSpan(1)
+    , m_cellWidthChanged(false)
     , m_intrinsicPaddingBefore(0)
     , m_intrinsicPaddingAfter(0)
 {
@@ -174,7 +175,7 @@ void RenderTableCell::layout()
 int RenderTableCell::paddingTop(bool includeIntrinsicPadding) const
 {
     int result = RenderBlock::paddingTop();
-    if (!includeIntrinsicPadding || !style()->isHorizontalWritingMode())
+    if (!includeIntrinsicPadding || !isHorizontalWritingMode())
         return result;
     return result + (style()->writingMode() == TopToBottomWritingMode ? intrinsicPaddingBefore() : intrinsicPaddingAfter());
 }
@@ -182,7 +183,7 @@ int RenderTableCell::paddingTop(bool includeIntrinsicPadding) const
 int RenderTableCell::paddingBottom(bool includeIntrinsicPadding) const
 {
     int result = RenderBlock::paddingBottom();
-    if (!includeIntrinsicPadding || !style()->isHorizontalWritingMode())
+    if (!includeIntrinsicPadding || !isHorizontalWritingMode())
         return result;
     return result + (style()->writingMode() == TopToBottomWritingMode ? intrinsicPaddingAfter() : intrinsicPaddingBefore());
 }
@@ -190,7 +191,7 @@ int RenderTableCell::paddingBottom(bool includeIntrinsicPadding) const
 int RenderTableCell::paddingLeft(bool includeIntrinsicPadding) const
 {
     int result = RenderBlock::paddingLeft();
-    if (!includeIntrinsicPadding || style()->isHorizontalWritingMode())
+    if (!includeIntrinsicPadding || isHorizontalWritingMode())
         return result;
     return result + (style()->writingMode() == LeftToRightWritingMode ? intrinsicPaddingBefore() : intrinsicPaddingAfter());
     
@@ -199,7 +200,7 @@ int RenderTableCell::paddingLeft(bool includeIntrinsicPadding) const
 int RenderTableCell::paddingRight(bool includeIntrinsicPadding) const
 {   
     int result = RenderBlock::paddingRight();
-    if (!includeIntrinsicPadding || style()->isHorizontalWritingMode())
+    if (!includeIntrinsicPadding || isHorizontalWritingMode())
         return result;
     return result + (style()->writingMode() == LeftToRightWritingMode ? intrinsicPaddingAfter() : intrinsicPaddingBefore());
 }
@@ -225,6 +226,12 @@ void RenderTableCell::setOverrideSize(int size)
     clearIntrinsicPadding();
     RenderBlock::setOverrideSize(size);
 }
+    
+void RenderTableCell::setOverrideSizeFromRowHeight(int rowHeight)
+{
+    clearIntrinsicPadding();
+    RenderBlock::setOverrideSize(max(0, rowHeight - borderBefore() - paddingBefore() - borderAfter() - paddingAfter()));
+}
 
 IntSize RenderTableCell::offsetFromContainer(RenderObject* o, const IntPoint& point) const
 {
@@ -1049,8 +1056,8 @@ void RenderTableCell::scrollbarsChanged(bool horizontalScrollbarChanged, bool ve
         return; // Not sure if we should be doing something when a scrollbar goes away or not.
     
     // We only care if the scrollbar that affects our intrinsic padding has been added.
-    if ((style()->isHorizontalWritingMode() && !horizontalScrollbarChanged) ||
-        (!style()->isHorizontalWritingMode() && !verticalScrollbarChanged))
+    if ((isHorizontalWritingMode() && !horizontalScrollbarChanged) ||
+        (!isHorizontalWritingMode() && !verticalScrollbarChanged))
         return;
 
     // Shrink our intrinsic padding as much as possible to accommodate the scrollbar.
diff --git a/Source/WebCore/rendering/RenderTableCell.h b/Source/WebCore/rendering/RenderTableCell.h
index cfdb739..9884999 100644
--- a/Source/WebCore/rendering/RenderTableCell.h
+++ b/Source/WebCore/rendering/RenderTableCell.h
@@ -120,11 +120,15 @@ public:
     virtual int paddingAfter(bool includeIntrinsicPadding = true) const;
 
     virtual void setOverrideSize(int);
+    void setOverrideSizeFromRowHeight(int);
 
     bool hasVisualOverflow() const { return m_overflow && !borderBoxRect().contains(m_overflow->visualOverflowRect()); }
 
     virtual void scrollbarsChanged(bool horizontalScrollbarChanged, bool verticalScrollbarChanged);
 
+    bool cellWidthChanged() const { return m_cellWidthChanged; }
+    void setCellWidthChanged(bool b = true) { m_cellWidthChanged = b; }
+
 protected:
     virtual void styleWillChange(StyleDifference, const RenderStyle* newStyle);
     virtual void styleDidChange(StyleDifference, const RenderStyle* oldStyle);
@@ -136,8 +140,6 @@ private:
 
     virtual void destroy();
 
-    virtual bool requiresLayer() const { return isPositioned() || isTransparent() || hasOverflowClip() || hasTransform() || hasMask() || hasReflection(); }
-
     virtual void computeLogicalWidth();
 
     virtual void paintBoxDecorations(PaintInfo&, int tx, int ty);
@@ -152,7 +154,8 @@ private:
     int m_row;
     int m_column;
     int m_rowSpan;
-    int m_columnSpan;
+    int m_columnSpan : 31;
+    bool m_cellWidthChanged : 1;
     int m_intrinsicPaddingBefore;
     int m_intrinsicPaddingAfter;
 };
diff --git a/Source/WebCore/rendering/RenderTableRow.cpp b/Source/WebCore/rendering/RenderTableRow.cpp
index 7300c19..a29f218 100644
--- a/Source/WebCore/rendering/RenderTableRow.cpp
+++ b/Source/WebCore/rendering/RenderTableRow.cpp
@@ -63,6 +63,17 @@ void RenderTableRow::styleWillChange(StyleDifference diff, const RenderStyle* ne
     RenderBox::styleWillChange(diff, newStyle);
 }
 
+void RenderTableRow::styleDidChange(StyleDifference diff, const RenderStyle* oldStyle)
+{
+    RenderBox::styleDidChange(diff, oldStyle);
+
+    // Update pseudos for :before and :after now.
+    if (!isAnonymous() && document()->usesBeforeAfterRules()) {
+        children()->updateBeforeAfterContent(this, BEFORE);
+        children()->updateBeforeAfterContent(this, AFTER);
+    }
+}
+
 void RenderTableRow::addChild(RenderObject* child, RenderObject* beforeChild)
 {
     // Make sure we don't append things after :after-generated content if we have it.
diff --git a/Source/WebCore/rendering/RenderTableRow.h b/Source/WebCore/rendering/RenderTableRow.h
index 20aa424..2af8dcb 100644
--- a/Source/WebCore/rendering/RenderTableRow.h
+++ b/Source/WebCore/rendering/RenderTableRow.h
@@ -62,6 +62,7 @@ private:
     virtual void imageChanged(WrappedImagePtr, const IntRect* = 0);
 
     virtual void styleWillChange(StyleDifference, const RenderStyle* newStyle);
+    virtual void styleDidChange(StyleDifference, const RenderStyle* oldStyle);
 
     RenderObjectChildList m_children;
 };
diff --git a/Source/WebCore/rendering/RenderTableSection.cpp b/Source/WebCore/rendering/RenderTableSection.cpp
index 3d46ece..7c0a768 100644
--- a/Source/WebCore/rendering/RenderTableSection.cpp
+++ b/Source/WebCore/rendering/RenderTableSection.cpp
@@ -203,7 +203,7 @@ void RenderTableSection::addCell(RenderTableCell* cell, RenderTableRow* row)
             switch (logicalHeight.type()) {
                 case Percent:
                     if (!(cRowLogicalHeight.isPercent()) ||
-                        (cRowLogicalHeight.isPercent() && cRowLogicalHeight.rawValue() < logicalHeight.rawValue()))
+                        (cRowLogicalHeight.isPercent() && cRowLogicalHeight.percent() < logicalHeight.percent()))
                         m_grid[m_cRow].logicalHeight = logicalHeight;
                         break;
                 case Fixed:
@@ -521,22 +521,22 @@ int RenderTableSection::layoutRows(int toAdd)
             if (m_grid[r].logicalHeight.isAuto())
                 numAuto++;
             else if (m_grid[r].logicalHeight.isPercent())
-                totalPercent += m_grid[r].logicalHeight.rawValue();
+                totalPercent += m_grid[r].logicalHeight.percent();
         }
         if (totalPercent) {
             // try to satisfy percent
             int add = 0;
-            totalPercent = min(totalPercent, 100 * percentScaleFactor);
+            totalPercent = min(totalPercent, 100);
             int rh = m_rowPos[1] - m_rowPos[0];
             for (int r = 0; r < totalRows; r++) {
                 if (totalPercent > 0 && m_grid[r].logicalHeight.isPercent()) {
-                    int toAdd = min(dh, (totalHeight * m_grid[r].logicalHeight.rawValue() / (100 * percentScaleFactor)) - rh);
+                    int toAdd = min(dh, static_cast<int>((totalHeight * m_grid[r].logicalHeight.percent() / 100) - rh));
                     // If toAdd is negative, then we don't want to shrink the row (this bug
                     // affected Outlook Web Access).
                     toAdd = max(0, toAdd);
                     add += toAdd;
                     dh -= toAdd;
-                    totalPercent -= m_grid[r].logicalHeight.rawValue();
+                    totalPercent -= m_grid[r].logicalHeight.percent();
                 }
                 if (r < totalRows - 1)
                     rh = m_rowPos[r + 2] - m_rowPos[r + 1];
@@ -647,9 +647,7 @@ int RenderTableSection::layoutRows(int toAdd)
                 // Alignment within a cell is based off the calculated
                 // height, which becomes irrelevant once the cell has
                 // been resized based off its percentage.
-                cell->setOverrideSize(max(0, 
-                                           rHeight - cell->borderBefore() - cell->paddingBefore() - 
-                                                     cell->borderAfter() - cell->paddingAfter()));
+                cell->setOverrideSizeFromRowHeight(rHeight);
                 cell->layoutIfNeeded();
 
                 // If the baseline moved, we may have to update the data for our row. Find out the new baseline.
diff --git a/Source/WebCore/rendering/RenderText.cpp b/Source/WebCore/rendering/RenderText.cpp
index 3e696d3..e660875 100644
--- a/Source/WebCore/rendering/RenderText.cpp
+++ b/Source/WebCore/rendering/RenderText.cpp
@@ -551,6 +551,12 @@ IntRect RenderText::localCaretRect(InlineBox* inlineBox, int caretOffset, int* e
     case CENTER:
     case WEBKIT_CENTER:
         break;
+    case TASTART:
+        rightAligned = !cbStyle->isLeftToRightDirection();
+        break;
+    case TAEND:
+        rightAligned = cbStyle->isLeftToRightDirection();
+        break;
     }
 
     if (rightAligned) {
@@ -566,13 +572,13 @@ IntRect RenderText::localCaretRect(InlineBox* inlineBox, int caretOffset, int* e
 
 ALWAYS_INLINE float RenderText::widthFromCache(const Font& f, int start, int len, float xPos, HashSet<const SimpleFontData*>* fallbackFonts, GlyphOverflow* glyphOverflow) const
 {
-    if (style()->hasTextCombine()) {
+    if (style()->hasTextCombine() && isCombineText()) {
         const RenderCombineText* combineText = toRenderCombineText(this);
         if (combineText->isCombined())
             return combineText->combinedTextWidth(f);
     }
 
-    if (f.isFixedPitch() && !f.isSmallCaps() && m_isAllASCII) {
+    if (f.isFixedPitch() && !f.isSmallCaps() && m_isAllASCII && (!glyphOverflow || !glyphOverflow->computeBounds)) {
         float monospaceCharacterWidth = f.spaceWidth();
         float tabWidth = allowTabs() ? monospaceCharacterWidth * 8 : 0;
         float w = 0;
@@ -1247,7 +1253,7 @@ float RenderText::width(unsigned from, unsigned len, const Font& f, float xPos,
 
     float w;
     if (&f == &style()->font()) {
-        if (!style()->preserveNewline() && !from && len == textLength()) {
+        if (!style()->preserveNewline() && !from && len == textLength() && (!glyphOverflow || !glyphOverflow->computeBounds)) {
             if (fallbackFonts) {
                 ASSERT(glyphOverflow);
                 if (preferredLogicalWidthsDirty() || !m_knownToHaveNoOverflowAndNoFallbackFonts) {
@@ -1404,6 +1410,8 @@ int RenderText::previousOffset(int current) const
     return result;
 }
 
+#if PLATFORM(MAC)
+
 #define HANGUL_CHOSEONG_START (0x1100)
 #define HANGUL_CHOSEONG_END (0x115F)
 #define HANGUL_JUNGSEONG_START (0x1160)
@@ -1428,6 +1436,14 @@ inline bool isHangulLVT(UChar32 character)
     return (character - HANGUL_SYLLABLE_START) % HANGUL_JONGSEONG_COUNT;
 }
 
+inline bool isMark(UChar32 c)
+{
+    int8_t charType = u_charType(c);
+    return charType == U_NON_SPACING_MARK || charType == U_ENCLOSING_MARK || charType == U_COMBINING_SPACING_MARK;
+}
+
+#endif
+
 int RenderText::previousOffsetForBackwardDeletion(int current) const
 {
 #if PLATFORM(MAC)
@@ -1446,7 +1462,7 @@ int RenderText::previousOffsetForBackwardDeletion(int current) const
         if ((character >= 0x0530) && (character < 0x1950))
             break;
 
-        if (u_isbase(character) && (character != 0xFF9E) && (character != 0xFF9F))
+        if (!isMark(character) && (character != 0xFF9E) && (character != 0xFF9F))
             break;
     }
 
diff --git a/Source/WebCore/rendering/RenderText.h b/Source/WebCore/rendering/RenderText.h
index b88590c..7fa3518 100644
--- a/Source/WebCore/rendering/RenderText.h
+++ b/Source/WebCore/rendering/RenderText.h
@@ -125,6 +125,8 @@ public:
     virtual void computePreferredLogicalWidths(float leadWidth);
     bool isAllCollapsibleWhitespace();
     
+    bool knownToHaveNoOverflowAndNoFallbackFonts() const { return m_knownToHaveNoOverflowAndNoFallbackFonts; }
+
 protected:
     virtual void styleWillChange(StyleDifference, const RenderStyle*) { }
     virtual void styleDidChange(StyleDifference, const RenderStyle* oldStyle);
diff --git a/Source/WebCore/rendering/RenderTextControlSingleLine.cpp b/Source/WebCore/rendering/RenderTextControlSingleLine.cpp
index 8b98335..b9697ff 100644
--- a/Source/WebCore/rendering/RenderTextControlSingleLine.cpp
+++ b/Source/WebCore/rendering/RenderTextControlSingleLine.cpp
@@ -1111,7 +1111,7 @@ PassRefPtr<Scrollbar> RenderTextControlSingleLine::createScrollbar(ScrollableAre
 
 InputElement* RenderTextControlSingleLine::inputElement() const
 {
-    return toInputElement(static_cast<Element*>(node()));
+    return node()->toInputElement();
 }
 
 int RenderTextControlSingleLine::textBlockInsetLeft() const
diff --git a/Source/WebCore/rendering/RenderTheme.cpp b/Source/WebCore/rendering/RenderTheme.cpp
index b68429c..f254c99 100644
--- a/Source/WebCore/rendering/RenderTheme.cpp
+++ b/Source/WebCore/rendering/RenderTheme.cpp
@@ -779,10 +779,10 @@ bool RenderTheme::isActive(const RenderObject* o) const
 
 bool RenderTheme::isChecked(const RenderObject* o) const
 {
-    if (!o->node() || !o->node()->isElementNode())
+    if (!o->node())
         return false;
 
-    InputElement* inputElement = toInputElement(static_cast<Element*>(o->node()));
+    InputElement* inputElement = o->node()->toInputElement();
     if (!inputElement)
         return false;
 
@@ -791,10 +791,10 @@ bool RenderTheme::isChecked(const RenderObject* o) const
 
 bool RenderTheme::isIndeterminate(const RenderObject* o) const
 {
-    if (!o->node() || !o->node()->isElementNode())
+    if (!o->node())
         return false;
 
-    InputElement* inputElement = toInputElement(static_cast<Element*>(o->node()));
+    InputElement* inputElement = o->node()->toInputElement();
     if (!inputElement)
         return false;
 
diff --git a/Source/WebCore/rendering/RenderTheme.h b/Source/WebCore/rendering/RenderTheme.h
index 5021712..53c23e3 100644
--- a/Source/WebCore/rendering/RenderTheme.h
+++ b/Source/WebCore/rendering/RenderTheme.h
@@ -88,6 +88,9 @@ public:
     virtual String extraQuirksStyleSheet() { return String(); }
 #if ENABLE(VIDEO)
     virtual String extraMediaControlsStyleSheet() { return String(); };
+#if ENABLE(FULLSCREEN_API)
+    virtual String extraFullScreenStyleSheet() { return String(); };
+#endif
 #endif
 
     // A method to obtain the baseline position for a "leaf" control.  This will only be used if a baseline
diff --git a/Source/WebCore/rendering/RenderThemeChromiumWin.cpp b/Source/WebCore/rendering/RenderThemeChromiumWin.cpp
index 6f3be00..53ec9cb 100644
--- a/Source/WebCore/rendering/RenderThemeChromiumWin.cpp
+++ b/Source/WebCore/rendering/RenderThemeChromiumWin.cpp
@@ -43,8 +43,8 @@
 #include "RenderProgress.h"
 #include "RenderSlider.h"
 #include "ScrollbarTheme.h"
+#include "SystemInfo.h"
 #include "TransparencyWin.h"
-#include "WindowsVersion.h"
 
 // FIXME: This dependency should eventually be removed.
 #include <skia/ext/skia_utils_win.h>
@@ -141,8 +141,8 @@ bool ThemePainter::s_hasInstance = false;
 
 static void getNonClientMetrics(NONCLIENTMETRICS* metrics)
 {
-    static UINT size = isVistaOrNewer() ?
-        sizeof(NONCLIENTMETRICS) : NONCLIENTMETRICS_SIZE_PRE_VISTA;
+    static UINT size = (windowsVersion() >= WindowsVista) ?
+        (sizeof NONCLIENTMETRICS) : NONCLIENTMETRICS_SIZE_PRE_VISTA;
     metrics->cbSize = size;
     bool success = !!SystemParametersInfo(SPI_GETNONCLIENTMETRICS, size, metrics, 0);
     ASSERT(success);
diff --git a/Source/WebCore/rendering/RenderThemeMac.h b/Source/WebCore/rendering/RenderThemeMac.h
index d951ff6..d64944b 100644
--- a/Source/WebCore/rendering/RenderThemeMac.h
+++ b/Source/WebCore/rendering/RenderThemeMac.h
@@ -162,6 +162,9 @@ protected:
 
     // Media controls
     virtual String extraMediaControlsStyleSheet();
+#if ENABLE(FULLSCREEN_API)
+    virtual String extraFullScreenStyleSheet();
+#endif
 
     virtual bool shouldRenderMediaControlPart(ControlPart, Element*);
     virtual bool usesMediaControlStatusDisplay();
diff --git a/Source/WebCore/rendering/RenderThemeMac.mm b/Source/WebCore/rendering/RenderThemeMac.mm
index f5611dc..0e23c89 100644
--- a/Source/WebCore/rendering/RenderThemeMac.mm
+++ b/Source/WebCore/rendering/RenderThemeMac.mm
@@ -1961,20 +1961,45 @@ String RenderThemeMac::extraMediaControlsStyleSheet()
 #endif
 }
 
+#if ENABLE(FULLSCREEN_API)
+String RenderThemeMac::extraFullScreenStyleSheet()
+{
+#if PLATFORM(MAC)
+    if (mediaControllerTheme() == MediaControllerThemeQuickTime)
+        return String(fullscreenQuickTimeUserAgentStyleSheet, sizeof(fullscreenQuickTimeUserAgentStyleSheet));
+    
+    return String();
+#else
+    ASSERT_NOT_REACHED();
+    return String();
+#endif
+}
+#endif
+
 bool RenderThemeMac::shouldRenderMediaControlPart(ControlPart part, Element* element)
 {
+    HTMLMediaElement* mediaElement = static_cast<HTMLMediaElement*>(element);
     switch (part) {
     case MediaVolumeSliderContainerPart:
     case MediaVolumeSliderPart:
     case MediaVolumeSliderMuteButtonPart:
     case MediaVolumeSliderThumbPart: {
-        HTMLMediaElement* mediaElement = static_cast<HTMLMediaElement*>(element);
         return mediaControllerTheme() == MediaControllerThemeQuickTime && mediaElement->hasAudio();
     }
     case MediaToggleClosedCaptionsButtonPart:
         // We rely on QTKit to render captions so don't enable the button unless it will be able to do so.
         if (!element->hasTagName(videoTag))
             return false;
+        break;
+    case MediaRewindButtonPart:
+        if (mediaElement->isFullscreen())
+            return mediaElement->movieLoadType() == MediaPlayer::LiveStream 
+                || mediaElement->movieLoadType() == MediaPlayer::StoredStream;
+    case MediaSeekForwardButtonPart:
+    case MediaSeekBackButtonPart:
+        if (mediaElement->isFullscreen())
+            return mediaElement->movieLoadType() != MediaPlayer::StoredStream 
+                && mediaElement->movieLoadType() != MediaPlayer::LiveStream;
     default:
         break;
     }
diff --git a/Source/WebCore/rendering/RenderThemeWin.cpp b/Source/WebCore/rendering/RenderThemeWin.cpp
index d5e4155..af100b7 100644
--- a/Source/WebCore/rendering/RenderThemeWin.cpp
+++ b/Source/WebCore/rendering/RenderThemeWin.cpp
@@ -569,15 +569,17 @@ ThemeData RenderThemeWin::getThemeData(RenderObject* o, ControlSubPart subPart)
             result.m_state = determineState(o);
             break;
         case MenulistPart:
-        case MenulistButtonPart:
-            result.m_part = isRunningOnVistaOrLater() ? CP_DROPDOWNBUTTONRIGHT : CP_DROPDOWNBUTTON;
-            if (isRunningOnVistaOrLater() && documentIsInApplicationChromeMode(o->document())) {
+        case MenulistButtonPart: {
+            const bool isVistaOrLater = (windowsVersion() >= WindowsVista);
+            result.m_part = isVistaOrLater ? CP_DROPDOWNBUTTONRIGHT : CP_DROPDOWNBUTTON;
+            if (isVistaOrLater && documentIsInApplicationChromeMode(o->document())) {
                 // The "readonly" look we use in application chrome mode
                 // only uses a "normal" look for the drop down button.
                 result.m_state = TS_NORMAL;
             } else
                 result.m_state = determineState(o);
             break;
+        }
         case RadioPart:
             result.m_part = BP_RADIO;
             result.m_state = determineState(o);
@@ -585,7 +587,7 @@ ThemeData RenderThemeWin::getThemeData(RenderObject* o, ControlSubPart subPart)
         case SearchFieldPart:
         case TextFieldPart:
         case TextAreaPart:
-            result.m_part = isRunningOnVistaOrLater() ? EP_EDITBORDER_NOSCROLL : TFP_TEXTFIELD;
+            result.m_part = (windowsVersion() >= WindowsVista) ? EP_EDITBORDER_NOSCROLL : TFP_TEXTFIELD;
             result.m_state = determineState(o);
             break;
         case SliderHorizontalPart:
@@ -728,7 +730,7 @@ bool RenderThemeWin::paintMenuList(RenderObject* o, const PaintInfo& i, const In
 {
     HANDLE theme;
     int part;
-    if (haveTheme && isRunningOnVistaOrLater()) {
+    if (haveTheme && (windowsVersion() >= WindowsVista)) {
         theme = menuListTheme();
         if (documentIsInApplicationChromeMode(o->document()))
             part = CP_READONLY;
@@ -792,7 +794,7 @@ bool RenderThemeWin::paintMenuListButton(RenderObject* o, const PaintInfo& i, co
         buttonRect.setX(buttonRect.maxX() - dropDownButtonWidth);
     buttonRect.setWidth(dropDownButtonWidth);
 
-    if (isRunningOnVistaOrLater()) {
+    if ((windowsVersion() >= WindowsVista)) {
         // Outset the top, right, and bottom borders of the button so that they coincide with the <select>'s border.
         buttonRect.setY(buttonRect.y() - vistaMenuListButtonOutset);
         buttonRect.setHeight(buttonRect.height() + 2 * vistaMenuListButtonOutset);
diff --git a/Source/WebCore/rendering/RenderTreeAsText.cpp b/Source/WebCore/rendering/RenderTreeAsText.cpp
index cad5830..8857391 100644
--- a/Source/WebCore/rendering/RenderTreeAsText.cpp
+++ b/Source/WebCore/rendering/RenderTreeAsText.cpp
@@ -35,6 +35,7 @@
 #include "InlineTextBox.h"
 #include "PrintContext.h"
 #include "RenderBR.h"
+#include "RenderDetailsMarker.h"
 #include "RenderFileUploadControl.h"
 #include "RenderInline.h"
 #include "RenderLayer.h"
@@ -45,6 +46,7 @@
 #include "RenderView.h"
 #include "RenderWidget.h"
 #include "SelectionController.h"
+#include <wtf/HexNumber.h>
 #include <wtf/UnusedParam.h>
 #include <wtf/Vector.h>
 #include <wtf/unicode/CharacterNames.h>
@@ -209,11 +211,11 @@ String quoteAndEscapeNonPrintables(const String& s)
             if (c >= 0x20 && c < 0x7F)
                 result.append(c);
             else {
-                unsigned u = c;
-                String hex = String::format("\\x{%X}", u);
-                unsigned len = hex.length();
-                for (unsigned i = 0; i < len; ++i)
-                    result.append(hex[i]);
+                result.append('\\');
+                result.append('x');
+                result.append('{');
+                appendUnsignedAsHex(c, result); 
+                result.append('}');
             }
         }
     }
@@ -372,6 +374,24 @@ void RenderTreeAsText::writeRenderObject(TextStream& ts, const RenderObject& o,
         ts << " [r=" << c.row() << " c=" << c.col() << " rs=" << c.rowSpan() << " cs=" << c.colSpan() << "]";
     }
 
+    if (o.isDetailsMarker()) {
+        ts << ": ";
+        switch (toRenderDetailsMarker(&o)->orientation()) {
+        case RenderDetailsMarker::Left:
+            ts << "left";
+            break;
+        case RenderDetailsMarker::Right:
+            ts << "right";
+            break;
+        case RenderDetailsMarker::Up:
+            ts << "up";
+            break;
+        case RenderDetailsMarker::Down:
+            ts << "down";
+            break;
+        }
+    }
+
     if (o.isListMarker()) {
         String text = toRenderListMarker(&o)->text();
         if (!text.isEmpty()) {
@@ -487,8 +507,10 @@ static void writeTextRun(TextStream& ts, const RenderText& o, const InlineTextBo
             ts << " override";
     }
     ts << ": "
-        << quoteAndEscapeNonPrintables(String(o.text()).substring(run.start(), run.len()))
-        << "\n";
+        << quoteAndEscapeNonPrintables(String(o.text()).substring(run.start(), run.len()));
+    if (run.hasHyphen())
+        ts << " + hyphen string " << quoteAndEscapeNonPrintables(o.style()->hyphenString());
+    ts << "\n";
 }
 
 void write(TextStream& ts, const RenderObject& o, int indent, RenderAsTextBehavior behavior)
diff --git a/Source/WebCore/rendering/RenderVideo.cpp b/Source/WebCore/rendering/RenderVideo.cpp
index 1ae736b..3a96ef8 100644
--- a/Source/WebCore/rendering/RenderVideo.cpp
+++ b/Source/WebCore/rendering/RenderVideo.cpp
@@ -202,6 +202,8 @@ void RenderVideo::paintReplaced(PaintInfo& paintInfo, int tx, int ty)
 
     if (displayingPoster)
         paintIntoRect(paintInfo.context, rect);
+    else if (document()->view() && document()->view()->paintBehavior() & PaintBehaviorFlattenCompositingLayers)
+        mediaPlayer->paintCurrentFrameInContext(paintInfo.context, rect);
     else
         mediaPlayer->paint(paintInfo.context, rect);
 }
diff --git a/Source/WebCore/rendering/RenderWidget.cpp b/Source/WebCore/rendering/RenderWidget.cpp
index 13b572d..33f6436 100644
--- a/Source/WebCore/rendering/RenderWidget.cpp
+++ b/Source/WebCore/rendering/RenderWidget.cpp
@@ -136,7 +136,7 @@ void RenderWidget::destroy()
     if (hasOverrideSize())
         setOverrideSize(-1);
 
-    if (style() && (style()->height().isPercent() || style()->minHeight().isPercent() || style()->maxHeight().isPercent()))
+    if (style() && (style()->logicalHeight().isPercent() || style()->logicalMinHeight().isPercent() || style()->logicalMaxHeight().isPercent()))
         RenderBlock::removePercentHeightDescendant(this);
 
     if (hasLayer()) {
diff --git a/Source/WebCore/rendering/RootInlineBox.cpp b/Source/WebCore/rendering/RootInlineBox.cpp
index 8617252..c6f1bd8 100644
--- a/Source/WebCore/rendering/RootInlineBox.cpp
+++ b/Source/WebCore/rendering/RootInlineBox.cpp
@@ -28,10 +28,12 @@
 #include "Frame.h"
 #include "GraphicsContext.h"
 #include "HitTestResult.h"
+#include "InlineTextBox.h"
 #include "Page.h"
 #include "PaintInfo.h"
 #include "RenderArena.h"
 #include "RenderBlock.h"
+#include "VerticalPositionCache.h"
 
 using namespace std;
 
@@ -52,7 +54,7 @@ RootInlineBox::RootInlineBox(RenderBlock* block)
     , m_hasAnnotationsBefore(false)
     , m_hasAnnotationsAfter(false)
 {
-    setIsHorizontal(block->style()->isHorizontalWritingMode());
+    setIsHorizontal(block->isHorizontalWritingMode());
 }
 
 
@@ -238,7 +240,7 @@ int RootInlineBox::alignBoxesInBlockDirection(int heightOfBlock, GlyphOverflowAn
 
     m_baselineType = requiresIdeographicBaseline(textBoxDataMap) ? IdeographicBaseline : AlphabeticBaseline;
 
-    computeLogicalBoxHeights(maxPositionTop, maxPositionBottom, maxAscent, maxDescent, setMaxAscent, setMaxDescent, noQuirksMode,
+    computeLogicalBoxHeights(this, maxPositionTop, maxPositionBottom, maxAscent, maxDescent, setMaxAscent, setMaxDescent, noQuirksMode,
                              textBoxDataMap, baselineType(), verticalPositionCache);
 
     if (maxAscent + maxDescent < max(maxPositionTop, maxPositionBottom))
@@ -335,7 +337,7 @@ GapRects RootInlineBox::lineSelectionGap(RenderBlock* rootBlock, const IntPoint&
         for (InlineBox* box = firstBox->nextLeafChild(); box; box = box->nextLeafChild()) {
             if (box->selectionState() != RenderObject::SelectionNone) {
                 IntRect logicalRect(lastLogicalLeft, selTop, box->logicalLeft() - lastLogicalLeft, selHeight);
-                logicalRect.move(renderer()->style()->isHorizontalWritingMode() ? offsetFromRootBlock : IntSize(offsetFromRootBlock.height(), offsetFromRootBlock.width()));
+                logicalRect.move(renderer()->isHorizontalWritingMode() ? offsetFromRootBlock : IntSize(offsetFromRootBlock.height(), offsetFromRootBlock.width()));
                 IntRect gapRect = rootBlock->logicalRectToPhysicalRect(rootBlockPhysicalPosition, logicalRect);
                 if (isPreviousBoxSelected && gapRect.width() > 0 && gapRect.height() > 0) {
                     if (paintInfo && box->parent()->renderer()->style()->visibility() == VISIBLE)
@@ -354,13 +356,6 @@ GapRects RootInlineBox::lineSelectionGap(RenderBlock* rootBlock, const IntPoint&
     return result;
 }
 
-void RootInlineBox::setHasSelectedChildren(bool b)
-{
-    if (m_hasSelectedChildren == b)
-        return;
-    m_hasSelectedChildren = b;
-}
-
 RenderObject::SelectionState RootInlineBox::selectionState()
 {
     // Walk over all of the selected boxes.
@@ -460,7 +455,7 @@ RenderBlock* RootInlineBox::block() const
 
 static bool isEditableLeaf(InlineBox* leaf)
 {
-    return leaf && leaf->renderer() && leaf->renderer()->node() && leaf->renderer()->node()->isContentEditable();
+    return leaf && leaf->renderer() && leaf->renderer()->node() && leaf->renderer()->node()->rendererIsEditable();
 }
 
 InlineBox* RootInlineBox::closestLeafChildForLogicalLeftPosition(int leftPosition, bool onlyEditableLeaves)
@@ -553,4 +548,269 @@ IntRect RootInlineBox::paddedLayoutOverflowRect(int endPadding) const
     return lineLayoutOverflow;
 }
 
+static void setAscentAndDescent(int& ascent, int& descent, int newAscent, int newDescent, bool& ascentDescentSet)
+{
+    if (!ascentDescentSet) {
+        ascentDescentSet = true;
+        ascent = newAscent;
+        descent = newDescent;
+    } else {
+        ascent = max(ascent, newAscent);
+        descent = max(descent, newDescent);
+    }
+}
+
+void RootInlineBox::ascentAndDescentForBox(InlineBox* box, GlyphOverflowAndFallbackFontsMap& textBoxDataMap, int& ascent, int& descent,
+                                           bool& affectsAscent, bool& affectsDescent) const
+{
+    bool ascentDescentSet = false;
+
+    // Replaced boxes will return 0 for the line-height if line-box-contain says they are
+    // not to be included.
+    if (box->renderer()->isReplaced()) {
+        if (renderer()->style(m_firstLine)->lineBoxContain() & LineBoxContainReplaced) {
+            ascent = box->baselinePosition(baselineType());
+            descent = box->lineHeight() - ascent;
+            
+            // Replaced elements always affect both the ascent and descent.
+            affectsAscent = true;
+            affectsDescent = true;
+        }
+        return;
+    }
+
+    Vector<const SimpleFontData*>* usedFonts = 0;
+    GlyphOverflow* glyphOverflow = 0;
+    if (box->isText()) {
+        GlyphOverflowAndFallbackFontsMap::iterator it = textBoxDataMap.find(static_cast<InlineTextBox*>(box));
+        usedFonts = it == textBoxDataMap.end() ? 0 : &it->second.first;
+        glyphOverflow = it == textBoxDataMap.end() ? 0 : &it->second.second;
+    }
+        
+    bool includeLeading = includeLeadingForBox(box);
+    bool includeFont = includeFontForBox(box);
+    
+    bool setUsedFont = false;
+    bool setUsedFontWithLeading = false;
+
+    if (usedFonts && !usedFonts->isEmpty() && (includeFont || (box->renderer()->style(m_firstLine)->lineHeight().isNegative() && includeLeading))) {
+        usedFonts->append(box->renderer()->style(m_firstLine)->font().primaryFont());
+        for (size_t i = 0; i < usedFonts->size(); ++i) {
+            const FontMetrics& fontMetrics = usedFonts->at(i)->fontMetrics();
+            int usedFontAscent = fontMetrics.ascent(baselineType());
+            int usedFontDescent = fontMetrics.descent(baselineType());
+            int halfLeading = (fontMetrics.lineSpacing() - fontMetrics.height()) / 2;
+            int usedFontAscentAndLeading = usedFontAscent + halfLeading;
+            int usedFontDescentAndLeading = fontMetrics.lineSpacing() - usedFontAscentAndLeading;
+            if (includeFont) {
+                setAscentAndDescent(ascent, descent, usedFontAscent, usedFontDescent, ascentDescentSet);
+                setUsedFont = true;
+            }
+            if (includeLeading) {
+                setAscentAndDescent(ascent, descent, usedFontAscentAndLeading, usedFontDescentAndLeading, ascentDescentSet);
+                setUsedFontWithLeading = true;
+            }
+            if (!affectsAscent)
+                affectsAscent = usedFontAscent - box->logicalTop() > 0;
+            if (!affectsDescent)
+                affectsDescent = usedFontDescent + box->logicalTop() > 0;
+        }
+    }
+
+    // If leading is included for the box, then we compute that box.
+    if (includeLeading && !setUsedFontWithLeading) {
+        int ascentWithLeading = box->baselinePosition(baselineType());
+        int descentWithLeading = box->lineHeight() - ascentWithLeading;
+        setAscentAndDescent(ascent, descent, ascentWithLeading, descentWithLeading, ascentDescentSet);
+        
+        // Examine the font box for inline flows and text boxes to see if any part of it is above the baseline.
+        // If the top of our font box relative to the root box baseline is above the root box baseline, then
+        // we are contributing to the maxAscent value. Descent is similar. If any part of our font box is below
+        // the root box's baseline, then we contribute to the maxDescent value.
+        affectsAscent = ascentWithLeading - box->logicalTop() > 0;
+        affectsDescent = descentWithLeading + box->logicalTop() > 0; 
+    }
+    
+    if (includeFontForBox(box) && !setUsedFont) {
+        int fontAscent = box->renderer()->style(m_firstLine)->fontMetrics().ascent();
+        int fontDescent = box->renderer()->style(m_firstLine)->fontMetrics().descent();
+        setAscentAndDescent(ascent, descent, fontAscent, fontDescent, ascentDescentSet);
+        affectsAscent = fontAscent - box->logicalTop() > 0;
+        affectsDescent = fontDescent + box->logicalTop() > 0; 
+    }
+
+    if (includeGlyphsForBox(box) && glyphOverflow && glyphOverflow->computeBounds) {
+        setAscentAndDescent(ascent, descent, glyphOverflow->top, glyphOverflow->bottom, ascentDescentSet);
+        affectsAscent = glyphOverflow->top - box->logicalTop() > 0;
+        affectsDescent = glyphOverflow->bottom + box->logicalTop() > 0; 
+        glyphOverflow->top = min(glyphOverflow->top, max(0, glyphOverflow->top - box->renderer()->style(m_firstLine)->fontMetrics().ascent()));
+        glyphOverflow->bottom = min(glyphOverflow->bottom, max(0, glyphOverflow->bottom - box->renderer()->style(m_firstLine)->fontMetrics().descent()));
+    }
+
+    if (includeMarginForBox(box)) {
+        int ascentWithMargin = box->renderer()->style(m_firstLine)->fontMetrics().ascent();
+        int descentWithMargin = box->renderer()->style(m_firstLine)->fontMetrics().descent();
+        if (box->parent() && !box->renderer()->isText()) {
+            ascentWithMargin += box->boxModelObject()->borderBefore() + box->boxModelObject()->paddingBefore() + box->boxModelObject()->marginBefore();
+            descentWithMargin += box->boxModelObject()->borderAfter() + box->boxModelObject()->paddingAfter() + box->boxModelObject()->marginAfter();
+        }
+        setAscentAndDescent(ascent, descent, ascentWithMargin, descentWithMargin, ascentDescentSet);
+        
+        // Treat like a replaced element, since we're using the margin box.
+        affectsAscent = true;
+        affectsDescent = true;
+    }
+}
+
+int RootInlineBox::verticalPositionForBox(InlineBox* box, VerticalPositionCache& verticalPositionCache)
+{
+    if (box->renderer()->isText())
+        return box->parent()->logicalTop();
+    
+    RenderBoxModelObject* renderer = box->boxModelObject();
+    ASSERT(renderer->isInline());
+    if (!renderer->isInline())
+        return 0;
+
+    // This method determines the vertical position for inline elements.
+    bool firstLine = m_firstLine;
+    if (firstLine && !renderer->document()->usesFirstLineRules())
+        firstLine = false;
+
+    // Check the cache.
+    bool isRenderInline = renderer->isRenderInline();
+    if (isRenderInline && !firstLine) {
+        int verticalPosition = verticalPositionCache.get(renderer, baselineType());
+        if (verticalPosition != PositionUndefined)
+            return verticalPosition;
+    }
+
+    int verticalPosition = 0;
+    EVerticalAlign verticalAlign = renderer->style()->verticalAlign();
+    if (verticalAlign == TOP || verticalAlign == BOTTOM)
+        return 0;
+   
+    RenderObject* parent = renderer->parent();
+    if (parent->isRenderInline() && parent->style()->verticalAlign() != TOP && parent->style()->verticalAlign() != BOTTOM)
+        verticalPosition = box->parent()->logicalTop();
+    
+    if (verticalAlign != BASELINE) {
+        const Font& font = parent->style(firstLine)->font();
+        const FontMetrics& fontMetrics = font.fontMetrics();
+        int fontSize = font.pixelSize();
+
+        LineDirectionMode lineDirection = parent->isHorizontalWritingMode() ? HorizontalLine : VerticalLine;
+
+        if (verticalAlign == SUB)
+            verticalPosition += fontSize / 5 + 1;
+        else if (verticalAlign == SUPER)
+            verticalPosition -= fontSize / 3 + 1;
+        else if (verticalAlign == TEXT_TOP)
+            verticalPosition += renderer->baselinePosition(baselineType(), firstLine, lineDirection) - fontMetrics.ascent(baselineType());
+        else if (verticalAlign == MIDDLE)
+            verticalPosition += -static_cast<int>(fontMetrics.xHeight() / 2) - renderer->lineHeight(firstLine, lineDirection) / 2 + renderer->baselinePosition(baselineType(), firstLine, lineDirection);
+        else if (verticalAlign == TEXT_BOTTOM) {
+            verticalPosition += fontMetrics.descent(baselineType());
+            // lineHeight - baselinePosition is always 0 for replaced elements (except inline blocks), so don't bother wasting time in that case.
+            if (!renderer->isReplaced() || renderer->isInlineBlockOrInlineTable())
+                verticalPosition -= (renderer->lineHeight(firstLine, lineDirection) - renderer->baselinePosition(baselineType(), firstLine, lineDirection));
+        } else if (verticalAlign == BASELINE_MIDDLE)
+            verticalPosition += -renderer->lineHeight(firstLine, lineDirection) / 2 + renderer->baselinePosition(baselineType(), firstLine, lineDirection);
+        else if (verticalAlign == LENGTH)
+            verticalPosition -= renderer->style()->verticalAlignLength().calcValue(renderer->lineHeight(firstLine, lineDirection));
+    }
+
+    // Store the cached value.
+    if (isRenderInline && !firstLine)
+        verticalPositionCache.set(renderer, baselineType(), verticalPosition);
+
+    return verticalPosition;
+}
+
+bool RootInlineBox::includeLeadingForBox(InlineBox* box) const
+{
+    if (box->renderer()->isReplaced() || (box->renderer()->isText() && !box->isText()))
+        return false;
+
+    LineBoxContain lineBoxContain = renderer()->style()->lineBoxContain();
+    return (lineBoxContain & LineBoxContainInline) || (box == this && (lineBoxContain & LineBoxContainBlock));
+}
+
+bool RootInlineBox::includeFontForBox(InlineBox* box) const
+{
+    if (box->renderer()->isReplaced() || (box->renderer()->isText() && !box->isText()))
+        return false;
+    
+    if (!box->isText() && box->isInlineFlowBox() && !static_cast<InlineFlowBox*>(box)->hasTextChildren())
+        return false;
+
+    // For now map "glyphs" to "font" in vertical text mode until the bounds returned by glyphs aren't garbage.
+    LineBoxContain lineBoxContain = renderer()->style()->lineBoxContain();
+    return (lineBoxContain & LineBoxContainFont) || (!isHorizontal() && (lineBoxContain & LineBoxContainGlyphs));
+}
+
+bool RootInlineBox::includeGlyphsForBox(InlineBox* box) const
+{
+    if (box->renderer()->isReplaced() || (box->renderer()->isText() && !box->isText()))
+        return false;
+    
+    if (!box->isText() && box->isInlineFlowBox() && !static_cast<InlineFlowBox*>(box)->hasTextChildren())
+        return false;
+
+    // FIXME: We can't fit to glyphs yet for vertical text, since the bounds returned are garbage.
+    LineBoxContain lineBoxContain = renderer()->style()->lineBoxContain();
+    return isHorizontal() && (lineBoxContain & LineBoxContainGlyphs);
+}
+
+bool RootInlineBox::includeMarginForBox(InlineBox* box) const
+{
+    if (box->renderer()->isReplaced() || (box->renderer()->isText() && !box->isText()))
+        return false;
+
+    LineBoxContain lineBoxContain = renderer()->style()->lineBoxContain();
+    return lineBoxContain & LineBoxContainInlineBox;
+}
+
+
+bool RootInlineBox::fitsToGlyphs() const
+{
+    // FIXME: We can't fit to glyphs yet for vertical text, since the bounds returned are garbage.
+    LineBoxContain lineBoxContain = renderer()->style()->lineBoxContain();
+    return isHorizontal() && (lineBoxContain & LineBoxContainGlyphs);
+}
+
+bool RootInlineBox::includesRootLineBoxFontOrLeading() const
+{
+    LineBoxContain lineBoxContain = renderer()->style()->lineBoxContain();
+    return (lineBoxContain & LineBoxContainBlock) || (lineBoxContain & LineBoxContainInline) || (lineBoxContain & LineBoxContainFont);
+}
+
+Node* RootInlineBox::getLogicalStartBoxWithNode(InlineBox*& startBox)
+{
+    Vector<InlineBox*> leafBoxesInLogicalOrder;
+    collectLeafBoxesInLogicalOrder(leafBoxesInLogicalOrder);
+    for (size_t i = 0; i < leafBoxesInLogicalOrder.size(); ++i) {
+        if (leafBoxesInLogicalOrder[i]->renderer()->node()) {
+            startBox = leafBoxesInLogicalOrder[i];
+            return startBox->renderer()->node();
+        }
+    }
+    startBox = 0;
+    return 0;
+}
+    
+Node* RootInlineBox::getLogicalEndBoxWithNode(InlineBox*& endBox)
+{
+    Vector<InlineBox*> leafBoxesInLogicalOrder;
+    collectLeafBoxesInLogicalOrder(leafBoxesInLogicalOrder);
+    for (size_t i = leafBoxesInLogicalOrder.size(); i > 0; --i) { 
+        if (leafBoxesInLogicalOrder[i - 1]->renderer()->node()) {
+            endBox = leafBoxesInLogicalOrder[i - 1];
+            return endBox->renderer()->node();
+        }
+    }
+    endBox = 0;
+    return 0;
+}
+
 } // namespace WebCore
diff --git a/Source/WebCore/rendering/RootInlineBox.h b/Source/WebCore/rendering/RootInlineBox.h
index 1a9f0a8..0ff5704 100644
--- a/Source/WebCore/rendering/RootInlineBox.h
+++ b/Source/WebCore/rendering/RootInlineBox.h
@@ -99,8 +99,8 @@ public:
     virtual void paint(PaintInfo&, int tx, int ty);
     virtual bool nodeAtPoint(const HitTestRequest&, HitTestResult&, int, int, int, int);
 
-    bool hasSelectedChildren() const { return m_hasSelectedChildren; }
-    void setHasSelectedChildren(bool);
+    bool hasSelectedChildren() const { return m_hasSelectedChildrenOrCanHaveLeadingExpansion; }
+    void setHasSelectedChildren(bool hasSelectedChildren) { m_hasSelectedChildrenOrCanHaveLeadingExpansion = hasSelectedChildren; }
 
     virtual RenderObject::SelectionState selectionState();
     InlineBox* firstSelectedBox();
@@ -133,6 +133,17 @@ public:
 
     IntRect paddedLayoutOverflowRect(int endPadding) const;
 
+    void ascentAndDescentForBox(InlineBox*, GlyphOverflowAndFallbackFontsMap&, int& ascent, int& descent, bool& affectsAscent, bool& affectsDescent) const;
+    int verticalPositionForBox(InlineBox*, VerticalPositionCache&);
+    bool includeLeadingForBox(InlineBox*) const;
+    bool includeFontForBox(InlineBox*) const;
+    bool includeGlyphsForBox(InlineBox*) const;
+    bool includeMarginForBox(InlineBox*) const;
+    bool fitsToGlyphs() const;
+    bool includesRootLineBoxFontOrLeading() const;
+
+    Node* getLogicalStartBoxWithNode(InlineBox*&);
+    Node* getLogicalEndBoxWithNode(InlineBox*&);
 private:
     bool hasEllipsisBox() const { return m_hasEllipsisBoxOrHyphen; }
     void setHasEllipsisBox(bool hasEllipsisBox) { m_hasEllipsisBoxOrHyphen = hasEllipsisBox; }
diff --git a/Source/WebCore/rendering/mathml/RenderMathMLRoot.cpp b/Source/WebCore/rendering/mathml/RenderMathMLRoot.cpp
index 075f6ba..51046f8 100644
--- a/Source/WebCore/rendering/mathml/RenderMathMLRoot.cpp
+++ b/Source/WebCore/rendering/mathml/RenderMathMLRoot.cpp
@@ -229,7 +229,10 @@ void RenderMathMLRoot::layout()
     }
     
     // Positioning of the index
-    RenderBoxModelObject* indexBox = toRenderBoxModelObject(firstChild()->firstChild());
+    RenderObject* possibleIndex = firstChild()->firstChild();
+    while (possibleIndex && !possibleIndex->isBoxModelObject())
+        possibleIndex = possibleIndex->nextSibling();
+    RenderBoxModelObject* indexBox = toRenderBoxModelObject(possibleIndex);
     if (!indexBox)
         return;
     
diff --git a/Source/WebCore/rendering/style/BorderData.h b/Source/WebCore/rendering/style/BorderData.h
index 0e50edb..26f089f 100644
--- a/Source/WebCore/rendering/style/BorderData.h
+++ b/Source/WebCore/rendering/style/BorderData.h
@@ -49,13 +49,13 @@ public:
 
     bool hasBorderRadius() const
     {
-        if (m_topLeft.width().rawValue() > 0)
+        if (!m_topLeft.width().isZero())
             return true;
-        if (m_topRight.width().rawValue() > 0)
+        if (!m_topRight.width().isZero())
             return true;
-        if (m_bottomLeft.width().rawValue() > 0)
+        if (!m_bottomLeft.width().isZero())
             return true;
-        if (m_bottomRight.width().rawValue() > 0)
+        if (!m_bottomRight.width().isZero())
             return true;
         return false;
     }
diff --git a/Source/WebCore/rendering/style/FillLayer.cpp b/Source/WebCore/rendering/style/FillLayer.cpp
index 59f3bb2..c957cfe 100644
--- a/Source/WebCore/rendering/style/FillLayer.cpp
+++ b/Source/WebCore/rendering/style/FillLayer.cpp
@@ -129,17 +129,6 @@ bool FillLayer::operator==(const FillLayer& o) const
 void FillLayer::fillUnsetProperties()
 {
     FillLayer* curr;
-    for (curr = this; curr && curr->isImageSet(); curr = curr->next()) { }
-    if (curr && curr != this) {
-        // We need to fill in the remaining values with the pattern specified.
-        for (FillLayer* pattern = this; curr; curr = curr->next()) {
-            curr->m_image = pattern->m_image;
-            pattern = pattern->next();
-            if (pattern == curr || !pattern)
-                pattern = this;
-        }
-    }
-    
     for (curr = this; curr && curr->isXPositionSet(); curr = curr->next()) { }
     if (curr && curr != this) {
         // We need to fill in the remaining values with the pattern specified.
@@ -246,12 +235,7 @@ void FillLayer::cullEmptyLayers()
     FillLayer* next;
     for (FillLayer* p = this; p; p = next) {
         next = p->m_next;
-        if (next && !next->isImageSet() &&
-            !next->isXPositionSet() && !next->isYPositionSet() &&
-            !next->isAttachmentSet() && !next->isClipSet() &&
-            !next->isCompositeSet() && !next->isOriginSet() &&
-            !next->isRepeatXSet() && !next->isRepeatYSet()
-            && !next->isSizeSet()) {
+        if (next && !next->isImageSet()) {
             delete next;
             p->m_next = 0;
             break;
diff --git a/Source/WebCore/rendering/style/RenderStyle.cpp b/Source/WebCore/rendering/style/RenderStyle.cpp
index 122b762..34e972d 100644
--- a/Source/WebCore/rendering/style/RenderStyle.cpp
+++ b/Source/WebCore/rendering/style/RenderStyle.cpp
@@ -56,6 +56,14 @@ PassRefPtr<RenderStyle> RenderStyle::createDefaultStyle()
     return adoptRef(new RenderStyle(true));
 }
 
+PassRefPtr<RenderStyle> RenderStyle::createAnonymousStyle(const RenderStyle* parentStyle)
+{
+    RefPtr<RenderStyle> newStyle = RenderStyle::create();
+    newStyle->inheritFrom(parentStyle);
+    newStyle->inheritUnicodeBidiFrom(parentStyle);
+    return newStyle;
+}
+
 PassRefPtr<RenderStyle> RenderStyle::clone(const RenderStyle* other)
 {
     return adoptRef(new RenderStyle(*other));
@@ -295,21 +303,6 @@ static bool positionedObjectMoved(const LengthBox& a, const LengthBox& b)
     return true;
 }
 
-/*
-  compares two styles. The result gives an idea of the action that
-  needs to be taken when replacing the old style with a new one.
-
-  CbLayout: The containing block of the object needs a relayout.
-  Layout: the RenderObject needs a relayout after the style change
-  Visible: The change is visible, but no relayout is needed
-  NonVisible: The object does need neither repaint nor relayout after
-       the change.
-
-  ### TODO:
-  A lot can be optimised here based on the display type, lots of
-  optimisations are unimplemented, and currently result in the
-  worst case result causing a relayout of the containing block.
-*/
 StyleDifference RenderStyle::diff(const RenderStyle* other, unsigned& changedContextSensitiveProperties) const
 {
     changedContextSensitiveProperties = ContextSensitivePropertyNone;
@@ -411,7 +404,8 @@ StyleDifference RenderStyle::diff(const RenderStyle* other, unsigned& changedCon
             rareInheritedData->locale != other->rareInheritedData->locale ||
             rareInheritedData->textEmphasisMark != other->rareInheritedData->textEmphasisMark ||
             rareInheritedData->textEmphasisPosition != other->rareInheritedData->textEmphasisPosition ||
-            rareInheritedData->textEmphasisCustomMark != other->rareInheritedData->textEmphasisCustomMark)
+            rareInheritedData->textEmphasisCustomMark != other->rareInheritedData->textEmphasisCustomMark ||
+            rareInheritedData->m_lineBoxContain != other->rareInheritedData->m_lineBoxContain)
             return StyleDifferenceLayout;
 
         if (!rareInheritedData->shadowDataEquivalent(*other->rareInheritedData.get()))
@@ -499,15 +493,19 @@ StyleDifference RenderStyle::diff(const RenderStyle* other, unsigned& changedCon
         rareNonInheritedData->m_counterReset != other->rareNonInheritedData->m_counterReset)
         return StyleDifferenceLayout;
 
+    if ((visibility() == COLLAPSE) != (other->visibility() == COLLAPSE))
+        return StyleDifferenceLayout;
+
     if ((rareNonInheritedData->opacity == 1 && other->rareNonInheritedData->opacity < 1) ||
         (rareNonInheritedData->opacity < 1 && other->rareNonInheritedData->opacity == 1)) {
-        // FIXME: We should add an optimized form of layout that just recomputes visual overflow.
+        // FIXME: We would like to use SimplifiedLayout here, but we can't quite do that yet.
+        // We need to make sure SimplifiedLayout can operate correctly on RenderInlines (we will need
+        // to add a selfNeedsSimplifiedLayout bit in order to not get confused and taint every line).
+        // In addition we need to solve the floating object issue when layers come and go. Right now
+        // a full layout is necessary to keep floating object lists sane.
         return StyleDifferenceLayout;
     }
 
-    if ((visibility() == COLLAPSE) != (other->visibility() == COLLAPSE))
-        return StyleDifferenceLayout;
-                    
 #if ENABLE(SVG)
     // SVGRenderStyle::diff() might have returned StyleDifferenceRepaint, eg. if fill changes.
     // If eg. the font-size changed at the same time, we're not allowed to return StyleDifferenceRepaint,
@@ -525,13 +523,10 @@ StyleDifference RenderStyle::diff(const RenderStyle* other, unsigned& changedCon
             if (position() == AbsolutePosition && positionedObjectMoved(surround->offset, other->surround->offset))
                 return StyleDifferenceLayoutPositionedMovementOnly;
 
-            // FIXME: We will need to do a bit of work in RenderObject/Box::setStyle before we
-            // can stop doing a layout when relative positioned objects move.  In particular, we'll need
-            // to update scrolling positions and figure out how to do a repaint properly of the updated layer.
-            //if (other->position() == RelativePosition)
-            //    return RepaintLayer;
-            //else
-                return StyleDifferenceLayout;
+            // FIXME: We would like to use SimplifiedLayout for relative positioning, but we can't quite do that yet.
+            // We need to make sure SimplifiedLayout can operate correctly on RenderInlines (we will need
+            // to add a selfNeedsSimplifiedLayout bit in order to not get confused and taint every line).
+            return StyleDifferenceLayout;
         } else if (m_box->zIndex() != other->m_box->zIndex() || m_box->hasAutoZIndex() != other->m_box->hasAutoZIndex() ||
                  visual->clip != other->visual->clip || visual->hasClip != other->visual->hasClip)
             return StyleDifferenceRepaintLayer;
diff --git a/Source/WebCore/rendering/style/RenderStyle.h b/Source/WebCore/rendering/style/RenderStyle.h
index 79ed6e4..859348f 100644
--- a/Source/WebCore/rendering/style/RenderStyle.h
+++ b/Source/WebCore/rendering/style/RenderStyle.h
@@ -27,6 +27,7 @@
 
 #include "AnimationList.h"
 #include "BorderValue.h"
+#include "CSSLineBoxContainValue.h"
 #include "CSSPrimitiveValue.h"
 #include "CSSPropertyNames.h"
 #include "Color.h"
@@ -58,6 +59,7 @@
 #include "StyleTransformData.h"
 #include "StyleVisualData.h"
 #include "TextDirection.h"
+#include "TextOrientation.h"
 #include "ThemeTypes.h"
 #include "TransformOperations.h"
 #include <wtf/Forward.h>
@@ -106,6 +108,7 @@ class RenderStyle: public RefCounted<RenderStyle> {
     friend class AnimationBase; // Used by CSS animations. We can't allow them to animate based off visited colors.
     friend class ApplyStyleCommand; // Editing has to only reveal unvisited info.
     friend class EditingStyle; // Editing has to only reveal unvisited info.
+    friend class CSSStyleApplyProperty; // Sets members directly.
     friend class CSSStyleSelector; // Sets members directly.
     friend class CSSComputedStyleDeclaration; // Ignores visited styles, so needs to be able to see unvisited info.
     friend class PropertyWrapperMaybeInvalidColor; // Used by CSS animations. We can't allow them to animate based off visited colors.
@@ -184,7 +187,7 @@ protected:
         unsigned _list_style_type : 7; // EListStyleType
         unsigned _list_style_position : 1; // EListStylePosition
         unsigned _visibility : 2; // EVisibility
-        unsigned _text_align : 3; // ETextAlign
+        unsigned _text_align : 4; // ETextAlign
         unsigned _text_transform : 2; // ETextTransform
         unsigned _text_decorations : 4;
         unsigned _cursor_style : 6; // ECursor
@@ -310,6 +313,7 @@ private:
 public:
     static PassRefPtr<RenderStyle> create();
     static PassRefPtr<RenderStyle> createDefaultStyle();
+    static PassRefPtr<RenderStyle> createAnonymousStyle(const RenderStyle* parentStyle);
     static PassRefPtr<RenderStyle> clone(const RenderStyle*);
 
     ~RenderStyle();
@@ -770,6 +774,7 @@ public:
     bool isRunningAcceleratedAnimation() const { return rareNonInheritedData->m_runningAcceleratedAnimation; }
 #endif
 
+    LineBoxContain lineBoxContain() const { return rareInheritedData->m_lineBoxContain; }
     const LineClampValue& lineClamp() const { return rareNonInheritedData->lineClamp; }
     bool textSizeAdjust() const { return rareInheritedData->textSizeAdjust; }
     ETextSecurity textSecurity() const { return static_cast<ETextSecurity>(rareInheritedData->textSecurity); }
@@ -1130,6 +1135,7 @@ public:
     void setIsRunningAcceleratedAnimation(bool b = true) { SET_VAR(rareNonInheritedData, m_runningAcceleratedAnimation, b); }
 #endif
 
+    void setLineBoxContain(LineBoxContain c) { SET_VAR(rareInheritedData, m_lineBoxContain, c); }
     void setLineClamp(LineClampValue c) { SET_VAR(rareNonInheritedData, lineClamp, c); }
     void setTextSizeAdjust(bool b) { SET_VAR(rareInheritedData, textSizeAdjust, b); }
     void setTextSecurity(ETextSecurity aTextSecurity) { SET_VAR(rareInheritedData, textSecurity, aTextSecurity); }
@@ -1246,6 +1252,7 @@ public:
     static TextDirection initialDirection() { return LTR; }
     static WritingMode initialWritingMode() { return TopToBottomWritingMode; }
     static TextCombine initialTextCombine() { return TextCombineNone; }
+    static TextOrientation initialTextOrientation() { return TextOrientationVerticalRight; }
     static EDisplay initialDisplay() { return INLINE; }
     static EEmptyCell initialEmptyCells() { return SHOW; }
     static EFloat initialFloating() { return FNONE; }
@@ -1339,6 +1346,7 @@ public:
     static TextEmphasisMark initialTextEmphasisMark() { return TextEmphasisMarkNone; }
     static const AtomicString& initialTextEmphasisCustomMark() { return nullAtom; }
     static TextEmphasisPosition initialTextEmphasisPosition() { return TextEmphasisPositionOver; }
+    static LineBoxContain initialLineBoxContain() { return LineBoxContainBlock | LineBoxContainInline | LineBoxContainReplaced; }
 
     // Keep these at the end.
     static LineClampValue initialLineClamp() { return LineClampValue(); }
@@ -1365,6 +1373,7 @@ public:
 #endif
 
 private:
+    void inheritUnicodeBidiFrom(const RenderStyle* parent) { noninherited_flags._unicodeBidi = parent->noninherited_flags._unicodeBidi; }
     void getShadowExtent(const ShadowData*, int& top, int& right, int& bottom, int& left) const;
     void getShadowHorizontalExtent(const ShadowData*, int& left, int& right) const;
     void getShadowVerticalExtent(const ShadowData*, int& top, int& bottom) const;
diff --git a/Source/WebCore/rendering/style/RenderStyleConstants.h b/Source/WebCore/rendering/style/RenderStyleConstants.h
index 3c62dbe..08f2c15 100644
--- a/Source/WebCore/rendering/style/RenderStyleConstants.h
+++ b/Source/WebCore/rendering/style/RenderStyleConstants.h
@@ -51,6 +51,7 @@ enum StyleDifference {
     StyleDifferenceRepaint,
     StyleDifferenceRepaintLayer,
     StyleDifferenceLayoutPositionedMovementOnly,
+    StyleDifferenceSimplifiedLayout,
     StyleDifferenceLayout
 };
 
@@ -120,7 +121,7 @@ enum ETableLayout {
 };
 
 enum EUnicodeBidi {
-    UBNormal, Embed, Override
+    UBNormal, Embed, Override, Isolate
 };
 
 // CSS Text Layout Module Level 3: Vertical writing support
@@ -318,7 +319,7 @@ enum EWhiteSpace {
 };
 
 enum ETextAlign {
-    TAAUTO, LEFT, RIGHT, CENTER, JUSTIFY, WEBKIT_LEFT, WEBKIT_RIGHT, WEBKIT_CENTER
+    TAAUTO, LEFT, RIGHT, CENTER, JUSTIFY, WEBKIT_LEFT, WEBKIT_RIGHT, WEBKIT_CENTER, TASTART, TAEND,
 };
 
 enum ETextTransform {
diff --git a/Source/WebCore/rendering/style/StyleRareInheritedData.cpp b/Source/WebCore/rendering/style/StyleRareInheritedData.cpp
index 2798fd1..2253d1c 100644
--- a/Source/WebCore/rendering/style/StyleRareInheritedData.cpp
+++ b/Source/WebCore/rendering/style/StyleRareInheritedData.cpp
@@ -66,6 +66,7 @@ StyleRareInheritedData::StyleRareInheritedData()
     , textEmphasisFill(TextEmphasisFillFilled)
     , textEmphasisMark(TextEmphasisMarkNone)
     , textEmphasisPosition(TextEmphasisPositionOver)
+    , m_lineBoxContain(RenderStyle::initialLineBoxContain())
     , hyphenationLimitBefore(-1)
     , hyphenationLimitAfter(-1)
 {
@@ -113,6 +114,7 @@ StyleRareInheritedData::StyleRareInheritedData(const StyleRareInheritedData& o)
     , textEmphasisFill(o.textEmphasisFill)
     , textEmphasisMark(o.textEmphasisMark)
     , textEmphasisPosition(o.textEmphasisPosition)
+    , m_lineBoxContain(o.m_lineBoxContain)
     , hyphenationString(o.hyphenationString)
     , hyphenationLimitBefore(o.hyphenationLimitBefore)
     , hyphenationLimitAfter(o.hyphenationLimitAfter)
@@ -179,6 +181,7 @@ bool StyleRareInheritedData::operator==(const StyleRareInheritedData& o) const
         && textEmphasisFill == o.textEmphasisFill
         && textEmphasisMark == o.textEmphasisMark
         && textEmphasisPosition == o.textEmphasisPosition
+        && m_lineBoxContain == o.m_lineBoxContain
         && hyphenationString == o.hyphenationString
         && locale == o.locale
         && textEmphasisCustomMark == o.textEmphasisCustomMark
diff --git a/Source/WebCore/rendering/style/StyleRareInheritedData.h b/Source/WebCore/rendering/style/StyleRareInheritedData.h
index d4f233c..39cfe3c 100644
--- a/Source/WebCore/rendering/style/StyleRareInheritedData.h
+++ b/Source/WebCore/rendering/style/StyleRareInheritedData.h
@@ -99,6 +99,7 @@ public:
     unsigned textEmphasisFill : 1; // TextEmphasisFill
     unsigned textEmphasisMark : 3; // TextEmphasisMark
     unsigned textEmphasisPosition : 1; // TextEmphasisPosition
+    unsigned m_lineBoxContain: 7; // LineBoxContain
 
     AtomicString hyphenationString;
     short hyphenationLimitBefore;
diff --git a/Source/WebCore/rendering/style/StyleRareNonInheritedData.h b/Source/WebCore/rendering/style/StyleRareNonInheritedData.h
index 89437f6..268a123 100644
--- a/Source/WebCore/rendering/style/StyleRareNonInheritedData.h
+++ b/Source/WebCore/rendering/style/StyleRareNonInheritedData.h
@@ -107,7 +107,7 @@ public:
     
     short m_counterIncrement;
     short m_counterReset;
-    
+
 #if USE(ACCELERATED_COMPOSITING)
     bool m_runningAcceleratedAnimation : 1;
 #endif
diff --git a/Source/WebCore/rendering/svg/RenderSVGAllInOne.cpp b/Source/WebCore/rendering/svg/RenderSVGAllInOne.cpp
index 835bce8..9f3d8a5 100644
--- a/Source/WebCore/rendering/svg/RenderSVGAllInOne.cpp
+++ b/Source/WebCore/rendering/svg/RenderSVGAllInOne.cpp
@@ -34,6 +34,7 @@
 #include "RenderSVGInline.cpp"
 #include "RenderSVGInlineText.cpp"
 #include "RenderSVGModelObject.cpp"
+#include "RenderSVGPath.cpp"
 #include "RenderSVGResource.cpp"
 #include "RenderSVGResourceClipper.cpp"
 #include "RenderSVGResourceContainer.cpp"
diff --git a/Source/WebCore/rendering/svg/RenderSVGText.cpp b/Source/WebCore/rendering/svg/RenderSVGText.cpp
index 56d9306..8ca3d58 100644
--- a/Source/WebCore/rendering/svg/RenderSVGText.cpp
+++ b/Source/WebCore/rendering/svg/RenderSVGText.cpp
@@ -51,6 +51,7 @@ namespace WebCore {
 
 RenderSVGText::RenderSVGText(SVGTextElement* node) 
     : RenderSVGBlock(node)
+    , m_needsReordering(false)
     , m_needsPositioningValuesUpdate(true)
     , m_needsTransformUpdate(true)
 {
@@ -127,6 +128,7 @@ void RenderSVGText::layout()
         // Perform SVG text layout phase one (see SVGTextLayoutAttributesBuilder for details).
         SVGTextLayoutAttributesBuilder layoutAttributesBuilder;
         layoutAttributesBuilder.buildLayoutAttributesForTextSubtree(this);
+        m_needsReordering = true;
         m_needsPositioningValuesUpdate = false;
         updateCachedBoundariesInParents = true;
     }
@@ -134,7 +136,7 @@ void RenderSVGText::layout()
     // Reduced version of RenderBlock::layoutBlock(), which only takes care of SVG text.
     // All if branches that could cause early exit in RenderBlocks layoutBlock() method are turned into assertions.
     ASSERT(!isInline());
-    ASSERT(!layoutOnlyPositionedObjects());
+    ASSERT(!simplifiedLayout());
     ASSERT(!scrollsOverflow());
     ASSERT(!hasControlClip());
     ASSERT(!hasColumns());
@@ -150,6 +152,9 @@ void RenderSVGText::layout()
     ASSERT(childrenInline());
     forceLayoutInlineChildren();
 
+    if (m_needsReordering)
+        m_needsReordering = false;
+
     if (!updateCachedBoundariesInParents)
         updateCachedBoundariesInParents = oldBoundaries != objectBoundingBox();
 
diff --git a/Source/WebCore/rendering/svg/RenderSVGText.h b/Source/WebCore/rendering/svg/RenderSVGText.h
index 188d5fc..93fc5f8 100644
--- a/Source/WebCore/rendering/svg/RenderSVGText.h
+++ b/Source/WebCore/rendering/svg/RenderSVGText.h
@@ -26,6 +26,7 @@
 
 #include "AffineTransform.h"
 #include "RenderSVGBlock.h"
+#include "SVGTextLayoutAttributes.h"
 
 namespace WebCore {
 
@@ -33,7 +34,7 @@ class SVGTextElement;
 
 class RenderSVGText : public RenderSVGBlock {
 public:
-    RenderSVGText(SVGTextElement* node);
+    RenderSVGText(SVGTextElement*);
 
     void setNeedsPositioningValuesUpdate() { m_needsPositioningValuesUpdate = true; }
     virtual void setNeedsTransformUpdate() { m_needsTransformUpdate = true; }
@@ -42,6 +43,9 @@ public:
     static RenderSVGText* locateRenderSVGTextAncestor(RenderObject*);
     static const RenderSVGText* locateRenderSVGTextAncestor(const RenderObject*);
 
+    Vector<SVGTextLayoutAttributes>& layoutAttributes() { return m_layoutAttributes; }
+    bool needsReordering() const { return m_needsReordering; }
+
 private:
     virtual const char* renderName() const { return "RenderSVGText"; }
     virtual bool isSVGText() const { return true; }
@@ -71,9 +75,11 @@ private:
     virtual RenderBlock* firstLineBlock() const;
     virtual void updateFirstLetter();
 
+    bool m_needsReordering : 1;
     bool m_needsPositioningValuesUpdate : 1;
     bool m_needsTransformUpdate : 1;
     AffineTransform m_localTransform;
+    Vector<SVGTextLayoutAttributes> m_layoutAttributes;
 };
 
 inline RenderSVGText* toRenderSVGText(RenderObject* object)
diff --git a/Source/WebCore/rendering/svg/SVGInlineTextBox.cpp b/Source/WebCore/rendering/svg/SVGInlineTextBox.cpp
index 05e1357..17bbfaa 100644
--- a/Source/WebCore/rendering/svg/SVGInlineTextBox.cpp
+++ b/Source/WebCore/rendering/svg/SVGInlineTextBox.cpp
@@ -73,7 +73,7 @@ int SVGInlineTextBox::offsetForPositionInFragment(const SVGTextFragment& fragmen
     if (!fragment.transform.isIdentity())
         textRun.setHorizontalGlyphStretch(narrowPrecisionToFloat(fragment.transform.xScale()));
 
-    return fragment.positionListOffset - start() + textRenderer->scaledFont().offsetForPosition(textRun, position * scalingFactor, includePartialGlyphs);
+    return fragment.characterOffset - start() + textRenderer->scaledFont().offsetForPosition(textRun, position * scalingFactor, includePartialGlyphs);
 }
 
 float SVGInlineTextBox::positionForOffset(int) const
@@ -402,7 +402,7 @@ TextRun SVGInlineTextBox::constructTextRun(RenderStyle* style, const SVGTextFrag
     RenderText* text = textRenderer();
     ASSERT(text);
 
-    TextRun run(text->characters() + fragment.positionListOffset
+    TextRun run(text->characters() + fragment.characterOffset
                 , fragment.length
                 , false /* allowTabs */
                 , 0 /* xPos, only relevant with allowTabs=true */
@@ -425,7 +425,7 @@ bool SVGInlineTextBox::mapStartEndPositionsIntoFragmentCoordinates(const SVGText
     if (startPosition >= endPosition)
         return false;
 
-    int offset = static_cast<int>(fragment.positionListOffset) - start();
+    int offset = static_cast<int>(fragment.characterOffset) - start();
     int length = static_cast<int>(fragment.length);
 
     if (startPosition >= offset + length || endPosition <= offset)
diff --git a/Source/WebCore/rendering/svg/SVGRenderTreeAsText.cpp b/Source/WebCore/rendering/svg/SVGRenderTreeAsText.cpp
index 0f94fdd..a099f87 100644
--- a/Source/WebCore/rendering/svg/SVGRenderTreeAsText.cpp
+++ b/Source/WebCore/rendering/svg/SVGRenderTreeAsText.cpp
@@ -464,8 +464,8 @@ static inline void writeSVGInlineTextBox(TextStream& ts, SVGInlineTextBox* textB
         SVGTextFragment& fragment = fragments.at(i);
         writeIndent(ts, indent + 1);
 
-        unsigned startOffset = fragment.positionListOffset;
-        unsigned endOffset = fragment.positionListOffset + fragment.length;
+        unsigned startOffset = fragment.characterOffset;
+        unsigned endOffset = fragment.characterOffset + fragment.length;
 
         // FIXME: Remove this hack, once the new text layout engine is completly landed. We want to preserve the old layout test results for now.
         ts << "chunk 1 ";
@@ -500,7 +500,7 @@ static inline void writeSVGInlineTextBox(TextStream& ts, SVGInlineTextBox* textB
                 ts << " override";
         }
 
-        ts << ": " << quoteAndEscapeNonPrintables(text.substring(fragment.positionListOffset, fragment.length)) << "\n";
+        ts << ": " << quoteAndEscapeNonPrintables(text.substring(fragment.characterOffset, fragment.length)) << "\n";
     }
 }
 
diff --git a/Source/WebCore/rendering/svg/SVGRootInlineBox.cpp b/Source/WebCore/rendering/svg/SVGRootInlineBox.cpp
index c2289d6..ddbd3ea 100644
--- a/Source/WebCore/rendering/svg/SVGRootInlineBox.cpp
+++ b/Source/WebCore/rendering/svg/SVGRootInlineBox.cpp
@@ -25,8 +25,8 @@
 
 #if ENABLE(SVG)
 #include "GraphicsContext.h"
-#include "RenderBlock.h"
 #include "RenderSVGInlineText.h"
+#include "RenderSVGText.h"
 #include "SVGInlineFlowBox.h"
 #include "SVGInlineTextBox.h"
 #include "SVGNames.h"
@@ -73,8 +73,15 @@ void SVGRootInlineBox::paint(PaintInfo& paintInfo, int, int)
 
 void SVGRootInlineBox::computePerCharacterLayoutInformation()
 {
+    RenderSVGText* parentBlock = toRenderSVGText(block());
+    ASSERT(parentBlock);
+
+    Vector<SVGTextLayoutAttributes>& attributes = parentBlock->layoutAttributes();
+    if (parentBlock->needsReordering())
+        reorderValueLists(attributes);
+
     // Perform SVG text layout phase two (see SVGTextLayoutEngine for details).
-    SVGTextLayoutEngine characterLayout;
+    SVGTextLayoutEngine characterLayout(attributes);
     layoutCharactersInTextBoxes(this, characterLayout);
 
     // Perform SVG text layout phase three (see SVGTextChunkBuilder for details).
@@ -108,8 +115,12 @@ void SVGRootInlineBox::layoutCharactersInTextBoxes(InlineFlowBox* start, SVGText
             if (isTextPath) {
                 // Build text chunks for all <textPath> children, using the line layout algorithm.
                 // This is needeed as text-anchor is just an additional startOffset for text paths.
-                SVGTextLayoutEngine lineLayout;
+                RenderSVGText* parentBlock = toRenderSVGText(block());
+                ASSERT(parentBlock);
+
+                SVGTextLayoutEngine lineLayout(parentBlock->layoutAttributes());
                 layoutCharactersInTextBoxes(flowBox, lineLayout);
+
                 characterLayout.beginTextPathLayout(child->renderer(), lineLayout);
             }
 
@@ -215,6 +226,91 @@ InlineBox* SVGRootInlineBox::closestLeafChildForPosition(const IntPoint& point)
 
     return closestLeaf ? closestLeaf : lastLeaf;
 }
+ 
+static inline void swapItemsInVector(Vector<float>& firstVector, Vector<float>& lastVector, unsigned first, unsigned last)
+{
+    float temp = firstVector.at(first);
+    firstVector.at(first) = lastVector.at(last);
+    lastVector.at(last) = temp;
+}
+
+static inline void swapItemsInLayoutAttributes(SVGTextLayoutAttributes& firstAttributes, SVGTextLayoutAttributes& lastAttributes, unsigned firstPosition, unsigned lastPosition)
+{
+    swapItemsInVector(firstAttributes.xValues(), lastAttributes.xValues(), firstPosition, lastPosition);
+    swapItemsInVector(firstAttributes.yValues(), lastAttributes.yValues(), firstPosition, lastPosition);
+    swapItemsInVector(firstAttributes.dxValues(), lastAttributes.dxValues(), firstPosition, lastPosition);
+    swapItemsInVector(firstAttributes.dyValues(), lastAttributes.dyValues(), firstPosition, lastPosition);
+    swapItemsInVector(firstAttributes.rotateValues(), lastAttributes.rotateValues(), firstPosition, lastPosition);
+}
+
+static inline void findFirstAndLastAttributesInVector(Vector<SVGTextLayoutAttributes>& attributes, RenderSVGInlineText* firstContext, RenderSVGInlineText* lastContext,
+                                                      SVGTextLayoutAttributes*& first, SVGTextLayoutAttributes*& last)
+{
+    first = 0;
+    last = 0;
+
+    unsigned attributesSize = attributes.size();
+    for (unsigned i = 0; i < attributesSize; ++i) {
+        SVGTextLayoutAttributes& current = attributes.at(i);
+        if (!first && firstContext == current.context())
+            first = &current;
+        if (!last && lastContext == current.context())
+            last = &current;
+        if (first && last)
+            break;
+    }
+
+    ASSERT(first);
+    ASSERT(last);
+}
+
+static inline void reverseInlineBoxRangeAndValueListsIfNeeded(void* userData, Vector<InlineBox*>::iterator first, Vector<InlineBox*>::iterator last)
+{
+    ASSERT(userData);
+    Vector<SVGTextLayoutAttributes>& attributes = *reinterpret_cast<Vector<SVGTextLayoutAttributes>*>(userData);
+
+    // This is a copy of std::reverse(first, last). It additionally assure that the value lists within the InlineBoxes are reordered as well.
+    while (true)  {
+        if (first == last || first == --last)
+            return;
+
+        ASSERT((*first)->isSVGInlineTextBox());
+        ASSERT((*last)->isSVGInlineTextBox());
+
+        SVGInlineTextBox* firstTextBox = static_cast<SVGInlineTextBox*>(*first);
+        SVGInlineTextBox* lastTextBox = static_cast<SVGInlineTextBox*>(*last);
+
+        // Reordering is only necessary for BiDi text that is _absolutely_ positioned.
+        if (firstTextBox->len() == 1 && firstTextBox->len() == lastTextBox->len()) {
+            RenderSVGInlineText* firstContext = toRenderSVGInlineText(firstTextBox->textRenderer());
+            RenderSVGInlineText* lastContext = toRenderSVGInlineText(lastTextBox->textRenderer());
+
+            SVGTextLayoutAttributes* firstAttributes = 0;
+            SVGTextLayoutAttributes* lastAttributes = 0;
+            findFirstAndLastAttributesInVector(attributes, firstContext, lastContext, firstAttributes, lastAttributes);
+
+            unsigned firstBoxPosition = firstTextBox->start();
+            unsigned firstBoxEnd = firstTextBox->end();
+
+            unsigned lastBoxPosition = lastTextBox->start();
+            unsigned lastBoxEnd = lastTextBox->end();
+            for (; firstBoxPosition <= firstBoxEnd && lastBoxPosition <= lastBoxEnd; ++lastBoxPosition, ++firstBoxPosition)
+                swapItemsInLayoutAttributes(*firstAttributes, *lastAttributes, firstBoxPosition, lastBoxPosition);
+        }
+
+        InlineBox* temp = *first;
+        *first = *last;
+        *last = temp;
+
+        ++first;
+    }
+}
+
+void SVGRootInlineBox::reorderValueLists(Vector<SVGTextLayoutAttributes>& attributes)
+{
+    Vector<InlineBox*> leafBoxesInLogicalOrder;
+    collectLeafBoxesInLogicalOrder(leafBoxesInLogicalOrder, reverseInlineBoxRangeAndValueListsIfNeeded, &attributes);
+}
 
 } // namespace WebCore
 
diff --git a/Source/WebCore/rendering/svg/SVGRootInlineBox.h b/Source/WebCore/rendering/svg/SVGRootInlineBox.h
index 2e073c9..39612e7 100644
--- a/Source/WebCore/rendering/svg/SVGRootInlineBox.h
+++ b/Source/WebCore/rendering/svg/SVGRootInlineBox.h
@@ -55,6 +55,7 @@ public:
     InlineBox* closestLeafChildForPosition(const IntPoint&);
 
 private:
+    void reorderValueLists(Vector<SVGTextLayoutAttributes>&);
     void layoutCharactersInTextBoxes(InlineFlowBox*, SVGTextLayoutEngine&);
     void layoutChildBoxes(InlineFlowBox*);
     void layoutRootBox();
diff --git a/Source/WebCore/rendering/svg/SVGShadowTreeElements.cpp b/Source/WebCore/rendering/svg/SVGShadowTreeElements.cpp
index 2d84c48..9ccdef0 100644
--- a/Source/WebCore/rendering/svg/SVGShadowTreeElements.cpp
+++ b/Source/WebCore/rendering/svg/SVGShadowTreeElements.cpp
@@ -47,6 +47,10 @@ FloatSize SVGShadowTreeContainerElement::containerTranslation() const
     return FloatSize(m_xOffset.value(this), m_yOffset.value(this));
 }
 
+PassRefPtr<Element> SVGShadowTreeContainerElement::cloneElementWithoutAttributesAndChildren() const
+{
+    return adoptRef(new SVGShadowTreeContainerElement(document()));
+}
 // SVGShadowTreeRootElement
 
 inline SVGShadowTreeRootElement::SVGShadowTreeRootElement(Document* document, SVGUseElement* shadowParent)
diff --git a/Source/WebCore/rendering/svg/SVGShadowTreeElements.h b/Source/WebCore/rendering/svg/SVGShadowTreeElements.h
index 3406f95..2952e35 100644
--- a/Source/WebCore/rendering/svg/SVGShadowTreeElements.h
+++ b/Source/WebCore/rendering/svg/SVGShadowTreeElements.h
@@ -44,6 +44,7 @@ protected:
     SVGShadowTreeContainerElement(Document*);
 
 private:
+    virtual PassRefPtr<Element> cloneElementWithoutAttributesAndChildren() const;
     virtual bool isShadowTreeContainerElement() const { return true; }
 
     SVGLength m_xOffset;
diff --git a/Source/WebCore/rendering/svg/SVGTextChunk.cpp b/Source/WebCore/rendering/svg/SVGTextChunk.cpp
index 5dea6ad..49407e5 100644
--- a/Source/WebCore/rendering/svg/SVGTextChunk.cpp
+++ b/Source/WebCore/rendering/svg/SVGTextChunk.cpp
@@ -27,10 +27,8 @@
 
 namespace WebCore {
 
-SVGTextChunk::SVGTextChunk(bool isVerticalText, ETextAnchor textAnchor, SVGTextContentElement::SVGLengthAdjustType lengthAdjust, float desiredTextLength)
-    : m_isVerticalText(isVerticalText)
-    , m_textAnchor(textAnchor)
-    , m_lengthAdjust(lengthAdjust)
+SVGTextChunk::SVGTextChunk(unsigned chunkStyle, float desiredTextLength)
+    : m_chunkStyle(chunkStyle)
     , m_desiredTextLength(desiredTextLength)
 {
 }
@@ -52,7 +50,7 @@ void SVGTextChunk::calculateLength(float& length, unsigned& characters) const
             SVGTextFragment& fragment = fragments.at(i);
             characters += fragment.length;
 
-            if (m_isVerticalText)
+            if (m_chunkStyle & VerticalText)
                 length += fragment.height;
             else
                 length += fragment.width;
@@ -63,7 +61,7 @@ void SVGTextChunk::calculateLength(float& length, unsigned& characters) const
             }
 
             // Resepect gap between chunks.
-            if (m_isVerticalText)
+            if (m_chunkStyle & VerticalText)
                  length += fragment.y - (lastFragment->y + lastFragment->height);
             else
                  length += fragment.x - (lastFragment->x + lastFragment->width);
@@ -75,17 +73,11 @@ void SVGTextChunk::calculateLength(float& length, unsigned& characters) const
 
 float SVGTextChunk::calculateTextAnchorShift(float length) const
 {
-    switch (m_textAnchor) {
-    case TA_START:
-        return 0;
-    case TA_MIDDLE:
+    if (m_chunkStyle & MiddleAnchor)
         return -length / 2;
-    case TA_END:
-        return -length;
-    };
-
-    ASSERT_NOT_REACHED();
-    return 0;
+    if (m_chunkStyle & EndAnchor)
+        return m_chunkStyle & RightToLeftText ? 0 : -length;
+    return m_chunkStyle & RightToLeftText ? -length : 0;
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/rendering/svg/SVGTextChunk.h b/Source/WebCore/rendering/svg/SVGTextChunk.h
index ebe6d81..9618d9f 100644
--- a/Source/WebCore/rendering/svg/SVGTextChunk.h
+++ b/Source/WebCore/rendering/svg/SVGTextChunk.h
@@ -31,34 +31,37 @@ class SVGInlineTextBox;
 // A SVGTextChunk describes a range of SVGTextFragments, see the SVG spec definition of a "text chunk".
 class SVGTextChunk {
 public:
-    SVGTextChunk(bool isVerticalText, ETextAnchor, SVGTextContentElement::SVGLengthAdjustType, float desiredTextLength);
+    enum ChunkStyle {
+        DefaultStyle = 1 << 0,
+        MiddleAnchor = 1 << 1,
+        EndAnchor = 1 << 2,
+        RightToLeftText = 1 << 3,
+        VerticalText = 1 << 4,
+        LengthAdjustSpacing = 1 << 5,
+        LengthAdjustSpacingAndGlyphs = 1 << 6
+    };
+
+    SVGTextChunk(unsigned chunkStyle, float desiredTextLength);
 
     void calculateLength(float& length, unsigned& characters) const;
     float calculateTextAnchorShift(float length) const;
 
-    bool isVerticalText() const { return m_isVerticalText; }
-    ETextAnchor textAnchor() const { return m_textAnchor; }
-    SVGTextContentElement::SVGLengthAdjustType lengthAdjust() const { return m_lengthAdjust; }
+    bool isVerticalText() const { return m_chunkStyle & VerticalText; }
     float desiredTextLength() const { return m_desiredTextLength; }
 
     Vector<SVGInlineTextBox*>& boxes() { return m_boxes; }
     const Vector<SVGInlineTextBox*>& boxes() const { return m_boxes; }
 
-    bool hasDesiredTextLength() const { return m_lengthAdjust != SVGTextContentElement::LENGTHADJUST_UNKNOWN && m_desiredTextLength > 0; } 
-    bool hasTextAnchor() const { return m_textAnchor != TA_START; }
+    bool hasDesiredTextLength() const { return m_desiredTextLength > 0 && ((m_chunkStyle & LengthAdjustSpacing) || (m_chunkStyle & LengthAdjustSpacingAndGlyphs)); }
+    bool hasTextAnchor() const {  return m_chunkStyle & RightToLeftText ? !(m_chunkStyle & EndAnchor) : (m_chunkStyle & MiddleAnchor) || (m_chunkStyle & EndAnchor); }
+    bool hasLengthAdjustSpacing() const { return m_chunkStyle & LengthAdjustSpacing; }
+    bool hasLengthAdjustSpacingAndGlyphs() const { return m_chunkStyle & LengthAdjustSpacingAndGlyphs; }
 
 private:
     // Contains all SVGInlineTextBoxes this chunk spans.
     Vector<SVGInlineTextBox*> m_boxes;
 
-    // writing-mode specific property.
-    bool m_isVerticalText;
-
-    // text-anchor specific properties.
-    ETextAnchor m_textAnchor;
-
-    // textLength/lengthAdjust specific properties.
-    SVGTextContentElement::SVGLengthAdjustType m_lengthAdjust;
+    unsigned m_chunkStyle;
     float m_desiredTextLength;
 };
 
diff --git a/Source/WebCore/rendering/svg/SVGTextChunkBuilder.cpp b/Source/WebCore/rendering/svg/SVGTextChunkBuilder.cpp
index bbbae6c..47311bd 100644
--- a/Source/WebCore/rendering/svg/SVGTextChunkBuilder.cpp
+++ b/Source/WebCore/rendering/svg/SVGTextChunkBuilder.cpp
@@ -101,15 +101,47 @@ void SVGTextChunkBuilder::addTextChunk(Vector<SVGInlineTextBox*>& lineLayoutBoxe
     const SVGRenderStyle* svgStyle = style->svgStyle();
     ASSERT(svgStyle);
 
-    SVGTextContentElement::SVGLengthAdjustType lengthAdjust = SVGTextContentElement::LENGTHADJUST_UNKNOWN;
+    // Build chunk style flags.
+    unsigned chunkStyle = SVGTextChunk::DefaultStyle;
+
+    // Handle 'direction' property.
+    if (!style->isLeftToRightDirection())
+        chunkStyle |= SVGTextChunk::RightToLeftText;
+
+    // Handle 'writing-mode' property.
+    if (svgStyle->isVerticalWritingMode())
+        chunkStyle |= SVGTextChunk::VerticalText;
+
+    // Handle 'text-anchor' property.
+    switch (svgStyle->textAnchor()) {
+    case TA_START:
+        break;
+    case TA_MIDDLE:
+        chunkStyle |= SVGTextChunk::MiddleAnchor;
+        break;
+    case TA_END:
+        chunkStyle |= SVGTextChunk::EndAnchor;
+        break;
+    };
+
+    // Handle 'lengthAdjust' property.
     float desiredTextLength = 0;
-
     if (SVGTextContentElement* textContentElement = SVGTextContentElement::elementFromRenderer(textRenderer->parent())) {
-        lengthAdjust = static_cast<SVGTextContentElement::SVGLengthAdjustType>(textContentElement->lengthAdjust());
         desiredTextLength = textContentElement->textLength().value(textContentElement);
+
+        switch (static_cast<SVGTextContentElement::SVGLengthAdjustType>(textContentElement->lengthAdjust())) {
+        case SVGTextContentElement::LENGTHADJUST_UNKNOWN:
+            break;
+        case SVGTextContentElement::LENGTHADJUST_SPACING:
+            chunkStyle |= SVGTextChunk::LengthAdjustSpacing;
+            break;
+        case SVGTextContentElement::LENGTHADJUST_SPACINGANDGLYPHS:
+            chunkStyle |= SVGTextChunk::LengthAdjustSpacingAndGlyphs;
+            break;
+        };
     }
 
-    SVGTextChunk chunk(svgStyle->isVerticalWritingMode(), svgStyle->textAnchor(), lengthAdjust, desiredTextLength);
+    SVGTextChunk chunk(chunkStyle, desiredTextLength);
 
     Vector<SVGInlineTextBox*>& boxes = chunk.boxes();
     for (unsigned i = boxStart; i < boxStart + boxCount; ++i)
@@ -137,7 +169,7 @@ void SVGTextChunkBuilder::processTextChunk(const SVGTextChunk& chunk)
 
     bool isVerticalText = chunk.isVerticalText();
     if (processTextLength) {
-        if (chunk.lengthAdjust() == SVGTextContentElement::LENGTHADJUST_SPACING) {
+        if (chunk.hasLengthAdjustSpacing()) {
             float textLengthShift = (chunk.desiredTextLength() - chunkLength) / chunkCharacters;
             unsigned atCharacter = 0;
             for (unsigned boxPosition = 0; boxPosition < boxCount; ++boxPosition) {
@@ -147,7 +179,7 @@ void SVGTextChunkBuilder::processTextChunk(const SVGTextChunk& chunk)
                 processTextLengthSpacingCorrection(isVerticalText, textLengthShift, fragments, atCharacter);
             }
         } else {
-            ASSERT(chunk.lengthAdjust() == SVGTextContentElement::LENGTHADJUST_SPACINGANDGLYPHS);
+            ASSERT(chunk.hasLengthAdjustSpacingAndGlyphs());
             float scale = chunk.desiredTextLength() / chunkLength;
             AffineTransform spacingAndGlyphsTransform;
 
@@ -172,7 +204,7 @@ void SVGTextChunkBuilder::processTextChunk(const SVGTextChunk& chunk)
         return;
 
     // If we previously applied a lengthAdjust="spacing" correction, we have to recalculate the chunk length, to be able to apply the text-anchor shift.
-    if (processTextLength && chunk.lengthAdjust() == SVGTextContentElement::LENGTHADJUST_SPACING) {
+    if (processTextLength && chunk.hasLengthAdjustSpacing()) {
         chunkLength = 0;
         chunkCharacters = 0;
         chunk.calculateLength(chunkLength, chunkCharacters);
diff --git a/Source/WebCore/rendering/svg/SVGTextFragment.h b/Source/WebCore/rendering/svg/SVGTextFragment.h
index 2e520da..b5b3c57 100644
--- a/Source/WebCore/rendering/svg/SVGTextFragment.h
+++ b/Source/WebCore/rendering/svg/SVGTextFragment.h
@@ -28,7 +28,8 @@ namespace WebCore {
 // A SVGTextFragment describes a text fragment of a RenderSVGInlineText which can be rendered at once.
 struct SVGTextFragment {
     SVGTextFragment()
-        : positionListOffset(0)
+        : characterOffset(0)
+        , metricsListOffset(0)
         , length(0)
         , x(0)
         , y(0)
@@ -37,8 +38,9 @@ struct SVGTextFragment {
     {
     }
 
-    // The first rendered character starts at RenderSVGInlineText::characters() + positionListOffset.
-    unsigned positionListOffset;
+    // The first rendered character starts at RenderSVGInlineText::characters() + characterOffset.
+    unsigned characterOffset;
+    unsigned metricsListOffset;
     unsigned length;
 
     float x;
diff --git a/Source/WebCore/rendering/svg/SVGTextLayoutAttributes.cpp b/Source/WebCore/rendering/svg/SVGTextLayoutAttributes.cpp
index 3037b77..4c227b4 100644
--- a/Source/WebCore/rendering/svg/SVGTextLayoutAttributes.cpp
+++ b/Source/WebCore/rendering/svg/SVGTextLayoutAttributes.cpp
@@ -27,7 +27,8 @@
 
 namespace WebCore {
 
-SVGTextLayoutAttributes::SVGTextLayoutAttributes()
+SVGTextLayoutAttributes::SVGTextLayoutAttributes(RenderSVGInlineText* context)
+    : m_context(context)
 {
 }
 
@@ -65,6 +66,8 @@ static inline void dumpLayoutVector(const Vector<float>& values)
 
 void SVGTextLayoutAttributes::dump() const
 {
+    fprintf(stderr, "context: %p\n", m_context);
+
     fprintf(stderr, "x values: ");
     dumpLayoutVector(m_xValues);
     fprintf(stderr, "\n");
diff --git a/Source/WebCore/rendering/svg/SVGTextLayoutAttributes.h b/Source/WebCore/rendering/svg/SVGTextLayoutAttributes.h
index d08d5b7..fc6bd10 100644
--- a/Source/WebCore/rendering/svg/SVGTextLayoutAttributes.h
+++ b/Source/WebCore/rendering/svg/SVGTextLayoutAttributes.h
@@ -27,15 +27,19 @@
 
 namespace WebCore {
 
+class RenderSVGInlineText;
+
 class SVGTextLayoutAttributes {
 public:
-    SVGTextLayoutAttributes();
+    SVGTextLayoutAttributes(RenderSVGInlineText* context = 0);
 
     void reserveCapacity(unsigned length);
     void dump() const;
 
     static float emptyValue();
 
+    RenderSVGInlineText* context() const { return m_context; }
+
     Vector<float>& xValues() { return m_xValues; }
     const Vector<float>& xValues() const { return m_xValues; }
 
@@ -55,6 +59,7 @@ public:
     const Vector<SVGTextMetrics>& textMetricsValues() const { return m_textMetricsValues; }
 
 private:
+    RenderSVGInlineText* m_context;
     Vector<float> m_xValues;
     Vector<float> m_yValues;
     Vector<float> m_dxValues;
diff --git a/Source/WebCore/rendering/svg/SVGTextLayoutAttributesBuilder.cpp b/Source/WebCore/rendering/svg/SVGTextLayoutAttributesBuilder.cpp
index 3122912..86be424 100644
--- a/Source/WebCore/rendering/svg/SVGTextLayoutAttributesBuilder.cpp
+++ b/Source/WebCore/rendering/svg/SVGTextLayoutAttributesBuilder.cpp
@@ -52,9 +52,11 @@ void SVGTextLayoutAttributesBuilder::buildLayoutAttributesForTextSubtree(RenderS
     buildOutermostLayoutScope(textRoot, atCharacter);
 
     // Propagate layout attributes to each RenderSVGInlineText object.
+    Vector<SVGTextLayoutAttributes>& allAttributes = textRoot->layoutAttributes();
+    allAttributes.clear();
     atCharacter = 0;
     lastCharacter = '\0';
-    propagateLayoutAttributes(textRoot, atCharacter, lastCharacter);
+    propagateLayoutAttributes(textRoot, allAttributes, atCharacter, lastCharacter);
 }
 
 static inline void extractFloatValuesFromSVGLengthList(SVGElement* lengthContext, const SVGLengthList& list, Vector<float>& floatValues, unsigned textContentLength)
@@ -186,7 +188,7 @@ void SVGTextLayoutAttributesBuilder::buildOutermostLayoutScope(RenderSVGText* te
     m_scopes.prepend(scope);
 }
 
-void SVGTextLayoutAttributesBuilder::propagateLayoutAttributes(RenderObject* start, unsigned& atCharacter, UChar& lastCharacter) const
+void SVGTextLayoutAttributesBuilder::propagateLayoutAttributes(RenderObject* start, Vector<SVGTextLayoutAttributes>& allAttributes, unsigned& atCharacter, UChar& lastCharacter) const
 {
     for (RenderObject* child = start->firstChild(); child; child = child->nextSibling()) { 
         if (child->isSVGInlineText()) {
@@ -195,16 +197,29 @@ void SVGTextLayoutAttributesBuilder::propagateLayoutAttributes(RenderObject* sta
             unsigned textLength = text->textLength();
             bool preserveWhiteSpace = shouldPreserveAllWhiteSpace(text->style());
 
-            SVGTextLayoutAttributes attributes;
+            SVGTextLayoutAttributes attributes(text);
             attributes.reserveCapacity(textLength);
     
             unsigned valueListPosition = atCharacter;
             unsigned metricsLength = 1;
+            SVGTextMetrics lastMetrics = SVGTextMetrics::emptyMetrics();
+
             for (unsigned textPosition = 0; textPosition < textLength; textPosition += metricsLength) {
                 const UChar& currentCharacter = characters[textPosition];
 
-                SVGTextMetrics metrics = SVGTextMetrics::measureCharacterRange(text, textPosition, 1);
-                metricsLength = metrics.length();
+                SVGTextMetrics startToCurrentMetrics = SVGTextMetrics::measureCharacterRange(text, 0, textPosition + 1);
+                SVGTextMetrics currentMetrics = SVGTextMetrics::measureCharacterRange(text, textPosition, 1);
+
+                // Frequent case for Arabic text: when measuring a single character the arabic isolated form is taken
+                // when rendering the glyph "in context" (with it's surrounding characters) it changes due to shaping.
+                // So whenever runWidthAdvance != currentMetrics.width(), we are processing a text run whose length is
+                // not equal to the sum of the individual lengths of the glyphs, when measuring them isolated.
+                float runWidthAdvance = startToCurrentMetrics.width() - lastMetrics.width();
+                if (runWidthAdvance != currentMetrics.width())
+                    currentMetrics.setWidth(runWidthAdvance);
+
+                lastMetrics = startToCurrentMetrics;
+                metricsLength = currentMetrics.length();
 
                 if (!preserveWhiteSpace && characterIsSpace(currentCharacter) && characterIsSpaceOrNull(lastCharacter)) {
                     assignEmptyLayoutAttributesForCharacter(attributes);
@@ -212,7 +227,7 @@ void SVGTextLayoutAttributesBuilder::propagateLayoutAttributes(RenderObject* sta
                     continue;
                 }
 
-                assignLayoutAttributesForCharacter(attributes, metrics, valueListPosition);
+                assignLayoutAttributesForCharacter(attributes, currentMetrics, valueListPosition);
 
                 if (metricsLength > 1) {
                     for (unsigned i = 0; i < metricsLength - 1; ++i)
@@ -225,10 +240,12 @@ void SVGTextLayoutAttributesBuilder::propagateLayoutAttributes(RenderObject* sta
 
 #if DUMP_TEXT_LAYOUT_ATTRIBUTES > 0
             fprintf(stderr, "\nDumping layout attributes for RenderSVGInlineText, renderer=%p, node=%p (atCharacter: %i)\n", text, text->node(), atCharacter);
+            fprintf(stderr, "BiDi properties: unicode-bidi=%i, block direction=%i\n", text->style()->unicodeBidi(), text->style()->direction());
             attributes.dump();
 #endif
 
             text->storeLayoutAttributes(attributes);
+            allAttributes.append(attributes);
             atCharacter = valueListPosition;
             continue;
         }
@@ -236,7 +253,7 @@ void SVGTextLayoutAttributesBuilder::propagateLayoutAttributes(RenderObject* sta
         if (!child->isSVGInline())
             continue;
 
-        propagateLayoutAttributes(child, atCharacter, lastCharacter);
+        propagateLayoutAttributes(child, allAttributes, atCharacter, lastCharacter);
     }
 }
 
diff --git a/Source/WebCore/rendering/svg/SVGTextLayoutAttributesBuilder.h b/Source/WebCore/rendering/svg/SVGTextLayoutAttributesBuilder.h
index c68185b..b368c51 100644
--- a/Source/WebCore/rendering/svg/SVGTextLayoutAttributesBuilder.h
+++ b/Source/WebCore/rendering/svg/SVGTextLayoutAttributesBuilder.h
@@ -60,7 +60,7 @@ private:
     void buildLayoutScope(LayoutScope&, RenderObject*, unsigned textContentStart, unsigned textContentLength) const;
     void buildLayoutScopes(RenderObject*, unsigned& atCharacter, UChar& lastCharacter);
     void buildOutermostLayoutScope(RenderSVGText*, unsigned textLength);
-    void propagateLayoutAttributes(RenderObject*, unsigned& atCharacter, UChar& lastCharacter) const;
+    void propagateLayoutAttributes(RenderObject*, Vector<SVGTextLayoutAttributes>& allAttributes, unsigned& atCharacter, UChar& lastCharacter) const;
 
     enum LayoutValueType {
         XValueAttribute,
diff --git a/Source/WebCore/rendering/svg/SVGTextLayoutEngine.cpp b/Source/WebCore/rendering/svg/SVGTextLayoutEngine.cpp
index c25ed79..71db2ea 100644
--- a/Source/WebCore/rendering/svg/SVGTextLayoutEngine.cpp
+++ b/Source/WebCore/rendering/svg/SVGTextLayoutEngine.cpp
@@ -34,8 +34,13 @@
 
 namespace WebCore {
 
-SVGTextLayoutEngine::SVGTextLayoutEngine()
-    : m_x(0)
+SVGTextLayoutEngine::SVGTextLayoutEngine(Vector<SVGTextLayoutAttributes>& layoutAttributes)
+    : m_layoutAttributes(layoutAttributes)
+    , m_logicalCharacterOffset(0)
+    , m_logicalMetricsListOffset(0)
+    , m_visualCharacterOffset(0)
+    , m_visualMetricsListOffset(0)
+    , m_x(0)
     , m_y(0)
     , m_dx(0)
     , m_dy(0)
@@ -46,6 +51,7 @@ SVGTextLayoutEngine::SVGTextLayoutEngine()
     , m_textPathSpacing(0)
     , m_textPathScaling(1)
 {
+    ASSERT(!m_layoutAttributes.isEmpty());
 }
 
 void SVGTextLayoutEngine::updateCharacerPositionIfNeeded(float& x, float& y)
@@ -77,7 +83,7 @@ void SVGTextLayoutEngine::updateCurrentTextPosition(float x, float y, float glyp
     }
 }
 
-void SVGTextLayoutEngine::updateRelativePositionAdjustmentsIfNeeded(Vector<float>& dxValues, Vector<float>& dyValues, unsigned positionListOffset)
+void SVGTextLayoutEngine::updateRelativePositionAdjustmentsIfNeeded(Vector<float>& dxValues, Vector<float>& dyValues)
 {
     // Update relative positioning information.
     if (dxValues.isEmpty() && dyValues.isEmpty())
@@ -85,14 +91,14 @@ void SVGTextLayoutEngine::updateRelativePositionAdjustmentsIfNeeded(Vector<float
 
     float dx = 0;
     if (!dxValues.isEmpty()) {
-        float& dxCurrent = dxValues.at(positionListOffset);
+        float& dxCurrent = dxValues.at(m_logicalCharacterOffset);
         if (dxCurrent != SVGTextLayoutAttributes::emptyValue())
             dx = dxCurrent;
     }
 
     float dy = 0;
     if (!dyValues.isEmpty()) {
-        float& dyCurrent = dyValues.at(positionListOffset);
+        float& dyCurrent = dyValues.at(m_logicalCharacterOffset);
         if (dyCurrent != SVGTextLayoutAttributes::emptyValue())
             dy = dyCurrent;
     }
@@ -113,23 +119,31 @@ void SVGTextLayoutEngine::updateRelativePositionAdjustmentsIfNeeded(Vector<float
     m_dy = dy;
 }
 
-void SVGTextLayoutEngine::recordTextFragment(SVGInlineTextBox* textBox, RenderSVGInlineText* text, unsigned positionListOffset, const SVGTextMetrics& lastCharacterMetrics)
+void SVGTextLayoutEngine::recordTextFragment(SVGInlineTextBox* textBox, Vector<SVGTextMetrics>& textMetricsValues)
 {
     ASSERT(!m_currentTextFragment.length);
+    ASSERT(m_visualMetricsListOffset > 0);
 
     // Figure out length of fragment.
-    m_currentTextFragment.length = positionListOffset - m_currentTextFragment.positionListOffset;
+    m_currentTextFragment.length = m_visualCharacterOffset - m_currentTextFragment.characterOffset;
 
     // Figure out fragment metrics.
-    if (m_currentTextFragment.length == 1) {
-        // Fast path, can rely on already computed per-character metrics.
-        m_currentTextFragment.width = lastCharacterMetrics.width();
-        m_currentTextFragment.height = lastCharacterMetrics.height();
-    } else {
-        // Need to measure the whole range (range metrics != sum of character metrics)
-        SVGTextMetrics metrics = SVGTextMetrics::measureCharacterRange(text, m_currentTextFragment.positionListOffset, m_currentTextFragment.length);
-        m_currentTextFragment.width = metrics.width();
-        m_currentTextFragment.height = metrics.height();
+    SVGTextMetrics& lastCharacterMetrics = textMetricsValues.at(m_visualMetricsListOffset - 1);
+    m_currentTextFragment.width = lastCharacterMetrics.width();
+    m_currentTextFragment.height = lastCharacterMetrics.height();
+
+    if (m_currentTextFragment.length > 1) {
+        // SVGTextLayoutAttributesBuilder assures that the length of the range is equal to the sum of the individual lengths of the glyphs.
+        float length = 0;
+        if (m_isVerticalText) {
+            for (unsigned i = m_currentTextFragment.metricsListOffset; i < m_visualMetricsListOffset; ++i)
+                length += textMetricsValues.at(i).height();
+            m_currentTextFragment.height = length;
+        } else {
+            for (unsigned i = m_currentTextFragment.metricsListOffset; i < m_visualMetricsListOffset; ++i)
+                length += textMetricsValues.at(i).width();
+            m_currentTextFragment.width = length;
+        }
     }
 
     textBox->textFragments().append(m_currentTextFragment);
@@ -281,7 +295,7 @@ void SVGTextLayoutEngine::finalizeTransformMatrices(Vector<SVGInlineTextBox*>& b
         SVGInlineTextBox* textBox = boxes.at(boxPosition);
         Vector<SVGTextFragment>& fragments = textBox->textFragments();
         fprintf(stderr, "-> Box %i: Dumping text fragments for SVGInlineTextBox, textBox=%p, textRenderer=%p\n", boxPosition, textBox, textBox->textRenderer());
-        fprintf(stderr, "        textBox properties, start=%i, len=%i\n", textBox->start(), textBox->len());
+        fprintf(stderr, "        textBox properties, start=%i, len=%i, box direction=%i\n", textBox->start(), textBox->len(), textBox->direction());
         fprintf(stderr, "   textRenderer properties, textLength=%i\n", textBox->textRenderer()->textLength());
 
         const UChar* characters = textBox->textRenderer()->characters();
@@ -289,9 +303,9 @@ void SVGTextLayoutEngine::finalizeTransformMatrices(Vector<SVGInlineTextBox*>& b
         unsigned fragmentCount = fragments.size();
         for (unsigned i = 0; i < fragmentCount; ++i) {
             SVGTextFragment& fragment = fragments.at(i);
-            String fragmentString(characters + fragment.positionListOffset, fragment.length);
-            fprintf(stderr, "    -> Fragment %i, x=%lf, y=%lf, width=%lf, height=%lf, positionListOffset=%i, length=%i, characters='%s'\n"
-                          , i, fragment.x, fragment.y, fragment.width, fragment.height, fragment.positionListOffset, fragment.length, fragmentString.utf8().data());
+            String fragmentString(characters + fragment.characterOffset, fragment.length);
+            fprintf(stderr, "    -> Fragment %i, x=%lf, y=%lf, width=%lf, height=%lf, characterOffset=%i, length=%i, characters='%s'\n"
+                          , i, fragment.x, fragment.y, fragment.width, fragment.height, fragment.characterOffset, fragment.length, fragmentString.utf8().data());
         }
     }
 #endif
@@ -328,6 +342,97 @@ void SVGTextLayoutEngine::finalizeTransformMatrices(Vector<SVGInlineTextBox*>& b
     boxes.clear();
 }
 
+bool SVGTextLayoutEngine::currentLogicalCharacterAttributes(SVGTextLayoutAttributes& logicalAttributes)
+{
+    logicalAttributes = m_layoutAttributes.first();
+    if (m_logicalCharacterOffset != logicalAttributes.xValues().size())
+        return true;
+
+    m_layoutAttributes.remove(0);
+    if (m_layoutAttributes.isEmpty())
+        return false;
+
+    logicalAttributes = m_layoutAttributes.first();
+    m_logicalMetricsListOffset = 0;
+    m_logicalCharacterOffset = 0;
+    return true;
+}
+
+bool SVGTextLayoutEngine::currentLogicalCharacterMetrics(SVGTextLayoutAttributes& logicalAttributes, SVGTextMetrics& logicalMetrics)
+{
+    logicalMetrics = SVGTextMetrics::emptyMetrics();
+
+    Vector<SVGTextMetrics>& textMetricsValues = logicalAttributes.textMetricsValues();
+    unsigned textMetricsSize = textMetricsValues.size();
+    while (true) {
+        if (m_logicalMetricsListOffset == textMetricsSize) {
+            if (!currentLogicalCharacterAttributes(logicalAttributes))
+                return false;
+
+            textMetricsValues = logicalAttributes.textMetricsValues();
+            textMetricsSize = textMetricsValues.size();
+            continue;
+        }
+
+        logicalMetrics = textMetricsValues.at(m_logicalMetricsListOffset);
+        if (logicalMetrics == SVGTextMetrics::emptyMetrics() || (!logicalMetrics.width() && !logicalMetrics.height())) {
+            advanceToNextLogicalCharacter(logicalMetrics);
+            continue;
+        }
+
+        // Stop if we found the next valid logical text metrics object.
+        return true;
+    }
+
+    ASSERT_NOT_REACHED();
+    return true;
+}
+
+bool SVGTextLayoutEngine::currentVisualCharacterMetrics(SVGInlineTextBox* textBox, RenderSVGInlineText* text, SVGTextMetrics& metrics)
+{
+    SVGTextLayoutAttributes& attributes = text->layoutAttributes();
+    Vector<SVGTextMetrics>& textMetricsValues = attributes.textMetricsValues();
+    ASSERT(!textMetricsValues.isEmpty());
+
+    unsigned textMetricsSize = textMetricsValues.size();
+    unsigned boxStart = textBox->start();
+    unsigned boxLength = textBox->len();
+
+    if (m_visualMetricsListOffset == textMetricsSize)
+        return false;
+
+    while (m_visualMetricsListOffset < textMetricsSize) {
+        SVGTextMetrics& visualMetrics = textMetricsValues.at(m_visualMetricsListOffset);
+
+        // Advance to text box start location.
+        if (m_visualCharacterOffset < boxStart) {
+            advanceToNextVisualCharacter(visualMetrics);
+            continue;
+        }
+
+        // Stop if we've finished processing this text box.
+        if (m_visualCharacterOffset >= boxStart + boxLength)
+            return false;
+
+        metrics = visualMetrics;
+        return true;
+    }
+
+    return false;
+}
+
+void SVGTextLayoutEngine::advanceToNextLogicalCharacter(const SVGTextMetrics& logicalMetrics)
+{
+    ++m_logicalMetricsListOffset;
+    m_logicalCharacterOffset += logicalMetrics.length();
+}
+
+void SVGTextLayoutEngine::advanceToNextVisualCharacter(const SVGTextMetrics& visualMetrics)
+{
+    ++m_visualMetricsListOffset;
+    m_visualCharacterOffset += visualMetrics.length();
+}
+
 void SVGTextLayoutEngine::layoutTextOnLineOrPath(SVGInlineTextBox* textBox, RenderSVGInlineText* text, const RenderStyle* style)
 {
     SVGElement* lengthContext = static_cast<SVGElement*>(text->parent()->node());
@@ -338,26 +443,10 @@ void SVGTextLayoutEngine::layoutTextOnLineOrPath(SVGInlineTextBox* textBox, Rend
     const SVGRenderStyle* svgStyle = style->svgStyle();
     ASSERT(svgStyle);
 
-    SVGTextLayoutAttributes& attributes = text->layoutAttributes();
-    Vector<float>& xValues = attributes.xValues();
-    Vector<float>& yValues = attributes.yValues();
-    Vector<float>& dxValues = attributes.dxValues();
-    Vector<float>& dyValues = attributes.dyValues();
-    Vector<float>& rotateValues = attributes.rotateValues();
-    Vector<SVGTextMetrics>& textMetricsValues = attributes.textMetricsValues();
-
-    unsigned boxStart = textBox->start();
-    unsigned boxLength = textBox->len();
-    unsigned textMetricsSize = textMetricsValues.size();
-    ASSERT(textMetricsSize <= xValues.size());
-    ASSERT(textMetricsSize <= yValues.size());
-    ASSERT(xValues.size() == yValues.size());
+    m_visualMetricsListOffset = 0;
+    m_visualCharacterOffset = 0;
 
-    if (boxLength > textMetricsSize)
-        textMetricsSize = boxLength; 
-
-    unsigned positionListOffset = 0;
-    unsigned metricsListOffset = 0;
+    Vector<SVGTextMetrics>& textMetricsValues = text->layoutAttributes().textMetricsValues();
     const UChar* characters = text->characters();
 
     const Font& font = style->font();
@@ -372,56 +461,63 @@ void SVGTextLayoutEngine::layoutTextOnLineOrPath(SVGInlineTextBox* textBox, Rend
     baselineShift -= baselineLayout.calculateAlignmentBaselineShift(m_isVerticalText, text);
 
     // Main layout algorithm.
-    unsigned positionListSize = xValues.size();
-    for (; metricsListOffset < textMetricsSize && positionListOffset < positionListSize; ++metricsListOffset) {
-        SVGTextMetrics& metrics = textMetricsValues.at(metricsListOffset);
-        // Advance to text box start location.
-        if (positionListOffset < boxStart) {
-            positionListOffset += metrics.length();
+    while (true) {
+        // Find the start of the current text box in this list, respecting ligatures.
+        SVGTextMetrics visualMetrics = SVGTextMetrics::emptyMetrics();
+        if (!currentVisualCharacterMetrics(textBox, text, visualMetrics))
+            break;
+
+        if (visualMetrics == SVGTextMetrics::emptyMetrics()) {
+            advanceToNextVisualCharacter(visualMetrics);
             continue;
         }
 
-        // Stop if we've finished processing this text box.
-        if (positionListOffset >= boxStart + boxLength)
+        SVGTextLayoutAttributes logicalAttributes;
+        if (!currentLogicalCharacterAttributes(logicalAttributes))
             break;
- 
-        float x = xValues.at(positionListOffset);
-        float y = yValues.at(positionListOffset);
 
-        // When we've advanced to the box start offset, determine using the original x/y values,
-        // wheter this character starts a new text chunk, before doing any further processing.
-        if (positionListOffset == boxStart)
-            textBox->setStartsNewTextChunk(text->characterStartsNewTextChunk(boxStart));
+        SVGTextMetrics logicalMetrics = SVGTextMetrics::emptyMetrics();
+        if (!currentLogicalCharacterMetrics(logicalAttributes, logicalMetrics))
+            break;
 
-        if (metrics == SVGTextMetrics::emptyMetrics()) {
-            positionListOffset += metrics.length();
-            continue;
-        }
+        Vector<float>& xValues = logicalAttributes.xValues();
+        Vector<float>& yValues = logicalAttributes.yValues();
+        Vector<float>& dxValues = logicalAttributes.dxValues();
+        Vector<float>& dyValues = logicalAttributes.dyValues();
+        Vector<float>& rotateValues = logicalAttributes.rotateValues();
+
+        float x = xValues.at(m_logicalCharacterOffset);
+        float y = yValues.at(m_logicalCharacterOffset);
+
+        // When we've advanced to the box start offset, determine using the original x/y values,
+        // whether this character starts a new text chunk, before doing any further processing.
+        if (m_visualCharacterOffset == textBox->start())
+            textBox->setStartsNewTextChunk(logicalAttributes.context()->characterStartsNewTextChunk(m_logicalCharacterOffset));
 
-        const UChar* currentCharacter = characters + positionListOffset;
         float angle = 0;
         if (!rotateValues.isEmpty()) {
-            float newAngle = rotateValues.at(positionListOffset);
+            float newAngle = rotateValues.at(m_logicalCharacterOffset);
             if (newAngle != SVGTextLayoutAttributes::emptyValue())
                 angle = newAngle;
         }
 
         // Calculate glyph orientation angle.
+        const UChar* currentCharacter = characters + m_visualCharacterOffset;
         float orientationAngle = baselineLayout.calculateGlyphOrientationAngle(m_isVerticalText, svgStyle, *currentCharacter);
 
         // Calculate glyph advance & x/y orientation shifts.
         float xOrientationShift = 0;
         float yOrientationShift = 0;
-        float glyphAdvance = baselineLayout.calculateGlyphAdvanceAndOrientation(m_isVerticalText, metrics, orientationAngle, xOrientationShift, yOrientationShift);
+        float glyphAdvance = baselineLayout.calculateGlyphAdvanceAndOrientation(m_isVerticalText, visualMetrics, orientationAngle, xOrientationShift, yOrientationShift);
 
         // Assign current text position to x/y values, if needed.
         updateCharacerPositionIfNeeded(x, y);
 
         // Apply dx/dy value adjustments to current text position, if needed.
-        updateRelativePositionAdjustmentsIfNeeded(dxValues, dyValues, positionListOffset);
+        updateRelativePositionAdjustmentsIfNeeded(dxValues, dyValues);
 
         // Calculate SVG Fonts kerning, if needed.
-        float kerning = spacingLayout.calculateSVGKerning(m_isVerticalText, metrics.glyph());
+        float kerning = spacingLayout.calculateSVGKerning(m_isVerticalText, visualMetrics.glyph());
 
         // Calculate CSS 'kerning', 'letter-spacing' and 'word-spacing' for next character, if needed.
         float spacing = spacingLayout.calculateCSSKerningAndSpacing(svgStyle, lengthContext, currentCharacter);
@@ -461,7 +557,8 @@ void SVGTextLayoutEngine::layoutTextOnLineOrPath(SVGInlineTextBox* textBox, Rend
 
             // Skip character, if we're before the path.
             if (textPathOffset < 0) {
-                positionListOffset += metrics.length();
+                advanceToNextLogicalCharacter(logicalMetrics);
+                advanceToNextVisualCharacter(visualMetrics);
                 continue;
             }
 
@@ -513,16 +610,17 @@ void SVGTextLayoutEngine::layoutTextOnLineOrPath(SVGInlineTextBox* textBox, Rend
         // If we already started a fragment, close it now.
         if (didStartTextFragment && shouldStartNewFragment) {
             applySpacingToNextCharacter = false;
-            recordTextFragment(textBox, text, positionListOffset, textMetricsValues.at(metricsListOffset - 1));
+            recordTextFragment(textBox, textMetricsValues);
         }
 
         // Eventually start a new fragment, if not yet done.
         if (!didStartTextFragment || shouldStartNewFragment) {
-            ASSERT(!m_currentTextFragment.positionListOffset);
+            ASSERT(!m_currentTextFragment.characterOffset);
             ASSERT(!m_currentTextFragment.length);
 
             didStartTextFragment = true;
-            m_currentTextFragment.positionListOffset = positionListOffset;
+            m_currentTextFragment.characterOffset = m_visualCharacterOffset;
+            m_currentTextFragment.metricsListOffset = m_visualMetricsListOffset;
             m_currentTextFragment.x = x;
             m_currentTextFragment.y = y;
 
@@ -563,7 +661,8 @@ void SVGTextLayoutEngine::layoutTextOnLineOrPath(SVGInlineTextBox* textBox, Rend
             updateCurrentTextPosition(xNew, yNew, glyphAdvance + spacing);
         }
 
-        positionListOffset += metrics.length();
+        advanceToNextLogicalCharacter(logicalMetrics);
+        advanceToNextVisualCharacter(visualMetrics);
         lastAngle = angle;
     }
 
@@ -571,7 +670,7 @@ void SVGTextLayoutEngine::layoutTextOnLineOrPath(SVGInlineTextBox* textBox, Rend
         return;
 
     // Close last open fragment, if needed.
-    recordTextFragment(textBox, text, positionListOffset, textMetricsValues.at(metricsListOffset - 1));
+    recordTextFragment(textBox, textMetricsValues);
 }
 
 }
diff --git a/Source/WebCore/rendering/svg/SVGTextLayoutEngine.h b/Source/WebCore/rendering/svg/SVGTextLayoutEngine.h
index 631e4cd..22dd59b 100644
--- a/Source/WebCore/rendering/svg/SVGTextLayoutEngine.h
+++ b/Source/WebCore/rendering/svg/SVGTextLayoutEngine.h
@@ -24,6 +24,7 @@
 #include "Path.h"
 #include "SVGTextChunkBuilder.h"
 #include "SVGTextFragment.h"
+#include "SVGTextLayoutAttributes.h"
 #include "SVGTextMetrics.h"
 #include <wtf/Vector.h>
 
@@ -47,7 +48,7 @@ class SVGRenderStyle;
 class SVGTextLayoutEngine {
     WTF_MAKE_NONCOPYABLE(SVGTextLayoutEngine);
 public:
-    SVGTextLayoutEngine();
+    SVGTextLayoutEngine(Vector<SVGTextLayoutAttributes>&);
     SVGTextChunkBuilder& chunkLayoutBuilder() { return m_chunkLayoutBuilder; }
 
     void beginTextPathLayout(RenderObject*, SVGTextLayoutEngine& lineLayout);
@@ -59,20 +60,32 @@ public:
 private:
     void updateCharacerPositionIfNeeded(float& x, float& y);
     void updateCurrentTextPosition(float x, float y, float glyphAdvance);
-    void updateRelativePositionAdjustmentsIfNeeded(Vector<float>& dxValues, Vector<float>& dyValues, unsigned valueListPosition);
+    void updateRelativePositionAdjustmentsIfNeeded(Vector<float>& dxValues, Vector<float>& dyValues);
 
-    void recordTextFragment(SVGInlineTextBox*, RenderSVGInlineText*, unsigned positionListOffset, const SVGTextMetrics& lastCharacterMetrics);
+    void recordTextFragment(SVGInlineTextBox*, Vector<SVGTextMetrics>& textMetricValues);
     bool parentDefinesTextLength(RenderObject*) const;
 
     void layoutTextOnLineOrPath(SVGInlineTextBox*, RenderSVGInlineText*, const RenderStyle*);
     void finalizeTransformMatrices(Vector<SVGInlineTextBox*>&);
 
+    bool currentLogicalCharacterAttributes(SVGTextLayoutAttributes&);
+    bool currentLogicalCharacterMetrics(SVGTextLayoutAttributes&, SVGTextMetrics&);
+    bool currentVisualCharacterMetrics(SVGInlineTextBox*, RenderSVGInlineText*, SVGTextMetrics&);
+
+    void advanceToNextLogicalCharacter(const SVGTextMetrics&);
+    void advanceToNextVisualCharacter(const SVGTextMetrics&);
+
 private:
+    Vector<SVGTextLayoutAttributes> m_layoutAttributes;
     Vector<SVGInlineTextBox*> m_lineLayoutBoxes;
     Vector<SVGInlineTextBox*> m_pathLayoutBoxes;
     SVGTextChunkBuilder m_chunkLayoutBuilder;
 
     SVGTextFragment m_currentTextFragment;
+    unsigned m_logicalCharacterOffset;
+    unsigned m_logicalMetricsListOffset;
+    unsigned m_visualCharacterOffset;
+    unsigned m_visualMetricsListOffset;
     float m_x;
     float m_y;
     float m_dx;
diff --git a/Source/WebCore/rendering/svg/SVGTextMetrics.cpp b/Source/WebCore/rendering/svg/SVGTextMetrics.cpp
index d75bdb3..042bc22 100644
--- a/Source/WebCore/rendering/svg/SVGTextMetrics.cpp
+++ b/Source/WebCore/rendering/svg/SVGTextMetrics.cpp
@@ -74,7 +74,17 @@ SVGTextMetrics SVGTextMetrics::emptyMetrics()
 
 static TextRun constructTextRun(RenderSVGInlineText* text, const UChar* characters, unsigned position, unsigned length)
 {
-    TextRun run(characters + position, length);
+    RenderStyle* style = text->style();
+    ASSERT(style);
+
+    TextRun run(characters + position
+                , length
+                , false /* allowTabs */
+                , 0 /* xPos, only relevant with allowTabs=true */
+                , 0 /* padding, only relevant for justified text, not relevant for SVG */
+                , TextRun::AllowTrailingExpansion
+                , !style->isLeftToRightDirection()
+                , style->unicodeBidi() == Override /* directionalOverride */);
 
 #if ENABLE(SVG_FONTS)
     run.setReferencingRenderObject(text);
@@ -92,22 +102,6 @@ SVGTextMetrics SVGTextMetrics::measureCharacterRange(RenderSVGInlineText* text,
     return SVGTextMetrics(text, run, position, text->textLength());
 }
 
-void SVGTextMetrics::measureAllCharactersIndividually(RenderSVGInlineText* text, Vector<SVGTextMetrics>& allMetrics)
-{
-    ASSERT(text);
-    const UChar* characters = text->characters();
-    unsigned length = text->textLength();
-
-    TextRun run(constructTextRun(text, 0, 0, 0));
-    for (unsigned position = 0; position < length; ) {
-        run.setText(characters + position, 1);
-
-        SVGTextMetrics metrics(text, run, position, text->textLength());
-        allMetrics.append(metrics);
-        position += metrics.length();
-    }
-}
-
 }
 
 #endif // ENABLE(SVG)
diff --git a/Source/WebCore/rendering/svg/SVGTextMetrics.h b/Source/WebCore/rendering/svg/SVGTextMetrics.h
index 7ef0f7d..cb016b6 100644
--- a/Source/WebCore/rendering/svg/SVGTextMetrics.h
+++ b/Source/WebCore/rendering/svg/SVGTextMetrics.h
@@ -32,7 +32,6 @@ class SVGTextMetrics {
 public:
     static SVGTextMetrics emptyMetrics();
     static SVGTextMetrics measureCharacterRange(RenderSVGInlineText*, unsigned position, unsigned length);
-    static void measureAllCharactersIndividually(RenderSVGInlineText*, Vector<SVGTextMetrics>&);
 
     bool operator==(const SVGTextMetrics&);
 
@@ -62,6 +61,10 @@ public:
     const Glyph& glyph() const { return m_glyph; }
 
 private:
+    friend class SVGTextLayoutAttributesBuilder;
+    void setWidth(float width) { m_width = width; }
+
+private:
     SVGTextMetrics();
     SVGTextMetrics(RenderSVGInlineText*, const TextRun&, unsigned position, unsigned textLength);
 
diff --git a/Source/WebCore/rendering/svg/SVGTextQuery.cpp b/Source/WebCore/rendering/svg/SVGTextQuery.cpp
index 1a4cdab..5f3523e 100644
--- a/Source/WebCore/rendering/svg/SVGTextQuery.cpp
+++ b/Source/WebCore/rendering/svg/SVGTextQuery.cpp
@@ -313,7 +313,7 @@ bool SVGTextQuery::subStringLengthCallback(Data* queryData, const SVGTextFragmen
     if (!mapStartEndPositionsIntoFragmentCoordinates(queryData, fragment, startPosition, endPosition))
         return false;
 
-    SVGTextMetrics metrics = SVGTextMetrics::measureCharacterRange(queryData->textRenderer, fragment.positionListOffset + startPosition, endPosition - startPosition);
+    SVGTextMetrics metrics = SVGTextMetrics::measureCharacterRange(queryData->textRenderer, fragment.characterOffset + startPosition, endPosition - startPosition);
     float fragmentLength = queryData->isVerticalText ? metrics.height() : metrics.width();
 
     data->subStringLength += mapLengthThroughFragmentTransformation(fragment, queryData->isVerticalText, fragmentLength);
@@ -353,7 +353,7 @@ bool SVGTextQuery::startPositionOfCharacterCallback(Data* queryData, const SVGTe
     data->startPosition = FloatPoint(fragment.x, fragment.y);
 
     if (startPosition) {
-        SVGTextMetrics metrics = SVGTextMetrics::measureCharacterRange(queryData->textRenderer, fragment.positionListOffset, startPosition);
+        SVGTextMetrics metrics = SVGTextMetrics::measureCharacterRange(queryData->textRenderer, fragment.characterOffset, startPosition);
         if (queryData->isVerticalText)
             data->startPosition.move(0, metrics.height());
         else
@@ -399,7 +399,7 @@ bool SVGTextQuery::endPositionOfCharacterCallback(Data* queryData, const SVGText
 
     data->endPosition = FloatPoint(fragment.x, fragment.y);
 
-    SVGTextMetrics metrics = SVGTextMetrics::measureCharacterRange(queryData->textRenderer, fragment.positionListOffset, startPosition + 1);
+    SVGTextMetrics metrics = SVGTextMetrics::measureCharacterRange(queryData->textRenderer, fragment.characterOffset, startPosition + 1);
     if (queryData->isVerticalText)
         data->endPosition.move(0, metrics.height());
     else
@@ -478,14 +478,14 @@ static inline void calculateGlyphBoundaries(SVGTextQuery::Data* queryData, const
     extent.setLocation(FloatPoint(fragment.x, fragment.y - queryData->textRenderer->scaledFont().fontMetrics().floatAscent() / scalingFactor));
 
     if (startPosition) {
-        SVGTextMetrics metrics = SVGTextMetrics::measureCharacterRange(queryData->textRenderer, fragment.positionListOffset, startPosition);
+        SVGTextMetrics metrics = SVGTextMetrics::measureCharacterRange(queryData->textRenderer, fragment.characterOffset, startPosition);
         if (queryData->isVerticalText)
             extent.move(0, metrics.height());
         else
             extent.move(metrics.width(), 0);
     }
 
-    SVGTextMetrics metrics = SVGTextMetrics::measureCharacterRange(queryData->textRenderer, fragment.positionListOffset + startPosition, 1);
+    SVGTextMetrics metrics = SVGTextMetrics::measureCharacterRange(queryData->textRenderer, fragment.characterOffset + startPosition, 1);
     extent.setSize(FloatSize(metrics.width(), metrics.height()));
 
     if (fragment.transform.isIdentity())
diff --git a/Source/WebCore/storage/AbstractDatabase.h b/Source/WebCore/storage/AbstractDatabase.h
index bd5d0db..9279adc 100644
--- a/Source/WebCore/storage/AbstractDatabase.h
+++ b/Source/WebCore/storage/AbstractDatabase.h
@@ -35,7 +35,7 @@
 #include "PlatformString.h"
 #include "SQLiteDatabase.h"
 #include <wtf/Forward.h>
-#include <wtf/ThreadSafeShared.h>
+#include <wtf/ThreadSafeRefCounted.h>
 #ifndef NDEBUG
 #include "SecurityOrigin.h"
 #endif
@@ -46,7 +46,7 @@ class DatabaseAuthorizer;
 class ScriptExecutionContext;
 class SecurityOrigin;
 
-class AbstractDatabase : public ThreadSafeShared<AbstractDatabase> {
+class AbstractDatabase : public ThreadSafeRefCounted<AbstractDatabase> {
 public:
     static bool isAvailable();
     static void setIsAvailable(bool available);
diff --git a/Source/WebCore/storage/DatabaseAuthorizer.h b/Source/WebCore/storage/DatabaseAuthorizer.h
index da7761d..939b409 100644
--- a/Source/WebCore/storage/DatabaseAuthorizer.h
+++ b/Source/WebCore/storage/DatabaseAuthorizer.h
@@ -31,7 +31,7 @@
 #include "PlatformString.h"
 #include <wtf/Forward.h>
 #include <wtf/HashSet.h>
-#include <wtf/ThreadSafeShared.h>
+#include <wtf/ThreadSafeRefCounted.h>
 #include <wtf/text/StringHash.h>
 
 namespace WebCore {
@@ -40,7 +40,7 @@ extern const int SQLAuthAllow;
 extern const int SQLAuthIgnore;
 extern const int SQLAuthDeny;
 
-class DatabaseAuthorizer : public ThreadSafeShared<DatabaseAuthorizer> {
+class DatabaseAuthorizer : public ThreadSafeRefCounted<DatabaseAuthorizer> {
 public:
 
     enum Permissions {
diff --git a/Source/WebCore/storage/DatabaseCallback.h b/Source/WebCore/storage/DatabaseCallback.h
index 8ad56ed..586416a 100644
--- a/Source/WebCore/storage/DatabaseCallback.h
+++ b/Source/WebCore/storage/DatabaseCallback.h
@@ -33,14 +33,14 @@
 
 #if ENABLE(DATABASE)
 
-#include <wtf/ThreadSafeShared.h>
+#include <wtf/ThreadSafeRefCounted.h>
 
 namespace WebCore {
 
 class Database;
 class DatabaseSync;
 
-class DatabaseCallback : public ThreadSafeShared<DatabaseCallback> {
+class DatabaseCallback : public ThreadSafeRefCounted<DatabaseCallback> {
 public:
     virtual ~DatabaseCallback() { }
     virtual bool handleEvent(Database*) = 0;
diff --git a/Source/WebCore/storage/DatabaseThread.h b/Source/WebCore/storage/DatabaseThread.h
index c81e376..ee1702c 100644
--- a/Source/WebCore/storage/DatabaseThread.h
+++ b/Source/WebCore/storage/DatabaseThread.h
@@ -48,7 +48,7 @@ class Document;
 class SQLTransactionClient;
 class SQLTransactionCoordinator;
 
-class DatabaseThread : public ThreadSafeShared<DatabaseThread> {
+class DatabaseThread : public ThreadSafeRefCounted<DatabaseThread> {
 public:
     static PassRefPtr<DatabaseThread> create() { return adoptRef(new DatabaseThread); }
     ~DatabaseThread();
diff --git a/Source/WebCore/storage/IDBBackingStore.h b/Source/WebCore/storage/IDBBackingStore.h
index e75fee1..29523a2 100644
--- a/Source/WebCore/storage/IDBBackingStore.h
+++ b/Source/WebCore/storage/IDBBackingStore.h
@@ -44,37 +44,36 @@ class SecurityOrigin;
 
 class IDBBackingStore : public RefCounted<IDBBackingStore> {
 public:
-    static PassRefPtr<IDBBackingStore> open(SecurityOrigin*, const String& pathBase, int64_t maximumSize, const String& fileIdentifier, IDBFactoryBackendImpl*);
-    ~IDBBackingStore();
-
-    bool extractIDBDatabaseMetaData(const String& name, String& foundVersion, int64_t& foundId);
-    bool setIDBDatabaseMetaData(const String& name, const String& version, int64_t& rowId, bool invalidRowId);
-
-    void getObjectStores(int64_t databaseId, Vector<int64_t>& foundIds, Vector<String>& foundNames, Vector<String>& foundKeyPaths, Vector<bool>& foundAutoIncrementFlags);
-    bool createObjectStore(const String& name, const String& keyPath, bool autoIncrement, int64_t databaseId, int64_t& assignedObjectStoreId);
-    void deleteObjectStore(int64_t objectStoreId);
-    String getObjectStoreRecord(int64_t objectStoreId, const IDBKey&);
-    bool putObjectStoreRecord(int64_t objectStoreId, const IDBKey&, const String& value, int64_t& rowId, bool invalidRowId);
-    void clearObjectStore(int64_t objectStoreId);
-    void deleteObjectStoreRecord(int64_t objectStoreId, int64_t objectStoreDataId);
-    double nextAutoIncrementNumber(int64_t objectStoreId);
-    bool keyExistsInObjectStore(int64_t objectStoreId, const IDBKey&, int64_t& foundObjectStoreDataId);
+    virtual ~IDBBackingStore() {};
+
+    virtual bool extractIDBDatabaseMetaData(const String& name, String& foundVersion, int64_t& foundId) = 0;
+    virtual bool setIDBDatabaseMetaData(const String& name, const String& version, int64_t& rowId, bool invalidRowId) = 0;
+
+    virtual void getObjectStores(int64_t databaseId, Vector<int64_t>& foundIds, Vector<String>& foundNames, Vector<String>& foundKeyPaths, Vector<bool>& foundAutoIncrementFlags) = 0;
+    virtual bool createObjectStore(const String& name, const String& keyPath, bool autoIncrement, int64_t databaseId, int64_t& assignedObjectStoreId) = 0;
+    virtual void deleteObjectStore(int64_t objectStoreId) = 0;
+    virtual String getObjectStoreRecord(int64_t objectStoreId, const IDBKey&) = 0;
+    virtual bool putObjectStoreRecord(int64_t objectStoreId, const IDBKey&, const String& value, int64_t& rowId, bool invalidRowId) = 0;
+    virtual void clearObjectStore(int64_t objectStoreId) = 0;
+    virtual void deleteObjectStoreRecord(int64_t objectStoreId, int64_t objectStoreDataId) = 0;
+    virtual double nextAutoIncrementNumber(int64_t objectStoreId) = 0;
+    virtual bool keyExistsInObjectStore(int64_t objectStoreId, const IDBKey&, int64_t& foundObjectStoreDataId) = 0;
 
     class ObjectStoreRecordCallback {
     public:
          virtual bool callback(int64_t objectStoreDataId, const String& value) = 0;
          virtual ~ObjectStoreRecordCallback() {};
     };
-    bool forEachObjectStoreRecord(int64_t objectStoreId, ObjectStoreRecordCallback&);
+    virtual bool forEachObjectStoreRecord(int64_t objectStoreId, ObjectStoreRecordCallback&) = 0;
 
-    void getIndexes(int64_t objectStoreId, Vector<int64_t>& foundIds, Vector<String>& foundNames, Vector<String>& foundKeyPaths, Vector<bool>& foundUniqueFlags);
-    bool createIndex(int64_t objectStoreId, const String& name, const String& keyPath, bool isUnique, int64_t& indexId);
-    void deleteIndex(int64_t indexId);
-    bool putIndexDataForRecord(int64_t indexId, const IDBKey&, int64_t objectStoreDataId);
-    bool deleteIndexDataForRecord(int64_t objectStoreDataId);
-    String getObjectViaIndex(int64_t indexId, const IDBKey&);
-    PassRefPtr<IDBKey> getPrimaryKeyViaIndex(int64_t indexId, const IDBKey&);
-    bool keyExistsInIndex(int64_t indexId, const IDBKey&);
+    virtual void getIndexes(int64_t objectStoreId, Vector<int64_t>& foundIds, Vector<String>& foundNames, Vector<String>& foundKeyPaths, Vector<bool>& foundUniqueFlags) = 0;
+    virtual bool createIndex(int64_t objectStoreId, const String& name, const String& keyPath, bool isUnique, int64_t& indexId) = 0;
+    virtual void deleteIndex(int64_t indexId) = 0;
+    virtual bool putIndexDataForRecord(int64_t indexId, const IDBKey&, int64_t objectStoreDataId) = 0;
+    virtual bool deleteIndexDataForRecord(int64_t objectStoreDataId) = 0;
+    virtual String getObjectViaIndex(int64_t indexId, const IDBKey&) = 0;
+    virtual PassRefPtr<IDBKey> getPrimaryKeyViaIndex(int64_t indexId, const IDBKey&) = 0;
+    virtual bool keyExistsInIndex(int64_t indexId, const IDBKey&) = 0;
 
     class Cursor : public RefCounted<Cursor> {
     public:
@@ -87,9 +86,9 @@ public:
         virtual ~Cursor() {};
     };
 
-    PassRefPtr<Cursor> openObjectStoreCursor(int64_t objectStoreId, const IDBKeyRange*, IDBCursor::Direction);
-    PassRefPtr<Cursor> openIndexKeyCursor(int64_t indexId, const IDBKeyRange*, IDBCursor::Direction);
-    PassRefPtr<Cursor> openIndexCursor(int64_t indexId, const IDBKeyRange*, IDBCursor::Direction);
+    virtual PassRefPtr<Cursor> openObjectStoreCursor(int64_t objectStoreId, const IDBKeyRange*, IDBCursor::Direction) = 0;
+    virtual PassRefPtr<Cursor> openIndexKeyCursor(int64_t indexId, const IDBKeyRange*, IDBCursor::Direction) = 0;
+    virtual PassRefPtr<Cursor> openIndexCursor(int64_t indexId, const IDBKeyRange*, IDBCursor::Direction) = 0;
 
     class Transaction : public RefCounted<Transaction> {
     public:
@@ -97,14 +96,7 @@ public:
         virtual void commit() = 0;
         virtual void rollback() = 0;
     };
-    PassRefPtr<Transaction> createTransaction();
-
-private:
-    IDBBackingStore(String identifier, IDBFactoryBackendImpl* factory);
-
-    SQLiteDatabase m_db;
-    String m_identifier;
-    RefPtr<IDBFactoryBackendImpl> m_factory;
+    virtual PassRefPtr<Transaction> createTransaction() = 0;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/storage/IDBCallbacks.h b/Source/WebCore/storage/IDBCallbacks.h
index f4e1b98..ddc6e60 100644
--- a/Source/WebCore/storage/IDBCallbacks.h
+++ b/Source/WebCore/storage/IDBCallbacks.h
@@ -32,7 +32,6 @@
 #include "IDBCursorBackendInterface.h"
 #include "IDBDatabaseBackendInterface.h"
 #include "IDBDatabaseError.h"
-#include "IDBIndexBackendInterface.h"
 #include "IDBKey.h"
 #include "IDBObjectStoreBackendInterface.h"
 #include "IDBTransactionBackendInterface.h"
@@ -44,14 +43,13 @@
 namespace WebCore {
 
 // FIXME: All child classes need to be made threadsafe.
-class IDBCallbacks : public ThreadSafeShared<IDBCallbacks> {
+class IDBCallbacks : public ThreadSafeRefCounted<IDBCallbacks> {
 public:
     virtual ~IDBCallbacks() { }
 
     virtual void onError(PassRefPtr<IDBDatabaseError>) = 0;
     virtual void onSuccess(PassRefPtr<IDBCursorBackendInterface>) = 0;
     virtual void onSuccess(PassRefPtr<IDBDatabaseBackendInterface>) = 0;
-    virtual void onSuccess(PassRefPtr<IDBIndexBackendInterface>) = 0;
     virtual void onSuccess(PassRefPtr<IDBKey>) = 0;
     virtual void onSuccess(PassRefPtr<IDBTransactionBackendInterface>) = 0;
     virtual void onSuccess(PassRefPtr<SerializedScriptValue>) = 0;
diff --git a/Source/WebCore/storage/IDBCursorBackendInterface.h b/Source/WebCore/storage/IDBCursorBackendInterface.h
index 6cdab42..21425c9 100644
--- a/Source/WebCore/storage/IDBCursorBackendInterface.h
+++ b/Source/WebCore/storage/IDBCursorBackendInterface.h
@@ -41,7 +41,7 @@ class IDBKey;
 class IDBRequest;
 class SerializedScriptValue;
 
-class IDBCursorBackendInterface : public ThreadSafeShared<IDBCursorBackendInterface> {
+class IDBCursorBackendInterface : public ThreadSafeRefCounted<IDBCursorBackendInterface> {
 public:
     virtual ~IDBCursorBackendInterface() {}
 
diff --git a/Source/WebCore/storage/IDBDatabase.cpp b/Source/WebCore/storage/IDBDatabase.cpp
index fe8d350..d54b969 100644
--- a/Source/WebCore/storage/IDBDatabase.cpp
+++ b/Source/WebCore/storage/IDBDatabase.cpp
@@ -29,6 +29,7 @@
 #include "Document.h"
 #include "EventQueue.h"
 #include "IDBAny.h"
+#include "IDBDatabaseCallbacksImpl.h"
 #include "IDBDatabaseError.h"
 #include "IDBDatabaseException.h"
 #include "IDBEventDispatcher.h"
@@ -58,10 +59,12 @@ IDBDatabase::IDBDatabase(ScriptExecutionContext* context, PassRefPtr<IDBDatabase
 {
     // We pass a reference of this object before it can be adopted.
     relaxAdoptionRequirement();
+    m_databaseCallbacks = IDBDatabaseCallbacksImpl::create(this);
 }
 
 IDBDatabase::~IDBDatabase()
 {
+    m_databaseCallbacks->unregisterDatabase(this);
 }
 
 void IDBDatabase::setSetVersionTransaction(IDBTransaction* transaction)
@@ -103,7 +106,7 @@ void IDBDatabase::deleteObjectStore(const String& name, ExceptionCode& ec)
 PassRefPtr<IDBVersionChangeRequest> IDBDatabase::setVersion(ScriptExecutionContext* context, const String& version, ExceptionCode& ec)
 {
     RefPtr<IDBVersionChangeRequest> request = IDBVersionChangeRequest::create(context, IDBAny::create(this), version);
-    m_backend->setVersion(version, request, this, ec);
+    m_backend->setVersion(version, request, m_databaseCallbacks, ec);
     return request;
 }
 
@@ -154,7 +157,7 @@ void IDBDatabase::close()
     }
 
     m_noNewTransactions = true;
-    m_backend->close(this);
+    m_backend->close(m_databaseCallbacks);
 }
 
 void IDBDatabase::onVersionChange(const String& version)
@@ -174,7 +177,7 @@ bool IDBDatabase::hasPendingActivity() const
 
 void IDBDatabase::open()
 {
-    m_backend->open(this);
+    m_backend->open(m_databaseCallbacks);
 }
 
 void IDBDatabase::enqueueEvent(PassRefPtr<Event> event)
diff --git a/Source/WebCore/storage/IDBDatabase.h b/Source/WebCore/storage/IDBDatabase.h
index 51f1d23..9d4883e 100644
--- a/Source/WebCore/storage/IDBDatabase.h
+++ b/Source/WebCore/storage/IDBDatabase.h
@@ -32,7 +32,7 @@
 #include "EventTarget.h"
 #include "ExceptionCode.h"
 #include "IDBDatabaseBackendInterface.h"
-#include "IDBDatabaseCallbacks.h"
+#include "IDBDatabaseCallbacksImpl.h"
 #include "IDBObjectStore.h"
 #include "IDBTransaction.h"
 #include "OptionsObject.h"
@@ -47,7 +47,7 @@ namespace WebCore {
 class IDBVersionChangeRequest;
 class ScriptExecutionContext;
 
-class IDBDatabase : public IDBDatabaseCallbacks, public EventTarget, public ActiveDOMObject {
+class IDBDatabase : public RefCounted<IDBDatabase>, public EventTarget, public ActiveDOMObject {
 public:
     static PassRefPtr<IDBDatabase> create(ScriptExecutionContext*, PassRefPtr<IDBDatabaseBackendInterface>);
     ~IDBDatabase();
@@ -91,8 +91,8 @@ public:
     bool dispatchEvent(PassRefPtr<Event> event, ExceptionCode& ec) { return EventTarget::dispatchEvent(event, ec); }
     virtual bool dispatchEvent(PassRefPtr<Event>);
 
-    using RefCounted<IDBDatabaseCallbacks>::ref;
-    using RefCounted<IDBDatabaseCallbacks>::deref;
+    using RefCounted<IDBDatabase>::ref;
+    using RefCounted<IDBDatabase>::deref;
 
 private:
     IDBDatabase(ScriptExecutionContext*, PassRefPtr<IDBDatabaseBackendInterface>);
@@ -114,6 +114,8 @@ private:
     // Keep track of the versionchange events waiting to be fired on this
     // database so that we can cancel them if the database closes.
     Vector<RefPtr<Event> > m_enqueuedEvents;
+
+    RefPtr<IDBDatabaseCallbacksImpl> m_databaseCallbacks;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/storage/IDBDatabaseBackendInterface.h b/Source/WebCore/storage/IDBDatabaseBackendInterface.h
index ad6fdc7..2245bd7 100644
--- a/Source/WebCore/storage/IDBDatabaseBackendInterface.h
+++ b/Source/WebCore/storage/IDBDatabaseBackendInterface.h
@@ -46,7 +46,7 @@ class IDBTransactionBackendInterface;
 // This is implemented by IDBDatabaseBackendImpl and optionally others (in order to proxy
 // calls across process barriers). All calls to these classes should be non-blocking and
 // trigger work on a background thread if necessary.
-class IDBDatabaseBackendInterface : public ThreadSafeShared<IDBDatabaseBackendInterface> {
+class IDBDatabaseBackendInterface : public ThreadSafeRefCounted<IDBDatabaseBackendInterface> {
 public:
     virtual ~IDBDatabaseBackendInterface() { }
 
diff --git a/Source/WebCore/storage/IDBDatabaseCallbacksImpl.cpp b/Source/WebCore/storage/IDBDatabaseCallbacksImpl.cpp
new file mode 100644
index 0000000..39c4409
--- /dev/null
+++ b/Source/WebCore/storage/IDBDatabaseCallbacksImpl.cpp
@@ -0,0 +1,63 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "IDBDatabaseCallbacksImpl.h"
+
+#if ENABLE(INDEXED_DATABASE)
+
+#include "IDBDatabase.h"
+
+namespace WebCore {
+
+PassRefPtr<IDBDatabaseCallbacksImpl> IDBDatabaseCallbacksImpl::create(IDBDatabase* database)
+{
+    return adoptRef(new IDBDatabaseCallbacksImpl(database));
+}
+
+IDBDatabaseCallbacksImpl::IDBDatabaseCallbacksImpl(IDBDatabase* database)
+    : m_database(database)
+{
+}
+
+IDBDatabaseCallbacksImpl::~IDBDatabaseCallbacksImpl()
+{
+}
+
+void IDBDatabaseCallbacksImpl::onVersionChange(const String& version)
+{
+    if (m_database)
+        m_database->onVersionChange(version);
+}
+
+void IDBDatabaseCallbacksImpl::unregisterDatabase(IDBDatabase* database)
+{
+    ASSERT(database == m_database);
+    m_database = 0;
+}
+
+} // namespace WebCore
+
+#endif
diff --git a/Source/WebCore/storage/IDBDatabaseCallbacksImpl.h b/Source/WebCore/storage/IDBDatabaseCallbacksImpl.h
new file mode 100644
index 0000000..e8b1f99
--- /dev/null
+++ b/Source/WebCore/storage/IDBDatabaseCallbacksImpl.h
@@ -0,0 +1,58 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef IDBDatabaseCallbacksImpl_h
+#define IDBDatabaseCallbacksImpl_h
+
+#include "IDBDatabaseCallbacks.h"
+#include "PlatformString.h"
+#include <wtf/RefCounted.h>
+
+#if ENABLE(INDEXED_DATABASE)
+
+namespace WebCore {
+
+class IDBDatabase;
+
+class IDBDatabaseCallbacksImpl : public IDBDatabaseCallbacks {
+public:
+    static PassRefPtr<IDBDatabaseCallbacksImpl> create(IDBDatabase*);
+    virtual ~IDBDatabaseCallbacksImpl();
+
+    virtual void onVersionChange(const String& version);
+    void unregisterDatabase(IDBDatabase*);
+
+private:
+    IDBDatabaseCallbacksImpl(IDBDatabase*);
+
+    // m_database has a RefPtr to this, so use a weak pointer to avoid a cycle.
+    IDBDatabase* m_database;
+};
+
+} // namespace WebCore
+
+#endif
+
+#endif // IDBDatabaseCallbacksImpl_h
diff --git a/Source/WebCore/storage/IDBFactory.cpp b/Source/WebCore/storage/IDBFactory.cpp
index 85e976c..295398b 100644
--- a/Source/WebCore/storage/IDBFactory.cpp
+++ b/Source/WebCore/storage/IDBFactory.cpp
@@ -74,7 +74,7 @@ PassRefPtr<IDBRequest> IDBFactory::open(ScriptExecutionContext* context, const S
 
     RefPtr<IDBRequest> request = IDBRequest::create(document, IDBAny::create(this), 0);
     GroupSettings* groupSettings = document->page()->group().groupSettings();
-    m_factoryBackend->open(name, request, document->securityOrigin(), document->frame(), groupSettings->indexedDBDatabasePath(), groupSettings->indexedDBQuotaBytes());
+    m_factoryBackend->open(name, request, document->securityOrigin(), document->frame(), groupSettings->indexedDBDatabasePath(), groupSettings->indexedDBQuotaBytes(), IDBFactoryBackendInterface::DefaultBackingStore);
     return request;
 }
 
diff --git a/Source/WebCore/storage/IDBFactoryBackendImpl.cpp b/Source/WebCore/storage/IDBFactoryBackendImpl.cpp
index 9127455..461e930 100644
--- a/Source/WebCore/storage/IDBFactoryBackendImpl.cpp
+++ b/Source/WebCore/storage/IDBFactoryBackendImpl.cpp
@@ -30,9 +30,9 @@
 #include "IDBFactoryBackendImpl.h"
 
 #include "DOMStringList.h"
-#include "IDBBackingStore.h"
 #include "IDBDatabaseBackendImpl.h"
 #include "IDBDatabaseException.h"
+#include "IDBSQLiteBackingStore.h"
 #include "IDBTransactionCoordinator.h"
 #include "SecurityOrigin.h"
 #include <wtf/Threading.h>
@@ -69,7 +69,7 @@ void IDBFactoryBackendImpl::removeIDBBackingStore(const String& uniqueIdentifier
     m_backingStoreMap.remove(uniqueIdentifier);
 }
 
-void IDBFactoryBackendImpl::open(const String& name, PassRefPtr<IDBCallbacks> callbacks, PassRefPtr<SecurityOrigin> securityOrigin, Frame*, const String& dataDir, int64_t maximumSize)
+void IDBFactoryBackendImpl::open(const String& name, PassRefPtr<IDBCallbacks> callbacks, PassRefPtr<SecurityOrigin> securityOrigin, Frame*, const String& dataDir, int64_t maximumSize, BackingStoreType)
 {
     String fileIdentifier = securityOrigin->databaseIdentifier();
     String uniqueIdentifier = fileIdentifier + "@" + name;
@@ -86,7 +86,7 @@ void IDBFactoryBackendImpl::open(const String& name, PassRefPtr<IDBCallbacks> ca
     if (it2 != m_backingStoreMap.end())
         backingStore = it2->second;
     else {
-        backingStore = IDBBackingStore::open(securityOrigin.get(), dataDir, maximumSize, fileIdentifier, this);
+        backingStore = IDBSQLiteBackingStore::open(securityOrigin.get(), dataDir, maximumSize, fileIdentifier, this);
         if (!backingStore) {
             callbacks->onError(IDBDatabaseError::create(IDBDatabaseException::UNKNOWN_ERR, "Internal error."));
             return;
diff --git a/Source/WebCore/storage/IDBFactoryBackendImpl.h b/Source/WebCore/storage/IDBFactoryBackendImpl.h
index 071bcf8..ab6e153 100644
--- a/Source/WebCore/storage/IDBFactoryBackendImpl.h
+++ b/Source/WebCore/storage/IDBFactoryBackendImpl.h
@@ -55,7 +55,7 @@ public:
     void addIDBBackingStore(const String& uniqueIdentifier, IDBBackingStore*);
     void removeIDBBackingStore(const String& uniqueIdentifier);
 
-    virtual void open(const String& name, PassRefPtr<IDBCallbacks>, PassRefPtr<SecurityOrigin>, Frame*, const String& dataDir, int64_t maximumSize);
+    virtual void open(const String& name, PassRefPtr<IDBCallbacks>, PassRefPtr<SecurityOrigin>, Frame*, const String& dataDir, int64_t maximumSize, BackingStoreType);
 
 private:
     IDBFactoryBackendImpl();
diff --git a/Source/WebCore/storage/IDBFactoryBackendInterface.h b/Source/WebCore/storage/IDBFactoryBackendInterface.h
index e05f316..87362d4 100644
--- a/Source/WebCore/storage/IDBFactoryBackendInterface.h
+++ b/Source/WebCore/storage/IDBFactoryBackendInterface.h
@@ -46,12 +46,17 @@ class SecurityOrigin;
 // This is implemented by IDBFactoryBackendImpl and optionally others (in order to proxy
 // calls across process barriers). All calls to these classes should be non-blocking and
 // trigger work on a background thread if necessary.
-class IDBFactoryBackendInterface : public ThreadSafeShared<IDBFactoryBackendInterface> {
+class IDBFactoryBackendInterface : public ThreadSafeRefCounted<IDBFactoryBackendInterface> {
 public:
     static PassRefPtr<IDBFactoryBackendInterface> create();
     virtual ~IDBFactoryBackendInterface() { }
 
-    virtual void open(const String& name, PassRefPtr<IDBCallbacks>, PassRefPtr<SecurityOrigin>, Frame*, const String& dataDir, int64_t maximumSize) = 0;
+    enum BackingStoreType {
+        DefaultBackingStore,
+        LevelDBBackingStore
+    };
+
+    virtual void open(const String& name, PassRefPtr<IDBCallbacks>, PassRefPtr<SecurityOrigin>, Frame*, const String& dataDir, int64_t maximumSize, BackingStoreType) = 0;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/storage/IDBIndexBackendInterface.h b/Source/WebCore/storage/IDBIndexBackendInterface.h
index e0e578d..81ef1d5 100644
--- a/Source/WebCore/storage/IDBIndexBackendInterface.h
+++ b/Source/WebCore/storage/IDBIndexBackendInterface.h
@@ -39,7 +39,7 @@ class IDBKey;
 class IDBKeyRange;
 class IDBTransactionBackendInterface;
 
-class IDBIndexBackendInterface : public ThreadSafeShared<IDBIndexBackendInterface> {
+class IDBIndexBackendInterface : public ThreadSafeRefCounted<IDBIndexBackendInterface> {
 public:
     virtual ~IDBIndexBackendInterface() { }
 
diff --git a/Source/WebCore/storage/IDBKey.h b/Source/WebCore/storage/IDBKey.h
index 5816ce3..8ee9b8e 100644
--- a/Source/WebCore/storage/IDBKey.h
+++ b/Source/WebCore/storage/IDBKey.h
@@ -34,7 +34,7 @@
 
 namespace WebCore {
 
-class IDBKey : public ThreadSafeShared<IDBKey> {
+class IDBKey : public ThreadSafeRefCounted<IDBKey> {
 public:
     static PassRefPtr<IDBKey> createNull()
     {
@@ -100,8 +100,8 @@ public:
     bool isLessThan(const IDBKey* other) const;
     bool isEqual(const IDBKey* other) const;
 
-    using ThreadSafeShared<IDBKey>::ref;
-    using ThreadSafeShared<IDBKey>::deref;
+    using ThreadSafeRefCounted<IDBKey>::ref;
+    using ThreadSafeRefCounted<IDBKey>::deref;
 
 private:
     IDBKey();
diff --git a/Source/WebCore/storage/IDBKeyRange.h b/Source/WebCore/storage/IDBKeyRange.h
index 636a5c1..7a87088 100644
--- a/Source/WebCore/storage/IDBKeyRange.h
+++ b/Source/WebCore/storage/IDBKeyRange.h
@@ -35,7 +35,7 @@
 
 namespace WebCore {
 
-class IDBKeyRange : public ThreadSafeShared<IDBKeyRange> {
+class IDBKeyRange : public ThreadSafeRefCounted<IDBKeyRange> {
 public:
     static PassRefPtr<IDBKeyRange> create(PassRefPtr<IDBKey> lower, PassRefPtr<IDBKey> upper, bool lowerOpen, bool upperOpen)
     {
diff --git a/Source/WebCore/storage/IDBObjectStoreBackendInterface.h b/Source/WebCore/storage/IDBObjectStoreBackendInterface.h
index 177701c..2975ed7 100644
--- a/Source/WebCore/storage/IDBObjectStoreBackendInterface.h
+++ b/Source/WebCore/storage/IDBObjectStoreBackendInterface.h
@@ -42,7 +42,7 @@ class IDBKeyRange;
 class IDBTransactionBackendInterface;
 class SerializedScriptValue;
 
-class IDBObjectStoreBackendInterface : public ThreadSafeShared<IDBObjectStoreBackendInterface> {
+class IDBObjectStoreBackendInterface : public ThreadSafeRefCounted<IDBObjectStoreBackendInterface> {
 public:
     virtual ~IDBObjectStoreBackendInterface() { }
 
diff --git a/Source/WebCore/storage/IDBRequest.cpp b/Source/WebCore/storage/IDBRequest.cpp
index e1837fc..f8d818a 100644
--- a/Source/WebCore/storage/IDBRequest.cpp
+++ b/Source/WebCore/storage/IDBRequest.cpp
@@ -39,7 +39,6 @@
 #include "IDBCursorWithValue.h"
 #include "IDBDatabase.h"
 #include "IDBEventDispatcher.h"
-#include "IDBIndex.h"
 #include "IDBPendingTransactionMonitor.h"
 #include "IDBTransaction.h"
 
@@ -205,11 +204,6 @@ void IDBRequest::onSuccess(PassRefPtr<IDBDatabaseBackendInterface> backend)
     enqueueEvent(createSuccessEvent());
 }
 
-void IDBRequest::onSuccess(PassRefPtr<IDBIndexBackendInterface> backend)
-{
-    ASSERT_NOT_REACHED(); // FIXME: This method should go away.
-}
-
 void IDBRequest::onSuccess(PassRefPtr<IDBKey> idbKey)
 {
     ASSERT(!m_errorCode && m_errorMessage.isNull() && !m_result);
diff --git a/Source/WebCore/storage/IDBRequest.h b/Source/WebCore/storage/IDBRequest.h
index b6b4e5b..900df01 100644
--- a/Source/WebCore/storage/IDBRequest.h
+++ b/Source/WebCore/storage/IDBRequest.h
@@ -76,7 +76,6 @@ public:
     virtual void onError(PassRefPtr<IDBDatabaseError>);
     virtual void onSuccess(PassRefPtr<IDBDatabaseBackendInterface>);
     virtual void onSuccess(PassRefPtr<IDBCursorBackendInterface>);
-    virtual void onSuccess(PassRefPtr<IDBIndexBackendInterface>);
     virtual void onSuccess(PassRefPtr<IDBKey>);
     virtual void onSuccess(PassRefPtr<IDBTransactionBackendInterface>);
     virtual void onSuccess(PassRefPtr<SerializedScriptValue>);
@@ -92,8 +91,8 @@ public:
     bool dispatchEvent(PassRefPtr<Event> event, ExceptionCode& ec) { return EventTarget::dispatchEvent(event, ec); }
     virtual void uncaughtExceptionInEventHandler();
 
-    using ThreadSafeShared<IDBCallbacks>::ref;
-    using ThreadSafeShared<IDBCallbacks>::deref;
+    using ThreadSafeRefCounted<IDBCallbacks>::ref;
+    using ThreadSafeRefCounted<IDBCallbacks>::deref;
 
 protected:
     IDBRequest(ScriptExecutionContext*, PassRefPtr<IDBAny> source, IDBTransaction*);
diff --git a/Source/WebCore/storage/IDBBackingStore.cpp b/Source/WebCore/storage/IDBSQLiteBackingStore.cpp
index 3859c4c..e43b7a3 100644
--- a/Source/WebCore/storage/IDBBackingStore.cpp
+++ b/Source/WebCore/storage/IDBSQLiteBackingStore.cpp
@@ -24,7 +24,7 @@
  */
 
 #include "config.h"
-#include "IDBBackingStore.h"
+#include "IDBSQLiteBackingStore.h"
 
 #if ENABLE(INDEXED_DATABASE)
 
@@ -39,14 +39,14 @@
 
 namespace WebCore {
 
-IDBBackingStore::IDBBackingStore(String identifier, IDBFactoryBackendImpl* factory)
+IDBSQLiteBackingStore::IDBSQLiteBackingStore(String identifier, IDBFactoryBackendImpl* factory)
     : m_identifier(identifier)
     , m_factory(factory)
 {
     m_factory->addIDBBackingStore(identifier, this);
 }
 
-IDBBackingStore::~IDBBackingStore()
+IDBSQLiteBackingStore::~IDBSQLiteBackingStore()
 {
     m_factory->removeIDBBackingStore(m_identifier);
 }
@@ -165,9 +165,9 @@ static bool migrateDatabase(SQLiteDatabase& sqliteDatabase)
     return true;
 }
 
-PassRefPtr<IDBBackingStore> IDBBackingStore::open(SecurityOrigin* securityOrigin, const String& pathBase, int64_t maximumSize, const String& fileIdentifier, IDBFactoryBackendImpl* factory)
+PassRefPtr<IDBBackingStore> IDBSQLiteBackingStore::open(SecurityOrigin* securityOrigin, const String& pathBase, int64_t maximumSize, const String& fileIdentifier, IDBFactoryBackendImpl* factory)
 {
-    RefPtr<IDBBackingStore> backingStore(adoptRef(new IDBBackingStore(fileIdentifier, factory)));
+    RefPtr<IDBSQLiteBackingStore> backingStore(adoptRef(new IDBSQLiteBackingStore(fileIdentifier, factory)));
 
     String path = ":memory:";
     if (!pathBase.isEmpty()) {
@@ -197,7 +197,7 @@ PassRefPtr<IDBBackingStore> IDBBackingStore::open(SecurityOrigin* securityOrigin
     return backingStore.release();
 }
 
-bool IDBBackingStore::extractIDBDatabaseMetaData(const String& name, String& foundVersion, int64_t& foundId)
+bool IDBSQLiteBackingStore::extractIDBDatabaseMetaData(const String& name, String& foundVersion, int64_t& foundId)
 {
     SQLiteStatement databaseQuery(m_db, "SELECT id, version FROM Databases WHERE name = ?");
     if (databaseQuery.prepare() != SQLResultOk) {
@@ -216,7 +216,7 @@ bool IDBBackingStore::extractIDBDatabaseMetaData(const String& name, String& fou
     return true;
 }
 
-bool IDBBackingStore::setIDBDatabaseMetaData(const String& name, const String& version, int64_t& rowId, bool invalidRowId)
+bool IDBSQLiteBackingStore::setIDBDatabaseMetaData(const String& name, const String& version, int64_t& rowId, bool invalidRowId)
 {
     ASSERT(!name.isNull());
     ASSERT(!version.isNull());
@@ -242,7 +242,7 @@ bool IDBBackingStore::setIDBDatabaseMetaData(const String& name, const String& v
     return true;
 }
 
-void IDBBackingStore::getObjectStores(int64_t databaseId, Vector<int64_t>& foundIds, Vector<String>& foundNames, Vector<String>& foundKeyPaths, Vector<bool>& foundAutoIncrementFlags)
+void IDBSQLiteBackingStore::getObjectStores(int64_t databaseId, Vector<int64_t>& foundIds, Vector<String>& foundNames, Vector<String>& foundKeyPaths, Vector<bool>& foundAutoIncrementFlags)
 {
     SQLiteStatement query(m_db, "SELECT id, name, keyPath, doAutoIncrement FROM ObjectStores WHERE databaseId = ?");
     bool ok = query.prepare() == SQLResultOk;
@@ -263,7 +263,7 @@ void IDBBackingStore::getObjectStores(int64_t databaseId, Vector<int64_t>& found
     }
 }
 
-bool IDBBackingStore::createObjectStore(const String& name, const String& keyPath, bool autoIncrement, int64_t databaseId, int64_t& assignedObjectStoreId)
+bool IDBSQLiteBackingStore::createObjectStore(const String& name, const String& keyPath, bool autoIncrement, int64_t databaseId, int64_t& assignedObjectStoreId)
 {
     SQLiteStatement query(m_db, "INSERT INTO ObjectStores (name, keyPath, doAutoIncrement, databaseId) VALUES (?, ?, ?, ?)");
     if (query.prepare() != SQLResultOk)
@@ -291,7 +291,7 @@ static void doDelete(SQLiteDatabase& db, const char* sql, int64_t id)
     ASSERT_UNUSED(ok, ok); // FIXME: Better error handling.
 }
 
-void IDBBackingStore::deleteObjectStore(int64_t objectStoreId)
+void IDBSQLiteBackingStore::deleteObjectStore(int64_t objectStoreId)
 {
     doDelete(m_db, "DELETE FROM ObjectStores WHERE id = ?", objectStoreId);
     doDelete(m_db, "DELETE FROM ObjectStoreData WHERE objectStoreId = ?", objectStoreId);
@@ -373,7 +373,7 @@ static String upperCursorWhereFragment(const IDBKey& key, String comparisonOpera
     return "";
 }
 
-String IDBBackingStore::getObjectStoreRecord(int64_t objectStoreId, const IDBKey& key)
+String IDBSQLiteBackingStore::getObjectStoreRecord(int64_t objectStoreId, const IDBKey& key)
 {
     SQLiteStatement query(m_db, "SELECT keyString, keyDate, keyNumber, value FROM ObjectStoreData WHERE objectStoreId = ? AND " + whereSyntaxForKey(key));
     bool ok = query.prepare() == SQLResultOk;
@@ -422,7 +422,7 @@ static void bindKeyToQueryWithNulls(SQLiteStatement& query, int baseColumn, cons
     }
 }
 
-bool IDBBackingStore::putObjectStoreRecord(int64_t objectStoreId, const IDBKey& key, const String& value, int64_t& rowId, bool invalidRowId)
+bool IDBSQLiteBackingStore::putObjectStoreRecord(int64_t objectStoreId, const IDBKey& key, const String& value, int64_t& rowId, bool invalidRowId)
 {
     String sql = !invalidRowId ? "UPDATE ObjectStoreData SET keyString = ?, keyDate = ?, keyNumber = ?, value = ? WHERE id = ?"
                                : "INSERT INTO ObjectStoreData (keyString, keyDate, keyNumber, value, objectStoreId) VALUES (?, ?, ?, ?, ?)";
@@ -446,13 +446,13 @@ bool IDBBackingStore::putObjectStoreRecord(int64_t objectStoreId, const IDBKey&
     return true;
 }
 
-void IDBBackingStore::clearObjectStore(int64_t objectStoreId)
+void IDBSQLiteBackingStore::clearObjectStore(int64_t objectStoreId)
 {
     doDelete(m_db, "DELETE FROM IndexData WHERE objectStoreDataId IN (SELECT id FROM ObjectStoreData WHERE objectStoreId = ?)", objectStoreId);
     doDelete(m_db, "DELETE FROM ObjectStoreData WHERE objectStoreId = ?", objectStoreId);
 }
 
-void IDBBackingStore::deleteObjectStoreRecord(int64_t, int64_t objectStoreDataId)
+void IDBSQLiteBackingStore::deleteObjectStoreRecord(int64_t, int64_t objectStoreDataId)
 {
     SQLiteStatement osQuery(m_db, "DELETE FROM ObjectStoreData WHERE id = ?");
     bool ok = osQuery.prepare() == SQLResultOk;
@@ -473,7 +473,7 @@ void IDBBackingStore::deleteObjectStoreRecord(int64_t, int64_t objectStoreDataId
     ASSERT_UNUSED(ok, ok);
 }
 
-double IDBBackingStore::nextAutoIncrementNumber(int64_t objectStoreId)
+double IDBSQLiteBackingStore::nextAutoIncrementNumber(int64_t objectStoreId)
 {
     SQLiteStatement query(m_db, "SELECT max(keyNumber) + 1 FROM ObjectStoreData WHERE objectStoreId = ? AND keyString IS NULL AND keyDate IS NULL");
     bool ok = query.prepare() == SQLResultOk;
@@ -487,7 +487,7 @@ double IDBBackingStore::nextAutoIncrementNumber(int64_t objectStoreId)
     return query.getColumnDouble(0);
 }
 
-bool IDBBackingStore::keyExistsInObjectStore(int64_t objectStoreId, const IDBKey& key, int64_t& foundObjectStoreDataId)
+bool IDBSQLiteBackingStore::keyExistsInObjectStore(int64_t objectStoreId, const IDBKey& key, int64_t& foundObjectStoreDataId)
 {
     String sql = String("SELECT id FROM ObjectStoreData WHERE objectStoreId = ? AND ") + whereSyntaxForKey(key);
     SQLiteStatement query(m_db, sql);
@@ -504,7 +504,7 @@ bool IDBBackingStore::keyExistsInObjectStore(int64_t objectStoreId, const IDBKey
     return true;
 }
 
-bool IDBBackingStore::forEachObjectStoreRecord(int64_t objectStoreId, ObjectStoreRecordCallback& callback)
+bool IDBSQLiteBackingStore::forEachObjectStoreRecord(int64_t objectStoreId, ObjectStoreRecordCallback& callback)
 {
     SQLiteStatement query(m_db, "SELECT id, value FROM ObjectStoreData WHERE objectStoreId = ?");
     if (query.prepare() != SQLResultOk)
@@ -522,7 +522,7 @@ bool IDBBackingStore::forEachObjectStoreRecord(int64_t objectStoreId, ObjectStor
     return true;
 }
 
-void IDBBackingStore::getIndexes(int64_t objectStoreId, Vector<int64_t>& foundIds, Vector<String>& foundNames, Vector<String>& foundKeyPaths, Vector<bool>& foundUniqueFlags)
+void IDBSQLiteBackingStore::getIndexes(int64_t objectStoreId, Vector<int64_t>& foundIds, Vector<String>& foundNames, Vector<String>& foundKeyPaths, Vector<bool>& foundUniqueFlags)
 {
     SQLiteStatement query(m_db, "SELECT id, name, keyPath, isUnique FROM Indexes WHERE objectStoreId = ?");
     bool ok = query.prepare() == SQLResultOk;
@@ -543,7 +543,7 @@ void IDBBackingStore::getIndexes(int64_t objectStoreId, Vector<int64_t>& foundId
     }
 }
 
-bool IDBBackingStore::createIndex(int64_t objectStoreId, const String& name, const String& keyPath, bool isUnique, int64_t& indexId)
+bool IDBSQLiteBackingStore::createIndex(int64_t objectStoreId, const String& name, const String& keyPath, bool isUnique, int64_t& indexId)
 {
     SQLiteStatement query(m_db, "INSERT INTO Indexes (objectStoreId, name, keyPath, isUnique) VALUES (?, ?, ?, ?)");
     if (query.prepare() != SQLResultOk)
@@ -561,13 +561,13 @@ bool IDBBackingStore::createIndex(int64_t objectStoreId, const String& name, con
     return true;
 }
 
-void IDBBackingStore::deleteIndex(int64_t indexId)
+void IDBSQLiteBackingStore::deleteIndex(int64_t indexId)
 {
     doDelete(m_db, "DELETE FROM Indexes WHERE id = ?", indexId);
     doDelete(m_db, "DELETE FROM IndexData WHERE indexId = ?", indexId);
 }
 
-bool IDBBackingStore::putIndexDataForRecord(int64_t indexId, const IDBKey& key, int64_t objectStoreDataId)
+bool IDBSQLiteBackingStore::putIndexDataForRecord(int64_t indexId, const IDBKey& key, int64_t objectStoreDataId)
 {
     SQLiteStatement query(m_db, "INSERT INTO IndexData (keyString, keyDate, keyNumber, indexId, objectStoreDataId) VALUES (?, ?, ?, ?, ?)");
     if (query.prepare() != SQLResultOk)
@@ -580,7 +580,7 @@ bool IDBBackingStore::putIndexDataForRecord(int64_t indexId, const IDBKey& key,
     return query.step() == SQLResultDone;
 }
 
-bool IDBBackingStore::deleteIndexDataForRecord(int64_t objectStoreDataId)
+bool IDBSQLiteBackingStore::deleteIndexDataForRecord(int64_t objectStoreDataId)
 {
     SQLiteStatement query(m_db, "DELETE FROM IndexData WHERE objectStoreDataId = ?");
     if (query.prepare() != SQLResultOk)
@@ -590,7 +590,7 @@ bool IDBBackingStore::deleteIndexDataForRecord(int64_t objectStoreDataId)
     return query.step() == SQLResultDone;
 }
 
-String IDBBackingStore::getObjectViaIndex(int64_t indexId, const IDBKey& key)
+String IDBSQLiteBackingStore::getObjectViaIndex(int64_t indexId, const IDBKey& key)
 {
     String sql = String("SELECT ")
                  + "ObjectStoreData.value "
@@ -629,7 +629,7 @@ static PassRefPtr<IDBKey> keyFromQuery(SQLiteStatement& query, int baseColumn)
     return IDBKey::createNull();
 }
 
-PassRefPtr<IDBKey> IDBBackingStore::getPrimaryKeyViaIndex(int64_t indexId, const IDBKey& key)
+PassRefPtr<IDBKey> IDBSQLiteBackingStore::getPrimaryKeyViaIndex(int64_t indexId, const IDBKey& key)
 {
     String sql = String("SELECT ")
                  + "ObjectStoreData.keyString, ObjectStoreData.keyDate, ObjectStoreData.keyNumber "
@@ -651,7 +651,7 @@ PassRefPtr<IDBKey> IDBBackingStore::getPrimaryKeyViaIndex(int64_t indexId, const
     return foundKey.release();
 }
 
-bool IDBBackingStore::keyExistsInIndex(int64_t indexId, const IDBKey& key)
+bool IDBSQLiteBackingStore::keyExistsInIndex(int64_t indexId, const IDBKey& key)
 {
     String sql = String("SELECT id FROM IndexData WHERE indexId = ? AND ") + whereSyntaxForKey(key);
     SQLiteStatement query(m_db, sql);
@@ -666,7 +666,7 @@ bool IDBBackingStore::keyExistsInIndex(int64_t indexId, const IDBKey& key)
 
 namespace {
 
-class CursorImplCommon : public IDBBackingStore::Cursor {
+class CursorImplCommon : public IDBSQLiteBackingStore::Cursor {
 public:
     CursorImplCommon(SQLiteDatabase& sqliteDatabase, String query, bool uniquenessConstraint, bool iterateForward)
         : m_query(sqliteDatabase, query)
@@ -849,7 +849,7 @@ bool IndexCursorImpl::currentRowExists()
 
 } // namespace
 
-PassRefPtr<IDBBackingStore::Cursor> IDBBackingStore::openObjectStoreCursor(int64_t objectStoreId, const IDBKeyRange* range, IDBCursor::Direction direction)
+PassRefPtr<IDBBackingStore::Cursor> IDBSQLiteBackingStore::openObjectStoreCursor(int64_t objectStoreId, const IDBKeyRange* range, IDBCursor::Direction direction)
 {
     bool lowerBound = range && range->lower();
     bool upperBound = range && range->upper();
@@ -886,7 +886,7 @@ PassRefPtr<IDBBackingStore::Cursor> IDBBackingStore::openObjectStoreCursor(int64
     return cursor.release();
 }
 
-PassRefPtr<IDBBackingStore::Cursor> IDBBackingStore::openIndexKeyCursor(int64_t indexId, const IDBKeyRange* range, IDBCursor::Direction direction)
+PassRefPtr<IDBBackingStore::Cursor> IDBSQLiteBackingStore::openIndexKeyCursor(int64_t indexId, const IDBKeyRange* range, IDBCursor::Direction direction)
 {
     String sql = String("SELECT IndexData.id, IndexData.keyString, IndexData.keyDate, IndexData.keyNumber, ")
                  + ("ObjectStoreData.keyString, ObjectStoreData.keyDate, ObjectStoreData.keyNumber ")
@@ -926,7 +926,7 @@ PassRefPtr<IDBBackingStore::Cursor> IDBBackingStore::openIndexKeyCursor(int64_t
     return cursor.release();
 }
 
-PassRefPtr<IDBBackingStore::Cursor> IDBBackingStore::openIndexCursor(int64_t indexId, const IDBKeyRange* range, IDBCursor::Direction direction)
+PassRefPtr<IDBBackingStore::Cursor> IDBSQLiteBackingStore::openIndexCursor(int64_t indexId, const IDBKeyRange* range, IDBCursor::Direction direction)
 {
     String sql = String("SELECT IndexData.id, IndexData.keyString, IndexData.keyDate, IndexData.keyNumber, ")
                  + ("ObjectStoreData.value, ObjectStoreData.keyString, ObjectStoreData.keyDate, ObjectStoreData.keyNumber ")
@@ -986,7 +986,7 @@ private:
 
 } // namespace
 
-PassRefPtr<IDBBackingStore::Transaction> IDBBackingStore::createTransaction()
+PassRefPtr<IDBBackingStore::Transaction> IDBSQLiteBackingStore::createTransaction()
 {
     return adoptRef(new TransactionImpl(m_db));
 }
diff --git a/Source/WebCore/storage/IDBSQLiteBackingStore.h b/Source/WebCore/storage/IDBSQLiteBackingStore.h
new file mode 100644
index 0000000..fe0c6c1
--- /dev/null
+++ b/Source/WebCore/storage/IDBSQLiteBackingStore.h
@@ -0,0 +1,82 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef IDBSQLiteBackingStore_h
+#define IDBSQLiteBackingStore_h
+
+#if ENABLE(INDEXED_DATABASE)
+
+#include "IDBBackingStore.h"
+
+namespace WebCore {
+
+class IDBSQLiteBackingStore : public IDBBackingStore {
+public:
+    static PassRefPtr<IDBBackingStore> open(SecurityOrigin*, const String& pathBase, int64_t maximumSize, const String& fileIdentifier, IDBFactoryBackendImpl*);
+    virtual ~IDBSQLiteBackingStore();
+
+    virtual bool extractIDBDatabaseMetaData(const String& name, String& foundVersion, int64_t& foundId);
+    virtual bool setIDBDatabaseMetaData(const String& name, const String& version, int64_t& rowId, bool invalidRowId);
+
+    virtual void getObjectStores(int64_t databaseId, Vector<int64_t>& foundIds, Vector<String>& foundNames, Vector<String>& foundKeyPaths, Vector<bool>& foundAutoIncrementFlags);
+    virtual bool createObjectStore(const String& name, const String& keyPath, bool autoIncrement, int64_t databaseId, int64_t& assignedObjectStoreId);
+    virtual void deleteObjectStore(int64_t objectStoreId);
+    virtual String getObjectStoreRecord(int64_t objectStoreId, const IDBKey&);
+    virtual bool putObjectStoreRecord(int64_t objectStoreId, const IDBKey&, const String& value, int64_t& rowId, bool invalidRowId);
+    virtual void clearObjectStore(int64_t objectStoreId);
+    virtual void deleteObjectStoreRecord(int64_t objectStoreId, int64_t objectStoreDataId);
+    virtual double nextAutoIncrementNumber(int64_t objectStoreId);
+    virtual bool keyExistsInObjectStore(int64_t objectStoreId, const IDBKey&, int64_t& foundObjectStoreDataId);
+
+    virtual bool forEachObjectStoreRecord(int64_t objectStoreId, ObjectStoreRecordCallback&);
+
+    virtual void getIndexes(int64_t objectStoreId, Vector<int64_t>& foundIds, Vector<String>& foundNames, Vector<String>& foundKeyPaths, Vector<bool>& foundUniqueFlags);
+    virtual bool createIndex(int64_t objectStoreId, const String& name, const String& keyPath, bool isUnique, int64_t& indexId);
+    virtual void deleteIndex(int64_t indexId);
+    virtual bool putIndexDataForRecord(int64_t indexId, const IDBKey&, int64_t objectStoreDataId);
+    virtual bool deleteIndexDataForRecord(int64_t objectStoreDataId);
+    virtual String getObjectViaIndex(int64_t indexId, const IDBKey&);
+    virtual PassRefPtr<IDBKey> getPrimaryKeyViaIndex(int64_t indexId, const IDBKey&);
+    virtual bool keyExistsInIndex(int64_t indexId, const IDBKey&);
+
+    virtual PassRefPtr<Cursor> openObjectStoreCursor(int64_t objectStoreId, const IDBKeyRange*, IDBCursor::Direction);
+    virtual PassRefPtr<Cursor> openIndexKeyCursor(int64_t indexId, const IDBKeyRange*, IDBCursor::Direction);
+    virtual PassRefPtr<Cursor> openIndexCursor(int64_t indexId, const IDBKeyRange*, IDBCursor::Direction);
+
+    virtual PassRefPtr<Transaction> createTransaction();
+
+private:
+    IDBSQLiteBackingStore(String identifier, IDBFactoryBackendImpl*);
+
+    SQLiteDatabase m_db;
+    String m_identifier;
+    RefPtr<IDBFactoryBackendImpl> m_factory;
+};
+
+} // namespace WebCore
+
+#endif
+
+#endif // IDBSQLiteBackingStore_h
diff --git a/Source/WebCore/storage/IDBTransactionBackendInterface.h b/Source/WebCore/storage/IDBTransactionBackendInterface.h
index 1b370af..3432e9a 100644
--- a/Source/WebCore/storage/IDBTransactionBackendInterface.h
+++ b/Source/WebCore/storage/IDBTransactionBackendInterface.h
@@ -43,7 +43,7 @@ class IDBTransactionCallbacks;
 // This is implemented by IDBTransactionBackendImpl and optionally others (in order to proxy
 // calls across process barriers). All calls to these classes should be non-blocking and
 // trigger work on a background thread if necessary.
-class IDBTransactionBackendInterface : public ThreadSafeShared<IDBTransactionBackendInterface> {
+class IDBTransactionBackendInterface : public ThreadSafeRefCounted<IDBTransactionBackendInterface> {
 public:
     virtual ~IDBTransactionBackendInterface() { }
 
diff --git a/Source/WebCore/storage/LocalStorageTask.cpp b/Source/WebCore/storage/LocalStorageTask.cpp
index d31c991..5d2c807 100644
--- a/Source/WebCore/storage/LocalStorageTask.cpp
+++ b/Source/WebCore/storage/LocalStorageTask.cpp
@@ -30,6 +30,7 @@
 
 #include "LocalStorageThread.h"
 #include "StorageAreaSync.h"
+#include "StorageTracker.h"
 
 namespace WebCore {
 
@@ -50,6 +51,27 @@ LocalStorageTask::LocalStorageTask(Type type, LocalStorageThread* thread)
     ASSERT(m_thread);
     ASSERT(m_type == TerminateThread);
 }
+    
+LocalStorageTask::LocalStorageTask(Type type)
+    : m_type(type)
+{
+    ASSERT(m_type == ImportOrigins || m_type == DeleteAllOrigins);
+}
+    
+LocalStorageTask::LocalStorageTask(Type type, const String& originIdentifier)
+    : m_type(type)
+    , m_originIdentifier(originIdentifier)
+{
+    ASSERT(m_type == DeleteOrigin);
+}
+
+LocalStorageTask::LocalStorageTask(Type type, const String& originIdentifier, const String& databaseFilename)
+    : m_type(type)
+    , m_originIdentifier(originIdentifier)
+    , m_databaseFilename(databaseFilename)
+{
+    ASSERT(m_type == SetOriginDetails);
+}
 
 LocalStorageTask::~LocalStorageTask()
 {
@@ -64,6 +86,18 @@ void LocalStorageTask::performTask()
         case AreaSync:
             m_area->performSync();
             break;
+        case SetOriginDetails:
+            StorageTracker::tracker().syncSetOriginDetails(m_originIdentifier, m_databaseFilename);
+            break;
+        case ImportOrigins:
+            StorageTracker::tracker().syncImportOriginIdentifiers();
+            break;
+        case DeleteAllOrigins:
+            StorageTracker::tracker().syncDeleteAllOrigins();
+            break;
+        case DeleteOrigin:
+            StorageTracker::tracker().syncDeleteOrigin(m_originIdentifier);
+            break;
         case DeleteEmptyDatabase:
             m_area->deleteEmptyDatabase();
             break;
diff --git a/Source/WebCore/storage/LocalStorageTask.h b/Source/WebCore/storage/LocalStorageTask.h
index 27a8eb5..99e72f5 100644
--- a/Source/WebCore/storage/LocalStorageTask.h
+++ b/Source/WebCore/storage/LocalStorageTask.h
@@ -28,6 +28,7 @@
 
 #if ENABLE(DOM_STORAGE)
 
+#include "PlatformString.h"
 #include <wtf/PassOwnPtr.h>
 #include <wtf/Threading.h>
 
@@ -40,13 +41,17 @@ namespace WebCore {
     class LocalStorageTask {
         WTF_MAKE_NONCOPYABLE(LocalStorageTask); WTF_MAKE_FAST_ALLOCATED;
     public:
-        enum Type { AreaImport, AreaSync, DeleteEmptyDatabase, TerminateThread };
+        enum Type { AreaImport, AreaSync, DeleteEmptyDatabase, SetOriginDetails, ImportOrigins, DeleteAllOrigins, DeleteOrigin, TerminateThread };
 
         ~LocalStorageTask();
 
         static PassOwnPtr<LocalStorageTask> createImport(StorageAreaSync* area) { return adoptPtr(new LocalStorageTask(AreaImport, area)); }
         static PassOwnPtr<LocalStorageTask> createSync(StorageAreaSync* area) { return adoptPtr(new LocalStorageTask(AreaSync, area)); }
         static PassOwnPtr<LocalStorageTask> createDeleteEmptyDatabase(StorageAreaSync* area) { return adoptPtr(new LocalStorageTask(DeleteEmptyDatabase, area)); }
+        static PassOwnPtr<LocalStorageTask> createOriginIdentifiersImport() { return adoptPtr(new LocalStorageTask(ImportOrigins)); }
+        static PassOwnPtr<LocalStorageTask> createSetOriginDetails(const String& originIdentifier, const String& databaseFilename) { return adoptPtr(new LocalStorageTask(SetOriginDetails, originIdentifier, databaseFilename)); }
+        static PassOwnPtr<LocalStorageTask> createDeleteOrigin(const String& originIdentifier) { return adoptPtr(new LocalStorageTask(DeleteOrigin, originIdentifier)); }
+        static PassOwnPtr<LocalStorageTask> createDeleteAllOrigins() { return adoptPtr(new LocalStorageTask(DeleteAllOrigins)); }
         static PassOwnPtr<LocalStorageTask> createTerminate(LocalStorageThread* thread) { return adoptPtr(new LocalStorageTask(TerminateThread, thread)); }
 
         void performTask();
@@ -54,10 +59,15 @@ namespace WebCore {
     private:
         LocalStorageTask(Type, StorageAreaSync*);
         LocalStorageTask(Type, LocalStorageThread*);
+        LocalStorageTask(Type, const String& originIdentifier);
+        LocalStorageTask(Type, const String& originIdentifier, const String& databaseFilename);
+        LocalStorageTask(Type);
 
         Type m_type;
         StorageAreaSync* m_area;
         LocalStorageThread* m_thread;
+        String m_originIdentifier;
+        String m_databaseFilename;
     };
 
 } // namespace WebCore
diff --git a/Source/WebCore/storage/SQLCallbackWrapper.h b/Source/WebCore/storage/SQLCallbackWrapper.h
new file mode 100644
index 0000000..38059fa
--- /dev/null
+++ b/Source/WebCore/storage/SQLCallbackWrapper.h
@@ -0,0 +1,108 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+#ifndef SQLCallbackWrapper_h
+#define SQLCallbackWrapper_h
+
+#if ENABLE(DATABASE)
+
+#include "CrossThreadTask.h"
+#include "ScriptExecutionContext.h"
+#include <wtf/ThreadingPrimitives.h>
+
+namespace WebCore {
+
+// A helper class to safely dereference the callback objects held by
+// SQLStatement and SQLTransaction on the proper thread. The 'wrapped'
+// callback is dereferenced:
+// - by destructing the enclosing wrapper - on any thread
+// - by calling clear() - on any thread
+// - by unwrapping and then dereferencing normally - on context thread only
+template<typename T> class SQLCallbackWrapper {
+public:
+    SQLCallbackWrapper(PassRefPtr<T> callback, ScriptExecutionContext* scriptExecutionContext)
+        : m_callback(callback)
+        , m_scriptExecutionContext(m_callback ? scriptExecutionContext : 0)
+    {
+        ASSERT(!m_callback || (m_scriptExecutionContext.get() && m_scriptExecutionContext->isContextThread()));
+    }
+
+    ~SQLCallbackWrapper()
+    {
+        clear();
+    }
+
+    void clear()
+    {
+        ScriptExecutionContext* context;
+        T* callback;
+        {
+            MutexLocker locker(m_mutex);
+            if (!m_callback) {
+                ASSERT(!m_scriptExecutionContext);
+                return;
+            }
+            if (m_scriptExecutionContext->isContextThread()) {
+                m_callback = 0;
+                m_scriptExecutionContext = 0;
+                return;
+            }
+            context = m_scriptExecutionContext.release().leakRef();
+            callback = m_callback.release().leakRef();
+        }
+        context->postTask(createCallbackTask(&safeRelease, callback));
+    }
+
+    PassRefPtr<T> unwrap()
+    {
+        MutexLocker locker(m_mutex);
+        ASSERT(!m_callback || m_scriptExecutionContext->isContextThread());
+        m_scriptExecutionContext = 0;
+        return m_callback.release();
+    }
+
+    // Useful for optimizations only, please test the return value of unwrap to be sure.
+    bool hasCallback() const { return m_callback; }
+
+private:
+    static void safeRelease(ScriptExecutionContext* context, T* callback)
+    {
+        ASSERT(callback && context && context->isContextThread());
+        callback->deref();
+        context->deref();
+    }
+
+    Mutex m_mutex;
+    RefPtr<T> m_callback;
+    RefPtr<ScriptExecutionContext> m_scriptExecutionContext;
+};
+
+} // namespace WebCore
+
+#endif // ENABLE(DATABASE)
+
+#endif // SQLCallbackWrapper_h
diff --git a/Source/WebCore/storage/SQLError.h b/Source/WebCore/storage/SQLError.h
index 496145a..eb9005b 100644
--- a/Source/WebCore/storage/SQLError.h
+++ b/Source/WebCore/storage/SQLError.h
@@ -32,11 +32,11 @@
 #if ENABLE(DATABASE)
 
 #include "PlatformString.h"
-#include <wtf/ThreadSafeShared.h>
+#include <wtf/ThreadSafeRefCounted.h>
 
 namespace WebCore {
 
-class SQLError : public ThreadSafeShared<SQLError> {
+class SQLError : public ThreadSafeRefCounted<SQLError> {
 public:
     static PassRefPtr<SQLError> create(unsigned code, const String& message) { return adoptRef(new SQLError(code, message)); }
 
diff --git a/Source/WebCore/storage/SQLResultSet.h b/Source/WebCore/storage/SQLResultSet.h
index 268472f..964504c 100644
--- a/Source/WebCore/storage/SQLResultSet.h
+++ b/Source/WebCore/storage/SQLResultSet.h
@@ -33,11 +33,11 @@
 
 #include "ExceptionCode.h"
 #include "SQLResultSetRowList.h"
-#include <wtf/ThreadSafeShared.h>
+#include <wtf/ThreadSafeRefCounted.h>
 
 namespace WebCore {
 
-class SQLResultSet : public ThreadSafeShared<SQLResultSet> {
+class SQLResultSet : public ThreadSafeRefCounted<SQLResultSet> {
 public:
     static PassRefPtr<SQLResultSet> create() { return adoptRef(new SQLResultSet); }
 
diff --git a/Source/WebCore/storage/SQLStatement.cpp b/Source/WebCore/storage/SQLStatement.cpp
index 306f561..58b7f71 100644
--- a/Source/WebCore/storage/SQLStatement.cpp
+++ b/Source/WebCore/storage/SQLStatement.cpp
@@ -43,16 +43,16 @@
 
 namespace WebCore {
 
-PassRefPtr<SQLStatement> SQLStatement::create(const String& statement, const Vector<SQLValue>& arguments, PassRefPtr<SQLStatementCallback> callback, PassRefPtr<SQLStatementErrorCallback> errorCallback, int permissions)
+PassRefPtr<SQLStatement> SQLStatement::create(Database* database, const String& statement, const Vector<SQLValue>& arguments, PassRefPtr<SQLStatementCallback> callback, PassRefPtr<SQLStatementErrorCallback> errorCallback, int permissions)
 {
-    return adoptRef(new SQLStatement(statement, arguments, callback, errorCallback, permissions));
+    return adoptRef(new SQLStatement(database, statement, arguments, callback, errorCallback, permissions));
 }
 
-SQLStatement::SQLStatement(const String& statement, const Vector<SQLValue>& arguments, PassRefPtr<SQLStatementCallback> callback, PassRefPtr<SQLStatementErrorCallback> errorCallback, int permissions)
+SQLStatement::SQLStatement(Database* database, const String& statement, const Vector<SQLValue>& arguments, PassRefPtr<SQLStatementCallback> callback, PassRefPtr<SQLStatementErrorCallback> errorCallback, int permissions)
     : m_statement(statement.crossThreadString())
     , m_arguments(arguments)
-    , m_statementCallback(callback)
-    , m_statementErrorCallback(errorCallback)
+    , m_statementCallbackWrapper(callback, database->scriptExecutionContext())
+    , m_statementErrorCallbackWrapper(errorCallback, database->scriptExecutionContext())
     , m_permissions(permissions)
 {
 }
@@ -166,17 +166,16 @@ bool SQLStatement::performCallback(SQLTransaction* transaction)
 
     bool callbackError = false;
 
+    RefPtr<SQLStatementCallback> callback = m_statementCallbackWrapper.unwrap();
+    RefPtr<SQLStatementErrorCallback> errorCallback = m_statementErrorCallbackWrapper.unwrap();
+
     // Call the appropriate statement callback and track if it resulted in an error,
     // because then we need to jump to the transaction error callback.
     if (m_error) {
-        ASSERT(m_statementErrorCallback);
-        callbackError = m_statementErrorCallback->handleEvent(transaction, m_error.get());
-    } else if (m_statementCallback)
-        callbackError = !m_statementCallback->handleEvent(transaction, m_resultSet.get());
-
-    // Now release our callbacks, to break reference cycles.
-    m_statementCallback = 0;
-    m_statementErrorCallback = 0;
+        ASSERT(errorCallback);
+        callbackError = errorCallback->handleEvent(transaction, m_error.get());
+    } else if (callback)
+        callbackError = !callback->handleEvent(transaction, m_resultSet.get());
 
     return callbackError;
 }
diff --git a/Source/WebCore/storage/SQLStatement.h b/Source/WebCore/storage/SQLStatement.h
index afd605a..1d81eb2 100644
--- a/Source/WebCore/storage/SQLStatement.h
+++ b/Source/WebCore/storage/SQLStatement.h
@@ -31,6 +31,7 @@
 #if ENABLE(DATABASE)
 
 #include "PlatformString.h"
+#include "SQLCallbackWrapper.h"
 #include "SQLResultSet.h"
 #include "SQLValue.h"
 #include <wtf/Forward.h>
@@ -44,15 +45,15 @@ class SQLStatementCallback;
 class SQLStatementErrorCallback;
 class SQLTransaction;
 
-class SQLStatement : public ThreadSafeShared<SQLStatement> {
+class SQLStatement : public ThreadSafeRefCounted<SQLStatement> {
 public:
-    static PassRefPtr<SQLStatement> create(const String&, const Vector<SQLValue>&, PassRefPtr<SQLStatementCallback>, PassRefPtr<SQLStatementErrorCallback>, int permissions);
+    static PassRefPtr<SQLStatement> create(Database*, const String&, const Vector<SQLValue>&, PassRefPtr<SQLStatementCallback>, PassRefPtr<SQLStatementErrorCallback>, int permissions);
 
     bool execute(Database*);
     bool lastExecutionFailedDueToQuota() const;
 
-    bool hasStatementCallback() const { return m_statementCallback; }
-    bool hasStatementErrorCallback() const { return m_statementErrorCallback; }
+    bool hasStatementCallback() const { return m_statementCallbackWrapper.hasCallback(); }
+    bool hasStatementErrorCallback() const { return m_statementErrorCallbackWrapper.hasCallback(); }
 
     void setDatabaseDeletedError();
     void setVersionMismatchedError();
@@ -61,15 +62,15 @@ public:
 
     SQLError* sqlError() const { return m_error.get(); }
 private:
-    SQLStatement(const String& statement, const Vector<SQLValue>& arguments, PassRefPtr<SQLStatementCallback>, PassRefPtr<SQLStatementErrorCallback>, int permissions);
+    SQLStatement(Database*, const String& statement, const Vector<SQLValue>& arguments, PassRefPtr<SQLStatementCallback>, PassRefPtr<SQLStatementErrorCallback>, int permissions);
 
     void setFailureDueToQuota();
     void clearFailureDueToQuota();
 
     String m_statement;
     Vector<SQLValue> m_arguments;
-    RefPtr<SQLStatementCallback> m_statementCallback;
-    RefPtr<SQLStatementErrorCallback> m_statementErrorCallback;
+    SQLCallbackWrapper<SQLStatementCallback> m_statementCallbackWrapper;
+    SQLCallbackWrapper<SQLStatementErrorCallback> m_statementErrorCallbackWrapper;
 
     RefPtr<SQLError> m_error;
     RefPtr<SQLResultSet> m_resultSet;
diff --git a/Source/WebCore/storage/SQLStatementCallback.h b/Source/WebCore/storage/SQLStatementCallback.h
index f86e29f..cae5827 100644
--- a/Source/WebCore/storage/SQLStatementCallback.h
+++ b/Source/WebCore/storage/SQLStatementCallback.h
@@ -30,14 +30,14 @@
 
 #if ENABLE(DATABASE)
 
-#include <wtf/ThreadSafeShared.h>
+#include <wtf/ThreadSafeRefCounted.h>
 
 namespace WebCore {
 
 class SQLTransaction;
 class SQLResultSet;
 
-class SQLStatementCallback : public ThreadSafeShared<SQLStatementCallback> {
+class SQLStatementCallback : public ThreadSafeRefCounted<SQLStatementCallback> {
 public:
     virtual ~SQLStatementCallback() { }
     virtual bool handleEvent(SQLTransaction*, SQLResultSet*) = 0;
diff --git a/Source/WebCore/storage/SQLStatementErrorCallback.h b/Source/WebCore/storage/SQLStatementErrorCallback.h
index acb8f64..5fecec4 100644
--- a/Source/WebCore/storage/SQLStatementErrorCallback.h
+++ b/Source/WebCore/storage/SQLStatementErrorCallback.h
@@ -31,14 +31,14 @@
 
 #if ENABLE(DATABASE)
 
-#include <wtf/ThreadSafeShared.h>
+#include <wtf/ThreadSafeRefCounted.h>
 
 namespace WebCore {
 
 class SQLTransaction;
 class SQLError;
 
-class SQLStatementErrorCallback : public ThreadSafeShared<SQLStatementErrorCallback> {
+class SQLStatementErrorCallback : public ThreadSafeRefCounted<SQLStatementErrorCallback> {
 public:
     virtual ~SQLStatementErrorCallback() { }
     virtual bool handleEvent(SQLTransaction*, SQLError*) = 0;
diff --git a/Source/WebCore/storage/SQLTransaction.cpp b/Source/WebCore/storage/SQLTransaction.cpp
index dea9d97..dfcd568 100644
--- a/Source/WebCore/storage/SQLTransaction.cpp
+++ b/Source/WebCore/storage/SQLTransaction.cpp
@@ -71,9 +71,9 @@ SQLTransaction::SQLTransaction(Database* db, PassRefPtr<SQLTransactionCallback>
     , m_executeSqlAllowed(false)
     , m_database(db)
     , m_wrapper(wrapper)
-    , m_callback(callback)
-    , m_successCallback(successCallback)
-    , m_errorCallback(errorCallback)
+    , m_callbackWrapper(callback, db->scriptExecutionContext())
+    , m_successCallbackWrapper(successCallback, db->scriptExecutionContext())
+    , m_errorCallbackWrapper(errorCallback, db->scriptExecutionContext())
     , m_shouldRetryCurrentStatement(false)
     , m_modifiedDatabase(false)
     , m_lockAcquired(false)
@@ -100,7 +100,7 @@ void SQLTransaction::executeSQL(const String& sqlStatement, const Vector<SQLValu
     else if (m_readOnly)
         permissions |= DatabaseAuthorizer::ReadOnlyMask;
 
-    RefPtr<SQLStatement> statement = SQLStatement::create(sqlStatement, arguments, callback, callbackError, permissions);
+    RefPtr<SQLStatement> statement = SQLStatement::create(m_database.get(), sqlStatement, arguments, callback, callbackError, permissions);
 
     if (m_database->deleted())
         statement->setDatabaseDeletedError();
@@ -159,9 +159,9 @@ void SQLTransaction::checkAndHandleClosedOrInterruptedDatabase()
     m_nextStep = 0;
 
     // Release the unneeded callbacks, to break reference cycles.
-    m_callback = 0;
-    m_successCallback = 0;
-    m_errorCallback = 0;
+    m_callbackWrapper.clear();
+    m_successCallbackWrapper.clear();
+    m_errorCallbackWrapper.clear();
 
     // The next steps should be executed only if we're on the DB thread.
     if (currentThread() != database()->scriptExecutionContext()->databaseThread()->getThreadID())
@@ -293,11 +293,11 @@ void SQLTransaction::deliverTransactionCallback()
 {
     bool shouldDeliverErrorCallback = false;
 
-    if (m_callback) {
+    RefPtr<SQLTransactionCallback> callback = m_callbackWrapper.unwrap();
+    if (callback) {
         m_executeSqlAllowed = true;
-        shouldDeliverErrorCallback = !m_callback->handleEvent(this);
+        shouldDeliverErrorCallback = !callback->handleEvent(this);
         m_executeSqlAllowed = false;
-        m_callback = 0;
     }
 
     // Transaction Step 5 - If the transaction callback was null or raised an exception, jump to the error callback
@@ -425,7 +425,7 @@ void SQLTransaction::deliverStatementCallback()
     m_executeSqlAllowed = false;
 
     if (result) {
-      m_transactionError = SQLError::create(SQLError::UNKNOWN_ERR, "the statement callback raised an exception or statement error callback did not return false");
+        m_transactionError = SQLError::create(SQLError::UNKNOWN_ERR, "the statement callback raised an exception or statement error callback did not return false");
         handleTransactionError(true);
     } else
         scheduleToRunStatements();
@@ -465,7 +465,7 @@ void SQLTransaction::postflightAndCommit()
 
     // If the commit failed, the transaction will still be marked as "in progress"
     if (m_sqliteTransaction->inProgress()) {
-        m_successCallback = 0;
+        m_successCallbackWrapper.clear();
         m_transactionError = SQLError::create(SQLError::DATABASE_ERR, "failed to commit the transaction");
         handleTransactionError(false);
         return;
@@ -480,10 +480,10 @@ void SQLTransaction::postflightAndCommit()
         m_database->transactionClient()->didCommitWriteTransaction(database());
 
     // Now release our unneeded callbacks, to break reference cycles.
-    m_errorCallback = 0;
+    m_errorCallbackWrapper.clear();
 
     // Transaction Step 10 - Deliver success callback, if there is one
-    if (m_successCallback) {
+    if (m_successCallbackWrapper.hasCallback()) {
         m_nextStep = &SQLTransaction::deliverSuccessCallback;
         LOG(StorageAPI, "Scheduling deliverSuccessCallback for transaction %p\n", this);
         m_database->scheduleTransactionCallback(this);
@@ -494,11 +494,9 @@ void SQLTransaction::postflightAndCommit()
 void SQLTransaction::deliverSuccessCallback()
 {
     // Transaction Step 10 - Deliver success callback
-    ASSERT(m_successCallback);
-    m_successCallback->handleEvent();
-
-    // Release the last callback to break reference cycle
-    m_successCallback = 0;
+    RefPtr<VoidCallback> successCallback = m_successCallbackWrapper.unwrap();
+    if (successCallback)
+        successCallback->handleEvent();
 
     // Schedule a "post-success callback" step to return control to the database thread in case there
     // are further transactions queued up for this Database
@@ -524,7 +522,7 @@ void SQLTransaction::cleanupAfterSuccessCallback()
 
 void SQLTransaction::handleTransactionError(bool inCallback)
 {
-    if (m_errorCallback) {
+    if (m_errorCallbackWrapper.hasCallback()) {
         if (inCallback)
             deliverTransactionErrorCallback();
         else {
@@ -552,10 +550,9 @@ void SQLTransaction::deliverTransactionErrorCallback()
 
     // Transaction Step 12 - If exists, invoke error callback with the last
     // error to have occurred in this transaction.
-    if (m_errorCallback) {
-        m_errorCallback->handleEvent(m_transactionError.get());
-        m_errorCallback = 0;
-    }
+    RefPtr<SQLTransactionErrorCallback> errorCallback = m_errorCallbackWrapper.unwrap();
+    if (errorCallback)
+        errorCallback->handleEvent(m_transactionError.get());
 
     m_nextStep = &SQLTransaction::cleanupAfterTransactionErrorCallback;
     LOG(StorageAPI, "Scheduling cleanupAfterTransactionErrorCallback for transaction %p\n", this);
diff --git a/Source/WebCore/storage/SQLTransaction.h b/Source/WebCore/storage/SQLTransaction.h
index 3eb1fd5..4c84f91 100644
--- a/Source/WebCore/storage/SQLTransaction.h
+++ b/Source/WebCore/storage/SQLTransaction.h
@@ -34,7 +34,7 @@
 #include "SQLStatement.h"
 #include <wtf/Deque.h>
 #include <wtf/Forward.h>
-#include <wtf/ThreadSafeShared.h>
+#include <wtf/ThreadSafeRefCounted.h>
 #include <wtf/Vector.h>
 
 namespace WebCore {
@@ -50,7 +50,7 @@ class SQLTransactionErrorCallback;
 class SQLValue;
 class VoidCallback;
 
-class SQLTransactionWrapper : public ThreadSafeShared<SQLTransactionWrapper> {
+class SQLTransactionWrapper : public ThreadSafeRefCounted<SQLTransactionWrapper> {
 public:
     virtual ~SQLTransactionWrapper() { }
     virtual bool performPreflight(SQLTransaction*) = 0;
@@ -59,7 +59,7 @@ public:
     virtual SQLError* sqlError() const = 0;
 };
 
-class SQLTransaction : public ThreadSafeShared<SQLTransaction> {
+class SQLTransaction : public ThreadSafeRefCounted<SQLTransaction> {
 public:
     static PassRefPtr<SQLTransaction> create(Database*, PassRefPtr<SQLTransactionCallback>, PassRefPtr<SQLTransactionErrorCallback>,
                                              PassRefPtr<VoidCallback>, PassRefPtr<SQLTransactionWrapper>, bool readOnly = false);
@@ -115,9 +115,9 @@ private:
 
     RefPtr<Database> m_database;
     RefPtr<SQLTransactionWrapper> m_wrapper;
-    RefPtr<SQLTransactionCallback> m_callback;
-    RefPtr<VoidCallback> m_successCallback;
-    RefPtr<SQLTransactionErrorCallback> m_errorCallback;
+    SQLCallbackWrapper<SQLTransactionCallback> m_callbackWrapper;
+    SQLCallbackWrapper<VoidCallback> m_successCallbackWrapper;
+    SQLCallbackWrapper<SQLTransactionErrorCallback> m_errorCallbackWrapper;
     RefPtr<SQLError> m_transactionError;
     bool m_shouldRetryCurrentStatement;
     bool m_modifiedDatabase;
diff --git a/Source/WebCore/storage/SQLTransactionCallback.h b/Source/WebCore/storage/SQLTransactionCallback.h
index aff6233..6904880 100644
--- a/Source/WebCore/storage/SQLTransactionCallback.h
+++ b/Source/WebCore/storage/SQLTransactionCallback.h
@@ -31,13 +31,13 @@
 
 #if ENABLE(DATABASE)
 
-#include <wtf/ThreadSafeShared.h>
+#include <wtf/ThreadSafeRefCounted.h>
 
 namespace WebCore {
 
 class SQLTransaction;
 
-class SQLTransactionCallback : public ThreadSafeShared<SQLTransactionCallback> {
+class SQLTransactionCallback : public ThreadSafeRefCounted<SQLTransactionCallback> {
 public:
     virtual ~SQLTransactionCallback() { }
     virtual bool handleEvent(SQLTransaction*) = 0;
diff --git a/Source/WebCore/storage/SQLTransactionErrorCallback.h b/Source/WebCore/storage/SQLTransactionErrorCallback.h
index 4095d6a..f067571 100644
--- a/Source/WebCore/storage/SQLTransactionErrorCallback.h
+++ b/Source/WebCore/storage/SQLTransactionErrorCallback.h
@@ -31,13 +31,13 @@
 
 #if ENABLE(DATABASE)
 
-#include <wtf/ThreadSafeShared.h>
+#include <wtf/ThreadSafeRefCounted.h>
 
 namespace WebCore {
 
 class SQLError;
 
-class SQLTransactionErrorCallback : public ThreadSafeShared<SQLTransactionErrorCallback> {
+class SQLTransactionErrorCallback : public ThreadSafeRefCounted<SQLTransactionErrorCallback> {
 public:
     virtual ~SQLTransactionErrorCallback() { }
     virtual bool handleEvent(SQLError*) = 0;
diff --git a/Source/WebCore/storage/StorageAreaImpl.cpp b/Source/WebCore/storage/StorageAreaImpl.cpp
index 54df135..bb2d702 100644
--- a/Source/WebCore/storage/StorageAreaImpl.cpp
+++ b/Source/WebCore/storage/StorageAreaImpl.cpp
@@ -231,6 +231,31 @@ void StorageAreaImpl::close()
 #endif
 }
 
+void StorageAreaImpl::clearForOriginDeletion()
+{
+    ASSERT(!m_isShutdown);
+    blockUntilImportComplete();
+    
+    if (m_storageMap->length()) {
+        unsigned quota = m_storageMap->quota();
+        m_storageMap = StorageMap::create(quota);
+    }
+
+    if (m_storageAreaSync) {
+        m_storageAreaSync->scheduleClear();
+        m_storageAreaSync->scheduleCloseDatabase();
+    }
+}
+    
+void StorageAreaImpl::sync()
+{
+    ASSERT(!m_isShutdown);
+    blockUntilImportComplete();
+    
+    if (m_storageAreaSync)
+        m_storageAreaSync->scheduleSync();
+}
+
 void StorageAreaImpl::blockUntilImportComplete() const
 {
     if (m_storageAreaSync)
diff --git a/Source/WebCore/storage/StorageAreaImpl.h b/Source/WebCore/storage/StorageAreaImpl.h
index 60d72cb..9f87e69 100644
--- a/Source/WebCore/storage/StorageAreaImpl.h
+++ b/Source/WebCore/storage/StorageAreaImpl.h
@@ -59,6 +59,11 @@ namespace WebCore {
         // Only called from a background thread.
         void importItem(const String& key, const String& value);
 
+        // Used to clear a StorageArea and close db before backing db file is deleted.
+        void clearForOriginDeletion();
+
+        void sync();
+
     private:
         StorageAreaImpl(StorageType, PassRefPtr<SecurityOrigin>, PassRefPtr<StorageSyncManager>, unsigned quota);
         StorageAreaImpl(StorageAreaImpl*);
diff --git a/Source/WebCore/storage/StorageAreaSync.cpp b/Source/WebCore/storage/StorageAreaSync.cpp
index f2008ab..94a002a 100644
--- a/Source/WebCore/storage/StorageAreaSync.cpp
+++ b/Source/WebCore/storage/StorageAreaSync.cpp
@@ -36,6 +36,7 @@
 #include "SecurityOrigin.h"
 #include "StorageAreaImpl.h"
 #include "StorageSyncManager.h"
+#include "StorageTracker.h"
 #include "SuddenTermination.h"
 #include <wtf/text/CString.h>
 
@@ -60,6 +61,7 @@ inline StorageAreaSync::StorageAreaSync(PassRefPtr<StorageSyncManager> storageSy
     , m_syncScheduled(false)
     , m_syncInProgress(false)
     , m_databaseOpenFailed(false)
+    , m_syncCloseDatabase(false)
     , m_importComplete(false)
 {
     ASSERT(isMainThread());
@@ -138,6 +140,25 @@ void StorageAreaSync::scheduleClear()
     }
 }
 
+void StorageAreaSync::scheduleCloseDatabase()
+{
+    ASSERT(isMainThread());
+    ASSERT(!m_finalSyncScheduled);
+
+    if (!m_database.isOpen())
+        return;
+
+    m_syncCloseDatabase = true;
+    
+    if (!m_syncTimer.isActive()) {
+        m_syncTimer.startOneShot(StorageSyncInterval);
+        
+        // The following is balanced by the call to enableSuddenTermination in the
+        // syncTimerFired function.
+        disableSuddenTermination();
+    }
+}
+
 void StorageAreaSync::syncTimerFired(Timer<StorageAreaSync>*)
 {
     ASSERT(isMainThread());
@@ -222,6 +243,10 @@ void StorageAreaSync::openDatabase(OpenDatabaseParamType openingStrategy)
         return;
     }
 
+    // A StorageTracker thread may have been scheduled to delete the db we're
+    // reopening, so cancel possible deletion.
+    StorageTracker::tracker().cancelDeletingOrigin(m_databaseIdentifier);
+
     if (!m_database.open(databaseFilename)) {
         LOG_ERROR("Failed to open database file %s for local storage", databaseFilename.utf8().data());
         markImported();
@@ -235,6 +260,8 @@ void StorageAreaSync::openDatabase(OpenDatabaseParamType openingStrategy)
         m_databaseOpenFailed = true;
         return;
     }
+
+    StorageTracker::tracker().setOriginDetails(m_databaseIdentifier, databaseFilename);
 }
 
 void StorageAreaSync::performImport()
@@ -319,6 +346,15 @@ void StorageAreaSync::sync(bool clearItems, const HashMap<String, String>& items
     if (!m_database.isOpen())
         return;
 
+    // Closing this db because it is about to be deleted by StorageTracker.
+    // The delete will be cancelled if StorageAreaSync needs to reopen the db
+    // to write new items created after the request to delete the db.
+    if (m_syncCloseDatabase) {
+        m_syncCloseDatabase = false;
+        m_database.close();
+        return;
+    }
+    
     // If the clear flag is set, then we clear all items out before we write any new ones in.
     if (clearItems) {
         SQLiteStatement clear(m_database, "DELETE FROM ItemTable");
@@ -421,12 +457,21 @@ void StorageAreaSync::deleteEmptyDatabase()
     if (!count) {
         query.finalize();
         m_database.close();
-        String databaseFilename = m_syncManager->fullDatabaseFilename(m_databaseIdentifier);
-        if (!SQLiteFileSystem::deleteDatabaseFile(databaseFilename))
-            LOG_ERROR("Failed to delete database file %s\n", databaseFilename.utf8().data());
+        if (StorageTracker::tracker().isActive())
+            StorageTracker::tracker().deleteOrigin(m_databaseIdentifier);
+        else {
+            String databaseFilename = m_syncManager->fullDatabaseFilename(m_databaseIdentifier);
+            if (!SQLiteFileSystem::deleteDatabaseFile(databaseFilename))
+                LOG_ERROR("Failed to delete database file %s\n", databaseFilename.utf8().data());
+        }
     }
 }
 
+void StorageAreaSync::scheduleSync()
+{
+    syncTimerFired(&m_syncTimer);
+}
+    
 } // namespace WebCore
 
 #endif // ENABLE(DOM_STORAGE)
diff --git a/Source/WebCore/storage/StorageAreaSync.h b/Source/WebCore/storage/StorageAreaSync.h
index 90aa6a7..ebfb053 100644
--- a/Source/WebCore/storage/StorageAreaSync.h
+++ b/Source/WebCore/storage/StorageAreaSync.h
@@ -49,6 +49,9 @@ namespace WebCore {
 
         void scheduleItemForSync(const String& key, const String& value);
         void scheduleClear();
+        void scheduleCloseDatabase();
+
+        void scheduleSync();
 
     private:
         StorageAreaSync(PassRefPtr<StorageSyncManager>, PassRefPtr<StorageAreaImpl>, const String& databaseIdentifier);
@@ -92,6 +95,8 @@ namespace WebCore {
         bool m_syncScheduled;
         bool m_syncInProgress;
         bool m_databaseOpenFailed;
+        
+        bool m_syncCloseDatabase;
 
         mutable Mutex m_importLock;
         mutable ThreadCondition m_importCondition;
diff --git a/Source/WebCore/storage/StorageNamespace.h b/Source/WebCore/storage/StorageNamespace.h
index f7dad1e..f5604b0 100644
--- a/Source/WebCore/storage/StorageNamespace.h
+++ b/Source/WebCore/storage/StorageNamespace.h
@@ -50,10 +50,16 @@ public:
     virtual PassRefPtr<StorageNamespace> copy() = 0;
     virtual void close() = 0;
     virtual void unlock() = 0;
+<<<<<<< HEAD
 
 #ifdef ANDROID
     virtual void clear(Page*) = 0;
 #endif
+=======
+    virtual void clearOriginForDeletion(SecurityOrigin*) = 0;
+    virtual void clearAllOriginsForDeletion() = 0;
+    virtual void sync() = 0;
+>>>>>>> webkit.org at r82507
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/storage/StorageNamespaceImpl.cpp b/Source/WebCore/storage/StorageNamespaceImpl.cpp
index 68508a7..c6279ed 100644
--- a/Source/WebCore/storage/StorageNamespaceImpl.cpp
+++ b/Source/WebCore/storage/StorageNamespaceImpl.cpp
@@ -32,6 +32,7 @@
 #include "StorageAreaImpl.h"
 #include "StorageMap.h"
 #include "StorageSyncManager.h"
+#include "StorageTracker.h"
 #include <wtf/StdLibExtras.h>
 #include <wtf/text/StringHash.h>
 
@@ -167,6 +168,32 @@ void StorageNamespaceImpl::unlock()
     // Because there's a single event loop per-process, this is a no-op.
 }
 
+void StorageNamespaceImpl::clearOriginForDeletion(SecurityOrigin* origin)
+{
+    ASSERT(isMainThread());
+
+    RefPtr<StorageAreaImpl> storageArea = m_storageAreaMap.get(origin);
+    if (storageArea)
+        storageArea->clearForOriginDeletion();
+}
+
+void StorageNamespaceImpl::clearAllOriginsForDeletion()
+{
+    ASSERT(isMainThread());
+
+    StorageAreaMap::iterator end = m_storageAreaMap.end();
+    for (StorageAreaMap::iterator it = m_storageAreaMap.begin(); it != end; ++it)
+        it->second->clearForOriginDeletion();
+}
+    
+void StorageNamespaceImpl::sync()
+{
+    ASSERT(isMainThread());
+    StorageAreaMap::iterator end = m_storageAreaMap.end();
+    for (StorageAreaMap::iterator it = m_storageAreaMap.begin(); it != end; ++it)
+        it->second->sync();
+}
+
 } // namespace WebCore
 
 #endif // ENABLE(DOM_STORAGE)
diff --git a/Source/WebCore/storage/StorageNamespaceImpl.h b/Source/WebCore/storage/StorageNamespaceImpl.h
index c2361fa..871f540 100644
--- a/Source/WebCore/storage/StorageNamespaceImpl.h
+++ b/Source/WebCore/storage/StorageNamespaceImpl.h
@@ -53,10 +53,21 @@ namespace WebCore {
         virtual void close();
         virtual void unlock();
 
+<<<<<<< HEAD
 #ifdef ANDROID
         virtual void clear(Page*);
 #endif
 
+=======
+        // Not removing the origin's StorageArea from m_storageAreaMap because
+        // we're just deleting the underlying db file. If an item is added immediately
+        // after file deletion, we want the same StorageArea to eventually trigger
+        // a sync and for StorageAreaSync to recreate the backing db file.
+        virtual void clearOriginForDeletion(SecurityOrigin*);
+        virtual void clearAllOriginsForDeletion();
+        virtual void sync();
+        
+>>>>>>> webkit.org at r82507
     private:
         StorageNamespaceImpl(StorageType, const String& path, unsigned quota);
 
diff --git a/Source/WebCore/storage/StorageTracker.cpp b/Source/WebCore/storage/StorageTracker.cpp
new file mode 100644
index 0000000..e18b4b8
--- /dev/null
+++ b/Source/WebCore/storage/StorageTracker.cpp
@@ -0,0 +1,539 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "StorageTracker.h"
+
+#if ENABLE(DOM_STORAGE)
+
+#include "DatabaseThread.h"
+#include "FileSystem.h"
+#include "LocalStorageTask.h"
+#include "LocalStorageThread.h"
+#include "Logging.h"
+#include "PageGroup.h"
+#include "SQLiteFileSystem.h"
+#include "SQLiteStatement.h"
+#include "SecurityOrigin.h"
+#include "StorageTrackerClient.h"
+#include "TextEncoding.h"
+#include <wtf/MainThread.h>
+#include <wtf/StdLibExtras.h>
+#include <wtf/Vector.h>
+#include <wtf/text/CString.h>
+
+namespace WebCore {
+
+static StorageTracker* storageTracker = 0;
+
+void StorageTracker::initializeTracker(const String& storagePath)
+{
+    ASSERT(isMainThread());
+    ASSERT(!storageTracker);
+    
+    if (!storageTracker)
+        storageTracker = new StorageTracker(storagePath);
+    
+    // Make sure text encoding maps have been built on the main thread, as the StorageTracker thread might try to do it there instead.
+    // FIXME (<rdar://problem/9127819>): Is there a more explicit way of doing this besides accessing the UTF8Encoding?
+    UTF8Encoding();
+    
+    SQLiteFileSystem::registerSQLiteVFS();
+    storageTracker->setIsActive(true);
+    storageTracker->m_thread->start();  
+    storageTracker->importOriginIdentifiers();
+}
+
+StorageTracker& StorageTracker::tracker()
+{
+    if (!storageTracker)
+        storageTracker = new StorageTracker("");
+    
+    return *storageTracker;
+}
+
+StorageTracker::StorageTracker(const String& storagePath)
+    : m_client(0)
+    , m_thread(LocalStorageThread::create())
+    , m_isActive(false)
+{
+    setStorageDirectoryPath(storagePath);
+}
+
+void StorageTracker::setStorageDirectoryPath(const String& path)
+{
+    MutexLocker lockDatabase(m_databaseGuard);
+    ASSERT(!m_database.isOpen());
+    
+    m_storageDirectoryPath = path.threadsafeCopy();
+}
+
+String StorageTracker::trackerDatabasePath()
+{
+    ASSERT(!m_databaseGuard.tryLock());
+    return SQLiteFileSystem::appendDatabaseFileNameToPath(m_storageDirectoryPath, "StorageTracker.db");
+}
+
+void StorageTracker::openTrackerDatabase(bool createIfDoesNotExist)
+{
+    ASSERT(m_isActive);
+    ASSERT(!isMainThread());
+    ASSERT(!m_databaseGuard.tryLock());
+
+    if (m_database.isOpen())
+        return;
+    
+    String databasePath = trackerDatabasePath();
+    
+    if (!SQLiteFileSystem::ensureDatabaseFileExists(databasePath, createIfDoesNotExist)) {
+        if (createIfDoesNotExist)
+            LOG_ERROR("Failed to create database file '%s'", databasePath.ascii().data());
+        return;
+    }
+    
+    if (!m_database.open(databasePath)) {
+        LOG_ERROR("Failed to open databasePath %s.", databasePath.ascii().data());
+        return;
+    }
+    
+    m_database.disableThreadingChecks();
+    
+    if (!m_database.tableExists("Origins")) {
+        if (!m_database.executeCommand("CREATE TABLE Origins (origin TEXT UNIQUE ON CONFLICT REPLACE, path TEXT);"))
+            LOG_ERROR("Failed to create Origins table.");
+    }
+}
+
+void StorageTracker::importOriginIdentifiers()
+{   
+    if (!m_isActive)
+        return;
+    
+    ASSERT(isMainThread());
+    ASSERT(m_thread);
+
+    m_thread->scheduleTask(LocalStorageTask::createOriginIdentifiersImport());
+}
+
+void StorageTracker::syncImportOriginIdentifiers()
+{
+    ASSERT(m_isActive);
+    
+    ASSERT(!isMainThread());
+
+    {
+        MutexLocker lockDatabase(m_databaseGuard);
+
+        // Don't force creation of StorageTracker's db just because a tracker
+        // was initialized. It will be created if local storage dbs are found
+        // by syncFileSystemAndTrackerDatabse() or the next time a local storage
+        // db is created by StorageAreaSync.
+        openTrackerDatabase(false);
+
+        if (m_database.isOpen()) {
+            SQLiteStatement statement(m_database, "SELECT origin FROM Origins");
+            if (statement.prepare() != SQLResultOk) {
+                LOG_ERROR("Failed to prepare statement.");
+                return;
+            }
+            
+            int result;
+            
+            {
+                MutexLocker lockOrigins(m_originSetGuard);
+                while ((result = statement.step()) == SQLResultRow)
+                    m_originSet.add(statement.getColumnText(0).threadsafeCopy());
+            }
+            
+            if (result != SQLResultDone) {
+                LOG_ERROR("Failed to read in all origins from the database.");
+                return;
+            }
+        }
+    }
+    
+    syncFileSystemAndTrackerDatabase();
+    
+    {
+        MutexLocker lockClient(m_clientGuard);
+        if (m_client) {
+            MutexLocker lockOrigins(m_originSetGuard);
+            OriginSet::const_iterator end = m_originSet.end();
+            for (OriginSet::const_iterator it = m_originSet.begin(); it != end; ++it)
+                m_client->dispatchDidModifyOrigin(*it);
+        }
+    }
+}
+    
+void StorageTracker::syncFileSystemAndTrackerDatabase()
+{
+    ASSERT(!isMainThread());
+    ASSERT(m_isActive);
+
+    m_databaseGuard.lock();
+    DEFINE_STATIC_LOCAL(const String, fileMatchPattern, ("*.localstorage"));
+    DEFINE_STATIC_LOCAL(const String, fileExt, (".localstorage"));
+    DEFINE_STATIC_LOCAL(const unsigned, fileExtLength, (fileExt.length()));
+    m_databaseGuard.unlock();
+
+    Vector<String> paths;
+    {
+        MutexLocker lock(m_databaseGuard);
+        paths = listDirectory(m_storageDirectoryPath, fileMatchPattern);
+    }
+
+    // Use a copy of m_originSet to find expired entries and to schedule their
+    // deletions from disk and from m_originSet.
+    OriginSet originSetCopy;
+    {
+        MutexLocker lock(m_originSetGuard);
+        OriginSet::const_iterator end = m_originSet.end();
+        for (OriginSet::const_iterator it = m_originSet.begin(); it != end; ++it)
+            originSetCopy.add((*it).threadsafeCopy());
+    }
+    
+    // Add missing StorageTracker records.
+    OriginSet foundOrigins;
+    Vector<String>::const_iterator end = paths.end();
+    for (Vector<String>::const_iterator it = paths.begin(); it != end; ++it) {
+        String path = *it;
+        if (path.endsWith(fileExt, true) && path.length() > fileExtLength) {
+            String file = pathGetFileName(path);
+            String originIdentifier = file.substring(0, file.length() - fileExtLength);
+            if (!originSetCopy.contains(originIdentifier))
+                syncSetOriginDetails(originIdentifier, path);
+
+            foundOrigins.add(originIdentifier);
+        }
+    }
+
+    // Delete stale StorageTracker records.
+    OriginSet::const_iterator setEnd = originSetCopy.end();
+    for (OriginSet::const_iterator it = originSetCopy.begin(); it != setEnd; ++it) {
+        if (!foundOrigins.contains(*it))
+            syncDeleteOrigin(*it);
+    }
+}
+
+void StorageTracker::setOriginDetails(const String& originIdentifier, const String& databaseFile)
+{
+    if (!m_isActive)
+        return;
+
+    {
+        MutexLocker lockOrigins(m_originSetGuard);
+
+        if (m_originSet.contains(originIdentifier))
+            return;
+
+        m_originSet.add(originIdentifier);
+    }
+
+    OwnPtr<LocalStorageTask> task = LocalStorageTask::createSetOriginDetails(originIdentifier.threadsafeCopy(), databaseFile);
+
+    if (isMainThread()) {
+        ASSERT(m_thread);
+        m_thread->scheduleTask(task.release());
+    } else 
+        callOnMainThread(scheduleTask, reinterpret_cast<void*>(task.leakPtr()));
+}
+
+void StorageTracker::scheduleTask(void* taskIn)
+{
+    ASSERT(isMainThread());
+    ASSERT(StorageTracker::tracker().m_thread);
+    
+    OwnPtr<LocalStorageTask> task = adoptPtr(reinterpret_cast<LocalStorageTask*>(taskIn));
+
+    StorageTracker::tracker().m_thread->scheduleTask(task.release());
+}
+
+void StorageTracker::syncSetOriginDetails(const String& originIdentifier, const String& databaseFile)
+{
+    ASSERT(!isMainThread());
+
+    MutexLocker lockDatabase(m_databaseGuard);
+
+    openTrackerDatabase(true);
+    
+    if (!m_database.isOpen())
+        return;
+
+    SQLiteStatement statement(m_database, "INSERT INTO Origins VALUES (?, ?)");
+    if (statement.prepare() != SQLResultOk) {
+        LOG_ERROR("Unable to establish origin '%s' in the tracker", originIdentifier.ascii().data());
+        return;
+    } 
+    
+    statement.bindText(1, originIdentifier);
+    statement.bindText(2, databaseFile);
+    
+    if (statement.step() != SQLResultDone)
+        LOG_ERROR("Unable to establish origin '%s' in the tracker", originIdentifier.ascii().data());
+
+    {
+        MutexLocker lockOrigins(m_originSetGuard);
+        if (!m_originSet.contains(originIdentifier))
+            m_originSet.add(originIdentifier);
+    }
+
+    {
+        MutexLocker lockClient(m_clientGuard);
+        if (m_client)
+            m_client->dispatchDidModifyOrigin(originIdentifier);
+    }
+}
+
+void StorageTracker::origins(Vector<RefPtr<SecurityOrigin> >& result)
+{
+    ASSERT(m_isActive);
+    
+    if (!m_isActive)
+        return;
+
+    MutexLocker lockOrigins(m_originSetGuard);
+
+    OriginSet::const_iterator end = m_originSet.end();
+    for (OriginSet::const_iterator it = m_originSet.begin(); it != end; ++it)
+        result.append(SecurityOrigin::createFromDatabaseIdentifier(*it));
+}
+
+void StorageTracker::deleteAllOrigins()
+{
+    ASSERT(m_isActive);
+    ASSERT(isMainThread());
+    ASSERT(m_thread);
+    
+    if (!m_isActive)
+        return;
+
+    {
+        MutexLocker lockOrigins(m_originSetGuard);
+        willDeleteAllOrigins();
+        m_originSet.clear();
+    }
+
+    PageGroup::clearLocalStorageForAllOrigins();
+    
+    m_thread->scheduleTask(LocalStorageTask::createDeleteAllOrigins());
+}
+    
+void StorageTracker::syncDeleteAllOrigins()
+{
+    ASSERT(!isMainThread());
+    
+    MutexLocker lockDatabase(m_databaseGuard);
+    
+    openTrackerDatabase(false);
+    if (!m_database.isOpen())
+        return;
+    
+    SQLiteStatement statement(m_database, "SELECT origin, path FROM Origins");
+    if (statement.prepare() != SQLResultOk) {
+        LOG_ERROR("Failed to prepare statement.");
+        return;
+    }
+    
+    int result;
+    while ((result = statement.step()) == SQLResultRow) {
+        if (!canDeleteOrigin(statement.getColumnText(0)))
+            continue;
+
+        SQLiteFileSystem::deleteDatabaseFile(statement.getColumnText(1));
+
+        {
+            MutexLocker lockClient(m_clientGuard);
+            if (m_client)
+                m_client->dispatchDidModifyOrigin(statement.getColumnText(0));
+        }
+    }
+    
+    if (result != SQLResultDone)
+        LOG_ERROR("Failed to read in all origins from the database.");
+    
+    if (m_database.isOpen())
+        m_database.close();
+    
+    SQLiteFileSystem::deleteDatabaseFile(trackerDatabasePath());
+    SQLiteFileSystem::deleteEmptyDatabaseDirectory(m_storageDirectoryPath);
+}
+
+void StorageTracker::deleteOrigin(const String& originIdentifier)
+{
+    deleteOrigin(SecurityOrigin::createFromDatabaseIdentifier(originIdentifier).get());
+}
+
+void StorageTracker::deleteOrigin(SecurityOrigin* origin)
+{    
+    ASSERT(m_isActive);
+    ASSERT(isMainThread());
+    ASSERT(m_thread);
+    
+    if (!m_isActive)
+        return;
+
+    // Before deleting database, we need to clear in-memory local storage data
+    // in StorageArea, and to close the StorageArea db. It's possible for an
+    // item to be added immediately after closing the db and cause StorageAreaSync
+    // to reopen the db before the db is deleted by a StorageTracker thread.
+    // In this case, reopening the db in StorageAreaSync will cancel a pending
+    // StorageTracker db deletion.
+    PageGroup::clearLocalStorageForOrigin(origin);
+
+    String originId = origin->databaseIdentifier();
+    
+    {
+        MutexLocker lockOrigins(m_originSetGuard);
+        willDeleteOrigin(originId);
+        m_originSet.remove(originId);
+    }
+    
+    m_thread->scheduleTask(LocalStorageTask::createDeleteOrigin(originId));
+}
+
+void StorageTracker::syncDeleteOrigin(const String& originIdentifier)
+{
+    ASSERT(!isMainThread());
+
+    MutexLocker lockDatabase(m_databaseGuard);
+    
+    if (!canDeleteOrigin(originIdentifier)) {
+        LOG_ERROR("Attempted to delete origin '%s' while it was being created\n", originIdentifier.ascii().data());
+        return;
+    }
+    
+    openTrackerDatabase(false);
+    if (!m_database.isOpen())
+        return;
+    
+    // Get origin's db file path, delete entry in tracker's db, then delete db file.
+    SQLiteStatement pathStatement(m_database, "SELECT path FROM Origins WHERE origin=?");
+    if (pathStatement.prepare() != SQLResultOk) {
+        LOG_ERROR("Unable to prepare selection of path for origin '%s'", originIdentifier.ascii().data());
+        return;
+    }
+    pathStatement.bindText(1, originIdentifier);
+    int result = pathStatement.step();
+    if (result != SQLResultRow) {
+        LOG_ERROR("Unable to find origin '%s' in Origins table", originIdentifier.ascii().data());
+        return;
+    }
+    
+    String path = pathStatement.getColumnText(0);
+
+    ASSERT(!path.isEmpty());
+    
+    SQLiteStatement deleteStatement(m_database, "DELETE FROM Origins where origin=?");
+    if (deleteStatement.prepare() != SQLResultOk) {
+        LOG_ERROR("Unable to prepare deletion of origin '%s'", originIdentifier.ascii().data());
+        return;
+    }
+    deleteStatement.bindText(1, originIdentifier);
+    if (!deleteStatement.executeCommand()) {
+        LOG_ERROR("Unable to execute deletion of origin '%s'", originIdentifier.ascii().data());
+        return;
+    }
+
+    SQLiteFileSystem::deleteDatabaseFile(path);
+    
+    bool shouldDeleteTrackerFiles = false;
+    {
+        MutexLocker originLock(m_originSetGuard);
+        m_originSet.remove(originIdentifier);
+        shouldDeleteTrackerFiles = m_originSet.isEmpty();
+    }
+
+    if (shouldDeleteTrackerFiles) {
+        m_database.close();
+        SQLiteFileSystem::deleteDatabaseFile(trackerDatabasePath());
+        SQLiteFileSystem::deleteEmptyDatabaseDirectory(m_storageDirectoryPath);
+    }
+
+    {
+        MutexLocker lockClient(m_clientGuard);
+        if (m_client)
+            m_client->dispatchDidModifyOrigin(originIdentifier);
+    }
+}
+    
+void StorageTracker::willDeleteAllOrigins()
+{
+    ASSERT(!m_originSetGuard.tryLock());
+
+    OriginSet::const_iterator end = m_originSet.end();
+    for (OriginSet::const_iterator it = m_originSet.begin(); it != end; ++it)
+        m_originsBeingDeleted.add((*it).threadsafeCopy());
+}
+
+void StorageTracker::willDeleteOrigin(const String& originIdentifier)
+{
+    ASSERT(isMainThread());
+    ASSERT(!m_originSetGuard.tryLock());
+
+    m_originsBeingDeleted.add(originIdentifier);
+}
+    
+bool StorageTracker::canDeleteOrigin(const String& originIdentifier)
+{
+    ASSERT(!m_databaseGuard.tryLock());
+    MutexLocker lockOrigins(m_originSetGuard);
+    return m_originsBeingDeleted.contains(originIdentifier);
+}
+
+void StorageTracker::cancelDeletingOrigin(const String& originIdentifier)
+{
+    if (!m_isActive)
+        return;
+
+    MutexLocker lockDatabase(m_databaseGuard);
+    MutexLocker lockOrigins(m_originSetGuard);
+    if (!m_originsBeingDeleted.isEmpty())
+        m_originsBeingDeleted.remove(originIdentifier);
+}
+
+void StorageTracker::setClient(StorageTrackerClient* client)
+{
+    MutexLocker lockClient(m_clientGuard);
+    m_client = client;
+}
+
+void StorageTracker::syncLocalStorage()
+{
+    PageGroup::syncLocalStorage();
+}
+    
+bool StorageTracker::isActive()
+{
+    return m_isActive;
+}
+
+void StorageTracker::setIsActive(bool flag)
+{
+    m_isActive = flag;
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(DOM_STORAGE)
diff --git a/Source/WebCore/storage/StorageTracker.h b/Source/WebCore/storage/StorageTracker.h
new file mode 100644
index 0000000..04a821b
--- /dev/null
+++ b/Source/WebCore/storage/StorageTracker.h
@@ -0,0 +1,117 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef StorageTracker_h
+#define StorageTracker_h
+
+#if ENABLE(DOM_STORAGE)
+    
+#include "PlatformString.h"
+#include "SQLiteDatabase.h"
+#include <wtf/HashSet.h>
+#include <wtf/OwnPtr.h>
+#include <wtf/Vector.h>
+#include <wtf/text/StringHash.h>
+
+namespace WebCore {
+
+class LocalStorageTask;
+class LocalStorageThread;
+class SecurityOrigin;
+class StorageTrackerClient;    
+
+class StorageTracker {
+    WTF_MAKE_NONCOPYABLE(StorageTracker);
+    WTF_MAKE_FAST_ALLOCATED;
+public:
+    static void initializeTracker(const String& storagePath);
+    static StorageTracker& tracker();
+    static void scheduleTask(void*);
+
+    void importOriginIdentifiers();
+    void setOriginDetails(const String& originIdentifier, const String& databaseFile);
+    
+    void deleteAllOrigins();
+    void deleteOrigin(SecurityOrigin*);
+    void deleteOrigin(const String& originIdentifier);
+    void origins(Vector<RefPtr<SecurityOrigin> >& result);
+
+    void cancelDeletingOrigin(const String& originIdentifier);
+    
+    void setClient(StorageTrackerClient*);
+    
+    bool isActive();
+
+    // Sync to disk on background thread.
+    void syncDeleteAllOrigins();
+    void syncDeleteOrigin(const String& originIdentifier);
+    void syncSetOriginDetails(const String& originIdentifier, const String& databaseFile);
+    void syncImportOriginIdentifiers();
+    void syncFileSystemAndTrackerDatabase();
+
+    void syncLocalStorage();
+
+private:
+    StorageTracker(const String& storagePath);
+
+    String trackerDatabasePath();
+    void openTrackerDatabase(bool createIfDoesNotExist);
+
+    void setStorageDirectoryPath(const String&);
+
+    void deleteTrackerFiles();
+
+    bool canDeleteOrigin(const String& originIdentifier);
+    void willDeleteOrigin(const String& originIdentifier);
+    void willDeleteAllOrigins();
+
+    void originFilePaths(Vector<String>& paths);
+    
+    void setIsActive(bool);
+
+    // Guard for m_database, m_storageDirectoryPath and static Strings in syncFileSystemAndTrackerDatabase().
+    Mutex m_databaseGuard;
+    SQLiteDatabase m_database;
+    String m_storageDirectoryPath;
+
+    Mutex m_clientGuard;
+    StorageTrackerClient* m_client;
+
+    // Guard for m_originSet and m_originsBeingDeleted.
+    Mutex m_originSetGuard;
+    typedef HashSet<String> OriginSet;
+    OriginSet m_originSet;
+    OriginSet m_originsBeingDeleted;
+
+    OwnPtr<LocalStorageThread> m_thread;
+    
+    bool m_isActive;
+};
+    
+} // namespace WebCore
+
+#endif // ENABLE(DOM_STORAGE)
+
+#endif // StorageTracker_h
diff --git a/Source/WebCore/storage/StorageTrackerClient.h b/Source/WebCore/storage/StorageTrackerClient.h
new file mode 100644
index 0000000..9c2d53e
--- /dev/null
+++ b/Source/WebCore/storage/StorageTrackerClient.h
@@ -0,0 +1,41 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+ 
+#ifndef StorageTrackerClient_h
+#define StorageTrackerClient_h
+
+#include <wtf/Forward.h>
+
+namespace WebCore {
+
+class StorageTrackerClient {
+public:
+    virtual ~StorageTrackerClient() { }
+    virtual void dispatchDidModifyOrigin(const String& originIdentifier) = 0;
+};
+
+} // namespace WebCore
+
+#endif // StorageTrackerClient_h
diff --git a/Source/WebCore/svg/SVGAElement.cpp b/Source/WebCore/svg/SVGAElement.cpp
index 601b432..4d02c69 100644
--- a/Source/WebCore/svg/SVGAElement.cpp
+++ b/Source/WebCore/svg/SVGAElement.cpp
@@ -195,7 +195,7 @@ void SVGAElement::defaultEventHandler(Event* event)
 
 bool SVGAElement::supportsFocus() const
 {
-    if (isContentEditable())
+    if (rendererIsEditable())
         return SVGStyledTransformableElement::supportsFocus();
     return true;
 }
diff --git a/Source/WebCore/svg/SVGComponentTransferFunctionElement.cpp b/Source/WebCore/svg/SVGComponentTransferFunctionElement.cpp
index c35a344..6ed5813 100644
--- a/Source/WebCore/svg/SVGComponentTransferFunctionElement.cpp
+++ b/Source/WebCore/svg/SVGComponentTransferFunctionElement.cpp
@@ -81,6 +81,17 @@ void SVGComponentTransferFunctionElement::parseMappedAttribute(Attribute* attr)
         SVGElement::parseMappedAttribute(attr);
 }
 
+void SVGComponentTransferFunctionElement::svgAttributeChanged(const QualifiedName& attrName)
+{
+    SVGElement::svgAttributeChanged(attrName);
+
+    if (attrName == SVGNames::typeAttr) {
+        ComponentTransferType componentType = static_cast<ComponentTransferType>(type());
+        if (componentType < FECOMPONENTTRANSFER_TYPE_UNKNOWN || componentType > FECOMPONENTTRANSFER_TYPE_GAMMA)
+            setTypeBaseValue(FECOMPONENTTRANSFER_TYPE_UNKNOWN);
+    }
+}
+
 void SVGComponentTransferFunctionElement::synchronizeProperty(const QualifiedName& attrName)
 {
     SVGElement::synchronizeProperty(attrName);
diff --git a/Source/WebCore/svg/SVGComponentTransferFunctionElement.h b/Source/WebCore/svg/SVGComponentTransferFunctionElement.h
index 2be693b..931e52e 100644
--- a/Source/WebCore/svg/SVGComponentTransferFunctionElement.h
+++ b/Source/WebCore/svg/SVGComponentTransferFunctionElement.h
@@ -37,6 +37,7 @@ protected:
     SVGComponentTransferFunctionElement(const QualifiedName&, Document*);
 
     virtual void parseMappedAttribute(Attribute*);
+    virtual void svgAttributeChanged(const QualifiedName&);
     virtual void synchronizeProperty(const QualifiedName&);
     virtual void fillAttributeToPropertyTypeMap();
     virtual AttributeToPropertyTypeMap& attributeToPropertyTypeMap();
diff --git a/Source/WebCore/svg/SVGElement.cpp b/Source/WebCore/svg/SVGElement.cpp
index 4630ccb..044f439 100644
--- a/Source/WebCore/svg/SVGElement.cpp
+++ b/Source/WebCore/svg/SVGElement.cpp
@@ -316,12 +316,9 @@ void SVGElement::sendSVGLoadEventIfPossible(bool sendParentLoadEvents)
         RefPtr<Node> parent;
         if (sendParentLoadEvents)
             parent = currentTarget->parentNode(); // save the next parent to dispatch too incase dispatching the event changes the tree
-        if (hasLoadListener(currentTarget.get())) {
-            RefPtr<Event> event = Event::create(eventNames().loadEvent, false, false);
-            event->setTarget(currentTarget);
-            currentTarget->dispatchGenericEvent(event.release());
-        }
-        currentTarget = (parent && parent->isSVGElement()) ? static_pointer_cast<SVGElement>(parent) : 0;
+        if (hasLoadListener(currentTarget.get()))
+            currentTarget->dispatchEvent(Event::create(eventNames().loadEvent, false, false));
+        currentTarget = (parent && parent->isSVGElement()) ? static_pointer_cast<SVGElement>(parent) : RefPtr<SVGElement>();
     }
 }
 
diff --git a/Source/WebCore/svg/SVGElementInstance.cpp b/Source/WebCore/svg/SVGElementInstance.cpp
index a873f0b..6b9c085 100644
--- a/Source/WebCore/svg/SVGElementInstance.cpp
+++ b/Source/WebCore/svg/SVGElementInstance.cpp
@@ -1,6 +1,7 @@
 /*
  * Copyright (C) 2007, 2008 Nikolas Zimmermann <zimmermann@kde.org>
  * Copyright (C) Research In Motion Limited 2010. All rights reserved.
+ * Copyright (C) 2011 Torch Mobile (Beijing) Co. Ltd. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -40,15 +41,16 @@ namespace WebCore {
 static WTF::RefCountedLeakCounter instanceCounter("WebCoreSVGElementInstance");
 #endif
 
-SVGElementInstance::SVGElementInstance(SVGUseElement* useElement, PassRefPtr<SVGElement> originalElement)
-    : m_useElement(useElement)
+SVGElementInstance::SVGElementInstance(SVGUseElement* correspondingUseElement, SVGUseElement* directUseElement, PassRefPtr<SVGElement> originalElement)
+    : m_correspondingUseElement(correspondingUseElement)
+    , m_directUseElement(directUseElement)
     , m_element(originalElement)
     , m_previousSibling(0)
     , m_nextSibling(0)
     , m_firstChild(0)
     , m_lastChild(0)
 {
-    ASSERT(m_useElement);
+    ASSERT(m_correspondingUseElement);
     ASSERT(m_element);
 
     // Register as instance for passed element.
@@ -131,19 +133,13 @@ void SVGElementInstance::removeAllEventListeners()
     m_element->removeAllEventListeners();
 }
 
-bool SVGElementInstance::dispatchEvent(PassRefPtr<Event> prpEvent)
+bool SVGElementInstance::dispatchEvent(PassRefPtr<Event> event)
 {
-    RefPtr<EventTarget> protect = this;
-    RefPtr<Event> event = prpEvent;
-
-    event->setTarget(this);
-
     SVGElement* element = shadowTreeElement();
     if (!element)
         return false;
 
-    RefPtr<FrameView> view = element->document()->view();
-    return element->dispatchGenericEvent(event.release());
+    return element->dispatchEvent(event);
 }
 
 EventTargetData* SVGElementInstance::eventTargetData()
diff --git a/Source/WebCore/svg/SVGElementInstance.h b/Source/WebCore/svg/SVGElementInstance.h
index 6dbcff4..2a8c52f 100644
--- a/Source/WebCore/svg/SVGElementInstance.h
+++ b/Source/WebCore/svg/SVGElementInstance.h
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2007, 2008 Nikolas Zimmermann <zimmermann@kde.org>
+ * Copyright (C) 2011 Torch Mobile (Beijing) Co. Ltd. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -39,9 +40,9 @@ class SVGElementInstanceList;
 class SVGElementInstance : public TreeShared<SVGElementInstance>,
                            public EventTarget {
 public:
-    static PassRefPtr<SVGElementInstance> create(SVGUseElement* useElement, PassRefPtr<SVGElement> originalElement)
+    static PassRefPtr<SVGElementInstance> create(SVGUseElement* correspondingUseElement, SVGUseElement* directUseElement, PassRefPtr<SVGElement> originalElement)
     {
-        return adoptRef(new SVGElementInstance(useElement, originalElement));
+        return adoptRef(new SVGElementInstance(correspondingUseElement, directUseElement, originalElement));
     }
 
     virtual ~SVGElementInstance();
@@ -55,9 +56,14 @@ public:
     virtual bool dispatchEvent(PassRefPtr<Event>);
 
     SVGElement* correspondingElement() const { return m_element.get(); }
-    SVGUseElement* correspondingUseElement() const { return m_useElement; }
+    SVGUseElement* correspondingUseElement() const { return m_correspondingUseElement; }
+    SVGUseElement* directUseElement() const { return m_directUseElement; }
     SVGElement* shadowTreeElement() const { return m_shadowTreeElement.get(); }
-    void clearUseElement() { m_useElement = 0; }
+    void clearUseElements()
+    {
+        m_directUseElement = 0;
+        m_correspondingUseElement = 0;
+    }
 
     SVGElementInstance* parentNode() const { return parent(); }
     PassRefPtr<SVGElementInstanceList> childNodes();
@@ -120,7 +126,7 @@ public:
 private:
     friend class SVGUseElement;
 
-    SVGElementInstance(SVGUseElement*, PassRefPtr<SVGElement> originalElement);
+    SVGElementInstance(SVGUseElement*, SVGUseElement*, PassRefPtr<SVGElement> originalElement);
 
     virtual Node* toNode() { return shadowTreeElement(); }
     virtual SVGElementInstance* toSVGElementInstance() { return this; }
@@ -150,7 +156,8 @@ private:
     virtual EventTargetData* eventTargetData();
     virtual EventTargetData* ensureEventTargetData();
 
-    SVGUseElement* m_useElement;
+    SVGUseElement* m_correspondingUseElement;
+    SVGUseElement* m_directUseElement;
     RefPtr<SVGElement> m_element;
     RefPtr<SVGElement> m_shadowTreeElement;
 
diff --git a/Source/WebCore/svg/SVGFEDisplacementMapElement.cpp b/Source/WebCore/svg/SVGFEDisplacementMapElement.cpp
index 873f85a..1429b34 100644
--- a/Source/WebCore/svg/SVGFEDisplacementMapElement.cpp
+++ b/Source/WebCore/svg/SVGFEDisplacementMapElement.cpp
@@ -97,13 +97,19 @@ void SVGFEDisplacementMapElement::svgAttributeChanged(const QualifiedName& attrN
 {
     SVGFilterPrimitiveStandardAttributes::svgAttributeChanged(attrName);
 
-    if (attrName == SVGNames::xChannelSelectorAttr
-        || attrName == SVGNames::yChannelSelectorAttr
-        || attrName == SVGNames::scaleAttr)
+    if (attrName == SVGNames::xChannelSelectorAttr) {
+        ChannelSelectorType selector = static_cast<ChannelSelectorType>(xChannelSelector());
+        if (CHANNEL_UNKNOWN > selector || selector > CHANNEL_A)
+            setXChannelSelectorBaseValue(CHANNEL_UNKNOWN);
         primitiveAttributeChanged(attrName);
-
-    if (attrName == SVGNames::inAttr
-        || attrName == SVGNames::in2Attr)
+    } else if (attrName == SVGNames::yChannelSelectorAttr) {
+        ChannelSelectorType selector = static_cast<ChannelSelectorType>(yChannelSelector());
+        if (CHANNEL_UNKNOWN > selector || selector > CHANNEL_A)
+            setYChannelSelectorBaseValue(CHANNEL_UNKNOWN);
+        primitiveAttributeChanged(attrName);
+    } else if (attrName == SVGNames::scaleAttr)
+        primitiveAttributeChanged(attrName);
+    else if (attrName == SVGNames::inAttr || attrName == SVGNames::in2Attr)
         invalidate();
 }
 
diff --git a/Source/WebCore/svg/SVGTitleElement.cpp b/Source/WebCore/svg/SVGTitleElement.cpp
index 6281f10..ebcddb4 100644
--- a/Source/WebCore/svg/SVGTitleElement.cpp
+++ b/Source/WebCore/svg/SVGTitleElement.cpp
@@ -40,7 +40,7 @@ void SVGTitleElement::insertedIntoDocument()
 {
     SVGStyledElement::insertedIntoDocument();
     if (firstChild())
-        document()->setTitle(textContent(), this);
+        document()->setTitleElement(textContent(), this);
 }
 
 void SVGTitleElement::removedFromDocument()
@@ -53,7 +53,7 @@ void SVGTitleElement::childrenChanged(bool changedByParser, Node* beforeChange,
 {
     SVGElement::childrenChanged(changedByParser, beforeChange, afterChange, childCountDelta);
     if (inDocument())
-        document()->setTitle(textContent(), this);
+        document()->setTitleElement(textContent(), this);
 }
 
 AttributeToPropertyTypeMap& SVGTitleElement::attributeToPropertyTypeMap()
diff --git a/Source/WebCore/svg/SVGUseElement.cpp b/Source/WebCore/svg/SVGUseElement.cpp
index 4239f66..21f0954 100644
--- a/Source/WebCore/svg/SVGUseElement.cpp
+++ b/Source/WebCore/svg/SVGUseElement.cpp
@@ -239,11 +239,15 @@ void SVGUseElement::fillAttributeToPropertyTypeMap()
     attributeToPropertyTypeMap.set(XLinkNames::hrefAttr, AnimatedString);
 }
 
-static void updateContainerSize(SVGUseElement* useElement, SVGElementInstance* targetInstance)
+static void updateContainerSize(SVGElementInstance* targetInstance)
 {
     // Depth-first used to write the method in early exit style, no particular other reason.
     for (SVGElementInstance* instance = targetInstance->firstChild(); instance; instance = instance->nextSibling())
-        updateContainerSize(useElement, instance);
+        updateContainerSize(instance);
+
+    SVGUseElement* useElement = targetInstance->directUseElement();
+    if (!useElement)
+        return;
 
     SVGElement* correspondingElement = targetInstance->correspondingElement();
     ASSERT(correspondingElement);
@@ -281,7 +285,8 @@ void SVGUseElement::updateContainerSizes()
         return;
 
     // Update whole subtree, scanning for shadow container elements, that correspond to <svg>/<symbol> tags
-    updateContainerSize(this, m_targetElementInstance.get());
+    ASSERT(m_targetElementInstance->directUseElement() == this);
+    updateContainerSize(m_targetElementInstance.get());
 
     if (RenderObject* object = renderer())
         RenderSVGResource::markForLayoutAndParentResourceInvalidation(object);
@@ -380,6 +385,9 @@ void dumpInstanceTree(unsigned int& depth, String& text, SVGElementInstance* tar
     SVGElement* shadowTreeElement = targetInstance->shadowTreeElement();
     ASSERT(shadowTreeElement);
 
+    SVGUseElement* directUseElement = targetInstance->directUseElement();
+    String directUseElementName = directUseElement ? directUseElement->nodeName() : "null";
+
     String elementId = element->getIdAttribute();
     String elementNodeName = element->nodeName();
     String shadowTreeElementNodeName = shadowTreeElement->nodeName();
@@ -389,9 +397,9 @@ void dumpInstanceTree(unsigned int& depth, String& text, SVGElementInstance* tar
     for (unsigned int i = 0; i < depth; ++i)
         text += "  ";
 
-    text += String::format("SVGElementInstance this=%p, (parentNode=%s (%p), firstChild=%s (%p), correspondingElement=%s (%p), shadowTreeElement=%s (%p), id=%s)\n",
+    text += String::format("SVGElementInstance this=%p, (parentNode=%s (%p), firstChild=%s (%p), correspondingElement=%s (%p), directUseElement=%s (%p), shadowTreeElement=%s (%p), id=%s)\n",
                            targetInstance, parentNodeName.latin1().data(), element->parentNode(), firstChildNodeName.latin1().data(), element->firstChild(),
-                           elementNodeName.latin1().data(), element, shadowTreeElementNodeName.latin1().data(), shadowTreeElement, elementId.latin1().data());
+                           elementNodeName.latin1().data(), element, directUseElementName.latin1().data(), directUseElement, shadowTreeElementNodeName.latin1().data(), shadowTreeElement, elementId.latin1().data());
 
     for (unsigned int i = 0; i < depth; ++i)
         text += "  ";
@@ -533,7 +541,7 @@ void SVGUseElement::buildShadowAndInstanceTree(SVGShadowTreeRootElement* shadowR
     // Spec: If the 'use' element references a simple graphics element such as a 'rect', then there is only a
     // single SVGElementInstance object, and the correspondingElement attribute on this SVGElementInstance object
     // is the SVGRectElement that corresponds to the referenced 'rect' element.
-    m_targetElementInstance = SVGElementInstance::create(this, target);
+    m_targetElementInstance = SVGElementInstance::create(this, this, target);
 
     // Eventually enter recursion to build SVGElementInstance objects for the sub-tree children
     bool foundProblem = false;
@@ -550,6 +558,7 @@ void SVGUseElement::buildShadowAndInstanceTree(SVGShadowTreeRootElement* shadowR
     ASSERT(m_targetElementInstance);
     ASSERT(!m_targetElementInstance->shadowTreeElement());
     ASSERT(m_targetElementInstance->correspondingUseElement() == this);
+    ASSERT(m_targetElementInstance->directUseElement() == this);
     ASSERT(m_targetElementInstance->correspondingElement() == target);
 
     // Build shadow tree from instance tree
@@ -559,11 +568,11 @@ void SVGUseElement::buildShadowAndInstanceTree(SVGShadowTreeRootElement* shadowR
 #if ENABLE(SVG) && ENABLE(SVG_USE)
     // Expand all <use> elements in the shadow tree.
     // Expand means: replace the actual <use> element by what it references.
-    expandUseElementsInShadowTree(shadowRoot, shadowRoot);
+    expandUseElementsInShadowTree(shadowRoot);
 
     // Expand all <symbol> elements in the shadow tree.
     // Expand means: replace the actual <symbol> element by the <svg> element.
-    expandSymbolElementsInShadowTree(shadowRoot, shadowRoot);
+    expandSymbolElementsInShadowTree(shadowRoot);
 #endif
 
     // Now that the shadow tree is completly expanded, we can associate
@@ -582,6 +591,16 @@ void SVGUseElement::buildShadowAndInstanceTree(SVGShadowTreeRootElement* shadowR
     // Consistency checks - this is assumed in updateContainerOffset().
     ASSERT(m_targetElementInstance->shadowTreeElement()->parentNode() == shadowRoot);
 
+    // Transfer event listeners assigned to the referenced element to our shadow tree elements.
+    transferEventListenersToShadowTree(m_targetElementInstance.get());
+
+    // Update container offset/size
+    updateContainerOffsets();
+    updateContainerSizes();
+
+    // Update relative length information
+    updateRelativeLengthsInformation();
+
     // Eventually dump instance tree
 #ifdef DUMP_INSTANCE_TREE
     String text;
@@ -602,23 +621,13 @@ void SVGUseElement::buildShadowAndInstanceTree(SVGShadowTreeRootElement* shadowR
 
     fprintf(stderr, "Dumping <use> shadow tree markup:\n%s\n", markup.latin1().data());
 #endif
-
-    // Transfer event listeners assigned to the referenced element to our shadow tree elements.
-    transferEventListenersToShadowTree(m_targetElementInstance.get());
-
-    // Update container offset/size
-    updateContainerOffsets();
-    updateContainerSizes();
-
-    // Update relative length information
-    updateRelativeLengthsInformation();
 }
 
 void SVGUseElement::detachInstance()
 {
     if (!m_targetElementInstance)
         return;
-    m_targetElementInstance->clearUseElement();
+    m_targetElementInstance->clearUseElements();
     m_targetElementInstance = 0;
 }
 
@@ -722,7 +731,7 @@ void SVGUseElement::buildInstanceTree(SVGElement* target, SVGElementInstance* ta
             continue;
 
         // Create SVGElementInstance object, for both container/non-container nodes.
-        RefPtr<SVGElementInstance> instance = SVGElementInstance::create(this, element);
+        RefPtr<SVGElementInstance> instance = SVGElementInstance::create(this, 0, element);
         SVGElementInstance* instancePtr = instance.get();
         targetInstance->appendChild(instance.release());
 
@@ -735,7 +744,7 @@ void SVGUseElement::buildInstanceTree(SVGElement* target, SVGElementInstance* ta
     if (!targetHasUseTag || !newTarget)
         return;
 
-    RefPtr<SVGElementInstance> newInstance = SVGElementInstance::create(this, newTarget);
+    RefPtr<SVGElementInstance> newInstance = SVGElementInstance::create(this, static_cast<SVGUseElement*>(target), newTarget);
     SVGElementInstance* newInstancePtr = newInstance.get();
     targetInstance->appendChild(newInstance.release());
     buildInstanceTree(newTarget, newInstancePtr, foundProblem);
@@ -812,7 +821,7 @@ void SVGUseElement::buildShadowTree(SVGShadowTreeRootElement* shadowRoot, SVGEle
 }
 
 #if ENABLE(SVG) && ENABLE(SVG_USE)
-void SVGUseElement::expandUseElementsInShadowTree(SVGShadowTreeRootElement* shadowRoot, Node* element)
+void SVGUseElement::expandUseElementsInShadowTree(Node* element)
 {
     // Why expand the <use> elements in the shadow tree here, and not just
     // do this directly in buildShadowTree, if we encounter a <use> element?
@@ -860,21 +869,25 @@ void SVGUseElement::expandUseElementsInShadowTree(SVGShadowTreeRootElement* shad
         if (subtreeContainsDisallowedElement(cloneParent.get()))
             removeDisallowedElementsFromSubtree(cloneParent.get());
 
+        RefPtr<Node> replacingElement(cloneParent.get());
+
         // Replace <use> with referenced content.
         ASSERT(use->parentNode()); 
         use->parentNode()->replaceChild(cloneParent.release(), use, ec);
         ASSERT(!ec);
 
-        // Immediately stop here, and restart expanding.
-        expandUseElementsInShadowTree(shadowRoot, shadowRoot);
-        return;
+        // Expand the siblings because the *element* is replaced and we will
+        // lose the sibling chain when we are back from recursion.
+        element = replacingElement.get();
+        for (RefPtr<Node> sibling = element->nextSibling(); sibling; sibling = sibling->nextSibling())
+            expandUseElementsInShadowTree(sibling.get());
     }
 
     for (RefPtr<Node> child = element->firstChild(); child; child = child->nextSibling())
-        expandUseElementsInShadowTree(shadowRoot, child.get());
+        expandUseElementsInShadowTree(child.get());
 }
 
-void SVGUseElement::expandSymbolElementsInShadowTree(SVGShadowTreeRootElement* shadowRoot, Node* element)
+void SVGUseElement::expandSymbolElementsInShadowTree(Node* element)
 {
     if (element->hasTagName(SVGNames::symbolTag)) {
         // Spec: The referenced 'symbol' and its contents are deep-cloned into the generated tree,
@@ -904,18 +917,22 @@ void SVGUseElement::expandSymbolElementsInShadowTree(SVGShadowTreeRootElement* s
         if (subtreeContainsDisallowedElement(svgElement.get()))
             removeDisallowedElementsFromSubtree(svgElement.get());
 
+        RefPtr<Node> replacingElement(svgElement.get());
+
         // Replace <symbol> with <svg>.
         ASSERT(element->parentNode()); 
         element->parentNode()->replaceChild(svgElement.release(), element, ec);
         ASSERT(!ec);
 
-        // Immediately stop here, and restart expanding.
-        expandSymbolElementsInShadowTree(shadowRoot, shadowRoot);
-        return;
+        // Expand the siblings because the *element* is replaced and we will
+        // lose the sibling chain when we are back from recursion.
+        element = replacingElement.get();
+        for (RefPtr<Node> sibling = element->nextSibling(); sibling; sibling = sibling->nextSibling())
+            expandSymbolElementsInShadowTree(sibling.get());
     }
 
     for (RefPtr<Node> child = element->firstChild(); child; child = child->nextSibling())
-        expandSymbolElementsInShadowTree(shadowRoot, child.get());
+        expandSymbolElementsInShadowTree(child.get());
 }
 
 #endif
diff --git a/Source/WebCore/svg/SVGUseElement.h b/Source/WebCore/svg/SVGUseElement.h
index 10c9be9..30569b5 100644
--- a/Source/WebCore/svg/SVGUseElement.h
+++ b/Source/WebCore/svg/SVGUseElement.h
@@ -91,8 +91,8 @@ private:
     void buildShadowTree(SVGShadowTreeRootElement*, SVGElement* target, SVGElementInstance* targetInstance);
 
 #if ENABLE(SVG) && ENABLE(SVG_USE)
-    void expandUseElementsInShadowTree(SVGShadowTreeRootElement*, Node* element);
-    void expandSymbolElementsInShadowTree(SVGShadowTreeRootElement*, Node* element);
+    void expandUseElementsInShadowTree(Node* element);
+    void expandSymbolElementsInShadowTree(Node* element);
 #endif
 
     // "Tree connector" 
diff --git a/Source/WebCore/svg/properties/SVGAnimatedPropertyDescription.h b/Source/WebCore/svg/properties/SVGAnimatedPropertyDescription.h
index 6fb5e66..5fbaf9e 100644
--- a/Source/WebCore/svg/properties/SVGAnimatedPropertyDescription.h
+++ b/Source/WebCore/svg/properties/SVGAnimatedPropertyDescription.h
@@ -69,7 +69,7 @@ struct SVGAnimatedPropertyDescription {
 struct SVGAnimatedPropertyDescriptionHash {
     static unsigned hash(const SVGAnimatedPropertyDescription& key)
     {
-        return WTF::StringHasher::createBlobHash<sizeof(SVGAnimatedPropertyDescription)>(&key);
+        return StringHasher::hashMemory<sizeof(SVGAnimatedPropertyDescription)>(&key);
     }
 
     static bool equal(const SVGAnimatedPropertyDescription& a, const SVGAnimatedPropertyDescription& b)
diff --git a/Source/WebCore/websockets/ThreadableWebSocketChannelClientWrapper.h b/Source/WebCore/websockets/ThreadableWebSocketChannelClientWrapper.h
index 4099615..683ee84 100644
--- a/Source/WebCore/websockets/ThreadableWebSocketChannelClientWrapper.h
+++ b/Source/WebCore/websockets/ThreadableWebSocketChannelClientWrapper.h
@@ -42,7 +42,7 @@
 
 namespace WebCore {
 
-class ThreadableWebSocketChannelClientWrapper : public ThreadSafeShared<ThreadableWebSocketChannelClientWrapper> {
+class ThreadableWebSocketChannelClientWrapper : public ThreadSafeRefCounted<ThreadableWebSocketChannelClientWrapper> {
 public:
     static PassRefPtr<ThreadableWebSocketChannelClientWrapper> create(WebSocketChannelClient* client)
     {
diff --git a/Source/WebCore/websockets/WebSocket.cpp b/Source/WebCore/websockets/WebSocket.cpp
index e15d079..5dfd48b 100644
--- a/Source/WebCore/websockets/WebSocket.cpp
+++ b/Source/WebCore/websockets/WebSocket.cpp
@@ -283,7 +283,10 @@ void WebSocket::didClose(unsigned long unhandledBufferedAmount)
     m_bufferedAmountAfterClose += unhandledBufferedAmount;
     ASSERT(scriptExecutionContext());
     dispatchEvent(Event::create(eventNames().closeEvent, false, false));
-    m_channel = 0;
+    if (m_channel) {
+        m_channel->disconnect();
+        m_channel = 0;
+    }
     if (hasPendingActivity())
         ActiveDOMObject::unsetPendingActivity(this);
 }
diff --git a/Source/WebCore/wml/WMLInputElement.cpp b/Source/WebCore/wml/WMLInputElement.cpp
index 80e4e70..5d35be3 100644
--- a/Source/WebCore/wml/WMLInputElement.cpp
+++ b/Source/WebCore/wml/WMLInputElement.cpp
@@ -307,8 +307,8 @@ void WMLInputElement::defaultEventHandler(Event* evt)
 
     if (clickDefaultFormButton) {
         // Fire onChange for text fields.
-        if (wasChangedSinceLastChangeEvent()) {
-            setChangedSinceLastChangeEvent(false);
+        if (wasChangedSinceLastFormControlChangeEvent()) {
+            setChangedSinceLastFormControlChangeEvent(false);
             dispatchEvent(Event::create(eventNames().changeEvent, true, false));
         }
 
diff --git a/Source/WebCore/wml/WMLInputElement.h b/Source/WebCore/wml/WMLInputElement.h
index 558147a..4cffef8 100644
--- a/Source/WebCore/wml/WMLInputElement.h
+++ b/Source/WebCore/wml/WMLInputElement.h
@@ -36,6 +36,8 @@ public:
     WMLInputElement(const QualifiedName& tagName, Document*);
     virtual ~WMLInputElement();
 
+    virtual InputElement* toInputElement() { return this; }
+
     virtual bool isKeyboardFocusable(KeyboardEvent*) const;
     virtual bool isMouseFocusable() const;
     virtual void dispatchFocusEvent();
diff --git a/Source/WebCore/workers/DefaultSharedWorkerRepository.cpp b/Source/WebCore/workers/DefaultSharedWorkerRepository.cpp
index c20cd30..31b2d4f 100644
--- a/Source/WebCore/workers/DefaultSharedWorkerRepository.cpp
+++ b/Source/WebCore/workers/DefaultSharedWorkerRepository.cpp
@@ -58,7 +58,7 @@
 
 namespace WebCore {
 
-class SharedWorkerProxy : public ThreadSafeShared<SharedWorkerProxy>, public WorkerLoaderProxy, public WorkerReportingProxy {
+class SharedWorkerProxy : public ThreadSafeRefCounted<SharedWorkerProxy>, public WorkerLoaderProxy, public WorkerReportingProxy {
 public:
     static PassRefPtr<SharedWorkerProxy> create(const String& name, const KURL& url, PassRefPtr<SecurityOrigin> origin) { return adoptRef(new SharedWorkerProxy(name, url, origin)); }
 
diff --git a/Source/WebCore/workers/WorkerContext.cpp b/Source/WebCore/workers/WorkerContext.cpp
index acf7f04..3b14e59 100644
--- a/Source/WebCore/workers/WorkerContext.cpp
+++ b/Source/WebCore/workers/WorkerContext.cpp
@@ -67,9 +67,12 @@
 
 #if ENABLE(FILE_SYSTEM)
 #include "AsyncFileSystem.h"
+#include "DirectoryEntrySync.h"
 #include "DOMFileSystem.h"
+#include "DOMFileSystemBase.h"
 #include "DOMFileSystemSync.h"
 #include "ErrorCallback.h"
+#include "FileEntrySync.h"
 #include "FileError.h"
 #include "FileException.h"
 #include "FileSystemCallback.h"
@@ -377,6 +380,53 @@ PassRefPtr<DOMFileSystemSync> WorkerContext::requestFileSystemSync(int type, lon
     return helper.getResult(ec);
 }
 
+void WorkerContext::resolveLocalFileSystemURL(const String& url, PassRefPtr<EntryCallback> successCallback, PassRefPtr<ErrorCallback> errorCallback)
+{
+    KURL completedURL = completeURL(url);
+    if (!AsyncFileSystem::isAvailable() || !securityOrigin()->canAccessFileSystem() || !securityOrigin()->canRequest(completedURL)) {
+        DOMFileSystem::scheduleCallback(this, errorCallback, FileError::create(FileError::SECURITY_ERR));
+        return;
+    }
+
+    AsyncFileSystem::Type type;
+    String filePath;
+    if (!completedURL.isValid() || !DOMFileSystemBase::crackFileSystemURL(completedURL, type, filePath)) {
+        DOMFileSystem::scheduleCallback(this, errorCallback, FileError::create(FileError::ENCODING_ERR));
+        return;
+    }
+
+    LocalFileSystem::localFileSystem().readFileSystem(this, type, ResolveURICallbacks::create(successCallback, errorCallback, this, filePath));
+}
+
+PassRefPtr<EntrySync> WorkerContext::resolveLocalFileSystemSyncURL(const String& url, ExceptionCode& ec)
+{
+    ec = 0;
+    KURL completedURL = completeURL(url);
+    if (!AsyncFileSystem::isAvailable() || !securityOrigin()->canAccessFileSystem() || !securityOrigin()->canRequest(completedURL)) {
+        ec = FileException::SECURITY_ERR;
+        return 0;
+    }
+
+    AsyncFileSystem::Type type;
+    String filePath;
+    if (!completedURL.isValid() || !DOMFileSystemBase::crackFileSystemURL(completedURL, type, filePath)) {
+        ec = FileException::ENCODING_ERR;
+        return 0;
+    }
+
+    FileSystemSyncCallbackHelper readFileSystemHelper;
+    LocalFileSystem::localFileSystem().readFileSystem(this, type, FileSystemCallbacks::create(readFileSystemHelper.successCallback(), readFileSystemHelper.errorCallback(), this), true);
+    RefPtr<DOMFileSystemSync> fileSystem = readFileSystemHelper.getResult(ec);
+    if (!fileSystem)
+        return 0;
+
+    RefPtr<EntrySync> entry = fileSystem->root()->getDirectory(filePath, 0, ec);
+    if (ec == FileException::TYPE_MISMATCH_ERR)
+        return fileSystem->root()->getFile(filePath, 0, ec);
+
+    return entry.release();
+}
+
 COMPILE_ASSERT(static_cast<int>(WorkerContext::TEMPORARY) == static_cast<int>(AsyncFileSystem::Temporary), enum_mismatch);
 COMPILE_ASSERT(static_cast<int>(WorkerContext::PERSISTENT) == static_cast<int>(AsyncFileSystem::Persistent), enum_mismatch);
 #endif
diff --git a/Source/WebCore/workers/WorkerContext.h b/Source/WebCore/workers/WorkerContext.h
index 2e802f2..d2ccb11 100644
--- a/Source/WebCore/workers/WorkerContext.h
+++ b/Source/WebCore/workers/WorkerContext.h
@@ -50,6 +50,8 @@ namespace WebCore {
     class Database;
     class DatabaseCallback;
     class DatabaseSync;
+    class EntryCallback;
+    class EntrySync;
     class ErrorCallback;
     class FileSystemCallback;
     class NotificationCenter;
@@ -129,8 +131,10 @@ namespace WebCore {
             TEMPORARY,
             PERSISTENT,
         };
-        void requestFileSystem(int type, long long size, PassRefPtr<FileSystemCallback>, PassRefPtr<ErrorCallback>);
+        void requestFileSystem(int type, long long size, PassRefPtr<FileSystemCallback> successCallback, PassRefPtr<ErrorCallback>);
         PassRefPtr<DOMFileSystemSync> requestFileSystemSync(int type, long long size, ExceptionCode&);
+        void resolveLocalFileSystemURL(const String& url, PassRefPtr<EntryCallback> successCallback, PassRefPtr<ErrorCallback>);
+        PassRefPtr<EntrySync> resolveLocalFileSystemSyncURL(const String& url, ExceptionCode&);
 #endif
 
         // These methods are used for GC marking. See JSWorkerContext::markChildren(MarkStack&) in
diff --git a/Source/WebCore/workers/WorkerContext.idl b/Source/WebCore/workers/WorkerContext.idl
index 179221e..7b2af6b 100644
--- a/Source/WebCore/workers/WorkerContext.idl
+++ b/Source/WebCore/workers/WorkerContext.idl
@@ -110,8 +110,12 @@ module threads {
         const unsigned short PERSISTENT = 1;
         [EnabledAtRuntime=FileSystem] void requestFileSystem(in unsigned short type, in long long size, in [Callback, Optional] FileSystemCallback successCallback, in [Callback, Optional] ErrorCallback errorCallback);
         [EnabledAtRuntime=FileSystem] DOMFileSystemSync requestFileSystemSync(in unsigned short type, in long long size) raises (FileException);
+        [EnabledAtRuntime=FileSystem] void resolveLocalFileSystemURL(in DOMString url, in [Callback, Optional] EntryCallback successCallback, in [Callback, Optional] ErrorCallback errorCallback);
+        [EnabledAtRuntime=FileSystem] EntrySync resolveLocalFileSystemSyncURL(in DOMString url) raises (FileException);
 
                  attribute [EnabledAtRuntime=FileSystem] FlagsConstructor Flags;
+                 attribute [EnabledAtRuntime=FileSystem] FileErrorConstructor FileError;
+                 attribute [EnabledAtRuntime=FileSystem] FileExceptionConstructor FileException;
 #endif
 
         attribute ArrayBufferConstructor ArrayBuffer; // Usable with new operator
diff --git a/Source/WebCore/xml/XMLTreeViewer.cpp b/Source/WebCore/xml/XMLTreeViewer.cpp
index 7a893f6..f1e2c0f 100644
--- a/Source/WebCore/xml/XMLTreeViewer.cpp
+++ b/Source/WebCore/xml/XMLTreeViewer.cpp
@@ -14,7 +14,7 @@
  * distribution.
  *
  * THIS SOFTWARE IS PROVIDED BY GOOGLE INC. AND ITS CONTRIBUTORS
- * “AS IS� AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
  * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL GOOGLE INC.
  * OR ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
@@ -33,6 +33,7 @@
 
 
 #include "Base64.h"
+#include "Element.h"
 #include "Document.h"
 #include "Frame.h"
 #include "HTMLNames.h"
@@ -88,7 +89,7 @@ bool XMLTreeViewer::hasNoStyleInformation() const
 
 void XMLTreeViewer::transformDocumentToTreeView()
 {
-    String sheetString(reinterpret_cast<char*>(XMLViewer_xsl), sizeof(XMLViewer_xsl));
+    String sheetString(reinterpret_cast<const char*>(XMLViewer_xsl), sizeof(XMLViewer_xsl));
     RefPtr<XSLStyleSheet> styleSheet = XSLStyleSheet::createForXMLTreeViewer(m_document, sheetString);
 
     RefPtr<XSLTProcessor> processor = XSLTProcessor::create();
@@ -104,9 +105,16 @@ void XMLTreeViewer::transformDocumentToTreeView()
     // FIXME: We should introduce error handling
     if (processor->transformToString(m_document, resultMIMEType, newSource, resultEncoding))
         processor->createDocumentFromSource(newSource, resultEncoding, resultMIMEType, m_document, frame);
+
+    // Adding source xml for dealing with namespaces and CDATA issues and for extensions use.
+    Element* sourceXmlElement = frame->document()->getElementById(AtomicString("source-xml"));
+    if (sourceXmlElement)
+        m_document->cloneChildNodes(sourceXmlElement);
+
     // New document should have been loaded in frame. Tell it to use view source styles.
     frame->document()->setUsesViewSourceStyles(true);
     frame->document()->styleSelectorChanged(RecalcStyleImmediately);
+
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/xml/XMLTreeViewer.h b/Source/WebCore/xml/XMLTreeViewer.h
index 7fde7bc..84297ea 100644
--- a/Source/WebCore/xml/XMLTreeViewer.h
+++ b/Source/WebCore/xml/XMLTreeViewer.h
@@ -14,7 +14,7 @@
  * distribution.
  *
  * THIS SOFTWARE IS PROVIDED BY GOOGLE INC. AND ITS CONTRIBUTORS
- * “AS IS� AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
  * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL GOOGLE INC.
  * OR ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
diff --git a/Source/WebCore/xml/XMLViewer.xsl b/Source/WebCore/xml/XMLViewer.xsl
index cb66858..4ee3ca8 100644
--- a/Source/WebCore/xml/XMLViewer.xsl
+++ b/Source/WebCore/xml/XMLViewer.xsl
@@ -248,16 +248,16 @@
                 <xsl:call-template name="style"/>
                 <xsl:call-template name="script"/>
             </head>
-            <body onload="onload()">
+            <body onload="onWebKitXMLViewerLoad()">
                 <div class="header">
-                    <span> <xsl:value-of select="$xml_has_no_style_message"/> </span> 
+                    <span> <xsl:value-of select="$xml_has_no_style_message"/> </span>
                     <br/>
                 </div>
 
                 <div class="pretty-print">
                     <xsl:apply-templates/>
                 </div>
-                <div> </div>
+                <div id="source-xml"></div>
             </body>
         </html>
     </xsl:template>
@@ -265,7 +265,7 @@
     <xsl:template name="script">
         <script type="text/javascript">
             <xsl:text>
-                function onload()
+                function onWebKitXMLViewerLoad()
                 {
                     drawArrows();
                     initButtons();
@@ -339,7 +339,6 @@
                    // To prevent selection on double click
                    e.preventDefault();
                 }
-
             </xsl:text>
         </script>
     </xsl:template>
@@ -363,6 +362,10 @@
                 font-size: 13px;
             }
 
+            #source-xml {
+                display: none;
+            }
+
             .collapsable-content {
                 margin-left: 1em;
             }
diff --git a/Source/WebCore/xml/XPathResult.cpp b/Source/WebCore/xml/XPathResult.cpp
index b608280..1dcde2e 100644
--- a/Source/WebCore/xml/XPathResult.cpp
+++ b/Source/WebCore/xml/XPathResult.cpp
@@ -41,6 +41,8 @@ using namespace XPath;
 
 XPathResult::XPathResult(Document* document, const Value& value)
     : m_value(value)
+    , m_nodeSetPosition(0)
+    , m_domTreeVersion(0)
 {
     switch (m_value.type()) {
         case Value::BooleanValue:
diff --git a/Source/WebCore/xml/XPathResult.h b/Source/WebCore/xml/XPathResult.h
index cbb51f5..e45916c 100644
--- a/Source/WebCore/xml/XPathResult.h
+++ b/Source/WebCore/xml/XPathResult.h
@@ -80,7 +80,7 @@ namespace WebCore {
         XPath::NodeSet m_nodeSet; // FIXME: why duplicate the node set stored in m_value?
         unsigned short m_resultType;
         RefPtr<Document> m_document;
-        unsigned m_domTreeVersion;
+        uint64_t m_domTreeVersion;
     };
 
 } // namespace WebCore
diff --git a/Source/WebKit.pri b/Source/WebKit.pri
index f61b489..c76066f 100644
--- a/Source/WebKit.pri
+++ b/Source/WebKit.pri
@@ -73,6 +73,8 @@ INCLUDEPATH += \
     $$OUTPUT_DIR/include \
     $$QT.script.includes
 
+DEFINES += QT_ASCII_CAST_WARNINGS
+
 webkit2:INCLUDEPATH *= $$OUTPUT_DIR/include/WebKit2
 
 # Pick up 3rdparty libraries from INCLUDE/LIB just like with MSVC
@@ -93,7 +95,7 @@ linux-g++* {
 
 symbian|*-armcc {
     # Enable GNU compiler extensions to the ARM compiler for all Qt ports using RVCT
-    RVCT_COMMON_CFLAGS = --gnu --diag_suppress 68,111,177,368,830,1293
+    RVCT_COMMON_CFLAGS = --gnu --diag_suppress 68,111,177,368,830,1293 --signed_bitfields
     RVCT_COMMON_CXXFLAGS = $$RVCT_COMMON_CFLAGS --no_parse_templates
     # Make debug symbols leaner in RVCT4.x. Ignored by compiler for release builds
     QMAKE_CXXFLAGS.ARMCC_4_0 += --remove_unneeded_entities
@@ -132,9 +134,9 @@ symbian|maemo5|maemo6 {
 
 ####
 
-contains(QT_CONFIG, modular):!contains(QT_CONFIG, uitools)|disable_uitools: DEFINES *= QT_NO_UITOOLS
+!contains(QT_CONFIG, uitools)|disable_uitools: DEFINES *= QT_NO_UITOOLS
 
-!contains(QT_CONFIG, modular) {
+isEmpty(QT.phonon.includes) {
     QT.phonon.includes = $$QMAKE_INCDIR_QT/phonon
     QT.phonon.libs = $$QMAKE_LIBDIR_QT
 }
diff --git a/Source/WebKit/ChangeLog b/Source/WebKit/ChangeLog
index 78e8174..d786ce1 100644
--- a/Source/WebKit/ChangeLog
+++ b/Source/WebKit/ChangeLog
@@ -1,3 +1,56 @@
+2011-03-29  Timothy Hatcher  <timothy@apple.com>
+
+        Update WebKit Localizable.strings to only contain WebKit/win strings.
+
+        https://webkit.org/b/57354
+
+        Reviewed by Sam Weinig.
+
+        * English.lproj/Localizable.strings: Updated.
+
+2011-03-23  Jia Pu  <jpu@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Hook up new AppKit autocorrection UI with WK2.
+        https://bugs.webkit.org/show_bug.cgi?id=56055
+        <rdar://problem/8947463>
+
+        Please see WebCore/ChangeLog for detail.
+
+        * WebKit.xcodeproj/project.pbxproj:
+
+2011-03-17  Jeff Miller  <jeffm@apple.com>
+
+        Use a consistent set of file patterns in the svn:ignore property for all .xcodeproj directories, specifically:
+        
+        *.mode*
+        *.pbxuser
+        *.perspective*
+        project.xcworkspace
+        xcuserdata
+
+        * WebKit.xcodeproj: Modified property svn:ignore.
+
+2011-03-15  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        REGRESSION (WebKit2): keygen element doesn't work
+        https://bugs.webkit.org/show_bug.cgi?id=56402
+        <rdar://problem/9006545>
+
+        * WebKit.xcodeproj/project.pbxproj: Renamed WebKeyGenerator.m to use Objective C++.
+
+2011-03-11  Anton D'Auria  <adauria@apple.com>
+
+        Reviewed and landed by Brady Eidson.
+
+        Add WebKit1 API to view and delete local storage
+        https://bugs.webkit.org/show_bug.cgi?id=51878
+
+        * WebKit.xcodeproj/project.pbxproj:
+
 2011-03-02  Sam Weinig  <sam@webkit.org>
 
         Reviewed by Anders Carlsson.
diff --git a/Source/WebKit/English.lproj/Localizable.strings b/Source/WebKit/English.lproj/Localizable.strings
index ebc6ecf..eebf03f 100644
--- a/Source/WebKit/English.lproj/Localizable.strings
+++ b/Source/WebKit/English.lproj/Localizable.strings
diff --git a/Source/WebKit/WebKit.xcodeproj/project.pbxproj b/Source/WebKit/WebKit.xcodeproj/project.pbxproj
index 5bebdbe..06a5566 100644
--- a/Source/WebKit/WebKit.xcodeproj/project.pbxproj
+++ b/Source/WebKit/WebKit.xcodeproj/project.pbxproj
@@ -85,6 +85,11 @@
 		37B6FB4F1063530C000FDB3B /* WebPDFDocumentExtras.mm in Sources */ = {isa = PBXBuildFile; fileRef = 37B6FB4D1063530C000FDB3B /* WebPDFDocumentExtras.mm */; };
 		37D1DCA81065928C0068F7EF /* WebJSPDFDoc.h in Headers */ = {isa = PBXBuildFile; fileRef = 37D1DCA61065928C0068F7EF /* WebJSPDFDoc.h */; };
 		37D1DCA91065928C0068F7EF /* WebJSPDFDoc.mm in Sources */ = {isa = PBXBuildFile; fileRef = 37D1DCA71065928C0068F7EF /* WebJSPDFDoc.mm */; };
+		3AB02AF612C1319B00FBB694 /* WebStorageManager.mm in Sources */ = {isa = PBXBuildFile; fileRef = 3AB02AF512C1319B00FBB694 /* WebStorageManager.mm */; };
+		3AB02B0012C132B200FBB694 /* WebStorageManagerPrivate.h in Headers */ = {isa = PBXBuildFile; fileRef = 3AB02AFF12C132B200FBB694 /* WebStorageManagerPrivate.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		3ABB3C7A1309C3B500E93D94 /* WebStorageTrackerClient.h in Headers */ = {isa = PBXBuildFile; fileRef = 3ABB3C781309C3B500E93D94 /* WebStorageTrackerClient.h */; };
+		3ABB3C7B1309C3B500E93D94 /* WebStorageTrackerClient.mm in Sources */ = {isa = PBXBuildFile; fileRef = 3ABB3C791309C3B500E93D94 /* WebStorageTrackerClient.mm */; };
+		3AE15D5012DBDED4009323C8 /* WebStorageManagerInternal.h in Headers */ = {isa = PBXBuildFile; fileRef = 3AE15D4F12DBDED4009323C8 /* WebStorageManagerInternal.h */; };
 		41F4484F10338E8C0030E55E /* WebWorkersPrivate.h in Headers */ = {isa = PBXBuildFile; fileRef = 41F4484D10338E8C0030E55E /* WebWorkersPrivate.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		41F4485010338E8C0030E55E /* WebWorkersPrivate.mm in Sources */ = {isa = PBXBuildFile; fileRef = 41F4484E10338E8C0030E55E /* WebWorkersPrivate.mm */; };
 		44BB8B141241A022001E3A22 /* WebArchiveInternal.h in Headers */ = {isa = PBXBuildFile; fileRef = 44BB8B131241A022001E3A22 /* WebArchiveInternal.h */; };
@@ -302,7 +307,7 @@
 		939811130824BF01008DF038 /* WebHistory.mm in Sources */ = {isa = PBXBuildFile; fileRef = 65DA2608052CC18700A97B31 /* WebHistory.mm */; };
 		939811150824BF01008DF038 /* WebNSDataExtras.m in Sources */ = {isa = PBXBuildFile; fileRef = BECD142A0565830A005BB09C /* WebNSDataExtras.m */; };
 		939811160824BF01008DF038 /* WebNSEventExtras.m in Sources */ = {isa = PBXBuildFile; fileRef = BE887C00056D3A6E009BB3E7 /* WebNSEventExtras.m */; };
-		939811170824BF01008DF038 /* WebKeyGenerator.m in Sources */ = {isa = PBXBuildFile; fileRef = 84723BE4056D719E0044BFEA /* WebKeyGenerator.m */; };
+		939811170824BF01008DF038 /* WebKeyGenerator.mm in Sources */ = {isa = PBXBuildFile; fileRef = 84723BE4056D719E0044BFEA /* WebKeyGenerator.mm */; };
 		939811190824BF01008DF038 /* WebNSPrintOperationExtras.m in Sources */ = {isa = PBXBuildFile; fileRef = EDD1A5C705C83987008E3150 /* WebNSPrintOperationExtras.m */; };
 		9398111A0824BF01008DF038 /* WebResource.mm in Sources */ = {isa = PBXBuildFile; fileRef = 84311A1305EAAAF00088EDA4 /* WebResource.mm */; };
 		9398111B0824BF01008DF038 /* WebDefaultEditingDelegate.m in Sources */ = {isa = PBXBuildFile; fileRef = BE95BEE505FD0805006E1513 /* WebDefaultEditingDelegate.m */; };
@@ -339,6 +344,8 @@
 		B6CE5C25100BC5F500219936 /* WebApplicationCache.h in Headers */ = {isa = PBXBuildFile; fileRef = B68049710FFBCEC1009F7F62 /* WebApplicationCache.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		B804176F1217A83100466BAE /* WebInspectorFrontend.h in Headers */ = {isa = PBXBuildFile; fileRef = B804176D1217A83100466BAE /* WebInspectorFrontend.h */; };
 		B80417701217A83100466BAE /* WebInspectorFrontend.mm in Sources */ = {isa = PBXBuildFile; fileRef = B804176E1217A83100466BAE /* WebInspectorFrontend.mm */; };
+		B82958D3132707D0000D0E79 /* CorrectionPanel.h in Headers */ = {isa = PBXBuildFile; fileRef = B82958D1132707D0000D0E79 /* CorrectionPanel.h */; };
+		B82958D4132707D0000D0E79 /* CorrectionPanel.mm in Sources */ = {isa = PBXBuildFile; fileRef = B82958D2132707D0000D0E79 /* CorrectionPanel.mm */; };
 		BC26C69E10B743F400B687ED /* WebSerializedJSValue.h in Headers */ = {isa = PBXBuildFile; fileRef = BC26C69D10B743F400B687ED /* WebSerializedJSValue.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC26C6A510B7447A00B687ED /* WebSerializedJSValue.mm in Sources */ = {isa = PBXBuildFile; fileRef = BC26C6A410B7447A00B687ED /* WebSerializedJSValue.mm */; };
 		BC2E464D0FD8A96800A9D9DE /* WebViewData.h in Headers */ = {isa = PBXBuildFile; fileRef = BC2E464B0FD8A96800A9D9DE /* WebViewData.h */; };
@@ -483,6 +490,11 @@
 		3944607E020F50ED0ECA1767 /* WebBackForwardList.mm */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = WebBackForwardList.mm; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
 		3944607F020F50ED0ECA1767 /* WebHistoryItem.h */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.c.h; path = WebHistoryItem.h; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
 		39446080020F50ED0ECA1767 /* WebHistoryItem.mm */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = WebHistoryItem.mm; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
+		3AB02AF512C1319B00FBB694 /* WebStorageManager.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = WebStorageManager.mm; sourceTree = "<group>"; };
+		3AB02AFF12C132B200FBB694 /* WebStorageManagerPrivate.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebStorageManagerPrivate.h; sourceTree = "<group>"; };
+		3ABB3C781309C3B500E93D94 /* WebStorageTrackerClient.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebStorageTrackerClient.h; sourceTree = "<group>"; };
+		3ABB3C791309C3B500E93D94 /* WebStorageTrackerClient.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = WebStorageTrackerClient.mm; sourceTree = "<group>"; };
+		3AE15D4F12DBDED4009323C8 /* WebStorageManagerInternal.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebStorageManagerInternal.h; sourceTree = "<group>"; };
 		41F4484D10338E8C0030E55E /* WebWorkersPrivate.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = WebWorkersPrivate.h; path = mac/Workers/WebWorkersPrivate.h; sourceTree = "<group>"; };
 		41F4484E10338E8C0030E55E /* WebWorkersPrivate.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; name = WebWorkersPrivate.mm; path = mac/Workers/WebWorkersPrivate.mm; sourceTree = "<group>"; };
 		449098B90F8F82DF0076A327 /* FeatureDefines.xcconfig */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.xcconfig; path = FeatureDefines.xcconfig; sourceTree = "<group>"; };
@@ -587,7 +599,7 @@
 		8467275C0367158500CA2ACA /* WebPluginController.h */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.c.h; path = WebPluginController.h; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
 		8467275D0367158500CA2ACA /* WebPluginController.mm */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = WebPluginController.mm; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
 		84723BE3056D719E0044BFEA /* WebKeyGenerator.h */ = {isa = PBXFileReference; fileEncoding = 4; indentWidth = 4; lastKnownFileType = sourcecode.c.h; path = WebKeyGenerator.h; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
-		84723BE4056D719E0044BFEA /* WebKeyGenerator.m */ = {isa = PBXFileReference; fileEncoding = 4; indentWidth = 4; lastKnownFileType = sourcecode.c.objc; path = WebKeyGenerator.m; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
+		84723BE4056D719E0044BFEA /* WebKeyGenerator.mm */ = {isa = PBXFileReference; fileEncoding = 4; indentWidth = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = WebKeyGenerator.mm; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
 		848DFF840365FE6A00CA2ACA /* WebPlugin.h */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.c.h; path = WebPlugin.h; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
 		848DFF850365FE6A00CA2ACA /* WebPluginContainer.h */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.c.h; path = WebPluginContainer.h; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
 		848DFF860365FE6A00CA2ACA /* WebPluginViewFactory.h */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.c.h; path = WebPluginViewFactory.h; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
@@ -650,6 +662,8 @@
 		B68049720FFBCEC1009F7F62 /* WebApplicationCache.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = WebApplicationCache.mm; sourceTree = "<group>"; };
 		B804176D1217A83100466BAE /* WebInspectorFrontend.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebInspectorFrontend.h; sourceTree = "<group>"; };
 		B804176E1217A83100466BAE /* WebInspectorFrontend.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = WebInspectorFrontend.mm; sourceTree = "<group>"; };
+		B82958D1132707D0000D0E79 /* CorrectionPanel.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CorrectionPanel.h; sourceTree = "<group>"; };
+		B82958D2132707D0000D0E79 /* CorrectionPanel.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = CorrectionPanel.mm; sourceTree = "<group>"; };
 		BC26C69D10B743F400B687ED /* WebSerializedJSValue.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebSerializedJSValue.h; sourceTree = "<group>"; };
 		BC26C6A410B7447A00B687ED /* WebSerializedJSValue.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = WebSerializedJSValue.mm; sourceTree = "<group>"; };
 		BC2E464B0FD8A96800A9D9DE /* WebViewData.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebViewData.h; sourceTree = "<group>"; };
@@ -1056,6 +1070,11 @@
 				A5DEFC0E11D5343E00885273 /* WebDatabaseQuotaManager.mm */,
 				511F3FD30CECC88F00852565 /* WebDatabaseTrackerClient.h */,
 				511F3FD40CECC88F00852565 /* WebDatabaseTrackerClient.mm */,
+				3AB02AF512C1319B00FBB694 /* WebStorageManager.mm */,
+				3AB02AFF12C132B200FBB694 /* WebStorageManagerPrivate.h */,
+				3AE15D4F12DBDED4009323C8 /* WebStorageManagerInternal.h */,
+				3ABB3C781309C3B500E93D94 /* WebStorageTrackerClient.h */,
+				3ABB3C791309C3B500E93D94 /* WebStorageTrackerClient.mm */,
 			);
 			name = Storage;
 			path = mac/Storage;
@@ -1280,6 +1299,8 @@
 		F5B36B400281DE87018635CB /* WebCoreSupport */ = {
 			isa = PBXGroup;
 			children = (
+				B82958D1132707D0000D0E79 /* CorrectionPanel.h */,
+				B82958D2132707D0000D0E79 /* CorrectionPanel.mm */,
 				598AD91D1201CECF00ABAE4E /* WebDeviceOrientationClient.mm */,
 				598AD9191201CEC900ABAE4E /* WebDeviceOrientationClient.h */,
 				B68049710FFBCEC1009F7F62 /* WebApplicationCache.h */,
@@ -1310,7 +1331,7 @@
 				9345D4EA0365C5B2008635CE /* WebJavaScriptTextInputPanel.h */,
 				9345D4EB0365C5B2008635CE /* WebJavaScriptTextInputPanel.m */,
 				84723BE3056D719E0044BFEA /* WebKeyGenerator.h */,
-				84723BE4056D719E0044BFEA /* WebKeyGenerator.m */,
+				84723BE4056D719E0044BFEA /* WebKeyGenerator.mm */,
 				1AA879B411CBE9BF003C664F /* WebPlatformStrategies.h */,
 				1AA879B511CBE9BF003C664F /* WebPlatformStrategies.mm */,
 				0A2D87FB107AF52B00CDDEE3 /* WebPluginHalterClient.h */,
@@ -1625,8 +1646,12 @@
 				598AD92A1201CF3B00ABAE4E /* WebDeviceOrientationProviderMockInternal.h in Headers */,
 				598ADA461202275000ABAE4E /* WebDeviceOrientationProvider.h in Headers */,
 				93E2A1A4123B0B3C009FE12A /* WebDashboardRegion.h in Headers */,
+				3AB02B0012C132B200FBB694 /* WebStorageManagerPrivate.h in Headers */,
 				CDA62AE2125F87C2007FD118 /* WebFullScreenController.h in Headers */,
+				3AE15D5012DBDED4009323C8 /* WebStorageManagerInternal.h in Headers */,
+				3ABB3C7A1309C3B500E93D94 /* WebStorageTrackerClient.h in Headers */,
 				BC42D324131ED1E00075FA4B /* WebLocalizableStringsInternal.h in Headers */,
+				B82958D3132707D0000D0E79 /* CorrectionPanel.h in Headers */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
@@ -1908,7 +1933,7 @@
 				1C7B0C660EB2464D00A28502 /* WebInspectorClientCF.cpp in Sources */,
 				939810E40824BF01008DF038 /* WebJavaScriptTextInputPanel.m in Sources */,
 				37D1DCA91065928C0068F7EF /* WebJSPDFDoc.mm in Sources */,
-				939811170824BF01008DF038 /* WebKeyGenerator.m in Sources */,
+				939811170824BF01008DF038 /* WebKeyGenerator.mm in Sources */,
 				939811030824BF01008DF038 /* WebKitErrors.m in Sources */,
 				939810C30824BF01008DF038 /* WebKitLogging.m in Sources */,
 				939810C40824BF01008DF038 /* WebKitNSStringExtras.mm in Sources */,
@@ -1993,8 +2018,11 @@
 				598AD9221201CF1000ABAE4E /* WebDeviceOrientation.mm in Sources */,
 				598AD9281201CF3200ABAE4E /* WebDeviceOrientationProviderMock.mm in Sources */,
 				93E2A1A5123B0B3C009FE12A /* WebDashboardRegion.mm in Sources */,
+				3AB02AF612C1319B00FBB694 /* WebStorageManager.mm in Sources */,
 				CDA62AE3125F87C2007FD118 /* WebFullScreenController.mm in Sources */,
+				3ABB3C7B1309C3B500E93D94 /* WebStorageTrackerClient.mm in Sources */,
 				BC42D34D131ED3880075FA4B /* WebLocalizableStringsInternal.mm in Sources */,
+				B82958D4132707D0000D0E79 /* CorrectionPanel.mm in Sources */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
diff --git a/Source/WebKit/cf/ChangeLog b/Source/WebKit/cf/ChangeLog
index 1826525..abcc065 100644
--- a/Source/WebKit/cf/ChangeLog
+++ b/Source/WebKit/cf/ChangeLog
@@ -1,3 +1,15 @@
+2011-03-15  Kevin Ollivier  <kevino@theolliviers.com>
+
+        Reviewed by Darin Adler.
+
+        Introduce WTF_USE_EXPORT_MACROS, which will allow us to put shared library import/export
+        info into the headers rather than in export symbol definition files, but disable it on 
+        all platforms initially so we can deal with port build issues one port at a time.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=27551
+
+        * WebCoreSupport/WebInspectorClientCF.cpp:
+
 2011-02-23  Patrick Gansterer  <paroga@webkit.org>
 
         Reviewed by Darin Adler.
diff --git a/Source/WebKit/cf/WebCoreSupport/WebInspectorClientCF.cpp b/Source/WebKit/cf/WebCoreSupport/WebInspectorClientCF.cpp
index 7fe7e5f..0362dac 100644
--- a/Source/WebKit/cf/WebCoreSupport/WebInspectorClientCF.cpp
+++ b/Source/WebKit/cf/WebCoreSupport/WebInspectorClientCF.cpp
@@ -37,6 +37,11 @@
 #define WTF_USE_JSC 1
 #endif
 
+// Leave these set to nothing until we switch Mac and Win ports over to 
+// using the export macros.
+#define JS_EXPORT_PRIVATE
+#define WTF_EXPORT_PRIVATE
+
 #if defined(WIN32) || defined(_WIN32)
 #ifndef WTF_USE_CFNETWORK
 #define WTF_USE_CFNETWORK 1
@@ -126,6 +131,18 @@ void WebInspectorClient::releaseFrontendPage()
     m_frontendPage = 0;
 }
 
+void WebInspectorClient::saveSessionSetting(const String& key, const String& value)
+{
+    if (!key.isEmpty())
+        m_sessionSettings.set(key, value);
+}
+
+void WebInspectorClient::loadSessionSetting(const String& key, String* value)
+{
+    if (!key.isEmpty())
+        *value = m_sessionSettings.get(key);
+}
+
 WTF::PassOwnPtr<WebCore::InspectorFrontendClientLocal::Settings> WebInspectorClient::createFrontendSettings()
 {
     class InspectorFrontendSettingsCF : public WebCore::InspectorFrontendClientLocal::Settings {
diff --git a/Source/WebKit/chromium/ChangeLog b/Source/WebKit/chromium/ChangeLog
index e5e6149..8becdba 100644
--- a/Source/WebKit/chromium/ChangeLog
+++ b/Source/WebKit/chromium/ChangeLog
@@ -1,3 +1,1713 @@
+2011-03-29  John Abd-El-Malek  <jam@chromium.org>
+
+        Reviewed by Tony Chang.
+
+        [chromium]: Remove the code that called WebViewClient for spelling now that chromium is updated
+        https://bugs.webkit.org/show_bug.cgi?id=57396
+
+        * DEPS:
+        * public/WebFrame.h:
+        * public/WebView.h:
+        * public/WebViewClient.h:
+        (WebKit::WebViewClient::handleCurrentKeyboardEvent):
+        * src/EditorClientImpl.cpp:
+        (WebKit::EditorClientImpl::checkSpellingOfString):
+        (WebKit::EditorClientImpl::requestCheckingOfString):
+        (WebKit::EditorClientImpl::getAutoCorrectSuggestionForMisspelledWord):
+        (WebKit::EditorClientImpl::updateSpellingUIWithMisspelledWord):
+        (WebKit::EditorClientImpl::showSpellingUI):
+        (WebKit::EditorClientImpl::spellingUIIsShowing):
+        * src/WebViewImpl.cpp:
+        (WebKit::WebView::create):
+        * src/WebViewImpl.h:
+        * src/WebWorkerBase.cpp:
+        (WebKit::WebWorkerBase::initializeLoader):
+        * tests/PopupMenuTest.cpp:
+        (WebKit::SelectPopupMenuTest::SetUp):
+        * tests/WebFrameTest.cpp:
+        (WebKit::TEST_F):
+        * tests/WebPageSerializerTest.cpp:
+        (WebKit::WebPageSerializerTest::SetUp):
+
+2011-03-30  MORITA Hajime  <morrita@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        [Chromium] Expose the shadow DOM to DumpRenderTree JS tests.
+        https://bugs.webkit.org/show_bug.cgi?id=56573
+
+        Added:
+        - WebBindins::makeNode() to convert WebNode to a JS object, and
+        - WebElement::shadowRoot().
+
+        * public/WebBindings.h:
+        * public/WebElement.h:
+        * src/WebBindings.cpp:
+        (WebKit::makeNodeImpl):
+        (WebKit::WebBindings::makeNode):
+        * src/WebElement.cpp:
+        (WebKit::WebElement::shadowRoot):
+
+2011-03-30  Mario Sanchez Prada  <msanchez@igalia.com>
+
+        Reviewed by Chris Fleizach.
+
+        AX: GTK: ARIA role is not respected on <p> <label> <div> and <form>
+        https://bugs.webkit.org/show_bug.cgi?id=47636
+
+        Duplicate new internal WebCore roles in the Chromium port.
+
+        * public/WebAccessibilityRole.h: Update enumeration
+        WebAccessibilityRole to reflect newly added roles in WebCore.
+        * src/AssertMatchingEnums.cpp: Added new assertions.
+
+2011-03-30  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: split debugger agent into Page and Worker-specific ones
+        https://bugs.webkit.org/show_bug.cgi?id=57345
+
+        ScriptDebugServer and InspectorDebuggerAgent contain only functionality common
+        for Worker and Page debugger. All specifics is moved into Page/WorkerScriptDebugServer
+        and Page/WorkerDebuggerAgent.
+
+        * src/DebuggerAgentManager.cpp:
+        (WebKit::DebuggerAgentManager::setExposeV8DebuggerProtocol):
+        * src/WebDevToolsAgentImpl.cpp:
+        (WebKit::WebDevToolsAgent::interruptAndDispatch):
+        (WebKit::WebDevToolsAgent::processPendingMessages):
+
+2011-03-30  Yury Semikhatsky  <yurys@chromium.org>
+
+        Unreviewed. Rollout r82438 and r82436.
+
+        * src/DebuggerAgentManager.cpp:
+        (WebKit::DebuggerAgentManager::setExposeV8DebuggerProtocol):
+        * src/WebDevToolsAgentImpl.cpp:
+        (WebKit::WebDevToolsAgent::interruptAndDispatch):
+        (WebKit::WebDevToolsAgent::processPendingMessages):
+
+2011-03-30  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: split debugger agent into Page and Worker-specific ones
+        https://bugs.webkit.org/show_bug.cgi?id=57345
+
+        ScriptDebugServer and InspectorDebuggerAgent contain only functionality common
+        for Worker and Page debugger. All specifics is moved into Page/WorkerScriptDebugServer
+        and Page/WorkerDebuggerAgent.
+
+        * src/DebuggerAgentManager.cpp:
+        (WebKit::DebuggerAgentManager::setExposeV8DebuggerProtocol):
+        * src/WebDevToolsAgentImpl.cpp:
+        (WebKit::WebDevToolsAgent::interruptAndDispatch):
+        (WebKit::WebDevToolsAgent::processPendingMessages):
+
+2011-03-29  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r82293.
+        http://trac.webkit.org/changeset/82293
+        https://bugs.webkit.org/show_bug.cgi?id=57390
+
+        Breaks RetrieveCSSResources (Requested by abarth|gardener on
+        #webkit).
+
+        * WebKit.gyp:
+        * src/WebPageSerializer.cpp:
+        (WebCore::getSubResourceURLFromElement):
+        (WebCore::retrieveResourcesForElement):
+        (WebCore::retrieveResourcesForFrame):
+        (WebKit::WebPageSerializer::retrieveAllResources):
+        * tests/WebPageSerializerTest.cpp:
+        * tests/data/pageserialization/css_test_page.html: Removed.
+        * tests/data/pageserialization/import_style_from_link.css: Removed.
+        * tests/data/pageserialization/import_styles.css: Removed.
+        * tests/data/pageserialization/link_styles.css: Removed.
+
+2011-03-29  Tony Chang  <tony@chromium.org>
+
+        Roll chromium version to r79710 to pick up libpng changes.
+
+        * DEPS:
+
+2011-03-29  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r82295 and r82300.
+        http://trac.webkit.org/changeset/82295
+        http://trac.webkit.org/changeset/82300
+        https://bugs.webkit.org/show_bug.cgi?id=57380
+
+        This patch breaks compile on Chromium (Requested by
+        abarth|gardener on #webkit).
+
+        * public/WebAccessibilityRole.h:
+        * src/AssertMatchingEnums.cpp:
+
+2011-03-29  Mario Sanchez Prada  <msanchez@igalia.com>
+
+        Reviewed by Adam Barth.
+
+        REGRESSION(r82295): This patch does not compile on Chromium (Requested by abarth|gardener on #webkit).
+        https://bugs.webkit.org/show_bug.cgi?id=57377
+
+        Fix build errors on Chromium bots.
+
+        * public/WebAccessibilityRole.h: Update to reflect newly added roles in WebCore.
+        * src/AssertMatchingEnums.cpp: Ditto.
+
+2011-03-29  Adam Barth  <abarth@webkit.org>
+
+        Roll Chromium DEPS
+        https://bugs.webkit.org/show_bug.cgi?id=57361
+
+        * DEPS:
+
+2011-03-29  Jay Civelli  <jcivelli@chromium.org>
+
+        Reviewed by David Levin.
+
+        Adding retrieval off CSS resources to WebPageSerializer::retrieveAllResources.
+        https://bugs.webkit.org/show_bug.cgi?id=56650
+
+        * WebKit.gyp:
+        * src/WebPageSerializer.cpp:
+        (WebCore::getResourceAttributeForElement):
+        (WebCore::retrieveStyleSheetForElement):
+        (WebCore::retrieveResourcesForElement):
+        (WebCore::retrieveResourcesForFrame):
+        (WebCore::retrieveResourcesForCSSRule):
+        (WebCore::retrieveResourcesForCSSStyleDeclaration):
+        (WebCore::retrieveResourcesForCSSStyleSheet):
+        (WebKit::WebPageSerializer::retrieveAllResources):
+        * tests/WebPageSerializerTest.cpp:
+        (WebKit::TestWebFrameClient::TestWebFrameClient):
+        (WebKit::TestWebFrameClient::allowScript):
+        (WebKit::WebPageSerializerTest::enableJS):
+        (WebKit::WebPageSerializerTest::runOnLoad):
+        (WebKit::TEST_F):
+        * tests/data/pageserialization/css_test_page.html: Added.
+        * tests/data/pageserialization/import_style_from_link.css: Added.
+        (#divOrange):
+        * tests/data/pageserialization/import_styles.css: Added.
+        (#divYellow):
+        * tests/data/pageserialization/link_styles.css: Added.
+        (#divRed):
+
+2011-03-29  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        [Chromium] Inspector does not always shows transferred size correctly (e.g. gzipped/chunked content)
+        https://bugs.webkit.org/show_bug.cgi?id=56602
+
+        Added new methods to interface while keeping the old ones to keep
+        chromium working until it is also patched.
+
+        * public/WebURLLoaderClient.h:
+        (WebKit::WebURLLoaderClient::didReceiveData2):
+        * src/AssociatedURLLoader.cpp:
+        (WebKit::AssociatedURLLoader::ClientAdapter::didReceiveData):
+        * src/ResourceHandle.cpp:
+        (WebCore::ResourceHandleInternal::didReceiveData):
+        (WebCore::ResourceHandleInternal::didReceiveData2):
+
+2011-03-29  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: [Chromium] DevTools shows two resources for each plugin resource loaded
+        https://bugs.webkit.org/show_bug.cgi?id=57101
+
+        Remove DevToolsAgent network callbacks as this information is now available through ResourceLoader
+
+        * public/WebDevToolsAgent.h:
+        * src/WebDevToolsAgentImpl.cpp:
+        * src/WebDevToolsAgentImpl.h:
+
+2011-03-29  Emil A Eklund  <eae@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Relative mouse coordinates recalculated for each target
+        https://bugs.webkit.org/show_bug.cgi?id=57130
+
+        * public/WebDOMMouseEvent.h:
+        * src/WebDOMMouseEvent.cpp:
+        (WebKit::WebDOMMouseEvent::layerX):
+        (WebKit::WebDOMMouseEvent::layerY):
+        (WebKit::WebDOMMouseEvent::offsetX):
+        (WebKit::WebDOMMouseEvent::offsetY):
+
+2011-03-29  Yuta Kitamura  <yutak@chromium.org>
+
+        Unreviewed, rolling out r82195.
+        http://trac.webkit.org/changeset/82195
+        https://bugs.webkit.org/show_bug.cgi?id=56602
+
+        Broke Chromium Clang builds.
+
+        * public/WebDevToolsAgent.h:
+        * public/WebURLLoaderClient.h:
+        * src/AssociatedURLLoader.cpp:
+        (WebKit::AssociatedURLLoader::ClientAdapter::didReceiveData):
+        * src/ResourceHandle.cpp:
+        (WebCore::ResourceHandleInternal::didReceiveData):
+        * src/WebDevToolsAgentImpl.cpp:
+        (WebKit::WebDevToolsAgentImpl::didReceiveData):
+        * src/WebDevToolsAgentImpl.h:
+
+2011-03-29  Yuta Kitamura  <yutak@chromium.org>
+
+        Unreviewed. Another build fix. The last fix was incorrect.
+
+        * src/ChromeClientImpl.cpp:
+        (WebKit::ChromeClientImpl::supportsFullscreenForNode):
+        (WebKit::ChromeClientImpl::supportsFullScreenForElement):
+        * src/ChromeClientImpl.h:
+
+2011-03-29  Yuta Kitamura  <yutak@chromium.org>
+
+        Unreviewed. Build fix for Chromium Clang bot.
+
+        * src/ChromeClientImpl.cpp:
+        (WebKit::ChromeClientImpl::supportsFullscreenForNode):
+        * src/ChromeClientImpl.h:
+
+2011-03-28  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        [Chromium] Inspector does not always shows transferred size correctly (e.g. gzipped/chunked content)
+        https://bugs.webkit.org/show_bug.cgi?id=56602
+
+        Added new methods to interface while keeping the old ones to keep
+        chromium working until it is also patched.
+
+        * public/WebDevToolsAgent.h:
+        * public/WebURLLoaderClient.h:
+        (WebKit::WebURLLoaderClient::didReceiveData):
+        * src/AssociatedURLLoader.cpp:
+        (WebKit::AssociatedURLLoader::ClientAdapter::didReceiveData):
+        * src/ResourceHandle.cpp:
+        (WebCore::ResourceHandleInternal::didReceiveData):
+        * src/WebDevToolsAgentImpl.cpp:
+        (WebKit::WebDevToolsAgentImpl::didReceiveData):
+        * src/WebDevToolsAgentImpl.h:
+
+2011-03-28  Tony Chang  <tony@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        [chromium] have DRT write the png checksum into a png comment
+        https://bugs.webkit.org/show_bug.cgi?id=57255
+
+        * DEPS: Pull in version of chromium with comment writing
+
+2011-03-28  Adele Peterson  <adele@apple.com>
+
+        Build fix.
+
+        * src/WebFrameImpl.cpp: (WebKit::WebFrameImpl::selectionStartHasSpellingMarkerFor):
+        Call new selectionStartHasMarkerFor method instead of selectionStartHasSpellingMarkerFor.
+
+2011-03-28  Pavel Feldman  <pfeldman@chromium.org>
+
+        Not reviewed: fixed chromium build.
+
+        * src/WebDevToolsAgentImpl.cpp:
+        (WebKit::WebDevToolsAgent::shouldInterruptForMessage):
+
+2011-03-25  Andy Estes  <aestes@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        REGRESSION (r70748): latest nightly builds kills AC_QuickTime.js
+        https://bugs.webkit.org/show_bug.cgi?id=49016
+
+        Update objectContentType() implementation to handle the
+        shouldPreferPlugInsForImages flag.
+
+        * src/FrameLoaderClientImpl.cpp:
+        (WebKit::FrameLoaderClientImpl::objectContentType):
+        * src/FrameLoaderClientImpl.h:
+
+2011-03-25  Kinuko Yasuda  <kinuko@chromium.org>
+
+        Reviewed by David Levin.
+
+        Data race between ~WorkerFileSystemCallbacksBridge and runTasksOnWorkerThread
+        https://bugs.webkit.org/show_bug.cgi?id=56138
+        Stopped passing the WorkerFileSystemCallbacksBridge's reference to
+        MainThreadFileSystemCallbacks so that in most cases (in normal cases)
+        its reference is only maintained by WorkerThread.
+
+        * src/WorkerFileSystemCallbacksBridge.cpp:
+        (WebKit::MainThreadFileSystemCallbacks::createLeakedPtr):
+        (WebKit::MainThreadFileSystemCallbacks::MainThreadFileSystemCallbacks):
+        (WebKit::WorkerFileSystemCallbacksBridge::mayPostTaskToWorker):
+        * src/WorkerFileSystemCallbacksBridge.h:
+
+2011-03-24  John Abd-El-Malek  <jam@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [chromium] Add setters for various client interfaces, and add WebSpellCheckClient
+        https://bugs.webkit.org/show_bug.cgi?id=57070
+
+        * public/WebSpellCheckClient.h: Added.
+        (WebKit::WebSpellCheckClient::spellCheck):
+        (WebKit::WebSpellCheckClient::requestCheckingOfText):
+        (WebKit::WebSpellCheckClient::autoCorrectWord):
+        (WebKit::WebSpellCheckClient::showSpellingUI):
+        (WebKit::WebSpellCheckClient::isShowingSpellingUI):
+        (WebKit::WebSpellCheckClient::updateSpellingUIWithMisspelledWord):
+        (WebKit::WebSpellCheckClient::~WebSpellCheckClient):
+        * public/WebView.h:
+        * public/WebViewClient.h:
+        * src/EditorClientImpl.cpp:
+        (WebKit::EditorClientImpl::checkSpellingOfString):
+        (WebKit::EditorClientImpl::requestCheckingOfString):
+        (WebKit::EditorClientImpl::getAutoCorrectSuggestionForMisspelledWord):
+        (WebKit::EditorClientImpl::updateSpellingUIWithMisspelledWord):
+        (WebKit::EditorClientImpl::showSpellingUI):
+        (WebKit::EditorClientImpl::spellingUIIsShowing):
+        * src/WebViewImpl.cpp:
+        (WebKit::WebViewImpl::setWebDevToolsAgentClient):
+        (WebKit::WebViewImpl::setWebAutoFillClient):
+        (WebKit::WebViewImpl::setWebSpellCheckClient):
+        (WebKit::WebViewImpl::WebViewImpl):
+        * src/WebViewImpl.h:
+        (WebKit::WebViewImpl::spellCheckClient):
+
+2011-03-25  Cary Clark  <caryclark@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        Add CGBitmapContext.h include to WebViewImpl.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=57097
+        
+        No tests. Exposes no new functionality.
+
+        * src/WebViewImpl.cpp:
+
+2011-03-25  Adam Klein  <adamk@chromium.org>
+
+        Reviewed by David Levin.
+
+        [chromium] Remove deprecated overload of openFileSystem for workers
+        https://bugs.webkit.org/show_bug.cgi?id=57062
+
+        * public/WebCommonWorkerClient.h:
+
+2011-03-25  Chang Shu  <cshu@webkit.org>
+
+        Reviewed by Ryosuke Niwa.
+
+        rename Node::isContentEditable and all call sites to rendererIsEditable
+        https://bugs.webkit.org/show_bug.cgi?id=54290
+
+        This is part of the effort to separate JS API HTMLElement isContentEditable from
+        internal Node::rendererIsEditable.
+
+        * src/WebNode.cpp:
+        (WebKit::WebNode::isContentEditable):
+        * src/WebViewImpl.cpp:
+        (WebKit::WebViewImpl::setFocus):
+        (WebKit::WebViewImpl::setComposition):
+        (WebKit::WebViewImpl::confirmComposition):
+
+2011-03-25  Mikhail Naganov  <mnaganov@chromium.org>
+
+        Roll forward Chromium deps to r79379 to pick up V8 3.2.4.2.
+
+        * DEPS:
+
+2011-03-24  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r81916 and r81917.
+        http://trac.webkit.org/changeset/81916
+        http://trac.webkit.org/changeset/81917
+        https://bugs.webkit.org/show_bug.cgi?id=57071
+
+        broke a test on platforms that do not have QuickTime installed
+        (Requested by estes on #webkit).
+
+        * src/FrameLoaderClientImpl.cpp:
+        (WebKit::FrameLoaderClientImpl::objectContentType):
+        * src/FrameLoaderClientImpl.h:
+
+2011-03-24  Min Qin  <qinmin@google.com>
+
+        Reviewed by James Robinson.
+
+        Allow WebMediaPlayerClient to notify MediaPlayer that the playback state has changed
+
+        https://bugs.webkit.org/show_bug.cgi?id=56837
+
+        * public/WebMediaPlayerClient.h:
+        * src/WebMediaPlayerClientImpl.cpp:
+        (WebKit::WebMediaPlayerClientImpl::playbackStateChanged):
+        * src/WebMediaPlayerClientImpl.h:
+
+2011-03-23  John Abd-El-Malek  <jam@chromium.org>
+
+        Reviewed by Tony Chang.
+
+        [chromium] Get rid of WEB_TEXT_CHECKING_RESULT_IS_A_STRUCT since it&apos;s not needed anymore
+        https://bugs.webkit.org/show_bug.cgi?id=56955
+
+        * DEPS:
+        * public/WebTextCheckingResult.h:
+
+2011-03-24  Bill Budge  <bbudge@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Change a forward declaration of WebURLLoaderOptions to struct to prevent a build break in Chromium.
+        https://bugs.webkit.org/show_bug.cgi?id=57064
+
+        No tests. Exposes no new functionality.
+
+        * public/WebFrame.h:
+
+2011-03-24  Andy Estes  <aestes@apple.com>
+
+        Fix the chromium build.
+
+        * src/FrameLoaderClientImpl.cpp:
+        (WebKit::FrameLoaderClientImpl::objectContentType):
+
+2011-03-24  Andy Estes  <aestes@apple.com>
+
+        Reviewed by Darin Adler.
+
+        REGRESSION (r70748): latest nightly builds kills AC_QuickTime.js
+        https://bugs.webkit.org/show_bug.cgi?id=49016
+
+        Update objectContentType() implementation to handle the
+        shouldPreferPlugInsForImages flag.
+
+        * src/FrameLoaderClientImpl.cpp:
+        (WebKit::FrameLoaderClientImpl::objectContentType):
+        * src/FrameLoaderClientImpl.h:
+
+2011-03-24  Bill Budge  <bbudge@chromium.org>
+
+        Reviewed by Dmitry Titov.
+
+        Add an overloaded WebFrame::createAssociatedURLLoader method that takes WebURLLoaderOptions, so clients can specify CORS options to allow cross-origin requests.
+        https://bugs.webkit.org/show_bug.cgi?id=56885
+
+        No new tests. Exposes no new functionality.
+
+        * public/WebFrame.h:
+        * src/WebFrameImpl.cpp:
+        (WebKit::WebFrameImpl::createAssociatedURLLoader):
+        * src/WebFrameImpl.h:
+
+2011-03-24  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Remove legacy version of findPlainText.
+        https://bugs.webkit.org/show_bug.cgi?id=57056
+
+        * src/WebFrameImpl.cpp:
+        (WebKit::WebFrameImpl::scopeStringMatches):
+        Replace use of legacy findPlainText with a version that
+        takes an options parameter.
+
+2011-03-24  Nat Duca  <nduca@chromium.org>
+
+        Reviewed by Kenneth Russell.
+
+        [chromium] Add traceEvents to compositor
+        https://bugs.webkit.org/show_bug.cgi?id=56965
+
+        * src/WebViewImpl.cpp:
+        (WebKit::WebViewImpl::composite):
+
+2011-03-24  Dominic Mazzoni  <dmazzoni@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        Add accessibilityObject accessor to WebDocument (needed for
+        building an accessibility tree that includes iframes).
+        https://bugs.webkit.org/show_bug.cgi?id=56984
+
+        * public/WebDocument.h:
+        * src/WebDocument.cpp:
+        (WebKit::WebDocument::accessibilityObject):
+
+2011-03-24  Ilya Sherman  <isherman@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Expose Node::isFocusable() in the Chromium WebKit API
+        In service of https://code.google.com/p/chromium/issues/detail?id=72918
+        https://bugs.webkit.org/show_bug.cgi?id=56809
+
+        * public/WebNode.h:
+        * src/WebNode.cpp:
+        (WebKit::WebNode::isFocusable):
+
+2011-03-24  Pavel Feldman  <pfeldman@chromium.org>
+
+        Not reviewed: fix chromium compilation.
+
+        * public/WebDevToolsAgent.h:
+
+2011-03-24  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: brush up Network agent API.
+        https://bugs.webkit.org/show_bug.cgi?id=57001
+
+        * public/WebDevToolsAgent.h:
+        * src/WebDevToolsAgentImpl.cpp:
+        (WebKit::WebDevToolsAgentImpl::identifierForInitialRequest):
+        (WebKit::WebDevToolsAgentImpl::willSendRequest):
+        * src/WebDevToolsAgentImpl.h:
+
+2011-03-24  Noel Gordon  <noel.gordon@gmail.com>
+
+        Reviewed by Ojan Vafai.
+
+        [chromium] WebBindings::getRangeImpl() should NULL check its NPObject argument
+        https://bugs.webkit.org/show_bug.cgi?id=56996
+
+        * src/WebBindings.cpp:
+        (WebKit::getRangeImpl):
+
+2011-03-23  Noel Gordon  <noel.gordon@gmail.com>
+
+        Reviewed by Ojan Vafai.
+
+        [chromium] WebBindings{.h,.cpp}: should use consistent argument naming
+        https://bugs.webkit.org/show_bug.cgi?id=56898
+
+        Address FIXME I noted/added in r81676.  Wanted to just copy/paste the checking
+        code from elsewhere in the file, but inconsistent argument naming made it more
+        difficult than it need be, so first step: use consistent naming.
+
+        * public/WebBindings.h:
+        * src/WebBindings.cpp:
+        (WebKit::WebBindings::construct):
+        (WebKit::WebBindings::enumerate):
+        (WebKit::WebBindings::evaluate):
+        (WebKit::WebBindings::evaluateHelper):
+        (WebKit::WebBindings::getProperty):
+        (WebKit::WebBindings::hasMethod):
+        (WebKit::WebBindings::hasProperty):
+        (WebKit::WebBindings::invoke):
+        (WebKit::WebBindings::invokeDefault):
+        (WebKit::WebBindings::releaseObject):
+        (WebKit::WebBindings::removeProperty):
+        (WebKit::WebBindings::retainObject):
+        (WebKit::WebBindings::setException):
+        (WebKit::WebBindings::setProperty):
+        (WebKit::WebBindings::unregisterObject):
+        (WebKit::WebBindings::extractIdentifierData):
+        (WebKit::getRangeImpl):
+        (WebKit::getElementImpl):
+        (WebKit::makeIntArrayImpl):
+        (WebKit::WebBindings::getRange):
+        (WebKit::WebBindings::makeIntArray):
+
+2011-03-23  Jay Civelli  <jcivelli@chromium.org>
+
+        Reviewed by David Levin.
+
+        Relanding:
+        Moving the method that is used to retrieve all the resources in
+        a page from the Chromium code (dom_operations.cc) to WebKit.
+        https://bugs.webkit.org/show_bug.cgi?id=55859
+
+        * WebKit.gyp:
+        * public/WebPageSerializer.h:
+        * public/WebURL.h:
+        (WebKit::operator==):
+        (WebKit::operator!=):
+        * public/WebVector.h:
+        (WebKit::WebVector::contains):
+        * src/WebDataSourceImpl.cpp:
+        (WebKit::WebDataSourceImpl::WebDataSourceImpl):
+        * src/WebPageSerializer.cpp:
+        (WebCore::getSubResourceURLFromElement):
+        (WebCore::retrieveResourcesForElement):
+        (WebCore::retrieveResourcesForFrame):
+        (WebKit::WebPageSerializer::retrieveAllResources):
+        * tests/WebFrameTest.cpp:
+        * tests/WebPageSerializerTest.cpp: Added.
+        * tests/data/pageserialization/awesome.png: Added.
+        * tests/data/pageserialization/embed_iframe.html: Added.
+        * tests/data/pageserialization/object_iframe.html: Added.
+        * tests/data/pageserialization/simple_iframe.html: Added.
+        * tests/data/pageserialization/simple_page.html: Added.
+        * tests/data/pageserialization/top_frame.html: Added.
+
+2011-03-23  Kenneth Russell  <kbr@google.com>
+
+        Rolled forward Chromium DEPS again to fix DumpRenderTree build
+        failure caused by r81821.
+
+        * DEPS:
+
+2011-03-23  Kenneth Russell  <kbr@google.com>
+
+        Rolled forward Chromium DEPS to fix build breakage after r81821.
+
+        * DEPS:
+
+2011-03-23  Kenneth Russell  <kbr@google.com>
+
+        Reviewed by James Robinson.
+
+        [chromium] WebGLRenderingContext and other DOMWindow properties should remain if WebGL is disabled
+        https://bugs.webkit.org/show_bug.cgi?id=56947
+
+        Removed the WebRuntimeFeatures setting for WebGL. WebGL support is
+        now controlled exclusively through the page's Settings.
+
+        * public/WebRuntimeFeatures.h:
+        * src/WebRuntimeFeatures.cpp:
+
+2011-03-23  Chris Rogers  <crogers@google.com>
+
+        Reviewed by Kenneth Russell.
+
+        Add API to retrieve the audio hardware sample-rate
+        https://bugs.webkit.org/show_bug.cgi?id=56882
+
+        * public/WebAudioDevice.h:
+        * public/WebKitClient.h:
+        (WebKit::WebKitClient::audioHardwareSampleRate):
+        * src/AudioDestinationChromium.cpp:
+        (WebCore::AudioDestination::hardwareSampleRate):
+
+2011-03-23  Cris Neckar  <cdn@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Add refptr for widget. Mutations can happen within the event handler.
+        https://bugs.webkit.org/show_bug.cgi?id=56774
+
+        * src/WebPluginContainerImpl.cpp:
+        (WebKit::WebPluginContainerImpl::handleEvent):
+
+2011-03-23  Viet-Trung Luu  <viettrungluu@chromium.org>
+
+        Reviewed by Tony Chang.
+
+        [chromium] Add FormatPlainText to WebClipboard::Format enumeration.
+        https://bugs.webkit.org/show_bug.cgi?id=56868
+
+        Chromium's WebClipboard::isFormatAvailable() will be correspondingly
+        extended.
+
+        * public/WebClipboard.h:
+        * src/AssertMatchingEnums.cpp:
+
+2011-03-23  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        [Chromium] Web Inspector: Remove DebuggerScript.js from Chromium resource bundle.
+        https://bugs.webkit.org/show_bug.cgi?id=56916
+
+        * DEPS: bump up Chromium dependency to the revision where no references to the DebuggerScript.js resource are left.
+        * WebKit.grd:
+
+2011-03-23  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        [Chromium] Web Inspector: remove inspectNode method from WebDevToolsAgent
+        https://bugs.webkit.org/show_bug.cgi?id=56926
+
+        * public/WebDevToolsAgent.h:
+        * src/WebDevToolsAgentImpl.cpp:
+        * src/WebDevToolsAgentImpl.h:
+
+2011-03-23  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r81686.
+        http://trac.webkit.org/changeset/81686
+        https://bugs.webkit.org/show_bug.cgi?id=56914
+
+        Breaks webkit_tests in Chromium again. (Requested by pfeldman
+        on #webkit).
+
+        * WebKit.gyp:
+        * public/WebPageSerializer.h:
+        * public/WebURL.h:
+        * public/WebVector.h:
+        (WebKit::WebVector::operator[]):
+        * src/WebDataSourceImpl.cpp:
+        (WebKit::WebDataSourceImpl::WebDataSourceImpl):
+        * src/WebPageSerializer.cpp:
+        * tests/WebFrameTest.cpp:
+        * tests/WebPageSerializerTest.cpp: Removed.
+        * tests/data/pageserialization/awesome.png: Removed.
+        * tests/data/pageserialization/embed_iframe.html: Removed.
+        * tests/data/pageserialization/object_iframe.html: Removed.
+        * tests/data/pageserialization/simple_iframe.html: Removed.
+        * tests/data/pageserialization/simple_page.html: Removed.
+        * tests/data/pageserialization/top_frame.html: Removed.
+
+2011-03-22  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        [V8] Web Inspector: compile DebuggerScript.js into DebuggerScriptSource.h
+        https://bugs.webkit.org/show_bug.cgi?id=56843
+
+        * public/WebDevToolsAgentClient.h: the script source is now compiled along with the inspector code.
+        * src/WebDevToolsAgentImpl.cpp:
+        (WebKit::WebDevToolsAgentImpl::attach):
+
+2011-03-22  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        [Chromium] Web Inspector: remove obsolete methods from WebDevToolsAgentClient.h
+        https://bugs.webkit.org/show_bug.cgi?id=56897
+
+        * public/WebDevToolsAgentClient.h:
+
+2011-03-22  Noel Gordon  <noel.gordon@gmail.com>
+
+        Reviewed by Tony Chang.
+
+        [chromium] Remove identity from dragTargetDragEnter() function signature
+        https://bugs.webkit.org/show_bug.cgi?id=56875
+
+        First part of 3-sided patch.  Add new function signature sans identity.
+
+        * public/WebView.h:
+        * src/WebViewImpl.cpp:
+        (WebKit::WebViewImpl::dragTargetDragEnter):
+        * src/WebViewImpl.h:
+
+2011-03-22  John Bauman  <jbauman@chromium.org>
+
+        Reviewed by Kenneth Russell.
+
+        Add support for preserveDrawingBuffer context creation attribute
+        https://bugs.webkit.org/show_bug.cgi?id=56431
+
+        * src/GraphicsContext3DChromium.cpp:
+        (WebCore::GraphicsContext3DInternal::markContextChanged):
+        (WebCore::GraphicsContext3DInternal::markLayerComposited):
+        (WebCore::GraphicsContext3DInternal::layerComposited):
+        (WebCore::GraphicsContext3D::layerComposited):
+        * src/GraphicsContext3DInternal.h:
+
+2011-03-22  John Abd-El-Malek  <jam@chromium.org>
+
+        Reviewed by Tony Chang.
+
+        [chromium] Make WebTextCheckingResult&apos;s members be public in preparation for converting it to a struct
+        https://bugs.webkit.org/show_bug.cgi?id=56857
+
+        * DEPS:
+        * public/WebTextCheckingResult.h:
+
+2011-03-22  Jay Civelli  <jcivelli@chromium.org>
+
+        Reviewed by David Levin.
+
+        Relanding:
+        Moving the method that is used to retrieve all the resources in
+        a page from the Chromium code (dom_operations.cc) to WebKit.
+        https://bugs.webkit.org/show_bug.cgi?id=55859
+
+
+        * WebKit.gyp:
+        * public/WebPageSerializer.h:
+        * public/WebURL.h:
+        (WebKit::operator==):
+        (WebKit::operator!=):
+        * public/WebVector.h:
+        (WebKit::WebVector::contains):
+        * src/WebDataSourceImpl.cpp:
+        (WebKit::WebDataSourceImpl::WebDataSourceImpl):
+        * src/WebPageSerializer.cpp:
+        (WebCore::getSubResourceURLFromElement):
+        (WebCore::retrieveResourcesForElement):
+        (WebCore::retrieveResourcesForFrame):
+        (WebKit::WebPageSerializer::retrieveAllResources):
+        * tests/WebFrameTest.cpp:
+        * tests/WebPageSerializerTest.cpp: Added.
+        * tests/data/pageserialization/awesome.png: Added.
+        * tests/data/pageserialization/embed_iframe.html: Added.
+        * tests/data/pageserialization/object_iframe.html: Added.
+        * tests/data/pageserialization/simple_iframe.html: Added.
+        * tests/data/pageserialization/simple_page.html: Added.
+        * tests/data/pageserialization/top_frame.html: Added.
+
+2011-03-22  Noel Gordon  <noel.gordon@gmail.com>
+
+        Reviewed by Tony Chang.
+
+        [chromium] Remove Gears from Chromium WebKit
+        https://bugs.webkit.org/show_bug.cgi?id=56808
+
+        Gears has been removed from Chromium 12. Remove Gears drag drop support
+        from WebKit. That work lead to http://webkit.org/b/25916, a proposal to
+        add native file drag drop, and its subsequent standardization in HTML5.
+
+        * public/WebBindings.h:
+        * public/WebView.h:
+        * src/WebBindings.cpp:
+        (WebKit::getRangeImpl): FIXME note added.
+        * src/WebViewImpl.cpp:
+        (WebKit::WebViewImpl::WebViewImpl):
+        (WebKit::WebViewImpl::dragTargetDragEnter):
+        (WebKit::WebViewImpl::dragTargetDragLeave):
+        (WebKit::WebViewImpl::dragTargetDrop):
+        (WebKit::WebViewImpl::dragTargetDragEnterOrOver):
+        * src/WebViewImpl.h:
+
+2011-03-21  Adam Klein  <adamk@chromium.org>
+
+        Reviewed by David Levin.
+
+        [fileapi] Add URI resolution support to WorkerContext
+        https://bugs.webkit.org/show_bug.cgi?id=55644
+
+        Pass "create" bool through to allow opening
+        a filesystem without allowing creation.
+
+        * src/LocalFileSystemChromium.cpp:
+        (WebCore::LocalFileSystem::readFileSystem):
+        (WebCore::LocalFileSystem::requestFileSystem):
+        * src/WebWorkerBase.cpp:
+        (WebKit::WebWorkerBase::openFileSystemForWorker):
+        * src/WebWorkerBase.h:
+        * src/WorkerFileSystemCallbacksBridge.cpp:
+        (WebKit::WorkerFileSystemCallbacksBridge::postOpenFileSystemToMainThread):
+        (WebKit::WorkerFileSystemCallbacksBridge::openFileSystemOnMainThread):
+        * src/WorkerFileSystemCallbacksBridge.h:
+
+2011-03-21  Ilya Sherman  <isherman@chromium.org>
+
+        Reviewed by James Robinson.
+
+        Remove WebInputElement::isEnabledFormControl() from Chromium WebKit API
+        Clients should instead call into WebFormControlElement::isEnabled().
+        https://bugs.webkit.org/show_bug.cgi?id=56364
+
+        * public/WebInputElement.h: Removed isEnabledFormControl().
+        * src/WebInputElement.cpp: Removed isEnabledFormControl().
+
+2011-03-21  Robert Kroeger  <rjkroege@chromium.org>
+
+        Reviewed by Antonio Gomes.
+
+        Flag to enable a platform specific GestureReocognizer framework in Chromium.
+
+        https://bugs.webkit.org/show_bug.cgi?id=49345
+
+        * features.gypi:
+
+2011-03-21  Tony Chang  <tony@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        [chromium] remove devtools_html's dependency on WebKit.gypi
+        https://bugs.webkit.org/show_bug.cgi?id=56661
+
+        We want to depend on the values in the gypi file, not the gypi file
+        itself.  Actually, if someone edits a gypi file, s/he should re-run
+        gyp to pick up the new dependencies.
+
+        It turns out that this doesn't matter much for this target anymore
+        since we pull the .js dependencies from the inspector html file.
+
+        * WebKit.gyp: cleanup dependencies
+        * scripts/generate_devtools_html.py: remove unused param
+
+2011-03-21  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r81377.
+        http://trac.webkit.org/changeset/81377
+        https://bugs.webkit.org/show_bug.cgi?id=56765
+
+        WebPageSerializerTest.MultipleFrames is broken (Requested by
+        simonjam on #webkit).
+
+        * WebKit.gyp:
+        * public/WebPageSerializer.h:
+        * public/WebURL.h:
+        * public/WebVector.h:
+        (WebKit::WebVector::operator[]):
+        * src/WebDataSourceImpl.cpp:
+        (WebKit::WebDataSourceImpl::WebDataSourceImpl):
+        * src/WebPageSerializer.cpp:
+        * tests/WebFrameTest.cpp:
+        * tests/WebPageSerializerTest.cpp: Removed.
+        * tests/data/pageserialization/awesome.png: Removed.
+        * tests/data/pageserialization/embed_iframe.html: Removed.
+        * tests/data/pageserialization/object_iframe.html: Removed.
+        * tests/data/pageserialization/simple_iframe.html: Removed.
+        * tests/data/pageserialization/simple_page.html: Removed.
+        * tests/data/pageserialization/top_frame.html: Removed.
+
+2011-03-21  Daniel Sievers  <sievers@google.com>
+
+        Reviewed by Simon Fraser.
+
+        [Chromium] Make RenderAsTextBehavior and LayerTreeAsTextBehavior tweakable from the DumpRenderTree commandline
+        https://bugs.webkit.org/show_bug.cgi?id=56139
+
+        * public/WebFrame.h:
+        * src/WebFrameImpl.cpp:
+        (WebKit::WebFrameImpl::renderTreeAsText):
+        (WebKit::WebFrameImpl::layerTreeAsText):
+        * src/WebFrameImpl.h:
+
+2011-03-21  Eric Uhrhane <ericu@chromium.org>
+
+        Reviewed by David Levin.
+
+        [fileapi/chromium] Fetch platform path using GetMetadata before creating File from FileEntry*
+        https://bugs.webkit.org/show_bug.cgi?id=56704
+
+        * src/WebFileSystemCallbacksImpl.cpp:
+        (WebFileSystemCallbacksImpl::didReadMetadata)
+        Pass new platformPath member through.
+
+        * src/WorkerFileSystemCallbacksBridge.cpp:
+        (CrossThreadCopierBase)
+        Copy new platformPath member.
+
+        * public/WebFileInfo.h:
+        (struct WebFileInfo)
+        Add new platformPath member.
+
+2011-03-21  Leandro Gracia Gil  <leandrogracia@chromium.org>
+
+        Reviewed by Steve Block.
+
+        Media Stream API patch 0: adding compilation guards.
+        https://bugs.webkit.org/show_bug.cgi?id=56458
+
+        Enabling the feature by default for chromium builds.
+
+        * features.gypi:
+
+2011-03-21  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: Inspector does not always show correct transfer size (for compressed/chunked data)
+        https://bugs.webkit.org/show_bug.cgi?id=56691
+
+        Added transfer size support in inspector for compressed data.
+
+        * src/ResourceHandle.cpp:
+        (WebCore::ResourceHandleInternal::didReceiveData):
+        * src/WebDevToolsAgentImpl.cpp:
+        (WebKit::WebDevToolsAgentImpl::didReceiveData):
+
+2011-03-20  Bill Budge  <bbudge@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Rename ThreadSafeShared to ThreadSafeRefCounted
+        https://bugs.webkit.org/show_bug.cgi?id=56714
+
+        No new tests. Exposes no new functionality.
+
+        * src/PlatformMessagePortChannel.h:
+        * src/WebWorkerBase.cpp:
+        * src/WorkerFileSystemCallbacksBridge.h:
+        * src/WorkerFileWriterCallbacksBridge.h:
+
+2011-03-18  Tony Chang  <tony@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        [chromium] make devtool concatenation targets conditional based on debug_devtools
+        https://bugs.webkit.org/show_bug.cgi?id=56667
+
+        We don't want to run these targets when debug_devtools=1 because it
+        will overwrite the devtools.js and devtools.css files copied by
+        inspector_resources.  On Linux, this triggers a warning because
+        there are two commands that target the same output file when
+        debug_devtools=1.
+
+        I also removed the 'sources' lines since I don't think they do
+        anything for actions.
+
+        * WebKit.gyp:
+
+2011-03-17  Alexey Marinichev  <amarinichev@chromium.org>
+
+        Reviewed by Kenneth Russell.
+
+        chromium: uninitialized field in WebViewImpl
+        https://bugs.webkit.org/show_bug.cgi?id=56620
+
+        * src/WebViewImpl.cpp:
+        (WebKit::WebViewImpl::WebViewImpl):
+
+2011-03-17  Adrienne Walker  <enne@google.com>
+
+        Reviewed by James Robinson.
+
+        [chromium] Turn off accelerated compositing for RTL style pages.
+        https://bugs.webkit.org/show_bug.cgi?id=56585
+
+        * src/WebViewImpl.cpp:
+        (WebKit::WebViewImpl::layout):
+        (WebKit::WebViewImpl::pageHasRTLStyle):
+        (WebKit::WebViewImpl::setRootGraphicsLayer):
+        * src/WebViewImpl.h:
+
+2011-03-17  Jay Civelli  <jcivelli@chromium.org>
+
+        Reviewed by David Levin.
+
+        Moving the method that is used to retrieve all the resources in
+        a page from the Chromium code (dom_operations.cc) to WebKit.
+        https://bugs.webkit.org/show_bug.cgi?id=55859
+
+        * WebKit.gyp:
+        * public/WebPageSerializer.h:
+        * public/WebURL.h:
+        (WebKit::operator==):
+        (WebKit::operator!=):
+        * public/WebVector.h:
+        (WebKit::WebVector::contains):
+        * src/WebDataSourceImpl.cpp:
+        (WebKit::WebDataSourceImpl::WebDataSourceImpl):
+        * src/WebPageSerializer.cpp:
+        (WebCore::getSubResourceURLFromElement):
+        (WebCore::retrieveResourcesForElement):
+        (WebCore::retrieveResourcesForFrame):
+        (WebKit::WebPageSerializer::retrieveAllResources):
+        * tests/WebFrameTest.cpp:
+        * tests/WebPageSerializerTest.cpp: Added.
+        * tests/data/pageserialization: Added.
+        * tests/data/pageserialization/awesome.png: Added.
+        * tests/data/pageserialization/embed_iframe.html: Added.
+        * tests/data/pageserialization/object_iframe.html: Added.
+        * tests/data/pageserialization/simple_iframe.html: Added.
+        * tests/data/pageserialization/simple_page.html: Added.
+        * tests/data/pageserialization/top_frame.html: Added.
+
+2011-03-17  Tony Chang  <tony@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        [chromium] don't concatenate devtools files when debug_devtools=1
+        https://bugs.webkit.org/show_bug.cgi?id=56572
+
+        * WebKit.gyp:
+
+2011-03-17  Tony Chang  <tony@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        [chromium] minor cleanup of devtools_files variable in WebKit.gyp
+        https://bugs.webkit.org/show_bug.cgi?id=56503
+
+        * WebKit.gyp: Moving duplicate variables out of a condition.
+
+2011-03-16  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by James Robinson.
+
+        Remove USE(BUILTIN_UTF8_CODEC)
+        https://bugs.webkit.org/show_bug.cgi?id=56508
+
+        * features.gypi:
+
+2011-03-16  Tony Chang  <tony@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        [chromium] include inspector gif files in the list of resources
+        https://bugs.webkit.org/show_bug.cgi?id=56504
+
+        * scripts/generate_devtools_grd.py:
+
+2011-03-16  Bill Budge  <bbudge@chromium.org>
+
+        Reviewed by David Levin.
+
+        AssociatedURLLoader does not support Cross Origin Requests
+        https://bugs.webkit.org/show_bug.cgi?id=53925
+
+        No new tests. Exposes no new functionality.
+
+        * public/WebURLLoader.h:
+        (WebKit::WebURLLoaderOptions::WebURLLoaderOptions):
+        * src/AssociatedURLLoader.cpp:
+        (WebKit::AssociatedURLLoader::ClientAdapter::isDocumentThreadableLoaderClient):
+        (WebKit::AssociatedURLLoader::ClientAdapter::clearClient):
+        (WebKit::AssociatedURLLoader::ClientAdapter::create):
+        (WebKit::AssociatedURLLoader::ClientAdapter::ClientAdapter):
+        (WebKit::AssociatedURLLoader::ClientAdapter::willSendRequest):
+        (WebKit::AssociatedURLLoader::ClientAdapter::didSendData):
+        (WebKit::AssociatedURLLoader::ClientAdapter::didReceiveResponse):
+        (WebKit::AssociatedURLLoader::ClientAdapter::didReceiveData):
+        (WebKit::AssociatedURLLoader::ClientAdapter::didReceiveCachedMetadata):
+        (WebKit::AssociatedURLLoader::ClientAdapter::didFinishLoading):
+        (WebKit::AssociatedURLLoader::ClientAdapter::didFail):
+        (WebKit::AssociatedURLLoader::AssociatedURLLoader):
+        (WebKit::AssociatedURLLoader::~AssociatedURLLoader):
+        (WebKit::AssociatedURLLoader::loadSynchronously):
+        (WebKit::AssociatedURLLoader::loadAsynchronously):
+        (WebKit::AssociatedURLLoader::cancel):
+        (WebKit::AssociatedURLLoader::setDefersLoading):
+        * src/AssociatedURLLoader.h:
+
+2011-03-16  Adam Barth  <abarth@webkit.org>
+
+        Roll Chromium DEPS.
+
+        * DEPS:
+
+2011-03-16  Daniel Sievers  <sievers@google.com>
+
+        Reviewed by James Robinson.
+
+        Add setting to always force compositing mode
+        https://bugs.webkit.org/show_bug.cgi?id=56156
+
+        * public/WebSettings.h:
+        * src/WebSettingsImpl.cpp:
+        (WebKit::WebSettingsImpl::setForceCompositingMode):
+        * src/WebSettingsImpl.h:
+
+2011-03-16  Sreeram Ramachandran  <sreeram@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        Revert of r80451. Decided to do this in WebCore instead.
+        https://bugs.webkit.org/show_bug.cgi?id=55844
+
+        * public/WebFrame.h:
+        * src/WebFrameImpl.cpp:
+        * src/WebFrameImpl.h:
+
+2011-03-15  Ilya Sherman  <isherman@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Move isReadOnly() from WebInputElement to WebFormControlElement
+        https://bugs.webkit.org/show_bug.cgi?id=55760
+
+        * public/WebFormControlElement.h:
+        * public/WebInputElement.h:
+        * src/WebFormControlElement.cpp:
+        (WebKit::WebFormControlElement::isReadOnly):
+        * src/WebInputElement.cpp:
+
+2011-03-15  John Bauman  <jbauman@chromium.org>
+
+        Reviewed by Kenneth Russell.
+
+        Non-premultiplied-alpha canvas attribute is ignore for toDataURL, drawImage, texImage2D
+        https://bugs.webkit.org/show_bug.cgi?id=56238
+
+        Add support for reading a webgl context into an ImageData.
+
+        * src/GraphicsContext3DChromium.cpp:
+        (WebCore::GraphicsContext3DInternal::paintRenderingResultsToCanvas):
+        (WebCore::GraphicsContext3DInternal::paintRenderingResultsToImageData):
+        * src/GraphicsContext3DInternal.h:
+
+2011-03-15  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r81144.
+        http://trac.webkit.org/changeset/81144
+        https://bugs.webkit.org/show_bug.cgi?id=56432
+
+        It broke the ui test
+        NPAPITesterBase.GetURLRedirectNotification. (Requested by
+        dave_levin on #webkit).
+
+        * public/WebURLLoader.h:
+        * src/AssociatedURLLoader.cpp:
+        (WebKit::AssociatedURLLoader::AssociatedURLLoader):
+        (WebKit::AssociatedURLLoader::~AssociatedURLLoader):
+        (WebKit::AssociatedURLLoader::loadSynchronously):
+        (WebKit::AssociatedURLLoader::loadAsynchronously):
+        (WebKit::AssociatedURLLoader::cancel):
+        (WebKit::AssociatedURLLoader::setDefersLoading):
+        (WebKit::AssociatedURLLoader::prepareRequest):
+        (WebKit::AssociatedURLLoader::willSendRequest):
+        (WebKit::AssociatedURLLoader::didSendData):
+        (WebKit::AssociatedURLLoader::didReceiveResponse):
+        (WebKit::AssociatedURLLoader::didDownloadData):
+        (WebKit::AssociatedURLLoader::didReceiveData):
+        (WebKit::AssociatedURLLoader::didReceiveCachedMetadata):
+        (WebKit::AssociatedURLLoader::didFinishLoading):
+        (WebKit::AssociatedURLLoader::didFail):
+        * src/AssociatedURLLoader.h:
+
+2011-03-15  Tony Chang  <tony@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        pngcrush images used by inspector
+        https://bugs.webkit.org/show_bug.cgi?id=56426
+
+        This saves 120k in WebCore and 8k in WebKit/chromium.  I ran
+        pngcrush -brute, so none of the meta data (ancillary chunks)
+        are modified.
+
+        * src/js/Images/segmentChromium.png:
+        * src/js/Images/segmentHoverChromium.png:
+        * src/js/Images/segmentHoverEndChromium.png:
+        * src/js/Images/segmentSelectedChromium.png:
+        * src/js/Images/segmentSelectedEndChromium.png:
+        * src/js/Images/statusbarBackgroundChromium.png:
+        * src/js/Images/statusbarBottomBackgroundChromium.png:
+        * src/js/Images/statusbarMenuButtonChromium.png:
+        * src/js/Images/statusbarMenuButtonSelectedChromium.png:
+
+2011-03-15  Michael Nordman  <michaeln@google.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        When initiating a main resource load, let the application cache
+        know which frame the load is being conducted for. This patch doesn't
+        resolve the following bug, but the additional WebFrame parameter
+        should provide the chromium port with enough info to pick the
+        "most appropiate" cached resource.
+        https://bugs.webkit.org/show_bug.cgi?id=55505
+
+        Also fixup a stale comment in stopLoadingInFrame.
+
+        * public/WebApplicationCacheHost.h:
+        (WebKit::WebApplicationCacheHost::willStartMainResourceRequest):
+        * src/ApplicationCacheHost.cpp:
+        (WebCore::ApplicationCacheHost::maybeLoadMainResource):
+        (WebCore::ApplicationCacheHost::stopLoadingInFrame):
+
+2011-03-15  Tony Chang  <tony@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        [chromium] add a build target to create a grd file with devtool resources
+        https://bugs.webkit.org/show_bug.cgi?id=56335
+
+        Reland with a fix to avoid really long command lines on Windows.
+
+        * WebKit.gyp:
+        * scripts/generate_devtools_grd.py: Added.
+
+2011-03-15  Alok priyadarshi  <alokp@chromium.org>
+
+        Reviewed by James Robinson.
+
+        Valgrind error due to uninitialized PluginLayerChromium::m_textureId
+        https://bugs.webkit.org/show_bug.cgi?id=56390
+
+        * src/WebPluginContainerImpl.cpp:
+        (WebKit::WebPluginContainerImpl::setBackingTextureId):
+        (WebKit::WebPluginContainerImpl::platformLayer):
+
+2011-03-15  Brett Wilson  <brettw@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Make WebConsoleMessage properly respect the log level.
+        https://bugs.webkit.org/show_bug.cgi?id=56386
+
+        * public/WebConsoleMessage.h:
+        (WebKit::WebConsoleMessage::WebConsoleMessage):
+
+2011-03-15  Tony Chang  <tony@chromium.org>
+
+        Revert r81147 and r81149, broke the chromium win build.
+
+        * WebKit.gyp:
+        * scripts/generate_devtools_grd.py: Removed.
+
+2011-03-15  Tony Chang  <tony@chromium.org>
+
+        Fix chromium build using python 2.5 (with statement).
+
+        * scripts/generate_devtools_grd.py:
+
+2011-03-15  Tony Chang  <tony@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        [chromium] add a build target to create a grd file with devtool resources
+        https://bugs.webkit.org/show_bug.cgi?id=56335
+
+        This is the webkit side of the fix for
+        http://code.google.com/p/chromium/issues/detail?id=35793
+
+        * WebKit.gyp:
+        * scripts/generate_devtools_grd.py: Added.
+
+2011-03-15  Bill Budge  <bbudge@chromium.org>
+
+        Reviewed by David Levin.
+
+        AssociatedURLLoader does not support Cross Origin Requests
+        https://bugs.webkit.org/show_bug.cgi?id=53925
+
+        No new tests. No new functionality exposed.
+
+        * public/WebURLLoader.h:
+        (WebKit::WebURLLoaderOptions::WebURLLoaderOptions):
+        * src/AssociatedURLLoader.cpp:
+        (WebKit::AssociatedURLLoader::ClientAdapter::clearClient):
+        (WebKit::AssociatedURLLoader::ClientAdapter::create):
+        (WebKit::AssociatedURLLoader::ClientAdapter::ClientAdapter):
+        (WebKit::AssociatedURLLoader::ClientAdapter::willSendRequest):
+        (WebKit::AssociatedURLLoader::ClientAdapter::didSendData):
+        (WebKit::AssociatedURLLoader::ClientAdapter::didReceiveResponse):
+        (WebKit::AssociatedURLLoader::ClientAdapter::didReceiveData):
+        (WebKit::AssociatedURLLoader::ClientAdapter::didReceiveCachedMetadata):
+        (WebKit::AssociatedURLLoader::ClientAdapter::didFinishLoading):
+        (WebKit::AssociatedURLLoader::ClientAdapter::didFail):
+        (WebKit::AssociatedURLLoader::AssociatedURLLoader):
+        (WebKit::AssociatedURLLoader::~AssociatedURLLoader):
+        (WebKit::AssociatedURLLoader::loadSynchronously):
+        (WebKit::AssociatedURLLoader::loadAsynchronously):
+        (WebKit::AssociatedURLLoader::cancel):
+        (WebKit::AssociatedURLLoader::setDefersLoading):
+        * src/AssociatedURLLoader.h:
+
+2011-03-15  Alok priyadarshi  <alokp@chromium.org>
+
+        Reviewed by James Robinson.
+
+        Remove unnecessary function WebPlugin::getBackingTextureId
+        https://bugs.webkit.org/show_bug.cgi?id=56122
+
+        It will be tested by Pepper2D and Pepper3D layout/smoke tests
+        on the Chromium side.
+
+        * public/WebPlugin.h:
+        * src/WebPluginContainerImpl.cpp:
+        (WebKit::WebPluginContainerImpl::platformLayer):
+
+2011-03-15  Mikhail Naganov  <mnaganov@chromium.org>
+
+        Unreviewed. Update chromium deps to pick up the latest V8.
+
+        * DEPS:
+
+2011-03-14  Alexey Marinichev  <amarinichev@chromium.org>
+
+        Reviewed by Kenneth Russell.
+
+        Graphics Context is not properly recovered if the GPU process dies.
+        https://bugs.webkit.org/show_bug.cgi?id=56148
+
+        Split context recreation into two steps.
+
+        * src/WebViewImpl.cpp:
+        (WebKit::WebViewImpl::composite):
+        (WebKit::WebViewImpl::doComposite):
+        (WebKit::WebViewImpl::reallocateRenderer):
+        * src/WebViewImpl.h:
+
+2011-03-14  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r81094.
+        http://trac.webkit.org/changeset/81094
+        https://bugs.webkit.org/show_bug.cgi?id=56355
+
+        Broke the chromium DRT related build. (Requested by dave_levin
+        on #webkit).
+
+        * public/WebFrame.h:
+        * src/WebFrameImpl.cpp:
+        (WebKit::WebFrameImpl::renderTreeAsText):
+        (WebKit::WebFrameImpl::layerTreeAsText):
+        * src/WebFrameImpl.h:
+
+2011-03-14  Daniel Sievers  <sievers@google.com>
+
+        Reviewed by Simon Fraser.
+
+        [Chromium] Make RenderAsTextBehavior and LayerTreeAsTextBehavior tweakable from the DumpRenderTree commandline
+        https://bugs.webkit.org/show_bug.cgi?id=56139
+
+        * public/WebFrame.h:
+        * src/WebFrameImpl.cpp:
+        (WebKit::WebFrameImpl::renderTreeAsText):
+        (WebKit::WebFrameImpl::layerTreeAsText):
+        * src/WebFrameImpl.h:
+
+2011-03-14  John Knottenbelt  <jknotten@chromium.org>
+
+        Reviewed by Steve Block.
+
+        Detach Geolocation from Frame when Page destroyed.
+        https://bugs.webkit.org/show_bug.cgi?id=52877
+
+        Add accessors to the WebGeolocationClientMock to allow the number of
+        pending geolocation permission requests to be queried.
+
+        * public/WebGeolocationClientMock.h:
+        * src/WebGeolocationClientMock.cpp:
+        (WebKit::WebGeolocationClientMock::numberOfPendingPermissionRequests):
+
+2011-03-11  David Levin  <levin@chromium.org>
+
+        Rollout the chromium deps roll as it adds a dependency on a header
+        that the bots building for WebKit don't seem to have.
+
+        Specifically gfx\gl\gl_context_egl.cc depends on d3dcompiler.h
+
+        * DEPS:
+
+2011-03-11  Daniel Cheng  <dcheng@chromium.org>
+
+        Reviewed by Tony Chang.
+
+        [chromium] Correct return type of WebClipboard::readImage.
+        https://bugs.webkit.org/show_bug.cgi?id=56234
+
+        Update the return type to reflect that we are returning a blob of PNG
+        data, not a bitmap.
+
+        * public/WebClipboard.h:
+        (WebKit::WebClipboard::readImage):
+
+2011-03-11  David Levin  <levin@chromium.org>
+
+        Update chromium deps to pick up the skia roll.
+
+        * DEPS:
+
+2011-03-11  Adrienne Walker  <enne@google.com>
+
+        Reviewed by Kenneth Russell.
+
+        Add missing unit tests to TilingData.
+        https://bugs.webkit.org/show_bug.cgi?id=54143
+
+        * tests/TilingDataTest.cpp:
+        (WebCore::TEST):
+
+2011-03-11  Anton D'Auria  <adauria@apple.com>
+
+        Reviewed and landed by Brady Eidson.
+
+        Add WebKit1 API to view and delete local storage
+        https://bugs.webkit.org/show_bug.cgi?id=51878
+
+        * src/StorageNamespaceProxy.cpp:
+        (WebCore::StorageNamespaceProxy::clearOriginForDeletion):
+        (WebCore::StorageNamespaceProxy::clearAllOriginsForDeletion):
+        (WebCore::StorageNamespaceProxy::sync):
+        * src/StorageNamespaceProxy.h:
+
+2011-03-11  Dominic Mazzoni  <dmazzoni@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        Add an accessibilityIsIgnored method to WebAccessibilityObject.
+        https://bugs.webkit.org/show_bug.cgi?id=50969
+
+        * public/WebAccessibilityObject.h:
+        * src/WebAccessibilityObject.cpp:
+        (WebKit::WebAccessibilityObject::accessibilityIsIgnored):
+
+2011-03-11  Avi Drissman  <avi@google.com>
+
+        Reviewed by Tony Chang.
+
+        Fix missing initialization of new member variables.
+        https://bugs.webkit.org/show_bug.cgi?id=50969
+
+        * public/WebMenuItemInfo.h:
+        (WebKit::WebMenuItemInfo::WebMenuItemInfo):
+
+2011-03-11  Roland Steiner  <rolandsteiner@chromium.org>
+
+        Reviewed by Ryosuke Niwa.
+
+        Bug 55570 - Remove dependency of dom/InputElement.cpp on html/ and wml/
+        https://bugs.webkit.org/show_bug.cgi?id=55570
+
+        Add a virtual function toInputElement() to Node that has a default
+        implementation of returning 0.
+        For HTMLInputElement and WMLInputElement (which derive from InputElement)
+        override this to return the object.
+        Change all calling sites of the old toInputElement to use the new member
+        function. This also allows us to save some casts.
+
+        No new tests (refactoring).
+
+        * src/WebInputElement.cpp:
+        (WebKit::toWebInputElement):
+
+2011-03-10  Takayoshi Kochi  <kochi@chromium.org>
+
+        Reviewed by Tony Chang.
+
+        Remove default parameter declaration for familiForChars(), which is no longer necessary.
+
+        * public/gtk/WebFontInfo.h:
+
+2011-03-10  Nat Duca  <nduca@chromium.org>
+
+        Reviewed by James Robinson.
+
+        [chromium] Make updateAndDrawLayers argumentless.
+        https://bugs.webkit.org/show_bug.cgi?id=55985
+
+        Made the TilePainters and viewport parameters for
+        LayerRendererChromium member variables instead of arguments on
+        updateAndDrawLayers. In a future change, this will allows us to
+        draw the layer tree without the WebView's assistance.
+
+        * src/WebViewImpl.cpp:
+        (WebKit::WebViewImpl::resize):
+        (WebKit::WebViewImpl::paint):
+        (WebKit::WebViewImpl::scrollRootLayerRect):
+        (WebKit::WebViewImpl::invalidateRootLayerRect):
+        (WebKit::WebViewImplContentPainter::create):
+        (WebKit::WebViewImplContentPainter::paint):
+        (WebKit::WebViewImplContentPainter::WebViewImplContentPainter):
+        (WebKit::WebViewImplScrollbarPainter::create):
+        (WebKit::WebViewImplScrollbarPainter::paint):
+        (WebKit::WebViewImplScrollbarPainter::WebViewImplScrollbarPainter):
+        (WebKit::WebViewImpl::setIsAcceleratedCompositingActive):
+        (WebKit::WebViewImpl::doComposite):
+        (WebKit::WebViewImpl::reallocateRenderer):
+        (WebKit::WebViewImpl::updateLayerRendererViewport):
+        * src/WebViewImpl.h:
+
+2011-03-10  Tony Chang  <tony@chromium.org>
+
+        Unreviewed, roll chromium version to r77259 to pick up
+        webfontinfo api change.
+
+        * DEPS:
+
+2011-03-10  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r80701.
+        http://trac.webkit.org/changeset/80701
+        https://bugs.webkit.org/show_bug.cgi?id=56126
+
+        fast/dom/Geolocation/window-close-crash.html fails on Snow
+        Leopard release builds (Requested by mihaip on #webkit).
+
+        * public/WebGeolocationClientMock.h:
+        * src/WebGeolocationClientMock.cpp:
+
+2011-03-10  Andrey Kosyakov  <caseq@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: better names for HAR export commands
+        https://bugs.webkit.org/show_bug.cgi?id=56097
+
+        Rename Export to HAR to Copy entry/network log as HAR
+        Expose Copy as HAR unconditionally, remove related settings entry.
+
+        * src/js/DevTools.js: removed override for resourceExportEnabled
+
+2011-01-26  John Knottenbelt  <jknotten@chromium.org>
+
+        Reviewed by Dmitry Titov.
+
+        Detach Geolocation from Frame when Page destroyed.
+        https://bugs.webkit.org/show_bug.cgi?id=52877
+
+        Add accessors to the WebGeolocationClientMock to allow the number of
+        pending geolocation permission requests to be queried.
+
+        * public/WebGeolocationClientMock.h:
+        * src/WebGeolocationClientMock.cpp:
+        (WebKit::WebGeolocationClientMock::numberOfPendingPermissionRequests):
+
+2011-03-08  Hans Wennborg  <hans@chromium.org>
+
+        Reviewed by Jeremy Orlow.
+
+        IndexedDB: Add BackingStoreType parameter to IDBFactoryBackendInterface::open
+        https://bugs.webkit.org/show_bug.cgi?id=55948
+
+        Add a parameter that allows for selection of alternative backing store
+        implementations.
+
+        * public/WebIDBFactory.h:
+        (WebKit::WebIDBFactory::open):
+        * src/AssertMatchingEnums.cpp:
+        * src/IDBFactoryBackendProxy.cpp:
+        (WebCore::IDBFactoryBackendProxy::open):
+        * src/IDBFactoryBackendProxy.h:
+        * src/WebIDBFactoryImpl.cpp:
+        (WebKit::WebIDBFactoryImpl::open):
+        * src/WebIDBFactoryImpl.h:
+
+2011-03-08  Kinuko Yasuda  <kinuko@chromium.org>
+
+        Reviewed by David Levin.
+
+        Destroying WorkerFileSystemCallbacksBridge on main thread results in ASSERT in WorkerContext::Observer::~Observer
+        https://bugs.webkit.org/show_bug.cgi?id=55895
+
+        * src/WorkerFileSystemCallbacksBridge.cpp:
+        (WebKit::WorkerFileSystemCallbacksBridge::runTaskOnWorkerThread):
+        Added stopObserving() so that releasing the bridge on the main thread
+        (this could happen before or after the runTaskOnWorkerThread) does
+        not cause the assertion error.
+
+2011-03-08  Alok priyadarshi  <alokp@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Plugins needs a way to trigger style recalc
+        https://bugs.webkit.org/show_bug.cgi?id=55242
+
+        It will be tested by Pepper2D and Pepper3D layout/smoke tests
+        on the Chromium side.
+        
+        * public/WebPluginContainer.h:
+        * src/WebPluginContainerImpl.cpp:
+        (WebKit::WebPluginContainerImpl::setBackingTextureId):
+        * src/WebPluginContainerImpl.h:
+
+2011-03-08  Andrei Popescu  <andreip@google.com>
+
+        Reviewed by Steve Block.
+
+        IDBCallbacks::onsuccess(IDBIndex*) is unused and should be removed.
+        https://bugs.webkit.org/show_bug.cgi?id=55938
+
+        * public/WebIDBCallbacks.h:
+        * src/IDBCallbacksProxy.cpp:
+        * src/IDBCallbacksProxy.h:
+        * src/WebIDBCallbacksImpl.cpp:
+        * src/WebIDBCallbacksImpl.h:
+        * src/WebIDBObjectStoreImpl.cpp:
+
+2011-03-07  Daniel Cheng  <dcheng@chromium.org>
+
+        Reviewed by David Levin.
+
+        Add support for DataTransferItems
+        https://bugs.webkit.org/show_bug.cgi?id=55115
+
+        Add new runtime enabled flag for data transfer items feature.
+
+        * public/WebRuntimeFeatures.h:
+        * src/WebRuntimeFeatures.cpp:
+        (WebKit::WebRuntimeFeatures::enableDataTransferItems):
+        (WebKit::WebRuntimeFeatures::isDataTransferItemsEnabled):
+
 2011-03-07  Ryosuke Niwa  <rniwa@webkit.org>
 
         Chromium build fix.
diff --git a/Source/WebKit/chromium/DEPS b/Source/WebKit/chromium/DEPS
index 0e8c529..3ab2e78 100644
--- a/Source/WebKit/chromium/DEPS
+++ b/Source/WebKit/chromium/DEPS
@@ -32,7 +32,7 @@
 
 vars = {
   'chromium_svn': 'http://src.chromium.org/svn/trunk/src',
-  'chromium_rev': '77152'
+  'chromium_rev': '79759'
 }
 
 deps = {
diff --git a/Source/WebKit/chromium/WebKit.grd b/Source/WebKit/chromium/WebKit.grd
index 38570b9..4da7600 100644
--- a/Source/WebKit/chromium/WebKit.grd
+++ b/Source/WebKit/chromium/WebKit.grd
@@ -9,7 +9,6 @@
   </outputs>
   <release seq="1">
     <includes>
-      <include name="IDR_DEVTOOLS_DEBUGGER_SCRIPT_JS" file="..\..\..\Source\WebCore\bindings\v8\DebuggerScript.js" type="BINDATA"/>
       <include name="IDR_AUDIO_SPATIALIZATION_T000_P000" file="..\..\WebCore\platform\audio\resources\IRC_Composite_C_R0195_T000_P000.wav" type="BINDATA"/>
       <include name="IDR_AUDIO_SPATIALIZATION_T000_P015" file="..\..\WebCore\platform\audio\resources\IRC_Composite_C_R0195_T000_P015.wav" type="BINDATA"/>
       <include name="IDR_AUDIO_SPATIALIZATION_T000_P030" file="..\..\WebCore\platform\audio\resources\IRC_Composite_C_R0195_T000_P030.wav" type="BINDATA"/>
diff --git a/Source/WebKit/chromium/WebKit.gyp b/Source/WebKit/chromium/WebKit.gyp
index 1cb68f9..d47248e 100644
--- a/Source/WebKit/chromium/WebKit.gyp
+++ b/Source/WebKit/chromium/WebKit.gyp
@@ -44,22 +44,10 @@
                 # e.g. via build-webkit --chromium
                 'chromium_src_dir': '../../WebKit/chromium',
                 'webkit_target_type': 'static_library',
-
-                # List of DevTools source files, ordered by dependencies. It is used both
-                # for copying them to resource dir, and for generating 'devtools.html' file.
-                'devtools_files': [
-                    '<@(devtools_css_files)',
-                    '<@(devtools_js_files)',
-                ],
             },{
                 # WebKit is checked out in src/chromium/third_party/WebKit
                 'chromium_src_dir': '../../../../..',
                 'webkit_target_type': '<(library)',
-
-                'devtools_files': [
-                    '<@(devtools_css_files)',
-                    '<@(devtools_js_files)',
-                ],
             }],
         ],
         'ahem_path': '../../../Tools/DumpRenderTree/qt/fonts/AHEM____.TTF',
@@ -67,6 +55,13 @@
         # If debug_devtools is set to 1, JavaScript files for DevTools are
         # stored as is. Otherwise, a concatenated file is stored.
         'debug_devtools%': 0,
+
+        # List of DevTools source files, ordered by dependencies. It is used both
+        # for copying them to resource dir, and for generating 'devtools.html' file.
+        'devtools_files': [
+            '<@(devtools_css_files)',
+            '<@(devtools_js_files)',
+        ],
     },
     'targets': [
         {
@@ -732,67 +727,57 @@
             'sources': ['<(PRODUCT_DIR)/resources/inspector/devtools.html'],
             'actions': [{
                 'action_name': 'devtools_html',
-                'inputs': [
-                    'scripts/generate_devtools_html.py',
-                    # See issue 29695: WebKit.gypi is a source file for devtools.html.
-                    'WebKit.gypi',
-                    '../../WebCore/inspector/front-end/inspector.html',
-                ],
-                'outputs': ['<(PRODUCT_DIR)/resources/inspector/devtools.html'],
-                'action': ['python', '<@(_inputs)', '<@(_outputs)', '<@(debug_devtools)', '<@(devtools_files)'],
-            }],
-        },
-        {
-            'target_name': 'concatenated_devtools_js',
-            'type': 'none',
-            'dependencies': [
-                'devtools_html',
-                '../../WebCore/WebCore.gyp/WebCore.gyp:inspector_protocol_sources'
-            ],
-            'sources': ['<(PRODUCT_DIR)/resources/inspector/DevTools.js'],
-            'actions': [{
-                'action_name': 'concatenate_devtools_js',
-                'script_name': 'scripts/concatenate_js_files.py',
+                'script_name': 'scripts/generate_devtools_html.py',
                 'input_page': '../../WebCore/inspector/front-end/inspector.html',
                 'inputs': [
                     '<@(_script_name)',
                     '<@(_input_page)',
-                    '<@(webinspector_files)',
                     '<@(devtools_files)',
-                    '<(SHARED_INTERMEDIATE_DIR)/webcore/InspectorBackendStub.js'
-                ],
-                'search_path': [
-                    '../../WebCore/inspector/front-end',
-                    'src/js',
-                    '<(SHARED_INTERMEDIATE_DIR)/webcore',
                 ],
-                'outputs': ['<(PRODUCT_DIR)/resources/inspector/DevTools.js'],
-                'action': ['python', '<@(_script_name)', '<@(_input_page)', '<@(_search_path)', '<@(_outputs)'],
+                'outputs': ['<(PRODUCT_DIR)/resources/inspector/devtools.html'],
+                'action': ['python', '<@(_script_name)', '<@(_input_page)', '<@(_outputs)', '<@(debug_devtools)', '<@(devtools_files)'],
             }],
         },
         {
-            'target_name': 'concatenated_devtools_css',
+            'target_name': 'generate_devtools_grd',
             'type': 'none',
             'dependencies': [
-                'devtools_html'
+                'devtools_html',
+            ],
+            'conditions': [
+                ['debug_devtools==0', {
+                    'dependencies': ['concatenated_devtools_js',
+                                     'concatenated_devtools_css'],
+                },{
+                    # If we're not concatenating devtools files, we want to
+                    # run after the original files have been copied to
+                    # <(PRODUCT_DIR)/resources/inspector.
+                    'dependencies': ['inspector_resources'],
+                }],
             ],
-            'sources': ['<(PRODUCT_DIR)/resources/inspector/devTools.css'],
             'actions': [{
-                'action_name': 'concatenate_devtools_css',
-                'script_name': 'scripts/concatenate_css_files.py',
-                'input_page': '../../WebCore/inspector/front-end/inspector.html',
+                'action_name': 'generate_devtools_grd',
+                'script_name': 'scripts/generate_devtools_grd.py',
+                'input_pages': [
+                    '<(PRODUCT_DIR)/resources/inspector/devtools.html',
+                    '<(PRODUCT_DIR)/resources/inspector/DevTools.js',
+                    '<(PRODUCT_DIR)/resources/inspector/devTools.css',
+                ],
+                'images': [
+                    '<@(webinspector_image_files)',
+                    '<@(devtools_image_files)',
+                ],
                 'inputs': [
                     '<@(_script_name)',
-                    '<@(_input_page)',
-                    '<@(webinspector_files)',
-                    '<@(devtools_files)'
+                    '<@(_input_pages)',
+                    '<@(_images)',
                 ],
                 'search_path': [
-                    '../../WebCore/inspector/front-end',
-                    'src/js',
+                    '../../WebCore/inspector/front-end/Images',
+                    'src/js/Images',
                 ],
-                'outputs': ['<(PRODUCT_DIR)/resources/inspector/devTools.css'],
-                'action': ['python', '<@(_script_name)', '<@(_input_page)', '<@(_search_path)', '<@(_outputs)'],
+                'outputs': ['<(SHARED_INTERMEDIATE_DIR)/devtools/devtools_resources.grd'],
+                'action': ['python', '<@(_script_name)', '<@(_input_pages)', '--images', '<@(_search_path)', '--output', '<@(_outputs)'],
             }],
         },
         {
@@ -832,6 +817,7 @@
                                 'tests/TransparencyWinTest.cpp',
                                 'tests/UniscribeHelperTest.cpp',
                                 'tests/WebFrameTest.cpp',
+                                'tests/WebPageSerializerTest.cpp',
                             ],
                         }],
                         ['OS=="mac"', {
@@ -1151,6 +1137,61 @@
                 },
             ],
         }],
+        ['debug_devtools==0', {
+            'targets': [
+                {
+                    'target_name': 'concatenated_devtools_js',
+                    'type': 'none',
+                    'dependencies': [
+                        'devtools_html',
+                        '../../WebCore/WebCore.gyp/WebCore.gyp:inspector_protocol_sources'
+                    ],
+                    'actions': [{
+                        'action_name': 'concatenate_devtools_js',
+                        'script_name': 'scripts/concatenate_js_files.py',
+                        'input_page': '../../WebCore/inspector/front-end/inspector.html',
+                        'inputs': [
+                            '<@(_script_name)',
+                            '<@(_input_page)',
+                            '<@(webinspector_files)',
+                            '<@(devtools_files)',
+                            '<(SHARED_INTERMEDIATE_DIR)/webcore/InspectorBackendStub.js'
+                        ],
+                        'search_path': [
+                            '../../WebCore/inspector/front-end',
+                            'src/js',
+                            '<(SHARED_INTERMEDIATE_DIR)/webcore',
+                        ],
+                        'outputs': ['<(PRODUCT_DIR)/resources/inspector/DevTools.js'],
+                        'action': ['python', '<@(_script_name)', '<@(_input_page)', '<@(_search_path)', '<@(_outputs)'],
+                    }],
+                },
+                {
+                    'target_name': 'concatenated_devtools_css',
+                    'type': 'none',
+                    'dependencies': [
+                        'devtools_html'
+                    ],
+                    'actions': [{
+                        'action_name': 'concatenate_devtools_css',
+                        'script_name': 'scripts/concatenate_css_files.py',
+                        'input_page': '../../WebCore/inspector/front-end/inspector.html',
+                        'inputs': [
+                            '<@(_script_name)',
+                            '<@(_input_page)',
+                            '<@(webinspector_files)',
+                            '<@(devtools_files)'
+                        ],
+                        'search_path': [
+                            '../../WebCore/inspector/front-end',
+                            'src/js',
+                        ],
+                        'outputs': ['<(PRODUCT_DIR)/resources/inspector/devTools.css'],
+                        'action': ['python', '<@(_script_name)', '<@(_input_page)', '<@(_search_path)', '<@(_outputs)'],
+                    }],
+                },
+            ],
+        }],
     ], # conditions
 }
 
diff --git a/Source/WebKit/chromium/features.gypi b/Source/WebKit/chromium/features.gypi
index 4e91d60..7354eb8 100644
--- a/Source/WebKit/chromium/features.gypi
+++ b/Source/WebKit/chromium/features.gypi
@@ -59,6 +59,7 @@
         'ENABLE_FILTERS=1',
         'ENABLE_FULLSCREEN_API=1',
         'ENABLE_GEOLOCATION=1',
+        'ENABLE_GESTURE_RECOGNIZER=1',
         'ENABLE_ICONDATABASE=0',
         'ENABLE_INDEXED_DATABASE=1',
         'ENABLE_INPUT_SPEECH=1',
@@ -67,6 +68,7 @@
         'ENABLE_LINK_PREFETCH=1',
         'ENABLE_MATHML=0',
         'ENABLE_MEDIA_STATISTICS=1',
+        'ENABLE_MEDIA_STREAM=1',
         'ENABLE_METER_TAG=1',
         'ENABLE_NOTIFICATIONS=1',
         'ENABLE_OFFLINE_WEB_APPLICATIONS=1',
@@ -93,7 +95,6 @@
         'ENABLE_XPATH=1',
         'ENABLE_XSLT=1',
         'WTF_USE_ACCELERATED_COMPOSITING=1',
-        'WTF_USE_BUILTIN_UTF8_CODEC=1',
         'WTF_USE_WEBP=1',
         'WTF_USE_WEBKIT_IMAGE_DECODERS=1',
       ],
diff --git a/Source/WebKit/chromium/public/WebAccessibilityObject.h b/Source/WebKit/chromium/public/WebAccessibilityObject.h
index 67a79e0..bdc3d09d 100644
--- a/Source/WebKit/chromium/public/WebAccessibilityObject.h
+++ b/Source/WebKit/chromium/public/WebAccessibilityObject.h
@@ -118,6 +118,7 @@ public:
     WEBKIT_API WebDocument document() const;
     WEBKIT_API bool hasComputedStyle() const;
     WEBKIT_API WebString computedStyleDisplay() const;
+    WEBKIT_API bool accessibilityIsIgnored() const;
 
 #if WEBKIT_IMPLEMENTATION
     WebAccessibilityObject(const WTF::PassRefPtr<WebCore::AccessibilityObject>&);
diff --git a/Source/WebKit/chromium/public/WebAccessibilityRole.h b/Source/WebKit/chromium/public/WebAccessibilityRole.h
index b0748a7..391b3e2 100644
--- a/Source/WebKit/chromium/public/WebAccessibilityRole.h
+++ b/Source/WebKit/chromium/public/WebAccessibilityRole.h
@@ -116,6 +116,11 @@ enum WebAccessibilityRole {
     WebAccessibilityRoleMenuListPopup,
     WebAccessibilityRoleMenuListOption,
 
+    WebAccessibilityRoleParagraph,
+    WebAccessibilityRoleLabel,
+    WebAccessibilityRoleDiv,
+    WebAccessibilityRoleForm,
+
     WebAccessibilityRoleLandmarkApplication,
     WebAccessibilityRoleLandmarkBanner,
     WebAccessibilityRoleLandmarkComplementary,
diff --git a/Source/WebKit/chromium/public/WebApplicationCacheHost.h b/Source/WebKit/chromium/public/WebApplicationCacheHost.h
index acbc106..8539d82 100644
--- a/Source/WebKit/chromium/public/WebApplicationCacheHost.h
+++ b/Source/WebKit/chromium/public/WebApplicationCacheHost.h
@@ -38,6 +38,7 @@
 namespace WebKit {
 
 class WebApplicationCacheHostClient;
+class WebFrame;
 class WebURL;
 class WebURLRequest;
 class WebURLResponse;
@@ -73,9 +74,11 @@ public:
     virtual ~WebApplicationCacheHost() { }
 
     // Called for every request made within the context.
-    virtual void willStartMainResourceRequest(WebURLRequest&) { }
+    virtual void willStartMainResourceRequest(WebURLRequest& r, const WebFrame*) { willStartMainResourceRequest(r); }
     virtual void willStartSubResourceRequest(WebURLRequest&) { }
 
+    virtual void willStartMainResourceRequest(WebURLRequest&) { } // DEPRECATED, remove after derived classes have caught up.
+
     // One or the other selectCache methods is called after having parsed the <html> tag.
     // The latter returns false if the current document has been identified as a "foreign"
     // entry, in which case the frame navigation will be restarted by webkit.
diff --git a/Source/WebKit/chromium/public/WebAudioDevice.h b/Source/WebKit/chromium/public/WebAudioDevice.h
index a9f5a1c..00aea97 100644
--- a/Source/WebKit/chromium/public/WebAudioDevice.h
+++ b/Source/WebKit/chromium/public/WebAudioDevice.h
@@ -48,6 +48,7 @@ public:
 
     virtual void start() = 0;
     virtual void stop() = 0;
+    virtual double sampleRate() = 0;
 };
 
 } // namespace WebKit
diff --git a/Source/WebKit/chromium/public/WebBindings.h b/Source/WebKit/chromium/public/WebBindings.h
index cb33781..149bff3 100644
--- a/Source/WebKit/chromium/public/WebBindings.h
+++ b/Source/WebKit/chromium/public/WebBindings.h
@@ -40,6 +40,7 @@ namespace WebKit {
 
 class WebDragData;
 class WebElement;
+class WebNode;
 class WebRange;
 
 // A haphazard collection of functions for dealing with plugins.
@@ -55,7 +56,7 @@ public:
     WEBKIT_API static NPObject* createObject(NPP, NPClass*);
 
     // NPN_Enumerate
-    WEBKIT_API static bool enumerate(NPP, NPObject*, NPIdentifier**, uint32_t* count);
+    WEBKIT_API static bool enumerate(NPP, NPObject*, NPIdentifier**, uint32_t* identifierCount);
 
     // NPN_Evaluate
     WEBKIT_API static bool evaluate(NPP, NPObject*, NPString* script, NPVariant* result);
@@ -67,7 +68,7 @@ public:
     WEBKIT_API static NPIdentifier getIntIdentifier(int32_t number);
 
     // NPN_GetProperty
-    WEBKIT_API static bool getProperty(NPP, NPObject*, NPIdentifier propertyName, NPVariant *result);
+    WEBKIT_API static bool getProperty(NPP, NPObject*, NPIdentifier property, NPVariant *result);
 
     // NPN_GetStringIdentifier
     WEBKIT_API static NPIdentifier getStringIdentifier(const NPUTF8* string);
@@ -76,10 +77,10 @@ public:
     WEBKIT_API static void getStringIdentifiers(const NPUTF8** names, int32_t nameCount, NPIdentifier*);
 
     // NPN_HasMethod
-    WEBKIT_API static bool hasMethod(NPP, NPObject*, NPIdentifier methodName);
+    WEBKIT_API static bool hasMethod(NPP, NPObject*, NPIdentifier method);
 
     // NPN_HasProperty
-    WEBKIT_API static bool hasProperty(NPP, NPObject*, NPIdentifier propertyName);
+    WEBKIT_API static bool hasProperty(NPP, NPObject*, NPIdentifier property);
 
     // NPN_IdentifierIsString
     WEBKIT_API static bool identifierIsString(NPIdentifier);
@@ -91,10 +92,10 @@ public:
     WEBKIT_API static int32_t intFromIdentifier(NPIdentifier);
 
     // NPN_Invoke
-    WEBKIT_API static bool invoke(NPP, NPObject*, NPIdentifier methodName, const NPVariant* args, uint32_t count, NPVariant* result);
+    WEBKIT_API static bool invoke(NPP, NPObject*, NPIdentifier method, const NPVariant* args, uint32_t argCount, NPVariant* result);
 
     // NPN_InvokeDefault
-    WEBKIT_API static bool invokeDefault(NPP, NPObject*, const NPVariant* args, uint32_t count, NPVariant* result);
+    WEBKIT_API static bool invokeDefault(NPP, NPObject*, const NPVariant* args, uint32_t argCount, NPVariant* result);
 
     // NPN_ReleaseObject
     WEBKIT_API static void releaseObject(NPObject*);
@@ -127,17 +128,6 @@ public:
     // undefined.  If iString is false, the opposite is true.
     WEBKIT_API static void extractIdentifierData(const NPIdentifier&, const NPUTF8*& string, int32_t& number, bool& isString);
 
-    // Return true (success) if the given npobj is the current drag event in browser dispatch,
-    // and is accessible based on context execution frames and their security origins and
-    // WebKit clipboard access policy. If so, return the event id and the clipboard data (WebDragData).
-    // This only works with V8.  If compiled without V8, it'll always return false.
-    WEBKIT_API static bool getDragData(NPObject* event, int* eventId, WebDragData*);
-
-    // Invoke the event access policy checks listed above with GetDragData().  No need for clipboard
-    // data or event_id outputs, just confirm the given npobj is the current & accessible drag event.
-    // This only works with V8.  If compiled without V8, it'll always return false.
-    WEBKIT_API static bool isDragEvent(NPObject* event);
-
     // Return true (success) if the given npobj is a range object.
     // If so, return that range as a WebRange object.
     WEBKIT_API static bool getRange(NPObject* range, WebRange*);
@@ -148,6 +138,7 @@ public:
 
     WEBKIT_API static NPObject* makeIntArray(const WebVector<int>&);
     WEBKIT_API static NPObject* makeStringArray(const WebVector<WebString>&);
+    WEBKIT_API static NPObject* makeNode(const WebNode&);
 
     // Exceptions -------------------------------------------------------------
 
diff --git a/Source/WebKit/chromium/public/WebClipboard.h b/Source/WebKit/chromium/public/WebClipboard.h
index f9a06cf..1be255a 100644
--- a/Source/WebKit/chromium/public/WebClipboard.h
+++ b/Source/WebKit/chromium/public/WebClipboard.h
@@ -32,18 +32,20 @@
 #define WebClipboard_h
 
 #include "WebCommon.h"
-#include "WebImage.h"
+#include "WebData.h"
 #include "WebString.h"
 #include "WebVector.h"
 
 namespace WebKit {
 
 class WebDragData;
+class WebImage;
 class WebURL;
 
 class WebClipboard {
 public:
     enum Format {
+        FormatPlainText,
         FormatHTML,
         FormatBookmark,
         FormatSmartPaste
@@ -62,7 +64,7 @@ public:
 
     virtual WebString readPlainText(Buffer) { return WebString(); }
     virtual WebString readHTML(Buffer, WebURL*) { return WebString(); }
-    virtual WebImage readImage(Buffer) { return WebImage(); }
+    virtual WebData readImage(Buffer) { return WebData(); }
 
     virtual void writePlainText(const WebString&) { }
     virtual void writeHTML(
diff --git a/Source/WebKit/chromium/public/WebCommonWorkerClient.h b/Source/WebKit/chromium/public/WebCommonWorkerClient.h
index b99d39d..9f11aa2 100644
--- a/Source/WebKit/chromium/public/WebCommonWorkerClient.h
+++ b/Source/WebKit/chromium/public/WebCommonWorkerClient.h
@@ -92,12 +92,6 @@ public:
         WEBKIT_ASSERT_NOT_REACHED();
     }
 
-    // This will be removed once changes in chromium use the new method above.
-    virtual void openFileSystem(WebFileSystem::Type, long long size, WebFileSystemCallbacks*)
-    {
-        WEBKIT_ASSERT_NOT_REACHED();
-    }
-
 protected:
     ~WebCommonWorkerClient() { }
 };
diff --git a/Source/WebKit/chromium/public/WebConsoleMessage.h b/Source/WebKit/chromium/public/WebConsoleMessage.h
index d7a0ead..3dcbc77 100644
--- a/Source/WebKit/chromium/public/WebConsoleMessage.h
+++ b/Source/WebKit/chromium/public/WebConsoleMessage.h
@@ -49,7 +49,7 @@ struct WebConsoleMessage {
     WebConsoleMessage()
         : level(LevelLog) { }
     WebConsoleMessage(Level level, const WebString& text)
-        : level(LevelLog)
+        : level(level)
         , text(text) { }
 };
 
diff --git a/Source/WebKit/chromium/public/WebDOMMouseEvent.h b/Source/WebKit/chromium/public/WebDOMMouseEvent.h
index 4c38b56..c3de098 100644
--- a/Source/WebKit/chromium/public/WebDOMMouseEvent.h
+++ b/Source/WebKit/chromium/public/WebDOMMouseEvent.h
@@ -44,10 +44,10 @@ public:
     WEBKIT_API int screenY() const;
     WEBKIT_API int clientX() const;
     WEBKIT_API int clientY() const;
-    WEBKIT_API int layerX() const;
-    WEBKIT_API int layerY() const;
-    WEBKIT_API int offsetX() const;
-    WEBKIT_API int offsetY() const;
+    WEBKIT_API int layerX();
+    WEBKIT_API int layerY();
+    WEBKIT_API int offsetX();
+    WEBKIT_API int offsetY();
     WEBKIT_API int pageX() const;
     WEBKIT_API int pageY() const;
     WEBKIT_API int x() const;
diff --git a/Source/WebKit/chromium/public/WebDevToolsAgent.h b/Source/WebKit/chromium/public/WebDevToolsAgent.h
index d6a7bcd..03303f7 100644
--- a/Source/WebKit/chromium/public/WebDevToolsAgent.h
+++ b/Source/WebKit/chromium/public/WebDevToolsAgent.h
@@ -33,13 +33,6 @@
 
 #include "WebCommon.h"
 
-#if WEBKIT_USING_V8
-namespace v8 {
-class Value;
-template <class T> class Handle;
-}
-#endif
-
 namespace WebKit {
 class WebDevToolsAgentClient;
 class WebDevToolsMessageTransport;
@@ -65,9 +58,6 @@ public:
     virtual void dispatchOnInspectorBackend(const WebString& message) = 0;
 
     virtual void inspectElementAt(const WebPoint&) = 0;
-#if WEBKIT_USING_V8
-    virtual void inspectNode(v8::Handle<v8::Value>) = 0;
-#endif
     virtual void setRuntimeProperty(const WebString& name, const WebString& value) = 0;
 
     // Exposed for LayoutTestController.
@@ -98,13 +88,6 @@ public:
     // Installs dispatch handle that is going to be called periodically
     // while on a breakpoint.
     WEBKIT_API static void setMessageLoopDispatchHandler(MessageLoopDispatchHandler);
-
-    virtual void identifierForInitialRequest(unsigned long resourceId, WebFrame*, const WebURLRequest&) = 0;
-    virtual void willSendRequest(unsigned long resourceId, WebURLRequest&) = 0;
-    virtual void didReceiveData(unsigned long resourceId, int length) = 0;
-    virtual void didReceiveResponse(unsigned long resourceId, const WebURLResponse&) = 0;
-    virtual void didFinishLoading(unsigned long resourceId) = 0;
-    virtual void didFailLoading(unsigned long resourceId, const WebURLError&) = 0;
 };
 
 } // namespace WebKit
diff --git a/Source/WebKit/chromium/public/WebDevToolsAgentClient.h b/Source/WebKit/chromium/public/WebDevToolsAgentClient.h
index b373b60..3ec5487 100644
--- a/Source/WebKit/chromium/public/WebDevToolsAgentClient.h
+++ b/Source/WebKit/chromium/public/WebDevToolsAgentClient.h
@@ -42,7 +42,6 @@ class WebDevToolsAgentClient {
 public:
     virtual void sendMessageToInspectorFrontend(const WebString&) { }
     virtual void sendDebuggerOutput(const WebString&) { }
-    virtual void sendDispatchToAPU(const WebString&) { }
 
     // Returns the identifier of the entity hosting this agent.
     virtual int hostIdentifier() { return -1; }
@@ -50,8 +49,6 @@ public:
     // Notifies host upon runtime feature being enabled/disabled.
     virtual void runtimePropertyChanged(const WebString& name, const WebString& value) { }
 
-    virtual WebCString debuggerScriptSource() { return WebCString(); }
-
     class WebKitClientMessageLoop {
     public:
         virtual ~WebKitClientMessageLoop() { }
diff --git a/Source/WebKit/chromium/public/WebDocument.h b/Source/WebKit/chromium/public/WebDocument.h
index d9f7386..23f28c3 100644
--- a/Source/WebKit/chromium/public/WebDocument.h
+++ b/Source/WebKit/chromium/public/WebDocument.h
@@ -42,6 +42,7 @@ namespace WTF { template <typename T> class PassRefPtr; }
 #endif
 
 namespace WebKit {
+class WebAccessibilityObject;
 class WebDocumentType;
 class WebElement;
 class WebFrame;
@@ -79,6 +80,7 @@ public:
     WEBKIT_API WebElement getElementById(const WebString&) const;
     WEBKIT_API WebNode focusedNode() const;
     WEBKIT_API WebDocumentType doctype() const;
+    WEBKIT_API WebAccessibilityObject accessibilityObject() const;
 
 #if WEBKIT_IMPLEMENTATION
     WebDocument(const WTF::PassRefPtr<WebCore::Document>&);
diff --git a/Source/WebKit/chromium/public/WebElement.h b/Source/WebKit/chromium/public/WebElement.h
index 8d51e98..2072dd3 100644
--- a/Source/WebKit/chromium/public/WebElement.h
+++ b/Source/WebKit/chromium/public/WebElement.h
@@ -58,6 +58,7 @@ class WebNamedNodeMap;
         WEBKIT_API bool setAttribute(const WebString& name, const WebString& value);
         WEBKIT_API WebNamedNodeMap attributes() const;
         WEBKIT_API WebString innerText() const;
+        WEBKIT_API WebNode shadowRoot();
 
         // Returns the language code specified for this element.  This attribute
         // is inherited, so the returned value is drawn from the closest parent
diff --git a/Source/WebKit/chromium/public/WebFileInfo.h b/Source/WebKit/chromium/public/WebFileInfo.h
index be0b3e4..d326e06 100644
--- a/Source/WebKit/chromium/public/WebFileInfo.h
+++ b/Source/WebKit/chromium/public/WebFileInfo.h
@@ -31,6 +31,8 @@
 #ifndef WebFileInfo_h
 #define WebFileInfo_h
 
+#include "WebString.h"
+
 namespace WebKit {
 
 struct WebFileInfo {
@@ -50,6 +52,8 @@ struct WebFileInfo {
 
     Type type;
 
+    WebString platformPath;
+
     WebFileInfo() : modificationTime(0.0), length(-1), type(TypeUnknown) { }
 };
 
diff --git a/Source/WebKit/chromium/public/WebFormControlElement.h b/Source/WebKit/chromium/public/WebFormControlElement.h
index e70b995..53ef850 100644
--- a/Source/WebKit/chromium/public/WebFormControlElement.h
+++ b/Source/WebKit/chromium/public/WebFormControlElement.h
@@ -54,6 +54,7 @@ public:
     void assign(const WebFormControlElement& e) { WebElement::assign(e); }
 
     WEBKIT_API bool isEnabled() const;
+    WEBKIT_API bool isReadOnly() const;
     WEBKIT_API WebString formControlName() const;
     WEBKIT_API WebString formControlType() const;
 
diff --git a/Source/WebKit/chromium/public/WebFrame.h b/Source/WebKit/chromium/public/WebFrame.h
index f3f5ba6..d5d2ff4 100644
--- a/Source/WebKit/chromium/public/WebFrame.h
+++ b/Source/WebKit/chromium/public/WebFrame.h
@@ -70,11 +70,9 @@ struct WebFindOptions;
 struct WebRect;
 struct WebScriptSource;
 struct WebSize;
+struct WebURLLoaderOptions;
 template <typename T> class WebVector;
 
-// FIXME(jam): take this out once Chromium has this
-#define WEBFRAME_PRINTBEGIN_TAKES_NODE
-
 class WebFrame {
 public:
     // Returns the number of live WebFrame objects, used for leak checking.
@@ -345,10 +343,13 @@ public:
     // DEPRECATED: Please use createAssociatedURLLoader instead.
     virtual void dispatchWillSendRequest(WebURLRequest&) = 0;
 
+    // FIXME: Remove this overload when clients have been changed to pass options.
+    virtual WebURLLoader* createAssociatedURLLoader() = 0;
+
     // Returns a WebURLLoader that is associated with this frame.  The loader
     // will, for example, be cancelled when WebFrame::stopLoading is called.
     // FIXME: stopLoading does not yet cancel an associated loader!!
-    virtual WebURLLoader* createAssociatedURLLoader() = 0;
+    virtual WebURLLoader* createAssociatedURLLoader(const WebURLLoaderOptions&) = 0;
 
     // Called from within WebFrameClient::didReceiveDocumentData to commit
     // data for the frame that will be used to construct the frame's
@@ -365,10 +366,6 @@ public:
     // with a suppressed opener.
     virtual bool willSuppressOpenerInNewFrame() const = 0;
 
-    // Returns true if this frame is in the midst of executing a beforeunload
-    // or unload event handler.
-    virtual bool pageDismissalEventBeingDispatched() const = 0;
-
 
     // Editing -------------------------------------------------------------
 
@@ -549,7 +546,7 @@ public:
 
     // Returns a text representation of the render tree.  This method is used
     // to support layout tests.
-    virtual WebString renderTreeAsText() const = 0;
+    virtual WebString renderTreeAsText(bool showDebugInfo = false) const = 0;
 
     // Returns the counter value for the specified element.  This method is
     // used to support layout tests.
@@ -582,7 +579,7 @@ public:
 
     // Dumps the layer tree, used by the accelerated compositor, in
     // text form. This is used only by layout tests.
-    virtual WebString layerTreeAsText() const = 0;
+    virtual WebString layerTreeAsText(bool showDebugInfo = false) const = 0;
 
 protected:
     ~WebFrame() { }
diff --git a/Source/WebKit/chromium/public/WebGeolocationClientMock.h b/Source/WebKit/chromium/public/WebGeolocationClientMock.h
index 08a85e2..9a39e2e 100644
--- a/Source/WebKit/chromium/public/WebGeolocationClientMock.h
+++ b/Source/WebKit/chromium/public/WebGeolocationClientMock.h
@@ -51,6 +51,7 @@ public:
     WEBKIT_API void setPosition(double latitude, double longitude, double accuracy);
     WEBKIT_API void setError(int errorCode, const WebString& message);
     WEBKIT_API void setPermission(bool);
+    WEBKIT_API int numberOfPendingPermissionRequests() const;
     WEBKIT_API void resetMock();
 
     virtual void startUpdating();
diff --git a/Source/WebKit/chromium/public/WebIDBCallbacks.h b/Source/WebKit/chromium/public/WebIDBCallbacks.h
index 1eb6d3a..ec7c095 100644
--- a/Source/WebKit/chromium/public/WebIDBCallbacks.h
+++ b/Source/WebKit/chromium/public/WebIDBCallbacks.h
@@ -49,8 +49,8 @@ public:
     virtual void onSuccess(WebIDBCursor*) { WEBKIT_ASSERT_NOT_REACHED(); }
     virtual void onSuccess(WebIDBDatabase*) { WEBKIT_ASSERT_NOT_REACHED(); }
     virtual void onSuccess(const WebIDBKey&) { WEBKIT_ASSERT_NOT_REACHED(); }
+    // FIXME: remove after Webkit roll.
     virtual void onSuccess(WebIDBIndex*) { WEBKIT_ASSERT_NOT_REACHED(); }
-    virtual void onSuccess(WebIDBObjectStore*) { WEBKIT_ASSERT_NOT_REACHED(); }
     virtual void onSuccess(WebIDBTransaction*) { WEBKIT_ASSERT_NOT_REACHED(); }
     virtual void onSuccess(const WebSerializedScriptValue&) { WEBKIT_ASSERT_NOT_REACHED(); }
     virtual void onBlocked() { WEBKIT_ASSERT_NOT_REACHED(); }
diff --git a/Source/WebKit/chromium/public/WebIDBFactory.h b/Source/WebKit/chromium/public/WebIDBFactory.h
index 977510f..29414e8 100755
--- a/Source/WebKit/chromium/public/WebIDBFactory.h
+++ b/Source/WebKit/chromium/public/WebIDBFactory.h
@@ -51,8 +51,18 @@ public:
 
     virtual ~WebIDBFactory() { }
 
+    enum BackingStoreType {
+        DefaultBackingStore,
+        LevelDBBackingStore
+    };
+
     // The WebKit implementation of open ignores the WebFrame* parameter.
-    virtual void open(const WebString& name, WebIDBCallbacks*, const WebSecurityOrigin&, WebFrame*, const WebString& dataDir, unsigned long long maximumSize) { WEBKIT_ASSERT_NOT_REACHED(); }
+    // FIXME: Assert not reached when Chromium side is updated.
+    virtual void open(const WebString& name, WebIDBCallbacks* callbacks, const WebSecurityOrigin& origin, WebFrame* frame, const WebString& dataDir, unsigned long long maximumSize, BackingStoreType) { open(name, callbacks, origin, frame, dataDir, maximumSize); }
+
+    // FIXME: Remove this when Chromium side is updated.
+    virtual void open(const WebString& name, WebIDBCallbacks* callbacks, const WebSecurityOrigin& origin, WebFrame* frame, const WebString& dataDir, unsigned long long maximumSize) { open(name, callbacks, origin, frame, dataDir, maximumSize, DefaultBackingStore); }
+
     virtual void deleteDatabase(const WebString& name, WebIDBCallbacks*, const WebSecurityOrigin&, WebFrame*, const WebString& dataDir) { WEBKIT_ASSERT_NOT_REACHED(); }
 };
 
diff --git a/Source/WebKit/chromium/public/WebInputElement.h b/Source/WebKit/chromium/public/WebInputElement.h
index 1f0836b..3ae6578 100644
--- a/Source/WebKit/chromium/public/WebInputElement.h
+++ b/Source/WebKit/chromium/public/WebInputElement.h
@@ -60,8 +60,6 @@ namespace WebKit {
         WEBKIT_API bool isPasswordField() const;
         WEBKIT_API bool isImageButton() const;
         WEBKIT_API bool autoComplete() const;
-        WEBKIT_API bool isReadOnly() const;
-        WEBKIT_API bool isEnabledFormControl() const;
         WEBKIT_API int maxLength() const;
         WEBKIT_API bool isActivatedSubmit() const;
         WEBKIT_API void setActivatedSubmit(bool);
diff --git a/Source/WebKit/chromium/public/WebKitClient.h b/Source/WebKit/chromium/public/WebKitClient.h
index 208ecdd..eb99531 100644
--- a/Source/WebKit/chromium/public/WebKitClient.h
+++ b/Source/WebKit/chromium/public/WebKitClient.h
@@ -286,6 +286,7 @@ public:
 
     // Audio --------------------------------------------------------------
 
+    virtual double audioHardwareSampleRate() { return 0; }
     virtual WebAudioDevice* createAudioDevice(size_t bufferSize, unsigned numberOfChannels, double sampleRate, WebAudioDevice::RenderCallback*) { return 0; }
 
     // FileSystem ----------------------------------------------------------
diff --git a/Source/WebKit/chromium/public/WebMediaPlayerClient.h b/Source/WebKit/chromium/public/WebMediaPlayerClient.h
index 7e5dd68..5f60870 100644
--- a/Source/WebKit/chromium/public/WebMediaPlayerClient.h
+++ b/Source/WebKit/chromium/public/WebMediaPlayerClient.h
@@ -49,6 +49,7 @@ public:
     virtual void sizeChanged() = 0;
     virtual void sawUnsupportedTracks() = 0;
     virtual float volume() const = 0;
+    virtual void playbackStateChanged() = 0;
 
 protected:
     ~WebMediaPlayerClient() { }
diff --git a/Source/WebKit/chromium/public/WebMenuItemInfo.h b/Source/WebKit/chromium/public/WebMenuItemInfo.h
index f6e622a..742b4ef 100644
--- a/Source/WebKit/chromium/public/WebMenuItemInfo.h
+++ b/Source/WebKit/chromium/public/WebMenuItemInfo.h
@@ -49,6 +49,8 @@ struct WebMenuItemInfo {
     WebMenuItemInfo() 
         : type(Option)
         , action(0)
+        , textDirection(WebTextDirectionDefault)
+        , hasTextDirectionOverride(false)
         , enabled(false)
         , checked(false)
     {
diff --git a/Source/WebKit/chromium/public/WebNode.h b/Source/WebKit/chromium/public/WebNode.h
index 7116dfa..92b17d4 100644
--- a/Source/WebKit/chromium/public/WebNode.h
+++ b/Source/WebKit/chromium/public/WebNode.h
@@ -96,6 +96,7 @@ public:
     WEBKIT_API WebNodeList childNodes();
     WEBKIT_API WebString createMarkup() const;
     WEBKIT_API bool isTextNode() const;
+    WEBKIT_API bool isFocusable() const;
     WEBKIT_API bool isContentEditable() const;
     WEBKIT_API bool isElementNode() const;
     WEBKIT_API void addEventListener(const WebString& eventType, WebDOMEventListener* listener, bool useCapture);
diff --git a/Source/WebKit/chromium/public/WebPageSerializer.h b/Source/WebKit/chromium/public/WebPageSerializer.h
index 94f7994..b4d5715 100644
--- a/Source/WebKit/chromium/public/WebPageSerializer.h
+++ b/Source/WebKit/chromium/public/WebPageSerializer.h
@@ -34,10 +34,12 @@
 #include "WebCommon.h"
 
 namespace WebKit {
+class WebCString;
 class WebFrame;
 class WebPageSerializerClient;
 class WebString;
 class WebURL;
+class WebView;
 template <typename T> class WebVector;
 
 // Get html data by serializing all frames of current page with lists
@@ -69,6 +71,14 @@ public:
                                      const WebVector<WebString>& localPaths,
                                      const WebString& localDirectoryName);
 
+    // Retrieve all the resource for the passed view, including the main frame
+    // and sub-frames. Returns true if all resources were retrieved
+    // successfully.
+    WEBKIT_API static bool retrieveAllResources(WebView*,
+                                                const WebVector<WebCString>& supportedSchemes,
+                                                WebVector<WebURL>* resources,
+                                                WebVector<WebURL>* frames);
+
     // FIXME: The following are here for unit testing purposes. Consider
     // changing the unit tests instead.
 
@@ -80,6 +90,6 @@ public:
     WEBKIT_API static WebString generateBaseTagDeclaration(const WebString& baseTarget);
 };
 
-}  // namespace WebKit
+} // namespace WebKit
 
 #endif
diff --git a/Source/WebKit/chromium/public/WebPlugin.h b/Source/WebKit/chromium/public/WebPlugin.h
index 4a6f081..17e29e2 100644
--- a/Source/WebKit/chromium/public/WebPlugin.h
+++ b/Source/WebKit/chromium/public/WebPlugin.h
@@ -64,10 +64,6 @@ public:
     virtual void updateGeometry(
         const WebRect& frameRect, const WebRect& clipRect,
         const WebVector<WebRect>& cutOutsRects, bool isVisible) = 0;
-    
-    // If the plugin instance is backed by an OpenGL texture, return its ID in the
-    // compositors namespace. Otherwise return 0. Returns 0 by default.
-    virtual unsigned getBackingTextureId() { return 0; }
 
     virtual void updateFocus(bool) = 0;
     virtual void updateVisibility(bool) = 0;
diff --git a/Source/WebKit/chromium/public/WebPluginContainer.h b/Source/WebKit/chromium/public/WebPluginContainer.h
index c580f81..026028b 100644
--- a/Source/WebKit/chromium/public/WebPluginContainer.h
+++ b/Source/WebKit/chromium/public/WebPluginContainer.h
@@ -55,6 +55,10 @@ public:
     // WebPlugin::updateGeometry.
     virtual void reportGeometry() = 0;
     
+    // Sets the id of the texture used for hw-accel compositing.
+    // The default value for id is zero which indicates software rendering.
+    // A non-zero value will trigger hw-accelerated compositing.
+    virtual void setBackingTextureId(unsigned) = 0;
     // Called when the backing texture is ready to be composited.
     virtual void commitBackingTexture() {}
     
diff --git a/Source/WebKit/chromium/public/WebRuntimeFeatures.h b/Source/WebKit/chromium/public/WebRuntimeFeatures.h
index c9e32f5..dfaae5e 100644
--- a/Source/WebKit/chromium/public/WebRuntimeFeatures.h
+++ b/Source/WebKit/chromium/public/WebRuntimeFeatures.h
@@ -63,6 +63,9 @@ public:
 
     WEBKIT_API static void enableApplicationCache(bool);
     WEBKIT_API static bool isApplicationCacheEnabled();
+    
+    WEBKIT_API static void enableDataTransferItems(bool);
+    WEBKIT_API static bool isDataTransferItemsEnabled();
 
     WEBKIT_API static void enableGeolocation(bool);
     WEBKIT_API static bool isGeolocationEnabled();
@@ -73,9 +76,6 @@ public:
     WEBKIT_API static void enableWebAudio(bool);
     WEBKIT_API static bool isWebAudioEnabled();
 
-    WEBKIT_API static void enableWebGL(bool);
-    WEBKIT_API static bool isWebGLEnabled();
-
     WEBKIT_API static void enablePushState(bool);
     WEBKIT_API static bool isPushStateEnabled(bool);
 
diff --git a/Source/WebKit/chromium/public/WebSettings.h b/Source/WebKit/chromium/public/WebSettings.h
index 11ed49d..113de52 100644
--- a/Source/WebKit/chromium/public/WebSettings.h
+++ b/Source/WebKit/chromium/public/WebSettings.h
@@ -101,6 +101,7 @@ public:
     virtual bool showPlatformLayerTree() const = 0;
     virtual void setEditingBehavior(EditingBehavior) = 0;
     virtual void setAcceleratedCompositingEnabled(bool) = 0;
+    virtual void setForceCompositingMode(bool) = 0;
     virtual void setCompositeToTextureEnabled(bool) = 0;
     virtual bool compositeToTextureEnabled() const = 0;
     virtual void setAcceleratedCompositingFor3DTransformsEnabled(bool) = 0;
diff --git a/Source/WebKit/chromium/public/WebSpellCheckClient.h b/Source/WebKit/chromium/public/WebSpellCheckClient.h
new file mode 100755
index 0000000..87bdf9e
--- /dev/null
+++ b/Source/WebKit/chromium/public/WebSpellCheckClient.h
@@ -0,0 +1,73 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebSpellCheckClient_h
+#define WebSpellCheckClient_h
+
+#include "WebString.h"
+
+namespace WebKit {
+
+class WebString;
+class WebTextCheckingCompletion;
+
+class WebSpellCheckClient {
+public:
+    // The client should perform spell-checking on the given text. If the
+    // text contains a misspelled word, then upon return misspelledOffset
+    // will point to the start of the misspelled word, and misspelledLength
+    // will indicates its length. Otherwise, if there was not a spelling
+    // error, then upon return misspelledLength is 0.
+    virtual void spellCheck(
+        const WebString& text, int& misspelledOffset, int& misspelledLength) { }
+    // Requests asynchronous spelling and grammar checking, whose result should be
+    // returned by passed completion object.
+    virtual void requestCheckingOfText(const WebString&, WebTextCheckingCompletion*) { }
+
+    // Computes an auto-corrected replacement for a misspelled word. If no
+    // replacement is found, then an empty string is returned.
+    virtual WebString autoCorrectWord(const WebString& misspelledWord) { return WebString(); }
+
+    // Show or hide the spelling UI.
+    virtual void showSpellingUI(bool show) { }
+
+    // Returns true if the spelling UI is showing.
+    virtual bool isShowingSpellingUI() { return false; }
+
+    // Update the spelling UI with the given word.
+    virtual void updateSpellingUIWithMisspelledWord(const WebString& word) { }
+
+protected:
+    ~WebSpellCheckClient() { }
+};
+
+} // namespace WebKit
+
+#endif
diff --git a/Source/WebKit/chromium/public/WebTextCheckingCompletion.h b/Source/WebKit/chromium/public/WebTextCheckingCompletion.h
index 7e6526d..a207a27 100644
--- a/Source/WebKit/chromium/public/WebTextCheckingCompletion.h
+++ b/Source/WebKit/chromium/public/WebTextCheckingCompletion.h
@@ -35,7 +35,7 @@
 
 namespace WebKit {
 
-class WebTextCheckingResult;
+struct WebTextCheckingResult;
 template <typename T> class WebVector;
 
 // Gets called back when WebViewClient finished an asynchronous spell checking.
diff --git a/Source/WebKit/chromium/public/WebTextCheckingResult.h b/Source/WebKit/chromium/public/WebTextCheckingResult.h
index 4d16d31..79fbb56 100644
--- a/Source/WebKit/chromium/public/WebTextCheckingResult.h
+++ b/Source/WebKit/chromium/public/WebTextCheckingResult.h
@@ -36,28 +36,22 @@
 namespace WebKit {
 
 // A checked entry of text checking.
-class WebTextCheckingResult {
-public:
+struct WebTextCheckingResult {
     enum Error {
         ErrorSpelling = 1 << 0,
         ErrorGrammar = 1 << 1
     };
 
-    Error error() const { return m_error; }
-    int position() const { return m_position; }
-    int length() const { return m_length; }
-
-    explicit WebTextCheckingResult(Error error = ErrorSpelling, int position = 0, int length = 0) 
-        : m_error(error)
-        , m_position(position)
-        , m_length(length)
+    explicit WebTextCheckingResult(Error e = ErrorSpelling, int p = 0, int l = 0) 
+        : error(e)
+        , position(p)
+        , length(l)
     {
     }
-    
-private:
-    Error m_error;
-    int m_position;
-    int m_length;
+
+    Error error;
+    int position;
+    int length;
 };
 
 } // namespace WebKit
diff --git a/Source/WebKit/chromium/public/WebURL.h b/Source/WebKit/chromium/public/WebURL.h
index bb90e32..707ba08 100644
--- a/Source/WebKit/chromium/public/WebURL.h
+++ b/Source/WebKit/chromium/public/WebURL.h
@@ -143,6 +143,16 @@ inline bool operator<(const WebURL& a, const WebURL& b)
     return a.spec() < b.spec();
 }
 
+inline bool operator==(const WebURL& a, const WebURL& b)
+{
+    return !a.spec().compare(b.spec());
+}
+
+inline bool operator!=(const WebURL& a, const WebURL& b)
+{
+    return !(a == b);
+}
+
 } // namespace WebKit
 
 #endif
diff --git a/Source/WebKit/chromium/public/WebURLLoader.h b/Source/WebKit/chromium/public/WebURLLoader.h
index 54d105e..38efcb4 100644
--- a/Source/WebKit/chromium/public/WebURLLoader.h
+++ b/Source/WebKit/chromium/public/WebURLLoader.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2009 Google Inc. All rights reserved.
+ * Copyright (C) 2009, 2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -41,6 +41,21 @@ class WebURLRequest;
 class WebURLResponse;
 struct WebURLError;
 
+enum WebCrossOriginRequestPolicy {
+    DenyCrossOriginRequests,
+    UseAccessControl,
+    AllowCrossOriginRequests
+};
+
+struct WebURLLoaderOptions {
+    WebURLLoaderOptions() : sniffContent(false), allowCredentials(false), forcePreflight(false), crossOriginRequestPolicy(DenyCrossOriginRequests) { }
+
+    bool sniffContent; // Whether to sniff content.
+    bool allowCredentials; // Whether to send HTTP credentials and cookies with the request.
+    bool forcePreflight; // If AccessControl is used, whether to force a preflight.
+    WebCrossOriginRequestPolicy crossOriginRequestPolicy;
+};
+
 class WebURLLoader {
 public:
     // The WebURLLoader may be deleted in a call to its client.
diff --git a/Source/WebKit/chromium/public/WebURLLoaderClient.h b/Source/WebKit/chromium/public/WebURLLoaderClient.h
index 87d100f..e306b19 100644
--- a/Source/WebKit/chromium/public/WebURLLoaderClient.h
+++ b/Source/WebKit/chromium/public/WebURLLoaderClient.h
@@ -58,6 +58,10 @@ public:
     virtual void didDownloadData(WebURLLoader*, int dataLength) { }
 
     // Called when a chunk of response data is received.
+    // FIXME(vsevik): rename once original didReceiveData() is removed.
+    virtual void didReceiveData2(WebURLLoader*, const char* data, int dataLength, int lengthReceived) { }
+
+    // FIXME(vsevik): remove once not used downstream
     virtual void didReceiveData(WebURLLoader*, const char* data, int dataLength) { }
 
     // Called when a chunk of renderer-generated metadata is received from the cache.
diff --git a/Source/WebKit/chromium/public/WebVector.h b/Source/WebKit/chromium/public/WebVector.h
index cf3ec95..bb02abc 100644
--- a/Source/WebKit/chromium/public/WebVector.h
+++ b/Source/WebKit/chromium/public/WebVector.h
@@ -125,6 +125,15 @@ public:
         WEBKIT_ASSERT(i < m_size);
         return m_ptr[i];
     }
+    
+    bool contains(const T& value) const
+    {
+        for (size_t i = 0; i < m_size; i++) {
+            if (m_ptr[i] == value)
+                return true;
+        }
+        return false;
+    }
 
     T* data() { return m_ptr; }
     const T* data() const { return m_ptr; }
@@ -172,6 +181,6 @@ private:
     size_t m_size;
 };
 
-}  // namespace WebKit
+} // namespace WebKit
 
 #endif
diff --git a/Source/WebKit/chromium/public/WebView.h b/Source/WebKit/chromium/public/WebView.h
index 081fddb..d32e09c 100644
--- a/Source/WebKit/chromium/public/WebView.h
+++ b/Source/WebKit/chromium/public/WebView.h
@@ -36,9 +36,6 @@
 #include "WebVector.h"
 #include "WebWidget.h"
 
-// FIXME(jam): take out once Chromium rolls past this revision
-#define WEBKIT_HAS_WEB_AUTO_FILL_CLIENT
-
 namespace WebKit {
 
 class WebAccessibilityObject;
@@ -51,6 +48,7 @@ class WebFrameClient;
 class WebGraphicsContext3D;
 class WebNode;
 class WebSettings;
+class WebSpellCheckClient;
 class WebString;
 class WebViewClient;
 struct WebMediaPlayerAction;
@@ -86,9 +84,7 @@ public:
     // Creates a WebView that is NOT yet initialized.  You will need to
     // call initializeMainFrame to finish the initialization.  It is valid
     // to pass null client pointers.
-    WEBKIT_API static WebView* create(WebViewClient*,
-                                      WebDevToolsAgentClient*,
-                                      WebAutoFillClient*);
+    WEBKIT_API static WebView* create(WebViewClient*);
 
     // After creating a WebView, you should immediately call this method.
     // You can optionally modify the settings before calling this method.
@@ -96,6 +92,11 @@ public:
     // child frames.  It is valid to pass a null WebFrameClient pointer.
     virtual void initializeMainFrame(WebFrameClient*) = 0;
 
+    // Initializes the various client interfaces.
+    virtual void setDevToolsAgentClient(WebDevToolsAgentClient*) = 0;
+    virtual void setAutoFillClient(WebAutoFillClient*) = 0;
+    virtual void setSpellCheckClient(WebSpellCheckClient*) = 0;
+
 
     // Options -------------------------------------------------------------
 
@@ -229,7 +230,11 @@ public:
     // Callback methods when a drag-and-drop operation is trying to drop
     // something on the WebView.
     virtual WebDragOperation dragTargetDragEnter(
-        const WebDragData&, int identity,
+        const WebDragData&, int identity, // FIXME: remove identity from this function signature.
+        const WebPoint& clientPoint, const WebPoint& screenPoint,
+        WebDragOperationsMask operationsAllowed) = 0;
+    virtual WebDragOperation dragTargetDragEnter(
+        const WebDragData&,
         const WebPoint& clientPoint, const WebPoint& screenPoint,
         WebDragOperationsMask operationsAllowed) = 0;
     virtual WebDragOperation dragTargetDragOver(
@@ -239,13 +244,6 @@ public:
     virtual void dragTargetDrop(
         const WebPoint& clientPoint, const WebPoint& screenPoint) = 0;
 
-    virtual int dragIdentity() = 0;
-
-    // Helper method for drag and drop target operations: override the
-    // default drop effect with either a "copy" (accept true) or "none"
-    // (accept false) effect.  Return true on success.
-    virtual bool setDropEffect(bool accept) = 0;
-
 
     // Support for resource loading initiated by plugins -------------------
 
diff --git a/Source/WebKit/chromium/public/WebViewClient.h b/Source/WebKit/chromium/public/WebViewClient.h
index 2588788..c168ef2 100644
--- a/Source/WebKit/chromium/public/WebViewClient.h
+++ b/Source/WebKit/chromium/public/WebViewClient.h
@@ -64,7 +64,6 @@ class WebRange;
 class WebSpeechInputController;
 class WebSpeechInputListener;
 class WebStorageNamespace;
-class WebTextCheckingCompletion;
 class WebURL;
 class WebURLRequest;
 class WebView;
@@ -170,32 +169,6 @@ public:
     virtual bool handleCurrentKeyboardEvent() { return false; }
 
 
-    // Spellchecker --------------------------------------------------------
-
-    // The client should perform spell-checking on the given text.  If the
-    // text contains a misspelled word, then upon return misspelledOffset
-    // will point to the start of the misspelled word, and misspelledLength
-    // will indicates its length.  Otherwise, if there was not a spelling
-    // error, then upon return misspelledLength is 0.
-    virtual void spellCheck(
-        const WebString& text, int& misspelledOffset, int& misspelledLength) { }
-    // Requests asynchronous spelling and grammar checking, whose result should be
-    // returned by passed completion object.
-    virtual void requestCheckingOfText(const WebString&, WebTextCheckingCompletion*) { }
-    // Computes an auto-corrected replacement for a misspelled word.  If no
-    // replacement is found, then an empty string is returned.
-    virtual WebString autoCorrectWord(const WebString& misspelledWord) { return WebString(); }
-
-    // Show or hide the spelling UI.
-    virtual void showSpellingUI(bool show) { }
-
-    // Returns true if the spelling UI is showing.
-    virtual bool isShowingSpellingUI() { return false; }
-
-    // Update the spelling UI with the given word.
-    virtual void updateSpellingUIWithMisspelledWord(const WebString& word) { }
-
-
     // Dialogs -------------------------------------------------------------
 
     // This method returns immediately after showing the dialog. When the
diff --git a/Source/WebKit/chromium/public/gtk/WebFontInfo.h b/Source/WebKit/chromium/public/gtk/WebFontInfo.h
index d603372..aa31faf 100644
--- a/Source/WebKit/chromium/public/gtk/WebFontInfo.h
+++ b/Source/WebKit/chromium/public/gtk/WebFontInfo.h
@@ -50,7 +50,7 @@ public:
     //
     // Returns: the font family or an empty string if the request could not be
     // satisfied.
-    WEBKIT_API static WebCString familyForChars(const WebUChar* characters, size_t numCharacters, const char* preferredLocale = 0);
+    WEBKIT_API static WebCString familyForChars(const WebUChar* characters, size_t numCharacters, const char* preferredLocale);
 
     // Fill out the given WebFontRenderStyle with the user's preferences for
     // rendering the given font at the given size.
diff --git a/Source/WebKit/chromium/scripts/generate_devtools_grd.py b/Source/WebKit/chromium/scripts/generate_devtools_grd.py
new file mode 100644
index 0000000..fabe64b
--- /dev/null
+++ b/Source/WebKit/chromium/scripts/generate_devtools_grd.py
@@ -0,0 +1,121 @@
+#!/usr/bin/env python
+#
+# Copyright (C) 2011 Google Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are
+# met:
+#
+#         * Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+#         * Redistributions in binary form must reproduce the above
+# copyright notice, this list of conditions and the following disclaimer
+# in the documentation and/or other materials provided with the
+# distribution.
+#         * Neither the name of Google Inc. nor the names of its
+# contributors may be used to endorse or promote products derived from
+# this software without specific prior written permission.
+#
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+"""Creates a grd file for packaging the inspector files."""
+
+from __future__ import with_statement
+
+import errno
+import os
+import shutil
+import sys
+from xml.dom import minidom
+
+kDevToolsResourcePrefix = 'IDR_DEVTOOLS_'
+kGrdTemplate = '''<?xml version="1.0" encoding="UTF-8"?>
+<grit latest_public_release="0" current_release="1">
+  <outputs>
+    <output filename="grit/devtools_resources.h" type="rc_header">
+      <emit emit_type='prepend'></emit>
+    </output>
+    <output filename="grit/devtools_resources_map.cc" type="resource_file_map_source" />
+    <output filename="grit/devtools_resources_map.h" type="resource_map_header" />
+
+    <output filename="devtools_resources.pak" type="data_package" />
+  </outputs>
+  <release seq="1">
+    <includes></includes>
+  </release>
+</grit>
+'''
+
+
+class ParsedArgs:
+    def __init__(self, source_files, image_dirs, output_filename):
+        self.source_files = source_files
+        self.image_dirs = image_dirs
+        self.output_filename = output_filename
+
+
+def parse_args(argv):
+    images_position = argv.index('--images')
+    output_position = argv.index('--output')
+    source_files = argv[:images_position]
+    image_dirs = argv[images_position + 1:output_position]
+    return ParsedArgs(source_files, image_dirs, argv[output_position + 1])
+
+
+def make_name_from_filename(filename):
+    return (filename.replace('/', '_')
+                    .replace('\\', '_')
+                    .replace('.', '_')).upper()
+
+
+def add_file_to_grd(grd_doc, filename):
+    includes_node = grd_doc.getElementsByTagName('includes')[0]
+    includes_node.appendChild(grd_doc.createTextNode('\n      '))
+
+    new_include_node = grd_doc.createElement('include')
+    new_include_node.setAttribute('name', make_name_from_filename(filename))
+    new_include_node.setAttribute('file', filename)
+    new_include_node.setAttribute('type', 'BINDATA')
+    includes_node.appendChild(new_include_node)
+
+
+def main(argv):
+    parsed_args = parse_args(argv[1:])
+
+    doc = minidom.parseString(kGrdTemplate)
+    output_directory = os.path.dirname(parsed_args.output_filename)
+
+    try:
+        os.makedirs(os.path.join(output_directory, 'Images'))
+    except OSError, e:
+        if e.errno != errno.EEXIST:
+            raise e
+
+    for filename in parsed_args.source_files:
+        shutil.copy(filename, output_directory)
+        add_file_to_grd(doc, os.path.basename(filename))
+
+    for dirname in parsed_args.image_dirs:
+        for filename in os.listdir(dirname):
+            if not filename.endswith('.png') and not filename.endswith('.gif'):
+                continue
+            shutil.copy(os.path.join(dirname, filename),
+                        os.path.join(output_directory, 'Images'))
+            add_file_to_grd(doc, os.path.join('Images', filename))
+
+    with open(parsed_args.output_filename, 'w') as output_file:
+        output_file.write(doc.toxml(encoding='UTF-8'))
+
+
+if __name__ == '__main__':
+    sys.exit(main(sys.argv))
diff --git a/Source/WebKit/chromium/scripts/generate_devtools_html.py b/Source/WebKit/chromium/scripts/generate_devtools_html.py
index b9b5fff..b8eab09 100644
--- a/Source/WebKit/chromium/scripts/generate_devtools_html.py
+++ b/Source/WebKit/chromium/scripts/generate_devtools_html.py
@@ -45,17 +45,17 @@ def GenerateIncludeTag(resource_path):
 
 def main(argv):
 
-    if len(argv) < 5:
-        print('usage: %s ignored inspector_html devtools_html debug'
+    if len(argv) < 4:
+        print('usage: %s inspector_html devtools_html debug'
               ' css_and_js_files_list' % argv[0])
         return 1
 
     # The first argument is ignored. We put 'webkit.gyp' in the inputs list
     # for this script, so every time the list of script gets changed, our html
     # file is rebuilt.
-    inspector_html_name = argv[2]
-    devtools_html_name = argv[3]
-    debug = argv[4] != '0'
+    inspector_html_name = argv[1]
+    devtools_html_name = argv[2]
+    debug = argv[3] != '0'
     inspector_html = open(inspector_html_name, 'r')
     devtools_html = open(devtools_html_name, 'w')
 
@@ -66,7 +66,7 @@ def main(argv):
             continue
         if '</head>' in line:
             if debug:
-                for resource in argv[5:]:
+                for resource in argv[4:]:
                     devtools_html.write(GenerateIncludeTag(resource))
             else:
                 devtools_html.write(GenerateIncludeTag("devTools.css"))
diff --git a/Source/WebKit/chromium/src/ApplicationCacheHost.cpp b/Source/WebKit/chromium/src/ApplicationCacheHost.cpp
index 2696b2c..3981ee9 100644
--- a/Source/WebKit/chromium/src/ApplicationCacheHost.cpp
+++ b/Source/WebKit/chromium/src/ApplicationCacheHost.cpp
@@ -42,6 +42,7 @@
 #include "Page.h"
 #include "ProgressEvent.h"
 #include "Settings.h"
+#include "WebFrameImpl.h"
 #include "WebURL.h"
 #include "WebURLError.h"
 #include "WebURLResponse.h"
@@ -81,7 +82,7 @@ void ApplicationCacheHost::maybeLoadMainResource(ResourceRequest& request, Subst
     m_internal.set(new ApplicationCacheHostInternal(this));
     if (m_internal->m_outerHost) {
         WrappedResourceRequest wrapped(request);
-        m_internal->m_outerHost->willStartMainResourceRequest(wrapped);
+        m_internal->m_outerHost->willStartMainResourceRequest(wrapped, WebFrameImpl::fromFrame(m_documentLoader->frame()));
     } else
         m_internal.clear();
 
@@ -259,7 +260,7 @@ void ApplicationCacheHost::stopDeferringEvents()
 
 void ApplicationCacheHost::stopLoadingInFrame(Frame* frame)
 {
-    // FIXME: Implement this method.
+    // N/A to the chromium port
 }
 
 void ApplicationCacheHost::dispatchDOMEvent(EventID id, int total, int done)
diff --git a/Source/WebKit/chromium/src/AssertMatchingEnums.cpp b/Source/WebKit/chromium/src/AssertMatchingEnums.cpp
index 20fbcd5..7baaf8a 100644
--- a/Source/WebKit/chromium/src/AssertMatchingEnums.cpp
+++ b/Source/WebKit/chromium/src/AssertMatchingEnums.cpp
@@ -45,6 +45,7 @@
 #include "GeolocationError.h"
 #include "GeolocationPosition.h"
 #include "HTMLInputElement.h"
+#include "IDBFactoryBackendInterface.h"
 #include "IDBKey.h"
 #include "MediaPlayer.h"
 #include "NotificationPresenter.h"
@@ -67,6 +68,7 @@
 #include "WebFontDescription.h"
 #include "WebGeolocationError.h"
 #include "WebGeolocationPosition.h"
+#include "WebIDBFactory.h"
 #include "WebIDBKey.h"
 #include "WebInputElement.h"
 #include "WebMediaPlayer.h"
@@ -171,6 +173,10 @@ COMPILE_ASSERT_MATCHING_ENUM(WebAccessibilityRoleTreeItemRole, TreeItemRole);
 COMPILE_ASSERT_MATCHING_ENUM(WebAccessibilityRoleDirectory, DirectoryRole);
 COMPILE_ASSERT_MATCHING_ENUM(WebAccessibilityRoleEditableText, EditableTextRole);
 COMPILE_ASSERT_MATCHING_ENUM(WebAccessibilityRoleListItem, ListItemRole);
+COMPILE_ASSERT_MATCHING_ENUM(WebAccessibilityRoleParagraph, ParagraphRole);
+COMPILE_ASSERT_MATCHING_ENUM(WebAccessibilityRoleLabel, LabelRole);
+COMPILE_ASSERT_MATCHING_ENUM(WebAccessibilityRoleDiv, DivRole);
+COMPILE_ASSERT_MATCHING_ENUM(WebAccessibilityRoleForm, FormRole);
 COMPILE_ASSERT_MATCHING_ENUM(WebAccessibilityRoleLandmarkApplication, LandmarkApplicationRole);
 COMPILE_ASSERT_MATCHING_ENUM(WebAccessibilityRoleLandmarkBanner, LandmarkBannerRole);
 COMPILE_ASSERT_MATCHING_ENUM(WebAccessibilityRoleLandmarkComplementary, LandmarkComplementaryRole);
@@ -209,6 +215,7 @@ COMPILE_ASSERT_MATCHING_ENUM(WebApplicationCacheHost::CachedEvent, ApplicationCa
 COMPILE_ASSERT_MATCHING_ENUM(WebApplicationCacheHost::ObsoleteEvent, ApplicationCacheHost::OBSOLETE_EVENT);
 #endif
 
+COMPILE_ASSERT_MATCHING_ENUM(WebClipboard::FormatPlainText, PasteboardPrivate::PlainTextFormat);
 COMPILE_ASSERT_MATCHING_ENUM(WebClipboard::FormatHTML, PasteboardPrivate::HTMLFormat);
 COMPILE_ASSERT_MATCHING_ENUM(WebClipboard::FormatBookmark, PasteboardPrivate::BookmarkFormat);
 COMPILE_ASSERT_MATCHING_ENUM(WebClipboard::FormatSmartPaste, PasteboardPrivate::WebSmartPasteFormat);
@@ -377,6 +384,9 @@ COMPILE_ASSERT_MATCHING_ENUM(WebIDBKey::StringType, IDBKey::StringType);
 COMPILE_ASSERT_MATCHING_ENUM(WebIDBKey::DateType, IDBKey::DateType);
 COMPILE_ASSERT_MATCHING_ENUM(WebIDBKey::NumberType, IDBKey::NumberType);
 
+COMPILE_ASSERT_MATCHING_ENUM(WebIDBFactory::DefaultBackingStore, IDBFactoryBackendInterface::DefaultBackingStore);
+COMPILE_ASSERT_MATCHING_ENUM(WebIDBFactory::LevelDBBackingStore, IDBFactoryBackendInterface::LevelDBBackingStore);
+
 #if ENABLE(FILE_SYSTEM)
 COMPILE_ASSERT_MATCHING_ENUM(WebFileSystem::TypeTemporary, AsyncFileSystem::Temporary);
 COMPILE_ASSERT_MATCHING_ENUM(WebFileSystem::TypePersistent, AsyncFileSystem::Persistent);
diff --git a/Source/WebKit/chromium/src/AssociatedURLLoader.cpp b/Source/WebKit/chromium/src/AssociatedURLLoader.cpp
index 34a4055..1ca9900 100644
--- a/Source/WebKit/chromium/src/AssociatedURLLoader.cpp
+++ b/Source/WebKit/chromium/src/AssociatedURLLoader.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2010 Google Inc. All rights reserved.
+ * Copyright (C) 2010, 2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -31,103 +31,206 @@
 #include "config.h"
 #include "AssociatedURLLoader.h"
 
+#include "DocumentThreadableLoader.h"
+#include "DocumentThreadableLoaderClient.h"
+#include "SubresourceLoader.h"
 #include "WebApplicationCacheHost.h"
 #include "WebDataSource.h"
 #include "WebFrameImpl.h"
 #include "WebKit.h"
 #include "WebKitClient.h"
+#include "WebURLError.h"
+#include "WebURLLoaderClient.h"
 #include "WebURLRequest.h"
+#include "WrappedResourceRequest.h"
+#include "WrappedResourceResponse.h"
+
+using namespace WebCore;
+using namespace WebKit;
+using namespace WTF;
 
 namespace WebKit {
 
-AssociatedURLLoader::AssociatedURLLoader(PassRefPtr<WebFrameImpl> frameImpl)
-    : m_frameImpl(frameImpl),
-      m_realLoader(webKitClient()->createURLLoader()),
-      m_realClient(0)
+// This class bridges the interface differences between WebCore and WebKit loader clients.
+// It forwards its ThreadableLoaderClient notifications to a WebURLLoaderClient.
+class AssociatedURLLoader::ClientAdapter : public DocumentThreadableLoaderClient {
+public:
+    static PassOwnPtr<ClientAdapter> create(AssociatedURLLoader*, WebURLLoaderClient*, bool /*downloadToFile*/);
+
+    virtual void didSendData(unsigned long long /*bytesSent*/, unsigned long long /*totalBytesToBeSent*/);
+    virtual void willSendRequest(ResourceRequest& /*newRequest*/, const ResourceResponse& /*redirectResponse*/);
+
+    virtual void didReceiveResponse(const ResourceResponse&);
+    virtual void didReceiveData(const char*, int /*dataLength*/);
+    virtual void didReceiveCachedMetadata(const char*, int /*dataLength*/);
+    virtual void didFinishLoading(unsigned long /*identifier*/, double /*finishTime*/);
+    virtual void didFail(const ResourceError&);
+
+    virtual bool isDocumentThreadableLoaderClient() { return true; }
+
+    // This method stops loading and releases the DocumentThreadableLoader as early as possible.
+    void clearClient() { m_client = 0; }
+
+private:
+    ClientAdapter(AssociatedURLLoader*, WebURLLoaderClient*, bool /*downloadToFile*/);
+
+    AssociatedURLLoader* m_loader;
+    WebURLLoaderClient* m_client;
+    unsigned long m_downloadLength;
+    bool m_downloadToFile;
+};
+
+PassOwnPtr<AssociatedURLLoader::ClientAdapter> AssociatedURLLoader::ClientAdapter::create(AssociatedURLLoader* loader, WebURLLoaderClient* client, bool downloadToFile)
 {
+    return adoptPtr(new ClientAdapter(loader, client, downloadToFile));
 }
 
-AssociatedURLLoader::~AssociatedURLLoader()
+AssociatedURLLoader::ClientAdapter::ClientAdapter(AssociatedURLLoader* loader, WebURLLoaderClient* client, bool downloadToFile)
+    : m_loader(loader)
+    , m_client(client)
+    , m_downloadLength(0)
+    , m_downloadToFile(downloadToFile)
 {
+    ASSERT(m_loader);
+    ASSERT(m_client);
 }
 
-void AssociatedURLLoader::loadSynchronously(const WebURLRequest& request, WebURLResponse& response, WebURLError& error, WebData& data)
+void AssociatedURLLoader::ClientAdapter::willSendRequest(ResourceRequest& newRequest, const ResourceResponse& redirectResponse)
 {
-    ASSERT(!m_realClient);
-
-    WebURLRequest requestCopy(request);
-    prepareRequest(requestCopy);
+    if (!m_client)
+        return;
 
-    m_realLoader->loadSynchronously(requestCopy, response, error, data);
+    WrappedResourceRequest wrappedNewRequest(newRequest);
+    WrappedResourceResponse wrappedRedirectResponse(redirectResponse);
+    m_client->willSendRequest(m_loader, wrappedNewRequest, wrappedRedirectResponse);
 }
 
-void AssociatedURLLoader::loadAsynchronously(const WebURLRequest& request, WebURLLoaderClient* client)
+void AssociatedURLLoader::ClientAdapter::didSendData(unsigned long long bytesSent, unsigned long long totalBytesToBeSent)
 {
-    ASSERT(!m_realClient);
+    if (!m_client)
+        return;
 
-    WebURLRequest requestCopy(request);
-    prepareRequest(requestCopy);
+    m_client->didSendData(m_loader, bytesSent, totalBytesToBeSent);
+}
 
-    m_realClient = client;
-    m_realLoader->loadAsynchronously(requestCopy, this);
+void AssociatedURLLoader::ClientAdapter::didReceiveResponse(const ResourceResponse& response)
+{
+    WrappedResourceResponse wrappedResponse(response);
+    m_client->didReceiveResponse(m_loader, wrappedResponse);
 }
 
-void AssociatedURLLoader::cancel()
+void AssociatedURLLoader::ClientAdapter::didReceiveData(const char* data, int dataLength)
 {
-    m_realLoader->cancel();
+    if (!m_client)
+        return;
+
+    // FIXME(vsevik): add -1 to params once migrated.
+    m_client->didReceiveData(m_loader, data, dataLength);
+    m_downloadLength += dataLength;
 }
 
-void AssociatedURLLoader::setDefersLoading(bool defersLoading)
+void AssociatedURLLoader::ClientAdapter::didReceiveCachedMetadata(const char* data, int lengthReceived)
 {
-    m_realLoader->setDefersLoading(defersLoading);
+    if (!m_client)
+        return;
+
+    m_client->didReceiveCachedMetadata(m_loader, data, lengthReceived);
 }
 
-void AssociatedURLLoader::prepareRequest(WebURLRequest& request)
+void AssociatedURLLoader::ClientAdapter::didFinishLoading(unsigned long identifier, double finishTime)
 {
-    WebApplicationCacheHost* applicationCacheHost = m_frameImpl->dataSource()->applicationCacheHost();
-    if (applicationCacheHost)
-        applicationCacheHost->willStartSubResourceRequest(request);
-    m_frameImpl->dispatchWillSendRequest(request);
+    if (!m_client)
+        return;
+
+    if (m_downloadToFile) {
+        int downloadLength = m_downloadLength <= INT_MAX ? m_downloadLength : INT_MAX;
+        m_client->didDownloadData(m_loader, downloadLength);
+        // While the client could have cancelled, continue, since the load finished. 
+    }
+
+    m_client->didFinishLoading(m_loader, finishTime);
 }
 
-void AssociatedURLLoader::willSendRequest(WebURLLoader*, WebURLRequest& newRequest, const WebURLResponse& redirectResponse)
+void AssociatedURLLoader::ClientAdapter::didFail(const ResourceError& error)
 {
-    m_realClient->willSendRequest(this, newRequest, redirectResponse);
+    if (!m_client)
+        return;
+
+    WebURLError webError(error);
+    m_client->didFail(m_loader, webError);
 }
 
-void AssociatedURLLoader::didSendData(WebURLLoader*, unsigned long long bytesSent, unsigned long long totalBytesToBeSent)
+AssociatedURLLoader::AssociatedURLLoader(PassRefPtr<WebFrameImpl> frameImpl)
+    : m_frameImpl(frameImpl)
+    , m_client(0)
 {
-    m_realClient->didSendData(this, bytesSent, totalBytesToBeSent);
+    ASSERT(m_frameImpl);
+
+    m_options.sniffContent = false;
+    m_options.allowCredentials = true;
+    m_options.forcePreflight = false;
+    m_options.crossOriginRequestPolicy = AllowCrossOriginRequests; // TODO(bbudge) Default should be DenyCrossOriginRequests, but this would break some tests.
 }
 
-void AssociatedURLLoader::didReceiveResponse(WebURLLoader*, const WebURLResponse& response)
+AssociatedURLLoader::AssociatedURLLoader(PassRefPtr<WebFrameImpl> frameImpl, const WebURLLoaderOptions& options)
+    : m_frameImpl(frameImpl)
+    , m_options(options)
+    , m_client(0)
 {
-    m_realClient->didReceiveResponse(this, response);
+    ASSERT(m_frameImpl);
 }
 
-void AssociatedURLLoader::didDownloadData(WebURLLoader*, int dataLength)
+AssociatedURLLoader::~AssociatedURLLoader()
 {
-    m_realClient->didDownloadData(this, dataLength);
+    if (m_clientAdapter)
+        m_clientAdapter->clearClient();
 }
 
-void AssociatedURLLoader::didReceiveData(WebURLLoader*, const char* data, int dataLength)
+#define COMPILE_ASSERT_MATCHING_ENUM(webkit_name, webcore_name) \
+    COMPILE_ASSERT(static_cast<int>(WebKit::webkit_name) == static_cast<int>(WebCore::webcore_name), mismatching_enums)
+
+COMPILE_ASSERT_MATCHING_ENUM(DenyCrossOriginRequests, DenyCrossOriginRequests);
+COMPILE_ASSERT_MATCHING_ENUM(UseAccessControl, UseAccessControl);
+COMPILE_ASSERT_MATCHING_ENUM(AllowCrossOriginRequests, AllowCrossOriginRequests);
+
+void AssociatedURLLoader::loadSynchronously(const WebURLRequest& request, WebURLResponse& response, WebURLError& error, WebData& data)
 {
-    m_realClient->didReceiveData(this, data, dataLength);
+    ASSERT(0); // Synchronous loading is not supported.
 }
 
-void AssociatedURLLoader::didReceiveCachedMetadata(WebURLLoader*, const char* data, int dataLength)
+void AssociatedURLLoader::loadAsynchronously(const WebURLRequest& request, WebURLLoaderClient* client)
 {
-    m_realClient->didReceiveCachedMetadata(this, data, dataLength);
+    ASSERT(!m_client);
+
+    m_client = client;
+    ASSERT(m_client);
+
+    ThreadableLoaderOptions options;
+    options.sendLoadCallbacks = true; // Always send callbacks.
+    options.sniffContent = m_options.sniffContent;
+    options.allowCredentials = m_options.allowCredentials;
+    options.forcePreflight = m_options.forcePreflight;
+    options.crossOriginRequestPolicy = static_cast<WebCore::CrossOriginRequestPolicy>(m_options.crossOriginRequestPolicy);
+
+    const ResourceRequest& webcoreRequest = request.toResourceRequest();
+    Document* webcoreDocument = m_frameImpl->frame()->document();
+    m_clientAdapter = ClientAdapter::create(this, m_client, request.downloadToFile());
+
+    m_loader = DocumentThreadableLoader::create(webcoreDocument, m_clientAdapter.get(), webcoreRequest, options);
 }
 
-void AssociatedURLLoader::didFinishLoading(WebURLLoader*, double finishTime)
+void AssociatedURLLoader::cancel()
 {
-    m_realClient->didFinishLoading(this, finishTime);
+    if (m_loader) {
+        m_clientAdapter->clearClient();
+        m_loader->cancel();
+    }
 }
 
-void AssociatedURLLoader::didFail(WebURLLoader*, const WebURLError& error)
+void AssociatedURLLoader::setDefersLoading(bool defersLoading)
 {
-    m_realClient->didFail(this, error);
+    if (m_loader)
+        m_loader->setDefersLoading(defersLoading);
 }
 
 } // namespace WebKit
diff --git a/Source/WebKit/chromium/src/AssociatedURLLoader.h b/Source/WebKit/chromium/src/AssociatedURLLoader.h
index 91cb0bf..ed183e5 100644
--- a/Source/WebKit/chromium/src/AssociatedURLLoader.h
+++ b/Source/WebKit/chromium/src/AssociatedURLLoader.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2010 Google Inc. All rights reserved.
+ * Copyright (C) 2010, 2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -32,20 +32,22 @@
 #define AssociatedURLLoader_h
 
 #include "WebURLLoader.h"
-#include "WebURLLoaderClient.h"
+#include <wtf/Noncopyable.h>
 #include <wtf/OwnPtr.h>
 #include <wtf/RefPtr.h>
 
+namespace WebCore { class DocumentThreadableLoader; }
+
 namespace WebKit {
 
 class WebFrameImpl;
 
 // This class is used to implement WebFrame::createAssociatedURLLoader.
-// FIXME: Implement in terms of WebCore::SubresourceLoader.
-class AssociatedURLLoader : public WebURLLoader,
-                            public WebURLLoaderClient {
+class AssociatedURLLoader : public WebURLLoader {
+    WTF_MAKE_NONCOPYABLE(AssociatedURLLoader);
 public:
     AssociatedURLLoader(PassRefPtr<WebFrameImpl>);
+    AssociatedURLLoader(PassRefPtr<WebFrameImpl>, const WebURLLoaderOptions&);
     ~AssociatedURLLoader();
 
     // WebURLLoader methods:
@@ -54,22 +56,15 @@ public:
     virtual void cancel();
     virtual void setDefersLoading(bool);
 
-    // WebURLLoaderClient methods:
-    virtual void willSendRequest(WebURLLoader*, WebURLRequest& newRequest, const WebURLResponse& redirectResponse);
-    virtual void didSendData(WebURLLoader*, unsigned long long bytesSent, unsigned long long totalBytesToBeSent);
-    virtual void didReceiveResponse(WebURLLoader*, const WebURLResponse&);
-    virtual void didDownloadData(WebURLLoader*, int dataLength);
-    virtual void didReceiveData(WebURLLoader*, const char* data, int dataLength);
-    virtual void didReceiveCachedMetadata(WebURLLoader*, const char* data, int dataLength);
-    virtual void didFinishLoading(WebURLLoader*, double finishTime);
-    virtual void didFail(WebURLLoader*, const WebURLError&);
-
 private:
-    void prepareRequest(WebURLRequest&);
+
+    class ClientAdapter;
 
     RefPtr<WebFrameImpl> m_frameImpl;
-    OwnPtr<WebURLLoader> m_realLoader;
-    WebURLLoaderClient* m_realClient;
+    WebURLLoaderOptions m_options;
+    WebURLLoaderClient* m_client;
+    OwnPtr<ClientAdapter> m_clientAdapter;
+    RefPtr<WebCore::DocumentThreadableLoader> m_loader;
 };
 
 } // namespace WebKit
diff --git a/Source/WebKit/chromium/src/AudioDestinationChromium.cpp b/Source/WebKit/chromium/src/AudioDestinationChromium.cpp
index a483308..6fc51db 100644
--- a/Source/WebKit/chromium/src/AudioDestinationChromium.cpp
+++ b/Source/WebKit/chromium/src/AudioDestinationChromium.cpp
@@ -98,8 +98,7 @@ void AudioDestinationChromium::stop()
 
 double AudioDestination::hardwareSampleRate()
 {
-    // FIXME: implement this properly for Chromium.
-    return 44100.0;
+    return webKitClient()->audioHardwareSampleRate();
 }
 
 // Pulls on our provider to get the rendered audio stream.
diff --git a/Source/WebKit/chromium/src/ChromeClientImpl.cpp b/Source/WebKit/chromium/src/ChromeClientImpl.cpp
index 1e639ec..99302cc 100644
--- a/Source/WebKit/chromium/src/ChromeClientImpl.cpp
+++ b/Source/WebKit/chromium/src/ChromeClientImpl.cpp
@@ -857,7 +857,7 @@ void ChromeClientImpl::exitFullscreenForNode(WebCore::Node* node)
 }
 
 #if ENABLE(FULLSCREEN_API)
-bool ChromeClientImpl::supportsFullScreenForElement(const WebCore::Element* element)
+bool ChromeClientImpl::supportsFullScreenForElement(const WebCore::Element* element, bool withKeyboard)
 {
     return m_webView->page()->settings()->fullScreenEnabled();
 }
diff --git a/Source/WebKit/chromium/src/ChromeClientImpl.h b/Source/WebKit/chromium/src/ChromeClientImpl.h
index e70b766..f3a48ee 100644
--- a/Source/WebKit/chromium/src/ChromeClientImpl.h
+++ b/Source/WebKit/chromium/src/ChromeClientImpl.h
@@ -166,7 +166,7 @@ public:
     virtual void exitFullscreenForNode(WebCore::Node*);
 
 #if ENABLE(FULLSCREEN_API)
-    virtual bool supportsFullScreenForElement(const WebCore::Element*);
+    virtual bool supportsFullScreenForElement(const WebCore::Element*, bool withKeyboard);
     virtual void enterFullScreenForElement(WebCore::Element*);
     virtual void exitFullScreenForElement(WebCore::Element*);
     virtual void fullScreenRendererChanged(WebCore::RenderBox*);
diff --git a/Source/WebKit/chromium/src/DebuggerAgentManager.cpp b/Source/WebKit/chromium/src/DebuggerAgentManager.cpp
index b76bcfe..368b78c 100644
--- a/Source/WebKit/chromium/src/DebuggerAgentManager.cpp
+++ b/Source/WebKit/chromium/src/DebuggerAgentManager.cpp
@@ -34,7 +34,7 @@
 #include "DebuggerAgentImpl.h"
 #include "Frame.h"
 #include "PageGroupLoadDeferrer.h"
-#include "ScriptDebugServer.h"
+#include "PageScriptDebugServer.h"
 #include "V8Proxy.h"
 #include "WebDevToolsAgentImpl.h"
 #include "WebFrameImpl.h"
@@ -247,7 +247,7 @@ void DebuggerAgentManager::setMessageLoopDispatchHandler(WebDevToolsAgent::Messa
 void DebuggerAgentManager::setExposeV8DebuggerProtocol(bool value)
 {
     s_exposeV8DebuggerProtocol = value;
-    WebCore::ScriptDebugServer::shared().setEnabled(!s_exposeV8DebuggerProtocol);
+    WebCore::PageScriptDebugServer::shared().setEnabled(!s_exposeV8DebuggerProtocol);
 }
 
 void DebuggerAgentManager::setHostId(WebFrameImpl* webframe, int hostId)
diff --git a/Source/WebKit/chromium/src/EditorClientImpl.cpp b/Source/WebKit/chromium/src/EditorClientImpl.cpp
index 38d4f5e..6f2231d 100644
--- a/Source/WebKit/chromium/src/EditorClientImpl.cpp
+++ b/Source/WebKit/chromium/src/EditorClientImpl.cpp
@@ -54,6 +54,7 @@
 #include "WebNode.h"
 #include "WebPasswordAutocompleteListener.h"
 #include "WebRange.h"
+#include "WebSpellCheckClient.h"
 #include "WebTextAffinity.h"
 #include "WebTextCheckingCompletionImpl.h"
 #include "WebViewClient.h"
@@ -856,8 +857,8 @@ void EditorClientImpl::checkSpellingOfString(const UChar* text, int length,
     int spellLength = 0;
 
     // Check to see if the provided text is spelled correctly.
-    if (isContinuousSpellCheckingEnabled() && m_webView->client())
-        m_webView->client()->spellCheck(WebString(text, length), spellLocation, spellLength);
+    if (isContinuousSpellCheckingEnabled() && m_webView->spellCheckClient())
+        m_webView->spellCheckClient()->spellCheck(WebString(text, length), spellLocation, spellLength);
     else {
         spellLocation = 0;
         spellLength = 0;
@@ -873,7 +874,8 @@ void EditorClientImpl::checkSpellingOfString(const UChar* text, int length,
 
 void EditorClientImpl::requestCheckingOfString(SpellChecker* sender, int identifier, const String& text)
 {
-    m_webView->client()->requestCheckingOfText(text, new WebTextCheckingCompletionImpl(identifier, sender));
+    if (m_webView->spellCheckClient())
+        m_webView->spellCheckClient()->requestCheckingOfText(text, new WebTextCheckingCompletionImpl(identifier, sender));
 }
 
 String EditorClientImpl::getAutoCorrectSuggestionForMisspelledWord(const String& misspelledWord)
@@ -888,7 +890,9 @@ String EditorClientImpl::getAutoCorrectSuggestionForMisspelledWord(const String&
             return String();
     }
 
-    return m_webView->client()->autoCorrectWord(WebString(misspelledWord));
+    if (m_webView->spellCheckClient())
+        return m_webView->spellCheckClient()->autoCorrectWord(WebString(misspelledWord));
+    return String();
 }
 
 void EditorClientImpl::checkGrammarOfString(const UChar*, int length,
@@ -911,20 +915,20 @@ void EditorClientImpl::updateSpellingUIWithGrammarString(const String&,
 
 void EditorClientImpl::updateSpellingUIWithMisspelledWord(const String& misspelledWord)
 {
-    if (m_webView->client())
-        m_webView->client()->updateSpellingUIWithMisspelledWord(WebString(misspelledWord));
+    if (m_webView->spellCheckClient())
+        m_webView->spellCheckClient()->updateSpellingUIWithMisspelledWord(WebString(misspelledWord));
 }
 
 void EditorClientImpl::showSpellingUI(bool show)
 {
-    if (m_webView->client())
-        m_webView->client()->showSpellingUI(show);
+    if (m_webView->spellCheckClient())
+        m_webView->spellCheckClient()->showSpellingUI(show);
 }
 
 bool EditorClientImpl::spellingUIIsShowing()
 {
-    if (m_webView->client())
-        return m_webView->client()->isShowingSpellingUI();
+    if (m_webView->spellCheckClient())
+        return m_webView->spellCheckClient()->isShowingSpellingUI();
     return false;
 }
 
diff --git a/Source/WebKit/chromium/src/FrameLoaderClientImpl.cpp b/Source/WebKit/chromium/src/FrameLoaderClientImpl.cpp
index dc47923..647a70c 100644
--- a/Source/WebKit/chromium/src/FrameLoaderClientImpl.cpp
+++ b/Source/WebKit/chromium/src/FrameLoaderClientImpl.cpp
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2009 Google Inc. All rights reserved.
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -1479,7 +1480,8 @@ PassRefPtr<Widget> FrameLoaderClientImpl::createJavaAppletWidget(
 
 ObjectContentType FrameLoaderClientImpl::objectContentType(
     const KURL& url,
-    const String& explicitMimeType)
+    const String& explicitMimeType,
+    bool shouldPreferPlugInsForImages)
 {
     // This code is based on Apple's implementation from
     // WebCoreSupport/WebFrameBridge.mm.
@@ -1503,12 +1505,14 @@ ObjectContentType FrameLoaderClientImpl::objectContentType(
             return ObjectContentFrame;
     }
 
-    if (MIMETypeRegistry::isSupportedImageMIMEType(mimeType))
-        return ObjectContentImage;
-
     // If Chrome is started with the --disable-plugins switch, pluginData is 0.
     PluginData* pluginData = m_webFrame->frame()->page()->pluginData();
-    if (pluginData && pluginData->supportsMimeType(mimeType))
+    bool plugInSupportsMIMEType = pluginData && pluginData->supportsMimeType(mimeType);
+
+    if (MIMETypeRegistry::isSupportedImageMIMEType(mimeType))
+        return shouldPreferPlugInsForImages && plugInSupportsMIMEType ? ObjectContentNetscapePlugin : ObjectContentImage;
+
+    if (plugInSupportsMIMEType)
         return ObjectContentNetscapePlugin;
 
     if (MIMETypeRegistry::isSupportedNonImageMIMEType(mimeType))
diff --git a/Source/WebKit/chromium/src/FrameLoaderClientImpl.h b/Source/WebKit/chromium/src/FrameLoaderClientImpl.h
index 7abf617..f19c26c 100644
--- a/Source/WebKit/chromium/src/FrameLoaderClientImpl.h
+++ b/Source/WebKit/chromium/src/FrameLoaderClientImpl.h
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2009 Google Inc. All rights reserved.
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -197,7 +198,7 @@ public:
         const Vector<WTF::String>& paramNames,
         const Vector<WTF::String>& paramValues);
     virtual WebCore::ObjectContentType objectContentType(
-        const WebCore::KURL& url, const WTF::String& mimeType);
+        const WebCore::KURL&, const WTF::String& mimeType, bool shouldPreferPlugInsForImages);
     virtual WTF::String overrideMediaType() const;
     virtual void didPerformFirstNavigation() const;
     virtual void registerForIconNotification(bool listen = true);
diff --git a/Source/WebKit/chromium/src/GraphicsContext3DChromium.cpp b/Source/WebKit/chromium/src/GraphicsContext3DChromium.cpp
index 3d937ac..54c18e3 100644
--- a/Source/WebKit/chromium/src/GraphicsContext3DChromium.cpp
+++ b/Source/WebKit/chromium/src/GraphicsContext3DChromium.cpp
@@ -82,6 +82,7 @@ namespace WebCore {
 GraphicsContext3DInternal::GraphicsContext3DInternal()
     : m_webViewImpl(0)
     , m_initializedAvailableExtensions(false)
+    , m_layerComposited(false)
 #if USE(SKIA)
 #elif PLATFORM(CG)
     , m_renderOutput(0)
@@ -160,6 +161,24 @@ WebGLLayerChromium* GraphicsContext3DInternal::platformLayer() const
 }
 #endif
 
+void GraphicsContext3DInternal::markContextChanged()
+{
+#if USE(ACCELERATED_COMPOSITING)
+    platformLayer()->setTextureUpdated();
+#endif
+    m_layerComposited = false;
+}
+
+void GraphicsContext3DInternal::markLayerComposited()
+{
+    m_layerComposited = true;
+}
+
+bool GraphicsContext3DInternal::layerComposited() const
+{
+    return m_layerComposited;
+}
+
 void GraphicsContext3DInternal::paintRenderingResultsToCanvas(CanvasRenderingContext* context)
 {
     HTMLCanvasElement* canvas = context->canvas();
@@ -200,6 +219,16 @@ void GraphicsContext3DInternal::paintRenderingResultsToCanvas(CanvasRenderingCon
 
     m_impl->readBackFramebuffer(pixels, 4 * m_impl->width() * m_impl->height());
 
+    if (!m_impl->getContextAttributes().premultipliedAlpha) {
+        size_t bufferSize = 4 * m_impl->width() * m_impl->height();
+
+        for (size_t i = 0; i < bufferSize; i += 4) {
+            pixels[i + 0] = std::min(255, pixels[i + 0] * pixels[i + 3] / 255);
+            pixels[i + 1] = std::min(255, pixels[i + 1] * pixels[i + 3] / 255);
+            pixels[i + 2] = std::min(255, pixels[i + 2] * pixels[i + 3] / 255);
+        }
+    }
+
 #if USE(SKIA)
     if (m_resizingBitmap.readyToDraw()) {
         // We need to draw the resizing bitmap into the canvas's backing store.
@@ -218,6 +247,23 @@ void GraphicsContext3DInternal::paintRenderingResultsToCanvas(CanvasRenderingCon
 #endif
 }
 
+PassRefPtr<ImageData> GraphicsContext3DInternal::paintRenderingResultsToImageData()
+{
+    if (m_impl->getContextAttributes().premultipliedAlpha)
+        return 0;
+    
+    RefPtr<ImageData> imageData = ImageData::create(IntSize(m_impl->width(), m_impl->height()));
+    unsigned char* pixels = imageData->data()->data()->data();
+    size_t bufferSize = 4 * m_impl->width() * m_impl->height();
+
+    m_impl->readBackFramebuffer(pixels, bufferSize);
+
+    for (size_t i = 0; i < bufferSize; i += 4)
+        std::swap(pixels[i], pixels[i + 2]);
+
+    return imageData.release();
+}
+
 bool GraphicsContext3DInternal::paintsIntoCanvasBuffer() const
 {
     // If the gpu compositor is on then skip the readback and software rendering path.
@@ -1058,7 +1104,16 @@ DELEGATE_TO_INTERNAL_6(vertexAttribPointer, GC3Duint, GC3Dint, GC3Denum, GC3Dboo
 
 DELEGATE_TO_INTERNAL_4(viewport, GC3Dint, GC3Dint, GC3Dsizei, GC3Dsizei)
 
+DELEGATE_TO_INTERNAL(markLayerComposited)
+DELEGATE_TO_INTERNAL(markContextChanged)
+
+bool GraphicsContext3D::layerComposited() const
+{
+    return m_internal->layerComposited();
+}
+
 DELEGATE_TO_INTERNAL_1(paintRenderingResultsToCanvas, CanvasRenderingContext*)
+DELEGATE_TO_INTERNAL_R(paintRenderingResultsToImageData, PassRefPtr<ImageData>)
 
 bool GraphicsContext3D::paintsIntoCanvasBuffer() const
 {
diff --git a/Source/WebKit/chromium/src/GraphicsContext3DInternal.h b/Source/WebKit/chromium/src/GraphicsContext3DInternal.h
index c8f7c7a..0af291e 100644
--- a/Source/WebKit/chromium/src/GraphicsContext3DInternal.h
+++ b/Source/WebKit/chromium/src/GraphicsContext3DInternal.h
@@ -66,7 +66,12 @@ public:
     void reshape(int width, int height);
     IntSize getInternalFramebufferSize();
 
+    void markContextChanged();
+    bool layerComposited() const;
+    void markLayerComposited();
+
     void paintRenderingResultsToCanvas(CanvasRenderingContext*);
+    PassRefPtr<ImageData> paintRenderingResultsToImageData();
     bool paintsIntoCanvasBuffer() const;
 
     void prepareTexture();
@@ -273,6 +278,7 @@ private:
     bool m_initializedAvailableExtensions;
     HashSet<String> m_enabledExtensions;
     HashSet<String> m_requestableExtensions;
+    bool m_layerComposited;
 #if USE(ACCELERATED_COMPOSITING)
     RefPtr<WebGLLayerChromium> m_compositingLayer;
 #endif
diff --git a/Source/WebKit/chromium/src/IDBCallbacksProxy.cpp b/Source/WebKit/chromium/src/IDBCallbacksProxy.cpp
index ea0f433..727092a 100644
--- a/Source/WebKit/chromium/src/IDBCallbacksProxy.cpp
+++ b/Source/WebKit/chromium/src/IDBCallbacksProxy.cpp
@@ -35,7 +35,6 @@
 #include "WebIDBCursorImpl.h"
 #include "WebIDBDatabaseImpl.h"
 #include "WebIDBDatabaseError.h"
-#include "WebIDBIndexImpl.h"
 #include "WebIDBKey.h"
 #include "WebIDBTransactionImpl.h"
 #include "WebSerializedScriptValue.h"
@@ -73,11 +72,6 @@ void IDBCallbacksProxy::onSuccess(PassRefPtr<IDBDatabaseBackendInterface> backen
     m_callbacks->onSuccess(new WebKit::WebIDBDatabaseImpl(backend));
 }
 
-void IDBCallbacksProxy::onSuccess(PassRefPtr<IDBIndexBackendInterface> backend)
-{
-    m_callbacks->onSuccess(new WebKit::WebIDBIndexImpl(backend));
-}
-
 void IDBCallbacksProxy::onSuccess(PassRefPtr<IDBKey> idbKey)
 {
     m_callbacks->onSuccess(WebKit::WebIDBKey(idbKey));
diff --git a/Source/WebKit/chromium/src/IDBCallbacksProxy.h b/Source/WebKit/chromium/src/IDBCallbacksProxy.h
index 912cb86..6829845 100644
--- a/Source/WebKit/chromium/src/IDBCallbacksProxy.h
+++ b/Source/WebKit/chromium/src/IDBCallbacksProxy.h
@@ -50,7 +50,6 @@ public:
     virtual void onError(PassRefPtr<IDBDatabaseError>);
     virtual void onSuccess(PassRefPtr<IDBCursorBackendInterface>);
     virtual void onSuccess(PassRefPtr<IDBDatabaseBackendInterface>);
-    virtual void onSuccess(PassRefPtr<IDBIndexBackendInterface>);
     virtual void onSuccess(PassRefPtr<IDBKey>);
     virtual void onSuccess(PassRefPtr<IDBTransactionBackendInterface>);
     virtual void onSuccess(PassRefPtr<SerializedScriptValue>);
diff --git a/Source/WebKit/chromium/src/IDBFactoryBackendProxy.cpp b/Source/WebKit/chromium/src/IDBFactoryBackendProxy.cpp
index 67504a3..9e5ccc0 100755
--- a/Source/WebKit/chromium/src/IDBFactoryBackendProxy.cpp
+++ b/Source/WebKit/chromium/src/IDBFactoryBackendProxy.cpp
@@ -59,13 +59,12 @@ IDBFactoryBackendProxy::~IDBFactoryBackendProxy()
 {
 }
 
-void IDBFactoryBackendProxy::open(const String& name, PassRefPtr<IDBCallbacks> callbacks, PassRefPtr<SecurityOrigin> origin, Frame* frame, const String& dataDir, int64_t maximumSize)
+void IDBFactoryBackendProxy::open(const String& name, PassRefPtr<IDBCallbacks> callbacks, PassRefPtr<SecurityOrigin> origin, Frame* frame, const String& dataDir, int64_t maximumSize, BackingStoreType backingStoreType)
 {
     WebKit::WebFrame* webFrame = WebKit::WebFrameImpl::fromFrame(frame);
-    m_webIDBFactory->open(name, new WebIDBCallbacksImpl(callbacks), origin, webFrame, dataDir, maximumSize);
+    m_webIDBFactory->open(name, new WebIDBCallbacksImpl(callbacks), origin, webFrame, dataDir, maximumSize, static_cast<WebKit::WebIDBFactory::BackingStoreType>(backingStoreType));
 }
 
 } // namespace WebCore
 
 #endif // ENABLE(INDEXED_DATABASE)
-
diff --git a/Source/WebKit/chromium/src/IDBFactoryBackendProxy.h b/Source/WebKit/chromium/src/IDBFactoryBackendProxy.h
index 5950a68..593051e 100755
--- a/Source/WebKit/chromium/src/IDBFactoryBackendProxy.h
+++ b/Source/WebKit/chromium/src/IDBFactoryBackendProxy.h
@@ -45,7 +45,7 @@ public:
     virtual ~IDBFactoryBackendProxy();
 
     PassRefPtr<DOMStringList> databases(void) const;
-    virtual void open(const String& name, PassRefPtr<IDBCallbacks>, PassRefPtr<SecurityOrigin>, Frame*, const String& dataDir, int64_t maximumSize);
+    virtual void open(const String& name, PassRefPtr<IDBCallbacks>, PassRefPtr<SecurityOrigin>, Frame*, const String& dataDir, int64_t maximumSize, BackingStoreType);
 
 private:
     IDBFactoryBackendProxy();
@@ -59,4 +59,3 @@ private:
 #endif
 
 #endif // IDBFactoryBackendProxy_h
-
diff --git a/Source/WebKit/chromium/src/LocalFileSystemChromium.cpp b/Source/WebKit/chromium/src/LocalFileSystemChromium.cpp
index 35e4de8..b377bdb 100644
--- a/Source/WebKit/chromium/src/LocalFileSystemChromium.cpp
+++ b/Source/WebKit/chromium/src/LocalFileSystemChromium.cpp
@@ -57,29 +57,40 @@ LocalFileSystem& LocalFileSystem::localFileSystem()
     return *localFileSystem;
 }
 
-void LocalFileSystem::readFileSystem(ScriptExecutionContext* context, AsyncFileSystem::Type type, PassOwnPtr<AsyncFileSystemCallbacks> callbacks)
-{
-    ASSERT(context && context->isDocument());
-    Document* document = static_cast<Document*>(context);
-    WebFrameImpl* webFrame = WebFrameImpl::fromFrame(document->frame());
-    webFrame->client()->openFileSystem(webFrame, static_cast<WebFileSystem::Type>(type), 0, false, new WebFileSystemCallbacksImpl(callbacks, type));
-}
+namespace {
 
-void LocalFileSystem::requestFileSystem(ScriptExecutionContext* context, AsyncFileSystem::Type type, long long size, PassOwnPtr<AsyncFileSystemCallbacks> callbacks, bool synchronous)
+enum CreationFlag {
+    OpenExisting,
+    CreateIfNotPresent
+};
+
+} // namespace
+
+static void openFileSystemHelper(ScriptExecutionContext* context, AsyncFileSystem::Type type, PassOwnPtr<AsyncFileSystemCallbacks> callbacks, bool synchronous, long long size, CreationFlag create)
 {
     ASSERT(context);
     if (context->isDocument()) {
         Document* document = static_cast<Document*>(context);
         WebFrameImpl* webFrame = WebFrameImpl::fromFrame(document->frame());
-        webFrame->client()->openFileSystem(webFrame, static_cast<WebFileSystem::Type>(type), size, true, new WebFileSystemCallbacksImpl(callbacks, type));
+        webFrame->client()->openFileSystem(webFrame, static_cast<WebFileSystem::Type>(type), size, create == CreateIfNotPresent, new WebFileSystemCallbacksImpl(callbacks, type));
     } else {
         WorkerContext* workerContext = static_cast<WorkerContext*>(context);
         WorkerLoaderProxy* workerLoaderProxy = &workerContext->thread()->workerLoaderProxy();
         WebWorkerBase* webWorker = static_cast<WebWorkerBase*>(workerLoaderProxy);
-        webWorker->openFileSystemForWorker(static_cast<WebFileSystem::Type>(type), size, new WebFileSystemCallbacksImpl(callbacks, type, context, synchronous), synchronous);
+        webWorker->openFileSystemForWorker(static_cast<WebFileSystem::Type>(type), size, create == CreateIfNotPresent, new WebFileSystemCallbacksImpl(callbacks, type, context, synchronous), synchronous);
     }
 }
 
+void LocalFileSystem::readFileSystem(ScriptExecutionContext* context, AsyncFileSystem::Type type, PassOwnPtr<AsyncFileSystemCallbacks> callbacks, bool synchronous)
+{
+    openFileSystemHelper(context, type, callbacks, synchronous, 0, OpenExisting);
+}
+
+void LocalFileSystem::requestFileSystem(ScriptExecutionContext* context, AsyncFileSystem::Type type, long long size, PassOwnPtr<AsyncFileSystemCallbacks> callbacks, bool synchronous)
+{
+    openFileSystemHelper(context, type, callbacks, synchronous, size, CreateIfNotPresent);
+}
+
 } // namespace WebCore
 
 #endif // ENABLE(FILE_SYSTEM)
diff --git a/Source/WebKit/chromium/src/LocalizedStrings.cpp b/Source/WebKit/chromium/src/LocalizedStrings.cpp
index 18f9fb8..35e03c4 100644
--- a/Source/WebKit/chromium/src/LocalizedStrings.cpp
+++ b/Source/WebKit/chromium/src/LocalizedStrings.cpp
@@ -257,7 +257,7 @@ String contextMenuItemTagNoGuessesFound() { return String(); }
 String contextMenuItemTagIgnoreSpelling() { return String(); }
 String contextMenuItemTagLearnSpelling() { return String(); }
 String contextMenuItemTagSearchWeb() { return String(); }
-String contextMenuItemTagLookUpInDictionary() { return String(); }
+String contextMenuItemTagLookUpInDictionary(const String&) { return String(); }
 String contextMenuItemTagOpenLink() { return String(); }
 String contextMenuItemTagIgnoreGrammar() { return String(); }
 String contextMenuItemTagSpellingMenu() { return String(); }
diff --git a/Source/WebKit/chromium/src/PlatformMessagePortChannel.h b/Source/WebKit/chromium/src/PlatformMessagePortChannel.h
index 5416145..9cd7001 100644
--- a/Source/WebKit/chromium/src/PlatformMessagePortChannel.h
+++ b/Source/WebKit/chromium/src/PlatformMessagePortChannel.h
@@ -46,7 +46,7 @@ namespace WebCore {
 class MessagePort;
 
 // PlatformMessagePortChannel is a platform-dependent interface to the remote side of a message channel.
-class PlatformMessagePortChannel : public ThreadSafeShared<PlatformMessagePortChannel>,
+class PlatformMessagePortChannel : public ThreadSafeRefCounted<PlatformMessagePortChannel>,
                                    public WebKit::WebMessagePortChannelClient {
 public:
     static void createChannel(PassRefPtr<MessagePort>, PassRefPtr<MessagePort>);
diff --git a/Source/WebKit/chromium/src/ResourceHandle.cpp b/Source/WebKit/chromium/src/ResourceHandle.cpp
index 72f60bb..f88a48a 100644
--- a/Source/WebKit/chromium/src/ResourceHandle.cpp
+++ b/Source/WebKit/chromium/src/ResourceHandle.cpp
@@ -72,7 +72,11 @@ public:
     virtual void didSendData(
         WebURLLoader*, unsigned long long bytesSent, unsigned long long totalBytesToBeSent);
     virtual void didReceiveResponse(WebURLLoader*, const WebURLResponse&);
+    virtual void didReceiveData2(WebURLLoader*, const char* data, int dataLength, int lengthReceived);
+
+    // FIXME(vsevik): remove once not used downstream
     virtual void didReceiveData(WebURLLoader*, const char* data, int dataLength);
+
     virtual void didReceiveCachedMetadata(WebURLLoader*, const char* data, int dataLength);
     virtual void didFinishLoading(WebURLLoader*, double finishTime);
     virtual void didFail(WebURLLoader*, const WebURLError&);
@@ -159,18 +163,20 @@ void ResourceHandleInternal::didReceiveResponse(WebURLLoader*, const WebURLRespo
     m_client->didReceiveResponse(m_owner, response.toResourceResponse());
 }
 
-void ResourceHandleInternal::didReceiveData(
-    WebURLLoader*, const char* data, int dataLength)
+// FIXME(vsevik): remove once not used
+void ResourceHandleInternal::didReceiveData(WebURLLoader* webURLLoader, const char* data, int dataLength)
+{
+    didReceiveData2(webURLLoader, data, dataLength, -1);
+}
+
+void ResourceHandleInternal::didReceiveData2(WebURLLoader*, const char* data, int dataLength, int lengthReceived)
 {
     ASSERT(m_client);
     if (m_state != ConnectionStateReceivedResponse && m_state != ConnectionStateReceivingData)
         CRASH();
     m_state = ConnectionStateReceivingData;
 
-    // FIXME(yurys): it looks like lengthReceived is always the same as
-    // dataLength and that the latter parameter can be eliminated.
-    // See WebKit bug: https://bugs.webkit.org/show_bug.cgi?id=31019
-    m_client->didReceiveData(m_owner, data, dataLength, dataLength);
+    m_client->didReceiveData(m_owner, data, dataLength, lengthReceived);
 }
 
 void ResourceHandleInternal::didReceiveCachedMetadata(WebURLLoader*, const char* data, int dataLength)
diff --git a/Source/WebKit/chromium/src/StorageNamespaceProxy.cpp b/Source/WebKit/chromium/src/StorageNamespaceProxy.cpp
index ec0dbce..ef19b2f 100644
--- a/Source/WebKit/chromium/src/StorageNamespaceProxy.cpp
+++ b/Source/WebKit/chromium/src/StorageNamespaceProxy.cpp
@@ -92,6 +92,21 @@ void StorageNamespaceProxy::unlock()
     // FIXME: Implement.
 }
 
+void StorageNamespaceProxy::clearOriginForDeletion(SecurityOrigin* origin)
+{
+    ASSERT_NOT_REACHED();
+}
+
+void StorageNamespaceProxy::clearAllOriginsForDeletion()
+{
+    ASSERT_NOT_REACHED();
+}
+
+void StorageNamespaceProxy::sync()
+{
+    ASSERT_NOT_REACHED();
+}
+
 } // namespace WebCore
 
 #endif // ENABLE(DOM_STORAGE)
diff --git a/Source/WebKit/chromium/src/StorageNamespaceProxy.h b/Source/WebKit/chromium/src/StorageNamespaceProxy.h
index 28d7a23..9388531 100644
--- a/Source/WebKit/chromium/src/StorageNamespaceProxy.h
+++ b/Source/WebKit/chromium/src/StorageNamespaceProxy.h
@@ -43,6 +43,11 @@ public:
     virtual PassRefPtr<StorageNamespace> copy();
     virtual void close();
     virtual void unlock();
+    
+    virtual void clearOriginForDeletion(SecurityOrigin*);
+    virtual void clearAllOriginsForDeletion();
+    
+    virtual void sync();
 
 private:
     OwnPtr<WebKit::WebStorageNamespace> m_storageNamespace;
diff --git a/Source/WebKit/chromium/src/WebAccessibilityObject.cpp b/Source/WebKit/chromium/src/WebAccessibilityObject.cpp
index 30305bd..8df112a 100644
--- a/Source/WebKit/chromium/src/WebAccessibilityObject.cpp
+++ b/Source/WebKit/chromium/src/WebAccessibilityObject.cpp
@@ -537,6 +537,12 @@ WebString WebAccessibilityObject::computedStyleDisplay() const
     return WebString(CSSPrimitiveValue::create(renderStyle->display())->getStringValue());
 }
 
+bool WebAccessibilityObject::accessibilityIsIgnored() const
+{
+    m_private->updateBackingStore();
+    return m_private->accessibilityIsIgnored();
+}
+
 WebAccessibilityObject::WebAccessibilityObject(const WTF::PassRefPtr<WebCore::AccessibilityObject>& object)
     : m_private(static_cast<WebAccessibilityObjectPrivate*>(object.releaseRef()))
 {
diff --git a/Source/WebKit/chromium/src/WebBindings.cpp b/Source/WebKit/chromium/src/WebBindings.cpp
index 0882e38..4012d1c 100644
--- a/Source/WebKit/chromium/src/WebBindings.cpp
+++ b/Source/WebKit/chromium/src/WebBindings.cpp
@@ -35,25 +35,18 @@
 #include "npruntime_priv.h"
 
 #if USE(V8)
-#include "ChromiumDataObject.h"
-#include "ClipboardChromium.h"
-#include "EventNames.h"
-#include "MouseEvent.h"
 #include "NPV8Object.h"  // for PrivateIdentifier
 #include "Range.h"
 #include "V8BindingState.h"
 #include "V8DOMWrapper.h"
 #include "V8Element.h"
-#include "V8Event.h"
-#include "V8Helpers.h"
-#include "V8HiddenPropertyName.h"
 #include "V8NPUtils.h"
+#include "V8Node.h"
 #include "V8Proxy.h"
 #include "V8Range.h"
 #elif USE(JSC)
 #include "bridge/c/c_utility.h"
 #endif
-#include "WebDragData.h"
 #include "WebElement.h"
 #include "WebRange.h"
 
@@ -65,9 +58,9 @@ using namespace WebCore;
 
 namespace WebKit {
 
-bool WebBindings::construct(NPP npp, NPObject *npobj, const NPVariant *args, uint32_t argCount, NPVariant* result)
+bool WebBindings::construct(NPP npp, NPObject* object, const NPVariant* args, uint32_t argCount, NPVariant* result)
 {
-    return _NPN_Construct(npp, npobj, args, argCount, result);
+    return _NPN_Construct(npp, object, args, argCount, result);
 }
 
 NPObject* WebBindings::createObject(NPP npp, NPClass* npClass)
@@ -75,19 +68,19 @@ NPObject* WebBindings::createObject(NPP npp, NPClass* npClass)
     return _NPN_CreateObject(npp, npClass);
 }
 
-bool WebBindings::enumerate(NPP id, NPObject* obj, NPIdentifier** identifier, uint32_t* val)
+bool WebBindings::enumerate(NPP npp, NPObject* object, NPIdentifier** identifier, uint32_t* identifierCount)
 {
-    return _NPN_Enumerate(id, obj, identifier, val);
+    return _NPN_Enumerate(npp, object, identifier, identifierCount);
 }
 
-bool WebBindings::evaluate(NPP npp, NPObject* npObject, NPString* npScript, NPVariant* result)
+bool WebBindings::evaluate(NPP npp, NPObject* object, NPString* script, NPVariant* result)
 {
-    return _NPN_Evaluate(npp, npObject, npScript, result);
+    return _NPN_Evaluate(npp, object, script, result);
 }
 
-bool WebBindings::evaluateHelper(NPP npp, bool popups_allowed, NPObject* npobj, NPString* npscript, NPVariant* result)
+bool WebBindings::evaluateHelper(NPP npp, bool popupsAllowed, NPObject* object, NPString* script, NPVariant* result)
 {
-    return _NPN_EvaluateHelper(npp, popups_allowed, npobj, npscript, result);
+    return _NPN_EvaluateHelper(npp, popupsAllowed, object, script, result);
 }
 
 NPIdentifier WebBindings::getIntIdentifier(int32_t number)
@@ -95,9 +88,9 @@ NPIdentifier WebBindings::getIntIdentifier(int32_t number)
     return _NPN_GetIntIdentifier(number);
 }
 
-bool WebBindings::getProperty(NPP npp, NPObject* obj, NPIdentifier propertyName, NPVariant *result)
+bool WebBindings::getProperty(NPP npp, NPObject* object, NPIdentifier property, NPVariant* result)
 {
-    return _NPN_GetProperty(npp, obj, propertyName, result);
+    return _NPN_GetProperty(npp, object, property, result);
 }
 
 NPIdentifier WebBindings::getStringIdentifier(const NPUTF8* string)
@@ -110,14 +103,14 @@ void WebBindings::getStringIdentifiers(const NPUTF8** names, int32_t nameCount,
     _NPN_GetStringIdentifiers(names, nameCount, identifiers);
 }
 
-bool WebBindings::hasMethod(NPP npp, NPObject* npObject, NPIdentifier methodName)
+bool WebBindings::hasMethod(NPP npp, NPObject* object, NPIdentifier method)
 {
-    return _NPN_HasMethod(npp, npObject, methodName);
+    return _NPN_HasMethod(npp, object, method);
 }
 
-bool WebBindings::hasProperty(NPP npp, NPObject* npObject, NPIdentifier propertyName)
+bool WebBindings::hasProperty(NPP npp, NPObject* object, NPIdentifier property)
 {
-    return _NPN_HasProperty(npp, npObject, propertyName);
+    return _NPN_HasProperty(npp, object, property);
 }
 
 bool WebBindings::identifierIsString(NPIdentifier identifier)
@@ -139,19 +132,19 @@ void WebBindings::initializeVariantWithStringCopy(NPVariant* variant, const NPSt
 #endif
 }
 
-bool WebBindings::invoke(NPP npp, NPObject* npObject, NPIdentifier methodName, const NPVariant* arguments, uint32_t argumentCount, NPVariant* result)
+bool WebBindings::invoke(NPP npp, NPObject* object, NPIdentifier method, const NPVariant* args, uint32_t argCount, NPVariant* result)
 {
-    return _NPN_Invoke(npp, npObject, methodName, arguments, argumentCount, result);
+    return _NPN_Invoke(npp, object, method, args, argCount, result);
 }
 
-bool WebBindings::invokeDefault(NPP id, NPObject* obj, const NPVariant* args, uint32_t count, NPVariant* result)
+bool WebBindings::invokeDefault(NPP npp, NPObject* object, const NPVariant* args, uint32_t argCount, NPVariant* result)
 {
-    return _NPN_InvokeDefault(id, obj, args, count, result);
+    return _NPN_InvokeDefault(npp, object, args, argCount, result);
 }
 
-void WebBindings::releaseObject(NPObject* npObject)
+void WebBindings::releaseObject(NPObject* object)
 {
-    return _NPN_ReleaseObject(npObject);
+    return _NPN_ReleaseObject(object);
 }
 
 void WebBindings::releaseVariantValue(NPVariant* variant)
@@ -159,30 +152,30 @@ void WebBindings::releaseVariantValue(NPVariant* variant)
     _NPN_ReleaseVariantValue(variant);
 }
 
-bool WebBindings::removeProperty(NPP id, NPObject* object, NPIdentifier identifier)
+bool WebBindings::removeProperty(NPP npp, NPObject* object, NPIdentifier identifier)
 {
-    return  _NPN_RemoveProperty(id, object, identifier);
+    return _NPN_RemoveProperty(npp, object, identifier);
 }
 
-NPObject* WebBindings::retainObject(NPObject* npObject)
+NPObject* WebBindings::retainObject(NPObject* object)
 {
-    return _NPN_RetainObject(npObject);
+    return _NPN_RetainObject(object);
 }
 
-void WebBindings::setException(NPObject* obj, const NPUTF8* message)
+void WebBindings::setException(NPObject* object, const NPUTF8* message)
 {
-    _NPN_SetException(obj, message);
+    _NPN_SetException(object, message);
 }
 
-bool WebBindings::setProperty(NPP id, NPObject* obj, NPIdentifier identifier, const NPVariant* variant)
+bool WebBindings::setProperty(NPP npp, NPObject* object, NPIdentifier identifier, const NPVariant* value)
 {
-    return _NPN_SetProperty(id, obj, identifier, variant);
+    return _NPN_SetProperty(npp, object, identifier, value);
 }
 
-void WebBindings::unregisterObject(NPObject* npObject)
+void WebBindings::unregisterObject(NPObject* object)
 {
 #if USE(V8)
-    _NPN_UnregisterObject(npObject);
+    _NPN_UnregisterObject(object);
 #endif
 }
 
@@ -193,116 +186,46 @@ NPUTF8* WebBindings::utf8FromIdentifier(NPIdentifier identifier)
 
 void WebBindings::extractIdentifierData(const NPIdentifier& identifier, const NPUTF8*& string, int32_t& number, bool& isString)
 {
-    PrivateIdentifier* priv = static_cast<PrivateIdentifier*>(identifier);
-    if (!priv) {
+    PrivateIdentifier* data = static_cast<PrivateIdentifier*>(identifier);
+    if (!data) {
         isString = false;
         number = 0;
         return;
     }
 
-    isString = priv->isString;
+    isString = data->isString;
     if (isString)
-        string = priv->value.string;
+        string = data->value.string;
     else
-        number = priv->value.number;
+        number = data->value.number;
 }
 
 #if USE(V8)
 
-static v8::Local<v8::Value> getEvent(const v8::Handle<v8::Context>& context)
+static bool getRangeImpl(NPObject* object, WebRange* webRange)
 {
-    return context->Global()->GetHiddenValue(V8HiddenPropertyName::event());
-}
-
-static bool getDragDataImpl(NPObject* npobj, int* eventId, WebDragData* data)
-{
-    if (!npobj)
-        return false;
-    if (npobj->_class != npScriptObjectClass)
-        return false;
-
-    v8::HandleScope handleScope;
-    v8::Handle<v8::Context> context = v8::Context::GetEntered();
-    if (context.IsEmpty())
-        return false;
-
-    // Get the current WebCore event.
-    v8::Handle<v8::Value> currentEvent(getEvent(context));
-    Event* event = V8Event::toNative(v8::Handle<v8::Object>::Cast(currentEvent));
-    if (!event)
-        return false;
-
-    // Check that the given npobj is that event.
-    V8NPObject* object = reinterpret_cast<V8NPObject*>(npobj);
-    Event* given = V8Event::toNative(object->v8Object);
-    if (given != event)
-        return false;
-
-    // Check the execution frames are same origin.
-    V8Proxy* current = V8Proxy::retrieve(V8Proxy::retrieveFrameForCurrentContext());
-    Frame* frame = V8Proxy::retrieveFrame(context);
-    if (!current || !V8BindingSecurity::canAccessFrame(V8BindingState::Only(), frame, false))
-        return false;
-
-    const EventNames& names(eventNames());
-    const AtomicString& eventType(event->type());
-
-    enum DragTargetMouseEventId {
-        DragEnterId = 1, DragOverId = 2, DragLeaveId = 3, DropId = 4
-    };
-
-    // The event type should be a drag event.
-    if (eventType == names.dragenterEvent)
-        *eventId = DragEnterId;
-    else if (eventType == names.dragoverEvent)
-        *eventId = DragOverId;
-    else if (eventType == names.dragleaveEvent)
-        *eventId = DragLeaveId;
-    else if (eventType == names.dropEvent)
-        *eventId = DropId;
-    else
-        return false;
-
-    // Drag events are mouse events and should have a clipboard.
-    MouseEvent* me = static_cast<MouseEvent*>(event);
-    Clipboard* clipboard = me->clipboard();
-    if (!clipboard)
+    if (!object || (object->_class != npScriptObjectClass))
         return false;
 
-    // And that clipboard should be accessible by WebKit policy.
-    ClipboardChromium* chrome = static_cast<ClipboardChromium*>(clipboard);
-    HashSet<String> accessible(chrome->types());
-    if (accessible.isEmpty())
-        return false;
-
-    RefPtr<ChromiumDataObject> dataObject(chrome->dataObject());
-    if (dataObject && data)
-        *data = WebDragData(dataObject);
-
-    return dataObject;
-}
-
-static bool getRangeImpl(NPObject* npobj, WebRange* range)
-{
-    V8NPObject* v8npobject = reinterpret_cast<V8NPObject*>(npobj);
-    v8::Handle<v8::Object> v8object(v8npobject->v8Object);
-    if (!V8Range::info.equals(V8DOMWrapper::domWrapperType(v8object)))
+    V8NPObject* v8NPObject = reinterpret_cast<V8NPObject*>(object);
+    v8::Handle<v8::Object> v8Object(v8NPObject->v8Object);
+    if (!V8Range::info.equals(V8DOMWrapper::domWrapperType(v8Object)))
         return false;
 
-    Range* native = V8Range::toNative(v8object);
+    Range* native = V8Range::toNative(v8Object);
     if (!native)
         return false;
 
-    *range = WebRange(native);
+    *webRange = WebRange(native);
     return true;
 }
 
-static bool getElementImpl(NPObject* npObj, WebElement* webElement)
+static bool getElementImpl(NPObject* object, WebElement* webElement)
 {
-    if (!npObj || (npObj->_class != npScriptObjectClass))
+    if (!object || (object->_class != npScriptObjectClass))
         return false;
 
-    V8NPObject* v8NPObject = reinterpret_cast<V8NPObject*>(npObj);
+    V8NPObject* v8NPObject = reinterpret_cast<V8NPObject*>(object);
     v8::Handle<v8::Object> v8Object(v8NPObject->v8Object);
     Element* native = V8Element::toNative(v8Object);
     if (!native)
@@ -316,7 +239,7 @@ static NPObject* makeIntArrayImpl(const WebVector<int>& data)
 {
     v8::HandleScope handleScope;
     v8::Handle<v8::Array> result = v8::Array::New(data.size());
-    for (size_t i = 0; i < data.size(); i++)
+    for (size_t i = 0; i < data.size(); ++i)
         result->Set(i, v8::Number::New(data[i]));
 
     WebCore::DOMWindow* window = WebCore::V8Proxy::retrieveWindow(WebCore::V8Proxy::currentContext());
@@ -334,28 +257,22 @@ static NPObject* makeStringArrayImpl(const WebVector<WebString>& data)
     return npCreateV8ScriptObject(0, result, window);
 }
 
-#endif
-
-bool WebBindings::getDragData(NPObject* event, int* eventId, WebDragData* data)
+static NPObject* makeNodeImpl(WebNode data)
 {
-#if USE(V8)
-    return getDragDataImpl(event, eventId, data);
-#else
-    // Not supported on other ports (JSC, etc).
-    return false;
-#endif
+    v8::HandleScope handleScope;
+    if (data.isNull())
+        return 0;
+    v8::Handle<v8::Object> result = V8Node::wrap(data.unwrap<Node>());
+    WebCore::DOMWindow* window = WebCore::V8Proxy::retrieveWindow(WebCore::V8Proxy::currentContext());
+    return npCreateV8ScriptObject(0, result, window);
 }
 
-bool WebBindings::isDragEvent(NPObject* event)
-{
-    int eventId;
-    return getDragData(event, &eventId, 0);
-}
+#endif
 
-bool WebBindings::getRange(NPObject* range, WebRange* webrange)
+bool WebBindings::getRange(NPObject* range, WebRange* webRange)
 {
 #if USE(V8)
-    return getRangeImpl(range, webrange);
+    return getRangeImpl(range, webRange);
 #else
     // Not supported on other ports (JSC, etc).
     return false;
@@ -372,7 +289,7 @@ bool WebBindings::getElement(NPObject* element, WebElement* webElement)
 #endif
 }
 
-NPObject* WebBindings::makeIntArray(const WebVector<int> & data)
+NPObject* WebBindings::makeIntArray(const WebVector<int>& data)
 {
 #if USE(V8)
     return makeIntArrayImpl(data);
@@ -392,6 +309,16 @@ NPObject* WebBindings::makeStringArray(const WebVector<WebString>& data)
 #endif
 }
 
+NPObject* WebBindings::makeNode(const WebNode& data)
+{
+#if USE(V8)
+    return makeNodeImpl(data);
+#else
+    // Not supported on other ports (JSC, etc.).
+    return 0;
+#endif
+}
+
 void WebBindings::pushExceptionHandler(ExceptionHandler handler, void* data)
 {
     WebCore::pushExceptionHandler(handler, data);
diff --git a/Source/WebKit/chromium/src/WebDOMMouseEvent.cpp b/Source/WebKit/chromium/src/WebDOMMouseEvent.cpp
index bfeae37..1e65888 100644
--- a/Source/WebKit/chromium/src/WebDOMMouseEvent.cpp
+++ b/Source/WebKit/chromium/src/WebDOMMouseEvent.cpp
@@ -57,24 +57,24 @@ int WebDOMMouseEvent::clientY() const
     return constUnwrap<MouseEvent>()->clientY();
 }
 
-int WebDOMMouseEvent::layerX() const
+int WebDOMMouseEvent::layerX()
 {
-    return constUnwrap<MouseEvent>()->layerX();
+    return unwrap<MouseEvent>()->layerX();
 }
 
-int WebDOMMouseEvent::layerY() const
+int WebDOMMouseEvent::layerY()
 {
-    return constUnwrap<MouseEvent>()->layerY();
+    return unwrap<MouseEvent>()->layerY();
 }
 
-int WebDOMMouseEvent::offsetX() const
+int WebDOMMouseEvent::offsetX()
 {
-    return constUnwrap<MouseEvent>()->offsetX();
+    return unwrap<MouseEvent>()->offsetX();
 }
 
-int WebDOMMouseEvent::offsetY() const
+int WebDOMMouseEvent::offsetY()
 {
-    return constUnwrap<MouseEvent>()->offsetY();
+    return unwrap<MouseEvent>()->offsetY();
 }
 
 int WebDOMMouseEvent::pageX() const
diff --git a/Source/WebKit/chromium/src/WebDataSourceImpl.cpp b/Source/WebKit/chromium/src/WebDataSourceImpl.cpp
index 65147fa..1366a80 100644
--- a/Source/WebKit/chromium/src/WebDataSourceImpl.cpp
+++ b/Source/WebKit/chromium/src/WebDataSourceImpl.cpp
@@ -174,7 +174,7 @@ WebDataSourceImpl::WebDataSourceImpl(const ResourceRequest& request, const Subst
         // frame, which results in a second data source being created.  We want
         // to wait to attach the WebPluginLoadObserver to that data source.
         if (!request.url().isEmpty()) {
-            ASSERT(m_nextPluginLoadObserver->url() == request.url());
+            ASSERT(m_nextPluginLoadObserver->url() == WebURL(request.url()));
             m_pluginLoadObserver.set(m_nextPluginLoadObserver);
             m_nextPluginLoadObserver = 0;
         }
diff --git a/Source/WebKit/chromium/src/WebDevToolsAgentImpl.cpp b/Source/WebKit/chromium/src/WebDevToolsAgentImpl.cpp
index 6329d76..c1a5f9c 100644
--- a/Source/WebKit/chromium/src/WebDevToolsAgentImpl.cpp
+++ b/Source/WebKit/chromium/src/WebDevToolsAgentImpl.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2010 Google Inc. All rights reserved.
+ * Copyright (C) 2010-2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -40,13 +40,12 @@
 #include "InspectorInstrumentation.h"
 #include "Page.h"
 #include "PageGroup.h"
+#include "PageScriptDebugServer.h"
 #include "PlatformString.h"
 #include "ResourceError.h"
 #include "ResourceRequest.h"
 #include "ResourceResponse.h"
-#include "ScriptDebugServer.h"
 #include "V8Binding.h"
-#include "V8Node.h"
 #include "V8Proxy.h"
 #include "V8Utilities.h"
 #include "WebDataSource.h"
@@ -73,14 +72,14 @@ namespace {
 static const char kFrontendConnectedFeatureName[] = "frontend-connected";
 static const char kInspectorStateFeatureName[] = "inspector-state";
 
-class ClientMessageLoopAdapter : public ScriptDebugServer::ClientMessageLoop {
+class ClientMessageLoopAdapter : public PageScriptDebugServer::ClientMessageLoop {
 public:
     static void ensureClientMessageLoopCreated(WebDevToolsAgentClient* client)
     {
         if (s_instance)
             return;
         s_instance = new ClientMessageLoopAdapter(client->createClientMessageLoop());
-        ScriptDebugServer::shared().setClientMessageLoop(s_instance);
+        PageScriptDebugServer::shared().setClientMessageLoop(s_instance);
     }
 
     static void inspectedViewClosed(WebViewImpl* view)
@@ -93,7 +92,7 @@ public:
     {
         // Release render thread if necessary.
         if (s_instance && s_instance->m_running)
-            ScriptDebugServer::shared().continueProgram();
+            PageScriptDebugServer::shared().continueProgram();
     }
 
 private:
@@ -187,9 +186,6 @@ void WebDevToolsAgentImpl::attach()
 
     m_debuggerAgentImpl.set(
         new DebuggerAgentImpl(m_webViewImpl, this, m_client));
-    WebCString debuggerScriptJs = m_client->debuggerScriptSource();
-    ScriptDebugServer::shared().setDebuggerScriptSource(
-        String(debuggerScriptJs.data(), debuggerScriptJs.length()));
     m_attached = true;
 }
 
@@ -230,14 +226,6 @@ void WebDevToolsAgentImpl::inspectElementAt(const WebPoint& point)
     m_webViewImpl->inspectElementAt(point);
 }
 
-void WebDevToolsAgentImpl::inspectNode(v8::Handle<v8::Value> node)
-{
-    if (!V8Node::HasInstance(node))
-        V8Proxy::setDOMException(TYPE_MISMATCH_ERR);
-    else
-        inspectorController()->inspect(V8Node::toNative(v8::Handle<v8::Object>::Cast(node)));
-}
-
 void WebDevToolsAgentImpl::setRuntimeProperty(const WebString& name, const WebString& value)
 {
     if (name == kInspectorStateFeatureName) {
@@ -260,49 +248,6 @@ Frame* WebDevToolsAgentImpl::mainFrame()
     return 0;
 }
 
-
-//------- plugin resource load notifications ---------------
-void WebDevToolsAgentImpl::identifierForInitialRequest(
-    unsigned long resourceId,
-    WebFrame* webFrame,
-    const WebURLRequest& request)
-{
-    WebFrameImpl* webFrameImpl = static_cast<WebFrameImpl*>(webFrame);
-    Frame* frame = webFrameImpl->frame();
-    DocumentLoader* loader = frame->loader()->activeDocumentLoader();
-    InspectorInstrumentation::identifierForInitialRequest(frame, resourceId, loader, request.toResourceRequest());
-}
-
-void WebDevToolsAgentImpl::willSendRequest(unsigned long resourceId, WebURLRequest& request)
-{
-    if (InspectorController* ic = inspectorController()) {
-        InspectorInstrumentation::willSendRequest(mainFrame(), resourceId, request.toMutableResourceRequest(), ResourceResponse());
-        if (ic->hasFrontend() && request.reportLoadTiming())
-            request.setReportRawHeaders(true);
-    }
-}
-
-void WebDevToolsAgentImpl::didReceiveData(unsigned long resourceId, int length)
-{
-    InspectorInstrumentation::didReceiveContentLength(mainFrame(), resourceId, length);
-}
-
-void WebDevToolsAgentImpl::didReceiveResponse(unsigned long resourceId, const WebURLResponse& response)
-{
-    InspectorInstrumentationCookie cookie = InspectorInstrumentation::willReceiveResourceResponse(mainFrame(), resourceId, response.toResourceResponse());
-    InspectorInstrumentation::didReceiveResourceResponse(cookie, resourceId, 0, response.toResourceResponse());
-}
-
-void WebDevToolsAgentImpl::didFinishLoading(unsigned long resourceId)
-{
-    InspectorInstrumentation::didFinishLoading(mainFrame(), resourceId, 0);
-}
-
-void WebDevToolsAgentImpl::didFailLoading(unsigned long resourceId, const WebURLError& error)
-{
-    InspectorInstrumentation::didFailLoading(mainFrame(), resourceId, error);
-}
-
 void WebDevToolsAgentImpl::inspectorDestroyed()
 {
     // Our lifetime is bound to the WebViewImpl.
@@ -374,7 +319,7 @@ void WebDevToolsAgent::debuggerPauseScript()
 
 void WebDevToolsAgent::interruptAndDispatch(MessageDescriptor* d)
 {
-    class DebuggerTask : public ScriptDebugServer::Task {
+    class DebuggerTask : public PageScriptDebugServer::Task {
     public:
         DebuggerTask(WebDevToolsAgent::MessageDescriptor* descriptor) : m_descriptor(descriptor) { }
         virtual ~DebuggerTask() { }
@@ -386,7 +331,7 @@ void WebDevToolsAgent::interruptAndDispatch(MessageDescriptor* d)
     private:
         OwnPtr<WebDevToolsAgent::MessageDescriptor> m_descriptor;
     };
-    ScriptDebugServer::interruptAndRun(new DebuggerTask(d));
+    PageScriptDebugServer::interruptAndRun(new DebuggerTask(d));
 }
 
 bool WebDevToolsAgent::shouldInterruptForMessage(const WebString& message)
@@ -395,18 +340,18 @@ bool WebDevToolsAgent::shouldInterruptForMessage(const WebString& message)
     if (!InspectorBackendDispatcher::getCommandName(message, &commandName))
         return false;
     return commandName == InspectorBackendDispatcher::Debugger_pauseCmd
-        || commandName == InspectorBackendDispatcher::Debugger_setJavaScriptBreakpointCmd
-        || commandName == InspectorBackendDispatcher::Debugger_removeJavaScriptBreakpointCmd
-        || commandName == InspectorBackendDispatcher::Debugger_activateBreakpointsCmd
-        || commandName == InspectorBackendDispatcher::Debugger_deactivateBreakpointsCmd
-        || commandName == InspectorBackendDispatcher::Inspector_startProfilingCmd
-        || commandName == InspectorBackendDispatcher::Inspector_stopProfilingCmd
+        || commandName == InspectorBackendDispatcher::Debugger_setBreakpointCmd
+        || commandName == InspectorBackendDispatcher::Debugger_setBreakpointByUrlCmd
+        || commandName == InspectorBackendDispatcher::Debugger_removeBreakpointCmd
+        || commandName == InspectorBackendDispatcher::Debugger_setBreakpointsActiveCmd
+        || commandName == InspectorBackendDispatcher::Profiler_startCmd
+        || commandName == InspectorBackendDispatcher::Profiler_stopCmd
         || commandName == InspectorBackendDispatcher::Profiler_getProfileCmd;
 }
 
 void WebDevToolsAgent::processPendingMessages()
 {
-    ScriptDebugServer::shared().runPendingTasks();
+    PageScriptDebugServer::shared().runPendingTasks();
 }
 
 void WebDevToolsAgent::setMessageLoopDispatchHandler(MessageLoopDispatchHandler handler)
diff --git a/Source/WebKit/chromium/src/WebDevToolsAgentImpl.h b/Source/WebKit/chromium/src/WebDevToolsAgentImpl.h
index 2bc197d..33ca232 100644
--- a/Source/WebKit/chromium/src/WebDevToolsAgentImpl.h
+++ b/Source/WebKit/chromium/src/WebDevToolsAgentImpl.h
@@ -35,7 +35,6 @@
 
 #include "WebDevToolsAgentPrivate.h"
 
-#include <v8.h>
 #include <wtf/Forward.h>
 #include <wtf/OwnPtr.h>
 
@@ -76,18 +75,10 @@ public:
     virtual void didNavigate();
     virtual void dispatchOnInspectorBackend(const WebString& message);
     virtual void inspectElementAt(const WebPoint& point);
-    virtual void inspectNode(v8::Handle<v8::Value> node);
     virtual void evaluateInWebInspector(long callId, const WebString& script);
     virtual void setRuntimeProperty(const WebString& name, const WebString& value);
     virtual void setTimelineProfilingEnabled(bool enable);
 
-    virtual void identifierForInitialRequest(unsigned long, WebFrame*, const WebURLRequest&);
-    virtual void willSendRequest(unsigned long, WebURLRequest&);
-    virtual void didReceiveData(unsigned long, int length);
-    virtual void didReceiveResponse(unsigned long, const WebURLResponse&);
-    virtual void didFinishLoading(unsigned long);
-    virtual void didFailLoading(unsigned long, const WebURLError&);
-
     // InspectorClient implementation.
     virtual void inspectorDestroyed();
     virtual void openInspectorFrontend(WebCore::InspectorController*);
diff --git a/Source/WebKit/chromium/src/WebDocument.cpp b/Source/WebKit/chromium/src/WebDocument.cpp
index a983bf7..0abf307 100644
--- a/Source/WebKit/chromium/src/WebDocument.cpp
+++ b/Source/WebKit/chromium/src/WebDocument.cpp
@@ -31,6 +31,7 @@
 #include "config.h"
 #include "WebDocument.h"
 
+#include "AXObjectCache.h"
 #include "Document.h"
 #include "DocumentType.h"
 #include "Element.h"
@@ -41,6 +42,7 @@
 #include "HTMLHeadElement.h"
 #include "NodeList.h"
 
+#include "WebAccessibilityObject.h"
 #include "WebDocumentType.h"
 #include "WebElement.h"
 #include "WebFrameImpl.h"
@@ -129,6 +131,13 @@ WebDocumentType WebDocument::doctype() const
     return WebDocumentType(constUnwrap<Document>()->doctype());
 }
 
+WebAccessibilityObject WebDocument::accessibilityObject() const
+{
+    const Document* document = constUnwrap<Document>();
+    return WebAccessibilityObject(
+        document->axObjectCache()->getOrCreate(document->renderer()));
+}
+
 WebDocument::WebDocument(const PassRefPtr<Document>& elem)
     : WebNode(elem)
 {
diff --git a/Source/WebKit/chromium/src/WebElement.cpp b/Source/WebKit/chromium/src/WebElement.cpp
index 34daa34..ee7ec09 100644
--- a/Source/WebKit/chromium/src/WebElement.cpp
+++ b/Source/WebKit/chromium/src/WebElement.cpp
@@ -90,6 +90,11 @@ WebString WebElement::innerText() const
     return constUnwrap<Element>()->innerText();
 }
 
+WebNode WebElement::shadowRoot()
+{
+    return adoptRef(unwrap<Element>()->shadowRoot());
+}
+
 WebString WebElement::computeInheritedLanguage() const
 {
     return WebString(constUnwrap<Element>()->computeInheritedLanguage());
diff --git a/Source/WebKit/chromium/src/WebFileSystemCallbacksImpl.cpp b/Source/WebKit/chromium/src/WebFileSystemCallbacksImpl.cpp
index 0c71f80..58d56e9 100644
--- a/Source/WebKit/chromium/src/WebFileSystemCallbacksImpl.cpp
+++ b/Source/WebKit/chromium/src/WebFileSystemCallbacksImpl.cpp
@@ -72,6 +72,7 @@ void WebFileSystemCallbacksImpl::didReadMetadata(const WebFileInfo& webFileInfo)
     fileMetadata.modificationTime = webFileInfo.modificationTime;
     fileMetadata.length = webFileInfo.length;
     fileMetadata.type = static_cast<FileMetadata::Type>(webFileInfo.type);
+    fileMetadata.platformPath = webFileInfo.platformPath;
     m_callbacks->didReadMetadata(fileMetadata);
     delete this;
 }
diff --git a/Source/WebKit/chromium/src/WebFormControlElement.cpp b/Source/WebKit/chromium/src/WebFormControlElement.cpp
index d2bc8ab..f00b058 100644
--- a/Source/WebKit/chromium/src/WebFormControlElement.cpp
+++ b/Source/WebKit/chromium/src/WebFormControlElement.cpp
@@ -43,6 +43,11 @@ bool WebFormControlElement::isEnabled() const
     return constUnwrap<HTMLFormControlElement>()->isEnabledFormControl();
 }
 
+bool WebFormControlElement::isReadOnly() const
+{
+    return constUnwrap<HTMLFormControlElement>()->readOnly();
+}
+
 WebString WebFormControlElement::formControlName() const
 {
     return constUnwrap<HTMLFormControlElement>()->name();
diff --git a/Source/WebKit/chromium/src/WebFrameImpl.cpp b/Source/WebKit/chromium/src/WebFrameImpl.cpp
index 53e1d44..fdfb14e 100644
--- a/Source/WebKit/chromium/src/WebFrameImpl.cpp
+++ b/Source/WebKit/chromium/src/WebFrameImpl.cpp
@@ -1052,11 +1052,17 @@ void WebFrameImpl::dispatchWillSendRequest(WebURLRequest& request)
         0, 0, request.toMutableResourceRequest(), response);
 }
 
+// FIXME: Remove this overload when clients have been changed to pass options.
 WebURLLoader* WebFrameImpl::createAssociatedURLLoader()
 {
     return new AssociatedURLLoader(this);
 }
 
+WebURLLoader* WebFrameImpl::createAssociatedURLLoader(const WebURLLoaderOptions& options)
+{
+    return new AssociatedURLLoader(this, options);
+}
+
 void WebFrameImpl::commitDocumentData(const char* data, size_t length)
 {
     m_frame->loader()->documentLoader()->commitData(data, length);
@@ -1077,11 +1083,6 @@ bool WebFrameImpl::willSuppressOpenerInNewFrame() const
     return frame()->loader()->suppressOpenerInNewFrame();
 }
 
-bool WebFrameImpl::pageDismissalEventBeingDispatched() const
-{
-    return frame()->loader()->pageDismissalEventBeingDispatched();
-}
-
 void WebFrameImpl::replaceSelection(const WebString& text)
 {
     RefPtr<DocumentFragment> fragment = createFragmentFromText(
@@ -1583,8 +1584,7 @@ void WebFrameImpl::scopeStringMatches(int identifier,
         // find an alternative.
         RefPtr<Range> resultRange(findPlainText(searchRange.get(),
                                                 searchText,
-                                                true,
-                                                options.matchCase));
+                                                options.matchCase ? 0 : CaseInsensitive));
         if (resultRange->collapsed(ec)) {
             if (!resultRange->startContainer()->isInShadowTree())
                 break;
@@ -1742,9 +1742,18 @@ WebString WebFrameImpl::contentAsMarkup() const
     return createFullMarkup(m_frame->document());
 }
 
-WebString WebFrameImpl::renderTreeAsText() const
+WebString WebFrameImpl::renderTreeAsText(bool showDebugInfo) const
 {
-    return externalRepresentation(m_frame);
+    RenderAsTextBehavior behavior = RenderAsTextBehaviorNormal;
+
+    if (showDebugInfo) {
+        behavior |= RenderAsTextShowCompositedLayers
+            | RenderAsTextShowAddresses
+            | RenderAsTextShowIDAndClass
+            | RenderAsTextShowLayerNesting;
+    }
+
+    return externalRepresentation(m_frame, behavior);
 }
 
 WebString WebFrameImpl::counterValueForElementById(const WebString& id) const
@@ -1791,7 +1800,7 @@ bool WebFrameImpl::selectionStartHasSpellingMarkerFor(int from, int length) cons
 {
     if (!m_frame)
         return false;
-    return m_frame->editor()->selectionStartHasSpellingMarkerFor(from, length);
+    return m_frame->editor()->selectionStartHasMarkerFor(DocumentMarker::Spelling, from, length);
 }
 
 bool WebFrameImpl::pauseSVGAnimation(const WebString& animationId, double time, const WebString& elementId)
@@ -1814,11 +1823,11 @@ bool WebFrameImpl::pauseSVGAnimation(const WebString& animationId, double time,
 #endif
 }
 
-WebString WebFrameImpl::layerTreeAsText() const
+WebString WebFrameImpl::layerTreeAsText(bool showDebugInfo) const
 {
     if (!m_frame)
         return WebString();
-    return WebString(m_frame->layerTreeAsText());
+    return WebString(m_frame->layerTreeAsText(showDebugInfo));
 }
 
 // WebFrameImpl public ---------------------------------------------------------
diff --git a/Source/WebKit/chromium/src/WebFrameImpl.h b/Source/WebKit/chromium/src/WebFrameImpl.h
index 179051e..6129de1 100644
--- a/Source/WebKit/chromium/src/WebFrameImpl.h
+++ b/Source/WebKit/chromium/src/WebFrameImpl.h
@@ -133,12 +133,13 @@ public:
     virtual bool isViewSourceModeEnabled() const;
     virtual void setReferrerForRequest(WebURLRequest&, const WebURL& referrer);
     virtual void dispatchWillSendRequest(WebURLRequest&);
+    // FIXME: Remove this overload when clients have been changed to pass options.
     virtual WebURLLoader* createAssociatedURLLoader();
+    virtual WebURLLoader* createAssociatedURLLoader(const WebURLLoaderOptions&);
     virtual void commitDocumentData(const char* data, size_t length);
     virtual unsigned unloadListenerCount() const;
     virtual bool isProcessingUserGesture() const;
     virtual bool willSuppressOpenerInNewFrame() const;
-    virtual bool pageDismissalEventBeingDispatched() const;
     virtual void replaceSelection(const WebString&);
     virtual void insertText(const WebString&);
     virtual void setMarkedText(const WebString&, unsigned location, unsigned length);
@@ -187,7 +188,7 @@ public:
 
     virtual WebString contentAsText(size_t maxChars) const;
     virtual WebString contentAsMarkup() const;
-    virtual WebString renderTreeAsText() const;
+    virtual WebString renderTreeAsText(bool showDebugInfo = false) const;
     virtual WebString counterValueForElementById(const WebString& id) const;
     virtual WebString markerTextForListItem(const WebElement&) const;
     virtual int pageNumberForElementById(const WebString& id,
@@ -199,7 +200,7 @@ public:
     virtual bool pauseSVGAnimation(const WebString& animationId,
                                    double time,
                                    const WebString& elementId);
-    virtual WebString layerTreeAsText() const;
+    virtual WebString layerTreeAsText(bool showDebugInfo = false) const;
 
     static PassRefPtr<WebFrameImpl> create(WebFrameClient* client);
     ~WebFrameImpl();
diff --git a/Source/WebKit/chromium/src/WebGeolocationClientMock.cpp b/Source/WebKit/chromium/src/WebGeolocationClientMock.cpp
index 1ec3dd1..0ad47da 100644
--- a/Source/WebKit/chromium/src/WebGeolocationClientMock.cpp
+++ b/Source/WebKit/chromium/src/WebGeolocationClientMock.cpp
@@ -82,6 +82,11 @@ void WebGeolocationClientMock::setPermission(bool allowed)
     m_clientMock->setPermission(allowed);
 }
 
+int WebGeolocationClientMock::numberOfPendingPermissionRequests() const
+{
+    return m_clientMock->numberOfPendingPermissionRequests();
+}
+
 void WebGeolocationClientMock::resetMock()
 {
     m_clientMock->reset();
diff --git a/Source/WebKit/chromium/src/WebIDBCallbacksImpl.cpp b/Source/WebKit/chromium/src/WebIDBCallbacksImpl.cpp
index 38ac360..ce307a4 100644
--- a/Source/WebKit/chromium/src/WebIDBCallbacksImpl.cpp
+++ b/Source/WebKit/chromium/src/WebIDBCallbacksImpl.cpp
@@ -30,13 +30,11 @@
 #include "IDBCursorBackendProxy.h"
 #include "IDBDatabaseError.h"
 #include "IDBDatabaseProxy.h"
-#include "IDBIndexBackendProxy.h"
 #include "IDBKey.h"
 #include "IDBTransactionBackendProxy.h"
 #include "WebIDBCallbacks.h"
 #include "WebIDBDatabase.h"
 #include "WebIDBDatabaseError.h"
-#include "WebIDBIndex.h"
 #include "WebIDBKey.h"
 #include "WebIDBTransaction.h"
 #include "WebSerializedScriptValue.h"
@@ -74,11 +72,6 @@ void WebIDBCallbacksImpl::onSuccess(const WebKit::WebIDBKey& key)
     m_callbacks->onSuccess(key);
 }
 
-void WebIDBCallbacksImpl::onSuccess(WebKit::WebIDBIndex* webKitInstance)
-{
-    m_callbacks->onSuccess(IDBIndexBackendProxy::create(webKitInstance));
-}
-
 void WebIDBCallbacksImpl::onSuccess(WebKit::WebIDBTransaction* webKitInstance)
 {
     m_callbacks->onSuccess(IDBTransactionBackendProxy::create(webKitInstance));
diff --git a/Source/WebKit/chromium/src/WebIDBCallbacksImpl.h b/Source/WebKit/chromium/src/WebIDBCallbacksImpl.h
index 9dd59a5..057aa25 100644
--- a/Source/WebKit/chromium/src/WebIDBCallbacksImpl.h
+++ b/Source/WebKit/chromium/src/WebIDBCallbacksImpl.h
@@ -45,7 +45,6 @@ public:
     virtual void onSuccess(WebKit::WebIDBCursor*);
     virtual void onSuccess(WebKit::WebIDBDatabase*);
     virtual void onSuccess(const WebKit::WebIDBKey&);
-    virtual void onSuccess(WebKit::WebIDBIndex*);
     virtual void onSuccess(WebKit::WebIDBTransaction*);
     virtual void onSuccess(const WebKit::WebSerializedScriptValue&);
     virtual void onBlocked();
diff --git a/Source/WebKit/chromium/src/WebIDBFactoryImpl.cpp b/Source/WebKit/chromium/src/WebIDBFactoryImpl.cpp
index a509076..3e21af5 100755
--- a/Source/WebKit/chromium/src/WebIDBFactoryImpl.cpp
+++ b/Source/WebKit/chromium/src/WebIDBFactoryImpl.cpp
@@ -58,9 +58,9 @@ WebIDBFactoryImpl::~WebIDBFactoryImpl()
 {
 }
 
-void WebIDBFactoryImpl::open(const WebString& name, WebIDBCallbacks* callbacks, const WebSecurityOrigin& origin, WebFrame*, const WebString& dataDir, unsigned long long maximumSize)
+void WebIDBFactoryImpl::open(const WebString& name, WebIDBCallbacks* callbacks, const WebSecurityOrigin& origin, WebFrame*, const WebString& dataDir, unsigned long long maximumSize, BackingStoreType backingStoreType)
 {
-    m_idbFactoryBackend->open(name, IDBCallbacksProxy::create(callbacks), origin, 0, dataDir, maximumSize);
+    m_idbFactoryBackend->open(name, IDBCallbacksProxy::create(callbacks), origin, 0, dataDir, maximumSize, static_cast<IDBFactoryBackendInterface::BackingStoreType>(backingStoreType));
 }
 
 } // namespace WebKit
diff --git a/Source/WebKit/chromium/src/WebIDBFactoryImpl.h b/Source/WebKit/chromium/src/WebIDBFactoryImpl.h
index 9ed6e3f..0ffd289 100755
--- a/Source/WebKit/chromium/src/WebIDBFactoryImpl.h
+++ b/Source/WebKit/chromium/src/WebIDBFactoryImpl.h
@@ -42,7 +42,7 @@ public:
     WebIDBFactoryImpl();
     virtual ~WebIDBFactoryImpl();
 
-    virtual void open(const WebString& name, WebIDBCallbacks*, const WebSecurityOrigin&, WebFrame*, const WebString& dataDir, unsigned long long maximumSize);
+    virtual void open(const WebString& name, WebIDBCallbacks*, const WebSecurityOrigin&, WebFrame*, const WebString& dataDir, unsigned long long maximumSize, BackingStoreType);
 
 private:
     WTF::RefPtr<WebCore::IDBFactoryBackendInterface> m_idbFactoryBackend;
diff --git a/Source/WebKit/chromium/src/WebIDBObjectStoreImpl.cpp b/Source/WebKit/chromium/src/WebIDBObjectStoreImpl.cpp
index 9fe6166..56e354d 100755
--- a/Source/WebKit/chromium/src/WebIDBObjectStoreImpl.cpp
+++ b/Source/WebKit/chromium/src/WebIDBObjectStoreImpl.cpp
@@ -28,6 +28,7 @@
 
 #include "DOMStringList.h"
 #include "IDBCallbacksProxy.h"
+#include "IDBIndexBackendInterface.h"
 #include "IDBKeyRange.h"
 #include "IDBObjectStoreBackendInterface.h"
 #include "WebIDBIndexImpl.h"
diff --git a/Source/WebKit/chromium/src/WebInputElement.cpp b/Source/WebKit/chromium/src/WebInputElement.cpp
index 548f1bb..3448bb6 100644
--- a/Source/WebKit/chromium/src/WebInputElement.cpp
+++ b/Source/WebKit/chromium/src/WebInputElement.cpp
@@ -65,16 +65,6 @@ bool WebInputElement::autoComplete() const
     return constUnwrap<HTMLInputElement>()->autoComplete();
 }
 
-bool WebInputElement::isReadOnly() const
-{
-    return constUnwrap<HTMLInputElement>()->readOnly();
-}
-
-bool WebInputElement::isEnabledFormControl() const
-{
-    return constUnwrap<HTMLInputElement>()->isEnabledFormControl();
-}
-
 int WebInputElement::maxLength() const
 {
     return constUnwrap<HTMLInputElement>()->maxLength();
@@ -183,7 +173,7 @@ WebInputElement::operator PassRefPtr<HTMLInputElement>() const
 
 WebInputElement* toWebInputElement(WebElement* webElement)
 {
-    InputElement* inputElement = toInputElement(webElement->unwrap<Element>());
+    InputElement* inputElement = webElement->unwrap<Element>()->toInputElement();
     if (!inputElement)
         return 0;
 
diff --git a/Source/WebKit/chromium/src/WebMediaPlayerClientImpl.cpp b/Source/WebKit/chromium/src/WebMediaPlayerClientImpl.cpp
index a1b428c..abe9cbf 100644
--- a/Source/WebKit/chromium/src/WebMediaPlayerClientImpl.cpp
+++ b/Source/WebKit/chromium/src/WebMediaPlayerClientImpl.cpp
@@ -183,6 +183,12 @@ float WebMediaPlayerClientImpl::volume() const
     return 0.0f;
 }
 
+void WebMediaPlayerClientImpl::playbackStateChanged()
+{
+    ASSERT(m_mediaPlayer);
+    m_mediaPlayer->playbackStateChanged();
+}
+
 // MediaPlayerPrivateInterface -------------------------------------------------
 
 void WebMediaPlayerClientImpl::load(const String& url)
diff --git a/Source/WebKit/chromium/src/WebMediaPlayerClientImpl.h b/Source/WebKit/chromium/src/WebMediaPlayerClientImpl.h
index 5d44626..22030b3 100644
--- a/Source/WebKit/chromium/src/WebMediaPlayerClientImpl.h
+++ b/Source/WebKit/chromium/src/WebMediaPlayerClientImpl.h
@@ -76,6 +76,7 @@ public:
     virtual void sizeChanged();
     virtual void sawUnsupportedTracks();
     virtual float volume() const;
+    virtual void playbackStateChanged();
 
     // MediaPlayerPrivateInterface methods:
     virtual void load(const WTF::String& url);
diff --git a/Source/WebKit/chromium/src/WebNode.cpp b/Source/WebKit/chromium/src/WebNode.cpp
index e91d1ee..68b6f13 100644
--- a/Source/WebKit/chromium/src/WebNode.cpp
+++ b/Source/WebKit/chromium/src/WebNode.cpp
@@ -145,9 +145,14 @@ bool WebNode::isTextNode() const
     return m_private->isTextNode();
 }
 
+bool WebNode::isFocusable() const
+{
+    return m_private->isFocusable();
+}
+
 bool WebNode::isContentEditable() const
 {
-    return m_private->isContentEditable();
+    return m_private->rendererIsEditable();
 }
 
 bool WebNode::isElementNode() const
diff --git a/Source/WebKit/chromium/src/WebPageSerializer.cpp b/Source/WebKit/chromium/src/WebPageSerializer.cpp
index 1fda484..c8c7529 100644
--- a/Source/WebKit/chromium/src/WebPageSerializer.cpp
+++ b/Source/WebKit/chromium/src/WebPageSerializer.cpp
@@ -31,19 +31,152 @@
 #include "config.h"
 #include "WebPageSerializer.h"
 
+#include "DocumentLoader.h"
+#include "Element.h"
+#include "Frame.h"
+#include "HTMLAllCollection.h"
+#include "HTMLFrameOwnerElement.h"
+#include "HTMLInputElement.h"
+#include "HTMLNames.h"
 #include "KURL.h"
+#include "Vector.h"
 
+#include "WebCString.h"
 #include "WebFrame.h"
+#include "WebFrameImpl.h"
 #include "WebPageSerializerClient.h"
 #include "WebPageSerializerImpl.h"
 #include "WebString.h"
 #include "WebURL.h"
 #include "WebVector.h"
+#include "WebView.h"
 
 #include <wtf/text/StringConcatenate.h>
 
 using namespace WebCore;
 
+namespace {
+
+KURL getSubResourceURLFromElement(Element* element)
+{
+    ASSERT(element);
+    const QualifiedName* attributeName = 0;
+    if (element->hasTagName(HTMLNames::imgTag) || element->hasTagName(HTMLNames::scriptTag))
+        attributeName = &HTMLNames::srcAttr;
+    else if (element->hasTagName(HTMLNames::inputTag)) {
+        HTMLInputElement* input = static_cast<HTMLInputElement*>(element);
+        if (input->isImageButton())
+            attributeName = &HTMLNames::srcAttr;
+    } else if (element->hasTagName(HTMLNames::bodyTag)
+               || element->hasTagName(HTMLNames::tableTag)
+               || element->hasTagName(HTMLNames::trTag)
+               || element->hasTagName(HTMLNames::tdTag))
+        attributeName = &HTMLNames::backgroundAttr;
+    else if (element->hasTagName(HTMLNames::blockquoteTag)
+             || element->hasTagName(HTMLNames::qTag)
+             || element->hasTagName(HTMLNames::delTag)
+             || element->hasTagName(HTMLNames::insTag))
+        attributeName = &HTMLNames::citeAttr;
+    else if (element->hasTagName(HTMLNames::linkTag)) {
+        // If the link element is not css, ignore it.
+        if (equalIgnoringCase(element->getAttribute(HTMLNames::typeAttr), "text/css")) {
+            // FIXME: Add support for extracting links of sub-resources which
+            // are inside style-sheet such as @import, @font-face, url(), etc.
+            attributeName = &HTMLNames::hrefAttr;
+        }
+    } else if (element->hasTagName(HTMLNames::objectTag))
+        attributeName = &HTMLNames::dataAttr;
+    else if (element->hasTagName(HTMLNames::embedTag))
+        attributeName = &HTMLNames::srcAttr;
+
+    if (!attributeName)
+        return KURL();
+
+    String value = element->getAttribute(*attributeName);
+    // Ignore javascript content.
+    if (value.isEmpty() || value.stripWhiteSpace().startsWith("javascript:", false))
+        return KURL();
+  
+    return element->document()->completeURL(value);
+}
+
+void retrieveResourcesForElement(Element* element,
+                                 Vector<Frame*>* visitedFrames,
+                                 Vector<Frame*>* framesToVisit,
+                                 Vector<KURL>* frameURLs,
+                                 Vector<KURL>* resourceURLs)
+{
+    // If the node is a frame, we'll process it later in retrieveResourcesForFrame.
+    if ((element->hasTagName(HTMLNames::iframeTag) || element->hasTagName(HTMLNames::frameTag)
+        || element->hasTagName(HTMLNames::objectTag) || element->hasTagName(HTMLNames::embedTag))
+            && element->isFrameOwnerElement()) {
+        Frame* frame = static_cast<HTMLFrameOwnerElement*>(element)->contentFrame();
+        if (frame) {
+            if (!visitedFrames->contains(frame))
+                framesToVisit->append(frame);
+            return;
+        }
+    }
+
+    KURL url = getSubResourceURLFromElement(element);
+    if (url.isEmpty() || !url.isValid())
+        return; // No subresource for this node.
+
+    // Ignore URLs that have a non-standard protocols. Since the FTP protocol
+    // does no have a cache mechanism, we skip it as well.
+    if (!url.protocolInHTTPFamily() && !url.isLocalFile())
+        return;
+
+    if (!resourceURLs->contains(url))
+        resourceURLs->append(url);
+}
+
+void retrieveResourcesForFrame(Frame* frame,
+                               const WebKit::WebVector<WebKit::WebCString>& supportedSchemes,
+                               Vector<Frame*>* visitedFrames,
+                               Vector<Frame*>* framesToVisit,
+                               Vector<KURL>* frameURLs,
+                               Vector<KURL>* resourceURLs)
+{
+    KURL frameURL = frame->loader()->documentLoader()->request().url();
+
+    // If the frame's URL is invalid, ignore it, it is not retrievable.
+    if (!frameURL.isValid())
+        return;
+
+    // Ignore frames from unsupported schemes.
+    bool isValidScheme = false;
+    for (size_t i = 0; i < supportedSchemes.size(); ++i) {
+        if (frameURL.protocolIs(static_cast<CString>(supportedSchemes[i]).data())) {
+            isValidScheme = true;
+            break;
+        }
+    }
+    if (!isValidScheme)
+        return;
+
+    // If we have already seen that frame, ignore it.
+    if (visitedFrames->contains(frame))
+        return;
+    visitedFrames->append(frame);
+    if (!frameURLs->contains(frameURL))
+        frameURLs->append(frameURL);
+  
+    // Now get the resources associated with each node of the document.
+    RefPtr<HTMLAllCollection> allNodes = frame->document()->all();
+    for (unsigned i = 0; i < allNodes->length(); ++i) {
+        Node* node = allNodes->item(i);
+        // We are only interested in HTML resources.
+        if (!node->isElementNode())
+            continue;
+        retrieveResourcesForElement(static_cast<Element*>(node),
+                                    visitedFrames, framesToVisit,
+                                    frameURLs, resourceURLs);
+    }
+}
+
+} // namespace
+
 namespace WebKit {
 
 bool WebPageSerializer::serialize(WebFrame* frame,
@@ -58,6 +191,48 @@ bool WebPageSerializer::serialize(WebFrame* frame,
     return serializerImpl.serialize();
 }
 
+bool WebPageSerializer::retrieveAllResources(WebView* view,
+                                             const WebVector<WebCString>& supportedSchemes,
+                                             WebVector<WebURL>* resourceURLs,
+                                             WebVector<WebURL>* frameURLs) {
+    WebFrameImpl* mainFrame = static_cast<WebFrameImpl*>(view->mainFrame());
+    if (!mainFrame)
+        return false;
+
+    Vector<Frame*> framesToVisit;
+    Vector<Frame*> visitedFrames;
+    Vector<KURL> frameKURLs;
+    Vector<KURL> resourceKURLs;
+    
+    // Let's retrieve the resources from every frame in this page.
+    framesToVisit.append(mainFrame->frame());
+    while (!framesToVisit.isEmpty()) {
+        Frame* frame = framesToVisit[0];
+        framesToVisit.remove(0);
+        retrieveResourcesForFrame(frame, supportedSchemes,
+                                  &visitedFrames, &framesToVisit,
+                                  &frameKURLs, &resourceKURLs);
+    }
+
+    // Converts the results to WebURLs.
+    WebVector<WebURL> resultResourceURLs(resourceKURLs.size());
+    for (size_t i = 0; i < resourceKURLs.size(); ++i) {
+        resultResourceURLs[i] = resourceKURLs[i];
+        // A frame's src can point to the same URL as another resource, keep the
+        // resource URL only in such cases.
+        size_t index = frameKURLs.find(resourceKURLs[i]);
+        if (index != notFound)
+            frameKURLs.remove(index);
+    }
+    *resourceURLs = resultResourceURLs;
+    WebVector<WebURL> resultFrameURLs(frameKURLs.size());
+    for (size_t i = 0; i < frameKURLs.size(); ++i)
+        resultFrameURLs[i] = frameKURLs[i];
+    *frameURLs = resultFrameURLs;
+    
+    return true;
+}
+
 WebString WebPageSerializer::generateMetaCharsetDeclaration(const WebString& charset)
 {
     return makeString("<meta http-equiv=\"Content-Type\" content=\"text/html; charset=", static_cast<const String&>(charset), "\">");
@@ -77,4 +252,4 @@ WebString WebPageSerializer::generateBaseTagDeclaration(const WebString& baseTar
     return makeString("<base href=\".\" target=\"", static_cast<const String&>(baseTarget), "\">");
 }
 
-}  // namespace WebKit
+} // namespace WebKit
diff --git a/Source/WebKit/chromium/src/WebPluginContainerImpl.cpp b/Source/WebKit/chromium/src/WebPluginContainerImpl.cpp
index bb1b083..40f8625 100644
--- a/Source/WebKit/chromium/src/WebPluginContainerImpl.cpp
+++ b/Source/WebKit/chromium/src/WebPluginContainerImpl.cpp
@@ -164,6 +164,7 @@ void WebPluginContainerImpl::handleEvent(Event* event)
     if (!m_webPlugin->acceptsInputEvents())
         return;
 
+    RefPtr<WebPluginContainerImpl> protector(this);
     // The events we pass are defined at:
     //    http://devedge-temp.mozilla.org/library/manuals/2002/plugin/1.0/structures5.html#1000000
     // Don't take the documentation as truth, however.  There are many cases
@@ -307,6 +308,22 @@ void WebPluginContainerImpl::reportGeometry()
     m_webPlugin->updateGeometry(windowRect, clipRect, cutOutRects, isVisible());
 }
 
+void WebPluginContainerImpl::setBackingTextureId(unsigned id)
+{
+#if USE(ACCELERATED_COMPOSITING)
+    unsigned currId = m_platformLayer->textureId();
+    if (currId == id)
+        return;
+
+    m_platformLayer->setTextureId(id);
+    // If anyone of the IDs is zero we need to switch between hardware
+    // and software compositing. This is done by triggering a style recalc
+    // on the container element.
+    if (!(currId * id))
+        m_element->setNeedsStyleRecalc(WebCore::SyntheticStyleChange);
+#endif
+}
+
 void WebPluginContainerImpl::commitBackingTexture()
 {
 #if USE(ACCELERATED_COMPOSITING)
@@ -427,15 +444,7 @@ void WebPluginContainerImpl::willDestroyPluginLoadObserver(WebPluginLoadObserver
 #if USE(ACCELERATED_COMPOSITING)
 WebCore::LayerChromium* WebPluginContainerImpl::platformLayer() const
 {
-    // FIXME: In the event of a context lost, the texture needs to be recreated on the compositor's
-    // context and rebound to the platform layer here.
-    unsigned backingTextureId = m_webPlugin->getBackingTextureId();
-    if (!backingTextureId)
-        return 0;
-
-    m_platformLayer->setTextureId(backingTextureId);
-
-    return m_platformLayer.get();
+    return m_platformLayer->textureId() ? m_platformLayer.get() : 0;
 }
 #endif
 
diff --git a/Source/WebKit/chromium/src/WebPluginContainerImpl.h b/Source/WebKit/chromium/src/WebPluginContainerImpl.h
index ebe6983..9922932 100644
--- a/Source/WebKit/chromium/src/WebPluginContainerImpl.h
+++ b/Source/WebKit/chromium/src/WebPluginContainerImpl.h
@@ -84,6 +84,7 @@ public:
     virtual void invalidateRect(const WebRect&);
     virtual void scrollRect(int dx, int dy, const WebRect&);
     virtual void reportGeometry();
+    virtual void setBackingTextureId(unsigned);
     virtual void commitBackingTexture();
     virtual void clearScriptObjects();
     virtual NPObject* scriptableObjectForElement();
diff --git a/Source/WebKit/chromium/src/WebRuntimeFeatures.cpp b/Source/WebKit/chromium/src/WebRuntimeFeatures.cpp
index e3ece6e..256bf56 100644
--- a/Source/WebKit/chromium/src/WebRuntimeFeatures.cpp
+++ b/Source/WebKit/chromium/src/WebRuntimeFeatures.cpp
@@ -152,6 +152,22 @@ bool WebRuntimeFeatures::isApplicationCacheEnabled()
 #endif
 }
 
+void WebRuntimeFeatures::enableDataTransferItems(bool enable)
+{
+#if ENABLE(DATA_TRANSFER_ITEMS)
+    RuntimeEnabledFeatures::setDataTransferItemsEnabled(enable);
+#endif
+}
+
+bool WebRuntimeFeatures::isDataTransferItemsEnabled()
+{
+#if ENABLE(DATA_TRANSFER_ITEMS)
+    return RuntimeEnabledFeatures::dataTransferItemsEnabled();
+#else
+    return false;
+#endif
+}
+
 void WebRuntimeFeatures::enableGeolocation(bool enable)
 {
 #if ENABLE(GEOLOCATION)
@@ -200,22 +216,6 @@ bool WebRuntimeFeatures::isWebAudioEnabled()
 #endif
 }
 
-void WebRuntimeFeatures::enableWebGL(bool enable)
-{
-#if ENABLE(WEBGL)
-    RuntimeEnabledFeatures::setWebGLEnabled(enable);
-#endif
-}
-
-bool WebRuntimeFeatures::isWebGLEnabled()
-{
-#if ENABLE(WEBGL)
-    return RuntimeEnabledFeatures::webGLRenderingContextEnabled();
-#else
-    return false;
-#endif
-}
-
 void WebRuntimeFeatures::enablePushState(bool enable)
 {
     RuntimeEnabledFeatures::setPushStateEnabled(enable);
diff --git a/Source/WebKit/chromium/src/WebSettingsImpl.cpp b/Source/WebKit/chromium/src/WebSettingsImpl.cpp
index e5d172e..1089af9 100644
--- a/Source/WebKit/chromium/src/WebSettingsImpl.cpp
+++ b/Source/WebKit/chromium/src/WebSettingsImpl.cpp
@@ -308,6 +308,11 @@ void WebSettingsImpl::setAcceleratedCompositingEnabled(bool enabled)
     m_settings->setAcceleratedCompositingEnabled(enabled);
 }
 
+void WebSettingsImpl::setForceCompositingMode(bool enabled)
+{
+    m_settings->setForceCompositingMode(enabled);
+}
+
 void WebSettingsImpl::setCompositeToTextureEnabled(bool enabled)
 {
     m_compositeToTextureEnabled = enabled;
diff --git a/Source/WebKit/chromium/src/WebSettingsImpl.h b/Source/WebKit/chromium/src/WebSettingsImpl.h
index 323a5b3..d0319f8 100644
--- a/Source/WebKit/chromium/src/WebSettingsImpl.h
+++ b/Source/WebKit/chromium/src/WebSettingsImpl.h
@@ -94,6 +94,7 @@ public:
     virtual bool showPlatformLayerTree() const { return m_showPlatformLayerTree; }
     virtual void setEditingBehavior(EditingBehavior);
     virtual void setAcceleratedCompositingEnabled(bool);
+    virtual void setForceCompositingMode(bool);
     virtual void setCompositeToTextureEnabled(bool);
     virtual bool compositeToTextureEnabled() const { return m_compositeToTextureEnabled; }
     virtual void setAcceleratedCompositingFor3DTransformsEnabled(bool);
diff --git a/Source/WebKit/chromium/src/WebTextCheckingCompletionImpl.cpp b/Source/WebKit/chromium/src/WebTextCheckingCompletionImpl.cpp
index 2759790..b9e5227 100644
--- a/Source/WebKit/chromium/src/WebTextCheckingCompletionImpl.cpp
+++ b/Source/WebKit/chromium/src/WebTextCheckingCompletionImpl.cpp
@@ -43,7 +43,7 @@ static Vector<SpellCheckingResult> toCoreResults(const WebVector<WebTextChecking
 {
     Vector<SpellCheckingResult> coreResults;
     for (size_t i = 0; i < results.size(); ++i)
-        coreResults.append(SpellCheckingResult(static_cast<DocumentMarker::MarkerType>(results[i].error()), results[i].position(), results[i].length()));
+        coreResults.append(SpellCheckingResult(static_cast<DocumentMarker::MarkerType>(results[i].error), results[i].position, results[i].length));
     return coreResults;
 }
 
diff --git a/Source/WebKit/chromium/src/WebViewImpl.cpp b/Source/WebKit/chromium/src/WebViewImpl.cpp
index 6ae4f35..4efa880 100644
--- a/Source/WebKit/chromium/src/WebViewImpl.cpp
+++ b/Source/WebKit/chromium/src/WebViewImpl.cpp
@@ -77,7 +77,6 @@
 #include "PageGroup.h"
 #include "PageGroupLoadDeferrer.h"
 #include "Pasteboard.h"
-#include "PlatformBridge.h"
 #include "PlatformContextSkia.h"
 #include "PlatformKeyboardEvent.h"
 #include "PlatformMouseEvent.h"
@@ -93,6 +92,7 @@
 #include "Settings.h"
 #include "SpeechInputClientImpl.h"
 #include "Timer.h"
+#include "TraceEvent.h"
 #include "TypingCommand.h"
 #include "UserGestureIndicator.h"
 #include "Vector.h"
@@ -126,6 +126,7 @@
 #include <wtf/RefPtr.h>
 
 #if PLATFORM(CG)
+#include <CoreGraphics/CGBitmapContext.h>
 #include <CoreGraphics/CGContext.h>
 #endif
 
@@ -211,13 +212,13 @@ static bool shouldUseExternalPopupMenus = false;
 
 // WebView ----------------------------------------------------------------
 
-WebView* WebView::create(WebViewClient* client, WebDevToolsAgentClient* devToolsClient, WebAutoFillClient* autoFillClient)
+WebView* WebView::create(WebViewClient* client)
 {
     // Keep runtime flag for device motion turned off until it's implemented.
     WebRuntimeFeatures::enableDeviceMotion(false);
 
     // Pass the WebViewImpl's self-reference to the caller.
-    return adoptRef(new WebViewImpl(client, devToolsClient, autoFillClient)).leakRef();
+    return adoptRef(new WebViewImpl(client)).leakRef();
 }
 
 void WebView::setUseExternalPopupMenus(bool useExternalPopupMenus)
@@ -269,9 +270,28 @@ void WebViewImpl::initializeMainFrame(WebFrameClient* frameClient)
     SecurityOrigin::setLocalLoadPolicy(SecurityOrigin::AllowLocalLoadsForLocalOnly);
 }
 
-WebViewImpl::WebViewImpl(WebViewClient* client, WebDevToolsAgentClient* devToolsClient, WebAutoFillClient* autoFillClient)
+void WebViewImpl::setDevToolsAgentClient(WebDevToolsAgentClient* devToolsClient) 
+{
+    if (devToolsClient)
+        m_devToolsAgent = new WebDevToolsAgentImpl(this, devToolsClient);
+    else
+        m_devToolsAgent.clear();
+}
+
+void WebViewImpl::setAutoFillClient(WebAutoFillClient* autoFillClient)
+{
+    m_autoFillClient = autoFillClient;
+}
+
+void WebViewImpl::setSpellCheckClient(WebSpellCheckClient* spellCheckClient)
+{
+    m_spellCheckClient = spellCheckClient;
+}
+
+WebViewImpl::WebViewImpl(WebViewClient* client)
     : m_client(client)
-    , m_autoFillClient(autoFillClient)
+    , m_autoFillClient(0)
+    , m_spellCheckClient(0)
     , m_chromeClientImpl(this)
     , m_contextMenuClientImpl(this)
     , m_dragClientImpl(this)
@@ -290,9 +310,6 @@ WebViewImpl::WebViewImpl(WebViewClient* client, WebDevToolsAgentClient* devTools
     , m_suppressNextKeypressEvent(false)
     , m_initialNavigationPolicy(WebNavigationPolicyIgnore)
     , m_imeAcceptEvents(true)
-    , m_dragTargetDispatch(false)
-    , m_dragIdentity(0)
-    , m_dropEffect(DropEffectDefault)
     , m_operationsAllowed(WebDragOperationNone)
     , m_dragOperation(WebDragOperationNone)
     , m_autoFillPopupShowing(false)
@@ -305,6 +322,7 @@ WebViewImpl::WebViewImpl(WebViewClient* client, WebDevToolsAgentClient* devTools
     , m_layerRenderer(0)
     , m_isAcceleratedCompositingActive(false)
     , m_compositorCreationFailed(false)
+    , m_recreatingGraphicsContext(false)
 #endif
 #if ENABLE(INPUT_SPEECH)
     , m_speechInputClient(SpeechInputClientImpl::create(client))
@@ -321,9 +339,6 @@ WebViewImpl::WebViewImpl(WebViewClient* client, WebDevToolsAgentClient* devTools
     // set to impossible point so we always get the first mouse pos
     m_lastMousePosition = WebPoint(-1, -1);
 
-    if (devToolsClient)
-        m_devToolsAgent = new WebDevToolsAgentImpl(this, devToolsClient);
-
     Page::PageClients pageClients;
     pageClients.chromeClient = &m_chromeClientImpl;
     pageClients.contextMenuClient = &m_contextMenuClientImpl;
@@ -962,13 +977,14 @@ void WebViewImpl::resize(const WebSize& newSize)
     }
 
     if (m_client) {
-        WebRect damagedRect(0, 0, m_size.width, m_size.height);
         if (isAcceleratedCompositingActive()) {
 #if USE(ACCELERATED_COMPOSITING)
-            invalidateRootLayerRect(damagedRect);
+            updateLayerRendererViewport();
 #endif
-        } else
+        } else {
+            WebRect damagedRect(0, 0, m_size.width, m_size.height);
             m_client->didInvalidateRect(damagedRect);
+        }
     }
 
 #if USE(ACCELERATED_COMPOSITING)
@@ -993,6 +1009,12 @@ void WebViewImpl::animate()
 
 void WebViewImpl::layout()
 {
+#if USE(ACCELERATED_COMPOSITING)
+    // FIXME: RTL style not supported by the compositor yet.
+    if (isAcceleratedCompositingActive() && pageHasRTLStyle())
+        setIsAcceleratedCompositingActive(false);
+#endif
+
     WebFrameImpl* webframe = mainFrameImpl();
     if (webframe) {
         // In order for our child HWNDs (NativeWindowWidgets) to update properly,
@@ -1057,7 +1079,7 @@ void WebViewImpl::paint(WebCanvas* canvas, const WebRect& rect)
         if (canvas) {
             // Clip rect to the confines of the rootLayerTexture.
             IntRect resizeRect(rect);
-            resizeRect.intersect(IntRect(IntPoint(), m_layerRenderer->visibleRectSize()));
+            resizeRect.intersect(IntRect(IntPoint(), m_layerRenderer->viewportSize()));
             doPixelReadbackToCanvas(canvas, resizeRect);
         }
 #endif
@@ -1081,6 +1103,14 @@ void WebViewImpl::themeChanged()
 void WebViewImpl::composite(bool finish)
 {
 #if USE(ACCELERATED_COMPOSITING)
+    TRACE_EVENT("WebViewImpl::composite", this, 0);
+    if (m_recreatingGraphicsContext) {
+        // reallocateRenderer will request a repaint whether or not it succeeded
+        // in creating a new context.
+        reallocateRenderer();
+        m_recreatingGraphicsContext = false;
+        return;
+    }
     doComposite();
 
     // Finish if requested.
@@ -1091,8 +1121,16 @@ void WebViewImpl::composite(bool finish)
     m_layerRenderer->present();
 
     GraphicsContext3D* context = m_layerRenderer->context();
-    if (context->getExtensions()->getGraphicsResetStatusARB() != GraphicsContext3D::NO_ERROR)
-        reallocateRenderer();
+    if (context->getExtensions()->getGraphicsResetStatusARB() != GraphicsContext3D::NO_ERROR) {
+        // Trying to recover the context right here will not work if GPU process
+        // died. This is because GpuChannelHost::OnErrorMessage will only be
+        // called at the next iteration of the message loop, reverting our
+        // recovery attempts here. Instead, we detach the root layer from the
+        // renderer, recreate the renderer at the next message loop iteration
+        // and request a repaint yet again.
+        m_recreatingGraphicsContext = true;
+        setRootLayerNeedsDisplay();
+    }
 #endif
 }
 
@@ -1235,7 +1273,7 @@ void WebViewImpl::setFocus(bool enable)
                 Element* element = static_cast<Element*>(focusedNode);
                 if (element->isTextFormControl())
                     element->updateFocusAppearance(true);
-                else if (focusedNode->isContentEditable()) {
+                else if (focusedNode->rendererIsEditable()) {
                     // updateFocusAppearance() selects all the text of
                     // contentseditable DIVs. So we set the selection explicitly
                     // instead. Note that this has the side effect of moving the
@@ -1297,7 +1335,7 @@ bool WebViewImpl::setComposition(
     PassRefPtr<Range> range = editor->compositionRange();
     if (range) {
         const Node* node = range->startContainer();
-        if (!node || !node->isContentEditable())
+        if (!node || !node->rendererIsEditable())
             return false;
     }
 
@@ -1346,7 +1384,7 @@ bool WebViewImpl::confirmComposition(const WebString& text)
     PassRefPtr<Range> range = editor->compositionRange();
     if (range) {
         const Node* node = range->startContainer();
-        if (!node || !node->isContentEditable())
+        if (!node || !node->rendererIsEditable())
             return false;
     }
 
@@ -1755,7 +1793,22 @@ void WebViewImpl::dragSourceSystemDragEnded()
 }
 
 WebDragOperation WebViewImpl::dragTargetDragEnter(
-    const WebDragData& webDragData, int identity,
+    const WebDragData& webDragData, int identity, // FIXME: remove identity from this function signature.
+    const WebPoint& clientPoint,
+    const WebPoint& screenPoint,
+    WebDragOperationsMask operationsAllowed)
+{
+    ASSERT(!m_currentDragData.get());
+
+    m_currentDragData = webDragData;
+    UNUSED_PARAM(identity);
+    m_operationsAllowed = operationsAllowed;
+
+    return dragTargetDragEnterOrOver(clientPoint, screenPoint, DragEnter);
+}
+
+WebDragOperation WebViewImpl::dragTargetDragEnter(
+    const WebDragData& webDragData,
     const WebPoint& clientPoint,
     const WebPoint& screenPoint,
     WebDragOperationsMask operationsAllowed)
@@ -1763,7 +1816,6 @@ WebDragOperation WebViewImpl::dragTargetDragEnter(
     ASSERT(!m_currentDragData.get());
 
     m_currentDragData = webDragData;
-    m_dragIdentity = identity;
     m_operationsAllowed = operationsAllowed;
 
     return dragTargetDragEnterOrOver(clientPoint, screenPoint, DragEnter);
@@ -1789,14 +1841,12 @@ void WebViewImpl::dragTargetDragLeave()
         IntPoint(),
         static_cast<DragOperation>(m_operationsAllowed));
 
-    m_dragTargetDispatch = true;
     m_page->dragController()->dragExited(&dragData);
-    m_dragTargetDispatch = false;
 
-    m_currentDragData = 0;
-    m_dropEffect = DropEffectDefault;
+    // FIXME: why is the drag scroll timer not stopped here?
+
     m_dragOperation = WebDragOperationNone;
-    m_dragIdentity = 0;
+    m_currentDragData = 0;
 }
 
 void WebViewImpl::dragTargetDrop(const WebPoint& clientPoint,
@@ -1822,22 +1872,12 @@ void WebViewImpl::dragTargetDrop(const WebPoint& clientPoint,
         screenPoint,
         static_cast<DragOperation>(m_operationsAllowed));
 
-    m_dragTargetDispatch = true;
     m_page->dragController()->performDrag(&dragData);
-    m_dragTargetDispatch = false;
 
-    m_currentDragData = 0;
-    m_dropEffect = DropEffectDefault;
     m_dragOperation = WebDragOperationNone;
-    m_dragIdentity = 0;
-    m_dragScrollTimer->stop();
-}
+    m_currentDragData = 0;
 
-int WebViewImpl::dragIdentity()
-{
-    if (m_dragTargetDispatch)
-        return m_dragIdentity;
-    return 0;
+    m_dragScrollTimer->stop();
 }
 
 WebDragOperation WebViewImpl::dragTargetDragEnterOrOver(const WebPoint& clientPoint, const WebPoint& screenPoint, DragAction dragAction)
@@ -1850,27 +1890,23 @@ WebDragOperation WebViewImpl::dragTargetDragEnterOrOver(const WebPoint& clientPo
         screenPoint,
         static_cast<DragOperation>(m_operationsAllowed));
 
-    m_dropEffect = DropEffectDefault;
-    m_dragTargetDispatch = true;
-    DragOperation effect = dragAction == DragEnter ? m_page->dragController()->dragEntered(&dragData)
-                                                   : m_page->dragController()->dragUpdated(&dragData);
-    // Mask the operation against the drag source's allowed operations.
-    if (!(effect & dragData.draggingSourceOperationMask()))
-        effect = DragOperationNone;
-    m_dragTargetDispatch = false;
-
-    if (m_dropEffect != DropEffectDefault) {
-        m_dragOperation = (m_dropEffect != DropEffectNone) ? WebDragOperationCopy
-                                                           : WebDragOperationNone;
-    } else
-        m_dragOperation = static_cast<WebDragOperation>(effect);
+    DragOperation dropEffect;
+    if (dragAction == DragEnter)
+        dropEffect = m_page->dragController()->dragEntered(&dragData);
+    else
+        dropEffect = m_page->dragController()->dragUpdated(&dragData);
+
+    // Mask the drop effect operation against the drag source's allowed operations.
+    if (!(dropEffect & dragData.draggingSourceOperationMask()))
+        dropEffect = DragOperationNone;
+
+     m_dragOperation = static_cast<WebDragOperation>(dropEffect);
 
     if (dragAction == DragOver)
         m_dragScrollTimer->triggerScroll(mainFrameImpl()->frameView(), clientPoint);
     else
         m_dragScrollTimer->stop();
 
-
     return m_dragOperation;
 }
 
@@ -2010,15 +2046,6 @@ void WebViewImpl::performCustomContextMenuAction(unsigned action)
 
 // WebView --------------------------------------------------------------------
 
-bool WebViewImpl::setDropEffect(bool accept)
-{
-    if (m_dragTargetDispatch) {
-        m_dropEffect = accept ? DropEffectCopy : DropEffectNone;
-        return true;
-    }
-    return false;
-}
-
 void WebViewImpl::setIsTransparent(bool isTransparent)
 {
     // Set any existing frames to be transparent.
@@ -2258,9 +2285,26 @@ bool WebViewImpl::allowsAcceleratedCompositing()
     return !m_compositorCreationFailed;
 }
 
+bool WebViewImpl::pageHasRTLStyle() const
+{
+    if (!page())
+        return false;
+    Document* document = page()->mainFrame()->document();
+    if (!document)
+        return false;
+    RenderView* renderView = document->renderView();
+    if (!renderView)
+        return false;
+    RenderStyle* style = renderView->style();
+    if (!style)
+        return false;
+    return (style->direction() == RTL);
+}
+
 void WebViewImpl::setRootGraphicsLayer(WebCore::PlatformLayer* layer)
 {
-    setIsAcceleratedCompositingActive(layer ? true : false);
+    // FIXME: RTL style not supported by the compositor yet.
+    setIsAcceleratedCompositingActive(layer && !pageHasRTLStyle() ? true : false);
     if (m_layerRenderer)
         m_layerRenderer->setRootLayer(layer);
 
@@ -2279,6 +2323,7 @@ void WebViewImpl::setRootLayerNeedsDisplay()
 
 void WebViewImpl::scrollRootLayerRect(const IntSize& scrollDelta, const IntRect& clipRect)
 {
+    updateLayerRendererViewport();
     setRootLayerNeedsDisplay();
 }
 
@@ -2290,14 +2335,66 @@ void WebViewImpl::invalidateRootLayerRect(const IntRect& rect)
         return;
 
     FrameView* view = page()->mainFrame()->view();
-    IntRect contentRect = view->visibleContentRect(false);
-    IntRect visibleRect = view->visibleContentRect(true);
-
     IntRect dirtyRect = view->windowToContents(rect);
-    m_layerRenderer->invalidateRootLayerRect(dirtyRect, visibleRect, contentRect);
+    updateLayerRendererViewport();
+    m_layerRenderer->invalidateRootLayerRect(dirtyRect);
     setRootLayerNeedsDisplay();
 }
 
+class WebViewImplContentPainter : public TilePaintInterface {
+    WTF_MAKE_NONCOPYABLE(WebViewImplContentPainter);
+public:
+    static PassOwnPtr<WebViewImplContentPainter*> create(WebViewImpl* webViewImpl)
+    {
+        return adoptPtr(new WebViewImplContentPainter(webViewImpl));
+    }
+
+    virtual void paint(GraphicsContext& context, const IntRect& contentRect)
+    {
+        Page* page = m_webViewImpl->page();
+        if (!page)
+            return;
+        FrameView* view = page->mainFrame()->view();
+        view->paintContents(&context, contentRect);
+    }
+
+private:
+    explicit WebViewImplContentPainter(WebViewImpl* webViewImpl)
+        : m_webViewImpl(webViewImpl)
+    {
+    }
+
+    WebViewImpl* m_webViewImpl;
+};
+
+class WebViewImplScrollbarPainter : public TilePaintInterface {
+    WTF_MAKE_NONCOPYABLE(WebViewImplScrollbarPainter);
+public:
+    static PassOwnPtr<WebViewImplScrollbarPainter> create(WebViewImpl* webViewImpl)
+    {
+        return adoptPtr(new WebViewImplScrollbarPainter(webViewImpl));
+    }
+
+    virtual void paint(GraphicsContext& context, const IntRect& contentRect)
+    {
+        Page* page = m_webViewImpl->page();
+        if (!page)
+            return;
+        FrameView* view = page->mainFrame()->view();
+
+        context.translate(static_cast<float>(view->scrollX()), static_cast<float>(view->scrollY()));
+        IntRect windowRect = view->contentsToWindow(contentRect);
+        view->paintScrollbars(&context, windowRect);
+    }
+
+private:
+    explicit WebViewImplScrollbarPainter(WebViewImpl* webViewImpl)
+        : m_webViewImpl(webViewImpl)
+    {
+    }
+
+    WebViewImpl* m_webViewImpl;
+};
 
 void WebViewImpl::setIsAcceleratedCompositingActive(bool active)
 {
@@ -2308,8 +2405,11 @@ void WebViewImpl::setIsAcceleratedCompositingActive(bool active)
 
     if (!active) {
         m_isAcceleratedCompositingActive = false;
+        // We need to finish all GL rendering before sending
+        // didActivateAcceleratedCompositing(false) to prevent
+        // flickering when compositing turns off.
         if (m_layerRenderer)
-            m_layerRenderer->finish(); // finish all GL rendering before we hide the window?
+            m_layerRenderer->finish();
         m_client->didActivateAcceleratedCompositing(false);
     } else if (m_layerRenderer) {
         m_isAcceleratedCompositingActive = true;
@@ -2324,7 +2424,8 @@ void WebViewImpl::setIsAcceleratedCompositingActive(bool active)
             if (context)
                 context->reshape(std::max(1, m_size.width), std::max(1, m_size.height));
         }
-        m_layerRenderer = LayerRendererChromium::create(context.release());
+
+        m_layerRenderer = LayerRendererChromium::create(context.release(), WebViewImplContentPainter::create(this), WebViewImplScrollbarPainter::create(this));
         if (m_layerRenderer) {
             m_client->didActivateAcceleratedCompositing(true);
             m_isAcceleratedCompositingActive = true;
@@ -2339,95 +2440,67 @@ void WebViewImpl::setIsAcceleratedCompositingActive(bool active)
         page()->mainFrame()->view()->setClipsRepaints(!m_isAcceleratedCompositingActive);
 }
 
-class WebViewImplTilePaintInterface : public TilePaintInterface {
-public:
-    explicit WebViewImplTilePaintInterface(WebViewImpl* webViewImpl)
-        : m_webViewImpl(webViewImpl)
-    {
-    }
-
-    virtual void paint(GraphicsContext& context, const IntRect& contentRect)
-    {
-        Page* page = m_webViewImpl->page();
-        if (!page)
-            return;
-        FrameView* view = page->mainFrame()->view();
-        view->paintContents(&context, contentRect);
-    }
-
-private:
-    WebViewImpl* m_webViewImpl;
-};
-
-
-class WebViewImplScrollbarPaintInterface : public TilePaintInterface {
-public:
-    explicit WebViewImplScrollbarPaintInterface(WebViewImpl* webViewImpl)
-        : m_webViewImpl(webViewImpl)
-    {
-    }
-
-    virtual void paint(GraphicsContext& context, const IntRect& contentRect)
-    {
-        Page* page = m_webViewImpl->page();
-        if (!page)
-            return;
-        FrameView* view = page->mainFrame()->view();
-
-        context.translate(static_cast<float>(view->scrollX()), static_cast<float>(view->scrollY()));
-        IntRect windowRect = view->contentsToWindow(contentRect);
-        view->paintScrollbars(&context, windowRect);
-    }
-
-private:
-    WebViewImpl* m_webViewImpl;
-};
-
 void WebViewImpl::doComposite()
 {
+    ASSERT(m_layerRenderer);
+    if (!m_layerRenderer) {
+        setIsAcceleratedCompositingActive(false);
+        return;
+    }
+
     ASSERT(isAcceleratedCompositingActive());
     if (!page())
         return;
 
-    FrameView* view = page()->mainFrame()->view();
-
-    // The visibleRect includes scrollbars whereas the contentRect doesn't.
-    IntRect visibleRect = view->visibleContentRect(true);
-    IntRect contentRect = view->visibleContentRect(false);
-    IntPoint scroll(view->scrollX(), view->scrollY());
-
-    WebViewImplTilePaintInterface tilePaint(this);
-
-    WebViewImplScrollbarPaintInterface scrollbarPaint(this);
     m_layerRenderer->setCompositeOffscreen(settings()->compositeToTextureEnabled());
 
     CCHeadsUpDisplay* hud = m_layerRenderer->headsUpDisplay();
     hud->setShowFPSCounter(settings()->showFPSCounter());
     hud->setShowPlatformLayerTree(settings()->showPlatformLayerTree());
 
-    m_layerRenderer->updateAndDrawLayers(visibleRect, contentRect, scroll, tilePaint, scrollbarPaint);
-
-    if (m_layerRenderer->isCompositingOffscreen())
-        m_layerRenderer->copyOffscreenTextureToDisplay();
+    m_layerRenderer->updateAndDrawLayers();
 }
 
 void WebViewImpl::reallocateRenderer()
 {
-    GraphicsContext3D* context = m_layerRenderer->context();
-    RefPtr<GraphicsContext3D> newContext = GraphicsContext3D::create(context->getContextAttributes(), m_page->chrome(), GraphicsContext3D::RenderDirectlyToHostWindow);
+    RefPtr<GraphicsContext3D> newContext = GraphicsContext3D::create(
+            getCompositorContextAttributes(), m_page->chrome(), GraphicsContext3D::RenderDirectlyToHostWindow);
     // GraphicsContext3D::create might fail and return 0, in that case LayerRendererChromium::create will also return 0.
-    RefPtr<LayerRendererChromium> layerRenderer = LayerRendererChromium::create(newContext);
+    RefPtr<LayerRendererChromium> layerRenderer = LayerRendererChromium::create(newContext, WebViewImplContentPainter::create(this), WebViewImplScrollbarPainter::create(this));
 
     // Reattach the root layer.  Child layers will get reattached as a side effect of updateLayersRecursive.
-    if (layerRenderer)
+    if (layerRenderer) {
         m_layerRenderer->transferRootLayer(layerRenderer.get());
-    m_layerRenderer = layerRenderer;
-
-    // Enable or disable accelerated compositing and request a refresh.
-    setRootGraphicsLayer(m_layerRenderer ? m_layerRenderer->rootLayer() : 0);
+        m_layerRenderer = layerRenderer;
+        // FIXME: In MacOS newContext->reshape method needs to be called to
+        // allocate IOSurfaces. All calls to create a context followed by
+        // reshape should really be extracted into one function; it is not
+        // immediately obvious that GraphicsContext3D object will not
+        // function properly until its reshape method is called.
+        newContext->reshape(std::max(1, m_size.width), std::max(1, m_size.height));
+        setRootGraphicsLayer(m_layerRenderer->rootLayer());
+        // Forces ViewHostMsg_DidActivateAcceleratedCompositing to be sent so
+        // that the browser process can reacquire surfaces.
+        m_client->didActivateAcceleratedCompositing(true);
+    } else
+        setRootGraphicsLayer(0);
 }
 #endif
 
+void WebViewImpl::updateLayerRendererViewport()
+{
+    ASSERT(m_layerRenderer);
+
+    if (!page())
+        return;
+
+    FrameView* view = page()->mainFrame()->view();
+    IntRect contentRect = view->visibleContentRect(false);
+    IntRect visibleRect = view->visibleContentRect(true);
+    IntPoint scroll(view->scrollX(), view->scrollY());
+
+    m_layerRenderer->setViewport(visibleRect, contentRect, scroll);
+}
 
 WebGraphicsContext3D* WebViewImpl::graphicsContext3D()
 {
diff --git a/Source/WebKit/chromium/src/WebViewImpl.h b/Source/WebKit/chromium/src/WebViewImpl.h
index 2163725..66b2908 100644
--- a/Source/WebKit/chromium/src/WebViewImpl.h
+++ b/Source/WebKit/chromium/src/WebViewImpl.h
@@ -114,6 +114,9 @@ public:
 
     // WebView methods:
     virtual void initializeMainFrame(WebFrameClient*);
+    virtual void setDevToolsAgentClient(WebDevToolsAgentClient*);
+    virtual void setAutoFillClient(WebAutoFillClient*);
+    virtual void setSpellCheckClient(WebSpellCheckClient*);
     virtual WebSettings* settings();
     virtual WebString pageEncoding() const;
     virtual void setPageEncoding(const WebString& encoding);
@@ -154,7 +157,12 @@ public:
         WebDragOperation operation);
     virtual void dragSourceSystemDragEnded();
     virtual WebDragOperation dragTargetDragEnter(
-        const WebDragData& dragData, int identity,
+        const WebDragData&, int identity, // FIXME: remove identity from this function signature.
+        const WebPoint& clientPoint,
+        const WebPoint& screenPoint,
+        WebDragOperationsMask operationsAllowed);
+    virtual WebDragOperation dragTargetDragEnter(
+        const WebDragData&,
         const WebPoint& clientPoint,
         const WebPoint& screenPoint,
         WebDragOperationsMask operationsAllowed);
@@ -166,8 +174,6 @@ public:
     virtual void dragTargetDrop(
         const WebPoint& clientPoint,
         const WebPoint& screenPoint);
-    virtual int dragIdentity();
-    virtual bool setDropEffect(bool accept);
     virtual unsigned long createUniqueIdentifierForRequest();
     virtual void inspectElementAt(const WebPoint& point);
     virtual WebString inspectorSettings() const;
@@ -221,6 +227,11 @@ public:
         return m_autoFillClient;
     }
 
+    WebSpellCheckClient* spellCheckClient()
+    {
+        return m_spellCheckClient;
+    }
+
     // Returns the page object associated with this view. This may be null when
     // the page is shutting down, but will be valid at all other times.
     WebCore::Page* page() const
@@ -327,6 +338,7 @@ public:
 
 #if USE(ACCELERATED_COMPOSITING)
     bool allowsAcceleratedCompositing();
+    bool pageHasRTLStyle() const;
     void setRootGraphicsLayer(WebCore::PlatformLayer*);
     void setRootLayerNeedsDisplay();
     void scrollRootLayerRect(const WebCore::IntSize& scrollDelta, const WebCore::IntRect& clipRect);
@@ -361,7 +373,7 @@ private:
       DragOver
     };
 
-    WebViewImpl(WebViewClient*, WebDevToolsAgentClient*, WebAutoFillClient*);
+    WebViewImpl(WebViewClient*);
     ~WebViewImpl();
 
     // Returns true if the event was actually processed.
@@ -399,10 +411,12 @@ private:
     void doComposite();
     void doPixelReadbackToCanvas(WebCanvas*, const WebCore::IntRect&);
     void reallocateRenderer();
+    void updateLayerRendererViewport();
 #endif
 
     WebViewClient* m_client;
     WebAutoFillClient* m_autoFillClient;
+    WebSpellCheckClient* m_spellCheckClient;
 
     ChromeClientImpl m_chromeClientImpl;
     ContextMenuClientImpl m_contextMenuClientImpl;
@@ -467,22 +481,6 @@ private:
     // Represents whether or not this object should process incoming IME events.
     bool m_imeAcceptEvents;
 
-    // True while dispatching system drag and drop events to drag/drop targets
-    // within this WebView.
-    bool m_dragTargetDispatch;
-
-    // Valid when m_dragTargetDispatch is true; the identity of the drag data
-    // copied from the WebDropData object sent from the browser process.
-    int m_dragIdentity;
-
-    // Valid when m_dragTargetDispatch is true. Used to override the default
-    // browser drop effect with the effects "none" or "copy".
-    enum DragTargetDropEffect {
-        DropEffectDefault = -1,
-        DropEffectNone,
-        DropEffectCopy
-    } m_dropEffect;
-
     // The available drag operations (copy, move link...) allowed by the source.
     WebDragOperation m_operationsAllowed;
 
@@ -531,6 +529,8 @@ private:
     RefPtr<WebCore::LayerRendererChromium> m_layerRenderer;
     bool m_isAcceleratedCompositingActive;
     bool m_compositorCreationFailed;
+    // If true, the graphics context is being restored.
+    bool m_recreatingGraphicsContext;
 #endif
     static const WebInputEvent* m_currentInputEvent;
 
diff --git a/Source/WebKit/chromium/src/WebWorkerBase.cpp b/Source/WebKit/chromium/src/WebWorkerBase.cpp
index b16b6d4..0cd5f41 100644
--- a/Source/WebKit/chromium/src/WebWorkerBase.cpp
+++ b/Source/WebKit/chromium/src/WebWorkerBase.cpp
@@ -65,7 +65,7 @@ namespace {
 
 // This class is used to route the result of the WebWorkerBase::allowDatabase
 // call back to the worker context.
-class AllowDatabaseMainThreadBridge : public ThreadSafeShared<AllowDatabaseMainThreadBridge> {
+class AllowDatabaseMainThreadBridge : public ThreadSafeRefCounted<AllowDatabaseMainThreadBridge> {
 public:
     static PassRefPtr<AllowDatabaseMainThreadBridge> create(WebWorkerBase* worker, const WTF::String& mode, WebCommonWorkerClient* commonClient, WebFrame* frame, const WTF::String& name, const WTF::String& displayName, unsigned long estimatedSize)
     {
@@ -170,7 +170,7 @@ void WebWorkerBase::initializeLoader(const WebURL& url)
     // loading requests from the worker context to the rest of WebKit and Chromium
     // infrastructure.
     ASSERT(!m_webView);
-    m_webView = WebView::create(0, 0, 0);
+    m_webView = WebView::create(0);
     m_webView->settings()->setOfflineWebApplicationCacheEnabled(WebRuntimeFeatures::isApplicationCacheEnabled());
     m_webView->initializeMainFrame(this);
 
@@ -237,7 +237,7 @@ bool WebWorkerBase::allowDatabase(WebFrame*, const WebString& name, const WebStr
 }
 
 #if ENABLE(FILE_SYSTEM)
-void WebWorkerBase::openFileSystemForWorker(WebFileSystem::Type type, long long size, WebFileSystemCallbacks* callbacks, bool synchronous)
+void WebWorkerBase::openFileSystemForWorker(WebFileSystem::Type type, long long size, bool create, WebFileSystemCallbacks* callbacks, bool synchronous)
 {
     WorkerRunLoop& runLoop = m_workerThread->runLoop();
     WorkerScriptController* controller = WorkerScriptController::controllerForContext();
@@ -248,7 +248,7 @@ void WebWorkerBase::openFileSystemForWorker(WebFileSystem::Type type, long long
     mode.append(String::number(runLoop.createUniqueId()));
 
     RefPtr<WorkerFileSystemCallbacksBridge> bridge = WorkerFileSystemCallbacksBridge::create(this, workerContext, callbacks);
-    bridge->postOpenFileSystemToMainThread(commonClient(), type, size, mode);
+    bridge->postOpenFileSystemToMainThread(commonClient(), type, size, create, mode);
 
     if (synchronous) {
         if (runLoop.runInMode(workerContext, mode) == MessageQueueTerminated)
diff --git a/Source/WebKit/chromium/src/WebWorkerBase.h b/Source/WebKit/chromium/src/WebWorkerBase.h
index ec73505..8fb032e 100644
--- a/Source/WebKit/chromium/src/WebWorkerBase.h
+++ b/Source/WebKit/chromium/src/WebWorkerBase.h
@@ -92,7 +92,7 @@ public:
     virtual bool allowDatabase(WebFrame*, const WebString& name, const WebString& displayName, unsigned long estimatedSize);
 
 #if ENABLE(FILE_SYSTEM)
-    void openFileSystemForWorker(WebFileSystem::Type, long long size, WebFileSystemCallbacks*, bool synchronous);
+    void openFileSystemForWorker(WebFileSystem::Type, long long size, bool create, WebFileSystemCallbacks*, bool synchronous);
 #endif
 
     // Executes the given task on the main thread.
diff --git a/Source/WebKit/chromium/src/WorkerFileSystemCallbacksBridge.cpp b/Source/WebKit/chromium/src/WorkerFileSystemCallbacksBridge.cpp
index 6c31221..d05322f 100644
--- a/Source/WebKit/chromium/src/WorkerFileSystemCallbacksBridge.cpp
+++ b/Source/WebKit/chromium/src/WorkerFileSystemCallbacksBridge.cpp
@@ -57,6 +57,7 @@ template<> struct CrossThreadCopierBase<false, false, WebKit::WebFileInfo> {
         newInfo.modificationTime = info.modificationTime;
         newInfo.length = info.length;
         newInfo.type = info.type;
+        newInfo.platformPath.assign(info.platformPath.data(), info.platformPath.length());
         return newInfo;
     }
 };
@@ -85,7 +86,7 @@ namespace WebKit {
 class MainThreadFileSystemCallbacks : public WebFileSystemCallbacks {
 public:
     // Callbacks are self-destructed and we always return leaked pointer here.
-    static MainThreadFileSystemCallbacks* createLeakedPtr(PassRefPtr<WorkerFileSystemCallbacksBridge> bridge, const String& mode)
+    static MainThreadFileSystemCallbacks* createLeakedPtr(WorkerFileSystemCallbacksBridge* bridge, const String& mode)
     {
         OwnPtr<MainThreadFileSystemCallbacks> callbacks = adoptPtr(new MainThreadFileSystemCallbacks(bridge, mode));
         return callbacks.leakPtr();
@@ -126,15 +127,16 @@ public:
     }
 
 private:
-    MainThreadFileSystemCallbacks(PassRefPtr<WorkerFileSystemCallbacksBridge> bridge, const String& mode)
+    MainThreadFileSystemCallbacks(WorkerFileSystemCallbacksBridge* bridge, const String& mode)
         : m_bridge(bridge)
         , m_mode(mode)
     {
-        ASSERT(m_bridge.get());
+        ASSERT(m_bridge);
     }
 
     friend class WorkerFileSystemCallbacksBridge;
-    RefPtr<WorkerFileSystemCallbacksBridge> m_bridge;
+    // The bridge pointer is kept by the bridge itself on the WorkerThread.
+    WorkerFileSystemCallbacksBridge* m_bridge;
     const String m_mode;
 };
 
@@ -150,9 +152,9 @@ void WorkerFileSystemCallbacksBridge::stop()
     }
 }
 
-void WorkerFileSystemCallbacksBridge::postOpenFileSystemToMainThread(WebCommonWorkerClient* commonClient, WebFileSystem::Type type, long long size, const String& mode)
+void WorkerFileSystemCallbacksBridge::postOpenFileSystemToMainThread(WebCommonWorkerClient* commonClient, WebFileSystem::Type type, long long size, bool create, const String& mode)
 {
-    dispatchTaskToMainThread(createCallbackTask(&openFileSystemOnMainThread, commonClient, type, size, this, mode));
+    dispatchTaskToMainThread(createCallbackTask(&openFileSystemOnMainThread, commonClient, type, size, create, this, mode));
 }
 
 void WorkerFileSystemCallbacksBridge::postMoveToMainThread(WebFileSystem* fileSystem, const String& sourcePath, const String& destinationPath, const String& mode)
@@ -212,12 +214,12 @@ void WorkerFileSystemCallbacksBridge::postReadDirectoryToMainThread(WebFileSyste
     dispatchTaskToMainThread(createCallbackTask(&readDirectoryOnMainThread, fileSystem, path, this, mode));
 }
 
-void WorkerFileSystemCallbacksBridge::openFileSystemOnMainThread(ScriptExecutionContext*, WebCommonWorkerClient* commonClient, WebFileSystem::Type type, long long size, WorkerFileSystemCallbacksBridge* bridge, const String& mode)
+void WorkerFileSystemCallbacksBridge::openFileSystemOnMainThread(ScriptExecutionContext*, WebCommonWorkerClient* commonClient, WebFileSystem::Type type, long long size, bool create, WorkerFileSystemCallbacksBridge* bridge, const String& mode)
 {
     if (!commonClient)
         bridge->didFailOnMainThread(WebFileErrorAbort, mode);
     else {
-        commonClient->openFileSystem(type, size, MainThreadFileSystemCallbacks::createLeakedPtr(bridge, mode));
+        commonClient->openFileSystem(type, size, create, MainThreadFileSystemCallbacks::createLeakedPtr(bridge, mode));
     }
 }
 
@@ -365,6 +367,7 @@ void WorkerFileSystemCallbacksBridge::runTaskOnWorkerThread(WebCore::ScriptExecu
     ASSERT(bridge->m_workerContext->isContextThread());
     taskToRun->performTask(scriptExecutionContext);
     bridge->m_callbacksOnWorkerThread = 0;
+    bridge->stopObserving();
 }
 
 void WorkerFileSystemCallbacksBridge::dispatchTaskToMainThread(PassOwnPtr<WebCore::ScriptExecutionContext::Task> task)
@@ -379,12 +382,9 @@ void WorkerFileSystemCallbacksBridge::dispatchTaskToMainThread(PassOwnPtr<WebCor
 void WorkerFileSystemCallbacksBridge::mayPostTaskToWorker(PassOwnPtr<ScriptExecutionContext::Task> task, const String& mode)
 {
     ASSERT(isMainThread());
-    { // Let go of the mutex before possibly deleting this due to m_selfRef.clear().
-        MutexLocker locker(m_mutex);
-        if (m_worker)
-            m_worker->postTaskForModeToWorkerContext(createCallbackTask(&runTaskOnWorkerThread, m_selfRef, task), mode);
-    }
-    m_selfRef.clear();
+    MutexLocker locker(m_mutex);
+    if (m_worker)
+        m_worker->postTaskForModeToWorkerContext(createCallbackTask(&runTaskOnWorkerThread, m_selfRef.release(), task), mode);
 }
 
 } // namespace WebCore
diff --git a/Source/WebKit/chromium/src/WorkerFileSystemCallbacksBridge.h b/Source/WebKit/chromium/src/WorkerFileSystemCallbacksBridge.h
index fa57f38..9a869dc 100644
--- a/Source/WebKit/chromium/src/WorkerFileSystemCallbacksBridge.h
+++ b/Source/WebKit/chromium/src/WorkerFileSystemCallbacksBridge.h
@@ -66,7 +66,7 @@ struct WebFileSystemEntry;
 //  --> Bridge::didXxxOnWorkerThread is called on WorkerThread
 //      This calls the original callbacks (m_callbacksOnWorkerThread) and
 //      releases a self-reference to the bridge.
-class WorkerFileSystemCallbacksBridge : public ThreadSafeShared<WorkerFileSystemCallbacksBridge>, public WebCore::WorkerContext::Observer {
+class WorkerFileSystemCallbacksBridge : public ThreadSafeRefCounted<WorkerFileSystemCallbacksBridge>, public WebCore::WorkerContext::Observer {
 public:
     ~WorkerFileSystemCallbacksBridge();
 
@@ -84,7 +84,7 @@ public:
     }
 
     // Methods that create an instance and post an initial request task to the main thread. They must be called on the worker thread.
-    void postOpenFileSystemToMainThread(WebCommonWorkerClient*, WebFileSystem::Type, long long size, const String& mode);
+    void postOpenFileSystemToMainThread(WebCommonWorkerClient*, WebFileSystem::Type, long long size, bool create, const String& mode);
     void postMoveToMainThread(WebFileSystem*, const String& srcPath, const String& destPath, const String& mode);
     void postCopyToMainThread(WebFileSystem*, const String& srcPath, const String& destPath, const String& mode);
     void postRemoveToMainThread(WebFileSystem*, const String& path, const String& mode);
@@ -107,7 +107,7 @@ private:
     WorkerFileSystemCallbacksBridge(WebWorkerBase*, WebCore::ScriptExecutionContext*, WebFileSystemCallbacks*);
 
     // Methods that are to be called on the main thread.
-    static void openFileSystemOnMainThread(WebCore::ScriptExecutionContext*, WebCommonWorkerClient*, WebFileSystem::Type, long long size, WorkerFileSystemCallbacksBridge*, const String& mode);
+    static void openFileSystemOnMainThread(WebCore::ScriptExecutionContext*, WebCommonWorkerClient*, WebFileSystem::Type, long long size, bool create, WorkerFileSystemCallbacksBridge*, const String& mode);
     static void moveOnMainThread(WebCore::ScriptExecutionContext*, WebFileSystem*, const String& srcPath, const String& destPath, WorkerFileSystemCallbacksBridge*, const String& mode);
     static void copyOnMainThread(WebCore::ScriptExecutionContext*, WebFileSystem*, const String& srcPath, const String& destPath, WorkerFileSystemCallbacksBridge*, const String& mode);
     static void removeOnMainThread(WebCore::ScriptExecutionContext*, WebFileSystem*, const String& path, WorkerFileSystemCallbacksBridge*, const String& mode);
@@ -138,7 +138,7 @@ private:
     void dispatchTaskToMainThread(PassOwnPtr<WebCore::ScriptExecutionContext::Task>);
     void mayPostTaskToWorker(PassOwnPtr<WebCore::ScriptExecutionContext::Task>, const String& mode);
 
-    // m_selfRef keeps a reference to itself until a task is created for the worker thread (at which point the task holds the reference).
+    // m_selfRef keeps a reference to itself while there's a pending callback on the main thread.
     RefPtr<WorkerFileSystemCallbacksBridge> m_selfRef;
 
     Mutex m_mutex;
diff --git a/Source/WebKit/chromium/src/WorkerFileWriterCallbacksBridge.h b/Source/WebKit/chromium/src/WorkerFileWriterCallbacksBridge.h
index 62e333c..7e9795e 100644
--- a/Source/WebKit/chromium/src/WorkerFileWriterCallbacksBridge.h
+++ b/Source/WebKit/chromium/src/WorkerFileWriterCallbacksBridge.h
@@ -38,7 +38,7 @@
 #include "WorkerContext.h"
 #include <wtf/PassOwnPtr.h>
 #include <wtf/PassRefPtr.h>
-#include <wtf/ThreadSafeShared.h>
+#include <wtf/ThreadSafeRefCounted.h>
 
 namespace WebCore {
     class AsyncFileWriterClient;
@@ -79,7 +79,7 @@ class WebWorkerBase;
 // should call postShutdownToMainThread before dropping its reference to the
 // bridge. This ensures that the WebFileWriter will be cleared on the main
 // thread and that no further calls to the WebFileWriterClient will be made.
-class WorkerFileWriterCallbacksBridge : public ThreadSafeShared<WorkerFileWriterCallbacksBridge>, public WebCore::WorkerContext::Observer, public WebFileWriterClient {
+class WorkerFileWriterCallbacksBridge : public ThreadSafeRefCounted<WorkerFileWriterCallbacksBridge>, public WebCore::WorkerContext::Observer, public WebFileWriterClient {
 public:
     ~WorkerFileWriterCallbacksBridge();
 
diff --git a/Source/WebKit/chromium/src/js/DevTools.js b/Source/WebKit/chromium/src/js/DevTools.js
index 03c72d2..7a3eb8d 100644
--- a/Source/WebKit/chromium/src/js/DevTools.js
+++ b/Source/WebKit/chromium/src/js/DevTools.js
@@ -48,7 +48,6 @@ var context = {};  // Used by WebCore's inspector routines.
     Preferences.onlineDetectionEnabled = false;
     Preferences.nativeInstrumentationEnabled = true;
     Preferences.fileSystemEnabled = false;
-    Preferences.resourceExportEnabled = true;
     Preferences.showTimingTab = true;
     Preferences.showCookiesTab = true;
 })();
diff --git a/Source/WebKit/chromium/src/js/Images/segmentChromium.png b/Source/WebKit/chromium/src/js/Images/segmentChromium.png
index f4248e1..a636820 100755
--- a/Source/WebKit/chromium/src/js/Images/segmentChromium.png
+++ b/Source/WebKit/chromium/src/js/Images/segmentChromium.png
diff --git a/Source/WebKit/chromium/src/js/Images/segmentHoverChromium.png b/Source/WebKit/chromium/src/js/Images/segmentHoverChromium.png
index 0a743d9..0510773 100755
--- a/Source/WebKit/chromium/src/js/Images/segmentHoverChromium.png
+++ b/Source/WebKit/chromium/src/js/Images/segmentHoverChromium.png
diff --git a/Source/WebKit/chromium/src/js/Images/segmentHoverEndChromium.png b/Source/WebKit/chromium/src/js/Images/segmentHoverEndChromium.png
index cf62072..91be9db 100755
--- a/Source/WebKit/chromium/src/js/Images/segmentHoverEndChromium.png
+++ b/Source/WebKit/chromium/src/js/Images/segmentHoverEndChromium.png
diff --git a/Source/WebKit/chromium/src/js/Images/segmentSelectedChromium.png b/Source/WebKit/chromium/src/js/Images/segmentSelectedChromium.png
index a1f7251..9df447b 100755
--- a/Source/WebKit/chromium/src/js/Images/segmentSelectedChromium.png
+++ b/Source/WebKit/chromium/src/js/Images/segmentSelectedChromium.png
diff --git a/Source/WebKit/chromium/src/js/Images/segmentSelectedEndChromium.png b/Source/WebKit/chromium/src/js/Images/segmentSelectedEndChromium.png
index 07641db..abe8db8 100755
--- a/Source/WebKit/chromium/src/js/Images/segmentSelectedEndChromium.png
+++ b/Source/WebKit/chromium/src/js/Images/segmentSelectedEndChromium.png
diff --git a/Source/WebKit/chromium/src/js/Images/statusbarBackgroundChromium.png b/Source/WebKit/chromium/src/js/Images/statusbarBackgroundChromium.png
index 7a760c1..b5a780f 100755
--- a/Source/WebKit/chromium/src/js/Images/statusbarBackgroundChromium.png
+++ b/Source/WebKit/chromium/src/js/Images/statusbarBackgroundChromium.png
diff --git a/Source/WebKit/chromium/src/js/Images/statusbarBottomBackgroundChromium.png b/Source/WebKit/chromium/src/js/Images/statusbarBottomBackgroundChromium.png
index e3bc944..531a3ef 100755
--- a/Source/WebKit/chromium/src/js/Images/statusbarBottomBackgroundChromium.png
+++ b/Source/WebKit/chromium/src/js/Images/statusbarBottomBackgroundChromium.png
diff --git a/Source/WebKit/chromium/src/js/Images/statusbarMenuButtonChromium.png b/Source/WebKit/chromium/src/js/Images/statusbarMenuButtonChromium.png
index 5ff61d9..c8fbd45 100755
--- a/Source/WebKit/chromium/src/js/Images/statusbarMenuButtonChromium.png
+++ b/Source/WebKit/chromium/src/js/Images/statusbarMenuButtonChromium.png
diff --git a/Source/WebKit/chromium/src/js/Images/statusbarMenuButtonSelectedChromium.png b/Source/WebKit/chromium/src/js/Images/statusbarMenuButtonSelectedChromium.png
index 3c0aeec..668070d 100755
--- a/Source/WebKit/chromium/src/js/Images/statusbarMenuButtonSelectedChromium.png
+++ b/Source/WebKit/chromium/src/js/Images/statusbarMenuButtonSelectedChromium.png
diff --git a/Source/WebKit/chromium/tests/PopupMenuTest.cpp b/Source/WebKit/chromium/tests/PopupMenuTest.cpp
index acfcda5..8c53ffc 100644
--- a/Source/WebKit/chromium/tests/PopupMenuTest.cpp
+++ b/Source/WebKit/chromium/tests/PopupMenuTest.cpp
@@ -181,7 +181,7 @@ public:
 protected:
     virtual void SetUp()
     {
-        m_webView = static_cast<WebViewImpl*>(WebView::create(&m_webviewClient, 0, 0));
+        m_webView = static_cast<WebViewImpl*>(WebView::create(&m_webviewClient));
         m_webView->initializeMainFrame(&m_webFrameClient);
         m_popupMenu = adoptRef(new PopupMenuChromium(&m_popupMenuClient));
     }
diff --git a/Source/WebKit/chromium/tests/TilingDataTest.cpp b/Source/WebKit/chromium/tests/TilingDataTest.cpp
index ec18f01..a41f7fe 100755
--- a/Source/WebKit/chromium/tests/TilingDataTest.cpp
+++ b/Source/WebKit/chromium/tests/TilingDataTest.cpp
@@ -331,4 +331,56 @@ TEST(TilingDataTest, tileSizeY_and_tilePositionY)
     EXPECT_EQ(4, TilingData(3, 100, 6, true).tilePositionY(3));
 }
 
+TEST(TilingDataTest, setTotalSize)
+{
+    TilingData data(5, 5, 5, false);
+    EXPECT_EQ(5, data.totalSizeX());
+    EXPECT_EQ(5, data.totalSizeY());
+    EXPECT_EQ(1, data.numTilesX());
+    EXPECT_EQ(5, data.tileSizeX(0));
+    EXPECT_EQ(1, data.numTilesY());
+    EXPECT_EQ(5, data.tileSizeY(0));
+
+    data.setTotalSize(6, 5);
+    EXPECT_EQ(6, data.totalSizeX());
+    EXPECT_EQ(5, data.totalSizeY());
+    EXPECT_EQ(2, data.numTilesX());
+    EXPECT_EQ(5, data.tileSizeX(0));
+    EXPECT_EQ(1, data.tileSizeX(1));
+    EXPECT_EQ(1, data.numTilesY());
+    EXPECT_EQ(5, data.tileSizeY(0));
+
+    data.setTotalSize(5, 12);
+    EXPECT_EQ(5, data.totalSizeX());
+    EXPECT_EQ(12, data.totalSizeY());
+    EXPECT_EQ(1, data.numTilesX());
+    EXPECT_EQ(5, data.tileSizeX(0));
+    EXPECT_EQ(3, data.numTilesY());
+    EXPECT_EQ(5, data.tileSizeY(0));
+    EXPECT_EQ(5, data.tileSizeY(1));
+    EXPECT_EQ(2, data.tileSizeY(2));
+}
+
+TEST(TilingDataTest, setMaxTextureSize)
+{
+    TilingData data(8, 16, 32, false);
+    EXPECT_EQ(2, data.numTilesX());
+    EXPECT_EQ(4, data.numTilesY());
+
+    data.setMaxTextureSize(32);
+    EXPECT_EQ(32, data.maxTextureSize());
+    EXPECT_EQ(1, data.numTilesX());
+    EXPECT_EQ(1, data.numTilesY());
+
+    data.setMaxTextureSize(2);
+    EXPECT_EQ(2, data.maxTextureSize());
+    EXPECT_EQ(8, data.numTilesX());
+    EXPECT_EQ(16, data.numTilesY());
+
+    data.setMaxTextureSize(5);
+    EXPECT_EQ(5, data.maxTextureSize());
+    EXPECT_EQ(4, data.numTilesX());
+    EXPECT_EQ(7, data.numTilesY());
+}
+
 } // namespace
diff --git a/Source/WebKit/chromium/tests/WebFrameTest.cpp b/Source/WebKit/chromium/tests/WebFrameTest.cpp
index 7342721..891fa83 100644
--- a/Source/WebKit/chromium/tests/WebFrameTest.cpp
+++ b/Source/WebKit/chromium/tests/WebFrameTest.cpp
@@ -28,6 +28,8 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
+#include "config.h"
+
 #include <googleurl/src/gurl.h>
 #include <gtest/gtest.h>
 #include <webkit/support/webkit_support.h>
@@ -85,7 +87,7 @@ TEST_F(WebFrameTest, ContentText)
 
     // Create and initialize the WebView.    
     TestWebFrameClient webFrameClient;
-    WebView* webView = WebView::create(0, 0, 0);
+    WebView* webView = WebView::create(0);
     webView->initializeMainFrame(&webFrameClient);
 
     // Load the main frame URL.
diff --git a/Source/WebKit/chromium/tests/WebPageSerializerTest.cpp b/Source/WebKit/chromium/tests/WebPageSerializerTest.cpp
new file mode 100644
index 0000000..1416882
--- /dev/null
+++ b/Source/WebKit/chromium/tests/WebPageSerializerTest.cpp
@@ -0,0 +1,193 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WebPageSerializer.h"
+
+#include "WebFrame.h"
+#include "WebFrameClient.h"
+#include "WebString.h"
+#include "WebURL.h"
+#include "WebURLRequest.h"
+#include "WebURLResponse.h"
+#include "WebView.h"
+
+#include <googleurl/src/gurl.h>
+#include <gtest/gtest.h>
+#include <webkit/support/webkit_support.h>
+
+using namespace WebKit;
+
+namespace {
+
+class TestWebFrameClient : public WebFrameClient {
+};
+
+class WebPageSerializerTest : public testing::Test {
+public:
+    WebPageSerializerTest() : m_webView(0), m_supportedSchemes(3U)
+    {
+        m_supportedSchemes[0] = "http";
+        m_supportedSchemes[1] = "https";
+        m_supportedSchemes[2] = "file";
+    }
+
+protected:
+    virtual void SetUp()
+    {
+        // Create and initialize the WebView.
+        m_webView = WebView::create(0);
+        m_webView->initializeMainFrame(&m_webFrameClient);
+    }
+
+    virtual void TearDown()
+    {
+        webkit_support::UnregisterAllMockedURLs();
+        m_webView->close();
+    }
+
+    void registerMockedURLLoad(const WebURL& url, const WebString& fileName)
+    {
+        WebURLResponse response;
+        response.initialize();
+        response.setMIMEType("text/html");
+        std::string filePath = webkit_support::GetWebKitRootDir().utf8();
+        filePath.append("/Source/WebKit/chromium/tests/data/pageserialization/");
+        filePath.append(fileName.utf8());
+        webkit_support::RegisterMockedURL(url, response, WebString::fromUTF8(filePath));
+    }
+
+    void loadURLInTopFrame(const GURL& url)
+    {
+        WebURLRequest urlRequest;
+        urlRequest.initialize();
+        urlRequest.setURL(WebURL(url));
+        m_webView->mainFrame()->loadRequest(urlRequest);
+        // Make sure any pending request get served.
+        webkit_support::ServeAsynchronousMockedRequests();
+    }
+
+    static bool webVectorContains(const WebVector<WebURL>& vector, char* url)
+    {
+        return vector.contains(WebURL(GURL(url)));
+    }
+
+    // Useful for debugging.
+    static void printWebURLs(const WebVector<WebURL>& urls)
+    {
+        for (size_t i = 0; i < urls.size(); i++)
+            printf("%s\n", urls[i].spec().data());
+    }
+
+    WebView* m_webView;
+    WebVector<WebCString> m_supportedSchemes;
+
+private:
+    TestWebFrameClient m_webFrameClient;
+};
+
+TEST_F(WebPageSerializerTest, HTMLNodes)
+{
+    // Register the mocked frame and load it.
+    WebURL topFrameURL = GURL("http://www.test.com");
+    registerMockedURLLoad(topFrameURL, WebString::fromUTF8("simple_page.html"));
+    loadURLInTopFrame(topFrameURL);
+
+    // Retrieve all resources.
+    WebVector<WebURL> frames;
+    WebVector<WebURL> resources;
+    ASSERT_TRUE(WebPageSerializer::retrieveAllResources(
+        m_webView, m_supportedSchemes, &resources, &frames));    
+
+    // Tests that all resources from the frame have been retrieved.
+    EXPECT_EQ(1, frames.size()); // There should be no duplicates.
+    EXPECT_TRUE(webVectorContains(frames, "http://www.test.com"));
+
+    EXPECT_EQ(14, resources.size()); // There should be no duplicates.
+    EXPECT_TRUE(webVectorContains(resources, "http://www.example.com/beautifull.css"));
+    EXPECT_TRUE(webVectorContains(resources, "http://www.test.com/awesome.js"));
+    EXPECT_TRUE(webVectorContains(resources, "http://www.test.com/bodyBackground.jpg"));
+    EXPECT_TRUE(webVectorContains(resources, "http://www.test.com/awesome.png"));
+    EXPECT_TRUE(webVectorContains(resources, "http://www.test.com/imageButton.png"));
+    EXPECT_TRUE(webVectorContains(resources, "http://www.test.com/tableBackground.png"));
+    EXPECT_TRUE(webVectorContains(resources, "http://www.test.com/trBackground.png"));
+    EXPECT_TRUE(webVectorContains(resources, "http://www.test.com/tdBackground.png"));
+    EXPECT_TRUE(webVectorContains(resources, "http://www.evene.fr/citations/auteur.php?ida=46"));
+    EXPECT_TRUE(webVectorContains(resources, "http://www.brainyquote.com/quotes/authors/c/charles_darwin.html"));
+    EXPECT_TRUE(webVectorContains(resources, "http://www.test.com/why_deleted.html"));
+    EXPECT_TRUE(webVectorContains(resources, "http://www.test.com/why_inserted.html"));
+    EXPECT_TRUE(webVectorContains(resources, "https://www.secure.com/https.gif"));
+    EXPECT_TRUE(webVectorContains(resources, "file://c/my_folder/file.gif"));
+}
+
+TEST_F(WebPageSerializerTest, MultipleFrames)
+{
+    // Register the mocked frames.
+    WebURL topFrameURL = GURL("http://www.test.com");
+    registerMockedURLLoad(topFrameURL, WebString::fromUTF8("top_frame.html"));
+    registerMockedURLLoad(GURL("http://www.test.com/simple_iframe.html"),
+                          WebString::fromUTF8("simple_iframe.html"));
+    registerMockedURLLoad(GURL("http://www.test.com/object_iframe.html"),
+                          WebString::fromUTF8("object_iframe.html"));
+    registerMockedURLLoad(GURL("http://www.test.com/embed_iframe.html"),
+                          WebString::fromUTF8("embed_iframe.html"));
+    // If we don't register a mocked resource for awesome.png, it causes the
+    // document loader of the iframe that has it as its src to assert on close,
+    // not sure why.
+    registerMockedURLLoad(GURL("http://www.test.com/awesome.png"),
+                          WebString::fromUTF8("awesome.png"));
+
+    loadURLInTopFrame(topFrameURL);
+
+    // Retrieve all resources.
+    WebVector<WebURL> frames;
+    WebVector<WebURL> resources;
+    ASSERT_TRUE(WebPageSerializer::retrieveAllResources(
+        m_webView, m_supportedSchemes, &resources, &frames));    
+
+    // Tests that all resources from the frame have been retrieved.
+    EXPECT_EQ(4, frames.size()); // There should be no duplicates.
+    EXPECT_TRUE(webVectorContains(frames, "http://www.test.com"));
+    EXPECT_TRUE(webVectorContains(frames, "http://www.test.com/simple_iframe.html"));
+    EXPECT_TRUE(webVectorContains(frames, "http://www.test.com/object_iframe.html"));
+    EXPECT_TRUE(webVectorContains(frames, "http://www.test.com/embed_iframe.html"));
+
+    EXPECT_EQ(5, resources.size()); // There should be no duplicates.
+    EXPECT_TRUE(webVectorContains(resources, "http://www.test.com/awesome.png"));
+    EXPECT_TRUE(webVectorContains(resources, "http://www.test.com/innerFrame.png"));
+    EXPECT_TRUE(webVectorContains(resources, "http://www.test.com/flash.swf"));
+    // FIXME: for some reason the following resources is missing on one of the bot
+    //        causing the test to fail. Probably a plugin issue.
+    // EXPECT_TRUE(webVectorContains(resources, "http://www.test.com/music.mid"));
+    EXPECT_TRUE(webVectorContains(resources, "http://www.test.com/object.png"));
+    EXPECT_TRUE(webVectorContains(resources, "http://www.test.com/embed.png"));
+}
+
+}
diff --git a/Source/WebKit/chromium/tests/data/pageserialization/awesome.png b/Source/WebKit/chromium/tests/data/pageserialization/awesome.png
new file mode 100644
index 0000000..8b13789
--- /dev/null
+++ b/Source/WebKit/chromium/tests/data/pageserialization/awesome.png
@@ -0,0 +1 @@
+
diff --git a/Source/WebKit/chromium/tests/data/pageserialization/embed_iframe.html b/Source/WebKit/chromium/tests/data/pageserialization/embed_iframe.html
new file mode 100644
index 0000000..174a8a9
--- /dev/null
+++ b/Source/WebKit/chromium/tests/data/pageserialization/embed_iframe.html
@@ -0,0 +1,5 @@
+<html>
+
+<img src="embed.png"/>
+
+</html>
diff --git a/Source/WebKit/chromium/tests/data/pageserialization/object_iframe.html b/Source/WebKit/chromium/tests/data/pageserialization/object_iframe.html
new file mode 100644
index 0000000..662bc5f
--- /dev/null
+++ b/Source/WebKit/chromium/tests/data/pageserialization/object_iframe.html
@@ -0,0 +1,5 @@
+<html>
+
+<img src="object.png"/>
+
+</html>
diff --git a/Source/WebKit/chromium/tests/data/pageserialization/simple_iframe.html b/Source/WebKit/chromium/tests/data/pageserialization/simple_iframe.html
new file mode 100644
index 0000000..65dca17
--- /dev/null
+++ b/Source/WebKit/chromium/tests/data/pageserialization/simple_iframe.html
@@ -0,0 +1,14 @@
+<html>
+<!--
+    This page is used to test that WebPageSerializer::retrieveAllResources retrieves
+    correctly the expected resources when dealing with multiple frames. 
+-->
+
+<body>
+
+<img src="awesome.png"/>
+<img src="innerFrame.png"/>
+
+</body>
+
+</html>
diff --git a/Source/WebKit/chromium/tests/data/pageserialization/simple_page.html b/Source/WebKit/chromium/tests/data/pageserialization/simple_page.html
new file mode 100644
index 0000000..66d09e1
--- /dev/null
+++ b/Source/WebKit/chromium/tests/data/pageserialization/simple_page.html
@@ -0,0 +1,50 @@
+<html>
+<!--
+    This page is used to test that WebPageSerializer::retrieveAllResources retrieves
+    correctly the expected resources from various HTML nodes.
+-->
+
+<head>
+<!-- Style sheet links should be retrieved -->
+<link rel="stylesheet" type="text/css" href="http://www.example.com/beautifull.css"/>
+<!-- Other link should NOT be retrieved -->
+<link rel="copyright" type="text/plain" href="http://www.example.com/copyright"/>
+<!-- Scripts should be retrieved -->
+<script src="awesome.js"></script>
+</head>
+
+<!-- Images are always retrieved -->
+<body background="bodyBackground.jpg">
+
+<!-- Twice to make sure we only report each resource once -->
+<img src="awesome.png"/>
+<img src="awesome.png"/>
+
+<form>
+  <input type="image" src="imageButton.png"/>
+</form>
+
+<table background="tableBackground.png">
+  <tr background="trBackground.png">
+    <td background="tdBackground.png"></td>
+  </tr>  
+  <tr background="trBackground.png">
+    <td background="tdBackground.png"></td>
+  </tr>
+</table>
+
+<!-- Some more obscure tags -->
+<blockquote cite="http://www.evene.fr/citations/auteur.php?ida=46"></blockquote>
+<q CITE="http://www.brainyquote.com/quotes/authors/c/charles_darwin.html"></q>
+<p>My favorite color is <del cite="why_deleted.html">blue</del> <ins>red</ins>!</p>
+<p>My favorite color is <del>blue</del> <ins cite="why_inserted.html">red</ins>!</p>
+
+<!-- Make sure we only retrieve URLs with the right schemes -->
+<img src="https://www.secure.com/https.gif"/>  <!-- HTTPS is OK -->
+<img src="file://c/my_folder/file.gif"/>  <!-- file is OK -->
+<img src="ftp://ftp.com/ftp.gif"/>  <!-- FTP is not OK -->
+<img src="unknown://unkown.com/unknown.gif"/>  <!-- Unknown schemes are not OK -->
+
+</body>
+
+</html>
diff --git a/Source/WebKit/chromium/tests/data/pageserialization/top_frame.html b/Source/WebKit/chromium/tests/data/pageserialization/top_frame.html
new file mode 100755
index 0000000..edc8ab2
--- /dev/null
+++ b/Source/WebKit/chromium/tests/data/pageserialization/top_frame.html
@@ -0,0 +1,28 @@
+<html>
+<!--
+    This page is used to test that WebPageSerializer::retrieveAllResources retrieves
+    correctly the expected resources when dealing with multiple frames. 
+-->
+
+<body>
+
+<!-- Resources used by a frame and a tag should be only reported once -->
+<iframe src="awesome.png"></iframe>
+<img src="awesome.png"/>
+
+<iframe src="simple_iframe.html"></iframe>
+<iframe src="simple_iframe.html"></iframe>
+
+<!-- Object tags can be used to create iframes -->
+
+<object data="object_iframe.html"></object>
+<object data="flash.swf"></object>
+
+<!-- Embed tags can be used to create iframes as well -->
+<embed src="embed_iframe.html"></object>
+<!--
+<embed src="music.mid"></embed>
+-->
+</body>
+
+</html>
diff --git a/Source/WebKit/efl/ChangeLog b/Source/WebKit/efl/ChangeLog
index a781c80..35da09c 100644
--- a/Source/WebKit/efl/ChangeLog
+++ b/Source/WebKit/efl/ChangeLog
@@ -1,3 +1,263 @@
+2011-03-29  Gyuyoung Kim  <gyuyoung.kim@samsung.com>
+
+        Reviewed by Antonio Gomes.
+
+        [EFL] Remove unnecessary ewk_view_viewport_attributes_set() invocation
+        https://bugs.webkit.org/show_bug.cgi?id=57222
+
+        WebCore sends viewport signal whenever viewport is changed by Page::updateViewportArguments().
+        Thus, we don't need to call ewk_view_viewport_attributes_set() with dummy viewport data
+        anymore.
+
+        * WebCoreSupport/FrameLoaderClientEfl.cpp:
+        (WebCore::FrameLoaderClientEfl::dispatchDidCommitLoad):
+
+2011-03-27  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Andreas Kling.
+
+        Fix agentOS() in FrameLoaderClientEfl
+        https://bugs.webkit.org/show_bug.cgi?id=57177
+
+        Replace old PLATFORM macro with OS and CPU.
+
+        * WebCoreSupport/FrameLoaderClientEfl.cpp:
+        (WebCore::agentOS):
+
+2011-03-27  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Andreas Kling.
+
+        [EFL] Use an appropriate user agent string
+        https://bugs.webkit.org/show_bug.cgi?id=57176
+
+        * WebCoreSupport/FrameLoaderClientEfl.cpp:
+        (WebCore::composeUserAgent):
+
+2011-03-25  Andy Estes  <aestes@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        REGRESSION (r70748): latest nightly builds kills AC_QuickTime.js
+        https://bugs.webkit.org/show_bug.cgi?id=49016
+
+        Update objectContentType() implementation to handle the
+        shouldPreferPlugInsForImages flag.
+
+        * WebCoreSupport/FrameLoaderClientEfl.cpp:
+        (WebCore::FrameLoaderClientEfl::objectContentType):
+        * WebCoreSupport/FrameLoaderClientEfl.h:
+
+2011-03-24  Gyuyoung Kim  <gyuyoung.kim@samsung.com>
+
+        Reviewed by Antonio Gomes.
+
+        [EFL] Add sound / mute button to MediaControl UI
+        https://bugs.webkit.org/show_bug.cgi?id=56726
+
+        Add sound / mute button to MediaControl UI.
+
+        * DefaultTheme/default.edc:
+        * DefaultTheme/widget/mediacontrol/mutebutton/mute_button.edc: Added.
+        * DefaultTheme/widget/mediacontrol/mutebutton/mutebutton.png: Added.
+        * DefaultTheme/widget/mediacontrol/mutebutton/unmutebutton.png: Added.
+
+2011-03-24  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r81916 and r81917.
+        http://trac.webkit.org/changeset/81916
+        http://trac.webkit.org/changeset/81917
+        https://bugs.webkit.org/show_bug.cgi?id=57071
+
+        broke a test on platforms that do not have QuickTime installed
+        (Requested by estes on #webkit).
+
+        * WebCoreSupport/FrameLoaderClientEfl.cpp:
+        (WebCore::FrameLoaderClientEfl::objectContentType):
+        * WebCoreSupport/FrameLoaderClientEfl.h:
+
+2011-03-24  Andy Estes  <aestes@apple.com>
+
+        Reviewed by Darin Adler.
+
+        REGRESSION (r70748): latest nightly builds kills AC_QuickTime.js
+        https://bugs.webkit.org/show_bug.cgi?id=49016
+
+        Update objectContentType() implementation to handle the
+        shouldPreferPlugInsForImages flag.
+
+        * WebCoreSupport/FrameLoaderClientEfl.cpp:
+        (WebCore::FrameLoaderClientEfl::objectContentType):
+        * WebCoreSupport/FrameLoaderClientEfl.h:
+
+2011-03-23  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Change IconDatabase opening to allow for arbitrary filenames
+        https://bugs.webkit.org/show_bug.cgi?id=56977
+
+        * ewk/ewk_settings.cpp:
+        (ewk_settings_icon_database_path_set):
+
+2011-03-23  Gyuyoung Kim  <gyuyoung.kim@samsung.com>
+
+        Reviewed by Antonio Gomes.
+
+        [EFL] Add play / pause button to media control
+        https://bugs.webkit.org/show_bug.cgi?id=55463
+
+        Add play|pause button to media control.
+
+        * DefaultTheme/default.edc:
+        * DefaultTheme/widget/mediacontrol/playpausebutton/pausebutton.png: Added.
+        * DefaultTheme/widget/mediacontrol/playpausebutton/playbutton.png: Added.
+        * DefaultTheme/widget/mediacontrol/playpausebutton/playpause_button.edc: Added.
+
+2011-03-22  Gyuyoung Kim  <gyuyoung.kim@samsung.com>
+
+        Reviewed by Antonio Gomes.
+
+        [EFL] Change return values with better one in ewk_setting's functions
+        https://bugs.webkit.org/show_bug.cgi?id=56819
+
+        In ewk_settings_cache_directory_path_set_xxx, they return false value
+        when soup is disabled. It is better to use EINA_SAFETY_ON_TRUE_RETURN_XXX.
+
+        * ewk/ewk_settings.cpp:
+        (ewk_settings_proxy_uri_get):
+        (ewk_settings_cache_directory_path_set):
+        (ewk_settings_cache_directory_path_get):
+
+2011-03-22  Grzegorz Czajkowski  <g.czajkowski@samsung.com>
+
+        Reviewed by Kent Tamura.
+
+        Add void to function without parameters
+        https://bugs.webkit.org/show_bug.cgi?id=56821
+
+        * ewk/ewk_cookies.cpp:
+        (ewk_cookies_clear):
+        (ewk_cookies_policy_get):
+        * ewk/ewk_cookies.h:
+        * ewk/ewk_private.h:
+        * ewk/ewk_settings.cpp:
+        (ewk_settings_web_database_default_quota_get):
+        (ewk_settings_web_database_path_get):
+        (ewk_settings_proxy_uri_get):
+        (ewk_settings_default_user_agent_get):
+        * ewk/ewk_settings.h:
+        * ewk/ewk_view.cpp:
+        (ewk_view_dpi_get):
+
+2011-03-17  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=56425
+        More groundwork for WebKit2 IconDatabase
+
+        Update already-used function names:
+        * ewk/ewk_history.cpp:
+        (ewk_history_item_icon_surface_get):
+        (ewk_history_item_icon_object_add):
+        * ewk/ewk_settings.cpp:
+        (ewk_settings_icon_database_icon_surface_get):
+        (ewk_settings_icon_database_icon_object_add):
+
+2011-03-16  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Viewport no longer allows an auto value for "user-scalable"
+        https://bugs.webkit.org/show_bug.cgi?id=55416
+
+        Make the default value for userScalable be true.
+
+        * ewk/ewk_view.cpp:
+        (ewk_view_viewport_attributes_get):
+
+2011-03-14  Brady Eidson  <beidson@apple.com>
+
+        Try to fix the EFL build-bustage that their EWS bot did not see, but their core-builder did.  (sigh)
+
+        * ewk/ewk_history.cpp:
+        (ewk_history_item_icon_surface_get):
+        (ewk_history_item_icon_object_add):
+
+2011-03-14  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=56320
+        Remove HistoryItem::icon() and the WebCore dependency on "IconDatabaseBase::defaultIcon()"
+
+        * ewk/ewk_history.cpp:
+        (ewk_history_item_icon_surface_get): Use IconDatabase directly.
+
+2011-03-14  Ryuan Choi  <ryuan.choi@samsung.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [EFL] Move cache_directory api
+        https://bugs.webkit.org/show_bug.cgi?id=52139
+
+        Move cache directory related apis from ewk_view to ewk_settings because
+        those are not related to ewk_view.
+
+        * ewk/ewk_main.cpp:
+        (_ewk_init_body):
+        * ewk/ewk_settings.cpp:
+        (ewk_settings_cache_directory_path_set):
+        (ewk_settings_cache_directory_path_get):
+        * ewk/ewk_settings.h:
+        * ewk/ewk_view.cpp:
+        (_ewk_view_priv_new):
+        (_ewk_view_priv_del):
+        * ewk/ewk_view.h:
+
+2011-03-12  Ryuan Choi  <ryuan.choi@samsung.com>
+
+        Unreviewed build fix.
+
+        [EFL] Fix build break because of several reason.
+        https://bugs.webkit.org/show_bug.cgi?id=56244
+
+        * ewk/ewk_settings.cpp:
+        (ewk_settings_icon_database_path_set):
+
+2011-03-10  Ryuan Choi  <ryuan.choi@samsung.com>
+
+        Reviewed by Antonio Gomes.
+
+        [EFL] Limit touch events when only page required touch events.
+        https://bugs.webkit.org/show_bug.cgi?id=54857
+
+        Block touch events when ChromeClient::needTouchEvents got false.
+
+        * WebCoreSupport/ChromeClientEfl.cpp:
+        (WebCore::ChromeClientEfl::needTouchEvents):
+        * WebCoreSupport/ChromeClientEfl.h:
+        * ewk/ewk_frame.cpp:
+        (ewk_frame_feed_touch_event):
+        * ewk/ewk_private.h:
+        * ewk/ewk_view.cpp:
+        (ewk_view_need_touch_events_set):
+        (ewk_view_need_touch_events_get):
+
+2011-03-08  Grzegorz Czajkowski  <g.czajkowski@samsung.com>
+
+        Reviewed by Kent Tamura.
+
+        [EFL] Doxygen documentation for ewk_window_features and ewk_context_menu
+        https://bugs.webkit.org/show_bug.cgi?id=55026
+
+        * ewk/ewk_contextmenu.cpp:
+        (ewk_context_menu_item_select): returns EINA_FALSE when CONTEXT_MENU is disabled
+        * ewk/ewk_contextmenu.h:
+        * ewk/ewk_window_features.cpp:
+        * ewk/ewk_window_features.h:
+
 2011-03-07  Sam Weinig  <sam@webkit.org>
 
         Reviewed by Anders Carlsson.
diff --git a/Source/WebKit/efl/DefaultTheme/default.edc b/Source/WebKit/efl/DefaultTheme/default.edc
index 7d750f4..f77bd86 100644
--- a/Source/WebKit/efl/DefaultTheme/default.edc
+++ b/Source/WebKit/efl/DefaultTheme/default.edc
@@ -76,4 +76,6 @@ collections {
 #include "widget/search/cancel/search_cancel.edc"
 #include "widget/search/decoration/search_decoration.edc"
 #include "widget/slider/slider.edc"
+#include "widget/mediacontrol/playpausebutton/playpause_button.edc"
+#include "widget/mediacontrol/mutebutton/mute_button.edc"
 }
diff --git a/Source/WebKit/efl/DefaultTheme/widget/mediacontrol/mutebutton/mute_button.edc b/Source/WebKit/efl/DefaultTheme/widget/mediacontrol/mutebutton/mute_button.edc
new file mode 100644
index 0000000..3219f2d
--- /dev/null
+++ b/Source/WebKit/efl/DefaultTheme/widget/mediacontrol/mutebutton/mute_button.edc
@@ -0,0 +1,60 @@
+/*
+    Copyright (C) 2008,2009 INdT - Instituto Nokia de Tecnologia
+    Copyright (C) 2009,2010 ProFUSION embedded systems
+    Copyright (C) 2011 Samsung Electronics
+
+    This file is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This file is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+   group {
+      name: "webkit/widget/mediacontrol/mute_button";
+
+      images {
+         image: "widget/mediacontrol/mutebutton/mutebutton.png" COMP;
+         image: "widget/mediacontrol/mutebutton/unmutebutton.png" COMP;
+      }
+
+      parts {
+         part {
+            name: "mute_button";
+            type: IMAGE;
+            description { state: "default" 0.0;
+               min: 25 25;
+            }
+            description { state: "mute" 0.0;
+               inherit: "default" 0.0;
+               image.normal: "widget/mediacontrol/mutebutton/mutebutton.png";
+            }
+            description { state: "sound" 0.0;
+               inherit: "default" 0.0;
+               image.normal: "widget/mediacontrol/mutebutton/unmutebutton.png";
+            }
+         }
+      }
+
+      programs {
+         program {
+             signal: "mute";
+             action: STATE_SET "mute" 0.0;
+             target: "mute_button";
+         }
+         program {
+             signal: "sound";
+             action: STATE_SET "sound" 0.0;
+             target: "mute_button";
+         }
+      }
+   }
diff --git a/Source/WebKit/efl/DefaultTheme/widget/mediacontrol/mutebutton/mutebutton.png b/Source/WebKit/efl/DefaultTheme/widget/mediacontrol/mutebutton/mutebutton.png
new file mode 100644
index 0000000..575acd6
--- /dev/null
+++ b/Source/WebKit/efl/DefaultTheme/widget/mediacontrol/mutebutton/mutebutton.png
diff --git a/Source/WebKit/efl/DefaultTheme/widget/mediacontrol/mutebutton/unmutebutton.png b/Source/WebKit/efl/DefaultTheme/widget/mediacontrol/mutebutton/unmutebutton.png
new file mode 100644
index 0000000..4282017
--- /dev/null
+++ b/Source/WebKit/efl/DefaultTheme/widget/mediacontrol/mutebutton/unmutebutton.png
diff --git a/Source/WebKit/efl/DefaultTheme/widget/mediacontrol/playpausebutton/pausebutton.png b/Source/WebKit/efl/DefaultTheme/widget/mediacontrol/playpausebutton/pausebutton.png
new file mode 100755
index 0000000..b40cfea
--- /dev/null
+++ b/Source/WebKit/efl/DefaultTheme/widget/mediacontrol/playpausebutton/pausebutton.png
diff --git a/Source/WebKit/efl/DefaultTheme/widget/mediacontrol/playpausebutton/playbutton.png b/Source/WebKit/efl/DefaultTheme/widget/mediacontrol/playpausebutton/playbutton.png
new file mode 100755
index 0000000..b4bc661
--- /dev/null
+++ b/Source/WebKit/efl/DefaultTheme/widget/mediacontrol/playpausebutton/playbutton.png
diff --git a/Source/WebKit/efl/DefaultTheme/widget/mediacontrol/playpausebutton/playpause_button.edc b/Source/WebKit/efl/DefaultTheme/widget/mediacontrol/playpausebutton/playpause_button.edc
new file mode 100644
index 0000000..86b7bca
--- /dev/null
+++ b/Source/WebKit/efl/DefaultTheme/widget/mediacontrol/playpausebutton/playpause_button.edc
@@ -0,0 +1,60 @@
+/*
+    Copyright (C) 2008,2009 INdT - Instituto Nokia de Tecnologia
+    Copyright (C) 2009,2010 ProFUSION embedded systems
+    Copyright (C) 2011 Samsung Electronics
+
+    This file is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This file is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+   group {
+      name: "webkit/widget/mediacontrol/playpause_button";
+
+      images {
+         image: "widget/mediacontrol/playpausebutton/playbutton.png" COMP;
+         image: "widget/mediacontrol/playpausebutton/pausebutton.png" COMP;
+      }
+
+      parts {
+         part {
+            name: "playpause_button";
+            type: IMAGE;
+            description { state: "default" 0.0;
+               min: 25 25;
+            }
+            description { state: "play" 0.0;
+               inherit: "default" 0.0;
+               image.normal: "widget/mediacontrol/playpausebutton/playbutton.png";
+            }
+            description { state: "pause" 0.0;
+               inherit: "default" 0.0;
+               image.normal: "widget/mediacontrol/playpausebutton/pausebutton.png";
+            }
+         }
+      }
+
+      programs {
+         program {
+             signal: "play";
+             action: STATE_SET "play" 0.0;
+             target: "playpause_button";
+         }
+         program {
+             signal: "pause";
+             action: STATE_SET "pause" 0.0;
+             target: "playpause_button";
+         }
+      }
+   }
diff --git a/Source/WebKit/efl/WebCoreSupport/ChromeClientEfl.cpp b/Source/WebKit/efl/WebCoreSupport/ChromeClientEfl.cpp
index a1851c5..ce2ac1b 100644
--- a/Source/WebKit/efl/WebCoreSupport/ChromeClientEfl.cpp
+++ b/Source/WebKit/efl/WebCoreSupport/ChromeClientEfl.cpp
@@ -396,6 +396,13 @@ void ChromeClientEfl::reachedApplicationCacheOriginQuota(SecurityOrigin*)
 }
 #endif
 
+#if ENABLE(TOUCH_EVENTS)
+void ChromeClientEfl::needTouchEvents(bool needed)
+{
+    ewk_view_need_touch_events_set(m_view, needed);
+}
+#endif
+
 #if ENABLE(DATABASE)
 void ChromeClientEfl::exceededDatabaseQuota(Frame* frame, const String& databaseName)
 {
diff --git a/Source/WebKit/efl/WebCoreSupport/ChromeClientEfl.h b/Source/WebKit/efl/WebCoreSupport/ChromeClientEfl.h
index 09b0f4f..3d276e5 100644
--- a/Source/WebKit/efl/WebCoreSupport/ChromeClientEfl.h
+++ b/Source/WebKit/efl/WebCoreSupport/ChromeClientEfl.h
@@ -121,7 +121,7 @@ public:
 #endif
 
 #if ENABLE(TOUCH_EVENTS)
-    virtual void needTouchEvents(bool) { }
+    virtual void needTouchEvents(bool);
 #endif
 
     virtual void runOpenPanel(Frame*, PassRefPtr<FileChooser>);
diff --git a/Source/WebKit/efl/WebCoreSupport/FrameLoaderClientEfl.cpp b/Source/WebKit/efl/WebCoreSupport/FrameLoaderClientEfl.cpp
index 3ea8c2a..fa34ac9 100644
--- a/Source/WebKit/efl/WebCoreSupport/FrameLoaderClientEfl.cpp
+++ b/Source/WebKit/efl/WebCoreSupport/FrameLoaderClientEfl.cpp
@@ -1,6 +1,6 @@
 /*
  * Copyright (C) 2006 Zack Rusin <zack@kde.org>
- * Copyright (C) 2006 Apple Computer, Inc.  All rights reserved.
+ * Copyright (C) 2006, 2011 Apple Inc. All rights reserved.
  * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
  * Copyright (C) 2008 Collabora Ltd. All rights reserved.
  * Copyright (C) 2008 Holger Hans Peter Freyther
@@ -50,13 +50,15 @@
 #include "ProgressTracker.h"
 #include "RenderPart.h"
 #include "ResourceRequest.h"
-#include "ViewportArguments.h"
+#include "WebKitVersion.h"
 #include "ewk_private.h"
 #include <wtf/text/CString.h>
 #include <wtf/text/StringConcatenate.h>
 
-#if PLATFORM(UNIX)
+#if OS(UNIX)
 #include <sys/utsname.h>
+#elif OS(WINDOWS)
+#include "SystemInfo.h"
 #endif
 
 #include <Ecore_Evas.h>
@@ -75,29 +77,22 @@ FrameLoaderClientEfl::FrameLoaderClientEfl(Evas_Object *view)
 {
 }
 
-static String agentPlatform()
-{
-    notImplemented();
-    return "Unknown";
-}
-
 static String agentOS()
 {
-#if PLATFORM(DARWIN)
-#if PLATFORM(X86)
+#if OS(DARWIN)
+#if CPU(X86)
     return "Intel Mac OS X";
 #else
     return "PPC Mac OS X";
 #endif
-#elif PLATFORM(UNIX)
+#elif OS(UNIX)
     struct utsname name;
     if (uname(&name) != -1)
         return makeString(name.sysname, ' ', name.machine);
 
     return "Unknown";
-#elif PLATFORM(WIN_OS)
-    // FIXME: Compute the Windows version
-    return "Windows";
+#elif OS(WINDOWS)
+    return windowsVersionForUAString();
 #else
     notImplemented();
     return "Unknown";
@@ -106,35 +101,8 @@ static String agentOS()
 
 static String composeUserAgent()
 {
-    // This is a liberal interpretation of http://www.mozilla.org/build/revised-user-agent-strings.html
-    // See also http://developer.apple.com/internet/safari/faq.html#anchor2
-
-    String ua;
-
-    // Product
-    ua += "Mozilla/5.0";
-
-    // Comment
-    ua += " (";
-    ua += agentPlatform(); // Platform
-    ua += "; ";
-    ua += agentOS(); // OS-or-CPU
-    ua += ") ";
-
-    // WebKit Product
-    // FIXME: The WebKit version is hardcoded
-    static const String webKitVersion = "525.1+";
-    ua += "AppleWebKit/" + webKitVersion;
-    ua += " (KHTML, like Gecko, ";
-    // We mention Safari since many broken sites check for it (OmniWeb does this too)
-    // We re-use the WebKit version, though it doesn't seem to matter much in practice
-    ua += "Safari/" + webKitVersion;
-    ua += ") ";
-
-    // Vendor Product
-    // ua += g_get_prgname();
-
-    return ua;
+    String webKitVersion = String::format("%d.%d", WEBKIT_MAJOR_VERSION, WEBKIT_MINOR_VERSION);
+    return makeString("Mozilla/5.0 (", agentOS(), ") AppleWebKit/", webKitVersion, " (KHTML, like Gecko) Safari/", webKitVersion);
 }
 
 void FrameLoaderClientEfl::setCustomUserAgent(const String &agent)
@@ -399,8 +367,12 @@ PassRefPtr<Widget> FrameLoaderClientEfl::createJavaAppletWidget(const IntSize&,
     return 0;
 }
 
-ObjectContentType FrameLoaderClientEfl::objectContentType(const KURL& url, const String& mimeType)
+ObjectContentType FrameLoaderClientEfl::objectContentType(const KURL& url, const String& mimeType, bool shouldPreferPlugInsForImages)
 {
+    // FIXME: once plugin support is enabled, this method needs to correctly handle the 'shouldPreferPlugInsForImages' flag. See
+    // WebCore::FrameLoader::defaultObjectContentType() for an example.
+    UNUSED_PARAM(shouldPreferPlugInsForImages);
+
     if (url.isEmpty() && mimeType.isEmpty())
         return ObjectContentNone;
 
@@ -626,9 +598,6 @@ void FrameLoaderClientEfl::dispatchDidCommitLoad()
         return;
     ewk_view_title_set(m_view, 0);
     ewk_view_uri_changed(m_view);
-
-    ViewportArguments arguments;
-    ewk_view_viewport_attributes_set(m_view, arguments);
 }
 
 void FrameLoaderClientEfl::dispatchDidFinishDocumentLoad()
diff --git a/Source/WebKit/efl/WebCoreSupport/FrameLoaderClientEfl.h b/Source/WebKit/efl/WebCoreSupport/FrameLoaderClientEfl.h
index 424c66b..5ea4e8c 100644
--- a/Source/WebKit/efl/WebCoreSupport/FrameLoaderClientEfl.h
+++ b/Source/WebKit/efl/WebCoreSupport/FrameLoaderClientEfl.h
@@ -1,6 +1,6 @@
 /*
  * Copyright (C) 2006 Zack Rusin <zack@kde.org>
- * Copyright (C) 2006 Apple Computer, Inc.  All rights reserved.
+ * Copyright (C) 2006, 2011 Apple Inc. All rights reserved.
  * Copyright (C) 2008 Collabora Ltd. All rights reserved.
  * Copyright (C) 2008 INdT - Instituto Nokia de Tecnologia
  * Copyright (C) 2009-2010 ProFUSION embedded systems
@@ -149,7 +149,7 @@ class FrameLoaderClientEfl : public FrameLoaderClient {
 
     virtual void registerForIconNotification(bool);
 
-    virtual ObjectContentType objectContentType(const KURL& url, const String& mimeType);
+    virtual ObjectContentType objectContentType(const KURL&, const String& mimeType, bool shouldPreferPlugInsForImages);
 
     virtual void setMainFrameDocumentReady(bool);
 
diff --git a/Source/WebKit/efl/ewk/ewk_contextmenu.cpp b/Source/WebKit/efl/ewk/ewk_contextmenu.cpp
index 40bd2ba..128208d 100644
--- a/Source/WebKit/efl/ewk/ewk_contextmenu.cpp
+++ b/Source/WebKit/efl/ewk/ewk_contextmenu.cpp
@@ -31,33 +31,53 @@
 #include <eina_safety_checks.h>
 #include <wtf/text/CString.h>
 
+/**
+ * \struct  _Ewk_Context_Menu
+ * @brief   Contains the context menu data.
+ */
 struct _Ewk_Context_Menu {
-    unsigned int __ref;
+    unsigned int __ref; /**< the reference count of the object */
 #if ENABLE(CONTEXT_MENUS)
-    WebCore::ContextMenuController* controller;
+    WebCore::ContextMenuController* controller; /**< the WebCore's object which is responsible for the context menu */
 #endif
-    Evas_Object* view;
+    Evas_Object* view; /**< the view object */
 
-    Eina_List* items;
+    Eina_List* items; /**< the list of items */
 };
 
+/**
+ * \struct  _Ewk_Context_Menu_Item
+ * @brief   Represents one item of the context menu object.
+ */
 struct _Ewk_Context_Menu_Item {
-    Ewk_Context_Menu_Item_Type type;
-    Ewk_Context_Menu_Action action;
+    Ewk_Context_Menu_Item_Type type; /**< contains the type of the item */
+    Ewk_Context_Menu_Action action; /**< contains the action of the item */
 
-    const char* title;
-    Ewk_Context_Menu* submenu;
+    const char* title; /**< contains the title of the item */
+    Ewk_Context_Menu* submenu; /**< contains the pointer to the submenu of the item */
 
     Eina_Bool checked:1;
     Eina_Bool enabled:1;
 };
 
+/**
+ * Increases the reference count of the given object.
+ *
+ * @param menu the context menu object to increase the reference count
+ */
 void ewk_context_menu_ref(Ewk_Context_Menu* menu)
 {
     EINA_SAFETY_ON_NULL_RETURN(menu);
     menu->__ref++;
 }
 
+/**
+ * Decreases the reference count of the given object, possibly freeing it.
+ *
+ * When the reference count it's reached 0, the menu with all items are freed.
+ *
+ * @param menu the context menu object to decrease the reference count
+ */
 void ewk_context_menu_unref(Ewk_Context_Menu* menu)
 {
     EINA_SAFETY_ON_NULL_RETURN(menu);
@@ -72,6 +92,14 @@ void ewk_context_menu_unref(Ewk_Context_Menu* menu)
     free(menu);
 }
 
+/**
+ * Destroys the context menu object.
+ *
+ * @param menu the context menu object to destroy
+ * @return @c EINA_TRUE on success, @c EINA_FALSE on failure
+ *
+ * @see ewk_context_menu_item_free
+ */
 Eina_Bool ewk_context_menu_destroy(Ewk_Context_Menu* menu)
 {
     EINA_SAFETY_ON_NULL_RETURN_VAL(menu, EINA_FALSE);
@@ -84,6 +112,12 @@ Eina_Bool ewk_context_menu_destroy(Ewk_Context_Menu* menu)
     return EINA_TRUE;
 }
 
+/**
+ * Gets the list of items.
+ *
+ * @param o the context menu object to get list of the items
+ * @return the list of the items on success or @c 0 on failure
+ */
 const Eina_List* ewk_context_menu_item_list_get(Ewk_Context_Menu* o)
 {
     EINA_SAFETY_ON_NULL_RETURN_VAL(o, 0);
@@ -91,6 +125,19 @@ const Eina_List* ewk_context_menu_item_list_get(Ewk_Context_Menu* o)
     return o->items;
 }
 
+/**
+ * Creates a new item of the context menu.
+ *
+ * @param type specifies a type of the item
+ * @param action specifies a action of the item
+ * @param submenu specifies a submenu of the item
+ * @param title specifies a title of the item
+ * @param checked
+ * @param enabled @c EINA_TRUE to enable the item or @c EINA_FALSE to disable
+ * @return the pointer to the new item on success or @c 0 on failure
+ *
+ * @note The return value @b should @b be freed after use.
+ */
 Ewk_Context_Menu_Item* ewk_context_menu_item_new(Ewk_Context_Menu_Item_Type type,
         Ewk_Context_Menu_Action action, Ewk_Context_Menu* submenu,
         const char* title, Eina_Bool checked, Eina_Bool enabled)
@@ -109,6 +156,13 @@ Ewk_Context_Menu_Item* ewk_context_menu_item_new(Ewk_Context_Menu_Item_Type type
     return item;
 }
 
+/**
+ * Selects the item from the context menu object.
+ *
+ * @param menu the context menu object
+ * @param item the item is selected
+ * @return @c EINA_TRUE on success or @c EINA_FALSE on failure
+ */
 Eina_Bool ewk_context_menu_item_select(Ewk_Context_Menu* menu, Ewk_Context_Menu_Item* item)
 {
 #if ENABLE(CONTEXT_MENUS)
@@ -120,11 +174,20 @@ Eina_Bool ewk_context_menu_item_select(Ewk_Context_Menu* menu, Ewk_Context_Menu_
     // Don't care about title and submenu as they're not used after this point.
     WebCore::ContextMenuItem core(type, action, WTF::String());
     menu->controller->contextMenuItemSelected(&core);
-#endif
-
     return EINA_TRUE;
+#else
+    return EINA_FALSE;
+#endif
 }
 
+/**
+ * Destroys the item of the context menu object.
+ *
+ * @param item the item to destroy
+ *
+ * @see ewk_context_menu_destroy
+ * @see ewk_context_menu_unref
+ */
 void ewk_context_menu_item_free(Ewk_Context_Menu_Item* item)
 {
     EINA_SAFETY_ON_NULL_RETURN(item);
@@ -133,12 +196,29 @@ void ewk_context_menu_item_free(Ewk_Context_Menu_Item* item)
     free(item);
 }
 
+/**
+ * Gets type of the item.
+ *
+ * @param o the item to get the type
+ * @return type of the item on success or @c EWK_ACTION_TYPE on failure
+ *
+ * @see ewk_context_menu_item_type_set
+ */
 Ewk_Context_Menu_Item_Type ewk_context_menu_item_type_get(Ewk_Context_Menu_Item* o)
 {
     EINA_SAFETY_ON_NULL_RETURN_VAL(o, EWK_ACTION_TYPE);
     return o->type;
 }
 
+/**
+ * Sets the type of item.
+ *
+ * @param o the item to set the type
+ * @param type a new type for the item object
+ * @return @c EINA_TRUE on success, or @c EINA_FALSE on failure
+ *
+ * @see ewk_context_menu_item_type_get
+ */
 Eina_Bool ewk_context_menu_item_type_set(Ewk_Context_Menu_Item* o, Ewk_Context_Menu_Item_Type type)
 {
     EINA_SAFETY_ON_NULL_RETURN_VAL(o, EINA_FALSE);
@@ -146,12 +226,29 @@ Eina_Bool ewk_context_menu_item_type_set(Ewk_Context_Menu_Item* o, Ewk_Context_M
     return EINA_TRUE;
 }
 
+/**
+ * Gets an action of the item.
+ *
+ * @param o the item to get the action
+ * @return an action of the item on success or @c EWK_CONTEXT_MENU_ITEM_TAG_NO_ACTION on failure
+ *
+ * @see ewk_context_menu_item_action_set
+ */
 Ewk_Context_Menu_Action ewk_context_menu_item_action_get(Ewk_Context_Menu_Item* o)
 {
     EINA_SAFETY_ON_NULL_RETURN_VAL(o, EWK_CONTEXT_MENU_ITEM_TAG_NO_ACTION);
     return o->action;
 }
 
+/**
+ * Sets an action of the item.
+ *
+ * @param o the item to set the action
+ * @param action a new action for the item object
+ * @return @c EINA_TRUE on success, or @c EINA_FALSE on failure
+ *
+ * @see ewk_context_menu_item_action_get
+ */
 Eina_Bool ewk_context_menu_item_action_set(Ewk_Context_Menu_Item* o, Ewk_Context_Menu_Action action)
 {
     EINA_SAFETY_ON_NULL_RETURN_VAL(o, EINA_FALSE);
@@ -159,12 +256,29 @@ Eina_Bool ewk_context_menu_item_action_set(Ewk_Context_Menu_Item* o, Ewk_Context
     return EINA_TRUE;
 }
 
+/**
+ * Gets a title of the item.
+ *
+ * @param o the item to get the title
+ * @return a title of the item on success, or @c 0 on failure
+ *
+ * @see ewk_context_menu_item_title_set
+ */
 const char* ewk_context_menu_item_title_get(Ewk_Context_Menu_Item* o)
 {
     EINA_SAFETY_ON_NULL_RETURN_VAL(o, 0);
     return o->title;
 }
 
+/**
+ * Sets a title of the item.
+ *
+ * @param o the item to set the title
+ * @param title a new title for the item object
+ * @return a new title of the item on success or @c 0 on failure
+ *
+ * @see ewk_context_menu_item_title_get
+ */
 const char* ewk_context_menu_item_title_set(Ewk_Context_Menu_Item* o, const char* title)
 {
     EINA_SAFETY_ON_NULL_RETURN_VAL(o, 0);
@@ -185,12 +299,29 @@ Eina_Bool ewk_context_menu_item_checked_set(Ewk_Context_Menu_Item* o, Eina_Bool
     return EINA_TRUE;
 }
 
+/**
+ * Gets if the item is enabled.
+ *
+ * @param o the item to get enabled state
+ * @return @c EINA_TRUE if it's enabled, @c EINA_FALSE if not or on failure
+ *
+ * @see ewk_context_menu_item_enabled_set
+ */
 Eina_Bool ewk_context_menu_item_enabled_get(Ewk_Context_Menu_Item* o)
 {
     EINA_SAFETY_ON_NULL_RETURN_VAL(o, EINA_FALSE);
     return o->enabled;
 }
 
+/**
+ * Enables/disables the item.
+ *
+ * @param o the item to enable/disable
+ * @param enabled @c EINA_TRUE to enable the item or @c EINA_FALSE to disable
+ * @return @c EINA_TRUE on success, or @c EINA_FALSE on failure
+ *
+ * @see ewk_context_menu_item_enabled_get
+ */
 Eina_Bool ewk_context_menu_item_enabled_set(Ewk_Context_Menu_Item *o, Eina_Bool enabled)
 {
     EINA_SAFETY_ON_NULL_RETURN_VAL(o, EINA_FALSE);
@@ -205,12 +336,13 @@ Eina_Bool ewk_context_menu_item_enabled_set(Ewk_Context_Menu_Item *o, Eina_Bool
 /**
  * @internal
  *
- * Creates context on view.
+ * Creates an empty context menu on view.
  *
- * @param view View.
- * @param Controller Context Menu Controller.
+ * @param view the view object
+ * @param controller the WebCore's context menu controller
+ * @return newly allocated the context menu on success or @c 0 on errors
  *
- * @return newly allocated context menu or @c 0 on errors.
+ * @note emits a signal "contextmenu,new"
  */
 Ewk_Context_Menu* ewk_context_menu_new(Evas_Object* view, WebCore::ContextMenuController* controller)
 {
@@ -233,6 +365,19 @@ Ewk_Context_Menu* ewk_context_menu_new(Evas_Object* view, WebCore::ContextMenuCo
     return menu;
 }
 
+/**
+ * @internal
+ *
+ * Frees the context menu.
+ *
+ * @param o the view object
+ * @return @c EINA_TRUE on success, or @c EINA_FALSE on failure
+ *
+ * @note emits a signal "contextmenu,free"
+ *
+ * @see ewk_context_menu_unref
+ * @see ewk_context_menu_destroy
+ */
 Eina_Bool ewk_context_menu_free(Ewk_Context_Menu* o)
 {
     EINA_SAFETY_ON_NULL_RETURN_VAL(o, EINA_FALSE);
@@ -241,6 +386,17 @@ Eina_Bool ewk_context_menu_free(Ewk_Context_Menu* o)
     return EINA_TRUE;
 }
 
+/**
+ * @internal
+ *
+ * Appends the WebCore's item to the context menu object.
+ *
+ * @param o the context menu object
+ * @param core the WebCore's context menu item that will be added to the context menu
+ * @note emits a signal "contextmenu,item,appended"
+ *
+ * @see ewk_context_menu_item_new
+ */
 void ewk_context_menu_item_append(Ewk_Context_Menu* o, WebCore::ContextMenuItem& core)
 {
     Ewk_Context_Menu_Item_Type type = static_cast<Ewk_Context_Menu_Item_Type>(core.type());
@@ -255,6 +411,18 @@ void ewk_context_menu_item_append(Ewk_Context_Menu* o, WebCore::ContextMenuItem&
     evas_object_smart_callback_call(o->view, "contextmenu,item,appended", o);
 }
 
+/**
+ * @internal
+ *
+ * Emits a signal with the items of the context menu.
+ *
+ * @param o the context menu object
+ * @return the same context menu object that was given through parameter
+ *
+ * @note emits a signal "contextmenu,customize"
+ *
+ * @see ewk_context_menu_item_list_get
+ */
 Ewk_Context_Menu* ewk_context_menu_custom_get(Ewk_Context_Menu* o)
 {
     EINA_SAFETY_ON_NULL_RETURN_VAL(o, 0);
@@ -263,6 +431,13 @@ Ewk_Context_Menu* ewk_context_menu_custom_get(Ewk_Context_Menu* o)
     return o;
 }
 
+/**
+ * @internal
+ *
+ * Emits a signal "contextmenu,show"
+ *
+ * @param o the context menu object
+ */
 void ewk_context_menu_show(Ewk_Context_Menu* o)
 {
     EINA_SAFETY_ON_NULL_RETURN(o);
diff --git a/Source/WebKit/efl/ewk/ewk_contextmenu.h b/Source/WebKit/efl/ewk/ewk_contextmenu.h
index c5adb48..7b60410 100644
--- a/Source/WebKit/efl/ewk/ewk_contextmenu.h
+++ b/Source/WebKit/efl/ewk/ewk_contextmenu.h
@@ -18,6 +18,11 @@
     Boston, MA 02110-1301, USA.
 */
 
+/**
+ * @file    ewk_contextmenu.h
+ * @brief   Describes the context menu API.
+ */
+
 #ifndef ewk_contextmenu_h
 #define ewk_contextmenu_h
 
@@ -30,7 +35,11 @@
 extern "C" {
 #endif
 
-// keep this in sync with ContextMenuItem.h
+/**
+ * \enum    _Ewk_Context_Menu_Action
+ * @brief   Provides the actions of items for the context menu.
+ * @info    Keep this in sync with ContextMenuItem.h
+ */
 enum _Ewk_Context_Menu_Action {
     EWK_CONTEXT_MENU_ITEM_TAG_NO_ACTION = 0, // this item is not actually in web_uidelegate.h
     EWK_CONTEXT_MENU_ITEM_TAG_OPEN_LINK_IN_NEW_WINDOW = 1,
@@ -67,12 +76,12 @@ enum _Ewk_Context_Menu_Action {
     EWK_CONTEXT_MENU_ITEM_PDFPREVIOUS_PAGE,
     EWK_CONTEXT_MENU_ITEM_TAG_OPEN_LINK = 2000,
     EWK_CONTEXT_MENU_ITEM_TAG_IGNORE_GRAMMAR,
-    EWK_CONTEXT_MENU_ITEM_TAG_SPELLING_MENU, // spelling or spelling/grammar sub-menu
+    EWK_CONTEXT_MENU_ITEM_TAG_SPELLING_MENU, /**< spelling or spelling/grammar sub-menu */
     EWK_CONTEXT_MENU_ITEM_TAG_SHOW_SPELLING_PANEL,
     EWK_CONTEXT_MENU_ITEM_TAG_CHECK_SPELLING,
     EWK_CONTEXT_MENU_ITEM_TAG_CHECK_SPELLING_WHILE_TYPING,
     EWK_CONTEXT_MENU_ITEM_TAG_CHECK_GRAMMAR_WITH_SPELLING,
-    EWK_CONTEXT_MENU_ITEM_TAG_FONT_MENU, // font sub-menu
+    EWK_CONTEXT_MENU_ITEM_TAG_FONT_MENU, /**< font sub-menu */
     EWK_CONTEXT_MENU_ITEM_TAG_SHOW_FONTS,
     EWK_CONTEXT_MENU_ITEM_TAG_BOLD,
     EWK_CONTEXT_MENU_ITEM_TAG_ITALIC,
@@ -80,41 +89,43 @@ enum _Ewk_Context_Menu_Action {
     EWK_CONTEXT_MENU_ITEM_TAG_OUTLINE,
     EWK_CONTEXT_MENU_ITEM_TAG_STYLES,
     EWK_CONTEXT_MENU_ITEM_TAG_SHOW_COLORS,
-    EWK_CONTEXT_MENU_ITEM_TAG_SPEECH_MENU, // speech sub-menu
+    EWK_CONTEXT_MENU_ITEM_TAG_SPEECH_MENU, /**< speech sub-menu */
     EWK_CONTEXT_MENU_ITEM_TAG_START_SPEAKING,
     EWK_CONTEXT_MENU_ITEM_TAG_STOP_SPEAKING,
-    EWK_CONTEXT_MENU_ITEM_TAG_WRITING_DIRECTION_MENU, // writing direction sub-menu
+    EWK_CONTEXT_MENU_ITEM_TAG_WRITING_DIRECTION_MENU, /**< writing direction sub-menu */
     EWK_CONTEXT_MENU_ITEM_TAG_DEFAULT_DIRECTION,
     EWK_CONTEXT_MENU_ITEM_TAG_LEFT_TO_RIGHT,
     EWK_CONTEXT_MENU_ITEM_TAG_RIGHT_TO_LEFT,
     EWK_CONTEXT_MENU_ITEM_TAG_PDFSINGLE_PAGE_SCROLLING,
     EWK_CONTEXT_MENU_ITEM_TAG_PDFFACING_PAGES_SCROLLING,
-    EWK_CONTEXT_MENU_ITEM_TAG_TEXT_DIRECTION_MENU, // text direction sub-menu
+    EWK_CONTEXT_MENU_ITEM_TAG_TEXT_DIRECTION_MENU, /**< text direction sub-menu */
     EWK_CONTEXT_MENU_ITEM_TAG_TEXT_DIRECTION_DEFAULT,
     EWK_CONTEXT_MENU_ITEM_TAG_TEXT_DIRECTION_LEFT_TO_RIGHT,
     EWK_CONTEXT_MENU_ITEM_TAG_TEXT_DIRECTION_RIGHT_TO_LEFT,
     EWK_CONTEXT_MENU_ITEM_BASE_CUSTOM_TAG = 5000,
     EWK_CONTEXT_MENU_ITEM_BASE_APPLICATION_TAG = 10000
 };
+/** Creates a type name for _Ewk_Context_Menu_Action */
 typedef enum _Ewk_Context_Menu_Action Ewk_Context_Menu_Action;
 
-// keep this in sync with ContextMenuItem.h
+/**
+ * \enum    _Ewk_Context_Menu_Item_Type
+ * @brief   Defines the types of the items for the context menu.
+ * @info    Keep this in sync with ContextMenuItem.h
+ */
 enum _Ewk_Context_Menu_Item_Type {
     EWK_ACTION_TYPE,
     EWK_CHECKABLE_ACTION_TYPE,
     EWK_SEPARATOR_TYPE,
     EWK_SUBMENU_TYPE
 };
+/** Creates a type name for _Ewk_Context_Menu_Item_Type */
 typedef enum _Ewk_Context_Menu_Item_Type    Ewk_Context_Menu_Item_Type;
 
-/**
- * The structure to contain Context Menu data
- */
+/** Creates a type name for _Ewk_Context_Menu */
 typedef struct _Ewk_Context_Menu            Ewk_Context_Menu;
 
-/**
- * Represents one item from Ewk_Context_Menu
- */
+/** Creates a type name for _Ewk_Context_Menu_Item */
 typedef struct _Ewk_Context_Menu_Item       Ewk_Context_Menu_Item;
 
 
diff --git a/Source/WebKit/efl/ewk/ewk_cookies.cpp b/Source/WebKit/efl/ewk/ewk_cookies.cpp
index 7558154..048886b 100644
--- a/Source/WebKit/efl/ewk/ewk_cookies.cpp
+++ b/Source/WebKit/efl/ewk/ewk_cookies.cpp
@@ -76,7 +76,7 @@ EAPI Eina_Bool ewk_cookies_file_set(const char *filename)
 /**
  * Clears all the cookies from the cookie jar.
  */
-EAPI void ewk_cookies_clear()
+EAPI void ewk_cookies_clear(void)
 {
 #if USE(SOUP)
     GSList* l;
@@ -207,7 +207,7 @@ EAPI void ewk_cookies_policy_set(Ewk_Cookie_Policy p)
  * @return the current acceptance policy
  * @see Ewk_Cookie_Policy
  */
-EAPI Ewk_Cookie_Policy ewk_cookies_policy_get()
+EAPI Ewk_Cookie_Policy ewk_cookies_policy_get(void)
 {
     Ewk_Cookie_Policy ewk_policy = EWK_COOKIE_JAR_ACCEPT_ALWAYS;
 #if USE(SOUP)
diff --git a/Source/WebKit/efl/ewk/ewk_cookies.h b/Source/WebKit/efl/ewk/ewk_cookies.h
index 19eac0f..ec0e84f 100644
--- a/Source/WebKit/efl/ewk/ewk_cookies.h
+++ b/Source/WebKit/efl/ewk/ewk_cookies.h
@@ -76,12 +76,12 @@ typedef enum _Ewk_Cookie_Policy Ewk_Cookie_Policy;
 /************************** Exported functions ***********************/
 
 EAPI Eina_Bool          ewk_cookies_file_set(const char *filename);
-EAPI void               ewk_cookies_clear();
-EAPI Eina_List*         ewk_cookies_get_all();
+EAPI void               ewk_cookies_clear(void);
+EAPI Eina_List*         ewk_cookies_get_all(void);
 EAPI void               ewk_cookies_cookie_del(Ewk_Cookie *cookie);
 EAPI void               ewk_cookies_cookie_free(Ewk_Cookie *cookie);
 EAPI void               ewk_cookies_policy_set(Ewk_Cookie_Policy p);
-EAPI Ewk_Cookie_Policy  ewk_cookies_policy_get();
+EAPI Ewk_Cookie_Policy  ewk_cookies_policy_get(void);
 
 #ifdef __cplusplus
 }
diff --git a/Source/WebKit/efl/ewk/ewk_frame.cpp b/Source/WebKit/efl/ewk/ewk_frame.cpp
index 0e2f903..4e52b56 100644
--- a/Source/WebKit/efl/ewk/ewk_frame.cpp
+++ b/Source/WebKit/efl/ewk/ewk_frame.cpp
@@ -1484,9 +1484,14 @@ Eina_Bool ewk_frame_feed_touch_event(Evas_Object* o, Ewk_Touch_Event_Type action
     Eina_Bool ret = EINA_FALSE;
 
 #if ENABLE(TOUCH_EVENTS)
-    EWK_FRAME_SD_GET_OR_RETURN(o, sd, EINA_FALSE);
-    EINA_SAFETY_ON_NULL_RETURN_VAL(sd->frame, EINA_FALSE);
     EINA_SAFETY_ON_NULL_RETURN_VAL(points, EINA_FALSE);
+    EWK_FRAME_SD_GET(o, sd);
+
+    if (!sd || !sd->frame || !ewk_view_need_touch_events_get(sd->view)) {
+        void* point;
+        EINA_LIST_FREE(points, point);
+        return EINA_FALSE;
+    }
 
     Evas_Coord x, y;
     evas_object_geometry_get(sd->view, &x, &y, 0, 0);
diff --git a/Source/WebKit/efl/ewk/ewk_history.cpp b/Source/WebKit/efl/ewk/ewk_history.cpp
index 0a9d349..fb70903 100644
--- a/Source/WebKit/efl/ewk/ewk_history.cpp
+++ b/Source/WebKit/efl/ewk/ewk_history.cpp
@@ -24,7 +24,9 @@
 #include "BackForwardListImpl.h"
 #include "EWebKit.h"
 #include "HistoryItem.h"
+#include "IconDatabaseBase.h"
 #include "Image.h"
+#include "IntSize.h"
 #include "ewk_private.h"
 #include <wtf/text/CString.h>
 
@@ -578,7 +580,8 @@ double ewk_history_item_time_last_visited_get(const Ewk_History_Item* item)
 cairo_surface_t* ewk_history_item_icon_surface_get(const Ewk_History_Item* item)
 {
     EWK_HISTORY_ITEM_CORE_GET_OR_RETURN(item, core, 0);
-    WebCore::Image* icon = core->icon();
+    
+    WebCore::Image* icon = WebCore::iconDatabase().synchronousIconForPageURL(core->url(), WebCore::IntSize(16, 16));
     if (!icon) {
         ERR("icon is NULL.");
         return 0;
@@ -606,7 +609,7 @@ Evas_Object* ewk_history_item_icon_object_add(const Ewk_History_Item* item, Evas
 {
     EWK_HISTORY_ITEM_CORE_GET_OR_RETURN(item, core, 0);
     EINA_SAFETY_ON_NULL_RETURN_VAL(canvas, 0);
-    WebCore::Image* icon = core->icon();
+    WebCore::Image* icon = WebCore::iconDatabase().synchronousIconForPageURL(core->url(), WebCore::IntSize(16, 16));
     cairo_surface_t* surface;
 
     if (!icon) {
diff --git a/Source/WebKit/efl/ewk/ewk_main.cpp b/Source/WebKit/efl/ewk/ewk_main.cpp
index c1c8e02..0c7cc70 100644
--- a/Source/WebKit/efl/ewk/ewk_main.cpp
+++ b/Source/WebKit/efl/ewk/ewk_main.cpp
@@ -26,7 +26,6 @@
 #include "Logging.h"
 #include "PageCache.h"
 #include "PageGroup.h"
-#include "appcache/ApplicationCacheStorage.h"
 #include "ewk_private.h"
 #include "ewk_settings.h"
 #include "runtime/InitializeThreading.h"
@@ -175,7 +174,9 @@ Eina_Bool _ewk_init_body(void)
         ewk_settings_web_database_path_set(wkdir.utf8().data());
         ewk_settings_icon_database_path_set(wkdir.utf8().data());
 
-        WebCore::cacheStorage().setCacheDirectory(wkdir);
+#if ENABLE(OFFLINE_WEB_APPLICATIONS)
+        ewk_settings_cache_directory_path_set(wkdir.utf8().data());
+#endif
     }
 
     // TODO: this should move to WebCore, already reported to webkit-gtk folks:
diff --git a/Source/WebKit/efl/ewk/ewk_private.h b/Source/WebKit/efl/ewk/ewk_private.h
index 496efdb..114c39e 100644
--- a/Source/WebKit/efl/ewk/ewk_private.h
+++ b/Source/WebKit/efl/ewk/ewk_private.h
@@ -106,7 +106,12 @@ void ewk_view_viewport_attributes_set(Evas_Object *o, const WebCore::ViewportArg
 
 void ewk_view_download_request(Evas_Object *o, Ewk_Download *download);
 
-int ewk_view_dpi_get();
+int ewk_view_dpi_get(void);
+
+#if ENABLE(TOUCH_EVENTS)
+void ewk_view_need_touch_events_set(Evas_Object*, bool needed);
+Eina_Bool ewk_view_need_touch_events_get(Evas_Object*);
+#endif
 
 Ewk_History *ewk_history_new(WebCore::BackForwardListImpl *history);
 void ewk_history_free(Ewk_History *history);
@@ -160,7 +165,7 @@ void ewk_view_contents_size_changed(Evas_Object *o, Evas_Coord w, Evas_Coord h);
 
 WebCore::FloatRect ewk_view_page_rect_get(Evas_Object *o);
 
-const char* ewk_settings_default_user_agent_get();
+const char* ewk_settings_default_user_agent_get(void);
 
 #ifdef __cplusplus
 
diff --git a/Source/WebKit/efl/ewk/ewk_settings.cpp b/Source/WebKit/efl/ewk/ewk_settings.cpp
index 69934c0..3a185d9 100644
--- a/Source/WebKit/efl/ewk/ewk_settings.cpp
+++ b/Source/WebKit/efl/ewk/ewk_settings.cpp
@@ -47,6 +47,12 @@
 #include <libsoup/soup.h>
 #endif
 
+#if ENABLE(OFFLINE_WEB_APPLICATIONS)
+#include "appcache/ApplicationCacheStorage.h"
+
+static const char* _ewk_cache_directory_path = 0;
+#endif
+
 static const char* _ewk_default_web_database_path = 0;
 static const char* _ewk_icon_database_path = 0;
 static uint64_t _ewk_default_web_database_quota = 1 * 1024 * 1024;
@@ -81,7 +87,7 @@ static WTF::String _ewk_settings_webkit_os_version_get()
  *
  * @return the current default database quota in bytes
  */
-uint64_t ewk_settings_web_database_default_quota_get()
+uint64_t ewk_settings_web_database_default_quota_get(void)
 {
     return _ewk_default_web_database_quota;
 }
@@ -114,7 +120,7 @@ void ewk_settings_web_database_path_set(const char *path)
  *
  * @return database path or @c 0 if none or web database is not supported
  */
-const char *ewk_settings_web_database_path_get()
+const char *ewk_settings_web_database_path_get(void)
 {
 #if ENABLE(DATABASE)
     return _ewk_default_web_database_path;
@@ -133,7 +139,7 @@ const char *ewk_settings_web_database_path_get()
  */
 Eina_Bool ewk_settings_icon_database_path_set(const char *directory)
 {
-    WebCore::iconDatabase().delayDatabaseCleanup();
+    WebCore::IconDatabase::delayDatabaseCleanup();
 
     if (directory) {
         struct stat st;
@@ -155,7 +161,7 @@ Eina_Bool ewk_settings_icon_database_path_set(const char *directory)
         }
 
         WebCore::iconDatabase().setEnabled(true);
-        WebCore::iconDatabase().open(WTF::String::fromUTF8(directory));
+        WebCore::iconDatabase().open(WTF::String::fromUTF8(directory), WebCore::IconDatabase::defaultDatabaseFilename());
         if (!_ewk_icon_database_path)
             _ewk_icon_database_path = eina_stringshare_add(directory);
         else
@@ -225,7 +231,7 @@ cairo_surface_t* ewk_settings_icon_database_icon_surface_get(const char *url)
     EINA_SAFETY_ON_NULL_RETURN_VAL(url, 0);
 
     WebCore::KURL kurl(WebCore::KURL(), WTF::String::fromUTF8(url));
-    WebCore::Image *icon = WebCore::iconDatabase().iconForPageURL(kurl.string(), WebCore::IntSize(16, 16));
+    WebCore::Image *icon = WebCore::iconDatabase().synchronousIconForPageURL(kurl.string(), WebCore::IntSize(16, 16));
 
     if (!icon) {
         ERR("no icon for url %s", url);
@@ -257,7 +263,7 @@ Evas_Object* ewk_settings_icon_database_icon_object_add(const char* url, Evas* c
     EINA_SAFETY_ON_NULL_RETURN_VAL(canvas, 0);
 
     WebCore::KURL kurl(WebCore::KURL(), WTF::String::fromUTF8(url));
-    WebCore::Image* icon = WebCore::iconDatabase().iconForPageURL(kurl.string(), WebCore::IntSize(16, 16));
+    WebCore::Image* icon = WebCore::iconDatabase().synchronousIconForPageURL(kurl.string(), WebCore::IntSize(16, 16));
     cairo_surface_t* surface;
 
     if (!icon) {
@@ -300,7 +306,7 @@ void ewk_settings_proxy_uri_set(const char* proxy)
  *
  * @return current proxy URI or @c 0 if it's not set
  */
-const char* ewk_settings_proxy_uri_get()
+const char* ewk_settings_proxy_uri_get(void)
 {
 #if USE(SOUP)
     SoupURI* uri;
@@ -315,7 +321,7 @@ const char* ewk_settings_proxy_uri_get()
     WTF::String proxy = soup_uri_to_string(uri, EINA_FALSE);
     return eina_stringshare_add(proxy.utf8().data());
 #elif USE(CURL)
-    EINA_SAFETY_ON_TRUE_RETURN_VAL(1, NULL);
+    EINA_SAFETY_ON_TRUE_RETURN_VAL(1, 0);
 #endif
 }
 
@@ -326,10 +332,53 @@ const char* ewk_settings_proxy_uri_get()
  *
  * @return a pointer to an eina_stringshare containing the user agent string
  */
-const char* ewk_settings_default_user_agent_get()
+const char* ewk_settings_default_user_agent_get(void)
 {
     WTF::String ua_version = makeString(String::number(WEBKIT_USER_AGENT_MAJOR_VERSION), '.', String::number(WEBKIT_USER_AGENT_MINOR_VERSION), '+');
     WTF::String static_ua = makeString("Mozilla/5.0 (", _ewk_settings_webkit_platform_get(), "; ", _ewk_settings_webkit_os_version_get(), ") AppleWebKit/", ua_version) + makeString(" (KHTML, like Gecko) Version/5.0 Safari/", ua_version);
 
     return eina_stringshare_add(static_ua.utf8().data());
 }
+
+/**
+ * Sets cache directory.
+ *
+ * @param path where to store cache, must be write-able.
+ *
+ * @return @c EINA_TRUE on success, @c EINA_FALSE if path is NULL or offline
+ *         web application is not supported.
+ */
+Eina_Bool ewk_settings_cache_directory_path_set(const char *path)
+{
+#if ENABLE(OFFLINE_WEB_APPLICATIONS)
+    if (!path)
+        return EINA_FALSE;
+
+    WebCore::cacheStorage().setCacheDirectory(WTF::String::fromUTF8(path));
+    if (!_ewk_cache_directory_path)
+        _ewk_cache_directory_path = eina_stringshare_add(path);
+    else
+        eina_stringshare_replace(&_ewk_cache_directory_path, path);
+    return EINA_TRUE;
+#else
+    EINA_SAFETY_ON_TRUE_RETURN_VAL(1, EINA_FALSE);
+#endif
+}
+
+/**
+ * Return cache directory path.
+ *
+ * This is guaranteed to be eina_stringshare, so whenever possible
+ * save yourself some cpu cycles and use eina_stringshare_ref()
+ * instead of eina_stringshare_add() or strdup().
+ *
+ * @return cache directory path.
+ */
+const char *ewk_settings_cache_directory_path_get()
+{
+#if ENABLE(OFFLINE_WEB_APPLICATIONS)
+    return _ewk_cache_directory_path;
+#else
+    EINA_SAFETY_ON_TRUE_RETURN_VAL(1, 0);
+#endif
+}
diff --git a/Source/WebKit/efl/ewk/ewk_settings.h b/Source/WebKit/efl/ewk/ewk_settings.h
index 0a495da..3e5ca47 100644
--- a/Source/WebKit/efl/ewk/ewk_settings.h
+++ b/Source/WebKit/efl/ewk/ewk_settings.h
@@ -37,9 +37,9 @@ extern "C" {
  * @brief General purpose settings, not tied to any view object.
  */
 
-EAPI uint64_t         ewk_settings_web_database_default_quota_get();
+EAPI uint64_t         ewk_settings_web_database_default_quota_get(void);
 EAPI void             ewk_settings_web_database_path_set(const char *path);
-EAPI const char      *ewk_settings_web_database_path_get();
+EAPI const char      *ewk_settings_web_database_path_get(void);
 
 EAPI Eina_Bool        ewk_settings_icon_database_path_set(const char *path);
 EAPI const char      *ewk_settings_icon_database_path_get(void);
@@ -48,8 +48,11 @@ EAPI Eina_Bool        ewk_settings_icon_database_clear(void);
 EAPI cairo_surface_t *ewk_settings_icon_database_icon_surface_get(const char *url);
 EAPI Evas_Object     *ewk_settings_icon_database_icon_object_add(const char *url, Evas *canvas);
 
-EAPI void            ewk_settings_proxy_uri_set(const char* proxy);
-EAPI const char*     ewk_settings_proxy_uri_get();
+EAPI Eina_Bool        ewk_settings_cache_directory_path_set(const char *path);
+EAPI const char      *ewk_settings_cache_directory_path_get(void);
+
+EAPI void             ewk_settings_proxy_uri_set(const char* proxy);
+EAPI const char*      ewk_settings_proxy_uri_get(void);
 
 #ifdef __cplusplus
 }
diff --git a/Source/WebKit/efl/ewk/ewk_view.cpp b/Source/WebKit/efl/ewk/ewk_view.cpp
index ab0629a..8a3b04d 100644
--- a/Source/WebKit/efl/ewk/ewk_view.cpp
+++ b/Source/WebKit/efl/ewk/ewk_view.cpp
@@ -43,7 +43,6 @@
 #include "PlatformMouseEvent.h"
 #include "PopupMenuClient.h"
 #include "ProgressTracker.h"
-#include "appcache/ApplicationCacheStorage.h"
 #include "ewk_private.h"
 
 #include <Ecore.h>
@@ -95,13 +94,13 @@ struct _Ewk_View_Private_Data {
     unsigned int imh; /**< input method hints */
     struct {
         Eina_Bool view_cleared:1;
+        Eina_Bool need_touch_events:1;
     } flags;
     struct {
         const char* user_agent;
         const char* user_stylesheet;
         const char* encoding_default;
         const char* encoding_custom;
-        const char* cache_directory;
         const char* theme;
         const char* local_storage_database_path;
         int font_minimum_size;
@@ -584,9 +583,6 @@ static Ewk_View_Private_Data* _ewk_view_priv_new(Ewk_View_Smart_Data* sd)
         (priv->page_settings->defaultTextEncodingName().utf8().data());
     priv->settings.encoding_custom = 0;
 
-    priv->settings.cache_directory = eina_stringshare_add
-        (WebCore::cacheStorage().cacheDirectory().utf8().data());
-
     s = priv->page_settings->localStorageDatabasePath();
     priv->settings.local_storage_database_path = eina_stringshare_add(s.string().utf8().data());
 
@@ -672,7 +668,6 @@ static void _ewk_view_priv_del(Ewk_View_Private_Data* priv)
     eina_stringshare_del(priv->settings.user_stylesheet);
     eina_stringshare_del(priv->settings.encoding_default);
     eina_stringshare_del(priv->settings.encoding_custom);
-    eina_stringshare_del(priv->settings.cache_directory);
     eina_stringshare_del(priv->settings.font_standard);
     eina_stringshare_del(priv->settings.font_cursive);
     eina_stringshare_del(priv->settings.font_monospace);
@@ -2723,22 +2718,6 @@ Eina_Bool ewk_view_setting_encoding_detector_get(Evas_Object* o)
     return priv->settings.encoding_detector;
 }
 
-const char* ewk_view_setting_cache_directory_get(const Evas_Object* o)
-{
-    EWK_VIEW_SD_GET_OR_RETURN(o, sd, 0);
-    EWK_VIEW_PRIV_GET_OR_RETURN(sd, priv, 0);
-    return priv->settings.cache_directory;
-}
-
-Eina_Bool ewk_view_setting_cache_directory_set(Evas_Object* o, const char* path)
-{
-    EWK_VIEW_SD_GET_OR_RETURN(o, sd, EINA_FALSE);
-    EWK_VIEW_PRIV_GET_OR_RETURN(sd, priv, EINA_FALSE);
-    if (eina_stringshare_replace(&priv->settings.cache_directory, path))
-        WebCore::cacheStorage().setCacheDirectory(String::fromUTF8(path));
-    return EINA_TRUE;
-}
-
 int ewk_view_setting_font_minimum_size_get(const Evas_Object* o)
 {
     EWK_VIEW_SD_GET_OR_RETURN(o, sd, 0);
@@ -4305,7 +4284,7 @@ void ewk_view_viewport_attributes_get(Evas_Object *o, float* w, float* h, float*
     if (device_pixel_ratio)
         *device_pixel_ratio = attributes.devicePixelRatio;
     if (user_scalable)
-        *user_scalable = attributes.userScalable;
+        *user_scalable = static_cast<bool>(attributes.userScalable);
 }
 
 /**
@@ -4508,7 +4487,7 @@ WebCore::FloatRect ewk_view_page_rect_get(Evas_Object *o)
  *
  * @return device's dpi value.
  */
-int ewk_view_dpi_get()
+int ewk_view_dpi_get(void)
 {
 #ifdef HAVE_ECORE_X
      return ecore_x_dpi_get();
@@ -4516,3 +4495,20 @@ int ewk_view_dpi_get()
      return 160;
 #endif
 }
+
+#if ENABLE(TOUCH_EVENTS)
+void ewk_view_need_touch_events_set(Evas_Object* o, bool needed)
+{
+    EWK_VIEW_SD_GET(o, sd);
+    EWK_VIEW_PRIV_GET(sd, priv);
+
+    priv->flags.need_touch_events = needed;
+}
+
+Eina_Bool ewk_view_need_touch_events_get(Evas_Object* o)
+{
+    EWK_VIEW_SD_GET_OR_RETURN(o, sd, EINA_FALSE);
+    EWK_VIEW_PRIV_GET_OR_RETURN(sd, priv, EINA_FALSE);
+    return priv->flags.need_touch_events;
+}
+#endif
diff --git a/Source/WebKit/efl/ewk/ewk_view.h b/Source/WebKit/efl/ewk/ewk_view.h
index e487f5e..84beecd 100644
--- a/Source/WebKit/efl/ewk/ewk_view.h
+++ b/Source/WebKit/efl/ewk/ewk_view.h
@@ -450,8 +450,6 @@ EAPI const char  *ewk_view_setting_encoding_custom_get(const Evas_Object *o);
 EAPI Eina_Bool    ewk_view_setting_encoding_custom_set(Evas_Object *o, const char *encoding);
 EAPI const char  *ewk_view_setting_encoding_default_get(const Evas_Object *o);
 EAPI Eina_Bool    ewk_view_setting_encoding_default_set(Evas_Object *o, const char *encoding);
-EAPI const char  *ewk_view_setting_cache_directory_get(const Evas_Object *o);
-EAPI Eina_Bool    ewk_view_setting_cache_directory_set(Evas_Object *o, const char *path);
 
 EAPI int          ewk_view_setting_font_minimum_size_get(const Evas_Object *o);
 EAPI Eina_Bool    ewk_view_setting_font_minimum_size_set(Evas_Object *o, int size);
diff --git a/Source/WebKit/efl/ewk/ewk_window_features.cpp b/Source/WebKit/efl/ewk/ewk_window_features.cpp
index 3855e89..4a311dc 100644
--- a/Source/WebKit/efl/ewk/ewk_window_features.cpp
+++ b/Source/WebKit/efl/ewk/ewk_window_features.cpp
@@ -26,17 +26,21 @@
 
 #include <Eina.h>
 
+/**
+ * \struct  _Ewk_Window_Features
+ * @brief   Contains the window features data.
+ */
 struct _Ewk_Window_Features {
     unsigned int __ref;
     WebCore::WindowFeatures* core;
 };
 
 /**
- * Decrease the ref count of an Ewk_Window_Features, possibly freeing it.
+ * Decreases the referece count of an Ewk_Window_Features, possibly freeing it.
  *
- * When its ref count reaches 0, @param window_features is freed.
+ * When the reference count of the object reaches 0, the one is freed.
  *
- * @param window_features The window's features.
+ * @param window_features the object to decrease reference count
  */
 EAPI void ewk_window_features_unref(Ewk_Window_Features* window_features)
 {
@@ -52,9 +56,9 @@ EAPI void ewk_window_features_unref(Ewk_Window_Features* window_features)
 }
 
 /**
- * Increase the ref count of an Ewk_Window_Features
+ * Increases the reference count of an Ewk_Window_Features.
  *
- * @param window_features The window's features.
+ * @param window_features the object to increase reference count
  */
 EAPI void ewk_window_features_ref(Ewk_Window_Features* window_features)
 {
@@ -63,15 +67,20 @@ EAPI void ewk_window_features_ref(Ewk_Window_Features* window_features)
 }
 
 /**
- * Get boolean properties
+ * Gets boolean properties of an Ewk_Window_Features.
+ *
+ * Properties are returned in the respective pointers. Passing @c 0 to any of
+ * these pointers will make that property to not be returned.
  *
- * @param window_features A window_features.
- * @param toolbar_visible pointer to store if toolbar is visible.
- * @param statusbar_visible pointer to store if statusbar is visible.
- * @param scrollbars_visible pointer to store if scrollbars is visible.
- * @param menubar_visible pointer to store if menubar is visible.
- * @param locationbar_visible pointer to store if locationbar is visible.
- * @param fullscreen pointer to store if fullscreen is enabled.
+ * @param window_features the object to get boolean properties
+ * @param toolbar_visible the pointer to store if toolbar is visible
+ * @param statusbar_visible the pointer to store if statusbar is visible
+ * @param scrollbars_visible the pointer to store if scrollbars is visible
+ * @param menubar_visible the pointer to store if menubar is visible
+ * @param locationbar_visible the pointer to store if locationbar is visible
+ * @param fullscreen the pointer to store if fullscreen is enabled
+ *
+ * @see ewk_window_features_int_property_get
  */
 EAPI void ewk_window_features_bool_property_get(Ewk_Window_Features* window_features, Eina_Bool* toolbar_visible, Eina_Bool* statusbar_visible, Eina_Bool* scrollbars_visible, Eina_Bool* menubar_visible, Eina_Bool* locationbar_visible, Eina_Bool* fullscreen)
 {
@@ -98,18 +107,21 @@ EAPI void ewk_window_features_bool_property_get(Ewk_Window_Features* window_feat
 }
 
 /**
- * Get int properties
+ * Gets int properties of an Ewk_Window_Features.
+ *
+ * Properties are returned in the respective pointers. Passing @c 0 to any of
+ * these pointers will make that property to not be returned.
+ *
+ * Make sure to check if the value returned is less than 0 before using it, since in
+ * that case it means that property was not set in winwdow_features object.
  *
- * Properties are returned in the respective pointers. Passing NULL to any of
- * these pointers will make that property to not be returned. Make sure to check
- * if the value returned is less than 0 before using it, since in that case it
- * means that property was not set in @param winwdow_features.
+ * @param window_features the window's features
+ * @param x the pointer to store x position
+ * @param y the pointer to store y position
+ * @param w the pointer to store width
+ * @param h the pointer to store height
  *
- * @param window_features A window_features.
- * @param x pointer to store x position or -1 if it's not set in window_features.
- * @param y pointer to store y position or-1 if it's not set in window_features.
- * @param w pointer to store width or-1 if it's not set in window_features.
- * @param h pointer to store height or-1 if it's not set in window_features.
+ * @see ewk_window_features_bool_property_get
  */
 EAPI void ewk_window_features_int_property_get(Ewk_Window_Features* window_features, int* x, int* y, int* w, int* h)
 {
@@ -133,13 +145,12 @@ EAPI void ewk_window_features_int_property_get(Ewk_Window_Features* window_featu
 
 /**
  * @internal
- * Create a new Ewk_Window_Features from a WebCore::WindowFeatures if @param
- * core is not NULL or a new one with default features.
  *
- * A new WebCore::WindowFeatures is allocated copying @param core features and
- * it is embedded inside an Ewk_Window_Features whose ref count is initialized.
+ * Creates a new Ewk_Window_Features object.
  *
- * @returns a new allocated Ewk_Window_Features
+ * @param core if not @c 0 a new WebCore::WindowFeatures is allocated copying core features and
+ * it is embedded inside the Ewk_Window_Features whose ref count is initialized, if core is @c 0 a new one is created with the default features.
+ * @returns a new allocated the Ewk_Window_Features object
  */
 Ewk_Window_Features* ewk_window_features_new_from_core(const WebCore::WindowFeatures* core)
 {
diff --git a/Source/WebKit/efl/ewk/ewk_window_features.h b/Source/WebKit/efl/ewk/ewk_window_features.h
index b579dc4..0501881 100644
--- a/Source/WebKit/efl/ewk/ewk_window_features.h
+++ b/Source/WebKit/efl/ewk/ewk_window_features.h
@@ -18,6 +18,11 @@
     Boston, MA 02110-1301, USA.
 */
 
+/**
+ * @file    ewk_window_features.h
+ * @brief   Access to the features of window.
+ */
+
 #ifndef ewk_window_features_h
 #define ewk_window_features_h
 
@@ -29,6 +34,7 @@
 extern "C" {
 #endif
 
+/** Creates a type name for _Ewk_Window_Features. */
 typedef struct _Ewk_Window_Features Ewk_Window_Features;
 
 EAPI void         ewk_window_features_unref(Ewk_Window_Features* window_features);
diff --git a/Source/WebKit/gtk/ChangeLog b/Source/WebKit/gtk/ChangeLog
index d5cfb4d..88452c2 100644
--- a/Source/WebKit/gtk/ChangeLog
+++ b/Source/WebKit/gtk/ChangeLog
@@ -1,3 +1,337 @@
+2011-03-30  Martin Robinson  <mrobinson@igalia.com>
+
+        Reviewed by Dirk Schulze.
+
+        [Cairo] Better separate the concerns of GraphicsContextCairo
+        https://bugs.webkit.org/show_bug.cgi?id=55150
+
+        Add a PlatformContextCairo which right now stores the cairo_t* for a
+        GraphicsContextCairo. Later patches will move logic for tracking ContextShadow
+        and image masking layers into this PlatformContextCairo class.
+
+        * webkit/webkitwebframe.cpp:
+        (draw_page_callback):
+        * webkit/webkitwebview.cpp:
+        (webkit_web_view_expose_event):
+        (webkit_web_view_draw):
+
+2011-03-29  Philippe Normand  <pnormand@igalia.com>
+
+        Unreviewed, disable an assert in testwebview due to
+        https://bugs.webkit.org/show_bug.cgi?id=57315
+
+        * tests/testwebview.c:
+
+2011-03-28  Adele Peterson  <adele@apple.com>
+
+        Build fix.
+
+        * WebCoreSupport/DumpRenderTreeSupportGtk.cpp:
+        (DumpRenderTreeSupportGtk::webkitWebFrameSelectionHasSpellingMarker):
+
+2011-03-28  Sergio Villar Senin  <svillar@igalia.com>
+
+        Reviewed by Martin Robinson.
+
+        [GTK] Fullscreen tests failing after r82084
+        https://bugs.webkit.org/show_bug.cgi?id=57219
+
+        Added the withKeyboard parameter to supportsFullScreenForElement
+        method in ChromeClient. Fullscreen will be disabled for keyboard
+        access by default.
+
+        * WebCoreSupport/ChromeClientGtk.cpp:
+        (WebKit::ChromeClient::supportsFullScreenForElement):
+        * WebCoreSupport/ChromeClientGtk.h:
+
+2011-03-25  Andy Estes  <aestes@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        REGRESSION (r70748): latest nightly builds kills AC_QuickTime.js
+        https://bugs.webkit.org/show_bug.cgi?id=49016
+
+        Update objectContentType() implementation to handle the
+        shouldPreferPlugInsForImages flag.
+
+        * WebCoreSupport/FrameLoaderClientGtk.cpp:
+        (WebKit::FrameLoaderClient::objectContentType):
+        * WebCoreSupport/FrameLoaderClientGtk.h:
+
+2011-03-25  Priit Laes  <plaes@plaes.org>
+
+        Reviewed by Martin Robinson.
+
+        [GTK] [PATCH] Avoid critical warning when free-ing list of plugins
+        https://bugs.webkit.org/show_bug.cgi?id=57025
+
+        * webkit/webkitwebplugindatabase.cpp:
+        (webkit_web_plugin_database_plugins_list_free):
+        Use regular check and return instead of g_return_if_fail.
+
+2011-03-24  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r81916 and r81917.
+        http://trac.webkit.org/changeset/81916
+        http://trac.webkit.org/changeset/81917
+        https://bugs.webkit.org/show_bug.cgi?id=57071
+
+        broke a test on platforms that do not have QuickTime installed
+        (Requested by estes on #webkit).
+
+        * WebCoreSupport/FrameLoaderClientGtk.cpp:
+        (WebKit::FrameLoaderClient::objectContentType):
+        * WebCoreSupport/FrameLoaderClientGtk.h:
+
+2011-03-24  Andy Estes  <aestes@apple.com>
+
+        Reviewed by Darin Adler.
+
+        REGRESSION (r70748): latest nightly builds kills AC_QuickTime.js
+        https://bugs.webkit.org/show_bug.cgi?id=49016
+
+        Update objectContentType() implementation to handle the
+        shouldPreferPlugInsForImages flag.
+
+        * WebCoreSupport/FrameLoaderClientGtk.cpp:
+        (WebKit::FrameLoaderClient::objectContentType):
+        * WebCoreSupport/FrameLoaderClientGtk.h:
+
+2011-03-23  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Change IconDatabase opening to allow for arbitrary filenames
+        https://bugs.webkit.org/show_bug.cgi?id=56977
+
+        * webkit/webkiticondatabase.cpp:
+        (webkit_icon_database_set_path):
+
+2011-03-22  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Rubber-stamped by Xan Lopez.
+
+        Applications that include WebKit headers fail to build when using strict warnings
+        because the signature for webkit_application_cache_get_maximum_size is missing a
+        'void' to make it explicit it takes no arguments.
+
+        * webkit/webkitapplicationcache.h:
+
+2011-03-21  Alejandro G. Castro  <alex@igalia.com>
+
+        Reviewed by Martin Robinson.
+
+        [GTK] 1.3.13 release bump
+        https://bugs.webkit.org/show_bug.cgi?id=56795
+
+        Version bump for 1.3.13 and updated NEWS file with release notes.
+
+        * NEWS:
+
+2011-03-21  Chang Shu  <cshu@webkit.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        REGRESSION (r79953): Can't type in MS Outlook 2011
+        https://bugs.webkit.org/show_bug.cgi?id=56665
+
+        r79953 removed the WebView level editablity which is persistent no matter whether
+        underlying document itself is changed and editability gets lost. The resolution is to
+        set this WebView editable value to WebCore. This avoids the callback from WebCore to
+        WebKit which was the main goal in r79953 to improve performance.
+
+        * webkit/webkitwebview.cpp:
+        (webkit_web_view_get_editable):
+        (webkit_web_view_set_editable):
+
+2011-03-21  Mario Sanchez Prada  <msanchez@igalia.com>
+
+        Reviewed by Martin Robinson.
+
+        [GTK] [Stable] AtkHypertext exposes wrong offsets for links placed inside <span> nodes
+        https://bugs.webkit.org/show_bug.cgi?id=56737
+
+        * tests/testatk.c:
+        (testWebkitAtkHypertextAndHyperlinks): Updated unit test to also
+        check offsets for hyperlinks inside <span> nodes.
+
+2011-03-18  David Keijser  <keijser@gmail.com> and Xan Lopez <xlopez@igalia.com>
+
+        Reviewed by Martin Robinson.
+
+        [GTK] On-demand event-listeners for DOM event signals
+        https://bugs.webkit.org/show_bug.cgi?id=49649
+
+        * tests/testdomdomwindow.c: update unit tests for new APIs.
+        (load_event_callback): ditto.
+        (test_dom_domview_signals): ditto.
+        (load_status_callback): ditto.
+
+2011-03-17  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=56425
+        More groundwork for WebKit2 IconDatabase
+
+        Update already-used function names:
+        * webkit/webkiticondatabase.cpp:
+        (webkit_icon_database_get_icon_uri):
+        (webkit_icon_database_get_icon_pixbuf):
+        * webkit/webkitwebview.cpp:
+        (webkit_web_view_get_icon_uri):
+
+2011-03-16  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Viewport no longer allows an auto value for "user-scalable"
+        https://bugs.webkit.org/show_bug.cgi?id=55416
+
+        Make the default value for userScalable be true.
+
+        * WebCoreSupport/DumpRenderTreeSupportGtk.cpp:
+        (DumpRenderTreeSupportGtk::dumpConfigurationForViewport): update test output to include userScalable.
+        * webkit/webkitviewportattributes.cpp:
+        (webkitViewportAttributesRecompute):
+
+2011-03-15  Ilya Sherman  <isherman@chromium.org>
+
+        Reviewed by Tony Chang.
+
+        Autofilled form elements are assigned fixed background color but not text color
+        https://bugs.webkit.org/show_bug.cgi?id=48382
+
+        * WebCoreSupport/DumpRenderTreeSupportGtk.cpp:
+        (DumpRenderTreeSupportGtk::setAutofilled): Added.
+        * WebCoreSupport/DumpRenderTreeSupportGtk.h:
+
+2011-03-14  Ryuan Choi  <ryuan.choi@samsung.com>
+
+        Reviewed by Martin Robinson.
+
+        [GTK] Possible leaks after splitting TextCheckerClientEnchant.
+        https://bugs.webkit.org/show_bug.cgi?id=55989
+
+        Convert gchar* to GOwnPtr<gchar> and refactor the code.
+
+        * WebCoreSupport/TextCheckerClientEnchant.cpp:
+        (WebKit::TextCheckerClientEnchant::checkSpellingOfString):
+
+2011-03-11  Marco Peereboom  <marco@peereboom.us>
+
+        Reviewed by Gustavo Noronha Silva.
+
+        Provide a knob to enable/disable DNS prefetching.
+        DNS prefetching is enabled by default.
+        https://bugs.webkit.org/show_bug.cgi?id=55973
+
+        * webkit/webkitwebsettings.cpp:
+        (webkit_web_settings_class_init):
+        (webkit_web_settings_set_property):
+        (webkit_web_settings_get_property):
+        (webkit_web_settings_copy):
+        * webkit/webkitwebview.cpp:
+        (webkit_web_view_update_settings):
+        (webkit_web_view_settings_notify):
+
+2011-03-08  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Martin Robinson.
+
+        [GTK] close-web-view emitted on disposed WebView
+        https://bugs.webkit.org/show_bug.cgi?id=55932
+
+        * WebCoreSupport/ChromeClientGtk.cpp:
+        (ChromeClient::chromeDestroyed): Remove the closeSoonTimer glib
+        source before destruction of the ChromeClient.
+
+2011-03-11  Roland Steiner  <rolandsteiner@chromium.org>
+
+        Reviewed by Ryosuke Niwa.
+
+        Bug 55570 - Remove dependency of dom/InputElement.cpp on html/ and wml/
+        https://bugs.webkit.org/show_bug.cgi?id=55570
+
+        Add a virtual function toInputElement() to Node that has a default
+        implementation of returning 0.
+        For HTMLInputElement and WMLInputElement (which derive from InputElement)
+        override this to return the object.
+        Change all calling sites of the old toInputElement to use the new member
+        function. This also allows us to save some casts.
+
+        No new tests (refactoring).
+
+        * src/WebInputElement.cpp:
+        (WebKit::toWebInputElement):
+
+        * WebCoreSupport/DumpRenderTreeSupportGtk.cpp:
+        (DumpRenderTreeSupportGtk::setValueForUser):
+
+2011-03-10  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] unittests/testapplicationcache crashes
+        https://bugs.webkit.org/show_bug.cgi?id=56083
+
+        Removed the webkit_application_cache_get_database_directory_path
+        API as the underlying ApplicationCacheStorage doesn't allow
+        setting the cache path multiple times.
+
+        * tests/testapplicationcache.c:
+        (main):
+        * webkit/webkitapplicationcache.cpp:
+        (webkit_application_cache_get_database_directory_path):
+        * webkit/webkitapplicationcache.h:
+        * webkit/webkitglobals.cpp:
+        (webkitInit):
+
+2011-03-09  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Mihai Parparita.
+
+        Unify Windows version checks.
+        https://bugs.webkit.org/show_bug.cgi?id=55979
+
+        * webkit/webkitwebsettings.cpp:
+        (webkitOSVersion):
+
+2011-03-08  Christian Dywan  <christian@lanedo.com>
+
+        Reviewed by Martin Robinson.
+
+        [GTK] provide an API to control the IconDatabase
+        https://bugs.webkit.org/show_bug.cgi?id=32510
+
+        * GNUmakefile.am:
+        * WebCoreSupport/FrameLoaderClientGtk.cpp: Emit signals on
+            the icon database for new icons.
+        * webkit/webkit.h:
+        * webkit/webkitdefines.h:
+        * webkit/webkitglobals.cpp:
+        * webkit/webkitglobals.h: Add a function to obtain the global
+            icon database.
+        * webkit/webkiticondatabase.cpp:
+        * webkit/webkiticondatabase.h: Implement public icon database
+            object with methods for obtaining icon URLs, pixbufs, clearing
+            waiting for new icons.
+        * webkit/webkitwebview.cpp:
+        * webkit/webkitwebview.h: Add a method to obtain an icon pixbuf
+            for the web view.
+2011-03-08  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        Reviewed by Martin Robinson.
+
+        [GTK] Add layoutTestController.setValueForUser() after r80412
+        https://bugs.webkit.org/show_bug.cgi?id=55862
+
+        Add setValueForUser method to DumpRenderTreeSupportGTK.
+
+        * WebCoreSupport/DumpRenderTreeSupportGtk.cpp:
+        (DumpRenderTreeSupportGtk::setValueForUser):
+        * WebCoreSupport/DumpRenderTreeSupportGtk.h:
+
 2011-03-07  Sam Weinig  <sam@webkit.org>
 
         Reviewed by Anders Carlsson.
diff --git a/Source/WebKit/gtk/GNUmakefile.am b/Source/WebKit/gtk/GNUmakefile.am
index 42ac1e4..7030ea8 100644
--- a/Source/WebKit/gtk/GNUmakefile.am
+++ b/Source/WebKit/gtk/GNUmakefile.am
@@ -116,6 +116,7 @@ webkitgtk_static_h_api += \
 	$(srcdir)/Source/WebKit/gtk/webkit/webkitgeolocationpolicydecision.h \
 	$(srcdir)/Source/WebKit/gtk/webkit/webkitglobals.h \
 	$(srcdir)/Source/WebKit/gtk/webkit/webkithittestresult.h \
+	$(srcdir)/Source/WebKit/gtk/webkit/webkiticondatabase.h \
 	$(srcdir)/Source/WebKit/gtk/webkit/webkitnetworkrequest.h \
 	$(srcdir)/Source/WebKit/gtk/webkit/webkitnetworkresponse.h \
 	$(srcdir)/Source/WebKit/gtk/webkit/webkitsecurityorigin.h \
@@ -203,6 +204,7 @@ webkitgtk_sources += \
 	Source/WebKit/gtk/webkit/webkitglobalsprivate.h \
 	Source/WebKit/gtk/webkit/webkithittestresult.cpp \
 	Source/WebKit/gtk/webkit/webkithittestresultprivate.h \
+	Source/WebKit/gtk/webkit/webkiticondatabase.cpp \
 	Source/WebKit/gtk/webkit/webkitnetworkrequest.cpp \
 	Source/WebKit/gtk/webkit/webkitnetworkrequestprivate.h \
 	Source/WebKit/gtk/webkit/webkitnetworkresponse.cpp \
diff --git a/Source/WebKit/gtk/NEWS b/Source/WebKit/gtk/NEWS
index a7e4581..c847f01 100644
--- a/Source/WebKit/gtk/NEWS
+++ b/Source/WebKit/gtk/NEWS
@@ -1,4 +1,55 @@
 =================
+WebKitGTK+ 1.3.13
+=================
+
+What's new in WebKitGTK+ 1.3.13?
+
+In this release the GObject DOM Bindings contain a major change. Explicit
+invocation of DOM objects' addEventListener methods has replaced the GObject
+signal method of DOM event handling. For intance, where before a developer
+would connect to the "click-event" signal, a developer must now call:
+webkit_dom_event_target_add_event_listener. For a more illustrative example see:
+http://trac.webkit.org/changeset/81486/trunk/Source/WebKit/gtk/tests/testdomdomwindow.c
+
+Added API to control the IconDatabase and the cache database APIs.
+
+WebKit bugs mostly relevant with the GTK+ port fixed since 1.3.12:
+
+Bug 23526 - [CAIRO] Support ImageBuffers clip operation on all Cairo ports (Martin Robinson)
+Bug 56180 - [GTK] JSC crashes in 32bit Release bots after r80743 (Martin Robinson)
+Bug 56180 - [GTK] JSC crashes in 32bit Release bots after r80743 (Geoffrey Garen)
+Bug 49649 - [GTK] On-demand event-listeners for DOM event signals (David Keijser)
+Bug 56333 - [GTK] [WebKit2] The UIProcess never changes the mouse cursor (Martin Robinson)
+Bug 55989 - [GTK] Possible leaks after splitting TextCheckerClientEnchant. (Ryuan Choi)
+Bug 50497 - Add all web audio auto-generated files to GTK make system (Chris Rogers)
+Bug 56180 - [GTK] JSC crashes in 32bit Release bots after r80743 (Sergio Villar Senin)
+Bug 55932 - [GTK] close-web-view emitted on disposed WebView (Philippe Normand)
+Bug 53098 - [GTK] Implement spin buttons for GTK+ 2.x (Martin Robinson)
+Bug 56125 - [GTK] [Webkit2] There are no scrollbars visible in the MiniBrowser (Martin Robinson)
+Bug 41903 - [GTK] plugins/return-negative-one-from-write.html crashes (Martin Robinson)
+Bug 32510 - [GTK] provide an API to control the IconDatabase (Christian Dywan)
+Bug 55868 - [GTK] Do not set juntion sides on scrollbar stepper buttons (Carlos Garcia Campos)
+Bug 55866 - [GTK] Use doubles instead of integers for coordinates when rendering arrows (Carlos Garcia Campos)
+Bug 55878 - [Gtk] toDataURL uses incorrect quality value when saving GdkPixbuf to buffer (Zan Dobersek)
+Bug 55531 - [GTK] Windowless plugins override the view cursor (Martin Robinson)
+Bug 55136 - Enable Copy Image Address context menu item in the Gtk port (Christian Dywan)
+Bug 53960 - [GTK] DRT needs implementation of EventSender.scheduleAsynchronousClick (Carlos Garcia Campos)
+Bug 55335 - [GTK] Extended application cache database API and added unit tests file. (Lukasz Slachciak)
+Bug 53146 - [GTK] Combo boxes should emit object:selection-changed even when collapsed (Mario Sanchez Prada)
+Bug 55473 - [GTK] Add support for external protocol handlers (Sergio Villar Senin)
+Bug 53228 - [Gtk] Resource size is incorrectly reported to WebCore (Sergio Villar Senin)
+Bug 48510 - [GTK] Implement WebContext and NativeKeyboardEvent classes for WebKit2 (Amruth Raj)
+Bug 48509 - [GTK] Implement WebView and WebKitWebView classes for WebKit2 (Amruth Raj)
+Bug 48510 - [GTK] Implement WebEventFactory, WebErrors classes for WebKit2 ( Amruth Raj)
+Bug 54658 - [gtk] Failing collinear arcTo canvas tests (Zan Dobersek)
+Bug 37769 - [Gtk] Flash item placed on wrong location right after load (Martin Robinson)
+Bug 54981 - [GTK] position:fixed elements flicker while scrolling after r74196 (Martin Robinson)
+Bug 56180 - [GTK] JSC crashes in 32bit Release bots after r80743 (Oliver Hunt)
+Bug 56737 - [GTK] [Stable] AtkHypertext exposes wrong offsets for links placed inside <span> nodes (Mario Sanchez Prada)
+Bug 56201 - WebKitIconDatabase may trigger crash in cairoImageSurfaceToGdkPixbuf (Christian Dywan)
+Bug 56690 - Stop inserting when the parent is removed (Justin Schuh)
+
+=================
 WebKitGTK+ 1.3.12
 =================
 
diff --git a/Source/WebKit/gtk/WebCoreSupport/ChromeClientGtk.cpp b/Source/WebKit/gtk/WebCoreSupport/ChromeClientGtk.cpp
index 8e828ac..9f21139 100644
--- a/Source/WebKit/gtk/WebCoreSupport/ChromeClientGtk.cpp
+++ b/Source/WebKit/gtk/WebCoreSupport/ChromeClientGtk.cpp
@@ -79,6 +79,9 @@ ChromeClient::ChromeClient(WebKitWebView* webView)
 
 void ChromeClient::chromeDestroyed()
 {
+    if (m_closeSoonTimer)
+        g_source_remove(m_closeSoonTimer);
+
     delete this;
 }
 
@@ -720,8 +723,11 @@ void ChromeClient::exitFullscreenForNode(Node* node)
 #endif
 
 #if ENABLE(FULLSCREEN_API)
-bool ChromeClient::supportsFullScreenForElement(const WebCore::Element* element)
+bool ChromeClient::supportsFullScreenForElement(const WebCore::Element* element, bool withKeyboard)
 {
+    if (withKeyboard)
+        return false;
+
     return true;
 }
 
diff --git a/Source/WebKit/gtk/WebCoreSupport/ChromeClientGtk.h b/Source/WebKit/gtk/WebCoreSupport/ChromeClientGtk.h
index 462ddc4..2bf81eb 100644
--- a/Source/WebKit/gtk/WebCoreSupport/ChromeClientGtk.h
+++ b/Source/WebKit/gtk/WebCoreSupport/ChromeClientGtk.h
@@ -145,7 +145,7 @@ namespace WebKit {
 #endif
 
 #if ENABLE(FULLSCREEN_API)
-        virtual bool supportsFullScreenForElement(const WebCore::Element*);
+        virtual bool supportsFullScreenForElement(const WebCore::Element*, bool withKeyboard);
         virtual void enterFullScreenForElement(WebCore::Element*);
         virtual void exitFullScreenForElement(WebCore::Element*);
 #endif
diff --git a/Source/WebKit/gtk/WebCoreSupport/DumpRenderTreeSupportGtk.cpp b/Source/WebKit/gtk/WebCoreSupport/DumpRenderTreeSupportGtk.cpp
index 6db2c81..1336f11 100644
--- a/Source/WebKit/gtk/WebCoreSupport/DumpRenderTreeSupportGtk.cpp
+++ b/Source/WebKit/gtk/WebCoreSupport/DumpRenderTreeSupportGtk.cpp
@@ -34,6 +34,8 @@
 #include "FrameView.h"
 #include "GCController.h"
 #include "GraphicsContext.h"
+#include "HTMLInputElement.h"
+#include "InputElement.h"
 #include "JSDOMWindow.h"
 #include "JSDocument.h"
 #include "JSElement.h"
@@ -98,11 +100,6 @@ bool DumpRenderTreeSupportGtk::linksIncludedInFocusChain()
     return s_linksIncludedInTabChain;
 }
 
-void DumpRenderTreeSupportGtk::setIconDatabaseEnabled(bool enabled)
-{
-    WebKit::setIconDatabaseEnabled(enabled);
-}
-
 void DumpRenderTreeSupportGtk::setSelectTrailingWhitespaceEnabled(bool enabled)
 {
     s_selectTrailingWhitespaceEnabled = enabled;
@@ -629,7 +626,7 @@ void DumpRenderTreeSupportGtk::dumpConfigurationForViewport(WebKitWebView* webVi
     ViewportArguments arguments = webView->priv->corePage->mainFrame()->document()->viewportArguments();
     ViewportAttributes attrs = computeViewportAttributes(arguments, /* default layout width for non-mobile pages */ 980, deviceWidth, deviceHeight, deviceDPI, IntSize(availableWidth, availableHeight));
 
-    fprintf(stdout, "viewport size %dx%d scale %f with limits [%f, %f]\n", attrs.layoutSize.width(), attrs.layoutSize.height(), attrs.initialScale, attrs.minimumScale, attrs.maximumScale);
+    fprintf(stdout, "viewport size %dx%d scale %f with limits [%f, %f] and userScalable %f\n", attrs.layoutSize.width(), attrs.layoutSize.height(), attrs.initialScale, attrs.minimumScale, attrs.maximumScale, attrs.userScalable);
 }
 
 void DumpRenderTreeSupportGtk::clearOpener(WebKitWebFrame* frame)
@@ -652,7 +649,7 @@ bool DumpRenderTreeSupportGtk::webkitWebFrameSelectionHasSpellingMarker(WebKitWe
 {
     g_return_val_if_fail(WEBKIT_IS_WEB_FRAME(frame), FALSE);
 
-    return core(frame)->editor()->selectionStartHasSpellingMarkerFor(from, length);
+    return core(frame)->editor()->selectionStartHasMarkerFor(DocumentMarker::Spelling, from, length);
 }
 
 bool DumpRenderTreeSupportGtk::findString(WebKitWebView* webView, const gchar* targetString, WebKitFindOptions findOptions)
@@ -669,3 +666,32 @@ void DumpRenderTreeSupportGtk::setMinimumTimerInterval(WebKitWebView* webView, d
 {
     core(webView)->settings()->setMinDOMTimerInterval(interval);
 }
+
+void DumpRenderTreeSupportGtk::setAutofilled(JSContextRef context, JSValueRef nodeObject, bool autofilled)
+{
+    JSC::ExecState* exec = toJS(context);
+    Element* element = toElement(toJS(exec, nodeObject));
+    if (!element)
+        return;
+    InputElement* inputElement = element->toInputElement();
+    if (!inputElement)
+        return;
+
+    static_cast<HTMLInputElement*>(inputElement)->setAutofilled(autofilled);
+}
+
+void DumpRenderTreeSupportGtk::setValueForUser(JSContextRef context, JSValueRef nodeObject, JSStringRef value)
+{
+    JSC::ExecState* exec = toJS(context);
+    Element* element = toElement(toJS(exec, nodeObject));
+    if (!element)
+        return;
+    InputElement* inputElement = element->toInputElement();
+    if (!inputElement)
+        return;
+
+    size_t bufferSize = JSStringGetMaximumUTF8CStringSize(value);
+    GOwnPtr<gchar> valueBuffer(static_cast<gchar*>(g_malloc(bufferSize)));
+    JSStringGetUTF8CString(value, valueBuffer.get(), bufferSize);
+    inputElement->setValueForUser(String::fromUTF8(valueBuffer.get()));
+}
diff --git a/Source/WebKit/gtk/WebCoreSupport/DumpRenderTreeSupportGtk.h b/Source/WebKit/gtk/WebCoreSupport/DumpRenderTreeSupportGtk.h
index 595d6da..7ad5af6 100644
--- a/Source/WebKit/gtk/WebCoreSupport/DumpRenderTreeSupportGtk.h
+++ b/Source/WebKit/gtk/WebCoreSupport/DumpRenderTreeSupportGtk.h
@@ -53,7 +53,6 @@ public:
 
     static void setLinksIncludedInFocusChain(bool);
     static bool linksIncludedInFocusChain();
-    static void setIconDatabaseEnabled(bool);
     static void setSelectTrailingWhitespaceEnabled(bool);
     static bool selectTrailingWhitespaceEnabled();
 
@@ -85,6 +84,8 @@ public:
     static AtkObject* getFocusedAccessibleElement(WebKitWebFrame*);
     static AtkObject* getRootAccessibleElement(WebKitWebFrame*);
     static void layoutFrame(WebKitWebFrame*);
+    static void setAutofilled(JSContextRef, JSValueRef, bool);
+    static void setValueForUser(JSContextRef, JSValueRef, JSStringRef);
 
     // WebKitWebView
     static void executeCoreCommandByName(WebKitWebView*, const gchar* name, const gchar* value);
diff --git a/Source/WebKit/gtk/WebCoreSupport/FrameLoaderClientGtk.cpp b/Source/WebKit/gtk/WebCoreSupport/FrameLoaderClientGtk.cpp
index d8ea90e..ca8bf9a 100644
--- a/Source/WebKit/gtk/WebCoreSupport/FrameLoaderClientGtk.cpp
+++ b/Source/WebKit/gtk/WebCoreSupport/FrameLoaderClientGtk.cpp
@@ -6,6 +6,7 @@
  *  Copyright (C) 2009, 2010 Gustavo Noronha Silva <gns@gnome.org>
  *  Copyright (C) Research In Motion Limited 2009. All rights reserved.
  *  Copyright (C) 2010 Igalia S.L.
+ *  Copyright (C) 2011 Apple Inc. All rights reserved.
  *
  *  This library is free software; you can redistribute it and/or
  *  modify it under the terms of the GNU Lesser General Public
@@ -65,6 +66,7 @@
 #include "webkiterror.h"
 #include "webkitglobals.h"
 #include "webkitglobalsprivate.h"
+#include "webkiticondatabase.h"
 #include "webkitnetworkrequest.h"
 #include "webkitnetworkrequestprivate.h"
 #include "webkitnetworkresponse.h"
@@ -710,9 +712,9 @@ PassRefPtr<Widget> FrameLoaderClient::createJavaAppletWidget(const IntSize& plug
     return FrameLoaderClient::createPlugin(pluginSize, element, baseURL, paramNames, paramValues, "application/x-java-applet", false);
 }
 
-ObjectContentType FrameLoaderClient::objectContentType(const KURL& url, const String& mimeType)
+ObjectContentType FrameLoaderClient::objectContentType(const KURL& url, const String& mimeType, bool shouldPreferPlugInsForImages)
 {
-    return FrameLoader::defaultObjectContentType(url, mimeType);
+    return FrameLoader::defaultObjectContentType(url, mimeType, shouldPreferPlugInsForImages);
 }
 
 String FrameLoaderClient::overrideMediaType() const
@@ -925,6 +927,10 @@ void FrameLoaderClient::dispatchDidReceiveIcon()
     if (m_loadingErrorPage)
         return;
 
+    const gchar* frameURI = webkit_web_frame_get_uri(m_frame);
+    WebKitIconDatabase* database = webkit_get_icon_database();
+    g_signal_emit_by_name(database, "icon-loaded", m_frame, frameURI);
+
     WebKitWebView* webView = getViewFromFrame(m_frame);
 
     // Avoid reporting favicons for non-main frames.
diff --git a/Source/WebKit/gtk/WebCoreSupport/FrameLoaderClientGtk.h b/Source/WebKit/gtk/WebCoreSupport/FrameLoaderClientGtk.h
index 3340837..b7ead7a 100644
--- a/Source/WebKit/gtk/WebCoreSupport/FrameLoaderClientGtk.h
+++ b/Source/WebKit/gtk/WebCoreSupport/FrameLoaderClientGtk.h
@@ -1,6 +1,6 @@
 /*
  * Copyright (C) 2006 Zack Rusin <zack@kde.org>
- * Copyright (C) 2006 Apple Computer, Inc.  All rights reserved.
+ * Copyright (C) 2006, 2011 Apple Inc. All rights reserved.
  * Copyright (C) 2008 Collabora Ltd. All rights reserved.
  *
  * All rights reserved.
@@ -126,7 +126,7 @@ namespace WebKit {
 
         virtual void registerForIconNotification(bool);
 
-        virtual WebCore::ObjectContentType objectContentType(const WebCore::KURL& url, const WTF::String& mimeType);
+        virtual WebCore::ObjectContentType objectContentType(const WebCore::KURL&, const WTF::String& mimeType, bool shouldPreferPlugInsForImages);
 
         virtual void setMainFrameDocumentReady(bool);
 
diff --git a/Source/WebKit/gtk/WebCoreSupport/TextCheckerClientEnchant.cpp b/Source/WebKit/gtk/WebCoreSupport/TextCheckerClientEnchant.cpp
index 74e8132..460000b 100644
--- a/Source/WebKit/gtk/WebCoreSupport/TextCheckerClientEnchant.cpp
+++ b/Source/WebKit/gtk/WebCoreSupport/TextCheckerClientEnchant.cpp
@@ -77,16 +77,16 @@ void TextCheckerClientEnchant::checkSpellingOfString(const UChar* text, int leng
     if (!dicts)
         return;
 
-    gchar* ctext = g_utf16_to_utf8(const_cast<gunichar2*>(text), length, 0, 0, 0);
-    int utflen = g_utf8_strlen(ctext, -1);
+    GOwnPtr<gchar> utf8Text(g_utf16_to_utf8(const_cast<gunichar2*>(text), length, 0, 0, 0));
+    int utf8Length = g_utf8_strlen(utf8Text.get(), -1);
 
     PangoLanguage* language(pango_language_get_default());
-    GOwnPtr<PangoLogAttr> attrs(g_new(PangoLogAttr, utflen+1));
+    GOwnPtr<PangoLogAttr> attrs(g_new(PangoLogAttr, utf8Length + 1));
 
     // pango_get_log_attrs uses an aditional position at the end of the text.
-    pango_get_log_attrs(ctext, -1, -1, language, attrs.get(), utflen+1);
+    pango_get_log_attrs(utf8Text.get(), -1, -1, language, attrs.get(), utf8Length + 1);
 
-    for (int i = 0; i < length+1; i++) {
+    for (int i = 0; i < length + 1; i++) {
         // We go through each character until we find an is_word_start,
         // then we get into an inner loop to find the is_word_end corresponding
         // to it.
@@ -103,18 +103,15 @@ void TextCheckerClientEnchant::checkSpellingOfString(const UChar* text, int leng
             // check characters twice.
             i = end;
 
-            for (; dicts; dicts = dicts->next) {
-                EnchantDict* dict = static_cast<EnchantDict*>(dicts->data);
-                gchar* cstart = g_utf8_offset_to_pointer(ctext, start);
-                gint bytes = static_cast<gint>(g_utf8_offset_to_pointer(ctext, end) - cstart);
-                gchar* word = g_new0(gchar, bytes+1);
-                int result;
+            gchar* cstart = g_utf8_offset_to_pointer(utf8Text.get(), start);
+            gint bytes = static_cast<gint>(g_utf8_offset_to_pointer(utf8Text.get(), end) - cstart);
+            GOwnPtr<gchar> word(g_new0(gchar, bytes + 1));
 
-                g_utf8_strncpy(word, cstart, end - start);
+            g_utf8_strncpy(word.get(), cstart, wordLength);
 
-                result = enchant_dict_check(dict, word, -1);
-                g_free(word);
-                if (result) {
+            for (; dicts; dicts = dicts->next) {
+                EnchantDict* dict = static_cast<EnchantDict*>(dicts->data);
+                if (enchant_dict_check(dict, word.get(), wordLength)) {
                     *misspellingLocation = start;
                     *misspellingLength = wordLength;
                 } else {
diff --git a/Source/WebKit/gtk/po/ChangeLog b/Source/WebKit/gtk/po/ChangeLog
index 2b4b385..8febef5 100644
--- a/Source/WebKit/gtk/po/ChangeLog
+++ b/Source/WebKit/gtk/po/ChangeLog
@@ -1,3 +1,11 @@
+2011-03-23  Luca Ferretti  <lferrett@gnome.org>
+
+        Rubber-stamped by Gustavo Noronha.
+
+        Italian translation update.
+
+        * it.po: Updated.
+
 2011-02-26  Christian Dywan  <christian@lanedo.com>
 
         Reviewed by Andreas Kling.
diff --git a/Source/WebKit/gtk/po/it.po b/Source/WebKit/gtk/po/it.po
index 0112a44..d30665a 100644
--- a/Source/WebKit/gtk/po/it.po
+++ b/Source/WebKit/gtk/po/it.po
@@ -1,12 +1,13 @@
 # This is the Italian locale translation for WebKitGtk
 # Copyright (C) 2009 Free Software Foundation, Inc.
-# Luca Ferretti <lferrett@gnome.org>, 2009, 2010.
+# Luca Ferretti <lferrett@gnome.org>, 2009, 2010, 2011.
+#
 msgid ""
 msgstr ""
 "Project-Id-Version: WebKitGtk\n"
-"Report-Msgid-Bugs-To: http://bugs.webkit.org/\n"
-"POT-Creation-Date: 2010-02-25 15:53-0300\n"
-"PO-Revision-Date: 2010-03-18 22:13+0100\n"
+"Report-Msgid-Bugs-To: http://bugs.webkit.org\n"
+"POT-Creation-Date: 2010-12-27 15:26+0000\n"
+"PO-Revision-Date: 2011-03-23 13:44+0100\n"
 "Last-Translator: Luca Ferretti <lferrett@gnome.org>\n"
 "Language-Team: Italian <tp@lists.linux.it>\n"
 "MIME-Version: 1.0\n"
@@ -14,321 +15,564 @@ msgstr ""
 "Content-Transfer-Encoding: 8bit\n"
 "Plural-Forms: nplurals=2; plural=(n != 1)\n"
 
-#: WebKit/gtk/WebCoreSupport/ChromeClientGtk.cpp:535
+#: ../WebCoreSupport/ChromeClientGtk.cpp:589
 msgid "Upload File"
 msgstr "Carica file"
 
-#: WebKit/gtk/WebCoreSupport/ContextMenuClientGtk.cpp:61
-#: WebCore/platform/gtk/LocalizedStringsGtk.cpp:143
+# merge da gtk
+#: ../WebCoreSupport/ContextMenuClientGtk.cpp:63
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:194
 msgid "Input _Methods"
 msgstr "Met_odi di input"
 
 # merge da gtk
-#: WebKit/gtk/WebCoreSupport/ContextMenuClientGtk.cpp:78
+#: ../WebCoreSupport/ContextMenuClientGtk.cpp:80
 msgid "LRM _Left-to-right mark"
 msgstr "LRM - Contrassegno _sinistra-destra"
 
 # merge da gtk
-#: WebKit/gtk/WebCoreSupport/ContextMenuClientGtk.cpp:79
+#: ../WebCoreSupport/ContextMenuClientGtk.cpp:81
 msgid "RLM _Right-to-left mark"
 msgstr "RLM - Contrassegno _destra-sinistra"
 
 # merge da gtk
-#: WebKit/gtk/WebCoreSupport/ContextMenuClientGtk.cpp:80
+#: ../WebCoreSupport/ContextMenuClientGtk.cpp:82
 msgid "LRE Left-to-right _embedding"
 msgstr "LRE - _Inserimento sinistra-destra"
 
 # merge da gtk
-#: WebKit/gtk/WebCoreSupport/ContextMenuClientGtk.cpp:81
+#: ../WebCoreSupport/ContextMenuClientGtk.cpp:83
 msgid "RLE Right-to-left e_mbedding"
 msgstr "RLE - I_nserimento destra-sinistra"
 
 # merge da gtk
-#: WebKit/gtk/WebCoreSupport/ContextMenuClientGtk.cpp:82
+#: ../WebCoreSupport/ContextMenuClientGtk.cpp:84
 msgid "LRO Left-to-right _override"
 msgstr "LRO - _Forza sinistra-destra"
 
 # merge da gtk
-#: WebKit/gtk/WebCoreSupport/ContextMenuClientGtk.cpp:83
+#: ../WebCoreSupport/ContextMenuClientGtk.cpp:85
 msgid "RLO Right-to-left o_verride"
 msgstr "RLO - F_orza destra-sinistra"
 
 # merge da gtk
-#: WebKit/gtk/WebCoreSupport/ContextMenuClientGtk.cpp:84
+#: ../WebCoreSupport/ContextMenuClientGtk.cpp:86
 msgid "PDF _Pop directional formatting"
 msgstr "PDF - Ca_ttura formattazione direzionale"
 
 # merge da gtk
-#: WebKit/gtk/WebCoreSupport/ContextMenuClientGtk.cpp:85
+#: ../WebCoreSupport/ContextMenuClientGtk.cpp:87
 msgid "ZWS _Zero width space"
 msgstr "ZWS - Spa_zio a larghezza nulla"
 
 # merge da gtk
-#: WebKit/gtk/WebCoreSupport/ContextMenuClientGtk.cpp:86
+#: ../WebCoreSupport/ContextMenuClientGtk.cpp:88
 msgid "ZWJ Zero width _joiner"
 msgstr "ZWJ - Spazio di _unione a larghezza nulla"
 
 # merge da gtk
-#: WebKit/gtk/WebCoreSupport/ContextMenuClientGtk.cpp:87
+#: ../WebCoreSupport/ContextMenuClientGtk.cpp:89
 msgid "ZWNJ Zero width _non-joiner"
 msgstr "ZWNJ - Spazio non di unione a _larghezza nulla"
 
 # merge da gtk
-#: WebKit/gtk/WebCoreSupport/ContextMenuClientGtk.cpp:109
-#: WebCore/platform/gtk/LocalizedStringsGtk.cpp:138
+#: ../WebCoreSupport/ContextMenuClientGtk.cpp:111
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:189
 msgid "_Insert Unicode Control Character"
 msgstr "Inserisci carattere di controllo _Unicode"
 
-#: WebKit/gtk/webkit/webkitdownload.cpp:266
+#: ../WebCoreSupport/FrameLoaderClientGtk.cpp:1180
+msgid "Load request cancelled"
+msgstr "Richiesta di caricamento annullata"
+
+# messo una perché, in base al codice, sono diverse porte.
+# Grazie a Daniele Forsi
+#: ../WebCoreSupport/FrameLoaderClientGtk.cpp:1186
+msgid "Not allowed to use restricted network port"
+msgstr "Non è concesso usare una porta di rete con restrizioni"
+
+#: ../WebCoreSupport/FrameLoaderClientGtk.cpp:1192
+msgid "URL cannot be shown"
+msgstr "Impossibile mostrare l'URL"
+
+#: ../WebCoreSupport/FrameLoaderClientGtk.cpp:1198
+msgid "Frame load was interrupted"
+msgstr "Il caricamento del frame è stato interrotto"
+
+#: ../WebCoreSupport/FrameLoaderClientGtk.cpp:1204
+msgid "Content with the specified MIME type cannot be shown"
+msgstr "Impossibile mostrare il contenuto con il tipo MIME specificato"
+
+#: ../WebCoreSupport/FrameLoaderClientGtk.cpp:1210
+msgid "File does not exist"
+msgstr "Il file non esiste"
+
+#: ../WebCoreSupport/FrameLoaderClientGtk.cpp:1216
+msgid "Plugin will handle load"
+msgstr "Il plugin gestirà il caricamento"
+
+#: ../WebCoreSupport/FullscreenVideoController.cpp:385
+msgid "Play"
+msgstr "Riproduci"
+
+#: ../WebCoreSupport/FullscreenVideoController.cpp:387
+msgid "Pause"
+msgstr "Pausa"
+
+#: ../WebCoreSupport/FullscreenVideoController.cpp:533
+msgid "Play / Pause"
+msgstr "Riproduci / Pausa"
+
+#: ../WebCoreSupport/FullscreenVideoController.cpp:533
+msgid "Play or pause the media"
+msgstr "Riproduce o mette in pausa il contenuto multimediale"
+
+#: ../WebCoreSupport/FullscreenVideoController.cpp:541
+msgid "Time:"
+msgstr "Tempo:"
+
+#: ../WebCoreSupport/FullscreenVideoController.cpp:565
+msgid "Exit Fullscreen"
+msgstr "Finestra normale"
+
+#: ../WebCoreSupport/FullscreenVideoController.cpp:565
+msgid "Exit from fullscreen mode"
+msgstr "Esce dalla modalità schermo intero"
+
+#: ../webkit/webkitdownload.cpp:273
 msgid "Network Request"
 msgstr "Richiesta di rete"
 
-#: WebKit/gtk/webkit/webkitdownload.cpp:267
+#: ../webkit/webkitdownload.cpp:274
 msgid "The network request for the URI that should be downloaded"
 msgstr "La richiesta di rete per l'URI che dovrebbe essere scaricato"
 
-#: WebKit/gtk/webkit/webkitdownload.cpp:281
+#: ../webkit/webkitdownload.cpp:288
 msgid "Network Response"
 msgstr "Risposta di rete"
 
-#: WebKit/gtk/webkit/webkitdownload.cpp:282
+#: ../webkit/webkitdownload.cpp:289
 msgid "The network response for the URI that should be downloaded"
 msgstr "La risposta di rete per l'URI che dovrebbe essere scaricato"
 
-#: WebKit/gtk/webkit/webkitdownload.cpp:296
+#: ../webkit/webkitdownload.cpp:303
 msgid "Destination URI"
 msgstr "URI di destinazione"
 
-#: WebKit/gtk/webkit/webkitdownload.cpp:297
+#: ../webkit/webkitdownload.cpp:304
 msgid "The destination URI where to save the file"
 msgstr "L'URI di destinazione in cui salvare il file"
 
-#: WebKit/gtk/webkit/webkitdownload.cpp:311
+#: ../webkit/webkitdownload.cpp:318
 msgid "Suggested Filename"
 msgstr "Nome file suggerito"
 
-#: WebKit/gtk/webkit/webkitdownload.cpp:312
+#: ../webkit/webkitdownload.cpp:319
 msgid "The filename suggested as default when saving"
 msgstr "Il nome di file suggerito come predefinito quando si salva"
 
-#: WebKit/gtk/webkit/webkitdownload.cpp:329
+#: ../webkit/webkitdownload.cpp:336
 msgid "Progress"
 msgstr "Avanzamento"
 
-#: WebKit/gtk/webkit/webkitdownload.cpp:330
+#: ../webkit/webkitdownload.cpp:337
 msgid "Determines the current progress of the download"
 msgstr "Determina l'avanzamento corrente dello scaricamento"
 
-#: WebKit/gtk/webkit/webkitdownload.cpp:343
+#: ../webkit/webkitdownload.cpp:350
 msgid "Status"
 msgstr "Stato"
 
-#: WebKit/gtk/webkit/webkitdownload.cpp:344
+#: ../webkit/webkitdownload.cpp:351
 msgid "Determines the current status of the download"
 msgstr "Determina lo stato corrente dello scaricamento"
 
-#: WebKit/gtk/webkit/webkitdownload.cpp:359
+#: ../webkit/webkitdownload.cpp:366
 msgid "Current Size"
 msgstr "Dimensione corrente"
 
-#: WebKit/gtk/webkit/webkitdownload.cpp:360
+#: ../webkit/webkitdownload.cpp:367
 msgid "The length of the data already downloaded"
 msgstr "La lunghezza dei dati già scaricati"
 
-#: WebKit/gtk/webkit/webkitdownload.cpp:374
+#: ../webkit/webkitdownload.cpp:381
 msgid "Total Size"
 msgstr "Dimensione totale"
 
-#: WebKit/gtk/webkit/webkitdownload.cpp:375
+#: ../webkit/webkitdownload.cpp:382
 msgid "The total size of the file"
 msgstr "La dimensione totale del file"
 
-#: WebKit/gtk/webkit/webkitdownload.cpp:526
+#: ../webkit/webkitdownload.cpp:534
 msgid "User cancelled the download"
 msgstr "L'utente ha annullato lo scaricamento"
 
-#: WebKit/gtk/webkit/webkitsoupauthdialog.c:248
+#: ../webkit/webkithittestresult.cpp:156
+msgid "Context"
+msgstr "Contesto"
+
+#: ../webkit/webkithittestresult.cpp:157
+msgid "Flags indicating the kind of target that received the event."
+msgstr "Flag che indicano il tipo di destinazione che ha ricevuto l'evento."
+
+#: ../webkit/webkithittestresult.cpp:171
+msgid "Link URI"
+msgstr "URI collegamento"
+
+#: ../webkit/webkithittestresult.cpp:172
+msgid "The URI to which the target that received the event points, if any."
+msgstr ""
+"L'URI a cui punta la destinazione che ha ricevuto l'evento, se presente."
+
+#: ../webkit/webkithittestresult.cpp:185
+msgid "Image URI"
+msgstr "URI immagine"
+
+#: ../webkit/webkithittestresult.cpp:186
+msgid ""
+"The URI of the image that is part of the target that received the event, if "
+"any."
+msgstr ""
+"L'URI dell'immagine che è parte della destinazione che ha ricevuto l'evento, "
+"se presente."
+
+#: ../webkit/webkithittestresult.cpp:199
+msgid "Media URI"
+msgstr "URI contenuto multimediale"
+
+#: ../webkit/webkithittestresult.cpp:200
+msgid ""
+"The URI of the media that is part of the target that received the event, if "
+"any."
+msgstr ""
+"L'URI del contenuto multimediale che è parte della destinazione che ha "
+"ricevuto l'evento, se presente."
+
+#: ../webkit/webkithittestresult.cpp:221
+msgid "Inner node"
+msgstr "Nodo interno"
+
+#: ../webkit/webkithittestresult.cpp:222
+msgid "The inner DOM node associated with the hit test result."
+msgstr "Il nodo DOM interno associato con il risultato dell'hit test."
+
+#: ../webkit/webkitnetworkrequest.cpp:134
+#: ../webkit/webkitnetworkresponse.cpp:134 ../webkit/webkitwebframe.cpp:323
+#: ../webkit/webkitwebhistoryitem.cpp:176 ../webkit/webkitwebresource.cpp:126
+#: ../webkit/webkitwebview.cpp:2997
+msgid "URI"
+msgstr "URI"
+
+#: ../webkit/webkitnetworkrequest.cpp:135
+msgid "The URI to which the request will be made."
+msgstr "L'URI a cui sarà fatta la richiesta."
+
+#: ../webkit/webkitnetworkrequest.cpp:148
+#: ../webkit/webkitnetworkresponse.cpp:148
+msgid "Message"
+msgstr "Messaggio"
+
+#: ../webkit/webkitnetworkrequest.cpp:149
+msgid "The SoupMessage that backs the request."
+msgstr "Il SoupMessage che accompagna la richesta."
+
+#: ../webkit/webkitnetworkresponse.cpp:135
+msgid "The URI to which the response will be made."
+msgstr "L'URI a cui verrà data la risposta."
+
+#: ../webkit/webkitnetworkresponse.cpp:149
+msgid "The SoupMessage that backs the response."
+msgstr "Il SoupMessage che accompagna la risposta."
+
+#: ../webkit/webkitsecurityorigin.cpp:150
+msgid "Protocol"
+msgstr "Protocollo"
+
+# origine di sicurezza??????
+#: ../webkit/webkitsecurityorigin.cpp:151
+msgid "The protocol of the security origin"
+msgstr "Il protocollo dell'origine della sicurezza"
+
+#: ../webkit/webkitsecurityorigin.cpp:164
+msgid "Host"
+msgstr "Host"
+
+#: ../webkit/webkitsecurityorigin.cpp:165
+msgid "The host of the security origin"
+msgstr "L'host dell'origine della sicurezza"
+
+#: ../webkit/webkitsecurityorigin.cpp:178
+msgid "Port"
+msgstr "Porta"
+
+#: ../webkit/webkitsecurityorigin.cpp:179
+msgid "The port of the security origin"
+msgstr "La porta dell'origine della sicurezza"
+
+#: ../webkit/webkitsecurityorigin.cpp:192
+msgid "Web Database Usage"
+msgstr "Uso database web"
+
+#: ../webkit/webkitsecurityorigin.cpp:193
+msgid "The cumulative size of all web databases in the security origin"
+msgstr ""
+"La dimensione cumulativa di tutti i database web nell'origine della sicurezza"
+
+#: ../webkit/webkitsecurityorigin.cpp:205
+msgid "Web Database Quota"
+msgstr "Quota database web"
+
+#: ../webkit/webkitsecurityorigin.cpp:206
+msgid "The web database quota of the security origin in bytes"
+msgstr "La quota di database web dell'origine della sicurezza in byte"
+
+#: ../webkit/webkitsoupauthdialog.c:264
 #, c-format
 msgid "A username and password are being requested by the site %s"
 msgstr "Il sito %s richiede un nome utente e una password"
 
-#: WebKit/gtk/webkit/webkitsoupauthdialog.c:278
+#: ../webkit/webkitsoupauthdialog.c:294
 msgid "Server message:"
 msgstr "Messaggio del server:"
 
-#: WebKit/gtk/webkit/webkitsoupauthdialog.c:291
+#: ../webkit/webkitsoupauthdialog.c:307
 msgid "Username:"
 msgstr "Nome utente:"
 
-#: WebKit/gtk/webkit/webkitsoupauthdialog.c:293
+#: ../webkit/webkitsoupauthdialog.c:309
 msgid "Password:"
 msgstr "Password:"
 
 # checkbox
-#: WebKit/gtk/webkit/webkitsoupauthdialog.c:302
+#: ../webkit/webkitsoupauthdialog.c:318
 msgid "_Remember password"
 msgstr "_Ricordare la password"
 
-#: WebKit/gtk/webkit/webkitwebframe.cpp:298
+#: ../webkit/webkitwebdatabase.cpp:173
+msgid "Security Origin"
+msgstr "Origine della sicurezza"
+
+#: ../webkit/webkitwebdatabase.cpp:174
+msgid "The security origin of the database"
+msgstr "L'origine della sicurezza del database"
+
+#: ../webkit/webkitwebdatabase.cpp:187 ../webkit/webkitwebframe.cpp:309
 msgid "Name"
 msgstr "Nome"
 
-#: WebKit/gtk/webkit/webkitwebframe.cpp:299
+#: ../webkit/webkitwebdatabase.cpp:188
+msgid "The name of the Web Database database"
+msgstr "Il nome del database Web Database"
+
+#: ../webkit/webkitwebdatabase.cpp:201
+msgid "Display Name"
+msgstr "Nome visibile"
+
+#: ../webkit/webkitwebdatabase.cpp:202
+msgid "The display name of the Web Storage database"
+msgstr "Il nome visibile del database Web Storage"
+
+#: ../webkit/webkitwebdatabase.cpp:215
+msgid "Expected Size"
+msgstr "Dimensione attesa"
+
+#: ../webkit/webkitwebdatabase.cpp:216
+msgid "The expected size of the Web Database database"
+msgstr "La dimensione attesa del database Web Database"
+
+#: ../webkit/webkitwebdatabase.cpp:228
+msgid "Size"
+msgstr "Dimensione"
+
+#: ../webkit/webkitwebdatabase.cpp:229
+msgid "The current size of the Web Database database"
+msgstr "La dimensione attuale del database Web Database"
+
+#: ../webkit/webkitwebdatabase.cpp:241
+msgid "Filename"
+msgstr "Nome file"
+
+#: ../webkit/webkitwebdatabase.cpp:242
+msgid "The absolute filename of the Web Storage database"
+msgstr "Il nome file assoluto del database Web Storage"
+
+#: ../webkit/webkitwebframe.cpp:310
 msgid "The name of the frame"
-msgstr "Il nome della cornice"
+msgstr "Il nome del frame"
 
-#: WebKit/gtk/webkit/webkitwebframe.cpp:305
-#: WebKit/gtk/webkit/webkitwebhistoryitem.cpp:146
-#: WebKit/gtk/webkit/webkitwebview.cpp:2318
+#: ../webkit/webkitwebframe.cpp:316 ../webkit/webkitwebhistoryitem.cpp:144
+#: ../webkit/webkitwebview.cpp:2983
 msgid "Title"
 msgstr "Titolo"
 
-#: WebKit/gtk/webkit/webkitwebframe.cpp:306
+#: ../webkit/webkitwebframe.cpp:317
 msgid "The document title of the frame"
-msgstr "Il titolo del documento nella cornice"
-
-#: WebKit/gtk/webkit/webkitwebframe.cpp:312
-#: WebKit/gtk/webkit/webkitwebhistoryitem.cpp:178
-#: WebKit/gtk/webkit/webkitwebview.cpp:2332
-msgid "URI"
-msgstr "URI"
+msgstr "Il titolo del documento nel frame"
 
-#: WebKit/gtk/webkit/webkitwebframe.cpp:313
+#: ../webkit/webkitwebframe.cpp:324
 msgid "The current URI of the contents displayed by the frame"
-msgstr "L'URI corrente del contenuto mostrato dalla cornice"
+msgstr "L'URI corrente del contenuto mostrato dal frame"
 
-#: WebKit/gtk/webkit/webkitwebframe.cpp:344
+#: ../webkit/webkitwebframe.cpp:355
 msgid "Horizontal Scrollbar Policy"
 msgstr "Politica barra scorrimento orizzontale"
 
-#: WebKit/gtk/webkit/webkitwebframe.cpp:345
+#: ../webkit/webkitwebframe.cpp:356
 msgid ""
 "Determines the current policy for the horizontal scrollbar of the frame."
 msgstr ""
-"Determina la politica attuale per la barra di scorrimento orizzontale della "
-"cornice."
+"Determina la politica attuale per la barra di scorrimento orizzontale del "
+"frame."
 
-#: WebKit/gtk/webkit/webkitwebframe.cpp:362
+#: ../webkit/webkitwebframe.cpp:373
 msgid "Vertical Scrollbar Policy"
 msgstr "Politica barra scorrimento verticale"
 
-#: WebKit/gtk/webkit/webkitwebframe.cpp:363
+#: ../webkit/webkitwebframe.cpp:374
 msgid "Determines the current policy for the vertical scrollbar of the frame."
 msgstr ""
 "Determina la politica attuale per la barra di scorrimento verticale del "
-"cornice."
+"frame."
 
-#: WebKit/gtk/webkit/webkitwebhistoryitem.cpp:147
+#: ../webkit/webkitwebhistoryitem.cpp:145
 msgid "The title of the history item"
 msgstr "Il titolo dell'elemento di cronologia"
 
-#: WebKit/gtk/webkit/webkitwebhistoryitem.cpp:162
+#: ../webkit/webkitwebhistoryitem.cpp:160
 msgid "Alternate Title"
 msgstr "Titolo alternativo"
 
-#: WebKit/gtk/webkit/webkitwebhistoryitem.cpp:163
+#: ../webkit/webkitwebhistoryitem.cpp:161
 msgid "The alternate title of the history item"
 msgstr "Il titolo alternativo dell'elemento di cronologia"
 
-#: WebKit/gtk/webkit/webkitwebhistoryitem.cpp:179
+#: ../webkit/webkitwebhistoryitem.cpp:177
 msgid "The URI of the history item"
 msgstr "L'URI dell'elemento di cronologia"
 
-#: WebKit/gtk/webkit/webkitwebhistoryitem.cpp:194
-#: WebKit/gtk/webkit/webkitwebnavigationaction.cpp:173
+#: ../webkit/webkitwebhistoryitem.cpp:192
+#: ../webkit/webkitwebnavigationaction.cpp:171
 msgid "Original URI"
 msgstr "URI originale"
 
-#: WebKit/gtk/webkit/webkitwebhistoryitem.cpp:195
+#: ../webkit/webkitwebhistoryitem.cpp:193
 msgid "The original URI of the history item"
 msgstr "L'URI originale dell'elemento di cronologia"
 
-#: WebKit/gtk/webkit/webkitwebhistoryitem.cpp:210
+#: ../webkit/webkitwebhistoryitem.cpp:208
 msgid "Last visited Time"
 msgstr "Data ultima visita"
 
-#: WebKit/gtk/webkit/webkitwebhistoryitem.cpp:211
+#: ../webkit/webkitwebhistoryitem.cpp:209
 msgid "The time at which the history item was last visited"
 msgstr ""
 "La data in cui l'elemento di cronologia è stato visitato l'ultima volta"
 
 # lasciato non tradotto perchè termine interno di WebKitGtk
 # cfr http://webkitgtk.org/reference/webkitgtk-WebKitWebInspector.html#WebKitWebInspector--web-view
-#: WebKit/gtk/webkit/webkitwebinspector.cpp:268
+#: ../webkit/webkitwebinspector.cpp:270
 msgid "Web View"
-msgstr "Web View"
+msgstr "Web view"
 
-#: WebKit/gtk/webkit/webkitwebinspector.cpp:269
+#: ../webkit/webkitwebinspector.cpp:271
 msgid "The Web View that renders the Web Inspector itself"
-msgstr "La Web View che esegue il rendering dell'Ispettore web stesso"
+msgstr "La Web view che esegue il rendering dell'Ispettore web stesso"
 
-#: WebKit/gtk/webkit/webkitwebinspector.cpp:282
+#: ../webkit/webkitwebinspector.cpp:284
 msgid "Inspected URI"
 msgstr "URI ispezionato"
 
-#: WebKit/gtk/webkit/webkitwebinspector.cpp:283
+#: ../webkit/webkitwebinspector.cpp:285
 msgid "The URI that is currently being inspected"
 msgstr "L'URI che attualmente è ispezionato"
 
-#: WebKit/gtk/webkit/webkitwebinspector.cpp:299
+#: ../webkit/webkitwebinspector.cpp:301
 msgid "Enable JavaScript profiling"
 msgstr "Abilita profiling JavaScript"
 
 # FIXME
 # oppure Esegue il profiling?
-#: WebKit/gtk/webkit/webkitwebinspector.cpp:300
+#: ../webkit/webkitwebinspector.cpp:302
 msgid "Profile the executed JavaScript."
 msgstr "Traccia un profilo del codice JavaScript eseguito."
 
-#: WebKit/gtk/webkit/webkitwebinspector.cpp:315
+#: ../webkit/webkitwebinspector.cpp:317
 msgid "Enable Timeline profiling"
 msgstr "Abilita profiling Timeline"
 
-#: WebKit/gtk/webkit/webkitwebinspector.cpp:316
+#: ../webkit/webkitwebinspector.cpp:318
 msgid "Profile the WebCore instrumentation."
 msgstr "Traccia un profilo della strumentazione WebCore."
 
-#: WebKit/gtk/webkit/webkitwebnavigationaction.cpp:158
+#: ../webkit/webkitwebnavigationaction.cpp:156
 msgid "Reason"
 msgstr "Motivo"
 
-#: WebKit/gtk/webkit/webkitwebnavigationaction.cpp:159
+#: ../webkit/webkitwebnavigationaction.cpp:157
 msgid "The reason why this navigation is occurring"
 msgstr "Il motivo per cui questa navigazione si sta verificando"
 
-#: WebKit/gtk/webkit/webkitwebnavigationaction.cpp:174
+#: ../webkit/webkitwebnavigationaction.cpp:172
 msgid "The URI that was requested as the target for the navigation"
-msgstr "L'URI che è stata richiesta come destinazione della navigazione"
+msgstr "L'URI che è stato richiesto come destinazione della navigazione"
 
-#: WebKit/gtk/webkit/webkitwebnavigationaction.cpp:188
+#: ../webkit/webkitwebnavigationaction.cpp:186
 msgid "Button"
 msgstr "Pulsante"
 
-#: WebKit/gtk/webkit/webkitwebnavigationaction.cpp:189
+#: ../webkit/webkitwebnavigationaction.cpp:187
 msgid "The button used to click"
 msgstr "Il pulsante usato per fare clic"
 
-#: WebKit/gtk/webkit/webkitwebnavigationaction.cpp:204
+#: ../webkit/webkitwebnavigationaction.cpp:202
 msgid "Modifier state"
 msgstr "Stato modificatori"
 
-#: WebKit/gtk/webkit/webkitwebnavigationaction.cpp:205
+#: ../webkit/webkitwebnavigationaction.cpp:203
 msgid "A bitmask representing the state of the modifier keys"
 msgstr "Una maschera di bit che rappresenta lo stato dei tasti modificatori"
 
-#: WebKit/gtk/webkit/webkitwebnavigationaction.cpp:220
+#: ../webkit/webkitwebnavigationaction.cpp:218
 msgid "Target frame"
-msgstr "Cornice destinazione"
+msgstr "Frame destinazione"
 
-#: WebKit/gtk/webkit/webkitwebnavigationaction.cpp:221
+#: ../webkit/webkitwebnavigationaction.cpp:219
 msgid "The target frame for the navigation"
-msgstr "La cornice di destinazione per la navigazione"
+msgstr "Il frame di destinazione per la navigazione"
 
-#: WebKit/gtk/webkit/webkitwebsettings.cpp:237
+#: ../webkit/webkitwebresource.cpp:127
+msgid "The uri of the resource"
+msgstr "L'URI della risorsa"
+
+#: ../webkit/webkitwebresource.cpp:141
+msgid "MIME Type"
+msgstr "Tipo MIME"
+
+#: ../webkit/webkitwebresource.cpp:142
+msgid "The MIME type of the resource"
+msgstr "Il tipo MIME della risorsa"
+
+#: ../webkit/webkitwebresource.cpp:156 ../webkit/webkitwebview.cpp:3132
+msgid "Encoding"
+msgstr "Codifica"
+
+#: ../webkit/webkitwebresource.cpp:157
+msgid "The text encoding name of the resource"
+msgstr "Il nome di codifica del testo della risorsa"
+
+#: ../webkit/webkitwebresource.cpp:172
+msgid "Frame Name"
+msgstr "Nome frame"
+
+#: ../webkit/webkitwebresource.cpp:173
+msgid "The frame name of the resource"
+msgstr "Il nome frame della risorsa"
+
+#: ../webkit/webkitwebsettings.cpp:252
 msgid "Default Encoding"
 msgstr "Codifica predefinita"
 
-#: WebKit/gtk/webkit/webkitwebsettings.cpp:238
+#: ../webkit/webkitwebsettings.cpp:253
 msgid "The default encoding used to display text."
 msgstr "La codifica predefinita usata per mostrare il testo."
 
@@ -337,90 +581,90 @@ msgstr "La codifica predefinita usata per mostrare il testo."
 #  * nella "breve" si lascia la forma inglese (es. sans serif) nella lunga 
 #    si mette la forma italiana (es. senza grazie)
 # Ciò per mantenere corte le "brevi" e per permettere che entrambe le diciture siano presenti
-#: WebKit/gtk/webkit/webkitwebsettings.cpp:246
+#: ../webkit/webkitwebsettings.cpp:261
 msgid "Cursive Font Family"
 msgstr "Famiglia carattere corsivo"
 
-#: WebKit/gtk/webkit/webkitwebsettings.cpp:247
+#: ../webkit/webkitwebsettings.cpp:262
 msgid "The default Cursive font family used to display text."
 msgstr ""
 "La famiglia del tipo di carattere \"corsivo\" predefinito usata per mostrare "
 "il testo."
 
-#: WebKit/gtk/webkit/webkitwebsettings.cpp:255
+#: ../webkit/webkitwebsettings.cpp:270
 msgid "Default Font Family"
 msgstr "Famiglia carattere predefinita"
 
-#: WebKit/gtk/webkit/webkitwebsettings.cpp:256
+#: ../webkit/webkitwebsettings.cpp:271
 msgid "The default font family used to display text."
 msgstr ""
 "La famiglia del tipo di carattere predefinito usata per mostrare il testo."
 
-#: WebKit/gtk/webkit/webkitwebsettings.cpp:264
+#: ../webkit/webkitwebsettings.cpp:279
 msgid "Fantasy Font Family"
 msgstr "Famiglia carattere fantasia"
 
-#: WebKit/gtk/webkit/webkitwebsettings.cpp:265
+#: ../webkit/webkitwebsettings.cpp:280
 msgid "The default Fantasy font family used to display text."
 msgstr ""
 "La famiglia del tipo di carattere \"fantasia\" predefinito usata per "
 "mostrare il testo."
 
-#: WebKit/gtk/webkit/webkitwebsettings.cpp:273
+#: ../webkit/webkitwebsettings.cpp:288
 msgid "Monospace Font Family"
 msgstr "Famiglia carattere monospace"
 
-#: WebKit/gtk/webkit/webkitwebsettings.cpp:274
+#: ../webkit/webkitwebsettings.cpp:289
 msgid "The default font family used to display monospace text."
 msgstr ""
 "La famiglia del tipo di carattere predefinito usata per mostrare il testo a "
 "spaziatura fissa."
 
-#: WebKit/gtk/webkit/webkitwebsettings.cpp:282
+#: ../webkit/webkitwebsettings.cpp:297
 msgid "Sans Serif Font Family"
 msgstr "Famiglia carattere sans serif"
 
-#: WebKit/gtk/webkit/webkitwebsettings.cpp:283
+#: ../webkit/webkitwebsettings.cpp:298
 msgid "The default Sans Serif font family used to display text."
 msgstr ""
 "La famiglia del tipo di carattere \"senza grazie\" predefinito usata per "
 "mostrare il testo."
 
-#: WebKit/gtk/webkit/webkitwebsettings.cpp:291
+#: ../webkit/webkitwebsettings.cpp:306
 msgid "Serif Font Family"
 msgstr "Famiglia carattere serif"
 
-#: WebKit/gtk/webkit/webkitwebsettings.cpp:292
+#: ../webkit/webkitwebsettings.cpp:307
 msgid "The default Serif font family used to display text."
 msgstr ""
 "La famiglia del tipo di carattere \"con grazie\" predefinito usata per "
 "mostrare il testo."
 
-#: WebKit/gtk/webkit/webkitwebsettings.cpp:300
+#: ../webkit/webkitwebsettings.cpp:315
 msgid "Default Font Size"
 msgstr "Dimensione predefinita carattere"
 
-#: WebKit/gtk/webkit/webkitwebsettings.cpp:301
+#: ../webkit/webkitwebsettings.cpp:316
 msgid "The default font size used to display text."
 msgstr ""
 "La dimensione predefinita per il tipo di carattere usato per mostrare il "
 "testo."
 
-#: WebKit/gtk/webkit/webkitwebsettings.cpp:309
+#: ../webkit/webkitwebsettings.cpp:324
 msgid "Default Monospace Font Size"
 msgstr "Dimensione predefinita carattere monospace"
 
-#: WebKit/gtk/webkit/webkitwebsettings.cpp:310
+#: ../webkit/webkitwebsettings.cpp:325
 msgid "The default font size used to display monospace text."
 msgstr ""
 "La dimensione predefinita per il tipo di carattere usato per mostrare il "
 "testo a larghezza fissa."
 
-#: WebKit/gtk/webkit/webkitwebsettings.cpp:318
+#: ../webkit/webkitwebsettings.cpp:333
 msgid "Minimum Font Size"
 msgstr "Dimensione minima carattere"
 
-#: WebKit/gtk/webkit/webkitwebsettings.cpp:319
+#: ../webkit/webkitwebsettings.cpp:334
 msgid "The minimum font size used to display text."
 msgstr ""
 "La dimensione minima per il tipo di carattere usato per mostrare il testo."
@@ -437,221 +681,245 @@ msgstr ""
 # size alone. This will assure that your content will never display at sizes less than 12 points,
 # but the functional font size boundary of the web view will remain at 9 points to prevent any
 #  chance of displaying unnecessarily small text.
-#: WebKit/gtk/webkit/webkitwebsettings.cpp:327
+#: ../webkit/webkitwebsettings.cpp:342
 msgid "Minimum Logical Font Size"
 msgstr "Dimensione minima naturale carattere"
 
-#: WebKit/gtk/webkit/webkitwebsettings.cpp:328
+#: ../webkit/webkitwebsettings.cpp:343
 msgid "The minimum logical font size used to display text."
 msgstr ""
 "La dimensione minima naturale per il tipo di carattere usato per mostrare il "
 "testo."
 
-#: WebKit/gtk/webkit/webkitwebsettings.cpp:347
+#: ../webkit/webkitwebsettings.cpp:362
 msgid "Enforce 96 DPI"
 msgstr "Forza 96 DPI"
 
-#: WebKit/gtk/webkit/webkitwebsettings.cpp:348
+#: ../webkit/webkitwebsettings.cpp:363
 msgid "Enforce a resolution of 96 DPI"
 msgstr "Forza la risoluzione a 96 DPI"
 
-#: WebKit/gtk/webkit/webkitwebsettings.cpp:356
+#: ../webkit/webkitwebsettings.cpp:371
 msgid "Auto Load Images"
 msgstr "Caricamento automatico immagini"
 
-#: WebKit/gtk/webkit/webkitwebsettings.cpp:357
+#: ../webkit/webkitwebsettings.cpp:372
 msgid "Load images automatically."
 msgstr "Carica le immagini in modo automatico."
 
-#: WebKit/gtk/webkit/webkitwebsettings.cpp:365
+#: ../webkit/webkitwebsettings.cpp:380
 msgid "Auto Shrink Images"
 msgstr "Restringimento automatico immagini"
 
 # assolutamente libertario
-#: WebKit/gtk/webkit/webkitwebsettings.cpp:366
+#: ../webkit/webkitwebsettings.cpp:381
 msgid "Automatically shrink standalone images to fit."
 msgstr "Restringe automaticamente le immagini singole alla dimensione adatta."
 
-#: WebKit/gtk/webkit/webkitwebsettings.cpp:374
+#: ../webkit/webkitwebsettings.cpp:389
 msgid "Print Backgrounds"
 msgstr "Stampa sfondi"
 
-#: WebKit/gtk/webkit/webkitwebsettings.cpp:375
+#: ../webkit/webkitwebsettings.cpp:390
 msgid "Whether background images should be printed."
 msgstr "Indica se le immagini di sfondo devono essere stampate."
 
-#: WebKit/gtk/webkit/webkitwebsettings.cpp:383
+#: ../webkit/webkitwebsettings.cpp:398
 msgid "Enable Scripts"
 msgstr "Abilita script"
 
-#: WebKit/gtk/webkit/webkitwebsettings.cpp:384
+#: ../webkit/webkitwebsettings.cpp:399
 msgid "Enable embedded scripting languages."
 msgstr "Abilita i linguaggi di scripting incorporati."
 
-#: WebKit/gtk/webkit/webkitwebsettings.cpp:392
+#: ../webkit/webkitwebsettings.cpp:407
 msgid "Enable Plugins"
 msgstr "Abilita plugin"
 
-#: WebKit/gtk/webkit/webkitwebsettings.cpp:393
+#: ../webkit/webkitwebsettings.cpp:408
 msgid "Enable embedded plugin objects."
 msgstr "Abilita gli oggetti plugin incorporati."
 
-#: WebKit/gtk/webkit/webkitwebsettings.cpp:401
+#: ../webkit/webkitwebsettings.cpp:416
 msgid "Resizable Text Areas"
 msgstr "Aree testo ridimensionabili"
 
-#: WebKit/gtk/webkit/webkitwebsettings.cpp:402
+#: ../webkit/webkitwebsettings.cpp:417
 msgid "Whether text areas are resizable."
 msgstr "Indica se le aree di testo sono ridimensionabili."
 
-#: WebKit/gtk/webkit/webkitwebsettings.cpp:409
+#: ../webkit/webkitwebsettings.cpp:424
 msgid "User Stylesheet URI"
 msgstr "URI foglio stile utente"
 
-#: WebKit/gtk/webkit/webkitwebsettings.cpp:410
+#: ../webkit/webkitwebsettings.cpp:425
 msgid "The URI of a stylesheet that is applied to every page."
 msgstr "L'URI di un foglio di stile che è applicato a ogni pagina."
 
-#: WebKit/gtk/webkit/webkitwebsettings.cpp:425
+#: ../webkit/webkitwebsettings.cpp:440
 msgid "Zoom Stepping Value"
 msgstr "Valore passo ingrandimento"
 
-#: WebKit/gtk/webkit/webkitwebsettings.cpp:426
+#: ../webkit/webkitwebsettings.cpp:441
 msgid "The value by which the zoom level is changed when zooming in or out."
 msgstr ""
 "Il valore di variazione del livello di ingrandimento quando si aumenta o "
 "riduce l'ingrandimento."
 
-#: WebKit/gtk/webkit/webkitwebsettings.cpp:444
+#: ../webkit/webkitwebsettings.cpp:459
 msgid "Enable Developer Extras"
 msgstr "Abilita extra per sviluppatori"
 
-#: WebKit/gtk/webkit/webkitwebsettings.cpp:445
+#: ../webkit/webkitwebsettings.cpp:460
 msgid "Enables special extensions that help developers"
 msgstr "Abilita estensioni speciali che sono d'aiuto per gli sviluppatori"
 
-#: WebKit/gtk/webkit/webkitwebsettings.cpp:465
+#: ../webkit/webkitwebsettings.cpp:480
 msgid "Enable Private Browsing"
 msgstr "Abilita navigazione privata"
 
-#: WebKit/gtk/webkit/webkitwebsettings.cpp:466
+#: ../webkit/webkitwebsettings.cpp:481
 msgid "Enables private browsing mode"
 msgstr "Abilita la modalità di navigazione privata"
 
-#: WebKit/gtk/webkit/webkitwebsettings.cpp:481
+#: ../webkit/webkitwebsettings.cpp:496
 msgid "Enable Spell Checking"
 msgstr "Abilita controllo ortografico"
 
-#: WebKit/gtk/webkit/webkitwebsettings.cpp:482
+#: ../webkit/webkitwebsettings.cpp:497
 msgid "Enables spell checking while typing"
 msgstr "Abilita il controllo ortografico durante la digitazione"
 
-#: WebKit/gtk/webkit/webkitwebsettings.cpp:505
+#: ../webkit/webkitwebsettings.cpp:520
 msgid "Languages to use for spell checking"
 msgstr "Lingue da usare per controllo ortografico"
 
-#: WebKit/gtk/webkit/webkitwebsettings.cpp:506
+#: ../webkit/webkitwebsettings.cpp:521
 msgid "Comma separated list of languages to use for spell checking"
 msgstr ""
 "Elenco separato da virgole delle lingue da usare per il controllo ortografico"
 
-#: WebKit/gtk/webkit/webkitwebsettings.cpp:520
+#: ../webkit/webkitwebsettings.cpp:535
 msgid "Enable Caret Browsing"
 msgstr "Abilita navigazione con cursore"
 
-#: WebKit/gtk/webkit/webkitwebsettings.cpp:521
-msgid "Whether to enable accessibility enhanced keyboard navigation"
+#: ../webkit/webkitwebsettings.cpp:536
+msgid "Whether to enable accesibility enhanced keyboard navigation"
 msgstr ""
 "Indica se abilitare la navigazione da tastiera ottimizzata per "
 "l'accessibilità"
 
-#: WebKit/gtk/webkit/webkitwebsettings.cpp:536
+#: ../webkit/webkitwebsettings.cpp:551
 msgid "Enable HTML5 Database"
-msgstr "Abilita Database HTML5"
+msgstr "Abilita database HTML5"
 
-#: WebKit/gtk/webkit/webkitwebsettings.cpp:537
+#: ../webkit/webkitwebsettings.cpp:552
 msgid "Whether to enable HTML5 database support"
 msgstr "Indica se abilitare il supporto ai database di HTML5"
 
-#: WebKit/gtk/webkit/webkitwebsettings.cpp:552
+#: ../webkit/webkitwebsettings.cpp:567
 msgid "Enable HTML5 Local Storage"
-msgstr "Abilita Local Storage HTML5"
+msgstr "Abilita local storage HTML5"
 
-#: WebKit/gtk/webkit/webkitwebsettings.cpp:553
+#: ../webkit/webkitwebsettings.cpp:568
 msgid "Whether to enable HTML5 Local Storage support"
 msgstr "Indica se abilitare il supporto a local storage di HTML5"
 
-#: WebKit/gtk/webkit/webkitwebsettings.cpp:567
+#: ../webkit/webkitwebsettings.cpp:582
 msgid "Enable XSS Auditor"
 msgstr "Abilita auditor XSS"
 
-#: WebKit/gtk/webkit/webkitwebsettings.cpp:568
-msgid "Whether to enable teh XSS auditor"
+#: ../webkit/webkitwebsettings.cpp:583
+msgid "Whether to enable the XSS auditor"
 msgstr "Indica se abilitare l'auditor XSS"
 
-#: WebKit/gtk/webkit/webkitwebsettings.cpp:586
+#: ../webkit/webkitwebsettings.cpp:601
+msgid "Enable Spatial Navigation"
+msgstr "Abilita navigazione spaziale"
+
+#: ../webkit/webkitwebsettings.cpp:602
+msgid "Whether to enable Spatial Navigation"
+msgstr "Indica se abilitare la navigazione spaziale"
+
+#: ../webkit/webkitwebsettings.cpp:620
+msgid "Enable Frame Flattening"
+msgstr "Abilita appiattimento frame"
+
+#: ../webkit/webkitwebsettings.cpp:621
+msgid "Whether to enable Frame Flattening"
+msgstr "Indica se abilitare l'appiattimento dei frame"
+
+#: ../webkit/webkitwebsettings.cpp:638
 msgid "User Agent"
-msgstr "User Agent"
+msgstr "User agent"
 
-#: WebKit/gtk/webkit/webkitwebsettings.cpp:587
+#: ../webkit/webkitwebsettings.cpp:639
 msgid "The User-Agent string used by WebKitGtk"
 msgstr "La stringa User-Agent usata da WebKitGtk"
 
-#: WebKit/gtk/webkit/webkitwebsettings.cpp:602
+#: ../webkit/webkitwebsettings.cpp:654
 msgid "JavaScript can open windows automatically"
-msgstr "JavaScript può aprire automatamente le fineste"
+msgstr "JavaScript può aprire automaticamente le finestre"
 
-#: WebKit/gtk/webkit/webkitwebsettings.cpp:603
+#: ../webkit/webkitwebsettings.cpp:655
 msgid "Whether JavaScript can open windows automatically"
-msgstr "Indica se JavaScript può aprire automatamente le fineste"
+msgstr "Indica se JavaScript può aprire automaticamente le finestre"
 
-#: WebKit/gtk/webkit/webkitwebsettings.cpp:618
+#: ../webkit/webkitwebsettings.cpp:669
+msgid "JavaScript can access Clipboard"
+msgstr "JavaScript può accedere agli appunti"
+
+#: ../webkit/webkitwebsettings.cpp:670
+msgid "Whether JavaScript can access Clipboard"
+msgstr "Indica se JavaScript può accedere agli appunti"
+
+#: ../webkit/webkitwebsettings.cpp:686
 msgid "Enable offline web application cache"
 msgstr "Abilita cache per applicazioni web fuori rete"
 
-#: WebKit/gtk/webkit/webkitwebsettings.cpp:619
+#: ../webkit/webkitwebsettings.cpp:687
 msgid "Whether to enable offline web application cache"
 msgstr "Indica se abilitare la cache per le applicazioni web fuori rete"
 
-#: WebKit/gtk/webkit/webkitwebsettings.cpp:646
+#: ../webkit/webkitwebsettings.cpp:715
 msgid "Editing behavior"
 msgstr "Comportamento editing"
 
-#: WebKit/gtk/webkit/webkitwebsettings.cpp:647
+#: ../webkit/webkitwebsettings.cpp:716
 msgid "The behavior mode to use in editing mode"
 msgstr "La modalità di comportamento da usare in modalità editing"
 
-#: WebKit/gtk/webkit/webkitwebsettings.cpp:663
+#: ../webkit/webkitwebsettings.cpp:732
 msgid "Enable universal access from file URIs"
-msgstr "Abilita accesso univesale dagli URI di file"
+msgstr "Abilita accesso universale dagli URI di file"
 
-#: WebKit/gtk/webkit/webkitwebsettings.cpp:664
+#: ../webkit/webkitwebsettings.cpp:733
 msgid "Whether to allow universal access from file URIs"
-msgstr "Indica se abilitare l'accesso univesale dagli URI di file"
+msgstr "Indica se abilitare l'accesso universale dagli URI di file"
 
-#: WebKit/gtk/webkit/webkitwebsettings.cpp:679
+#: ../webkit/webkitwebsettings.cpp:748
 msgid "Enable DOM paste"
 msgstr "Abilita DOM pasting"
 
-#: WebKit/gtk/webkit/webkitwebsettings.cpp:680
+#: ../webkit/webkitwebsettings.cpp:749
 msgid "Whether to enable DOM paste"
 msgstr "Indica se abilitare il DOM pasting"
 
-#: WebKit/gtk/webkit/webkitwebsettings.cpp:698
+#: ../webkit/webkitwebsettings.cpp:767
 msgid "Tab key cycles through elements"
 msgstr "Tasto TAB per passare tra gli elementi"
 
-#: WebKit/gtk/webkit/webkitwebsettings.cpp:699
+#: ../webkit/webkitwebsettings.cpp:768
 msgid "Whether the tab key cycles through elements on the page."
 msgstr ""
 "Indica se il tasto TAB permette di passare ciclicamente tra gli elementi "
 "della pagina."
 
-#: WebKit/gtk/webkit/webkitwebsettings.cpp:719
+#: ../webkit/webkitwebsettings.cpp:788
 msgid "Enable Default Context Menu"
 msgstr "Abilita menù contestuale predefinito"
 
-#: WebKit/gtk/webkit/webkitwebsettings.cpp:720
+#: ../webkit/webkitwebsettings.cpp:789
 msgid ""
 "Enables the handling of right-clicks for the creation of the default context "
 "menu"
@@ -659,251 +927,311 @@ msgstr ""
 "Abilita la gestione dei clic destri per la creazione del menù contestuale "
 "predefinito"
 
-#: WebKit/gtk/webkit/webkitwebsettings.cpp:740
+#: ../webkit/webkitwebsettings.cpp:809
 msgid "Enable Site Specific Quirks"
 msgstr "Abilita scappatoie specifiche per siti"
 
-#: WebKit/gtk/webkit/webkitwebsettings.cpp:741
+#: ../webkit/webkitwebsettings.cpp:810
 msgid "Enables the site-specific compatibility workarounds"
 msgstr ""
 "Abilita delle correzioni di compatibilità specifiche per determinati siti"
 
-#: WebKit/gtk/webkit/webkitwebsettings.cpp:763
+#: ../webkit/webkitwebsettings.cpp:832
 msgid "Enable page cache"
 msgstr "Abilita la cache di pagina"
 
-#: WebKit/gtk/webkit/webkitwebsettings.cpp:764
+#: ../webkit/webkitwebsettings.cpp:833
 msgid "Whether the page cache should be used"
 msgstr "Indica se usare la cache delle pagine"
 
-#: WebKit/gtk/webkit/webkitwebsettings.cpp:784
+#: ../webkit/webkitwebsettings.cpp:853
 msgid "Auto Resize Window"
 msgstr "Ridimensionamento automatico finestra"
 
-#: WebKit/gtk/webkit/webkitwebsettings.cpp:785
+#: ../webkit/webkitwebsettings.cpp:854
 msgid "Automatically resize the toplevel window when a page requests it"
 msgstr ""
 "Ridimensiona automaticamente la finestra di livello principale quando "
 "richiesto da una pagina"
 
-#: WebKit/gtk/webkit/webkitwebsettings.cpp:817
+#: ../webkit/webkitwebsettings.cpp:886
 msgid "Enable Java Applet"
 msgstr "Abilita applet Java"
 
-#: WebKit/gtk/webkit/webkitwebsettings.cpp:818
+#: ../webkit/webkitwebsettings.cpp:887
 msgid "Whether Java Applet support through <applet> should be enabled"
 msgstr "Indica se abilitare il supporto alle applet Java attraverso <applet>"
 
-#: WebKit/gtk/webkit/webkitwebview.cpp:2319
+#: ../webkit/webkitwebsettings.cpp:901
+msgid "Enable Hyperlink Auditing"
+msgstr "Abilita auditing hyperlink"
+
+#: ../webkit/webkitwebsettings.cpp:902
+msgid "Whether <a ping> should be able to send pings"
+msgstr "Indica se <a ping> sia in grado di inviare ping"
+
+#: ../webkit/webkitwebsettings.cpp:910
+msgid "Enable Fullscreen"
+msgstr "Abilita schermo intero"
+
+#: ../webkit/webkitwebsettings.cpp:911
+msgid "Whether the Mozilla style API should be enabled."
+msgstr "Indica se abilitare le API in stile Mozilla."
+
+#: ../webkit/webkitwebview.cpp:2984
 msgid "Returns the @web_view's document title"
 msgstr "Restituisce il titolo del documento di @web_view"
 
-#: WebKit/gtk/webkit/webkitwebview.cpp:2333
+#: ../webkit/webkitwebview.cpp:2998
 msgid "Returns the current URI of the contents displayed by the @web_view"
 msgstr "Restituisce l'URI attuale del contenuto mostrato dalla @web_view"
 
-#: WebKit/gtk/webkit/webkitwebview.cpp:2346
+#: ../webkit/webkitwebview.cpp:3011
 msgid "Copy target list"
 msgstr "Copia elenco destinazioni"
 
 # ma ha senso??
-#: WebKit/gtk/webkit/webkitwebview.cpp:2347
+#: ../webkit/webkitwebview.cpp:3012
 msgid "The list of targets this web view supports for clipboard copying"
 msgstr ""
 "L'elenco di destinazioni che questa vista web supporta per copiare negli "
 "appunti"
 
-#: WebKit/gtk/webkit/webkitwebview.cpp:2360
+#: ../webkit/webkitwebview.cpp:3025
 msgid "Paste target list"
 msgstr "Incolla elenco destinazioni"
 
 # ma ha senso??
-#: WebKit/gtk/webkit/webkitwebview.cpp:2361
+#: ../webkit/webkitwebview.cpp:3026
 msgid "The list of targets this web view supports for clipboard pasting"
 msgstr ""
 "L'elenco di destinazioni che questa vista web supporta per incollare dagli "
 "appunti"
 
-#: WebKit/gtk/webkit/webkitwebview.cpp:2367
+#: ../webkit/webkitwebview.cpp:3032
 msgid "Settings"
 msgstr "Impostazioni"
 
-#: WebKit/gtk/webkit/webkitwebview.cpp:2368
+#: ../webkit/webkitwebview.cpp:3033
 msgid "An associated WebKitWebSettings instance"
 msgstr "Un'istanza WebKitWebSettings associata"
 
-#: WebKit/gtk/webkit/webkitwebview.cpp:2381
+#: ../webkit/webkitwebview.cpp:3046
 msgid "Web Inspector"
 msgstr "Ispettore web"
 
-#: WebKit/gtk/webkit/webkitwebview.cpp:2382
+#: ../webkit/webkitwebview.cpp:3047
 msgid "The associated WebKitWebInspector instance"
 msgstr "L'istanza WebKitWebInspector associata"
 
-#: WebKit/gtk/webkit/webkitwebview.cpp:2402
+#: ../webkit/webkitwebview.cpp:3060
+msgid "Viewport Attributes"
+msgstr "Attributi viewport"
+
+#: ../webkit/webkitwebview.cpp:3061
+msgid "The associated WebKitViewportAttributes instance"
+msgstr "L'istanza WebKitViewportAttributes associata"
+
+#: ../webkit/webkitwebview.cpp:3081
 msgid "Editable"
 msgstr "Modificabile"
 
-#: WebKit/gtk/webkit/webkitwebview.cpp:2403
+#: ../webkit/webkitwebview.cpp:3082
 msgid "Whether content can be modified by the user"
 msgstr "Indica se il contenuto può essere modificato dall'utente"
 
-#: WebKit/gtk/webkit/webkitwebview.cpp:2409
+#: ../webkit/webkitwebview.cpp:3088
 msgid "Transparent"
 msgstr "Trasparente"
 
-#: WebKit/gtk/webkit/webkitwebview.cpp:2410
+#: ../webkit/webkitwebview.cpp:3089
 msgid "Whether content has a transparent background"
 msgstr "Indica se il contenuto ha uno sfondo trasparente"
 
-#: WebKit/gtk/webkit/webkitwebview.cpp:2423
+#: ../webkit/webkitwebview.cpp:3102
 msgid "Zoom level"
 msgstr "Livello ingrandimento"
 
-#: WebKit/gtk/webkit/webkitwebview.cpp:2424
+#: ../webkit/webkitwebview.cpp:3103
 msgid "The level of zoom of the content"
 msgstr "Il livello di ingrandimento del contenuto"
 
-#: WebKit/gtk/webkit/webkitwebview.cpp:2439
+#: ../webkit/webkitwebview.cpp:3118
 msgid "Full content zoom"
 msgstr "Ingrandimento intero contenuto"
 
-#: WebKit/gtk/webkit/webkitwebview.cpp:2440
+#: ../webkit/webkitwebview.cpp:3119
 msgid "Whether the full content is scaled when zooming"
 msgstr "Indica se all'ingrandimento viene scalato l'intero contenuto"
 
-#: WebKit/gtk/webkit/webkitwebview.cpp:2453
-msgid "Encoding"
-msgstr "Codifica"
-
-#: WebKit/gtk/webkit/webkitwebview.cpp:2454
+#: ../webkit/webkitwebview.cpp:3133
 msgid "The default encoding of the web view"
 msgstr "La codifica predefinita della vista web"
 
-#: WebKit/gtk/webkit/webkitwebview.cpp:2467
+#: ../webkit/webkitwebview.cpp:3146
 msgid "Custom Encoding"
 msgstr "Codifica personalizzata"
 
-#: WebKit/gtk/webkit/webkitwebview.cpp:2468
+#: ../webkit/webkitwebview.cpp:3147
 msgid "The custom encoding of the web view"
 msgstr "La codifica personalizzata della vista web"
 
-#: WebKit/gtk/webkit/webkitwebview.cpp:2520
+#: ../webkit/webkitwebview.cpp:3199
 msgid "Icon URI"
 msgstr "URI di icona"
 
-#: WebKit/gtk/webkit/webkitwebview.cpp:2521
+#: ../webkit/webkitwebview.cpp:3200
 msgid "The URI for the favicon for the #WebKitWebView."
 msgstr "L'URI per la favicon della #WebKitWebView."
 
-#: WebCore/platform/gtk/LocalizedStringsGtk.cpp:55
-#: WebCore/platform/gtk/LocalizedStringsGtk.cpp:60
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:56
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:61
 msgid "Submit"
 msgstr "Invia"
 
-#: WebCore/platform/gtk/LocalizedStringsGtk.cpp:65
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:66
 msgid "Reset"
 msgstr "Azzera"
 
-#: WebCore/platform/gtk/LocalizedStringsGtk.cpp:70
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:71
 msgid "This is a searchable index. Enter search keywords: "
 msgstr ""
-"Questo indice consente ricerche. Inserire la parole chiave da cercare: "
+"Questo indice consente ricerche. Inserire le parole chiave da cercare: "
 
-#: WebCore/platform/gtk/LocalizedStringsGtk.cpp:75
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:76
 msgid "Choose File"
 msgstr "Scelta file"
 
-#: WebCore/platform/gtk/LocalizedStringsGtk.cpp:80
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:81
 msgid "(None)"
 msgstr "(Nessuno)"
 
-#: WebCore/platform/gtk/LocalizedStringsGtk.cpp:85
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:86
 msgid "Open Link in New _Window"
 msgstr "Apri collegamento in nuova _finestra"
 
-#: WebCore/platform/gtk/LocalizedStringsGtk.cpp:90
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:91
 msgid "_Download Linked File"
 msgstr "_Scarica file collegato"
 
-#: WebCore/platform/gtk/LocalizedStringsGtk.cpp:95
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:96
 msgid "Copy Link Loc_ation"
 msgstr "Copia _posizione collegamento"
 
-#: WebCore/platform/gtk/LocalizedStringsGtk.cpp:100
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:101
 msgid "Open _Image in New Window"
 msgstr "Apri _immagine in nuova finestra"
 
-#: WebCore/platform/gtk/LocalizedStringsGtk.cpp:105
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:106
 msgid "Sa_ve Image As"
 msgstr "Sal_va immagine come"
 
-#: WebCore/platform/gtk/LocalizedStringsGtk.cpp:110
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:111
 msgid "Cop_y Image"
 msgstr "Copia i_mmagine"
 
-#: WebCore/platform/gtk/LocalizedStringsGtk.cpp:115
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:116
+msgid "Open _Video in New Window"
+msgstr "Apri _video in nuova finestra"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:121
+msgid "Open _Audio in New Window"
+msgstr "Apri _audio in nuova finestra"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:126
+msgid "Cop_y Video Link Location"
+msgstr "Copia _posizione collegamento video"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:131
+msgid "Cop_y Audio Link Location"
+msgstr "Copia _posizione collegamento audio"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:136
+msgid "_Toggle Media Controls"
+msgstr "Commu_ta controlli multimediali"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:141
+msgid "Toggle Media _Loop Playback"
+msgstr "Commuta _ripetizione multimediale"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:146
+msgid "Switch Video to _Fullscreen"
+msgstr "Mostra video a sc_hermo intero"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:151
+msgid "_Play"
+msgstr "_Riproduci"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:156
+msgid "_Pause"
+msgstr "_Pausa"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:161
+msgid "_Mute"
+msgstr "_Escludi audio"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:166
 msgid "Open _Frame in New Window"
-msgstr "Apri c_ornice in nuova finestra"
+msgstr "Apri _frame in nuova finestra"
 
-#: WebCore/platform/gtk/LocalizedStringsGtk.cpp:166
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:217
 msgid "_Reload"
 msgstr "A_ggiorna"
 
 # omesso Found
-#: WebCore/platform/gtk/LocalizedStringsGtk.cpp:183
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:234
 msgid "No Guesses Found"
 msgstr "Nessun suggerimento"
 
-#: WebCore/platform/gtk/LocalizedStringsGtk.cpp:188
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:239
 msgid "_Ignore Spelling"
 msgstr "_Ignora ortografia"
 
-#: WebCore/platform/gtk/LocalizedStringsGtk.cpp:193
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:244
 msgid "_Learn Spelling"
 msgstr "A_pprendi ortografia"
 
-#: WebCore/platform/gtk/LocalizedStringsGtk.cpp:198
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:249
 msgid "_Search the Web"
 msgstr "_Cerca nel web"
 
-#: WebCore/platform/gtk/LocalizedStringsGtk.cpp:203
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:254
 msgid "_Look Up in Dictionary"
 msgstr "Consu_lta dizionario"
 
-#: WebCore/platform/gtk/LocalizedStringsGtk.cpp:208
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:259
 msgid "_Open Link"
 msgstr "_Apri collegamento"
 
-#: WebCore/platform/gtk/LocalizedStringsGtk.cpp:213
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:264
 msgid "Ignore _Grammar"
 msgstr "Ignora _grammatica"
 
-#: WebCore/platform/gtk/LocalizedStringsGtk.cpp:218
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:269
 msgid "Spelling and _Grammar"
 msgstr "Ortografia e _grammatica"
 
-#: WebCore/platform/gtk/LocalizedStringsGtk.cpp:223
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:274
 msgid "_Show Spelling and Grammar"
 msgstr "_Mostra ortografia e grammatica"
 
-#: WebCore/platform/gtk/LocalizedStringsGtk.cpp:223
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:274
 msgid "_Hide Spelling and Grammar"
 msgstr "_Nascondi ortografia e grammatica"
 
-#: WebCore/platform/gtk/LocalizedStringsGtk.cpp:228
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:279
 msgid "_Check Document Now"
 msgstr "_Controlla documento ora"
 
-#: WebCore/platform/gtk/LocalizedStringsGtk.cpp:233
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:284
 msgid "Check Spelling While _Typing"
 msgstr "Controlla ortografia durante _digitazione"
 
-#: WebCore/platform/gtk/LocalizedStringsGtk.cpp:238
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:289
 msgid "Check _Grammar With Spelling"
 msgstr "Controlla _grammatica con ortografia"
 
-#: WebCore/platform/gtk/LocalizedStringsGtk.cpp:243
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:294
 msgid "_Font"
 msgstr "_Tipo di carattere"
 
@@ -912,260 +1240,275 @@ msgstr "_Tipo di carattere"
 # Le traduzioni di questi ultimi tre effetti per i font è presa
 # dalle GTK_STOCK (_Grassetto, _Corsivo, _Sottolineato)
 # Usato Co_ntorno come in OpenOffice.org
-#: WebCore/platform/gtk/LocalizedStringsGtk.cpp:266
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:317
 msgid "_Outline"
 msgstr "Co_ntorno"
 
-#: WebCore/platform/gtk/LocalizedStringsGtk.cpp:271
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:322
 msgid "Inspect _Element"
 msgstr "Ispeziona _elemento"
 
-#: WebCore/platform/gtk/LocalizedStringsGtk.cpp:276
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:327
 msgid "No recent searches"
 msgstr "Nessuna ricerca recente"
 
-#: WebCore/platform/gtk/LocalizedStringsGtk.cpp:281
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:332
 msgid "Recent searches"
 msgstr "Ricerche recenti"
 
-#: WebCore/platform/gtk/LocalizedStringsGtk.cpp:286
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:337
 msgid "_Clear recent searches"
 msgstr "Pu_lisci ricerche recenti"
 
 # String AXDefinitionListTermText()
-#: WebCore/platform/gtk/LocalizedStringsGtk.cpp:291
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:342
 msgid "term"
 msgstr "termine"
 
 # String AXDefinitionListDefinitionText()
-#: WebCore/platform/gtk/LocalizedStringsGtk.cpp:296
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:347
 msgid "definition"
 msgstr "definizione"
 
 # String AXButtonActionVerb()
-#: WebCore/platform/gtk/LocalizedStringsGtk.cpp:301
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:352
 msgid "press"
 msgstr "premi"
 
 # String AXRadioButtonActionVerb()
-#: WebCore/platform/gtk/LocalizedStringsGtk.cpp:306
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:357
 msgid "select"
 msgstr "seleziona"
 
 # String AXTextFieldActionVerb()
-#: WebCore/platform/gtk/LocalizedStringsGtk.cpp:311
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:362
 msgid "activate"
 msgstr "attiva"
 
 # String AXCheckedCheckBoxActionVerb()
-#: WebCore/platform/gtk/LocalizedStringsGtk.cpp:316
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:367
 msgid "uncheck"
 msgstr "togli spunta"
 
 # String AXUncheckedCheckBoxActionVerb()
-#: WebCore/platform/gtk/LocalizedStringsGtk.cpp:321
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:372
 msgid "check"
 msgstr "metti spunta"
 
 # String AXLinkActionVerb()
-#: WebCore/platform/gtk/LocalizedStringsGtk.cpp:326
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:377
 msgid "jump"
 msgstr "salta"
 
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:392
+msgid "Missing Plug-in"
+msgstr "Plugin mancante"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:398
+msgid "Plug-in Failure"
+msgstr "Fallimento plugin"
+
 # String multipleFileUploadText(unsigned numberOfFiles)
-#: WebCore/platform/gtk/LocalizedStringsGtk.cpp:342
+#. FIXME: If this file gets localized, this should really be localized as one string with a wildcard for the number.
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:404
 msgid " files"
 msgstr " file"
 
 # String unknownFileSizeText()
-#: WebCore/platform/gtk/LocalizedStringsGtk.cpp:347
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:409
 msgid "Unknown"
 msgstr "Sconosciuta"
 
-#: WebCore/platform/gtk/LocalizedStringsGtk.cpp:364
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:414
+#, c-format
+msgctxt "Title string for images"
+msgid "%s  (%dx%d pixels)"
+msgstr "%s  (%d×%d pixel)"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:426
 msgid "Loading..."
 msgstr "Caricamento..."
 
-#: WebCore/platform/gtk/LocalizedStringsGtk.cpp:369
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:431
 msgid "Live Broadcast"
 msgstr "Diffusione live"
 
-#: WebCore/platform/gtk/LocalizedStringsGtk.cpp:375
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:437
 msgid "audio element controller"
 msgstr "controllore elemento audio"
 
-#: WebCore/platform/gtk/LocalizedStringsGtk.cpp:377
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:439
 msgid "video element controller"
 msgstr "controllore elemento video"
 
-#: WebCore/platform/gtk/LocalizedStringsGtk.cpp:379
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:441
 msgid "mute"
 msgstr "escludi audio"
 
-#: WebCore/platform/gtk/LocalizedStringsGtk.cpp:381
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:443
 msgid "unmute"
 msgstr "abilita audio"
 
-#: WebCore/platform/gtk/LocalizedStringsGtk.cpp:383
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:445
 msgid "play"
 msgstr "riproduci"
 
-#: WebCore/platform/gtk/LocalizedStringsGtk.cpp:385
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:447
 msgid "pause"
 msgstr "pausa"
 
 # name == "Slider"
-#: WebCore/platform/gtk/LocalizedStringsGtk.cpp:387
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:449
 msgid "movie time"
 msgstr "tempo filmato"
 
 # name == "SliderThumb"
-#: WebCore/platform/gtk/LocalizedStringsGtk.cpp:389
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:451
 msgid "timeline slider thumb"
 msgstr "cursore dello scorrevole per linea temporale"
 
-#: WebCore/platform/gtk/LocalizedStringsGtk.cpp:391
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:453
 msgid "back 30 seconds"
 msgstr "indietro 30 secondi"
 
-#: WebCore/platform/gtk/LocalizedStringsGtk.cpp:393
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:455
 msgid "return to realtime"
 msgstr "ritorna a tempo effettivo"
 
-#: WebCore/platform/gtk/LocalizedStringsGtk.cpp:395
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:457
 msgid "elapsed time"
 msgstr "tempo trascorso"
 
-#: WebCore/platform/gtk/LocalizedStringsGtk.cpp:397
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:459
 msgid "remaining time"
 msgstr "tempo rimanente"
 
-#: WebCore/platform/gtk/LocalizedStringsGtk.cpp:399
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:461
 msgid "status"
 msgstr "stato"
 
-#: WebCore/platform/gtk/LocalizedStringsGtk.cpp:401
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:463
 msgid "fullscreen"
 msgstr "schermo intero"
 
-#: WebCore/platform/gtk/LocalizedStringsGtk.cpp:403
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:465
 msgid "fast forward"
 msgstr "avanti veloce"
 
-#: WebCore/platform/gtk/LocalizedStringsGtk.cpp:405
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:467
 msgid "fast reverse"
 msgstr "indietro veloce"
 
-#: WebCore/platform/gtk/LocalizedStringsGtk.cpp:407
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:469
 msgid "show closed captions"
 msgstr "mostra sottotitoli"
 
-#: WebCore/platform/gtk/LocalizedStringsGtk.cpp:409
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:471
 msgid "hide closed captions"
 msgstr "nascondi sottotitoli"
 
-#: WebCore/platform/gtk/LocalizedStringsGtk.cpp:418
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:480
 msgid "audio element playback controls and status display"
 msgstr "controlli di riproduzione e visualizzazione stato di elementi audio"
 
-#: WebCore/platform/gtk/LocalizedStringsGtk.cpp:420
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:482
 msgid "video element playback controls and status display"
 msgstr "controlli di riproduzione e visualizzazione stato di elementi video"
 
-#: WebCore/platform/gtk/LocalizedStringsGtk.cpp:422
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:484
 msgid "mute audio tracks"
 msgstr "escludi tracce audio"
 
-#: WebCore/platform/gtk/LocalizedStringsGtk.cpp:424
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:486
 msgid "unmute audio tracks"
 msgstr "abilita tracce audio"
 
-#: WebCore/platform/gtk/LocalizedStringsGtk.cpp:426
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:488
 msgid "begin playback"
 msgstr "inizia la riproduzione"
 
-#: WebCore/platform/gtk/LocalizedStringsGtk.cpp:428
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:490
 msgid "pause playback"
 msgstr "mette in pausa la riproduzione"
 
 # non so se è corretto... per induzione dovrebbe
-#: WebCore/platform/gtk/LocalizedStringsGtk.cpp:430
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:492
 msgid "movie time scrubber"
 msgstr "cambia con trascinamento il tempo del filmato"
 
 # non so se è corretto... per induzione dovrebbe
-#: WebCore/platform/gtk/LocalizedStringsGtk.cpp:432
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:494
 msgid "movie time scrubber thumb"
 msgstr "cursore per cambiare con trascinamento il tempo del filmato"
 
-#: WebCore/platform/gtk/LocalizedStringsGtk.cpp:434
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:496
 msgid "seek movie back 30 seconds"
 msgstr "posiziona il filmato indietro di 30 secondi"
 
-#: WebCore/platform/gtk/LocalizedStringsGtk.cpp:436
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:498
 msgid "return streaming movie to real time"
 msgstr "riporta il filmato in streaming al tempo reale"
 
-#: WebCore/platform/gtk/LocalizedStringsGtk.cpp:438
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:500
 msgid "current movie time in seconds"
 msgstr "tempo corrente del filmato in secondi"
 
-#: WebCore/platform/gtk/LocalizedStringsGtk.cpp:440
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:502
 msgid "number of seconds of movie remaining"
 msgstr "numero di secondi rimanenti del filmato"
 
-#: WebCore/platform/gtk/LocalizedStringsGtk.cpp:442
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:504
 msgid "current movie status"
 msgstr "stato attuale del filmato"
 
-#: WebCore/platform/gtk/LocalizedStringsGtk.cpp:444
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:506
 msgid "seek quickly back"
 msgstr "posiziona indietro rapidamente"
 
-#: WebCore/platform/gtk/LocalizedStringsGtk.cpp:446
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:508
 msgid "seek quickly forward"
 msgstr "posiziona avanti rapidamente"
 
-#: WebCore/platform/gtk/LocalizedStringsGtk.cpp:448
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:510
 msgid "Play movie in fullscreen mode"
 msgstr "Riproduce il filmato in modalità schermo intero"
 
-#: WebCore/platform/gtk/LocalizedStringsGtk.cpp:450
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:512
 msgid "start displaying closed captions"
 msgstr "avvia la visualizzazione dei sottotitoli"
 
-#: WebCore/platform/gtk/LocalizedStringsGtk.cpp:452
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:514
 msgid "stop displaying closed captions"
 msgstr "interrompe la visualizzazione dei sottotitoli"
 
-#: WebCore/platform/gtk/LocalizedStringsGtk.cpp:461
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:523
 msgid "indefinite time"
 msgstr "tempo indefinito"
 
-#: WebCore/platform/gtk/LocalizedStringsGtk.cpp:491
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:553
 msgid "value missing"
 msgstr "valore mancante"
 
-#: WebCore/platform/gtk/LocalizedStringsGtk.cpp:497
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:589
 msgid "type mismatch"
 msgstr "discrepanza di tipo"
 
-#: WebCore/platform/gtk/LocalizedStringsGtk.cpp:502
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:612
 msgid "pattern mismatch"
 msgstr "discrepanza di modello"
 
-#: WebCore/platform/gtk/LocalizedStringsGtk.cpp:507
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:617
 msgid "too long"
 msgstr "troppo lungo"
 
-#: WebCore/platform/gtk/LocalizedStringsGtk.cpp:512
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:622
 msgid "range underflow"
 msgstr "superamento limite inferiore dell'intervallo"
 
-#: WebCore/platform/gtk/LocalizedStringsGtk.cpp:517
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:627
 msgid "range overflow"
 msgstr "superamento limite superiore dell'intervallo"
 
-#: WebCore/platform/gtk/LocalizedStringsGtk.cpp:522
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:632
 msgid "step mismatch"
 msgstr "discrepanza di passo"
diff --git a/Source/WebKit/gtk/tests/testapplicationcache.c b/Source/WebKit/gtk/tests/testapplicationcache.c
index 55e360c..2b022fc 100644
--- a/Source/WebKit/gtk/tests/testapplicationcache.c
+++ b/Source/WebKit/gtk/tests/testapplicationcache.c
@@ -37,25 +37,6 @@ static void test_application_cache_maximum_size()
     g_assert(maxSize == webkit_application_cache_get_maximum_size());
 }
 
-static void test_application_cache_database_directory_path()
-{
-    unsigned long long maxSize = 8192;
-    webkit_application_cache_set_maximum_size(maxSize);
-
-    gchar* databaseDirectorySet = g_build_filename(g_get_user_data_dir(), "webkit", "databases", NULL);
-    webkit_application_cache_set_database_directory_path(databaseDirectorySet);
-
-    // Creating a WebView - make sure that it didn't change anything
-    WebKitWebView* webView = WEBKIT_WEB_VIEW(webkit_web_view_new());
-    g_object_ref_sink(webView);
-    g_object_unref(webView);
-
-    const gchar* databaseDirectoryGet = webkit_application_cache_get_database_directory_path();
-    g_assert_cmpstr(databaseDirectorySet, ==, databaseDirectoryGet);
-
-    g_free(databaseDirectorySet);
-}
-
 int main(int argc, char** argv)
 {
     g_thread_init(NULL);
@@ -64,8 +45,6 @@ int main(int argc, char** argv)
     g_test_bug_base("https://bugs.webkit.org/");
     g_test_add_func("/webkit/application_cache/maximum_size",
                     test_application_cache_maximum_size);
-    g_test_add_func("/webkit/application_cache/database_directory_path",
-                    test_application_cache_database_directory_path);
 
     return g_test_run();
 }
diff --git a/Source/WebKit/gtk/tests/testatk.c b/Source/WebKit/gtk/tests/testatk.c
index 79ca67d..161b4b8 100644
--- a/Source/WebKit/gtk/tests/testatk.c
+++ b/Source/WebKit/gtk/tests/testatk.c
@@ -52,7 +52,7 @@ static const char* comboBoxSelector = "<html><body><select><option selected valu
 
 static const char* formWithTextInputs = "<html><body><form><input type='text' name='entry' /></form></body></html>";
 
-static const char* hypertextAndHyperlinks = "<html><body><p>A paragraph with no links at all</p><p><a href='http://foo.bar.baz/'>A line</a> with <a href='http://bar.baz.foo/'>a link in the middle</a> as well as at the beginning and <a href='http://baz.foo.bar/'>at the end</a></p></body></html>";
+static const char* hypertextAndHyperlinks = "<html><body><p>A paragraph with no links at all</p><p><a href='http://foo.bar.baz/'>A line</a> with <a href='http://bar.baz.foo/'>a link in the middle</a> as well as at the beginning and <a href='http://baz.foo.bar/'>at the end</a></p><ol><li>List item with a <span><a href='http://foo.bar.baz/'>link inside a span node</a></span></li></ol></body></html>";
 
 static const char* layoutAndDataTables = "<html><body><table><tr><th>Odd</th><th>Even</th></tr><tr><td>1</td><td>2</td></tr></table><table><tr><td>foo</td><td>bar</td></tr></table></body></html>";
 
@@ -1405,6 +1405,25 @@ static void testWebkitAtkHypertextAndHyperlinks()
     g_assert_cmpint(atk_hyperlink_get_n_anchors(hLink3), ==, 1);
     g_assert_cmpstr(atk_hyperlink_get_uri(hLink3, 0), ==, "http://baz.foo.bar/");
 
+    AtkObject* list = atk_object_ref_accessible_child(object, 2);
+    g_assert(ATK_OBJECT(list));
+    g_assert(atk_object_get_role(list) == ATK_ROLE_LIST);
+    g_assert_cmpint(atk_object_get_n_accessible_children(list), ==, 1);
+
+    AtkObject* listItem = atk_object_ref_accessible_child(list, 0);
+    g_assert(ATK_IS_TEXT(listItem));
+    g_assert(ATK_IS_HYPERTEXT(listItem));
+
+    AtkHyperlink* hLinkInListItem = atk_hypertext_get_link(ATK_HYPERTEXT(listItem), 0);
+    g_assert(ATK_HYPERLINK(hLinkInListItem));
+    AtkObject* hLinkObject = atk_hyperlink_get_object(hLinkInListItem, 0);
+    g_assert(ATK_OBJECT(hLinkObject));
+    g_assert(atk_object_get_role(hLinkObject) == ATK_ROLE_LINK);
+    g_assert_cmpint(atk_hyperlink_get_start_index(hLinkInListItem), ==, 20);
+    g_assert_cmpint(atk_hyperlink_get_end_index(hLinkInListItem), ==, 43);
+    g_assert_cmpint(atk_hyperlink_get_n_anchors(hLinkInListItem), ==, 1);
+    g_assert_cmpstr(atk_hyperlink_get_uri(hLinkInListItem, 0), ==, "http://foo.bar.baz/");
+
     /* Finally check the AtkAction interface for a given AtkHyperlink. */
     g_assert(ATK_IS_ACTION(hLink1));
     g_assert_cmpint(atk_action_get_n_actions(ATK_ACTION(hLink1)), ==, 1);
@@ -1414,6 +1433,8 @@ static void testWebkitAtkHypertextAndHyperlinks()
 
     g_object_unref(paragraph1);
     g_object_unref(paragraph2);
+    g_object_unref(list);
+    g_object_unref(listItem);
     g_object_unref(webView);
 }
 
diff --git a/Source/WebKit/gtk/tests/testdomdomwindow.c b/Source/WebKit/gtk/tests/testdomdomwindow.c
index b15558e..0d93408 100644
--- a/Source/WebKit/gtk/tests/testdomdomwindow.c
+++ b/Source/WebKit/gtk/tests/testdomdomwindow.c
@@ -105,7 +105,7 @@ static void load_event_callback(WebKitWebView* webView, GParamSpec* spec, DomDom
 {
     WebKitLoadStatus status = webkit_web_view_get_load_status(webView);
     if (status == WEBKIT_LOAD_FINISHED) {
-        g_signal_connect(fixture->domWindow, "click-event", G_CALLBACK(clickedCallback), fixture);
+        webkit_dom_event_target_add_event_listener(WEBKIT_DOM_EVENT_TARGET(fixture->domWindow), "click", G_CALLBACK(clickedCallback), false, fixture);
 
         g_assert(fixture->clicked == FALSE);
         gtk_test_widget_click(GTK_WIDGET(fixture->webView), 1, 0);
@@ -125,7 +125,7 @@ static void test_dom_domview_signals(DomDomviewFixture* fixture, gconstpointer d
 
     fixture->domWindow = domWindow;
 
-    g_signal_connect(fixture->domWindow, "load-event", G_CALLBACK(loadedCallback), fixture);
+    webkit_dom_event_target_add_event_listener(WEBKIT_DOM_EVENT_TARGET(fixture->domWindow), "load", G_CALLBACK(loadedCallback), false, fixture);
     g_signal_connect(fixture->window, "map-event", G_CALLBACK(map_event_cb), fixture);
     g_signal_connect(fixture->webView, "notify::load-status", G_CALLBACK(load_event_callback), fixture);
 
@@ -176,7 +176,7 @@ static void load_status_callback(WebKitWebView* webView, GParamSpec* spec, DomDo
                                                 fixture->domWindow, 0, 0, 0, clientX, clientY,
                                                 FALSE, FALSE, FALSE, FALSE,
                                                 1, WEBKIT_DOM_EVENT_TARGET(element));
-        g_signal_connect(element, "click-event", G_CALLBACK(clicked_cb), fixture);
+        webkit_dom_event_target_add_event_listener(WEBKIT_DOM_EVENT_TARGET(element), "click", G_CALLBACK(clicked_cb), false, fixture);
         g_assert(fixture->clicked == FALSE);
         webkit_dom_event_target_dispatch_event(WEBKIT_DOM_EVENT_TARGET(element), event, NULL);
     }
diff --git a/Source/WebKit/gtk/tests/testwebview.c b/Source/WebKit/gtk/tests/testwebview.c
index 778235d..97e8a50 100644
--- a/Source/WebKit/gtk/tests/testwebview.c
+++ b/Source/WebKit/gtk/tests/testwebview.c
@@ -266,7 +266,10 @@ static void do_test_webkit_web_view_adjustments(gboolean with_page_cache)
     g_assert_cmpfloat(lower, ==, gtk_adjustment_get_lower(adjustment));
     g_assert_cmpfloat(upper, ==, gtk_adjustment_get_upper(adjustment));
 
-    g_assert_cmpfloat(gtk_adjustment_get_value(adjustment), ==, 100.0);
+    /* This assert is temporarily disabled until we fix the following bug: */
+    /* https://bugs.webkit.org/show_bug.cgi?id=57315 */
+    /* It should be re-enabled ASAP. */
+    /* g_assert_cmpfloat(gtk_adjustment_get_value(adjustment), ==, 100.0); */
 
     g_free(effective_uri);
     g_free(second_uri);
diff --git a/Source/WebKit/gtk/webkit/webkit.h b/Source/WebKit/gtk/webkit/webkit.h
index d85d698..77e96bc 100644
--- a/Source/WebKit/gtk/webkit/webkit.h
+++ b/Source/WebKit/gtk/webkit/webkit.h
@@ -30,6 +30,7 @@
 #include <webkit/webkitgeolocationpolicydecision.h>
 #include <webkit/webkitglobals.h>
 #include <webkit/webkithittestresult.h>
+#include <webkit/webkiticondatabase.h>
 #include <webkit/webkitnetworkrequest.h>
 #include <webkit/webkitnetworkresponse.h>
 #include <webkit/webkitsecurityorigin.h>
diff --git a/Source/WebKit/gtk/webkit/webkitapplicationcache.cpp b/Source/WebKit/gtk/webkit/webkitapplicationcache.cpp
index ab179b5..0b65d04 100644
--- a/Source/WebKit/gtk/webkit/webkitapplicationcache.cpp
+++ b/Source/WebKit/gtk/webkit/webkitapplicationcache.cpp
@@ -26,8 +26,6 @@
 #include <wtf/UnusedParam.h>
 #include <wtf/text/CString.h>
 
-// keeps current directory path to offline web applications cache database
-static WTF::CString cacheDirectoryPath = "";
 // web application cache maximum storage size
 static unsigned long long cacheMaxSize = UINT_MAX;
 
@@ -89,33 +87,9 @@ G_CONST_RETURN gchar* webkit_application_cache_get_database_directory_path()
 {
 #if ENABLE(OFFLINE_WEB_APPLICATIONS)
     CString path = WebCore::fileSystemRepresentation(WebCore::cacheStorage().cacheDirectory());
-
-    if (path != cacheDirectoryPath)
-        cacheDirectoryPath = path;
-
-    return cacheDirectoryPath.data();
+    return path.data();
 #else
     return "";
 #endif
 }
 
-/**
- * webkit_application_cache_set_database_directory_path:
- * @path: the new web application cache database path
- *
- * Sets the current path to the directory WebKit will write web aplication cache
- * databases.
- *
- * Since: 1.3.13
- **/
-void webkit_application_cache_set_database_directory_path(const gchar* path)
-{
-#if ENABLE(OFFLINE_WEB_APPLICATIONS)
-    WTF::CString pathString(path);
-    if (pathString != cacheDirectoryPath)
-        cacheDirectoryPath = pathString;
-
-    WebCore::cacheStorage().setCacheDirectory(WebCore::filenameToString(cacheDirectoryPath.data()));
-#endif
-}
-
diff --git a/Source/WebKit/gtk/webkit/webkitapplicationcache.h b/Source/WebKit/gtk/webkit/webkitapplicationcache.h
index 810a5d6..bb0f867 100644
--- a/Source/WebKit/gtk/webkit/webkitapplicationcache.h
+++ b/Source/WebKit/gtk/webkit/webkitapplicationcache.h
@@ -25,16 +25,13 @@
 G_BEGIN_DECLS
 
 WEBKIT_API unsigned long long
-webkit_application_cache_get_maximum_size();
+webkit_application_cache_get_maximum_size(void);
 
 WEBKIT_API void
 webkit_application_cache_set_maximum_size(unsigned long long size);
 
 WEBKIT_API G_CONST_RETURN gchar*
-webkit_application_cache_get_database_directory_path  (void);
-
-WEBKIT_API void
-webkit_application_cache_set_database_directory_path  (const gchar* path);
+webkit_application_cache_get_database_directory_path(void);
 
 G_END_DECLS
 
diff --git a/Source/WebKit/gtk/webkit/webkitdefines.h b/Source/WebKit/gtk/webkit/webkitdefines.h
index b0b607b..0b88084 100644
--- a/Source/WebKit/gtk/webkit/webkitdefines.h
+++ b/Source/WebKit/gtk/webkit/webkitdefines.h
@@ -41,6 +41,9 @@
 
 G_BEGIN_DECLS
 
+typedef struct _WebKitIconDatabase WebKitIconDatabase;
+typedef struct _WebKitIconDatabaseClass WebKitIconDatabaseClass;
+
 typedef struct _WebKitNetworkRequest WebKitNetworkRequest;
 typedef struct _WebKitNetworkRequestClass WebKitNetworkRequestClass;
 
diff --git a/Source/WebKit/gtk/webkit/webkitglobals.cpp b/Source/WebKit/gtk/webkit/webkitglobals.cpp
index 4d07ceb..b8d8b1f 100644
--- a/Source/WebKit/gtk/webkit/webkitglobals.cpp
+++ b/Source/WebKit/gtk/webkit/webkitglobals.cpp
@@ -40,6 +40,7 @@
 #include "ResourceResponse.h"
 #include "webkitapplicationcache.h"
 #include "webkitglobalsprivate.h"
+#include "webkiticondatabase.h"
 #include "webkitsoupauthdialog.h"
 #include "webkitwebdatabase.h"
 #include "webkitwebplugindatabaseprivate.h"
@@ -223,9 +224,24 @@ static GtkWidget* currentToplevelCallback(WebKitSoupAuthDialog* feature, SoupMes
         return NULL;
 }
 
-static void closeIconDatabaseOnExit()
+/**
+ * webkit_get_icon_database:
+ *
+ * Returns the #WebKitIconDatabase providing access to website icons.
+ *
+ * Return value: (transfer none): the current #WebKitIconDatabase
+ *
+ * Since: 1.3.13
+ */
+WebKitIconDatabase* webkit_get_icon_database()
 {
-    iconDatabase().close();
+    webkitInit();
+
+    static WebKitIconDatabase* database = 0;
+    if (!database)
+        database = WEBKIT_ICON_DATABASE(g_object_new(WEBKIT_TYPE_ICON_DATABASE, NULL));
+
+    return database;
 }
 
 void webkitInit()
@@ -249,14 +265,15 @@ void webkitInit()
 
     gchar* databaseDirectory = g_build_filename(g_get_user_data_dir(), "webkit", "databases", NULL);
     webkit_set_web_database_directory_path(databaseDirectory);
-    webkit_application_cache_set_database_directory_path(databaseDirectory);
+    WebCore::cacheStorage().setCacheDirectory(databaseDirectory);
 
     g_free(databaseDirectory);
 
     PageGroup::setShouldTrackVisitedLinks(true);
 
     Pasteboard::generalPasteboard()->setHelper(WebKit::pasteboardHelperInstance());
-    WebKit::setIconDatabaseEnabled(true);
+    GOwnPtr<gchar> iconDatabasePath(g_build_filename(g_get_user_data_dir(), "webkit", "icondatabase", NULL));
+    webkit_icon_database_set_path(webkit_get_icon_database(), iconDatabasePath.get());
 
     SoupSession* session = webkit_get_default_session();
 
@@ -280,25 +297,5 @@ PasteboardHelperGtk* pasteboardHelperInstance()
     return helper;
 }
 
-void setIconDatabaseEnabled(bool enabled)
-{
-    static bool initialized = false;
-    if (enabled && !initialized) {
-        initialized = true;
-        atexit(closeIconDatabaseOnExit);
-    }
-
-    if (enabled) {
-        iconDatabase().setEnabled(true);
-        GOwnPtr<gchar> iconDatabasePath(g_build_filename(g_get_user_data_dir(), "webkit", "icondatabase", NULL));
-        iconDatabase().open(iconDatabasePath.get());
-        return;
-    }
-
-    iconDatabase().setEnabled(false);
-    iconDatabase().close();
-}
-
-
 } /** end namespace WebKit */
 
diff --git a/Source/WebKit/gtk/webkit/webkitglobals.h b/Source/WebKit/gtk/webkit/webkitglobals.h
index 612c195..33d2b8b 100644
--- a/Source/WebKit/gtk/webkit/webkitglobals.h
+++ b/Source/WebKit/gtk/webkit/webkitglobals.h
@@ -58,6 +58,9 @@ webkit_get_default_session                      (void);
 WEBKIT_API WebKitWebPluginDatabase *
 webkit_get_web_plugin_database                  (void);
 
+WEBKIT_API WebKitIconDatabase *
+webkit_get_icon_database                        (void);
+
 WEBKIT_API void
 webkit_set_cache_model                          (WebKitCacheModel     cache_model);
 
diff --git a/Source/WebKit/gtk/webkit/webkitglobalsprivate.h b/Source/WebKit/gtk/webkit/webkitglobalsprivate.h
index 7eb3aae..5923f2e 100644
--- a/Source/WebKit/gtk/webkit/webkitglobalsprivate.h
+++ b/Source/WebKit/gtk/webkit/webkitglobalsprivate.h
@@ -33,7 +33,6 @@ namespace WebKit {
 class PasteboardHelperGtk;
 PasteboardHelperGtk* pasteboardHelperInstance();
 
-void setIconDatabaseEnabled(bool);
 }
 
 extern "C" {
diff --git a/Source/WebKit/gtk/webkit/webkiticondatabase.cpp b/Source/WebKit/gtk/webkit/webkiticondatabase.cpp
new file mode 100644
index 0000000..397bd51
--- /dev/null
+++ b/Source/WebKit/gtk/webkit/webkiticondatabase.cpp
@@ -0,0 +1,317 @@
+/*
+ * Copyright (C) 2011 Christian Dywan <christian@lanedo.com>
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#include "config.h"
+#include "webkiticondatabase.h"
+
+#include "DatabaseDetails.h"
+#include "DatabaseTracker.h"
+#include "FileSystem.h"
+#include "IconDatabase.h"
+#include "Image.h"
+#include "IntSize.h"
+#include "webkitglobalsprivate.h"
+#include "webkitmarshal.h"
+#include "webkitsecurityoriginprivate.h"
+#include "webkitwebframe.h"
+#include <glib/gi18n-lib.h>
+#include <wtf/gobject/GOwnPtr.h>
+#include <wtf/text/CString.h>
+
+/**
+ * SECTION:webkitwebdatabase
+ * @short_description: A WebKit web application database
+ *
+ * #WebKitIconDatabase provides access to website icons, as shown
+ * in tab labels, window captions or bookmarks. All views share
+ * the same icon database.
+ *
+ * The icon database is enabled by default and stored in
+ * ~/.local/share/webkit/icondatabase, depending on XDG_DATA_HOME.
+ *
+ * WebKit will automatically look for available icons in link elements
+ * on opened pages as well as an existing favicon.ico and load the
+ * images found into the memory cache if possible. The signal "icon-loaded"
+ * will be emitted when any icon is found and loaded.
+ * Old Icons are automatically cleaned up after 4 days.
+ *
+ * webkit_icon_database_set_path() can be used to change the location
+ * of the database and also to disable it by passing %NULL.
+ *
+ * If WebKitWebSettings::enable-private-browsing is %TRUE new icons
+ * won't be added to the database on disk and no existing icons will
+ * be deleted from it.
+ *
+ * Since: 1.3.13
+ */
+
+using namespace WebKit;
+
+enum {
+    PROP_0,
+
+    PROP_PATH,
+};
+
+enum {
+    ICON_LOADED,
+
+    LAST_SIGNAL
+};
+
+static guint webkit_icon_database_signals[LAST_SIGNAL] = { 0, };
+
+G_DEFINE_TYPE(WebKitIconDatabase, webkit_icon_database, G_TYPE_OBJECT);
+
+struct _WebKitIconDatabasePrivate {
+    GOwnPtr<gchar> path;
+};
+
+static void webkit_icon_database_finalize(GObject* object)
+{
+    // Call C++ destructors, the reverse of 'placement new syntax'
+    WEBKIT_ICON_DATABASE(object)->priv->~WebKitIconDatabasePrivate();
+
+    G_OBJECT_CLASS(webkit_icon_database_parent_class)->finalize(object);
+}
+
+static void webkit_icon_database_dispose(GObject* object)
+{
+    G_OBJECT_CLASS(webkit_icon_database_parent_class)->dispose(object);
+}
+
+static void webkit_icon_database_set_property(GObject* object, guint propId, const GValue* value, GParamSpec* pspec)
+{
+    WebKitIconDatabase* database = WEBKIT_ICON_DATABASE(object);
+
+    switch (propId) {
+    case PROP_PATH:
+        webkit_icon_database_set_path(database, g_value_get_string(value));
+        break;
+    default:
+        G_OBJECT_WARN_INVALID_PROPERTY_ID(object, propId, pspec);
+        break;
+    }
+}
+
+static void webkit_icon_database_get_property(GObject* object, guint propId, GValue* value, GParamSpec* pspec)
+{
+    WebKitIconDatabase* database = WEBKIT_ICON_DATABASE(object);
+
+    switch (propId) {
+    case PROP_PATH:
+        g_value_set_string(value, webkit_icon_database_get_path(database));
+        break;
+    default:
+        G_OBJECT_WARN_INVALID_PROPERTY_ID(object, propId, pspec);
+        break;
+    }
+}
+
+static void webkit_icon_database_class_init(WebKitIconDatabaseClass* klass)
+{
+    webkitInit();
+
+    GObjectClass* gobjectClass = G_OBJECT_CLASS(klass);
+    gobjectClass->dispose = webkit_icon_database_dispose;
+    gobjectClass->finalize = webkit_icon_database_finalize;
+    gobjectClass->set_property = webkit_icon_database_set_property;
+    gobjectClass->get_property = webkit_icon_database_get_property;
+
+     /**
+      * WebKitIconDatabase:path:
+      *
+      * The absolute path of the icon database folder.
+      *
+      * Since: 1.3.13
+      */
+     g_object_class_install_property(gobjectClass, PROP_PATH,
+                                     g_param_spec_string("path",
+                                                         _("Path"),
+                                                         _("The absolute path of the icon database folder"),
+                                                         NULL,
+                WEBKIT_PARAM_READWRITE));
+
+    /**
+     * WebKitIconDatabase::icon-loaded:
+     * @database: the object on which the signal is emitted
+     * @frame: the frame containing the icon
+     * @frame_uri: the URI of the frame containing the icon
+     *
+     * This signal is emitted when a favicon is available for a page,
+     * or a child frame.
+     * See WebKitWebView::icon-loaded if you only need the favicon for
+     * the main frame of a particular #WebKitWebView.
+     *
+     * Since: 1.3.13
+     */
+    webkit_icon_database_signals[ICON_LOADED] = g_signal_new("icon-loaded",
+            G_TYPE_FROM_CLASS(klass),
+            (GSignalFlags)G_SIGNAL_RUN_LAST,
+            0,
+            NULL,
+            NULL,
+            webkit_marshal_VOID__OBJECT_STRING,
+            G_TYPE_NONE, 2,
+            WEBKIT_TYPE_WEB_FRAME,
+            G_TYPE_STRING);
+
+    g_type_class_add_private(klass, sizeof(WebKitIconDatabasePrivate));
+}
+
+static void webkit_icon_database_init(WebKitIconDatabase* database)
+{
+    database->priv = G_TYPE_INSTANCE_GET_PRIVATE(database, WEBKIT_TYPE_ICON_DATABASE, WebKitIconDatabasePrivate);
+    // 'placement new syntax', see webkitwebview.cpp
+    new (database->priv) WebKitIconDatabasePrivate();
+}
+
+/**
+ * webkit_icon_database_get_path:
+ * @database: a #WebKitIconDatabase
+ *
+ * Determines the absolute path to the database folder on disk.
+ *
+ * Returns: the absolute path of the database folder, or %NULL
+ *
+ * Since: 1.3.13
+ **/
+G_CONST_RETURN gchar* webkit_icon_database_get_path(WebKitIconDatabase* database)
+{
+    g_return_val_if_fail(WEBKIT_IS_ICON_DATABASE(database), 0);
+
+    return database->priv->path.get();
+}
+
+static void closeIconDatabaseOnExit()
+{
+    if (WebCore::iconDatabase().isEnabled()) {
+        WebCore::iconDatabase().setEnabled(false);
+        WebCore::iconDatabase().close();
+    }
+}
+
+/**
+ * webkit_icon_database_set_path:
+ * @database: a #WebKitIconDatabase
+ * @path: an absolute path to the icon database folder
+ *
+ * Specifies the absolute path to the database folder on disk.
+ *
+ * Passing %NULL or "" disables the icon database.
+ *
+ * Since: 1.3.13
+ **/
+void webkit_icon_database_set_path(WebKitIconDatabase* database, const gchar* path)
+{
+    g_return_if_fail(WEBKIT_IS_ICON_DATABASE(database));
+
+    if (database->priv->path.get())
+        WebCore::iconDatabase().close();
+
+    if (!(path && path[0])) {
+        database->priv->path.set(0);
+        WebCore::iconDatabase().setEnabled(false);
+        return;
+    }
+
+    database->priv->path.set(g_strdup(path));
+
+    WebCore::iconDatabase().setEnabled(true);
+    WebCore::iconDatabase().open(WebCore::filenameToString(database->priv->path.get()), WebCore::IconDatabase::defaultDatabaseFilename());
+
+    static bool initialized = false;
+    if (!initialized) {
+        atexit(closeIconDatabaseOnExit);
+        initialized = true;
+    }
+}
+
+/**
+ * webkit_icon_database_get_icon_uri:
+ * @database: a #WebKitIconDatabase
+ * @page_uri: URI of the page containing the icon
+ *
+ * Obtains the URI for the favicon for the given page URI.
+ * See also webkit_web_view_get_icon_uri().
+ *
+ * Returns: a newly allocated URI for the favicon, or %NULL
+ *
+ * Since: 1.3.13
+ **/
+gchar* webkit_icon_database_get_icon_uri(WebKitIconDatabase* database, const gchar* pageURI)
+{
+    g_return_val_if_fail(WEBKIT_IS_ICON_DATABASE(database), 0);
+    g_return_val_if_fail(pageURI, 0);
+
+    String pageURL = String::fromUTF8(pageURI);
+    return g_strdup(WebCore::iconDatabase().synchronousIconURLForPageURL(pageURL).utf8().data());
+}
+
+/**
+ * webkit_icon_database_get_icon_pixbuf:
+ * @database: a #WebKitIconDatabase
+ * @page_uri: URI of the page containing the icon
+ *
+ * Obtains a #GdkPixbuf of the favicon for the given page URI, or
+ * a default icon if there is no icon for the given page. Use
+ * webkit_icon_database_get_icon_uri() if you need to distinguish these cases.
+ * Usually you want to connect to WebKitIconDatabase::icon-loaded and call this
+ * method in the callback.
+ *
+ * The pixbuf will have the largest size provided by the server and should
+ * be resized before it is displayed.
+ * See also webkit_web_view_get_icon_pixbuf().
+ *
+ * Returns: (transfer full): a new reference to a #GdkPixbuf, or %NULL
+ *
+ * Since: 1.3.13
+ **/
+GdkPixbuf* webkit_icon_database_get_icon_pixbuf(WebKitIconDatabase* database, const gchar* pageURI)
+{
+    g_return_val_if_fail(WEBKIT_IS_ICON_DATABASE(database), 0);
+    g_return_val_if_fail(pageURI, 0);
+
+    String pageURL = String::fromUTF8(pageURI);
+    // The exact size we pass is irrelevant to the WebCore::iconDatabase code.
+    // We must pass something greater than 0, 0 to get a pixbuf.
+    WebCore::Image* icon = WebCore::iconDatabase().synchronousIconForPageURL(pageURL, WebCore::IntSize(16, 16));
+    if (!icon)
+        return 0;
+    GdkPixbuf* pixbuf = icon->getGdkPixbuf();
+    if (!pixbuf)
+        return 0;
+    return static_cast<GdkPixbuf*>(g_object_ref(pixbuf));
+}
+
+/**
+ * webkit_icon_database_clear():
+ * @database: a #WebKitIconDatabase
+ *
+ * Clears all icons from the database.
+ *
+ * Since: 1.3.13
+ **/
+void webkit_icon_database_clear(WebKitIconDatabase* database)
+{
+    g_return_if_fail(WEBKIT_IS_ICON_DATABASE(database));
+
+    WebCore::iconDatabase().removeAllIcons();
+}
+
diff --git a/Source/WebKit/gtk/webkit/webkiticondatabase.h b/Source/WebKit/gtk/webkit/webkiticondatabase.h
new file mode 100644
index 0000000..7fe5acd
--- /dev/null
+++ b/Source/WebKit/gtk/webkit/webkiticondatabase.h
@@ -0,0 +1,78 @@
+/*
+ * Copyright (C) 2011 Christian Dywan <christian@lanedo.com>
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#ifndef webkiticondatabase_h
+#define webkiticondatabase_h
+
+#include <gdk-pixbuf/gdk-pixbuf.h>
+#include <glib-object.h>
+#include <webkit/webkitdefines.h>
+
+G_BEGIN_DECLS
+
+#define WEBKIT_TYPE_ICON_DATABASE             (webkit_icon_database_get_type())
+#define WEBKIT_ICON_DATABASE(obj)             (G_TYPE_CHECK_INSTANCE_CAST((obj), WEBKIT_TYPE_ICON_DATABASE, WebKitIconDatabase))
+#define WEBKIT_ICON_DATABASE_CLASS(klass)     (G_TYPE_CHECK_CLASS_CAST((klass),  WEBKIT_TYPE_ICON_DATABASE, WebKitIconDatabaseClass))
+#define WEBKIT_IS_ICON_DATABASE(obj)          (G_TYPE_CHECK_INSTANCE_TYPE((obj), WEBKIT_TYPE_ICON_DATABASE))
+#define WEBKIT_IS_ICON_DATABASE_CLASS(klass)  (G_TYPE_CHECK_CLASS_TYPE((klass),  WEBKIT_TYPE_ICON_DATABASE))
+#define WEBKIT_ICON_DATABASE_GET_CLASS(obj)   (G_TYPE_INSTANCE_GET_CLASS((obj),  WEBKIT_TYPE_ICON_DATABASE, WebKitIconDatabaseClass))
+
+typedef struct _WebKitIconDatabasePrivate WebKitIconDatabasePrivate;
+
+struct _WebKitIconDatabase {
+    GObject parent_instance;
+
+    /*< private >*/
+    WebKitIconDatabasePrivate* priv;
+};
+
+struct _WebKitIconDatabaseClass {
+    GObjectClass parent_class;
+
+    /* Padding for future expansion */
+    void (*_webkit_reserved1) (void);
+    void (*_webkit_reserved2) (void);
+    void (*_webkit_reserved3) (void);
+    void (*_webkit_reserved4) (void);
+};
+
+WEBKIT_API GType
+webkit_icon_database_get_type            (void);
+
+WEBKIT_API G_CONST_RETURN gchar*
+webkit_icon_database_get_path            (WebKitIconDatabase* database);
+
+WEBKIT_API void
+webkit_icon_database_set_path            (WebKitIconDatabase* database,
+                                          const gchar*        path);
+
+WEBKIT_API gchar*
+webkit_icon_database_get_icon_uri        (WebKitIconDatabase* database,
+                                          const gchar*        page_uri);
+
+WEBKIT_API GdkPixbuf*
+webkit_icon_database_get_icon_pixbuf     (WebKitIconDatabase* database,
+                                          const gchar*        page_uri);
+
+WEBKIT_API void
+webkit_icon_database_clear               (WebKitIconDatabase* database);
+
+G_END_DECLS
+
+#endif /* webkiticondatabase_h */
diff --git a/Source/WebKit/gtk/webkit/webkitviewportattributes.cpp b/Source/WebKit/gtk/webkit/webkitviewportattributes.cpp
index 9a98e44..742cddd 100644
--- a/Source/WebKit/gtk/webkit/webkitviewportattributes.cpp
+++ b/Source/WebKit/gtk/webkit/webkitviewportattributes.cpp
@@ -542,7 +542,7 @@ void webkitViewportAttributesRecompute(WebKitViewportAttributes* viewportAttribu
     priv->minimumScaleFactor = attributes.minimumScale;
     priv->maximumScaleFactor = attributes.maximumScale;
     priv->devicePixelRatio = attributes.devicePixelRatio;
-    priv->userScalable = arguments.userScalable;
+    priv->userScalable = static_cast<bool>(arguments.userScalable);
 
     if (!priv->isValid) {
         priv->isValid = TRUE;
diff --git a/Source/WebKit/gtk/webkit/webkitwebframe.cpp b/Source/WebKit/gtk/webkit/webkitwebframe.cpp
index fd90a6c..a0e40b3 100644
--- a/Source/WebKit/gtk/webkit/webkitwebframe.cpp
+++ b/Source/WebKit/gtk/webkit/webkitwebframe.cpp
@@ -44,6 +44,7 @@
 #include "JSDOMBinding.h"
 #include "JSDOMWindow.h"
 #include "JSElement.h"
+#include "PlatformContextCairo.h"
 #include "PrintContext.h"
 #include "RenderListItem.h"
 #include "RenderTreeAsText.h"
@@ -765,17 +766,17 @@ static void begin_print_callback(GtkPrintOperation* op, GtkPrintContext* context
     gtk_print_operation_set_n_pages(op, printContext->pageCount());
 }
 
-static void draw_page_callback(GtkPrintOperation* op, GtkPrintContext* context, gint page_nr, gpointer user_data)
+static void draw_page_callback(GtkPrintOperation*, GtkPrintContext* gtkPrintContext, gint pageNumber, PrintContext* corePrintContext)
 {
-    PrintContext* printContext = reinterpret_cast<PrintContext*>(user_data);
-
-    if (page_nr >= static_cast<gint>(printContext->pageCount()))
+    if (pageNumber >= static_cast<gint>(corePrintContext->pageCount()))
         return;
 
-    cairo_t* cr = gtk_print_context_get_cairo_context(context);
-    GraphicsContext ctx(cr);
-    float width = gtk_print_context_get_width(context);
-    printContext->spoolPage(ctx, page_nr, width);
+    cairo_t* cr = gtk_print_context_get_cairo_context(gtkPrintContext);
+    float pageWidth = gtk_print_context_get_width(gtkPrintContext);
+
+    PlatformContextCairo platformContext(cr);
+    GraphicsContext graphicsContext(&platformContext);
+    corePrintContext->spoolPage(graphicsContext, pageNumber, pageWidth);
 }
 
 static void end_print_callback(GtkPrintOperation* op, GtkPrintContext* context, gpointer user_data)
diff --git a/Source/WebKit/gtk/webkit/webkitwebplugindatabase.cpp b/Source/WebKit/gtk/webkit/webkitwebplugindatabase.cpp
index 2d36115..1ed5205 100644
--- a/Source/WebKit/gtk/webkit/webkitwebplugindatabase.cpp
+++ b/Source/WebKit/gtk/webkit/webkitwebplugindatabase.cpp
@@ -74,7 +74,8 @@ static void webkit_web_plugin_database_init(WebKitWebPluginDatabase* database)
  */
 void webkit_web_plugin_database_plugins_list_free(GSList* list)
 {
-    g_return_if_fail(list);
+    if (!list)
+        return;
 
     for (GSList* p = list; p; p = p->next)
         g_object_unref(p->data);
diff --git a/Source/WebKit/gtk/webkit/webkitwebsettings.cpp b/Source/WebKit/gtk/webkit/webkitwebsettings.cpp
index 7e7a506..3b4cf57 100644
--- a/Source/WebKit/gtk/webkit/webkitwebsettings.cpp
+++ b/Source/WebKit/gtk/webkit/webkitwebsettings.cpp
@@ -39,6 +39,8 @@
 
 #if OS(UNIX)
 #include <sys/utsname.h>
+#elif OS(WINDOWS)
+#include "SystemInfo.h"
 #endif
 
 /**
@@ -110,6 +112,7 @@ struct _WebKitWebSettingsPrivate {
     gboolean enable_java_applet;
     gboolean enable_hyperlink_auditing;
     gboolean enable_fullscreen;
+    gboolean enable_dns_prefetching;
 };
 
 #define WEBKIT_WEB_SETTINGS_GET_PRIVATE(obj) (G_TYPE_INSTANCE_GET_PRIVATE((obj), WEBKIT_TYPE_WEB_SETTINGS, WebKitWebSettingsPrivate))
@@ -162,7 +165,8 @@ enum {
     PROP_AUTO_RESIZE_WINDOW,
     PROP_ENABLE_JAVA_APPLET,
     PROP_ENABLE_HYPERLINK_AUDITING,
-    PROP_ENABLE_FULLSCREEN
+    PROP_ENABLE_FULLSCREEN,
+    PROP_ENABLE_DNS_PREFETCHING
 };
 
 // Create a default user agent string
@@ -208,7 +212,7 @@ static String webkitOSVersion()
     else
         uaOSVersion = String("Unknown");
 #elif OS(WINDOWS)
-    DEFINE_STATIC_LOCAL(const String, uaOSVersion, (String("Windows")));
+    DEFINE_STATIC_LOCAL(const String, uaOSVersion, (windowsVersionForUAString()));
 #else
     DEFINE_STATIC_LOCAL(const String, uaOSVersion, (String("Unknown")));
 #endif
@@ -909,6 +913,22 @@ static void webkit_web_settings_class_init(WebKitWebSettingsClass* klass)
                                                          FALSE,
                                                          flags));
 
+    /**
+    * WebKitWebSettings:enable-dns-prefetching
+    *
+    * Whether webkit prefetches domain names.  This is a separate knob from private browsing.
+    * Whether private browsing should set this or not is up for debate, for now it doesn't.
+    *
+    * Since: 1.3.13.
+    */
+    g_object_class_install_property(gobject_class,
+                                    PROP_ENABLE_DNS_PREFETCHING,
+                                    g_param_spec_boolean("enable-dns-prefetching",
+                                                         _("WebKit prefetches domain names"),
+                                                         _("Whether WebKit prefetches domain names"),
+                                                         TRUE,
+                                                         flags));
+
     g_type_class_add_private(klass, sizeof(WebKitWebSettingsPrivate));
 }
 
@@ -1094,6 +1114,9 @@ static void webkit_web_settings_set_property(GObject* object, guint prop_id, con
     case PROP_ENABLE_FULLSCREEN:
         priv->enable_fullscreen = g_value_get_boolean(value);
         break;
+    case PROP_ENABLE_DNS_PREFETCHING:
+        priv->enable_dns_prefetching = g_value_get_boolean(value);
+        break;
     default:
         G_OBJECT_WARN_INVALID_PROPERTY_ID(object, prop_id, pspec);
         break;
@@ -1244,6 +1267,9 @@ static void webkit_web_settings_get_property(GObject* object, guint prop_id, GVa
     case PROP_ENABLE_FULLSCREEN:
         g_value_set_boolean(value, priv->enable_fullscreen);
         break;
+    case PROP_ENABLE_DNS_PREFETCHING:
+        g_value_set_boolean(value, priv->enable_dns_prefetching);
+        break;
     default:
         G_OBJECT_WARN_INVALID_PROPERTY_ID(object, prop_id, pspec);
         break;
@@ -1320,6 +1346,7 @@ WebKitWebSettings* webkit_web_settings_copy(WebKitWebSettings* web_settings)
                  "enable-java-applet", priv->enable_java_applet,
                  "enable-hyperlink-auditing", priv->enable_hyperlink_auditing,
                  "enable-fullscreen", priv->enable_fullscreen,
+                 "enable-dns-prefetching", priv->enable_dns_prefetching,
                  NULL));
 
     return copy;
diff --git a/Source/WebKit/gtk/webkit/webkitwebview.cpp b/Source/WebKit/gtk/webkit/webkitwebview.cpp
index 0ffc9d9..bf74d7b 100644
--- a/Source/WebKit/gtk/webkit/webkitwebview.cpp
+++ b/Source/WebKit/gtk/webkit/webkitwebview.cpp
@@ -85,6 +85,7 @@
 #include "webkitgeolocationpolicydecision.h"
 #include "webkitglobalsprivate.h"
 #include "webkithittestresultprivate.h"
+#include "webkiticondatabase.h"
 #include "webkitmarshal.h"
 #include "webkitnetworkrequest.h"
 #include "webkitnetworkresponse.h"
@@ -709,8 +710,8 @@ static gboolean webkit_web_view_expose_event(GtkWidget* widget, GdkEventExpose*
         frame->view()->updateLayoutAndStyleIfNeededRecursive();
 
         RefPtr<cairo_t> cr = adoptRef(gdk_cairo_create(event->window));
-        GraphicsContext ctx(cr.get());
-        ctx.setGdkExposeEvent(event);
+        GraphicsContext gc(cr.get());
+        gc.setGdkExposeEvent(event);
 
         int rectCount;
         GOwnPtr<GdkRectangle> rects;
@@ -719,7 +720,7 @@ static gboolean webkit_web_view_expose_event(GtkWidget* widget, GdkEventExpose*
         for (int i = 0; i < rectCount; i++)
             paintRects.append(IntRect(rects.get()[i]));
 
-        paintWebView(frame, priv->transparent, ctx, static_cast<IntRect>(event->area), paintRects);
+        paintWebView(frame, priv->transparent, gc, static_cast<IntRect>(event->area), paintRects);
     }
 
     return FALSE;
@@ -736,7 +737,7 @@ static gboolean webkit_web_view_draw(GtkWidget* widget, cairo_t* cr)
 
     Frame* frame = core(webView)->mainFrame();
     if (frame->contentRenderer() && frame->view()) {
-        GraphicsContext ctx(cr);
+        GraphicsContext gc(cr);
         IntRect rect = clipRect;
         cairo_rectangle_list_t* rectList = cairo_copy_clip_rectangle_list(cr);
 
@@ -747,7 +748,7 @@ static gboolean webkit_web_view_draw(GtkWidget* widget, cairo_t* cr)
             for (int i = 0; i < rectList->num_rectangles; i++)
                 rects.append(enclosingIntRect(FloatRect(rectList->rectangles[i])));
         }
-        paintWebView(frame, priv->transparent, ctx, rect, rects);
+        paintWebView(frame, priv->transparent, gc, rect, rects);
 
         cairo_rectangle_list_destroy(rectList);
     }
@@ -2315,6 +2316,8 @@ static void webkit_web_view_class_init(WebKitWebViewClass* webViewClass)
      * @icon_uri: the URI for the icon
      *
      * This signal is emitted when the main frame has got a favicon.
+     * See WebKitIconDatabase::icon-loaded if you want to keep track of
+     * icons for child frames.
      *
      * Since: 1.1.18
      */
@@ -3290,7 +3293,8 @@ static void webkit_web_view_update_settings(WebKitWebView* webView)
         javaScriptCanAccessClipboard, enableOfflineWebAppCache,
         enableUniversalAccessFromFileURI, enableFileAccessFromFileURI,
         enableDOMPaste, tabKeyCyclesThroughElements,
-        enableSiteSpecificQuirks, usePageCache, enableJavaApplet, enableHyperlinkAuditing, enableFullscreen;
+        enableSiteSpecificQuirks, usePageCache, enableJavaApplet,
+        enableHyperlinkAuditing, enableFullscreen, enableDNSPrefetching;
 
     WebKitEditingBehavior editingBehavior;
 
@@ -3331,6 +3335,7 @@ static void webkit_web_view_update_settings(WebKitWebView* webView)
                  "enable-hyperlink-auditing", &enableHyperlinkAuditing,
                  "spell-checking-languages", &defaultSpellCheckingLanguages,
                  "enable-fullscreen", &enableFullscreen,
+                 "enable-dns-prefetching", &enableDNSPrefetching,
                  NULL);
 
     settings->setDefaultTextEncodingName(defaultEncoding);
@@ -3375,6 +3380,7 @@ static void webkit_web_view_update_settings(WebKitWebView* webView)
     WebKit::EditorClient* client = static_cast<WebKit::EditorClient*>(core(webView)->editorClient());
     static_cast<WebKit::TextCheckerClientEnchant*>(client->textChecker())->updateSpellCheckingLanguage(defaultSpellCheckingLanguages);
 #endif
+    settings->setDNSPrefetchingEnabled(enableDNSPrefetching);
 
     Page* page = core(webView);
     if (page)
@@ -3441,6 +3447,8 @@ static void webkit_web_view_settings_notify(WebKitWebSettings* webSettings, GPar
         settings->setJavaScriptEnabled(g_value_get_boolean(&value));
     else if (name == g_intern_string("enable-plugins"))
         settings->setPluginsEnabled(g_value_get_boolean(&value));
+    else if (name == g_intern_string("enable-dns-prefetching"))
+        settings->setDNSPrefetchingEnabled(g_value_get_boolean(&value));
     else if (name == g_intern_string("resizable-text-areas"))
         settings->setTextAreasAreResizable(g_value_get_boolean(&value));
     else if (name == g_intern_string("user-stylesheet-uri"))
@@ -4337,8 +4345,7 @@ gboolean webkit_web_view_get_editable(WebKitWebView* webView)
 {
     g_return_val_if_fail(WEBKIT_IS_WEB_VIEW(webView), FALSE);
 
-    Frame* frame = core(webView)->mainFrame();
-    return frame && frame->document()->inDesignMode();
+    return core(webView)->isEditable();
 }
 
 /**
@@ -4363,15 +4370,14 @@ void webkit_web_view_set_editable(WebKitWebView* webView, gboolean flag)
 {
     g_return_if_fail(WEBKIT_IS_WEB_VIEW(webView));
 
-    Frame* frame = core(webView)->mainFrame();
-    g_return_if_fail(frame);
-
-    // TODO: What happens when the frame is replaced?
     flag = flag != FALSE;
     if (flag == webkit_web_view_get_editable(webView))
         return;
 
-    frame->document()->setDesignMode(flag ? WebCore::Document::on : WebCore::Document::off);
+    core(webView)->setEditable(flag);
+
+    Frame* frame = core(webView)->mainFrame();
+    g_return_if_fail(frame);
 
     if (flag) {
         frame->editor()->applyEditingStyleToBodyElement();
@@ -5058,12 +5064,41 @@ WebKitHitTestResult* webkit_web_view_get_hit_test_result(WebKitWebView* webView,
 G_CONST_RETURN gchar* webkit_web_view_get_icon_uri(WebKitWebView* webView)
 {
     g_return_val_if_fail(WEBKIT_IS_WEB_VIEW(webView), 0);
-    String iconURL = iconDatabase().iconURLForPageURL(core(webView)->mainFrame()->document()->url().prettyURL());
+    String iconURL = iconDatabase().synchronousIconURLForPageURL(core(webView)->mainFrame()->document()->url().prettyURL());
     webView->priv->iconURI = iconURL.utf8();
     return webView->priv->iconURI.data();
 }
 
 /**
+ * webkit_web_view_get_icon_pixbuf:
+ * @webView: the #WebKitWebView object
+ *
+ * Obtains a #GdkPixbuf of the favicon for the given #WebKitWebView, or
+ * a default icon if there is no icon for the given page. Use
+ * webkit_web_view_get_icon_uri() if you need to distinguish these cases.
+ * Usually you want to connect to WebKitWebView::icon-loaded and call this
+ * method in the callback.
+ *
+ * The pixbuf will have the largest size provided by the server and should
+ * be resized before it is displayed.
+ * See also webkit_icon_database_get_icon_pixbuf().
+ *
+ * Returns: (transfer full): a new reference to a #GdkPixbuf, or %NULL
+ *
+ * Since: 1.3.13
+ */
+GdkPixbuf* webkit_web_view_get_icon_pixbuf(WebKitWebView* webView)
+{
+    g_return_val_if_fail(WEBKIT_IS_WEB_VIEW(webView), 0);
+
+    const gchar* pageURI = webkit_web_view_get_uri(webView);
+    WebKitIconDatabase* database = webkit_get_icon_database();
+    return webkit_icon_database_get_icon_pixbuf(database, pageURI);
+}
+
+
+
+/**
  * webkit_web_view_get_dom_document:
  * @webView: a #WebKitWebView
  * 
diff --git a/Source/WebKit/gtk/webkit/webkitwebview.h b/Source/WebKit/gtk/webkit/webkitwebview.h
index 1838bfe..38c9a70 100644
--- a/Source/WebKit/gtk/webkit/webkitwebview.h
+++ b/Source/WebKit/gtk/webkit/webkitwebview.h
@@ -397,6 +397,9 @@ webkit_web_view_get_hit_test_result             (WebKitWebView        *webView,
 WEBKIT_API G_CONST_RETURN gchar *
 webkit_web_view_get_icon_uri                    (WebKitWebView        *webView);
 
+WEBKIT_API GdkPixbuf *
+webkit_web_view_get_icon_pixbuf                 (WebKitWebView        *webView);
+
 WEBKIT_API WebKitDOMDocument *
 webkit_web_view_get_dom_document                (WebKitWebView        *webView);
 
diff --git a/Source/WebKit/haiku/ChangeLog b/Source/WebKit/haiku/ChangeLog
index b2aefce..7757fe7 100644
--- a/Source/WebKit/haiku/ChangeLog
+++ b/Source/WebKit/haiku/ChangeLog
@@ -1,3 +1,58 @@
+2011-03-25  Andy Estes  <aestes@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        REGRESSION (r70748): latest nightly builds kills AC_QuickTime.js
+        https://bugs.webkit.org/show_bug.cgi?id=49016
+
+        Update objectContentType() implementation to handle the
+        shouldPreferPlugInsForImages flag.
+
+        * WebCoreSupport/FrameLoaderClientHaiku.cpp:
+        (WebCore::FrameLoaderClientHaiku::objectContentType):
+        * WebCoreSupport/FrameLoaderClientHaiku.h:
+
+2011-03-25  Chang Shu  <cshu@webkit.org>
+
+        Reviewed by Ryosuke Niwa.
+
+        rename Node::isContentEditable and all call sites to rendererIsEditable
+        https://bugs.webkit.org/show_bug.cgi?id=54290
+
+        This is part of the effort to separate JS API HTMLElement isContentEditable from
+        internal Node::rendererIsEditable.
+
+        * WebCoreSupport/EditorClientHaiku.cpp:
+        (WebCore::EditorClientHaiku::handleKeyboardEvent):
+
+2011-03-24  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r81916 and r81917.
+        http://trac.webkit.org/changeset/81916
+        http://trac.webkit.org/changeset/81917
+        https://bugs.webkit.org/show_bug.cgi?id=57071
+
+        broke a test on platforms that do not have QuickTime installed
+        (Requested by estes on #webkit).
+
+        * WebCoreSupport/FrameLoaderClientHaiku.cpp:
+        (WebCore::FrameLoaderClientHaiku::objectContentType):
+        * WebCoreSupport/FrameLoaderClientHaiku.h:
+
+2011-03-24  Andy Estes  <aestes@apple.com>
+
+        Reviewed by Darin Adler.
+
+        REGRESSION (r70748): latest nightly builds kills AC_QuickTime.js
+        https://bugs.webkit.org/show_bug.cgi?id=49016
+
+        Update objectContentType() implementation to handle the
+        shouldPreferPlugInsForImages flag.
+
+        * WebCoreSupport/FrameLoaderClientHaiku.cpp:
+        (WebCore::FrameLoaderClientHaiku::objectContentType):
+        * WebCoreSupport/FrameLoaderClientHaiku.h:
+
 2011-03-07  Sam Weinig  <sam@webkit.org>
 
         Reviewed by Anders Carlsson.
diff --git a/Source/WebKit/haiku/WebCoreSupport/EditorClientHaiku.cpp b/Source/WebKit/haiku/WebCoreSupport/EditorClientHaiku.cpp
index 5c1b13f..1a84dab 100644
--- a/Source/WebKit/haiku/WebCoreSupport/EditorClientHaiku.cpp
+++ b/Source/WebKit/haiku/WebCoreSupport/EditorClientHaiku.cpp
@@ -254,7 +254,7 @@ void EditorClientHaiku::handleKeyboardEvent(KeyboardEvent* event)
     if (!start)
         return;
 
-    if (start->isContentEditable()) {
+    if (start->rendererIsEditable()) {
         switch (kevent->windowsVirtualKeyCode()) {
         case VK_BACK:
             frame->editor()->deleteWithDirection(DirectionBackward,
diff --git a/Source/WebKit/haiku/WebCoreSupport/FrameLoaderClientHaiku.cpp b/Source/WebKit/haiku/WebCoreSupport/FrameLoaderClientHaiku.cpp
index 8c42132..24a98d5 100644
--- a/Source/WebKit/haiku/WebCoreSupport/FrameLoaderClientHaiku.cpp
+++ b/Source/WebKit/haiku/WebCoreSupport/FrameLoaderClientHaiku.cpp
@@ -1,7 +1,7 @@
 /*
  * Copyright (C) 2006 Don Gibson <dgibson77@gmail.com>
  * Copyright (C) 2006 Zack Rusin <zack@kde.org>
- * Copyright (C) 2006 Apple Computer, Inc.  All rights reserved.
+ * Copyright (C) 2006, 2011 Apple Inc. All rights reserved.
  * Copyright (C) 2007 Trolltech ASA
  * Copyright (C) 2007 Ryan Leavengood <leavengood@gmail.com> All rights reserved.
  * Copyright (C) 2009 Maxime Simon <simon.maxime@gmail.com> All rights reserved.
@@ -754,7 +754,7 @@ void FrameLoaderClientHaiku::transferLoadingResourceFromPage(unsigned long, Docu
 {
 }
 
-ObjectContentType FrameLoaderClientHaiku::objectContentType(const KURL& url, const String& mimeType)
+ObjectContentType FrameLoaderClientHaiku::objectContentType(const KURL& url, const String& mimeType, bool shouldPreferPlugInsForImages)
 {
     notImplemented();
     return ObjectContentType();
diff --git a/Source/WebKit/haiku/WebCoreSupport/FrameLoaderClientHaiku.h b/Source/WebKit/haiku/WebCoreSupport/FrameLoaderClientHaiku.h
index 3e995a1..dbd3084 100644
--- a/Source/WebKit/haiku/WebCoreSupport/FrameLoaderClientHaiku.h
+++ b/Source/WebKit/haiku/WebCoreSupport/FrameLoaderClientHaiku.h
@@ -1,6 +1,6 @@
 /*
  * Copyright (C) 2006 Zack Rusin <zack@kde.org>
- * Copyright (C) 2006 Apple Computer, Inc.  All rights reserved.
+ * Copyright (C) 2006, 2011 Apple Inc. All rights reserved.
  * Copyright (C) 2007 Ryan Leavengood <leavengood@gmail.com> All rights reserved.
  *
  *
@@ -239,7 +239,7 @@ namespace WebCore {
                                                           const KURL& baseURL, const Vector<String>& paramNames,
                                                           const Vector<String>& paramValues);
 
-        virtual ObjectContentType objectContentType(const KURL& url, const String& mimeType);
+        virtual ObjectContentType objectContentType(const KURL&, const String& mimeType, bool shouldPreferPlugInsForImages);
         virtual String overrideMediaType() const;
 
         virtual void dispatchDidClearWindowObjectInWorld(DOMWrapperWorld*);
diff --git a/Source/WebKit/mac/Carbon/CarbonWindowAdapter.mm b/Source/WebKit/mac/Carbon/CarbonWindowAdapter.mm
index 9747350..7348304 100644
--- a/Source/WebKit/mac/Carbon/CarbonWindowAdapter.mm
+++ b/Source/WebKit/mac/Carbon/CarbonWindowAdapter.mm
@@ -179,7 +179,7 @@ static OSStatus NSCarbonWindowHandleEvent(EventHandlerCallRef inEventHandlerCall
 
     osStatus = GetWindowModality(_windowRef, &windowModality, NULL);
     if (osStatus != noErr) {
-        NSLog(@"Couldn't get window modality: error=%d", osStatus);
+        NSLog(@"Couldn't get window modality: error=%ld", osStatus);
         return nil;
     }
     
@@ -334,7 +334,7 @@ static OSStatus NSCarbonWindowHandleEvent(EventHandlerCallRef inEventHandlerCall
     if ([self _hasWindowRef]) {
         osStatus = GetWindowClass([self windowRef], &windowClass);
         if (osStatus != noErr) {
-            NSLog(@"Couldn't get window class: error=%d", osStatus);
+            NSLog(@"Couldn't get window class: error=%ld", osStatus);
         }
     }
     return windowClass; 
diff --git a/Source/WebKit/mac/ChangeLog b/Source/WebKit/mac/ChangeLog
index 32f8e50..afaa1e3 100644
--- a/Source/WebKit/mac/ChangeLog
+++ b/Source/WebKit/mac/ChangeLog
@@ -1,3 +1,791 @@
+2011-03-30  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        REGRESSION (r82320): Spacebar no longer pages down
+        https://bugs.webkit.org/show_bug.cgi?id=57423
+        <rdar://problem/9207702>
+
+        Also includes some unrelated cleanup that I had in my tree.
+
+        * WebView/WebHTMLView.mm:
+        (-[WebHTMLView _interpretKeyEvent:savingCommands:]): Added an assertion that the event is
+        being dispatched to the right frame.
+        (-[WebHTMLView setMarkedText:selectedRange:]): Use 0 for a pointer, not NULL.
+        (-[WebHTMLView doCommandBySelector:]): Update eventInterpretationHadSideEffects with "|=".
+        Even if this specific command hasn't been handled, that doesn't nullify side effects from
+        previous commands.
+        (-[WebHTMLView insertText:]): Besides looking at the return value of insertText() to fix the
+        bug, removed setting _private->interpretKeyEventsParameters to 0. I don't see any way for
+        another WebHTMLView NSTextInput method to be called from within insertText:, so no one is
+        going to look at it.
+
+2011-03-30  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Brady Eidson.
+
+        WebKit2: Attempting to view css file from url causes it to download
+        <rdar://problem/9102611>
+        https://bugs.webkit.org/show_bug.cgi?id=57501
+
+        * WebView/WebHTMLRepresentation.h:
+        * WebView/WebHTMLRepresentation.mm:
+        (+[WebHTMLRepresentation unsupportedTextMIMETypes]):
+        * WebView/WebHTMLView.mm:
+        (+[WebHTMLView unsupportedTextMIMETypes]):
+        Re-factor unsupportedTextMIMETypes to pull from WebCore's
+        MIMETypeRegistry, so that the list can be shared with WebKit2.
+
+2011-03-29  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=57408 
+        webkit-min-device-pixel-ratio media query doesn't work post-SnowLeopard 
+        -and corresponding-
+        <rdar://problem/8665411>
+
+        * Misc/WebNSControlExtras.m:
+        (-[NSControl sizeToFitAndAdjustWindowHeight]):
+        * WebCoreSupport/WebChromeClient.mm:
+        (WebChromeClient::scaleFactor):
+        * WebView/WebHTMLView.mm:
+        (-[WebHTMLView viewDidMoveToWindow]):
+        (-[WebHTMLView attachRootLayer:]):
+
+2011-03-29  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Make validation message bubble testable
+        https://bugs.webkit.org/show_bug.cgi?id=57290
+
+        * WebView/WebView.mm:
+        (-[WebView _preferencesChangedNotification:]): Copy the private value of
+          the timer magnification to WebCore::Settings.
+        (-[WebView validationMessageTimerMagnification]): Added.
+        (-[WebView setValidationMessageTimerMagnification:]): Added.
+        * WebView/WebViewData.h: Declare a member for the timer magnification.
+        * WebView/WebViewData.mm:
+        (-[WebViewPrivate init]): Initialize the timer magnification.
+        * WebView/WebViewPrivate.h:
+          Declare a setter and a getter for the timer magnification.
+
+2011-03-29  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [Mac] Enable interactive-validation tests on Mac DRT
+        https://bugs.webkit.org/show_bug.cgi?id=57308
+
+        * WebView/WebView.mm:
+        (-[WebView _preferencesChangedNotification:]):
+          Convey a WebView flag for interactive validation to WebCore::Settings.
+        (-[WebView interactiveFormValidationEnabled]): Added.
+        (-[WebView setInteractiveFormValidationEnabled:]): Added.
+        * WebView/WebViewData.h: Add interactiveFormValidationEnabled.
+        * WebView/WebViewData.mm:
+        (-[WebViewPrivate init]): Initialize interactiveFormValidationEnabled.
+        * WebView/WebViewPrivate.h: Add setter and getter for interactiveFormValidationEnabled.
+
+2011-03-29  Timothy Hatcher  <timothy@apple.com>
+
+        Update the order of the context menu to better match AppKit on Mac.
+
+        <rdar://problem/9054893>
+
+        Reviewed by John Sullivan.
+
+        * DefaultDelegates/WebDefaultContextMenuDelegate.mm:
+        (-[WebDefaultUIDelegate webView:contextMenuItemsForElement:defaultMenuItems:]): Update the order of items.
+        * WebCoreSupport/WebPlatformStrategies.h:
+        * WebCoreSupport/WebPlatformStrategies.mm:
+        (WebPlatformStrategies::contextMenuItemTagLookUpInDictionary): Added argument for selected string.
+
+2011-03-29  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=57379
+        Clean up WK1 key event handling logic
+
+        No bugs knowingly fixed, but this makes the code more consistent.
+
+        * WebView/WebHTMLView.mm:
+        (struct WebHTMLViewInterpretKeyEventsParameters): Renamed eventWasHandled to
+        eventInterpretationHadSideEffects, because "handled" doesn't really mean much.
+        (-[WebHTMLView _executeSavedEditingCommands]): Factored out from _interpretKeyEvent for use
+        from other functions. We need to execute saved commands when an input method asks for current
+        state, because providing stale state could confuse it.
+        (-[WebHTMLView _interpretKeyEvent:savingCommands:]): Heavily commented, and updated for other
+        changes.
+        (-[WebHTMLView characterIndexForPoint:]): Call _executeSavedEditingCommands, because otherwise,
+        the answer would be stale.
+        (-[WebHTMLView firstRectForCharacterRange:]): Ditto.
+        (-[WebHTMLView selectedRange]): Ditto.
+        (-[WebHTMLView markedRange]): Ditto.
+        (-[WebHTMLView attributedSubstringFromRange:]): Ditto.
+        (-[WebHTMLView hasMarkedText]): Ditto.
+        (-[WebHTMLView unmarkText]): Call _executeSavedEditingCommands, because otherwise, we'd be
+        operating on stale data. Also, updated for eventWasHandled renaming.
+        (-[WebHTMLView setMarkedText:selectedRange:]): Ditto.
+        (-[WebHTMLView doCommandBySelector:]): Removed special handling for noop:. I verified that
+        it's no longer needed for bug 14522, presumably due to WebCore level changes. It was also
+        fragile, because there is no guarantee about when noop: is sent (also, a custom key binding
+        could have a noop: as one of its commands, although that's hardly practical).
+        Added the same "from input method" logic that we have in insertText: - I don't know of any
+        IMs that call this method, but we clearly need to execute it as part of IM processing when
+        there is marked text.
+        (-[WebHTMLView insertText:]): Removed a confusing check for [text length]. Always set
+        eventInterpretationHadSideEffects to true, becasue there is no reason to try multiple times
+        if current selection isn't editable. This is different from doCommandBySelector:, where we
+        need to give super class a chance to handle the event if our processing fails.
+        Removed a nonsense "consumedByIM = true" assignment - we no longer need it now that the
+        return value of _interpretKeyEvent is computed differently.
+
+2011-03-28  Adele Peterson  <adele@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        Fix for <rdar://problem/9112694> REGRESSION (r79411): "Check grammar with spelling" context menu doesn't check as you type
+        https://bugs.webkit.org/show_bug.cgi?id=57173
+
+        * WebView/WebFrame.mm:
+        (-[WebFrame hasSpellingMarker:length:]): Call new selectionStartHasMarkerFor method instead of selectionStartHasSpellingMarkerFor.
+        (-[WebFrame hasGrammarMarker:length:]): Call new selectionStartHasMarkerFor method.
+        * WebView/WebFramePrivate.h: Add hasGrammarMarker so grammar marking can be tested.
+
+2011-03-28  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=57260
+        Clean up text input code a little
+
+        * WebCoreSupport/WebEditorClient.mm:
+        (WebEditorClient::handleKeyboardEvent):
+        (WebEditorClient::handleInputMethodKeydown):
+        * WebView/WebHTMLViewInternal.h:
+        Renamed _interceptEditingKeyEvent:shouldSaveCommand:, becasue it doesn't really intercept
+        anything. It's just a version it interpretKeyEvents: that tells us whether it was handled,
+        and also possibly saves resulting commands for later execution.
+
+        * WebView/WebHTMLView.mm:
+        (-[WebHTMLView _interpretKeyEvent:savingCommands:]): Changed to use early return. Changed
+        return value in case platformEvent is null to be less mysterious. Moved receivedNOOP from
+        WebHTMLViewPrivate to WebHTMLViewInterpretKeyEventsParameters, as this is just part of event
+        handling state, like the other booleans there. Don't call interpretKeyEvents: again simply
+        because the first call resulted in no saved commands, becasue it's confusing and apparently
+        useless (I couldn't find any broken behavior).
+        (-[WebHTMLView unmarkText]): Cleaned upo BOOL vs. bool constants.
+        (-[WebHTMLView setMarkedText:selectedRange:]): Ditto.
+        (-[WebHTMLView doCommandBySelector:]): Ditto.
+        (-[WebHTMLView insertText:]): Ditto.
+
+        * WebView/WebViewInternal.h: There was no _interceptEditingKeyEvent:shouldSaveCommand:
+        method on WebView.
+
+2011-03-27  Jer Noble  <jer.noble@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Full Screen: disable keyboard access by default
+        https://bugs.webkit.org/show_bug.cgi?id=56684
+
+        Take into account whether keyboard access was requested when deciding whether full
+        screen mode is supported.
+
+        * WebCoreSupport/WebChromeClient.h:
+        * WebCoreSupport/WebChromeClient.mm:
+        (WebChromeClient::supportsFullScreenForElement):
+        * WebView/WebView.mm:
+        (-[WebView _supportsFullScreenForElement:WebCore::withKeyboard:]):
+        * WebView/WebViewInternal.h:
+
+2011-03-26  Jer Noble  <jer.noble@apple.com>
+
+        Reviewed by Eric Carlson.
+
+        Enable the Full Screen API by default in WebKit/mac and WebKit2
+        https://bugs.webkit.org/show_bug.cgi?id=56956
+
+        * WebView/WebPreferences.mm:
+        (+[WebPreferences initialize]): Default the WebKitFullScreenEnabled preference to true.
+
+2011-03-25  Andy Estes  <aestes@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        REGRESSION (r70748): latest nightly builds kills AC_QuickTime.js
+        https://bugs.webkit.org/show_bug.cgi?id=49016
+
+        Update objectContentType() implementation to handle the
+        shouldPreferPlugInsForImages flag.
+
+        * WebCoreSupport/WebFrameLoaderClient.h:
+        * WebCoreSupport/WebFrameLoaderClient.mm:
+        (WebFrameLoaderClient::objectContentType):
+
+2011-03-24  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r81939.
+        http://trac.webkit.org/changeset/81939
+        https://bugs.webkit.org/show_bug.cgi?id=57084
+
+        Rolling out 81939, as it's causing a number of app cache test
+        failures. (Requested by jernoble on #webkit).
+
+        * WebView/WebView.mm:
+        (-[WebView _preferencesChangedNotification:]):
+
+2011-03-23  Jer Noble  <jer.noble@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Application Cache should save audio/ and video/ mime types as flat files
+        https://bugs.webkit.org/show_bug.cgi?id=53784
+        <rdar://problem/8932473>
+
+        No new tests.
+
+        Initialize the AppCache Total size quotas with the values for WebKitPreferences
+        upon startup.
+
+        * WebView/WebView.mm:
+        (-[WebView _preferencesChangedNotification:]):
+
+2011-03-24  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r81916 and r81917.
+        http://trac.webkit.org/changeset/81916
+        http://trac.webkit.org/changeset/81917
+        https://bugs.webkit.org/show_bug.cgi?id=57071
+
+        broke a test on platforms that do not have QuickTime installed
+        (Requested by estes on #webkit).
+
+        * WebCoreSupport/WebFrameLoaderClient.h:
+        * WebCoreSupport/WebFrameLoaderClient.mm:
+        (WebFrameLoaderClient::objectContentType):
+
+2011-03-24  Andy Estes  <aestes@apple.com>
+
+        Reviewed by Darin Adler.
+
+        REGRESSION (r70748): latest nightly builds kills AC_QuickTime.js
+        https://bugs.webkit.org/show_bug.cgi?id=49016
+
+        Update objectContentType() implementation to handle the
+        shouldPreferPlugInsForImages flag.
+
+        * WebCoreSupport/WebFrameLoaderClient.h:
+        * WebCoreSupport/WebFrameLoaderClient.mm:
+        (WebFrameLoaderClient::objectContentType):
+
+2011-03-24  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Ensure that all compilation takes place within a dynamic global object scope
+        https://bugs.webkit.org/show_bug.cgi?id=57054
+
+        * WebView/WebScriptDebugDelegate.mm:
+        (-[WebScriptCallFrame evaluateWebScript:]): Updated for signature change.
+
+2011-03-24  Jia Pu  <jpu@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Dismissed reversion suggestion is incorrectly learned.
+        https://bugs.webkit.org/show_bug.cgi?id=57039
+
+        CorrectionPanel should always use [NSSpellChecker dismissCorrectionBubbleForView].
+        [NSSpellChecker cancelCorrectionBubbleForView] is reserved for situation where correction panel
+        is dismissed explicitly by ESC key or clicking the dimiss button. Misusing these causes
+        incorrect automatic learning.
+
+        * WebCoreSupport/CorrectionPanel.mm:
+        (CorrectionPanel::dismissInternal):
+
+2011-03-24  David Kilzer  <ddkilzer@apple.com>
+
+        <http://webkit.org/b/56993> ENABLE_PLUGIN_PROXY_FOR_VIDEO should be defined to 0 on Mac OS X
+
+        Reviewed by Joseph Pecoraro.
+
+        * Plugins/WebPluginContainerPrivate.h: Changed value of
+        ENABLE_PLUGIN_PROXY_FOR_VIDEO from 1 to 0.
+
+2011-03-23  Jia Pu  <jpu@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Hook up new AppKit autocorrection UI with WK2.
+        https://bugs.webkit.org/show_bug.cgi?id=56055
+        <rdar://problem/8947463>
+
+        Please see WebCore/ChangeLog for detail.
+
+        * WebCoreSupport/CorrectionPanel.h: Added.
+        (CorrectionPanel::isShowing):
+        * WebCoreSupport/CorrectionPanel.mm: Added.
+        (correctionBubbleType):
+        (CorrectionPanel::CorrectionPanel):
+        (CorrectionPanel::~CorrectionPanel):
+        (CorrectionPanel::show):
+        (CorrectionPanel::dismiss):
+        (CorrectionPanel::dismissSoon):
+        (CorrectionPanel::dismissInternal):
+        (CorrectionPanel::recordAutocorrectionResponse):
+        * WebCoreSupport/WebEditorClient.h:
+        * WebCoreSupport/WebEditorClient.mm:
+        (WebEditorClient::WebEditorClient):
+        (WebEditorClient::showCorrectionPanel):
+        (WebEditorClient::dismissCorrectionPanel):
+        (WebEditorClient::dismissCorrectionPanelSoon):
+        (WebEditorClient::recordAutocorrectionResponse):
+        * WebView/WebView.mm:
+        (-[WebView handleCorrectionPanelResult:]):
+        * WebView/WebViewPrivate.h:
+
+2011-03-23  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Services menu item to convert selected Simplified/Traditional Chinese Text is not working.
+        https://bugs.webkit.org/show_bug.cgi?id=56974
+        <rdar://problem/8284642>
+
+        This fixes a regression introduced by http://trac.webkit.org/changeset/61794
+        where readSelectionFromPasteboard was accidentally removed.
+        This method and writeSelectionToPasteboard are needed to support Mac OS X
+        services.
+        
+        * WebView/WebHTMLView.mm:
+        (-[WebHTMLView _pasteAsPlainTextWithPasteboard:]): Added.
+        (-[WebHTMLView readSelectionFromPasteboard:]): Added.
+
+2011-03-23  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Change IconDatabase opening to allow for arbitrary filenames
+        https://bugs.webkit.org/show_bug.cgi?id=56977
+
+        * Misc/WebIconDatabase.mm:
+        (-[WebIconDatabase _startUpIconDatabase]):
+
+2011-03-22  Anton D'Auria  <adauria@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Add +[WebApplicationCache getOriginsWithCache]
+        https://bugs.webkit.org/show_bug.cgi?id=56722
+
+        Call existing WebCore::ApplicationCacheStorage::getOriginsWithCache API.
+
+        * WebCoreSupport/WebApplicationCache.h:
+        * WebCoreSupport/WebApplicationCache.mm:
+        (+[WebApplicationCache originsWithCache]):
+
+2011-03-22  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        OBJECT element with DivX source is always downloaded
+        https://bugs.webkit.org/show_bug.cgi?id=56879
+
+        * Plugins/WebBasePluginPackage.mm:
+        (-[WebBasePluginPackage getPluginInfoFromPLists]):
+        Always try to split every element in the "WebPluginExtensions" array, since the DivX plug-in
+        specifies multiple file extensions in a single element.
+
+2011-03-22  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        <rdar://problem/8648311> and https://bugs.webkit.org/show_bug.cgi?id=56876
+        WK2 Icon DB: Expand IconDatabaseClient interface and move it to the main thread
+
+        Note that while the new client calls always come through on the main thread, our mechanisms to
+        route dispatches to the main thread are still valid and will still work.
+
+        Update to the new IconDatabaseClient interface:
+        * WebCoreSupport/WebIconDatabaseClient.h:
+        * WebCoreSupport/WebIconDatabaseClient.mm:
+        (WebIconDatabaseClient::didRemoveAllIcons):
+        (WebIconDatabaseClient::didImportIconURLForPageURL):
+        (WebIconDatabaseClient::didImportIconDataForPageURL):
+        (WebIconDatabaseClient::didChangeIconForPageURL):
+        (WebIconDatabaseClient::didFinishURLImport):
+
+2011-03-22  Matthew Delaney  <mdelaney@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Have WebKit push acceleratedDrawing preferences to settings
+        https://bugs.webkit.org/show_bug.cgi?id=56792
+
+        * WebView/WebView.mm:
+
+2011-03-21  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Brady Eidson.
+
+        Expose a preference to use caching quirks for QuickLook,
+        and use it if the QuickLook framework is loaded.
+
+        https://bugs.webkit.org/show_bug.cgi?id=38690
+
+        * WebView/WebPreferenceKeysPrivate.h:
+        * WebView/WebPreferences.mm:
+        (useQuickLookQuirks):
+        (+[WebPreferences initialize]):
+        (-[WebPreferences useQuickLookResourceCachingQuirks]):
+        * WebView/WebPreferencesPrivate.h:
+        * WebView/WebView.mm:
+        (-[WebView _preferencesChangedNotification:]):
+
+2011-03-21  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        AX: showContextMenu not working in WK2
+        https://bugs.webkit.org/show_bug.cgi?id=56734
+
+        Implement showContextMenu() so accessibility related code can call this
+        independent of whether WK1 or WK2 is running.
+
+        * WebCoreSupport/WebChromeClient.h:
+        * WebCoreSupport/WebChromeClient.mm:
+        (WebChromeClient::showContextMenu):
+
+2011-03-21  Chang Shu  <cshu@webkit.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        REGRESSION (r79953): Can't type in MS Outlook 2011
+        https://bugs.webkit.org/show_bug.cgi?id=56665
+
+        r79953 removed the WebView level editablity which is persistent no matter whether
+        underlying document itself is changed and editability gets lost. The resolution is to
+        set this WebView editable value to WebCore. This avoids the callback from WebCore to
+        WebKit which was the main goal in r79953 to improve performance.
+
+        * WebView/WebView.mm:
+        (-[WebView setEditable:]):
+        (-[WebView isEditable]):
+
+2011-03-19  Anton D'Auria  <adauria@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        ApplicationCacheGroup is not obsolete after being deleted via ApplicationCacheStorage::deleteEntriesForOrigin
+        https://bugs.webkit.org/show_bug.cgi?id=56415
+        
+        Use new ApplicationCache API to delete all cache for an origin.
+
+        * WebCoreSupport/WebApplicationCache.h:
+        * WebCoreSupport/WebApplicationCache.mm:
+        (+[WebApplicationCache deleteOrigin:]):
+
+2011-03-17  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=56425
+        More groundwork for WebKit2 IconDatabase
+
+        Update already-used function names:
+        * Misc/WebIconDatabase.mm:
+        (-[WebIconDatabase iconForURL:withSize:cache:]):
+        (-[WebIconDatabase iconURLForURL:]):
+        * WebView/WebView.mm:
+        (-[WebView _dispatchDidReceiveIconFromWebFrame:]):
+
+2011-03-18  Pavel Podivilov  <podivilov@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: implement inspector session storage.
+        https://bugs.webkit.org/show_bug.cgi?id=56643
+
+        * WebCoreSupport/WebInspectorClient.h:
+        * WebCoreSupport/WebInspectorClient.mm:
+        (WebInspectorClient::saveSessionSetting):
+        (WebInspectorClient::loadSessionSetting):
+        (WebInspectorFrontendClient::saveSessionSetting):
+        (WebInspectorFrontendClient::loadSessionSetting):
+        (-[WebInspectorWindowController inspectorClient]):
+
+2011-03-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fixed a leak seen on the buildbot.
+
+        * WebCoreSupport/WebInspectorClient.mm:
+        (WebInspectorClient::openInspectorFrontend): Smart pointers are smart.
+
+2011-03-16  Jeff Johnson  <github@lapcatsoftware.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Logic error in -[WebHTMLView close]
+        https://bugs.webkit.org/show_bug.cgi?id=56445
+
+        Page is always nil at this point, because [self _webView] is nil,
+        so the conditional code is never run.
+
+        * WebView/WebHTMLView.mm:
+        (-[WebHTMLView close]):
+
+2011-03-16  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        WK2: Need to propagate enhanced accessibility flag from UI -> web process
+        https://bugs.webkit.org/show_bug.cgi?id=56379
+
+        * WebView/WebFrame.mm:
+        (-[WebFrame accessibilityRoot]):
+
+2011-03-15  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Make Structure creation require a JSGlobalData
+        https://bugs.webkit.org/show_bug.cgi?id=56438
+
+        Mechanical change to make all Structure creation use a JSGlobalData&
+
+        * Plugins/Hosted/ProxyInstance.mm:
+        (WebKit::ProxyRuntimeMethod::createStructure):
+        * Plugins/Hosted/ProxyRuntimeObject.h:
+        (WebKit::ProxyRuntimeObject::createStructure):
+
+2011-03-15  Alexey Proskuryakov  <ap@apple.com>
+
+        Forgot to save a modification to this file when committing.
+
+        * WebCoreSupport/WebKeyGenerator.mm: Changed "Apple Computer" to "Apple" in copyright header.
+
+2011-03-15  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        REGRESSION (WebKit2): keygen element doesn't work
+        https://bugs.webkit.org/show_bug.cgi?id=56402
+        <rdar://problem/9006545>
+
+        * WebCoreSupport/WebKeyGenerator.h:
+        * WebCoreSupport/WebKeyGenerator.m: Removed.
+        * WebCoreSupport/WebKeyGenerator.mm: Copied from Source/WebKit/mac/WebCoreSupport/WebKeyGenerator.m.
+        (+[WebKeyGenerator sharedGenerator]):
+        (toWebCertificateParseResult):
+        WebCore no longer needs WebKeyGenerator. Safari still does need a part of it, so keeping
+        this misnamed and misplaced code for now.
+
+        * WebCoreSupport/WebPlatformStrategies.h:
+        * WebCoreSupport/WebPlatformStrategies.mm:
+        (WebPlatformStrategies::keygenMenuItem512):
+        (WebPlatformStrategies::keygenMenuItem1024):
+        (WebPlatformStrategies::keygenMenuItem2048):
+        (WebPlatformStrategies::keygenKeychainItemName):
+        Added strings used by keygen.
+
+        * WebCoreSupport/WebSystemInterface.mm: (InitWebCoreSystemInterface): Initialize a WebCore
+        pointer to a function used by keygen.
+
+        * WebView/WebFrameView.mm: (-[WebFrameView initWithFrame:]): WebKeyGenerator can be lazily
+        initialized now.
+
+2011-03-15  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        WebKit part of <rdar://problem/9075624> Overlay scrollbars slow down PLT by 6%
+
+        New WebKitystemInterface function to force the scrollbars to flash
+        * WebCoreSupport/WebSystemInterface.mm:
+        (InitWebCoreSystemInterface):
+
+2011-03-15  Ilya Sherman  <isherman@chromium.org>
+
+        Reviewed by Tony Chang.
+
+        Autofilled form elements are assigned fixed background color but not text color
+        https://bugs.webkit.org/show_bug.cgi?id=48382
+
+        * DOM/WebDOMOperations.mm:
+        (-[DOMHTMLInputElement _setAutofilled:]): Added (wrapper).
+        * DOM/WebDOMOperationsPrivate.h:
+
+2011-03-15  Adam Roben  <aroben@apple.com>
+
+        Fix a leak in WebStorageTrackerClient::dispatchDidModifyOrigin
+
+        Fixes <http://webkit.org/b/56385> SecurityOrigin leaks seen in
+        WebStorageTrackerClient::dispatchDidModifyOrigin
+
+        Reviewed by Antti Koivisto.
+
+        * Storage/WebStorageTrackerClient.mm:
+        (WebStorageTrackerClient::dispatchDidModifyOriginOnMainThread): Adopt the reference passed
+        to us by dispatchDidModifyOrigin.
+        (WebStorageTrackerClient::dispatchDidModifyOrigin): Added a comment and removed an
+        unnecessary cast.
+
+2011-03-15  Kevin Ollivier  <kevino@theolliviers.com>
+
+        Reviewed by Darin Adler.
+
+        Introduce WTF_USE_EXPORT_MACROS, which will allow us to put shared library import/export
+        info into the headers rather than in export symbol definition files, but disable it on 
+        all platforms initially so we can deal with port build issues one port at a time.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=27551
+
+        * WebKitPrefix.h:
+
+2011-03-14  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=56320
+        Remove HistoryItem::icon() and the WebCore dependency on "IconDatabaseBase::defaultIcon()"
+
+        * History/WebHistoryItem.mm:
+        (-[WebHistoryItem icon]): This far-future FIXME is now irrelevant.
+
+2011-03-13  Pratik Solanki  <psolanki@apple.com>
+
+        Reviewed by Brady Eidson.
+
+        Make adjustMIMETypeIfNecessary use CFNetwork directly
+        https://bugs.webkit.org/show_bug.cgi?id=55912
+
+        * WebCoreSupport/WebSystemInterface.mm:
+        (InitWebCoreSystemInterface): Support for new WKSI functions.
+
+2011-03-12  Mark Rowe  <mrowe@apple.com>
+
+        Fix the 32-bit build.
+
+        * Carbon/CarbonWindowAdapter.mm:
+        (-[CarbonWindowAdapter initWithCarbonWindowRef:takingOwnership:disableOrdering:carbon:]): Use a more appropriate format specifier.
+        (-[CarbonWindowAdapter _carbonWindowClass]): Ditto.
+
+2011-03-11  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Anders Carlsson
+
+        <rdar://problem/8648311> and https://bugs.webkit.org/show_bug.cgi?id=56216
+        Rework disabled IconDatabase builds while allowing for a pluggable icon database implementation.
+
+        * Misc/WebIconDatabase.mm:
+        (+[WebIconDatabase _checkIntegrityBeforeOpening]): Call these static methods on IconDatabase::, not iconDatabase().
+        (-[WebIconDatabase _startUpIconDatabase]): Ditto.
+        (importToWebCoreFormat):
+
+2011-03-11  Anton D'Auria  <adauria@apple.com>
+
+        Reviewed and landed by Brady Eidson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=51878
+        Add WebKit1 API to view and delete local storage
+
+        * Storage/WebStorageManager.mm: Added.
+        (+[WebStorageManager sharedWebStorageManager]):
+        (-[WebStorageManager origins]):
+        (-[WebStorageManager deleteAllOrigins]):
+        (-[WebStorageManager deleteOrigin:]):
+        (-[WebStorageManager syncLocalStorage]):
+        (-[WebStorageManager syncFileSystemAndTrackerDatabase]):
+        (storageDirectoryPath):
+        (WebKitInitializeStorageIfNecessary):
+        * Storage/WebStorageManagerInternal.h: Added.
+        * Storage/WebStorageManagerPrivate.h: Added.
+        * Storage/WebStorageTrackerClient.h: Added.
+        * Storage/WebStorageTrackerClient.mm: Added.
+        (WebStorageTrackerClient::sharedWebStorageTrackerClient):
+        (WebStorageTrackerClient::WebStorageTrackerClient):
+        (WebStorageTrackerClient::~WebStorageTrackerClient):
+        (WebStorageTrackerClient::dispatchDidModifyOriginOnMainThread):
+        (WebStorageTrackerClient::dispatchDidModifyOrigin):
+        * WebCoreSupport/WebSecurityOrigin.mm:
+        (-[WebSecurityOrigin protocol]):
+        (-[WebSecurityOrigin host]):
+        (-[WebSecurityOrigin databaseIdentifier]):
+        (-[WebSecurityOrigin domain]):
+        (-[WebSecurityOrigin _initWithWebCoreSecurityOrigin:]):
+        * WebCoreSupport/WebSecurityOriginPrivate.h:
+        * WebKit.exp:
+        * WebView/WebView.mm:
+        (-[WebView _commonInitializationWithFrameName:groupName:usesDocumentViews:]):
+
+2011-03-10  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        <rdar://problem/9117047>
+        Don't paint more than 60 times per second even when scrolling
+
+        * WebView/WebClipView.mm:
+        (-[WebClipView _immediateScrollToPoint:]):
+
+2011-03-09  Matthew Delaney  <mdelaney@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Plumb through settings for accelerated drawing for canvas
+        https://bugs.webkit.org/show_bug.cgi?id=56039
+
+        * WebView/WebPreferenceKeysPrivate.h:
+        * WebView/WebPreferences.mm:
+        * WebView/WebPreferencesPrivate.h:
+
+2011-03-10  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Tony Chang.
+
+        VisiblePosition's next and previous should take an enum instead of a boolean
+        https://bugs.webkit.org/show_bug.cgi?id=56135
+
+        SelectionController::isAll now takes EditingBoundaryCrossingRule instead of
+        StayInEditableContent.
+
+        * WebView/WebView.mm:
+        (-[WebView _selectionIsAll]):
+
+2011-03-09  Jessie Berlin  <jberlin@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Use the Cookie Storage from the Private Browsing Storage Session directly
+        https://bugs.webkit.org/show_bug.cgi?id=55986
+
+        * WebCoreSupport/WebSystemInterface.mm:
+        (InitWebCoreSystemInterface):
+
+2011-03-08  Darin Adler  <darin@apple.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Promote a method used outside WebKit from internal to private
+        https://bugs.webkit.org/show_bug.cgi?id=55949
+
+        * Misc/WebNSPasteboardExtras.mm: Removed an unused category declaration.
+        Minor tweak, not directly related to the rest of this patch.
+
+        * WebView/WebFrame.mm:
+        (-[WebFrame _computePageRectsWithPrintScaleFactor:pageSize:]): Moved
+        this method from the internal category into the private category.
+        Streamlined the code a bit.
+
+        * WebView/WebFrameInternal.h: Removed _computePageRects method.
+        * WebView/WebFramePrivate.h: Added _computePageRects method.
+
 2011-03-07  Ryosuke Niwa  <rniwa@webkit.org>
 
         Reviewed by Darin Adler.
diff --git a/Source/WebKit/mac/Configurations/Base.xcconfig b/Source/WebKit/mac/Configurations/Base.xcconfig
index 0e84791..0cf0f7a 100644
--- a/Source/WebKit/mac/Configurations/Base.xcconfig
+++ b/Source/WebKit/mac/Configurations/Base.xcconfig
@@ -25,7 +25,6 @@ DEBUG_INFORMATION_FORMAT = dwarf;
 GCC_C_LANGUAGE_STANDARD = gnu99;
 GCC_DEBUGGING_SYMBOLS = default;
 GCC_DYNAMIC_NO_PIC = NO;
-GCC_ENABLE_CPP_EXCEPTIONS = NO;
 GCC_ENABLE_CPP_RTTI = NO;
 GCC_ENABLE_OBJC_EXCEPTIONS = YES;
 GCC_ENABLE_OBJC_GC = $(GCC_ENABLE_OBJC_GC_$(REAL_PLATFORM_NAME));
@@ -104,12 +103,23 @@ TARGET_GCC_VERSION_macosx_1050_ = $(TARGET_GCC_VERSION_macosx_1050_$(XCODE_VERSI
 TARGET_GCC_VERSION_macosx_1050_0310 = GCC_42;
 TARGET_GCC_VERSION_macosx_1050_0320 = GCC_42;
 TARGET_GCC_VERSION_macosx_1060 = GCC_42;
-TARGET_GCC_VERSION_macosx_1070 = LLVM_GCC_42;
+TARGET_GCC_VERSION_macosx_1070 = $(TARGET_GCC_VERSION_macosx_1070_$(CONFIGURATION));
+TARGET_GCC_VERSION_macosx_1070_Debug = LLVM_COMPILER;
+TARGET_GCC_VERSION_macosx_1070_Release = LLVM_GCC_42;
+TARGET_GCC_VERSION_macosx_1070_Production = LLVM_GCC_42;
 
 GCC_VERSION = $(GCC_VERSION_$(TARGET_GCC_VERSION));
 GCC_VERSION_GCC_40 = 4.0;
 GCC_VERSION_GCC_42 = 4.2;
 GCC_VERSION_LLVM_GCC_42 = com.apple.compilers.llvmgcc42;
+GCC_VERSION_LLVM_COMPILER = com.apple.compilers.llvm.clang.1_0;
+
+// FIXME: Disable C++ exceptions in the LLVM Compiler once it supports enabling Obj-C exceptions without C++ exceptions.
+GCC_ENABLE_CPP_EXCEPTIONS = $(GCC_ENABLE_CPP_EXCEPTIONS_$(TARGET_GCC_VERSION));
+GCC_ENABLE_CPP_EXCEPTIONS_GCC_40 = NO;
+GCC_ENABLE_CPP_EXCEPTIONS_GCC_42 = NO;
+GCC_ENABLE_CPP_EXCEPTIONS_LLVM_GCC = NO;
+GCC_ENABLE_CPP_EXCEPTIONS_LLVM_COMPILER = YES;
 
 // If the target Mac OS X version does not match the current Mac OS X version then we'll want to build using the target version's SDK.
 SDKROOT = $(SDKROOT_$(MAC_OS_X_VERSION_MAJOR)_$(TARGET_MAC_OS_X_VERSION_MAJOR));
diff --git a/Source/WebKit/mac/Configurations/Version.xcconfig b/Source/WebKit/mac/Configurations/Version.xcconfig
index b6a6045..5e8e50b 100644
--- a/Source/WebKit/mac/Configurations/Version.xcconfig
+++ b/Source/WebKit/mac/Configurations/Version.xcconfig
@@ -22,7 +22,7 @@
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 
 MAJOR_VERSION = 534;
-MINOR_VERSION = 24;
+MINOR_VERSION = 27;
 TINY_VERSION = 0;
 FULL_VERSION = $(MAJOR_VERSION).$(MINOR_VERSION);
 
diff --git a/Source/WebKit/mac/DOM/WebDOMOperations.mm b/Source/WebKit/mac/DOM/WebDOMOperations.mm
index eee4919..979433d 100644
--- a/Source/WebKit/mac/DOM/WebDOMOperations.mm
+++ b/Source/WebKit/mac/DOM/WebDOMOperations.mm
@@ -197,6 +197,11 @@ using namespace JSC;
 
 @implementation DOMHTMLInputElement (WebDOMHTMLInputElementOperationsPrivate)
 
+- (void)_setAutofilled:(BOOL)autofilled
+{
+    static_cast<HTMLInputElement*>(core((DOMElement *)self))->setAutofilled(autofilled);
+}
+
 - (void)_setValueForUser:(NSString *)value
 {
     static_cast<HTMLInputElement*>(core((DOMElement *)self))->setValueForUser(value);
diff --git a/Source/WebKit/mac/DOM/WebDOMOperationsPrivate.h b/Source/WebKit/mac/DOM/WebDOMOperationsPrivate.h
index dc1aaf8..b579a6f 100644
--- a/Source/WebKit/mac/DOM/WebDOMOperationsPrivate.h
+++ b/Source/WebKit/mac/DOM/WebDOMOperationsPrivate.h
@@ -39,6 +39,7 @@
 @end
 
 @interface DOMHTMLInputElement (WebDOMHTMLInputElementOperationsPrivate)
+- (void)_setAutofilled:(BOOL)autofilled;
 - (void)_setValueForUser:(NSString *)value;
 @end
 
diff --git a/Source/WebKit/mac/DefaultDelegates/WebDefaultContextMenuDelegate.mm b/Source/WebKit/mac/DefaultDelegates/WebDefaultContextMenuDelegate.mm
index a2f02e6..a6dd828 100644
--- a/Source/WebKit/mac/DefaultDelegates/WebDefaultContextMenuDelegate.mm
+++ b/Source/WebKit/mac/DefaultDelegates/WebDefaultContextMenuDelegate.mm
@@ -129,6 +129,12 @@
     }
 }
 
+#if defined(BUILDING_ON_TIGER) || defined(BUILDING_ON_LEOPARD) || defined(BUILDING_ON_SNOW_LEOPARD)
+#define INCLUDE_SPOTLIGHT_CONTEXT_MENU_ITEM 1
+#else
+#define INCLUDE_SPOTLIGHT_CONTEXT_MENU_ITEM 0
+#endif
+
 - (NSArray *)webView:(WebView *)wv contextMenuItemsForElement:(NSDictionary *)element  defaultMenuItems:(NSArray *)defaultMenuItems
 {
     // The defaultMenuItems here are ones supplied by the WebDocumentView protocol implementation. WebPDFView is
@@ -141,16 +147,29 @@
         // The Spotlight and Google items are implemented in WebView, and require that the
         // current document view conforms to WebDocumentText
         ASSERT([[[webFrame frameView] documentView] conformsToProtocol:@protocol(WebDocumentText)]);
-        [menuItems addObject:[self menuItemWithTag:WebMenuItemTagSearchInSpotlight target:nil representedObject:element]];
-        [menuItems addObject:[self menuItemWithTag:WebMenuItemTagSearchWeb target:nil representedObject:element]];
-        [menuItems addObject:[NSMenuItem separatorItem]];
 
         // FIXME 4184640: The Look Up in Dictionary item is only implemented in WebHTMLView, and so is present but
         // dimmed for other cases where WebElementIsSelectedKey is present. It would probably 
         // be better not to include it in the menu if the documentView isn't a WebHTMLView, but that could break 
         // existing clients that have code that relies on it being present (unlikely for clients outside of Apple, 
         // but Safari has such code).
-        [menuItems addObject:[self menuItemWithTag:WebMenuItemTagLookUpInDictionary target:nil representedObject:element]];            
+
+#if INCLUDE_SPOTLIGHT_CONTEXT_MENU_ITEM
+        [menuItems addObject:[self menuItemWithTag:WebMenuItemTagSearchInSpotlight target:nil representedObject:element]];
+#else
+        NSMenuItem *lookupMenuItem = [self menuItemWithTag:WebMenuItemTagLookUpInDictionary target:nil representedObject:element];
+        NSString *selectedString = [(id <WebDocumentText>)[[webFrame frameView] documentView] selectedString];
+        [lookupMenuItem setTitle:[NSString stringWithFormat:UI_STRING_INTERNAL("Look Up “%@�", "Look Up context menu item with selected word"), selectedString]];
+        [menuItems addObject:lookupMenuItem];
+#endif
+
+        [menuItems addObject:[self menuItemWithTag:WebMenuItemTagSearchWeb target:nil representedObject:element]];
+
+#if INCLUDE_SPOTLIGHT_CONTEXT_MENU_ITEM
+        [menuItems addObject:[NSMenuItem separatorItem]];
+        [menuItems addObject:[self menuItemWithTag:WebMenuItemTagLookUpInDictionary target:nil representedObject:element]];
+#endif
+
         [menuItems addObject:[NSMenuItem separatorItem]];
         [menuItems addObject:[self menuItemWithTag:WebMenuItemTagCopy target:nil representedObject:element]];
     } else {
diff --git a/Source/WebKit/mac/History/WebHistoryItem.mm b/Source/WebKit/mac/History/WebHistoryItem.mm
index de56180..530b18a 100644
--- a/Source/WebKit/mac/History/WebHistoryItem.mm
+++ b/Source/WebKit/mac/History/WebHistoryItem.mm
@@ -185,12 +185,6 @@ void WKNotifyHistoryItemChanged(HistoryItem*)
 - (NSImage *)icon
 {
     return [[WebIconDatabase sharedIconDatabase] iconForURL:[self URLString] withSize:WebIconSmallSize];
-    
-    // FIXME: Ideally, this code should simply be the following -
-    // return core(_private)->icon()->getNSImage();
-    // Once radar -
-    // <rdar://problem/4906567> - NSImage returned from WebCore::Image may be incorrect size
-    // is resolved
 }
 
 - (NSTimeInterval)lastVisitedTimeInterval
diff --git a/Source/WebKit/mac/Misc/WebIconDatabase.mm b/Source/WebKit/mac/Misc/WebIconDatabase.mm
index 50bcd7e..f223f09 100644
--- a/Source/WebKit/mac/Misc/WebIconDatabase.mm
+++ b/Source/WebKit/mac/Misc/WebIconDatabase.mm
@@ -137,8 +137,8 @@ static WebIconDatabaseClient* defaultClient()
     // FIXME - <rdar://problem/4697934> - Move the handling of FileURLs to WebCore and implement in ObjC++
     if ([URL _webkit_isFileURL])
         return [self _iconForFileURL:URL withSize:size];
-      
-    if (Image* image = iconDatabase().iconForPageURL(URL, IntSize(size)))
+    
+    if (Image* image = iconDatabase().synchronousIconForPageURL(URL, IntSize(size)))
         if (NSImage *icon = webGetNSImage(image, size))
             return icon;
     return [self defaultIconForURL:URL withSize:size];
@@ -155,7 +155,7 @@ static WebIconDatabaseClient* defaultClient()
         return nil;
     ASSERT_MAIN_THREAD();
 
-    return iconDatabase().iconURLForPageURL(URL);
+    return iconDatabase().synchronousIconURLForPageURL(URL);
 }
 
 - (NSImage *)defaultIconWithSize:(NSSize)size
@@ -258,7 +258,7 @@ static WebIconDatabaseClient* defaultClient()
 
 + (void)_checkIntegrityBeforeOpening
 {
-    iconDatabase().checkIntegrityBeforeOpening();
+    IconDatabase::checkIntegrityBeforeOpening();
 }
 
 @end
@@ -296,14 +296,14 @@ static WebIconDatabaseClient* defaultClient()
     NSString *legacyDB = [databaseDirectory stringByAppendingPathComponent:@"icon.db"];
     NSFileManager *defaultManager = [NSFileManager defaultManager];
     if ([defaultManager fileExistsAtPath:legacyDB isDirectory:&isDirectory] && !isDirectory) {
-        NSString *newDB = [databaseDirectory stringByAppendingPathComponent:iconDatabase().defaultDatabaseFilename()];
+        NSString *newDB = [databaseDirectory stringByAppendingPathComponent:IconDatabase::defaultDatabaseFilename()];
         if (![defaultManager fileExistsAtPath:newDB])
             rename([legacyDB fileSystemRepresentation], [newDB fileSystemRepresentation]);
     }
     
     // Set the private browsing pref then open the WebCore icon database
     iconDatabase().setPrivateBrowsingEnabled([[WebPreferences standardPreferences] privateBrowsingEnabled]);
-    if (!iconDatabase().open(databaseDirectory))
+    if (!iconDatabase().open(databaseDirectory, IconDatabase::defaultDatabaseFilename()))
         LOG_ERROR("Unable to open icon database");
     
     // Register for important notifications
@@ -656,7 +656,7 @@ bool importToWebCoreFormat()
     NSFileManager *fileManager = [NSFileManager defaultManager];
     enumerator = [[fileManager contentsOfDirectoryAtPath:databaseDirectory error:NULL] objectEnumerator];
 
-    NSString *databaseFilename = iconDatabase().defaultDatabaseFilename();
+    NSString *databaseFilename = IconDatabase::defaultDatabaseFilename();
 
     BOOL foundIconDB = NO;
     NSString *file;
diff --git a/Source/WebKit/mac/Misc/WebNSControlExtras.m b/Source/WebKit/mac/Misc/WebNSControlExtras.m
index b666131..dc91e23 100644
--- a/Source/WebKit/mac/Misc/WebNSControlExtras.m
+++ b/Source/WebKit/mac/Misc/WebNSControlExtras.m
@@ -44,7 +44,15 @@
 
     NSWindow *window = [self window];
     NSRect windowFrame = [window frame];
-    windowFrame.size.height += heightDelta * [window userSpaceScaleFactor];
+
+    CGFloat userSpaceScaleFactor;
+#if !defined(BUILDING_ON_LEOPARD) && !defined(BUILDING_ON_SNOW_LEOPARD)
+    userSpaceScaleFactor = [window backingScaleFactor];
+#else
+    userSpaceScaleFactor = [window userSpaceScaleFactor];
+#endif
+
+    windowFrame.size.height += heightDelta * userSpaceScaleFactor;
     [window setFrame:windowFrame display:NO];
 }
 
diff --git a/Source/WebKit/mac/Misc/WebNSPasteboardExtras.mm b/Source/WebKit/mac/Misc/WebNSPasteboardExtras.mm
index 7caa47a..f5c7436 100644
--- a/Source/WebKit/mac/Misc/WebNSPasteboardExtras.mm
+++ b/Source/WebKit/mac/Misc/WebNSPasteboardExtras.mm
@@ -47,11 +47,6 @@
 #import <wtf/RetainPtr.h>
 #import <wtf/StdLibExtras.h>
 
-@interface NSFilePromiseDragSource : NSObject
-- (id)initWithSource:(id)draggingSource;
-- (void)setTypes:(NSArray *)types onPasteboard:(NSPasteboard *)pboard;
-@end
-
 using namespace WebCore;
 
 NSString *WebURLPboardType = @"public.url";
diff --git a/Source/WebKit/mac/Plugins/Hosted/ProxyInstance.mm b/Source/WebKit/mac/Plugins/Hosted/ProxyInstance.mm
index 8a413d4..f26b85d 100644
--- a/Source/WebKit/mac/Plugins/Hosted/ProxyInstance.mm
+++ b/Source/WebKit/mac/Plugins/Hosted/ProxyInstance.mm
@@ -187,9 +187,9 @@ public:
         ASSERT(inherits(&s_info));
     }
 
-    static PassRefPtr<Structure> createStructure(JSValue prototype)
+    static PassRefPtr<Structure> createStructure(JSGlobalData& globalData, JSValue prototype)
     {
-        return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
+        return Structure::create(globalData, prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
     }
 
     static const ClassInfo s_info;
diff --git a/Source/WebKit/mac/Plugins/Hosted/ProxyRuntimeObject.h b/Source/WebKit/mac/Plugins/Hosted/ProxyRuntimeObject.h
index fc77890..a07c86c 100644
--- a/Source/WebKit/mac/Plugins/Hosted/ProxyRuntimeObject.h
+++ b/Source/WebKit/mac/Plugins/Hosted/ProxyRuntimeObject.h
@@ -41,9 +41,9 @@ public:
 
     ProxyInstance* getInternalProxyInstance() const;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSGlobalData& globalData, JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
+        return JSC::Structure::create(globalData, prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
     }
 
     static const JSC::ClassInfo s_info;
diff --git a/Source/WebKit/mac/Plugins/WebBasePluginPackage.mm b/Source/WebKit/mac/Plugins/WebBasePluginPackage.mm
index 05b084a..3fb86cb 100644
--- a/Source/WebKit/mac/Plugins/WebBasePluginPackage.mm
+++ b/Source/WebKit/mac/Plugins/WebBasePluginPackage.mm
@@ -38,6 +38,7 @@
 #import <wtf/Assertions.h>
 #import <wtf/Threading.h>
 #import <wtf/Vector.h>
+#import <wtf/text/CString.h>
 
 #import <WebKitSystemInterface.h>
 
@@ -222,8 +223,15 @@ static NSString *pathByResolvingSymlinksAndAliases(NSString *thePath)
         MimeClassInfo mimeClassInfo;
         
         extensions = [[MIMEDictionary objectForKey:WebPluginExtensionsKey] _web_lowercaseStrings];
-        for (NSUInteger i = 0; i < [extensions count]; ++i)
-            mimeClassInfo.extensions.append((NSString *)[extensions objectAtIndex:i]);
+        for (NSUInteger i = 0; i < [extensions count]; ++i) {
+            // The DivX plug-in lists multiple extensions in a comma separated string instead of using
+            // multiple array elements in the property list. Work around this here by splitting the
+            // extension string into components.
+            NSArray *extensionComponents = [[extensions objectAtIndex:i] componentsSeparatedByString:@","];
+
+            for (NSString *extension in extensionComponents)
+                mimeClassInfo.extensions.append(extension);
+        }
 
         if ([extensions count] == 0)
             extensions = [NSArray arrayWithObject:@""];
diff --git a/Source/WebKit/mac/Plugins/WebPluginContainerPrivate.h b/Source/WebKit/mac/Plugins/WebPluginContainerPrivate.h
index af7251d..1b8de41 100644
--- a/Source/WebKit/mac/Plugins/WebPluginContainerPrivate.h
+++ b/Source/WebKit/mac/Plugins/WebPluginContainerPrivate.h
@@ -29,7 +29,7 @@
 #import <Cocoa/Cocoa.h>
 
 #if !defined(ENABLE_PLUGIN_PROXY_FOR_VIDEO)
-#define ENABLE_PLUGIN_PROXY_FOR_VIDEO 1
+#define ENABLE_PLUGIN_PROXY_FOR_VIDEO 0
 #endif
 
 #if ENABLE_PLUGIN_PROXY_FOR_VIDEO
diff --git a/Source/WebKit/mac/Storage/WebStorageManager.mm b/Source/WebKit/mac/Storage/WebStorageManager.mm
new file mode 100644
index 0000000..23f699f
--- /dev/null
+++ b/Source/WebKit/mac/Storage/WebStorageManager.mm
@@ -0,0 +1,113 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#if ENABLE(DOM_STORAGE)
+
+#import "WebSecurityOriginInternal.h"
+#import "WebStorageManagerPrivate.h"
+#import "WebStorageManagerInternal.h"
+#import "WebStorageTrackerClient.h"
+
+#import <WebCore/SecurityOrigin.h>
+#import <WebCore/StorageTracker.h>
+
+using namespace WebCore;
+
+NSString * const WebStorageDirectoryDefaultsKey = @"WebKitLocalStorageDatabasePathPreferenceKey";
+NSString * const WebStorageDidModifyOriginNotification = @"WebStorageDidModifyOriginNotification";
+
+static NSString *storageDirectoryPath();
+
+@implementation WebStorageManager
+
++ (WebStorageManager *)sharedWebStorageManager
+{
+    static WebStorageManager *sharedManager = [[WebStorageManager alloc] init];
+    return sharedManager;
+}
+
+- (NSArray *)origins
+{
+    Vector<RefPtr<SecurityOrigin> > coreOrigins;
+
+    StorageTracker::tracker().origins(coreOrigins);
+
+    NSMutableArray *webOrigins = [[NSMutableArray alloc] initWithCapacity:coreOrigins.size()];
+
+    for (size_t i = 0; i < coreOrigins.size(); ++i) {
+        WebSecurityOrigin *webOrigin = [[WebSecurityOrigin alloc] _initWithWebCoreSecurityOrigin:coreOrigins[i].get()];
+        [webOrigins addObject:webOrigin];
+        [webOrigin release];
+    }
+
+    return [webOrigins autorelease];
+}
+
+- (void)deleteAllOrigins
+{
+    StorageTracker::tracker().deleteAllOrigins();
+}
+
+- (void)deleteOrigin:(WebSecurityOrigin *)origin
+{
+    StorageTracker::tracker().deleteOrigin([origin _core]);
+}
+
+- (void)syncLocalStorage
+{
+    StorageTracker::tracker().syncLocalStorage();
+}
+
+- (void)syncFileSystemAndTrackerDatabase
+{
+    StorageTracker::tracker().syncFileSystemAndTrackerDatabase();
+}
+
+static NSString *storageDirectoryPath()
+{
+    NSUserDefaults *defaults = [NSUserDefaults standardUserDefaults];
+    NSString *storageDirectory = [defaults objectForKey:WebStorageDirectoryDefaultsKey];
+    if (!storageDirectory || ![storageDirectory isKindOfClass:[NSString class]])
+        storageDirectory = @"~/Library/WebKit/LocalStorage";
+    
+    return [storageDirectory stringByStandardizingPath];
+}
+
+void WebKitInitializeStorageIfNecessary()
+{
+    static BOOL initialized = NO;
+    if (initialized)
+        return;
+    
+    StorageTracker::initializeTracker(storageDirectoryPath());
+    
+    StorageTracker::tracker().setClient(WebStorageTrackerClient::sharedWebStorageTrackerClient());
+    
+    initialized = YES;
+}
+
+@end
+
+#endif
diff --git a/Source/WebKit2/UIProcess/API/C/win/WKBaseWin.h b/Source/WebKit/mac/Storage/WebStorageManagerInternal.h
index e2ee9a7..d3d3604 100644
--- a/Source/WebKit2/UIProcess/API/C/win/WKBaseWin.h
+++ b/Source/WebKit/mac/Storage/WebStorageManagerInternal.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2010 Apple Inc. All rights reserved.
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -22,14 +22,9 @@
  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
  * THE POSSIBILITY OF SUCH DAMAGE.
  */
+ 
+#if ENABLE(DOM_STORAGE)
 
-#ifndef WKBaseWin_h
-#define WKBaseWin_h
+void WebKitInitializeStorageIfNecessary();
 
-#ifndef WKBase_h
-#error "Please #include \"WKBase.h\" instead of this file directly."
 #endif
-
-typedef const struct OpaqueWKView* WKViewRef;
-
-#endif /* WKBaseWin_h */
diff --git a/Source/WebKit/mac/Storage/WebStorageManagerPrivate.h b/Source/WebKit/mac/Storage/WebStorageManagerPrivate.h
new file mode 100644
index 0000000..34db3f6
--- /dev/null
+++ b/Source/WebKit/mac/Storage/WebStorageManagerPrivate.h
@@ -0,0 +1,45 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+extern NSString * const WebStorageDirectoryDefaultsKey;
+extern NSString * const WebStorageDidModifyOriginNotification;
+
+@class WebSecurityOrigin;
+
+@interface WebStorageManager : NSObject
+
++ (WebStorageManager *)sharedWebStorageManager;
+
+// Returns an array of WebSecurityOrigin objects that have LocalStorage.
+- (NSArray *)origins;
+
+- (void)deleteAllOrigins;
+- (void)deleteOrigin:(WebSecurityOrigin *)origin;
+
+- (void)syncLocalStorage;
+- (void)syncFileSystemAndTrackerDatabase;
+
+@end
+
diff --git a/Source/WebKit/mac/Storage/WebStorageTrackerClient.h b/Source/WebKit/mac/Storage/WebStorageTrackerClient.h
new file mode 100644
index 0000000..d3c190c
--- /dev/null
+++ b/Source/WebKit/mac/Storage/WebStorageTrackerClient.h
@@ -0,0 +1,45 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+ 
+#if ENABLE(DOM_STORAGE)
+
+#import <WebCore/SecurityOrigin.h>
+#import <WebCore/StorageTrackerClient.h>
+
+using namespace WebCore;
+
+class WebStorageTrackerClient : public WebCore::StorageTrackerClient {
+public:
+    static WebStorageTrackerClient* sharedWebStorageTrackerClient();
+    static void dispatchDidModifyOriginOnMainThread(void* context);
+    
+    virtual ~WebStorageTrackerClient();
+    virtual void dispatchDidModifyOrigin(const String& originIdentifier);
+    virtual void dispatchDidModifyOrigin(PassRefPtr<SecurityOrigin>);
+private:
+    WebStorageTrackerClient();
+};
+
+#endif
diff --git a/Source/WebKit/mac/Storage/WebStorageTrackerClient.mm b/Source/WebKit/mac/Storage/WebStorageTrackerClient.mm
new file mode 100644
index 0000000..01bb981
--- /dev/null
+++ b/Source/WebKit/mac/Storage/WebStorageTrackerClient.mm
@@ -0,0 +1,82 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#if ENABLE(DOM_STORAGE)
+
+#import "WebStorageTrackerClient.h"
+
+#import "WebSecurityOriginInternal.h"
+#import "WebStorageManagerPrivate.h"
+#import <WebCore/PlatformString.h>
+#import <WebCore/SecurityOrigin.h>
+#import <wtf/MainThread.h>
+#import <wtf/RetainPtr.h>
+
+using namespace WebCore;
+
+WebStorageTrackerClient* WebStorageTrackerClient::sharedWebStorageTrackerClient()
+{
+    static WebStorageTrackerClient* sharedClient = new WebStorageTrackerClient();
+    return sharedClient;
+}
+
+WebStorageTrackerClient::WebStorageTrackerClient()
+{
+}
+
+WebStorageTrackerClient::~WebStorageTrackerClient()
+{
+}
+
+void WebStorageTrackerClient::dispatchDidModifyOriginOnMainThread(void* context)
+{
+    ASSERT(isMainThread());
+    // adoptRef is balanced by leakRef in dispatchDidModifyOrigin.
+    RefPtr<SecurityOrigin> origin = adoptRef(static_cast<SecurityOrigin*>(context));
+    WebStorageTrackerClient::sharedWebStorageTrackerClient()->dispatchDidModifyOrigin(origin.get());
+}
+
+void WebStorageTrackerClient::dispatchDidModifyOrigin(PassRefPtr<SecurityOrigin> origin)
+{
+    RetainPtr<WebSecurityOrigin> webSecurityOrigin(AdoptNS, [[WebSecurityOrigin alloc] _initWithWebCoreSecurityOrigin:origin.get()]);
+
+    [[NSNotificationCenter defaultCenter] postNotificationName:WebStorageDidModifyOriginNotification 
+                                                        object:webSecurityOrigin.get()];
+}
+
+void WebStorageTrackerClient::dispatchDidModifyOrigin(const String& originIdentifier)
+{
+    PassRefPtr<SecurityOrigin> origin = SecurityOrigin::createFromDatabaseIdentifier(originIdentifier);
+
+    if (!isMainThread()) {
+        // leakRef is balanced by adoptRef in dispatchDidModifyOriginOnMainThread.
+        callOnMainThread(dispatchDidModifyOriginOnMainThread, origin.leakRef());
+        return;
+    }
+
+    dispatchDidModifyOrigin(origin);
+}
+
+#endif
diff --git a/Source/WebKit/mac/WebCoreSupport/CorrectionPanel.h b/Source/WebKit/mac/WebCoreSupport/CorrectionPanel.h
new file mode 100644
index 0000000..8adb79f
--- /dev/null
+++ b/Source/WebKit/mac/WebCoreSupport/CorrectionPanel.h
@@ -0,0 +1,60 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef CorrectionPanel_h
+#define CorrectionPanel_h
+
+#if !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD) && !defined(BUILDING_ON_SNOW_LEOPARD)
+#import <AppKit/NSTextChecker.h>
+#import <WebCore/CorrectionPanelInfo.h>
+#import <wtf/RetainPtr.h>
+
+@class WebView;
+
+class CorrectionPanel {
+    WTF_MAKE_NONCOPYABLE(CorrectionPanel);
+public:
+    CorrectionPanel();
+    ~CorrectionPanel();
+    void show(WebView*, WebCore::CorrectionPanelInfo::PanelType, const WebCore::FloatRect& boundingBoxOfReplacedString, const String& replacedString, const String& replacementString, const Vector<String>& alternativeReplacementStrings);
+    void dismiss(WebCore::ReasonForDismissingCorrectionPanel);
+    String dismissSoon(WebCore::ReasonForDismissingCorrectionPanel);
+    static void recordAutocorrectionResponse(WebView*, NSCorrectionResponse, const String& replacedString, const String& replacementString);
+
+private:
+    bool isShowing() const { return m_view; }
+    void dismissInternal(WebCore::ReasonForDismissingCorrectionPanel, bool dismissingExternally);
+    void handleAcceptedReplacement(NSString* acceptedReplacement, NSString* replaced, NSString* proposedReplacement, NSCorrectionBubbleType);
+
+    bool m_wasDismissedExternally;
+    WebCore::ReasonForDismissingCorrectionPanel m_reasonForDismissing;
+    RetainPtr<WebView> m_view;
+    RetainPtr<NSString> m_resultForSynchronousDismissal;
+    RetainPtr<NSCondition> m_resultCondition;
+};
+
+#endif // !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD) && !defined(BUILDING_ON_SNOW_LEOPARD)
+
+#endif // CorrectionPanel_h
diff --git a/Source/WebKit/mac/WebCoreSupport/CorrectionPanel.mm b/Source/WebKit/mac/WebCoreSupport/CorrectionPanel.mm
new file mode 100644
index 0000000..05f3f69
--- /dev/null
+++ b/Source/WebKit/mac/WebCoreSupport/CorrectionPanel.mm
@@ -0,0 +1,157 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+#import "CorrectionPanel.h"
+
+#import "WebViewPrivate.h"
+
+#if !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD) && !defined(BUILDING_ON_SNOW_LEOPARD)
+using namespace WebCore;
+
+static inline NSCorrectionBubbleType correctionBubbleType(CorrectionPanelInfo::PanelType panelType)
+{
+    switch (panelType) {
+    case CorrectionPanelInfo::PanelTypeCorrection:
+        return NSCorrectionBubbleTypeCorrection;
+    case CorrectionPanelInfo::PanelTypeReversion:
+        return NSCorrectionBubbleTypeReversion;
+    case CorrectionPanelInfo::PanelTypeSpellingSuggestions:
+        return NSCorrectionBubbleTypeGuesses;
+    }
+    ASSERT_NOT_REACHED();
+    return NSCorrectionBubbleTypeCorrection;
+}
+
+CorrectionPanel::CorrectionPanel()
+    : m_wasDismissedExternally(false)
+    , m_reasonForDismissing(ReasonForDismissingCorrectionPanelIgnored)
+    , m_resultCondition(AdoptNS, [[NSCondition alloc] init])
+{
+}
+
+CorrectionPanel::~CorrectionPanel()
+{
+    dismissInternal(ReasonForDismissingCorrectionPanelIgnored, false);
+}
+
+void CorrectionPanel::show(WebView* view, CorrectionPanelInfo::PanelType type, const FloatRect& boundingBoxOfReplacedString, const String& replacedString, const String& replacementString, const Vector<String>& alternativeReplacementStrings)
+{
+    dismissInternal(ReasonForDismissingCorrectionPanelIgnored, false);
+    
+    if (!view)
+        return;
+
+    NSString* replacedStringAsNSString = replacedString;
+    NSString* replacementStringAsNSString = replacementString;
+    m_view = view;
+    NSCorrectionBubbleType bubbleType = correctionBubbleType(type);
+    
+    NSMutableArray* alternativeStrings = 0;
+    if (!alternativeReplacementStrings.isEmpty()) {
+        size_t size = alternativeReplacementStrings.size();
+        alternativeStrings = [NSMutableArray arrayWithCapacity:size];
+        for (size_t i = 0; i < size; ++i)
+            [alternativeStrings addObject:(NSString*)alternativeReplacementStrings[i]];
+    }
+
+    [[NSSpellChecker sharedSpellChecker] showCorrectionBubbleOfType:bubbleType primaryString:replacementStringAsNSString alternativeStrings:alternativeStrings forStringInRect:boundingBoxOfReplacedString view:m_view.get() completionHandler:^(NSString* acceptedString) {
+        handleAcceptedReplacement(acceptedString, replacedStringAsNSString, replacementStringAsNSString, bubbleType);
+    }];
+}
+
+void CorrectionPanel::dismiss(ReasonForDismissingCorrectionPanel reason)
+{
+    dismissInternal(reason, true);
+}
+
+String CorrectionPanel::dismissSoon(ReasonForDismissingCorrectionPanel reason)
+{
+    if (!isShowing())
+        return String();
+
+    dismissInternal(reason, true);
+    [m_resultCondition.get() lock];
+    while (!m_resultForSynchronousDismissal)
+        [m_resultCondition.get() wait];
+    [m_resultCondition.get() unlock];
+    return m_resultForSynchronousDismissal.get();
+}
+
+void CorrectionPanel::dismissInternal(ReasonForDismissingCorrectionPanel reason, bool dismissingExternally)
+{
+    m_wasDismissedExternally = dismissingExternally;
+    if (!isShowing())
+        return;
+    
+    m_reasonForDismissing = reason;
+    m_resultForSynchronousDismissal.clear();
+    [[NSSpellChecker sharedSpellChecker] dismissCorrectionBubbleForView:m_view.get()];
+    m_view.clear();
+}
+
+void CorrectionPanel::recordAutocorrectionResponse(WebView* view, NSCorrectionResponse response, const String& replacedString, const String& replacementString)
+{
+    [[NSSpellChecker sharedSpellChecker] recordResponse:response toCorrection:replacementString forWord:replacedString language:nil inSpellDocumentWithTag:[view spellCheckerDocumentTag]];
+}
+
+void CorrectionPanel::handleAcceptedReplacement(NSString* acceptedReplacement, NSString* replaced, NSString* proposedReplacement,  NSCorrectionBubbleType correctionBubbleType)
+{
+    NSSpellChecker* spellChecker = [NSSpellChecker sharedSpellChecker];
+    NSInteger documentTag = [m_view.get() spellCheckerDocumentTag];
+
+    switch (correctionBubbleType) {
+    case NSCorrectionBubbleTypeCorrection:
+        if (acceptedReplacement)
+            [spellChecker recordResponse:NSCorrectionResponseAccepted toCorrection:acceptedReplacement forWord:replaced language:nil inSpellDocumentWithTag:documentTag];
+        else {
+            if (!m_wasDismissedExternally || m_reasonForDismissing == ReasonForDismissingCorrectionPanelCancelled)
+                [spellChecker recordResponse:NSCorrectionResponseRejected toCorrection:proposedReplacement forWord:replaced language:nil inSpellDocumentWithTag:documentTag];
+            else
+                [spellChecker recordResponse:NSCorrectionResponseIgnored toCorrection:proposedReplacement forWord:replaced language:nil inSpellDocumentWithTag:documentTag];
+        }
+        break;
+    case NSCorrectionBubbleTypeReversion:
+        if (acceptedReplacement)
+            [spellChecker recordResponse:NSCorrectionResponseReverted toCorrection:replaced forWord:acceptedReplacement language:nil inSpellDocumentWithTag:documentTag];
+        break;
+    case NSCorrectionBubbleTypeGuesses:
+        if (acceptedReplacement)
+            [spellChecker recordResponse:NSCorrectionResponseAccepted toCorrection:acceptedReplacement forWord:replaced language:nil inSpellDocumentWithTag:documentTag];
+        break;
+    }
+    
+    if (!m_wasDismissedExternally) {
+        [m_view.get() handleCorrectionPanelResult:acceptedReplacement];
+        return;
+    }
+    
+    [m_resultCondition.get() lock];
+    if (acceptedReplacement)
+        m_resultForSynchronousDismissal.adoptNS([acceptedReplacement copy]);
+    [m_resultCondition.get() signal];
+    [m_resultCondition.get() unlock];
+}
+
+#endif // !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD) && !defined(BUILDING_ON_SNOW_LEOPARD)
+
diff --git a/Source/WebKit/mac/WebCoreSupport/WebApplicationCache.h b/Source/WebKit/mac/WebCoreSupport/WebApplicationCache.h
index 976ce18..3d6c91e 100644
--- a/Source/WebKit/mac/WebCoreSupport/WebApplicationCache.h
+++ b/Source/WebKit/mac/WebCoreSupport/WebApplicationCache.h
@@ -25,6 +25,8 @@
 
 #import <Foundation/Foundation.h>
 
+@class WebSecurityOrigin;
+
 @interface WebApplicationCache: NSObject
 
 + (long long)maximumSize;
@@ -34,5 +36,8 @@
 + (void)setDefaultOriginQuota:(long long)size;
 
 + (void)deleteAllApplicationCaches;
++ (void)deleteCacheForOrigin:(WebSecurityOrigin *)origin;
+
++ (NSArray *)originsWithCache;
 
 @end
diff --git a/Source/WebKit/mac/WebCoreSupport/WebApplicationCache.mm b/Source/WebKit/mac/WebCoreSupport/WebApplicationCache.mm
index bf517c1..131bb9c 100644
--- a/Source/WebKit/mac/WebCoreSupport/WebApplicationCache.mm
+++ b/Source/WebKit/mac/WebCoreSupport/WebApplicationCache.mm
@@ -26,7 +26,12 @@
 #if ENABLE(OFFLINE_WEB_APPLICATIONS)
 
 #import "WebApplicationCache.h"
+
+#import "WebSecurityOriginInternal.h"
+#import <WebCore/ApplicationCache.h>
 #import <WebCore/ApplicationCacheStorage.h>
+#import <WebCore/SecurityOrigin.h>
+#import <wtf/RetainPtr.h>
 
 using namespace WebCore;
 
@@ -58,6 +63,27 @@ using namespace WebCore;
     cacheStorage().deleteAllEntries();
 }
 
++ (void)deleteCacheForOrigin:(WebSecurityOrigin *)origin
+{
+    ApplicationCache::deleteCacheForOrigin([origin _core]);
+}
+
++ (NSArray *)originsWithCache
+{
+    HashSet<RefPtr<SecurityOrigin>, SecurityOriginHash> coreOrigins;
+    cacheStorage().getOriginsWithCache(coreOrigins);
+    
+    NSMutableArray *webOrigins = [[[NSMutableArray alloc] initWithCapacity:coreOrigins.size()] autorelease];
+    
+    HashSet<RefPtr<SecurityOrigin>, SecurityOriginHash>::const_iterator end = coreOrigins.end();
+    for (HashSet<RefPtr<SecurityOrigin>, SecurityOriginHash>::const_iterator it = coreOrigins.begin(); it != end; ++it) {
+        RetainPtr<WebSecurityOrigin> webOrigin(AdoptNS, [[WebSecurityOrigin alloc] _initWithWebCoreSecurityOrigin:(*it).get()]);
+        [webOrigins addObject:webOrigin.get()];
+    }
+    
+    return webOrigins;
+}
+
 @end
 
 #endif
diff --git a/Source/WebKit/mac/WebCoreSupport/WebChromeClient.h b/Source/WebKit/mac/WebCoreSupport/WebChromeClient.h
index 3129fae..004d49b 100644
--- a/Source/WebKit/mac/WebCoreSupport/WebChromeClient.h
+++ b/Source/WebKit/mac/WebCoreSupport/WebChromeClient.h
@@ -164,7 +164,7 @@ public:
 #endif
     
 #if ENABLE(FULLSCREEN_API)
-    virtual bool supportsFullScreenForElement(const WebCore::Element*);
+    virtual bool supportsFullScreenForElement(const WebCore::Element*, bool withKeyboard);
     virtual void enterFullScreenForElement(WebCore::Element*);
     virtual void exitFullScreenForElement(WebCore::Element*);
 #endif
@@ -180,7 +180,7 @@ public:
     virtual PassRefPtr<WebCore::SearchPopupMenu> createSearchPopupMenu(WebCore::PopupMenuClient*) const;
 
 #if ENABLE(CONTEXT_MENUS)
-    virtual void showContextMenu() { }
+    virtual void showContextMenu();
 #endif
 private:
     WebView *m_webView;
diff --git a/Source/WebKit/mac/WebCoreSupport/WebChromeClient.mm b/Source/WebKit/mac/WebCoreSupport/WebChromeClient.mm
index 99b817b..6bf116b 100644
--- a/Source/WebKit/mac/WebCoreSupport/WebChromeClient.mm
+++ b/Source/WebKit/mac/WebCoreSupport/WebChromeClient.mm
@@ -51,14 +51,18 @@
 #import <WebCore/BlockExceptions.h>
 #import <WebCore/Console.h>
 #import <WebCore/Cursor.h>
+#import <WebCore/ContextMenu.h>
+#import <WebCore/ContextMenuController.h>
 #import <WebCore/Element.h>
 #import <WebCore/FileChooser.h>
 #import <WebCore/FloatRect.h>
 #import <WebCore/Frame.h>
 #import <WebCore/FrameLoadRequest.h>
+#import <WebCore/FrameView.h>
 #import <WebCore/HTMLNames.h>
 #import <WebCore/HitTestResult.h>
 #import <WebCore/Icon.h>
+#import <WebCore/IntPoint.h>
 #import <WebCore/IntRect.h>
 #import <WebCore/NavigationAction.h>
 #import <WebCore/Page.h>
@@ -174,9 +178,16 @@ FloatRect WebChromeClient::pageRect()
 
 float WebChromeClient::scaleFactor()
 {
-    if (NSWindow *window = [m_webView window])
-        return [window  userSpaceScaleFactor];
+    NSWindow *window = [m_webView window];
+#if !defined(BUILDING_ON_LEOPARD) && !defined(BUILDING_ON_SNOW_LEOPARD)
+    if (window)
+        return [window backingScaleFactor];
+    return [[NSScreen mainScreen] backingScaleFactor];
+#else
+    if (window)
+        return [window userSpaceScaleFactor];
     return [[NSScreen mainScreen] userSpaceScaleFactor];
+#endif
 }
 
 void WebChromeClient::focus()
@@ -876,6 +887,35 @@ PassRefPtr<WebCore::SearchPopupMenu> WebChromeClient::createSearchPopupMenu(WebC
     return adoptRef(new SearchPopupMenuMac(client));
 }
 
+#if ENABLE(CONTEXT_MENUS)
+void WebChromeClient::showContextMenu()
+{
+    Page* page = [m_webView page];
+    if (!page)
+        return;
+
+    ContextMenuController* controller = page->contextMenuController();
+    Node* node = controller->hitTestResult().innerNonSharedNode();
+    if (!node)
+        return;
+    Frame* frame = node->document()->frame();
+    if (!frame)
+        return;
+    FrameView* frameView = frame->view();
+    if (!frameView)
+        return;
+    NSView* view = frameView->documentView();
+    
+    IntPoint point = frameView->contentsToWindow(controller->hitTestResult().point());
+    NSPoint nsScreenPoint = [view convertPoint:point toView:nil];
+    // Show the contextual menu for this event.
+    NSEvent* event = [NSEvent mouseEventWithType:NSRightMouseDown location:nsScreenPoint modifierFlags:0 timestamp:0 windowNumber:[[view window] windowNumber] context:0 eventNumber:0 clickCount:1 pressure:1];
+    NSMenu* nsMenu = [view menuForEvent:event];
+    if (nsMenu)
+        [NSMenu popUpContextMenu:nsMenu withEvent:event forView:view];    
+}
+#endif
+
 #if USE(ACCELERATED_COMPOSITING)
 
 void WebChromeClient::attachRootGraphicsLayer(Frame* frame, GraphicsLayer* graphicsLayer)
@@ -938,12 +978,12 @@ void WebChromeClient::exitFullscreenForNode(Node*)
 
 #if ENABLE(FULLSCREEN_API)
 
-bool WebChromeClient::supportsFullScreenForElement(const Element* element)
+bool WebChromeClient::supportsFullScreenForElement(const Element* element, bool withKeyboard)
 {
-    SEL selector = @selector(webView:supportsFullScreenForElement:);
+    SEL selector = @selector(webView:supportsFullScreenForElement:withKeyboard:);
     if ([[m_webView UIDelegate] respondsToSelector:selector])
-        return CallUIDelegateReturningBoolean(false, m_webView, selector, kit(const_cast<WebCore::Element*>(element)));
-    return [m_webView _supportsFullScreenForElement:const_cast<WebCore::Element*>(element)];
+        return CallUIDelegateReturningBoolean(false, m_webView, selector, kit(const_cast<WebCore::Element*>(element)), withKeyboard);
+    return [m_webView _supportsFullScreenForElement:const_cast<WebCore::Element*>(element) withKeyboard:withKeyboard];
 }
 
 void WebChromeClient::enterFullScreenForElement(Element* element)
diff --git a/Source/WebKit/mac/WebCoreSupport/WebEditorClient.h b/Source/WebKit/mac/WebCoreSupport/WebEditorClient.h
index 1fa132a..412cb45 100644
--- a/Source/WebKit/mac/WebCoreSupport/WebEditorClient.h
+++ b/Source/WebKit/mac/WebCoreSupport/WebEditorClient.h
@@ -27,11 +27,11 @@
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#import <WebCore/Editor.h>
+#import "CorrectionPanel.h"
 #import <WebCore/EditorClient.h>
 #import <WebCore/TextCheckerClient.h>
-#import <wtf/RetainPtr.h>
 #import <wtf/Forward.h>
+#import <wtf/RetainPtr.h>
 #import <wtf/Vector.h>
 
 @class WebView;
@@ -140,10 +140,10 @@ public:
     virtual void setInputMethodState(bool enabled);
     virtual void requestCheckingOfString(WebCore::SpellChecker*, int, const WTF::String&);
 #if !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD) && !defined(BUILDING_ON_SNOW_LEOPARD)
-    virtual void showCorrectionPanel(WebCore::CorrectionPanelInfo::PanelType, const WebCore::FloatRect& boundingBoxOfReplacedString, const WTF::String& replacedString, const WTF::String& replacementString, const WTF::Vector<WTF::String>& alternativeReplacementStrings, WebCore::Editor*);
+    virtual void showCorrectionPanel(WebCore::CorrectionPanelInfo::PanelType, const WebCore::FloatRect& boundingBoxOfReplacedString, const String& replacedString, const String& replacementString, const Vector<String>& alternativeReplacementStrings);
     virtual void dismissCorrectionPanel(WebCore::ReasonForDismissingCorrectionPanel);
-    virtual bool isShowingCorrectionPanel();
-    virtual void recordAutocorrectionResponse(AutocorrectionResponseType, const WTF::String& replacedString, const WTF::String& replacementString);
+    virtual String dismissCorrectionPanelSoon(WebCore::ReasonForDismissingCorrectionPanel);
+    virtual void recordAutocorrectionResponse(AutocorrectionResponseType, const String& replacedString, const String& replacementString);
 #endif
 private:
     void registerCommandForUndoOrRedo(PassRefPtr<WebCore::EditCommand>, bool isRedo);
@@ -154,8 +154,6 @@ private:
     bool m_haveUndoRedoOperations;
 
 #if !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD) && !defined(BUILDING_ON_SNOW_LEOPARD)
-    BOOL m_correctionPanelIsShown;
-    BOOL m_correctionPanelIsDismissedExternally;
-    WebCore::ReasonForDismissingCorrectionPanel m_reasonForDismissingCorrectionPanel;
+    CorrectionPanel m_correctionPanel;
 #endif
 };
diff --git a/Source/WebKit/mac/WebCoreSupport/WebEditorClient.mm b/Source/WebKit/mac/WebCoreSupport/WebEditorClient.mm
index 69dd574..c205ef6 100644
--- a/Source/WebKit/mac/WebCoreSupport/WebEditorClient.mm
+++ b/Source/WebKit/mac/WebCoreSupport/WebEditorClient.mm
@@ -74,7 +74,6 @@
 #endif
 
 using namespace WebCore;
-using namespace WTF;
 
 using namespace HTMLNames;
 
@@ -202,9 +201,6 @@ WebEditorClient::WebEditorClient(WebView *webView)
     : m_webView(webView)
     , m_undoTarget([[[WebEditorUndoTarget alloc] init] autorelease])
     , m_haveUndoRedoOperations(false)
-#if !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD) && !defined(BUILDING_ON_SNOW_LEOPARD)
-    , m_correctionPanelIsShown(false)
-#endif
 {
 }
 
@@ -625,7 +621,7 @@ void WebEditorClient::handleKeyboardEvent(KeyboardEvent* event)
 {
     Frame* frame = event->target()->toNode()->document()->frame();
     WebHTMLView *webHTMLView = [[kit(frame) frameView] documentView];
-    if ([webHTMLView _interceptEditingKeyEvent:event shouldSaveCommand:NO])
+    if ([webHTMLView _interpretKeyEvent:event savingCommands:NO])
         event->setDefaultHandled();
 }
 
@@ -633,7 +629,7 @@ void WebEditorClient::handleInputMethodKeydown(KeyboardEvent* event)
 {
     Frame* frame = event->target()->toNode()->document()->frame();
     WebHTMLView *webHTMLView = [[kit(frame) frameView] documentView];
-    if ([webHTMLView _interceptEditingKeyEvent:event shouldSaveCommand:YES])
+    if ([webHTMLView _interpretKeyEvent:event savingCommands:YES])
         event->setDefaultHandled();
 }
 
@@ -891,73 +887,25 @@ void WebEditorClient::updateSpellingUIWithGrammarString(const String& badGrammar
 }
 
 #if !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD) && !defined(BUILDING_ON_SNOW_LEOPARD)
-void WebEditorClient::showCorrectionPanel(WebCore::CorrectionPanelInfo::PanelType panelType, const FloatRect& boundingBoxOfReplacedString, const String& replacedString, const String& replacementString, const Vector<String>& alternativeReplacementStrings, Editor* editor) {
-    dismissCorrectionPanel(ReasonForDismissingCorrectionPanelIgnored);
-
-    // Need to explicitly use these local NSString objects, because the C++ references may be invalidated by the time the block below is executed.
-    NSString *replacedStringAsNSString = replacedString;
-    NSString *replacementStringAsNSString = replacementString;
-
-    m_correctionPanelIsShown = YES;
-    m_correctionPanelIsDismissedExternally = NO;
-    m_reasonForDismissingCorrectionPanel = ReasonForDismissingCorrectionPanelIgnored;
-
-    NSCorrectionBubbleType bubbleType = correctionBubbleType(panelType);
-    NSMutableArray *alternativeStrings = nil;
-    if (!alternativeReplacementStrings.isEmpty()) {
-        size_t size = alternativeReplacementStrings.size();
-        alternativeStrings = [NSMutableArray arrayWithCapacity:size];
-        for (size_t i = 0; i < size; ++i)
-            [alternativeStrings addObject:(NSString*)alternativeReplacementStrings[i]];
-    }
-    NSSpellChecker *spellChecker = [NSSpellChecker sharedSpellChecker];
-    [[NSSpellChecker sharedSpellChecker] showCorrectionBubbleOfType:bubbleType primaryString:replacementStringAsNSString alternativeStrings:alternativeStrings forStringInRect:boundingBoxOfReplacedString view:m_webView completionHandler:^(NSString *acceptedString) {
-        switch (bubbleType) {
-        case NSCorrectionBubbleTypeCorrection:
-            if (acceptedString)
-                [spellChecker recordResponse:NSCorrectionResponseAccepted toCorrection:acceptedString forWord:replacedStringAsNSString language:nil inSpellDocumentWithTag:spellCheckerDocumentTag()];
-            else {
-                if (!m_correctionPanelIsDismissedExternally || m_reasonForDismissingCorrectionPanel == ReasonForDismissingCorrectionPanelCancelled)
-                    [spellChecker recordResponse:NSCorrectionResponseRejected toCorrection:replacementStringAsNSString forWord:replacedStringAsNSString language:nil inSpellDocumentWithTag:spellCheckerDocumentTag()];
-                else
-                    [spellChecker recordResponse:NSCorrectionResponseIgnored toCorrection:replacementStringAsNSString forWord:replacedStringAsNSString language:nil inSpellDocumentWithTag:spellCheckerDocumentTag()];
-            }
-            break;
-        case NSCorrectionBubbleTypeReversion:
-            if (acceptedString)
-                [spellChecker recordResponse:NSCorrectionResponseReverted toCorrection:replacedStringAsNSString forWord:acceptedString language:nil inSpellDocumentWithTag:spellCheckerDocumentTag()];
-            break;
-        case NSCorrectionBubbleTypeGuesses:
-            if (acceptedString)
-                [[NSSpellChecker sharedSpellChecker] recordResponse:NSCorrectionResponseAccepted toCorrection:acceptedString forWord:replacedStringAsNSString language:nil inSpellDocumentWithTag:[m_webView spellCheckerDocumentTag]];
-            break;
-        }
-        editor->handleCorrectionPanelResult(String(acceptedString));
-    }];
+void WebEditorClient::showCorrectionPanel(CorrectionPanelInfo::PanelType panelType, const FloatRect& boundingBoxOfReplacedString, const String& replacedString, const String& replacementString, const Vector<String>& alternativeReplacementStrings)
+{
+    m_correctionPanel.show(m_webView, panelType, boundingBoxOfReplacedString, replacedString, replacementString, alternativeReplacementStrings);
 }
 
 void WebEditorClient::dismissCorrectionPanel(ReasonForDismissingCorrectionPanel reasonForDismissing)
 {
-    if (isShowingCorrectionPanel()) {
-        m_correctionPanelIsDismissedExternally = YES;
-        m_reasonForDismissingCorrectionPanel = reasonForDismissing;
-        if (reasonForDismissing == ReasonForDismissingCorrectionPanelAccepted)
-            [[NSSpellChecker sharedSpellChecker] dismissCorrectionBubbleForView:m_webView];
-        else
-            [[NSSpellChecker sharedSpellChecker] cancelCorrectionBubbleForView:m_webView];
-        m_correctionPanelIsShown = NO;
-    }
+    m_correctionPanel.dismiss(reasonForDismissing);
 }
 
-bool WebEditorClient::isShowingCorrectionPanel()
+String WebEditorClient::dismissCorrectionPanelSoon(ReasonForDismissingCorrectionPanel reasonForDismissing)
 {
-    return m_correctionPanelIsShown;
+    return m_correctionPanel.dismissSoon(reasonForDismissing);
 }
 
 void WebEditorClient::recordAutocorrectionResponse(EditorClient::AutocorrectionResponseType responseType, const String& replacedString, const String& replacementString)
 {
-    NSCorrectionResponse spellCheckerResponse = responseType == EditorClient::AutocorrectionReverted ? NSCorrectionResponseReverted : NSCorrectionResponseEdited;
-    [[NSSpellChecker sharedSpellChecker] recordResponse:spellCheckerResponse toCorrection:replacementString forWord:replacedString language:nil inSpellDocumentWithTag:[m_webView spellCheckerDocumentTag]];
+    NSCorrectionResponse response = responseType == EditorClient::AutocorrectionReverted ? NSCorrectionResponseReverted : NSCorrectionResponseEdited;
+    CorrectionPanel::recordAutocorrectionResponse(m_webView, response, replacedString, replacementString);
 }
 #endif
 
diff --git a/Source/WebKit/mac/WebCoreSupport/WebFrameLoaderClient.h b/Source/WebKit/mac/WebCoreSupport/WebFrameLoaderClient.h
index c484729..4fe5664 100644
--- a/Source/WebKit/mac/WebCoreSupport/WebFrameLoaderClient.h
+++ b/Source/WebKit/mac/WebCoreSupport/WebFrameLoaderClient.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2006, 2007, 2008, 2011 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -216,7 +216,7 @@ private:
     virtual void showMediaPlayerProxyPlugin(WebCore::Widget*);
 #endif
     
-    virtual WebCore::ObjectContentType objectContentType(const WebCore::KURL& url, const WTF::String& mimeType);
+    virtual WebCore::ObjectContentType objectContentType(const WebCore::KURL&, const WTF::String& mimeType, bool shouldPreferPlugInsForImages);
     virtual WTF::String overrideMediaType() const;
     
     virtual void dispatchDidClearWindowObjectInWorld(WebCore::DOMWrapperWorld*);
diff --git a/Source/WebKit/mac/WebCoreSupport/WebFrameLoaderClient.mm b/Source/WebKit/mac/WebCoreSupport/WebFrameLoaderClient.mm
index a558d83..92c2b03 100644
--- a/Source/WebKit/mac/WebCoreSupport/WebFrameLoaderClient.mm
+++ b/Source/WebKit/mac/WebCoreSupport/WebFrameLoaderClient.mm
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2006, 2007, 2008, 2009, 2011 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -1454,7 +1454,7 @@ void WebFrameLoaderClient::transferLoadingResourceFromPage(unsigned long identif
     [kit(oldPage) _removeObjectForIdentifier:identifier];
 }
 
-ObjectContentType WebFrameLoaderClient::objectContentType(const KURL& url, const String& mimeType)
+ObjectContentType WebFrameLoaderClient::objectContentType(const KURL& url, const String& mimeType, bool shouldPreferPlugInsForImages)
 {
     BEGIN_BLOCK_OBJC_EXCEPTIONS;
 
@@ -1491,18 +1491,25 @@ ObjectContentType WebFrameLoaderClient::objectContentType(const KURL& url, const
     if (type.isEmpty())
         return ObjectContentFrame; // Go ahead and hope that we can display the content.
 
-    if (MIMETypeRegistry::isSupportedImageMIMEType(type))
-        return ObjectContentImage;
-
     WebBasePluginPackage *package = [getWebView(m_webFrame.get()) _pluginForMIMEType:type];
+    ObjectContentType plugInType = ObjectContentNone;
     if (package) {
 #if ENABLE(NETSCAPE_PLUGIN_API)
         if ([package isKindOfClass:[WebNetscapePluginPackage class]])
-            return ObjectContentNetscapePlugin;
+            plugInType = ObjectContentNetscapePlugin;
+        else
 #endif
-        ASSERT([package isKindOfClass:[WebPluginPackage class]]);
-        return ObjectContentOtherPlugin;
+        {
+            ASSERT([package isKindOfClass:[WebPluginPackage class]]);
+            plugInType = ObjectContentOtherPlugin;
+        }
     }
+    
+    if (MIMETypeRegistry::isSupportedImageMIMEType(type))
+        return shouldPreferPlugInsForImages && plugInType != ObjectContentNone ? plugInType : ObjectContentImage;
+
+    if (plugInType != ObjectContentNone)
+        return plugInType;
 
     if ([m_webFrame->_private->webFrameView _viewClassForMIMEType:type])
         return ObjectContentFrame;
diff --git a/Source/WebKit/mac/WebCoreSupport/WebIconDatabaseClient.h b/Source/WebKit/mac/WebCoreSupport/WebIconDatabaseClient.h
index 3f9df13..a557ab5 100644
--- a/Source/WebKit/mac/WebCoreSupport/WebIconDatabaseClient.h
+++ b/Source/WebKit/mac/WebCoreSupport/WebIconDatabaseClient.h
@@ -32,6 +32,9 @@
 class WebIconDatabaseClient : public WebCore::IconDatabaseClient {
 public:
     virtual bool performImport();
-    virtual void dispatchDidRemoveAllIcons();
-    virtual void dispatchDidAddIconForPageURL(const WTF::String& pageURL);
+    virtual void didRemoveAllIcons();
+    virtual void didImportIconURLForPageURL(const String&);
+    virtual void didImportIconDataForPageURL(const String&);
+    virtual void didChangeIconForPageURL(const String&);
+    virtual void didFinishURLImport();
 };
diff --git a/Source/WebKit/mac/WebCoreSupport/WebIconDatabaseClient.mm b/Source/WebKit/mac/WebCoreSupport/WebIconDatabaseClient.mm
index 3651dea..8214d02 100644
--- a/Source/WebKit/mac/WebCoreSupport/WebIconDatabaseClient.mm
+++ b/Source/WebKit/mac/WebCoreSupport/WebIconDatabaseClient.mm
@@ -41,14 +41,14 @@ bool WebIconDatabaseClient::performImport()
     return result;
 }
 
-void WebIconDatabaseClient::dispatchDidRemoveAllIcons()
+void WebIconDatabaseClient::didRemoveAllIcons()
 {
     NSAutoreleasePool *pool = [[NSAutoreleasePool alloc] init];
     [[WebIconDatabase sharedIconDatabase] _sendDidRemoveAllIconsNotification];
     [pool drain];
 }
 
-void WebIconDatabaseClient::dispatchDidAddIconForPageURL(const WTF::String& pageURL)
+void WebIconDatabaseClient::didImportIconURLForPageURL(const String& pageURL)
 {
     // This is a quick notification that is likely to fire in a rapidly iterating loop
     // Therefore we let WebCore handle autorelease by draining its pool "from time to time"
@@ -56,4 +56,19 @@ void WebIconDatabaseClient::dispatchDidAddIconForPageURL(const WTF::String& page
     [[WebIconDatabase sharedIconDatabase] _sendNotificationForURL:pageURL];
 }
 
+void WebIconDatabaseClient::didImportIconDataForPageURL(const String& pageURL)
+{
+    // WebKit1 only has a single "icon did change" notification.
+    didImportIconURLForPageURL(pageURL);
+}
+void WebIconDatabaseClient::didChangeIconForPageURL(const String& pageURL)
+{
+    // WebKit1 only has a single "icon did change" notification.
+    didImportIconURLForPageURL(pageURL);
+}
+
+void WebIconDatabaseClient::didFinishURLImport()
+{
+}
+
 #endif // ENABLE(ICONDATABASE)
diff --git a/Source/WebKit/mac/WebCoreSupport/WebInspectorClient.h b/Source/WebKit/mac/WebCoreSupport/WebInspectorClient.h
index 108c2cc..7d09109 100644
--- a/Source/WebKit/mac/WebCoreSupport/WebInspectorClient.h
+++ b/Source/WebKit/mac/WebCoreSupport/WebInspectorClient.h
@@ -31,7 +31,9 @@
 #import <WebCore/PlatformString.h>
 
 #import <wtf/Forward.h>
+#import <wtf/HashMap.h>
 #import <wtf/RetainPtr.h>
+#import <wtf/text/StringHash.h>
 
 #ifdef __OBJC__
 @class WebInspectorWindowController;
@@ -67,12 +69,17 @@ public:
 
     void releaseFrontendPage();
 
+    void saveSessionSetting(const String& key, const String& value);
+    void loadSessionSetting(const String& key, String* value);
+
 private:
     WTF::PassOwnPtr<WebCore::InspectorFrontendClientLocal::Settings> createFrontendSettings();
 
     WebView *m_webView;
     RetainPtr<WebNodeHighlighter> m_highlighter;
     WebCore::Page* m_frontendPage;
+
+    WTF::HashMap<WTF::String, WTF::String> m_sessionSettings;
 };
 
 
@@ -95,6 +102,9 @@ public:
     virtual void setAttachedWindowHeight(unsigned height);
     virtual void inspectedURLChanged(const WTF::String& newURL);
 
+    virtual void saveSessionSetting(const String& key, const String& value);
+    virtual void loadSessionSetting(const String& key, String* value);
+
 private:
     void updateWindowTitle() const;
 
diff --git a/Source/WebKit/mac/WebCoreSupport/WebInspectorClient.mm b/Source/WebKit/mac/WebCoreSupport/WebInspectorClient.mm
index d5a1d95..9b0c893 100644
--- a/Source/WebKit/mac/WebCoreSupport/WebInspectorClient.mm
+++ b/Source/WebKit/mac/WebCoreSupport/WebInspectorClient.mm
@@ -65,6 +65,7 @@ using namespace WebCore;
 - (BOOL)attached;
 - (void)setFrontendClient:(WebInspectorFrontendClient*)frontendClient;
 - (void)setInspectorClient:(WebInspectorClient*)inspectorClient;
+- (WebInspectorClient*)inspectorClient;
 - (void)setAttachedWindowHeight:(unsigned)height;
 - (void)destroyInspectorView:(bool)notifyInspectorController;
 @end
@@ -102,10 +103,10 @@ void WebInspectorClient::openInspectorFrontend(InspectorController* inspectorCon
     [windowController.get() setInspectorClient:this];
 
     m_frontendPage = core([windowController.get() webView]);
-    WebInspectorFrontendClient* frontendClient = new WebInspectorFrontendClient(m_webView, windowController.get(), inspectorController, m_frontendPage, createFrontendSettings());
-    m_frontendPage->inspectorController()->setInspectorFrontendClient(frontendClient);
-
-    [[m_webView inspector] setFrontend:[[WebInspectorFrontend alloc] initWithFrontendClient:frontendClient]];
+    OwnPtr<WebInspectorFrontendClient> frontendClient = adoptPtr(new WebInspectorFrontendClient(m_webView, windowController.get(), inspectorController, m_frontendPage, createFrontendSettings()));
+    RetainPtr<WebInspectorFrontend> webInspectorFrontend(AdoptNS, [[WebInspectorFrontend alloc] initWithFrontendClient:frontendClient.get()]);
+    [[m_webView inspector] setFrontend:webInspectorFrontend.get()];
+    m_frontendPage->inspectorController()->setInspectorFrontendClient(frontendClient.release());
 }
 
 void WebInspectorClient::highlight(Node* node)
@@ -201,6 +202,20 @@ void WebInspectorFrontendClient::inspectedURLChanged(const String& newURL)
     updateWindowTitle();
 }
 
+void WebInspectorFrontendClient::saveSessionSetting(const String& key, const String& value)
+{
+    WebInspectorClient* client = [m_windowController.get() inspectorClient];
+    if (client)
+        client->saveSessionSetting(key, value);
+}
+
+void WebInspectorFrontendClient::loadSessionSetting(const String& key, String* value)
+{
+    WebInspectorClient* client = [m_windowController.get() inspectorClient];
+    if (client)
+        client->loadSessionSetting(key, value);
+}
+
 void WebInspectorFrontendClient::updateWindowTitle() const
 {
     NSString *title = [NSString stringWithFormat:UI_STRING_INTERNAL("Web Inspector — %@", "Web Inspector window title"), (NSString *)m_inspectedURL];
@@ -422,6 +437,11 @@ void WebInspectorFrontendClient::updateWindowTitle() const
     _inspectorClient = inspectorClient;
 }
 
+- (WebInspectorClient*)inspectorClient
+{
+    return _inspectorClient;
+}
+
 - (void)setAttachedWindowHeight:(unsigned)height
 {
     if (!_attachedToInspectedWebView)
diff --git a/Source/WebKit/mac/WebCoreSupport/WebKeyGenerator.h b/Source/WebKit/mac/WebCoreSupport/WebKeyGenerator.h
index ed2ff77..7728699 100644
--- a/Source/WebKit/mac/WebCoreSupport/WebKeyGenerator.h
+++ b/Source/WebKit/mac/WebCoreSupport/WebKeyGenerator.h
@@ -1,29 +1,26 @@
 /*
- * Copyright (C) 2005 Apple Computer, Inc.  All rights reserved.
+ * Copyright (C) 2005, 2011 Apple Inc.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
  *
- * 1.  Redistributions of source code must retain the above copyright
- *     notice, this list of conditions and the following disclaimer. 
- * 2.  Redistributions in binary form must reproduce the above copyright
- *     notice, this list of conditions and the following disclaimer in the
- *     documentation and/or other materials provided with the distribution. 
- * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
- *     its contributors may be used to endorse or promote products derived
- *     from this software without specific prior written permission. 
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
- * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
- * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
- * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
- * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
- * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 typedef enum {
@@ -34,14 +31,11 @@ typedef enum {
 
 #ifdef __OBJC__
 
-#import <WebCore/WebCoreKeyGenerator.h>
+@interface WebKeyGenerator : NSObject
 
-@interface WebKeyGenerator : WebCoreKeyGenerator
-{
-    NSArray *strengthMenuItemTitles;
-}
-+ (void)createSharedGenerator;
++ (WebKeyGenerator *)sharedGenerator;
 - (WebCertificateParseResult)addCertificatesToKeychainFromData:(NSData *)data;
+
 @end
 
 #endif
diff --git a/Source/WebKit/mac/WebCoreSupport/WebKeyGenerator.m b/Source/WebKit/mac/WebCoreSupport/WebKeyGenerator.m
deleted file mode 100644
index ea1526f..0000000
--- a/Source/WebKit/mac/WebCoreSupport/WebKeyGenerator.m
+++ /dev/null
@@ -1,104 +0,0 @@
-/*
- * Copyright (C) 2005 Apple Computer, Inc.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1.  Redistributions of source code must retain the above copyright
- *     notice, this list of conditions and the following disclaimer. 
- * 2.  Redistributions in binary form must reproduce the above copyright
- *     notice, this list of conditions and the following disclaimer in the
- *     documentation and/or other materials provided with the distribution. 
- * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
- *     its contributors may be used to endorse or promote products derived
- *     from this software without specific prior written permission. 
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
- * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
- * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
- * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
- * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
- * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#import <WebKit/WebKeyGenerator.h>
-
-#import "WebLocalizableStringsInternal.h"
-#import <WebKitSystemInterface.h>
-#import <wtf/Assertions.h>
-
-@implementation WebKeyGenerator
-
-+ (void)createSharedGenerator
-{
-    if (![self sharedGenerator]) {
-        [[[self alloc] init] release];
-    }
-    ASSERT([[self sharedGenerator] isKindOfClass:self]);
-}
-
-- (void)dealloc
-{
-    [strengthMenuItemTitles release];
-    [super dealloc];
-}
-
-- (NSArray *)strengthMenuItemTitles
-{
-    if (!strengthMenuItemTitles) {
-        strengthMenuItemTitles = [[NSArray alloc] initWithObjects:
-            UI_STRING_INTERNAL("2048 (High Grade)", "Menu item title for KEYGEN pop-up menu"),
-            UI_STRING_INTERNAL("1024 (Medium Grade)", "Menu item title for KEYGEN pop-up menu"),
-            UI_STRING_INTERNAL("512 (Low Grade)", "Menu item title for KEYGEN pop-up menu"), nil];
-    }
-    return strengthMenuItemTitles;
-}
-
-- (NSString *)signedPublicKeyAndChallengeStringWithStrengthIndex:(unsigned)index challenge:(NSString *)challenge pageURL:(NSURL *)pageURL
-{    
-    // This switch statement must always be synced with the UI strings returned by strengthMenuItemTitles.
-    UInt32 keySize;
-    switch (index) {
-        case 0:
-            keySize = 2048;
-            break;
-        case 1:
-            keySize = 1024;
-            break;
-        case 2:
-            keySize = 512;
-            break;
-        default:
-            return nil;
-    }
-    
-    NSString *keyDescription = [NSString stringWithFormat:UI_STRING_INTERNAL("Key from %@", "name of keychain key generated by the KEYGEN tag"), [pageURL host]];
-    return [(NSString *)WKSignedPublicKeyAndChallengeString(keySize, (CFStringRef)challenge, (CFStringRef)keyDescription) autorelease];
-}
-
-static inline WebCertificateParseResult toWebCertificateParseResult(WKCertificateParseResult result)
-{
-    switch (result) {
-    case WKCertificateParseResultSucceeded:
-        return WebCertificateParseResultSucceeded;
-    case WKCertificateParseResultFailed:
-        return WebCertificateParseResultFailed;
-    case WKCertificateParseResultPKCS7:
-        return WebCertificateParseResultPKCS7;
-    }
-
-    ASSERT_NOT_REACHED();
-    return WebCertificateParseResultFailed;
-}
-
-- (WebCertificateParseResult)addCertificatesToKeychainFromData:(NSData *)data
-{
-    return toWebCertificateParseResult(WKAddCertificatesToKeychainFromData([data bytes], [data length]));
-}
-
-@end
diff --git a/Source/WebKit/mac/WebCoreSupport/WebKeyGenerator.mm b/Source/WebKit/mac/WebCoreSupport/WebKeyGenerator.mm
new file mode 100644
index 0000000..3e535ea
--- /dev/null
+++ b/Source/WebKit/mac/WebCoreSupport/WebKeyGenerator.mm
@@ -0,0 +1,61 @@
+/*
+ * Copyright (C) 2005, 2011 Apple Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#import <WebKit/WebKeyGenerator.h>
+
+#import <WebKitSystemInterface.h>
+#import <wtf/Assertions.h>
+
+@implementation WebKeyGenerator
+
++ (WebKeyGenerator *)sharedGenerator
+{
+    static WebKeyGenerator *sharedGenerator = [[WebKeyGenerator alloc] init];
+    return sharedGenerator;
+}
+
+static inline WebCertificateParseResult toWebCertificateParseResult(WKCertificateParseResult result)
+{
+    // FIXME: WebKeyGenerator is not used in WebKit, and this code should be moved to Safari.
+
+    switch (result) {
+    case WKCertificateParseResultSucceeded:
+        return WebCertificateParseResultSucceeded;
+    case WKCertificateParseResultFailed:
+        return WebCertificateParseResultFailed;
+    case WKCertificateParseResultPKCS7:
+        return WebCertificateParseResultPKCS7;
+    }
+
+    ASSERT_NOT_REACHED();
+    return WebCertificateParseResultFailed;
+}
+
+- (WebCertificateParseResult)addCertificatesToKeychainFromData:(NSData *)data
+{
+    return toWebCertificateParseResult(WKAddCertificatesToKeychainFromData([data bytes], [data length]));
+}
+
+@end
diff --git a/Source/WebKit/mac/WebCoreSupport/WebPlatformStrategies.h b/Source/WebKit/mac/WebCoreSupport/WebPlatformStrategies.h
index 30cadcf..29bdb8a 100644
--- a/Source/WebKit/mac/WebCoreSupport/WebPlatformStrategies.h
+++ b/Source/WebKit/mac/WebCoreSupport/WebPlatformStrategies.h
@@ -80,7 +80,7 @@ private:
     virtual WTF::String contextMenuItemTagIgnoreSpelling();
     virtual WTF::String contextMenuItemTagLearnSpelling();
     virtual WTF::String contextMenuItemTagSearchWeb();
-    virtual WTF::String contextMenuItemTagLookUpInDictionary();
+    virtual WTF::String contextMenuItemTagLookUpInDictionary(const WTF::String& selectedString);
     virtual WTF::String contextMenuItemTagOpenLink();
     virtual WTF::String contextMenuItemTagIgnoreGrammar();
     virtual WTF::String contextMenuItemTagSpellingMenu();
@@ -153,6 +153,10 @@ private:
     virtual WTF::String crashedPluginText();
     virtual WTF::String multipleFileUploadText(unsigned numberOfFiles);
     virtual WTF::String unknownFileSizeText();
+    virtual WTF::String keygenMenuItem512();
+    virtual WTF::String keygenMenuItem1024();
+    virtual WTF::String keygenMenuItem2048();
+    virtual WTF::String keygenKeychainItemName(const WTF::String& host);
     virtual WTF::String imageTitle(const WTF::String& filename, const WebCore::IntSize& size);
     virtual WTF::String mediaElementLoadingStateText();
     virtual WTF::String mediaElementLiveBroadcastStateText();
diff --git a/Source/WebKit/mac/WebCoreSupport/WebPlatformStrategies.mm b/Source/WebKit/mac/WebCoreSupport/WebPlatformStrategies.mm
index 94fc572..59ba436 100644
--- a/Source/WebKit/mac/WebCoreSupport/WebPlatformStrategies.mm
+++ b/Source/WebKit/mac/WebCoreSupport/WebPlatformStrategies.mm
@@ -274,9 +274,13 @@ String WebPlatformStrategies::contextMenuItemTagSearchWeb()
     return UI_STRING_INTERNAL("Search in Google", "Search in Google context menu item");
 }
 
-String WebPlatformStrategies::contextMenuItemTagLookUpInDictionary()
+String WebPlatformStrategies::contextMenuItemTagLookUpInDictionary(const String& selectedString)
 {
+#if defined(BUILDING_ON_TIGER) || defined(BUILDING_ON_LEOPARD) || defined(BUILDING_ON_SNOW_LEOPARD)
     return UI_STRING_INTERNAL("Look Up in Dictionary", "Look Up in Dictionary context menu item");
+#else
+    return [NSString stringWithFormat:UI_STRING_INTERNAL("Look Up “%@�", "Look Up context menu item with selected word"), (NSString *)selectedString];
+#endif
 }
 
 String WebPlatformStrategies::contextMenuItemTagOpenLink()
@@ -666,6 +670,26 @@ String WebPlatformStrategies::unknownFileSizeText()
     return UI_STRING_INTERNAL("Unknown", "Unknown filesize FTP directory listing item");
 }
 
+String WebPlatformStrategies::keygenMenuItem512()
+{
+    return UI_STRING_INTERNAL("512 (Low Grade)", "Menu item title for KEYGEN pop-up menu");
+}
+
+String WebPlatformStrategies::keygenMenuItem1024()
+{
+    return UI_STRING_INTERNAL("1024 (Medium Grade)", "Menu item title for KEYGEN pop-up menu");
+}
+
+String WebPlatformStrategies::keygenMenuItem2048()
+{
+    return UI_STRING_INTERNAL("2048 (High Grade)", "Menu item title for KEYGEN pop-up menu");
+}
+
+String WebPlatformStrategies::keygenKeychainItemName(const WTF::String& host)
+{
+    return [NSString stringWithFormat:UI_STRING_INTERNAL("Key from %@", "Name of keychain key generated by the KEYGEN tag"), (NSString *)host];
+}
+
 String WebPlatformStrategies::imageTitle(const String& filename, const IntSize& size)
 {
 #if !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
diff --git a/Source/WebKit/mac/WebCoreSupport/WebSecurityOrigin.mm b/Source/WebKit/mac/WebCoreSupport/WebSecurityOrigin.mm
index 385d869..131a1ac 100644
--- a/Source/WebKit/mac/WebCoreSupport/WebSecurityOrigin.mm
+++ b/Source/WebKit/mac/WebCoreSupport/WebSecurityOrigin.mm
@@ -46,23 +46,28 @@ using namespace WebCore;
 
     RefPtr<SecurityOrigin> origin = SecurityOrigin::create(KURL([url absoluteURL]));
     origin->ref();
-    _private = reinterpret_cast<WebSecurityOriginPrivate*>(origin.get());
+    _private = reinterpret_cast<WebSecurityOriginPrivate *>(origin.get());
 
     return self;
 }
 
-- (NSString*)protocol
+- (NSString *)protocol
 {
     return reinterpret_cast<SecurityOrigin*>(_private)->protocol();
 }
 
-- (NSString*)host
+- (NSString *)host
 {
     return reinterpret_cast<SecurityOrigin*>(_private)->host();
 }
 
+- (NSString *)databaseIdentifier
+{
+    return reinterpret_cast<SecurityOrigin*>(_private)->databaseIdentifier();
+}
+
 // Deprecated. Use host instead. This needs to stay here until we ship a new Safari.
-- (NSString*)domain
+- (NSString *)domain
 {
     return [self host];
 }
@@ -111,7 +116,7 @@ using namespace WebCore;
         return nil;
 
     origin->ref();
-    _private = reinterpret_cast<WebSecurityOriginPrivate*>(origin);
+    _private = reinterpret_cast<WebSecurityOriginPrivate *>(origin);
 
     return self;
 }
diff --git a/Source/WebKit/mac/WebCoreSupport/WebSecurityOriginPrivate.h b/Source/WebKit/mac/WebCoreSupport/WebSecurityOriginPrivate.h
index 2973d92..a784aba 100644
--- a/Source/WebKit/mac/WebCoreSupport/WebSecurityOriginPrivate.h
+++ b/Source/WebKit/mac/WebCoreSupport/WebSecurityOriginPrivate.h
@@ -37,8 +37,10 @@
 
 - (id)initWithURL:(NSURL *)url;
 
-- (NSString*)protocol;
-- (NSString*)host;
+- (NSString *)protocol;
+- (NSString *)host;
+
+- (NSString *)databaseIdentifier;
 
 // Returns zero if the port is the default port for the protocol, non-zero otherwise.
 - (unsigned short)port;
diff --git a/Source/WebKit/mac/WebCoreSupport/WebSystemInterface.mm b/Source/WebKit/mac/WebCoreSupport/WebSystemInterface.mm
index 6504f17..1b212a7 100644
--- a/Source/WebKit/mac/WebCoreSupport/WebSystemInterface.mm
+++ b/Source/WebKit/mac/WebCoreSupport/WebSystemInterface.mm
@@ -63,6 +63,7 @@ void InitWebCoreSystemInterface(void)
     INIT(GetHTTPPipeliningPriority);
     INIT(GetMIMETypeForExtension);
     INIT(GetNSURLResponseLastModifiedDate);
+    INIT(SignedPublicKeyAndChallengeString);
     INIT(GetPreferredExtensionForMIMEType);
     INIT(GetWheelEventDeltas);
     INIT(HitTestMediaUIPart);
@@ -128,6 +129,7 @@ void InitWebCoreSystemInterface(void)
     INIT(MakeScrollbarPainter);
     INIT(ScrollbarPainterSetDelegate);
     INIT(ScrollbarPainterPaint);
+    INIT(ScrollbarPainterForceFlashScrollers);
     INIT(ScrollbarThickness);
     INIT(ScrollbarMinimumThumbLength);
     INIT(ScrollbarMinimumTotalLengthNeededForThumb);
@@ -168,11 +170,17 @@ void InitWebCoreSystemInterface(void)
     INIT(UnregisterUniqueIdForElement);
     INIT(CreatePrivateStorageSession);
     INIT(CopyRequestWithStorageSession);
-    INIT(CreatePrivateInMemoryHTTPCookieStorage);
+    INIT(CopyHTTPCookieStorage);
     INIT(GetHTTPCookieAcceptPolicy);
     INIT(HTTPCookiesForURL);
     INIT(SetHTTPCookiesForURL);
     INIT(DeleteHTTPCookie);
 
+    INIT(GetCFURLResponseMIMEType);
+    INIT(GetCFURLResponseURL);
+    INIT(GetCFURLResponseHTTPResponse);
+    INIT(CopyCFURLResponseSuggestedFilename);
+    INIT(SetCFURLResponseMIMEType);
+
     didInit = true;
 }
diff --git a/Source/WebKit/mac/WebKit.exp b/Source/WebKit/mac/WebKit.exp
index 7c20307..ec8f74b 100644
--- a/Source/WebKit/mac/WebKit.exp
+++ b/Source/WebKit/mac/WebKit.exp
@@ -6,6 +6,7 @@
 .objc_class_name_WebCoreStatistics
 .objc_class_name_WebDataSource
 .objc_class_name_WebDatabaseManager
+.objc_class_name_WebStorageManager
 .objc_class_name_WebDefaultPolicyDelegate
 .objc_class_name_WebDeviceOrientation
 .objc_class_name_WebDeviceOrientationProviderMock
@@ -114,6 +115,8 @@ _WebReportError
 _WebScriptErrorDescriptionKey
 _WebScriptErrorDomain
 _WebScriptErrorLineNumberKey
+_WebStorageDirectoryDefaultsKey
+_WebStorageDidModifyOriginNotification
 _WebURLNamePboardType
 _WebURLPboardType
 _WebViewDidBeginEditingNotification
diff --git a/Source/WebKit/mac/WebKitPrefix.h b/Source/WebKit/mac/WebKitPrefix.h
index fe0f214..6d57815 100644
--- a/Source/WebKit/mac/WebKitPrefix.h
+++ b/Source/WebKit/mac/WebKitPrefix.h
@@ -79,12 +79,6 @@ typedef float CGFloat;
 #define WTF_USE_JSC 1
 #define WTF_USE_V8 0
 
-#ifdef __cplusplus
-#include <wtf/FastMalloc.h>
-#endif
-
-#include <wtf/DisallowCType.h>
-
 /* Work around bug with C++ library that screws up Objective-C++ when exception support is disabled. */
 #undef try
 #undef catch
@@ -92,3 +86,11 @@ typedef float CGFloat;
 #define JS_EXPORTDATA
 #define JS_EXPORTCLASS
 #define WEBKIT_EXPORTDATA
+#define WTF_EXPORT_PRIVATE
+#define JS_EXPORT_PRIVATE
+
+#ifdef __cplusplus
+#include <wtf/FastMalloc.h>
+#endif
+
+#include <wtf/DisallowCType.h>
diff --git a/Source/WebKit/mac/WebView/WebClipView.mm b/Source/WebKit/mac/WebView/WebClipView.mm
index ced5d8d..280695e 100644
--- a/Source/WebKit/mac/WebView/WebClipView.mm
+++ b/Source/WebKit/mac/WebView/WebClipView.mm
@@ -51,6 +51,13 @@ using namespace WebCore;
 - (void)_immediateScrollToPoint:(NSPoint)newOrigin;
 @end
 
+#if !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
+@interface NSWindow (WebNSWindowDetails)
+- (void)_disableDelayedWindowDisplay;
+- (void)_enableDelayedWindowDisplay;
+@end
+#endif
+
 @implementation WebClipView
 
 - (id)initWithFrame:(NSRect)frame
@@ -96,7 +103,17 @@ using namespace WebCore;
 - (void)_immediateScrollToPoint:(NSPoint)newOrigin
 {
     _isScrolling = YES;
+
+#if !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
+    [[self window] _disableDelayedWindowDisplay];
+#endif
+
     [super _immediateScrollToPoint:newOrigin];
+
+#if !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
+    [[self window] _enableDelayedWindowDisplay];
+#endif
+
     _isScrolling = NO;
 }
 #endif
diff --git a/Source/WebKit/mac/WebView/WebFrame.mm b/Source/WebKit/mac/WebView/WebFrame.mm
index e792539..584b09e 100644
--- a/Source/WebKit/mac/WebView/WebFrame.mm
+++ b/Source/WebKit/mac/WebView/WebFrame.mm
@@ -579,51 +579,14 @@ static inline WebDataSource *dataSource(DocumentLoader* loader)
     }
     
     if (contentsOnly)
-        _private->coreFrame->view()->paintContents(&context, enclosingIntRect(rect));
+        view->paintContents(&context, enclosingIntRect(rect));
     else
-        _private->coreFrame->view()->paint(&context, enclosingIntRect(rect));
+        view->paint(&context, enclosingIntRect(rect));
 
     if (shouldFlatten)
         view->setPaintBehavior(oldBehavior);
 }
 
-// Used by pagination code called from AppKit when a standalone web page is printed.
-- (NSArray*)_computePageRectsWithPrintScaleFactor:(float)printScaleFactor pageSize:(NSSize)pageSize
-{
-    NSMutableArray* pages = [NSMutableArray arrayWithCapacity:5];
-    if (printScaleFactor <= 0) {
-        LOG_ERROR("printScaleFactor has bad value %.2f", printScaleFactor);
-        return pages;
-    }
-
-    if (!_private->coreFrame || !_private->coreFrame->document() || !_private->coreFrame->view()) return pages;
-    RenderView* root = toRenderView(_private->coreFrame->document()->renderer());
-    if (!root) return pages;
-    
-    FrameView* view = _private->coreFrame->view();
-    if (!view)
-        return pages;
-
-    NSView* documentView = view->documentView();
-    if (!documentView)
-        return pages;
-
-    float docWidth = root->docWidth();
-    float docHeight = root->docHeight();
-
-    float printWidth = root->style()->isHorizontalWritingMode() ? docWidth / printScaleFactor : pageSize.width;
-    float printHeight = root->style()->isHorizontalWritingMode() ? pageSize.height : docHeight / printScaleFactor;
-
-    PrintContext printContext(_private->coreFrame);
-    printContext.computePageRectsWithPageSize(FloatSize(printWidth, printHeight), true);
-
-    const Vector<IntRect>& pageRects = printContext.pageRects();
-    const size_t pageCount = pageRects.size();
-    for (size_t pageNumber = 0; pageNumber < pageCount; ++pageNumber)
-        [pages addObject: [NSValue valueWithRect: NSRect(pageRects[pageNumber])]];
-    return pages;
-}
-
 - (BOOL)_getVisibleRect:(NSRect*)rect
 {
     ASSERT_ARG(rect, rect);
@@ -1347,10 +1310,18 @@ static inline WebDataSource *dataSource(DocumentLoader* loader)
 
 - (BOOL)hasSpellingMarker:(int)from length:(int)length
 {
-    Frame* coreFrame = _private->coreFrame;
+    Frame* coreFrame = core(self);
+    if (!coreFrame)
+        return NO;
+    return coreFrame->editor()->selectionStartHasMarkerFor(DocumentMarker::Spelling, from, length);
+}
+
+- (BOOL)hasGrammarMarker:(int)from length:(int)length
+{
+    Frame* coreFrame = core(self);
     if (!coreFrame)
         return NO;
-    return coreFrame->editor()->selectionStartHasSpellingMarkerFor(from, length);
+    return coreFrame->editor()->selectionStartHasMarkerFor(DocumentMarker::Grammar, from, length);
 }
 
 - (id)accessibilityRoot
@@ -1358,8 +1329,7 @@ static inline WebDataSource *dataSource(DocumentLoader* loader)
 #if HAVE(ACCESSIBILITY)
     if (!AXObjectCache::accessibilityEnabled()) {
         AXObjectCache::enableAccessibility();
-        if ([[NSApp accessibilityAttributeValue:NSAccessibilityEnhancedUserInterfaceAttribute] boolValue])
-            AXObjectCache::enableEnhancedUserInterfaceAccessibility();
+        AXObjectCache::setEnhancedUserInterfaceAccessibility([[NSApp accessibilityAttributeValue:NSAccessibilityEnhancedUserInterfaceAttribute] boolValue]);
     }
     
     if (!_private->coreFrame || !_private->coreFrame->document())
@@ -1387,6 +1357,41 @@ static inline WebDataSource *dataSource(DocumentLoader* loader)
         coreFrame->loader()->setOpener(0);
 }
 
+// Used by pagination code called from AppKit when a standalone web page is printed.
+- (NSArray *)_computePageRectsWithPrintScaleFactor:(float)printScaleFactor pageSize:(NSSize)pageSize
+{
+    if (printScaleFactor <= 0) {
+        LOG_ERROR("printScaleFactor has bad value %.2f", printScaleFactor);
+        return [NSArray array];
+    }
+
+    if (!_private->coreFrame)
+        return [NSArray array];
+    if (!_private->coreFrame->document())
+        return [NSArray array];
+    if (!_private->coreFrame->view())
+        return [NSArray array];
+    if (!_private->coreFrame->view()->documentView())
+        return [NSArray array];
+
+    RenderView* root = toRenderView(_private->coreFrame->document()->renderer());
+    if (!root)
+        return [NSArray array];
+
+    float printWidth = root->style()->isHorizontalWritingMode() ? root->docWidth() / printScaleFactor : pageSize.width;
+    float printHeight = root->style()->isHorizontalWritingMode() ? pageSize.height : root->docHeight() / printScaleFactor;
+
+    PrintContext printContext(_private->coreFrame);
+    printContext.computePageRectsWithPageSize(FloatSize(printWidth, printHeight), true);
+    const Vector<IntRect>& pageRects = printContext.pageRects();
+
+    size_t size = pageRects.size();
+    NSMutableArray *pages = [NSMutableArray arrayWithCapacity:size];
+    for (size_t i = 0; i < size; ++i)
+        [pages addObject:[NSValue valueWithRect:NSRect(pageRects[i])]];
+    return pages;
+}
+
 @end
 
 @implementation WebFrame
diff --git a/Source/WebKit/mac/WebView/WebFrameInternal.h b/Source/WebKit/mac/WebView/WebFrameInternal.h
index 7e8016a..c13b721 100644
--- a/Source/WebKit/mac/WebView/WebFrameInternal.h
+++ b/Source/WebKit/mac/WebView/WebFrameInternal.h
@@ -125,7 +125,6 @@ WebView *getWebView(WebFrame *webFrame);
 - (BOOL)_needsLayout;
 - (void)_drawRect:(NSRect)rect contentsOnly:(BOOL)contentsOnly;
 - (BOOL)_getVisibleRect:(NSRect*)rect;
-- (NSArray*)_computePageRectsWithPrintScaleFactor:(float)printWidthScaleFactor pageSize:(NSSize)pageSize;
 
 - (NSString *)_stringByEvaluatingJavaScriptFromString:(NSString *)string;
 - (NSString *)_stringByEvaluatingJavaScriptFromString:(NSString *)string forceUserGesture:(BOOL)forceUserGesture;
diff --git a/Source/WebKit/mac/WebView/WebFramePrivate.h b/Source/WebKit/mac/WebView/WebFramePrivate.h
index 75b57c7..82b3c4a 100644
--- a/Source/WebKit/mac/WebView/WebFramePrivate.h
+++ b/Source/WebKit/mac/WebView/WebFramePrivate.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2005, 2006, 2007, 2008, 2009, 2010 Apple Computer, Inc. All rights reserved.
+ * Copyright (C) 2005, 2006, 2007, 2008, 2009, 2010, 2011 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -69,8 +69,9 @@ typedef enum {
 } WebFrameLoadType;
 
 @interface WebFrame (WebPrivate)
+
 - (BOOL)_isDescendantOfFrame:(WebFrame *)frame;
-- (void)_setShouldCreateRenderers:(BOOL)f;
+- (void)_setShouldCreateRenderers:(BOOL)shouldCreateRenderers;
 - (NSColor *)_bodyBackgroundColor;
 - (BOOL)_isFrameSet;
 - (BOOL)_firstLayoutDone;
@@ -142,11 +143,15 @@ typedef enum {
 // Returns whether there is a spelling marker in the specified range of the focused node.
 - (BOOL)hasSpellingMarker:(int)location length:(int)length;
 
+- (BOOL)hasGrammarMarker:(int)from length:(int)length;
+
 // The top of the accessibility tree.
 - (id)accessibilityRoot;
 
 // Clears frame opener. This is executed between layout tests runs
 - (void)_clearOpener;
 
+// Printing.
+- (NSArray *)_computePageRectsWithPrintScaleFactor:(float)printWidthScaleFactor pageSize:(NSSize)pageSize;
 
 @end
diff --git a/Source/WebKit/mac/WebView/WebFrameView.mm b/Source/WebKit/mac/WebView/WebFrameView.mm
index 801c1f4..c42738c 100644
--- a/Source/WebKit/mac/WebView/WebFrameView.mm
+++ b/Source/WebKit/mac/WebView/WebFrameView.mm
@@ -308,7 +308,6 @@ static inline void addTypesFromClass(NSMutableDictionary *allTypes, Class objCCl
         WebCore::notifyHistoryItemChanged = WKNotifyHistoryItemChanged;
 
         [WebViewFactory createSharedFactory];
-        [WebKeyGenerator createSharedGenerator];
 
 // FIXME: Remove the NSAppKitVersionNumberWithDeferredWindowDisplaySupport check once
 // once AppKit's Deferred Window Display support is available.
diff --git a/Source/WebKit/mac/WebView/WebFullScreenController.h b/Source/WebKit/mac/WebView/WebFullScreenController.h
index f867dc2..0f55bd0 100644
--- a/Source/WebKit/mac/WebView/WebFullScreenController.h
+++ b/Source/WebKit/mac/WebView/WebFullScreenController.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2010 Apple Inc. All rights reserved.
+ * Copyright (C) 2010, 2011 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
diff --git a/Source/WebKit/mac/WebView/WebFullScreenController.mm b/Source/WebKit/mac/WebView/WebFullScreenController.mm
index 5b8b496..3cc8355 100644
--- a/Source/WebKit/mac/WebView/WebFullScreenController.mm
+++ b/Source/WebKit/mac/WebView/WebFullScreenController.mm
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2009, 2010, 2011 Apple Inc. All rights reserved.
+ * Copyright (C) 2010, 2011 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
diff --git a/Source/WebKit/mac/WebView/WebHTMLRepresentation.h b/Source/WebKit/mac/WebView/WebHTMLRepresentation.h
index 68f9bde..b714bf6 100644
--- a/Source/WebKit/mac/WebView/WebHTMLRepresentation.h
+++ b/Source/WebKit/mac/WebView/WebHTMLRepresentation.h
@@ -57,6 +57,7 @@
 + (NSArray *)supportedMIMETypes;
 + (NSArray *)supportedNonImageMIMETypes;
 + (NSArray *)supportedImageMIMETypes;
++ (NSArray *)unsupportedTextMIMETypes;
 
 - (NSAttributedString *)attributedStringFrom:(DOMNode *)startNode startOffset:(int)startOffset to:(DOMNode *)endNode endOffset:(int)endOffset;
 
diff --git a/Source/WebKit/mac/WebView/WebHTMLRepresentation.mm b/Source/WebKit/mac/WebView/WebHTMLRepresentation.mm
index fad0a4a..03edd5d 100644
--- a/Source/WebKit/mac/WebView/WebHTMLRepresentation.mm
+++ b/Source/WebKit/mac/WebView/WebHTMLRepresentation.mm
@@ -113,6 +113,12 @@ static NSArray *concatenateArrays(NSArray *first, NSArray *second)
     return staticSupportedImageMIMETypes.get();
 }
 
++ (NSArray *)unsupportedTextMIMETypes
+{
+    DEFINE_STATIC_LOCAL(RetainPtr<NSArray>, staticUnsupportedTextMIMETypes, (stringArray(MIMETypeRegistry::getUnsupportedTextMIMETypes())));
+    return staticUnsupportedTextMIMETypes.get();
+}
+
 - (id)init
 {
     self = [super init];
diff --git a/Source/WebKit/mac/WebView/WebHTMLView.mm b/Source/WebKit/mac/WebView/WebHTMLView.mm
index 00f65bd..e611e2b 100644
--- a/Source/WebKit/mac/WebView/WebHTMLView.mm
+++ b/Source/WebKit/mac/WebView/WebHTMLView.mm
@@ -383,6 +383,7 @@ static CachedResourceClient* promisedDataClient()
 - (DOMDocumentFragment *)_documentFragmentFromPasteboard:(NSPasteboard *)pasteboard inContext:(DOMRange *)context allowPlainText:(BOOL)allowPlainText;
 - (NSString *)_plainTextFromPasteboard:(NSPasteboard *)pasteboard;
 - (void)_pasteWithPasteboard:(NSPasteboard *)pasteboard allowPlainText:(BOOL)allowPlainText;
+- (void)_pasteAsPlainTextWithPasteboard:(NSPasteboard *)pasteboard;
 - (void)_removeMouseMovedObserverUnconditionally;
 - (void)_removeSuperviewObservers;
 - (void)_removeWindowObservers;
@@ -461,11 +462,9 @@ static CachedResourceClient* promisedDataClient()
 
 struct WebHTMLViewInterpretKeyEventsParameters {
     KeyboardEvent* event;
-    BOOL eventWasHandled;
-    BOOL shouldSaveCommand;
-    // The Input Method may consume an event and not tell us, in
-    // which case we should not bubble the event up the DOM
-    BOOL consumedByIM;
+    bool eventInterpretationHadSideEffects;
+    bool shouldSaveCommands;
+    bool consumedByIM;
 };
 
 @interface WebHTMLViewPrivate : NSObject {
@@ -522,7 +521,6 @@ struct WebHTMLViewInterpretKeyEventsParameters {
     BOOL transparentBackground;
 
     WebHTMLViewInterpretKeyEventsParameters* interpretKeyEventsParameters;
-    BOOL receivedNOOP;
     
     WebDataSource *dataSource;
     WebCore::CachedImage* promisedDragTIFFDataSource;
@@ -914,6 +912,32 @@ static NSURL* uniqueURLWithRelativePart(NSString *relativePart)
     [webView release];
 }
 
+- (void)_pasteAsPlainTextWithPasteboard:(NSPasteboard *)pasteboard 
+{ 
+    WebView *webView = [[self _webView] retain]; 
+    [webView _setInsertionPasteboard:pasteboard]; 
+
+    NSString *text = [self _plainTextFromPasteboard:pasteboard]; 
+    if ([self _shouldReplaceSelectionWithText:text givenAction:WebViewInsertActionPasted]) 
+        [[self _frame] _replaceSelectionWithText:text selectReplacement:NO smartReplace:[self _canSmartReplaceWithPasteboard:pasteboard]]; 
+
+    [webView _setInsertionPasteboard:nil]; 
+    [webView release];
+}
+
+// This method is needed to support Mac OS X services.
+- (BOOL)readSelectionFromPasteboard:(NSPasteboard *)pasteboard 
+{ 
+    Frame* coreFrame = core([self _frame]); 
+    if (!coreFrame) 
+        return NO; 
+    if (coreFrame->selection()->isContentRichlyEditable()) 
+        [self _pasteWithPasteboard:pasteboard allowPlainText:YES]; 
+    else 
+        [self _pasteAsPlainTextWithPasteboard:pasteboard]; 
+    return YES; 
+}
+
 - (void)_removeMouseMovedObserverUnconditionally
 {
     if (!_private || !_private->observingMouseMovedNotifications)
@@ -1169,21 +1193,7 @@ static NSURL* uniqueURLWithRelativePart(NSString *relativePart)
 
 + (NSArray *)unsupportedTextMIMETypes
 {
-    return [NSArray arrayWithObjects:
-        @"text/calendar",       // iCal
-        @"text/x-calendar",
-        @"text/x-vcalendar",
-        @"text/vcalendar",
-        @"text/vcard",          // vCard
-        @"text/x-vcard",
-        @"text/directory",
-        @"text/ldif",           // Netscape Address Book
-        @"text/qif",            // Quicken
-        @"text/x-qif",
-        @"text/x-csv",          // CSV (for Address Book and Microsoft Outlook)
-        @"text/x-vcf",          // vCard type used in Sun affinity app
-        @"text/rtf",            // Rich Text Format
-        nil];
+    return [WebHTMLRepresentation unsupportedTextMIMETypes];
 }
 
 + (void)_postFlagsChangedEvent:(NSEvent *)flagsChangedEvent
@@ -1985,10 +1995,6 @@ static void _updateMouseoverTimerCallback(CFRunLoopTimerRef timer, void *info)
     [self removeAllToolTips];
 
     [_private clear];
-
-    Page* page = core([self _webView]);
-    if (page)
-        page->dragController()->setDraggingImageURL(KURL());
 }
 
 - (BOOL)_hasHTMLDocument
@@ -2608,6 +2614,7 @@ WEBCORE_COMMAND(yankAndSelect)
     [NSPasteboard _web_setFindPasteboardString:[self selectedString] withOwner:self];
 }
 
+// This method is needed to support Mac OS X services.
 - (BOOL)writeSelectionToPasteboard:(NSPasteboard *)pasteboard types:(NSArray *)types
 {
     [pasteboard declareTypes:types owner:[self _topHTMLView]];
@@ -3036,7 +3043,12 @@ WEBCORE_COMMAND(yankAndSelect)
         // We may have created the layer hosting view while outside the window. Update the scale factor
         // now that we have a window to get it from.
         if (_private->layerHostingView) {
-            CGFloat scaleFactor = [[self window] userSpaceScaleFactor];
+            CGFloat scaleFactor;
+#if !defined(BUILDING_ON_SNOW_LEOPARD)
+            scaleFactor = [[self window] backingScaleFactor];
+#else
+            scaleFactor = [[self window] userSpaceScaleFactor];
+#endif
             [[_private->layerHostingView layer] setTransform:CATransform3DMakeScale(scaleFactor, scaleFactor, 1)];
         }
 #endif
@@ -5416,59 +5428,96 @@ static CGPoint coreGraphicsScreenPointForAppKitScreenPoint(NSPoint point)
     [self _updateMouseoverWithFakeEvent];
 }
 
-- (BOOL)_interceptEditingKeyEvent:(KeyboardEvent*)event shouldSaveCommand:(BOOL)shouldSave
+- (void)_executeSavedEditingCommands
+{
+    WebHTMLViewInterpretKeyEventsParameters* parameters = _private->interpretKeyEventsParameters;
+    if (!parameters || parameters->event->keypressCommands().isEmpty())
+        return;
+
+    // Avoid an infinite loop that would occur if executing a command appended it to event->keypressCommands() again.
+    bool wasSavingCommands = parameters->shouldSaveCommands;
+    parameters->shouldSaveCommands = false;
+
+    const Vector<KeypressCommand>& commands = parameters->event->keypressCommands();
+
+    for (size_t i = 0; i < commands.size(); ++i) {
+        if (commands[i].commandName == "insertText:")
+            [self insertText:commands[i].text];
+        else
+            [self doCommandBySelector:NSSelectorFromString(commands[i].commandName)];
+    }
+    parameters->event->keypressCommands().clear();
+    parameters->shouldSaveCommands = wasSavingCommands;
+}
+
+- (BOOL)_interpretKeyEvent:(KeyboardEvent*)event savingCommands:(BOOL)savingCommands
 {
-    // Ask AppKit to process the key event -- it will call back with either insertText or doCommandBySelector.
+    ASSERT(core([self _frame]) == event->target()->toNode()->document()->frame());
+    ASSERT(!savingCommands || event->keypressCommands().isEmpty()); // Save commands once for each event.
+
     WebHTMLViewInterpretKeyEventsParameters parameters;
-    parameters.eventWasHandled = false;
-    parameters.shouldSaveCommand = shouldSave;
+    parameters.eventInterpretationHadSideEffects = false;
+    parameters.shouldSaveCommands = savingCommands;
     // If we're intercepting the initial IM call we assume that the IM has consumed the event, 
     // and only change this assumption if one of the NSTextInput/Responder callbacks is used.
     // We assume the IM will *not* consume hotkey sequences
-    parameters.consumedByIM = !event->metaKey() && shouldSave;
+    parameters.consumedByIM = savingCommands && !event->metaKey();
 
-    if (const PlatformKeyboardEvent* platformEvent = event->keyEvent()) {
-        NSEvent *macEvent = platformEvent->macEvent();
-        if ([macEvent type] == NSKeyDown && [_private->completionController filterKeyDown:macEvent])
-            return true;
-        
-        if ([macEvent type] == NSFlagsChanged)
-            return false;
-        
-        parameters.event = event;
-        _private->interpretKeyEventsParameters = &parameters;
-        _private->receivedNOOP = NO;
-        const Vector<KeypressCommand>& commands = event->keypressCommands();
-        bool hasKeypressCommand = !commands.isEmpty();
-
-        // FIXME: interpretKeyEvents doesn't match application key equivalents (such as Cmd+A),
-        // and sends noop: for those. As a result, we don't handle those from within WebCore,
-        // but send a full sequence of DOM events, including an unneeded keypress.
-        if (parameters.shouldSaveCommand || !hasKeypressCommand)
-            [self interpretKeyEvents:[NSArray arrayWithObject:macEvent]];
-        else {
-            size_t size = commands.size();
-            // Are there commands that would just cause text insertion if executed via Editor?
-            // WebKit doesn't have enough information about mode to decide how they should be treated, so we leave it upon WebCore
-            // to either handle them immediately (e.g. Tab that changes focus) or let a keypress event be generated
-            // (e.g. Tab that inserts a Tab character, or Enter).
-            bool haveTextInsertionCommands = false;
-            for (size_t i = 0; i < size; ++i) {
-                if ([self coreCommandBySelector:NSSelectorFromString(commands[i].commandName)].isTextInsertion())
-                    haveTextInsertionCommands = true;
-            }
-            if (!haveTextInsertionCommands || platformEvent->type() == PlatformKeyboardEvent::Char) {
-                for (size_t i = 0; i < size; ++i) {
-                    if (commands[i].commandName == "insertText:")
-                        [self insertText:commands[i].text];
-                    else
-                        [self doCommandBySelector:NSSelectorFromString(commands[i].commandName)];
-                }
-            }
+    const PlatformKeyboardEvent* platformEvent = event->keyEvent();
+    if (!platformEvent)
+        return NO;
+
+    NSEvent *macEvent = platformEvent->macEvent();
+    if ([macEvent type] == NSKeyDown && [_private->completionController filterKeyDown:macEvent])
+        return YES;
+    
+    if ([macEvent type] == NSFlagsChanged)
+        return NO;
+    
+    parameters.event = event;
+    _private->interpretKeyEventsParameters = &parameters;
+    const Vector<KeypressCommand>& commands = event->keypressCommands();
+
+    if (savingCommands) {
+        // AppKit will respond with a series of NSTextInput protocol method calls. There are three groups that we heuristically differentiate:
+        // 1. Key Bindings. Only doCommandBySelector: and insertText: calls will be made, which we save in the event for execution
+        // after DOM dispatch. This is safe, because neither returns a result, so there is no branching on AppKit side.
+        // 2. Plain text input. Here as well, we need to dispatch DOM events prior to inserting text, so we save the insertText: command.
+        // 3. Input method processing. An IM can make any NSTextInput calls, and can base its decisions on results it gets, so we must
+        // execute the calls immediately. DOM events like keydown are tweaked to have keyCode of 229, and canceling them has no effect.
+        // Unfortunately, there is no real difference between plain text input and IM processing - for example, AppKit queries hasMarkedText
+        // when typing with U.S. keyboard, and inserts marked text for dead keys.
+        [self interpretKeyEvents:[NSArray arrayWithObject:macEvent]];
+    } else {
+        // Are there commands that could just cause text insertion if executed via Editor?
+        // WebKit doesn't have enough information about mode to decide how they should be treated, so we leave it upon WebCore
+        // to either handle them immediately (e.g. Tab that changes focus) or let a keypress event be generated
+        // (e.g. Tab that inserts a Tab character, or Enter).
+        bool haveTextInsertionCommands = false;
+        for (size_t i = 0; i < commands.size(); ++i) {
+            if ([self coreCommandBySelector:NSSelectorFromString(commands[i].commandName)].isTextInsertion())
+                haveTextInsertionCommands = true;
         }
-        _private->interpretKeyEventsParameters = 0;
+        // If there are no text insertion commands, default keydown handler is the right time to execute the commands.
+        // Keypress (Char event) handler is the latest opportunity to execute.
+        if (!haveTextInsertionCommands || platformEvent->type() == PlatformKeyboardEvent::Char)
+            [self _executeSavedEditingCommands];
     }
-    return (!_private->receivedNOOP && parameters.eventWasHandled) || parameters.consumedByIM;
+    _private->interpretKeyEventsParameters = 0;
+
+    // An input method may make several actions per keypress. For example, pressing Return with Korean IM both confirms it and sends a newline.
+    // IM-like actions are handled immediately (so parameters.eventInterpretationHadSideEffects is true), but there are saved commands that
+    // should be handled like normal text input after DOM event dispatch.
+    if (!event->keypressCommands().isEmpty())
+        return NO;
+
+    // An input method may consume an event and not tell us (e.g. when displaying a candidate window),
+    // in which case we should not bubble the event up the DOM.
+    if (parameters.consumedByIM)
+        return YES;
+
+    // If we have already executed all commands, don't do it again.
+    return parameters.eventInterpretationHadSideEffects;
 }
 
 - (WebCore::CachedImage*)promisedDragTIFFDataSource
@@ -5551,7 +5600,20 @@ static CGPoint coreGraphicsScreenPointForAppKitScreenPoint(NSPoint point)
 #if !defined(BUILDING_ON_LEOPARD)
     // If we aren't in the window yet, we'll use the screen's scale factor now, and reset the scale 
     // via -viewDidMoveToWindow.
-    CGFloat scaleFactor = [self window] ? [[self window] userSpaceScaleFactor] : [[NSScreen mainScreen] userSpaceScaleFactor];
+    NSWindow *window = [self window];
+    CGFloat scaleFactor;
+#if !defined(BUILDING_ON_SNOW_LEOPARD)
+    if (window)
+        scaleFactor = [window backingScaleFactor];
+    else
+        scaleFactor = [[NSScreen mainScreen] backingScaleFactor];
+#else
+    if (window)
+        scaleFactor = [window userSpaceScaleFactor];
+    else
+        scaleFactor = [[NSScreen mainScreen] userSpaceScaleFactor];
+#endif
+
     [viewLayer setTransform:CATransform3DMakeScale(scaleFactor, scaleFactor, 1)];
 #endif
 
@@ -5684,6 +5746,8 @@ static CGPoint coreGraphicsScreenPointForAppKitScreenPoint(NSPoint point)
 
 - (NSUInteger)characterIndexForPoint:(NSPoint)thePoint
 {
+    [self _executeSavedEditingCommands];
+
     NSWindow *window = [self window];
     WebFrame *frame = [self _frame];
 
@@ -5703,7 +5767,9 @@ static CGPoint coreGraphicsScreenPointForAppKitScreenPoint(NSPoint point)
 }
 
 - (NSRect)firstRectForCharacterRange:(NSRange)theRange
-{    
+{
+    [self _executeSavedEditingCommands];
+
     WebFrame *frame = [self _frame];
     
     // Just to match NSTextView's behavior. Regression tests cannot detect this;
@@ -5734,6 +5800,8 @@ static CGPoint coreGraphicsScreenPointForAppKitScreenPoint(NSPoint point)
 
 - (NSRange)selectedRange
 {
+    [self _executeSavedEditingCommands];
+
     if (!isTextInput(core([self _frame]))) {
         LOG(TextInput, "selectedRange -> (NSNotFound, 0)");
         return NSMakeRange(NSNotFound, 0);
@@ -5746,6 +5814,8 @@ static CGPoint coreGraphicsScreenPointForAppKitScreenPoint(NSPoint point)
 
 - (NSRange)markedRange
 {
+    [self _executeSavedEditingCommands];
+
     WebFrame *webFrame = [self _frame];
     Frame* coreFrame = core(webFrame);
     if (!coreFrame)
@@ -5758,6 +5828,8 @@ static CGPoint coreGraphicsScreenPointForAppKitScreenPoint(NSPoint point)
 
 - (NSAttributedString *)attributedSubstringFromRange:(NSRange)nsRange
 {
+    [self _executeSavedEditingCommands];
+
     WebFrame *frame = [self _frame];
     Frame* coreFrame = core(frame);
     if (!isTextInput(coreFrame) || isInPasswordField(coreFrame)) {
@@ -5799,6 +5871,8 @@ static CGPoint coreGraphicsScreenPointForAppKitScreenPoint(NSPoint point)
 
 - (BOOL)hasMarkedText
 {
+    [self _executeSavedEditingCommands];
+
     Frame* coreFrame = core([self _frame]);
     BOOL result = coreFrame && coreFrame->editor()->hasComposition();
     LOG(TextInput, "hasMarkedText -> %u", result);
@@ -5807,6 +5881,8 @@ static CGPoint coreGraphicsScreenPointForAppKitScreenPoint(NSPoint point)
 
 - (void)unmarkText
 {
+    [self _executeSavedEditingCommands];
+
     LOG(TextInput, "unmarkText");
 
     // Use pointer to get parameters passed to us by the caller of interpretKeyEvents.
@@ -5814,8 +5890,8 @@ static CGPoint coreGraphicsScreenPointForAppKitScreenPoint(NSPoint point)
     _private->interpretKeyEventsParameters = 0;
 
     if (parameters) {
-        parameters->eventWasHandled = YES;
-        parameters->consumedByIM = NO;
+        parameters->eventInterpretationHadSideEffects = true;
+        parameters->consumedByIM = false;
     }
     
     if (Frame* coreFrame = core([self _frame]))
@@ -5844,6 +5920,8 @@ static void extractUnderlines(NSAttributedString *string, Vector<CompositionUnde
 
 - (void)setMarkedText:(id)string selectedRange:(NSRange)newSelRange
 {
+    [self _executeSavedEditingCommands];
+
     BOOL isAttributedString = [string isKindOfClass:[NSAttributedString class]]; // Otherwise, NSString
 
     LOG(TextInput, "setMarkedText:\"%@\" selectedRange:(%u, %u)", isAttributedString ? [string string] : string, newSelRange.location, newSelRange.length);
@@ -5853,8 +5931,8 @@ static void extractUnderlines(NSAttributedString *string, Vector<CompositionUnde
     _private->interpretKeyEventsParameters = 0;
 
     if (parameters) {
-        parameters->eventWasHandled = YES;
-        parameters->consumedByIM = NO;
+        parameters->eventInterpretationHadSideEffects = true;
+        parameters->consumedByIM = false;
     }
     
     Frame* coreFrame = core([self _frame]);
@@ -5869,7 +5947,7 @@ static void extractUnderlines(NSAttributedString *string, Vector<CompositionUnde
 
     if (isAttributedString) {
         unsigned markedTextLength = [(NSString *)string length];
-        NSString *rangeString = [string attribute:NSTextInputReplacementRangeAttributeName atIndex:0 longestEffectiveRange:NULL inRange:NSMakeRange(0, markedTextLength)];
+        NSString *rangeString = [string attribute:NSTextInputReplacementRangeAttributeName atIndex:0 longestEffectiveRange:0 inRange:NSMakeRange(0, markedTextLength)];
         LOG(TextInput, "    ReplacementRange: %@", rangeString);
         // The AppKit adds a 'secret' property to the string that contains the replacement range.
         // The replacement range is the range of the the text that should be replaced with the new string.
@@ -5891,17 +5969,16 @@ static void extractUnderlines(NSAttributedString *string, Vector<CompositionUnde
     // The same call to interpretKeyEvents can do more than one command.
     WebHTMLViewInterpretKeyEventsParameters* parameters = _private->interpretKeyEventsParameters;
     if (parameters)
-        parameters->consumedByIM = NO;
-
-    if (selector == @selector(noop:)) {
-        _private->receivedNOOP = YES;
-        return;
-    }
+        parameters->consumedByIM = false;
 
     KeyboardEvent* event = parameters ? parameters->event : 0;
-    bool shouldSaveCommand = parameters && parameters->shouldSaveCommand;
+    bool shouldSaveCommand = parameters && parameters->shouldSaveCommands;
+
+    // As in insertText:, we assume that the call comes from an input method if there is marked text.
+    RefPtr<Frame> coreFrame = core([self _frame]);
+    bool isFromInputMethod = coreFrame && coreFrame->editor()->hasComposition();
 
-    if (event && shouldSaveCommand)
+    if (event && shouldSaveCommand && !isFromInputMethod)
         event->keypressCommands().append(KeypressCommand(NSStringFromSelector(selector)));
     else {
         // Make sure that only direct calls to doCommandBySelector: see the parameters by setting to 0.
@@ -5933,10 +6010,8 @@ static void extractUnderlines(NSAttributedString *string, Vector<CompositionUnde
         }
 
         if (parameters)
-            parameters->eventWasHandled = eventWasHandled;
+            parameters->eventInterpretationHadSideEffects |= eventWasHandled;
 
-        // Restore the parameters so that other calls to doCommandBySelector: see them,
-        // and other commands can participate in setting the "eventWasHandled" flag.
         _private->interpretKeyEventsParameters = parameters;
     }
 }
@@ -5948,9 +6023,8 @@ static void extractUnderlines(NSAttributedString *string, Vector<CompositionUnde
     LOG(TextInput, "insertText:\"%@\"", isAttributedString ? [string string] : string);
 
     WebHTMLViewInterpretKeyEventsParameters* parameters = _private->interpretKeyEventsParameters;
-    _private->interpretKeyEventsParameters = 0;
     if (parameters)
-        parameters->consumedByIM = NO;
+        parameters->consumedByIM = false;
 
     // We don't support inserting an attributed string but input methods don't appear to require this.
     RefPtr<Frame> coreFrame = core([self _frame]);
@@ -5960,57 +6034,48 @@ static void extractUnderlines(NSAttributedString *string, Vector<CompositionUnde
         text = [string string];
         // We deal with the NSTextInputReplacementRangeAttributeName attribute from NSAttributedString here
         // simply because it is used by at least one Input Method -- it corresonds to the kEventParamTextInputSendReplaceRange
-        // event in TSM.  This behaviour matches that of -[WebHTMLView setMarkedText:selectedRange:] when it receives an
+        // event in TSM. This behavior matches that of -[WebHTMLView setMarkedText:selectedRange:] when it receives an
         // NSAttributedString
-        NSString *rangeString = [string attribute:NSTextInputReplacementRangeAttributeName atIndex:0 longestEffectiveRange:NULL inRange:NSMakeRange(0, [text length])];
+        NSString *rangeString = [string attribute:NSTextInputReplacementRangeAttributeName atIndex:0 longestEffectiveRange:0 inRange:NSMakeRange(0, [text length])];
         LOG(TextInput, "    ReplacementRange: %@", rangeString);
         if (rangeString) {
             [[self _frame] _selectNSRange:NSRangeFromString(rangeString)];
-            isFromInputMethod = YES;
+            isFromInputMethod = true;
         }
     } else
         text = string;
 
-    bool eventHandled = false;
-    if ([text length]) {
-        KeyboardEvent* event = parameters ? parameters->event : 0;
-
-        // insertText can be called from an input method or from normal key event processing
-        // If its from normal key event processing, we may need to save the action to perform it later.
-        // If its from an input method, then we should go ahead and insert the text now.  
-        // We assume it's from the input method if we have marked text.
-        // FIXME: In theory, this could be wrong for some input methods, so we should try to find
-        // another way to determine if the call is from the input method
-        bool shouldSaveCommand = parameters && parameters->shouldSaveCommand;
-        if (event && shouldSaveCommand && !isFromInputMethod) {
-            event->keypressCommands().append(KeypressCommand("insertText:", text));
-            _private->interpretKeyEventsParameters = parameters;
-            return;
-        }
-        
-        String eventText = text;
-        eventText.replace(NSBackTabCharacter, NSTabCharacter); // same thing is done in KeyEventMac.mm in WebCore
-        if (coreFrame && coreFrame->editor()->canEdit()) {
-            if (!coreFrame->editor()->hasComposition())
-                eventHandled = coreFrame->editor()->insertText(eventText, event);
-            else {
-                eventHandled = true;
-                coreFrame->editor()->confirmComposition(eventText);
-            }
-        }
-    }
-    
-    if (!parameters)
+    KeyboardEvent* event = parameters ? parameters->event : 0;
+
+    // insertText can be called for several reasons:
+    // - If it's from normal key event processing (including key bindings), we may need to save the action to perform it later.
+    // - If it's from an input method, then we should go ahead and insert the text now. We assume it's from the input method if we have marked text.
+    // FIXME: In theory, this could be wrong for some input methods, so we should try to find another way to determine if the call is from the input method.
+    // - If it's sent outside of keyboard event processing (e.g. from Character Viewer, or when confirming an inline input area with a mouse),
+    // then we also execute it immediately, as there will be no other chance.
+    bool shouldSaveCommand = parameters && parameters->shouldSaveCommands;
+    if (event && shouldSaveCommand && !isFromInputMethod) {
+        event->keypressCommands().append(KeypressCommand("insertText:", text));
         return;
-    
-    if (isFromInputMethod) {
-        // Allow doCommandBySelector: to be called after insertText: by resetting interpretKeyEventsParameters
-        _private->interpretKeyEventsParameters = parameters;
-        parameters->consumedByIM = YES;
+    }
+
+    if (!coreFrame || !coreFrame->editor()->canEdit())
         return;
+
+    bool eventHandled = false;
+    String eventText = text;
+    eventText.replace(NSBackTabCharacter, NSTabCharacter); // same thing is done in KeyEventMac.mm in WebCore
+    if (!coreFrame->editor()->hasComposition()) {
+        // An insertText: might be handled by other responders in the chain if we don't handle it.
+        // One example is space bar that results in scrolling down the page.
+        eventHandled = coreFrame->editor()->insertText(eventText, event);
+    } else {
+        eventHandled = true;
+        coreFrame->editor()->confirmComposition(eventText);
     }
     
-    parameters->eventWasHandled = eventHandled;
+    if (parameters)
+        parameters->eventInterpretationHadSideEffects |= eventHandled;
 }
 
 - (void)_updateSelectionForInputManager
diff --git a/Source/WebKit/mac/WebView/WebHTMLViewInternal.h b/Source/WebKit/mac/WebView/WebHTMLViewInternal.h
index 07a782a..d38fded 100644
--- a/Source/WebKit/mac/WebView/WebHTMLViewInternal.h
+++ b/Source/WebKit/mac/WebView/WebHTMLViewInternal.h
@@ -49,7 +49,7 @@ namespace WebCore {
 - (WebFrame *)_frame;
 - (void)_lookUpInDictionaryFromMenu:(id)sender;
 - (void)_hoverFeedbackSuspendedChanged;
-- (BOOL)_interceptEditingKeyEvent:(WebCore::KeyboardEvent *)event shouldSaveCommand:(BOOL)shouldSave;
+- (BOOL)_interpretKeyEvent:(WebCore::KeyboardEvent *)event savingCommands:(BOOL)savingCommands;
 - (DOMDocumentFragment *)_documentFragmentFromPasteboard:(NSPasteboard *)pasteboard;
 - (NSEvent *)_mouseDownEvent;
 #ifndef BUILDING_ON_TIGER
diff --git a/Source/WebKit/mac/WebView/WebPreferenceKeysPrivate.h b/Source/WebKit/mac/WebView/WebPreferenceKeysPrivate.h
index b6ae03f..a2f176a 100644
--- a/Source/WebKit/mac/WebView/WebPreferenceKeysPrivate.h
+++ b/Source/WebKit/mac/WebView/WebPreferenceKeysPrivate.h
@@ -89,6 +89,7 @@
 #define WebKitJavaScriptCanAccessClipboardPreferenceKey @"WebKitJavaScriptCanAccessClipboard"
 #define WebKitXSSAuditorEnabledPreferenceKey @"WebKitXSSAuditorEnabled"
 #define WebKitAcceleratedDrawingEnabledPreferenceKey @"WebKitAcceleratedDrawingEnabled"
+#define WebKitCanvasUsesAcceleratedDrawingPreferenceKey @"WebKitCanvasUsesAcceleratedDrawing"
 #define WebKitAcceleratedCompositingEnabledPreferenceKey @"WebKitAcceleratedCompositingEnabled"
 #define WebKitShowDebugBordersPreferenceKey @"WebKitShowDebugBorders"
 #define WebKitShowRepaintCounterPreferenceKey @"WebKitShowRepaintCounter"
@@ -104,6 +105,7 @@
 #define WebKitAsynchronousSpellCheckingEnabledPreferenceKey @"WebKitAsynchronousSpellCheckingEnabled"
 #define WebKitMemoryInfoEnabledPreferenceKey @"WebKitMemoryInfoEnabled"
 #define WebKitHyperlinkAuditingEnabledPreferenceKey @"WebKitHyperlinkAuditingEnabled"
+#define WebKitUseQuickLookResourceCachingQuirksPreferenceKey @"WebKitUseQuickLookResourceCachingQuirks"
 
 // These are private both because callers should be using the cover methods and because the
 // cover methods themselves are private.
diff --git a/Source/WebKit/mac/WebView/WebPreferences.mm b/Source/WebKit/mac/WebView/WebPreferences.mm
index 3fd41f6..a5f24e0 100644
--- a/Source/WebKit/mac/WebView/WebPreferences.mm
+++ b/Source/WebKit/mac/WebView/WebPreferences.mm
@@ -136,6 +136,22 @@ static WebCacheModel cacheModelForMainBundle(void)
     return cacheModel;
 }
 
+static bool useQuickLookQuirks(void)
+{
+    NSArray* frameworks = [NSBundle allFrameworks];
+                           
+    if (!frameworks)
+        return false;
+
+    for (unsigned int i = 0; i < [frameworks count]; i++) {
+        NSBundle* bundle = [frameworks objectAtIndex: i];
+        const char* bundleID = [[bundle bundleIdentifier] UTF8String];
+        if (bundleID && !strcasecmp(bundleID, "com.apple.QuickLookUIFramework"))
+            return true;
+    }
+    return false;
+}
+
 @interface WebPreferencesPrivate : NSObject
 {
 @public
@@ -359,6 +375,7 @@ static WebCacheModel cacheModelForMainBundle(void)
         [NSNumber numberWithBool:YES],  WebKitXSSAuditorEnabledPreferenceKey,
         [NSNumber numberWithBool:YES],  WebKitAcceleratedCompositingEnabledPreferenceKey,
         [NSNumber numberWithBool:NO],  WebKitAcceleratedDrawingEnabledPreferenceKey,
+        [NSNumber numberWithBool:YES],  WebKitCanvasUsesAcceleratedDrawingPreferenceKey,
         [NSNumber numberWithBool:NO],   WebKitShowDebugBordersPreferenceKey,
         [NSNumber numberWithBool:NO],   WebKitShowRepaintCounterPreferenceKey,
         [NSNumber numberWithBool:NO],   WebKitWebGLEnabledPreferenceKey,
@@ -367,11 +384,12 @@ static WebCacheModel cacheModelForMainBundle(void)
         [NSNumber numberWithBool:NO],   WebKitFrameFlatteningEnabledPreferenceKey,
         [NSNumber numberWithBool:NO],   WebKitSpatialNavigationEnabledPreferenceKey,
         [NSNumber numberWithBool:NO],  WebKitDNSPrefetchingEnabledPreferenceKey,
-        [NSNumber numberWithBool:NO],   WebKitFullScreenEnabledPreferenceKey,
+        [NSNumber numberWithBool:YES],  WebKitFullScreenEnabledPreferenceKey,
         [NSNumber numberWithBool:NO],   WebKitAsynchronousSpellCheckingEnabledPreferenceKey,
         [NSNumber numberWithBool:NO],   WebKitMemoryInfoEnabledPreferenceKey,
         [NSNumber numberWithBool:YES],  WebKitHyperlinkAuditingEnabledPreferenceKey,
         [NSNumber numberWithBool:NO],   WebKitUsePreHTML5ParserQuirksKey,
+        [NSNumber numberWithBool:useQuickLookQuirks()], WebKitUseQuickLookResourceCachingQuirksPreferenceKey,
         [NSNumber numberWithLongLong:WebCore::ApplicationCacheStorage::noQuota()], WebKitApplicationCacheTotalQuota,
         [NSNumber numberWithLongLong:WebCore::ApplicationCacheStorage::noQuota()], WebKitApplicationCacheDefaultOriginQuota,
         nil];
@@ -1245,6 +1263,16 @@ static NSString *classIBCreatorID = nil;
     [self _setBoolValue:enabled forKey:WebKitAcceleratedDrawingEnabledPreferenceKey];
 }
 
+- (BOOL)canvasUsesAcceleratedDrawing
+{
+    return [self _boolValueForKey:WebKitCanvasUsesAcceleratedDrawingPreferenceKey];
+}
+
+- (void)setCanvasUsesAcceleratedDrawing:(BOOL)enabled
+{
+    [self _setBoolValue:enabled forKey:WebKitCanvasUsesAcceleratedDrawingPreferenceKey];
+}
+
 - (BOOL)acceleratedCompositingEnabled
 {
     return [self _boolValueForKey:WebKitAcceleratedCompositingEnabledPreferenceKey];
@@ -1385,6 +1413,11 @@ static NSString *classIBCreatorID = nil;
     [self _setBoolValue:flag forKey:WebKitUsePreHTML5ParserQuirksKey];
 }
 
+- (BOOL)useQuickLookResourceCachingQuirks
+{
+    return [self _boolValueForKey:WebKitUseQuickLookResourceCachingQuirksPreferenceKey];
+}
+
 - (void)didRemoveFromWebView
 {
     ASSERT(_private->numWebViews);
diff --git a/Source/WebKit/mac/WebView/WebPreferencesPrivate.h b/Source/WebKit/mac/WebView/WebPreferencesPrivate.h
index 40d4b5b..7e1f6a2 100644
--- a/Source/WebKit/mac/WebView/WebPreferencesPrivate.h
+++ b/Source/WebKit/mac/WebView/WebPreferencesPrivate.h
@@ -179,6 +179,9 @@ extern NSString *WebPreferencesRemovedNotification;
 - (BOOL)acceleratedDrawingEnabled;
 - (void)setAcceleratedDrawingEnabled:(BOOL)enabled;
 
+- (BOOL)canvasUsesAcceleratedDrawing;
+- (void)setCanvasUsesAcceleratedDrawing:(BOOL)enabled;
+
 - (BOOL)acceleratedCompositingEnabled;
 - (void)setAcceleratedCompositingEnabled:(BOOL)enabled;
 
@@ -233,4 +236,6 @@ extern NSString *WebPreferencesRemovedNotification;
 - (void)setUsePreHTML5ParserQuirks:(BOOL)flag;
 - (BOOL)usePreHTML5ParserQuirks;
 
+- (BOOL)useQuickLookResourceCachingQuirks;
+
 @end
diff --git a/Source/WebKit/mac/WebView/WebScriptDebugDelegate.mm b/Source/WebKit/mac/WebView/WebScriptDebugDelegate.mm
index 270266b..738c4df 100644
--- a/Source/WebKit/mac/WebView/WebScriptDebugDelegate.mm
+++ b/Source/WebKit/mac/WebView/WebScriptDebugDelegate.mm
@@ -239,7 +239,7 @@ NSString * const WebScriptErrorLineNumberKey = @"WebScriptErrorLineNumber";
     if (self == _private->debugger->globalCallFrame() && !globalObject->globalData().dynamicGlobalObject) {
         JSGlobalObject* globalObject = _private->debugger->globalObject();
 
-        DynamicGlobalObjectScope globalObjectScope(globalObject->globalExec(), globalObject);
+        DynamicGlobalObjectScope globalObjectScope(globalObject->globalData(), globalObject);
 
         JSValue exception;
         JSValue result = evaluateInGlobalCallFrame(stringToUString(script), exception, globalObject);
diff --git a/Source/WebKit/mac/WebView/WebView.mm b/Source/WebKit/mac/WebView/WebView.mm
index 2f45ca4..3d42be0 100644
--- a/Source/WebKit/mac/WebView/WebView.mm
+++ b/Source/WebKit/mac/WebView/WebView.mm
@@ -97,6 +97,7 @@
 #import "WebPreferencesPrivate.h"
 #import "WebScriptDebugDelegate.h"
 #import "WebScriptWorldInternal.h"
+#import "WebStorageManagerInternal.h"
 #import "WebSystemInterface.h"
 #import "WebTextCompletionController.h"
 #import "WebTextIterator.h"
@@ -687,6 +688,10 @@ static NSString *leakMailQuirksUserScriptPath()
 #if ENABLE(DATABASE)
         WebKitInitializeDatabasesIfNecessary();
 #endif
+
+#if ENABLE(DOM_STORAGE)
+        WebKitInitializeStorageIfNecessary();
+#endif
         WebKitInitializeApplicationCachePathIfNecessary();
         patchMailRemoveAttributesMethod();
         
@@ -1491,6 +1496,8 @@ static bool fastDocumentTeardownEnabled()
     // Until we fix that, I will comment out the test (CFM)
     settings->setAcceleratedCompositingEnabled((coreVideoHas7228836Fix() || [preferences webGLEnabled] || 
         [preferences accelerated2dCanvasEnabled]) && [preferences acceleratedCompositingEnabled]);
+    settings->setAcceleratedDrawingEnabled([preferences acceleratedDrawingEnabled]);
+    settings->setCanvasUsesAcceleratedDrawing([preferences canvasUsesAcceleratedDrawing]);    
     settings->setShowDebugBorders([preferences showDebugBorders]);
     settings->setShowRepaintCounter([preferences showRepaintCounter]);
     settings->setPluginAllowedRunTime([preferences pluginAllowedRunTime]);
@@ -1511,7 +1518,10 @@ static bool fastDocumentTeardownEnabled()
     settings->setMemoryInfoEnabled([preferences memoryInfoEnabled]);
     settings->setHyperlinkAuditingEnabled([preferences hyperlinkAuditingEnabled]);
     settings->setUsePreHTML5ParserQuirks([self _needsPreHTML5ParserQuirks]);
+    settings->setUseQuickLookResourceCachingQuirks([preferences useQuickLookResourceCachingQuirks]);
     settings->setCrossOriginCheckInGetMatchedCSSRulesDisabled([self _needsUnrestrictedGetMatchedCSSRules]);
+    settings->setInteractiveFormValidationEnabled([self interactiveFormValidationEnabled]);
+    settings->setValidationMessageTimerMagnification([self validationMessageTimerMagnification]);
 
     // Application Cache Preferences are stored on the global cache storage manager, not in Settings.
     [WebApplicationCache setDefaultOriginQuota:[preferences applicationCacheDefaultOriginQuota]];
@@ -2396,6 +2406,26 @@ static inline IMP getMethod(id o, SEL s)
     return NO;
 }
 
+- (BOOL)interactiveFormValidationEnabled
+{
+    return _private->interactiveFormValidationEnabled;
+}
+
+- (void)setInteractiveFormValidationEnabled:(BOOL)enabled
+{
+    _private->interactiveFormValidationEnabled = enabled;
+}
+
+- (int)validationMessageTimerMagnification
+{
+    return _private->validationMessageTimerMagnification;
+}
+
+- (void)setValidationMessageTimerMagnification:(int)newValue
+{
+    _private->validationMessageTimerMagnification = newValue;
+}
+
 - (BOOL)_isSoftwareRenderable
 {
 #if USE(ACCELERATED_COMPOSITING)
@@ -5000,12 +5030,12 @@ static NSAppleEventDescriptor* aeDescFromJSValue(ExecState* exec, JSValue jsValu
 
 - (void)setEditable:(BOOL)flag
 {
-    if ([self isEditable] != flag) {
-        if (!_private->tabKeyCyclesThroughElementsChanged && _private->page)
+    if ([self isEditable] != flag && _private->page) {
+        _private->page->setEditable(flag);
+        if (!_private->tabKeyCyclesThroughElementsChanged)
             _private->page->setTabKeyCyclesThroughElements(!flag);
         Frame* mainFrame = [self _mainCoreFrame];
         if (mainFrame) {
-            mainFrame->document()->setDesignMode(flag ? WebCore::Document::on : WebCore::Document::off);
             if (flag) {
                 mainFrame->editor()->applyEditingStyleToBodyElement();
                 // If the WebView is made editable and the selection is empty, set it to something.
@@ -5018,10 +5048,7 @@ static NSAppleEventDescriptor* aeDescFromJSValue(ExecState* exec, JSValue jsValu
 
 - (BOOL)isEditable
 {
-    Frame* mainFrame = [self _mainCoreFrame];
-    if (mainFrame)
-        return mainFrame->document()->inDesignMode();
-    return false;
+    return _private->page && _private->page->isEditable();
 }
 
 - (void)setTypingStyle:(DOMCSSStyleDeclaration *)style
@@ -5306,6 +5333,16 @@ static NSAppleEventDescriptor* aeDescFromJSValue(ExecState* exec, JSValue jsValu
 
 #endif
 
+#if !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD) && !defined(BUILDING_ON_SNOW_LEOPARD)
+- (void)handleCorrectionPanelResult:(NSString*)result
+{
+    WebFrame *webFrame = [self _selectedOrMainFrame];
+    Frame* coreFrame = core(webFrame);
+    if (coreFrame)
+        coreFrame->editor()->handleCorrectionPanelResult(result);
+}
+#endif
+
 @end
 
 @implementation WebView (WebViewUndoableEditing)
@@ -5415,7 +5452,7 @@ FOR_EACH_RESPONDER_SELECTOR(FORWARD)
     Frame* coreFrame = core([self _selectedOrMainFrame]);
     if (!coreFrame)
         return NO;
-    return coreFrame->selection()->isAll(MayLeaveEditableContent);
+    return coreFrame->selection()->isAll(CanCrossEditingBoundary);
 }
 
 @end
@@ -5859,7 +5896,7 @@ static inline uint64_t roundUpToPowerOf2(uint64_t num)
 
     WebFrameLoadDelegateImplementationCache* cache = &_private->frameLoadDelegateImplementations;
     if (cache->didReceiveIconForFrameFunc) {
-        Image* image = iconDatabase().iconForPageURL(core(webFrame)->document()->url().string(), IntSize(16, 16));
+        Image* image = iconDatabase().synchronousIconForPageURL(core(webFrame)->document()->url().string(), IntSize(16, 16));
         if (NSImage *icon = webGetNSImage(image, NSMakeSize(16, 16)))
             CallFrameLoadDelegate(cache->didReceiveIconForFrameFunc, self, @selector(webView:didReceiveIcon:forFrame:), icon, webFrame);
     }
@@ -6120,8 +6157,11 @@ static void layerSyncRunLoopObserverCallBack(CFRunLoopObserverRef, CFRunLoopActi
 #endif
 
 #if ENABLE(FULLSCREEN_API)
-- (BOOL)_supportsFullScreenForElement:(const WebCore::Element*)element
+- (BOOL)_supportsFullScreenForElement:(const WebCore::Element*)element withKeyboard:(BOOL)withKeyboard
 {
+    if (withKeyboard)
+        return NO;
+
     if (![[WebPreferences standardPreferences] fullScreenEnabled])
         return NO;
 
diff --git a/Source/WebKit/mac/WebView/WebViewData.h b/Source/WebKit/mac/WebView/WebViewData.h
index e8b9188..a6a5a07 100644
--- a/Source/WebKit/mac/WebView/WebViewData.h
+++ b/Source/WebKit/mac/WebView/WebViewData.h
@@ -186,5 +186,8 @@ extern int pluginDatabaseClientCount;
     id<WebDeviceOrientationProvider> m_deviceOrientationProvider;
 
     RefPtr<WebCore::HistoryItem> _globalHistoryItem;
+
+    BOOL interactiveFormValidationEnabled;
+    int validationMessageTimerMagnification;
 }
 @end
diff --git a/Source/WebKit/mac/WebView/WebViewData.mm b/Source/WebKit/mac/WebView/WebViewData.mm
index df7563e..e74c7a1 100644
--- a/Source/WebKit/mac/WebView/WebViewData.mm
+++ b/Source/WebKit/mac/WebView/WebViewData.mm
@@ -65,6 +65,10 @@ int pluginDatabaseClientCount = 0;
     zoomMultiplier = 1;
     zoomsTextOnly = NO;
 
+    interactiveFormValidationEnabled = NO;
+    // The default value should be synchronized with WebCore/page/Settings.cpp.
+    validationMessageTimerMagnification = 50;
+
 #if ENABLE(DASHBOARD_SUPPORT)
     dashboardBehaviorAllowWheelScrolling = YES;
 #endif
diff --git a/Source/WebKit/mac/WebView/WebViewInternal.h b/Source/WebKit/mac/WebView/WebViewInternal.h
index 9517104..65cb4d8 100644
--- a/Source/WebKit/mac/WebView/WebViewInternal.h
+++ b/Source/WebKit/mac/WebView/WebViewInternal.h
@@ -57,7 +57,6 @@ namespace WebCore {
 #ifdef __cplusplus
 
 @interface WebView (WebViewEditingExtras)
-- (BOOL)_interceptEditingKeyEvent:(WebCore::KeyboardEvent*)event shouldSaveCommand:(BOOL)shouldSave;
 - (BOOL)_shouldChangeSelectedDOMRange:(DOMRange *)currentRange toDOMRange:(DOMRange *)proposedRange affinity:(NSSelectionAffinity)selectionAffinity stillSelecting:(BOOL)flag;
 @end
 
@@ -190,7 +189,7 @@ namespace WebCore {
 #endif
 
 #if ENABLE(FULLSCREEN_API) && defined(__cplusplus)
-- (BOOL)_supportsFullScreenForElement:(WebCore::Element*)element;
+- (BOOL)_supportsFullScreenForElement:(WebCore::Element*)element withKeyboard:(BOOL)withKeyboard;
 - (void)_enterFullScreenForElement:(WebCore::Element*)element;
 - (void)_exitFullScreenForElement:(WebCore::Element*)element;
 - (void)_fullScreenRendererChanged:(WebCore::RenderBox*)renderer;
diff --git a/Source/WebKit/mac/WebView/WebViewPrivate.h b/Source/WebKit/mac/WebView/WebViewPrivate.h
index a4ea809..7d7537e 100644
--- a/Source/WebKit/mac/WebView/WebViewPrivate.h
+++ b/Source/WebKit/mac/WebView/WebViewPrivate.h
@@ -487,6 +487,12 @@ Could be worth adding to the API.
 - (void)_setPostsAcceleratedCompositingNotifications:(BOOL)flag;
 - (BOOL)_isUsingAcceleratedCompositing;
 
+// For DumpRenderTree
+- (BOOL)interactiveFormValidationEnabled;
+- (void)setInteractiveFormValidationEnabled:(BOOL)enabled;
+- (int)validationMessageTimerMagnification;
+- (void)setValidationMessageTimerMagnification:(int)newValue;
+
 // Returns YES if NSView -displayRectIgnoringOpacity:inContext: will produce a faithful representation of the content.
 - (BOOL)_isSoftwareRenderable;
 // When drawing into a bitmap context, we normally flatten compositing layers (and distort 3D transforms).
@@ -644,7 +650,9 @@ Could be worth adding to the API.
 - (void)setAutomaticSpellingCorrectionEnabled:(BOOL)flag;
 - (void)toggleAutomaticSpellingCorrection:(id)sender;
 #endif
-
+#if !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD) && !defined(BUILDING_ON_SNOW_LEOPARD)
+- (void)handleCorrectionPanelResult:(NSString*)result;
+#endif
 @end
 
 @interface WebView (WebViewEditingInMail)
diff --git a/Source/WebKit/qt/Api/DerivedSources.pro b/Source/WebKit/qt/Api/DerivedSources.pro
index 8084242..8be6748 100644
--- a/Source/WebKit/qt/Api/DerivedSources.pro
+++ b/Source/WebKit/qt/Api/DerivedSources.pro
@@ -19,7 +19,6 @@ win32-msvc* | wince* {
 } else {
     QUOTE = "\'"
     DOUBLE_ESCAPED_QUOTE = "\\\'"
-    ESCAPE = "\\"
 }
 
 qtheader_module.target = $${DESTDIR}/QtWebKit
diff --git a/Source/WebKit/qt/Api/qgraphicswebview.cpp b/Source/WebKit/qt/Api/qgraphicswebview.cpp
index b1c9586..b7b28bc 100644
--- a/Source/WebKit/qt/Api/qgraphicswebview.cpp
+++ b/Source/WebKit/qt/Api/qgraphicswebview.cpp
@@ -55,7 +55,8 @@ public:
     QGraphicsWebViewPrivate(QGraphicsWebView* parent)
         : q(parent)
         , page(0)
-        , resizesToContents(false) {}
+        , resizesToContents(false)
+        , renderHints(QPainter::TextAntialiasing | QPainter::SmoothPixmapTransform) {}
 
     virtual ~QGraphicsWebViewPrivate();
 
@@ -74,6 +75,7 @@ public:
     QGraphicsWebView* q;
     QWebPage* page;
     bool resizesToContents;
+    QPainter::RenderHints renderHints;
 
     QGraphicsItemOverlay* overlay() const
     {
@@ -279,6 +281,8 @@ QWebPage* QGraphicsWebView::page() const
 */
 void QGraphicsWebView::paint(QPainter* painter, const QStyleOptionGraphicsItem* option, QWidget*)
 {
+    QPainter::RenderHints oldHints = painter->renderHints();
+    painter->setRenderHints(oldHints | d->renderHints);
 #if ENABLE(TILED_BACKING_STORE)
     if (WebCore::TiledBackingStore* backingStore = QWebFramePrivate::core(page()->mainFrame())->tiledBackingStore()) {
         // FIXME: We should set the backing store viewport earlier than in paint
@@ -286,6 +290,7 @@ void QGraphicsWebView::paint(QPainter* painter, const QStyleOptionGraphicsItem*
         // QWebFrame::render is a public API, bypass it for tiled rendering so behavior does not need to change.
         WebCore::GraphicsContext context(painter); 
         page()->mainFrame()->d->renderFromTiledBackingStore(&context, option->exposedRect.toAlignedRect());
+        painter->setRenderHints(oldHints);
         return;
     } 
 #endif
@@ -294,6 +299,7 @@ void QGraphicsWebView::paint(QPainter* painter, const QStyleOptionGraphicsItem*
 #else
     page()->mainFrame()->render(painter, QWebFrame::AllLayers, option->exposedRect.toRect());
 #endif
+    painter->setRenderHints(oldHints);
 }
 
 /*! \reimp
@@ -357,6 +363,65 @@ QVariant QGraphicsWebView::inputMethodQuery(Qt::InputMethodQuery query) const
     return QVariant();
 }
 
+/*!
+    \property QGraphicsWebView::renderHints
+    \since 4.8
+    \brief the default render hints for the view
+
+    These hints are used to initialize QPainter before painting the Web page.
+
+    QPainter::TextAntialiasing and QPainter::SmoothPixmapTransform are enabled by default and will be
+    used to render the item in addition of what has been set on the painter given by QGraphicsScene.
+
+    \note This property is not available on Symbian. However, the getter and
+    setter functions can still be used directly.
+
+    \sa QPainter::renderHints()
+*/
+
+/*!
+    \since 4.8
+    Returns the render hints used by the view to render content.
+
+    \sa QPainter::renderHints()
+*/
+QPainter::RenderHints QGraphicsWebView::renderHints() const
+{
+    return d->renderHints;
+}
+
+/*!
+    \since 4.8
+    Sets the render hints used by the view to the specified \a hints.
+
+    \sa QPainter::setRenderHints()
+*/
+void QGraphicsWebView::setRenderHints(QPainter::RenderHints hints)
+{
+    if (hints == d->renderHints)
+        return;
+    d->renderHints = hints;
+    update();
+}
+
+/*!
+    \since 4.8
+    If \a enabled is true, enables the specified render \a hint; otherwise
+    disables it.
+
+    \sa renderHints, QPainter::renderHints()
+*/
+void QGraphicsWebView::setRenderHint(QPainter::RenderHint hint, bool enabled)
+{
+    QPainter::RenderHints oldHints = d->renderHints;
+    if (enabled)
+        d->renderHints |= hint;
+    else
+        d->renderHints &= ~hint;
+    if (oldHints != d->renderHints)
+        update();
+}
+
 /*! \reimp
 */
 bool QGraphicsWebView::event(QEvent* event)
diff --git a/Source/WebKit/qt/Api/qgraphicswebview.h b/Source/WebKit/qt/Api/qgraphicswebview.h
index 733c224..ceb0ad8 100644
--- a/Source/WebKit/qt/Api/qgraphicswebview.h
+++ b/Source/WebKit/qt/Api/qgraphicswebview.h
@@ -50,6 +50,9 @@ class QWEBKIT_EXPORT QGraphicsWebView : public QGraphicsWidget {
     Q_PROPERTY(bool resizesToContents READ resizesToContents WRITE setResizesToContents)
     Q_PROPERTY(bool tiledBackingStoreFrozen READ isTiledBackingStoreFrozen WRITE setTiledBackingStoreFrozen)
 
+    Q_PROPERTY(QPainter::RenderHints renderHints READ renderHints WRITE setRenderHints)
+    Q_FLAGS(QPainter::RenderHints)
+
 public:
     explicit QGraphicsWebView(QGraphicsItem* parent = 0);
     ~QGraphicsWebView();
@@ -99,6 +102,10 @@ public:
 
     virtual QVariant inputMethodQuery(Qt::InputMethodQuery query) const;
 
+    QPainter::RenderHints renderHints() const;
+    void setRenderHints(QPainter::RenderHints);
+    void setRenderHint(QPainter::RenderHint, bool enabled = true);
+
 public Q_SLOTS:
     void stop();
     void back();
diff --git a/Source/WebKit/qt/Api/qwebframe.cpp b/Source/WebKit/qt/Api/qwebframe.cpp
index 6f98bca..e5124bd 100644
--- a/Source/WebKit/qt/Api/qwebframe.cpp
+++ b/Source/WebKit/qt/Api/qwebframe.cpp
@@ -731,7 +731,7 @@ QMultiMap<QString, QString> QWebFrame::metaData() const
 
 static inline QUrl ensureAbsoluteUrl(const QUrl &url)
 {
-    if (!url.isRelative())
+    if (!url.isValid() || !url.isRelative())
         return url;
 
     // This contains the URL with absolute path but without 
@@ -780,26 +780,7 @@ QUrl QWebFrame::url() const
 */
 QUrl QWebFrame::requestedUrl() const
 {
-    // There are some possible edge cases to be handled here,
-    // apart from checking if activeDocumentLoader is valid:
-    //
-    // * Method can be called while processing an unsucessful load.
-    //   In this case, frameLoaderClient will hold the current error
-    //   (m_loadError), and we will make use of it to recover the 'failingURL'.
-    // * If the 'failingURL' holds a null'ed string though, we fallback
-    //   to 'outgoingReferrer' (it yet is safer than originalRequest).
-    FrameLoader* loader = d->frame->loader();
-    FrameLoaderClientQt* loaderClient = d->frameLoaderClient;
-
-    if (!loader->activeDocumentLoader()
-        || !loaderClient->m_loadError.isNull()) {
-        if (!loaderClient->m_loadError.failingURL().isNull())
-            return QUrl(loaderClient->m_loadError.failingURL());
-        else if (!loader->outgoingReferrer().isEmpty())
-            return QUrl(loader->outgoingReferrer());
-    }
-
-    return loader->originalRequest().url();
+    return d->frameLoaderClient->lastRequestedUrl();
 }
 /*!
     \since 4.6
@@ -893,11 +874,9 @@ void QWebFrame::load(const QNetworkRequest &req,
         case QNetworkAccessManager::DeleteOperation:
             request.setHTTPMethod("DELETE");
             break;
-#if QT_VERSION >= QT_VERSION_CHECK(4, 7, 0)
         case QNetworkAccessManager::CustomOperation:
             request.setHTTPMethod(req.attribute(QNetworkRequest::CustomVerbAttribute).toByteArray().constData());
             break;
-#endif
         case QNetworkAccessManager::UnknownOperation:
             // eh?
             break;
diff --git a/Source/WebKit/qt/Api/qwebhistory.cpp b/Source/WebKit/qt/Api/qwebhistory.cpp
index a9761de..33bad41 100644
--- a/Source/WebKit/qt/Api/qwebhistory.cpp
+++ b/Source/WebKit/qt/Api/qwebhistory.cpp
@@ -23,11 +23,13 @@
 #include "qwebframe_p.h"
 
 #include "BackForwardListImpl.h"
-#include "PlatformString.h"
+#include "IconDatabaseBase.h"
 #include "Image.h"
+#include "IntSize.h"
 #include "KURL.h"
 #include "Page.h"
 #include "PageGroup.h"
+#include "PlatformString.h"
 
 #include <QSharedData>
 #include <QDebug>
@@ -156,7 +158,8 @@ QDateTime QWebHistoryItem::lastVisited() const
 QIcon QWebHistoryItem::icon() const
 {
     if (d->item)
-        return *d->item->icon()->nativeImageForCurrentFrame();
+        return *WebCore::iconDatabase().synchronousIconForPageURL(d->item->url(), WebCore::IntSize(16, 16))->nativeImageForCurrentFrame();
+
     return QIcon();
 }
 
diff --git a/Source/WebKit/qt/Api/qwebhistoryinterface.cpp b/Source/WebKit/qt/Api/qwebhistoryinterface.cpp
index 61cf5af..40ff5c9 100644
--- a/Source/WebKit/qt/Api/qwebhistoryinterface.cpp
+++ b/Source/WebKit/qt/Api/qwebhistoryinterface.cpp
@@ -69,8 +69,8 @@ void QWebHistoryInterface::setDefaultInterface(QWebHistoryInterface* defaultInte
 
 /*!
   Returns the default interface that will be used by WebKit. If no default interface has been set,
-  Webkit will not keep track of visited links and a null pointer will be returned.
-  \sa setDefaultInterface
+  WebKit will not keep track of visited links and a null pointer will be returned.
+  \sa setDefaultInterface()
 */
 QWebHistoryInterface* QWebHistoryInterface::defaultInterface()
 {
diff --git a/Source/WebKit/qt/Api/qwebkitplatformplugin.h b/Source/WebKit/qt/Api/qwebkitplatformplugin.h
index 2a94e0c..f274a0b 100644
--- a/Source/WebKit/qt/Api/qwebkitplatformplugin.h
+++ b/Source/WebKit/qt/Api/qwebkitplatformplugin.h
@@ -26,6 +26,7 @@
  *  and may be changed from version to version or even be completely removed.
 */
 
+#include <QColor>
 #include <QObject>
 #include <QUrl>
 #if defined(ENABLE_QT_MULTIMEDIA) && ENABLE_QT_MULTIMEDIA
@@ -46,6 +47,10 @@ public:
     virtual bool itemIsSelected(int index) const = 0;
     virtual int itemCount() const = 0;
     virtual bool multiple() const = 0;
+    virtual QColor backgroundColor() const = 0;
+    virtual QColor foregroundColor() const = 0;
+    virtual QColor itemBackgroundColor(int index) const = 0;
+    virtual QColor itemForegroundColor(int index) const = 0;
 };
 
 class QWebSelectMethod : public QObject
diff --git a/Source/WebKit/qt/Api/qwebkitversion.cpp b/Source/WebKit/qt/Api/qwebkitversion.cpp
index 181913b..1143f99 100644
--- a/Source/WebKit/qt/Api/qwebkitversion.cpp
+++ b/Source/WebKit/qt/Api/qwebkitversion.cpp
@@ -40,7 +40,7 @@
 */
 QString qWebKitVersion()
 {
-    return QString("%1.%2").arg(WEBKIT_MAJOR_VERSION).arg(WEBKIT_MINOR_VERSION);
+    return QString::fromLatin1("%1.%2").arg(WEBKIT_MAJOR_VERSION).arg(WEBKIT_MINOR_VERSION);
 }
 
 /*!
diff --git a/Source/WebKit/qt/Api/qwebpage.cpp b/Source/WebKit/qt/Api/qwebpage.cpp
index 5dd57f5..ac1d562 100644
--- a/Source/WebKit/qt/Api/qwebpage.cpp
+++ b/Source/WebKit/qt/Api/qwebpage.cpp
@@ -104,6 +104,9 @@
 #include "Scrollbar.h"
 #include "SecurityOrigin.h"
 #include "Settings.h"
+#if defined Q_OS_WIN32
+#include "SystemInfo.h"
+#endif // Q_OS_WIN32
 #include "TextIterator.h"
 #include "WebPlatformStrategies.h"
 #include "WindowFeatures.h"
@@ -312,9 +315,6 @@ QWebPagePrivate::QWebPagePrivate(QWebPage *qq)
     ScriptController::initializeThreading();
     WTF::initializeMainThread();
     WebCore::SecurityOrigin::setLocalLoadPolicy(WebCore::SecurityOrigin::AllowLocalLoadsForLocalAndSubstituteData);
-#if QT_VERSION < QT_VERSION_CHECK(4, 7, 0)
-    WebCore::Font::setCodePath(WebCore::Font::Complex);
-#endif
 
     WebPlatformStrategies::initialize();
 
@@ -1168,7 +1168,7 @@ void QWebPagePrivate::dynamicPropertyChangeEvent(QDynamicPropertyChangeEvent* ev
 
         QString p = q->property("_q_RepaintThrottlingPreset").toString();
         for(int i = 0; i < sizeof(presets) / sizeof(presets[0]); i++) {
-            if(p == presets[i].name) {
+            if (p == QLatin1String(presets[i].name)) {
                 FrameView::setRepaintThrottlingDeferredRepaintDelay(
                         presets[i].deferredRepaintDelay);
                 FrameView::setRepaintThrottlingnInitialDeferredRepaintDelayDuringLoading(
@@ -1219,6 +1219,9 @@ void QWebPagePrivate::dynamicPropertyChangeEvent(QDynamicPropertyChangeEvent* ev
     else if (event->propertyName() == "_q_webInspectorServerPort") {
         InspectorServerQt* inspectorServer = InspectorServerQt::server();
         inspectorServer->listen(inspectorServerPort());
+    } else if (event->propertyName() == "_q_deadDecodedDataDeletionInterval") {
+        double interval = q->property("_q_deadDecodedDataDeletionInterval").toDouble();
+        memoryCache()->setDeadDecodedDataDeletionInterval(interval);
     }
 }
 #endif
@@ -2070,7 +2073,7 @@ void QWebPage::javaScriptConsoleMessage(const QString& message, int lineNumber,
     // Catch plugin logDestroy message for LayoutTests/plugins/open-and-close-window-with-plugin.html
     // At this point DRT's WebPage has already been destroyed
     if (QWebPagePrivate::drtRun) {
-        if (message == "PLUGIN: NPP_Destroy")
+        if (message == QLatin1String("PLUGIN: NPP_Destroy"))
             fprintf (stdout, "CONSOLE MESSAGE: line %d: %s\n", lineNumber, message.toUtf8().constData());
     }
 }
@@ -2540,7 +2543,7 @@ QWebPage::ViewportAttributes QWebPage::viewportAttributesForSize(const QSize& av
     result.m_minimumScaleFactor = conf.minimumScale;
     result.m_maximumScaleFactor = conf.maximumScale;
     result.m_devicePixelRatio = conf.devicePixelRatio;
-    result.m_isUserScalable = conf.userScalable;
+    result.m_isUserScalable = static_cast<bool>(conf.userScalable);
 
     d->pixelRatio = conf.devicePixelRatio;
 
@@ -3169,10 +3172,10 @@ bool QWebPage::focusNextPrevChild(bool next)
 void QWebPage::setContentEditable(bool editable)
 {
     if (isContentEditable() != editable) {
+        d->page->setEditable(editable);
         d->page->setTabKeyCyclesThroughElements(!editable);
         if (d->mainFrame) {
             WebCore::Frame* frame = d->mainFrame->d->frame;
-            frame->document()->setDesignMode(editable ? WebCore::Document::on : WebCore::Document::off);
             if (editable) {
                 frame->editor()->applyEditingStyleToBodyElement();
                 // FIXME: mac port calls this if there is no selectedDOMRange
@@ -3186,7 +3189,7 @@ void QWebPage::setContentEditable(bool editable)
 
 bool QWebPage::isContentEditable() const
 {
-    return d->mainFrame && d->mainFrame->d->frame->document()->inDesignMode();
+    return d->page->isEditable();
 }
 
 /*!
@@ -3772,52 +3775,7 @@ QString QWebPage::userAgentForUrl(const QUrl&) const
 #ifdef Q_OS_AIX
         firstPartTemp += QString::fromLatin1("AIX");
 #elif defined Q_OS_WIN32
-
-        switch (QSysInfo::WindowsVersion) {
-        case QSysInfo::WV_32s:
-            firstPartTemp += QString::fromLatin1("Windows 3.1");
-            break;
-        case QSysInfo::WV_95:
-            firstPartTemp += QString::fromLatin1("Windows 95");
-            break;
-        case QSysInfo::WV_98:
-            firstPartTemp += QString::fromLatin1("Windows 98");
-            break;
-        case QSysInfo::WV_Me:
-            firstPartTemp += QString::fromLatin1("Windows 98; Win 9x 4.90");
-            break;
-        case QSysInfo::WV_NT:
-            firstPartTemp += QString::fromLatin1("WinNT4.0");
-            break;
-        case QSysInfo::WV_2000:
-            firstPartTemp += QString::fromLatin1("Windows NT 5.0");
-            break;
-        case QSysInfo::WV_XP:
-            firstPartTemp += QString::fromLatin1("Windows NT 5.1");
-            break;
-        case QSysInfo::WV_2003:
-            firstPartTemp += QString::fromLatin1("Windows NT 5.2");
-            break;
-        case QSysInfo::WV_VISTA:
-            firstPartTemp += QString::fromLatin1("Windows NT 6.0");
-            break;
-         case QSysInfo::WV_WINDOWS7:
-            firstPartTemp += QString::fromLatin1("Windows NT 6.1");
-            break;
-         case QSysInfo::WV_CE:
-            firstPartTemp += QString::fromLatin1("Windows CE");
-            break;
-         case QSysInfo::WV_CENET:
-            firstPartTemp += QString::fromLatin1("Windows CE .NET");
-            break;
-         case QSysInfo::WV_CE_5:
-            firstPartTemp += QString::fromLatin1("Windows CE 5.x");
-            break;
-         case QSysInfo::WV_CE_6:
-            firstPartTemp += QString::fromLatin1("Windows CE 6.x");
-            break;
-        }
-
+        firstPartTemp += windowsVersionForUAString();
 #elif defined Q_OS_DARWIN
 #ifdef __i386__ || __x86_64__
         firstPartTemp += QString::fromLatin1("Intel Mac OS X");
@@ -4086,7 +4044,8 @@ quint64 QWebPage::bytesReceived() const
 /*!
     \fn void QWebPage::repaintRequested(const QRect& dirtyRect)
 
-    This signal is emitted whenever this QWebPage should be updated and no view was set.
+    This signal is emitted whenever this QWebPage should be updated. It's useful
+    when rendering a QWebPage without a QWebView or QGraphicsWebView.
     \a dirtyRect contains the area that needs to be updated. To paint the QWebPage get
     the mainFrame() and call the render(QPainter*, const QRegion&) method with the
     \a dirtyRect as the second parameter.
@@ -4131,6 +4090,8 @@ quint64 QWebPage::bytesReceived() const
 
     At signal emission time the meta-data of the QNetworkReply \a reply is available.
 
+    \note The receiving slot is responsible for deleting the QNetworkReply \a reply.
+
     \note This signal is only emitted if the forwardUnsupportedContent property is set to true.
 
     \sa downloadRequested()
diff --git a/Source/WebKit/qt/Api/qwebsettings.cpp b/Source/WebKit/qt/Api/qwebsettings.cpp
index 3f0b436..f744e81 100644
--- a/Source/WebKit/qt/Api/qwebsettings.cpp
+++ b/Source/WebKit/qt/Api/qwebsettings.cpp
@@ -28,6 +28,9 @@
 #include "MemoryCache.h"
 #include "CrossOriginPreflightResultCache.h"
 #include "FontCache.h"
+#if ENABLE(ICONDATABASE)
+#include "IconDatabaseClientQt.h"
+#endif
 #include "Page.h"
 #include "PageCache.h"
 #include "Settings.h"
@@ -477,25 +480,16 @@ QWebSettings::QWebSettings()
     d->fontFamilies.insert(QWebSettings::StandardFont, defaultFont.defaultFamily());
     d->fontFamilies.insert(QWebSettings::SerifFont, defaultFont.defaultFamily());
 
-#if QT_VERSION >= QT_VERSION_CHECK(4, 7, 0)
     defaultFont.setStyleHint(QFont::Fantasy);
     d->fontFamilies.insert(QWebSettings::FantasyFont, defaultFont.defaultFamily());
 
     defaultFont.setStyleHint(QFont::Cursive);
     d->fontFamilies.insert(QWebSettings::CursiveFont, defaultFont.defaultFamily());
-#else
-    d->fontFamilies.insert(QWebSettings::FantasyFont, defaultFont.defaultFamily());
-    d->fontFamilies.insert(QWebSettings::CursiveFont, defaultFont.defaultFamily());
-#endif
 
     defaultFont.setStyleHint(QFont::SansSerif);
     d->fontFamilies.insert(QWebSettings::SansSerifFont, defaultFont.defaultFamily());
 
-#if QT_VERSION >= QT_VERSION_CHECK(4, 7, 0)
     defaultFont.setStyleHint(QFont::Monospace);
-#else
-    defaultFont.setStyleHint(QFont::TypeWriter);
-#endif
     d->fontFamilies.insert(QWebSettings::FixedFont, defaultFont.defaultFamily());
 
     d->attributes.insert(QWebSettings::AutoLoadImages, true);
@@ -645,13 +639,18 @@ QString QWebSettings::defaultTextEncoding() const
 */
 void QWebSettings::setIconDatabasePath(const QString& path)
 {
-    WebCore::iconDatabase().delayDatabaseCleanup();
+#if ENABLE(ICONDATABASE)
+    // Make sure that IconDatabaseClientQt is instantiated.
+    WebCore::IconDatabaseClientQt::instance();
+#endif
+
+    WebCore::IconDatabase::delayDatabaseCleanup();
 
     if (!path.isEmpty()) {
         WebCore::iconDatabase().setEnabled(true);
         QFileInfo info(path);
         if (info.isDir() && info.isWritable())
-            WebCore::iconDatabase().open(path);
+            WebCore::iconDatabase().open(path, WebCore::IconDatabase::defaultDatabaseFilename());
     } else {
         WebCore::iconDatabase().setEnabled(false);
         WebCore::iconDatabase().close();
@@ -693,7 +692,7 @@ void QWebSettings::clearIconDatabase()
 */
 QIcon QWebSettings::iconForUrl(const QUrl& url)
 {
-    WebCore::Image* image = WebCore::iconDatabase().iconForPageURL(WebCore::KURL(url).string(),
+    WebCore::Image* image = WebCore::iconDatabase().synchronousIconForPageURL(WebCore::KURL(url).string(),
                                 WebCore::IntSize(16, 16));
     if (!image)
         return QPixmap();
diff --git a/Source/WebKit/qt/ChangeLog b/Source/WebKit/qt/ChangeLog
index a28825c..1a922ad 100644
--- a/Source/WebKit/qt/ChangeLog
+++ b/Source/WebKit/qt/ChangeLog
@@ -1,3 +1,716 @@
+2011-03-30  Robert Hogan  <robert@webkit.org>
+
+        Reviewed by Antonio Gomes.
+
+        [Qt] Fix LoadHTMLStringItem::invoke() after r75966
+
+        Add DRT support for loading an alternate HTML string
+        for error pages. This allows Qt to unskip
+        http/tests/navigation/go-back-to-error-page.html.
+
+        https://bugs.webkit.org/show_bug.cgi?id=52614
+
+        * WebCoreSupport/DumpRenderTreeSupportQt.cpp:
+        (DumpRenderTreeSupportQt::setAlternateHtml):
+        * WebCoreSupport/DumpRenderTreeSupportQt.h:
+
+2011-03-29  Alexis Menard  <alexis.menard@openbossa.org>
+
+        Unreviewed build fix for build-webkit -minimal.
+
+        Breakage introduced by http://trac.webkit.org/changeset/82238.
+        The minimal option has no support for shortcuts.
+
+        * WebCoreSupport/EditorClientQt.cpp:
+        (WebCore::EditorClientQt::handleInputMethodKeydown):
+
+2011-03-29  Janne Koskinen  <janne.p.koskinen@digia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Enterkey to go to Newline does not work in the text area(in HTML form)
+        https://bugs.webkit.org/show_bug.cgi?id=33179
+
+        Fixed newline generation from Qt::Key_Enter when editting text area using InputMethods.
+
+        * WebCoreSupport/EditorClientQt.cpp:
+        (WebCore::EditorClientQt::handleInputMethodKeydown):
+        * tests/qwebpage/tst_qwebpage.cpp:
+        (tst_QWebPage::inputMethods):
+
+2011-03-29  Andreas Kling  <kling@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Fix documentation for QWebPage::repaintRequested()
+
+        This signal is always emitted when the page is dirtied, so remove
+        reference to old behavior where we would only emit the signal for
+        headless QWebPages.
+
+        * Api/qwebpage.cpp:
+
+2011-03-28  Andreas Kling  <kling@webkit.org>
+
+        Reviewed by Benjamin Poulain.
+
+        [Qt] Pass QString() instead of String() when emitting titleChanged() for new loads.
+
+        * WebCoreSupport/FrameLoaderClientQt.cpp:
+        (WebCore::FrameLoaderClientQt::dispatchDidCommitLoad):
+
+2011-03-28  Andreas Kling  <kling@webkit.org>
+
+        Reviewed by Benjamin Poulain.
+
+        [Qt] Crash when calling QWebFrame::render() in response to QWebPage::repaintRequested()
+        https://bugs.webkit.org/show_bug.cgi?id=52629
+
+        * WebCoreSupport/ChromeClientQt.cpp:
+        (WebCore::ChromeClientQt::invalidateContentsAndWindow): Make the emission of
+        QWebPage::repaintRequested() use a Qt::QueuedConnection.
+
+        * tests/qwebpage/tst_qwebpage.cpp:
+        (RepaintRequestedRenderer::RepaintRequestedRenderer):
+        (RepaintRequestedRenderer::onRepaintRequested):
+        (tst_QWebPage::renderOnRepaintRequestedShouldNotRecurse): Test that calling
+        QWebFrame::render() in a slot connected to to QWebPage::repaintRequested()
+        doesn't cause recursive signal emissions.
+
+2011-03-28  Benjamin Poulain  <benjamin.poulain@nokia.com>
+
+        Reviewed by Andreas Kling.
+
+        [Qt] QtWebKit will not compile with QT_ASCII_CAST_WARNINGS enabled
+        https://bugs.webkit.org/show_bug.cgi?id=57087
+
+        * QtWebKit.pro: we can now enable QT_ASCII_CAST_WARNINGS
+        * tests/tests.pri: we do not require QT_ASCII_CAST_WARNINGS for tests
+        since they are applications, not libraries.
+
+2011-03-28  Andras Becsi  <abecsi@webkit.org>
+
+        Reviewed by Csaba Osztrogonác.
+
+        [Qt] QtWebKit does not link with --3d-canvas using MinGW
+        https://bugs.webkit.org/show_bug.cgi?id=57225
+
+        * QtWebKit.pro: Append the OpenGL libraries on MinGW so it can resolve symbols.
+
+2011-03-28  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Reviewed by Andreas Kling.
+
+        REGRESSION(r54712): [Qt] Installed QtWebKit header does not compile.
+        https://bugs.webkit.org/show_bug.cgi?id=57183
+
+        Windows buildfix after r82065.
+
+        * Api/DerivedSources.pro: Readding escaping on Windows platforms.
+
+2011-03-27  Andreas Kling  <kling@webkit.org>
+
+        Fix build warning about IconDatabaseClient.h (wrong path.)
+
+        * QtWebKit.pro:
+
+2011-03-27  Andreas Kling  <kling@webkit.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Support for CSS color and background-color properties on select element's dropdown list
+        https://bugs.webkit.org/show_bug.cgi?id=51627
+
+        Extend the QWebSelectData interface with background and foreground colors
+        for the whole menu, as well as per-item. Hook it up to the PopupMenuStyle
+        getters in RenderMenuList.
+
+        * Api/qwebkitplatformplugin.h:
+        * WebCoreSupport/PopupMenuQt.cpp:
+        (SelectData::backgroundColor):
+        (SelectData::foregroundColor):
+        (SelectData::itemBackgroundColor):
+        (SelectData::itemForegroundColor):
+        * WebCoreSupport/QtFallbackWebPopup.cpp:
+        (WebCore::QtFallbackWebPopup::show):
+        (WebCore::QtFallbackWebPopup::populate):
+
+2011-03-27  Yi Shen  <yi.4.shen@nokia.com>
+
+        Reviewed by Andreas Kling.
+
+        [Qt][Symbian] Fix Api test failure -- microFocusCoordinates
+        https://bugs.webkit.org/show_bug.cgi?id=57108
+
+        Since the canvas is not self-closing tag, we need to add '</canvas>'. 
+
+        * tests/qgraphicswebview/tst_qgraphicswebview.cpp:
+        (tst_QGraphicsWebView::microFocusCoordinates):
+        * tests/qwebview/tst_qwebview.cpp:
+        (tst_QWebView::microFocusCoordinates):
+
+2011-03-27  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Eric Seidel.
+
+        [Qt] Build fix: Define WTF_USE_TEXTURE_MAPPER=1 when CONFIG contains texmap.
+        https://bugs.webkit.org/show_bug.cgi?id=57143
+
+        Qt WebKit uses USE(TEXTURE_MAPPER) guard. Check texmap in CONFIG and
+        define WTF_USE_TEXTURE_MAPPER=1.
+
+        * QtWebKit.pro:
+
+2011-03-27  Andreas Kling  <kling@webkit.org>
+
+        Reviewed by Benjamin Poulain.
+
+        REGRESSION(r54712): [Qt] Installed QtWebKit header does not compile.
+        https://bugs.webkit.org/show_bug.cgi?id=57183
+
+        The convenience <QtWebKit> header would include \<QtNetwork/QtNetwork\>
+        which was due to the outputting code previously being wrapped in eval().
+
+        * Api/DerivedSources.pro:
+
+2011-03-27  Benjamin Poulain  <benjamin.poulain@nokia.com>
+
+        Reviewed by Andreas Kling.
+
+        [Qt] QtWebKit will not compile with QT_ASCII_CAST_WARNINGS enabled
+        https://bugs.webkit.org/show_bug.cgi?id=57087
+
+        Use explicit conversion for string to avoid depending on the default codec
+        installed by the user code.
+
+        * Api/qwebkitversion.cpp:
+        (qWebKitVersion):
+        * Api/qwebpage.cpp:
+        (QWebPagePrivate::dynamicPropertyChangeEvent):
+        (QWebPage::javaScriptConsoleMessage):
+        * WebCoreSupport/DumpRenderTreeSupportQt.cpp:
+        (convertToPropertyName):
+        (DumpRenderTreeSupportQt::setEditingBehavior):
+        (DumpRenderTreeSupportQt::plainText):
+        * WebCoreSupport/EditorClientQt.cpp:
+        (dumpRange):
+        * WebCoreSupport/FrameLoaderClientQt.cpp:
+        (drtDescriptionSuitableForTestResult):
+        (WebCore::FrameLoaderClientQt::dispatchDecidePolicyForNavigationAction):
+        * WebCoreSupport/InspectorClientQt.cpp:
+        (WebCore::InspectorClientQt::openInspectorFrontend):
+        * WebCoreSupport/InspectorServerQt.cpp:
+        (WebCore::parseWebSocketChallengeNumber):
+        (WebCore::InspectorServerRequestHandlerQt::tcpReadyRead):
+
+2011-03-26  Andreas Kling  <kling@webkit.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] QWebFrame::iconChanged() not emitted when icon is cached but not yet loaded
+        https://bugs.webkit.org/show_bug.cgi?id=57157
+
+        Add an IconDatabaseClient for the Qt port to ensure that QWebFrame::iconChanged()
+        is always emitted when appropriate.
+
+        * QtWebKit.pro: Add new files.
+
+        * WebCoreSupport/IconDatabaseClientQt.h: Added.
+        * WebCoreSupport/IconDatabaseClientQt.cpp: Added.
+        (WebCore::IconDatabaseClientQt::instance):
+        (WebCore::IconDatabaseClientQt::IconDatabaseClientQt):
+        (WebCore::IconDatabaseClientQt::~IconDatabaseClientQt):
+        (WebCore::IconDatabaseClientQt::performImport):
+        (WebCore::IconDatabaseClientQt::didRemoveAllIcons):
+        (WebCore::IconDatabaseClientQt::didImportIconURLForPageURL):
+        (WebCore::IconDatabaseClientQt::didImportIconDataForPageURL):
+        (WebCore::IconDatabaseClientQt::didChangeIconForPageURL):
+        (WebCore::IconDatabaseClientQt::didFinishURLImport):
+
+        * WebCoreSupport/FrameLoaderClientQt.h:
+        * WebCoreSupport/FrameLoaderClientQt.cpp:
+        (WebCore::FrameLoaderClientQt::registerForIconNotification):
+        (WebCore::FrameLoaderClientQt::onIconLoadedForPageURL): New slot connected
+        to the IconDatabaseClientQt::iconLoadedForPageURL() signal. This emits the
+        QWebFrame::iconChanged() signal when the IconDatabases finishes loading
+        a cached favicon for the frame's URL.
+
+        * Api/qwebsettings.cpp:
+        (QWebSettings::setIconDatabasePath): Make sure that IconDatabaseClientQt is
+        instantiated. An IconDatabaseClient has to be registered before the IconDatabase
+        spawns its reader thread.
+
+2011-03-25  Andy Estes  <aestes@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        REGRESSION (r70748): latest nightly builds kills AC_QuickTime.js
+        https://bugs.webkit.org/show_bug.cgi?id=49016
+
+        Update objectContentType() implementation to handle the
+        shouldPreferPlugInsForImages flag.
+
+        * WebCoreSupport/FrameLoaderClientQt.cpp:
+        (WebCore::FrameLoaderClientQt::objectContentType):
+        * WebCoreSupport/FrameLoaderClientQt.h:
+
+2011-03-25  Chang Shu  <cshu@webkit.org>
+
+        Reviewed by Ryosuke Niwa.
+
+        rename Node::isContentEditable and all call sites to rendererIsEditable
+        https://bugs.webkit.org/show_bug.cgi?id=54290
+
+        This is part of the effort to separate JS API HTMLElement isContentEditable from
+        internal Node::rendererIsEditable.
+
+        * WebCoreSupport/EditorClientQt.cpp:
+        (WebCore::EditorClientQt::handleKeyboardEvent):
+
+2011-03-25  Alexis Menard  <alexis.menard@openbossa.org>
+
+        Reviewed by Andreas Kling.
+
+        [Qt] The keyboard shortcuts during fullscreen playback do not work.
+        https://bugs.webkit.org/show_bug.cgi?id=57095
+
+        We need to explicitely set the focus on the widget in order to receive the keyboard events.
+
+        * WebCoreSupport/FullScreenVideoWidget.cpp:
+        (WebCore::FullScreenVideoWidget::show):
+
+2011-03-24  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r81916 and r81917.
+        http://trac.webkit.org/changeset/81916
+        http://trac.webkit.org/changeset/81917
+        https://bugs.webkit.org/show_bug.cgi?id=57071
+
+        broke a test on platforms that do not have QuickTime installed
+        (Requested by estes on #webkit).
+
+        * WebCoreSupport/FrameLoaderClientQt.cpp:
+        (WebCore::FrameLoaderClientQt::objectContentType):
+        * WebCoreSupport/FrameLoaderClientQt.h:
+
+2011-03-24  Andy Estes  <aestes@apple.com>
+
+        Reviewed by Darin Adler.
+
+        REGRESSION (r70748): latest nightly builds kills AC_QuickTime.js
+        https://bugs.webkit.org/show_bug.cgi?id=49016
+
+        Update objectContentType() implementation to handle the
+        shouldPreferPlugInsForImages flag.
+
+        * WebCoreSupport/FrameLoaderClientQt.cpp:
+        (WebCore::FrameLoaderClientQt::objectContentType):
+        * WebCoreSupport/FrameLoaderClientQt.h:
+
+2011-03-24  Benjamin Poulain  <benjamin.poulain@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] When we render WebGL offscreen, color conversion cost a lot of CPU cycles
+        https://bugs.webkit.org/show_bug.cgi?id=40884
+
+        Add tests and benchmarks for the software fallback of WebGL.
+
+        * tests/benchmarks/webgl/10000_triangles.html: Added.
+        * tests/benchmarks/webgl/tst_webgl.cpp: Added.
+        (GraphicsView::GraphicsView):
+        (GraphicsView::resizeEvent):
+        (tst_WebGlPerformance::init):
+        (tst_WebGlPerformance::cleanup):
+        (tst_WebGlPerformance::benchSoftwareFallbackRgb16):
+        (tst_WebGlPerformance::benchSoftwareFallbackRgb32):
+        (tst_WebGlPerformance::benchSoftwareFallbackArgb32):
+        (tst_WebGlPerformance::benchSoftwareFallbackArgb32Premultiplied):
+        (tst_WebGlPerformance::benchmarkFrameRenderingOnImage):
+        * tests/benchmarks/webgl/tst_webgl.qrc: Added.
+        * tests/benchmarks/webgl/webgl.pro: Added.
+        * tests/qgraphicswebview/qgraphicswebview.pro:
+        * tests/qgraphicswebview/resources/pointing_right.html: Added.
+        * tests/qgraphicswebview/resources/pointing_up.html: Added.
+        * tests/qgraphicswebview/tst_qgraphicswebview.cpp:
+        (compareImagesFuzzyPixelCount):
+        (GraphicsView::GraphicsView):
+        (tst_QGraphicsWebView::webglSoftwareFallbackVerticalOrientation):
+        (tst_QGraphicsWebView::webglSoftwareFallbackHorizontalOrientation):
+        (tst_QGraphicsWebView::compareCanvasToImage):
+        * tests/qgraphicswebview/tst_qgraphicswebview.qrc:
+        * tests/tests.pro:
+
+2011-03-24  Kristian Amlie  <kristian.amlie@nokia.com>
+
+        Reviewed by Benjamin Poulain.
+
+        Avoided ASCII-cast warnings for WebKit.
+
+        Normally they won't be enabled anyway, but if you build webkit from
+        within the Qt mother repository it will pick up Qt's default build
+        settings, which do enable it. We need to disable them because
+        warnings are treated as errors and there are way too many of them in
+        the WebKit code.
+
+        [Qt] Avoid ASCII-cast warnings for WebKit.
+        https://bugs.webkit.org/show_bug.cgi?id=57016
+
+        * QtWebKit.pro:
+
+2011-03-24  Caio Marcelo de Oliveira Filho  <caio.oliveira@openbossa.org>
+
+        Reviewed by Benjamin Poulain.
+
+        [Qt] Resetting the URL property of a QWebView results in the current directory being set as file::-type URL
+        https://bugs.webkit.org/show_bug.cgi?id=29595
+
+        Qt Designer resets the URL by setting it to QUrl(). The bug was caused by
+        ensureAbsoluteUrl() helper function treating the empty URL as a relative URL, and
+        prepending the current directory.
+
+        By fixing this, now we can pass QUrl() invalid and empty URLs to WebCore layer, which
+        will end up loading "about:blank", but keeping it as a requested URL.
+
+        This patch also simplifies the logic for requestedUrl(), since m_lastRequestedUrl
+        is filled for the loaded URLs as well, we can use it in every case.
+
+        Three new autotests were added, to better cover the expected behavior of setting
+        the QUrl() in a QWebFrame.
+
+        * Api/qwebframe.cpp:
+        (ensureAbsoluteUrl): do not treat invalid URLs (empty included) as relative.
+        (QWebFrame::requestedUrl): always use m_lastRequestedUrl.
+
+        * WebCoreSupport/FrameLoaderClientQt.cpp:
+        (WebCore::FrameLoaderClientQt::dispatchDidFinishLoad): do not clear m_lastRequestedUrl
+        anymore, since we always rely on it even for loaded frames.
+
+        * tests/qwebframe/tst_qwebframe.cpp:
+        (tst_QWebFrame::setUrlToEmpty): verify the behavior of setting empty URLs. This includes
+        the reduction of the bug report.
+        (tst_QWebFrame::setUrlToInvalid): setting invalid, but not necessarily empty, URLs.
+        (tst_QWebFrame::setUrlHistory): to verify how setting empty URLs affect history.
+
+2011-03-23  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Change IconDatabase opening to allow for arbitrary filenames
+        https://bugs.webkit.org/show_bug.cgi?id=56977
+
+        * Api/qwebsettings.cpp:
+        (QWebSettings::setIconDatabasePath):
+
+2011-03-23  Aparna Nandyal  <aparna.nand@wipro.com>
+
+        Reviewed by Andreas Kling.
+
+        [Qt] QtWebKit rendering problem when maximizing and doing a back
+        https://bugs.webkit.org/show_bug.cgi?id=56669
+
+        Added an auto test.
+        Patch by Alexis Menard < alexis.menard@nokia.com> on 2011-03-21
+ 
+        * tests/qwebview/tst_qwebview.cpp:
+        (tst_QWebView::rendering):
+
+2011-03-23  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        [V8] Web Inspector: compile DebuggerScript.js into DebuggerScriptSource.h
+        https://bugs.webkit.org/show_bug.cgi?id=56843
+
+        * WebCoreSupport/InspectorClientQt.cpp:
+        (WebCore::InspectorClientQt::openInspectorFrontend):
+
+2011-03-22  Andrew Wason  <rectalogic@rectalogic.com>
+
+        Reviewed by Benjamin Poulain.
+
+        [Qt] QWebPage with WebGL content crashes when rendering if no QWebView parent
+        https://bugs.webkit.org/show_bug.cgi?id=54138
+
+        * tests/qwebpage/tst_qwebpage.cpp:
+        (webGLScreenshotWithoutView):
+        (tst_QWebPage::acceleratedWebGLScreenshotWithoutView):
+        (tst_QWebPage::unacceleratedWebGLScreenshotWithoutView):
+         Render a QWebPage (with and without accelerated compositing)
+         with a WebGL context that has no owning view.  Shouldn't crash.
+
+2011-03-21  Chang Shu  <cshu@webkit.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        REGRESSION (r79953): Can't type in MS Outlook 2011
+        https://bugs.webkit.org/show_bug.cgi?id=56665
+
+        r79953 removed the WebView level editablity which is persistent no matter whether
+        underlying document itself is changed and editability gets lost. The resolution is to
+        set this WebView editable value to WebCore. This avoids the callback from WebCore to
+        WebKit which was the main goal in r79953 to improve performance.
+
+        * Api/qwebpage.cpp:
+        (QWebPage::setContentEditable):
+        (QWebPage::isContentEditable):
+
+2011-03-19  Andreas Kling  <kling@webkit.org>
+
+        Reviewed by Benjamin Poulain.
+
+        [Qt] Remove support for Qt 4.6
+        https://bugs.webkit.org/show_bug.cgi?id=56712
+
+        * Api/qwebframe.cpp:
+        (QWebFrame::load):
+        * Api/qwebpage.cpp:
+        (QWebPagePrivate::QWebPagePrivate):
+        * Api/qwebsettings.cpp:
+        (QWebSettings::QWebSettings):
+        * WebCoreSupport/GeolocationClientQt.cpp:
+        (WebCore::GeolocationClientQt::positionUpdated):
+
+2011-03-19  Andreas Kling  <kling@webkit.org>
+
+        Reviewed by Antonio Gomes.
+
+        [Qt][Doc] QWebPage::unsupportedContent() passes ownership of the QNetworkReply
+        https://bugs.webkit.org/show_bug.cgi?id=56711
+
+        Document the fact that when unsupportedContent(QNetworkReply*) is emitted,
+        ownership of the reply is transferred to the receiving slot.
+
+        * Api/qwebpage.cpp:
+
+2011-03-17  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=56425
+        More groundwork for WebKit2 IconDatabase
+
+        Update already-used function names:
+        * Api/qwebhistory.cpp:
+        (QWebHistoryItem::icon):
+        * Api/qwebsettings.cpp:
+        (QWebSettings::iconForUrl):
+
+2011-03-18  Alexis Menard  <alexis.menard@openbossa.org>
+
+        Reviewed by Benjamin Poulain.
+
+        [Qt] console.log not being exposed to QmlViewer
+        https://bugs.webkit.org/show_bug.cgi?id=56536
+
+        The documentation is bogus the feature does not exist.
+
+        * declarative/qdeclarativewebview.cpp:
+
+2011-03-17  Andreas Kling  <kling@webkit.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] QML WebView emits iconChanged() when the page title changes
+        https://bugs.webkit.org/show_bug.cgi?id=56570
+
+        * declarative/qdeclarativewebview.cpp:
+        (QDeclarativeWebView::setPage): Don't forward the frame's titleChanged
+        signal to the view's iconChanged signal.
+
+2011-03-17  Alexis Menard  <alexis.menard@openbossa.org>
+
+        Reviewed by Benjamin Poulain.
+
+        [Qt] Videos look ugly when using QGraphicsWebView.
+        https://bugs.webkit.org/show_bug.cgi?id=56580
+
+        We need to set QPainter::SmoothPixmapTransform on the painter for a proper rendering of the video.
+        QWebView does it but not QGraphicsWebView because the API does not exist. This patch is fixing it
+        by introducing the same API as QWebView to control the renderHints of the item. Unlike QWebView
+        QGraphicsWebView inherits the painter from QGraphicsScene and those flags are not set. This patch
+        ensure that before rendering the item we add QPainter::SmoothPixmapTransform and QPainter::TextAntialiasing
+        in addition of what could be set on the painter. In order to not break the rendering of all the items in the
+        scene we set back the painter to its original state when QGraphicsWebView is rendered.
+
+        * Api/qgraphicswebview.cpp:
+        (QGraphicsWebViewPrivate::QGraphicsWebViewPrivate):
+        (QGraphicsWebView::paint):
+        (QGraphicsWebView::renderHints):
+        (QGraphicsWebView::setRenderHints):
+        (QGraphicsWebView::setRenderHint):
+        * Api/qgraphicswebview.h:
+        * tests/qgraphicswebview/tst_qgraphicswebview.cpp:
+        (tst_QGraphicsWebView::renderHints):
+
+2011-03-16  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Viewport no longer allows an auto value for "user-scalable"
+        https://bugs.webkit.org/show_bug.cgi?id=55416
+
+        Make the default value for userScalable be true.
+
+        * Api/qwebpage.cpp:
+        (QWebPage::viewportAttributesForSize):
+        * WebCoreSupport/DumpRenderTreeSupportQt.cpp:
+        (DumpRenderTreeSupportQt::viewportAsText): update test output to include userScalable.
+
+2011-03-15  Kevin Ollivier  <kevino@theolliviers.com>
+
+        Reviewed by Darin Adler.
+
+        Introduce WTF_USE_EXPORT_MACROS, which will allow us to put shared library import/export
+        info into the headers rather than in export symbol definition files, but disable it on 
+        all platforms initially so we can deal with port build issues one port at a time.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=27551
+
+        * WebCoreSupport/GeolocationClientQt.cpp:
+        * WebCoreSupport/PopupMenuQt.cpp:
+
+2011-03-14  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=56320
+        Remove HistoryItem::icon() and the WebCore dependency on "IconDatabaseBase::defaultIcon()"
+
+        * Api/qwebhistory.cpp:
+        (QWebHistoryItem::icon): Use IconDatabase directly.
+
+2011-03-11  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by attempt at build fix!
+
+        https://bugs.webkit.org/show_bug.cgi?id=56216
+        Fix the Qt build following the same pattern of the patch.
+
+        * Api/qwebsettings.cpp:
+        (QWebSettings::setIconDatabasePath): Call the static method via IconDatabase:: and not via iconDatabase()
+
+2011-03-11  Alexis Menard  <alexis.menard@openbossa.org>
+
+        Reviewed by Ariya Hidayat.
+
+        [Qt] Entering fullscreen and leaving it may hide the cursor of the application.
+        https://bugs.webkit.org/show_bug.cgi?id=56181
+
+        We need to stop the auto hide cursor timer when closing the widget otherwise the timer
+        might get fired and therefore hide the cursor even when the fullscreen widget is closed.
+
+        * WebCoreSupport/FullScreenVideoWidget.cpp:
+        (WebCore::FullScreenVideoWidget::closeEvent):
+
+2011-03-10  David Boddie <david.boddie@nokia.com>
+
+        Reviewed by Andreas Kling.
+
+        Fixed a qdoc warning and terminology (WebKit instead of Webkit).
+        https://bugs.webkit.org/show_bug.cgi?id=55756
+
+        * Api/qwebhistoryinterface.cpp:
+
+2011-03-10  Andreas Kling  <kling@webkit.org>
+
+        Unreviewed build fix after r80774.
+
+        QML property versioning is introduced in Qt 4.7.3, not 4.7.2.
+        See also: http://bugreports.qt.nokia.com/browse/QTBUG-13451
+
+        * declarative/plugin.cpp:
+        (WebKitQmlPlugin::registerTypes):
+        * declarative/qdeclarativewebview.cpp:
+        * declarative/qdeclarativewebview_p.h:
+        * tests/qdeclarativewebview/tst_qdeclarativewebview.cpp:
+
+2011-03-10  Alexis Menard  <alexis.menard@openbossa.org>
+
+        Reviewed by Andreas Kling.
+
+        [Qt] QtDeclarative Webview element has a fixed white background
+        https://bugs.webkit.org/show_bug.cgi?id=40918
+
+        Implement a way to change the background color of the WebView QML element.
+        This feature is activated for QtWebKit 1.1 version of the plugin.
+
+        * declarative/plugin.cpp:
+        (WebKitQmlPlugin::registerTypes):
+        * declarative/qdeclarativewebview.cpp:
+        (QDeclarativeWebView::backgroundColor):
+        (QDeclarativeWebView::setBackgroundColor):
+        * declarative/qdeclarativewebview_p.h:
+        * tests/qdeclarativewebview/resources/webviewbackgroundcolor.qml: Added.
+        * tests/qdeclarativewebview/tst_qdeclarativewebview.cpp:
+        (tst_QDeclarativeWebView::backgroundColor):
+        * tests/qdeclarativewebview/tst_qdeclarativewebview.qrc:
+
+2011-03-10  Stanislav Paltis  <Stanislav.Paltis@nokia.com>
+
+        Reviewed by Laszlo Gombos.
+
+        [Qt] MemoryCache deadDecodedDataDeletionInterval is not exposed for client's usage
+        https://bugs.webkit.org/show_bug.cgi?id=55945
+        
+        Added handling of dynamic/runtime property _q_deadDecodedDataDeletionInterval to 
+        set interval used to trigger when decoded data in dead list of object cache will 
+        be purged from object cache. 
+
+        * Api/qwebpage.cpp:
+        (QWebPagePrivate::dynamicPropertyChangeEvent):
+
+2011-03-10  Caio Marcelo de Oliveira Filho  <caio.oliveira@openbossa.org>
+
+        Reviewed by Antonio Gomes.
+
+        Simplify how QWebFrame::requestedUrl() is obtained
+        https://bugs.webkit.org/show_bug.cgi?id=55842
+
+        When a load starts, store the requested URL until we know that it'll be
+        available for us in the document loader -- after load finished.
+
+        The existing auto tests cover the three different code paths in
+        requestedUrl() and the new code passes the autotests. In each of those
+        cases, we looked for the information in a different place, but in all
+        of them, dispatchDidStartProvisionalLoad was called.
+
+        This simplification will be useful to fix bug 32723. The way requestedUrl()
+        is implementent, we can't use it as a fallback for url() when the setUrl()
+        was called with an invalid URL.
+
+        * Api/qwebframe.cpp:
+        (QWebFrame::requestedUrl):
+        * WebCoreSupport/FrameLoaderClientQt.cpp:
+        (WebCore::FrameLoaderClientQt::dispatchDidStartProvisionalLoad):
+        (WebCore::FrameLoaderClientQt::dispatchDidFinishLoad):
+        * WebCoreSupport/FrameLoaderClientQt.h:
+        (WebCore::FrameLoaderClientQt::lastRequestedUrl):
+
+2011-03-10  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Tiled backing store's delegated scroll request uses incorrect convention
+        https://bugs.webkit.org/show_bug.cgi?id=56011
+
+        Adapt internal API to match the change from delta to point on the
+        WebCore side, and convert the point to a delta for the public API.
+
+        * WebCoreSupport/ChromeClientQt.cpp:
+        (WebCore::ChromeClientQt::delegatedScrollRequested):
+        * WebCoreSupport/ChromeClientQt.h:
+
+2011-03-09  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Mihai Parparita.
+
+        Unify Windows version checks.
+        https://bugs.webkit.org/show_bug.cgi?id=55979
+
+        * Api/qwebpage.cpp:
+        (QWebPage::userAgentForUrl):
+
 2011-03-07  Sam Weinig  <sam@webkit.org>
 
         Reviewed by Anders Carlsson.
diff --git a/Source/WebKit/qt/QtWebKit.pro b/Source/WebKit/qt/QtWebKit.pro
index 4b7bb05..8836c4a 100644
--- a/Source/WebKit/qt/QtWebKit.pro
+++ b/Source/WebKit/qt/QtWebKit.pro
@@ -42,6 +42,11 @@ isEmpty(OUTPUT_DIR): OUTPUT_DIR = ../..
 
 contains(QT_CONFIG, embedded):CONFIG += embedded
 
+win32*:!win32-msvc* {
+    # Make sure OpenGL libs are after the webcore lib so MinGW can resolve symbols
+    contains(DEFINES, ENABLE_WEBGL=1)|contains(CONFIG, texmap): LIBS += $$QMAKE_LIBS_OPENGL
+}
+
 moduleFile=$$PWD/qt_webkit_version.pri
 isEmpty(QT_BUILD_TREE):include($$moduleFile)
 VERSION = $${QT_WEBKIT_MAJOR_VERSION}.$${QT_WEBKIT_MINOR_VERSION}.$${QT_WEBKIT_PATCH_VERSION}
@@ -82,6 +87,7 @@ CONFIG(QTDIR_build) {
     symbian: TARGET =$$TARGET$${QT_LIBINFIX}
 }
 
+
 symbian {
     TARGET.EPOCALLOWDLLDATA=1
     # DRM and Allfiles capabilites need to be audited to be signed on Symbian
@@ -215,6 +221,15 @@ contains(DEFINES, ENABLE_VIDEO=1) {
     }
 }
 
+contains(DEFINES, ENABLE_ICONDATABASE=1) {
+    HEADERS += \
+        $$SOURCE_DIR/WebCore/loader/icon/IconDatabaseClient.h \
+        $$PWD/WebCoreSupport/IconDatabaseClientQt.h
+
+    SOURCES += \
+        $$PWD/WebCoreSupport/IconDatabaseClientQt.cpp
+}
+
 contains(DEFINES, ENABLE_DEVICE_ORIENTATION=1) {
     HEADERS += \
         $$PWD/WebCoreSupport/DeviceMotionClientQt.h \
@@ -238,6 +253,10 @@ contains(DEFINES, ENABLE_GEOLOCATION=1) {
         $$PWD/WebCoreSupport/GeolocationClientQt.cpp
 }
 
+contains(CONFIG, texmap) {
+    DEFINES += WTF_USE_TEXTURE_MAPPER=1
+}
+
 !symbian-abld:!symbian-sbsv2 {
     modfile.files = $$moduleFile
     modfile.path = $$[QMAKE_MKSPECS]/modules
diff --git a/Source/WebKit/qt/WebCoreSupport/ChromeClientQt.cpp b/Source/WebKit/qt/WebCoreSupport/ChromeClientQt.cpp
index c784375..bec4bc4 100644
--- a/Source/WebKit/qt/WebCoreSupport/ChromeClientQt.cpp
+++ b/Source/WebKit/qt/WebCoreSupport/ChromeClientQt.cpp
@@ -411,7 +411,7 @@ void ChromeClientQt::invalidateContentsAndWindow(const IntRect& windowRect, bool
         if (!rect.isEmpty())
             platformPageClient()->update(rect);
     }
-    emit m_webPage->repaintRequested(windowRect);
+    QMetaObject::invokeMethod(m_webPage, "repaintRequested", Qt::QueuedConnection, Q_ARG(QRect, windowRect));
 
     // FIXME: There is no "immediate" support for window painting.  This should be done always whenever the flag
     // is set.
@@ -430,9 +430,10 @@ void ChromeClientQt::scroll(const IntSize& delta, const IntRect& scrollViewRect,
 }
 
 #if ENABLE(TILED_BACKING_STORE)
-void ChromeClientQt::delegatedScrollRequested(const IntSize& delta)
+void ChromeClientQt::delegatedScrollRequested(const IntPoint& point)
 {
-    emit m_webPage->scrollRequested(delta.width(), delta.height(), QRect(QPoint(0, 0), m_webPage->viewportSize()));
+    QPoint currentPosition(m_webPage->mainFrame()->scrollPosition());
+    emit m_webPage->scrollRequested(point.x() - currentPosition.x(), point.y() - currentPosition.y(), QRect(QPoint(0, 0), m_webPage->viewportSize()));
 }
 #endif
 
diff --git a/Source/WebKit/qt/WebCoreSupport/ChromeClientQt.h b/Source/WebKit/qt/WebCoreSupport/ChromeClientQt.h
index 27327ef..a12c2ec 100644
--- a/Source/WebKit/qt/WebCoreSupport/ChromeClientQt.h
+++ b/Source/WebKit/qt/WebCoreSupport/ChromeClientQt.h
@@ -120,7 +120,7 @@ namespace WebCore {
         virtual void invalidateContentsForSlowScroll(const IntRect&, bool);
         virtual void scroll(const IntSize& scrollDelta, const IntRect& rectToScroll, const IntRect& clipRect);
 #if ENABLE(TILED_BACKING_STORE)
-        virtual void delegatedScrollRequested(const IntSize& scrollDelta);
+        virtual void delegatedScrollRequested(const IntPoint& scrollPoint);
 #endif
 
         virtual IntPoint screenToWindow(const IntPoint&) const;
diff --git a/Source/WebKit/qt/WebCoreSupport/DumpRenderTreeSupportQt.cpp b/Source/WebKit/qt/WebCoreSupport/DumpRenderTreeSupportQt.cpp
index c0017a2..ba712d1 100644
--- a/Source/WebKit/qt/WebCoreSupport/DumpRenderTreeSupportQt.cpp
+++ b/Source/WebKit/qt/WebCoreSupport/DumpRenderTreeSupportQt.cpp
@@ -531,7 +531,7 @@ QString DumpRenderTreeSupportQt::markerTextForListItem(const QWebElement& listIt
 
 static QString convertToPropertyName(const QString& name)
 {
-    QStringList parts = name.split('-');
+    QStringList parts = name.split(QLatin1Char('-'));
     QString camelCaseName;
     for (int j = 0; j < parts.count(); ++j) {
         QString part = parts.at(j);
@@ -626,11 +626,11 @@ void DumpRenderTreeSupportQt::setEditingBehavior(QWebPage* page, const QString&
 {
     WebCore::EditingBehaviorType coreEditingBehavior;
 
-    if (editingBehavior == "win")
+    if (editingBehavior == QLatin1String("win"))
         coreEditingBehavior = EditingWindowsBehavior;
-    else if (editingBehavior == "mac")
+    else if (editingBehavior == QLatin1String("mac"))
         coreEditingBehavior = EditingMacBehavior;
-    else if (editingBehavior == "unix")
+    else if (editingBehavior == QLatin1String("unix"))
         coreEditingBehavior = EditingUnixBehavior;
     else {
         ASSERT_NOT_REACHED();
@@ -742,12 +742,13 @@ QString DumpRenderTreeSupportQt::viewportAsText(QWebPage* page, int deviceDPI, c
         availableSize);
 
     QString res;
-    res = res.sprintf("viewport size %dx%d scale %f with limits [%f, %f]\n",
+    res = res.sprintf("viewport size %dx%d scale %f with limits [%f, %f] and userScalable %f\n",
             conf.layoutSize.width(),
             conf.layoutSize.height(),
             conf.initialScale,
             conf.minimumScale,
-            conf.maximumScale);
+            conf.maximumScale,
+            conf.userScalable);
 
     return res;
 }
@@ -922,10 +923,10 @@ void DumpRenderTreeSupportQt::simulateDesktopNotificationClick(const QString& ti
 QString DumpRenderTreeSupportQt::plainText(const QVariant& range)
 {
     QMap<QString, QVariant> map = range.toMap();
-    QVariant startContainer  = map.value("startContainer");
+    QVariant startContainer  = map.value(QLatin1String("startContainer"));
     map = startContainer.toMap();
 
-    return map.value("innerText").toString();
+    return map.value(QLatin1String("innerText")).toString();
 }
 
 QVariantList DumpRenderTreeSupportQt::nodesFromRect(const QWebElement& document, int x, int y, unsigned top, unsigned right, unsigned bottom, unsigned left, bool ignoreClipping)
@@ -949,6 +950,7 @@ QVariantList DumpRenderTreeSupportQt::nodesFromRect(const QWebElement& document,
     return res;
 }
 
+// API Candidate?
 QString DumpRenderTreeSupportQt::responseMimeType(QWebFrame* frame)
 {
     WebCore::Frame* coreFrame = QWebFramePrivate::core(frame);
@@ -1038,6 +1040,18 @@ QUrl DumpRenderTreeSupportQt::mediaContentUrlByElementId(QWebFrame* frame, const
     return res;
 }
 
+// API Candidate?
+void DumpRenderTreeSupportQt::setAlternateHtml(QWebFrame* frame, const QString& html, const QUrl& baseUrl, const QUrl& failingUrl)
+{
+    KURL kurl(baseUrl);
+    WebCore::Frame* coreFrame = QWebFramePrivate::core(frame);
+    WebCore::ResourceRequest request(kurl);
+    const QByteArray utf8 = html.toUtf8();
+    WTF::RefPtr<WebCore::SharedBuffer> data = WebCore::SharedBuffer::create(utf8.constData(), utf8.length());
+    WebCore::SubstituteData substituteData(data, WTF::String("text/html"), WTF::String("utf-8"), failingUrl);
+    coreFrame->loader()->load(request, substituteData, false);
+}
+
 // Provide a backward compatibility with previously exported private symbols as of QtWebKit 4.6 release
 
 void QWEBKIT_EXPORT qt_resumeActiveDOMObjects(QWebFrame* frame)
diff --git a/Source/WebKit/qt/WebCoreSupport/DumpRenderTreeSupportQt.h b/Source/WebKit/qt/WebCoreSupport/DumpRenderTreeSupportQt.h
index 1e7b275..78752d8 100644
--- a/Source/WebKit/qt/WebCoreSupport/DumpRenderTreeSupportQt.h
+++ b/Source/WebKit/qt/WebCoreSupport/DumpRenderTreeSupportQt.h
@@ -198,6 +198,7 @@ public:
     static void setMinimumTimerInterval(QWebPage*, double);
 
     static QUrl mediaContentUrlByElementId(QWebFrame*, const QString& elementId);
+    static void setAlternateHtml(QWebFrame*, const QString& html, const QUrl& baseUrl, const QUrl& failingUrl);
 };
 
 #endif
diff --git a/Source/WebKit/qt/WebCoreSupport/EditorClientQt.cpp b/Source/WebKit/qt/WebCoreSupport/EditorClientQt.cpp
index cf2fa41..e7bbd2c 100644
--- a/Source/WebKit/qt/WebCoreSupport/EditorClientQt.cpp
+++ b/Source/WebKit/qt/WebCoreSupport/EditorClientQt.cpp
@@ -76,9 +76,9 @@ static QString dumpRange(WebCore::Range *range)
         return QLatin1String("(null)");
     WebCore::ExceptionCode code;
 
-    QString str = QString("range from %1 of %2 to %3 of %4")
-        .arg(range->startOffset(code)).arg(dumpPath(range->startContainer(code)))
-        .arg(range->endOffset(code)).arg(dumpPath(range->endContainer(code)));
+    QString str = QString::fromLatin1("range from %1 of %2 to %3 of %4")
+            .arg(range->startOffset(code)).arg(dumpPath(range->startContainer(code)))
+            .arg(range->endOffset(code)).arg(dumpPath(range->endContainer(code)));
 
     return str;
 }
@@ -420,7 +420,7 @@ void EditorClientQt::handleKeyboardEvent(KeyboardEvent* event)
         return;
 
     // FIXME: refactor all of this to use Actions or something like them
-    if (start->isContentEditable()) {
+    if (start->rendererIsEditable()) {
         bool doSpatialNavigation = false;
         if (isSpatialNavigationEnabled(frame)) {
             if (!kevent->modifiers()) {
@@ -530,8 +530,22 @@ void EditorClientQt::handleKeyboardEvent(KeyboardEvent* event)
 #endif // QT_NO_SHORTCUT
 }
 
-void EditorClientQt::handleInputMethodKeydown(KeyboardEvent*)
+void EditorClientQt::handleInputMethodKeydown(KeyboardEvent* event)
 {
+#ifndef QT_NO_SHORTCUT
+    const PlatformKeyboardEvent* kevent = event->keyEvent();
+    if (kevent->type() == PlatformKeyboardEvent::RawKeyDown) {
+        QWebPage::WebAction action = QWebPagePrivate::editorActionForKeyEvent(kevent->qtEvent());
+        switch (action) {
+        case QWebPage::InsertParagraphSeparator:
+        case QWebPage::InsertLineSeparator:
+            m_page->triggerAction(action);
+            break;
+        default:
+            break;
+        }
+    }
+#endif
 }
 
 EditorClientQt::EditorClientQt(QWebPage* page)
diff --git a/Source/WebKit/qt/WebCoreSupport/FrameLoaderClientQt.cpp b/Source/WebKit/qt/WebCoreSupport/FrameLoaderClientQt.cpp
index 5cab6a7..d318494 100644
--- a/Source/WebKit/qt/WebCoreSupport/FrameLoaderClientQt.cpp
+++ b/Source/WebKit/qt/WebCoreSupport/FrameLoaderClientQt.cpp
@@ -1,6 +1,6 @@
 /*
  * Copyright (C) 2006 Zack Rusin <zack@kde.org>
- * Copyright (C) 2006 Apple Computer, Inc.  All rights reserved.
+ * Copyright (C) 2006, 2011 Apple Inc. All rights reserved.
  * Copyright (C) 2009 Nokia Corporation and/or its subsidiary(-ies)
  * Copyright (C) 2008 Collabora Ltd. All rights reserved.
  * Coypright (C) 2008 Holger Hans Peter Freyther
@@ -40,6 +40,9 @@
 #include "FrameView.h"
 #include "DocumentLoader.h"
 #include "HitTestResult.h"
+#if ENABLE(ICONDATABASE)
+#include "IconDatabaseClientQt.h"
+#endif
 #if USE(JSC)
 #include "JSDOMWindowBase.h"
 #elif USE(V8)
@@ -119,7 +122,7 @@ static QString drtDescriptionSuitableForTestResult(const WebCore::KURL& _url)
     if (_url.isEmpty() || !_url.isLocalFile())
         return _url.string();
     // Remove the leading path from file urls
-    return QString(_url.string()).replace(WebCore::FrameLoaderClientQt::dumpResourceLoadCallbacksPath, "").mid(1);
+    return QString(_url.string()).remove(WebCore::FrameLoaderClientQt::dumpResourceLoadCallbacksPath).mid(1);
 }
 
 static QString drtDescriptionSuitableForTestResult(const WebCore::ResourceError& error)
@@ -147,17 +150,17 @@ static QString drtDescriptionSuitableForTestResult(const RefPtr<WebCore::Node> n
 {
     QString result;
     if (exception) {
-        result.append("ERROR");
+        result.append(QLatin1String("ERROR"));
         return result;
     }
     if (!node) {
-        result.append("NULL");
+        result.append(QLatin1String("NULL"));
         return result;
     }
     result.append(node->nodeName());
     RefPtr<WebCore::Node> parent = node->parentNode();
     if (parent) {
-        result.append(" > ");
+        result.append(QLatin1String(" > "));
         result.append(drtDescriptionSuitableForTestResult(parent, 0));
     }
     return result;
@@ -437,6 +440,8 @@ void FrameLoaderClientQt::dispatchDidStartProvisionalLoad()
     if (dumpUserGestureInFrameLoaderCallbacks)
         printf("%s - in didStartProvisionalLoadForFrame\n", qPrintable(drtPrintFrameUserGestureStatus(m_frame)));
 
+    m_lastRequestedUrl = m_frame->loader()->activeDocumentLoader()->requestURL();
+
     if (m_webFrame)
         emit m_webFrame->provisionalLoad();
 }
@@ -481,7 +486,7 @@ void FrameLoaderClientQt::dispatchDidCommitLoad()
     // We should assume first the frame has no title. If it has, then the above dispatchDidReceiveTitle()
     // will be called very soon with the correct title.
     // This properly resets the title when we navigate to a URI without a title.
-    emit titleChanged(String());
+    emit titleChanged(QString());
 
     bool isMainFrame = (m_frame == m_frame->page()->mainFrame());
     if (!isMainFrame)
@@ -769,11 +774,25 @@ void FrameLoaderClientQt::didPerformFirstNavigation() const
     m_webFrame->page()->d->updateNavigationActions();
 }
 
-void FrameLoaderClientQt::registerForIconNotification(bool)
+void FrameLoaderClientQt::registerForIconNotification(bool shouldRegister)
 {
-    notImplemented();
+#if ENABLE(ICONDATABASE)
+    if (shouldRegister)
+        connect(IconDatabaseClientQt::instance(), SIGNAL(iconLoadedForPageURL(QString)), this, SLOT(onIconLoadedForPageURL(QString)), Qt::UniqueConnection);
+    else
+        disconnect(IconDatabaseClientQt::instance(), SIGNAL(iconLoadedForPageURL(QString)), this, SLOT(onIconLoadedForPageURL(QString)));
+#endif
 }
 
+void FrameLoaderClientQt::onIconLoadedForPageURL(const QString& url)
+{
+#if ENABLE(ICONDATABASE)
+    if (m_webFrame && m_webFrame->url() == url)
+        emit m_webFrame->iconChanged();
+#endif
+}
+
+
 void FrameLoaderClientQt::updateGlobalHistory()
 {
     QWebHistoryInterface *history = QWebHistoryInterface::defaultInterface();
@@ -1210,7 +1229,7 @@ void FrameLoaderClientQt::dispatchDecidePolicyForNavigationAction(FramePolicyFun
 
         printf("Policy delegate: attempt to load %s with navigation type '%s'%s\n",
                qPrintable(drtDescriptionSuitableForTestResult(request.url())), navigationTypeToString(action.type()),
-               (node) ? qPrintable(QString(" originating from " + drtDescriptionSuitableForTestResult(node, 0))) : "");
+               (node) ? qPrintable(QString::fromLatin1(" originating from ") + drtDescriptionSuitableForTestResult(node, 0)) : "");
 
         if (policyDelegatePermissive)
             result = PolicyUse;
@@ -1310,18 +1329,18 @@ void FrameLoaderClientQt::transferLoadingResourceFromPage(unsigned long, Documen
 {
 }
 
-ObjectContentType FrameLoaderClientQt::objectContentType(const KURL& url, const String& _mimeType)
+ObjectContentType FrameLoaderClientQt::objectContentType(const KURL& url, const String& mimeTypeIn, bool shouldPreferPlugInsForImages)
 {
-//    qDebug()<<" ++++++++++++++++ url is "<<url.prettyURL()<<", mime = "<<_mimeType;
+//    qDebug()<<" ++++++++++++++++ url is "<<url.prettyURL()<<", mime = "<<mimeTypeIn;
     QFileInfo fi(url.path());
     String extension = fi.suffix();
-    if (_mimeType == "application/x-qt-plugin" || _mimeType == "application/x-qt-styled-widget")
+    if (mimeTypeIn == "application/x-qt-plugin" || mimeTypeIn == "application/x-qt-styled-widget")
         return ObjectContentOtherPlugin;
 
-    if (url.isEmpty() && !_mimeType.length())
+    if (url.isEmpty() && !mimeTypeIn.length())
         return ObjectContentNone;
 
-    String mimeType = _mimeType;
+    String mimeType = mimeTypeIn;
     if (!mimeType.length())
         mimeType = MIMETypeRegistry::getMIMETypeForExtension(extension);
 
@@ -1331,14 +1350,17 @@ ObjectContentType FrameLoaderClientQt::objectContentType(const KURL& url, const
     if (!mimeType.length())
         return ObjectContentFrame;
 
-    if (MIMETypeRegistry::isSupportedImageMIMEType(mimeType))
-        return ObjectContentImage;
-
+    ObjectContentType plugInType = ObjectContentNone;
     if (PluginDatabase::installedPlugins()->isMIMETypeRegistered(mimeType))
-        return ObjectContentNetscapePlugin;
-
-    if (m_frame->page() && m_frame->page()->pluginData() && m_frame->page()->pluginData()->supportsMimeType(mimeType))
-        return ObjectContentOtherPlugin;
+        plugInType = ObjectContentNetscapePlugin;
+    else if (m_frame->page() && m_frame->page()->pluginData() && m_frame->page()->pluginData()->supportsMimeType(mimeType))
+        plugInType = ObjectContentOtherPlugin;
+        
+    if (MIMETypeRegistry::isSupportedImageMIMEType(mimeType))
+        return shouldPreferPlugInsForImages && plugInType != ObjectContentNone ? plugInType : ObjectContentImage;
+    
+    if (plugInType != ObjectContentNone)
+        return plugInType;
 
     if (MIMETypeRegistry::isSupportedNonImageMIMEType(mimeType))
         return ObjectContentFrame;
diff --git a/Source/WebKit/qt/WebCoreSupport/FrameLoaderClientQt.h b/Source/WebKit/qt/WebCoreSupport/FrameLoaderClientQt.h
index e5be421..3ec5f20 100644
--- a/Source/WebKit/qt/WebCoreSupport/FrameLoaderClientQt.h
+++ b/Source/WebKit/qt/WebCoreSupport/FrameLoaderClientQt.h
@@ -1,6 +1,6 @@
 /*
  * Copyright (C) 2006 Zack Rusin <zack@kde.org>
- * Copyright (C) 2006 Apple Computer, Inc.  All rights reserved.
+ * Copyright (C) 2006, 2011 Apple Inc. All rights reserved.
  * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
  * Copyright (C) 2008 Collabora Ltd. All rights reserved.
  *
@@ -211,7 +211,7 @@ public:
 
     virtual PassRefPtr<Widget> createJavaAppletWidget(const IntSize&, HTMLAppletElement*, const KURL& baseURL, const Vector<String>& paramNames, const Vector<String>& paramValues);
 
-    virtual ObjectContentType objectContentType(const KURL& url, const String& mimeType);
+    virtual ObjectContentType objectContentType(const KURL&, const String& mimeTypeIn, bool shouldPreferPlugInsForImages);
     virtual String overrideMediaType() const;
 
     virtual void dispatchDidClearWindowObjectInWorld(DOMWrapperWorld*);
@@ -239,6 +239,8 @@ public:
 
     virtual PassRefPtr<FrameNetworkingContext> createNetworkingContext();
 
+    const KURL& lastRequestedUrl() const { return m_lastRequestedUrl; }
+
     static bool dumpFrameLoaderCallbacks;
     static bool dumpUserGestureInFrameLoaderCallbacks;
     static bool dumpResourceLoadCallbacks;
@@ -253,6 +255,9 @@ public:
     static bool dumpHistoryCallbacks;
     static QMap<QString, QString> URLsToRedirect;
 
+private slots:
+    void onIconLoadedForPageURL(const QString&);
+
 private:
     Frame *m_frame;
     QWebFrame *m_webFrame;
@@ -267,6 +272,7 @@ private:
     // See finishedLoading().
     bool m_hasRepresentation;
 
+    KURL m_lastRequestedUrl;
     ResourceError m_loadError;
 };
 
diff --git a/Source/WebKit/qt/WebCoreSupport/FullScreenVideoWidget.cpp b/Source/WebKit/qt/WebCoreSupport/FullScreenVideoWidget.cpp
index 4922cd7..bb5e2b9 100644
--- a/Source/WebKit/qt/WebCoreSupport/FullScreenVideoWidget.cpp
+++ b/Source/WebKit/qt/WebCoreSupport/FullScreenVideoWidget.cpp
@@ -66,6 +66,7 @@ void FullScreenVideoWidget::show(QMediaPlayer* player)
     setMouseTracking(true);
     raise();
     m_mediaPlayer->setVideoOutput(this);
+    setFocus();
     grabMouse();
     hideCursor();
 }
@@ -73,6 +74,7 @@ void FullScreenVideoWidget::show(QMediaPlayer* player)
 void FullScreenVideoWidget::closeEvent(QCloseEvent* event)
 {
     m_mediaPlayer = 0;
+    m_cursorTimer.stop();
     setMouseTracking(false);
     releaseMouse();
     QApplication::restoreOverrideCursor();
diff --git a/Source/WebKit/qt/WebCoreSupport/GeolocationClientQt.cpp b/Source/WebKit/qt/WebCoreSupport/GeolocationClientQt.cpp
index 68a2af5..3c382cf 100644
--- a/Source/WebKit/qt/WebCoreSupport/GeolocationClientQt.cpp
+++ b/Source/WebKit/qt/WebCoreSupport/GeolocationClientQt.cpp
@@ -82,12 +82,7 @@ void GeolocationClientQt::positionUpdated(const QGeoPositionInfo &geoPosition)
     bool providesSpeed = geoPosition.hasAttribute(QGeoPositionInfo::GroundSpeed);
     double speed = geoPosition.attribute(QGeoPositionInfo::GroundSpeed);
 
-#if QT_VERSION >= QT_VERSION_CHECK(4, 7, 0)
     double timeStampInSeconds = geoPosition.timestamp().toMSecsSinceEpoch() / 1000;
-#else
-    QDateTime datetime = geoPosition.timestamp();
-    double timeStampInSeconds = (datetime.toTime_t() + datetime.time().msec()) / 1000;
-#endif
 
     m_lastPosition = GeolocationPosition::create(timeStampInSeconds, latitude, longitude,
                                                  accuracy, providesAltitude, altitude,
@@ -140,3 +135,5 @@ void GeolocationClientQt::cancelPermissionRequest(Geolocation* geolocation)
 }
 
 } // namespace WebCore
+
+#include "moc_GeolocationClientQt.cpp"
diff --git a/Source/WebKit/qt/WebCoreSupport/IconDatabaseClientQt.cpp b/Source/WebKit/qt/WebCoreSupport/IconDatabaseClientQt.cpp
new file mode 100644
index 0000000..77b41db
--- /dev/null
+++ b/Source/WebKit/qt/WebCoreSupport/IconDatabaseClientQt.cpp
@@ -0,0 +1,83 @@
+/*
+ * Copyright (C) 2011 Andreas Kling <kling@webkit.org>
+ *
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "IconDatabaseClientQt.h"
+
+#include "FrameLoaderClientQt.h"
+#include "IconDatabaseBase.h"
+#include <wtf/text/CString.h>
+
+namespace WebCore {
+
+IconDatabaseClientQt* IconDatabaseClientQt::instance()
+{
+    static IconDatabaseClientQt* client = 0;
+    if (!client) {
+        client = new IconDatabaseClientQt;
+        iconDatabase().setClient(client);
+    }
+    return client;
+}
+
+IconDatabaseClientQt::IconDatabaseClientQt()
+{
+}
+
+IconDatabaseClientQt::~IconDatabaseClientQt()
+{
+}
+
+bool IconDatabaseClientQt::performImport()
+{
+    return true;
+}
+
+void IconDatabaseClientQt::didRemoveAllIcons()
+{
+}
+
+void IconDatabaseClientQt::didImportIconURLForPageURL(const String& url)
+{
+}
+
+void IconDatabaseClientQt::didImportIconDataForPageURL(const String& url)
+{
+    emit iconLoadedForPageURL(url);
+}
+
+void IconDatabaseClientQt::didChangeIconForPageURL(const String& url)
+{
+}
+
+void IconDatabaseClientQt::didFinishURLImport()
+{
+}
+
+}
+
+#include "moc_IconDatabaseClientQt.cpp"
diff --git a/Source/WebKit/qt/WebCoreSupport/IconDatabaseClientQt.h b/Source/WebKit/qt/WebCoreSupport/IconDatabaseClientQt.h
new file mode 100644
index 0000000..593fdd3
--- /dev/null
+++ b/Source/WebKit/qt/WebCoreSupport/IconDatabaseClientQt.h
@@ -0,0 +1,58 @@
+/*
+ * Copyright (C) 2011 Andreas Kling <kling@webkit.org>
+ *
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef IconDatabaseClientQt_h
+#define IconDatabaseClientQt_h
+
+#include "IconDatabaseClient.h"
+#include <QtCore/QObject>
+
+namespace WebCore {
+
+class IconDatabaseClientQt : public QObject, public IconDatabaseClient {
+    Q_OBJECT
+public:
+    static IconDatabaseClientQt* instance();
+
+    virtual bool performImport();
+    virtual void didRemoveAllIcons();
+    virtual void didImportIconURLForPageURL(const String&);
+    virtual void didImportIconDataForPageURL(const String&);
+    virtual void didChangeIconForPageURL(const String&);
+    virtual void didFinishURLImport();
+
+signals:
+    void iconLoadedForPageURL(const QString&);
+
+private:
+    IconDatabaseClientQt();
+    virtual ~IconDatabaseClientQt();
+};
+
+}
+
+#endif
diff --git a/Source/WebKit/qt/WebCoreSupport/InspectorClientQt.cpp b/Source/WebKit/qt/WebCoreSupport/InspectorClientQt.cpp
index 441add6..6b557db 100644
--- a/Source/WebKit/qt/WebCoreSupport/InspectorClientQt.cpp
+++ b/Source/WebKit/qt/WebCoreSupport/InspectorClientQt.cpp
@@ -140,7 +140,7 @@ public:
         QVariant valueToStore = settingToVariant(value);
         QString settingKey(settingStoragePrefix + QString(name));
         qsettings.setValue(settingKey, valueToStore);
-        qsettings.setValue(settingKey + settingStorageTypeSuffix, QVariant::typeToName(valueToStore.type()));
+        qsettings.setValue(settingKey + settingStorageTypeSuffix, QLatin1String(QVariant::typeToName(valueToStore.type())));
 #endif // QT_NO_SETTINGS
     }
 
@@ -174,22 +174,6 @@ private:
 
 }
 
-#if USE(V8)
-static void ensureDebuggerScriptLoaded()
-{
-    static bool scriptLoaded = false;
-    if (scriptLoaded)
-        return;
-
-    QFile debuggerScriptFile(":/webkit/inspector/DebuggerScript.js");
-    if (debuggerScriptFile.open(QIODevice::ReadOnly)) {
-        QByteArray ba = debuggerScriptFile.readAll();
-        ScriptDebugServer::shared().setDebuggerScriptSource(String(ba.constData(), ba.length()));
-        scriptLoaded = true;
-    }
-}
-#endif
-
 InspectorClientQt::InspectorClientQt(QWebPage* page)
     : m_inspectedWebPage(page)
     , m_frontendWebPage(0)
@@ -218,10 +202,6 @@ void InspectorClientQt::inspectorDestroyed()
 void InspectorClientQt::openInspectorFrontend(WebCore::InspectorController* inspectorController)
 {
 #if ENABLE(INSPECTOR)
-#if USE(V8)
-    ensureDebuggerScriptLoaded();
-#endif
-
     QWebView* inspectorView = new QWebView;
     InspectorClientWebPage* inspectorPage = new InspectorClientWebPage(inspectorView);
     inspectorView->setPage(inspectorPage);
@@ -240,7 +220,7 @@ void InspectorClientQt::openInspectorFrontend(WebCore::InspectorController* insp
     inspectorUrl = inspector->property("_q_inspectorUrl").toUrl();
 #endif
     if (!inspectorUrl.isValid())
-        inspectorUrl = QUrl("qrc:/webkit/inspector/inspector.html");
+        inspectorUrl = QUrl(QLatin1String("qrc:/webkit/inspector/inspector.html"));
 
 #ifndef QT_NO_PROPERTIES
     QVariant inspectorJavaScriptWindowObjects = inspector->property("_q_inspectorJavaScriptWindowObjects");
diff --git a/Source/WebKit/qt/WebCoreSupport/InspectorServerQt.cpp b/Source/WebKit/qt/WebCoreSupport/InspectorServerQt.cpp
index f83deb2..92b7d5c 100644
--- a/Source/WebKit/qt/WebCoreSupport/InspectorServerQt.cpp
+++ b/Source/WebKit/qt/WebCoreSupport/InspectorServerQt.cpp
@@ -73,11 +73,10 @@ static quint32 parseWebSocketChallengeNumber(QString field)
     int numSpaces = 0;
     for (int i = 0; i < field.size(); i++) {
         QChar c = field[i];
-        if (c == (QChar)' ') {
+        if (c == QLatin1Char(' '))
             numSpaces++;
-        } else if ((c >= (QChar)'0') && (c <= (QChar)'9')) {
-            nString.append((QChar)c);
-        }
+        else if ((c >= QLatin1Char('0')) && (c <= QLatin1Char('9')))
+            nString.append(c);
     }
     quint32 num = nString.toLong();
     quint32 result = (numSpaces ? (num / numSpaces) : num);
@@ -195,7 +194,7 @@ void InspectorServerRequestHandlerQt::tcpReadyRead()
                 m_path = header.path();
                 m_contentType = header.contentType().toLatin1();
                 m_contentLength = header.contentLength();
-                if (header.hasKey("Upgrade") && (header.value("Upgrade") == QLatin1String("WebSocket")))
+                if (header.hasKey(QLatin1String("Upgrade")) && (header.value(QLatin1String("Upgrade")) == QLatin1String("WebSocket")))
                     isWebSocket = true;
 
                 m_data.clear();
@@ -204,9 +203,9 @@ void InspectorServerRequestHandlerQt::tcpReadyRead()
     }
 
     if (m_endOfHeaders) {
-        QStringList pathAndQuery = m_path.split("?");
+        QStringList pathAndQuery = m_path.split(QLatin1Char('?'));
         m_path = pathAndQuery[0];
-        QStringList words = m_path.split(QString::fromLatin1("/"));
+        QStringList words = m_path.split(QLatin1Char('/'));
 
         if (isWebSocket) {
             // switch to websocket-style WebSocketService messaging
@@ -216,18 +215,18 @@ void InspectorServerRequestHandlerQt::tcpReadyRead()
 
                 QByteArray key3 = m_tcpConnection->read(8);
 
-                quint32 number1 = parseWebSocketChallengeNumber(header.value("Sec-WebSocket-Key1"));
-                quint32 number2 = parseWebSocketChallengeNumber(header.value("Sec-WebSocket-Key2"));
+                quint32 number1 = parseWebSocketChallengeNumber(header.value(QLatin1String("Sec-WebSocket-Key1")));
+                quint32 number2 = parseWebSocketChallengeNumber(header.value(QLatin1String("Sec-WebSocket-Key2")));
 
                 char responseData[16];
                 generateWebSocketChallengeResponse(number1, number2, (unsigned char*)key3.data(), (unsigned char*)responseData);
                 QByteArray response(responseData, sizeof(responseData));
 
-                QHttpResponseHeader responseHeader(101, "WebSocket Protocol Handshake", 1, 1);
-                responseHeader.setValue("Upgrade", header.value("Upgrade"));
-                responseHeader.setValue("Connection", header.value("Connection"));
-                responseHeader.setValue("Sec-WebSocket-Origin", header.value("Origin"));
-                responseHeader.setValue("Sec-WebSocket-Location", ("ws://" + header.value("Host") + m_path));
+                QHttpResponseHeader responseHeader(101, QLatin1String("WebSocket Protocol Handshake"), 1, 1);
+                responseHeader.setValue(QLatin1String("Upgrade"), header.value(QLatin1String("Upgrade")));
+                responseHeader.setValue(QLatin1String("Connection"), header.value(QLatin1String("Connection")));
+                responseHeader.setValue(QLatin1String("Sec-WebSocket-Origin"), header.value(QLatin1String("Origin")));
+                responseHeader.setValue(QLatin1String("Sec-WebSocket-Location"), (QLatin1String("ws://") + header.value(QLatin1String("Host")) + m_path));
                 responseHeader.setContentLength(response.size());
                 m_tcpConnection->write(responseHeader.toString().toLatin1());
                 m_tcpConnection->write(response);
@@ -259,19 +258,19 @@ void InspectorServerRequestHandlerQt::tcpReadyRead()
         QString text = QString::fromLatin1("OK");
 
         // If no path is specified, generate an index page.
-        if ((m_path == "") || (m_path == "/")) {
-            QString indexHtml = "<html><head><title>Remote Web Inspector</title></head><body><ul>\n";
+        if (m_path.isEmpty() || (m_path == QString(QLatin1Char('/')))) {
+            QString indexHtml = QLatin1String("<html><head><title>Remote Web Inspector</title></head><body><ul>\n");
             for (QMap<int, InspectorClientQt* >::const_iterator it = m_server->m_inspectorClients.begin();
                  it != m_server->m_inspectorClients.end(); 
                  ++it) {
-                indexHtml.append(QString("<li><a href=\"/webkit/inspector/inspector.html?page=%1\">%2</li>\n")
+                indexHtml.append(QString::fromLatin1("<li><a href=\"/webkit/inspector/inspector.html?page=%1\">%2</li>\n")
                                  .arg(it.key())
                                  .arg(it.value()->m_inspectedWebPage->mainFrame()->url().toString()));
             }
-            indexHtml.append("</ul></body></html>");
+            indexHtml.append(QLatin1String("</ul></body></html>"));
             response = indexHtml.toLatin1();
         } else {
-            QString path = QString(":%1").arg(m_path);
+            QString path = QString::fromLatin1(":%1").arg(m_path);
             QFile file(path);
             // It seems that there should be an enum or define for these status codes somewhere in Qt or WebKit,
             // but grep fails to turn one up.
diff --git a/Source/WebKit/qt/WebCoreSupport/PopupMenuQt.cpp b/Source/WebKit/qt/WebCoreSupport/PopupMenuQt.cpp
index f7c4edc..b662f5c 100644
--- a/Source/WebKit/qt/WebCoreSupport/PopupMenuQt.cpp
+++ b/Source/WebKit/qt/WebCoreSupport/PopupMenuQt.cpp
@@ -44,6 +44,10 @@ public:
     virtual int itemCount() const { return d ? d->listSize() : 0; }
     virtual bool itemIsSelected(int idx) const { return d ? d->itemIsSelected(idx) : false; }
     virtual bool multiple() const;
+    virtual QColor backgroundColor() const { return d ? QColor(d->menuStyle().backgroundColor()) : QColor(); }
+    virtual QColor foregroundColor() const { return d ? QColor(d->menuStyle().foregroundColor()) : QColor(); }
+    virtual QColor itemBackgroundColor(int idx) const { return d ? QColor(d->itemStyle(idx).backgroundColor()) : QColor(); }
+    virtual QColor itemForegroundColor(int idx) const { return d ? QColor(d->itemStyle(idx).foregroundColor()) : QColor(); }
 
 private:
     WebCore::PopupMenuClient*& d;
@@ -157,4 +161,6 @@ void PopupMenuQt::selectItem(int index, bool ctrl, bool shift)
 
 }
 
+#include "moc_PopupMenuQt.cpp"
+
 // vim: ts=4 sw=4 et
diff --git a/Source/WebKit/qt/WebCoreSupport/QtFallbackWebPopup.cpp b/Source/WebKit/qt/WebCoreSupport/QtFallbackWebPopup.cpp
index afa6492..5e641de 100644
--- a/Source/WebKit/qt/WebCoreSupport/QtFallbackWebPopup.cpp
+++ b/Source/WebKit/qt/WebCoreSupport/QtFallbackWebPopup.cpp
@@ -124,6 +124,17 @@ void QtFallbackWebPopup::show(const QWebSelectData& data)
 
     populate(data);
 
+    QColor backgroundColor = data.backgroundColor();
+    QColor foregroundColor = data.foregroundColor();
+
+    QPalette palette = m_combo->palette();
+    if (backgroundColor.isValid())
+        palette.setColor(QPalette::Background, backgroundColor);
+    if (foregroundColor.isValid())
+        palette.setColor(QPalette::Foreground, foregroundColor);
+    m_combo->setPalette(palette);
+
+
     QRect rect = geometry();
     if (QGraphicsWebView *webView = qobject_cast<QGraphicsWebView*>(pageClient()->pluginParent())) {
         QGraphicsProxyWidget* proxy = new QGraphicsProxyWidget(webView);
@@ -235,6 +246,8 @@ void QtFallbackWebPopup::populate(const QWebSelectData& data)
 #ifndef QT_NO_TOOLTIP
             model->item(i)->setToolTip(data.itemToolTip(i));
 #endif
+            model->item(i)->setBackground(data.itemBackgroundColor(i));
+            model->item(i)->setForeground(data.itemForegroundColor(i));
             if (data.itemIsSelected(i))
                 currentIndex = i;
             break;
diff --git a/Source/WebKit/qt/WebCoreSupport/WebPlatformStrategies.cpp b/Source/WebKit/qt/WebCoreSupport/WebPlatformStrategies.cpp
index fffb564..182fe38 100644
--- a/Source/WebKit/qt/WebCoreSupport/WebPlatformStrategies.cpp
+++ b/Source/WebKit/qt/WebCoreSupport/WebPlatformStrategies.cpp
@@ -332,7 +332,7 @@ String WebPlatformStrategies::contextMenuItemTagSearchWeb()
     return QCoreApplication::translate("QWebPage", "Search The Web", "Search The Web context menu item");
 }
 
-String WebPlatformStrategies::contextMenuItemTagLookUpInDictionary()
+String WebPlatformStrategies::contextMenuItemTagLookUpInDictionary(const String&)
 {
     return QCoreApplication::translate("QWebPage", "Look Up In Dictionary", "Look Up in Dictionary context menu item");
 }
diff --git a/Source/WebKit/qt/WebCoreSupport/WebPlatformStrategies.h b/Source/WebKit/qt/WebCoreSupport/WebPlatformStrategies.h
index fbcfd16..b74af39 100644
--- a/Source/WebKit/qt/WebCoreSupport/WebPlatformStrategies.h
+++ b/Source/WebKit/qt/WebCoreSupport/WebPlatformStrategies.h
@@ -86,7 +86,7 @@ private:
     virtual WTF::String contextMenuItemTagIgnoreSpelling();
     virtual WTF::String contextMenuItemTagLearnSpelling();
     virtual WTF::String contextMenuItemTagSearchWeb();
-    virtual WTF::String contextMenuItemTagLookUpInDictionary();
+    virtual WTF::String contextMenuItemTagLookUpInDictionary(const String&);
     virtual WTF::String contextMenuItemTagOpenLink();
     virtual WTF::String contextMenuItemTagIgnoreGrammar();
     virtual WTF::String contextMenuItemTagSpellingMenu();
diff --git a/Source/WebKit/qt/declarative/plugin.cpp b/Source/WebKit/qt/declarative/plugin.cpp
index f1f165e..49af415 100644
--- a/Source/WebKit/qt/declarative/plugin.cpp
+++ b/Source/WebKit/qt/declarative/plugin.cpp
@@ -32,6 +32,11 @@ public:
         Q_ASSERT(QLatin1String(uri) == QLatin1String("QtWebKit"));
         qmlRegisterType<QDeclarativeWebSettings>();
         qmlRegisterType<QDeclarativeWebView>(uri, 1, 0, "WebView");
+#if QT_VERSION >= 0x040703
+        qmlRegisterType<QDeclarativeWebView>(uri, 1, 1, "WebView");
+        qmlRegisterRevision<QDeclarativeWebView, 0>("QtWebKit", 1, 0);
+        qmlRegisterRevision<QDeclarativeWebView, 1>("QtWebKit", 1, 1);
+#endif
     }
 };
 
diff --git a/Source/WebKit/qt/declarative/qdeclarativewebview.cpp b/Source/WebKit/qt/declarative/qdeclarativewebview.cpp
index 9313d6c..83645aa 100644
--- a/Source/WebKit/qt/declarative/qdeclarativewebview.cpp
+++ b/Source/WebKit/qt/declarative/qdeclarativewebview.cpp
@@ -517,13 +517,12 @@ void QDeclarativeWebView::geometryChanged(const QRectF& newGeometry, const QRect
             }
         }
 
-        html: "<script>console.log(\"This is in WebKit!\"); window.qml.qmlCall();</script>"
+        html: "<script>window.qml.qmlCall();</script>"
     }
     \endqml
 
     The output of the example will be:
     \code
-    This is in WebKit!
     This call is in QML!
     \endcode
 
@@ -772,7 +771,6 @@ void QDeclarativeWebView::setPage(QWebPage* page)
     page->mainFrame()->setScrollBarPolicy(Qt::Vertical, Qt::ScrollBarAlwaysOff);
     connect(page->mainFrame(), SIGNAL(urlChanged(QUrl)), this, SLOT(pageUrlChanged()));
     connect(page->mainFrame(), SIGNAL(titleChanged(QString)), this, SIGNAL(titleChanged(QString)));
-    connect(page->mainFrame(), SIGNAL(titleChanged(QString)), this, SIGNAL(iconChanged()));
     connect(page->mainFrame(), SIGNAL(iconChanged()), this, SIGNAL(iconChanged()));
     connect(page->mainFrame(), SIGNAL(initialLayoutCompleted()), this, SLOT(initialLayout()));
     connect(page->mainFrame(), SIGNAL(contentsSizeChanged(QSize)), this, SIGNAL(contentsSizeChanged(QSize)));
@@ -983,6 +981,29 @@ void QDeclarativeWebView::setContentsScale(qreal scale)
     emit contentsScaleChanged();
 }
 
+#if QT_VERSION >= 0x040703
+/*!
+    \qmlproperty color WebView::backgroundColor
+    \since QtWebKit 1.1
+    This property holds the background color of the view.
+*/
+
+QColor QDeclarativeWebView::backgroundColor() const
+{
+    return d->view->palette().base().color();
+}
+
+void QDeclarativeWebView::setBackgroundColor(const QColor& color)
+{
+    QPalette palette = d->view->palette();
+    if (palette.base().color() == color)
+        return;
+    palette.setBrush(QPalette::Base, color);
+    d->view->setPalette(palette);
+    emit backgroundColorChanged();
+}
+#endif
+
 /*!
     Returns the area of the largest element at position (\a x,\a y) that is no larger
     than \a maxWidth by \a maxHeight pixels.
diff --git a/Source/WebKit/qt/declarative/qdeclarativewebview_p.h b/Source/WebKit/qt/declarative/qdeclarativewebview_p.h
index ca15a1e..05f35f6 100644
--- a/Source/WebKit/qt/declarative/qdeclarativewebview_p.h
+++ b/Source/WebKit/qt/declarative/qdeclarativewebview_p.h
@@ -123,6 +123,9 @@ class QDeclarativeWebView : public QDeclarativeItem {
 
     Q_PROPERTY(QSize contentsSize READ contentsSize NOTIFY contentsSizeChanged)
     Q_PROPERTY(qreal contentsScale READ contentsScale WRITE setContentsScale NOTIFY contentsScaleChanged)
+#if QT_VERSION >= 0x040703
+    Q_PROPERTY(QColor backgroundColor READ backgroundColor WRITE setBackgroundColor NOTIFY backgroundColorChanged REVISION 1)
+#endif
 
 public:
     QDeclarativeWebView(QDeclarativeItem *parent = 0);
@@ -193,6 +196,11 @@ public:
     void setContentsScale(qreal scale);
     qreal contentsScale() const;
 
+#if QT_VERSION >= 0x040703
+    Q_REVISION(1) QColor backgroundColor() const;
+    Q_REVISION(1) void setBackgroundColor(const QColor&);
+#endif
+
 Q_SIGNALS:
     void preferredWidthChanged();
     void preferredHeightChanged();
@@ -209,6 +217,9 @@ Q_SIGNALS:
     void renderingEnabledChanged();
     void contentsSizeChanged(const QSize&);
     void contentsScaleChanged();
+#if QT_VERSION >= 0x040703
+    void backgroundColorChanged();
+#endif
 
     void loadStarted();
     void loadFinished();
diff --git a/Source/WebKit/qt/tests/benchmarks/webgl/10000_triangles.html b/Source/WebKit/qt/tests/benchmarks/webgl/10000_triangles.html
new file mode 100644
index 0000000..fd061aa
--- /dev/null
+++ b/Source/WebKit/qt/tests/benchmarks/webgl/10000_triangles.html
@@ -0,0 +1,59 @@
+<html>
+  <body style="margin: 0">
+    <canvas width="1000" height="1000"></canvas>
+  </body>
+</html>
+<script>
+    var canvas = document.getElementsByTagName("canvas")[0];
+    gl = canvas.getContext("experimental-webgl");
+    gl.clearColor(0.0, 1.0, 0.0, 1.0);
+    gl.viewport(0, 0, canvas.width, canvas.height);
+
+    var vertexShader = gl.createShader(gl.VERTEX_SHADER);
+    gl.shaderSource(vertexShader, "attribute vec4 vPosition;\nvoid main() { gl_Position = vPosition; }");
+    gl.compileShader(vertexShader);
+
+    var fragmentShader = gl.createShader(gl.FRAGMENT_SHADER);
+    gl.shaderSource(fragmentShader, "void main() { gl_FragColor = vec4(1.0, 0.0, 0.0, 1.0); }");
+    gl.compileShader(fragmentShader);
+
+    var shaderProgram = gl.createProgram();
+    gl.attachShader(shaderProgram, vertexShader);
+    gl.attachShader(shaderProgram, fragmentShader);
+    gl.bindAttribLocation(shaderProgram, 0, "vPosition");
+    gl.linkProgram(shaderProgram);
+
+    gl.useProgram(shaderProgram);
+
+    var buffer = gl.createBuffer();
+    gl.bindBuffer(gl.ARRAY_BUFFER, buffer);
+
+    var vertices = [];
+    var seedX = -1.0;
+    var seedY = 1.0;
+    for (var i = 1; i <= 10000; ++i) {
+        vertices.push(seedX);
+        vertices.push(seedY);
+        vertices.push(0);
+        seedX += 0.01;
+        vertices.push(seedX);
+        vertices.push(seedY - 0.02);
+        vertices.push(0);
+        seedX += 0.01;
+        vertices.push(seedX);
+        vertices.push(seedY);
+        vertices.push(0);
+        if (!(i % 100)) {
+            seedX = -1.0;
+            seedY -= 0.02;
+        }
+    }
+    gl.bufferData(gl.ARRAY_BUFFER, new Float32Array(vertices), gl.STATIC_DRAW);
+
+
+    gl.vertexAttribPointer(0, 3, gl.FLOAT, false, 0, 0);
+    gl.enableVertexAttribArray(0);
+    gl.clear(gl.COLOR_BUFFER_BIT);
+    gl.drawArrays(gl.TRIANGLES, 0, 30000);
+    gl.flush();
+</script>
diff --git a/Source/WebKit/qt/tests/benchmarks/webgl/tst_webgl.cpp b/Source/WebKit/qt/tests/benchmarks/webgl/tst_webgl.cpp
new file mode 100644
index 0000000..bd865a2
--- /dev/null
+++ b/Source/WebKit/qt/tests/benchmarks/webgl/tst_webgl.cpp
@@ -0,0 +1,130 @@
+/*
+    Copyright (C) 2011 Nokia Corporation and/or its subsidiary(-ies)
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+
+#include "../../util.h"
+#include <QGLWidget>
+#include <QGraphicsView>
+#include <QGraphicsWebView>
+#include <QScopedPointer>
+#include <QWebFrame>
+#include <QtTest/QtTest>
+
+class GraphicsView;
+
+class tst_WebGlPerformance : public QObject {
+    Q_OBJECT
+
+private slots:
+    void init();
+    void cleanup();
+
+    void benchSoftwareFallbackRgb16();
+    void benchSoftwareFallbackRgb32();
+    void benchSoftwareFallbackArgb32();
+    void benchSoftwareFallbackArgb32Premultiplied();
+
+private:
+    void benchmarkFrameRenderingOnImage(QImage::Format);
+
+    QScopedPointer<GraphicsView> m_view;
+};
+
+class GraphicsView : public QGraphicsView {
+public:
+    GraphicsView();
+    QGraphicsWebView* m_webView;
+
+protected:
+    void resizeEvent(QResizeEvent*);
+};
+
+GraphicsView::GraphicsView()
+{
+    QGraphicsScene* const scene = new QGraphicsScene(this);
+    setScene(scene);
+
+    m_webView = new QGraphicsWebView;
+    scene->addItem(m_webView);
+
+    m_webView->page()->settings()->setAttribute(QWebSettings::WebGLEnabled, true);
+
+    resize(800, 600);
+    setFrameShape(QFrame::NoFrame);
+    setViewport(new QGLWidget);
+}
+
+void GraphicsView::resizeEvent(QResizeEvent* event)
+{
+    QGraphicsView::resizeEvent(event);
+    QRectF rect(QPoint(0, 0), event->size());
+    m_webView->setGeometry(rect);
+    scene()->setSceneRect(rect);
+}
+
+void tst_WebGlPerformance::init()
+{
+    m_view.reset(new GraphicsView);
+    m_view->showMaximized();
+    QTest::qWaitForWindowShown(m_view.data());
+}
+
+void tst_WebGlPerformance::cleanup()
+{
+    m_view.reset();
+}
+
+void tst_WebGlPerformance::benchSoftwareFallbackRgb16()
+{
+    benchmarkFrameRenderingOnImage(QImage::Format_RGB16);
+}
+
+void tst_WebGlPerformance::benchSoftwareFallbackRgb32()
+{
+    benchmarkFrameRenderingOnImage(QImage::Format_RGB32);
+}
+
+void tst_WebGlPerformance::benchSoftwareFallbackArgb32()
+{
+    benchmarkFrameRenderingOnImage(QImage::Format_ARGB32);
+}
+
+void tst_WebGlPerformance::benchSoftwareFallbackArgb32Premultiplied()
+{
+    benchmarkFrameRenderingOnImage(QImage::Format_ARGB32_Premultiplied);
+}
+
+void tst_WebGlPerformance::benchmarkFrameRenderingOnImage(QImage::Format format)
+{
+    m_view->m_webView->load(QUrl(QLatin1String("qrc:///testcases/10000_triangles.html")));
+    const bool pageLoaded = waitForSignal(m_view->m_webView, SIGNAL(loadFinished(bool)));
+    Q_ASSERT(pageLoaded);
+    Q_UNUSED(pageLoaded);
+
+    QImage target(m_view->size(), format);
+    QBENCHMARK {
+        QPainter painter(&target);
+        m_view->render(&painter);
+        painter.end();
+    }
+}
+
+QTEST_MAIN(tst_WebGlPerformance)
+
+#include "tst_webgl.moc"
diff --git a/Source/WebKit/qt/tests/benchmarks/webgl/tst_webgl.qrc b/Source/WebKit/qt/tests/benchmarks/webgl/tst_webgl.qrc
new file mode 100644
index 0000000..b849448
--- /dev/null
+++ b/Source/WebKit/qt/tests/benchmarks/webgl/tst_webgl.qrc
@@ -0,0 +1,5 @@
+<RCC>
+    <qresource prefix="/testcases">
+        <file>10000_triangles.html</file>
+    </qresource>
+</RCC>
diff --git a/Source/WebKit/qt/tests/benchmarks/webgl/webgl.pro b/Source/WebKit/qt/tests/benchmarks/webgl/webgl.pro
new file mode 100644
index 0000000..fb21bc8
--- /dev/null
+++ b/Source/WebKit/qt/tests/benchmarks/webgl/webgl.pro
@@ -0,0 +1,4 @@
+isEmpty(OUTPUT_DIR): OUTPUT_DIR = ../../../../..
+include(../../tests.pri)
+exists($${TARGET}.qrc):RESOURCES += $${TARGET}.qrc
+QT += opengl
diff --git a/Source/WebKit/qt/tests/qdeclarativewebview/resources/webviewbackgroundcolor.qml b/Source/WebKit/qt/tests/qdeclarativewebview/resources/webviewbackgroundcolor.qml
new file mode 100644
index 0000000..2edc794
--- /dev/null
+++ b/Source/WebKit/qt/tests/qdeclarativewebview/resources/webviewbackgroundcolor.qml
@@ -0,0 +1,10 @@
+import Qt 4.7
+import QtWebKit 1.1
+
+WebView {
+    id: myweb
+    height: 300
+    width: 300
+    focus: true
+    backgroundColor : "red"
+}
diff --git a/Source/WebKit/qt/tests/qdeclarativewebview/tst_qdeclarativewebview.cpp b/Source/WebKit/qt/tests/qdeclarativewebview/tst_qdeclarativewebview.cpp
index 0025d6c..8fcab71 100644
--- a/Source/WebKit/qt/tests/qdeclarativewebview/tst_qdeclarativewebview.cpp
+++ b/Source/WebKit/qt/tests/qdeclarativewebview/tst_qdeclarativewebview.cpp
@@ -1,4 +1,5 @@
 #include "../util.h"
+#include <QColor>
 #include <QDebug>
 #include <QDeclarativeComponent>
 #include <QDeclarativeEngine>
@@ -22,6 +23,9 @@ private slots:
     void preferredHeightTest();
     void preferredWidthDefaultTest();
     void preferredHeightDefaultTest();
+#if QT_VERSION >= 0x040703
+    void backgroundColor();
+#endif
 
 private:
     void checkNoErrors(const QDeclarativeComponent&);
@@ -82,6 +86,36 @@ void tst_QDeclarativeWebView::preferredHeightDefaultTest()
     QCOMPARE(wv->property("prefHeight").toDouble(), view.preferredHeight());
 }
 
+#if QT_VERSION >= 0x040703
+void tst_QDeclarativeWebView::backgroundColor()
+{
+    // We test here the rendering of the background.
+    QDeclarativeEngine engine;
+    QDeclarativeComponent component(&engine, QUrl("qrc:///resources/webviewbackgroundcolor.qml"));
+    checkNoErrors(component);
+    QObject* wv = component.create();
+    QVERIFY(wv);
+    QCOMPARE(wv->property("backgroundColor").value<QColor>(), QColor(Qt::red));
+    QDeclarativeView view;
+    view.setSource(QUrl("qrc:///resources/webviewbackgroundcolor.qml"));
+    view.show();
+    QTest::qWaitForWindowShown(&view);
+    QPixmap result(view.width(), view.height());
+    QPainter painter(&result);
+    view.render(&painter);
+    QPixmap reference(view.width(), view.height());
+    reference.fill(Qt::red);
+    QCOMPARE(reference, result);
+
+    // We test the emission of the backgroundColorChanged signal.
+    QSignalSpy spyColorChanged(wv, SIGNAL(backgroundColorChanged()));
+    wv->setProperty("backgroundColor", Qt::red);
+    QCOMPARE(spyColorChanged.count(), 0);
+    wv->setProperty("backgroundColor", Qt::green);
+    QCOMPARE(spyColorChanged.count(), 1);
+}
+#endif
+
 void tst_QDeclarativeWebView::checkNoErrors(const QDeclarativeComponent& component)
 {
     // Wait until the component is ready
diff --git a/Source/WebKit/qt/tests/qdeclarativewebview/tst_qdeclarativewebview.qrc b/Source/WebKit/qt/tests/qdeclarativewebview/tst_qdeclarativewebview.qrc
index 9c27409..e14c333 100644
--- a/Source/WebKit/qt/tests/qdeclarativewebview/tst_qdeclarativewebview.qrc
+++ b/Source/WebKit/qt/tests/qdeclarativewebview/tst_qdeclarativewebview.qrc
@@ -3,5 +3,6 @@
         <file>resources/webviewtestdefault.qml</file>
         <file>resources/webviewtest.qml</file>
         <file>resources/sample.html</file>
+        <file>resources/webviewbackgroundcolor.qml</file>
     </qresource>
 </RCC>
diff --git a/Source/WebKit/qt/tests/qgraphicswebview/qgraphicswebview.pro b/Source/WebKit/qt/tests/qgraphicswebview/qgraphicswebview.pro
index e915d60..e5494ae 100644
--- a/Source/WebKit/qt/tests/qgraphicswebview/qgraphicswebview.pro
+++ b/Source/WebKit/qt/tests/qgraphicswebview/qgraphicswebview.pro
@@ -1,3 +1,6 @@
 isEmpty(OUTPUT_DIR): OUTPUT_DIR = ../../../..
 include(../tests.pri)
 exists($${TARGET}.qrc):RESOURCES += $${TARGET}.qrc
+contains(DEFINES, ENABLE_WEBGL=1) {
+    QT += opengl
+}
diff --git a/Source/WebKit/qt/tests/qgraphicswebview/resources/pointing_right.html b/Source/WebKit/qt/tests/qgraphicswebview/resources/pointing_right.html
new file mode 100644
index 0000000..bc592fb
--- /dev/null
+++ b/Source/WebKit/qt/tests/qgraphicswebview/resources/pointing_right.html
@@ -0,0 +1,45 @@
+<html>
+  <body style="margin: 0">
+    <canvas width="100" height="100"></canvas>
+  </body>
+</html>
+<script>
+    var canvas = document.getElementsByTagName("canvas")[0];
+    gl = canvas.getContext("experimental-webgl");
+    gl.clearColor(0.0, 1.0, 0.0, 1.0);
+    gl.viewport(0, 0, canvas.width, canvas.height);
+
+    var vertexShader = gl.createShader(gl.VERTEX_SHADER);
+    gl.shaderSource(vertexShader, "attribute vec4 vPosition;\nvoid main() { gl_Position = vPosition; }");
+    gl.compileShader(vertexShader);
+
+    var fragmentShader = gl.createShader(gl.FRAGMENT_SHADER);
+    gl.shaderSource(fragmentShader, "void main() { gl_FragColor = vec4(1.0, 0.0, 0.0, 1.0); }");
+    gl.compileShader(fragmentShader);
+
+    var shaderProgram = gl.createProgram();
+    gl.attachShader(shaderProgram, vertexShader);
+    gl.attachShader(shaderProgram, fragmentShader);
+    gl.bindAttribLocation(shaderProgram, 0, "vPosition");
+    gl.linkProgram(shaderProgram);
+
+    gl.useProgram(shaderProgram);
+
+    var buffer = gl.createBuffer();
+    gl.bindBuffer(gl.ARRAY_BUFFER, buffer);
+
+    var vertices = [-1.0, -1.0,
+                    0.0, 0.0,
+                    -1.0, 1.0];
+    var seedX = -1.0;
+    var seedY = 1.0;
+    vertices
+    gl.bufferData(gl.ARRAY_BUFFER, new Float32Array(vertices), gl.STATIC_DRAW);
+
+
+    gl.vertexAttribPointer(0, 2, gl.FLOAT, false, 0, 0);
+    gl.enableVertexAttribArray(0);
+    gl.clear(gl.COLOR_BUFFER_BIT);
+    gl.drawArrays(gl.TRIANGLES, 0, 3);
+    gl.flush();
+</script>
diff --git a/Source/WebKit/qt/tests/qgraphicswebview/resources/pointing_up.html b/Source/WebKit/qt/tests/qgraphicswebview/resources/pointing_up.html
new file mode 100644
index 0000000..474a56d
--- /dev/null
+++ b/Source/WebKit/qt/tests/qgraphicswebview/resources/pointing_up.html
@@ -0,0 +1,46 @@
+<html>
+  <body style="margin: 0">
+    <canvas width="100" height="100"></canvas>
+  </body>
+</html>
+<script>
+    var canvas = document.getElementsByTagName("canvas")[0];
+    gl = canvas.getContext("experimental-webgl");
+    gl.clearColor(0.0, 1.0, 0.0, 1.0);
+    gl.viewport(0, 0, canvas.width, canvas.height);
+
+    var vertexShader = gl.createShader(gl.VERTEX_SHADER);
+    gl.shaderSource(vertexShader, "attribute vec4 vPosition;\nvoid main() { gl_Position = vPosition; }");
+    gl.compileShader(vertexShader);
+
+    var fragmentShader = gl.createShader(gl.FRAGMENT_SHADER);
+    gl.shaderSource(fragmentShader, "void main() { gl_FragColor = vec4(1.0, 0.0, 0.0, 1.0); }");
+    gl.compileShader(fragmentShader);
+
+    var shaderProgram = gl.createProgram();
+    gl.attachShader(shaderProgram, vertexShader);
+    gl.attachShader(shaderProgram, fragmentShader);
+    gl.bindAttribLocation(shaderProgram, 0, "vPosition");
+    gl.linkProgram(shaderProgram);
+
+    gl.useProgram(shaderProgram);
+
+    var buffer = gl.createBuffer();
+    gl.bindBuffer(gl.ARRAY_BUFFER, buffer);
+
+    var vertices = [-1.0, -1.0,
+                    0.0, 0.0,
+                    1.0, -1.0];
+    var seedX = -1.0;
+    var seedY = 1.0;
+    vertices
+    gl.bufferData(gl.ARRAY_BUFFER, new Float32Array(vertices), gl.STATIC_DRAW);
+
+
+    gl.vertexAttribPointer(0, 2, gl.FLOAT, false, 0, 0);
+    gl.enableVertexAttribArray(0);
+    gl.clear(gl.COLOR_BUFFER_BIT);
+    gl.drawArrays(gl.TRIANGLES, 0, 3);
+    gl.flush();
+    gl.finish();
+</script>
diff --git a/Source/WebKit/qt/tests/qgraphicswebview/tst_qgraphicswebview.cpp b/Source/WebKit/qt/tests/qgraphicswebview/tst_qgraphicswebview.cpp
index f8a4359..7cc88db 100644
--- a/Source/WebKit/qt/tests/qgraphicswebview/tst_qgraphicswebview.cpp
+++ b/Source/WebKit/qt/tests/qgraphicswebview/tst_qgraphicswebview.cpp
@@ -25,6 +25,10 @@
 #include <qwebpage.h>
 #include <qwebframe.h>
 
+#if defined(ENABLE_WEBGL) && ENABLE_WEBGL
+#include <QGLWidget>
+#endif
+
 class tst_QGraphicsWebView : public QObject
 {
     Q_OBJECT
@@ -38,6 +42,15 @@ private slots:
     void widgetsRenderingThroughCache();
     void setPalette_data();
     void setPalette();
+    void renderHints();
+
+#if defined(ENABLE_WEBGL) && ENABLE_WEBGL
+    void webglSoftwareFallbackVerticalOrientation();
+    void webglSoftwareFallbackHorizontalOrientation();
+
+private:
+    void compareCanvasToImage(const QUrl&, const QImage&);
+#endif
 };
 
 void tst_QGraphicsWebView::qgraphicswebview()
@@ -191,9 +204,9 @@ void tst_QGraphicsWebView::microFocusCoordinates()
 
     page->mainFrame()->setHtml("<html><body>" \
         "<input type='text' id='input1' style='font--family: serif' value='' maxlength='20'/><br>" \
-        "<canvas id='canvas1' width='500' height='500'/>" \
+        "<canvas id='canvas1' width='500' height='500'></canvas>" \
         "<input type='password'/><br>" \
-        "<canvas id='canvas2' width='500' height='500'/>" \
+        "<canvas id='canvas2' width='500' height='500'></canvas>" \
         "</body></html>");
 
     page->mainFrame()->setFocus();
@@ -409,6 +422,146 @@ void tst_QGraphicsWebView::setPalette()
     QVERIFY(img1 != img2);
 }
 
+void tst_QGraphicsWebView::renderHints()
+{
+    QGraphicsWebView webView;
+
+    // default is only text antialiasing + smooth pixmap transform
+    QVERIFY(!(webView.renderHints() & QPainter::Antialiasing));
+    QVERIFY(webView.renderHints() & QPainter::TextAntialiasing);
+    QVERIFY(webView.renderHints() & QPainter::SmoothPixmapTransform);
+    QVERIFY(!(webView.renderHints() & QPainter::HighQualityAntialiasing));
+
+    webView.setRenderHint(QPainter::Antialiasing, true);
+    QVERIFY(webView.renderHints() & QPainter::Antialiasing);
+    QVERIFY(webView.renderHints() & QPainter::TextAntialiasing);
+    QVERIFY(webView.renderHints() & QPainter::SmoothPixmapTransform);
+    QVERIFY(!(webView.renderHints() & QPainter::HighQualityAntialiasing));
+
+    webView.setRenderHint(QPainter::Antialiasing, false);
+    QVERIFY(!(webView.renderHints() & QPainter::Antialiasing));
+    QVERIFY(webView.renderHints() & QPainter::TextAntialiasing);
+    QVERIFY(webView.renderHints() & QPainter::SmoothPixmapTransform);
+    QVERIFY(!(webView.renderHints() & QPainter::HighQualityAntialiasing));
+
+    webView.setRenderHint(QPainter::SmoothPixmapTransform, true);
+    QVERIFY(!(webView.renderHints() & QPainter::Antialiasing));
+    QVERIFY(webView.renderHints() & QPainter::TextAntialiasing);
+    QVERIFY(webView.renderHints() & QPainter::SmoothPixmapTransform);
+    QVERIFY(!(webView.renderHints() & QPainter::HighQualityAntialiasing));
+
+    webView.setRenderHint(QPainter::SmoothPixmapTransform, false);
+    QVERIFY(webView.renderHints() & QPainter::TextAntialiasing);
+    QVERIFY(!(webView.renderHints() & QPainter::SmoothPixmapTransform));
+    QVERIFY(!(webView.renderHints() & QPainter::HighQualityAntialiasing));
+}
+
+class GraphicsView : public QGraphicsView {
+public:
+    GraphicsView();
+    QGraphicsWebView* m_webView;
+};
+
+#if defined(ENABLE_WEBGL) && ENABLE_WEBGL
+bool compareImagesFuzzyPixelCount(const QImage& image1, const QImage& image2, qreal tolerance = 0.05)
+{
+    if (image1.size() != image2.size())
+        return false;
+
+    unsigned diffPixelCount = 0;
+    for (int row = 0; row < image1.size().width(); ++row) {
+        for (int column = 0; column < image1.size().height(); ++column)
+            if (image1.pixel(row, column) != image2.pixel(row, column))
+                ++diffPixelCount;
+    }
+
+    if (diffPixelCount > (image1.size().width() * image1.size().height()) * tolerance)
+        return false;
+
+    return true;
+}
+
+GraphicsView::GraphicsView()
+{
+    QGraphicsScene* const scene = new QGraphicsScene(this);
+    setScene(scene);
+
+    m_webView = new QGraphicsWebView;
+    scene->addItem(m_webView);
+
+    m_webView->page()->settings()->setAttribute(QWebSettings::WebGLEnabled, true);
+    m_webView->setResizesToContents(true);
+
+    setFrameShape(QFrame::NoFrame);
+    setViewport(new QGLWidget);
+}
+
+void tst_QGraphicsWebView::webglSoftwareFallbackVerticalOrientation()
+{
+    QSize canvasSize(100, 100);
+    QImage reference(canvasSize, QImage::Format_ARGB32);
+    reference.fill(0xFF00FF00);
+    { // Reference.
+        QPainter painter(&reference);
+        QPolygonF triangleUp;
+        triangleUp << QPointF(0, canvasSize.height())
+                   << QPointF(canvasSize.width(), canvasSize.height())
+                   << QPointF(canvasSize.width() / 2.0, canvasSize.height() / 2.0);
+        painter.setPen(Qt::NoPen);
+        painter.setBrush(Qt::red);
+        painter.drawPolygon(triangleUp);
+    }
+
+    compareCanvasToImage(QUrl(QLatin1String("qrc:///resources/pointing_up.html")), reference);
+}
+
+void tst_QGraphicsWebView::webglSoftwareFallbackHorizontalOrientation()
+{
+    QSize canvasSize(100, 100);
+    QImage reference(canvasSize, QImage::Format_ARGB32);
+    reference.fill(0xFF00FF00);
+    { // Reference.
+        QPainter painter(&reference);
+        QPolygonF triangleUp;
+        triangleUp << QPointF(0, 0)
+                   << QPointF(0, canvasSize.height())
+                   << QPointF(canvasSize.width() / 2.0, canvasSize.height() / 2.0);
+        painter.setPen(Qt::NoPen);
+        painter.setBrush(Qt::red);
+        painter.drawPolygon(triangleUp);
+    }
+
+    compareCanvasToImage(QUrl(QLatin1String("qrc:///resources/pointing_right.html")), reference);
+}
+
+void tst_QGraphicsWebView::compareCanvasToImage(const QUrl& url, const QImage& reference)
+{
+    GraphicsView view;
+    view.show();
+    QTest::qWaitForWindowShown(&view);
+
+    QGraphicsWebView* const graphicsWebView = view.m_webView;
+    graphicsWebView->load(url);
+    QVERIFY(waitForSignal(graphicsWebView, SIGNAL(loadFinished(bool))));
+    { // Force a render, to create the accelerated compositing tree.
+        QPixmap pixmap(view.size());
+        QPainter painter(&pixmap);
+        view.render(&painter);
+    }
+    QApplication::syncX();
+
+    const QSize imageSize = reference.size();
+
+    QImage target(imageSize, QImage::Format_ARGB32);
+    { // Web page content.
+        QPainter painter(&target);
+        QRectF renderRect(0, 0, imageSize.width(), imageSize.height());
+        view.scene()->render(&painter, renderRect, renderRect);
+    }
+    QVERIFY(compareImagesFuzzyPixelCount(target, reference, 0.01));
+}
+#endif
+
 QTEST_MAIN(tst_QGraphicsWebView)
 
 #include "tst_qgraphicswebview.moc"
diff --git a/Source/WebKit/qt/tests/qgraphicswebview/tst_qgraphicswebview.qrc b/Source/WebKit/qt/tests/qgraphicswebview/tst_qgraphicswebview.qrc
index c91bb9c..1488fcf 100644
--- a/Source/WebKit/qt/tests/qgraphicswebview/tst_qgraphicswebview.qrc
+++ b/Source/WebKit/qt/tests/qgraphicswebview/tst_qgraphicswebview.qrc
@@ -1,6 +1,7 @@
-<!DOCTYPE RCC><RCC version="1.0">
-<qresource>
-    <file>resources/input_types.html</file>
-</qresource>
+<RCC>
+    <qresource prefix="/">
+        <file>resources/input_types.html</file>
+        <file>resources/pointing_right.html</file>
+        <file>resources/pointing_up.html</file>
+    </qresource>
 </RCC>
-
diff --git a/Source/WebKit/qt/tests/qwebframe/tst_qwebframe.cpp b/Source/WebKit/qt/tests/qwebframe/tst_qwebframe.cpp
index bc1594a..2c44e4c 100644
--- a/Source/WebKit/qt/tests/qwebframe/tst_qwebframe.cpp
+++ b/Source/WebKit/qt/tests/qwebframe/tst_qwebframe.cpp
@@ -650,6 +650,9 @@ private slots:
     void setCacheLoadControlAttribute();
     void setUrlWithPendingLoads();
     void setUrlWithFragment();
+    void setUrlToEmpty();
+    void setUrlToInvalid();
+    void setUrlHistory();
 
 private:
     QString  evalJS(const QString&s) {
@@ -3340,5 +3343,148 @@ void tst_QWebFrame::setUrlWithFragment()
     QCOMPARE(page.mainFrame()->url(), url);
 }
 
+void tst_QWebFrame::setUrlToEmpty()
+{
+    int expectedLoadFinishedCount = 0;
+    const QUrl aboutBlank("about:blank");
+    const QUrl url("qrc:/test2.html");
+
+    QWebPage page;
+    QWebFrame* frame = page.mainFrame();
+    QCOMPARE(frame->url(), QUrl());
+    QCOMPARE(frame->requestedUrl(), QUrl());
+    QCOMPARE(frame->baseUrl(), QUrl());
+
+    QSignalSpy spy(frame, SIGNAL(loadFinished(bool)));
+
+    // Set existing url
+    frame->setUrl(url);
+    expectedLoadFinishedCount++;
+    ::waitForSignal(frame, SIGNAL(loadFinished(bool)));
+
+    QCOMPARE(spy.count(), expectedLoadFinishedCount);
+    QCOMPARE(frame->url(), url);
+    QCOMPARE(frame->requestedUrl(), url);
+    QCOMPARE(frame->baseUrl(), url);
+
+    // Set empty url
+    frame->setUrl(QUrl());
+    expectedLoadFinishedCount++;
+
+    QCOMPARE(spy.count(), expectedLoadFinishedCount);
+    QCOMPARE(frame->url(), aboutBlank);
+    QCOMPARE(frame->requestedUrl(), QUrl());
+    QCOMPARE(frame->baseUrl(), aboutBlank);
+
+    // Set existing url
+    frame->setUrl(url);
+    expectedLoadFinishedCount++;
+    ::waitForSignal(frame, SIGNAL(loadFinished(bool)));
+
+    QCOMPARE(spy.count(), expectedLoadFinishedCount);
+    QCOMPARE(frame->url(), url);
+    QCOMPARE(frame->requestedUrl(), url);
+    QCOMPARE(frame->baseUrl(), url);
+
+    // Load empty url
+    frame->load(QUrl());
+    expectedLoadFinishedCount++;
+
+    QCOMPARE(spy.count(), expectedLoadFinishedCount);
+    QCOMPARE(frame->url(), aboutBlank);
+    QCOMPARE(frame->requestedUrl(), QUrl());
+    QCOMPARE(frame->baseUrl(), aboutBlank);
+}
+
+void tst_QWebFrame::setUrlToInvalid()
+{
+    QWebPage page;
+    QWebFrame* frame = page.mainFrame();
+
+    const QUrl invalidUrl("http://strange;hostname/here");
+    QVERIFY(!invalidUrl.isEmpty());
+    QVERIFY(!invalidUrl.isValid());
+    QVERIFY(invalidUrl != QUrl());
+
+    frame->setUrl(invalidUrl);
+    QCOMPARE(frame->url(), invalidUrl);
+    QCOMPARE(frame->requestedUrl(), invalidUrl);
+    QCOMPARE(frame->baseUrl(), invalidUrl);
+
+    // QUrls equivalent to QUrl() will be treated as such.
+    const QUrl aboutBlank("about:blank");
+    const QUrl anotherInvalidUrl("1http://bugs.webkit.org");
+    QVERIFY(!anotherInvalidUrl.isEmpty()); // and they are not necessarily empty.
+    QVERIFY(!anotherInvalidUrl.isValid());
+    QCOMPARE(anotherInvalidUrl, QUrl());
+
+    frame->setUrl(anotherInvalidUrl);
+    QCOMPARE(frame->url(), aboutBlank);
+    QCOMPARE(frame->requestedUrl(), anotherInvalidUrl);
+    QCOMPARE(frame->baseUrl(), aboutBlank);
+}
+
+void tst_QWebFrame::setUrlHistory()
+{
+    const QUrl aboutBlank("about:blank");
+    QUrl url;
+    int expectedLoadFinishedCount = 0;
+    QWebFrame* frame = m_page->mainFrame();
+    QSignalSpy spy(frame, SIGNAL(loadFinished(bool)));
+
+    QCOMPARE(m_page->history()->count(), 0);
+
+    frame->setUrl(QUrl());
+    expectedLoadFinishedCount++;
+    QCOMPARE(spy.count(), expectedLoadFinishedCount);
+    QCOMPARE(frame->url(), aboutBlank);
+    QCOMPARE(frame->requestedUrl(), QUrl());
+    QCOMPARE(m_page->history()->count(), 0);
+
+    url = QUrl("http://non.existant/");
+    frame->setUrl(url);
+    ::waitForSignal(m_page, SIGNAL(loadFinished(bool)));
+    expectedLoadFinishedCount++;
+    QCOMPARE(spy.count(), expectedLoadFinishedCount);
+    QCOMPARE(frame->url(), url);
+    QCOMPARE(frame->requestedUrl(), url);
+    QCOMPARE(m_page->history()->count(), 0);
+
+    url = QUrl("qrc:/test1.html");
+    frame->setUrl(url);
+    ::waitForSignal(m_page, SIGNAL(loadFinished(bool)));
+    expectedLoadFinishedCount++;
+    QCOMPARE(spy.count(), expectedLoadFinishedCount);
+    QCOMPARE(frame->url(), url);
+    QCOMPARE(frame->requestedUrl(), url);
+    QCOMPARE(m_page->history()->count(), 1);
+
+    frame->setUrl(QUrl());
+    expectedLoadFinishedCount++;
+    QCOMPARE(spy.count(), expectedLoadFinishedCount);
+    QCOMPARE(frame->url(), aboutBlank);
+    QCOMPARE(frame->requestedUrl(), QUrl());
+    QCOMPARE(m_page->history()->count(), 1);
+
+    // Loading same page as current in history, so history count doesn't change.
+    url = QUrl("qrc:/test1.html");
+    frame->setUrl(url);
+    ::waitForSignal(m_page, SIGNAL(loadFinished(bool)));
+    expectedLoadFinishedCount++;
+    QCOMPARE(spy.count(), expectedLoadFinishedCount);
+    QCOMPARE(frame->url(), url);
+    QCOMPARE(frame->requestedUrl(), url);
+    QCOMPARE(m_page->history()->count(), 1);
+
+    url = QUrl("qrc:/test2.html");
+    frame->setUrl(url);
+    ::waitForSignal(m_page, SIGNAL(loadFinished(bool)));
+    expectedLoadFinishedCount++;
+    QCOMPARE(spy.count(), expectedLoadFinishedCount);
+    QCOMPARE(frame->url(), url);
+    QCOMPARE(frame->requestedUrl(), url);
+    QCOMPARE(m_page->history()->count(), 2);
+}
+
 QTEST_MAIN(tst_QWebFrame)
 #include "tst_qwebframe.moc"
diff --git a/Source/WebKit/qt/tests/qwebpage/tst_qwebpage.cpp b/Source/WebKit/qt/tests/qwebpage/tst_qwebpage.cpp
index 4417ac5..d43b2de 100644
--- a/Source/WebKit/qt/tests/qwebpage/tst_qwebpage.cpp
+++ b/Source/WebKit/qt/tests/qwebpage/tst_qwebpage.cpp
@@ -126,6 +126,11 @@ private slots:
     void screenshot_data();
     void screenshot();
 
+#if defined(ENABLE_WEBGL) && ENABLE_WEBGL
+    void acceleratedWebGLScreenshotWithoutView();
+    void unacceleratedWebGLScreenshotWithoutView();
+#endif
+
     void originatingObjectInNetworkRequests();
     void testJSPrompt();
     void showModalDialog();
@@ -135,6 +140,7 @@ private slots:
     void infiniteLoopJS();
     void navigatorCookieEnabled();
     void deleteQWebViewTwice();
+    void renderOnRepaintRequestedShouldNotRecurse();
 
 #ifdef Q_OS_MAC
     void macCopyUnicodeToClipboard();
@@ -2117,6 +2123,28 @@ void tst_QWebPage::inputMethods()
     clickOnPage(page, inputElement.geometry().center());
 
     QVERIFY(!viewEventSpy.contains(QEvent::RequestSoftwareInputPanel));
+
+    // START - Newline test for textarea
+    qApp->processEvents();
+    page->mainFrame()->setHtml("<html><body>" \
+                                            "<textarea rows='5' cols='1' id='input5' value=''/>" \
+                                            "</body></html>");
+    page->mainFrame()->evaluateJavaScript("var inputEle = document.getElementById('input5'); inputEle.focus(); inputEle.select();");
+    QKeyEvent keyEnter(QEvent::KeyPress, Qt::Key_Enter, Qt::NoModifier);
+    page->event(&keyEnter);
+    QList<QInputMethodEvent::Attribute> attribs;
+
+    QInputMethodEvent eventText("\n", attribs);
+    page->event(&eventText);
+
+    QInputMethodEvent eventText2("third line", attribs);
+    page->event(&eventText2);
+    qApp->processEvents();
+
+    QString inputValue2 = page->mainFrame()->evaluateJavaScript("document.getElementById('input5').value").toString();
+    QCOMPARE(inputValue2, QString("\n\nthird line"));
+    // END - Newline test for textarea
+
     delete container;
 }
 
@@ -2473,6 +2501,33 @@ void tst_QWebPage::screenshot()
     QDir::setCurrent(QApplication::applicationDirPath());
 }
 
+#if defined(ENABLE_WEBGL) && ENABLE_WEBGL
+// https://bugs.webkit.org/show_bug.cgi?id=54138
+static void webGLScreenshotWithoutView(bool accelerated)
+{
+    QWebPage page;
+    page.settings()->setAttribute(QWebSettings::WebGLEnabled, true);
+    page.settings()->setAttribute(QWebSettings::AcceleratedCompositingEnabled, accelerated);
+    QWebFrame* mainFrame = page.mainFrame();
+    mainFrame->setHtml("<html><body>"
+                       "<canvas id='webgl' width='300' height='300'></canvas>"
+                       "<script>document.getElementById('webgl').getContext('experimental-webgl')</script>"
+                       "</body></html>");
+
+    takeScreenshot(&page);
+}
+
+void tst_QWebPage::acceleratedWebGLScreenshotWithoutView()
+{
+    webGLScreenshotWithoutView(true);
+}
+
+void tst_QWebPage::unacceleratedWebGLScreenshotWithoutView()
+{
+    webGLScreenshotWithoutView(false);
+}
+#endif
+
 void tst_QWebPage::originatingObjectInNetworkRequests()
 {
     TestNetworkManager* networkManager = new TestNetworkManager(m_page);
@@ -2766,5 +2821,54 @@ void tst_QWebPage::deleteQWebViewTwice()
     }
 }
 
+class RepaintRequestedRenderer : public QObject {
+    Q_OBJECT
+public:
+    RepaintRequestedRenderer(QWebPage* page, QPainter* painter)
+        : m_page(page)
+        , m_painter(painter)
+        , m_recursionCount(0)
+    {
+        connect(m_page, SIGNAL(repaintRequested(QRect)), this, SLOT(onRepaintRequested(QRect)));
+    }
+
+signals:
+    void finished();
+
+private slots:
+    void onRepaintRequested(const QRect& rect)
+    {
+        QCOMPARE(m_recursionCount, 0);
+
+        m_recursionCount++;
+        m_page->mainFrame()->render(m_painter, rect);
+        m_recursionCount--;
+
+        QMetaObject::invokeMethod(this, "finished", Qt::QueuedConnection);
+    }
+
+private:
+    QWebPage* m_page;
+    QPainter* m_painter;
+    int m_recursionCount;
+};
+
+void tst_QWebPage::renderOnRepaintRequestedShouldNotRecurse()
+{
+    QSize viewportSize(720, 576);
+    QWebPage page;
+
+    QImage image(viewportSize, QImage::Format_ARGB32);
+    QPainter painter(&image);
+
+    page.setPreferredContentsSize(viewportSize);
+    page.setViewportSize(viewportSize);
+    RepaintRequestedRenderer r(&page, &painter);
+
+    page.mainFrame()->setHtml("zalan loves trunk", QUrl());
+
+    QVERIFY(::waitForSignal(&r, SIGNAL(finished())));
+}
+
 QTEST_MAIN(tst_QWebPage)
 #include "tst_qwebpage.moc"
diff --git a/Source/WebKit/qt/tests/qwebview/tst_qwebview.cpp b/Source/WebKit/qt/tests/qwebview/tst_qwebview.cpp
index 533d4e5..c7600fc 100644
--- a/Source/WebKit/qt/tests/qwebview/tst_qwebview.cpp
+++ b/Source/WebKit/qt/tests/qwebview/tst_qwebview.cpp
@@ -42,6 +42,7 @@ public slots:
     void cleanup();
 
 private slots:
+    void renderingAfterMaxAndBack();
     void renderHints();
     void getWebKitVersion();
 
@@ -207,9 +208,9 @@ void tst_QWebView::microFocusCoordinates()
 
     page->mainFrame()->setHtml("<html><body>" \
         "<input type='text' id='input1' style='font--family: serif' value='' maxlength='20'/><br>" \
-        "<canvas id='canvas1' width='500' height='500'/>" \
+        "<canvas id='canvas1' width='500' height='500'></canvas>" \
         "<input type='password'/><br>" \
-        "<canvas id='canvas2' width='500' height='500'/>" \
+        "<canvas id='canvas2' width='500' height='500'></canvas>" \
         "</body></html>");
 
     page->mainFrame()->setFocus();
@@ -438,6 +439,63 @@ void tst_QWebView::setPalette()
     QVERIFY(img1 != img2);
 }
 
+void tst_QWebView::renderingAfterMaxAndBack()
+{
+    QUrl url = QUrl("data:text/html,<html><head></head>"
+                   "<body width=1024 height=768 bgcolor=red>"
+                   "</body>"
+                   "</html>");
+
+    QWebView view;
+    view.page()->mainFrame()->load(url);
+    QVERIFY(waitForSignal(&view, SIGNAL(loadFinished(bool))));
+    view.show();
+
+    view.page()->settings()->setMaximumPagesInCache(3);
+
+    QTest::qWaitForWindowShown(&view);
+
+    QPixmap reference(view.page()->viewportSize());
+    reference.fill(Qt::red);
+
+    QPixmap image(view.page()->viewportSize());
+    QPainter painter(&image);
+    view.page()->currentFrame()->render(&painter);
+
+    QCOMPARE(image, reference);
+
+    QUrl url2 = QUrl("data:text/html,<html><head></head>"
+                     "<body width=1024 height=768 bgcolor=blue>"
+                     "</body>"
+                     "</html>");
+    view.page()->mainFrame()->load(url2);
+
+    QVERIFY(waitForSignal(&view, SIGNAL(loadFinished(bool))));
+
+    view.showMaximized();
+
+    QTest::qWaitForWindowShown(&view);
+
+    QPixmap reference2(view.page()->viewportSize());
+    reference2.fill(Qt::blue);
+
+    QPixmap image2(view.page()->viewportSize());
+    QPainter painter2(&image2);
+    view.page()->currentFrame()->render(&painter2);
+
+    QCOMPARE(image2, reference2);
+
+    view.back();
+
+    QPixmap reference3(view.page()->viewportSize());
+    reference3.fill(Qt::red);
+    QPixmap image3(view.page()->viewportSize());
+    QPainter painter3(&image3);
+    view.page()->currentFrame()->render(&painter3);
+
+    QCOMPARE(image3, reference3);
+}
+
 QTEST_MAIN(tst_QWebView)
 #include "tst_qwebview.moc"
 
diff --git a/Source/WebKit/qt/tests/tests.pri b/Source/WebKit/qt/tests/tests.pri
index bb519eb..ebb6f8e 100644
--- a/Source/WebKit/qt/tests/tests.pri
+++ b/Source/WebKit/qt/tests/tests.pri
@@ -32,3 +32,5 @@ symbian {
 # This define is used by some tests to look up resources in the source tree
 !symbian: DEFINES += TESTS_SOURCE_DIR=\\\"$$PWD/\\\"
 
+DEFINES -= QT_ASCII_CAST_WARNINGS
+
diff --git a/Source/WebKit/qt/tests/tests.pro b/Source/WebKit/qt/tests/tests.pro
index e5b7408..529fa04 100644
--- a/Source/WebKit/qt/tests/tests.pro
+++ b/Source/WebKit/qt/tests/tests.pro
@@ -3,3 +3,6 @@ TEMPLATE = subdirs
 SUBDIRS = qwebframe qwebpage qwebelement qgraphicswebview qwebhistoryinterface qwebview qwebhistory qwebinspector hybridPixmap
 contains(QT_CONFIG, declarative): SUBDIRS += qdeclarativewebview
 SUBDIRS += benchmarks/painting benchmarks/loading
+contains(DEFINES, ENABLE_WEBGL=1) {
+    SUBDIRS += benchmarks/webgl
+}
diff --git a/Source/WebKit/win/AccessibleBase.h b/Source/WebKit/win/AccessibleBase.h
index df2d927..008d580 100644
--- a/Source/WebKit/win/AccessibleBase.h
+++ b/Source/WebKit/win/AccessibleBase.h
@@ -26,10 +26,9 @@
 #ifndef AccessibleBase_h
 #define AccessibleBase_h
 
+#include "WebKit.h"
 #include <WebCore/AccessibilityObject.h>
 #include <WebCore/AccessibilityObjectWrapperWin.h>
-#include <WebKit/WebKit.h>
-#include <oleacc.h>
 
 class DECLSPEC_UUID("3dbd565b-db22-4d88-8e0e-778bde54524a") AccessibleBase : public IAccessibleComparable, public IServiceProvider, public WebCore::AccessibilityObjectWrapper {
 public:
diff --git a/Source/WebKit/win/AccessibleDocument.h b/Source/WebKit/win/AccessibleDocument.h
index aa38be8..bc13613 100644
--- a/Source/WebKit/win/AccessibleDocument.h
+++ b/Source/WebKit/win/AccessibleDocument.h
@@ -27,14 +27,11 @@
 #define AccessibleDocument_h
 
 #include "AccessibleBase.h"
-#include "WebKit.h"
-
-using WebCore::Document;
 
 class AccessibleDocument : public AccessibleBase {
 public:
-    AccessibleDocument(Document*);
-    Document* document() const;
+    AccessibleDocument(WebCore::Document*);
+    WebCore::Document* document() const;
 
 protected:
     virtual long role() const;
diff --git a/Source/WebKit/win/CFDictionaryPropertyBag.h b/Source/WebKit/win/CFDictionaryPropertyBag.h
index 3cac464..17964e5 100644
--- a/Source/WebKit/win/CFDictionaryPropertyBag.h
+++ b/Source/WebKit/win/CFDictionaryPropertyBag.h
@@ -26,6 +26,7 @@
 #ifndef CFDictionaryPropertyBag_h
 #define CFDictionaryPropertyBag_h
 
+#include "WebKit.h"
 #include <WebCore/COMPtr.h>
 #include <wtf/RetainPtr.h>
 
diff --git a/Source/WebKit/win/COMPropertyBag.h b/Source/WebKit/win/COMPropertyBag.h
index 620458e..dd0a8c4 100644
--- a/Source/WebKit/win/COMPropertyBag.h
+++ b/Source/WebKit/win/COMPropertyBag.h
@@ -1,234 +1,235 @@
-/*

- * Copyright (C) 2008 Apple Inc. All Rights Reserved.

- *

- * Redistribution and use in source and binary forms, with or without

- * modification, are permitted provided that the following conditions

- * are met:

- * 1. Redistributions of source code must retain the above copyright

- *    notice, this list of conditions and the following disclaimer.

- * 2. Redistributions in binary form must reproduce the above copyright

- *    notice, this list of conditions and the following disclaimer in the

- *    documentation and/or other materials provided with the distribution.

- *

- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY

- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE

- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR

- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR

- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,

- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,

- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR

- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY

- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT

- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE

- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 

- */

-

-#ifndef COMPropertyBag_h

-#define COMPropertyBag_h

-

-#define NOMINMAX

-#include <unknwn.h>

-

-#include <wtf/Noncopyable.h>

-#include <wtf/HashMap.h>

-

-#include "COMVariantSetter.h"

-

-template<typename ValueType, typename KeyType = typename WTF::String, typename HashType = typename WTF::StringHash>

-class COMPropertyBag : public IPropertyBag, public IPropertyBag2 {

-    WTF_MAKE_NONCOPYABLE(COMPropertyBag);

-public:

-    typedef HashMap<KeyType, ValueType, HashType> HashMapType;

-

-    static COMPropertyBag* createInstance(const HashMapType&);

-    static COMPropertyBag* adopt(HashMapType&);

-

-    // IUnknown

-    virtual HRESULT STDMETHODCALLTYPE QueryInterface(REFIID riid, void** ppvObject);

-    virtual ULONG STDMETHODCALLTYPE AddRef();

-    virtual ULONG STDMETHODCALLTYPE Release();

-

-    // IPropertyBag

-    virtual HRESULT STDMETHODCALLTYPE Read(LPCOLESTR pszPropName, VARIANT*, IErrorLog*);

-    virtual HRESULT STDMETHODCALLTYPE Write(LPCOLESTR pszPropName, VARIANT*);

-

-    // IPropertyBag2

-    virtual HRESULT STDMETHODCALLTYPE Read(ULONG cProperties, PROPBAG2*, IErrorLog*, VARIANT* pvarValue, HRESULT* phrError);

-    virtual HRESULT STDMETHODCALLTYPE Write(ULONG cProperties, PROPBAG2*, VARIANT*);

-    virtual HRESULT STDMETHODCALLTYPE CountProperties(ULONG* pcProperties);

-    virtual HRESULT STDMETHODCALLTYPE GetPropertyInfo(ULONG iProperty, ULONG cProperties, PROPBAG2* pPropBag, ULONG* pcProperties);

-    virtual HRESULT STDMETHODCALLTYPE LoadObject(LPCOLESTR pstrName, DWORD dwHint, IUnknown*, IErrorLog*);

-

-private:

-    COMPropertyBag()

-        : m_refCount(0)

-    {

-    }

-

-    COMPropertyBag(const HashMapType& hashMap)

-        : m_refCount(0)

-        , m_hashMap(hashMap)

-    {

-    }

-

-    ~COMPropertyBag() {}

-

-    ULONG m_refCount;

-    HashMapType m_hashMap;

-};

-

-// COMPropertyBag ------------------------------------------------------------------

-template<typename ValueType, typename KeyType, typename HashType>

-COMPropertyBag<ValueType, KeyType, HashType>* COMPropertyBag<typename ValueType, typename KeyType, HashType>::createInstance(const HashMapType& hashMap)

-{

-    COMPropertyBag* instance = new COMPropertyBag(hashMap);

-    instance->AddRef();

-    return instance;

-}

-

-template<typename ValueType, typename KeyType, typename HashType>

-COMPropertyBag<ValueType, KeyType, HashType>* COMPropertyBag<typename ValueType, typename KeyType, HashType>::adopt(HashMapType& hashMap)

-{

-    COMPropertyBag* instance = new COMPropertyBag;

-    instance->m_hashMap.swap(hashMap);

-    instance->AddRef();

-    return instance;

-}

-

-// IUnknown ------------------------------------------------------------------------

-template<typename ValueType, typename KeyType, typename HashType>

-HRESULT STDMETHODCALLTYPE COMPropertyBag<ValueType, KeyType, HashType>::QueryInterface(REFIID riid, void** ppvObject)

-{

-    *ppvObject = 0;

-    if (IsEqualGUID(riid, IID_IUnknown))

-        *ppvObject = static_cast<IPropertyBag*>(this);

-    else if (IsEqualGUID(riid, IID_IPropertyBag))

-        *ppvObject = static_cast<IPropertyBag*>(this);

-    else if (IsEqualGUID(riid, IID_IPropertyBag2))

-        *ppvObject = static_cast<IPropertyBag2*>(this);

-    else

-        return E_NOINTERFACE;

-

-    AddRef();

-    return S_OK;

-}

-

-template<typename ValueType, typename KeyType, typename HashType>

-ULONG STDMETHODCALLTYPE COMPropertyBag<ValueType, KeyType, HashType>::AddRef()

-{

-    return ++m_refCount;

-}

-

-template<typename ValueType, typename KeyType, typename HashType>

-ULONG STDMETHODCALLTYPE COMPropertyBag<ValueType, KeyType, HashType>::Release()

-{

-    ULONG newRef = --m_refCount;

-    if (!newRef)

-        delete this;

-

-    return newRef;

-}

-

-// IPropertyBag --------------------------------------------------------------------

-

-template<typename ValueType, typename KeyType, typename HashType>

-HRESULT STDMETHODCALLTYPE COMPropertyBag<ValueType, KeyType, HashType>::Read(LPCOLESTR pszPropName, VARIANT* pVar, IErrorLog* pErrorLog)

-{

-    if (!pszPropName)

-        return E_POINTER;

-

-    HashMapType::const_iterator it = m_hashMap.find(String(pszPropName));

-    HashMapType::const_iterator end = m_hashMap.end();

-    if (it == end)

-        return E_INVALIDARG;

-

-    VARTYPE requestedType = V_VT(pVar);

-    V_VT(pVar) = VT_EMPTY;

-    COMVariantSetter<ValueType>::setVariant(pVar, it->second);

-

-    if (requestedType != COMVariantSetter<ValueType>::variantType(it->second) && requestedType != VT_EMPTY)

-        return ::VariantChangeType(pVar, pVar, VARIANT_NOUSEROVERRIDE | VARIANT_ALPHABOOL, requestedType);

-

-    return S_OK;

-}

-

-template<typename ValueType, typename KeyType, typename HashType>

-HRESULT STDMETHODCALLTYPE COMPropertyBag<ValueType, KeyType, HashType>::Write(LPCOLESTR pszPropName, VARIANT* pVar)

-{

-    return E_FAIL;

-}

-

-template<typename ValueType, typename KeyType, typename HashType>

-HRESULT STDMETHODCALLTYPE COMPropertyBag<ValueType, KeyType, HashType>::Read(ULONG cProperties, PROPBAG2* pPropBag, IErrorLog* pErrorLog, VARIANT* pvarValue, HRESULT* phrError)

-{

-    if (!pPropBag || !pvarValue || !phrError)

-        return E_POINTER;

-

-    HRESULT hr = S_OK;

-

-    for (ULONG i = 0; i < cProperties; ++i) {

-        VariantInit(&pvarValue[i]);

-        pvarValue[i].vt = pPropBag[i].vt;

-        phrError[i] = Read(pPropBag[i].pstrName, &pvarValue[i], pErrorLog);

-        if (FAILED(phrError[i]))

-            hr = E_FAIL;

-    }

-

-    return hr;

-}

-

-template<typename ValueType, typename KeyType, typename HashType>

-HRESULT STDMETHODCALLTYPE COMPropertyBag<ValueType, KeyType, HashType>::Write(ULONG cProperties, PROPBAG2*, VARIANT*)

-{

-    return E_NOTIMPL;

-}

-

-template<typename ValueType, typename KeyType, typename HashType>

-HRESULT STDMETHODCALLTYPE COMPropertyBag<ValueType, KeyType, HashType>::CountProperties(ULONG* pcProperties)

-{

-    if (!pcProperties)

-        return E_POINTER;

-

-    *pcProperties = m_hashMap.size();

-    return S_OK;

-}

-

-template<typename ValueType, typename KeyType, typename HashType>

-HRESULT STDMETHODCALLTYPE COMPropertyBag<ValueType, KeyType, HashType>::GetPropertyInfo(ULONG iProperty, ULONG cProperties, PROPBAG2* pPropBag, ULONG* pcProperties)

-{

-    if (!pPropBag || !pcProperties)

-        return E_POINTER;

-

-    if (m_hashMap.size() <= iProperty)

-        return E_INVALIDARG;

-

-    *pcProperties = 0;

-    typedef HashMapType::const_iterator Iterator;

-    Iterator current = m_hashMap.begin();

-    Iterator end = m_hashMap.end();

-    for (ULONG i = 0; i < iProperty; ++i, ++current)

-        ;

-    for (ULONG j = 0; j < cProperties && current != end; ++j, ++current) {

-        // FIXME: the following fields aren't filled in

-        //pPropBag[j].cfType;   // (CLIPFORMAT) Clipboard format or MIME type of the property.

-        //pPropBag[j].clsid;    // (CLSID) CLSID of the object. This member is valid only if dwType is PROPBAG2_TYPE_OBJECT.

-

-        pPropBag[j].dwType = PROPBAG2_TYPE_DATA;

-        pPropBag[j].vt = COMVariantSetter<ValueType>::variantType(current->second);

-        pPropBag[j].dwHint = iProperty + j;

-        pPropBag[j].pstrName = (LPOLESTR)CoTaskMemAlloc(sizeof(wchar_t)*(current->first.length()+1));

-        if (!pPropBag[j].pstrName)

-            return E_OUTOFMEMORY;

-        wcscpy_s(pPropBag[j].pstrName, current->first.length()+1, static_cast<String>(current->first).charactersWithNullTermination());

-        ++*pcProperties;

-    }

-    return S_OK;

-}

-

-template<typename ValueType, typename KeyType, typename HashType>

-HRESULT STDMETHODCALLTYPE COMPropertyBag<ValueType, KeyType, HashType>::LoadObject(LPCOLESTR pstrName, DWORD dwHint, IUnknown*, IErrorLog*)

-{

-    return E_NOTIMPL;

-}

-

-#endif // COMPropertyBag_h

+/*
+ * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef COMPropertyBag_h
+#define COMPropertyBag_h
+
+#define NOMINMAX
+#include <ocidl.h>
+#include <unknwn.h>
+
+#include <wtf/Noncopyable.h>
+#include <wtf/HashMap.h>
+
+#include "COMVariantSetter.h"
+
+template<typename ValueType, typename KeyType = typename WTF::String, typename HashType = typename WTF::StringHash>
+class COMPropertyBag : public IPropertyBag, public IPropertyBag2 {
+    WTF_MAKE_NONCOPYABLE(COMPropertyBag);
+public:
+    typedef HashMap<KeyType, ValueType, HashType> HashMapType;
+
+    static COMPropertyBag* createInstance(const HashMapType&);
+    static COMPropertyBag* adopt(HashMapType&);
+
+    // IUnknown
+    virtual HRESULT STDMETHODCALLTYPE QueryInterface(REFIID riid, void** ppvObject);
+    virtual ULONG STDMETHODCALLTYPE AddRef();
+    virtual ULONG STDMETHODCALLTYPE Release();
+
+    // IPropertyBag
+    virtual HRESULT STDMETHODCALLTYPE Read(LPCOLESTR pszPropName, VARIANT*, IErrorLog*);
+    virtual HRESULT STDMETHODCALLTYPE Write(LPCOLESTR pszPropName, VARIANT*);
+
+    // IPropertyBag2
+    virtual HRESULT STDMETHODCALLTYPE Read(ULONG cProperties, PROPBAG2*, IErrorLog*, VARIANT* pvarValue, HRESULT* phrError);
+    virtual HRESULT STDMETHODCALLTYPE Write(ULONG cProperties, PROPBAG2*, VARIANT*);
+    virtual HRESULT STDMETHODCALLTYPE CountProperties(ULONG* pcProperties);
+    virtual HRESULT STDMETHODCALLTYPE GetPropertyInfo(ULONG iProperty, ULONG cProperties, PROPBAG2* pPropBag, ULONG* pcProperties);
+    virtual HRESULT STDMETHODCALLTYPE LoadObject(LPCOLESTR pstrName, DWORD dwHint, IUnknown*, IErrorLog*);
+
+private:
+    COMPropertyBag()
+        : m_refCount(0)
+    {
+    }
+
+    COMPropertyBag(const HashMapType& hashMap)
+        : m_refCount(0)
+        , m_hashMap(hashMap)
+    {
+    }
+
+    ~COMPropertyBag() {}
+
+    ULONG m_refCount;
+    HashMapType m_hashMap;
+};
+
+// COMPropertyBag ------------------------------------------------------------------
+template<typename ValueType, typename KeyType, typename HashType>
+COMPropertyBag<ValueType, KeyType, HashType>* COMPropertyBag<typename ValueType, typename KeyType, HashType>::createInstance(const HashMapType& hashMap)
+{
+    COMPropertyBag* instance = new COMPropertyBag(hashMap);
+    instance->AddRef();
+    return instance;
+}
+
+template<typename ValueType, typename KeyType, typename HashType>
+COMPropertyBag<ValueType, KeyType, HashType>* COMPropertyBag<typename ValueType, typename KeyType, HashType>::adopt(HashMapType& hashMap)
+{
+    COMPropertyBag* instance = new COMPropertyBag;
+    instance->m_hashMap.swap(hashMap);
+    instance->AddRef();
+    return instance;
+}
+
+// IUnknown ------------------------------------------------------------------------
+template<typename ValueType, typename KeyType, typename HashType>
+HRESULT STDMETHODCALLTYPE COMPropertyBag<ValueType, KeyType, HashType>::QueryInterface(REFIID riid, void** ppvObject)
+{
+    *ppvObject = 0;
+    if (IsEqualGUID(riid, IID_IUnknown))
+        *ppvObject = static_cast<IPropertyBag*>(this);
+    else if (IsEqualGUID(riid, IID_IPropertyBag))
+        *ppvObject = static_cast<IPropertyBag*>(this);
+    else if (IsEqualGUID(riid, IID_IPropertyBag2))
+        *ppvObject = static_cast<IPropertyBag2*>(this);
+    else
+        return E_NOINTERFACE;
+
+    AddRef();
+    return S_OK;
+}
+
+template<typename ValueType, typename KeyType, typename HashType>
+ULONG STDMETHODCALLTYPE COMPropertyBag<ValueType, KeyType, HashType>::AddRef()
+{
+    return ++m_refCount;
+}
+
+template<typename ValueType, typename KeyType, typename HashType>
+ULONG STDMETHODCALLTYPE COMPropertyBag<ValueType, KeyType, HashType>::Release()
+{
+    ULONG newRef = --m_refCount;
+    if (!newRef)
+        delete this;
+
+    return newRef;
+}
+
+// IPropertyBag --------------------------------------------------------------------
+
+template<typename ValueType, typename KeyType, typename HashType>
+HRESULT STDMETHODCALLTYPE COMPropertyBag<ValueType, KeyType, HashType>::Read(LPCOLESTR pszPropName, VARIANT* pVar, IErrorLog* pErrorLog)
+{
+    if (!pszPropName)
+        return E_POINTER;
+
+    HashMapType::const_iterator it = m_hashMap.find(String(pszPropName));
+    HashMapType::const_iterator end = m_hashMap.end();
+    if (it == end)
+        return E_INVALIDARG;
+
+    VARTYPE requestedType = V_VT(pVar);
+    V_VT(pVar) = VT_EMPTY;
+    COMVariantSetter<ValueType>::setVariant(pVar, it->second);
+
+    if (requestedType != COMVariantSetter<ValueType>::variantType(it->second) && requestedType != VT_EMPTY)
+        return ::VariantChangeType(pVar, pVar, VARIANT_NOUSEROVERRIDE | VARIANT_ALPHABOOL, requestedType);
+
+    return S_OK;
+}
+
+template<typename ValueType, typename KeyType, typename HashType>
+HRESULT STDMETHODCALLTYPE COMPropertyBag<ValueType, KeyType, HashType>::Write(LPCOLESTR pszPropName, VARIANT* pVar)
+{
+    return E_FAIL;
+}
+
+template<typename ValueType, typename KeyType, typename HashType>
+HRESULT STDMETHODCALLTYPE COMPropertyBag<ValueType, KeyType, HashType>::Read(ULONG cProperties, PROPBAG2* pPropBag, IErrorLog* pErrorLog, VARIANT* pvarValue, HRESULT* phrError)
+{
+    if (!pPropBag || !pvarValue || !phrError)
+        return E_POINTER;
+
+    HRESULT hr = S_OK;
+
+    for (ULONG i = 0; i < cProperties; ++i) {
+        VariantInit(&pvarValue[i]);
+        pvarValue[i].vt = pPropBag[i].vt;
+        phrError[i] = Read(pPropBag[i].pstrName, &pvarValue[i], pErrorLog);
+        if (FAILED(phrError[i]))
+            hr = E_FAIL;
+    }
+
+    return hr;
+}
+
+template<typename ValueType, typename KeyType, typename HashType>
+HRESULT STDMETHODCALLTYPE COMPropertyBag<ValueType, KeyType, HashType>::Write(ULONG cProperties, PROPBAG2*, VARIANT*)
+{
+    return E_NOTIMPL;
+}
+
+template<typename ValueType, typename KeyType, typename HashType>
+HRESULT STDMETHODCALLTYPE COMPropertyBag<ValueType, KeyType, HashType>::CountProperties(ULONG* pcProperties)
+{
+    if (!pcProperties)
+        return E_POINTER;
+
+    *pcProperties = m_hashMap.size();
+    return S_OK;
+}
+
+template<typename ValueType, typename KeyType, typename HashType>
+HRESULT STDMETHODCALLTYPE COMPropertyBag<ValueType, KeyType, HashType>::GetPropertyInfo(ULONG iProperty, ULONG cProperties, PROPBAG2* pPropBag, ULONG* pcProperties)
+{
+    if (!pPropBag || !pcProperties)
+        return E_POINTER;
+
+    if (m_hashMap.size() <= iProperty)
+        return E_INVALIDARG;
+
+    *pcProperties = 0;
+    typedef HashMapType::const_iterator Iterator;
+    Iterator current = m_hashMap.begin();
+    Iterator end = m_hashMap.end();
+    for (ULONG i = 0; i < iProperty; ++i, ++current)
+        ;
+    for (ULONG j = 0; j < cProperties && current != end; ++j, ++current) {
+        // FIXME: the following fields aren't filled in
+        //pPropBag[j].cfType;   // (CLIPFORMAT) Clipboard format or MIME type of the property.
+        //pPropBag[j].clsid;    // (CLSID) CLSID of the object. This member is valid only if dwType is PROPBAG2_TYPE_OBJECT.
+
+        pPropBag[j].dwType = PROPBAG2_TYPE_DATA;
+        pPropBag[j].vt = COMVariantSetter<ValueType>::variantType(current->second);
+        pPropBag[j].dwHint = iProperty + j;
+        pPropBag[j].pstrName = (LPOLESTR)CoTaskMemAlloc(sizeof(wchar_t)*(current->first.length()+1));
+        if (!pPropBag[j].pstrName)
+            return E_OUTOFMEMORY;
+        wcscpy_s(pPropBag[j].pstrName, current->first.length()+1, static_cast<String>(current->first).charactersWithNullTermination());
+        ++*pcProperties;
+    }
+    return S_OK;
+}
+
+template<typename ValueType, typename KeyType, typename HashType>
+HRESULT STDMETHODCALLTYPE COMPropertyBag<ValueType, KeyType, HashType>::LoadObject(LPCOLESTR pstrName, DWORD dwHint, IUnknown*, IErrorLog*)
+{
+    return E_NOTIMPL;
+}
+
+#endif // COMPropertyBag_h
diff --git a/Source/WebKit/win/COMVariantSetter.h b/Source/WebKit/win/COMVariantSetter.h
index feb233c..e211dca 100644
--- a/Source/WebKit/win/COMVariantSetter.h
+++ b/Source/WebKit/win/COMVariantSetter.h
@@ -1,194 +1,194 @@
-/*

- * Copyright (C) 2007, 2008 Apple Inc. All Rights Reserved.

- *

- * Redistribution and use in source and binary forms, with or without

- * modification, are permitted provided that the following conditions

- * are met:

- * 1. Redistributions of source code must retain the above copyright

- *    notice, this list of conditions and the following disclaimer.

- * 2. Redistributions in binary form must reproduce the above copyright

- *    notice, this list of conditions and the following disclaimer in the

- *    documentation and/or other materials provided with the distribution.

- *

- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY

- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE

- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR

- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR

- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,

- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,

- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR

- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY

- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT

- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE

- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 

- */

-

-#ifndef COMVariantSetter_h

-#define COMVariantSetter_h

-

-#include <WebCore/BString.h>

-#include <WebCore/COMPtr.h>

-#include <wtf/Assertions.h>

-#include <wtf/Forward.h>

-

-template<typename T> struct COMVariantSetter {};

-

-template<typename T> struct COMVariantSetterBase

-{

-    static inline VARENUM variantType(const T&)

-    {

-        return COMVariantSetter<T>::VariantType;

-    }

-};

-

-template<> struct COMVariantSetter<WTF::String> : COMVariantSetterBase<WTF::String>

-{

-    static const VARENUM VariantType = VT_BSTR;

-

-    static void setVariant(VARIANT* variant, const WTF::String& value)

-    {

-        ASSERT(V_VT(variant) == VT_EMPTY);

-

-        V_VT(variant) = VariantType;

-        V_BSTR(variant) = WebCore::BString(value).release();

-    }

-};

-

-template<> struct COMVariantSetter<bool> : COMVariantSetterBase<bool>

-{

-    static const VARENUM VariantType = VT_BOOL;

-

-    static void setVariant(VARIANT* variant, bool value)

-    {

-        ASSERT(V_VT(variant) == VT_EMPTY);

-

-        V_VT(variant) = VariantType;

-        V_BOOL(variant) = value;

-    }

-};

-

-template<> struct COMVariantSetter<unsigned long long> : COMVariantSetterBase<unsigned long long>

-{

-    static const VARENUM VariantType = VT_UI8;

-

-    static void setVariant(VARIANT* variant, unsigned long long value)

-    {

-        ASSERT(V_VT(variant) == VT_EMPTY);

-

-        V_VT(variant) = VariantType;

-        V_UI8(variant) = value;

-    }

-};

-

-template<> struct COMVariantSetter<int> : COMVariantSetterBase<int>

-{

-    static const VARENUM VariantType = VT_I4;

-

-    static void setVariant(VARIANT* variant, int value)

-    {

-        ASSERT(V_VT(variant) == VT_EMPTY);

-

-        V_VT(variant) = VariantType;

-        V_I4(variant) = value;

-    }

-};

-

-template<> struct COMVariantSetter<float> : COMVariantSetterBase<float>

-{

-    static const VARENUM VariantType = VT_R4;

-

-    static void setVariant(VARIANT* variant, float value)

-    {

-        ASSERT(V_VT(variant) == VT_EMPTY);

-

-        V_VT(variant) = VariantType;

-        V_R4(variant) = value;

-    }

-};

-

-template<typename T> struct COMVariantSetter<COMPtr<T> > : COMVariantSetterBase<COMPtr<T> >

-{

-    static const VARENUM VariantType = VT_UNKNOWN;

-

-    static void setVariant(VARIANT* variant, const COMPtr<T>& value)

-    {

-        ASSERT(V_VT(variant) == VT_EMPTY);

-

-        V_VT(variant) = VariantType;

-        V_UNKNOWN(variant) = value.get();

-        value->AddRef();

-    }

-};

-

-template<typename COMType, typename UnderlyingType>

-struct COMIUnknownVariantSetter : COMVariantSetterBase<UnderlyingType>

-{

-    static const VARENUM VariantType = VT_UNKNOWN;

-

-    static void setVariant(VARIANT* variant, const UnderlyingType& value)

-    {

-        ASSERT(V_VT(variant) == VT_EMPTY);

-

-        V_VT(variant) = VariantType;

-        V_UNKNOWN(variant) = COMType::createInstance(value);

-    }

-};

-

-class COMVariant {

-public:

-    COMVariant()

-    {

-        ::VariantInit(&m_variant);

-    }

-

-    template<typename UnderlyingType>

-    COMVariant(UnderlyingType value)

-    {

-        ::VariantInit(&m_variant);

-        COMVariantSetter<UnderlyingType>::setVariant(&m_variant, value);

-    }

-

-    ~COMVariant()

-    {

-        ::VariantClear(&m_variant);

-    }

-

-    COMVariant(const COMVariant& other)

-    {

-        ::VariantInit(&m_variant);

-        other.copyTo(&m_variant);

-    }

-

-    COMVariant& operator=(const COMVariant& other)

-    {

-        other.copyTo(&m_variant);

-        return *this;

-    }

-

-    void copyTo(VARIANT* dest) const

-    {

-        ::VariantCopy(dest, const_cast<VARIANT*>(&m_variant));

-    }

-

-    VARENUM variantType() const { return static_cast<VARENUM>(V_VT(&m_variant)); }

-

-private:

-    VARIANT m_variant;

-};

-

-template<> struct COMVariantSetter<COMVariant>

-{

-    static inline VARENUM variantType(const COMVariant& value)

-    {

-        return value.variantType();

-    }

-

-    static void setVariant(VARIANT* variant, const COMVariant& value)

-    {

-        ASSERT(V_VT(variant) == VT_EMPTY);

-

-        value.copyTo(variant);

-    }

-};

-

-#endif // COMVariantSetter

+/*
+ * Copyright (C) 2007, 2008 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef COMVariantSetter_h
+#define COMVariantSetter_h
+
+#include <WebCore/BString.h>
+#include <WebCore/COMPtr.h>
+#include <wtf/Assertions.h>
+#include <wtf/Forward.h>
+
+template<typename T> struct COMVariantSetter {};
+
+template<typename T> struct COMVariantSetterBase
+{
+    static inline VARENUM variantType(const T&)
+    {
+        return COMVariantSetter<T>::VariantType;
+    }
+};
+
+template<> struct COMVariantSetter<WTF::String> : COMVariantSetterBase<WTF::String>
+{
+    static const VARENUM VariantType = VT_BSTR;
+
+    static void setVariant(VARIANT* variant, const WTF::String& value)
+    {
+        ASSERT(V_VT(variant) == VT_EMPTY);
+
+        V_VT(variant) = VariantType;
+        V_BSTR(variant) = WebCore::BString(value).release();
+    }
+};
+
+template<> struct COMVariantSetter<bool> : COMVariantSetterBase<bool>
+{
+    static const VARENUM VariantType = VT_BOOL;
+
+    static void setVariant(VARIANT* variant, bool value)
+    {
+        ASSERT(V_VT(variant) == VT_EMPTY);
+
+        V_VT(variant) = VariantType;
+        V_BOOL(variant) = value;
+    }
+};
+
+template<> struct COMVariantSetter<unsigned long long> : COMVariantSetterBase<unsigned long long>
+{
+    static const VARENUM VariantType = VT_UI8;
+
+    static void setVariant(VARIANT* variant, unsigned long long value)
+    {
+        ASSERT(V_VT(variant) == VT_EMPTY);
+
+        V_VT(variant) = VariantType;
+        V_UI8(variant) = value;
+    }
+};
+
+template<> struct COMVariantSetter<int> : COMVariantSetterBase<int>
+{
+    static const VARENUM VariantType = VT_I4;
+
+    static void setVariant(VARIANT* variant, int value)
+    {
+        ASSERT(V_VT(variant) == VT_EMPTY);
+
+        V_VT(variant) = VariantType;
+        V_I4(variant) = value;
+    }
+};
+
+template<> struct COMVariantSetter<float> : COMVariantSetterBase<float>
+{
+    static const VARENUM VariantType = VT_R4;
+
+    static void setVariant(VARIANT* variant, float value)
+    {
+        ASSERT(V_VT(variant) == VT_EMPTY);
+
+        V_VT(variant) = VariantType;
+        V_R4(variant) = value;
+    }
+};
+
+template<typename T> struct COMVariantSetter<COMPtr<T> > : COMVariantSetterBase<COMPtr<T> >
+{
+    static const VARENUM VariantType = VT_UNKNOWN;
+
+    static void setVariant(VARIANT* variant, const COMPtr<T>& value)
+    {
+        ASSERT(V_VT(variant) == VT_EMPTY);
+
+        V_VT(variant) = VariantType;
+        V_UNKNOWN(variant) = value.get();
+        value->AddRef();
+    }
+};
+
+template<typename COMType, typename UnderlyingType>
+struct COMIUnknownVariantSetter : COMVariantSetterBase<UnderlyingType>
+{
+    static const VARENUM VariantType = VT_UNKNOWN;
+
+    static void setVariant(VARIANT* variant, const UnderlyingType& value)
+    {
+        ASSERT(V_VT(variant) == VT_EMPTY);
+
+        V_VT(variant) = VariantType;
+        V_UNKNOWN(variant) = COMType::createInstance(value);
+    }
+};
+
+class COMVariant {
+public:
+    COMVariant()
+    {
+        ::VariantInit(&m_variant);
+    }
+
+    template<typename UnderlyingType>
+    COMVariant(UnderlyingType value)
+    {
+        ::VariantInit(&m_variant);
+        COMVariantSetter<UnderlyingType>::setVariant(&m_variant, value);
+    }
+
+    ~COMVariant()
+    {
+        ::VariantClear(&m_variant);
+    }
+
+    COMVariant(const COMVariant& other)
+    {
+        ::VariantInit(&m_variant);
+        other.copyTo(&m_variant);
+    }
+
+    COMVariant& operator=(const COMVariant& other)
+    {
+        other.copyTo(&m_variant);
+        return *this;
+    }
+
+    void copyTo(VARIANT* dest) const
+    {
+        ::VariantCopy(dest, const_cast<VARIANT*>(&m_variant));
+    }
+
+    VARENUM variantType() const { return static_cast<VARENUM>(V_VT(&m_variant)); }
+
+private:
+    VARIANT m_variant;
+};
+
+template<> struct COMVariantSetter<COMVariant>
+{
+    static inline VARENUM variantType(const COMVariant& value)
+    {
+        return value.variantType();
+    }
+
+    static void setVariant(VARIANT* variant, const COMVariant& value)
+    {
+        ASSERT(V_VT(variant) == VT_EMPTY);
+
+        value.copyTo(variant);
+    }
+};
+
+#endif // COMVariantSetter
diff --git a/Source/WebKit/win/ChangeLog b/Source/WebKit/win/ChangeLog
index 5540ab3..870b692 100644
--- a/Source/WebKit/win/ChangeLog
+++ b/Source/WebKit/win/ChangeLog
@@ -1,3 +1,443 @@
+2011-03-30  Martin Robinson  <mrobinson@igalia.com>
+
+        Reviewed by Dirk Schulze.
+
+        [Cairo] Better separate the concerns of GraphicsContextCairo
+        https://bugs.webkit.org/show_bug.cgi?id=55150
+
+        * WebFrame.cpp:
+        (hdcFromContext): Modify this method to take PlatformContextCairo
+        instead of a cairo_t.
+        (WebFrame::spoolPage): Update to reflect new platform context.
+        (WebFrame::spoolPages): Ditto.
+        * WebFrame.h: Ditto.
+
+2011-03-30  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Update Windows production build logic for new production configurations
+        https://bugs.webkit.org/show_bug.cgi?id=57494
+
+        * WebKit.vcproj/InterfacesProduction.vsprops:
+        * WebKit.vcproj/WebKit.make:
+        * WebKit.vcproj/WebKitGUIDProduction.vsprops:
+        * WebKit.vcproj/WebKitLibProduction.vsprops:
+
+2011-03-30  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Rename Windows configuration Release_LTCG to Production for clarity
+        https://bugs.webkit.org/show_bug.cgi?id=57465
+
+        * WebKit.vcproj/Interfaces.vcproj:
+        * WebKit.vcproj/InterfacesProduction.vsprops: Copied from Source/WebKit/win/WebKit.vcproj/InterfacesReleaseLTCG.vsprops.
+        * WebKit.vcproj/InterfacesReleaseLTCG.vsprops: Removed.
+        * WebKit.vcproj/WebKit.sln:
+        * WebKit.vcproj/WebKit.submit.sln:
+        * WebKit.vcproj/WebKit.vcproj:
+        * WebKit.vcproj/WebKitGUID.vcproj:
+        * WebKit.vcproj/WebKitGUIDProduction.vsprops: Copied from Source/WebKit/win/WebKit.vcproj/WebKitGUIDReleaseLTCG.vsprops.
+        * WebKit.vcproj/WebKitGUIDReleaseLTCG.vsprops: Removed.
+        * WebKit.vcproj/WebKitLibProduction.vsprops: Copied from Source/WebKit/win/WebKit.vcproj/WebKitLibReleaseLTCG.vsprops.
+        * WebKit.vcproj/WebKitLibReleaseLTCG.vsprops: Removed.
+
+2011-03-29  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Adam Roben.
+
+        [WIN] Remove unused GEN_DOMObject files
+        https://bugs.webkit.org/show_bug.cgi?id=57370
+
+        * GEN_DOMObject.cpp: Removed.
+        * GEN_DOMObject.h: Removed.
+
+2011-03-29  Steve Falkenburg  <sfalken@apple.com>
+
+        More build fix.
+
+        * WebCoreSupport/WebPlatformStrategies.h:
+
+2011-03-29  Steve Falkenburg  <sfalken@apple.com>
+
+        Build fix.
+
+        * WebCoreSupport/WebPlatformStrategies.cpp:
+        (WebPlatformStrategies::contextMenuItemTagLookUpInDictionary):
+
+2011-03-29  Patrick Gansterer  <paroga@webkit.org>
+
+        Unreviewed. Try to fix Windows build.
+
+        * DOMEventsClasses.cpp: Added initguid.h again.
+
+2011-03-29  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Adam Roben.
+
+        [WIN] Cleanup includes in WebKit files
+        https://bugs.webkit.org/show_bug.cgi?id=57381
+
+        Add missing includes to fix build without precompiled header.
+        Also fix paths in #include statements (e.g. WTF -> wtf).
+
+        * AccessibleBase.h:
+        * AccessibleDocument.h: Replace using statement with a qualified name.
+        * CFDictionaryPropertyBag.h:
+        * DOMEventsClasses.cpp:
+        * DOMHTMLClasses.h:
+        * DefaultDownloadDelegate.cpp:
+        * DefaultDownloadDelegate.h:
+        * DefaultPolicyDelegate.cpp:
+        * DefaultPolicyDelegate.h:
+        * WebCoreSupport/EmbeddedWidget.h:
+        * WebCoreSupport/WebInspectorDelegate.h:
+        * WebDataSource.h:
+        * WebDatabaseManager.h:
+        * WebElementPropertyBag.h:
+        * WebFramePolicyListener.h:
+        * WebGeolocationPolicyListener.h:
+        * WebHistory.h:
+        * WebKitClassFactory.h:
+        * WebScriptWorld.h:
+        * WebSerializedJSValue.h:
+        * WebUserContentURLPattern.h:
+
+2011-03-29  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Use per-configuration vsprops in WebKit to avoid WebKitVSPropsRedirectionDir removal by MSVC IDE
+        https://bugs.webkit.org/show_bug.cgi?id=57383
+
+        Visual Studio's IDE was removing instances of $(WebKitVSPropsRedirectionDir) from
+        InheritedPropertySheet rules in our vcproj files when the vcproj was edited from within
+        the IDE. To avoid this, add a separate vsprops file for each project configuration that
+        contains the required inherited property sheets.
+
+        * WebKit.vcproj/Interfaces.vcproj:
+        * WebKit.vcproj/InterfacesDebug.vsprops: Added.
+        * WebKit.vcproj/InterfacesDebugAll.vsprops: Added.
+        * WebKit.vcproj/InterfacesDebugCairoCFLite.vsprops: Added.
+        * WebKit.vcproj/InterfacesRelease.vsprops: Added.
+        * WebKit.vcproj/InterfacesReleaseCairoCFLite.vsprops: Added.
+        * WebKit.vcproj/InterfacesReleaseLTCG.vsprops: Added.
+        * WebKit.vcproj/WebKit.vcproj:
+        * WebKit.vcproj/WebKitGUID.vcproj:
+        * WebKit.vcproj/WebKitGUIDDebug.vsprops: Added.
+        * WebKit.vcproj/WebKitGUIDDebugAll.vsprops: Added.
+        * WebKit.vcproj/WebKitGUIDDebugCairoCFLite.vsprops: Added.
+        * WebKit.vcproj/WebKitGUIDRelease.vsprops: Added.
+        * WebKit.vcproj/WebKitGUIDReleaseCairoCFLite.vsprops: Added.
+        * WebKit.vcproj/WebKitGUIDReleaseLTCG.vsprops: Added.
+        * WebKit.vcproj/WebKitLibDebug.vsprops: Added.
+        * WebKit.vcproj/WebKitLibDebugAll.vsprops: Added.
+        * WebKit.vcproj/WebKitLibDebugCairoCFLite.vsprops: Added.
+        * WebKit.vcproj/WebKitLibRelease.vsprops: Added.
+        * WebKit.vcproj/WebKitLibReleaseCairoCFLite.vsprops: Added.
+        * WebKit.vcproj/WebKitLibReleaseLTCG.vsprops: Added.
+
+2011-03-29  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Adam Roben.
+
+        Remove #pragma warning push and pop statements
+        https://bugs.webkit.org/show_bug.cgi?id=57198
+
+        We do not need to disable warnings via #pragma since we started
+        compiling WebCore with the same compiler warnings flags as WebKit.
+
+        * DOMCSSClasses.cpp:
+        * DOMCoreClasses.cpp:
+        * DOMEventsClasses.cpp:
+        * DOMHTMLClasses.cpp:
+        * DefaultDownloadDelegate.cpp:
+        * DefaultPolicyDelegate.cpp:
+        * MarshallingHelpers.cpp:
+        * WebActionPropertyBag.cpp:
+        * WebActionPropertyBag.h:
+        * WebCache.cpp:
+        * WebCoreSupport/WebDragClient.cpp:
+        * WebCoreSupport/WebEditorClient.cpp:
+        * WebCoreSupport/WebEditorClient.h:
+        * WebCoreSupport/WebFrameLoaderClient.cpp:
+        * WebCoreSupport/WebFrameLoaderClient.h:
+        * WebCoreSupport/WebInspectorClient.cpp:
+        * WebDocumentLoader.h:
+        * WebDownload.cpp:
+        * WebDownloadCFNet.cpp:
+        * WebDownloadCurl.cpp:
+        * WebElementPropertyBag.cpp:
+        * WebError.cpp:
+        * WebError.h:
+        * WebFrame.cpp:
+        * WebFrame.h:
+        * WebFramePolicyListener.cpp:
+        * WebFramePolicyListener.h:
+        * WebHistory.cpp:
+        * WebHistoryItem.cpp:
+        * WebIconDatabase.cpp:
+        * WebIconDatabase.h:
+        * WebInspector.cpp:
+        * WebJavaScriptCollector.cpp:
+        * WebKitGraphics.cpp:
+        * WebKitSystemBits.cpp:
+        * WebLocalizableStrings.cpp:
+        * WebMutableURLRequest.cpp:
+        * WebMutableURLRequest.h:
+        * WebNodeHighlight.cpp:
+        * WebNodeHighlight.h:
+        * WebNotificationCenter.cpp:
+        * WebResource.cpp:
+        * WebResource.h:
+        * WebScrollBar.cpp:
+        * WebScrollBar.h:
+        * WebURLAuthenticationChallenge.cpp:
+        * WebURLAuthenticationChallenge.h:
+        * WebURLAuthenticationChallengeSender.cpp:
+        * WebURLAuthenticationChallengeSenderCFNet.cpp:
+        * WebURLAuthenticationChallengeSenderCurl.cpp:
+        * WebURLCredential.cpp:
+        * WebURLCredential.h:
+        * WebURLProtectionSpace.cpp:
+        * WebURLProtectionSpace.h:
+        * WebURLResponse.cpp:
+        * WebURLResponse.h:
+
+2011-03-29  Brent Fulgham  <bfulgham@webkit.org>
+
+        Unreviewed build fix after r82247.
+
+        * WebMutableURLRequest.cpp: The new CertificateCFWin routines
+        are not CFNetwork-specific. All CF-based ports can use them.
+
+2011-03-29  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Adam Roben.
+
+        [WIN] Use WCHAR instead of TCHAR
+        https://bugs.webkit.org/show_bug.cgi?id=57191
+
+        We always use the UNICODE versions of windows functions, so
+        the usage of TCHAR makes no sense and mixing them is bad style.
+
+        * DefaultDownloadDelegate.cpp:
+        * WebCoreSupport/WebChromeClient.cpp:
+        * WebCoreSupport/WebContextMenuClient.cpp:
+        * WebCoreSupport/WebInspectorClient.cpp:
+        * WebKitDLL.cpp:
+        * WebNotificationCenter.cpp:
+        * WebPreferences.cpp:
+        * WebURLResponse.cpp:
+        * WebView.cpp:
+
+2011-03-29  Jeff Miller  <jeffm@apple.com>
+
+        Reviewed by Jon Honeycutt.
+
+        Add WebCore::copyCertificateToData() on Windows
+        https://bugs.webkit.org/show_bug.cgi?id=57296
+
+        Remove duplicate code that implemented this functionality in WebMutableURLRequest.cpp and use WebCore::copyCertificateToData() instead. 
+
+        * WebMutableURLRequest.cpp:
+        (WebMutableURLRequest::setClientCertificate):  Use WebCore::copyCertificateToData().
+
+2011-03-28  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Adam Roben.
+
+        [WIN] Remove unused DOMCreateInstance files
+        https://bugs.webkit.org/show_bug.cgi?id=57193
+
+        * DOMCreateInstance.cpp: Removed.
+        * DOMCreateInstance.h: Removed.
+
+2011-03-28  Adele Peterson  <adele@apple.com>
+
+        Build fix.
+        
+        * WebFrame.cpp: (WebFrame::hasSpellingMarker):
+        Call new selectionStartHasMarkerFor method instead of selectionStartHasSpellingMarkerFor.
+
+2011-03-28  Jeff Miller  <jeffm@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Include certificate when sending a WebCore::ResourceError to UI process on Windows
+        https://bugs.webkit.org/show_bug.cgi?id=57195
+        
+        Rename callers of wkGetSSLPeerCertificateData() to use wkGetSSLPeerCertificateDataBytePtr(), since it returns a void*.
+
+        * WebError.cpp:
+        (WebError::sslPeerCertificate):
+        * WebURLResponse.cpp:
+        (WebURLResponse::sslPeerCertificate):
+
+2011-03-28  Darin Adler  <darin@apple.com>
+
+        Set eol-style to native on more files. I noticed the last check-in had an entire file
+        changing because of an EOL style change, and setting this property prevents that from
+        happening in future. We may want to do this systematically for more of WebKit later.
+
+        * AccessibleBase.cpp: Added property svn:eol-style.
+        * AccessibleBase.h: Added property svn:eol-style.
+        * AccessibleDocument.cpp: Added property svn:eol-style.
+        * AccessibleDocument.h: Added property svn:eol-style.
+        * AccessibleImage.cpp: Added property svn:eol-style.
+        * AccessibleImage.h: Added property svn:eol-style.
+        * COMVariantSetter.h: Added property svn:eol-style.
+        * FullscreenVideoController.cpp: Added property svn:eol-style.
+        * FullscreenVideoController.h: Added property svn:eol-style.
+        * WebCoreSupport/EmbeddedWidget.cpp: Added property svn:eol-style.
+        * WebCoreSupport/EmbeddedWidget.h: Added property svn:eol-style.
+        * WebCoreSupport/WebDesktopNotificationsDelegate.cpp: Added property svn:eol-style.
+        * WebCoreSupport/WebDesktopNotificationsDelegate.h: Added property svn:eol-style.
+        * WebCoreSupport/WebFrameLoaderClient.cpp: Added property svn:eol-style.
+        * WebCoreSupport/WebInspectorDelegate.cpp: Added property svn:eol-style.
+        * WebCoreSupport/WebInspectorDelegate.h: Added property svn:eol-style.
+        * WebCoreSupport/WebPlatformStrategies.cpp: Added property svn:eol-style.
+        * WebCoreSupport/WebPlatformStrategies.h: Added property svn:eol-style.
+        * WebCoreSupport/WebPluginHalterClient.cpp: Added property svn:eol-style.
+        * WebCoreSupport/WebPluginHalterClient.h: Added property svn:eol-style.
+
+2011-03-28  Patrick Gansterer  <paroga@webkit.org>
+
+        Unreviewed build fix.
+
+        * COMPropertyBag.h: Added missing include.
+        * WebKitCOMAPI.h: Ditto.
+        * WebCoreSupport/WebFrameLoaderClient.h: Added missing forward declaration.
+
+2011-03-25  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Jon Honeycutt.
+
+        WebScrollBar not updating when calling WebScrollBar::setValue.
+        <rdar://problem/9143871>
+
+        * WebScrollBar.cpp:
+        (WebScrollBar::setValue):
+        Call scrollToOffsetWithoutAnimation to actually update the scroll position.
+
+2011-03-25  Andy Estes  <aestes@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        REGRESSION (r70748): latest nightly builds kills AC_QuickTime.js
+        https://bugs.webkit.org/show_bug.cgi?id=49016
+
+        Update objectContentType() implementation to handle the
+        shouldPreferPlugInsForImages flag.
+
+        * WebFrame.cpp:
+        (WebFrame::objectContentType):
+        * WebFrame.h:
+
+2011-03-24  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r81916 and r81917.
+        http://trac.webkit.org/changeset/81916
+        http://trac.webkit.org/changeset/81917
+        https://bugs.webkit.org/show_bug.cgi?id=57071
+
+        broke a test on platforms that do not have QuickTime installed
+        (Requested by estes on #webkit).
+
+        * WebFrame.cpp:
+        (WebFrame::objectContentType):
+        * WebFrame.h:
+
+2011-03-24  Andy Estes  <aestes@apple.com>
+
+        Reviewed by Darin Adler.
+
+        REGRESSION (r70748): latest nightly builds kills AC_QuickTime.js
+        https://bugs.webkit.org/show_bug.cgi?id=49016
+
+        Update objectContentType() implementation to handle the
+        shouldPreferPlugInsForImages flag.
+
+        * WebFrame.cpp:
+        (WebFrame::objectContentType):
+        * WebFrame.h:
+
+2011-03-23  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Change IconDatabase opening to allow for arbitrary filenames
+        https://bugs.webkit.org/show_bug.cgi?id=56977
+
+        * WebIconDatabase.cpp:
+        (WebIconDatabase::startUpIconDatabase):
+
+2011-03-22  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        <rdar://problem/8648311> and https://bugs.webkit.org/show_bug.cgi?id=56876
+        WK2 Icon DB: Expand IconDatabaseClient interface and move it to the main thread
+
+        Note that while the new client calls always come through on the main thread, our mechanisms to
+        route dispatches to the main thread are still valid and will still work.
+
+        Update to the new IconDatabaseClient interface:
+        * WebIconDatabase.cpp:
+        (WebIconDatabase::performImport):
+        (WebIconDatabase::didRemoveAllIcons):
+        (WebIconDatabase::didImportIconURLForPageURL):
+        (WebIconDatabase::didImportIconDataForPageURL):
+        (WebIconDatabase::didChangeIconForPageURL):
+        (WebIconDatabase::didFinishURLImport):
+        * WebIconDatabase.h:
+
+2011-03-17  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=56425
+        More groundwork for WebKit2 IconDatabase
+
+        Update already-used function names:
+        * WebIconDatabase.cpp:
+        (WebIconDatabase::iconForURL):
+        (WebIconDatabase::iconURLForURL):
+        (WebIconDatabase::hasIconForURL):
+
+2011-03-18  Pavel Podivilov  <podivilov@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: implement inspector session storage.
+        https://bugs.webkit.org/show_bug.cgi?id=56643
+
+        * WebCoreSupport/WebInspectorClient.cpp:
+        (WebInspectorClient::saveSessionSetting):
+        (WebInspectorClient::loadSessionSetting):
+        (WebInspectorFrontendClient::saveSessionSetting):
+        (WebInspectorFrontendClient::loadSessionSetting):
+        * WebCoreSupport/WebInspectorClient.h:
+
+2011-03-11  Brady Eidson  <beidson@apple.com>
+
+        More Windows build fix for https://bugs.webkit.org/show_bug.cgi?id=56216
+
+        * WebCoreStatistics.cpp:
+        * WebIconDatabase.cpp:
+
+2011-03-09  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Mihai Parparita.
+
+        Unify Windows version checks.
+        https://bugs.webkit.org/show_bug.cgi?id=55979
+
+        * WebView.cpp:
+        (WebView::standardUserAgentWithApplicationName):
+        (webKitVersionString):
+
 2011-03-07  Sam Weinig  <sam@webkit.org>
 
         Reviewed by Anders Carlsson.
diff --git a/Source/WebKit/win/DOMCSSClasses.cpp b/Source/WebKit/win/DOMCSSClasses.cpp
index b89053b..0220031 100644
--- a/Source/WebKit/win/DOMCSSClasses.cpp
+++ b/Source/WebKit/win/DOMCSSClasses.cpp
@@ -27,9 +27,7 @@
 #include "WebKitDLL.h"
 #include "DOMCSSClasses.h"
 
-#pragma warning(push, 0)
 #include <WebCore/PlatformString.h>
-#pragma warning(pop)
 
 // DOMCSSStyleDeclaration - DOMCSSStyleDeclaration ----------------------------
 
diff --git a/Source/WebKit/win/DOMCoreClasses.cpp b/Source/WebKit/win/DOMCoreClasses.cpp
index c6b8823..b0a6031 100644
--- a/Source/WebKit/win/DOMCoreClasses.cpp
+++ b/Source/WebKit/win/DOMCoreClasses.cpp
@@ -33,7 +33,6 @@
 #include "DOMHTMLClasses.h"
 #include "WebKitGraphics.h"
 
-#pragma warning(push, 0)
 #include <WebCore/BString.h>
 #include <WebCore/DOMWindow.h>
 #include <WebCore/Document.h>
@@ -49,7 +48,6 @@
 #include <WebCore/NodeList.h>
 #include <WebCore/RenderObject.h>
 #include <WebCore/RenderTreeAsText.h>
-#pragma warning(pop)
 
 #include <initguid.h>
 // {3B0C0EFF-478B-4b0b-8290-D2321E08E23E}
diff --git a/Source/WebKit/win/DOMCreateInstance.cpp b/Source/WebKit/win/DOMCreateInstance.cpp
deleted file mode 100644
index ebaa4ce..0000000
--- a/Source/WebKit/win/DOMCreateInstance.cpp
+++ /dev/null
@@ -1,357 +0,0 @@
-/*
- * Copyright (C) 2007 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1.  Redistributions of source code must retain the above copyright
- *     notice, this list of conditions and the following disclaimer.
- * 2.  Redistributions in binary form must reproduce the above copyright
- *     notice, this list of conditions and the following disclaimer in the
- *     documentation and/or other materials provided with the distribution.
- * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
- *     its contributors may be used to endorse or promote products derived
- *     from this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
- * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
- * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
- * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
- * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
- * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-// This file is a temporary hack to implement the createInstance methods for
-// the COM DOM bindings.
-
-#include "config.h"
-#include "DOMCreateInstance.h"
-
-#include "GEN_DOMNode.h"
-#include "GEN_DOMElement.h"
-#include "GEN_DOMDocument.h"
-#include "GEN_DOMAttr.h"
-#include "GEN_DOMText.h"
-#include "GEN_DOMCDATASection.h"
-#include "GEN_DOMEntityReference.h"
-#include "GEN_DOMEntity.h"
-#include "GEN_DOMProcessingInstruction.h"
-#include "GEN_DOMComment.h"
-#include "GEN_DOMHTMLElement.h"
-#include "GEN_DOMHTMLDocument.h"
-#include "GEN_DOMHTMLCollection.h"
-#include "GEN_DOMDocumentType.h"
-#include "GEN_DOMDocumentFragment.h"
-#include "GEN_DOMNotation.h"
-#include "GEN_DOMCSSCharsetRule.h"
-#include "GEN_DOMCSSFontFaceRule.h"
-#include "GEN_DOMCSSImportRule.h"
-#include "GEN_DOMCSSMediaRule.h"
-#include "GEN_DOMCSSPageRule.h"
-#include "GEN_DOMCSSPrimitiveValue.h"
-#include "GEN_DOMCSSRule.h"
-#include "GEN_DOMCSSRuleList.h"
-#include "GEN_DOMCSSStyleDeclaration.h"
-#include "GEN_DOMCSSStyleRule.h"
-#include "GEN_DOMCSSStyleSheet.h"
-#include "GEN_DOMCSSValueList.h"
-#include "GEN_DOMStyleSheet.h"
-#include "GEN_DOMDOMImplementation.h"
-#include "GEN_DOMNamedNodeMap.h"
-#include "GEN_DOMNodeList.h"
-#include "GEN_DOMCounter.h"
-#include "GEN_DOMCSSRuleList.h"
-#include "GEN_DOMCSSStyleDeclaration.h"
-#include "GEN_DOMMediaList.h"
-#include "GEN_DOMRect.h"
-#include "GEN_DOMStyleSheet.h"
-#include "GEN_DOMStyleSheetList.h"
-#include "GEN_DOMEvent.h"
-#include "GEN_DOMEvent.h"
-#include <wtf/HashMap.h>
-
-#pragma warning(push, 0)
-#include <WebCore/Node.h>
-#include <WebCore/Element.h>
-#include <WebCore/Document.h>
-#include <WebCore/Attr.h>
-#include <WebCore/Text.h>
-#include <WebCore/COMPtr.h>
-#include <WebCore/CDATASection.h>
-#include <WebCore/EntityReference.h>
-#include <WebCore/Entity.h>
-#include <WebCore/ProcessingInstruction.h>
-#include <WebCore/Comment.h>
-#include <WebCore/HTMLDocument.h>
-#include <WebCore/HTMLElement.h>
-#include <WebCore/HTMLCollection.h>
-#include <WebCore/DocumentType.h>
-#include <WebCore/DocumentFragment.h>
-#include <WebCore/Notation.h>
-#include <WebCore/CSSCharsetRule.h>
-#include <WebCore/CSSFontFaceRule.h>
-#include <WebCore/CSSImportRule.h>
-#include <WebCore/CSSMediaRule.h>
-#include <WebCore/CSSPageRule.h>
-#include <WebCore/CSSPrimitiveValue.h>
-#include <WebCore/CSSRule.h>
-#include <WebCore/CSSRuleList.h>
-#include <WebCore/CSSStyleDeclaration.h>
-#include <WebCore/CSSStyleRule.h>
-#include <WebCore/CSSStyleSheet.h>
-#include <WebCore/CSSValueList.h>
-#include <WebCore/StyleSheet.h>
-#include <WebCore/DOMImplementation.h>
-#include <WebCore/NamedNodeMap.h>
-#include <WebCore/NodeList.h>
-#include <WebCore/Counter.h>
-#include <WebCore/CSSRuleList.h>
-#include <WebCore/CSSStyleDeclaration.h>
-#include <WebCore/MediaList.h>
-#include <WebCore/Rect.h>
-#include <WebCore/StyleSheet.h>
-#include <WebCore/StyleSheetList.h>
-#include <WebCore/Event.h>
-#include <WebCore/EventListener.h>
-#pragma warning(pop)
-
-typedef HashMap<void*, GEN_DOMObject*> DOMWrapperCache;
-
-static DOMWrapperCache& domWrapperCache()
-{
-    static DOMWrapperCache cache;
-    return cache;
-}
-
-GEN_DOMObject* getDOMWrapper(void* objectHandle)
-{
-    return domWrapperCache().get(objectHandle);
-}
-
-void setDOMWrapper(void* objectHandle, GEN_DOMObject* wrapper)
-{
-    domWrapperCache().set(objectHandle, wrapper);
-}
-
-void removeDOMWrapper(void* objectHandle)
-{
-    domWrapperCache().remove(objectHandle);
-}
-
-#define COM_DOM_PREFIX(Type) GEN_DOM##Type
-#define CREATE_ONLY_SELF(Type) \
-    COM_DOM_PREFIX(Type)* COM_DOM_PREFIX(Type)::createInstance(WebCore::Type* impl) \
-    { \
-        if (!impl) \
-            return 0; \
-        if (GEN_DOMObject* cachedInstance = getDOMWrapper(impl)) { \
-            cachedInstance->AddRef(); \
-            return static_cast<COM_DOM_PREFIX(Type)*>(cachedInstance); \
-        } \
-        COMPtr<COM_DOM_PREFIX(Type)> comDOMObject = new COM_DOM_PREFIX(Type)(impl); \
-        setDOMWrapper(impl, comDOMObject.get()); \
-        return comDOMObject.releaseRef(); \
-    } \
-
-// Core
-
-GEN_DOMNode* GEN_DOMNode::createInstance(WebCore::Node* node)
-{
-    if (!node)
-        return 0;
-
-    if (GEN_DOMObject* cachedInstance = getDOMWrapper(node)) {
-        cachedInstance->AddRef();
-        return static_cast<GEN_DOMNode*>(cachedInstance);
-    }
-
-    COMPtr<GEN_DOMNode> domNode;
-    switch (node->nodeType()) {
-        case WebCore::Node::ELEMENT_NODE:
-            // FIXME: add support for creating subclasses of HTMLElement.
-            // FIXME: add support for creating SVGElements and its subclasses.
-            if (node->isHTMLElement())
-                domNode = new GEN_DOMHTMLElement(static_cast<WebCore::HTMLElement*>(node));
-            else
-                domNode = new GEN_DOMElement(static_cast<WebCore::Element*>(node));
-            break;
-        case WebCore::Node::ATTRIBUTE_NODE:
-            domNode = new GEN_DOMAttr(static_cast<WebCore::Attr*>(node));
-            break;
-        case WebCore::Node::TEXT_NODE:
-            domNode = new GEN_DOMText(static_cast<WebCore::Text*>(node));
-            break;
-        case WebCore::Node::CDATA_SECTION_NODE:
-            domNode = new GEN_DOMCDATASection(static_cast<WebCore::CDATASection*>(node));
-            break;
-        case WebCore::Node::ENTITY_REFERENCE_NODE:
-            domNode = new GEN_DOMEntityReference(static_cast<WebCore::EntityReference*>(node));
-            break;
-        case WebCore::Node::ENTITY_NODE:
-            domNode = new GEN_DOMEntity(static_cast<WebCore::Entity*>(node));
-            break;
-        case WebCore::Node::PROCESSING_INSTRUCTION_NODE:
-            domNode = new GEN_DOMProcessingInstruction(static_cast<WebCore::ProcessingInstruction*>(node));
-            break;
-        case WebCore::Node::COMMENT_NODE:
-            domNode = new GEN_DOMComment(static_cast<WebCore::Comment*>(node));
-            break;
-        case WebCore::Node::DOCUMENT_NODE:
-            // FIXME: add support for SVGDocument.
-            if (static_cast<WebCore::Document*>(node)->isHTMLDocument())
-                domNode = new GEN_DOMHTMLDocument(static_cast<WebCore::HTMLDocument*>(node));
-            else
-                domNode = new GEN_DOMDocument(static_cast<WebCore::Document*>(node));
-            break;
-        case WebCore::Node::DOCUMENT_TYPE_NODE:
-            domNode = new GEN_DOMDocumentType(static_cast<WebCore::DocumentType*>(node));
-            break;
-        case WebCore::Node::DOCUMENT_FRAGMENT_NODE:
-            domNode = new GEN_DOMDocumentFragment(static_cast<WebCore::DocumentFragment*>(node));
-            break;
-        case WebCore::Node::NOTATION_NODE:
-            domNode = new GEN_DOMNotation(static_cast<WebCore::Notation*>(node));
-            break;
-        default:
-            domNode = new GEN_DOMNode(node);
-            break;
-    }
-
-    setDOMWrapper(node, domNode.get());
-    return domNode.releaseRef();
-}
-
-GEN_DOMImplementation* GEN_DOMImplementation::createInstance(WebCore::DOMImplementation* impl)
-{
-    if (!impl)
-        return 0;
-
-    if (GEN_DOMObject* cachedInstance = getDOMWrapper(impl)) {
-        cachedInstance->AddRef();
-        return static_cast<GEN_DOMImplementation*>(cachedInstance);
-    }
-
-    COMPtr<GEN_DOMImplementation> comDOMObject = new GEN_DOMImplementation(impl);
-    setDOMWrapper(impl, comDOMObject.get());
-    return comDOMObject.releaseRef();
-}
-
-CREATE_ONLY_SELF(NamedNodeMap)
-CREATE_ONLY_SELF(NodeList)
-
-// Events
-
-// FIXME: Add the subclasses for Event when they get generated.
-CREATE_ONLY_SELF(Event)
-
-
-// CSS
-
-GEN_DOMCSSRule* GEN_DOMCSSRule::createInstance(WebCore::CSSRule* rule)
-{
-    if (!rule)
-        return 0;
-
-    if (GEN_DOMObject* cachedInstance = getDOMWrapper(rule)) {
-        cachedInstance->AddRef();
-        return static_cast<GEN_DOMCSSRule*>(cachedInstance);
-    }
-
-    COMPtr<GEN_DOMCSSRule> domRule;
-    switch (rule->type()) {
-        case WebCore::CSSRule::STYLE_RULE:
-            domRule = new GEN_DOMCSSStyleRule(static_cast<WebCore::CSSStyleRule*>(rule));
-            break;
-        case WebCore::CSSRule::CHARSET_RULE:
-            domRule = new GEN_DOMCSSCharsetRule(static_cast<WebCore::CSSCharsetRule*>(rule));
-            break;
-        case WebCore::CSSRule::IMPORT_RULE:
-            domRule = new GEN_DOMCSSImportRule(static_cast<WebCore::CSSImportRule*>(rule));
-            break;
-        case WebCore::CSSRule::MEDIA_RULE:
-            domRule = new GEN_DOMCSSMediaRule(static_cast<WebCore::CSSMediaRule*>(rule));
-            break;
-        case WebCore::CSSRule::FONT_FACE_RULE:
-            domRule = new GEN_DOMCSSFontFaceRule(static_cast<WebCore::CSSFontFaceRule*>(rule));
-            break;
-        case WebCore::CSSRule::PAGE_RULE:
-            domRule = new GEN_DOMCSSPageRule(static_cast<WebCore::CSSPageRule*>(rule));
-            break;
-        case WebCore::CSSRule::UNKNOWN_RULE:
-        default:
-            domRule = new GEN_DOMCSSRule(rule);
-            break;
-    }
-
-    setDOMWrapper(rule, domRule.get());
-    return domRule.releaseRef();
-}
-
-GEN_DOMStyleSheet* GEN_DOMStyleSheet::createInstance(WebCore::StyleSheet* styleSheet)
-{
-    if (!styleSheet)
-        return 0;
-
-    if (GEN_DOMObject* cachedInstance = getDOMWrapper(styleSheet)) {
-        cachedInstance->AddRef();
-        return static_cast<GEN_DOMStyleSheet*>(cachedInstance);
-    }
-
-    COMPtr<GEN_DOMStyleSheet> domStyleSheet;
-    if (styleSheet->isCSSStyleSheet())
-        domStyleSheet = new GEN_DOMCSSStyleSheet(static_cast<WebCore::CSSStyleSheet*>(styleSheet));
-    else
-        domStyleSheet = new GEN_DOMStyleSheet(styleSheet);
-
-    setDOMWrapper(styleSheet, domStyleSheet.get());
-    return domStyleSheet.releaseRef();
-}
-
-
-GEN_DOMCSSValue* GEN_DOMCSSValue::createInstance(WebCore::CSSValue* value)
-{
-    if (!value)
-        return 0;
-
-    if (GEN_DOMObject* cachedInstance = getDOMWrapper(value)) {
-        cachedInstance->AddRef();
-        return static_cast<GEN_DOMCSSValue*>(cachedInstance);
-    }
-
-    COMPtr<GEN_DOMCSSValue> domValue;
-    switch (value->cssValueType()) {
-        case WebCore::CSSValue::CSS_PRIMITIVE_VALUE:
-            domValue = new GEN_DOMCSSPrimitiveValue(static_cast<WebCore::CSSPrimitiveValue*>(value));
-            break;
-        case WebCore::CSSValue::CSS_VALUE_LIST:
-            domValue = new GEN_DOMCSSValueList(static_cast<WebCore::CSSValueList*>(value));
-            break;
-        case WebCore::CSSValue::CSS_INHERIT:
-            domValue = new GEN_DOMCSSValue(value);
-            break;
-        case WebCore::CSSValue::CSS_CUSTOM:
-            // FIXME: add support for SVGPaint and SVGColor
-            domValue = new GEN_DOMCSSValue(value);
-            break;
-    }
-
-    setDOMWrapper(value, domValue.get());
-    return domValue.releaseRef();
-}
-
-CREATE_ONLY_SELF(Counter)
-CREATE_ONLY_SELF(CSSRuleList)
-CREATE_ONLY_SELF(CSSStyleDeclaration)
-CREATE_ONLY_SELF(MediaList)
-CREATE_ONLY_SELF(Rect)
-CREATE_ONLY_SELF(StyleSheetList)
-
-
-// HTML
-
-CREATE_ONLY_SELF(HTMLCollection)
diff --git a/Source/WebKit/win/DOMEventsClasses.cpp b/Source/WebKit/win/DOMEventsClasses.cpp
index 11e14b3..9980734 100644
--- a/Source/WebKit/win/DOMEventsClasses.cpp
+++ b/Source/WebKit/win/DOMEventsClasses.cpp
@@ -28,12 +28,10 @@
 #include <initguid.h>
 #include "DOMEventsClasses.h"
 
-#pragma warning( push, 0 )
 #include <WebCore/DOMWindow.h>
 #include <WebCore/Event.h>
 #include <WebCore/KeyboardEvent.h>
 #include <WebCore/MouseEvent.h>
-#pragma warning( pop )
 
 // DOMEventListener -----------------------------------------------------------
 
diff --git a/Source/WebKit/win/DOMHTMLClasses.cpp b/Source/WebKit/win/DOMHTMLClasses.cpp
index 7fe2748..c163ec4 100644
--- a/Source/WebKit/win/DOMHTMLClasses.cpp
+++ b/Source/WebKit/win/DOMHTMLClasses.cpp
@@ -29,7 +29,6 @@
 #include "COMPtr.h"
 #include "WebFrame.h"
 
-#pragma warning(push, 0)
 #include <WebCore/BString.h>
 #include <WebCore/Document.h>
 #include <WebCore/Element.h>
@@ -47,7 +46,6 @@
 #include <WebCore/IntRect.h>
 #include <WebCore/RenderObject.h>
 #include <WebCore/RenderTextControl.h>
-#pragma warning(pop)
 
 using namespace WebCore;
 using namespace HTMLNames;
diff --git a/Source/WebKit/win/DOMHTMLClasses.h b/Source/WebKit/win/DOMHTMLClasses.h
index baeecc9..34c7951 100644
--- a/Source/WebKit/win/DOMHTMLClasses.h
+++ b/Source/WebKit/win/DOMHTMLClasses.h
@@ -28,9 +28,7 @@
 
 #include "WebKit.h"
 #include "DOMCoreClasses.h"
-#include "WebScriptObject.h"
-
-#include <WTF/RefPtr.h>
+#include <wtf/RefPtr.h>
 
 namespace WebCore {
     class HTMLCollection;
diff --git a/Source/WebKit/win/DefaultDownloadDelegate.cpp b/Source/WebKit/win/DefaultDownloadDelegate.cpp
index 29da6a4..d9cc71c 100644
--- a/Source/WebKit/win/DefaultDownloadDelegate.cpp
+++ b/Source/WebKit/win/DefaultDownloadDelegate.cpp
@@ -30,14 +30,13 @@
 #include "WebKit.h"
 #include "WebKitLogging.h"
 #include "WebMutableURLRequest.h"
+#include <WebCore/COMPtr.h>
 #include <wtf/text/CString.h>
 
 #include <shlobj.h>
-#include <tchar.h>
+#include <wchar.h>
 
-#pragma warning(push, 0)
 #include <WebCore/BString.h>
-#pragma warning(pop)
 
 using namespace WebCore;
 
@@ -109,7 +108,7 @@ HRESULT STDMETHODCALLTYPE DefaultDownloadDelegate::decideDestinationWithSuggeste
 {
     LOG(Download, "DefaultDownloadDelegate %p - decideDestinationWithSuggestedFilename %s", download, String(filename, SysStringLen(filename)).ascii().data());
 
-    TCHAR pathChars[MAX_PATH];
+    WCHAR pathChars[MAX_PATH];
     if (FAILED(SHGetFolderPath(0, CSIDL_DESKTOPDIRECTORY  | CSIDL_FLAG_CREATE, 0, 0, pathChars))) {
         if (FAILED(download->setDestination(filename, true))) {
             LOG_ERROR("Failed to set destination on file");
@@ -118,14 +117,14 @@ HRESULT STDMETHODCALLTYPE DefaultDownloadDelegate::decideDestinationWithSuggeste
         return S_OK;
     }
 
-    size_t fullLength = _tcslen(pathChars) + SysStringLen(filename) + 2;
+    size_t fullLength = wcslen(pathChars) + SysStringLen(filename) + 2;
     BSTR full = SysAllocStringLen(0, (UINT)fullLength);
     if (!full)
         return E_OUTOFMEMORY;
 
-    _tcscpy_s(full, fullLength, pathChars);
-    _tcscat_s(full, fullLength, _T("\\"));
-    _tcscat_s(full, fullLength, filename);
+    wcscpy_s(full, fullLength, pathChars);
+    wcscat_s(full, fullLength, L"\\");
+    wcscat_s(full, fullLength, filename);
     BString fullPath;
     fullPath.adoptBSTR(full);
 
diff --git a/Source/WebKit/win/DefaultDownloadDelegate.h b/Source/WebKit/win/DefaultDownloadDelegate.h
index b8fb8a7..b670381 100644
--- a/Source/WebKit/win/DefaultDownloadDelegate.h
+++ b/Source/WebKit/win/DefaultDownloadDelegate.h
@@ -25,7 +25,6 @@
 #ifndef DefaultDownloadDelegate_h
 #define DefaultDownloadDelegate_h
 
-#include "COMPtr.h"
 #include "WebKit.h"
 #include <wtf/HashSet.h>
 
diff --git a/Source/WebKit/win/DefaultPolicyDelegate.cpp b/Source/WebKit/win/DefaultPolicyDelegate.cpp
index 67fc556..02d7bdb 100644
--- a/Source/WebKit/win/DefaultPolicyDelegate.cpp
+++ b/Source/WebKit/win/DefaultPolicyDelegate.cpp
@@ -27,11 +27,8 @@
 #include "WebKitDLL.h"
 #include "DefaultPolicyDelegate.h"
 
-#include "WebKit.h"
-
-#pragma warning(push, 0)
+#include <WebCore/COMPtr.h>
 #include <WebCore/PlatformString.h>
-#pragma warning(pop)
 
 using namespace WebCore;
 
diff --git a/Source/WebKit/win/DefaultPolicyDelegate.h b/Source/WebKit/win/DefaultPolicyDelegate.h
index 443cf8a..f894b38 100644
--- a/Source/WebKit/win/DefaultPolicyDelegate.h
+++ b/Source/WebKit/win/DefaultPolicyDelegate.h
@@ -26,7 +26,6 @@
 #ifndef DefaultPolicyDelegate_h
 #define DefaultPolicyDelegate_h
 
-#include "COMPtr.h"
 #include "WebKit.h"
 
 class DefaultPolicyDelegate : public IWebPolicyDelegate {
diff --git a/Source/WebKit/win/MarshallingHelpers.cpp b/Source/WebKit/win/MarshallingHelpers.cpp
index 0cec6de..b29804e 100644
--- a/Source/WebKit/win/MarshallingHelpers.cpp
+++ b/Source/WebKit/win/MarshallingHelpers.cpp
@@ -28,11 +28,9 @@
 #include "MarshallingHelpers.h"
 #include "MathExtras.h"
 
-#pragma warning(push, 0)
 #include <WebCore/IntRect.h>
 #include <WebCore/KURL.h>
 #include <WebCore/PlatformString.h>
-#pragma warning(pop)
 
 using namespace WebCore;
 
diff --git a/Source/WebKit/win/WebActionPropertyBag.cpp b/Source/WebKit/win/WebActionPropertyBag.cpp
index c2b9e10..b20da91 100644
--- a/Source/WebKit/win/WebActionPropertyBag.cpp
+++ b/Source/WebKit/win/WebActionPropertyBag.cpp
@@ -31,13 +31,10 @@
 #include "DOMCoreClasses.h"
 #include "WebElementPropertyBag.h"
 #include "WebKit.h"
-
-#pragma warning(push, 0)
 #include <WebCore/BString.h>
 #include <WebCore/EventHandler.h>
-#include <WebCore/MouseEvent.h>
 #include <WebCore/HitTestResult.h>
-#pragma warning(pop)
+#include <WebCore/MouseEvent.h>
 
 using namespace WebCore;
 
diff --git a/Source/WebKit/win/WebActionPropertyBag.h b/Source/WebKit/win/WebActionPropertyBag.h
index 56f8f52..a32e9c5 100644
--- a/Source/WebKit/win/WebActionPropertyBag.h
+++ b/Source/WebKit/win/WebActionPropertyBag.h
@@ -27,12 +27,9 @@
 #define WebActionPropertyBag_h
 
 #include "ocidl.h"
-
-#pragma warning(push, 0)
 #include <WebCore/Frame.h>
 #include <WebCore/HTMLFormElement.h>
 #include <WebCore/NavigationAction.h>
-#pragma warning(pop)
 
 class WebActionPropertyBag : public IPropertyBag {
 public:
diff --git a/Source/WebKit/win/WebCache.cpp b/Source/WebKit/win/WebCache.cpp
index c7d0f31..dab1bcd 100644
--- a/Source/WebKit/win/WebCache.cpp
+++ b/Source/WebKit/win/WebCache.cpp
@@ -28,12 +28,9 @@
 #include "WebCache.h"
 
 #include "CFDictionaryPropertyBag.h"
-
-#pragma warning(push, 0)
 #include <WebCore/ApplicationCacheStorage.h>
 #include <WebCore/MemoryCache.h>
 #include <WebCore/CrossOriginPreflightResultCache.h>
-#pragma warning(pop)
 
 // WebCache ---------------------------------------------------------------------------
 
diff --git a/Source/WebKit/win/WebCoreStatistics.cpp b/Source/WebKit/win/WebCoreStatistics.cpp
index 7a9b126..0e30576 100644
--- a/Source/WebKit/win/WebCoreStatistics.cpp
+++ b/Source/WebKit/win/WebCoreStatistics.cpp
@@ -33,6 +33,7 @@
 #include <WebCore/GlyphPageTreeNode.h>
 #include <WebCore/IconDatabase.h>
 #include <WebCore/JSDOMWindow.h>
+#include <WebCore/SharedBuffer.h>
 
 using namespace JSC;
 using namespace WebCore;
diff --git a/Source/WebKit/win/WebCoreSupport/EmbeddedWidget.h b/Source/WebKit/win/WebCoreSupport/EmbeddedWidget.h
index ccd3451..abfe76e 100644
--- a/Source/WebKit/win/WebCoreSupport/EmbeddedWidget.h
+++ b/Source/WebKit/win/WebCoreSupport/EmbeddedWidget.h
@@ -26,6 +26,7 @@
 #ifndef EmbeddedWidget_h
 #define EmbeddedWidget_h
 
+#include "WebKit.h"
 #include <WebCore/COMPtr.h>
 #include <WebCore/IntRect.h>
 #include <WebCore/PluginView.h>
diff --git a/Source/WebKit/win/WebCoreSupport/WebChromeClient.cpp b/Source/WebKit/win/WebCoreSupport/WebChromeClient.cpp
index 65537f4..1935c5f 100644
--- a/Source/WebKit/win/WebCoreSupport/WebChromeClient.cpp
+++ b/Source/WebKit/win/WebCoreSupport/WebChromeClient.cpp
@@ -56,7 +56,7 @@
 #include <WebCore/PopupMenuWin.h>
 #include <WebCore/SearchPopupMenuWin.h>
 #include <WebCore/WindowFeatures.h>
-#include <tchar.h>
+#include <wchar.h>
 
 #if USE(ACCELERATED_COMPOSITING)
 #include <WebCore/GraphicsLayer.h>
@@ -591,8 +591,8 @@ void WebChromeClient::exceededDatabaseQuota(Frame* frame, const String& database
             uiDelegatePrivate->exceededDatabaseQuota(m_webView, kit(frame), origin.get(), BString(databaseIdentifier));
         else {
             // FIXME: remove this workaround once shipping Safari has the necessary delegate implemented.
-            TCHAR path[MAX_PATH];
-            HMODULE safariHandle = GetModuleHandle(TEXT("Safari.exe"));
+            WCHAR path[MAX_PATH];
+            HMODULE safariHandle = GetModuleHandleW(L"Safari.exe");
             if (!safariHandle)
                 return;
             GetModuleFileName(safariHandle, path, WTF_ARRAY_LENGTH(path));
@@ -606,9 +606,9 @@ void WebChromeClient::exceededDatabaseQuota(Frame* frame, const String& database
 
             LPCTSTR productVersion;
             UINT productVersionLength;
-            if (!VerQueryValue(data.data(), TEXT("\\StringFileInfo\\040904b0\\ProductVersion"), (void**)&productVersion, &productVersionLength))
+            if (!VerQueryValueW(data.data(), L"\\StringFileInfo\\040904b0\\ProductVersion", (void**)&productVersion, &productVersionLength))
                 return;
-            if (_tcsncmp(TEXT("3.1"), productVersion, productVersionLength) > 0) {
+            if (wcsncmp(L"3.1", productVersion, productVersionLength) > 0) {
                 const unsigned long long defaultQuota = 5 * 1024 * 1024; // 5 megabytes should hopefully be enough to test storage support.
                 origin->setQuota(defaultQuota);
             }
@@ -738,7 +738,7 @@ void WebChromeClient::runOpenPanel(Frame*, PassRefPtr<FileChooser> prpFileChoose
         return;
 
     bool multiFile = fileChooser->allowsMultipleFiles();
-    Vector<TCHAR> fileBuf(multiFile ? maxFilePathsListSize : MAX_PATH);
+    Vector<WCHAR> fileBuf(multiFile ? maxFilePathsListSize : MAX_PATH);
 
     OPENFILENAME ofn;
 
@@ -750,7 +750,7 @@ void WebChromeClient::runOpenPanel(Frame*, PassRefPtr<FileChooser> prpFileChoose
     ofn.lStructSize = sizeof(ofn);
     ofn.hwndOwner = viewWindow;
     String allFiles = allFilesText();
-    allFiles.append(TEXT("\0*.*\0\0"), 6);
+    allFiles.append(L"\0*.*\0\0", 6);
     ofn.lpstrFilter = allFiles.charactersWithNullTermination();
     ofn.lpstrFile = fileBuf.data();
     ofn.nMaxFile = fileBuf.size();
@@ -761,7 +761,7 @@ void WebChromeClient::runOpenPanel(Frame*, PassRefPtr<FileChooser> prpFileChoose
         ofn.Flags = ofn.Flags | OFN_ALLOWMULTISELECT;
 
     if (GetOpenFileName(&ofn)) {
-        TCHAR* files = fileBuf.data();
+        WCHAR* files = fileBuf.data();
         Vector<String> fileList;
         String file(files);
         if (multiFile) {
@@ -769,7 +769,7 @@ void WebChromeClient::runOpenPanel(Frame*, PassRefPtr<FileChooser> prpFileChoose
                 // When using the OFN_EXPLORER flag, the file list is null delimited.
                 // When you create a String from a ptr to this list, it will use strlen to look for the null character.
                 // Then we find the next file path string by using the length of the string we just created.
-                TCHAR* nextFilePtr = files + file.length() + 1;
+                WCHAR* nextFilePtr = files + file.length() + 1;
                 String nextFile(nextFilePtr);
                 // If multiple files are selected, there will be a directory name first, which we don't want to add to the vector.
                 // We know a single file was selected if there is only one filename in the list.  
diff --git a/Source/WebKit/win/WebCoreSupport/WebContextMenuClient.cpp b/Source/WebKit/win/WebCoreSupport/WebContextMenuClient.cpp
index 9405fc8..80690c7 100644
--- a/Source/WebKit/win/WebCoreSupport/WebContextMenuClient.cpp
+++ b/Source/WebKit/win/WebCoreSupport/WebContextMenuClient.cpp
@@ -41,8 +41,6 @@
 #include <WebCore/ResourceRequest.h>
 #include <WebCore/NotImplemented.h>
 
-#include <tchar.h>
-
 using namespace WebCore;
 
 WebContextMenuClient::WebContextMenuClient(WebView* webView)
diff --git a/Source/WebKit/win/WebCoreSupport/WebDragClient.cpp b/Source/WebKit/win/WebCoreSupport/WebDragClient.cpp
index c232867..5abcf6b 100644
--- a/Source/WebKit/win/WebCoreSupport/WebDragClient.cpp
+++ b/Source/WebKit/win/WebCoreSupport/WebDragClient.cpp
@@ -31,14 +31,12 @@
 
 #include <shlobj.h>
 
-#pragma warning(push, 0) 
 #include <WebCore/ClipboardWin.h>
 #include <WebCore/DragController.h>
 #include <WebCore/DragData.h>
 #include <WebCore/FrameView.h>
 #include <WebCore/GraphicsContext.h>
 #include <WebCore/Page.h>
-#pragma warning(pop) 
 
 using namespace WebCore;
 
diff --git a/Source/WebKit/win/WebCoreSupport/WebEditorClient.cpp b/Source/WebKit/win/WebCoreSupport/WebEditorClient.cpp
index 9f08087..1105904 100644
--- a/Source/WebKit/win/WebCoreSupport/WebEditorClient.cpp
+++ b/Source/WebKit/win/WebCoreSupport/WebEditorClient.cpp
@@ -33,7 +33,6 @@
 #include "WebNotificationCenter.h"
 #include "WebView.h"
 #include "DOMCoreClasses.h"
-#pragma warning(push, 0)
 #include <WebCore/BString.h>
 #include <WebCore/Document.h>
 #include <WebCore/EditCommand.h>
@@ -45,7 +44,6 @@
 #include <WebCore/PlatformKeyboardEvent.h>
 #include <WebCore/Range.h>
 #include <WebCore/UserTypingGestureIndicator.h>
-#pragma warning(pop)
 
 using namespace WebCore;
 using namespace HTMLNames;
diff --git a/Source/WebKit/win/WebCoreSupport/WebEditorClient.h b/Source/WebKit/win/WebCoreSupport/WebEditorClient.h
index 18be400..1d0a7d0 100644
--- a/Source/WebKit/win/WebCoreSupport/WebEditorClient.h
+++ b/Source/WebKit/win/WebCoreSupport/WebEditorClient.h
@@ -27,11 +27,9 @@
 #define WebEditorClient_H
 
 #include "WebKit.h"
-#pragma warning(push, 0)
 #include <WebCore/EditorClient.h>
 #include <WebCore/TextCheckerClient.h>
 #include <wtf/OwnPtr.h>
-#pragma warning(pop)
 
 class WebView;
 class WebNotification;
diff --git a/Source/WebKit/win/WebCoreSupport/WebFrameLoaderClient.cpp b/Source/WebKit/win/WebCoreSupport/WebFrameLoaderClient.cpp
index 03041a6..10a3190 100644
--- a/Source/WebKit/win/WebCoreSupport/WebFrameLoaderClient.cpp
+++ b/Source/WebKit/win/WebCoreSupport/WebFrameLoaderClient.cpp
@@ -49,7 +49,6 @@
 #include "WebURLAuthenticationChallenge.h"
 #include "WebURLResponse.h"
 #include "WebView.h"
-#pragma warning(push, 0)
 #include <WebCore/BackForwardController.h>
 #include <WebCore/CachedFrame.h>
 #include <WebCore/DocumentLoader.h>
@@ -69,7 +68,6 @@
 #include <WebCore/RenderPart.h>
 #include <WebCore/ResourceHandle.h>
 #include <WebCore/Settings.h>
-#pragma warning(pop)
 
 using namespace WebCore;
 using namespace HTMLNames;
diff --git a/Source/WebKit/win/WebCoreSupport/WebFrameLoaderClient.h b/Source/WebKit/win/WebCoreSupport/WebFrameLoaderClient.h
index 57de2ad..d864b23 100644
--- a/Source/WebKit/win/WebCoreSupport/WebFrameLoaderClient.h
+++ b/Source/WebKit/win/WebCoreSupport/WebFrameLoaderClient.h
@@ -29,9 +29,7 @@
 #ifndef WebFrameLoaderClient_h
 #define WebFrameLoaderClient_h
 
-#pragma warning(push, 0)
 #include <WebCore/FrameLoaderClient.h>
-#pragma warning(pop)
 
 namespace WebCore {
     class PluginManualLoader;
@@ -40,6 +38,7 @@ namespace WebCore {
 
 template <typename T> class COMPtr;
 class WebFrame;
+class WebHistory;
 
 class WebFrameLoaderClient : public WebCore::FrameLoaderClient {
 public:
diff --git a/Source/WebKit/win/WebCoreSupport/WebInspectorClient.cpp b/Source/WebKit/win/WebCoreSupport/WebInspectorClient.cpp
index 2922485..a93765d 100644
--- a/Source/WebKit/win/WebCoreSupport/WebInspectorClient.cpp
+++ b/Source/WebKit/win/WebCoreSupport/WebInspectorClient.cpp
@@ -35,7 +35,6 @@
 #include "WebNodeHighlight.h"
 #include "WebView.h"
 
-#pragma warning(push, 0)
 #include <WebCore/BString.h>
 #include <WebCore/Element.h>
 #include <WebCore/FloatRect.h>
@@ -45,9 +44,8 @@
 #include <WebCore/Page.h>
 #include <WebCore/RenderObject.h>
 #include <WebCore/WindowMessageBroadcaster.h>
-#pragma warning(pop)
 
-#include <tchar.h>
+#include <wchar.h>
 #include <wtf/RetainPtr.h>
 #include <wtf/text/StringConcatenate.h>
 
@@ -322,6 +320,16 @@ void WebInspectorFrontendClient::inspectedURLChanged(const String& newURL)
     updateWindowTitle();
 }
 
+void WebInspectorFrontendClient::saveSessionSetting(const String& key, const String& value)
+{
+    m_inspectorClient->saveSessionSetting(key, value);
+}
+
+void WebInspectorFrontendClient::loadSessionSetting(const String& key, String* value)
+{
+    m_inspectorClient->loadSessionSetting(key, value);
+}
+
 void WebInspectorFrontendClient::closeWindowWithoutNotifications()
 {
     if (!m_frontendHwnd)
diff --git a/Source/WebKit/win/WebCoreSupport/WebInspectorClient.h b/Source/WebKit/win/WebCoreSupport/WebInspectorClient.h
index a059559..e5ddbd5 100644
--- a/Source/WebKit/win/WebCoreSupport/WebInspectorClient.h
+++ b/Source/WebKit/win/WebCoreSupport/WebInspectorClient.h
@@ -35,7 +35,9 @@
 #include <WebCore/PlatformString.h>
 #include <WebCore/WindowMessageListener.h>
 #include <wtf/Forward.h>
+#include <wtf/HashMap.h>
 #include <wtf/OwnPtr.h>
+#include <wtf/text/StringHash.h>
 #include <windows.h>
 
 namespace WebCore {
@@ -73,6 +75,9 @@ public:
         releaseFrontendPage();
     }
 
+    void saveSessionSetting(const WTF::String& key, const WTF::String& value);
+    void loadSessionSetting(const WTF::String& key, WTF::String* value);
+
 private:
     ~WebInspectorClient();
     WTF::PassOwnPtr<WebCore::InspectorFrontendClientLocal::Settings> createFrontendSettings();
@@ -83,6 +88,8 @@ private:
     HWND m_frontendHwnd;
 
     OwnPtr<WebNodeHighlight> m_highlight;
+
+    WTF::HashMap<WTF::String, WTF::String> m_sessionSettings;
 };
 
 class WebInspectorFrontendClient : public WebCore::InspectorFrontendClientLocal, WebCore::WindowMessageListener {
@@ -104,6 +111,9 @@ public:
     virtual void setAttachedWindowHeight(unsigned height);
     virtual void inspectedURLChanged(const WTF::String& newURL);
 
+    virtual void saveSessionSetting(const WTF::String& key, const WTF::String& value);
+    virtual void loadSessionSetting(const WTF::String& key, WTF::String* value);
+
 private:
     ~WebInspectorFrontendClient();
 
diff --git a/Source/WebKit/win/WebCoreSupport/WebInspectorDelegate.h b/Source/WebKit/win/WebCoreSupport/WebInspectorDelegate.h
index 7561d5a..dce935a 100644
--- a/Source/WebKit/win/WebCoreSupport/WebInspectorDelegate.h
+++ b/Source/WebKit/win/WebCoreSupport/WebInspectorDelegate.h
@@ -1,336 +1,330 @@
-/*

- * Copyright (C) 2008 Matt Lilek <webkit@mattlilek.com>

- *

- * Redistribution and use in source and binary forms, with or without

- * modification, are permitted provided that the following conditions

- * are met:

- *

- * 1.  Redistributions of source code must retain the above copyright

- *     notice, this list of conditions and the following disclaimer. 

- * 2.  Redistributions in binary form must reproduce the above copyright

- *     notice, this list of conditions and the following disclaimer in the

- *     documentation and/or other materials provided with the distribution. 

- * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of

- *     its contributors may be used to endorse or promote products derived

- *     from this software without specific prior written permission. 

- *

- * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY

- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED

- * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE

- * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY

- * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES

- * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;

- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND

- * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT

- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF

- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

- */

-

-#ifndef WebInspectorDelegate_h

-#define WebInspectorDelegate_h

-

-struct IDataObject;

-struct IPropertyBag;

-struct IWebView;

-struct IWebFrame;

-struct IWebError;

-struct IWebURLRequest;

-struct IWebOpenPanelResultListener;

-

-class WebInspectorDelegate : public IWebUIDelegate {

-public:

-    static WebInspectorDelegate* createInstance();

-

-    // IUnknown

-    virtual ULONG STDMETHODCALLTYPE AddRef();

-    virtual ULONG STDMETHODCALLTYPE Release();

-    virtual HRESULT STDMETHODCALLTYPE QueryInterface(REFIID, void**) { return E_NOTIMPL; };

-

-    // IWebUIDelegate

-    virtual HRESULT STDMETHODCALLTYPE dragDestinationActionMaskForDraggingInfo( 

-        /* [in] */ IWebView*,

-        /* [in] */ IDataObject*,

-        /* [retval][out] */ WebDragDestinationAction* action);

-

-    // Not implemented

-    virtual HRESULT STDMETHODCALLTYPE createWebViewWithRequest( 

-        /* [in] */ IWebView*,

-        /* [in] */ IWebURLRequest*,

-        /* [retval][out] */ IWebView**) { return E_NOTIMPL; }

-

-    virtual HRESULT STDMETHODCALLTYPE webViewShow( 

-        /* [in] */ IWebView*) { return E_NOTIMPL; }

-

-    virtual HRESULT STDMETHODCALLTYPE webViewClose( 

-        /* [in] */ IWebView*) { return E_NOTIMPL; }

-

-    virtual HRESULT STDMETHODCALLTYPE webViewFocus( 

-        /* [in] */ IWebView*) { return E_NOTIMPL; }

-

-    virtual HRESULT STDMETHODCALLTYPE webViewUnfocus( 

-        /* [in] */ IWebView*) { return E_NOTIMPL; }

-

-    virtual HRESULT STDMETHODCALLTYPE webViewFirstResponder( 

-        /* [in] */ IWebView*,

-        /* [retval][out] */ OLE_HANDLE*) { return E_NOTIMPL; }

-

-    virtual HRESULT STDMETHODCALLTYPE makeFirstResponder( 

-        /* [in] */ IWebView*,

-        /* [in] */ OLE_HANDLE) { return E_NOTIMPL; }

-

-    virtual HRESULT STDMETHODCALLTYPE setStatusText( 

-        /* [in] */ IWebView*,

-        /* [in] */ BSTR) { return E_NOTIMPL; }

-

-    virtual HRESULT STDMETHODCALLTYPE webViewStatusText( 

-        /* [in] */ IWebView*,

-        /* [retval][out] */ BSTR*) { return E_NOTIMPL; }

-

-    virtual HRESULT STDMETHODCALLTYPE webViewAreToolbarsVisible( 

-        /* [in] */ IWebView*,

-        /* [retval][out] */ BOOL*) { return E_NOTIMPL; }

-

-    virtual HRESULT STDMETHODCALLTYPE setToolbarsVisible( 

-        /* [in] */ IWebView*,

-        /* [in] */ BOOL) { return E_NOTIMPL; }

-

-    virtual HRESULT STDMETHODCALLTYPE webViewIsStatusBarVisible( 

-        /* [in] */ IWebView*,

-        /* [retval][out] */ BOOL*) { return E_NOTIMPL; }

-

-    virtual HRESULT STDMETHODCALLTYPE setStatusBarVisible( 

-        /* [in] */ IWebView*,

-        /* [in] */ BOOL) { return E_NOTIMPL; }

-

-    virtual HRESULT STDMETHODCALLTYPE webViewIsResizable( 

-        /* [in] */ IWebView*,

-        /* [retval][out] */ BOOL*) { return E_NOTIMPL; }

-

-    virtual HRESULT STDMETHODCALLTYPE setResizable( 

-        /* [in] */ IWebView*,

-        /* [in] */ BOOL) { return E_NOTIMPL; }

-

-    virtual HRESULT STDMETHODCALLTYPE setFrame( 

-        /* [in] */ IWebView*,

-        /* [in] */ RECT*) { return E_NOTIMPL; }

-

-    virtual HRESULT STDMETHODCALLTYPE webViewFrame( 

-        /* [in] */ IWebView*,

-        /* [retval][out] */ RECT*) { return E_NOTIMPL; }

-

-    virtual HRESULT STDMETHODCALLTYPE setContentRect( 

-        /* [in] */ IWebView*,

-        /* [in] */ RECT*) { return E_NOTIMPL; }

-

-    virtual HRESULT STDMETHODCALLTYPE webViewContentRect( 

-        /* [in] */ IWebView*,

-        /* [retval][out] */ RECT*) { return E_NOTIMPL; }

-

-    virtual HRESULT STDMETHODCALLTYPE runJavaScriptAlertPanelWithMessage( 

-        /* [in] */ IWebView*,

-        /* [in] */ BSTR) { return E_NOTIMPL; }

-

-    virtual HRESULT STDMETHODCALLTYPE runJavaScriptConfirmPanelWithMessage( 

-        /* [in] */ IWebView*,

-        /* [in] */ BSTR,

-        /* [retval][out] */ BOOL*) { return E_NOTIMPL; }

-

-    virtual HRESULT STDMETHODCALLTYPE runJavaScriptTextInputPanelWithPrompt( 

-        /* [in] */ IWebView*,

-        /* [in] */ BSTR /*message*/,

-        /* [in] */ BSTR /*defaultText*/,

-        /* [retval][out] */ BSTR*) { return E_NOTIMPL; }

-

-    virtual HRESULT STDMETHODCALLTYPE runBeforeUnloadConfirmPanelWithMessage( 

-        /* [in] */ IWebView*,

-        /* [in] */ BSTR /*message*/,

-        /* [in] */ IWebFrame*  /*initiatedByFrame*/,

-        /* [retval][out] */ BOOL*) { return E_NOTIMPL; }

-

-    virtual HRESULT STDMETHODCALLTYPE runOpenPanelForFileButtonWithResultListener( 

-        /* [in] */ IWebView*,

-        /* [in] */ IWebOpenPanelResultListener*) { return E_NOTIMPL; }

-

-    virtual HRESULT STDMETHODCALLTYPE mouseDidMoveOverElement( 

-        /* [in] */ IWebView*,

-        /* [in] */ IPropertyBag*,

-        /* [in] */ UINT /*modifierFlags*/) { return E_NOTIMPL; }

-

-    virtual HRESULT STDMETHODCALLTYPE contextMenuItemsForElement( 

-        /* [in] */ IWebView*,

-        /* [in] */ IPropertyBag*,

-        /* [in] */ OLE_HANDLE,

-        /* [retval][out] */ OLE_HANDLE*) { return E_NOTIMPL; }

-

-    virtual HRESULT STDMETHODCALLTYPE validateUserInterfaceItem( 

-        /* [in] */ IWebView*,

-        /* [in] */ UINT,

-        /* [in] */ BOOL,

-        /* [retval][out] */ BOOL*) { return E_NOTIMPL; }

-

-    virtual HRESULT STDMETHODCALLTYPE shouldPerformAction( 

-        /* [in] */ IWebView*,

-        /* [in] */ UINT /*itemCommandID*/,

-        /* [in] */ UINT /*sender*/) { return E_NOTIMPL; }

-

-    virtual HRESULT STDMETHODCALLTYPE willPerformDragDestinationAction( 

-        /* [in] */ IWebView*,

-        /* [in] */ WebDragDestinationAction,

-        /* [in] */ IDataObject*) { return E_NOTIMPL; }

-

-    virtual HRESULT STDMETHODCALLTYPE dragSourceActionMaskForPoint( 

-        /* [in] */ IWebView*,

-        /* [in] */ LPPOINT,

-        /* [retval][out] */ WebDragSourceAction*) { return E_NOTIMPL; }

-

-    virtual HRESULT STDMETHODCALLTYPE willPerformDragSourceAction( 

-        /* [in] */ IWebView*,

-        /* [in] */ WebDragSourceAction,

-        /* [in] */ LPPOINT,

-        /* [in] */ IDataObject*,

-        /* [retval][out] */ IDataObject**) { return E_NOTIMPL; }

-

-    virtual HRESULT STDMETHODCALLTYPE contextMenuItemSelected( 

-        /* [in] */ IWebView*,

-        /* [in] */ void*  /*item*/,

-        /* [in] */ IPropertyBag*) { return E_NOTIMPL; }

-

-    virtual HRESULT STDMETHODCALLTYPE hasCustomMenuImplementation( 

-        /* [retval][out] */ BOOL*) { return E_NOTIMPL; }

-

-    virtual HRESULT STDMETHODCALLTYPE trackCustomPopupMenu( 

-        /* [in] */ IWebView*,

-        /* [in] */ OLE_HANDLE,

-        /* [in] */ LPPOINT) { return E_NOTIMPL; }

-

-    virtual HRESULT STDMETHODCALLTYPE measureCustomMenuItem( 

-        /* [in] */ IWebView*,

-        /* [in] */ void*  /*measureItem*/) { return E_NOTIMPL; }

-

-    virtual HRESULT STDMETHODCALLTYPE drawCustomMenuItem( 

-        /* [in] */ IWebView*,

-        /* [in] */ void*  /*drawItem*/) { return E_NOTIMPL; }

-

-    virtual HRESULT STDMETHODCALLTYPE addCustomMenuDrawingData( 

-        /* [in] */ IWebView*,

-        /* [in] */ OLE_HANDLE) { return E_NOTIMPL; }

-

-    virtual HRESULT STDMETHODCALLTYPE cleanUpCustomMenuDrawingData( 

-        /* [in] */ IWebView*,

-        /* [in] */ OLE_HANDLE) { return E_NOTIMPL; }

-

-    virtual HRESULT STDMETHODCALLTYPE canTakeFocus( 

-        /* [in] */ IWebView*,

-        /* [in] */ BOOL /*forward*/,

-        /* [out] */ BOOL*) { return E_NOTIMPL; }

-

-    virtual HRESULT STDMETHODCALLTYPE takeFocus( 

-        /* [in] */ IWebView*,

-        /* [in] */ BOOL /*forward*/) { return E_NOTIMPL; }

-

-    virtual HRESULT STDMETHODCALLTYPE registerUndoWithTarget( 

-        /* [in] */ IWebUndoTarget*,

-        /* [in] */ BSTR /*actionName*/,

-        /* [in] */ IUnknown*  /*actionArg*/) { return E_NOTIMPL; }

-

-    virtual HRESULT STDMETHODCALLTYPE removeAllActionsWithTarget( 

-        /* [in] */ IWebUndoTarget*) { return E_NOTIMPL; }

-

-    virtual HRESULT STDMETHODCALLTYPE setActionTitle( 

-        /* [in] */ BSTR) { return E_NOTIMPL; }

-

-    virtual HRESULT STDMETHODCALLTYPE undo() { return E_NOTIMPL; }

-

-    virtual HRESULT STDMETHODCALLTYPE redo() { return E_NOTIMPL; }

-

-    virtual HRESULT STDMETHODCALLTYPE canUndo( 

-        /* [retval][out] */ BOOL*) { return E_NOTIMPL; }

-

-    virtual HRESULT STDMETHODCALLTYPE canRedo( 

-        /* [retval][out] */ BOOL*) { return E_NOTIMPL; }

-

-    virtual HRESULT STDMETHODCALLTYPE printFrame( 

-        /* [in] */ IWebView *webView,

-        /* [in] */ IWebFrame *frame) { return E_NOTIMPL; }

-    

-    virtual HRESULT STDMETHODCALLTYPE ftpDirectoryTemplatePath( 

-        /* [in] */ IWebView *webView,

-        /* [retval][out] */ BSTR *path) { return E_NOTIMPL; }

-    

-    virtual HRESULT STDMETHODCALLTYPE webViewHeaderHeight( 

-        /* [in] */ IWebView *webView,

-        /* [retval][out] */ float *result) { return E_NOTIMPL; }

-    

-    virtual HRESULT STDMETHODCALLTYPE webViewFooterHeight( 

-        /* [in] */ IWebView *webView,

-        /* [retval][out] */ float *result) { return E_NOTIMPL; }

-    

-    virtual HRESULT STDMETHODCALLTYPE drawHeaderInRect( 

-        /* [in] */ IWebView *webView,

-        /* [in] */ RECT *rect,

-        /* [in] */ OLE_HANDLE drawingContext) { return E_NOTIMPL; }

-    

-    virtual HRESULT STDMETHODCALLTYPE drawFooterInRect( 

-        /* [in] */ IWebView *webView,

-        /* [in] */ RECT *rect,

-        /* [in] */ OLE_HANDLE drawingContext,

-        /* [in] */ UINT pageIndex,

-        /* [in] */ UINT pageCount) { return E_NOTIMPL; }

-    

-    virtual HRESULT STDMETHODCALLTYPE webViewPrintingMarginRect( 

-        /* [in] */ IWebView *webView,

-        /* [retval][out] */ RECT *rect) { return E_NOTIMPL; }

-    

-    virtual HRESULT STDMETHODCALLTYPE canRunModal( 

-        /* [in] */ IWebView *webView,

-        /* [retval][out] */ BOOL *canRunBoolean) { return E_NOTIMPL; }

-    

-    virtual HRESULT STDMETHODCALLTYPE createModalDialog( 

-        /* [in] */ IWebView *sender,

-        /* [in] */ IWebURLRequest *request,

-        /* [retval][out] */ IWebView **newWebView) { return E_NOTIMPL; }

-    

-    virtual HRESULT STDMETHODCALLTYPE runModal( 

-        /* [in] */ IWebView *webView) { return E_NOTIMPL; }

-    

-    virtual HRESULT STDMETHODCALLTYPE isMenuBarVisible( 

-        /* [in] */ IWebView *webView,

-        /* [retval][out] */ BOOL *visible) { return E_NOTIMPL; }

-    

-    virtual HRESULT STDMETHODCALLTYPE setMenuBarVisible( 

-        /* [in] */ IWebView *webView,

-        /* [in] */ BOOL visible) { return E_NOTIMPL; }

-    

-    virtual HRESULT STDMETHODCALLTYPE runDatabaseSizeLimitPrompt( 

-        /* [in] */ IWebView *webView,

-        /* [in] */ BSTR displayName,

-        /* [in] */ IWebFrame *initiatedByFrame,

-        /* [retval][out] */ BOOL *allowed) { return E_NOTIMPL; }

-    

-    virtual HRESULT STDMETHODCALLTYPE paintCustomScrollbar( 

-        /* [in] */ IWebView *webView,

-        /* [in] */ HDC hDC,

-        /* [in] */ RECT rect,

-        /* [in] */ WebScrollBarControlSize size,

-        /* [in] */ WebScrollbarControlState state,

-        /* [in] */ WebScrollbarControlPart pressedPart,

-        /* [in] */ BOOL vertical,

-        /* [in] */ float value,

-        /* [in] */ float proportion,

-        /* [in] */ WebScrollbarControlPartMask parts) { return E_NOTIMPL; }

-    

-    virtual HRESULT STDMETHODCALLTYPE paintCustomScrollCorner( 

-        /* [in] */ IWebView *webView,

-        /* [in] */ HDC hDC,

-        /* [in] */ RECT rect) { return E_NOTIMPL; }

-

-    virtual HRESULT STDMETHODCALLTYPE desktopNotificationsDelegate(

-        /* [retval][out] */ IWebDesktopNotificationsDelegate **result) { return E_NOTIMPL; }

-

-private:

-    WebInspectorDelegate();

-

-    ULONG m_refCount;

-};

-

-#endif // WebInspectorDelegate_h

+/*
+ * Copyright (C) 2008 Matt Lilek <webkit@mattlilek.com>
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer. 
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution. 
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission. 
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebInspectorDelegate_h
+#define WebInspectorDelegate_h
+
+#include "WebKit.h"
+
+class WebInspectorDelegate : public IWebUIDelegate {
+public:
+    static WebInspectorDelegate* createInstance();
+
+    // IUnknown
+    virtual ULONG STDMETHODCALLTYPE AddRef();
+    virtual ULONG STDMETHODCALLTYPE Release();
+    virtual HRESULT STDMETHODCALLTYPE QueryInterface(REFIID, void**) { return E_NOTIMPL; };
+
+    // IWebUIDelegate
+    virtual HRESULT STDMETHODCALLTYPE dragDestinationActionMaskForDraggingInfo( 
+        /* [in] */ IWebView*,
+        /* [in] */ IDataObject*,
+        /* [retval][out] */ WebDragDestinationAction* action);
+
+    // Not implemented
+    virtual HRESULT STDMETHODCALLTYPE createWebViewWithRequest( 
+        /* [in] */ IWebView*,
+        /* [in] */ IWebURLRequest*,
+        /* [retval][out] */ IWebView**) { return E_NOTIMPL; }
+
+    virtual HRESULT STDMETHODCALLTYPE webViewShow( 
+        /* [in] */ IWebView*) { return E_NOTIMPL; }
+
+    virtual HRESULT STDMETHODCALLTYPE webViewClose( 
+        /* [in] */ IWebView*) { return E_NOTIMPL; }
+
+    virtual HRESULT STDMETHODCALLTYPE webViewFocus( 
+        /* [in] */ IWebView*) { return E_NOTIMPL; }
+
+    virtual HRESULT STDMETHODCALLTYPE webViewUnfocus( 
+        /* [in] */ IWebView*) { return E_NOTIMPL; }
+
+    virtual HRESULT STDMETHODCALLTYPE webViewFirstResponder( 
+        /* [in] */ IWebView*,
+        /* [retval][out] */ OLE_HANDLE*) { return E_NOTIMPL; }
+
+    virtual HRESULT STDMETHODCALLTYPE makeFirstResponder( 
+        /* [in] */ IWebView*,
+        /* [in] */ OLE_HANDLE) { return E_NOTIMPL; }
+
+    virtual HRESULT STDMETHODCALLTYPE setStatusText( 
+        /* [in] */ IWebView*,
+        /* [in] */ BSTR) { return E_NOTIMPL; }
+
+    virtual HRESULT STDMETHODCALLTYPE webViewStatusText( 
+        /* [in] */ IWebView*,
+        /* [retval][out] */ BSTR*) { return E_NOTIMPL; }
+
+    virtual HRESULT STDMETHODCALLTYPE webViewAreToolbarsVisible( 
+        /* [in] */ IWebView*,
+        /* [retval][out] */ BOOL*) { return E_NOTIMPL; }
+
+    virtual HRESULT STDMETHODCALLTYPE setToolbarsVisible( 
+        /* [in] */ IWebView*,
+        /* [in] */ BOOL) { return E_NOTIMPL; }
+
+    virtual HRESULT STDMETHODCALLTYPE webViewIsStatusBarVisible( 
+        /* [in] */ IWebView*,
+        /* [retval][out] */ BOOL*) { return E_NOTIMPL; }
+
+    virtual HRESULT STDMETHODCALLTYPE setStatusBarVisible( 
+        /* [in] */ IWebView*,
+        /* [in] */ BOOL) { return E_NOTIMPL; }
+
+    virtual HRESULT STDMETHODCALLTYPE webViewIsResizable( 
+        /* [in] */ IWebView*,
+        /* [retval][out] */ BOOL*) { return E_NOTIMPL; }
+
+    virtual HRESULT STDMETHODCALLTYPE setResizable( 
+        /* [in] */ IWebView*,
+        /* [in] */ BOOL) { return E_NOTIMPL; }
+
+    virtual HRESULT STDMETHODCALLTYPE setFrame( 
+        /* [in] */ IWebView*,
+        /* [in] */ RECT*) { return E_NOTIMPL; }
+
+    virtual HRESULT STDMETHODCALLTYPE webViewFrame( 
+        /* [in] */ IWebView*,
+        /* [retval][out] */ RECT*) { return E_NOTIMPL; }
+
+    virtual HRESULT STDMETHODCALLTYPE setContentRect( 
+        /* [in] */ IWebView*,
+        /* [in] */ RECT*) { return E_NOTIMPL; }
+
+    virtual HRESULT STDMETHODCALLTYPE webViewContentRect( 
+        /* [in] */ IWebView*,
+        /* [retval][out] */ RECT*) { return E_NOTIMPL; }
+
+    virtual HRESULT STDMETHODCALLTYPE runJavaScriptAlertPanelWithMessage( 
+        /* [in] */ IWebView*,
+        /* [in] */ BSTR) { return E_NOTIMPL; }
+
+    virtual HRESULT STDMETHODCALLTYPE runJavaScriptConfirmPanelWithMessage( 
+        /* [in] */ IWebView*,
+        /* [in] */ BSTR,
+        /* [retval][out] */ BOOL*) { return E_NOTIMPL; }
+
+    virtual HRESULT STDMETHODCALLTYPE runJavaScriptTextInputPanelWithPrompt( 
+        /* [in] */ IWebView*,
+        /* [in] */ BSTR /*message*/,
+        /* [in] */ BSTR /*defaultText*/,
+        /* [retval][out] */ BSTR*) { return E_NOTIMPL; }
+
+    virtual HRESULT STDMETHODCALLTYPE runBeforeUnloadConfirmPanelWithMessage( 
+        /* [in] */ IWebView*,
+        /* [in] */ BSTR /*message*/,
+        /* [in] */ IWebFrame*  /*initiatedByFrame*/,
+        /* [retval][out] */ BOOL*) { return E_NOTIMPL; }
+
+    virtual HRESULT STDMETHODCALLTYPE runOpenPanelForFileButtonWithResultListener( 
+        /* [in] */ IWebView*,
+        /* [in] */ IWebOpenPanelResultListener*) { return E_NOTIMPL; }
+
+    virtual HRESULT STDMETHODCALLTYPE mouseDidMoveOverElement( 
+        /* [in] */ IWebView*,
+        /* [in] */ IPropertyBag*,
+        /* [in] */ UINT /*modifierFlags*/) { return E_NOTIMPL; }
+
+    virtual HRESULT STDMETHODCALLTYPE contextMenuItemsForElement( 
+        /* [in] */ IWebView*,
+        /* [in] */ IPropertyBag*,
+        /* [in] */ OLE_HANDLE,
+        /* [retval][out] */ OLE_HANDLE*) { return E_NOTIMPL; }
+
+    virtual HRESULT STDMETHODCALLTYPE validateUserInterfaceItem( 
+        /* [in] */ IWebView*,
+        /* [in] */ UINT,
+        /* [in] */ BOOL,
+        /* [retval][out] */ BOOL*) { return E_NOTIMPL; }
+
+    virtual HRESULT STDMETHODCALLTYPE shouldPerformAction( 
+        /* [in] */ IWebView*,
+        /* [in] */ UINT /*itemCommandID*/,
+        /* [in] */ UINT /*sender*/) { return E_NOTIMPL; }
+
+    virtual HRESULT STDMETHODCALLTYPE willPerformDragDestinationAction( 
+        /* [in] */ IWebView*,
+        /* [in] */ WebDragDestinationAction,
+        /* [in] */ IDataObject*) { return E_NOTIMPL; }
+
+    virtual HRESULT STDMETHODCALLTYPE dragSourceActionMaskForPoint( 
+        /* [in] */ IWebView*,
+        /* [in] */ LPPOINT,
+        /* [retval][out] */ WebDragSourceAction*) { return E_NOTIMPL; }
+
+    virtual HRESULT STDMETHODCALLTYPE willPerformDragSourceAction( 
+        /* [in] */ IWebView*,
+        /* [in] */ WebDragSourceAction,
+        /* [in] */ LPPOINT,
+        /* [in] */ IDataObject*,
+        /* [retval][out] */ IDataObject**) { return E_NOTIMPL; }
+
+    virtual HRESULT STDMETHODCALLTYPE contextMenuItemSelected( 
+        /* [in] */ IWebView*,
+        /* [in] */ void*  /*item*/,
+        /* [in] */ IPropertyBag*) { return E_NOTIMPL; }
+
+    virtual HRESULT STDMETHODCALLTYPE hasCustomMenuImplementation( 
+        /* [retval][out] */ BOOL*) { return E_NOTIMPL; }
+
+    virtual HRESULT STDMETHODCALLTYPE trackCustomPopupMenu( 
+        /* [in] */ IWebView*,
+        /* [in] */ OLE_HANDLE,
+        /* [in] */ LPPOINT) { return E_NOTIMPL; }
+
+    virtual HRESULT STDMETHODCALLTYPE measureCustomMenuItem( 
+        /* [in] */ IWebView*,
+        /* [in] */ void*  /*measureItem*/) { return E_NOTIMPL; }
+
+    virtual HRESULT STDMETHODCALLTYPE drawCustomMenuItem( 
+        /* [in] */ IWebView*,
+        /* [in] */ void*  /*drawItem*/) { return E_NOTIMPL; }
+
+    virtual HRESULT STDMETHODCALLTYPE addCustomMenuDrawingData( 
+        /* [in] */ IWebView*,
+        /* [in] */ OLE_HANDLE) { return E_NOTIMPL; }
+
+    virtual HRESULT STDMETHODCALLTYPE cleanUpCustomMenuDrawingData( 
+        /* [in] */ IWebView*,
+        /* [in] */ OLE_HANDLE) { return E_NOTIMPL; }
+
+    virtual HRESULT STDMETHODCALLTYPE canTakeFocus( 
+        /* [in] */ IWebView*,
+        /* [in] */ BOOL /*forward*/,
+        /* [out] */ BOOL*) { return E_NOTIMPL; }
+
+    virtual HRESULT STDMETHODCALLTYPE takeFocus( 
+        /* [in] */ IWebView*,
+        /* [in] */ BOOL /*forward*/) { return E_NOTIMPL; }
+
+    virtual HRESULT STDMETHODCALLTYPE registerUndoWithTarget( 
+        /* [in] */ IWebUndoTarget*,
+        /* [in] */ BSTR /*actionName*/,
+        /* [in] */ IUnknown*  /*actionArg*/) { return E_NOTIMPL; }
+
+    virtual HRESULT STDMETHODCALLTYPE removeAllActionsWithTarget( 
+        /* [in] */ IWebUndoTarget*) { return E_NOTIMPL; }
+
+    virtual HRESULT STDMETHODCALLTYPE setActionTitle( 
+        /* [in] */ BSTR) { return E_NOTIMPL; }
+
+    virtual HRESULT STDMETHODCALLTYPE undo() { return E_NOTIMPL; }
+
+    virtual HRESULT STDMETHODCALLTYPE redo() { return E_NOTIMPL; }
+
+    virtual HRESULT STDMETHODCALLTYPE canUndo( 
+        /* [retval][out] */ BOOL*) { return E_NOTIMPL; }
+
+    virtual HRESULT STDMETHODCALLTYPE canRedo( 
+        /* [retval][out] */ BOOL*) { return E_NOTIMPL; }
+
+    virtual HRESULT STDMETHODCALLTYPE printFrame( 
+        /* [in] */ IWebView *webView,
+        /* [in] */ IWebFrame *frame) { return E_NOTIMPL; }
+    
+    virtual HRESULT STDMETHODCALLTYPE ftpDirectoryTemplatePath( 
+        /* [in] */ IWebView *webView,
+        /* [retval][out] */ BSTR *path) { return E_NOTIMPL; }
+    
+    virtual HRESULT STDMETHODCALLTYPE webViewHeaderHeight( 
+        /* [in] */ IWebView *webView,
+        /* [retval][out] */ float *result) { return E_NOTIMPL; }
+    
+    virtual HRESULT STDMETHODCALLTYPE webViewFooterHeight( 
+        /* [in] */ IWebView *webView,
+        /* [retval][out] */ float *result) { return E_NOTIMPL; }
+    
+    virtual HRESULT STDMETHODCALLTYPE drawHeaderInRect( 
+        /* [in] */ IWebView *webView,
+        /* [in] */ RECT *rect,
+        /* [in] */ OLE_HANDLE drawingContext) { return E_NOTIMPL; }
+    
+    virtual HRESULT STDMETHODCALLTYPE drawFooterInRect( 
+        /* [in] */ IWebView *webView,
+        /* [in] */ RECT *rect,
+        /* [in] */ OLE_HANDLE drawingContext,
+        /* [in] */ UINT pageIndex,
+        /* [in] */ UINT pageCount) { return E_NOTIMPL; }
+    
+    virtual HRESULT STDMETHODCALLTYPE webViewPrintingMarginRect( 
+        /* [in] */ IWebView *webView,
+        /* [retval][out] */ RECT *rect) { return E_NOTIMPL; }
+    
+    virtual HRESULT STDMETHODCALLTYPE canRunModal( 
+        /* [in] */ IWebView *webView,
+        /* [retval][out] */ BOOL *canRunBoolean) { return E_NOTIMPL; }
+    
+    virtual HRESULT STDMETHODCALLTYPE createModalDialog( 
+        /* [in] */ IWebView *sender,
+        /* [in] */ IWebURLRequest *request,
+        /* [retval][out] */ IWebView **newWebView) { return E_NOTIMPL; }
+    
+    virtual HRESULT STDMETHODCALLTYPE runModal( 
+        /* [in] */ IWebView *webView) { return E_NOTIMPL; }
+    
+    virtual HRESULT STDMETHODCALLTYPE isMenuBarVisible( 
+        /* [in] */ IWebView *webView,
+        /* [retval][out] */ BOOL *visible) { return E_NOTIMPL; }
+    
+    virtual HRESULT STDMETHODCALLTYPE setMenuBarVisible( 
+        /* [in] */ IWebView *webView,
+        /* [in] */ BOOL visible) { return E_NOTIMPL; }
+    
+    virtual HRESULT STDMETHODCALLTYPE runDatabaseSizeLimitPrompt( 
+        /* [in] */ IWebView *webView,
+        /* [in] */ BSTR displayName,
+        /* [in] */ IWebFrame *initiatedByFrame,
+        /* [retval][out] */ BOOL *allowed) { return E_NOTIMPL; }
+    
+    virtual HRESULT STDMETHODCALLTYPE paintCustomScrollbar( 
+        /* [in] */ IWebView *webView,
+        /* [in] */ HDC hDC,
+        /* [in] */ RECT rect,
+        /* [in] */ WebScrollBarControlSize size,
+        /* [in] */ WebScrollbarControlState state,
+        /* [in] */ WebScrollbarControlPart pressedPart,
+        /* [in] */ BOOL vertical,
+        /* [in] */ float value,
+        /* [in] */ float proportion,
+        /* [in] */ WebScrollbarControlPartMask parts) { return E_NOTIMPL; }
+    
+    virtual HRESULT STDMETHODCALLTYPE paintCustomScrollCorner( 
+        /* [in] */ IWebView *webView,
+        /* [in] */ HDC hDC,
+        /* [in] */ RECT rect) { return E_NOTIMPL; }
+
+    virtual HRESULT STDMETHODCALLTYPE desktopNotificationsDelegate(
+        /* [retval][out] */ IWebDesktopNotificationsDelegate **result) { return E_NOTIMPL; }
+
+private:
+    WebInspectorDelegate();
+
+    ULONG m_refCount;
+};
+
+#endif // WebInspectorDelegate_h
diff --git a/Source/WebKit/win/WebCoreSupport/WebPlatformStrategies.cpp b/Source/WebKit/win/WebCoreSupport/WebPlatformStrategies.cpp
index 9f5b20e..e87777e 100644
--- a/Source/WebKit/win/WebCoreSupport/WebPlatformStrategies.cpp
+++ b/Source/WebKit/win/WebCoreSupport/WebPlatformStrategies.cpp
@@ -285,7 +285,7 @@ String WebPlatformStrategies::contextMenuItemTagSearchWeb()
     return UI_STRING("Search with Google", "Search in Google context menu item");
 }
 
-String WebPlatformStrategies::contextMenuItemTagLookUpInDictionary()
+String WebPlatformStrategies::contextMenuItemTagLookUpInDictionary(const String&)
 {
     return UI_STRING("Look Up in Dictionary", "Look Up in Dictionary context menu item");
 }
diff --git a/Source/WebKit/win/WebCoreSupport/WebPlatformStrategies.h b/Source/WebKit/win/WebCoreSupport/WebPlatformStrategies.h
index 4e5bb18..6d2949d 100644
--- a/Source/WebKit/win/WebCoreSupport/WebPlatformStrategies.h
+++ b/Source/WebKit/win/WebCoreSupport/WebPlatformStrategies.h
@@ -79,7 +79,7 @@ private:
     virtual WTF::String contextMenuItemTagIgnoreSpelling();
     virtual WTF::String contextMenuItemTagLearnSpelling();
     virtual WTF::String contextMenuItemTagSearchWeb();
-    virtual WTF::String contextMenuItemTagLookUpInDictionary();
+    virtual WTF::String contextMenuItemTagLookUpInDictionary(const WTF::String&);
     virtual WTF::String contextMenuItemTagOpenLink();
     virtual WTF::String contextMenuItemTagIgnoreGrammar();
     virtual WTF::String contextMenuItemTagSpellingMenu();
diff --git a/Source/WebKit/win/WebDataSource.h b/Source/WebKit/win/WebDataSource.h
index 3baa024..992e9dd 100644
--- a/Source/WebKit/win/WebDataSource.h
+++ b/Source/WebKit/win/WebDataSource.h
@@ -27,8 +27,8 @@
 #define WebDataSource_H
 
 #include "WebKit.h"
-#include "COMPtr.h"
-#include <WTF/RefPtr.h>
+#include <WebCore/COMPtr.h>
+#include <wtf/RefPtr.h>
 
 class WebDocumentLoader;
 class WebMutableURLRequest;
diff --git a/Source/WebKit/win/WebDatabaseManager.h b/Source/WebKit/win/WebDatabaseManager.h
index a8ca523..b52cbd5 100644
--- a/Source/WebKit/win/WebDatabaseManager.h
+++ b/Source/WebKit/win/WebDatabaseManager.h
@@ -31,9 +31,8 @@
 
 #if ENABLE(DATABASE)
 
-#include <WebCore/DatabaseTrackerClient.h>
-
 #include "WebKit.h"
+#include <WebCore/DatabaseTrackerClient.h>
 
 class WebDatabaseManager : public IWebDatabaseManager, private WebCore::DatabaseTrackerClient {
 public:
diff --git a/Source/WebKit/win/WebDocumentLoader.h b/Source/WebKit/win/WebDocumentLoader.h
index ad0544e..93b2a86 100644
--- a/Source/WebKit/win/WebDocumentLoader.h
+++ b/Source/WebKit/win/WebDocumentLoader.h
@@ -24,10 +24,7 @@
  */
 
 #include "WebDataSource.h"
-
-#pragma warning(push, 0)
 #include <WebCore/DocumentLoader.h>
-#pragma warning(pop)
 
 using namespace WebCore;
 
diff --git a/Source/WebKit/win/WebDownload.cpp b/Source/WebKit/win/WebDownload.cpp
index 45e36cc..cb5e2c3 100644
--- a/Source/WebKit/win/WebDownload.cpp
+++ b/Source/WebKit/win/WebDownload.cpp
@@ -38,7 +38,6 @@
 #include "WebURLResponse.h"
 #include <wtf/text/CString.h>
 
-#pragma warning(push, 0)
 #include <WebCore/BString.h>
 #include <WebCore/DownloadBundle.h>
 #include <WebCore/NotImplemented.h>
@@ -48,7 +47,6 @@
 #include <WebCore/ResourceResponse.h>
 #include <wtf/CurrentTime.h>
 #include <wtf/StdLibExtras.h>
-#pragma warning(pop)
 
 using namespace WebCore;
 
diff --git a/Source/WebKit/win/WebDownloadCFNet.cpp b/Source/WebKit/win/WebDownloadCFNet.cpp
index 5a1f1bc..7398a2a 100644
--- a/Source/WebKit/win/WebDownloadCFNet.cpp
+++ b/Source/WebKit/win/WebDownloadCFNet.cpp
@@ -44,7 +44,6 @@
 #include <sys/stat.h>
 #include <sys/types.h>
 
-#pragma warning(push, 0)
 #include <WebCore/AuthenticationCF.h>
 #include <WebCore/BString.h>
 #include <WebCore/CredentialStorage.h>
@@ -55,7 +54,6 @@
 #include <WebCore/ResourceRequest.h>
 #include <WebCore/ResourceResponse.h>
 #include <wtf/CurrentTime.h>
-#pragma warning(pop)
 
 using namespace WebCore;
 
diff --git a/Source/WebKit/win/WebDownloadCurl.cpp b/Source/WebKit/win/WebDownloadCurl.cpp
index 2025922..5eab2bb 100644
--- a/Source/WebKit/win/WebDownloadCurl.cpp
+++ b/Source/WebKit/win/WebDownloadCurl.cpp
@@ -44,7 +44,6 @@
 #include <sys/stat.h>
 #include <sys/types.h>
 
-#pragma warning(push, 0)
 #include <WebCore/BString.h>
 #include <WebCore/NotImplemented.h>
 #include <WebCore/ResourceError.h>
@@ -52,7 +51,6 @@
 #include <WebCore/ResourceRequest.h>
 #include <WebCore/ResourceResponse.h>
 #include <WebCore/SystemTime.h>
-#pragma warning(pop)
 
 using namespace WebCore;
 
diff --git a/Source/WebKit/win/WebElementPropertyBag.cpp b/Source/WebKit/win/WebElementPropertyBag.cpp
index e68360c..4ca0a71 100644
--- a/Source/WebKit/win/WebElementPropertyBag.cpp
+++ b/Source/WebKit/win/WebElementPropertyBag.cpp
@@ -30,7 +30,6 @@
 #include "MarshallingHelpers.h"
 #include "DOMCoreClasses.h"
 #include "WebFrame.h"
-#pragma warning(push, 0)
 #include <WebCore/Document.h>
 #include <WebCore/Frame.h>
 #include <WebCore/HitTestResult.h>
@@ -38,7 +37,6 @@
 #include <WebCore/Image.h>
 #include <WebCore/KURL.h>
 #include <WebCore/RenderObject.h>
-#pragma warning(pop)
 
 using namespace WebCore;
 
diff --git a/Source/WebKit/win/WebElementPropertyBag.h b/Source/WebKit/win/WebElementPropertyBag.h
index 3d96a65..7c2a565 100644
--- a/Source/WebKit/win/WebElementPropertyBag.h
+++ b/Source/WebKit/win/WebElementPropertyBag.h
@@ -26,9 +26,8 @@
 #ifndef WebElementPropertyBag_H
 #define WebElementPropertyBag_H
 
-#include "ocidl.h"
-
-#include <WTF/OwnPtr.h>
+#include <ocidl.h>
+#include <wtf/OwnPtr.h>
 
 namespace WebCore {
     class HitTestResult;
diff --git a/Source/WebKit/win/WebError.cpp b/Source/WebKit/win/WebError.cpp
index c9f1dff..16006ff 100644
--- a/Source/WebKit/win/WebError.cpp
+++ b/Source/WebKit/win/WebError.cpp
@@ -28,9 +28,7 @@
 #include "WebError.h"
 #include "WebKit.h"
 
-#pragma warning(push, 0)
 #include <WebCore/BString.h>
-#pragma warning(pop)
 
 #if USE(CFNETWORK)
 #include <WebKitSystemInterface/WebKitSystemInterface.h>
@@ -227,7 +225,7 @@ HRESULT STDMETHODCALLTYPE WebError::sslPeerCertificate(
     if (!m_cfErrorUserInfoDict)
         return E_FAIL;
 
-    void* data = wkGetSSLPeerCertificateData(m_cfErrorUserInfoDict.get());
+    void* data = wkGetSSLPeerCertificateDataBytePtr(m_cfErrorUserInfoDict.get());
     if (!data)
         return E_FAIL;
     *result = (OLE_HANDLE)(ULONG64)data;
diff --git a/Source/WebKit/win/WebError.h b/Source/WebKit/win/WebError.h
index ff0625d..0e78cf2 100644
--- a/Source/WebKit/win/WebError.h
+++ b/Source/WebKit/win/WebError.h
@@ -27,12 +27,8 @@
 #define WebError_h
 
 #include "WebKit.h"
-
-#pragma warning(push, 0)
 #include <WebCore/COMPtr.h>
 #include <WebCore/ResourceError.h>
-#pragma warning(pop)
-
 #include <wtf/RetainPtr.h>
 
 class WebError : public IWebError, IWebErrorPrivate {
diff --git a/Source/WebKit/win/WebFrame.cpp b/Source/WebKit/win/WebFrame.cpp
index e412543..4b9e35d 100644
--- a/Source/WebKit/win/WebFrame.cpp
+++ b/Source/WebKit/win/WebFrame.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2006, 2007, 2008, 2009, 2011 Apple Inc. All rights reserved.
  * Copyright (C) Research In Motion Limited 2009. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -53,7 +53,6 @@
 #include "WebScriptWorld.h"
 #include "WebURLResponse.h"
 #include "WebView.h"
-#pragma warning( push, 0 )
 #include <WebCore/BString.h>
 #include <WebCore/MemoryCache.h>
 #include <WebCore/Document.h>
@@ -104,11 +103,11 @@
 #include <JavaScriptCore/JSObject.h>
 #include <JavaScriptCore/JSValue.h>
 #include <wtf/MathExtras.h>
-#pragma warning(pop)
 
 #if PLATFORM(CG)
 #include <CoreGraphics/CoreGraphics.h>
 #elif PLATFORM(CAIRO)
+#include "PlatformContextCairo.h"
 #include <cairo-win32.h>
 #endif
 
@@ -1029,7 +1028,7 @@ HRESULT STDMETHODCALLTYPE WebFrame::hasSpellingMarker(
     Frame* coreFrame = core(this);
     if (!coreFrame)
         return E_FAIL;
-    *result = coreFrame->editor()->selectionStartHasSpellingMarkerFor(from, length);
+    *result = coreFrame->editor()->selectionStartHasMarkerFor(DocumentMarker::Spelling, from, length);
     return S_OK;
 }
 
@@ -1899,9 +1898,9 @@ PassRefPtr<Widget> WebFrame::createJavaAppletWidget(const IntSize& pluginSize, H
     return pluginView;
 }
 
-ObjectContentType WebFrame::objectContentType(const KURL& url, const String& mimeType)
+ObjectContentType WebFrame::objectContentType(const KURL& url, const String& mimeType, bool shouldPreferPlugInsForImages)
 {
-    return WebCore::FrameLoader::defaultObjectContentType(url, mimeType);
+    return WebCore::FrameLoader::defaultObjectContentType(url, mimeType, shouldPreferPlugInsForImages);
 }
 
 String WebFrame::overrideMediaType() const
@@ -2188,8 +2187,7 @@ static float scaleFactor(HDC printDC, const IntRect& marginRect, const IntRect&
 
 static HDC hdcFromContext(PlatformGraphicsContext* pctx)
 {
-    cairo_surface_t* surface = cairo_get_target(pctx);
-    return cairo_win32_surface_get_dc(surface);
+    return cairo_win32_surface_get_dc(cairo_get_target(pctx->cr()));
 }
 
 void WebFrame::drawHeader(PlatformGraphicsContext* pctx, IWebUIDelegate* ui, const IntRect& pageRect, float headerHeight)
@@ -2244,13 +2242,14 @@ void WebFrame::spoolPage(PlatformGraphicsContext* pctx, GraphicsContext* spoolCt
     XFORM original, scaled;
     GetWorldTransform(hdc, &original);
     
+    cairo_t* cr = pctx->cr();
     bool preview = (hdc != printDC);
     if (preview) {
         // If this is a preview, the Windows HDC was set to a non-scaled state so that Cairo will
         // draw correctly.  We need to retain the correct preview scale here for use when the Cairo
         // drawing completes so that we can scale our GDI-based header/footer calls. This is a
         // workaround for a bug in Cairo (see https://bugs.freedesktop.org/show_bug.cgi?id=28161)
-        scaled = buildXFORMFromCairo(hdc, pctx);
+        scaled = buildXFORMFromCairo(hdc, cr);
     }
 
     float scale = scaleFactor(printDC, marginRect, pageRect);
@@ -2260,13 +2259,13 @@ void WebFrame::spoolPage(PlatformGraphicsContext* pctx, GraphicsContext* spoolCt
 
     // We cannot scale the display HDC because the print surface also scales fonts,
     // resulting in invalid printing (and print preview)
-    cairo_scale(pctx, scale, scale);
-    cairo_translate(pctx, cairoMarginRect.x(), cairoMarginRect.y() + headerHeight);
+    cairo_scale(cr, scale, scale);
+    cairo_translate(cr, cairoMarginRect.x(), cairoMarginRect.y() + headerHeight);
 
     // Modify Cairo (only) to account for page position.
-    cairo_translate(pctx, -pageRect.x(), -pageRect.y());
+    cairo_translate(cr, -pageRect.x(), -pageRect.y());
     coreFrame->view()->paintContents(spoolCtx, pageRect);
-    cairo_translate(pctx, pageRect.x(), pageRect.y());
+    cairo_translate(cr, pageRect.x(), pageRect.y());
     
     if (preview) {
         // If this is a preview, the Windows HDC was set to a non-scaled state so that Cairo would
@@ -2287,8 +2286,8 @@ void WebFrame::spoolPage(PlatformGraphicsContext* pctx, GraphicsContext* spoolCt
 
     SetWorldTransform(hdc, &original);
 
-    cairo_show_page(pctx);
-    ASSERT(!cairo_status(pctx));
+    cairo_show_page(cr);
+    ASSERT(!cairo_status(cr));
     spoolCtx->restore();
 }
 
@@ -2340,17 +2339,21 @@ HRESULT STDMETHODCALLTYPE WebFrame::spoolPages(
     else
         printSurface = cairo_win32_printing_surface_create(targetDC); // metafile
     
-    PlatformGraphicsContext* pctx = (PlatformGraphicsContext*)cairo_create(printSurface);
-    if (!pctx) {
+    cairo_t* cr = cairo_create(printSurface);
+    if (!cr) {
         cairo_surface_destroy(printSurface);    
         return E_FAIL;
     }
-    
+
+    PlatformContextCairo platformContext(cr);
+    PlatformGraphicsContext* pctx = &platformContext;
+    cairo_destroy(cr);
+
     if (ctx) {
         // If this is a preview, the Windows HDC was sent with scaling information.
         // Retrieve it and reset it so that it draws properly.  This is a workaround
         // for a bug in Cairo (see https://bugs.freedesktop.org/show_bug.cgi?id=28161)
-        setCairoTransformToPreviewHDC(pctx, targetDC);
+        setCairoTransformToPreviewHDC(cr, targetDC);
     }
     
     cairo_surface_set_fallback_resolution(printSurface, 72.0, 72.0);
@@ -2394,7 +2397,6 @@ HRESULT STDMETHODCALLTYPE WebFrame::spoolPages(
         spoolPage(pctx, &spoolCtx, printDC, ui.get(), headerHeight, footerHeight, ii, pageCount);
 
 #if PLATFORM(CAIRO)
-    cairo_destroy(pctx);
     cairo_surface_finish(printSurface);
     ASSERT(!cairo_surface_status(printSurface));
     cairo_surface_destroy(printSurface);
diff --git a/Source/WebKit/win/WebFrame.h b/Source/WebKit/win/WebFrame.h
index 59c0aec..9158fb3 100644
--- a/Source/WebKit/win/WebFrame.h
+++ b/Source/WebKit/win/WebFrame.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2007 Apple Inc.  All rights reserved.
+ * Copyright (C) 2006, 2007, 2011 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -33,13 +33,11 @@
 
 #include "AccessibleDocument.h"
 
-#pragma warning(push, 0)
 #include <WebCore/FrameWin.h>
 #include <WebCore/GraphicsContext.h>
 #include <WebCore/KURL.h>
 #include <WebCore/PlatformString.h>
 #include <WebCore/ResourceHandleClient.h>
-#pragma warning(pop)
 
 #include <WTF/RefPtr.h>
 #include <WTF/HashMap.h>
@@ -64,7 +62,10 @@ typedef struct OpaqueJSValue* JSObjectRef;
 #if PLATFORM(CG)
 typedef struct CGContext PlatformGraphicsContext;
 #elif PLATFORM(CAIRO)
-typedef struct _cairo PlatformGraphicsContext;
+namespace WebCore {
+class PlatformContextCairo;
+}
+typedef class WebCore::PlatformContextCairo PlatformGraphicsContext;
 #endif
 
 class WebFrame;
@@ -341,7 +342,7 @@ public:
         
     virtual PassRefPtr<WebCore::Widget> createJavaAppletWidget(const WebCore::IntSize&, WebCore::HTMLAppletElement*, const WebCore::KURL& baseURL, const Vector<WTF::String>& paramNames, const Vector<WTF::String>& paramValues);
 
-    virtual WebCore::ObjectContentType objectContentType(const WebCore::KURL& url, const WTF::String& mimeType);
+    virtual WebCore::ObjectContentType objectContentType(const WebCore::KURL&, const WTF::String& mimeType, bool shouldPreferPlugInsForImages);
     virtual WTF::String overrideMediaType() const;
 
     virtual void dispatchDidClearWindowObjectInWorld(WebCore::DOMWrapperWorld*);
diff --git a/Source/WebKit/win/WebFramePolicyListener.cpp b/Source/WebKit/win/WebFramePolicyListener.cpp
index e82043d..4d19e1a 100644
--- a/Source/WebKit/win/WebFramePolicyListener.cpp
+++ b/Source/WebKit/win/WebFramePolicyListener.cpp
@@ -28,12 +28,9 @@
 #include "WebFramePolicyListener.h"
 
 #include "WebFrame.h"
-
-#pragma warning(push, 0)
 #include <WebCore/Frame.h>
 #include <WebCore/FrameLoader.h>
 #include <WebCore/FrameLoaderClient.h>
-#pragma warning(pop)
 
 using namespace WebCore;
 
diff --git a/Source/WebKit/win/WebFramePolicyListener.h b/Source/WebKit/win/WebFramePolicyListener.h
index 42f6d94..f1663e7 100644
--- a/Source/WebKit/win/WebFramePolicyListener.h
+++ b/Source/WebKit/win/WebFramePolicyListener.h
@@ -27,13 +27,10 @@
 #define WebFramePolicyListener_h
 
 #include "WebKit.h"
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefPtr.h>
 
-#include <WTF/PassRefPtr.h>
-#include <WTF/RefPtr.h>
-
-#pragma warning(push, 0)
 #include <WebCore/FrameLoaderTypes.h>
-#pragma warning(pop)
 
 namespace WebCore {
     class Frame;
diff --git a/Source/WebKit/win/WebGeolocationPolicyListener.h b/Source/WebKit/win/WebGeolocationPolicyListener.h
index 636c5f5..17d3d58 100644
--- a/Source/WebKit/win/WebGeolocationPolicyListener.h
+++ b/Source/WebKit/win/WebGeolocationPolicyListener.h
@@ -27,11 +27,9 @@
 #define WebGeolocationPolicyListener_h
 
 #include "WebKit.h"
-
 #include <WebCore/COMPtr.h>
-
-#include <WTF/PassRefPtr.h>
-#include <WTF/RefPtr.h>
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefPtr.h>
 
 namespace WebCore {
     class Geolocation;
diff --git a/Source/WebKit/win/WebHistory.cpp b/Source/WebKit/win/WebHistory.cpp
index 4caa554..efd6494 100644
--- a/Source/WebKit/win/WebHistory.cpp
+++ b/Source/WebKit/win/WebHistory.cpp
@@ -36,13 +36,11 @@
 #include "WebNotificationCenter.h"
 #include "WebPreferences.h"
 #include <CoreFoundation/CoreFoundation.h>
-#pragma warning( push, 0 )
 #include <WebCore/HistoryItem.h>
 #include <WebCore/HistoryPropertyList.h>
 #include <WebCore/KURL.h>
 #include <WebCore/PageGroup.h>
 #include <WebCore/SharedBuffer.h>
-#pragma warning( pop )
 #include <functional>
 #include <wtf/StdLibExtras.h>
 #include <wtf/Vector.h>
diff --git a/Source/WebKit/win/WebHistory.h b/Source/WebKit/win/WebHistory.h
index 17cd3a7..ec7a7a9 100644
--- a/Source/WebKit/win/WebHistory.h
+++ b/Source/WebKit/win/WebHistory.h
@@ -27,9 +27,8 @@
 #define WebHistory_H
 
 #include "WebKit.h"
-
-#include "COMPtr.h"
 #include <CoreFoundation/CoreFoundation.h>
+#include <WebCore/COMPtr.h>
 #include <wtf/Forward.h>
 #include <wtf/OwnArrayPtr.h>
 #include <wtf/RetainPtr.h>
diff --git a/Source/WebKit/win/WebHistoryItem.cpp b/Source/WebKit/win/WebHistoryItem.cpp
index 098eb86..031f8ab 100644
--- a/Source/WebKit/win/WebHistoryItem.cpp
+++ b/Source/WebKit/win/WebHistoryItem.cpp
@@ -31,13 +31,9 @@
 #include "COMPtr.h"
 #include "MarshallingHelpers.h"
 #include "WebKit.h"
-
-#pragma warning(push, 0)
 #include <WebCore/BString.h>
 #include <WebCore/HistoryItem.h>
 #include <WebCore/KURL.h>
-#pragma warning(pop)
-
 #include <wtf/PassOwnPtr.h>
 #include <wtf/RetainPtr.h>
 #include <wtf/text/CString.h>
diff --git a/Source/WebKit/win/WebIconDatabase.cpp b/Source/WebKit/win/WebIconDatabase.cpp
index 5ccf0b7..24e8f41 100644
--- a/Source/WebKit/win/WebIconDatabase.cpp
+++ b/Source/WebKit/win/WebIconDatabase.cpp
@@ -31,14 +31,13 @@
 #include "COMPtr.h"
 #include "WebPreferences.h"
 #include "WebNotificationCenter.h"
-#pragma warning(push, 0)
 #include <WebCore/BitmapInfo.h>
 #include <WebCore/BString.h>
 #include <WebCore/FileSystem.h>
 #include <WebCore/IconDatabase.h>
 #include <WebCore/Image.h>
 #include <WebCore/PlatformString.h>
-#pragma warning(pop)
+#include <WebCore/SharedBuffer.h>
 #include <wtf/MainThread.h>
 #include "shlobj.h"
 
@@ -97,7 +96,7 @@ void WebIconDatabase::startUpIconDatabase()
             LOG_ERROR("Failed to construct default icon database path");
     }
 
-    if (!iconDatabase().open(databasePath))
+    if (!iconDatabase().open(databasePath, WebCore::IconDatabase::defaultDatabaseFilename()))
             LOG_ERROR("Failed to open icon database path");
 }
 
@@ -172,7 +171,7 @@ HRESULT STDMETHODCALLTYPE WebIconDatabase::iconForURL(
 
     Image* icon = 0;
     if (url)
-        icon = iconDatabase().iconForPageURL(String(url, SysStringLen(url)), intSize);
+        icon = iconDatabase().synchronousIconForPageURL(String(url, SysStringLen(url)), intSize);
 
     // Make sure we check for the case of an "empty image"
     if (icon && icon->width()) {
@@ -234,7 +233,7 @@ HRESULT STDMETHODCALLTYPE WebIconDatabase::iconURLForURL(
 {
     if (!url || !iconURL)
         return E_POINTER;
-    BString iconURLBSTR(iconDatabase().iconURLForPageURL(String(url, SysStringLen(url))));
+    BString iconURLBSTR(iconDatabase().synchronousIconURLForPageURL(String(url, SysStringLen(url))));
     *iconURL = iconURLBSTR.release();
     return S_OK;
 }
@@ -272,11 +271,11 @@ HRESULT STDMETHODCALLTYPE WebIconDatabase::hasIconForURL(
 
     // Passing a size parameter of 0, 0 means we don't care about the result of the image, we just
     // want to make sure the read from disk to load the icon is kicked off.
-    iconDatabase().iconForPageURL(urlString, IntSize(0, 0));
+    iconDatabase().synchronousIconForPageURL(urlString, IntSize(0, 0));
 
     // Check to see if we have a non-empty icon URL for the page, and if we do, we have an icon for
     // the page.
-    *result = !(iconDatabase().iconURLForPageURL(urlString).isEmpty());
+    *result = !(iconDatabase().synchronousIconURLForPageURL(urlString).isEmpty());
 
     return S_OK;
 }
@@ -320,7 +319,13 @@ HBITMAP WebIconDatabase::getOrCreateDefaultIconBitmap(LPSIZE size)
 
 // IconDatabaseClient
 
-void WebIconDatabase::dispatchDidRemoveAllIcons()
+bool WebIconDatabase::performImport()
+{
+    // Windows doesn't do any old-style database importing.
+    return true;
+}
+
+void WebIconDatabase::didRemoveAllIcons()
 {
     // Queueing the empty string is a special way of saying "this queued notification is the didRemoveAllIcons notification"
     MutexLocker locker(m_notificationMutex);
@@ -328,13 +333,29 @@ void WebIconDatabase::dispatchDidRemoveAllIcons()
     scheduleNotificationDelivery();
 }
 
-void WebIconDatabase::dispatchDidAddIconForPageURL(const String& pageURL)
-{   
+void WebIconDatabase::didImportIconURLForPageURL(const WTF::String& pageURL)
+{
     MutexLocker locker(m_notificationMutex);
     m_notificationQueue.append(pageURL.threadsafeCopy());
     scheduleNotificationDelivery();
 }
 
+void WebIconDatabase::didImportIconDataForPageURL(const WTF::String& pageURL)
+{
+    // WebKit1 only has a single "icon did change" notification.
+    didImportIconURLForPageURL(pageURL);
+}
+
+void WebIconDatabase::didChangeIconForPageURL(const WTF::String& pageURL)
+{
+    // WebKit1 only has a single "icon did change" notification.
+    didImportIconURLForPageURL(pageURL);
+}
+
+void WebIconDatabase::didFinishURLImport()
+{
+}
+
 void WebIconDatabase::scheduleNotificationDelivery()
 {
     // Caller of this method must hold the m_notificationQueue lock
diff --git a/Source/WebKit/win/WebIconDatabase.h b/Source/WebKit/win/WebIconDatabase.h
index 178fff8..a895b81 100644
--- a/Source/WebKit/win/WebIconDatabase.h
+++ b/Source/WebKit/win/WebIconDatabase.h
@@ -28,12 +28,9 @@
 
 #include "WebKit.h"
 
-#pragma warning(push, 0)
 #include <WebCore/IconDatabaseClient.h>
 #include <WebCore/IntSize.h>
 #include <WebCore/IntSizeHash.h>
-#pragma warning(pop)
-
 #include <wtf/Vector.h>
 #include <wtf/Threading.h>
 
@@ -107,8 +104,12 @@ public:
         /* [retval][out] */ BOOL* result);
 
     // IconDatabaseClient
-    virtual void dispatchDidRemoveAllIcons();
-    virtual void dispatchDidAddIconForPageURL(const WTF::String&);
+    virtual bool performImport();
+    virtual void didRemoveAllIcons();
+    virtual void didImportIconURLForPageURL(const WTF::String&);
+    virtual void didImportIconDataForPageURL(const WTF::String&);
+    virtual void didChangeIconForPageURL(const WTF::String&);
+    virtual void didFinishURLImport();
 
     static BSTR iconDatabaseDidAddIconNotification();
     static BSTR iconDatabaseDidRemoveAllIconsNotification();
diff --git a/Source/WebKit/win/WebInspector.cpp b/Source/WebKit/win/WebInspector.cpp
index ec35099..976391d 100644
--- a/Source/WebKit/win/WebInspector.cpp
+++ b/Source/WebKit/win/WebInspector.cpp
@@ -31,10 +31,8 @@
 
 #include "WebKitDLL.h"
 #include "WebView.h"
-#pragma warning(push, 0)
 #include <WebCore/InspectorController.h>
 #include <WebCore/Page.h>
-#pragma warning(pop)
 #include <wtf/Assertions.h>
 
 using namespace WebCore;
diff --git a/Source/WebKit/win/WebJavaScriptCollector.cpp b/Source/WebKit/win/WebJavaScriptCollector.cpp
index 42a9da1..cb56b27 100644
--- a/Source/WebKit/win/WebJavaScriptCollector.cpp
+++ b/Source/WebKit/win/WebJavaScriptCollector.cpp
@@ -27,13 +27,11 @@
 #include "WebKitDLL.h"
 #include "WebJavaScriptCollector.h"
 
-#pragma warning(push, 0)
 #include <JavaScriptCore/Heap.h>
 #include <JavaScriptCore/JSGlobalData.h>
 #include <WebCore/GCController.h>
 #include <WebCore/JSDOMWindow.h>
 #include <runtime/JSLock.h>
-#pragma warning(pop)
 
 using namespace JSC;
 using namespace WebCore;
diff --git a/Source/WebKit/win/WebKit.vcproj/Interfaces.vcproj b/Source/WebKit/win/WebKit.vcproj/Interfaces.vcproj
index 555a477..724f98d 100644
--- a/Source/WebKit/win/WebKit.vcproj/Interfaces.vcproj
+++ b/Source/WebKit/win/WebKit.vcproj/Interfaces.vcproj
@@ -18,7 +18,7 @@
 		<Configuration
 			Name="Debug|Win32"
 			ConfigurationType="4"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;.\InterfacesCommon.vsprops"
+			InheritedPropertySheets=".\InterfacesDebug.vsprops"
 			CharacterSet="1"
 			>
 			<Tool
@@ -70,7 +70,7 @@
 		<Configuration
 			Name="Release|Win32"
 			ConfigurationType="4"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;.\InterfacesCommon.vsprops"
+			InheritedPropertySheets=".\InterfacesRelease.vsprops"
 			CharacterSet="1"
 			>
 			<Tool
@@ -120,9 +120,9 @@
 			/>
 		</Configuration>
 		<Configuration
-			Name="Release_LTCG|Win32"
+			Name="Production|Win32"
 			ConfigurationType="4"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;.\InterfacesCommon.vsprops"
+			InheritedPropertySheets=".\InterfacesProduction.vsprops"
 			CharacterSet="1"
 			WholeProgramOptimization="1"
 			>
@@ -175,7 +175,7 @@
 		<Configuration
 			Name="Debug_All|Win32"
 			ConfigurationType="4"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;.\InterfacesCommon.vsprops"
+			InheritedPropertySheets=".\InterfacesDebugAll.vsprops"
 			CharacterSet="1"
 			>
 			<Tool
@@ -227,7 +227,7 @@
 		<Configuration
 			Name="Release_Cairo_CFLite|Win32"
 			ConfigurationType="4"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefinesCairo.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\WinCairo.vsprops;.\InterfacesCommon.vsprops"
+			InheritedPropertySheets=".\InterfacesReleaseCairoCFLite.vsprops"
 			CharacterSet="1"
 			>
 			<Tool
@@ -279,7 +279,7 @@
 		<Configuration
 			Name="Debug_Cairo_CFLite|Win32"
 			ConfigurationType="4"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefinesCairo.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug_wincairo.vsprops;.\InterfacesCommon.vsprops"
+			InheritedPropertySheets=".\InterfacesDebugCairoCFLite.vsprops"
 			CharacterSet="1"
 			>
 			<Tool
@@ -352,7 +352,7 @@
 				/>
 			</FileConfiguration>
 			<FileConfiguration
-				Name="Release_LTCG|Win32"
+				Name="Production|Win32"
 				ExcludedFromBuild="true"
 				>
 				<Tool
@@ -404,7 +404,7 @@
 				/>
 			</FileConfiguration>
 			<FileConfiguration
-				Name="Release_LTCG|Win32"
+				Name="Production|Win32"
 				ExcludedFromBuild="true"
 				>
 				<Tool
@@ -456,7 +456,7 @@
 				/>
 			</FileConfiguration>
 			<FileConfiguration
-				Name="Release_LTCG|Win32"
+				Name="Production|Win32"
 				ExcludedFromBuild="true"
 				>
 				<Tool
@@ -508,7 +508,7 @@
 				/>
 			</FileConfiguration>
 			<FileConfiguration
-				Name="Release_LTCG|Win32"
+				Name="Production|Win32"
 				ExcludedFromBuild="true"
 				>
 				<Tool
@@ -560,7 +560,7 @@
 				/>
 			</FileConfiguration>
 			<FileConfiguration
-				Name="Release_LTCG|Win32"
+				Name="Production|Win32"
 				ExcludedFromBuild="true"
 				>
 				<Tool
@@ -612,7 +612,7 @@
 				/>
 			</FileConfiguration>
 			<FileConfiguration
-				Name="Release_LTCG|Win32"
+				Name="Production|Win32"
 				ExcludedFromBuild="true"
 				>
 				<Tool
@@ -664,7 +664,7 @@
 				/>
 			</FileConfiguration>
 			<FileConfiguration
-				Name="Release_LTCG|Win32"
+				Name="Production|Win32"
 				ExcludedFromBuild="true"
 				>
 				<Tool
@@ -716,7 +716,7 @@
 				/>
 			</FileConfiguration>
 			<FileConfiguration
-				Name="Release_LTCG|Win32"
+				Name="Production|Win32"
 				ExcludedFromBuild="true"
 				>
 				<Tool
@@ -768,7 +768,7 @@
 				/>
 			</FileConfiguration>
 			<FileConfiguration
-				Name="Release_LTCG|Win32"
+				Name="Production|Win32"
 				ExcludedFromBuild="true"
 				>
 				<Tool
@@ -820,7 +820,7 @@
 				/>
 			</FileConfiguration>
 			<FileConfiguration
-				Name="Release_LTCG|Win32"
+				Name="Production|Win32"
 				ExcludedFromBuild="true"
 				>
 				<Tool
@@ -872,7 +872,7 @@
 				/>
 			</FileConfiguration>
 			<FileConfiguration
-				Name="Release_LTCG|Win32"
+				Name="Production|Win32"
 				ExcludedFromBuild="true"
 				>
 				<Tool
@@ -924,7 +924,7 @@
 				/>
 			</FileConfiguration>
 			<FileConfiguration
-				Name="Release_LTCG|Win32"
+				Name="Production|Win32"
 				ExcludedFromBuild="true"
 				>
 				<Tool
@@ -976,7 +976,7 @@
 				/>
 			</FileConfiguration>
 			<FileConfiguration
-				Name="Release_LTCG|Win32"
+				Name="Production|Win32"
 				ExcludedFromBuild="true"
 				>
 				<Tool
@@ -1028,7 +1028,7 @@
 				/>
 			</FileConfiguration>
 			<FileConfiguration
-				Name="Release_LTCG|Win32"
+				Name="Production|Win32"
 				ExcludedFromBuild="true"
 				>
 				<Tool
@@ -1080,7 +1080,7 @@
 				/>
 			</FileConfiguration>
 			<FileConfiguration
-				Name="Release_LTCG|Win32"
+				Name="Production|Win32"
 				ExcludedFromBuild="true"
 				>
 				<Tool
@@ -1132,7 +1132,7 @@
 				/>
 			</FileConfiguration>
 			<FileConfiguration
-				Name="Release_LTCG|Win32"
+				Name="Production|Win32"
 				ExcludedFromBuild="true"
 				>
 				<Tool
@@ -1184,7 +1184,7 @@
 				/>
 			</FileConfiguration>
 			<FileConfiguration
-				Name="Release_LTCG|Win32"
+				Name="Production|Win32"
 				ExcludedFromBuild="true"
 				>
 				<Tool
@@ -1236,7 +1236,7 @@
 				/>
 			</FileConfiguration>
 			<FileConfiguration
-				Name="Release_LTCG|Win32"
+				Name="Production|Win32"
 				ExcludedFromBuild="true"
 				>
 				<Tool
@@ -1316,7 +1316,7 @@
 				/>
 			</FileConfiguration>
 			<FileConfiguration
-				Name="Release_LTCG|Win32"
+				Name="Production|Win32"
 				ExcludedFromBuild="true"
 				>
 				<Tool
@@ -1368,7 +1368,7 @@
 				/>
 			</FileConfiguration>
 			<FileConfiguration
-				Name="Release_LTCG|Win32"
+				Name="Production|Win32"
 				ExcludedFromBuild="true"
 				>
 				<Tool
@@ -1420,7 +1420,7 @@
 				/>
 			</FileConfiguration>
 			<FileConfiguration
-				Name="Release_LTCG|Win32"
+				Name="Production|Win32"
 				ExcludedFromBuild="true"
 				>
 				<Tool
@@ -1472,7 +1472,7 @@
 				/>
 			</FileConfiguration>
 			<FileConfiguration
-				Name="Release_LTCG|Win32"
+				Name="Production|Win32"
 				ExcludedFromBuild="true"
 				>
 				<Tool
@@ -1524,7 +1524,7 @@
 				/>
 			</FileConfiguration>
 			<FileConfiguration
-				Name="Release_LTCG|Win32"
+				Name="Production|Win32"
 				ExcludedFromBuild="true"
 				>
 				<Tool
@@ -1576,7 +1576,7 @@
 				/>
 			</FileConfiguration>
 			<FileConfiguration
-				Name="Release_LTCG|Win32"
+				Name="Production|Win32"
 				ExcludedFromBuild="true"
 				>
 				<Tool
@@ -1628,7 +1628,7 @@
 				/>
 			</FileConfiguration>
 			<FileConfiguration
-				Name="Release_LTCG|Win32"
+				Name="Production|Win32"
 				ExcludedFromBuild="true"
 				>
 				<Tool
@@ -1680,7 +1680,7 @@
 				/>
 			</FileConfiguration>
 			<FileConfiguration
-				Name="Release_LTCG|Win32"
+				Name="Production|Win32"
 				ExcludedFromBuild="true"
 				>
 				<Tool
@@ -1732,7 +1732,7 @@
 				/>
 			</FileConfiguration>
 			<FileConfiguration
-				Name="Release_LTCG|Win32"
+				Name="Production|Win32"
 				ExcludedFromBuild="true"
 				>
 				<Tool
@@ -1784,7 +1784,7 @@
 				/>
 			</FileConfiguration>
 			<FileConfiguration
-				Name="Release_LTCG|Win32"
+				Name="Production|Win32"
 				ExcludedFromBuild="true"
 				>
 				<Tool
@@ -1836,7 +1836,7 @@
 				/>
 			</FileConfiguration>
 			<FileConfiguration
-				Name="Release_LTCG|Win32"
+				Name="Production|Win32"
 				ExcludedFromBuild="true"
 				>
 				<Tool
@@ -1888,7 +1888,7 @@
 				/>
 			</FileConfiguration>
 			<FileConfiguration
-				Name="Release_LTCG|Win32"
+				Name="Production|Win32"
 				ExcludedFromBuild="true"
 				>
 				<Tool
@@ -1940,7 +1940,7 @@
 				/>
 			</FileConfiguration>
 			<FileConfiguration
-				Name="Release_LTCG|Win32"
+				Name="Production|Win32"
 				ExcludedFromBuild="true"
 				>
 				<Tool
@@ -1992,7 +1992,7 @@
 				/>
 			</FileConfiguration>
 			<FileConfiguration
-				Name="Release_LTCG|Win32"
+				Name="Production|Win32"
 				ExcludedFromBuild="true"
 				>
 				<Tool
@@ -2044,7 +2044,7 @@
 				/>
 			</FileConfiguration>
 			<FileConfiguration
-				Name="Release_LTCG|Win32"
+				Name="Production|Win32"
 				ExcludedFromBuild="true"
 				>
 				<Tool
@@ -2096,7 +2096,7 @@
 				/>
 			</FileConfiguration>
 			<FileConfiguration
-				Name="Release_LTCG|Win32"
+				Name="Production|Win32"
 				ExcludedFromBuild="true"
 				>
 				<Tool
@@ -2148,7 +2148,7 @@
 				/>
 			</FileConfiguration>
 			<FileConfiguration
-				Name="Release_LTCG|Win32"
+				Name="Production|Win32"
 				ExcludedFromBuild="true"
 				>
 				<Tool
@@ -2200,7 +2200,7 @@
 				/>
 			</FileConfiguration>
 			<FileConfiguration
-				Name="Release_LTCG|Win32"
+				Name="Production|Win32"
 				ExcludedFromBuild="true"
 				>
 				<Tool
@@ -2252,7 +2252,7 @@
 				/>
 			</FileConfiguration>
 			<FileConfiguration
-				Name="Release_LTCG|Win32"
+				Name="Production|Win32"
 				ExcludedFromBuild="true"
 				>
 				<Tool
@@ -2304,7 +2304,7 @@
 				/>
 			</FileConfiguration>
 			<FileConfiguration
-				Name="Release_LTCG|Win32"
+				Name="Production|Win32"
 				ExcludedFromBuild="true"
 				>
 				<Tool
@@ -2356,7 +2356,7 @@
 				/>
 			</FileConfiguration>
 			<FileConfiguration
-				Name="Release_LTCG|Win32"
+				Name="Production|Win32"
 				ExcludedFromBuild="true"
 				>
 				<Tool
@@ -2408,7 +2408,7 @@
 				/>
 			</FileConfiguration>
 			<FileConfiguration
-				Name="Release_LTCG|Win32"
+				Name="Production|Win32"
 				ExcludedFromBuild="true"
 				>
 				<Tool
@@ -2460,7 +2460,7 @@
 				/>
 			</FileConfiguration>
 			<FileConfiguration
-				Name="Release_LTCG|Win32"
+				Name="Production|Win32"
 				ExcludedFromBuild="true"
 				>
 				<Tool
@@ -2512,7 +2512,7 @@
 				/>
 			</FileConfiguration>
 			<FileConfiguration
-				Name="Release_LTCG|Win32"
+				Name="Production|Win32"
 				ExcludedFromBuild="true"
 				>
 				<Tool
@@ -2564,7 +2564,7 @@
 				/>
 			</FileConfiguration>
 			<FileConfiguration
-				Name="Release_LTCG|Win32"
+				Name="Production|Win32"
 				ExcludedFromBuild="true"
 				>
 				<Tool
@@ -2616,7 +2616,7 @@
 				/>
 			</FileConfiguration>
 			<FileConfiguration
-				Name="Release_LTCG|Win32"
+				Name="Production|Win32"
 				ExcludedFromBuild="true"
 				>
 				<Tool
@@ -2668,7 +2668,7 @@
 				/>
 			</FileConfiguration>
 			<FileConfiguration
-				Name="Release_LTCG|Win32"
+				Name="Production|Win32"
 				ExcludedFromBuild="true"
 				>
 				<Tool
@@ -2720,7 +2720,7 @@
 				/>
 			</FileConfiguration>
 			<FileConfiguration
-				Name="Release_LTCG|Win32"
+				Name="Production|Win32"
 				ExcludedFromBuild="true"
 				>
 				<Tool
@@ -2772,7 +2772,7 @@
 				/>
 			</FileConfiguration>
 			<FileConfiguration
-				Name="Release_LTCG|Win32"
+				Name="Production|Win32"
 				ExcludedFromBuild="true"
 				>
 				<Tool
@@ -2824,7 +2824,7 @@
 				/>
 			</FileConfiguration>
 			<FileConfiguration
-				Name="Release_LTCG|Win32"
+				Name="Production|Win32"
 				ExcludedFromBuild="true"
 				>
 				<Tool
@@ -2876,7 +2876,7 @@
 				/>
 			</FileConfiguration>
 			<FileConfiguration
-				Name="Release_LTCG|Win32"
+				Name="Production|Win32"
 				ExcludedFromBuild="true"
 				>
 				<Tool
@@ -2928,7 +2928,7 @@
 				/>
 			</FileConfiguration>
 			<FileConfiguration
-				Name="Release_LTCG|Win32"
+				Name="Production|Win32"
 				ExcludedFromBuild="true"
 				>
 				<Tool
@@ -2980,7 +2980,7 @@
 				/>
 			</FileConfiguration>
 			<FileConfiguration
-				Name="Release_LTCG|Win32"
+				Name="Production|Win32"
 				ExcludedFromBuild="true"
 				>
 				<Tool
@@ -3032,7 +3032,7 @@
 				/>
 			</FileConfiguration>
 			<FileConfiguration
-				Name="Release_LTCG|Win32"
+				Name="Production|Win32"
 				ExcludedFromBuild="true"
 				>
 				<Tool
@@ -3084,7 +3084,7 @@
 				/>
 			</FileConfiguration>
 			<FileConfiguration
-				Name="Release_LTCG|Win32"
+				Name="Production|Win32"
 				ExcludedFromBuild="true"
 				>
 				<Tool
@@ -3136,7 +3136,7 @@
 				/>
 			</FileConfiguration>
 			<FileConfiguration
-				Name="Release_LTCG|Win32"
+				Name="Production|Win32"
 				ExcludedFromBuild="true"
 				>
 				<Tool
@@ -3188,7 +3188,7 @@
 				/>
 			</FileConfiguration>
 			<FileConfiguration
-				Name="Release_LTCG|Win32"
+				Name="Production|Win32"
 				ExcludedFromBuild="true"
 				>
 				<Tool
@@ -3240,7 +3240,7 @@
 				/>
 			</FileConfiguration>
 			<FileConfiguration
-				Name="Release_LTCG|Win32"
+				Name="Production|Win32"
 				ExcludedFromBuild="true"
 				>
 				<Tool
@@ -3292,7 +3292,7 @@
 				/>
 			</FileConfiguration>
 			<FileConfiguration
-				Name="Release_LTCG|Win32"
+				Name="Production|Win32"
 				ExcludedFromBuild="true"
 				>
 				<Tool
@@ -3344,7 +3344,7 @@
 				/>
 			</FileConfiguration>
 			<FileConfiguration
-				Name="Release_LTCG|Win32"
+				Name="Production|Win32"
 				ExcludedFromBuild="true"
 				>
 				<Tool
@@ -3396,7 +3396,7 @@
 				/>
 			</FileConfiguration>
 			<FileConfiguration
-				Name="Release_LTCG|Win32"
+				Name="Production|Win32"
 				ExcludedFromBuild="true"
 				>
 				<Tool
@@ -3448,7 +3448,7 @@
 				/>
 			</FileConfiguration>
 			<FileConfiguration
-				Name="Release_LTCG|Win32"
+				Name="Production|Win32"
 				ExcludedFromBuild="true"
 				>
 				<Tool
@@ -3500,7 +3500,7 @@
 				/>
 			</FileConfiguration>
 			<FileConfiguration
-				Name="Release_LTCG|Win32"
+				Name="Production|Win32"
 				ExcludedFromBuild="true"
 				>
 				<Tool
@@ -3552,7 +3552,7 @@
 				/>
 			</FileConfiguration>
 			<FileConfiguration
-				Name="Release_LTCG|Win32"
+				Name="Production|Win32"
 				ExcludedFromBuild="true"
 				>
 				<Tool
@@ -3604,7 +3604,7 @@
 				/>
 			</FileConfiguration>
 			<FileConfiguration
-				Name="Release_LTCG|Win32"
+				Name="Production|Win32"
 				ExcludedFromBuild="true"
 				>
 				<Tool
@@ -3656,7 +3656,7 @@
 				/>
 			</FileConfiguration>
 			<FileConfiguration
-				Name="Release_LTCG|Win32"
+				Name="Production|Win32"
 				ExcludedFromBuild="true"
 				>
 				<Tool
@@ -3708,7 +3708,7 @@
 				/>
 			</FileConfiguration>
 			<FileConfiguration
-				Name="Release_LTCG|Win32"
+				Name="Production|Win32"
 				ExcludedFromBuild="true"
 				>
 				<Tool
@@ -3760,7 +3760,7 @@
 				/>
 			</FileConfiguration>
 			<FileConfiguration
-				Name="Release_LTCG|Win32"
+				Name="Production|Win32"
 				ExcludedFromBuild="true"
 				>
 				<Tool
@@ -3812,7 +3812,7 @@
 				/>
 			</FileConfiguration>
 			<FileConfiguration
-				Name="Release_LTCG|Win32"
+				Name="Production|Win32"
 				ExcludedFromBuild="true"
 				>
 				<Tool
@@ -3864,7 +3864,7 @@
 				/>
 			</FileConfiguration>
 			<FileConfiguration
-				Name="Release_LTCG|Win32"
+				Name="Production|Win32"
 				ExcludedFromBuild="true"
 				>
 				<Tool
@@ -3916,7 +3916,7 @@
 				/>
 			</FileConfiguration>
 			<FileConfiguration
-				Name="Release_LTCG|Win32"
+				Name="Production|Win32"
 				ExcludedFromBuild="true"
 				>
 				<Tool
@@ -3968,7 +3968,7 @@
 				/>
 			</FileConfiguration>
 			<FileConfiguration
-				Name="Release_LTCG|Win32"
+				Name="Production|Win32"
 				ExcludedFromBuild="true"
 				>
 				<Tool
@@ -4020,7 +4020,7 @@
 				/>
 			</FileConfiguration>
 			<FileConfiguration
-				Name="Release_LTCG|Win32"
+				Name="Production|Win32"
 				ExcludedFromBuild="true"
 				>
 				<Tool
@@ -4072,7 +4072,7 @@
 				/>
 			</FileConfiguration>
 			<FileConfiguration
-				Name="Release_LTCG|Win32"
+				Name="Production|Win32"
 				ExcludedFromBuild="true"
 				>
 				<Tool
@@ -4124,7 +4124,7 @@
 				/>
 			</FileConfiguration>
 			<FileConfiguration
-				Name="Release_LTCG|Win32"
+				Name="Production|Win32"
 				ExcludedFromBuild="true"
 				>
 				<Tool
@@ -4176,7 +4176,7 @@
 				/>
 			</FileConfiguration>
 			<FileConfiguration
-				Name="Release_LTCG|Win32"
+				Name="Production|Win32"
 				ExcludedFromBuild="true"
 				>
 				<Tool
@@ -4228,7 +4228,7 @@
 				/>
 			</FileConfiguration>
 			<FileConfiguration
-				Name="Release_LTCG|Win32"
+				Name="Production|Win32"
 				ExcludedFromBuild="true"
 				>
 				<Tool
@@ -4280,7 +4280,7 @@
 				/>
 			</FileConfiguration>
 			<FileConfiguration
-				Name="Release_LTCG|Win32"
+				Name="Production|Win32"
 				ExcludedFromBuild="true"
 				>
 				<Tool
@@ -4332,7 +4332,7 @@
 				/>
 			</FileConfiguration>
 			<FileConfiguration
-				Name="Release_LTCG|Win32"
+				Name="Production|Win32"
 				ExcludedFromBuild="true"
 				>
 				<Tool
@@ -4384,7 +4384,7 @@
 				/>
 			</FileConfiguration>
 			<FileConfiguration
-				Name="Release_LTCG|Win32"
+				Name="Production|Win32"
 				ExcludedFromBuild="true"
 				>
 				<Tool
@@ -4436,7 +4436,7 @@
 				/>
 			</FileConfiguration>
 			<FileConfiguration
-				Name="Release_LTCG|Win32"
+				Name="Production|Win32"
 				ExcludedFromBuild="true"
 				>
 				<Tool
@@ -4488,7 +4488,7 @@
 				/>
 			</FileConfiguration>
 			<FileConfiguration
-				Name="Release_LTCG|Win32"
+				Name="Production|Win32"
 				ExcludedFromBuild="true"
 				>
 				<Tool
@@ -4540,7 +4540,7 @@
 				/>
 			</FileConfiguration>
 			<FileConfiguration
-				Name="Release_LTCG|Win32"
+				Name="Production|Win32"
 				ExcludedFromBuild="true"
 				>
 				<Tool
@@ -4592,7 +4592,7 @@
 				/>
 			</FileConfiguration>
 			<FileConfiguration
-				Name="Release_LTCG|Win32"
+				Name="Production|Win32"
 				>
 				<Tool
 					Name="VCMIDLTool"
@@ -4644,7 +4644,7 @@
 				/>
 			</FileConfiguration>
 			<FileConfiguration
-				Name="Release_LTCG|Win32"
+				Name="Production|Win32"
 				ExcludedFromBuild="true"
 				>
 				<Tool
diff --git a/Source/WebKit/win/WebKit.vcproj/InterfacesDebug.vsprops b/Source/WebKit/win/WebKit.vcproj/InterfacesDebug.vsprops
new file mode 100644
index 0000000..263dcb6
--- /dev/null
+++ b/Source/WebKit/win/WebKit.vcproj/InterfacesDebug.vsprops
@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="InterfacesDebug"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;
+      .\InterfacesCommon.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Source/WebKit/win/WebKit.vcproj/InterfacesDebugAll.vsprops b/Source/WebKit/win/WebKit.vcproj/InterfacesDebugAll.vsprops
new file mode 100644
index 0000000..045b788
--- /dev/null
+++ b/Source/WebKit/win/WebKit.vcproj/InterfacesDebugAll.vsprops
@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="InterfacesDebugAll"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;
+      .\InterfacesCommon.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Source/WebKit/win/WebKit.vcproj/InterfacesDebugCairoCFLite.vsprops b/Source/WebKit/win/WebKit.vcproj/InterfacesDebugCairoCFLite.vsprops
new file mode 100644
index 0000000..36fcc5a
--- /dev/null
+++ b/Source/WebKit/win/WebKit.vcproj/InterfacesDebugCairoCFLite.vsprops
@@ -0,0 +1,13 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="InterfacesDebugCairoCFLite"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefinesCairo.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug_wincairo.vsprops;
+      .\InterfacesCommon.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Source/WebKit/win/WebKit.vcproj/InterfacesProduction.vsprops b/Source/WebKit/win/WebKit.vcproj/InterfacesProduction.vsprops
new file mode 100644
index 0000000..5e71307
--- /dev/null
+++ b/Source/WebKit/win/WebKit.vcproj/InterfacesProduction.vsprops
@@ -0,0 +1,13 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="InterfacesProduction"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\production.vsprops;
+      .\InterfacesCommon.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Source/WebKit/win/WebKit.vcproj/InterfacesRelease.vsprops b/Source/WebKit/win/WebKit.vcproj/InterfacesRelease.vsprops
new file mode 100644
index 0000000..77c4b1f
--- /dev/null
+++ b/Source/WebKit/win/WebKit.vcproj/InterfacesRelease.vsprops
@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="InterfacesRelease"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
+      .\InterfacesCommon.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Source/WebKit/win/WebKit.vcproj/InterfacesReleaseCairoCFLite.vsprops b/Source/WebKit/win/WebKit.vcproj/InterfacesReleaseCairoCFLite.vsprops
new file mode 100644
index 0000000..5e17aee
--- /dev/null
+++ b/Source/WebKit/win/WebKit.vcproj/InterfacesReleaseCairoCFLite.vsprops
@@ -0,0 +1,13 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="InterfacesReleaseCairoCFLite"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefinesCairo.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\WinCairo.vsprops;
+      .\InterfacesCommon.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Source/WebKit/win/WebKit.vcproj/WebKit.make b/Source/WebKit/win/WebKit.vcproj/WebKit.make
index b777d2f..59bd412 100755
--- a/Source/WebKit/win/WebKit.vcproj/WebKit.make
+++ b/Source/WebKit/win/WebKit.vcproj/WebKit.make
@@ -1,7 +1,7 @@
 !IF "$(BUILDSTYLE)"=="DEBUG"
 BUILDSTYLE=Debug_All
 !ELSE
-BUILDSTYLE=Release_LTCG
+BUILDSTYLE=Production
 !ENDIF
 
 install:
@@ -9,7 +9,6 @@ install:
 	set WebKitOutputDir=$(OBJROOT)
 	set ConfigurationBuildDir=$(OBJROOT)\$(BUILDSTYLE)
 	set WebKitVSPropsRedirectionDir=$(SRCROOT)\AppleInternal\tools\vsprops\OpenSource\1\2\3\4\ 
-	set PRODUCTION=1
 	devenv "WebKit.submit.sln" /rebuild $(BUILDSTYLE)
 	-xcopy "%ConfigurationBuildDir%\bin\*.exe" "$(DSTROOT)\AppleInternal\bin\" /e/v/i/h/y
 	xcopy "%ConfigurationBuildDir%\bin\*.pdb" "$(DSTROOT)\AppleInternal\bin\" /e/v/i/h/y
diff --git a/Source/WebKit/win/WebKit.vcproj/WebKit.sln b/Source/WebKit/win/WebKit.vcproj/WebKit.sln
index 3b578c5..b2b8d92 100644
--- a/Source/WebKit/win/WebKit.vcproj/WebKit.sln
+++ b/Source/WebKit/win/WebKit.vcproj/WebKit.sln
@@ -159,7 +159,7 @@ Global
 		Debug_Cairo_CFLite|Win32 = Debug_Cairo_CFLite|Win32
 		Debug|Win32 = Debug|Win32
 		Release_Cairo_CFLite|Win32 = Release_Cairo_CFLite|Win32
-		Release_LTCG|Win32 = Release_LTCG|Win32
+		Production|Win32 = Production|Win32
 		Release|Win32 = Release|Win32
 	EndGlobalSection
 	GlobalSection(ProjectConfigurationPlatforms) = postSolution
@@ -171,8 +171,8 @@ Global
 		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Debug|Win32.Build.0 = Debug|Win32
 		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Release_Cairo_CFLite|Win32.ActiveCfg = Release_Cairo_CFLite|Win32
 		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Release_Cairo_CFLite|Win32.Build.0 = Release_Cairo_CFLite|Win32
-		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Release_LTCG|Win32.ActiveCfg = Release_LTCG|Win32
-		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Release_LTCG|Win32.Build.0 = Release_LTCG|Win32
+		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Production|Win32.ActiveCfg = Production|Win32
+		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Production|Win32.Build.0 = Production|Win32
 		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Release|Win32.ActiveCfg = Release|Win32
 		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Release|Win32.Build.0 = Release|Win32
 		{1C16337B-ACF3-4D03-AA90-851C5B5EADA6}.Debug_All|Win32.ActiveCfg = Debug_All|Win32
@@ -183,8 +183,8 @@ Global
 		{1C16337B-ACF3-4D03-AA90-851C5B5EADA6}.Debug|Win32.Build.0 = Debug|Win32
 		{1C16337B-ACF3-4D03-AA90-851C5B5EADA6}.Release_Cairo_CFLite|Win32.ActiveCfg = Release_Cairo_CFLite|Win32
 		{1C16337B-ACF3-4D03-AA90-851C5B5EADA6}.Release_Cairo_CFLite|Win32.Build.0 = Release_Cairo_CFLite|Win32
-		{1C16337B-ACF3-4D03-AA90-851C5B5EADA6}.Release_LTCG|Win32.ActiveCfg = Release_LTCG|Win32
-		{1C16337B-ACF3-4D03-AA90-851C5B5EADA6}.Release_LTCG|Win32.Build.0 = Release_LTCG|Win32
+		{1C16337B-ACF3-4D03-AA90-851C5B5EADA6}.Production|Win32.ActiveCfg = Production|Win32
+		{1C16337B-ACF3-4D03-AA90-851C5B5EADA6}.Production|Win32.Build.0 = Production|Win32
 		{1C16337B-ACF3-4D03-AA90-851C5B5EADA6}.Release|Win32.ActiveCfg = Release|Win32
 		{1C16337B-ACF3-4D03-AA90-851C5B5EADA6}.Release|Win32.Build.0 = Release|Win32
 		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Debug_All|Win32.ActiveCfg = Debug_All|Win32
@@ -195,8 +195,8 @@ Global
 		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Debug|Win32.Build.0 = Debug|Win32
 		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Release_Cairo_CFLite|Win32.ActiveCfg = Release_Cairo_CFLite|Win32
 		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Release_Cairo_CFLite|Win32.Build.0 = Release_Cairo_CFLite|Win32
-		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Release_LTCG|Win32.ActiveCfg = Release_LTCG|Win32
-		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Release_LTCG|Win32.Build.0 = Release_LTCG|Win32
+		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Production|Win32.ActiveCfg = Production|Win32
+		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Production|Win32.Build.0 = Production|Win32
 		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Release|Win32.ActiveCfg = Release|Win32
 		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Release|Win32.Build.0 = Release|Win32
 		{C59E5129-B453-49B7-A52B-1E104715F76E}.Debug_All|Win32.ActiveCfg = Debug_All|Win32
@@ -207,8 +207,8 @@ Global
 		{C59E5129-B453-49B7-A52B-1E104715F76E}.Debug|Win32.Build.0 = Debug|Win32
 		{C59E5129-B453-49B7-A52B-1E104715F76E}.Release_Cairo_CFLite|Win32.ActiveCfg = Release_Cairo_CFLite|Win32
 		{C59E5129-B453-49B7-A52B-1E104715F76E}.Release_Cairo_CFLite|Win32.Build.0 = Release_Cairo_CFLite|Win32
-		{C59E5129-B453-49B7-A52B-1E104715F76E}.Release_LTCG|Win32.ActiveCfg = Release_LTCG|Win32
-		{C59E5129-B453-49B7-A52B-1E104715F76E}.Release_LTCG|Win32.Build.0 = Release_LTCG|Win32
+		{C59E5129-B453-49B7-A52B-1E104715F76E}.Production|Win32.ActiveCfg = Production|Win32
+		{C59E5129-B453-49B7-A52B-1E104715F76E}.Production|Win32.Build.0 = Production|Win32
 		{C59E5129-B453-49B7-A52B-1E104715F76E}.Release|Win32.ActiveCfg = Release|Win32
 		{C59E5129-B453-49B7-A52B-1E104715F76E}.Release|Win32.Build.0 = Release|Win32
 		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Debug_All|Win32.ActiveCfg = Debug_All|Win32
@@ -219,8 +219,8 @@ Global
 		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Debug|Win32.Build.0 = Debug|Win32
 		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Release_Cairo_CFLite|Win32.ActiveCfg = Release_Cairo_CFLite|Win32
 		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Release_Cairo_CFLite|Win32.Build.0 = Release_Cairo_CFLite|Win32
-		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Release_LTCG|Win32.ActiveCfg = Release_LTCG|Win32
-		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Release_LTCG|Win32.Build.0 = Release_LTCG|Win32
+		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Production|Win32.ActiveCfg = Production|Win32
+		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Production|Win32.Build.0 = Production|Win32
 		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Release|Win32.ActiveCfg = Release|Win32
 		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Release|Win32.Build.0 = Release|Win32
 		{0A324352-B3B6-496C-9E5B-4C7E923E628B}.Debug_All|Win32.ActiveCfg = Debug_All|Win32
@@ -231,8 +231,8 @@ Global
 		{0A324352-B3B6-496C-9E5B-4C7E923E628B}.Debug|Win32.Build.0 = Debug|Win32
 		{0A324352-B3B6-496C-9E5B-4C7E923E628B}.Release_Cairo_CFLite|Win32.ActiveCfg = Release_Cairo_CFLite|Win32
 		{0A324352-B3B6-496C-9E5B-4C7E923E628B}.Release_Cairo_CFLite|Win32.Build.0 = Release_Cairo_CFLite|Win32
-		{0A324352-B3B6-496C-9E5B-4C7E923E628B}.Release_LTCG|Win32.ActiveCfg = Release_LTCG|Win32
-		{0A324352-B3B6-496C-9E5B-4C7E923E628B}.Release_LTCG|Win32.Build.0 = Release_LTCG|Win32
+		{0A324352-B3B6-496C-9E5B-4C7E923E628B}.Production|Win32.ActiveCfg = Production|Win32
+		{0A324352-B3B6-496C-9E5B-4C7E923E628B}.Production|Win32.Build.0 = Production|Win32
 		{0A324352-B3B6-496C-9E5B-4C7E923E628B}.Release|Win32.ActiveCfg = Release|Win32
 		{0A324352-B3B6-496C-9E5B-4C7E923E628B}.Release|Win32.Build.0 = Release|Win32
 		{E498CA9D-3BD2-4D52-8E37-C8DC76526325}.Debug_All|Win32.ActiveCfg = Debug_All|Win32
@@ -241,8 +241,8 @@ Global
 		{E498CA9D-3BD2-4D52-8E37-C8DC76526325}.Debug|Win32.ActiveCfg = Debug|Win32
 		{E498CA9D-3BD2-4D52-8E37-C8DC76526325}.Debug|Win32.Build.0 = Debug|Win32
 		{E498CA9D-3BD2-4D52-8E37-C8DC76526325}.Release_Cairo_CFLite|Win32.ActiveCfg = Release_Cairo_CFLite|Win32
-		{E498CA9D-3BD2-4D52-8E37-C8DC76526325}.Release_LTCG|Win32.ActiveCfg = Release_LTCG|Win32
-		{E498CA9D-3BD2-4D52-8E37-C8DC76526325}.Release_LTCG|Win32.Build.0 = Release_LTCG|Win32
+		{E498CA9D-3BD2-4D52-8E37-C8DC76526325}.Production|Win32.ActiveCfg = Production|Win32
+		{E498CA9D-3BD2-4D52-8E37-C8DC76526325}.Production|Win32.Build.0 = Production|Win32
 		{E498CA9D-3BD2-4D52-8E37-C8DC76526325}.Release|Win32.ActiveCfg = Release|Win32
 		{E498CA9D-3BD2-4D52-8E37-C8DC76526325}.Release|Win32.Build.0 = Release|Win32
 		{1AFD081F-1AC7-4A97-8EFA-6DF97761A3A2}.Debug_All|Win32.ActiveCfg = Debug_All|Win32
@@ -253,8 +253,8 @@ Global
 		{1AFD081F-1AC7-4A97-8EFA-6DF97761A3A2}.Debug|Win32.Build.0 = Debug|Win32
 		{1AFD081F-1AC7-4A97-8EFA-6DF97761A3A2}.Release_Cairo_CFLite|Win32.ActiveCfg = Release_Cairo_CFLite|Win32
 		{1AFD081F-1AC7-4A97-8EFA-6DF97761A3A2}.Release_Cairo_CFLite|Win32.Build.0 = Release_Cairo_CFLite|Win32
-		{1AFD081F-1AC7-4A97-8EFA-6DF97761A3A2}.Release_LTCG|Win32.ActiveCfg = Release_LTCG|Win32
-		{1AFD081F-1AC7-4A97-8EFA-6DF97761A3A2}.Release_LTCG|Win32.Build.0 = Release_LTCG|Win32
+		{1AFD081F-1AC7-4A97-8EFA-6DF97761A3A2}.Production|Win32.ActiveCfg = Production|Win32
+		{1AFD081F-1AC7-4A97-8EFA-6DF97761A3A2}.Production|Win32.Build.0 = Production|Win32
 		{1AFD081F-1AC7-4A97-8EFA-6DF97761A3A2}.Release|Win32.ActiveCfg = Release|Win32
 		{1AFD081F-1AC7-4A97-8EFA-6DF97761A3A2}.Release|Win32.Build.0 = Release|Win32
 		{2E51ABE8-76CB-485B-A66C-46AEF4DF8ACD}.Debug_All|Win32.ActiveCfg = Debug_All|Win32
@@ -265,8 +265,8 @@ Global
 		{2E51ABE8-76CB-485B-A66C-46AEF4DF8ACD}.Debug|Win32.Build.0 = Debug|Win32
 		{2E51ABE8-76CB-485B-A66C-46AEF4DF8ACD}.Release_Cairo_CFLite|Win32.ActiveCfg = Release_Cairo_CFLite|Win32
 		{2E51ABE8-76CB-485B-A66C-46AEF4DF8ACD}.Release_Cairo_CFLite|Win32.Build.0 = Release_Cairo_CFLite|Win32
-		{2E51ABE8-76CB-485B-A66C-46AEF4DF8ACD}.Release_LTCG|Win32.ActiveCfg = Release_LTCG|Win32
-		{2E51ABE8-76CB-485B-A66C-46AEF4DF8ACD}.Release_LTCG|Win32.Build.0 = Release_LTCG|Win32
+		{2E51ABE8-76CB-485B-A66C-46AEF4DF8ACD}.Production|Win32.ActiveCfg = Production|Win32
+		{2E51ABE8-76CB-485B-A66C-46AEF4DF8ACD}.Production|Win32.Build.0 = Production|Win32
 		{2E51ABE8-76CB-485B-A66C-46AEF4DF8ACD}.Release|Win32.ActiveCfg = Release|Win32
 		{2E51ABE8-76CB-485B-A66C-46AEF4DF8ACD}.Release|Win32.Build.0 = Release|Win32
 		{2EDAD637-CBA8-4E55-97ED-7D2BBC336FDB}.Debug_All|Win32.ActiveCfg = Debug_All|Win32
@@ -277,8 +277,8 @@ Global
 		{2EDAD637-CBA8-4E55-97ED-7D2BBC336FDB}.Debug|Win32.Build.0 = Debug|Win32
 		{2EDAD637-CBA8-4E55-97ED-7D2BBC336FDB}.Release_Cairo_CFLite|Win32.ActiveCfg = Release_Cairo_CFLite|Win32
 		{2EDAD637-CBA8-4E55-97ED-7D2BBC336FDB}.Release_Cairo_CFLite|Win32.Build.0 = Release_Cairo_CFLite|Win32
-		{2EDAD637-CBA8-4E55-97ED-7D2BBC336FDB}.Release_LTCG|Win32.ActiveCfg = Release_LTCG|Win32
-		{2EDAD637-CBA8-4E55-97ED-7D2BBC336FDB}.Release_LTCG|Win32.Build.0 = Release_LTCG|Win32
+		{2EDAD637-CBA8-4E55-97ED-7D2BBC336FDB}.Production|Win32.ActiveCfg = Production|Win32
+		{2EDAD637-CBA8-4E55-97ED-7D2BBC336FDB}.Production|Win32.Build.0 = Production|Win32
 		{2EDAD637-CBA8-4E55-97ED-7D2BBC336FDB}.Release|Win32.ActiveCfg = Release|Win32
 		{2EDAD637-CBA8-4E55-97ED-7D2BBC336FDB}.Release|Win32.Build.0 = Release|Win32
 		{AAE88FEF-509E-4D49-870B-7357922C276F}.Debug_All|Win32.ActiveCfg = Debug_All|Win32
@@ -289,8 +289,8 @@ Global
 		{AAE88FEF-509E-4D49-870B-7357922C276F}.Debug|Win32.Build.0 = Debug|Win32
 		{AAE88FEF-509E-4D49-870B-7357922C276F}.Release_Cairo_CFLite|Win32.ActiveCfg = Release_Cairo_CFLite|Win32
 		{AAE88FEF-509E-4D49-870B-7357922C276F}.Release_Cairo_CFLite|Win32.Build.0 = Release_Cairo_CFLite|Win32
-		{AAE88FEF-509E-4D49-870B-7357922C276F}.Release_LTCG|Win32.ActiveCfg = Release_LTCG|Win32
-		{AAE88FEF-509E-4D49-870B-7357922C276F}.Release_LTCG|Win32.Build.0 = Release_LTCG|Win32
+		{AAE88FEF-509E-4D49-870B-7357922C276F}.Production|Win32.ActiveCfg = Production|Win32
+		{AAE88FEF-509E-4D49-870B-7357922C276F}.Production|Win32.Build.0 = Production|Win32
 		{AAE88FEF-509E-4D49-870B-7357922C276F}.Release|Win32.ActiveCfg = Release|Win32
 		{AAE88FEF-509E-4D49-870B-7357922C276F}.Release|Win32.Build.0 = Release|Win32
 		{91762BE2-87EF-4F5A-A480-48B90EB3F406}.Debug_All|Win32.ActiveCfg = Debug_All|Win32
@@ -301,8 +301,8 @@ Global
 		{91762BE2-87EF-4F5A-A480-48B90EB3F406}.Debug|Win32.Build.0 = Debug|Win32
 		{91762BE2-87EF-4F5A-A480-48B90EB3F406}.Release_Cairo_CFLite|Win32.ActiveCfg = Release_Cairo_CFLite|Win32
 		{91762BE2-87EF-4F5A-A480-48B90EB3F406}.Release_Cairo_CFLite|Win32.Build.0 = Release_Cairo_CFLite|Win32
-		{91762BE2-87EF-4F5A-A480-48B90EB3F406}.Release_LTCG|Win32.ActiveCfg = Release_LTCG|Win32
-		{91762BE2-87EF-4F5A-A480-48B90EB3F406}.Release_LTCG|Win32.Build.0 = Release_LTCG|Win32
+		{91762BE2-87EF-4F5A-A480-48B90EB3F406}.Production|Win32.ActiveCfg = Production|Win32
+		{91762BE2-87EF-4F5A-A480-48B90EB3F406}.Production|Win32.Build.0 = Production|Win32
 		{91762BE2-87EF-4F5A-A480-48B90EB3F406}.Release|Win32.ActiveCfg = Release|Win32
 		{91762BE2-87EF-4F5A-A480-48B90EB3F406}.Release|Win32.Build.0 = Release|Win32
 		{0662A8A9-82A3-4638-97D8-EC425D8D87C9}.Debug_All|Win32.ActiveCfg = Debug_All|Win32
@@ -313,8 +313,8 @@ Global
 		{0662A8A9-82A3-4638-97D8-EC425D8D87C9}.Debug|Win32.Build.0 = Debug|Win32
 		{0662A8A9-82A3-4638-97D8-EC425D8D87C9}.Release_Cairo_CFLite|Win32.ActiveCfg = Release_Cairo_CFLite|Win32
 		{0662A8A9-82A3-4638-97D8-EC425D8D87C9}.Release_Cairo_CFLite|Win32.Build.0 = Release_Cairo_CFLite|Win32
-		{0662A8A9-82A3-4638-97D8-EC425D8D87C9}.Release_LTCG|Win32.ActiveCfg = Release_LTCG|Win32
-		{0662A8A9-82A3-4638-97D8-EC425D8D87C9}.Release_LTCG|Win32.Build.0 = Release_LTCG|Win32
+		{0662A8A9-82A3-4638-97D8-EC425D8D87C9}.Production|Win32.ActiveCfg = Production|Win32
+		{0662A8A9-82A3-4638-97D8-EC425D8D87C9}.Production|Win32.Build.0 = Production|Win32
 		{0662A8A9-82A3-4638-97D8-EC425D8D87C9}.Release|Win32.ActiveCfg = Release|Win32
 		{0662A8A9-82A3-4638-97D8-EC425D8D87C9}.Release|Win32.Build.0 = Release|Win32
 		{B8437A41-67BC-4769-9452-45203827F821}.Debug_All|Win32.ActiveCfg = Debug_All|Win32
@@ -325,8 +325,8 @@ Global
 		{B8437A41-67BC-4769-9452-45203827F821}.Debug|Win32.Build.0 = Debug|Win32
 		{B8437A41-67BC-4769-9452-45203827F821}.Release_Cairo_CFLite|Win32.ActiveCfg = Release_Cairo_CFLite|Win32
 		{B8437A41-67BC-4769-9452-45203827F821}.Release_Cairo_CFLite|Win32.Build.0 = Release_Cairo_CFLite|Win32
-		{B8437A41-67BC-4769-9452-45203827F821}.Release_LTCG|Win32.ActiveCfg = Release_LTCG|Win32
-		{B8437A41-67BC-4769-9452-45203827F821}.Release_LTCG|Win32.Build.0 = Release_LTCG|Win32
+		{B8437A41-67BC-4769-9452-45203827F821}.Production|Win32.ActiveCfg = Production|Win32
+		{B8437A41-67BC-4769-9452-45203827F821}.Production|Win32.Build.0 = Production|Win32
 		{B8437A41-67BC-4769-9452-45203827F821}.Release|Win32.ActiveCfg = Release|Win32
 		{B8437A41-67BC-4769-9452-45203827F821}.Release|Win32.Build.0 = Release|Win32
 		{6567DFD4-D6DE-4CD5-825D-17E353D160E1}.Debug_All|Win32.ActiveCfg = Debug_All|Win32
@@ -337,8 +337,8 @@ Global
 		{6567DFD4-D6DE-4CD5-825D-17E353D160E1}.Debug|Win32.Build.0 = Debug|Win32
 		{6567DFD4-D6DE-4CD5-825D-17E353D160E1}.Release_Cairo_CFLite|Win32.ActiveCfg = Release_Cairo_CFLite|Win32
 		{6567DFD4-D6DE-4CD5-825D-17E353D160E1}.Release_Cairo_CFLite|Win32.Build.0 = Release_Cairo_CFLite|Win32
-		{6567DFD4-D6DE-4CD5-825D-17E353D160E1}.Release_LTCG|Win32.ActiveCfg = Release_LTCG|Win32
-		{6567DFD4-D6DE-4CD5-825D-17E353D160E1}.Release_LTCG|Win32.Build.0 = Release_LTCG|Win32
+		{6567DFD4-D6DE-4CD5-825D-17E353D160E1}.Production|Win32.ActiveCfg = Production|Win32
+		{6567DFD4-D6DE-4CD5-825D-17E353D160E1}.Production|Win32.Build.0 = Production|Win32
 		{6567DFD4-D6DE-4CD5-825D-17E353D160E1}.Release|Win32.ActiveCfg = Release|Win32
 		{6567DFD4-D6DE-4CD5-825D-17E353D160E1}.Release|Win32.Build.0 = Release|Win32
 		{59CC0547-70AC-499C-9B19-EC01C6F61137}.Debug_All|Win32.ActiveCfg = Debug_All|Win32
@@ -349,8 +349,8 @@ Global
 		{59CC0547-70AC-499C-9B19-EC01C6F61137}.Debug|Win32.Build.0 = Debug|Win32
 		{59CC0547-70AC-499C-9B19-EC01C6F61137}.Release_Cairo_CFLite|Win32.ActiveCfg = Release_Cairo_CFLite|Win32
 		{59CC0547-70AC-499C-9B19-EC01C6F61137}.Release_Cairo_CFLite|Win32.Build.0 = Release_Cairo_CFLite|Win32
-		{59CC0547-70AC-499C-9B19-EC01C6F61137}.Release_LTCG|Win32.ActiveCfg = Release_LTCG|Win32
-		{59CC0547-70AC-499C-9B19-EC01C6F61137}.Release_LTCG|Win32.Build.0 = Release_LTCG|Win32
+		{59CC0547-70AC-499C-9B19-EC01C6F61137}.Production|Win32.ActiveCfg = Production|Win32
+		{59CC0547-70AC-499C-9B19-EC01C6F61137}.Production|Win32.Build.0 = Production|Win32
 		{59CC0547-70AC-499C-9B19-EC01C6F61137}.Release|Win32.ActiveCfg = Release|Win32
 		{59CC0547-70AC-499C-9B19-EC01C6F61137}.Release|Win32.Build.0 = Release|Win32
 		{DA31DA52-6675-48D4-89E0-333A7144397C}.Debug_All|Win32.ActiveCfg = Debug_All|Win32
@@ -361,8 +361,8 @@ Global
 		{DA31DA52-6675-48D4-89E0-333A7144397C}.Debug|Win32.Build.0 = Debug|Win32
 		{DA31DA52-6675-48D4-89E0-333A7144397C}.Release_Cairo_CFLite|Win32.ActiveCfg = Release_Cairo_CFLite|Win32
 		{DA31DA52-6675-48D4-89E0-333A7144397C}.Release_Cairo_CFLite|Win32.Build.0 = Release_Cairo_CFLite|Win32
-		{DA31DA52-6675-48D4-89E0-333A7144397C}.Release_LTCG|Win32.ActiveCfg = Release_LTCG|Win32
-		{DA31DA52-6675-48D4-89E0-333A7144397C}.Release_LTCG|Win32.Build.0 = Release_LTCG|Win32
+		{DA31DA52-6675-48D4-89E0-333A7144397C}.Production|Win32.ActiveCfg = Production|Win32
+		{DA31DA52-6675-48D4-89E0-333A7144397C}.Production|Win32.Build.0 = Production|Win32
 		{DA31DA52-6675-48D4-89E0-333A7144397C}.Release|Win32.ActiveCfg = Release|Win32
 		{DA31DA52-6675-48D4-89E0-333A7144397C}.Release|Win32.Build.0 = Release|Win32
 		{44B9C152-1870-4035-B94D-7B3285AA0C12}.Debug_All|Win32.ActiveCfg = Debug_All|Win32
@@ -373,8 +373,8 @@ Global
 		{44B9C152-1870-4035-B94D-7B3285AA0C12}.Debug|Win32.Build.0 = Debug|Win32
 		{44B9C152-1870-4035-B94D-7B3285AA0C12}.Release_Cairo_CFLite|Win32.ActiveCfg = Release_Cairo_CFLite|Win32
 		{44B9C152-1870-4035-B94D-7B3285AA0C12}.Release_Cairo_CFLite|Win32.Build.0 = Release_Cairo_CFLite|Win32
-		{44B9C152-1870-4035-B94D-7B3285AA0C12}.Release_LTCG|Win32.ActiveCfg = Release_LTCG|Win32
-		{44B9C152-1870-4035-B94D-7B3285AA0C12}.Release_LTCG|Win32.Build.0 = Release_LTCG|Win32
+		{44B9C152-1870-4035-B94D-7B3285AA0C12}.Production|Win32.ActiveCfg = Production|Win32
+		{44B9C152-1870-4035-B94D-7B3285AA0C12}.Production|Win32.Build.0 = Production|Win32
 		{44B9C152-1870-4035-B94D-7B3285AA0C12}.Release|Win32.ActiveCfg = Release|Win32
 		{44B9C152-1870-4035-B94D-7B3285AA0C12}.Release|Win32.Build.0 = Release|Win32
 		{C0737398-3565-439E-A2B8-AB2BE4D5430C}.Debug_All|Win32.ActiveCfg = Debug_All|Win32
@@ -385,8 +385,8 @@ Global
 		{C0737398-3565-439E-A2B8-AB2BE4D5430C}.Debug|Win32.Build.0 = Debug|Win32
 		{C0737398-3565-439E-A2B8-AB2BE4D5430C}.Release_Cairo_CFLite|Win32.ActiveCfg = Release_Cairo_CFLite|Win32
 		{C0737398-3565-439E-A2B8-AB2BE4D5430C}.Release_Cairo_CFLite|Win32.Build.0 = Release_Cairo_CFLite|Win32
-		{C0737398-3565-439E-A2B8-AB2BE4D5430C}.Release_LTCG|Win32.ActiveCfg = Release_LTCG|Win32
-		{C0737398-3565-439E-A2B8-AB2BE4D5430C}.Release_LTCG|Win32.Build.0 = Release_LTCG|Win32
+		{C0737398-3565-439E-A2B8-AB2BE4D5430C}.Production|Win32.ActiveCfg = Production|Win32
+		{C0737398-3565-439E-A2B8-AB2BE4D5430C}.Production|Win32.Build.0 = Production|Win32
 		{C0737398-3565-439E-A2B8-AB2BE4D5430C}.Release|Win32.ActiveCfg = Release|Win32
 		{C0737398-3565-439E-A2B8-AB2BE4D5430C}.Release|Win32.Build.0 = Release|Win32
 		{626089A3-25D3-4883-A96C-B8C66E036397}.Debug_All|Win32.ActiveCfg = Debug_All|Win32
@@ -397,8 +397,8 @@ Global
 		{626089A3-25D3-4883-A96C-B8C66E036397}.Debug|Win32.Build.0 = Debug|Win32
 		{626089A3-25D3-4883-A96C-B8C66E036397}.Release_Cairo_CFLite|Win32.ActiveCfg = Release_Cairo_CFLite|Win32
 		{626089A3-25D3-4883-A96C-B8C66E036397}.Release_Cairo_CFLite|Win32.Build.0 = Release_Cairo_CFLite|Win32
-		{626089A3-25D3-4883-A96C-B8C66E036397}.Release_LTCG|Win32.ActiveCfg = Release_LTCG|Win32
-		{626089A3-25D3-4883-A96C-B8C66E036397}.Release_LTCG|Win32.Build.0 = Release_LTCG|Win32
+		{626089A3-25D3-4883-A96C-B8C66E036397}.Production|Win32.ActiveCfg = Production|Win32
+		{626089A3-25D3-4883-A96C-B8C66E036397}.Production|Win32.Build.0 = Production|Win32
 		{626089A3-25D3-4883-A96C-B8C66E036397}.Release|Win32.ActiveCfg = Release|Win32
 		{626089A3-25D3-4883-A96C-B8C66E036397}.Release|Win32.Build.0 = Release|Win32
 		{D09806DB-E58B-4646-8C9B-61101906C1E2}.Debug_All|Win32.ActiveCfg = Debug_All|Win32
@@ -409,8 +409,8 @@ Global
 		{D09806DB-E58B-4646-8C9B-61101906C1E2}.Debug|Win32.Build.0 = Debug|Win32
 		{D09806DB-E58B-4646-8C9B-61101906C1E2}.Release_Cairo_CFLite|Win32.ActiveCfg = Release_Cairo_CFLite|Win32
 		{D09806DB-E58B-4646-8C9B-61101906C1E2}.Release_Cairo_CFLite|Win32.Build.0 = Release_Cairo_CFLite|Win32
-		{D09806DB-E58B-4646-8C9B-61101906C1E2}.Release_LTCG|Win32.ActiveCfg = Release_LTCG|Win32
-		{D09806DB-E58B-4646-8C9B-61101906C1E2}.Release_LTCG|Win32.Build.0 = Release_LTCG|Win32
+		{D09806DB-E58B-4646-8C9B-61101906C1E2}.Production|Win32.ActiveCfg = Production|Win32
+		{D09806DB-E58B-4646-8C9B-61101906C1E2}.Production|Win32.Build.0 = Production|Win32
 		{D09806DB-E58B-4646-8C9B-61101906C1E2}.Release|Win32.ActiveCfg = Release|Win32
 		{D09806DB-E58B-4646-8C9B-61101906C1E2}.Release|Win32.Build.0 = Release|Win32
 		{114FCA11-216B-4C8C-957E-30A75AE80443}.Debug_All|Win32.ActiveCfg = Debug_All|Win32
@@ -421,8 +421,8 @@ Global
 		{114FCA11-216B-4C8C-957E-30A75AE80443}.Debug|Win32.Build.0 = Debug|Win32
 		{114FCA11-216B-4C8C-957E-30A75AE80443}.Release_Cairo_CFLite|Win32.ActiveCfg = Release_Cairo_CFLite|Win32
 		{114FCA11-216B-4C8C-957E-30A75AE80443}.Release_Cairo_CFLite|Win32.Build.0 = Release_Cairo_CFLite|Win32
-		{114FCA11-216B-4C8C-957E-30A75AE80443}.Release_LTCG|Win32.ActiveCfg = Release_LTCG|Win32
-		{114FCA11-216B-4C8C-957E-30A75AE80443}.Release_LTCG|Win32.Build.0 = Release_LTCG|Win32
+		{114FCA11-216B-4C8C-957E-30A75AE80443}.Production|Win32.ActiveCfg = Production|Win32
+		{114FCA11-216B-4C8C-957E-30A75AE80443}.Production|Win32.Build.0 = Production|Win32
 		{114FCA11-216B-4C8C-957E-30A75AE80443}.Release|Win32.ActiveCfg = Release|Win32
 		{114FCA11-216B-4C8C-957E-30A75AE80443}.Release|Win32.Build.0 = Release|Win32
 		{CBC3391C-F060-4BF5-A66E-81404168816B}.Debug_All|Win32.ActiveCfg = Debug_All|Win32
@@ -433,8 +433,8 @@ Global
 		{CBC3391C-F060-4BF5-A66E-81404168816B}.Debug|Win32.Build.0 = Debug|Win32
 		{CBC3391C-F060-4BF5-A66E-81404168816B}.Release_Cairo_CFLite|Win32.ActiveCfg = Release_Cairo_CFLite|Win32
 		{CBC3391C-F060-4BF5-A66E-81404168816B}.Release_Cairo_CFLite|Win32.Build.0 = Release_Cairo_CFLite|Win32
-		{CBC3391C-F060-4BF5-A66E-81404168816B}.Release_LTCG|Win32.ActiveCfg = Release_LTCG|Win32
-		{CBC3391C-F060-4BF5-A66E-81404168816B}.Release_LTCG|Win32.Build.0 = Release_LTCG|Win32
+		{CBC3391C-F060-4BF5-A66E-81404168816B}.Production|Win32.ActiveCfg = Production|Win32
+		{CBC3391C-F060-4BF5-A66E-81404168816B}.Production|Win32.Build.0 = Production|Win32
 		{CBC3391C-F060-4BF5-A66E-81404168816B}.Release|Win32.ActiveCfg = Release|Win32
 		{CBC3391C-F060-4BF5-A66E-81404168816B}.Release|Win32.Build.0 = Release|Win32
 		{4343BC0B-A2E0-4B48-8277-F33CFBFA83CD}.Debug_All|Win32.ActiveCfg = Debug_All|Win32
@@ -445,8 +445,8 @@ Global
 		{4343BC0B-A2E0-4B48-8277-F33CFBFA83CD}.Debug|Win32.Build.0 = Debug|Win32
 		{4343BC0B-A2E0-4B48-8277-F33CFBFA83CD}.Release_Cairo_CFLite|Win32.ActiveCfg = Release_Cairo_CFLite|Win32
 		{4343BC0B-A2E0-4B48-8277-F33CFBFA83CD}.Release_Cairo_CFLite|Win32.Build.0 = Release_Cairo_CFLite|Win32
-		{4343BC0B-A2E0-4B48-8277-F33CFBFA83CD}.Release_LTCG|Win32.ActiveCfg = Release_LTCG|Win32
-		{4343BC0B-A2E0-4B48-8277-F33CFBFA83CD}.Release_LTCG|Win32.Build.0 = Release_LTCG|Win32
+		{4343BC0B-A2E0-4B48-8277-F33CFBFA83CD}.Production|Win32.ActiveCfg = Production|Win32
+		{4343BC0B-A2E0-4B48-8277-F33CFBFA83CD}.Production|Win32.Build.0 = Production|Win32
 		{4343BC0B-A2E0-4B48-8277-F33CFBFA83CD}.Release|Win32.ActiveCfg = Release|Win32
 		{4343BC0B-A2E0-4B48-8277-F33CFBFA83CD}.Release|Win32.Build.0 = Release|Win32
 		{3B99669B-1817-443B-BCBE-835580146668}.Debug_All|Win32.ActiveCfg = Debug_All|Win32
@@ -457,8 +457,8 @@ Global
 		{3B99669B-1817-443B-BCBE-835580146668}.Debug|Win32.Build.0 = Debug|Win32
 		{3B99669B-1817-443B-BCBE-835580146668}.Release_Cairo_CFLite|Win32.ActiveCfg = Release_Cairo_CFLite|Win32
 		{3B99669B-1817-443B-BCBE-835580146668}.Release_Cairo_CFLite|Win32.Build.0 = Release_Cairo_CFLite|Win32
-		{3B99669B-1817-443B-BCBE-835580146668}.Release_LTCG|Win32.ActiveCfg = Release_LTCG|Win32
-		{3B99669B-1817-443B-BCBE-835580146668}.Release_LTCG|Win32.Build.0 = Release_LTCG|Win32
+		{3B99669B-1817-443B-BCBE-835580146668}.Production|Win32.ActiveCfg = Production|Win32
+		{3B99669B-1817-443B-BCBE-835580146668}.Production|Win32.Build.0 = Production|Win32
 		{3B99669B-1817-443B-BCBE-835580146668}.Release|Win32.ActiveCfg = Release|Win32
 		{3B99669B-1817-443B-BCBE-835580146668}.Release|Win32.Build.0 = Release|Win32
 		{1480CF5F-4160-47B5-A0E6-96AEC8258FB5}.Debug_All|Win32.ActiveCfg = Debug_All|Win32
@@ -469,8 +469,8 @@ Global
 		{1480CF5F-4160-47B5-A0E6-96AEC8258FB5}.Debug|Win32.Build.0 = Debug|Win32
 		{1480CF5F-4160-47B5-A0E6-96AEC8258FB5}.Release_Cairo_CFLite|Win32.ActiveCfg = Release_Cairo_CFLite|Win32
 		{1480CF5F-4160-47B5-A0E6-96AEC8258FB5}.Release_Cairo_CFLite|Win32.Build.0 = Release_Cairo_CFLite|Win32
-		{1480CF5F-4160-47B5-A0E6-96AEC8258FB5}.Release_LTCG|Win32.ActiveCfg = Release_LTCG|Win32
-		{1480CF5F-4160-47B5-A0E6-96AEC8258FB5}.Release_LTCG|Win32.Build.0 = Release_LTCG|Win32
+		{1480CF5F-4160-47B5-A0E6-96AEC8258FB5}.Production|Win32.ActiveCfg = Production|Win32
+		{1480CF5F-4160-47B5-A0E6-96AEC8258FB5}.Production|Win32.Build.0 = Production|Win32
 		{1480CF5F-4160-47B5-A0E6-96AEC8258FB5}.Release|Win32.ActiveCfg = Release|Win32
 		{1480CF5F-4160-47B5-A0E6-96AEC8258FB5}.Release|Win32.Build.0 = Release|Win32
 		{3E48AB23-D249-488F-A1C4-43CDF52FBD28}.Debug_All|Win32.ActiveCfg = Debug_All|Win32
@@ -481,8 +481,8 @@ Global
 		{3E48AB23-D249-488F-A1C4-43CDF52FBD28}.Debug|Win32.Build.0 = Debug|Win32
 		{3E48AB23-D249-488F-A1C4-43CDF52FBD28}.Release_Cairo_CFLite|Win32.ActiveCfg = Release_Cairo_CFLite|Win32
 		{3E48AB23-D249-488F-A1C4-43CDF52FBD28}.Release_Cairo_CFLite|Win32.Build.0 = Release_Cairo_CFLite|Win32
-		{3E48AB23-D249-488F-A1C4-43CDF52FBD28}.Release_LTCG|Win32.ActiveCfg = Release_LTCG|Win32
-		{3E48AB23-D249-488F-A1C4-43CDF52FBD28}.Release_LTCG|Win32.Build.0 = Release_LTCG|Win32
+		{3E48AB23-D249-488F-A1C4-43CDF52FBD28}.Production|Win32.ActiveCfg = Production|Win32
+		{3E48AB23-D249-488F-A1C4-43CDF52FBD28}.Production|Win32.Build.0 = Production|Win32
 		{3E48AB23-D249-488F-A1C4-43CDF52FBD28}.Release|Win32.ActiveCfg = Release|Win32
 		{3E48AB23-D249-488F-A1C4-43CDF52FBD28}.Release|Win32.Build.0 = Release|Win32
 		{45C45411-7F0E-404D-919A-4EE9BB60BE86}.Debug_All|Win32.ActiveCfg = Debug_All|Win32
@@ -493,8 +493,8 @@ Global
 		{45C45411-7F0E-404D-919A-4EE9BB60BE86}.Debug|Win32.Build.0 = Debug|Win32
 		{45C45411-7F0E-404D-919A-4EE9BB60BE86}.Release_Cairo_CFLite|Win32.ActiveCfg = Release_Cairo_CFLite|Win32
 		{45C45411-7F0E-404D-919A-4EE9BB60BE86}.Release_Cairo_CFLite|Win32.Build.0 = Release_Cairo_CFLite|Win32
-		{45C45411-7F0E-404D-919A-4EE9BB60BE86}.Release_LTCG|Win32.ActiveCfg = Release_LTCG|Win32
-		{45C45411-7F0E-404D-919A-4EE9BB60BE86}.Release_LTCG|Win32.Build.0 = Release_LTCG|Win32
+		{45C45411-7F0E-404D-919A-4EE9BB60BE86}.Production|Win32.ActiveCfg = Production|Win32
+		{45C45411-7F0E-404D-919A-4EE9BB60BE86}.Production|Win32.Build.0 = Production|Win32
 		{45C45411-7F0E-404D-919A-4EE9BB60BE86}.Release|Win32.ActiveCfg = Release|Win32
 		{45C45411-7F0E-404D-919A-4EE9BB60BE86}.Release|Win32.Build.0 = Release|Win32
 		{B0101604-B483-4F8C-9C51-90B46A2B1CD3}.Debug_All|Win32.ActiveCfg = Debug_All|Win32
@@ -505,8 +505,8 @@ Global
 		{B0101604-B483-4F8C-9C51-90B46A2B1CD3}.Debug|Win32.Build.0 = Debug|Win32
 		{B0101604-B483-4F8C-9C51-90B46A2B1CD3}.Release_Cairo_CFLite|Win32.ActiveCfg = Release_Cairo_CFLite|Win32
 		{B0101604-B483-4F8C-9C51-90B46A2B1CD3}.Release_Cairo_CFLite|Win32.Build.0 = Release_Cairo_CFLite|Win32
-		{B0101604-B483-4F8C-9C51-90B46A2B1CD3}.Release_LTCG|Win32.ActiveCfg = Release_LTCG|Win32
-		{B0101604-B483-4F8C-9C51-90B46A2B1CD3}.Release_LTCG|Win32.Build.0 = Release_LTCG|Win32
+		{B0101604-B483-4F8C-9C51-90B46A2B1CD3}.Production|Win32.ActiveCfg = Production|Win32
+		{B0101604-B483-4F8C-9C51-90B46A2B1CD3}.Production|Win32.Build.0 = Production|Win32
 		{B0101604-B483-4F8C-9C51-90B46A2B1CD3}.Release|Win32.ActiveCfg = Release|Win32
 		{B0101604-B483-4F8C-9C51-90B46A2B1CD3}.Release|Win32.Build.0 = Release|Win32
 	EndGlobalSection
diff --git a/Source/WebKit/win/WebKit.vcproj/WebKit.submit.sln b/Source/WebKit/win/WebKit.vcproj/WebKit.submit.sln
index 8f431f1..e873b11 100644
--- a/Source/WebKit/win/WebKit.vcproj/WebKit.submit.sln
+++ b/Source/WebKit/win/WebKit.vcproj/WebKit.submit.sln
@@ -18,7 +18,7 @@ Global
 	GlobalSection(SolutionConfigurationPlatforms) = preSolution
 		Debug_All|Win32 = Debug_All|Win32
 		Debug|Win32 = Debug|Win32
-		Release_LTCG|Win32 = Release_LTCG|Win32
+		Production|Win32 = Production|Win32
 		Release|Win32 = Release|Win32
 	EndGlobalSection
 	GlobalSection(ProjectConfigurationPlatforms) = postSolution
@@ -26,24 +26,24 @@ Global
 		{0662A8A9-82A3-4638-97D8-EC425D8D87C9}.Debug_All|Win32.Build.0 = Debug_All|Win32
 		{0662A8A9-82A3-4638-97D8-EC425D8D87C9}.Debug|Win32.ActiveCfg = Debug|Win32
 		{0662A8A9-82A3-4638-97D8-EC425D8D87C9}.Debug|Win32.Build.0 = Debug|Win32
-		{0662A8A9-82A3-4638-97D8-EC425D8D87C9}.Release_LTCG|Win32.ActiveCfg = Release_LTCG|Win32
-		{0662A8A9-82A3-4638-97D8-EC425D8D87C9}.Release_LTCG|Win32.Build.0 = Release_LTCG|Win32
+		{0662A8A9-82A3-4638-97D8-EC425D8D87C9}.Production|Win32.ActiveCfg = Production|Win32
+		{0662A8A9-82A3-4638-97D8-EC425D8D87C9}.Production|Win32.Build.0 = Production|Win32
 		{0662A8A9-82A3-4638-97D8-EC425D8D87C9}.Release|Win32.ActiveCfg = Release|Win32
 		{0662A8A9-82A3-4638-97D8-EC425D8D87C9}.Release|Win32.Build.0 = Release|Win32
 		{B8437A41-67BC-4769-9452-45203827F821}.Debug_All|Win32.ActiveCfg = Debug_All|Win32
 		{B8437A41-67BC-4769-9452-45203827F821}.Debug_All|Win32.Build.0 = Debug_All|Win32
 		{B8437A41-67BC-4769-9452-45203827F821}.Debug|Win32.ActiveCfg = Debug|Win32
 		{B8437A41-67BC-4769-9452-45203827F821}.Debug|Win32.Build.0 = Debug|Win32
-		{B8437A41-67BC-4769-9452-45203827F821}.Release_LTCG|Win32.ActiveCfg = Release_LTCG|Win32
-		{B8437A41-67BC-4769-9452-45203827F821}.Release_LTCG|Win32.Build.0 = Release_LTCG|Win32
+		{B8437A41-67BC-4769-9452-45203827F821}.Production|Win32.ActiveCfg = Production|Win32
+		{B8437A41-67BC-4769-9452-45203827F821}.Production|Win32.Build.0 = Production|Win32
 		{B8437A41-67BC-4769-9452-45203827F821}.Release|Win32.ActiveCfg = Release|Win32
 		{B8437A41-67BC-4769-9452-45203827F821}.Release|Win32.Build.0 = Release|Win32
 		{91762BE2-87EF-4F5A-A480-48B90EB3F406}.Debug_All|Win32.ActiveCfg = Debug_All|Win32
 		{91762BE2-87EF-4F5A-A480-48B90EB3F406}.Debug_All|Win32.Build.0 = Debug_All|Win32
 		{91762BE2-87EF-4F5A-A480-48B90EB3F406}.Debug|Win32.ActiveCfg = Debug|Win32
 		{91762BE2-87EF-4F5A-A480-48B90EB3F406}.Debug|Win32.Build.0 = Debug|Win32
-		{91762BE2-87EF-4F5A-A480-48B90EB3F406}.Release_LTCG|Win32.ActiveCfg = Release_LTCG|Win32
-		{91762BE2-87EF-4F5A-A480-48B90EB3F406}.Release_LTCG|Win32.Build.0 = Release_LTCG|Win32
+		{91762BE2-87EF-4F5A-A480-48B90EB3F406}.Production|Win32.ActiveCfg = Production|Win32
+		{91762BE2-87EF-4F5A-A480-48B90EB3F406}.Production|Win32.Build.0 = Production|Win32
 		{91762BE2-87EF-4F5A-A480-48B90EB3F406}.Release|Win32.ActiveCfg = Release|Win32
 		{91762BE2-87EF-4F5A-A480-48B90EB3F406}.Release|Win32.Build.0 = Release|Win32
 	EndGlobalSection
diff --git a/Source/WebKit/win/WebKit.vcproj/WebKit.vcproj b/Source/WebKit/win/WebKit.vcproj/WebKit.vcproj
index d1aa3c6..a8b9cc3 100644
--- a/Source/WebKit/win/WebKit.vcproj/WebKit.vcproj
+++ b/Source/WebKit/win/WebKit.vcproj/WebKit.vcproj
@@ -18,7 +18,7 @@
 		<Configuration
 			Name="Debug|Win32"
 			ConfigurationType="4"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;.\WebKitLibCommon.vsprops"
+			InheritedPropertySheets=".\WebKitLibDebug.vsprops"
 			CharacterSet="1"
 			>
 			<Tool
@@ -70,7 +70,7 @@
 		<Configuration
 			Name="Release|Win32"
 			ConfigurationType="4"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;.\WebKitLibCommon.vsprops"
+			InheritedPropertySheets=".\WebKitLibRelease.vsprops"
 			CharacterSet="1"
 			>
 			<Tool
@@ -122,7 +122,7 @@
 		<Configuration
 			Name="Debug_Cairo_CFLite|Win32"
 			ConfigurationType="4"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefinesCairo.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\WinCairo.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug_wincairo.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\cURL.vsprops;.\WebKitLibCommon.vsprops"
+			InheritedPropertySheets=".\WebKitLibDebugCairoCFLite.vsprops"
 			CharacterSet="1"
 			>
 			<Tool
@@ -174,7 +174,7 @@
 		<Configuration
 			Name="Release_Cairo_CFLite|Win32"
 			ConfigurationType="4"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefinesCairo.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\WinCairo.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\WinCairo.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\cURL.vsprops;.\WebKitLibCommon.vsprops"
+			InheritedPropertySheets=".\WebKitLibReleaseCairoCFLite.vsprops"
 			CharacterSet="1"
 			>
 			<Tool
@@ -226,7 +226,7 @@
 		<Configuration
 			Name="Debug_All|Win32"
 			ConfigurationType="4"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug_all.vsprops;.\WebKitLibCommon.vsprops"
+			InheritedPropertySheets=".\WebKitLibDebugAll.vsprops"
 			CharacterSet="1"
 			>
 			<Tool
@@ -276,9 +276,9 @@
 			/>
 		</Configuration>
 		<Configuration
-			Name="Release_LTCG|Win32"
+			Name="Production|Win32"
 			ConfigurationType="4"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;.\WebKitLibCommon.vsprops"
+			InheritedPropertySheets=".\WebKitLibProduction.vsprops"
 			CharacterSet="1"
 			WholeProgramOptimization="1"
 			>
@@ -827,7 +827,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -903,7 +903,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -1079,7 +1079,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -1301,7 +1301,7 @@
 				/>
 			</FileConfiguration>
 			<FileConfiguration
-				Name="Release_LTCG|Win32"
+				Name="Production|Win32"
 				>
 				<Tool
 					Name="VCCLCompilerTool"
diff --git a/Source/WebKit/win/WebKit.vcproj/WebKitGUID.vcproj b/Source/WebKit/win/WebKit.vcproj/WebKitGUID.vcproj
index 5d1abd2..f087413 100644
--- a/Source/WebKit/win/WebKit.vcproj/WebKitGUID.vcproj
+++ b/Source/WebKit/win/WebKit.vcproj/WebKitGUID.vcproj
@@ -18,7 +18,7 @@
 		<Configuration
 			Name="Debug|Win32"
 			ConfigurationType="4"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;.\WebKitGUIDCommon.vsprops"
+			InheritedPropertySheets=".\WebKitGUIDDebug.vsprops"
 			CharacterSet="1"
 			>
 			<Tool
@@ -71,7 +71,7 @@
 		<Configuration
 			Name="Release|Win32"
 			ConfigurationType="4"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;.\WebKitGUIDCommon.vsprops"
+			InheritedPropertySheets=".\WebKitGUIDRelease.vsprops"
 			CharacterSet="1"
 			>
 			<Tool
@@ -124,7 +124,7 @@
 		<Configuration
 			Name="Debug_All|Win32"
 			ConfigurationType="4"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug_all.vsprops;.\WebKitGUIDCommon.vsprops"
+			InheritedPropertySheets=".\WebKitGUIDDebugAll.vsprops"
 			CharacterSet="1"
 			>
 			<Tool
@@ -175,9 +175,9 @@
 			/>
 		</Configuration>
 		<Configuration
-			Name="Release_LTCG|Win32"
+			Name="Production|Win32"
 			ConfigurationType="4"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;.\WebKitGUIDCommon.vsprops"
+			InheritedPropertySheets=".\WebKitGUIDProduction.vsprops"
 			CharacterSet="1"
 			WholeProgramOptimization="1"
 			>
@@ -231,7 +231,7 @@
 		<Configuration
 			Name="Release_Cairo_CFLite|Win32"
 			ConfigurationType="4"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefinesCairo.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\WinCairo.vsprops;.\WebKitGUIDCommon.vsprops"
+			InheritedPropertySheets=".\WebKitGUIDReleaseCairoCFLite.vsprops"
 			CharacterSet="1"
 			>
 			<Tool
@@ -284,7 +284,7 @@
 		<Configuration
 			Name="Debug_Cairo_CFLite|Win32"
 			ConfigurationType="4"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefinesCairo.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug_wincairo.vsprops;.\WebKitGUIDCommon.vsprops"
+			InheritedPropertySheets=".\WebKitGUIDDebugCairoCFLite.vsprops"
 			CharacterSet="1"
 			>
 			<Tool
diff --git a/Source/WebKit/win/WebKit.vcproj/WebKitGUIDDebug.vsprops b/Source/WebKit/win/WebKit.vcproj/WebKitGUIDDebug.vsprops
new file mode 100644
index 0000000..2038998
--- /dev/null
+++ b/Source/WebKit/win/WebKit.vcproj/WebKitGUIDDebug.vsprops
@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="WebKitGUIDDebug"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;
+      .\WebKitGUIDCommon.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Source/WebKit/win/WebKit.vcproj/WebKitGUIDDebugAll.vsprops b/Source/WebKit/win/WebKit.vcproj/WebKitGUIDDebugAll.vsprops
new file mode 100644
index 0000000..ccd2847
--- /dev/null
+++ b/Source/WebKit/win/WebKit.vcproj/WebKitGUIDDebugAll.vsprops
@@ -0,0 +1,13 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="WebKitGUIDDebugAll"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug_all.vsprops;
+      .\WebKitGUIDCommon.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Source/WebKit/win/WebKit.vcproj/WebKitGUIDDebugCairoCFLite.vsprops b/Source/WebKit/win/WebKit.vcproj/WebKitGUIDDebugCairoCFLite.vsprops
new file mode 100644
index 0000000..abbdd3e
--- /dev/null
+++ b/Source/WebKit/win/WebKit.vcproj/WebKitGUIDDebugCairoCFLite.vsprops
@@ -0,0 +1,13 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="WebKitGUIDDebugCairoCFLite"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefinesCairo.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug_wincairo.vsprops;
+      .\WebKitGUIDCommon.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Source/WebKit/win/WebKit.vcproj/WebKitGUIDProduction.vsprops b/Source/WebKit/win/WebKit.vcproj/WebKitGUIDProduction.vsprops
new file mode 100644
index 0000000..941bf46
--- /dev/null
+++ b/Source/WebKit/win/WebKit.vcproj/WebKitGUIDProduction.vsprops
@@ -0,0 +1,13 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="WebKitGUIDProduction"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\production.vsprops;
+      .\WebKitGUIDCommon.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Source/WebKit/win/WebKit.vcproj/WebKitGUIDRelease.vsprops b/Source/WebKit/win/WebKit.vcproj/WebKitGUIDRelease.vsprops
new file mode 100644
index 0000000..39566ea
--- /dev/null
+++ b/Source/WebKit/win/WebKit.vcproj/WebKitGUIDRelease.vsprops
@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="WebKitGUIDRelease"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
+      .\WebKitGUIDCommon.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Source/WebKit/win/WebKit.vcproj/WebKitGUIDReleaseCairoCFLite.vsprops b/Source/WebKit/win/WebKit.vcproj/WebKitGUIDReleaseCairoCFLite.vsprops
new file mode 100644
index 0000000..bc0b7a1
--- /dev/null
+++ b/Source/WebKit/win/WebKit.vcproj/WebKitGUIDReleaseCairoCFLite.vsprops
@@ -0,0 +1,13 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="WebKitGUIDReleaseCairoCFLite"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefinesCairo.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\WinCairo.vsprops;
+      .\WebKitGUIDCommon.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Source/WebKit/win/WebKit.vcproj/WebKitLibDebug.vsprops b/Source/WebKit/win/WebKit.vcproj/WebKitLibDebug.vsprops
new file mode 100644
index 0000000..0e003e5
--- /dev/null
+++ b/Source/WebKit/win/WebKit.vcproj/WebKitLibDebug.vsprops
@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="WebKitLibDebug"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;
+      .\WebKitLibCommon.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Source/WebKit/win/WebKit.vcproj/WebKitLibDebugAll.vsprops b/Source/WebKit/win/WebKit.vcproj/WebKitLibDebugAll.vsprops
new file mode 100644
index 0000000..005cee7
--- /dev/null
+++ b/Source/WebKit/win/WebKit.vcproj/WebKitLibDebugAll.vsprops
@@ -0,0 +1,13 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="WebKitLibDebugAll"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug_all.vsprops;
+      .\WebKitLibCommon.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Source/WebKit/win/WebKit.vcproj/WebKitLibDebugCairoCFLite.vsprops b/Source/WebKit/win/WebKit.vcproj/WebKitLibDebugCairoCFLite.vsprops
new file mode 100644
index 0000000..355350d
--- /dev/null
+++ b/Source/WebKit/win/WebKit.vcproj/WebKitLibDebugCairoCFLite.vsprops
@@ -0,0 +1,15 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="WebKitLibDebugCairoCFLite"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefinesCairo.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\WinCairo.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug_wincairo.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\cURL.vsprops;
+      .\WebKitLibCommon.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Source/WebKit/win/WebKit.vcproj/WebKitLibProduction.vsprops b/Source/WebKit/win/WebKit.vcproj/WebKitLibProduction.vsprops
new file mode 100644
index 0000000..127707e
--- /dev/null
+++ b/Source/WebKit/win/WebKit.vcproj/WebKitLibProduction.vsprops
@@ -0,0 +1,13 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="WebKitProduction"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\production.vsprops;
+      .\WebKitLibCommon.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Source/WebKit/win/WebKit.vcproj/WebKitLibRelease.vsprops b/Source/WebKit/win/WebKit.vcproj/WebKitLibRelease.vsprops
new file mode 100644
index 0000000..82f6dfd
--- /dev/null
+++ b/Source/WebKit/win/WebKit.vcproj/WebKitLibRelease.vsprops
@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="WebKitLibRelease"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
+      .\WebKitLibCommon.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Source/WebKit/win/WebKit.vcproj/WebKitLibReleaseCairoCFLite.vsprops b/Source/WebKit/win/WebKit.vcproj/WebKitLibReleaseCairoCFLite.vsprops
new file mode 100644
index 0000000..692fdc0
--- /dev/null
+++ b/Source/WebKit/win/WebKit.vcproj/WebKitLibReleaseCairoCFLite.vsprops
@@ -0,0 +1,15 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="WebKitLibReleaseCairoCFLite"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefinesCairo.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\WinCairo.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\WinCairo.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\cURL.vsprops;
+      .\WebKitLibCommon.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Source/WebKit/win/WebKitCOMAPI.h b/Source/WebKit/win/WebKitCOMAPI.h
index 598ac2d..a9e6dad 100644
--- a/Source/WebKit/win/WebKitCOMAPI.h
+++ b/Source/WebKit/win/WebKitCOMAPI.h
@@ -26,6 +26,8 @@
 #ifndef WebKitCOMAPI_h
 #define WebKitCOMAPI_h
 
+#include <unknwn.h>
+
 extern "C" {
 
 // Callers should use this API instead of CoCreateInstance to instantiate WebKit COM classes.
diff --git a/Source/WebKit/win/WebKitClassFactory.h b/Source/WebKit/win/WebKitClassFactory.h
index 90a43c2..85ad843 100644
--- a/Source/WebKit/win/WebKitClassFactory.h
+++ b/Source/WebKit/win/WebKitClassFactory.h
@@ -26,6 +26,8 @@
 #ifndef WebKitClassFactory_H
 #define WebKitClassFactory_H
 
+#include <unknwn.h>
+
 class WebKitClassFactory : public IClassFactory
 {
 public:
diff --git a/Source/WebKit/win/WebKitDLL.cpp b/Source/WebKit/win/WebKitDLL.cpp
index d6a5120..ef85608 100644
--- a/Source/WebKit/win/WebKitDLL.cpp
+++ b/Source/WebKit/win/WebKitDLL.cpp
@@ -38,9 +38,9 @@
 #include <WebCore/SharedBuffer.h>
 #include <WebCore/WebCoreInstanceHandle.h>
 #include <WebCore/Widget.h>
-#include <wtf/Vector.h>
-#include <tchar.h>
 #include <olectl.h>
+#include <wchar.h>
+#include <wtf/Vector.h>
 
 using namespace WebCore;
 
diff --git a/Source/WebKit/win/WebKitGraphics.cpp b/Source/WebKit/win/WebKitGraphics.cpp
index b130002..216b7b7 100644
--- a/Source/WebKit/win/WebKitGraphics.cpp
+++ b/Source/WebKit/win/WebKitGraphics.cpp
@@ -31,7 +31,6 @@
 
 #include "WebPreferences.h"
 
-#pragma warning(push, 0)
 #include <WebCore/Font.h>
 #include <WebCore/FontDescription.h>
 #include <WebCore/FontSelector.h>
@@ -42,7 +41,6 @@
 #include <wtf/unicode/CharacterNames.h>
 
 #include <CoreGraphics/CoreGraphics.h>
-#pragma warning(pop)
 
 #include <WebKitSystemInterface/WebKitSystemInterface.h>
 
diff --git a/Source/WebKit/win/WebKitSystemBits.cpp b/Source/WebKit/win/WebKitSystemBits.cpp
index eec6361..c77a78b 100644
--- a/Source/WebKit/win/WebKitSystemBits.cpp
+++ b/Source/WebKit/win/WebKitSystemBits.cpp
@@ -29,12 +29,9 @@
 #include "config.h"
 #include "WebKitSystemBits.h"
 
-#pragma warning(push, 0)
+#include <CoreFoundation/CoreFoundation.h>
 #include <WebCore/PlatformString.h>
-#pragma warning(pop)
-
 #include <windows.h>
-#include <CoreFoundation/CoreFoundation.h>
 
 unsigned long long WebMemorySize()
 {
diff --git a/Source/WebKit/win/WebLocalizableStrings.cpp b/Source/WebKit/win/WebLocalizableStrings.cpp
index e9b99ad..b05c55e 100644
--- a/Source/WebKit/win/WebLocalizableStrings.cpp
+++ b/Source/WebKit/win/WebLocalizableStrings.cpp
@@ -28,11 +28,9 @@
 
 #include "WebLocalizableStrings.h"
 
-#pragma warning(push, 0)
 #include <WebCore/PlatformString.h>
 #include <wtf/text/CString.h>
 #include <wtf/text/StringHash.h>
-#pragma warning(pop)
 
 #include <wtf/Assertions.h>
 #include <wtf/HashMap.h>
diff --git a/Source/WebKit/win/WebMutableURLRequest.cpp b/Source/WebKit/win/WebMutableURLRequest.cpp
index 02829d7..5aac756 100644
--- a/Source/WebKit/win/WebMutableURLRequest.cpp
+++ b/Source/WebKit/win/WebMutableURLRequest.cpp
@@ -30,17 +30,18 @@
 #include "WebKit.h"
 #include "MarshallingHelpers.h"
 #include "WebKit.h"
-#pragma warning(push, 0)
 #include <WebCore/BString.h>
 #include <WebCore/COMPtr.h>
 #include <WebCore/FormData.h>
 #include <WebCore/NotImplemented.h>
 #include <WebCore/ResourceHandle.h>
 #include <wtf/text/CString.h>
-#pragma warning(pop)
-
 #include <wtf/RetainPtr.h>
 
+#if USE(CF)
+#include <WebCore/CertificateCFWin.h>
+#endif
+
 #if USE(CFNETWORK)
 #include <CFNetwork/CFURLRequestPriv.h>
 #endif
@@ -350,26 +351,6 @@ HRESULT STDMETHODCALLTYPE WebMutableURLRequest::setAllowsAnyHTTPSCertificate(voi
     return S_OK;
 }
 
-static void deallocCertContext(void* ptr, void* info)
-{
-    if (ptr)
-        CertFreeCertificateContext(reinterpret_cast<PCCERT_CONTEXT>(ptr));
-}
-
-static CFDataRef copyCert(PCCERT_CONTEXT cert)
-{
-    static CFAllocatorRef certDealloc;
-    PCCERT_CONTEXT certCopy = 0;
-    if (!certDealloc) {
-        CFAllocatorContext allocContext = {
-            0, 0, 0, 0, 0, 0, 0, deallocCertContext, 0
-        };
-        certDealloc = CFAllocatorCreate(kCFAllocatorDefault, &allocContext);
-    }
-    certCopy = CertDuplicateCertificateContext(cert);
-    return CFDataCreateWithBytesNoCopy(kCFAllocatorDefault, reinterpret_cast<const UInt8*>(certCopy), sizeof(*certCopy), certDealloc);
-}
-
 HRESULT STDMETHODCALLTYPE WebMutableURLRequest::setClientCertificate(
     /* [in] */ OLE_HANDLE cert)
 {
@@ -377,7 +358,7 @@ HRESULT STDMETHODCALLTYPE WebMutableURLRequest::setClientCertificate(
         return E_POINTER;
 
     PCCERT_CONTEXT certContext = reinterpret_cast<PCCERT_CONTEXT>((ULONG64)cert);
-    RetainPtr<CFDataRef> certData(AdoptCF, copyCert(certContext));
+    RetainPtr<CFDataRef> certData = WebCore::copyCertificateToData(certContext);
     ResourceHandle::setClientCertificate(m_request.url().host(), certData.get());
     return S_OK;
 }
diff --git a/Source/WebKit/win/WebMutableURLRequest.h b/Source/WebKit/win/WebMutableURLRequest.h
index 77dc1a0..0f89676 100644
--- a/Source/WebKit/win/WebMutableURLRequest.h
+++ b/Source/WebKit/win/WebMutableURLRequest.h
@@ -27,9 +27,7 @@
 #define WebMutableURLRequest_H
 
 #include "WebKit.h"
-#pragma warning(push, 0)
 #include <WebCore/ResourceRequest.h>
-#pragma warning(pop)
 
 namespace WebCore
 {
diff --git a/Source/WebKit/win/WebNodeHighlight.cpp b/Source/WebKit/win/WebNodeHighlight.cpp
index c4bf181..0e51b1c 100644
--- a/Source/WebKit/win/WebNodeHighlight.cpp
+++ b/Source/WebKit/win/WebNodeHighlight.cpp
@@ -30,14 +30,12 @@
 #include "WebNodeHighlight.h"
 
 #include "WebView.h"
-#pragma warning(push, 0)
 #include <WebCore/BitmapInfo.h>
 #include <WebCore/Color.h>
 #include <WebCore/GraphicsContext.h>
 #include <WebCore/InspectorController.h>
 #include <WebCore/Page.h>
 #include <WebCore/WindowMessageBroadcaster.h>
-#pragma warning(pop)
 #include <wtf/OwnPtr.h>
 #include <wtf/HashSet.h>
 
diff --git a/Source/WebKit/win/WebNodeHighlight.h b/Source/WebKit/win/WebNodeHighlight.h
index de347d3..1d154f9 100644
--- a/Source/WebKit/win/WebNodeHighlight.h
+++ b/Source/WebKit/win/WebNodeHighlight.h
@@ -29,10 +29,7 @@
 #ifndef WebNodeHighlight_h
 #define WebNodeHighlight_h
 
-#pragma warning(push, 0)
 #include <WebCore/WindowMessageListener.h>
-#pragma warning(pop)
-
 #include <windows.h>
 
 class WebView;
diff --git a/Source/WebKit/win/WebNotificationCenter.cpp b/Source/WebKit/win/WebNotificationCenter.cpp
index 6c22224..e30f066 100644
--- a/Source/WebKit/win/WebNotificationCenter.cpp
+++ b/Source/WebKit/win/WebNotificationCenter.cpp
@@ -28,16 +28,14 @@
 #include "WebNotificationCenter.h"
 
 #include "WebNotification.h"
-#pragma warning(push, 0)
 #include <WebCore/COMPtr.h>
 #include <WebCore/PlatformString.h>
 #include <wtf/HashMap.h>
 #include <wtf/HashTraits.h>
 #include <wtf/Vector.h>
 #include <wtf/text/StringHash.h>
-#pragma warning(pop)
-#include <tchar.h>
 #include <utility>
+#include <wchar.h>
 
 using namespace WebCore;
 
diff --git a/Source/WebKit/win/WebPreferences.cpp b/Source/WebKit/win/WebPreferences.cpp
index 01cab2b..a4869b6 100644
--- a/Source/WebKit/win/WebPreferences.cpp
+++ b/Source/WebKit/win/WebPreferences.cpp
@@ -40,7 +40,7 @@
 #include <WebCore/PlatformString.h>
 #include <limits>
 #include <shlobj.h>
-#include <tchar.h>
+#include <wchar.h>
 #include <wtf/HashMap.h>
 #include <wtf/OwnArrayPtr.h>
 #include <wtf/text/CString.h>
@@ -340,12 +340,12 @@ LONGLONG WebPreferences::longlongValueForKey(CFStringRef key)
 void WebPreferences::setStringValue(CFStringRef key, LPCTSTR value)
 {
     BSTR val = stringValueForKey(key);
-    if (val && !_tcscmp(val, value))
+    if (val && !wcscmp(val, value))
         return;
     SysFreeString(val);
     
     RetainPtr<CFStringRef> valueRef(AdoptCF,
-        CFStringCreateWithCharactersNoCopy(0, (UniChar*)_wcsdup(value), (CFIndex)_tcslen(value), kCFAllocatorMalloc));
+        CFStringCreateWithCharactersNoCopy(0, (UniChar*)_wcsdup(value), (CFIndex)wcslen(value), kCFAllocatorMalloc));
     setValueForKey(key, valueRef.get());
 
     postPreferencesChangesNotification();
diff --git a/Source/WebKit/win/WebResource.cpp b/Source/WebKit/win/WebResource.cpp
index 506e55d..ccfd95d 100644
--- a/Source/WebKit/win/WebResource.cpp
+++ b/Source/WebKit/win/WebResource.cpp
@@ -29,10 +29,7 @@
 
 #include "MarshallingHelpers.h"
 #include "MemoryStream.h"
-
-#pragma warning(push, 0)
 #include <WebCore/BString.h>
-#pragma warning(pop)
 
 using namespace WebCore;
 
diff --git a/Source/WebKit/win/WebResource.h b/Source/WebKit/win/WebResource.h
index 7c6759a..611803e 100644
--- a/Source/WebKit/win/WebResource.h
+++ b/Source/WebKit/win/WebResource.h
@@ -28,14 +28,11 @@
 
 #include "WebKit.h"
 #include "COMPtr.h"
-
-#pragma warning(push, 0)
 #include <WebCore/KURL.h>
 #include <WebCore/PlatformString.h>
 #include <WebCore/ResourceResponse.h>
 #include <WebCore/SharedBuffer.h>
 #include <wtf/PassRefPtr.h>
-#pragma warning(pop)
 
 class WebResource : public IWebResource {
 public:
diff --git a/Source/WebKit/win/WebScriptWorld.h b/Source/WebKit/win/WebScriptWorld.h
index 01511de..4b0fa48 100644
--- a/Source/WebKit/win/WebScriptWorld.h
+++ b/Source/WebKit/win/WebScriptWorld.h
@@ -25,6 +25,7 @@
 #ifndef WebScriptWorld_h
 #define WebScriptWorld_h
 
+#include "WebKit.h"
 #include <WebCore/COMPtr.h>
 
 namespace WebCore {
diff --git a/Source/WebKit/win/WebScrollBar.cpp b/Source/WebKit/win/WebScrollBar.cpp
index 9f0131b..224a72a 100644
--- a/Source/WebKit/win/WebScrollBar.cpp
+++ b/Source/WebKit/win/WebScrollBar.cpp
@@ -28,12 +28,10 @@
 #include "WebKit.h"
 #include "WebScrollBar.h"
 
-#pragma warning(push, 0)
 #include <WebCore/GraphicsContext.h>
 #include <WebCore/PlatformMouseEvent.h>
 #include <WebCore/Scrollbar.h>
 #include <WebCore/ScrollbarTheme.h>
-#pragma warning(pop)
 
 using namespace WebCore;
 
@@ -145,6 +143,7 @@ HRESULT STDMETHODCALLTYPE WebScrollBar::setValue(
     /* [in] */ int value)
 {
     m_currentPosition = value;
+    ScrollableArea::scrollToOffsetWithoutAnimation(m_scrollBar->orientation(), m_currentPosition);
     return S_OK;
 }
 
diff --git a/Source/WebKit/win/WebScrollBar.h b/Source/WebKit/win/WebScrollBar.h
index 39457d4..0482419 100644
--- a/Source/WebKit/win/WebScrollBar.h
+++ b/Source/WebKit/win/WebScrollBar.h
@@ -31,11 +31,9 @@
 #include <wtf/RefPtr.h>
 #include <wtf/OwnPtr.h>
 
-#pragma warning(push, 0)
 #include <WebCore/COMPtr.h>
 #include <WebCore/Scrollbar.h>
 #include <WebCore/ScrollableArea.h>
-#pragma warning(pop)
 
 namespace WebCore {
 class Scrollbar;
diff --git a/Source/WebKit/win/WebSerializedJSValue.h b/Source/WebKit/win/WebSerializedJSValue.h
index 6e3747d..61e5617 100644
--- a/Source/WebKit/win/WebSerializedJSValue.h
+++ b/Source/WebKit/win/WebSerializedJSValue.h
@@ -25,6 +25,7 @@
 #ifndef WebSerializedJSValue_h
 #define WebSerializedJSValue_h
 
+#include "WebKit.h"
 #include <WebCore/COMPtr.h>
 
 typedef const struct OpaqueJSContext* JSContextRef;
diff --git a/Source/WebKit/win/WebURLAuthenticationChallenge.cpp b/Source/WebKit/win/WebURLAuthenticationChallenge.cpp
index c711450..1663376 100644
--- a/Source/WebKit/win/WebURLAuthenticationChallenge.cpp
+++ b/Source/WebKit/win/WebURLAuthenticationChallenge.cpp
@@ -35,11 +35,8 @@
 #include "WebURLProtectionSpace.h"
 #include "WebURLResponse.h"
 #include "WebKit.h"
-
-#pragma warning(push, 0)
 #include <WebCore/BString.h>
 #include <WebCore/ResourceHandle.h>
-#pragma warning(pop)
 
 using namespace WebCore;
 
diff --git a/Source/WebKit/win/WebURLAuthenticationChallenge.h b/Source/WebKit/win/WebURLAuthenticationChallenge.h
index d0eba20..dfc5733 100644
--- a/Source/WebKit/win/WebURLAuthenticationChallenge.h
+++ b/Source/WebKit/win/WebURLAuthenticationChallenge.h
@@ -27,11 +27,8 @@
 #define WebURLAuthenticationChallenge_h
 
 #include "WebKit.h"
-
-#pragma warning(push, 0)
 #include <WebCore/AuthenticationChallenge.h>
 #include <WebCore/COMPtr.h>
-#pragma warning(pop)
 
 class DECLSPEC_UUID("FD3B2381-0BB6-4B59-AF09-0E599C8901CF") WebURLAuthenticationChallenge : public IWebURLAuthenticationChallenge {
 public:
diff --git a/Source/WebKit/win/WebURLAuthenticationChallengeSender.cpp b/Source/WebKit/win/WebURLAuthenticationChallengeSender.cpp
index 1257d41..0a9154f 100644
--- a/Source/WebKit/win/WebURLAuthenticationChallengeSender.cpp
+++ b/Source/WebKit/win/WebURLAuthenticationChallengeSender.cpp
@@ -32,10 +32,7 @@
 #include "WebKit.h"
 #include "WebURLAuthenticationChallenge.h"
 #include "WebURLCredential.h"
-
-#pragma warning(push, 0)
 #include <WebCore/AuthenticationClient.h>
-#pragma warning(pop)
 
 using namespace WebCore;
 
diff --git a/Source/WebKit/win/WebURLAuthenticationChallengeSenderCFNet.cpp b/Source/WebKit/win/WebURLAuthenticationChallengeSenderCFNet.cpp
index f756391..3d329d1 100644
--- a/Source/WebKit/win/WebURLAuthenticationChallengeSenderCFNet.cpp
+++ b/Source/WebKit/win/WebURLAuthenticationChallengeSenderCFNet.cpp
@@ -32,10 +32,7 @@
 #include "WebKit.h"
 #include "WebURLAuthenticationChallenge.h"
 #include "WebURLCredential.h"
-
-#pragma warning(push, 0)
 #include <WebCore/AuthenticationClient.h>
-#pragma warning(pop)
 
 using namespace WebCore;
 
diff --git a/Source/WebKit/win/WebURLAuthenticationChallengeSenderCurl.cpp b/Source/WebKit/win/WebURLAuthenticationChallengeSenderCurl.cpp
index 2cf9a75..2f49f67 100644
--- a/Source/WebKit/win/WebURLAuthenticationChallengeSenderCurl.cpp
+++ b/Source/WebKit/win/WebURLAuthenticationChallengeSenderCurl.cpp
@@ -33,10 +33,7 @@
 #include "WebKit.h"
 #include "WebURLAuthenticationChallenge.h"
 #include "WebURLCredential.h"
-
-#pragma warning(push, 0)
 #include <WebCore/ResourceHandle.h>
-#pragma warning(pop)
 
 using namespace WebCore;
 
diff --git a/Source/WebKit/win/WebURLCredential.cpp b/Source/WebKit/win/WebURLCredential.cpp
index 82cf78c..0d9ac34 100644
--- a/Source/WebKit/win/WebURLCredential.cpp
+++ b/Source/WebKit/win/WebURLCredential.cpp
@@ -28,9 +28,7 @@
 #include "WebURLCredential.h"
 
 #include "WebKit.h"
-#pragma warning(push, 0)
 #include <WebCore/BString.h>
-#pragma warning(pop)
 
 using namespace WebCore;
 
diff --git a/Source/WebKit/win/WebURLCredential.h b/Source/WebKit/win/WebURLCredential.h
index 094c966..11f3755 100644
--- a/Source/WebKit/win/WebURLCredential.h
+++ b/Source/WebKit/win/WebURLCredential.h
@@ -27,10 +27,7 @@
 #define WebURLCredential_h
 
 #include "WebKit.h"
-
-#pragma warning(push, 0)
 #include <WebCore/Credential.h>
-#pragma warning(pop)
 
 class WebURLCredential : public IWebURLCredential
 {
diff --git a/Source/WebKit/win/WebURLProtectionSpace.cpp b/Source/WebKit/win/WebURLProtectionSpace.cpp
index 6086abb..98a727e 100644
--- a/Source/WebKit/win/WebURLProtectionSpace.cpp
+++ b/Source/WebKit/win/WebURLProtectionSpace.cpp
@@ -28,9 +28,7 @@
 #include "WebKitDLL.h"
 #include "WebURLProtectionSpace.h"
 
-#pragma warning(push, 0)
 #include <WebCore/BString.h>
-#pragma warning(pop)
 
 using namespace WebCore;
 
diff --git a/Source/WebKit/win/WebURLProtectionSpace.h b/Source/WebKit/win/WebURLProtectionSpace.h
index 579d21b..c1f763f 100644
--- a/Source/WebKit/win/WebURLProtectionSpace.h
+++ b/Source/WebKit/win/WebURLProtectionSpace.h
@@ -27,10 +27,7 @@
 #define WebURLProtectionSpace_h
 
 #include "WebKit.h"
-
-#pragma warning(push, 0)
 #include <WebCore/ProtectionSpace.h>
-#pragma warning(pop)
 
 class WebURLProtectionSpace : public IWebURLProtectionSpace
 {
diff --git a/Source/WebKit/win/WebURLResponse.cpp b/Source/WebKit/win/WebURLResponse.cpp
index 644e1d8..b6c94dd 100644
--- a/Source/WebKit/win/WebURLResponse.cpp
+++ b/Source/WebKit/win/WebURLResponse.cpp
@@ -38,14 +38,12 @@
 #endif
 
 #include <wtf/platform.h>
-#pragma warning( push, 0 )
 #include <WebCore/BString.h>
 #include <WebCore/KURL.h>
 #include <WebCore/ResourceHandle.h>
-#pragma warning( pop )
 #include <shlobj.h>
 #include <shlwapi.h>
-#include <tchar.h>
+#include <wchar.h>
 
 using namespace WebCore;
 
@@ -410,7 +408,7 @@ HRESULT STDMETHODCALLTYPE WebURLResponse::sslPeerCertificate(
     CFDictionaryRef dict = certificateDictionary();
     if (!dict)
         return E_FAIL;
-    void* data = wkGetSSLPeerCertificateData(dict);
+    void* data = wkGetSSLPeerCertificateDataBytePtr(dict);
     if (!data)
         return E_FAIL;
     *result = (OLE_HANDLE)(ULONG64)data;
@@ -439,21 +437,21 @@ HRESULT WebURLResponse::suggestedFileExtension(BSTR *result)
         err = RegOpenKeyEx(key, mimeType, 0, KEY_QUERY_VALUE, &subKey);
         if (!err) {
             DWORD keyType = REG_SZ;
-            TCHAR extension[MAX_PATH];
+            WCHAR extension[MAX_PATH];
             DWORD keySize = sizeof(extension)/sizeof(extension[0]);
             err = RegQueryValueEx(subKey, TEXT("Extension"), 0, &keyType, (LPBYTE)extension, &keySize);
             if (!err && keyType != REG_SZ)
                 err = ERROR_INVALID_DATA;
             if (err) {
                 // fallback handlers
-                if (!_tcscmp(mimeType, TEXT("text/html"))) {
-                    _tcscpy(extension, TEXT(".html"));
+                if (!wcscmp(mimeType, L"text/html")) {
+                    wcscpy(extension, L".html");
                     err = 0;
-                } else if (!_tcscmp(mimeType, TEXT("application/xhtml+xml"))) {
-                    _tcscpy(extension, TEXT(".xhtml"));
+                } else if (!wcscmp(mimeType, L"application/xhtml+xml")) {
+                    wcscpy(extension, L".xhtml");
                     err = 0;
-                } else if (!_tcscmp(mimeType, TEXT("image/svg+xml"))) {
-                    _tcscpy(extension, TEXT(".svg"));
+                } else if (!wcscmp(mimeType, L"image/svg+xml")) {
+                    wcscpy(extension, L".svg");
                     err = 0;
                 }
             }
diff --git a/Source/WebKit/win/WebURLResponse.h b/Source/WebKit/win/WebURLResponse.h
index 761ca8e..8e82a2b 100644
--- a/Source/WebKit/win/WebURLResponse.h
+++ b/Source/WebKit/win/WebURLResponse.h
@@ -27,10 +27,7 @@
 #define WebURLResponse_H
 
 #include "WebKit.h"
-
-#pragma warning(push, 0)
 #include <WebCore/ResourceResponse.h>
-#pragma warning(pop)
 
 class WebURLResponse : public IWebHTTPURLResponse, IWebURLResponsePrivate
 {
diff --git a/Source/WebKit/win/WebUserContentURLPattern.h b/Source/WebKit/win/WebUserContentURLPattern.h
index 42854b4..8864093 100644
--- a/Source/WebKit/win/WebUserContentURLPattern.h
+++ b/Source/WebKit/win/WebUserContentURLPattern.h
@@ -25,6 +25,7 @@
 #ifndef WebUserContentURLPattern_h
 #define WebUserContentURLPattern_h
 
+#include "WebKit.h"
 #include <WebCore/COMPtr.h>
 #include <WebCore/UserContentURLPattern.h>
 
diff --git a/Source/WebKit/win/WebView.cpp b/Source/WebKit/win/WebView.cpp
index 0fb8047..69f83de 100644
--- a/Source/WebKit/win/WebView.cpp
+++ b/Source/WebKit/win/WebView.cpp
@@ -128,6 +128,7 @@
 #include <WebCore/SelectionController.h>
 #include <WebCore/Settings.h>
 #include <WebCore/SimpleFontData.h>
+#include <WebCore/SystemInfo.h>
 #include <WebCore/TypingCommand.h>
 #include <WebCore/WindowMessageBroadcaster.h>
 #include <wtf/Threading.h>
@@ -161,7 +162,7 @@
 #include <comutil.h>
 #include <dimm.h>
 #include <oleacc.h>
-#include <tchar.h>
+#include <wchar.h>
 #include <windowsx.h>
 #include <wtf/HashSet.h>
 #include <wtf/text/CString.h>
@@ -184,8 +185,7 @@ using JSC::JSLock;
 static HMODULE accessibilityLib;
 static HashSet<WebView*> pendingDeleteBackingStoreSet;
 
-static String osVersion();
-static String webKitVersion();
+static String webKitVersionString();
 
 WebView* kit(Page* page)
 {
@@ -1244,9 +1244,10 @@ bool WebView::canHandleRequest(const WebCore::ResourceRequest& request)
 
 String WebView::standardUserAgentWithApplicationName(const String& applicationName)
 {
-    if (applicationName.isEmpty())
-        return makeString("Mozilla/5.0 (", osVersion(), ") AppleWebKit/", webKitVersion(), " (KHTML, like Gecko)");
-    return makeString("Mozilla/5.0 (", osVersion(), ") AppleWebKit/", webKitVersion(), " (KHTML, like Gecko) ", applicationName);
+    DEFINE_STATIC_LOCAL(String, osVersion, (windowsVersionForUAString()));
+    DEFINE_STATIC_LOCAL(String, webKitVersion, (webKitVersionString()));
+
+    return makeString("Mozilla/5.0 (", osVersion, ") AppleWebKit/", webKitVersion, " (KHTML, like Gecko)", applicationName.isEmpty() ? "" : " ", applicationName);
 }
 
 Page* WebView::page()
@@ -1675,12 +1676,12 @@ bool WebView::mouseWheel(WPARAM wParam, LPARAM lParam, bool isMouseHWheel)
     HWND focusedWindow = GetFocus();
     if (focusedWindow && focusedWindow != m_viewWindow) {
         // Our focus is on a different hwnd, see if it's a PopupMenu and if so, set the focus back on us (which will hide the popup).
-        TCHAR className[256];
+        WCHAR className[256];
 
         // Make sure truncation won't affect the comparison.
-        ASSERT(WTF_ARRAY_LENGTH(className) > _tcslen(PopupMenuWin::popupClassName()));
+        ASSERT(WTF_ARRAY_LENGTH(className) > wcslen(PopupMenuWin::popupClassName()));
 
-        if (GetClassName(focusedWindow, className, WTF_ARRAY_LENGTH(className)) && !_tcscmp(className, PopupMenuWin::popupClassName())) {
+        if (GetClassNameW(focusedWindow, className, WTF_ARRAY_LENGTH(className)) && !wcscmp(className, PopupMenuWin::popupClassName())) {
             // We don't let the WebView scroll here for two reasons - 1) To match Firefox behavior, 2) If we do scroll, we lose the
             // focus ring around the select menu.
             SetFocus(m_viewWindow);
@@ -2336,31 +2337,7 @@ bool WebView::developerExtrasEnabled() const
 #endif
 }
 
-static String osVersion()
-{
-    String osVersion;
-    OSVERSIONINFO versionInfo = {0};
-    versionInfo.dwOSVersionInfoSize = sizeof(versionInfo);
-    GetVersionEx(&versionInfo);
-
-    if (versionInfo.dwPlatformId == VER_PLATFORM_WIN32_WINDOWS) {
-        if (versionInfo.dwMajorVersion == 4) {
-            if (versionInfo.dwMinorVersion == 0)
-                osVersion = "Windows 95";
-            else if (versionInfo.dwMinorVersion == 10)
-                osVersion = "Windows 98";
-            else if (versionInfo.dwMinorVersion == 90)
-                osVersion = "Windows 98; Win 9x 4.90";
-        }
-    } else if (versionInfo.dwPlatformId == VER_PLATFORM_WIN32_NT)
-        osVersion = makeString("Windows NT ", String::number(versionInfo.dwMajorVersion), '.', String::number(versionInfo.dwMinorVersion));
-
-    if (!osVersion.length())
-        osVersion = makeString("Windows ", String::number(versionInfo.dwMajorVersion), '.', String::number(versionInfo.dwMinorVersion));
-    return osVersion;
-}
-
-static String webKitVersion()
+static String webKitVersionString()
 {
     LPWSTR buildNumberStringPtr;
     if (!::LoadStringW(gInstance, BUILD_NUMBER, reinterpret_cast<LPWSTR>(&buildNumberStringPtr), 0) || !buildNumberStringPtr)
@@ -2523,15 +2500,15 @@ bool WebView::shouldInitializeTrackPointHack()
         return shouldCreateScrollbars;
 
     hasRunTrackPointCheck = true;
-    const TCHAR trackPointKeys[][50] = { TEXT("Software\\Lenovo\\TrackPoint"),
-        TEXT("Software\\Lenovo\\UltraNav"),
-        TEXT("Software\\Alps\\Apoint\\TrackPoint"),
-        TEXT("Software\\Synaptics\\SynTPEnh\\UltraNavUSB"),
-        TEXT("Software\\Synaptics\\SynTPEnh\\UltraNavPS2") };
+    const WCHAR trackPointKeys[][50] = { L"Software\\Lenovo\\TrackPoint",
+        L"Software\\Lenovo\\UltraNav",
+        L"Software\\Alps\\Apoint\\TrackPoint",
+        L"Software\\Synaptics\\SynTPEnh\\UltraNavUSB",
+        L"Software\\Synaptics\\SynTPEnh\\UltraNavPS2" };
 
     for (int i = 0; i < 5; ++i) {
         HKEY trackPointKey;
-        int readKeyResult = ::RegOpenKeyEx(HKEY_CURRENT_USER, trackPointKeys[i], 0, KEY_READ, &trackPointKey);
+        int readKeyResult = ::RegOpenKeyExW(HKEY_CURRENT_USER, trackPointKeys[i], 0, KEY_READ, &trackPointKey);
         ::RegCloseKey(trackPointKey);
         if (readKeyResult == ERROR_SUCCESS) {
             shouldCreateScrollbars = true;
@@ -2562,8 +2539,8 @@ HRESULT STDMETHODCALLTYPE WebView::initWithFrame(
         // If we detected a registry key belonging to a TrackPoint driver, then create fake trackpoint
         // scrollbars, so the WebView will receive WM_VSCROLL and WM_HSCROLL messages. We create one
         // vertical scrollbar and one horizontal to allow for receiving both types of messages.
-        ::CreateWindow(TEXT("SCROLLBAR"), TEXT("FAKETRACKPOINTHSCROLLBAR"), WS_CHILD | WS_VISIBLE | SBS_HORZ, 0, 0, 0, 0, m_viewWindow, 0, gInstance, 0);
-        ::CreateWindow(TEXT("SCROLLBAR"), TEXT("FAKETRACKPOINTVSCROLLBAR"), WS_CHILD | WS_VISIBLE | SBS_VERT, 0, 0, 0, 0, m_viewWindow, 0, gInstance, 0);
+        ::CreateWindowW(L"SCROLLBAR", L"FAKETRACKPOINTHSCROLLBAR", WS_CHILD | WS_VISIBLE | SBS_HORZ, 0, 0, 0, 0, m_viewWindow, 0, gInstance, 0);
+        ::CreateWindowW(L"SCROLLBAR", L"FAKETRACKPOINTVSCROLLBAR", WS_CHILD | WS_VISIBLE | SBS_VERT, 0, 0, 0, 0, m_viewWindow, 0, gInstance, 0);
     }
 
     hr = registerDragDrop();
@@ -3050,7 +3027,7 @@ HRESULT STDMETHODCALLTYPE WebView::setCustomTextEncodingName(
     if (FAILED(hr))
         return hr;
 
-    if (oldEncoding != encodingName && (!oldEncoding || !encodingName || _tcscmp(oldEncoding, encodingName))) {
+    if (oldEncoding != encodingName && (!oldEncoding || !encodingName || wcscmp(oldEncoding, encodingName))) {
         if (Frame* coreFrame = core(m_mainFrame))
             coreFrame->loader()->reloadWithOverrideEncoding(String(encodingName, SysStringLen(encodingName)));
     }
@@ -5271,7 +5248,7 @@ const IMMDict& IMMDict::dict()
 
 IMMDict::IMMDict()
 {
-    m_instance = ::LoadLibrary(TEXT("IMM32.DLL"));
+    m_instance = ::LoadLibraryW(L"IMM32.DLL");
     getContext = reinterpret_cast<getContextPtr>(::GetProcAddress(m_instance, "ImmGetContext"));
     ASSERT(getContext);
     releaseContext = reinterpret_cast<releaseContextPtr>(::GetProcAddress(m_instance, "ImmReleaseContext"));
@@ -5928,7 +5905,7 @@ bool WebView::onGetObject(WPARAM wParam, LPARAM lParam, LRESULT& lResult) const
         return false;
 
     if (!accessibilityLib) {
-        if (!(accessibilityLib = ::LoadLibrary(TEXT("oleacc.dll"))))
+        if (!(accessibilityLib = ::LoadLibraryW(L"oleacc.dll")))
             return false;
     }
 
diff --git a/Source/WebKit/wince/CMakeListsWinCE.txt b/Source/WebKit/wince/CMakeListsWinCE.txt
index 28feaf3..de6de60 100644
--- a/Source/WebKit/wince/CMakeListsWinCE.txt
+++ b/Source/WebKit/wince/CMakeListsWinCE.txt
@@ -1,6 +1,7 @@
 LIST(APPEND WebKit_INCLUDE_DIRECTORIES
     "${WEBCORE_DIR}/page/win"
     "${WEBCORE_DIR}/platform/graphics/wince"
+    "${WEBCORE_DIR}/platform/graphics/win"
     "${WEBCORE_DIR}/platform/network/win"
     "${WEBCORE_DIR}/platform/win"
 
diff --git a/Source/WebKit/wince/ChangeLog b/Source/WebKit/wince/ChangeLog
index 724b92a..e595f25 100644
--- a/Source/WebKit/wince/ChangeLog
+++ b/Source/WebKit/wince/ChangeLog
@@ -1,3 +1,61 @@
+2011-03-27  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Andreas Kling.
+
+        [WINCE] Use a appropriate user agent string
+        https://bugs.webkit.org/show_bug.cgi?id=57175
+
+        * WebCoreSupport/FrameLoaderClientWinCE.cpp:
+        (WebKit::FrameLoaderClientWinCE::userAgent):
+
+2011-03-26  Patrick Gansterer  <paroga@webkit.org>
+
+        Unreviewed WinCE build fix.
+
+        * CMakeListsWinCE.txt: Added missing include directory.
+
+2011-03-25  Andy Estes  <aestes@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        REGRESSION (r70748): latest nightly builds kills AC_QuickTime.js
+        https://bugs.webkit.org/show_bug.cgi?id=49016
+
+        Update objectContentType() implementation to handle the
+        shouldPreferPlugInsForImages flag.
+
+        * WebCoreSupport/FrameLoaderClientWinCE.cpp:
+        (WebKit::FrameLoaderClientWinCE::objectContentType):
+        * WebCoreSupport/FrameLoaderClientWinCE.h:
+
+2011-03-24  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r81916 and r81917.
+        http://trac.webkit.org/changeset/81916
+        http://trac.webkit.org/changeset/81917
+        https://bugs.webkit.org/show_bug.cgi?id=57071
+
+        broke a test on platforms that do not have QuickTime installed
+        (Requested by estes on #webkit).
+
+        * WebCoreSupport/FrameLoaderClientWinCE.cpp:
+        (WebKit::FrameLoaderClientWinCE::objectContentType):
+        * WebCoreSupport/FrameLoaderClientWinCE.h:
+
+2011-03-24  Andy Estes  <aestes@apple.com>
+
+        Reviewed by Darin Adler.
+
+        REGRESSION (r70748): latest nightly builds kills AC_QuickTime.js
+        https://bugs.webkit.org/show_bug.cgi?id=49016
+
+        Update objectContentType() implementation to handle the
+        shouldPreferPlugInsForImages flag.
+
+        * WebCoreSupport/FrameLoaderClientWinCE.cpp:
+        (WebKit::FrameLoaderClientWinCE::objectContentType):
+        * WebCoreSupport/FrameLoaderClientWinCE.h:
+
 2011-03-07  Sam Weinig  <sam@webkit.org>
 
         Reviewed by Anders Carlsson.
diff --git a/Source/WebKit/wince/WebCoreSupport/FrameLoaderClientWinCE.cpp b/Source/WebKit/wince/WebCoreSupport/FrameLoaderClientWinCE.cpp
index 3fbed2b..2d8812f 100644
--- a/Source/WebKit/wince/WebCoreSupport/FrameLoaderClientWinCE.cpp
+++ b/Source/WebKit/wince/WebCoreSupport/FrameLoaderClientWinCE.cpp
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2010 Patrick Gansterer <paroga@paroga.com>
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -35,7 +36,10 @@
 #include "Page.h"
 #include "PluginDatabase.h"
 #include "RenderPart.h"
+#include "SystemInfo.h"
+#include "WebKitVersion.h"
 #include "WebView.h"
+#include <wtf/text/StringConcatenate.h>
 
 using namespace WebCore;
 
@@ -54,7 +58,14 @@ FrameLoaderClientWinCE::~FrameLoaderClientWinCE()
 
 String FrameLoaderClientWinCE::userAgent(const KURL&)
 {
-    return "WebKitWinCE";
+    DEFINE_STATIC_LOCAL(String, userAgentString, ());
+
+    if (userAgentString.isNull()) {
+        String webKitVersion = String::format("%d.%d", WEBKIT_MAJOR_VERSION, WEBKIT_MINOR_VERSION);
+        userAgentString = makeString("Mozilla/5.0 (", windowsVersionForUAString(), ") AppleWebKit/", webKitVersion, " (KHTML, like Gecko) Mobile Safari/", webKitVersion);
+    }
+
+    return userAgentString;
 }
 
 PassRefPtr<DocumentLoader> FrameLoaderClientWinCE::createDocumentLoader(const WebCore::ResourceRequest& request, const SubstituteData& substituteData)
@@ -182,9 +193,9 @@ PassRefPtr<Widget> FrameLoaderClientWinCE::createJavaAppletWidget(const IntSize&
     return 0;
 }
 
-ObjectContentType FrameLoaderClientWinCE::objectContentType(const KURL& url, const String& mimeType)
+ObjectContentType FrameLoaderClientWinCE::objectContentType(const KURL& url, const String& mimeType, bool shouldPreferPlugInsForImages)
 {
-    return FrameLoader::defaultObjectContentType(url, mimeType);
+    return FrameLoader::defaultObjectContentType(url, mimeType, shouldPreferPlugInsForImages);
 }
 
 String FrameLoaderClientWinCE::overrideMediaType() const
diff --git a/Source/WebKit/wince/WebCoreSupport/FrameLoaderClientWinCE.h b/Source/WebKit/wince/WebCoreSupport/FrameLoaderClientWinCE.h
index ce3a620..401225d 100644
--- a/Source/WebKit/wince/WebCoreSupport/FrameLoaderClientWinCE.h
+++ b/Source/WebKit/wince/WebCoreSupport/FrameLoaderClientWinCE.h
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2010 Patrick Gansterer <paroga@paroga.com>
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -120,7 +121,7 @@ public:
 
     virtual void registerForIconNotification(bool);
 
-    virtual WebCore::ObjectContentType objectContentType(const WebCore::KURL& url, const WTF::String& mimeType);
+    virtual WebCore::ObjectContentType objectContentType(const WebCore::KURL&, const WTF::String& mimeType, bool shouldPreferPlugInsForImages);
 
     virtual void setMainFrameDocumentReady(bool);
 
diff --git a/Source/WebKit/wince/WebCoreSupport/PlatformStrategiesWinCE.cpp b/Source/WebKit/wince/WebCoreSupport/PlatformStrategiesWinCE.cpp
index fc447ab..455da71 100644
--- a/Source/WebKit/wince/WebCoreSupport/PlatformStrategiesWinCE.cpp
+++ b/Source/WebKit/wince/WebCoreSupport/PlatformStrategiesWinCE.cpp
@@ -289,7 +289,7 @@ String PlatformStrategiesWinCE::contextMenuItemTagSearchWeb()
     return UI_STRING("Search with Google", "Search in Google context menu item");
 }
 
-String PlatformStrategiesWinCE::contextMenuItemTagLookUpInDictionary()
+String PlatformStrategiesWinCE::contextMenuItemTagLookUpInDictionary(const String&)
 {
     return UI_STRING("Look Up in Dictionary", "Look Up in Dictionary context menu item");
 }
diff --git a/Source/WebKit/wince/WebCoreSupport/PlatformStrategiesWinCE.h b/Source/WebKit/wince/WebCoreSupport/PlatformStrategiesWinCE.h
index e5f87ea..6ed49ae 100644
--- a/Source/WebKit/wince/WebCoreSupport/PlatformStrategiesWinCE.h
+++ b/Source/WebKit/wince/WebCoreSupport/PlatformStrategiesWinCE.h
@@ -78,7 +78,7 @@ private:
     virtual WTF::String contextMenuItemTagIgnoreSpelling();
     virtual WTF::String contextMenuItemTagLearnSpelling();
     virtual WTF::String contextMenuItemTagSearchWeb();
-    virtual WTF::String contextMenuItemTagLookUpInDictionary();
+    virtual WTF::String contextMenuItemTagLookUpInDictionary(const String&);
     virtual WTF::String contextMenuItemTagOpenLink();
     virtual WTF::String contextMenuItemTagIgnoreGrammar();
     virtual WTF::String contextMenuItemTagSpellingMenu();
diff --git a/Source/WebKit/wx/ChangeLog b/Source/WebKit/wx/ChangeLog
index 3e385b1..980fa8a 100644
--- a/Source/WebKit/wx/ChangeLog
+++ b/Source/WebKit/wx/ChangeLog
@@ -1,3 +1,80 @@
+2011-03-25  Andy Estes  <aestes@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        REGRESSION (r70748): latest nightly builds kills AC_QuickTime.js
+        https://bugs.webkit.org/show_bug.cgi?id=49016
+
+        Update objectContentType() implementation to handle the
+        shouldPreferPlugInsForImages flag.
+
+        * WebKitSupport/FrameLoaderClientWx.cpp:
+        (WebCore::FrameLoaderClientWx::objectContentType):
+        * WebKitSupport/FrameLoaderClientWx.h:
+
+2011-03-24  Kevin Ollivier  <kevino@theolliviers.com>
+
+        [wx] Build fix, remove old call and replace it with correct one.
+
+        * WebView.cpp:
+        (wxWebView::Create):
+
+2011-03-24  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r81916 and r81917.
+        http://trac.webkit.org/changeset/81916
+        http://trac.webkit.org/changeset/81917
+        https://bugs.webkit.org/show_bug.cgi?id=57071
+
+        broke a test on platforms that do not have QuickTime installed
+        (Requested by estes on #webkit).
+
+        * WebKitSupport/FrameLoaderClientWx.cpp:
+        (WebCore::FrameLoaderClientWx::objectContentType):
+        * WebKitSupport/FrameLoaderClientWx.h:
+
+2011-03-24  Andy Estes  <aestes@apple.com>
+
+        Reviewed by Darin Adler.
+
+        REGRESSION (r70748): latest nightly builds kills AC_QuickTime.js
+        https://bugs.webkit.org/show_bug.cgi?id=49016
+
+        Update objectContentType() implementation to handle the
+        shouldPreferPlugInsForImages flag.
+
+        * WebKitSupport/FrameLoaderClientWx.cpp:
+        (WebCore::FrameLoaderClientWx::objectContentType):
+        * WebKitSupport/FrameLoaderClientWx.h:
+
+2011-03-21  Chang Shu  <cshu@webkit.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        REGRESSION (r79953): Can't type in MS Outlook 2011
+        https://bugs.webkit.org/show_bug.cgi?id=56665
+
+        r79953 removed the WebView level editablity which is persistent no matter whether
+        underlying document itself is changed and editability gets lost. The resolution is to
+        set this WebView editable value to WebCore. This avoids the callback from WebCore to
+        WebKit which was the main goal in r79953 to improve performance.
+
+        * WebFrame.cpp:
+        (wxWebFrame::MakeEditable):
+        (wxWebFrame::IsEditable):
+
+2011-03-15  Kevin Ollivier  <kevino@theolliviers.com>
+
+        Reviewed by Darin Adler.
+
+        Introduce WTF_USE_EXPORT_MACROS, which will allow us to put shared library import/export
+        info into the headers rather than in export symbol definition files, but disable it on 
+        all platforms initially so we can deal with port build issues one port at a time.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=27551
+
+        * bindings/python/webview.i:
+
 2011-03-07  Sam Weinig  <sam@webkit.org>
 
         Reviewed by Anders Carlsson.
diff --git a/Source/WebKit/wx/WebFrame.cpp b/Source/WebKit/wx/WebFrame.cpp
index e32d300..86bf660 100644
--- a/Source/WebKit/wx/WebFrame.cpp
+++ b/Source/WebKit/wx/WebFrame.cpp
@@ -402,14 +402,14 @@ void wxWebFrame::ResetTextSize()
 
 void wxWebFrame::MakeEditable(bool enable)
 {
-    if (enable != IsEditable() && m_impl->frame && m_impl->frame->document())
-        m_impl->frame->document()->setDesignMode(enable ? WebCore::Document::on : WebCore::Document::off);
+    if (enable != IsEditable() && m_impl->frame && m_impl->frame->page())
+        m_impl->frame->page()->setEditable(enable);
 }
 
 bool wxWebFrame::IsEditable() const
 {
-    if (m_impl->frame && m_impl->frame->document())
-        return m_impl->frame->document()->inDesignMode();
+    if (m_impl->frame && m_impl->frame->page())
+        return m_impl->frame->page()->isEditable();
     return false;
 }
 
diff --git a/Source/WebKit/wx/WebKitSupport/FrameLoaderClientWx.cpp b/Source/WebKit/wx/WebKitSupport/FrameLoaderClientWx.cpp
index 68e1e70..afc255c 100644
--- a/Source/WebKit/wx/WebKitSupport/FrameLoaderClientWx.cpp
+++ b/Source/WebKit/wx/WebKitSupport/FrameLoaderClientWx.cpp
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2007 Kevin Ollivier <kevino@theolliviers.com>
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
  *
  * All rights reserved.
  *
@@ -870,7 +871,7 @@ void FrameLoaderClientWx::transferLoadingResourceFromPage(unsigned long, Documen
 {
 }
 
-ObjectContentType FrameLoaderClientWx::objectContentType(const KURL& url, const String& mimeType)
+ObjectContentType FrameLoaderClientWx::objectContentType(const KURL& url, const String& mimeType, bool shouldPreferPlugInsForImages)
 {
     notImplemented();
     return ObjectContentType();
diff --git a/Source/WebKit/wx/WebKitSupport/FrameLoaderClientWx.h b/Source/WebKit/wx/WebKitSupport/FrameLoaderClientWx.h
index 8f1e69e..254f95c 100644
--- a/Source/WebKit/wx/WebKitSupport/FrameLoaderClientWx.h
+++ b/Source/WebKit/wx/WebKitSupport/FrameLoaderClientWx.h
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2007 Kevin Ollivier <kevino@theolliviers.com>
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
  *
  * All rights reserved.
  *
@@ -217,7 +218,7 @@ namespace WebCore {
         
         virtual PassRefPtr<Widget> createJavaAppletWidget(const IntSize&, HTMLAppletElement*, const KURL& baseURL, const Vector<String>& paramNames, const Vector<String>& paramValues);
 
-        virtual ObjectContentType objectContentType(const KURL& url, const String& mimeType);
+        virtual ObjectContentType objectContentType(const KURL&, const String& mimeType, bool shouldPreferPlugInsForImages);
         virtual String overrideMediaType() const;
 
         virtual void dispatchDidClearWindowObjectInWorld(DOMWrapperWorld*);
diff --git a/Source/WebKit/wx/WebView.cpp b/Source/WebKit/wx/WebView.cpp
index 3215b7a..dab3225 100644
--- a/Source/WebKit/wx/WebView.cpp
+++ b/Source/WebKit/wx/WebView.cpp
@@ -71,6 +71,7 @@
 
 #include "ScriptController.h"
 #include "JSDOMBinding.h"
+#include <runtime/initializeThreading.h>
 #include <runtime/JSValue.h>
 #include <runtime/UString.h>
 #include <wtf/text/CString.h>
@@ -358,7 +359,7 @@ bool wxWebView::Create(wxWindow* parent, int id, const wxPoint& position,
     if (!wxWindow::Create(parent, id, position, size, style, name))
         return false;
 
-    WTF::initializeThreading();
+    JSC::initializeThreading();
     WTF::initializeMainThread();
 
 // This is necessary because we are using SharedTimerWin.cpp on Windows,
diff --git a/Source/WebKit/wx/bindings/python/webview.i b/Source/WebKit/wx/bindings/python/webview.i
index f1621b0..118aed1 100644
--- a/Source/WebKit/wx/bindings/python/webview.i
+++ b/Source/WebKit/wx/bindings/python/webview.i
@@ -49,6 +49,7 @@
 #include "WebDOMNodeList.h"
 #include "WebDOMObject.h"
 #include "WebDOMRange.h"
+#include "WebDOMWebKitAnimationList.h"
 
 #ifndef __WXMSW__
 PyObject* createDOMNodeSubtype(WebDOMNode* ptr, bool setThisOwn, bool isValueObject)
diff --git a/Source/WebKit2/ChangeLog b/Source/WebKit2/ChangeLog
index 3ade49a..bacf704 100644
--- a/Source/WebKit2/ChangeLog
+++ b/Source/WebKit2/ChangeLog
@@ -1,3 +1,4871 @@
+2011-03-30  Ivan Krstić  <ike@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Ensure consistent, readable working directory for WebProcess before entering sandbox
+        <rdar://problem/8951176>
+
+        * WebProcess/mac/WebProcessMac.mm:
+        (WebKit::WebProcess::platformInitializeWebProcess):
+
+2011-03-30  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Brady Eidson.
+
+        WebKit2: Attempting to view css file from url causes it to download
+        <rdar://problem/9102611>
+        https://bugs.webkit.org/show_bug.cgi?id=57501
+
+        * UIProcess/WebPageProxy.cpp:
+        (WebKit::WebPageProxy::canShowMIMEType):
+        Match WebKit1 by allowing any MIME type that starts with "text/"
+        except the ones we explicitly blacklist.
+
+2011-03-30  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Update Windows production build logic for new production configurations
+        https://bugs.webkit.org/show_bug.cgi?id=57494
+
+        * win/WebKit2.make:
+        * win/WebKit2Production.vsprops:
+        * win/WebKit2WebProcessProduction.vsprops:
+
+2011-03-30  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Rename Windows configuration Release_LTCG to Production for clarity
+        https://bugs.webkit.org/show_bug.cgi?id=57465
+
+        * win/WebKit2.submit.sln:
+        * win/WebKit2.vcproj:
+        * win/WebKit2Generated.vcproj:
+        * win/WebKit2Production.vsprops: Copied from Source/WebKit2/win/WebKit2ReleaseLTCG.vsprops.
+        * win/WebKit2ReleaseLTCG.vsprops: Removed.
+        * win/WebKit2WebProcess.vcproj:
+        * win/WebKit2WebProcessProduction.vsprops: Copied from Source/WebKit2/win/WebKit2WebProcessReleaseLTCG.vsprops.
+        * win/WebKit2WebProcessReleaseLTCG.vsprops: Removed.
+
+2011-03-30  Jer Noble  <jer.noble@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        WebKit2: WebProcess is using 89%, while viewing a PDF
+        https://bugs.webkit.org/show_bug.cgi?id=57471
+
+        Break a never ending display/update cycle between the UIProcess and the WebProcess
+        by clearing the dirty region when a page has a custom representation (like a PDF).
+        Also, avoid the issue where possible by not setting the dirty region in the same case.
+
+        * WebProcess/WebPage/DrawingAreaImpl.cpp:
+        (WebKit::DrawingAreaImpl::setNeedsDisplay): Bail early if mainFrameHasCustomRepresentation().
+        (WebKit::DrawingAreaImpl::scroll): Ditto.
+        (WebKit::DrawingAreaImpl::display): Both bail early and clear m_dirtyRegion if 
+            mainFrameHasCustomRepresentation().
+
+2011-03-30  Sam Weinig  <sam@webkit.org>
+
+        Fix Snow Leopard build.
+
+        * UIProcess/mac/WebContextMenuProxyMac.mm:
+        (WebKit::WebContextMenuProxyMac::showContextMenu):
+
+2011-03-30  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        WebKit2 contextual menu looks different than the rest of the OS
+        <rdar://problem/9172935>
+        https://bugs.webkit.org/show_bug.cgi?id=57475
+
+        * UIProcess/mac/WebContextMenuProxyMac.mm:
+        (WebKit::WebContextMenuProxyMac::showContextMenu):
+        Use correct SPI for showing a context menu. The dummy view is also
+        not necessary, so remove it.
+
+2011-03-30  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Crash when NPN_Evaluate removes the plug-in frame
+        https://bugs.webkit.org/show_bug.cgi?id=57474
+        <rdar://problem/9191396>
+
+        Get a reference to the frame since it can be nulled out if running the JavaScript code
+        causes the plug-in's containing frame to be removed from the frame tree.
+
+        * WebProcess/Plugins/PluginView.cpp:
+        (WebKit::PluginView::evaluate):
+
+2011-03-30  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Add default localization strategy that can be shared by WebKit1 and WebKit2
+        https://bugs.webkit.org/show_bug.cgi?id=57406
+
+        * Shared/WebLocalizableStrings.h: Removed.
+        Removed in favor of using WebCore/LocalizedStrings.h directly.
+
+        * PluginProcess/mac/PluginProcessMac.mm:
+        * UIProcess/API/mac/WKView.mm:
+        * UIProcess/mac/WebInspectorProxyMac.mm:
+        * WebProcess/WebCoreSupport/mac/WebErrorsMac.mm:
+        * WebProcess/mac/WebProcessMac.mm:
+        Use WebCore/LocalizedStrings.h directly.
+
+        * WebProcess/WebCoreSupport/WebPlatformStrategies.cpp:
+        * WebProcess/WebCoreSupport/WebPlatformStrategies.h:
+        Remove localization strategy override in favor of using new default implementation.
+
+        * GNUmakefile.am:
+        * WebKit2.pro:
+        * WebKit2.xcodeproj/project.pbxproj:
+        * win/WebKit2.vcproj:
+        Remove WebLocalizableStrings.h
+
+2011-03-30  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Assertion failure in plug-in process when calling WKPluginSiteDataManagerGetSitesWithData
+        https://bugs.webkit.org/show_bug.cgi?id=57468
+        <rdar://problem/9199089>
+
+        Call decrementLoadCount from removeWebProcessConnection instead of startShutdownTimerIfNecessary,
+        otherwise we'll get a load count underflow when a connection is never created.
+
+        * PluginProcess/PluginProcess.cpp:
+        (WebKit::PluginProcess::removeWebProcessConnection):
+        (WebKit::PluginProcess::createWebProcessConnection):
+        (WebKit::PluginProcess::startShutdownTimerIfNecessary):
+
+2011-03-30  Jessie Berlin  <jberlin@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        WebKit2: Make sure to try to terminate the Web Process when any work that might require the
+        Web Process to be relaunched is done
+        https://bugs.webkit.org/show_bug.cgi?id=57462
+
+        For the ManagerProxies in the UIProcess, only return true from shouldTerminate if there are
+        no more callbacks waiting to be invoked.
+
+        For the the Managers in the WebProcess, call WebProcess::shared().terminateIfPossible() when
+        any work called for by a ManagerProxy function that called relaunchProcessIfNecessary is
+        finished.
+
+        * UIProcess/WebContext.cpp:
+        (WebKit::WebContext::shouldTerminate):
+        Check with each of the ManagerProxies.
+
+        * UIProcess/WebApplicationCacheManagerProxy.cpp:
+        (WebKit::WebApplicationCacheManagerProxy::shouldTerminate):
+        * UIProcess/WebApplicationCacheManagerProxy.h:
+        * UIProcess/WebCookieManagerProxy.cpp:
+        (WebKit::WebCookieManagerProxy::shouldTerminate):
+        * UIProcess/WebCookieManagerProxy.h:
+        * UIProcess/WebDatabaseManagerProxy.cpp:
+        (WebKit::WebDatabaseManagerProxy::shouldTerminate):
+        * UIProcess/WebDatabaseManagerProxy.h:
+        * UIProcess/WebKeyValueStorageManagerProxy.cpp:
+        (WebKit::WebKeyValueStorageManagerProxy::shouldTerminate):
+        * UIProcess/WebKeyValueStorageManagerProxy.h:
+        * UIProcess/WebMediaCacheManagerProxy.cpp:
+        (WebKit::WebMediaCacheManagerProxy::shouldTerminate):
+        * UIProcess/WebMediaCacheManagerProxy.h:
+        * UIProcess/WebResourceCacheManagerProxy.cpp:
+        (WebKit::WebResourceCacheManagerProxy::shouldTerminate):
+        * UIProcess/WebResourceCacheManagerProxy.h:
+
+        * WebProcess/ApplicationCache/WebApplicationCacheManager.cpp:
+        (WebKit::WebApplicationCacheManager::getApplicationCacheOrigins):
+        (WebKit::WebApplicationCacheManager::deleteEntriesForOrigin):
+        (WebKit::WebApplicationCacheManager::deleteAllEntries):
+        * WebProcess/Cookies/WebCookieManager.cpp:
+        (WebKit::WebCookieManager::getHostnamesWithCookies):
+        (WebKit::WebCookieManager::deleteCookiesForHostname):
+        (WebKit::WebCookieManager::deleteAllCookies):
+        (WebKit::WebCookieManager::startObservingCookieChanges):
+        (WebKit::WebCookieManager::setHTTPCookieAcceptPolicy):
+        (WebKit::WebCookieManager::getHTTPCookieAcceptPolicy):
+        * WebProcess/KeyValueStorage/WebKeyValueStorageManager.cpp:
+        (WebKit::WebKeyValueStorageManager::getKeyValueStorageOrigins):
+        (WebKit::WebKeyValueStorageManager::deleteEntriesForOrigin):
+        (WebKit::WebKeyValueStorageManager::deleteAllEntries):
+        * WebProcess/MediaCache/WebMediaCacheManager.cpp:
+        (WebKit::WebMediaCacheManager::getHostnamesWithMediaCache):
+        (WebKit::WebMediaCacheManager::clearCacheForHostname):
+        (WebKit::WebMediaCacheManager::clearCacheForAllHostnames):
+        * WebProcess/ResourceCache/WebResourceCacheManager.cpp:
+        (WebKit::WebResourceCacheManager::getCacheOrigins):
+        (WebKit::WebResourceCacheManager::clearCacheForOrigin):
+        (WebKit::WebResourceCacheManager::clearCacheForAllOrigins):
+        * WebProcess/WebCoreSupport/WebDatabaseManager.cpp:
+        (WebKit::WebDatabaseManager::getDatabasesByOrigin):
+        (WebKit::WebDatabaseManager::getDatabaseOrigins):
+        (WebKit::WebDatabaseManager::deleteDatabaseWithNameForOrigin):
+        (WebKit::WebDatabaseManager::deleteDatabasesForOrigin):
+        (WebKit::WebDatabaseManager::deleteAllDatabases):
+        (WebKit::WebDatabaseManager::setQuotaForOrigin):
+
+2011-03-30  Adam Roben  <aroben@apple.com>
+
+        Mac build fix after r82442
+
+        * WebProcess/Plugins/PluginProxy.cpp:
+        (WebKit::PluginProxy::geometryDidChange): Added a missing argument.
+
+2011-03-29  Adam Roben  <aroben@apple.com>
+
+        Add a way to specify that a ShareableBitmap has no alpha channel
+
+        Before this patch, all ShareableBitmaps had an alpha channel. With this patch, all
+        ShareableBitmaps *still* have an alpha channel. But now there's a way to specify you don't
+        want one (which will be used in the future)!
+
+        Fixes <http://webkit.org/b/57388> Need a way to specify that a ShareableBitmap has no alpha
+        channel
+
+        Reviewed by Anders Carlsson.
+
+        * Shared/ShareableBitmap.cpp:
+        (WebKit::ShareableBitmap::Handle::Handle): Moved here from the header file, and added
+        initialization of m_flags.
+
+        (WebKit::ShareableBitmap::Handle::encode):
+        (WebKit::ShareableBitmap::Handle::decode):
+        Encode/decode m_flags.
+
+        (WebKit::ShareableBitmap::create):
+        (WebKit::ShareableBitmap::createShareable):
+        Pass along the new Flags argument.
+
+        (WebKit::ShareableBitmap::createHandle): Store our Flags on the Handle.
+        (WebKit::ShareableBitmap::ShareableBitmap): Store the Flags in m_flags.
+
+        * Shared/ShareableBitmap.h: Added Flag, Flags, and m_flags, and added a Flags argument to
+        some create functions.
+
+        * Shared/WebCoreArgumentCoders.cpp:
+        (CoreIPC::encodeImage):
+        * Shared/WebImage.cpp:
+        (WebKit::WebImage::create):
+        Specify that we want a bitmap that supports alpha to maintain current behavior.
+
+        * Shared/cg/ShareableBitmapCG.cpp:
+        (WebKit::bitmapInfo): New helper function. Includes an alpha channel only if specified in
+        the flags.
+
+        (WebKit::ShareableBitmap::createGraphicsContext):
+        (WebKit::ShareableBitmap::makeCGImage):
+        Use the new helper function.
+
+        * WebProcess/Plugins/Netscape/NetscapePlugin.cpp:
+        (WebKit::NetscapePlugin::snapshot):
+        * WebProcess/Plugins/PluginProxy.cpp:
+        (WebKit::PluginProxy::geometryDidChange):
+        * WebProcess/WebCoreSupport/mac/WebDragClientMac.mm:
+        (WebKit::convertImageToBitmap):
+        * WebProcess/WebCoreSupport/win/WebPopupMenuWin.cpp:
+        (WebKit::WebPopupMenu::setUpPlatformData):
+        * WebProcess/WebPage/DrawingAreaImpl.cpp:
+        (WebKit::DrawingAreaImpl::display):
+        * WebProcess/WebPage/FindController.cpp:
+        (WebKit::FindController::updateFindIndicator):
+        Specify that we want a bitmap that supports alpha to maintain current behavior.
+
+2011-03-29  Adam Roben  <aroben@apple.com>
+
+        Add ShareableBitmap::Handle
+
+        This object is used for encoding/decoding a ShareableBitmap via CoreIPC. It currently just
+        encapsulates a SharedMemory::Handle (which is what we were using previously) and the image's
+        size (which means callers no longer need to deal with the size explicitly), but in the
+        future could be used to store more information about the bitmap.
+
+        This should cause no behavior changes.
+
+        Fixes <http://webkit.org/b/57397> ShareableBitmap needs its own Handle type
+
+        Reviewed by Anders Carlsson.
+
+        * PluginProcess/PluginControllerProxy.cpp:
+        (WebKit::PluginControllerProxy::geometryDidChange): No longer need to pass a size to create,
+        since the Handle records the size.
+        (WebKit::PluginControllerProxy::snapshot): No longer need the bufferSize argument, since the
+        Handle records the size.
+
+        * PluginProcess/PluginControllerProxy.h:
+        * PluginProcess/PluginControllerProxy.messages.in:
+        Updated Handle types and removed unnecessary size argument to Snapshot.
+
+        * Shared/PlatformPopupMenuData.cpp:
+        (WebKit::PlatformPopupMenuData::encode):
+        (WebKit::PlatformPopupMenuData::decode):
+        * Shared/PlatformPopupMenuData.h:
+        Changed to use ShareableBitmap::Handle and removed m_backingStoreSize, which is now stored
+        in the Handles.
+
+        * Shared/ShareableBitmap.cpp:
+        (WebKit::ShareableBitmap::Handle::encode):
+        (WebKit::ShareableBitmap::Handle::decode):
+        Simple encode/decode functions.
+
+        (WebKit::ShareableBitmap::create): Get the size from the Handle instead of as a separate
+        argument.
+        (WebKit::ShareableBitmap::createHandle): Store our size in the Handle.
+
+        * Shared/ShareableBitmap.h: Added ShareableBitmap::Handle and made some functions use it.
+
+        * Shared/UpdateInfo.h: Changed to use ShareableBitmap::Handle.
+
+        * Shared/UserMessageCoders.h:
+        (WebKit::UserMessageEncoder::baseEncode):
+        (WebKit::UserMessageDecoder::baseDecode):
+        * Shared/WebCoreArgumentCoders.cpp:
+        (CoreIPC::encodeImage):
+        (CoreIPC::decodeImage):
+        Use the size stored in the Handle instead of encoding/decoding one separately.
+
+        * UIProcess/API/mac/PageClientImpl.h:
+        * UIProcess/API/mac/PageClientImpl.mm:
+        (WebKit::PageClientImpl::setDragImage):
+        Removed the unnecessary imageSize argument. We can get it from the image itself.
+
+        * UIProcess/BackingStore.cpp:
+        (WebKit::BackingStore::incorporateUpdate):
+        * UIProcess/FindIndicator.cpp:
+        (WebKit::FindIndicator::create):
+        No longer need to pass a size when creating a ShareableBitmap from a Handle.
+
+        * UIProcess/FindIndicator.h: Changed to use ShareableBitmap::Handle.
+
+        * UIProcess/PageClient.h: Removed unnecessary imageSize argument from setDragImage.
+
+        * UIProcess/WebPageProxy.cpp:
+        (WebKit::WebPageProxy::setFindIndicator):
+        * UIProcess/WebPageProxy.h:
+        * UIProcess/WebPageProxy.messages.in:
+        * UIProcess/mac/WebPageProxyMac.mm:
+        (WebKit::WebPageProxy::setDragImage):
+        * WebProcess/Plugins/PluginProxy.cpp:
+        (WebKit::PluginProxy::snapshot):
+        (WebKit::PluginProxy::geometryDidChange):
+        * WebProcess/WebCoreSupport/mac/WebDragClientMac.mm:
+        (WebKit::WebDragClient::startDrag):
+        Changed to use ShareableBitmap::Handle and removed now-unnecessary size arguments (since we
+        can get the size from the Handle).
+
+        * WebProcess/WebCoreSupport/win/WebPopupMenuWin.cpp:
+        (WebKit::WebPopupMenu::setUpPlatformData): Don't need to store the backing store size in the
+        data anymore; the Handles will make sure it reaches the other process.
+
+        * WebProcess/WebPage/FindController.cpp:
+        (WebKit::FindController::updateFindIndicator):
+        (WebKit::FindController::hideFindIndicator):
+        Changed to use ShareableBitmap::Handle.
+
+2011-03-30  Alejandro G. Castro  <alex@igalia.com>
+
+        Fix GTK build after r81980.
+
+        * GNUmakefile.am:
+
+2011-03-29  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=57408 
+        webkit-min-device-pixel-ratio media query doesn't work post-SnowLeopard 
+        -and corresponding-
+        <rdar://problem/8665411>
+
+        * Shared/WebPageCreationParameters.cpp:
+        (WebKit::WebPageCreationParameters::encode):
+        (WebKit::WebPageCreationParameters::decode):
+        * Shared/WebPageCreationParameters.h:
+        * UIProcess/API/mac/PageClientImpl.h:
+        * UIProcess/API/mac/PageClientImpl.mm:
+        (WebKit::PageClientImpl::userSpaceScaleFactor):
+        * UIProcess/API/qt/qwkpage_p.h:
+        (QWKPagePrivate::userSpaceScaleFactor):
+        * UIProcess/PageClient.h:
+        * UIProcess/WebPageProxy.cpp:
+        (WebKit::WebPageProxy::creationParameters):
+        * UIProcess/gtk/WebView.h:
+        (WebKit::WebView::userSpaceScaleFactor):
+        * UIProcess/win/WebView.h:
+        (WebKit::WebView::userSpaceScaleFactor):
+        * WebProcess/WebCoreSupport/WebChromeClient.cpp:
+        (WebKit::WebChromeClient::scaleFactor):
+        * WebProcess/WebPage/WebPage.cpp:
+        (WebKit::WebPage::WebPage):
+        * WebProcess/WebPage/WebPage.h:
+        (WebKit::WebPage::userSpaceScaleFactor):
+
+2011-03-29  Brent Fulgham  <bfulgham@webkit.org>
+
+        Unreviewed WinCairo build fix.
+
+        Bring DownloadCurl implementation stubs in line with current
+        CFNetwork API.
+
+        * WebProcess/Downloads/curl/DownloadCurl.cpp:
+        (WebKit::Download::receivedCredential):
+        (WebKit::Download::receivedRequestToContinueWithoutCredential):
+        (WebKit::Download::receivedCancellation):
+
+2011-03-29  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        AX: WK2: When creating the window remote token, use what's returned from accessibility
+        https://bugs.webkit.org/show_bug.cgi?id=57398
+
+        This will allow a specific WKView to override what's used for the window attribute of the
+        HTML elements.
+
+        * UIProcess/API/mac/WKView.mm:
+        (-[WKView viewDidMoveToWindow]):
+
+2011-03-29  Jeff Miller  <jeffm@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Make Windows-only InjectedBundle functions platform-specific
+        https://bugs.webkit.org/show_bug.cgi?id=57385
+        
+        Added files for Windows-specific WKBundle functions.
+        Removed stub wrappers for InjectedBundle::setHostAllowsAnyHTTPSCertificate() and InjectedBundle::setClientCertificate() from non-Windows platforms.
+
+        * WebProcess/InjectedBundle/API/c/WKBundle.cpp: Moved WKBundleSetHostAllowsAnyHTTPSCertificate() and WKBundleSetClientCertificate() to WKBundlePrivateWin.cpp.
+        * WebProcess/InjectedBundle/API/c/WKBundlePrivate.h: Moved WKBundleSetHostAllowsAnyHTTPSCertificate() and WKBundleSetClientCertificate() to WKBundlePrivateWin.h.
+        * WebProcess/InjectedBundle/API/c/win: Added.
+        * WebProcess/InjectedBundle/API/c/win/WKBundlePrivateWin.cpp: Added.
+        (WKBundleSetHostAllowsAnyHTTPSCertificate): Moved from WKBundle.cpp.
+        (WKBundleSetClientCertificate): Moved from WKBundle.cpp.
+        * WebProcess/InjectedBundle/API/c/win/WKBundlePrivateWin.h: Added.
+        * WebProcess/InjectedBundle/InjectedBundle.h: setHostAllowsAnyHTTPSCertificate() and setClientCertificate() are Windows-only.
+        * WebProcess/InjectedBundle/gtk/InjectedBundleGtk.cpp: Removed setHostAllowsAnyHTTPSCertificate() and setClientCertificate().
+        * WebProcess/InjectedBundle/mac/InjectedBundleMac.cpp: Removed setHostAllowsAnyHTTPSCertificate() and setClientCertificate().
+        * WebProcess/InjectedBundle/qt/InjectedBundleQt.cpp: Removed setHostAllowsAnyHTTPSCertificate() and setClientCertificate().
+        * win/WebKit2.vcproj: Added WKBundlePrivateWin.cpp and WKBundlePrivateWin.h.
+        * win/WebKit2Generated.make: Copy WKBundlePrivateWin.h.
+
+2011-03-29  Anders Carlsson  <andersca@apple.com>
+
+        Fix Windows build.
+
+        * WebProcess/Downloads/cfnet/DownloadCFNet.cpp:
+        (WebKit::Download::receivedCredential):
+        (WebKit::Download::receivedRequestToContinueWithoutCredential):
+        (WebKit::Download::receivedCancellation):
+
+2011-03-29  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Downloads: Authentication support
+        https://bugs.webkit.org/show_bug.cgi?id=57403
+        <rdar://problem/8691166>
+
+        * UIProcess/API/C/WKContext.h:
+        Add didReceiveAuthenticationChallenge callback.
+
+        * UIProcess/Downloads/DownloadProxy.cpp:
+        (WebKit::DownloadProxy::didReceiveAuthenticationChallenge):
+        Call the download client.
+
+        * UIProcess/Downloads/DownloadProxy.messages.in:
+        Add DidReceiveAuthenticationChallenge message.
+
+        * UIProcess/WebDownloadClient.cpp:
+        (WebKit::WebDownloadClient::didReceiveAuthenticationChallenge):
+        Call the client callback function.
+
+        * UIProcess/WebDownloadClient.h:
+        * WebProcess/Authentication/AuthenticationManager.cpp:
+        (WebKit::AuthenticationManager::didReceiveAuthenticationChallenge):
+        Send the DidReceiveAuthenticationChallenge message to the download proxy.
+
+        (WebKit::AuthenticationManager::useCredentialForChallenge):
+        (WebKit::AuthenticationManager::continueWithoutCredentialForChallenge):
+        (WebKit::AuthenticationManager::cancelChallenge):
+        If the authentication client is null, call the static download member functions.
+
+        * WebProcess/Authentication/AuthenticationManager.h:
+        * WebProcess/Downloads/Download.cpp:
+        (WebKit::Download::didReceiveAuthenticationChallenge):
+        Call the authentication manager.
+
+        * WebProcess/Downloads/Download.h:
+        * WebProcess/Downloads/mac/DownloadMac.mm:
+        (WebKit::Download::receivedCredential):
+        (WebKit::Download::receivedRequestToContinueWithoutCredential):
+        (WebKit::Download::receivedCancellation):
+        Call the right sender methods.
+
+        (-[WKDownloadAsDelegate download:didReceiveAuthenticationChallenge:]):
+        (-[WKDownloadAsDelegate downloadShouldUseCredentialStorage:]):
+        Call the right Download member functions.
+
+        * WebProcess/Downloads/qt/DownloadQt.cpp:
+        (WebKit::Download::receivedCredential):
+        (WebKit::Download::receivedRequestToContinueWithoutCredential):
+        (WebKit::Download::receivedCancellation):
+        * WebProcess/Downloads/soup/DownloadSoup.cpp:
+        (WebKit::Download::receivedCredential):
+        (WebKit::Download::receivedRequestToContinueWithoutCredential):
+        (WebKit::Download::receivedCancellation):
+        Add stubs.
+
+2011-03-29  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        AuthenticationChallengeProxy objects should be associated with processes, not pages
+        https://bugs.webkit.org/show_bug.cgi?id=57401
+
+        * UIProcess/Authentication/AuthenticationChallengeProxy.cpp:
+        (WebKit::AuthenticationChallengeProxy::AuthenticationChallengeProxy):
+        (WebKit::AuthenticationChallengeProxy::~AuthenticationChallengeProxy):
+        (WebKit::AuthenticationChallengeProxy::useCredential):
+        (WebKit::AuthenticationChallengeProxy::cancel):
+        * UIProcess/Authentication/AuthenticationChallengeProxy.h:
+        (WebKit::AuthenticationChallengeProxy::create):
+        * UIProcess/WebPageProxy.cpp:
+        (WebKit::WebPageProxy::didReceiveAuthenticationChallenge):
+
+2011-03-29  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Use LocalizedStrings.h as a bottleneck for localized strings instead of
+        using UI_STRING.
+
+        * UIProcess/API/mac/WKView.mm:
+        (-[WKView validateUserInterfaceItem:]):
+        Call existing localization functions instead of using UI_STRING.
+
+        (-[WKView _getTextInputState:selectionEnd:underlines:]):
+        Remove unnecessary WebCore:: prefix.
+
+2011-03-29  Chang Shu  <cshu@webkit.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        WebKitTestRunner needs layoutTestController.setAllowUniversalAccessFromFileURLs
+        https://bugs.webkit.org/show_bug.cgi?id=42692
+
+        * Shared/WebPreferencesStore.cpp:
+        (WebKit::WebPreferencesStore::decode):
+        (WebKit::WebPreferencesStore::overrideAllowUniversalAccessFromFileURLsForTestRunner):
+        * Shared/WebPreferencesStore.h:
+        * WebProcess/InjectedBundle/API/c/WKBundle.cpp:
+        (WKBundleOverrideAllowUniversalAccessFromFileURLsForTestRunner):
+        * WebProcess/InjectedBundle/API/c/WKBundlePrivate.h:
+        * WebProcess/InjectedBundle/InjectedBundle.cpp:
+        (WebKit::InjectedBundle::overrideAllowUniversalAccessFromFileURLsForTestRunner):
+        * WebProcess/InjectedBundle/InjectedBundle.h:
+
+2011-03-29  Timothy Hatcher  <timothy@apple.com>
+
+        Update the order of the context menu to better match AppKit on Mac.
+
+        <rdar://problem/9054893>
+
+        Reviewed by John Sullivan.
+
+        * WebProcess/WebCoreSupport/WebPlatformStrategies.cpp:
+        (WebKit::WebPlatformStrategies::contextMenuItemTagLookUpInDictionary): Added argument for selected string.
+        * WebProcess/WebCoreSupport/WebPlatformStrategies.h:
+
+2011-03-29  Jeff Miller  <jeffm@apple.com>
+
+        Fix formatting of WebKit2.vcproj after r82283.
+
+        * win/WebKit2.vcproj:
+
+2011-03-29  Martin Robinson  <mrobinson@igalia.com>
+
+        [GTK] Build failed with ‘GDK_KEY_KP_Space’ was not declared in this scope
+        https://bugs.webkit.org/show_bug.cgi?id=55314
+
+        Build fix for older versions of GTK+. Use the deprecated names for GDK key
+        defines and include GtkVersioning.h to allow building on newer versions
+        of GTK+.
+
+        * Shared/gtk/WebEventFactory.cpp:
+        (WebKit::isGdkKeyCodeFromKeyPad): Update key defines.
+
+2011-03-29  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Use per-configuration vsprops in WebKit to avoid WebKitVSPropsRedirectionDir removal by MSVC IDE
+        https://bugs.webkit.org/show_bug.cgi?id=57383
+
+        Visual Studio's IDE was removing instances of $(WebKitVSPropsRedirectionDir) from
+        InheritedPropertySheet rules in our vcproj files when the vcproj was edited from within
+        the IDE. To avoid this, add a separate vsprops file for each project configuration that
+        contains the required inherited property sheets.
+
+        * win/WebKit2.vcproj:
+        * win/WebKit2Debug.vsprops: Added.
+        * win/WebKit2DebugAll.vsprops: Added.
+        * win/WebKit2DebugCairoCFLite.vsprops: Added.
+        * win/WebKit2Release.vsprops: Added.
+        * win/WebKit2ReleaseCairoCFLite.vsprops: Added.
+        * win/WebKit2ReleaseLTCG.vsprops: Added.
+        * win/WebKit2WebProcess.vcproj:
+        * win/WebKit2WebProcessDebug.vsprops: Added.
+        * win/WebKit2WebProcessDebugAll.vsprops: Added.
+        * win/WebKit2WebProcessDebugCairoCFLite.vsprops: Added.
+        * win/WebKit2WebProcessRelease.vsprops: Added.
+        * win/WebKit2WebProcessReleaseCairoCFLite.vsprops: Added.
+        * win/WebKit2WebProcessReleaseLTCG.vsprops: Added.
+
+2011-03-29  Jessie Berlin  <jberlin@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        WebKit2: The WebProcess should be relaunched if necessary when WebKit2 is asked for
+        information about Cookies, Databases, Local Storage, etc.
+        https://bugs.webkit.org/show_bug.cgi?id=57374
+
+        Instead of bailing when the WebProcess is not valid, call relaunchProcessIfNecessary().
+
+        * UIProcess/Plugins/WebPluginSiteDataManager.cpp:
+        (WebKit::WebPluginSiteDataManager::getSitesWithData):
+        (WebKit::WebPluginSiteDataManager::clearSiteData):
+        * UIProcess/WebApplicationCacheManagerProxy.cpp:
+        (WebKit::WebApplicationCacheManagerProxy::getApplicationCacheOrigins):
+        (WebKit::WebApplicationCacheManagerProxy::deleteEntriesForOrigin):
+        (WebKit::WebApplicationCacheManagerProxy::deleteAllEntries):
+        * UIProcess/WebCookieManagerProxy.cpp:
+        (WebKit::WebCookieManagerProxy::getHostnamesWithCookies):
+        (WebKit::WebCookieManagerProxy::deleteCookiesForHostname):
+        (WebKit::WebCookieManagerProxy::deleteAllCookies):
+        (WebKit::WebCookieManagerProxy::startObservingCookieChanges):
+        (WebKit::WebCookieManagerProxy::setHTTPCookieAcceptPolicy):
+        (WebKit::WebCookieManagerProxy::getHTTPCookieAcceptPolicy):
+        * UIProcess/WebDatabaseManagerProxy.cpp:
+        (WebKit::WebDatabaseManagerProxy::getDatabasesByOrigin):
+        (WebKit::WebDatabaseManagerProxy::getDatabaseOrigins):
+        (WebKit::WebDatabaseManagerProxy::deleteDatabaseWithNameForOrigin):
+        (WebKit::WebDatabaseManagerProxy::deleteDatabasesForOrigin):
+        (WebKit::WebDatabaseManagerProxy::deleteAllDatabases):
+        (WebKit::WebDatabaseManagerProxy::setQuotaForOrigin):
+        * UIProcess/WebKeyValueStorageManagerProxy.cpp:
+        (WebKit::WebKeyValueStorageManagerProxy::getKeyValueStorageOrigins):
+        (WebKit::WebKeyValueStorageManagerProxy::deleteEntriesForOrigin):
+        (WebKit::WebKeyValueStorageManagerProxy::deleteAllEntries):
+        * UIProcess/WebMediaCacheManagerProxy.cpp:
+        (WebKit::WebMediaCacheManagerProxy::getHostnamesWithMediaCache):
+        (WebKit::WebMediaCacheManagerProxy::clearCacheForHostname):
+        (WebKit::WebMediaCacheManagerProxy::clearCacheForAllHostnames):
+        * UIProcess/WebResourceCacheManagerProxy.cpp:
+        (WebKit::WebResourceCacheManagerProxy::getCacheOrigins):
+        (WebKit::WebResourceCacheManagerProxy::clearCacheForOrigin):
+        (WebKit::WebResourceCacheManagerProxy::clearCacheForAllOrigins):
+
+2011-03-29  Jeff Miller  <jeffm@apple.com>
+
+        Reviewed by Darin Adler.
+
+        WebKit2: Support setting the client certificate on Windows
+        https://bugs.webkit.org/show_bug.cgi?id=57368
+        
+        Allow setting the client certificate for a host via the injected bundle.
+        This requires the ability for Webkit2 Windows clients to create a WKCertificateInfo from a PCCERT_CONTEXT so they can send it to the web process.
+
+        * Shared/API/c/win/WKCertificateInfoWin.cpp:
+        (WKCertificateInfoCreateWithCertificate): Added.
+        * Shared/API/c/win/WKCertificateInfoWin.h: Added WKCertificateInfoCreateWithCertificate().
+        * WebProcess/InjectedBundle/API/c/WKBundle.cpp:
+        (WKBundleSetClientCertificate): Added.
+        * WebProcess/InjectedBundle/API/c/WKBundlePrivate.h: Added WKBundleSetClientCertificate().
+        * WebProcess/InjectedBundle/InjectedBundle.h: Added setClientCertificate().
+        * WebProcess/InjectedBundle/gtk/InjectedBundleGtk.cpp:
+        (WebKit::InjectedBundle::setClientCertificate): Added, should never be called.
+        * WebProcess/InjectedBundle/mac/InjectedBundleMac.cpp:
+        (WebKit::InjectedBundle::setClientCertificate): Added, should never be called.
+        * WebProcess/InjectedBundle/qt/InjectedBundleQt.cpp:
+        (WebKit::InjectedBundle::setClientCertificate): Added, should never be called.
+        * WebProcess/InjectedBundle/win/InjectedBundleWin.cpp:
+        (WebKit::InjectedBundle::setClientCertificate): Added.
+
+2011-03-29  Timothy Hatcher  <timothy@apple.com>
+
+        Make WebKit2 work with update-webkit-localizable-strings.
+
+        https://webkit.org/b/57354
+
+        Reviewed by Sam Weinig.
+
+        * PluginProcess/mac/PluginProcessMac.mm: Remove UI_STRING macro. Use WebLocalizableStrings.h.
+        * Shared/WebLocalizableStrings.h: Added.
+        * UIProcess/API/mac/WKView.mm: Remove UI_STRING macro. Use WebLocalizableStrings.h.
+        * UIProcess/mac/WebInspectorProxyMac.mm:
+        (WebKit::WebInspectorProxy::platformInspectedURLChanged): Use UI_STRING. Remove FIXME.
+        * WebProcess/WebCoreSupport/WebPlatformStrategies.cpp: Remove UI_STRING macros.
+        Use WebLocalizableStrings.h.
+        * WebProcess/WebCoreSupport/mac/WebErrorsMac.mm:
+        (registerErrors): Remove UI_STRING macro. Use WebLocalizableStrings.h.
+        * WebProcess/mac/WebProcessMac.mm:
+        (WebKit::WebProcess::platformInitializeWebProcess): Use UI_STRING. Remove FIXME.
+
+        * GNUmakefile.am: Added Shared/WebLocalizableStrings.h.
+        * WebKit2.pro: Ditto.
+        * WebKit2.xcodeproj/project.pbxproj: Ditto.
+        * win/WebKit2.vcproj: Ditto.
+
+2011-03-29  Jeff Miller  <jeffm@apple.com>
+
+        Reviewed by Darin Adler.
+
+        CoreIPC::decodeResourceError() leaks a CFDataRef
+        https://bugs.webkit.org/show_bug.cgi?id=57366
+
+        * Shared/win/WebCoreArgumentCodersWin.cpp:
+        (CoreIPC::decodeResourceError): Don't leak the result of WebCore::copyCertificateToData(), since the ResourceError will retain it.
+
+2011-03-29  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Allow the AppleConnect plug-in to use the QuickDraw drawing model
+        https://bugs.webkit.org/show_bug.cgi?id=57365
+        <rdar://problem/8712320>
+
+        * Shared/Plugins/Netscape/mac/NetscapePluginModuleMac.mm:
+        (WebKit::NetscapePluginModule::determineQuirks):
+        * Shared/Plugins/PluginQuirks.h:
+        * WebProcess/Plugins/Netscape/mac/NetscapePluginMac.mm:
+        (WebKit::NetscapePlugin::platformPostInitialize):
+
+2011-03-29  Darin Adler  <darin@apple.com>
+
+        Reviewed by Adam Roben.
+
+        WebKit2 bundle page needs to offer generated file hooks
+        https://bugs.webkit.org/show_bug.cgi?id=57279
+
+        * WebProcess/InjectedBundle/API/c/WKBundlePage.h: Added shouldGenerateFileForUpload and
+        generateFileForUpload callback pointers.
+
+        * WebProcess/InjectedBundle/InjectedBundlePageUIClient.cpp:
+        (WebKit::InjectedBundlePageUIClient::shouldGenerateFileForUpload): Added.
+        (WebKit::InjectedBundlePageUIClient::generateFileForUpload): Added.
+        * WebProcess/InjectedBundle/InjectedBundlePageUIClient.h: Added functions above.
+
+        * WebProcess/WebCoreSupport/WebChromeClient.cpp:
+        (WebKit::WebChromeClient::shouldReplaceWithGeneratedFileForUpload): Implemented by
+        calling the functions above.
+        (WebKit::WebChromeClient::generateReplacementFile): Ditto.
+
+2011-03-29  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Assertion failure in plug-in process with clang-built 32/64-bit WebKit2
+        https://bugs.webkit.org/show_bug.cgi?id=57359
+
+        Don't use __alignof when encoding and decoding scalar types.
+        
+        Darwin 32-bit, double and unsigned long long are 4-byte aligned but on 64-bit they're
+        8-byte aligned which causes problems when doing IPC between 32-bit and 64-bit processes.
+        GCC is buggy and returns 8, but clang is correct and returns 4. Use sizeof instead which we know
+        is equal to or greater than the alignment.
+
+        * Platform/CoreIPC/ArgumentDecoder.cpp:
+        (CoreIPC::ArgumentDecoder::decodeBool):
+        (CoreIPC::ArgumentDecoder::decodeUInt32):
+        (CoreIPC::ArgumentDecoder::decodeUInt64):
+        (CoreIPC::ArgumentDecoder::decodeInt32):
+        (CoreIPC::ArgumentDecoder::decodeInt64):
+        (CoreIPC::ArgumentDecoder::decodeFloat):
+        (CoreIPC::ArgumentDecoder::decodeDouble):
+        * Platform/CoreIPC/ArgumentEncoder.cpp:
+        (CoreIPC::ArgumentEncoder::encodeBool):
+        (CoreIPC::ArgumentEncoder::encodeUInt32):
+        (CoreIPC::ArgumentEncoder::encodeUInt64):
+        (CoreIPC::ArgumentEncoder::encodeInt32):
+        (CoreIPC::ArgumentEncoder::encodeInt64):
+        (CoreIPC::ArgumentEncoder::encodeFloat):
+        (CoreIPC::ArgumentEncoder::encodeDouble):
+
+2011-03-29  Brent Fulgham  <bfulgham@webkit.org>
+
+        Unreviewed build fix after r81928.
+
+        * win/WebKit2.vcproj: Don't build CG-specific icon routines
+        for WinCairo port.
+
+2011-03-29  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Reproducible crash running under libgmalloc, in -[WKView(Internal) removeTrackingRect:] --&gt; objc_assign_ivar_non_gc
+        <rdar://problem/9193352>
+        https://bugs.webkit.org/show_bug.cgi?id=57358
+
+        -[WKView removeTrackingRect] can be called from below -[WKView dealloc] after we have
+        destroyed _data. So, nil out _data after releasing it and nil check it appropriately.
+        
+        * UIProcess/API/mac/WKView.mm:
+        (-[WKView dealloc]):
+        Nil out _data after releasing it.
+
+        (-[WKView removeTrackingRect:]):
+        Add early return for nil _data.
+
+2011-03-29  Jeff Miller  <jeffm@apple.com>
+
+        Reviewed by Jon Honeycutt.
+
+        Add WebCore::copyCertificateToData() on Windows
+        https://bugs.webkit.org/show_bug.cgi?id=57296
+        
+        Remove duplicate code that implemented this functionality in WebCoreArgumentCodersWin.cpp and use WebCore::copyCertificateToData() instead. 
+
+        * Shared/win/WebCoreArgumentCodersWin.cpp:
+        (CoreIPC::decodeResourceError): Use WebCore::copyCertificateToData().
+
+2011-03-29  Balazs Kelemen  <kbalazs@webkit.org>
+
+        Unreviewed build fix (64 bit gcc).
+
+        GCC does not accept uint64_t formatted as %lli.
+
+        * UIProcess/WebIconDatabase.cpp:
+        (WebKit::WebIconDatabase::getLoadDecisionForIconURL): Add explicit cast to long long.
+
+2011-03-28  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        WKPageGetSourceForFrame and WKPageGetContentsAsString should throw an error in case of a race with page loading
+        https://bugs.webkit.org/show_bug.cgi?id=57305
+        <rdar://problem/8738060>, <rdar://problem/8780168>
+
+        * UIProcess/WebPageProxy.cpp:
+        (WebKit::WebPageProxy::close): Clear m_loadDependentStringCallbackIDs
+        (WebKit::WebPageProxy::getSourceForFrame): track the callback as load dependent
+        (WebKit::WebPageProxy::getContentsAsString): ditto
+        (WebKit::WebPageProxy::clearLoadDependentCallbacks): Invalidate all load dependent callbacks
+        (WebKit::WebPageProxy::didCommitLoadForFrame): Call clearLoadDependentCallbacks
+        (WebKit::WebPageProxy::didFailLoadForFrame): ditto
+        (WebKit::WebPageProxy::stringCallback): Remove callback from load dependent set if appropriate
+        (WebKit::WebPageProxy::processDidCrash): Clear m_loadDependentStringCallbackIDs
+        * UIProcess/WebPageProxy.h: Add m_loadDependentStringCallbackIDs hash set.
+
+2011-03-28  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Use String instead of CString as return value of openTemporaryFile
+        https://bugs.webkit.org/show_bug.cgi?id=55332
+
+        * Shared/WebMemorySampler.cpp:
+        (WebKit::WebMemorySampler::initializeTempLogFile):
+        * WebProcess/Plugins/Netscape/NetscapePluginStream.cpp:
+        (WebKit::NetscapePluginStream::stop):
+        * WebProcess/Plugins/Netscape/NetscapePluginStream.h:
+
+2011-03-28  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Jon Honeycutt.
+
+        WebKit2: Downloads started with DownloadCFNet::start never start
+        https://bugs.webkit.org/show_bug.cgi?id=57268
+
+        * WebProcess/Downloads/cfnet/DownloadCFNet.cpp:
+        (WebKit::Download::start): Call CFURLDownloadStart on the download we create.
+
+2011-03-28  Anders Carlsson  <andersca@apple.com>
+
+        Fix Windows build.
+
+        * Shared/ShareableBitmap.h:
+
+2011-03-28  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Beep when pressing a menu key equivalent when a plug-in has focus
+        https://bugs.webkit.org/show_bug.cgi?id=57264
+        <rdar://problem/8935597>
+
+        We don't want the WKTextInputWindowController inputContext to be involved in interpretKeyEvents.
+
+        * UIProcess/API/mac/WKView.mm:
+        (-[WKView inputContext]):
+
+2011-03-28  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        CGImageRefs must hold a strong reference to underlying data
+        https://bugs.webkit.org/show_bug.cgi?id=57263
+        <rdar://problem/9146179>
+
+        Make paintBitmapContext use CGBitmapContextCreateImage, which creates a copy-on-write copy
+        of the bitmap data. Also, add ShareableBitmap::makeCGImageCopy which does the same thing, and
+        ShareableBitmap::makeCGImage in the cases where we know that the ShareableBitmap data will never change.
+
+        * Platform/cg/CGUtilities.cpp:
+        (WebKit::paintImage):
+        Factor image painting code out into a separate function.
+
+        (WebKit::paintBitmapContext):
+        Call paintImage.
+
+        * Shared/API/c/cg/WKImageCG.cpp:
+        (WKImagemakeCGImage):
+        Use ShareableBitmap::makeCGImageCopy.
+
+        * Shared/ShareableBitmap.h:
+        * Shared/cg/ShareableBitmapCG.cpp:
+        (WebKit::ShareableBitmap::createGraphicsContext):
+        (WebKit::ShareableBitmap::paint):
+        (WebKit::ShareableBitmap::makeCGImageCopy):
+        (WebKit::ShareableBitmap::makeCGImage):
+        (WebKit::ShareableBitmap::releaseBitmapContextData):
+        (WebKit::ShareableBitmap::releaseDataProviderData):
+        Add makeCGImage and makeCGImageCopy.
+
+        * Shared/cg/WebCoreArgumentCodersCG.cpp:
+        (CoreIPC::createImage):
+        Use ShareableBitmap::makeCGImage.
+        
+        * UIProcess/API/mac/PageClientImpl.mm:
+        (WebKit::PageClientImpl::setDragImage):
+        Use ShareableBitmap::makeCGImage and plug a CGImageRef leak.
+
+2011-03-28  Alexey Proskuryakov  <ap@apple.com>
+
+        Build fix.
+
+        * UIProcess/API/mac/WKView.mm: (-[WKView keyDown:]): It's not "event" in this function, it's
+        "theEvent".
+
+2011-03-28  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=57260
+        Clean up text input code a little
+
+        * UIProcess/API/mac/WKView.mm:
+        (-[WKView doCommandBySelector:]): This NSTextInput protocol method lacked a LOG() call.
+        (-[WKView keyDown:]): Added (possibly useless) event protection to match performKeyEquivalent:
+        and also WebKit1.
+
+        * WebProcess/WebPage/mac/WebPageMac.mm: Removed an obsolete comment.
+
+2011-03-28  Jeff Miller  <jeffm@apple.com>
+
+        Reviewed by Adam Roben.
+
+        ResourceError::certificate() should return a PCCERT_CONTEXT
+        https://bugs.webkit.org/show_bug.cgi?id=57262
+
+        * Shared/win/PlatformCertificateInfo.cpp:
+        (WebKit::PlatformCertificateInfo::PlatformCertificateInfo): Don't assert if no PCCERT_CONTEXT is specified.
+        * Shared/win/WebCoreArgumentCodersWin.cpp:
+        (CoreIPC::encodeResourceError): Removed unneeded code now that ResourceError::certificate() returns a PCCERT_CONTEXT.
+
+2011-03-28  Jeff Miller  <jeffm@apple.com>
+
+        Rubber-stamped by Adam Roben.
+
+        Remove unused CFErrorRef.
+
+        * Shared/win/WebCoreArgumentCodersWin.cpp:
+        (CoreIPC::encodeResourceError): Remove unused CFErrorRef.
+
+2011-03-28  Jeff Miller  <jeffm@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Include certificate when sending a WebCore::ResourceError to UI process on Windows
+        https://bugs.webkit.org/show_bug.cgi?id=57195
+        
+        Add support for sending the certificate with the WebCore::ResourceError.
+
+        * Shared/win/WebCoreArgumentCodersWin.cpp:
+        (CoreIPC::encodeResourceError): Encode certificate data.
+        (CoreIPC::deallocCertContext): Added.
+        (CoreIPC::createCertContextDeallocator): Added.
+        (CoreIPC::copyCert): Added.
+        (CoreIPC::decodeResourceError): Decode certificate data.
+
+2011-03-27  Andy Estes  <aestes@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Correctly get a plug-in's MIME type when it uses WebPluginMIMETypesFilename
+        https://bugs.webkit.org/show_bug.cgi?id=57205
+        
+        If the plug-in's Info.plist uses WebPluginMIMETypesFilename to specify
+        plug-in MIME types, WebKit has to check for a property list file in
+        ~/Library/Preferences for the MIME type dictionary.
+
+        * Shared/Plugins/Netscape/mac/NetscapePluginModuleMac.mm:
+        (WebKit::getMIMETypesFromPluginBundle): If the bundle's Info dictionary
+        has the key WebPluginMIMETypesFilename, open the property list
+        specified by that key's value and return the MIME type dictionary from
+        there. Otherwise, return the MIME type dictionary specified by the key
+        WebPluginMIMETypes.
+        (WebKit::getPluginInfoFromPropertyLists): Call
+        getMIMETypesFromPluginBundle().
+
+2011-03-27  Jer Noble  <jer.noble@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Full Screen: disable keyboard access by default
+        https://bugs.webkit.org/show_bug.cgi?id=56684
+
+        Take into account whether keyboard access was requested when deciding whether full
+        screen mode is supported.
+
+        * UIProcess/WebFullScreenManagerProxy.cpp:
+        (WebKit::WebFullScreenManagerProxy::supportsFullScreen):
+        * UIProcess/WebFullScreenManagerProxy.h:
+        * UIProcess/WebFullScreenManagerProxy.messages.in:
+        * WebProcess/FullScreen/WebFullScreenManager.cpp:
+        (WebKit::WebFullScreenManager::supportsFullScreen):
+        * WebProcess/FullScreen/WebFullScreenManager.h:
+        * WebProcess/WebCoreSupport/WebChromeClient.cpp:
+        (WebKit::WebChromeClient::supportsFullScreenForElement):
+        * WebProcess/WebCoreSupport/WebChromeClient.h:
+
+2011-03-27  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Dock doesn't come back after leaving fullscreen on Hulu
+        https://bugs.webkit.org/show_bug.cgi?id=57189
+        <rdar://problem/9192413>
+
+        Port some code over from the old WebKit1 plug-in host.
+
+        * PluginProcess/mac/PluginProcessShim.mm:
+        (WebKit::shimShowMenuBar):
+        (WebKit::shimHideMenuBar):
+        (WebKit::shimIsMenuBarVisible):
+
+2011-03-27  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Keep a strong reference to the connection to avoid crashes.
+
+        * Platform/CoreIPC/Connection.cpp:
+
+2011-03-26  Jeff Miller  <jeffm@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        WKErrorCopyCFError() doesn't actually return a copy of the CFErrorRef
+        https://bugs.webkit.org/show_bug.cgi?id=57172
+
+        * Shared/API/c/cf/WKErrorCF.cpp:
+        (WKErrorCopyCFError): Use RetainPtr<> and leakRef() to return a real copy.
+
+2011-03-26  Maciej Stachowiak  <mjs@apple.com>
+
+        Revert inadvertently commited changes.
+
+        * WebProcess/com.apple.WebProcess.sb:
+
+2011-03-26  Jer Noble  <jer.noble@apple.com>
+
+        Reviewed by Eric Carlson.
+
+        Enable the Full Screen API by default in WebKit/mac and WebKit2
+        https://bugs.webkit.org/show_bug.cgi?id=56956
+
+        * Shared/WebPreferencesStore.h: Default the fullScreenEnabled preference to true.
+
+2011-03-26  Jeff Miller  <jeffm@apple.com>
+
+        Reviewed by Steve Falkenburg.
+
+        Add PlatformCertificateInfo::PlatformCertificateInfo(PCCERT_CONTEXT) constructor on Windows
+        https://bugs.webkit.org/show_bug.cgi?id=57152
+        
+        We're going to need to create a PlatformCertificateInfo with a single certificate on Windows to support client certificates.
+        Also, stop relying on the fact that the Win32 API CertDuplicateCertificateContext() currently returns the same PCCERT_CONTEXT that you pass to it, since that may change in the future.
+
+        * Shared/win/PlatformCertificateInfo.cpp:
+        (WebKit::PlatformCertificateInfo::PlatformCertificateInfo): Added PlatformCertificateInfo(PCCERT_CONTEXT) construtor. Use return value from CertDuplicateCertificateContext().
+        (WebKit::PlatformCertificateInfo::operator=): Use return value from CertDuplicateCertificateContext().
+        * Shared/win/PlatformCertificateInfo.h: Added PlatformCertificateInfo(PCCERT_CONTEXT) construtor.
+
+2011-03-26  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Graphic corruption appeared with Silverlight contents while resizing window
+        https://bugs.webkit.org/show_bug.cgi?id=57167
+        <rdar://problem/9094052>
+
+        Pass DispatchMessageEvenWhenWaitingForSyncReply when sending GeometryDidChange messages since that will guarantee
+        that those messages will be handled before PaintEntirePlugin messages which prevents the PaintEntirePlugin handler from
+        painting into the wrong backing store.
+
+        * WebProcess/Plugins/PluginProxy.cpp:
+        (WebKit::PluginProxy::geometryDidChange):
+
+2011-03-26  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Web process considered unresponsive (SPOD shown) when displaying a JavaScript alert() as a result of a click
+        <rdar://problem/9067557>
+        https://bugs.webkit.org/show_bug.cgi?id=57166
+
+        * UIProcess/WebPageProxy.cpp:
+        (WebKit::WebPageProxy::runJavaScriptAlert):
+        (WebKit::WebPageProxy::runJavaScriptConfirm):
+        (WebKit::WebPageProxy::runJavaScriptPrompt):
+        Invalidate the responsiveness timer before calling out to the client.
+
+2011-03-26  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        ASSERTION FAILED: m_operationInProgress == NoOperation loading nytimes.com
+        https://bugs.webkit.org/show_bug.cgi?id=57165
+        <rdar://problem/9024311>
+
+        The assertion fired because during GC, the web process sends a synchronous NPObjectMessageReceiver::Deallocate
+        message to the plug-in process. Since this is a synchronous message, the web process needs to process incoming synchronous
+        messages. While waiting, we get an incoming PluginProxy::Evaluate message from the plug-in. This causes JavaScript to run
+        during GC which is very bad.
+
+        The fix for this is to add a flag on the connection that will cause synchronous messages sent by the connection (in this case the
+        plug-in process) to not be processed while the other side (the web process) is waiting for a synchronous reply _unless_ the connection
+        is actually processing a synchronous message. (The last part is to avoid deadlocks).
+
+        Since the call to NPN_Evaluate by the plug-in (that ends up sending the PluginProxy::Evaluate message) comes from a run loop timer firing,
+        it's OK to wait for it to be processed by the web process when it returns to the run loop.
+
+        * Platform/CoreIPC/Connection.cpp:
+        (CoreIPC::Connection::Connection):
+        Initialize m_onlySendMessagesAsDispatchWhenWaitingForSyncReplyWhenProcessingSuchAMessage and m_inDispatchMessageMarkedDispatchWhenWaitingForSyncReplyCount.
+
+        (CoreIPC::Connection::setOnlySendMessagesAsDispatchWhenWaitingForSyncReplyWhenProcessingSuchAMessage):
+        Set m_onlySendMessagesAsDispatchWhenWaitingForSyncReplyWhenProcessingSuchAMessage.
+
+        (CoreIPC::Connection::sendMessage):
+        Don't add the MessageID::DispatchMessageWhenWaitingForSyncReply flag when the right flags has been set on the connection, and it's not processing a synchronous message.
+
+        (CoreIPC::Connection::dispatchMessage):
+        Increment and decrement m_inDispatchMessageMarkedDispatchWhenWaitingForSyncReplyCount accordingly.
+
+        * PluginProcess/WebProcessConnection.cpp:
+        (WebKit::WebProcessConnection::WebProcessConnection):
+        Call setOnlySendMessagesAsDispatchWhenWaitingForSyncReplyWhenProcessingSuchAMessage on the connection.
+
+2011-03-26  Sam Weinig  <sam@webkit.org>
+
+        Rollout r82042 (If a user doesn't have a Database/LocalStorage directory, it can't be created (sandbox violations))
+
+        -[NSString stringByResolvingSymlinksInPath] does not do what we needed for paths within /private.
+        This caused all SSL sites to stop working.
+
+        * WebProcess/mac/WebProcessMac.mm:
+        (WebKit::appendSandboxParameterPath):
+        (WebKit::initializeSandbox):
+
+2011-03-26  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        If a user doesn't have a Database/LocalStorage directory, it can't be created (sandbox violations)
+        <rdar://problem/9127411>
+        https://bugs.webkit.org/show_bug.cgi?id=57164
+
+        * WebProcess/mac/WebProcessMac.mm:
+        (WebKit::appendSandboxParameterPath):
+        (WebKit::initializeSandbox):
+        Use -[NSString stringByResolvingSymlinksInPath] instead of realpath to ensure we can resolve
+        symlinks even if the file/directory doesn't exist yet.
+
+2011-03-26  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Factor processing of incoming sync replies out into processIncomingSyncReply
+        https://bugs.webkit.org/show_bug.cgi?id=57161
+
+        * Platform/CoreIPC/Connection.cpp:
+        (CoreIPC::Connection::sendSyncMessage):
+        Pass DispatchMessageEvenWhenWaitingForSyncReply to sendMessage.
+
+        (CoreIPC::Connection::processIncomingSyncReply):
+        Move code from processIncomingMessage to here.
+
+        (CoreIPC::Connection::processIncomingMessage):
+        Call processIncomingSyncReply.
+
+2011-03-26  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        WebKit2: Assert in CoreIPC::typeFromCFTypeRef() when loading a site with an invalid certificate
+        <rdar://problem/9188041>
+        https://bugs.webkit.org/show_bug.cgi?id=57159
+
+        * Shared/cf/ArgumentCodersCF.cpp:
+        (CoreIPC::typeFromCFTypeRef):
+        (CoreIPC::encode):
+        (CoreIPC::decode):
+        * Shared/cf/ArgumentCodersCF.h:
+        Add encoding/decoding for SecCertificateRef type.
+
+        * Shared/mac/PlatformCertificateInfo.mm:
+        (WebKit::PlatformCertificateInfo::encode):
+        (WebKit::PlatformCertificateInfo::decode):
+        Use ArgumentCodersCF now that it knows how to encode/decode SecCertificateRefs.
+
+2011-03-26  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Handle synchronous replies coming in out of order
+        https://bugs.webkit.org/show_bug.cgi?id=57158
+
+        When processing an incoming reply, don't assume that it belongs to the last sent synchronous request.
+        Instead, iterate over the m_pendingSyncReplies vector backwards looking for the corresponding request.
+
+        * Platform/CoreIPC/Connection.cpp:
+        (CoreIPC::Connection::processIncomingMessage):
+
+2011-03-26  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Fix a possible deadlock when two synchronous messages are sent at the same time
+        https://bugs.webkit.org/show_bug.cgi?id=57155
+
+        Simplify code and fix a possible (although highly improbable) dead lock.
+
+        * Platform/CoreIPC/Connection.cpp:
+        Make SyncMessageState atomically ref counted since it can be ref()'ed from the connection queue.
+        Get rid of m_waitForSyncReplyCount and add m_didScheduleDispatchMessagesWork.
+
+        (CoreIPC::Connection::SyncMessageState::SyncMessageState):
+        Initialize m_didScheduleDispatchMessagesWork to false.
+
+        (CoreIPC::Connection::SyncMessageState::processIncomingMessage):
+        if m_didScheduleDispatchMessagesWork is false, schedule a call to dispatchMessageAndResetDidScheduleDispatchMessagesWork
+        on the client run loop.
+
+        (CoreIPC::Connection::SyncMessageState::dispatchMessageAndResetDidScheduleDispatchMessagesWork):
+        Dispatch messages and set m_didScheduleDispatchMessagesWork back to false.
+
+        (CoreIPC::Connection::sendSyncMessage):
+        Remove calls to beginWaitForSyncReply and endWaitForSyncReply.
+
+2011-03-25  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Adele Peterson.
+
+        WKPageLoadAlternateHTMLString doesn't re-spawn a dead WebProcess, but should
+        <rdar://problem/9191493>
+        https://bugs.webkit.org/show_bug.cgi?id=57134
+
+        Make all load functions respawn a dead WebProcess for consistency.
+
+        * UIProcess/WebPageProxy.cpp:
+        (WebKit::WebPageProxy::loadHTMLString):
+        Respawn a dead WebProcess.
+
+        (WebKit::WebPageProxy::loadAlternateHTMLString):
+        Respawn a dead WebProcess.
+
+        (WebKit::WebPageProxy::loadPlainTextString):
+        Respawn a dead WebProcess.
+
+        (WebKit::WebPageProxy::didStartProvisionalLoadForFrame):
+        * UIProcess/WebPageProxy.h:
+        * UIProcess/WebPageProxy.messages.in:
+        * WebProcess/WebCoreSupport/WebFrameLoaderClient.cpp:
+        (WebKit::WebFrameLoaderClient::dispatchDidStartProvisionalLoad):
+        * WebProcess/WebPage/WebPage.cpp:
+        (WebKit::WebPage::loadAlternateHTMLString):
+        Since we may no longer always have a main frame when calling WKPageLoadAlternateHTMLString,
+        set the unreachable URL, if there is one, on provisional load.
+
+2011-03-25  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        PluginView's call to invalidateContentsAndWindow() in invalidateRect() is wrong for plug-ins which paint into compositing layers
+        https://bugs.webkit.org/show_bug.cgi?id=57133
+        <rdar://problem/9029442>
+
+        * WebProcess/Plugins/Netscape/mac/NetscapePluginMac.mm:
+        (WebKit::NetscapePlugin::platformInvalidate):
+        Return true under the Core Animation drawing model, since that prevents the plug-in from calling PluginController::invalidate.
+
+        * WebProcess/Plugins/PluginView.cpp:
+        (WebKit::PluginView::invalidateRect):
+        Don't call invalidateContentsAndWindow() if the plug-in has a Core Animation layer.
+
+2011-03-25  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        <rdar://problem/8648311> and https://bugs.webkit.org/show_bug.cgi?id=56425
+        WebKit2 IconDatabase and API
+
+        This gets a basic, usable API in place.
+        Enhancements can come in other bugs as they're needed.
+
+        * UIProcess/API/C/WKIconDatabase.cpp:
+        (WKIconDatabaseRetainIconForURL):
+        (WKIconDatabaseReleaseIconForURL):
+        (WKIconDatabaseEnableDatabaseCleanup):
+        * UIProcess/API/C/WKIconDatabase.h:
+        
+        The first actual accessor for an "icon for a URL" is for a CGImageRef:
+        * UIProcess/API/C/cg: Added.
+        * UIProcess/API/C/cg/WKIconDatabaseCG.cpp: Added.
+        (WKIconDatabaseGetCGImageForURL):
+        * UIProcess/API/C/cg/WKIconDatabaseCG.h: Added.
+        
+        Expose relevant methods to support the above API:
+        * UIProcess/WebIconDatabase.cpp:
+        (WebKit::WebIconDatabase::WebIconDatabase): New IconDatabases will have cleanup disabled from the start,
+          and require a single call to "enableDatabaseCleanup" to allow cleanup.
+        (WebKit::WebIconDatabase::setDatabasePath):
+        (WebKit::WebIconDatabase::enableDatabaseCleanup):
+        (WebKit::WebIconDatabase::imageForPageURL):
+        * UIProcess/WebIconDatabase.h:
+        
+        Project file stuff:
+        * WebKit2.xcodeproj/project.pbxproj:
+        * win/WebKit2.vcproj:
+
+2011-03-25  Jeff Miller  <jeffm@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Add CoreIPC::encodeResourceError() and CoreIPC::decodeResourceError() for all platforms
+        https://bugs.webkit.org/show_bug.cgi?id=57125
+        
+        Currently, these are only implemented on the Mac, but we're going to need them for Windows as well, so we might as well make them always platform-specific.
+        In this patch, just replicate the existing common non-Mac implementation in WebCoreArgumentCoders.h to platform-specific files.
+
+        * Shared/WebCoreArgumentCoders.h: Move non-Mac implementations of encodeResourceError() and decodeResourceError() to common files.
+        * Shared/gtk/WebCoreArgumentCodersGtk.cpp:
+        (CoreIPC::encodeResourceError): Added.
+        (CoreIPC::decodeResourceError): Added.
+        * Shared/qt/WebCoreArgumentCodersQt.cpp:
+        (CoreIPC::encodeResourceError): Added.
+        (CoreIPC::decodeResourceError): Added.
+        * Shared/win/WebCoreArgumentCodersWin.cpp:
+        (CoreIPC::encodeResourceError): Added.
+        (CoreIPC::decodeResourceError): Added.
+
+2011-03-25  Andy Estes  <aestes@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        REGRESSION (r70748): latest nightly builds kills AC_QuickTime.js
+        https://bugs.webkit.org/show_bug.cgi?id=49016
+
+        Update objectContentType() implementation to handle the
+        shouldPreferPlugInsForImages flag.
+
+        * WebProcess/WebCoreSupport/WebFrameLoaderClient.cpp:
+        (WebKit::WebFrameLoaderClient::objectContentType):
+        * WebProcess/WebCoreSupport/WebFrameLoaderClient.h:
+
+2011-03-25  Brent Fulgham  <bfulgham@webkit.org>
+
+        Unreviewed build correction.
+
+        Add stubs for WK2 cookie handling with cURL.
+
+        * WebProcess/Cookies/curl: Added.
+        * WebProcess/Cookies/curl/WebCookieManagerCurl.cpp: Added.
+        (WebKit::WebCookieManager::platformSetHTTPCookieAcceptPolicy):
+        (WebKit::WebCookieManager::platformGetHTTPCookieAcceptPolicy):
+        * win/WebKit2.vcproj:
+
+2011-03-25  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Brian Weinstein.
+
+        Microsoft Windows Presentation Foundation (WPF) plug-in complains about missing xpcom.dll
+        https://bugs.webkit.org/show_bug.cgi?id=57119
+        <rdar://problem/9054148>
+
+        This plug-in from Microsoft links against xpcom.dll, which is a Firefox-specific DLL
+        not available in WebKit. The plug-in is fairly widespread, since it was included in
+        a Windows Update push at one point.
+
+        * UIProcess/Plugins/win/PluginInfoStoreWin.cpp:
+        (WebKit::PluginInfoStore::shouldUsePlugin): Blacklist npwpf.dll.
+
+2011-03-25  Jessie Berlin  <jberlin@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        WebKit2: Need to be able to set and get the Cookie Storage Policy.
+        https://bugs.webkit.org/show_bug.cgi?id=50780
+
+        Part 2: Make it possible to set the initial policy on Windows.
+
+        In WebKit1, we read the initial policy on Windows from WebPreferences at startup.
+        Since that is not possible in WebKit2, make it possible to specify the initial policy
+        as a creation parameter to the WebProcess.
+
+        * Shared/WebProcessCreationParameters.cpp:
+        (WebKit::WebProcessCreationParameters::encode):
+        Encode initialHTTPCookieAcceptPolicy on Windows.
+        (WebKit::WebProcessCreationParameters::decode):
+        Decode initialHTTPCookieAcceptPolicy on Windows.
+        * Shared/WebProcessCreationParameters.h:
+
+        * UIProcess/API/C/win/WKContextPrivateWin.h:
+        * UIProcess/API/C/win/WKContextWin.cpp:
+        (WKContextSetInitialHTTPCookieAcceptPolicy):
+        Call through to WebContext.
+
+        * UIProcess/WebContext.cpp:
+        (WebKit::WebContext::WebContext):
+        Give the initial policy a default of "Always".
+        * UIProcess/WebContext.h:
+        (WebKit::WebContext::setInitialHTTPCookieAcceptPolicy):
+        * UIProcess/win/WebContextWin.cpp:
+        (WebKit::WebContext::platformInitializeWebProcess):
+        Set the initial policy on Windows.
+
+        * WebProcess/Cookies/WebCookieManager.h:
+        Make setHTTPCookieAcceptPolicy public so that it can be called from WebProcessWin.
+
+        * WebProcess/win/WebProcessWin.cpp:
+        (WebKit::WebProcess::platformInitializeWebProcess):
+        Tell the WebCookieManager about the initial policy.
+
+2011-03-25  Jessie Berlin  <jberlin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        WebKit2: Need to be able to set and get the Cookie Storage Policy.
+        https://bugs.webkit.org/show_bug.cgi?id=50780
+
+        * Shared/HTTPCookieAcceptPolicy.h: Added.
+
+        * UIProcess/API/C/WKAPICast.h:
+        (WebKit::toHTTPCookieAcceptPolicy):
+        (WebKit::toAPI):
+
+        * UIProcess/API/C/WKCookieManager.cpp:
+        (WKCookieManagerSetHTTPCookieAcceptPolicy):
+        Call through to WebCookieManagerProxy.
+        (WKCookieManagerGetHTTPCookieAcceptPolicy):
+        Ditto.
+        * UIProcess/API/C/WKCookieManager.h:
+
+        * UIProcess/WebCookieManagerProxy.cpp:
+        (WebKit::WebCookieManagerProxy::invalidate):
+        Invalidate the get http cookie accept policy callbacks.
+        (WebKit::WebCookieManagerProxy::setHTTPCookieAcceptPolicy):
+        Send a message to the Web Process with the new value.
+        (WebKit::WebCookieManagerProxy::getHTTPCookieAcceptPolicy):
+        Keep track of the callback and send a message to the Web Process.
+        (WebKit::WebCookieManagerProxy::didGetHTTPCookieAcceptPolicy):
+        Invoke the callback.
+        * UIProcess/mac/WebCookieManagerProxyMac.mm: Added.
+        (WebKit::WebCookieManagerProxy::persistHTTPCookieAcceptPolicy):
+        On Mac, also set the policy in the UI Process because the sandboxed Web Process cannot
+        persist the policy.
+        * UIProcess/WebCookieManagerProxy.h:
+        * UIProcess/WebCookieManagerProxy.messages.in:
+
+        * WebKit2.pri:
+        * WebKit2.pro:
+        * WebKit2.xcodeproj/project.pbxproj:
+        * win/WebKit2.vcproj:
+        * win/WebKit2Common.vsprops:
+
+        * WebProcess/Cookies/WebCookieManager.cpp:
+        (WebKit::WebCookieManager::setHTTPCookieAcceptPolicy):
+        Call platformSetHTTPCookieAcceptPolicy.
+        (WebKit::WebCookieManager::getHTTPCookieAcceptPolicy):
+        Send the result of platformGetHTTPCookieAcceptPolicy to the UI Process.
+        * WebProcess/Cookies/WebCookieManager.h:
+        * WebProcess/Cookies/WebCookieManager.messages.in:
+
+        * WebProcess/Cookies/cf: Added.
+        * WebProcess/Cookies/cf/WebCookieManagerCFNet.cpp: Added.
+        (WebKit::WebCookieManager::platformSetHTTPCookieAcceptPolicy):
+        Set the policy on both the default cookie storage and any Private Browsing cookie storage.
+        (WebKit::WebCookieManager::platformGetHTTPCookieAcceptPolicy):
+        * WebProcess/Cookies/mac: Added.
+        * WebProcess/Cookies/mac/WebCookieManagerMac.mm: Added.
+        (WebKit::WebCookieManager::platformSetHTTPCookieAcceptPolicy):
+        Set the policy on the default cookie storage and add a FIXME to set it on any Private
+        Browsing cookie storage.
+        (WebKit::WebCookieManager::platformGetHTTPCookieAcceptPolicy):
+
+        * WebProcess/Cookies/gtk: Added.
+        * WebProcess/Cookies/gtk/WebCookieManagerGtk.cpp: Added.
+        (WebKit::WebCookieManager::platformSetHTTPCookieAcceptPolicy):
+        (WebKit::WebCookieManager::platformGetHTTPCookieAcceptPolicy):
+        * WebProcess/Cookies/qt: Added.
+        * WebProcess/Cookies/qt/WebCookieManagerQt.cpp: Added.
+        (WebKit::WebCookieManager::platformSetHTTPCookieAcceptPolicy):
+        (WebKit::WebCookieManager::platformGetHTTPCookieAcceptPolicy):
+
+2011-03-25  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        REGRESSION(r79227): CFURLCache not initialized correctly in WebKit2
+        https://bugs.webkit.org/show_bug.cgi?id=57109
+        <rdar://problem/9184590>
+        
+        Check for a trailing Windows path separator, not a Unix path separator.
+
+        * UIProcess/win/WebContextWin.cpp:
+        (WebKit::WebContext::platformInitializeWebProcess):
+
+2011-03-25  Benjamin Poulain  <benjamin.poulain@nokia.com>
+
+        Reviewed by Andreas Kling.
+
+        [Qt] QtWebKit will not compile with QT_ASCII_CAST_WARNINGS enabled
+        https://bugs.webkit.org/show_bug.cgi?id=57087
+
+        Use explicit conversion for string to avoid depending on the default codec
+        installed by the user code.
+
+        * Platform/qt/SharedMemoryQt.cpp:
+        (WebKit::SharedMemory::create):
+        * Shared/Plugins/Netscape/x11/NetscapePluginModuleX11.cpp:
+        (WebKit::initializeGTK):
+        * UIProcess/API/qt/tests/qgraphicswkview/tst_qgraphicswkview.cpp:
+        (tst_QGraphicsWKView::loadEmptyPage):
+        (tst_QGraphicsWKView::loadEmptyUrl):
+        * UIProcess/API/qt/tests/qwkpage/tst_qwkpage.cpp:
+        (tst_QWKPage::loadEmptyUrl):
+        * UIProcess/Launcher/qt/ProcessLauncherQt.cpp:
+        (WebKit::ProcessLauncher::launchProcess):
+        * WebProcess/Plugins/Netscape/x11/NetscapePluginX11.cpp:
+        (WebKit::getPluginDisplay):
+        * WebProcess/qt/WebProcessMainQt.cpp:
+        (WebKit::EnvHttpProxyFactory::initializeFromEnvironment):
+        (WebKit::WebProcessMainQt):
+
+2011-03-25  Brent Fulgham  <bfulgham@webkit.org>
+
+        Correct project file missing $(WebKitVSPropsRedirectionDir)s
+        after r81924.
+
+        * win/WebKit2.vcproj: Restore lost $(WebKitVSPropsRedirectionDir)
+
+2011-03-25  Alejandro G. Castro  <alex@igalia.com>
+
+        Reviewed by Martin Robinson.
+
+        [WK2] Consider .c files in the generate-forwarding-headers script
+        https://bugs.webkit.org/show_bug.cgi?id=56680
+
+        * Scripts/generate-forwarding-headers.pl:
+
+2011-03-24  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r81916 and r81917.
+        http://trac.webkit.org/changeset/81916
+        http://trac.webkit.org/changeset/81917
+        https://bugs.webkit.org/show_bug.cgi?id=57071
+
+        broke a test on platforms that do not have QuickTime installed
+        (Requested by estes on #webkit).
+
+        * WebProcess/WebCoreSupport/WebFrameLoaderClient.cpp:
+        (WebKit::WebFrameLoaderClient::objectContentType):
+        * WebProcess/WebCoreSupport/WebFrameLoaderClient.h:
+
+2011-03-24  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=57069
+        Add WKIconDatabase api to the project files, and expose accessor on WKContext.
+
+        Project file stuffs:
+        * GNUmakefile.am:
+        * WebKit2.xcodeproj/project.pbxproj:
+        * win/WebKit2.vcproj:
+
+        * Shared/API/c/WKBase.h:
+        * UIProcess/API/C/WKAPICast.h:
+
+        * UIProcess/API/C/WKContext.cpp:
+        (WKContextGetIconDatabase):
+        * UIProcess/API/C/WKContext.h:
+
+        * UIProcess/API/C/WKIconDatabase.cpp: Added.
+        (WKIconDatabaseGetTypeID):
+        * UIProcess/API/C/WKIconDatabase.h: Added.
+
+        * UIProcess/WebContext.h:
+        (WebKit::WebContext::iconDatabase):
+
+2011-03-24  Brent Fulgham  <bfulgham@webkit.org>
+
+        Build correction.
+
+        Disable the CA Layer stuff when building with Cairo.
+
+        * win/WebKit2.vcproj:
+
+2011-03-24  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=57058
+        Hookup the UIProcess WebIconDatabase to a WebCore::IconDatabase as its implementation
+
+        * UIProcess/WebIconDatabase.cpp:
+        (WebKit::WebIconDatabase::WebIconDatabase):
+        (WebKit::WebIconDatabase::setDatabasePath): Create a new WebCore::IconDatabase and open it to this path.
+        (WebKit::WebIconDatabase::retainIconForPageURL): Actually retain the url, using the impl.
+        (WebKit::WebIconDatabase::releaseIconForPageURL): Actually release the url, using the impl.
+        (WebKit::WebIconDatabase::setIconURLForPageURL): Actually set the url, using the impl.
+        (WebKit::WebIconDatabase::setIconDataForIconURL): Actually set the data, using the impl.
+        (WebKit::WebIconDatabase::getLoadDecisionForIconURL): Actually ask for a load decision to call back with.
+        (WebKit::WebIconDatabase::performImport):
+        (WebKit::WebIconDatabase::didImportIconURLForPageURL):
+        (WebKit::WebIconDatabase::didImportIconDataForPageURL):
+        (WebKit::WebIconDatabase::didChangeIconForPageURL):
+        (WebKit::WebIconDatabase::didRemoveAllIcons):
+        (WebKit::WebIconDatabase::didFinishURLImport): Notify all the pending callbacks what their load decisions
+          are now that they're available.
+        * UIProcess/WebIconDatabase.h:
+
+        Add an IconDatabase logging channel:
+        * Platform/Logging.cpp:
+        (WebKit::initializeLogChannelsIfNecessary):
+        * Platform/Logging.h:
+
+        * UIProcess/WebContext.cpp:
+        (WebKit::WebContext::setIconDatabasePath): Pass the new path on to the WebIconDatabase, possibly
+          opening it.
+        * UIProcess/WebContext.h:
+
+2011-03-24  Andy Estes  <aestes@apple.com>
+
+        Reviewed by Darin Adler.
+
+        REGRESSION (r70748): latest nightly builds kills AC_QuickTime.js
+        https://bugs.webkit.org/show_bug.cgi?id=49016
+
+        Update objectContentType() implementation to handle the
+        shouldPreferPlugInsForImages flag.
+
+        * WebProcess/WebCoreSupport/WebFrameLoaderClient.cpp:
+        (WebKit::WebFrameLoaderClient::objectContentType):
+        * WebProcess/WebCoreSupport/WebFrameLoaderClient.h:
+
+2011-03-24  Adam Roben  <aroben@apple.com>
+
+        Start compiling LayerTreeHostCA on Windows
+
+        Fixes <http://webkit.org/b/57060> WebKit2.vcproj should compile LayerTreeHostCA
+
+        Reviewed by Anders Carlsson.
+
+        * WebProcess/WebPage/ca/win/LayerTreeHostCAWin.cpp: Added.
+        (WebKit::LayerTreeHostCA::platformInitialize):
+        (WebKit::LayerTreeHostCA::scheduleLayerFlush):
+        (WebKit::LayerTreeHostCA::platformInvalidate):
+        (WebKit::LayerTreeHostCA::platformSizeDidChange):
+        (WebKit::LayerTreeHostCA::platformForceRepaint):
+        (WebKit::LayerTreeHostCA::platformDidPerformScheduledLayerFlush):
+        Stubbed out.
+
+        * win/WebKit2.vcproj: Added new files. Let VS reorder existing files.
+
+        * win/WebKit2Apple.vsprops: Added WebProcess\WebPage\ca to the include path.
+
+2011-03-24  Jer Noble  <jer.noble@apple.com>
+
+        Unreviewed build fix.
+
+        Remove reference to LayerTreeHostMac.h from WebFullScreenManagerMac.mm.
+
+        * WebProcess/FullScreen/mac/WebFullScreenManagerMac.mm:
+
+2011-03-24  Adam Roben  <aroben@apple.com>
+
+        Split Mac-specific parts of LayerTreeHostCA into LayerTreeHostCAMac.mm
+
+        Fixes <http://webkit.org/b/57046> LayerTreeHostMac's code should be shareable with Windows
+
+        Reviewed by Anders Carlsson.
+
+        * WebKit2.xcodeproj/project.pbxproj:
+
+        * WebProcess/WebPage/ca/LayerTreeHostCA.cpp: Renamed from Source/WebKit2/WebProcess/WebPage/ca/LayerTreeHostCA.mm.
+        (WebKit::LayerTreeHostCA::LayerTreeHostCA): Moved some Mac-specific code to
+        LayerTreeHostCAMac.mm.
+        (WebKit::LayerTreeHostCA::~LayerTreeHostCA): Wrapped some Mac-specific code in
+        PLATFORM(MAC).
+
+        (WebKit::LayerTreeHostCA::invalidate):
+        (WebKit::LayerTreeHostCA::sizeDidChange):
+        (WebKit::LayerTreeHostCA::forceRepaint):
+        Moved some Mac-specific code to LayerTreeHostCAMac.mm.
+
+        (WebKit::LayerTreeHostCA::performScheduledLayerFlush): Renamed from
+        flushPendingLayerChangesRunLoopObserverCallback. Moved some code from here...
+        (WebKit::LayerTreeHostCA::didPerformScheduledLayerFlush): ...to here. Moved some
+        Mac-specific code to LayerTreeHostCAMac.mm.
+
+        * WebProcess/WebPage/ca/LayerTreeHostCA.h: Added new functions, wrapped some Mac-specific
+        declarations in PLATFORM(MAC).
+
+        * WebProcess/WebPage/ca/mac/LayerTreeHostCAMac.mm: Added.
+        (WebKit::LayerTreeHostCA::platformInitialize):
+        (WebKit::LayerTreeHostCA::scheduleLayerFlush):
+        (WebKit::LayerTreeHostCA::platformInvalidate):
+        (WebKit::LayerTreeHostCA::platformSizeDidChange):
+        (WebKit::LayerTreeHostCA::platformForceRepaint):
+        (WebKit::LayerTreeHostCA::flushPendingLayerChangesRunLoopObserverCallback):
+        (WebKit::LayerTreeHostCA::platformDidPerformScheduledLayerFlush):
+        Code was extracted from LayerTreeHostCA.cpp.
+
+2011-03-24  Adam Roben  <aroben@apple.com>
+
+        Rename LayerTreeHostMac to LayerTreeHostCA
+
+        This is the first step toward sharing code with Windows.
+
+        Fixes <http://webkit.org/b/57051>.
+
+        Reviewed by Anders Carlsson.
+
+        * WebKit2.xcodeproj/project.pbxproj:
+        * WebProcess/WebPage/LayerTreeHost.cpp:
+        (WebKit::LayerTreeHost::create):
+        Updated for rename.
+
+        * WebProcess/WebPage/ca/LayerTreeHostCA.h: Renamed from Source/WebKit2/WebProcess/WebPage/mac/LayerTreeHostMac.h.
+        * WebProcess/WebPage/ca/LayerTreeHostCA.mm: Renamed from Source/WebKit2/WebProcess/WebPage/mac/LayerTreeHostMac.mm.
+
+2011-03-17  Jer Noble  <jer.noble@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        WebKit2: Cancelling full screen early leaves full screen window up.
+        https://bugs.webkit.org/show_bug.cgi?id=56589
+
+        No new tests, as WebKitTestRunner does not currently support the new Full Screen API.
+
+        Notify the UIProcess when it needs to tear down its layer hosting view, turn off
+        the background layer when not in accelerated rendering mode and don't swap out 
+        the web view unnecessarily 
+
+        * UIProcess/mac/WKFullScreenWindowController.mm:
+        (-[WKFullScreenWindowController beganExitFullScreenAnimation]): Check before swapping _webView.
+        (-[WKFullScreenWindowController enterAcceleratedCompositingMode:]): Add the _layerHostingView
+            to the full screen window's animationView, not its contentsView.
+        (-[WKFullScreenWindowController exitAcceleratedCompositingMode]): Hide the background layer.
+        * WebProcess/FullScreen/mac/WebFullScreenManagerMac.mm:
+        (WebKit::WebFullScreenManagerMac::setRootFullScreenLayer): If given a null rootLayer, tell
+            the client to exit accelerated mode.
+
+2011-03-24  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        WebKit2:Services menu item to convert selected Simplified/Traditional Chinese Text is not working.
+        https://bugs.webkit.org/show_bug.cgi?id=56975
+        <rdar://problem/8915066>
+        
+        Adding missing entry point to support Mac OS X services in WebKit2.
+
+        * UIProcess/API/mac/WKView.mm:
+        (-[WKView readSelectionFromPasteboard:]): Added.
+        * UIProcess/WebPageProxy.h:
+        * UIProcess/mac/WebPageProxyMac.mm:
+        (WebKit::WebPageProxy::readSelectionFromPasteboard): Added.
+        * WebProcess/WebPage/WebPage.h:
+        * WebProcess/WebPage/WebPage.messages.in: Added synchronous
+        message.
+        * WebProcess/WebPage/mac/WebPageMac.mm:
+        (WebKit::WebPage::readSelectionFromPasteboard): Added.
+
+2011-03-24  Jia Pu  <jpu@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Dismissed reversion suggestion is incorrectly learned.
+        https://bugs.webkit.org/show_bug.cgi?id=57039
+
+        CorrectionPanel should always use [NSSpellChecker dismissCorrectionBubbleForView].
+        [NSSpellChecker cancelCorrectionBubbleForView] is reserved for situation where correction panel
+        is dismissed explicitly by ESC key or clicking the dimiss button. Misusing these causes
+        incorrect automatic learning.
+
+        * UIProcess/mac/CorrectionPanel.mm:
+        (WebKit::CorrectionPanel::dismissInternal):
+
+2011-03-24  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Adam Roben.
+
+        WebKit2: Add Trackpoint driver hack to support IBM trackpads
+        https://bugs.webkit.org/show_bug.cgi?id=49830
+        <rdar://problem/8705951>
+
+        Copy code from WebKit1 to WebKit2 to handle initializing fake scrollbars so 
+        IBM machines with a trackpad send us WM_VSCROLL and WM_HSCROLL messages.
+
+        Listen for the WM_VSCROLL and WM_HSCROLL messages, and turn the values into
+        ScrollDirection and ScrollGranularity, and send a scroll command to the
+        WebProcess.
+
+        * UIProcess/WebPageProxy.cpp:
+        (WebKit::WebPageProxy::scrollBy): Send a message to the WebProcess.
+        * UIProcess/WebPageProxy.h:
+        * UIProcess/win/WebView.cpp:
+        (WebKit::WebView::wndProc): Add WM_VSCROLL and WM_HSCROLL message handling.
+        (WebKit::WebView::initialize): Call shouldInitializeTrackPointHack.
+        (WebKit::WebView::onHorizontalScroll): Turn wParam into a ScrollDirection and ScrollGranularity. 
+        (WebKit::WebView::onVerticalScroll): Ditto.
+        (WebKit::WebView::shouldInitializeTrackPointHack): Check the registry for keys that indicate
+            the machine has a IBM Trackpoint driver.
+        * UIProcess/win/WebView.h:
+        * WebProcess/WebPage/WebPage.cpp:
+        (WebKit::WebPage::scrollBy): Call scroll method.
+        (WebKit::WebPage::scroll): Moved from WebPageMac and WebPageWin.
+        (WebKit::WebPage::logicalScroll): Ditto.
+        * WebProcess/WebPage/WebPage.h:
+        * WebProcess/WebPage/WebPage.messages.in: Add a new scrollBy message. 
+        * WebProcess/WebPage/mac/WebPageMac.mm: Remove scroll and logicalScroll, they are now in WebPage.cpp.
+        * WebProcess/WebPage/win/WebPageWin.cpp: Ditto.
+
+2011-03-24  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Dictionary text extraction is not correctly detecting word boundaries on bing.com
+        <rdar://problem/9078569>
+        https://bugs.webkit.org/show_bug.cgi?id=56995
+
+        * Shared/DictionaryPopupInfo.cpp:
+        (WebKit::DictionaryPopupInfo::encode):
+        (WebKit::DictionaryPopupInfo::decode):
+        * Shared/DictionaryPopupInfo.h:
+        Add options dictionary.
+
+        * UIProcess/API/mac/PageClientImpl.mm:
+        (WebKit::PageClientImpl::didPerformDictionaryLookup):
+        Add path that can pass options through.
+
+        * WebProcess/WebCoreSupport/mac/WebContextMenuClientMac.mm:
+        (WebKit::WebContextMenuClient::lookUpInDictionary):
+        Use the new performDictionaryLookupForSelection which can extract context
+        if supported.
+
+        * WebProcess/WebPage/WebPage.h:
+        * WebProcess/WebPage/mac/WebPageMac.mm:
+        (WebKit::characterRangeAtPositionForPoint):
+        (WebKit::characterRangeAtPoint):
+        Split functionality out of characterRangeAtPoint and into 
+        characterRangeAtPositionForPoint to avoid doing duplicate work 
+        if you already have the position.
+
+        (WebKit::isPositionInRange):
+        (WebKit::shouldUseSelection):
+        Add predicate to determine if we should use the selection instead
+        of expanding to find the word we are over.
+
+        (WebKit::WebPage::performDictionaryLookupAtLocation):
+        If available, use the surrounding paragraph as context to get better extraction
+        and to get lexicographical information about the word. Also, clean up and use 
+        editing APIs to make the code more concise and understandable.
+
+        (WebKit::WebPage::performDictionaryLookupForSelection):
+        Use similar logic as in performDictionaryLookupAtLocation to extract additional
+        details from a selection for use in the dictionary popup.
+
+        (WebKit::WebPage::performDictionaryLookupForRange):
+        Pass options to WebProcess if available.
+
+2011-03-24  Jon Lee  <jonlee@apple.com>
+
+        Reviewed by Darin Adler.
+
+        WebKit2: Tabbing from the last focused field to a non-webpage element leaves the selection in a weird state
+        <rdar://problem/8553962>
+
+        * WebProcess/WebPage/WebPage.cpp:
+        (WebKit::WebPage::setFocused): When the page loses focus, clear out any selection in the frame
+
+2011-03-24  Brian Weinstein  <bweinstein@apple.com>
+
+        Rubber-stamped by Sam Weinig.
+
+        Fix a typo in the VK_LEFT case of performDefaultBehaviorForKeyEvent.
+
+        * WebProcess/WebPage/mac/WebPageMac.mm:
+        (WebKit::WebPage::performDefaultBehaviorForKeyEvent): It should be a logical or,
+            not a bitwise or.
+
+2011-03-24  Jeff Miller  <jeffm@apple.com>
+
+        Fix typo - USE(CF_NETWORK) should be USE(CFNETWORK).
+
+        * WebProcess/InjectedBundle/win/InjectedBundleWin.cpp:
+        (WebKit::InjectedBundle::setHostAllowsAnyHTTPSCertificate): USE(CF_NETWORK) should be USE(CFNETWORK)
+
+2011-03-23  Jia Pu  <jpu@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Hook up new AppKit autocorrection UI with WK2.
+        https://bugs.webkit.org/show_bug.cgi?id=56055
+        <rdar://problem/8947463>
+
+        Please see WebCore/ChangeLog for detail.
+
+        The calls to AppKit are implemented in PageClientImpl. Other changes are necessary for the
+        plumbing work.
+
+        * UIProcess/API/mac/PageClientImpl.h:
+        * UIProcess/API/mac/PageClientImpl.mm:
+        (WebKit::PageClientImpl::showCorrectionPanel):
+        (WebKit::PageClientImpl::dismissCorrectionPanel):
+        (WebKit::PageClientImpl::dismissCorrectionPanelSoon):
+        (WebKit::PageClientImpl::recordAutocorrectionResponse):
+        * UIProcess/API/mac/WKView.mm:
+        (-[WKView spellCheckerDocumentTag]):
+        (-[WKView handleCorrectionPanelResult:]):
+        * UIProcess/API/mac/WKViewPrivate.h:
+        * UIProcess/PageClient.h:
+        * UIProcess/WebPageProxy.cpp:
+        (WebKit::WebPageProxy::didCommitLoadForFrame):
+        (WebKit::WebPageProxy::showCorrectionPanel):
+        (WebKit::WebPageProxy::dismissCorrectionPanel):
+        (WebKit::WebPageProxy::dismissCorrectionPanelSoon):
+        (WebKit::WebPageProxy::recordAutocorrectionResponse):
+        (WebKit::WebPageProxy::handleCorrectionPanelResult):
+        * UIProcess/WebPageProxy.h:
+        * UIProcess/WebPageProxy.messages.in:
+        * UIProcess/mac/CorrectionPanel.h: Added.
+        (WebKit::CorrectionPanel::isShowing):
+        * UIProcess/mac/CorrectionPanel.mm: Added.
+        (correctionBubbleType):
+        (WebKit::CorrectionPanel::CorrectionPanel):
+        (WebKit::CorrectionPanel::~CorrectionPanel):
+        (WebKit::CorrectionPanel::show):
+        (WebKit::CorrectionPanel::dismiss):
+        (WebKit::CorrectionPanel::dismissSoon):
+        (WebKit::CorrectionPanel::dismissInternal):
+        (WebKit::CorrectionPanel::recordAutocorrectionResponse):
+        * WebKit2.xcodeproj/project.pbxproj:
+        * WebProcess/WebCoreSupport/WebEditorClient.h:
+        * WebProcess/WebCoreSupport/mac/WebEditorClientMac.mm:
+        (WebKit::WebEditorClient::showCorrectionPanel):
+        (WebKit::WebEditorClient::dismissCorrectionPanel):
+        (WebKit::WebEditorClient::dismissCorrectionPanelSoon):
+        (WebKit::WebEditorClient::recordAutocorrectionResponse):
+        * WebProcess/WebPage/WebPage.cpp:
+        (WebKit::WebPage::handleCorrectionPanelResult):
+        * WebProcess/WebPage/WebPage.h:
+        * WebProcess/WebPage/WebPage.messages.in:
+
+2011-03-23  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        WebKit2: Need API to manage the Media Cache
+        https://bugs.webkit.org/show_bug.cgi?id=56878
+        <rdar://problem/9082503>
+
+        Call through to HTMLMediaElement functions to manage the WebCore media cache.
+
+        * WebProcess/MediaCache/WebMediaCacheManager.cpp:
+        (WebKit::WebMediaCacheManager::getHostnamesWithMediaCache):
+        (WebKit::WebMediaCacheManager::clearCacheForHostname):
+        (WebKit::WebMediaCacheManager::clearCacheForAllHostnames):
+
+2011-03-23  Jeff Miller  <jeffm@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Add WKBundleSetHostAllowsAnyHTTPSCertificate() for Windows
+        https://bugs.webkit.org/show_bug.cgi?id=56972
+        
+        This is the WebKit2 equivalent to the WebKit1 API IWebMutableURLRequest::setAllowsAnyHTTPSCertificate().
+
+        * WebProcess/InjectedBundle/API/c/WKBundle.cpp:
+        (WKBundleSetHostAllowsAnyHTTPSCertificate): Added.
+        * WebProcess/InjectedBundle/API/c/WKBundlePrivate.h: Added WKBundleSetHostAllowsAnyHTTPSCertificate().
+        * WebProcess/InjectedBundle/InjectedBundle.h: Added setHostAllowsAnyHTTPSCertificate().
+        * WebProcess/InjectedBundle/gtk/InjectedBundleGtk.cpp:
+        (WebKit::InjectedBundle::setHostAllowsAnyHTTPSCertificate): Added, should never be called.
+        * WebProcess/InjectedBundle/mac/InjectedBundleMac.cpp:
+        (WebKit::InjectedBundle::setHostAllowsAnyHTTPSCertificate): Added, should never be called.
+        * WebProcess/InjectedBundle/qt/InjectedBundleQt.cpp:
+        (WebKit::InjectedBundle::setHostAllowsAnyHTTPSCertificate): Added, should never be called.
+        * WebProcess/InjectedBundle/win/InjectedBundleWin.cpp:
+        (WebKit::InjectedBundle::setHostAllowsAnyHTTPSCertificate): Added.
+
+2011-03-23  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Roll out r81593 Need WebKit2 API for creating a page with a specific main frame name
+
+        This API is not necessary.
+
+        * Shared/WebPageCreationParameters.cpp:
+        (WebKit::WebPageCreationParameters::encode):
+        (WebKit::WebPageCreationParameters::decode):
+        * Shared/WebPageCreationParameters.h:
+        * UIProcess/API/mac/WKView.h:
+        * UIProcess/API/mac/WKView.mm:
+        (-[WKView initWithFrame:]):
+        (-[WKView initWithFrame:contextRef:]):
+        (-[WKView initWithFrame:contextRef:pageGroupRef:]):
+        * UIProcess/WebPageProxy.cpp:
+        (WebKit::WebPageProxy::creationParameters):
+        * UIProcess/WebPageProxy.h:
+        * WebProcess/WebPage/WebFrame.cpp:
+        (WebKit::WebFrame::createMainFrame):
+        * WebProcess/WebPage/WebFrame.h:
+        * WebProcess/WebPage/WebPage.cpp:
+        (WebKit::WebPage::WebPage):
+
+2011-03-23  Balazs Kelemen  <kbalazs@webkit.org>
+
+        Reviewed by Andreas Kling.
+
+        [WK2] Handle keyboard and mouse events on X11
+        https://bugs.webkit.org/show_bug.cgi?id=56103
+
+        Propagate keyboard and mouse events to the plugin
+        as XEvent's.
+
+        * WebProcess/Plugins/Netscape/x11/NetscapePluginX11.cpp:
+        (WebKit::initializeXEvent):
+        (WebKit::xTimeStamp):
+        (WebKit::xKeyModifiers):
+        (WebKit::setCommonMouseEventFields):
+        (WebKit::setXMotionEventFields):
+        (WebKit::setXButtonEventFields):
+        (WebKit::setXCrossingEventFields):
+        (WebKit::NetscapePlugin::platformHandleMouseEvent):
+        (WebKit::NetscapePlugin::platformHandleMouseEnterEvent):
+        (WebKit::NetscapePlugin::platformHandleMouseLeaveEvent):
+        (WebKit::setXKeyEventFields):
+        (WebKit::NetscapePlugin::platformHandleKeyboardEvent):
+
+2011-03-23  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Connection::SyncMessageState::processIncomingMessage should ignore whether the message is sync or not
+        https://bugs.webkit.org/show_bug.cgi?id=56954
+
+        This is so we'll eventually be able to send sync messages that aren't processed immediately if the 
+        destination is waiting for a reply to another synchronous message.
+
+        * Platform/CoreIPC/Connection.cpp:
+        (CoreIPC::Connection::SyncMessageState::processIncomingMessage):
+        Only check for the DispatchMessageWhenWaitingForSyncReply flag.
+
+        (CoreIPC::Connection::sendSyncMessage):
+        Add both DispatchMessageWhenWaitingForSyncReply and SyncMessage to the message ID.
+
+        * Platform/CoreIPC/Connection.h:
+        (CoreIPC::Connection::sendSync):        
+        (CoreIPC::Connection::deprecatedSendSync):
+        No need to add SyncMessage here anymore.
+
+2011-03-23  Brian Weinstein  <bweinstein@apple.com>
+
+        Qt Build Fix.
+
+        * DerivedSources.pro:
+
+2011-03-22  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Darin Adler.
+
+        WebKit2: Need API to manage the Media Cache
+        https://bugs.webkit.org/show_bug.cgi?id=56878
+        <rdar://problem/9082503>
+
+        Project File Fun:
+        * GNUmakefile.am:
+        * WebKit2.pri:
+        * WebKit2.pro:
+        * WebKit2.xcodeproj/project.pbxproj:
+        * win/WebKit2.vcproj:
+        * win/WebKit2Common.vsprops:
+        * win/WebKit2Generated.make:
+        
+        Derived Sources and API fun:
+        * DerivedSources.make:
+        * DerivedSources.pro:
+        * Platform/CoreIPC/MessageID.h:
+        * Shared/API/c/WKBase.h:
+        * Shared/APIObject.h:
+        * UIProcess/API/C/WKAPICast.h:
+        
+        * UIProcess/WebProcessProxy.cpp:
+        (WebKit::WebProcessProxy::didReceiveMessage): Add a case for MediaCache messages.
+        * WebProcess/WebProcess.cpp:
+        (WebKit::WebProcess::didReceiveMessage): Ditto.
+        
+        * UIProcess/WebContext.cpp:
+        (WebKit::WebContext::WebContext): Initialize the WebMediaCacheManagerProxy member variable.
+        (WebKit::WebContext::~WebContext): Invalidate the WebMediaCacheManagerProxy.
+        (WebKit::WebContext::disconnectProcess): Ditto.
+        (WebKit::WebContext::didReceiveMessage): Add a case for MediaCache messages.
+        * UIProcess/WebContext.h:
+        (WebKit::WebContext::mediaCacheManagerProxy):
+
+        * UIProcess/API/C/WKContext.cpp:
+        (WKContextGetMediaCacheManager): Returns the context's WebMediaCacheManager.
+        * UIProcess/API/C/WKContext.h:
+
+        * UIProcess/API/C/WKMediaCacheManager.cpp: Added.
+        (WKMediaCacheManagerGetTypeID): Returns the WebMediaCacheManagerProxy type.
+        (WKMediaCacheManagerGetHostnamesWithMediaCache): Calls down to the WebMediaCacheManagerProxy.
+        (WKMediaCacheManagerClearCacheForHostname): Ditto.
+        (WKMediaCacheManagerClearCacheForAllHostnames): Ditto.
+        * UIProcess/API/C/WKMediaCacheManager.h: Added.
+
+        * UIProcess/WebMediaCacheManagerProxy.cpp: Added.
+        (WebKit::WebMediaCacheManagerProxy::create):
+        (WebKit::WebMediaCacheManagerProxy::WebMediaCacheManagerProxy):
+        (WebKit::WebMediaCacheManagerProxy::~WebMediaCacheManagerProxy):
+        (WebKit::WebMediaCacheManagerProxy::invalidate):
+        (WebKit::WebMediaCacheManagerProxy::didReceiveMessage):
+        (WebKit::WebMediaCacheManagerProxy::getHostnamesWithMediaCache): Call through to the WebProcess.
+        (WebKit::WebMediaCacheManagerProxy::didGetHostnamesWithMediaCache): Process the WebProcess response,
+            and call the callback.
+        (WebKit::WebMediaCacheManagerProxy::clearCacheForHostname): Call through to the WebProcess.
+        (WebKit::WebMediaCacheManagerProxy::clearCacheForAllHostnames): Call through to the WebProcess.
+        * UIProcess/WebMediaCacheManagerProxy.h: Added.
+        (WebKit::WebMediaCacheManagerProxy::clearContext):
+        (WebKit::WebMediaCacheManagerProxy::type):
+        * UIProcess/WebMediaCacheManagerProxy.messages.in: Added.
+
+        * WebProcess/MediaCache: Added.
+        * WebProcess/MediaCache/WebMediaCacheManager.cpp: Added.
+        (WebKit::WebMediaCacheManager::shared):
+        (WebKit::WebMediaCacheManager::WebMediaCacheManager):
+        (WebKit::WebMediaCacheManager::didReceiveMessage):
+        (WebKit::WebMediaCacheManager::getHostnamesWithMediaCache): Added a FIXME to call through to WebCore.
+        (WebKit::WebMediaCacheManager::clearCacheForHostname): Ditto.
+        (WebKit::WebMediaCacheManager::clearCacheForAllHostnames): Ditto.
+        * WebProcess/MediaCache/WebMediaCacheManager.h: Added.
+        * WebProcess/MediaCache/WebMediaCacheManager.messages.in: Added.
+
+2011-03-22  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Add asynchronous load decision call to WebKit2 IconDatabase
+        https://bugs.webkit.org/show_bug.cgi?id=56887
+
+        * UIProcess/WebIconDatabase.cpp:
+        (WebKit::WebIconDatabase::getLoadDecisionForIconURL): In the future, get the actual load decision from the database.
+          For now, always message "IconLoadNo" back to the WebProcess.
+        * UIProcess/WebIconDatabase.h:
+        * UIProcess/WebIconDatabase.messages.in:
+        
+        * WebProcess/IconDatabase/WebIconDatabaseProxy.cpp:
+        (WebKit::WebIconDatabaseProxy::loadDecisionForIconURL): Message the UIProcess for the load decision.
+        (WebKit::WebIconDatabaseProxy::receivedIconLoadDecision): Callback into WebCore with the received load decision.
+        * WebProcess/IconDatabase/WebIconDatabaseProxy.h:
+        * WebProcess/IconDatabase/WebIconDatabaseProxy.messages.in:
+
+2011-03-23  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        REGRESSION: WK2: AX: PDF in Safari no longer accessible.
+        https://bugs.webkit.org/show_bug.cgi?id=56849
+
+        The WKView needs to know when to return the WKPDFView and when to return
+        the remote web process connection.
+
+        * UIProcess/API/mac/PDFViewController.h:
+        (WebKit::PDFViewController::pdfView):
+        * UIProcess/API/mac/WKView.mm:
+        (-[WKView accessibilityFocusedUIElement]):
+        (-[WKView accessibilityHitTest:]):
+        (-[WKView accessibilityAttributeValue:]):
+
+2011-03-21  Stephanie Lewis  <slewis@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=56798
+        Wrap autorelease pools around calls that can have pathological memory growth on Membuster.  
+        Only wrap the main runloop because some background threads are not expected to call into 
+        objc and an autorelease pool could mask bugs.
+
+        * Platform/mac/RunLoopMac.mm:
+        (RunLoop::performWork):
+        (RunLoop::TimerBase::timerFired):
+        * WebProcess/WebPage/mac/LayerTreeHostMac.mm:
+        (WebKit::LayerTreeHostMac::flushPendingLayerChangesRunLoopObserverCallback):
+
+2011-03-22  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        OBJECT element with DivX source is always downloaded
+        https://bugs.webkit.org/show_bug.cgi?id=56879
+
+        * Shared/Plugins/Netscape/mac/NetscapePluginModuleMac.mm:
+        (WebKit::getPluginInfoFromPropertyLists):
+        Always try to split every element in the "WebPluginExtensions" array, since the DivX plug-in
+        specifies multiple file extensions in a single element.
+        
+        * WebProcess/WebCoreSupport/WebFrameLoaderClient.cpp:
+        (WebKit::pluginSupportsExtension):
+        Add a new helper function.
+
+        (WebKit::WebFrameLoaderClient::objectContentType):
+        If we can't find the MIME for an extension, explicitly check if there's a plugin that claims to
+        handle the given extension.
+
+2011-03-22  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Rename the synchronous icon database messages to be prefixed with "synchronous"
+
+        * UIProcess/WebIconDatabase.cpp:
+        (WebKit::WebIconDatabase::synchronousIconDataForPageURL):
+        (WebKit::WebIconDatabase::synchronousIconURLForPageURL):
+        (WebKit::WebIconDatabase::synchronousIconDataKnownForIconURL):
+        (WebKit::WebIconDatabase::synchronousLoadDecisionForIconURL):
+        * UIProcess/WebIconDatabase.h:
+        * UIProcess/WebIconDatabase.messages.in:
+
+        * WebProcess/IconDatabase/WebIconDatabaseProxy.cpp:
+        (WebKit::WebIconDatabaseProxy::synchronousIconForPageURL):
+
+2011-03-22  Sam Weinig  <sam@webkit.org>
+
+        Rubber-stamped by Anders Carlsson.
+
+        Loading a new tab does not dismiss Lookup
+        <rdar://problem/9138391> 
+
+        * UIProcess/API/mac/WKView.mm:
+        (-[WKView viewDidMoveToWindow]):
+        Hide the dictionary popup when moving the WKView out of a window.
+
+2011-03-22  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Microsoft Silverlight playback shows artifacts
+        https://bugs.webkit.org/show_bug.cgi?id=56863
+        <rdar://problem/9103136>
+
+        * PluginProcess/PluginControllerProxy.cpp:
+        (WebKit::PluginControllerProxy::paint):
+        If the plug-in is transparent, clear the dirty rect before painting.
+
+        * Shared/Plugins/Netscape/mac/NetscapePluginModuleMac.mm:
+        (WebKit::NetscapePluginModule::determineQuirks):
+        Add the MakeTransparentIfBackgroundAttributeExists quirk for Silverlight plug-ins.
+
+        * Shared/Plugins/PluginQuirks.h:
+        Add MakeTransparentIfBackgroundAttributeExists quirk.
+
+        * WebProcess/Plugins/Netscape/NetscapeBrowserFuncs.cpp:
+        (WebKit::NPN_SetValue):
+        Handle NPPVpluginTransparentBool.
+
+        * WebProcess/Plugins/Netscape/NetscapePlugin.cpp:
+        (WebKit::NetscapePlugin::NetscapePlugin):
+        Initialize m_isTransparent to false.
+
+        (WebKit::NetscapePlugin::setIsTransparent):
+        Set m_isTransparent.
+
+        (WebKit::NetscapePlugin::initialize):
+        If the plug-in has the MakeTransparentIfBackgroundAttributeExists quirk, make it transparent
+        if there's a 'background' attribute.
+
+        (WebKit::NetscapePlugin::isTransparent):
+        Add getter.
+
+        * WebProcess/Plugins/Plugin.h:
+        Add isTransparent().
+
+        * WebProcess/Plugins/PluginProxy.cpp:
+        (WebKit::PluginProxy::paint):
+        Always copy the plug-in backing store to the plug-in proxy backing store.
+
+        (WebKit::PluginProxy::isTransparent):
+        Add getter that should never be called.
+
+        (WebKit::PluginProxy::update):
+        Always copy the plug-in backing store to the plug-in proxy backing store.
+
+2011-03-22  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Crash when calling PluginProxy::evaluate on a destroyed plug-in
+        https://bugs.webkit.org/show_bug.cgi?id=56848
+        <rdar://problem/9168975>
+
+        Return early if the NPObject doesn't exist anymore.
+
+        * WebProcess/Plugins/PluginProxy.cpp:
+        (WebKit::PluginProxy::evaluate):
+
+2011-03-22  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Adam Roben.
+
+        WebKit2: Cannot make a selection past the end of the visible page (no autoscrolling)
+        <rdar://problem/8823874>
+        https://bugs.webkit.org/show_bug.cgi?id=56847
+
+        * Shared/mac/WebEventFactory.mm:
+        (WebKit::currentMouseButton):
+        (WebKit::mouseButtonForEvent):
+        Add mouse button for mouseEnter/Exit events. [NSEvent buttonNumber] doesn't seem to give the right result
+        for these events, but getting the currentMouseButton does work.
+
+2011-03-21  Brady Eidson  <beidson@apple.com>
+
+        Fix Mac release builds after https://bugs.webkit.org/show_bug.cgi?id=56783
+
+        * Platform/mac/Logging.mac.mm:
+
+2011-03-21  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Brian Weinstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=56783
+        Actually hook up WebKit2 logging on Mac.
+
+        * Platform/Logging.cpp:
+        (WebKit::initializeLogChannel):
+        * Platform/Logging.h:
+        * Platform/mac/Logging.mac.mm: Added.
+        (WebKit::initializeLogChannel):
+ 
+       * UIProcess/WebContext.cpp:
+        (WebKit::WebContext::WebContext): Initialize logging if necessary.
+
+        * WebKit2.xcodeproj/project.pbxproj:
+
+2011-03-21  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        REGRESSION (r81269): WebKit2 gets into an infinite recursion after an unhandled command key
+        https://bugs.webkit.org/show_bug.cgi?id=56782
+        <rdar://problem/9151993>
+
+        * UIProcess/API/mac/PageClientImpl.mm: (WebKit::PageClientImpl::doneWithKeyEvent):
+        Factored out code for resending an event and moved it to WKView.
+
+        * UIProcess/API/mac/WKView.mm:
+        (-[WKView performKeyEquivalent:]): Don't zero out _keyDownEventBeingResent, it's easier
+        to just do that in _resendKeyDownEvent:.
+        (-[WKView keyDown:]): Ditto.
+        (-[WKView _resendKeyDownEvent:]): Moved from PageClientImpl.mm. Added an assertion that we
+        are not already resending an event - it would be too confusing if we ever had to do that,
+        but looks like this never happens.
+
+        * UIProcess/API/mac/WKViewInternal.h: Exposed _resendKeyDownEvent.
+
+2011-03-21  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        QT plug-in fails to load contextual menu
+        https://bugs.webkit.org/show_bug.cgi?id=56777
+        <rdar://problem/8979033>
+
+        Open a Carbon resource map and make it the current map when calling NP_Initialize.
+
+        * Platform/Module.cpp:
+        (WebKit::Module::Module):
+        Initialize m_bundleResourceMap to -1.
+
+        * Platform/Module.h:
+        Add m_bundleResourceMap.
+
+        * Platform/mac/ModuleMac.mm:
+        (WebKit::Module::unload):
+        Close the resource map.
+
+        (WebKit::Module::bundleResourceMap):
+        Open a resource map if necessary.
+
+        * Shared/Plugins/Netscape/NetscapePluginModule.cpp:
+        (WebKit::NetscapePluginModule::tryLoad):
+        Get the resource map and make it current before calling NP_Initialize.
+
+2011-03-21  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Plug-in process crashes if it fails to load a plug-in module
+        https://bugs.webkit.org/show_bug.cgi?id=56775
+
+        * PluginProcess/PluginControllerProxy.cpp:
+        (WebKit::PluginControllerProxy::initialize):
+        If NetscapePlugin::create returns null, call removePluginControllerProxy with a null plug-in.
+
+        * PluginProcess/WebProcessConnection.cpp:
+        (WebKit::WebProcessConnection::removePluginControllerProxy):
+        Remove an incorrect assertion. Don't invalidate the remote object map if the plug-in is null.
+
+2011-03-21  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        QT plug-in loads controller at top of movie not bottom
+        https://bugs.webkit.org/show_bug.cgi?id=56764
+        <rdar://problem/8979037>
+
+        Create a layer with geometryFlipped set and add the plug-in layer as a sublayer,
+        matching WebKit1.
+
+        * WebProcess/Plugins/Netscape/mac/NetscapePluginMac.mm:
+        (WebKit::NetscapePlugin::platformPostInitialize):
+
+2011-03-21  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        WebKit2 needs preferences to change security knobs
+        https://bugs.webkit.org/show_bug.cgi?id=56762
+
+        Add preferences for WebSecurityEnabled, UniversalAccessFromFileURLsAllowed
+        and FileAccessFromFileURLsAllowed.
+
+        * Shared/WebPreferencesStore.h:
+        * UIProcess/API/C/WKPreferences.cpp:
+        (WKPreferencesSetWebSecurityEnabled):
+        (WKPreferencesGetWebSecurityEnabled):
+        (WKPreferencesSetUniversalAccessFromFileURLsAllowed):
+        (WKPreferencesGetUniversalAccessFromFileURLsAllowed):
+        (WKPreferencesSetFileAccessFromFileURLsAllowed):
+        (WKPreferencesGetFileAccessFromFileURLsAllowed):
+        * UIProcess/API/C/WKPreferencesPrivate.h:
+        * WebProcess/WebPage/WebPage.cpp:
+        (WebKit::WebPage::updatePreferences):
+
+2011-03-21  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Remove old DrawingArea and LayerHostingView code from WKView.
+
+        * UIProcess/API/mac/WKView.mm:
+        (-[WKView drawRect:]):
+        (-[WKView hitTest:]):
+        (-[WKView WebKit::]):
+
+2011-03-21  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Need WebKit2 API for creating a page with a specific main frame name
+        https://bugs.webkit.org/show_bug.cgi?id=56759
+
+        * Shared/WebPageCreationParameters.cpp:
+        (WebKit::WebPageCreationParameters::encode):
+        (WebKit::WebPageCreationParameters::decode):
+        * Shared/WebPageCreationParameters.h:
+        Add mainFrameName to creation parameters.
+
+        * UIProcess/API/mac/WKView.h:
+        * UIProcess/API/mac/WKView.mm:
+        (-[WKView initWithFrame:]):
+        (-[WKView initWithFrame:contextRef:]):
+        (-[WKView initWithFrame:contextRef:pageGroupRef:]):
+        (-[WKView initWithFrame:contextRef:pageGroupRef:mainFrameName:]):
+        Add new initializer which takes a main frame name.
+
+        * UIProcess/WebPageProxy.cpp:
+        (WebKit::WebPageProxy::setMainFrameName):
+        (WebKit::WebPageProxy::creationParameters):
+        * UIProcess/WebPageProxy.h:
+        Store the main frame name for initialization/re-initialization.
+
+        * WebProcess/WebPage/WebFrame.cpp:
+        (WebKit::WebFrame::createMainFrame):
+        * WebProcess/WebPage/WebFrame.h:
+        * WebProcess/WebPage/WebPage.cpp:
+        (WebKit::WebPage::WebPage):
+        Pass the name to main frame creation.
+
+2011-03-20  Bill Budge  <bbudge@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Rename ThreadSafeShared to ThreadSafeRefCounted
+        https://bugs.webkit.org/show_bug.cgi?id=56714
+
+        No new tests. Exposes no new functionality.
+
+        * Platform/CoreIPC/Connection.h:
+        * Platform/WorkQueue.h:
+        * Platform/win/WorkQueueWin.cpp:
+        * UIProcess/Launcher/ProcessLauncher.h:
+        * UIProcess/Launcher/ThreadLauncher.h:
+
+2011-03-19  Anton D'Auria  <adauria@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        ApplicationCacheGroup is not obsolete after being deleted via ApplicationCacheStorage::deleteEntriesForOrigin
+        https://bugs.webkit.org/show_bug.cgi?id=56415
+
+        * WebProcess/ApplicationCache/WebApplicationCacheManager.cpp: calling ApplicationCacheGroup::deleteCacheGroupsForOrigin
+        instead of ApplicationCacheStorage::deleteEntriesForOrigin.
+        (WebKit::WebApplicationCacheManager::deleteEntriesForOrigin):
+
+2011-03-18  Sam Weinig  <sam@webkit.org>
+
+        Attempt to fix the WinCairo build.
+
+        * win/WebKit2.vcproj:
+
+2011-03-18  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Empty gray page after going back from a PDF
+        https://bugs.webkit.org/show_bug.cgi?id=56694
+        <rdar://problem/8811854>
+
+        Update m_frameHasCustomRepresentation when loading a page that's in the page cache.
+
+        * WebProcess/WebCoreSupport/WebFrameLoaderClient.cpp:
+        (WebKit::WebFrameLoaderClient::transitionToCommittedFromCachedFrame):
+
+2011-03-18  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Crash when sending a sync message ends up invalidating the connection
+        https://bugs.webkit.org/show_bug.cgi?id=56686
+        <rdar://problem/9048781>
+
+        Guard against a null client.
+
+        * Platform/CoreIPC/Connection.cpp:
+        (CoreIPC::Connection::sendSyncMessage):
+
+2011-03-18  Balazs Kelemen  <kbalazs@webkit.org>
+
+        Reviewed by Benjamin Poulain.
+
+        [Qt][WK2] Need a way to debug the web process after the UI process dies
+        https://bugs.webkit.org/show_bug.cgi?id=56116
+
+        Allow the web process to outlive it's parent process
+        in debug builds if the QT_WEBKIT_KEEP_ALIVE_WEB_PROCESS
+        environment variable is set.
+
+        * UIProcess/Launcher/qt/ProcessLauncherQt.cpp:
+        (WebKit::QtWebProcess::setupChildProcess): Used getenv
+        since the prctl call is already in a Linux-only block
+        and the implementation in this file is a candidate
+        for sharing across ports in the future.
+
+2011-03-18  Darin Adler  <darin@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        Command-period does not stop load when page has focus in WebKit2
+        https://bugs.webkit.org/show_bug.cgi?id=56601
+
+        * UIProcess/API/mac/WKView.mm:
+        (-[WKView doCommandBySelector:]): If called outside interpretKeyEvents,
+        call through to super.
+        (-[WKView insertText:]): Assert that we are inside interpretKeyEvents.
+        (-[WKView unmarkText]): Ditto.
+        (-[WKView setMarkedText:selectedRange:]): Ditto.
+        (-[WKView _interceptKeyEvent:]): Set a flag to indicate we are inside
+        interpretKeyEvents for use by the above.
+
+2011-03-18  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=56425
+        More groundwork for WebKit2 IconDatabase
+
+        -Update the synchronous method names to be prefixed with "synchronous."
+        -Add empty implementations for the asynchronous accessors.
+
+        * WebProcess/IconDatabase/WebIconDatabaseProxy.cpp:
+        (WebKit::WebIconDatabaseProxy::setEnabled):
+        (WebKit::WebIconDatabaseProxy::synchronousIconForPageURL):
+        (WebKit::WebIconDatabaseProxy::synchronousIconURLForPageURL):
+        (WebKit::WebIconDatabaseProxy::synchronousIconDataKnownForIconURL):
+        (WebKit::WebIconDatabaseProxy::synchronousLoadDecisionForIconURL):
+        (WebKit::WebIconDatabaseProxy::supportsAsynchronousMode):
+        (WebKit::WebIconDatabaseProxy::loadDecisionForIconURL):
+        (WebKit::WebIconDatabaseProxy::iconDataForIconURL):
+        * WebProcess/IconDatabase/WebIconDatabaseProxy.h:
+
+2011-03-18  Alejandro G. Castro  <alex@igalia.com>
+
+        Reviewed by Martin Robinson.
+
+        Fixed compilation after r80925.
+
+        * GNUmakefile.am:
+        * UIProcess/gtk/WebFullScreenManagerProxyGtk.cpp: Added.
+        (WebKit::WebFullScreenManagerProxy::enterFullScreen):
+        (WebKit::WebFullScreenManagerProxy::exitFullScreen):
+        (WebKit::WebFullScreenManagerProxy::beganEnterFullScreenAnimation):
+        (WebKit::WebFullScreenManagerProxy::finishedEnterFullScreenAnimation):
+        (WebKit::WebFullScreenManagerProxy::beganExitFullScreenAnimation):
+        (WebKit::WebFullScreenManagerProxy::finishedExitFullScreenAnimation):
+        (WebKit::WebFullScreenManagerProxy::enterAcceleratedCompositingMode):
+        (WebKit::WebFullScreenManagerProxy::exitAcceleratedCompositingMode):
+        (WebKit::WebFullScreenManagerProxy::getFullScreenRect):
+        * WebProcess/FullScreen/gtk/WebFullScreenManagerGtk.cpp: Added.
+        (WebKit::WebFullScreenManagerGtk::WebFullScreenManagerGtk):
+        (WebKit::WebFullScreenManager::create):
+        (WebKit::WebFullScreenManagerGtk::setRootFullScreenLayer):
+        (WebKit::WebFullScreenManagerGtk::beginEnterFullScreenAnimation):
+        (WebKit::WebFullScreenManagerGtk::beginExitFullScreenAnimation):
+        * WebProcess/FullScreen/gtk/WebFullScreenManagerGtk.h: Added.
+
+2011-03-18  Alejandro G. Castro  <alex@igalia.com>
+
+        Unreviewed, fixed compilation after r81208.
+
+        * GNUmakefile.am:
+
+2011-03-18  John Sullivan  <sullivan@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=56645
+        Assertion fires when hidden Find-on-Page matches are encountered in WebKit2
+
+        * WebProcess/WebPage/FindController.cpp:
+        (WebKit::FindController::updateFindIndicator):
+        Bail out if the selection rect is empty, before trying to generate an appropriately-sized
+        bitmap. (Previously it was bailing out afterwards, but encountering an assertion in debug
+        builds along the way.)
+
+2011-03-18  Mark Rowe  <mrowe@apple.com>
+
+        Rubber-stamped by Jon Honeycutt.
+
+        <rdar://problem/9153929> PluginProcess fails to launch due to PluginProcessShim.dylib building for 64-bit only
+
+        Fix a bogus change from r81392 that made PluginProcessShim.xcconfig import DebugRelease.xcconfig.
+        As its name suggests, DebugRelease.xcconfig is only applicable for the debug and release configurations.
+        It overrides the valid build architectures and also restricts the build to only the active architecture.
+        
+        * Configurations/PluginProcessShim.xcconfig: Import BaseTarget.xcconfig instead. This is what
+        each target-specific .xcconfig file should import.
+
+2011-03-17  Mark Rowe  <mrowe@apple.com>
+
+        Fix the build.
+
+        * WebKit2.xcodeproj/project.pbxproj:
+
+2011-03-17  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Implement PluginProcessProxy::setFullscreenWindowIsShowing
+        https://bugs.webkit.org/show_bug.cgi?id=56618
+
+        * UIProcess/Plugins/PluginProcessProxy.cpp:
+        (WebKit::PluginProcessProxy::PluginProcessProxy):
+        Initialize m_fullscreenWindowIsShowing.
+
+        (WebKit::PluginProcessProxy::didClose):
+        if m_fullscreenWindowIsShowing is true, call exitFullscreen.
+
+        * UIProcess/Plugins/PluginProcessProxy.h:
+        * UIProcess/Plugins/mac/PluginProcessProxyMac.mm:
+        (WebKit::PluginProcessProxy::getPluginProcessSerialNumber):
+        Add helper function for getting a PSN for the plug-in process.
+
+        (WebKit::PluginProcessProxy::makePluginProcessTheFrontProcess):
+        Make the plug-in process the front process.
+
+        (WebKit::PluginProcessProxy::makeUIProcessTheFrontProcess):
+        Make the current process (the UI process) the front process.
+
+        (WebKit::PluginProcessProxy::setFullscreenWindowIsShowing):
+        Call enterFullscreen or exitFullscreen.
+
+        (WebKit::PluginProcessProxy::enterFullscreen):
+        Make the plug-in process the front process and hide the menu bar.
+
+        (WebKit::PluginProcessProxy::exitFullscreen):
+        Show the menu bar and if necessary make the UI process the front process.
+
+        (WebKit::PluginProcessProxy::endModal):
+        call makeUIProcessTheFrontProcess.
+
+        (WebKit::PluginProcessProxy::applicationDidBecomeActive):
+        Call makePluginProcessTheFrontProcess.
+
+2011-03-17  Adam Roben  <aroben@apple.com>
+
+        Make bidi text in <select> menus in WebKit2 on Windows match WebKit1
+
+        Fixes <http://webkit.org/b/56614> 3 <select> bidi tests failing on Windows 7 Release
+        (WebKit2 Tests)
+
+        Reviewed by Sam Weinig.
+
+        * WebProcess/WebCoreSupport/WebChromeClient.cpp:
+        (WebKit::WebChromeClient::selectItemWritingDirectionIsNatural):
+        (WebKit::WebChromeClient::selectItemAlignmentFollowsMenuWritingDirection):
+        On Windows, return the same values we return in WebKit1.
+
+2011-03-17  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Implement PluginProcessProxy::setModalWindowIsShowing
+        https://bugs.webkit.org/show_bug.cgi?id=56615
+
+        * UIProcess/Plugins/PluginProcessProxy.cpp:
+        (WebKit::PluginProcessProxy::PluginProcessProxy):
+        Initialize m_modalWindowIsShowing.
+
+        (WebKit::PluginProcessProxy::didClose):
+        If m_modalWindowIsShowing is true, we must call endModal.
+
+        * UIProcess/Plugins/mac/PluginProcessProxyMac.mm:
+        (-[WKPlaceholderModalWindow _wantsUserAttention]):
+        Add a WKPlaceholderModalWindow.
+
+        (WebKit::PluginProcessProxy::setModalWindowIsShowing):
+        Call beginModal or endModal depending on whether we're showing a modal window or not.
+
+        (WebKit::PluginProcessProxy::beginModal):
+        Create a fake window and start a nested run loop. Listen for NSApplicationWillBecomeActiveNotification notifications.
+
+        (WebKit::PluginProcessProxy::endModal):
+        Tear down the window and the run loop.
+
+        (WebKit::PluginProcessProxy::applicationDidBecomeActive):
+        Make sure that the plug-in process is frontmost.
+
+2011-03-17  Jeff Miller  <jeffm@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Web page shouldn't swallow alt-key combinations on Windows
+        https://bugs.webkit.org/show_bug.cgi?id=56612
+        
+        Make Alt+Left Arrow and Alt+Right Arrow go back and forward, but make
+        sure any alt-key combinations bubble up to the client.
+
+        * WebProcess/WebPage/win/WebPageWin.cpp:
+        (WebKit::WebPage::performDefaultBehaviorForKeyEvent): Make Alt+Left Arrow and Alt+Right Arrow go back and forward, ignore any other alt-key combinations.
+
+2011-03-17  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Send SetModalWindowIsShowing and SetFullscreenWindowIsShowing messages to the UI process
+        https://bugs.webkit.org/show_bug.cgi?id=56610
+
+        * PluginProcess/mac/PluginProcessMac.mm:
+        (WebKit::FullscreenWindowTracker::FullscreenWindowTracker):
+        Add fullscreen window tracker class.
+
+        (WebKit::rectCoversAnyScreen):
+        Return whether the given rect covers any screen.
+
+        (WebKit::windowCoversAnyScreen):
+        Return whether the given window covers any screen.
+
+        (WebKit::FullscreenWindowTracker::windowShown):
+        If we're showing a fullscreen window, call PluginProcess::setFullscreenWindowIsShowing.
+
+        (WebKit::FullscreenWindowTracker::windowHidden):
+        If we're hiding the last fullscreen window, call PluginProcess::setFullscreenWindowIsShowing.
+
+        (WebKit::cocoaWindowShown):
+        (WebKit::cocoaWindowHidden):
+        (WebKit::carbonWindowShown):
+        (WebKit::carbonWindowHidden):
+        Call the window tracking functions.
+
+        (WebKit::setModal):
+        Call PluginProcess::setModalWindowIsShowing.
+
+        (WebKit::PluginProcess::setModalWindowIsShowing):
+        (WebKit::PluginProcess::setFullscreenWindowIsShowing):
+        Send CoreIPC messages.
+
+        * UIProcess/Plugins/PluginProcessProxy.h:
+        * UIProcess/Plugins/PluginProcessProxy.messages.in:
+        Add new messages.
+
+        * UIProcess/Plugins/mac/PluginProcessProxyMac.mm:
+        (WebKit::PluginProcessProxy::setModalWindowIsShowing):
+        (WebKit::PluginProcessProxy::setFullscreenWindowIsShowing):
+        Add stubs.
+
+2011-03-17  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Brady Eidson.
+
+        Allow passing a certificate chain as a user message
+        <rdar://problem/8951709>
+        https://bugs.webkit.org/show_bug.cgi?id=56605
+
+        * Shared/API/c/mac/WKCertificateInfoMac.h:
+        * Shared/API/c/mac/WKCertificateInfoMac.mm:
+        (WKCertificateInfoCreateWithCertficateChain):
+        Added. Creates a WKCertificate from a certificate chain.
+
+        * Shared/UserMessageCoders.h:
+        (WebKit::UserMessageEncoder::baseEncode):
+        (WebKit::UserMessageDecoder::baseDecode):
+        Add encoding/decoding of WebCertificateInfo.
+
+2011-03-17  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Add PluginProcessShim hooks for when windows are shown and hidden
+        https://bugs.webkit.org/show_bug.cgi?id=56597
+
+        * Configurations/PluginProcessShim.xcconfig:
+        Add HEADER_SEARCH_PATHS so we can find WebKitSystemInterface.h.
+
+        * PluginProcess/mac/PluginProcessMac.mm:
+        (WebKit::cocoaWindowShown):
+        (WebKit::cocoaWindowHidden):
+        (WebKit::carbonWindowShown):
+        (WebKit::carbonWindowHidden):
+        (WebKit::setModal):
+        (WebKit::PluginProcess::initializeShim):
+        Add empty stubs.
+
+        * PluginProcess/mac/PluginProcessShim.h:
+        * PluginProcess/mac/PluginProcessShim.mm:
+        (WebKit::beginModal):
+        (WebKit::endModal):
+        Keep a modal count and call setModal accordingly.
+
+        (WebKit::shim_NSApplication_RunModalForWindow):
+        (WebKit::shimModalDialog):
+        (WebKit::shimAlert):
+        Call beginModal/endModal.
+
+        (WebKit::shimShowWindow):
+        (WebKit::shimHideWindow):
+        Call the shim functions.
+        
+        (WebKit::WebKitPluginProcessShimInitialize):
+        Listen for notifications and call the necessary shim functions.
+
+        * WebKit2.xcodeproj/project.pbxproj:
+        Link the plug-in process shim with AppKit and QuartzCore and WKSI.
+
+2011-03-17  Jeff Miller  <jeffm@apple.com>
+
+        Use a consistent set of file patterns in the svn:ignore property for all .xcodeproj directories, specifically:
+        
+        *.mode*
+        *.pbxuser
+        *.perspective*
+        project.xcworkspace
+        xcuserdata
+
+        * WebKit2.xcodeproj: Modified property svn:ignore.
+
+2011-03-17  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        WKErrors need the PeerCertificateChain for certificate errors
+        <rdar://problem/8951784>
+        https://bugs.webkit.org/show_bug.cgi?id=56592
+
+        * Shared/WebCoreArgumentCoders.h:
+        Special case encoding/decoding of ResourceErrors for the mac.
+
+        * Shared/mac/PlatformCertificateInfo.h:
+        * Shared/mac/PlatformCertificateInfo.mm:
+        (WebKit::PlatformCertificateInfo::PlatformCertificateInfo):
+        Add constructor that take the PeerCertificateChain as CFArrayRef.
+
+        * Shared/mac/WebCoreArgumentCodersMac.mm:
+        (CoreIPC::encodeResourceError):
+        (CoreIPC::decodeResourceError):
+        Add encode/decode for ResourceError using the underlying NSError
+        and encoding/decoding as much of the userInfo as we know how to.
+        Right now this includes all string values and the PeerCertificateChain.
+
+2011-03-17  John Sullivan  <sullivan@apple.com>
+
+        Reviewed by Adam Roben.
+
+        https://bugs.webkit.org/show_bug.cgi?id=56574
+        Dealloc'ing a WKView can leave a stale reference to it in NSWindow
+
+        * UIProcess/API/mac/WKView.mm:
+        (-[WKView viewWillMoveToWindow:]):
+        Clear the outgoing window's growBoxOwner if it is this view.
+
+2011-03-17  Anders Carlsson  <andersca@apple.com>
+
+        Rubber-stamped by John Sullivan.
+
+        Rename PluginProcessShim.cpp to PluginProcessShim.mm.
+
+        * PluginProcess/mac/PluginProcessShim.cpp: Removed.
+        * PluginProcess/mac/PluginProcessShim.mm: Copied from PluginProcess/mac/PluginProcessShim.cpp.
+        * WebKit2.xcodeproj/project.pbxproj:
+
+2011-03-17  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Invalidate all NPObjects for a plug-in when that plug-in is destroyed
+        https://bugs.webkit.org/show_bug.cgi?id=56511
+        <rdar://problem/8993491>
+
+        Before this change, we would invalidate NPObjectProxy objects and delete NPObjectMessageReceiver
+        objects when the last plug-in of a certain type was destroyed. Doing so caused us to hold on to memory
+        which we don't need, and could also lead to crashes if the NPObjectMessageReceiver would get a message and
+        tried to invoke it on a already deallocated NPObject.
+
+        * PluginProcess/PluginControllerProxy.cpp:
+        (WebKit::PluginControllerProxy::initialize):
+        If we fail to initialize, call removePluginControllerProxy instead of having WebProcessConnection do so.
+
+        (WebKit::PluginControllerProxy::destroy):
+        Pass the plug-in to removePluginControllerProxy.
+
+        * PluginProcess/WebProcessConnection.cpp:
+        (WebKit::WebProcessConnection::removePluginControllerProxy):
+        Call NPRemoteObjectMap::pluginDestroyed when the plug-in has been destroyed.
+
+        (WebKit::WebProcessConnection::createPlugin):
+        Don't call removePluginControllerProxy if the plug-in fails to initialize. PluginControllerProxy::initialize now
+        takes care of doing this.
+
+        * Shared/Plugins/NPObjectMessageReceiver.cpp:
+        (WebKit::NPObjectMessageReceiver::NPObjectMessageReceiver):
+        (WebKit::NPObjectMessageReceiver::~NPObjectMessageReceiver):
+        * Shared/Plugins/NPObjectMessageReceiver.h:
+        Remove m_shouldReleaseObjectWhenInvalidating, we now know that no NPObjects will have been deallocated
+        by the time the NPObjectMessageReceiver is destroyed.
+
+        (WebKit::NPObjectMessageReceiver::plugin):
+        Add getter.
+        
+        * Shared/Plugins/NPObjectProxy.h:
+        (WebKit::NPObjectProxy::plugin):
+        Add getter.
+        
+        * Shared/Plugins/NPRemoteObjectMap.cpp:
+        (WebKit::NPRemoteObjectMap::NPRemoteObjectMap):
+        Remove m_isInvalidating.
+
+        (WebKit::NPRemoteObjectMap::npObjectProxyDestroyed):
+        Simplify code.
+
+        (WebKit::NPRemoteObjectMap::pluginDestroyed):
+        Rename invalidate to pluginDestroyed. Only invalidate/delete objects that belong to the given plug-in.
+
+        * Shared/Plugins/NPRemoteObjectMap.h:
+        Remove m_isInvalidating.
+        
+        * WebProcess/Plugins/PluginProcessConnection.cpp:
+        (WebKit::PluginProcessConnection::removePluginProxy):
+        Call NPRemoteObjectMap::pluginDestroyed when the plug-in has been destroyed.
+
+2011-03-17  Oleg Romashin  <oleg.romashin@nokia.com>
+
+        Reviewed by Anders Carlsson.
+
+        Teach WebKit2 messages.py generator to ifdef headers include
+        which are related to ifdef-ed methods/types
+        https://bugs.webkit.org/show_bug.cgi?id=55658
+
+        * Scripts/webkit2/messages.py:
+        * Scripts/webkit2/messages_unittest.py:
+
+2011-03-16  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Viewport no longer allows an auto value for "user-scalable"
+        https://bugs.webkit.org/show_bug.cgi?id=55416
+
+        Make the default value for userScalable be true.
+
+        * UIProcess/API/qt/qwkpage.cpp:
+        (QWKPage::viewportAttributesForSize):
+
+2011-03-16  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        NPObjectProxy and NPObjectMessageReceiver objects should know their Plugin object
+        https://bugs.webkit.org/show_bug.cgi?id=56506
+
+        * PluginProcess/PluginControllerProxy.cpp:
+        (WebKit::PluginControllerProxy::windowScriptNPObject):
+        (WebKit::PluginControllerProxy::pluginElementNPObject):
+        (WebKit::PluginControllerProxy::evaluate):
+        (WebKit::PluginControllerProxy::getPluginScriptableNPObject):
+        * Shared/Plugins/NPObjectMessageReceiver.cpp:
+        (WebKit::NPObjectMessageReceiver::create):
+        (WebKit::NPObjectMessageReceiver::NPObjectMessageReceiver):
+        (WebKit::NPObjectMessageReceiver::invoke):
+        (WebKit::NPObjectMessageReceiver::invokeDefault):
+        (WebKit::NPObjectMessageReceiver::getProperty):
+        (WebKit::NPObjectMessageReceiver::setProperty):
+        (WebKit::NPObjectMessageReceiver::construct):
+        * Shared/Plugins/NPObjectMessageReceiver.h:
+        * Shared/Plugins/NPObjectProxy.cpp:
+        (WebKit::NPObjectProxy::create):
+        (WebKit::NPObjectProxy::NPObjectProxy):
+        (WebKit::NPObjectProxy::invalidate):
+        (WebKit::NPObjectProxy::initialize):
+        (WebKit::NPObjectProxy::invoke):
+        (WebKit::NPObjectProxy::invokeDefault):
+        (WebKit::NPObjectProxy::getProperty):
+        (WebKit::NPObjectProxy::setProperty):
+        (WebKit::NPObjectProxy::construct):
+        * Shared/Plugins/NPObjectProxy.h:
+        * Shared/Plugins/NPRemoteObjectMap.cpp:
+        (WebKit::NPRemoteObjectMap::createNPObjectProxy):
+        (WebKit::NPRemoteObjectMap::registerNPObject):
+        (WebKit::NPRemoteObjectMap::npVariantToNPVariantData):
+        (WebKit::NPRemoteObjectMap::npVariantDataToNPVariant):
+        * Shared/Plugins/NPRemoteObjectMap.h:
+        * WebProcess/Plugins/PluginProxy.cpp:
+        (WebKit::PluginProxy::pluginScriptableNPObject):
+        (WebKit::PluginProxy::getWindowScriptNPObject):
+        (WebKit::PluginProxy::getPluginElementNPObject):
+        (WebKit::PluginProxy::evaluate):
+
+2011-03-16  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=54987 Crash beneath 
+        WebPageProxy::viewWillStartLiveResize when resizing window after web process 
+        crashed
+        -and corresponding-
+        <rdar://problem/9037685>
+
+        Just need simple isValid() checks here. 
+        * UIProcess/WebPageProxy.cpp:
+        (WebKit::WebPageProxy::initializeUIClient):
+        (WebKit::WebPageProxy::viewWillStartLiveResize):
+        (WebKit::WebPageProxy::viewWillEndLiveResize):
+
+2011-03-16  Damian Kaleta  <dkaleta@apple.com>
+
+        Reviewed by Kevin Decker.
+
+        Add a user default that will force all plugins to opt in to non-executable data
+        https://bugs.webkit.org/show_bug.cgi?id=56487
+        <rdar://problem/9109095>
+
+        * UIProcess/Plugins/PluginProcessProxy.cpp:
+        (WebKit::PluginProcessProxy::PluginProcessProxy):
+        * UIProcess/Plugins/PluginProcessProxy.h:
+        * UIProcess/Plugins/mac/PluginProcessProxyMac.mm:
+        (WebKit::PluginProcessProxy::pluginNeedsExecutableHeap):
+
+2011-03-16  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        WK2: Need to propagate enhanced accessibility flag from UI -> web process
+        https://bugs.webkit.org/show_bug.cgi?id=56379
+
+        Support sending the enhanced accessibility flag between processes.
+
+        * UIProcess/WebContext.cpp:
+        (WebKit::WebContext::~WebContext):
+        (WebKit::WebContext::setEnhancedAccessibility):
+        * UIProcess/WebContext.h:
+        * UIProcess/gtk/WebContextGtk.cpp:
+        (WebKit::WebContet::platformInvalidateContext):
+        * UIProcess/mac/WebContextMac.mm:
+        (WebKit::WebContext::platformInitializeWebProcess):
+        (WebKit::WebContext::platformInvalidateContext):
+        * UIProcess/qt/WebContextQt.cpp:
+        (WebKit::WebContext::platformInvalidateContext):
+        * UIProcess/win/WebContextWin.cpp:
+        (WebKit::WebContext::platformInvalidateContext):
+        * WebProcess/WebProcess.cpp:
+        (WebKit::WebProcess::setEnhancedAccessibility):
+        * WebProcess/WebProcess.h:
+        * WebProcess/WebProcess.messages.in:
+
+2011-03-15  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Make Structure creation require a JSGlobalData
+        https://bugs.webkit.org/show_bug.cgi?id=56438
+
+        Mechanical change to make all Structure creation use a JSGlobalData&.
+
+        * WebProcess/Plugins/Netscape/JSNPMethod.cpp:
+        (WebKit::JSNPMethod::JSNPMethod):
+        * WebProcess/Plugins/Netscape/JSNPMethod.h:
+        (WebKit::JSNPMethod::createStructure):
+        * WebProcess/Plugins/Netscape/JSNPObject.cpp:
+        (WebKit::JSNPObject::JSNPObject):
+        * WebProcess/Plugins/Netscape/JSNPObject.h:
+        (WebKit::JSNPObject::createStructure):
+
+2011-03-16  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        WebKit2: Sometimes Command-[ opens a new tab and loads the back page in it
+        https://bugs.webkit.org/show_bug.cgi?id=56477
+        <rdar://problem/8806664>
+
+        * UIProcess/API/mac/PageClientImpl.mm: (WebKit::PageClientImpl::doneWithKeyEvent):
+        Set NSApplication current event when re-dispatching a key event that returned from the web
+        process unhandled. That way, code that looks at current event modifiers won't be confused.
+
+2011-03-16  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Adam Roben.
+
+        Add WebKit2 API to figure out if an input or textarea was edited
+        https://bugs.webkit.org/show_bug.cgi?id=56474
+
+        Expose WKBundleNodeHandleGetHTMLInputElementLastChangeWasUserEdit and
+        WKBundleNodeHandleGetHTMLTextAreaElementLastChangeWasUserEdit. Next time,
+        I will work on giving these functions longer names.
+
+        * WebProcess/InjectedBundle/API/c/WKBundleNodeHandle.cpp:
+        (WKBundleNodeHandleGetHTMLInputElementLastChangeWasUserEdit):
+        (WKBundleNodeHandleGetHTMLTextAreaElementLastChangeWasUserEdit):
+        * WebProcess/InjectedBundle/API/c/WKBundleNodeHandlePrivate.h:
+        * WebProcess/InjectedBundle/DOM/InjectedBundleNodeHandle.cpp:
+        (WebKit::InjectedBundleNodeHandle::htmlInputElementLastChangeWasUserEdit):
+        (WebKit::InjectedBundleNodeHandle::htmlTextAreaElementLastChangeWasUserEdit):
+        * WebProcess/InjectedBundle/DOM/InjectedBundleNodeHandle.h:
+
+2011-03-16  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Adam Roben.
+
+        https://bugs.webkit.org/show_bug.cgi?id=56467
+        IconDatabase-related crash seen in WK2 tests
+
+        * WebProcess/IconDatabase/WebIconDatabaseProxy.cpp:
+        (WebKit::WebIconDatabaseProxy::setIconDataForIconURL): The IconLoader might set a null data for an icon, so handle that case.
+
+2011-03-16  Benjamin Poulain  <benjamin.poulain@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt][WK2] Loading an empty URL crashes
+        https://bugs.webkit.org/show_bug.cgi?id=55501
+
+        A null WKURLRef is created in the API of WebKit 2 when converting a null string. The code
+        of WKPageLoadURL assume the WKPageRef is not null which causes crashes if it is.
+
+        This patch uses the converter toWTFString() to pass from WKPageRef to WTFString. This converter
+        ensure the returned string is a valid null string.
+
+        Tested through the Qt API tests.
+
+        * UIProcess/API/C/WKPage.cpp:
+        (WKPageLoadURL):
+        * UIProcess/API/qt/tests/qgraphicswkview/tst_qgraphicswkview.cpp:
+        (tst_QGraphicsWKView::loadEmptyUrl):
+        * UIProcess/API/qt/tests/qwkpage/qwkpage.pro: Added.
+        * UIProcess/API/qt/tests/qwkpage/tst_qwkpage.cpp: Added.
+        (tst_QWKPage::init):
+        (tst_QWKPage::cleanup):
+        (tst_QWKPage::loadEmptyUrl):
+        * UIProcess/API/qt/tests/tests.pro:
+
+2011-03-15  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=56425
+        WebKit2 icon database.
+
+        Project file paperwork:
+        * DerivedSources.make:
+        * DerivedSources.pro:
+        * GNUmakefile.am:
+        * WebKit2.pri:
+        * WebKit2.pro:
+        * WebKit2.xcodeproj/project.pbxproj:
+        * win/WebKit2.vcproj:
+        * win/WebKit2Common.vsprops:
+        * Scripts/webkit2/messages.py: Special-case capitalization for messages that start with "URL" to be lowercased
+          to "url" instead of "uRL".
+
+        Add messaging-related stuff:
+        * Platform/CoreIPC/MessageID.h:
+        * UIProcess/WebIconDatabase.messages.in: Added.
+        * WebProcess/IconDatabase/WebIconDatabaseProxy.messages.in: Added.
+        * UIProcess/WebProcessProxy.cpp:
+        (WebKit::WebProcessProxy::didReceiveMessage):
+        (WebKit::WebProcessProxy::didReceiveSyncMessage):
+
+        Prep to make WebIconDatabase an API object:
+        * Shared/APIObject.h:
+
+        Add an "icon DB is enabled" flag to WebProcessCreationParameters:
+        * Shared/WebProcessCreationParameters.cpp:
+        (WebKit::WebProcessCreationParameters::encode):
+        (WebKit::WebProcessCreationParameters::decode):
+        * Shared/WebProcessCreationParameters.h:
+
+        Add SPI for client apps to set the icon database path:
+        * UIProcess/API/C/WKContext.cpp:
+        (WKContextSetIconDatabasePath):
+        * UIProcess/API/C/WKContextPrivate.h:
+        * UIProcess/WebContext.h:
+        (WebKit::WebContext::setIconDatabasePath):
+
+        Hook up initialization, clearing, and messaging for the icon database:
+        * UIProcess/WebContext.cpp:
+        (WebKit::WebContext::WebContext):
+        (WebKit::WebContext::~WebContext):
+        (WebKit::WebContext::ensureWebProcess):
+        (WebKit::WebContext::didReceiveMessage):
+        (WebKit::WebContext::didReceiveSyncMessage):
+        (WebKit::WebContext::iconDatabasePath):
+        * UIProcess/gtk/WebContextGtk.cpp:
+        (WebKit::WebContext::platformDefaultIconDatabasePath):
+        * UIProcess/mac/WebContextMac.mm:
+        (WebKit::WebContext::platformDefaultIconDatabasePath):
+        * UIProcess/qt/WebContextQt.cpp:
+        (WebKit::WebContext::platformDefaultIconDatabasePath):
+        * UIProcess/win/WebContextWin.cpp:
+        (WebKit::WebContext::platformDefaultIconDatabasePath):
+
+        Add the UIProcess-side IconDatabase. It will be the "actual database" as well as the API object:
+        * UIProcess/WebIconDatabase.cpp: Added.
+        (WebKit::WebIconDatabase::create):
+        (WebKit::WebIconDatabase::~WebIconDatabase):
+        (WebKit::WebIconDatabase::WebIconDatabase):
+        (WebKit::WebIconDatabase::invalidate):
+        (WebKit::WebIconDatabase::retainIconForPageURL):
+        (WebKit::WebIconDatabase::releaseIconForPageURL):
+        (WebKit::WebIconDatabase::setIconURLForPageURL):
+        (WebKit::WebIconDatabase::setIconDataForIconURL):
+        (WebKit::WebIconDatabase::iconDataForPageURL):
+        (WebKit::WebIconDatabase::iconURLForPageURL):
+        (WebKit::WebIconDatabase::iconDataKnownForIconURL):
+        (WebKit::WebIconDatabase::loadDecisionForIconURL):
+        (WebKit::WebIconDatabase::didReceiveMessage):
+        (WebKit::WebIconDatabase::didReceiveSyncMessage):
+        * UIProcess/WebIconDatabase.h: Added.
+        (WebKit::WebIconDatabase::clearContext):
+        (WebKit::WebIconDatabase::type):
+
+        Add the WebProcess-side IconDatabaseProxy. It acts as the WebCore IconDatabase and operates via messaging:
+        * WebProcess/IconDatabase: Added.
+        * WebProcess/IconDatabase/WebIconDatabaseProxy.cpp: Added.
+        (WebKit::WebIconDatabaseProxy::~WebIconDatabaseProxy):
+        (WebKit::WebIconDatabaseProxy::WebIconDatabaseProxy):
+        (WebKit::WebIconDatabaseProxy::isEnabled):
+        (WebKit::WebIconDatabaseProxy::setEnabled):
+        (WebKit::WebIconDatabaseProxy::iconForPageURL):
+        (WebKit::WebIconDatabaseProxy::retainIconForPageURL):
+        (WebKit::WebIconDatabaseProxy::releaseIconForPageURL):
+        (WebKit::WebIconDatabaseProxy::iconURLForPageURL):
+        (WebKit::WebIconDatabaseProxy::iconDataKnownForIconURL):
+        (WebKit::WebIconDatabaseProxy::loadDecisionForIconURL):
+        (WebKit::WebIconDatabaseProxy::setIconURLForPageURL):
+        (WebKit::WebIconDatabaseProxy::setIconDataForIconURL):
+        (WebKit::WebIconDatabaseProxy::urlImportFinished):
+        (WebKit::WebIconDatabaseProxy::didReceiveMessage):
+        * WebProcess/IconDatabase/WebIconDatabaseProxy.h: Added.
+
+        Hook up initialization and messaging for the icon database proxy:
+        * WebProcess/WebProcess.cpp:
+        (WebKit::WebProcess::WebProcess):
+        (WebKit::WebProcess::initializeWebProcess):
+        (WebKit::WebProcess::didReceiveMessage):
+        * WebProcess/WebProcess.h:
+
+2011-03-15  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        WebKit2: False SPOD cursor when context menu is open
+        <rdar://problem/9029154>
+        https://bugs.webkit.org/show_bug.cgi?id=56433
+
+        * UIProcess/WebPageProxy.cpp:
+        (WebKit::WebPageProxy::showContextMenu):
+        Update to match showPopupMenu idiomatically, and stop the responsivenessTimer
+        since the act of showing the context menu could spin a nested runloop.
+
+        * UIProcess/mac/WebContextMenuProxyMac.mm:
+        (WebKit::WebContextMenuProxyMac::showContextMenu):
+        * UIProcess/qt/WebContextMenuProxyQt.cpp:
+        (WebKit::WebContextMenuProxyQt::showContextMenu):
+        * UIProcess/win/WebContextMenuProxyWin.cpp:
+        (WebKit::WebContextMenuProxyWin::showContextMenu):
+        Move isEmpty() check to implementations, since we don't want to show
+        this in any case, not just the one where we check it.
+
+2011-03-15  Siddharth Mathur  <siddharth.mathur@nokia.com>
+
+        Reviewed by Laszlo Gombos.
+
+        [Qt][Symbian][WK2] Fix exporting and importing the WebProcessMainQt symbol
+        https://bugs.webkit.org/show_bug.cgi?id=56417
+
+        Use the Q_DECL_EXPORT and Q_DECL_IMPORT macros directly to make sure
+        the symbol is always exported/imported.
+
+        * WebProcess/qt/WebProcessMainQt.cpp:
+        (WebKit::WebProcessMainQt):
+        * qt/MainQt.cpp:
+
+2011-03-15  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        REGRESSION (WebKit2): keygen element doesn't work
+        https://bugs.webkit.org/show_bug.cgi?id=56402
+        <rdar://problem/9006545>
+
+        * WebProcess/WebCoreSupport/WebPlatformStrategies.cpp:
+        * WebProcess/WebCoreSupport/WebPlatformStrategies.h:
+        Added strings used by keygen.
+
+        * WebProcess/WebCoreSupport/mac/WebSystemInterface.mm: Initialize a WebCore pointer to
+        a function used by keygen.
+
+2011-03-15  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        WebKit2 part of <rdar://problem/9075624> Overlay scrollbars slow down PLT by 6%
+
+        New WebKitystemInterface function to force the scrollbars to flash
+        * WebProcess/WebCoreSupport/mac/WebSystemInterface.mm:
+        (InitWebCoreSystemInterface):
+
+2011-03-15  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Make sure that NP_Shutdown is always the last NPP function called
+        https://bugs.webkit.org/show_bug.cgi?id=56391
+        <rdar://problem/8989902>
+
+        Make sure to always increment the load count whenever a web process connection
+        is opened to a plug-in process, and decrement it when the last web process connection
+        goes away.
+
+        * PluginProcess/PluginProcess.cpp:
+        (WebKit::PluginProcess::createWebProcessConnection):
+        (WebKit::PluginProcess::startShutdownTimerIfNecessary):
+        * Shared/Plugins/Netscape/NetscapePluginModule.cpp:
+        * Shared/Plugins/Netscape/NetscapePluginModule.h:
+        * WebProcess/Plugins/Netscape/NetscapePlugin.cpp:
+        (WebKit::NetscapePlugin::NetscapePlugin):
+        (WebKit::NetscapePlugin::~NetscapePlugin):
+
+2011-03-15  Martin Robinson  <mrobinson@igalia.com>
+
+        Reviewed by Adam Barth.
+
+        [GTK] [WebKit2] The UIProcess never changes the mouse cursor
+        https://bugs.webkit.org/show_bug.cgi?id=56333
+
+        Add an implementation for WebView::addCursor for WebKit2 GTK+. This allows
+        the cursor to change as the user mouses around the page. There is currently
+        no test infrastructure to track cursor changes.
+
+        * UIProcess/gtk/WebView.cpp:
+        (WebKit::WebView::setCursor): Ported implementation from WebKit1.
+
+2011-03-15  Kevin Ollivier  <kevino@theolliviers.com>
+
+        Reviewed by Darin Adler.
+
+        Introduce WTF_USE_EXPORT_MACROS, which will allow us to put shared library import/export
+        info into the headers rather than in export symbol definition files, but disable it on 
+        all platforms initially so we can deal with port build issues one port at a time.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=27551
+
+        * config.h:
+
+2011-03-14  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        REGRESSION: Print preview is blank when selecting multiple pages per sheet
+        https://bugs.webkit.org/show_bug.cgi?id=56341
+        <rdar://problem/8991382>
+
+        * UIProcess/API/mac/WKPrintingView.mm: (pageDidDrawToPDF): Don't reset latest expected
+        callback number after receiving a different one. We only update preview after receiving
+        the latest expected page data (and the assumption is that AppKit will ask for pages in
+        natural order for N-up).
+
+2011-03-14  Adam Roben  <aroben@apple.com>
+
+        Make WKBundlePageCanHandleRequest return true for empty document URLs
+
+        Reviewed by Sam Weinig.
+
+        * WebProcess/WebPage/WebPage.cpp:
+        (WebKit::WebPage::canHandleRequest): Return true for any URL schemes that are handled as
+        empty documents, and defer to the platform for everything else.
+
+        * WebProcess/WebPage/WebPage.h: Added platformCanHandleRequest.
+
+        * WebProcess/WebPage/mac/WebPageMac.mm:
+        (WebKit::WebPage::platformCanHandleRequest):
+        * WebProcess/WebPage/qt/WebPageQt.cpp:
+        (WebKit::WebPage::platformCanHandleRequest):
+        * WebProcess/WebPage/win/WebPageWin.cpp:
+        (WebKit::WebPage::platformCanHandleRequest):
+        Renamed from canHandleRequest.
+
+2011-03-14  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        CrashTracer: 60 crashes in WebProcess at com.apple.WebKit2: -[AccessibilityWebPageObject accessibilityHitTest:] + 248
+        https://bugs.webkit.org/show_bug.cgi?id=56336
+
+        Crash trace indicates a nil pointer access in one of these m_page->mainFrame()->coreFrame()->view()
+        pointers.
+
+        * WebProcess/WebPage/mac/AccessibilityWebPageObject.mm:
+        (-[AccessibilityWebPageObject accessibilityHitTest:]):
+
+2011-03-14  Alice Liu  <alice.liu@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Provide API for creating WKImage from CGImageRef
+        https://bugs.webkit.org/show_bug.cgi?id=56159
+
+        Add function for creating a WKImage from CGImage data.
+        * Shared/API/c/cg/WKImageCG.cpp:
+        (WKImageCreateFromCGImage): Added. Creates a graphics context for the bitmap-backed image and draws into it. 
+        * Shared/API/c/cg/WKImageCG.h:
+
+2011-03-14  Balazs Kelemen  <kbalazs@webkit.org>
+
+        Reviewed by Adam Roben.
+
+        [Qt][WK2]Unbreak InjectedBundle on Qt
+        https://bugs.webkit.org/show_bug.cgi?id=54109
+
+        Add API's to WKURL and WKString to satisfy
+        WebKitTestRunner's needs.
+
+        * Shared/API/c/WKString.cpp:
+        (WKStringIsEqualToUTF8CStringIgnoringCase):
+        * Shared/API/c/WKString.h:
+        * Shared/API/c/WKURL.cpp:
+        (WKURLCopyHostName):
+        (WKURLCopyScheme):
+        * Shared/API/c/WKURL.h:
+        * Shared/WebString.h:
+        (WebKit::WebString::equalToUTF8StringIgnoringCase):
+        * Shared/WebURL.h: Added OwnPtr<KURL> member to be able
+        to lazily parse the URL and store the result.
+        (WebKit::WebURL::host):
+        (WebKit::WebURL::protocol):
+        (WebKit::WebURL::parseURLIfNecessary):
+        * win/WebKit2.def: Revert the symbol exports that were
+        needed to use KURL in WebKitTestRunner.
+
+2011-03-14  Jeff Miller  <jeffm@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Add WKViewSetScrollOffsetOnNextResize() to C API on Windows
+        https://bugs.webkit.org/show_bug.cgi?id=56340
+
+        * UIProcess/API/C/win/WKView.cpp:
+        (WKViewSetScrollOffsetOnNextResize): Added.
+        * UIProcess/API/C/win/WKView.h: Added WKViewSetScrollOffsetOnNextResize().
+        * UIProcess/win/WebView.cpp:
+        (WebKit::WebView::onSizeEvent): Apply any scroll offset when setting the drawing area size.
+        (WebKit::WebView::setScrollOffsetOnNextResize): Added.
+        * UIProcess/win/WebView.h: Added setScrollOffsetOnNextResize().
+
+2011-03-14  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Adam Roben and Gavin Barraclough.
+
+        FileSystemWin.cpp needs listDirectory() implementation
+        https://bugs.webkit.org/show_bug.cgi?id=56331
+        <rdar://problem/9126635>
+        
+        Move PathWalker down into WebCore, and call the PathWalker in WebCore
+        (that now has a second argument, the pattern to take).
+
+        * UIProcess/Plugins/win/PluginInfoStoreWin.cpp:
+        (WebKit::PluginInfoStore::pluginPathsInDirectory):
+
+2011-03-14  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        WebKit2: No icon shown for <input type=file>
+        <rdar://problem/8988982>
+        https://bugs.webkit.org/show_bug.cgi?id=54288
+
+        * WebProcess/WebCoreSupport/WebChromeClient.cpp:
+        (WebKit::WebChromeClient::chooseIconForFiles):
+        Add implementation for chooseIconForFiles which calls down to Icon::createIconForFiles.
+
+2011-03-14  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        <rdar://problem/8762095> and https://bugs.webkit.org/show_bug.cgi?id=55172
+        Need WK2 API to view/manage origins with LocalStorage
+
+        Hookup the existing API stubs to the WebCore implementations:
+        * WebProcess/KeyValueStorage/WebKeyValueStorageManager.cpp:
+        (WebKit::WebKeyValueStorageManager::getKeyValueStorageOrigins):
+        (WebKit::WebKeyValueStorageManager::deleteEntriesForOrigin):
+        (WebKit::WebKeyValueStorageManager::deleteAllEntries):
+
+2011-03-13  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        <rdar://problem/9127270> and https://bugs.webkit.org/show_bug.cgi?id=56282
+
+        Pass the path along with creation parameters:
+        * Shared/WebProcessCreationParameters.cpp:
+        (WebKit::WebProcessCreationParameters::encode):
+        (WebKit::WebProcessCreationParameters::decode):
+        * Shared/WebProcessCreationParameters.h:
+
+        Add SPI to set the path:
+        * UIProcess/API/C/WKContext.cpp:
+        (WKContextSetLocalStorageDirectory):
+        * UIProcess/API/C/WKContextPrivate.h:
+
+        Pass the path along in the process creation parameters:
+        * UIProcess/WebContext.cpp:
+        (WebKit::WebContext::ensureWebProcess):
+        (WebKit::WebContext::localStorageDirectory):
+        * UIProcess/WebContext.h:
+        (WebKit::WebContext::setLocalStorageDirectory):
+
+        * UIProcess/gtk/WebContextGtk.cpp:
+        (WebKit::WebContext::platformDefaultLocalStorageDirectory):
+        * UIProcess/mac/WebContextMac.mm:
+        (WebKit::WebContext::platformDefaultLocalStorageDirectory):
+        * UIProcess/qt/WebContextQt.cpp:
+        (WebKit::WebContext::platformDefaultLocalStorageDirectory):
+        * UIProcess/win/WebContextWin.cpp:
+        (WebKit::WebContext::platformDefaultLocalStorageDirectory):
+
+        Include the path with settings updates, because WebCore needs it set on the Settings object:
+        * WebProcess/WebPage/WebPage.cpp:
+        (WebKit::WebPage::updatePreferences):
+
+        * WebProcess/WebProcess.cpp:
+        (WebKit::WebProcess::initializeWebProcess):
+        * WebProcess/WebProcess.h:
+        (WebKit::WebProcess::localStorageDirectory):
+
+        Sandboxing stuff:
+        * WebProcess/com.apple.WebProcess.sb:
+        * WebProcess/mac/WebProcessMac.mm:
+        (WebKit::initializeSandbox):
+
+2011-03-12  Jer Noble  <jer.noble@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        WebKit2: Build WKFullScreenWindowController cleanly in 32-bit.
+        https://bugs.webkit.org/show_bug.cgi?id=56260
+
+        Include <Carbon/Carbon.h> instead of <HIToolbox/MacApplication.h>.
+
+        * UIProcess/mac/WKFullScreenWindowController.mm:
+
+2011-03-13  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Add ability to create a WKErrorRef
+        <rdar://problem/9115768>
+        https://bugs.webkit.org/show_bug.cgi?id=56279
+
+        * Shared/API/c/cf/WKErrorCF.cpp: Added.
+        (WKErrorCreateWithCFError):
+        (WKErrorCopyCFError):
+        * Shared/API/c/cf/WKErrorCF.h: Added.
+        Add new API to create a WKErrorRef from a CFErrorRef
+        and vice-versa.
+
+        * WebKit2.xcodeproj/project.pbxproj:
+        * win/WebKit2.vcproj:
+        * win/WebKit2Generated.make:
+        Add new files.
+
+2011-03-13  Pratik Solanki  <psolanki@apple.com>
+
+        Reviewed by Brady Eidson.
+
+        Make adjustMIMETypeIfNecessary use CFNetwork directly
+        https://bugs.webkit.org/show_bug.cgi?id=55912
+
+        * WebProcess/WebCoreSupport/mac/WebSystemInterface.mm:
+        (InitWebCoreSystemInterface): Support for new WKSI functions.
+
+2011-03-13  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        WebPageProxy cleanup
+        https://bugs.webkit.org/show_bug.cgi?id=56267
+
+        * UIProcess/WebPageProxy.cpp: Moved all Mac-only function implementations from
+        here to WebPageProxyMac.mm.
+        * UIProcess/WebPageProxy.h: Cleaned up #includes.
+        * UIProcess/mac/WebPageProxyMac.mm: Moved all Mac-only function implementations
+        here.
+        (WebKit::WebPageProxy::updateWindowIsVisible):
+        (WebKit::WebPageProxy::windowAndViewFramesChanged):
+        (WebKit::WebPageProxy::getMarkedRange):
+        (WebKit::WebPageProxy::characterIndexForPoint):
+        (WebKit::WebPageProxy::firstRectForCharacterRange):
+        (WebKit::WebPageProxy::writeSelectionToPasteboard):
+        (WebKit::WebPageProxy::setDragImage):
+        (WebKit::WebPageProxy::performDictionaryLookupAtLocation):
+        (WebKit::WebPageProxy::interpretKeyEvent):
+        (WebKit::WebPageProxy::sendComplexTextInputToPlugin):
+        (WebKit::WebPageProxy::uppercaseWord):
+        (WebKit::WebPageProxy::lowercaseWord):
+        (WebKit::WebPageProxy::capitalizeWord):
+        (WebKit::WebPageProxy::setSmartInsertDeleteEnabled):
+        (WebKit::WebPageProxy::didPerformDictionaryLookup):
+        (WebKit::WebPageProxy::registerWebProcessAccessibilityToken):
+        (WebKit::WebPageProxy::registerUIProcessAccessibilityTokens):
+        (WebKit::WebPageProxy::setComplexTextInputEnabled):
+
+2011-03-13  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/8949683> WebKit2: Drag image is offset when the page is scrolled down
+        https://bugs.webkit.org/show_bug.cgi?id=56265
+
+        * WebProcess/WebCoreSupport/mac/WebDragClientMac.mm:
+        (WebKit::WebDragClient::startDrag): Send the location in view coordinates rather than
+        document coordinates.
+
+2011-03-13  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        Fix a crash when dragging.
+
+        * WebProcess/WebCoreSupport/mac/WebDragClientMac.mm:
+        (WebKit::convertImageToBitmap): Retain the saved context.
+
+2011-03-12  Darin Adler  <darin@apple.com>
+
+        * WebProcess/WebCoreSupport/mac/WebDragClientMac.mm:
+        (WebKit::WebDragClient::startDrag): Fixed typo in a comment.
+
+2011-03-11  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Dragging image to desktop gives webloc instead of image file in WebKit2
+        https://bugs.webkit.org/show_bug.cgi?id=56193
+
+        * WebProcess/WebCoreSupport/mac/WebDragClientMac.mm:
+        (WebKit::convertImageToBitmap): Added. Factored out from startDrag to
+        make the startDrag code clearer.
+        (WebKit::WebDragClient::startDrag): Streamlined code a bit.
+        (WebKit::cachedImage): Added. Helper for function below.
+        (WebKit::arrayForURLsWithTitles): Added. Helper for function below.
+        (WebKit::WebDragClient::declareAndWriteDragImage): Added code to handle file
+        promises and removed a log of uneeded code.
+        (-[WKPasteboardFilePromiseOwner copyDropDirectory]): Added.
+        (promisedDataClient): Added.
+        (-[WKPasteboardOwner clearImage]): Added.
+        (-[WKPasteboardOwner initWithImage:]): Added.
+        (-[WKPasteboardOwner dealloc]): Added.
+        (-[WKPasteboardOwner finalize]): Added.
+        (-[WKPasteboardOwner pasteboard:provideDataForType:]): Added.
+        (-[WKPasteboardOwner pasteboardChangedOwner:]): Added.
+        (matchesExtensionOrEquivalent): Added.
+        (-[WKPasteboardOwner namesOfPromisedFilesDroppedAtDestination:]): Added.
+        Much of the new code above came from the WebKit1 drag code.
+
+        * WebProcess/WebPage/WebPage.cpp:
+        (WebKit::WebPage::dragEnded): Added call to Mac-only platformDragEnded.
+        * WebProcess/WebPage/WebPage.h: Added Mac-only platformDragEnded and m_dragSource.
+        * WebProcess/WebPage/mac/WebPageMac.mm:
+        (WebKit::WebPage::setDragSource): Added.
+        (WebKit::WebPage::platformDragEnded): Added.
+
+2011-03-12  Mark Rowe  <mrowe@apple.com>
+
+        Fix the 32-bit build.
+
+        This involves hacking around some HIToolbox headers that do things of dubious correctness,
+        and fixing the usual CGRect vs NSRect issues.
+        
+        * UIProcess/mac/WKFullScreenWindowController.mm:
+        (-[WKFullScreenWindowController enterFullScreen:]): NSRect is not CGRect.
+        * WebProcess/FullScreen/mac/WebFullScreenManagerMac.mm:
+        (WebKit::WebFullScreenManagerMac::beginExitFullScreenAnimation): Ditto.
+
+2011-03-12  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        * WebProcess/WebPage/WebFrame.cpp:
+        (WebKit::WebFrame::url):
+        Get the URL from the loader, not from the document.
+
+        (WebKit::WebFrame::suggestedFilenameForResourceWithURL):
+        Return the correct suggested filename for the main resource.
+
+        (WebKit::WebFrame::mimeTypeForResourceWithURL):
+        Return the correct mime type for the main resource.
+
+2011-03-12  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Should be able to download a PDF to the Downloads folder
+        https://bugs.webkit.org/show_bug.cgi?id=56256
+
+        * UIProcess/API/C/WKPage.h:
+        Add WKPageSaveDataToFileInDownloadsFolderCallback to the UI client.
+
+        * UIProcess/API/mac/PDFViewController.h:
+        * UIProcess/API/mac/PDFViewController.mm:
+        (-[WKPDFView _applyPDFPreferences]):
+        (-[WKPDFView _updatePreferences:]):
+        Use new PDFViewController::page getter.
+
+        (-[WKPDFView PDFViewSavePDFToDownloadFolder:]):
+        Call PDFViewController::savePDFToDownloadsFolder.
+
+        (WebKit::releaseCFData):
+        (WebKit::PDFViewController::savePDFToDownloadsFolder):
+        Create a WebData that wraps the CFData, then pass it along to
+        WebPageProxy::saveDataToFileInDownloadsFolder.
+
+        * UIProcess/WebPageProxy.cpp:
+        (WebKit::WebPageProxy::saveDataToFileInDownloadsFolder):
+        Call WebUIClient::saveDataToFileInDownloadsFolder.
+
+        (WebKit::WebUIClient::saveDataToFileInDownloadsFolder):
+        * UIProcess/WebUIClient.h:
+        Call the UI client callback function.
+
+2011-03-12  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        WebData should be able to wrap already existing data
+        https://bugs.webkit.org/show_bug.cgi?id=56254
+
+        * Shared/WebData.h:
+        (WebKit::WebData::createWithoutCopying):
+        (WebKit::WebData::create):
+        (WebKit::WebData::~WebData):
+        (WebKit::WebData::bytes):
+        (WebKit::WebData::size):
+        (WebKit::WebData::WebData):
+        (WebKit::WebData::fastFreeBytes):
+
+2011-03-12  Jer Noble  <jer.noble@apple.com>
+
+        Reviewed by Eric Carlson.
+
+        WebKit2: Initialize the WebFullScreenManagerProxy with a WKView
+        https://bugs.webkit.org/show_bug.cgi?id=56250
+
+        * UIProcess/API/mac/WKView.mm:
+        (-[WKView initWithFrame:contextRef:pageGroupRef:]): Call fullScreenManager()->setView(self).
+
+2011-03-11  Jer Noble  <jer.noble@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        Add full screen animation code to WebFullScreenManager.
+        https://bugs.webkit.org/show_bug.cgi?id=56220
+
+        * WebProcess/FullScreen/WebFullScreenManager.cpp: .
+        (WebKit::WebFullScreenManager::~WebFullScreenManager): Added.
+        (WebKit::WebFullScreenManager::exitFullScreenForElement): Remove ASSERTs.
+        (WebKit::WebFullScreenManager::willEnterFullScreen): Set the full screen renderer's background color.
+        (WebKit::WebFullScreenManager::didEnterFullScreen): Ditto.
+        (WebKit::WebFullScreenManager::willExitFullScreen): Ditto.
+        (WebKit::WebFullScreenManager::didExitFullScreen): Ditto.
+        * WebProcess/FullScreen/WebFullScreenManager.h: Make a few functions pure virtual to be implemented in a 
+            concrete subclass.
+        * WebProcess/FullScreen/mac/WebFullScreenManagerMac.h: Added.
+        * WebProcess/FullScreen/mac/WebFullScreenManagerMac.mm: Added.
+        (-[WebFullScreenManagerAnimationListener initWithManager:WebKit::began:finished:]): Listener for CAAnimations.
+        (-[WebFullScreenManagerAnimationListener animationDidStart:]): Added.
+        (-[WebFullScreenManagerAnimationListener animationDidStop:finished:]): Added.
+        (-[WebFullScreenManagerAnimationListener invalidate]): Added.
+        (WebKit::WebFullScreenManager::create): Now creates a WebFullScreenManagerMac.
+        (WebKit::WebFullScreenManagerMac::create): Added.
+        (WebKit::WebFullScreenManagerMac::WebFullScreenManagerMac): Added.
+        (WebKit::WebFullScreenManagerMac::~WebFullScreenManagerMac): Added.
+        (WebKit::WebFullScreenManagerMac::setRootFullScreenLayer): Set up the remote layer host.
+        (WebKit::WebFullScreenManagerMac::beginEnterFullScreenAnimation): Create a CATransform3D
+            which will animate the full screen renderer from its initial position to its final one.
+        (WebKit::WebFullScreenManagerMac::beginExitFullScreenAnimation): Ditto.
+
+2011-03-11  Jer Noble  <jer.noble@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        Hook up new WKFullScreenWindowController functions to WebFullScreenManagerProxy
+        https://bugs.webkit.org/show_bug.cgi?id=56218
+
+        * UIProcess/WebFullScreenManagerProxy.cpp:
+        * UIProcess/mac/WebFullScreenManagerProxyMac.mm: Added.
+        (WebKit::WebFullScreenManagerProxy::enterFullScreen): Call into WKFullScreenWindowController.
+        (WebKit::WebFullScreenManagerProxy::exitFullScreen): Ditto.
+        (WebKit::WebFullScreenManagerProxy::beganEnterFullScreenAnimation): Ditto.
+        (WebKit::WebFullScreenManagerProxy::finishedEnterFullScreenAnimation): Ditto.
+        (WebKit::WebFullScreenManagerProxy::beganExitFullScreenAnimation): Ditto.
+        (WebKit::WebFullScreenManagerProxy::finishedExitFullScreenAnimation): Ditto.
+        (WebKit::WebFullScreenManagerProxy::enterAcceleratedCompositingMode): Ditto.
+        (WebKit::WebFullScreenManagerProxy::exitAcceleratedCompositingMode): Ditto.
+        (WebKit::WebFullScreenManagerProxy::getFullScreenRect): Ditto.
+        * UIProcess/API/mac/WKView.mm:
+        (-[WKView fullScreenWindowController]): Lazily instantiate a WKFullScreenWindowController.
+        * UIProcess/API/mac/WKViewInternal.h:
+
+2011-03-11  Jer Noble  <jer.noble@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        Add the WKFullScreenWindowController, mostly cribbed from WebKit's WebFullScreenController.
+
+        [WebKit2] Implement a full screen window controller
+        https://bugs.webkit.org/show_bug.cgi?id=56210
+
+        * UIProcess/mac/WKFullScreenWindowController.h: Added.
+        * UIProcess/mac/WKFullScreenWindowController.mm: Added.
+        (-[WKFullScreenWindowController init]): Remove the _mediaEventListener.
+        (-[WKFullScreenWindowController dealloc]): Make sure to cancel previous async requests.
+        (-[WKFullScreenWindowController windowDidLoad]): Remove the Tiger protection.
+        (-[WKFullScreenWindowController webView]): Type change.
+        (-[WKFullScreenWindowController setWebView:]): Type change.
+        (-[WKFullScreenWindowController applicationDidResignActive:]): Case changes.
+        (-[WKFullScreenWindowController applicationDidChangeScreenParameters:]): Case changes.
+        (-[WKFullScreenWindowController enterFullScreen:]): Removed most of the animation code
+            which will reappear in WebFullScreenManager.
+        (-[WKFullScreenWindowController beganEnterFullScreenAnimation]): Added.
+        (-[WKFullScreenWindowController finishedEnterFullScreenAnimation:]): Added.
+        (-[WKFullScreenWindowController exitFullScreen]): Ditto to enterFullScreen.
+        (-[WKFullScreenWindowController beganExitFullScreenAnimation]): Added.
+        (-[WKFullScreenWindowController finishedExitFullScreenAnimation:]): Added.
+        (-[WKFullScreenWindowController enterAcceleratedCompositingMode:WebKit::]): Set up the
+            layer tree host.
+        (-[WKFullScreenWindowController exitAcceleratedCompositingMode]): Tear down same.
+        (-[WKFullScreenWindowController getFullScreenRect:WebCore::]): Added.
+        (-[WKFullScreenWindowController _updateMenuAndDockForFullScreen]): Case changes.
+        (-[WKFullScreenWindowController _disableIdleDisplaySleep]): Ditto.
+        (-[WKFullScreenWindowController _enableIdleDisplaySleep]): Ditto.
+        (-[WKFullScreenWindowController _disableIdleSystemSleep]): Ditto.
+        (-[WKFullScreenWindowController _enableIdleSystemSleep]): Ditto.
+        (-[WKFullScreenWindowController _enableTickleTimer]): Ditto.
+        (-[WKFullScreenWindowController _disableTickleTimer]): Ditto.
+        (-[WKFullScreenWindowController _tickleTimerFired]): Ditto.
+        (-[WKFullScreenWindowController _updatePowerAssertions]): Use _isPlaying ivar.
+        (-[WKFullScreenWindowController _manager]): Added.
+        (-[WKFullScreenWindowController _requestExit]): Case changes.
+        (-[WKFullScreenWindowController _requestExitFullScreenWithAnimation:]): Ditto.
+        (-[WKFullScreenWindowController _swapView:with:]): Added.
+        (-[WKFullScreenWindowController _fullScreenWindow]): Case changes.
+        (-[WKFullScreenWindow initWithContentRect:styleMask:backing:defer:]): Geometry no
+            longer needs to be flipped.
+        (-[WKFullScreenWindow cancelOperation:]): Case changes.
+
+2011-03-11  Jer Noble  <jer.noble@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        Create new interface stubs to support full screen mode in WebKit2.
+
+        WebKit2: Plumb new full screen animation APIs through WebKit2.
+        https://bugs.webkit.org/show_bug.cgi?id=55993
+
+        * UIProcess/WebFullScreenManagerProxy.cpp:
+        (WebKit::WebFullScreenManagerProxy::WebFullScreenManagerProxy): Added.
+        (WebKit::WebFullScreenManagerProxy::invalidate): Clear m_webView.
+        (WebKit::WebFullScreenManagerProxy::setWebView): Set m_webView.
+        (WebKit::WebFullScreenManagerProxy::beginEnterFullScreenAnimation): Added.
+        (WebKit::WebFullScreenManagerProxy::beginExitFullScreenAnimation): Added.
+        (WebKit::WebFullScreenManagerProxy::beganEnterFullScreenAnimation): Added stub.
+        (WebKit::WebFullScreenManagerProxy::finishedEnterFullScreenAnimation): Added stub.
+        (WebKit::WebFullScreenManagerProxy::beganExitFullScreenAnimation): Added stub.
+        (WebKit::WebFullScreenManagerProxy::finishedExitFullScreenAnimation): Added stub.
+        (WebKit::WebFullScreenManagerProxy::enterAcceleratedCompositingMode): Added stub.
+        (WebKit::WebFullScreenManagerProxy::exitAcceleratedCompositingMode): Added stub.
+        (WebKit::WebFullScreenManagerProxy::getFullScreenRect): Added stub.
+        * UIProcess/WebFullScreenManagerProxy.h:
+        * UIProcess/WebFullScreenManagerProxy.messages.in: Added new message definitions.
+        * UIProcess/WebPageProxy.cpp: Moved include of WebFullScreenManagerProxy.h into source file.
+        * UIProcess/WebPageProxy.h: Ditto.
+        * WebProcess/FullScreen/WebFullScreenManager.cpp:
+        (WebKit::WebFullScreenManager::element): Added.
+        (WebKit::WebFullScreenManager::supportsFullScreen): Send message through WebPage.
+        (WebKit::WebFullScreenManager::enterFullScreenForElement): Ditto.
+        (WebKit::WebFullScreenManager::exitFullScreenForElement): Ditto.
+        (WebKit::WebFullScreenManager::beganEnterFullScreenAnimation): Added..
+        (WebKit::WebFullScreenManager::finishedEnterFullScreenAnimation): Added.
+        (WebKit::WebFullScreenManager::beganExitFullScreenAnimation): Added.
+        (WebKit::WebFullScreenManager::finishedExitFullScreenAnimation): Added.
+        (WebKit::WebFullScreenManager::setRootFullScreenLayer): Added stub.
+        (WebKit::WebFullScreenManager::getFullScreenRect): Added.
+        (WebKit::WebFullScreenManager::beginEnterFullScreenAnimation): Added stub.
+        (WebKit::WebFullScreenManager::beginExitFullScreenAnimation): Added stub.
+        * WebProcess/FullScreen/WebFullScreenManager.h:
+        * WebProcess/FullScreen/WebFullScreenManager.messages.in: Added new message definitions.
+        * WebProcess/WebCoreSupport/WebChromeClient.cpp:
+        (WebKit::WebChromeClient::setRootFullScreenLayer): Added.
+        * WebProcess/WebCoreSupport/WebChromeClient.h:
+
+2011-03-11  Alice Liu  <alice.liu@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Support encoding /decoding WebData in usermessages
+        https://bugs.webkit.org/show_bug.cgi?id=56158
+
+        Added encoding/decoding for APIObject::TypeData
+        * Shared/UserMessageCoders.h:
+        (WebKit::UserMessageEncoder::baseEncode):
+        (WebKit::UserMessageDecoder::baseDecode):
+
+2011-03-11  Alice Liu  <alice.liu@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Add api for "remove" to WKMutableDictionary
+        https://bugs.webkit.org/show_bug.cgi?id=56157
+
+        * Shared/API/c/WKMutableDictionary.cpp:
+        (WKDictionaryRemoveItem): Added; call remove on MutableDictionary impl.
+        * Shared/API/c/WKMutableDictionary.h:
+        * Shared/MutableDictionary.cpp:
+        (WebKit::MutableDictionary::remove): Added; call remove on the underlying hashmap.
+        * Shared/MutableDictionary.h:
+
+2011-03-11  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r80899 and r80912.
+        http://trac.webkit.org/changeset/80899
+        http://trac.webkit.org/changeset/80912
+        https://bugs.webkit.org/show_bug.cgi?id=56236
+
+        Caused animation tests to crash on Snow Leopard WebKit2
+        (Requested by rniwa on #webkit).
+
+        * Shared/ShareableBitmap.cpp:
+        (WebKit::ShareableBitmap::create):
+        (WebKit::ShareableBitmap::createShareable):
+        (WebKit::ShareableBitmap::resize):
+        * Shared/ShareableBitmap.h:
+        (WebKit::ShareableBitmap::numBytesForSize):
+        (WebKit::ShareableBitmap::sizeInBytes):
+        * UIProcess/DrawingAreaProxyImpl.cpp:
+        (WebKit::DrawingAreaProxyImpl::update):
+        * WebKit2.xcodeproj/project.pbxproj:
+        * WebProcess/WebPage/DrawingArea.h:
+        (WebKit::DrawingArea::didUpdate):
+        * WebProcess/WebPage/DrawingArea.messages.in:
+        * WebProcess/WebPage/DrawingAreaImpl.cpp:
+        (WebKit::DrawingAreaImpl::~DrawingAreaImpl):
+        (WebKit::DrawingAreaImpl::sendDidUpdateBackingStoreState):
+        (WebKit::DrawingAreaImpl::didUpdate):
+        (WebKit::DrawingAreaImpl::exitAcceleratedCompositingMode):
+        (WebKit::DrawingAreaImpl::display):
+        * WebProcess/WebPage/DrawingAreaImpl.h:
+        * WebProcess/WebPage/SharedMemoryCache.cpp: Removed.
+        * WebProcess/WebPage/SharedMemoryCache.h: Removed.
+        * win/WebKit2.vcproj:
+
+2011-03-11  Brian Weinstein  <bweinstein@apple.com>
+
+        Windows build fix. Add SharedMemoryCache to the vcproj.
+
+        * win/WebKit2.vcproj:
+
+2011-03-11  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=56222
+        A window remains frozen if web process crashes during printing
+
+        * UIProcess/API/mac/PageClientImpl.h:
+        * UIProcess/API/mac/PageClientImpl.mm:
+        * UIProcess/PageClient.h:
+        * UIProcess/WebPageProxy.cpp:
+        (WebKit::WebPageProxy::setComplexTextInputEnabled):
+        * UIProcess/WebPageProxy.h:
+        Moved setAutodisplay code into WKPrintingView.
+
+        * UIProcess/API/mac/WKPrintingView.h:
+        * UIProcess/API/mac/WKView.mm:
+        (-[WKView printOperationWithPrintInfo:forFrame:]):
+        Keep a reference to the actual WKView, so that we can manipulate how it displays, even if
+        page goes away.
+
+        * UIProcess/API/mac/WKPrintingView.mm:
+        (-[WKPrintingView initWithFrameProxy:WebKit::view:]):
+        (-[WKPrintingView _setAutodisplay:]):
+        (-[WKPrintingView _suspendAutodisplay]):
+        (-[WKPrintingView _delayedResumeAutodisplayTimerFired]):
+        Move setAutodisplay here.
+
+2011-03-11  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Add a shared memory cache to the web process
+        https://bugs.webkit.org/show_bug.cgi?id=56232
+
+        Add a very simple shared memory cache to the web process, so that we don't have to allocate and
+        free memory over and over when painting.
+
+        * Shared/ShareableBitmap.cpp:
+        (WebKit::ShareableBitmap::create):
+        (WebKit::ShareableBitmap::createShareable):
+        (WebKit::ShareableBitmap::resize):
+        * Shared/ShareableBitmap.h:
+        (WebKit::ShareableBitmap::numBytesNeededForBitmapSize):
+        (WebKit::ShareableBitmap::sizeInBytes):
+        Rename numBytesForSize to numBytesNeededForBitmapSize.
+
+        * UIProcess/DrawingAreaProxyImpl.cpp:
+        (WebKit::DrawingAreaProxyImpl::update):
+        Always send back a DidUpdate message, even if we didn't use the update info.
+        This is needed so that the web process knows when the UI process is done with the shared memory inside
+        the update info struct.
+
+        * WebKit2.xcodeproj/project.pbxproj:
+        Add new files.
+
+        * WebProcess/WebPage/DrawingArea.h:
+        (WebKit::DrawingArea::didUpdate):
+        * WebProcess/WebPage/DrawingArea.messages.in:
+        DidUpdate now takes a boolean.
+
+        * WebProcess/WebPage/DrawingAreaImpl.cpp:
+        (WebKit::sharedMemoryCache):
+        Add shared memory cache.
+
+        (WebKit::DrawingAreaImpl::~DrawingAreaImpl):
+        Return the shared memory to the cache.
+
+        (WebKit::DrawingAreaImpl::sendDidUpdateBackingStoreState):
+        display now takes an extra boolean.
+
+        (WebKit::DrawingAreaImpl::didUpdate):
+        Return the shared memory to the cache.
+
+        (WebKit::DrawingAreaImpl::display):
+        If useSharedMemoryCache is true, get shared memory from the cache.
+
+        * WebProcess/WebPage/SharedMemoryCache.cpp: Added.
+        (WebKit::SharedMemoryCache::acquireSharedMemory):
+        If the memory we currently hold on to is big enough, return it.
+
+        (WebKit::SharedMemoryCache::releaseSharedMemory):
+        If we're already holding on to shared memory, evict it if the returned
+        shared memory object is bigger than the one we currently hold.
+
+        (WebKit::SharedMemoryCache::clearCacheTimerFired):
+        Null out the shared memory object.
+
+2011-03-11  Jessie Berlin  <jberlin@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Crash calling WebContext::clearResourceCaches(InMemoryResourceCachesOnly) before the Web
+        Process has finished launching.
+        https://bugs.webkit.org/show_bug.cgi?id=56208
+
+        Only send the message if the Web Process is valid.
+
+        * UIProcess/WebContext.cpp:
+        (WebKit::WebContext::clearResourceCaches):
+
+2011-03-11  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Don't paint more than 60 times per second
+        https://bugs.webkit.org/show_bug.cgi?id=56206
+        <rdar://problem/9085989>
+
+        * WebProcess/WebPage/DrawingAreaImpl.cpp:
+        (WebKit::DrawingAreaImpl::DrawingAreaImpl):
+        Initialize m_lastDisplayTime to 0. Change the display timer to call displayTimerFired.
+
+        (WebKit::DrawingAreaImpl::didUpdate):
+        Call displayTimerFired instead of display.
+
+        (WebKit::DrawingAreaImpl::displayTimerFired):
+        If we're asked to paint again less than 1/60th of a second after we've already painted,
+        defer painting.
+
+        (WebKit::DrawingAreaImpl::display):
+        Update m_lastDisplayTime.
+
+2011-03-11  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Alice Liu.
+
+        <rdar://problem/9120161> WKPageRestoreFromSessionState does not set the pending API request URL.
+
+        * UIProcess/cf/WebPageProxyCF.cpp:
+        (WebKit::WebPageProxy::restoreFromSessionStateData): If we're navigating to a back/forward item
+        as part of the restoration, call setPendingAPIRequestURL. When there's a provisional URL this will
+        be done by our call to loadURL elsewhere in the function.
+
+2011-03-10  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Jon Honeycutt.
+
+        WebKit2 UI process crashes if web process crashes while computing page rects for printing
+        https://bugs.webkit.org/show_bug.cgi?id=56160
+        <rdar://problem/9027410>
+
+        * UIProcess/API/mac/WKPrintingView.mm:
+        (-[WKPrintingView _suspendAutodisplay]): Added a null check for page, matching one that
+        we have when resuming autodisplay.
+        (-[WKPrintingView _delayedResumeAutodisplayTimerFired]): Added a FIXME.
+        (pageDidComputePageRects): Sanitize results coming from the web process (and avoid crashing
+        when there is a communication error, so results are all null).
+        (-[WKPrintingView knowsPageRange:]): If there is no page any more, we can't tell how many
+        pages it had.
+        (-[WKPrintingView rectForPage:]): Handle the case where we are neither calculating pages
+        nor knowing them, as it happens when the web process crashes.        
+
+2011-03-10  Mark Rowe  <mrowe@apple.com>
+
+        Rubber-stamped by Sam Weinig.
+
+        Part of <rdar://problem/8728860> WebKit2 needs to be made localizable
+
+        The presence of CFBundleDevelopmentRegion in the application's Info.plist prevents
+        the default localization that we set during launch from being respected.
+
+        * PluginProcess/Info.plist: Remove CFBundleDevelopmentRegion.
+        * WebProcess/Info.plist: Ditto.
+
+2011-03-10  Martin Robinson  <mrobinson@igalia.com>
+
+        Build for WebKit2 GTK+ after r80714.
+
+        * GNUmakefile.am: Update source list.
+        * WebProcess/Plugins/Netscape/x11/NetscapePluginX11.cpp: 
+        (WebKit::x11Display): Add missing semicolon.
+
+2011-03-10  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        REGRESSION (WebKit2): VoiceOver focus no longer follows keyboard focus
+        https://bugs.webkit.org/show_bug.cgi?id=55959
+
+        NSApplication has to return the focused element within the app in order
+        for NSAccessibilityHandleFocusChanged() to work. The default implementation
+        relies on keyWindow. Consequently, in WK2, the WebProcess must override that method
+        to return the appropriate focused element within the WebProcess, since
+        there is no keyWindow.
+
+        * WebKit2.xcodeproj/project.pbxproj:
+        * WebProcess/WebPage/mac/AccessibilityWebPageObject.mm:
+        (-[AccessibilityWebPageObject accessibilityFocusedUIElement]):
+        * WebProcess/WebProcess.cpp:
+        (WebKit::WebProcess::focusedWebPage):
+        * WebProcess/WebProcess.h:
+        * WebProcess/mac/NSApplicationOverride.mm: Added.
+        (-[NSApplication accessibilityFocusedUIElement]):
+
+2011-03-10  Oleg Romashin  <romaxa@gmail.com>
+
+        Reviewed by Andreas Kling.
+
+        Make Qt port compiling with ENABLE_PLUGIN_PROCESS=1, part3
+        Solving conflict of Qt and Xlib includes
+
+        * Shared/Plugins/NPIdentifierData.cpp:
+        * Shared/Plugins/NPIdentifierData.h:
+        * Shared/Plugins/NPObjectProxy.cpp:
+        * Shared/Plugins/NPVariantData.h:
+
+2011-03-10  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Mark Rowe.
+
+        - Fix plugins in release and production builds.
+
+        * WebKit2.xcodeproj/project.pbxproj:
+        Make sure to base the PluginProcess target on the correct xcconfig file
+        in all configurations.
+
+2011-03-09  Matthew Delaney  <mdelaney@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Plumb through settings for accelerated drawing for canvas
+        https://bugs.webkit.org/show_bug.cgi?id=56039
+
+        * Shared/WebPreferencesStore.h:
+        * UIProcess/API/C/WKPreferences.cpp:
+        * UIProcess/API/C/WKPreferencesPrivate.h:
+        * WebProcess/WebPage/WebPage.cpp:
+
+2011-03-10  Jessie Berlin  <jberlin@apple.com>
+
+        Reviewed by Oliver Hunt and Brian Weinstein.
+
+        WebKit2: Need a way to clear only the in-memory resource caches
+        https://bugs.webkit.org/show_bug.cgi?id=56022
+
+        Add a parameter to WKContextClearResourceCaches to specify whether to clear all the caches
+        or just the memory caches.
+
+        * Shared/ResourceCachesToClear.h: Added.
+        * UIProcess/API/C/WKAPICast.h:
+        (WebKit::toResourceCachesToClear):
+
+        * UIProcess/API/C/WKContext.cpp:
+        (WKContextClearResourceCaches):
+        Add the new parameter.
+        * UIProcess/API/C/WKContext.h:
+        * UIProcess/WebContext.cpp:
+        (WebKit::WebContext::clearResourceCaches):
+        Ditto.
+        * UIProcess/WebContext.h:
+
+        * WebProcess/WebProcess.cpp:
+        (WebKit::WebProcess::clearResourceCaches):
+        Pass the new parameter through to the platform-specific functions.
+        * WebProcess/WebProcess.h:
+        Add the new parameter and give it a default of AllResourceCaches.
+        * WebProcess/WebProcess.messages.in:
+        Ditto.
+        * WebProcess/gtk/WebProcessGtk.cpp:
+        (WebKit::WebProcess::platformClearResourceCaches):
+        Ditto.
+        * WebProcess/qt/WebProcessQt.cpp:
+        (WebKit::WebProcess::platformClearResourceCaches):
+        Ditto.
+        * WebProcess/win/WebProcessWin.cpp:
+        (WebKit::WebProcess::platformClearResourceCaches):
+        When told to clear only the in-memory caches, return early so as not to clear the CFNetwork
+        disk cache.
+        * WebProcess/mac/WebProcessMac.mm:
+        (WebKit::WebProcess::platformClearResourceCaches):
+        Ditto.
+
+        * WebKit2.xcodeproj/project.pbxproj:
+        Add ResourceCachesToClear.h
+        * win/WebKit2.vcproj:
+        Ditto.
+
+2011-03-10  Jeff Miller  <jeffm@apple.com>
+
+        Reviewed by Adam Roben.
+
+        WKViewRegisterEditCommandCallback should use WKViewUndoType
+        https://bugs.webkit.org/show_bug.cgi?id=56120
+
+        * UIProcess/API/C/win/WKView.h: Change undoOrRedo parameter in WKViewRegisterEditCommandCallback to be WKViewUndoType.
+
+2011-03-10  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Tiled backing store's delegated scroll request uses incorrect convention
+        https://bugs.webkit.org/show_bug.cgi?id=56011
+
+        Adapt all of the internal API to match the delta to point
+        conversion at the WebCore side.
+
+        * UIProcess/API/qt/qwkpage.cpp:
+        (QWKPagePrivate::pageDidRequestScroll):
+        * UIProcess/API/qt/qwkpage_p.h:
+        * UIProcess/PageClient.h:
+        * UIProcess/WebPageProxy.cpp:
+        (WebKit::WebPageProxy::pageDidRequestScroll):
+        * UIProcess/WebPageProxy.h:
+        * UIProcess/WebPageProxy.messages.in:
+        * WebProcess/WebCoreSupport/WebChromeClient.cpp:
+        (WebKit::WebChromeClient::delegatedScrollRequested):
+        * WebProcess/WebCoreSupport/WebChromeClient.h:
+        * WebProcess/WebPage/WebPage.cpp:
+        (WebKit::WebPage::pageDidRequestScroll):
+        * WebProcess/WebPage/WebPage.h:
+
+2011-03-10  Balazs Kelemen  <kbalazs@webkit.org>
+
+        Reviewed by Andreas Kling.
+
+        [WK2] Make non-transparent windowless plugins paint on X11
+        https://bugs.webkit.org/show_bug.cgi?id=55660
+
+        Implement painting for non-transparent windowless X11 plugins.
+        The essence of the logic has been adapted from WebCore.
+        The implementation is stubbed for GTK and working only on Qt
+        but it should be really easy to finish it for GTK.
+
+        * WebKit2.pro:
+        * WebProcess/Plugins/Netscape/NetscapeBrowserFuncs.cpp:
+        (WebKit::NPN_GetValue): Handle X11 specific values that are necessary.
+        * WebProcess/Plugins/Netscape/NetscapePlugin.cpp:
+        (WebKit::NetscapePlugin::NetscapePlugin): Initialize the X11 specific
+        members that has been added.
+        (WebKit::NetscapePlugin::callSetWindow): Always set the x and y coordinates
+        of the NP_Window to 0 on X11 since we are using a backings store as the
+        painting area for the plugin.
+        * WebProcess/Plugins/Netscape/NetscapePlugin.h:
+        * WebProcess/Plugins/Netscape/gtk/NetscapePluginGtk.cpp: Removed in favour
+        of a common implementation for X11.
+        * WebProcess/Plugins/Netscape/qt/NetscapePluginQt.cpp: Ditto.
+        * WebProcess/Plugins/Netscape/x11/NetscapePluginX11.cpp: Added.
+        (WebKit::getPluginDisplay):
+
+        Platform specific static getters.
+        (WebKit::x11Display):
+        (WebKit::displayDepth):
+        (WebKit::rootWindowID):
+        (WebKit::x11Screen):
+
+        (WebKit::NetscapePlugin::platformPostInitialize): Set up the visual
+        settings and the colormap for the plugin.
+        (WebKit::NetscapePlugin::platformDestroy):
+        (WebKit::NetscapePlugin::platformInvalidate): Remained stub.
+        (WebKit::NetscapePlugin::platformGeometryDidChange): Create a new
+        pixmap that fits the geometry.
+        (WebKit::NetscapePlugin::platformPaint): Propagate a paint event
+        to the plugin, sync with it if necessary and draw the pixmap to
+        the screen.
+        (WebKit::toNP): Remained stub.
+        (WebKit::NetscapePlugin::platformHandleMouseEvent): Remained stub.
+        (WebKit::NetscapePlugin::platformHandleWheelEvent): Remained stub.
+        (WebKit::NetscapePlugin::platformSetFocus): Remained stub.
+        (WebKit::NetscapePlugin::platformHandleMouseEnterEvent): Remained stub.
+        (WebKit::NetscapePlugin::platformHandleMouseLeaveEvent): Remained stub.
+        (WebKit::NetscapePlugin::platformHandleKeyboardEvent): Remained stub.
+        * WebProcess/WebCoreSupport/WebFrameLoaderClient.cpp:
+        (WebKit::WebFrameLoaderClient::createPlugin): Hack. Inject wmode=opaque
+        key-value pair to the plugin parameters to force Flash to act in
+        non-transparent windowless mode. Qt also doing this in WebCore.
+
+2011-03-09  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Mihai Parparita.
+
+        Unify Windows version checks.
+        https://bugs.webkit.org/show_bug.cgi?id=55979
+
+        * UIProcess/win/WebPageProxyWin.cpp:
+        (WebKit::WebPageProxy::standardUserAgent):
+
+2011-03-09  Adele Peterson  <adele@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=56068
+        <rdar://problem/9058245> WebKit2: Can't uncheck 'Spelling and Grammar' contextual items
+
+        * UIProcess/WebPageProxy.cpp: (WebKit::WebPageProxy::contextMenuItemSelected):
+        Add cases for ContextMenuItemTagCorrectSpellingAutomatically, ContextMenuItemTagCheckSpellingWhileTyping, 
+        and ContextMenuItemTagCheckGrammarWithSpelling
+
+2011-03-09  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Frequent crashes when printing in WebPageProxy::setAutodisplay
+        https://bugs.webkit.org/show_bug.cgi?id=56057
+        <rdar://problem/9053290>
+
+        * UIProcess/API/mac/WKPrintingView.mm: (-[WKPrintingView _delayedResumeAutodisplayTimerFired]):
+        Null check the page, there is no reason for it to still exist.
+
+2011-03-09  Brent Fulgham  <bfulgham@webkit.org>
+
+        Unreviewed build correction.
+
+        * UIProcess/DrawingAreaProxy.messages.in: Exclude the other
+          method using LayerTreeContext for non-accelerated composition case.
+
+2011-03-09  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Change plugins to use their own executable on Mac OS X
+        https://bugs.webkit.org/show_bug.cgi?id=55991
+
+        * Configurations/PluginProcess.xcconfig: Copied from Source/WebKit2/Configurations/WebProcess.xcconfig.
+        * PluginProcess/Info.plist: Copied from Source/WebKit2/WebProcess/Info.plist.
+        Add files necessary for adding PluginProcess.app.
+
+        * UIProcess/Launcher/mac/ProcessLauncherMac.mm:
+        (WebKit::ProcessLauncher::launchProcess):
+        Launch the PluginProcess.app when launching a plugin process.
+
+        * WebKit2.xcodeproj/project.pbxproj:
+        Add new executable and new files, removes some unneeded copying
+        and duplicate compiling of files.
+
+        * WebProcess/Info.plist:
+        Sorted.
+
+2011-03-09  Jessie Berlin  <jberlin@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Use the Cookie Storage from the Private Browsing Storage Session directly
+        https://bugs.webkit.org/show_bug.cgi?id=55986
+
+        * WebProcess/WebCoreSupport/mac/WebSystemInterface.mm:
+        (InitWebCoreSystemInterface):
+
+2011-03-09  Alejandro G. Castro  <alex@igalia.com>
+
+        Fix compilation after r80596, add soup Download stubs.
+
+        * GNUmakefile.am:
+        * WebProcess/Downloads/soup/DownloadSoup.cpp: Added.
+        (WebKit::Download::start):
+        (WebKit::Download::startWithHandle):
+        (WebKit::Download::cancel):
+        (WebKit::Download::platformInvalidate):
+        (WebKit::Download::didDecideDestination):
+        (WebKit::Download::platformDidFinish):
+
+2011-03-09  Alejandro G. Castro  <alex@igalia.com>
+
+        Fix GTK+ compilation after r80619. Add WebFullScreenManager.
+
+        * GNUmakefile.am:
+
+2011-03-08  Jer Noble  <jer.noble@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        WebKit2: Plumb through the FULLSCREEN_API Chrome client calls
+        https://bugs.webkit.org/show_bug.cgi?id=55273
+
+        The FULLSCREEN_API Chrome client calls need to be plumbed through from the 
+        WebProcess to the UIProcess.  To do this, WebFullScreenManager (and Proxy)
+        classes have been added to WebPage.
+
+        * DerivedSources.make: Added rules necessary to build DerivedSources for new .in files.
+        * DerivedSources.pro: Ditto.
+        * Platform/CoreIPC/MessageID.h: Added message types for WebFullScreenManager.
+        * Shared/API/c/WKBase.h: Added WKFullScreenManagerRef.
+        * Shared/APIObject.h: Added APIType for WebFullScreenManager.
+        * UIProcess/WebFullScreenManagerProxy.cpp: Added.
+        * UIProcess/WebFullScreenManagerProxy.h: Added.
+        * UIProcess/WebFullScreenManagerProxy.messages.in: Added.
+        * UIProcess/WebPageProxy.cpp:
+        (WebKit::WebPageProxy::close): Invalidate and clear m_fullScreenManager.
+        (WebKit::WebPageProxy::processDidCrash): Ditto.
+        (WebKit::WebPageProxy::didReceiveMessage): Pass messages on to WebFullScreenManagerProxy.
+        (WebKit::WebPageProxy::didReceiveSyncMessage): Ditto.
+        (WebKit::WebPageProxy::fullScreenManager): Added. Lazy instantiation of m_fullScreenManager.
+        * UIProcess/WebPageProxy.h:
+        * UIProcess/WebPageProxy.messages.in:
+        * UIProcess/WebUIClient.cpp:
+        * UIProcess/WebUIClient.h:
+        * WebKit2.xcodeproj/project.pbxproj: Added references to new classes in project file.
+        * WebKit2.pro: Ditto.
+        * win/WebKit2.vcproj: Ditto.
+        * WebKit2.pri: Added new directories to include file path.
+        * win/WebKit2Common.vsprops: Ditto.
+        * WebProcess/FullScreen/WebFullScreenManager.cpp: Added.
+        * WebProcess/FullScreen/WebFullScreenManager.h: Added.
+        * WebProcess/FullScreen/WebFullScreenManager.messages.in: Added.
+        * WebProcess/WebCoreSupport/WebChromeClient.cpp:
+        (WebKit::WebChromeClient::supportsFullScreenForElement): Pass through to WebFullScreenManager.
+        (WebKit::WebChromeClient::enterFullScreenForElement): Ditto.
+        (WebKit::WebChromeClient::exitFullScreenForElement): Ditto.
+        * WebProcess/WebPage/WebPage.cpp:
+        (WebKit::WebPage::close): Invalidate and clear m_fullScreenManager.
+        (WebKit::WebPage::fullScreenManager): Lazy instantiation of m_fullScreenManager.
+        (WebKit::WebPage::didReceiveMessage): Pass messages through to WebFullScreenManager.
+        * WebProcess/WebPage/WebPage.h:
+
+2011-03-08  Jer Noble  <jer.noble@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        WebKit2: Plumb through the "supportsFullScreen" preference.
+        https://bugs.webkit.org/show_bug.cgi?id=55261
+
+        The "supportsFullScreen" preference needs to be plumbed through from
+        the UIProcess to the WebProcess.
+
+        * Shared/WebPreferencesStore.h: Add a new macro entry.
+        * UIProcess/API/C/WKPreferences.cpp: Implement preferences getter and setter.
+        (WKPreferencesSetFullScreenEnabled):
+        (WKPreferencesGetFullScreenEnabled):
+        * UIProcess/API/C/WKPreferences.h:
+        * WebProcess/WebPage/WebPage.cpp:
+        (WebKit::WebPage::updatePreferences): Sync the fullScreenEnabled setting through to
+            the settings object.
+
+2011-03-08  Jeff Miller  <jeffm@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        WebKit2: Implement Windows glue for Undo/Redo
+        https://bugs.webkit.org/show_bug.cgi?id=55961
+        
+        Expose Undo/Redo infrastructure through WKView on Windows by
+        adding an undo client as well as APIs to reapply and unapply
+        an edit command.
+
+        * UIProcess/API/C/win/WKView.cpp:
+        (WKViewSetViewUndoClient): Added.
+        (WKViewReapplyEditCommand): Added.
+        (WKViewUnapplyEditCommand): Added.
+        * UIProcess/API/C/win/WKView.h: Added WKViewUndoClient, WKViewSetViewUndoClient(), and WKViewUnapplyEditCommand().
+        * UIProcess/WebPageProxy.cpp:
+        (WebKit::WebPageProxy::isValidEditCommand): Added, used to validated an edit command from a WKView API.
+        * UIProcess/WebPageProxy.h: Added isValidEditCommand().
+        * UIProcess/win/WebUndoClient.cpp: Added, APIClient for WKViewUndoClient. 
+        (WebKit::WebUndoClient::registerEditCommand): Added.
+        (WebKit::WebUndoClient::clearAllEditCommands): Added.
+        * UIProcess/win/WebUndoClient.h: Added, APIClient for WKViewUndoClient.
+        * UIProcess/win/WebView.cpp:
+        (WebKit::WebView::initializeUndoClient): Added.
+        (WebKit::WebView::close): Clear out undo client.
+        (WebKit::WebView::registerEditCommand): Implemented to call through to WKViewUndoClient.
+        (WebKit::WebView::clearAllEditCommands): Implmented to call through to WKViewUndoClient.
+        (WebKit::WebView::reapplyEditCommand): Added.
+        (WebKit::WebView::unapplyEditCommand): Added.
+        * UIProcess/win/WebView.h: Added undo client support.
+        * win/WebKit2.vcproj: Added WebUndoClient.cpp and WebUndoClient.h.
+
+2011-03-08  Jeff Miller  <jeffm@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        WebKit2: Expose WebEditCommandProxy in the C API on Windows
+        https://bugs.webkit.org/show_bug.cgi?id=55962
+        
+        Make WebEditCommandProxy a subclass of APIObject, and define
+        WKEditCommandRef as the type that will be exposed through the C API.
+
+        * Shared/API/c/win/WKBaseWin.h: Add WKEditCommandRef.
+        * Shared/APIObject.h: Add platform-specific TypeEditCommandProxy.
+        * UIProcess/API/C/win/WKAPICastWin.h: Add API mapping for WKEditCommandRef.
+        * UIProcess/WebEditCommandProxy.h: Subclass WebEditCommandProxy from APIObject.
+        (WebKit::WebEditCommandProxy::type): Added.
+
+2011-03-08  Jeff Miller  <jeffm@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        WebKit2: Redo is broken
+        https://bugs.webkit.org/show_bug.cgi?id=55978
+        
+        WebEditCommandProxy::unapply() and WebEditCommandProxy::reapply() were registering the wrong edit command when an undo or redo happens.
+        For example, when we unapply(), we should register a Redo command, not an Undo command.
+
+        * UIProcess/WebEditCommandProxy.cpp:
+        (WebKit::WebEditCommandProxy::unapply): Register a Redo command, not an Undo command.
+        (WebKit::WebEditCommandProxy::reapply): Register an Undo command, not a Redo command.
+
+2011-03-08  Brent Fulgham  <bfulgham@webkit.org>
+
+        Reviewed by Adam Roben.
+
+        https://bugs.webkit.org/show_bug.cgi?id=55977
+        Refine CF/CFNet distinctions for better code sharing.
+        1. Rename Downloads/cf/win/DownloadCFNetWin.cpp to DownloadCFWin.cpp
+           since it does not use any CFNETWORK features.
+        2. Create new cfnet directory.
+        3. Move Downloads/cf/DownloadCFNet.cpp to Downloads/cfnet
+        4. Update project file.
+
+        * WebProcess/Downloads/cf/DownloadCFNet.cpp: Removed.
+        * WebProcess/Downloads/cf/win/DownloadCFNetWin.cpp: Removed.
+        * WebProcess/Downloads/cf/win/DownloadCFWin.cpp: Copied from WebProcess/Downloads/cf/win/DownloadCFNetWin.cpp.
+        * WebProcess/Downloads/cfnet: Added.
+        * WebProcess/Downloads/cfnet/DownloadCFNet.cpp: Copied from WebProcess/Downloads/cf/DownloadCFNet.cpp.
+        * win/WebKit2.vcproj:
+
+2011-03-08  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Brady Eidson.
+
+        <http://webkit.org/b/55976> Provisional URL should be loaded when restoring session state even if there are back / forward list entries.
+
+        * UIProcess/cf/WebPageProxyCF.cpp:
+        (WebKit::WebPageProxy::restoreFromSessionStateData): If there's a provisional URL that we will load then restore the session state
+        without navigating to the current item.
+        * WebProcess/WebPage/WebPage.messages.in: Expose the ability to restore the session state without navigating to the current item.
+
+2011-03-08  Brent Fulgham  <bfulgham@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=55956
+        WebKit2 Changes to correct WinCairo port build
+
+        * Shared/LayerTreeContext.h: Don't exclude CoreIPC declarations for non-accelerated
+          compositing case.
+        * UIProcess/DrawingAreaProxy.h: Add "stdint.h" include needed for Cairo build.
+        * UIProcess/DrawingAreaProxyImpl.cpp: Exclude accelerated compositing code for
+          WinCairo build.
+        (WebKit::DrawingAreaProxyImpl::~DrawingAreaProxyImpl):
+        (WebKit::DrawingAreaProxyImpl::didUpdateBackingStoreState):
+        (WebKit::DrawingAreaProxyImpl::enterAcceleratedCompositingMode):
+        (WebKit::DrawingAreaProxyImpl::exitAcceleratedCompositingMode):
+        (WebKit::DrawingAreaProxyImpl::sendUpdateBackingStoreState):
+        (WebKit::DrawingAreaProxyImpl::waitForAndDispatchDidUpdateBackingStoreState):
+        * UIProcess/DrawingAreaProxyImpl.h: Exclude declarations for code only used when
+          accelerated compositing is enabled.
+        (WebKit::DrawingAreaProxyImpl::isInAcceleratedCompositingMode):
+        * UIProcess/win/WebView.cpp: Protect CG-specific drawing code.
+        (WebKit::WebView::setFindIndicator):
+        * WebProcess/Downloads/Download.h: Allow CFLite implentation to share overwrite flag,
+          as well as destination and bundle paths.
+        * WebProcess/Downloads/curl/DownloadCurl.cpp: Remove stub (to share CFNet implementation
+          of file handling.  This will be moved to a common area in a future patch.)
+        * WebProcess/WebPage/DrawingAreaImpl.cpp: Exclude accelerated-compositing paths.
+        (WebKit::DrawingAreaImpl::layerHostDidFlushLayers):
+        (WebKit::DrawingAreaImpl::sendDidUpdateBackingStoreState):
+        (WebKit::DrawingAreaImpl::exitAcceleratedCompositingMode):
+        * WebProcess/WebPage/WebPage.cpp: Protect CG-specific drawing code.
+        (WebKit::WebPage::drawRectToPDF):
+        (WebKit::WebPage::drawPagesToPDF):
+        * win/WebKit2.vcproj: Exclude unused LayerTreeContext from WinCairo
+
+2011-03-08  Ivan Krstić  <ike@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Re-fix: can't paste from 3rd party text editor into WebKit2 window
+        <rdar://problem/8978624>
+
+        * WebProcess/com.apple.WebProcess.sb:
+
+2011-03-08  Martin Robinson  <mrobinson@igalia.com>
+
+        Fix the WebKit2 compilation after r80578.
+
+        * UIProcess/gtk/WebView.cpp:
+        (WebKit::WebView::setFocus): Added.
+        * UIProcess/gtk/WebView.h:
+
+2011-03-08  Jessie Berlin  <jberlin@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        Crash in CFNetwork visiting google.com
+        https://bugs.webkit.org/show_bug.cgi?id=55958
+
+        * Shared/API/c/cf/WKURLResponseCF.cpp:
+        (WKURLResponseCopyCFURLResponse):
+        If the response to copy is null, return 0;
+
+2011-03-08  John Sullivan  <sullivan@apple.com>
+
+        Reverted the patch for https://bugs.webkit.org/show_bug.cgi?id=55940
+        
+        The patch was insufficient, and it wasn't useful for the intended client use either.
+
+        * WebProcess/InjectedBundle/API/c/WKBundlePage.h:
+        * WebProcess/WebCoreSupport/WebFrameLoaderClient.cpp:
+        (WebKit::WebFrameLoaderClient::dispatchDecidePolicyForNavigationAction):
+
+2011-03-08  Alejandro G. Castro  <alex@igalia.com>
+
+        Unreviewed, fixed GTK+ compilation after r80569.
+
+        * UIProcess/gtk/WebView.cpp:
+        (WebKit::WebView::windowToScreen):
+        * UIProcess/gtk/WebView.h:
+
+2011-03-08  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        WK2: Cannot set focus on an element when focus is outside of WKView
+        https://bugs.webkit.org/show_bug.cgi?id=55281
+
+        * UIProcess/API/mac/PageClientImpl.h:
+        * UIProcess/API/mac/PageClientImpl.mm:
+        (WebKit::PageClientImpl::setFocus):
+        * UIProcess/API/qt/qwkpage_p.h:
+        (QWKPagePrivate::setFocus):
+        * UIProcess/PageClient.h:
+        * UIProcess/WebPageProxy.cpp:
+        (WebKit::WebPageProxy::setFocus):
+        * UIProcess/WebPageProxy.h:
+        * UIProcess/WebPageProxy.messages.in:
+        * UIProcess/win/WebView.h:
+        (WebKit::WebView::setFocus):
+        * WebProcess/WebCoreSupport/WebChromeClient.cpp:
+        (WebKit::WebChromeClient::focus):
+        (WebKit::WebChromeClient::unfocus):
+
+2011-03-08  Jeff Miller  <jeffm@apple.com>
+
+        Unreviewed, fix last change so WKBaseWin.h is in alphabetical order in the project XML.
+
+        * win/WebKit2.vcproj: Move WKBaseWin.h to be in alphabetical order.
+
+2011-03-08  Jeff Miller  <jeffm@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Remove Source/WebKit2/UIProcess/API/C/win/WKBaseWin.h
+        https://bugs.webkit.org/show_bug.cgi?id=55952
+
+        * UIProcess/API/C/win/WKBaseWin.h: Removed.
+        * win/WebKit2.vcproj: Refer to the Shared version of WKBaseWin.h instead of the one in UIProcess.
+
+2011-03-08  Alejandro G. Castro  <alex@igalia.com>
+
+        Reviewed by Martin Robinson.
+
+        [GTK] Add new files to compilation after r77974
+        https://bugs.webkit.org/show_bug.cgi?id=54076
+
+        The commit added new code to allow passing context to policy
+        delegate methods, we also added dummy ResourceRequest and
+        ResourceResponse decoders until we implement them.
+
+        * GNUmakefile.am:
+        * Shared/gtk/WebCoreArgumentCodersGtk.cpp:
+        (CoreIPC::decodeResourceRequest):
+        (CoreIPC::decodeResourceResponse):
+
+2011-03-08  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        AX: Webkit2 not sending UAZoomFocusChanged notifications
+        https://bugs.webkit.org/show_bug.cgi?id=55916
+
+        Needed to implement the windowToScreen() method so that the right frame
+        could be calculated to send for zoom focus changes.
+
+        * UIProcess/API/mac/PageClientImpl.h:
+        * UIProcess/API/mac/PageClientImpl.mm:
+        (WebKit::PageClientImpl::windowToScreen):
+        * UIProcess/API/qt/qwkpage.cpp:
+        (QWKPagePrivate::windowToScreen):
+        * UIProcess/API/qt/qwkpage_p.h:
+        * UIProcess/PageClient.h:
+        * UIProcess/WebPageProxy.cpp:
+        (WebKit::WebPageProxy::windowToScreen):
+        * UIProcess/WebPageProxy.h:
+        * UIProcess/WebPageProxy.messages.in:
+        * UIProcess/win/WebView.cpp:
+        (WebKit::WebView::windowToScreen):
+        * UIProcess/win/WebView.h:
+        * WebProcess/WebCoreSupport/WebChromeClient.cpp:
+        (WebKit::WebChromeClient::windowToScreen):
+        * WebProcess/WebPage/WebPage.cpp:
+        (WebKit::WebPage::windowToScreen):
+        * WebProcess/WebPage/WebPage.h:
+
+2011-03-08  John Sullivan  <sullivan@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=55940
+        WebKit2 should support Ignore policy from injected bundle client
+
+        * WebProcess/InjectedBundle/API/c/WKBundlePage.h:
+        Added WKBundlePagePolicyActionIgnore.
+        
+        * WebProcess/WebCoreSupport/WebFrameLoaderClient.cpp:
+        (WebKit::WebFrameLoaderClient::dispatchDecidePolicyForNavigationAction):
+        If the injected bundle client returns WKBundlePagePolicyActionIgnore, convert it
+        to the loader's PolicyIgnore.
+
+2011-03-08  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] [Symbian] [WK2] Fix building WebKit 2 API tests
+        https://bugs.webkit.org/show_bug.cgi?id=55876
+
+        Make sure TESTS_SOURCE_DIR is set for Symbian the same way
+        as it is for WK1.
+
+        * UIProcess/API/qt/tests/qgraphicswkview/tst_qgraphicswkview.cpp:
+        (tst_QGraphicsWKView::loadEmptyPage):
+        * UIProcess/API/qt/tests/tests.pri:
+
 2011-03-07  Damian Kaleta  <dkaleta@apple.com>
 
         Reviewed by Anders Carlsson.
diff --git a/Source/WebKit2/Configurations/Base.xcconfig b/Source/WebKit2/Configurations/Base.xcconfig
index 6f06a69..8018769 100644
--- a/Source/WebKit2/Configurations/Base.xcconfig
+++ b/Source/WebKit2/Configurations/Base.xcconfig
@@ -25,7 +25,6 @@ DEBUG_INFORMATION_FORMAT = dwarf;
 GCC_C_LANGUAGE_STANDARD = gnu99;
 GCC_DEBUGGING_SYMBOLS = default;
 GCC_DYNAMIC_NO_PIC = NO;
-GCC_ENABLE_CPP_EXCEPTIONS = NO;
 GCC_ENABLE_CPP_RTTI = NO;
 GCC_ENABLE_OBJC_EXCEPTIONS = YES;
 GCC_ENABLE_OBJC_GC = supported;
@@ -95,12 +94,23 @@ TARGET_GCC_VERSION_1050_ = $(TARGET_GCC_VERSION_1050_$(XCODE_VERSION_ACTUAL));
 TARGET_GCC_VERSION_1050_0310 = GCC_42;
 TARGET_GCC_VERSION_1050_0320 = GCC_42;
 TARGET_GCC_VERSION_1060 = GCC_42;
-TARGET_GCC_VERSION_1070 = LLVM_GCC_42;
+TARGET_GCC_VERSION_1070 = $(TARGET_GCC_VERSION_1070_$(CONFIGURATION));
+TARGET_GCC_VERSION_1070_Debug = LLVM_COMPILER;
+TARGET_GCC_VERSION_1070_Release = LLVM_GCC_42;
+TARGET_GCC_VERSION_1070_Production = LLVM_GCC_42;
 
 GCC_VERSION = $(GCC_VERSION_$(TARGET_GCC_VERSION));
 GCC_VERSION_GCC_40 = 4.0;
 GCC_VERSION_GCC_42 = 4.2;
 GCC_VERSION_LLVM_GCC_42 = com.apple.compilers.llvmgcc42;
+GCC_VERSION_LLVM_COMPILER = com.apple.compilers.llvm.clang.1_0;
+
+// FIXME: Disable C++ exceptions in the LLVM Compiler once it supports enabling Obj-C exceptions without C++ exceptions.
+GCC_ENABLE_CPP_EXCEPTIONS = $(GCC_ENABLE_CPP_EXCEPTIONS_$(TARGET_GCC_VERSION));
+GCC_ENABLE_CPP_EXCEPTIONS_GCC_40 = NO;
+GCC_ENABLE_CPP_EXCEPTIONS_GCC_42 = NO;
+GCC_ENABLE_CPP_EXCEPTIONS_LLVM_GCC = NO;
+GCC_ENABLE_CPP_EXCEPTIONS_LLVM_COMPILER = YES;
 
 // If the target Mac OS X version does not match the current Mac OS X version then we'll want to build using the target version's SDK.
 SDKROOT = $(SDKROOT_$(MAC_OS_X_VERSION_MAJOR)_$(TARGET_MAC_OS_X_VERSION_MAJOR));
diff --git a/Source/WebKit2/Configurations/PluginProcess.xcconfig b/Source/WebKit2/Configurations/PluginProcess.xcconfig
new file mode 100644
index 0000000..14d29fd
--- /dev/null
+++ b/Source/WebKit2/Configurations/PluginProcess.xcconfig
@@ -0,0 +1,29 @@
+// Copyright (C) 2010, 2011 Apple Inc. All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions
+// are met:
+// 1. Redistributions of source code must retain the above copyright
+//    notice, this list of conditions and the following disclaimer.
+// 2. Redistributions in binary form must reproduce the above copyright
+//    notice, this list of conditions and the following disclaimer in the
+//    documentation and/or other materials provided with the distribution.
+//
+// THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+// EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+// IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+// PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+// CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+// EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+// PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+// PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+// OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+
+#include "BaseTarget.xcconfig"
+
+GCC_ENABLE_OBJC_GC = NO;
+PRODUCT_NAME = PluginProcess;
+INFOPLIST_FILE = PluginProcess/Info.plist;
+INSTALL_PATH = $(SYSTEM_LIBRARY_DIR)/PrivateFrameworks/WebKit2.framework;
diff --git a/Source/WebKit2/Configurations/PluginProcessShim.xcconfig b/Source/WebKit2/Configurations/PluginProcessShim.xcconfig
index a607b72..272e2d4 100644
--- a/Source/WebKit2/Configurations/PluginProcessShim.xcconfig
+++ b/Source/WebKit2/Configurations/PluginProcessShim.xcconfig
@@ -21,8 +21,10 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 
-#include "Version.xcconfig"
+#include "BaseTarget.xcconfig"
 
 GCC_DYNAMIC_NO_PIC = NO;
+HEADER_SEARCH_PATHS = $(BUILT_PRODUCTS_DIR)/usr/local/include;
 PRODUCT_NAME = PluginProcessShim;
 SKIP_INSTALL = YES;
+
diff --git a/Source/WebKit2/Configurations/Version.xcconfig b/Source/WebKit2/Configurations/Version.xcconfig
index 3095c3b..e3bfad7 100644
--- a/Source/WebKit2/Configurations/Version.xcconfig
+++ b/Source/WebKit2/Configurations/Version.xcconfig
@@ -22,7 +22,7 @@
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 
 MAJOR_VERSION = 534;
-MINOR_VERSION = 24;
+MINOR_VERSION = 27;
 TINY_VERSION = 0;
 FULL_VERSION = $(MAJOR_VERSION).$(MINOR_VERSION);
 
diff --git a/Source/WebKit2/DerivedSources.make b/Source/WebKit2/DerivedSources.make
index 40a9b7a..6f30dd4 100644
--- a/Source/WebKit2/DerivedSources.make
+++ b/Source/WebKit2/DerivedSources.make
@@ -26,8 +26,11 @@ VPATH = \
     $(WebKit2)/WebProcess/ApplicationCache \
     $(WebKit2)/WebProcess/Authentication \
     $(WebKit2)/WebProcess/Cookies \
+    $(WebKit2)/WebProcess/FullScreen \
     $(WebKit2)/WebProcess/Geolocation \
+    $(WebKit2)/WebProcess/IconDatabase \
     $(WebKit2)/WebProcess/KeyValueStorage \
+    $(WebKit2)/WebProcess/MediaCache \
     $(WebKit2)/WebProcess/Plugins \
     $(WebKit2)/WebProcess/ResourceCache \
     $(WebKit2)/WebProcess/WebCoreSupport \
@@ -55,12 +58,18 @@ MESSAGE_RECEIVERS = \
     WebContext \
     WebDatabaseManager \
     WebDatabaseManagerProxy \
+    WebFullScreenManager \
+    WebFullScreenManagerProxy \
     WebGeolocationManager \
     WebGeolocationManagerProxy \
+    WebIconDatabase \
+    WebIconDatabaseProxy \
     WebInspector \
     WebInspectorProxy \
     WebKeyValueStorageManager \
     WebKeyValueStorageManagerProxy \
+    WebMediaCacheManager \
+    WebMediaCacheManagerProxy \
     WebPage \
     WebPageProxy \
     WebProcess \
diff --git a/Source/WebKit2/DerivedSources.pro b/Source/WebKit2/DerivedSources.pro
index 3af0549..71b5872 100644
--- a/Source/WebKit2/DerivedSources.pro
+++ b/Source/WebKit2/DerivedSources.pro
@@ -78,8 +78,11 @@ VPATH = \
     WebProcess/ApplicationCache \
     WebProcess/Authentication \
     WebProcess/Cookies \
+    WebProcess/FullScreen \
     WebProcess/Geolocation \
+    WebProcess/IconDatabase \
     WebProcess/KeyValueStorage \
+    WebProcess/MediaCache \
     WebProcess/Plugins \
     WebProcess/ResourceCache \
     WebProcess/WebCoreSupport \
@@ -106,9 +109,15 @@ MESSAGE_RECEIVERS = \
     WebDatabaseManagerProxy.messages.in \
     WebGeolocationManager.messages.in \
     WebGeolocationManagerProxy.messages.in \
+    WebIconDatabase.messages.in \
+    WebIconDatabaseProxy.messages.in \
     WebInspectorProxy.messages.in \
     WebKeyValueStorageManager.messages.in \
     WebKeyValueStorageManagerProxy.messages.in \
+    WebMediaCacheManager.messages.in \
+    WebMediaCacheManagerProxy.messages.in \
+    WebFullScreenManager.messages.in \
+    WebFullScreenManagerProxy.messages.in \
     WebPage/WebInspector.messages.in \
     WebPage/WebPage.messages.in \
     WebPageProxy.messages.in \
diff --git a/Source/WebKit2/GNUmakefile.am b/Source/WebKit2/GNUmakefile.am
index 597d29a..837165d 100644
--- a/Source/WebKit2/GNUmakefile.am
+++ b/Source/WebKit2/GNUmakefile.am
@@ -55,6 +55,7 @@ libWebKit2_la_HEADERS = \
 	$(WebKit2)/UIProcess/API/C/WKFramePolicyListener.h \
 	$(WebKit2)/UIProcess/API/C/WKInspector.h \
 	$(WebKit2)/UIProcess/API/C/WKKeyValueStorageManager.h \
+	$(WebKit2)/UIProcess/API/C/WKMediaCacheManager.h \
 	$(WebKit2)/UIProcess/API/C/WKNativeEvent.h \
 	$(WebKit2)/UIProcess/API/C/WKNavigationData.h \
 	$(WebKit2)/UIProcess/API/C/WKOpenPanelParameters.h \
@@ -320,10 +321,14 @@ libWebKit2_la_SOURCES = \
 	Source/WebKit2/UIProcess/API/C/WKFrame.h \
 	Source/WebKit2/UIProcess/API/C/WKFramePolicyListener.cpp \
 	Source/WebKit2/UIProcess/API/C/WKFramePolicyListener.h \
+	Source/WebKit2/UIProcess/API/C/WKIconDatabase.cpp \
+	Source/WebKit2/UIProcess/API/C/WKIconDatabase.h \
 	Source/WebKit2/UIProcess/API/C/WKInspector.cpp \
 	Source/WebKit2/UIProcess/API/C/WKInspector.h \
 	Source/WebKit2/UIProcess/API/C/WKKeyValueStorageManager.cpp \
 	Source/WebKit2/UIProcess/API/C/WKKeyValueStorageManager.h \
+	Source/WebKit2/UIProcess/API/C/WKMediaCacheManager.cpp \
+	Source/WebKit2/UIProcess/API/C/WKMediaCacheManager.h \
 	Source/WebKit2/UIProcess/API/C/WKNativeEvent.h \
 	Source/WebKit2/UIProcess/API/C/WKNavigationData.cpp \
 	Source/WebKit2/UIProcess/API/C/WKNavigationData.h \
@@ -371,6 +376,7 @@ libWebKit2_la_SOURCES = \
 	Source/WebKit2/UIProcess/gtk/ChunkedUpdateDrawingAreaProxyGtk.cpp \
 	Source/WebKit2/UIProcess/gtk/TextCheckerGtk.cpp \
 	Source/WebKit2/UIProcess/gtk/WebContextGtk.cpp \
+	Source/WebKit2/UIProcess/gtk/WebFullScreenManagerProxyGtk.cpp \
 	Source/WebKit2/UIProcess/gtk/WebInspectorGtk.cpp \
 	Source/WebKit2/UIProcess/gtk/WebViewWidget.cpp \
 	Source/WebKit2/UIProcess/gtk/WebViewWidget.h \
@@ -438,16 +444,22 @@ libWebKit2_la_SOURCES = \
 	Source/WebKit2/UIProcess/WebFramePolicyListenerProxy.h \
 	Source/WebKit2/UIProcess/WebFrameProxy.cpp \
 	Source/WebKit2/UIProcess/WebFrameProxy.h \
+	Source/WebKit2/UIProcess/WebFullScreenManagerProxy.cpp \
+	Source/WebKit2/UIProcess/WebFullScreenManagerProxy.h \
 	Source/WebKit2/UIProcess/WebGeolocationManagerProxy.cpp \
 	Source/WebKit2/UIProcess/WebGeolocationManagerProxy.h \
 	Source/WebKit2/UIProcess/WebGeolocationProvider.cpp \
 	Source/WebKit2/UIProcess/WebGeolocationProvider.h \
 	Source/WebKit2/UIProcess/WebHistoryClient.cpp \
 	Source/WebKit2/UIProcess/WebHistoryClient.h \
+	Source/WebKit2/UIProcess/WebIconDatabase.cpp \
+	Source/WebKit2/UIProcess/WebIconDatabase.h \
 	Source/WebKit2/UIProcess/WebInspectorProxy.cpp \
 	Source/WebKit2/UIProcess/WebInspectorProxy.h \
 	Source/WebKit2/UIProcess/WebKeyValueStorageManagerProxy.cpp \
 	Source/WebKit2/UIProcess/WebKeyValueStorageManagerProxy.h \
+	Source/WebKit2/UIProcess/WebMediaCacheManagerProxy.cpp \
+	Source/WebKit2/UIProcess/WebMediaCacheManagerProxy.h \
 	Source/WebKit2/UIProcess/WebLoaderClient.cpp \
 	Source/WebKit2/UIProcess/WebLoaderClient.h \
 	Source/WebKit2/UIProcess/WebNavigationData.cpp \
@@ -479,11 +491,16 @@ libWebKit2_la_SOURCES = \
 	Source/WebKit2/WebProcess/Authentication/AuthenticationManager.h \
 	Source/WebKit2/WebProcess/Cookies/WebCookieManager.h \
 	Source/WebKit2/WebProcess/Cookies/WebCookieManager.cpp \
-	Source/WebKit2/WebProcess/Downloads/curl/DownloadCurl.cpp \
+	Source/WebKit2/WebProcess/Cookies/gtk/WebCookieManagerGtk.cpp \
 	Source/WebKit2/WebProcess/Downloads/Download.cpp \
 	Source/WebKit2/WebProcess/Downloads/Download.h \
 	Source/WebKit2/WebProcess/Downloads/DownloadManager.cpp \
 	Source/WebKit2/WebProcess/Downloads/DownloadManager.h \
+	Source/WebKit2/WebProcess/Downloads/soup/DownloadSoup.cpp \
+	Source/WebKit2/WebProcess/FullScreen/WebFullScreenManager.cpp \
+	Source/WebKit2/WebProcess/FullScreen/WebFullScreenManager.h \
+	Source/WebKit2/WebProcess/FullScreen/gtk/WebFullScreenManagerGtk.cpp \
+	Source/WebKit2/WebProcess/FullScreen/gtk/WebFullScreenManagerGtk.h \
 	Source/WebKit2/WebProcess/Geolocation/GeolocationPermissionRequestManager.cpp \
 	Source/WebKit2/WebProcess/Geolocation/GeolocationPermissionRequestManager.h \
 	Source/WebKit2/WebProcess/Geolocation/WebGeolocationManager.cpp \
@@ -491,6 +508,8 @@ libWebKit2_la_SOURCES = \
 	Source/WebKit2/WebProcess/gtk/WebProcessGtk.cpp \
 	Source/WebKit2/WebProcess/gtk/WebProcessMainGtk.cpp \
 	Source/WebKit2/WebProcess/gtk/WebProcessMainGtk.h \
+	Source/WebKit2/WebProcess/IconDatabase/WebIconDatabaseProxy.cpp \
+	Source/WebKit2/WebProcess/IconDatabase/WebIconDatabaseProxy.h \
 	Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundleAPICast.h \
 	Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundleBackForwardList.cpp \
 	Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundleBackForwardList.h \
@@ -503,6 +522,8 @@ libWebKit2_la_SOURCES = \
 	Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundle.h \
 	Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundleHitTestResult.cpp \
 	Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundleHitTestResult.h \
+	Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundleNavigationAction.h \
+	Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundleNavigationAction.cpp \
 	Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundleInitialize.h \
 	Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundleInspector.cpp \
 	Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundleInspector.h \
@@ -526,16 +547,18 @@ libWebKit2_la_SOURCES = \
 	Source/WebKit2/WebProcess/InjectedBundle/DOM/InjectedBundleRangeHandle.cpp \
 	Source/WebKit2/WebProcess/InjectedBundle/DOM/InjectedBundleRangeHandle.h \
 	Source/WebKit2/WebProcess/InjectedBundle/gtk/InjectedBundleGtk.cpp \
+	Source/WebKit2/WebProcess/InjectedBundle/InjectedBundle.cpp \
+	Source/WebKit2/WebProcess/InjectedBundle/InjectedBundle.h \
 	Source/WebKit2/WebProcess/InjectedBundle/InjectedBundleBackForwardList.cpp \
 	Source/WebKit2/WebProcess/InjectedBundle/InjectedBundleBackForwardList.h \
 	Source/WebKit2/WebProcess/InjectedBundle/InjectedBundleBackForwardListItem.cpp \
 	Source/WebKit2/WebProcess/InjectedBundle/InjectedBundleBackForwardListItem.h \
 	Source/WebKit2/WebProcess/InjectedBundle/InjectedBundleClient.cpp \
 	Source/WebKit2/WebProcess/InjectedBundle/InjectedBundleClient.h \
-	Source/WebKit2/WebProcess/InjectedBundle/InjectedBundle.cpp \
-	Source/WebKit2/WebProcess/InjectedBundle/InjectedBundle.h \
 	Source/WebKit2/WebProcess/InjectedBundle/InjectedBundleHitTestResult.cpp \
 	Source/WebKit2/WebProcess/InjectedBundle/InjectedBundleHitTestResult.h \
+	Source/WebKit2/WebProcess/InjectedBundle/InjectedBundleNavigationAction.cpp \
+	Source/WebKit2/WebProcess/InjectedBundle/InjectedBundleNavigationAction.h \
 	Source/WebKit2/WebProcess/InjectedBundle/InjectedBundlePageContextMenuClient.cpp \
 	Source/WebKit2/WebProcess/InjectedBundle/InjectedBundlePageContextMenuClient.h \
 	Source/WebKit2/WebProcess/InjectedBundle/InjectedBundlePageEditorClient.cpp \
@@ -544,6 +567,8 @@ libWebKit2_la_SOURCES = \
 	Source/WebKit2/WebProcess/InjectedBundle/InjectedBundlePageFormClient.h \
 	Source/WebKit2/WebProcess/InjectedBundle/InjectedBundlePageLoaderClient.cpp \
 	Source/WebKit2/WebProcess/InjectedBundle/InjectedBundlePageLoaderClient.h \
+	Source/WebKit2/WebProcess/InjectedBundle/InjectedBundlePagePolicyClient.cpp \
+	Source/WebKit2/WebProcess/InjectedBundle/InjectedBundlePagePolicyClient.h \
 	Source/WebKit2/WebProcess/InjectedBundle/InjectedBundlePageResourceLoadClient.cpp \
 	Source/WebKit2/WebProcess/InjectedBundle/InjectedBundlePageResourceLoadClient.h \
 	Source/WebKit2/WebProcess/InjectedBundle/InjectedBundlePageUIClient.cpp \
@@ -553,7 +578,8 @@ libWebKit2_la_SOURCES = \
 	Source/WebKit2/WebProcess/InjectedBundle/InjectedBundleUserMessageCoders.h \
 	Source/WebKit2/WebProcess/KeyValueStorage/WebKeyValueStorageManager.cpp \
 	Source/WebKit2/WebProcess/KeyValueStorage/WebKeyValueStorageManager.h \
-	Source/WebKit2/WebProcess/Plugins/Netscape/gtk/NetscapePluginGtk.cpp \
+	Source/WebKit2/WebProcess/MediaCache/WebMediaCacheManager.cpp \
+	Source/WebKit2/WebProcess/MediaCache/WebMediaCacheManager.h \
 	Source/WebKit2/WebProcess/Plugins/Netscape/JSNPMethod.cpp \
 	Source/WebKit2/WebProcess/Plugins/Netscape/JSNPMethod.h \
 	Source/WebKit2/WebProcess/Plugins/Netscape/JSNPObject.cpp \
@@ -570,6 +596,7 @@ libWebKit2_la_SOURCES = \
 	Source/WebKit2/WebProcess/Plugins/Netscape/NPRuntimeObjectMap.h \
 	Source/WebKit2/WebProcess/Plugins/Netscape/NPRuntimeUtilities.cpp \
 	Source/WebKit2/WebProcess/Plugins/Netscape/NPRuntimeUtilities.h \
+	Source/WebKit2/WebProcess/Plugins/Netscape/x11/NetscapePluginX11.cpp \
 	Source/WebKit2/WebProcess/Plugins/PluginController.h \
 	Source/WebKit2/WebProcess/Plugins/Plugin.cpp \
 	Source/WebKit2/WebProcess/Plugins/Plugin.h \
@@ -685,8 +712,10 @@ libWebKit2_la_CPPFLAGS = \
 	-I$(srcdir)/Source/WebKit2/WebProcess/Authentication \
 	-I$(srcdir)/Source/WebKit2/WebProcess/Cookies \
 	-I$(srcdir)/Source/WebKit2/WebProcess/Downloads \
+	-I$(srcdir)/Source/WebKit2/WebProcess/FullScreen \
 	-I$(srcdir)/Source/WebKit2/WebProcess/Geolocation \
 	-I$(srcdir)/Source/WebKit2/WebProcess/gtk \
+	-I$(srcdir)/Source/WebKit2/WebProcess/IconDatabase \
 	-I$(srcdir)/Source/WebKit2/WebProcess/InjectedBundle \
 	-I$(srcdir)/Source/WebKit2/WebProcess/InjectedBundle/API \
 	-I$(srcdir)/Source/WebKit2/WebProcess/InjectedBundle/API/c \
@@ -694,6 +723,7 @@ libWebKit2_la_CPPFLAGS = \
 	-I$(srcdir)/Source/WebKit2/WebProcess/InjectedBundle/gtk \
 	-I$(srcdir)/Source/WebKit2/WebProcess/KeyValueStorage \
 	-I$(srcdir)/Source/WebKit2/WebProcess/Launching \
+	-I$(srcdir)/Source/WebKit2/WebProcess/MediaCache \
 	-I$(srcdir)/Source/WebKit2/WebProcess/ResourceCache \
 	-I$(srcdir)/Source/WebKit2/WebProcess/Plugins \
 	-I$(srcdir)/Source/WebKit2/WebProcess/Plugins/Netscape \
@@ -848,10 +878,18 @@ webkit2_built_sources += \
 	DerivedSources/WebKit2/WebDatabaseManagerMessages.h \
 	DerivedSources/WebKit2/WebDatabaseManagerProxyMessageReceiver.cpp \
 	DerivedSources/WebKit2/WebDatabaseManagerProxyMessages.h \
+	DerivedSources/WebKit2/WebFullScreenManagerMessageReceiver.cpp \
+	DerivedSources/WebKit2/WebFullScreenManagerMessages.h \
+	DerivedSources/WebKit2/WebFullScreenManagerProxyMessageReceiver.cpp \
+	DerivedSources/WebKit2/WebFullScreenManagerProxyMessages.h \
 	DerivedSources/WebKit2/WebGeolocationManagerMessageReceiver.cpp \
 	DerivedSources/WebKit2/WebGeolocationManagerMessages.h \
 	DerivedSources/WebKit2/WebGeolocationManagerProxyMessageReceiver.cpp \
 	DerivedSources/WebKit2/WebGeolocationManagerProxyMessages.h \
+	DerivedSources/WebKit2/WebIconDatabaseMessageReceiver.cpp \
+	DerivedSources/WebKit2/WebIconDatabaseMessages.h \
+	DerivedSources/WebKit2/WebIconDatabaseProxyMessageReceiver.cpp \
+	DerivedSources/WebKit2/WebIconDatabaseProxyMessages.h \
 	DerivedSources/WebKit2/WebInspectorMessageReceiver.cpp \
 	DerivedSources/WebKit2/WebInspectorMessages.h \
 	DerivedSources/WebKit2/WebInspectorProxyMessageReceiver.cpp \
@@ -860,6 +898,10 @@ webkit2_built_sources += \
 	DerivedSources/WebKit2/WebKeyValueStorageManagerMessages.h \
 	DerivedSources/WebKit2/WebKeyValueStorageManagerProxyMessageReceiver.cpp \
 	DerivedSources/WebKit2/WebKeyValueStorageManagerProxyMessages.h \
+	DerivedSources/WebKit2/WebMediaCacheManagerMessageReceiver.cpp \
+	DerivedSources/WebKit2/WebMediaCacheManagerMessages.h \
+	DerivedSources/WebKit2/WebMediaCacheManagerProxyMessageReceiver.cpp \
+	DerivedSources/WebKit2/WebMediaCacheManagerProxyMessages.h \
 	DerivedSources/WebKit2/WebPageProxyMessageReceiver.cpp \
 	DerivedSources/WebKit2/WebPageProxyMessages.h \
 	DerivedSources/WebKit2/WebPageMessageReceiver.cpp \
@@ -897,8 +939,11 @@ vpath %.messages.in = \
 	$(WebKit2)/WebProcess/ApplicationCache \
 	$(WebKit2)/WebProcess/Authentication \
 	$(WebKit2)/WebProcess/Cookies \
+	$(WebKit2)/WebProcess/FullScreen \
 	$(WebKit2)/WebProcess/Geolocation \
+	$(WebKit2)/WebProcess/IconDatabase \
 	$(WebKit2)/WebProcess/KeyValueStorage \
+	$(WebKit2)/WebProcess/MediaCache \
 	$(WebKit2)/WebProcess/Plugins \
 	$(WebKit2)/WebProcess/ResourceCache \
 	$(WebKit2)/WebProcess/WebCoreSupport \
diff --git a/Source/WebKit2/Platform/CoreIPC/ArgumentDecoder.cpp b/Source/WebKit2/Platform/CoreIPC/ArgumentDecoder.cpp
index 4664806..44f9a9f 100644
--- a/Source/WebKit2/Platform/CoreIPC/ArgumentDecoder.cpp
+++ b/Source/WebKit2/Platform/CoreIPC/ArgumentDecoder.cpp
@@ -145,7 +145,7 @@ bool ArgumentDecoder::decodeBytes(uint8_t* buffer, size_t bufferSize)
 
 bool ArgumentDecoder::decodeBool(bool& result)
 {
-    if (!alignBufferPosition(__alignof(result), sizeof(result)))
+    if (!alignBufferPosition(sizeof(result), sizeof(result)))
         return false;
     
     result = *reinterpret_cast<bool*>(m_bufferPos);
@@ -155,7 +155,7 @@ bool ArgumentDecoder::decodeBool(bool& result)
 
 bool ArgumentDecoder::decodeUInt32(uint32_t& result)
 {
-    if (!alignBufferPosition(__alignof(result), sizeof(result)))
+    if (!alignBufferPosition(sizeof(result), sizeof(result)))
         return false;
     
     result = *reinterpret_cast<uint32_t*>(m_bufferPos);
@@ -165,7 +165,7 @@ bool ArgumentDecoder::decodeUInt32(uint32_t& result)
 
 bool ArgumentDecoder::decodeUInt64(uint64_t& result)
 {
-    if (!alignBufferPosition(__alignof(result), sizeof(result)))
+    if (!alignBufferPosition(sizeof(result), sizeof(result)))
         return false;
     
     result = *reinterpret_cast<uint64_t*>(m_bufferPos);
@@ -175,7 +175,7 @@ bool ArgumentDecoder::decodeUInt64(uint64_t& result)
 
 bool ArgumentDecoder::decodeInt32(int32_t& result)
 {
-    if (!alignBufferPosition(__alignof(result), sizeof(result)))
+    if (!alignBufferPosition(sizeof(result), sizeof(result)))
         return false;
     
     result = *reinterpret_cast<uint32_t*>(m_bufferPos);
@@ -185,7 +185,7 @@ bool ArgumentDecoder::decodeInt32(int32_t& result)
 
 bool ArgumentDecoder::decodeInt64(int64_t& result)
 {
-    if (!alignBufferPosition(__alignof(result), sizeof(result)))
+    if (!alignBufferPosition(sizeof(result), sizeof(result)))
         return false;
     
     result = *reinterpret_cast<uint64_t*>(m_bufferPos);
@@ -195,7 +195,7 @@ bool ArgumentDecoder::decodeInt64(int64_t& result)
 
 bool ArgumentDecoder::decodeFloat(float& result)
 {
-    if (!alignBufferPosition(__alignof(result), sizeof(result)))
+    if (!alignBufferPosition(sizeof(result), sizeof(result)))
         return false;
     
     result = *reinterpret_cast<float*>(m_bufferPos);
@@ -205,7 +205,7 @@ bool ArgumentDecoder::decodeFloat(float& result)
 
 bool ArgumentDecoder::decodeDouble(double& result)
 {
-    if (!alignBufferPosition(__alignof(result), sizeof(result)))
+    if (!alignBufferPosition(sizeof(result), sizeof(result)))
         return false;
     
     result = *reinterpret_cast<double*>(m_bufferPos);
diff --git a/Source/WebKit2/Platform/CoreIPC/ArgumentEncoder.cpp b/Source/WebKit2/Platform/CoreIPC/ArgumentEncoder.cpp
index aa71b0f..fb0b68b 100644
--- a/Source/WebKit2/Platform/CoreIPC/ArgumentEncoder.cpp
+++ b/Source/WebKit2/Platform/CoreIPC/ArgumentEncoder.cpp
@@ -97,49 +97,49 @@ void ArgumentEncoder::encodeBytes(const uint8_t* bytes, size_t size)
 
 void ArgumentEncoder::encodeBool(bool n)
 {
-    uint8_t* buffer = grow(__alignof(n), sizeof(n));
+    uint8_t* buffer = grow(sizeof(n), sizeof(n));
     
     *reinterpret_cast<bool*>(buffer) = n;
 }
 
 void ArgumentEncoder::encodeUInt32(uint32_t n)
 {
-    uint8_t* buffer = grow(__alignof(n), sizeof(n));
+    uint8_t* buffer = grow(sizeof(n), sizeof(n));
     
     *reinterpret_cast<uint32_t*>(buffer) = n;
 }
 
 void ArgumentEncoder::encodeUInt64(uint64_t n)
 {
-    uint8_t* buffer = grow(__alignof(n), sizeof(n));
+    uint8_t* buffer = grow(sizeof(n), sizeof(n));
     
     *reinterpret_cast<uint64_t*>(buffer) = n;
 }
 
 void ArgumentEncoder::encodeInt32(int32_t n)
 {
-    uint8_t* buffer = grow(__alignof(n), sizeof(n));
+    uint8_t* buffer = grow(sizeof(n), sizeof(n));
     
     *reinterpret_cast<int32_t*>(buffer) = n;
 }
 
 void ArgumentEncoder::encodeInt64(int64_t n)
 {
-    uint8_t* buffer = grow(__alignof(n), sizeof(n));
+    uint8_t* buffer = grow(sizeof(n), sizeof(n));
     
     *reinterpret_cast<int64_t*>(buffer) = n;
 }
 
 void ArgumentEncoder::encodeFloat(float n)
 {
-    uint8_t* buffer = grow(__alignof(n), sizeof(n));
+    uint8_t* buffer = grow(sizeof(n), sizeof(n));
 
     *reinterpret_cast<float*>(buffer) = n;
 }
 
 void ArgumentEncoder::encodeDouble(double n)
 {
-    uint8_t* buffer = grow(__alignof(n), sizeof(n));
+    uint8_t* buffer = grow(sizeof(n), sizeof(n));
 
     *reinterpret_cast<double*>(buffer) = n;
 }
diff --git a/Source/WebKit2/Platform/CoreIPC/Connection.cpp b/Source/WebKit2/Platform/CoreIPC/Connection.cpp
index 281ccb6..a65f065 100644
--- a/Source/WebKit2/Platform/CoreIPC/Connection.cpp
+++ b/Source/WebKit2/Platform/CoreIPC/Connection.cpp
@@ -36,14 +36,11 @@ using namespace std;
 
 namespace CoreIPC {
 
-class Connection::SyncMessageState : public RefCounted<Connection::SyncMessageState> {
+class Connection::SyncMessageState : public ThreadSafeRefCounted<Connection::SyncMessageState> {
 public:
     static PassRefPtr<SyncMessageState> getOrCreate(RunLoop*);
     ~SyncMessageState();
 
-    void beginWaitForSyncReply();
-    void endWaitForSyncReply();
-
     void wakeUpClientRunLoop()
     {
         m_waitForSyncReplySemaphore.signal();
@@ -76,16 +73,18 @@ private:
         return syncMessageStateMapMutex;
     }
 
+    void dispatchMessageAndResetDidScheduleDispatchMessagesWork();
+
     RunLoop* m_runLoop;
     BinarySemaphore m_waitForSyncReplySemaphore;
 
-    // Protects m_waitForSyncReplyCount and m_messagesToDispatchWhileWaitingForSyncReply.
+    // Protects m_didScheduleDispatchMessagesWork and m_messagesToDispatchWhileWaitingForSyncReply.
     Mutex m_mutex;
 
-    unsigned m_waitForSyncReplyCount;
+    bool m_didScheduleDispatchMessagesWork;
 
     struct ConnectionAndIncomingMessage {
-        Connection* connection;
+        RefPtr<Connection> connection;
         IncomingMessage incomingMessage;
     };
     Vector<ConnectionAndIncomingMessage> m_messagesToDispatchWhileWaitingForSyncReply;
@@ -109,7 +108,7 @@ PassRefPtr<Connection::SyncMessageState> Connection::SyncMessageState::getOrCrea
 
 Connection::SyncMessageState::SyncMessageState(RunLoop* runLoop)
     : m_runLoop(runLoop)
-    , m_waitForSyncReplyCount(0)
+    , m_didScheduleDispatchMessagesWork(false)
 {
 }
 
@@ -121,49 +120,27 @@ Connection::SyncMessageState::~SyncMessageState()
     syncMessageStateMap().remove(m_runLoop);
 }
 
-void Connection::SyncMessageState::beginWaitForSyncReply()
-{
-    ASSERT(RunLoop::current() == m_runLoop);
-
-    MutexLocker locker(m_mutex);
-    m_waitForSyncReplyCount++;
-}
-
-void Connection::SyncMessageState::endWaitForSyncReply()
-{
-    ASSERT(RunLoop::current() == m_runLoop);
-
-    MutexLocker locker(m_mutex);
-    ASSERT(m_waitForSyncReplyCount);
-    --m_waitForSyncReplyCount;
-
-    if (m_waitForSyncReplyCount)
-        return;
-
-    // Dispatch any remaining incoming sync messages.
-    for (size_t i = 0; i < m_messagesToDispatchWhileWaitingForSyncReply.size(); ++i) {
-        ConnectionAndIncomingMessage& connectionAndIncomingMessage = m_messagesToDispatchWhileWaitingForSyncReply[i];
-        connectionAndIncomingMessage.connection->enqueueIncomingMessage(connectionAndIncomingMessage.incomingMessage);
-    }
-
-    m_messagesToDispatchWhileWaitingForSyncReply.clear();
-}
-
 bool Connection::SyncMessageState::processIncomingMessage(Connection* connection, IncomingMessage& incomingMessage)
 {
     MessageID messageID = incomingMessage.messageID();
-    if (!messageID.isSync() && !messageID.shouldDispatchMessageWhenWaitingForSyncReply())
-        return false;
-
-    MutexLocker locker(m_mutex);
-    if (!m_waitForSyncReplyCount)
+    if (!messageID.shouldDispatchMessageWhenWaitingForSyncReply())
         return false;
 
     ConnectionAndIncomingMessage connectionAndIncomingMessage;
     connectionAndIncomingMessage.connection = connection;
     connectionAndIncomingMessage.incomingMessage = incomingMessage;
 
-    m_messagesToDispatchWhileWaitingForSyncReply.append(connectionAndIncomingMessage);
+    {
+        MutexLocker locker(m_mutex);
+        
+        if (!m_didScheduleDispatchMessagesWork) {
+            m_runLoop->scheduleWork(WorkItem::create(this, &SyncMessageState::dispatchMessageAndResetDidScheduleDispatchMessagesWork));
+            m_didScheduleDispatchMessagesWork = true;
+        }
+
+        m_messagesToDispatchWhileWaitingForSyncReply.append(connectionAndIncomingMessage);
+    }
+
     wakeUpClientRunLoop();
 
     return true;
@@ -186,6 +163,17 @@ void Connection::SyncMessageState::dispatchMessages()
     }
 }
 
+void Connection::SyncMessageState::dispatchMessageAndResetDidScheduleDispatchMessagesWork()
+{
+    {
+        MutexLocker locker(m_mutex);
+        ASSERT(m_didScheduleDispatchMessagesWork);
+        m_didScheduleDispatchMessagesWork = false;
+    }
+
+    dispatchMessages();
+}
+
 PassRefPtr<Connection> Connection::createServerConnection(Identifier identifier, Client* client, RunLoop* clientRunLoop)
 {
     return adoptRef(new Connection(identifier, true, client, clientRunLoop));
@@ -200,11 +188,13 @@ Connection::Connection(Identifier identifier, bool isServer, Client* client, Run
     : m_client(client)
     , m_isServer(isServer)
     , m_syncRequestID(0)
+    , m_onlySendMessagesAsDispatchWhenWaitingForSyncReplyWhenProcessingSuchAMessage(false)
     , m_didCloseOnConnectionWorkQueueCallback(0)
     , m_isConnected(false)
     , m_connectionQueue("com.apple.CoreIPC.ReceiveQueue")
     , m_clientRunLoop(clientRunLoop)
     , m_inDispatchMessageCount(0)
+    , m_inDispatchMessageMarkedDispatchWhenWaitingForSyncReplyCount(0)
     , m_didReceiveInvalidMessage(false)
     , m_syncMessageState(SyncMessageState::getOrCreate(clientRunLoop))
     , m_shouldWaitForSyncReplies(true)
@@ -221,6 +211,13 @@ Connection::~Connection()
     m_connectionQueue.invalidate();
 }
 
+void Connection::setOnlySendMessagesAsDispatchWhenWaitingForSyncReplyWhenProcessingSuchAMessage(bool flag)
+{
+    ASSERT(!m_isConnected);
+
+    m_onlySendMessagesAsDispatchWhenWaitingForSyncReplyWhenProcessingSuchAMessage = flag;
+}
+
 void Connection::setDidCloseOnConnectionWorkQueueCallback(DidCloseOnConnectionWorkQueueCallback callback)
 {
     ASSERT(!m_isConnected);
@@ -265,7 +262,9 @@ bool Connection::sendMessage(MessageID messageID, PassOwnPtr<ArgumentEncoder> ar
     if (!isValid())
         return false;
 
-    if (messageSendFlags & DispatchMessageEvenWhenWaitingForSyncReply)
+    if (messageSendFlags & DispatchMessageEvenWhenWaitingForSyncReply
+        && (!m_onlySendMessagesAsDispatchWhenWaitingForSyncReplyWhenProcessingSuchAMessage
+            || m_inDispatchMessageMarkedDispatchWhenWaitingForSyncReplyCount))
         messageID = messageID.messageIDWithAddedFlags(MessageID::DispatchMessageWhenWaitingForSyncReply);
 
     MutexLocker locker(m_outgoingMessagesLock);
@@ -357,12 +356,8 @@ PassOwnPtr<ArgumentDecoder> Connection::sendSyncMessage(MessageID messageID, uin
         m_pendingSyncReplies.append(PendingSyncReply(syncRequestID));
     }
 
-    // We have to begin waiting for the sync reply before sending the message, in case the other side
-    // would have sent a request before us, which would lead to a deadlock.
-    m_syncMessageState->beginWaitForSyncReply();
-
     // First send the message.
-    sendMessage(messageID, encoder);
+    sendMessage(messageID.messageIDWithAddedFlags(MessageID::SyncMessage), encoder, DispatchMessageEvenWhenWaitingForSyncReply);
 
     // Then wait for a reply. Waiting for a reply could involve dispatching incoming sync messages, so
     // keep an extra reference to the connection here in case it's invalidated.
@@ -376,9 +371,7 @@ PassOwnPtr<ArgumentDecoder> Connection::sendSyncMessage(MessageID messageID, uin
         m_pendingSyncReplies.removeLast();
     }
 
-    m_syncMessageState->endWaitForSyncReply();
-
-    if (!reply)
+    if (!reply && m_client)
         m_client->didFailToSendSyncMessage(this);
 
     return reply.release();
@@ -415,19 +408,41 @@ PassOwnPtr<ArgumentDecoder> Connection::waitForSyncReply(uint64_t syncRequestID,
     return 0;
 }
 
-void Connection::processIncomingMessage(MessageID messageID, PassOwnPtr<ArgumentDecoder> arguments)
+void Connection::processIncomingSyncReply(PassOwnPtr<ArgumentDecoder> arguments)
 {
-    // Check if this is a sync reply.
-    if (messageID == MessageID(CoreIPCMessage::SyncMessageReply)) {
-        MutexLocker locker(m_syncReplyStateMutex);
-        ASSERT(!m_pendingSyncReplies.isEmpty());
+    MutexLocker locker(m_syncReplyStateMutex);
+    ASSERT(!m_pendingSyncReplies.isEmpty());
+
+    // Go through the stack of sync requests that have pending replies and see which one
+    // this reply is for.
+    for (size_t i = m_pendingSyncReplies.size(); i > 0; --i) {
+        PendingSyncReply& pendingSyncReply = m_pendingSyncReplies[i - 1];
+
+        if (pendingSyncReply.syncRequestID != arguments->destinationID())
+            continue;
 
-        PendingSyncReply& pendingSyncReply = m_pendingSyncReplies.last();
-        ASSERT(pendingSyncReply.syncRequestID == arguments->destinationID());
+        ASSERT(!pendingSyncReply.replyDecoder);
 
         pendingSyncReply.replyDecoder = arguments.leakPtr();
         pendingSyncReply.didReceiveReply = true;
-        m_syncMessageState->wakeUpClientRunLoop();
+
+        // We got a reply to the last send message, wake up the client run loop so it can be processed.
+        if (i == m_pendingSyncReplies.size())
+            m_syncMessageState->wakeUpClientRunLoop();
+
+        return;
+    }
+
+    // We got a reply for a message we never sent.
+    // FIXME: Dispatch a didReceiveInvalidMessage callback on the client.
+    ASSERT_NOT_REACHED();
+}
+
+void Connection::processIncomingMessage(MessageID messageID, PassOwnPtr<ArgumentDecoder> arguments)
+{
+    // Check if this is a sync reply.
+    if (messageID == MessageID(CoreIPCMessage::SyncMessageReply)) {
+        processIncomingSyncReply(arguments);
         return;
     }
 
@@ -569,6 +584,9 @@ void Connection::dispatchMessage(IncomingMessage& message)
 
     m_inDispatchMessageCount++;
 
+    if (message.messageID().shouldDispatchMessageWhenWaitingForSyncReply())
+        m_inDispatchMessageMarkedDispatchWhenWaitingForSyncReplyCount++;
+
     bool oldDidReceiveInvalidMessage = m_didReceiveInvalidMessage;
     m_didReceiveInvalidMessage = false;
 
@@ -580,6 +598,9 @@ void Connection::dispatchMessage(IncomingMessage& message)
     m_didReceiveInvalidMessage |= arguments->isInvalid();
     m_inDispatchMessageCount--;
 
+    if (message.messageID().shouldDispatchMessageWhenWaitingForSyncReply())
+        m_inDispatchMessageMarkedDispatchWhenWaitingForSyncReplyCount--;
+
     if (m_didReceiveInvalidMessage && m_client)
         m_client->didReceiveInvalidMessage(this, message.messageID());
 
diff --git a/Source/WebKit2/Platform/CoreIPC/Connection.h b/Source/WebKit2/Platform/CoreIPC/Connection.h
index eaa2ab9..b6a2415 100644
--- a/Source/WebKit2/Platform/CoreIPC/Connection.h
+++ b/Source/WebKit2/Platform/CoreIPC/Connection.h
@@ -72,7 +72,7 @@ enum MessageSendFlags {
     } \
 while (0)
 
-class Connection : public ThreadSafeShared<Connection> {
+class Connection : public ThreadSafeRefCounted<Connection> {
 public:
     class MessageReceiver {
     protected:
@@ -114,6 +114,8 @@ public:
     void setShouldCloseConnectionOnProcessTermination(WebKit::PlatformProcessIdentifier);
 #endif
 
+    void setOnlySendMessagesAsDispatchWhenWaitingForSyncReplyWhenProcessingSuchAMessage(bool);
+
     // The set callback will be called on the connection work queue when the connection is closed, 
     // before didCall is called on the client thread. Must be called before the connection is opened.
     // In the future we might want a more generic way to handle sync or async messages directly
@@ -191,6 +193,8 @@ private:
 
     // Called on the connection work queue.
     void processIncomingMessage(MessageID, PassOwnPtr<ArgumentDecoder>);
+    void processIncomingSyncReply(PassOwnPtr<ArgumentDecoder>);
+
     bool canSendOutgoingMessages() const;
     bool platformCanSendOutgoingMessages() const;
     void sendOutgoingMessages();
@@ -212,13 +216,15 @@ private:
     bool m_isServer;
     uint64_t m_syncRequestID;
 
+    bool m_onlySendMessagesAsDispatchWhenWaitingForSyncReplyWhenProcessingSuchAMessage;
     DidCloseOnConnectionWorkQueueCallback m_didCloseOnConnectionWorkQueueCallback;
 
     bool m_isConnected;
     WorkQueue m_connectionQueue;
     RunLoop* m_clientRunLoop;
 
-    uint32_t m_inDispatchMessageCount;
+    unsigned m_inDispatchMessageCount;
+    unsigned m_inDispatchMessageMarkedDispatchWhenWaitingForSyncReplyCount;
     bool m_didReceiveInvalidMessage;
 
     // Incoming messages.
@@ -336,7 +342,7 @@ template<typename T> bool Connection::sendSync(const T& message, const typename
     argumentEncoder->encode(message);
 
     // Now send the message and wait for a reply.
-    OwnPtr<ArgumentDecoder> replyDecoder = sendSyncMessage(MessageID(T::messageID, MessageID::SyncMessage), syncRequestID, argumentEncoder.release(), timeout);
+    OwnPtr<ArgumentDecoder> replyDecoder = sendSyncMessage(MessageID(T::messageID), syncRequestID, argumentEncoder.release(), timeout);
     if (!replyDecoder)
         return false;
 
@@ -367,7 +373,7 @@ inline bool Connection::deprecatedSendSync(E messageID, uint64_t destinationID,
     argumentEncoder->encode(arguments);
     
     // Now send the message and wait for a reply.
-    OwnPtr<ArgumentDecoder> replyDecoder = sendSyncMessage(MessageID(messageID, MessageID::SyncMessage), syncRequestID, argumentEncoder.release(), timeout);
+    OwnPtr<ArgumentDecoder> replyDecoder = sendSyncMessage(MessageID(messageID), syncRequestID, argumentEncoder.release(), timeout);
     if (!replyDecoder)
         return false;
     
diff --git a/Source/WebKit2/Platform/CoreIPC/MessageID.h b/Source/WebKit2/Platform/CoreIPC/MessageID.h
index 83154ec..2afb168 100644
--- a/Source/WebKit2/Platform/CoreIPC/MessageID.h
+++ b/Source/WebKit2/Platform/CoreIPC/MessageID.h
@@ -42,9 +42,12 @@ enum MessageClass {
     MessageClassWebApplicationCacheManager,
     MessageClassWebCookieManager,
     MessageClassWebDatabaseManager,
+    MessageClassWebFullScreenManager,
     MessageClassWebGeolocationManagerProxy,
+    MessageClassWebIconDatabaseProxy,
     MessageClassWebInspector,
     MessageClassWebKeyValueStorageManager,
+    MessageClassWebMediaCacheManager,
     MessageClassWebPage,
     MessageClassWebProcess,
     MessageClassWebResourceCacheManager,
@@ -58,9 +61,12 @@ enum MessageClass {
     MessageClassWebContextLegacy,
     MessageClassWebCookieManagerProxy,
     MessageClassWebDatabaseManagerProxy,
+    MessageClassWebFullScreenManagerProxy,
     MessageClassWebGeolocationManager,
+    MessageClassWebIconDatabase,
     MessageClassWebInspectorProxy,
     MessageClassWebKeyValueStorageManagerProxy,
+    MessageClassWebMediaCacheManagerProxy,
     MessageClassWebPageProxy,
     MessageClassWebProcessProxy,
     MessageClassWebProcessProxyLegacy,
diff --git a/Source/WebKit2/Platform/Logging.cpp b/Source/WebKit2/Platform/Logging.cpp
index 184821c..9093415 100644
--- a/Source/WebKit2/Platform/Logging.cpp
+++ b/Source/WebKit2/Platform/Logging.cpp
@@ -28,15 +28,20 @@
 
 #if !LOG_DISABLED
 
+namespace WebKit {
+
 WTFLogChannel LogSessionState = { 0x00000001, "WebKit2LogLevel", WTFLogChannelOff };
 WTFLogChannel LogContextMenu  = { 0x00000002, "WebKit2LogLevel", WTFLogChannelOff };
 WTFLogChannel LogTextInput    = { 0x00000004, "WebKit2LogLevel", WTFLogChannelOff };
 WTFLogChannel LogView         = { 0x00000008, "WebKit2LogLevel", WTFLogChannelOff };
+WTFLogChannel LogIconDatabase = { 0x00000010, "WebKit2LogLevel", WTFLogChannelOff };
 
-static inline void initializeLogChannel(WTFLogChannel* channel)
+#if !PLATFORM(MAC)
+void initializeLogChannel(WTFLogChannel* channel)
 {
-    // FIXME: This is a build fix.  Each platform will need to define their own initializeLogChannel().
+    // FIXME: Each platform will need to define their own initializeLogChannel().
 }
+#endif
 
 void initializeLogChannelsIfNecessary()
 {
@@ -46,9 +51,12 @@ void initializeLogChannelsIfNecessary()
     haveInitializedLogChannels = true;
 
     initializeLogChannel(&LogContextMenu);
+    initializeLogChannel(&LogIconDatabase);
     initializeLogChannel(&LogSessionState);
     initializeLogChannel(&LogTextInput);
     initializeLogChannel(&LogView);
 }
 
+} // namespace WebKit
+
 #endif // LOG_DISABLED
diff --git a/Source/WebKit2/Platform/Logging.h b/Source/WebKit2/Platform/Logging.h
index b2cc391..098bc68 100644
--- a/Source/WebKit2/Platform/Logging.h
+++ b/Source/WebKit2/Platform/Logging.h
@@ -23,8 +23,8 @@
  * THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef Logging_h
-#define Logging_h
+#ifndef WebKitLogging_h
+#define WebKitLogging_h
 
 #include <wtf/Assertions.h>
 
@@ -34,16 +34,18 @@
 #define LOG_CHANNEL_PREFIX Log
 #endif
 
-EXTERN_C_BEGIN
+namespace WebKit {
 
 extern WTFLogChannel LogContextMenu;
+extern WTFLogChannel LogIconDatabase;
 extern WTFLogChannel LogSessionState;
 extern WTFLogChannel LogTextInput;
 extern WTFLogChannel LogView;
 
+void initializeLogChannel(WTFLogChannel*);
 void initializeLogChannelsIfNecessary(void);
 
-EXTERN_C_END
+} // namespace WebKit
 
 #endif // LOG_DISABLED
 
diff --git a/Source/WebKit2/Platform/Module.cpp b/Source/WebKit2/Platform/Module.cpp
index 33ffbe0..a78db29 100644
--- a/Source/WebKit2/Platform/Module.cpp
+++ b/Source/WebKit2/Platform/Module.cpp
@@ -33,6 +33,9 @@ Module::Module(const String& path)
 #if PLATFORM(WIN)
     , m_module(0)
 #endif
+#if PLATFORM(MAC) && !defined(__LP64__)
+    , m_bundleResourceMap(-1)
+#endif
 {
 }
 
diff --git a/Source/WebKit2/Platform/Module.h b/Source/WebKit2/Platform/Module.h
index 47899e9..b58e18a 100644
--- a/Source/WebKit2/Platform/Module.h
+++ b/Source/WebKit2/Platform/Module.h
@@ -56,12 +56,19 @@ public:
 
     template<typename FunctionType> FunctionType functionPointer(const char* functionName) const;
 
+#if PLATFORM(MAC) && !defined(__LP64__)
+    CFBundleRefNum bundleResourceMap();
+#endif
+
 private:
     void* platformFunctionPointer(const char* functionName) const;
 
     String m_path;
 #if PLATFORM(MAC)
     RetainPtr<CFBundleRef> m_bundle;
+#if !defined(__LP64__)
+    CFBundleRefNum m_bundleResourceMap;
+#endif
 #elif PLATFORM(WIN)
     HMODULE m_module;
 #elif PLATFORM(QT)
diff --git a/Source/WebKit2/Platform/WorkQueue.h b/Source/WebKit2/Platform/WorkQueue.h
index 441d625..99f77ae 100644
--- a/Source/WebKit2/Platform/WorkQueue.h
+++ b/Source/WebKit2/Platform/WorkQueue.h
@@ -106,7 +106,7 @@ private:
     dispatch_queue_t m_dispatchQueue;
 #endif
 #elif PLATFORM(WIN)
-    class WorkItemWin : public ThreadSafeShared<WorkItemWin> {
+    class WorkItemWin : public ThreadSafeRefCounted<WorkItemWin> {
     public:
         static PassRefPtr<WorkItemWin> create(PassOwnPtr<WorkItem>, WorkQueue*);
         virtual ~WorkItemWin();
diff --git a/Source/WebKit2/Platform/cg/CGUtilities.cpp b/Source/WebKit2/Platform/cg/CGUtilities.cpp
index e57206d..6cde8ee 100644
--- a/Source/WebKit2/Platform/cg/CGUtilities.cpp
+++ b/Source/WebKit2/Platform/cg/CGUtilities.cpp
@@ -29,37 +29,29 @@
 #include <wtf/RetainPtr.h>
 
 namespace WebKit {
-    
-void paintBitmapContext(CGContextRef context, CGContextRef bitmapContext, CGPoint destination, CGRect source)
-{
-    void* bitmapData = CGBitmapContextGetData(bitmapContext);
-    ASSERT(bitmapData);
-
-    size_t imageWidth = CGBitmapContextGetWidth(bitmapContext);
-    size_t imageHeight = CGBitmapContextGetHeight(bitmapContext);
-
-    size_t bytesPerRow = CGBitmapContextGetBytesPerRow(bitmapContext);
-
-    RetainPtr<CGDataProviderRef> dataProvider(AdoptCF, CGDataProviderCreateWithData(0, bitmapData, bytesPerRow * imageHeight, 0));
-    RetainPtr<CGImageRef> image(AdoptCF, CGImageCreate(imageWidth, imageHeight, 
-                                                       CGBitmapContextGetBitsPerComponent(bitmapContext),
-                                                       CGBitmapContextGetBitsPerPixel(bitmapContext), 
-                                                       bytesPerRow,
-                                                       CGBitmapContextGetColorSpace(bitmapContext), 
-                                                       CGBitmapContextGetBitmapInfo(bitmapContext), 
-                                                       dataProvider.get(), 0, false, kCGRenderingIntentDefault));
 
+void paintImage(CGContextRef context, CGImageRef image, CGPoint destination, CGRect source)
+{
     CGContextSaveGState(context);
 
     CGContextClipToRect(context, CGRectMake(destination.x, destination.y, source.size.width, source.size.height));
     CGContextScaleCTM(context, 1, -1);
 
+    size_t imageHeight = CGImageGetHeight(image);
+    size_t imageWidth = CGImageGetWidth(image);
+
     CGFloat destX = destination.x - source.origin.x;
     CGFloat destY = -static_cast<CGFloat>(imageHeight) - destination.y + source.origin.y;
 
-    CGContextDrawImage(context, CGRectMake(destX, destY, imageWidth, imageHeight), image.get());
+    CGContextDrawImage(context, CGRectMake(destX, destY, imageWidth, imageHeight), image);
     CGContextRestoreGState(context);
 }
-    
+
+void paintBitmapContext(CGContextRef context, CGContextRef bitmapContext, CGPoint destination, CGRect source)
+{
+    RetainPtr<CGImageRef> image(AdoptCF, CGBitmapContextCreateImage(bitmapContext));
+    paintImage(context, image.get(), destination, source);
+}
+
 } // namespace WebKit
 
diff --git a/Source/WebKit2/Platform/cg/CGUtilities.h b/Source/WebKit2/Platform/cg/CGUtilities.h
index 3dca654..82cf6dd 100644
--- a/Source/WebKit2/Platform/cg/CGUtilities.h
+++ b/Source/WebKit2/Platform/cg/CGUtilities.h
@@ -28,6 +28,7 @@
 
 namespace WebKit {
 
+void paintImage(CGContextRef, CGImageRef, CGPoint destination, CGRect source);
 void paintBitmapContext(CGContextRef, CGContextRef bitmapContext, CGPoint destination, CGRect source);
 
 } // namespace WebKit
diff --git a/Source/WebKit2/Platform/mac/Logging.mac.mm b/Source/WebKit2/Platform/mac/Logging.mac.mm
new file mode 100644
index 0000000..6e45828
--- /dev/null
+++ b/Source/WebKit2/Platform/mac/Logging.mac.mm
@@ -0,0 +1,49 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "Logging.h"
+
+namespace WebKit {
+
+#ifndef NDEBUG
+
+void initializeLogChannel(WTFLogChannel* channel)
+{
+    channel->state = WTFLogChannelOff;
+    NSString *logLevelString = [[NSUserDefaults standardUserDefaults] objectForKey:[NSString stringWithUTF8String:channel->defaultName]];
+    if (!logLevelString)
+        return;
+        
+    unsigned logLevel;
+    if (![[NSScanner scannerWithString:logLevelString] scanHexInt:&logLevel])
+        NSLog(@"unable to parse hex value for %s (%@), logging is off", channel->defaultName, logLevelString);
+    if ((logLevel & channel->mask) == channel->mask)
+        channel->state = WTFLogChannelOn;
+}
+
+#endif
+
+} // namespace WebKit
diff --git a/Source/WebKit2/Platform/mac/ModuleMac.mm b/Source/WebKit2/Platform/mac/ModuleMac.mm
index 078e7ee..1ec60f3 100644
--- a/Source/WebKit2/Platform/mac/ModuleMac.mm
+++ b/Source/WebKit2/Platform/mac/ModuleMac.mm
@@ -48,6 +48,13 @@ bool Module::load()
 
 void Module::unload()
 {
+    ASSERT(m_bundle);
+
+#if !defined(__LP64__)
+    if (m_bundleResourceMap != -1)
+        CFBundleCloseBundleResourceMap(m_bundle.get(), m_bundleResourceMap);
+#endif
+
     // See the comment in Module.h for why we leak the bundle here.
     m_bundle.releaseRef();
 }
@@ -60,4 +67,14 @@ void* Module::platformFunctionPointer(const char* functionName) const
     return CFBundleGetFunctionPointerForName(m_bundle.get(), functionNameString.get());
 }
 
+#if !defined(__LP64__)
+CFBundleRefNum Module::bundleResourceMap()
+{
+    if (m_bundleResourceMap == -1)
+        m_bundleResourceMap = CFBundleOpenBundleResourceMap(m_bundle.get());
+
+    return m_bundleResourceMap;
+}
+#endif
+
 }
diff --git a/Source/WebKit2/Platform/mac/RunLoopMac.mm b/Source/WebKit2/Platform/mac/RunLoopMac.mm
index 8258550..828c57f 100644
--- a/Source/WebKit2/Platform/mac/RunLoopMac.mm
+++ b/Source/WebKit2/Platform/mac/RunLoopMac.mm
@@ -30,7 +30,14 @@
 
 void RunLoop::performWork(void* context)
 {
-    static_cast<RunLoop*>(context)->performWork();
+    // Wrap main thread in an Autorelease pool.  Sending messages can call 
+    // into objc code and accumulate memory.  
+    if (current() == main()) {
+        NSAutoreleasePool *pool = [[NSAutoreleasePool alloc] init];
+        static_cast<RunLoop*>(context)->performWork();
+        [pool drain];
+    } else
+        static_cast<RunLoop*>(context)->performWork();
 }
 
 RunLoop::RunLoop()
@@ -91,7 +98,15 @@ void RunLoop::wakeUp()
 void RunLoop::TimerBase::timerFired(CFRunLoopTimerRef, void* context)
 {
     TimerBase* timer = static_cast<TimerBase*>(context);
-    timer->fired();
+    
+    // Wrap main thread in an Autorelease pool.  The timer can call 
+    // into objc code and accumulate memory outside of the main event loop.
+    if (current() == main()) {
+        NSAutoreleasePool *pool = [[NSAutoreleasePool alloc] init]; 
+        timer->fired();
+        [pool drain];
+    } else
+        timer->fired();
 }
 
 RunLoop::TimerBase::TimerBase(RunLoop* runLoop)
diff --git a/Source/WebKit2/Platform/qt/SharedMemoryQt.cpp b/Source/WebKit2/Platform/qt/SharedMemoryQt.cpp
index 91af533..8d5d70f 100644
--- a/Source/WebKit2/Platform/qt/SharedMemoryQt.cpp
+++ b/Source/WebKit2/Platform/qt/SharedMemoryQt.cpp
@@ -101,7 +101,7 @@ void SharedMemory::Handle::adoptFromAttachment(int fileDescriptor, size_t size)
 
 PassRefPtr<SharedMemory> SharedMemory::create(size_t size)
 {
-    QString tempName = QDir::temp().filePath("qwkshm.XXXXXX");
+    QString tempName = QDir::temp().filePath(QLatin1String("qwkshm.XXXXXX"));
     QByteArray tempNameCSTR = tempName.toLocal8Bit();
     char* tempNameC = tempNameCSTR.data();
 
diff --git a/Source/WebKit2/Platform/win/WorkQueueWin.cpp b/Source/WebKit2/Platform/win/WorkQueueWin.cpp
index 0a89225..44e9885 100644
--- a/Source/WebKit2/Platform/win/WorkQueueWin.cpp
+++ b/Source/WebKit2/Platform/win/WorkQueueWin.cpp
@@ -210,7 +210,7 @@ void WorkQueue::scheduleWork(PassOwnPtr<WorkItem> item)
         ::QueueUserWorkItem(workThreadCallback, this, WT_EXECUTEDEFAULT);
 }
 
-struct TimerContext : public ThreadSafeShared<TimerContext> {
+struct TimerContext : public ThreadSafeRefCounted<TimerContext> {
     static PassRefPtr<TimerContext> create() { return adoptRef(new TimerContext); }
 
     WorkQueue* queue;
diff --git a/Source/WebKit2/PluginProcess/Info.plist b/Source/WebKit2/PluginProcess/Info.plist
new file mode 100644
index 0000000..cbf2492
--- /dev/null
+++ b/Source/WebKit2/PluginProcess/Info.plist
@@ -0,0 +1,30 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+	<key>CFBundleExecutable</key>
+	<string>${PRODUCT_NAME}</string>
+	<key>CFBundleGetInfoString</key>
+	<string>${BUNDLE_VERSION}, Copyright 2003-2011 Apple Inc.</string>
+	<key>CFBundleIdentifier</key>
+	<string>com.apple.WebKit.${PRODUCT_NAME}</string>
+	<key>CFBundleInfoDictionaryVersion</key>
+	<string>6.0</string>
+	<key>CFBundleName</key>
+	<string>${PRODUCT_NAME}</string>
+	<key>CFBundlePackageType</key>
+	<string>APPL</string>
+	<key>CFBundleShortVersionString</key>
+	<string>${SHORT_VERSION_STRING}</string>
+	<key>CFBundleVersion</key>
+	<string>${BUNDLE_VERSION}</string>
+	<key>LSFileQuarantineEnabled</key>
+	<true/>
+	<key>LSMinimumSystemVersion</key>
+	<string>${MACOSX_DEPLOYMENT_TARGET}</string>
+	<key>LSUIElement</key>
+	<true/>
+	<key>NSPrincipalClass</key>
+	<string>NSApplication</string>
+</dict>
+</plist>
diff --git a/Source/WebKit2/PluginProcess/PluginControllerProxy.cpp b/Source/WebKit2/PluginProcess/PluginControllerProxy.cpp
index b140f78..03a8aec 100644
--- a/Source/WebKit2/PluginProcess/PluginControllerProxy.cpp
+++ b/Source/WebKit2/PluginProcess/PluginControllerProxy.cpp
@@ -78,11 +78,21 @@ bool PluginControllerProxy::initialize(const Plugin::Parameters& parameters)
     ASSERT(!m_plugin);
 
     m_plugin = NetscapePlugin::create(PluginProcess::shared().netscapePluginModule());
-    if (!m_plugin)
+    if (!m_plugin) {
+        // This will delete the plug-in controller proxy object.
+        m_connection->removePluginControllerProxy(this, 0);
         return false;
+    }
 
     if (!m_plugin->initialize(this, parameters)) {
+        // Get the plug-in so we can pass it to removePluginControllerProxy. The pointer is only
+        // used as an identifier so it's OK to just get a weak reference.
+        Plugin* plugin = m_plugin.get();
+        
         m_plugin = 0;
+
+        // This will delete the plug-in controller proxy object.
+        m_connection->removePluginControllerProxy(this, plugin);
         return false;
     }
 
@@ -102,13 +112,17 @@ void PluginControllerProxy::destroy()
         return;
     }
 
+    // Get the plug-in so we can pass it to removePluginControllerProxy. The pointer is only
+    // used as an identifier so it's OK to just get a weak reference.
+    Plugin* plugin = m_plugin.get();
+
     m_plugin->destroy();
     m_plugin = 0;
 
     platformDestroy();
 
     // This will delete the plug-in controller proxy object.
-    m_connection->removePluginControllerProxy(this);
+    m_connection->removePluginControllerProxy(this, plugin);
 }
 
 void PluginControllerProxy::paint()
@@ -122,11 +136,16 @@ void PluginControllerProxy::paint()
     IntRect dirtyRect = m_dirtyRect;
     m_dirtyRect = IntRect();
 
+    ASSERT(m_plugin);
+
     // Create a graphics context.
     OwnPtr<GraphicsContext> graphicsContext = m_backingStore->createGraphicsContext();
+
     graphicsContext->translate(-m_frameRect.x(), -m_frameRect.y());
 
-    ASSERT(m_plugin);
+    if (m_plugin->isTransparent())
+        graphicsContext->clearRect(dirtyRect);
+
     m_plugin->paint(graphicsContext.get(), dirtyRect);
 
     m_connection->connection()->send(Messages::PluginProxy::Update(dirtyRect), m_pluginInstanceID);
@@ -199,7 +218,7 @@ NPObject* PluginControllerProxy::windowScriptNPObject()
     if (!windowScriptNPObjectID)
         return 0;
 
-    return m_connection->npRemoteObjectMap()->createNPObjectProxy(windowScriptNPObjectID);
+    return m_connection->npRemoteObjectMap()->createNPObjectProxy(windowScriptNPObjectID, m_plugin.get());
 }
 
 NPObject* PluginControllerProxy::pluginElementNPObject()
@@ -212,7 +231,7 @@ NPObject* PluginControllerProxy::pluginElementNPObject()
     if (!pluginElementNPObjectID)
         return 0;
 
-    return m_connection->npRemoteObjectMap()->createNPObjectProxy(pluginElementNPObjectID);
+    return m_connection->npRemoteObjectMap()->createNPObjectProxy(pluginElementNPObjectID, m_plugin.get());
 }
 
 bool PluginControllerProxy::evaluate(NPObject* npObject, const String& scriptString, NPVariant* result, bool allowPopups)
@@ -223,7 +242,7 @@ bool PluginControllerProxy::evaluate(NPObject* npObject, const String& scriptStr
     OBJECT_TO_NPVARIANT(npObject, npObjectAsNPVariant);
 
     // Send the NPObject over as an NPVariantData.
-    NPVariantData npObjectAsNPVariantData = m_connection->npRemoteObjectMap()->npVariantToNPVariantData(npObjectAsNPVariant);
+    NPVariantData npObjectAsNPVariantData = m_connection->npRemoteObjectMap()->npVariantToNPVariantData(npObjectAsNPVariant, m_plugin.get());
 
     bool returnValue = false;
     NPVariantData resultData;
@@ -234,7 +253,7 @@ bool PluginControllerProxy::evaluate(NPObject* npObject, const String& scriptStr
     if (!returnValue)
         return false;
 
-    *result = m_connection->npRemoteObjectMap()->npVariantDataToNPVariant(resultData);
+    *result = m_connection->npRemoteObjectMap()->npVariantDataToNPVariant(resultData, m_plugin.get());
     return true;
 }
 
@@ -321,7 +340,7 @@ void PluginControllerProxy::frameDidFail(uint64_t requestID, bool wasCancelled)
     m_plugin->frameDidFail(requestID, wasCancelled);
 }
 
-void PluginControllerProxy::geometryDidChange(const IntRect& frameRect, const IntRect& clipRect, const SharedMemory::Handle& backingStoreHandle)
+void PluginControllerProxy::geometryDidChange(const IntRect& frameRect, const IntRect& clipRect, const ShareableBitmap::Handle& backingStoreHandle)
 {
     m_frameRect = frameRect;
     m_clipRect = clipRect;
@@ -330,7 +349,7 @@ void PluginControllerProxy::geometryDidChange(const IntRect& frameRect, const In
 
     if (!backingStoreHandle.isNull()) {
         // Create a new backing store.
-        m_backingStore = ShareableBitmap::create(frameRect.size(), backingStoreHandle);
+        m_backingStore = ShareableBitmap::create(backingStoreHandle);
     }
 
     m_plugin->geometryDidChange(frameRect, clipRect);
@@ -429,7 +448,7 @@ void PluginControllerProxy::paintEntirePlugin()
     paint();
 }
 
-void PluginControllerProxy::snapshot(WebCore::IntSize& bufferSize, SharedMemory::Handle& backingStoreHandle)
+void PluginControllerProxy::snapshot(ShareableBitmap::Handle& backingStoreHandle)
 {
     ASSERT(m_plugin);
     RefPtr<ShareableBitmap> bitmap = m_plugin->snapshot();
@@ -437,7 +456,6 @@ void PluginControllerProxy::snapshot(WebCore::IntSize& bufferSize, SharedMemory:
         return;
 
     bitmap->createHandle(backingStoreHandle);
-    bufferSize = bitmap->size();
 }
 
 void PluginControllerProxy::setFocus(bool hasFocus)
@@ -459,7 +477,7 @@ void PluginControllerProxy::getPluginScriptableNPObject(uint64_t& pluginScriptab
         return;
     }
     
-    pluginScriptableNPObjectID = m_connection->npRemoteObjectMap()->registerNPObject(pluginScriptableNPObject);
+    pluginScriptableNPObjectID = m_connection->npRemoteObjectMap()->registerNPObject(pluginScriptableNPObject, m_plugin.get());
     releaseNPObject(pluginScriptableNPObject);
 }
 
diff --git a/Source/WebKit2/PluginProcess/PluginControllerProxy.h b/Source/WebKit2/PluginProcess/PluginControllerProxy.h
index e470f85..65be39e 100644
--- a/Source/WebKit2/PluginProcess/PluginControllerProxy.h
+++ b/Source/WebKit2/PluginProcess/PluginControllerProxy.h
@@ -32,7 +32,7 @@
 #include "Plugin.h"
 #include "PluginController.h"
 #include "RunLoop.h"
-#include "SharedMemory.h"
+#include "ShareableBitmap.h"
 #include <wtf/Noncopyable.h>
 
 #if PLATFORM(MAC)
@@ -105,7 +105,7 @@ private:
     // Message handlers.
     void frameDidFinishLoading(uint64_t requestID);
     void frameDidFail(uint64_t requestID, bool wasCancelled);
-    void geometryDidChange(const WebCore::IntRect& frameRect, const WebCore::IntRect& clipRect, const SharedMemory::Handle& backingStoreHandle);
+    void geometryDidChange(const WebCore::IntRect& frameRect, const WebCore::IntRect& clipRect, const ShareableBitmap::Handle& backingStoreHandle);
     void didEvaluateJavaScript(uint64_t requestID, const String& requestURLString, const String& result);
     void streamDidReceiveResponse(uint64_t streamID, const String& responseURLString, uint32_t streamLength, uint32_t lastModifiedTime, const String& mimeType, const String& headers);
     void streamDidReceiveData(uint64_t streamID, const CoreIPC::DataReference& data);
@@ -121,7 +121,7 @@ private:
     void handleMouseLeaveEvent(const WebMouseEvent&, bool& handled);
     void handleKeyboardEvent(const WebKeyboardEvent&, bool& handled);
     void paintEntirePlugin();
-    void snapshot(WebCore::IntSize& bufferSize, SharedMemory::Handle& backingStoreHandle);
+    void snapshot(ShareableBitmap::Handle& backingStoreHandle);
     void setFocus(bool);
     void didUpdate();
     void getPluginScriptableNPObject(uint64_t& pluginScriptableNPObjectID);
diff --git a/Source/WebKit2/PluginProcess/PluginControllerProxy.messages.in b/Source/WebKit2/PluginProcess/PluginControllerProxy.messages.in
index 91cc57f..6e27b36 100644
--- a/Source/WebKit2/PluginProcess/PluginControllerProxy.messages.in
+++ b/Source/WebKit2/PluginProcess/PluginControllerProxy.messages.in
@@ -24,7 +24,7 @@
 
 messages -> PluginControllerProxy {
     # Sent when the plug-in geometry changes.
-    GeometryDidChange(WebCore::IntRect frameRect, WebCore::IntRect clipRect, WebKit::SharedMemory::Handle backingStoreHandle)
+    GeometryDidChange(WebCore::IntRect frameRect, WebCore::IntRect clipRect, WebKit::ShareableBitmap::Handle backingStoreHandle)
 
     # Sent when a frame has finished loading.
     FrameDidFinishLoading(uint64_t requestID)
@@ -101,7 +101,7 @@ messages -> PluginControllerProxy {
 #endif
 
     # Return a snapshot of the plugin
-    Snapshot() -> (WebCore::IntSize size, WebKit::SharedMemory::Handle backingStoreHandle)
+    Snapshot() -> (WebKit::ShareableBitmap::Handle backingStoreHandle)
     
     # Sent when private browsing is enabled or disabled
     PrivateBrowsingStateChanged(bool isPrivateBrowsingEnabled)
diff --git a/Source/WebKit2/PluginProcess/PluginProcess.cpp b/Source/WebKit2/PluginProcess/PluginProcess.cpp
index 9a9f3bc..e35de9d 100644
--- a/Source/WebKit2/PluginProcess/PluginProcess.cpp
+++ b/Source/WebKit2/PluginProcess/PluginProcess.cpp
@@ -72,6 +72,11 @@ void PluginProcess::removeWebProcessConnection(WebProcessConnection* webProcessC
     ASSERT(vectorIndex != notFound);
 
     m_webProcessConnections.remove(vectorIndex);
+    
+    if (m_webProcessConnections.isEmpty() && m_pluginModule) {
+        // Decrement the load count. This is balanced by a call to incrementLoadCount in createWebProcessConnection.
+        m_pluginModule->decrementLoadCount();
+    }        
 
     startShutdownTimerIfNecessary();
 }
@@ -133,6 +138,8 @@ void PluginProcess::createWebProcessConnection()
     mach_port_t listeningPort;
     mach_port_allocate(mach_task_self(), MACH_PORT_RIGHT_RECEIVE, &listeningPort);
 
+    bool didHaveAnyWebProcessConnections = !m_webProcessConnections.isEmpty();
+
     // Create a listening connection.
     RefPtr<WebProcessConnection> connection = WebProcessConnection::create(listeningPort);
     m_webProcessConnections.append(connection.release());
@@ -140,6 +147,14 @@ void PluginProcess::createWebProcessConnection()
     CoreIPC::MachPort clientPort(listeningPort, MACH_MSG_TYPE_MAKE_SEND);
     m_connection->send(Messages::PluginProcessProxy::DidCreateWebProcessConnection(clientPort), 0);
 
+    if (NetscapePluginModule* module = netscapePluginModule()) {
+        if (!didHaveAnyWebProcessConnections) {
+            // Increment the load count. This is matched by a call to decrementLoadCount in removeWebProcessConnection.
+            // We do this so that the plug-in module's NP_Shutdown won't be called until right before exiting.
+            module->incrementLoadCount();
+        }
+    }
+
     // Stop the shutdown timer.
     m_shutdownTimer.stop();
 }
diff --git a/Source/WebKit2/PluginProcess/PluginProcess.h b/Source/WebKit2/PluginProcess/PluginProcess.h
index 3e14e5e..83c3b30 100644
--- a/Source/WebKit2/PluginProcess/PluginProcess.h
+++ b/Source/WebKit2/PluginProcess/PluginProcess.h
@@ -52,6 +52,9 @@ public:
 #if PLATFORM(MAC)
     void initializeShim();
 
+    void setModalWindowIsShowing(bool);
+    void setFullscreenWindowIsShowing(bool);
+
 #if USE(ACCELERATED_COMPOSITING)
     mach_port_t compositingRenderServerPort() const { return m_compositingRenderServerPort; }
 #endif
diff --git a/Source/WebKit2/PluginProcess/WebProcessConnection.cpp b/Source/WebKit2/PluginProcess/WebProcessConnection.cpp
index 07c9309..56ffbb9 100644
--- a/Source/WebKit2/PluginProcess/WebProcessConnection.cpp
+++ b/Source/WebKit2/PluginProcess/WebProcessConnection.cpp
@@ -52,6 +52,7 @@ WebProcessConnection::WebProcessConnection(CoreIPC::Connection::Identifier conne
     m_connection = CoreIPC::Connection::createServerConnection(connectionIdentifier, this, RunLoop::main());
     m_npRemoteObjectMap = NPRemoteObjectMap::create(m_connection.get());
 
+    m_connection->setOnlySendMessagesAsDispatchWhenWaitingForSyncReplyWhenProcessingSuchAMessage(true);
     m_connection->open();
 }
 
@@ -70,7 +71,7 @@ void WebProcessConnection::destroyPluginControllerProxy(PluginControllerProxy* p
     pluginController->destroy();
 }
 
-void WebProcessConnection::removePluginControllerProxy(PluginControllerProxy* pluginController)
+void WebProcessConnection::removePluginControllerProxy(PluginControllerProxy* pluginController, Plugin* plugin)
 {
     {
         ASSERT(m_pluginControllers.contains(pluginController->pluginInstanceID()));
@@ -78,12 +79,14 @@ void WebProcessConnection::removePluginControllerProxy(PluginControllerProxy* pl
         OwnPtr<PluginControllerProxy> pluginControllerOwnPtr = adoptPtr(m_pluginControllers.take(pluginController->pluginInstanceID()));
         ASSERT(pluginControllerOwnPtr == pluginController);
     }
-    
+
+    // Invalidate all objects related to this plug-in.
+    if (plugin)
+        m_npRemoteObjectMap->pluginDestroyed(plugin);
+
     if (!m_pluginControllers.isEmpty())
         return;
 
-    // Invalidate our remote object map.
-    m_npRemoteObjectMap->invalidate();
     m_npRemoteObjectMap = nullptr;
 
     // The last plug-in went away, close this connection.
@@ -167,13 +170,10 @@ void WebProcessConnection::createPlugin(uint64_t pluginInstanceID, const Plugin:
     // Now try to initialize the plug-in.
     result = pluginControllerProxyPtr->initialize(parameters);
 
-    if (result) {
-        remoteLayerClientID = pluginControllerProxyPtr->remoteLayerClientID();
+    if (!result)
         return;
-    }
 
-    // We failed to initialize, remove the plug-in controller. This could cause us to be deleted.
-    removePluginControllerProxy(pluginControllerProxyPtr);
+    remoteLayerClientID = pluginControllerProxyPtr->remoteLayerClientID();
 }
 
 } // namespace WebKit
diff --git a/Source/WebKit2/PluginProcess/WebProcessConnection.h b/Source/WebKit2/PluginProcess/WebProcessConnection.h
index 4953e61..83fe0fe 100644
--- a/Source/WebKit2/PluginProcess/WebProcessConnection.h
+++ b/Source/WebKit2/PluginProcess/WebProcessConnection.h
@@ -47,7 +47,7 @@ public:
     CoreIPC::Connection* connection() const { return m_connection.get(); }
     NPRemoteObjectMap* npRemoteObjectMap() const { return m_npRemoteObjectMap.get(); }
 
-    void removePluginControllerProxy(PluginControllerProxy*);
+    void removePluginControllerProxy(PluginControllerProxy*, Plugin*);
 
 private:
     WebProcessConnection(CoreIPC::Connection::Identifier);
diff --git a/Source/WebKit2/PluginProcess/mac/PluginProcessMac.mm b/Source/WebKit2/PluginProcess/mac/PluginProcessMac.mm
index 5a54719..3a3586a 100644
--- a/Source/WebKit2/PluginProcess/mac/PluginProcessMac.mm
+++ b/Source/WebKit2/PluginProcess/mac/PluginProcessMac.mm
@@ -28,17 +28,98 @@
 
 #if ENABLE(PLUGIN_PROCESS)
 
-// FIXME (WebKit2) <rdar://problem/8728860> WebKit2 needs to be localized
-#define UI_STRING(__str, __desc) [NSString stringWithUTF8String:__str]
-
 #import "NetscapePlugin.h"
 #import "PluginProcessShim.h"
+#import "PluginProcessProxyMessages.h"
 #import "PluginProcessCreationParameters.h"
+#import <WebCore/LocalizedStrings.h>
 #import <WebKitSystemInterface.h>
 #import <dlfcn.h>
+#import <wtf/HashSet.h>
 
 namespace WebKit {
 
+class FullscreenWindowTracker {
+    WTF_MAKE_NONCOPYABLE(FullscreenWindowTracker);
+
+public:
+    FullscreenWindowTracker() { }
+    
+    template<typename T> void windowShown(T window);
+    template<typename T> void windowHidden(T window);
+
+private:
+    typedef HashSet<void*> WindowSet;
+    WindowSet m_windows;
+};
+
+static bool rectCoversAnyScreen(NSRect rect)
+{
+    for (NSScreen *screen in [NSScreen screens]) {
+        if (NSContainsRect(rect, [screen frame]))
+            return YES;
+    }
+    return NO;
+}
+
+#ifndef NP_NO_CARBON
+static bool windowCoversAnyScreen(WindowRef window)
+{
+    HIRect bounds;
+    HIWindowGetBounds(window, kWindowStructureRgn, kHICoordSpaceScreenPixel, &bounds);
+
+    // Convert to Cocoa-style screen coordinates that use a Y offset relative to the zeroth screen's origin.
+    bounds.origin.y = NSHeight([[[NSScreen screens] objectAtIndex:0] frame]) - CGRectGetMaxY(bounds);
+
+    return rectCoversAnyScreen(NSRectFromCGRect(bounds));
+}
+#endif
+
+static bool windowCoversAnyScreen(NSWindow* window)
+{
+    return rectCoversAnyScreen([window frame]);
+}
+
+template<typename T> void FullscreenWindowTracker::windowShown(T window)
+{
+    // If this window is already visible then there is nothing to do.
+    WindowSet::iterator it = m_windows.find(window);
+    if (it != m_windows.end())
+        return;
+    
+    // If the window is not full-screen then we're not interested in it.
+    if (!windowCoversAnyScreen(window))
+        return;
+
+    bool windowSetWasEmpty = m_windows.isEmpty();
+
+    m_windows.add(window);
+    
+    // If this is the first full screen window to be shown, notify the UI process.
+    if (windowSetWasEmpty)
+        PluginProcess::shared().setFullscreenWindowIsShowing(true);
+}
+
+template<typename T> void FullscreenWindowTracker::windowHidden(T window)
+{
+    // If this is not a window that we're tracking then there is nothing to do.
+    WindowSet::iterator it = m_windows.find(window);
+    if (it == m_windows.end())
+        return;
+
+    m_windows.remove(it);
+
+    // If this was the last full screen window that was visible, notify the UI process.
+    if (m_windows.isEmpty())
+        PluginProcess::shared().setFullscreenWindowIsShowing(false);
+}
+
+static FullscreenWindowTracker& fullscreenWindowTracker()
+{
+    DEFINE_STATIC_LOCAL(FullscreenWindowTracker, fullscreenWindowTracker, ());
+    return fullscreenWindowTracker;
+}
+
 static bool isUserbreakSet = false;
 
 static void initShouldCallRealDebugger()
@@ -78,18 +159,62 @@ static UInt32 getCurrentEventButtonState()
 #endif
 }
     
+static void cocoaWindowShown(NSWindow *window)
+{
+    fullscreenWindowTracker().windowShown(window);
+}
+
+static void cocoaWindowHidden(NSWindow *window)
+{
+    fullscreenWindowTracker().windowHidden(window);
+}
+
+static void carbonWindowShown(WindowRef window)
+{
+#ifndef NP_NO_CARBON
+    fullscreenWindowTracker().windowShown(window);
+#endif
+}
+
+static void carbonWindowHidden(WindowRef window)
+{
+#ifndef NP_NO_CARBON
+    fullscreenWindowTracker().windowHidden(window);
+#endif
+}
+
+static void setModal(bool modalWindowIsShowing)
+{
+    PluginProcess::shared().setModalWindowIsShowing(modalWindowIsShowing);
+}
+
 void PluginProcess::initializeShim()
 {
     const PluginProcessShimCallbacks callbacks = {
         shouldCallRealDebugger,
         isWindowActive,
-        getCurrentEventButtonState
+        getCurrentEventButtonState,
+        cocoaWindowShown,
+        cocoaWindowHidden,
+        carbonWindowShown,
+        carbonWindowHidden,
+        setModal,
     };
 
     PluginProcessShimInitializeFunc initFunc = reinterpret_cast<PluginProcessShimInitializeFunc>(dlsym(RTLD_DEFAULT, "WebKitPluginProcessShimInitialize"));
     initFunc(callbacks);
 }
 
+void PluginProcess::setModalWindowIsShowing(bool modalWindowIsShowing)
+{
+    m_connection->send(Messages::PluginProcessProxy::SetModalWindowIsShowing(modalWindowIsShowing), 0);
+}
+
+void PluginProcess::setFullscreenWindowIsShowing(bool fullscreenWindowIsShowing)
+{
+    m_connection->send(Messages::PluginProcessProxy::SetFullscreenWindowIsShowing(fullscreenWindowIsShowing), 0);
+}
+
 void PluginProcess::platformInitialize(const PluginProcessCreationParameters& parameters)
 {
     m_compositingRenderServerPort = parameters.acceleratedCompositingPort.port();
diff --git a/Source/WebKit2/PluginProcess/mac/PluginProcessShim.h b/Source/WebKit2/PluginProcess/mac/PluginProcessShim.h
index 0fbee23..b021a3a 100644
--- a/Source/WebKit2/PluginProcess/mac/PluginProcessShim.h
+++ b/Source/WebKit2/PluginProcess/mac/PluginProcessShim.h
@@ -26,6 +26,8 @@
 #ifndef PluginProcessShim_h
 #define PluginProcessShim_h
 
+@class NSWindow;
+
 #include <Carbon/Carbon.h>
 
 namespace WebKit {
@@ -34,6 +36,11 @@ struct PluginProcessShimCallbacks {
     bool (*shouldCallRealDebugger)();
     bool (*isWindowActive)(WindowRef, bool& result);
     UInt32 (*getCurrentEventButtonState)();
+    void (*cocoaWindowShown)(NSWindow *);
+    void (*cocoaWindowHidden)(NSWindow *);
+    void (*carbonWindowShown)(WindowRef);
+    void (*carbonWindowHidden)(WindowRef);
+    void (*setModal)(bool);
 };
 
 typedef void (*PluginProcessShimInitializeFunc)(const PluginProcessShimCallbacks&);
diff --git a/Source/WebKit2/PluginProcess/mac/PluginProcessShim.mm b/Source/WebKit2/PluginProcess/mac/PluginProcessShim.mm
new file mode 100644
index 0000000..6a32727
--- /dev/null
+++ b/Source/WebKit2/PluginProcess/mac/PluginProcessShim.mm
@@ -0,0 +1,190 @@
+/*
+ * Copyright (C) 2010 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#import "PluginProcessShim.h"
+
+#import <AppKit/AppKit.h>
+#import <Carbon/Carbon.h>
+#import <WebKitSystemInterface.h>
+#import <stdio.h>
+#import <objc/objc-runtime.h>
+
+#define DYLD_INTERPOSE(_replacement,_replacee) \
+    __attribute__((used)) static struct{ const void* replacement; const void* replacee; } _interpose_##_replacee \
+    __attribute__ ((section ("__DATA,__interpose"))) = { (const void*)(unsigned long)&_replacement, (const void*)(unsigned long)&_replacee };
+
+namespace WebKit {
+
+extern "C" void WebKitPluginProcessShimInitialize(const PluginProcessShimCallbacks& callbacks);
+
+static PluginProcessShimCallbacks pluginProcessShimCallbacks;
+
+static IMP NSApplication_RunModalForWindow;
+static unsigned modalCount = 0;
+
+static void beginModal()
+{
+    // Make sure to make ourselves the front process
+    ProcessSerialNumber psn;
+    GetCurrentProcess(&psn);
+    SetFrontProcess(&psn);
+    
+    if (!modalCount++)
+        pluginProcessShimCallbacks.setModal(true);
+}
+
+static void endModal()
+{
+    if (!--modalCount)
+        pluginProcessShimCallbacks.setModal(false);
+}    
+
+static NSInteger shim_NSApplication_RunModalForWindow(id self, SEL _cmd, NSWindow* window)
+{
+    beginModal();
+    NSInteger result = ((NSInteger (*)(id, SEL, NSWindow *))NSApplication_RunModalForWindow)(self, _cmd, window);
+    endModal();
+
+    return result;
+}
+
+#ifndef __LP64__
+static void shimDebugger(void)
+{
+    if (!pluginProcessShimCallbacks.shouldCallRealDebugger())
+        return;
+    
+    Debugger();
+}
+
+static UInt32 shimGetCurrentEventButtonState()
+{
+    return pluginProcessShimCallbacks.getCurrentEventButtonState();
+}
+
+static Boolean shimIsWindowActive(WindowRef window)
+{
+    bool result;
+    if (pluginProcessShimCallbacks.isWindowActive(window, result))
+        return result;
+    
+    return IsWindowActive(window);
+}
+
+static void shimModalDialog(ModalFilterUPP modalFilter, DialogItemIndex *itemHit)
+{
+    beginModal();
+    ModalDialog(modalFilter, itemHit);
+    endModal();
+}
+
+static DialogItemIndex shimAlert(SInt16 alertID, ModalFilterUPP modalFilter)
+{
+    beginModal();
+    DialogItemIndex index = Alert(alertID, modalFilter);
+    endModal();
+    
+    return index;
+}
+
+static void shimShowWindow(WindowRef window)
+{
+    pluginProcessShimCallbacks.carbonWindowShown(window);
+    ShowWindow(window);
+}
+
+static void shimHideWindow(WindowRef window)
+{
+    pluginProcessShimCallbacks.carbonWindowHidden(window);
+    HideWindow(window);
+}
+
+static bool isMenuBarVisible = true;
+
+static void shimShowMenuBar(void)
+{
+    isMenuBarVisible = true;
+
+    ShowMenuBar();
+}
+
+static void shimHideMenuBar(void)
+{
+    isMenuBarVisible = false;
+
+    // Make sure to make ourselves the front process
+    ProcessSerialNumber psn;
+    GetCurrentProcess(&psn);
+    SetFrontProcess(&psn);
+    
+    HideMenuBar();
+}
+
+static Boolean shimIsMenuBarVisible(void)
+{
+    return isMenuBarVisible;
+}
+
+DYLD_INTERPOSE(shimDebugger, Debugger);
+DYLD_INTERPOSE(shimGetCurrentEventButtonState, GetCurrentEventButtonState);
+DYLD_INTERPOSE(shimIsWindowActive, IsWindowActive);
+DYLD_INTERPOSE(shimModalDialog, ModalDialog);
+DYLD_INTERPOSE(shimAlert, Alert);
+DYLD_INTERPOSE(shimShowWindow, ShowWindow);
+DYLD_INTERPOSE(shimHideWindow, HideWindow);
+DYLD_INTERPOSE(shimShowMenuBar, ShowMenuBar)
+DYLD_INTERPOSE(shimHideMenuBar, HideMenuBar)
+DYLD_INTERPOSE(shimIsMenuBarVisible, IsMenuBarVisible);
+
+#endif
+
+__attribute__((visibility("default")))
+void WebKitPluginProcessShimInitialize(const PluginProcessShimCallbacks& callbacks)
+{
+    pluginProcessShimCallbacks = callbacks;
+
+    // Override -[NSApplication runModalForWindow:]
+    Method runModalForWindowMethod = class_getInstanceMethod(objc_getClass("NSApplication"), @selector(runModalForWindow:));
+    NSApplication_RunModalForWindow = method_setImplementation(runModalForWindowMethod, reinterpret_cast<IMP>(shim_NSApplication_RunModalForWindow));
+
+    NSNotificationCenter *defaultCenter = [NSNotificationCenter defaultCenter];
+
+    // Track when any Cocoa window is about to be be shown.
+    id orderOnScreenObserver = [defaultCenter addObserverForName:WKWindowWillOrderOnScreenNotification()
+                                                          object:nil
+                                                           queue:nil
+                                                           usingBlock:^(NSNotification *notification) { pluginProcessShimCallbacks.cocoaWindowShown([notification object]); }];
+    // Track when any cocoa window is about to be hidden.
+    id orderOffScreenObserver = [defaultCenter addObserverForName:WKWindowWillOrderOffScreenNotification()
+                                                           object:nil
+                                                            queue:nil
+                                                       usingBlock:^(NSNotification *notification) { pluginProcessShimCallbacks.cocoaWindowHidden([notification object]); }];
+
+    // Leak the two observers so that they observe notifications for the lifetime of the process.
+    CFRetain(orderOnScreenObserver);
+    CFRetain(orderOffScreenObserver);
+}
+
+} // namespace WebKit
diff --git a/Source/WebKit2/Scripts/generate-forwarding-headers.pl b/Source/WebKit2/Scripts/generate-forwarding-headers.pl
index 5a53d81..43425ef 100755
--- a/Source/WebKit2/Scripts/generate-forwarding-headers.pl
+++ b/Source/WebKit2/Scripts/generate-forwarding-headers.pl
@@ -64,7 +64,7 @@ foreach (@frameworks) {
 sub collectNeededHeaders {
     my $filePath = $File::Find::name;
     my $file = $_;
-    if ($filePath =~ '\.h$|\.cpp$') {
+    if ($filePath =~ '\.h$|\.cpp$|\.c$') {
         open(FILE, "<$file") or die "Could not open $filePath.\n";
         while (<FILE>) {
            if (m/^#.*<$framework\/(.*\.h)/) {
diff --git a/Source/WebKit2/Scripts/webkit2/messages.py b/Source/WebKit2/Scripts/webkit2/messages.py
index 1c6ae97..159ca32 100644
--- a/Source/WebKit2/Scripts/webkit2/messages.py
+++ b/Source/WebKit2/Scripts/webkit2/messages.py
@@ -89,6 +89,9 @@ class MessageReceiver(object):
                 else:
                     parameters = []
 
+                for parameter in parameters:
+                    parameter.condition = condition
+
                 delayed = delayed_string == 'delayed'
 
                 if reply_parameters_string:
@@ -120,9 +123,10 @@ class Message(object):
 
 
 class Parameter(object):
-    def __init__(self, type, name):
+    def __init__(self, type, name, condition=None):
         self.type = type
         self.name = name
+        self.condition = condition
 
 
 def parse_parameter_string(parameter_string):
@@ -362,6 +366,8 @@ def generate_messages_header(file):
 
 
 def handler_function(receiver, message):
+    if message.name.find('URL') == 0:
+        return '%s::%s' % (receiver.name, 'url' + message.name[3:])
     return '%s::%s' % (receiver.name, message.name[0].lower() + message.name[1:])
 
 
@@ -449,21 +455,35 @@ def headers_for_type(type):
 
 def generate_message_handler(file):
     receiver = MessageReceiver.parse(file)
-    headers = set([
-        '"%s"' % messages_header_filename(receiver),
-        '"HandleMessage.h"',
-        '"ArgumentDecoder.h"',
-    ])
+    headers = {
+        '"%s"' % messages_header_filename(receiver): None,
+        '"HandleMessage.h"': None,
+        '"ArgumentDecoder.h"': None,
+    }
 
+    type_conditions = {}
     for parameter in receiver.iterparameters():
         type = parameter.type
+        condition = parameter.condition
+
+        if type in type_conditions:
+            if not type_conditions[type]:
+                condition = type_conditions[type]
+            else:
+                if not condition:
+                    type_conditions[type] = condition
+        else:
+            type_conditions[type] = condition
+
         argument_encoder_headers = argument_coder_headers_for_type(parameter.type)
         if argument_encoder_headers:
-            headers.update(argument_encoder_headers)
+            for header in argument_encoder_headers:
+                headers[header] = condition
             continue
 
         type_headers = headers_for_type(type)
-        headers.update(type_headers)
+        for header in type_headers:
+            headers[header] = condition
 
     for message in receiver.messages:
         if message.reply_parameters is not None:
@@ -471,11 +491,13 @@ def generate_message_handler(file):
                 type = reply_parameter.type
                 argument_encoder_headers = argument_coder_headers_for_type(type)
                 if argument_encoder_headers:
-                    headers.update(argument_encoder_headers)
+                    for header in argument_encoder_headers:
+                        headers[header] = message.condition
                     continue
 
                 type_headers = headers_for_type(type)
-                headers.update(type_headers)
+                for header in type_headers:
+                    headers[header] = message.condition
 
     result = []
 
@@ -487,7 +509,13 @@ def generate_message_handler(file):
         result.append('#if %s\n\n' % receiver.condition)
 
     result.append('#include "%s.h"\n\n' % receiver.name)
-    result += ['#include %s\n' % header for header in sorted(headers)]
+    for headercondition in sorted(headers):
+        if headers[headercondition]:
+            result.append('#if %s\n' % headers[headercondition])
+            result += ['#include %s\n' % headercondition]
+            result.append('#endif\n')
+        else:
+            result += ['#include %s\n' % headercondition]
     result.append('\n')
 
     result.append('namespace WebKit {\n\n')
diff --git a/Source/WebKit2/Scripts/webkit2/messages_unittest.py b/Source/WebKit2/Scripts/webkit2/messages_unittest.py
index 8ed8cee..90d59ae 100644
--- a/Source/WebKit2/Scripts/webkit2/messages_unittest.py
+++ b/Source/WebKit2/Scripts/webkit2/messages_unittest.py
@@ -68,7 +68,9 @@ messages -> WebPage {
     GetPlugins(bool refresh) -> (Vector<WebCore::PluginInfo> plugins)
     GetPluginProcessConnection(WTF::String pluginPath) -> (CoreIPC::Connection::Handle connectionHandle) delayed
 
+#if PLATFORM(MAC)
     DidCreateWebProcessConnection(CoreIPC::MachPort connectionIdentifier)
+#endif
 
 #if PLATFORM(MAC)
     # Keyboard support
@@ -179,7 +181,7 @@ _expected_results = {
             'parameters': (
                 ('CoreIPC::MachPort', 'connectionIdentifier'),
             ),
-            'condition': None,
+            'condition': 'PLATFORM(MAC)',
         },
         {
             'name': 'InterpretKeyEvent',
@@ -291,7 +293,9 @@ enum Kind {
     RunJavaScriptAlertID,
     GetPluginsID,
     GetPluginProcessConnectionID,
+#if PLATFORM(MAC)
     DidCreateWebProcessConnectionID,
+#endif
 #if PLATFORM(MAC)
     InterpretKeyEventID,
 #endif
@@ -418,6 +422,7 @@ struct GetPluginProcessConnection : CoreIPC::Arguments1<const WTF::String&> {
     }
 };
 
+#if PLATFORM(MAC)
 struct DidCreateWebProcessConnection : CoreIPC::Arguments1<const CoreIPC::MachPort&> {
     static const Kind messageID = DidCreateWebProcessConnectionID;
     typedef CoreIPC::Arguments1<const CoreIPC::MachPort&> DecodeType;
@@ -426,6 +431,7 @@ struct DidCreateWebProcessConnection : CoreIPC::Arguments1<const CoreIPC::MachPo
     {
     }
 };
+#endif
 
 #if PLATFORM(MAC)
 struct InterpretKeyEvent : CoreIPC::Arguments1<uint32_t> {
@@ -486,14 +492,22 @@ _expected_receiver_implementation = """/*
 
 #include "WebPage.h"
 
+#if PLATFORM(MAC)
 #include "ArgumentCoders.h"
+#endif
 #include "ArgumentDecoder.h"
 #include "Connection.h"
 #include "HandleMessage.h"
+#if PLATFORM(MAC)
 #include "MachPort.h"
+#endif
 #include "Plugin.h"
+#if PLATFORM(MAC)
 #include "WebCoreArgumentCoders.h"
+#endif
+#if ENABLE(TOUCH_EVENTS)
 #include "WebEvent.h"
+#endif
 #include "WebPageMessages.h"
 #include "WebPreferencesStore.h"
 
@@ -525,9 +539,11 @@ void WebPage::didReceiveWebPageMessage(CoreIPC::Connection*, CoreIPC::MessageID
     case Messages::WebPage::SendIntsID:
         CoreIPC::handleMessage<Messages::WebPage::SendInts>(arguments, this, &WebPage::sendInts);
         return;
+#if PLATFORM(MAC)
     case Messages::WebPage::DidCreateWebProcessConnectionID:
         CoreIPC::handleMessage<Messages::WebPage::DidCreateWebProcessConnection>(arguments, this, &WebPage::didCreateWebProcessConnection);
         return;
+#endif
     default:
         break;
     }
diff --git a/Source/WebKit2/Shared/API/c/WKBase.h b/Source/WebKit2/Shared/API/c/WKBase.h
index 900cd51..1baa872 100644
--- a/Source/WebKit2/Shared/API/c/WKBase.h
+++ b/Source/WebKit2/Shared/API/c/WKBase.h
@@ -84,8 +84,10 @@ typedef const struct OpaqueWKFramePolicyListener* WKFramePolicyListenerRef;
 typedef const struct OpaqueWKGeolocationManager* WKGeolocationManagerRef;
 typedef const struct OpaqueWKGeolocationPermissionRequest* WKGeolocationPermissionRequestRef;
 typedef const struct OpaqueWKGeolocationPosition* WKGeolocationPositionRef;
+typedef const struct OpaqueWKIconDatabase* WKIconDatabaseRef;
 typedef const struct OpaqueWKInspector* WKInspectorRef;
 typedef const struct OpaqueWKKeyValueStorageManager* WKKeyValueStorageManagerRef;
+typedef const struct OpaqueWKMediaCacheManager* WKMediaCacheManagerRef;
 typedef const struct OpaqueWKNavigationData* WKNavigationDataRef;
 typedef const struct OpaqueWKOpenPanelParameters* WKOpenPanelParametersRef;
 typedef const struct OpaqueWKOpenPanelResultListener* WKOpenPanelResultListenerRef;
diff --git a/Source/WebKit2/Shared/API/c/WKMutableDictionary.cpp b/Source/WebKit2/Shared/API/c/WKMutableDictionary.cpp
index 0d96ca1..ecd680c 100644
--- a/Source/WebKit2/Shared/API/c/WKMutableDictionary.cpp
+++ b/Source/WebKit2/Shared/API/c/WKMutableDictionary.cpp
@@ -51,3 +51,8 @@ bool WKDictionarySetItem(WKMutableDictionaryRef dictionaryRef, WKStringRef keyRe
 {
     return toImpl(dictionaryRef)->set(toImpl(keyRef)->string(), toImpl(itemRef));
 }
+
+void WKDictionaryRemoveItem(WKMutableDictionaryRef dictionaryRef, WKStringRef keyRef)
+{
+    toImpl(dictionaryRef)->remove(toImpl(keyRef)->string());
+}
diff --git a/Source/WebKit2/Shared/API/c/WKMutableDictionary.h b/Source/WebKit2/Shared/API/c/WKMutableDictionary.h
index 467c1d4..2459f91 100644
--- a/Source/WebKit2/Shared/API/c/WKMutableDictionary.h
+++ b/Source/WebKit2/Shared/API/c/WKMutableDictionary.h
@@ -42,6 +42,7 @@ WK_EXPORT bool WKDictionaryIsMutable(WKDictionaryRef dictionary);
 
 WK_EXPORT bool WKDictionaryAddItem(WKMutableDictionaryRef dictionary, WKStringRef key, WKTypeRef item);
 WK_EXPORT bool WKDictionarySetItem(WKMutableDictionaryRef dictionary, WKStringRef key, WKTypeRef item);
+WK_EXPORT void WKDictionaryRemoveItem(WKMutableDictionaryRef dictionary, WKStringRef key);
 
 #ifdef __cplusplus
 }
diff --git a/Source/WebKit2/Shared/API/c/WKString.cpp b/Source/WebKit2/Shared/API/c/WKString.cpp
index 72841a4..0c388c6 100644
--- a/Source/WebKit2/Shared/API/c/WKString.cpp
+++ b/Source/WebKit2/Shared/API/c/WKString.cpp
@@ -67,6 +67,11 @@ bool WKStringIsEqualToUTF8CString(WKStringRef aRef, const char* b)
     return toImpl(aRef)->equalToUTF8String(b);
 }
 
+bool WKStringIsEqualToUTF8CStringIgnoringCase(WKStringRef aRef, const char* b)
+{
+    return toImpl(aRef)->equalToUTF8StringIgnoringCase(b);
+}
+
 WKStringRef WKStringCreateWithJSString(JSStringRef jsStringRef)
 {
     RefPtr<WebString> webString = WebString::create(jsStringRef);
diff --git a/Source/WebKit2/Shared/API/c/WKString.h b/Source/WebKit2/Shared/API/c/WKString.h
index e79839e..dffcab2 100644
--- a/Source/WebKit2/Shared/API/c/WKString.h
+++ b/Source/WebKit2/Shared/API/c/WKString.h
@@ -47,6 +47,7 @@ WK_EXPORT size_t WKStringGetUTF8CString(WKStringRef string, char* buffer, size_t
 
 WK_EXPORT bool WKStringIsEqual(WKStringRef a, WKStringRef b);
 WK_EXPORT bool WKStringIsEqualToUTF8CString(WKStringRef a, const char* b);
+WK_EXPORT bool WKStringIsEqualToUTF8CStringIgnoringCase(WKStringRef a, const char* b);
 
 #ifdef __cplusplus
 }
diff --git a/Source/WebKit2/Shared/API/c/WKURL.cpp b/Source/WebKit2/Shared/API/c/WKURL.cpp
index 6b7e567..dacd589 100644
--- a/Source/WebKit2/Shared/API/c/WKURL.cpp
+++ b/Source/WebKit2/Shared/API/c/WKURL.cpp
@@ -49,3 +49,13 @@ bool WKURLIsEqual(WKURLRef a, WKURLRef b)
 {
     return toImpl(a)->string() == toImpl(b)->string();
 }
+
+WKStringRef WKURLCopyHostName(WKURLRef url)
+{
+    return toCopiedAPI(toImpl(url)->host());
+}
+
+WKStringRef WKURLCopyScheme(WKURLRef url)
+{
+    return toCopiedAPI(toImpl(url)->protocol());
+}
diff --git a/Source/WebKit2/Shared/API/c/WKURL.h b/Source/WebKit2/Shared/API/c/WKURL.h
index 738bce5..f599f16 100644
--- a/Source/WebKit2/Shared/API/c/WKURL.h
+++ b/Source/WebKit2/Shared/API/c/WKURL.h
@@ -36,7 +36,9 @@ WK_EXPORT WKTypeID WKURLGetTypeID();
 
 WK_EXPORT WKURLRef WKURLCreateWithUTF8CString(const char* string);
 
-WK_EXPORT WKStringRef WKURLCopyString(WKURLRef URL);
+WK_EXPORT WKStringRef WKURLCopyString(WKURLRef url);
+WK_EXPORT WKStringRef WKURLCopyHostName(WKURLRef url);
+WK_EXPORT WKStringRef WKURLCopyScheme(WKURLRef url);
 
 WK_EXPORT bool WKURLIsEqual(WKURLRef a, WKURLRef b);
 
diff --git a/Source/WebKit2/Shared/API/c/cf/WKErrorCF.cpp b/Source/WebKit2/Shared/API/c/cf/WKErrorCF.cpp
new file mode 100644
index 0000000..95a1b43
--- /dev/null
+++ b/Source/WebKit2/Shared/API/c/cf/WKErrorCF.cpp
@@ -0,0 +1,45 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WKErrorCF.h"
+
+#include "WKAPICast.h"
+#include "WebError.h"
+
+using namespace WebCore;
+using namespace WebKit;
+
+WKErrorRef WKErrorCreateWithCFError(CFErrorRef cfError)
+{
+    RefPtr<WebError> error = WebError::create(ResourceError(cfError));
+    return toAPI(error.release().releaseRef());
+}
+
+CFErrorRef WKErrorCopyCFError(CFAllocatorRef alloc, WKErrorRef error)
+{
+    RetainPtr<CFErrorRef> cfError = toImpl(error)->platformError().cfError();
+    return cfError.leakRef();
+}
diff --git a/Source/WebKit2/Shared/API/c/cf/WKErrorCF.h b/Source/WebKit2/Shared/API/c/cf/WKErrorCF.h
new file mode 100644
index 0000000..298f7c2
--- /dev/null
+++ b/Source/WebKit2/Shared/API/c/cf/WKErrorCF.h
@@ -0,0 +1,43 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WKErrorCF_h
+#define WKErrorCF_h
+
+#include <CoreFoundation/CoreFoundation.h>
+#include <WebKit2/WKBase.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+WK_EXPORT WKErrorRef WKErrorCreateWithCFError(CFErrorRef error);
+WK_EXPORT CFErrorRef WKErrorCopyCFError(CFAllocatorRef alloc, WKErrorRef error);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* WKErrorCF_h */
diff --git a/Source/WebKit2/Shared/API/c/cf/WKURLResponseCF.cpp b/Source/WebKit2/Shared/API/c/cf/WKURLResponseCF.cpp
index 42473c8..10b4941 100644
--- a/Source/WebKit2/Shared/API/c/cf/WKURLResponseCF.cpp
+++ b/Source/WebKit2/Shared/API/c/cf/WKURLResponseCF.cpp
@@ -33,6 +33,9 @@ using namespace WebKit;
 
 WKURLResponseRef WKURLResponseCreateWithCFURLResponse(CFURLResponseRef urlResponse)
 {
+    if (!urlResponse)
+        return 0;
+
     CFURLResponseRef copiedURLResponse = CFURLResponseCreateCopy(kCFAllocatorDefault, urlResponse);
     RefPtr<WebURLResponse> response = WebURLResponse::create(copiedURLResponse);
     return toAPI(response.release().releaseRef());
@@ -40,5 +43,12 @@ WKURLResponseRef WKURLResponseCreateWithCFURLResponse(CFURLResponseRef urlRespon
 
 CFURLResponseRef WKURLResponseCopyCFURLResponse(CFAllocatorRef alloc, WKURLResponseRef urlResponse)
 {
+    if (!urlResponse)
+        return 0;
+
+    PlatformResponse platformURLResponse = toImpl(urlResponse)->platformResponse();
+    if (!platformURLResponse)
+        return 0;
+
     return CFURLResponseCreateCopy(alloc, toImpl(urlResponse)->platformResponse());
 }
diff --git a/Source/WebKit2/Shared/API/c/cg/WKImageCG.cpp b/Source/WebKit2/Shared/API/c/cg/WKImageCG.cpp
index 61b5f17..7af747e 100644
--- a/Source/WebKit2/Shared/API/c/cg/WKImageCG.cpp
+++ b/Source/WebKit2/Shared/API/c/cg/WKImageCG.cpp
@@ -36,6 +36,14 @@ using namespace WebCore;
 
 CGImageRef WKImageCreateCGImage(WKImageRef imageRef)
 {
-    OwnPtr<GraphicsContext> sourceContext = toImpl(imageRef)->bitmap()->createGraphicsContext();
-    return CGBitmapContextCreateImage(sourceContext->platformContext());
+    return toImpl(imageRef)->bitmap()->makeCGImageCopy().leakRef();
+}
+
+WKImageRef WKImageCreateFromCGImage(CGImageRef imageRef, WKImageOptions options)
+{
+    IntSize imageSize(CGImageGetWidth(imageRef), CGImageGetHeight(imageRef));
+    RefPtr<WebImage> webImage = WebImage::create(imageSize, toImageOptions(options));
+    OwnPtr<GraphicsContext> graphicsContext = webImage->bitmap()->createGraphicsContext();
+    CGContextDrawImage(graphicsContext->platformContext(), CGRectMake(0, 0, imageSize.width(), imageSize.height()), imageRef);
+    return toAPI(webImage.release().leakRef());
 }
diff --git a/Source/WebKit2/Shared/API/c/cg/WKImageCG.h b/Source/WebKit2/Shared/API/c/cg/WKImageCG.h
index 7705c31..800b02e 100644
--- a/Source/WebKit2/Shared/API/c/cg/WKImageCG.h
+++ b/Source/WebKit2/Shared/API/c/cg/WKImageCG.h
@@ -28,6 +28,7 @@
 
 #include <CoreGraphics/CGImage.h>
 #include <WebKit2/WKBase.h>
+#include <WebKit2/WKImage.h>
 
 #ifdef __cplusplus
 extern "C" {
@@ -35,6 +36,8 @@ extern "C" {
 
 WK_EXPORT CGImageRef WKImageCreateCGImage(WKImageRef image);
 
+WK_EXPORT WKImageRef WKImageCreateFromCGImage(CGImageRef imageRef, WKImageOptions options);
+
 #ifdef __cplusplus
 }
 #endif
diff --git a/Source/WebKit2/Shared/API/c/mac/WKCertificateInfoMac.h b/Source/WebKit2/Shared/API/c/mac/WKCertificateInfoMac.h
index 7d44478..d098f34 100644
--- a/Source/WebKit2/Shared/API/c/mac/WKCertificateInfoMac.h
+++ b/Source/WebKit2/Shared/API/c/mac/WKCertificateInfoMac.h
@@ -33,6 +33,7 @@
 extern "C" {
 #endif
 
+WK_EXPORT WKCertificateInfoRef WKCertificateInfoCreateWithCertficateChain(CFArrayRef certificateChain);
 WK_EXPORT CFArrayRef WKCertificateInfoGetCertificateChain(WKCertificateInfoRef certificateInfo);
 
 #ifdef __cplusplus
diff --git a/Source/WebKit2/Shared/API/c/mac/WKCertificateInfoMac.mm b/Source/WebKit2/Shared/API/c/mac/WKCertificateInfoMac.mm
index a2f348d..34dd431 100644
--- a/Source/WebKit2/Shared/API/c/mac/WKCertificateInfoMac.mm
+++ b/Source/WebKit2/Shared/API/c/mac/WKCertificateInfoMac.mm
@@ -31,6 +31,12 @@
 
 using namespace WebKit;
 
+WKCertificateInfoRef WKCertificateInfoCreateWithCertficateChain(CFArrayRef certificateChain)
+{
+    RefPtr<WebCertificateInfo> certificateInfo = WebCertificateInfo::create(PlatformCertificateInfo(certificateChain));
+    return toAPI(certificateInfo.release().leakRef());
+}
+
 CFArrayRef WKCertificateInfoGetCertificateChain(WKCertificateInfoRef certificateInfoRef)
 {
     return toImpl(certificateInfoRef)->platformCertificateInfo().certificateChain();
diff --git a/Source/WebKit2/Shared/API/c/win/WKBaseWin.h b/Source/WebKit2/Shared/API/c/win/WKBaseWin.h
index e2ee9a7..fdd4607 100644
--- a/Source/WebKit2/Shared/API/c/win/WKBaseWin.h
+++ b/Source/WebKit2/Shared/API/c/win/WKBaseWin.h
@@ -31,5 +31,6 @@
 #endif
 
 typedef const struct OpaqueWKView* WKViewRef;
+typedef const struct OpaqueWKEditCommand* WKEditCommandRef;
 
 #endif /* WKBaseWin_h */
diff --git a/Source/WebKit2/Shared/API/c/win/WKCertificateInfoWin.cpp b/Source/WebKit2/Shared/API/c/win/WKCertificateInfoWin.cpp
index ada20ef..674f94e 100644
--- a/Source/WebKit2/Shared/API/c/win/WKCertificateInfoWin.cpp
+++ b/Source/WebKit2/Shared/API/c/win/WKCertificateInfoWin.cpp
@@ -31,6 +31,11 @@
 
 using namespace WebKit;
 
+WKCertificateInfoRef WKCertificateInfoCreateWithCertificate(PCCERT_CONTEXT certificate)
+{
+    return toAPI(WebCertificateInfo::create(PlatformCertificateInfo(certificate)).leakRef());
+}
+
 size_t WKCertificateInfoGetCertificateChainLength(WKCertificateInfoRef certificateInfoRef)
 {
     return toImpl(certificateInfoRef)->platformCertificateInfo().certificateChain().size();
diff --git a/Source/WebKit2/Shared/API/c/win/WKCertificateInfoWin.h b/Source/WebKit2/Shared/API/c/win/WKCertificateInfoWin.h
index 0fcd818..a3ee9e5 100644
--- a/Source/WebKit2/Shared/API/c/win/WKCertificateInfoWin.h
+++ b/Source/WebKit2/Shared/API/c/win/WKCertificateInfoWin.h
@@ -33,6 +33,7 @@
 extern "C" {
 #endif
 
+WK_EXPORT WKCertificateInfoRef WKCertificateInfoCreateWithCertificate(PCCERT_CONTEXT certificate);
 WK_EXPORT size_t WKCertificateInfoGetCertificateChainLength(WKCertificateInfoRef certificateInfo);
 WK_EXPORT PCCERT_CONTEXT WKCertificateInfoGetCertificateContextAtIndex(WKCertificateInfoRef certificateInfo, size_t index);
 
diff --git a/Source/WebKit2/Shared/APIObject.h b/Source/WebKit2/Shared/APIObject.h
index 24f8cba..7f50b51 100644
--- a/Source/WebKit2/Shared/APIObject.h
+++ b/Source/WebKit2/Shared/APIObject.h
@@ -72,11 +72,14 @@ public:
         TypeFormSubmissionListener,
         TypeFrame,
         TypeFramePolicyListener,
+        TypeFullScreenManager,
         TypeGeolocationManager,
         TypeGeolocationPermissionRequest,
         TypeGeolocationPosition,
+        TypeIconDatabase,
         TypeInspector,
         TypeKeyValueStorageManager,
+        TypeMediaCacheManager,
         TypeNavigationData,
         TypeOpenPanelParameters,
         TypeOpenPanelResultListener,
@@ -101,7 +104,8 @@ public:
         TypeBundleScriptWorld,
 
         // Platform specific
-        TypeView
+        TypeView,
+        TypeEditCommandProxy
     };
 
     virtual ~APIObject()
diff --git a/Source/WebKit2/Shared/DictionaryPopupInfo.cpp b/Source/WebKit2/Shared/DictionaryPopupInfo.cpp
index 15cb306..45bf91d 100644
--- a/Source/WebKit2/Shared/DictionaryPopupInfo.cpp
+++ b/Source/WebKit2/Shared/DictionaryPopupInfo.cpp
@@ -28,6 +28,10 @@
 
 #include "WebCoreArgumentCoders.h"
 
+#if PLATFORM(MAC)
+#include "ArgumentCodersCF.h"
+#endif
+
 namespace WebKit {
 
 void DictionaryPopupInfo::encode(CoreIPC::ArgumentEncoder* encoder) const
@@ -35,6 +39,10 @@ void DictionaryPopupInfo::encode(CoreIPC::ArgumentEncoder* encoder) const
     encoder->encode(origin);
     encoder->encode(fontInfo);
     encoder->encodeEnum(type);
+
+#if PLATFORM(MAC)
+    CoreIPC::encode(encoder, options.get());
+#endif
 }
 
 bool DictionaryPopupInfo::decode(CoreIPC::ArgumentDecoder* decoder, DictionaryPopupInfo& result)
@@ -45,6 +53,10 @@ bool DictionaryPopupInfo::decode(CoreIPC::ArgumentDecoder* decoder, DictionaryPo
         return false;
     if (!decoder->decodeEnum(result.type))
         return false;
+#if PLATFORM(MAC)
+    if (!CoreIPC::decode(decoder, result.options))
+        return false;
+#endif
     return true;
 }
 
diff --git a/Source/WebKit2/Shared/DictionaryPopupInfo.h b/Source/WebKit2/Shared/DictionaryPopupInfo.h
index 5682fcd..68c81a7 100644
--- a/Source/WebKit2/Shared/DictionaryPopupInfo.h
+++ b/Source/WebKit2/Shared/DictionaryPopupInfo.h
@@ -29,6 +29,10 @@
 #include "FontInfo.h"
 #include <WebCore/FloatPoint.h>
 
+#if PLATFORM(MAC)
+#include <wtf/RetainPtr.h>
+#endif
+
 namespace CoreIPC {
     class ArgumentDecoder;
     class ArgumentEncoder;
@@ -48,6 +52,9 @@ struct DictionaryPopupInfo {
     WebCore::FloatPoint origin;
     FontInfo fontInfo;
     Type type;
+#if PLATFORM(MAC)
+    RetainPtr<CFDictionaryRef> options;
+#endif
 };
 
 } // namespace WebKit
diff --git a/Source/WebKit2/Shared/HTTPCookieAcceptPolicy.h b/Source/WebKit2/Shared/HTTPCookieAcceptPolicy.h
new file mode 100644
index 0000000..d7a645e
--- /dev/null
+++ b/Source/WebKit2/Shared/HTTPCookieAcceptPolicy.h
@@ -0,0 +1,40 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef HTTPCookieAcceptPolicy_h
+#define HTTPCookieAcceptPolicy_h
+
+namespace WebKit {
+
+enum {
+    HTTPCookieAcceptPolicyAlways = 0,
+    HTTPCookieAcceptPolicyNever = 1,
+    HTTPCookieAcceptPolicyOnlyFromMainDocumentDomain = 2,
+};
+typedef unsigned HTTPCookieAcceptPolicy;
+
+} // namespace WebKit
+
+#endif // HTTPCookieAcceptPolicy_h
diff --git a/Source/WebKit2/Shared/LayerTreeContext.h b/Source/WebKit2/Shared/LayerTreeContext.h
index e2938aa..233b7ae 100644
--- a/Source/WebKit2/Shared/LayerTreeContext.h
+++ b/Source/WebKit2/Shared/LayerTreeContext.h
@@ -26,13 +26,13 @@
 #ifndef LayerTreeContext_h
 #define LayerTreeContext_h
 
-#if USE(ACCELERATED_COMPOSITING)
-
 namespace CoreIPC {
     class ArgumentDecoder;
     class ArgumentEncoder;
 }
 
+#if USE(ACCELERATED_COMPOSITING)
+
 namespace WebKit {
 
 class LayerTreeContext {
diff --git a/Source/WebKit2/Shared/MutableDictionary.cpp b/Source/WebKit2/Shared/MutableDictionary.cpp
index 222caf3..2f905ec 100644
--- a/Source/WebKit2/Shared/MutableDictionary.cpp
+++ b/Source/WebKit2/Shared/MutableDictionary.cpp
@@ -48,4 +48,9 @@ bool MutableDictionary::set(const String& key, APIObject* item)
     return result.second;
 }
 
+void MutableDictionary::remove(const String& key)
+{
+    m_map.remove(key);
+}
+
 } // namespace WebKit
diff --git a/Source/WebKit2/Shared/MutableDictionary.h b/Source/WebKit2/Shared/MutableDictionary.h
index f5ee4e7..5898cb7 100644
--- a/Source/WebKit2/Shared/MutableDictionary.h
+++ b/Source/WebKit2/Shared/MutableDictionary.h
@@ -43,6 +43,7 @@ public:
 
     bool add(const String& key, APIObject*);
     bool set(const String& key, APIObject*);
+    void remove(const String& key);
 
     virtual bool isMutable() { return true; }
 
diff --git a/Source/WebKit2/Shared/PlatformPopupMenuData.cpp b/Source/WebKit2/Shared/PlatformPopupMenuData.cpp
index a5ebb45..1f56daf 100644
--- a/Source/WebKit2/Shared/PlatformPopupMenuData.cpp
+++ b/Source/WebKit2/Shared/PlatformPopupMenuData.cpp
@@ -51,13 +51,12 @@ void PlatformPopupMenuData::encode(CoreIPC::ArgumentEncoder* encoder) const
     encoder->encode(m_clientInsetRight);
     encoder->encode(m_popupWidth);
     encoder->encode(m_itemHeight);
-    encoder->encode(m_backingStoreSize);
 
-    SharedMemory::Handle notSelectedBackingStoreHandle;
+    ShareableBitmap::Handle notSelectedBackingStoreHandle;
     m_notSelectedBackingStore->createHandle(notSelectedBackingStoreHandle);
     encoder->encode(notSelectedBackingStoreHandle);
 
-    SharedMemory::Handle selectedBackingStoreHandle;
+    ShareableBitmap::Handle selectedBackingStoreHandle;
     m_selectedBackingStore->createHandle(selectedBackingStoreHandle);
     encoder->encode(selectedBackingStoreHandle);
 #elif PLATFORM(MAC)
@@ -80,18 +79,16 @@ bool PlatformPopupMenuData::decode(CoreIPC::ArgumentDecoder* decoder, PlatformPo
         return false;
     if (!decoder->decode(data.m_itemHeight))
         return false;
-    if (!decoder->decode(data.m_backingStoreSize))
-        return false;
 
-    SharedMemory::Handle notSelectedBackingStoreHandle;
+    ShareableBitmap::Handle notSelectedBackingStoreHandle;
     if (!decoder->decode(notSelectedBackingStoreHandle))
         return false;
-    data.m_notSelectedBackingStore = ShareableBitmap::create(data.m_backingStoreSize, notSelectedBackingStoreHandle);
+    data.m_notSelectedBackingStore = ShareableBitmap::create(notSelectedBackingStoreHandle);
 
-    SharedMemory::Handle selectedBackingStoreHandle;
+    ShareableBitmap::Handle selectedBackingStoreHandle;
     if (!decoder->decode(selectedBackingStoreHandle))
         return false;
-    data.m_selectedBackingStore = ShareableBitmap::create(data.m_backingStoreSize, selectedBackingStoreHandle);
+    data.m_selectedBackingStore = ShareableBitmap::create(selectedBackingStoreHandle);
 #elif PLATFORM(MAC)
     if (!decoder->decode(data.fontInfo))
         return false;
diff --git a/Source/WebKit2/Shared/PlatformPopupMenuData.h b/Source/WebKit2/Shared/PlatformPopupMenuData.h
index f79b4b2..5b3f58d 100644
--- a/Source/WebKit2/Shared/PlatformPopupMenuData.h
+++ b/Source/WebKit2/Shared/PlatformPopupMenuData.h
@@ -50,7 +50,6 @@ struct PlatformPopupMenuData {
     int m_clientInsetRight;
     int m_popupWidth;
     int m_itemHeight;
-    WebCore::IntSize m_backingStoreSize;
     RefPtr<ShareableBitmap> m_notSelectedBackingStore;
     RefPtr<ShareableBitmap> m_selectedBackingStore;
 #elif PLATFORM(MAC)
diff --git a/Source/WebKit2/Shared/Plugins/NPIdentifierData.h b/Source/WebKit2/Shared/Plugins/NPIdentifierData.h
index dbe979e..1a7c772 100644
--- a/Source/WebKit2/Shared/Plugins/NPIdentifierData.h
+++ b/Source/WebKit2/Shared/Plugins/NPIdentifierData.h
@@ -28,7 +28,7 @@
 
 #if ENABLE(PLUGIN_PROCESS)
 
-#include <WebCore/npruntime.h>
+#include <WebCore/npruntime_internal.h>
 #include <wtf/text/CString.h>
 
 namespace CoreIPC {
diff --git a/Source/WebKit2/Shared/Plugins/NPObjectMessageReceiver.cpp b/Source/WebKit2/Shared/Plugins/NPObjectMessageReceiver.cpp
index 2fd7244..46742af 100644
--- a/Source/WebKit2/Shared/Plugins/NPObjectMessageReceiver.cpp
+++ b/Source/WebKit2/Shared/Plugins/NPObjectMessageReceiver.cpp
@@ -33,21 +33,18 @@
 #include "NPRuntimeUtilities.h"
 #include "NPVariantData.h"
 
-// FIXME: This code shouldn't know about NPJSObject.
-#include "NPJSObject.h"
-
 namespace WebKit {
 
-PassOwnPtr<NPObjectMessageReceiver> NPObjectMessageReceiver::create(NPRemoteObjectMap* npRemoteObjectMap, uint64_t npObjectID, NPObject* npObject)
+PassOwnPtr<NPObjectMessageReceiver> NPObjectMessageReceiver::create(NPRemoteObjectMap* npRemoteObjectMap, Plugin* plugin, uint64_t npObjectID, NPObject* npObject)
 {
-    return adoptPtr(new NPObjectMessageReceiver(npRemoteObjectMap, npObjectID, npObject));
+    return adoptPtr(new NPObjectMessageReceiver(npRemoteObjectMap, plugin, npObjectID, npObject));
 }
 
-NPObjectMessageReceiver::NPObjectMessageReceiver(NPRemoteObjectMap* npRemoteObjectMap, uint64_t npObjectID, NPObject* npObject)
+NPObjectMessageReceiver::NPObjectMessageReceiver(NPRemoteObjectMap* npRemoteObjectMap, Plugin* plugin, uint64_t npObjectID, NPObject* npObject)
     : m_npRemoteObjectMap(npRemoteObjectMap)
+    , m_plugin(plugin)
     , m_npObjectID(npObjectID)
     , m_npObject(npObject)
-    , m_shouldReleaseObjectWhenInvalidating(!NPJSObject::isNPJSObject(npObject))
 {
     retainNPObject(m_npObject);
 }
@@ -56,13 +53,6 @@ NPObjectMessageReceiver::~NPObjectMessageReceiver()
 {
     m_npRemoteObjectMap->unregisterNPObject(m_npObjectID);
 
-    // If we're invalidating the remote object map, we don't always want to release the underlying NPObject.
-    // One example of this is NPJSObjects in the Web process, which have already been deallocated by the plug-in view.
-    // FIXME: This is not the ideal way to handle this. Maybe NPObjectMessageReceiver should be notified somehow when the underlying
-    // NPObject is deallocated.
-    if (m_npRemoteObjectMap->isInvalidating() && !m_shouldReleaseObjectWhenInvalidating)
-        return;
-
     releaseNPObject(m_npObject);
 }
 
@@ -90,7 +80,7 @@ void NPObjectMessageReceiver::invoke(const NPIdentifierData& methodNameData, con
 
     Vector<NPVariant> arguments;
     for (size_t i = 0; i < argumentsData.size(); ++i)
-        arguments.append(m_npRemoteObjectMap->npVariantDataToNPVariant(argumentsData[i]));
+        arguments.append(m_npRemoteObjectMap->npVariantDataToNPVariant(argumentsData[i], m_plugin));
 
     NPVariant result;
     VOID_TO_NPVARIANT(result);
@@ -98,7 +88,7 @@ void NPObjectMessageReceiver::invoke(const NPIdentifierData& methodNameData, con
     returnValue = m_npObject->_class->invoke(m_npObject, methodNameData.createNPIdentifier(), arguments.data(), arguments.size(), &result);
     if (returnValue) {
         // Convert the NPVariant to an NPVariantData.
-        resultData = m_npRemoteObjectMap->npVariantToNPVariantData(result);
+        resultData = m_npRemoteObjectMap->npVariantToNPVariantData(result, m_plugin);
     }
 
     // Release all arguments.
@@ -118,7 +108,7 @@ void NPObjectMessageReceiver::invokeDefault(const Vector<NPVariantData>& argumen
 
     Vector<NPVariant> arguments;
     for (size_t i = 0; i < argumentsData.size(); ++i)
-        arguments.append(m_npRemoteObjectMap->npVariantDataToNPVariant(argumentsData[i]));
+        arguments.append(m_npRemoteObjectMap->npVariantDataToNPVariant(argumentsData[i], m_plugin));
 
     NPVariant result;
     VOID_TO_NPVARIANT(result);
@@ -126,7 +116,7 @@ void NPObjectMessageReceiver::invokeDefault(const Vector<NPVariantData>& argumen
     returnValue = m_npObject->_class->invokeDefault(m_npObject, arguments.data(), arguments.size(), &result);
     if (returnValue) {
         // Convert the NPVariant to an NPVariantData.
-        resultData = m_npRemoteObjectMap->npVariantToNPVariantData(result);
+        resultData = m_npRemoteObjectMap->npVariantToNPVariantData(result, m_plugin);
     }
 
     // Release all arguments.
@@ -160,7 +150,7 @@ void NPObjectMessageReceiver::getProperty(const NPIdentifierData& propertyNameDa
         return;
 
     // Convert the NPVariant to an NPVariantData.
-    resultData = m_npRemoteObjectMap->npVariantToNPVariantData(result);
+    resultData = m_npRemoteObjectMap->npVariantToNPVariantData(result, m_plugin);
 
     // And release the result.
     releaseNPVariantValue(&result);
@@ -173,7 +163,7 @@ void NPObjectMessageReceiver::setProperty(const NPIdentifierData& propertyNameDa
         return;
     }
 
-    NPVariant propertyValue = m_npRemoteObjectMap->npVariantDataToNPVariant(propertyValueData);
+    NPVariant propertyValue = m_npRemoteObjectMap->npVariantDataToNPVariant(propertyValueData, m_plugin);
 
     // Set the property.
     returnValue = m_npObject->_class->setProperty(m_npObject, propertyNameData.createNPIdentifier(), &propertyValue);
@@ -221,7 +211,7 @@ void NPObjectMessageReceiver::construct(const Vector<NPVariantData>& argumentsDa
 
     Vector<NPVariant> arguments;
     for (size_t i = 0; i < argumentsData.size(); ++i)
-        arguments.append(m_npRemoteObjectMap->npVariantDataToNPVariant(argumentsData[i]));
+        arguments.append(m_npRemoteObjectMap->npVariantDataToNPVariant(argumentsData[i], m_plugin));
 
     NPVariant result;
     VOID_TO_NPVARIANT(result);
@@ -229,7 +219,7 @@ void NPObjectMessageReceiver::construct(const Vector<NPVariantData>& argumentsDa
     returnValue = m_npObject->_class->construct(m_npObject, arguments.data(), arguments.size(), &result);
     if (returnValue) {
         // Convert the NPVariant to an NPVariantData.
-        resultData = m_npRemoteObjectMap->npVariantToNPVariantData(result);
+        resultData = m_npRemoteObjectMap->npVariantToNPVariantData(result, m_plugin);
     }
 
     // Release all arguments.
diff --git a/Source/WebKit2/Shared/Plugins/NPObjectMessageReceiver.h b/Source/WebKit2/Shared/Plugins/NPObjectMessageReceiver.h
index cfb66e1..22352d2 100644
--- a/Source/WebKit2/Shared/Plugins/NPObjectMessageReceiver.h
+++ b/Source/WebKit2/Shared/Plugins/NPObjectMessageReceiver.h
@@ -38,20 +38,22 @@ namespace WebKit {
 class NPIdentifierData;
 class NPRemoteObjectMap;
 class NPVariantData;
+class Plugin;
 
 class NPObjectMessageReceiver {
     WTF_MAKE_NONCOPYABLE(NPObjectMessageReceiver);
 
 public:
-    static PassOwnPtr<NPObjectMessageReceiver> create(NPRemoteObjectMap* npRemoteObjectMap, uint64_t npObjectID, NPObject* npObject);
+    static PassOwnPtr<NPObjectMessageReceiver> create(NPRemoteObjectMap*, Plugin*, uint64_t npObjectID, NPObject*);
     ~NPObjectMessageReceiver();
 
     CoreIPC::SyncReplyMode didReceiveSyncNPObjectMessageReceiverMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::ArgumentDecoder*, CoreIPC::ArgumentEncoder*);
 
+    Plugin* plugin() const { return m_plugin; }
     NPObject* npObject() const { return m_npObject; }
     
 private:
-    NPObjectMessageReceiver(NPRemoteObjectMap* npRemoteObjectMap, uint64_t npObjectID, NPObject* npObject);
+    NPObjectMessageReceiver(NPRemoteObjectMap*, Plugin*, uint64_t npObjectID, NPObject*);
 
     // Message handlers.
     void deallocate();
@@ -66,9 +68,9 @@ private:
     void construct(const Vector<NPVariantData>& argumentsData, bool& returnValue, NPVariantData& resultData);
 
     NPRemoteObjectMap* m_npRemoteObjectMap;
+    Plugin* m_plugin;
     uint64_t m_npObjectID;
     NPObject* m_npObject;
-    bool m_shouldReleaseObjectWhenInvalidating;
 };
     
 } // namespace WebKit
diff --git a/Source/WebKit2/Shared/Plugins/NPObjectProxy.cpp b/Source/WebKit2/Shared/Plugins/NPObjectProxy.cpp
index 04a6e7d..61daa6c 100644
--- a/Source/WebKit2/Shared/Plugins/NPObjectProxy.cpp
+++ b/Source/WebKit2/Shared/Plugins/NPObjectProxy.cpp
@@ -38,16 +38,17 @@
 
 namespace WebKit {
 
-NPObjectProxy* NPObjectProxy::create(NPRemoteObjectMap* npRemoteObjectMap, uint64_t npObjectID)
+NPObjectProxy* NPObjectProxy::create(NPRemoteObjectMap* npRemoteObjectMap, Plugin* plugin, uint64_t npObjectID)
 {
     NPObjectProxy* npObjectProxy = toNPObjectProxy(createNPObject(0, npClass()));
-    npObjectProxy->initialize(npRemoteObjectMap, npObjectID);
+    npObjectProxy->initialize(npRemoteObjectMap, plugin, npObjectID);
 
     return npObjectProxy;
 }
 
 NPObjectProxy::NPObjectProxy()
     : m_npRemoteObjectMap(0)
+    , m_plugin(0)
     , m_npObjectID(0)
 {
 }
@@ -69,19 +70,24 @@ bool NPObjectProxy::isNPObjectProxy(NPObject* npObject)
 void NPObjectProxy::invalidate()
 {
     ASSERT(m_npRemoteObjectMap);
+    ASSERT(m_plugin);
 
     m_npRemoteObjectMap = 0;
+    m_plugin = 0;
 }
     
-void NPObjectProxy::initialize(NPRemoteObjectMap* npRemoteObjectMap, uint64_t npObjectID)
+void NPObjectProxy::initialize(NPRemoteObjectMap* npRemoteObjectMap, Plugin* plugin, uint64_t npObjectID)
 {
     ASSERT(!m_npRemoteObjectMap);
+    ASSERT(!m_plugin);
     ASSERT(!m_npObjectID);
 
     ASSERT(npRemoteObjectMap);
+    ASSERT(plugin);
     ASSERT(npObjectID);
 
     m_npRemoteObjectMap = npRemoteObjectMap;
+    m_plugin = plugin;
     m_npObjectID = npObjectID;
 }
 
@@ -108,7 +114,7 @@ bool NPObjectProxy::invoke(NPIdentifier methodName, const NPVariant* arguments,
     NPIdentifierData methodNameData = NPIdentifierData::fromNPIdentifier(methodName);
     Vector<NPVariantData> argumentsData;
     for (uint32_t i = 0; i < argumentCount; ++i)
-        argumentsData.append(m_npRemoteObjectMap->npVariantToNPVariantData(arguments[i]));
+        argumentsData.append(m_npRemoteObjectMap->npVariantToNPVariantData(arguments[i], m_plugin));
 
     bool returnValue = false;
     NPVariantData resultData;
@@ -119,7 +125,7 @@ bool NPObjectProxy::invoke(NPIdentifier methodName, const NPVariant* arguments,
     if (!returnValue)
         return false;
     
-    *result = m_npRemoteObjectMap->npVariantDataToNPVariant(resultData);
+    *result = m_npRemoteObjectMap->npVariantDataToNPVariant(resultData, m_plugin);
     return true;
 }
 
@@ -130,7 +136,7 @@ bool NPObjectProxy::invokeDefault(const NPVariant* arguments, uint32_t argumentC
 
     Vector<NPVariantData> argumentsData;
     for (uint32_t i = 0; i < argumentCount; ++i)
-        argumentsData.append(m_npRemoteObjectMap->npVariantToNPVariantData(arguments[i]));
+        argumentsData.append(m_npRemoteObjectMap->npVariantToNPVariantData(arguments[i], m_plugin));
 
     bool returnValue = false;
     NPVariantData resultData;
@@ -141,7 +147,7 @@ bool NPObjectProxy::invokeDefault(const NPVariant* arguments, uint32_t argumentC
     if (!returnValue)
         return false;
     
-    *result = m_npRemoteObjectMap->npVariantDataToNPVariant(resultData);
+    *result = m_npRemoteObjectMap->npVariantDataToNPVariant(resultData, m_plugin);
     return true;
 }
 
@@ -176,7 +182,7 @@ bool NPObjectProxy::getProperty(NPIdentifier propertyName, NPVariant* result)
     if (!returnValue)
         return false;
 
-    *result = m_npRemoteObjectMap->npVariantDataToNPVariant(resultData);
+    *result = m_npRemoteObjectMap->npVariantDataToNPVariant(resultData, m_plugin);
     return true;
 }
 
@@ -186,7 +192,7 @@ bool NPObjectProxy::setProperty(NPIdentifier propertyName, const NPVariant* valu
         return false;
     
     NPIdentifierData propertyNameData = NPIdentifierData::fromNPIdentifier(propertyName);
-    NPVariantData propertyValueData = m_npRemoteObjectMap->npVariantToNPVariantData(*value);
+    NPVariantData propertyValueData = m_npRemoteObjectMap->npVariantToNPVariantData(*value, m_plugin);
 
     bool returnValue = false;
 
@@ -242,7 +248,7 @@ bool NPObjectProxy::construct(const NPVariant* arguments, uint32_t argumentCount
 
     Vector<NPVariantData> argumentsData;
     for (uint32_t i = 0; i < argumentCount; ++i)
-        argumentsData.append(m_npRemoteObjectMap->npVariantToNPVariantData(arguments[i]));
+        argumentsData.append(m_npRemoteObjectMap->npVariantToNPVariantData(arguments[i], m_plugin));
 
     bool returnValue = false;
     NPVariantData resultData;
@@ -253,7 +259,7 @@ bool NPObjectProxy::construct(const NPVariant* arguments, uint32_t argumentCount
     if (!returnValue)
         return false;
     
-    *result = m_npRemoteObjectMap->npVariantDataToNPVariant(resultData);
+    *result = m_npRemoteObjectMap->npVariantDataToNPVariant(resultData, m_plugin);
     return true;
 }
 
diff --git a/Source/WebKit2/Shared/Plugins/NPObjectProxy.h b/Source/WebKit2/Shared/Plugins/NPObjectProxy.h
index e4c00c5..f472cb8 100644
--- a/Source/WebKit2/Shared/Plugins/NPObjectProxy.h
+++ b/Source/WebKit2/Shared/Plugins/NPObjectProxy.h
@@ -28,18 +28,19 @@
 
 #if ENABLE(PLUGIN_PROCESS)
 
-#include <WebCore/npruntime.h>
+#include <WebCore/npruntime_internal.h>
 #include <wtf/Noncopyable.h>
 
 namespace WebKit {
 
 class NPRemoteObjectMap;
+class Plugin;
 
 class NPObjectProxy : public NPObject {
     WTF_MAKE_NONCOPYABLE(NPObjectProxy);
 
 public:
-    static NPObjectProxy* create(NPRemoteObjectMap* npRemoteObjectMap, uint64_t npObjectID);
+    static NPObjectProxy* create(NPRemoteObjectMap*, Plugin*, uint64_t npObjectID);
 
     static bool isNPObjectProxy(NPObject*);
     
@@ -49,6 +50,7 @@ public:
         return static_cast<NPObjectProxy*>(npObject);
     }
 
+    Plugin* plugin() const { return m_plugin; }
     uint64_t npObjectID() const { return m_npObjectID; }
 
     void invalidate();
@@ -57,7 +59,7 @@ private:
     NPObjectProxy();
     ~NPObjectProxy();
 
-    void initialize(NPRemoteObjectMap* npRemoteObjectMap, uint64_t npObjectID);
+    void initialize(NPRemoteObjectMap*, Plugin*, uint64_t npObjectID);
 
     bool hasMethod(NPIdentifier methodName);
     bool invoke(NPIdentifier methodName, const NPVariant* arguments, uint32_t argumentCount, NPVariant* result);
@@ -83,6 +85,7 @@ private:
     static bool NP_Construct(NPObject*, const NPVariant* arguments, uint32_t argumentCount, NPVariant* result);
 
     NPRemoteObjectMap* m_npRemoteObjectMap;
+    Plugin* m_plugin;
     uint64_t m_npObjectID;
 };
     
diff --git a/Source/WebKit2/Shared/Plugins/NPRemoteObjectMap.cpp b/Source/WebKit2/Shared/Plugins/NPRemoteObjectMap.cpp
index 0e164f1..70978c5 100644
--- a/Source/WebKit2/Shared/Plugins/NPRemoteObjectMap.cpp
+++ b/Source/WebKit2/Shared/Plugins/NPRemoteObjectMap.cpp
@@ -50,7 +50,6 @@ PassRefPtr<NPRemoteObjectMap> NPRemoteObjectMap::create(CoreIPC::Connection* con
 
 NPRemoteObjectMap::NPRemoteObjectMap(CoreIPC::Connection* connection)
     : m_connection(connection)
-    , m_isInvalidating(false)
 {
 }
 
@@ -60,9 +59,9 @@ NPRemoteObjectMap::~NPRemoteObjectMap()
     ASSERT(m_registeredNPObjects.isEmpty());
 }
 
-NPObject* NPRemoteObjectMap::createNPObjectProxy(uint64_t remoteObjectID)
+NPObject* NPRemoteObjectMap::createNPObjectProxy(uint64_t remoteObjectID, Plugin* plugin)
 {
-    NPObjectProxy* npObjectProxy = NPObjectProxy::create(this, remoteObjectID);
+    NPObjectProxy* npObjectProxy = NPObjectProxy::create(this, plugin, remoteObjectID);
 
     m_npObjectProxies.add(npObjectProxy);
 
@@ -71,16 +70,16 @@ NPObject* NPRemoteObjectMap::createNPObjectProxy(uint64_t remoteObjectID)
 
 void NPRemoteObjectMap::npObjectProxyDestroyed(NPObject* npObject)
 {
-    ASSERT(NPObjectProxy::isNPObjectProxy(npObject));
-    ASSERT(m_npObjectProxies.contains(npObject));
+    NPObjectProxy* npObjectProxy = NPObjectProxy::toNPObjectProxy(npObject);
+    ASSERT(m_npObjectProxies.contains(npObjectProxy));
 
-    m_npObjectProxies.remove(npObject);
+    m_npObjectProxies.remove(npObjectProxy);
 }
 
-uint64_t NPRemoteObjectMap::registerNPObject(NPObject* npObject)
+uint64_t NPRemoteObjectMap::registerNPObject(NPObject* npObject, Plugin* plugin)
 {
     uint64_t npObjectID = generateNPObjectID();
-    m_registeredNPObjects.set(npObjectID, NPObjectMessageReceiver::create(this, npObjectID, npObject).leakPtr());
+    m_registeredNPObjects.set(npObjectID, NPObjectMessageReceiver::create(this, plugin, npObjectID, npObject).leakPtr());
 
     return npObjectID;
 }
@@ -90,7 +89,7 @@ void NPRemoteObjectMap::unregisterNPObject(uint64_t npObjectID)
     m_registeredNPObjects.remove(npObjectID);
 }
 
-NPVariantData NPRemoteObjectMap::npVariantToNPVariantData(const NPVariant& variant)
+NPVariantData NPRemoteObjectMap::npVariantToNPVariantData(const NPVariant& variant, Plugin* plugin)
 {
     switch (variant.type) {
     case NPVariantType_Void:
@@ -124,7 +123,7 @@ NPVariantData NPRemoteObjectMap::npVariantToNPVariantData(const NPVariant& varia
             return NPVariantData::makeRemoteNPObjectID(npObjectID);
         }
 
-        uint64_t npObjectID = registerNPObject(npObject);
+        uint64_t npObjectID = registerNPObject(npObject, plugin);
         return NPVariantData::makeLocalNPObjectID(npObjectID);
     }
 
@@ -134,7 +133,7 @@ NPVariantData NPRemoteObjectMap::npVariantToNPVariantData(const NPVariant& varia
     return NPVariantData::makeVoid();
 }
 
-NPVariant NPRemoteObjectMap::npVariantDataToNPVariant(const NPVariantData& npVariantData)
+NPVariant NPRemoteObjectMap::npVariantDataToNPVariant(const NPVariantData& npVariantData, Plugin* plugin)
 {
     NPVariant npVariant;
 
@@ -178,7 +177,7 @@ NPVariant NPRemoteObjectMap::npVariantDataToNPVariant(const NPVariantData& npVar
         break;
     }
     case NPVariantData::RemoteNPObjectID: {
-        NPObject* npObjectProxy = createNPObjectProxy(npVariantData.remoteNPObjectIDValue());
+        NPObject* npObjectProxy = createNPObjectProxy(npVariantData.remoteNPObjectIDValue(), plugin);
         OBJECT_TO_NPVARIANT(npObjectProxy, npVariant);
         break;
     }
@@ -187,25 +186,37 @@ NPVariant NPRemoteObjectMap::npVariantDataToNPVariant(const NPVariantData& npVar
     return npVariant;
 }
 
-void NPRemoteObjectMap::invalidate()
+void NPRemoteObjectMap::pluginDestroyed(Plugin* plugin)
 {
-    ASSERT(!m_isInvalidating);
-
-    m_isInvalidating = true;
-
     Vector<NPObjectMessageReceiver*> messageReceivers;
-    copyValuesToVector(m_registeredNPObjects, messageReceivers);
+
+    // Gather the receivers associated with this plug-in.
+    for (HashMap<uint64_t, NPObjectMessageReceiver*>::const_iterator it = m_registeredNPObjects.begin(), end = m_registeredNPObjects.end(); it != end; ++it) {
+        NPObjectMessageReceiver* npObjectMessageReceiver = it->second;
+        if (npObjectMessageReceiver->plugin() == plugin)
+            messageReceivers.append(npObjectMessageReceiver);
+    }
 
     // Now delete all the receivers.
     deleteAllValues(messageReceivers);
 
-    ASSERT(m_registeredNPObjects.isEmpty());
+    Vector<NPObjectProxy*> objectProxies;
+    for (HashSet<NPObjectProxy*>::const_iterator it = m_npObjectProxies.begin(), end = m_npObjectProxies.end(); it != end; ++it) {
+        NPObjectProxy* npObjectProxy = *it;
 
-    for (HashSet<NPObject*>::const_iterator it = m_npObjectProxies.begin(), end = m_npObjectProxies.end(); it != end; ++it)
-        NPObjectProxy::toNPObjectProxy(*it)->invalidate();
-    m_npObjectProxies.clear();
+        if (npObjectProxy->plugin() == plugin)
+            objectProxies.append(npObjectProxy);
+    }
+
+    // Invalidate and remove all proxies associated with this plug-in.
+    for (size_t i = 0; i < objectProxies.size(); ++i) {
+        NPObjectProxy* npObjectProxy = objectProxies[i];
 
-    m_isInvalidating = false;
+        npObjectProxy->invalidate();
+
+        ASSERT(m_npObjectProxies.contains(npObjectProxy));
+        m_npObjectProxies.remove(npObjectProxy);
+    }
 }
 
 CoreIPC::SyncReplyMode NPRemoteObjectMap::didReceiveSyncMessage(CoreIPC::Connection* connection, CoreIPC::MessageID messageID, CoreIPC::ArgumentDecoder* arguments, CoreIPC::ArgumentEncoder* reply)
diff --git a/Source/WebKit2/Shared/Plugins/NPRemoteObjectMap.h b/Source/WebKit2/Shared/Plugins/NPRemoteObjectMap.h
index ff0bbbb..812d4d7 100644
--- a/Source/WebKit2/Shared/Plugins/NPRemoteObjectMap.h
+++ b/Source/WebKit2/Shared/Plugins/NPRemoteObjectMap.h
@@ -39,6 +39,7 @@ namespace WebKit {
 class NPObjectMessageReceiver;
 class NPObjectProxy;
 class NPVariantData;
+class Plugin;
 
 class NPRemoteObjectMap : public RefCounted<NPRemoteObjectMap> {
 public:
@@ -46,23 +47,22 @@ public:
     ~NPRemoteObjectMap();
 
     // Creates an NPObjectProxy wrapper for the remote object with the given remote object ID.
-    NPObject* createNPObjectProxy(uint64_t remoteObjectID);
+    NPObject* createNPObjectProxy(uint64_t remoteObjectID, Plugin*);
     void npObjectProxyDestroyed(NPObject*);
 
     // Expose the given NPObject as a remote object. Returns the objectID.
-    uint64_t registerNPObject(NPObject*);
+    uint64_t registerNPObject(NPObject*, Plugin*);
     void unregisterNPObject(uint64_t);
 
     // Given an NPVariant, creates an NPVariantData object (a CoreIPC representation of an NPVariant).
-    NPVariantData npVariantToNPVariantData(const NPVariant&);
+    NPVariantData npVariantToNPVariantData(const NPVariant&, Plugin*);
 
     // Given an NPVariantData, creates an NPVariant object.
-    NPVariant npVariantDataToNPVariant(const NPVariantData&);
+    NPVariant npVariantDataToNPVariant(const NPVariantData&, Plugin*);
 
     CoreIPC::Connection* connection() const { return m_connection; }
-    bool isInvalidating() const { return m_isInvalidating; }
 
-    void invalidate();
+    void pluginDestroyed(Plugin*);
 
     CoreIPC::SyncReplyMode didReceiveSyncMessage(CoreIPC::Connection* connection, CoreIPC::MessageID messageID, CoreIPC::ArgumentDecoder* arguments, CoreIPC::ArgumentEncoder* reply);
 
@@ -70,14 +70,12 @@ private:
     explicit NPRemoteObjectMap(CoreIPC::Connection*);
     CoreIPC::Connection* m_connection;
 
-    bool m_isInvalidating;
-
     // A map of NPObjectMessageReceiver classes, wrapping objects that we export to the
     // other end of the connection.
     HashMap<uint64_t, NPObjectMessageReceiver*> m_registeredNPObjects;
 
     // A set of NPObjectProxy objects associated with this map.
-    HashSet<NPObject*> m_npObjectProxies;
+    HashSet<NPObjectProxy*> m_npObjectProxies;
 };
 
 } // namespace WebKit
diff --git a/Source/WebKit2/Shared/Plugins/Netscape/NetscapePluginModule.cpp b/Source/WebKit2/Shared/Plugins/Netscape/NetscapePluginModule.cpp
index 7bbdaa8..54af967 100644
--- a/Source/WebKit2/Shared/Plugins/Netscape/NetscapePluginModule.cpp
+++ b/Source/WebKit2/Shared/Plugins/Netscape/NetscapePluginModule.cpp
@@ -58,16 +58,6 @@ NetscapePluginModule::~NetscapePluginModule()
     ASSERT(initializedNetscapePluginModules().find(this) == notFound);
 }
 
-void NetscapePluginModule::pluginCreated()
-{
-    incrementLoadCount();
-}
-
-void NetscapePluginModule::pluginDestroyed()
-{
-    decrementLoadCount();
-}
-
 Vector<String> NetscapePluginModule::sitesWithData()
 {
     Vector<String> sites;
@@ -235,8 +225,21 @@ bool NetscapePluginModule::tryLoad()
     // reversed. Failing to follow this order results in crashes (e.g., in Silverlight on Mac and
     // in Flash and QuickTime on Windows).
 #if PLUGIN_ARCHITECTURE(MAC)
-    if (initializeFuncPtr(netscapeBrowserFuncs()) != NPERR_NO_ERROR || getEntryPointsFuncPtr(&m_pluginFuncs) != NPERR_NO_ERROR)
-        return false;
+#ifndef NP_NO_CARBON
+    // Plugins (at least QT) require that you call UseResFile on the resource file before loading it.
+    ResFileRefNum currentResourceFile = CurResFile();
+    
+    ResFileRefNum pluginResourceFile = m_module->bundleResourceMap();
+    UseResFile(pluginResourceFile);
+#endif
+    bool result = initializeFuncPtr(netscapeBrowserFuncs()) == NPERR_NO_ERROR && getEntryPointsFuncPtr(&m_pluginFuncs) == NPERR_NO_ERROR;
+
+#ifndef NP_NO_CARBON
+    // Restore the resource file.
+    UseResFile(currentResourceFile);
+#endif
+
+    return result;
 #elif PLUGIN_ARCHITECTURE(WIN)
     if (getEntryPointsFuncPtr(&m_pluginFuncs) != NPERR_NO_ERROR || initializeFuncPtr(netscapeBrowserFuncs()) != NPERR_NO_ERROR)
         return false;
diff --git a/Source/WebKit2/Shared/Plugins/Netscape/NetscapePluginModule.h b/Source/WebKit2/Shared/Plugins/Netscape/NetscapePluginModule.h
index aee26bb..4ec7991 100644
--- a/Source/WebKit2/Shared/Plugins/Netscape/NetscapePluginModule.h
+++ b/Source/WebKit2/Shared/Plugins/Netscape/NetscapePluginModule.h
@@ -45,9 +45,9 @@ public:
     ~NetscapePluginModule();
 
     const NPPluginFuncs& pluginFuncs() const { return m_pluginFuncs; }
-
-    void pluginCreated();
-    void pluginDestroyed();
+ 
+    void incrementLoadCount();
+    void decrementLoadCount();
 
     static bool getPluginInfo(const String& pluginPath, PluginInfoStore::Plugin&);
 
@@ -68,9 +68,6 @@ private:
     void applyX11QuirksBeforeLoad();
 #endif
 
-    void incrementLoadCount();
-    void decrementLoadCount();
-
     bool tryGetSitesWithData(Vector<String>&);
     bool tryClearSiteData(const String& site, uint64_t flags, uint64_t maxAge);
 
diff --git a/Source/WebKit2/Shared/Plugins/Netscape/mac/NetscapePluginModuleMac.mm b/Source/WebKit2/Shared/Plugins/Netscape/mac/NetscapePluginModuleMac.mm
index accab46..d290f5b 100644
--- a/Source/WebKit2/Shared/Plugins/Netscape/mac/NetscapePluginModuleMac.mm
+++ b/Source/WebKit2/Shared/Plugins/Netscape/mac/NetscapePluginModuleMac.mm
@@ -86,13 +86,35 @@ static bool getPluginArchitecture(CFBundleRef bundle, cpu_type_t& pluginArchitec
 
     return false;
 }
+    
+static RetainPtr<CFDictionaryRef> getMIMETypesFromPluginBundle(CFBundleRef bundle)
+{
+    CFStringRef propertyListFilename = static_cast<CFStringRef>(CFBundleGetValueForInfoDictionaryKey(bundle, CFSTR("WebPluginMIMETypesFilename")));
+    if (propertyListFilename) {
+        RetainPtr<CFStringRef> propertyListPath(AdoptCF, CFStringCreateWithFormat(kCFAllocatorDefault, 0, CFSTR("%@/Library/Preferences/%@"), NSHomeDirectory(), propertyListFilename));
+        RetainPtr<CFURLRef> propertyListURL(AdoptCF, CFURLCreateWithFileSystemPath(kCFAllocatorDefault, propertyListPath.get(), kCFURLPOSIXPathStyle, FALSE));
+
+        CFDataRef propertyListData;
+        CFURLCreateDataAndPropertiesFromResource(kCFAllocatorDefault, propertyListURL.get(), &propertyListData, 0, 0, 0);
+        RetainPtr<CFPropertyListRef> propertyList(AdoptCF, CFPropertyListCreateWithData(kCFAllocatorDefault, propertyListData, kCFPropertyListImmutable, 0, 0));
+        if (propertyListData)
+            CFRelease(propertyListData);
+        
+        // FIXME: Have the plug-in create the MIME types property list if it doesn't exist.
+        // https://bugs.webkit.org/show_bug.cgi?id=57204
+        if (!propertyList || CFGetTypeID(propertyList.get()) != CFDictionaryGetTypeID())
+            return 0;
+        
+        return static_cast<CFDictionaryRef>(CFDictionaryGetValue(static_cast<CFDictionaryRef>(propertyList.get()), CFSTR("WebPluginMIMETypes")));
+    }
+    
+    return static_cast<CFDictionaryRef>(CFBundleGetValueForInfoDictionaryKey(bundle, CFSTR("WebPluginMIMETypes")));
+}
 
 static bool getPluginInfoFromPropertyLists(CFBundleRef bundle, PluginInfo& pluginInfo)
 {
-    // FIXME: Handle WebPluginMIMETypesFilenameKey.
-    
-    CFDictionaryRef mimeTypes = static_cast<CFDictionaryRef>(CFBundleGetValueForInfoDictionaryKey(bundle, CFSTR("WebPluginMIMETypes")));
-    if (!mimeTypes || CFGetTypeID(mimeTypes) != CFDictionaryGetTypeID())
+    RetainPtr<CFDictionaryRef> mimeTypes = getMIMETypesFromPluginBundle(bundle);
+    if (!mimeTypes || CFGetTypeID(mimeTypes.get()) != CFDictionaryGetTypeID())
         return false;
 
     // Get the plug-in name.
@@ -106,10 +128,10 @@ static bool getPluginInfoFromPropertyLists(CFBundleRef bundle, PluginInfo& plugi
         pluginInfo.desc = pluginDescription;
     
     // Get the MIME type mapping dictionary.
-    CFIndex numMimeTypes = CFDictionaryGetCount(mimeTypes);
+    CFIndex numMimeTypes = CFDictionaryGetCount(mimeTypes.get());          
     Vector<CFStringRef> mimeTypesVector(numMimeTypes);
     Vector<CFDictionaryRef> mimeTypeInfoVector(numMimeTypes);
-    CFDictionaryGetKeysAndValues(mimeTypes, reinterpret_cast<const void**>(mimeTypesVector.data()), reinterpret_cast<const void**>(mimeTypeInfoVector.data()));
+    CFDictionaryGetKeysAndValues(mimeTypes.get(), reinterpret_cast<const void**>(mimeTypesVector.data()), reinterpret_cast<const void**>(mimeTypeInfoVector.data()));
     
     for (CFIndex i = 0; i < numMimeTypes; ++i) {
         MimeClassInfo mimeClassInfo;
@@ -142,8 +164,15 @@ static bool getPluginInfoFromPropertyLists(CFBundleRef bundle, PluginInfo& plugi
             CFStringRef extension = static_cast<CFStringRef>(CFArrayGetValueAtIndex(extensionsArray, i));
             if (!extension || CFGetTypeID(extension) != CFStringGetTypeID())
                 continue;
-            
-            mimeClassInfo.extensions.append(String(extension).lower());
+
+            // The DivX plug-in lists multiple extensions in a comma separated string instead of using
+            // multiple array elements in the property list. Work around this here by splitting the
+            // extension string into components.
+            Vector<String> extensionComponents;
+            String(extension).lower().split(',', extensionComponents);
+
+            for (size_t i = 0; i < extensionComponents.size(); ++i)
+                mimeClassInfo.extensions.append(extensionComponents[i]);
         }
 
         // Add this MIME type.
@@ -333,8 +362,24 @@ void NetscapePluginModule::determineQuirks()
     if (plugin.bundleIdentifier == "com.macromedia.Flash Player.plugin") {
         // Flash requires that the return value of getprogname() be "WebKitPluginHost".
         m_pluginQuirks.add(PluginQuirks::PrognameShouldBeWebKitPluginHost);
+
+        // Flash supports snapshotting.
         m_pluginQuirks.add(PluginQuirks::SupportsSnapshotting);
     }
+
+    if (plugin.bundleIdentifier == "com.microsoft.SilverlightPlugin") {
+        // Silverlight doesn't explicitly opt into transparency, so we'll do it whenever
+        // there's a 'background' attribute.
+        m_pluginQuirks.add(PluginQuirks::MakeTransparentIfBackgroundAttributeExists);
+    }
+
+#ifndef NP_NO_QUICKDRAW
+    if (plugin.bundleIdentifier == "com.apple.ist.ds.appleconnect.webplugin") {
+        // The AppleConnect plug-in uses QuickDraw but doesn't paint or receive events
+        // so we'll allow it to be instantiated even though we don't support QuickDraw.
+        m_pluginQuirks.add(PluginQuirks::AllowHalfBakedQuickDrawSupport);
+    }
+#endif
 }
 
 } // namespace WebKit
diff --git a/Source/WebKit2/Shared/Plugins/Netscape/x11/NetscapePluginModuleX11.cpp b/Source/WebKit2/Shared/Plugins/Netscape/x11/NetscapePluginModuleX11.cpp
index b5e3aad..76ecda7 100644
--- a/Source/WebKit2/Shared/Plugins/Netscape/x11/NetscapePluginModuleX11.cpp
+++ b/Source/WebKit2/Shared/Plugins/Netscape/x11/NetscapePluginModuleX11.cpp
@@ -40,7 +40,7 @@ namespace WebKit {
 #if PLATFORM(QT)
 static void initializeGTK()
 {
-    QLibrary library("libgtk-x11-2.0.so.0");
+    QLibrary library(QLatin1String("libgtk-x11-2.0.so.0"));
     if (library.load()) {
         typedef void *(*gtk_init_check_ptr)(int*, char***);
         gtk_init_check_ptr gtkInitCheck = reinterpret_cast<gtk_init_check_ptr>(library.resolve("gtk_init_check"));
diff --git a/Source/WebKit2/Shared/Plugins/PluginQuirks.h b/Source/WebKit2/Shared/Plugins/PluginQuirks.h
index 9f8c1c4..ea4643b 100644
--- a/Source/WebKit2/Shared/Plugins/PluginQuirks.h
+++ b/Source/WebKit2/Shared/Plugins/PluginQuirks.h
@@ -36,8 +36,25 @@ public:
         // The plug-in wants the call to getprogame() to return "WebKitPluginHost".
         // Adobe Flash Will not handle key down events otherwise.
         PrognameShouldBeWebKitPluginHost,
+
         // Supports receiving a paint event, even when using CoreAnimation rendering.
         SupportsSnapshotting,
+
+        // Make the plug-in transparent if it has a "background" attribute set.
+        // Microsoft Silverlight doesn't opt into transparency using NPN_SetValue and
+        // NPPVpluginTransparentBool, so we'll always force if the plug-in has a "background"
+        // attribute specified, regardless of it's value.
+        // FIXME: We could get more fancy here and check for specific values that we know are
+        // transparent.
+        MakeTransparentIfBackgroundAttributeExists,
+
+#ifndef NP_NO_QUICKDRAW
+        // Allow the plug-in to use the QuickDraw drawing model, since wek now that the plug-in
+        // will never paint or receive events. Used by the AppleConnect plug-in.
+        AllowHalfBakedQuickDrawSupport,
+#endif
+
+        // X11 specific quirks:
 #elif PLUGIN_ARCHITECTURE(X11)
         // Flash and npwrapper ask the browser about which GTK version does it use
         // and refuse to load and work if it is not GTK 2 so we need to fake it in
diff --git a/Source/WebKit2/Shared/ResourceCachesToClear.h b/Source/WebKit2/Shared/ResourceCachesToClear.h
new file mode 100644
index 0000000..df9367c
--- /dev/null
+++ b/Source/WebKit2/Shared/ResourceCachesToClear.h
@@ -0,0 +1,38 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef ResourceCachesToClear_h
+#define ResourceCachesToClear_h
+
+namespace WebKit {
+
+enum ResourceCachesToClear {
+    AllResourceCaches = 0,
+    InMemoryResourceCachesOnly = 1
+};
+
+} // namespace WebKit
+
+#endif // ResourceCachesToClear_h
diff --git a/Source/WebKit2/Shared/ShareableBitmap.cpp b/Source/WebKit2/Shared/ShareableBitmap.cpp
index ab1991f..cde3aa1 100644
--- a/Source/WebKit2/Shared/ShareableBitmap.cpp
+++ b/Source/WebKit2/Shared/ShareableBitmap.cpp
@@ -27,13 +27,37 @@
 #include "ShareableBitmap.h"
 
 #include "SharedMemory.h"
+#include "WebCoreArgumentCoders.h"
 #include <WebCore/GraphicsContext.h>
 
 using namespace WebCore;
 
 namespace WebKit {
 
-PassRefPtr<ShareableBitmap> ShareableBitmap::create(const WebCore::IntSize& size)
+ShareableBitmap::Handle::Handle()
+    : m_flags(0)
+{
+}
+
+void ShareableBitmap::Handle::encode(CoreIPC::ArgumentEncoder* encoder) const
+{
+    encoder->encode(m_handle);
+    encoder->encode(m_size);
+    encoder->encode(m_flags);
+}
+
+bool ShareableBitmap::Handle::decode(CoreIPC::ArgumentDecoder* decoder, Handle& handle)
+{
+    if (!decoder->decode(handle.m_handle))
+        return false;
+    if (!decoder->decode(handle.m_size))
+        return false;
+    if (!decoder->decode(handle.m_flags))
+        return false;
+    return true;
+}
+
+PassRefPtr<ShareableBitmap> ShareableBitmap::create(const IntSize& size, Flags flags)
 {
     size_t numBytes = numBytesForSize(size);
     
@@ -41,10 +65,10 @@ PassRefPtr<ShareableBitmap> ShareableBitmap::create(const WebCore::IntSize& size
     if (!tryFastMalloc(numBytes).getValue(data))
         return 0;
 
-    return adoptRef(new ShareableBitmap(size, data));
+    return adoptRef(new ShareableBitmap(size, flags, data));
 }
 
-PassRefPtr<ShareableBitmap> ShareableBitmap::createShareable(const IntSize& size)
+PassRefPtr<ShareableBitmap> ShareableBitmap::createShareable(const IntSize& size, Flags flags)
 {
     size_t numBytes = numBytesForSize(size);
 
@@ -52,44 +76,50 @@ PassRefPtr<ShareableBitmap> ShareableBitmap::createShareable(const IntSize& size
     if (!sharedMemory)
         return 0;
 
-    return adoptRef(new ShareableBitmap(size, sharedMemory));
+    return adoptRef(new ShareableBitmap(size, flags, sharedMemory));
 }
 
-PassRefPtr<ShareableBitmap> ShareableBitmap::create(const WebCore::IntSize& size, PassRefPtr<SharedMemory> sharedMemory)
+PassRefPtr<ShareableBitmap> ShareableBitmap::create(const IntSize& size, Flags flags, PassRefPtr<SharedMemory> sharedMemory)
 {
     ASSERT(sharedMemory);
 
     size_t numBytes = numBytesForSize(size);
     ASSERT_UNUSED(numBytes, sharedMemory->size() >= numBytes);
     
-    return adoptRef(new ShareableBitmap(size, sharedMemory));
+    return adoptRef(new ShareableBitmap(size, flags, sharedMemory));
 }
 
-PassRefPtr<ShareableBitmap> ShareableBitmap::create(const WebCore::IntSize& size, const SharedMemory::Handle& handle)
+PassRefPtr<ShareableBitmap> ShareableBitmap::create(const Handle& handle)
 {
     // Create the shared memory.
-    RefPtr<SharedMemory> sharedMemory = SharedMemory::create(handle, SharedMemory::ReadWrite);
+    RefPtr<SharedMemory> sharedMemory = SharedMemory::create(handle.m_handle, SharedMemory::ReadWrite);
     if (!sharedMemory)
         return 0;
 
-    return create(size, sharedMemory.release());
+    return create(handle.m_size, handle.m_flags, sharedMemory.release());
 }
 
-bool ShareableBitmap::createHandle(SharedMemory::Handle& handle)
+bool ShareableBitmap::createHandle(Handle& handle)
 {
     ASSERT(isBackedBySharedMemory());
 
-    return m_sharedMemory->createHandle(handle, SharedMemory::ReadWrite);
+    if (!m_sharedMemory->createHandle(handle.m_handle, SharedMemory::ReadWrite))
+        return false;
+    handle.m_size = m_size;
+    handle.m_flags = m_flags;
+    return true;
 }
 
-ShareableBitmap::ShareableBitmap(const IntSize& size, void* data)
+ShareableBitmap::ShareableBitmap(const IntSize& size, Flags flags, void* data)
     : m_size(size)
+    , m_flags(flags)
     , m_data(data)
 {
 }
 
-ShareableBitmap::ShareableBitmap(const IntSize& size, PassRefPtr<SharedMemory> sharedMemory)
+ShareableBitmap::ShareableBitmap(const IntSize& size, Flags flags, PassRefPtr<SharedMemory> sharedMemory)
     : m_size(size)
+    , m_flags(flags)
     , m_sharedMemory(sharedMemory)
     , m_data(0)
 {
diff --git a/Source/WebKit2/Shared/ShareableBitmap.h b/Source/WebKit2/Shared/ShareableBitmap.h
index f9a3af0..fe7fa0a 100644
--- a/Source/WebKit2/Shared/ShareableBitmap.h
+++ b/Source/WebKit2/Shared/ShareableBitmap.h
@@ -33,6 +33,10 @@
 #include <wtf/RefCounted.h>
 #include <wtf/RefPtr.h>
 
+#if PLATFORM(CG)
+#include <wtf/RetainPtr.h>
+#endif
+
 namespace WebCore {
     class GraphicsContext;
 }
@@ -41,20 +45,43 @@ namespace WebKit {
     
 class ShareableBitmap : public RefCounted<ShareableBitmap> {
 public:
+    enum Flag {
+        SupportsAlpha = 1 << 0,
+    };
+    typedef unsigned Flags;
+
+    class Handle {
+        WTF_MAKE_NONCOPYABLE(Handle);
+    public:
+        Handle();
+
+        bool isNull() const { return m_handle.isNull(); }
+
+        void encode(CoreIPC::ArgumentEncoder*) const;
+        static bool decode(CoreIPC::ArgumentDecoder*, Handle&);
+
+    private:
+        friend class ShareableBitmap;
+
+        mutable SharedMemory::Handle m_handle;
+        WebCore::IntSize m_size;
+        Flags m_flags;
+    };
+
     // Create a shareable bitmap that uses malloced memory.
-    static PassRefPtr<ShareableBitmap> create(const WebCore::IntSize&);
+    static PassRefPtr<ShareableBitmap> create(const WebCore::IntSize&, Flags);
 
     // Create a shareable bitmap whose backing memory can be shared with another process.
-    static PassRefPtr<ShareableBitmap> createShareable(const WebCore::IntSize&);
+    static PassRefPtr<ShareableBitmap> createShareable(const WebCore::IntSize&, Flags);
 
     // Create a shareable bitmap from an already existing shared memory block.
-    static PassRefPtr<ShareableBitmap> create(const WebCore::IntSize&, PassRefPtr<SharedMemory>);
+    static PassRefPtr<ShareableBitmap> create(const WebCore::IntSize&, Flags, PassRefPtr<SharedMemory>);
 
-    // Create a shareable bitmap from a shared memory handle.
-    static PassRefPtr<ShareableBitmap> create(const WebCore::IntSize&, const SharedMemory::Handle&);
+    // Create a shareable bitmap from a handle.
+    static PassRefPtr<ShareableBitmap> create(const Handle&);
 
-    // Create a shared memory handle.
-    bool createHandle(SharedMemory::Handle&);
+    // Create a handle.
+    bool createHandle(Handle&);
 
     ~ShareableBitmap();
 
@@ -71,18 +98,31 @@ public:
 
     bool isBackedBySharedMemory() const { return m_sharedMemory; }
 
+#if PLATFORM(CG)
+    // This creates a copied CGImageRef (most likely a copy-on-write) of the shareable bitmap.
+    RetainPtr<CGImageRef> makeCGImageCopy();
+
+    // This creates a CGImageRef that directly references the shared bitmap data.
+    // This is only safe to use when we know that the contents of the shareable bitmap won't change.
+    RetainPtr<CGImageRef> makeCGImage();
+#endif
+
 private:
-    ShareableBitmap(const WebCore::IntSize&, void*);
-    ShareableBitmap(const WebCore::IntSize&, PassRefPtr<SharedMemory>);
+    ShareableBitmap(const WebCore::IntSize&, Flags, void*);
+    ShareableBitmap(const WebCore::IntSize&, Flags, PassRefPtr<SharedMemory>);
 
     static size_t numBytesForSize(const WebCore::IntSize& size) { return size.width() * size.height() * 4; }
 
-    static void releaseData(void* typelessBitmap, void* typelessData);
-    
+#if PLATFORM(CG)
+    static void releaseBitmapContextData(void* typelessBitmap, void* typelessData);
+    static void releaseDataProviderData(void* typelessBitmap, const void* typelessData, size_t);
+#endif
+
     void* data() const;
     size_t sizeInBytes() const { return numBytesForSize(m_size); }
 
     WebCore::IntSize m_size;
+    Flags m_flags;
 
     // If the shareable bitmap is backed by shared memory, this points to the shared memory object.
     RefPtr<SharedMemory> m_sharedMemory;
diff --git a/Source/WebKit2/Shared/UpdateInfo.h b/Source/WebKit2/Shared/UpdateInfo.h
index 7b5454e..8e08ed0 100644
--- a/Source/WebKit2/Shared/UpdateInfo.h
+++ b/Source/WebKit2/Shared/UpdateInfo.h
@@ -26,7 +26,7 @@
 #ifndef UpdateInfo_h
 #define UpdateInfo_h
 
-#include "SharedMemory.h"
+#include "ShareableBitmap.h"
 #include <WebCore/IntRect.h>
 #include <wtf/Noncopyable.h>
 
@@ -60,7 +60,7 @@ public:
     Vector<WebCore::IntRect> updateRects;
 
     // The handle of the shareable bitmap containing the updates. Will be null if there are no updates.
-    SharedMemory::Handle bitmapHandle;
+    ShareableBitmap::Handle bitmapHandle;
 };
 
 } // namespace WebKit
diff --git a/Source/WebKit2/Shared/UserMessageCoders.h b/Source/WebKit2/Shared/UserMessageCoders.h
index 1326a98..ad72493 100644
--- a/Source/WebKit2/Shared/UserMessageCoders.h
+++ b/Source/WebKit2/Shared/UserMessageCoders.h
@@ -31,7 +31,9 @@
 #include "ImmutableArray.h"
 #include "ImmutableDictionary.h"
 #include "ShareableBitmap.h"
+#include "WebCertificateInfo.h"
 #include "WebCoreArgumentCoders.h"
+#include "WebData.h"
 #include "WebImage.h"
 #include "WebNumber.h"
 #include "WebSerializedScriptValue.h"
@@ -47,6 +49,8 @@ namespace WebKit {
 //   - SerializedScriptValue -> SerializedScriptValue
 //   - String -> String
 //   - UserContentURLPattern -> UserContentURLPattern
+//   - WebCertificateInfo -> WebCertificateInfo
+//   - WebData -> WebData
 //   - WebDouble -> WebDouble
 //   - WebImage -> WebImage
 //   - WebUInt64 -> WebUInt64
@@ -128,16 +132,25 @@ public:
                 return true;
             }
 
-            SharedMemory::Handle handle;
+            ShareableBitmap::Handle handle;
             if (!image->bitmap()->createHandle(handle))
                 return false;
 
             encoder->encode(true);
             
-            encoder->encode(image->size());
             encoder->encode(handle);
             return true;
         }
+        case APIObject::TypeData: {
+            WebData* data = static_cast<WebData*>(m_root);
+            encoder->encodeBytes(data->bytes(), data->size());
+            return true;
+        }
+        case APIObject::TypeCertificateInfo: {
+            WebCertificateInfo* certificateInfo = static_cast<WebCertificateInfo*>(m_root);
+            encoder->encode(certificateInfo->platformCertificateInfo());
+            return true;
+        }
         default:
             break;
         }
@@ -162,6 +175,8 @@ protected:
 //   - SerializedScriptValue -> SerializedScriptValue
 //   - String -> String
 //   - UserContentURLPattern -> UserContentURLPattern
+//   - WebCertificateInfo -> WebCertificateInfo
+//   - WebData -> WebData
 //   - WebDouble -> WebDouble
 //   - WebImage -> WebImage
 //   - WebUInt64 -> WebUInt64
@@ -277,17 +292,27 @@ public:
             if (!didEncode)
                 break;
 
-            WebCore::IntSize size;
-            if (!decoder->decode(size))
-                return false;
-
-            SharedMemory::Handle handle;
+            ShareableBitmap::Handle handle;
             if (!decoder->decode(handle))
                 return false;
 
-            coder.m_root = WebImage::create(ShareableBitmap::create(size, handle));
+            coder.m_root = WebImage::create(ShareableBitmap::create(handle));
             return true;
         }
+        case APIObject::TypeData: {
+            Vector<uint8_t> buffer;
+            if (!decoder->decodeBytes(buffer))
+                return false;
+            coder.m_root = WebData::create(buffer);
+            break;
+        }
+        case APIObject::TypeCertificateInfo: {
+            PlatformCertificateInfo platformCertificateInfo;
+            if (!decoder->decode(platformCertificateInfo))
+                return false;
+            coder.m_root = WebCertificateInfo::create(platformCertificateInfo);
+            break;
+        }
         default:
             break;
         }
diff --git a/Source/WebKit2/Shared/WebCoreArgumentCoders.cpp b/Source/WebKit2/Shared/WebCoreArgumentCoders.cpp
index e97c7fd..99b3c00 100644
--- a/Source/WebKit2/Shared/WebCoreArgumentCoders.cpp
+++ b/Source/WebKit2/Shared/WebCoreArgumentCoders.cpp
@@ -37,25 +37,21 @@ namespace CoreIPC {
 
 void encodeImage(ArgumentEncoder* encoder, Image* image)
 {
-    RefPtr<ShareableBitmap> bitmap = ShareableBitmap::createShareable(image->size());
+    RefPtr<ShareableBitmap> bitmap = ShareableBitmap::createShareable(image->size(), ShareableBitmap::SupportsAlpha);
     bitmap->createGraphicsContext()->drawImage(image, ColorSpaceDeviceRGB, IntPoint());
-    SharedMemory::Handle handle;
+    ShareableBitmap::Handle handle;
     bitmap->createHandle(handle);
 
-    encoder->encode(image->size());
     encoder->encode(handle);
 }
 
 bool decodeImage(ArgumentDecoder* decoder, RefPtr<Image>& image)
 {
-    IntSize imageSize;
-    if (!decoder->decode(imageSize))
-        return false;
-    SharedMemory::Handle handle;
+    ShareableBitmap::Handle handle;
     if (!decoder->decode(handle))
         return false;
     
-    RefPtr<ShareableBitmap> bitmap = ShareableBitmap::create(imageSize, handle);
+    RefPtr<ShareableBitmap> bitmap = ShareableBitmap::create(handle);
     if (!bitmap)
         return false;
     image = createImage(bitmap.get());
diff --git a/Source/WebKit2/Shared/WebCoreArgumentCoders.h b/Source/WebKit2/Shared/WebCoreArgumentCoders.h
index 1679bb6..e12b9be 100644
--- a/Source/WebKit2/Shared/WebCoreArgumentCoders.h
+++ b/Source/WebKit2/Shared/WebCoreArgumentCoders.h
@@ -277,26 +277,22 @@ template<> struct ArgumentCoder<WebCore::ResourceResponse> {
     }
 };
 
+// These two functions are implemented in a platform specific manner.
+void encodeResourceError(ArgumentEncoder*, const WebCore::ResourceError&);
+bool decodeResourceError(ArgumentDecoder*, WebCore::ResourceError&);
+
 template<> struct ArgumentCoder<WebCore::ResourceError> {
     static void encode(ArgumentEncoder* encoder, const WebCore::ResourceError& resourceError)
     {
-        encoder->encode(CoreIPC::In(resourceError.domain(), resourceError.errorCode(), resourceError.failingURL(), resourceError.localizedDescription()));
+        encodeResourceError(encoder, resourceError);
     }
     
     static bool decode(ArgumentDecoder* decoder, WebCore::ResourceError& resourceError)
     {
-        String domain;
-        int errorCode;
-        String failingURL;
-        String localizedDescription;
-        if (!decoder->decode(CoreIPC::Out(domain, errorCode, failingURL, localizedDescription)))
-            return false;
-        resourceError = WebCore::ResourceError(domain, errorCode, failingURL, localizedDescription);
-        return true;
+        return decodeResourceError(decoder, resourceError);
     }
 };
 
-
 template<> struct ArgumentCoder<WebCore::WindowFeatures> {
     static void encode(ArgumentEncoder* encoder, const WebCore::WindowFeatures& windowFeatures)
     {
diff --git a/Source/WebKit2/Shared/WebData.h b/Source/WebKit2/Shared/WebData.h
index 789b965..538e496 100644
--- a/Source/WebKit2/Shared/WebData.h
+++ b/Source/WebKit2/Shared/WebData.h
@@ -38,34 +38,60 @@ class WebData : public APIObject {
 public:
     static const Type APIType = TypeData;
 
+    typedef void (*FreeDataFunction)(unsigned char*, const void* context);
+
+    static PassRefPtr<WebData> createWithoutCopying(const unsigned char* bytes, size_t size, FreeDataFunction freeDataFunction, const void* context)
+    {
+        return adoptRef(new WebData(bytes, size, freeDataFunction, context));
+    }
+
     static PassRefPtr<WebData> create(const unsigned char* bytes, size_t size)
     {
-        return adoptRef(new WebData(bytes, size));
+        unsigned char *copiedBytes = 0;
+
+        if (size) {
+            copiedBytes = static_cast<unsigned char*>(fastMalloc(size));
+            memcpy(copiedBytes, bytes, size);
+        }
+
+        return createWithoutCopying(copiedBytes, size, fastFreeBytes, 0);
     }
     
     static PassRefPtr<WebData> create(const Vector<unsigned char>& buffer)
     {
-        return adoptRef(new WebData(buffer));
+        return create(buffer.data(), buffer.size());
     }
-    
-    const unsigned char* bytes() const { return m_buffer.data(); }
-    size_t size() const { return m_buffer.size(); }
+
+    ~WebData()
+    {
+        m_freeDataFunction(const_cast<unsigned char*>(m_bytes), m_context);
+    }
+
+    const unsigned char* bytes() const { return m_bytes; }
+    size_t size() const { return m_size; }
 
 private:
-    WebData(const unsigned char* bytes, size_t size)
-        : m_buffer(size)
+    WebData(const unsigned char* bytes, size_t size, FreeDataFunction freeDataFunction, const void* context)
+        : m_bytes(bytes)
+        , m_size(size)
+        , m_freeDataFunction(freeDataFunction)
+        , m_context(context)
     {
-        memcpy(m_buffer.data(), bytes, size);
     }
-    
-    WebData(const Vector<unsigned char>& buffer)
-        : m_buffer(buffer)
+
+    static void fastFreeBytes(unsigned char* bytes, const void*)
     {
+        if (bytes)
+            fastFree(static_cast<void*>(bytes));
     }
 
     virtual Type type() const { return APIType; }
 
-    Vector<unsigned char> m_buffer;
+    const unsigned char* m_bytes;
+    size_t m_size;
+
+    FreeDataFunction m_freeDataFunction;
+    const void* m_context;
 };
 
 } // namespace WebKit
diff --git a/Source/WebKit2/Shared/WebImage.cpp b/Source/WebKit2/Shared/WebImage.cpp
index e245268..b0e4bff 100644
--- a/Source/WebKit2/Shared/WebImage.cpp
+++ b/Source/WebKit2/Shared/WebImage.cpp
@@ -35,8 +35,8 @@ namespace WebKit {
 PassRefPtr<WebImage> WebImage::create(const IntSize& size, ImageOptions options)
 {
     if (options & ImageOptionsShareable)
-        return WebImage::create(ShareableBitmap::createShareable(size));
-    return WebImage::create(ShareableBitmap::create(size));
+        return WebImage::create(ShareableBitmap::createShareable(size, ShareableBitmap::SupportsAlpha));
+    return WebImage::create(ShareableBitmap::create(size, ShareableBitmap::SupportsAlpha));
 }
 
 PassRefPtr<WebImage> WebImage::create(PassRefPtr<ShareableBitmap> bitmap)
diff --git a/Source/WebKit2/Shared/WebMemorySampler.cpp b/Source/WebKit2/Shared/WebMemorySampler.cpp
index 82b2be9..ef17a2b 100644
--- a/Source/WebKit2/Shared/WebMemorySampler.cpp
+++ b/Source/WebKit2/Shared/WebMemorySampler.cpp
@@ -117,7 +117,7 @@ bool WebMemorySampler::isRunning() const
     
 void WebMemorySampler::initializeTempLogFile()
 {
-    m_sampleLogFilePath = String((openTemporaryFile(processName().utf8().data(), m_sampleLogFile)).data());
+    m_sampleLogFilePath = openTemporaryFile(processName(), m_sampleLogFile);
     writeHeaders();
 }
 
diff --git a/Source/WebKit2/Shared/WebPageCreationParameters.cpp b/Source/WebKit2/Shared/WebPageCreationParameters.cpp
index 33b53e3..c5dff58 100644
--- a/Source/WebKit2/Shared/WebPageCreationParameters.cpp
+++ b/Source/WebKit2/Shared/WebPageCreationParameters.cpp
@@ -51,6 +51,7 @@ void WebPageCreationParameters::encode(CoreIPC::ArgumentEncoder* encoder) const
     encoder->encode(highestUsedBackForwardItemID);
     encoder->encode(canRunBeforeUnloadConfirmPanel);
     encoder->encode(canRunModal);
+    encoder->encode(userSpaceScaleFactor);
 
 #if PLATFORM(MAC)
     encoder->encode(isSmartInsertDeleteEnabled);
@@ -99,6 +100,8 @@ bool WebPageCreationParameters::decode(CoreIPC::ArgumentDecoder* decoder, WebPag
         return false;
     if (!decoder->decode(parameters.canRunModal))
         return false;
+    if (!decoder->decode(parameters.userSpaceScaleFactor))
+        return false;
 
 #if PLATFORM(MAC)
     if (!decoder->decode(parameters.isSmartInsertDeleteEnabled))
diff --git a/Source/WebKit2/Shared/WebPageCreationParameters.h b/Source/WebKit2/Shared/WebPageCreationParameters.h
index 31759e1..5fb152f 100644
--- a/Source/WebKit2/Shared/WebPageCreationParameters.h
+++ b/Source/WebKit2/Shared/WebPageCreationParameters.h
@@ -71,6 +71,8 @@ struct WebPageCreationParameters {
     bool canRunBeforeUnloadConfirmPanel;
     bool canRunModal;
 
+    float userSpaceScaleFactor;
+
 #if PLATFORM(MAC)
     bool isSmartInsertDeleteEnabled;
 #endif
diff --git a/Source/WebKit2/Shared/WebPreferencesStore.cpp b/Source/WebKit2/Shared/WebPreferencesStore.cpp
index c215782..c072740 100644
--- a/Source/WebKit2/Shared/WebPreferencesStore.cpp
+++ b/Source/WebKit2/Shared/WebPreferencesStore.cpp
@@ -49,6 +49,8 @@ namespace WebPreferencesKey {
 
 static bool hasXSSAuditorEnabledTestRunnerOverride;
 static bool xssAuditorEnabledTestRunnerOverride;
+static bool hasAllowUniversalAccessFromFileURLsTestRunnerOverride;
+static bool allowUniversalAccessFromFileURLsTestRunnerOverride;
 
 WebPreferencesStore::WebPreferencesStore()
 {
@@ -67,6 +69,9 @@ bool WebPreferencesStore::decode(CoreIPC::ArgumentDecoder* decoder, WebPreferenc
     if (hasXSSAuditorEnabledTestRunnerOverride)
         s.m_boolValues.set(WebPreferencesKey::xssAuditorEnabledKey(), xssAuditorEnabledTestRunnerOverride);
 
+    if (hasAllowUniversalAccessFromFileURLsTestRunnerOverride)
+        s.m_boolValues.set(WebPreferencesKey::allowUniversalAccessFromFileURLsKey(), allowUniversalAccessFromFileURLsTestRunnerOverride);
+
     return true;
 }
 
@@ -76,6 +81,12 @@ void WebPreferencesStore::overrideXSSAuditorEnabledForTestRunner(bool enabled)
     xssAuditorEnabledTestRunnerOverride = enabled;
 }
 
+void WebPreferencesStore::overrideAllowUniversalAccessFromFileURLsForTestRunner(bool enabled)
+{
+    hasAllowUniversalAccessFromFileURLsTestRunnerOverride = true;
+    allowUniversalAccessFromFileURLsTestRunnerOverride = enabled;
+}
+
 void WebPreferencesStore::removeTestRunnerOverrides()
 {
     hasXSSAuditorEnabledTestRunnerOverride = false;
diff --git a/Source/WebKit2/Shared/WebPreferencesStore.h b/Source/WebKit2/Shared/WebPreferencesStore.h
index f00a90e..43ef487 100644
--- a/Source/WebKit2/Shared/WebPreferencesStore.h
+++ b/Source/WebKit2/Shared/WebPreferencesStore.h
@@ -54,6 +54,7 @@ namespace WebKit {
     macro(NeedsSiteSpecificQuirks, needsSiteSpecificQuirks, Bool, bool, false) \
     macro(AcceleratedCompositingEnabled, acceleratedCompositingEnabled, Bool, bool, true) \
     macro(AcceleratedDrawingEnabled, acceleratedDrawingEnabled, Bool, bool, false) \
+    macro(CanvasUsesAcceleratedDrawing, canvasUsesAcceleratedDrawing, Bool, bool, true) \
     macro(CompositingBordersVisible, compositingBordersVisible, Bool, bool, false) \
     macro(CompositingRepaintCountersVisible, compositingRepaintCountersVisible, Bool, bool, false) \
     macro(WebGLEnabled, webGLEnabled, Bool, bool, false) \
@@ -68,6 +69,10 @@ namespace WebKit {
     macro(DOMPasteAllowed, domPasteAllowed, Bool, bool, false) \
     macro(JavaScriptCanAccessClipboard, javaScriptCanAccessClipboard, Bool, bool, false) \
     macro(ShouldPrintBackgrounds, shouldPrintBackgrounds, Bool, bool, false) \
+    macro(FullScreenEnabled, fullScreenEnabled, Bool, bool, true) \
+    macro(WebSecurityEnabled, webSecurityEnabled, Bool, bool, true) \
+    macro(AllowUniversalAccessFromFileURLs, allowUniversalAccessFromFileURLs, Bool, bool, false) \
+    macro(AllowFileAccessFromFileURLs, allowFileAccessFromFileURLs, Bool, bool, false) \
     \
 
 #define FOR_EACH_WEBKIT_DOUBLE_PREFERENCE(macro) \
@@ -163,6 +168,7 @@ struct WebPreferencesStore {
     double getDoubleValueForKey(const String& key) const;
 
     static void overrideXSSAuditorEnabledForTestRunner(bool);
+    static void overrideAllowUniversalAccessFromFileURLsForTestRunner(bool);
     static void removeTestRunnerOverrides();
 
     HashMap<String, String> m_stringValues;
diff --git a/Source/WebKit2/Shared/WebProcessCreationParameters.cpp b/Source/WebKit2/Shared/WebProcessCreationParameters.cpp
index 360c6d7..db3cd4c 100644
--- a/Source/WebKit2/Shared/WebProcessCreationParameters.cpp
+++ b/Source/WebKit2/Shared/WebProcessCreationParameters.cpp
@@ -51,6 +51,7 @@ void WebProcessCreationParameters::encode(CoreIPC::ArgumentEncoder* encoder) con
     encoder->encode(injectedBundlePathExtensionHandle);
     encoder->encode(applicationCacheDirectory);
     encoder->encode(databaseDirectory);
+    encoder->encode(localStorageDirectory);
     encoder->encode(urlSchemesRegistererdAsEmptyDocument);
     encoder->encode(urlSchemesRegisteredAsSecure);
     encoder->encode(urlSchemesForWhichDomainRelaxationIsForbidden);
@@ -60,6 +61,7 @@ void WebProcessCreationParameters::encode(CoreIPC::ArgumentEncoder* encoder) con
     encoder->encode(clearResourceCaches);
     encoder->encode(clearApplicationCache);
     encoder->encode(shouldAlwaysUseComplexTextCodePath);
+    encoder->encode(iconDatabaseEnabled);
     encoder->encode(languageCode);
     encoder->encode(textCheckerState);
     encoder->encode(defaultRequestTimeoutInterval);
@@ -79,6 +81,7 @@ void WebProcessCreationParameters::encode(CoreIPC::ArgumentEncoder* encoder) con
     encoder->encode(cfURLCachePath);
     encoder->encode(cfURLCacheDiskCapacity);
     encoder->encode(cfURLCacheMemoryCapacity);
+    encoder->encode(initialHTTPCookieAcceptPolicy);
 #endif
 }
 
@@ -92,6 +95,8 @@ bool WebProcessCreationParameters::decode(CoreIPC::ArgumentDecoder* decoder, Web
         return false;
     if (!decoder->decode(parameters.databaseDirectory))
         return false;
+    if (!decoder->decode(parameters.localStorageDirectory))
+        return false;
     if (!decoder->decode(parameters.urlSchemesRegistererdAsEmptyDocument))
         return false;
     if (!decoder->decode(parameters.urlSchemesRegisteredAsSecure))
@@ -110,6 +115,8 @@ bool WebProcessCreationParameters::decode(CoreIPC::ArgumentDecoder* decoder, Web
         return false;
     if (!decoder->decode(parameters.shouldAlwaysUseComplexTextCodePath))
         return false;
+    if (!decoder->decode(parameters.iconDatabaseEnabled))
+        return false;
     if (!decoder->decode(parameters.languageCode))
         return false;
     if (!decoder->decode(parameters.textCheckerState))
@@ -145,6 +152,8 @@ bool WebProcessCreationParameters::decode(CoreIPC::ArgumentDecoder* decoder, Web
         return false;
     if (!decoder->decode(parameters.cfURLCacheMemoryCapacity))
         return false;
+    if (!decoder->decode(parameters.initialHTTPCookieAcceptPolicy))
+        return false;
 #endif
 
     return true;
diff --git a/Source/WebKit2/Shared/WebProcessCreationParameters.h b/Source/WebKit2/Shared/WebProcessCreationParameters.h
index a57be99..112d6eb 100644
--- a/Source/WebKit2/Shared/WebProcessCreationParameters.h
+++ b/Source/WebKit2/Shared/WebProcessCreationParameters.h
@@ -54,6 +54,7 @@ struct WebProcessCreationParameters {
 
     String applicationCacheDirectory;
     String databaseDirectory;
+    String localStorageDirectory;
     Vector<String> urlSchemesRegistererdAsEmptyDocument;
     Vector<String> urlSchemesRegisteredAsSecure;
     Vector<String> urlSchemesForWhichDomainRelaxationIsForbidden;
@@ -69,6 +70,8 @@ struct WebProcessCreationParameters {
 
     bool shouldAlwaysUseComplexTextCodePath;
 
+    bool iconDatabaseEnabled;
+
     String languageCode;
 
     TextCheckerState textCheckerState;
@@ -97,6 +100,8 @@ struct WebProcessCreationParameters {
     uint64_t cfURLCacheDiskCapacity;
     uint64_t cfURLCacheMemoryCapacity;
 
+    uint32_t initialHTTPCookieAcceptPolicy;
+
     bool shouldPaintNativeControls;
 #endif
 };
diff --git a/Source/WebKit2/Shared/WebString.h b/Source/WebKit2/Shared/WebString.h
index a77293b..6827276 100644
--- a/Source/WebKit2/Shared/WebString.h
+++ b/Source/WebKit2/Shared/WebString.h
@@ -74,6 +74,7 @@ public:
 
     bool equal(WebString* other) { return m_string == other->m_string; }
     bool equalToUTF8String(const char* other) { return m_string == String::fromUTF8(other); }
+    bool equalToUTF8StringIgnoringCase(const char* other) { return equalIgnoringCase(m_string, other); }
 
     const String& string() const { return m_string; }
 
diff --git a/Source/WebKit2/Shared/WebURL.h b/Source/WebKit2/Shared/WebURL.h
index 1b0826b..14bd99f 100644
--- a/Source/WebKit2/Shared/WebURL.h
+++ b/Source/WebKit2/Shared/WebURL.h
@@ -27,6 +27,9 @@
 #define WebURL_h
 
 #include "APIObject.h"
+#include <WebCore/KURL.h>
+#include <wtf/OwnPtr.h>
+#include <wtf/PassOwnPtr.h>
 #include <wtf/PassRefPtr.h>
 #include <wtf/text/WTFString.h>
 
@@ -48,15 +51,35 @@ public:
 
     const String& string() const { return m_string; }
 
+    String host() const
+    {
+        parseURLIfNecessary();
+        return m_parsedURL->isValid() ? m_parsedURL->host() : String();
+    }
+
+    String protocol() const
+    {
+        parseURLIfNecessary();
+        return m_parsedURL->isValid() ? m_parsedURL->protocol() : String();
+    }
+
 private:
     WebURL(const String& string)
         : m_string(string)
     {
     }
 
+    void parseURLIfNecessary() const
+    {
+        if (m_parsedURL)
+            return;
+        m_parsedURL = WTF::adoptPtr(new WebCore::KURL(WebCore::KURL(), m_string));
+    }
+
     virtual Type type() const { return APIType; }
 
     String m_string;
+    mutable OwnPtr<WebCore::KURL> m_parsedURL;
 };
 
 } // namespace WebKit
diff --git a/Source/WebKit2/Shared/cf/ArgumentCodersCF.cpp b/Source/WebKit2/Shared/cf/ArgumentCodersCF.cpp
index 936b6b3..c762d5b 100644
--- a/Source/WebKit2/Shared/cf/ArgumentCodersCF.cpp
+++ b/Source/WebKit2/Shared/cf/ArgumentCodersCF.cpp
@@ -48,6 +48,9 @@ enum CFType {
     CFNumber,
     CFString,
     CFURL,
+#if PLATFORM(MAC)
+    SecCertificate,
+#endif
     Null,
     Unknown,
 };
@@ -76,6 +79,10 @@ static CFType typeFromCFTypeRef(CFTypeRef type)
         return CFString;
     if (typeID == CFURLGetTypeID())
         return CFURL;
+#if PLATFORM(MAC)
+    if (typeID == SecCertificateGetTypeID())
+        return SecCertificate;
+#endif
 
     ASSERT_NOT_REACHED();
     return Unknown;
@@ -110,6 +117,11 @@ static void encode(ArgumentEncoder* encoder, CFTypeRef typeRef)
     case CFURL:
         encode(encoder, static_cast<CFURLRef>(typeRef));
         return;
+#if PLATFORM(MAC)
+    case SecCertificate:
+        encode(encoder, (SecCertificateRef)typeRef);
+        return;
+#endif
     case Null:
         return;
     case Unknown:
@@ -178,6 +190,15 @@ static bool decode(ArgumentDecoder* decoder, RetainPtr<CFTypeRef>& result)
         result.adoptCF(url.leakRef());
         return true;
     }
+#if PLATFORM(MAC)
+    case SecCertificate: {
+        RetainPtr<SecCertificateRef> certificate;
+        if (!decode(decoder, certificate))
+            return false;
+        result.adoptCF(certificate.leakRef());
+        return true;
+    }
+#endif
     case Null:
         result = tokenNullTypeRef();
         return true;
@@ -459,5 +480,22 @@ bool decode(ArgumentDecoder* decoder, RetainPtr<CFURLRef>& result)
     return true;
 }
 
-} // namespace CoreIPC
+#if PLATFORM(MAC)
+void encode(ArgumentEncoder* encoder, SecCertificateRef certificate)
+{
+    RetainPtr<CFDataRef> data(AdoptCF, SecCertificateCopyData(certificate));
+    encode(encoder, data.get());
+}
 
+bool decode(ArgumentDecoder* decoder, RetainPtr<SecCertificateRef>& result)
+{
+    RetainPtr<CFDataRef> data;
+    if (!decode(decoder, data))
+        return false;
+
+    result.adoptCF(SecCertificateCreateWithData(0, data.get()));
+    return true;
+}
+#endif
+
+} // namespace CoreIPC
diff --git a/Source/WebKit2/Shared/cf/ArgumentCodersCF.h b/Source/WebKit2/Shared/cf/ArgumentCodersCF.h
index 4caec5f..291a093 100644
--- a/Source/WebKit2/Shared/cf/ArgumentCodersCF.h
+++ b/Source/WebKit2/Shared/cf/ArgumentCodersCF.h
@@ -28,6 +28,10 @@
 
 #include <wtf/RetainPtr.h>
 
+#if PLATFORM(MAC)
+#include <Security/SecCertificate.h>
+#endif
+
 namespace CoreIPC {
 
 class ArgumentEncoder;
@@ -61,6 +65,12 @@ bool decode(ArgumentDecoder*, RetainPtr<CFStringRef>& result);
 void encode(ArgumentEncoder*, CFURLRef);
 bool decode(ArgumentDecoder*, RetainPtr<CFURLRef>& result);
 
+#if PLATFORM(MAC)
+// SecCertificateRef
+void encode(ArgumentEncoder*, SecCertificateRef);
+bool decode(ArgumentDecoder*, RetainPtr<SecCertificateRef>& result);
+#endif
+
 CFTypeRef tokenNullTypeRef();
 
 } // namespace CoreIPC
diff --git a/Source/WebKit2/Shared/cg/ShareableBitmapCG.cpp b/Source/WebKit2/Shared/cg/ShareableBitmapCG.cpp
index 28ba7ea..6bcc108 100644
--- a/Source/WebKit2/Shared/cg/ShareableBitmapCG.cpp
+++ b/Source/WebKit2/Shared/cg/ShareableBitmapCG.cpp
@@ -34,14 +34,26 @@ using namespace WebCore;
 
 namespace WebKit {
 
+static CGBitmapInfo bitmapInfo(ShareableBitmap::Flags flags)
+{
+    CGBitmapInfo info = kCGBitmapByteOrder32Host;
+    if (flags & ShareableBitmap::SupportsAlpha)
+        info |= kCGImageAlphaPremultipliedFirst;
+    else
+        info |= kCGImageAlphaNoneSkipFirst;
+
+    return info;
+}
+
 PassOwnPtr<GraphicsContext> ShareableBitmap::createGraphicsContext()
 {
     RetainPtr<CGColorSpaceRef> colorSpace(AdoptCF, CGColorSpaceCreateDeviceRGB());
 
-    ref(); // Balanced by deref in releaseData.
+
+    ref(); // Balanced by deref in releaseBitmapContextData.
     RetainPtr<CGContextRef> bitmapContext(AdoptCF, CGBitmapContextCreateWithData(data(),
         m_size.width(), m_size.height(), 8, m_size.width() * 4, colorSpace.get(),
-        kCGImageAlphaPremultipliedFirst | kCGBitmapByteOrder32Host, releaseData, this));
+        bitmapInfo(m_flags), releaseBitmapContextData, this));
 
     // We want the origin to be in the top left corner so we flip the backing store context.
     CGContextTranslateCTM(bitmapContext.get(), 0, m_size.height());
@@ -52,14 +64,38 @@ PassOwnPtr<GraphicsContext> ShareableBitmap::createGraphicsContext()
 
 void ShareableBitmap::paint(WebCore::GraphicsContext& context, const IntPoint& dstPoint, const IntRect& srcRect)
 {
-    paintBitmapContext(context.platformContext(), createGraphicsContext()->platformContext(), dstPoint, srcRect);
+    paintImage(context.platformContext(), makeCGImageCopy().get(), dstPoint, srcRect);
+}
+
+RetainPtr<CGImageRef> ShareableBitmap::makeCGImageCopy()
+{
+    OwnPtr<GraphicsContext> graphicsContext = createGraphicsContext();
+    RetainPtr<CGImageRef> image(AdoptCF, CGBitmapContextCreateImage(graphicsContext->platformContext()));
+    return image;
+}
+
+RetainPtr<CGImageRef> ShareableBitmap::makeCGImage()
+{
+    ref(); // Balanced by deref in releaseDataProviderData.
+    RetainPtr<CGDataProvider> dataProvider(AdoptCF, CGDataProviderCreateWithData(this, data(), sizeInBytes(), releaseDataProviderData));
+
+    RetainPtr<CGColorSpaceRef> colorSpace(AdoptCF, CGColorSpaceCreateDeviceRGB());
+    RetainPtr<CGImageRef> image(AdoptCF, CGImageCreate(m_size.width(), m_size.height(), 8, 32, m_size.width() * 4, colorSpace.get(), bitmapInfo(m_flags), dataProvider.get(), 0, false, kCGRenderingIntentDefault));
+    return image;
 }
 
-void ShareableBitmap::releaseData(void* typelessBitmap, void* typelessData)
+void ShareableBitmap::releaseBitmapContextData(void* typelessBitmap, void* typelessData)
 {
     ShareableBitmap* bitmap = static_cast<ShareableBitmap*>(typelessBitmap);
     ASSERT_UNUSED(typelessData, bitmap->data() == typelessData);
     bitmap->deref(); // Balanced by ref in createGraphicsContext.
 }
 
+void ShareableBitmap::releaseDataProviderData(void* typelessBitmap, const void* typelessData, size_t)
+{
+    ShareableBitmap* bitmap = static_cast<ShareableBitmap*>(typelessBitmap);
+    ASSERT_UNUSED(typelessData, bitmap->data() == typelessData);
+    bitmap->deref(); // Balanced by ref in createCGImage.
+}
+
 } // namespace WebKit
diff --git a/Source/WebKit2/Shared/cg/WebCoreArgumentCodersCG.cpp b/Source/WebKit2/Shared/cg/WebCoreArgumentCodersCG.cpp
index 058cf51..fb1395f 100644
--- a/Source/WebKit2/Shared/cg/WebCoreArgumentCodersCG.cpp
+++ b/Source/WebKit2/Shared/cg/WebCoreArgumentCodersCG.cpp
@@ -36,7 +36,7 @@ namespace CoreIPC {
 
 RefPtr<Image> createImage(ShareableBitmap* bitmap)
 {
-    RetainPtr<CGImageRef> platformImage(AdoptCF, CGBitmapContextCreateImage(bitmap->createGraphicsContext()->platformContext()));
+    RetainPtr<CGImageRef> platformImage = bitmap->makeCGImage();
     if (!platformImage)
         return 0;
     // BitmapImage::create adopts the CGImageRef that's passed in, which is why we need to leakRef here.
diff --git a/Source/WebKit2/Shared/gtk/WebCoreArgumentCodersGtk.cpp b/Source/WebKit2/Shared/gtk/WebCoreArgumentCodersGtk.cpp
index 2770a3f..73527ce 100644
--- a/Source/WebKit2/Shared/gtk/WebCoreArgumentCodersGtk.cpp
+++ b/Source/WebKit2/Shared/gtk/WebCoreArgumentCodersGtk.cpp
@@ -39,7 +39,12 @@ void encodeResourceRequest(ArgumentEncoder* encoder, const WebCore::ResourceRequ
 bool decodeResourceRequest(ArgumentDecoder* decoder, WebCore::ResourceRequest& resourceRequest)
 {
     notImplemented();
-    return false;
+
+    // FIXME: Add real implementation when we want to implement something that
+    // depends on this like the policy client.
+    // https://bugs.webkit.org/show_bug.cgi?id=55934
+    resourceRequest = WebCore::ResourceRequest();
+    return true;
 }
 
 void encodeResourceResponse(ArgumentEncoder* encoder, const WebCore::ResourceResponse& resourceResponse)
@@ -50,7 +55,27 @@ void encodeResourceResponse(ArgumentEncoder* encoder, const WebCore::ResourceRes
 bool decodeResourceResponse(ArgumentDecoder* decoder, WebCore::ResourceResponse& resourceResponse)
 {
     notImplemented();
-    return false;
+
+    // FIXME: Ditto.
+    resourceResponse = WebCore::ResourceResponse();
+    return true;
+}
+
+void encodeResourceError(ArgumentEncoder* encoder, const WebCore::ResourceError& resourceError)
+{
+    encoder->encode(CoreIPC::In(resourceError.domain(), resourceError.errorCode(), resourceError.failingURL(), resourceError.localizedDescription()));
+}
+
+bool decodeResourceError(ArgumentDecoder* decoder, WebCore::ResourceError& resourceError)
+{
+    String domain;
+    int errorCode;
+    String failingURL;
+    String localizedDescription;
+    if (!decoder->decode(CoreIPC::Out(domain, errorCode, failingURL, localizedDescription)))
+        return false;
+    resourceError = WebCore::ResourceError(domain, errorCode, failingURL, localizedDescription);
+    return true;
 }
 
 }
diff --git a/Source/WebKit2/Shared/gtk/WebEventFactory.cpp b/Source/WebKit2/Shared/gtk/WebEventFactory.cpp
index a9acbb3..d8f8b46 100644
--- a/Source/WebKit2/Shared/gtk/WebEventFactory.cpp
+++ b/Source/WebKit2/Shared/gtk/WebEventFactory.cpp
@@ -28,6 +28,7 @@
 #include "config.h"
 #include "WebEventFactory.h"
 
+#include "GtkVersioning.h"
 #include "PlatformKeyboardEvent.h"
 #include "Scrollbar.h"
 #include "WindowsKeyboardCodes.h"
@@ -41,7 +42,7 @@ namespace WebKit {
 
 static inline bool isGdkKeyCodeFromKeyPad(unsigned keyval)
 {
-    return keyval >= GDK_KEY_KP_Space && keyval <= GDK_KEY_KP_9;
+    return keyval >= GDK_KP_Space && keyval <= GDK_KP_9;
 }
 
 static inline WebEvent::Modifiers modifiersForEvent(const GdkEvent* event)
diff --git a/Source/WebKit2/Shared/mac/PlatformCertificateInfo.h b/Source/WebKit2/Shared/mac/PlatformCertificateInfo.h
index be7eb36..7ef5b37 100644
--- a/Source/WebKit2/Shared/mac/PlatformCertificateInfo.h
+++ b/Source/WebKit2/Shared/mac/PlatformCertificateInfo.h
@@ -40,6 +40,7 @@ class PlatformCertificateInfo {
 public:
     PlatformCertificateInfo();
     explicit PlatformCertificateInfo(const WebCore::ResourceResponse&);
+    explicit PlatformCertificateInfo(CFArrayRef certificateChain);
 
     CFArrayRef certificateChain() const { return m_certificateChain.get(); }
 
diff --git a/Source/WebKit2/Shared/mac/PlatformCertificateInfo.mm b/Source/WebKit2/Shared/mac/PlatformCertificateInfo.mm
index 0c0b737..5ae772c 100644
--- a/Source/WebKit2/Shared/mac/PlatformCertificateInfo.mm
+++ b/Source/WebKit2/Shared/mac/PlatformCertificateInfo.mm
@@ -26,10 +26,10 @@
 #import "config.h"
 #import "PlatformCertificateInfo.h"
 
+#import "ArgumentCodersCF.h"
 #import "ArgumentDecoder.h"
 #import "ArgumentEncoder.h"
 #import <WebKitSystemInterface.h>
-#import <Security/Security.h>
 
 using namespace WebCore;
 
@@ -44,47 +44,34 @@ PlatformCertificateInfo::PlatformCertificateInfo(const ResourceResponse& respons
 {
 }
 
+PlatformCertificateInfo::PlatformCertificateInfo(CFArrayRef certificateChain)
+    : m_certificateChain(certificateChain)
+{
+}
+
 void PlatformCertificateInfo::encode(CoreIPC::ArgumentEncoder* encoder) const
 {
-    // Special case no certificates, 
     if (!m_certificateChain) {
-        encoder->encodeUInt64(std::numeric_limits<uint64_t>::max());
+        encoder->encodeBool(false);
         return;
     }
 
-    uint64_t length = CFArrayGetCount(m_certificateChain.get());
-    encoder->encodeUInt64(length);
-
-    for (size_t i = 0; i < length; ++i) {
-        RetainPtr<CFDataRef> data(AdoptCF, SecCertificateCopyData((SecCertificateRef)CFArrayGetValueAtIndex(m_certificateChain.get(), i)));
-        encoder->encodeBytes(CFDataGetBytePtr(data.get()), CFDataGetLength(data.get()));
-    }
+    encoder->encodeBool(true);
+    CoreIPC::encode(encoder, m_certificateChain.get());
 }
 
 bool PlatformCertificateInfo::decode(CoreIPC::ArgumentDecoder* decoder, PlatformCertificateInfo& c)
 {
-    uint64_t length;
-    if (!decoder->decode(length))
+    bool hasCertificateChain;
+    if (!decoder->decode(hasCertificateChain))
         return false;
 
-    if (length == std::numeric_limits<uint64_t>::max()) {
-        // This is the no certificates case.
+    if (!hasCertificateChain)
         return true;
-    }
-
-    RetainPtr<CFMutableArrayRef> array(AdoptCF, CFArrayCreateMutable(0, length, &kCFTypeArrayCallBacks));
-
-    for (size_t i = 0; i < length; ++i) {
-        Vector<uint8_t> bytes;
-        if (!decoder->decodeBytes(bytes))
-            return false;
 
-        RetainPtr<CFDataRef> data(AdoptCF, CFDataCreateWithBytesNoCopy(0, bytes.data(), bytes.size(), kCFAllocatorNull));
-        RetainPtr<SecCertificateRef> certificate(AdoptCF, SecCertificateCreateWithData(0, data.get()));
-        CFArrayAppendValue(array.get(), certificate.get());
-    }
+    if (!CoreIPC::decode(decoder, c.m_certificateChain))
+        return false;
 
-    c.m_certificateChain = array;
     return true;
 }
 
diff --git a/Source/WebKit2/Shared/mac/WebCoreArgumentCodersMac.mm b/Source/WebKit2/Shared/mac/WebCoreArgumentCodersMac.mm
index a12e566..321cb40 100644
--- a/Source/WebKit2/Shared/mac/WebCoreArgumentCodersMac.mm
+++ b/Source/WebKit2/Shared/mac/WebCoreArgumentCodersMac.mm
@@ -27,11 +27,15 @@
 #import "WebCoreArgumentCoders.h"
 
 #import "ArgumentCodersCF.h"
+#import "PlatformCertificateInfo.h"
 #import "WebKitSystemInterface.h"
 
+using namespace WebCore;
+using namespace WebKit;
+
 namespace CoreIPC {
 
-void encodeResourceRequest(ArgumentEncoder* encoder, const WebCore::ResourceRequest& resourceRequest)
+void encodeResourceRequest(ArgumentEncoder* encoder, const ResourceRequest& resourceRequest)
 {
     bool requestIsPresent = resourceRequest.nsURLRequest();
     encoder->encode(requestIsPresent);
@@ -43,14 +47,14 @@ void encodeResourceRequest(ArgumentEncoder* encoder, const WebCore::ResourceRequ
     encode(encoder, dictionary.get());
 }
 
-bool decodeResourceRequest(ArgumentDecoder* decoder, WebCore::ResourceRequest& resourceRequest)
+bool decodeResourceRequest(ArgumentDecoder* decoder, ResourceRequest& resourceRequest)
 {
     bool requestIsPresent;
     if (!decoder->decode(requestIsPresent))
         return false;
 
     if (!requestIsPresent) {
-        resourceRequest = WebCore::ResourceRequest();
+        resourceRequest = ResourceRequest();
         return true;
     }
 
@@ -62,11 +66,11 @@ bool decodeResourceRequest(ArgumentDecoder* decoder, WebCore::ResourceRequest& r
     if (!nsURLRequest)
         return false;
 
-    resourceRequest = WebCore::ResourceRequest(nsURLRequest);
+    resourceRequest = ResourceRequest(nsURLRequest);
     return true;
 }
 
-void encodeResourceResponse(ArgumentEncoder* encoder, const WebCore::ResourceResponse& resourceResponse)
+void encodeResourceResponse(ArgumentEncoder* encoder, const ResourceResponse& resourceResponse)
 {
     bool responseIsPresent = resourceResponse.nsURLResponse();
     encoder->encode(responseIsPresent);
@@ -78,14 +82,14 @@ void encodeResourceResponse(ArgumentEncoder* encoder, const WebCore::ResourceRes
     encode(encoder, dictionary.get());
 }
 
-bool decodeResourceResponse(ArgumentDecoder* decoder, WebCore::ResourceResponse& resourceResponse)
+bool decodeResourceResponse(ArgumentDecoder* decoder, ResourceResponse& resourceResponse)
 {
     bool responseIsPresent;
     if (!decoder->decode(responseIsPresent))
         return false;
 
     if (!responseIsPresent) {
-        resourceResponse = WebCore::ResourceResponse();
+        resourceResponse = ResourceResponse();
         return true;
     }
 
@@ -97,7 +101,93 @@ bool decodeResourceResponse(ArgumentDecoder* decoder, WebCore::ResourceResponse&
     if (!nsURLResponse)
         return false;
 
-    resourceResponse = WebCore::ResourceResponse(nsURLResponse);
+    resourceResponse = ResourceResponse(nsURLResponse);
+    return true;
+}
+
+static NSString* nsString(const String& string)
+{
+    return string.impl() ? [NSString stringWithCharacters:reinterpret_cast<const UniChar*>(string.characters()) length:string.length()] : @"";
+}
+
+void encodeResourceError(ArgumentEncoder* encoder, const ResourceError& resourceError)
+{
+    bool errorIsNull = resourceError.isNull();
+    encoder->encode(errorIsNull);
+
+    if (errorIsNull)
+        return;
+
+    NSError *nsError = resourceError.nsError();
+
+    String domain = [nsError domain];
+    encoder->encode(domain);
+    
+    int64_t code = [nsError code];
+    encoder->encode(code);
+
+    HashMap<String, String> stringUserInfoMap;
+
+    NSDictionary* userInfo = [nsError userInfo];
+    for (NSString *key in userInfo) {
+        id value = [userInfo objectForKey:key];
+        if (![value isKindOfClass:[NSString class]])
+            continue;
+
+        stringUserInfoMap.set(key, (NSString *)value);
+        continue;
+    }
+    encoder->encode(stringUserInfoMap);
+
+    id peerCertificateChain = [userInfo objectForKey:@"NSErrorPeerCertificateChainKey"];
+    ASSERT(!peerCertificateChain || [peerCertificateChain isKindOfClass:[NSArray class]]);
+    encoder->encode(PlatformCertificateInfo((CFArrayRef)peerCertificateChain));
+}
+
+bool decodeResourceError(ArgumentDecoder* decoder, ResourceError& resourceError)
+{
+    bool errorIsNull;
+    if (!decoder->decode(errorIsNull))
+        return false;
+    
+    if (errorIsNull) {
+        resourceError = ResourceError();
+        return true;
+    }
+
+    String domain;
+    if (!decoder->decode(domain))
+        return false;
+
+    int64_t code;
+    if (!decoder->decode(code))
+        return false;
+
+    HashMap<String, String> stringUserInfoMap;
+    if (!decoder->decode(stringUserInfoMap))
+        return false;
+
+    PlatformCertificateInfo certificate;
+    if (!decoder->decode(certificate))
+        return false;
+
+    NSUInteger userInfoSize = stringUserInfoMap.size();
+    if (certificate.certificateChain())
+        userInfoSize++;
+
+    NSMutableDictionary* userInfo = [NSMutableDictionary dictionaryWithCapacity:userInfoSize];
+    
+    HashMap<String, String>::const_iterator it = stringUserInfoMap.begin();
+    HashMap<String, String>::const_iterator end = stringUserInfoMap.end();
+    for (; it != end; ++it)
+        [userInfo setObject:nsString(it->second) forKey:nsString(it->first)];
+
+    if (certificate.certificateChain())
+        [userInfo setObject:(NSArray *)certificate.certificateChain() forKey:@"NSErrorPeerCertificateChainKey"];
+
+    NSError *nsError = [[NSError alloc] initWithDomain:nsString(domain) code:code userInfo:userInfo];
+
+    resourceError = ResourceError(nsError);
     return true;
 }
 
diff --git a/Source/WebKit2/Shared/mac/WebEventFactory.mm b/Source/WebKit2/Shared/mac/WebEventFactory.mm
index 8f02f6b..67ab1ba 100644
--- a/Source/WebKit2/Shared/mac/WebEventFactory.mm
+++ b/Source/WebKit2/Shared/mac/WebEventFactory.mm
@@ -34,6 +34,18 @@ using namespace WebCore;
 
 namespace WebKit {
 
+static WebMouseEvent::Button currentMouseButton()
+{
+    NSUInteger pressedMouseButtons = [NSEvent pressedMouseButtons];
+    if (!pressedMouseButtons)
+        return WebMouseEvent::NoButton;
+    if (pressedMouseButtons == 1 << 0)
+        return WebMouseEvent::LeftButton;
+    if (pressedMouseButtons == 1 << 1)
+        return WebMouseEvent::RightButton;
+    return WebMouseEvent::MiddleButton;
+}
+
 static WebMouseEvent::Button mouseButtonForEvent(NSEvent *event)
 {
     switch ([event type]) {
@@ -49,6 +61,9 @@ static WebMouseEvent::Button mouseButtonForEvent(NSEvent *event)
         case NSOtherMouseUp:
         case NSOtherMouseDragged:
             return WebMouseEvent::MiddleButton;
+        case NSMouseEntered:
+        case NSMouseExited:
+            return currentMouseButton();
         default:
             return WebMouseEvent::NoButton;
     }
diff --git a/Source/WebKit2/Shared/qt/WebCoreArgumentCodersQt.cpp b/Source/WebKit2/Shared/qt/WebCoreArgumentCodersQt.cpp
index a5d5f12..8377923 100644
--- a/Source/WebKit2/Shared/qt/WebCoreArgumentCodersQt.cpp
+++ b/Source/WebKit2/Shared/qt/WebCoreArgumentCodersQt.cpp
@@ -60,4 +60,21 @@ bool decodeResourceResponse(ArgumentDecoder* decoder, WebCore::ResourceResponse&
     return true;
 }
 
+void encodeResourceError(ArgumentEncoder* encoder, const WebCore::ResourceError& resourceError)
+{
+    encoder->encode(CoreIPC::In(resourceError.domain(), resourceError.errorCode(), resourceError.failingURL(), resourceError.localizedDescription()));
+}
+
+bool decodeResourceError(ArgumentDecoder* decoder, WebCore::ResourceError& resourceError)
+{
+    String domain;
+    int errorCode;
+    String failingURL;
+    String localizedDescription;
+    if (!decoder->decode(CoreIPC::Out(domain, errorCode, failingURL, localizedDescription)))
+        return false;
+    resourceError = WebCore::ResourceError(domain, errorCode, failingURL, localizedDescription);
+    return true;
+}
+
 } // namespace CoreIPC
diff --git a/Source/WebKit2/Shared/win/PlatformCertificateInfo.cpp b/Source/WebKit2/Shared/win/PlatformCertificateInfo.cpp
index ade2291..0d1ca36 100644
--- a/Source/WebKit2/Shared/win/PlatformCertificateInfo.cpp
+++ b/Source/WebKit2/Shared/win/PlatformCertificateInfo.cpp
@@ -65,14 +65,23 @@ PlatformCertificateInfo::PlatformCertificateInfo(const ResourceResponse& respons
     PCERT_SIMPLE_CHAIN firstSimpleChain = chainContext->rgpChain[0];
     for (unsigned i = 0; i < firstSimpleChain->cElement; ++i) {
         PCCERT_CONTEXT certificateContext = firstSimpleChain->rgpElement[i]->pCertContext;
-        ::CertDuplicateCertificateContext(certificateContext);
-        m_certificateChain.append(certificateContext);
+        PCCERT_CONTEXT certificateContextCopy = ::CertDuplicateCertificateContext(certificateContext);
+        m_certificateChain.append(certificateContextCopy);
     }
 #else
     // FIXME: WinCairo implementation
 #endif
 }
 
+PlatformCertificateInfo::PlatformCertificateInfo(PCCERT_CONTEXT certificateContext)
+{
+    if (!certificateContext)
+        return;
+    
+    PCCERT_CONTEXT certificateContextCopy = ::CertDuplicateCertificateContext(certificateContext);
+    m_certificateChain.append(certificateContextCopy);    
+}
+
 PlatformCertificateInfo::~PlatformCertificateInfo()
 {
     clearCertificateChain();
@@ -81,8 +90,8 @@ PlatformCertificateInfo::~PlatformCertificateInfo()
 PlatformCertificateInfo::PlatformCertificateInfo(const PlatformCertificateInfo& other)
 {
     for (size_t i = 0; i < other.m_certificateChain.size(); ++i) {
-        ::CertDuplicateCertificateContext(other.m_certificateChain[i]);
-        m_certificateChain.append(other.m_certificateChain[i]);
+        PCCERT_CONTEXT certificateContextCopy = ::CertDuplicateCertificateContext(other.m_certificateChain[i]);
+        m_certificateChain.append(certificateContextCopy);
     }
 }
 
@@ -90,8 +99,8 @@ PlatformCertificateInfo& PlatformCertificateInfo::operator=(const PlatformCertif
 {
     clearCertificateChain();
     for (size_t i = 0; i < other.m_certificateChain.size(); ++i) {
-        ::CertDuplicateCertificateContext(other.m_certificateChain[i]);
-        m_certificateChain.append(other.m_certificateChain[i]);
+        PCCERT_CONTEXT certificateContextCopy = ::CertDuplicateCertificateContext(other.m_certificateChain[i]);
+        m_certificateChain.append(certificateContextCopy);
     }
     return *this;
 }
diff --git a/Source/WebKit2/Shared/win/PlatformCertificateInfo.h b/Source/WebKit2/Shared/win/PlatformCertificateInfo.h
index e483d37..dd999ef 100644
--- a/Source/WebKit2/Shared/win/PlatformCertificateInfo.h
+++ b/Source/WebKit2/Shared/win/PlatformCertificateInfo.h
@@ -43,6 +43,7 @@ class PlatformCertificateInfo {
 public:
     PlatformCertificateInfo();
     explicit PlatformCertificateInfo(const WebCore::ResourceResponse&);    
+    explicit PlatformCertificateInfo(PCCERT_CONTEXT);    
     ~PlatformCertificateInfo();
 
     PlatformCertificateInfo(const PlatformCertificateInfo&);
diff --git a/Source/WebKit2/Shared/win/WebCoreArgumentCodersWin.cpp b/Source/WebKit2/Shared/win/WebCoreArgumentCodersWin.cpp
index 9513e90..d659ac4 100644
--- a/Source/WebKit2/Shared/win/WebCoreArgumentCodersWin.cpp
+++ b/Source/WebKit2/Shared/win/WebCoreArgumentCodersWin.cpp
@@ -28,6 +28,8 @@
 
 #if USE(CFNETWORK)
 #include "ArgumentCodersCF.h"
+#include "PlatformCertificateInfo.h"
+#include <WebCore/CertificateCFWin.h>
 #include <WebKitSystemInterface/WebKitSystemInterface.h>
 #endif
 
@@ -117,4 +119,39 @@ bool decodeResourceResponse(ArgumentDecoder* decoder, WebCore::ResourceResponse&
 #endif
 }
 
+void encodeResourceError(ArgumentEncoder* encoder, const WebCore::ResourceError& resourceError)
+{
+    encoder->encode(CoreIPC::In(resourceError.domain(), resourceError.errorCode(), resourceError.failingURL(), resourceError.localizedDescription()));
+
+#if USE(CFNETWORK)
+    encoder->encode(WebKit::PlatformCertificateInfo(resourceError.certificate()));
+#endif
+}
+
+bool decodeResourceError(ArgumentDecoder* decoder, WebCore::ResourceError& resourceError)
+{
+    String domain;
+    int errorCode;
+    String failingURL;
+    String localizedDescription;
+    if (!decoder->decode(CoreIPC::Out(domain, errorCode, failingURL, localizedDescription)))
+        return false;
+
+#if USE(CFNETWORK)
+    WebKit::PlatformCertificateInfo certificate;
+    if (!decoder->decode(certificate))
+        return false;
+    
+    const Vector<PCCERT_CONTEXT> certificateChain = certificate.certificateChain();
+    if (!certificateChain.isEmpty()) {
+        ASSERT(certificateChain.size() == 1);
+        resourceError = WebCore::ResourceError(domain, errorCode, failingURL, localizedDescription, WebCore::copyCertificateToData(certificateChain.first()).get());
+        return true;
+    }
+#endif
+
+    resourceError = WebCore::ResourceError(domain, errorCode, failingURL, localizedDescription);
+    return true;
+}
+
 } // namespace CoreIPC
diff --git a/Source/WebKit2/UIProcess/API/C/WKAPICast.h b/Source/WebKit2/UIProcess/API/C/WKAPICast.h
index a2983e9..a440c6f 100644
--- a/Source/WebKit2/UIProcess/API/C/WKAPICast.h
+++ b/Source/WebKit2/UIProcess/API/C/WKAPICast.h
@@ -29,12 +29,16 @@
 
 #include "CacheModel.h"
 #include "FontSmoothingLevel.h"
+#include "HTTPCookieAcceptPolicy.h"
+#include "ResourceCachesToClear.h"
 #include "WKContext.h"
+#include "WKCookieManager.h"
 #include "WKCredentialTypes.h"
 #include "WKPage.h"
 #include "WKPreferencesPrivate.h"
 #include "WKProtectionSpaceTypes.h"
 #include "WKSharedAPICast.h"
+#include <WebCore/CookieJar.h>
 #include <WebCore/Credential.h>
 #include <WebCore/FrameLoaderTypes.h>
 #include <WebCore/ProtectionSpace.h>
@@ -58,8 +62,10 @@ class WebFramePolicyListenerProxy;
 class WebFrameProxy;
 class WebGeolocationManagerProxy;
 class WebGeolocationPosition;
+class WebIconDatabase;
 class WebInspectorProxy;
 class WebKeyValueStorageManagerProxy;
+class WebMediaCacheManagerProxy;
 class WebNavigationData;
 class WebOpenPanelParameters;
 class WebOpenPanelResultListenerProxy;
@@ -86,7 +92,9 @@ WK_ADD_API_MAPPING(WKFrameRef, WebFrameProxy)
 WK_ADD_API_MAPPING(WKGeolocationManagerRef, WebGeolocationManagerProxy)
 WK_ADD_API_MAPPING(WKGeolocationPermissionRequestRef, GeolocationPermissionRequestProxy)
 WK_ADD_API_MAPPING(WKGeolocationPositionRef, WebGeolocationPosition)
+WK_ADD_API_MAPPING(WKIconDatabaseRef, WebIconDatabase)
 WK_ADD_API_MAPPING(WKKeyValueStorageManagerRef, WebKeyValueStorageManagerProxy)
+WK_ADD_API_MAPPING(WKMediaCacheManagerRef, WebMediaCacheManagerProxy)
 WK_ADD_API_MAPPING(WKNavigationDataRef, WebNavigationData)
 WK_ADD_API_MAPPING(WKOpenPanelParametersRef, WebOpenPanelParameters)
 WK_ADD_API_MAPPING(WKOpenPanelResultListenerRef, WebOpenPanelResultListenerProxy)
@@ -235,6 +243,49 @@ inline WebCore::CredentialPersistence toCredentialPersistence(WKCredentialPersis
     }
 }
 
+inline ResourceCachesToClear toResourceCachesToClear(WKResourceCachesToClear wkResourceCachesToClear)
+{
+    switch (wkResourceCachesToClear) {
+    case kWKAllResourceCaches:
+        return AllResourceCaches;
+    case kWKInMemoryResourceCachesOnly:
+        return InMemoryResourceCachesOnly;
+    }
+
+    ASSERT_NOT_REACHED();
+    return AllResourceCaches;
+}
+
+inline HTTPCookieAcceptPolicy toHTTPCookieAcceptPolicy(WKHTTPCookieAcceptPolicy policy)
+{
+    switch (policy) {
+    case kWKHTTPCookieAcceptPolicyAlways:
+        return HTTPCookieAcceptPolicyAlways;
+    case kWKHTTPCookieAcceptPolicyNever:
+        return HTTPCookieAcceptPolicyNever;
+    case kWKHTTPCookieAcceptPolicyOnlyFromMainDocumentDomain:
+        return HTTPCookieAcceptPolicyOnlyFromMainDocumentDomain;
+    }
+
+    ASSERT_NOT_REACHED();
+    return HTTPCookieAcceptPolicyAlways;
+}
+
+inline WKHTTPCookieAcceptPolicy toAPI(HTTPCookieAcceptPolicy policy)
+{
+    switch (policy) {
+    case HTTPCookieAcceptPolicyAlways:
+        return kWKHTTPCookieAcceptPolicyAlways;
+    case HTTPCookieAcceptPolicyNever:
+        return kWKHTTPCookieAcceptPolicyNever;
+    case HTTPCookieAcceptPolicyOnlyFromMainDocumentDomain:
+        return kWKHTTPCookieAcceptPolicyOnlyFromMainDocumentDomain;
+    }
+
+    ASSERT_NOT_REACHED();
+    return kWKHTTPCookieAcceptPolicyAlways;
+}
+
 } // namespace WebKit
 
 #if defined(WIN32) || defined(_WIN32)
diff --git a/Source/WebKit2/UIProcess/API/C/WKContext.cpp b/Source/WebKit2/UIProcess/API/C/WKContext.cpp
index 6e4e5e0..bf196b7 100644
--- a/Source/WebKit2/UIProcess/API/C/WKContext.cpp
+++ b/Source/WebKit2/UIProcess/API/C/WKContext.cpp
@@ -148,9 +148,9 @@ void WKContextSetDomainRelaxationForbiddenForURLScheme(WKContextRef contextRef,
     toImpl(contextRef)->setDomainRelaxationForbiddenForURLScheme(toImpl(urlScheme)->string());
 }
 
-void WKContextClearResourceCaches(WKContextRef contextRef)
+void WKContextClearResourceCaches(WKContextRef contextRef, WKResourceCachesToClear cachesToClear)
 {
-    toImpl(contextRef)->clearResourceCaches();
+    toImpl(contextRef)->clearResourceCaches(toResourceCachesToClear(cachesToClear));
 }
 
 void WKContextClearApplicationCache(WKContextRef contextRef)
@@ -178,11 +178,21 @@ WKGeolocationManagerRef WKContextGetGeolocationManager(WKContextRef contextRef)
     return toAPI(toImpl(contextRef)->geolocationManagerProxy());
 }
 
+WKIconDatabaseRef WKContextGetIconDatabase(WKContextRef contextRef)
+{
+    return toAPI(toImpl(contextRef)->iconDatabase());
+}
+
 WKKeyValueStorageManagerRef WKContextGetKeyValueStorageManager(WKContextRef contextRef)
 {
     return toAPI(toImpl(contextRef)->keyValueStorageManagerProxy());
 }
 
+WKMediaCacheManagerRef WKContextGetMediaCacheManager(WKContextRef contextRef)
+{
+    return toAPI(toImpl(contextRef)->mediaCacheManagerProxy());
+}
+
 WKPluginSiteDataManagerRef WKContextGetPluginSiteDataManager(WKContextRef contextRef)
 {
     return toAPI(toImpl(contextRef)->pluginSiteDataManager());
@@ -203,7 +213,17 @@ void WKContextStopMemorySampler(WKContextRef contextRef)
     toImpl(contextRef)->stopMemorySampler();
 }
 
+void WKContextSetIconDatabasePath(WKContextRef contextRef, WKStringRef iconDatabasePath)
+{
+    toImpl(contextRef)->setIconDatabasePath(toImpl(iconDatabasePath)->string());
+}
+
 void WKContextSetDatabaseDirectory(WKContextRef contextRef, WKStringRef databaseDirectory)
 {
     toImpl(contextRef)->setDatabaseDirectory(toImpl(databaseDirectory)->string());
 }
+
+void WKContextSetLocalStorageDirectory(WKContextRef contextRef, WKStringRef localStorageDirectory)
+{
+    toImpl(contextRef)->setLocalStorageDirectory(toImpl(localStorageDirectory)->string());
+}
diff --git a/Source/WebKit2/UIProcess/API/C/WKContext.h b/Source/WebKit2/UIProcess/API/C/WKContext.h
index f8e7cee..606574f 100644
--- a/Source/WebKit2/UIProcess/API/C/WKContext.h
+++ b/Source/WebKit2/UIProcess/API/C/WKContext.h
@@ -39,6 +39,12 @@ enum {
 };
 typedef uint32_t WKCacheModel;
 
+enum {
+    kWKAllResourceCaches = 0,
+    kWKInMemoryResourceCachesOnly = 1
+};
+typedef uint32_t WKResourceCachesToClear;
+
 // Injected Bundle Client
 typedef void (*WKContextDidReceiveMessageFromInjectedBundleCallback)(WKContextRef page, WKStringRef messageName, WKTypeRef messageBody, const void *clientInfo);
 typedef void (*WKContextDidReceiveSynchronousMessageFromInjectedBundleCallback)(WKContextRef page, WKStringRef messageName, WKTypeRef messageBody, WKTypeRef* returnData, const void *clientInfo);
@@ -71,6 +77,7 @@ typedef struct WKContextHistoryClient WKContextHistoryClient;
 
 // Download Client
 typedef void (*WKContextDownloadDidStartCallback)(WKContextRef context, WKDownloadRef download, const void *clientInfo);
+typedef void (*WKContextDownloadDidReceiveAuthenticationChallengeCallback)(WKContextRef context, WKDownloadRef download, WKAuthenticationChallengeRef authenticationChallenge, const void *clientInfo);
 typedef void (*WKContextDownloadDidReceiveResponseCallback)(WKContextRef context, WKDownloadRef download, WKURLResponseRef response, const void *clientInfo);
 typedef void (*WKContextDownloadDidReceiveDataCallback)(WKContextRef context, WKDownloadRef download, uint64_t length, const void *clientInfo);
 typedef bool (*WKContextDownloadShouldDecodeSourceDataOfMIMETypeCallback)(WKContextRef context, WKDownloadRef download, WKStringRef mimeType, const void *clientInfo);
@@ -85,6 +92,7 @@ struct WKContextDownloadClient {
     int                                                                 version;
     const void *                                                        clientInfo;
     WKContextDownloadDidStartCallback                                   didStart;
+    WKContextDownloadDidReceiveAuthenticationChallengeCallback          didReceiveAuthenticationChallenge;
     WKContextDownloadDidReceiveResponseCallback                         didReceiveResponse;
     WKContextDownloadDidReceiveDataCallback                             didReceiveData;
     WKContextDownloadShouldDecodeSourceDataOfMIMETypeCallback           shouldDecodeSourceDataOfMIMEType;
@@ -117,7 +125,7 @@ WK_EXPORT void WKContextAddVisitedLink(WKContextRef context, WKStringRef visited
 WK_EXPORT void WKContextSetCacheModel(WKContextRef context, WKCacheModel cacheModel);
 WK_EXPORT WKCacheModel WKContextGetCacheModel(WKContextRef context);
 
-WK_EXPORT void WKContextClearResourceCaches(WKContextRef context);
+WK_EXPORT void WKContextClearResourceCaches(WKContextRef context, WKResourceCachesToClear cachesToClear);
 WK_EXPORT void WKContextClearApplicationCache(WKContextRef context);
 
 WK_EXPORT void WKContextStartMemorySampler(WKContextRef context, WKDoubleRef interval);
@@ -127,7 +135,9 @@ WK_EXPORT WKApplicationCacheManagerRef WKContextGetApplicationCacheManager(WKCon
 WK_EXPORT WKCookieManagerRef WKContextGetCookieManager(WKContextRef context);
 WK_EXPORT WKDatabaseManagerRef WKContextGetDatabaseManager(WKContextRef context);
 WK_EXPORT WKGeolocationManagerRef WKContextGetGeolocationManager(WKContextRef context);
+WK_EXPORT WKIconDatabaseRef WKContextGetIconDatabase(WKContextRef context);
 WK_EXPORT WKKeyValueStorageManagerRef WKContextGetKeyValueStorageManager(WKContextRef context);
+WK_EXPORT WKMediaCacheManagerRef WKContextGetMediaCacheManager(WKContextRef context);
 WK_EXPORT WKPluginSiteDataManagerRef WKContextGetPluginSiteDataManager(WKContextRef context);
 WK_EXPORT WKResourceCacheManagerRef WKContextGetResourceCacheManager(WKContextRef context);
 
diff --git a/Source/WebKit2/UIProcess/API/C/WKContextPrivate.h b/Source/WebKit2/UIProcess/API/C/WKContextPrivate.h
index bcd24a5..5fd7dd3 100644
--- a/Source/WebKit2/UIProcess/API/C/WKContextPrivate.h
+++ b/Source/WebKit2/UIProcess/API/C/WKContextPrivate.h
@@ -54,9 +54,12 @@ WK_EXPORT void WKContextRegisterURLSchemeAsSecure(WKContextRef context, WKString
 
 WK_EXPORT void WKContextSetDomainRelaxationForbiddenForURLScheme(WKContextRef context, WKStringRef urlScheme);
 
-// FIXME: This function is only effective if called before the Web process is launched. But
-// we should really change this setting to be on WebPreferences and changeable at runtime.
+WK_EXPORT void WKContextSetIconDatabasePath(WKContextRef context, WKStringRef iconDatabasePath);
+
+// FIXME: These functions are only effective if called before the Web process is launched. But
+// we should really change these settings to be on WebPreferences and changeable at runtime.
 WK_EXPORT void WKContextSetDatabaseDirectory(WKContextRef context, WKStringRef databaseDirectory);
+WK_EXPORT void WKContextSetLocalStorageDirectory(WKContextRef context, WKStringRef localStorageDirectory);
 
 #ifdef __cplusplus
 }
diff --git a/Source/WebKit2/UIProcess/API/C/WKCookieManager.cpp b/Source/WebKit2/UIProcess/API/C/WKCookieManager.cpp
index 83578f7..50e2732 100644
--- a/Source/WebKit2/UIProcess/API/C/WKCookieManager.cpp
+++ b/Source/WebKit2/UIProcess/API/C/WKCookieManager.cpp
@@ -58,6 +58,16 @@ void WKCookieManagerDeleteAllCookies(WKCookieManagerRef cookieManagerRef)
     toImpl(cookieManagerRef)->deleteAllCookies();
 }
 
+void WKCookieManagerSetHTTPCookieAcceptPolicy(WKCookieManagerRef cookieManager, WKHTTPCookieAcceptPolicy policy)
+{
+    toImpl(cookieManager)->setHTTPCookieAcceptPolicy(toHTTPCookieAcceptPolicy(policy));
+}
+
+void WKCookieManagerGetHTTPCookieAcceptPolicy(WKCookieManagerRef cookieManager, void* context, WKCookieManagerGetHTTPCookieAcceptPolicyFunction callback)
+{
+    toImpl(cookieManager)->getHTTPCookieAcceptPolicy(HTTPCookieAcceptPolicyCallback::create(context, callback));
+}
+
 void WKCookieManagerStartObservingCookieChanges(WKCookieManagerRef cookieManager)
 {
     toImpl(cookieManager)->startObservingCookieChanges();
diff --git a/Source/WebKit2/UIProcess/API/C/WKCookieManager.h b/Source/WebKit2/UIProcess/API/C/WKCookieManager.h
index 75d8ef5..4da60f4 100644
--- a/Source/WebKit2/UIProcess/API/C/WKCookieManager.h
+++ b/Source/WebKit2/UIProcess/API/C/WKCookieManager.h
@@ -32,6 +32,13 @@
 extern "C" {
 #endif
 
+enum {
+    kWKHTTPCookieAcceptPolicyAlways = 0,
+    kWKHTTPCookieAcceptPolicyNever = 1,
+    kWKHTTPCookieAcceptPolicyOnlyFromMainDocumentDomain = 2
+};
+typedef uint32_t WKHTTPCookieAcceptPolicy;
+
 // Cookie Manager Client
 typedef void (*WKCookieManagerCookiesDidChangeCallback)(WKCookieManagerRef cookieManager, const void *clientInfo);
 
@@ -52,6 +59,10 @@ WK_EXPORT void WKCookieManagerGetHostnamesWithCookies(WKCookieManagerRef cookieM
 WK_EXPORT void WKCookieManagerDeleteCookiesForHostname(WKCookieManagerRef cookieManager, WKStringRef hostname);
 WK_EXPORT void WKCookieManagerDeleteAllCookies(WKCookieManagerRef cookieManager);
 
+WK_EXPORT void WKCookieManagerSetHTTPCookieAcceptPolicy(WKCookieManagerRef cookieManager, WKHTTPCookieAcceptPolicy policy);
+typedef void (*WKCookieManagerGetHTTPCookieAcceptPolicyFunction)(WKHTTPCookieAcceptPolicy, WKErrorRef, void*);
+WK_EXPORT void WKCookieManagerGetHTTPCookieAcceptPolicy(WKCookieManagerRef cookieManager, void* context, WKCookieManagerGetHTTPCookieAcceptPolicyFunction callback);
+
 WK_EXPORT void WKCookieManagerStartObservingCookieChanges(WKCookieManagerRef cookieManager);
 WK_EXPORT void WKCookieManagerStopObservingCookieChanges(WKCookieManagerRef cookieManager);
 
diff --git a/Source/WebKit2/UIProcess/API/C/WKIconDatabase.cpp b/Source/WebKit2/UIProcess/API/C/WKIconDatabase.cpp
new file mode 100644
index 0000000..c8e87a0
--- /dev/null
+++ b/Source/WebKit2/UIProcess/API/C/WKIconDatabase.cpp
@@ -0,0 +1,52 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WKIconDatabase.h"
+
+#include "WKAPICast.h"
+#include "WebIconDatabase.h"
+
+using namespace WebKit;
+
+WKTypeID WKIconDatabaseGetTypeID()
+{
+    return toAPI(WebIconDatabase::APIType);
+}
+
+void WKIconDatabaseRetainIconForURL(WKIconDatabaseRef iconDatabaseRef, WKURLRef pageURLRef)
+{
+    toImpl(iconDatabaseRef)->retainIconForPageURL(toWTFString(pageURLRef));
+}
+
+void WKIconDatabaseReleaseIconForURL(WKIconDatabaseRef iconDatabaseRef, WKURLRef pageURLRef)
+{
+    toImpl(iconDatabaseRef)->releaseIconForPageURL(toWTFString(pageURLRef));
+}
+
+void WKIconDatabaseEnableDatabaseCleanup(WKIconDatabaseRef iconDatabaseRef)
+{
+    toImpl(iconDatabaseRef)->enableDatabaseCleanup();
+}
diff --git a/Source/WebKit2/UIProcess/API/C/WKIconDatabase.h b/Source/WebKit2/UIProcess/API/C/WKIconDatabase.h
new file mode 100644
index 0000000..1ea1860
--- /dev/null
+++ b/Source/WebKit2/UIProcess/API/C/WKIconDatabase.h
@@ -0,0 +1,45 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WKIconDatabase_h
+#define WKIconDatabase_h
+
+#include <WebKit2/WKBase.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+WK_EXPORT WKTypeID WKIconDatabaseGetTypeID();
+
+WK_EXPORT void WKIconDatabaseRetainIconForURL(WKIconDatabaseRef iconDatabase, WKURLRef pageURL);
+WK_EXPORT void WKIconDatabaseReleaseIconForURL(WKIconDatabaseRef iconDatabase, WKURLRef pageURL);
+WK_EXPORT void WKIconDatabaseEnableDatabaseCleanup(WKIconDatabaseRef iconDatabase);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* WKIconDatabase_h */
diff --git a/Source/WebKit2/UIProcess/API/C/WKMediaCacheManager.cpp b/Source/WebKit2/UIProcess/API/C/WKMediaCacheManager.cpp
new file mode 100644
index 0000000..6e2ecce
--- /dev/null
+++ b/Source/WebKit2/UIProcess/API/C/WKMediaCacheManager.cpp
@@ -0,0 +1,52 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WKMediaCacheManager.h"
+
+#include "WKAPICast.h"
+#include "WebMediaCacheManagerProxy.h"
+
+using namespace WebKit;
+
+WKTypeID WKMediaCacheManagerGetTypeID()
+{
+    return toAPI(WebMediaCacheManagerProxy::APIType);
+}
+
+void WKMediaCacheManagerGetHostnamesWithMediaCache(WKMediaCacheManagerRef mediaCacheManagerRef, void* context, WKMediaCacheManagerGetHostnamesWithMediaCacheFunction callback)
+{
+    toImpl(mediaCacheManagerRef)->getHostnamesWithMediaCache(ArrayCallback::create(context, callback));
+}
+
+void WKMediaCacheManagerClearCacheForHostname(WKMediaCacheManagerRef mediaCacheManagerRef, WKStringRef hostname)
+{
+    toImpl(mediaCacheManagerRef)->clearCacheForHostname(toWTFString(hostname));
+}
+
+void WKMediaCacheManagerClearCacheForAllHostnames(WKMediaCacheManagerRef mediaCacheManagerRef)
+{
+    toImpl(mediaCacheManagerRef)->clearCacheForAllHostnames();
+}
diff --git a/Source/WebKit2/UIProcess/API/C/WKMediaCacheManager.h b/Source/WebKit2/UIProcess/API/C/WKMediaCacheManager.h
new file mode 100644
index 0000000..eee1b92
--- /dev/null
+++ b/Source/WebKit2/UIProcess/API/C/WKMediaCacheManager.h
@@ -0,0 +1,47 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WKMediaCacheManager_h
+#define WKMediaCacheManager_h
+
+#include <WebKit2/WKBase.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+WK_EXPORT WKTypeID WKMediaCacheManagerGetTypeID();
+
+typedef void (*WKMediaCacheManagerGetHostnamesWithMediaCacheFunction)(WKArrayRef, WKErrorRef, void*);
+WK_EXPORT void WKMediaCacheManagerGetHostnamesWithMediaCache(WKMediaCacheManagerRef mediaCacheManager, void* context, WKMediaCacheManagerGetHostnamesWithMediaCacheFunction function);
+
+WK_EXPORT void WKMediaCacheManagerClearCacheForHostname(WKMediaCacheManagerRef mediaCacheManager, WKStringRef hostname);
+WK_EXPORT void WKMediaCacheManagerClearCacheForAllHostnames(WKMediaCacheManagerRef mediaCacheManager);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif // WKMediaCacheManager_h
diff --git a/Source/WebKit2/UIProcess/API/C/WKPage.cpp b/Source/WebKit2/UIProcess/API/C/WKPage.cpp
index c4e8eae..7061e39 100644
--- a/Source/WebKit2/UIProcess/API/C/WKPage.cpp
+++ b/Source/WebKit2/UIProcess/API/C/WKPage.cpp
@@ -56,7 +56,7 @@ WKPageGroupRef WKPageGetPageGroup(WKPageRef pageRef)
 
 void WKPageLoadURL(WKPageRef pageRef, WKURLRef URLRef)
 {
-    toImpl(pageRef)->loadURL(toImpl(URLRef)->string());
+    toImpl(pageRef)->loadURL(toWTFString(URLRef));
 }
 
 void WKPageLoadURLRequest(WKPageRef pageRef, WKURLRequestRef urlRequestRef)
diff --git a/Source/WebKit2/UIProcess/API/C/WKPage.h b/Source/WebKit2/UIProcess/API/C/WKPage.h
index 655e999..03f49f7 100644
--- a/Source/WebKit2/UIProcess/API/C/WKPage.h
+++ b/Source/WebKit2/UIProcess/API/C/WKPage.h
@@ -173,6 +173,7 @@ typedef void (*WKPageDrawHeaderCallback)(WKPageRef page, WKFrameRef frame, WKRec
 typedef void (*WKPageDrawFooterCallback)(WKPageRef page, WKFrameRef frame, WKRect rect, const void* clientInfo);
 typedef void (*WKPagePrintFrameCallback)(WKPageRef page, WKFrameRef frame, const void* clientInfo);
 typedef void (*WKPageDidCompleteRubberBandForMainFrameCallback)(WKPageRef page, WKSize initialOverhang, const void* clientInfo);
+typedef void (*WKPageSaveDataToFileInDownloadsFolderCallback)(WKPageRef page, WKStringRef suggestedFilename, WKStringRef mimeType, WKURLRef originatingURL, WKDataRef data, const void* clientInfo);
 
 struct WKPageUIClient {
     int                                                                 version;
@@ -210,6 +211,7 @@ struct WKPageUIClient {
     WKPagePrintFrameCallback                                            printFrame;
     WKPageCallback                                                      runModal;
     WKPageDidCompleteRubberBandForMainFrameCallback                     didCompleteRubberBandForMainFrame;
+    WKPageSaveDataToFileInDownloadsFolderCallback                       saveDataToFileInDownloadsFolder;
 };
 typedef struct WKPageUIClient WKPageUIClient;
 
diff --git a/Source/WebKit2/UIProcess/API/C/WKPreferences.cpp b/Source/WebKit2/UIProcess/API/C/WKPreferences.cpp
index 7ba9ba0..0122531 100644
--- a/Source/WebKit2/UIProcess/API/C/WKPreferences.cpp
+++ b/Source/WebKit2/UIProcess/API/C/WKPreferences.cpp
@@ -311,6 +311,16 @@ bool WKPreferencesGetAcceleratedDrawingEnabled(WKPreferencesRef preferencesRef)
     return toImpl(preferencesRef)->acceleratedDrawingEnabled();
 }
 
+void WKPreferencesSetCanvasUsesAcceleratedDrawing(WKPreferencesRef preferencesRef, bool flag)
+{
+    toImpl(preferencesRef)->setCanvasUsesAcceleratedDrawing(flag);
+}
+
+bool WKPreferencesGetCanvasUsesAcceleratedDrawing(WKPreferencesRef preferencesRef)
+{
+    return toImpl(preferencesRef)->canvasUsesAcceleratedDrawing();
+}
+
 void WKPreferencesSetAcceleratedCompositingEnabled(WKPreferencesRef preferencesRef, bool flag)
 {
     toImpl(preferencesRef)->setAcceleratedCompositingEnabled(flag);
@@ -480,3 +490,43 @@ bool WKPreferencesGetJavaScriptCanAccessClipboard(WKPreferencesRef preferencesRe
 {
     return toImpl(preferencesRef)->javaScriptCanAccessClipboard();
 }
+
+void WKPreferencesSetFullScreenEnabled(WKPreferencesRef preferencesRef, bool enabled)
+{
+    toImpl(preferencesRef)->setFullScreenEnabled(enabled);
+}
+
+bool WKPreferencesGetFullScreenEnabled(WKPreferencesRef preferencesRef)
+{
+    return toImpl(preferencesRef)->fullScreenEnabled();
+}
+
+void WKPreferencesSetWebSecurityEnabled(WKPreferencesRef preferencesRef, bool enabled)
+{
+    toImpl(preferencesRef)->setWebSecurityEnabled(enabled);
+}
+
+bool WKPreferencesGetWebSecurityEnabled(WKPreferencesRef preferencesRef)
+{
+    return toImpl(preferencesRef)->webSecurityEnabled();
+}
+
+void WKPreferencesSetUniversalAccessFromFileURLsAllowed(WKPreferencesRef preferencesRef, bool allowed)
+{
+    toImpl(preferencesRef)->setAllowUniversalAccessFromFileURLs(allowed);
+}
+
+bool WKPreferencesGetUniversalAccessFromFileURLsAllowed(WKPreferencesRef preferencesRef)
+{
+    return toImpl(preferencesRef)->allowUniversalAccessFromFileURLs();
+}
+
+void WKPreferencesSetFileAccessFromFileURLsAllowed(WKPreferencesRef preferencesRef, bool allowed)
+{
+    toImpl(preferencesRef)->setAllowFileAccessFromFileURLs(allowed);
+}
+
+bool WKPreferencesGetFileAccessFromFileURLsAllowed(WKPreferencesRef preferencesRef)
+{
+    return toImpl(preferencesRef)->allowFileAccessFromFileURLs();
+}
diff --git a/Source/WebKit2/UIProcess/API/C/WKPreferences.h b/Source/WebKit2/UIProcess/API/C/WKPreferences.h
index 5c6c478..f2486bf 100644
--- a/Source/WebKit2/UIProcess/API/C/WKPreferences.h
+++ b/Source/WebKit2/UIProcess/API/C/WKPreferences.h
@@ -150,6 +150,11 @@ WK_EXPORT bool WKPreferencesGetShouldPrintBackgrounds(WKPreferencesRef preferenc
 WK_EXPORT void WKPreferencesSetJavaScriptCanAccessClipboard(WKPreferencesRef preferencesRef, bool enabled);
 WK_EXPORT bool WKPreferencesGetJavaScriptCanAccessClipboard(WKPreferencesRef preferencesRef);
 
+// Defaults to false
+WK_EXPORT void WKPreferencesSetFullScreenEnabled(WKPreferencesRef preferencesRef, bool enabled);
+WK_EXPORT bool WKPreferencesGetFullScreenEnabled(WKPreferencesRef preferencesRef);
+
+
 #ifdef __cplusplus
 }
 #endif
diff --git a/Source/WebKit2/UIProcess/API/C/WKPreferencesPrivate.h b/Source/WebKit2/UIProcess/API/C/WKPreferencesPrivate.h
index 426119b..ddf1b9a 100644
--- a/Source/WebKit2/UIProcess/API/C/WKPreferencesPrivate.h
+++ b/Source/WebKit2/UIProcess/API/C/WKPreferencesPrivate.h
@@ -52,6 +52,10 @@ WK_EXPORT void WKPreferencesSetAcceleratedDrawingEnabled(WKPreferencesRef, bool)
 WK_EXPORT bool WKPreferencesGetAcceleratedDrawingEnabled(WKPreferencesRef);
 
 // Defaults to true.
+WK_EXPORT void WKPreferencesSetCanvasUsesAcceleratedDrawing(WKPreferencesRef, bool);
+WK_EXPORT bool WKPreferencesGetCanvasUsesAcceleratedDrawing(WKPreferencesRef);
+
+// Defaults to true.
 WK_EXPORT void WKPreferencesSetAcceleratedCompositingEnabled(WKPreferencesRef, bool);
 WK_EXPORT bool WKPreferencesGetAcceleratedCompositingEnabled(WKPreferencesRef);
 
@@ -99,6 +103,18 @@ WK_EXPORT bool WKPreferencesGetPaginateDuringLayoutEnabled(WKPreferencesRef pref
 WK_EXPORT void WKPreferencesSetDOMPasteAllowed(WKPreferencesRef preferences, bool enabled);
 WK_EXPORT bool WKPreferencesGetDOMPasteAllowed(WKPreferencesRef preferences);
 
+// Defaults to true.
+WK_EXPORT void WKPreferencesSetWebSecurityEnabled(WKPreferencesRef preferences, bool enabled);
+WK_EXPORT bool WKPreferencesGetWebSecurityEnabled(WKPreferencesRef preferences);
+
+// Defaults to false.
+WK_EXPORT void WKPreferencesSetUniversalAccessFromFileURLsAllowed(WKPreferencesRef preferences, bool allowed);
+WK_EXPORT bool WKPreferencesGetUniversalAccessFromFileURLsAllowed(WKPreferencesRef preferences);
+
+// Defaults to false.
+WK_EXPORT void WKPreferencesSetFileAccessFromFileURLsAllowed(WKPreferencesRef preferences, bool allowed);
+WK_EXPORT bool WKPreferencesGetFileAccessFromFileURLsAllowed(WKPreferencesRef preferences);
+
 #ifdef __cplusplus
 }
 #endif
diff --git a/Source/WebKit2/UIProcess/API/C/cg/WKIconDatabaseCG.cpp b/Source/WebKit2/UIProcess/API/C/cg/WKIconDatabaseCG.cpp
new file mode 100644
index 0000000..5e50dd8
--- /dev/null
+++ b/Source/WebKit2/UIProcess/API/C/cg/WKIconDatabaseCG.cpp
@@ -0,0 +1,41 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTAwBILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WKIconDatabaseCG.h"
+
+#include "WebIconDatabase.h"
+#include "WKAPICast.h"
+#include "WKSharedAPICast.h"
+#include <WebCore/Image.h>
+
+using namespace WebKit;
+using namespace WebCore;
+
+CGImageRef WKIconDatabaseGetCGImageForURL(WKIconDatabaseRef iconDatabaseRef, WKURLRef urlRef)
+{
+    Image* image = toImpl(iconDatabaseRef)->imageForPageURL(toWTFString(urlRef));
+    return image ? image->getCGImageRef() : 0;
+}
diff --git a/Source/WebKit2/UIProcess/API/C/cg/WKIconDatabaseCG.h b/Source/WebKit2/UIProcess/API/C/cg/WKIconDatabaseCG.h
new file mode 100644
index 0000000..48cf5bf
--- /dev/null
+++ b/Source/WebKit2/UIProcess/API/C/cg/WKIconDatabaseCG.h
@@ -0,0 +1,42 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WKIconDatabaseCG_h
+#define WKIconDatabaseCG_h
+
+#include <CoreGraphics/CGImage.h>
+#include <WebKit2/WKBase.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+WK_EXPORT CGImageRef WKIconDatabaseGetCGImageForURL(WKIconDatabaseRef iconDatabase, WKURLRef urlString);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* WKIconDatabaseCG_h */
diff --git a/Source/WebKit2/UIProcess/API/C/win/WKAPICastWin.h b/Source/WebKit2/UIProcess/API/C/win/WKAPICastWin.h
index 6acb1a6..09cf06f 100644
--- a/Source/WebKit2/UIProcess/API/C/win/WKAPICastWin.h
+++ b/Source/WebKit2/UIProcess/API/C/win/WKAPICastWin.h
@@ -33,8 +33,10 @@
 namespace WebKit {
 
 class WebView;
+class WebEditCommandProxy;
 
 WK_ADD_API_MAPPING(WKViewRef, WebView)
+WK_ADD_API_MAPPING(WKEditCommandRef, WebEditCommandProxy)
 
 }
 
diff --git a/Source/WebKit2/UIProcess/API/C/win/WKContextPrivateWin.h b/Source/WebKit2/UIProcess/API/C/win/WKContextPrivateWin.h
index c8a9c34..0d49ac9 100644
--- a/Source/WebKit2/UIProcess/API/C/win/WKContextPrivateWin.h
+++ b/Source/WebKit2/UIProcess/API/C/win/WKContextPrivateWin.h
@@ -28,6 +28,7 @@
 
 #include <WebKit2/WKBase.h>
 #include <WebKit2/WKContext.h>
+#include <WebKit2/WKCookieManager.h>
 
 #ifndef __cplusplus
 #include <stdbool.h>
@@ -40,6 +41,9 @@ extern "C" {
 // Defaults to true.
 WK_EXPORT void WKContextSetShouldPaintNativeControls(WKContextRef, bool);
 
+// Defaults to WKHTTPCookieAcceptPolicyAlways.
+WK_EXPORT void WKContextSetInitialHTTPCookieAcceptPolicy(WKContextRef, WKHTTPCookieAcceptPolicy);
+
 #ifdef __cplusplus
 }
 #endif
diff --git a/Source/WebKit2/UIProcess/API/C/win/WKContextWin.cpp b/Source/WebKit2/UIProcess/API/C/win/WKContextWin.cpp
index 110951f..4971540 100644
--- a/Source/WebKit2/UIProcess/API/C/win/WKContextWin.cpp
+++ b/Source/WebKit2/UIProcess/API/C/win/WKContextWin.cpp
@@ -36,3 +36,8 @@ void WKContextSetShouldPaintNativeControls(WKContextRef contextRef, bool b)
 {
     toImpl(contextRef)->setShouldPaintNativeControls(b);
 }
+
+void WKContextSetInitialHTTPCookieAcceptPolicy(WKContextRef contextRef, WKHTTPCookieAcceptPolicy policy)
+{
+    toImpl(contextRef)->setInitialHTTPCookieAcceptPolicy(toHTTPCookieAcceptPolicy(policy));
+}
diff --git a/Source/WebKit2/UIProcess/API/C/win/WKView.cpp b/Source/WebKit2/UIProcess/API/C/win/WKView.cpp
index 62603fe..05ae0d7 100644
--- a/Source/WebKit2/UIProcess/API/C/win/WKView.cpp
+++ b/Source/WebKit2/UIProcess/API/C/win/WKView.cpp
@@ -72,6 +72,11 @@ void WKViewSetInitialFocus(WKViewRef viewRef, bool forward)
     toImpl(viewRef)->setInitialFocus(forward);
 }
 
+void WKViewSetScrollOffsetOnNextResize(WKViewRef viewRef, WKSize scrollOffset)
+{
+    toImpl(viewRef)->setScrollOffsetOnNextResize(toIntSize(scrollOffset));
+}
+
 void WKViewSetFindIndicatorCallback(WKViewRef viewRef, WKViewFindIndicatorCallback callback, void* context)
 {
     toImpl(viewRef)->setFindIndicatorCallback(callback, context);
@@ -81,3 +86,20 @@ WKViewFindIndicatorCallback WKViewGetFindIndicatorCallback(WKViewRef viewRef, vo
 {    
     return toImpl(viewRef)->getFindIndicatorCallback(context);
 }
+
+void WKViewSetViewUndoClient(WKViewRef viewRef, const WKViewUndoClient* wkClient)
+{
+    if (wkClient && wkClient->version)
+        return;
+    toImpl(viewRef)->initializeUndoClient(wkClient);
+}
+
+void WKViewReapplyEditCommand(WKViewRef viewRef, WKEditCommandRef command)
+{
+    toImpl(viewRef)->reapplyEditCommand(toImpl(command));
+}
+
+void WKViewUnapplyEditCommand(WKViewRef viewRef, WKEditCommandRef command)
+{
+    toImpl(viewRef)->unapplyEditCommand(toImpl(command));
+}
diff --git a/Source/WebKit2/UIProcess/API/C/win/WKView.h b/Source/WebKit2/UIProcess/API/C/win/WKView.h
index 213897e..c8ac44c 100644
--- a/Source/WebKit2/UIProcess/API/C/win/WKView.h
+++ b/Source/WebKit2/UIProcess/API/C/win/WKView.h
@@ -27,12 +27,31 @@
 #define WKView_h
 
 #include <WebKit2/WKBase.h>
+#include <WebKit2/WKGeometry.h>
 #include <windows.h>
 
 #ifdef __cplusplus
 extern "C" {
 #endif
 
+// Undo Client.
+enum {
+    kWKViewUndo = 0,
+    kWKViewRedo = 1
+};
+typedef uint32_t WKViewUndoType;
+
+typedef void (*WKViewRegisterEditCommandCallback)(WKViewRef, WKEditCommandRef, WKViewUndoType undoOrRedo, const void *clientInfo);
+typedef void (*WKViewClearAllEditCommandsCallback)(WKViewRef, const void *clientInfo);
+
+struct WKViewUndoClient {
+    int                                                                 version;
+    const void *                                                        clientInfo;
+    WKViewRegisterEditCommandCallback                                   registerEditCommand;
+    WKViewClearAllEditCommandsCallback                                  clearAllEditCommands;
+};
+typedef struct WKViewUndoClient WKViewUndoClient;
+
 WK_EXPORT WKTypeID WKViewGetTypeID();
 
 WK_EXPORT WKViewRef WKViewCreate(RECT rect, WKContextRef context, WKPageGroupRef pageGroup, HWND parentWindow);
@@ -41,10 +60,15 @@ WK_EXPORT HWND WKViewGetWindow(WKViewRef view);
 
 WK_EXPORT WKPageRef WKViewGetPage(WKViewRef view);
 
+WK_EXPORT void WKViewSetViewUndoClient(WKViewRef view, const WKViewUndoClient* client);
+WK_EXPORT void WKViewReapplyEditCommand(WKViewRef view, WKEditCommandRef command);
+WK_EXPORT void WKViewUnapplyEditCommand(WKViewRef view, WKEditCommandRef command);
+
 WK_EXPORT void WKViewSetParentWindow(WKViewRef view, HWND parentWindow);
 WK_EXPORT void WKViewWindowAncestryDidChange(WKViewRef view);
 WK_EXPORT void WKViewSetIsInWindow(WKViewRef view, bool isInWindow);
 WK_EXPORT void WKViewSetInitialFocus(WKViewRef view, bool forward);
+WK_EXPORT void WKViewSetScrollOffsetOnNextResize(WKViewRef view, WKSize scrollOffset);
 
 typedef void (*WKViewFindIndicatorCallback)(WKViewRef, HBITMAP selectionBitmap, RECT selectionRectInWindowCoordinates, bool fadeout, void*);
 WK_EXPORT void WKViewSetFindIndicatorCallback(WKViewRef view, WKViewFindIndicatorCallback callback, void* context);
diff --git a/Source/WebKit2/UIProcess/API/mac/PDFViewController.h b/Source/WebKit2/UIProcess/API/mac/PDFViewController.h
index d22d8b5..dc30f56 100644
--- a/Source/WebKit2/UIProcess/API/mac/PDFViewController.h
+++ b/Source/WebKit2/UIProcess/API/mac/PDFViewController.h
@@ -41,6 +41,8 @@ namespace CoreIPC {
 
 namespace WebKit {
 
+class WebPageProxy;
+
 class PDFViewController {
     WTF_MAKE_NONCOPYABLE(PDFViewController);
 
@@ -49,6 +51,9 @@ public:
     ~PDFViewController();
 
     WKView* wkView() const { return m_wkView; }
+    WebPageProxy* page() const;
+    NSView* pdfView() const;
+    
     void setPDFDocumentData(const String& mimeType, const String& suggestedFilename, const CoreIPC::DataReference&);
 
     double zoomFactor() const;
@@ -58,6 +63,7 @@ public:
 
     NSPrintOperation *makePrintOperation(NSPrintInfo *);
     void openPDFInFinder();
+    void savePDFToDownloadsFolder();
 
 private:
     explicit PDFViewController(WKView *wkView);
diff --git a/Source/WebKit2/UIProcess/API/mac/PDFViewController.mm b/Source/WebKit2/UIProcess/API/mac/PDFViewController.mm
index 5d9b860..5c64000 100644
--- a/Source/WebKit2/UIProcess/API/mac/PDFViewController.mm
+++ b/Source/WebKit2/UIProcess/API/mac/PDFViewController.mm
@@ -29,6 +29,7 @@
 #import "DataReference.h"
 #import "WKAPICast.h"
 #import "WKView.h"
+#import "WebData.h"
 #import "WebPageGroup.h"
 #import "WebPageProxy.h"
 #import "WebPreferences.h"
@@ -116,7 +117,7 @@ extern "C" NSString *_NSPathForSystemFramework(NSString *framework);
     if (!_pdfViewController)
         return;
 
-    WebPreferences *preferences = toImpl([_pdfViewController->wkView() pageRef])->pageGroup()->preferences();
+    WebPreferences *preferences = _pdfViewController->page()->pageGroup()->preferences();
 
     CGFloat scaleFactor = preferences->pdfScaleFactor();
     if (!scaleFactor)
@@ -135,7 +136,7 @@ extern "C" NSString *_NSPathForSystemFramework(NSString *framework);
     if (!_pdfViewController)
         return;
 
-    WebPreferences* preferences = toImpl([_pdfViewController->wkView() pageRef])->pageGroup()->preferences();
+    WebPreferences* preferences = _pdfViewController->page()->pageGroup()->preferences();
 
     CGFloat scaleFactor = [_pdfView autoScales] ? 0 : [_pdfView scaleFactor];
     preferences->setPDFScaleFactor(scaleFactor);
@@ -187,6 +188,11 @@ extern "C" NSString *_NSPathForSystemFramework(NSString *framework);
     _pdfViewController->openPDFInFinder();
 }
 
+- (void)PDFViewSavePDFToDownloadFolder:(PDFView *)sender
+{
+    _pdfViewController->savePDFToDownloadsFolder();
+}
+
 @end
 
 namespace WebKit {
@@ -212,6 +218,16 @@ PDFViewController::~PDFViewController()
     m_wkPDFView = nullptr;
 }
 
+WebPageProxy* PDFViewController::page() const
+{
+    return toImpl([m_wkView pageRef]);
+}
+
+NSView* PDFViewController::pdfView() const
+{ 
+    return m_wkPDFView.get(); 
+}
+    
 static RetainPtr<CFDataRef> convertPostScriptDataSourceToPDF(const CoreIPC::DataReference& dataReference)
 {
     // Convert PostScript to PDF using Quartz 2D API
@@ -330,6 +346,32 @@ void PDFViewController::openPDFInFinder()
     [[NSWorkspace sharedWorkspace] openFile:path];
 }
 
+static void releaseCFData(unsigned char*, const void* data)
+{
+    ASSERT(CFGetTypeID(data) == CFDataGetTypeID());
+
+    // Balanced by CFRetain in savePDFToDownloadsFolder.
+    CFRelease(data);
+}
+
+void PDFViewController::savePDFToDownloadsFolder()
+{
+    // We don't want to write the file until we have a document to write. (see 5267607).
+    if (![m_pdfView document]) {
+        NSBeep();
+        return;
+    }
+
+    ASSERT(m_pdfData);
+
+    // Balanced by CFRelease in releaseCFData.
+    CFRetain(m_pdfData.get());
+
+    RefPtr<WebData> data = WebData::createWithoutCopying(CFDataGetBytePtr(m_pdfData.get()), CFDataGetLength(m_pdfData.get()), releaseCFData, m_pdfData.get());
+
+    page()->saveDataToFileInDownloadsFolder(m_suggestedFilename.get(), page()->mainFrame()->mimeType(), page()->mainFrame()->url(), data.get());
+}
+
 static NSString *temporaryPDFDirectoryPath()
 {
     static NSString *temporaryPDFDirectoryPath;
diff --git a/Source/WebKit2/UIProcess/API/mac/PageClientImpl.h b/Source/WebKit2/UIProcess/API/mac/PageClientImpl.h
index e01cf66..e217fc5 100644
--- a/Source/WebKit2/UIProcess/API/mac/PageClientImpl.h
+++ b/Source/WebKit2/UIProcess/API/mac/PageClientImpl.h
@@ -26,6 +26,7 @@
 #ifndef PageClientImpl_h
 #define PageClientImpl_h
 
+#include "CorrectionPanel.h"
 #include "PageClient.h"
 #include <wtf/RetainPtr.h>
 
@@ -62,6 +63,7 @@ private:
     virtual void processDidCrash();
     virtual void pageClosed();
     virtual void didRelaunchProcess();
+    virtual void setFocus(bool focused);
     virtual void takeFocus(bool direction);
     virtual void toolTipChanged(const String& oldToolTip, const String& newToolTip);
     virtual void setCursor(const WebCore::Cursor&);
@@ -70,11 +72,12 @@ private:
     virtual void registerEditCommand(PassRefPtr<WebEditCommandProxy>, WebPageProxy::UndoOrRedo);
     virtual void clearAllEditCommands();
     virtual void interceptKeyEvent(const NativeWebKeyboardEvent& event, Vector<WebCore::KeypressCommand>& commandName, uint32_t selectionStart, uint32_t selectionEnd, Vector<WebCore::CompositionUnderline>& underlines);
-    virtual void setDragImage(const WebCore::IntPoint& clientPosition, const WebCore::IntSize& imageSize, PassRefPtr<ShareableBitmap> dragImage, bool isLinkDrag);
+    virtual void setDragImage(const WebCore::IntPoint& clientPosition, PassRefPtr<ShareableBitmap> dragImage, bool isLinkDrag);
 
     virtual WebCore::FloatRect convertToDeviceSpace(const WebCore::FloatRect&);
     virtual WebCore::FloatRect convertToUserSpace(const WebCore::FloatRect&);
-
+    virtual WebCore::IntRect windowToScreen(const WebCore::IntRect&);
+    
     virtual void doneWithKeyEvent(const NativeWebKeyboardEvent&, bool wasEventHandled);
 
     virtual PassRefPtr<WebPopupMenuProxy> createPopupMenuProxy(WebPageProxy*);
@@ -87,7 +90,6 @@ private:
 
     virtual void accessibilityWebProcessTokenReceived(const CoreIPC::DataReference&);    
     virtual void setComplexTextInputEnabled(uint64_t pluginComplexTextInputIdentifier, bool complexTextInputEnabled);
-    virtual void setAutodisplay(bool);
 
     virtual CGContextRef containingWindowGraphicsContext();
 
@@ -103,8 +105,18 @@ private:
 
     virtual void didPerformDictionaryLookup(const String&, double scaleFactor, const DictionaryPopupInfo&);
 
+    virtual void showCorrectionPanel(WebCore::CorrectionPanelInfo::PanelType, const WebCore::FloatRect& boundingBoxOfReplacedString, const String& replacedString, const String& replacementString, const Vector<String>& alternativeReplacementStrings);
+    virtual void dismissCorrectionPanel(WebCore::ReasonForDismissingCorrectionPanel);
+    virtual String dismissCorrectionPanelSoon(WebCore::ReasonForDismissingCorrectionPanel);
+    virtual void recordAutocorrectionResponse(WebCore::EditorClient::AutocorrectionResponseType, const String& replacedString, const String& replacementString);
+
+    virtual float userSpaceScaleFactor() const;
+
     WKView* m_wkView;
     RetainPtr<WebEditorUndoTargetObjC> m_undoTarget;
+#if !defined(BUILDING_ON_SNOW_LEOPARD)
+    CorrectionPanel m_correctionPanel;
+#endif
 };
 
 } // namespace WebKit
diff --git a/Source/WebKit2/UIProcess/API/mac/PageClientImpl.mm b/Source/WebKit2/UIProcess/API/mac/PageClientImpl.mm
index 88bb9a4..7a0d62d 100644
--- a/Source/WebKit2/UIProcess/API/mac/PageClientImpl.mm
+++ b/Source/WebKit2/UIProcess/API/mac/PageClientImpl.mm
@@ -45,6 +45,7 @@
 #import <wtf/PassOwnPtr.h>
 #import <wtf/text/CString.h>
 #import <wtf/text/WTFString.h>
+#import <WebKitSystemInterface.h>
 
 @interface NSApplication (WebNSApplicationDetails)
 - (NSCursor *)_cursorRectCursor;
@@ -195,6 +196,15 @@ void PageClientImpl::didRelaunchProcess()
     [m_wkView _didRelaunchProcess];
 }
 
+void PageClientImpl::setFocus(bool focused)
+{
+    if (focused)
+        [[m_wkView window] makeFirstResponder:m_wkView];
+    else
+        // takeFocus in this context means take focus away from the WKView.
+        takeFocus(true);
+}
+    
 void PageClientImpl::takeFocus(bool direction)
 {
     [m_wkView _takeFocus:direction];
@@ -287,10 +297,11 @@ void PageClientImpl::interceptKeyEvent(const NativeWebKeyboardEvent& event, Vect
     [m_wkView _getTextInputState:selectionStart selectionEnd:selectionEnd underlines:underlines];
 }
 
-void PageClientImpl::setDragImage(const IntPoint& clientPosition, const IntSize& imageSize, PassRefPtr<ShareableBitmap> dragImage, bool isLinkDrag)
+void PageClientImpl::setDragImage(const IntPoint& clientPosition, PassRefPtr<ShareableBitmap> dragImage, bool isLinkDrag)
 {
-    OwnPtr<GraphicsContext> graphicsContext = dragImage->createGraphicsContext();
-    RetainPtr<NSImage> dragNSImage(AdoptNS, [[NSImage alloc] initWithCGImage:CGBitmapContextCreateImage(graphicsContext->platformContext()) size:imageSize]);
+    RetainPtr<CGImageRef> dragCGImage = dragImage->makeCGImage();
+    RetainPtr<NSImage> dragNSImage(AdoptNS, [[NSImage alloc] initWithCGImage:dragCGImage.get() size:dragImage->size()]);
+
     [m_wkView _setDragImage:dragNSImage.get() at:clientPosition linkDrag:isLinkDrag];
 }
     
@@ -303,6 +314,14 @@ FloatRect PageClientImpl::convertToUserSpace(const FloatRect& rect)
 {
     return [m_wkView _convertToUserSpace:rect];
 }
+    
+IntRect PageClientImpl::windowToScreen(const IntRect& rect)
+{
+    NSRect tempRect = rect;
+    tempRect = [m_wkView convertRect:tempRect toView:nil];
+    tempRect.origin = [[m_wkView window] convertBaseToScreen:tempRect.origin];
+    return enclosingIntRect(tempRect);
+}
 
 void PageClientImpl::doneWithKeyEvent(const NativeWebKeyboardEvent& event, bool wasEventHandled)
 {
@@ -311,10 +330,8 @@ void PageClientImpl::doneWithKeyEvent(const NativeWebKeyboardEvent& event, bool
         return;
     if (wasEventHandled)
         [NSCursor setHiddenUntilMouseMoves:YES];
-    else {
-        [m_wkView _setEventBeingResent:nativeEvent];
-        [[NSApplication sharedApplication] sendEvent:nativeEvent];
-    }
+    else
+        [m_wkView _resendKeyDownEvent:nativeEvent];
 }
 
 PassRefPtr<WebPopupMenuProxy> PageClientImpl::createPopupMenuProxy(WebPageProxy* page)
@@ -355,18 +372,6 @@ void PageClientImpl::setComplexTextInputEnabled(uint64_t pluginComplexTextInputI
     [m_wkView _setComplexTextInputEnabled:complexTextInputEnabled pluginComplexTextInputIdentifier:pluginComplexTextInputIdentifier];
 }
 
-void PageClientImpl::setAutodisplay(bool newState)
-{
-    if (!newState && [[m_wkView window] isAutodisplay])
-        [m_wkView displayIfNeeded];
-    
-    [[m_wkView window] setAutodisplay:newState];
-
-    // For some reason, painting doesn't happen for a long time without this call, <rdar://problem/8975229>.
-    if (newState)
-        [m_wkView displayIfNeeded];
-}
-
 CGContextRef PageClientImpl::containingWindowGraphicsContext()
 {
     NSWindow *window = [m_wkView window];
@@ -419,9 +424,64 @@ void PageClientImpl::didPerformDictionaryLookup(const String& text, double scale
     NSPoint textBaselineOrigin = dictionaryPopupInfo.origin;
     textBaselineOrigin.y += [font ascender];
     
+#if !defined(BUILDING_ON_SNOW_LEOPARD)
+    // Convert to screen coordinates.
+    textBaselineOrigin = [m_wkView convertPoint:textBaselineOrigin toView:nil];
+    textBaselineOrigin = [m_wkView.window convertRectToScreen:NSMakeRect(textBaselineOrigin.x, textBaselineOrigin.y, 0, 0)].origin;
+
+    WKShowWordDefinitionWindow(attributedString.get(), textBaselineOrigin, (NSDictionary *)dictionaryPopupInfo.options.get());
+#else
     // If the dictionary lookup is being triggered by a hot key, force the overlay style.
     NSDictionary *options = (dictionaryPopupInfo.type == DictionaryPopupInfo::HotKey) ? [NSDictionary dictionaryWithObject:NSDefinitionPresentationTypeOverlay forKey:NSDefinitionPresentationTypeKey] : 0;
     [m_wkView showDefinitionForAttributedString:attributedString.get() range:NSMakeRange(0, [attributedString.get() length]) options:options baselineOriginProvider:^(NSRange adjustedRange) { return (NSPoint)textBaselineOrigin; }];
+#endif
+}
+
+void PageClientImpl::showCorrectionPanel(CorrectionPanelInfo::PanelType type, const FloatRect& boundingBoxOfReplacedString, const String& replacedString, const String& replacementString, const Vector<String>& alternativeReplacementStrings)
+{
+#if !defined(BUILDING_ON_SNOW_LEOPARD)
+    if (!isViewVisible() || !isViewInWindow())
+        return;
+    m_correctionPanel.show(m_wkView, type, boundingBoxOfReplacedString, replacedString, replacementString, alternativeReplacementStrings);
+#endif
+}
+
+void PageClientImpl::dismissCorrectionPanel(ReasonForDismissingCorrectionPanel reason)
+{
+#if !defined(BUILDING_ON_SNOW_LEOPARD)
+    m_correctionPanel.dismiss(reason);
+#endif
+}
+
+String PageClientImpl::dismissCorrectionPanelSoon(WebCore::ReasonForDismissingCorrectionPanel reason)
+{
+#if !defined(BUILDING_ON_SNOW_LEOPARD)
+    return m_correctionPanel.dismissSoon(reason);
+#else
+    return String();
+#endif
+}
+
+void PageClientImpl::recordAutocorrectionResponse(EditorClient::AutocorrectionResponseType responseType, const String& replacedString, const String& replacementString)
+{
+#if !defined(BUILDING_ON_SNOW_LEOPARD)
+    NSCorrectionResponse response = responseType == EditorClient::AutocorrectionReverted ? NSCorrectionResponseReverted : NSCorrectionResponseEdited;
+    CorrectionPanel::recordAutocorrectionResponse(m_wkView, response, replacedString, replacementString);
+#endif
+}
+
+float PageClientImpl::userSpaceScaleFactor() const
+{
+    NSWindow *window = [m_wkView window];
+#if !defined(BUILDING_ON_SNOW_LEOPARD)
+    if (window)
+        return [window backingScaleFactor];
+    return [[NSScreen mainScreen] backingScaleFactor];
+#else
+    if (window)
+        return [window userSpaceScaleFactor];
+    return [[NSScreen mainScreen] userSpaceScaleFactor];
+#endif
 }
 
 } // namespace WebKit
diff --git a/Source/WebKit2/UIProcess/API/mac/WKPrintingView.h b/Source/WebKit2/UIProcess/API/mac/WKPrintingView.h
index 3f7a692..87d81f4 100644
--- a/Source/WebKit2/UIProcess/API/mac/WKPrintingView.h
+++ b/Source/WebKit2/UIProcess/API/mac/WKPrintingView.h
@@ -35,6 +35,7 @@ namespace WebKit {
 @interface WKPrintingView : NSView {
 @public
     NSPrintOperation *_printOperation; // WKPrintingView is owned by the operation.
+    RetainPtr<NSView> _wkView;
 
     RefPtr<WebKit::WebFrameProxy> _webFrame;
     Vector<WebCore::IntRect> _printingPageRects;
@@ -56,6 +57,6 @@ namespace WebKit {
     NSTimer *_autodisplayResumeTimer;
 }
 
-- (id)initWithFrameProxy:(WebKit::WebFrameProxy*)frame;
+- (id)initWithFrameProxy:(WebKit::WebFrameProxy*)frame view:(NSView *)wkView;
 
 @end
diff --git a/Source/WebKit2/UIProcess/API/mac/WKPrintingView.mm b/Source/WebKit2/UIProcess/API/mac/WKPrintingView.mm
index 28ba153..d5d9de7 100644
--- a/Source/WebKit2/UIProcess/API/mac/WKPrintingView.mm
+++ b/Source/WebKit2/UIProcess/API/mac/WKPrintingView.mm
@@ -43,13 +43,14 @@ static BOOL isForcingPreviewUpdate;
 
 @implementation WKPrintingView
 
-- (id)initWithFrameProxy:(WebFrameProxy*)frame
+- (id)initWithFrameProxy:(WebKit::WebFrameProxy*)frame view:(NSView *)wkView
 {
     self = [super init]; // No frame rect to pass to NSView.
     if (!self)
         return nil;
 
     _webFrame = frame;
+    _wkView = wkView;
 
     return self;
 }
@@ -59,6 +60,19 @@ static BOOL isForcingPreviewUpdate;
     return YES;
 }
 
+- (void)_setAutodisplay:(BOOL)newState
+{
+    if (!newState && [[_wkView.get() window] isAutodisplay])
+        [_wkView.get() displayIfNeeded];
+    
+    [[_wkView.get() window] setAutodisplay:newState];
+
+    // For some reason, painting doesn't happen for a long time without this call, <rdar://problem/8975229>.
+    if (newState)
+        [_wkView.get() displayIfNeeded];
+}
+
+
 - (void)_suspendAutodisplay
 {
     // A drawRect: call on WKView causes a switch to screen mode, which is slow due to relayout, and we want to avoid that.
@@ -67,7 +81,7 @@ static BOOL isForcingPreviewUpdate;
         [_autodisplayResumeTimer invalidate];
         _autodisplayResumeTimer = nil;
     } else
-        _webFrame->page()->setAutodisplay(false);
+        [self _setAutodisplay:NO];
 }
 
 - (void)_delayedResumeAutodisplayTimerFired
@@ -75,7 +89,7 @@ static BOOL isForcingPreviewUpdate;
     ASSERT(isMainThread());
     
     _autodisplayResumeTimer = nil;
-    _webFrame->page()->setAutodisplay(true);
+    [self _setAutodisplay:YES];
 }
 
 - (void)_delayedResumeAutodisplay
@@ -200,11 +214,12 @@ static void pageDidDrawToPDF(WKDataRef dataRef, WKErrorRef, void* untypedContext
                 pair<HashMap<WebCore::IntRect, Vector<uint8_t> >::iterator, bool> entry = view->_pagePreviews.add(iter->second, Vector<uint8_t>());
                 entry.first->second.append(data->bytes(), data->size());
             }
-            bool receivedResponseToLatestRequest = view->_latestExpectedPreviewCallback == context->callbackID;
-            view->_latestExpectedPreviewCallback = 0;
             view->_expectedPreviewCallbacks.remove(context->callbackID);
-            if (receivedResponseToLatestRequest)
+            bool receivedResponseToLatestRequest = view->_latestExpectedPreviewCallback == context->callbackID;
+            if (receivedResponseToLatestRequest) {
+                view->_latestExpectedPreviewCallback = 0;
                 [view _updatePreview];
+            }
         }
     }
 }
@@ -264,6 +279,12 @@ static void pageDidComputePageRects(const Vector<WebCore::IntRect>& pageRects, d
         view->_printingPageRects = pageRects;
         view->_totalScaleFactorForPrinting = totalScaleFactorForPrinting;
 
+        // Sanitize a response coming from the Web process.
+        if (view->_printingPageRects.isEmpty())
+            view->_printingPageRects.append(IntRect(0, 0, 1, 1));
+        if (view->_totalScaleFactorForPrinting <= 0)
+            view->_totalScaleFactorForPrinting = 1;
+
         const IntRect& lastPrintingPageRect = view->_printingPageRects[view->_printingPageRects.size() - 1];
         NSRect newFrameSize = NSMakeRect(0, 0, 
             ceil(lastPrintingPageRect.maxX() * view->_totalScaleFactorForPrinting), 
@@ -330,6 +351,11 @@ static void prepareDataForPrintingOnSecondaryThread(void* untypedContext)
     if (!isMainThread())
         _isPrintingFromSecondaryThread = YES;
 
+    if (!_webFrame->page()) {
+        *range = NSMakeRange(1, NSIntegerMax);
+        return YES;
+    }
+
     [self _suspendAutodisplay];
     
     [self _adjustPrintingMarginsForHeaderAndFooter];
@@ -524,11 +550,22 @@ static void prepareDataForPrintingOnSecondaryThread(void* untypedContext)
     ASSERT(_printOperation == [NSPrintOperation currentOperation]);
     if (![self _hasPageRects]) {
         LOG(View, "-[WKPrintingView %p rectForPage:%d] - data is not yet available", self, (int)page);
+        if (!_webFrame->page()) {
+            // We may have not told AppKit how many pages there are, so it will try to print until a null rect is returned.
+            return NSMakeRect(0, 0, 0, 0);
+        }
         // We must be still calculating the page range.
         ASSERT(_expectedComputedPagesCallback);
         return NSMakeRect(0, 0, 1, 1);
     }
 
+    // If Web process crashes while computing page rects, we never tell AppKit how many pages there are.
+    // Returning a null rect prevents selecting non-existent pages in preview dialog.
+    if (static_cast<unsigned>(page) > _printingPageRects.size()) {
+        ASSERT(!_webFrame->page());
+        return NSMakeRect(0, 0, 0, 0);
+    }
+
     IntRect rect = _printingPageRects[page - 1];
     rect.scale(_totalScaleFactorForPrinting);
     LOG(View, "-[WKPrintingView %p rectForPage:%d] -> x %d, y %d, width %d, height %d", self, (int)page, rect.x(), rect.y(), rect.width(), rect.height());
diff --git a/Source/WebKit2/UIProcess/API/mac/WKView.mm b/Source/WebKit2/UIProcess/API/mac/WKView.mm
index e432549..05693ef 100644
--- a/Source/WebKit2/UIProcess/API/mac/WKView.mm
+++ b/Source/WebKit2/UIProcess/API/mac/WKView.mm
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2010 Apple Inc. All rights reserved.
+ * Copyright (C) 2010, 2011 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -42,6 +42,7 @@
 #import "TextChecker.h"
 #import "TextCheckerState.h"
 #import "WKAPICast.h"
+#import "WKFullScreenWindowController.h"
 #import "WKPrintingView.h"
 #import "WKStringCF.h"
 #import "WKTextInputWindowController.h"
@@ -49,6 +50,7 @@
 #import "WKViewPrivate.h"
 #import "WebContext.h"
 #import "WebEventFactory.h"
+#import "WebFullScreenManagerProxy.h"
 #import "WebPage.h"
 #import "WebPageProxy.h"
 #import "WebProcessProxy.h"
@@ -57,6 +59,7 @@
 #import <WebCore/ColorMac.h>
 #import <WebCore/DragController.h>
 #import <WebCore/DragData.h>
+#import <WebCore/LocalizedStrings.h>
 #import <WebCore/FloatRect.h>
 #import <WebCore/IntRect.h>
 #import <WebCore/KeyboardEvent.h>
@@ -66,15 +69,14 @@
 #import <wtf/RefPtr.h>
 #import <wtf/RetainPtr.h>
 
-// FIXME (WebKit2) <rdar://problem/8728860> WebKit2 needs to be localized
-#define UI_STRING(__str, __desc) [NSString stringWithUTF8String:__str]
-
-@interface NSApplication (Details)
+@interface NSApplication (WebNSApplicationDetails)
 - (void)speakString:(NSString *)string;
+- (void)_setCurrentEvent:(NSEvent *)event;
 @end
 
-@interface NSWindow (Details)
+@interface NSWindow (WebNSWindowDetails)
 - (NSRect)_growBoxRect;
+- (id)_growBoxOwner;
 - (void)_setShowOpaqueGrowBoxForOwner:(id)owner;
 - (BOOL)_updateGrowBoxForWindowFrameChange;
 @end
@@ -108,11 +110,6 @@ typedef HashMap<String, ValidationVector> ValidationMap;
 
     RetainPtr<NSView> _layerHostingView;
 
-    // FIXME: Remove _oldLayerHostingView.
-#if USE(ACCELERATED_COMPOSITING)
-    NSView *_oldLayerHostingView;
-#endif
-
     RetainPtr<id> _remoteAccessibilityChild;
     
     // For asynchronous validation.
@@ -124,7 +121,8 @@ typedef HashMap<String, ValidationVector> ValidationMap;
     // We keep here the event when resending it to
     // the application to distinguish the case of a new event from one 
     // that has been already sent to WebCore.
-    NSEvent *_keyDownEventBeingResent;
+    RetainPtr<NSEvent> _keyDownEventBeingResent;
+    bool _isInInterpretKeyEvents;
     Vector<KeypressCommand> _commandsList;
 
     NSSize _resizeScrollOffset;
@@ -145,6 +143,13 @@ typedef HashMap<String, ValidationVector> ValidationMap;
 #if ENABLE(GESTURE_EVENTS)
     id _endGestureMonitor;
 #endif
+    
+#if ENABLE(FULLSCREEN_API)
+    RetainPtr<WKFullScreenWindowController> _fullScreenWindowController;
+#endif
+
+    BOOL _hasSpellCheckerDocumentTag;
+    NSInteger _spellCheckerDocumentTag;
 }
 @end
 
@@ -158,12 +163,6 @@ typedef HashMap<String, ValidationVector> ValidationMap;
 
 @implementation WKView
 
-// FIXME: Remove this once we no longer want to be able to go back to the old drawing area.
-static bool useNewDrawingArea()
-{
-    return true;
-}
-
 - (id)initWithFrame:(NSRect)frame
 {
     return [self initWithFrame:frame contextRef:toAPI(WebContext::sharedProcessContext())];
@@ -223,6 +222,9 @@ static bool useNewDrawingArea()
     _data->_pageClient = PageClientImpl::create(self);
     _data->_page = toImpl(contextRef)->createWebPage(_data->_pageClient.get(), toImpl(pageGroupRef));
     _data->_page->initializeWebPage();
+#if ENABLE(FULLSCREEN_API)
+    _data->_page->fullScreenManager()->setWebView(self);
+#endif
     _data->_mouseDownEvent = nil;
     _data->_ignoringMouseDraggedEvents = NO;
 
@@ -238,6 +240,7 @@ static bool useNewDrawingArea()
     _data->_page->close();
 
     [_data release];
+    _data = nil;
 
     WebContext::statistics().wkViewCount--;
 
@@ -496,6 +499,8 @@ WEBCORE_COMMAND(yankAndSelect)
 
 #undef WEBCORE_COMMAND
 
+// This method is needed to support Mac OS X services.
+
 - (BOOL)writeSelectionToPasteboard:(NSPasteboard *)pasteboard types:(NSArray *)types
 {
     Vector<String> pasteboardTypes;
@@ -505,6 +510,8 @@ WEBCORE_COMMAND(yankAndSelect)
     return _data->_page->writeSelectionToPasteboard([pasteboard name], pasteboardTypes);
 }
 
+// This method is needed to support Mac OS X services.
+
 - (id)validRequestorForSendType:(NSString *)sendType returnType:(NSString *)returnType
 {
     BOOL isValidSendType = !sendType || ([PasteboardTypes::forSelection() containsObject:sendType] && !_data->_page->selectionState().isNone);
@@ -520,6 +527,13 @@ WEBCORE_COMMAND(yankAndSelect)
     return [[self nextResponder] validRequestorForSendType:sendType returnType:returnType];
 }
 
+// This method is needed to support Mac OS X services.
+
+- (BOOL)readSelectionFromPasteboard:(NSPasteboard *)pasteboard 
+{
+    return _data->_page->readSelectionFromPasteboard([pasteboard name]);
+}
+
 /*
 
 When possible, editing-related methods should be implemented in WebCore with the
@@ -589,12 +603,8 @@ static void validateCommandCallback(WKStringRef commandName, bool isEnabled, int
     SEL action = [item action];
 
     if (action == @selector(showGuessPanel:)) {
-        if (NSMenuItem *menuItem = ::menuItem(item)) {
-            BOOL panelShowing = [[[NSSpellChecker sharedSpellChecker] spellingPanel] isVisible];
-            [menuItem setTitle:panelShowing
-                ? UI_STRING("Hide Spelling and Grammar", "menu item title")
-                : UI_STRING("Show Spelling and Grammar", "menu item title")];
-        }
+        if (NSMenuItem *menuItem = ::menuItem(item))
+            [menuItem setTitle:contextMenuItemTagShowSpellingPanel([[[NSSpellChecker sharedSpellChecker] spellingPanel] isVisible])];
         return _data->_page->selectionState().isContentEditable;
     }
 
@@ -621,12 +631,8 @@ static void validateCommandCallback(WKStringRef commandName, bool isEnabled, int
     }
 
     if (action == @selector(orderFrontSubstitutionsPanel:)) {
-        if (NSMenuItem *menuItem = ::menuItem(item)) {
-            BOOL panelShowing = [[[NSSpellChecker sharedSpellChecker] substitutionsPanel] isVisible];
-            [menuItem setTitle:panelShowing
-                ? UI_STRING("Hide Substitutions", "menu item title")
-                : UI_STRING("Show Substitutions", "menu item title")];
-        }
+        if (NSMenuItem *menuItem = ::menuItem(item))
+            [menuItem setTitle:contextMenuItemTagShowSubstitutions([[[NSSpellChecker sharedSpellChecker] substitutionsPanel] isVisible])];
         return _data->_page->selectionState().isContentEditable;
     }
 
@@ -1010,6 +1016,12 @@ static const short kIOHIDEventTypeScroll = 6;
 
 - (void)doCommandBySelector:(SEL)selector
 {
+    LOG(TextInput, "doCommandBySelector:\"%s\"", sel_getName(selector));
+
+    if (!_data->_isInInterpretKeyEvents) {
+        [super doCommandBySelector:selector];
+        return;
+    }
     if (selector != @selector(noop:))
         _data->_commandsList.append(KeypressCommand(commandNameForSelector(selector)));
 }
@@ -1034,9 +1046,13 @@ static const short kIOHIDEventTypeScroll = 6;
             isFromInputMethod = YES;
     } else
         text = string;
-    
+
     String eventText = text;
     
+    // We'd need a different code path here if we wanted to be able to handle this
+    // outside of interpretKeyEvents.
+    ASSERT(_data->_isInInterpretKeyEvents);
+
     if (!isFromInputMethod)
         _data->_commandsList.append(KeypressCommand("insertText", text));
     else {
@@ -1085,9 +1101,6 @@ static const short kIOHIDEventTypeScroll = 6;
     // But don't do it if we have already handled the event.
     // Pressing Esc results in a fake event being sent - don't pass it to WebCore.
     if (!eventWasSentToWebCore && event == [NSApp currentEvent] && self == [[self window] firstResponder]) {
-        [_data->_keyDownEventBeingResent release];
-        _data->_keyDownEventBeingResent = nil;
-        
         _data->_page->handleKeyboardEvent(NativeWebKeyboardEvent(event, self));
         return YES;
     }
@@ -1102,6 +1115,11 @@ static const short kIOHIDEventTypeScroll = 6;
 
 - (void)keyDown:(NSEvent *)theEvent
 {
+    // There's a chance that responding to this event will run a nested event loop, and
+    // fetching a new event might release the old one. Retaining and then autoreleasing
+    // the current event prevents that from causing a problem inside WebKit or AppKit code.
+    [[theEvent retain] autorelease];
+
     if (_data->_pluginComplexTextInputIdentifier) {
         // Try feeding the keyboard event directly to the plug-in.
         NSString *string = nil;
@@ -1120,8 +1138,6 @@ static const short kIOHIDEventTypeScroll = 6;
     // there is no range selection).
     // If this is the case we should ignore the key down.
     if (_data->_keyDownEventBeingResent == theEvent) {
-        [_data->_keyDownEventBeingResent release];
-        _data->_keyDownEventBeingResent = nil;
         [super keyDown:theEvent];
         return;
     }
@@ -1129,7 +1145,7 @@ static const short kIOHIDEventTypeScroll = 6;
 }
 
 - (NSTextInputContext *)inputContext {
-    if (_data->_pluginComplexTextInputIdentifier)
+    if (_data->_pluginComplexTextInputIdentifier && !_data->_isInInterpretKeyEvents)
         return [[WKTextInputWindowController sharedTextInputWindowController] inputContext];
 
     return [super inputContext];
@@ -1153,7 +1169,11 @@ static const short kIOHIDEventTypeScroll = 6;
 - (void)unmarkText
 {
     LOG(TextInput, "unmarkText");
-    
+
+    // We'd need a different code path here if we wanted to be able to handle this
+    // outside of interpretKeyEvents.
+    ASSERT(_data->_isInInterpretKeyEvents);
+
     _data->_commandsList.append(KeypressCommand("unmarkText"));
 }
 
@@ -1208,6 +1228,10 @@ static void extractUnderlines(NSAttributedString *string, Vector<CompositionUnde
         extractUnderlines(string, _data->_underlines);
     }
     
+    // We'd need a different code path here if we wanted to be able to handle this
+    // outside of interpretKeyEvents.
+    ASSERT(_data->_isInInterpretKeyEvents);
+
     _data->_commandsList.append(KeypressCommand("setMarkedText", text));
     _data->_selectionStart = newSelRange.location;
     _data->_selectionEnd = NSMaxRange(newSelRange);
@@ -1418,10 +1442,15 @@ static void extractUnderlines(NSAttributedString *string, Vector<CompositionUnde
 
 - (void)viewWillMoveToWindow:(NSWindow *)window
 {
-    if (window != [self window]) {
-        [self removeWindowObservers];
-        [self addWindowObserversForWindow:window];
-    }
+    NSWindow *currentWindow = [self window];
+    if (window == currentWindow)
+        return;
+    
+    [self removeWindowObservers];
+    [self addWindowObserversForWindow:window];
+    
+    if ([currentWindow _growBoxOwner] == self)
+        [currentWindow _setShowOpaqueGrowBoxForOwner:nil];
 }
 
 - (void)viewDidMoveToWindow
@@ -1438,7 +1467,7 @@ static void extractUnderlines(NSAttributedString *string, Vector<CompositionUnde
         // Initialize remote accessibility when the window connection has been established.
 #if !defined(BUILDING_ON_SNOW_LEOPARD)
         NSData *remoteElementToken = WKAXRemoteTokenForElement(self);
-        NSData *remoteWindowToken = WKAXRemoteTokenForElement([self window]);
+        NSData *remoteWindowToken = WKAXRemoteTokenForElement([self accessibilityAttributeValue:NSAccessibilityWindowAttribute]);
         CoreIPC::DataReference elementToken = CoreIPC::DataReference(reinterpret_cast<const uint8_t*>([remoteElementToken bytes]), [remoteElementToken length]);
         CoreIPC::DataReference windowToken = CoreIPC::DataReference(reinterpret_cast<const uint8_t*>([remoteWindowToken bytes]), [remoteWindowToken length]);
         _data->_page->registerUIProcessAccessibilityTokens(elementToken, windowToken);
@@ -1454,6 +1483,9 @@ static void extractUnderlines(NSAttributedString *string, Vector<CompositionUnde
             _data->_endGestureMonitor = nil;
         }
 #endif
+#if !defined(BUILDING_ON_SNOW_LEOPARD)
+        WKHideWordDefinitionWindow();
+#endif
     }
 }
 
@@ -1510,37 +1542,25 @@ static void drawPageBackground(CGContextRef context, WebPageProxy* page, const I
 {
     LOG(View, "drawRect: x:%g, y:%g, width:%g, height:%g", rect.origin.x, rect.origin.y, rect.size.width, rect.size.height);
     _data->_page->endPrinting();
-    if (useNewDrawingArea()) {
-        CGContextRef context = static_cast<CGContextRef>([[NSGraphicsContext currentContext] graphicsPort]);
-
-        if (DrawingAreaProxyImpl* drawingArea = static_cast<DrawingAreaProxyImpl*>(_data->_page->drawingArea())) {
-            const NSRect *rectsBeingDrawn;
-            NSInteger numRectsBeingDrawn;
-            [self getRectsBeingDrawn:&rectsBeingDrawn count:&numRectsBeingDrawn];
-            for (NSInteger i = 0; i < numRectsBeingDrawn; ++i) {
-                Region unpaintedRegion;
-                IntRect rect = enclosingIntRect(rectsBeingDrawn[i]);
-                drawingArea->paint(context, rect, unpaintedRegion);
-
-                Vector<IntRect> unpaintedRects = unpaintedRegion.rects();
-                for (size_t i = 0; i < unpaintedRects.size(); ++i)
-                    drawPageBackground(context, _data->_page.get(), unpaintedRects[i]);
-            }
-        } else 
-            drawPageBackground(context, _data->_page.get(), enclosingIntRect(rect));
-
-        _data->_page->didDraw();
-        return;
-    }
+    CGContextRef context = static_cast<CGContextRef>([[NSGraphicsContext currentContext] graphicsPort]);
+
+    if (DrawingAreaProxyImpl* drawingArea = static_cast<DrawingAreaProxyImpl*>(_data->_page->drawingArea())) {
+        const NSRect *rectsBeingDrawn;
+        NSInteger numRectsBeingDrawn;
+        [self getRectsBeingDrawn:&rectsBeingDrawn count:&numRectsBeingDrawn];
+        for (NSInteger i = 0; i < numRectsBeingDrawn; ++i) {
+            Region unpaintedRegion;
+            IntRect rect = enclosingIntRect(rectsBeingDrawn[i]);
+            drawingArea->paint(context, rect, unpaintedRegion);
+
+            Vector<IntRect> unpaintedRects = unpaintedRegion.rects();
+            for (size_t i = 0; i < unpaintedRects.size(); ++i)
+                drawPageBackground(context, _data->_page.get(), unpaintedRects[i]);
+        }
+    } else 
+        drawPageBackground(context, _data->_page.get(), enclosingIntRect(rect));
 
-    if (_data->_page->isValid() && _data->_page->drawingArea()) {
-        CGContextRef context = static_cast<CGContextRef>([[NSGraphicsContext currentContext] graphicsPort]);
-        _data->_page->drawingArea()->paint(IntRect(rect), context);
-        _data->_page->didDraw();
-    } else if (_data->_page->drawsBackground()) {
-        [_data->_page->drawsTransparentBackground() ? [NSColor clearColor] : [NSColor whiteColor] set];
-        NSRectFill(rect);
-    }
+    _data->_page->didDraw();
 }
 
 - (BOOL)isOpaque
@@ -1567,6 +1587,9 @@ static void drawPageBackground(CGContextRef context, WebPageProxy* page, const I
 
 - (id)accessibilityFocusedUIElement
 {
+    if (_data->_pdfViewController)
+        return NSAccessibilityUnignoredDescendant(_data->_pdfViewController->pdfView());
+
     return _data->_remoteAccessibilityChild.get();
 }
 
@@ -1577,15 +1600,25 @@ static void drawPageBackground(CGContextRef context, WebPageProxy* page, const I
 
 - (id)accessibilityHitTest:(NSPoint)point
 {
+    if (_data->_pdfViewController)
+        return [_data->_pdfViewController->pdfView() accessibilityHitTest:point];
+    
     return _data->_remoteAccessibilityChild.get();
 }
 
 - (id)accessibilityAttributeValue:(NSString*)attribute
 {
     if ([attribute isEqualToString:NSAccessibilityChildrenAttribute]) {
-        if (!_data->_remoteAccessibilityChild)
+
+        id child = nil;
+        if (_data->_pdfViewController)
+            child = NSAccessibilityUnignoredDescendant(_data->_pdfViewController->pdfView());
+        else if (_data->_remoteAccessibilityChild)
+            child = _data->_remoteAccessibilityChild.get();
+        
+        if (!child)
             return nil;
-        return [NSArray arrayWithObject:_data->_remoteAccessibilityChild.get()];
+        return [NSArray arrayWithObject:child];
     }
     if ([attribute isEqualToString:NSAccessibilityRoleAttribute])
         return NSAccessibilityGroupRole;
@@ -1605,10 +1638,6 @@ static void drawPageBackground(CGContextRef context, WebPageProxy* page, const I
     if (hitView && _data && hitView == _data->_layerHostingView)
         hitView = self;
 
-#if USE(ACCELERATED_COMPOSITING)
-    if (hitView && _data && hitView == _data->_oldLayerHostingView)
-        hitView = self;
-#endif
     return hitView;
 }
 
@@ -1634,7 +1663,7 @@ static void drawPageBackground(CGContextRef context, WebPageProxy* page, const I
             return 0;
         return _data->_pdfViewController->makePrintOperation(printInfo);
     } else {
-        RetainPtr<WKPrintingView> printingView(AdoptNS, [[WKPrintingView alloc] initWithFrameProxy:toImpl(frameRef)]);
+        RetainPtr<WKPrintingView> printingView(AdoptNS, [[WKPrintingView alloc] initWithFrameProxy:toImpl(frameRef) view:self]);
         // NSPrintOperation takes ownership of the view.
         NSPrintOperation *printOperation = [NSPrintOperation printOperationWithView:printingView.get()];
         [printOperation setCanSpawnSeparateThread:YES];
@@ -1649,10 +1678,7 @@ static void drawPageBackground(CGContextRef context, WebPageProxy* page, const I
 
 - (PassOwnPtr<WebKit::DrawingAreaProxy>)_createDrawingAreaProxy
 {
-    if (useNewDrawingArea())
-        return DrawingAreaProxyImpl::create(_data->_page.get());
-
-    return ChunkedUpdateDrawingAreaProxy::create(self, _data->_page.get());
+    return DrawingAreaProxyImpl::create(_data->_page.get());
 }
 
 - (BOOL)_isFocused
@@ -1708,21 +1734,33 @@ static void drawPageBackground(CGContextRef context, WebPageProxy* page, const I
     }
 }
 
-- (void)_setEventBeingResent:(NSEvent *)event
+- (void)_resendKeyDownEvent:(NSEvent *)event
 {
-    _data->_keyDownEventBeingResent = [event retain];
+    ASSERT(!_data->_keyDownEventBeingResent);
+    _data->_keyDownEventBeingResent = event;
+    [NSApp _setCurrentEvent:event];
+    [NSApp sendEvent:event];
+
+    _data->_keyDownEventBeingResent = nullptr;
 }
 
 - (Vector<KeypressCommand>&)_interceptKeyEvent:(NSEvent *)theEvent 
 {
+    ASSERT(!_data->_isInInterpretKeyEvents);
+
+    _data->_isInInterpretKeyEvents = true;
     _data->_commandsList.clear();
-    // interpretKeyEvents will trigger one or more calls to doCommandBySelector or setText
+
+    // Calling interpretKeyEvents will trigger one or more calls to doCommandBySelector and insertText
     // that will populate the commandsList vector.
     [self interpretKeyEvents:[NSArray arrayWithObject:theEvent]];
+
+    _data->_isInInterpretKeyEvents = false;
+
     return _data->_commandsList;
 }
 
-- (void)_getTextInputState:(unsigned)start selectionEnd:(unsigned)end underlines:(Vector<WebCore::CompositionUnderline>&)lines
+- (void)_getTextInputState:(unsigned)start selectionEnd:(unsigned)end underlines:(Vector<CompositionUnderline>&)lines
 {
     start = _data->_selectionStart;
     end = _data->_selectionEnd;
@@ -1771,20 +1809,23 @@ static void drawPageBackground(CGContextRef context, WebPageProxy* page, const I
 
 - (void)removeTrackingRect:(NSTrackingRectTag)tag
 {
+    if (!_data)
+        return;
+
     if (tag == 0)
         return;
     
-    if (_data && (tag == TRACKING_RECT_TAG)) {
+    if (tag == TRACKING_RECT_TAG) {
         _data->_trackingRectOwner = nil;
         return;
     }
     
-    if (_data && (tag == _data->_lastToolTipTag)) {
+    if (tag == _data->_lastToolTipTag) {
         [super removeTrackingRect:tag];
         _data->_lastToolTipTag = 0;
         return;
     }
-    
+
     // If any other tracking rect is being removed, we don't know how it was created
     // and it's possible there's a leak involved (see 3500217)
     ASSERT_NOT_REACHED();
@@ -2001,6 +2042,17 @@ static void drawPageBackground(CGContextRef context, WebPageProxy* page, const I
     [self _updateGrowBoxForWindowFrameChange];
 }
 
+#if ENABLE(FULLSCREEN_API)
+- (WKFullScreenWindowController*)fullScreenWindowController
+{
+    if (!_data->_fullScreenWindowController) {
+        _data->_fullScreenWindowController.adoptNS([[WKFullScreenWindowController alloc] init]);
+        [_data->_fullScreenWindowController.get() setWebView:self];
+    }
+    return _data->_fullScreenWindowController.get();
+}
+#endif
+
 @end
 
 @implementation WKView (Private)
@@ -2033,5 +2085,19 @@ static void drawPageBackground(CGContextRef context, WebPageProxy* page, const I
     _data->_page->performDictionaryLookupAtLocation(FloatPoint(thePoint.x, thePoint.y));
 }
 
+- (NSInteger)spellCheckerDocumentTag
+{
+    if (!_data->_hasSpellCheckerDocumentTag) {
+        _data->_spellCheckerDocumentTag = [NSSpellChecker uniqueSpellDocumentTag];
+        _data->_hasSpellCheckerDocumentTag = YES;
+    }
+    return _data->_spellCheckerDocumentTag;
+}
+
+- (void)handleCorrectionPanelResult:(NSString*)result
+{
+    _data->_page->handleCorrectionPanelResult(result);
+}
+
 @end
 
diff --git a/Source/WebKit2/UIProcess/API/mac/WKViewInternal.h b/Source/WebKit2/UIProcess/API/mac/WKViewInternal.h
index 4147658..e4a40f7 100644
--- a/Source/WebKit2/UIProcess/API/mac/WKViewInternal.h
+++ b/Source/WebKit2/UIProcess/API/mac/WKViewInternal.h
@@ -27,11 +27,20 @@
 #import <WebCore/Editor.h>
 #import <WebCore/KeyboardEvent.h>
 
+namespace CoreIPC {
+    class DataReference;
+}
+
 namespace WebKit {
     class DrawingAreaProxy;
     class FindIndicator;
+    class LayerTreeContext;
 }
 
+#if ENABLE(FULLSCREEN_API)
+@class WKFullScreenWindowController;
+#endif
+
 @interface WKView (Internal)
 - (PassOwnPtr<WebKit::DrawingAreaProxy>)_createDrawingAreaProxy;
 - (BOOL)_isFocused;
@@ -44,7 +53,7 @@ namespace WebKit {
 - (void)_setUserInterfaceItemState:(NSString *)commandName enabled:(BOOL)isEnabled state:(int)newState;
 - (Vector<WebCore::KeypressCommand>&)_interceptKeyEvent:(NSEvent *)theEvent;
 - (void)_getTextInputState:(unsigned)start selectionEnd:(unsigned)end underlines:(Vector<WebCore::CompositionUnderline>&)lines;
-- (void)_setEventBeingResent:(NSEvent *)event;
+- (void)_resendKeyDownEvent:(NSEvent *)event;
 - (NSRect)_convertToDeviceSpace:(NSRect)rect;
 - (NSRect)_convertToUserSpace:(NSRect)rect;
 - (void)_setFindIndicator:(PassRefPtr<WebKit::FindIndicator>)findIndicator fadeOut:(BOOL)fadeOut;
@@ -64,4 +73,8 @@ namespace WebKit {
 - (void)_setDrawingAreaSize:(NSSize)size;
 
 - (void)_didChangeScrollbarsForMainFrame;
+
+#if ENABLE(FULLSCREEN_API)
+- (WKFullScreenWindowController*)fullScreenWindowController;
+#endif
 @end
diff --git a/Source/WebKit2/UIProcess/API/mac/WKViewPrivate.h b/Source/WebKit2/UIProcess/API/mac/WKViewPrivate.h
index cece1c7..37c2d8d 100644
--- a/Source/WebKit2/UIProcess/API/mac/WKViewPrivate.h
+++ b/Source/WebKit2/UIProcess/API/mac/WKViewPrivate.h
@@ -35,4 +35,6 @@
 
 - (void)performDictionaryLookupAtCurrentMouseLocation;
 
+- (NSInteger)spellCheckerDocumentTag;
+- (void)handleCorrectionPanelResult:(NSString*)result;
 @end
diff --git a/Source/WebKit2/UIProcess/API/qt/qwkpage.cpp b/Source/WebKit2/UIProcess/API/qt/qwkpage.cpp
index 05c7b8b..a162918 100644
--- a/Source/WebKit2/UIProcess/API/qt/qwkpage.cpp
+++ b/Source/WebKit2/UIProcess/API/qt/qwkpage.cpp
@@ -194,9 +194,9 @@ void QWKPagePrivate::exitAcceleratedCompositingMode()
     // FIXME: Implement.
 }
 
-void QWKPagePrivate::pageDidRequestScroll(const IntSize& delta)
+void QWKPagePrivate::pageDidRequestScroll(const IntPoint& point)
 {
-    emit q->scrollRequested(delta.width(), delta.height());
+    emit q->scrollRequested(point.x(), point.y());
 }
 
 void QWKPagePrivate::didChangeContentsSize(const IntSize& newSize)
@@ -222,6 +222,11 @@ FloatRect QWKPagePrivate::convertToDeviceSpace(const FloatRect& rect)
     return rect;
 }
 
+IntRect QWKPagePrivate::windowToScreen(const IntRect& rect)
+{
+    return rect;
+}
+
 FloatRect QWKPagePrivate::convertToUserSpace(const FloatRect& rect)
 {
     return rect;
@@ -482,7 +487,8 @@ QWKPage::QWKPage(QWKContext* context)
         0,  /* drawFooter */
         0,  /* printFrame */
         0,  /* runModal */
-        0   /* didCompleteRubberBandForMainFrame */
+        0,   /* didCompleteRubberBandForMainFrame */
+        0    /* saveDataToFileInDownloadsFolder */
     };
     WKPageSetPageUIClient(pageRef(), &uiClient);
 }
@@ -561,7 +567,7 @@ QWKPage::ViewportAttributes QWKPage::viewportAttributesForSize(const QSize& avai
     result.m_minimumScaleFactor = conf.minimumScale;
     result.m_maximumScaleFactor = conf.maximumScale;
     result.m_devicePixelRatio = conf.devicePixelRatio;
-    result.m_isUserScalable = conf.userScalable;
+    result.m_isUserScalable = static_cast<bool>(conf.userScalable);
 
     return result;
 }
diff --git a/Source/WebKit2/UIProcess/API/qt/qwkpage_p.h b/Source/WebKit2/UIProcess/API/qt/qwkpage_p.h
index 1a626a1..ee1fb0e 100644
--- a/Source/WebKit2/UIProcess/API/qt/qwkpage_p.h
+++ b/Source/WebKit2/UIProcess/API/qt/qwkpage_p.h
@@ -63,7 +63,7 @@ public:
     virtual void enterAcceleratedCompositingMode(const LayerTreeContext&);
     virtual void exitAcceleratedCompositingMode();
 #endif // USE(ACCELERATED_COMPOSITING)
-    virtual void pageDidRequestScroll(const WebCore::IntSize&);
+    virtual void pageDidRequestScroll(const WebCore::IntPoint&);
     virtual void processDidCrash();
     virtual void pageClosed() { }
     virtual void didRelaunchProcess();
@@ -72,11 +72,14 @@ public:
     virtual void setCursor(const WebCore::Cursor&);
     virtual void setViewportArguments(const WebCore::ViewportArguments&);
     virtual void takeFocus(bool direction);
+    virtual void setFocus(bool focused) { }
     virtual void toolTipChanged(const WTF::String&, const WTF::String&);
     virtual void registerEditCommand(PassRefPtr<WebKit::WebEditCommandProxy>, WebKit::WebPageProxy::UndoOrRedo);
     virtual void clearAllEditCommands();
     virtual WebCore::FloatRect convertToDeviceSpace(const WebCore::FloatRect&);
     virtual WebCore::FloatRect convertToUserSpace(const WebCore::FloatRect&);
+    virtual WebCore::IntRect windowToScreen(const WebCore::IntRect&);
+
     virtual void doneWithKeyEvent(const WebKit::NativeWebKeyboardEvent&, bool wasEventHandled);
     virtual void selectionChanged(bool, bool, bool, bool);
     virtual PassRefPtr<WebKit::WebPopupMenuProxy> createPopupMenuProxy(WebKit::WebPageProxy*);
@@ -92,6 +95,8 @@ public:
 
     virtual void flashBackingStoreUpdates(const Vector<WebCore::IntRect>& updateRects);
 
+    virtual float userSpaceScaleFactor() const { return 1; }
+
     void paint(QPainter* painter, QRect);
 
     void keyPressEvent(QKeyEvent*);
diff --git a/Source/WebKit2/UIProcess/API/qt/tests/qgraphicswkview/tst_qgraphicswkview.cpp b/Source/WebKit2/UIProcess/API/qt/tests/qgraphicswkview/tst_qgraphicswkview.cpp
index f26c69d..8cb7263 100644
--- a/Source/WebKit2/UIProcess/API/qt/tests/qgraphicswkview/tst_qgraphicswkview.cpp
+++ b/Source/WebKit2/UIProcess/API/qt/tests/qgraphicswkview/tst_qgraphicswkview.cpp
@@ -35,6 +35,7 @@ private slots:
     void init();
     void cleanup();
 
+    void loadEmptyUrl();
     void loadEmptyPage();
 
 private:
@@ -83,10 +84,21 @@ void tst_QGraphicsWKView::loadEmptyPage()
 {
     m_view->show();
 
-    m_view->m_webView-> load(QUrl::fromLocalFile(TESTDIR "/html/basic_page.html"));
+    m_view->m_webView-> load(QUrl::fromLocalFile(QLatin1String(TESTS_SOURCE_DIR "/html/basic_page.html")));
     QVERIFY(waitForSignal(m_view->m_webView, SIGNAL(loadFinished(bool))));
 }
 
+void tst_QGraphicsWKView::loadEmptyUrl()
+{
+    // That should not crash.
+    m_view->show();
+    m_view->m_webView->load(QUrl());
+    QVERIFY(!waitForSignal(m_view->m_webView->page(), SIGNAL(engineConnectionChanged(bool)), 50));
+
+    m_view->m_webView->load(QUrl(QLatin1String("")));
+    QVERIFY(!waitForSignal(m_view->m_webView->page(), SIGNAL(engineConnectionChanged(bool)), 50));
+}
+
 QTEST_MAIN(tst_QGraphicsWKView)
 
 #include "tst_qgraphicswkview.moc"
diff --git a/Source/WebKit2/UIProcess/API/qt/tests/qwkpage/qwkpage.pro b/Source/WebKit2/UIProcess/API/qt/tests/qwkpage/qwkpage.pro
new file mode 100644
index 0000000..e99c7f4
--- /dev/null
+++ b/Source/WebKit2/UIProcess/API/qt/tests/qwkpage/qwkpage.pro
@@ -0,0 +1 @@
+include(../tests.pri)
diff --git a/Source/WebKit2/UIProcess/API/qt/tests/qwkpage/tst_qwkpage.cpp b/Source/WebKit2/UIProcess/API/qt/tests/qwkpage/tst_qwkpage.cpp
new file mode 100644
index 0000000..39fcac2
--- /dev/null
+++ b/Source/WebKit2/UIProcess/API/qt/tests/qwkpage/tst_qwkpage.cpp
@@ -0,0 +1,59 @@
+/*
+    Copyright (C) 2011 Nokia Corporation and/or its subsidiary(-ies)
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include <QScopedPointer>
+#include <QtTest/QtTest>
+#include <qwkcontext.h>
+#include <qwkpage.h>
+
+class tst_QWKPage : public QObject {
+    Q_OBJECT
+
+private slots:
+    void init();
+    void cleanup();
+
+    void loadEmptyUrl();
+
+private:
+    QScopedPointer<QWKContext> m_context;
+    QScopedPointer<QWKPage> m_page;
+};
+
+void tst_QWKPage::init()
+{
+    m_context.reset(new QWKContext);
+    m_page.reset(new QWKPage(m_context.data()));
+}
+
+void tst_QWKPage::cleanup()
+{
+    m_page.reset();
+    m_context.reset();
+}
+
+void tst_QWKPage::loadEmptyUrl()
+{
+    m_page->load(QUrl());
+    m_page->load(QUrl(QLatin1String("")));
+}
+
+QTEST_MAIN(tst_QWKPage)
+
+#include "tst_qwkpage.moc"
diff --git a/Source/WebKit2/UIProcess/API/qt/tests/tests.pri b/Source/WebKit2/UIProcess/API/qt/tests/tests.pri
index 3a2aac1..032acc3 100644
--- a/Source/WebKit2/UIProcess/API/qt/tests/tests.pri
+++ b/Source/WebKit2/UIProcess/API/qt/tests/tests.pri
@@ -13,4 +13,4 @@ include(../../../../../WebKit.pri)
 QT += testlib
 
 QMAKE_RPATHDIR = $$OUTPUT_DIR/lib $$QMAKE_RPATHDIR
-DEFINES += TESTDIR=\\\"$$PWD\\\"
+!symbian: DEFINES += TESTS_SOURCE_DIR=\\\"$$PWD\\\"
diff --git a/Source/WebKit2/UIProcess/API/qt/tests/tests.pro b/Source/WebKit2/UIProcess/API/qt/tests/tests.pro
index eb85021..f8db5a4 100644
--- a/Source/WebKit2/UIProcess/API/qt/tests/tests.pro
+++ b/Source/WebKit2/UIProcess/API/qt/tests/tests.pro
@@ -1,2 +1,2 @@
 TEMPLATE = subdirs
-SUBDIRS = qgraphicswkview
+SUBDIRS = qgraphicswkview qwkpage
diff --git a/Source/WebKit2/UIProcess/Authentication/AuthenticationChallengeProxy.cpp b/Source/WebKit2/UIProcess/Authentication/AuthenticationChallengeProxy.cpp
index ffe8bac..ecff862 100644
--- a/Source/WebKit2/UIProcess/Authentication/AuthenticationChallengeProxy.cpp
+++ b/Source/WebKit2/UIProcess/Authentication/AuthenticationChallengeProxy.cpp
@@ -36,10 +36,10 @@
 
 namespace WebKit {
 
-AuthenticationChallengeProxy::AuthenticationChallengeProxy(const WebCore::AuthenticationChallenge& authenticationChallenge, uint64_t challengeID, WebPageProxy* page)
+AuthenticationChallengeProxy::AuthenticationChallengeProxy(const WebCore::AuthenticationChallenge& authenticationChallenge, uint64_t challengeID, WebProcessProxy* process)
     : m_coreAuthenticationChallenge(authenticationChallenge)
     , m_challengeID(challengeID)
-    , m_page(page)
+    , m_process(process)
 {
     ASSERT(m_challengeID);
     m_listener = AuthenticationDecisionListener::create(this);
@@ -49,8 +49,8 @@ AuthenticationChallengeProxy::~AuthenticationChallengeProxy()
 {
     // If an outstanding AuthenticationChallengeProxy is being destroyed even though it hasn't been responded to yet,
     // we cancel it here so the WebProcess isn't waiting for an answer forever.
-    if (m_challengeID && m_page->process())
-        m_page->process()->send(Messages::AuthenticationManager::CancelChallenge(m_challengeID), m_page->pageID());
+    if (m_challengeID)
+        m_process->send(Messages::AuthenticationManager::CancelChallenge(m_challengeID), 0);
 
     if (m_listener)
         m_listener->detachChallenge();
@@ -62,9 +62,9 @@ void AuthenticationChallengeProxy::useCredential(WebCredential* credential)
         return;
 
     if (!credential)
-        m_page->process()->send(Messages::AuthenticationManager::ContinueWithoutCredentialForChallenge(m_challengeID), m_page->pageID());
+        m_process->send(Messages::AuthenticationManager::ContinueWithoutCredentialForChallenge(m_challengeID), 0);
     else 
-        m_page->process()->send(Messages::AuthenticationManager::UseCredentialForChallenge(m_challengeID, credential->core()), m_page->pageID());
+        m_process->send(Messages::AuthenticationManager::UseCredentialForChallenge(m_challengeID, credential->core()), 0);
 
     m_challengeID = 0;
 }
@@ -74,7 +74,7 @@ void AuthenticationChallengeProxy::cancel()
     if (!m_challengeID)
         return;
 
-    m_page->process()->send(Messages::AuthenticationManager::CancelChallenge(m_challengeID), m_page->pageID());
+    m_process->send(Messages::AuthenticationManager::CancelChallenge(m_challengeID), 0);
 
     m_challengeID = 0;
 }
diff --git a/Source/WebKit2/UIProcess/Authentication/AuthenticationChallengeProxy.h b/Source/WebKit2/UIProcess/Authentication/AuthenticationChallengeProxy.h
index d4e76dd..a429ac5 100644
--- a/Source/WebKit2/UIProcess/Authentication/AuthenticationChallengeProxy.h
+++ b/Source/WebKit2/UIProcess/Authentication/AuthenticationChallengeProxy.h
@@ -40,16 +40,16 @@ namespace WebKit {
 
 class AuthenticationDecisionListener;
 class WebCredential;
-class WebPageProxy;
+class WebProcessProxy;
 class WebProtectionSpace;
 
 class AuthenticationChallengeProxy : public APIObject {
 public:
     static const Type APIType = TypeAuthenticationChallenge;
 
-    static PassRefPtr<AuthenticationChallengeProxy> create(const WebCore::AuthenticationChallenge& authenticationChallenge, uint64_t challengeID, WebPageProxy* page)
+    static PassRefPtr<AuthenticationChallengeProxy> create(const WebCore::AuthenticationChallenge& authenticationChallenge, uint64_t challengeID, WebProcessProxy* process)
     {
-        return adoptRef(new AuthenticationChallengeProxy(authenticationChallenge, challengeID, page));
+        return adoptRef(new AuthenticationChallengeProxy(authenticationChallenge, challengeID, process));
     }
     
     ~AuthenticationChallengeProxy();
@@ -63,13 +63,13 @@ public:
     int previousFailureCount() const { return m_coreAuthenticationChallenge.previousFailureCount(); }
 
 private:
-    AuthenticationChallengeProxy(const WebCore::AuthenticationChallenge&, uint64_t challengeID, WebPageProxy* page);
+    AuthenticationChallengeProxy(const WebCore::AuthenticationChallenge&, uint64_t challengeID, WebProcessProxy*);
 
     virtual Type type() const { return APIType; }
     
     WebCore::AuthenticationChallenge m_coreAuthenticationChallenge;
     uint64_t m_challengeID;
-    RefPtr<WebPageProxy> m_page;
+    RefPtr<WebProcessProxy> m_process;
     RefPtr<AuthenticationDecisionListener> m_listener;
     mutable RefPtr<WebCredential> m_webCredential;
     mutable RefPtr<WebProtectionSpace> m_webProtectionSpace;
diff --git a/Source/WebKit2/UIProcess/BackingStore.cpp b/Source/WebKit2/UIProcess/BackingStore.cpp
index f9a2672..5f024e6 100644
--- a/Source/WebKit2/UIProcess/BackingStore.cpp
+++ b/Source/WebKit2/UIProcess/BackingStore.cpp
@@ -57,9 +57,10 @@ void BackingStore::incorporateUpdate(const UpdateInfo& updateInfo)
 {
 //    ASSERT(m_size == updateInfo.viewSize);
     
-    RefPtr<ShareableBitmap> bitmap = ShareableBitmap::create(updateInfo.updateRectBounds.size(), updateInfo.bitmapHandle);
+    RefPtr<ShareableBitmap> bitmap = ShareableBitmap::create(updateInfo.bitmapHandle);
     if (!bitmap)
         return;
+    ASSERT(bitmap->size() == updateInfo.updateRectBounds.size());
     
     incorporateUpdate(bitmap.get(), updateInfo);
 }
diff --git a/Source/WebKit2/UIProcess/Downloads/DownloadProxy.cpp b/Source/WebKit2/UIProcess/Downloads/DownloadProxy.cpp
index 55168bc..ad61d33 100644
--- a/Source/WebKit2/UIProcess/Downloads/DownloadProxy.cpp
+++ b/Source/WebKit2/UIProcess/Downloads/DownloadProxy.cpp
@@ -26,6 +26,7 @@
 #include "config.h"
 #include "DownloadProxy.h"
 
+#include "AuthenticationChallengeProxy.h"
 #include "DataReference.h"
 #include "WebContext.h"
 #include "WebData.h"
@@ -91,6 +92,15 @@ void DownloadProxy::didStart(const ResourceRequest& request)
     m_webContext->downloadClient().didStart(m_webContext, this);
 }
 
+void DownloadProxy::didReceiveAuthenticationChallenge(const AuthenticationChallenge& authenticationChallenge, uint64_t challengeID)
+{
+    if (!m_webContext)
+        return;
+
+    RefPtr<AuthenticationChallengeProxy> authenticationChallengeProxy = AuthenticationChallengeProxy::create(authenticationChallenge, challengeID, m_webContext->process());
+    m_webContext->downloadClient().didReceiveAuthenticationChallenge(m_webContext, this, authenticationChallengeProxy.get());
+}
+
 void DownloadProxy::didReceiveResponse(const ResourceResponse& response)
 {
     if (!m_webContext)
diff --git a/Source/WebKit2/UIProcess/Downloads/DownloadProxy.h b/Source/WebKit2/UIProcess/Downloads/DownloadProxy.h
index a155d72..2643173 100644
--- a/Source/WebKit2/UIProcess/Downloads/DownloadProxy.h
+++ b/Source/WebKit2/UIProcess/Downloads/DownloadProxy.h
@@ -34,6 +34,7 @@
 #include <wtf/PassRefPtr.h>
 
 namespace WebCore {
+    class AuthenticationChallenge;
     class ResourceError;
     class ResourceResponse;
 }
@@ -69,6 +70,7 @@ private:
 
     // Message handlers.
     void didStart(const WebCore::ResourceRequest&);
+    void didReceiveAuthenticationChallenge(const WebCore::AuthenticationChallenge&, uint64_t challengeID);
     void didReceiveResponse(const WebCore::ResourceResponse&);
     void didReceiveData(uint64_t length);
     void shouldDecodeSourceDataOfMIMEType(const String& mimeType, bool& result);
diff --git a/Source/WebKit2/UIProcess/Downloads/DownloadProxy.messages.in b/Source/WebKit2/UIProcess/Downloads/DownloadProxy.messages.in
index 999080b..d725599 100644
--- a/Source/WebKit2/UIProcess/Downloads/DownloadProxy.messages.in
+++ b/Source/WebKit2/UIProcess/Downloads/DownloadProxy.messages.in
@@ -22,6 +22,8 @@
 
 messages -> DownloadProxy {
     DidStart(WebCore::ResourceRequest request)
+    DidReceiveAuthenticationChallenge(WebCore::AuthenticationChallenge challenge, uint64_t challengeID)
+
     DidReceiveResponse(WebCore::ResourceResponse response)
     DidReceiveData(uint64_t length)
     ShouldDecodeSourceDataOfMIMEType(String mimeType) -> (bool result)
diff --git a/Source/WebKit2/UIProcess/DrawingAreaProxy.h b/Source/WebKit2/UIProcess/DrawingAreaProxy.h
index 4222c3b..c72cf03 100644
--- a/Source/WebKit2/UIProcess/DrawingAreaProxy.h
+++ b/Source/WebKit2/UIProcess/DrawingAreaProxy.h
@@ -28,6 +28,7 @@
 #define DrawingAreaProxy_h
 
 #include "DrawingAreaInfo.h"
+#include <stdint.h>
 #include <WebCore/IntSize.h>
 #include <wtf/Noncopyable.h>
 
diff --git a/Source/WebKit2/UIProcess/DrawingAreaProxy.messages.in b/Source/WebKit2/UIProcess/DrawingAreaProxy.messages.in
index 217feaf..78d5724 100644
--- a/Source/WebKit2/UIProcess/DrawingAreaProxy.messages.in
+++ b/Source/WebKit2/UIProcess/DrawingAreaProxy.messages.in
@@ -22,9 +22,8 @@
 
 messages -> DrawingAreaProxy {
     Update(uint64_t stateID, WebKit::UpdateInfo updateInfo)
-    DidUpdateBackingStoreState(uint64_t backingStoreStateID, WebKit::UpdateInfo updateInfo, WebKit::LayerTreeContext context)
-
 #if USE(ACCELERATED_COMPOSITING)
+    DidUpdateBackingStoreState(uint64_t backingStoreStateID, WebKit::UpdateInfo updateInfo, WebKit::LayerTreeContext context)
     EnterAcceleratedCompositingMode(uint64_t backingStoreStateID, WebKit::LayerTreeContext context)
     ExitAcceleratedCompositingMode(uint64_t backingStoreStateID, WebKit::UpdateInfo updateInfo)
 #endif
diff --git a/Source/WebKit2/UIProcess/DrawingAreaProxyImpl.cpp b/Source/WebKit2/UIProcess/DrawingAreaProxyImpl.cpp
index 4cf4d2e..0ee42f4 100644
--- a/Source/WebKit2/UIProcess/DrawingAreaProxyImpl.cpp
+++ b/Source/WebKit2/UIProcess/DrawingAreaProxyImpl.cpp
@@ -58,9 +58,11 @@ DrawingAreaProxyImpl::DrawingAreaProxyImpl(WebPageProxy* webPageProxy)
 
 DrawingAreaProxyImpl::~DrawingAreaProxyImpl()
 {
+#if USE(ACCELERATED_COMPOSITING)
     // Make sure to exit accelerated compositing mode.
     if (isInAcceleratedCompositingMode())
         exitAcceleratedCompositingMode();
+#endif
 }
 
 void DrawingAreaProxyImpl::paint(BackingStore::PlatformGraphicsContext context, const IntRect& rect, Region& unpaintedRegion)
@@ -162,6 +164,7 @@ void DrawingAreaProxyImpl::didUpdateBackingStoreState(uint64_t backingStoreState
     if (m_nextBackingStoreStateID != m_currentBackingStoreStateID)
         sendUpdateBackingStoreState(RespondImmediately);
 
+#if USE(ACCELERATED_COMPOSITING)
     if (layerTreeContext != m_layerTreeContext) {
         if (!m_layerTreeContext.isEmpty()) {
             exitAcceleratedCompositingMode();
@@ -178,6 +181,7 @@ void DrawingAreaProxyImpl::didUpdateBackingStoreState(uint64_t backingStoreState
         ASSERT(!m_backingStore);
         return;
     }
+#endif
 
     // FIXME: We could just reuse our existing backing store if it's the same size as
     // updateInfo.viewSize.
@@ -191,7 +195,9 @@ void DrawingAreaProxyImpl::enterAcceleratedCompositingMode(uint64_t backingStore
     if (backingStoreStateID < m_currentBackingStoreStateID)
         return;
 
+#if USE(ACCELERATED_COMPOSITING)
     enterAcceleratedCompositingMode(layerTreeContext);
+#endif
 }
 
 void DrawingAreaProxyImpl::exitAcceleratedCompositingMode(uint64_t backingStoreStateID, const UpdateInfo& updateInfo)
@@ -200,7 +206,9 @@ void DrawingAreaProxyImpl::exitAcceleratedCompositingMode(uint64_t backingStoreS
     if (backingStoreStateID < m_currentBackingStoreStateID)
         return;
 
+#if USE(ACCELERATED_COMPOSITING)
     exitAcceleratedCompositingMode();
+#endif
 
     incorporateUpdate(updateInfo);
 }
@@ -252,11 +260,13 @@ void DrawingAreaProxyImpl::sendUpdateBackingStoreState(RespondImmediatelyOrNot r
     m_webPageProxy->process()->send(Messages::DrawingArea::UpdateBackingStoreState(m_nextBackingStoreStateID, respondImmediatelyOrNot == RespondImmediately, m_size, m_scrollOffset), m_webPageProxy->pageID());
     m_scrollOffset = IntSize();
 
+#if USE(ACCELERATED_COMPOSITING)
     if (m_isWaitingForDidUpdateBackingStoreState && !m_layerTreeContext.isEmpty()) {
         // Wait for the DidUpdateBackingStoreState message. Normally we don this in DrawingAreaProxyImpl::paint, but that
         // function is never called when in accelerated compositing mode.
         waitForAndDispatchDidUpdateBackingStoreState();
     }
+#endif
 }
 
 void DrawingAreaProxyImpl::waitForAndDispatchDidUpdateBackingStoreState()
@@ -268,6 +278,7 @@ void DrawingAreaProxyImpl::waitForAndDispatchDidUpdateBackingStoreState()
     if (m_webPageProxy->process()->isLaunching())
         return;
     
+#if USE(ACCELERATED_COMPOSITING)
     // FIXME: waitForAndDispatchImmediately will always return the oldest DidUpdateBackingStoreState message that
     // hasn't yet been processed. But it might be better to skip ahead to some other DidUpdateBackingStoreState
     // message, if multiple DidUpdateBackingStoreState messages are waiting to be processed. For instance, we could
@@ -276,8 +287,10 @@ void DrawingAreaProxyImpl::waitForAndDispatchDidUpdateBackingStoreState()
     // The timeout, in seconds, we use when waiting for a DidUpdateBackingStoreState message when we're asked to paint.
     static const double didUpdateBackingStoreStateTimeout = 0.5;
     m_webPageProxy->process()->connection()->waitForAndDispatchImmediately<Messages::DrawingAreaProxy::DidUpdateBackingStoreState>(m_webPageProxy->pageID(), didUpdateBackingStoreStateTimeout);
+#endif
 }
 
+#if USE(ACCELERATED_COMPOSITING)
 void DrawingAreaProxyImpl::enterAcceleratedCompositingMode(const LayerTreeContext& layerTreeContext)
 {
     ASSERT(!isInAcceleratedCompositingMode());
@@ -294,6 +307,7 @@ void DrawingAreaProxyImpl::exitAcceleratedCompositingMode()
     m_layerTreeContext = LayerTreeContext();    
     m_webPageProxy->exitAcceleratedCompositingMode();
 }
+#endif
 
 void DrawingAreaProxyImpl::discardBackingStoreSoon()
 {
diff --git a/Source/WebKit2/UIProcess/DrawingAreaProxyImpl.h b/Source/WebKit2/UIProcess/DrawingAreaProxyImpl.h
index 17c7512..11e430c 100644
--- a/Source/WebKit2/UIProcess/DrawingAreaProxyImpl.h
+++ b/Source/WebKit2/UIProcess/DrawingAreaProxyImpl.h
@@ -68,10 +68,14 @@ private:
     void sendUpdateBackingStoreState(RespondImmediatelyOrNot);
     void waitForAndDispatchDidUpdateBackingStoreState();
 
+#if USE(ACCELERATED_COMPOSITING)
     void enterAcceleratedCompositingMode(const LayerTreeContext&);
     void exitAcceleratedCompositingMode();
 
     bool isInAcceleratedCompositingMode() const { return !m_layerTreeContext.isEmpty(); }
+#else
+    bool isInAcceleratedCompositingMode() const { return false; }
+#endif
 
     void discardBackingStoreSoon();
     void discardBackingStore();
@@ -85,9 +89,11 @@ private:
     // whenever our state changes in a way that will require a new backing store to be allocated.
     uint64_t m_nextBackingStoreStateID;
 
+#if USE(ACCELERATED_COMPOSITING)
     // The current layer tree context.
     LayerTreeContext m_layerTreeContext;
-    
+#endif
+
     // Whether we've sent a UpdateBackingStoreState message and are now waiting for a DidUpdateBackingStoreState message.
     // Used to throttle UpdateBackingStoreState messages so we don't send them faster than the Web process can handle.
     bool m_isWaitingForDidUpdateBackingStoreState;
diff --git a/Source/WebKit2/UIProcess/FindIndicator.cpp b/Source/WebKit2/UIProcess/FindIndicator.cpp
index d6ac461..d30fb8d 100644
--- a/Source/WebKit2/UIProcess/FindIndicator.cpp
+++ b/Source/WebKit2/UIProcess/FindIndicator.cpp
@@ -77,11 +77,12 @@ static const int gradientLightAlpha = 255;
 
 namespace WebKit {
 
-PassRefPtr<FindIndicator> FindIndicator::create(const FloatRect& selectionRectInWindowCoordinates, const Vector<FloatRect>& textRectsInSelectionRectCoordinates, const SharedMemory::Handle& contentImageHandle)
+PassRefPtr<FindIndicator> FindIndicator::create(const FloatRect& selectionRectInWindowCoordinates, const Vector<FloatRect>& textRectsInSelectionRectCoordinates, const ShareableBitmap::Handle& contentImageHandle)
 {
-    RefPtr<ShareableBitmap> contentImage = ShareableBitmap::create(enclosingIntRect(selectionRectInWindowCoordinates).size(), contentImageHandle);
+    RefPtr<ShareableBitmap> contentImage = ShareableBitmap::create(contentImageHandle);
     if (!contentImage)
         return 0;
+    ASSERT(contentImage->size() == enclosingIntRect(selectionRectInWindowCoordinates).size());
 
     return adoptRef(new FindIndicator(selectionRectInWindowCoordinates, textRectsInSelectionRectCoordinates, contentImage.release()));
 }
diff --git a/Source/WebKit2/UIProcess/FindIndicator.h b/Source/WebKit2/UIProcess/FindIndicator.h
index 69088ce..49d07da 100644
--- a/Source/WebKit2/UIProcess/FindIndicator.h
+++ b/Source/WebKit2/UIProcess/FindIndicator.h
@@ -26,7 +26,7 @@
 #ifndef FindIndicator_h
 #define FindIndicator_h
 
-#include "SharedMemory.h"
+#include "ShareableBitmap.h"
 #include <WebCore/FloatRect.h>
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefCounted.h>
@@ -38,11 +38,9 @@ namespace WebCore {
 
 namespace WebKit {
 
-class ShareableBitmap;
-
 class FindIndicator : public RefCounted<FindIndicator> {
 public:
-    static PassRefPtr<FindIndicator> create(const WebCore::FloatRect& selectionRectInWindowCoordinates, const Vector<WebCore::FloatRect>& textRectsInSelectionRectCoordinates, const SharedMemory::Handle& contentImageHandle);
+    static PassRefPtr<FindIndicator> create(const WebCore::FloatRect& selectionRectInWindowCoordinates, const Vector<WebCore::FloatRect>& textRectsInSelectionRectCoordinates, const ShareableBitmap::Handle& contentImageHandle);
     ~FindIndicator();
 
     WebCore::FloatRect selectionRectInWindowCoordinates() const { return m_selectionRectInWindowCoordinates; }
diff --git a/Source/WebKit2/UIProcess/Launcher/ProcessLauncher.h b/Source/WebKit2/UIProcess/Launcher/ProcessLauncher.h
index 8a1cd01..8dbfb11 100644
--- a/Source/WebKit2/UIProcess/Launcher/ProcessLauncher.h
+++ b/Source/WebKit2/UIProcess/Launcher/ProcessLauncher.h
@@ -37,7 +37,7 @@ class QLocalSocket;
 
 namespace WebKit {
 
-class ProcessLauncher : public ThreadSafeShared<ProcessLauncher> {
+class ProcessLauncher : public ThreadSafeRefCounted<ProcessLauncher> {
 public:
     class Client {
     public:
diff --git a/Source/WebKit2/UIProcess/Launcher/ThreadLauncher.h b/Source/WebKit2/UIProcess/Launcher/ThreadLauncher.h
index 9c90fbd..f3a5312 100644
--- a/Source/WebKit2/UIProcess/Launcher/ThreadLauncher.h
+++ b/Source/WebKit2/UIProcess/Launcher/ThreadLauncher.h
@@ -37,7 +37,7 @@ class QLocalSocket;
 
 namespace WebKit {
 
-class ThreadLauncher : public ThreadSafeShared<ThreadLauncher> {
+class ThreadLauncher : public ThreadSafeRefCounted<ThreadLauncher> {
 public:
     class Client {
     public:
diff --git a/Source/WebKit2/UIProcess/Launcher/mac/ProcessLauncherMac.mm b/Source/WebKit2/UIProcess/Launcher/mac/ProcessLauncherMac.mm
index af758d9..a1e8f5c 100644
--- a/Source/WebKit2/UIProcess/Launcher/mac/ProcessLauncherMac.mm
+++ b/Source/WebKit2/UIProcess/Launcher/mac/ProcessLauncherMac.mm
@@ -200,8 +200,13 @@ void ProcessLauncher::launchProcess()
     NSString *frameworksPath = [[webKit2Bundle bundlePath] stringByDeletingLastPathComponent];
     const char* frameworkExecutablePath = [[webKit2Bundle executablePath] fileSystemRepresentation];
 
-    NSString *webProcessAppPath = [webKit2Bundle pathForAuxiliaryExecutable:@"WebProcess.app"];
-    NSString *webProcessAppExecutablePath = [[NSBundle bundleWithPath:webProcessAppPath] executablePath];
+    NSString *processPath;
+    if (m_launchOptions.processType == ProcessLauncher::PluginProcess)
+        processPath = [webKit2Bundle pathForAuxiliaryExecutable:@"PluginProcess.app"];
+    else
+        processPath = [webKit2Bundle pathForAuxiliaryExecutable:@"WebProcess.app"];
+
+    NSString *processAppExecutablePath = [[NSBundle bundleWithPath:processPath] executablePath];
 
     RetainPtr<CFStringRef> cfLocalization(AdoptCF, WKCopyCFLocalizationPreferredName(NULL));
     CString localization = String(cfLocalization.get()).utf8();
@@ -209,7 +214,7 @@ void ProcessLauncher::launchProcess()
     // Make a unique, per pid, per process launcher web process service name.
     CString serviceName = String::format("com.apple.WebKit.WebProcess-%d-%p", getpid(), this).utf8();
 
-    const char* args[] = { [webProcessAppExecutablePath fileSystemRepresentation], frameworkExecutablePath, "-type", processTypeAsString(m_launchOptions.processType), "-servicename", serviceName.data(), "-localization", localization.data(), 0 };
+    const char* args[] = { [processAppExecutablePath fileSystemRepresentation], frameworkExecutablePath, "-type", processTypeAsString(m_launchOptions.processType), "-servicename", serviceName.data(), "-localization", localization.data(), 0 };
 
     // Register ourselves.
     kern_return_t kr = bootstrap_register2(bootstrap_port, const_cast<char*>(serviceName.data()), listeningPort, 0);
@@ -259,7 +264,7 @@ void ProcessLauncher::launchProcess()
 
     if (m_launchOptions.processType == ProcessLauncher::PluginProcess) {
         // We need to insert the plug-in process shim.
-        NSString *pluginProcessShimPathNSString = [[webProcessAppExecutablePath stringByDeletingLastPathComponent] stringByAppendingPathComponent:@"PluginProcessShim.dylib"];
+        NSString *pluginProcessShimPathNSString = [[processAppExecutablePath stringByDeletingLastPathComponent] stringByAppendingPathComponent:@"PluginProcessShim.dylib"];
         const char* pluginProcessShimPath = [pluginProcessShimPathNSString fileSystemRepresentation];
 
         // Make sure that the file exists.
diff --git a/Source/WebKit2/UIProcess/Launcher/qt/ProcessLauncherQt.cpp b/Source/WebKit2/UIProcess/Launcher/qt/ProcessLauncherQt.cpp
index 1e7e14a..cae5bdf 100644
--- a/Source/WebKit2/UIProcess/Launcher/qt/ProcessLauncherQt.cpp
+++ b/Source/WebKit2/UIProcess/Launcher/qt/ProcessLauncherQt.cpp
@@ -75,18 +75,22 @@ protected:
 void QtWebProcess::setupChildProcess()
 {
 #if defined Q_OS_LINUX
+#ifndef NDEBUG
+    if (getenv("QT_WEBKIT_KEEP_ALIVE_WEB_PROCESS"))
+        return;
+#endif
     prctl(PR_SET_PDEATHSIG, SIGKILL);
 #endif
 }
 
 void ProcessLauncher::launchProcess()
 {
-    QString applicationPath = "%1 %2";
+    QString applicationPath = QLatin1String("%1 %2");
 
-    if (QFile::exists(QCoreApplication::applicationDirPath() + "/QtWebProcess")) {
-        applicationPath = applicationPath.arg(QCoreApplication::applicationDirPath() + "/QtWebProcess");
+    if (QFile::exists(QCoreApplication::applicationDirPath() + QLatin1String("/QtWebProcess"))) {
+        applicationPath = applicationPath.arg(QCoreApplication::applicationDirPath() + QLatin1String("/QtWebProcess"));
     } else {
-        applicationPath = applicationPath.arg("QtWebProcess");
+        applicationPath = applicationPath.arg(QLatin1String("QtWebProcess"));
     }
 
     int sockets[2];
diff --git a/Source/WebKit2/UIProcess/PageClient.h b/Source/WebKit2/UIProcess/PageClient.h
index 59e02ca..83ce502 100644
--- a/Source/WebKit2/UIProcess/PageClient.h
+++ b/Source/WebKit2/UIProcess/PageClient.h
@@ -81,11 +81,12 @@ public:
     virtual void didRelaunchProcess() = 0;
     virtual void pageClosed() = 0;
 
+    virtual void setFocus(bool focused) = 0;
     virtual void takeFocus(bool direction) = 0;
     virtual void toolTipChanged(const String&, const String&) = 0;
 
 #if ENABLE(TILED_BACKING_STORE)
-    virtual void pageDidRequestScroll(const WebCore::IntSize&) = 0;
+    virtual void pageDidRequestScroll(const WebCore::IntPoint&) = 0;
 #endif
 #if PLATFORM(QT)
     virtual void didChangeContentsSize(const WebCore::IntSize&) = 0;
@@ -100,14 +101,15 @@ public:
 #if PLATFORM(MAC)
     virtual void accessibilityWebProcessTokenReceived(const CoreIPC::DataReference&) = 0;
     virtual void interceptKeyEvent(const NativeWebKeyboardEvent&, Vector<WebCore::KeypressCommand>& commandName, uint32_t selectionStart, uint32_t selectionEnd, Vector<WebCore::CompositionUnderline>& underlines) = 0;
-    virtual void setDragImage(const WebCore::IntPoint& clientPosition, const WebCore::IntSize& imageSize, PassRefPtr<ShareableBitmap> dragImage, bool isLinkDrag) = 0;
+    virtual void setDragImage(const WebCore::IntPoint& clientPosition, PassRefPtr<ShareableBitmap> dragImage, bool isLinkDrag) = 0;
 #endif
 #if PLATFORM(WIN)
     virtual void compositionSelectionChanged(bool) = 0;
 #endif
     virtual WebCore::FloatRect convertToDeviceSpace(const WebCore::FloatRect&) = 0;
     virtual WebCore::FloatRect convertToUserSpace(const WebCore::FloatRect&) = 0;
-
+    virtual WebCore::IntRect windowToScreen(const WebCore::IntRect&) = 0;
+    
     virtual void doneWithKeyEvent(const NativeWebKeyboardEvent&, bool wasEventHandled) = 0;
 
     virtual PassRefPtr<WebPopupMenuProxy> createPopupMenuProxy(WebPageProxy*) = 0;
@@ -126,9 +128,12 @@ public:
 
 #if PLATFORM(MAC)
     virtual void setComplexTextInputEnabled(uint64_t pluginComplexTextInputIdentifier, bool complexTextInputEnabled) = 0;
-    virtual void setAutodisplay(bool) = 0;
     virtual CGContextRef containingWindowGraphicsContext() = 0;
     virtual void didPerformDictionaryLookup(const String&, double scaleFactor, const DictionaryPopupInfo&) = 0;
+    virtual void showCorrectionPanel(WebCore::CorrectionPanelInfo::PanelType, const WebCore::FloatRect& boundingBoxOfReplacedString, const String& replacedString, const String& replacementString, const Vector<String>& alternativeReplacementStrings) = 0;
+    virtual void dismissCorrectionPanel(WebCore::ReasonForDismissingCorrectionPanel) = 0;
+    virtual String dismissCorrectionPanelSoon(WebCore::ReasonForDismissingCorrectionPanel) = 0;
+    virtual void recordAutocorrectionResponse(WebCore::EditorClient::AutocorrectionResponseType, const String& replacedString, const String& replacementString) = 0;
 #endif
 
     virtual void didChangeScrollbarsForMainFrame() const = 0;
@@ -140,6 +145,8 @@ public:
     virtual void setCustomRepresentationZoomFactor(double) = 0;
 
     virtual void flashBackingStoreUpdates(const Vector<WebCore::IntRect>& updateRects) = 0;
+
+    virtual float userSpaceScaleFactor() const = 0;
 };
 
 } // namespace WebKit
diff --git a/Source/WebKit2/UIProcess/Plugins/PluginProcessProxy.cpp b/Source/WebKit2/UIProcess/Plugins/PluginProcessProxy.cpp
index c63d500..f167747 100644
--- a/Source/WebKit2/UIProcess/Plugins/PluginProcessProxy.cpp
+++ b/Source/WebKit2/UIProcess/Plugins/PluginProcessProxy.cpp
@@ -38,16 +38,6 @@
 #include "WebProcessProxy.h"
 
 namespace WebKit {
-    
-#if PLATFORM(MAC)
-static bool pluginNeedsExecutableHeap(const PluginInfoStore::Plugin& pluginInfo)
-{
-    if (pluginInfo.bundleIdentifier == "com.apple.QuickTime Plugin.plugin")
-        return false;
-    
-    return true;
-}
-#endif
 
 PassOwnPtr<PluginProcessProxy> PluginProcessProxy::create(PluginProcessManager* PluginProcessManager, const PluginInfoStore::Plugin& pluginInfo)
 {
@@ -58,12 +48,16 @@ PluginProcessProxy::PluginProcessProxy(PluginProcessManager* PluginProcessManage
     : m_pluginProcessManager(PluginProcessManager)
     , m_pluginInfo(pluginInfo)
     , m_numPendingConnectionRequests(0)
+#if PLATFORM(MAC)
+    , m_modalWindowIsShowing(false)
+    , m_fullscreenWindowIsShowing(false)
+#endif
 {
     ProcessLauncher::LaunchOptions launchOptions;
     launchOptions.processType = ProcessLauncher::PluginProcess;
 #if PLATFORM(MAC)
     launchOptions.architecture = pluginInfo.pluginArchitecture;
-    launchOptions.executableHeap = pluginNeedsExecutableHeap(pluginInfo);
+    launchOptions.executableHeap = PluginProcessProxy::pluginNeedsExecutableHeap(pluginInfo);
 #endif
 
     m_processLauncher = ProcessLauncher::create(this, launchOptions);
@@ -153,6 +147,14 @@ void PluginProcessProxy::didReceiveMessage(CoreIPC::Connection* connection, Core
 
 void PluginProcessProxy::didClose(CoreIPC::Connection*)
 {
+#if PLATFORM(MAC)
+    if (m_modalWindowIsShowing)
+        endModal();
+
+    if (m_fullscreenWindowIsShowing)
+        exitFullscreen();
+#endif
+
     pluginProcessCrashedOrFailedToLaunch();
 }
 
diff --git a/Source/WebKit2/UIProcess/Plugins/PluginProcessProxy.h b/Source/WebKit2/UIProcess/Plugins/PluginProcessProxy.h
index 2ea2573..e285d64 100644
--- a/Source/WebKit2/UIProcess/Plugins/PluginProcessProxy.h
+++ b/Source/WebKit2/UIProcess/Plugins/PluginProcessProxy.h
@@ -33,6 +33,12 @@
 #include "ProcessLauncher.h"
 #include <wtf/Deque.h>
 
+#if PLATFORM(MAC)
+#include <wtf/RetainPtr.h>
+OBJC_CLASS NSObject;
+OBJC_CLASS WKPlaceholderModalWindow;
+#endif
+
 // FIXME: This is platform specific.
 namespace CoreIPC {
     class MachPort;
@@ -47,6 +53,9 @@ struct PluginProcessCreationParameters;
 
 class PluginProcessProxy : CoreIPC::Connection::Client, ProcessLauncher::Client {
 public:
+#if PLATFORM(MAC)
+    static bool pluginNeedsExecutableHeap(const PluginInfoStore::Plugin&);
+#endif
     static PassOwnPtr<PluginProcessProxy> create(PluginProcessManager*, const PluginInfoStore::Plugin&);
     ~PluginProcessProxy();
 
@@ -81,6 +90,22 @@ private:
     void didGetSitesWithData(const Vector<String>& sites, uint64_t callbackID);
     void didClearSiteData(uint64_t callbackID);
 
+#if PLATFORM(MAC)
+    bool getPluginProcessSerialNumber(ProcessSerialNumber&);
+    void makePluginProcessTheFrontProcess();
+    void makeUIProcessTheFrontProcess();
+
+    void setFullscreenWindowIsShowing(bool);
+    void enterFullscreen();
+    void exitFullscreen();
+
+    void setModalWindowIsShowing(bool);
+    void beginModal();
+    void endModal();
+
+    void applicationDidBecomeActive();
+#endif
+
     void platformInitializePluginProcess(PluginProcessCreationParameters& parameters);
 
     // The plug-in host process manager.
@@ -112,6 +137,13 @@ private:
     // If createPluginConnection is called while the process is still launching we'll keep count of it and send a bunch of requests
     // when the process finishes launching.
     unsigned m_numPendingConnectionRequests;
+
+#if PLATFORM(MAC)
+    RetainPtr<NSObject> m_activationObserver;
+    RetainPtr<WKPlaceholderModalWindow *> m_placeholderWindow;
+    bool m_modalWindowIsShowing;
+    bool m_fullscreenWindowIsShowing;
+#endif
 };
 
 } // namespace WebKit
diff --git a/Source/WebKit2/UIProcess/Plugins/PluginProcessProxy.messages.in b/Source/WebKit2/UIProcess/Plugins/PluginProcessProxy.messages.in
index a504f9a..5fcbe71 100644
--- a/Source/WebKit2/UIProcess/Plugins/PluginProcessProxy.messages.in
+++ b/Source/WebKit2/UIProcess/Plugins/PluginProcessProxy.messages.in
@@ -28,6 +28,11 @@ messages -> PluginProcessProxy {
 
     DidGetSitesWithData(Vector<WTF::String> sites, uint64_t callbackID)
     DidClearSiteData(uint64_t callbackID)
+
+#if PLATFORM(MAC)
+    SetModalWindowIsShowing(bool modalWindowIsShowing)
+    SetFullscreenWindowIsShowing(bool fullscreenWindowIsShowing)
+#endif
 }
 
 #endif
diff --git a/Source/WebKit2/UIProcess/Plugins/WebPluginSiteDataManager.cpp b/Source/WebKit2/UIProcess/Plugins/WebPluginSiteDataManager.cpp
index dfa0806..5f56d0b 100644
--- a/Source/WebKit2/UIProcess/Plugins/WebPluginSiteDataManager.cpp
+++ b/Source/WebKit2/UIProcess/Plugins/WebPluginSiteDataManager.cpp
@@ -163,11 +163,7 @@ void WebPluginSiteDataManager::getSitesWithData(PassRefPtr<ArrayCallback> prpCal
     m_pendingGetSitesWithData.set(callbackID, state);
     state->getSitesWithDataForNextPlugin();
 #else
-    if (!m_webContext->hasValidProcess()) {
-        RefPtr<ArrayCallback> callback = m_arrayCallbacks.take(callbackID);
-        callback->invalidate();
-        return;
-    }
+    m_webContext->relaunchProcessIfNecessary();
 
     Vector<String> pluginPaths;
     m_webContext->pluginInfoStore()->getPluginPaths(pluginPaths);
@@ -227,11 +223,7 @@ void WebPluginSiteDataManager::clearSiteData(ImmutableArray* sites, uint64_t fla
     state->clearSiteDataForNextPlugin();
 #else
 
-    if (!m_webContext->hasValidProcess()) {
-        RefPtr<VoidCallback> callback = m_voidCallbacks.take(callbackID);
-        callback->invalidate();
-        return;
-    }
+    m_webContext->relaunchProcessIfNecessary();
     Vector<String> pluginPaths;
     m_webContext->pluginInfoStore()->getPluginPaths(pluginPaths);
     m_webContext->ensureWebProcess();    
diff --git a/Source/WebKit2/UIProcess/Plugins/mac/PluginProcessProxyMac.mm b/Source/WebKit2/UIProcess/Plugins/mac/PluginProcessProxyMac.mm
index 2adc473..8375fd2 100644
--- a/Source/WebKit2/UIProcess/Plugins/mac/PluginProcessProxyMac.mm
+++ b/Source/WebKit2/UIProcess/Plugins/mac/PluginProcessProxyMac.mm
@@ -31,7 +31,33 @@
 #import "PluginProcessCreationParameters.h"
 #import "WebKitSystemInterface.h"
 
+@interface WKPlaceholderModalWindow : NSWindow 
+@end
+
+@implementation WKPlaceholderModalWindow
+
+// Prevent NSApp from calling requestUserAttention: when the window is shown 
+// modally, even if the app is inactive. See 6823049.
+- (BOOL)_wantsUserAttention
+{
+    return NO;   
+}
+
+@end
+
 namespace WebKit {
+    
+bool PluginProcessProxy::pluginNeedsExecutableHeap(const PluginInfoStore::Plugin& pluginInfo)
+{
+    static bool forceNonexecutableHeapForPlugins = [[NSUserDefaults standardUserDefaults] boolForKey:@"ForceNonexecutableHeapForPlugins"];
+    if (forceNonexecutableHeapForPlugins)
+        return false;
+    
+    if (pluginInfo.bundleIdentifier == "com.apple.QuickTime Plugin.plugin")
+        return false;
+    
+    return true;
+}
 
 void PluginProcessProxy::platformInitializePluginProcess(PluginProcessCreationParameters& parameters)
 {
@@ -41,7 +67,117 @@ void PluginProcessProxy::platformInitializePluginProcess(PluginProcessCreationPa
     if (renderServerPort != MACH_PORT_NULL)
         parameters.acceleratedCompositingPort = CoreIPC::MachPort(renderServerPort, MACH_MSG_TYPE_COPY_SEND);
 #endif
-}    
+}
+
+bool PluginProcessProxy::getPluginProcessSerialNumber(ProcessSerialNumber& pluginProcessSerialNumber)
+{
+    pid_t pluginProcessPID = m_processLauncher->processIdentifier();
+    return GetProcessForPID(pluginProcessPID, &pluginProcessSerialNumber) == noErr;
+}
+
+void PluginProcessProxy::makePluginProcessTheFrontProcess()
+{
+    ProcessSerialNumber pluginProcessSerialNumber;
+    if (!getPluginProcessSerialNumber(pluginProcessSerialNumber))
+        return;
+
+    SetFrontProcess(&pluginProcessSerialNumber);
+}
+
+void PluginProcessProxy::makeUIProcessTheFrontProcess()
+{
+    ProcessSerialNumber processSerialNumber;
+    GetCurrentProcess(&processSerialNumber);
+    SetFrontProcess(&processSerialNumber);            
+}
+
+void PluginProcessProxy::setFullscreenWindowIsShowing(bool fullscreenWindowIsShowing)
+{
+    if (m_fullscreenWindowIsShowing == fullscreenWindowIsShowing)
+        return;
+
+    m_fullscreenWindowIsShowing = fullscreenWindowIsShowing;
+    if (m_fullscreenWindowIsShowing)
+        enterFullscreen();
+    else
+        exitFullscreen();
+}
+
+void PluginProcessProxy::enterFullscreen()
+{
+    [NSMenu setMenuBarVisible:NO];
+
+    makePluginProcessTheFrontProcess();
+}
+
+void PluginProcessProxy::exitFullscreen()
+{
+    [NSMenu setMenuBarVisible:YES];
+
+    // If the plug-in host is the current application then we should bring ourselves to the front when it exits full-screen mode.
+
+    ProcessSerialNumber frontProcessSerialNumber;
+    GetFrontProcess(&frontProcessSerialNumber);
+    Boolean isSameProcess = 0;
+
+    ProcessSerialNumber pluginProcessSerialNumber;
+    if (!getPluginProcessSerialNumber(pluginProcessSerialNumber))
+        return;
+
+    SameProcess(&frontProcessSerialNumber, &pluginProcessSerialNumber, &isSameProcess);
+    if (!isSameProcess)
+        return;
+
+    makeUIProcessTheFrontProcess();
+}
+
+void PluginProcessProxy::setModalWindowIsShowing(bool modalWindowIsShowing)
+{
+    if (modalWindowIsShowing == m_modalWindowIsShowing) 
+        return;
+    
+    m_modalWindowIsShowing = modalWindowIsShowing;
+    
+    if (m_modalWindowIsShowing)
+        beginModal();
+    else
+        endModal();
+}
+
+void PluginProcessProxy::beginModal()
+{
+    ASSERT(!m_placeholderWindow);
+    ASSERT(!m_activationObserver);
+    
+    m_placeholderWindow.adoptNS([[WKPlaceholderModalWindow alloc] initWithContentRect:NSMakeRect(0, 0, 1, 1) styleMask:NSBorderlessWindowMask backing:NSBackingStoreBuffered defer:YES]);
+    
+    m_activationObserver = [[NSNotificationCenter defaultCenter] addObserverForName:NSApplicationWillBecomeActiveNotification object:NSApp queue:nil
+                                                                         usingBlock:^(NSNotification *){ applicationDidBecomeActive(); }];
+    
+    [NSApp runModalForWindow:m_placeholderWindow.get()];
+    
+    [m_placeholderWindow.get() orderOut:nil];
+    m_placeholderWindow = nullptr;
+}
+
+void PluginProcessProxy::endModal()
+{
+    ASSERT(m_placeholderWindow);
+    ASSERT(m_activationObserver);
+    
+    [[NSNotificationCenter defaultCenter] removeObserver:m_activationObserver.get()];
+    m_activationObserver = nullptr;
+    
+    [NSApp stopModal];
+
+    makeUIProcessTheFrontProcess();
+}
+    
+void PluginProcessProxy::applicationDidBecomeActive()
+{
+    makePluginProcessTheFrontProcess();
+}
+
 
 } // namespace WebKit
 
diff --git a/Source/WebKit2/UIProcess/Plugins/win/PluginInfoStoreWin.cpp b/Source/WebKit2/UIProcess/Plugins/win/PluginInfoStoreWin.cpp
index 2138131..f695969 100644
--- a/Source/WebKit2/UIProcess/Plugins/win/PluginInfoStoreWin.cpp
+++ b/Source/WebKit2/UIProcess/Plugins/win/PluginInfoStoreWin.cpp
@@ -27,6 +27,7 @@
 #include "PluginInfoStore.h"
 
 #include "NetscapePluginModule.h"
+#include <WebCore/PathWalker.h>
 #include <shlwapi.h>
 
 using namespace WebCore;
@@ -254,37 +255,11 @@ Vector<String> PluginInfoStore::pluginsDirectories()
     return directories;
 }
 
-class PathWalker {
-    WTF_MAKE_NONCOPYABLE(PathWalker);
-public:
-    PathWalker(const String& directory)
-    {
-        String pattern = directory + "\\*";
-        m_handle = ::FindFirstFileW(pattern.charactersWithNullTermination(), &m_data);
-    }
-
-    ~PathWalker()
-    {
-        if (!isValid())
-            return;
-        ::FindClose(m_handle);
-    }
-
-    bool isValid() const { return m_handle != INVALID_HANDLE_VALUE; }
-    const WIN32_FIND_DATAW& data() const { return m_data; }
-
-    bool step() { return ::FindNextFileW(m_handle, &m_data); }
-
-private:
-    HANDLE m_handle;
-    WIN32_FIND_DATAW m_data;
-};
-
 Vector<String> PluginInfoStore::pluginPathsInDirectory(const String& directory)
 {
     Vector<String> paths;
 
-    PathWalker walker(directory);
+    PathWalker walker(directory, "*");
     if (!walker.isValid())
         return paths;
 
@@ -385,6 +360,11 @@ bool PluginInfoStore::shouldUsePlugin(const Plugin& plugin)
         return false;
     }
 
+    if (equalIgnoringCase(plugin.info.file, "npwpf.dll")) {
+        // Bug 57119: Microsoft Windows Presentation Foundation (WPF) plug-in complains about missing xpcom.dll
+        return false;
+    }
+
     if (plugin.info.name == "Yahoo Application State Plugin") {
         // https://bugs.webkit.org/show_bug.cgi?id=26860
         // Bug in Yahoo Application State plug-in earlier than 1.0.0.6 leads to heap corruption.
diff --git a/Source/WebKit2/UIProcess/WebApplicationCacheManagerProxy.cpp b/Source/WebKit2/UIProcess/WebApplicationCacheManagerProxy.cpp
index 1cf4921..6b24940 100644
--- a/Source/WebKit2/UIProcess/WebApplicationCacheManagerProxy.cpp
+++ b/Source/WebKit2/UIProcess/WebApplicationCacheManagerProxy.cpp
@@ -52,6 +52,11 @@ void WebApplicationCacheManagerProxy::invalidate()
     invalidateCallbackMap(m_arrayCallbacks);
 }
 
+bool WebApplicationCacheManagerProxy::shouldTerminate(WebProcessProxy*) const
+{
+    return m_arrayCallbacks.isEmpty();
+}
+
 void WebApplicationCacheManagerProxy::didReceiveMessage(CoreIPC::Connection* connection, CoreIPC::MessageID messageID, CoreIPC::ArgumentDecoder* arguments)
 {
     didReceiveWebApplicationCacheManagerProxyMessage(connection, messageID, arguments);
@@ -60,10 +65,7 @@ void WebApplicationCacheManagerProxy::didReceiveMessage(CoreIPC::Connection* con
 void WebApplicationCacheManagerProxy::getApplicationCacheOrigins(PassRefPtr<ArrayCallback> prpCallback)
 {
     RefPtr<ArrayCallback> callback = prpCallback;
-    if (!m_webContext->hasValidProcess()) {
-        callback->invalidate();
-        return;
-    }
+    m_webContext->relaunchProcessIfNecessary();
     
     uint64_t callbackID = callback->callbackID();
     m_arrayCallbacks.set(callbackID, callback.release());
@@ -78,8 +80,7 @@ void WebApplicationCacheManagerProxy::didGetApplicationCacheOrigins(const Vector
 
 void WebApplicationCacheManagerProxy::deleteEntriesForOrigin(WebSecurityOrigin* origin)
 {
-    if (!m_webContext->hasValidProcess())
-        return;
+    m_webContext->relaunchProcessIfNecessary();
     
     SecurityOriginData securityOriginData;
     securityOriginData.protocol = origin->protocol();
@@ -91,8 +92,7 @@ void WebApplicationCacheManagerProxy::deleteEntriesForOrigin(WebSecurityOrigin*
 
 void WebApplicationCacheManagerProxy::deleteAllEntries()
 {
-    if (!m_webContext->hasValidProcess())
-        return;
+    m_webContext->relaunchProcessIfNecessary();
     m_webContext->process()->send(Messages::WebApplicationCacheManager::DeleteAllEntries(), 0);
 }
 
diff --git a/Source/WebKit2/UIProcess/WebApplicationCacheManagerProxy.h b/Source/WebKit2/UIProcess/WebApplicationCacheManagerProxy.h
index 81637e0..b3dca15 100644
--- a/Source/WebKit2/UIProcess/WebApplicationCacheManagerProxy.h
+++ b/Source/WebKit2/UIProcess/WebApplicationCacheManagerProxy.h
@@ -44,6 +44,7 @@ namespace WebKit {
 
 struct SecurityOriginData;
 class WebContext;
+class WebProcessProxy;
 class WebSecurityOrigin;
 
 typedef GenericCallback<WKArrayRef> ArrayCallback;
@@ -64,6 +65,8 @@ public:
 
     void didReceiveMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::ArgumentDecoder*);
 
+    bool shouldTerminate(WebProcessProxy*) const;
+
 private:
     WebApplicationCacheManagerProxy(WebContext*);
 
diff --git a/Source/WebKit2/UIProcess/WebContext.cpp b/Source/WebKit2/UIProcess/WebContext.cpp
index 01b1e0c..0609d68 100644
--- a/Source/WebKit2/UIProcess/WebContext.cpp
+++ b/Source/WebKit2/UIProcess/WebContext.cpp
@@ -29,6 +29,7 @@
 #include "DownloadProxy.h"
 #include "ImmutableArray.h"
 #include "InjectedBundleMessageKinds.h"
+#include "Logging.h"
 #include "RunLoop.h"
 #include "SandboxExtension.h"
 #include "TextChecker.h"
@@ -40,7 +41,9 @@
 #include "WebCoreArgumentCoders.h"
 #include "WebDatabaseManagerProxy.h"
 #include "WebGeolocationManagerProxy.h"
+#include "WebIconDatabase.h"
 #include "WebKeyValueStorageManagerProxy.h"
+#include "WebMediaCacheManagerProxy.h"
 #include "WebPluginSiteDataManager.h"
 #include "WebPageGroup.h"
 #include "WebMemorySampler.h"
@@ -116,13 +119,20 @@ WebContext::WebContext(ProcessModel processModel, const String& injectedBundlePa
     , m_cookieManagerProxy(WebCookieManagerProxy::create(this))
     , m_databaseManagerProxy(WebDatabaseManagerProxy::create(this))
     , m_geolocationManagerProxy(WebGeolocationManagerProxy::create(this))
+    , m_iconDatabase(WebIconDatabase::create(this))
     , m_keyValueStorageManagerProxy(WebKeyValueStorageManagerProxy::create(this))
+    , m_mediaCacheManagerProxy(WebMediaCacheManagerProxy::create(this))
     , m_pluginSiteDataManager(WebPluginSiteDataManager::create(this))
     , m_resourceCacheManagerProxy(WebResourceCacheManagerProxy::create(this))
 #if PLATFORM(WIN)
     , m_shouldPaintNativeControls(true)
+    , m_initialHTTPCookieAcceptPolicy(HTTPCookieAcceptPolicyAlways)
 #endif
 {
+#ifndef NDEBUG
+    WebKit::initializeLogChannelsIfNecessary();
+#endif
+
     contexts().append(this);
 
     addLanguageChangeObserver(this, languageChanged);
@@ -147,21 +157,29 @@ WebContext::~WebContext()
     m_cookieManagerProxy->invalidate();
     m_cookieManagerProxy->clearContext();
 
+    m_databaseManagerProxy->invalidate();
+    m_databaseManagerProxy->clearContext();
+    
     m_geolocationManagerProxy->invalidate();
     m_geolocationManagerProxy->clearContext();
 
-    m_databaseManagerProxy->invalidate();
-    m_databaseManagerProxy->clearContext();
+    m_iconDatabase->invalidate();
+    m_iconDatabase->clearContext();
     
     m_keyValueStorageManagerProxy->invalidate();
     m_keyValueStorageManagerProxy->clearContext();
 
+    m_mediaCacheManagerProxy->invalidate();
+    m_mediaCacheManagerProxy->clearContext();
+
     m_pluginSiteDataManager->invalidate();
     m_pluginSiteDataManager->clearContext();
 
     m_resourceCacheManagerProxy->invalidate();
     m_resourceCacheManagerProxy->clearContext();
 
+    platformInvalidateContext();
+    
 #ifndef NDEBUG
     webContextCounter.decrement();
 #endif
@@ -222,6 +240,7 @@ void WebContext::ensureWebProcess()
     parameters.languageCode = defaultLanguage();
     parameters.applicationCacheDirectory = applicationCacheDirectory();
     parameters.databaseDirectory = databaseDirectory();
+    parameters.localStorageDirectory = localStorageDirectory();
     parameters.clearResourceCaches = m_clearResourceCachesForNewWebProcess;
     parameters.clearApplicationCache = m_clearApplicationCacheForNewWebProcess;
 #if PLATFORM(MAC)
@@ -236,6 +255,8 @@ void WebContext::ensureWebProcess()
     copyToVector(m_schemesToSetDomainRelaxationForbiddenFor, parameters.urlSchemesForWhichDomainRelaxationIsForbidden);
 
     parameters.shouldAlwaysUseComplexTextCodePath = m_alwaysUsesComplexTextCodePath;
+    
+    parameters.iconDatabaseEnabled = !iconDatabasePath().isEmpty();
 
     parameters.textCheckerState = TextChecker::state();
 
@@ -261,8 +282,20 @@ bool WebContext::shouldTerminate(WebProcessProxy* process)
     if (!m_downloads.isEmpty())
         return false;
 
+    if (!m_applicationCacheManagerProxy->shouldTerminate(process))
+        return false;
+    if (!m_cookieManagerProxy->shouldTerminate(process))
+        return false;
+    if (!m_databaseManagerProxy->shouldTerminate(process))
+        return false;
+    if (!m_keyValueStorageManagerProxy->shouldTerminate(process))
+        return false;
+    if (!m_mediaCacheManagerProxy->shouldTerminate(process))
+        return false;
     if (!m_pluginSiteDataManager->shouldTerminate(process))
         return false;
+    if (!m_resourceCacheManagerProxy->shouldTerminate(process))
+        return false;
 
     return true;
 }
@@ -306,6 +339,7 @@ void WebContext::disconnectProcess(WebProcessProxy* process)
     m_databaseManagerProxy->invalidate();
     m_geolocationManagerProxy->invalidate();
     m_keyValueStorageManagerProxy->invalidate();
+    m_mediaCacheManagerProxy->invalidate();
     m_resourceCacheManagerProxy->invalidate();
 
     // When out of process plug-ins are enabled, we don't want to invalidate the plug-in site data
@@ -590,12 +624,22 @@ void WebContext::didReceiveMessage(CoreIPC::Connection* connection, CoreIPC::Mes
         m_geolocationManagerProxy->didReceiveMessage(connection, messageID, arguments);
         return;
     }
+    
+    if (messageID.is<CoreIPC::MessageClassWebIconDatabase>()) {
+        m_iconDatabase->didReceiveMessage(connection, messageID, arguments);
+        return;
+    }
 
     if (messageID.is<CoreIPC::MessageClassWebKeyValueStorageManagerProxy>()) {
         m_keyValueStorageManagerProxy->didReceiveMessage(connection, messageID, arguments);
         return;
     }
 
+    if (messageID.is<CoreIPC::MessageClassWebMediaCacheManagerProxy>()) {
+        m_mediaCacheManagerProxy->didReceiveMessage(connection, messageID, arguments);
+        return;
+    }
+
     if (messageID.is<CoreIPC::MessageClassWebResourceCacheManagerProxy>()) {
         m_resourceCacheManagerProxy->didReceiveWebResourceCacheManagerProxyMessage(connection, messageID, arguments);
         return;
@@ -631,6 +675,9 @@ CoreIPC::SyncReplyMode WebContext::didReceiveSyncMessage(CoreIPC::Connection* co
         return CoreIPC::AutomaticReply;
     }
     
+    if (messageID.is<CoreIPC::MessageClassWebIconDatabase>())
+        return m_iconDatabase->didReceiveSyncMessage(connection, messageID, arguments, reply);
+    
     switch (messageID.get<WebContextLegacyMessage::Kind>()) {
         case WebContextLegacyMessage::PostSynchronousMessage: {
             // FIXME: We should probably encode something in the case that the arguments do not decode correctly.
@@ -653,17 +700,20 @@ CoreIPC::SyncReplyMode WebContext::didReceiveSyncMessage(CoreIPC::Connection* co
     return CoreIPC::AutomaticReply;
 }
 
-void WebContext::clearResourceCaches()
+void WebContext::clearResourceCaches(ResourceCachesToClear cachesToClear)
 {
-    if (!hasValidProcess()) {
-        // FIXME <rdar://problem/8727879>: Setting this flag ensures that the next time a WebProcess is created, this request to
-        // clear the resource cache will be respected. But if the user quits the application before another WebProcess is created,
-        // their request will be ignored.
-        m_clearResourceCachesForNewWebProcess = true;
+    if (hasValidProcess()) {
+        m_process->send(Messages::WebProcess::ClearResourceCaches(cachesToClear), 0);
         return;
     }
 
-    m_process->send(Messages::WebProcess::ClearResourceCaches(), 0);
+    if (cachesToClear == InMemoryResourceCachesOnly)
+        return;
+
+    // FIXME <rdar://problem/8727879>: Setting this flag ensures that the next time a WebProcess is created, this request to
+    // clear the resource cache will be respected. But if the user quits the application before another WebProcess is created,
+    // their request will be ignored.
+    m_clearResourceCachesForNewWebProcess = true;
 }
 
 void WebContext::clearApplicationCache()
@@ -678,6 +728,14 @@ void WebContext::clearApplicationCache()
 
     m_process->send(Messages::WebProcess::ClearApplicationCache(), 0);
 }
+   
+void WebContext::setEnhancedAccessibility(bool flag)
+{
+    if (!hasValidProcess())
+        return;
+    
+    m_process->send(Messages::WebProcess::SetEnhancedAccessibility(flag), 0);
+}
     
 void WebContext::startMemorySampler(const double interval)
 {    
@@ -726,4 +784,26 @@ String WebContext::databaseDirectory() const
     return platformDefaultDatabaseDirectory();
 }
 
+void WebContext::setIconDatabasePath(const String& path)
+{
+    m_overrideIconDatabasePath = path;
+    m_iconDatabase->setDatabasePath(path);
+}
+
+String WebContext::iconDatabasePath() const
+{
+    if (!m_overrideIconDatabasePath.isEmpty())
+        return m_overrideIconDatabasePath;
+
+    return platformDefaultIconDatabasePath();
+}
+
+String WebContext::localStorageDirectory() const
+{
+    if (!m_overrideLocalStorageDirectory.isEmpty())
+        return m_overrideLocalStorageDirectory;
+
+    return platformDefaultLocalStorageDirectory();
+}
+
 } // namespace WebKit
diff --git a/Source/WebKit2/UIProcess/WebContext.h b/Source/WebKit2/UIProcess/WebContext.h
index 72cd5dc..a9ba22f 100644
--- a/Source/WebKit2/UIProcess/WebContext.h
+++ b/Source/WebKit2/UIProcess/WebContext.h
@@ -49,7 +49,9 @@ class WebApplicationCacheManagerProxy;
 class WebCookieManagerProxy;
 class WebDatabaseManagerProxy;
 class WebGeolocationManagerProxy;
+class WebIconDatabase;
 class WebKeyValueStorageManagerProxy;
+class WebMediaCacheManagerProxy;
 class WebPageGroup;
 class WebPageProxy;
 class WebResourceCacheManagerProxy;
@@ -118,7 +120,7 @@ public:
 
     void setCacheModel(CacheModel);
     CacheModel cacheModel() const { return m_cacheModel; }
-    void clearResourceCaches();
+    void clearResourceCaches(ResourceCachesToClear);
     void clearApplicationCache();
 
     void setDefaultRequestTimeoutInterval(double);
@@ -128,8 +130,12 @@ public:
 
 #if PLATFORM(WIN)
     void setShouldPaintNativeControls(bool);
+
+    void setInitialHTTPCookieAcceptPolicy(HTTPCookieAcceptPolicy policy) { m_initialHTTPCookieAcceptPolicy = policy; }
 #endif
 
+    void setEnhancedAccessibility(bool);
+    
     // Downloads.
     uint64_t createDownloadProxy();
     WebDownloadClient& downloadClient() { return m_downloadClient; }
@@ -141,7 +147,9 @@ public:
     WebCookieManagerProxy* cookieManagerProxy() const { return m_cookieManagerProxy.get(); }
     WebDatabaseManagerProxy* databaseManagerProxy() const { return m_databaseManagerProxy.get(); }
     WebGeolocationManagerProxy* geolocationManagerProxy() const { return m_geolocationManagerProxy.get(); }
+    WebIconDatabase* iconDatabase() const { return m_iconDatabase.get(); }
     WebKeyValueStorageManagerProxy* keyValueStorageManagerProxy() const { return m_keyValueStorageManagerProxy.get(); }
+    WebMediaCacheManagerProxy* mediaCacheManagerProxy() const { return m_mediaCacheManagerProxy.get(); }
     WebPluginSiteDataManager* pluginSiteDataManager() const { return m_pluginSiteDataManager.get(); }
     WebResourceCacheManagerProxy* resourceCacheManagerProxy() const { return m_resourceCacheManagerProxy.get(); }
 
@@ -150,9 +158,11 @@ public:
         unsigned wkPageCount;
         unsigned wkFrameCount;
     };
-    static Statistics& statistics();
+    static Statistics& statistics();    
 
     void setDatabaseDirectory(const String& dir) { m_overrideDatabaseDirectory = dir; }
+    void setIconDatabasePath(const String&);
+    void setLocalStorageDirectory(const String& dir) { m_overrideLocalStorageDirectory = dir; }
 
     void ensureWebProcess();
 
@@ -164,7 +174,8 @@ private:
     virtual Type type() const { return APIType; }
 
     void platformInitializeWebProcess(WebProcessCreationParameters&);
-
+    void platformInvalidateContext();
+    
     // History client
     void didNavigateWithNavigationData(uint64_t pageID, const WebNavigationDataStore& store, uint64_t frameID);
     void didPerformClientRedirect(uint64_t pageID, const String& sourceURLString, const String& destinationURLString, uint64_t frameID);
@@ -189,6 +200,12 @@ private:
     String databaseDirectory() const;
     String platformDefaultDatabaseDirectory() const;
 
+    String iconDatabasePath() const;
+    String platformDefaultIconDatabasePath() const;
+
+    String localStorageDirectory() const;
+    String platformDefaultLocalStorageDirectory() const;
+    
     ProcessModel m_processModel;
     
     // FIXME: In the future, this should be one or more WebProcessProxies.
@@ -228,15 +245,24 @@ private:
     RefPtr<WebCookieManagerProxy> m_cookieManagerProxy;
     RefPtr<WebDatabaseManagerProxy> m_databaseManagerProxy;
     RefPtr<WebGeolocationManagerProxy> m_geolocationManagerProxy;
+    RefPtr<WebIconDatabase> m_iconDatabase;
     RefPtr<WebKeyValueStorageManagerProxy> m_keyValueStorageManagerProxy;
+    RefPtr<WebMediaCacheManagerProxy> m_mediaCacheManagerProxy;
     RefPtr<WebPluginSiteDataManager> m_pluginSiteDataManager;
     RefPtr<WebResourceCacheManagerProxy> m_resourceCacheManagerProxy;
 
 #if PLATFORM(WIN)
     bool m_shouldPaintNativeControls;
+    HTTPCookieAcceptPolicy m_initialHTTPCookieAcceptPolicy;
 #endif
 
+#if PLATFORM(MAC)
+    RetainPtr<CFTypeRef> m_enhancedAccessibilityObserver;
+#endif
+    
     String m_overrideDatabaseDirectory;
+    String m_overrideIconDatabasePath;
+    String m_overrideLocalStorageDirectory;
 };
 
 } // namespace WebKit
diff --git a/Source/WebKit2/UIProcess/WebCookieManagerProxy.cpp b/Source/WebKit2/UIProcess/WebCookieManagerProxy.cpp
index c56374c..a30ab41 100644
--- a/Source/WebKit2/UIProcess/WebCookieManagerProxy.cpp
+++ b/Source/WebKit2/UIProcess/WebCookieManagerProxy.cpp
@@ -50,6 +50,12 @@ WebCookieManagerProxy::~WebCookieManagerProxy()
 void WebCookieManagerProxy::invalidate()
 {
     invalidateCallbackMap(m_arrayCallbacks);
+    invalidateCallbackMap(m_httpCookieAcceptPolicyCallbacks);
+}
+
+bool WebCookieManagerProxy::shouldTerminate(WebProcessProxy*) const
+{
+    return m_arrayCallbacks.isEmpty() && m_httpCookieAcceptPolicyCallbacks.isEmpty();
 }
 
 void WebCookieManagerProxy::initializeClient(const WKCookieManagerClient* client)
@@ -67,10 +73,7 @@ void WebCookieManagerProxy::getHostnamesWithCookies(PassRefPtr<ArrayCallback> pr
     ASSERT(m_webContext);
 
     RefPtr<ArrayCallback> callback = prpCallback;
-    if (!m_webContext->hasValidProcess()) {
-        callback->invalidate();
-        return;
-    }
+    m_webContext->relaunchProcessIfNecessary();
     
     uint64_t callbackID = callback->callbackID();
     m_arrayCallbacks.set(callbackID, callback.release());
@@ -97,24 +100,21 @@ void WebCookieManagerProxy::didGetHostnamesWithCookies(const Vector<String>& hos
 void WebCookieManagerProxy::deleteCookiesForHostname(const String& hostname)
 {
     ASSERT(m_webContext);
-    if (!m_webContext->hasValidProcess())
-        return;
+    m_webContext->relaunchProcessIfNecessary();
     m_webContext->process()->send(Messages::WebCookieManager::DeleteCookiesForHostname(hostname), 0);
 }
 
 void WebCookieManagerProxy::deleteAllCookies()
 {
     ASSERT(m_webContext);
-    if (!m_webContext->hasValidProcess())
-        return;
+    m_webContext->relaunchProcessIfNecessary();
     m_webContext->process()->send(Messages::WebCookieManager::DeleteAllCookies(), 0);
 }
 
 void WebCookieManagerProxy::startObservingCookieChanges()
 {
     ASSERT(m_webContext);
-    if (!m_webContext->hasValidProcess())
-        return;
+    m_webContext->relaunchProcessIfNecessary();
     m_webContext->process()->send(Messages::WebCookieManager::StartObservingCookieChanges(), 0);
 }
 
@@ -131,4 +131,37 @@ void WebCookieManagerProxy::cookiesDidChange()
     m_client.cookiesDidChange(this);
 }
 
+void WebCookieManagerProxy::setHTTPCookieAcceptPolicy(HTTPCookieAcceptPolicy policy)
+{
+    ASSERT(m_webContext);
+    m_webContext->relaunchProcessIfNecessary();
+#if PLATFORM(MAC)
+    persistHTTPCookieAcceptPolicy(policy);
+#endif
+    m_webContext->process()->send(Messages::WebCookieManager::SetHTTPCookieAcceptPolicy(policy), 0);
+}
+
+void WebCookieManagerProxy::getHTTPCookieAcceptPolicy(PassRefPtr<HTTPCookieAcceptPolicyCallback> prpCallback)
+{
+    ASSERT(m_webContext);
+
+    RefPtr<HTTPCookieAcceptPolicyCallback> callback = prpCallback;
+    m_webContext->relaunchProcessIfNecessary();
+
+    uint64_t callbackID = callback->callbackID();
+    m_httpCookieAcceptPolicyCallbacks.set(callbackID, callback.release());
+    m_webContext->process()->send(Messages::WebCookieManager::GetHTTPCookieAcceptPolicy(callbackID), 0);
+}
+
+void WebCookieManagerProxy::didGetHTTPCookieAcceptPolicy(uint32_t policy, uint64_t callbackID)
+{
+    RefPtr<HTTPCookieAcceptPolicyCallback> callback = m_httpCookieAcceptPolicyCallbacks.take(callbackID);
+    if (!callback) {
+        // FIXME: Log error or assert.
+        return;
+    }
+
+    callback->performCallbackWithReturnValue(policy);
+}
+
 } // namespace WebKit
diff --git a/Source/WebKit2/UIProcess/WebCookieManagerProxy.h b/Source/WebKit2/UIProcess/WebCookieManagerProxy.h
index 9d63265..7dc20d5 100644
--- a/Source/WebKit2/UIProcess/WebCookieManagerProxy.h
+++ b/Source/WebKit2/UIProcess/WebCookieManagerProxy.h
@@ -43,8 +43,10 @@ namespace CoreIPC {
 namespace WebKit {
 
 class WebContext;
+class WebProcessProxy;
 
 typedef GenericCallback<WKArrayRef> ArrayCallback;
+typedef GenericCallback<WKHTTPCookieAcceptPolicy, HTTPCookieAcceptPolicy> HTTPCookieAcceptPolicyCallback;
 
 class WebCookieManagerProxy : public APIObject {
 public:
@@ -62,24 +64,35 @@ public:
     void deleteCookiesForHostname(const String& hostname);
     void deleteAllCookies();
 
+    void setHTTPCookieAcceptPolicy(HTTPCookieAcceptPolicy);
+    void getHTTPCookieAcceptPolicy(PassRefPtr<HTTPCookieAcceptPolicyCallback>);
+
     void startObservingCookieChanges();
     void stopObservingCookieChanges();
 
     void didReceiveMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::ArgumentDecoder*);
 
+    bool shouldTerminate(WebProcessProxy*) const;
+
 private:
     WebCookieManagerProxy(WebContext*);
 
     virtual Type type() const { return APIType; }
 
     void didGetHostnamesWithCookies(const Vector<String>&, uint64_t callbackID);
+    void didGetHTTPCookieAcceptPolicy(uint32_t policy, uint64_t callbackID);
 
     void cookiesDidChange();
     
     void didReceiveWebCookieManagerProxyMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::ArgumentDecoder*);
 
+#if PLATFORM(MAC)
+    void persistHTTPCookieAcceptPolicy(HTTPCookieAcceptPolicy);
+#endif
+
     WebContext* m_webContext;
     HashMap<uint64_t, RefPtr<ArrayCallback> > m_arrayCallbacks;
+    HashMap<uint64_t, RefPtr<HTTPCookieAcceptPolicyCallback> > m_httpCookieAcceptPolicyCallbacks;
 
     WebCookieManagerProxyClient m_client;
 };
diff --git a/Source/WebKit2/UIProcess/WebCookieManagerProxy.messages.in b/Source/WebKit2/UIProcess/WebCookieManagerProxy.messages.in
index 808b4c7..2ae0545 100644
--- a/Source/WebKit2/UIProcess/WebCookieManagerProxy.messages.in
+++ b/Source/WebKit2/UIProcess/WebCookieManagerProxy.messages.in
@@ -22,6 +22,7 @@
 
 messages -> WebCookieManagerProxy {
     DidGetHostnamesWithCookies(Vector<WTF::String> hostnames, uint64_t callbackID);
+    DidGetHTTPCookieAcceptPolicy(uint32_t policy, uint64_t callbackID);
     
     CookiesDidChange()
 }
diff --git a/Source/WebKit2/UIProcess/WebDatabaseManagerProxy.cpp b/Source/WebKit2/UIProcess/WebDatabaseManagerProxy.cpp
index 96488fb..67323cd 100644
--- a/Source/WebKit2/UIProcess/WebDatabaseManagerProxy.cpp
+++ b/Source/WebKit2/UIProcess/WebDatabaseManagerProxy.cpp
@@ -103,6 +103,11 @@ void WebDatabaseManagerProxy::invalidate()
     invalidateCallbackMap(m_arrayCallbacks);
 }
 
+bool WebDatabaseManagerProxy::shouldTerminate(WebProcessProxy*) const
+{
+    return m_arrayCallbacks.isEmpty();
+}
+
 void WebDatabaseManagerProxy::initializeClient(const WKDatabaseManagerClient* client)
 {
     m_client.initialize(client);
@@ -111,10 +116,7 @@ void WebDatabaseManagerProxy::initializeClient(const WKDatabaseManagerClient* cl
 void WebDatabaseManagerProxy::getDatabasesByOrigin(PassRefPtr<ArrayCallback> prpCallback)
 {
     RefPtr<ArrayCallback> callback = prpCallback;
-    if (!m_webContext->hasValidProcess()) {
-        callback->invalidate();
-        return;
-    }
+    m_webContext->relaunchProcessIfNecessary();
     uint64_t callbackID = callback->callbackID();
     m_arrayCallbacks.set(callbackID, callback.release());
     m_webContext->process()->send(Messages::WebDatabaseManager::GetDatabasesByOrigin(callbackID), 0);
@@ -167,10 +169,7 @@ void WebDatabaseManagerProxy::didGetDatabasesByOrigin(const Vector<OriginAndData
 void WebDatabaseManagerProxy::getDatabaseOrigins(PassRefPtr<ArrayCallback> prpCallback)
 {
     RefPtr<ArrayCallback> callback = prpCallback;
-    if (!m_webContext->hasValidProcess()) {
-        callback->invalidate();
-        return;
-    }
+    m_webContext->relaunchProcessIfNecessary();
     uint64_t callbackID = callback->callbackID();
     m_arrayCallbacks.set(callbackID, callback.release());
     m_webContext->process()->send(Messages::WebDatabaseManager::GetDatabaseOrigins(callbackID), 0);
@@ -195,29 +194,25 @@ void WebDatabaseManagerProxy::didGetDatabaseOrigins(const Vector<String>& origin
 
 void WebDatabaseManagerProxy::deleteDatabaseWithNameForOrigin(const String& databaseIdentifier, WebSecurityOrigin* origin)
 {
-    if (!m_webContext->hasValidProcess())
-        return;
+    m_webContext->relaunchProcessIfNecessary();
     m_webContext->process()->send(Messages::WebDatabaseManager::DeleteDatabaseWithNameForOrigin(databaseIdentifier, origin->databaseIdentifier()), 0);
 }
 
 void WebDatabaseManagerProxy::deleteDatabasesForOrigin(WebSecurityOrigin* origin)
 {
-    if (!m_webContext->hasValidProcess())
-        return;
+    m_webContext->relaunchProcessIfNecessary();
     m_webContext->process()->send(Messages::WebDatabaseManager::DeleteDatabasesForOrigin(origin->databaseIdentifier()), 0);
 }
 
 void WebDatabaseManagerProxy::deleteAllDatabases()
 {
-    if (!m_webContext->hasValidProcess())
-        return;
+    m_webContext->relaunchProcessIfNecessary();
     m_webContext->process()->send(Messages::WebDatabaseManager::DeleteAllDatabases(), 0);
 }
 
 void WebDatabaseManagerProxy::setQuotaForOrigin(WebSecurityOrigin* origin, uint64_t quota)
 {
-    if (!m_webContext->hasValidProcess())
-        return;
+    m_webContext->relaunchProcessIfNecessary();
     m_webContext->process()->send(Messages::WebDatabaseManager::SetQuotaForOrigin(origin->databaseIdentifier(), quota), 0);
 }
 
diff --git a/Source/WebKit2/UIProcess/WebDatabaseManagerProxy.h b/Source/WebKit2/UIProcess/WebDatabaseManagerProxy.h
index 3658845..d70011c 100644
--- a/Source/WebKit2/UIProcess/WebDatabaseManagerProxy.h
+++ b/Source/WebKit2/UIProcess/WebDatabaseManagerProxy.h
@@ -43,6 +43,7 @@ class MessageID;
 namespace WebKit {
 
 class WebContext;
+class WebProcessProxy;
 class WebSecurityOrigin;
 
 typedef GenericCallback<WKArrayRef> ArrayCallback;
@@ -77,6 +78,8 @@ public:
 
     void didReceiveWebDatabaseManagerProxyMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::ArgumentDecoder*);
 
+    bool shouldTerminate(WebProcessProxy*) const;
+
 private:
     explicit WebDatabaseManagerProxy(WebContext*);
 
diff --git a/Source/WebKit2/UIProcess/WebDownloadClient.cpp b/Source/WebKit2/UIProcess/WebDownloadClient.cpp
index 4b1b756..612a056 100644
--- a/Source/WebKit2/UIProcess/WebDownloadClient.cpp
+++ b/Source/WebKit2/UIProcess/WebDownloadClient.cpp
@@ -42,6 +42,14 @@ void WebDownloadClient::didStart(WebContext* webContext, DownloadProxy* download
     m_client.didStart(toAPI(webContext), toAPI(downloadProxy), m_client.clientInfo);
 }
 
+void WebDownloadClient::didReceiveAuthenticationChallenge(WebContext* webContext, DownloadProxy* downloadProxy, AuthenticationChallengeProxy* authenticationChallengeProxy)
+{
+    if (!m_client.didReceiveAuthenticationChallenge)
+        return;
+
+    m_client.didReceiveAuthenticationChallenge(toAPI(webContext), toAPI(downloadProxy), toAPI(authenticationChallengeProxy), m_client.clientInfo);
+}
+
 void WebDownloadClient::didReceiveResponse(WebContext* webContext, DownloadProxy* downloadProxy, const ResourceResponse& response)
 {
     if (!m_client.didReceiveResponse)
diff --git a/Source/WebKit2/UIProcess/WebDownloadClient.h b/Source/WebKit2/UIProcess/WebDownloadClient.h
index 902c870..46010a1 100644
--- a/Source/WebKit2/UIProcess/WebDownloadClient.h
+++ b/Source/WebKit2/UIProcess/WebDownloadClient.h
@@ -37,12 +37,14 @@ namespace WebCore {
 
 namespace WebKit {
 
+class AuthenticationChallengeProxy;
 class DownloadProxy;
 class WebContext;
 
 class WebDownloadClient : public APIClient<WKContextDownloadClient> {
 public:
     void didStart(WebContext*, DownloadProxy*);
+    void didReceiveAuthenticationChallenge(WebContext*, DownloadProxy*, AuthenticationChallengeProxy*);
     void didReceiveResponse(WebContext*, DownloadProxy*, const WebCore::ResourceResponse&);
     void didReceiveData(WebContext*, DownloadProxy*, uint64_t length);
     bool shouldDecodeSourceDataOfMIMEType(WebContext*, DownloadProxy*, const String& mimeType);
diff --git a/Source/WebKit2/UIProcess/WebEditCommandProxy.cpp b/Source/WebKit2/UIProcess/WebEditCommandProxy.cpp
index 568faa1..b9599f3 100644
--- a/Source/WebKit2/UIProcess/WebEditCommandProxy.cpp
+++ b/Source/WebKit2/UIProcess/WebEditCommandProxy.cpp
@@ -54,7 +54,7 @@ void WebEditCommandProxy::unapply()
         return;
 
     m_page->process()->send(Messages::WebPage::UnapplyEditCommand(m_commandID), m_page->pageID());
-    m_page->registerEditCommand(this, WebPageProxy::Undo);
+    m_page->registerEditCommand(this, WebPageProxy::Redo);
 }
 
 void WebEditCommandProxy::reapply()
@@ -63,7 +63,7 @@ void WebEditCommandProxy::reapply()
         return;
 
     m_page->process()->send(Messages::WebPage::ReapplyEditCommand(m_commandID), m_page->pageID());
-    m_page->registerEditCommand(this, WebPageProxy::Redo);
+    m_page->registerEditCommand(this, WebPageProxy::Undo);
 }
 
 } // namespace WebKit
diff --git a/Source/WebKit2/UIProcess/WebEditCommandProxy.h b/Source/WebKit2/UIProcess/WebEditCommandProxy.h
index 2d21d3f..4c08877 100644
--- a/Source/WebKit2/UIProcess/WebEditCommandProxy.h
+++ b/Source/WebKit2/UIProcess/WebEditCommandProxy.h
@@ -26,6 +26,7 @@
 #ifndef WebEditCommandProxy_h
 #define WebEditCommandProxy_h
 
+#include "APIObject.h"
 #include <WebCore/EditAction.h>
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefCounted.h>
@@ -34,7 +35,7 @@ namespace WebKit {
 
 class WebPageProxy;
 
-class WebEditCommandProxy : public RefCounted<WebEditCommandProxy> {
+class WebEditCommandProxy : public APIObject {
 public:
     static PassRefPtr<WebEditCommandProxy> create(uint64_t commandID, WebCore::EditAction editAction, WebPageProxy* page)
     {
@@ -53,6 +54,8 @@ public:
 private:
     WebEditCommandProxy(uint64_t commandID, WebCore::EditAction, WebPageProxy*);
 
+    virtual Type type() const { return TypeEditCommandProxy; }
+
     uint64_t m_commandID;
     WebCore::EditAction m_editAction;
     WebPageProxy* m_page;
diff --git a/Source/WebKit2/UIProcess/WebFullScreenManagerProxy.cpp b/Source/WebKit2/UIProcess/WebFullScreenManagerProxy.cpp
new file mode 100644
index 0000000..91daf10
--- /dev/null
+++ b/Source/WebKit2/UIProcess/WebFullScreenManagerProxy.cpp
@@ -0,0 +1,113 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WebFullScreenManagerProxy.h"
+
+#if ENABLE(FULLSCREEN_API)
+
+#include "WebContext.h"
+#include "WebFullScreenManagerMessages.h"
+#include "WebFullScreenManagerProxyMessages.h"
+#include "WebProcess.h"
+
+namespace WebKit {
+
+PassRefPtr<WebFullScreenManagerProxy> WebFullScreenManagerProxy::create(WebPageProxy* page)
+{
+    return adoptRef(new WebFullScreenManagerProxy(page));
+}
+
+WebFullScreenManagerProxy::WebFullScreenManagerProxy(WebPageProxy* page)
+    : m_page(page)
+    , m_webView(0)
+{
+}
+
+WebFullScreenManagerProxy::~WebFullScreenManagerProxy()
+{
+}
+
+void WebFullScreenManagerProxy::invalidate()
+{
+    m_webView = 0;
+}
+
+void WebFullScreenManagerProxy::setWebView(PlatformWebView* webView)
+{
+    m_webView = webView;
+}
+
+void WebFullScreenManagerProxy::didReceiveMessage(CoreIPC::Connection* connection, CoreIPC::MessageID messageID, CoreIPC::ArgumentDecoder* arguments)
+{
+    didReceiveWebFullScreenManagerProxyMessage(connection, messageID, arguments);
+}
+
+CoreIPC::SyncReplyMode WebFullScreenManagerProxy::didReceiveSyncMessage(CoreIPC::Connection* connection, CoreIPC::MessageID messageID, CoreIPC::ArgumentDecoder* arguments, CoreIPC::ArgumentEncoder* reply)
+{
+    return didReceiveSyncWebFullScreenManagerProxyMessage(connection, messageID, arguments, reply);
+}
+
+void WebFullScreenManagerProxy::willEnterFullScreen()
+{
+    m_page->process()->send(Messages::WebFullScreenManager::WillEnterFullScreen(), m_page->pageID());
+}
+
+void WebFullScreenManagerProxy::didEnterFullScreen()
+{
+    m_page->process()->send(Messages::WebFullScreenManager::DidEnterFullScreen(), m_page->pageID());
+}
+
+void WebFullScreenManagerProxy::willExitFullScreen()
+{
+    m_page->process()->send(Messages::WebFullScreenManager::WillExitFullScreen(), m_page->pageID());
+}
+
+void WebFullScreenManagerProxy::didExitFullScreen()
+{
+    m_page->process()->send(Messages::WebFullScreenManager::DidExitFullScreen(), m_page->pageID());
+}
+
+void WebFullScreenManagerProxy::beginEnterFullScreenAnimation(float duration)
+{
+    m_page->process()->send(Messages::WebFullScreenManager::BeginEnterFullScreenAnimation(duration), m_page->pageID());
+}
+
+void WebFullScreenManagerProxy::beginExitFullScreenAnimation(float duration)
+{
+    m_page->process()->send(Messages::WebFullScreenManager::BeginExitFullScreenAnimation(duration), m_page->pageID());
+}
+
+void WebFullScreenManagerProxy::supportsFullScreen(bool withKeyboard, bool& supports)
+{
+    if (withKeyboard)
+        supports = false;
+    else
+        supports = true;
+}
+
+} // namespace WebKit
+
+#endif // ENABLE(FULLSCREEN_API)
diff --git a/Source/WebKit2/UIProcess/WebFullScreenManagerProxy.h b/Source/WebKit2/UIProcess/WebFullScreenManagerProxy.h
new file mode 100644
index 0000000..1f3dca6
--- /dev/null
+++ b/Source/WebKit2/UIProcess/WebFullScreenManagerProxy.h
@@ -0,0 +1,110 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebFullScreenManagerProxy_h
+#define WebFullScreenManagerProxy_h
+
+#if ENABLE(FULLSCREEN_API)
+
+#include "Connection.h"
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefPtr.h>
+
+namespace CoreIPC {
+class ArgumentDecoder;
+class Connection;
+class MessageID;
+}
+
+namespace WebCore {
+class IntRect;
+}
+
+#if PLATFORM(MAC)
+OBJC_CLASS WKView;
+#endif
+
+namespace WebKit {
+    
+#if PLATFORM(MAC)
+typedef WKView PlatformWebView;
+#elif PLATFORM(WIN)
+class WebView;
+typedef WebView PlatformWebView;
+#elif PLATFORM(QT)
+typedef QGraphicsWKView PlatformWebView;
+#elif PLATFORM(GTK)
+class WebView;
+typedef WebView PlatformWebView;
+#endif
+
+class WebPageProxy;
+class LayerTreeContext;
+
+class WebFullScreenManagerProxy : public RefCounted<WebFullScreenManagerProxy> {
+public:
+    static PassRefPtr<WebFullScreenManagerProxy> create(WebPageProxy*);
+    virtual ~WebFullScreenManagerProxy();
+
+    void invalidate();
+
+    void setWebView(PlatformWebView*);
+
+    void didReceiveMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::ArgumentDecoder*);
+    CoreIPC::SyncReplyMode didReceiveSyncMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::ArgumentDecoder* arguments, CoreIPC::ArgumentEncoder* reply);
+
+    void willEnterFullScreen();
+    void didEnterFullScreen();
+    void willExitFullScreen();
+    void didExitFullScreen();
+    void beginEnterFullScreenAnimation(float duration);
+    void beginExitFullScreenAnimation(float duration);
+
+private:
+    WebFullScreenManagerProxy(WebPageProxy*);
+
+    void supportsFullScreen(bool withKeyboard, bool&);
+    void enterFullScreen();
+    void exitFullScreen();
+    void beganEnterFullScreenAnimation();
+    void finishedEnterFullScreenAnimation(bool completed);
+    void beganExitFullScreenAnimation();
+    void finishedExitFullScreenAnimation(bool completed);
+    void enterAcceleratedCompositingMode(const LayerTreeContext&);
+    void exitAcceleratedCompositingMode();
+    void getFullScreenRect(WebCore::IntRect&);
+
+    WebPageProxy* m_page;
+    PlatformWebView* m_webView;
+
+    void didReceiveWebFullScreenManagerProxyMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::ArgumentDecoder*);
+    CoreIPC::SyncReplyMode didReceiveSyncWebFullScreenManagerProxyMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::ArgumentDecoder* arguments, CoreIPC::ArgumentEncoder* reply);
+};
+
+} // namespace WebKit
+
+#endif // ENABLE(FULLSCREEN_API)
+
+#endif // WebFullScreenManagerProxy_h
diff --git a/Source/WebKit2/UIProcess/WebFullScreenManagerProxy.messages.in b/Source/WebKit2/UIProcess/WebFullScreenManagerProxy.messages.in
new file mode 100644
index 0000000..007e309
--- /dev/null
+++ b/Source/WebKit2/UIProcess/WebFullScreenManagerProxy.messages.in
@@ -0,0 +1,38 @@
+# Copyright (C) 2011 Apple Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+# 1.  Redistributions of source code must retain the above copyright
+#     notice, this list of conditions and the following disclaimer.
+# 2.  Redistributions in binary form must reproduce the above copyright
+#     notice, this list of conditions and the following disclaimer in the
+#     documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND
+# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+# WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+# DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR
+# ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+# SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+# OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+#if ENABLE(FULLSCREEN_API)
+messages -> WebFullScreenManagerProxy {
+    SupportsFullScreen(bool withKeyboard) -> (bool supportsFullScreen)
+    EnterFullScreen()
+    ExitFullScreen()
+    BeganEnterFullScreenAnimation()
+    FinishedEnterFullScreenAnimation(bool completed)
+    BeganExitFullScreenAnimation()
+    FinishedExitFullScreenAnimation(bool completed)
+    GetFullScreenRect() -> (WebCore::IntRect rect)
+#if USE(ACCELERATED_COMPOSITING)
+    EnterAcceleratedCompositingMode(WebKit::LayerTreeContext context)
+    ExitAcceleratedCompositingMode()
+#endif
+}
+#endif
diff --git a/Source/WebKit2/UIProcess/WebIconDatabase.cpp b/Source/WebKit2/UIProcess/WebIconDatabase.cpp
new file mode 100644
index 0000000..c397a1d
--- /dev/null
+++ b/Source/WebKit2/UIProcess/WebIconDatabase.cpp
@@ -0,0 +1,255 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WebIconDatabase.h"
+
+#include "DataReference.h"
+#include "Logging.h"
+#include "WebContext.h"
+#include "WebIconDatabaseProxyMessages.h"
+#include <WebCore/FileSystem.h>
+#include <WebCore/IconDatabase.h>
+#include <WebCore/IconDatabaseBase.h>
+#include <wtf/text/WTFString.h>
+
+using namespace WebCore;
+
+namespace WebKit {
+
+PassRefPtr<WebIconDatabase> WebIconDatabase::create(WebContext* context)
+{
+    return adoptRef(new WebIconDatabase(context));
+}
+
+WebIconDatabase::~WebIconDatabase()
+{
+}
+
+WebIconDatabase::WebIconDatabase(WebContext* context)
+    : m_webContext(context)
+    , m_urlImportCompleted(false)
+    , m_databaseCleanupDisabled(false)
+{
+}
+
+void WebIconDatabase::invalidate()
+{
+}
+
+void WebIconDatabase::setDatabasePath(const String& path)
+{
+    if (m_iconDatabaseImpl && m_iconDatabaseImpl->isOpen()) {
+        LOG_ERROR("Icon database already has a path and is already open. We don't currently support changing its path and reopening.");
+        return;
+    }
+
+    m_iconDatabaseImpl =  IconDatabase::create();
+    m_iconDatabaseImpl->setClient(this);
+    IconDatabase::delayDatabaseCleanup();
+    m_databaseCleanupDisabled = true;
+    m_iconDatabaseImpl->setEnabled(true);
+    if (!m_iconDatabaseImpl->open(directoryName(path), pathGetFileName(path))) {
+        LOG_ERROR("Unable to open WebKit2 icon database on disk");
+        m_iconDatabaseImpl.clear();
+        setGlobalIconDatabase(0);
+        IconDatabase::allowDatabaseCleanup();
+        m_databaseCleanupDisabled = false;
+    }
+    setGlobalIconDatabase(m_iconDatabaseImpl.get());
+}
+
+void WebIconDatabase::enableDatabaseCleanup()
+{
+    if (!m_iconDatabaseImpl) {
+        LOG_ERROR("Cannot enabled Icon Database cleanup - it hasn't been opened yet.");
+        return;
+    }
+
+    if (!m_databaseCleanupDisabled) {
+        LOG_ERROR("Attempt to enable database cleanup, but it's already enabled.");
+        ASSERT_NOT_REACHED();
+        return;
+    }
+    
+    IconDatabase::allowDatabaseCleanup();
+    m_databaseCleanupDisabled = false;
+}
+
+void WebIconDatabase::retainIconForPageURL(const String& pageURL)
+{
+    LOG(IconDatabase, "WK2 UIProcess retaining icon for page URL %s", pageURL.ascii().data());
+    if (m_iconDatabaseImpl)
+        m_iconDatabaseImpl->retainIconForPageURL(pageURL);
+}
+
+void WebIconDatabase::releaseIconForPageURL(const String& pageURL)
+{
+    LOG(IconDatabase, "WK2 UIProcess releasing icon for page URL %s", pageURL.ascii().data());
+    if (m_iconDatabaseImpl)
+        m_iconDatabaseImpl->releaseIconForPageURL(pageURL);
+}
+
+void WebIconDatabase::setIconURLForPageURL(const String& iconURL, const String& pageURL)
+{
+    LOG(IconDatabase, "WK2 UIProcess setting icon URL %s for page URL %s", iconURL.ascii().data(), pageURL.ascii().data());
+    if (m_iconDatabaseImpl)
+        m_iconDatabaseImpl->setIconURLForPageURL(iconURL, pageURL);
+}
+
+void WebIconDatabase::setIconDataForIconURL(const CoreIPC::DataReference& iconData, const String& iconURL)
+{
+    LOG(IconDatabase, "WK2 UIProcess setting icon data (%i bytes) for page URL %s", (int)iconData.size(), iconURL.ascii().data());
+    if (!m_iconDatabaseImpl)
+        return;
+
+    RefPtr<SharedBuffer> buffer = SharedBuffer::create(iconData.data(), iconData.size());
+    m_iconDatabaseImpl->setIconDataForIconURL(buffer.release(), iconURL);
+}
+
+void WebIconDatabase::synchronousIconDataForPageURL(const String&, CoreIPC::DataReference& iconData)
+{
+    iconData = CoreIPC::DataReference();
+}
+
+void WebIconDatabase::synchronousIconURLForPageURL(const String&, String& iconURL)
+{
+    iconURL = String();
+}
+
+void WebIconDatabase::synchronousIconDataKnownForIconURL(const String&, bool& iconDataKnown) const
+{
+    iconDataKnown = false;
+}
+
+void WebIconDatabase::synchronousLoadDecisionForIconURL(const String&, int& loadDecision) const
+{
+    loadDecision = static_cast<int>(IconLoadNo);
+}
+
+void WebIconDatabase::getLoadDecisionForIconURL(const String& iconURL, uint64_t callbackID)
+{
+    LOG(IconDatabase, "WK2 UIProcess getting load decision for icon URL %s with callback ID %lli", iconURL.ascii().data(), static_cast<long long>(callbackID));
+
+    if (!m_webContext)
+        return;
+
+    if (!m_iconDatabaseImpl || !m_iconDatabaseImpl->isOpen() || iconURL.isEmpty()) {
+        m_webContext->process()->send(Messages::WebIconDatabaseProxy::ReceivedIconLoadDecision(static_cast<int>(IconLoadNo), callbackID), 0);
+        return;
+    }
+    
+    // If the decision hasn't been read from disk yet, set this url and callback ID aside to be notifed later
+    IconLoadDecision decision = m_iconDatabaseImpl->synchronousLoadDecisionForIconURL(iconURL, 0);
+    if (decision == IconLoadUnknown) {
+        // We should never get an unknown load decision after the URL import has completed.
+        ASSERT(!m_urlImportCompleted);
+        
+        m_pendingLoadDecisionURLMap.set(callbackID, iconURL);
+        return;    
+    }
+    
+    m_webContext->process()->send(Messages::WebIconDatabaseProxy::ReceivedIconLoadDecision((int)decision, callbackID), 0);
+}
+
+Image* WebIconDatabase::imageForPageURL(const String& pageURL)
+{
+    if (!m_webContext)
+        return 0;
+
+    if (!m_iconDatabaseImpl || !m_iconDatabaseImpl->isOpen() || pageURL.isEmpty())
+        return 0;
+
+    // The WebCore IconDatabase ignores the passed in size parameter.
+    // If that changes we'll need to rethink how this API is exposed.
+    return m_iconDatabaseImpl->synchronousIconForPageURL(pageURL, WebCore::IntSize(32, 32));
+}
+
+
+// WebCore::IconDatabaseClient
+bool WebIconDatabase::performImport()
+{
+    // WebKit2 icon database doesn't currently support importing any old icon database formats.
+    return true;
+}
+
+void WebIconDatabase::didImportIconURLForPageURL(const String&)
+{
+    // Send a WK2 client notification out here.
+}
+
+void WebIconDatabase::didImportIconDataForPageURL(const String&)
+{
+    // Send a WK2 client notification out here.
+}
+
+void WebIconDatabase::didChangeIconForPageURL(const String&)
+{
+    // Send a WK2 client notification out here.
+}
+
+void WebIconDatabase::didRemoveAllIcons()
+{
+    // Send a WK2 client notification out here.
+}
+
+void WebIconDatabase::didFinishURLImport()
+{
+    if (!m_webContext)
+        return;
+    
+    ASSERT(!m_urlImportCompleted);
+
+    LOG(IconDatabase, "WK2 UIProcess URL import complete, notifying all %i pending page URL load decisions", m_pendingLoadDecisionURLMap.size());
+
+    HashMap<uint64_t, String>::iterator i = m_pendingLoadDecisionURLMap.begin();
+    HashMap<uint64_t, String>::iterator end = m_pendingLoadDecisionURLMap.end();
+    
+    for (; i != end; ++i) {
+        LOG(IconDatabase, "WK2 UIProcess performing delayed callback on callback ID %i for page url %s", (int)i->first, i->second.ascii().data());
+        IconLoadDecision decision = m_iconDatabaseImpl->synchronousLoadDecisionForIconURL(i->second, 0);
+
+        // Decisions should never be unknown after the inital import is complete
+        ASSERT(decision != IconLoadUnknown);
+
+        m_webContext->process()->send(Messages::WebIconDatabaseProxy::ReceivedIconLoadDecision(static_cast<int>(decision), i->first), 0);
+    }
+    
+    m_pendingLoadDecisionURLMap.clear();
+    
+    m_urlImportCompleted = true;
+}
+
+void WebIconDatabase::didReceiveMessage(CoreIPC::Connection* connection, CoreIPC::MessageID messageID, CoreIPC::ArgumentDecoder* decoder)
+{
+    didReceiveWebIconDatabaseMessage(connection, messageID, decoder);
+}
+
+CoreIPC::SyncReplyMode WebIconDatabase::didReceiveSyncMessage(CoreIPC::Connection* connection, CoreIPC::MessageID messageID, CoreIPC::ArgumentDecoder* decoder, CoreIPC::ArgumentEncoder* reply)
+{
+    return didReceiveSyncWebIconDatabaseMessage(connection, messageID, decoder, reply);
+}
+
+} // namespace WebKit
diff --git a/Source/WebKit2/UIProcess/WebIconDatabase.h b/Source/WebKit2/UIProcess/WebIconDatabase.h
new file mode 100644
index 0000000..802f2aa
--- /dev/null
+++ b/Source/WebKit2/UIProcess/WebIconDatabase.h
@@ -0,0 +1,110 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebIconDatabase_h
+#define WebIconDatabase_h
+
+#include "APIObject.h"
+
+#include "Connection.h"
+#include <WebCore/IconDatabaseClient.h>
+#include <wtf/Forward.h>
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefPtr.h>
+#include <wtf/Vector.h>
+#include <wtf/text/StringHash.h>
+
+namespace CoreIPC {
+class ArgumentDecoder;
+class DataReference;
+class MessageID;
+}
+
+namespace WebCore {
+class IconDatabase;
+class Image;
+}
+
+namespace WebKit {
+
+class WebContext;
+
+class WebIconDatabase : public APIObject, public WebCore::IconDatabaseClient {
+public:
+    static const Type APIType = TypeIconDatabase;
+
+    static PassRefPtr<WebIconDatabase> create(WebContext*);
+    virtual ~WebIconDatabase();
+
+    void invalidate();
+    void clearContext() { m_webContext = 0; }
+    void setDatabasePath(const String&);
+    void enableDatabaseCleanup();
+
+    void retainIconForPageURL(const String&);
+    void releaseIconForPageURL(const String&);
+    void setIconURLForPageURL(const String&, const String&);
+    void setIconDataForIconURL(const CoreIPC::DataReference&, const String&);
+    
+    void synchronousIconDataForPageURL(const String&, CoreIPC::DataReference&);
+    void synchronousIconURLForPageURL(const String&, String&);
+    void synchronousIconDataKnownForIconURL(const String&, bool&) const;
+    void synchronousLoadDecisionForIconURL(const String&, int&) const;
+    
+    void getLoadDecisionForIconURL(const String&, uint64_t callbackID);
+
+    WebCore::Image* imageForPageURL(const String&);
+    
+    // WebCore::IconDatabaseClient
+    virtual bool performImport();
+    virtual void didImportIconURLForPageURL(const String&);
+    virtual void didImportIconDataForPageURL(const String&);
+    virtual void didChangeIconForPageURL(const String&);
+    virtual void didRemoveAllIcons();
+    virtual void didFinishURLImport();
+    
+    void didReceiveMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::ArgumentDecoder*);
+    CoreIPC::SyncReplyMode didReceiveSyncMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::ArgumentDecoder*, CoreIPC::ArgumentEncoder*);
+
+private:
+    WebIconDatabase(WebContext*);
+
+    virtual Type type() const { return APIType; }
+
+    void didReceiveWebIconDatabaseMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::ArgumentDecoder*);
+    CoreIPC::SyncReplyMode didReceiveSyncWebIconDatabaseMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::ArgumentDecoder*, CoreIPC::ArgumentEncoder*);
+
+    WebContext* m_webContext;
+    
+    OwnPtr<WebCore::IconDatabase> m_iconDatabaseImpl;
+    bool m_urlImportCompleted;
+    bool m_databaseCleanupDisabled;
+    HashMap<uint64_t, String> m_pendingLoadDecisionURLMap;
+
+};
+
+} // namespace WebKit
+
+#endif // WebIconDatabase_h
diff --git a/Source/WebKit2/UIProcess/WebIconDatabase.messages.in b/Source/WebKit2/UIProcess/WebIconDatabase.messages.in
new file mode 100644
index 0000000..b68a0a7
--- /dev/null
+++ b/Source/WebKit2/UIProcess/WebIconDatabase.messages.in
@@ -0,0 +1,35 @@
+# Copyright (C) 2011 Apple Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+# 1.  Redistributions of source code must retain the above copyright
+#     notice, this list of conditions and the following disclaimer.
+# 2.  Redistributions in binary form must reproduce the above copyright
+#     notice, this list of conditions and the following disclaimer in the
+#     documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND
+# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+# WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+# DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR
+# ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+# SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+# OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+messages -> WebIconDatabase {
+    RetainIconForPageURL(WTF::String pageURL)
+    ReleaseIconForPageURL(WTF::String pageURL)
+    SetIconURLForPageURL(WTF::String iconURL, WTF::String pageURL)
+    SetIconDataForIconURL(CoreIPC::DataReference iconData, WTF::String iconURL)
+    
+    SynchronousIconDataForPageURL(WTF::String pageURL) -> (CoreIPC::DataReference iconData)
+    SynchronousIconURLForPageURL(WTF::String pageURL) -> (WTF::String iconURL)
+    SynchronousIconDataKnownForIconURL(WTF::String iconURL) -> (bool dataKnown)
+    SynchronousLoadDecisionForIconURL(WTF::String iconURL) -> (int loadDecision)
+    
+    GetLoadDecisionForIconURL(WTF::String iconURL, uint64_t callbackID)
+}
diff --git a/Source/WebKit2/UIProcess/WebKeyValueStorageManagerProxy.cpp b/Source/WebKit2/UIProcess/WebKeyValueStorageManagerProxy.cpp
index dafa613..1de1532 100644
--- a/Source/WebKit2/UIProcess/WebKeyValueStorageManagerProxy.cpp
+++ b/Source/WebKit2/UIProcess/WebKeyValueStorageManagerProxy.cpp
@@ -52,6 +52,11 @@ void WebKeyValueStorageManagerProxy::invalidate()
     invalidateCallbackMap(m_arrayCallbacks);
 }
 
+bool WebKeyValueStorageManagerProxy::shouldTerminate(WebProcessProxy*) const
+{
+    return m_arrayCallbacks.isEmpty();
+}
+
 void WebKeyValueStorageManagerProxy::didReceiveMessage(CoreIPC::Connection* connection, CoreIPC::MessageID messageID, CoreIPC::ArgumentDecoder* arguments)
 {
     didReceiveWebKeyValueStorageManagerProxyMessage(connection, messageID, arguments);
@@ -60,10 +65,7 @@ void WebKeyValueStorageManagerProxy::didReceiveMessage(CoreIPC::Connection* conn
 void WebKeyValueStorageManagerProxy::getKeyValueStorageOrigins(PassRefPtr<ArrayCallback> prpCallback)
 {
     RefPtr<ArrayCallback> callback = prpCallback;
-    if (!m_webContext->hasValidProcess()) {
-        callback->invalidate();
-        return;
-    }
+    m_webContext->relaunchProcessIfNecessary();
     
     uint64_t callbackID = callback->callbackID();
     m_arrayCallbacks.set(callbackID, callback.release());
@@ -78,8 +80,7 @@ void WebKeyValueStorageManagerProxy::didGetKeyValueStorageOrigins(const Vector<S
 
 void WebKeyValueStorageManagerProxy::deleteEntriesForOrigin(WebSecurityOrigin* origin)
 {
-    if (!m_webContext->hasValidProcess())
-        return;
+    m_webContext->relaunchProcessIfNecessary();
     
     SecurityOriginData securityOriginData;
     securityOriginData.protocol = origin->protocol();
@@ -91,9 +92,7 @@ void WebKeyValueStorageManagerProxy::deleteEntriesForOrigin(WebSecurityOrigin* o
 
 void WebKeyValueStorageManagerProxy::deleteAllEntries()
 {
-    if (!m_webContext->hasValidProcess())
-        return;
-
+    m_webContext->relaunchProcessIfNecessary();
     m_webContext->process()->send(Messages::WebKeyValueStorageManager::DeleteAllEntries(), 0);
 }
 
diff --git a/Source/WebKit2/UIProcess/WebKeyValueStorageManagerProxy.h b/Source/WebKit2/UIProcess/WebKeyValueStorageManagerProxy.h
index 1c5ea3a..79cb03e 100644
--- a/Source/WebKit2/UIProcess/WebKeyValueStorageManagerProxy.h
+++ b/Source/WebKit2/UIProcess/WebKeyValueStorageManagerProxy.h
@@ -44,6 +44,7 @@ namespace WebKit {
 
 struct SecurityOriginData;
 class WebContext;
+class WebProcessProxy;
 class WebSecurityOrigin;
 
 typedef GenericCallback<WKArrayRef> ArrayCallback;
@@ -64,6 +65,8 @@ public:
 
     void didReceiveMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::ArgumentDecoder*);
 
+    bool shouldTerminate(WebProcessProxy*) const;
+
 private:
     WebKeyValueStorageManagerProxy(WebContext*);
 
diff --git a/Source/WebKit2/UIProcess/WebMediaCacheManagerProxy.cpp b/Source/WebKit2/UIProcess/WebMediaCacheManagerProxy.cpp
new file mode 100644
index 0000000..c8a7f51
--- /dev/null
+++ b/Source/WebKit2/UIProcess/WebMediaCacheManagerProxy.cpp
@@ -0,0 +1,103 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WebMediaCacheManagerProxy.h"
+
+#include "WebContext.h"
+#include "WebMediaCacheManagerMessages.h"
+#include "WebSecurityOrigin.h"
+
+namespace WebKit {
+
+PassRefPtr<WebMediaCacheManagerProxy> WebMediaCacheManagerProxy::create(WebContext* context)
+{
+    return adoptRef(new WebMediaCacheManagerProxy(context));
+}
+
+WebMediaCacheManagerProxy::WebMediaCacheManagerProxy(WebContext* context)
+    : m_webContext(context)
+{
+}
+
+WebMediaCacheManagerProxy::~WebMediaCacheManagerProxy()
+{
+}
+
+void WebMediaCacheManagerProxy::invalidate()
+{
+    invalidateCallbackMap(m_arrayCallbacks);
+}
+
+bool WebMediaCacheManagerProxy::shouldTerminate(WebProcessProxy*) const
+{
+    return m_arrayCallbacks.isEmpty();
+}
+
+void WebMediaCacheManagerProxy::didReceiveMessage(CoreIPC::Connection* connection, CoreIPC::MessageID messageID, CoreIPC::ArgumentDecoder* arguments)
+{
+    didReceiveWebMediaCacheManagerProxyMessage(connection, messageID, arguments);
+}
+
+void WebMediaCacheManagerProxy::getHostnamesWithMediaCache(PassRefPtr<ArrayCallback> prpCallback)
+{
+    RefPtr<ArrayCallback> callback = prpCallback;
+    m_webContext->relaunchProcessIfNecessary();
+    
+    uint64_t callbackID = callback->callbackID();
+    m_arrayCallbacks.set(callbackID, callback.release());
+    m_webContext->process()->send(Messages::WebMediaCacheManager::GetHostnamesWithMediaCache(callbackID), 0);
+}
+    
+void WebMediaCacheManagerProxy::didGetHostnamesWithMediaCache(const Vector<String>& hostnameList, uint64_t callbackID)
+{
+    RefPtr<ArrayCallback> callback = m_arrayCallbacks.take(callbackID);
+    if (!callback) {
+        // FIXME: Log error or assert.
+        return;
+    }
+
+    size_t hostnameCount = hostnameList.size();
+    Vector<RefPtr<APIObject> > hostnames(hostnameCount);
+
+    for (size_t i = 0; i < hostnameCount; ++i)
+        hostnames[i] = WebString::create(hostnameList[i]);
+
+    callback->performCallbackWithReturnValue(ImmutableArray::adopt(hostnames).get());
+}
+
+void WebMediaCacheManagerProxy::clearCacheForHostname(const String& hostname)
+{
+    m_webContext->relaunchProcessIfNecessary();
+    m_webContext->process()->send(Messages::WebMediaCacheManager::ClearCacheForHostname(hostname), 0);
+}
+
+void WebMediaCacheManagerProxy::clearCacheForAllHostnames()
+{
+    m_webContext->relaunchProcessIfNecessary();
+    m_webContext->process()->send(Messages::WebMediaCacheManager::ClearCacheForAllHostnames(), 0);
+}
+
+} // namespace WebKit
diff --git a/Source/WebKit2/UIProcess/WebMediaCacheManagerProxy.h b/Source/WebKit2/UIProcess/WebMediaCacheManagerProxy.h
new file mode 100644
index 0000000..43231e5
--- /dev/null
+++ b/Source/WebKit2/UIProcess/WebMediaCacheManagerProxy.h
@@ -0,0 +1,83 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebMediaCacheManagerProxy_h
+#define WebMediaCacheManagerProxy_h
+
+#include "APIObject.h"
+#include "GenericCallback.h"
+#include "ImmutableArray.h"
+
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefPtr.h>
+#include <wtf/Vector.h>
+
+namespace CoreIPC {
+    class ArgumentDecoder;
+    class Connection;
+    class MessageID;
+}
+
+namespace WebKit {
+
+class WebContext;
+class WebProcessProxy;
+
+typedef GenericCallback<WKArrayRef> ArrayCallback;
+
+class WebMediaCacheManagerProxy : public APIObject {
+public:
+    static const Type APIType = TypeMediaCacheManager;
+
+    static PassRefPtr<WebMediaCacheManagerProxy> create(WebContext*);
+    virtual ~WebMediaCacheManagerProxy();
+
+    void invalidate();
+    void clearContext() { m_webContext = 0; }
+    
+    void getHostnamesWithMediaCache(PassRefPtr<ArrayCallback>);
+    void clearCacheForHostname(const String&);
+    void clearCacheForAllHostnames();
+
+    void didReceiveMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::ArgumentDecoder*);
+
+    bool shouldTerminate(WebProcessProxy*) const;
+
+private:
+    WebMediaCacheManagerProxy(WebContext*);
+
+    virtual Type type() const { return APIType; }
+
+    void didGetHostnamesWithMediaCache(const Vector<String>&, uint64_t callbackID);
+    
+    void didReceiveWebMediaCacheManagerProxyMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::ArgumentDecoder*);
+
+    WebContext* m_webContext;
+    HashMap<uint64_t, RefPtr<ArrayCallback> > m_arrayCallbacks;
+};
+
+} // namespace WebKit
+
+#endif // WebMediaCacheManagerProxy_h
diff --git a/Source/WebKit2/UIProcess/WebMediaCacheManagerProxy.messages.in b/Source/WebKit2/UIProcess/WebMediaCacheManagerProxy.messages.in
new file mode 100644
index 0000000..7929064
--- /dev/null
+++ b/Source/WebKit2/UIProcess/WebMediaCacheManagerProxy.messages.in
@@ -0,0 +1,25 @@
+# Copyright (C) 2011 Apple Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+# 1.  Redistributions of source code must retain the above copyright
+#     notice, this list of conditions and the following disclaimer.
+# 2.  Redistributions in binary form must reproduce the above copyright
+#     notice, this list of conditions and the following disclaimer in the
+#     documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND
+# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+# WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+# DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR
+# ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+# SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+# OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+messages -> WebMediaCacheManagerProxy {
+    DidGetHostnamesWithMediaCache(Vector<WTF::String> hostnames, uint64_t callbackID);
+}
diff --git a/Source/WebKit2/UIProcess/WebPageProxy.cpp b/Source/WebKit2/UIProcess/WebPageProxy.cpp
index 3813a39..ce3af46 100644
--- a/Source/WebKit2/UIProcess/WebPageProxy.cpp
+++ b/Source/WebKit2/UIProcess/WebPageProxy.cpp
@@ -52,6 +52,8 @@
 #include "WebEvent.h"
 #include "WebFormSubmissionListenerProxy.h"
 #include "WebFramePolicyListenerProxy.h"
+#include "WebFullScreenManagerProxy.h"
+#include "WebInspectorProxy.h"
 #include "WebOpenPanelResultListenerProxy.h"
 #include "WebPageCreationParameters.h"
 #include "WebPageGroup.h"
@@ -71,10 +73,6 @@
 #include <WebCore/WindowFeatures.h>
 #include <stdio.h>
 
-#if PLATFORM(MAC)
-#include "DictionaryPopupInfo.h"
-#endif
-
 #if PLATFORM(WIN)
 #include "WebDragSource.h"
 #include <WebCore/BitmapInfo.h>
@@ -220,6 +218,9 @@ void WebPageProxy::initializeResourceLoadClient(const WKPageResourceLoadClient*
 
 void WebPageProxy::initializeUIClient(const WKPageUIClient* client)
 {
+    if (!isValid())
+        return;
+
     m_uiClient.initialize(client);
 
     process()->send(Messages::WebPage::SetCanRunBeforeUnloadConfirmPanel(m_uiClient.canRunBeforeUnloadConfirmPanel()), m_pageID);
@@ -297,6 +298,13 @@ void WebPageProxy::close()
     }
 #endif
 
+#if ENABLE(FULLSCREEN_API)
+    if (m_fullScreenManager) {
+        m_fullScreenManager->invalidate();
+        m_fullScreenManager = 0;
+    }
+#endif
+
     if (m_openPanelResultListener) {
         m_openPanelResultListener->invalidate();
         m_openPanelResultListener = 0;
@@ -315,6 +323,7 @@ void WebPageProxy::close()
     invalidateCallbackMap(m_voidCallbacks);
     invalidateCallbackMap(m_dataCallbacks);
     invalidateCallbackMap(m_stringCallbacks);
+    m_loadDependentStringCallbackIDs.clear();
     invalidateCallbackMap(m_scriptValueCallbacks);
     invalidateCallbackMap(m_computedPagesCallbacks);
 
@@ -386,26 +395,27 @@ void WebPageProxy::loadURLRequest(WebURLRequest* urlRequest)
 void WebPageProxy::loadHTMLString(const String& htmlString, const String& baseURL)
 {
     if (!isValid())
-        return;
+        reattachToWebProcess();
+
     process()->send(Messages::WebPage::LoadHTMLString(htmlString, baseURL), m_pageID);
 }
 
 void WebPageProxy::loadAlternateHTMLString(const String& htmlString, const String& baseURL, const String& unreachableURL)
 {
     if (!isValid())
-        return;
+        reattachToWebProcess();
 
-    if (!m_mainFrame)
-        return;
+    if (m_mainFrame)
+        m_mainFrame->setUnreachableURL(unreachableURL);
 
-    m_mainFrame->setUnreachableURL(unreachableURL);
     process()->send(Messages::WebPage::LoadAlternateHTMLString(htmlString, baseURL, unreachableURL), m_pageID);
 }
 
 void WebPageProxy::loadPlainTextString(const String& string)
 {
     if (!isValid())
-        return;
+        reattachToWebProcess();
+
     process()->send(Messages::WebPage::LoadPlainTextString(string), m_pageID);
 }
 
@@ -509,7 +519,10 @@ bool WebPageProxy::canShowMIMEType(const String& mimeType) const
 
     if (MIMETypeRegistry::isSupportedImageMIMEType(mimeType))
         return true;
-    
+
+    if (mimeType.startsWith("text/", false))
+        return !MIMETypeRegistry::isUnsupportedTextMIMEType(mimeType);
+
     String newMimeType = mimeType;
     PluginInfoStore::Plugin plugin = context()->pluginInfoStore()->findPlugin(newMimeType, KURL());
     if (!plugin.path.isNull())
@@ -542,11 +555,15 @@ void WebPageProxy::setDrawsTransparentBackground(bool drawsTransparentBackground
 
 void WebPageProxy::viewWillStartLiveResize()
 {
+    if (!isValid())
+        return;
     process()->send(Messages::WebPage::ViewWillStartLiveResize(), m_pageID);
 }
 
 void WebPageProxy::viewWillEndLiveResize()
 {
+    if (!isValid())
+        return;
     process()->send(Messages::WebPage::ViewWillEndLiveResize(), m_pageID);
 }
 
@@ -633,49 +650,7 @@ void WebPageProxy::executeEditCommand(const String& commandName)
     process()->send(Messages::WebPage::ExecuteEditCommand(commandName), m_pageID);
 }
     
-#if PLATFORM(MAC)
-void WebPageProxy::updateWindowIsVisible(bool windowIsVisible)
-{
-    if (!isValid())
-        return;
-    process()->send(Messages::WebPage::SetWindowIsVisible(windowIsVisible), m_pageID);
-}
-
-void WebPageProxy::windowAndViewFramesChanged(const IntRect& windowFrameInScreenCoordinates, const IntRect& viewFrameInWindowCoordinates, const IntPoint& accessibilityViewCoordinates)
-{
-    if (!isValid())
-        return;
-
-    process()->send(Messages::WebPage::WindowAndViewFramesChanged(windowFrameInScreenCoordinates, viewFrameInWindowCoordinates, accessibilityViewCoordinates), m_pageID);
-}
-
-void WebPageProxy::getMarkedRange(uint64_t& location, uint64_t& length)
-{
-    process()->sendSync(Messages::WebPage::GetMarkedRange(), Messages::WebPage::GetMarkedRange::Reply(location, length), m_pageID);
-}
-    
-uint64_t WebPageProxy::characterIndexForPoint(const IntPoint point)
-{
-    uint64_t result;
-    process()->sendSync(Messages::WebPage::CharacterIndexForPoint(point), Messages::WebPage::CharacterIndexForPoint::Reply(result), m_pageID);
-    return result;
-}
-
-WebCore::IntRect WebPageProxy::firstRectForCharacterRange(uint64_t location, uint64_t length)
-{
-    IntRect resultRect;
-    process()->sendSync(Messages::WebPage::FirstRectForCharacterRange(location, length), Messages::WebPage::FirstRectForCharacterRange::Reply(resultRect), m_pageID);
-    return resultRect;
-}
-    
-bool WebPageProxy::writeSelectionToPasteboard(const String& pasteboardName, const Vector<String>& pasteboardTypes)
-{
-    bool result;
-    const double MessageTimeout = 20;
-    process()->sendSync(Messages::WebPage::WriteSelectionToPasteboard(pasteboardName, pasteboardTypes), Messages::WebPage::WriteSelectionToPasteboard::Reply(result), m_pageID, MessageTimeout);
-    return result;
-}
-#elif PLATFORM(WIN)
+#if PLATFORM(WIN)
 WebCore::IntRect WebPageProxy::firstRectForCharacterInSelectedRange(int characterPosition)
 {
     IntRect resultRect;
@@ -719,17 +694,6 @@ void WebPageProxy::didPerformDragControllerAction(uint64_t resultOperation)
     m_currentDragOperation = static_cast<DragOperation>(resultOperation);
 }
 
-#if PLATFORM(MAC)
-void WebPageProxy::setDragImage(const WebCore::IntPoint& clientPosition, const IntSize& imageSize, const SharedMemory::Handle& dragImageHandle, bool isLinkDrag)
-{
-    RefPtr<ShareableBitmap> dragImage = ShareableBitmap::create(imageSize, dragImageHandle);
-    if (!dragImage)
-        return;
-    
-    m_pageClient->setDragImage(clientPosition, imageSize, dragImage.release(), isLinkDrag);
-}
-#endif
-
 #if PLATFORM(WIN)
 
 void WebPageProxy::startDragDrop(const IntPoint& imageOrigin, const IntPoint& dragPoint, uint64_t okEffect, 
@@ -880,6 +844,14 @@ void WebPageProxy::handleTouchEvent(const WebTouchEvent& event)
 }
 #endif
 
+void WebPageProxy::scrollBy(ScrollDirection direction, ScrollGranularity granularity)
+{
+    if (!isValid())
+        return;
+
+    process()->send(Messages::WebPage::ScrollBy(direction, granularity), m_pageID);
+}
+
 void WebPageProxy::receivedPolicyDecision(PolicyAction action, WebFrameProxy* frame, uint64_t listenerID)
 {
     if (!isValid())
@@ -1147,6 +1119,7 @@ void WebPageProxy::getSourceForFrame(WebFrameProxy* frame, PassRefPtr<StringCall
 {
     RefPtr<StringCallback> callback = prpCallback;
     uint64_t callbackID = callback->callbackID();
+    m_loadDependentStringCallbackIDs.add(callbackID);
     m_stringCallbacks.set(callbackID, callback.get());
     process()->send(Messages::WebPage::GetSourceForFrame(frame->frameID(), callbackID), m_pageID);
 }
@@ -1155,6 +1128,7 @@ void WebPageProxy::getContentsAsString(PassRefPtr<StringCallback> prpCallback)
 {
     RefPtr<StringCallback> callback = prpCallback;
     uint64_t callbackID = callback->callbackID();
+    m_loadDependentStringCallbackIDs.add(callbackID);
     m_stringCallbacks.set(callbackID, callback.get());
     process()->send(Messages::WebPage::GetContentsAsString(callbackID), m_pageID);
 }
@@ -1205,16 +1179,6 @@ void WebPageProxy::forceRepaint(PassRefPtr<VoidCallback> prpCallback)
     process()->send(Messages::WebPage::ForceRepaint(callbackID), m_pageID); 
 }
 
-#if PLATFORM(MAC)
-void WebPageProxy::performDictionaryLookupAtLocation(const WebCore::FloatPoint& point)
-{
-    if (!isValid())
-        return;
-
-    process()->send(Messages::WebPage::PerformDictionaryLookupAtLocation(point), m_pageID); 
-}
-#endif
-
 void WebPageProxy::preferencesDidChange()
 {
     if (!isValid())
@@ -1257,6 +1221,13 @@ void WebPageProxy::didReceiveMessage(CoreIPC::Connection* connection, CoreIPC::M
     }
 #endif
 
+#if ENABLE(FULLSCREEN_API)
+    if (messageID.is<CoreIPC::MessageClassWebFullScreenManagerProxy>()) {
+        fullScreenManager()->didReceiveMessage(connection, messageID, arguments);
+        return;
+    }
+#endif
+
     didReceiveWebPageProxyMessage(connection, messageID, arguments);
 }
 
@@ -1270,17 +1241,17 @@ void WebPageProxy::didReceiveSyncMessage(CoreIPC::Connection* connection, CoreIP
     }
 #endif
 
+#if ENABLE(FULLSCREEN_API)
+    if (messageID.is<CoreIPC::MessageClassWebFullScreenManagerProxy>()) {
+        fullScreenManager()->didReceiveSyncMessage(connection, messageID, arguments, reply);
+        return;
+    }
+#endif
+
     // FIXME: Do something with reply.
     didReceiveSyncWebPageProxyMessage(connection, messageID, arguments, reply);
 }
 
-#if PLATFORM(MAC)
-void WebPageProxy::interpretKeyEvent(uint32_t type, Vector<KeypressCommand>& commandsList, uint32_t selectionStart, uint32_t selectionEnd, Vector<CompositionUnderline>& underlines)
-{
-    m_pageClient->interceptKeyEvent(m_keyEventQueue.first(), commandsList, selectionStart, selectionEnd, underlines);
-}
-#endif
-
 void WebPageProxy::didCreateMainFrame(uint64_t frameID)
 {
     MESSAGE_CHECK(!m_mainFrame);
@@ -1382,7 +1353,7 @@ void WebPageProxy::didFinishProgress()
     m_loaderClient.didFinishProgress(this);
 }
 
-void WebPageProxy::didStartProvisionalLoadForFrame(uint64_t frameID, const String& url, bool loadingSubstituteDataForUnreachableURL, CoreIPC::ArgumentDecoder* arguments)
+void WebPageProxy::didStartProvisionalLoadForFrame(uint64_t frameID, const String& url, const String& unreachableURL, CoreIPC::ArgumentDecoder* arguments)
 {
     clearPendingAPIRequestURL();
 
@@ -1394,8 +1365,7 @@ void WebPageProxy::didStartProvisionalLoadForFrame(uint64_t frameID, const Strin
     WebFrameProxy* frame = process()->webFrame(frameID);
     MESSAGE_CHECK(frame);
 
-    if (!loadingSubstituteDataForUnreachableURL)
-        frame->setUnreachableURL(String());
+    frame->setUnreachableURL(unreachableURL);
 
     frame->didStartProvisionalLoad(url);
     m_loaderClient.didStartProvisionalLoadForFrame(this, frame, userData.get());
@@ -1431,6 +1401,19 @@ void WebPageProxy::didFailProvisionalLoadForFrame(uint64_t frameID, const Resour
     m_loaderClient.didFailProvisionalLoadWithErrorForFrame(this, frame, error, userData.get());
 }
 
+void WebPageProxy::clearLoadDependentCallbacks()
+{
+    Vector<uint64_t> callbackIDsCopy;
+    copyToVector(m_loadDependentStringCallbackIDs, callbackIDsCopy);
+    m_loadDependentStringCallbackIDs.clear();
+
+    for (size_t i = 0; i < callbackIDsCopy.size(); ++i) {
+        RefPtr<StringCallback> callback = m_stringCallbacks.take(callbackIDsCopy[i]);
+        if (callback)
+            callback->invalidate();
+    }
+}
+
 void WebPageProxy::didCommitLoadForFrame(uint64_t frameID, const String& mimeType, bool frameHasCustomRepresentation, const PlatformCertificateInfo& certificateInfo, CoreIPC::ArgumentDecoder* arguments)
 {
     RefPtr<APIObject> userData;
@@ -1438,9 +1421,15 @@ void WebPageProxy::didCommitLoadForFrame(uint64_t frameID, const String& mimeTyp
     if (!arguments->decode(messageDecoder))
         return;
 
+#if PLATFORM(MAC) && !defined(BUILDING_ON_SNOW_LEOPARD)
+    dismissCorrectionPanel(ReasonForDismissingCorrectionPanelIgnored);
+#endif
+
     WebFrameProxy* frame = process()->webFrame(frameID);
     MESSAGE_CHECK(frame);
 
+    clearLoadDependentCallbacks();
+
     frame->didCommitLoad(mimeType, certificateInfo);
 
     if (frame->isMainFrame()) {
@@ -1489,6 +1478,8 @@ void WebPageProxy::didFailLoadForFrame(uint64_t frameID, const ResourceError& er
     WebFrameProxy* frame = process()->webFrame(frameID);
     MESSAGE_CHECK(frame);
 
+    clearLoadDependentCallbacks();
+
     frame->didFailLoad();
 
     m_loaderClient.didFailLoadWithErrorForFrame(this, frame, error, userData.get());
@@ -1798,6 +1789,9 @@ void WebPageProxy::runJavaScriptAlert(uint64_t frameID, const String& message)
     WebFrameProxy* frame = process()->webFrame(frameID);
     MESSAGE_CHECK(frame);
 
+    // Since runJavaScriptAlert() can spin a nested run loop we need to turn off the responsiveness timer.
+    process()->responsivenessTimer()->stop();
+
     m_uiClient.runJavaScriptAlert(this, message, frame);
 }
 
@@ -1806,6 +1800,9 @@ void WebPageProxy::runJavaScriptConfirm(uint64_t frameID, const String& message,
     WebFrameProxy* frame = process()->webFrame(frameID);
     MESSAGE_CHECK(frame);
 
+    // Since runJavaScriptConfirm() can spin a nested run loop we need to turn off the responsiveness timer.
+    process()->responsivenessTimer()->stop();
+
     result = m_uiClient.runJavaScriptConfirm(this, message, frame);
 }
 
@@ -1814,6 +1811,9 @@ void WebPageProxy::runJavaScriptPrompt(uint64_t frameID, const String& message,
     WebFrameProxy* frame = process()->webFrame(frameID);
     MESSAGE_CHECK(frame);
 
+    // Since runJavaScriptPrompt() can spin a nested run loop we need to turn off the responsiveness timer.
+    process()->responsivenessTimer()->stop();
+
     result = m_uiClient.runJavaScriptPrompt(this, message, defaultValue, frame);
 }
 
@@ -1889,6 +1889,11 @@ void WebPageProxy::getWindowFrame(FloatRect& newWindowFrame)
     newWindowFrame = m_pageClient->convertToUserSpace(m_uiClient.windowFrame(this));
 }
 
+void WebPageProxy::windowToScreen(const IntRect& viewRect, IntRect& result)
+{
+    result = m_pageClient->windowToScreen(viewRect);
+}
+    
 void WebPageProxy::runBeforeUnloadConfirmPanel(const String& message, uint64_t frameID, bool& shouldClose)
 {
     WebFrameProxy* frame = process()->webFrame(frameID);
@@ -1898,9 +1903,9 @@ void WebPageProxy::runBeforeUnloadConfirmPanel(const String& message, uint64_t f
 }
 
 #if ENABLE(TILED_BACKING_STORE)
-void WebPageProxy::pageDidRequestScroll(const IntSize& delta)
+void WebPageProxy::pageDidRequestScroll(const IntPoint& point)
 {
-    m_pageClient->pageDidRequestScroll(delta);
+    m_pageClient->pageDidRequestScroll(point);
 }
 #endif
 
@@ -1983,6 +1988,15 @@ WebInspectorProxy* WebPageProxy::inspector()
 
 #endif
 
+#if ENABLE(FULLSCREEN_API)
+WebFullScreenManagerProxy* WebPageProxy::fullScreenManager()
+{
+    if (!m_fullScreenManager)
+        m_fullScreenManager = WebFullScreenManagerProxy::create(this);
+    return m_fullScreenManager.get();
+}
+#endif
+
 // BackForwardList
 
 void WebPageProxy::backForwardAddItem(uint64_t itemID)
@@ -2016,17 +2030,6 @@ void WebPageProxy::selectionStateChanged(const SelectionState& selectionState)
     m_selectionState = selectionState;
 }
 
-#if PLATFORM(MAC)
-// Complex text input support for plug-ins.
-void WebPageProxy::sendComplexTextInputToPlugin(uint64_t pluginComplexTextInputIdentifier, const String& textInput)
-{
-    if (!isValid())
-        return;
-    
-    process()->send(Messages::WebPage::SendComplexTextInputToPlugin(pluginComplexTextInputIdentifier, textInput), m_pageID);
-}
-#endif
-
 #if PLATFORM(WIN)
 void WebPageProxy::didChangeCompositionSelection(bool hasComposition)
 {
@@ -2061,7 +2064,7 @@ void WebPageProxy::didCountStringMatches(const String& string, uint32_t matchCou
     m_findClient.didCountStringMatches(this, string, matchCount);
 }
 
-void WebPageProxy::setFindIndicator(const FloatRect& selectionRectInWindowCoordinates, const Vector<FloatRect>& textRectsInSelectionRectCoordinates, const SharedMemory::Handle& contentImageHandle, bool fadeOut)
+void WebPageProxy::setFindIndicator(const FloatRect& selectionRectInWindowCoordinates, const Vector<FloatRect>& textRectsInSelectionRectCoordinates, const ShareableBitmap::Handle& contentImageHandle, bool fadeOut)
 {
     RefPtr<FindIndicator> findIndicator = FindIndicator::create(selectionRectInWindowCoordinates, textRectsInSelectionRectCoordinates, contentImageHandle);
     m_pageClient->setFindIndicator(findIndicator.release(), fadeOut);
@@ -2126,20 +2129,21 @@ void WebPageProxy::showContextMenu(const IntPoint& menuLocation, const ContextMe
 
     m_activeContextMenuState = contextMenuState;
 
-    if (m_activeContextMenu)
+    if (m_activeContextMenu) {
         m_activeContextMenu->hideContextMenu();
-    else
-        m_activeContextMenu = m_pageClient->createContextMenuProxy(this);
+        m_activeContextMenu = 0;
+    }
+
+    m_activeContextMenu = m_pageClient->createContextMenuProxy(this);
+
+    // Since showContextMenu() can spin a nested run loop we need to turn off the responsiveness timer.
+    process()->responsivenessTimer()->stop();
 
     // Give the PageContextMenuClient one last swipe at changing the menu.
     Vector<WebContextMenuItemData> items;
-        
-    if (!m_contextMenuClient.getContextMenuFromProposedMenu(this, proposedItems, items, userData.get())) {
+    if (!m_contextMenuClient.getContextMenuFromProposedMenu(this, proposedItems, items, userData.get()))
         m_activeContextMenu->showContextMenu(menuLocation, proposedItems);
-        return;
-    }
-    
-    if (items.size())
+    else
         m_activeContextMenu->showContextMenu(menuLocation, items);
 }
 
@@ -2176,6 +2180,11 @@ void WebPageProxy::contextMenuItemSelected(const WebContextMenuItemData& item)
         process()->updateTextCheckerState();
         return;
     }
+    if (item.action() == ContextMenuItemTagCorrectSpellingAutomatically) {
+        TextChecker::setAutomaticSpellingCorrectionEnabled(!TextChecker::state().isAutomaticSpellingCorrectionEnabled);
+        process()->updateTextCheckerState();
+        return;        
+    }
 #endif
     if (item.action() == ContextMenuItemTagDownloadImageToDisk) {
         m_context->download(this, KURL(KURL(), m_activeContextMenuState.absoluteImageURLString));
@@ -2185,7 +2194,16 @@ void WebPageProxy::contextMenuItemSelected(const WebContextMenuItemData& item)
         m_context->download(this, KURL(KURL(), m_activeContextMenuState.absoluteLinkURLString));
         return;
     }
-    
+    if (item.action() == ContextMenuItemTagCheckSpellingWhileTyping) {
+        TextChecker::setContinuousSpellCheckingEnabled(!TextChecker::state().isContinuousSpellCheckingEnabled);
+        process()->updateTextCheckerState();
+        return;
+    }
+    if (item.action() == ContextMenuItemTagCheckGrammarWithSpelling) {
+        TextChecker::setGrammarCheckingEnabled(!TextChecker::state().isGrammarCheckingEnabled);
+        process()->updateTextCheckerState();
+        return;
+    }
     if (item.action() == ContextMenuItemTagLearnSpelling || item.action() == ContextMenuItemTagIgnoreSpelling)
         ++m_pendingLearnOrIgnoreWordMessageCount;
 
@@ -2247,33 +2265,6 @@ void WebPageProxy::unmarkAllBadGrammar()
     process()->send(Messages::WebPage::UnmarkAllBadGrammar(), m_pageID);
 }
 
-#if PLATFORM(MAC)
-void WebPageProxy::uppercaseWord()
-{
-    process()->send(Messages::WebPage::UppercaseWord(), m_pageID);
-}
-
-void WebPageProxy::lowercaseWord()
-{
-    process()->send(Messages::WebPage::LowercaseWord(), m_pageID);
-}
-
-void WebPageProxy::capitalizeWord()
-{
-    process()->send(Messages::WebPage::CapitalizeWord(), m_pageID);
-}
-
-void WebPageProxy::setSmartInsertDeleteEnabled(bool isSmartInsertDeleteEnabled)
-{ 
-    if (m_isSmartInsertDeleteEnabled == isSmartInsertDeleteEnabled)
-        return;
-
-    TextChecker::setSmartInsertDeleteEnabled(isSmartInsertDeleteEnabled);
-    m_isSmartInsertDeleteEnabled = isSmartInsertDeleteEnabled;
-    process()->send(Messages::WebPage::SetSmartInsertDeleteEnabled(isSmartInsertDeleteEnabled), m_pageID);
-}
-#endif
-
 void WebPageProxy::registerEditCommand(PassRefPtr<WebEditCommandProxy> commandProxy, UndoOrRedo undoOrRedo)
 {
     m_pageClient->registerEditCommand(commandProxy, undoOrRedo);
@@ -2293,6 +2284,11 @@ void WebPageProxy::removeEditCommand(WebEditCommandProxy* command)
     process()->send(Messages::WebPage::DidRemoveEditCommand(command->commandID()), m_pageID);
 }
 
+bool WebPageProxy::isValidEditCommand(WebEditCommandProxy* command)
+{
+    return m_editCommandSet.find(command) != m_editCommandSet.end();
+}
+
 int64_t WebPageProxy::spellDocumentTag()
 {
     if (!m_hasSpellDocumentTag) {
@@ -2341,6 +2337,11 @@ void WebPageProxy::ignoreWord(const String& word)
 
 // Other
 
+void WebPageProxy::setFocus(bool focused)
+{
+    m_pageClient->setFocus(focused);
+}
+
 void WebPageProxy::takeFocus(bool direction)
 {
     m_pageClient->takeFocus(direction);
@@ -2453,9 +2454,12 @@ void WebPageProxy::stringCallback(const String& resultString, uint64_t callbackI
     RefPtr<StringCallback> callback = m_stringCallbacks.take(callbackID);
     if (!callback) {
         // FIXME: Log error or assert.
+        // this can validly happen if a load invalidated the callback, though
         return;
     }
 
+    m_loadDependentStringCallbackIDs.remove(callbackID);
+
     callback->performCallbackWithReturnValue(resultString.impl());
 }
 
@@ -2496,26 +2500,6 @@ void WebPageProxy::validateCommandCallback(const String& commandName, bool isEna
     callback->performCallbackWithReturnValue(commandName.impl(), isEnabled, state);
 }
 
-#if PLATFORM(MAC)
-void WebPageProxy::didPerformDictionaryLookup(const String& text, const DictionaryPopupInfo& dictionaryPopupInfo)
-{
-    m_pageClient->didPerformDictionaryLookup(text, m_viewScaleFactor, dictionaryPopupInfo);
-}
-    
-void WebPageProxy::registerWebProcessAccessibilityToken(const CoreIPC::DataReference& data)
-{
-    m_pageClient->accessibilityWebProcessTokenReceived(data);
-}    
-    
-void WebPageProxy::registerUIProcessAccessibilityTokens(const CoreIPC::DataReference& elementToken, const CoreIPC::DataReference& windowToken)
-{
-    if (!isValid())
-        return;
-
-    process()->send(Messages::WebPage::RegisterUIProcessAccessibilityTokens(elementToken, windowToken), m_pageID);
-}
-#endif
-
 void WebPageProxy::focusedFrameChanged(uint64_t frameID)
 {
     if (!frameID) {
@@ -2572,6 +2556,13 @@ void WebPageProxy::processDidCrash()
     }
 #endif
 
+#if ENABLE(FULLSCREEN_API)
+    if (m_fullScreenManager) {
+        m_fullScreenManager->invalidate();
+        m_fullScreenManager = 0;
+    }
+#endif
+
     if (m_openPanelResultListener) {
         m_openPanelResultListener->invalidate();
         m_openPanelResultListener = 0;
@@ -2590,6 +2581,7 @@ void WebPageProxy::processDidCrash()
     invalidateCallbackMap(m_voidCallbacks);
     invalidateCallbackMap(m_dataCallbacks);
     invalidateCallbackMap(m_stringCallbacks);
+    m_loadDependentStringCallbackIDs.clear();
     invalidateCallbackMap(m_scriptValueCallbacks);
     invalidateCallbackMap(m_computedPagesCallbacks);
     invalidateCallbackMap(m_validateCommandCallbacks);
@@ -2633,6 +2625,7 @@ WebPageCreationParameters WebPageProxy::creationParameters() const
     parameters.highestUsedBackForwardItemID = WebBackForwardListItem::highedUsedItemID();
     parameters.canRunBeforeUnloadConfirmPanel = m_uiClient.canRunBeforeUnloadConfirmPanel();
     parameters.canRunModal = m_uiClient.canRunModal();
+    parameters.userSpaceScaleFactor = m_pageClient->userSpaceScaleFactor();
 
 #if PLATFORM(MAC)
     parameters.isSmartInsertDeleteEnabled = m_isSmartInsertDeleteEnabled;
@@ -2677,7 +2670,7 @@ void WebPageProxy::didReceiveAuthenticationChallenge(uint64_t frameID, const Web
     WebFrameProxy* frame = process()->webFrame(frameID);
     MESSAGE_CHECK(frame);
 
-    RefPtr<AuthenticationChallengeProxy> authenticationChallenge = AuthenticationChallengeProxy::create(coreChallenge, challengeID, this);
+    RefPtr<AuthenticationChallengeProxy> authenticationChallenge = AuthenticationChallengeProxy::create(coreChallenge, challengeID, process());
     
     m_loaderClient.didReceiveAuthenticationChallengeInFrame(this, frame, authenticationChallenge.get());
 }
@@ -2748,18 +2741,6 @@ void WebPageProxy::didFinishLoadingDataForCustomRepresentation(const String& sug
     m_pageClient->didFinishLoadingDataForCustomRepresentation(suggestedFilename, dataReference);
 }
 
-#if PLATFORM(MAC)
-void WebPageProxy::setComplexTextInputEnabled(uint64_t pluginComplexTextInputIdentifier, bool complexTextInputEnabled)
-{
-    m_pageClient->setComplexTextInputEnabled(pluginComplexTextInputIdentifier, complexTextInputEnabled);
-}
-
-void WebPageProxy::setAutodisplay(bool newState)
-{
-    m_pageClient->setAutodisplay(newState);
-}
-#endif
-
 void WebPageProxy::backForwardRemovedItem(uint64_t itemID)
 {
     process()->send(Messages::WebPage::DidRemoveBackForwardItem(itemID), m_pageID);
@@ -2822,4 +2803,41 @@ Color WebPageProxy::backingStoreUpdatesFlashColor()
     return Color(200, 0, 255);
 }
 
+void WebPageProxy::saveDataToFileInDownloadsFolder(const String& suggestedFilename, const String& mimeType, const String& originatingURLString, WebData* data)
+{
+    m_uiClient.saveDataToFileInDownloadsFolder(this, suggestedFilename, mimeType, originatingURLString, data);
+}
+
+#if PLATFORM(MAC) && !defined(BUILDING_ON_SNOW_LEOPARD)
+void WebPageProxy::showCorrectionPanel(int32_t panelType, const WebCore::FloatRect& boundingBoxOfReplacedString, const String& replacedString, const String& replacementString, const Vector<String>& alternativeReplacementStrings)
+{
+    m_pageClient->showCorrectionPanel((WebCore::CorrectionPanelInfo::PanelType)panelType, boundingBoxOfReplacedString, replacedString, replacementString, alternativeReplacementStrings);
+}
+
+void WebPageProxy::dismissCorrectionPanel(int32_t reason)
+{
+    m_pageClient->dismissCorrectionPanel((WebCore::ReasonForDismissingCorrectionPanel)reason);
+}
+
+void WebPageProxy::dismissCorrectionPanelSoon(int32_t reason, String& result)
+{
+    result = m_pageClient->dismissCorrectionPanelSoon((WebCore::ReasonForDismissingCorrectionPanel)reason);
+}
+
+void WebPageProxy::recordAutocorrectionResponse(int32_t responseType, const String& replacedString, const String& replacementString)
+{
+    m_pageClient->recordAutocorrectionResponse((WebCore::EditorClient::AutocorrectionResponseType)responseType, replacedString, replacementString);
+}
+#endif
+
+#if PLATFORM(MAC)
+void WebPageProxy::handleCorrectionPanelResult(const String& result)
+{
+#if !defined(BUILDING_ON_SNOW_LEOPARD)
+    if (!isClosed())
+        process()->send(Messages::WebPage::HandleCorrectionPanelResult(result), m_pageID, 0);
+#endif
+}
+#endif
+
 } // namespace WebKit
diff --git a/Source/WebKit2/UIProcess/WebPageProxy.h b/Source/WebKit2/UIProcess/WebPageProxy.h
index ce56cea..e3e62d4 100644
--- a/Source/WebKit2/UIProcess/WebPageProxy.h
+++ b/Source/WebKit2/UIProcess/WebPageProxy.h
@@ -27,6 +27,7 @@
 #define WebPageProxy_h
 
 #include "APIObject.h"
+#include "Connection.h"
 #include "ContextMenuState.h"
 #include "DragControllerAction.h"
 #include "DrawingAreaProxy.h"
@@ -37,24 +38,17 @@
 #include "WKBase.h"
 #include "WKPagePrivate.h"
 #include "WebContextMenuItemData.h"
-#include "WebEvent.h"
 #include "WebFindClient.h"
-#include "WebFindOptions.h"
 #include "WebFormClient.h"
 #include "WebFrameProxy.h"
 #include "WebHistoryClient.h"
-#include "WebInspectorProxy.h"
 #include "WebLoaderClient.h"
 #include "WebPageContextMenuClient.h"
 #include "WebPolicyClient.h"
 #include "WebPopupMenuProxy.h"
 #include "WebResourceLoadClient.h"
 #include "WebUIClient.h"
-#include <WebCore/DragActions.h>
-#include <WebCore/EditAction.h>
-#include <WebCore/Editor.h>
-#include <WebCore/FrameLoaderTypes.h>
-#include <WebCore/KeyboardEvent.h>
+#include <WebCore/ScrollTypes.h>
 #include <wtf/HashMap.h>
 #include <wtf/HashSet.h>
 #include <wtf/OwnPtr.h>
@@ -83,7 +77,6 @@ namespace WebCore {
 
 namespace WebKit {
 
-class DrawingAreaProxy;
 class NativeWebKeyboardEvent;
 class PageClient;
 class PlatformCertificateInfo;
@@ -93,15 +86,14 @@ class WebBackForwardListItem;
 class WebContextMenuProxy;
 class WebData;
 class WebEditCommandProxy;
+class WebFullScreenManagerProxy;
 class WebKeyboardEvent;
 class WebMouseEvent;
 class WebOpenPanelResultListenerProxy;
 class WebPageGroup;
-class WebPopupMenuProxy;
 class WebProcessProxy;
 class WebURLRequest;
 class WebWheelEvent;
-struct ContextMenuState;
 struct DictionaryPopupInfo;
 struct PlatformPopupMenuData;
 struct PrintInfo;
@@ -182,6 +174,10 @@ public:
     WebInspectorProxy* inspector();
 #endif
 
+#if ENABLE(FULLSCREEN_API)
+    WebFullScreenManagerProxy* fullScreenManager();
+#endif
+
     void initializeContextMenuClient(const WKPageContextMenuClient*);
     void initializeFindClient(const WKPageFindClient*);
     void initializeFormClient(const WKPageFormClient*);
@@ -282,6 +278,8 @@ public:
     void handleTouchEvent(const WebTouchEvent&);
 #endif
 
+    void scrollBy(WebCore::ScrollDirection, WebCore::ScrollGranularity);
+
     String pageTitle() const;
     const String& toolTip() const { return m_toolTip; }
 
@@ -331,6 +329,7 @@ public:
     // Called by the UI process when it is ready to send its tokens to the web process.
     void registerUIProcessAccessibilityTokens(const CoreIPC::DataReference& elemenToken, const CoreIPC::DataReference& windowToken);
     bool writeSelectionToPasteboard(const String& pasteboardName, const Vector<String>& pasteboardTypes);
+    bool readSelectionFromPasteboard(const String& pasteboardName);
 #endif
 
     void viewScaleFactorDidChange(double);
@@ -358,8 +357,6 @@ public:
     void drawFooter(WebFrameProxy*, const WebCore::FloatRect&);
 
 #if PLATFORM(MAC)
-    void setAutodisplay(bool);
-
     // Dictionary.
     void performDictionaryLookupAtLocation(const WebCore::FloatPoint&);
 #endif
@@ -373,7 +370,7 @@ public:
     void didPerformDragControllerAction(uint64_t resultOperation);
     void dragEnded(const WebCore::IntPoint& clientPosition, const WebCore::IntPoint& globalPosition, uint64_t operation);
 #if PLATFORM(MAC)
-    void setDragImage(const WebCore::IntPoint& clientPosition, const WebCore::IntSize& imageSize, const SharedMemory::Handle& dragImageHandle, bool isLinkDrag);
+    void setDragImage(const WebCore::IntPoint& clientPosition, const ShareableBitmap::Handle& dragImageHandle, bool isLinkDrag);
 #endif
 #if PLATFORM(WIN)
     void startDragDrop(const WebCore::IntPoint& imagePoint, const WebCore::IntPoint& dragPoint, uint64_t okEffect, const HashMap<UINT, Vector<String> >& dataMap, const WebCore::IntSize& dragImageSize, const SharedMemory::Handle& dragImageHandle, bool isLinkDrag);
@@ -395,6 +392,7 @@ public:
     enum UndoOrRedo { Undo, Redo };
     void addEditCommand(WebEditCommandProxy*);
     void removeEditCommand(WebEditCommandProxy*);
+    bool isValidEditCommand(WebEditCommandProxy*);
     void registerEditCommand(PassRefPtr<WebEditCommandProxy>, UndoOrRedo);
 
     WebProcessProxy* process() const;
@@ -454,14 +452,21 @@ public:
 
     void flashBackingStoreUpdates(const Vector<WebCore::IntRect>& updateRects);
 
+#if PLATFORM(MAC)
+    void handleCorrectionPanelResult(const String& result);
+#endif
+
     static void setDebugPaintFlags(WKPageDebugPaintFlags flags) { s_debugPaintFlags = flags; }
     static WKPageDebugPaintFlags debugPaintFlags() { return s_debugPaintFlags; }
 
     // Color to be used with kWKDebugFlashViewUpdates.
     static WebCore::Color viewUpdatesFlashColor();
+
     // Color to be used with kWKDebugFlashBackingStoreUpdates.
     static WebCore::Color backingStoreUpdatesFlashColor();
 
+    void saveDataToFileInDownloadsFolder(const String& suggestedFilename, const String& mimeType, const String& originatingURLString, WebData*);
+
 private:
     WebPageProxy(PageClient*, WebContext*, WebPageGroup*, uint64_t pageID);
 
@@ -480,7 +485,7 @@ private:
     void didSaveFrameToPageCache(uint64_t frameID);
     void didRestoreFrameFromPageCache(uint64_t frameID, uint64_t parentFrameID);
 
-    void didStartProvisionalLoadForFrame(uint64_t frameID, const String&, bool loadingSubstituteDataForUnreachableURL, CoreIPC::ArgumentDecoder*);
+    void didStartProvisionalLoadForFrame(uint64_t frameID, const String& url, const String& unreachableURL, CoreIPC::ArgumentDecoder*);
     void didReceiveServerRedirectForProvisionalLoadForFrame(uint64_t frameID, const String&, CoreIPC::ArgumentDecoder*);
     void didFailProvisionalLoadForFrame(uint64_t frameID, const WebCore::ResourceError&, CoreIPC::ArgumentDecoder*);
     void didCommitLoadForFrame(uint64_t frameID, const String& mimeType, bool frameHasCustomRepresentation, const PlatformCertificateInfo&, CoreIPC::ArgumentDecoder*);
@@ -534,6 +539,7 @@ private:
     void getIsResizable(bool& isResizable);
     void setWindowFrame(const WebCore::FloatRect&);
     void getWindowFrame(WebCore::FloatRect&);
+    void windowToScreen(const WebCore::IntRect& viewRect, WebCore::IntRect& result);
     void runBeforeUnloadConfirmPanel(const String& message, uint64_t frameID, bool& shouldClose);
     void didChangeViewportData(const WebCore::ViewportArguments&);
     void pageDidScroll();
@@ -550,7 +556,7 @@ private:
     void reattachToWebProcessWithItem(WebBackForwardListItem*);
 
 #if ENABLE(TILED_BACKING_STORE)
-    void pageDidRequestScroll(const WebCore::IntSize&);
+    void pageDidRequestScroll(const WebCore::IntPoint&);
 #endif
 
 #if PLATFORM(QT)
@@ -580,7 +586,7 @@ private:
     
     // Find.
     void didCountStringMatches(const String&, uint32_t matchCount);
-    void setFindIndicator(const WebCore::FloatRect& selectionRectInWindowCoordinates, const Vector<WebCore::FloatRect>& textRectsInSelectionRectCoordinates, const SharedMemory::Handle& contentImageHandle, bool fadeOut);
+    void setFindIndicator(const WebCore::FloatRect& selectionRectInWindowCoordinates, const Vector<WebCore::FloatRect>& textRectsInSelectionRectCoordinates, const ShareableBitmap::Handle& contentImageHandle, bool fadeOut);
     void didFindString(const String&, uint32_t matchCount);
     void didFailToFindString(const String&);
 
@@ -610,6 +616,7 @@ private:
     void learnWord(const String& word);
     void ignoreWord(const String& word);
 
+    void setFocus(bool focused);
     void takeFocus(bool direction);
     void setToolTip(const String&);
     void setCursor(const WebCore::Cursor&);
@@ -642,6 +649,15 @@ private:
 
     void initializeSandboxExtensionHandle(const WebCore::KURL&, SandboxExtension::Handle&);
 
+#if PLATFORM(MAC) && !defined(BUILDING_ON_SNOW_LEOPARD)
+    void showCorrectionPanel(int32_t panelType, const WebCore::FloatRect& boundingBoxOfReplacedString, const String& replacedString, const String& replacementString, const Vector<String>& alternativeReplacementStrings);
+    void dismissCorrectionPanel(int32_t reason);
+    void dismissCorrectionPanelSoon(int32_t reason, String& result);
+    void recordAutocorrectionResponse(int32_t responseType, const String& replacedString, const String& replacementString);
+#endif
+
+    void clearLoadDependentCallbacks();
+
     PageClient* m_pageClient;
     WebLoaderClient m_loaderClient;
     WebPolicyClient m_policyClient;
@@ -667,9 +683,14 @@ private:
     RefPtr<WebInspectorProxy> m_inspector;
 #endif
 
+#if ENABLE(FULLSCREEN_API)
+    RefPtr<WebFullScreenManagerProxy> m_fullScreenManager;
+#endif
+
     HashMap<uint64_t, RefPtr<VoidCallback> > m_voidCallbacks;
     HashMap<uint64_t, RefPtr<DataCallback> > m_dataCallbacks;
     HashMap<uint64_t, RefPtr<StringCallback> > m_stringCallbacks;
+    HashSet<uint64_t> m_loadDependentStringCallbackIDs;
     HashMap<uint64_t, RefPtr<ScriptValueCallback> > m_scriptValueCallbacks;
     HashMap<uint64_t, RefPtr<ComputedPagesCallback> > m_computedPagesCallbacks;
     HashMap<uint64_t, RefPtr<ValidateCommandCallback> > m_validateCommandCallbacks;
diff --git a/Source/WebKit2/UIProcess/WebPageProxy.messages.in b/Source/WebKit2/UIProcess/WebPageProxy.messages.in
index 8692f14..e145d82 100644
--- a/Source/WebKit2/UIProcess/WebPageProxy.messages.in
+++ b/Source/WebKit2/UIProcess/WebPageProxy.messages.in
@@ -35,6 +35,7 @@ messages -> WebPageProxy {
     SetCursor(WebCore::Cursor cursor)
     SetStatusText(WTF::String statusText)
     SetToolTip(WTF::String toolTip)
+    SetFocus(bool focused)
     TakeFocus(bool direction)
     FocusedFrameChanged(uint64_t frameID)
     FrameSetLargestFrameChanged(uint64_t frameID)
@@ -48,6 +49,7 @@ messages -> WebPageProxy {
     GetIsResizable() -> (bool isResizable)
     SetWindowFrame(WebCore::FloatRect windowFrame)
     GetWindowFrame() -> (WebCore::FloatRect windowFrame)
+    WindowToScreen(WebCore::IntRect rect) -> (WebCore::IntRect screenFrame)
     RunBeforeUnloadConfirmPanel(WTF::String message, uint64_t frameID) -> (bool shouldClose)
     PageDidScroll()
     RunOpenPanel(uint64_t frameID, WebKit::WebOpenPanelParameters::Data parameters)
@@ -58,7 +60,7 @@ messages -> WebPageProxy {
     DidChangeScrollOffsetPinningForMainFrame(bool hasHorizontalScrollbar, bool hasVerticalScrollbar)
 
 #if ENABLE(TILED_BACKING_STORE)
-    PageDidRequestScroll(WebCore::IntSize delta)
+    PageDidRequestScroll(WebCore::IntPoint point)
 #endif
 #if PLATFORM(QT)
     DidChangeContentsSize(WebCore::IntSize newSize)
@@ -92,7 +94,7 @@ messages -> WebPageProxy {
     DidFirstVisuallyNonEmptyLayoutForFrame(uint64_t frameID, WebKit::InjectedBundleUserMessageEncoder userData)
     DidReceiveServerRedirectForProvisionalLoadForFrame(uint64_t frameID, WTF::String url, WebKit::InjectedBundleUserMessageEncoder userData)
     DidRemoveFrameFromHierarchy(uint64_t frameID, WebKit::InjectedBundleUserMessageEncoder userData)
-    DidStartProvisionalLoadForFrame(uint64_t frameID, WTF::String url, bool loadingSubstituteDataForUnreachableURL, WebKit::InjectedBundleUserMessageEncoder userData)
+    DidStartProvisionalLoadForFrame(uint64_t frameID, WTF::String url, WTF::String unreachableURL, WebKit::InjectedBundleUserMessageEncoder userData)
     DidReceiveTitleForFrame(uint64_t frameID, WTF::String title, WebKit::InjectedBundleUserMessageEncoder userData)
     DidDisplayInsecureContentForFrame(uint64_t frameID, WebKit::InjectedBundleUserMessageEncoder userData)
     DidRunInsecureContentForFrame(uint64_t frameID, WebKit::InjectedBundleUserMessageEncoder userData)
@@ -157,7 +159,7 @@ messages -> WebPageProxy {
 
     # Find messages
     DidCountStringMatches(WTF::String string, uint32_t matchCount)
-    SetFindIndicator(WebCore::FloatRect selectionRect, Vector<WebCore::FloatRect> textRects, WebKit::SharedMemory::Handle contentImageHandle, bool fadeOut)
+    SetFindIndicator(WebCore::FloatRect selectionRect, Vector<WebCore::FloatRect> textRects, WebKit::ShareableBitmap::Handle contentImageHandle, bool fadeOut)
     DidFindString(WTF::String string, uint32_t matchCount)
     DidFailToFindString(WTF::String string)
 
@@ -201,9 +203,17 @@ messages -> WebPageProxy {
     # Drag and drop messages
     DidPerformDragControllerAction(uint64_t resultOperation)
 #if PLATFORM(MAC)
-    SetDragImage(WebCore::IntPoint clientPosition, WebCore::IntSize imageSize, WebKit::SharedMemory::Handle dragImage, bool linkDrag)
+    SetDragImage(WebCore::IntPoint clientPosition, WebKit::ShareableBitmap::Handle dragImage, bool linkDrag)
 #endif
 #if PLATFORM(WIN)
     StartDragDrop(WebCore::IntPoint imagePoint, WebCore::IntPoint dragPoint, uint64_t okEffect, HashMap<UINT,Vector<String> > dataMap, WebCore::IntSize dragImageSize, WebKit::SharedMemory::Handle dragImage, bool linkDrag)
 #endif
+
+#if PLATFORM(MAC) && !defined(BUILDING_ON_SNOW_LEOPARD)
+    # Autocorrection messages
+    ShowCorrectionPanel(int32_t panelType, WebCore::FloatRect boundingBoxOfReplacedString, String replacedString, String replacementString, Vector<String> alternativeReplacementStrings)
+    DismissCorrectionPanel(int32_t reason)
+    DismissCorrectionPanelSoon(int32_t reason) -> (String result)
+    RecordAutocorrectionResponse(int32_t responseType, String replacedString, String replacementString);
+#endif
 }
diff --git a/Source/WebKit2/UIProcess/WebProcessProxy.cpp b/Source/WebKit2/UIProcess/WebProcessProxy.cpp
index 42e3408..8a48724 100644
--- a/Source/WebKit2/UIProcess/WebProcessProxy.cpp
+++ b/Source/WebKit2/UIProcess/WebProcessProxy.cpp
@@ -252,7 +252,9 @@ void WebProcessProxy::didReceiveMessage(CoreIPC::Connection* connection, CoreIPC
         || messageID.is<CoreIPC::MessageClassWebCookieManagerProxy>()
         || messageID.is<CoreIPC::MessageClassWebDatabaseManagerProxy>()
         || messageID.is<CoreIPC::MessageClassWebGeolocationManagerProxy>()
+        || messageID.is<CoreIPC::MessageClassWebIconDatabase>()
         || messageID.is<CoreIPC::MessageClassWebKeyValueStorageManagerProxy>()
+        || messageID.is<CoreIPC::MessageClassWebMediaCacheManagerProxy>()
         || messageID.is<CoreIPC::MessageClassWebResourceCacheManagerProxy>()) {
         m_context->didReceiveMessage(connection, messageID, arguments);
         return;
@@ -290,7 +292,8 @@ CoreIPC::SyncReplyMode WebProcessProxy::didReceiveSyncMessage(CoreIPC::Connectio
     }
 #endif
 
-    if (messageID.is<CoreIPC::MessageClassWebContext>() || messageID.is<CoreIPC::MessageClassWebContextLegacy>()  || messageID.is<CoreIPC::MessageClassDownloadProxy>())
+    if (messageID.is<CoreIPC::MessageClassWebContext>() || messageID.is<CoreIPC::MessageClassWebContextLegacy>() 
+        || messageID.is<CoreIPC::MessageClassDownloadProxy>() || messageID.is<CoreIPC::MessageClassWebIconDatabase>())
         return m_context->didReceiveSyncMessage(connection, messageID, arguments, reply);
 
     uint64_t pageID = arguments->destinationID();
diff --git a/Source/WebKit2/UIProcess/WebResourceCacheManagerProxy.cpp b/Source/WebKit2/UIProcess/WebResourceCacheManagerProxy.cpp
index aa65113..403a8dc 100644
--- a/Source/WebKit2/UIProcess/WebResourceCacheManagerProxy.cpp
+++ b/Source/WebKit2/UIProcess/WebResourceCacheManagerProxy.cpp
@@ -56,13 +56,15 @@ void WebResourceCacheManagerProxy::invalidate()
     invalidateCallbackMap(m_arrayCallbacks);
 }
 
+bool WebResourceCacheManagerProxy::shouldTerminate(WebProcessProxy*) const
+{
+    return m_arrayCallbacks.isEmpty();
+}
+
 void WebResourceCacheManagerProxy::getCacheOrigins(PassRefPtr<ArrayCallback> prpCallback)
 {
     RefPtr<ArrayCallback> callback = prpCallback;
-    if (!m_webContext->hasValidProcess()) {
-        callback->invalidate();
-        return;
-    }
+    m_webContext->relaunchProcessIfNecessary();
     uint64_t callbackID = callback->callbackID();
     m_arrayCallbacks.set(callbackID, callback.release());
     m_webContext->process()->send(Messages::WebResourceCacheManager::GetCacheOrigins(callbackID), 0);
@@ -76,8 +78,7 @@ void WebResourceCacheManagerProxy::didGetCacheOrigins(const Vector<SecurityOrigi
 
 void WebResourceCacheManagerProxy::clearCacheForOrigin(WebSecurityOrigin* origin)
 {
-    if (!m_webContext->hasValidProcess())
-        return;
+    m_webContext->relaunchProcessIfNecessary();
 
     SecurityOriginData securityOrigin;
     securityOrigin.protocol = origin->protocol();
@@ -88,8 +89,7 @@ void WebResourceCacheManagerProxy::clearCacheForOrigin(WebSecurityOrigin* origin
 
 void WebResourceCacheManagerProxy::clearCacheForAllOrigins()
 {
-    if (!m_webContext->hasValidProcess())
-        return;
+    m_webContext->relaunchProcessIfNecessary();
     m_webContext->process()->send(Messages::WebResourceCacheManager::ClearCacheForAllOrigins(), 0);
 }
 
diff --git a/Source/WebKit2/UIProcess/WebResourceCacheManagerProxy.h b/Source/WebKit2/UIProcess/WebResourceCacheManagerProxy.h
index 0a2c3c8..1a360b4 100644
--- a/Source/WebKit2/UIProcess/WebResourceCacheManagerProxy.h
+++ b/Source/WebKit2/UIProcess/WebResourceCacheManagerProxy.h
@@ -42,6 +42,7 @@ namespace WebKit {
 
 struct SecurityOriginData;
 class WebContext;
+class WebProcessProxy;
 class WebSecurityOrigin;
 
 typedef GenericCallback<WKArrayRef> ArrayCallback;
@@ -62,6 +63,8 @@ public:
 
     void didReceiveWebResourceCacheManagerProxyMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::ArgumentDecoder*);
 
+    bool shouldTerminate(WebProcessProxy*) const;
+
 private:
     explicit WebResourceCacheManagerProxy(WebContext*);
 
diff --git a/Source/WebKit2/UIProcess/WebUIClient.cpp b/Source/WebKit2/UIProcess/WebUIClient.cpp
index 31dd458..9bb8efc 100644
--- a/Source/WebKit2/UIProcess/WebUIClient.cpp
+++ b/Source/WebKit2/UIProcess/WebUIClient.cpp
@@ -329,10 +329,18 @@ void WebUIClient::runModal(WebPageProxy* page)
 
 void WebUIClient::didCompleteRubberBandForMainFrame(WebPageProxy* page, const IntSize& initialOverhang)
 {
-    if (!m_client.runModal)
+    if (!m_client.didCompleteRubberBandForMainFrame)
         return;
 
     m_client.didCompleteRubberBandForMainFrame(toAPI(page), toAPI(initialOverhang), m_client.clientInfo);
 }
 
+void WebUIClient::saveDataToFileInDownloadsFolder(WebPageProxy* page, const String& suggestedFilename, const String& mimeType, const String& originatingURLString, WebData* data)
+{
+    if (!m_client.saveDataToFileInDownloadsFolder)
+        return;
+
+    m_client.saveDataToFileInDownloadsFolder(toAPI(page), toAPI(suggestedFilename.impl()), toAPI(mimeType.impl()), toURLRef(originatingURLString.impl()), toAPI(data), m_client.clientInfo);
+}
+
 } // namespace WebKit
diff --git a/Source/WebKit2/UIProcess/WebUIClient.h b/Source/WebKit2/UIProcess/WebUIClient.h
index ed47f8f..8fcf7b6 100644
--- a/Source/WebKit2/UIProcess/WebUIClient.h
+++ b/Source/WebKit2/UIProcess/WebUIClient.h
@@ -44,6 +44,7 @@ namespace WebKit {
 class APIObject;
 class GeolocationPermissionRequestProxy;
 class NativeWebKeyboardEvent;
+class WebData;
 class WebFrameProxy;
 class WebPageProxy;
 class WebSecurityOrigin;
@@ -98,6 +99,8 @@ public:
     void runModal(WebPageProxy*);
 
     void didCompleteRubberBandForMainFrame(WebPageProxy*, const WebCore::IntSize&);
+
+    void saveDataToFileInDownloadsFolder(WebPageProxy*, const String& suggestedFilename, const String& mimeType, const String& originatingURLString, WebData*);
 };
 
 } // namespace WebKit
diff --git a/Source/WebKit2/UIProcess/cf/WebPageProxyCF.cpp b/Source/WebKit2/UIProcess/cf/WebPageProxyCF.cpp
index dc26899..45e77df 100644
--- a/Source/WebKit2/UIProcess/cf/WebPageProxyCF.cpp
+++ b/Source/WebKit2/UIProcess/cf/WebPageProxyCF.cpp
@@ -151,7 +151,6 @@ void WebPageProxy::restoreFromSessionStateData(WebData* webData)
             provisionalURL = static_cast<CFStringRef>(value);
     }
 
-    bool restoredFromBackForwardList = false;
     if (backForwardListDictionary) {
         if (!m_backForwardList->restoreFromCFDictionaryRepresentation(backForwardListDictionary))
             LOG(SessionState, "Failed to restore back/forward list from SessionHistory dictionary");
@@ -161,21 +160,23 @@ void WebPageProxy::restoreFromSessionStateData(WebData* webData)
                 for (size_t i = 0; i < size; ++i)
                     process()->registerNewWebBackForwardListItem(entries[i].get());
 
-                SandboxExtension::Handle sandboxExtensionHandle;
-                if (WebBackForwardListItem* item = m_backForwardList->currentItem())
-                    initializeSandboxExtensionHandle(KURL(KURL(), item->url()), sandboxExtensionHandle);
-
-                process()->send(Messages::WebPage::RestoreSessionAndNavigateToCurrentItem(SessionState(m_backForwardList->entries(), m_backForwardList->currentIndex()), sandboxExtensionHandle), m_pageID);
-
-                restoredFromBackForwardList = true;
+                SessionState state(m_backForwardList->entries(), m_backForwardList->currentIndex());
+                if (provisionalURL)
+                    process()->send(Messages::WebPage::RestoreSession(state), m_pageID);
+                else {
+                    SandboxExtension::Handle sandboxExtensionHandle;
+                    if (WebBackForwardListItem* item = m_backForwardList->currentItem()) {
+                        initializeSandboxExtensionHandle(KURL(KURL(), item->url()), sandboxExtensionHandle);
+                        setPendingAPIRequestURL(item->url());
+                    }
+
+                    process()->send(Messages::WebPage::RestoreSessionAndNavigateToCurrentItem(state, sandboxExtensionHandle), m_pageID);
+                }
             }
         }
     }
 
-    // FIXME: It would be better to load the provisional URL even if the back/forward list is also present.
-    // But when we tried it, it overwrote the current item in the back/forward list instead of pushing a
-    // new item on. For now, just throw away the provisional URL if there is also a back/forward list.
-    if (provisionalURL && !restoredFromBackForwardList)
+    if (provisionalURL)
         loadURL(provisionalURL);
 }
 
diff --git a/Source/WebKit2/UIProcess/gtk/WebContextGtk.cpp b/Source/WebKit2/UIProcess/gtk/WebContextGtk.cpp
index d67726c..e09bfa5 100644
--- a/Source/WebKit2/UIProcess/gtk/WebContextGtk.cpp
+++ b/Source/WebKit2/UIProcess/gtk/WebContextGtk.cpp
@@ -41,9 +41,24 @@ void WebContext::platformInitializeWebProcess(WebProcessCreationParameters&)
 {
 }
 
+void WebContext::platformInvalidateContext()
+{
+}
+
 String WebContext::platformDefaultDatabaseDirectory() const
 {
     return WTF::String::fromUTF8(g_build_filename(g_get_user_data_dir(), "webkit", "databases", NULL));
 }
 
+String WebContext::platformDefaultIconDatabasePath() const
+{
+    // FIXME: Implement.
+    return WTF::String();
+}
+
+String WebContext::platformDefaultLocalStorageDirectory() const
+{
+    return WTF::String::fromUTF8(g_build_filename(g_get_user_data_dir(), "webkit", "localstorage", NULL));
+}
+
 } // namespace WebKit
diff --git a/Source/WebKit2/UIProcess/gtk/WebFullScreenManagerProxyGtk.cpp b/Source/WebKit2/UIProcess/gtk/WebFullScreenManagerProxyGtk.cpp
new file mode 100644
index 0000000..82e8657
--- /dev/null
+++ b/Source/WebKit2/UIProcess/gtk/WebFullScreenManagerProxyGtk.cpp
@@ -0,0 +1,81 @@
+/*
+ *  Copyright (C) 2011 Igalia S.L.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  along with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ */
+
+#include "config.h"
+#include "WebFullScreenManagerProxy.h"
+
+#if ENABLE(FULLSCREEN_API)
+
+#include "WebContext.h"
+#include "WebFullScreenManagerMessages.h"
+#include "WebFullScreenManagerProxyMessages.h"
+#include "WebProcess.h"
+
+#include <WebCore/NotImplemented.h>
+
+namespace WebKit {
+
+void WebFullScreenManagerProxy::enterFullScreen()
+{
+    notImplemented();
+}
+
+void WebFullScreenManagerProxy::exitFullScreen()
+{
+    notImplemented();
+}
+
+void WebFullScreenManagerProxy::beganEnterFullScreenAnimation()
+{
+    notImplemented();
+}
+
+void WebFullScreenManagerProxy::finishedEnterFullScreenAnimation(bool completed)
+{
+    notImplemented();
+}
+
+void WebFullScreenManagerProxy::beganExitFullScreenAnimation()
+{
+    notImplemented();
+}
+
+void WebFullScreenManagerProxy::finishedExitFullScreenAnimation(bool completed)
+{
+    notImplemented();
+}
+
+void WebFullScreenManagerProxy::enterAcceleratedCompositingMode(const LayerTreeContext& context)
+{
+    notImplemented();
+}
+
+void WebFullScreenManagerProxy::exitAcceleratedCompositingMode()
+{
+    notImplemented();
+}
+
+void WebFullScreenManagerProxy::getFullScreenRect(WebCore::IntRect& rect)
+{
+    notImplemented();
+}
+
+} // namespace WebKit
+
+#endif // ENABLE(FULLSCREEN_API)
diff --git a/Source/WebKit2/UIProcess/gtk/WebView.cpp b/Source/WebKit2/UIProcess/gtk/WebView.cpp
index 5063922..2ff67cd 100644
--- a/Source/WebKit2/UIProcess/gtk/WebView.cpp
+++ b/Source/WebKit2/UIProcess/gtk/WebView.cpp
@@ -179,6 +179,11 @@ void WebView::didRelaunchProcess()
     notImplemented();
 }
 
+void WebView::setFocus(bool)
+{
+    notImplemented();
+}
+
 void WebView::takeFocus(bool)
 {
     notImplemented();
@@ -189,9 +194,17 @@ void WebView::toolTipChanged(const String&, const String&)
     notImplemented();
 }
 
-void WebView::setCursor(const Cursor&)
+void WebView::setCursor(const Cursor& cursor)
 {
-    notImplemented();
+    // [GTK] Widget::setCursor() gets called frequently
+    // http://bugs.webkit.org/show_bug.cgi?id=16388
+    // Setting the cursor may be an expensive operation in some backends,
+    // so don't re-set the cursor if it's already set to the target value.
+    GdkWindow* window = gtk_widget_get_window(m_viewWidget);
+    GdkCursor* currentCursor = gdk_window_get_cursor(window);
+    GdkCursor* newCursor = cursor.platformCursor().get();
+    if (currentCursor != newCursor)
+        gdk_window_set_cursor(window, newCursor);
 }
 
 void WebView::setViewportArguments(const WebCore::ViewportArguments&)
@@ -221,6 +234,12 @@ FloatRect WebView::convertToUserSpace(const FloatRect& viewRect)
     return viewRect;
 }
 
+IntRect WebView::windowToScreen(const IntRect& rect)
+{
+    notImplemented();
+    return IntRect();
+}
+
 void WebView::doneWithKeyEvent(const NativeWebKeyboardEvent&, bool wasEventHandled)
 {
     notImplemented();
diff --git a/Source/WebKit2/UIProcess/gtk/WebView.h b/Source/WebKit2/UIProcess/gtk/WebView.h
index 256dc04..6c281ed 100644
--- a/Source/WebKit2/UIProcess/gtk/WebView.h
+++ b/Source/WebKit2/UIProcess/gtk/WebView.h
@@ -85,6 +85,7 @@ private:
     virtual void processDidCrash();
     virtual void didRelaunchProcess();
     virtual void pageClosed();
+    virtual void setFocus(bool focused);
     virtual void takeFocus(bool direction);
     virtual void toolTipChanged(const WTF::String&, const WTF::String&);
     virtual void setCursor(const WebCore::Cursor&);
@@ -93,6 +94,7 @@ private:
     virtual void clearAllEditCommands();
     virtual WebCore::FloatRect convertToDeviceSpace(const WebCore::FloatRect&);
     virtual WebCore::FloatRect convertToUserSpace(const WebCore::FloatRect&);
+    virtual WebCore::IntRect windowToScreen(const WebCore::IntRect&);
     virtual void doneWithKeyEvent(const NativeWebKeyboardEvent&, bool wasEventHandled);
     virtual void didNotHandleKeyEvent(const NativeWebKeyboardEvent&);
     virtual PassRefPtr<WebPopupMenuProxy> createPopupMenuProxy(WebPageProxy*);
@@ -100,6 +102,7 @@ private:
     virtual void setFindIndicator(PassRefPtr<FindIndicator>, bool fadeOut);
     virtual void didChangeScrollbarsForMainFrame() const;
     virtual void flashBackingStoreUpdates(const Vector<WebCore::IntRect>& updateRects);
+    virtual float userSpaceScaleFactor() const { return 1; }
 
 #if USE(ACCELERATED_COMPOSITING)
     virtual void pageDidEnterAcceleratedCompositing();
diff --git a/Source/WebKit2/UIProcess/mac/CorrectionPanel.h b/Source/WebKit2/UIProcess/mac/CorrectionPanel.h
new file mode 100644
index 0000000..d4bc353
--- /dev/null
+++ b/Source/WebKit2/UIProcess/mac/CorrectionPanel.h
@@ -0,0 +1,63 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef CorrectionPanel_h
+#define CorrectionPanel_h
+
+#if !defined(BUILDING_ON_SNOW_LEOPARD)
+#import <AppKit/NSTextChecker.h>
+#import <WebCore/CorrectionPanelInfo.h>
+#import <wtf/RetainPtr.h>
+
+@class WKView;
+
+namespace WebKit {
+
+class CorrectionPanel {
+public:
+    CorrectionPanel();
+    ~CorrectionPanel();
+    void show(WKView*, WebCore::CorrectionPanelInfo::PanelType, const WebCore::FloatRect& boundingBoxOfReplacedString, const String& replacedString, const String& replacementString, const Vector<String>& alternativeReplacementStrings);
+    void dismiss(WebCore::ReasonForDismissingCorrectionPanel);
+    String dismissSoon(WebCore::ReasonForDismissingCorrectionPanel);
+    static void recordAutocorrectionResponse(WKView*, NSCorrectionResponse, const String& replacedString, const String& replacementString);
+
+private:
+    bool isShowing() const { return m_view; }
+    void dismissInternal(WebCore::ReasonForDismissingCorrectionPanel, bool dismissingExternally);
+    void handleAcceptedReplacement(NSString* acceptedReplacement, NSString* replaced, NSString* proposedReplacement, NSCorrectionBubbleType);
+
+    bool m_wasDismissedExternally;
+    WebCore::ReasonForDismissingCorrectionPanel m_reasonForDismissing;
+    RetainPtr<WKView> m_view;
+    RetainPtr<NSString> m_resultForSynchronousDismissal;
+    RetainPtr<NSCondition> m_resultCondition;
+};
+
+} // namespace WebKit
+
+#endif // !defined(BUILDING_ON_SNOW_LEOPARD)
+
+#endif // CorrectionPanel_h
diff --git a/Source/WebKit2/UIProcess/mac/CorrectionPanel.mm b/Source/WebKit2/UIProcess/mac/CorrectionPanel.mm
new file mode 100644
index 0000000..ab6818f
--- /dev/null
+++ b/Source/WebKit2/UIProcess/mac/CorrectionPanel.mm
@@ -0,0 +1,166 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#import "config.h"
+#if !defined(BUILDING_ON_SNOW_LEOPARD)
+#import "CorrectionPanel.h"
+
+#import "WebPageProxy.h"
+#import "WKView.h"
+#import "WKViewPrivate.h"
+
+using namespace WebCore;
+
+static inline NSCorrectionBubbleType correctionBubbleType(CorrectionPanelInfo::PanelType panelType)
+{
+    switch (panelType) {
+    case CorrectionPanelInfo::PanelTypeCorrection:
+        return NSCorrectionBubbleTypeCorrection;
+    case CorrectionPanelInfo::PanelTypeReversion:
+        return NSCorrectionBubbleTypeReversion;
+    case CorrectionPanelInfo::PanelTypeSpellingSuggestions:
+        return NSCorrectionBubbleTypeGuesses;
+    }
+    ASSERT_NOT_REACHED();
+    return NSCorrectionBubbleTypeCorrection;
+}
+
+namespace WebKit {
+
+CorrectionPanel::CorrectionPanel()
+    : m_wasDismissedExternally(false)
+    , m_reasonForDismissing(ReasonForDismissingCorrectionPanelIgnored)
+    , m_resultCondition(AdoptNS, [[NSCondition alloc] init])
+{
+}
+
+CorrectionPanel::~CorrectionPanel()
+{
+    dismissInternal(ReasonForDismissingCorrectionPanelIgnored, false);
+}
+
+void CorrectionPanel::show(WKView* view, CorrectionPanelInfo::PanelType type, const FloatRect& boundingBoxOfReplacedString, const String& replacedString, const String& replacementString, const Vector<String>& alternativeReplacementStrings)
+{
+    dismissInternal(ReasonForDismissingCorrectionPanelIgnored, false);
+    
+    if (!view)
+        return;
+
+    NSString* replacedStringAsNSString = replacedString;
+    NSString* replacementStringAsNSString = replacementString;
+    m_view = view;
+    NSCorrectionBubbleType bubbleType = correctionBubbleType(type);
+    
+    NSMutableArray* alternativeStrings = 0;
+    if (!alternativeReplacementStrings.isEmpty()) {
+        size_t size = alternativeReplacementStrings.size();
+        alternativeStrings = [NSMutableArray arrayWithCapacity:size];
+        for (size_t i = 0; i < size; ++i)
+            [alternativeStrings addObject:(NSString*)alternativeReplacementStrings[i]];
+    }
+
+    NSSpellChecker* spellChecker = [NSSpellChecker sharedSpellChecker];
+    [spellChecker showCorrectionBubbleOfType:bubbleType primaryString:replacementStringAsNSString alternativeStrings:alternativeStrings forStringInRect:boundingBoxOfReplacedString view:m_view.get() completionHandler:^(NSString* acceptedString) {
+        handleAcceptedReplacement(acceptedString, replacedStringAsNSString, replacementStringAsNSString, bubbleType);
+    }];
+}
+
+void CorrectionPanel::dismiss(ReasonForDismissingCorrectionPanel reason)
+{
+    dismissInternal(reason, true);
+}
+
+String CorrectionPanel::dismissSoon(ReasonForDismissingCorrectionPanel reason)
+{
+    if (!isShowing())
+        return String();
+
+    dismissInternal(reason, true);
+    [m_resultCondition.get() lock];
+    while (!m_resultForSynchronousDismissal)
+        [m_resultCondition.get() wait];
+    [m_resultCondition.get() unlock];
+    return m_resultForSynchronousDismissal.get();
+}
+
+void CorrectionPanel::dismissInternal(ReasonForDismissingCorrectionPanel reason, bool dismissingExternally)
+{
+    m_wasDismissedExternally = dismissingExternally;
+    if (!isShowing())
+        return;
+    
+    m_reasonForDismissing = reason;
+    m_resultForSynchronousDismissal.clear();
+    [[NSSpellChecker sharedSpellChecker] dismissCorrectionBubbleForView:m_view.get()];
+    m_view.clear();
+}
+
+void CorrectionPanel::recordAutocorrectionResponse(WKView* view, NSCorrectionResponse response, const String& replacedString, const String& replacementString)
+{
+    [[NSSpellChecker sharedSpellChecker] recordResponse:response toCorrection:replacementString forWord:replacedString language:nil inSpellDocumentWithTag:[view spellCheckerDocumentTag]];
+}
+
+void CorrectionPanel::handleAcceptedReplacement(NSString* acceptedReplacement, NSString* replaced, NSString* proposedReplacement,  NSCorrectionBubbleType correctionBubbleType)
+{
+    NSSpellChecker* spellChecker = [NSSpellChecker sharedSpellChecker];
+    NSInteger documentTag = [m_view.get() spellCheckerDocumentTag];
+    
+    switch (correctionBubbleType) {
+    case NSCorrectionBubbleTypeCorrection:
+        if (acceptedReplacement)
+            [spellChecker recordResponse:NSCorrectionResponseAccepted toCorrection:acceptedReplacement forWord:replaced language:nil inSpellDocumentWithTag:documentTag];
+        else {
+            if (!m_wasDismissedExternally || m_reasonForDismissing == ReasonForDismissingCorrectionPanelCancelled)
+                [spellChecker recordResponse:NSCorrectionResponseRejected toCorrection:proposedReplacement forWord:replaced language:nil inSpellDocumentWithTag:documentTag];
+            else
+                [spellChecker recordResponse:NSCorrectionResponseIgnored toCorrection:proposedReplacement forWord:replaced language:nil inSpellDocumentWithTag:documentTag];
+        }
+        break;
+    case NSCorrectionBubbleTypeReversion:
+        if (acceptedReplacement)
+            [spellChecker recordResponse:NSCorrectionResponseReverted toCorrection:replaced forWord:acceptedReplacement language:nil inSpellDocumentWithTag:documentTag];
+        break;
+    case NSCorrectionBubbleTypeGuesses:
+        if (acceptedReplacement)
+            [spellChecker recordResponse:NSCorrectionResponseAccepted toCorrection:acceptedReplacement forWord:replaced language:nil inSpellDocumentWithTag:documentTag];
+        break;
+    }
+    
+    if (!m_wasDismissedExternally) {
+        [m_view.get() handleCorrectionPanelResult:acceptedReplacement];
+        return;
+    }
+    
+    [m_resultCondition.get() lock];
+    if (acceptedReplacement)
+        m_resultForSynchronousDismissal.adoptNS([acceptedReplacement copy]);
+    [m_resultCondition.get() signal];
+    [m_resultCondition.get() unlock];
+}
+
+} // namespace WebKit
+
+#endif //!defined(BUILDING_ON_SNOW_LEOPARD)
+
diff --git a/Source/WebKit2/UIProcess/mac/WKFullScreenWindowController.h b/Source/WebKit2/UIProcess/mac/WKFullScreenWindowController.h
new file mode 100644
index 0000000..57311e7
--- /dev/null
+++ b/Source/WebKit2/UIProcess/mac/WKFullScreenWindowController.h
@@ -0,0 +1,74 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#if ENABLE(FULLSCREEN_API)
+
+#import <Cocoa/Cocoa.h>
+#import <wtf/RetainPtr.h>
+
+namespace WebKit { 
+class LayerTreeContext;
+}
+
+namespace WebCore {
+class IntRect;
+}
+
+@class WKView;
+
+@interface WKFullScreenWindowController : NSWindowController {
+@private
+    WKView *_webView;
+    RetainPtr<NSView> _webViewPlaceholder;
+    RetainPtr<NSView> _layerViewPlaceholder;
+    RetainPtr<NSView> _layerHostingView;
+    
+    BOOL _isAnimating;
+    BOOL _isFullScreen;
+    BOOL _isWindowLoaded;
+    BOOL _forceDisableAnimation;
+    BOOL _isPlaying;
+    CGRect _initialFrame;    
+    uint32_t _idleDisplaySleepAssertion;
+    uint32_t _idleSystemSleepAssertion;
+    NSTimer *_tickleTimer;
+}
+
+- (WKView*)webView;
+- (void)setWebView:(WKView*)webView;
+
+- (void)enterFullScreen:(NSScreen *)screen;
+- (void)exitFullScreen;
+- (void)beganEnterFullScreenAnimation;
+- (void)beganExitFullScreenAnimation;
+- (void)finishedEnterFullScreenAnimation:(bool)completed;
+- (void)finishedExitFullScreenAnimation:(bool)completed;
+- (void)enterAcceleratedCompositingMode:(const WebKit::LayerTreeContext&)context;
+- (void)exitAcceleratedCompositingMode;
+- (WebCore::IntRect)getFullScreenRect;
+
+@end
+
+#endif
diff --git a/Source/WebKit2/UIProcess/mac/WKFullScreenWindowController.mm b/Source/WebKit2/UIProcess/mac/WKFullScreenWindowController.mm
new file mode 100644
index 0000000..91eeaf6
--- /dev/null
+++ b/Source/WebKit2/UIProcess/mac/WKFullScreenWindowController.mm
@@ -0,0 +1,608 @@
+/*
+ * Copyright (C) 2009, 2010, 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#import "config.h"
+
+#if ENABLE(FULLSCREEN_API)
+
+#import "WKFullScreenWindowController.h"
+
+#import "LayerTreeContext.h"
+#import "WKAPICast.h"
+#import "WKViewInternal.h"
+#import "WebFullScreenManagerProxy.h"
+#import "WebPageProxy.h"
+#import <Carbon/Carbon.h> // For SetSystemUIMode()
+#import <IOKit/pwr_mgt/IOPMLib.h> // For IOPMAssertionCreate()
+#import <QuartzCore/QuartzCore.h>
+#import <WebCore/FloatRect.h>
+#import <WebCore/IntRect.h>
+#import <WebKitSystemInterface.h>
+
+static const NSTimeInterval tickleTimerInterval = 1.0;
+
+using namespace WebKit;
+using namespace WebCore;
+
+#if defined(BUILDING_ON_LEOPARD)
+@interface CATransaction(SnowLeopardConvenienceFunctions)
++ (void)setDisableActions:(BOOL)flag;
++ (void)setAnimationDuration:(CFTimeInterval)dur;
+@end
+
+@implementation CATransaction(SnowLeopardConvenienceFunctions)
++ (void)setDisableActions:(BOOL)flag
+{
+    [self setValue:[NSNumber numberWithBool:flag] forKey:kCATransactionDisableActions];
+}
+
++ (void)setAnimationDuration:(CFTimeInterval)dur
+{
+    [self setValue:[NSNumber numberWithDouble:dur] forKey:kCATransactionAnimationDuration];
+}
+@end
+
+#endif
+
+@interface WKFullScreenWindow : NSWindow
+{
+    NSView* _animationView;
+    CALayer* _backgroundLayer;
+}
+- (CALayer*)backgroundLayer;
+- (NSView*)animationView;
+@end
+
+@interface WKFullScreenWindowController(Private)
+- (void)_requestExitFullScreenWithAnimation:(BOOL)animation;
+- (void)_updateMenuAndDockForFullScreen;
+- (void)_updatePowerAssertions;
+- (WKFullScreenWindow *)_fullScreenWindow;
+- (CFTimeInterval)_animationDuration;
+- (void)_swapView:(NSView*)view with:(NSView*)otherView;
+- (WebFullScreenManagerProxy*)_manager;
+@end
+
+@interface NSWindow(IsOnActiveSpaceAdditionForTigerAndLeopard)
+- (BOOL)isOnActiveSpace;
+@end
+
+@implementation WKFullScreenWindowController
+
+#pragma mark -
+#pragma mark Initialization
+- (id)init
+{
+    NSWindow *window = [[WKFullScreenWindow alloc] initWithContentRect:NSZeroRect styleMask:NSBorderlessWindowMask backing:NSBackingStoreBuffered defer:NO];
+    self = [super initWithWindow:window];
+    [window release];
+    if (!self)
+        return nil;
+    [self windowDidLoad];
+    
+    return self;
+}
+
+- (void)dealloc
+{
+    [self setWebView:nil];
+    
+    [NSObject cancelPreviousPerformRequestsWithTarget:self];
+    
+    [[NSNotificationCenter defaultCenter] removeObserver:self];
+    [super dealloc];
+}
+
+- (void)windowDidLoad
+{
+    [super windowDidLoad];
+
+    [[NSNotificationCenter defaultCenter] addObserver:self selector:@selector(applicationDidResignActive:) name:NSApplicationDidResignActiveNotification object:NSApp];
+    [[NSNotificationCenter defaultCenter] addObserver:self selector:@selector(applicationDidChangeScreenParameters:) name:NSApplicationDidChangeScreenParametersNotification object:NSApp];
+}
+
+#pragma mark -
+#pragma mark Accessors
+
+- (WKView*)webView
+{
+    return _webView;
+}
+
+- (void)setWebView:(WKView *)webView
+{
+    [webView retain];
+    [_webView release];
+    _webView = webView;
+}
+
+#pragma mark -
+#pragma mark Notifications
+
+- (void)applicationDidResignActive:(NSNotification*)notification
+{   
+    // Check to see if the fullScreenWindow is on the active space; this function is available
+    // on 10.6 and later, so default to YES if the function is not available:
+    NSWindow* fullScreenWindow = [self _fullScreenWindow];
+    BOOL isOnActiveSpace = ([fullScreenWindow respondsToSelector:@selector(isOnActiveSpace)] ? [fullScreenWindow isOnActiveSpace] : YES);
+    
+    // Replicate the QuickTime Player (X) behavior when losing active application status:
+    // Is the fullScreen screen the main screen? (Note: this covers the case where only a 
+    // single screen is available.)  Is the fullScreen screen on the current space? IFF so, 
+    // then exit fullScreen mode. 
+    if ([fullScreenWindow screen] == [[NSScreen screens] objectAtIndex:0] && isOnActiveSpace)
+        [self _requestExitFullScreenWithAnimation:NO];
+}
+
+- (void)applicationDidChangeScreenParameters:(NSNotification*)notification
+{
+    // The user may have changed the main screen by moving the menu bar, or they may have changed
+    // the Dock's size or location, or they may have changed the fullScreen screen's dimensions. 
+    // Update our presentation parameters, and ensure that the full screen window occupies the 
+    // entire screen:
+    [self _updateMenuAndDockForFullScreen];
+    NSWindow* window = [self window];
+    [window setFrame:[[window screen] frame] display:YES];
+}
+
+#pragma mark -
+#pragma mark Exposed Interface
+
+- (void)enterFullScreen:(NSScreen *)screen
+{
+    if (_isFullScreen)
+        return;
+    
+    _isFullScreen = YES;
+    _isAnimating = YES;
+    
+    NSDisableScreenUpdates();
+    
+    if (!screen)
+        screen = [NSScreen mainScreen];
+    NSRect screenFrame = [screen frame];
+    
+    NSRect webViewFrame = [_webView convertRectToBase:[_webView frame]];
+    webViewFrame.origin = [[_webView window] convertBaseToScreen:webViewFrame.origin];
+        
+    // In the case of a multi-monitor setup where the webView straddles two
+    // monitors, we must create a window large enough to contain the destination
+    // frame and the initial frame.
+    NSRect windowFrame = NSUnionRect(screenFrame, webViewFrame);
+    [[self window] setFrame:windowFrame display:YES];
+    
+    CALayer* backgroundLayer = [[self _fullScreenWindow] backgroundLayer];
+    NSRect backgroundFrame = {[[self window] convertScreenToBase:screenFrame.origin], screenFrame.size};
+    backgroundFrame = [[[self window] contentView] convertRectFromBase:backgroundFrame];
+    
+    [CATransaction begin];
+    [CATransaction setDisableActions:YES];
+    [backgroundLayer setFrame:NSRectToCGRect(backgroundFrame)];
+    [CATransaction commit];
+
+    CFTimeInterval duration = [self _animationDuration];
+    [self _manager]->willEnterFullScreen();
+    [self _manager]->beginEnterFullScreenAnimation(duration);
+}
+
+- (void)beganEnterFullScreenAnimation
+{    
+    [self _updateMenuAndDockForFullScreen];   
+    [self _updatePowerAssertions];
+    
+    // In a previous incarnation, the NSWindow attached to this controller may have
+    // been on a different screen. Temporarily change the collectionBehavior of the window:
+    NSWindow* fullScreenWindow = [self window];
+    NSWindowCollectionBehavior behavior = [fullScreenWindow collectionBehavior];
+    [fullScreenWindow setCollectionBehavior:NSWindowCollectionBehaviorCanJoinAllSpaces];
+    [fullScreenWindow makeKeyAndOrderFront:self];
+    [fullScreenWindow setCollectionBehavior:behavior];
+
+    // Start the opacity animation. We can use implicit animations here because we don't care when
+    // the animation finishes.
+    [CATransaction begin];
+    [CATransaction setAnimationDuration:[self _animationDuration]];
+    [[[self _fullScreenWindow] backgroundLayer] setOpacity:1];
+    [CATransaction commit];
+
+    NSEnableScreenUpdates();
+    _isAnimating = YES;
+}
+
+- (void)finishedEnterFullScreenAnimation:(bool)completed
+{
+    NSDisableScreenUpdates();
+    
+    if (completed) {                
+        // Swap the webView placeholder into place.
+        if (!_webViewPlaceholder)
+            _webViewPlaceholder.adoptNS([[NSView alloc] init]);
+        [self _swapView:_webView with:_webViewPlaceholder.get()];
+        
+        // Then insert the WebView into the full screen window
+        NSView* animationView = [[self _fullScreenWindow] animationView];
+        [animationView addSubview:_webView positioned:NSWindowBelow relativeTo:_layerHostingView.get()];
+        [_webView setFrame:[animationView bounds]];
+        
+        // FIXME: In Barolo, orderIn will animate, which is not what we want.  Find a way
+        // to work around this behavior.
+        //[[_webViewPlaceholder.get() window] orderOut:self];
+        [[self window] makeKeyAndOrderFront:self];
+    }
+    
+    [self _manager]->didEnterFullScreen();
+    NSEnableScreenUpdates();
+    
+    _isAnimating = NO;
+}
+
+- (void)exitFullScreen
+{
+    if (!_isFullScreen)
+        return;
+    
+    _isFullScreen = NO;
+    _isAnimating = YES;
+    
+    NSDisableScreenUpdates();
+    
+    [self _manager]->willExitFullScreen();
+    [self _manager]->beginExitFullScreenAnimation([self _animationDuration]);
+}
+
+- (void)beganExitFullScreenAnimation
+{   
+    [self _updateMenuAndDockForFullScreen];   
+    [self _updatePowerAssertions];
+    
+    // The user may have moved the fullScreen window in Spaces, so temporarily change 
+    // the collectionBehavior of the webView's window:
+    NSWindow* webWindow = [[self webView] window];
+    NSWindowCollectionBehavior behavior = [webWindow collectionBehavior];
+    [webWindow setCollectionBehavior:NSWindowCollectionBehaviorCanJoinAllSpaces];
+    [webWindow orderWindow:NSWindowBelow relativeTo:[[self window] windowNumber]];
+    [webWindow setCollectionBehavior:behavior];
+    
+    // Swap the webView back into its original position:
+    if ([_webView window] == [self window])
+        [self _swapView:_webViewPlaceholder.get() with:_webView];
+    
+    [CATransaction begin];
+    [CATransaction setAnimationDuration:[self _animationDuration]];
+    [[[self _fullScreenWindow] backgroundLayer] setOpacity:0];
+    [CATransaction commit];
+    
+    NSEnableScreenUpdates();
+    _isAnimating = YES;
+}
+
+- (void)finishedExitFullScreenAnimation:(bool)completed
+{
+    NSDisableScreenUpdates();
+    
+    if (completed) {
+        [self _updateMenuAndDockForFullScreen];
+        [self _updatePowerAssertions];
+        [NSCursor setHiddenUntilMouseMoves:YES];
+                
+        [[self window] orderOut:self];
+        [[_webView window] makeKeyAndOrderFront:self];
+    }
+    
+    [self _manager]->didExitFullScreen();
+    NSEnableScreenUpdates();
+    
+    _isAnimating = NO;
+}
+
+- (void)enterAcceleratedCompositingMode:(const WebKit::LayerTreeContext&)layerTreeContext
+{
+    if (_layerHostingView)
+        return;
+
+    ASSERT(!layerTreeContext.isEmpty());
+    
+    // Create an NSView that will host our layer tree.
+    _layerHostingView.adoptNS([[NSView alloc] initWithFrame:[[self window] frame]]);
+    [_layerHostingView.get() setAutoresizingMask:NSViewWidthSizable | NSViewHeightSizable];
+    
+    [CATransaction begin];
+    [CATransaction setDisableActions:YES];
+    WKFullScreenWindow* window = [self _fullScreenWindow];
+    [[window animationView] addSubview:_layerHostingView.get()];
+    
+    // Create a root layer that will back the NSView.
+    RetainPtr<CALayer> rootLayer(AdoptNS, [[CALayer alloc] init]);
+#ifndef NDEBUG
+    [rootLayer.get() setName:@"Hosting root layer"];
+#endif
+    
+    CALayer *renderLayer = WKMakeRenderLayer(layerTreeContext.contextID);
+    [rootLayer.get() addSublayer:renderLayer];
+    
+    [_layerHostingView.get() setLayer:rootLayer.get()];
+    [_layerHostingView.get() setWantsLayer:YES];
+    [[window backgroundLayer] setHidden:NO];
+    [CATransaction commit];
+}
+
+- (void)exitAcceleratedCompositingMode
+{
+    if (!_layerHostingView)
+        return;
+    
+    [CATransaction begin];
+    [CATransaction setDisableActions:YES];
+    [_layerHostingView.get() removeFromSuperview];
+    [_layerHostingView.get() setLayer:nil];
+    [_layerHostingView.get() setWantsLayer:NO];
+    [[[self _fullScreenWindow] backgroundLayer] setHidden:YES];
+    [CATransaction commit];
+    
+    _layerHostingView = 0;
+}
+
+- (WebCore::IntRect)getFullScreenRect
+{
+    return enclosingIntRect([[self window] frame]);
+}
+
+#pragma mark -
+#pragma mark Internal Interface
+
+- (void)_updateMenuAndDockForFullScreen
+{
+    // NSApplicationPresentationOptions is available on > 10.6 only:
+#if !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
+    NSApplicationPresentationOptions options = NSApplicationPresentationDefault;
+    NSScreen* fullScreenScreen = [[self window] screen];
+    
+    if (_isFullScreen) {
+        // Auto-hide the menu bar if the fullScreenScreen contains the menu bar:
+        // NOTE: if the fullScreenScreen contains the menu bar but not the dock, we must still 
+        // auto-hide the dock, or an exception will be thrown.
+        if ([[NSScreen screens] objectAtIndex:0] == fullScreenScreen)
+            options |= (NSApplicationPresentationAutoHideMenuBar | NSApplicationPresentationAutoHideDock);
+        // Check if the current screen contains the dock by comparing the screen's frame to its
+        // visibleFrame; if a dock is present, the visibleFrame will differ. If the current screen
+        // contains the dock, hide it.
+        else if (!NSEqualRects([fullScreenScreen frame], [fullScreenScreen visibleFrame]))
+            options |= NSApplicationPresentationAutoHideDock;
+    }
+    
+    if ([NSApp respondsToSelector:@selector(setPresentationOptions:)])
+        [NSApp setPresentationOptions:options];
+    else
+#endif
+        SetSystemUIMode(_isFullScreen ? kUIModeNormal : kUIModeAllHidden, 0);
+}
+
+#if !defined(BUILDING_ON_TIGER) // IOPMAssertionCreateWithName not defined on < 10.5
+- (void)_disableIdleDisplaySleep
+{
+    if (_idleDisplaySleepAssertion == kIOPMNullAssertionID) 
+#if defined(BUILDING_ON_LEOPARD) // IOPMAssertionCreateWithName is not defined in the 10.5 SDK
+        IOPMAssertionCreate(kIOPMAssertionTypeNoDisplaySleep, kIOPMAssertionLevelOn, &_idleDisplaySleepAssertion);
+#else // IOPMAssertionCreate is depreciated in > 10.5
+    IOPMAssertionCreateWithName(kIOPMAssertionTypeNoDisplaySleep, kIOPMAssertionLevelOn, CFSTR("WebKit playing a video fullScreen."), &_idleDisplaySleepAssertion);
+#endif
+}
+
+- (void)_enableIdleDisplaySleep
+{
+    if (_idleDisplaySleepAssertion != kIOPMNullAssertionID) {
+        IOPMAssertionRelease(_idleDisplaySleepAssertion);
+        _idleDisplaySleepAssertion = kIOPMNullAssertionID;
+    }
+}
+
+- (void)_disableIdleSystemSleep
+{
+    if (_idleSystemSleepAssertion == kIOPMNullAssertionID) 
+#if defined(BUILDING_ON_LEOPARD) // IOPMAssertionCreateWithName is not defined in the 10.5 SDK
+        IOPMAssertionCreate(kIOPMAssertionTypeNoIdleSleep, kIOPMAssertionLevelOn, &_idleSystemSleepAssertion);
+#else // IOPMAssertionCreate is depreciated in > 10.5
+    IOPMAssertionCreateWithName(kIOPMAssertionTypeNoIdleSleep, kIOPMAssertionLevelOn, CFSTR("WebKit playing a video fullScreen."), &_idleSystemSleepAssertion);
+#endif
+}
+
+- (void)_enableIdleSystemSleep
+{
+    if (_idleSystemSleepAssertion != kIOPMNullAssertionID) {
+        IOPMAssertionRelease(_idleSystemSleepAssertion);
+        _idleSystemSleepAssertion = kIOPMNullAssertionID;
+    }
+}
+
+- (void)_enableTickleTimer
+{
+    [_tickleTimer invalidate];
+    [_tickleTimer release];
+    _tickleTimer = [[NSTimer scheduledTimerWithTimeInterval:tickleTimerInterval target:self selector:@selector(_tickleTimerFired) userInfo:nil repeats:YES] retain];
+}
+
+- (void)_disableTickleTimer
+{
+    [_tickleTimer invalidate];
+    [_tickleTimer release];
+    _tickleTimer = nil;
+}
+
+- (void)_tickleTimerFired
+{
+    UpdateSystemActivity(OverallAct);
+}
+#endif
+
+- (void)_updatePowerAssertions
+{
+#if !defined(BUILDING_ON_TIGER) 
+    if (_isPlaying && _isFullScreen) {
+        [self _disableIdleSystemSleep];
+        [self _disableIdleDisplaySleep];
+        [self _enableTickleTimer];
+    } else {
+        [self _enableIdleSystemSleep];
+        [self _enableIdleDisplaySleep];
+        [self _disableTickleTimer];
+    }
+#endif
+}
+
+- (WebFullScreenManagerProxy*)_manager
+{
+    WebPageProxy* webPage = toImpl([_webView pageRef]);
+    if (!webPage)
+        return 0;
+    return webPage->fullScreenManager();
+}
+
+- (void)_requestExit
+{
+    [self exitFullScreen];
+    _forceDisableAnimation = NO;
+}
+
+- (void)_requestExitFullScreenWithAnimation:(BOOL)animation
+{
+    _forceDisableAnimation = !animation;
+    [self performSelector:@selector(_requestExit) withObject:nil afterDelay:0];
+    
+}
+
+- (void)_swapView:(NSView*)view with:(NSView*)otherView
+{
+    [otherView setFrame:[view frame]];        
+    [otherView setAutoresizingMask:[view autoresizingMask]];
+    [otherView removeFromSuperview];
+    [[view superview] replaceSubview:view with:otherView];
+}
+
+#pragma mark -
+#pragma mark Utility Functions
+
+- (WKFullScreenWindow *)_fullScreenWindow
+{
+    ASSERT([[self window] isKindOfClass:[WKFullScreenWindow class]]);
+    return (WKFullScreenWindow *)[self window];
+}
+
+- (CFTimeInterval)_animationDuration
+{
+    static const CFTimeInterval defaultDuration = 0.5;
+    CFTimeInterval duration = defaultDuration;
+#if !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
+    NSUInteger modifierFlags = [NSEvent modifierFlags];
+#else
+    NSUInteger modifierFlags = [[NSApp currentEvent] modifierFlags];
+#endif
+    if ((modifierFlags & NSControlKeyMask) == NSControlKeyMask)
+        duration *= 2;
+    if ((modifierFlags & NSShiftKeyMask) == NSShiftKeyMask)
+        duration *= 10;
+    if (_forceDisableAnimation) {
+        // This will disable scale animation
+        duration = 0;
+    }
+    return duration;
+}
+
+@end
+
+#pragma mark -
+@implementation WKFullScreenWindow
+
+- (id)initWithContentRect:(NSRect)contentRect styleMask:(NSUInteger)aStyle backing:(NSBackingStoreType)bufferingType defer:(BOOL)flag
+{
+    UNUSED_PARAM(aStyle);
+    self = [super initWithContentRect:contentRect styleMask:NSBorderlessWindowMask backing:bufferingType defer:flag];
+    if (!self)
+        return nil;
+    [self setOpaque:NO];
+    [self setBackgroundColor:[NSColor clearColor]];
+    [self setIgnoresMouseEvents:NO];
+    [self setAcceptsMouseMovedEvents:YES];
+    [self setReleasedWhenClosed:NO];
+    [self setHasShadow:YES];
+#if !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
+    [self setMovable:NO];
+#else
+    [self setMovableByWindowBackground:NO];
+#endif
+    
+    NSView* contentView = [self contentView];
+    _animationView = [[NSView alloc] initWithFrame:[contentView bounds]];
+    
+    CALayer* contentLayer = [[CALayer alloc] init];
+    [_animationView setLayer:contentLayer];
+    [_animationView setWantsLayer:YES];
+    [_animationView setAutoresizingMask:NSViewWidthSizable|NSViewHeightSizable];
+    [contentView addSubview:_animationView];
+    
+    _backgroundLayer = [[CALayer alloc] init];
+    [contentLayer addSublayer:_backgroundLayer];
+    
+    [_backgroundLayer setBackgroundColor:CGColorGetConstantColor(kCGColorBlack)];
+    [_backgroundLayer setOpacity:0];
+    return self;
+}
+
+- (void)dealloc
+{
+    [_animationView release];
+    [_backgroundLayer release];
+    [super dealloc];
+}
+
+- (BOOL)canBecomeKeyWindow
+{
+    return YES;
+}
+
+- (void)keyDown:(NSEvent *)theEvent
+{
+    if ([[theEvent charactersIgnoringModifiers] isEqual:@"\e"]) // Esacpe key-code
+        [self cancelOperation:self];
+    else [super keyDown:theEvent];
+}
+
+- (void)cancelOperation:(id)sender
+{
+    UNUSED_PARAM(sender);
+    [[self windowController] _requestExitFullScreenWithAnimation:YES];
+}
+
+- (CALayer*)backgroundLayer
+{
+    return _backgroundLayer;
+}
+
+- (NSView*)animationView
+{
+    return _animationView;
+}
+@end
+
+#endif
diff --git a/Source/WebKit2/UIProcess/mac/WebContextMac.mm b/Source/WebKit2/UIProcess/mac/WebContextMac.mm
index 498b6e7..f7c186d 100644
--- a/Source/WebKit2/UIProcess/mac/WebContextMac.mm
+++ b/Source/WebKit2/UIProcess/mac/WebContextMac.mm
@@ -35,6 +35,12 @@ using namespace WebCore;
 
 NSString *WebDatabaseDirectoryDefaultsKey = @"WebDatabaseDirectory";
 NSString *WebKitLocalCacheDefaultsKey = @"WebKitLocalCache";
+NSString *WebStorageDirectoryDefaultsKey = @"WebKitLocalStorageDatabasePathPreferenceKey";
+
+static NSString *WebKitApplicationDidChangeAccessibilityEnhancedUserInterfaceNotification = @"NSApplicationDidChangeAccessibilityEnhancedUserInterfaceNotification";
+
+// FIXME: <rdar://problem/9138817> - After this "backwards compatibility" radar is removed, this code should be removed to only return an empty String.
+NSString *WebIconDatabaseDirectoryDefaultsKey = @"WebIconDatabaseDirectoryDefaultsKey";
 
 namespace WebKit {
 
@@ -97,8 +103,18 @@ void WebContext::platformInitializeWebProcess(WebProcessCreationParameters& para
 #if USE(CFURLSTORAGESESSIONS)
     parameters.uiProcessBundleIdentifier = String([[NSBundle mainBundle] bundleIdentifier]);
 #endif
+    
+    // Listen for enhanced accessibility changes and propagate them to the WebProcess.
+    m_enhancedAccessibilityObserver = [[NSNotificationCenter defaultCenter] addObserverForName:WebKitApplicationDidChangeAccessibilityEnhancedUserInterfaceNotification object:nil queue:[NSOperationQueue currentQueue] usingBlock:^(NSNotification *note) {
+        setEnhancedAccessibility([[[note userInfo] objectForKey:@"AXEnhancedUserInterface"] boolValue]);
+    }];
 }
 
+void WebContext::platformInvalidateContext()
+{
+    [[NSNotificationCenter defaultCenter] removeObserver:(id)m_enhancedAccessibilityObserver.get()];
+}
+    
 String WebContext::platformDefaultDatabaseDirectory() const
 {
     NSString *databasesDirectory = [[NSUserDefaults standardUserDefaults] objectForKey:WebDatabaseDirectoryDefaultsKey];
@@ -107,5 +123,22 @@ String WebContext::platformDefaultDatabaseDirectory() const
     return [databasesDirectory stringByStandardizingPath];
 }
 
+String WebContext::platformDefaultIconDatabasePath() const
+{
+    // FIXME: <rdar://problem/9138817> - After this "backwards compatibility" radar is removed, this code should be removed to only return an empty String.
+    NSString *databasesDirectory = [[NSUserDefaults standardUserDefaults] objectForKey:WebIconDatabaseDirectoryDefaultsKey];
+    if (!databasesDirectory || ![databasesDirectory isKindOfClass:[NSString class]])
+        databasesDirectory = @"~/Library/Icons/WebpageIcons.db";
+    return [databasesDirectory stringByStandardizingPath];
+}
+
+String WebContext::platformDefaultLocalStorageDirectory() const
+{
+    NSString *localStorageDirectory = [[NSUserDefaults standardUserDefaults] objectForKey:WebStorageDirectoryDefaultsKey];
+    if (!localStorageDirectory || ![localStorageDirectory isKindOfClass:[NSString class]])
+        localStorageDirectory = @"~/Library/WebKit/LocalStorage";
+    return [localStorageDirectory stringByStandardizingPath];
+}
+
 } // namespace WebKit
 
diff --git a/Source/WebKit2/UIProcess/mac/WebContextMenuProxyMac.mm b/Source/WebKit2/UIProcess/mac/WebContextMenuProxyMac.mm
index 67139b3..fd0f534 100644
--- a/Source/WebKit2/UIProcess/mac/WebContextMenuProxyMac.mm
+++ b/Source/WebKit2/UIProcess/mac/WebContextMenuProxyMac.mm
@@ -199,6 +199,9 @@ void WebContextMenuProxyMac::populate(const Vector<WebContextMenuItemData>& item
 
 void WebContextMenuProxyMac::showContextMenu(const IntPoint& menuLocation, const Vector<WebContextMenuItemData>& items)
 {
+    if (items.isEmpty())
+        return;
+    
     populate(items);
     [[WKMenuTarget sharedMenuTarget] setMenuProxy:this];
     
@@ -215,14 +218,12 @@ void WebContextMenuProxyMac::showContextMenu(const IntPoint& menuLocation, const
     float vertOffset = roundf((NSMaxY(menuRect) - NSMaxY(titleFrame)) + NSHeight(titleFrame));
     NSPoint location = NSMakePoint(NSMinX(menuRect), NSMaxY(menuRect) - vertOffset);
 
-    RetainPtr<NSView> dummyView(AdoptNS, [[NSView alloc] initWithFrame:menuRect]);
-    [m_webView addSubview:dummyView.get()];
-    location = [dummyView.get() convertPoint:location fromView:m_webView];
-
-    WKPopupMenu(menu, location, roundf(NSWidth(menuRect)), dummyView.get(), -1, nil);
+    location = [m_webView convertPoint:location toView:nil];
+    location = [m_webView.window convertBaseToScreen:location];
+ 
+    WKPopupContextMenu(menu, location);
 
     [m_popup.get() dismissPopUp];
-    [dummyView.get() removeFromSuperview];
 }
 
 void WebContextMenuProxyMac::hideContextMenu()
diff --git a/Source/WebKit2/UIProcess/mac/WebCookieManagerProxyMac.mm b/Source/WebKit2/UIProcess/mac/WebCookieManagerProxyMac.mm
new file mode 100644
index 0000000..6a31346
--- /dev/null
+++ b/Source/WebKit2/UIProcess/mac/WebCookieManagerProxyMac.mm
@@ -0,0 +1,39 @@
+/*
+ * Copyright (C) 2011, 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#import "config.h"
+#import "WebCookieManagerProxy.h"
+
+namespace WebKit {
+
+void WebCookieManagerProxy::persistHTTPCookieAcceptPolicy(HTTPCookieAcceptPolicy policy)
+{
+    // FIXME: The sandbox appears to prevent persisting the new policy to disk, so we must set the
+    // policy in the UI Process as well as in the Web Process (to make sure it gets set on any
+    // Private Browsing Cookie Storage).
+    [[NSHTTPCookieStorage sharedHTTPCookieStorage] setCookieAcceptPolicy:policy];
+}
+
+} // namespace WebKit
diff --git a/Source/WebKit2/UIProcess/mac/WebFullScreenManagerProxyMac.mm b/Source/WebKit2/UIProcess/mac/WebFullScreenManagerProxyMac.mm
new file mode 100644
index 0000000..d533573
--- /dev/null
+++ b/Source/WebKit2/UIProcess/mac/WebFullScreenManagerProxyMac.mm
@@ -0,0 +1,101 @@
+/*
+ * Copyright (C) 2010 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WebFullScreenManagerProxy.h"
+#include "LayerTreeContext.h"
+#include "WKFullScreenWindowController.h"
+#include "WKViewInternal.h"
+
+#if ENABLE(FULLSCREEN_API)
+
+namespace WebKit {
+
+void WebFullScreenManagerProxy::enterFullScreen()
+{
+    if (!m_webView)
+        return;
+    [[m_webView fullScreenWindowController] enterFullScreen:nil];
+}
+
+void WebFullScreenManagerProxy::exitFullScreen()
+{
+    if (!m_webView)
+        return;
+    [[m_webView fullScreenWindowController] exitFullScreen];
+}
+
+void WebFullScreenManagerProxy::beganEnterFullScreenAnimation()
+{
+    if (!m_webView)
+        return;
+    [[m_webView fullScreenWindowController] beganEnterFullScreenAnimation];
+}
+
+void WebFullScreenManagerProxy::finishedEnterFullScreenAnimation(bool completed)
+{
+    if (!m_webView)
+        return;
+    [[m_webView fullScreenWindowController] finishedEnterFullScreenAnimation:completed];
+}
+
+void WebFullScreenManagerProxy::beganExitFullScreenAnimation()
+{
+    if (!m_webView)
+        return;
+    [[m_webView fullScreenWindowController] beganExitFullScreenAnimation];
+}
+
+void WebFullScreenManagerProxy::finishedExitFullScreenAnimation(bool completed)
+{
+    if (!m_webView)
+        return;
+    [[m_webView fullScreenWindowController] finishedExitFullScreenAnimation:completed];
+}
+    
+void WebFullScreenManagerProxy::enterAcceleratedCompositingMode(const LayerTreeContext& context)
+{
+    if (!m_webView)
+        return;
+    [[m_webView fullScreenWindowController] enterAcceleratedCompositingMode:context];
+}
+
+void WebFullScreenManagerProxy::exitAcceleratedCompositingMode()
+{
+    if (!m_webView)
+        return;
+    [[m_webView fullScreenWindowController] exitAcceleratedCompositingMode];
+}
+
+void WebFullScreenManagerProxy::getFullScreenRect(WebCore::IntRect& rect)
+{
+    if (!m_webView)
+        return;
+    rect = [[m_webView fullScreenWindowController] getFullScreenRect];
+}
+
+} // namespace WebKit
+
+#endif
diff --git a/Source/WebKit2/UIProcess/mac/WebInspectorProxyMac.mm b/Source/WebKit2/UIProcess/mac/WebInspectorProxyMac.mm
index 67d184c..9657764 100644
--- a/Source/WebKit2/UIProcess/mac/WebInspectorProxyMac.mm
+++ b/Source/WebKit2/UIProcess/mac/WebInspectorProxyMac.mm
@@ -32,6 +32,7 @@
 #import "WKView.h"
 #import "WebPageProxy.h"
 #import <WebKitSystemInterface.h>
+#import <WebCore/LocalizedStrings.h>
 #import <wtf/text/WTFString.h>
 
 using namespace WebCore;
@@ -134,8 +135,7 @@ void WebInspectorProxy::platformClose()
 
 void WebInspectorProxy::platformInspectedURLChanged(const String& urlString)
 {
-    // FIXME: this should be made localizable once WebKit2 supports it. <rdar://problem/8728860>
-    NSString *title = [NSString stringWithFormat:@"Web Inspector \u2014 %@", (NSString *)urlString];
+    NSString *title = [NSString stringWithFormat:UI_STRING("Web Inspector — %@", "Web Inspector window title"), (NSString *)urlString];
     [m_inspectorWindow.get() setTitle:title];
 }
 
diff --git a/Source/WebKit2/UIProcess/mac/WebPageProxyMac.mm b/Source/WebKit2/UIProcess/mac/WebPageProxyMac.mm
index 1d3ed53..90df81e 100644
--- a/Source/WebKit2/UIProcess/mac/WebPageProxyMac.mm
+++ b/Source/WebKit2/UIProcess/mac/WebPageProxyMac.mm
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2010 Apple Inc. All rights reserved.
+ * Copyright (C) 2010, 2011 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -26,7 +26,13 @@
 #import "config.h"
 #import "WebPageProxy.h"
 
+#import "DataReference.h"
+#import "DictionaryPopupInfo.h"
+#import "NativeWebKeyboardEvent.h"
 #import "PageClient.h"
+#import "TextChecker.h"
+#import "WebPageMessages.h"
+#import "WebProcessProxy.h"
 #import <wtf/text/StringConcatenate.h>
 
 @interface NSApplication (Details)
@@ -113,4 +119,133 @@ CGContextRef WebPageProxy::containingWindowGraphicsContext()
     return m_pageClient->containingWindowGraphicsContext();
 }
 
+void WebPageProxy::updateWindowIsVisible(bool windowIsVisible)
+{
+    if (!isValid())
+        return;
+    process()->send(Messages::WebPage::SetWindowIsVisible(windowIsVisible), m_pageID);
+}
+
+void WebPageProxy::windowAndViewFramesChanged(const IntRect& windowFrameInScreenCoordinates, const IntRect& viewFrameInWindowCoordinates, const IntPoint& accessibilityViewCoordinates)
+{
+    if (!isValid())
+        return;
+
+    process()->send(Messages::WebPage::WindowAndViewFramesChanged(windowFrameInScreenCoordinates, viewFrameInWindowCoordinates, accessibilityViewCoordinates), m_pageID);
+}
+
+void WebPageProxy::getMarkedRange(uint64_t& location, uint64_t& length)
+{
+    process()->sendSync(Messages::WebPage::GetMarkedRange(), Messages::WebPage::GetMarkedRange::Reply(location, length), m_pageID);
+}
+    
+uint64_t WebPageProxy::characterIndexForPoint(const IntPoint point)
+{
+    uint64_t result;
+    process()->sendSync(Messages::WebPage::CharacterIndexForPoint(point), Messages::WebPage::CharacterIndexForPoint::Reply(result), m_pageID);
+    return result;
+}
+
+WebCore::IntRect WebPageProxy::firstRectForCharacterRange(uint64_t location, uint64_t length)
+{
+    IntRect resultRect;
+    process()->sendSync(Messages::WebPage::FirstRectForCharacterRange(location, length), Messages::WebPage::FirstRectForCharacterRange::Reply(resultRect), m_pageID);
+    return resultRect;
+}
+    
+bool WebPageProxy::writeSelectionToPasteboard(const String& pasteboardName, const Vector<String>& pasteboardTypes)
+{
+    bool result;
+    const double MessageTimeout = 20;
+    process()->sendSync(Messages::WebPage::WriteSelectionToPasteboard(pasteboardName, pasteboardTypes), Messages::WebPage::WriteSelectionToPasteboard::Reply(result), m_pageID, MessageTimeout);
+    return result;
+}
+
+bool WebPageProxy::readSelectionFromPasteboard(const String& pasteboardName)
+{
+    bool result;
+    const double MessageTimeout = 20;
+    process()->sendSync(Messages::WebPage::ReadSelectionFromPasteboard(pasteboardName), Messages::WebPage::ReadSelectionFromPasteboard::Reply(result), m_pageID, MessageTimeout);
+    return result;
+}
+
+void WebPageProxy::setDragImage(const WebCore::IntPoint& clientPosition, const ShareableBitmap::Handle& dragImageHandle, bool isLinkDrag)
+{
+    RefPtr<ShareableBitmap> dragImage = ShareableBitmap::create(dragImageHandle);
+    if (!dragImage)
+        return;
+    
+    m_pageClient->setDragImage(clientPosition, dragImage.release(), isLinkDrag);
+}
+
+void WebPageProxy::performDictionaryLookupAtLocation(const WebCore::FloatPoint& point)
+{
+    if (!isValid())
+        return;
+
+    process()->send(Messages::WebPage::PerformDictionaryLookupAtLocation(point), m_pageID); 
+}
+
+void WebPageProxy::interpretKeyEvent(uint32_t type, Vector<KeypressCommand>& commandsList, uint32_t selectionStart, uint32_t selectionEnd, Vector<CompositionUnderline>& underlines)
+{
+    m_pageClient->interceptKeyEvent(m_keyEventQueue.first(), commandsList, selectionStart, selectionEnd, underlines);
+}
+
+// Complex text input support for plug-ins.
+void WebPageProxy::sendComplexTextInputToPlugin(uint64_t pluginComplexTextInputIdentifier, const String& textInput)
+{
+    if (!isValid())
+        return;
+    
+    process()->send(Messages::WebPage::SendComplexTextInputToPlugin(pluginComplexTextInputIdentifier, textInput), m_pageID);
+}
+
+void WebPageProxy::uppercaseWord()
+{
+    process()->send(Messages::WebPage::UppercaseWord(), m_pageID);
+}
+
+void WebPageProxy::lowercaseWord()
+{
+    process()->send(Messages::WebPage::LowercaseWord(), m_pageID);
+}
+
+void WebPageProxy::capitalizeWord()
+{
+    process()->send(Messages::WebPage::CapitalizeWord(), m_pageID);
+}
+
+void WebPageProxy::setSmartInsertDeleteEnabled(bool isSmartInsertDeleteEnabled)
+{ 
+    if (m_isSmartInsertDeleteEnabled == isSmartInsertDeleteEnabled)
+        return;
+
+    TextChecker::setSmartInsertDeleteEnabled(isSmartInsertDeleteEnabled);
+    m_isSmartInsertDeleteEnabled = isSmartInsertDeleteEnabled;
+    process()->send(Messages::WebPage::SetSmartInsertDeleteEnabled(isSmartInsertDeleteEnabled), m_pageID);
+}
+
+void WebPageProxy::didPerformDictionaryLookup(const String& text, const DictionaryPopupInfo& dictionaryPopupInfo)
+{
+    m_pageClient->didPerformDictionaryLookup(text, m_viewScaleFactor, dictionaryPopupInfo);
+}
+    
+void WebPageProxy::registerWebProcessAccessibilityToken(const CoreIPC::DataReference& data)
+{
+    m_pageClient->accessibilityWebProcessTokenReceived(data);
+}    
+    
+void WebPageProxy::registerUIProcessAccessibilityTokens(const CoreIPC::DataReference& elementToken, const CoreIPC::DataReference& windowToken)
+{
+    if (!isValid())
+        return;
+
+    process()->send(Messages::WebPage::RegisterUIProcessAccessibilityTokens(elementToken, windowToken), m_pageID);
+}
+
+void WebPageProxy::setComplexTextInputEnabled(uint64_t pluginComplexTextInputIdentifier, bool complexTextInputEnabled)
+{
+    m_pageClient->setComplexTextInputEnabled(pluginComplexTextInputIdentifier, complexTextInputEnabled);
+}
+
 } // namespace WebKit
diff --git a/Source/WebKit2/UIProcess/qt/WebContextMenuProxyQt.cpp b/Source/WebKit2/UIProcess/qt/WebContextMenuProxyQt.cpp
index 777f98c..16283bc 100644
--- a/Source/WebKit2/UIProcess/qt/WebContextMenuProxyQt.cpp
+++ b/Source/WebKit2/UIProcess/qt/WebContextMenuProxyQt.cpp
@@ -82,6 +82,9 @@ PassRefPtr<WebContextMenuProxyQt> WebContextMenuProxyQt::create(QWKPage* page)
 
 void WebContextMenuProxyQt::showContextMenu(const IntPoint& position, const Vector<WebContextMenuItemData>& items)
 {
+    if (items.isEmpty())
+        return;
+
     OwnPtr<QMenu> menu = createContextMenu(items);
 
     // We send the signal, even with no items, because the client should be able to show custom items
diff --git a/Source/WebKit2/UIProcess/qt/WebContextQt.cpp b/Source/WebKit2/UIProcess/qt/WebContextQt.cpp
index c1301d5..b46587e 100644
--- a/Source/WebKit2/UIProcess/qt/WebContextQt.cpp
+++ b/Source/WebKit2/UIProcess/qt/WebContextQt.cpp
@@ -47,10 +47,26 @@ void WebContext::platformInitializeWebProcess(WebProcessCreationParameters&)
     qRegisterMetaType<QProcess::ExitStatus>("QProcess::ExitStatus");
 }
 
+void WebContext::platformInvalidateContext()
+{
+}
+
 String WebContext::platformDefaultDatabaseDirectory() const
 {
     // FIXME: Implement.
     return "";
 }
 
+String WebContext::platformDefaultIconDatabasePath() const
+{
+    // FIXME: Implement.
+    return "";
+}
+
+String WebContext::platformDefaultLocalStorageDirectory() const
+{
+    // FIXME: Implement.
+    return "";
+}
+
 } // namespace WebKit
diff --git a/Source/WebKit2/UIProcess/win/WebContextMenuProxyWin.cpp b/Source/WebKit2/UIProcess/win/WebContextMenuProxyWin.cpp
index 5afd07e..4b5a5a7 100644
--- a/Source/WebKit2/UIProcess/win/WebContextMenuProxyWin.cpp
+++ b/Source/WebKit2/UIProcess/win/WebContextMenuProxyWin.cpp
@@ -73,6 +73,9 @@ void WebContextMenuProxyWin::populateMenu(HMENU menu, const Vector<WebContextMen
 
 void WebContextMenuProxyWin::showContextMenu(const IntPoint& origin, const Vector<WebContextMenuItemData>& items)
 {
+    if (items.isEmpty())
+        return;
+
     // Hide any context menu we have showing (this also destroys the menu).
     hideContextMenu();
 
diff --git a/Source/WebKit2/UIProcess/win/WebContextWin.cpp b/Source/WebKit2/UIProcess/win/WebContextWin.cpp
index 26708d7..d5fd859 100644
--- a/Source/WebKit2/UIProcess/win/WebContextWin.cpp
+++ b/Source/WebKit2/UIProcess/win/WebContextWin.cpp
@@ -64,22 +64,39 @@ void WebContext::platformInitializeWebProcess(WebProcessCreationParameters& para
 
     RetainPtr<CFStringRef> cfURLCachePath(AdoptCF, wkCopyFoundationCacheDirectory());
     parameters.cfURLCachePath = String(cfURLCachePath.get());
-    // Remove the ending '/' (necessary to have CFNetwork find the Cache file).
+    // Remove the ending '\' (necessary to have CFNetwork find the Cache file).
     ASSERT(parameters.cfURLCachePath.length());
-    if (parameters.cfURLCachePath[parameters.cfURLCachePath.length() - 1] == '/')
+    if (parameters.cfURLCachePath[parameters.cfURLCachePath.length() - 1] == '\\')
         parameters.cfURLCachePath.remove(parameters.cfURLCachePath.length() - 1);
 
 #if USE(CFURLSTORAGESESSIONS)
     parameters.uiProcessBundleIdentifier = String(reinterpret_cast<CFStringRef>(CFBundleGetValueForInfoDictionaryKey(CFBundleGetMainBundle(), kCFBundleIdentifierKey)));
 #endif // USE(CFURLSTORAGESESSIONS)
 
+    parameters.initialHTTPCookieAcceptPolicy = m_initialHTTPCookieAcceptPolicy;
+
 #endif // USE(CFNETWORK)
 }
 
+void WebContext::platformInvalidateContext()
+{
+}
+
 String WebContext::platformDefaultDatabaseDirectory() const
 {
     return WebCore::pathByAppendingComponent(WebCore::localUserSpecificStorageDirectory(), "Databases");
 }
 
+String WebContext::platformDefaultIconDatabasePath() const
+{
+    // IconDatabase should be disabled by default on Windows, and should therefore have no default path.
+    return String();
+}
+
+String WebContext::platformDefaultLocalStorageDirectory() const
+{
+    return WebCore::pathByAppendingComponent(WebCore::localUserSpecificStorageDirectory(), "LocalStorage");
+}
+
 } // namespace WebKit
 
diff --git a/Source/WebKit2/UIProcess/win/WebPageProxyWin.cpp b/Source/WebKit2/UIProcess/win/WebPageProxyWin.cpp
index 186ad44..1745a06 100644
--- a/Source/WebKit2/UIProcess/win/WebPageProxyWin.cpp
+++ b/Source/WebKit2/UIProcess/win/WebPageProxyWin.cpp
@@ -28,6 +28,7 @@
 
 #include "resource.h"
 #include <tchar.h>
+#include <WebCore/SystemInfo.h>
 #include <WebCore/WebCoreInstanceHandle.h>
 #include <wtf/StdLibExtras.h>
 #include <wtf/text/StringConcatenate.h>
@@ -36,30 +37,6 @@ using namespace WebCore;
 
 namespace WebKit {
 
-static String windowsVersion()
-{
-   String osVersion;
-   OSVERSIONINFO versionInfo = { 0 };
-   versionInfo.dwOSVersionInfoSize = sizeof(versionInfo);
-   ::GetVersionEx(&versionInfo);
-
-   if (versionInfo.dwPlatformId == VER_PLATFORM_WIN32_WINDOWS) {
-       if (versionInfo.dwMajorVersion == 4) {
-           if (versionInfo.dwMinorVersion == 0)
-               osVersion = "Windows 95";
-           else if (versionInfo.dwMinorVersion == 10)
-               osVersion = "Windows 98";
-           else if (versionInfo.dwMinorVersion == 90)
-               osVersion = "Windows 98; Win 9x 4.90";
-       }
-   } else if (versionInfo.dwPlatformId == VER_PLATFORM_WIN32_NT)
-       osVersion = makeString("Windows NT ", String::number(versionInfo.dwMajorVersion), '.', String::number(versionInfo.dwMinorVersion));
-
-   if (!osVersion.length())
-       osVersion = makeString("Windows ", String::number(versionInfo.dwMajorVersion), '.', String::number(versionInfo.dwMinorVersion));
-   return osVersion;
-}
-
 static String userVisibleWebKitVersionString()
 {
     LPWSTR buildNumberStringPtr;
@@ -71,12 +48,10 @@ static String userVisibleWebKitVersionString()
 
 String WebPageProxy::standardUserAgent(const String& applicationNameForUserAgent)
 {
-    DEFINE_STATIC_LOCAL(String, osVersion, (windowsVersion()));
+    DEFINE_STATIC_LOCAL(String, osVersion, (windowsVersionForUAString()));
     DEFINE_STATIC_LOCAL(String, webKitVersion, (userVisibleWebKitVersionString()));
 
-    if (applicationNameForUserAgent.isEmpty())
-        return makeString("Mozilla/5.0 (", osVersion, ") AppleWebKit/", webKitVersion, " (KHTML, like Gecko)");
-    return makeString("Mozilla/5.0 (", osVersion, ") AppleWebKit/", webKitVersion, " (KHTML, like Gecko) ", applicationNameForUserAgent);
+    return makeString("Mozilla/5.0 (", osVersion, ") AppleWebKit/", webKitVersion, " (KHTML, like Gecko)", applicationNameForUserAgent.isEmpty() ? "" : " ", applicationNameForUserAgent);
 }
 
 } // namespace WebKit
diff --git a/Source/WebKit2/UIProcess/win/WebUndoClient.cpp b/Source/WebKit2/UIProcess/win/WebUndoClient.cpp
new file mode 100644
index 0000000..9bc96f5
--- /dev/null
+++ b/Source/WebKit2/UIProcess/win/WebUndoClient.cpp
@@ -0,0 +1,53 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WebUndoClient.h"
+
+#include "WKAPICast.h"
+#include "WebEditCommandProxy.h"
+#include "WebView.h"
+
+namespace WebKit {
+
+void WebUndoClient::registerEditCommand(WebView* view, PassRefPtr<WebEditCommandProxy> prpCommand, WebPageProxy::UndoOrRedo undoOrRedo)
+{
+    if (!m_client.registerEditCommand)
+        return;
+
+    RefPtr<WebEditCommandProxy> command = prpCommand;
+    m_client.registerEditCommand(toAPI(view), toAPI(command.release().releaseRef()), (undoOrRedo == WebPageProxy::Undo) ? kWKViewUndo : kWKViewRedo, m_client.clientInfo);
+}
+
+void WebUndoClient::clearAllEditCommands(WebView* view)
+{
+    if (!m_client.clearAllEditCommands)
+        return;
+    
+    m_client.clearAllEditCommands(toAPI(view), m_client.clientInfo);
+}
+
+} // namespace WebKit
+
diff --git a/Source/WebKit2/UIProcess/win/WebUndoClient.h b/Source/WebKit2/UIProcess/win/WebUndoClient.h
new file mode 100755
index 0000000..12582c0
--- /dev/null
+++ b/Source/WebKit2/UIProcess/win/WebUndoClient.h
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebUndoClient_h
+#define WebUndoClient_h
+
+#include "APIClient.h"
+#include "WKView.h"
+#include "WebPageProxy.h"
+#include <wtf/Forward.h>
+
+namespace WebKit {
+
+class WebEditCommandProxy;
+
+class WebUndoClient : public APIClient<WKViewUndoClient> {
+public:
+    void registerEditCommand(WebView*, PassRefPtr<WebEditCommandProxy>, WebPageProxy::UndoOrRedo);
+    void clearAllEditCommands(WebView*);
+};
+
+} // namespace WebKit
+
+#endif // WebUndoClient_h
diff --git a/Source/WebKit2/UIProcess/win/WebView.cpp b/Source/WebKit2/UIProcess/win/WebView.cpp
index 62e0c42..1447864 100644
--- a/Source/WebKit2/UIProcess/win/WebView.cpp
+++ b/Source/WebKit2/UIProcess/win/WebView.cpp
@@ -44,7 +44,9 @@
 #include <WebCore/BitmapInfo.h>
 #include <WebCore/Cursor.h>
 #include <WebCore/FloatRect.h>
+#if PLATFORM(CG)
 #include <WebCore/GraphicsContextCG.h>
+#endif
 #include <WebCore/IntRect.h>
 #include <WebCore/SoftLinking.h>
 #include <WebCore/WebCoreInstanceHandle.h>
@@ -149,6 +151,12 @@ LRESULT WebView::wndProc(HWND hWnd, UINT message, WPARAM wParam, LPARAM lParam)
     case WM_VISTA_MOUSEHWHEEL:
         lResult = onWheelEvent(hWnd, message, wParam, lParam, handled);
         break;
+    case WM_HSCROLL:
+        lResult = onHorizontalScroll(hWnd, message, wParam, lParam, handled);
+        break;
+    case WM_VSCROLL:
+        lResult = onVerticalScroll(hWnd, message, wParam, lParam, handled);
+        break;
     case WM_SYSKEYDOWN:
     case WM_KEYDOWN:
     case WM_SYSCHAR:
@@ -280,6 +288,20 @@ WebView::~WebView()
 void WebView::initialize()
 {
     ::RegisterDragDrop(m_window, this);
+
+    if (shouldInitializeTrackPointHack()) {
+        // If we detected a registry key belonging to a TrackPoint driver, then create fake
+        // scrollbars, so the WebView will receive WM_VSCROLL and WM_HSCROLL messages.
+        // We create an invisible vertical scrollbar and an invisible horizontal scrollbar to allow
+        // for receiving both types of messages.
+        ::CreateWindow(TEXT("SCROLLBAR"), TEXT("FAKETRACKPOINTHSCROLLBAR"), WS_CHILD | WS_VISIBLE | SBS_HORZ, 0, 0, 0, 0, m_window, 0, instanceHandle(), 0);
+        ::CreateWindow(TEXT("SCROLLBAR"), TEXT("FAKETRACKPOINTVSCROLLBAR"), WS_CHILD | WS_VISIBLE | SBS_VERT, 0, 0, 0, 0, m_window, 0, instanceHandle(), 0);
+    }
+}
+
+void WebView::initializeUndoClient(const WKViewUndoClient* client)
+{
+    m_undoClient.initialize(client);
 }
 
 void WebView::setParentWindow(HWND parentWindow)
@@ -394,6 +416,70 @@ LRESULT WebView::onWheelEvent(HWND hWnd, UINT message, WPARAM wParam, LPARAM lPa
     return 0;
 }
 
+LRESULT WebView::onHorizontalScroll(HWND hWnd, UINT message, WPARAM wParam, LPARAM lParam, bool& handled)
+{
+    ScrollDirection direction;
+    ScrollGranularity granularity;
+    switch (LOWORD(wParam)) {
+    case SB_LINELEFT:
+        granularity = ScrollByLine;
+        direction = ScrollLeft;
+        break;
+    case SB_LINERIGHT:
+        granularity = ScrollByLine;
+        direction = ScrollRight;
+        break;
+    case SB_PAGELEFT:
+        granularity = ScrollByDocument;
+        direction = ScrollLeft;
+        break;
+    case SB_PAGERIGHT:
+        granularity = ScrollByDocument;
+        direction = ScrollRight;
+        break;
+    default:
+        handled = false;
+        return 0;
+    }
+
+    m_page->scrollBy(direction, granularity);
+
+    handled = true;
+    return 0;
+}
+
+LRESULT WebView::onVerticalScroll(HWND hWnd, UINT message, WPARAM wParam, LPARAM lParam, bool& handled)
+{
+    ScrollDirection direction;
+    ScrollGranularity granularity;
+    switch (LOWORD(wParam)) {
+    case SB_LINEDOWN:
+        granularity = ScrollByLine;
+        direction = ScrollDown;
+        break;
+    case SB_LINEUP:
+        granularity = ScrollByLine;
+        direction = ScrollUp;
+        break;
+    case SB_PAGEDOWN:
+        granularity = ScrollByDocument;
+        direction = ScrollDown;
+        break;
+    case SB_PAGEUP:
+        granularity = ScrollByDocument;
+        direction = ScrollUp;
+        break;
+    default:
+        handled = false;
+        return 0;
+    }
+
+    m_page->scrollBy(direction, granularity);
+
+    handled = true;
+    return 0;
+}
+
 LRESULT WebView::onKeyEvent(HWND hWnd, UINT message, WPARAM wParam, LPARAM lParam, bool& handled)
 {
     m_page->handleKeyboardEvent(NativeWebKeyboardEvent(hWnd, message, wParam, lParam));
@@ -490,8 +576,10 @@ LRESULT WebView::onSizeEvent(HWND, UINT, WPARAM, LPARAM lParam, bool& handled)
     int width = LOWORD(lParam);
     int height = HIWORD(lParam);
 
-    if (m_page && m_page->drawingArea())
-        m_page->drawingArea()->setSize(IntSize(width, height), IntSize());
+    if (m_page && m_page->drawingArea()) {
+        m_page->drawingArea()->setSize(IntSize(width, height), m_nextResizeScrollOffset);
+        m_nextResizeScrollOffset = IntSize();
+    }
 
     handled = true;
     return 0;
@@ -638,8 +726,39 @@ void WebView::stopTrackingMouseLeave()
     ::TrackMouseEvent(&trackMouseEvent);
 }
 
+bool WebView::shouldInitializeTrackPointHack()
+{
+    static bool shouldCreateScrollbars;
+    static bool hasRunTrackPointCheck;
+
+    if (hasRunTrackPointCheck)
+        return shouldCreateScrollbars;
+
+    hasRunTrackPointCheck = true;
+    const wchar_t* trackPointKeys[] = { 
+        L"Software\\Lenovo\\TrackPoint",
+        L"Software\\Lenovo\\UltraNav",
+        L"Software\\Alps\\Apoint\\TrackPoint",
+        L"Software\\Synaptics\\SynTPEnh\\UltraNavUSB",
+        L"Software\\Synaptics\\SynTPEnh\\UltraNavPS2"
+    };
+
+    for (size_t i = 0; i < WTF_ARRAY_LENGTH(trackPointKeys); ++i) {
+        HKEY trackPointKey;
+        int readKeyResult = ::RegOpenKeyExW(HKEY_CURRENT_USER, trackPointKeys[i], 0, KEY_READ, &trackPointKey);
+        ::RegCloseKey(trackPointKey);
+        if (readKeyResult == ERROR_SUCCESS) {
+            shouldCreateScrollbars = true;
+            return shouldCreateScrollbars;
+        }
+    }
+
+    return shouldCreateScrollbars;
+}
+
 void WebView::close()
 {
+    m_undoClient.initialize(0);
     ::RevokeDragDrop(m_window);
     setParentWindow(0);
     m_page->close();
@@ -789,16 +908,41 @@ void WebView::setInitialFocus(bool forward)
     m_page->setInitialFocus(forward);
 }
 
+void WebView::setScrollOffsetOnNextResize(const IntSize& scrollOffset)
+{
+    // The next time we get a WM_SIZE message, scroll by the specified amount in onSizeEvent().
+    m_nextResizeScrollOffset = scrollOffset;
+}
+
 void WebView::setViewportArguments(const WebCore::ViewportArguments&)
 {
 }
 
-void WebView::registerEditCommand(PassRefPtr<WebEditCommandProxy>, WebPageProxy::UndoOrRedo)
+void WebView::registerEditCommand(PassRefPtr<WebEditCommandProxy> prpCommand, WebPageProxy::UndoOrRedo undoOrRedo)
 {
+    RefPtr<WebEditCommandProxy> command = prpCommand;
+    m_undoClient.registerEditCommand(this, command, undoOrRedo);
 }
 
 void WebView::clearAllEditCommands()
 {
+    m_undoClient.clearAllEditCommands(this);
+}
+
+void WebView::reapplyEditCommand(WebEditCommandProxy* command)
+{
+    if (!m_page->isValid() || !m_page->isValidEditCommand(command))
+        return;
+    
+    command->reapply();
+}
+
+void WebView::unapplyEditCommand(WebEditCommandProxy* command)
+{
+    if (!m_page->isValid() || !m_page->isValidEditCommand(command))
+        return;
+    
+    command->unapply();
 }
 
 FloatRect WebView::convertToDeviceSpace(const FloatRect& rect)
@@ -806,6 +950,11 @@ FloatRect WebView::convertToDeviceSpace(const FloatRect& rect)
     return rect;
 }
 
+IntRect WebView::windowToScreen(const IntRect& rect)
+{
+    return rect;
+}
+
 FloatRect WebView::convertToUserSpace(const FloatRect& rect)
 {
     return rect;
@@ -1105,11 +1254,15 @@ void WebView::setFindIndicator(PassRefPtr<FindIndicator> prpFindIndicator, bool
 
             hbmp = CreateDIBSection(0, &bitmapInfo, DIB_RGB_COLORS, static_cast<void**>(&bits), 0, 0);
             HBITMAP hbmpOld = static_cast<HBITMAP>(SelectObject(hdc, hbmp));
+#if PLATFORM(CG)
             RetainPtr<CGContextRef> context(AdoptCF, CGBitmapContextCreate(bits, width, height,
                 8, width * sizeof(RGBQUAD), deviceRGBColorSpaceRef(), kCGBitmapByteOrder32Little | kCGImageAlphaPremultipliedFirst));
 
             GraphicsContext graphicsContext(context.get());
             contentImage->paint(graphicsContext, IntPoint(), contentImage->bounds());
+#else
+            // FIXME: Implement!
+#endif
 
             ::SelectObject(hdc, hbmpOld);
             ::DeleteDC(hdc);
diff --git a/Source/WebKit2/UIProcess/win/WebView.h b/Source/WebKit2/UIProcess/win/WebView.h
index 28aedd6..1d65179 100644
--- a/Source/WebKit2/UIProcess/win/WebView.h
+++ b/Source/WebKit2/UIProcess/win/WebView.h
@@ -30,6 +30,7 @@
 #include "PageClient.h"
 #include "WKView.h"
 #include "WebPageProxy.h"
+#include "WebUndoClient.h"
 #include <ShlObj.h>
 #include <WebCore/COMPtr.h>
 #include <WebCore/DragActions.h>
@@ -61,9 +62,14 @@ public:
     void setIsInWindow(bool);
     void setOverrideCursor(HCURSOR);
     void setInitialFocus(bool forward);
+    void setScrollOffsetOnNextResize(const WebCore::IntSize&);
     void setFindIndicatorCallback(WKViewFindIndicatorCallback, void*);
     WKViewFindIndicatorCallback getFindIndicatorCallback(void**);
     void initialize();
+    
+    void initializeUndoClient(const WKViewUndoClient*);
+    void reapplyEditCommand(WebEditCommandProxy*);
+    void unapplyEditCommand(WebEditCommandProxy*);
 
     // IUnknown
     virtual HRESULT STDMETHODCALLTYPE QueryInterface(REFIID riid, void** ppvObject);
@@ -89,6 +95,8 @@ private:
 
     LRESULT onMouseEvent(HWND hWnd, UINT message, WPARAM, LPARAM, bool& handled);
     LRESULT onWheelEvent(HWND hWnd, UINT message, WPARAM, LPARAM, bool& handled);
+    LRESULT onHorizontalScroll(HWND hWnd, UINT message, WPARAM, LPARAM, bool& handled);
+    LRESULT onVerticalScroll(HWND hWnd, UINT message, WPARAM, LPARAM, bool& handled);
     LRESULT onKeyEvent(HWND hWnd, UINT message, WPARAM, LPARAM, bool& handled);
     LRESULT onPaintEvent(HWND hWnd, UINT message, WPARAM, LPARAM, bool& handled);
     LRESULT onPrintClientEvent(HWND hWnd, UINT message, WPARAM, LPARAM, bool& handled);
@@ -123,6 +131,8 @@ private:
     void startTrackingMouseLeave();
     void stopTrackingMouseLeave();
 
+    bool shouldInitializeTrackPointHack();
+
     void close();
 
     HCURSOR cursorToShow() const;
@@ -134,6 +144,7 @@ private:
     virtual void displayView();
     virtual void scrollView(const WebCore::IntRect& scrollRect, const WebCore::IntSize& scrollOffset);
     virtual void flashBackingStoreUpdates(const Vector<WebCore::IntRect>& updateRects);
+    virtual float userSpaceScaleFactor() const { return 1; }
     
     virtual WebCore::IntSize viewSize();
     virtual bool isViewWindowActive();
@@ -144,6 +155,7 @@ private:
     virtual void didRelaunchProcess();
     virtual void pageClosed();
     virtual void takeFocus(bool direction);
+    virtual void setFocus(bool focused) { }
     virtual void toolTipChanged(const WTF::String&, const WTF::String&);
     virtual void setCursor(const WebCore::Cursor&);
     virtual void setViewportArguments(const WebCore::ViewportArguments&);
@@ -151,6 +163,7 @@ private:
     virtual void clearAllEditCommands();
     virtual WebCore::FloatRect convertToDeviceSpace(const WebCore::FloatRect&);
     virtual WebCore::FloatRect convertToUserSpace(const WebCore::FloatRect&);
+    virtual WebCore::IntRect windowToScreen(const WebCore::IntRect&);
     virtual void doneWithKeyEvent(const NativeWebKeyboardEvent&, bool wasEventHandled);
     virtual void compositionSelectionChanged(bool);
     virtual PassRefPtr<WebPopupMenuProxy> createPopupMenuProxy(WebPageProxy*);
@@ -177,6 +190,8 @@ private:
     HWND m_window;
     HWND m_topLevelParentWindow;
     HWND m_toolTipWindow;
+    
+    WebCore::IntSize m_nextResizeScrollOffset;
 
     HCURSOR m_lastCursorSet;
     HCURSOR m_webCoreCursor;
@@ -192,6 +207,8 @@ private:
 
     unsigned m_inIMEComposition;
 
+    WebUndoClient m_undoClient;
+
     WKViewFindIndicatorCallback m_findIndicatorCallback;
     void* m_findIndicatorCallbackContext;
 
diff --git a/Source/WebKit2/WebKit2.pri b/Source/WebKit2/WebKit2.pri
index 681f83f..c6ae792 100644
--- a/Source/WebKit2/WebKit2.pri
+++ b/Source/WebKit2/WebKit2.pri
@@ -41,13 +41,17 @@ WEBKIT2_INCLUDEPATH = \
     $$SOURCE_DIR/WebKit2/WebProcess/ApplicationCache \
     $$SOURCE_DIR/WebKit2/WebProcess/Authentication \
     $$SOURCE_DIR/WebKit2/WebProcess/Cookies \
+    $$SOURCE_DIR/WebKit2/WebProcess/Cookies/qt \
     $$SOURCE_DIR/WebKit2/WebProcess/Downloads \
     $$SOURCE_DIR/WebKit2/WebProcess/Downloads/qt \
+    $$SOURCE_DIR/WebKit2/WebProcess/FullScreen \
     $$SOURCE_DIR/WebKit2/WebProcess/Geolocation \
+    $$SOURCE_DIR/WebKit2/WebProcess/IconDatabase \
     $$SOURCE_DIR/WebKit2/WebProcess/InjectedBundle \
     $$SOURCE_DIR/WebKit2/WebProcess/InjectedBundle/DOM \
     $$SOURCE_DIR/WebKit2/WebProcess/InjectedBundle/API/c \
     $$SOURCE_DIR/WebKit2/WebProcess/KeyValueStorage \
+    $$SOURCE_DIR/WebKit2/WebProcess/MediaCache \
     $$SOURCE_DIR/WebKit2/WebProcess/Plugins \
     $$SOURCE_DIR/WebKit2/WebProcess/Plugins/Netscape \
     $$SOURCE_DIR/WebKit2/WebProcess/ResourceCache \
diff --git a/Source/WebKit2/WebKit2.pro b/Source/WebKit2/WebKit2.pro
index 1e7d051..d3b0814 100644
--- a/Source/WebKit2/WebKit2.pro
+++ b/Source/WebKit2/WebKit2.pro
@@ -33,12 +33,18 @@ WEBKIT2_GENERATED_HEADERS = \
     $$WEBKIT2_GENERATED_SOURCES_DIR/WebCookieManagerProxyMessages.h \
     $$WEBKIT2_GENERATED_SOURCES_DIR/WebDatabaseManagerMessages.h \
     $$WEBKIT2_GENERATED_SOURCES_DIR/WebDatabaseManagerProxyMessages.h \
+    $$WEBKIT2_GENERATED_SOURCES_DIR/WebFullScreenManagerMessages.h \
+    $$WEBKIT2_GENERATED_SOURCES_DIR/WebFullScreenManagerProxyMessages.h \
     $$WEBKIT2_GENERATED_SOURCES_DIR/WebGeolocationManagerMessages.h \
     $$WEBKIT2_GENERATED_SOURCES_DIR/WebGeolocationManagerProxyMessages.h \
+    $$WEBKIT2_GENERATED_SOURCES_DIR/WebIconDatabaseMessages.h \
+    $$WEBKIT2_GENERATED_SOURCES_DIR/WebIconDatabaseProxyMessages.h \
     $$WEBKIT2_GENERATED_SOURCES_DIR/WebInspectorMessages.h \
     $$WEBKIT2_GENERATED_SOURCES_DIR/WebInspectorProxyMessages.h \
     $$WEBKIT2_GENERATED_SOURCES_DIR/WebKeyValueStorageManagerMessages.h \
     $$WEBKIT2_GENERATED_SOURCES_DIR/WebKeyValueStorageManagerProxyMessages.h \
+    $$WEBKIT2_GENERATED_SOURCES_DIR/WebMediaCacheManagerMessages.h \
+    $$WEBKIT2_GENERATED_SOURCES_DIR/WebMediaCacheManagerProxyMessages.h \
     $$WEBKIT2_GENERATED_SOURCES_DIR/WebPageMessages.h \
     $$WEBKIT2_GENERATED_SOURCES_DIR/WebPageProxyMessages.h \
     $$WEBKIT2_GENERATED_SOURCES_DIR/WebProcessConnectionMessages.h \
@@ -62,12 +68,18 @@ WEBKIT2_GENERATED_SOURCES = \
     $$WEBKIT2_GENERATED_SOURCES_DIR/WebCookieManagerProxyMessageReceiver.cpp \
     $$WEBKIT2_GENERATED_SOURCES_DIR/WebDatabaseManagerMessageReceiver.cpp \
     $$WEBKIT2_GENERATED_SOURCES_DIR/WebDatabaseManagerProxyMessageReceiver.cpp \
+    $$WEBKIT2_GENERATED_SOURCES_DIR/WebFullScreenManagerMessageReceiver.cpp \
+    $$WEBKIT2_GENERATED_SOURCES_DIR/WebFullScreenManagerProxyMessageReceiver.cpp \
     $$WEBKIT2_GENERATED_SOURCES_DIR/WebGeolocationManagerMessageReceiver.cpp \
     $$WEBKIT2_GENERATED_SOURCES_DIR/WebGeolocationManagerProxyMessageReceiver.cpp \
+    $$WEBKIT2_GENERATED_SOURCES_DIR/WebIconDatabaseMessageReceiver.cpp \
+    $$WEBKIT2_GENERATED_SOURCES_DIR/WebIconDatabaseProxyMessageReceiver.cpp \
     $$WEBKIT2_GENERATED_SOURCES_DIR/WebInspectorMessageReceiver.cpp \
     $$WEBKIT2_GENERATED_SOURCES_DIR/WebInspectorProxyMessageReceiver.cpp \
     $$WEBKIT2_GENERATED_SOURCES_DIR/WebKeyValueStorageManagerMessageReceiver.cpp \
     $$WEBKIT2_GENERATED_SOURCES_DIR/WebKeyValueStorageManagerProxyMessageReceiver.cpp \
+    $$WEBKIT2_GENERATED_SOURCES_DIR/WebMediaCacheManagerMessageReceiver.cpp \
+    $$WEBKIT2_GENERATED_SOURCES_DIR/WebMediaCacheManagerProxyMessageReceiver.cpp \
     $$WEBKIT2_GENERATED_SOURCES_DIR/WebPageMessageReceiver.cpp \
     $$WEBKIT2_GENERATED_SOURCES_DIR/WebPageProxyMessageReceiver.cpp \
     $$WEBKIT2_GENERATED_SOURCES_DIR/WebProcessConnectionMessageReceiver.cpp \
@@ -190,12 +202,15 @@ HEADERS += \
     UIProcess/WebFrameListenerProxy.h \
     UIProcess/WebFramePolicyListenerProxy.h \
     UIProcess/WebFrameProxy.h \
+    UIProcess/WebFullScreenManagerProxy.h \
     UIProcess/WebGeolocationManagerProxy.h \
     UIProcess/WebGeolocationProvider.h \
     UIProcess/WebHistoryClient.h \
+    UIProcess/WebIconDatabase.h \
     UIProcess/WebInspectorProxy.h \
     UIProcess/WebKeyValueStorageManagerProxy.h \
     UIProcess/WebLoaderClient.h \
+    UIProcess/WebMediaCacheManagerProxy.h \
     UIProcess/WebNavigationData.h \
     UIProcess/WebOpenPanelResultListenerProxy.h \
     UIProcess/WebPageContextMenuClient.h \
@@ -214,8 +229,10 @@ HEADERS += \
     WebProcess/Cookies/WebCookieManager.h \
     WebProcess/Downloads/Download.h \
     WebProcess/Downloads/DownloadManager.h \
+    WebProcess/FullScreen/WebFullScreenManager.h \
     WebProcess/Geolocation/GeolocationPermissionRequestManager.h \
     WebProcess/Geolocation/WebGeolocationManager.h \
+    WebProcess/IconDatabase/WebIconDatabaseProxy.h \
     WebProcess/InjectedBundle/DOM/InjectedBundleNodeHandle.h \
     WebProcess/InjectedBundle/DOM/InjectedBundleRangeHandle.h \
     WebProcess/InjectedBundle/InjectedBundle.h \
@@ -229,6 +246,7 @@ HEADERS += \
     WebProcess/InjectedBundle/InjectedBundleScriptWorld.h \
     WebProcess/InjectedBundle/InjectedBundleUserMessageCoders.h \
     WebProcess/KeyValueStorage/WebKeyValueStorageManager.h \
+    WebProcess/MediaCache/WebMediaCacheManager.h \
     WebProcess/ResourceCache/WebResourceCacheManager.h \
     WebProcess/Plugins/Netscape/JSNPMethod.h \
     WebProcess/Plugins/Netscape/JSNPObject.h \
@@ -380,12 +398,15 @@ SOURCES += \
     UIProcess/WebFrameListenerProxy.cpp \
     UIProcess/WebFramePolicyListenerProxy.cpp \
     UIProcess/WebFrameProxy.cpp \
+    UIProcess/WebFullScreenManagerProxy.cpp \
     UIProcess/WebGeolocationManagerProxy.cpp \
     UIProcess/WebGeolocationProvider.cpp \
     UIProcess/WebHistoryClient.cpp \
+    UIProcess/WebIconDatabase.cpp \
     UIProcess/WebInspectorProxy.cpp \
     UIProcess/WebKeyValueStorageManagerProxy.cpp \
     UIProcess/WebLoaderClient.cpp \
+    UIProcess/WebMediaCacheManagerProxy.cpp \
     UIProcess/WebNavigationData.cpp \
     UIProcess/WebOpenPanelResultListenerProxy.cpp \
     UIProcess/WebPageContextMenuClient.cpp \
@@ -410,11 +431,14 @@ SOURCES += \
     WebProcess/ApplicationCache/WebApplicationCacheManager.cpp \
     WebProcess/Authentication/AuthenticationManager.cpp \
     WebProcess/Cookies/WebCookieManager.cpp \
+    WebProcess/Cookies/qt/WebCookieManagerQt.cpp \
     WebProcess/Downloads/Download.cpp \
     WebProcess/Downloads/DownloadManager.cpp \
+    WebProcess/Downloads/qt/DownloadQt.cpp \
+    WebProcess/FullScreen/WebFullScreenManager.cpp \
     WebProcess/Geolocation/GeolocationPermissionRequestManager.cpp \
     WebProcess/Geolocation/WebGeolocationManager.cpp \
-    WebProcess/Downloads/qt/DownloadQt.cpp \
+    WebProcess/IconDatabase/WebIconDatabaseProxy.cpp \
     WebProcess/InjectedBundle/DOM/InjectedBundleNodeHandle.cpp \
     WebProcess/InjectedBundle/DOM/InjectedBundleRangeHandle.cpp \
     WebProcess/InjectedBundle/InjectedBundle.cpp \
@@ -433,6 +457,7 @@ SOURCES += \
     WebProcess/InjectedBundle/InjectedBundleScriptWorld.cpp \
     WebProcess/InjectedBundle/qt/InjectedBundleQt.cpp \
     WebProcess/KeyValueStorage/WebKeyValueStorageManager.cpp \
+    WebProcess/MediaCache/WebMediaCacheManager.cpp \
     WebProcess/ResourceCache/WebResourceCacheManager.cpp \
     WebProcess/Plugins/Netscape/JSNPMethod.cpp \
     WebProcess/Plugins/Netscape/JSNPObject.cpp \
@@ -442,7 +467,7 @@ SOURCES += \
     WebProcess/Plugins/Netscape/NetscapeBrowserFuncs.cpp \
     WebProcess/Plugins/Netscape/NetscapePlugin.cpp \
     WebProcess/Plugins/Netscape/NetscapePluginStream.cpp \
-    WebProcess/Plugins/Netscape/qt/NetscapePluginQt.cpp \
+    WebProcess/Plugins/Netscape/x11/NetscapePluginX11.cpp \
     WebProcess/Plugins/Netscape/qt/PluginProxyQt.cpp \
     WebProcess/Plugins/Plugin.cpp \
     WebProcess/Plugins/PluginView.cpp \
diff --git a/Source/WebKit2/WebKit2.xcodeproj/project.pbxproj b/Source/WebKit2/WebKit2.xcodeproj/project.pbxproj
index 76679b7..d54f8f2 100644
--- a/Source/WebKit2/WebKit2.xcodeproj/project.pbxproj
+++ b/Source/WebKit2/WebKit2.xcodeproj/project.pbxproj
@@ -15,6 +15,7 @@
 			);
 			dependencies = (
 				1A50DB3C110A3C19000D3FE5 /* PBXTargetDependency */,
+				BCDE0AC113272712001259FB /* PBXTargetDependency */,
 			);
 			name = All;
 			productName = WebKit2;
@@ -63,11 +64,8 @@
 		1A119A95127B796200A9ECB1 /* MessageSender.h in Headers */ = {isa = PBXBuildFile; fileRef = 1A119A94127B796200A9ECB1 /* MessageSender.h */; };
 		1A186EEA12EF7618008E5F37 /* LayerTreeHost.h in Headers */ = {isa = PBXBuildFile; fileRef = 1A186EE812EF7618008E5F37 /* LayerTreeHost.h */; };
 		1A186EEB12EF7618008E5F37 /* LayerTreeHost.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1A186EE912EF7618008E5F37 /* LayerTreeHost.cpp */; };
-		1A18718512EF9877008E5F37 /* LayerTreeHostMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = 1A18718412EF9877008E5F37 /* LayerTreeHostMac.mm */; };
 		1A1C4EC810D06099005E67E7 /* WebCore.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = 1AA1C79A100E7FC50078DEBC /* WebCore.framework */; };
 		1A1C649B11F4174200553C19 /* WebContextMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = 1A1C648611F415B700553C19 /* WebContextMac.mm */; };
-		1A1FA285127A13BC0050E709 /* NPObjectProxy.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1A1FA284127A13BC0050E709 /* NPObjectProxy.cpp */; };
-		1A1FA35D127A45BF0050E709 /* NPObjectMessageReceiver.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1A1FA35C127A45BF0050E709 /* NPObjectMessageReceiver.cpp */; };
 		1A2161B011F37664008AD0F5 /* NPRuntimeObjectMap.h in Headers */ = {isa = PBXBuildFile; fileRef = 1A2161AE11F37664008AD0F5 /* NPRuntimeObjectMap.h */; };
 		1A2161B111F37664008AD0F5 /* NPRuntimeObjectMap.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1A2161AF11F37664008AD0F5 /* NPRuntimeObjectMap.cpp */; };
 		1A2162B011F38971008AD0F5 /* NPRuntimeUtilities.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1A2162AE11F38971008AD0F5 /* NPRuntimeUtilities.cpp */; };
@@ -98,6 +96,8 @@
 		1A2D957012848564001EB962 /* ChildProcess.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1A2D956E12848564001EB962 /* ChildProcess.cpp */; };
 		1A30066E1110F4F70031937C /* ResponsivenessTimer.h in Headers */ = {isa = PBXBuildFile; fileRef = 1A30066C1110F4F70031937C /* ResponsivenessTimer.h */; };
 		1A30EAC6115D7DA30053E937 /* ConnectionMac.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1A30EAC5115D7DA30053E937 /* ConnectionMac.cpp */; };
+		1A3979F61332983A00E00300 /* AppKit.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = 0867D6A5FE840307C02AAC07 /* AppKit.framework */; };
+		1A3979F71332983F00E00300 /* QuartzCore.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = 1AA1CC5C100FA1A10078DEBC /* QuartzCore.framework */; };
 		1A3DD1FD125E59F3004515E6 /* WebFindClient.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1A3DD1FC125E59F3004515E6 /* WebFindClient.cpp */; };
 		1A3DD202125E5A1F004515E6 /* WebFindClient.h in Headers */ = {isa = PBXBuildFile; fileRef = 1A3DD201125E5A1F004515E6 /* WebFindClient.h */; };
 		1A3DD206125E5A2F004515E6 /* APIClient.h in Headers */ = {isa = PBXBuildFile; fileRef = 1A3DD205125E5A2F004515E6 /* APIClient.h */; };
@@ -125,7 +125,6 @@
 		1A64218712DCF49200CAAE2C /* DrawingAreaProxyImpl.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1A64218512DCF49200CAAE2C /* DrawingAreaProxyImpl.cpp */; };
 		1A6421F612DCFBAB00CAAE2C /* DrawingAreaImpl.h in Headers */ = {isa = PBXBuildFile; fileRef = 1A6421F412DCFBAB00CAAE2C /* DrawingAreaImpl.h */; };
 		1A6421F712DCFBAB00CAAE2C /* DrawingAreaImpl.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1A6421F512DCFBAB00CAAE2C /* DrawingAreaImpl.cpp */; };
-		1A64228B12DD024700CAAE2C /* DrawingArea.messages.in in CopyFiles */ = {isa = PBXBuildFile; fileRef = 1A64228A12DD024700CAAE2C /* DrawingArea.messages.in */; };
 		1A64229912DD029200CAAE2C /* DrawingAreaMessageReceiver.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1A64229712DD029200CAAE2C /* DrawingAreaMessageReceiver.cpp */; };
 		1A64229A12DD029200CAAE2C /* DrawingAreaMessages.h in Headers */ = {isa = PBXBuildFile; fileRef = 1A64229812DD029200CAAE2C /* DrawingAreaMessages.h */; };
 		1A64230812DD09EB00CAAE2C /* DrawingAreaProxyMessageReceiver.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1A64230612DD09EB00CAAE2C /* DrawingAreaProxyMessageReceiver.cpp */; };
@@ -137,7 +136,6 @@
 		1A64256812DE42EC00CAAE2C /* BackingStore.h in Headers */ = {isa = PBXBuildFile; fileRef = 1A64256612DE42EC00CAAE2C /* BackingStore.h */; };
 		1A64256912DE42EC00CAAE2C /* BackingStore.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1A64256712DE42EC00CAAE2C /* BackingStore.cpp */; };
 		1A64292D12DE5F9800CAAE2C /* BackingStoreMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = 1A64292C12DE5F9800CAAE2C /* BackingStoreMac.mm */; };
-		1A690D1712F39E3300ECD289 /* LayerTreeHostMac.h in Headers */ = {isa = PBXBuildFile; fileRef = 1A690D1612F39E3300ECD289 /* LayerTreeHostMac.h */; };
 		1A6F9F9011E13EFC00DB1371 /* CommandLine.h in Headers */ = {isa = PBXBuildFile; fileRef = 1A6F9F8E11E13EFC00DB1371 /* CommandLine.h */; };
 		1A6F9FB711E1408500DB1371 /* CommandLineMac.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1A6F9FB611E1408500DB1371 /* CommandLineMac.cpp */; };
 		1A6FA01E11E1526300DB1371 /* WebProcessMainMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = 1A6FA01D11E1526300DB1371 /* WebProcessMainMac.mm */; };
@@ -202,8 +200,7 @@
 		1AB7D72D1288CAAD00CFD08C /* WebDownloadClient.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1AB7D72B1288CAAD00CFD08C /* WebDownloadClient.cpp */; };
 		1AB7D78D1288CD9A00CFD08C /* WKDownload.h in Headers */ = {isa = PBXBuildFile; fileRef = 1AB7D78B1288CD9A00CFD08C /* WKDownload.h */; settings = {ATTRIBUTES = (Public, ); }; };
 		1AB7D78E1288CD9A00CFD08C /* WKDownload.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1AB7D78C1288CD9A00CFD08C /* WKDownload.cpp */; };
-		1AC25FC212A48F6000BD2671 /* PluginProcessShim.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1AC25F8A12A48E0300BD2671 /* PluginProcessShim.cpp */; };
-		1AC25FDC12A4902700BD2671 /* PluginProcessShim.dylib in Copy Plug-in Process Shim */ = {isa = PBXBuildFile; fileRef = 1AC25FB012A48EA700BD2671 /* PluginProcessShim.dylib */; };
+		1AC25FC212A48F6000BD2671 /* PluginProcessShim.mm in Sources */ = {isa = PBXBuildFile; fileRef = 1AC25F8A12A48E0300BD2671 /* PluginProcessShim.mm */; };
 		1AC41AC71263C88300054E94 /* BinarySemaphore.h in Headers */ = {isa = PBXBuildFile; fileRef = 1AC41AC51263C88300054E94 /* BinarySemaphore.h */; };
 		1AC41AC81263C88300054E94 /* BinarySemaphore.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1AC41AC61263C88300054E94 /* BinarySemaphore.cpp */; };
 		1AC86FF3130B46D3002C1257 /* WKPluginSiteDataManager.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1AC86FF1130B46D3002C1257 /* WKPluginSiteDataManager.cpp */; };
@@ -263,12 +260,30 @@
 		33367658130C9ECB006C9DE2 /* WebResourceCacheManagerProxyMessages.h in Headers */ = {isa = PBXBuildFile; fileRef = 33367654130C9ECA006C9DE2 /* WebResourceCacheManagerProxyMessages.h */; };
 		33AA1066131F060000D4A575 /* WebCookieManagerProxyClient.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 33AA1064131F060000D4A575 /* WebCookieManagerProxyClient.cpp */; };
 		33AA1067131F060000D4A575 /* WebCookieManagerProxyClient.h in Headers */ = {isa = PBXBuildFile; fileRef = 33AA1065131F060000D4A575 /* WebCookieManagerProxyClient.h */; };
+		33D3A3B51339600B00709BE4 /* WKMediaCacheManager.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 33D3A3B31339600B00709BE4 /* WKMediaCacheManager.cpp */; };
+		33D3A3B61339600B00709BE4 /* WKMediaCacheManager.h in Headers */ = {isa = PBXBuildFile; fileRef = 33D3A3B41339600B00709BE4 /* WKMediaCacheManager.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		33D3A3BA1339606200709BE4 /* WebMediaCacheManagerProxy.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 33D3A3B71339606200709BE4 /* WebMediaCacheManagerProxy.cpp */; };
+		33D3A3BB1339606200709BE4 /* WebMediaCacheManagerProxy.h in Headers */ = {isa = PBXBuildFile; fileRef = 33D3A3B81339606200709BE4 /* WebMediaCacheManagerProxy.h */; };
+		33D3A3C1133960B000709BE4 /* WebMediaCacheManager.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 33D3A3BE133960B000709BE4 /* WebMediaCacheManager.cpp */; };
+		33D3A3C2133960B000709BE4 /* WebMediaCacheManager.h in Headers */ = {isa = PBXBuildFile; fileRef = 33D3A3BF133960B000709BE4 /* WebMediaCacheManager.h */; };
+		33D3A3C81339617900709BE4 /* WebMediaCacheManagerMessageReceiver.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 33D3A3C41339617900709BE4 /* WebMediaCacheManagerMessageReceiver.cpp */; };
+		33D3A3C91339617900709BE4 /* WebMediaCacheManagerMessages.h in Headers */ = {isa = PBXBuildFile; fileRef = 33D3A3C51339617900709BE4 /* WebMediaCacheManagerMessages.h */; };
+		33D3A3CA1339617900709BE4 /* WebMediaCacheManagerProxyMessageReceiver.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 33D3A3C61339617900709BE4 /* WebMediaCacheManagerProxyMessageReceiver.cpp */; };
+		33D3A3CB1339617900709BE4 /* WebMediaCacheManagerProxyMessages.h in Headers */ = {isa = PBXBuildFile; fileRef = 33D3A3C71339617900709BE4 /* WebMediaCacheManagerProxyMessages.h */; };
 		33F9D5B91312F1EE000D683F /* WebResourceCacheManagerCFNet.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 33F9D5B81312F1EE000D683F /* WebResourceCacheManagerCFNet.cpp */; };
 		37C4E9F6131C6E7E0029BD5A /* config.h in Headers */ = {isa = PBXBuildFile; fileRef = B396EA5512E0ED2D00F4FEB7 /* config.h */; };
 		37F623B812A57B6200E3FDF6 /* WKFindOptions.h in Headers */ = {isa = PBXBuildFile; fileRef = 37F623B712A57B6200E3FDF6 /* WKFindOptions.h */; settings = {ATTRIBUTES = (Public, ); }; };
 		51021E9C12B16788005C033C /* WebContextMenuClientMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = 51021E9B12B16788005C033C /* WebContextMenuClientMac.mm */; };
 		510FBB9A1288C95E00AFFDF4 /* WebContextMenuItemData.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 510FBB981288C95E00AFFDF4 /* WebContextMenuItemData.cpp */; };
 		510FBB9B1288C95E00AFFDF4 /* WebContextMenuItemData.h in Headers */ = {isa = PBXBuildFile; fileRef = 510FBB991288C95E00AFFDF4 /* WebContextMenuItemData.h */; };
+		5110AE0C133C16CB0072717A /* WKIconDatabase.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 5110AE0A133C16CB0072717A /* WKIconDatabase.cpp */; };
+		5110AE0D133C16CB0072717A /* WKIconDatabase.h in Headers */ = {isa = PBXBuildFile; fileRef = 5110AE0B133C16CB0072717A /* WKIconDatabase.h */; settings = {ATTRIBUTES = (Public, ); }; };
+		511B24A6132E095700065A0C /* WebIconDatabaseProxy.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 511B24A4132E095700065A0C /* WebIconDatabaseProxy.cpp */; };
+		511B24A7132E095700065A0C /* WebIconDatabaseProxy.h in Headers */ = {isa = PBXBuildFile; fileRef = 511B24A5132E095700065A0C /* WebIconDatabaseProxy.h */; };
+		511B24AA132E097200065A0C /* WebIconDatabase.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 511B24A8132E097200065A0C /* WebIconDatabase.cpp */; };
+		511B24AB132E097200065A0C /* WebIconDatabase.h in Headers */ = {isa = PBXBuildFile; fileRef = 511B24A9132E097200065A0C /* WebIconDatabase.h */; };
+		5123CF1B133D260A0056F800 /* WKIconDatabaseCG.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 5123CF19133D260A0056F800 /* WKIconDatabaseCG.cpp */; };
+		5123CF1C133D260A0056F800 /* WKIconDatabaseCG.h in Headers */ = {isa = PBXBuildFile; fileRef = 5123CF1A133D260A0056F800 /* WKIconDatabaseCG.h */; settings = {ATTRIBUTES = (Public, ); }; };
 		512935D71288D19400A4B695 /* WebContextMenuItem.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 512935D51288D19400A4B695 /* WebContextMenuItem.cpp */; };
 		512935D81288D19400A4B695 /* WebContextMenuItem.h in Headers */ = {isa = PBXBuildFile; fileRef = 512935D61288D19400A4B695 /* WebContextMenuItem.h */; };
 		512935E31288D97800A4B695 /* InjectedBundlePageContextMenuClient.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 512935E11288D97800A4B695 /* InjectedBundlePageContextMenuClient.cpp */; };
@@ -306,6 +321,7 @@
 		5153569C1291B1D2000749DC /* WebPageContextMenuClient.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 5153569A1291B1D2000749DC /* WebPageContextMenuClient.cpp */; };
 		5153569D1291B1D2000749DC /* WebPageContextMenuClient.h in Headers */ = {isa = PBXBuildFile; fileRef = 5153569B1291B1D2000749DC /* WebPageContextMenuClient.h */; };
 		51578B831209ECEF00A37C4A /* WebData.h in Headers */ = {isa = PBXBuildFile; fileRef = 51578B821209ECEF00A37C4A /* WebData.h */; };
+		5160BFE113381DF900918999 /* Logging.mac.mm in Sources */ = {isa = PBXBuildFile; fileRef = 5160BFE013381DF900918999 /* Logging.mac.mm */; };
 		516A4A5D120A2CCD00C05B7F /* WebError.h in Headers */ = {isa = PBXBuildFile; fileRef = 516A4A5B120A2CCD00C05B7F /* WebError.h */; };
 		51871B5B127CB89D00F76232 /* WebContextMenu.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 51871B59127CB89D00F76232 /* WebContextMenu.cpp */; };
 		51871B5C127CB89D00F76232 /* WebContextMenu.h in Headers */ = {isa = PBXBuildFile; fileRef = 51871B5A127CB89D00F76232 /* WebContextMenu.h */; };
@@ -336,8 +352,11 @@
 		51ACBBA1127A8F2C00D203B9 /* WebContextMenuProxyMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = 51ACBB9F127A8F2C00D203B9 /* WebContextMenuProxyMac.mm */; };
 		51B3005012529D0E000B5CA0 /* WebBackForwardListCF.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 51B3004E12529D0E000B5CA0 /* WebBackForwardListCF.cpp */; };
 		51B3005112529D0E000B5CA0 /* WebPageProxyCF.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 51B3004F12529D0E000B5CA0 /* WebPageProxyCF.cpp */; };
+		51D02F64132EC5B900BEAA96 /* WebIconDatabaseMessageReceiver.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 51D02F63132EC5B900BEAA96 /* WebIconDatabaseMessageReceiver.cpp */; };
+		51D02F6A132EC73700BEAA96 /* WebIconDatabaseMessages.h in Headers */ = {isa = PBXBuildFile; fileRef = 51D02F67132EC73700BEAA96 /* WebIconDatabaseMessages.h */; };
+		51D02F6B132EC73700BEAA96 /* WebIconDatabaseProxyMessageReceiver.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 51D02F68132EC73700BEAA96 /* WebIconDatabaseProxyMessageReceiver.cpp */; };
+		51D02F6C132EC73700BEAA96 /* WebIconDatabaseProxyMessages.h in Headers */ = {isa = PBXBuildFile; fileRef = 51D02F69132EC73700BEAA96 /* WebIconDatabaseProxyMessages.h */; };
 		6501BD1A12F1243400E9F248 /* WKBundleInspector.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 65B86F1712F11D7B00B7DD8A /* WKBundleInspector.cpp */; };
-		6546A82C13000164000CEB1C /* InjectedBundlePageResourceLoadClient.h in CopyFiles */ = {isa = PBXBuildFile; fileRef = 6546A82A13000164000CEB1C /* InjectedBundlePageResourceLoadClient.h */; };
 		659C551E130006410025C0C2 /* InjectedBundlePageResourceLoadClient.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 6546A82913000164000CEB1C /* InjectedBundlePageResourceLoadClient.cpp */; };
 		65B86F1E12F11DE300B7DD8A /* WKBundleInspector.h in Headers */ = {isa = PBXBuildFile; fileRef = 65B86F1812F11D7B00B7DD8A /* WKBundleInspector.h */; settings = {ATTRIBUTES = (Public, ); }; };
 		6D8A91A611F0EFD100DD01FE /* com.apple.WebProcess.sb in Resources */ = {isa = PBXBuildFile; fileRef = 6D8A91A511F0EFD100DD01FE /* com.apple.WebProcess.sb */; };
@@ -363,6 +382,8 @@
 		93FC67BE12D3CCF200A60610 /* DecoderAdapter.h in Headers */ = {isa = PBXBuildFile; fileRef = 93FC679E12D3CC7400A60610 /* DecoderAdapter.h */; };
 		93FC67BF12D3CCF200A60610 /* EncoderAdapter.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 93FC679F12D3CC7400A60610 /* EncoderAdapter.cpp */; };
 		93FC67C012D3CCF200A60610 /* EncoderAdapter.h in Headers */ = {isa = PBXBuildFile; fileRef = 93FC67A012D3CC7400A60610 /* EncoderAdapter.h */; };
+		B878B615133428DC006888E9 /* CorrectionPanel.h in Headers */ = {isa = PBXBuildFile; fileRef = B878B613133428DC006888E9 /* CorrectionPanel.h */; };
+		B878B616133428DC006888E9 /* CorrectionPanel.mm in Sources */ = {isa = PBXBuildFile; fileRef = B878B614133428DC006888E9 /* CorrectionPanel.mm */; };
 		BC0092F7115837A300E0AE2A /* RunLoopMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = BC0092F5115837A300E0AE2A /* RunLoopMac.mm */; };
 		BC0092F8115837A300E0AE2A /* WorkQueueMac.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC0092F6115837A300E0AE2A /* WorkQueueMac.cpp */; };
 		BC032D7510F4378D0058C15A /* WebChromeClient.h in Headers */ = {isa = PBXBuildFile; fileRef = BC032D6010F4378D0058C15A /* WebChromeClient.h */; };
@@ -676,6 +697,9 @@
 		BCDDB32D124EC2E10048D13C /* WKAPICast.h in Headers */ = {isa = PBXBuildFile; fileRef = BCDDB32C124EC2E10048D13C /* WKAPICast.h */; };
 		BCDE059B11CDA8AE00E41AF1 /* WebContextInjectedBundleClient.h in Headers */ = {isa = PBXBuildFile; fileRef = BCDE059911CDA8AE00E41AF1 /* WebContextInjectedBundleClient.h */; };
 		BCDE059C11CDA8AE00E41AF1 /* WebContextInjectedBundleClient.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BCDE059A11CDA8AE00E41AF1 /* WebContextInjectedBundleClient.cpp */; };
+		BCDE093B13272496001259FB /* MainMac.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1A6FA31011E3921E00DB1371 /* MainMac.cpp */; };
+		BCDE093D13272496001259FB /* PluginProcessShim.dylib in Copy Plug-in Process Shim */ = {isa = PBXBuildFile; fileRef = 1AC25FB012A48EA700BD2671 /* PluginProcessShim.dylib */; };
+		BCDE0ABF13272708001259FB /* PluginProcess.app in CopyFiles */ = {isa = PBXBuildFile; fileRef = BCDE094213272496001259FB /* PluginProcess.app */; };
 		BCE2315D122C30CA00D5C35A /* WebURLRequest.h in Headers */ = {isa = PBXBuildFile; fileRef = BCE2315B122C30CA00D5C35A /* WebURLRequest.h */; };
 		BCE2315E122C30CA00D5C35A /* WebURLRequest.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BCE2315C122C30CA00D5C35A /* WebURLRequest.cpp */; };
 		BCE231C2122C466E00D5C35A /* WebURLRequestMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = BCE231C0122C466E00D5C35A /* WebURLRequestMac.mm */; };
@@ -716,6 +740,8 @@
 		BCF69FA31176D01400471A52 /* WebNavigationData.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BCF69FA11176D01400471A52 /* WebNavigationData.cpp */; };
 		BCF69FA91176D1CB00471A52 /* WKNavigationData.h in Headers */ = {isa = PBXBuildFile; fileRef = BCF69FA71176D1CB00471A52 /* WKNavigationData.h */; settings = {ATTRIBUTES = (Public, ); }; };
 		BCF69FAA1176D1CB00471A52 /* WKNavigationData.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BCF69FA81176D1CB00471A52 /* WKNavigationData.cpp */; };
+		BCFD548B132D82680055D816 /* WKErrorCF.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BCFD5489132D82680055D816 /* WKErrorCF.cpp */; };
+		BCFD548C132D82680055D816 /* WKErrorCF.h in Headers */ = {isa = PBXBuildFile; fileRef = BCFD548A132D82680055D816 /* WKErrorCF.h */; settings = {ATTRIBUTES = (Public, ); }; };
 		BFA6179F12F0B99D0033E0CA /* WKViewPrivate.h in Headers */ = {isa = PBXBuildFile; fileRef = BFA6179E12F0B99D0033E0CA /* WKViewPrivate.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		C01A260112662F2100C9ED55 /* ShareableBitmapCG.cpp in Sources */ = {isa = PBXBuildFile; fileRef = C01A260012662F2100C9ED55 /* ShareableBitmapCG.cpp */; };
 		C02BFF1E1251502E009CCBEA /* NativeWebKeyboardEventMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = C02BFF1D1251502E009CCBEA /* NativeWebKeyboardEventMac.mm */; };
@@ -725,11 +751,14 @@
 		C0337DD3127A2A0E008FF4F4 /* WebKeyboardEvent.cpp in Sources */ = {isa = PBXBuildFile; fileRef = C0337DD2127A2A0E008FF4F4 /* WebKeyboardEvent.cpp */; };
 		C0337DD8127A51B6008FF4F4 /* WebTouchEvent.cpp in Sources */ = {isa = PBXBuildFile; fileRef = C0337DD7127A51B6008FF4F4 /* WebTouchEvent.cpp */; };
 		C0337DDD127A521C008FF4F4 /* WebPlatformTouchPoint.cpp in Sources */ = {isa = PBXBuildFile; fileRef = C0337DDC127A521C008FF4F4 /* WebPlatformTouchPoint.cpp */; };
+		C03A136C133BEBF900D767D1 /* LayerTreeHostCAMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = C03A136B133BEBF900D767D1 /* LayerTreeHostCAMac.mm */; };
+		C064504A133BE709003470E2 /* LayerTreeHostCA.h in Headers */ = {isa = PBXBuildFile; fileRef = C098A053133BE1C500B199A4 /* LayerTreeHostCA.h */; };
 		C06C6095124C144B0001682F /* WebPageCreationParameters.cpp in Sources */ = {isa = PBXBuildFile; fileRef = C06C6093124C14430001682F /* WebPageCreationParameters.cpp */; };
 		C09AE5E9125257C20025825D /* WKNativeEvent.h in Headers */ = {isa = PBXBuildFile; fileRef = C09AE5E8125257C20025825D /* WKNativeEvent.h */; settings = {ATTRIBUTES = (Public, ); }; };
 		C0CE72A01247E71D00BC0EC4 /* WebPageMessageReceiver.cpp in Sources */ = {isa = PBXBuildFile; fileRef = C0CE729E1247E71D00BC0EC4 /* WebPageMessageReceiver.cpp */; };
 		C0CE72A11247E71D00BC0EC4 /* WebPageMessages.h in Headers */ = {isa = PBXBuildFile; fileRef = C0CE729F1247E71D00BC0EC4 /* WebPageMessages.h */; };
 		C0CE72AD1247E78D00BC0EC4 /* HandleMessage.h in Headers */ = {isa = PBXBuildFile; fileRef = C0CE72AC1247E78D00BC0EC4 /* HandleMessage.h */; };
+		C0D74DDE133BE2D90089CD44 /* LayerTreeHostCA.cpp in Sources */ = {isa = PBXBuildFile; fileRef = C098A054133BE1C500B199A4 /* LayerTreeHostCA.cpp */; };
 		C0E3AA7A1209E83000A49D01 /* ModuleMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = C0E3AA481209E45000A49D01 /* ModuleMac.mm */; };
 		C0E3AA7B1209E83500A49D01 /* Module.cpp in Sources */ = {isa = PBXBuildFile; fileRef = C0E3AA451209E2BA00A49D01 /* Module.cpp */; };
 		C0E3AA7C1209E83C00A49D01 /* Module.h in Headers */ = {isa = PBXBuildFile; fileRef = C0E3AA441209E2BA00A49D01 /* Module.h */; };
@@ -738,6 +767,15 @@
 		C574A37712E6099D002DFE98 /* WebDragClientMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = C554FFA212E4E8EA002F22C0 /* WebDragClientMac.mm */; };
 		C574A58112E66681002DFE98 /* PasteboardTypes.h in Headers */ = {isa = PBXBuildFile; fileRef = C574A57F12E66681002DFE98 /* PasteboardTypes.h */; };
 		C574A58212E66681002DFE98 /* PasteboardTypes.mm in Sources */ = {isa = PBXBuildFile; fileRef = C574A58012E66681002DFE98 /* PasteboardTypes.mm */; };
+		CD6F75F4131B66D000D6B21E /* WebFullScreenManagerProxy.cpp in Sources */ = {isa = PBXBuildFile; fileRef = CD73BA3E131A2E8A00EEDED2 /* WebFullScreenManagerProxy.cpp */; };
+		CD73BA47131ACC9A00EEDED2 /* WebFullScreenManagerProxyMessageReceiver.cpp in Sources */ = {isa = PBXBuildFile; fileRef = CD73BA45131ACC8800EEDED2 /* WebFullScreenManagerProxyMessageReceiver.cpp */; };
+		CD73BA4E131ACDB700EEDED2 /* WebFullScreenManagerMessageReceiver.cpp in Sources */ = {isa = PBXBuildFile; fileRef = CD73BA48131ACD8E00EEDED2 /* WebFullScreenManagerMessageReceiver.cpp */; };
+		CD73BA53131B645B00EEDED2 /* WebFullScreenManager.cpp in Sources */ = {isa = PBXBuildFile; fileRef = CD73BA37131A29FE00EEDED2 /* WebFullScreenManager.cpp */; };
+		CDCA85C8132ABA4E00E961DF /* WKFullScreenWindowController.mm in Sources */ = {isa = PBXBuildFile; fileRef = CDCA85C6132ABA4E00E961DF /* WKFullScreenWindowController.mm */; };
+		CDCA85C9132ABA4E00E961DF /* WKFullScreenWindowController.h in Headers */ = {isa = PBXBuildFile; fileRef = CDCA85C7132ABA4E00E961DF /* WKFullScreenWindowController.h */; };
+		CDCA85D5132AC2B300E961DF /* IOKit.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = CDCA85D4132AC2B300E961DF /* IOKit.framework */; };
+		CDCA85EE132AD70100E961DF /* WebFullScreenManagerProxyMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = CDCA85DE132AD05300E961DF /* WebFullScreenManagerProxyMac.mm */; };
+		CDCA8603132ADC0500E961DF /* WebFullScreenManagerMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = CDCA85E6132AD33000E961DF /* WebFullScreenManagerMac.mm */; };
 		D3B9484611FF4B6500032B39 /* WebPopupMenu.cpp in Sources */ = {isa = PBXBuildFile; fileRef = D3B9484211FF4B6500032B39 /* WebPopupMenu.cpp */; };
 		D3B9484711FF4B6500032B39 /* WebPopupMenu.h in Headers */ = {isa = PBXBuildFile; fileRef = D3B9484311FF4B6500032B39 /* WebPopupMenu.h */; };
 		D3B9484811FF4B6500032B39 /* WebSearchPopupMenu.cpp in Sources */ = {isa = PBXBuildFile; fileRef = D3B9484411FF4B6500032B39 /* WebSearchPopupMenu.cpp */; };
@@ -745,8 +783,6 @@
 		E134F01712EA5D33004EC58D /* WKPrintingView.h in Headers */ = {isa = PBXBuildFile; fileRef = E134F01512EA5D11004EC58D /* WKPrintingView.h */; };
 		E134F01A12EA5D99004EC58D /* WKPrintingView.mm in Sources */ = {isa = PBXBuildFile; fileRef = E134F01912EA5D99004EC58D /* WKPrintingView.mm */; };
 		E18C92F412DB9E7100CF2AEB /* PrintInfo.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E18C92F312DB9E7100CF2AEB /* PrintInfo.cpp */; };
-		E18C92F512DB9E7A00CF2AEB /* PrintInfo.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E18C92F312DB9E7100CF2AEB /* PrintInfo.cpp */; };
-		E18C92F612DB9E9400CF2AEB /* PrintInfoMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = E1CC1B8F12D7EADF00625838 /* PrintInfoMac.mm */; };
 		E1BB16A413201B9B00F49431 /* FullKeyboardAccessWatcher.h in Headers */ = {isa = PBXBuildFile; fileRef = E1BB1688132018BA00F49431 /* FullKeyboardAccessWatcher.h */; };
 		E1BB16A513201B9B00F49431 /* FullKeyboardAccessWatcher.mm in Sources */ = {isa = PBXBuildFile; fileRef = E1BB1689132018BA00F49431 /* FullKeyboardAccessWatcher.mm */; };
 		E1CC1B9012D7EADF00625838 /* PrintInfo.h in Headers */ = {isa = PBXBuildFile; fileRef = E1CC1B8E12D7EADF00625838 /* PrintInfo.h */; };
@@ -769,9 +805,12 @@
 		F634445612A885C8000612D8 /* WebSecurityOrigin.h in Headers */ = {isa = PBXBuildFile; fileRef = F634445512A885C8000612D8 /* WebSecurityOrigin.h */; };
 		F634445C12A885E9000612D8 /* WKSecurityOrigin.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F634445A12A885E9000612D8 /* WKSecurityOrigin.cpp */; };
 		F634445D12A885E9000612D8 /* WKSecurityOrigin.h in Headers */ = {isa = PBXBuildFile; fileRef = F634445B12A885E9000612D8 /* WKSecurityOrigin.h */; settings = {ATTRIBUTES = (Public, ); }; };
+		F6389550133BEF38008941D5 /* HTTPCookieAcceptPolicy.h in CopyFiles */ = {isa = PBXBuildFile; fileRef = F638954F133BEF38008941D5 /* HTTPCookieAcceptPolicy.h */; };
 		F67DD7BA125E40D9007BDCB8 /* WKSerializedScriptValuePrivate.h in Headers */ = {isa = PBXBuildFile; fileRef = F67DD7B9125E40D9007BDCB8 /* WKSerializedScriptValuePrivate.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		F6A25FDC12ADC6CC00DC40CC /* WebDatabaseManager.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F6A25FDA12ADC6CC00DC40CC /* WebDatabaseManager.cpp */; };
 		F6A25FDD12ADC6CC00DC40CC /* WebDatabaseManager.h in Headers */ = {isa = PBXBuildFile; fileRef = F6A25FDB12ADC6CC00DC40CC /* WebDatabaseManager.h */; };
+		F6A90813133C20510082C3F4 /* WebCookieManagerMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = F6A90811133C1F3D0082C3F4 /* WebCookieManagerMac.mm */; };
+		F6D632BC133D198200743D77 /* WebCookieManagerProxyMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = F6D632BA133D181B00743D77 /* WebCookieManagerProxyMac.mm */; };
 /* End PBXBuildFile section */
 
 /* Begin PBXContainerItemProxy section */
@@ -789,19 +828,33 @@
 			remoteGlobalIDString = 1A50DB1D110A3BDC000D3FE5;
 			remoteInfo = WebProcess;
 		};
-		1AC25FD712A48FD500BD2671 /* PBXContainerItemProxy */ = {
+		37F7407812721F740093869B /* PBXContainerItemProxy */ = {
+			isa = PBXContainerItemProxy;
+			containerPortal = 0867D690FE84028FC02AAC07 /* Project object */;
+			proxyType = 1;
+			remoteGlobalIDString = C0CE72851247E66800BC0EC4;
+			remoteInfo = "Derived Sources";
+		};
+		BCDE093513272496001259FB /* PBXContainerItemProxy */ = {
 			isa = PBXContainerItemProxy;
 			containerPortal = 0867D690FE84028FC02AAC07 /* Project object */;
 			proxyType = 1;
 			remoteGlobalIDString = 1AC25FAF12A48EA700BD2671;
 			remoteInfo = PluginProcessShim;
 		};
-		37F7407812721F740093869B /* PBXContainerItemProxy */ = {
+		BCDE093713272496001259FB /* PBXContainerItemProxy */ = {
 			isa = PBXContainerItemProxy;
 			containerPortal = 0867D690FE84028FC02AAC07 /* Project object */;
 			proxyType = 1;
-			remoteGlobalIDString = C0CE72851247E66800BC0EC4;
-			remoteInfo = "Derived Sources";
+			remoteGlobalIDString = 8DC2EF4F0486A6940098B216;
+			remoteInfo = WebKit2;
+		};
+		BCDE0AC013272712001259FB /* PBXContainerItemProxy */ = {
+			isa = PBXContainerItemProxy;
+			containerPortal = 0867D690FE84028FC02AAC07 /* Project object */;
+			proxyType = 1;
+			remoteGlobalIDString = BCDE093313272496001259FB;
+			remoteInfo = "Plugin Process";
 		};
 /* End PBXContainerItemProxy section */
 
@@ -813,18 +866,18 @@
 			dstSubfolderSpec = 1;
 			files = (
 				1A50DB66110A3D57000D3FE5 /* WebProcess.app in CopyFiles */,
-				1A64228B12DD024700CAAE2C /* DrawingArea.messages.in in CopyFiles */,
-				6546A82C13000164000CEB1C /* InjectedBundlePageResourceLoadClient.h in CopyFiles */,
+				BCDE0ABF13272708001259FB /* PluginProcess.app in CopyFiles */,
+				F6389550133BEF38008941D5 /* HTTPCookieAcceptPolicy.h in CopyFiles */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
-		1AC25FDD12A4904500BD2671 /* Copy Plug-in Process Shim */ = {
+		BCDE093C13272496001259FB /* Copy Plug-in Process Shim */ = {
 			isa = PBXCopyFilesBuildPhase;
 			buildActionMask = 2147483647;
-			dstPath = WebProcess.app/Contents/MacOS;
+			dstPath = PluginProcess.app/Contents/MacOS;
 			dstSubfolderSpec = 16;
 			files = (
-				1AC25FDC12A4902700BD2671 /* PluginProcessShim.dylib in Copy Plug-in Process Shim */,
+				BCDE093D13272496001259FB /* PluginProcessShim.dylib in Copy Plug-in Process Shim */,
 			);
 			name = "Copy Plug-in Process Shim";
 			runOnlyForDeploymentPostprocessing = 0;
@@ -868,7 +921,6 @@
 		1A119A94127B796200A9ECB1 /* MessageSender.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MessageSender.h; sourceTree = "<group>"; };
 		1A186EE812EF7618008E5F37 /* LayerTreeHost.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = LayerTreeHost.h; sourceTree = "<group>"; };
 		1A186EE912EF7618008E5F37 /* LayerTreeHost.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = LayerTreeHost.cpp; sourceTree = "<group>"; };
-		1A18718412EF9877008E5F37 /* LayerTreeHostMac.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = LayerTreeHostMac.mm; sourceTree = "<group>"; };
 		1A1C648611F415B700553C19 /* WebContextMac.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = WebContextMac.mm; sourceTree = "<group>"; };
 		1A1FA251127A0E4F0050E709 /* NPRemoteObjectMap.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = NPRemoteObjectMap.h; sourceTree = "<group>"; };
 		1A1FA252127A0E4F0050E709 /* NPRemoteObjectMap.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = NPRemoteObjectMap.cpp; sourceTree = "<group>"; };
@@ -947,7 +999,6 @@
 		1A64256612DE42EC00CAAE2C /* BackingStore.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = BackingStore.h; sourceTree = "<group>"; };
 		1A64256712DE42EC00CAAE2C /* BackingStore.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = BackingStore.cpp; sourceTree = "<group>"; };
 		1A64292C12DE5F9800CAAE2C /* BackingStoreMac.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = BackingStoreMac.mm; sourceTree = "<group>"; };
-		1A690D1612F39E3300ECD289 /* LayerTreeHostMac.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = LayerTreeHostMac.h; sourceTree = "<group>"; };
 		1A6F9F8E11E13EFC00DB1371 /* CommandLine.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CommandLine.h; sourceTree = "<group>"; };
 		1A6F9FB611E1408500DB1371 /* CommandLineMac.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = CommandLineMac.cpp; sourceTree = "<group>"; };
 		1A6FA01D11E1526300DB1371 /* WebProcessMainMac.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = WebProcessMainMac.mm; sourceTree = "<group>"; };
@@ -1017,7 +1068,7 @@
 		1AB7D78B1288CD9A00CFD08C /* WKDownload.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WKDownload.h; sourceTree = "<group>"; };
 		1AB7D78C1288CD9A00CFD08C /* WKDownload.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WKDownload.cpp; sourceTree = "<group>"; };
 		1AC25F8912A48E0300BD2671 /* PluginProcessShim.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PluginProcessShim.h; sourceTree = "<group>"; };
-		1AC25F8A12A48E0300BD2671 /* PluginProcessShim.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = PluginProcessShim.cpp; sourceTree = "<group>"; };
+		1AC25F8A12A48E0300BD2671 /* PluginProcessShim.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = PluginProcessShim.mm; sourceTree = "<group>"; };
 		1AC25FB012A48EA700BD2671 /* PluginProcessShim.dylib */ = {isa = PBXFileReference; explicitFileType = "compiled.mach-o.dylib"; includeInIndex = 0; path = PluginProcessShim.dylib; sourceTree = BUILT_PRODUCTS_DIR; };
 		1AC25FBB12A48EDA00BD2671 /* PluginProcessShim.xcconfig */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.xcconfig; path = PluginProcessShim.xcconfig; sourceTree = "<group>"; };
 		1AC41AC51263C88300054E94 /* BinarySemaphore.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = BinarySemaphore.h; sourceTree = "<group>"; };
@@ -1086,11 +1137,31 @@
 		33367654130C9ECA006C9DE2 /* WebResourceCacheManagerProxyMessages.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebResourceCacheManagerProxyMessages.h; sourceTree = "<group>"; };
 		33AA1064131F060000D4A575 /* WebCookieManagerProxyClient.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WebCookieManagerProxyClient.cpp; sourceTree = "<group>"; };
 		33AA1065131F060000D4A575 /* WebCookieManagerProxyClient.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebCookieManagerProxyClient.h; sourceTree = "<group>"; };
+		33D3A3B31339600B00709BE4 /* WKMediaCacheManager.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WKMediaCacheManager.cpp; sourceTree = "<group>"; };
+		33D3A3B41339600B00709BE4 /* WKMediaCacheManager.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WKMediaCacheManager.h; sourceTree = "<group>"; };
+		33D3A3B71339606200709BE4 /* WebMediaCacheManagerProxy.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WebMediaCacheManagerProxy.cpp; sourceTree = "<group>"; };
+		33D3A3B81339606200709BE4 /* WebMediaCacheManagerProxy.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebMediaCacheManagerProxy.h; sourceTree = "<group>"; };
+		33D3A3B91339606200709BE4 /* WebMediaCacheManagerProxy.messages.in */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = WebMediaCacheManagerProxy.messages.in; sourceTree = "<group>"; };
+		33D3A3BE133960B000709BE4 /* WebMediaCacheManager.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = WebMediaCacheManager.cpp; path = MediaCache/WebMediaCacheManager.cpp; sourceTree = "<group>"; };
+		33D3A3BF133960B000709BE4 /* WebMediaCacheManager.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = WebMediaCacheManager.h; path = MediaCache/WebMediaCacheManager.h; sourceTree = "<group>"; };
+		33D3A3C0133960B000709BE4 /* WebMediaCacheManager.messages.in */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = WebMediaCacheManager.messages.in; path = MediaCache/WebMediaCacheManager.messages.in; sourceTree = "<group>"; };
+		33D3A3C41339617900709BE4 /* WebMediaCacheManagerMessageReceiver.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WebMediaCacheManagerMessageReceiver.cpp; sourceTree = "<group>"; };
+		33D3A3C51339617900709BE4 /* WebMediaCacheManagerMessages.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebMediaCacheManagerMessages.h; sourceTree = "<group>"; };
+		33D3A3C61339617900709BE4 /* WebMediaCacheManagerProxyMessageReceiver.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WebMediaCacheManagerProxyMessageReceiver.cpp; sourceTree = "<group>"; };
+		33D3A3C71339617900709BE4 /* WebMediaCacheManagerProxyMessages.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebMediaCacheManagerProxyMessages.h; sourceTree = "<group>"; };
 		33F9D5B81312F1EE000D683F /* WebResourceCacheManagerCFNet.cpp */ = {isa = PBXFileReference; explicitFileType = sourcecode.cpp.objcpp; fileEncoding = 4; name = WebResourceCacheManagerCFNet.cpp; path = ResourceCache/cf/WebResourceCacheManagerCFNet.cpp; sourceTree = "<group>"; };
 		37F623B712A57B6200E3FDF6 /* WKFindOptions.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WKFindOptions.h; sourceTree = "<group>"; };
 		51021E9B12B16788005C033C /* WebContextMenuClientMac.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = WebContextMenuClientMac.mm; sourceTree = "<group>"; };
 		510FBB981288C95E00AFFDF4 /* WebContextMenuItemData.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WebContextMenuItemData.cpp; sourceTree = "<group>"; };
 		510FBB991288C95E00AFFDF4 /* WebContextMenuItemData.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebContextMenuItemData.h; sourceTree = "<group>"; };
+		5110AE0A133C16CB0072717A /* WKIconDatabase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WKIconDatabase.cpp; sourceTree = "<group>"; };
+		5110AE0B133C16CB0072717A /* WKIconDatabase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WKIconDatabase.h; sourceTree = "<group>"; };
+		511B24A4132E095700065A0C /* WebIconDatabaseProxy.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = WebIconDatabaseProxy.cpp; path = IconDatabase/WebIconDatabaseProxy.cpp; sourceTree = "<group>"; };
+		511B24A5132E095700065A0C /* WebIconDatabaseProxy.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = WebIconDatabaseProxy.h; path = IconDatabase/WebIconDatabaseProxy.h; sourceTree = "<group>"; };
+		511B24A8132E097200065A0C /* WebIconDatabase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WebIconDatabase.cpp; sourceTree = "<group>"; };
+		511B24A9132E097200065A0C /* WebIconDatabase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebIconDatabase.h; sourceTree = "<group>"; };
+		5123CF19133D260A0056F800 /* WKIconDatabaseCG.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = WKIconDatabaseCG.cpp; path = cg/WKIconDatabaseCG.cpp; sourceTree = "<group>"; };
+		5123CF1A133D260A0056F800 /* WKIconDatabaseCG.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = WKIconDatabaseCG.h; path = cg/WKIconDatabaseCG.h; sourceTree = "<group>"; };
 		512935D51288D19400A4B695 /* WebContextMenuItem.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WebContextMenuItem.cpp; sourceTree = "<group>"; };
 		512935D61288D19400A4B695 /* WebContextMenuItem.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebContextMenuItem.h; sourceTree = "<group>"; };
 		512935E11288D97800A4B695 /* InjectedBundlePageContextMenuClient.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = InjectedBundlePageContextMenuClient.cpp; sourceTree = "<group>"; };
@@ -1129,9 +1200,11 @@
 		5153569A1291B1D2000749DC /* WebPageContextMenuClient.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WebPageContextMenuClient.cpp; sourceTree = "<group>"; };
 		5153569B1291B1D2000749DC /* WebPageContextMenuClient.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebPageContextMenuClient.h; sourceTree = "<group>"; };
 		51578B821209ECEF00A37C4A /* WebData.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebData.h; sourceTree = "<group>"; };
+		5160BFE013381DF900918999 /* Logging.mac.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = Logging.mac.mm; sourceTree = "<group>"; };
 		516A4A5B120A2CCD00C05B7F /* WebError.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebError.h; sourceTree = "<group>"; };
 		517A33B3130B308C00F80CB5 /* WKApplicationCacheManager.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WKApplicationCacheManager.cpp; sourceTree = "<group>"; };
 		517A33B4130B308C00F80CB5 /* WKApplicationCacheManager.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WKApplicationCacheManager.h; sourceTree = "<group>"; };
+		5184BC4A132E907A006B9E28 /* WebIconDatabase.messages.in */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = WebIconDatabase.messages.in; sourceTree = "<group>"; };
 		51871B59127CB89D00F76232 /* WebContextMenu.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WebContextMenu.cpp; sourceTree = "<group>"; };
 		51871B5A127CB89D00F76232 /* WebContextMenu.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebContextMenu.h; sourceTree = "<group>"; };
 		518ACAE912AEE6BB00B04B83 /* WKProtectionSpaceTypes.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WKProtectionSpaceTypes.h; sourceTree = "<group>"; };
@@ -1163,6 +1236,11 @@
 		51ACBB9F127A8F2C00D203B9 /* WebContextMenuProxyMac.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = WebContextMenuProxyMac.mm; sourceTree = "<group>"; };
 		51B3004E12529D0E000B5CA0 /* WebBackForwardListCF.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = WebBackForwardListCF.cpp; path = cf/WebBackForwardListCF.cpp; sourceTree = "<group>"; };
 		51B3004F12529D0E000B5CA0 /* WebPageProxyCF.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = WebPageProxyCF.cpp; path = cf/WebPageProxyCF.cpp; sourceTree = "<group>"; };
+		51D02F63132EC5B900BEAA96 /* WebIconDatabaseMessageReceiver.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WebIconDatabaseMessageReceiver.cpp; sourceTree = "<group>"; };
+		51D02F65132EC6D300BEAA96 /* WebIconDatabaseProxy.messages.in */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = WebIconDatabaseProxy.messages.in; path = IconDatabase/WebIconDatabaseProxy.messages.in; sourceTree = "<group>"; };
+		51D02F67132EC73700BEAA96 /* WebIconDatabaseMessages.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebIconDatabaseMessages.h; sourceTree = "<group>"; };
+		51D02F68132EC73700BEAA96 /* WebIconDatabaseProxyMessageReceiver.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WebIconDatabaseProxyMessageReceiver.cpp; sourceTree = "<group>"; };
+		51D02F69132EC73700BEAA96 /* WebIconDatabaseProxyMessages.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebIconDatabaseProxyMessages.h; sourceTree = "<group>"; };
 		5DAD7294116FF70B00EE5396 /* WebProcess.xcconfig */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.xcconfig; path = WebProcess.xcconfig; sourceTree = "<group>"; };
 		5DAD73F1116FF90C00EE5396 /* BaseTarget.xcconfig */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.xcconfig; path = BaseTarget.xcconfig; sourceTree = "<group>"; };
 		6546A82913000164000CEB1C /* InjectedBundlePageResourceLoadClient.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = InjectedBundlePageResourceLoadClient.cpp; sourceTree = "<group>"; };
@@ -1195,6 +1273,8 @@
 		93FC67A012D3CC7400A60610 /* EncoderAdapter.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = EncoderAdapter.h; sourceTree = "<group>"; };
 		A72D5D7F1236CBA800A88B15 /* WebSerializedScriptValue.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebSerializedScriptValue.h; sourceTree = "<group>"; };
 		B396EA5512E0ED2D00F4FEB7 /* config.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = config.h; sourceTree = "<group>"; };
+		B878B613133428DC006888E9 /* CorrectionPanel.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CorrectionPanel.h; sourceTree = "<group>"; };
+		B878B614133428DC006888E9 /* CorrectionPanel.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = CorrectionPanel.mm; sourceTree = "<group>"; };
 		BC0092F5115837A300E0AE2A /* RunLoopMac.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = RunLoopMac.mm; sourceTree = "<group>"; };
 		BC0092F6115837A300E0AE2A /* WorkQueueMac.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WorkQueueMac.cpp; sourceTree = "<group>"; };
 		BC032D6010F4378D0058C15A /* WebChromeClient.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebChromeClient.h; sourceTree = "<group>"; };
@@ -1257,6 +1337,8 @@
 		BC111B4C112F619200337BAB /* PageClientImpl.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = PageClientImpl.mm; sourceTree = "<group>"; };
 		BC111B5B112F629800337BAB /* WebEventFactory.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebEventFactory.h; sourceTree = "<group>"; };
 		BC111B5C112F629800337BAB /* WebEventFactory.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = WebEventFactory.mm; sourceTree = "<group>"; };
+		BC122FA3132707F300F7EAC1 /* PluginProcess.xcconfig */ = {isa = PBXFileReference; lastKnownFileType = text.xcconfig; path = PluginProcess.xcconfig; sourceTree = "<group>"; };
+		BC122FA61327087400F7EAC1 /* Info.plist */ = {isa = PBXFileReference; lastKnownFileType = text.plist.xml; name = Info.plist; path = PluginProcess/Info.plist; sourceTree = "<group>"; };
 		BC131BC811726C2800B69727 /* CoreIPCMessageKinds.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CoreIPCMessageKinds.h; sourceTree = "<group>"; };
 		BC14DF75120B5B7900826C0C /* InjectedBundleScriptWorld.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InjectedBundleScriptWorld.h; sourceTree = "<group>"; };
 		BC14DF76120B5B7900826C0C /* InjectedBundleScriptWorld.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = InjectedBundleScriptWorld.cpp; sourceTree = "<group>"; };
@@ -1513,6 +1595,7 @@
 		BCDDB32C124EC2E10048D13C /* WKAPICast.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WKAPICast.h; sourceTree = "<group>"; };
 		BCDE059911CDA8AE00E41AF1 /* WebContextInjectedBundleClient.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebContextInjectedBundleClient.h; sourceTree = "<group>"; };
 		BCDE059A11CDA8AE00E41AF1 /* WebContextInjectedBundleClient.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WebContextInjectedBundleClient.cpp; sourceTree = "<group>"; };
+		BCDE094213272496001259FB /* PluginProcess.app */ = {isa = PBXFileReference; explicitFileType = wrapper.application; includeInIndex = 0; path = PluginProcess.app; sourceTree = BUILT_PRODUCTS_DIR; };
 		BCE2315B122C30CA00D5C35A /* WebURLRequest.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebURLRequest.h; sourceTree = "<group>"; };
 		BCE2315C122C30CA00D5C35A /* WebURLRequest.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WebURLRequest.cpp; sourceTree = "<group>"; };
 		BCE231C0122C466E00D5C35A /* WebURLRequestMac.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = WebURLRequestMac.mm; sourceTree = "<group>"; };
@@ -1557,6 +1640,8 @@
 		BCF69FA11176D01400471A52 /* WebNavigationData.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WebNavigationData.cpp; sourceTree = "<group>"; };
 		BCF69FA71176D1CB00471A52 /* WKNavigationData.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WKNavigationData.h; sourceTree = "<group>"; };
 		BCF69FA81176D1CB00471A52 /* WKNavigationData.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WKNavigationData.cpp; sourceTree = "<group>"; };
+		BCFD5489132D82680055D816 /* WKErrorCF.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WKErrorCF.cpp; sourceTree = "<group>"; };
+		BCFD548A132D82680055D816 /* WKErrorCF.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WKErrorCF.h; sourceTree = "<group>"; };
 		BFA6179E12F0B99D0033E0CA /* WKViewPrivate.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WKViewPrivate.h; sourceTree = "<group>"; };
 		C01A260012662F2100C9ED55 /* ShareableBitmapCG.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ShareableBitmapCG.cpp; sourceTree = "<group>"; };
 		C02BFF1512514FD8009CCBEA /* NativeWebKeyboardEvent.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = NativeWebKeyboardEvent.h; sourceTree = "<group>"; };
@@ -1567,9 +1652,12 @@
 		C0337DD2127A2A0E008FF4F4 /* WebKeyboardEvent.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WebKeyboardEvent.cpp; sourceTree = "<group>"; };
 		C0337DD7127A51B6008FF4F4 /* WebTouchEvent.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WebTouchEvent.cpp; sourceTree = "<group>"; };
 		C0337DDC127A521C008FF4F4 /* WebPlatformTouchPoint.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WebPlatformTouchPoint.cpp; sourceTree = "<group>"; };
+		C03A136B133BEBF900D767D1 /* LayerTreeHostCAMac.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = LayerTreeHostCAMac.mm; sourceTree = "<group>"; };
 		C06C6093124C14430001682F /* WebPageCreationParameters.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WebPageCreationParameters.cpp; sourceTree = "<group>"; };
 		C06C6094124C14430001682F /* WebPageCreationParameters.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebPageCreationParameters.h; sourceTree = "<group>"; };
 		C08FDE87124A851C007645BD /* messages_unittest.py */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.script.python; path = messages_unittest.py; sourceTree = "<group>"; };
+		C098A053133BE1C500B199A4 /* LayerTreeHostCA.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = LayerTreeHostCA.h; sourceTree = "<group>"; };
+		C098A054133BE1C500B199A4 /* LayerTreeHostCA.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = LayerTreeHostCA.cpp; sourceTree = "<group>"; };
 		C09AE5E8125257C20025825D /* WKNativeEvent.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WKNativeEvent.h; sourceTree = "<group>"; };
 		C0CE72581247E4DA00BC0EC4 /* WebPage.messages.in */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = WebPage.messages.in; sourceTree = "<group>"; };
 		C0CE729E1247E71D00BC0EC4 /* WebPageMessageReceiver.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WebPageMessageReceiver.cpp; sourceTree = "<group>"; };
@@ -1588,6 +1676,22 @@
 		C554FFA212E4E8EA002F22C0 /* WebDragClientMac.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = WebDragClientMac.mm; sourceTree = "<group>"; };
 		C574A57F12E66681002DFE98 /* PasteboardTypes.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PasteboardTypes.h; sourceTree = "<group>"; };
 		C574A58012E66681002DFE98 /* PasteboardTypes.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = PasteboardTypes.mm; sourceTree = "<group>"; };
+		CD73BA37131A29FE00EEDED2 /* WebFullScreenManager.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = WebFullScreenManager.cpp; path = FullScreen/WebFullScreenManager.cpp; sourceTree = "<group>"; };
+		CD73BA38131A29FE00EEDED2 /* WebFullScreenManager.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = WebFullScreenManager.h; path = FullScreen/WebFullScreenManager.h; sourceTree = "<group>"; };
+		CD73BA39131A29FE00EEDED2 /* WebFullScreenManager.messages.in */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = WebFullScreenManager.messages.in; path = FullScreen/WebFullScreenManager.messages.in; sourceTree = "<group>"; };
+		CD73BA3E131A2E8A00EEDED2 /* WebFullScreenManagerProxy.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WebFullScreenManagerProxy.cpp; sourceTree = "<group>"; };
+		CD73BA3F131A2E8A00EEDED2 /* WebFullScreenManagerProxy.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebFullScreenManagerProxy.h; sourceTree = "<group>"; };
+		CD73BA40131A2E8A00EEDED2 /* WebFullScreenManagerProxy.messages.in */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = WebFullScreenManagerProxy.messages.in; sourceTree = "<group>"; };
+		CD73BA45131ACC8800EEDED2 /* WebFullScreenManagerProxyMessageReceiver.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WebFullScreenManagerProxyMessageReceiver.cpp; sourceTree = "<group>"; };
+		CD73BA48131ACD8E00EEDED2 /* WebFullScreenManagerMessageReceiver.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WebFullScreenManagerMessageReceiver.cpp; sourceTree = "<group>"; };
+		CD73BA49131ACD8E00EEDED2 /* WebFullScreenManagerMessages.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebFullScreenManagerMessages.h; sourceTree = "<group>"; };
+		CD73BA4A131ACD8F00EEDED2 /* WebFullScreenManagerProxyMessages.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebFullScreenManagerProxyMessages.h; sourceTree = "<group>"; };
+		CDCA85C6132ABA4E00E961DF /* WKFullScreenWindowController.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = WKFullScreenWindowController.mm; sourceTree = "<group>"; };
+		CDCA85C7132ABA4E00E961DF /* WKFullScreenWindowController.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WKFullScreenWindowController.h; sourceTree = "<group>"; };
+		CDCA85D4132AC2B300E961DF /* IOKit.framework */ = {isa = PBXFileReference; lastKnownFileType = wrapper.framework; name = IOKit.framework; path = /System/Library/Frameworks/IOKit.framework; sourceTree = "<absolute>"; };
+		CDCA85DE132AD05300E961DF /* WebFullScreenManagerProxyMac.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = WebFullScreenManagerProxyMac.mm; sourceTree = "<group>"; };
+		CDCA85E5132AD33000E961DF /* WebFullScreenManagerMac.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebFullScreenManagerMac.h; sourceTree = "<group>"; };
+		CDCA85E6132AD33000E961DF /* WebFullScreenManagerMac.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = WebFullScreenManagerMac.mm; sourceTree = "<group>"; };
 		D3B9484211FF4B6500032B39 /* WebPopupMenu.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WebPopupMenu.cpp; sourceTree = "<group>"; };
 		D3B9484311FF4B6500032B39 /* WebPopupMenu.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebPopupMenu.h; sourceTree = "<group>"; };
 		D3B9484411FF4B6500032B39 /* WebSearchPopupMenu.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WebSearchPopupMenu.cpp; sourceTree = "<group>"; };
@@ -1617,9 +1721,13 @@
 		F634445512A885C8000612D8 /* WebSecurityOrigin.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebSecurityOrigin.h; sourceTree = "<group>"; };
 		F634445A12A885E9000612D8 /* WKSecurityOrigin.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WKSecurityOrigin.cpp; sourceTree = "<group>"; };
 		F634445B12A885E9000612D8 /* WKSecurityOrigin.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WKSecurityOrigin.h; sourceTree = "<group>"; };
+		F638954F133BEF38008941D5 /* HTTPCookieAcceptPolicy.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = HTTPCookieAcceptPolicy.h; sourceTree = "<group>"; };
 		F67DD7B9125E40D9007BDCB8 /* WKSerializedScriptValuePrivate.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WKSerializedScriptValuePrivate.h; sourceTree = "<group>"; };
+		F6A0C13F13281E6E0070430F /* ResourceCachesToClear.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ResourceCachesToClear.h; sourceTree = "<group>"; };
 		F6A25FDA12ADC6CC00DC40CC /* WebDatabaseManager.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WebDatabaseManager.cpp; sourceTree = "<group>"; };
 		F6A25FDB12ADC6CC00DC40CC /* WebDatabaseManager.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebDatabaseManager.h; sourceTree = "<group>"; };
+		F6A90811133C1F3D0082C3F4 /* WebCookieManagerMac.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = WebCookieManagerMac.mm; sourceTree = "<group>"; };
+		F6D632BA133D181B00743D77 /* WebCookieManagerProxyMac.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = WebCookieManagerProxyMac.mm; sourceTree = "<group>"; };
 /* End PBXFileReference section */
 
 /* Begin PBXFrameworksBuildPhase section */
@@ -1627,7 +1735,9 @@
 			isa = PBXFrameworksBuildPhase;
 			buildActionMask = 2147483647;
 			files = (
+				1A3979F61332983A00E00300 /* AppKit.framework in Frameworks */,
 				1AA479B012A5A436008236C3 /* Carbon.framework in Frameworks */,
+				1A3979F71332983F00E00300 /* QuartzCore.framework in Frameworks */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
@@ -1644,6 +1754,7 @@
 				1AA1CC5D100FA1A10078DEBC /* QuartzCore.framework in Frameworks */,
 				1A1C4EC810D06099005E67E7 /* WebCore.framework in Frameworks */,
 				BCF5068512431861005955AE /* Security.framework in Frameworks */,
+				CDCA85D5132AC2B300E961DF /* IOKit.framework in Frameworks */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
@@ -1656,6 +1767,7 @@
 				8DC2EF5B0486A6940098B216 /* WebKit2.framework */,
 				1A50DB1E110A3BDC000D3FE5 /* WebProcess.app */,
 				1AC25FB012A48EA700BD2671 /* PluginProcessShim.dylib */,
+				BCDE094213272496001259FB /* PluginProcess.app */,
 			);
 			name = Products;
 			sourceTree = "<group>";
@@ -1697,6 +1809,7 @@
 		089C1665FE841158C02AAC07 /* Resources */ = {
 			isa = PBXGroup;
 			children = (
+				BC122FA51327085D00F7EAC1 /* PluginProcess */,
 				BC8A500E11765AD400757573 /* WebKit2 */,
 				BC8A500F11765AE300757573 /* WebProcess */,
 				6D8A91A511F0EFD100DD01FE /* com.apple.WebProcess.sb */,
@@ -1715,6 +1828,7 @@
 				1AA1CD06100FA1BA0078DEBC /* Carbon.framework */,
 				1058C7B1FEA5585E11CA2CBB /* Cocoa.framework */,
 				BCD0042C110C1E27003B8A67 /* CoreServices.framework */,
+				CDCA85D4132AC2B300E961DF /* IOKit.framework */,
 				1AA1C7DE100E846E0078DEBC /* JavaScriptCore.framework */,
 				BC87DFA91018101400564216 /* libicucore.dylib */,
 				1AA1CC5C100FA1A10078DEBC /* QuartzCore.framework */,
@@ -1757,7 +1871,7 @@
 				1A2D91A51281D739001EB962 /* PluginControllerProxyMac.mm */,
 				1A0EC802124BD41E007EF4A5 /* PluginProcessMainMac.mm */,
 				1AA4792212A59FD9008236C3 /* PluginProcessMac.mm */,
-				1AC25F8A12A48E0300BD2671 /* PluginProcessShim.cpp */,
+				1AC25F8A12A48E0300BD2671 /* PluginProcessShim.mm */,
 				1AC25F8912A48E0300BD2671 /* PluginProcessShim.h */,
 			);
 			path = mac;
@@ -1788,6 +1902,7 @@
 				5DAD73F1116FF90C00EE5396 /* BaseTarget.xcconfig */,
 				1A4F976B100E7B6600637A18 /* DebugRelease.xcconfig */,
 				1A4F976C100E7B6600637A18 /* FeatureDefines.xcconfig */,
+				BC122FA3132707F300F7EAC1 /* PluginProcess.xcconfig */,
 				1AC25FBB12A48EDA00BD2671 /* PluginProcessShim.xcconfig */,
 				1A4F976E100E7B6600637A18 /* Version.xcconfig */,
 				BCB86F4B116AAACD00CE20B7 /* WebKit2.xcconfig */,
@@ -1885,6 +2000,7 @@
 		1A7E814E1152D2240003695B /* mac */ = {
 			isa = PBXGroup;
 			children = (
+				5160BFE013381DF900918999 /* Logging.mac.mm */,
 				1A24B5F011F531E800C38269 /* MachUtilities.cpp */,
 				1A24B5F111F531E800C38269 /* MachUtilities.h */,
 				C0E3AA481209E45000A49D01 /* ModuleMac.mm */,
@@ -1925,6 +2041,7 @@
 				C517388012DF8F4F00EE3F47 /* DragControllerAction.h */,
 				0FB659221208B4DB0044816C /* DrawingAreaInfo.h */,
 				762B7481120BBA0100819339 /* FontSmoothingLevel.h */,
+				F638954F133BEF38008941D5 /* HTTPCookieAcceptPolicy.h */,
 				BCCF6B2312C93E7A008F9C35 /* ImageOptions.h */,
 				BC64696D11DBE603006455B0 /* ImmutableArray.cpp */,
 				BC64696E11DBE603006455B0 /* ImmutableArray.h */,
@@ -1944,6 +2061,7 @@
 				E1CC1B8E12D7EADF00625838 /* PrintInfo.h */,
 				BCE81D8A1319F7EF00241910 /* FontInfo.cpp */,
 				BCE81D8B1319F7EF00241910 /* FontInfo.h */,
+				F6A0C13F13281E6E0070430F /* ResourceCachesToClear.h */,
 				BC2D021612AC41CB00E732A3 /* SameDocumentNavigationType.h */,
 				1AAB4A8C1296F0A20023952F /* SandboxExtension.h */,
 				33152973130D0CB200ED2483 /* SecurityOriginData.cpp */,
@@ -2128,6 +2246,7 @@
 		3309344B1315B93A0097A7BC /* Cookies */ = {
 			isa = PBXGroup;
 			children = (
+				F638955A133BF57D008941D5 /* mac */,
 				3309344C1315B94D0097A7BC /* WebCookieManager.cpp */,
 				3309344D1315B94D0097A7BC /* WebCookieManager.h */,
 				3309344E1315B94D0097A7BC /* WebCookieManager.messages.in */,
@@ -2146,6 +2265,16 @@
 			name = ResourceCache;
 			sourceTree = "<group>";
 		};
+		33D3A3BD1339609800709BE4 /* MediaCache */ = {
+			isa = PBXGroup;
+			children = (
+				33D3A3BE133960B000709BE4 /* WebMediaCacheManager.cpp */,
+				33D3A3BF133960B000709BE4 /* WebMediaCacheManager.h */,
+				33D3A3C0133960B000709BE4 /* WebMediaCacheManager.messages.in */,
+			);
+			name = MediaCache;
+			sourceTree = "<group>";
+		};
 		33F9D5B71312F1B1000D683F /* cf */ = {
 			isa = PBXGroup;
 			children = (
@@ -2154,6 +2283,15 @@
 			name = cf;
 			sourceTree = "<group>";
 		};
+		5123CF18133D25E60056F800 /* cg */ = {
+			isa = PBXGroup;
+			children = (
+				5123CF19133D260A0056F800 /* WKIconDatabaseCG.cpp */,
+				5123CF1A133D260A0056F800 /* WKIconDatabaseCG.h */,
+			);
+			name = cg;
+			sourceTree = "<group>";
+		};
 		512E352A130B559900ABD19A /* ApplicationCache */ = {
 			isa = PBXGroup;
 			children = (
@@ -2209,17 +2347,30 @@
 			name = cf;
 			sourceTree = "<group>";
 		};
+		51FBB9C1132E079200F327B4 /* IconDatabase */ = {
+			isa = PBXGroup;
+			children = (
+				511B24A4132E095700065A0C /* WebIconDatabaseProxy.cpp */,
+				511B24A5132E095700065A0C /* WebIconDatabaseProxy.h */,
+				51D02F65132EC6D300BEAA96 /* WebIconDatabaseProxy.messages.in */,
+			);
+			name = IconDatabase;
+			sourceTree = "<group>";
+		};
 		BC032D5C10F436D50058C15A /* WebProcess */ = {
 			isa = PBXGroup;
 			children = (
+				CD73BA3D131A2A2100EEDED2 /* FullScreen */,
 				512E352A130B559900ABD19A /* ApplicationCache */,
 				512F588612A8834700629530 /* Authentication */,
 				3309344B1315B93A0097A7BC /* Cookies */,
 				1A61614C127798B5003ACD86 /* Downloads */,
 				BC0E5FCB12D696DD0012A72A /* Geolocation */,
+				51FBB9C1132E079200F327B4 /* IconDatabase */,
 				BC204EDF11C83E72008F3375 /* InjectedBundle */,
 				51A9E0FB1315CC0E009E7031 /* KeyValueStorage */,
 				1A6FA01C11E1526300DB1371 /* mac */,
+				33D3A3BD1339609800709BE4 /* MediaCache */,
 				1A6FB7AA11E64B4900DB1371 /* Plugins */,
 				3336762B130C9978006C9DE2 /* ResourceCache */,
 				BC032D5D10F437220058C15A /* WebCoreSupport */,
@@ -2272,6 +2423,7 @@
 		BC032D5E10F4372B0058C15A /* WebPage */ = {
 			isa = PBXGroup;
 			children = (
+				C098A052133BE1C500B199A4 /* ca */,
 				BC963D6C113DD19500574BE2 /* mac */,
 				BC5F7BB21182376C0052C02C /* ChunkedUpdateDrawingArea.cpp */,
 				BC5F7BB31182376C0052C02C /* ChunkedUpdateDrawingArea.h */,
@@ -2384,6 +2536,9 @@
 				BCB9F69E1123A84B00A137E0 /* WebFramePolicyListenerProxy.h */,
 				BC111B0A112F5E4F00337BAB /* WebFrameProxy.cpp */,
 				BC9B389F10F538BE00443A15 /* WebFrameProxy.h */,
+				CD73BA3E131A2E8A00EEDED2 /* WebFullScreenManagerProxy.cpp */,
+				CD73BA3F131A2E8A00EEDED2 /* WebFullScreenManagerProxy.h */,
+				CD73BA40131A2E8A00EEDED2 /* WebFullScreenManagerProxy.messages.in */,
 				BC54CACA12D64291005C67B0 /* WebGeolocationManagerProxy.cpp */,
 				BC54CAC912D64291005C67B0 /* WebGeolocationManagerProxy.h */,
 				BC0E615212D6CAC80012A72A /* WebGeolocationManagerProxy.messages.in */,
@@ -2391,6 +2546,9 @@
 				BC1BE1F012D54DBD0004A228 /* WebGeolocationProvider.h */,
 				BCF69F841176CD6F00471A52 /* WebHistoryClient.cpp */,
 				BCF69F851176CD6F00471A52 /* WebHistoryClient.h */,
+				511B24A8132E097200065A0C /* WebIconDatabase.cpp */,
+				511B24A9132E097200065A0C /* WebIconDatabase.h */,
+				5184BC4A132E907A006B9E28 /* WebIconDatabase.messages.in */,
 				1C8E28331275D73800BC7BD0 /* WebInspectorProxy.cpp */,
 				1C8E28321275D73800BC7BD0 /* WebInspectorProxy.h */,
 				1C77C1951288A872006A742F /* WebInspectorProxy.messages.in */,
@@ -2399,6 +2557,9 @@
 				51A9E1041315CCFC009E7031 /* WebKeyValueStorageManagerProxy.messages.in */,
 				BCB9E76111232B9E00A137E0 /* WebLoaderClient.cpp */,
 				BC59534010FC04520098F82D /* WebLoaderClient.h */,
+				33D3A3B71339606200709BE4 /* WebMediaCacheManagerProxy.cpp */,
+				33D3A3B81339606200709BE4 /* WebMediaCacheManagerProxy.h */,
+				33D3A3B91339606200709BE4 /* WebMediaCacheManagerProxy.messages.in */,
 				BCF69FA11176D01400471A52 /* WebNavigationData.cpp */,
 				BCF69FA01176D01400471A52 /* WebNavigationData.h */,
 				BC1DFEA312B31F87005DF730 /* WebOpenPanelResultListenerProxy.cpp */,
@@ -2444,6 +2605,7 @@
 		BC0C376610F807660076D7CB /* C */ = {
 			isa = PBXGroup;
 			children = (
+				5123CF18133D25E60056F800 /* cg */,
 				BCB63477116BF10600603215 /* WebKit2.h */,
 				BCDDB32C124EC2E10048D13C /* WKAPICast.h */,
 				517A33B3130B308C00F80CB5 /* WKApplicationCacheManager.cpp */,
@@ -2480,10 +2642,14 @@
 				BC06F44C12DBDF3F002D78DE /* WKGeolocationPermissionRequest.h */,
 				BC0E619712D6CD120012A72A /* WKGeolocationPosition.cpp */,
 				BC0E619612D6CD120012A72A /* WKGeolocationPosition.h */,
+				5110AE0A133C16CB0072717A /* WKIconDatabase.cpp */,
+				5110AE0B133C16CB0072717A /* WKIconDatabase.h */,
 				1C8E293812761E5B00BC7BD0 /* WKInspector.cpp */,
 				1C8E293712761E5B00BC7BD0 /* WKInspector.h */,
 				51A9E1081315CD18009E7031 /* WKKeyValueStorageManager.cpp */,
 				51A9E1091315CD18009E7031 /* WKKeyValueStorageManager.h */,
+				33D3A3B31339600B00709BE4 /* WKMediaCacheManager.cpp */,
+				33D3A3B41339600B00709BE4 /* WKMediaCacheManager.h */,
 				C09AE5E8125257C20025825D /* WKNativeEvent.h */,
 				BCF69FA81176D1CB00471A52 /* WKNavigationData.cpp */,
 				BCF69FA71176D1CB00471A52 /* WKNavigationData.h */,
@@ -2620,6 +2786,14 @@
 			path = CoreIPCSupport;
 			sourceTree = "<group>";
 		};
+		BC122FA51327085D00F7EAC1 /* PluginProcess */ = {
+			isa = PBXGroup;
+			children = (
+				BC122FA61327087400F7EAC1 /* Info.plist */,
+			);
+			name = PluginProcess;
+			sourceTree = "<group>";
+		};
 		BC204EDF11C83E72008F3375 /* InjectedBundle */ = {
 			isa = PBXGroup;
 			children = (
@@ -2742,6 +2916,8 @@
 		BC4075D5124FEFFA0068F20A /* cf */ = {
 			isa = PBXGroup;
 			children = (
+				BCFD5489132D82680055D816 /* WKErrorCF.cpp */,
+				BCFD548A132D82680055D816 /* WKErrorCF.h */,
 				BC407611124FF0370068F20A /* WKStringCF.cpp */,
 				BC407612124FF0370068F20A /* WKStringCF.h */,
 				BC407613124FF0370068F20A /* WKURLCF.cpp */,
@@ -2804,8 +2980,6 @@
 				29CD55A8128E294F00133C85 /* AccessibilityWebPageObject.h */,
 				29CD55A9128E294F00133C85 /* AccessibilityWebPageObject.mm */,
 				BC5F7BB8118237990052C02C /* ChunkedUpdateDrawingAreaMac.cpp */,
-				1A690D1612F39E3300ECD289 /* LayerTreeHostMac.h */,
-				1A18718412EF9877008E5F37 /* LayerTreeHostMac.mm */,
 				1C8E2DAD1278C5B200BC7BD0 /* WebInspectorMac.mm */,
 				BC963D6D113DD1A500574BE2 /* WebPageMac.mm */,
 			);
@@ -2824,17 +2998,23 @@
 		BCCF085C113F3B7500C650C5 /* mac */ = {
 			isa = PBXGroup;
 			children = (
+				F6D632BA133D181B00743D77 /* WebCookieManagerProxyMac.mm */,
 				1A64292C12DE5F9800CAAE2C /* BackingStoreMac.mm */,
 				BC2651F511825EF800243E12 /* ChunkedUpdateDrawingAreaProxyMac.mm */,
+				B878B613133428DC006888E9 /* CorrectionPanel.h */,
+				B878B614133428DC006888E9 /* CorrectionPanel.mm */,
 				1AA417ED12C00D87002BE67B /* TextCheckerMac.mm */,
 				1A1C648611F415B700553C19 /* WebContextMac.mm */,
 				51ACBB9E127A8F2C00D203B9 /* WebContextMenuProxyMac.h */,
 				51ACBB9F127A8F2C00D203B9 /* WebContextMenuProxyMac.mm */,
+				CDCA85DE132AD05300E961DF /* WebFullScreenManagerProxyMac.mm */,
 				1CA8B935127C774E00576C2B /* WebInspectorProxyMac.mm */,
 				BC857E8512B71EBB00EDEB2E /* WebPageProxyMac.mm */,
 				BC5750951268F3C6006F0F12 /* WebPopupMenuProxyMac.h */,
 				BC5750961268F3C6006F0F12 /* WebPopupMenuProxyMac.mm */,
 				BC84EB1712A7100C0083F2DA /* WebPreferencesMac.mm */,
+				CDCA85C6132ABA4E00E961DF /* WKFullScreenWindowController.mm */,
+				CDCA85C7132ABA4E00E961DF /* WKFullScreenWindowController.h */,
 			);
 			path = mac;
 			sourceTree = "<group>";
@@ -2925,6 +3105,24 @@
 			path = cg;
 			sourceTree = "<group>";
 		};
+		C03A136A133BEBF900D767D1 /* mac */ = {
+			isa = PBXGroup;
+			children = (
+				C03A136B133BEBF900D767D1 /* LayerTreeHostCAMac.mm */,
+			);
+			path = mac;
+			sourceTree = "<group>";
+		};
+		C098A052133BE1C500B199A4 /* ca */ = {
+			isa = PBXGroup;
+			children = (
+				C03A136A133BEBF900D767D1 /* mac */,
+				C098A053133BE1C500B199A4 /* LayerTreeHostCA.h */,
+				C098A054133BE1C500B199A4 /* LayerTreeHostCA.cpp */,
+			);
+			path = ca;
+			sourceTree = "<group>";
+		};
 		C0CE729D1247E71D00BC0EC4 /* Derived Sources */ = {
 			isa = PBXGroup;
 			children = (
@@ -2960,10 +3158,18 @@
 				F62A76B312B1B25F0005F1B6 /* WebDatabaseManagerMessages.h */,
 				F62A76B412B1B25F0005F1B6 /* WebDatabaseManagerProxyMessageReceiver.cpp */,
 				F62A76B512B1B25F0005F1B6 /* WebDatabaseManagerProxyMessages.h */,
+				CD73BA48131ACD8E00EEDED2 /* WebFullScreenManagerMessageReceiver.cpp */,
+				CD73BA49131ACD8E00EEDED2 /* WebFullScreenManagerMessages.h */,
+				CD73BA4A131ACD8F00EEDED2 /* WebFullScreenManagerProxyMessages.h */,
+				CD73BA45131ACC8800EEDED2 /* WebFullScreenManagerProxyMessageReceiver.cpp */,
 				BC0E605F12D6BA910012A72A /* WebGeolocationManagerMessageReceiver.cpp */,
 				BC0E606012D6BA910012A72A /* WebGeolocationManagerMessages.h */,
 				BC0E618012D6CB1D0012A72A /* WebGeolocationManagerProxyMessageReceiver.cpp */,
 				BC0E618112D6CB1D0012A72A /* WebGeolocationManagerProxyMessages.h */,
+				51D02F63132EC5B900BEAA96 /* WebIconDatabaseMessageReceiver.cpp */,
+				51D02F67132EC73700BEAA96 /* WebIconDatabaseMessages.h */,
+				51D02F68132EC73700BEAA96 /* WebIconDatabaseProxyMessageReceiver.cpp */,
+				51D02F69132EC73700BEAA96 /* WebIconDatabaseProxyMessages.h */,
 				1C8E2A311277852400BC7BD0 /* WebInspectorMessageReceiver.cpp */,
 				1C8E2A321277852400BC7BD0 /* WebInspectorMessages.h */,
 				1CA8B943127C882A00576C2B /* WebInspectorProxyMessageReceiver.cpp */,
@@ -2972,6 +3178,10 @@
 				51A9E1251315ED35009E7031 /* WebKeyValueStorageManagerMessages.h */,
 				51A9E1261315ED35009E7031 /* WebKeyValueStorageManagerProxyMessageReceiver.cpp */,
 				51A9E1271315ED35009E7031 /* WebKeyValueStorageManagerProxyMessages.h */,
+				33D3A3C41339617900709BE4 /* WebMediaCacheManagerMessageReceiver.cpp */,
+				33D3A3C51339617900709BE4 /* WebMediaCacheManagerMessages.h */,
+				33D3A3C61339617900709BE4 /* WebMediaCacheManagerProxyMessageReceiver.cpp */,
+				33D3A3C71339617900709BE4 /* WebMediaCacheManagerProxyMessages.h */,
 				C0CE729E1247E71D00BC0EC4 /* WebPageMessageReceiver.cpp */,
 				C0CE729F1247E71D00BC0EC4 /* WebPageMessages.h */,
 				BCBD3912125BB1A800D2C29F /* WebPageProxyMessageReceiver.cpp */,
@@ -3015,6 +3225,36 @@
 			path = webkit2;
 			sourceTree = "<group>";
 		};
+		CD73BA3D131A2A2100EEDED2 /* FullScreen */ = {
+			isa = PBXGroup;
+			children = (
+				CDCA85E4132AD33000E961DF /* mac */,
+				CD73BA37131A29FE00EEDED2 /* WebFullScreenManager.cpp */,
+				CD73BA38131A29FE00EEDED2 /* WebFullScreenManager.h */,
+				CD73BA39131A29FE00EEDED2 /* WebFullScreenManager.messages.in */,
+			);
+			name = FullScreen;
+			sourceTree = "<group>";
+		};
+		CDCA85E4132AD33000E961DF /* mac */ = {
+			isa = PBXGroup;
+			children = (
+				CDCA85E5132AD33000E961DF /* WebFullScreenManagerMac.h */,
+				CDCA85E6132AD33000E961DF /* WebFullScreenManagerMac.mm */,
+			);
+			name = mac;
+			path = FullScreen/mac;
+			sourceTree = "<group>";
+		};
+		F638955A133BF57D008941D5 /* mac */ = {
+			isa = PBXGroup;
+			children = (
+				F6A90811133C1F3D0082C3F4 /* WebCookieManagerMac.mm */,
+			);
+			name = mac;
+			path = Cookies/mac;
+			sourceTree = "<group>";
+		};
 /* End PBXGroup section */
 
 /* Begin PBXHeadersBuildPhase section */
@@ -3362,7 +3602,6 @@
 				BFA6179F12F0B99D0033E0CA /* WKViewPrivate.h in Headers */,
 				1A9636BD12F348490078A062 /* ShareableSurface.h in Headers */,
 				1A9639F712F38ECD0078A062 /* CoreAnimationRenderer.h in Headers */,
-				1A690D1712F39E3300ECD289 /* LayerTreeHostMac.h in Headers */,
 				BC8147A912F64CDA007B2C32 /* InjectedBundlePagePolicyClient.h in Headers */,
 				BC8147D512F66D31007B2C32 /* InjectedBundleNavigationAction.h in Headers */,
 				BC7043CC12F75EE0006472B9 /* WKBundleNavigationAction.h in Headers */,
@@ -3397,6 +3636,21 @@
 				37C4E9F6131C6E7E0029BD5A /* config.h in Headers */,
 				E1BB16A413201B9B00F49431 /* FullKeyboardAccessWatcher.h in Headers */,
 				33AA1067131F060000D4A575 /* WebCookieManagerProxyClient.h in Headers */,
+				CDCA85C9132ABA4E00E961DF /* WKFullScreenWindowController.h in Headers */,
+				BCFD548C132D82680055D816 /* WKErrorCF.h in Headers */,
+				511B24A7132E095700065A0C /* WebIconDatabaseProxy.h in Headers */,
+				511B24AB132E097200065A0C /* WebIconDatabase.h in Headers */,
+				51D02F6A132EC73700BEAA96 /* WebIconDatabaseMessages.h in Headers */,
+				51D02F6C132EC73700BEAA96 /* WebIconDatabaseProxyMessages.h in Headers */,
+				B878B615133428DC006888E9 /* CorrectionPanel.h in Headers */,
+				33D3A3B61339600B00709BE4 /* WKMediaCacheManager.h in Headers */,
+				33D3A3BB1339606200709BE4 /* WebMediaCacheManagerProxy.h in Headers */,
+				33D3A3C2133960B000709BE4 /* WebMediaCacheManager.h in Headers */,
+				33D3A3C91339617900709BE4 /* WebMediaCacheManagerMessages.h in Headers */,
+				33D3A3CB1339617900709BE4 /* WebMediaCacheManagerProxyMessages.h in Headers */,
+				C064504A133BE709003470E2 /* LayerTreeHostCA.h in Headers */,
+				5110AE0D133C16CB0072717A /* WKIconDatabase.h in Headers */,
+				5123CF1C133D260A0056F800 /* WKIconDatabaseCG.h in Headers */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
@@ -3409,12 +3663,10 @@
 			buildPhases = (
 				1A50DB1A110A3BDC000D3FE5 /* Resources */,
 				1A50DB1B110A3BDC000D3FE5 /* Sources */,
-				1AC25FDD12A4904500BD2671 /* Copy Plug-in Process Shim */,
 			);
 			buildRules = (
 			);
 			dependencies = (
-				1AC25FD812A48FD500BD2671 /* PBXTargetDependency */,
 				1A50DB27110A3BEF000D3FE5 /* PBXTargetDependency */,
 			);
 			name = WebProcess;
@@ -3464,6 +3716,25 @@
 			productReference = 8DC2EF5B0486A6940098B216 /* WebKit2.framework */;
 			productType = "com.apple.product-type.framework";
 		};
+		BCDE093313272496001259FB /* PluginProcess */ = {
+			isa = PBXNativeTarget;
+			buildConfigurationList = BCDE093E13272496001259FB /* Build configuration list for PBXNativeTarget "PluginProcess" */;
+			buildPhases = (
+				BCDE093813272496001259FB /* Resources */,
+				BCDE093A13272496001259FB /* Sources */,
+				BCDE093C13272496001259FB /* Copy Plug-in Process Shim */,
+			);
+			buildRules = (
+			);
+			dependencies = (
+				BCDE093413272496001259FB /* PBXTargetDependency */,
+				BCDE093613272496001259FB /* PBXTargetDependency */,
+			);
+			name = PluginProcess;
+			productName = WebProcess;
+			productReference = BCDE094213272496001259FB /* PluginProcess.app */;
+			productType = "com.apple.product-type.application";
+		};
 /* End PBXNativeTarget section */
 
 /* Begin PBXProject section */
@@ -3487,6 +3758,7 @@
 				1A50DB38110A3C13000D3FE5 /* All */,
 				8DC2EF4F0486A6940098B216 /* WebKit2 */,
 				1A50DB1D110A3BDC000D3FE5 /* WebProcess */,
+				BCDE093313272496001259FB /* PluginProcess */,
 				C0CE72851247E66800BC0EC4 /* Derived Sources */,
 				1AC25FAF12A48EA700BD2671 /* PluginProcessShim */,
 			);
@@ -3510,6 +3782,13 @@
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
+		BCDE093813272496001259FB /* Resources */ = {
+			isa = PBXResourcesBuildPhase;
+			buildActionMask = 2147483647;
+			files = (
+			);
+			runOnlyForDeploymentPostprocessing = 0;
+		};
 /* End PBXResourcesBuildPhase section */
 
 /* Begin PBXShellScriptBuildPhase section */
@@ -3608,10 +3887,6 @@
 			buildActionMask = 2147483647;
 			files = (
 				1A6FA31111E3921E00DB1371 /* MainMac.cpp in Sources */,
-				1A1FA285127A13BC0050E709 /* NPObjectProxy.cpp in Sources */,
-				1A1FA35D127A45BF0050E709 /* NPObjectMessageReceiver.cpp in Sources */,
-				E18C92F512DB9E7A00CF2AEB /* PrintInfo.cpp in Sources */,
-				E18C92F612DB9E9400CF2AEB /* PrintInfoMac.mm in Sources */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
@@ -3619,7 +3894,7 @@
 			isa = PBXSourcesBuildPhase;
 			buildActionMask = 2147483647;
 			files = (
-				1AC25FC212A48F6000BD2671 /* PluginProcessShim.cpp in Sources */,
+				1AC25FC212A48F6000BD2671 /* PluginProcessShim.mm in Sources */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
@@ -3934,7 +4209,6 @@
 				E134F01A12EA5D99004EC58D /* WKPrintingView.mm in Sources */,
 				BC9585C812F095B800755821 /* WebGestureEvent.cpp in Sources */,
 				1A186EEB12EF7618008E5F37 /* LayerTreeHost.cpp in Sources */,
-				1A18718512EF9877008E5F37 /* LayerTreeHostMac.mm in Sources */,
 				6501BD1A12F1243400E9F248 /* WKBundleInspector.cpp in Sources */,
 				1A9636BC12F348490078A062 /* ShareableSurface.cpp in Sources */,
 				1A9639F812F38ECD0078A062 /* CoreAnimationRenderer.mm in Sources */,
@@ -3976,6 +4250,39 @@
 				BCE81D98131AE02100241910 /* DictionaryPopupInfo.cpp in Sources */,
 				E1BB16A513201B9B00F49431 /* FullKeyboardAccessWatcher.mm in Sources */,
 				33AA1066131F060000D4A575 /* WebCookieManagerProxyClient.cpp in Sources */,
+				CD73BA47131ACC9A00EEDED2 /* WebFullScreenManagerProxyMessageReceiver.cpp in Sources */,
+				CD73BA4E131ACDB700EEDED2 /* WebFullScreenManagerMessageReceiver.cpp in Sources */,
+				CD73BA53131B645B00EEDED2 /* WebFullScreenManager.cpp in Sources */,
+				CD6F75F4131B66D000D6B21E /* WebFullScreenManagerProxy.cpp in Sources */,
+				CDCA85C8132ABA4E00E961DF /* WKFullScreenWindowController.mm in Sources */,
+				CDCA85EE132AD70100E961DF /* WebFullScreenManagerProxyMac.mm in Sources */,
+				CDCA8603132ADC0500E961DF /* WebFullScreenManagerMac.mm in Sources */,
+				BCFD548B132D82680055D816 /* WKErrorCF.cpp in Sources */,
+				511B24A6132E095700065A0C /* WebIconDatabaseProxy.cpp in Sources */,
+				511B24AA132E097200065A0C /* WebIconDatabase.cpp in Sources */,
+				51D02F64132EC5B900BEAA96 /* WebIconDatabaseMessageReceiver.cpp in Sources */,
+				51D02F6B132EC73700BEAA96 /* WebIconDatabaseProxyMessageReceiver.cpp in Sources */,
+				B878B616133428DC006888E9 /* CorrectionPanel.mm in Sources */,
+				33D3A3B51339600B00709BE4 /* WKMediaCacheManager.cpp in Sources */,
+				33D3A3BA1339606200709BE4 /* WebMediaCacheManagerProxy.cpp in Sources */,
+				33D3A3C1133960B000709BE4 /* WebMediaCacheManager.cpp in Sources */,
+				33D3A3C81339617900709BE4 /* WebMediaCacheManagerMessageReceiver.cpp in Sources */,
+				33D3A3CA1339617900709BE4 /* WebMediaCacheManagerProxyMessageReceiver.cpp in Sources */,
+				5160BFE113381DF900918999 /* Logging.mac.mm in Sources */,
+				C0D74DDE133BE2D90089CD44 /* LayerTreeHostCA.cpp in Sources */,
+				C03A136C133BEBF900D767D1 /* LayerTreeHostCAMac.mm in Sources */,
+				5110AE0C133C16CB0072717A /* WKIconDatabase.cpp in Sources */,
+				5123CF1B133D260A0056F800 /* WKIconDatabaseCG.cpp in Sources */,
+				F6A90813133C20510082C3F4 /* WebCookieManagerMac.mm in Sources */,
+				F6D632BC133D198200743D77 /* WebCookieManagerProxyMac.mm in Sources */,
+			);
+			runOnlyForDeploymentPostprocessing = 0;
+		};
+		BCDE093A13272496001259FB /* Sources */ = {
+			isa = PBXSourcesBuildPhase;
+			buildActionMask = 2147483647;
+			files = (
+				BCDE093B13272496001259FB /* MainMac.cpp in Sources */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
@@ -3992,16 +4299,26 @@
 			target = 1A50DB1D110A3BDC000D3FE5 /* WebProcess */;
 			targetProxy = 1A50DB3B110A3C19000D3FE5 /* PBXContainerItemProxy */;
 		};
-		1AC25FD812A48FD500BD2671 /* PBXTargetDependency */ = {
-			isa = PBXTargetDependency;
-			target = 1AC25FAF12A48EA700BD2671 /* PluginProcessShim */;
-			targetProxy = 1AC25FD712A48FD500BD2671 /* PBXContainerItemProxy */;
-		};
 		37F7407912721F740093869B /* PBXTargetDependency */ = {
 			isa = PBXTargetDependency;
 			target = C0CE72851247E66800BC0EC4 /* Derived Sources */;
 			targetProxy = 37F7407812721F740093869B /* PBXContainerItemProxy */;
 		};
+		BCDE093413272496001259FB /* PBXTargetDependency */ = {
+			isa = PBXTargetDependency;
+			target = 1AC25FAF12A48EA700BD2671 /* PluginProcessShim */;
+			targetProxy = BCDE093513272496001259FB /* PBXContainerItemProxy */;
+		};
+		BCDE093613272496001259FB /* PBXTargetDependency */ = {
+			isa = PBXTargetDependency;
+			target = 8DC2EF4F0486A6940098B216 /* WebKit2 */;
+			targetProxy = BCDE093713272496001259FB /* PBXContainerItemProxy */;
+		};
+		BCDE0AC113272712001259FB /* PBXTargetDependency */ = {
+			isa = PBXTargetDependency;
+			target = BCDE093313272496001259FB /* PluginProcess */;
+			targetProxy = BCDE0AC013272712001259FB /* PBXContainerItemProxy */;
+		};
 /* End PBXTargetDependency section */
 
 /* Begin PBXVariantGroup section */
@@ -4048,6 +4365,10 @@
 			isa = XCBuildConfiguration;
 			baseConfigurationReference = 1AC25FBB12A48EDA00BD2671 /* PluginProcessShim.xcconfig */;
 			buildSettings = {
+				OTHER_LDFLAGS = (
+					"$(OTHER_LDFLAGS)",
+					"-l$(WEBKIT_SYSTEM_INTERFACE_LIBRARY)",
+				);
 			};
 			name = Debug;
 		};
@@ -4055,6 +4376,10 @@
 			isa = XCBuildConfiguration;
 			baseConfigurationReference = 1AC25FBB12A48EDA00BD2671 /* PluginProcessShim.xcconfig */;
 			buildSettings = {
+				OTHER_LDFLAGS = (
+					"$(OTHER_LDFLAGS)",
+					"-l$(WEBKIT_SYSTEM_INTERFACE_LIBRARY)",
+				);
 			};
 			name = Release;
 		};
@@ -4062,6 +4387,10 @@
 			isa = XCBuildConfiguration;
 			baseConfigurationReference = 1AC25FBB12A48EDA00BD2671 /* PluginProcessShim.xcconfig */;
 			buildSettings = {
+				OTHER_LDFLAGS = (
+					"$(OTHER_LDFLAGS)",
+					"-lWebKitSystemInterface",
+				);
 			};
 			name = Production;
 		};
@@ -4137,6 +4466,27 @@
 			};
 			name = Production;
 		};
+		BCDE093F13272496001259FB /* Debug */ = {
+			isa = XCBuildConfiguration;
+			baseConfigurationReference = BC122FA3132707F300F7EAC1 /* PluginProcess.xcconfig */;
+			buildSettings = {
+			};
+			name = Debug;
+		};
+		BCDE094013272496001259FB /* Release */ = {
+			isa = XCBuildConfiguration;
+			baseConfigurationReference = BC122FA3132707F300F7EAC1 /* PluginProcess.xcconfig */;
+			buildSettings = {
+			};
+			name = Release;
+		};
+		BCDE094113272496001259FB /* Production */ = {
+			isa = XCBuildConfiguration;
+			baseConfigurationReference = BC122FA3132707F300F7EAC1 /* PluginProcess.xcconfig */;
+			buildSettings = {
+			};
+			name = Production;
+		};
 		C0CE72861247E66800BC0EC4 /* Debug */ = {
 			isa = XCBuildConfiguration;
 			buildSettings = {
@@ -4218,6 +4568,16 @@
 			defaultConfigurationIsVisible = 0;
 			defaultConfigurationName = Production;
 		};
+		BCDE093E13272496001259FB /* Build configuration list for PBXNativeTarget "PluginProcess" */ = {
+			isa = XCConfigurationList;
+			buildConfigurations = (
+				BCDE093F13272496001259FB /* Debug */,
+				BCDE094013272496001259FB /* Release */,
+				BCDE094113272496001259FB /* Production */,
+			);
+			defaultConfigurationIsVisible = 0;
+			defaultConfigurationName = Production;
+		};
 		C0CE72891247E68600BC0EC4 /* Build configuration list for PBXAggregateTarget "Derived Sources" */ = {
 			isa = XCConfigurationList;
 			buildConfigurations = (
diff --git a/Source/WebKit2/WebProcess/ApplicationCache/WebApplicationCacheManager.cpp b/Source/WebKit2/WebProcess/ApplicationCache/WebApplicationCacheManager.cpp
index 71ae14f..4f91e3d 100644
--- a/Source/WebKit2/WebProcess/ApplicationCache/WebApplicationCacheManager.cpp
+++ b/Source/WebKit2/WebProcess/ApplicationCache/WebApplicationCacheManager.cpp
@@ -30,6 +30,7 @@
 #include "SecurityOriginData.h"
 #include "WebApplicationCacheManagerProxyMessages.h"
 #include "WebProcess.h"
+#include <WebCore/ApplicationCache.h>
 #include <WebCore/ApplicationCacheStorage.h>
 #include <WebCore/SecurityOrigin.h>
 #include <WebCore/SecurityOriginHash.h>
@@ -78,6 +79,7 @@ void WebApplicationCacheManager::getApplicationCacheOrigins(uint64_t callbackID)
     }
 
     WebProcess::shared().connection()->send(Messages::WebApplicationCacheManagerProxy::DidGetApplicationCacheOrigins(identifiers, callbackID), 0);
+    WebProcess::shared().terminateIfPossible();
 }
 
 void WebApplicationCacheManager::deleteEntriesForOrigin(const SecurityOriginData& originData)
@@ -87,8 +89,9 @@ void WebApplicationCacheManager::deleteEntriesForOrigin(const SecurityOriginData
     if (!origin)
         return;
     
-    cacheStorage().deleteEntriesForOrigin(origin.get());
+    ApplicationCache::deleteCacheForOrigin(origin.get());
 #endif
+    WebProcess::shared().terminateIfPossible();
 }
 
 void WebApplicationCacheManager::deleteAllEntries()
@@ -96,6 +99,7 @@ void WebApplicationCacheManager::deleteAllEntries()
 #if ENABLE(OFFLINE_WEB_APPLICATIONS)
     cacheStorage().deleteAllEntries();
 #endif
+    WebProcess::shared().terminateIfPossible();
 }
 
 } // namespace WebKit
diff --git a/Source/WebKit2/WebProcess/Authentication/AuthenticationManager.cpp b/Source/WebKit2/WebProcess/Authentication/AuthenticationManager.cpp
index af35f75..e7550d0 100644
--- a/Source/WebKit2/WebProcess/Authentication/AuthenticationManager.cpp
+++ b/Source/WebKit2/WebProcess/Authentication/AuthenticationManager.cpp
@@ -26,6 +26,8 @@
 #include "config.h"
 #include "AuthenticationManager.h"
 
+#include "Download.h"
+#include "DownloadProxyMessages.h"
 #include "MessageID.h"
 #include "WebCoreArgumentCoders.h"
 #include "WebFrame.h"
@@ -35,6 +37,8 @@
 #include <WebCore/AuthenticationChallenge.h>
 #include <WebCore/AuthenticationClient.h>
 
+using namespace WebCore;
+
 namespace WebKit {
 
 static uint64_t generateAuthenticationChallengeID()
@@ -58,46 +62,64 @@ void AuthenticationManager::didReceiveMessage(CoreIPC::Connection* connection, C
     didReceiveAuthenticationManagerMessage(connection, messageID, arguments);
 }
 
-void AuthenticationManager::didReceiveAuthenticationChallenge(WebFrame* frame, const WebCore::AuthenticationChallenge& authenticationChallenge)
+void AuthenticationManager::didReceiveAuthenticationChallenge(WebFrame* frame, const AuthenticationChallenge& authenticationChallenge)
 {
     ASSERT(frame);
     ASSERT(frame->page());
 
-    uint64_t id = generateAuthenticationChallengeID();
-    m_challenges.set(id, authenticationChallenge);    
+    uint64_t challengeID = generateAuthenticationChallengeID();
+    m_challenges.set(challengeID, authenticationChallenge);    
     
-    WebProcess::shared().connection()->send(Messages::WebPageProxy::DidReceiveAuthenticationChallenge(frame->frameID(), authenticationChallenge, id), frame->page()->pageID());
+    WebProcess::shared().connection()->send(Messages::WebPageProxy::DidReceiveAuthenticationChallenge(frame->frameID(), authenticationChallenge, challengeID), frame->page()->pageID());
+}
+
+void AuthenticationManager::didReceiveAuthenticationChallenge(Download* download, const AuthenticationChallenge& authenticationChallenge)
+{
+    uint64_t challengeID = generateAuthenticationChallengeID();
+    m_challenges.set(challengeID, authenticationChallenge);
+
+    download->send(Messages::DownloadProxy::DidReceiveAuthenticationChallenge(authenticationChallenge, challengeID));
 }
 
-void AuthenticationManager::useCredentialForChallenge(uint64_t challengeID, const WebCore::Credential& credential)
+void AuthenticationManager::useCredentialForChallenge(uint64_t challengeID, const Credential& credential)
 {
-    WebCore::AuthenticationChallenge challenge = m_challenges.take(challengeID);
+    AuthenticationChallenge challenge = m_challenges.take(challengeID);
     ASSERT(!challenge.isNull());
-    WebCore::AuthenticationClient* coreClient = challenge.authenticationClient();
-    if (!coreClient)
+    AuthenticationClient* coreClient = challenge.authenticationClient();
+    if (!coreClient) {
+        // This authentication challenge comes from a download.
+        Download::receivedCredential(challenge, credential);
         return;
+        
+    }
 
     coreClient->receivedCredential(challenge, credential);
 }
 
 void AuthenticationManager::continueWithoutCredentialForChallenge(uint64_t challengeID)
 {
-    WebCore::AuthenticationChallenge challenge = m_challenges.take(challengeID);
+    AuthenticationChallenge challenge = m_challenges.take(challengeID);
     ASSERT(!challenge.isNull());
-    WebCore::AuthenticationClient* coreClient = challenge.authenticationClient();
-    if (!coreClient)
+    AuthenticationClient* coreClient = challenge.authenticationClient();
+    if (!coreClient) {
+        // This authentication challenge comes from a download.
+        Download::receivedRequestToContinueWithoutCredential(challenge);
         return;
+    }
 
     coreClient->receivedRequestToContinueWithoutCredential(challenge);
 }
 
 void AuthenticationManager::cancelChallenge(uint64_t challengeID)
 {
-    WebCore::AuthenticationChallenge challenge = m_challenges.take(challengeID);
+    AuthenticationChallenge challenge = m_challenges.take(challengeID);
     ASSERT(!challenge.isNull());
-    WebCore::AuthenticationClient* coreClient = challenge.authenticationClient();
-    if (!coreClient)
+    AuthenticationClient* coreClient = challenge.authenticationClient();
+    if (!coreClient) {
+        // This authentication challenge comes from a download.
+        Download::receivedCancellation(challenge);
         return;
+    }
 
     coreClient->receivedCancellation(challenge);
 }
diff --git a/Source/WebKit2/WebProcess/Authentication/AuthenticationManager.h b/Source/WebKit2/WebProcess/Authentication/AuthenticationManager.h
index ce5ff1c..2c67430 100644
--- a/Source/WebKit2/WebProcess/Authentication/AuthenticationManager.h
+++ b/Source/WebKit2/WebProcess/Authentication/AuthenticationManager.h
@@ -41,6 +41,7 @@ namespace WebCore {
 
 namespace WebKit {
 
+class Download;
 class WebFrame;
 
 class AuthenticationManager {
@@ -52,6 +53,7 @@ public:
     void didReceiveMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::ArgumentDecoder*);
 
     void didReceiveAuthenticationChallenge(WebFrame*, const WebCore::AuthenticationChallenge&);
+    void didReceiveAuthenticationChallenge(Download*, const WebCore::AuthenticationChallenge&);
 
     void useCredentialForChallenge(uint64_t challengeID, const WebCore::Credential&);
     void continueWithoutCredentialForChallenge(uint64_t challengeID);
diff --git a/Source/WebKit2/WebProcess/Cookies/WebCookieManager.cpp b/Source/WebKit2/WebProcess/Cookies/WebCookieManager.cpp
index 1c88ee2..4181e14 100644
--- a/Source/WebKit2/WebProcess/Cookies/WebCookieManager.cpp
+++ b/Source/WebKit2/WebProcess/Cookies/WebCookieManager.cpp
@@ -62,21 +62,25 @@ void WebCookieManager::getHostnamesWithCookies(uint64_t callbackID)
     copyToVector(hostnames, hostnameList);
 
     WebProcess::shared().connection()->send(Messages::WebCookieManagerProxy::DidGetHostnamesWithCookies(hostnameList, callbackID), 0);
+    WebProcess::shared().terminateIfPossible();
 }
 
 void WebCookieManager::deleteCookiesForHostname(const String& hostname)
 {
     WebCore::deleteCookiesForHostname(hostname);
+    WebProcess::shared().terminateIfPossible();
 }
 
 void WebCookieManager::deleteAllCookies()
 {
     WebCore::deleteAllCookies();
+    WebProcess::shared().terminateIfPossible();
 }
 
 void WebCookieManager::startObservingCookieChanges()
 {
     WebCore::startObservingCookieChanges();
+    WebProcess::shared().terminateIfPossible();
 }
 
 void WebCookieManager::stopObservingCookieChanges()
@@ -89,4 +93,16 @@ void WebCookieManager::dispatchCookiesDidChange()
     WebProcess::shared().connection()->send(Messages::WebCookieManagerProxy::CookiesDidChange(), 0);
 }
 
+void WebCookieManager::setHTTPCookieAcceptPolicy(HTTPCookieAcceptPolicy policy)
+{
+    platformSetHTTPCookieAcceptPolicy(policy);
+    WebProcess::shared().terminateIfPossible();
+}
+
+void WebCookieManager::getHTTPCookieAcceptPolicy(uint64_t callbackID)
+{
+    WebProcess::shared().connection()->send(Messages::WebCookieManagerProxy::DidGetHTTPCookieAcceptPolicy(platformGetHTTPCookieAcceptPolicy(), callbackID), 0);
+    WebProcess::shared().terminateIfPossible();
+}
+
 } // namespace WebKit
diff --git a/Source/WebKit2/WebProcess/Cookies/WebCookieManager.h b/Source/WebKit2/WebProcess/Cookies/WebCookieManager.h
index 911020c..c0bd1f3 100644
--- a/Source/WebKit2/WebProcess/Cookies/WebCookieManager.h
+++ b/Source/WebKit2/WebProcess/Cookies/WebCookieManager.h
@@ -26,6 +26,7 @@
 #ifndef WebCookieManager_h
 #define WebCookieManager_h
 
+#include "HTTPCookieAcceptPolicy.h"
 #include <wtf/Noncopyable.h>
 #include <wtf/text/WTFString.h>
 
@@ -46,6 +47,8 @@ public:
     
     void dispatchCookiesDidChange();
 
+    void setHTTPCookieAcceptPolicy(HTTPCookieAcceptPolicy);
+
 private:
     WebCookieManager();
     
@@ -53,6 +56,10 @@ private:
     void deleteCookiesForHostname(const String&);
     void deleteAllCookies();
 
+    void platformSetHTTPCookieAcceptPolicy(HTTPCookieAcceptPolicy);
+    void getHTTPCookieAcceptPolicy(uint64_t callbackID);
+    HTTPCookieAcceptPolicy platformGetHTTPCookieAcceptPolicy();
+
     void startObservingCookieChanges();
     void stopObservingCookieChanges();
 
diff --git a/Source/WebKit2/WebProcess/Cookies/WebCookieManager.messages.in b/Source/WebKit2/WebProcess/Cookies/WebCookieManager.messages.in
index 470facb..15de9b6 100644
--- a/Source/WebKit2/WebProcess/Cookies/WebCookieManager.messages.in
+++ b/Source/WebKit2/WebProcess/Cookies/WebCookieManager.messages.in
@@ -27,6 +27,9 @@
     void GetHostnamesWithCookies(uint64_t callbackID)
     void DeleteCookiesForHostname(WTF::String hostname)
     void DeleteAllCookies()
+
+    void SetHTTPCookieAcceptPolicy(uint32_t policy)
+    void GetHTTPCookieAcceptPolicy(uint64_t callbackID)
     
     void StartObservingCookieChanges()
     void StopObservingCookieChanges()
diff --git a/Source/WebKit2/WebProcess/Cookies/cf/WebCookieManagerCFNet.cpp b/Source/WebKit2/WebProcess/Cookies/cf/WebCookieManagerCFNet.cpp
new file mode 100644
index 0000000..b0fb3d1
--- /dev/null
+++ b/Source/WebKit2/WebProcess/Cookies/cf/WebCookieManagerCFNet.cpp
@@ -0,0 +1,50 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WebCookieManager.h"
+
+#include <CFNetwork/CFHTTPCookiesPriv.h>
+#include <WebCore/CookieStorage.h>
+#include <WebCore/CookieStorageCFNet.h>
+
+namespace WebKit {
+
+void WebCookieManager::platformSetHTTPCookieAcceptPolicy(HTTPCookieAcceptPolicy policy)
+{
+    CFHTTPCookieStorageSetCookieAcceptPolicy(WebCore::defaultCookieStorage(), policy);
+
+    CFHTTPCookieStorageRef privateBrowsingCookieStorage = WebCore::privateBrowsingCookieStorage();
+    if (!privateBrowsingCookieStorage)
+        return;
+    CFHTTPCookieStorageSetCookieAcceptPolicy(privateBrowsingCookieStorage, policy);
+}
+
+HTTPCookieAcceptPolicy WebCookieManager::platformGetHTTPCookieAcceptPolicy()
+{
+    return CFHTTPCookieStorageGetCookieAcceptPolicy(WebCore::currentCookieStorage());
+}
+
+} // namespace WebKit
diff --git a/Source/WebKit2/WebProcess/Cookies/curl/WebCookieManagerCurl.cpp b/Source/WebKit2/WebProcess/Cookies/curl/WebCookieManagerCurl.cpp
new file mode 100644
index 0000000..505082d
--- /dev/null
+++ b/Source/WebKit2/WebProcess/Cookies/curl/WebCookieManagerCurl.cpp
@@ -0,0 +1,47 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ * Copyright (C) 2011 Brent Fulgham <bfulgham@webkit.org>. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WebCookieManager.h"
+
+#include <WebCore/CookieStorage.h>
+#include <WebCore/NotImplemented.h>
+
+namespace WebKit {
+
+void WebCookieManager::platformSetHTTPCookieAcceptPolicy(HTTPCookieAcceptPolicy policy)
+{
+    // Fixme: To be implemented
+    notImplemented();
+}
+
+HTTPCookieAcceptPolicy WebCookieManager::platformGetHTTPCookieAcceptPolicy()
+{
+    notImplemented();
+    return HTTPCookieAcceptPolicyOnlyFromMainDocumentDomain;
+}
+
+} // namespace WebKit
diff --git a/Source/WebKit2/WebProcess/Cookies/gtk/WebCookieManagerGtk.cpp b/Source/WebKit2/WebProcess/Cookies/gtk/WebCookieManagerGtk.cpp
new file mode 100644
index 0000000..acdd608
--- /dev/null
+++ b/Source/WebKit2/WebProcess/Cookies/gtk/WebCookieManagerGtk.cpp
@@ -0,0 +1,42 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WebCookieManager.h"
+
+namespace WebKit {
+
+void WebCookieManager::platformSetHTTPCookieAcceptPolicy(HTTPCookieAcceptPolicy)
+{
+    // FIXME: Not implemented.
+}
+
+HTTPCookieAcceptPolicy WebCookieManager::platformGetHTTPCookieAcceptPolicy()
+{
+    // FIXME: Not implemented.
+    return HTTPCookieAcceptPolicyAlways;
+}
+
+} // namespace WebKit
diff --git a/Source/WebKit2/WebProcess/Cookies/mac/WebCookieManagerMac.mm b/Source/WebKit2/WebProcess/Cookies/mac/WebCookieManagerMac.mm
new file mode 100644
index 0000000..cf73622
--- /dev/null
+++ b/Source/WebKit2/WebProcess/Cookies/mac/WebCookieManagerMac.mm
@@ -0,0 +1,45 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#import "config.h"
+#import "WebCookieManager.h"
+
+namespace WebKit {
+
+void WebCookieManager::platformSetHTTPCookieAcceptPolicy(HTTPCookieAcceptPolicy policy)
+{
+    [[NSHTTPCookieStorage sharedHTTPCookieStorage] setCookieAcceptPolicy:policy];
+
+#if USE(CFURLSTORAGESESSIONS)
+    // FIXME: Also update the Private Browsing Storage Session's cookie storage.
+#endif
+}
+
+HTTPCookieAcceptPolicy WebCookieManager::platformGetHTTPCookieAcceptPolicy()
+{
+    return [[NSHTTPCookieStorage sharedHTTPCookieStorage] cookieAcceptPolicy];
+}
+
+} // namespace WebKit
diff --git a/Source/WebKit2/WebProcess/Cookies/qt/WebCookieManagerQt.cpp b/Source/WebKit2/WebProcess/Cookies/qt/WebCookieManagerQt.cpp
new file mode 100644
index 0000000..acdd608
--- /dev/null
+++ b/Source/WebKit2/WebProcess/Cookies/qt/WebCookieManagerQt.cpp
@@ -0,0 +1,42 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WebCookieManager.h"
+
+namespace WebKit {
+
+void WebCookieManager::platformSetHTTPCookieAcceptPolicy(HTTPCookieAcceptPolicy)
+{
+    // FIXME: Not implemented.
+}
+
+HTTPCookieAcceptPolicy WebCookieManager::platformGetHTTPCookieAcceptPolicy()
+{
+    // FIXME: Not implemented.
+    return HTTPCookieAcceptPolicyAlways;
+}
+
+} // namespace WebKit
diff --git a/Source/WebKit2/WebProcess/Downloads/Download.cpp b/Source/WebKit2/WebProcess/Downloads/Download.cpp
index 1c36df2..3fc87d9 100644
--- a/Source/WebKit2/WebProcess/Downloads/Download.cpp
+++ b/Source/WebKit2/WebProcess/Downloads/Download.cpp
@@ -26,6 +26,7 @@
 #include "config.h"
 #include "Download.h"
 
+#include "AuthenticationManager.h"
 #include "Connection.h"
 #include "DataReference.h"
 #include "DownloadProxyMessages.h"
@@ -68,6 +69,11 @@ void Download::didStart()
     send(Messages::DownloadProxy::DidStart(m_request));
 }
 
+void Download::didReceiveAuthenticationChallenge(const AuthenticationChallenge& authenticationChallenge)
+{
+    AuthenticationManager::shared().didReceiveAuthenticationChallenge(this, authenticationChallenge);
+}
+
 void Download::didReceiveResponse(const ResourceResponse& response)
 {
     send(Messages::DownloadProxy::DidReceiveResponse(response));
diff --git a/Source/WebKit2/WebProcess/Downloads/Download.h b/Source/WebKit2/WebProcess/Downloads/Download.h
index 26d8f3d..780e8c2 100644
--- a/Source/WebKit2/WebProcess/Downloads/Download.h
+++ b/Source/WebKit2/WebProcess/Downloads/Download.h
@@ -47,6 +47,8 @@ namespace CoreIPC {
 }
 
 namespace WebCore {
+    class AuthenticationChallenge;
+    class Credential;
     class ResourceError;
     class ResourceHandle;
     class ResourceResponse;
@@ -74,6 +76,7 @@ public:
     uint64_t downloadID() const { return m_downloadID; }
 
     void didStart();
+    void didReceiveAuthenticationChallenge(const WebCore::AuthenticationChallenge&);
     void didReceiveResponse(const WebCore::ResourceResponse&);
     void didReceiveData(uint64_t length);
     bool shouldDecodeSourceDataOfMIMEType(const String& mimeType);
@@ -89,6 +92,11 @@ public:
     const String& destination() const { return m_destination; }
 #endif
 
+    // Authentication
+    static void receivedCredential(const WebCore::AuthenticationChallenge&, const WebCore::Credential&);
+    static void receivedRequestToContinueWithoutCredential(const WebCore::AuthenticationChallenge&);
+    static void receivedCancellation(const WebCore::AuthenticationChallenge&);
+
 private:
     Download(uint64_t downloadID, const WebCore::ResourceRequest&);
 
@@ -105,10 +113,10 @@ private:
     RetainPtr<NSURLDownload> m_nsURLDownload;
     RetainPtr<WKDownloadAsDelegate> m_delegate;
 #endif
-#if USE(CFNETWORK)
     bool m_allowOverwrite;
     String m_destination;
     String m_bundlePath;
+#if USE(CFNETWORK)
     RetainPtr<CFURLDownloadRef> m_download;
 #endif
 };
diff --git a/Source/WebKit2/WebProcess/Downloads/cf/win/DownloadCFNetWin.cpp b/Source/WebKit2/WebProcess/Downloads/cf/win/DownloadCFWin.cpp
index 0dd6508..0dd6508 100644
--- a/Source/WebKit2/WebProcess/Downloads/cf/win/DownloadCFNetWin.cpp
+++ b/Source/WebKit2/WebProcess/Downloads/cf/win/DownloadCFWin.cpp
diff --git a/Source/WebKit2/WebProcess/Downloads/cf/DownloadCFNet.cpp b/Source/WebKit2/WebProcess/Downloads/cfnet/DownloadCFNet.cpp
index 3215039..170c6aa 100644
--- a/Source/WebKit2/WebProcess/Downloads/cf/DownloadCFNet.cpp
+++ b/Source/WebKit2/WebProcess/Downloads/cfnet/DownloadCFNet.cpp
@@ -70,6 +70,8 @@ void Download::start(WebPage*)
 
     CFURLDownloadScheduleWithCurrentMessageQueue(m_download.get());
     CFURLDownloadScheduleDownloadWithRunLoop(m_download.get(), loaderRunLoop(), kCFRunLoopDefaultMode);
+
+    CFURLDownloadStart(m_download.get());
 }
 
 void Download::startWithHandle(WebPage*, ResourceHandle* handle, const ResourceRequest& initialRequest, const ResourceResponse& response)
@@ -206,4 +208,19 @@ void didFailCallback(CFURLDownloadRef, CFErrorRef error, const void* clientInfo)
     downloadFromClientInfo(clientInfo)->didFail(ResourceError(error), dataReference);
 }
 
+void Download::receivedCredential(const AuthenticationChallenge& authenticationChallenge, const Credential& credential)
+{
+    notImplemented();
+}
+
+void Download::receivedRequestToContinueWithoutCredential(const AuthenticationChallenge& authenticationChallenge)
+{
+    notImplemented();
+}
+
+void Download::receivedCancellation(const AuthenticationChallenge& authenticationChallenge)
+{
+    notImplemented();
+}
+
 } // namespace WebKit
diff --git a/Source/WebKit2/WebProcess/Downloads/curl/DownloadCurl.cpp b/Source/WebKit2/WebProcess/Downloads/curl/DownloadCurl.cpp
index 6ebce01..0466e7c 100644
--- a/Source/WebKit2/WebProcess/Downloads/curl/DownloadCurl.cpp
+++ b/Source/WebKit2/WebProcess/Downloads/curl/DownloadCurl.cpp
@@ -58,7 +58,17 @@ void Download::didDecideDestination(const String& destination, bool allowOverwri
     notImplemented();
 }
 
-void Download::platformDidFinish()
+void Download::receivedCredential(const AuthenticationChallenge& authenticationChallenge, const Credential& credential)
+{
+    notImplemented();
+}
+
+void Download::receivedRequestToContinueWithoutCredential(const AuthenticationChallenge& authenticationChallenge)
+{
+    notImplemented();
+}
+
+void Download::receivedCancellation(const AuthenticationChallenge& authenticationChallenge)
 {
     notImplemented();
 }
diff --git a/Source/WebKit2/WebProcess/Downloads/mac/DownloadMac.mm b/Source/WebKit2/WebProcess/Downloads/mac/DownloadMac.mm
index f7fe8dc..2d09612 100644
--- a/Source/WebKit2/WebProcess/Downloads/mac/DownloadMac.mm
+++ b/Source/WebKit2/WebProcess/Downloads/mac/DownloadMac.mm
@@ -26,6 +26,7 @@
 #import "config.h"
 #import "Download.h"
 
+#import <WebCore/AuthenticationMac.h>
 #import <WebCore/BackForwardController.h>
 #import <WebCore/HistoryItem.h>
 #import <WebCore/NotImplemented.h>
@@ -177,6 +178,21 @@ void Download::platformDidFinish()
 {
 }
 
+void Download::receivedCredential(const AuthenticationChallenge& authenticationChallenge, const Credential& credential)
+{
+    [authenticationChallenge.sender() useCredential:mac(credential) forAuthenticationChallenge:authenticationChallenge.nsURLAuthenticationChallenge()];
+}
+
+void Download::receivedRequestToContinueWithoutCredential(const AuthenticationChallenge& authenticationChallenge)
+{
+    [authenticationChallenge.sender() continueWithoutCredentialForAuthenticationChallenge:authenticationChallenge.nsURLAuthenticationChallenge()];
+}
+
+void Download::receivedCancellation(const AuthenticationChallenge& authenticationChallenge)
+{
+    [authenticationChallenge.sender() cancelAuthenticationChallenge:authenticationChallenge.nsURLAuthenticationChallenge()];
+}
+
 } // namespace WebKit
 
 @implementation WKDownloadAsDelegate
@@ -216,8 +232,8 @@ void Download::platformDidFinish()
 
 - (void)download:(NSURLDownload *)download didReceiveAuthenticationChallenge:(NSURLAuthenticationChallenge *)challenge
 {
-    // FIXME: Implement.
-    notImplemented();
+    if (_download)
+        _download->didReceiveAuthenticationChallenge(core(challenge));
 }
 
 - (void)download:(NSURLDownload *)download didCancelAuthenticationChallenge:(NSURLAuthenticationChallenge *)challenge
@@ -228,9 +244,7 @@ void Download::platformDidFinish()
 
 - (BOOL)downloadShouldUseCredentialStorage:(NSURLDownload *)download
 {
-    // FIXME: Implement.
-    notImplemented();
-    return YES;
+    return NO;
 }
 
 - (void)download:(NSURLDownload *)download didReceiveResponse:(NSURLResponse *)response
diff --git a/Source/WebKit2/WebProcess/Downloads/qt/DownloadQt.cpp b/Source/WebKit2/WebProcess/Downloads/qt/DownloadQt.cpp
index 19b86f0..ad5e7de 100644
--- a/Source/WebKit2/WebProcess/Downloads/qt/DownloadQt.cpp
+++ b/Source/WebKit2/WebProcess/Downloads/qt/DownloadQt.cpp
@@ -62,4 +62,19 @@ void Download::platformDidFinish()
     notImplemented();
 }
 
+void Download::receivedCredential(const AuthenticationChallenge& authenticationChallenge, const Credential& credential)
+{
+    notImplemented();
+}
+
+void Download::receivedRequestToContinueWithoutCredential(const AuthenticationChallenge& authenticationChallenge)
+{
+    notImplemented();
+}
+
+void Download::receivedCancellation(const AuthenticationChallenge& authenticationChallenge)
+{
+    notImplemented();
+}
+
 } // namespace WebKit
diff --git a/Source/WebKit2/WebProcess/Plugins/Netscape/gtk/NetscapePluginGtk.cpp b/Source/WebKit2/WebProcess/Downloads/soup/DownloadSoup.cpp
index f7c9440..a228916 100644
--- a/Source/WebKit2/WebProcess/Plugins/Netscape/gtk/NetscapePluginGtk.cpp
+++ b/Source/WebKit2/WebProcess/Downloads/soup/DownloadSoup.cpp
@@ -1,6 +1,6 @@
 /*
- * Copyright (C) 2010 Apple Inc. All rights reserved.
- * Portions Copyright (c) 2010 Motorola Mobility, Inc.  All rights reserved.
+ * Copyright (C) 2010, 2011 Apple Inc. All rights reserved.
+ * Copyright (C) 2010 Brent Fulgham <bfulgham@webkit.org>
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -25,7 +25,7 @@
  */
 
 #include "config.h"
-#include "NetscapePlugin.h"
+#include "Download.h"
 
 #include <WebCore/NotImplemented.h>
 
@@ -33,73 +33,49 @@ using namespace WebCore;
 
 namespace WebKit {
 
-bool NetscapePlugin::platformPostInitialize()
+void Download::start(WebPage* initiatingWebPage)
 {
     notImplemented();
-    return true;
 }
 
-void NetscapePlugin::platformDestroy()
+void Download::startWithHandle(WebPage* initiatingPage, ResourceHandle*, const ResourceRequest& initialRequest, const ResourceResponse&)
 {
     notImplemented();
 }
 
-bool NetscapePlugin::platformInvalidate(const IntRect&)
+void Download::cancel()
 {
     notImplemented();
-    return false;
 }
 
-void NetscapePlugin::platformGeometryDidChange()
+void Download::platformInvalidate()
 {
     notImplemented();
 }
 
-void NetscapePlugin::platformPaint(GraphicsContext* context, const IntRect& dirtyRect, bool)
+void Download::didDecideDestination(const String& destination, bool allowOverwrite)
 {
     notImplemented();
 }
 
-NPEvent toNP(const WebMouseEvent& event)
+void Download::platformDidFinish()
 {
-    NPEvent npEvent = NPEvent();
     notImplemented();
-    return npEvent;
 }
 
-bool NetscapePlugin::platformHandleMouseEvent(const WebMouseEvent& event)
+void Download::receivedCredential(const AuthenticationChallenge& authenticationChallenge, const Credential& credential)
 {
     notImplemented();
-    return true;
 }
 
-bool NetscapePlugin::platformHandleWheelEvent(const WebWheelEvent&)
+void Download::receivedRequestToContinueWithoutCredential(const AuthenticationChallenge& authenticationChallenge)
 {
     notImplemented();
-    return false;
 }
 
-void NetscapePlugin::platformSetFocus(bool)
+void Download::receivedCancellation(const AuthenticationChallenge& authenticationChallenge)
 {
     notImplemented();
 }
 
-bool NetscapePlugin::platformHandleMouseEnterEvent(const WebMouseEvent& event)
-{
-    notImplemented();
-    return true;
-}
-
-bool NetscapePlugin::platformHandleMouseLeaveEvent(const WebMouseEvent& event)
-{
-    notImplemented();
-    return true;
-}
-
-bool NetscapePlugin::platformHandleKeyboardEvent(const WebKeyboardEvent&)
-{
-    notImplemented();
-    return false;
-}
-
 } // namespace WebKit
diff --git a/Source/WebKit2/WebProcess/FullScreen/WebFullScreenManager.cpp b/Source/WebKit2/WebProcess/FullScreen/WebFullScreenManager.cpp
new file mode 100644
index 0000000..e856876
--- /dev/null
+++ b/Source/WebKit2/WebProcess/FullScreen/WebFullScreenManager.cpp
@@ -0,0 +1,147 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+#include "config.h"
+#include "WebFullScreenManager.h"
+
+#if ENABLE(FULLSCREEN_API)
+
+#include "Connection.h"
+#include "MessageID.h"
+#include "WebCoreArgumentCoders.h"
+#include "WebFullScreenManagerProxyMessages.h"
+#include "WebPage.h"
+#include "WebProcess.h"
+#include <WebCore/Color.h>
+#include <WebCore/Page.h>
+#include <WebCore/Settings.h>
+
+using namespace WebCore;
+
+namespace WebKit {
+
+WebFullScreenManager::WebFullScreenManager(WebPage* page)
+    : m_page(page)
+{
+}
+    
+WebFullScreenManager::~WebFullScreenManager()
+{
+    
+}
+
+WebCore::Element* WebFullScreenManager::element() 
+{ 
+    return m_element.get(); 
+}
+
+void WebFullScreenManager::didReceiveMessage(CoreIPC::Connection* connection, CoreIPC::MessageID messageID, CoreIPC::ArgumentDecoder* arguments)
+{
+    didReceiveWebFullScreenManagerMessage(connection, messageID, arguments);
+}
+
+bool WebFullScreenManager::supportsFullScreen(bool withKeyboard)
+{
+    if (!m_page->corePage()->settings()->fullScreenEnabled())
+        return false;
+
+    bool supports = true;
+    m_page->sendSync(Messages::WebFullScreenManagerProxy::SupportsFullScreen(withKeyboard), supports);
+    return supports;
+}
+
+void WebFullScreenManager::enterFullScreenForElement(WebCore::Element* element)
+{
+    ASSERT(element);
+    m_element = element;
+    m_initialFrame = m_element->screenRect();
+    m_page->send(Messages::WebFullScreenManagerProxy::EnterFullScreen());
+}
+
+void WebFullScreenManager::exitFullScreenForElement(WebCore::Element* element)
+{
+    ASSERT(element);
+    ASSERT(m_element == element);
+    m_page->send(Messages::WebFullScreenManagerProxy::ExitFullScreen());
+}
+
+void WebFullScreenManager::beganEnterFullScreenAnimation()
+{
+    m_page->send(Messages::WebFullScreenManagerProxy::BeganEnterFullScreenAnimation());
+}
+
+void WebFullScreenManager::finishedEnterFullScreenAnimation(bool completed)
+{
+    m_page->send(Messages::WebFullScreenManagerProxy::FinishedEnterFullScreenAnimation(completed));
+}
+
+void WebFullScreenManager::beganExitFullScreenAnimation()
+{
+    m_page->send(Messages::WebFullScreenManagerProxy::BeganExitFullScreenAnimation());
+}
+
+void WebFullScreenManager::finishedExitFullScreenAnimation(bool completed)
+{
+    m_page->send(Messages::WebFullScreenManagerProxy::FinishedExitFullScreenAnimation(completed));
+}
+    
+IntRect WebFullScreenManager::getFullScreenRect()
+{
+    IntRect rect;
+    m_page->sendSync(Messages::WebFullScreenManagerProxy::GetFullScreenRect(), Messages::WebFullScreenManagerProxy::GetFullScreenRect::Reply(rect));
+    return rect;
+}
+
+void WebFullScreenManager::willEnterFullScreen()
+{
+    ASSERT(m_element);
+    m_element->document()->webkitWillEnterFullScreenForElement(m_element.get());
+    m_element->document()->setFullScreenRendererBackgroundColor(Color::transparent);
+}
+
+void WebFullScreenManager::didEnterFullScreen()
+{
+    ASSERT(m_element);
+    m_element->document()->webkitDidEnterFullScreenForElement(m_element.get());
+    m_element->document()->setFullScreenRendererBackgroundColor(Color::black);
+}
+
+void WebFullScreenManager::willExitFullScreen()
+{
+    ASSERT(m_element);
+    m_element->document()->webkitWillExitFullScreenForElement(m_element.get());
+    m_element->document()->setFullScreenRendererBackgroundColor(Color::transparent);
+}
+
+void WebFullScreenManager::didExitFullScreen()
+{
+    ASSERT(m_element);
+    m_element->document()->webkitDidExitFullScreenForElement(m_element.get());
+    m_element->document()->setFullScreenRendererBackgroundColor(Color::black);
+}
+
+
+} // namespace WebKit
+
+#endif // ENABLE(FULLSCREEN_API)
diff --git a/Source/WebKit2/WebProcess/FullScreen/WebFullScreenManager.h b/Source/WebKit2/WebProcess/FullScreen/WebFullScreenManager.h
new file mode 100644
index 0000000..d4ec15d
--- /dev/null
+++ b/Source/WebKit2/WebProcess/FullScreen/WebFullScreenManager.h
@@ -0,0 +1,90 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+#ifndef WebFullScreenManager_h
+#define WebFullScreenManager_h
+
+#if ENABLE(FULLSCREEN_API)
+
+#include <WebCore/IntRect.h>
+#include <wtf/RefCounted.h>
+#include <wtf/RefPtr.h>
+
+namespace CoreIPC {
+class ArgumentDecoder;
+class Connection;
+class MessageID;
+}
+
+namespace WebCore {
+class IntRect;
+class Element;
+class GraphicsLayer;
+}
+
+namespace WebKit {
+
+class WebPage;
+
+class WebFullScreenManager : public RefCounted<WebFullScreenManager> {
+public:
+    static PassRefPtr<WebFullScreenManager> create(WebPage*);
+    virtual ~WebFullScreenManager();
+
+    void didReceiveMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::ArgumentDecoder*);
+
+    bool supportsFullScreen(bool withKeyboard);
+    void enterFullScreenForElement(WebCore::Element*);
+    void exitFullScreenForElement(WebCore::Element*);
+    void beganEnterFullScreenAnimation();
+    void finishedEnterFullScreenAnimation(bool completed);
+    void beganExitFullScreenAnimation();
+    void finishedExitFullScreenAnimation(bool completed);
+    virtual void setRootFullScreenLayer(WebCore::GraphicsLayer*) = 0;
+
+    WebCore::Element* element();
+
+protected:
+    WebFullScreenManager(WebPage*);
+
+    void willEnterFullScreen();
+    void didEnterFullScreen();
+    void willExitFullScreen();
+    void didExitFullScreen();
+    virtual void beginEnterFullScreenAnimation(float duration) = 0;
+    virtual void beginExitFullScreenAnimation(float duration) = 0;
+    WebCore::IntRect getFullScreenRect();
+
+    void didReceiveWebFullScreenManagerMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::ArgumentDecoder*);
+
+    WebCore::IntRect m_initialFrame;
+    RefPtr<WebPage> m_page;
+    RefPtr<WebCore::Element> m_element;
+};
+
+} // namespace WebKit
+
+#endif // ENABLE(FULLSCREEN_API)
+
+#endif // WebFullScreenManager_h
diff --git a/Source/WebKit2/WebProcess/FullScreen/WebFullScreenManager.messages.in b/Source/WebKit2/WebProcess/FullScreen/WebFullScreenManager.messages.in
new file mode 100644
index 0000000..d53f9d5
--- /dev/null
+++ b/Source/WebKit2/WebProcess/FullScreen/WebFullScreenManager.messages.in
@@ -0,0 +1,32 @@
+# Copyright (C) 2011 Apple Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+# 1.  Redistributions of source code must retain the above copyright
+#     notice, this list of conditions and the following disclaimer.
+# 2.  Redistributions in binary form must reproduce the above copyright
+#     notice, this list of conditions and the following disclaimer in the
+#     documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND
+# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+# WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+# DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR
+# ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+# SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+# OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+#if ENABLE(FULLSCREEN_API)
+messages -> WebFullScreenManager {
+    WillEnterFullScreen()
+    DidEnterFullScreen()
+    WillExitFullScreen()
+    DidExitFullScreen()
+    BeginEnterFullScreenAnimation(float duration)
+    BeginExitFullScreenAnimation(float duration)
+}
+#endif
diff --git a/Source/WebKit2/WebProcess/FullScreen/gtk/WebFullScreenManagerGtk.cpp b/Source/WebKit2/WebProcess/FullScreen/gtk/WebFullScreenManagerGtk.cpp
new file mode 100644
index 0000000..5c4e697
--- /dev/null
+++ b/Source/WebKit2/WebProcess/FullScreen/gtk/WebFullScreenManagerGtk.cpp
@@ -0,0 +1,56 @@
+/*
+ *  Copyright (C) 2011 Igalia S.L.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  along with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ */
+
+#include "config.h"
+#include "WebFullScreenManagerGtk.h"
+
+#if ENABLE(FULLSCREEN_API)
+
+#include <WebCore/NotImplemented.h>
+
+namespace WebKit {
+
+WebFullScreenManagerGtk::WebFullScreenManagerGtk(WebPage* page)
+    : WebFullScreenManager(page)
+{
+}
+
+PassRefPtr<WebFullScreenManager> WebFullScreenManager::create(WebPage* page)
+{
+    return adoptRef(new WebFullScreenManagerGtk(page));
+}
+
+void WebFullScreenManagerGtk::setRootFullScreenLayer(WebCore::GraphicsLayer* layer)
+{
+    notImplemented();
+}
+
+void WebFullScreenManagerGtk::beginEnterFullScreenAnimation(float duration)
+{
+    notImplemented();
+}
+
+void WebFullScreenManagerGtk::beginExitFullScreenAnimation(float duration)
+{
+    notImplemented();
+}
+
+} // namespace WebKit
+
+#endif // ENABLE(FULLSCREEN_API)
diff --git a/Source/WebKit2/WebProcess/FullScreen/gtk/WebFullScreenManagerGtk.h b/Source/WebKit2/WebProcess/FullScreen/gtk/WebFullScreenManagerGtk.h
new file mode 100644
index 0000000..51f5527
--- /dev/null
+++ b/Source/WebKit2/WebProcess/FullScreen/gtk/WebFullScreenManagerGtk.h
@@ -0,0 +1,50 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebFullScreenManagerGtk_h
+#define WebFullScreenManagerGtk_h
+
+#if ENABLE(FULLSCREEN_API)
+
+#include "WebFullScreenManager.h"
+
+namespace WebKit {
+
+class WebFullScreenManagerGtk : public WebFullScreenManager {
+public:
+    WebFullScreenManagerGtk(WebPage*);
+    virtual void setRootFullScreenLayer(WebCore::GraphicsLayer*);
+
+private:
+    virtual void beginEnterFullScreenAnimation(float duration);
+    virtual void beginExitFullScreenAnimation(float duration);
+
+};
+
+}
+
+#endif // ENABLE(FULLSCREEN_API)
+
+#endif // WebFullScreenManagerGtk_h
diff --git a/Source/WebKit2/WebProcess/FullScreen/mac/WebFullScreenManagerMac.h b/Source/WebKit2/WebProcess/FullScreen/mac/WebFullScreenManagerMac.h
new file mode 100644
index 0000000..e247eb5
--- /dev/null
+++ b/Source/WebKit2/WebProcess/FullScreen/mac/WebFullScreenManagerMac.h
@@ -0,0 +1,67 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebFullScreenManagerMac_h
+#define WebFullScreenManagerMac_h
+
+#if ENABLE(FULLSCREEN_API)
+
+#import "LayerTreeContext.h"
+#import "WebFullScreenManager.h"
+
+#import <WebCore/IntRect.h>
+#import <wtf/RetainPtr.h>
+
+typedef struct __WKCARemoteLayerClientRef* WKCARemoteLayerClientRef;
+OBJC_CLASS WebFullScreenManagerAnimationListener;
+
+namespace WebKit {
+
+class WebFullScreenManagerMac : public WebFullScreenManager {
+public:
+    static PassRefPtr<WebFullScreenManagerMac> create(WebPage*);
+
+    virtual void setRootFullScreenLayer(WebCore::GraphicsLayer*);
+
+private:
+    WebFullScreenManagerMac(WebPage*);
+    virtual ~WebFullScreenManagerMac();
+
+    virtual void beginEnterFullScreenAnimation(float duration);
+    virtual void beginExitFullScreenAnimation(float duration);
+
+    OwnPtr<WebCore::GraphicsLayer> m_rootLayer;
+    WebCore::GraphicsLayer* m_fullScreenRootLayer;
+    LayerTreeContext m_layerTreeContext;
+    RetainPtr<WKCARemoteLayerClientRef> m_remoteLayerClient;
+    RetainPtr<id> m_enterFullScreenListener;
+    RetainPtr<id> m_exitFullScreenListener;
+};
+
+}
+
+#endif // ENABLE(FULLSCREEN_API)
+
+#endif // WebFullScreenManagerMac_h
diff --git a/Source/WebKit2/WebProcess/FullScreen/mac/WebFullScreenManagerMac.mm b/Source/WebKit2/WebProcess/FullScreen/mac/WebFullScreenManagerMac.mm
new file mode 100644
index 0000000..66243c5
--- /dev/null
+++ b/Source/WebKit2/WebProcess/FullScreen/mac/WebFullScreenManagerMac.mm
@@ -0,0 +1,277 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+#import "config.h"
+#import "WebFullScreenManagerMac.h"
+
+#if ENABLE(FULLSCREEN_API)
+
+#import "Connection.h"
+#import "LayerTreeContext.h"
+#import "MessageID.h"
+#import "WebFullScreenManagerProxyMessages.h"
+#import "WebPage.h"
+#import "WebProcess.h"
+#import <QuartzCore/QuartzCore.h>
+#import <WebCore/Frame.h>
+#import <WebCore/FrameView.h>
+#import <WebCore/GraphicsLayer.h>
+#import <WebCore/Page.h>
+#import <WebCore/Settings.h>
+#import <WebKitSystemInterface.h>
+
+using namespace WebCore;
+
+typedef void (WebKit::WebFullScreenManager::*AnimationBeganFunction)();
+typedef void (WebKit::WebFullScreenManager::*AnimationFinishedFunction)(bool);
+
+#if defined(BUILDING_ON_LEOPARD)
+@interface CATransaction(SnowLeopardConvenienceFunctions)
++ (void)setDisableActions:(BOOL)flag;
+@end
+
+@implementation CATransaction(SnowLeopardConvenienceFunctions)
++ (void)setDisableActions:(BOOL)flag
+{
+    [self setValue:[NSNumber numberWithBool:flag] forKey:kCATransactionDisableActions];
+}
+@end
+#endif
+
+@interface WebFullScreenManagerAnimationListener : NSObject {
+    WebKit::WebFullScreenManager* _manager;
+    AnimationBeganFunction _began;
+    AnimationFinishedFunction _finished;
+}
+- (id)initWithManager:(WebKit::WebFullScreenManager*)manager began:(AnimationBeganFunction)began finished:(AnimationFinishedFunction)finished;
+- (void)animationDidStart:(CAAnimation *)anim;
+- (void)animationDidStop:(CAAnimation *)anim finished:(BOOL)flag;
+- (void)invalidate;
+@end
+
+@implementation WebFullScreenManagerAnimationListener
+- (id)initWithManager:(WebKit::WebFullScreenManager*)manager began:(AnimationBeganFunction)began finished:(AnimationFinishedFunction)finished
+{
+    self = [super init];
+    if (!self)
+        return nil;
+
+    _manager = manager;
+    _began = began;
+    _finished = finished;
+    return self;
+}
+
+- (void)animationDidStart:(CAAnimation *)anim
+{
+    if (_manager && _began)
+        (_manager->*_began)();
+}
+
+- (void)animationDidStop:(CAAnimation *)anim finished:(BOOL)flag
+{
+    if (_manager && _finished)
+        (_manager->*_finished)(flag);
+}
+
+- (void)invalidate
+{
+    _manager = 0;
+    _began = 0;
+    _finished = 0;
+}
+@end
+
+namespace WebKit {
+
+PassRefPtr<WebFullScreenManager> WebFullScreenManager::create(WebPage* page)
+{
+    return WebFullScreenManagerMac::create(page);
+}
+
+PassRefPtr<WebFullScreenManagerMac> WebFullScreenManagerMac::create(WebPage* page)
+{
+    return adoptRef(new WebFullScreenManagerMac(page));
+}
+
+WebFullScreenManagerMac::WebFullScreenManagerMac(WebPage* page)
+    : WebFullScreenManager(page)
+{
+    m_enterFullScreenListener.adoptNS([[WebFullScreenManagerAnimationListener alloc] initWithManager:this began:&WebFullScreenManagerMac::beganEnterFullScreenAnimation finished:&WebFullScreenManagerMac::finishedEnterFullScreenAnimation]);
+    m_exitFullScreenListener.adoptNS([[WebFullScreenManagerAnimationListener alloc] initWithManager:this began:&WebFullScreenManagerMac::beganExitFullScreenAnimation finished:&WebFullScreenManagerMac::finishedExitFullScreenAnimation]);
+}
+
+WebFullScreenManagerMac::~WebFullScreenManagerMac()
+{
+    m_page->send(Messages::WebFullScreenManagerProxy::ExitAcceleratedCompositingMode());
+    [m_enterFullScreenListener.get() invalidate];
+    [m_exitFullScreenListener.get() invalidate];
+}
+
+void WebFullScreenManagerMac::setRootFullScreenLayer(WebCore::GraphicsLayer* layer)
+{
+    if (m_fullScreenRootLayer == layer)
+        return;
+    m_fullScreenRootLayer = layer;
+
+    if (!m_fullScreenRootLayer) {
+        m_page->send(Messages::WebFullScreenManagerProxy::ExitAcceleratedCompositingMode());
+        if (m_rootLayer) {
+            m_rootLayer->removeAllChildren();
+            m_rootLayer = 0;
+        }
+        return;
+    }
+
+    if (!m_rootLayer) {
+        mach_port_t serverPort = WebProcess::shared().compositingRenderServerPort();
+        m_remoteLayerClient = WKCARemoteLayerClientMakeWithServerPort(serverPort);
+
+        m_rootLayer = GraphicsLayer::create(NULL);
+#ifndef NDEBUG
+        m_rootLayer->setName("Full screen root layer");
+#endif
+        m_rootLayer->setDrawsContent(false);
+        m_rootLayer->setSize(getFullScreenRect().size());
+
+        [m_rootLayer->platformLayer() setGeometryFlipped:YES];
+        WKCARemoteLayerClientSetLayer(m_remoteLayerClient.get(), m_rootLayer->platformLayer());
+        m_layerTreeContext.contextID = WKCARemoteLayerClientGetClientId(m_remoteLayerClient.get());
+        m_page->send(Messages::WebFullScreenManagerProxy::EnterAcceleratedCompositingMode(m_layerTreeContext));
+    }
+
+    m_rootLayer->removeAllChildren();
+
+    if (m_fullScreenRootLayer)
+        m_rootLayer->addChild(m_fullScreenRootLayer);
+
+    m_rootLayer->syncCompositingStateForThisLayerOnly();
+    m_page->corePage()->mainFrame()->view()->syncCompositingStateIncludingSubframes();
+}
+
+void WebFullScreenManagerMac::beginEnterFullScreenAnimation(float duration)
+{
+    ASSERT(m_element);
+    ASSERT(m_fullScreenRootLayer);
+
+    IntRect destinationFrame = getFullScreenRect();
+    m_element->document()->setFullScreenRendererSize(destinationFrame.size());
+    m_rootLayer->syncCompositingStateForThisLayerOnly();
+    m_page->corePage()->mainFrame()->view()->syncCompositingStateIncludingSubframes();
+
+    // FIXME: Once we gain the ability to do native WebKit animations of generated
+    // content, this can change to use them.  Meanwhile, we'll have to animate the
+    // CALayer directly:
+    CALayer* caLayer = m_fullScreenRootLayer->platformLayer();
+
+    // Create a transformation matrix that will transform the renderer layer such that
+    // the fullscreen element appears to move from its starting position and size to its
+    // final one.
+    CGPoint destinationPosition = [caLayer position];
+    CGPoint layerAnchor = [caLayer anchorPoint];
+    CGPoint initialPosition = CGPointMake(
+        m_initialFrame.x() + m_initialFrame.width() * layerAnchor.x,
+        m_initialFrame.y() + m_initialFrame.height() * layerAnchor.y);
+    CATransform3D shrinkTransform = CATransform3DMakeScale(
+        static_cast<CGFloat>(m_initialFrame.width()) / destinationFrame.width(),
+        static_cast<CGFloat>(m_initialFrame.height()) / destinationFrame.height(), 1);
+    CATransform3D shiftTransform = CATransform3DMakeTranslation(
+        initialPosition.x - destinationPosition.x,
+        // Drawing is flipped here, and so much be the translation transformation
+        destinationPosition.y - initialPosition.y, 0);
+    CATransform3D finalTransform = CATransform3DConcat(shrinkTransform, shiftTransform);
+
+    // Use a CABasicAnimation here for the zoom effect. We want to be notified that the animation has
+    // completed by way of the CAAnimation delegate.
+    CABasicAnimation* zoomAnimation = [CABasicAnimation animationWithKeyPath:@"transform"];
+    [zoomAnimation setFromValue:[NSValue valueWithCATransform3D:finalTransform]];
+    [zoomAnimation setToValue:[NSValue valueWithCATransform3D:CATransform3DIdentity]];
+    [zoomAnimation setDelegate:m_enterFullScreenListener.get()];
+    [zoomAnimation setDuration:duration];
+    [zoomAnimation setTimingFunction:[CAMediaTimingFunction functionWithName:kCAMediaTimingFunctionEaseInEaseOut]];
+    [zoomAnimation setFillMode:kCAFillModeForwards];
+
+    // Disable implicit animations and set the layer's transformation matrix to its final state.
+    [CATransaction begin];
+    [CATransaction setDisableActions:YES];
+    [caLayer addAnimation:zoomAnimation forKey:@"zoom"];
+    [CATransaction commit];
+}
+
+void WebFullScreenManagerMac::beginExitFullScreenAnimation(float duration)
+{
+    ASSERT(m_element);
+    ASSERT(m_fullScreenRootLayer);
+
+    IntRect destinationFrame = getFullScreenRect();
+    m_element->document()->setFullScreenRendererSize(destinationFrame.size());
+    m_rootLayer->syncCompositingStateForThisLayerOnly();
+    m_page->corePage()->mainFrame()->view()->syncCompositingStateIncludingSubframes();
+
+    // FIXME: Once we gain the ability to do native WebKit animations of generated
+    // content, this can change to use them.  Meanwhile, we'll have to animate the
+    // CALayer directly:
+    CALayer* caLayer = m_fullScreenRootLayer->platformLayer();
+
+    // Create a transformation matrix that will transform the renderer layer such that
+    // the fullscreen element appears to move from its starting position and size to its
+    // final one.
+    CGPoint destinationPosition = [(CALayer*)[caLayer presentationLayer] position];
+    CGRect destinationBounds = NSRectToCGRect([[caLayer presentationLayer] bounds]);
+    CGPoint layerAnchor = [caLayer anchorPoint];
+    CGPoint initialPosition = CGPointMake(
+        m_initialFrame.x() + m_initialFrame.width() * layerAnchor.x,
+        m_initialFrame.y() + m_initialFrame.height() * layerAnchor.y);
+    CATransform3D shrinkTransform = CATransform3DMakeScale(
+        static_cast<CGFloat>(m_initialFrame.width()) / destinationBounds.size.width,
+        static_cast<CGFloat>(m_initialFrame.height()) / destinationBounds.size.height, 1);
+    CATransform3D shiftTransform = CATransform3DMakeTranslation(
+        initialPosition.x - destinationPosition.x,
+        // Drawing is flipped here, and so must be the translation transformation
+        destinationPosition.y - initialPosition.y, 0);
+    CATransform3D finalTransform = CATransform3DConcat(shrinkTransform, shiftTransform);
+
+    CATransform3D initialTransform = [(CALayer*)[caLayer presentationLayer] transform];
+
+    // Use a CABasicAnimation here for the zoom effect. We want to be notified that the animation has
+    // completed by way of the CAAnimation delegate.
+    CABasicAnimation* zoomAnimation = [CABasicAnimation animationWithKeyPath:@"transform"];
+    [zoomAnimation setFromValue:[NSValue valueWithCATransform3D:initialTransform]];
+    [zoomAnimation setToValue:[NSValue valueWithCATransform3D:finalTransform]];
+    [zoomAnimation setDelegate:m_exitFullScreenListener.get()];
+    [zoomAnimation setDuration:duration];
+    [zoomAnimation setTimingFunction:[CAMediaTimingFunction functionWithName:kCAMediaTimingFunctionEaseInEaseOut]];
+    [zoomAnimation setFillMode:kCAFillModeForwards];
+
+    // Disable implicit animations and set the layer's transformation matrix to its final state.
+    [CATransaction begin];
+    [CATransaction setDisableActions:YES];
+    [caLayer addAnimation:zoomAnimation forKey:@"zoom"];
+    [caLayer setTransform:finalTransform];
+    [CATransaction commit];
+}
+
+} // namespace WebKit
+
+#endif // ENABLE(FULLSCREEN_API)
diff --git a/Source/WebKit2/WebProcess/IconDatabase/WebIconDatabaseProxy.cpp b/Source/WebKit2/WebProcess/IconDatabase/WebIconDatabaseProxy.cpp
new file mode 100644
index 0000000..0207791
--- /dev/null
+++ b/Source/WebKit2/WebProcess/IconDatabase/WebIconDatabaseProxy.cpp
@@ -0,0 +1,151 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WebIconDatabaseProxy.h"
+
+#include "DataReference.h"
+#include "MessageID.h"
+#include "WebIconDatabaseMessages.h"
+#include "WebProcess.h"
+#include <WebCore/SharedBuffer.h>
+#include <wtf/text/WTFString.h>
+
+using namespace WebCore;
+
+namespace WebKit {
+
+WebIconDatabaseProxy::~WebIconDatabaseProxy()
+{
+}
+
+WebIconDatabaseProxy::WebIconDatabaseProxy(WebProcess* process)
+    : m_isEnabled(false)
+    , m_process(process)
+{
+}
+
+bool WebIconDatabaseProxy::isEnabled() const
+{
+    return m_isEnabled;
+}
+
+void WebIconDatabaseProxy::setEnabled(bool enabled)
+{
+    if (enabled == m_isEnabled)
+        return;
+    
+    m_isEnabled = enabled;
+    setGlobalIconDatabase(enabled ? this : 0);
+}
+
+
+void WebIconDatabaseProxy::retainIconForPageURL(const String& pageURL)
+{
+    m_process->connection()->send(Messages::WebIconDatabase::RetainIconForPageURL(pageURL), 0);
+}
+
+void WebIconDatabaseProxy::releaseIconForPageURL(const String& pageURL)
+{
+    m_process->connection()->send(Messages::WebIconDatabase::ReleaseIconForPageURL(pageURL), 0);
+}
+
+Image* WebIconDatabaseProxy::synchronousIconForPageURL(const String& pageURL, const IntSize& size)
+{
+    CoreIPC::DataReference result;
+    if (!m_process->connection()->sendSync(Messages::WebIconDatabase::SynchronousIconDataForPageURL(pageURL), Messages::WebIconDatabase::SynchronousIconDataForPageURL::Reply(result), 0))
+        return 0;
+    
+    // FIXME: Return Image created with the above data.
+    return 0;
+}
+
+
+String WebIconDatabaseProxy::synchronousIconURLForPageURL(const String& pageURL)
+{
+    // FIXME: This needs to ask the UI process for the iconURL, but it can't do so synchronously because it will slow down page loading.
+    // The parts in WebCore that need this data will have to be changed to work asycnchronously.
+    return String();
+}
+
+bool WebIconDatabaseProxy::synchronousIconDataKnownForIconURL(const String& iconURL)
+{
+    // FIXME: This needs to ask the UI process for the iconURL, but it can't do so synchronously because it will slow down page loading.
+    // The parts in WebCore that need this data will have to be changed to work asycnchronously.
+    return false;
+}
+
+IconLoadDecision WebIconDatabaseProxy::synchronousLoadDecisionForIconURL(const String& iconURL, DocumentLoader* documentLoader)
+{
+    // FIXME: This needs to ask the UI process for the iconURL, but it can't do so synchronously because it will slow down page loading.
+    // The parts in WebCore that need this data will have to be changed to work asycnchronously.
+    return IconLoadNo;
+}
+
+bool WebIconDatabaseProxy::supportsAsynchronousMode()
+{
+    return true;
+}
+
+void WebIconDatabaseProxy::loadDecisionForIconURL(const String& iconURL, PassRefPtr<WebCore::IconLoadDecisionCallback> callback)
+{
+    uint64_t id = callback->callbackID();
+    m_iconLoadDecisionCallbacks.add(id, callback);
+    
+    m_process->connection()->send(Messages::WebIconDatabase::GetLoadDecisionForIconURL(iconURL, id), 0);
+}
+
+void WebIconDatabaseProxy::receivedIconLoadDecision(int decision, uint64_t callbackID)
+{
+    RefPtr<WebCore::IconLoadDecisionCallback> callback = m_iconLoadDecisionCallbacks.take(callbackID);
+    if (callback)
+        callback->performCallback(static_cast<WebCore::IconLoadDecision>(decision));
+}
+
+void WebIconDatabaseProxy::iconDataForIconURL(const String& iconURL, PassRefPtr<WebCore::IconDataCallback> callback)
+{
+}
+
+void WebIconDatabaseProxy::setIconURLForPageURL(const String& iconURL, const String& pageURL)
+{
+    m_process->connection()->send(Messages::WebIconDatabase::SetIconURLForPageURL(iconURL, pageURL), 0);
+}
+
+void WebIconDatabaseProxy::setIconDataForIconURL(PassRefPtr<SharedBuffer> iconData, const String& iconURL)
+{
+    CoreIPC::DataReference data(reinterpret_cast<const uint8_t*>(iconData ? iconData->data() : 0), iconData ? iconData->size() : 0);
+    m_process->connection()->send(Messages::WebIconDatabase::SetIconDataForIconURL(data, iconURL), 0);
+}
+
+void WebIconDatabaseProxy::urlImportFinished()
+{
+}
+
+void WebIconDatabaseProxy::didReceiveMessage(CoreIPC::Connection* connection, CoreIPC::MessageID messageID, CoreIPC::ArgumentDecoder* arguments)
+{
+    didReceiveWebIconDatabaseProxyMessage(connection, messageID, arguments);
+}
+
+} // namespace WebKit
diff --git a/Source/WebKit2/WebProcess/IconDatabase/WebIconDatabaseProxy.h b/Source/WebKit2/WebProcess/IconDatabase/WebIconDatabaseProxy.h
new file mode 100644
index 0000000..2096aba
--- /dev/null
+++ b/Source/WebKit2/WebProcess/IconDatabase/WebIconDatabaseProxy.h
@@ -0,0 +1,89 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebIconDatabaseProxy_h
+#define WebIconDatabaseProxy_h
+
+#include "APIObject.h"
+
+#include <WebCore/IconDatabaseBase.h>
+
+#include <wtf/HashMap.h>
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefPtr.h>
+#include <wtf/Vector.h>
+
+namespace CoreIPC {
+class ArgumentDecoder;
+class Connection;
+class MessageID;
+}
+
+namespace WebKit {
+
+class WebProcess;
+
+class WebIconDatabaseProxy : public WebCore::IconDatabaseBase {
+public:
+    explicit WebIconDatabaseProxy(WebProcess*);
+    virtual ~WebIconDatabaseProxy();
+
+    virtual bool isEnabled() const;
+    void setEnabled(bool);
+    
+    
+    virtual void retainIconForPageURL(const String&);
+    virtual void releaseIconForPageURL(const String&);
+    virtual void setIconURLForPageURL(const String&, const String&);
+    virtual void setIconDataForIconURL(PassRefPtr<WebCore::SharedBuffer>, const String&);
+
+    virtual String synchronousIconURLForPageURL(const String&);
+    virtual bool synchronousIconDataKnownForIconURL(const String&);
+    virtual WebCore::IconLoadDecision synchronousLoadDecisionForIconURL(const String&, WebCore::DocumentLoader*);
+    virtual WebCore::Image* synchronousIconForPageURL(const String&, const WebCore::IntSize&);
+    
+    // Asynchronous calls we should use to replace the above when supported.
+    virtual bool supportsAsynchronousMode();
+    virtual void loadDecisionForIconURL(const String&, PassRefPtr<WebCore::IconLoadDecisionCallback>);
+    void receivedIconLoadDecision(int decision, uint64_t callbackID);
+    virtual void iconDataForIconURL(const String&, PassRefPtr<WebCore::IconDataCallback>);
+        
+    void didReceiveMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::ArgumentDecoder*);
+    
+private:
+    void didReceiveWebIconDatabaseProxyMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::ArgumentDecoder*);
+    
+    // Callbacks from the UIProcess
+    void urlImportFinished();
+
+    bool m_isEnabled;
+    WebProcess* m_process;
+    
+    HashMap<uint64_t, RefPtr<WebCore::IconLoadDecisionCallback> > m_iconLoadDecisionCallbacks;
+};
+
+} // namespace WebKit
+
+#endif // WebIconDatabaseProxy_h
diff --git a/Source/WebKit2/WebProcess/IconDatabase/WebIconDatabaseProxy.messages.in b/Source/WebKit2/WebProcess/IconDatabase/WebIconDatabaseProxy.messages.in
new file mode 100644
index 0000000..049a0d9
--- /dev/null
+++ b/Source/WebKit2/WebProcess/IconDatabase/WebIconDatabaseProxy.messages.in
@@ -0,0 +1,26 @@
+# Copyright (C) 2011 Apple Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+# 1.  Redistributions of source code must retain the above copyright
+#     notice, this list of conditions and the following disclaimer.
+# 2.  Redistributions in binary form must reproduce the above copyright
+#     notice, this list of conditions and the following disclaimer in the
+#     documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND
+# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+# WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+# DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR
+# ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+# SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+# OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+messages -> WebIconDatabaseProxy {
+    URLImportFinished()
+    ReceivedIconLoadDecision(int loadDecision, uint64_t callbackID)
+}
diff --git a/Source/WebKit2/WebProcess/Info.plist b/Source/WebKit2/WebProcess/Info.plist
index 1fa2672..dabaf1f 100644
--- a/Source/WebKit2/WebProcess/Info.plist
+++ b/Source/WebKit2/WebProcess/Info.plist
@@ -2,10 +2,6 @@
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <dict>
-	<key>LSFileQuarantineEnabled</key>
-	<true/>
-	<key>CFBundleDevelopmentRegion</key>
-	<string>English</string>
 	<key>CFBundleExecutable</key>
 	<string>${PRODUCT_NAME}</string>
 	<key>CFBundleGetInfoString</key>
@@ -22,11 +18,13 @@
 	<string>${SHORT_VERSION_STRING}</string>
 	<key>CFBundleVersion</key>
 	<string>${BUNDLE_VERSION}</string>
+	<key>LSFileQuarantineEnabled</key>
+	<true/>
 	<key>LSMinimumSystemVersion</key>
 	<string>${MACOSX_DEPLOYMENT_TARGET}</string>
-	<key>NSPrincipalClass</key>
-	<string>NSApplication</string>
 	<key>LSUIElement</key>
 	<true/>
+	<key>NSPrincipalClass</key>
+	<string>NSApplication</string>
 </dict>
 </plist>
diff --git a/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundle.cpp b/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundle.cpp
index a58dbda..587968c 100644
--- a/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundle.cpp
+++ b/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundle.cpp
@@ -128,6 +128,11 @@ void WKBundleOverrideXSSAuditorEnabledForTestRunner(WKBundleRef bundleRef, WKBun
     toImpl(bundleRef)->overrideXSSAuditorEnabledForTestRunner(toImpl(pageGroupRef), enabled);
 }
 
+void WKBundleOverrideAllowUniversalAccessFromFileURLsForTestRunner(WKBundleRef bundleRef, WKBundlePageGroupRef pageGroupRef, bool enabled)
+{
+    toImpl(bundleRef)->overrideAllowUniversalAccessFromFileURLsForTestRunner(toImpl(pageGroupRef), enabled);
+}
+
 void WKBundleReportException(JSContextRef context, JSValueRef exception)
 {
     InjectedBundle::reportException(context, exception);
diff --git a/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundleNodeHandle.cpp b/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundleNodeHandle.cpp
index 0e91d8e..6bed7a4 100644
--- a/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundleNodeHandle.cpp
+++ b/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundleNodeHandle.cpp
@@ -76,6 +76,16 @@ void WKBundleNodeHandleSetHTMLInputElementAutofilled(WKBundleNodeHandleRef htmlI
     toImpl(htmlInputElementHandleRef)->setHTMLInputElementAutofilled(filled);
 }
 
+bool WKBundleNodeHandleGetHTMLInputElementLastChangeWasUserEdit(WKBundleNodeHandleRef htmlInputElementHandleRef)
+{
+    return toImpl(htmlInputElementHandleRef)->htmlInputElementLastChangeWasUserEdit();
+}
+
+bool WKBundleNodeHandleGetHTMLTextAreaElementLastChangeWasUserEdit(WKBundleNodeHandleRef htmlTextAreaElementHandleRef)
+{
+    return toImpl(htmlTextAreaElementHandleRef)->htmlTextAreaElementLastChangeWasUserEdit();
+}
+
 WKBundleNodeHandleRef WKBundleNodeHandleCopyHTMLTableCellElementCellAbove(WKBundleNodeHandleRef htmlTableCellElementHandleRef)
 {
     RefPtr<InjectedBundleNodeHandle> nodeHandle = toImpl(htmlTableCellElementHandleRef)->htmlTableCellElementCellAbove();
diff --git a/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundleNodeHandlePrivate.h b/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundleNodeHandlePrivate.h
index aaa95e6..6006596 100644
--- a/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundleNodeHandlePrivate.h
+++ b/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundleNodeHandlePrivate.h
@@ -50,7 +50,11 @@ WK_EXPORT WKRect WKBundleNodeHandleGetRenderRect(WKBundleNodeHandleRef nodeHandl
 WK_EXPORT void WKBundleNodeHandleSetHTMLInputElementValueForUser(WKBundleNodeHandleRef htmlInputElementHandle, WKStringRef value);
 WK_EXPORT bool WKBundleNodeHandleGetHTMLInputElementAutofilled(WKBundleNodeHandleRef htmlInputElementHandle);
 WK_EXPORT void WKBundleNodeHandleSetHTMLInputElementAutofilled(WKBundleNodeHandleRef htmlInputElementHandle, bool filled);
+WK_EXPORT bool WKBundleNodeHandleGetHTMLInputElementLastChangeWasUserEdit(WKBundleNodeHandleRef htmlInputElementHandle);
 
+/* HTMLTextAreaElement Specific Operations */
+WK_EXPORT bool WKBundleNodeHandleGetHTMLTextAreaElementLastChangeWasUserEdit(WKBundleNodeHandleRef htmlTextAreaElementHandle);
+    
 /* HTMLTableCellElement Specific Operations */
 WK_EXPORT WKBundleNodeHandleRef WKBundleNodeHandleCopyHTMLTableCellElementCellAbove(WKBundleNodeHandleRef htmlTableCellElementHandle);
 
diff --git a/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundlePage.h b/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundlePage.h
index 4be67d5..e01f51f 100644
--- a/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundlePage.h
+++ b/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundlePage.h
@@ -168,6 +168,7 @@ typedef void (*WKBundlePageWillRunJavaScriptPromptCallback)(WKBundlePageRef page
 typedef void (*WKBundlePageMouseDidMoveOverElementCallback)(WKBundlePageRef page, WKBundleHitTestResultRef hitTestResult, WKEventModifiers modifiers, WKTypeRef* userData, const void *clientInfo);
 typedef void (*WKBundlePageDidScrollCallback)(WKBundlePageRef page, const void *clientInfo);
 typedef void (*WKBundlePagePaintCustomOverhangAreaCallback)(WKBundlePageRef page, WKGraphicsContextRef graphicsContext, WKRect horizontalOverhang, WKRect verticalOverhang, WKRect dirtyRect, const void* clientInfo);
+typedef WKStringRef (*WKBundlePageGenerateFileForUploadCallback)(WKBundlePageRef page, WKStringRef originalFilePath, const void* clientInfo);
 
 struct WKBundlePageUIClient {
     int                                                                 version;
@@ -180,6 +181,8 @@ struct WKBundlePageUIClient {
     WKBundlePageMouseDidMoveOverElementCallback                         mouseDidMoveOverElement;
     WKBundlePageDidScrollCallback                                       pageDidScroll;
     WKBundlePagePaintCustomOverhangAreaCallback                         paintCustomOverhangArea;
+    WKBundlePageGenerateFileForUploadCallback                           shouldGenerateFileForUpload;
+    WKBundlePageGenerateFileForUploadCallback                           generateFileForUpload;
 };
 typedef struct WKBundlePageUIClient WKBundlePageUIClient;
 
diff --git a/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundlePrivate.h b/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundlePrivate.h
index bb0bd9f..79c796a 100644
--- a/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundlePrivate.h
+++ b/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundlePrivate.h
@@ -65,6 +65,7 @@ WK_EXPORT void WKBundleRemoveAllUserContent(WKBundleRef bundle, WKBundlePageGrou
 
 // Will make WebProcess ignore this preference until a preferences change notification, only for WebKitTestRunner use.
 WK_EXPORT void WKBundleOverrideXSSAuditorEnabledForTestRunner(WKBundleRef bundle, WKBundlePageGroupRef pageGroup, bool enabled);
+WK_EXPORT void WKBundleOverrideAllowUniversalAccessFromFileURLsForTestRunner(WKBundleRef bundle, WKBundlePageGroupRef pageGroup, bool enabled);
 
 #ifdef __cplusplus
 }
diff --git a/Source/WebKit2/WebProcess/InjectedBundle/API/c/win/WKBundlePrivateWin.cpp b/Source/WebKit2/WebProcess/InjectedBundle/API/c/win/WKBundlePrivateWin.cpp
new file mode 100644
index 0000000..d97784e
--- /dev/null
+++ b/Source/WebKit2/WebProcess/InjectedBundle/API/c/win/WKBundlePrivateWin.cpp
@@ -0,0 +1,43 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WKBundlePrivateWin.h"
+
+#include "InjectedBundle.h"
+#include "WKAPICast.h"
+#include "WKBundleAPICast.h"
+
+using namespace WebKit;
+
+void WKBundleSetHostAllowsAnyHTTPSCertificate(WKBundleRef bundleRef, WKStringRef host)
+{
+    toImpl(bundleRef)->setHostAllowsAnyHTTPSCertificate(toWTFString(host));
+}
+
+void WKBundleSetClientCertificate(WKBundleRef bundleRef, WKStringRef host, WKCertificateInfoRef certificateInfoRef)
+{
+    toImpl(bundleRef)->setClientCertificate(toWTFString(host), toImpl(certificateInfoRef));
+}
diff --git a/Source/WebKit2/WebProcess/InjectedBundle/API/c/win/WKBundlePrivateWin.h b/Source/WebKit2/WebProcess/InjectedBundle/API/c/win/WKBundlePrivateWin.h
new file mode 100644
index 0000000..e404ec8
--- /dev/null
+++ b/Source/WebKit2/WebProcess/InjectedBundle/API/c/win/WKBundlePrivateWin.h
@@ -0,0 +1,42 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WKBundlePrivateWin_h
+#define WKBundlePrivateWin_h
+
+#include <WebKit2/WKBase.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+WK_EXPORT void WKBundleSetHostAllowsAnyHTTPSCertificate(WKBundleRef bundle, WKStringRef host);
+WK_EXPORT void WKBundleSetClientCertificate(WKBundleRef bundle, WKStringRef host, WKCertificateInfoRef certificateInfo);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* WKBundlePrivateWin_h */
diff --git a/Source/WebKit2/WebProcess/InjectedBundle/DOM/InjectedBundleNodeHandle.cpp b/Source/WebKit2/WebProcess/InjectedBundle/DOM/InjectedBundleNodeHandle.cpp
index 858941e..5e15872 100644
--- a/Source/WebKit2/WebProcess/InjectedBundle/DOM/InjectedBundleNodeHandle.cpp
+++ b/Source/WebKit2/WebProcess/InjectedBundle/DOM/InjectedBundleNodeHandle.cpp
@@ -30,12 +30,13 @@
 #include "WebFrameLoaderClient.h"
 #include <JavaScriptCore/APICast.h>
 #include <WebCore/Document.h>
+#include <WebCore/Frame.h>
 #include <WebCore/HTMLFrameElement.h>
 #include <WebCore/HTMLIFrameElement.h>
-#include <WebCore/Frame.h>
 #include <WebCore/HTMLInputElement.h>
 #include <WebCore/HTMLNames.h>
 #include <WebCore/HTMLTableCellElement.h>
+#include <WebCore/HTMLTextAreaElement.h>
 #include <WebCore/IntRect.h>
 #include <WebCore/JSNode.h>
 #include <WebCore/Node.h>
@@ -132,7 +133,6 @@ bool InjectedBundleNodeHandle::isHTMLInputElementAutofilled() const
     return static_cast<HTMLInputElement*>(m_node.get())->isAutofilled();
 }
 
-
 void InjectedBundleNodeHandle::setHTMLInputElementAutofilled(bool filled)
 {
     if (!m_node->hasTagName(inputTag))
@@ -141,6 +141,22 @@ void InjectedBundleNodeHandle::setHTMLInputElementAutofilled(bool filled)
     static_cast<HTMLInputElement*>(m_node.get())->setAutofilled(filled);
 }
 
+bool InjectedBundleNodeHandle::htmlInputElementLastChangeWasUserEdit()
+{
+    if (!m_node->hasTagName(inputTag))
+        return false;
+
+    return static_cast<HTMLInputElement*>(m_node.get())->lastChangeWasUserEdit();
+}
+
+bool InjectedBundleNodeHandle::htmlTextAreaElementLastChangeWasUserEdit()
+{
+    if (!m_node->hasTagName(textareaTag))
+        return false;
+
+    return static_cast<HTMLTextAreaElement*>(m_node.get())->lastChangeWasUserEdit();
+}
+
 PassRefPtr<InjectedBundleNodeHandle> InjectedBundleNodeHandle::htmlTableCellElementCellAbove()
 {
     if (!m_node->hasTagName(tdTag))
diff --git a/Source/WebKit2/WebProcess/InjectedBundle/DOM/InjectedBundleNodeHandle.h b/Source/WebKit2/WebProcess/InjectedBundle/DOM/InjectedBundleNodeHandle.h
index 0dcebf6..e4a5ab9 100644
--- a/Source/WebKit2/WebProcess/InjectedBundle/DOM/InjectedBundleNodeHandle.h
+++ b/Source/WebKit2/WebProcess/InjectedBundle/DOM/InjectedBundleNodeHandle.h
@@ -63,6 +63,9 @@ public:
     void setHTMLInputElementValueForUser(const String&);
     bool isHTMLInputElementAutofilled() const;
     void setHTMLInputElementAutofilled(bool);
+    bool htmlInputElementLastChangeWasUserEdit();
+    bool htmlTextAreaElementLastChangeWasUserEdit();
+    
     PassRefPtr<InjectedBundleNodeHandle> htmlTableCellElementCellAbove();
 
     PassRefPtr<WebFrame> documentFrame();
diff --git a/Source/WebKit2/WebProcess/InjectedBundle/InjectedBundle.cpp b/Source/WebKit2/WebProcess/InjectedBundle/InjectedBundle.cpp
index b887374..24dc7f9 100644
--- a/Source/WebKit2/WebProcess/InjectedBundle/InjectedBundle.cpp
+++ b/Source/WebKit2/WebProcess/InjectedBundle/InjectedBundle.cpp
@@ -108,6 +108,16 @@ void InjectedBundle::overrideXSSAuditorEnabledForTestRunner(WebPageGroupProxy* p
         (*iter)->settings()->setXSSAuditorEnabled(enabled);
 }
 
+void InjectedBundle::overrideAllowUniversalAccessFromFileURLsForTestRunner(WebPageGroupProxy* pageGroup, bool enabled)
+{
+    // Override the preference for all future pages.
+    WebPreferencesStore::overrideAllowUniversalAccessFromFileURLsForTestRunner(enabled);
+
+    // Change the setting for existing ones.
+    const HashSet<Page*>& pages = PageGroup::pageGroup(pageGroup->identifier())->pages();
+    for (HashSet<Page*>::iterator iter = pages.begin(); iter != pages.end(); ++iter)
+        (*iter)->settings()->setAllowUniversalAccessFromFileURLs(enabled);
+}
 
 static PassOwnPtr<Vector<String> > toStringVector(ImmutableArray* patterns)
 {
diff --git a/Source/WebKit2/WebProcess/InjectedBundle/InjectedBundle.h b/Source/WebKit2/WebProcess/InjectedBundle/InjectedBundle.h
index cf844c9..6896669 100644
--- a/Source/WebKit2/WebProcess/InjectedBundle/InjectedBundle.h
+++ b/Source/WebKit2/WebProcess/InjectedBundle/InjectedBundle.h
@@ -59,6 +59,7 @@ typedef void* PlatformBundle;
 
 class ImmutableArray;
 class InjectedBundleScriptWorld;
+class WebCertificateInfo;
 class WebPage;
 class WebPageGroupProxy;
 
@@ -79,12 +80,17 @@ public:
     void initializeClient(WKBundleClient*);
     void postMessage(const String&, APIObject*);
     void postSynchronousMessage(const String&, APIObject*, RefPtr<APIObject>& returnData);
+#if PLATFORM(WIN)
+    void setHostAllowsAnyHTTPSCertificate(const String&);
+    void setClientCertificate(const String&, const WebCertificateInfo*);
+#endif
 
     // TestRunner only SPI
     void setShouldTrackVisitedLinks(bool);
     void removeAllVisitedLinks();
     void activateMacFontAscentHack();
     void overrideXSSAuditorEnabledForTestRunner(WebPageGroupProxy* pageGroup, bool enabled);
+    void overrideAllowUniversalAccessFromFileURLsForTestRunner(WebPageGroupProxy*, bool);
 
     // UserContent API
     void addUserScript(WebPageGroupProxy*, InjectedBundleScriptWorld*, const String& source, const String& url, ImmutableArray* whitelist, ImmutableArray* blacklist, WebCore::UserScriptInjectionTime, WebCore::UserContentInjectedFrames);
diff --git a/Source/WebKit2/WebProcess/InjectedBundle/InjectedBundlePageUIClient.cpp b/Source/WebKit2/WebProcess/InjectedBundle/InjectedBundlePageUIClient.cpp
index 7bb4f89..532d058 100644
--- a/Source/WebKit2/WebProcess/InjectedBundle/InjectedBundlePageUIClient.cpp
+++ b/Source/WebKit2/WebProcess/InjectedBundle/InjectedBundlePageUIClient.cpp
@@ -99,4 +99,20 @@ void InjectedBundlePageUIClient::paintCustomOverhangArea(WebPage* page, Graphics
     m_client.paintCustomOverhangArea(toAPI(page), toAPI(context.get()), toAPI(horizontalOverhangArea), toAPI(verticalOverhangArea), toAPI(dirtyRect), m_client.clientInfo);
 }
 
+String InjectedBundlePageUIClient::shouldGenerateFileForUpload(WebPage* page, const String& originalFilePath)
+{
+    if (!m_client.shouldGenerateFileForUpload)
+        return String();
+    RefPtr<WebString> generatedFilePath = adoptRef(toImpl(m_client.shouldGenerateFileForUpload(toAPI(page), toAPI(originalFilePath.impl()), m_client.clientInfo)));
+    return generatedFilePath ? generatedFilePath->string() : String();
+}
+
+String InjectedBundlePageUIClient::generateFileForUpload(WebPage* page, const String& originalFilePath)
+{
+    if (!m_client.shouldGenerateFileForUpload)
+        return String();
+    RefPtr<WebString> generatedFilePath = adoptRef(toImpl(m_client.generateFileForUpload(toAPI(page), toAPI(originalFilePath.impl()), m_client.clientInfo)));
+    return generatedFilePath ? generatedFilePath->string() : String();
+}
+
 } // namespace WebKit
diff --git a/Source/WebKit2/WebProcess/InjectedBundle/InjectedBundlePageUIClient.h b/Source/WebKit2/WebProcess/InjectedBundle/InjectedBundlePageUIClient.h
index 94925b7..47a5ca8 100644
--- a/Source/WebKit2/WebProcess/InjectedBundle/InjectedBundlePageUIClient.h
+++ b/Source/WebKit2/WebProcess/InjectedBundle/InjectedBundlePageUIClient.h
@@ -55,6 +55,9 @@ public:
 
     bool shouldPaintCustomOverhangArea();
     void paintCustomOverhangArea(WebPage*, WebCore::GraphicsContext*, const WebCore::IntRect&, const WebCore::IntRect&, const WebCore::IntRect&);
+
+    String shouldGenerateFileForUpload(WebPage*, const String& originalFilePath);
+    String generateFileForUpload(WebPage*, const String& originalFilePath);
 };
 
 } // namespace WebKit
diff --git a/Source/WebKit2/WebProcess/InjectedBundle/win/InjectedBundleWin.cpp b/Source/WebKit2/WebProcess/InjectedBundle/win/InjectedBundleWin.cpp
index 1e593fc..4b415a4 100644
--- a/Source/WebKit2/WebProcess/InjectedBundle/win/InjectedBundleWin.cpp
+++ b/Source/WebKit2/WebProcess/InjectedBundle/win/InjectedBundleWin.cpp
@@ -28,6 +28,8 @@
 
 #include "WKBundleAPICast.h"
 #include "WKBundleInitialize.h"
+#include "WebCertificateInfo.h"
+#include <WebCore/ResourceHandle.h>
 #include <WebCore/SimpleFontData.h>
 
 #include <windows.h>
@@ -35,6 +37,10 @@
 #include <shlobj.h>
 #include <shlwapi.h>
 
+#if USE(CFNETWORK)
+#include <WebCore/CertificateCFWin.h>
+#endif
+
 using namespace WebCore;
 
 namespace WebKit {
@@ -86,4 +92,27 @@ void InjectedBundle::activateMacFontAscentHack()
     SimpleFontData::setShouldApplyMacAscentHack(true);
 }
 
+void InjectedBundle::setHostAllowsAnyHTTPSCertificate(const String& host)
+{
+#if USE(CFNETWORK)
+    ResourceHandle::setHostAllowsAnyHTTPSCertificate(host);
+#endif
+}
+
+void InjectedBundle::setClientCertificate(const String& host, const WebCertificateInfo* certificateInfo)
+{
+#if USE(CFNETWORK)
+    ASSERT(certificateInfo);
+    if (!certificateInfo)
+        return;
+    
+    const Vector<PCCERT_CONTEXT> certificateChain = certificateInfo->platformCertificateInfo().certificateChain();
+    ASSERT(certificateChain.size() == 1);
+    if (certificateChain.size() != 1)
+        return;
+    
+    ResourceHandle::setClientCertificate(host, WebCore::copyCertificateToData(certificateChain.first()).get());
+#endif
+}
+
 } // namespace WebKit
diff --git a/Source/WebKit2/WebProcess/KeyValueStorage/WebKeyValueStorageManager.cpp b/Source/WebKit2/WebProcess/KeyValueStorage/WebKeyValueStorageManager.cpp
index 5ee1419..45431c3 100644
--- a/Source/WebKit2/WebProcess/KeyValueStorage/WebKeyValueStorageManager.cpp
+++ b/Source/WebKit2/WebProcess/KeyValueStorage/WebKeyValueStorageManager.cpp
@@ -34,6 +34,7 @@
 #include <WebCore/NotImplemented.h>
 #include <WebCore/SecurityOrigin.h>
 #include <WebCore/SecurityOriginHash.h>
+#include <WebCore/StorageTracker.h>
 
 using namespace WebCore;
 
@@ -56,39 +57,42 @@ void WebKeyValueStorageManager::didReceiveMessage(CoreIPC::Connection* connectio
 
 void WebKeyValueStorageManager::getKeyValueStorageOrigins(uint64_t callbackID)
 {
-    HashSet<RefPtr<SecurityOrigin>, SecurityOriginHash> origins;
+    Vector<RefPtr<SecurityOrigin> > coreOrigins;
 
-    // FIXME: <rdar://problem/8762095> and https://bugs.webkit.org/show_bug.cgi?id=55172 - Actually get the origins from WebCore once https://bugs.webkit.org/show_bug.cgi?id=51878 is resolved.
+    StorageTracker::tracker().origins(coreOrigins);
 
+    size_t size = coreOrigins.size();
     Vector<SecurityOriginData> identifiers;
-    identifiers.reserveCapacity(origins.size());
+    identifiers.reserveCapacity(size);
 
-    HashSet<RefPtr<SecurityOrigin>, SecurityOriginHash>::iterator end = origins.end();
-    HashSet<RefPtr<SecurityOrigin>, SecurityOriginHash>::iterator i = origins.begin();
-    for (; i != end; ++i) {
-        RefPtr<SecurityOrigin> origin = *i;
-        
+    for (size_t i = 0; i < size; ++i) {        
         SecurityOriginData originData;
-        originData.protocol = origin->protocol();
-        originData.host = origin->host();
-        originData.port = origin->port();
+        
+        originData.protocol = coreOrigins[i]->protocol();
+        originData.host = coreOrigins[i]->host();
+        originData.port = coreOrigins[i]->port();
 
         identifiers.uncheckedAppend(originData);
     }
 
     WebProcess::shared().connection()->send(Messages::WebKeyValueStorageManagerProxy::DidGetKeyValueStorageOrigins(identifiers, callbackID), 0);
+    WebProcess::shared().terminateIfPossible();
 }
 
 void WebKeyValueStorageManager::deleteEntriesForOrigin(const SecurityOriginData& originData)
 {
-    // FIXME: <rdar://problem/8762095> and https://bugs.webkit.org/show_bug.cgi?id=55172 - Implement once https://bugs.webkit.org/show_bug.cgi?id=51878 is resolved.
-    notImplemented();
+    RefPtr<SecurityOrigin> origin = SecurityOrigin::create(originData.protocol, originData.host, originData.port);
+    if (!origin)
+        return;
+
+    StorageTracker::tracker().deleteOrigin(origin.get());
+    WebProcess::shared().terminateIfPossible();
 }
 
 void WebKeyValueStorageManager::deleteAllEntries()
 {
-    // FIXME: <rdar://problem/8762095> and https://bugs.webkit.org/show_bug.cgi?id=55172 - Implement once https://bugs.webkit.org/show_bug.cgi?id=51878 is resolved.
-    notImplemented();
+    StorageTracker::tracker().deleteAllOrigins();
+    WebProcess::shared().terminateIfPossible();
 }
 
 } // namespace WebKit
diff --git a/Source/WebKit2/WebProcess/MediaCache/WebMediaCacheManager.cpp b/Source/WebKit2/WebProcess/MediaCache/WebMediaCacheManager.cpp
new file mode 100644
index 0000000..6baf6d9
--- /dev/null
+++ b/Source/WebKit2/WebProcess/MediaCache/WebMediaCacheManager.cpp
@@ -0,0 +1,82 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WebMediaCacheManager.h"
+
+#include "MessageID.h"
+#include "SecurityOriginData.h"
+#include "WebMediaCacheManagerProxyMessages.h"
+#include "WebProcess.h"
+#include <WebCore/HTMLMediaElement.h>
+
+using namespace WebCore;
+
+namespace WebKit {
+
+WebMediaCacheManager& WebMediaCacheManager::shared()
+{
+    static WebMediaCacheManager& shared = *new WebMediaCacheManager;
+    return shared;
+}
+
+WebMediaCacheManager::WebMediaCacheManager()
+{
+}
+
+void WebMediaCacheManager::didReceiveMessage(CoreIPC::Connection* connection, CoreIPC::MessageID messageID, CoreIPC::ArgumentDecoder* arguments)
+{
+    didReceiveWebMediaCacheManagerMessage(connection, messageID, arguments);
+}
+
+void WebMediaCacheManager::getHostnamesWithMediaCache(uint64_t callbackID)
+{
+    Vector<String> mediaCacheHostnames;
+
+#if ENABLE(VIDEO)
+    HTMLMediaElement::getSitesInMediaCache(mediaCacheHostnames);
+#endif
+
+    WebProcess::shared().connection()->send(Messages::WebMediaCacheManagerProxy::DidGetHostnamesWithMediaCache(mediaCacheHostnames, callbackID), 0);
+    WebProcess::shared().terminateIfPossible();
+}
+
+void WebMediaCacheManager::clearCacheForHostname(const String& hostname)
+{
+#if ENABLE(VIDEO)
+    HTMLMediaElement::clearMediaCacheForSite(hostname);
+#endif
+    WebProcess::shared().terminateIfPossible();
+}
+
+void WebMediaCacheManager::clearCacheForAllHostnames()
+{
+#if ENABLE(VIDEO)
+    HTMLMediaElement::clearMediaCache();
+#endif
+    WebProcess::shared().terminateIfPossible();
+}
+
+} // namespace WebKit
diff --git a/Source/WebKit2/WebProcess/MediaCache/WebMediaCacheManager.h b/Source/WebKit2/WebProcess/MediaCache/WebMediaCacheManager.h
new file mode 100644
index 0000000..909be97
--- /dev/null
+++ b/Source/WebKit2/WebProcess/MediaCache/WebMediaCacheManager.h
@@ -0,0 +1,60 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebMediaCacheManager_h
+#define WebMediaCacheManager_h
+
+#include <wtf/Noncopyable.h>
+#include <wtf/text/WTFString.h>
+
+namespace CoreIPC {
+    class ArgumentDecoder;
+    class Connection;
+    class MessageID;
+}
+
+namespace WebKit {
+
+class WebMediaCacheManager {
+    WTF_MAKE_NONCOPYABLE(WebMediaCacheManager);
+
+public:
+    static WebMediaCacheManager& shared();
+
+    void didReceiveMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::ArgumentDecoder*);
+
+private:
+    WebMediaCacheManager();
+    
+    void getHostnamesWithMediaCache(uint64_t callbackID);
+    void clearCacheForHostname(const String&);
+    void clearCacheForAllHostnames();
+
+    void didReceiveWebMediaCacheManagerMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::ArgumentDecoder*);
+};
+
+} // namespace WebKit
+
+#endif // WebMediaCacheManager_h
diff --git a/Source/WebKit2/WebProcess/MediaCache/WebMediaCacheManager.messages.in b/Source/WebKit2/WebProcess/MediaCache/WebMediaCacheManager.messages.in
new file mode 100644
index 0000000..5eee8cc
--- /dev/null
+++ b/Source/WebKit2/WebProcess/MediaCache/WebMediaCacheManager.messages.in
@@ -0,0 +1,27 @@
+# Copyright (C) 2011 Apple Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+# 1.  Redistributions of source code must retain the above copyright
+#     notice, this list of conditions and the following disclaimer.
+# 2.  Redistributions in binary form must reproduce the above copyright
+#     notice, this list of conditions and the following disclaimer in the
+#     documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND
+# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+# WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+# DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR
+# ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+# SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+# OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+messages -> WebMediaCacheManager {
+    void GetHostnamesWithMediaCache(uint64_t callbackID)
+    void ClearCacheForHostname(WTF::String hostname)
+    void ClearCacheForAllHostnames()
+}
diff --git a/Source/WebKit2/WebProcess/Plugins/Netscape/JSNPMethod.cpp b/Source/WebKit2/WebProcess/Plugins/Netscape/JSNPMethod.cpp
index fc73519..8b36d1d 100644
--- a/Source/WebKit2/WebProcess/Plugins/Netscape/JSNPMethod.cpp
+++ b/Source/WebKit2/WebProcess/Plugins/Netscape/JSNPMethod.cpp
@@ -42,7 +42,7 @@ namespace WebKit {
 const ClassInfo JSNPMethod::s_info = { "NPMethod", &InternalFunction::s_info, 0, 0 };
 
 JSNPMethod::JSNPMethod(ExecState* exec, JSGlobalObject* globalObject, const Identifier& name, NPIdentifier npIdentifier)
-    : InternalFunction(&exec->globalData(), globalObject, createStructure(globalObject->functionPrototype()), name)
+    : InternalFunction(&exec->globalData(), globalObject, createStructure(exec->globalData(), globalObject->functionPrototype()), name)
     , m_npIdentifier(npIdentifier)
 {
     ASSERT(inherits(&s_info));
diff --git a/Source/WebKit2/WebProcess/Plugins/Netscape/JSNPMethod.h b/Source/WebKit2/WebProcess/Plugins/Netscape/JSNPMethod.h
index a913a99..f0c2424 100644
--- a/Source/WebKit2/WebProcess/Plugins/Netscape/JSNPMethod.h
+++ b/Source/WebKit2/WebProcess/Plugins/Netscape/JSNPMethod.h
@@ -42,9 +42,9 @@ public:
     NPIdentifier npIdentifier() const { return m_npIdentifier; }
 
 private:    
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSGlobalData& globalData, JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
+        return JSC::Structure::create(globalData, prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
     }
 
     virtual JSC::CallType getCallData(JSC::CallData&);
diff --git a/Source/WebKit2/WebProcess/Plugins/Netscape/JSNPObject.cpp b/Source/WebKit2/WebProcess/Plugins/Netscape/JSNPObject.cpp
index 2724f0d..93f9fc5 100644
--- a/Source/WebKit2/WebProcess/Plugins/Netscape/JSNPObject.cpp
+++ b/Source/WebKit2/WebProcess/Plugins/Netscape/JSNPObject.cpp
@@ -50,7 +50,7 @@ static NPIdentifier npIdentifierFromIdentifier(const Identifier& identifier)
 const ClassInfo JSNPObject::s_info = { "NPObject", &JSObjectWithGlobalObject::s_info, 0, 0 };
 
 JSNPObject::JSNPObject(JSGlobalObject* globalObject, NPRuntimeObjectMap* objectMap, NPObject* npObject)
-    : JSObjectWithGlobalObject(globalObject, createStructure(globalObject->objectPrototype()))
+    : JSObjectWithGlobalObject(globalObject, createStructure(globalObject->globalData(), globalObject->objectPrototype()))
     , m_objectMap(objectMap)
     , m_npObject(npObject)
 {
diff --git a/Source/WebKit2/WebProcess/Plugins/Netscape/JSNPObject.h b/Source/WebKit2/WebProcess/Plugins/Netscape/JSNPObject.h
index adaffa7..e8a08da 100644
--- a/Source/WebKit2/WebProcess/Plugins/Netscape/JSNPObject.h
+++ b/Source/WebKit2/WebProcess/Plugins/Netscape/JSNPObject.h
@@ -55,9 +55,9 @@ public:
 private:
     static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | JSC::OverridesGetPropertyNames | JSObject::StructureFlags;
     
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSGlobalData& globalData, JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
+        return JSC::Structure::create(globalData, prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
     }
 
     virtual JSC::CallType getCallData(JSC::CallData&);
diff --git a/Source/WebKit2/WebProcess/Plugins/Netscape/NetscapeBrowserFuncs.cpp b/Source/WebKit2/WebProcess/Plugins/Netscape/NetscapeBrowserFuncs.cpp
index 679de6f..a548fd6 100644
--- a/Source/WebKit2/WebProcess/Plugins/Netscape/NetscapeBrowserFuncs.cpp
+++ b/Source/WebKit2/WebProcess/Plugins/Netscape/NetscapeBrowserFuncs.cpp
@@ -35,6 +35,12 @@
 #include <WebCore/SharedBuffer.h>
 #include <utility>
 
+#if PLATFORM(QT)
+#include <QX11Info>
+#elif PLATFORM(GTK)
+#include <gdk/gdkx.h>
+#endif
+
 using namespace WebCore;
 using namespace std;
 
@@ -484,17 +490,33 @@ static NPError NPN_GetValue(NPP npp, NPNVariable variable, void *value)
            *(NPBool*)value = true;
            break;
 #elif PLUGIN_ARCHITECTURE(X11)
+       case NPNVxDisplay:
+#if PLATFORM(QT)
+           *reinterpret_cast<Display**>(value) = QX11Info::display();
+           break;
+#elif PLATFORM(GTK)
+           *reinterpret_cast<Display**>(value) = GDK_DISPLAY_XDISPLAY(gdk_display_get_default());
+           break;
+#else
+           goto default;
+#endif
+       case NPNVSupportsXEmbedBool:
+           *static_cast<NPBool*>(value) = true;
+           break;
+       case NPNVSupportsWindowless:
+           *static_cast<NPBool*>(value) = true;
+           break;
+
        case NPNVToolkit: {
            const uint32_t expectedGTKToolKitVersion = 2;
 
            RefPtr<NetscapePlugin> plugin = NetscapePlugin::fromNPP(npp);
-           if (plugin->quirks().contains(PluginQuirks::RequiresGTKToolKit)) {
-               *reinterpret_cast<uint32_t*>(value) = expectedGTKToolKitVersion;
-               break;
-           }
-
-           return NPERR_GENERIC_ERROR;
+           *reinterpret_cast<uint32_t*>(value) = plugin->quirks().contains(PluginQuirks::RequiresGTKToolKit) ?
+                                                 expectedGTKToolKitVersion : 0;
+           break;
        }
+
+       // TODO: implement NPNVnetscapeWindow once we want to support windowed plugins.
 #endif
         default:
             notImplemented();
@@ -529,7 +551,12 @@ static NPError NPN_SetValue(NPP npp, NPPVariable variable, void *value)
             return NPERR_NO_ERROR;
         }
 
-        case NPPVpluginTransparentBool:
+        case NPPVpluginTransparentBool: {
+            RefPtr<NetscapePlugin> plugin = NetscapePlugin::fromNPP(npp);
+            plugin->setIsTransparent(value);
+            return NPERR_NO_ERROR;
+        }
+
         default:
             notImplemented();
             return NPERR_GENERIC_ERROR;
diff --git a/Source/WebKit2/WebProcess/Plugins/Netscape/NetscapePlugin.cpp b/Source/WebKit2/WebProcess/Plugins/Netscape/NetscapePlugin.cpp
index 7e9b059..7d00219 100644
--- a/Source/WebKit2/WebProcess/Plugins/Netscape/NetscapePlugin.cpp
+++ b/Source/WebKit2/WebProcess/Plugins/Netscape/NetscapePlugin.cpp
@@ -64,6 +64,7 @@ NetscapePlugin::NetscapePlugin(PassRefPtr<NetscapePluginModule> pluginModule)
 #else
     , m_isWindowed(true)
 #endif
+    , m_isTransparent(false)
     , m_inNPPNew(false)
     , m_loadManually(false)
 #if PLATFORM(MAC)
@@ -75,20 +76,23 @@ NetscapePlugin::NetscapePlugin(PassRefPtr<NetscapePluginModule> pluginModule)
 #ifndef NP_NO_CARBON
     , m_nullEventTimer(RunLoop::main(), this, &NetscapePlugin::nullEventTimerFired)
     , m_npCGContext()
-#endif    
+#endif
+#elif PLUGIN_ARCHITECTURE(X11)
+    , m_drawable(0)
+    , m_pluginDisplay(0)
 #endif
 {
     m_npp.ndata = this;
     m_npp.pdata = 0;
     
-    m_pluginModule->pluginCreated();
+    m_pluginModule->incrementLoadCount();
 }
 
 NetscapePlugin::~NetscapePlugin()
 {
     ASSERT(!m_isStarted);
 
-    m_pluginModule->pluginDestroyed();
+    m_pluginModule->decrementLoadCount();
 }
 
 PassRefPtr<NetscapePlugin> NetscapePlugin::fromNPP(NPP npp)
@@ -189,6 +193,11 @@ void NetscapePlugin::setIsWindowed(bool isWindowed)
     m_isWindowed = isWindowed;
 }
 
+void NetscapePlugin::setIsTransparent(bool isTransparent)
+{
+    m_isTransparent = isTransparent;
+}
+
 void NetscapePlugin::setStatusbarText(const String& statusbarText)
 {
     m_pluginController->setStatusbarText(statusbarText);
@@ -347,8 +356,14 @@ NPError NetscapePlugin::NPP_SetValue(NPNVariable variable, void *value)
 
 void NetscapePlugin::callSetWindow()
 {
+#if PLUGIN_ARCHITECTURE(X11)
+    // We use a backing store as the painting area for the plugin.
+    m_npWindow.x = 0;
+    m_npWindow.y = 0;
+#else
     m_npWindow.x = m_frameRect.x();
     m_npWindow.y = m_frameRect.y();
+#endif
     m_npWindow.width = m_frameRect.width();
     m_npWindow.height = m_frameRect.height();
     m_npWindow.clipRect.top = m_clipRect.y();
@@ -427,6 +442,17 @@ bool NetscapePlugin::initialize(PluginController* pluginController, const Parame
         values.append(paramValues[i].data());
     }
 
+#if PLATFORM(MAC)
+    if (m_pluginModule->pluginQuirks().contains(PluginQuirks::MakeTransparentIfBackgroundAttributeExists)) {
+        for (size_t i = 0; i < parameters.names.size(); ++i) {
+            if (equalIgnoringCase(parameters.names[i], "background")) {
+                setIsTransparent(true);
+                break;
+            }
+        }
+    }
+#endif
+
     NetscapePlugin* previousNPPNewPlugin = currentNPPNewPlugin;
     
     m_inNPPNew = true;
@@ -487,7 +513,7 @@ PassRefPtr<ShareableBitmap> NetscapePlugin::snapshot()
 
     ASSERT(m_isStarted);
     
-    RefPtr<ShareableBitmap> bitmap = ShareableBitmap::createShareable(m_frameRect.size());
+    RefPtr<ShareableBitmap> bitmap = ShareableBitmap::createShareable(m_frameRect.size(), ShareableBitmap::SupportsAlpha);
     OwnPtr<GraphicsContext> context = bitmap->createGraphicsContext();
 
     context->translate(-m_frameRect.x(), -m_frameRect.y());
@@ -497,6 +523,11 @@ PassRefPtr<ShareableBitmap> NetscapePlugin::snapshot()
     return bitmap.release();
 }
 
+bool NetscapePlugin::isTransparent()
+{
+    return m_isTransparent;
+}
+
 void NetscapePlugin::geometryDidChange(const IntRect& frameRect, const IntRect& clipRect)
 {
     ASSERT(m_isStarted);
diff --git a/Source/WebKit2/WebProcess/Plugins/Netscape/NetscapePlugin.h b/Source/WebKit2/WebProcess/Plugins/Netscape/NetscapePlugin.h
index e865d93..7cf9ead 100644
--- a/Source/WebKit2/WebProcess/Plugins/Netscape/NetscapePlugin.h
+++ b/Source/WebKit2/WebProcess/Plugins/Netscape/NetscapePlugin.h
@@ -78,6 +78,7 @@ public:
                  const Vector<uint8_t>& httpBody, bool sendNotification, void* notificationData);
     NPError destroyStream(NPStream*, NPReason);
     void setIsWindowed(bool);
+    void setIsTransparent(bool);
     void setStatusbarText(const String&);
     static void setException(const String&);
     bool evaluate(NPObject*, const String&scriptString, NPVariant* result);
@@ -145,6 +146,7 @@ private:
 #if PLATFORM(MAC)
     virtual PlatformLayer* pluginLayer();
 #endif
+    virtual bool isTransparent();
     virtual void geometryDidChange(const WebCore::IntRect& frameRect, const WebCore::IntRect& clipRect);
     virtual void frameDidFinishLoading(uint64_t requestID);
     virtual void frameDidFail(uint64_t requestID, bool wasCancelled);
@@ -203,12 +205,13 @@ private:
 
     bool m_isStarted;
     bool m_isWindowed;
+    bool m_isTransparent;
     bool m_inNPPNew;
     bool m_loadManually;
     RefPtr<NetscapePluginStream> m_manualStream;
     Vector<bool, 8> m_popupEnabledStates;
 
-#if PLATFORM(MAC)
+#if PLUGIN_ARCHITECTURE(MAC)
     NPDrawingModel m_drawingModel;
     NPEventModel m_eventModel;
     RetainPtr<PlatformLayer> m_pluginLayer;
@@ -229,8 +232,11 @@ private:
     RunLoop::Timer<NetscapePlugin> m_nullEventTimer;
     NP_CGContext m_npCGContext;
 #endif
-#elif PLATFORM(WIN)
+#elif PLUGIN_ARCHITECTURE(WIN)
     HWND m_window;
+#elif PLUGIN_ARCHITECTURE(X11)
+    Pixmap m_drawable;
+    Display* m_pluginDisplay;
 #endif
 };
 
diff --git a/Source/WebKit2/WebProcess/Plugins/Netscape/NetscapePluginStream.cpp b/Source/WebKit2/WebProcess/Plugins/Netscape/NetscapePluginStream.cpp
index 9450317..cf5affc 100644
--- a/Source/WebKit2/WebProcess/Plugins/Netscape/NetscapePluginStream.cpp
+++ b/Source/WebKit2/WebProcess/Plugins/Netscape/NetscapePluginStream.cpp
@@ -304,7 +304,7 @@ void NetscapePluginStream::stop(NPReason reason)
             
             ASSERT(!m_filePath.isNull());
             
-            m_plugin->NPP_StreamAsFile(&m_npStream, m_filePath.data());
+            m_plugin->NPP_StreamAsFile(&m_npStream, m_filePath.utf8().data());
         } else {
             // Just close the file.
             if (m_fileHandle != invalidPlatformFileHandle)
@@ -315,8 +315,8 @@ void NetscapePluginStream::stop(NPReason reason)
         // to delete the file here -- NPP_StreamAsFile() is always called immediately before NPP_DestroyStream()
         // (the stream destruction function), so there can be no expectation that a plugin will read the stream
         // file asynchronously after NPP_StreamAsFile() is called.
-        deleteFile(String::fromUTF8(m_filePath.data()));
-        m_filePath = CString();
+        deleteFile(m_filePath);
+        m_filePath = String();
 
         // NPP_StreamAsFile could call NPN_DestroyStream and destroy the stream.
         if (!m_isStarted)
diff --git a/Source/WebKit2/WebProcess/Plugins/Netscape/NetscapePluginStream.h b/Source/WebKit2/WebProcess/Plugins/Netscape/NetscapePluginStream.h
index 7757001..f22ab61 100644
--- a/Source/WebKit2/WebProcess/Plugins/Netscape/NetscapePluginStream.h
+++ b/Source/WebKit2/WebProcess/Plugins/Netscape/NetscapePluginStream.h
@@ -88,7 +88,7 @@ private:
     uint16_t m_transferMode;
     int32_t m_offset;
 
-    CString m_filePath;
+    String m_filePath;
     WebCore::PlatformFileHandle m_fileHandle;
     
     // Whether NPP_NewStream has successfully been called.
diff --git a/Source/WebKit2/WebProcess/Plugins/Netscape/mac/NetscapePluginMac.mm b/Source/WebKit2/WebProcess/Plugins/Netscape/mac/NetscapePluginMac.mm
index 2a33008..14ac070 100644
--- a/Source/WebKit2/WebProcess/Plugins/Netscape/mac/NetscapePluginMac.mm
+++ b/Source/WebKit2/WebProcess/Plugins/Netscape/mac/NetscapePluginMac.mm
@@ -221,7 +221,8 @@ bool NetscapePlugin::platformPostInitialize()
     
 #ifndef NP_NO_QUICKDRAW
     // Right now we don't support the QuickDraw drawing model at all
-    if (m_drawingModel == NPDrawingModelQuickDraw)
+    if (m_drawingModel == NPDrawingModelQuickDraw &&
+        !m_pluginModule->pluginQuirks().contains(PluginQuirks::AllowHalfBakedQuickDrawSupport))
         return false;
 #endif
 
@@ -230,7 +231,17 @@ bool NetscapePlugin::platformPostInitialize()
         // Get the Core Animation layer.
         if (NPP_GetValue(NPPVpluginCoreAnimationLayer, &value) == NPERR_NO_ERROR && value) {
             ASSERT(!m_pluginLayer);
-            m_pluginLayer = reinterpret_cast<CALayer *>(value);
+
+            CALayer *realPluginLayer = reinterpret_cast<CALayer *>(value);
+
+            // Create a layer with flipped geometry and add the real plug-in layer as a sublayer
+            // so the coordinate system will match the event coordinate system.
+            m_pluginLayer.adoptNS([[CALayer alloc] init]);
+            [m_pluginLayer.get() setBounds:[realPluginLayer bounds]];
+            [m_pluginLayer.get() setGeometryFlipped:YES];
+
+            [realPluginLayer setAutoresizingMask:kCALayerWidthSizable | kCALayerHeightSizable];
+            [m_pluginLayer.get() addSublayer:realPluginLayer];
         }
     }
 
@@ -277,6 +288,10 @@ void NetscapePlugin::platformDestroy()
 
 bool NetscapePlugin::platformInvalidate(const IntRect&)
 {
+    // NPN_InvalidateRect is just a no-op in the Core Animation drawing model.
+    if (m_drawingModel == NPDrawingModelCoreAnimation)
+        return true;
+
     return false;
 }
 
diff --git a/Source/WebKit2/WebProcess/Plugins/Netscape/qt/NetscapePluginQt.cpp b/Source/WebKit2/WebProcess/Plugins/Netscape/qt/NetscapePluginQt.cpp
deleted file mode 100644
index 581dcf3..0000000
--- a/Source/WebKit2/WebProcess/Plugins/Netscape/qt/NetscapePluginQt.cpp
+++ /dev/null
@@ -1,125 +0,0 @@
-/*
- * Copyright (C) 2010 Apple Inc. All rights reserved.
- * Copyright (C) 2010 University of Szeged
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
- * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
- * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
- * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
- * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
- * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
- * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
- * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
- * THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "config.h"
-#include "NetscapePlugin.h"
-
-#include "WebEvent.h"
-#include <WebCore/GraphicsContext.h>
-#include <WebCore/NotImplemented.h>
-
-using namespace WebCore;
-
-namespace WebKit {
-
-bool NetscapePlugin::platformPostInitialize()
-{
-    notImplemented();
-    return true;
-}
-
-void NetscapePlugin::platformDestroy()
-{
-    notImplemented();
-}
-
-bool NetscapePlugin::platformInvalidate(const IntRect&)
-{
-    notImplemented();
-    return false;
-}
-
-void NetscapePlugin::platformGeometryDidChange()
-{
-    notImplemented();
-}
-
-void NetscapePlugin::platformPaint(GraphicsContext* context, const IntRect& dirtyRect, bool)
-{
-    notImplemented();
-}
-
-NPEvent toNP(const WebMouseEvent& event)
-{
-#if OS(SYMBIAN)
-    NPEvent npEvent = QEvent(QEvent::None);
-#else
-    NPEvent npEvent = NPEvent();
-#endif
-
-    notImplemented();
-
-    return npEvent;
-}
-
-bool NetscapePlugin::platformHandleMouseEvent(const WebMouseEvent& event)
-{
-    if (m_isWindowed)
-        return false;
-
-    NPEvent npEvent = toNP(event);
-    NPP_HandleEvent(&npEvent);
-    return true;
-}
-
-bool NetscapePlugin::platformHandleWheelEvent(const WebWheelEvent&)
-{
-    notImplemented();
-    return false;
-}
-
-void NetscapePlugin::platformSetFocus(bool)
-{
-    notImplemented();
-}
-
-bool NetscapePlugin::platformHandleMouseEnterEvent(const WebMouseEvent& event)
-{
-    if (m_isWindowed)
-        return false;
-
-    NPEvent npEvent = toNP(event);
-    NPP_HandleEvent(&npEvent);
-    return true;
-}
-
-bool NetscapePlugin::platformHandleMouseLeaveEvent(const WebMouseEvent& event)
-{
-    if (m_isWindowed)
-        return false;
-
-    NPEvent npEvent = toNP(event);
-    NPP_HandleEvent(&npEvent);
-    return true;
-}
-
-bool NetscapePlugin::platformHandleKeyboardEvent(const WebKeyboardEvent&)
-{
-    notImplemented();
-    return false;
-}
-
-} // namespace WebKit
diff --git a/Source/WebKit2/WebProcess/Plugins/Netscape/x11/NetscapePluginX11.cpp b/Source/WebKit2/WebProcess/Plugins/Netscape/x11/NetscapePluginX11.cpp
new file mode 100644
index 0000000..27e694b
--- /dev/null
+++ b/Source/WebKit2/WebProcess/Plugins/Netscape/x11/NetscapePluginX11.cpp
@@ -0,0 +1,425 @@
+/*
+ * Copyright (C) 2010 Apple Inc. All rights reserved.
+ * Copyright (C) 2010 University of Szeged
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "NetscapePlugin.h"
+
+#include "WebEvent.h"
+#include <WebCore/GraphicsContext.h>
+#include <WebCore/NotImplemented.h>
+
+#if PLATFORM(QT)
+#include <QApplication>
+#include <QDesktopWidget>
+#include <QPixmap>
+#include <QX11Info>
+#elif PLATFORM(GTK)
+#include <gdk/gdkx.h>
+#endif
+
+using namespace WebCore;
+
+namespace WebKit {
+
+static Display *getPluginDisplay()
+{
+#if PLATFORM(QT)
+    // At the moment, we only support gdk based plugins (like Flash) that use a different X connection.
+    // The code below has the same effect as this one:
+    // Display *gdkDisplay = gdk_x11_display_get_xdisplay(gdk_display_get_default());
+
+    QLibrary library(QLatin1String("libgdk-x11-2.0"), 0);
+    if (!library.load())
+        return 0;
+
+    typedef void *(*gdk_display_get_default_ptr)();
+    gdk_display_get_default_ptr gdk_display_get_default = (gdk_display_get_default_ptr)library.resolve("gdk_display_get_default");
+    if (!gdk_display_get_default)
+        return 0;
+
+    typedef void *(*gdk_x11_display_get_xdisplay_ptr)(void *);
+    gdk_x11_display_get_xdisplay_ptr gdk_x11_display_get_xdisplay = (gdk_x11_display_get_xdisplay_ptr)library.resolve("gdk_x11_display_get_xdisplay");
+    if (!gdk_x11_display_get_xdisplay)
+        return 0;
+
+    return (Display*)gdk_x11_display_get_xdisplay(gdk_display_get_default());
+#elif PLATFORM(GTK)
+    // Since we're a gdk/gtk app, we'll (probably?) have the same X connection as any gdk-based
+    // plugins, so we can return that. We might want to add other implementations here later.
+    return GDK_DISPLAY_XDISPLAY(gdk_display_get_default());
+#else
+    return 0;
+#endif
+}
+
+static inline Display* x11Display()
+{
+#if PLATFORM(QT)
+    return QX11Info::display();
+#elif PLATFORM(GTK)
+    return GDK_DISPLAY_XDISPLAY(gdk_display_get_default());
+#else
+    return 0;
+#endif
+}
+
+static inline int displayDepth()
+{
+#if PLATFORM(QT)
+    return QApplication::desktop()->x11Info().depth();
+#elif PLATFORM(GTK)
+    return gdk_visual_get_depth(gdk_screen_get_system_visual(gdk_screen_get_default()));
+#else
+    return 0;
+#endif
+}
+
+static inline unsigned long rootWindowID()
+{
+#if PLATFORM(QT)
+    return QX11Info::appRootWindow();
+#elif PLATFORM(GTK)
+    return GDK_ROOT_WINDOW();
+#else
+    return 0;
+#endif
+}
+
+static inline int x11Screen()
+{
+#if PLATFORM(QT)
+    return QX11Info::appScreen();
+#elif PLATFORM(GTK)
+    return gdk_screen_get_number(gdk_screen_get_default());
+#else
+    return 0;
+#endif
+}
+
+bool NetscapePlugin::platformPostInitialize()
+{
+    if (m_isWindowed)
+        return false;
+
+    if (!(m_pluginDisplay = getPluginDisplay()))
+        return false;
+
+    NPSetWindowCallbackStruct* callbackStruct = new NPSetWindowCallbackStruct;
+    callbackStruct->type = 0;
+    Display* display = x11Display();
+    int depth = displayDepth();
+    callbackStruct->display = display;
+    callbackStruct->depth = depth;
+
+    XVisualInfo visualTemplate;
+    visualTemplate.screen = x11Screen();
+    visualTemplate.depth = depth;
+    visualTemplate.c_class = TrueColor;
+    int numMatching;
+    XVisualInfo* visualInfo = XGetVisualInfo(display, VisualScreenMask | VisualDepthMask | VisualClassMask,
+                                             &visualTemplate, &numMatching);
+    ASSERT(visualInfo);
+    Visual* visual = visualInfo[0].visual;
+    ASSERT(visual);
+    XFree(visualInfo);
+
+    callbackStruct->visual = visual;
+    callbackStruct->colormap = XCreateColormap(display, rootWindowID(), visual, AllocNone);
+
+    m_npWindow.type = NPWindowTypeDrawable;
+    m_npWindow.window = 0;
+    m_npWindow.ws_info = callbackStruct;
+
+    callSetWindow();
+
+    return true;
+}
+
+void NetscapePlugin::platformDestroy()
+{
+    delete static_cast<NPSetWindowCallbackStruct*>(m_npWindow.ws_info);
+
+    if (m_drawable) {
+        XFreePixmap(x11Display(), m_drawable);
+        m_drawable = 0;
+    }
+}
+
+bool NetscapePlugin::platformInvalidate(const IntRect&)
+{
+    notImplemented();
+    return false;
+}
+
+void NetscapePlugin::platformGeometryDidChange()
+{
+    if (m_isWindowed) {
+        notImplemented();
+        return;
+    }
+
+    Display* display = x11Display();
+    if (m_drawable)
+        XFreePixmap(display, m_drawable);
+
+    m_drawable = XCreatePixmap(display, rootWindowID(), m_frameRect.width(), m_frameRect.height(), displayDepth());
+
+    XSync(display, false); // Make sure that the server knows about the Drawable.
+}
+
+void NetscapePlugin::platformPaint(GraphicsContext* context, const IntRect& dirtyRect, bool /*isSnapshot*/)
+{
+    if (m_isWindowed) {
+        notImplemented();
+        return;
+    }
+
+    if (!m_isStarted) {
+        // FIXME: we should paint a missing plugin icon.
+        return;
+    }
+
+    if (context->paintingDisabled())
+        return;
+
+    ASSERT(m_drawable);
+
+#if PLATFORM(QT)
+    QPainter* painter = context->platformContext();
+    painter->translate(m_frameRect.x(), m_frameRect.y());
+#else
+    notImplemented();
+    return;
+#endif
+
+    XEvent xevent;
+    memset(&xevent, 0, sizeof(XEvent));
+    XGraphicsExposeEvent& exposeEvent = xevent.xgraphicsexpose;
+    exposeEvent.type = GraphicsExpose;
+    exposeEvent.display = x11Display();
+    exposeEvent.drawable = m_drawable;
+
+    IntRect exposedRect(dirtyRect);
+    exposedRect.intersect(m_frameRect);
+    exposedRect.move(-m_frameRect.x(), -m_frameRect.y());
+    exposeEvent.x = exposedRect.x();
+    exposeEvent.y = exposedRect.y();
+
+    // Note: in transparent mode Flash thinks width is the right and height is the bottom.
+    // We should take it into account if we want to support transparency.
+    exposeEvent.width = exposedRect.width();
+    exposeEvent.height = exposedRect.height();
+
+    NPP_HandleEvent(&xevent);
+
+    if (m_pluginDisplay != x11Display())
+        XSync(m_pluginDisplay, false);
+
+#if PLATFORM(QT)
+    QPixmap qtDrawable = QPixmap::fromX11Pixmap(m_drawable, QPixmap::ExplicitlyShared);
+    ASSERT(qtDrawable.depth() == static_cast<NPSetWindowCallbackStruct*>(m_npWindow.ws_info)->depth);
+    painter->drawPixmap(QPoint(exposedRect.x(), exposedRect.y()), qtDrawable, exposedRect);
+
+    painter->translate(-m_frameRect.x(), -m_frameRect.y());
+#endif
+}
+
+static inline void initializeXEvent(XEvent& event)
+{
+    memset(&event, 0, sizeof(XEvent));
+    event.xany.serial = 0;
+    event.xany.send_event = false;
+    event.xany.display = x11Display();
+    event.xany.window = 0;
+}
+
+static inline uint64_t xTimeStamp(double timestampInSeconds)
+{
+    return timestampInSeconds * 1000;
+}
+
+static inline unsigned xKeyModifiers(const WebEvent& event)
+{
+    unsigned xModifiers = 0;
+    if (event.controlKey())
+        xModifiers |= ControlMask;
+    if (event.shiftKey())
+        xModifiers |= ShiftMask;
+    if (event.altKey())
+        xModifiers |= Mod1Mask;
+    if (event.metaKey())
+        xModifiers |= Mod4Mask;
+
+    return xModifiers;
+}
+
+template <typename XEventType>
+static inline void setCommonMouseEventFields(XEventType& xEvent, const WebMouseEvent& webEvent, const WebCore::IntPoint& pluginLocation)
+{
+    xEvent.root = rootWindowID();
+    xEvent.subwindow = 0;
+    xEvent.time = xTimeStamp(webEvent.timestamp());
+    xEvent.x = webEvent.position().x() - pluginLocation.x();
+    xEvent.y = webEvent.position().y() - pluginLocation.y();
+    xEvent.x_root = webEvent.globalPosition().x();
+    xEvent.y_root = webEvent.globalPosition().y();
+    xEvent.state = xKeyModifiers(webEvent);
+    xEvent.same_screen = true;
+}
+
+static inline void setXMotionEventFields(XEvent& xEvent, const WebMouseEvent& webEvent, const WebCore::IntPoint& pluginLocation)
+{
+    XMotionEvent& xMotion = xEvent.xmotion;
+    setCommonMouseEventFields(xMotion, webEvent, pluginLocation);
+    xMotion.type = MotionNotify;
+}
+
+static inline void setXButtonEventFields(XEvent& xEvent, const WebMouseEvent& webEvent, const WebCore::IntPoint& pluginLocation)
+{
+    XButtonEvent& xButton = xEvent.xbutton;
+    setCommonMouseEventFields(xButton, webEvent, pluginLocation);
+
+    xButton.type = (webEvent.type() == WebEvent::MouseDown) ? ButtonPress : ButtonRelease;
+    switch (webEvent.button()) {
+    case WebMouseEvent::LeftButton:
+        xButton.button = Button1;
+        break;
+    case WebMouseEvent::MiddleButton:
+        xButton.button = Button2;
+        break;
+    case WebMouseEvent::RightButton:
+        xButton.button = Button3;
+        break;
+    }
+}
+
+static inline void setXCrossingEventFields(XEvent& xEvent, const WebMouseEvent& webEvent, const WebCore::IntPoint& pluginLocation, int type)
+{
+    XCrossingEvent& xCrossing = xEvent.xcrossing;
+    setCommonMouseEventFields(xCrossing, webEvent, pluginLocation);
+
+    xCrossing.type = type;
+    xCrossing.mode = NotifyNormal;
+    xCrossing.detail = NotifyDetailNone;
+    xCrossing.focus = false;
+}
+
+bool NetscapePlugin::platformHandleMouseEvent(const WebMouseEvent& event)
+{
+    if (m_isWindowed)
+        return false;
+
+    XEvent xEvent;
+    initializeXEvent(xEvent);
+
+    switch (event.type()) {
+    case WebEvent::MouseDown:
+    case WebEvent::MouseUp:
+        setXButtonEventFields(xEvent, event, m_frameRect.location());
+        break;
+    case WebEvent::MouseMove:
+        setXMotionEventFields(xEvent, event, m_frameRect.location());
+        break;
+    }
+
+    return NPP_HandleEvent(&xEvent);
+}
+
+// We undefine these constants in npruntime_internal.h to avoid collision
+// with WebKit and platform headers. Values are defined in X.h.
+const int kKeyPressType = 2;
+const int kKeyReleaseType = 3;
+const int kFocusInType = 9;
+const int kFocusOutType = 10;
+
+bool NetscapePlugin::platformHandleWheelEvent(const WebWheelEvent&)
+{
+    notImplemented();
+    return false;
+}
+
+void NetscapePlugin::platformSetFocus(bool)
+{
+    notImplemented();
+}
+
+bool NetscapePlugin::platformHandleMouseEnterEvent(const WebMouseEvent& event)
+{
+    if (m_isWindowed)
+        return false;
+
+    XEvent xEvent;
+    initializeXEvent(xEvent);
+    setXCrossingEventFields(xEvent, event, m_frameRect.location(), EnterNotify);
+
+    return NPP_HandleEvent(&xEvent);
+}
+
+bool NetscapePlugin::platformHandleMouseLeaveEvent(const WebMouseEvent& event)
+{
+    if (m_isWindowed)
+        return false;
+
+    XEvent xEvent;
+    initializeXEvent(xEvent);
+    setXCrossingEventFields(xEvent, event, m_frameRect.location(), LeaveNotify);
+
+    return NPP_HandleEvent(&xEvent);
+}
+
+static inline void setXKeyEventFields(XEvent& xEvent, const WebKeyboardEvent& webEvent)
+{
+    xEvent.xany.type = (webEvent.type() == WebEvent::KeyDown) ? kKeyPressType : kKeyReleaseType;
+    XKeyEvent& xKey = xEvent.xkey;
+    xKey.root = rootWindowID();
+    xKey.subwindow = 0;
+    xKey.time = xTimeStamp(webEvent.timestamp());
+    xKey.state = xKeyModifiers(webEvent);
+    xKey.keycode = webEvent.nativeVirtualKeyCode();
+
+    xKey.same_screen = true;
+
+    // Key events propagated to the plugin does not need to have position.
+    // source: https://developer.mozilla.org/en/NPEvent
+    xKey.x = 0;
+    xKey.y = 0;
+    xKey.x_root = 0;
+    xKey.y_root = 0;
+}
+
+bool NetscapePlugin::platformHandleKeyboardEvent(const WebKeyboardEvent& event)
+{
+    // We don't generate other types of keyboard events via WebEventFactory.
+    ASSERT(event.type() == WebEvent::KeyDown || event.type() == WebEvent::KeyUp);
+
+    XEvent xEvent;
+    initializeXEvent(xEvent);
+    setXKeyEventFields(xEvent, event);
+
+    return NPP_HandleEvent(&xEvent);
+}
+
+} // namespace WebKit
diff --git a/Source/WebKit2/WebProcess/Plugins/Plugin.h b/Source/WebKit2/WebProcess/Plugins/Plugin.h
index 6afeb5c..83a0ff1 100644
--- a/Source/WebKit2/WebProcess/Plugins/Plugin.h
+++ b/Source/WebKit2/WebProcess/Plugins/Plugin.h
@@ -84,6 +84,9 @@ public:
     // If a plug-in is using the Core Animation drawing model, this returns its plug-in layer.
     virtual PlatformLayer* pluginLayer() = 0;
 #endif
+    
+    // Returns whether the plug-in is transparent or not.
+    virtual bool isTransparent() = 0;
 
     // Tells the plug-in that either the plug-ins frame rect or its clip rect has changed. Both rects are in window coordinates.
     virtual void geometryDidChange(const WebCore::IntRect& frameRect, const WebCore::IntRect& clipRect) = 0;
diff --git a/Source/WebKit2/WebProcess/Plugins/PluginProcessConnection.cpp b/Source/WebKit2/WebProcess/Plugins/PluginProcessConnection.cpp
index ef931c8..3d007a6 100644
--- a/Source/WebKit2/WebProcess/Plugins/PluginProcessConnection.cpp
+++ b/Source/WebKit2/WebProcess/Plugins/PluginProcessConnection.cpp
@@ -62,13 +62,14 @@ void PluginProcessConnection::removePluginProxy(PluginProxy* plugin)
     ASSERT(m_plugins.contains(plugin->pluginInstanceID()));
     m_plugins.remove(plugin->pluginInstanceID());
 
+    // Invalidate all objects related to this plug-in.
+    m_npRemoteObjectMap->pluginDestroyed(plugin);
+
     if (!m_plugins.isEmpty())
         return;
 
-    // Invalidate our remote object map.
-    m_npRemoteObjectMap->invalidate();
-    m_npRemoteObjectMap = 0;
-    
+    m_npRemoteObjectMap = nullptr;
+
     // We have no more plug-ins, invalidate the connection to the plug-in process.
     ASSERT(m_connection);
     m_connection->invalidate();
diff --git a/Source/WebKit2/WebProcess/Plugins/PluginProxy.cpp b/Source/WebKit2/WebProcess/Plugins/PluginProxy.cpp
index f267d9e..fc8f552 100644
--- a/Source/WebKit2/WebProcess/Plugins/PluginProxy.cpp
+++ b/Source/WebKit2/WebProcess/Plugins/PluginProxy.cpp
@@ -132,7 +132,8 @@ void PluginProxy::paint(GraphicsContext* graphicsContext, const IntRect& dirtyRe
     
         // Blit the plug-in backing store into our own backing store.
         OwnPtr<WebCore::GraphicsContext> graphicsContext = m_backingStore->createGraphicsContext();
-        
+        graphicsContext->setCompositeOperation(CompositeCopy);
+
         m_pluginBackingStore->paint(*graphicsContext, IntPoint(), IntRect(0, 0, m_frameRect.width(), m_frameRect.height()));
 
         m_pluginBackingStoreContainsValidData = true;
@@ -152,14 +153,20 @@ void PluginProxy::paint(GraphicsContext* graphicsContext, const IntRect& dirtyRe
 
 PassRefPtr<ShareableBitmap> PluginProxy::snapshot()
 {
-    IntSize bufferSize;
-    SharedMemory::Handle snapshotStoreHandle;
-    m_connection->connection()->sendSync(Messages::PluginControllerProxy::Snapshot(), Messages::PluginControllerProxy::Snapshot::Reply(bufferSize, snapshotStoreHandle), m_pluginInstanceID);
+    ShareableBitmap::Handle snapshotStoreHandle;
+    m_connection->connection()->sendSync(Messages::PluginControllerProxy::Snapshot(), Messages::PluginControllerProxy::Snapshot::Reply(snapshotStoreHandle), m_pluginInstanceID);
 
-    RefPtr<ShareableBitmap> snapshotBuffer = ShareableBitmap::create(bufferSize, snapshotStoreHandle);
+    RefPtr<ShareableBitmap> snapshotBuffer = ShareableBitmap::create(snapshotStoreHandle);
     return snapshotBuffer.release();
 }
 
+bool PluginProxy::isTransparent()
+{
+    // This should never be called from the web process.
+    ASSERT_NOT_REACHED();
+    return false;
+}
+
 void PluginProxy::geometryDidChange(const IntRect& frameRect, const IntRect& clipRect)
 {
     ASSERT(m_isStarted);
@@ -167,14 +174,14 @@ void PluginProxy::geometryDidChange(const IntRect& frameRect, const IntRect& cli
     m_frameRect = frameRect;
 
     if (!needsBackingStore()) {
-        SharedMemory::Handle pluginBackingStoreHandle;
-        m_connection->connection()->send(Messages::PluginControllerProxy::GeometryDidChange(frameRect, clipRect, pluginBackingStoreHandle), m_pluginInstanceID);
+        ShareableBitmap::Handle pluginBackingStoreHandle;
+        m_connection->connection()->send(Messages::PluginControllerProxy::GeometryDidChange(frameRect, clipRect, pluginBackingStoreHandle), m_pluginInstanceID, CoreIPC::DispatchMessageEvenWhenWaitingForSyncReply);
         return;
     }
 
     bool didUpdateBackingStore = false;
     if (!m_backingStore) {
-        m_backingStore = ShareableBitmap::create(frameRect.size());
+        m_backingStore = ShareableBitmap::create(frameRect.size(), ShareableBitmap::SupportsAlpha);
         didUpdateBackingStore = true;
     } else if (frameRect.size() != m_backingStore->size()) {
         // The backing store already exists, just resize it.
@@ -184,24 +191,24 @@ void PluginProxy::geometryDidChange(const IntRect& frameRect, const IntRect& cli
         didUpdateBackingStore = true;
     }
 
-    SharedMemory::Handle pluginBackingStoreHandle;
+    ShareableBitmap::Handle pluginBackingStoreHandle;
 
     if (didUpdateBackingStore) {
         // Create a new plug-in backing store.
-        m_pluginBackingStore = ShareableBitmap::createShareable(frameRect.size());
+        m_pluginBackingStore = ShareableBitmap::createShareable(frameRect.size(), ShareableBitmap::SupportsAlpha);
         if (!m_pluginBackingStore)
             return;
 
         // Create a handle to the plug-in backing store so we can send it over.
         if (!m_pluginBackingStore->createHandle(pluginBackingStoreHandle)) {
-            m_pluginBackingStore.clear();
+            m_pluginBackingStore = nullptr;
             return;
         }
 
         m_pluginBackingStoreContainsValidData = false;
     }
 
-    m_connection->connection()->send(Messages::PluginControllerProxy::GeometryDidChange(frameRect, clipRect, pluginBackingStoreHandle), m_pluginInstanceID);
+    m_connection->connection()->send(Messages::PluginControllerProxy::GeometryDidChange(frameRect, clipRect, pluginBackingStoreHandle), m_pluginInstanceID, CoreIPC::DispatchMessageEvenWhenWaitingForSyncReply);
 }
 
 void PluginProxy::frameDidFinishLoading(uint64_t requestID)
@@ -319,7 +326,7 @@ NPObject* PluginProxy::pluginScriptableNPObject()
     if (!pluginScriptableNPObjectID)
         return 0;
 
-    return m_connection->npRemoteObjectMap()->createNPObjectProxy(pluginScriptableNPObjectID);
+    return m_connection->npRemoteObjectMap()->createNPObjectProxy(pluginScriptableNPObjectID, this);
 }
 
 #if PLATFORM(MAC)
@@ -388,7 +395,7 @@ void PluginProxy::getWindowScriptNPObject(uint64_t& windowScriptNPObjectID)
         return;
     }
 
-    windowScriptNPObjectID = m_connection->npRemoteObjectMap()->registerNPObject(windowScriptNPObject);
+    windowScriptNPObjectID = m_connection->npRemoteObjectMap()->registerNPObject(windowScriptNPObject, this);
     releaseNPObject(windowScriptNPObject);
 }
 
@@ -400,7 +407,7 @@ void PluginProxy::getPluginElementNPObject(uint64_t& pluginElementNPObjectID)
         return;
     }
 
-    pluginElementNPObjectID = m_connection->npRemoteObjectMap()->registerNPObject(pluginElementNPObject);
+    pluginElementNPObjectID = m_connection->npRemoteObjectMap()->registerNPObject(pluginElementNPObject, this);
     releaseNPObject(pluginElementNPObject);
 }
 
@@ -408,16 +415,19 @@ void PluginProxy::evaluate(const NPVariantData& npObjectAsVariantData, const Str
 {
     PluginController::PluginDestructionProtector protector(m_pluginController);
 
-    NPVariant npObjectAsVariant = m_connection->npRemoteObjectMap()->npVariantDataToNPVariant(npObjectAsVariantData);
-    ASSERT(NPVARIANT_IS_OBJECT(npObjectAsVariant));
-
+    NPVariant npObjectAsVariant = m_connection->npRemoteObjectMap()->npVariantDataToNPVariant(npObjectAsVariantData, this);
+    if (!NPVARIANT_IS_OBJECT(npObjectAsVariant) || !(NPVARIANT_TO_OBJECT(npObjectAsVariant))) {
+        returnValue = false;
+        return;
+    }
+        
     NPVariant result;
     returnValue = m_pluginController->evaluate(NPVARIANT_TO_OBJECT(npObjectAsVariant), scriptString, &result, allowPopups);
     if (!returnValue)
         return;
 
     // Convert the NPVariant to an NPVariantData.
-    resultData = m_connection->npRemoteObjectMap()->npVariantToNPVariantData(result);
+    resultData = m_connection->npRemoteObjectMap()->npVariantToNPVariantData(result, this);
     
     // And release the result.
     releaseNPVariantValue(&result);
@@ -458,7 +468,7 @@ void PluginProxy::update(const IntRect& paintedRect)
     if (m_backingStore) {
         // Blit the plug-in backing store into our own backing store.
         OwnPtr<GraphicsContext> graphicsContext = m_backingStore->createGraphicsContext();
-
+        graphicsContext->setCompositeOperation(CompositeCopy);
         m_pluginBackingStore->paint(*graphicsContext, paintedRectPluginCoordinates.location(), 
                                     paintedRectPluginCoordinates);
     }
diff --git a/Source/WebKit2/WebProcess/Plugins/PluginProxy.h b/Source/WebKit2/WebProcess/Plugins/PluginProxy.h
index 4fe99a7..bd55a9e 100644
--- a/Source/WebKit2/WebProcess/Plugins/PluginProxy.h
+++ b/Source/WebKit2/WebProcess/Plugins/PluginProxy.h
@@ -68,6 +68,7 @@ private:
 #if PLATFORM(MAC)
     virtual PlatformLayer* pluginLayer();
 #endif
+    virtual bool isTransparent();
     virtual void geometryDidChange(const WebCore::IntRect& frameRect, const WebCore::IntRect& clipRect);
     virtual void frameDidFinishLoading(uint64_t requestID);
     virtual void frameDidFail(uint64_t requestID, bool wasCancelled);
diff --git a/Source/WebKit2/WebProcess/Plugins/PluginView.cpp b/Source/WebKit2/WebProcess/Plugins/PluginView.cpp
index 3b1629d..ec770ec 100644
--- a/Source/WebKit2/WebProcess/Plugins/PluginView.cpp
+++ b/Source/WebKit2/WebProcess/Plugins/PluginView.cpp
@@ -825,6 +825,11 @@ void PluginView::invalidateRect(const IntRect& dirtyRect)
     if (!parent() || !m_plugin || !m_isInitialized)
         return;
 
+#if PLATFORM(MAC)
+    if (m_plugin->pluginLayer())
+        return;
+#endif
+
     IntRect dirtyRectInWindowCoordinates = convertToContainingWindow(dirtyRect);
 
     parent()->hostWindow()->invalidateContentsAndWindow(intersection(dirtyRectInWindowCoordinates, clipRectInWindowCoordinates()), false);
@@ -926,11 +931,12 @@ NPObject* PluginView::pluginElementNPObject()
 
 bool PluginView::evaluate(NPObject* npObject, const String& scriptString, NPVariant* result, bool allowPopups)
 {
-    if (!frame())
+    RefPtr<Frame> frame = m_pluginElement->document()->frame();
+    if (!frame)
         return false;
 
-    bool oldAllowPopups = frame()->script()->allowPopupsFromPlugin();
-    frame()->script()->setAllowPopupsFromPlugin(allowPopups);
+    bool oldAllowPopups = frame->script()->allowPopupsFromPlugin();
+    frame->script()->setAllowPopupsFromPlugin(allowPopups);
 
     // Calling evaluate will run JavaScript that can potentially remove the plug-in element, so we need to
     // protect the plug-in view from destruction.
@@ -938,7 +944,7 @@ bool PluginView::evaluate(NPObject* npObject, const String& scriptString, NPVari
 
     bool returnValue = m_npRuntimeObjectMap.evaluate(npObject, scriptString, result);
 
-    frame()->script()->setAllowPopupsFromPlugin(oldAllowPopups);
+    frame->script()->setAllowPopupsFromPlugin(oldAllowPopups);
 
     return returnValue;
 }
diff --git a/Source/WebKit2/WebProcess/ResourceCache/WebResourceCacheManager.cpp b/Source/WebKit2/WebProcess/ResourceCache/WebResourceCacheManager.cpp
index dad2791..1596319 100644
--- a/Source/WebKit2/WebProcess/ResourceCache/WebResourceCacheManager.cpp
+++ b/Source/WebKit2/WebProcess/ResourceCache/WebResourceCacheManager.cpp
@@ -93,6 +93,7 @@ void WebResourceCacheManager::getCacheOrigins(uint64_t callbackID) const
     }
 
     WebProcess::shared().connection()->send(Messages::WebResourceCacheManagerProxy::DidGetCacheOrigins(identifiers, callbackID), 0);
+    WebProcess::shared().terminateIfPossible();
 }
 
 void WebResourceCacheManager::clearCacheForOrigin(SecurityOriginData originData) const
@@ -110,11 +111,13 @@ void WebResourceCacheManager::clearCacheForOrigin(SecurityOriginData originData)
 
     clearCFURLCacheForHostNames(hostArray.get());
 #endif
+    WebProcess::shared().terminateIfPossible();
 }
 
 void WebResourceCacheManager::clearCacheForAllOrigins() const
 {
     WebProcess::shared().clearResourceCaches();
+    WebProcess::shared().terminateIfPossible();
 }
 
 } // namespace WebKit
diff --git a/Source/WebKit2/WebProcess/WebCoreSupport/WebChromeClient.cpp b/Source/WebKit2/WebProcess/WebCoreSupport/WebChromeClient.cpp
index d4c357d..becf48f 100644
--- a/Source/WebKit2/WebProcess/WebCoreSupport/WebChromeClient.cpp
+++ b/Source/WebKit2/WebProcess/WebCoreSupport/WebChromeClient.cpp
@@ -34,6 +34,7 @@
 #include "WebCoreArgumentCoders.h"
 #include "WebFrame.h"
 #include "WebFrameLoaderClient.h"
+#include "WebFullScreenManager.h"
 #include "WebOpenPanelParameters.h"
 #include "WebOpenPanelResultListener.h"
 #include "WebPage.h"
@@ -51,6 +52,7 @@
 #include <WebCore/FrameView.h>
 #include <WebCore/HTMLNames.h>
 #include <WebCore/HTMLPlugInImageElement.h>
+#include <WebCore/Icon.h>
 #include <WebCore/NotImplemented.h>
 #include <WebCore/Page.h>
 #include <WebCore/SecurityOrigin.h>
@@ -115,18 +117,17 @@ FloatRect WebChromeClient::pageRect()
 
 float WebChromeClient::scaleFactor()
 {
-    notImplemented();
-    return 1.0;
+    return m_page->userSpaceScaleFactor();
 }
 
 void WebChromeClient::focus()
 {
-    notImplemented();
+    m_page->send(Messages::WebPageProxy::SetFocus(true));
 }
 
 void WebChromeClient::unfocus()
 {
-    notImplemented();
+    m_page->send(Messages::WebPageProxy::SetFocus(false));
 }
 
 bool WebChromeClient::canTakeFocus(FocusDirection)
@@ -373,7 +374,7 @@ void WebChromeClient::scroll(const IntSize& scrollOffset, const IntRect& scrollR
 }
 
 #if ENABLE(TILED_BACKING_STORE)
-void WebChromeClient::delegatedScrollRequested(const IntSize& scrollOffset)
+void WebChromeClient::delegatedScrollRequested(const IntPoint& scrollOffset)
 {
     m_page->pageDidRequestScroll(scrollOffset);
 }
@@ -385,10 +386,9 @@ IntPoint WebChromeClient::screenToWindow(const IntPoint&) const
     return IntPoint();
 }
 
-IntRect WebChromeClient::windowToScreen(const IntRect&) const
+IntRect WebChromeClient::windowToScreen(const IntRect& rect) const
 {
-    notImplemented();
-    return IntRect();
+    return m_page->windowToScreen(rect);
 }
 
 PlatformPageClient WebChromeClient::platformPageClient() const
@@ -545,14 +545,13 @@ void WebChromeClient::paintCustomHighlight(Node*, const AtomicString& type, cons
 
 bool WebChromeClient::shouldReplaceWithGeneratedFileForUpload(const String& path, String& generatedFilename)
 {
-    notImplemented();
-    return false;
+    generatedFilename = m_page->injectedBundleUIClient().shouldGenerateFileForUpload(m_page, path);
+    return !generatedFilename.isNull();
 }
 
 String WebChromeClient::generateReplacementFile(const String& path)
 {
-    notImplemented();
-    return String();
+    return m_page->injectedBundleUIClient().generateFileForUpload(m_page, path);
 }
 
 bool WebChromeClient::paintCustomScrollbar(GraphicsContext*, const FloatRect&, ScrollbarControlSize, 
@@ -610,9 +609,9 @@ void WebChromeClient::runOpenPanel(Frame* frame, PassRefPtr<FileChooser> prpFile
     m_page->send(Messages::WebPageProxy::RunOpenPanel(static_cast<WebFrameLoaderClient*>(frame->loader()->client())->webFrame()->frameID(), parameters));
 }
 
-void WebChromeClient::chooseIconForFiles(const Vector<String>&, FileChooser*)
+void WebChromeClient::chooseIconForFiles(const Vector<String>& filenames, FileChooser* chooser)
 {
-    notImplemented();
+    chooser->iconLoaded(Icon::createIconForFiles(filenames));
 }
 
 void WebChromeClient::setCursor(const WebCore::Cursor& cursor)
@@ -639,12 +638,20 @@ void WebChromeClient::formDidBlur(const Node*)
 
 bool WebChromeClient::selectItemWritingDirectionIsNatural()
 {
+#if PLATFORM(WIN)
+    return true;
+#else
     return false;
+#endif
 }
 
 bool WebChromeClient::selectItemAlignmentFollowsMenuWritingDirection()
 {
+#if PLATFORM(WIN)
+    return false;
+#else
     return true;
+#endif
 }
 
 PassRefPtr<WebCore::PopupMenu> WebChromeClient::createPopupMenu(WebCore::PopupMenuClient* client) const
@@ -705,6 +712,29 @@ void WebChromeClient::setLastSetCursorToCurrentCursor()
 }
 #endif
 
+#if ENABLE(FULLSCREEN_API)
+bool WebChromeClient::supportsFullScreenForElement(const WebCore::Element* element, bool withKeyboard)
+{
+    return m_page->fullScreenManager()->supportsFullScreen(withKeyboard);
+}
+
+void WebChromeClient::enterFullScreenForElement(WebCore::Element* element)
+{
+    m_page->fullScreenManager()->enterFullScreenForElement(element);
+}
+
+void WebChromeClient::exitFullScreenForElement(WebCore::Element* element)
+{
+    m_page->fullScreenManager()->exitFullScreenForElement(element);
+}
+    
+void WebChromeClient::setRootFullScreenLayer(GraphicsLayer* layer)
+{
+    m_page->fullScreenManager()->setRootFullScreenLayer(layer);
+}
+
+#endif
+
 void WebChromeClient::dispatchViewportDataDidChange(const ViewportArguments& args) const
 {
     m_page->send(Messages::WebPageProxy::DidChangeViewportData(args));
diff --git a/Source/WebKit2/WebProcess/WebCoreSupport/WebChromeClient.h b/Source/WebKit2/WebProcess/WebCoreSupport/WebChromeClient.h
index 96da752..57e98c5 100644
--- a/Source/WebKit2/WebProcess/WebCoreSupport/WebChromeClient.h
+++ b/Source/WebKit2/WebProcess/WebCoreSupport/WebChromeClient.h
@@ -113,7 +113,7 @@ private:
     virtual void invalidateContentsForSlowScroll(const WebCore::IntRect&, bool);
     virtual void scroll(const WebCore::IntSize& scrollOffset, const WebCore::IntRect& scrollRect, const WebCore::IntRect& clipRect);
 #if ENABLE(TILED_BACKING_STORE)
-    virtual void delegatedScrollRequested(const WebCore::IntSize& scrollOffset);
+    virtual void delegatedScrollRequested(const WebCore::IntPoint& scrollOffset);
 #endif
     virtual WebCore::IntPoint screenToWindow(const WebCore::IntPoint&) const;
     virtual WebCore::IntRect windowToScreen(const WebCore::IntRect&) const;
@@ -205,6 +205,13 @@ private:
     virtual void setLastSetCursorToCurrentCursor();
 #endif
 
+#if ENABLE(FULLSCREEN_API)
+    virtual bool supportsFullScreenForElement(const WebCore::Element*, bool withKeyboard);
+    virtual void enterFullScreenForElement(WebCore::Element*);
+    virtual void exitFullScreenForElement(WebCore::Element*);
+    virtual void setRootFullScreenLayer(WebCore::GraphicsLayer*);
+#endif
+
     virtual void dispatchViewportDataDidChange(const WebCore::ViewportArguments&) const;
 
     virtual void didCompleteRubberBandForMainFrame(const WebCore::IntSize&) const;
diff --git a/Source/WebKit2/WebProcess/WebCoreSupport/WebDatabaseManager.cpp b/Source/WebKit2/WebProcess/WebCoreSupport/WebDatabaseManager.cpp
index caa6eda..825a448 100644
--- a/Source/WebKit2/WebProcess/WebCoreSupport/WebDatabaseManager.cpp
+++ b/Source/WebKit2/WebProcess/WebCoreSupport/WebDatabaseManager.cpp
@@ -105,6 +105,7 @@ void WebDatabaseManager::getDatabasesByOrigin(uint64_t callbackID) const
     }
 
     WebProcess::shared().connection()->send(Messages::WebDatabaseManagerProxy::DidGetDatabasesByOrigin(originAndDatabasesVector, callbackID), 0);
+    WebProcess::shared().terminateIfPossible();
 }
 
 void WebDatabaseManager::getDatabaseOrigins(uint64_t callbackID) const
@@ -118,6 +119,7 @@ void WebDatabaseManager::getDatabaseOrigins(uint64_t callbackID) const
     for (size_t i = 0; i < numOrigins; ++i)
         identifiers[i] = origins[i]->databaseIdentifier();
     WebProcess::shared().connection()->send(Messages::WebDatabaseManagerProxy::DidGetDatabaseOrigins(identifiers, callbackID), 0);
+    WebProcess::shared().terminateIfPossible();
 }
 
 void WebDatabaseManager::deleteDatabaseWithNameForOrigin(const String& databaseIdentifier, const String& originIdentifier) const
@@ -127,6 +129,7 @@ void WebDatabaseManager::deleteDatabaseWithNameForOrigin(const String& databaseI
         return;
 
     DatabaseTracker::tracker().deleteDatabase(origin.get(), databaseIdentifier);
+    WebProcess::shared().terminateIfPossible();
 }
 
 void WebDatabaseManager::deleteDatabasesForOrigin(const String& originIdentifier) const
@@ -136,11 +139,13 @@ void WebDatabaseManager::deleteDatabasesForOrigin(const String& originIdentifier
         return;
 
     DatabaseTracker::tracker().deleteOrigin(origin.get());
+    WebProcess::shared().terminateIfPossible();
 }
 
 void WebDatabaseManager::deleteAllDatabases() const
 {
     DatabaseTracker::tracker().deleteAllDatabases();
+    WebProcess::shared().terminateIfPossible();
 }
 
 void WebDatabaseManager::setQuotaForOrigin(const String& originIdentifier, unsigned long long quota) const
@@ -154,6 +159,7 @@ void WebDatabaseManager::setQuotaForOrigin(const String& originIdentifier, unsig
         return;
 
     DatabaseTracker::tracker().setQuota(origin.get(), quota);
+    WebProcess::shared().terminateIfPossible();
 }
 
 void WebDatabaseManager::dispatchDidModifyOrigin(SecurityOrigin* origin)
diff --git a/Source/WebKit2/WebProcess/WebCoreSupport/WebEditorClient.h b/Source/WebKit2/WebProcess/WebCoreSupport/WebEditorClient.h
index fa8426a..9200af0 100644
--- a/Source/WebKit2/WebProcess/WebCoreSupport/WebEditorClient.h
+++ b/Source/WebKit2/WebProcess/WebCoreSupport/WebEditorClient.h
@@ -141,11 +141,11 @@ private:
     virtual void willSetInputMethodState();
     virtual void setInputMethodState(bool enabled);
     virtual void requestCheckingOfString(WebCore::SpellChecker*, int, const WTF::String&);
-#if PLATFORM(MAC) && !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD) && !defined(BUILDING_ON_SNOW_LEOPARD)
-    virtual void showCorrectionPanel(WebCore::CorrectionPanelInfo::PanelType, const WebCore::FloatRect& boundingBoxOfReplacedString, const String& replacedString, const String& replacementString, const Vector<String>& alternativeReplacementStrings, WebCore::Editor*);
+#if PLATFORM(MAC) && !defined(BUILDING_ON_SNOW_LEOPARD)
+    virtual void showCorrectionPanel(WebCore::CorrectionPanelInfo::PanelType, const WebCore::FloatRect& boundingBoxOfReplacedString, const String& replacedString, const String& replacementString, const Vector<String>& alternativeReplacementStrings);
     virtual void dismissCorrectionPanel(WebCore::ReasonForDismissingCorrectionPanel);
-    virtual bool isShowingCorrectionPanel();
-    virtual void recordAutocorrectionResponse(AutocorrectionResponseType, const WTF::String& replacedString, const WTF::String& replacementString);
+    virtual String dismissCorrectionPanelSoon(WebCore::ReasonForDismissingCorrectionPanel);
+    virtual void recordAutocorrectionResponse(AutocorrectionResponseType, const String& replacedString, const String& replacementString);
 #endif
     WebPage* m_page;
 };
diff --git a/Source/WebKit2/WebProcess/WebCoreSupport/WebFrameLoaderClient.cpp b/Source/WebKit2/WebProcess/WebCoreSupport/WebFrameLoaderClient.cpp
index 3770ca6..fa3cdce 100644
--- a/Source/WebKit2/WebProcess/WebCoreSupport/WebFrameLoaderClient.cpp
+++ b/Source/WebKit2/WebProcess/WebCoreSupport/WebFrameLoaderClient.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2010 Apple Inc. All rights reserved.
+ * Copyright (C) 2010, 2011 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -386,8 +386,10 @@ void WebFrameLoaderClient::dispatchDidStartProvisionalLoad()
     WebPage* webPage = m_frame->page();
     if (!webPage)
         return;
+
     webPage->findController().hideFindUI();
-    
+    webPage->sandboxExtensionTracker().didStartProvisionalLoad(m_frame);
+
     DocumentLoader* provisionalLoader = m_frame->coreFrame()->loader()->provisionalDocumentLoader();
     const String& url = provisionalLoader->url().string();
     RefPtr<APIObject> userData;
@@ -395,12 +397,10 @@ void WebFrameLoaderClient::dispatchDidStartProvisionalLoad()
     // Notify the bundle client.
     webPage->injectedBundleLoaderClient().didStartProvisionalLoadForFrame(webPage, m_frame, userData);
 
-    bool loadingSubstituteDataForUnreachableURL = !provisionalLoader->unreachableURL().isNull();
-
-    webPage->sandboxExtensionTracker().didStartProvisionalLoad(m_frame);
+    String unreachableURL = provisionalLoader->unreachableURL().string();
 
     // Notify the UIProcess.
-    webPage->send(Messages::WebPageProxy::DidStartProvisionalLoadForFrame(m_frame->frameID(), url, loadingSubstituteDataForUnreachableURL, InjectedBundleUserMessageEncoder(userData.get())));
+    webPage->send(Messages::WebPageProxy::DidStartProvisionalLoadForFrame(m_frame->frameID(), url, unreachableURL, InjectedBundleUserMessageEncoder(userData.get())));
 }
 
 void WebFrameLoaderClient::dispatchDidReceiveTitle(const String& title)
@@ -653,7 +653,7 @@ void WebFrameLoaderClient::dispatchDecidePolicyForNavigationAction(FramePolicyFu
         (m_frame->coreFrame()->loader()->policyChecker()->*function)(PolicyUse);
         return;
     }
-
+    
     uint64_t listenerID = m_frame->setUpPolicyListener(function);
     bool receivedPolicyAction;
     uint64_t policyAction;
@@ -1086,6 +1086,11 @@ void WebFrameLoaderClient::savePlatformDataToCachedFrame(CachedFrame*)
 
 void WebFrameLoaderClient::transitionToCommittedFromCachedFrame(CachedFrame*)
 {
+    WebPage* webPage = m_frame->page();
+    bool isMainFrame = webPage->mainFrame() == m_frame;
+    
+    const String& mimeType = m_frame->coreFrame()->loader()->documentLoader()->response().mimeType();
+    m_frameHasCustomRepresentation = isMainFrame && WebProcess::shared().shouldUseCustomRepresentationForMIMEType(mimeType);
 }
 
 void WebFrameLoaderClient::transitionToCommittedForNewPage()
@@ -1217,6 +1222,19 @@ PassRefPtr<Widget> WebFrameLoaderClient::createPlugin(const IntSize&, HTMLPlugIn
             parameters.names[i] = paramNames[i].lower();
     }
 
+#if PLUGIN_ARCHITECTURE(X11)
+    if (equalIgnoringCase(mimeType, "application/x-shockwave-flash")) {
+        // Currently we don't support transparency and windowed mode.
+        // Inject wmode=opaque to make Flash work in these conditions.
+        size_t wmodeIndex = parameters.names.find("wmode");
+        if (wmodeIndex == -1) {
+            parameters.names.append("wmode");
+            parameters.values.append("opaque");
+        } else if (equalIgnoringCase(parameters.values[wmodeIndex], "window"))
+            parameters.values[wmodeIndex] = "opaque";
+    }
+#endif
+
     RefPtr<Plugin> plugin = webPage->createPlugin(parameters);
     if (!plugin)
         return 0;
@@ -1237,27 +1255,58 @@ PassRefPtr<Widget> WebFrameLoaderClient::createJavaAppletWidget(const IntSize& p
     return createPlugin(pluginSize, appletElement, KURL(), paramNames, paramValues, "application/x-java-applet", false);
 }
 
-ObjectContentType WebFrameLoaderClient::objectContentType(const KURL& url, const String& mimeTypeIn)
+static bool pluginSupportsExtension(PluginData* pluginData, const String& extension)
+{
+    ASSERT(extension.lower() == extension);
+
+    for (size_t i = 0; i < pluginData->mimes().size(); ++i) {
+        const MimeClassInfo& mimeClassInfo = pluginData->mimes()[i];
+
+        if (mimeClassInfo.extensions.contains(extension))
+            return true;
+    }
+    return false;
+}
+
+ObjectContentType WebFrameLoaderClient::objectContentType(const KURL& url, const String& mimeTypeIn, bool shouldPreferPlugInsForImages)
 {
     // FIXME: This should be merged with WebCore::FrameLoader::defaultObjectContentType when the plugin code
     // is consolidated.
 
     String mimeType = mimeTypeIn;
-    if (mimeType.isEmpty())
-        mimeType = MIMETypeRegistry::getMIMETypeForExtension(url.path().substring(url.path().reverseFind('.') + 1));
+    if (mimeType.isEmpty()) {
+        String extension = url.path().substring(url.path().reverseFind('.') + 1).lower();
+
+        // Try to guess the MIME type from the extension.
+        mimeType = MIMETypeRegistry::getMIMETypeForExtension(extension);
+
+        if (mimeType.isEmpty()) {
+            // Check if there's a plug-in around that can handle the extension.
+            if (WebPage* webPage = m_frame->page()) {
+                if (PluginData* pluginData = webPage->corePage()->pluginData()) {
+                    if (pluginSupportsExtension(pluginData, extension))
+                        return ObjectContentNetscapePlugin;
+                }
+            }
+        }
+    }
 
     if (mimeType.isEmpty())
         return ObjectContentFrame;
 
-    if (MIMETypeRegistry::isSupportedImageMIMEType(mimeType))
-        return WebCore::ObjectContentImage;
-
+    bool plugInSupportsMIMEType = false;
     if (WebPage* webPage = m_frame->page()) {
         if (PluginData* pluginData = webPage->corePage()->pluginData()) {
             if (pluginData->supportsMimeType(mimeType))
-                return ObjectContentNetscapePlugin;
+                plugInSupportsMIMEType = true;
         }
     }
+    
+    if (MIMETypeRegistry::isSupportedImageMIMEType(mimeType))
+        return shouldPreferPlugInsForImages && plugInSupportsMIMEType ? ObjectContentNetscapePlugin : ObjectContentImage;
+
+    if (plugInSupportsMIMEType)
+        return ObjectContentNetscapePlugin;
 
     if (MIMETypeRegistry::isSupportedNonImageMIMEType(mimeType))
         return ObjectContentFrame;
diff --git a/Source/WebKit2/WebProcess/WebCoreSupport/WebFrameLoaderClient.h b/Source/WebKit2/WebProcess/WebCoreSupport/WebFrameLoaderClient.h
index 9ca9a75..1948541 100644
--- a/Source/WebKit2/WebProcess/WebCoreSupport/WebFrameLoaderClient.h
+++ b/Source/WebKit2/WebProcess/WebCoreSupport/WebFrameLoaderClient.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2010 Apple Inc. All rights reserved.
+ * Copyright (C) 2010, 2011 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -191,7 +191,7 @@ private:
     
     virtual PassRefPtr<WebCore::Widget> createJavaAppletWidget(const WebCore::IntSize&, WebCore::HTMLAppletElement*, const WebCore::KURL& baseURL, const Vector<String>& paramNames, const Vector<String>& paramValues);
     
-    virtual WebCore::ObjectContentType objectContentType(const WebCore::KURL& url, const String& mimeType);
+    virtual WebCore::ObjectContentType objectContentType(const WebCore::KURL&, const String& mimeType, bool shouldPreferPlugInsForImages);
     virtual String overrideMediaType() const;
 
     virtual void dispatchDidClearWindowObjectInWorld(WebCore::DOMWrapperWorld*);
diff --git a/Source/WebKit2/WebProcess/WebCoreSupport/WebPlatformStrategies.cpp b/Source/WebKit2/WebProcess/WebCoreSupport/WebPlatformStrategies.cpp
index 7e14701..9cb6bec 100644
--- a/Source/WebKit2/WebProcess/WebCoreSupport/WebPlatformStrategies.cpp
+++ b/Source/WebKit2/WebProcess/WebCoreSupport/WebPlatformStrategies.cpp
@@ -33,60 +33,16 @@
 #include "WebCookieManager.h"
 #include "WebCoreArgumentCoders.h"
 #include "WebProcess.h"
-#include <WebCore/LocalizedStrings.h>
-#include <WebCore/NotImplemented.h>
 #include <WebCore/Page.h>
-#include <WebCore/PageGroup.h>
-#include <wtf/MathExtras.h>
-#include <wtf/text/CString.h>
 
 #if USE(CF)
 #include <wtf/RetainPtr.h>
 #endif
 
-#if PLATFORM(MAC)
-
-#define UI_STRING(string, description) localizedString(string)
-#define UI_STRING_KEY(string, key, description) localizedString(key)
-
-#else
-
-#define UI_STRING(string, description) String::fromUTF8(string, strlen(string))
-#define UI_STRING_KEY(string, key, description) String::fromUTF8(string, strlen(string))
-
-#endif
-
 using namespace WebCore;
 
 namespace WebKit {
 
-// We can't use String::format for two reasons:
-//  1) It doesn't handle non-ASCII characters in the format string.
-//  2) It doesn't handle the %2$d syntax.
-// Note that because |format| is used as the second parameter to va_start, it cannot be a reference
-// type according to section 18.7/3 of the C++ N1905 standard.
-static String formatLocalizedString(String format, ...)
-{
-#if USE(CF)
-    va_list arguments;
-    va_start(arguments, format);
-    RetainPtr<CFStringRef> formatCFString(AdoptCF, format.createCFString());
-    RetainPtr<CFStringRef> result(AdoptCF, CFStringCreateWithFormatAndArguments(0, 0, formatCFString.get(), arguments));
-    va_end(arguments);
-    return result.get();
-#elif PLATFORM(QT)
-    va_list arguments;
-    va_start(arguments, format);
-    QString result;
-    result.vsprintf(format.latin1().data(), arguments);
-    va_end(arguments);
-    return result;
-#else
-    notImplemented();
-    return format;
-#endif
-}
-
 void WebPlatformStrategies::initialize()
 {
     DEFINE_STATIC_LOCAL(WebPlatformStrategies, platformStrategies, ());
@@ -109,11 +65,6 @@ PluginStrategy* WebPlatformStrategies::createPluginStrategy()
     return this;
 }
 
-LocalizationStrategy* WebPlatformStrategies::createLocalizationStrategy()
-{
-    return this;
-}
-
 VisitedLinkStrategy* WebPlatformStrategies::createVisitedLinkStrategy()
 {
     return this;
@@ -128,25 +79,6 @@ void WebPlatformStrategies::notifyCookiesChanged()
 
 // PluginStrategy
 
-void WebPlatformStrategies::populatePluginCache()
-{
-    if (m_pluginCacheIsPopulated)
-        return;
-
-    ASSERT(m_cachedPlugins.isEmpty());
-    
-    Vector<PluginInfo> plugins;
-    
-    // FIXME: Should we do something in case of error here?
-    WebProcess::shared().connection()->sendSync(Messages::WebContext::GetPlugins(m_shouldRefreshPlugins),
-                                                Messages::WebContext::GetPlugins::Reply(plugins), 0);
-
-    m_cachedPlugins.swap(plugins);
-    
-    m_shouldRefreshPlugins = false;
-    m_pluginCacheIsPopulated = true;
-}
-
 void WebPlatformStrategies::refreshPlugins()
 {
     m_cachedPlugins.clear();
@@ -162,777 +94,27 @@ void WebPlatformStrategies::getPluginInfo(const WebCore::Page*, Vector<WebCore::
     plugins = m_cachedPlugins;
 }
 
-// LocalizationStrategy    
-
-String WebPlatformStrategies::inputElementAltText()
-{
-    return UI_STRING_KEY("Submit", "Submit (input element)", "alt text for <input> elements with no alt, title, or value");
-}
-
-String WebPlatformStrategies::resetButtonDefaultLabel()
-{
-    return UI_STRING("Reset", "default label for Reset buttons in forms on web pages");
-}
-
-String WebPlatformStrategies::searchableIndexIntroduction()
-{
-    return UI_STRING("This is a searchable index. Enter search keywords: ",
-        "text that appears at the start of nearly-obsolete web pages in the form of a 'searchable index'");
-}
-
-String WebPlatformStrategies::submitButtonDefaultLabel()
-{
-    return UI_STRING("Submit", "default label for Submit buttons in forms on web pages");
-}
-
-String WebPlatformStrategies::fileButtonChooseFileLabel()
-{
-    return UI_STRING("Choose File", "title for file button used in HTML forms");
-}
-
-String WebPlatformStrategies::fileButtonNoFileSelectedLabel()
-{
-    return UI_STRING("no file selected", "text to display in file button used in HTML forms when no file is selected");
-}
-
-String WebPlatformStrategies::defaultDetailsSummaryText()
-{
-    return UI_STRING("Details", "text to display in <details> tag when it has no <summary> child");
-}
-
-#if PLATFORM(MAC)
-String WebPlatformStrategies::copyImageUnknownFileLabel()
-{
-    return UI_STRING("unknown", "Unknown filename");
-}
-#endif
-
-#if ENABLE(CONTEXT_MENUS)
-
-String WebPlatformStrategies::contextMenuItemTagOpenLinkInNewWindow()
-{
-    return UI_STRING("Open Link in New Window", "Open in New Window context menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagDownloadLinkToDisk()
-{
-    return UI_STRING("Download Linked File", "Download Linked File context menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagCopyLinkToClipboard()
-{
-    return UI_STRING("Copy Link", "Copy Link context menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagOpenImageInNewWindow()
-{
-    return UI_STRING("Open Image in New Window", "Open Image in New Window context menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagDownloadImageToDisk()
-{
-    return UI_STRING("Download Image", "Download Image context menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagCopyImageToClipboard()
-{
-    return UI_STRING("Copy Image", "Copy Image context menu item");
-}
-
-#if PLATFORM(QT)
-String WebPlatformStrategies::contextMenuItemTagCopyImageUrlToClipboard()
-{
-    return UI_STRING("Copy Image Address", "Copy Image Address menu item");
-}
-#endif
-
-String WebPlatformStrategies::contextMenuItemTagOpenVideoInNewWindow()
-{
-    return UI_STRING("Open Video in New Window", "Open Video in New Window context menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagOpenAudioInNewWindow()
-{
-    return UI_STRING("Open Audio in New Window", "Open Audio in New Window context menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagCopyVideoLinkToClipboard()
-{
-    return UI_STRING("Copy Video Address", "Copy Video Address Location context menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagCopyAudioLinkToClipboard()
-{
-    return UI_STRING("Copy Audio Address", "Copy Audio Address Location context menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagToggleMediaControls()
-{
-    return UI_STRING("Controls", "Media Controls context menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagToggleMediaLoop()
-{
-    return UI_STRING("Loop", "Media Loop context menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagEnterVideoFullscreen()
-{
-    return UI_STRING("Enter Fullscreen", "Video Enter Fullscreen context menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagMediaPlay()
-{
-    return UI_STRING("Play", "Media Play context menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagMediaPause()
-{
-    return UI_STRING("Pause", "Media Pause context menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagMediaMute()
-{
-    return UI_STRING("Mute", "Media Mute context menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagOpenFrameInNewWindow()
-{
-    return UI_STRING("Open Frame in New Window", "Open Frame in New Window context menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagCopy()
-{
-    return UI_STRING("Copy", "Copy context menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagGoBack()
-{
-    return UI_STRING("Back", "Back context menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagGoForward()
-{
-    return UI_STRING("Forward", "Forward context menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagStop()
-{
-    return UI_STRING("Stop", "Stop context menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagReload()
-{
-    return UI_STRING("Reload", "Reload context menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagCut()
-{
-    return UI_STRING("Cut", "Cut context menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagPaste()
-{
-    return UI_STRING("Paste", "Paste context menu item");
-}
-
-#if PLATFORM(GTK)
-
-String WebPlatformStrategies::contextMenuItemTagDelete()
-{
-    notImplemented();
-    return "Delete";
-}
-
-String WebPlatformStrategies::contextMenuItemTagInputMethods()
-{
-    notImplemented();
-    return "Input Methods";
-}
-
-String WebPlatformStrategies::contextMenuItemTagUnicode()
-{
-    notImplemented();
-    return "Unicode";
-}
-
-#endif
-
-#if PLATFORM(GTK) || PLATFORM(QT)
-
-String WebPlatformStrategies::contextMenuItemTagSelectAll()
-{
-    notImplemented();
-    return "Select All";
-}
-
-#endif
-
-String WebPlatformStrategies::contextMenuItemTagNoGuessesFound()
-{
-    return UI_STRING("No Guesses Found", "No Guesses Found context menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagIgnoreSpelling()
-{
-    return UI_STRING("Ignore Spelling", "Ignore Spelling context menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagLearnSpelling()
-{
-    return UI_STRING("Learn Spelling", "Learn Spelling context menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagSearchWeb()
-{
-    return UI_STRING("Search in Google", "Search in Google context menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagLookUpInDictionary()
-{
-    return UI_STRING("Look Up in Dictionary", "Look Up in Dictionary context menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagOpenLink()
-{
-    return UI_STRING("Open Link", "Open Link context menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagIgnoreGrammar()
-{
-    return UI_STRING("Ignore Grammar", "Ignore Grammar context menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagSpellingMenu()
-{
-    return UI_STRING("Spelling and Grammar", "Spelling and Grammar context sub-menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagShowSpellingPanel(bool show)
-{
-    if (show)
-        return UI_STRING("Show Spelling and Grammar", "menu item title");
-    return UI_STRING("Hide Spelling and Grammar", "menu item title");
-}
-
-String WebPlatformStrategies::contextMenuItemTagCheckSpelling()
-{
-    return UI_STRING("Check Document Now", "Check spelling context menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagCheckSpellingWhileTyping()
-{
-    return UI_STRING("Check Spelling While Typing", "Check spelling while typing context menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagCheckGrammarWithSpelling()
-{
-    return UI_STRING("Check Grammar With Spelling", "Check grammar with spelling context menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagFontMenu()
-{
-    return UI_STRING("Font", "Font context sub-menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagBold()
-{
-    return UI_STRING("Bold", "Bold context menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagItalic()
-{
-    return UI_STRING("Italic", "Italic context menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagUnderline()
-{
-    return UI_STRING("Underline", "Underline context menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagOutline()
-{
-    return UI_STRING("Outline", "Outline context menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagWritingDirectionMenu()
-{
-    return UI_STRING("Paragraph Direction", "Paragraph direction context sub-menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagTextDirectionMenu()
-{
-    return UI_STRING("Selection Direction", "Selection direction context sub-menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagDefaultDirection()
-{
-    return UI_STRING("Default", "Default writing direction context menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagLeftToRight()
-{
-    return UI_STRING("Left to Right", "Left to Right context menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagRightToLeft()
-{
-    return UI_STRING("Right to Left", "Right to Left context menu item");
-}
-
-#if PLATFORM(MAC)
-
-String WebPlatformStrategies::contextMenuItemTagSearchInSpotlight()
-{
-    return UI_STRING("Search in Spotlight", "Search in Spotlight context menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagShowFonts()
-{
-    return UI_STRING("Show Fonts", "Show fonts context menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagStyles()
-{
-    return UI_STRING("Styles...", "Styles context menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagShowColors()
-{
-    return UI_STRING("Show Colors", "Show colors context menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagSpeechMenu()
-{
-    return UI_STRING("Speech", "Speech context sub-menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagStartSpeaking()
-{
-    return UI_STRING("Start Speaking", "Start speaking context menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagStopSpeaking()
-{
-    return UI_STRING("Stop Speaking", "Stop speaking context menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagCorrectSpellingAutomatically()
-{
-    return UI_STRING("Correct Spelling Automatically", "Correct Spelling Automatically context menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagSubstitutionsMenu()
-{
-    return UI_STRING("Substitutions", "Substitutions context sub-menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagShowSubstitutions(bool show)
-{
-    if (show) 
-        return UI_STRING("Show Substitutions", "menu item title");
-    return UI_STRING("Hide Substitutions", "menu item title");
-}
-
-String WebPlatformStrategies::contextMenuItemTagSmartCopyPaste()
-{
-    return UI_STRING("Smart Copy/Paste", "Smart Copy/Paste context menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagSmartQuotes()
-{
-    return UI_STRING("Smart Quotes", "Smart Quotes context menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagSmartDashes()
-{
-    return UI_STRING("Smart Dashes", "Smart Dashes context menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagSmartLinks()
-{
-    return UI_STRING("Smart Links", "Smart Links context menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagTextReplacement()
-{
-    return UI_STRING("Text Replacement", "Text Replacement context menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagTransformationsMenu()
-{
-    return UI_STRING("Transformations", "Transformations context sub-menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagMakeUpperCase()
-{
-    return UI_STRING("Make Upper Case", "Make Upper Case context menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagMakeLowerCase()
-{
-    return UI_STRING("Make Lower Case", "Make Lower Case context menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagCapitalize()
-{
-    return UI_STRING("Capitalize", "Capitalize context menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagChangeBack(const String& replacedString)
-{
-    notImplemented();
-    return replacedString;
-}
-
-#endif
-
-String WebPlatformStrategies::contextMenuItemTagInspectElement()
-{
-    return UI_STRING("Inspect Element", "Inspect Element context menu item");
-}
-
-#endif // ENABLE(CONTEXT_MENUS)
-
-String WebPlatformStrategies::searchMenuNoRecentSearchesText()
-{
-    return UI_STRING("No recent searches", "Label for only item in menu that appears when clicking on the search field image, when no searches have been performed");
-}
-
-String WebPlatformStrategies::searchMenuRecentSearchesText()
-{
-    return UI_STRING("Recent Searches", "label for first item in the menu that appears when clicking on the search field image, used as embedded menu title");
-}
-
-String WebPlatformStrategies::searchMenuClearRecentSearchesText()
-{
-    return UI_STRING("Clear Recent Searches", "menu item in Recent Searches menu that empties menu's contents");
-}
-
-String WebPlatformStrategies::AXWebAreaText()
-{
-    return UI_STRING("HTML content", "accessibility role description for web area");
-}
-
-String WebPlatformStrategies::AXLinkText()
-{
-    return UI_STRING("link", "accessibility role description for link");
-}
-
-String WebPlatformStrategies::AXListMarkerText()
-{
-    return UI_STRING("list marker", "accessibility role description for list marker");
-}
-
-String WebPlatformStrategies::AXImageMapText()
-{
-    return UI_STRING("image map", "accessibility role description for image map");
-}
-
-String WebPlatformStrategies::AXHeadingText()
-{
-    return UI_STRING("heading", "accessibility role description for headings");
-}
-
-String WebPlatformStrategies::AXDefinitionListTermText()
-{
-    return UI_STRING("term", "term word of a definition");
-}
-
-String WebPlatformStrategies::AXDefinitionListDefinitionText()
-{
-    return UI_STRING("definition", "definition phrase");
-}
-
-#if PLATFORM(MAC)
-String WebPlatformStrategies::AXARIAContentGroupText(const String& ariaType)
-{
-    if (ariaType == "ARIAApplicationAlert")
-        return UI_STRING("alert", "An ARIA accessibility group that acts as an alert.");
-    if (ariaType == "ARIAApplicationAlertDialog")
-        return UI_STRING("alert dialog", "An ARIA accessibility group that acts as an alert dialog.");
-    if (ariaType == "ARIAApplicationDialog")
-        return UI_STRING("dialog", "An ARIA accessibility group that acts as an dialog.");
-    if (ariaType == "ARIAApplicationLog")
-        return UI_STRING("log", "An ARIA accessibility group that acts as a console log.");
-    if (ariaType == "ARIAApplicationMarquee")
-        return UI_STRING("marquee", "An ARIA accessibility group that acts as a marquee.");    
-    if (ariaType == "ARIAApplicationStatus")
-        return UI_STRING("application status", "An ARIA accessibility group that acts as a status update.");    
-    if (ariaType == "ARIAApplicationTimer")
-        return UI_STRING("timer", "An ARIA accessibility group that acts as an updating timer.");    
-    if (ariaType == "ARIADocument")
-        return UI_STRING("document", "An ARIA accessibility group that acts as a document.");    
-    if (ariaType == "ARIADocumentArticle")
-        return UI_STRING("article", "An ARIA accessibility group that acts as an article.");    
-    if (ariaType == "ARIADocumentNote")
-        return UI_STRING("note", "An ARIA accessibility group that acts as a note in a document.");    
-    if (ariaType == "ARIADocumentRegion")
-        return UI_STRING("region", "An ARIA accessibility group that acts as a distinct region in a document.");    
-    if (ariaType == "ARIALandmarkApplication")
-        return UI_STRING("application", "An ARIA accessibility group that acts as an application.");    
-    if (ariaType == "ARIALandmarkBanner")
-        return UI_STRING("banner", "An ARIA accessibility group that acts as a banner.");    
-    if (ariaType == "ARIALandmarkComplementary")
-        return UI_STRING("complementary", "An ARIA accessibility group that acts as a region of complementary information.");    
-    if (ariaType == "ARIALandmarkContentInfo")
-        return UI_STRING("content", "An ARIA accessibility group that contains content.");    
-    if (ariaType == "ARIALandmarkMain")
-        return UI_STRING("main", "An ARIA accessibility group that is the main portion of the website.");    
-    if (ariaType == "ARIALandmarkNavigation")
-        return UI_STRING("navigation", "An ARIA accessibility group that contains the main navigation elements of a website.");    
-    if (ariaType == "ARIALandmarkSearch")
-        return UI_STRING("search", "An ARIA accessibility group that contains a search feature of a website.");    
-    if (ariaType == "ARIAUserInterfaceTooltip")
-        return UI_STRING("tooltip", "An ARIA accessibility group that acts as a tooltip.");    
-    if (ariaType == "ARIATabPanel")
-        return UI_STRING("tab panel", "An ARIA accessibility group that contains the content of a tab.");
-    if (ariaType == "ARIADocumentMath")
-        return UI_STRING("math", "An ARIA accessibility group that contains mathematical symbols.");
-    return String();
-}
-#endif
-
-String WebPlatformStrategies::AXButtonActionVerb()
-{
-    return UI_STRING("press", "Verb stating the action that will occur when a button is pressed, as used by accessibility");
-}
-
-String WebPlatformStrategies::AXRadioButtonActionVerb() 
-{
-    return UI_STRING("select", "Verb stating the action that will occur when a radio button is clicked, as used by accessibility");
-}
-
-String WebPlatformStrategies::AXTextFieldActionVerb()
-{
-    return UI_STRING("activate", "Verb stating the action that will occur when a text field is selected, as used by accessibility");
-}
-
-String WebPlatformStrategies::AXCheckedCheckBoxActionVerb()
-{
-    return UI_STRING("uncheck", "Verb stating the action that will occur when a checked checkbox is clicked, as used by accessibility");
-}
-
-String WebPlatformStrategies::AXUncheckedCheckBoxActionVerb()
-{
-    return UI_STRING("check", "Verb stating the action that will occur when an unchecked checkbox is clicked, as used by accessibility");
-}
-
-String WebPlatformStrategies::AXMenuListActionVerb()
-{
-    notImplemented();
-    return "select";
-}
-
-String WebPlatformStrategies::AXMenuListPopupActionVerb()
-{
-    notImplemented();
-    return "select";
-}
-
-String WebPlatformStrategies::AXLinkActionVerb()
-{
-    return UI_STRING("jump", "Verb stating the action that will occur when a link is clicked, as used by accessibility");
-}
-
-String WebPlatformStrategies::missingPluginText()
-{
-    return UI_STRING("Missing Plug-in", "Label text to be used when a plugin is missing");
-}
-
-String WebPlatformStrategies::crashedPluginText()
-{
-    return UI_STRING("Plug-in Failure", "Label text to be used if plugin host process has crashed");
-}
-
-String WebPlatformStrategies::multipleFileUploadText(unsigned numberOfFiles)
-{
-    return formatLocalizedString(UI_STRING("%d files", "Label to describe the number of files selected in a file upload control that allows multiple files"), numberOfFiles);
-}
-
-String WebPlatformStrategies::unknownFileSizeText()
-{
-    return UI_STRING("Unknown", "Unknown filesize FTP directory listing item");
-}
-
-#if PLATFORM(WIN)
-
-String WebPlatformStrategies::uploadFileText()
-{
-    notImplemented();
-    return "upload";
-}
-
-String WebPlatformStrategies::allFilesText()
-{
-    notImplemented();
-    return "all files";
-}
-
-#endif
-
-String WebPlatformStrategies::imageTitle(const String& filename, const IntSize& size)
-{
-    // FIXME: This should format the numbers correctly. In Mac WebKit, we used +[NSNumberFormatter localizedStringFromNumber:numberStyle:].
-    return formatLocalizedString(UI_STRING("<filename> %d×%d pixels", "window title suffix for a standalone image (uses multiplication symbol, not x)"), size.width(), size.height()).replace("<filename>", filename);
-}
-
-String WebPlatformStrategies::mediaElementLoadingStateText()
-{
-    return UI_STRING("Loading...", "Media controller status message when the media is loading");
-}
-
-String WebPlatformStrategies::mediaElementLiveBroadcastStateText()
-{
-    return UI_STRING("Live Broadcast", "Media controller status message when watching a live broadcast");
-}
-
-String WebPlatformStrategies::localizedMediaControlElementString(const String& name)
-{
-    if (name == "AudioElement")
-        return UI_STRING("audio element controller", "accessibility role description for audio element controller");
-    if (name == "VideoElement")
-        return UI_STRING("video element controller", "accessibility role description for video element controller");
-    if (name == "MuteButton")
-        return UI_STRING("mute", "accessibility role description for mute button");
-    if (name == "UnMuteButton")
-        return UI_STRING("unmute", "accessibility role description for turn mute off button");
-    if (name == "PlayButton")
-        return UI_STRING("play", "accessibility role description for play button");
-    if (name == "PauseButton")
-        return UI_STRING("pause", "accessibility role description for pause button");
-    if (name == "Slider")
-        return UI_STRING("movie time", "accessibility role description for timeline slider");
-    if (name == "SliderThumb")
-        return UI_STRING("timeline slider thumb", "accessibility role description for timeline thumb");
-    if (name == "RewindButton")
-        return UI_STRING("back 30 seconds", "accessibility role description for seek back 30 seconds button");
-    if (name == "ReturnToRealtimeButton")
-        return UI_STRING("return to realtime", "accessibility role description for return to real time button");
-    if (name == "CurrentTimeDisplay")
-        return UI_STRING("elapsed time", "accessibility role description for elapsed time display");
-    if (name == "TimeRemainingDisplay")
-        return UI_STRING("remaining time", "accessibility role description for time remaining display");
-    if (name == "StatusDisplay")
-        return UI_STRING("status", "accessibility role description for movie status");
-    if (name == "FullscreenButton")
-        return UI_STRING("fullscreen", "accessibility role description for enter fullscreen button");
-    if (name == "SeekForwardButton")
-        return UI_STRING("fast forward", "accessibility role description for fast forward button");
-    if (name == "SeekBackButton")
-        return UI_STRING("fast reverse", "accessibility role description for fast reverse button");
-    if (name == "ShowClosedCaptionsButton")
-        return UI_STRING("show closed captions", "accessibility role description for show closed captions button");
-    if (name == "HideClosedCaptionsButton")
-        return UI_STRING("hide closed captions", "accessibility role description for hide closed captions button");
-
-    // FIXME: the ControlsPanel container should never be visible in the accessibility hierarchy.
-    if (name == "ControlsPanel")
-        return String();
-
-    ASSERT_NOT_REACHED();
-    return String();
-}
-
-String WebPlatformStrategies::localizedMediaControlElementHelpText(const String& name)
-{
-    if (name == "AudioElement")
-        return UI_STRING("audio element playback controls and status display", "accessibility role description for audio element controller");
-    if (name == "VideoElement")
-        return UI_STRING("video element playback controls and status display", "accessibility role description for video element controller");
-    if (name == "MuteButton")
-        return UI_STRING("mute audio tracks", "accessibility help text for mute button");
-    if (name == "UnMuteButton")
-        return UI_STRING("unmute audio tracks", "accessibility help text for un mute button");
-    if (name == "PlayButton")
-        return UI_STRING("begin playback", "accessibility help text for play button");
-    if (name == "PauseButton")
-        return UI_STRING("pause playback", "accessibility help text for pause button");
-    if (name == "Slider")
-        return UI_STRING("movie time scrubber", "accessibility help text for timeline slider");
-    if (name == "SliderThumb")
-        return UI_STRING("movie time scrubber thumb", "accessibility help text for timeline slider thumb");
-    if (name == "RewindButton")
-        return UI_STRING("seek movie back 30 seconds", "accessibility help text for jump back 30 seconds button");
-    if (name == "ReturnToRealtimeButton")
-        return UI_STRING("return streaming movie to real time", "accessibility help text for return streaming movie to real time button");
-    if (name == "CurrentTimeDisplay")
-        return UI_STRING("current movie time in seconds", "accessibility help text for elapsed time display");
-    if (name == "TimeRemainingDisplay")
-        return UI_STRING("number of seconds of movie remaining", "accessibility help text for remaining time display");
-    if (name == "StatusDisplay")
-        return UI_STRING("current movie status", "accessibility help text for movie status display");
-    if (name == "SeekBackButton")
-        return UI_STRING("seek quickly back", "accessibility help text for fast rewind button");
-    if (name == "SeekForwardButton")
-        return UI_STRING("seek quickly forward", "accessibility help text for fast forward button");
-    if (name == "FullscreenButton")
-        return UI_STRING("Play movie in fullscreen mode", "accessibility help text for enter fullscreen button");
-    if (name == "ShowClosedCaptionsButton")
-        return UI_STRING("start displaying closed captions", "accessibility help text for show closed captions button");
-    if (name == "HideClosedCaptionsButton")
-        return UI_STRING("stop displaying closed captions", "accessibility help text for hide closed captions button");
-
-    ASSERT_NOT_REACHED();
-    return String();
-}
-
-String WebPlatformStrategies::localizedMediaTimeDescription(float time)
-{
-    if (!isfinite(time))
-        return UI_STRING("indefinite time", "accessibility help text for an indefinite media controller time value");
-
-    int seconds = static_cast<int>(fabsf(time)); 
-    int days = seconds / (60 * 60 * 24);
-    int hours = seconds / (60 * 60);
-    int minutes = (seconds / 60) % 60;
-    seconds %= 60;
-
-    if (days)
-        return formatLocalizedString(UI_STRING("%1$d days %2$d hours %3$d minutes %4$d seconds", "accessibility help text for media controller time value >= 1 day"), days, hours, minutes, seconds);
-    if (hours)
-        return formatLocalizedString(UI_STRING("%1$d hours %2$d minutes %3$d seconds", "accessibility help text for media controller time value >= 60 minutes"), hours, minutes, seconds);
-    if (minutes)
-        return formatLocalizedString(UI_STRING("%1$d minutes %2$d seconds", "accessibility help text for media controller time value >= 60 seconds"), minutes, seconds);
-    return formatLocalizedString(UI_STRING("%1$d seconds", "accessibility help text for media controller time value < 60 seconds"), seconds);
-}
-
-String WebPlatformStrategies::validationMessageValueMissingText()
-{
-    return UI_STRING("value missing", "Validation message for required form control elements that have no value");
-}
-
-String WebPlatformStrategies::validationMessageTypeMismatchText()
-{
-    return UI_STRING("type mismatch", "Validation message for input form controls with a value not matching type");
-}
-
-String WebPlatformStrategies::validationMessagePatternMismatchText()
-{
-    return UI_STRING("pattern mismatch", "Validation message for input form controls requiring a constrained value according to pattern");
-}
-
-String WebPlatformStrategies::validationMessageTooLongText()
-{
-    return UI_STRING("too long", "Validation message for form control elements with a value longer than maximum allowed length");
-}
-
-String WebPlatformStrategies::validationMessageRangeUnderflowText()
+void WebPlatformStrategies::populatePluginCache()
 {
-    return UI_STRING("range underflow", "Validation message for input form controls with value lower than allowed minimum");
-}
+    if (m_pluginCacheIsPopulated)
+        return;
 
-String WebPlatformStrategies::validationMessageRangeOverflowText()
-{
-    return UI_STRING("range overflow", "Validation message for input form controls with value higher than allowed maximum");
-}
+    ASSERT(m_cachedPlugins.isEmpty());
+    
+    Vector<PluginInfo> plugins;
+    
+    // FIXME: Should we do something in case of error here?
+    WebProcess::shared().connection()->sendSync(Messages::WebContext::GetPlugins(m_shouldRefreshPlugins),
+                                                Messages::WebContext::GetPlugins::Reply(plugins), 0);
 
-String WebPlatformStrategies::validationMessageStepMismatchText()
-{
-    return UI_STRING("step mismatch", "Validation message for input form controls with value not respecting the step attribute");
+    m_cachedPlugins.swap(plugins);
+    
+    m_shouldRefreshPlugins = false;
+    m_pluginCacheIsPopulated = true;
 }
 
 // VisitedLinkStrategy
+
 bool WebPlatformStrategies::isLinkVisited(Page* page, LinkHash linkHash)
 {
     return WebProcess::shared().isLinkVisited(linkHash);
diff --git a/Source/WebKit2/WebProcess/WebCoreSupport/WebPlatformStrategies.h b/Source/WebKit2/WebProcess/WebCoreSupport/WebPlatformStrategies.h
index 92f8236..55285de 100644
--- a/Source/WebKit2/WebProcess/WebCoreSupport/WebPlatformStrategies.h
+++ b/Source/WebKit2/WebProcess/WebCoreSupport/WebPlatformStrategies.h
@@ -31,12 +31,11 @@
 #include <WebCore/CookiesStrategy.h>
 #include <WebCore/PlatformStrategies.h>
 #include <WebCore/PluginStrategy.h>
-#include <WebCore/LocalizationStrategy.h>
 #include <WebCore/VisitedLinkStrategy.h>
 
 namespace WebKit {
 
-class WebPlatformStrategies : public WebCore::PlatformStrategies, private WebCore::CookiesStrategy, private WebCore::PluginStrategy, private WebCore::LocalizationStrategy, private WebCore::VisitedLinkStrategy {
+class WebPlatformStrategies : public WebCore::PlatformStrategies, private WebCore::CookiesStrategy, private WebCore::PluginStrategy, private WebCore::VisitedLinkStrategy {
 public:
     static void initialize();
     
@@ -46,7 +45,6 @@ private:
     // WebCore::PlatformStrategies
     virtual WebCore::CookiesStrategy* createCookiesStrategy();
     virtual WebCore::PluginStrategy* createPluginStrategy();
-    virtual WebCore::LocalizationStrategy* createLocalizationStrategy();
     virtual WebCore::VisitedLinkStrategy* createVisitedLinkStrategy();
 
     // WebCore::CookiesStrategy
@@ -55,152 +53,15 @@ private:
     // WebCore::PluginStrategy
     virtual void refreshPlugins();
     virtual void getPluginInfo(const WebCore::Page*, Vector<WebCore::PluginInfo>&);
-
-    // WebCore::LocalizationStrategy    
-    virtual String inputElementAltText();
-    virtual String resetButtonDefaultLabel();
-    virtual String searchableIndexIntroduction();
-    virtual String submitButtonDefaultLabel();
-    virtual String fileButtonChooseFileLabel();
-    virtual String fileButtonNoFileSelectedLabel();
-    virtual String defaultDetailsSummaryText();
-#if PLATFORM(MAC)
-    virtual String copyImageUnknownFileLabel();
-#endif
-#if ENABLE(CONTEXT_MENUS)
-    virtual String contextMenuItemTagOpenLinkInNewWindow();
-    virtual String contextMenuItemTagDownloadLinkToDisk();
-    virtual String contextMenuItemTagCopyLinkToClipboard();
-    virtual String contextMenuItemTagOpenImageInNewWindow();
-    virtual String contextMenuItemTagDownloadImageToDisk();
-    virtual String contextMenuItemTagCopyImageToClipboard();
-#if PLATFORM(QT)
-    virtual String contextMenuItemTagCopyImageUrlToClipboard();
-#endif
-    virtual String contextMenuItemTagOpenFrameInNewWindow();
-    virtual String contextMenuItemTagCopy();
-    virtual String contextMenuItemTagGoBack();
-    virtual String contextMenuItemTagGoForward();
-    virtual String contextMenuItemTagStop();
-    virtual String contextMenuItemTagReload();
-    virtual String contextMenuItemTagCut();
-    virtual String contextMenuItemTagPaste();
-#if PLATFORM(GTK)
-    virtual String contextMenuItemTagDelete();
-    virtual String contextMenuItemTagInputMethods();
-    virtual String contextMenuItemTagUnicode();
-#endif
-#if PLATFORM(GTK) || PLATFORM(QT)
-    virtual String contextMenuItemTagSelectAll();
-#endif
-    virtual String contextMenuItemTagNoGuessesFound();
-    virtual String contextMenuItemTagIgnoreSpelling();
-    virtual String contextMenuItemTagLearnSpelling();
-    virtual String contextMenuItemTagSearchWeb();
-    virtual String contextMenuItemTagLookUpInDictionary();
-    virtual String contextMenuItemTagOpenLink();
-    virtual String contextMenuItemTagIgnoreGrammar();
-    virtual String contextMenuItemTagSpellingMenu();
-    virtual String contextMenuItemTagShowSpellingPanel(bool show);
-    virtual String contextMenuItemTagCheckSpelling();
-    virtual String contextMenuItemTagCheckSpellingWhileTyping();
-    virtual String contextMenuItemTagCheckGrammarWithSpelling();
-    virtual String contextMenuItemTagFontMenu();
-    virtual String contextMenuItemTagBold();
-    virtual String contextMenuItemTagItalic();
-    virtual String contextMenuItemTagUnderline();
-    virtual String contextMenuItemTagOutline();
-    virtual String contextMenuItemTagWritingDirectionMenu();
-    virtual String contextMenuItemTagTextDirectionMenu();
-    virtual String contextMenuItemTagDefaultDirection();
-    virtual String contextMenuItemTagLeftToRight();
-    virtual String contextMenuItemTagRightToLeft();
-#if PLATFORM(MAC)
-    virtual String contextMenuItemTagSearchInSpotlight();
-    virtual String contextMenuItemTagShowFonts();
-    virtual String contextMenuItemTagStyles();
-    virtual String contextMenuItemTagShowColors();
-    virtual String contextMenuItemTagSpeechMenu();
-    virtual String contextMenuItemTagStartSpeaking();
-    virtual String contextMenuItemTagStopSpeaking();
-    virtual String contextMenuItemTagCorrectSpellingAutomatically();
-    virtual String contextMenuItemTagSubstitutionsMenu();
-    virtual String contextMenuItemTagShowSubstitutions(bool show);
-    virtual String contextMenuItemTagSmartCopyPaste();
-    virtual String contextMenuItemTagSmartQuotes();
-    virtual String contextMenuItemTagSmartDashes();
-    virtual String contextMenuItemTagSmartLinks();
-    virtual String contextMenuItemTagTextReplacement();
-    virtual String contextMenuItemTagTransformationsMenu();
-    virtual String contextMenuItemTagMakeUpperCase();
-    virtual String contextMenuItemTagMakeLowerCase();
-    virtual String contextMenuItemTagCapitalize();
-    virtual String contextMenuItemTagChangeBack(const String& replacedString);
-#endif
-    virtual String contextMenuItemTagInspectElement();
-    virtual String contextMenuItemTagOpenVideoInNewWindow();
-    virtual String contextMenuItemTagOpenAudioInNewWindow();
-    virtual String contextMenuItemTagCopyVideoLinkToClipboard();
-    virtual String contextMenuItemTagCopyAudioLinkToClipboard();
-    virtual String contextMenuItemTagToggleMediaControls();
-    virtual String contextMenuItemTagToggleMediaLoop();
-    virtual String contextMenuItemTagEnterVideoFullscreen();
-    virtual String contextMenuItemTagMediaPlay();
-    virtual String contextMenuItemTagMediaPause();
-    virtual String contextMenuItemTagMediaMute();
-#endif // ENABLE(CONTEXT_MENUS)
-    virtual String searchMenuNoRecentSearchesText();
-    virtual String searchMenuRecentSearchesText();
-    virtual String searchMenuClearRecentSearchesText();
-    virtual String AXWebAreaText();
-    virtual String AXLinkText();
-    virtual String AXListMarkerText();
-    virtual String AXImageMapText();
-    virtual String AXHeadingText();
-    virtual String AXDefinitionListTermText();
-    virtual String AXDefinitionListDefinitionText();
-#if PLATFORM(MAC)
-    virtual String AXARIAContentGroupText(const String& ariaType);
-#endif
-    virtual String AXButtonActionVerb();
-    virtual String AXRadioButtonActionVerb();
-    virtual String AXTextFieldActionVerb();
-    virtual String AXCheckedCheckBoxActionVerb();
-    virtual String AXUncheckedCheckBoxActionVerb();
-    virtual String AXMenuListActionVerb();
-    virtual String AXMenuListPopupActionVerb();
-    virtual String AXLinkActionVerb();
-    virtual String missingPluginText();
-    virtual String crashedPluginText();
-    virtual String multipleFileUploadText(unsigned numberOfFiles);
-    virtual String unknownFileSizeText();
-#if PLATFORM(WIN)
-    virtual String uploadFileText();
-    virtual String allFilesText();
-#endif
-    virtual String imageTitle(const String& filename, const WebCore::IntSize& size);
-    virtual String mediaElementLoadingStateText();
-    virtual String mediaElementLiveBroadcastStateText();
-    virtual String localizedMediaControlElementString(const String&);
-    virtual String localizedMediaControlElementHelpText(const String&);
-    virtual String localizedMediaTimeDescription(float);
-    virtual String validationMessageValueMissingText();
-    virtual String validationMessageTypeMismatchText();
-    virtual String validationMessagePatternMismatchText();
-    virtual String validationMessageTooLongText();
-    virtual String validationMessageRangeUnderflowText();
-    virtual String validationMessageRangeOverflowText();
-    virtual String validationMessageStepMismatchText();
-
     void populatePluginCache();
 
-    bool m_pluginCacheIsPopulated;
-    bool m_shouldRefreshPlugins;
-    Vector<WebCore::PluginInfo> m_cachedPlugins;
-
     // WebCore::VisitedLinkStrategy
     virtual bool isLinkVisited(WebCore::Page*, WebCore::LinkHash);
     virtual void addVisitedLink(WebCore::Page*, WebCore::LinkHash);
+
+    bool m_pluginCacheIsPopulated;
+    bool m_shouldRefreshPlugins;
+    Vector<WebCore::PluginInfo> m_cachedPlugins;
 };
 
 } // namespace WebKit
diff --git a/Source/WebKit2/WebProcess/WebCoreSupport/mac/WebContextMenuClientMac.mm b/Source/WebKit2/WebProcess/WebCoreSupport/mac/WebContextMenuClientMac.mm
index 7d91c56..6aa83f8 100644
--- a/Source/WebKit2/WebProcess/WebCoreSupport/mac/WebContextMenuClientMac.mm
+++ b/Source/WebKit2/WebProcess/WebCoreSupport/mac/WebContextMenuClientMac.mm
@@ -41,11 +41,7 @@ namespace WebKit {
 
 void WebContextMenuClient::lookUpInDictionary(Frame* frame)
 {
-    RefPtr<Range> selectedRange = frame->selection()->selection().toNormalizedRange();
-    if (!selectedRange)
-        return;
-
-    m_page->performDictionaryLookupForRange(DictionaryPopupInfo::ContextMenu, frame, selectedRange.get());
+    m_page->performDictionaryLookupForSelection(DictionaryPopupInfo::ContextMenu, frame, frame->selection()->selection());
 }
 
 bool WebContextMenuClient::isSpeaking()
diff --git a/Source/WebKit2/WebProcess/WebCoreSupport/mac/WebDragClientMac.mm b/Source/WebKit2/WebProcess/WebCoreSupport/mac/WebDragClientMac.mm
index ae9cec3..75d92e2 100644
--- a/Source/WebKit2/WebProcess/WebCoreSupport/mac/WebDragClientMac.mm
+++ b/Source/WebKit2/WebProcess/WebCoreSupport/mac/WebDragClientMac.mm
@@ -32,134 +32,273 @@
 #import "WebPage.h"
 #import "WebPageProxyMessages.h"
 #import <WebCore/CachedImage.h>
-#import <WebCore/DOMPrivate.h>
 #import <WebCore/DOMElementInternal.h>
+#import <WebCore/DOMPrivate.h>
+#import <WebCore/DragController.h>
 #import <WebCore/FrameView.h>
 #import <WebCore/GraphicsContext.h>
 #import <WebCore/LegacyWebArchive.h>
 #import <WebCore/RenderImage.h>
+#import <WebCore/ResourceHandle.h>
 #import <WebCore/StringTruncator.h>
-#import <wtf/StdLibExtras.h>
+#import <WebKit/WebArchive.h>
 #import <WebKit/WebKitNSStringExtras.h>
+#import <WebKit/WebNSFileManagerExtras.h>
+#import <WebKit/WebNSPasteboardExtras.h>
 #import <WebKit/WebNSURLExtras.h>
+#import <WebKitSystemInterface.h>
+#import <wtf/StdLibExtras.h>
 
 using namespace WebCore;
+using namespace WebKit;
+
+// Internal AppKit class. If the pasteboard handling was in the same process
+// that called the dragImage method, this would be created automatically.
+// Create it explicitly because dragImage is called in the UI process.
+@interface NSFilePromiseDragSource : NSObject
+{
+    char _unknownFields[256];
+}
+- (id)initWithSource:(id)dragSource;
+- (void)setTypes:(NSArray *)types onPasteboard:(NSPasteboard *)pasteboard;
+@end
+
+@interface WKPasteboardFilePromiseOwner : NSFilePromiseDragSource
+@end
+
+@interface WKPasteboardOwner : NSObject
+{
+    CachedResourceHandle<CachedImage> _image;
+}
+- (id)initWithImage:(CachedImage*)image;
+@end
 
 namespace WebKit {
 
-using namespace WebCore;
-   
-void WebDragClient::startDrag(DragImageRef dragImage, const IntPoint& at, const IntPoint& eventPos, Clipboard* clipboard, Frame* frame, bool linkDrag)
+static PassRefPtr<ShareableBitmap> convertImageToBitmap(NSImage *image)
 {
-    if (!frame)
-        return;
-    ASSERT(clipboard);
-    
-    NSImage *dragNSImage = dragImage.get();
-    RefPtr<ShareableBitmap> dragShareableImage = ShareableBitmap::createShareable(IntSize([dragNSImage size]));
-    OwnPtr<GraphicsContext> graphicsContext = dragShareableImage->createGraphicsContext();
+    RefPtr<ShareableBitmap> bitmap = ShareableBitmap::createShareable(IntSize([image size]), ShareableBitmap::SupportsAlpha);
+    OwnPtr<GraphicsContext> graphicsContext = bitmap->createGraphicsContext();
 
-    [NSGraphicsContext saveGraphicsState];
-    NSGraphicsContext* bitmapContext = [NSGraphicsContext graphicsContextWithGraphicsPort:graphicsContext->platformContext() flipped:YES];
-    [NSGraphicsContext setCurrentContext: bitmapContext];
-    
-    [dragNSImage drawInRect:NSMakeRect(0, 0, [dragNSImage size].width , [dragNSImage size].height) fromRect:NSZeroRect operation:NSCompositeSourceOver fraction:1 respectFlipped:YES hints:nil];
-    [NSGraphicsContext restoreGraphicsState];
- 
-    SharedMemory::Handle handle;
-    if (!dragShareableImage->createHandle(handle))
+    RetainPtr<NSGraphicsContext> savedContext = [NSGraphicsContext currentContext];
+
+    [NSGraphicsContext setCurrentContext:[NSGraphicsContext graphicsContextWithGraphicsPort:graphicsContext->platformContext() flipped:YES]];
+    [image drawInRect:NSMakeRect(0, 0, bitmap->size().width(), bitmap->size().height()) fromRect:NSZeroRect operation:NSCompositeSourceOver fraction:1 respectFlipped:YES hints:nil];
+
+    [NSGraphicsContext setCurrentContext:savedContext.get()];
+
+    return bitmap.release();
+}
+
+void WebDragClient::startDrag(RetainPtr<NSImage> image, const IntPoint& point, const IntPoint&, Clipboard*, Frame* frame, bool linkDrag)
+{
+    RefPtr<ShareableBitmap> bitmap = convertImageToBitmap(image.get());
+    ShareableBitmap::Handle handle;
+    if (!bitmap->createHandle(handle))
         return;
-    IntPoint clientPoint(at);
-    m_page->send(Messages::WebPageProxy::SetDragImage(clientPoint, IntSize([dragNSImage size]), handle, linkDrag));
+
+    // FIXME: Seems this message should be named StartDrag, not SetDragImage.
+    m_page->send(Messages::WebPageProxy::SetDragImage(frame->view()->contentsToWindow(point), handle, linkDrag));
 }
 
-static void writeURL(NSPasteboard* pasteboard, NSURL* URL, NSString* title, NSArray* types)
+static CachedImage* cachedImage(Element* element)
 {
-    ASSERT(URL);
-    
+    RenderObject* renderer = element->renderer();
+    if (!renderer)
+        return 0;
+    if (!renderer->isRenderImage())
+        return 0;
+    CachedImage* image = toRenderImage(renderer)->cachedImage();
+    if (!image || image->errorOccurred()) 
+        return 0;
+    return image;
+}
+
+static NSArray *arrayForURLsWithTitles(NSURL *URL, NSString *title)
+{
+    return [NSArray arrayWithObjects:[NSArray arrayWithObject:[URL _web_originalDataAsString]],
+        [NSArray arrayWithObject:[title _webkit_stringByTrimmingWhitespace]], nil];
+}
+
+void WebDragClient::declareAndWriteDragImage(NSPasteboard *pasteboard, DOMElement *element, NSURL *URL, NSString *title, WebCore::Frame*)
+{
+    ASSERT(element);
+    ASSERT(pasteboard && pasteboard == [NSPasteboard pasteboardWithName:NSDragPboard]);
+
+    Element* coreElement = core(element);
+
+    CachedImage* image = cachedImage(coreElement);
+
+    NSString *extension = @"";
+    if (image) {
+        extension = image->image()->filenameExtension();
+        if (![extension length])
+            return;
+    }
+
     if (![title length]) {
         title = [[URL path] lastPathComponent];
         if (![title length])
             title = [URL _web_userVisibleString];
     }
-    
-    if ([types containsObject:NSURLPboardType])
-        [URL writeToPasteboard:pasteboard];
-    if ([types containsObject:PasteboardTypes::WebURLPboardType])
-        [pasteboard setString:[URL _web_originalDataAsString] forType:PasteboardTypes::WebURLPboardType];
-    if ([types containsObject:PasteboardTypes::WebURLNamePboardType])
-        [pasteboard setString:title forType:PasteboardTypes::WebURLNamePboardType];
-    if ([types containsObject:NSStringPboardType])
-        [pasteboard setString:[URL _web_userVisibleString] forType:NSStringPboardType];
-    if ([types containsObject:PasteboardTypes::WebURLsWithTitlesPboardType]) {
-        NSArray* URLs = [NSArray arrayWithObject:URL];
-        unsigned count = [URLs count];
-        
-        if (!count || [pasteboard availableTypeFromArray:[NSArray arrayWithObject:PasteboardTypes::WebURLsWithTitlesPboardType]] == nil)
-            return;
 
-        NSArray* titles = [NSArray arrayWithObject:title];
-        
-        if (count != [titles count])
-            titles = nil;
-        
-        NSMutableArray* URLStrings = [NSMutableArray arrayWithCapacity:count];
-        NSMutableArray* titlesOrEmptyStrings = [NSMutableArray arrayWithCapacity:count];
-        for (unsigned index = 0; index < count; ++index) {
-            [URLStrings addObject:[[URLs objectAtIndex:index] _web_originalDataAsString]];
-            [titlesOrEmptyStrings addObject:(titles == nil) ? @"" : [[titles objectAtIndex:index] _webkit_stringByTrimmingWhitespace]];
+    RefPtr<LegacyWebArchive> archive = LegacyWebArchive::create(coreElement);
+
+    RetainPtr<NSMutableArray> types(AdoptNS, [[NSMutableArray alloc] initWithObjects:NSFilesPromisePboardType, nil]);
+    [types.get() addObjectsFromArray:archive ? PasteboardTypes::forImagesWithArchive() : PasteboardTypes::forImages()];
+
+    RetainPtr<WKPasteboardOwner> pasteboardOwner(AdoptNS, [[WKPasteboardOwner alloc] initWithImage:image]);
+
+    RetainPtr<WKPasteboardFilePromiseOwner> filePromiseOwner(AdoptNS, [(WKPasteboardFilePromiseOwner *)[WKPasteboardFilePromiseOwner alloc] initWithSource:pasteboardOwner.get()]);
+    m_page->setDragSource(filePromiseOwner.get());
+
+    [pasteboard declareTypes:types.get() owner:pasteboardOwner.get()];    
+
+    [pasteboard setPropertyList:[NSArray arrayWithObject:extension] forType:NSFilesPromisePboardType];
+
+    [filePromiseOwner.get() setTypes:[pasteboard propertyListForType:NSFilesPromisePboardType] onPasteboard:pasteboard];
+
+    [URL writeToPasteboard:pasteboard];
+
+    [pasteboard setString:[URL _web_originalDataAsString] forType:PasteboardTypes::WebURLPboardType];
+
+    [pasteboard setString:title forType:PasteboardTypes::WebURLNamePboardType];
+
+    [pasteboard setString:[URL _web_userVisibleString] forType:NSStringPboardType];
+
+    [pasteboard setPropertyList:arrayForURLsWithTitles(URL, title) forType:PasteboardTypes::WebURLsWithTitlesPboardType];
+
+    if (archive)
+        [pasteboard setData:(NSData *)archive->rawDataRepresentation().get() forType:PasteboardTypes::WebArchivePboardType];
+}
+
+} // namespace WebKit
+
+@implementation WKPasteboardFilePromiseOwner
+
+// The AppKit implementation of copyDropDirectory gets the current pasteboard in
+// a way that only works in the process where the drag is initiated. We supply
+// an implementation that gets the pasteboard by name instead.
+- (CFURLRef)copyDropDirectory
+{
+    PasteboardRef pasteboard;
+    OSStatus status = PasteboardCreate((CFStringRef)NSDragPboard, &pasteboard);
+    if (status != noErr || !pasteboard)
+        return 0;
+    CFURLRef location = 0;
+    status = PasteboardCopyPasteLocation(pasteboard, &location);
+    CFRelease(pasteboard);
+    if (status != noErr || !location)
+        return 0;
+    CFMakeCollectable(location);
+    return location;
+}
+
+@end
+
+@implementation WKPasteboardOwner
+
+static CachedResourceClient* promisedDataClient()
+{
+    static CachedResourceClient* client = new CachedResourceClient;
+    return client;
+}
+
+- (void)clearImage
+{
+    if (!_image)
+        return;
+    _image->removeClient(promisedDataClient());
+    _image = 0;
+}
+
+- (id)initWithImage:(CachedImage*)image
+{
+    self = [super init];
+    if (!self)
+        return nil;
+
+    _image = image;
+    if (image)
+        image->addClient(promisedDataClient());
+    return self;
+}
+
+- (void)dealloc
+{
+    [self clearImage];
+    [super dealloc];
+}
+
+- (void)finalize
+{
+    [self clearImage];
+    [super finalize];
+}
+
+- (void)pasteboard:(NSPasteboard *)pasteboard provideDataForType:(NSString *)type
+{
+    if ([type isEqual:NSTIFFPboardType]) {
+        if (_image) {
+            if (Image* image = _image->image())
+                [pasteboard setData:(NSData *)image->getTIFFRepresentation() forType:NSTIFFPboardType];
+            [self clearImage];
         }
-        
-        [pasteboard setPropertyList:[NSArray arrayWithObjects:URLStrings, titlesOrEmptyStrings, nil]
-                            forType:PasteboardTypes::WebURLsWithTitlesPboardType];
+        return;
     }
+    // FIXME: Handle RTFD here.
 }
-    
-static void writeImage(NSPasteboard* pasteboard, NSImage *image, DOMElement* element, NSURL* URL, NSString* title, LegacyWebArchive* archive, NSArray* types)
+
+- (void)pasteboardChangedOwner:(NSPasteboard *)pasteboard
 {
-    ASSERT(image || element);
-    ASSERT(URL);
-    
-    writeURL(pasteboard, URL, title, types);
-    
-    if ([types containsObject:NSTIFFPboardType]) {
-        // FIXME: we should add handling of promised types.
-        if (image)
-            [pasteboard setData:[image TIFFRepresentation] forType:NSTIFFPboardType];
-        else if (element)
-            [pasteboard setData:[element _imageTIFFRepresentation] forType:NSTIFFPboardType];
-    }
-    
-    if (archive && [types containsObject:PasteboardTypes::WebArchivePboardType])
-        [pasteboard setData:[[(NSData *)archive->rawDataRepresentation().get() retain] autorelease] forType:PasteboardTypes::WebArchivePboardType];
+    [self clearImage];
 }
-    
-void WebDragClient::declareAndWriteDragImage(NSPasteboard* pasteboard, DOMElement* element, NSURL* URL, NSString* title, WebCore::Frame*)
+
+static bool matchesExtensionOrEquivalent(NSString *filename, NSString *extension)
 {
-    ASSERT(element);
-    ASSERT(pasteboard && pasteboard == [NSPasteboard pasteboardWithName:NSDragPboard]);
+    NSString *extensionAsSuffix = [@"." stringByAppendingString:extension];
+    return [filename _webkit_hasCaseInsensitiveSuffix:extensionAsSuffix]
+        || ([extension _webkit_isCaseInsensitiveEqualToString:@"jpeg"]
+            && [filename _webkit_hasCaseInsensitiveSuffix:@".jpg"]);
+}
+
+- (NSArray *)namesOfPromisedFilesDroppedAtDestination:(NSURL *)dropDestination
+{
+    NSFileWrapper *wrapper = nil;
+    NSURL *draggingImageURL = nil;
     
-    NSString *extension = @"";
-    if (RenderObject* renderer = core(element)->renderer()) {
-        if (renderer->isImage()) {
-            if (CachedImage* image = toRenderImage(renderer)->cachedImage()) {
-                extension = image->image()->filenameExtension();
-                if (![extension length])
-                    return;
-            }
+    if (_image) {
+        if (SharedBuffer* buffer = _image->CachedResource::data()) {
+            NSData *data = buffer->createNSData();
+            NSURLResponse *response = _image->response().nsURLResponse();
+            draggingImageURL = [response URL];
+            wrapper = [[[NSFileWrapper alloc] initRegularFileWithContents:data] autorelease];
+            NSString* filename = [response suggestedFilename];
+            NSString* trueExtension(_image->image()->filenameExtension());
+            if (!matchesExtensionOrEquivalent(filename, trueExtension))
+                filename = [[filename stringByAppendingString:@"."] stringByAppendingString:trueExtension];
+            [wrapper setPreferredFilename:filename];
         }
     }
+
+    // FIXME: Do we need to handle the case where we do not have a CachedImage?
+    // WebKit1 had code for this case.
     
-    RefPtr<LegacyWebArchive> archive = LegacyWebArchive::create(core(element));
-    NSMutableArray *types = [[NSMutableArray alloc] initWithObjects:NSFilesPromisePboardType, nil];
-    [types addObjectsFromArray:(archive) ? PasteboardTypes::forImagesWithArchive() : PasteboardTypes::forImages()];
-    [pasteboard declareTypes:types owner:nil];    
-    writeImage(pasteboard, nil, element, URL, title, archive.get(), types);
-    [types release];
-    
-    NSArray *extensions = [[NSArray alloc] initWithObjects:extension, nil];
-    [pasteboard setPropertyList:extensions forType:NSFilesPromisePboardType];
-    [extensions release];
+    if (!wrapper) {
+        LOG_ERROR("Failed to create image file.");
+        return nil;
+    }
+
+    // FIXME: Report an error if we fail to create a file.
+    NSString *path = [[dropDestination path] stringByAppendingPathComponent:[wrapper preferredFilename]];
+    path = [[NSFileManager defaultManager] _webkit_pathWithUniqueFilenameForPath:path];
+    if (![wrapper writeToFile:path atomically:NO updateFilenames:YES])
+        LOG_ERROR("Failed to create image file via -[NSFileWrapper writeToFile:atomically:updateFilenames:] at path %@", path);
+
+    if (draggingImageURL)
+        [[NSFileManager defaultManager] _webkit_setMetadataURL:[draggingImageURL absoluteString] referrer:nil atPath:path];
+
+    return [NSArray arrayWithObject:[path lastPathComponent]];
 }
 
-} // namespace WebKit
+@end
diff --git a/Source/WebKit2/WebProcess/WebCoreSupport/mac/WebEditorClientMac.mm b/Source/WebKit2/WebProcess/WebCoreSupport/mac/WebEditorClientMac.mm
index 8af0438..7a95a72 100644
--- a/Source/WebKit2/WebProcess/WebCoreSupport/mac/WebEditorClientMac.mm
+++ b/Source/WebKit2/WebProcess/WebCoreSupport/mac/WebEditorClientMac.mm
@@ -46,7 +46,7 @@
 #import <WebCore/Page.h>
 #import <WebKit/WebResource.h>
 #import <WebKit/WebNSURLExtras.h>
-#if !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD) && !defined(BUILDING_ON_SNOW_LEOPARD)
+#if !defined(BUILDING_ON_SNOW_LEOPARD)
 #import <AppKit/NSTextChecker.h>
 #endif
 
@@ -246,26 +246,27 @@ void WebEditorClient::checkTextOfParagraph(const UChar* text, int length, uint64
     m_page->sendSync(Messages::WebPageProxy::CheckTextOfParagraph(String(text, length), checkingTypes), Messages::WebPageProxy::CheckTextOfParagraph::Reply(results));
 }
 
-#if !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD) && !defined(BUILDING_ON_SNOW_LEOPARD)
-void WebEditorClient::showCorrectionPanel(WebCore::CorrectionPanelInfo::PanelType type, const WebCore::FloatRect& boundingBoxOfReplacedString, const WTF::String& replacedString, const WTF::String& replacementString, const Vector<String>& alternativeReplacementStrings, WebCore::Editor*)
+#if !defined(BUILDING_ON_SNOW_LEOPARD)
+void WebEditorClient::showCorrectionPanel(WebCore::CorrectionPanelInfo::PanelType type, const WebCore::FloatRect& boundingBoxOfReplacedString, const String& replacedString, const String& replacementString, const Vector<String>& alternativeReplacementStrings)
 {
-    notImplemented();
+    m_page->send(Messages::WebPageProxy::ShowCorrectionPanel(type, boundingBoxOfReplacedString, replacedString, replacementString, alternativeReplacementStrings));
 }
 
-void WebEditorClient::dismissCorrectionPanel(WebCore::ReasonForDismissingCorrectionPanel)
+void WebEditorClient::dismissCorrectionPanel(WebCore::ReasonForDismissingCorrectionPanel reason)
 {
-    notImplemented();
+    m_page->send(Messages::WebPageProxy::DismissCorrectionPanel(reason));
 }
 
-bool WebEditorClient::isShowingCorrectionPanel()
+String WebEditorClient::dismissCorrectionPanelSoon(WebCore::ReasonForDismissingCorrectionPanel reason)
 {
-    notImplemented();
-    return false;
+    String result;
+    m_page->sendSync(Messages::WebPageProxy::DismissCorrectionPanelSoon(reason), Messages::WebPageProxy::DismissCorrectionPanelSoon::Reply(result));
+    return result;
 }
 
 void WebEditorClient::recordAutocorrectionResponse(EditorClient::AutocorrectionResponseType responseType, const String& replacedString, const String& replacementString)
 {
-    notImplemented();
+    m_page->send(Messages::WebPageProxy::RecordAutocorrectionResponse(responseType, replacedString, replacementString));
 }
 #endif
 
diff --git a/Source/WebKit2/WebProcess/WebCoreSupport/mac/WebErrorsMac.mm b/Source/WebKit2/WebProcess/WebCoreSupport/mac/WebErrorsMac.mm
index 677c537..70e7607 100644
--- a/Source/WebKit2/WebProcess/WebCoreSupport/mac/WebErrorsMac.mm
+++ b/Source/WebKit2/WebProcess/WebCoreSupport/mac/WebErrorsMac.mm
@@ -28,6 +28,7 @@
 
 #import "WKError.h"
 #import "WebError.h"
+#import <WebCore/LocalizedStrings.h>
 #import <WebCore/ResourceRequest.h>
 #import <WebCore/ResourceResponse.h>
 #import <pthread.h>
@@ -41,9 +42,6 @@ static NSString * const WebKitErrorMIMETypeKey =               @"WebKitErrorMIME
 static NSString * const WebKitErrorPlugInNameKey =             @"WebKitErrorPlugInNameKey";
 static NSString * const WebKitErrorPlugInPageURLStringKey =    @"WebKitErrorPlugInPageURLStringKey";
 
-// FIXME (WebKit2) <rdar://problem/8728860> WebKit2 needs to be localized
-#define UI_STRING(__str, __desc) [NSString stringWithUTF8String:__str]
-
 // Policy errors
 #define WebKitErrorDescriptionCannotShowMIMEType UI_STRING("Content with specified MIME type can’t be shown", "WebKitErrorCannotShowMIMEType description")
 #define WebKitErrorDescriptionCannotShowURL UI_STRING("The URL can’t be shown", "WebKitErrorCannotShowURL description")
@@ -119,17 +117,17 @@ static void registerErrors()
 
     NSDictionary *dict = [NSDictionary dictionaryWithObjectsAndKeys:
         // Policy errors
-        WebKitErrorDescriptionCannotShowMIMEType,                   [NSNumber numberWithInt: kWKErrorCodeCannotShowMIMEType],
-        WebKitErrorDescriptionCannotShowURL,                        [NSNumber numberWithInt: kWKErrorCodeCannotShowURL],
-        WebKitErrorDescriptionFrameLoadInterruptedByPolicyChange,   [NSNumber numberWithInt: kWKErrorCodeFrameLoadInterruptedByPolicyChange],
-        WebKitErrorDescriptionCannotUseRestrictedPort,              [NSNumber numberWithInt: kWKErrorCodeCannotUseRestrictedPort],
+        (NSString *)WebKitErrorDescriptionCannotShowMIMEType,                   [NSNumber numberWithInt: kWKErrorCodeCannotShowMIMEType],
+        (NSString *)WebKitErrorDescriptionCannotShowURL,                        [NSNumber numberWithInt: kWKErrorCodeCannotShowURL],
+        (NSString *)WebKitErrorDescriptionFrameLoadInterruptedByPolicyChange,   [NSNumber numberWithInt: kWKErrorCodeFrameLoadInterruptedByPolicyChange],
+        (NSString *)WebKitErrorDescriptionCannotUseRestrictedPort,              [NSNumber numberWithInt: kWKErrorCodeCannotUseRestrictedPort],
         
         // Plug-in and java errors
-        WebKitErrorDescriptionCannotFindPlugin,                     [NSNumber numberWithInt: kWKErrorCodeCannotFindPlugIn],
-        WebKitErrorDescriptionCannotLoadPlugin,                     [NSNumber numberWithInt: kWKErrorCodeCannotLoadPlugIn],
-        WebKitErrorDescriptionJavaUnavailable,                      [NSNumber numberWithInt: kWKErrorCodeJavaUnavailable],
-        WebKitErrorDescriptionPlugInCancelledConnection,            [NSNumber numberWithInt: kWKErrorCodePlugInCancelledConnection],
-        WebKitErrorDescriptionPlugInWillHandleLoad,                 [NSNumber numberWithInt: kWKErrorCodePlugInWillHandleLoad],
+        (NSString *)WebKitErrorDescriptionCannotFindPlugin,                     [NSNumber numberWithInt: kWKErrorCodeCannotFindPlugIn],
+        (NSString *)WebKitErrorDescriptionCannotLoadPlugin,                     [NSNumber numberWithInt: kWKErrorCodeCannotLoadPlugIn],
+        (NSString *)WebKitErrorDescriptionJavaUnavailable,                      [NSNumber numberWithInt: kWKErrorCodeJavaUnavailable],
+        (NSString *)WebKitErrorDescriptionPlugInCancelledConnection,            [NSNumber numberWithInt: kWKErrorCodePlugInCancelledConnection],
+        (NSString *)WebKitErrorDescriptionPlugInWillHandleLoad,                 [NSNumber numberWithInt: kWKErrorCodePlugInWillHandleLoad],
         nil];
 
     [NSError _webkit_addErrorsWithCodesAndDescriptions:dict inDomain:WebError::webKitErrorDomain()];
diff --git a/Source/WebKit2/WebProcess/WebCoreSupport/mac/WebSystemInterface.mm b/Source/WebKit2/WebProcess/WebCoreSupport/mac/WebSystemInterface.mm
index 2c8649e..06faa2f 100644
--- a/Source/WebKit2/WebProcess/WebCoreSupport/mac/WebSystemInterface.mm
+++ b/Source/WebKit2/WebProcess/WebCoreSupport/mac/WebSystemInterface.mm
@@ -59,6 +59,7 @@ void InitWebCoreSystemInterface(void)
         INIT(GetHTTPPipeliningPriority);
         INIT(GetMIMETypeForExtension);
         INIT(GetNSURLResponseLastModifiedDate);
+        INIT(SignedPublicKeyAndChallengeString);
         INIT(GetPreferredExtensionForMIMEType);
         INIT(GetUserToBaseCTM);
         INIT(GetWheelEventDeltas);
@@ -95,7 +96,7 @@ void InitWebCoreSystemInterface(void)
         INIT(SignalCFReadStreamHasBytes);
         INIT(CreatePrivateStorageSession);
         INIT(CopyRequestWithStorageSession);
-        INIT(CreatePrivateInMemoryHTTPCookieStorage);
+        INIT(CopyHTTPCookieStorage);
         INIT(GetHTTPCookieAcceptPolicy);
         INIT(HTTPCookiesForURL);
         INIT(SetHTTPCookiesForURL);
@@ -108,6 +109,7 @@ void InitWebCoreSystemInterface(void)
         INIT(MakeScrollbarPainter);
         INIT(ScrollbarPainterSetDelegate);
         INIT(ScrollbarPainterPaint);
+        INIT(ScrollbarPainterForceFlashScrollers);
         INIT(ScrollbarThickness);
         INIT(ScrollbarMinimumThumbLength);
         INIT(ScrollbarMinimumTotalLengthNeededForThumb);
@@ -148,5 +150,11 @@ void InitWebCoreSystemInterface(void)
         INIT(AccessibilityHandleFocusChanged);
         INIT(CreateAXUIElementRef);
         INIT(UnregisterUniqueIdForElement);        
+
+        INIT(GetCFURLResponseMIMEType);
+        INIT(GetCFURLResponseURL);
+        INIT(GetCFURLResponseHTTPResponse);
+        INIT(CopyCFURLResponseSuggestedFilename);
+        INIT(SetCFURLResponseMIMEType);
     });
 }
diff --git a/Source/WebKit2/WebProcess/WebCoreSupport/win/WebPopupMenuWin.cpp b/Source/WebKit2/WebProcess/WebCoreSupport/win/WebPopupMenuWin.cpp
index b4db406..851203c 100644
--- a/Source/WebKit2/WebProcess/WebCoreSupport/win/WebPopupMenuWin.cpp
+++ b/Source/WebKit2/WebProcess/WebCoreSupport/win/WebPopupMenuWin.cpp
@@ -78,9 +78,9 @@ void WebPopupMenu::setUpPlatformData(const WebCore::IntRect& pageCoordinates, Pl
     // The backing stores should be drawn at least as wide as the control on the page to match the width of the popup window we'll create.
     int backingStoreWidth = max(pageCoordinates.width() - m_popupClient->clientInsetLeft() - m_popupClient->clientInsetRight(), popupWidth);
 
-    data.m_backingStoreSize = IntSize(backingStoreWidth, (itemCount * data.m_itemHeight));
-    data.m_notSelectedBackingStore = ShareableBitmap::createShareable(data.m_backingStoreSize);
-    data.m_selectedBackingStore = ShareableBitmap::createShareable(data.m_backingStoreSize);
+    IntSize backingStoreSize(backingStoreWidth, (itemCount * data.m_itemHeight));
+    data.m_notSelectedBackingStore = ShareableBitmap::createShareable(backingStoreSize, ShareableBitmap::SupportsAlpha);
+    data.m_selectedBackingStore = ShareableBitmap::createShareable(backingStoreSize, ShareableBitmap::SupportsAlpha);
 
     OwnPtr<GraphicsContext> notSelectedBackingStoreContext = data.m_notSelectedBackingStore->createGraphicsContext();
     OwnPtr<GraphicsContext> selectedBackingStoreContext = data.m_selectedBackingStore->createGraphicsContext();
@@ -88,7 +88,7 @@ void WebPopupMenu::setUpPlatformData(const WebCore::IntRect& pageCoordinates, Pl
     Color activeOptionBackgroundColor = RenderTheme::defaultTheme()->activeListBoxSelectionBackgroundColor();
     Color activeOptionTextColor = RenderTheme::defaultTheme()->activeListBoxSelectionForegroundColor();
 
-    for (int y = 0; y < data.m_backingStoreSize.height(); y += data.m_itemHeight) {
+    for (int y = 0; y < backingStoreSize.height(); y += data.m_itemHeight) {
         int index = y / data.m_itemHeight;
 
         PopupMenuStyle itemStyle = m_popupClient->itemStyle(index);
diff --git a/Source/WebKit2/WebProcess/WebPage/DrawingAreaImpl.cpp b/Source/WebKit2/WebProcess/WebPage/DrawingAreaImpl.cpp
index 0a18256..47acc7a 100644
--- a/Source/WebKit2/WebProcess/WebPage/DrawingAreaImpl.cpp
+++ b/Source/WebKit2/WebProcess/WebPage/DrawingAreaImpl.cpp
@@ -64,7 +64,8 @@ DrawingAreaImpl::DrawingAreaImpl(WebPage* webPage, const WebPageCreationParamete
     , m_isWaitingForDidUpdate(false)
     , m_isPaintingSuspended(!parameters.isVisible)
     , m_alwaysUseCompositing(false)
-    , m_displayTimer(WebProcess::shared().runLoop(), this, &DrawingAreaImpl::display)
+    , m_lastDisplayTime(0)
+    , m_displayTimer(WebProcess::shared().runLoop(), this, &DrawingAreaImpl::displayTimerFired)
     , m_exitCompositingTimer(WebProcess::shared().runLoop(), this, &DrawingAreaImpl::exitAcceleratedCompositingMode)
 {
     if (webPage->corePage()->settings()->acceleratedDrawingEnabled())
@@ -89,6 +90,9 @@ void DrawingAreaImpl::setNeedsDisplay(const IntRect& rect)
         return;
     }
     
+    if (m_webPage->mainFrameHasCustomRepresentation())
+        return;
+
     m_dirtyRegion.unite(dirtyRect);
     scheduleDisplay();
 }
@@ -104,6 +108,9 @@ void DrawingAreaImpl::scroll(const IntRect& scrollRect, const IntSize& scrollOff
         return;
     }
 
+    if (m_webPage->mainFrameHasCustomRepresentation())
+        return;
+
     if (!m_scrollRect.isEmpty() && scrollRect != m_scrollRect) {
         unsigned scrollArea = scrollRect.width() * scrollRect.height();
         unsigned currentScrollArea = m_scrollRect.width() * m_scrollRect.height();
@@ -197,7 +204,9 @@ void DrawingAreaImpl::layerHostDidFlushLayers()
     if (!m_layerTreeHost)
         return;
 
+#if USE(ACCELERATED_COMPOSITING)
     m_webPage->send(Messages::DrawingAreaProxy::EnterAcceleratedCompositingMode(m_backingStoreStateID, m_layerTreeHost->layerTreeContext()));
+#endif
 }
 
 void DrawingAreaImpl::setRootCompositingLayer(GraphicsLayer* graphicsLayer)
@@ -291,11 +300,13 @@ void DrawingAreaImpl::sendDidUpdateBackingStoreState()
     m_shouldSendDidUpdateBackingStoreState = false;
 
     UpdateInfo updateInfo;
-    LayerTreeContext layerTreeContext;
 
     if (!m_isPaintingSuspended && !m_layerTreeHost)
         display(updateInfo);
 
+#if USE(ACCELERATED_COMPOSITING)
+    LayerTreeContext layerTreeContext;
+
     if (m_isPaintingSuspended || m_layerTreeHost) {
         updateInfo.viewSize = m_webPage->size();
 
@@ -311,6 +322,7 @@ void DrawingAreaImpl::sendDidUpdateBackingStoreState()
     }
 
     m_webPage->send(Messages::DrawingAreaProxy::DidUpdateBackingStoreState(m_backingStoreStateID, updateInfo, layerTreeContext));
+#endif
 }
 
 void DrawingAreaImpl::didUpdate()
@@ -322,8 +334,8 @@ void DrawingAreaImpl::didUpdate()
 
     m_isWaitingForDidUpdate = false;
 
-    // Display if needed.
-    display();
+    // Display if needed. We call displayTimerFired here since it will throttle updates to 60fps.
+    displayTimerFired();
 }
 
 void DrawingAreaImpl::suspendPainting()
@@ -391,9 +403,11 @@ void DrawingAreaImpl::exitAcceleratedCompositingMode()
     else
         display(updateInfo);
 
+#if USE(ACCELERATED_COMPOSITING)
     // Send along a complete update of the page so we can paint the contents right after we exit the
     // accelerated compositing mode, eliminiating flicker.
     m_webPage->send(Messages::DrawingAreaProxy::ExitAcceleratedCompositingMode(m_backingStoreStateID, updateInfo));
+#endif
 }
 
 void DrawingAreaImpl::exitAcceleratedCompositingModeSoon()
@@ -421,6 +435,21 @@ void DrawingAreaImpl::scheduleDisplay()
     m_displayTimer.startOneShot(0);
 }
 
+void DrawingAreaImpl::displayTimerFired()
+{
+    static const double minimumFrameInterval = 1.0 / 60.0;
+    
+    double timeSinceLastDisplay = currentTime() - m_lastDisplayTime;
+    double timeUntilNextDisplay = minimumFrameInterval - timeSinceLastDisplay;
+
+    if (timeUntilNextDisplay > 0) {
+        m_displayTimer.startOneShot(timeUntilNextDisplay);
+        return;
+    }
+
+    display();
+}
+
 void DrawingAreaImpl::display()
 {
     ASSERT(!m_layerTreeHost);
@@ -479,8 +508,11 @@ void DrawingAreaImpl::display(UpdateInfo& updateInfo)
     ASSERT(!m_webPage->size().isEmpty());
 
     // FIXME: It would be better if we could avoid painting altogether when there is a custom representation.
-    if (m_webPage->mainFrameHasCustomRepresentation())
+    if (m_webPage->mainFrameHasCustomRepresentation()) {
+        // ASSUMPTION: the custom representation will be painting the dirty region for us.
+        m_dirtyRegion = Region();
         return;
+    }
 
     m_webPage->layoutIfNeeded();
 
@@ -492,7 +524,7 @@ void DrawingAreaImpl::display(UpdateInfo& updateInfo)
     IntRect bounds = m_dirtyRegion.bounds();
     ASSERT(m_webPage->bounds().contains(bounds));
 
-    RefPtr<ShareableBitmap> bitmap = ShareableBitmap::createShareable(bounds.size());
+    RefPtr<ShareableBitmap> bitmap = ShareableBitmap::createShareable(bounds.size(), ShareableBitmap::SupportsAlpha);
     if (!bitmap->createHandle(updateInfo.bitmapHandle))
         return;
 
@@ -527,6 +559,8 @@ void DrawingAreaImpl::display(UpdateInfo& updateInfo)
     // Layout can trigger more calls to setNeedsDisplay and we don't want to process them
     // until the UI process has painted the update, so we stop the timer here.
     m_displayTimer.stop();
+
+    m_lastDisplayTime = currentTime();
 }
 
 
diff --git a/Source/WebKit2/WebProcess/WebPage/DrawingAreaImpl.h b/Source/WebKit2/WebProcess/WebPage/DrawingAreaImpl.h
index 8d85200..9e93869 100644
--- a/Source/WebKit2/WebProcess/WebPage/DrawingAreaImpl.h
+++ b/Source/WebKit2/WebProcess/WebPage/DrawingAreaImpl.h
@@ -72,6 +72,7 @@ private:
     void exitAcceleratedCompositingMode();
 
     void scheduleDisplay();
+    void displayTimerFired();
     void display();
     void display(UpdateInfo&);
 
@@ -97,6 +98,8 @@ private:
     bool m_isPaintingSuspended;
     bool m_alwaysUseCompositing;
 
+    double m_lastDisplayTime;
+
     RunLoop::Timer<DrawingAreaImpl> m_displayTimer;
     RunLoop::Timer<DrawingAreaImpl> m_exitCompositingTimer;
 
diff --git a/Source/WebKit2/WebProcess/WebPage/FindController.cpp b/Source/WebKit2/WebProcess/WebPage/FindController.cpp
index 8e9dba7..3e7b268 100644
--- a/Source/WebKit2/WebProcess/WebPage/FindController.cpp
+++ b/Source/WebKit2/WebProcess/WebPage/FindController.cpp
@@ -153,6 +153,10 @@ bool FindController::updateFindIndicator(Frame* selectedFrame, bool isShowingOve
         return false;
 
     IntRect selectionRect = enclosingIntRect(selectedFrame->selection()->bounds());
+    
+    // Selection rect can be empty for matches that are currently obscured from view.
+    if (selectionRect.isEmpty())
+        return false;
 
     // We want the selection rect in window coordinates.
     IntRect selectionRectInWindowCoordinates = selectedFrame->view()->contentsToWindow(selectionRect);
@@ -161,7 +165,7 @@ bool FindController::updateFindIndicator(Frame* selectedFrame, bool isShowingOve
     selectedFrame->selection()->getClippedVisibleTextRectangles(textRects);
 
     // Create a backing store and paint the find indicator text into it.
-    RefPtr<ShareableBitmap> findIndicatorTextBackingStore = ShareableBitmap::createShareable(selectionRect.size());
+    RefPtr<ShareableBitmap> findIndicatorTextBackingStore = ShareableBitmap::createShareable(selectionRect.size(), ShareableBitmap::SupportsAlpha);
     if (!findIndicatorTextBackingStore)
         return false;
     
@@ -178,7 +182,7 @@ bool FindController::updateFindIndicator(Frame* selectedFrame, bool isShowingOve
     selectedFrame->view()->paint(graphicsContext.get(), paintRect);
     selectedFrame->view()->setPaintBehavior(PaintBehaviorNormal);
     
-    SharedMemory::Handle handle;
+    ShareableBitmap::Handle handle;
     if (!findIndicatorTextBackingStore->createHandle(handle))
         return false;
 
@@ -203,7 +207,7 @@ void FindController::hideFindIndicator()
     if (!m_isShowingFindIndicator)
         return;
 
-    SharedMemory::Handle handle;
+    ShareableBitmap::Handle handle;
     m_webPage->send(Messages::WebPageProxy::SetFindIndicator(FloatRect(), Vector<FloatRect>(), handle, false));
     m_isShowingFindIndicator = false;
 }
diff --git a/Source/WebKit2/WebProcess/WebPage/LayerTreeHost.cpp b/Source/WebKit2/WebProcess/WebPage/LayerTreeHost.cpp
index 1112d39..737e195 100644
--- a/Source/WebKit2/WebProcess/WebPage/LayerTreeHost.cpp
+++ b/Source/WebKit2/WebProcess/WebPage/LayerTreeHost.cpp
@@ -27,7 +27,7 @@
 #include "LayerTreeHost.h"
 
 #if PLATFORM(MAC)
-#include "LayerTreeHostMac.h"
+#include "LayerTreeHostCA.h"
 #endif
 
 #if !PLATFORM(MAC) && !PLATFORM(WIN)
@@ -41,7 +41,7 @@ namespace WebKit {
 PassRefPtr<LayerTreeHost> LayerTreeHost::create(WebPage* webPage)
 {
 #if PLATFORM(MAC)
-    return LayerTreeHostMac::create(webPage);
+    return LayerTreeHostCA::create(webPage);
 #endif
 
     return 0;
diff --git a/Source/WebKit2/WebProcess/WebPage/WebFrame.cpp b/Source/WebKit2/WebProcess/WebPage/WebFrame.cpp
index fa4dc2c..574634f 100644
--- a/Source/WebKit2/WebProcess/WebPage/WebFrame.cpp
+++ b/Source/WebKit2/WebProcess/WebPage/WebFrame.cpp
@@ -335,7 +335,11 @@ String WebFrame::url() const
     if (!m_coreFrame)
         return String();
 
-    return m_coreFrame->document()->url().string();
+    DocumentLoader* documentLoader = m_coreFrame->loader()->documentLoader();
+    if (!documentLoader)
+        return String();
+
+    return documentLoader->url().string();
 }
 
 String WebFrame::innerText() const
@@ -611,7 +615,12 @@ String WebFrame::suggestedFilenameForResourceWithURL(const KURL& url) const
     DocumentLoader* loader = m_coreFrame->loader()->documentLoader();
     if (!loader)
         return String();
-    
+
+    // First, try the main resource.
+    if (loader->url() == url)
+        return loader->response().suggestedFilename();
+
+    // Next, try subresources.
     RefPtr<ArchiveResource> resource = loader->subresource(url);
     if (!resource)
         return String();
@@ -627,7 +636,12 @@ String WebFrame::mimeTypeForResourceWithURL(const KURL& url) const
     DocumentLoader* loader = m_coreFrame->loader()->documentLoader();
     if (!loader)
         return String();
-    
+
+    // First, try the main resource.
+    if (loader->url() == url)
+        return loader->response().mimeType();
+
+    // Next, try subresources.
     RefPtr<ArchiveResource> resource = loader->subresource(url);
     if (resource)
         return resource->mimeType();
diff --git a/Source/WebKit2/WebProcess/WebPage/WebPage.cpp b/Source/WebKit2/WebProcess/WebPage/WebPage.cpp
index ff567bd..d5f3724 100644
--- a/Source/WebKit2/WebProcess/WebPage/WebPage.cpp
+++ b/Source/WebKit2/WebProcess/WebPage/WebPage.cpp
@@ -54,6 +54,7 @@
 #include "WebEvent.h"
 #include "WebEventConversion.h"
 #include "WebFrame.h"
+#include "WebFullScreenManager.h"
 #include "WebGeolocationClient.h"
 #include "WebImage.h"
 #include "WebInspector.h"
@@ -91,6 +92,7 @@
 #include <WebCore/RenderView.h>
 #include <WebCore/ReplaceSelectionCommand.h>
 #include <WebCore/ResourceRequest.h>
+#include <WebCore/SchemeRegistry.h>
 #include <WebCore/SerializedScriptValue.h>
 #include <WebCore/Settings.h>
 #include <WebCore/SharedBuffer.h>
@@ -158,6 +160,7 @@ WebPage::WebPage(uint64_t pageID, const WebPageCreationParameters& parameters)
     , m_canRunBeforeUnloadConfirmPanel(parameters.canRunBeforeUnloadConfirmPanel)
     , m_canRunModal(parameters.canRunModal)
     , m_isRunningModal(false)
+    , m_userSpaceScaleFactor(parameters.userSpaceScaleFactor)
     , m_cachedMainFrameIsPinnedToLeftSide(false)
     , m_cachedMainFrameIsPinnedToRightSide(false)
 {
@@ -352,6 +355,9 @@ void WebPage::close()
 #if ENABLE(INSPECTOR)
     m_inspector = 0;
 #endif
+#if ENABLE(FULLSCREEN_API)
+    m_fullScreenManager = 0;
+#endif
 
     if (m_activePopupMenu) {
         m_activePopupMenu->disconnectFromPage();
@@ -424,7 +430,7 @@ void WebPage::loadAlternateHTMLString(const String& htmlString, const String& ba
 {
     RefPtr<SharedBuffer> sharedBuffer = SharedBuffer::create(reinterpret_cast<const char*>(htmlString.characters()), htmlString.length() * sizeof(UChar));
     KURL baseURL = baseURLString.isEmpty() ? blankURL() : KURL(KURL(), baseURLString);
-    KURL unreachableURL = unreachableURLString.isEmpty() ? KURL() : KURL(KURL(), unreachableURLString)  ;
+    KURL unreachableURL = unreachableURLString.isEmpty() ? KURL() : KURL(KURL(), unreachableURLString);
     loadData(sharedBuffer, "text/html", "utf-16", baseURL, unreachableURL);
 }
 
@@ -785,9 +791,9 @@ void WebPage::pageDidScroll()
 }
 
 #if ENABLE(TILED_BACKING_STORE)
-void WebPage::pageDidRequestScroll(const IntSize& delta)
+void WebPage::pageDidRequestScroll(const IntPoint& point)
 {
-    send(Messages::WebPageProxy::PageDidRequestScroll(delta));
+    send(Messages::WebPageProxy::PageDidRequestScroll(point));
 }
 #endif
 
@@ -1051,6 +1057,21 @@ void WebPage::touchEvent(const WebTouchEvent& touchEvent)
 }
 #endif
 
+void WebPage::scroll(Page* page, ScrollDirection direction, ScrollGranularity granularity)
+{
+    page->focusController()->focusedOrMainFrame()->eventHandler()->scrollRecursively(direction, granularity);
+}
+
+void WebPage::logicalScroll(Page* page, ScrollLogicalDirection direction, ScrollGranularity granularity)
+{
+    page->focusController()->focusedOrMainFrame()->eventHandler()->logicalScrollRecursively(direction, granularity);
+}
+
+void WebPage::scrollBy(uint32_t scrollDirection, uint32_t scrollGranularity)
+{
+    scroll(m_page.get(), static_cast<ScrollDirection>(scrollDirection), static_cast<ScrollGranularity>(scrollGranularity));
+}
+
 void WebPage::setActive(bool isActive)
 {
     m_page->focusController()->setActive(isActive);
@@ -1121,6 +1142,8 @@ void WebPage::viewWillEndLiveResize()
 
 void WebPage::setFocused(bool isFocused)
 {
+    if (!isFocused)
+        m_page->focusController()->focusedOrMainFrame()->selection()->clear();
     m_page->focusController()->setFocused(isFocused);
 }
 
@@ -1176,6 +1199,13 @@ void WebPage::setUserAgent(const String& userAgent)
 {
     m_userAgent = userAgent;
 }
+    
+IntRect WebPage::windowToScreen(const IntRect& rect)
+{
+    IntRect screenRect;
+    sendSync(Messages::WebPageProxy::WindowToScreen(rect), Messages::WebPageProxy::WindowToScreen::Reply(screenRect));
+    return screenRect;
+}
 
 IntRect WebPage::windowResizerRect() const
 {
@@ -1353,6 +1383,9 @@ void WebPage::updatePreferences(const WebPreferencesStore& store)
     settings->setDOMPasteAllowed(store.getBoolValueForKey(WebPreferencesKey::domPasteAllowedKey()));
     settings->setJavaScriptCanAccessClipboard(store.getBoolValueForKey(WebPreferencesKey::javaScriptCanAccessClipboardKey()));
     settings->setShouldPrintBackgrounds(store.getBoolValueForKey(WebPreferencesKey::shouldPrintBackgroundsKey()));
+    settings->setWebSecurityEnabled(store.getBoolValueForKey(WebPreferencesKey::webSecurityEnabledKey()));
+    settings->setAllowUniversalAccessFromFileURLs(store.getBoolValueForKey(WebPreferencesKey::allowUniversalAccessFromFileURLsKey()));
+    settings->setAllowFileAccessFromFileURLs(store.getBoolValueForKey(WebPreferencesKey::allowFileAccessFromFileURLsKey()));
 
     settings->setMinimumFontSize(store.getUInt32ValueForKey(WebPreferencesKey::minimumFontSizeKey()));
     settings->setMinimumLogicalFontSize(store.getUInt32ValueForKey(WebPreferencesKey::minimumLogicalFontSizeKey()));
@@ -1363,9 +1396,11 @@ void WebPage::updatePreferences(const WebPreferencesStore& store)
     // Temporarily turn off accelerated compositing until we have a good solution for rendering it.
     settings->setAcceleratedCompositingEnabled(false);
     settings->setAcceleratedDrawingEnabled(false);
+    settings->setCanvasUsesAcceleratedDrawing(false);
 #else
     settings->setAcceleratedCompositingEnabled(store.getBoolValueForKey(WebPreferencesKey::acceleratedCompositingEnabledKey()));
     settings->setAcceleratedDrawingEnabled(store.getBoolValueForKey(WebPreferencesKey::acceleratedDrawingEnabledKey()));
+    settings->setCanvasUsesAcceleratedDrawing(store.getBoolValueForKey(WebPreferencesKey::canvasUsesAcceleratedDrawingKey()));
 #endif
     settings->setShowDebugBorders(store.getBoolValueForKey(WebPreferencesKey::compositingBordersVisibleKey()));
     settings->setShowRepaintCounter(store.getBoolValueForKey(WebPreferencesKey::compositingRepaintCountersVisibleKey()));
@@ -1375,6 +1410,14 @@ void WebPage::updatePreferences(const WebPreferencesStore& store)
     AbstractDatabase::setIsAvailable(store.getBoolValueForKey(WebPreferencesKey::databasesEnabledKey()));
 #endif
 
+#if ENABLE(FULLSCREEN_API)
+    settings->setFullScreenEnabled(store.getBoolValueForKey(WebPreferencesKey::fullScreenEnabledKey()));
+#endif
+
+#if ENABLE(DOM_STORAGE)
+    settings->setLocalStorageDatabasePath(WebProcess::shared().localStorageDirectory());
+#endif
+
     platformPreferencesDidChange(store);
 }
 
@@ -1389,6 +1432,15 @@ WebInspector* WebPage::inspector()
 }
 #endif
 
+#if ENABLE(FULLSCREEN_API)
+WebFullScreenManager* WebPage::fullScreenManager()
+{
+    if (!m_fullScreenManager)
+        m_fullScreenManager = WebFullScreenManager::create(this);
+    return m_fullScreenManager.get();
+}
+#endif
+
 #if !PLATFORM(MAC)
 bool WebPage::handleEditingKeyboardEvent(KeyboardEvent* evt)
 {
@@ -1488,6 +1540,7 @@ void WebPage::dragEnded(WebCore::IntPoint clientPosition, WebCore::IntPoint glob
     IntPoint adjustedClientPosition(clientPosition.x() + m_page->dragController()->dragOffset().x(), clientPosition.y() + m_page->dragController()->dragOffset().y());
     IntPoint adjustedGlobalPosition(globalPosition.x() + m_page->dragController()->dragOffset().x(), globalPosition.y() + m_page->dragController()->dragOffset().y());
     
+    platformDragEnded();
     m_page->dragController()->dragEnded();
     FrameView* view = m_page->mainFrame()->view();
     if (!view)
@@ -1729,13 +1782,13 @@ void WebPage::windowAndViewFramesChanged(const WebCore::IntRect& windowFrameInSc
         (*it)->windowAndViewFramesChanged(windowFrameInScreenCoordinates, viewFrameInWindowCoordinates);
 }
 
+#endif
+    
 bool WebPage::windowIsFocused() const
 {
     return m_page->focusController()->isActive();
 }
-
-#endif
-
+    
 void WebPage::didReceiveMessage(CoreIPC::Connection* connection, CoreIPC::MessageID messageID, CoreIPC::ArgumentDecoder* arguments)
 {
     if (messageID.is<CoreIPC::MessageClassDrawingAreaLegacy>()) {
@@ -1760,6 +1813,13 @@ void WebPage::didReceiveMessage(CoreIPC::Connection* connection, CoreIPC::Messag
     }
 #endif
 
+#if ENABLE(FULLSCREEN_API)
+    if (messageID.is<CoreIPC::MessageClassWebFullScreenManager>()) {
+        fullScreenManager()->didReceiveMessage(connection, messageID, arguments);
+        return;
+    }
+#endif
+
     didReceiveWebPageMessage(connection, messageID, arguments);
 }
 
@@ -1998,6 +2058,7 @@ void WebPage::drawRectToPDF(uint64_t frameID, const WebCore::IntRect& rect, uint
     if (coreFrame) {
         ASSERT(coreFrame->document()->printing());
 
+#if PLATFORM(CG)
         // FIXME: Use CGDataConsumerCreate with callbacks to avoid copying the data.
         RetainPtr<CGDataConsumerRef> pdfDataConsumer(AdoptCF, CGDataConsumerCreateWithCFData(pdfPageData.get()));
 
@@ -2013,6 +2074,7 @@ void WebPage::drawRectToPDF(uint64_t frameID, const WebCore::IntRect& rect, uint
 
         CGPDFContextEndPage(context.get());
         CGPDFContextClose(context.get());
+#endif
     }
 
     send(Messages::WebPageProxy::DataCallback(CoreIPC::DataReference(CFDataGetBytePtr(pdfPageData.get()), CFDataGetLength(pdfPageData.get())), callbackID));
@@ -2028,6 +2090,7 @@ void WebPage::drawPagesToPDF(uint64_t frameID, uint32_t first, uint32_t count, u
     if (coreFrame) {
         ASSERT(coreFrame->document()->printing());
 
+#if PLATFORM(CG)
         // FIXME: Use CGDataConsumerCreate with callbacks to avoid copying the data.
         RetainPtr<CGDataConsumerRef> pdfDataConsumer(AdoptCF, CGDataConsumerCreateWithCFData(pdfPageData.get()));
 
@@ -2048,6 +2111,7 @@ void WebPage::drawPagesToPDF(uint64_t frameID, uint32_t first, uint32_t count, u
             CGPDFContextEndPage(context.get());
         }
         CGPDFContextClose(context.get());
+#endif
     }
 
     send(Messages::WebPageProxy::DataCallback(CoreIPC::DataReference(CFDataGetBytePtr(pdfPageData.get()), CFDataGetLength(pdfPageData.get())), callbackID));
@@ -2072,4 +2136,27 @@ void WebPage::setMemoryCacheMessagesEnabled(bool memoryCacheMessagesEnabled)
     m_page->setMemoryCacheClientCallsEnabled(memoryCacheMessagesEnabled);
 }
 
+#if !PLATFORM(MAC)
+void WebPage::platformDragEnded()
+{
+}
+#endif
+
+bool WebPage::canHandleRequest(const WebCore::ResourceRequest& request)
+{
+    if (SchemeRegistry::shouldLoadURLSchemeAsEmptyDocument(request.url().protocol()))
+        return true;
+    return platformCanHandleRequest(request);
+}
+
+#if PLATFORM(MAC) && !defined(BUILDING_ON_SNOW_LEOPARD)
+void WebPage::handleCorrectionPanelResult(const String& result)
+{
+    Frame* frame = m_page->focusController()->focusedOrMainFrame();
+    if (!frame)
+        return;
+    frame->editor()->handleCorrectionPanelResult(result);
+}
+#endif
+
 } // namespace WebKit
diff --git a/Source/WebKit2/WebProcess/WebPage/WebPage.h b/Source/WebKit2/WebProcess/WebPage/WebPage.h
index 8ce6405..8e4e71c 100644
--- a/Source/WebKit2/WebProcess/WebPage/WebPage.h
+++ b/Source/WebKit2/WebProcess/WebPage/WebPage.h
@@ -46,6 +46,7 @@
 #include <WebCore/Editor.h>
 #include <WebCore/FrameLoaderTypes.h>
 #include <WebCore/IntRect.h>
+#include <WebCore/ScrollTypes.h>
 #include <WebCore/WebCoreKeyboardUIMode.h>
 #include <wtf/HashMap.h>
 #include <wtf/OwnPtr.h>
@@ -61,6 +62,8 @@
 #include "DictionaryPopupInfo.h"
 #include <wtf/RetainPtr.h>
 OBJC_CLASS AccessibilityWebPageObject;
+OBJC_CLASS NSDictionary;
+OBJC_CLASS NSObject;
 #endif
 
 namespace CoreIPC {
@@ -77,6 +80,7 @@ namespace WebCore {
     class Range;
     class ResourceRequest;
     class SharedBuffer;
+    class VisibleSelection;
 }
 
 namespace WebKit {
@@ -90,6 +94,7 @@ class WebContextMenu;
 class WebContextMenuItemData;
 class WebEvent;
 class WebFrame;
+class WebFullScreenManager;
 class WebImage;
 class WebInspector;
 class WebKeyboardEvent;
@@ -137,10 +142,16 @@ public:
 
     void scrollMainFrameIfNotAtMaxScrollPosition(const WebCore::IntSize& scrollOffset);
 
+    void scrollBy(uint32_t scrollDirection, uint32_t scrollGranularity);
+
 #if ENABLE(INSPECTOR)
     WebInspector* inspector();
 #endif
 
+#if ENABLE(FULLSCREEN_API)
+    WebFullScreenManager* fullScreenManager();
+#endif
+
     // -- Called by the DrawingArea.
     // FIXME: We could genericize these into a DrawingArea client interface. Would that be beneficial?
     void drawRect(WebCore::GraphicsContext&, const WebCore::IntRect&);
@@ -229,15 +240,16 @@ public:
     bool windowIsVisible() const { return m_windowIsVisible; }
     const WebCore::IntRect& windowFrameInScreenCoordinates() const { return m_windowFrameInScreenCoordinates; }
     const WebCore::IntRect& viewFrameInWindowCoordinates() const { return m_viewFrameInWindowCoordinates; }
-    bool windowIsFocused() const;
     bool interceptEditingKeyboardEvent(WebCore::KeyboardEvent*, bool);
 #elif PLATFORM(WIN)
     HWND nativeWindow() const { return m_nativeWindow; }
 #endif
 
+    bool windowIsFocused() const;
     void installPageOverlay(PassRefPtr<PageOverlay>);
     void uninstallPageOverlay(PageOverlay*);
     bool hasPageOverlay() const { return m_pageOverlay; }
+    WebCore::IntRect windowToScreen(const WebCore::IntRect&);
 
     PassRefPtr<WebImage> snapshotInViewCoordinates(const WebCore::IntRect&, ImageOptions);
     PassRefPtr<WebImage> snapshotInDocumentCoordinates(const WebCore::IntRect&, ImageOptions);
@@ -250,7 +262,7 @@ public:
 
     void pageDidScroll();
 #if ENABLE(TILED_BACKING_STORE)
-    void pageDidRequestScroll(const WebCore::IntSize& delta);
+    void pageDidRequestScroll(const WebCore::IntPoint&);
     void setActualVisibleContentRect(const WebCore::IntRect&);
 
     bool resizesToContentsEnabled() const { return !m_resizesToContentsLayoutSize.isEmpty(); }
@@ -297,6 +309,7 @@ public:
     void characterIndexForPoint(const WebCore::IntPoint point, uint64_t& result);
     void firstRectForCharacterRange(uint64_t location, uint64_t length, WebCore::IntRect& resultRect);
     void writeSelectionToPasteboard(const WTF::String& pasteboardName, const WTF::Vector<WTF::String>& pasteboardTypes, bool& result);
+    void readSelectionFromPasteboard(const WTF::String& pasteboardName, bool& result);
 #elif PLATFORM(WIN)
     void confirmComposition(const String& compositionString);
     void setComposition(const WTF::String& compositionString, const WTF::Vector<WebCore::CompositionUnderline>& underlines, uint64_t cursorPosition);
@@ -309,7 +322,7 @@ public:
     void dummy(bool&);
 
 #if PLATFORM(MAC)
-    void performDictionaryLookupForRange(DictionaryPopupInfo::Type, WebCore::Frame*, WebCore::Range*);
+    void performDictionaryLookupForSelection(DictionaryPopupInfo::Type, WebCore::Frame*, const WebCore::VisibleSelection&);
 
     bool isSpeaking();
     void speak(const String&);
@@ -346,10 +359,20 @@ public:
 
     void runModal();
 
+    float userSpaceScaleFactor() const { return m_userSpaceScaleFactor; }
+
     void setMemoryCacheMessagesEnabled(bool);
 
     void forceRepaintWithoutCallback();
 
+#if PLATFORM(MAC)
+    void setDragSource(NSObject *);
+#endif
+
+#if PLATFORM(MAC) && !defined(BUILDING_ON_SNOW_LEOPARD)
+    void handleCorrectionPanelResult(const String&);
+#endif
+
 private:
     WebPage(uint64_t pageID, const WebPageCreationParameters&);
 
@@ -398,6 +421,9 @@ private:
     void touchEvent(const WebTouchEvent&);
 #endif
 
+    static void scroll(WebCore::Page*, WebCore::ScrollDirection, WebCore::ScrollGranularity);
+    static void logicalScroll(WebCore::Page*, WebCore::ScrollLogicalDirection, WebCore::ScrollGranularity);
+
     uint64_t restoreSession(const SessionState&);
     void restoreSessionAndNavigateToCurrentItem(const SessionState&, const SandboxExtension::Handle&);
 
@@ -429,6 +455,7 @@ private:
 
 #if PLATFORM(MAC)
     void performDictionaryLookupAtLocation(const WebCore::FloatPoint&);
+    void performDictionaryLookupForRange(DictionaryPopupInfo::Type, WebCore::Frame*, WebCore::Range*, NSDictionary *options);
 
     void setWindowIsVisible(bool windowIsVisible);
     void windowAndViewFramesChanged(const WebCore::IntRect& windowFrameInScreenCoordinates, const WebCore::IntRect& viewFrameInWindowCoordinates, const WebCore::IntPoint& accessibilityViewCoordinates);
@@ -473,6 +500,10 @@ private:
     void didSelectItemFromActiveContextMenu(const WebContextMenuItemData&);
 #endif
 
+    void platformDragEnded();
+
+    static bool platformCanHandleRequest(const WebCore::ResourceRequest&);
+
     OwnPtr<WebCore::Page> m_page;
     RefPtr<WebFrame> m_mainFrame;
     RefPtr<InjectedBundleBackForwardList> m_backForwardList;
@@ -512,6 +543,8 @@ private:
     HashSet<PluginView*> m_pluginViews;
     
     RetainPtr<AccessibilityWebPageObject> m_mockAccessibilityElement;
+
+    RetainPtr<NSObject> m_dragSource;
 #elif PLATFORM(WIN)
     // Our view's window (in the UI process).
     HWND m_nativeWindow;
@@ -539,6 +572,9 @@ private:
 #if ENABLE(INSPECTOR)
     RefPtr<WebInspector> m_inspector;
 #endif
+#if ENABLE(FULLSCREEN_API)
+    RefPtr<WebFullScreenManager> m_fullScreenManager;
+#endif
     RefPtr<WebPopupMenu> m_activePopupMenu;
     RefPtr<WebContextMenu> m_contextMenu;
     RefPtr<WebOpenPanelResultListener> m_activeOpenPanelResultListener;
@@ -554,6 +590,8 @@ private:
     bool m_canRunModal;
     bool m_isRunningModal;
 
+    float m_userSpaceScaleFactor;
+
     bool m_cachedMainFrameIsPinnedToLeftSide;
     bool m_cachedMainFrameIsPinnedToRightSide;
 };
diff --git a/Source/WebKit2/WebProcess/WebPage/WebPage.messages.in b/Source/WebKit2/WebProcess/WebPage/WebPage.messages.in
index 0c0eea5..69bd54d 100644
--- a/Source/WebKit2/WebProcess/WebPage/WebPage.messages.in
+++ b/Source/WebKit2/WebProcess/WebPage/WebPage.messages.in
@@ -42,6 +42,8 @@ messages -> WebPage {
     TouchEvent(WebKit::WebTouchEvent event)
 #endif
 
+    ScrollBy(uint32_t scrollDirection, uint32_t scrollGranularity)
+
     GoBack(uint64_t backForwardItemID, WebKit::SandboxExtension::Handle sandboxExtensionHandle)
     GoForward(uint64_t backForwardItemID, WebKit::SandboxExtension::Handle sandboxExtensionHandle)
     GoToBackForwardItem(uint64_t backForwardItemID, WebKit::SandboxExtension::Handle sandboxExtensionHandle)
@@ -55,6 +57,7 @@ messages -> WebPage {
 
     StopLoadingFrame(uint64_t frameID)
     
+    RestoreSession(WebKit::SessionState state)
     RestoreSessionAndNavigateToCurrentItem(WebKit::SessionState state, WebKit::SandboxExtension::Handle sandboxExtensionHandle)
 
     DidRemoveBackForwardItem(uint64_t backForwardItemID)
@@ -181,6 +184,7 @@ messages -> WebPage {
     FirstRectForCharacterRange(uint64_t location, uint64_t length) -> (WebCore::IntRect resultRect)
     RegisterUIProcessAccessibilityTokens(CoreIPC::DataReference elemenToken, CoreIPC::DataReference windowToken)
     WriteSelectionToPasteboard(WTF::String pasteboardName, WTF::Vector<WTF::String> pasteboardTypes) -> (bool result)
+    ReadSelectionFromPasteboard(WTF::String pasteboardName) -> (bool result)
 #endif
 #if PLATFORM(WIN)
     ConfirmComposition(WTF::String compositionString)
@@ -191,4 +195,8 @@ messages -> WebPage {
 #if PLATFORM(QT)
     FindZoomableAreaForPoint(WebCore::IntPoint point)
 #endif
+
+#if PLATFORM(MAC) && !defined(BUILDING_ON_SNOW_LEOPARD)
+    HandleCorrectionPanelResult(String result)
+#endif
 }
diff --git a/Source/WebKit2/WebProcess/WebPage/mac/LayerTreeHostMac.mm b/Source/WebKit2/WebProcess/WebPage/ca/LayerTreeHostCA.cpp
index 494f5e6..2460607 100644
--- a/Source/WebKit2/WebProcess/WebPage/mac/LayerTreeHostMac.mm
+++ b/Source/WebKit2/WebProcess/WebPage/ca/LayerTreeHostCA.cpp
@@ -23,39 +23,31 @@
  * THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#import "config.h"
-#import "LayerTreeHostMac.h"
-
-#import "DrawingAreaImpl.h"
-#import "WebPage.h"
-#import "WebProcess.h"
-#import <QuartzCore/CATransaction.h>
-#import <WebCore/Frame.h>
-#import <WebCore/FrameView.h>
-#import <WebCore/Page.h>
-#import <WebCore/Settings.h>
-#import <WebKitSystemInterface.h>
-
-@interface CATransaction (Details)
-+ (void)synchronize;
-@end
+#include "config.h"
+#include "LayerTreeHostCA.h"
+
+#include "DrawingAreaImpl.h"
+#include "WebPage.h"
+#include "WebProcess.h"
+#include <WebCore/Frame.h>
+#include <WebCore/FrameView.h>
+#include <WebCore/Page.h>
+#include <WebCore/Settings.h>
 
 using namespace WebCore;
 
 namespace WebKit {
 
-PassRefPtr<LayerTreeHostMac> LayerTreeHostMac::create(WebPage* webPage)
+PassRefPtr<LayerTreeHostCA> LayerTreeHostCA::create(WebPage* webPage)
 {
-    return adoptRef(new LayerTreeHostMac(webPage));
+    return adoptRef(new LayerTreeHostCA(webPage));
 }
 
-LayerTreeHostMac::LayerTreeHostMac(WebPage* webPage)
+LayerTreeHostCA::LayerTreeHostCA(WebPage* webPage)
     : LayerTreeHost(webPage)
     , m_isValid(true)
     , m_notifyAfterScheduledLayerFlush(false)
 {
-    mach_port_t serverPort = WebProcess::shared().compositingRenderServerPort();
-    m_remoteLayerClient = WKCARemoteLayerClientMakeWithServerPort(serverPort);
 
     // Create a root layer.
     m_rootLayer = GraphicsLayer::create(this);
@@ -65,8 +57,6 @@ LayerTreeHostMac::LayerTreeHostMac(WebPage* webPage)
     m_rootLayer->setDrawsContent(false);
     m_rootLayer->setSize(webPage->size());
 
-    [m_rootLayer->platformLayer() setGeometryFlipped:YES];
-
     m_nonCompositedContentLayer = GraphicsLayer::create(this);
 #ifndef NDEBUG
     m_nonCompositedContentLayer->setName("LayerTreeHost non-composited content");
@@ -79,53 +69,35 @@ LayerTreeHostMac::LayerTreeHostMac(WebPage* webPage)
 
     m_rootLayer->addChild(m_nonCompositedContentLayer.get());
 
-    WKCARemoteLayerClientSetLayer(m_remoteLayerClient.get(), m_rootLayer->platformLayer());
-
     if (m_webPage->hasPageOverlay())
         createPageOverlayLayer();
 
-    scheduleLayerFlush();
+    platformInitialize();
 
-    m_layerTreeContext.contextID = WKCARemoteLayerClientGetClientId(m_remoteLayerClient.get());
+    scheduleLayerFlush();
 }
 
-LayerTreeHostMac::~LayerTreeHostMac()
+LayerTreeHostCA::~LayerTreeHostCA()
 {
     ASSERT(!m_isValid);
+    ASSERT(!m_rootLayer);
+#if PLATFORM(MAC)
     ASSERT(!m_flushPendingLayerChangesRunLoopObserver);
     ASSERT(!m_remoteLayerClient);
-    ASSERT(!m_rootLayer);
+#endif
 }
 
-const LayerTreeContext& LayerTreeHostMac::layerTreeContext()
+const LayerTreeContext& LayerTreeHostCA::layerTreeContext()
 {
     return m_layerTreeContext;
 }
 
-void LayerTreeHostMac::scheduleLayerFlush()
-{
-    CFRunLoopRef currentRunLoop = CFRunLoopGetCurrent();
-    
-    // Make sure we wake up the loop or the observer could be delayed until some other source fires.
-    CFRunLoopWakeUp(currentRunLoop);
-
-    if (m_flushPendingLayerChangesRunLoopObserver)
-        return;
-
-    // Run before the Core Animation commit observer, which has order 2000000.
-    const CFIndex runLoopOrder = 2000000 - 1;
-    CFRunLoopObserverContext context = { 0, this, 0, 0, 0 };
-    m_flushPendingLayerChangesRunLoopObserver.adoptCF(CFRunLoopObserverCreate(0, kCFRunLoopBeforeWaiting | kCFRunLoopExit, true, runLoopOrder, flushPendingLayerChangesRunLoopObserverCallback, &context));
-
-    CFRunLoopAddObserver(currentRunLoop, m_flushPendingLayerChangesRunLoopObserver.get(), kCFRunLoopCommonModes);
-}
-
-void LayerTreeHostMac::setShouldNotifyAfterNextScheduledLayerFlush(bool notifyAfterScheduledLayerFlush)
+void LayerTreeHostCA::setShouldNotifyAfterNextScheduledLayerFlush(bool notifyAfterScheduledLayerFlush)
 {
     m_notifyAfterScheduledLayerFlush = notifyAfterScheduledLayerFlush;
 }
 
-void LayerTreeHostMac::setRootCompositingLayer(GraphicsLayer* graphicsLayer)
+void LayerTreeHostCA::setRootCompositingLayer(GraphicsLayer* graphicsLayer)
 {
     m_nonCompositedContentLayer->removeAllChildren();
 
@@ -134,22 +106,15 @@ void LayerTreeHostMac::setRootCompositingLayer(GraphicsLayer* graphicsLayer)
         m_nonCompositedContentLayer->addChild(graphicsLayer);
 }
 
-void LayerTreeHostMac::invalidate()
+void LayerTreeHostCA::invalidate()
 {
     ASSERT(m_isValid);
-
-    if (m_flushPendingLayerChangesRunLoopObserver) {
-        CFRunLoopObserverInvalidate(m_flushPendingLayerChangesRunLoopObserver.get());
-        m_flushPendingLayerChangesRunLoopObserver = nullptr;
-    }
-
-    WKCARemoteLayerClientInvalidate(m_remoteLayerClient.get());
-    m_remoteLayerClient = nullptr;
+    platformInvalidate();
     m_rootLayer = nullptr;
     m_isValid = false;
 }
 
-void LayerTreeHostMac::setNonCompositedContentsNeedDisplay(const IntRect& rect)
+void LayerTreeHostCA::setNonCompositedContentsNeedDisplay(const IntRect& rect)
 {
     m_nonCompositedContentLayer->setNeedsDisplayInRect(rect);
     if (m_pageOverlayLayer)
@@ -158,12 +123,12 @@ void LayerTreeHostMac::setNonCompositedContentsNeedDisplay(const IntRect& rect)
     scheduleLayerFlush();
 }
 
-void LayerTreeHostMac::scrollNonCompositedContents(const IntRect& scrollRect, const IntSize& scrollOffset)
+void LayerTreeHostCA::scrollNonCompositedContents(const IntRect& scrollRect, const IntSize& scrollOffset)
 {
     setNonCompositedContentsNeedDisplay(scrollRect);
 }
 
-void LayerTreeHostMac::sizeDidChange(const IntSize& newSize)
+void LayerTreeHostCA::sizeDidChange(const IntSize& newSize)
 {
     m_rootLayer->setSize(newSize);
     m_nonCompositedContentLayer->setSize(newSize);
@@ -174,47 +139,45 @@ void LayerTreeHostMac::sizeDidChange(const IntSize& newSize)
     scheduleLayerFlush();
     flushPendingLayerChanges();
 
-    [CATransaction flush];
-    [CATransaction synchronize];
+    platformSizeDidChange();
 }
 
-void LayerTreeHostMac::forceRepaint()
+void LayerTreeHostCA::forceRepaint()
 {
     scheduleLayerFlush();
     flushPendingLayerChanges();
 
-    [CATransaction flush];
-    [CATransaction synchronize];
+    platformForceRepaint();
 }    
 
-void LayerTreeHostMac::didInstallPageOverlay()
+void LayerTreeHostCA::didInstallPageOverlay()
 {
     createPageOverlayLayer();
     scheduleLayerFlush();
 }
 
-void LayerTreeHostMac::didUninstallPageOverlay()
+void LayerTreeHostCA::didUninstallPageOverlay()
 {
     destroyPageOverlayLayer();
     scheduleLayerFlush();
 }
 
-void LayerTreeHostMac::setPageOverlayNeedsDisplay(const IntRect& rect)
+void LayerTreeHostCA::setPageOverlayNeedsDisplay(const IntRect& rect)
 {
     ASSERT(m_pageOverlayLayer);
     m_pageOverlayLayer->setNeedsDisplayInRect(rect);
     scheduleLayerFlush();
 }
 
-void LayerTreeHostMac::notifyAnimationStarted(const WebCore::GraphicsLayer*, double time)
+void LayerTreeHostCA::notifyAnimationStarted(const WebCore::GraphicsLayer*, double time)
 {
 }
 
-void LayerTreeHostMac::notifySyncRequired(const WebCore::GraphicsLayer*)
+void LayerTreeHostCA::notifySyncRequired(const WebCore::GraphicsLayer*)
 {
 }
 
-void LayerTreeHostMac::paintContents(const GraphicsLayer* graphicsLayer, GraphicsContext& graphicsContext, GraphicsLayerPaintingPhase, const IntRect& clipRect)
+void LayerTreeHostCA::paintContents(const GraphicsLayer* graphicsLayer, GraphicsContext& graphicsContext, GraphicsLayerPaintingPhase, const IntRect& clipRect)
 {
     if (graphicsLayer == m_nonCompositedContentLayer) {
         m_webPage->drawRect(graphicsContext, clipRect);
@@ -227,25 +190,20 @@ void LayerTreeHostMac::paintContents(const GraphicsLayer* graphicsLayer, Graphic
     }
 }
 
-bool LayerTreeHostMac::showDebugBorders() const
+bool LayerTreeHostCA::showDebugBorders() const
 {
     return m_webPage->corePage()->settings()->showDebugBorders();
 }
 
-bool LayerTreeHostMac::showRepaintCounter() const
+bool LayerTreeHostCA::showRepaintCounter() const
 {
     return m_webPage->corePage()->settings()->showRepaintCounter();
 }
 
-void LayerTreeHostMac::flushPendingLayerChangesRunLoopObserverCallback(CFRunLoopObserverRef, CFRunLoopActivity, void* context)
-{
-    static_cast<LayerTreeHostMac*>(context)->flushPendingLayerChangesRunLoopObserverCallback();
-}
-
-void LayerTreeHostMac::flushPendingLayerChangesRunLoopObserverCallback()
+void LayerTreeHostCA::performScheduledLayerFlush()
 {
     {
-        RefPtr<LayerTreeHostMac> protect(this);
+        RefPtr<LayerTreeHostCA> protect(this);
         m_webPage->layoutIfNeeded();
 
         if (!m_isValid)
@@ -255,10 +213,12 @@ void LayerTreeHostMac::flushPendingLayerChangesRunLoopObserverCallback()
     if (!flushPendingLayerChanges())
         return;
 
-    // We successfully flushed the pending layer changes, remove the run loop observer.
-    ASSERT(m_flushPendingLayerChangesRunLoopObserver);
-    CFRunLoopObserverInvalidate(m_flushPendingLayerChangesRunLoopObserver.get());
-    m_flushPendingLayerChangesRunLoopObserver = 0;
+    didPerformScheduledLayerFlush();
+}
+
+void LayerTreeHostCA::didPerformScheduledLayerFlush()
+{
+    platformDidPerformScheduledLayerFlush();
 
     if (m_notifyAfterScheduledLayerFlush) {
         // Let the drawing area know that we've done a flush of the layer changes.
@@ -267,7 +227,7 @@ void LayerTreeHostMac::flushPendingLayerChangesRunLoopObserverCallback()
     }
 }
 
-bool LayerTreeHostMac::flushPendingLayerChanges()
+bool LayerTreeHostCA::flushPendingLayerChanges()
 {
     m_rootLayer->syncCompositingStateForThisLayerOnly();
     m_nonCompositedContentLayer->syncCompositingStateForThisLayerOnly();
@@ -277,7 +237,7 @@ bool LayerTreeHostMac::flushPendingLayerChanges()
     return m_webPage->corePage()->mainFrame()->view()->syncCompositingStateIncludingSubframes();
 }
 
-void LayerTreeHostMac::createPageOverlayLayer()
+void LayerTreeHostCA::createPageOverlayLayer()
 {
     ASSERT(!m_pageOverlayLayer);
 
@@ -292,7 +252,7 @@ void LayerTreeHostMac::createPageOverlayLayer()
     m_rootLayer->addChild(m_pageOverlayLayer.get());
 }
 
-void LayerTreeHostMac::destroyPageOverlayLayer()
+void LayerTreeHostCA::destroyPageOverlayLayer()
 {
     ASSERT(m_pageOverlayLayer);
     m_pageOverlayLayer->removeFromParent();
diff --git a/Source/WebKit2/WebProcess/WebPage/mac/LayerTreeHostMac.h b/Source/WebKit2/WebProcess/WebPage/ca/LayerTreeHostCA.h
index d05e43e..ba4e33a 100644
--- a/Source/WebKit2/WebProcess/WebPage/mac/LayerTreeHostMac.h
+++ b/Source/WebKit2/WebProcess/WebPage/ca/LayerTreeHostCA.h
@@ -23,26 +23,31 @@
  * THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef LayerTreeHostMac_h
-#define LayerTreeHostMac_h
+#ifndef LayerTreeHostCA_h
+#define LayerTreeHostCA_h
 
 #include "LayerTreeContext.h"
 #include "LayerTreeHost.h"
 #include <WebCore/GraphicsLayerClient.h>
 #include <wtf/OwnPtr.h>
+
+#if PLATFORM(MAC)
 #include <wtf/RetainPtr.h>
+#endif
 
+#if PLATFORM(MAC)
 typedef struct __WKCARemoteLayerClientRef* WKCARemoteLayerClientRef;
+#endif
 
 namespace WebKit {
 
-class LayerTreeHostMac : public LayerTreeHost, WebCore::GraphicsLayerClient {
+class LayerTreeHostCA : public LayerTreeHost, WebCore::GraphicsLayerClient {
 public:
-    static PassRefPtr<LayerTreeHostMac> create(WebPage*);
-    ~LayerTreeHostMac();
+    static PassRefPtr<LayerTreeHostCA> create(WebPage*);
+    ~LayerTreeHostCA();
     
 private:
-    explicit LayerTreeHostMac(WebPage*);
+    explicit LayerTreeHostCA(WebPage*);
 
     // LayerTreeHost.
     virtual const LayerTreeContext& layerTreeContext();
@@ -67,13 +72,23 @@ private:
     virtual bool showDebugBorders() const;
     virtual bool showRepaintCounter() const;
 
-    static void flushPendingLayerChangesRunLoopObserverCallback(CFRunLoopObserverRef, CFRunLoopActivity, void*);
-    void flushPendingLayerChangesRunLoopObserverCallback();
+    void platformInitialize();
+    void platformInvalidate();
+    void platformSizeDidChange();
+    void platformForceRepaint();
+
+    void performScheduledLayerFlush();
+    void didPerformScheduledLayerFlush();
+    void platformDidPerformScheduledLayerFlush();
     bool flushPendingLayerChanges();
 
     void createPageOverlayLayer();
     void destroyPageOverlayLayer();
 
+#if PLATFORM(MAC)
+    static void flushPendingLayerChangesRunLoopObserverCallback(CFRunLoopObserverRef, CFRunLoopActivity, void*);
+#endif
+
     // The context for this layer tree.
     LayerTreeContext m_layerTreeContext;
 
@@ -93,10 +108,12 @@ private:
     // The page overlay layer. Will be null if there's no page overlay.
     OwnPtr<WebCore::GraphicsLayer> m_pageOverlayLayer;
 
+#if PLATFORM(MAC)
     RetainPtr<WKCARemoteLayerClientRef> m_remoteLayerClient;
     RetainPtr<CFRunLoopObserverRef> m_flushPendingLayerChangesRunLoopObserver;
+#endif
 };
 
 } // namespace WebKit
 
-#endif // LayerTreeHostMac_h
+#endif // LayerTreeHostCA_h
diff --git a/Source/WebKit2/WebProcess/WebPage/ca/mac/LayerTreeHostCAMac.mm b/Source/WebKit2/WebProcess/WebPage/ca/mac/LayerTreeHostCAMac.mm
new file mode 100644
index 0000000..50776d7
--- /dev/null
+++ b/Source/WebKit2/WebProcess/WebPage/ca/mac/LayerTreeHostCAMac.mm
@@ -0,0 +1,109 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#import "config.h"
+#import "LayerTreeHostCA.h"
+
+#import "WebProcess.h"
+#import <QuartzCore/CATransaction.h>
+#import <WebCore/GraphicsLayer.h>
+#import <WebKitSystemInterface.h>
+
+@interface CATransaction (Details)
++ (void)synchronize;
+@end
+
+namespace WebKit {
+
+void LayerTreeHostCA::platformInitialize()
+{
+    mach_port_t serverPort = WebProcess::shared().compositingRenderServerPort();
+    m_remoteLayerClient = WKCARemoteLayerClientMakeWithServerPort(serverPort);
+
+    [m_rootLayer->platformLayer() setGeometryFlipped:YES];
+
+    WKCARemoteLayerClientSetLayer(m_remoteLayerClient.get(), m_rootLayer->platformLayer());
+
+    m_layerTreeContext.contextID = WKCARemoteLayerClientGetClientId(m_remoteLayerClient.get());
+}
+
+void LayerTreeHostCA::scheduleLayerFlush()
+{
+    CFRunLoopRef currentRunLoop = CFRunLoopGetCurrent();
+    
+    // Make sure we wake up the loop or the observer could be delayed until some other source fires.
+    CFRunLoopWakeUp(currentRunLoop);
+
+    if (m_flushPendingLayerChangesRunLoopObserver)
+        return;
+
+    // Run before the Core Animation commit observer, which has order 2000000.
+    const CFIndex runLoopOrder = 2000000 - 1;
+    CFRunLoopObserverContext context = { 0, this, 0, 0, 0 };
+    m_flushPendingLayerChangesRunLoopObserver.adoptCF(CFRunLoopObserverCreate(0, kCFRunLoopBeforeWaiting | kCFRunLoopExit, true, runLoopOrder, flushPendingLayerChangesRunLoopObserverCallback, &context));
+
+    CFRunLoopAddObserver(currentRunLoop, m_flushPendingLayerChangesRunLoopObserver.get(), kCFRunLoopCommonModes);
+}
+
+void LayerTreeHostCA::platformInvalidate()
+{
+    if (m_flushPendingLayerChangesRunLoopObserver) {
+        CFRunLoopObserverInvalidate(m_flushPendingLayerChangesRunLoopObserver.get());
+        m_flushPendingLayerChangesRunLoopObserver = nullptr;
+    }
+
+    WKCARemoteLayerClientInvalidate(m_remoteLayerClient.get());
+    m_remoteLayerClient = nullptr;
+}
+
+void LayerTreeHostCA::platformSizeDidChange()
+{
+    [CATransaction flush];
+    [CATransaction synchronize];
+}
+
+void LayerTreeHostCA::platformForceRepaint()
+{
+    [CATransaction flush];
+    [CATransaction synchronize];
+}    
+
+void LayerTreeHostCA::flushPendingLayerChangesRunLoopObserverCallback(CFRunLoopObserverRef, CFRunLoopActivity, void* context)
+{
+    // This gets called outside of the normal event loop so wrap in an autorelease pool
+    NSAutoreleasePool *pool = [[NSAutoreleasePool alloc] init];
+    static_cast<LayerTreeHostCA*>(context)->performScheduledLayerFlush();
+    [pool drain];
+}
+
+void LayerTreeHostCA::platformDidPerformScheduledLayerFlush()
+{
+    // We successfully flushed the pending layer changes, remove the run loop observer.
+    ASSERT(m_flushPendingLayerChangesRunLoopObserver);
+    CFRunLoopObserverInvalidate(m_flushPendingLayerChangesRunLoopObserver.get());
+    m_flushPendingLayerChangesRunLoopObserver = 0;
+}
+
+} // namespace WebKit
diff --git a/Source/WebKit2/WebProcess/WebPage/ca/win/LayerTreeHostCAWin.cpp b/Source/WebKit2/WebProcess/WebPage/ca/win/LayerTreeHostCAWin.cpp
new file mode 100644
index 0000000..81db03e
--- /dev/null
+++ b/Source/WebKit2/WebProcess/WebPage/ca/win/LayerTreeHostCAWin.cpp
@@ -0,0 +1,69 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "LayerTreeHostCA.h"
+
+#include <WebCore/NotImplemented.h>
+
+namespace WebKit {
+
+void LayerTreeHostCA::platformInitialize()
+{
+    // FIXME: <http://webkit.org/b/45567> Implement this!
+    notImplemented();
+}
+
+void LayerTreeHostCA::scheduleLayerFlush()
+{
+    // FIXME: <http://webkit.org/b/45567> Implement this!
+    notImplemented();
+}
+
+void LayerTreeHostCA::platformInvalidate()
+{
+    // FIXME: <http://webkit.org/b/45567> Implement this!
+    notImplemented();
+}
+
+void LayerTreeHostCA::platformSizeDidChange()
+{
+    // FIXME: <http://webkit.org/b/45567> Implement this!
+    notImplemented();
+}
+
+void LayerTreeHostCA::platformForceRepaint()
+{
+    // FIXME: <http://webkit.org/b/45567> Implement this!
+    notImplemented();
+}
+
+void LayerTreeHostCA::platformDidPerformScheduledLayerFlush()
+{
+    // FIXME: <http://webkit.org/b/45567> Implement this!
+    notImplemented();
+}
+
+} // namespace WebKit
diff --git a/Source/WebKit2/WebProcess/WebPage/mac/AccessibilityWebPageObject.mm b/Source/WebKit2/WebProcess/WebPage/mac/AccessibilityWebPageObject.mm
index c88ab7e..1d036fa 100644
--- a/Source/WebKit2/WebProcess/WebPage/mac/AccessibilityWebPageObject.mm
+++ b/Source/WebKit2/WebProcess/WebPage/mac/AccessibilityWebPageObject.mm
@@ -175,10 +175,12 @@ using namespace WebKit;
     point.y -= remotePosition.y;
     point.x -= remotePosition.x;
     
-    WebCore::FrameView* fv = m_page->mainFrame()->coreFrame()->view();
-    if (fv) {
-        point.y += fv->scrollPosition().y();
-        point.x += fv->scrollPosition().x();
+    if (m_page && m_page->mainFrame() && m_page->mainFrame()->coreFrame()) {
+        WebCore::FrameView* fv = m_page->mainFrame()->coreFrame()->view();
+        if (fv) {
+            point.y += fv->scrollPosition().y();
+            point.x += fv->scrollPosition().x();
+        }
     }
     
     return [[self accessibilityRootObjectWrapper] accessibilityHitTest:point];
@@ -186,7 +188,7 @@ using namespace WebKit;
 
 - (id)accessibilityFocusedUIElement 
 {
-    return NSAccessibilityUnignoredDescendant(self);
+    return [[self accessibilityRootObjectWrapper] accessibilityFocusedUIElement];
 }
 
 
diff --git a/Source/WebKit2/WebProcess/WebPage/mac/WebPageMac.mm b/Source/WebKit2/WebProcess/WebPage/mac/WebPageMac.mm
index 4cae5aa..8d81889 100644
--- a/Source/WebKit2/WebProcess/WebPage/mac/WebPageMac.mm
+++ b/Source/WebKit2/WebProcess/WebPage/mac/WebPageMac.mm
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2010 Apple Inc. All rights reserved.
+ * Copyright (C) 2010, 2011 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -46,6 +46,7 @@
 #import <WebCore/ScrollView.h>
 #import <WebCore/TextIterator.h>
 #import <WebCore/WindowsKeyboardCodes.h>
+#import <WebCore/visible_units.h>
 #import <WebKitSystemInterface.h>
 
 using namespace WebCore;
@@ -76,8 +77,6 @@ void WebPage::platformPreferencesDidChange(const WebPreferencesStore&)
 {
 }
 
-// FIXME: need to add support for input methods
-    
 bool WebPage::interceptEditingKeyboardEvent(KeyboardEvent* evt, bool shouldSaveCommand)
 {
     Node* node = evt->target()->toNode();
@@ -164,12 +163,12 @@ void WebPage::getMarkedRange(uint64_t& location, uint64_t& length)
     getLocationAndLengthFromRange(frame->editor()->compositionRange().get(), location, length);
 }
 
-static PassRefPtr<Range> characterRangeAtPoint(Frame* frame, const IntPoint& point)
+
+static PassRefPtr<Range> characterRangeAtPositionForPoint(Frame* frame, const VisiblePosition& position, const IntPoint& point)
 {
-    VisiblePosition position = frame->visiblePositionForPoint(point);
     if (position.isNull())
         return 0;
-    
+
     VisiblePosition previous = position.previous();
     if (previous.isNotNull()) {
         RefPtr<Range> previousCharacterRange = makeRange(previous, position);
@@ -188,7 +187,12 @@ static PassRefPtr<Range> characterRangeAtPoint(Frame* frame, const IntPoint& poi
     
     return 0;
 }
-    
+
+static PassRefPtr<Range> characterRangeAtPoint(Frame* frame, const IntPoint& point)
+{
+    return characterRangeAtPositionForPoint(frame, frame->visiblePositionForPoint(point), point);
+}
+
 void WebPage::characterIndexForPoint(IntPoint point, uint64_t& index)
 {
     index = NSNotFound;
@@ -242,6 +246,32 @@ void WebPage::firstRectForCharacterRange(uint64_t location, uint64_t length, Web
     resultRect = frame->view()->contentsToWindow(rect);
 }
 
+static bool isPositionInRange(const VisiblePosition& position, Range* range)
+{
+    RefPtr<Range> positionRange = makeRange(position, position);
+
+    ExceptionCode ec = 0;
+    range->compareBoundaryPoints(Range::START_TO_START, positionRange.get(), ec);
+    if (ec)
+        return false;
+
+    if (!range->isPointInRange(positionRange->startContainer(), positionRange->startOffset(), ec))
+        return false;
+    if (ec)
+        return false;
+
+    return true;
+}
+
+static bool shouldUseSelection(const VisiblePosition& position, const VisibleSelection& selection)
+{
+    RefPtr<Range> selectedRange = selection.toNormalizedRange();
+    if (!selectedRange)
+        return false;
+
+    return isPositionInRange(position, selectedRange.get());
+}
+
 void WebPage::performDictionaryLookupAtLocation(const FloatPoint& floatPoint)
 {
     Frame* frame = m_page->mainFrame();
@@ -250,46 +280,78 @@ void WebPage::performDictionaryLookupAtLocation(const FloatPoint& floatPoint)
 
     // Find the frame the point is over.
     IntPoint point = roundedIntPoint(floatPoint);
-
     HitTestResult result = frame->eventHandler()->hitTestResultAtPoint(point, false);
     frame = result.innerNonSharedNode() ? result.innerNonSharedNode()->document()->frame() : m_page->focusController()->focusedOrMainFrame();
 
-    // Figure out if there are any characters under the point.
-    RefPtr<Range> characterRange = characterRangeAtPoint(frame, frame->view()->windowToContents(point));
-    if (!characterRange)
+    IntPoint translatedPoint = frame->view()->windowToContents(point);
+    VisiblePosition position = frame->visiblePositionForPoint(translatedPoint);
+
+    // Don't do anything if there is no character at the point.
+    if (!characterRangeAtPositionForPoint(frame, position, translatedPoint))
         return;
 
-    // Grab the currently selected text.
-    RefPtr<Range> selectedRange = m_page->focusController()->focusedOrMainFrame()->selection()->selection().toNormalizedRange();
-
-    // Use the selected text if the point was anywhere in it. Assertain this by seeing if either character range
-    // the mouse is over is contained by the selection range.
-    if (characterRange && selectedRange) {
-        ExceptionCode ec = 0;
-        selectedRange->compareBoundaryPoints(Range::START_TO_START, characterRange.get(), ec);
-        if (!ec) {
-            if (selectedRange->isPointInRange(characterRange->startContainer(), characterRange->startOffset(), ec)) {
-                if (!ec)
-                    characterRange = selectedRange;
-            }
-        }
+    VisibleSelection selection = m_page->focusController()->focusedOrMainFrame()->selection()->selection();
+    if (shouldUseSelection(position, selection)) {
+        performDictionaryLookupForSelection(DictionaryPopupInfo::HotKey, frame, selection);
+        return;
     }
 
-    if (!characterRange)
-        return;
+    NSDictionary *options = nil;
+
+#if !defined(BUILDING_ON_SNOW_LEOPARD)
+    // As context, we are going to use the surrounding paragraph of text.
+    VisiblePosition paragraphStart = startOfParagraph(position);
+    VisiblePosition paragraphEnd = endOfParagraph(position);
+
+    NSRange rangeToPass = NSMakeRange(TextIterator::rangeLength(makeRange(paragraphStart, position).get()), 0);
 
-    // Ensure we have whole words.
-    VisibleSelection selection(characterRange.get());
-    selection.expandUsingGranularity(WordGranularity);
+    RefPtr<Range> fullCharacterRange = makeRange(paragraphStart, paragraphEnd);
+    String fullPlainTextString = plainText(fullCharacterRange.get());
 
-    RefPtr<Range> finalRange = selection.toNormalizedRange();
+    NSRange extractedRange = WKExtractWordDefinitionTokenRangeFromContextualString(fullPlainTextString, rangeToPass, &options);
+
+    RefPtr<Range> finalRange = TextIterator::subrange(fullCharacterRange.get(), extractedRange.location, extractedRange.length);
+    if (!finalRange)
+        return;
+#else
+    RefPtr<Range> finalRange = makeRange(startOfWord(position), endOfWord(position));
     if (!finalRange)
         return;
+#endif
+
+    performDictionaryLookupForRange(DictionaryPopupInfo::HotKey, frame, finalRange.get(), options);
+}
+
+void WebPage::performDictionaryLookupForSelection(DictionaryPopupInfo::Type type, Frame* frame, const VisibleSelection& selection)
+{
+    RefPtr<Range> selectedRange = selection.toNormalizedRange();
+    if (!selectedRange)
+        return;
 
-    performDictionaryLookupForRange(DictionaryPopupInfo::HotKey, frame, finalRange.get());
+    NSDictionary *options = nil;
+
+#if !defined(BUILDING_ON_SNOW_LEOPARD)
+    VisiblePosition selectionStart = selection.visibleStart();
+    VisiblePosition selectionEnd = selection.visibleEnd();
+
+    // As context, we are going to use the surrounding paragraphs of text.
+    VisiblePosition paragraphStart = startOfParagraph(selectionStart);
+    VisiblePosition paragraphEnd = endOfParagraph(selectionEnd);
+
+    int lengthToSelectionStart = TextIterator::rangeLength(makeRange(paragraphStart, selectionStart).get());
+    int lengthToSelectionEnd = TextIterator::rangeLength(makeRange(paragraphStart, selectionEnd).get());
+    NSRange rangeToPass = NSMakeRange(lengthToSelectionStart, lengthToSelectionEnd - lengthToSelectionStart);
+
+    String fullPlainTextString = plainText(makeRange(paragraphStart, paragraphEnd).get());
+
+    // Since we already have the range we want, we just need to grab the returned options.
+    WKExtractWordDefinitionTokenRangeFromContextualString(fullPlainTextString, rangeToPass, &options);
+#endif
+
+    performDictionaryLookupForRange(type, frame, selectedRange.get(), options);
 }
 
-void WebPage::performDictionaryLookupForRange(DictionaryPopupInfo::Type type, Frame* frame, Range* range)
+void WebPage::performDictionaryLookupForRange(DictionaryPopupInfo::Type type, Frame* frame, Range* range, NSDictionary *options)
 {
     String rangeText = range->text();
     if (rangeText.stripWhiteSpace().isEmpty())
@@ -316,20 +378,11 @@ void WebPage::performDictionaryLookupForRange(DictionaryPopupInfo::Type type, Fr
     dictionaryPopupInfo.type = type;
     dictionaryPopupInfo.origin = FloatPoint(rangeRect.x(), rangeRect.y());
     dictionaryPopupInfo.fontInfo.fontAttributeDictionary = fontDescriptorAttributes;
+    dictionaryPopupInfo.options = (CFDictionaryRef)options;
 
     send(Messages::WebPageProxy::DidPerformDictionaryLookup(rangeText, dictionaryPopupInfo));
 }
 
-static inline void scroll(Page* page, ScrollDirection direction, ScrollGranularity granularity)
-{
-    page->focusController()->focusedOrMainFrame()->eventHandler()->scrollRecursively(direction, granularity);
-}
-
-static inline void logicalScroll(Page* page, ScrollLogicalDirection direction, ScrollGranularity granularity)
-{
-    page->focusController()->focusedOrMainFrame()->eventHandler()->logicalScrollRecursively(direction, granularity);
-}
-
 bool WebPage::performDefaultBehaviorForKeyEvent(const WebKeyboardEvent& keyboardEvent)
 {
     if (keyboardEvent.type() != WebEvent::KeyDown)
@@ -390,7 +443,7 @@ bool WebPage::performDefaultBehaviorForKeyEvent(const WebKeyboardEvent& keyboard
         if (keyboardEvent.metaKey())
             m_page->goBack();
         else {
-            if (keyboardEvent.altKey()  | keyboardEvent.controlKey())
+            if (keyboardEvent.altKey() || keyboardEvent.controlKey())
                 scroll(m_page.get(), ScrollLeft, ScrollByPage);
             else
                 scroll(m_page.get(), ScrollLeft, ScrollByLine);
@@ -435,6 +488,13 @@ void WebPage::writeSelectionToPasteboard(const String& pasteboardName, const Vec
     result = true;
 }
 
+void WebPage::readSelectionFromPasteboard(const String& pasteboardName, bool& result)
+{
+    Frame* frame = m_page->focusController()->focusedOrMainFrame();
+    frame->editor()->readSelectionFromPasteboard(pasteboardName);
+    result = true;
+}
+    
 AccessibilityWebPageObject* WebPage::accessibilityRemoteObject()
 {
     return m_mockAccessibilityElement.get();
@@ -472,13 +532,26 @@ String WebPage::cachedResponseMIMETypeForURL(const WebCore::KURL& url)
     return [[cachedResponse response] MIMEType];
 }
 
-bool WebPage::canHandleRequest(const WebCore::ResourceRequest& request)
+bool WebPage::platformCanHandleRequest(const WebCore::ResourceRequest& request)
 {
     if ([NSURLConnection canHandleRequest:request.nsURLRequest()])
-        return YES;
+        return true;
 
     // FIXME: Return true if this scheme is any one WebKit2 knows how to handle.
     return request.url().protocolIs("applewebdata");
 }
 
+void WebPage::setDragSource(NSObject *dragSource)
+{
+    m_dragSource = dragSource;
+}
+
+void WebPage::platformDragEnded()
+{
+    // The drag source we care about here is NSFilePromiseDragSource, which doesn't look at
+    // the arguments. It's OK to just pass arbitrary constant values, so we just pass all zeroes.
+    [m_dragSource.get() draggedImage:nil endedAt:NSZeroPoint operation:NSDragOperationNone];
+    m_dragSource = nullptr;
+}
+
 } // namespace WebKit
diff --git a/Source/WebKit2/WebProcess/WebPage/qt/WebPageQt.cpp b/Source/WebKit2/WebProcess/WebPage/qt/WebPageQt.cpp
index cad0c04..de8385c 100644
--- a/Source/WebKit2/WebProcess/WebPage/qt/WebPageQt.cpp
+++ b/Source/WebKit2/WebProcess/WebPage/qt/WebPageQt.cpp
@@ -277,7 +277,7 @@ String WebPage::cachedResponseMIMETypeForURL(const WebCore::KURL&)
     return String();
 }
 
-bool WebPage::canHandleRequest(const WebCore::ResourceRequest&)
+bool WebPage::platformCanHandleRequest(const WebCore::ResourceRequest&)
 {
     // FIXME: Implement
     return true;
diff --git a/Source/WebKit2/WebProcess/WebPage/win/WebPageWin.cpp b/Source/WebKit2/WebProcess/WebPage/win/WebPageWin.cpp
index 73ba2b2..41bb219 100644
--- a/Source/WebKit2/WebProcess/WebPage/win/WebPageWin.cpp
+++ b/Source/WebKit2/WebProcess/WebPage/win/WebPageWin.cpp
@@ -192,16 +192,6 @@ const char* WebPage::interpretKeyEvent(const KeyboardEvent* evt)
     return mapKey ? keyPressCommandsMap->get(mapKey) : 0;
 }
 
-static inline void scroll(Page* page, ScrollDirection direction, ScrollGranularity granularity)
-{
-    page->focusController()->focusedOrMainFrame()->eventHandler()->scrollRecursively(direction, granularity);
-}
-
-static inline void logicalScroll(Page* page, ScrollLogicalDirection direction, ScrollGranularity granularity)
-{
-    page->focusController()->focusedOrMainFrame()->eventHandler()->logicalScrollRecursively(direction, granularity);
-}
-
 bool WebPage::performDefaultBehaviorForKeyEvent(const WebKeyboardEvent& keyboardEvent)
 {
     if (keyboardEvent.type() != WebEvent::KeyDown && keyboardEvent.type() != WebEvent::RawKeyDown)
@@ -209,33 +199,53 @@ bool WebPage::performDefaultBehaviorForKeyEvent(const WebKeyboardEvent& keyboard
 
     switch (keyboardEvent.windowsVirtualKeyCode()) {
     case VK_BACK:
+        if (keyboardEvent.isSystemKey())
+            return false;
         if (keyboardEvent.shiftKey())
             m_page->goForward();
         else
             m_page->goBack();
         break;
     case VK_LEFT:
-        scroll(m_page.get(), ScrollLeft, ScrollByLine);
+        if (keyboardEvent.isSystemKey())
+            m_page->goBack();
+        else
+            scroll(m_page.get(), ScrollLeft, ScrollByLine);
         break;
     case VK_RIGHT:
-        scroll(m_page.get(), ScrollRight, ScrollByLine);
+        if (keyboardEvent.isSystemKey())
+            m_page->goForward();
+        else
+            scroll(m_page.get(), ScrollRight, ScrollByLine);
         break;
     case VK_UP:
+        if (keyboardEvent.isSystemKey())
+            return false;
         scroll(m_page.get(), ScrollUp, ScrollByLine);
         break;
     case VK_DOWN:
+        if (keyboardEvent.isSystemKey())
+            return false;
         scroll(m_page.get(), ScrollDown, ScrollByLine);
         break;
     case VK_HOME:
+        if (keyboardEvent.isSystemKey())
+            return false;
         logicalScroll(m_page.get(), ScrollBlockDirectionBackward, ScrollByDocument);
         break;
     case VK_END:
+        if (keyboardEvent.isSystemKey())
+            return false;
         logicalScroll(m_page.get(), ScrollBlockDirectionForward, ScrollByDocument);
         break;
     case VK_PRIOR:
+        if (keyboardEvent.isSystemKey())
+            return false;
         logicalScroll(m_page.get(), ScrollBlockDirectionBackward, ScrollByPage);
         break;
     case VK_NEXT:
+        if (keyboardEvent.isSystemKey())
+            return false;
         logicalScroll(m_page.get(), ScrollBlockDirectionForward, ScrollByPage);
         break;
     default:
@@ -296,10 +306,9 @@ String WebPage::cachedResponseMIMETypeForURL(const WebCore::KURL& url)
 #endif
 }
 
-bool WebPage::canHandleRequest(const WebCore::ResourceRequest& request)
+bool WebPage::platformCanHandleRequest(const WebCore::ResourceRequest& request)
 {
 #if USE(CFNETWORK)
-     // FIXME: Are there other requests we need to be able to handle? WebKit1's WebView.cpp has a FIXME here as well.
     return CFURLProtocolCanHandleRequest(request.cfURLRequest());
 #else
     return true;
diff --git a/Source/WebKit2/WebProcess/WebProcess.cpp b/Source/WebKit2/WebProcess/WebProcess.cpp
index 6de748f..ba3290b 100644
--- a/Source/WebKit2/WebProcess/WebProcess.cpp
+++ b/Source/WebKit2/WebProcess/WebProcess.cpp
@@ -41,6 +41,7 @@
 #include "WebFrame.h"
 #include "WebGeolocationManagerMessages.h"
 #include "WebKeyValueStorageManager.h"
+#include "WebMediaCacheManager.h"
 #include "WebMemorySampler.h"
 #include "WebPage.h"
 #include "WebPageCreationParameters.h"
@@ -50,6 +51,7 @@
 #include "WebProcessMessages.h"
 #include "WebProcessProxyMessages.h"
 #include "WebResourceCacheManager.h"
+#include <WebCore/AXObjectCache.h>
 #include <WebCore/ApplicationCacheStorage.h>
 #include <WebCore/CrossOriginPreflightResultCache.h>
 #include <WebCore/Font.h>
@@ -62,6 +64,7 @@
 #include <WebCore/SchemeRegistry.h>
 #include <WebCore/SecurityOrigin.h>
 #include <WebCore/Settings.h>
+#include <WebCore/StorageTracker.h>
 #include <wtf/PassRefPtr.h>
 #include <wtf/RandomNumber.h>
 
@@ -126,6 +129,7 @@ WebProcess::WebProcess()
 #endif
     , m_textCheckerState()
     , m_geolocationManager(this)
+    , m_iconDatabaseProxy(this)
 {
 #if USE(PLATFORM_STRATEGIES)
     // Initialize our platform strategies.
@@ -175,6 +179,15 @@ void WebProcess::initializeWebProcess(const WebProcessCreationParameters& parame
     WebDatabaseManager::initialize(parameters.databaseDirectory);
 #endif
 
+#if ENABLE(ICONDATABASE)
+    m_iconDatabaseProxy.setEnabled(parameters.iconDatabaseEnabled);
+#endif
+
+#if ENABLE(DOM_STORAGE)
+    StorageTracker::initializeTracker(parameters.localStorageDirectory);
+    m_localStorageDirectory = parameters.localStorageDirectory;
+#endif
+    
 #if ENABLE(OFFLINE_WEB_APPLICATIONS)
     if (!parameters.applicationCacheDirectory.isEmpty())
         cacheStorage().setCacheDirectory(parameters.applicationCacheDirectory);
@@ -453,6 +466,17 @@ void WebProcess::calculateCacheSizes(CacheModel cacheModel, uint64_t memorySize,
     };
 }
 
+WebPage* WebProcess::focusedWebPage() const
+{    
+    HashMap<uint64_t, RefPtr<WebPage> >::const_iterator end = m_pageMap.end();
+    for (HashMap<uint64_t, RefPtr<WebPage> >::const_iterator it = m_pageMap.begin(); it != end; ++it) {
+        WebPage* page = (*it).second.get();
+        if (page->windowIsFocused())
+            return page;
+    }
+    return 0;
+}
+    
 WebPage* WebProcess::webPage(uint64_t pageID) const
 {
     return m_pageMap.get(pageID).get();
@@ -565,11 +589,21 @@ void WebProcess::didReceiveMessage(CoreIPC::Connection* connection, CoreIPC::Mes
         return;
     }
 
+    if (messageID.is<CoreIPC::MessageClassWebIconDatabaseProxy>()) {
+        m_iconDatabaseProxy.didReceiveMessage(connection, messageID, arguments);
+        return;
+    }
+
     if (messageID.is<CoreIPC::MessageClassWebKeyValueStorageManager>()) {
         WebKeyValueStorageManager::shared().didReceiveMessage(connection, messageID, arguments);
         return;
     }
 
+    if (messageID.is<CoreIPC::MessageClassWebMediaCacheManager>()) {
+        WebMediaCacheManager::shared().didReceiveMessage(connection, messageID, arguments);
+        return;
+    }
+
     if (messageID.is<CoreIPC::MessageClassWebResourceCacheManager>()) {
         WebResourceCacheManager::shared().didReceiveMessage(connection, messageID, arguments);
         return;
@@ -668,9 +702,11 @@ WebPageGroupProxy* WebProcess::webPageGroup(const WebPageGroupData& pageGroupDat
     return result.first->second.get();
 }
 
-void WebProcess::clearResourceCaches()
+void WebProcess::clearResourceCaches(uint32_t cachesToClear)
 {
-    platformClearResourceCaches();
+    ResourceCachesToClear resourceCachesToClear = static_cast<ResourceCachesToClear>(cachesToClear);
+
+    platformClearResourceCaches(resourceCachesToClear);
 
     // Toggling the cache model like this forces the cache to evict all its in-memory resources.
     // FIXME: We need a better way to do this.
@@ -748,6 +784,11 @@ void WebProcess::cancelDownload(uint64_t downloadID)
     DownloadManager::shared().cancelDownload(downloadID);
 }
 
+void WebProcess::setEnhancedAccessibility(bool flag)
+{
+    WebCore::AXObjectCache::setEnhancedUserInterfaceAccessibility(flag);
+}
+    
 void WebProcess::startMemorySampler(const SandboxExtension::Handle& sampleLogFileHandle, const String& sampleLogFilePath, const double interval)
 {
 #if ENABLE(MEMORY_SAMPLER)    
diff --git a/Source/WebKit2/WebProcess/WebProcess.h b/Source/WebKit2/WebProcess/WebProcess.h
index 946bb69..d666910 100644
--- a/Source/WebKit2/WebProcess/WebProcess.h
+++ b/Source/WebKit2/WebProcess/WebProcess.h
@@ -29,11 +29,13 @@
 #include "CacheModel.h"
 #include "ChildProcess.h"
 #include "DrawingArea.h"
+#include "ResourceCachesToClear.h"
 #include "SandboxExtension.h"
 #include "SharedMemory.h"
 #include "TextCheckerState.h"
 #include "VisitedLinkTable.h"
 #include "WebGeolocationManager.h"
+#include "WebIconDatabaseProxy.h"
 #include "WebPageGroupProxy.h"
 #include <WebCore/LinkHash.h>
 #include <wtf/Forward.h>
@@ -76,7 +78,8 @@ public:
     WebPage* webPage(uint64_t pageID) const;
     void createWebPage(uint64_t pageID, const WebPageCreationParameters&);
     void removeWebPage(uint64_t pageID);
-
+    WebPage* focusedWebPage() const;
+    
     InjectedBundle* injectedBundle() const { return m_injectedBundle.get(); }
 
     bool isSeparateProcess() const;
@@ -116,7 +119,9 @@ public:
     // Geolocation
     WebGeolocationManager& geolocationManager() { return m_geolocationManager; }
 
-    void clearResourceCaches();
+    void clearResourceCaches(uint32_t cachesToClear = AllResourceCaches);
+    
+    const String& localStorageDirectory() const { return m_localStorageDirectory; }
 
 private:
     WebProcess();
@@ -144,9 +149,11 @@ private:
     static void calculateCacheSizes(CacheModel cacheModel, uint64_t memorySize, uint64_t diskFreeSize,
         unsigned& cacheTotalCapacity, unsigned& cacheMinDeadCapacity, unsigned& cacheMaxDeadCapacity, double& deadDecodedDataDeletionInterval,
         unsigned& pageCacheCapacity, unsigned long& urlCacheMemoryCapacity, unsigned long& urlCacheDiskCapacity);
-    void platformClearResourceCaches();
+    void platformClearResourceCaches(ResourceCachesToClear);
     void clearApplicationCache();
 
+    void setEnhancedAccessibility(bool);
+    
 #if !ENABLE(PLUGIN_PROCESS)
     void getSitesWithPluginData(const Vector<String>& pluginPaths, uint64_t callbackID);
     void clearPluginSiteData(const Vector<String>& pluginPaths, const Vector<String>& sites, uint64_t flags, uint64_t maxAgeInSeconds, uint64_t callbackID);
@@ -202,6 +209,9 @@ private:
 
     TextCheckerState m_textCheckerState;
     WebGeolocationManager m_geolocationManager;
+    WebIconDatabaseProxy m_iconDatabaseProxy;
+    
+    String m_localStorageDirectory;
 };
 
 } // namespace WebKit
diff --git a/Source/WebKit2/WebProcess/WebProcess.messages.in b/Source/WebKit2/WebProcess/WebProcess.messages.in
index e297179..36155a7 100644
--- a/Source/WebKit2/WebProcess/WebProcess.messages.in
+++ b/Source/WebKit2/WebProcess/WebProcess.messages.in
@@ -51,7 +51,7 @@ messages -> WebProcess {
     ClearPluginSiteData(Vector<WTF::String> pluginPaths, Vector<WTF::String> sites, uint64_t flags, uint64_t maxAgeInSeconds, uint64_t callbackID)
 #endif
 
-    ClearResourceCaches();
+    ClearResourceCaches(uint32_t cachesToClear);
     ClearApplicationCache();
     
     void StartMemorySampler(WebKit::SandboxExtension::Handle sampleLogFileHandle, WTF::String sampleLogFilePath, double interval);
@@ -63,4 +63,6 @@ messages -> WebProcess {
     CancelDownload(uint64_t downloadID)
 
     SetTextCheckerState(WebKit::TextCheckerState textCheckerState)
+
+    SetEnhancedAccessibility(bool flag)
 }
diff --git a/Source/WebKit2/WebProcess/com.apple.WebProcess.sb b/Source/WebKit2/WebProcess/com.apple.WebProcess.sb
index 07c1f52..fa81666 100644
--- a/Source/WebKit2/WebProcess/com.apple.WebProcess.sb
+++ b/Source/WebKit2/WebProcess/com.apple.WebProcess.sb
@@ -3,6 +3,10 @@
 (allow ipc-posix-shm system-audit system-socket file-read-metadata)
 
 (import "system.sb")
+(import "com.apple.corefoundation.sb")
+
+;; Distributed notifications, local pasteboard client
+(corefoundation)
 
 ;; Read-only preferences and data
 (allow file-read*
@@ -69,6 +73,10 @@
 (if (positive? (string-length (param "WEBKIT_DATABASE_DIR")))
     (allow file* (subpath (param "WEBKIT_DATABASE_DIR"))))
 
+;; LocalStorage dir
+(if (positive? (string-length (param "WEBKIT_LOCALSTORAGE_DIR")))
+    (allow file* (subpath (param "WEBKIT_LOCALSTORAGE_DIR"))))
+    
 ;; The NSURLCache directory.
 (if (positive? (string-length (param "NSURL_CACHE_DIR")))
     (allow file* (subpath (param "NSURL_CACHE_DIR"))))
@@ -87,7 +95,6 @@
 ;; Various services required by AppKit and other frameworks
 (allow mach-lookup
    (global-name "com.apple.CoreServices.coreservicesd")
-   (global-name "com.apple.CFPasteboardClient")
    (global-name "com.apple.DiskArbitration.diskarbitrationd")
    (global-name "com.apple.FileCoordination")
    (global-name "com.apple.FontObjectsServer")
@@ -99,7 +106,6 @@
    (global-name "com.apple.audio.coreaudiod")
    (global-name "com.apple.cookied")
    (global-name "com.apple.cvmsServ")
-   (global-name "com.apple.distributed_notifications.2")
    (global-name "com.apple.dock.server")
    (global-name "com.apple.ocspd")
    (global-name "com.apple.pasteboard.1")
diff --git a/Source/WebKit2/WebProcess/gtk/WebProcessGtk.cpp b/Source/WebKit2/WebProcess/gtk/WebProcessGtk.cpp
index 0deed68..77088a3 100644
--- a/Source/WebKit2/WebProcess/gtk/WebProcessGtk.cpp
+++ b/Source/WebKit2/WebProcess/gtk/WebProcessGtk.cpp
@@ -37,7 +37,7 @@ void WebProcess::platformSetCacheModel(CacheModel)
     notImplemented(); 
 }
 
-void WebProcess::platformClearResourceCaches()
+void WebProcess::platformClearResourceCaches(ResourceCachesToClear)
 {
     notImplemented();
 }
diff --git a/Source/WebKit2/WebProcess/mac/WebProcessMac.mm b/Source/WebKit2/WebProcess/mac/WebProcessMac.mm
index 92b36b8..88ef834 100644
--- a/Source/WebKit2/WebProcess/mac/WebProcessMac.mm
+++ b/Source/WebKit2/WebProcess/mac/WebProcessMac.mm
@@ -28,6 +28,7 @@
 
 #import "FullKeyboardAccessWatcher.h"
 #import "SandboxExtension.h"
+#import "WebPage.h"
 #import "WebProcessCreationParameters.h"
 #import <WebCore/MemoryCache.h>
 #import <WebCore/PageCache.h>
@@ -37,6 +38,8 @@
 #import <mach/host_info.h>
 #import <mach/mach.h>
 #import <mach/mach_error.h>
+#import <objc/runtime.h>
+#import <WebCore/LocalizedStrings.h>
 
 #if ENABLE(WEB_PROCESS_SANDBOX)
 #import <sandbox.h>
@@ -106,8 +109,10 @@ void WebProcess::platformSetCacheModel(CacheModel cacheModel)
     [nsurlCache setDiskCapacity:max<unsigned long>(urlCacheDiskCapacity, [nsurlCache diskCapacity])]; // Don't shrink a big disk cache, since that would cause churn.
 }
 
-void WebProcess::platformClearResourceCaches()
+void WebProcess::platformClearResourceCaches(ResourceCachesToClear cachesToClear)
 {
+    if (cachesToClear == InMemoryResourceCachesOnly)
+        return;
     [[NSURLCache sharedURLCache] removeAllCachedResponses];
 }
 
@@ -152,6 +157,7 @@ static void initializeSandbox(const WebProcessCreationParameters& parameters)
     appendSandboxParameterConfPath(sandboxParameters, "DARWIN_USER_TEMP_DIR", _CS_DARWIN_USER_TEMP_DIR);
     appendSandboxParameterConfPath(sandboxParameters, "DARWIN_USER_CACHE_DIR", _CS_DARWIN_USER_CACHE_DIR);
     appendSandboxParameterPath(sandboxParameters, "WEBKIT_DATABASE_DIR", [(NSString *)parameters.databaseDirectory fileSystemRepresentation]);
+    appendSandboxParameterPath(sandboxParameters, "WEBKIT_LOCALSTORAGE_DIR", [(NSString *)parameters.localStorageDirectory fileSystemRepresentation]);
     appendSandboxParameterPath(sandboxParameters, "NSURL_CACHE_DIR", parameters.nsURLCachePath.data());
     appendSandboxParameterPath(sandboxParameters, "UI_PROCESS_BUNDLE_RESOURCE_DIR", parameters.uiProcessBundleResourcePath.data());
     sandboxParameters.append(static_cast<const char*>(0));
@@ -171,13 +177,23 @@ static void initializeSandbox(const WebProcessCreationParameters& parameters)
 #endif
 }
 
+static id NSApplicationAccessibilityFocusedUIElement(NSApplication*, SEL)
+{
+    WebPage* page = WebProcess::shared().focusedWebPage();
+    if (!page || !page->accessibilityRemoteObject())
+        return 0;
+
+    return [page->accessibilityRemoteObject() accessibilityFocusedUIElement];
+}
+    
 void WebProcess::platformInitializeWebProcess(const WebProcessCreationParameters& parameters, CoreIPC::ArgumentDecoder*)
 {
+    [[NSFileManager defaultManager] changeCurrentDirectoryPath:[[NSBundle mainBundle] bundlePath]];
+
     initializeSandbox(parameters);
 
     if (!parameters.parentProcessName.isNull()) {
-        // FIXME (WebKit2) <rdar://problem/8728860> WebKit2 needs to be localized
-        NSString *applicationName = [NSString stringWithFormat:@"%@ Web Content", (NSString *)parameters.parentProcessName];
+        NSString *applicationName = [NSString stringWithFormat:UI_STRING("%@ Web Content", "Visible name of the web process. The argument is the application name."), (NSString *)parameters.parentProcessName];
         WKSetVisibleApplicationName((CFStringRef)applicationName);
     }
 
@@ -191,6 +207,11 @@ void WebProcess::platformInitializeWebProcess(const WebProcessCreationParameters
     }
 
     m_compositingRenderServerPort = parameters.acceleratedCompositingPort.port();
+
+    // rdar://9118639 accessibilityFocusedUIElement in NSApplication defaults to use the keyWindow. Since there's
+    // no window in WK2, NSApplication needs to use the focused page's focused element.
+    Method methodToPatch = class_getInstanceMethod([NSApplication class], @selector(accessibilityFocusedUIElement));
+    method_setImplementation(methodToPatch, (IMP)NSApplicationAccessibilityFocusedUIElement);
 }
 
 void WebProcess::platformTerminate()
diff --git a/Source/WebKit2/WebProcess/qt/WebProcessMainQt.cpp b/Source/WebKit2/WebProcess/qt/WebProcessMainQt.cpp
index 291c3e7..6ff10ba 100644
--- a/Source/WebKit2/WebProcess/qt/WebProcessMainQt.cpp
+++ b/Source/WebKit2/WebProcess/qt/WebProcessMainQt.cpp
@@ -48,13 +48,6 @@
 #endif
 #endif
 
-#if !defined(QWEBKIT_EXPORT)
-#if defined(QT_SHARED)
-#define QWEBKIT_EXPORT Q_DECL_EXPORT
-#else
-#define QWEBKIT_EXPORT
-#endif
-#endif
 #ifndef NDEBUG
 #include <QDebug>
 #endif
@@ -89,7 +82,7 @@ bool EnvHttpProxyFactory::initializeFromEnvironment()
 {
     bool wasSetByEnvironment = false;
 
-    QUrl proxyUrl = QUrl::fromUserInput(qgetenv("http_proxy"));
+    QUrl proxyUrl = QUrl::fromUserInput(QString::fromLocal8Bit(qgetenv("http_proxy")));
     if (proxyUrl.isValid() && !proxyUrl.host().isEmpty()) {
         int proxyPort = (proxyUrl.port() > 0) ? proxyUrl.port() : 8080;
         m_httpProxy << QNetworkProxy(QNetworkProxy::HttpProxy, proxyUrl.host(), proxyPort);
@@ -97,7 +90,7 @@ bool EnvHttpProxyFactory::initializeFromEnvironment()
     } else
         m_httpProxy << QNetworkProxy::NoProxy;
 
-    proxyUrl = QUrl::fromUserInput(qgetenv("https_proxy"));
+    proxyUrl = QUrl::fromUserInput(QString::fromLocal8Bit(qgetenv("https_proxy")));
     if (proxyUrl.isValid() && !proxyUrl.host().isEmpty()) {
         int proxyPort = (proxyUrl.port() > 0) ? proxyUrl.port() : 8080;
         m_httpsProxy << QNetworkProxy(QNetworkProxy::HttpProxy, proxyUrl.host(), proxyPort);
@@ -137,9 +130,9 @@ static void initializeProxy()
     QNetworkProxyFactory::setUseSystemConfiguration(true);
 }
 
-QWEBKIT_EXPORT int WebProcessMainQt(int argc, char** argv)
+Q_DECL_EXPORT int WebProcessMainQt(int argc, char** argv)
 {
-    QApplication::setGraphicsSystem("raster");
+    QApplication::setGraphicsSystem(QLatin1String("raster"));
     QApplication* app = new QApplication(argc, argv);
 #ifndef NDEBUG
     if (!qgetenv("WEBKIT2_PAUSE_WEB_PROCESS_ON_LAUNCH").isEmpty()) {
diff --git a/Source/WebKit2/WebProcess/qt/WebProcessQt.cpp b/Source/WebKit2/WebProcess/qt/WebProcessQt.cpp
index 459274c..919044e 100644
--- a/Source/WebKit2/WebProcess/qt/WebProcessQt.cpp
+++ b/Source/WebKit2/WebProcess/qt/WebProcessQt.cpp
@@ -37,7 +37,7 @@ void WebProcess::platformSetCacheModel(CacheModel)
     // FIXME: Implement.
 }
 
-void WebProcess::platformClearResourceCaches()
+void WebProcess::platformClearResourceCaches(ResourceCachesToClear)
 {
 }
 
diff --git a/Source/WebKit2/WebProcess/win/WebProcessWin.cpp b/Source/WebKit2/WebProcess/win/WebProcessWin.cpp
index 58230d3..d56fef6 100644
--- a/Source/WebKit2/WebProcess/win/WebProcessWin.cpp
+++ b/Source/WebKit2/WebProcess/win/WebProcessWin.cpp
@@ -26,6 +26,7 @@
 #include "config.h"
 #include "WebProcess.h"
 
+#include "WebCookieManager.h"
 #include "WebProcessCreationParameters.h"
 #include <WebCore/FileSystem.h>
 #include <WebCore/MemoryCache.h>
@@ -98,9 +99,11 @@ void WebProcess::platformSetCacheModel(CacheModel cacheModel)
 #endif
 }
 
-void WebProcess::platformClearResourceCaches()
+void WebProcess::platformClearResourceCaches(ResourceCachesToClear cachesToClear)
 {
 #if USE(CFNETWORK)
+    if (cachesToClear == InMemoryResourceCachesOnly)
+        return;
     CFURLCacheRemoveAllCachedResponses(RetainPtr<CFURLCacheRef>(AdoptCF, CFURLCacheCopySharedURLCache()).get());
 #endif
 }
@@ -119,6 +122,8 @@ void WebProcess::platformInitializeWebProcess(const WebProcessCreationParameters
     RetainPtr<CFURLCacheRef> uiProcessCache(AdoptCF, CFURLCacheCreate(kCFAllocatorDefault, cacheMemoryCapacity, cacheDiskCapacity, cachePath.get()));
     CFURLCacheSetSharedURLCache(uiProcessCache.get());
 #endif
+
+    WebCookieManager::shared().setHTTPCookieAcceptPolicy(parameters.initialHTTPCookieAcceptPolicy);
 }
 
 void WebProcess::platformTerminate()
diff --git a/Source/WebKit2/config.h b/Source/WebKit2/config.h
index 36fd989..3723185 100644
--- a/Source/WebKit2/config.h
+++ b/Source/WebKit2/config.h
@@ -28,16 +28,6 @@
 #include "autotoolsconfig.h"
 #endif /* defined (BUILDING_GTK__) */
 
-#ifdef __cplusplus
-
-// These undefs match up with defines in WebKit2Prefix.h for Mac OS X.
-// Helps us catch if anyone uses new or delete by accident in code and doesn't include "config.h".
-#undef new
-#undef delete
-#include <wtf/FastMalloc.h>
-
-#endif
-
 #include <wtf/DisallowCType.h>
 #include <wtf/Platform.h>
 
@@ -68,6 +58,8 @@ static const type& name() \
 
 #define JS_EXPORTDATA
 #define JS_EXPORTCLASS
+#define WTF_EXPORT_PRIVATE
+#define JS_EXPORT_PRIVATE
 
 #elif defined(__APPLE__)
 
@@ -102,6 +94,9 @@ static const type& name() \
 #define JS_EXPORTCLASS
 #define WEBKIT_EXPORTDATA
 
+#define WTF_EXPORT_PRIVATE
+#define JS_EXPORT_PRIVATE
+
 #include <WebCore/EmptyProtocolDefinitions.h>
 
 #elif defined(WIN32) || defined(_WIN32)
@@ -136,6 +131,16 @@ static const type& name() \
 
 #endif /* defined(WIN32) || defined(_WIN32) */
 
+#ifdef __cplusplus
+
+// These undefs match up with defines in WebKit2Prefix.h for Mac OS X.
+// Helps us catch if anyone uses new or delete by accident in code and doesn't include "config.h".
+#undef new
+#undef delete
+#include <wtf/FastMalloc.h>
+
+#endif
+
 #if PLATFORM(MAC) || (OS(MAC_OS_X) && PLATFORM(QT))
 #define PLUGIN_ARCHITECTURE_MAC 1
 #elif PLATFORM(WIN) || (OS(WINDOWS) && PLATFORM(QT))
diff --git a/Source/WebKit2/qt/MainQt.cpp b/Source/WebKit2/qt/MainQt.cpp
index d42ef05..d243514 100644
--- a/Source/WebKit2/qt/MainQt.cpp
+++ b/Source/WebKit2/qt/MainQt.cpp
@@ -26,16 +26,8 @@
 
 #include <QtGlobal>
 
-#if !defined(QWEBKIT_EXPORT)
-#if defined(QT_SHARED)
-#define QWEBKIT_EXPORT Q_DECL_EXPORT
-#else
-#define QWEBKIT_EXPORT
-#endif
-#endif
-
 namespace WebKit {
-QWEBKIT_EXPORT int WebProcessMainQt(int argc, char** argv);
+Q_DECL_IMPORT int WebProcessMainQt(int argc, char** argv);
 }
 
 // The framework entry point.
diff --git a/Source/WebKit2/win/WebKit2.def b/Source/WebKit2/win/WebKit2.def
index 799fea9..37c5dfc 100644
--- a/Source/WebKit2/win/WebKit2.def
+++ b/Source/WebKit2/win/WebKit2.def
@@ -19,14 +19,6 @@ EXPORTS
         WebKitShouldUseFontSmoothing
         WebKitCreateInstance
 		
-        ; Exported for WebKitTestRunner's use only
-        ??0KURL@WebCore@@QAE@W4ParsedURLStringTag@1@PBD@Z
-        ??1StringImpl@WTF@@QAE@XZ
-        ?equal@WTF@@YA_NPBVStringImpl@1@PBD@Z
-        ?equalIgnoringCase@WTF@@YA_NPAVStringImpl@1@PBD@Z
-        ?host@KURL@WebCore@@QBE?AVString@WTF@@XZ
-        ?protocol@KURL@WebCore@@QBE?AVString@WTF@@XZ
-		
         ; These functions are deprecated
         WebLocalizedString
         WebLocalizedLPCTSTR
diff --git a/Source/WebKit2/win/WebKit2.make b/Source/WebKit2/win/WebKit2.make
index 111d113..b53561e 100755
--- a/Source/WebKit2/win/WebKit2.make
+++ b/Source/WebKit2/win/WebKit2.make
@@ -1,7 +1,7 @@
 !IF "$(BUILDSTYLE)"=="DEBUG"
 BUILDSTYLE=Debug_All
 !ELSE
-BUILDSTYLE=Release_LTCG
+BUILDSTYLE=Production
 !ENDIF
 
 install:
@@ -9,7 +9,6 @@ install:
 	set WebKitOutputDir=$(OBJROOT)
 	set ConfigurationBuildDir=$(OBJROOT)\$(BUILDSTYLE)
 	set WebKitVSPropsRedirectionDir=$(SRCROOT)\AppleInternal\tools\vsprops\OpenSource\1\2\3\ 
-	set PRODUCTION=1
 	devenv "WebKit2.submit.sln" /rebuild $(BUILDSTYLE)
 	-xcopy "%ConfigurationBuildDir%\bin\*.exe" "$(DSTROOT)\AppleInternal\bin\" /e/v/i/h/y
 	xcopy "%ConfigurationBuildDir%\bin\*.pdb" "$(DSTROOT)\AppleInternal\bin\" /e/v/i/h/y
diff --git a/Source/WebKit2/win/WebKit2.submit.sln b/Source/WebKit2/win/WebKit2.submit.sln
index 4c0089b..208a0df 100755
--- a/Source/WebKit2/win/WebKit2.submit.sln
+++ b/Source/WebKit2/win/WebKit2.submit.sln
@@ -17,7 +17,7 @@ Global
 	GlobalSection(SolutionConfigurationPlatforms) = preSolution
 		Debug_All|Win32 = Debug_All|Win32
 		Debug|Win32 = Debug|Win32
-		Release_LTCG|Win32 = Release_LTCG|Win32
+		Production|Win32 = Production|Win32
 		Release|Win32 = Release|Win32
 	EndGlobalSection
 	GlobalSection(ProjectConfigurationPlatforms) = postSolution
@@ -25,24 +25,24 @@ Global
 		{2E51ABE8-76CB-485B-A66C-46AEF4DF8ACD}.Debug_All|Win32.Build.0 = Debug_All|Win32
 		{2E51ABE8-76CB-485B-A66C-46AEF4DF8ACD}.Debug|Win32.ActiveCfg = Debug|Win32
 		{2E51ABE8-76CB-485B-A66C-46AEF4DF8ACD}.Debug|Win32.Build.0 = Debug|Win32
-		{2E51ABE8-76CB-485B-A66C-46AEF4DF8ACD}.Release_LTCG|Win32.ActiveCfg = Release_LTCG|Win32
-		{2E51ABE8-76CB-485B-A66C-46AEF4DF8ACD}.Release_LTCG|Win32.Build.0 = Release_LTCG|Win32
+		{2E51ABE8-76CB-485B-A66C-46AEF4DF8ACD}.Production|Win32.ActiveCfg = Production|Win32
+		{2E51ABE8-76CB-485B-A66C-46AEF4DF8ACD}.Production|Win32.Build.0 = Production|Win32
 		{2E51ABE8-76CB-485B-A66C-46AEF4DF8ACD}.Release|Win32.ActiveCfg = Release|Win32
 		{2E51ABE8-76CB-485B-A66C-46AEF4DF8ACD}.Release|Win32.Build.0 = Release|Win32
 		{2EDAD637-CBA8-4E55-97ED-7D2BBC336FDB}.Debug_All|Win32.ActiveCfg = Debug_All|Win32
 		{2EDAD637-CBA8-4E55-97ED-7D2BBC336FDB}.Debug_All|Win32.Build.0 = Debug_All|Win32
 		{2EDAD637-CBA8-4E55-97ED-7D2BBC336FDB}.Debug|Win32.ActiveCfg = Debug|Win32
 		{2EDAD637-CBA8-4E55-97ED-7D2BBC336FDB}.Debug|Win32.Build.0 = Debug|Win32
-		{2EDAD637-CBA8-4E55-97ED-7D2BBC336FDB}.Release_LTCG|Win32.ActiveCfg = Release_LTCG|Win32
-		{2EDAD637-CBA8-4E55-97ED-7D2BBC336FDB}.Release_LTCG|Win32.Build.0 = Release_LTCG|Win32
+		{2EDAD637-CBA8-4E55-97ED-7D2BBC336FDB}.Production|Win32.ActiveCfg = Production|Win32
+		{2EDAD637-CBA8-4E55-97ED-7D2BBC336FDB}.Production|Win32.Build.0 = Production|Win32
 		{2EDAD637-CBA8-4E55-97ED-7D2BBC336FDB}.Release|Win32.ActiveCfg = Release|Win32
 		{2EDAD637-CBA8-4E55-97ED-7D2BBC336FDB}.Release|Win32.Build.0 = Release|Win32
 		{AAE88FEF-509E-4D49-870B-7357922C276F}.Debug_All|Win32.ActiveCfg = Debug_All|Win32
 		{AAE88FEF-509E-4D49-870B-7357922C276F}.Debug_All|Win32.Build.0 = Debug_All|Win32
 		{AAE88FEF-509E-4D49-870B-7357922C276F}.Debug|Win32.ActiveCfg = Debug|Win32
 		{AAE88FEF-509E-4D49-870B-7357922C276F}.Debug|Win32.Build.0 = Debug|Win32
-		{AAE88FEF-509E-4D49-870B-7357922C276F}.Release_LTCG|Win32.ActiveCfg = Release_LTCG|Win32
-		{AAE88FEF-509E-4D49-870B-7357922C276F}.Release_LTCG|Win32.Build.0 = Release_LTCG|Win32
+		{AAE88FEF-509E-4D49-870B-7357922C276F}.Production|Win32.ActiveCfg = Production|Win32
+		{AAE88FEF-509E-4D49-870B-7357922C276F}.Production|Win32.Build.0 = Production|Win32
 		{AAE88FEF-509E-4D49-870B-7357922C276F}.Release|Win32.ActiveCfg = Release|Win32
 		{AAE88FEF-509E-4D49-870B-7357922C276F}.Release|Win32.Build.0 = Release|Win32
 	EndGlobalSection
diff --git a/Source/WebKit2/win/WebKit2.vcproj b/Source/WebKit2/win/WebKit2.vcproj
index ecd064d..5e4ffa8 100755
--- a/Source/WebKit2/win/WebKit2.vcproj
+++ b/Source/WebKit2/win/WebKit2.vcproj
@@ -18,7 +18,7 @@
 		<Configuration
 			Name="Debug|Win32"
 			ConfigurationType="2"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;.\WebKit2Common.vsprops;.\WebKit2DirectX.vsprops;.\WebKit2Apple.vsprops"
+			InheritedPropertySheets=".\WebKit2Debug.vsprops"
 			CharacterSet="1"
 			>
 			<Tool
@@ -79,7 +79,7 @@
 		<Configuration
 			Name="Release|Win32"
 			ConfigurationType="2"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;.\WebKit2Common.vsprops;.\WebKit2DirectX.vsprops;.\WebKit2Apple.vsprops"
+			InheritedPropertySheets=".\WebKit2Release.vsprops"
 			CharacterSet="1"
 			>
 			<Tool
@@ -140,7 +140,7 @@
 		<Configuration
 			Name="Debug_Cairo_CFLite|Win32"
 			ConfigurationType="2"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefinesCairo.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\debug_wincairo.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\cURL.vsprops;.\WebKit2Common.vsprops;.\WebKit2CFLite.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\WinCairo.vsprops"
+			InheritedPropertySheets=".\WebKit2DebugCairoCFLite.vsprops"
 			CharacterSet="1"
 			>
 			<Tool
@@ -202,7 +202,7 @@
 		<Configuration
 			Name="Release_Cairo_CFLite|Win32"
 			ConfigurationType="2"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefinesCairo.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\WinCairo.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\cURL.vsprops;.\WebKit2Common.vsprops;.\WebKit2CFLite.vsprops"
+			InheritedPropertySheets=".\WebKit2ReleaseCairoCFLite.vsprops"
 			CharacterSet="1"
 			>
 			<Tool
@@ -263,7 +263,7 @@
 		<Configuration
 			Name="Debug_All|Win32"
 			ConfigurationType="2"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\debug_all.vsprops;.\WebKit2Common.vsprops;.\WebKit2DirectX.vsprops;.\WebKit2Apple.vsprops"
+			InheritedPropertySheets=".\WebKit2DebugAll.vsprops"
 			CharacterSet="1"
 			>
 			<Tool
@@ -322,9 +322,9 @@
 			/>
 		</Configuration>
 		<Configuration
-			Name="Release_LTCG|Win32"
+			Name="Production|Win32"
 			ConfigurationType="2"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;.\WebKit2Common.vsprops;.\WebKit2DirectX.vsprops;.\WebKit2Apple.vsprops"
+			InheritedPropertySheets=".\WebKit2Production.vsprops"
 			CharacterSet="1"
 			WholeProgramOptimization="1"
 			>
@@ -507,6 +507,10 @@
 				>
 			</File>
 			<File
+				RelativePath="..\Shared\ResourceCachesToClear.h"
+				>
+			</File>
+			<File
 				RelativePath="..\Shared\SameDocumentNavigationType.h"
 				>
 			</File>
@@ -786,6 +790,10 @@
 					>
 				</File>
 				<File
+					RelativePath="..\Shared\API\c\win\WKBaseWin.h"
+					>
+				</File>
+				<File
 					RelativePath="..\Shared\API\c\WKCertificateInfo.cpp"
 					>
 				</File>
@@ -973,6 +981,30 @@
 					Name="cf"
 					>
 					<File
+						RelativePath="..\Shared\API\c\cf\WKErrorCF.cpp"
+						>
+						<FileConfiguration
+							Name="Debug_Cairo_CFLite|Win32"
+							ExcludedFromBuild="true"
+							>
+							<Tool
+								Name="VCCLCompilerTool"
+							/>
+						</FileConfiguration>
+						<FileConfiguration
+							Name="Release_Cairo_CFLite|Win32"
+							ExcludedFromBuild="true"
+							>
+							<Tool
+								Name="VCCLCompilerTool"
+							/>
+						</FileConfiguration>
+					</File>
+					<File
+						RelativePath="..\Shared\API\c\cf\WKErrorCF.h"
+						>
+					</File>
+					<File
 						RelativePath="..\Shared\API\c\cf\WKStringCF.cpp"
 						>
 					</File>
@@ -1140,6 +1172,22 @@
 				<File
 					RelativePath="..\Shared\win\LayerTreeContextWin.cpp"
 					>
+					<FileConfiguration
+						Name="Debug_Cairo_CFLite|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+					<FileConfiguration
+						Name="Release_Cairo_CFLite|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
 				</File>
 				<File
 					RelativePath="..\Shared\win\NativeWebKeyboardEventWin.cpp"
@@ -1297,7 +1345,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -1411,6 +1459,22 @@
 				</File>
 			</Filter>
 			<Filter
+				Name="IconDatabase"
+				>
+				<File
+					RelativePath="..\WebProcess\IconDatabase\WebIconDatabaseProxy.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\WebProcess\IconDatabase\WebIconDatabaseProxy.h"
+					>
+				</File>
+				<File
+					RelativePath="..\WebProcess\IconDatabase\WebIconDatabaseProxy.messages.in"
+					>
+				</File>
+			</Filter>
+			<Filter
 				Name="KeyValueStorage"
 				>
 				<File
@@ -1427,6 +1491,22 @@
 				</File>
 			</Filter>
 			<Filter
+				Name="MediaCache"
+				>
+				<File
+					RelativePath="..\WebProcess\MediaCache\WebMediaCacheManager.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\WebProcess\MediaCache\WebMediaCacheManager.h"
+					>
+				</File>
+				<File
+					RelativePath="..\WebProcess\MediaCache\WebMediaCacheManager.messages.in"
+					>
+				</File>
+			</Filter>
+			<Filter
 				Name="ResourceCache"
 				>
 				<File
@@ -1465,6 +1545,70 @@
 					RelativePath="..\WebProcess\Cookies\WebCookieManager.messages.in"
 					>
 				</File>
+				<Filter
+					Name="cf"
+					>
+					<File
+						RelativePath="..\WebProcess\Cookies\cf\WebCookieManagerCFNet.cpp"
+						>
+						<FileConfiguration
+							Name="Debug_Cairo_CFLite|Win32"
+							ExcludedFromBuild="true"
+							>
+							<Tool
+								Name="VCCLCompilerTool"
+							/>
+						</FileConfiguration>
+						<FileConfiguration
+							Name="Release_Cairo_CFLite|Win32"
+							ExcludedFromBuild="true"
+							>
+							<Tool
+								Name="VCCLCompilerTool"
+							/>
+						</FileConfiguration>
+					</File>
+				</Filter>
+				<Filter
+					Name="curl"
+					>
+					<File
+						RelativePath="..\WebProcess\Cookies\curl\WebCookieManagerCurl.cpp"
+						>
+						<FileConfiguration
+							Name="Debug|Win32"
+							ExcludedFromBuild="true"
+							>
+							<Tool
+								Name="VCCLCompilerTool"
+							/>
+						</FileConfiguration>
+						<FileConfiguration
+							Name="Release|Win32"
+							ExcludedFromBuild="true"
+							>
+							<Tool
+								Name="VCCLCompilerTool"
+							/>
+						</FileConfiguration>
+						<FileConfiguration
+							Name="Debug_All|Win32"
+							ExcludedFromBuild="true"
+							>
+							<Tool
+								Name="VCCLCompilerTool"
+							/>
+						</FileConfiguration>
+						<FileConfiguration
+							Name="Production|Win32"
+							ExcludedFromBuild="true"
+							>
+							<Tool
+								Name="VCCLCompilerTool"
+							/>
+						</FileConfiguration>
+					</File>
+				</Filter>
 			</Filter>
 			<Filter
 				Name="WebCoreSupport"
@@ -1769,6 +1913,58 @@
 						>
 					</File>
 				</Filter>
+				<Filter
+					Name="ca"
+					>
+					<File
+						RelativePath="..\WebProcess\WebPage\ca\LayerTreeHostCA.cpp"
+						>
+						<FileConfiguration
+							Name="Debug_Cairo_CFLite|Win32"
+							ExcludedFromBuild="true"
+							>
+							<Tool
+								Name="VCCLCompilerTool"
+							/>
+						</FileConfiguration>
+						<FileConfiguration
+							Name="Release_Cairo_CFLite|Win32"
+							ExcludedFromBuild="true"
+							>
+							<Tool
+								Name="VCCLCompilerTool"
+							/>
+						</FileConfiguration>
+					</File>
+					<File
+						RelativePath="..\WebProcess\WebPage\ca\LayerTreeHostCA.h"
+						>
+					</File>
+					<Filter
+						Name="win"
+						>
+						<File
+							RelativePath="..\WebProcess\WebPage\ca\win\LayerTreeHostCAWin.cpp"
+							>
+							<FileConfiguration
+								Name="Debug_Cairo_CFLite|Win32"
+								ExcludedFromBuild="true"
+								>
+								<Tool
+									Name="VCCLCompilerTool"
+								/>
+							</FileConfiguration>
+							<FileConfiguration
+								Name="Release_Cairo_CFLite|Win32"
+								ExcludedFromBuild="true"
+								>
+								<Tool
+									Name="VCCLCompilerTool"
+								/>
+							</FileConfiguration>
+						</File>
+					</Filter>
+				</Filter>
 			</Filter>
 			<Filter
 				Name="win"
@@ -1805,7 +2001,15 @@
 					Name="cf"
 					>
 					<File
-						RelativePath="..\WebProcess\Downloads\cf\DownloadCFNet.cpp"
+						RelativePath="..\WebProcess\Downloads\cf\win\DownloadCFWin.cpp"
+						>
+					</File>
+				</Filter>
+				<Filter
+					Name="cfnet"
+					>
+					<File
+						RelativePath="..\WebProcess\Downloads\cfnet\DownloadCFNet.cpp"
 						>
 						<FileConfiguration
 							Name="Debug_Cairo_CFLite|Win32"
@@ -1824,14 +2028,6 @@
 							/>
 						</FileConfiguration>
 					</File>
-					<Filter
-						Name="win"
-						>
-						<File
-							RelativePath="..\WebProcess\Downloads\cf\win\DownloadCFNetWin.cpp"
-							>
-						</File>
-					</Filter>
 				</Filter>
 				<Filter
 					Name="curl"
@@ -1864,7 +2060,7 @@
 							/>
 						</FileConfiguration>
 						<FileConfiguration
-							Name="Release_LTCG|Win32"
+							Name="Production|Win32"
 							ExcludedFromBuild="true"
 							>
 							<Tool
@@ -2127,6 +2323,18 @@
 							RelativePath="..\WebProcess\InjectedBundle\API\c\WKBundleScriptWorld.h"
 							>
 						</File>
+						<Filter
+							Name="win"
+							>
+							<File
+								RelativePath="..\WebProcess\InjectedBundle\API\c\win\WKBundlePrivateWin.cpp"
+								>
+							</File>
+							<File
+								RelativePath="..\WebProcess\InjectedBundle\API\c\win\WKBundlePrivateWin.h"
+								>
+							</File>
+						</Filter>
 					</Filter>
 				</Filter>
 				<Filter
@@ -2511,6 +2719,14 @@
 				>
 			</File>
 			<File
+				RelativePath="..\UIProcess\WebFullScreenManagerProxy.cpp"
+				>
+			</File>
+			<File
+				RelativePath="..\UIProcess\WebFullScreenManagerProxy.h"
+				>
+			</File>
+			<File
 				RelativePath="..\UIProcess\WebGeolocationManagerProxy.cpp"
 				>
 			</File>
@@ -2539,6 +2755,18 @@
 				>
 			</File>
 			<File
+				RelativePath="..\UIProcess\WebIconDatabase.cpp"
+				>
+			</File>
+			<File
+				RelativePath="..\UIProcess\WebIconDatabase.h"
+				>
+			</File>
+			<File
+				RelativePath="..\UIProcess\WebIconDatabase.messages.in"
+				>
+			</File>
+			<File
 				RelativePath="..\UIProcess\WebInspectorProxy.cpp"
 				>
 			</File>
@@ -2567,6 +2795,18 @@
 				>
 			</File>
 			<File
+				RelativePath="..\UIProcess\WebMediaCacheManagerProxy.cpp"
+				>
+			</File>
+			<File
+				RelativePath="..\UIProcess\WebMediaCacheManagerProxy.h"
+				>
+			</File>
+			<File
+				RelativePath="..\UIProcess\WebMediaCacheManagerProxy.messages.in"
+				>
+			</File>
+			<File
 				RelativePath="..\UIProcess\WebNavigationData.cpp"
 				>
 			</File>
@@ -2825,6 +3065,14 @@
 						>
 					</File>
 					<File
+						RelativePath="..\UIProcess\API\C\WKIconDatabase.cpp"
+						>
+					</File>
+					<File
+						RelativePath="..\UIProcess\API\C\WKIconDatabase.h"
+						>
+					</File>
+					<File
 						RelativePath="..\UIProcess\API\C\WKInspector.cpp"
 						>
 					</File>
@@ -2841,6 +3089,14 @@
 						>
 					</File>
 					<File
+						RelativePath="..\UIProcess\API\C\WKMediaCacheManager.cpp"
+						>
+					</File>
+					<File
+						RelativePath="..\UIProcess\API\C\WKMediaCacheManager.h"
+						>
+					</File>
+					<File
 						RelativePath="..\UIProcess\API\C\WKNativeEvent.h"
 						>
 					</File>
@@ -2929,14 +3185,54 @@
 						>
 					</File>
 					<Filter
-						Name="win"
+						Name="cg"
 						>
 						<File
-							RelativePath="..\UIProcess\API\C\win\WKAPICastWin.h"
+							RelativePath="..\UIProcess\API\C\cg\WKIconDatabaseCG.cpp"
 							>
+							<FileConfiguration
+								Name="Debug_Cairo_CFLite|Win32"
+								ExcludedFromBuild="true"
+								>
+								<Tool
+									Name="VCCLCompilerTool"
+								/>
+							</FileConfiguration>
+							<FileConfiguration
+								Name="Release_Cairo_CFLite|Win32"
+								ExcludedFromBuild="true"
+								>
+								<Tool
+									Name="VCCLCompilerTool"
+								/>
+							</FileConfiguration>
 						</File>
 						<File
-							RelativePath="..\UIProcess\API\C\win\WKBaseWin.h"
+							RelativePath="..\UIProcess\API\C\cg\WKIconDatabaseCG.h"
+							>
+							<FileConfiguration
+								Name="Debug_Cairo_CFLite|Win32"
+								ExcludedFromBuild="true"
+								>
+								<Tool
+									Name="VCCustomBuildTool"
+								/>
+							</FileConfiguration>
+							<FileConfiguration
+								Name="Release_Cairo_CFLite|Win32"
+								ExcludedFromBuild="true"
+								>
+								<Tool
+									Name="VCCustomBuildTool"
+								/>
+							</FileConfiguration>
+						</File>
+					</Filter>
+					<Filter
+						Name="win"
+						>
+						<File
+							RelativePath="..\UIProcess\API\C\win\WKAPICastWin.h"
 							>
 						</File>
 						<File
@@ -3110,6 +3406,14 @@
 					>
 				</File>
 				<File
+					RelativePath="..\UIProcess\win\WebUndoClient.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\UIProcess\win\WebUndoClient.h"
+					>
+				</File>
+				<File
 					RelativePath="..\UIProcess\win\WebView.cpp"
 					>
 				</File>
@@ -3547,6 +3851,22 @@
 				>
 			</File>
 			<File
+				RelativePath="$(ConfigurationBuildDir)\obj\$(ProjectName)\DerivedSources\WebFullScreenManagerMessageReceiver.cpp"
+				>
+			</File>
+			<File
+				RelativePath="$(ConfigurationBuildDir)\obj\$(ProjectName)\DerivedSources\WebFullScreenManagerMessages.h"
+				>
+			</File>
+			<File
+				RelativePath="$(ConfigurationBuildDir)\obj\$(ProjectName)\DerivedSources\WebFullScreenManagerProxyMessageReceiver.cpp"
+				>
+			</File>
+			<File
+				RelativePath="$(ConfigurationBuildDir)\obj\$(ProjectName)\DerivedSources\WebFullScreenManagerProxyMessages.h"
+				>
+			</File>
+			<File
 				RelativePath="$(ConfigurationBuildDir)\obj\$(ProjectName)\DerivedSources\WebGeolocationManagerMessageReceiver.cpp"
 				>
 			</File>
@@ -3563,6 +3883,22 @@
 				>
 			</File>
 			<File
+				RelativePath="$(ConfigurationBuildDir)\obj\$(ProjectName)\DerivedSources\WebIconDatabaseMessageReceiver.cpp"
+				>
+			</File>
+			<File
+				RelativePath="$(ConfigurationBuildDir)\obj\$(ProjectName)\DerivedSources\WebIconDatabaseMessages.h"
+				>
+			</File>
+			<File
+				RelativePath="$(ConfigurationBuildDir)\obj\$(ProjectName)\DerivedSources\WebIconDatabaseProxyMessageReceiver.cpp"
+				>
+			</File>
+			<File
+				RelativePath="$(ConfigurationBuildDir)\obj\$(ProjectName)\DerivedSources\WebIconDatabaseProxyMessages.h"
+				>
+			</File>
+			<File
 				RelativePath="$(ConfigurationBuildDir)\obj\$(ProjectName)\DerivedSources\WebInspectorMessageReceiver.cpp"
 				>
 			</File>
@@ -3595,6 +3931,22 @@
 				>
 			</File>
 			<File
+				RelativePath="$(ConfigurationBuildDir)\obj\$(ProjectName)\DerivedSources\WebMediaCacheManagerMessageReceiver.cpp"
+				>
+			</File>
+			<File
+				RelativePath="$(ConfigurationBuildDir)\obj\$(ProjectName)\DerivedSources\WebMediaCacheManagerMessages.h"
+				>
+			</File>
+			<File
+				RelativePath="$(ConfigurationBuildDir)\obj\$(ProjectName)\DerivedSources\WebMediaCacheManagerProxyMessageReceiver.cpp"
+				>
+			</File>
+			<File
+				RelativePath="$(ConfigurationBuildDir)\obj\$(ProjectName)\DerivedSources\WebMediaCacheManagerProxyMessages.h"
+				>
+			</File>
+			<File
 				RelativePath="$(ConfigurationBuildDir)\obj\$(ProjectName)\DerivedSources\WebPageMessageReceiver.cpp"
 				>
 			</File>
@@ -3728,7 +4080,7 @@
 				/>
 			</FileConfiguration>
 			<FileConfiguration
-				Name="Release_LTCG|Win32"
+				Name="Production|Win32"
 				>
 				<Tool
 					Name="VCCLCompilerTool"
diff --git a/Source/WebKit2/win/WebKit2Apple.vsprops b/Source/WebKit2/win/WebKit2Apple.vsprops
index 4cec313..68d01ac 100644
--- a/Source/WebKit2/win/WebKit2Apple.vsprops
+++ b/Source/WebKit2/win/WebKit2Apple.vsprops
@@ -5,6 +5,10 @@
 	Name="WebKit2Apple"
 	>
 	<Tool
+		Name="VCCLCompilerTool"
+		AdditionalIncludeDirectories="&quot;$(ProjectDir)..\WebProcess\WebPage\ca&quot;"
+	/>
+	<Tool
 		Name="VCLinkerTool"
 		AdditionalDependencies="CFNetwork$(LibraryConfigSuffix).lib CoreFoundation$(LibraryConfigSuffix).lib CoreGraphics$(LibraryConfigSuffix).lib QTMovieWin$(WebKitConfigSuffix).lib WebKitSystemInterface$(WebKitConfigSuffix).lib"
 		ModuleDefinitionFile="WebKit2.def"
diff --git a/Source/WebKit2/win/WebKit2Common.vsprops b/Source/WebKit2/win/WebKit2Common.vsprops
index e093639..1af69ae 100755
--- a/Source/WebKit2/win/WebKit2Common.vsprops
+++ b/Source/WebKit2/win/WebKit2Common.vsprops
@@ -6,7 +6,7 @@
 	>
 	<Tool
 		Name="VCCLCompilerTool"
-		AdditionalIncludeDirectories="&quot;$(ProjectDir)&quot;;&quot;$(ProjectDir)\..&quot;;&quot;$(ProjectDir)\..\Platform&quot;;&quot;$(ProjectDir)\..\Platform\cg&quot;;&quot;$(ProjectDir)\..\Platform\CoreIPC&quot;;&quot;$(ProjectDir)\..\PluginProcess&quot;;&quot;$(ProjectDir)\..\Shared&quot;;&quot;$(ProjectDir)\..\Shared\win&quot;;&quot;$(ProjectDir)\..\Shared\cf&quot;;&quot;$(ProjectDir)\..\Shared\API\c&quot;;&quot;$(ProjectDir)\..\Shared\API\c\cf&quot;;&quot;$(ProjectDir)\..\Shared\API\c\win&quot;;&quot;$(ProjectDir)\..\Shared\CoreIPCSupport&quot;;&quot;$(ProjectDir)\..\Shared\Plugins&quot;;&quot;$(ProjectDir)\..\Shared\Plugins\Netscape&quot;;&quot;$(ProjectDir)\..\UIProcess&quot;;&quot;$(ProjectDir)\..\UIProcess\API\C&quot;;&quot;$(ProjectDir)\..\UIProcess\API\C\win&quot;;&quot;$(ProjectDir)\..\UIProcess\API\cpp&quot;;&quot;$(ProjectDir)\..\UIProcess\API\win&quot;;&quot;$(ProjectDir)\..\UIProcess\Authentication&quot;;&quot;$(ProjectDir)\..\UIProcess\Downloads&quot;;&quot;$(ProjectDir)\..\UIProcess\Launcher&quot;;&quot;$(ProjectDir)\..\UIProcess\Plugins&quot;;&quot;$(ProjectDir)\..\UIProcess\win&quot;;&quot;$(ProjectDir)\..\WebProcess&quot;;&quot;$(ProjectDir)\..\WebProcess\WebCoreSupport&quot;;&quot;$(ProjectDir)\..\WebProcess\WebCoreSupport\win&quot;;&quot;$(ProjectDir)\..\WebProcess\WebPage&quot;;&quot;$(ProjectDir)\..\WebProcess\WebPage\win&quot;;&quot;$(ProjectDir)\..\WebProcess\InjectedBundle&quot;;&quot;$(ProjectDir)\..\WebProcess\InjectedBundle\API\c&quot;;&quot;$(ProjectDir)\..\WebProcess\InjectedBundle\DOM&quot;;&quot;$(ProjectDir)\..\WebProcess\InjectedBundle\win&quot;;&quot;$(ProjectDir)\..\WebProcess\Plugins&quot;;&quot;$(ProjectDir)\..\WebProcess\Plugins\Netscape&quot;;&quot;$(ProjectDir)\..\WebProcess\win&quot;;&quot;$(ProjectDir)\..\WebProcess\ApplicationCache&quot;;&quot;$(ProjectDir)\..\WebProcess\Authentication&quot;;&quot;$(ProjectDir)\..\WebProcess\Cookies&quot;;&quot;$(ProjectDir)\..\WebProcess\Downloads&quot;;&quot;$(ProjectDir)\..\WebProcess\Downloads\cf&quot;;&quot;$(ProjectDir)\..\WebProcess\Geolocation&quot;;&quot;$(ProjectDir)\..\WebProcess\KeyValueStorage&quot;;&quot;$(ProjectDir)\..\WebProcess\ResourceCache&quot;;&quot;$(ConfigurationBuildDir)\obj\$(ProjectName)\DerivedSources&quot;;&quot;$(ConfigurationBuildDir)\Include&quot;;&quot;$(ConfigurationBuildDir)\Include\private&quot;;&quot;$(WebKitLibrariesDir)\Include&quot;;&quot;$(WebKitLibrariesDir)\Include\private&quot;;&quot;$(WebKitLibrariesDir)\Include\pthreads&quot;;&quot;$(ConfigurationBuildDir)\Include\JavaScriptCore&quot;;&quot;$(ConfigurationBuildDir)\Include\private\JavaScriptCore&quot;;&quot;$(WebKitLibrariesDir)\Include\JavaScriptCore&quot;;&quot;$(WebKitLibrariesDir)\Include\private\JavaScriptCore&quot;;&quot;$(ConfigurationBuildDir)\Include\WebCore\ForwardingHeaders&quot;;&quot;$(WebKitLibrariesDir)\Include\WebCore\ForwardingHeaders&quot;"
+		AdditionalIncludeDirectories="&quot;$(ProjectDir)&quot;;&quot;$(ProjectDir)\..&quot;;&quot;$(ProjectDir)\..\Platform&quot;;&quot;$(ProjectDir)\..\Platform\cg&quot;;&quot;$(ProjectDir)\..\Platform\CoreIPC&quot;;&quot;$(ProjectDir)\..\PluginProcess&quot;;&quot;$(ProjectDir)\..\Shared&quot;;&quot;$(ProjectDir)\..\Shared\win&quot;;&quot;$(ProjectDir)\..\Shared\cf&quot;;&quot;$(ProjectDir)\..\Shared\API\c&quot;;&quot;$(ProjectDir)\..\Shared\API\c\cf&quot;;&quot;$(ProjectDir)\..\Shared\API\c\win&quot;;&quot;$(ProjectDir)\..\Shared\CoreIPCSupport&quot;;&quot;$(ProjectDir)\..\Shared\Plugins&quot;;&quot;$(ProjectDir)\..\Shared\Plugins\Netscape&quot;;&quot;$(ProjectDir)\..\UIProcess&quot;;&quot;$(ProjectDir)\..\UIProcess\API\C&quot;;&quot;$(ProjectDir)\..\UIProcess\API\C\win&quot;;&quot;$(ProjectDir)\..\UIProcess\API\cpp&quot;;&quot;$(ProjectDir)\..\UIProcess\API\win&quot;;&quot;$(ProjectDir)\..\UIProcess\Authentication&quot;;&quot;$(ProjectDir)\..\UIProcess\Downloads&quot;;&quot;$(ProjectDir)\..\UIProcess\Launcher&quot;;&quot;$(ProjectDir)\..\UIProcess\Plugins&quot;;&quot;$(ProjectDir)\..\UIProcess\win&quot;;&quot;$(ProjectDir)\..\WebProcess&quot;;&quot;$(ProjectDir)\..\WebProcess\WebCoreSupport&quot;;&quot;$(ProjectDir)\..\WebProcess\WebCoreSupport\win&quot;;&quot;$(ProjectDir)\..\WebProcess\WebPage&quot;;&quot;$(ProjectDir)\..\WebProcess\WebPage\win&quot;;&quot;$(ProjectDir)\..\WebProcess\IconDatabase&quot;;&quot;$(ProjectDir)\..\WebProcess\InjectedBundle&quot;;&quot;$(ProjectDir)\..\WebProcess\InjectedBundle\API\c&quot;;&quot;$(ProjectDir)\..\WebProcess\InjectedBundle\DOM&quot;;&quot;$(ProjectDir)\..\WebProcess\InjectedBundle\win&quot;;&quot;$(ProjectDir)\..\WebProcess\Plugins&quot;;&quot;$(ProjectDir)\..\WebProcess\Plugins\Netscape&quot;;&quot;$(ProjectDir)\..\WebProcess\win&quot;;&quot;$(ProjectDir)\..\WebProcess\ApplicationCache&quot;;&quot;$(ProjectDir)\..\WebProcess\Authentication&quot;;&quot;$(ProjectDir)\..\WebProcess\Cookies&quot;;&quot;$(ProjectDir)\..\WebProcess\Cookies\cf&quot;;&quot;$(ProjectDir)\..\WebProcess\Downloads&quot;;&quot;$(ProjectDir)\..\WebProcess\Downloads\cf&quot;;&quot;$(ProjectDir)\..\WebProcess\FullScreen&quot;;&quot;$(ProjectDir)\..\WebProcess\Geolocation&quot;;&quot;$(ProjectDir)\..\WebProcess\KeyValueStorage&quot;;&quot;$(ProjectDir)\..\WebProcess\MediaCache&quot;;&quot;$(ProjectDir)\..\WebProcess\ResourceCache&quot;;&quot;$(ConfigurationBuildDir)\obj\$(ProjectName)\DerivedSources&quot;;&quot;$(ConfigurationBuildDir)\Include&quot;;&quot;$(ConfigurationBuildDir)\Include\private&quot;;&quot;$(WebKitLibrariesDir)\Include&quot;;&quot;$(WebKitLibrariesDir)\Include\private&quot;;&quot;$(WebKitLibrariesDir)\Include\pthreads&quot;;&quot;$(ConfigurationBuildDir)\Include\JavaScriptCore&quot;;&quot;$(ConfigurationBuildDir)\Include\private\JavaScriptCore&quot;;&quot;$(WebKitLibrariesDir)\Include\JavaScriptCore&quot;;&quot;$(WebKitLibrariesDir)\Include\private\JavaScriptCore&quot;;&quot;$(ConfigurationBuildDir)\Include\WebCore\ForwardingHeaders&quot;;&quot;$(WebKitLibrariesDir)\Include\WebCore\ForwardingHeaders&quot;"
 		PreprocessorDefinitions="_USRDLL;WEBKIT_EXPORTS;FRAMEWORK_NAME=WebKit;BUILDING_WEBKIT"
 		UsePrecompiledHeader="2"
 		PrecompiledHeaderThrough="WebKit2Prefix.h"
diff --git a/Source/WebKit2/win/WebKit2Debug.vsprops b/Source/WebKit2/win/WebKit2Debug.vsprops
new file mode 100644
index 0000000..b9b30a4
--- /dev/null
+++ b/Source/WebKit2/win/WebKit2Debug.vsprops
@@ -0,0 +1,14 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="WebKit2Debug"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;
+      .\WebKit2Common.vsprops;
+      .\WebKit2DirectX.vsprops;
+      .\WebKit2Apple.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Source/WebKit2/win/WebKit2DebugAll.vsprops b/Source/WebKit2/win/WebKit2DebugAll.vsprops
new file mode 100644
index 0000000..2397b8e
--- /dev/null
+++ b/Source/WebKit2/win/WebKit2DebugAll.vsprops
@@ -0,0 +1,15 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="WebKit2DebugAll"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\debug_all.vsprops;
+      .\WebKit2Common.vsprops;
+      .\WebKit2DirectX.vsprops;
+      .\WebKit2Apple.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Source/WebKit2/win/WebKit2DebugCairoCFLite.vsprops b/Source/WebKit2/win/WebKit2DebugCairoCFLite.vsprops
new file mode 100644
index 0000000..967cf1c
--- /dev/null
+++ b/Source/WebKit2/win/WebKit2DebugCairoCFLite.vsprops
@@ -0,0 +1,16 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="WebKit2DebugCairoCFLite"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefinesCairo.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\debug_wincairo.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\cURL.vsprops;
+      .\WebKit2Common.vsprops;
+      .\WebKit2CFLite.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\WinCairo.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Source/WebKit2/win/WebKit2Generated.make b/Source/WebKit2/win/WebKit2Generated.make
index b5c2134..79c5f14 100644
--- a/Source/WebKit2/win/WebKit2Generated.make
+++ b/Source/WebKit2/win/WebKit2Generated.make
@@ -1,6 +1,7 @@
 all:
     touch "%ConfigurationBuildDir%\buildfailed"
     -mkdir 2>NUL "%ConfigurationBuildDir%\include\WebKit2"
+    xcopy /y /d "..\Shared\API\c\cf\WKErrorCF.h" "%ConfigurationBuildDir%\include\WebKit2"
     xcopy /y /d "..\Shared\API\c\cf\WKStringCF.h" "%ConfigurationBuildDir%\include\WebKit2"
     xcopy /y /d "..\Shared\API\c\cf\WKURLCF.h" "%ConfigurationBuildDir%\include\WebKit2"
     xcopy /y /d "..\Shared\API\c\cf\WKURLRequestCF.h" "%ConfigurationBuildDir%\include\WebKit2"
@@ -57,6 +58,7 @@ all:
     xcopy /y /d "..\UIProcess\API\C\WKGeolocationPosition.h" "%ConfigurationBuildDir%\include\WebKit2"
     xcopy /y /d "..\UIProcess\API\C\WKInspector.h" "%ConfigurationBuildDir%\include\WebKit2"
     xcopy /y /d "..\UIProcess\API\C\WKKeyValueStorageManager.h" "%ConfigurationBuildDir%\include\WebKit2"
+    xcopy /y /d "..\UIProcess\API\C\WKMediaCacheManager.h" "%ConfigurationBuildDir%\include\WebKit2"
     xcopy /y /d "..\UIProcess\API\C\WKNativeEvent.h" "%ConfigurationBuildDir%\include\WebKit2"
     xcopy /y /d "..\UIProcess\API\C\WKNavigationData.h" "%ConfigurationBuildDir%\include\WebKit2"
     xcopy /y /d "..\UIProcess\API\C\WKOpenPanelParameters.h" "%ConfigurationBuildDir%\include\WebKit2"
@@ -74,6 +76,7 @@ all:
     xcopy /y /d "..\UIProcess\API\C\win\WKView.h" "%ConfigurationBuildDir%\include\WebKit2"
     xcopy /y /d "..\UIProcess\API\C\win\WKViewPrivate.h" "%ConfigurationBuildDir%\include\WebKit2"
     xcopy /y /d "..\UIProcess\API\cpp\WKRetainPtr.h" "%ConfigurationBuildDir%\include\WebKit2"
+    xcopy /y /d "..\WebProcess\InjectedBundle\API\c\win\WKBundlePrivateWin.h" "%ConfigurationBuildDir%\include\WebKit2"
     xcopy /y /d "..\WebProcess\InjectedBundle\API\c\WKBundle.h" "%ConfigurationBuildDir%\include\WebKit2"
     xcopy /y /d "..\WebProcess\InjectedBundle\API\c\WKBundleBackForwardList.h" "%ConfigurationBuildDir%\include\WebKit2"
     xcopy /y /d "..\WebProcess\InjectedBundle\API\c\WKBundleBackForwardListItem.h" "%ConfigurationBuildDir%\include\WebKit2"
diff --git a/Source/WebKit2/win/WebKit2Generated.vcproj b/Source/WebKit2/win/WebKit2Generated.vcproj
index 901e87d..75ea918 100755
--- a/Source/WebKit2/win/WebKit2Generated.vcproj
+++ b/Source/WebKit2/win/WebKit2Generated.vcproj
@@ -43,7 +43,7 @@
 			/>
 		</Configuration>
 		<Configuration
-			Name="Release_LTCG|Win32"
+			Name="Production|Win32"
 			ConfigurationType="0"
 			InheritedPropertySheets=".\WebKit2GeneratedCommon.vsprops"
 			>
diff --git a/Source/WebKit2/win/WebKit2Production.vsprops b/Source/WebKit2/win/WebKit2Production.vsprops
new file mode 100644
index 0000000..5bdec6f
--- /dev/null
+++ b/Source/WebKit2/win/WebKit2Production.vsprops
@@ -0,0 +1,15 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="WebKit2Production"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\production.vsprops;
+      .\WebKit2Common.vsprops;
+      .\WebKit2DirectX.vsprops;
+      .\WebKit2Apple.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Source/WebKit2/win/WebKit2Release.vsprops b/Source/WebKit2/win/WebKit2Release.vsprops
new file mode 100644
index 0000000..7ae6676
--- /dev/null
+++ b/Source/WebKit2/win/WebKit2Release.vsprops
@@ -0,0 +1,14 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="WebKit2Release"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
+      .\WebKit2Common.vsprops;
+      .\WebKit2DirectX.vsprops;
+      .\WebKit2Apple.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Source/WebKit2/win/WebKit2ReleaseCairoCFLite.vsprops b/Source/WebKit2/win/WebKit2ReleaseCairoCFLite.vsprops
new file mode 100644
index 0000000..685f929
--- /dev/null
+++ b/Source/WebKit2/win/WebKit2ReleaseCairoCFLite.vsprops
@@ -0,0 +1,15 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="WebKit2ReleaseCairoCFLite"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefinesCairo.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\WinCairo.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\cURL.vsprops;
+      .\WebKit2Common.vsprops;
+      .\WebKit2CFLite.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Source/WebKit2/win/WebKit2WebProcess.vcproj b/Source/WebKit2/win/WebKit2WebProcess.vcproj
index ab34908..16a0238 100755
--- a/Source/WebKit2/win/WebKit2WebProcess.vcproj
+++ b/Source/WebKit2/win/WebKit2WebProcess.vcproj
@@ -17,7 +17,7 @@
 		<Configuration
 			Name="Debug|Win32"
 			ConfigurationType="1"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;.\WebKit2WebProcessCommon.vsprops"
+			InheritedPropertySheets=".\WebKit2WebProcessDebug.vsprops"
 			CharacterSet="1"
 			>
 			<Tool
@@ -78,7 +78,7 @@
 		<Configuration
 			Name="Release|Win32"
 			ConfigurationType="1"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;.\WebKit2WebProcessCommon.vsprops"
+			InheritedPropertySheets=".\WebKit2WebProcessRelease.vsprops"
 			CharacterSet="1"
 			>
 			<Tool
@@ -139,7 +139,7 @@
 		<Configuration
 			Name="Debug_All|Win32"
 			ConfigurationType="1"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\debug_all.vsprops;.\WebKit2WebProcessCommon.vsprops"
+			InheritedPropertySheets=".\WebKit2WebProcessDebugAll.vsprops"
 			CharacterSet="1"
 			>
 			<Tool
@@ -200,7 +200,7 @@
 		<Configuration
 			Name="Debug_Cairo_CFLite|Win32"
 			ConfigurationType="1"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefinesCairo.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\debug_wincairo.vsprops;.\WebKit2WebProcessCommon.vsprops"
+			InheritedPropertySheets=".\WebKit2WebProcessDebugCairoCFLite.vsprops"
 			CharacterSet="1"
 			>
 			<Tool
@@ -259,9 +259,9 @@
 			/>
 		</Configuration>
 		<Configuration
-			Name="Release_LTCG|Win32"
+			Name="Production|Win32"
 			ConfigurationType="1"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;.\WebKit2WebProcessCommon.vsprops"
+			InheritedPropertySheets=".\WebKit2WebProcessProduction.vsprops"
 			CharacterSet="1"
 			WholeProgramOptimization="1"
 			>
@@ -323,7 +323,7 @@
 		<Configuration
 			Name="Release_Cairo_CFLite|Win32"
 			ConfigurationType="1"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefinesCairo.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\WinCairo.vsprops;.\WebKit2WebProcessCommon.vsprops"
+			InheritedPropertySheets=".\WebKit2WebProcessReleaseCairoCFLite.vsprops"
 			CharacterSet="1"
 			>
 			<Tool
diff --git a/Source/WebKit2/win/WebKit2WebProcessDebug.vsprops b/Source/WebKit2/win/WebKit2WebProcessDebug.vsprops
new file mode 100644
index 0000000..0beec34
--- /dev/null
+++ b/Source/WebKit2/win/WebKit2WebProcessDebug.vsprops
@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="WebKit2WebProcessDebug"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;
+      .\WebKit2WebProcessCommon.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Source/WebKit2/win/WebKit2WebProcessDebugAll.vsprops b/Source/WebKit2/win/WebKit2WebProcessDebugAll.vsprops
new file mode 100644
index 0000000..54886b8
--- /dev/null
+++ b/Source/WebKit2/win/WebKit2WebProcessDebugAll.vsprops
@@ -0,0 +1,13 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="WebKit2WebProcessDebugAll"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\debug_all.vsprops;
+      .\WebKit2WebProcessCommon.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Source/WebKit2/win/WebKit2WebProcessDebugCairoCFLite.vsprops b/Source/WebKit2/win/WebKit2WebProcessDebugCairoCFLite.vsprops
new file mode 100644
index 0000000..c05f6c1
--- /dev/null
+++ b/Source/WebKit2/win/WebKit2WebProcessDebugCairoCFLite.vsprops
@@ -0,0 +1,13 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="WebKit2WebProcessDebugCairoCFLite"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefinesCairo.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\debug_wincairo.vsprops;
+      .\WebKit2WebProcessCommon.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Source/WebKit2/win/WebKit2WebProcessProduction.vsprops b/Source/WebKit2/win/WebKit2WebProcessProduction.vsprops
new file mode 100644
index 0000000..08c8ae2
--- /dev/null
+++ b/Source/WebKit2/win/WebKit2WebProcessProduction.vsprops
@@ -0,0 +1,13 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="WebKit2WebProcessProduction"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\production.vsprops;
+      .\WebKit2WebProcessCommon.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Source/WebKit2/win/WebKit2WebProcessRelease.vsprops b/Source/WebKit2/win/WebKit2WebProcessRelease.vsprops
new file mode 100644
index 0000000..a32a112
--- /dev/null
+++ b/Source/WebKit2/win/WebKit2WebProcessRelease.vsprops
@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="WebKit2WebProcessRelease"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
+      .\WebKit2WebProcessCommon.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Source/WebKit2/win/WebKit2WebProcessReleaseCairoCFLite.vsprops b/Source/WebKit2/win/WebKit2WebProcessReleaseCairoCFLite.vsprops
new file mode 100644
index 0000000..d278242
--- /dev/null
+++ b/Source/WebKit2/win/WebKit2WebProcessReleaseCairoCFLite.vsprops
@@ -0,0 +1,13 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="WebKit2WebProcessReleaseCairoCFLite"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefinesCairo.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\WinCairo.vsprops;
+      .\WebKit2WebProcessCommon.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Source/cmake/OptionsEfl.cmake b/Source/cmake/OptionsEfl.cmake
index 74fcbd7..6b0b080 100644
--- a/Source/cmake/OptionsEfl.cmake
+++ b/Source/cmake/OptionsEfl.cmake
@@ -127,11 +127,11 @@ ENDIF ()
 IF (FONT_BACKEND STREQUAL "freetype")
   FIND_PACKAGE(Freetype 9.0 REQUIRED)
   SET(WTF_USE_FREETYPE 1)
-  ADD_DEFINITIONS(-DUSE_FREETYPE=1)
+  ADD_DEFINITIONS(-DWTF_USE_FREETYPE=1)
 ELSE ()
   FIND_PACKAGE(Pango REQUIRED)
   SET(WTF_USE_PANGO 1)
-  ADD_DEFINITIONS(-DUSE_PANGO=1)
+  ADD_DEFINITIONS(-DWTF_USE_PANGO=1)
 
   IF (NOT ENABLE_GLIB_SUPPORT)
     SET(ENABLE_GLIB_SUPPORT 1)
diff --git a/Source/gyp/common.gypi b/Source/gyp/common.gypi
index 892009c..d40bd84 100644
--- a/Source/gyp/common.gypi
+++ b/Source/gyp/common.gypi
@@ -1,10 +1,10 @@
 {
   'target_defaults': {
     'configurations': {
-      'Debug': {},
-      'Release': {},
       'Production': {},
+      'Release': {},
+      'Debug': {},
     },
-    'default_configuration': 'Debug',
+    'default_configuration': 'Production',
   },
 }
diff --git a/Source/gyp/configure b/Source/gyp/configure
index cd2b126..28d6677 100755
--- a/Source/gyp/configure
+++ b/Source/gyp/configure
@@ -31,35 +31,85 @@
 import os
 import subprocess
 
+from optparse import OptionParser
 
-PROJECTS = [
-    "JavaScriptGlue",
-    "JavaScriptCore",
-    "WebCore",
-]
+def chdir_to_source():
+    source_directory = os.path.abspath(os.path.join(__file__, '..', '..'))
+    os.chdir(source_directory)
+
+def gyp():
+    return os.path.join('ThirdParty', 'gyp', 'gyp')
 
+class Project:
+    def __init__(self, name):
+        self._name = name
 
-def create_project(project):
-    subprocess.call([
-        'gyp',  # FIXME: gyp shouldn't need to be in the PATH.
-        os.path.join(project, 'gyp', project + '.gyp'),
-        '-G',
-        'xcode_list_excluded_files=0',
-        '--depth=.',
-    ])
+    def name(self):
+        return self._name
 
+    def inputs(self):
+        return [
+            os.path.join(self._name, 'gyp', self._name + '.gyp'),
+            os.path.join(self._name, self._name + '.gypi'),
+            os.path.join('gyp', 'common.gypi'),
+        ]
 
-def create_all_projects():
-    for project in PROJECTS:
-        create_project(project)
+    def output(self):
+        return os.path.join(self._name, 'gyp', self._name + '.xcodeproj', 'project.pbxproj')
 
+    def should_generate(self):
+        if not os.path.exists(self.output()):
+            return True
+        return os.path.getmtime(self.output()) < self._newest(self.inputs())
+
+    def generate(self):
+        subprocess.call([
+            gyp(),
+            self.inputs()[0],
+            '-G',
+            'xcode_list_excluded_files=0',
+            '--depth=.',
+        ])
+        # GYP doesn't always touch the output file, but we want to touch the
+        # file so that we don't keep trying to regenerate it.
+        os.utime(self.output(), None)
+
+    @staticmethod
+    def _newest(paths):
+        return max([os.path.getmtime(path) for path in paths])
+
+PROJECTS = [
+    Project("JavaScriptCore"),
+    Project("WebCore"),
+]
+
+def projects_to_generate():
+    should_generate = [project for project in PROJECTS if project.should_generate()]
+    already_generated = [project.name() for project in set(PROJECTS) - set(should_generate)]
+
+    if already_generated:
+        print "Not generating %s because the generated files exist and are newer than the GYP files." % ', '.join(already_generated)
+        print "Pass --regenerate-projects to override."
+
+    return should_generate
 
 def main():
-    source_directory = os.path.abspath(os.path.join(__file__, '..', '..'))
-    os.chdir(source_directory)
+    chdir_to_source()
+
+    parser = OptionParser()
     # FIXME: The user should be able to pass which port on the command line.
-    create_all_projects()
+    parser.add_option("--regenerate-projects", dest="regenerate_projects",
+                      default=False, action="store_true",
+                      help="Generate all project files even if they appear to be up to date.")
+    (options, args) = parser.parse_args()
+
+    projects = PROJECTS
+    if not options.regenerate_projects:
+        projects = projects_to_generate()
 
+    for project in projects:
+        print "Generating %s." % project.name()
+        project.generate()
 
 if __name__ == "__main__":
     main()
diff --git a/Source/gyp/remove-headers-if-needed.sh b/Source/gyp/remove-headers-if-needed.sh
deleted file mode 100644
index 4137859..0000000
--- a/Source/gyp/remove-headers-if-needed.sh
+++ /dev/null
@@ -1,3 +0,0 @@
-if (( TARGET_MAC_OS_X_VERSION_MAJOR > 1050 )); then
-    rm -rf \"$BUILT_PRODUCTS_DIR/$PUBLIC_HEADERS_FOLDER_PATH\"/*.h;
-fi
diff --git a/Tools/BuildSlaveSupport/build.webkit.org-config/config.json b/Tools/BuildSlaveSupport/build.webkit.org-config/config.json
index 09953ab..28ff304 100644
--- a/Tools/BuildSlaveSupport/build.webkit.org-config/config.json
+++ b/Tools/BuildSlaveSupport/build.webkit.org-config/config.json
@@ -219,15 +219,19 @@
                   ],
 
     "schedulers": [ { "type": "AnyBranchScheduler", "name": "trunk", "change_filter": "trunk_filter", "treeStableTimer": 45.0,
-                      "builderNames": ["Leopard Intel Release (Build)", "Leopard Intel Debug (Build)",
-                                       "SnowLeopard Intel Release (Build)", "SnowLeopard Intel Leaks",
-                                       "GTK Linux 32-bit Release", "GTK Linux 32-bit Debug", "GTK Linux 64-bit Debug",
+                      "builderNames": ["GTK Linux 32-bit Release", "GTK Linux 32-bit Debug", "GTK Linux 64-bit Debug",
                                        "Qt Linux Release", "Qt Linux Release minimal", "Qt Linux ARMv7 Release",
                                        "Qt Windows 32-bit Release", "Qt Windows 32-bit Debug",
                                        "Chromium Win Release", "Chromium Mac Release", "Chromium Linux Release",
                                        "Chromium Win Release (Tests)", "Chromium Mac Release (Tests)", "Chromium Linux Release (Tests)",
                                        "WinCairo Debug (Build)", "WinCE Release (Build)", "EFL Linux Release (Build)"]
                     },
+                    { "type": "PlatformSpecificScheduler", "platform": "mac-leopard", "branch": "trunk", "treeStableTimer": 45.0,
+                      "builderNames": ["Leopard Intel Release (Build)", "Leopard Intel Debug (Build)"]
+                    },
+                    { "type": "PlatformSpecificScheduler", "platform": "mac-snowleopard", "branch": "trunk", "treeStableTimer": 45.0,
+                      "builderNames": ["SnowLeopard Intel Release (Build)", "SnowLeopard Intel Leaks"]
+                    },
                     { "type": "PlatformSpecificScheduler", "platform": "win", "branch": "trunk", "treeStableTimer": 45.0,
                       "builderNames": ["Windows Release (Build)", "Windows Debug (Build)"]
                     },
diff --git a/Tools/BuildSlaveSupport/build.webkit.org-config/master.cfg b/Tools/BuildSlaveSupport/build.webkit.org-config/master.cfg
index 7913095..1beee38 100644
--- a/Tools/BuildSlaveSupport/build.webkit.org-config/master.cfg
+++ b/Tools/BuildSlaveSupport/build.webkit.org-config/master.cfg
@@ -145,7 +145,7 @@ class RunJavaScriptCoreTests(shell.Test):
     description = ["jscore-tests running"]
     descriptionDone = ["jscore-tests"]
     command = ["perl", "./Tools/Scripts/run-javascriptcore-tests", WithProperties("--%(configuration)s")]
-    logfiles = {'results': 'Source/JavaScriptCore/tests/mozilla/actual.html'}
+    logfiles = {'actual.html (source)': 'Source/JavaScriptCore/tests/mozilla/actual.html'}
 
     def __init__(self, skipBuild=False, *args, **kwargs):
         self.skipBuild = skipBuild
@@ -168,6 +168,9 @@ class RunJavaScriptCoreTests(shell.Test):
         else:
             self.regressionLine = None
 
+        if 'actual.html (source)' in cmd.logs:
+            self.addHTMLLog('actual.html', cmd.logs['actual.html (source)'].getText())
+
     def evaluateCommand(self, cmd):
         if self.regressionLine:
             return FAILURE
@@ -360,6 +363,7 @@ class RunQtAPITests(shell.Test):
         return [self.name]
 
 class RunWebKitLeakTests(RunWebKitTests):
+    warnOnWarnings = True
     def start(self):
         self.setCommand(self.command + ["--leaks"])
         return RunWebKitTests.start(self)
diff --git a/Tools/BuildSlaveSupport/build.webkit.org-config/public_html/LeaksViewer/LeaksLoader.js b/Tools/BuildSlaveSupport/build.webkit.org-config/public_html/LeaksViewer/LeaksLoader.js
new file mode 100644
index 0000000..e559e73
--- /dev/null
+++ b/Tools/BuildSlaveSupport/build.webkit.org-config/public_html/LeaksViewer/LeaksLoader.js
@@ -0,0 +1,65 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+function LeaksLoader(didCountLeaksFilesCallback, didLoadLeaksFileCallback) {
+    this._didCountLeaksFilesCallback = didCountLeaksFilesCallback;
+    this._didLoadLeaksFileCallback = didLoadLeaksFileCallback;
+}
+
+LeaksLoader.prototype = {
+    start: function(url) {
+        if (/\.txt$/.test(url))
+            this._loadLeaksFiles([url]);
+        else
+            this._loadLeaksFromResultsPage(url);
+    },
+
+    _loadLeaksFiles: function(urls) {
+        this._didCountLeaksFilesCallback(urls.length);
+
+        var self = this;
+        var pendingURLs = urls.length;
+        urls.forEach(function(url) {
+            getResource(url, function(xhr) {
+                self._didLoadLeaksFileCallback(xhr.responseText);
+            });
+        });
+    },
+
+    _loadLeaksFromResultsPage: function(url) {
+        var self = this;
+        getResource(url, function(xhr) {
+            var root = document.createElement("html");
+            root.innerHTML = xhr.responseText;
+
+            // Strip off everything after the last /.
+            var baseURL = url.substring(0, url.lastIndexOf("/") + 1);
+
+            var urls = Array.prototype.map.call(root.querySelectorAll("tr.file > td > a[href$='-leaks.txt']"), function(link) { return baseURL + link.getAttribute("href"); });
+
+            self._loadLeaksFiles(urls);
+        });
+    },
+};
diff --git a/Tools/BuildSlaveSupport/build.webkit.org-config/public_html/LeaksViewer/LeaksParser.js b/Tools/BuildSlaveSupport/build.webkit.org-config/public_html/LeaksViewer/LeaksParser.js
new file mode 100644
index 0000000..bcd3800
--- /dev/null
+++ b/Tools/BuildSlaveSupport/build.webkit.org-config/public_html/LeaksViewer/LeaksParser.js
@@ -0,0 +1,40 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+function LeaksParser(didParseLeaksFileCallback) {
+    this._didParseLeaksFileCallback = didParseLeaksFileCallback;
+    this._worker = new Worker("LeaksParserWorker.js");
+
+    var self = this;
+    this._worker.onmessage = function(e) {
+        self._didParseLeaksFileCallback(e.data);
+    };
+}
+
+LeaksParser.prototype = {
+    addLeaksFile: function(leaksText) {
+        this._worker.postMessage(leaksText);
+    },
+};
diff --git a/Tools/BuildSlaveSupport/build.webkit.org-config/public_html/LeaksViewer/LeaksParserWorker.js b/Tools/BuildSlaveSupport/build.webkit.org-config/public_html/LeaksViewer/LeaksParserWorker.js
new file mode 100644
index 0000000..c425b15
--- /dev/null
+++ b/Tools/BuildSlaveSupport/build.webkit.org-config/public_html/LeaksViewer/LeaksParserWorker.js
@@ -0,0 +1,101 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+function LeaksParserWorker() {
+    this.profile = this._createNode("top level");
+}
+
+LeaksParserWorker.prototype = {
+    addLeaksFile: function(leaksText) {
+        this._incorporateLeaks(this._parseLeaks(leaksText));
+    },
+
+    _parseLeaks: function(text) {
+        var leaks = [];
+        var currentSize = 0;
+        text.split("\n").forEach(function(line) {
+            var match = /^Leak:.*\ssize=(\d+)\s/.exec(line);
+            if (match) {
+                currentSize = parseInt(match[1], 10);
+                return;
+            }
+            if (!/^\s+Call stack:/.test(line))
+                return;
+
+            // The first frame is not really a frame at all ("Call stack: thread 0xNNNNN:"), so we omit it.
+            leaks.push({ size: currentSize, stack: line.split(" | ").slice(1).map(function(str) { return str.trim(); }) });
+            currentSize = 0;
+        });
+        return leaks;
+    },
+
+    _createNode: function(functionName) {
+        return {
+            functionName: functionName,
+            selfTime: 0,
+            totalTime: 0,
+            averageTime: 0,
+            numberOfCalls: 0,
+            children: [],
+            childrenByName: {},
+            callUID: functionName,
+        };
+    },
+
+    // This function creates a fake "profile" from a set of leak stacks. "selfTime" is the number of
+    // stacks in which this function was at the top (in theory, only functions like malloc should have a
+    // non-zero selfTime). "totalTime" is the number of stacks which contain this function (and thus is
+    // the number of leaks that occurred in or beneath this function).
+    // FIXME: This is expensive! Can we parallelize it?
+    _incorporateLeaks: function(leaks) {
+        var self = this;
+        leaks.forEach(function(leak) {
+            leak.stack.reduce(function(node, frame, index, array) {
+                var childNode;
+                if (frame in node.childrenByName)
+                    childNode = node.childrenByName[frame];
+                else {
+                    childNode = self._createNode(frame);
+                    childNode.head = self.profile;
+                    node.childrenByName[frame] = childNode;
+                    node.children.push(childNode);
+                }
+                if (index === array.length - 1)
+                    childNode.selfTime += leak.size;
+                childNode.totalTime += leak.size;
+                ++childNode.numberOfCalls;
+                return childNode;
+            }, self.profile);
+        });
+        self.profile.totalTime = self.profile.children.reduce(function(sum, child) { return sum + child.totalTime; }, 0);
+    },
+};
+
+var parser = new LeaksParserWorker();
+
+onmessage = function(e) {
+    parser.addLeaksFile(e.data);
+    postMessage(parser.profile);
+}
diff --git a/Tools/BuildSlaveSupport/build.webkit.org-config/public_html/LeaksViewer/LeaksViewer.css b/Tools/BuildSlaveSupport/build.webkit.org-config/public_html/LeaksViewer/LeaksViewer.css
new file mode 100644
index 0000000..76d71a8
--- /dev/null
+++ b/Tools/BuildSlaveSupport/build.webkit.org-config/public_html/LeaksViewer/LeaksViewer.css
@@ -0,0 +1,91 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#url-prompt-container {
+    position: absolute;
+    top: 0;
+    bottom: 0;
+    left: 0;
+    right: 0;
+    background-color: rgba(0, 0, 0, 0.5);
+    z-index: 50000;
+}
+
+#url-prompt {
+    position: absolute;
+    top: 0;
+    bottom: 0;
+    left: 0;
+    right: 0;
+    width: 400px;
+    height: 300px;
+    margin: auto;
+    background-color: white;
+    -webkit-box-shadow: 0 5px 10px rgba(0, 0, 0, 0.8);
+    padding: 50px 0;
+    text-align: center;
+}
+
+#loading-indicator {
+    position: absolute;
+    right: 20px;
+    width: 150px;
+    margin-top: 5px;
+}
+
+#spinner {
+    float: left;
+    margin-top: -1px;
+}
+
+#loading-indicator-label {
+    margin-left: 5px;
+}
+
+#recent-builds-loading-indicator {
+    color: gray;
+}
+
+#recent-builds-list {
+    list-style: none;
+    margin: 0;
+    padding: 0;
+}
+
+/* Inspector style overrides */
+
+.percent-time-status-bar-item {
+    /* We always show leak counts as real values, not percentages, so this button isn't useful. */
+    display: none !important;
+}
+
+.data-grid .data-container {
+    overflow-x: visible;
+    overflow-y: auto;
+}
+
+.data-grid td > div, .data-grid th > div {
+    overflow: visible;
+}
diff --git a/Tools/BuildSlaveSupport/build.webkit.org-config/public_html/LeaksViewer/LeaksViewer.js b/Tools/BuildSlaveSupport/build.webkit.org-config/public_html/LeaksViewer/LeaksViewer.js
new file mode 100644
index 0000000..bd83f1a
--- /dev/null
+++ b/Tools/BuildSlaveSupport/build.webkit.org-config/public_html/LeaksViewer/LeaksViewer.js
@@ -0,0 +1,202 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+var LeaksViewer = {
+    loaded: function() {
+        this._loader = new LeaksLoader(this._didCountLeaksFiles.bind(this), this._didLoadLeaksFile.bind(this));
+        this._parser = new LeaksParser(this._didParseLeaksFile.bind(this));
+
+        this._loadingIndicator = document.getElementById("loading-indicator");
+        this._loadingIndicatorLabel = document.getElementById("loading-indicator-label");
+
+        this._profileView = new WebInspector.CPUProfileView({});
+        document.getElementById("main-panels").appendChild(this._profileView.element);
+        this._profileView.show();
+
+        // From WebInspector.Panel.prototype.show
+        var statusBarItems = this._profileView.statusBarItems;
+        if (statusBarItems) {
+            this._statusBarItemContainer = document.createElement("div");
+            for (var i = 0; i < statusBarItems.length; ++i)
+                this._statusBarItemContainer.appendChild(statusBarItems[i]);
+            document.getElementById("main-status-bar").appendChild(this._statusBarItemContainer);
+        }
+
+        var url;
+        var match = /url=([^&]+)/.exec(location.search);
+        if (match)
+            url = decodeURIComponent(match[1]);
+
+        if (url)
+            this._loadLeaksFromURL(url)
+        else
+            this._displayURLPrompt();
+    },
+
+    get filesLeftToParse() {
+        if (!('_filesLeftToParse' in this))
+            this._filesLeftToParse = 0;
+        return this._filesLeftToParse;
+    },
+
+    set filesLeftToParse(x) {
+        if (this._filesLeftToParse === x)
+            return;
+        this._filesLeftToParse = x;
+        this._loadingStatusChanged();
+    },
+
+    get loading() {
+        return this._isLoading;
+    },
+
+    set loading(x) {
+        if (this._isLoading === x)
+            return;
+        this._isLoading = x;
+        this._loadingStatusChanged();
+    },
+
+    get url() {
+        return this._url;
+    },
+
+    set url(x) {
+        if (this._url === x)
+            return;
+
+        this._url = x;
+        this._updateTitle();
+    },
+
+    urlPromptButtonClicked: function(e) {
+        this._urlChosenFromPrompt(document.getElementById("url").value);
+    },
+
+    _didCountLeaksFiles: function(fileCount) {
+        this._fileCount = fileCount;
+        this.filesLeftToParse = fileCount;
+    },
+
+    _didLoadLeaksFile: function(leaksText) {
+        this._parser.addLeaksFile(leaksText);
+    },
+
+    _didLoadRecentBuilds: function(builds) {
+        this._recentBuilds = builds;
+        this._updateURLPrompt();
+    },
+
+    _didParseLeaksFile: function(profile) {
+        if (--this.filesLeftToParse)
+            return;
+        ProfilerAgent.profileReady(profile);
+        this.loading = false;
+    },
+
+    _displayURLPrompt: function() {
+        document.getElementById("url-prompt-container").removeStyleClass("hidden");
+        document.getElementById("url").focus();
+        var loader = new RecentBuildsLoader(this._didLoadRecentBuilds.bind(this));
+        loader.start("SnowLeopard Intel Leaks", this._numberOfRecentBuildsToLoad);
+    },
+
+    _loadLeaksFromURL: function(url) {
+        this.url = url;
+        this.loading = true;
+
+        this._loader.start(this.url);
+    },
+
+    _loadingIndicatorText: function() {
+        var text = "Loading";
+        if (this.filesLeftToParse)
+            text += " " + (this._fileCount - this.filesLeftToParse + 1) + "/" + this._fileCount + " files";
+        text += "\u2026";
+        return text;
+    },
+
+    _loadingStatusChanged: function() {
+        this._setLoadingIndicatorHidden(!this.loading);
+        this._updateLoadingIndicatorLabel();
+        this._updateTitle();
+    },
+
+    _numberOfRecentBuildsToLoad: 10,
+
+    _setLoadingIndicatorHidden: function(hidden) {
+        if (hidden)
+            this._loadingIndicator.addStyleClass("hidden");
+        else
+            this._loadingIndicator.removeStyleClass("hidden");
+    },
+
+    _updateLoadingIndicatorLabel: function() {
+        this._loadingIndicatorLabel.innerText = this._loadingIndicatorText();
+    },
+
+    _updateTitle: function() {
+        var title = "Leaks Viewer \u2014 ";
+        if (this.loading)
+            title += "(" + this._loadingIndicatorText() + ") ";
+        title += this.url;
+        document.title = title;
+    },
+
+    _updateURLPrompt: function() {
+        var recentBuildsContainer = document.getElementById("recent-builds-container");
+        recentBuildsContainer.removeChildren();
+        if (this._recentBuilds && this._recentBuilds.length) {
+            var list = document.createElement("ol");
+            list.id = "recent-builds-list";
+
+            var self = this;
+            this._recentBuilds.forEach(function(build) {
+                var link = document.createElement("a");
+                link.href = document.location.href + "?url=" + encodeURIComponent(build.url);
+                link.addEventListener("click", function(e) {
+                    self._urlChosenFromPrompt(build.url);
+                    e.preventDefault();
+                });
+                link.appendChild(document.createTextNode("r" + build.revision + ": " + build.leakCount + " leaks"));
+                var item = document.createElement("li");
+                item.appendChild(link);
+
+                list.appendChild(item);
+            });
+
+            recentBuildsContainer.appendChild(list);
+        } else
+            recentBuildsContainer.appendChild(document.createTextNode("No recent leaky builds found."));
+    },
+
+    _urlChosenFromPrompt: function(url) {
+        this._loadLeaksFromURL(url);
+        document.getElementById("url-prompt-container").addStyleClass("hidden");
+    },
+
+};
+
+addEventListener("load", LeaksViewer.loaded.bind(LeaksViewer));
diff --git a/Tools/BuildSlaveSupport/build.webkit.org-config/public_html/LeaksViewer/RecentBuildsLoader.js b/Tools/BuildSlaveSupport/build.webkit.org-config/public_html/LeaksViewer/RecentBuildsLoader.js
new file mode 100644
index 0000000..c15aef2
--- /dev/null
+++ b/Tools/BuildSlaveSupport/build.webkit.org-config/public_html/LeaksViewer/RecentBuildsLoader.js
@@ -0,0 +1,80 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+function RecentBuildsLoader(didLoadRecentBuildsCallback) {
+    this._didLoadRecentBuildsCallback = didLoadRecentBuildsCallback;
+}
+
+RecentBuildsLoader.prototype = {
+    start: function(builderName, maximumNumberOfBuilds) {
+        var url = this._buildbotBaseURL + "/json/builders/" + builderName + "/builds/?";
+        url += range(maximumNumberOfBuilds).map(function(n) { return "select=-" + (n + 1); }).join("&");
+        var self = this;
+        getResource(url, function(xhr) {
+            var data = JSON.parse(xhr.responseText);
+            var builds = [];
+            Object.keys(data).forEach(function(buildNumber) {
+                var build = data[buildNumber];
+
+                var buildInfo = {
+                    revision: build.sourceStamp.changes[0].rev,
+                    leakCount: 0,
+                    url: null,
+                };
+                for (var stepIndex = 0; stepIndex < build.steps.length; ++stepIndex) {
+                    var step = build.steps[stepIndex];
+                    if (step.name === "layout-test") {
+                        if (!("text" in step))
+                            continue;
+                        var strings = step.text;
+                        for (var stringIndex = 0; stringIndex < strings.length; ++stringIndex) {
+                            var match = /^(\d+) total leaks found!$/.exec(strings[stringIndex]);
+                            if (!match)
+                                continue;
+                            buildInfo.leakCount = parseInt(match[1], 10);
+                            break;
+                        }
+                    } else if (step.name === "MasterShellCommand") {
+                        if (!("urls" in step))
+                            return;
+                        if (!("view results" in step.urls))
+                            return;
+                        buildInfo.url = self._buildbotBaseURL + step.urls["view results"] + "/";
+                    }
+
+                    if (buildInfo.leakCount && buildInfo.url) {
+                        builds.push(buildInfo);
+                        break;
+                    }
+                }
+            });
+            // Sort descending by revision.
+            builds.sort(function(a, b) { return b.revision - a.revision; });
+            self._didLoadRecentBuildsCallback(builds);
+        });
+    },
+
+    _buildbotBaseURL: "http://build.webkit.org/",
+};
diff --git a/Tools/BuildSlaveSupport/build.webkit.org-config/public_html/LeaksViewer/Utilities.js b/Tools/BuildSlaveSupport/build.webkit.org-config/public_html/LeaksViewer/Utilities.js
new file mode 100644
index 0000000..c44848a
--- /dev/null
+++ b/Tools/BuildSlaveSupport/build.webkit.org-config/public_html/LeaksViewer/Utilities.js
@@ -0,0 +1,42 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+function getResource(url, callback) {
+    var xhr = new XMLHttpRequest();
+    xhr.onreadystatechange = function() {
+        // Allow a status of 0 for easier testing with local files.
+        if (this.readyState == 4 && (!this.status || this.status == 200))
+            callback(this);
+    };
+    xhr.open("GET", url);
+    xhr.send();
+}
+
+function range(n) {
+    var result = new Array(n);
+    for (var i = 0; i < n; ++i)
+        result[i] = i;
+    return result;
+}
diff --git a/Tools/BuildSlaveSupport/build.webkit.org-config/public_html/LeaksViewer/WebInspectorShims.js b/Tools/BuildSlaveSupport/build.webkit.org-config/public_html/LeaksViewer/WebInspectorShims.js
new file mode 100644
index 0000000..b948f12
--- /dev/null
+++ b/Tools/BuildSlaveSupport/build.webkit.org-config/public_html/LeaksViewer/WebInspectorShims.js
@@ -0,0 +1,67 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// This file contains definitions that are needed to satisfy the Web Inspector JavaScript files we
+// import.
+
+var WebInspector = {
+    UIString: function(string) {
+        return String.vsprintf(string, Array.prototype.slice.call(arguments, 1));
+    },
+};
+
+var Preferences = {
+    // Setting this to false causes the "Average" and "Calls" columns to be shown.
+    samplingCPUProfiler: false,
+};
+
+var ProfilerAgent = {
+    getProfile: function(typeId, uid, callback) {
+        this._callback = callback;
+    },
+
+    profileReady: function(head) {
+        this._callback({ head: head });
+    },
+};
+
+// This function makes any required changes to objects imported from the Web Inspector JavaScript
+// files.
+function monkeyPatchInspectorObjects() {
+    var originalGetter = WebInspector.ProfileDataGridNode.prototype.__lookupGetter__("data");
+    WebInspector.ProfileDataGridNode.prototype.__defineGetter__("data", function() {
+        var data = originalGetter.call(this);
+
+        // ProfileDataGridNode formats values as milliseconds, but we are instead measuring bytes.
+        if (!this.profileView.showSelfTimeAsPercent)
+            data.self = Number.bytesToString(this.selfTime);
+        if (!this.profileView.showTotalTimeAsPercent)
+            data.total = Number.bytesToString(this.totalTime);
+        if (!this.profileView.showAverageTimeAsPercent)
+            data.average = Number.bytesToString(this.averageTime);
+
+        return data;
+    });
+}
diff --git a/Tools/BuildSlaveSupport/build.webkit.org-config/public_html/LeaksViewer/index.html b/Tools/BuildSlaveSupport/build.webkit.org-config/public_html/LeaksViewer/index.html
new file mode 100644
index 0000000..3c185bc
--- /dev/null
+++ b/Tools/BuildSlaveSupport/build.webkit.org-config/public_html/LeaksViewer/index.html
@@ -0,0 +1,80 @@
+<!--
+Copyright (C) 2011 Apple Inc. All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions
+are met:
+1. Redistributions of source code must retain the above copyright
+   notice, this list of conditions and the following disclaimer.
+2. Redistributions in binary form must reproduce the above copyright
+   notice, this list of conditions and the following disclaimer in the
+   documentation and/or other materials provided with the distribution.
+
+THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+THE POSSIBILITY OF SUCH DAMAGE.
+-->
+
+<!DOCTYPE html>
+<html>
+<head>
+    <title>Leaks Viewer</title>
+    <link rel=stylesheet href="http://svn.webkit.org/repository/webkit/trunk/Source/WebCore/inspector/front-end/inspector.css?p=80565">
+    <link rel=stylesheet href=LeaksViewer.css>
+
+    <script src=WebInspectorShims.js></script>
+
+    <!-- The order here matches inspector.html. -->
+    <script src="http://svn.webkit.org/repository/webkit/!svn/bc/80565/trunk/Source/WebCore/inspector/front-end/utilities.js"></script>
+    <script src="http://svn.webkit.org/repository/webkit/!svn/bc/80565/trunk/Source/WebCore/inspector/front-end/treeoutline.js"></script>
+    <script src="http://svn.webkit.org/repository/webkit/!svn/bc/80565/trunk/Source/WebCore/inspector/front-end/Object.js"></script>
+    <script src="http://svn.webkit.org/repository/webkit/!svn/bc/80565/trunk/Source/WebCore/inspector/front-end/View.js"></script>
+    <script src="http://svn.webkit.org/repository/webkit/!svn/bc/80565/trunk/Source/WebCore/inspector/front-end/Panel.js"></script>
+    <script src="http://svn.webkit.org/repository/webkit/!svn/bc/80565/trunk/Source/WebCore/inspector/front-end/DataGrid.js"></script>
+    <script src="http://svn.webkit.org/repository/webkit/!svn/bc/80565/trunk/Source/WebCore/inspector/front-end/SidebarTreeElement.js"></script>
+    <script src="http://svn.webkit.org/repository/webkit/!svn/bc/80565/trunk/Source/WebCore/inspector/front-end/StatusBarButton.js"></script>
+    <script src="http://svn.webkit.org/repository/webkit/!svn/bc/80565/trunk/Source/WebCore/inspector/front-end/ProfilesPanel.js"></script>
+    <script src="http://svn.webkit.org/repository/webkit/!svn/bc/80565/trunk/Source/WebCore/inspector/front-end/ProfileDataGridTree.js"></script>
+    <script src="http://svn.webkit.org/repository/webkit/!svn/bc/80565/trunk/Source/WebCore/inspector/front-end/BottomUpProfileDataGridTree.js"></script>
+    <script src="http://svn.webkit.org/repository/webkit/!svn/bc/80565/trunk/Source/WebCore/inspector/front-end/TopDownProfileDataGridTree.js"></script>
+    <script src="http://svn.webkit.org/repository/webkit/!svn/bc/80565/trunk/Source/WebCore/inspector/front-end/ProfileView.js"></script>
+
+    <script>
+        // Now that all the Inspector files have loaded we can apply our monkey patches.
+        monkeyPatchInspectorObjects();
+    </script>
+
+    <script src=LeaksLoader.js></script>
+    <script src=LeaksParser.js></script>
+    <script src=LeaksViewer.js></script>
+    <script src=RecentBuildsLoader.js></script>
+    <script src=Utilities.js></script>
+</head>
+<body>
+    <div id=main-panels></div>
+    <div id=main-status-bar class=status-bar>
+        <div id=loading-indicator class=hidden>
+            <img id=spinner src=http://svn.webkit.org/repository/webkit/!svn/bc/80565/trunk/Source/WebCore/inspector/front-end/Images/spinner.gif>
+            <span id=loading-indicator-label>Loading&hellip;</span>
+        </div>
+    </div>
+    <div id=url-prompt-container class=hidden>
+        <div id=url-prompt>
+            <p>Enter the URL of a build results page or leaks file:</p>
+            <input id=url type=url><button onclick='LeaksViewer.urlPromptButtonClicked(event)'>Fetch leaks</button>
+            <p>Or choose a recent build:</p>
+            <div id=recent-builds-container>
+                <p id=recent-builds-loading-indicator>Loading builds&hellip;</p>
+            </div>
+        </div>
+    </div>
+</body>
+</html>
diff --git a/Tools/BuildSlaveSupport/build.webkit.org-config/templates/root.html b/Tools/BuildSlaveSupport/build.webkit.org-config/templates/root.html
index c6d2343..88f2e10 100755
--- a/Tools/BuildSlaveSupport/build.webkit.org-config/templates/root.html
+++ b/Tools/BuildSlaveSupport/build.webkit.org-config/templates/root.html
@@ -19,6 +19,7 @@
   <li><a href="http://webkit-commit-queue.appspot.com/">Commit Queue Status</a> information.</li>
   <li><a href="changes">ChangeSource</a> information.</li>
   <li><a href="results">Test Results</a></li>
+  <li><a href="LeaksViewer">Leaks Viewer</a></li>
 </ul>
 </body> </html>
 
diff --git a/Tools/BuildSlaveSupport/test-result-archive b/Tools/BuildSlaveSupport/test-result-archive
index a4d3ca3..b34e04a 100644
--- a/Tools/BuildSlaveSupport/test-result-archive
+++ b/Tools/BuildSlaveSupport/test-result-archive
@@ -90,7 +90,11 @@ def archiveTestResults(configuration, platform, layoutTestResultsDir):
         # deleting its contents, claiming "Directory not empty".
         # We can safely ignore this since it was the directory contents that
         # we are most interested in deleting.
-        if e.errno != 90:
+        # Python in Cygwin will also sometimes throw errno 2 if a process is
+        # holding a file open. There's no point in failing to create the
+        # archive just because some other process is behaving badly. See
+        # <http://webkit.org/b/55581>.
+        if e.errno != 90 and e.errno != 2:
             raise
 
 def zipFilesRecursively(archiveFile, files):
diff --git a/Tools/BuildSlaveSupport/win/kill-old-processes b/Tools/BuildSlaveSupport/win/kill-old-processes
index 885d6fa..f7f4423 100755
--- a/Tools/BuildSlaveSupport/win/kill-old-processes
+++ b/Tools/BuildSlaveSupport/win/kill-old-processes
@@ -30,7 +30,7 @@ def main():
                 "svn.exe", "httpd.exe", "cl.exe", "link.exe", "midl.exe", "devenv.exe", "perl.exe",

                 "imagediff.exe", "imagediff_debug.exe", "jsc.exe", "jsc_debug.exe", "WebKit2WebProcess.exe",

                 "WebKit2WebProcess_debug.exe", "WebKitTestRunner.exe", "WebKitTestRunner_debug.exe",

-                "wdiff.exe"]

+                "wdiff.exe", "LightTPD.exe"]

 

     for task in tasksToKill:

         os.system("taskkill /f /im " + task)

diff --git a/Tools/ChangeLog b/Tools/ChangeLog
index caccb04..479fd41 100644
--- a/Tools/ChangeLog
+++ b/Tools/ChangeLog
@@ -1,3 +1,2714 @@
+2011-03-30  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Update Windows production build logic for new production configurations
+        https://bugs.webkit.org/show_bug.cgi?id=57494
+
+        * DumpRenderTree/TestNetscapePlugIn/win/TestNetscapePluginProduction.vsprops:
+        * DumpRenderTree/win/DumpRenderTreeProduction.vsprops:
+        * DumpRenderTree/win/ImageDiffProduction.vsprops:
+        * FindSafari/FindSafariProduction.vsprops:
+        * FindSafari/FindSafariReleasePGO.vsprops:
+        * MiniBrowser/Configurations/MiniBrowserProduction.vsprops:
+        * WebKitAPITest/WebKitAPITestProduction.vsprops:
+        * WebKitLauncherWin/WebKitLauncherWinProduction.vsprops:
+        * WebKitTestRunner/win/InjectedBundleProduction.vsprops:
+        * WebKitTestRunner/win/WebKitTestRunnerProduction.vsprops:
+        * WinLauncher/WinLauncherProduction.vsprops:
+        * record-memory-win/record-memory-winProduction.vsprops:
+
+2011-03-30  Robert Hogan  <robert@webkit.org>
+
+        Reviewed by Antonio Gomes.
+
+        [Qt] Fix LoadHTMLStringItem::invoke() after r75966
+        Unskip http/tests/navigation/go-back-to-error-page.html
+
+        Also add the location of DumpRenderTreeSupportQt.h
+        to DRT's include paths.
+
+        https://bugs.webkit.org/show_bug.cgi?id=52614
+
+        * DumpRenderTree/qt/DumpRenderTree.pro:
+        * DumpRenderTree/qt/DumpRenderTreeQt.cpp:
+        * DumpRenderTree/qt/DumpRenderTreeQt.h:
+        * DumpRenderTree/qt/GCControllerQt.cpp:
+        * DumpRenderTree/qt/LayoutTestControllerQt.cpp:
+        (LayoutTestController::queueLoadHTMLString):
+        * DumpRenderTree/qt/LayoutTestControllerQt.h:
+        * DumpRenderTree/qt/PlainTextControllerQt.cpp:
+        * DumpRenderTree/qt/TextInputControllerQt.cpp:
+        * DumpRenderTree/qt/WorkQueueItemQt.cpp:
+        (LoadAlternateHTMLStringItem::invoke):
+        * DumpRenderTree/qt/WorkQueueItemQt.h:
+        (LoadAlternateHTMLStringItem::LoadAlternateHTMLStringItem):
+        * QtTestBrowser/QtTestBrowser.pro:
+        * QtTestBrowser/launcherwindow.h:
+
+2011-03-30  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Adam Roben.
+
+        SheriffBot rollouts take too long
+        https://bugs.webkit.org/show_bug.cgi?id=57498
+
+        We used to build before landing rollouts via the commit-queue to
+        prevent further breakage, but now that our individual commit-queue
+        machines are slower, building takes too long.  I can't remember the
+        last time a rollout broke compile.  It seems like just landing the
+        patch is the better trade-off.
+
+        * Scripts/webkitpy/tool/bot/commitqueuetask.py:
+        * Scripts/webkitpy/tool/commands/queues_unittest.py:
+
+2011-03-30  Adam Barth  <abarth@webkit.org>
+
+        Remove platform/chromium-mac-snowleopard
+        https://bugs.webkit.org/show_bug.cgi?id=57486
+
+        This directory no longer exists, so we can remove it from the fallback
+        chain.
+
+        * Scripts/webkitpy/layout_tests/port/chromium_mac.py:
+
+2011-03-30  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Rename Windows configuration Release_LTCG to Production for clarity
+        https://bugs.webkit.org/show_bug.cgi?id=57465
+
+        * DumpRenderTree/DumpRenderTree.sln:
+        * DumpRenderTree/TestNetscapePlugIn/win/TestNetscapePlugin.vcproj:
+        * DumpRenderTree/TestNetscapePlugIn/win/TestNetscapePluginProduction.vsprops: Copied from Tools/DumpRenderTree/TestNetscapePlugIn/win/TestNetscapePluginReleaseLTCG.vsprops.
+        * DumpRenderTree/TestNetscapePlugIn/win/TestNetscapePluginReleaseLTCG.vsprops: Removed.
+        * DumpRenderTree/win/DumpRenderTree.vcproj:
+        * DumpRenderTree/win/DumpRenderTreeProduction.vsprops: Copied from Tools/DumpRenderTree/win/DumpRenderTreeReleaseLTCG.vsprops.
+        * DumpRenderTree/win/DumpRenderTreeReleaseLTCG.vsprops: Removed.
+        * DumpRenderTree/win/ImageDiff.vcproj:
+        * DumpRenderTree/win/ImageDiffProduction.vsprops: Copied from Tools/DumpRenderTree/win/ImageDiffReleaseLTCG.vsprops.
+        * DumpRenderTree/win/ImageDiffReleaseLTCG.vsprops: Removed.
+        * FindSafari/FindSafari.vcproj:
+        * FindSafari/FindSafariProduction.vsprops: Copied from Tools/FindSafari/FindSafariReleaseLTCG.vsprops.
+        * FindSafari/FindSafariReleaseLTCG.vsprops: Removed.
+        * MiniBrowser/Configurations/MiniBrowserProduction.vsprops: Copied from Tools/MiniBrowser/Configurations/MiniBrowserReleaseLTCG.vsprops.
+        * MiniBrowser/Configurations/MiniBrowserReleaseLTCG.vsprops: Removed.
+        * MiniBrowser/MiniBrowser.vcproj:
+        * Scripts/webkitdirs.pm:
+        * TestWebKitAPI/win/TestWebKitAPI.sln:
+        * TestWebKitAPI/win/TestWebKitAPI.vcproj:
+        * TestWebKitAPI/win/TestWebKitAPIGenerated.vcproj:
+        * TestWebKitAPI/win/TestWebKitAPIInjectedBundle.vcproj:
+        * WebKitAPITest/WebKitAPITest.vcproj:
+        * WebKitAPITest/WebKitAPITestProduction.vsprops: Copied from Tools/WebKitAPITest/WebKitAPITestReleaseLTCG.vsprops.
+        * WebKitAPITest/WebKitAPITestReleaseLTCG.vsprops: Removed.
+        * WebKitLauncherWin/WebKitLauncherWin.vcproj:
+        * WebKitLauncherWin/WebKitLauncherWinProduction.vsprops: Copied from Tools/WebKitLauncherWin/WebKitLauncherWinReleaseLTCG.vsprops.
+        * WebKitLauncherWin/WebKitLauncherWinReleaseLTCG.vsprops: Removed.
+        * WebKitTestRunner/WebKitTestRunner.sln:
+        * WebKitTestRunner/win/InjectedBundle.vcproj:
+        * WebKitTestRunner/win/InjectedBundleGenerated.vcproj:
+        * WebKitTestRunner/win/InjectedBundleProduction.vsprops: Copied from Tools/WebKitTestRunner/win/InjectedBundleReleaseLTCG.vsprops.
+        * WebKitTestRunner/win/InjectedBundleReleaseLTCG.vsprops: Removed.
+        * WebKitTestRunner/win/WebKitTestRunner.vcproj:
+        * WebKitTestRunner/win/WebKitTestRunnerProduction.vsprops: Copied from Tools/WebKitTestRunner/win/WebKitTestRunnerReleaseLTCG.vsprops.
+        * WebKitTestRunner/win/WebKitTestRunnerReleaseLTCG.vsprops: Removed.
+        * WinLauncher/WinLauncher.vcproj:
+        * WinLauncher/WinLauncherProduction.vsprops: Copied from Tools/WinLauncher/WinLauncherReleaseLTCG.vsprops.
+        * WinLauncher/WinLauncherReleaseLTCG.vsprops: Removed.
+        * record-memory-win/record-memory-win.vcproj:
+        * record-memory-win/record-memory-winProduction.vsprops: Copied from Tools/record-memory-win/record-memory-winReleaseLTCG.vsprops.
+        * record-memory-win/record-memory-winReleaseLTCG.vsprops: Removed.
+
+2011-03-30  MORITA Hajime  <morrita@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        [Chromium] Expose the shadow DOM to DumpRenderTree JS tests.
+        https://bugs.webkit.org/show_bug.cgi?id=56573
+
+        Added LayoutTestController.shadowRoot() to Chromium DRT.
+
+        * DumpRenderTree/chromium/LayoutTestController.cpp:
+        (LayoutTestController::LayoutTestController):
+        (LayoutTestController::shadowRoot):
+        * DumpRenderTree/chromium/LayoutTestController.h:
+
+2011-03-30  Yuta Kitamura  <yutak@chromium.org>
+
+        Reviewed by Kent Tamura.
+
+        [Chromium] DumpRenderTree: Implement LayoutTestController::setPluginsEnabled
+        https://bugs.webkit.org/show_bug.cgi?id=57430
+
+        * DumpRenderTree/chromium/LayoutTestController.cpp:
+        (LayoutTestController::LayoutTestController):
+        (LayoutTestController::setPluginsEnabled):
+        * DumpRenderTree/chromium/LayoutTestController.h:
+
+2011-03-30  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Adam Barth.
+
+        make webkit-patch upload respect -d
+        https://bugs.webkit.org/show_bug.cgi?id=57425
+
+        * Scripts/webkitpy/common/checkout/scm.py:
+        * Scripts/webkitpy/tool/steps/commit.py:
+
+2011-03-30  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Adam Barth.
+
+        Make "webkit-patch --dry-run --verbose land" log the SVN command it's going to use
+        https://bugs.webkit.org/show_bug.cgi?id=57429
+
+        * Scripts/webkitpy/common/checkout/scm.py:
+
+2011-03-29  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r82383.
+        http://trac.webkit.org/changeset/82383
+        https://bugs.webkit.org/show_bug.cgi?id=57417
+
+        "nrwt isn't shutting down cleanly" (Requested by dpranke on
+        #webkit).
+
+        * Scripts/webkitpy/layout_tests/port/chromium_win.py:
+        * Scripts/webkitpy/layout_tests/port/chromium_win_unittest.py:
+        * Scripts/webkitpy/layout_tests/run_webkit_tests_unittest.py:
+
+2011-03-29  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Make validation message bubble testable
+        https://bugs.webkit.org/show_bug.cgi?id=57290
+
+        * DumpRenderTree/mac/DumpRenderTree.mm:
+        (createWebViewAndOffscreenWindow): Change a setting so that validation
+          bubbles isn't hidden automatically.
+
+2011-03-29  Dirk Pranke  <dpranke@chromium.org>
+
+        Reviewed by Ojan Vafai.
+
+        new-run-webkit-tests: use 'threads' on win instead of 'old-threads'
+
+        It's a bit unclear whether multiple threads or multiple
+        processes will be a better model on windows. This change will
+        test threads for now while we're still working out the bugs in
+        multiple-processes.
+
+        https://bugs.webkit.org/show_bug.cgi?id=57410
+
+        * Scripts/webkitpy/layout_tests/port/chromium_win.py:
+        * Scripts/webkitpy/layout_tests/port/chromium_win_unittest.py:
+        * Scripts/webkitpy/layout_tests/run_webkit_tests_unittest.py:
+
+2011-03-29  David Levin  <levin@chromium.org>
+
+        Reviewed by Shinichiro Hamaji.
+
+        check-webkit-style confused by two ChangeLog entries in a row from same user
+        https://bugs.webkit.org/show_bug.cgi?id=57250
+
+        * Scripts/webkitpy/style/checker.py: Add the line should be checked function to ChangeLogChecker.
+        * Scripts/webkitpy/style/checker_unittest.py: Fix test due to that new function.
+        * Scripts/webkitpy/style/checkers/changelog.py: Made this code aware of what lines were being checked.
+          It basically assumes only one ChangeLog entry is being processed because that is the standard case and
+          checking more than that would be very messey.
+        * Scripts/webkitpy/style/checkers/changelog_unittest.py: Add testing to catch the broken case.
+        * Scripts/webkitpy/style/error_handlers.py: Added should_line_be_checked.
+
+2011-03-29  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [Mac] Enable interactive-validation tests on Mac DRT
+        https://bugs.webkit.org/show_bug.cgi?id=57308
+
+        * DumpRenderTree/mac/DumpRenderTree.mm:
+        (createWebViewAndOffscreenWindow): Enable the form interactive validation feature.
+
+2011-03-29  Chang Shu  <cshu@webkit.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        WebKitTestRunner needs layoutTestController.setAllowUniversalAccessFromFileURLs
+        https://bugs.webkit.org/show_bug.cgi?id=42692
+
+        * WebKitTestRunner/InjectedBundle/InjectedBundle.cpp:
+        (WTR::InjectedBundle::beginTesting):
+        * WebKitTestRunner/InjectedBundle/LayoutTestController.cpp:
+        (WTR::LayoutTestController::setAllowUniversalAccessFromFileURLs):
+        * WebKitTestRunner/InjectedBundle/LayoutTestController.h:
+
+2011-03-24  Martin Robinson  <mrobinson@igalia.com>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] [DRT] GtkScrolledWindow adds three pixels of padding between the WebView and the scrollbar
+        https://bugs.webkit.org/show_bug.cgi?id=57067
+
+        Eliminate extra spacing between the DRT GtkScrolledWindow and the DRT WebView. This
+        will allow WebKit1GTK+ and WebKit2GTK+ to share test results. Followup commits will
+        update DRT and pixel results as hundreds of results will need to be updated.
+
+        * DumpRenderTree/gtk/DumpRenderTree.cpp:
+        (setDefaultsToConsistentStateValuesForTesting): Eliminate spacing on the GtkScrolledWindow
+        by overriding the theme RC/CSS files.
+
+2011-03-29  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Use per-configuration vsprops in tools projects to avoid WebKitVSPropsRedirectionDir removal by MSVC IDE
+        https://bugs.webkit.org/show_bug.cgi?id=57394
+
+        Visual Studio's IDE was removing instances of $(WebKitVSPropsRedirectionDir) from
+        InheritedPropertySheet rules in our vcproj files when the vcproj was edited from within
+        the IDE. To avoid this, add a separate vsprops file for each project configuration that
+        contains the required inherited property sheets.
+
+        * DumpRenderTree/TestNetscapePlugIn/win/TestNetscapePlugin.vcproj:
+        * DumpRenderTree/TestNetscapePlugIn/win/TestNetscapePluginDebug.vsprops: Added.
+        * DumpRenderTree/TestNetscapePlugIn/win/TestNetscapePluginDebugAll.vsprops: Added.
+        * DumpRenderTree/TestNetscapePlugIn/win/TestNetscapePluginDebugCairoCFLite.vsprops: Added.
+        * DumpRenderTree/TestNetscapePlugIn/win/TestNetscapePluginRelease.vsprops: Added.
+        * DumpRenderTree/TestNetscapePlugIn/win/TestNetscapePluginReleaseCairoCFLite.vsprops: Added.
+        * DumpRenderTree/TestNetscapePlugIn/win/TestNetscapePluginReleaseLTCG.vsprops: Added.
+        * DumpRenderTree/win/DumpRenderTree.vcproj:
+        * DumpRenderTree/win/DumpRenderTreeDebug.vsprops: Added.
+        * DumpRenderTree/win/DumpRenderTreeDebugAll.vsprops: Added.
+        * DumpRenderTree/win/DumpRenderTreeDebugCairoCFLite.vsprops: Added.
+        * DumpRenderTree/win/DumpRenderTreeRelease.vsprops: Added.
+        * DumpRenderTree/win/DumpRenderTreeReleaseCairoCFLite.vsprops: Added.
+        * DumpRenderTree/win/DumpRenderTreeReleaseLTCG.vsprops: Added.
+        * DumpRenderTree/win/ImageDiff.vcproj:
+        * DumpRenderTree/win/ImageDiffDebug.vsprops: Added.
+        * DumpRenderTree/win/ImageDiffDebugAll.vsprops: Added.
+        * DumpRenderTree/win/ImageDiffDebugCairoCFLite.vsprops: Added.
+        * DumpRenderTree/win/ImageDiffRelease.vsprops: Added.
+        * DumpRenderTree/win/ImageDiffReleaseCairoCFLite.vsprops: Added.
+        * DumpRenderTree/win/ImageDiffReleaseLTCG.vsprops: Added.
+        * FindSafari/FindSafari.vcproj:
+        * FindSafari/FindSafariDebug.vsprops: Added.
+        * FindSafari/FindSafariDebugAll.vsprops: Added.
+        * FindSafari/FindSafariDebugCairoCFLite.vsprops: Added.
+        * FindSafari/FindSafariRelease.vsprops: Added.
+        * FindSafari/FindSafariReleaseCairoCFLite.vsprops: Added.
+        * FindSafari/FindSafariReleaseLTCG.vsprops: Added.
+        * FindSafari/FindSafariReleasePGO.vsprops: Added.
+        * MiniBrowser/Configurations/MiniBrowserDebug.vsprops: Added.
+        * MiniBrowser/Configurations/MiniBrowserDebugAll.vsprops: Added.
+        * MiniBrowser/Configurations/MiniBrowserDebugCairoCFLite.vsprops: Added.
+        * MiniBrowser/Configurations/MiniBrowserRelease.vsprops: Added.
+        * MiniBrowser/Configurations/MiniBrowserReleaseCairoCFLite.vsprops: Added.
+        * MiniBrowser/Configurations/MiniBrowserReleaseLTCG.vsprops: Added.
+        * MiniBrowser/MiniBrowser.vcproj:
+        * WebKitAPITest/WebKitAPITest.vcproj:
+        * WebKitAPITest/WebKitAPITestDebug.vsprops: Added.
+        * WebKitAPITest/WebKitAPITestDebugAll.vsprops: Added.
+        * WebKitAPITest/WebKitAPITestDebugCairoCFLite.vsprops: Added.
+        * WebKitAPITest/WebKitAPITestRelease.vsprops: Added.
+        * WebKitAPITest/WebKitAPITestReleaseCairoCFLite.vsprops: Added.
+        * WebKitAPITest/WebKitAPITestReleaseLTCG.vsprops: Added.
+        * WebKitLauncherWin/WebKitLauncherWin.vcproj:
+        * WebKitLauncherWin/WebKitLauncherWinDebug.vsprops: Added.
+        * WebKitLauncherWin/WebKitLauncherWinDebugAll.vsprops: Added.
+        * WebKitLauncherWin/WebKitLauncherWinDebugCairoCFLite.vsprops: Added.
+        * WebKitLauncherWin/WebKitLauncherWinRelease.vsprops: Added.
+        * WebKitLauncherWin/WebKitLauncherWinReleaseCairoCFLite.vsprops: Added.
+        * WebKitLauncherWin/WebKitLauncherWinReleaseLTCG.vsprops: Added.
+        * WebKitTestRunner/win/InjectedBundle.vcproj:
+        * WebKitTestRunner/win/InjectedBundleDebug.vsprops: Added.
+        * WebKitTestRunner/win/InjectedBundleDebugAll.vsprops: Added.
+        * WebKitTestRunner/win/InjectedBundleDebugCairoCFLite.vsprops: Added.
+        * WebKitTestRunner/win/InjectedBundleRelease.vsprops: Added.
+        * WebKitTestRunner/win/InjectedBundleReleaseCairoCFLite.vsprops: Added.
+        * WebKitTestRunner/win/InjectedBundleReleaseLTCG.vsprops: Added.
+        * WebKitTestRunner/win/WebKitTestRunner.vcproj:
+        * WebKitTestRunner/win/WebKitTestRunnerDebug.vsprops: Added.
+        * WebKitTestRunner/win/WebKitTestRunnerDebugAll.vsprops: Added.
+        * WebKitTestRunner/win/WebKitTestRunnerDebugCairoCFLite.vsprops: Added.
+        * WebKitTestRunner/win/WebKitTestRunnerRelease.vsprops: Added.
+        * WebKitTestRunner/win/WebKitTestRunnerReleaseCairoCFLite.vsprops: Added.
+        * WebKitTestRunner/win/WebKitTestRunnerReleaseLTCG.vsprops: Added.
+        * WinLauncher/WinLauncher.vcproj:
+        * WinLauncher/WinLauncherDebug.vsprops: Added.
+        * WinLauncher/WinLauncherDebugAll.vsprops: Added.
+        * WinLauncher/WinLauncherDebugCairoCFLite.vsprops: Added.
+        * WinLauncher/WinLauncherRelease.vsprops: Added.
+        * WinLauncher/WinLauncherReleaseCairoCFLite.vsprops: Added.
+        * WinLauncher/WinLauncherReleaseLTCG.vsprops: Added.
+        * record-memory-win/record-memory-win.vcproj:
+        * record-memory-win/record-memory-winDebug.vsprops: Added.
+        * record-memory-win/record-memory-winDebugAll.vsprops: Added.
+        * record-memory-win/record-memory-winDebugCairoCFLite.vsprops: Added.
+        * record-memory-win/record-memory-winRelease.vsprops: Added.
+        * record-memory-win/record-memory-winReleaseCairoCFLite.vsprops: Added.
+        * record-memory-win/record-memory-winReleaseLTCG.vsprops: Added.
+
+2011-03-29  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        test_runner2.py can crash due to undefined variable
+        https://bugs.webkit.org/show_bug.cgi?id=57356
+
+        Replace reference to undefined variable with a variable that's actually
+        defined.  AFAICT, there's no way to test this code.
+
+        * Scripts/webkitpy/layout_tests/layout_package/test_runner2.py:
+
+2011-03-29  Tony Chang  <tony@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        cleanup rebaseline-chromium-webkit-tests
+        https://bugs.webkit.org/show_bug.cgi?id=57375
+
+        * Scripts/webkitpy/layout_tests/rebaseline_chromium_webkit_tests.py:
+            - Split _extract_and_add_new_baselines into 3 functions
+            - Reduce the amount of line wrapping (the file already has lines
+              over 80 col, so may as well try to make the file consistent)
+            - Remove unnecessary ()s
+
+2011-03-29  Brent Fulgham  <bfulgham@webkit.org>
+
+        Reviewed by Adam Roben.
+
+        Make WinCairo a core builder.
+        https://bugs.webkit.org/show_bug.cgi?id=57373
+
+        * Scripts/webkitpy/common/net/buildbot/buildbot.py: Add WinCairo.
+        * Scripts/webkitpy/common/net/buildbot/buildbot_unittest.py: Add WinCairo.
+
+2011-03-29  Timothy Hatcher  <timothy@apple.com>
+
+        Update update-webkit-localizable-strings to understand that WebKit and
+        WebKit2 strings go in WebCore.
+
+        Also make extract-localizable-strings optionally use an exclude file. No individual
+        warnings are produced about unlocalized strings when there is no exclude file. This
+        is needed for WebCore, since there are too many bare strings.
+
+        https://webkit.org/b/57354
+
+        Reviewed by Sam Weinig.
+
+        * Scripts/extract-localizable-strings: Support "-" to mean no exclude file.
+        * Scripts/update-webkit-localizable-strings: Update paths to scan WebCore and WebKit2.
+
+2011-03-29  Darin Adler  <darin@apple.com>
+
+        Reviewed by Adam Roben.
+
+        WebKit2 bundle page needs to offer generated file hooks
+        https://bugs.webkit.org/show_bug.cgi?id=57279
+
+        (Land missing part of the original patch after r82289.)
+
+        * WebKitTestRunner/InjectedBundle/InjectedBundlePage.cpp:
+        (WTR::InjectedBundlePage::InjectedBundlePage): Added new callbacks.
+
+2011-03-29  Tony Chang  <tony@chromium.org>
+
+        Reviewed by Ojan Vafai.
+
+        [chromium] NRWT should be able to read checksums from png comments
+        https://bugs.webkit.org/show_bug.cgi?id=57280
+
+        * Scripts/read-checksum-from-png: Added. Utility script to read the checksum
+            from a file.
+        * Scripts/webkitpy/common/system/filesystem.py: Add open_binary_file_for_reading
+        * Scripts/webkitpy/common/system/filesystem_mock.py:
+        * Scripts/webkitpy/layout_tests/port/base.py: When loading a checksum,
+            if the -checksum.txt file doesn't exist, try looking in the png.
+        * Scripts/webkitpy/layout_tests/port/mock_drt_unittest.py:
+        * Scripts/webkitpy/layout_tests/port/test.py:
+        * Scripts/webkitpy/layout_tests/read_checksum_from_png.py: Added. Scan the first
+            2k for a png comment with the checksum
+        * Scripts/webkitpy/layout_tests/read_checksum_from_png_unittest.py: Added.
+
+2011-03-29  Philippe Normand  <pnormand@igalia.com>
+
+        Rubber-stamped by Gustavo Noronha Silva.
+
+        [GTK] http/tests/uri/username-with-no-hostname.html fails
+        https://bugs.webkit.org/show_bug.cgi?id=57325
+
+        * DumpRenderTree/gtk/DumpRenderTree.cpp:
+        (willSendRequestCallback): URI host value check done case-insensitively.
+
+2011-03-29  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Martin Robinson.
+
+        [GTK] http/tests/uri/username-with-no-hostname.html fails
+        https://bugs.webkit.org/show_bug.cgi?id=57325
+
+        * DumpRenderTree/gtk/DumpRenderTree.cpp:
+        (willSendRequestCallback): Check URI before submitting the request
+        to WebCore.
+
+2011-03-29  Noel Gordon  <noel.gordon@gmail.com>
+
+        Reviewed by Ojan Vafai.
+
+        [chromium] DRT EventSender: remove identity from dragTargetDragEnter() calls
+        https://bugs.webkit.org/show_bug.cgi?id=57303
+
+        * DumpRenderTree/chromium/EventSender.cpp:
+        (EventSender::doDragDrop):
+        (EventSender::beginDragWithFiles):
+
+2011-03-29  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Andreas Kling.
+
+        [Qt] Add -print-loaded-urls option to Qt's MiniBrowser and to QtTestBrowser
+        https://bugs.webkit.org/show_bug.cgi?id=57314
+
+        Provide possibility to print loaded urls to the standard output.
+
+        * MiniBrowser/qt/BrowserWindow.cpp:
+        (BrowserWindow::BrowserWindow):
+        (BrowserWindow::printURL):
+        * MiniBrowser/qt/BrowserWindow.h:
+        * MiniBrowser/qt/MiniBrowserApplication.cpp:
+        (MiniBrowserApplication::handleUserOptions):
+        * MiniBrowser/qt/MiniBrowserApplication.h:
+        (WindowOptions::WindowOptions):
+        * QtTestBrowser/launcherwindow.cpp:
+        (LauncherWindow::initializeView):
+        (LauncherWindow::printURL):
+        (LauncherWindow::cloneWindow):
+        * QtTestBrowser/launcherwindow.h:
+        (WindowOptions::WindowOptions):
+        * QtTestBrowser/main.cpp:
+        (LauncherApplication::handleUserOptions):
+
+2011-03-29  Gabor Loki  <loki@webkit.org>
+
+        Rubber-stamped by Csaba Osztrogonác.
+
+        [Qt] Teach build-jsc how to build JavaScriptCore on Qt
+        https://bugs.webkit.org/show_bug.cgi?id=56918
+
+        * Scripts/build-jsc: Remove duplicated --qt options to avoid passing them to qmake.
+
+2011-03-28  Gabor Loki  <loki@webkit.org>
+
+        Reviewed by Csaba Osztrogonác.
+
+        [Qt] Teach build-jsc how to build JavaScriptCore on Qt
+        https://bugs.webkit.org/show_bug.cgi?id=56918
+
+        * Scripts/build-jsc:
+        * Scripts/webkitdirs.pm:
+
+2011-03-28  Andrew Foster  <andrewf@chromium.org>
+
+        Reviewed by Ojan Vafai.
+
+        webkit-patch should be more intelligent about whether a bug applies to a patch
+        Create a new function, parse_bug_id_from_changelog() which determines
+        that a bug is related to a patch by parsing the output generated from
+        prepare-ChangeLog, rather than arbitrarily matching a URL to a bug in
+        the description of a patch.
+        https://bugs.webkit.org/show_bug.cgi?id=56989
+
+        * Scripts/webkitpy/common/checkout/api.py:
+        * Scripts/webkitpy/common/checkout/changelog.py:
+        * Scripts/webkitpy/common/net/bugzilla/__init__.py:
+        * Scripts/webkitpy/common/net/bugzilla/bugzilla.py:
+        * Scripts/webkitpy/common/net/bugzilla/bugzilla_unittest.py:
+        * Scripts/webkitpy/style/checkers/changelog.py:
+        * Scripts/webkitpy/tool/commands/upload.py:
+
+2011-03-28  Maciej Stachowiak  <mjs@apple.com>
+
+        Revert accidentally commited change.
+
+        * DumpRenderTree/mac/ResourceLoadDelegate.mm:
+        (-[ResourceLoadDelegate webView:resource:willSendRequest:redirectResponse:fromDataSource:]):
+
+2011-03-28  Tony Chang  <tony@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        [chromium] have DRT write the png checksum into a png comment
+        https://bugs.webkit.org/show_bug.cgi?id=57255
+
+        * DumpRenderTree/chromium/TestShell.cpp:
+        (TestShell::dumpImage):
+
+2011-03-28  Adele Peterson  <adele@apple.com>
+
+        Removing Qt stub, since it doesn't use the same header as the others.
+
+        * DumpRenderTree/qt/LayoutTestControllerQt.cpp:
+
+2011-03-28  Adele Peterson  <adele@apple.com>
+
+        Added a few more stubs.
+
+        * DumpRenderTree/gtk/LayoutTestControllerGtk.cpp:
+        (LayoutTestController::hasGrammarMarker):
+        * DumpRenderTree/qt/LayoutTestControllerQt.cpp:
+        (LayoutTestController::hasGrammarMarker):
+        * DumpRenderTree/wx/LayoutTestControllerWx.cpp:
+        (LayoutTestController::hasGrammarMarker):
+
+2011-03-28  Adele Peterson  <adele@apple.com>
+
+        Build fix.
+
+        * DumpRenderTree/win/LayoutTestControllerWin.cpp:
+        (LayoutTestController::hasGrammarMarker):
+
+2011-03-28  Adele Peterson  <adele@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        Testing support for <rdar://problem/9112694> REGRESSION (r79411): "Check grammar with spelling" context menu doesn't check as you type
+        https://bugs.webkit.org/show_bug.cgi?id=57173
+
+        * DumpRenderTree/LayoutTestController.cpp:
+        (hasGrammarMarkerCallback): Added.
+        (LayoutTestController::staticFunctions): Added case for hasGrammarMarker.
+        * DumpRenderTree/LayoutTestController.h:
+        * DumpRenderTree/mac/DumpRenderTree.mm: (createWebViewAndOffscreenWindow): Call setGrammarCheckingEnabled.
+        * DumpRenderTree/mac/LayoutTestControllerMac.mm: (LayoutTestController::hasGrammarMarker): Added. Call new hasGrammarMarker method.
+
+2011-03-28  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Reviewed by Benjamin Poulain.
+
+        [Qt] QtWebKit will not compile with QT_ASCII_CAST_WARNINGS enabled
+        https://bugs.webkit.org/show_bug.cgi?id=57087
+
+        Trivial typo fix after r82082.
+
+        * WebKitTestRunner/InjectedBundle/qt/ActivateFontsQt.cpp:
+        (WTR::activateFonts):
+
+2011-03-28  Alexis Menard  <alexis.menard@openbossa.org>
+
+        Reviewed by Andreas Kling.
+
+        Add myself to the committers list.
+
+        * Scripts/webkitpy/common/config/committers.py:
+
+2011-03-28  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        WebKit2 unfortunately uses code from WebKit, so MiniBrowser needs
+        to link against WebKit.framework for now.
+
+        * MiniBrowser/MiniBrowser.xcodeproj/project.pbxproj:
+
+2011-03-28  Benjamin Poulain  <benjamin.poulain@nokia.com>
+
+        Reviewed by Andreas Kling.
+
+        [Qt] QtWebKit will not compile with QT_ASCII_CAST_WARNINGS enabled
+        https://bugs.webkit.org/show_bug.cgi?id=57087
+
+        Disable QT_ASCII_CAST_WARNINGS for applications.
+
+        * DumpRenderTree/qt/DumpRenderTree.pro:
+        * DumpRenderTree/qt/ImageDiff.pro:
+        * DumpRenderTree/qt/TestNetscapePlugin/TestNetscapePlugin.pro:
+        * MiniBrowser/qt/MiniBrowser.pro:
+        * QtTestBrowser/QtTestBrowser.pro:
+        * WebKitTestRunner/qt/WebKitTestRunner.pro:
+
+2011-03-28  Andreas Kling  <kling@webkit.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] QtTestBrowser doesn't reset its window title when opening about:blank
+        https://bugs.webkit.org/show_bug.cgi?id=57224
+
+        * QtTestBrowser/mainwindow.cpp:
+        (MainWindow::buildUI):
+        (MainWindow::onTitleChanged):
+        * QtTestBrowser/mainwindow.h:
+
+2011-03-27  Jer Noble  <jer.noble@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Full Screen: disable keyboard access by default
+        https://bugs.webkit.org/show_bug.cgi?id=56684
+
+        Accept the withKeyboard parameter to supportsFullScreenForElement.
+
+        * DumpRenderTree/mac/UIDelegate.mm:
+        (-[UIDelegate webView:supportsFullScreenForElement:withKeyboard:]):
+
+2011-03-27  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by David Levin.
+
+        check-webkit-style should check ChangeLog for a valid bug number
+        https://bugs.webkit.org/show_bug.cgi?id=57184
+
+        * Scripts/webkitpy/style/checker.py:
+        * Scripts/webkitpy/style/checker_unittest.py:
+        * Scripts/webkitpy/style/checkers/changelog.py: Added.
+        * Scripts/webkitpy/style/checkers/changelog_unittest.py: Added.
+
+2011-03-27  Benjamin Poulain  <benjamin.poulain@nokia.com>
+
+        Reviewed by Andreas Kling.
+
+        [Qt] QtWebKit will not compile with QT_ASCII_CAST_WARNINGS enabled
+        https://bugs.webkit.org/show_bug.cgi?id=57087
+
+        Use explicit conversion for string to avoid depending on the default codec
+        installed by the user code.
+
+        * WebKitTestRunner/InjectedBundle/qt/ActivateFontsQt.cpp:
+        (WTR::activateFonts):
+
+2011-03-26  Maciej Stachowiak  <mjs@apple.com>
+
+        Revert inadvertantly committed changes.
+
+        * Scripts/old-run-webkit-tests:
+        * Scripts/webkitpy/layout_tests/run_webkit_tests.py:
+
+2011-03-26  Andreas Kling  <kling@webkit.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Show page icons (favicons) in QtTestBrowser location bar.
+        https://bugs.webkit.org/show_bug.cgi?id=57162
+
+        * QtTestBrowser/QtTestBrowser.qrc:
+        * QtTestBrowser/favicon.png: Added.
+        * QtTestBrowser/locationedit.cpp:
+        (defaultPageIcon):
+        (LocationEdit::LocationEdit):
+        (LocationEdit::setPageIcon):
+        (LocationEdit::resizeEvent):
+        (LocationEdit::updateInternalGeometry):
+        * QtTestBrowser/locationedit.h:
+        * QtTestBrowser/mainwindow.cpp:
+        (MainWindow::buildUI):
+        (MainWindow::onIconChanged):
+        (MainWindow::onLoadStarted):
+        * QtTestBrowser/mainwindow.h:
+
+2011-03-23  Martin Robinson  <mrobinson@igalia.com>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] Force DumpRenderTree to use 96 DPI
+        https://bugs.webkit.org/show_bug.cgi?id=56866
+
+        Make sure that GTK+ is set to use 96 DPI when running tests. This ensures
+        broader compatibility with WebKit2 and makes setting font sizes more straightforward.
+
+        * DumpRenderTree/gtk/DumpRenderTree.cpp:
+        (initializeGtkFontSettings): Set the screen resolution and GTK+ xft property to 96 DPI.
+        (resetDefaultsToConsistentValues):Remove the call which repeatedly set the GDK screen resolution.
+        (setDefaultsToConsistentStateValuesForTesting): Update the font sizes to reflect the new DPI.
+
+2011-03-25  Andy Estes  <aestes@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        REGRESSION (r70748): latest nightly builds kills AC_QuickTime.js
+        https://bugs.webkit.org/show_bug.cgi?id=49016
+
+        TestNetscapePlugIn needs to register support for an image MIME type so
+        we can test that the embed tag prefers plug-ins to render image MIME
+        types.
+
+        * DumpRenderTree/TestNetscapePlugIn/mac/Info.plist: Register image/png.
+        * DumpRenderTree/TestNetscapePlugIn/main.cpp:
+        (NP_GetMIMEDescription): Ditto.
+        * DumpRenderTree/TestNetscapePlugIn/win/TestNetscapePlugin.rc: Ditto.
+
+2011-03-25  Jessie Berlin  <jberlin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        WebKit2: Need to be able to set and get the Cookie Storage Policy.
+        https://bugs.webkit.org/show_bug.cgi?id=50780
+
+        Add a test for getting and setting the HTTP Cookie Accept Policy in WebKit2.
+
+        The test is named "CookieManager" so that we can eventually exercise more of the
+        CookieManager functionality in the test.
+
+        * TestWebKitAPI/Tests/WebKit2/CookieManager.cpp: Added.
+        (TestWebKitAPI::didGetTestHTTPCookieAcceptPolicy):
+        Assert that the policy returned is equal to the policy set in
+        didGetUserHTTPCookieAcceptPolicy, and then restore the user's policy.
+        (TestWebKitAPI::didGetUserHTTPCookieAcceptPolicy):
+        Set the policy to something different than the user's policy and get the policy again.
+        (TestWebKitAPI::didFinishLoadForFrame):
+        Get the user's policy so that it can be restored at the end of the test.
+        (TestWebKitAPI::TEST):
+        Load about:blank so that the Web Process gets instatiated (needed to get the
+        CookieManager).
+
+        * TestWebKitAPI/win/TestWebKitAPI.vcproj:
+        Add CookieManager.cpp.
+
+2011-03-24  Kevin Ollivier  <kevino@theolliviers.com>
+
+        [wx] Fix the build so that gcc-4.1 and up can be used to build on SnowLeopard.
+
+        * wx/build/settings.py:
+
+2011-03-24  Ilya Sherman  <isherman@chromium.org>
+
+        Reviewed by Adam Roben.
+
+        Implement layoutTestController.setAutoFilled in DRT on Windows
+        https://bugs.webkit.org/show_bug.cgi?id=56828
+
+        * DumpRenderTree/win/LayoutTestControllerWin.cpp:
+        (LayoutTestController::setAutofilled): Implemented.
+
+2011-03-24  Brent Fulgham  <bfulgham@webkit.org>
+
+        Unreviewed build correction.
+
+        Correct vsprops file for Debug variant of the CFLite build.
+        Disable a CFNETWORK-specific test when building for CFLite.
+
+        * TestWebKitAPI/Configurations/TestWebKitAPIDebugCairoCFLite.vsprops:
+        * TestWebKitAPI/win/TestWebKitAPI.vcproj:
+
+2011-03-24  Dirk Pranke  <dpranke@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        fix regressions introduced in 81908 - there were a couple of
+        code paths that only fired under python 2.5 that I missed.
+
+        Also change a couple of 'python' references to sys.executable
+        in order to handle runing test-webkitpy with a binary other than
+        something called 'python'.
+
+        https://bugs.webkit.org/show_bug.cgi?id=57063
+
+        * Scripts/webkitpy/layout_tests/port/mac.py:
+        * Scripts/webkitpy/layout_tests/port/port_testcase.py:
+        * Scripts/webkitpy/test/cat.py:
+        * Scripts/webkitpy/test/echo.py:
+
+2011-03-24  Brent Fulgham  <bfulgham@webkit.org>
+
+        Unreviewed build correction.
+
+        Add a stub implementation of the TestInvocation dumping logic.
+        Update project files to reflect new file.
+
+        * WebKitTestRunner/cairo: Added.
+        * WebKitTestRunner/cairo/TestInvocationCairo.cpp: Added.
+        (WTR::TestInvocation::dumpPixelsAndCompareWithExpected):
+        * WebKitTestRunner/win/WebKitTestRunner.vcproj:
+
+2011-03-24  Dirk Pranke  <dpranke@chromium.org>
+
+        Reviewed by Tony Chang.
+
+        new-run-webkit-tests: clean up worker model defaults. This
+        changes the default behavior to 'threads' instead of
+        'old-threads', and clarifies that chromium-win-* and
+        chromium-mac-leopard are exceptions.
+
+        https://bugs.webkit.org/show_bug.cgi?id=56971
+
+        * Scripts/webkitpy/layout_tests/port/base.py:
+        * Scripts/webkitpy/layout_tests/port/chromium_linux.py:
+        * Scripts/webkitpy/layout_tests/port/chromium_mac.py:
+        * Scripts/webkitpy/layout_tests/port/chromium_win.py:
+        * Scripts/webkitpy/layout_tests/port/test.py:
+        * Scripts/webkitpy/layout_tests/run_webkit_tests_unittest.py:
+
+2011-03-23  Leandro Gracia Gil  <leandrogracia@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Media Stream API: fix the order of the options in build-webkit.
+        https://bugs.webkit.org/show_bug.cgi?id=56949
+
+        Fix the order of the options in build-webkit.
+
+        * Scripts/build-webkit:
+
+2011-03-23  Adam Klein  <adamk@chromium.org>
+
+        Reviewed by Mihai Parparita.
+
+        Add an option to new-run-webkit-httpd to allow overriding the location of LayoutTests directory
+        https://bugs.webkit.org/show_bug.cgi?id=56884
+
+        This option will be utilized by Chromium's ui_tests to allow
+        referencing js-test-resources from a layout test over HTTP.
+
+        * Scripts/new-run-webkit-httpd:
+        Added --layout_tests_dir option.
+        * Scripts/webkitpy/layout_tests/port/http_server.py:
+        Plumbed through as layout_tests_dir param.
+
+2011-03-23  Dirk Pranke  <dpranke@chromium.org>
+
+        Reviewed by Mihai Parparita.
+
+        new-run-webkit-tests: run tests in ascending alphabetical order per
+        dir. This is a second attempt at the fix; the first attempt, in 
+        r81597, broke the behavior on the old-inline and old-threads
+        worker models.
+
+        https://bugs.webkit.org/show_bug.cgi?id=56760
+
+        * Scripts/webkitpy/layout_tests/layout_package/dump_render_tree_thread.py:
+        * Scripts/webkitpy/layout_tests/layout_package/test_runner.py:
+        * Scripts/webkitpy/layout_tests/port/test.py:
+        * Scripts/webkitpy/layout_tests/run_webkit_tests_unittest.py:
+
+2011-03-23  Mario Sanchez Prada  <msanchez@igalia.com>
+
+        Reviewed by Martin Robinson.
+
+        [GTK] GTK's DRT to ouput detail's string for the 'property-change' signal
+        https://bugs.webkit.org/show_bug.cgi?id=56953
+
+        Print the string for the detail of 'property-change' signal.
+
+        * DumpRenderTree/gtk/AccessibilityCallbacks.cpp:
+        (axObjectEventListener): Print the detail string.
+
+2011-03-23  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        [V8] Web Inspector: compile DebuggerScript.js into DebuggerScriptSource.h
+        https://bugs.webkit.org/show_bug.cgi?id=56843
+
+        * DumpRenderTree/chromium/DRTDevToolsAgent.cpp:
+        * DumpRenderTree/chromium/DRTDevToolsAgent.h:
+
+2011-03-22  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Teach update-webkit about gyp
+        https://bugs.webkit.org/show_bug.cgi?id=56881
+
+        This makes it possible for someone who builds from Xcode
+        to just run update-webkit --gyp and have the project files
+        generated after update automatically.
+
+        I also added a stand-alone "generate-project-files" script
+        wrapping Source/gyp/configure.  This makes running gyp simpler
+        since most people will not have gyp or Source/gyp in their path.
+
+        * Scripts/build-webkit:
+        * Scripts/generate-project-files: Added.
+        * Scripts/update-webkit:
+
+2011-03-22  Anton D'Auria  <adauria@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Add +[WebApplicationCache getOriginsWithCache]
+        https://bugs.webkit.org/show_bug.cgi?id=56722
+
+        * DumpRenderTree/LayoutTestController.cpp:
+        (originsWithApplicationCacheCallback):
+        (LayoutTestController::staticFunctions):
+        * DumpRenderTree/LayoutTestController.h:
+        * DumpRenderTree/chromium/LayoutTestController.cpp: Added stub.
+        (LayoutTestController::originsWithApplicationCache):
+        * DumpRenderTree/chromium/LayoutTestController.h:
+        * DumpRenderTree/gtk/LayoutTestControllerGtk.cpp: Added stub.
+        (LayoutTestController::originsWithApplicationCache):
+        * DumpRenderTree/mac/LayoutTestControllerMac.mm: Pass array of origin's database identifiers.
+        (originsArrayToJS): Helper function for converting array of WebSecurityOrigins to a JS array of origin identifiers.
+        (LayoutTestController::originsWithApplicationCache):
+        (LayoutTestController::originsWithLocalStorage):
+        * DumpRenderTree/qt/LayoutTestControllerQt.cpp: Added stub.
+        (LayoutTestController::originsWithApplicationCache):
+        * DumpRenderTree/qt/LayoutTestControllerQt.h:
+        * DumpRenderTree/win/LayoutTestControllerWin.cpp: Added stub.
+        (LayoutTestController::originsWithApplicationCache):
+        * DumpRenderTree/wx/LayoutTestControllerWx.cpp: Added stub.
+        (LayoutTestController::originsWithApplicationCache):
+
+2011-03-22  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Add support to build-webkit for building with gyp-generated project files
+        https://bugs.webkit.org/show_bug.cgi?id=56877
+
+        build-webkit is a cesspool.  This change just hacks in --gyp support for Mac.
+        Eventually we'll want to support gyp-generated projects in a more general manner.
+
+        * Scripts/build-webkit:
+
+2011-03-22  David Kilzer  <ddkilzer@apple.com>
+
+        <http://webkit.org/b/56781> Add --dsym switch to enable dsym generation when building with Xcode
+
+        Reviewed by Joseph Pecoraro.
+
+        * Scripts/build-webkit: Updated usage statement to include
+        --dsym.
+        * Scripts/webkitdirs.pm: Added $generateDsym variable.
+        (generateDsym): Added. Call determineGenerateDsym() and
+        return $generateDsym.
+        (determineGenerateDsym): Added.  Parse @ARGV for --dsym and set
+        $generateDsym.
+        (argumentsForXcode): Added.  Returns additional arguments for
+        xcodebuild based on command-line switches.
+        (XcodeOptions): Updated to include argumentsForXcode() in the
+        array returned.
+
+2011-03-22  Adam Roben  <aroben@apple.com>
+
+        Make Leopard Debug bots and Windows XP Debug (Tests) core builders
+
+        These bots are consistently green again.
+
+        Fixes <http://webkit.org/b/56830> Leopard Debug bots and Windows XP Debug (Tests) should be
+        core builders
+
+        Rubber-stamped by Antti Koivisto.
+
+        * Scripts/webkitpy/common/net/buildbot/buildbot.py:
+        (BuildBot.__init__): Loosened the regexps for Leopard and Windows.
+
+        * Scripts/webkitpy/common/net/buildbot/buildbot_unittest.py:
+        (BuildBotTest.test_builder_name_regexps): Updated expectations.
+
+2011-03-21  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r81597.
+        http://trac.webkit.org/changeset/81597
+        https://bugs.webkit.org/show_bug.cgi?id=56801
+
+        Change results in lots of unexpected flaky on the dashboard.
+        (Requested by pfeldman on #webkit).
+
+        * Scripts/webkitpy/layout_tests/layout_package/test_runner.py:
+        * Scripts/webkitpy/layout_tests/port/test.py:
+        * Scripts/webkitpy/layout_tests/run_webkit_tests_unittest.py:
+
+2011-03-21  Sam Weinig  <sam@webkit.org>
+
+        Fix failing tests on the WebKit2 bots.
+
+        * WebKitTestRunner/TestController.cpp:
+        (WTR::TestController::resetStateToConsistentValues):
+
+2011-03-21  Daniel Sievers  <sievers@google.com>
+
+        Reviewed by Simon Fraser.
+
+        [Chromium] Make RenderAsTextBehavior and LayerTreeAsTextBehavior tweakable from the DumpRenderTree commandline
+        https://bugs.webkit.org/show_bug.cgi?id=56139
+
+        * DumpRenderTree/chromium/DumpRenderTree.cpp:
+        (main):
+        * DumpRenderTree/chromium/LayoutTestController.cpp:
+        (LayoutTestController::LayoutTestController):
+        (LayoutTestController::layerTreeAsText):
+        * DumpRenderTree/chromium/LayoutTestController.h:
+        (LayoutTestController::setShowDebugLayerTree):
+        * DumpRenderTree/chromium/TestShell.cpp:
+        (TestShell::runFileTest):
+        (TestShell::dump):
+        * DumpRenderTree/chromium/TestShell.h:
+        (TestParams::TestParams):
+
+2011-03-21  Adam Roben  <aroben@apple.com>
+
+        Try again to get buildbot to show run-javascriptcore-tests's actual.html as an HTML file
+
+        Fixes <http://webkit.org/b/56746> build.webkit.org shows run-javascriptcore-tests's HTML
+        output as plain text
+
+        Reviewed by David Kilzer.
+
+        * BuildSlaveSupport/build.webkit.org-config/master.cfg:
+        (RunJavaScriptCoreTests): List actual.html as one of our log files so it will get uploaded
+        to the master.
+        (RunJavaScriptCoreTests.commandComplete): Reading the actual.html file here won't work,
+        since we're running on the build master, not the slave. Instead, turn the raw source of
+        actual.html which the build slave uploaded into an HTML log.
+
+2011-03-21  Dirk Pranke  <dpranke@chromium.org>
+
+        Reviewed by Mihai Parparita.
+
+        new-run-webkit-tests: run tests in ascending alphabetical order per dir
+        https://bugs.webkit.org/show_bug.cgi?id=56760
+
+        * Scripts/webkitpy/layout_tests/layout_package/test_runner.py:
+        * Scripts/webkitpy/layout_tests/run_webkit_tests_unittest.py:
+        * Scripts/webkitpy/layout_tests/port/test.py:
+
+2011-03-21  Leandro Gracia Gil  <leandrogracia@chromium.org>
+
+        Reviewed by Steve Block.
+
+        Media Stream API patch 0: adding compilation guards.
+        https://bugs.webkit.org/show_bug.cgi?id=56458
+
+        Adding options to enable the media stream API feature in Chromium.
+
+        * Scripts/build-webkit:
+
+2011-03-21  Qi Zhang  <qi.2.zhang@nokia.com>
+
+        Reviewed by Laszlo Gombos.
+
+        [Qt] Add a command line option to capture stdout and stderr for DumpRenderTree
+        https://bugs.webkit.org/show_bug.cgi?id=56323
+
+        Using freopen to redirect STDOUT and STDERR when DumpRenderTree command line provide 
+        "--stdout" or "--stderr" option.
+
+        * DumpRenderTree/qt/DumpRenderTreeQt.cpp:
+        (WebCore::DumpRenderTree::~DumpRenderTree):
+        (WebCore::DumpRenderTree::processArgsLine):
+        (WebCore::DumpRenderTree::loadNextTestInStandAloneMode):
+        * DumpRenderTree/qt/DumpRenderTreeQt.h:
+        (WebCore::DumpRenderTree::setRedirectOutputFileName):
+        (WebCore::DumpRenderTree::setRedirectErrorFileName):
+        * DumpRenderTree/qt/main.cpp:
+        (isOption):
+        (takeOptionValue):
+        (printUsage):
+        (main):
+
+2011-03-21  Adam Roben  <aroben@apple.com>
+
+        Fix exceptions on the buildbot due to my last change
+
+        * BuildSlaveSupport/build.webkit.org-config/master.cfg:
+        (RunJavaScriptCoreTests.commandComplete): Catch exceptions due to actual.html not existing.
+
+2011-03-21  Adam Roben  <aroben@apple.com>
+
+        Teach buildbot to treat run-javascriptcore-tests's actual.html as an HTML file
+
+        Fixes <http://webkit.org/b/56746> build.webkit.org shows run-javascriptcore-tests's HTML
+        output as plain text
+
+        Reviewed by Darin Adler.
+
+        * BuildSlaveSupport/build.webkit.org-config/master.cfg:
+        (RunJavaScriptCoreTests): Removed the logfiles variable, which can only handle plaintext
+        logs.
+        (RunJavaScriptCoreTests.commandComplete): Use the addHTMLLog method to upload actual.html to
+        the build master. This will correctly treat it as HTML.
+
+2011-03-20  Bill Budge  <bbudge@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Rename ThreadSafeShared to ThreadSafeRefCounted
+        https://bugs.webkit.org/show_bug.cgi?id=56714
+
+        No new tests. Exposes no new functionality.
+
+        * DumpRenderTree/ForwardingHeaders/wtf/ThreadSafeRefCounted.h: Copied from DumpRenderTree/ForwardingHeaders/wtf/ThreadSafeShared.h.
+        * DumpRenderTree/ForwardingHeaders/wtf/ThreadSafeShared.h: Removed.
+        * Scripts/do-webcore-rename:
+
+2011-03-19  Anton D'Auria  <adauria@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Add stub to LayoutTestControllerGtk.cpp to fix GTK build
+        https://bugs.webkit.org/show_bug.cgi?id=56719
+
+        * DumpRenderTree/gtk/LayoutTestControllerGtk.cpp: Adding stub.
+        (LayoutTestController::clearApplicationCacheForOrigin):
+
+2011-03-19  Anton D'Auria  <adauria@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        ApplicationCacheGroup is not obsolete after being deleted via ApplicationCacheStorage::deleteEntriesForOrigin
+        https://bugs.webkit.org/show_bug.cgi?id=56415
+
+        * DumpRenderTree/LayoutTestController.cpp:
+        (clearApplicationCacheForOriginCallback):
+        (LayoutTestController::staticFunctions):
+        * DumpRenderTree/LayoutTestController.h:
+        * DumpRenderTree/chromium/LayoutTestController.cpp: Adding stubs.
+        (LayoutTestController::LayoutTestController):
+        (LayoutTestController::clearAllApplicationCaches):
+        (LayoutTestController::clearApplicationCacheForOrigin): 
+        * DumpRenderTree/chromium/LayoutTestController.h:
+        * DumpRenderTree/mac/LayoutTestControllerMac.mm: Adding stub.
+        (LayoutTestController::clearApplicationCacheForOrigin):
+        * DumpRenderTree/qt/LayoutTestControllerQt.cpp: Adding stub.
+        (LayoutTestController::clearApplicationCacheForOrigin):
+        * DumpRenderTree/qt/LayoutTestControllerQt.h:
+        * DumpRenderTree/win/LayoutTestControllerWin.cpp: Adding stub.
+        (LayoutTestController::clearApplicationCacheForOrigin):
+        * DumpRenderTree/wx/LayoutTestControllerWx.cpp: Adding stub.
+        (LayoutTestController::clearApplicationCacheForOrigin):
+
+2011-03-18  Dan Bernstein  <mitz@apple.com>
+
+        Revised build fix for r81135.
+
+        * WebKitTestRunner/Configurations/InjectedBundle.xcconfig:
+        * WebKitTestRunner/WebKitTestRunner.xcodeproj/project.pbxproj:
+
+2011-03-18  Adam Roben  <aroben@apple.com>
+
+        Windows build fix
+
+        * WebKitTestRunner/config.h: Add a missing #endif.
+
+2011-03-18  Andreas Kling  <kling@webkit.org>
+
+        Unbreak Qt build after r81494.
+
+        * WebKitTestRunner/qt/TestInvocationQt.cpp:
+        (WTR::TestInvocation::dumpPixelsAndCompareWithExpected):
+
+2011-03-18  Sam Weinig  <sam@webkit.org>
+
+        Fix windows build. This was really Adam Roben's fault. I swear!
+
+        * WebKitTestRunner/config.h:
+
+2011-03-18  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Adam Roben.
+
+        Pixel tests don't work in WebKitTestRunner on Windows
+        https://bugs.webkit.org/show_bug.cgi?id=56630
+
+        Cross-platformize (Mac and Windows CG) the pixel dumping code in WebKitTestRunner to use WebKit2
+        built-in snapshotting instead of using the window server on the Mac.
+
+        * WebKitTestRunner/InjectedBundle/InjectedBundle.cpp:
+        (WTR::InjectedBundle::InjectedBundle):
+        (WTR::InjectedBundle::didReceiveMessage):
+        (WTR::InjectedBundle::beginTesting):
+        (WTR::InjectedBundle::done):
+        * WebKitTestRunner/InjectedBundle/InjectedBundle.h:
+        (WTR::InjectedBundle::setPixelResult):
+        (WTR::InjectedBundle::shouldDumpPixels):
+        * WebKitTestRunner/InjectedBundle/InjectedBundlePage.cpp:
+        (WTR::InjectedBundlePage::dump):
+        Take the snapshot in the bundle and send it to the UIProcess for dumping.
+
+        * WebKitTestRunner/TestInvocation.cpp:
+        (WTR::TestInvocation::invoke):
+        (WTR::TestInvocation::dump):
+        (WTR::TestInvocation::didReceiveMessageFromInjectedBundle):
+        * WebKitTestRunner/TestInvocation.h:
+        * WebKitTestRunner/cg: Added.
+        * WebKitTestRunner/cg/TestInvocationCG.cpp: Copied from WebKitTestRunner/mac/TestInvocationMac.mm.
+        (WTR::createCGContextFromImage):
+        (WTR::computeMD5HashStringForContext):
+        (WTR::TestInvocation::dumpPixelsAndCompareWithExpected):
+        * WebKitTestRunner/mac/TestInvocationMac.mm: Removed.
+        Making pixel dumping code shared for CG ports. Also use the WTF/MD5 instead of platform specific code.
+
+        * WebKitTestRunner/win/TestInvocationWin.cpp:
+        (WTR::TestInvocation::dumpPixelsAndCompareWithExpected):
+        Keep stub for Cairo build.
+
+        * WebKitTestRunner/Configurations/WebKitTestRunnerCoreGraphics.vsprops: Added.
+        Add CG configuration.
+
+        * WebKitTestRunner/WebKitTestRunner.xcodeproj/project.pbxproj:
+        * WebKitTestRunner/win/WebKitTestRunner.vcproj:
+        Add new files.
+
+2011-03-18  Adam Roben  <aroben@apple.com>
+
+        Don't allow Leaks Viewer's vertical scrollbar to cover up long function names
+
+        Rubber-stamped by Simon Fraser.
+
+        * BuildSlaveSupport/build.webkit.org-config/public_html/LeaksViewer/LeaksViewer.css:
+        (.data-grid .data-container): Use overflow-y:auto instead of the Inspector's default
+        overflow-y:overlay so that the scrollbar doesn't overlay the content.
+
+2011-03-18  Adam Roben  <aroben@apple.com>
+
+        Don't ellipsize long or indented function names in Leaks Viewer
+
+        Fixes <http://webkit.org/b/56037> Leaks viewer needs horizontal
+        scrollbar
+
+        Reviewed by Simon Fraser.
+
+        * BuildSlaveSupport/build.webkit.org-config/public_html/LeaksViewer/LeaksViewer.css:
+        (.data-grid .data-container):
+        (.data-grid td > div, .data-grid th > div):
+        Allow the contents to extend to the right.
+
+2011-03-18  Adam Roben  <aroben@apple.com>
+
+        Fix some leaks in DRT seen on the leaks bot
+
+        Fixes <http://webkit.org/b/56638> addURLToRedirectCallback and
+        setWillSendRequestClearHeaderCallback in DRT are leaky
+
+        Reviewed by Alexey Proskuryakov.
+
+        * DumpRenderTree/ForwardingHeaders/wtf/OwnArrayPtr.h: Added.
+
+        * DumpRenderTree/LayoutTestController.cpp:
+        (addURLToRedirectCallback):
+        (setWillSendRequestClearHeaderCallback):
+        Use OwnArrayPtr to cause the strings to be deleted.
+
+2011-03-18  Adam Roben  <aroben@apple.com>
+
+        Fix a NSURLCredential leak seen on the leaks bot
+
+        Fixes <http://webkit.org/b/56637> -[SynchronousLoader
+        connection:didReceiveAuthenticationChallenge:] is leaky
+
+        Reviewed by John Sullivan.
+
+        * DumpRenderTree/mac/LayoutTestControllerMac.mm:
+        (-[SynchronousLoader connection:didReceiveAuthenticationChallenge:]): Use a RetainPtr to
+        cause the NSURLCredential to be released.
+
+2011-03-18  John Knottenbelt  <jknotten@chromium.org>
+
+        Unreviewed.
+
+        Remove unnecessary brackets around my email address.
+
+        * Scripts/webkitpy/common/config/committers.py:
+
+2011-03-18  Adam Roben  <aroben@apple.com>
+        
+        Remove some files I accidentally added in r81454
+
+        * WebKitTestRunner/Configurations/WebKitTestRunnerCoreGraphics.vsprops: Removed.
+        * WebKitTestRunner/cg/TestInvocationCG.cpp: Removed.
+
+2011-03-18  Adam Roben  <aroben@apple.com>
+
+        Ignore an NSNumberFormatter leak on SnowLeopard
+
+        * Scripts/old-run-webkit-tests:
+        (countAndPrintLeaks): Ignore leaks in -[NSNumberFormatter
+        getObjectValue:forString:errorDescription:].
+
+2011-03-18  Adam Roben  <aroben@apple.com>
+
+        Fix a leak beneath LayoutTestController::authenticateSession seen on the bots
+
+        Rubber-stamped by Mark Rowe.
+
+        * DumpRenderTree/mac/LayoutTestControllerMac.mm:
+        (LayoutTestController::authenticateSession): Use a RetainPtr to cause the NSURLRequest to be
+        released.
+
+2011-03-17  Adam Roben  <aroben@apple.com>
+
+        Address a review comment I missed in r81445
+
+        * BuildSlaveSupport/build.webkit.org-config/public_html/LeaksViewer/LeaksParserWorker.js:
+        (LeaksParserWorker.prototype._parseLeaks): Anchor the RegExp used to find the number of
+        leaked bytes to speed up searching on long lines.
+
+2011-03-17  Adam Roben  <aroben@apple.com>
+
+        Mark leaky builds orange, even if all regression tests passed
+
+        Fixes <http://webkit.org/b/56609> SnowLeopard Intel Leaks bot appears green on
+        build.webkit.org when all tests pass even though there are still leaks
+
+        Reviewed by Dan Bernstein.
+
+        * BuildSlaveSupport/build.webkit.org-config/master.cfg:
+        (RunWebKitLeakTests): Set the warnOnWarnings property to True so that the entire build will
+        be marked orange if this build step generates warnings.
+
+2011-03-17  Adam Roben  <aroben@apple.com>
+
+        Allow values in Leaks Viewer to be shown as percentages
+
+        Double-clicking on a column will toggle between showing percentages and showing real values.
+
+        Fixes <http://webkit.org/b/56628> Would like to view values as percentages of the total
+        number of leaked bytes in Leaks Viewer
+
+        Reviewed by Joe Pecoraro.
+
+        * BuildSlaveSupport/build.webkit.org-config/public_html/LeaksViewer/LeaksParserWorker.js:
+        (LeaksParserWorker.prototype._incorporateLeaks): Calculate the (never-shown) top-level
+        node's totalTime, which is used in calculating percentages.
+
+        * BuildSlaveSupport/build.webkit.org-config/public_html/LeaksViewer/WebInspectorShims.js:
+        (monkeyPatchInspectorObjects): Only format values as bytes if we aren't supposed to be
+        showing them as percentages.
+
+2011-03-17  Adam Roben  <aroben@apple.com>
+
+        Show the number of leaked bytes, not just leaked allocations, in Leaks Viewer
+
+        The Self and Total columns now report the number of leaked bytes. The new Calls column shows
+        the number of leaked allocations. And the new Average column shows the average number of
+        leaked bytes per call.
+
+        Fixes <http://webkit.org/b/56344> Leaks Viewer should show how many bytes were leaked, not
+        just how many allocations
+
+        Reviewed by Joe Pecoraro.
+
+        * BuildSlaveSupport/build.webkit.org-config/public_html/LeaksViewer/LeaksParserWorker.js:
+        (LeaksParserWorker.prototype._parseLeaks): Parse the number of leaked bytes from the "Leak:"
+        line and store it with the leak stack.
+        (LeaksParserWorker.prototype._createNode): Initialize the averageTime and numberOfCalls
+        properties.
+        (LeaksParserWorker.prototype._incorporateLeaks): Updated to get the stack from the .stack
+        property, and changed to store the number of leaked bytes in .selfTime/.totalTime.
+        .numberOfCalls now holds the number of leaked allocations.
+
+        * BuildSlaveSupport/build.webkit.org-config/public_html/LeaksViewer/WebInspectorShims.js:
+        (Preferences): Set samplingCPUProfiler to false so that the Average and Calls columns will
+        appear.
+        (monkeyPatchInspectorObjects): Format the values as bytes.
+
+2011-03-17  Adam Roben  <aroben@apple.com>
+
+        Make Leaks Viewer able to count leaks in builds that didn't fail any regression tests
+
+        Fixes <http://webkit.org/b/56626> Leaks Viewer omits recent builds which didn't fail any
+        regression tests
+
+        Reviewed by James Robinson.
+
+        * BuildSlaveSupport/build.webkit.org-config/public_html/LeaksViewer/RecentBuildsLoader.js:
+        (RecentBuildsLoader.prototype.start): Get the number of leaks out of the "text" array, which
+        is always populated, even when all regression tests pass.
+
+2011-03-10  Hayato Ito  <hayato@chromium.org>
+
+        Reviewed by Tony Chang.
+
+        Add a check logic for reftests in case that a reftest is marked AS REBASELINE.
+
+        https://bugs.webkit.org/show_bug.cgi?id=56076
+
+        * Scripts/webkitpy/layout_tests/rebaseline_chromium_webkit_tests.py:
+
+2011-03-17  Adam Roben  <aroben@apple.com>
+
+        Skip a compositing-sensitive test when accelerated compositing is disabled
+
+        Reviewed by Sam Weinig.
+
+        * Scripts/old-run-webkit-tests: Skip media/media-document-audio-repaint.html when
+        accelerated compositing is disabled.
+
+2011-03-17  Adam Roben  <aroben@apple.com>
+
+        Start using PlatformSpecificScheduler for the Mac builders
+
+        The current set of file/directory patterns should work for Mac builders. We may discover
+        that there are more files and directories we can exclude from the Mac builds, but they can
+        be added later.
+
+        Fixes <http://webkit.org/b/56593> Mac builders do lots of unnecessary builds
+
+        Reviewed by Mark Rowe.
+
+        * BuildSlaveSupport/build.webkit.org-config/config.json: Moved the Mac builders into two
+        PlatformSpecificSchedulers: one for Leopard, and one for SnowLeopard.
+
+        * Scripts/webkitpy/common/config/build.py:
+        (_should_file_trigger_build): Allow "mac-leopard" and "mac-snowleopard" platforms, and
+        cleaned up patterns a little bit.
+
+        * Scripts/webkitpy/common/config/build_unittest.py:
+        (ShouldBuildTest): Fixed some expected results.
+        (ShouldBuildTest.test_should_build): Start testing "mac-leopard" and "mac-snowleopard"
+        platforms.
+
+2011-03-17  Jeff Miller  <jeffm@apple.com>
+
+        Use a consistent set of file patterns in the svn:ignore property for all .xcodeproj directories, specifically:
+        
+        *.mode*
+        *.pbxuser
+        *.perspective*
+        project.xcworkspace
+        xcuserdata
+
+        * DumpRenderTree/DumpRenderTree.xcodeproj: Modified property svn:ignore.
+        * MiniBrowser/MiniBrowser.xcodeproj: Modified property svn:ignore.
+        * TestWebKitAPI/TestWebKitAPI.xcodeproj: Modified property svn:ignore.
+        * WebKitLauncher/WebKitLauncher.xcodeproj: Modified property svn:ignore.
+        * WebKitTestRunner/WebKitTestRunner.xcodeproj: Modified property svn:ignore.
+
+2011-03-17  Adam Roben  <aroben@apple.com>
+
+        Make old-run-webkit-tests pick up mac-wk2 results when running in WebKit2 mode on Windows
+
+        Fixes <http://webkit.org/b/56563> Running WebKit2 tests on Windows should use results from
+        mac-wk2
+
+        Reviewed by Anders Carlsson.
+
+        * Scripts/old-run-webkit-tests:
+        (expectedDirectoryForTest): Clean up the code to search in extra Mac platform result
+        directories on Windows. Add mac-wk2 to the set of extra platforms we look in on Windows when
+        we're running in WebKit2 mode.
+
+2011-03-17  Mikhail Naganov  <mnaganov@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: Clean up Inspector strings.
+        https://bugs.webkit.org/show_bug.cgi?id=56557
+
+        Modify the script to deal correctly with "\xNN" escapes, and to
+        check strings in Chromium's DevTools.js.
+
+        * Scripts/check-inspector-strings:
+
+2011-03-17  Keith Kyzivat  <keith.kyzivat@nokia.com>
+
+        Reviewed by Benjamin Poulain.
+
+        Update autoinstall to install mechanize 0.2.4
+        https://bugs.webkit.org/show_bug.cgi?id=56499
+
+        Newer versions of mechanize support HTTPS proxies, which is necessary
+        for people using webkit-patch behind firewalls.
+
+        * Scripts/webkitpy/common/system/autoinstall.py:
+        * Scripts/webkitpy/thirdparty/__init__.py:
+
+2011-03-16  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Adam Roben.
+
+        REGRESSION (r81084): media/invalid-media-url-crash.html and editing/execCommand/indent-paragraphs.html failing on WebKit2
+        https://bugs.webkit.org/show_bug.cgi?id=56541
+
+        * WebKitTestRunner/InjectedBundle/InjectedBundlePage.cpp:
+        (WTR::InjectedBundlePage::willSendRequestForFrame):
+        Check for an empty host in addition to a null host.  This bug was introduced
+        when porting off of the KURL code and onto the WKURLRef version.
+
+2011-03-16  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Adam Roben.
+
+        Add Lucas Forschler to the list of WebKit committers.
+
+        * Scripts/webkitpy/common/config/committers.py:
+
+2011-03-16  Sam Weinig  <sam@webkit.org>
+
+        Reviewed upon and dictated through Adam Roben.
+
+        Escape crashing function names in results.html. This fixes an issue
+        when a crash involves a type with templates.
+
+        * Scripts/old-run-webkit-tests:
+
+2011-03-16  Daniel Sievers  <sievers@google.com>
+
+        Reviewed by James Robinson.
+
+        Add setting to always force compositing mode
+        https://bugs.webkit.org/show_bug.cgi?id=56156
+
+        * DumpRenderTree/chromium/DumpRenderTree.cpp:
+        (main):
+        * DumpRenderTree/chromium/TestShell.cpp:
+        (TestShell::TestShell):
+        (TestShell::resetWebSettings):
+        * DumpRenderTree/chromium/TestShell.h:
+        (TestShell::setForceCompositingMode):
+        * DumpRenderTree/chromium/WebPreferences.cpp:
+        (WebPreferences::reset):
+        (WebPreferences::applyTo):
+        * DumpRenderTree/chromium/WebPreferences.h:
+
+2011-03-15  Hayato Ito  <hayato@chromium.org>
+
+        Reviewed by Ojan Vafai.
+
+        Ignore files that will be used by reftests in old-run-webkit-tests.
+
+        https://bugs.webkit.org/show_bug.cgi?id=55936
+
+        * Scripts/old-run-webkit-tests:
+
+2011-03-15  Felipe Oliveira da Silva Netto  <f.dachshund@gmail.com>
+
+        Reviewed by Adam Roben.
+
+        Function relativeScriptsDir doesn't return the correct relative
+        Scripts directory.
+
+        * Scripts/webkitdirs.pm:
+        (relativeScriptsDir): Ensure we use the directory that contains
+        webkitdirs.pm, not the one that contains the original script that
+        was invoked.
+
+2011-03-15  Kevin Ollivier  <kevino@theolliviers.com>
+
+        [wx] Build fixes for long linker commands on Win and method return error, plus a Mac
+        fix to link against the Security framework after recent WebKitSystemInterface changes.
+
+        * DumpRenderTree/wx/LayoutTestControllerWx.cpp:
+        (LayoutTestController::originsWithLocalStorage):
+        * wx/build/settings.py:
+        * wx/build/waf_extensions.py:
+
+2011-03-15  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Add script to convert a patch to a prettypatch and show in the default browser
+        https://bugs.webkit.org/show_bug.cgi?id=56416
+
+        This can be used either like
+            $ svn-create-patch | show-pretty-diff
+        or
+            $ show-pretty-diff patch.diff
+
+        * Scripts/show-pretty-diff: Added.
+
+2011-03-15  Brian Weinstein  <bweinstein@apple.com>
+
+        Rubber-stamped by Adam Roben.
+
+        Adding myself as a reviewer.
+
+        * Scripts/webkitpy/common/config/committers.py:
+
+2011-03-15  Anders Carlsson  <andersca@apple.com>
+
+        Try to fix the Windows build.
+
+        * DumpRenderTree/TestNetscapePlugIn/Tests/NPDeallocateCalledBeforeNPShutdown.cpp:
+        (NPDeallocateCalledBeforeNPShutdown::TestObject::~TestObject):
+
+2011-03-15  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Make sure that NP_Shutdown is always the last NPP function called
+        https://bugs.webkit.org/show_bug.cgi?id=56391
+
+        Add a test that times out if an NP_Deallocate object is called after NP_Shutdown.
+
+        * DumpRenderTree/DumpRenderTree.xcodeproj/project.pbxproj:
+        * DumpRenderTree/TestNetscapePlugIn/PluginTest.cpp:
+        (PluginTest::PluginTest):
+        (PluginTest::NP_Shutdown):
+        (PluginTest::registerNPShutdownFunction):
+        * DumpRenderTree/TestNetscapePlugIn/PluginTest.h:
+        * DumpRenderTree/TestNetscapePlugIn/Tests/NPDeallocateCalledBeforeNPShutdown.cpp: Added.
+        (NPDeallocateCalledBeforeNPShutdown::NPDeallocateCalledBeforeNPShutdown):
+        (NPDeallocateCalledBeforeNPShutdown::TestObject::~TestObject):
+        (NPDeallocateCalledBeforeNPShutdown::ScriptableObject::hasProperty):
+        (NPDeallocateCalledBeforeNPShutdown::ScriptableObject::getProperty):
+        (NPDeallocateCalledBeforeNPShutdown::NPP_New):
+        (NPDeallocateCalledBeforeNPShutdown::NPP_GetValue):
+        (NPDeallocateCalledBeforeNPShutdown::shutdown):
+        * DumpRenderTree/TestNetscapePlugIn/main.cpp:
+        (NP_Shutdown):
+        * DumpRenderTree/TestNetscapePlugIn/win/TestNetscapePlugin.vcproj:
+        * DumpRenderTree/qt/TestNetscapePlugin/TestNetscapePlugin.pro:
+        * GNUmakefile.am:
+
+2011-03-15  Ilya Sherman  <isherman@chromium.org>
+
+        Reviewed by Tony Chang.
+
+        Autofilled form elements are assigned fixed background color but not text color
+        https://bugs.webkit.org/show_bug.cgi?id=48382
+
+        * DumpRenderTree/LayoutTestController.cpp:
+        (setAutofilledCallback): Added.
+        (LayoutTestController::staticFunctions):
+        * DumpRenderTree/LayoutTestController.h:
+        * DumpRenderTree/chromium/LayoutTestController.cpp:
+        (LayoutTestController::LayoutTestController):
+        (LayoutTestController::setAutofilled): Added.
+        * DumpRenderTree/chromium/LayoutTestController.h:
+        * DumpRenderTree/gtk/LayoutTestControllerGtk.cpp:
+        (LayoutTestController::setAutofilled): Added.
+        * DumpRenderTree/mac/LayoutTestControllerMac.mm:
+        (LayoutTestController::setAutofilled): Added.
+        (LayoutTestController::setValueForUser): Style tweak.
+        * DumpRenderTree/win/LayoutTestControllerWin.cpp:
+        (LayoutTestController::setAutofilled): Added (stub).
+        * DumpRenderTree/wx/LayoutTestControllerWx.cpp:
+        (LayoutTestController::setAutofilled): Added (stub).
+
+2011-03-15  Dan Bernstein  <mitz@apple.com>
+
+        Build fix after r81135.
+
+        * TestWebKitAPI/Configurations/InjectedBundle.xcconfig:
+
+2011-03-15  Dan Bernstein  <mitz@apple.com>
+
+        Build fix after r81135.
+
+        * WebKitTestRunner/Configurations/InjectedBundle.xcconfig:
+        * WebKitTestRunner/mac/TestControllerMac.mm:
+        * WebKitTestRunner/mac/TestInvocationMac.mm:
+        * WebKitTestRunner/mac/main.mm:
+
+2011-03-15  Balazs Kelemen  <kbalazs@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        REGRESSION(80977): breaks Qt ARMv7 Linux Release bot
+        https://bugs.webkit.org/show_bug.cgi?id=56349
+
+        * QtTestBrowser/QtTestBrowser.pro: Link against fontconfig
+        on platforms where we use it. Copied from DumpRenderTree.pro.
+
+2011-03-15  Dan Bernstein  <mitz@apple.com>
+
+        Build fix after r81135.
+
+        * DumpRenderTree/cf/WebArchiveDumpSupport.cpp:
+        * DumpRenderTree/mac/WebArchiveDumpSupportMac.mm:
+
+2011-03-15  Kevin Ollivier  <kevino@theolliviers.com>
+
+        Reviewed by Darin Adler.
+
+        Introduce WTF_USE_EXPORT_MACROS, which will allow us to put shared library import/export
+        info into the headers rather than in export symbol definition files, but disable it on 
+        all platforms initially so we can deal with port build issues one port at a time.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=27551
+
+        * DumpRenderTree/cg/ImageDiffCG.cpp:
+        * DumpRenderTree/chromium/config.h:
+        * DumpRenderTree/config.h:
+        * DumpRenderTree/wx/LayoutTestControllerWx.cpp:
+        * TestWebKitAPI/TestWebKitAPIPrefix.h:
+        * WebKitAPITest/HostWindow.cpp:
+        * WebKitAPITest/TestsController.cpp:
+        * WebKitAPITest/config.h: Added.
+        * WebKitAPITest/main.cpp:
+        * WebKitAPITest/tests/WebViewDestruction.cpp:
+        * WebKitTestRunner/InjectedBundle/Bindings/JSWrapper.cpp:
+        * WebKitTestRunner/InjectedBundle/EventSendingController.cpp:
+        * WebKitTestRunner/InjectedBundle/GCController.cpp:
+        * WebKitTestRunner/InjectedBundle/InjectedBundle.cpp:
+        * WebKitTestRunner/InjectedBundle/InjectedBundleMain.cpp:
+        * WebKitTestRunner/InjectedBundle/InjectedBundlePage.cpp:
+        * WebKitTestRunner/InjectedBundle/LayoutTestController.cpp:
+        * WebKitTestRunner/InjectedBundle/qt/ActivateFontsQt.cpp:
+        * WebKitTestRunner/InjectedBundle/qt/InjectedBundleQt.cpp:
+        * WebKitTestRunner/InjectedBundle/qt/LayoutTestControllerQt.cpp:
+        * WebKitTestRunner/InjectedBundle/win/ActivateFonts.cpp:
+        * WebKitTestRunner/InjectedBundle/win/InjectedBundleWin.cpp:
+        * WebKitTestRunner/InjectedBundle/win/LayoutTestControllerWin.cpp:
+        * WebKitTestRunner/TestController.cpp:
+        * WebKitTestRunner/TestInvocation.cpp:
+        * WebKitTestRunner/config.h: Added.
+        * WebKitTestRunner/qt/PlatformWebViewQt.cpp:
+        * WebKitTestRunner/qt/TestControllerQt.cpp:
+        * WebKitTestRunner/qt/TestInvocationQt.cpp:
+        * WebKitTestRunner/qt/main.cpp:
+        * WebKitTestRunner/win/PlatformWebViewWin.cpp:
+        * WebKitTestRunner/win/TestControllerWin.cpp:
+        * WebKitTestRunner/win/TestInvocationWin.cpp:
+        * WebKitTestRunner/win/main.cpp:
+        * wx/build/settings.py:
+
+2011-03-15  Hayato Ito  <hayato@chromium.org>
+
+        Reviewed by Shinichiro Hamaji.
+
+        [NRWT] Add support for reftests to new-run-webkit-tests.
+
+        https://bugs.webkit.org/show_bug.cgi?id=55457
+
+        * Scripts/webkitpy/layout_tests/layout_package/single_test_runner.py:
+        * Scripts/webkitpy/layout_tests/layout_package/test_failures.py:
+        * Scripts/webkitpy/layout_tests/layout_package/test_result_writer.py:
+        * Scripts/webkitpy/layout_tests/port/base.py:
+        * Scripts/webkitpy/layout_tests/port/dryrun.py:
+        * Scripts/webkitpy/layout_tests/port/test.py:
+        * Scripts/webkitpy/layout_tests/port/test_files.py:
+        * Scripts/webkitpy/layout_tests/run_webkit_tests_unittest.py:
+
+2011-03-15  Alejandro G. Castro  <alex@igalia.com>
+
+        Reviewed by Martin Robinson.
+
+        [GTK] Fix compilation warning after r80892
+        https://bugs.webkit.org/show_bug.cgi?id=56302
+
+        * DumpRenderTree/gtk/LayoutTestControllerGtk.cpp:
+        (LayoutTestController::originsWithLocalStorage):
+
+2011-03-15  Robert Hogan  <robert@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Document the qmakearg argument, and hint how to build webkit2 on Qt
+        https://bugs.webkit.org/show_bug.cgi?id=56326
+
+        * Scripts/build-webkit: add --qmakearg to build-webkit --help
+
+2011-03-15  Adam Roben  <aroben@apple.com>
+
+        Make Windows 7 Release (Tests) a core builder
+
+        We can probably make Windows XP Debug (Tests) a core builder, too, but we should probably
+        give it a few more days of greenness first.
+
+        Fixes <http://webkit.org/b/55665> Windows 7 Release (Tests) should be a core builder
+
+        Reviewed by Sam Weinig.
+
+        * Scripts/webkitpy/common/net/buildbot/buildbot.py:
+        (BuildBot): Added a regexp to match Windows 7 Release (Tests).
+
+        * Scripts/webkitpy/common/net/buildbot/buildbot_unittest.py:
+        (BuildBotTest): Updated the list of builders to match the current list on build.webkit.org.
+        Updated the core regexps to match the buildbot module. Updated the expected results to match
+        the current set of core builders.
+
+2011-03-14  Adam Roben  <aroben@apple.com>
+
+        Add forgotten file from r81116
+
+        * TestWebKitAPI/Configurations/TestWebKitAPICFNetwork.vsprops: Added.
+
+2011-03-14  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Adam Roben.
+
+        about:blank fake responses don't get serialized when sent the UIProcess
+        <rdar://problem/9108119>
+        https://bugs.webkit.org/show_bug.cgi?id=56357
+
+        * TestWebKitAPI/Tests/WebKit2/AboutBlankLoad.cpp: Added.
+        (TestWebKitAPI::decidePolicyForResponse):
+        (TestWebKitAPI::TEST):
+        Add test that loads of about:blank have a response with a MIMEType of text/html.
+
+        * TestWebKitAPI/PlatformUtilities.h:
+        * TestWebKitAPI/mac/PlatformUtilitiesMac.mm:
+        (TestWebKitAPI::Util::MIMETypeForWKURLResponse):
+        * TestWebKitAPI/win/PlatformUtilitiesWin.cpp:
+        (TestWebKitAPI::Util::MIMETypeForWKURLResponse):
+        Add helper to get the MIMEType from a WKURLResponse.
+
+        * TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:
+        * TestWebKitAPI/win/TestWebKitAPI.vcproj:
+        Add new files.
+
+2011-03-14  Jarkko Sakkinen  <jarkko.j.sakkinen@gmail.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Command-line options for QGLWidget and WebGL to QtTestBrowser
+        https://bugs.webkit.org/show_bug.cgi?id=56006
+
+        * QtTestBrowser/launcherwindow.cpp:
+        (LauncherWindow::initializeView):
+        * QtTestBrowser/main.cpp:
+        (LauncherApplication::handleUserOptions):
+
+2011-03-14  James Kozianski  <koz@chromium.org>
+
+        Reviewed by Ojan Vafai.
+
+        Add method to make BuildBot return test outputs
+        https://bugs.webkit.org/show_bug.cgi?id=54374
+
+        The Builder.latest_cached_build will be used by the new rebaseline
+        script to determine the build to use baselines from.
+
+        * Scripts/webkitpy/common/net/buildbot/buildbot.py:
+        * Scripts/webkitpy/common/net/buildbot/buildbot_unittest.py:
+
+2011-03-14  Adam Roben  <aroben@apple.com>
+
+        Test that WKBundlePageCanHandleRequest returns true for empty document URLs
+
+        Reviewed by Sam Weinig.
+
+        * TestWebKitAPI/Tests/WebKit2/CanHandleRequest.cpp: Added.
+        (TestWebKitAPI::didReceiveMessageFromInjectedBundle): Store the result of the test.
+        (TestWebKitAPI::setInjectedBundleClient): Hook up our callback.
+        (TestWebKitAPI::TEST): Register "emptyscheme" as an empty document scheme, load a page to
+        ensure the web process is initialized, then ask the bundle to run the test and assert that
+        it succeeded.
+
+        * TestWebKitAPI/Tests/WebKit2/CanHandleRequest_Bundle.cpp: Added.
+        (TestWebKitAPI::CanHandleRequestTest::CanHandleRequestTest): Just call up to the base class.
+        (TestWebKitAPI::canHandleURL): Helper function to test whether WebKit2 claims to be able to
+        handle a given URL.
+        (TestWebKitAPI::runTest): Check that empty document URLs can be handled (and that an unknown
+        URL type cannot be handled).
+        (TestWebKitAPI::CanHandleRequestTest::didReceiveMessage): Run the test and return the
+        result.
+
+        * TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:
+        * TestWebKitAPI/win/TestWebKitAPI.vcproj:
+        * TestWebKitAPI/win/TestWebKitAPIInjectedBundle.vcproj:
+        Added new files to the project.
+
+2011-03-14  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r81094.
+        http://trac.webkit.org/changeset/81094
+        https://bugs.webkit.org/show_bug.cgi?id=56355
+
+        Broke the chromium DRT related build. (Requested by dave_levin
+        on #webkit).
+
+        * DumpRenderTree/chromium/DumpRenderTree.cpp:
+        (main):
+        * DumpRenderTree/chromium/LayoutTestController.cpp:
+        (LayoutTestController::LayoutTestController):
+        (LayoutTestController::layerTreeAsText):
+        * DumpRenderTree/chromium/LayoutTestController.h:
+        * DumpRenderTree/chromium/TestShell.cpp:
+        (TestShell::runFileTest):
+        (TestShell::dump):
+        * DumpRenderTree/chromium/TestShell.h:
+        (TestParams::TestParams):
+
+2011-03-14  Daniel Sievers  <sievers@google.com>
+
+        Reviewed by Simon Fraser.
+
+        [Chromium] Make RenderAsTextBehavior and LayerTreeAsTextBehavior tweakable from the DumpRenderTree commandline
+        https://bugs.webkit.org/show_bug.cgi?id=56139
+
+        * DumpRenderTree/chromium/DumpRenderTree.cpp:
+        (main):
+        * DumpRenderTree/chromium/LayoutTestController.cpp:
+        (LayoutTestController::LayoutTestController):
+        (LayoutTestController::layerTreeAsText):
+        * DumpRenderTree/chromium/LayoutTestController.h:
+        (LayoutTestController::setShowDebugLayerTree):
+        * DumpRenderTree/chromium/TestShell.cpp:
+        (TestShell::runFileTest):
+        (TestShell::dump):
+        * DumpRenderTree/chromium/TestShell.h:
+        (TestParams::TestParams):
+
+2011-03-14  Balazs Kelemen  <kbalazs@webkit.org>
+
+        Reviewed by Adam Roben.
+
+        [Qt][WK2]Unbreak InjectedBundle on Qt
+        https://bugs.webkit.org/show_bug.cgi?id=54109
+
+        * WebKitTestRunner/InjectedBundle/InjectedBundlePage.cpp:
+        (WTR::InjectedBundlePage::willSendRequestForFrame): Use new WebKit2
+        API's instead of KURL to analyze the URL.
+        * WebKitTestRunner/StringFunctions.h:
+        (WTR::adoptWK): Moved from InjectedBundlePage.cpp to make it available globally
+        in the WebKitTestRunner project.
+        (WTR::toWK): Use adoptWK.
+        (WTR::operator<<): Added helper for printing a WKURL.
+        * WebKitTestRunner/WebKitTestRunner.xcodeproj/project.pbxproj: Do not link
+        against WebCore.
+
+2011-03-14  Balazs Kelemen  <kbalazs@webkit.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        check-webkit-style falsely should not complain about WebKit2 API headers in the Shared directory
+        https://bugs.webkit.org/show_bug.cgi?id=56321
+
+        * Scripts/webkitpy/style/checker.py: Add the patch "Source/WebKit2/Shared/API/c"
+        to the list of exceptions for WebKit2 C API headers.
+
+2011-03-14  Adam Roben  <aroben@apple.com>
+
+        Show the list of recent leaky builds in reverse chronological order
+
+        Previously they were being shown in a deterministic but surprising order based on
+        lexicographically sorting the build offsets (-1, -10, -2, -3...).
+
+        Fixes <http://webkit.org/b/56342> Leaks Viewer shows recent builds in a strange order
+
+        Reviewed by Darin Adler.
+
+        * BuildSlaveSupport/build.webkit.org-config/public_html/LeaksViewer/RecentBuildsLoader.js:
+        (RecentBuildsLoader.prototype.start): Sort the builds by revision before passing them to our
+        callback.
+
+2011-03-14  Adam Roben  <aroben@apple.com>
+
+        Show a list of up to 10 recent leaky builds when Leaks Viewer loads
+
+        Fixes <http://webkit.org/b/56043> Leaks Viewer should present a list of recent builds to
+        analyze
+
+        Reviewed by David Kilzer and Joe Pecoraro.
+
+        * BuildSlaveSupport/build.webkit.org-config/public_html/LeaksViewer/LeaksViewer.css:
+        (#url-prompt): Made this a bit taller to make room for the list of builds.
+
+        (#recent-builds-loading-indicator):
+        (#recent-builds-list):
+        Added styles for the build list and loading indicator.
+
+        * BuildSlaveSupport/build.webkit.org-config/public_html/LeaksViewer/LeaksViewer.js:
+        (LeaksViewer.loaded): Pass the URL from the query through decodeURIComponent before loading
+        it. This will unescape it.
+        (LeaksViewer.urlPromptButtonClicked): Moved code from here to _urlChosenFromPrompt.
+        (LeaksViewer._didLoadRecentBuilds): Added. Stores the builds and updates the prompt.
+        (LeaksViewer._displayURLPrompt): Start loading the recent leaky builds.
+        (LeaksViewer._updateURLPrompt): Create a list of the recent leaky builds and add them to the
+        prompt UI.
+        (LeaksViewer._urlChosenFromPrompt): Added. Code came from urlPromptButtonClicked. This is
+        now also used when a recent build is clicked.
+
+        * BuildSlaveSupport/build.webkit.org-config/public_html/LeaksViewer/RecentBuildsLoader.js: Added.
+        (RecentBuildsLoader): Store the callback.
+        (RecentBuildsLoader.prototype.start): Load the N most recent builds from the specified
+        builder. Find the revision number, leak count, and results URL for each one. Pass the
+        resulting info to our callback.
+
+        * BuildSlaveSupport/build.webkit.org-config/public_html/LeaksViewer/Utilities.js:
+        (range): Added this helper function to return an array containing the integers [0, n).
+
+        * BuildSlaveSupport/build.webkit.org-config/public_html/LeaksViewer/index.html: Added
+        RecentBuildsLoader.js and added text to the prompt UI to show the recent builds.
+
+2011-03-14  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Fix two memory leaks within LayoutTestController's storage support.
+
+        * DumpRenderTree/mac/LayoutTestControllerMac.mm:
+        (LayoutTestController::originsWithLocalStorage): Don't leak the JSStringRef that is returned
+        by JSStringCreateWithCFString.
+        (LayoutTestController::deleteLocalStorageForOrigin): Don't leak the WebSecurityOrigin that we
+        allocate.
+
+2011-03-14  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        <http://webkit.org/b/56304> REGRESSION(r80892): 100,000+ leaks seen on the build bot
+
+        * DumpRenderTree/LayoutTestController.cpp:
+        (LayoutTestController::staticFunctions): Remove duplicate entries.
+
+2011-03-14  Alice Liu  <alice.liu@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        DumpRenderTree Perl Support fails to build with ARCHS="i386 x86_64"
+
+        * DumpRenderTree/mac/PerlSupport/Makefile:
+        Add whitespace when joining "-arch" with the architectures passed in as arguments.
+
+2011-03-14  Daniel Bates  <dbates@rim.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=55438
+        Add double quotes around value of -DCMAKE_WINCE_SDK that I inadvertently did not add
+        when landing changeset 81041 <http://trac.webkit.org/changeset/81041>.
+
+        * Scripts/build-webkit:
+
+2011-03-14  Daniel Bates  <dbates@rim.com>
+
+        Reviewed by David Kilzer.
+
+        Cleanup: Separate port-specific implementation details from webkitdirs::buildCMakeProject()
+        https://bugs.webkit.org/show_bug.cgi?id=55438
+
+        Separate out the EFL- and WinCE-specific logic from the port-independent logic in
+        webkitdirs::buildCMakeProject(). Also, remove redundant code for generating the
+        CMake arguments for feature defines.
+
+        * Scripts/build-webkit:
+          - Added cMakeArgsFromFeatures() to convert the @features array to CMake arguments.
+          - Modified EFL and WinCE-specific building logic to call buildCMakeProjectOrExit().
+          - Sorted forward declarations.
+          - Initialize $makeArgs with the empty string so as to simplify its use in string operations;
+            Modified call sites as needed.
+        * Scripts/webkitdirs.pm:
+          - Added cleanCMakeGeneratedProject() to clean a CMake build.
+          - Added buildCMakeGeneratedProject() to build using generated build system.
+          - Added buildCMakeProjectOrExit() which is a facade for building a CMake project.
+          - Added generateBuildSystemFromCMakeProject() to generate the build system from
+            a CMake project.
+          - Removed buildCMakeProject(). This functionality is in buildCMakeProjectOrExit().
+
+2011-03-14  John Knottenbelt  <jknotten@chromium.org>
+
+        Reviewed by Steve Block.
+
+        Detach Geolocation from Frame when Page destroyed.
+        https://bugs.webkit.org/show_bug.cgi?id=52877
+
+        Extend the layout test controller to expose the number of pending
+        geolocation requests, so that we can test that the requests have
+        been cancelled on page close.
+
+        * DumpRenderTree/LayoutTestController.cpp:
+        (numberOfPendingGeolocationPermissionRequestsCallback):
+        (LayoutTestController::staticFunctions):
+        * DumpRenderTree/LayoutTestController.h:
+        * DumpRenderTree/chromium/LayoutTestController.cpp:
+        (LayoutTestController::LayoutTestController):
+        (LayoutTestController::numberOfPendingGeolocationPermissionRequests):
+        * DumpRenderTree/chromium/LayoutTestController.h:
+        * DumpRenderTree/gtk/LayoutTestControllerGtk.cpp:
+        (LayoutTestController::numberOfPendingGeolocationPermissionRequests):
+        * DumpRenderTree/mac/LayoutTestControllerMac.mm:
+        (LayoutTestController::numberOfPendingGeolocationPermissionRequests):
+        * DumpRenderTree/mac/UIDelegate.h:
+        * DumpRenderTree/mac/UIDelegate.mm:
+        (-[UIDelegate numberOfPendingGeolocationPermissionRequests]):
+        * DumpRenderTree/qt/LayoutTestControllerQt.cpp:
+        (LayoutTestController::numberOfPendingGeolocationPermissionRequests):
+        * DumpRenderTree/qt/LayoutTestControllerQt.h:
+        * DumpRenderTree/win/LayoutTestControllerWin.cpp:
+        (LayoutTestController::numberOfPendingGeolocationPermissionRequests):
+        * DumpRenderTree/wx/LayoutTestControllerWx.cpp:
+        (LayoutTestController::numberOfPendingGeolocationPermissionRequests):
+
+
+2011-03-14  Gyuyoung Kim  <gyuyoung.kim@samsung.com>
+
+        Unreviewed. Modify my email address in committers.py.
+
+        * Scripts/webkitpy/common/config/committers.py:
+
+2011-03-13  Joe Wild  <joseph.wild@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] QtLauncher does not load the same set of fonts as the DRT
+        https://bugs.webkit.org/show_bug.cgi?id=34959
+
+        This patch adds the option "-use-test-fonts" to the QtTestBrowser.
+        When this option is used the webkit fonts are loaded the same
+        as they are in DumpRenderTree.  This option can be used on
+        QtTestBrowser and run-launcher.  It can only be used
+        on Linux systems with FcInit and is configured as such.
+
+        * QtTestBrowser/launcherwindow.h:
+        (WindowOptions::WindowOptions):
+        * QtTestBrowser/main.cpp:
+        (initWebKitTestFonts):
+        (launcherMain):
+        (LauncherApplication::handleUserOptions):
+
+2011-03-12  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        <rdar://problem/8995822> Build DumpRenderTree perl support only for the architectures
+        DumpRenderTree is being built for.
+
+        * DumpRenderTree/mac/PerlSupport/Makefile:
+
+2011-03-12  Dan Bernstein  <mitz@apple.com>
+
+        Suggested by Mark Rowe.
+
+        * DumpRenderTree/mac/Configurations/Base.xcconfig: Leave C++ exceptions enabled
+        as they were before r80915.
+
+2011-03-12  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Should be able to download a PDF to the Downloads folder
+        https://bugs.webkit.org/show_bug.cgi?id=56256
+
+        * MiniBrowser/mac/BrowserWindowController.m:
+        (-[BrowserWindowController awakeFromNib]):
+        * WebKitTestRunner/TestController.cpp:
+        (WTR::TestController::createOtherPage):
+        (WTR::TestController::initialize):
+        Update for API changes.
+
+2011-03-11  Anton D'Auria  <adauria@apple.com>
+
+        Reviewed and landed by Brady Eidson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=51878
+        Add WebKit1 API to view and delete local storage
+
+        Added tests that write to LocalStorage, delete one origin, get list of origins with local storage, delete all origins.
+
+        * DumpRenderTree/DumpRenderTree.xcodeproj/project.pbxproj:
+        * DumpRenderTree/LayoutTestController.cpp:
+        (syncLocalStorageCallback):
+        (observeStorageTrackerNotificationsCallback):
+        (deleteAllLocalStorageCallback):
+        (deleteLocalStorageForOriginCallback):
+        (originsWithLocalStorageCallback):
+        (LayoutTestController::staticFunctions):
+        * DumpRenderTree/LayoutTestController.h:
+        * DumpRenderTree/StorageTrackerDelegate.h: Added.
+        * DumpRenderTree/StorageTrackerDelegate.mm: Added.
+        (-[StorageTrackerDelegate init]):
+        (-[StorageTrackerDelegate logNotifications:controller:]):
+        (-[StorageTrackerDelegate originModified:]):
+        (-[StorageTrackerDelegate dealloc]):
+        (-[StorageTrackerDelegate setControllerToNotifyDone:]):
+        * DumpRenderTree/chromium/LayoutTestController.cpp:
+        (LayoutTestController::LayoutTestController):
+        (LayoutTestController::deleteAllLocalStorage):
+        (LayoutTestController::originsWithLocalStorage):
+        (LayoutTestController::deleteLocalStorageForOrigin):
+        (observeStorageTrackerNotifications):
+        (syncLocalStorage):
+        * DumpRenderTree/chromium/LayoutTestController.h:
+        * DumpRenderTree/gtk/LayoutTestControllerGtk.cpp:
+        (LayoutTestController::originsWithLocalStorage):
+        (LayoutTestController::deleteAllLocalStorage):
+        (LayoutTestController::deleteLocalStorageForOrigin):
+        (LayoutTestController::observeStorageTrackerNotifications):
+        (LayoutTestController::syncLocalStorage):
+        * DumpRenderTree/mac/DumpRenderTree.mm:
+        (resetDefaultsToConsistentValues):
+        (allocateGlobalControllers):
+        (releaseGlobalControllers):
+        * DumpRenderTree/mac/DumpRenderTreeMac.h:
+        * DumpRenderTree/mac/LayoutTestControllerMac.mm:
+        (LayoutTestController::syncLocalStorage):
+        (LayoutTestController::observeStorageTrackerNotifications):
+        (LayoutTestController::deleteAllLocalStorage):
+        (LayoutTestController::originsWithLocalStorage):
+        (LayoutTestController::deleteLocalStorageForOrigin):
+        * DumpRenderTree/qt/LayoutTestControllerQt.cpp:
+        (LayoutTestController::originsWithLocalStorage):
+        (LayoutTestController::deleteAllLocalStorage):
+        (LayoutTestController::deleteLocalStorageForOrigin):
+        (LayoutTestController::observeStorageTrackerNotifications):
+        (LayoutTestController::syncLocalStorage):
+        * DumpRenderTree/qt/LayoutTestControllerQt.h:
+        * DumpRenderTree/win/LayoutTestControllerWin.cpp:
+        (LayoutTestController::clearAllApplicationCaches):
+        (LayoutTestController::syncLocalStorage):
+        (LayoutTestController::observeStorageTrackerNotifications):
+        (LayoutTestController::clearAllDatabases):
+        (LayoutTestController::deleteAllLocalStorage):
+        (LayoutTestController::originsWithLocalStorage):
+        (LayoutTestController::deleteLocalStorageForOrigin):
+        * DumpRenderTree/wx/LayoutTestControllerWx.cpp:
+        (LayoutTestController::syncLocalStorage):
+        (LayoutTestController::observeStorageTrackerNotifications):
+        (LayoutTestController::clearAllDatabases):
+        (LayoutTestController::deleteAllLocalStorage):
+        (LayoutTestController::originsWithLocalStorage):
+        (LayoutTestController::deleteLocalStorageForOrigin):
+
+2011-03-11  Jessie Berlin  <jberlin@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Crash calling WebContext::clearResourceCaches(InMemoryResourceCachesOnly) before the Web
+        Process has finished launching.
+        https://bugs.webkit.org/show_bug.cgi?id=56208
+
+        * TestWebKitAPI/Tests/WebKit2/SendingMessagesToTheWebProcessBeforeItIsValid.cpp: Added.
+        (TestWebKitAPI::TEST):
+        Test that calling WKContextClearResourceCaches works with both options when called before
+        the Web Process is valid.
+
+        * TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:
+        Add the new test.
+        * TestWebKitAPI/win/TestWebKitAPI.vcproj:
+        Ditto.
+
+2011-03-11  Adam Roben  <aroben@apple.com>
+
+        Make it possible to view all leaks from a build at once in Leaks Viewer
+
+        You can now give Leaks Viewer the URL of a build results page (e.g.,
+        <http://build.webkit.org/results/SnowLeopard%20Intel%20Leaks/r80847%20(15493)/>), and it
+        will load all the leaks files from that build.
+
+        Fixes <http://webkit.org/b/56030> Leaks Viewer: Would like to be able to look at all leaks
+        files from a particular build at once, rather than one at a time
+
+        Reviewed by David Kilzer.
+
+        * BuildSlaveSupport/build.webkit.org-config/public_html/LeaksViewer/LeaksLoader.js: Added.
+        (LeaksLoader): Initialize our properties.
+        (LeaksLoader.prototype.start): If the URL ends in .txt, assume it's a single leaks file and
+        load it. Otherwise assume it's a build results page URL and start fetching the leaks files
+        from that page.
+        (LeaksLoader.prototype._loadLeaksFiles): Tell our client how many leaks files we're loading
+        so it can provide feedback. Then load each one and pass it to the client.
+        (LeaksLoader.prototype._loadLeaksFromResultsPage): Load the HTML of the results page, parse
+        it into a DOM, pull out all the links to leaks files, and load each one.
+
+        * BuildSlaveSupport/build.webkit.org-config/public_html/LeaksViewer/LeaksParser.js: Added.
+        (LeaksParser): Initialize our worker.
+        (LeaksParser.prototype.addLeaksFile): Tell the worker about the leaks file's contents.
+
+        * BuildSlaveSupport/build.webkit.org-config/public_html/LeaksViewer/LeaksParserWorker.js: Added.
+        This code mostly came from Worker.js.
+        (LeaksParserWorker): Initialize our profile.
+        (LeaksParserWorker.prototype.addLeaksFile): Parse the leaks file and incorporate it into our
+        profile.
+        (LeaksParserWorker.prototype._parseLeaks):
+        (LeaksParserWorker.prototype._createNode):
+        (LeaksParserWorker.prototype._incorporateLeaks):
+        Moved these functions here from LeaksViewer. _incorporateLeaks is essentially just a renamed
+        version of createProfile which adds to this.profile instead of making a new profile each
+        time.
+        (onmessage): Parse the file and send back the new profile.
+
+        * BuildSlaveSupport/build.webkit.org-config/public_html/LeaksViewer/LeaksViewer.css:
+        (#loading-indicator):
+        (#spinner):
+        (#loading-indicator-label):
+        Tweaked styles to accomodate a longer label.
+
+        * BuildSlaveSupport/build.webkit.org-config/public_html/LeaksViewer/LeaksViewer.js:
+        (LeaksViewer.loaded): Set up a loader and parser.
+
+        (LeaksViewer.get filesLeftToParse):
+        (LeaksViewer.set filesLeftToParse):
+        Added these simple accessors.
+
+        (LeaksViewer._didCountLeaksFiles): Callback from LeaksLoader. Stores the count.
+        (LeaksViewer._didLoadLeaksFile): Callback from LeaksLoader. Passes the file contents off to
+        the parser.
+        (LeaksViewer._didParseLeaksFile): Callback from LeaksParser. If all files have been parsed,
+        tell the ProfilerAgent and mark that we're done loading. (Code came from the old
+        _loadLeaksFromURL function).
+        (LeaksViewer._loadLeaksFromURL): Now just calls through to the loader.
+        (LeaksViewer._loadingIndicatorText): Added. Returns the text that should show up in the
+        loading indicator, including the number of files being loaded.
+        (LeaksViewer._loadingStatusChanged): Update the loading indicator's label, too.
+        (LeaksViewer._updateLoadingIndicatorLabel): Added. Just updates the label!
+        (LeaksViewer._updateTitle): Moved code to compute the "Loading" text to
+        _loadingIndicatorText.
+
+        * BuildSlaveSupport/build.webkit.org-config/public_html/LeaksViewer/Utilities.js: Added.
+        (getResource): Moved here from LeaksViewer.js.
+
+        * BuildSlaveSupport/build.webkit.org-config/public_html/LeaksViewer/Worker.js: Subsumed by
+        LeaksParserWorker.js.
+
+        * BuildSlaveSupport/build.webkit.org-config/public_html/LeaksViewer/index.html: Added new JS
+        files, added a #loading-indicator-label element, and tweaked the prompt wording.
+
+2011-03-11  Adam Roben  <aroben@apple.com>
+
+        Don't trigger a build when build.webkit.org's HTML files are modified
+
+        Fixes <http://webkit.org/b/56190> Windows bots shouldn't have built r80848/r80851, but did
+
+        Reviewed by Dan Bernstein.
+
+        * Scripts/webkitpy/common/config/build.py:
+        (_should_file_trigger_build): Added build.webkit.org's public_html directory to the list of
+        directories that shouldn't trigger builds. Re-sorted the list.
+
+        * Scripts/webkitpy/common/config/build_unittest.py:
+        (ShouldBuildTest): Added a test to cover the above change.
+
+2011-03-11  Adam Roben  <aroben@apple.com>
+
+        Roll out r80848
+
+        It was accidentally committed.
+
+        * BuildSlaveSupport/build.webkit.org-config/public_html/LeaksViewer/LeaksViewer.js:
+        (LeaksViewer._loadLeaksFromURL):
+
+2011-03-11  Tony Chang  <tony@chromium.org>
+
+        Reviewed by Ojan Vafai.
+
+        kill hung lighttpd processes on the chromium win bot
+        https://bugs.webkit.org/show_bug.cgi?id=56152
+
+        Sometimes this process doesn't exit and it holds on to
+        a log file that we can't delete or copy, causing the tests
+        to go red.
+
+        * BuildSlaveSupport/win/kill-old-processes:
+
+2011-03-11  Ilya Sherman  <isherman@chromium.org>
+
+        Reviewed by Kent Tamura.
+
+        [Chromium] missing HTMLInputElement::setValueForUser() to tests
+        https://bugs.webkit.org/show_bug.cgi?id=55854
+
+        * DumpRenderTree/chromium/LayoutTestController.cpp:
+        (LayoutTestController::LayoutTestController):
+        (LayoutTestController::setValueForUser): Added.
+        * DumpRenderTree/chromium/LayoutTestController.h:
+
+2011-03-10  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        Clean up some gross code in TestShellWin.cpp.  No functional change.
+        https://bugs.webkit.org/show_bug.cgi?id=56048
+
+        * DumpRenderTree/chromium/TestShellWin.cpp:
+        (checkLayoutTestSystemDependencies):
+
+2011-03-10  Keith Kyzivat  <keith.kyzivat@nokia.com>
+
+        Reviewed by Laszlo Gombos.
+
+        [Qt] Buildfix for platforms where X11 is not available (e.g. Symbian)
+
+        * WebKitTestRunner/InjectedBundle/qt/ActivateFontsQt.cpp:
+        (WTR::activateFonts): Guard X11-specific code with Q_WS_X11.
+
+2011-03-10  Gyuyoung Kim  <gyuyoung.kim@samsung.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [EFL] Make single backing store the default for EWebLauncher
+        https://bugs.webkit.org/show_bug.cgi?id=55753
+
+        Set single backing store the default for EWebLauncher.
+
+        * EWebLauncher/main.c:
+        (main):
+
+2011-03-10  Adam Roben  <aroben@apple.com>
+
+        Ignore errors from files being held open when creating a test result archive
+
+        Fixes <http://webkit.org/b/55581> Test results don't get uploaded if test-result-archive
+        fails to delete the results directory
+
+        Reviewed by Mark Rowe.
+
+        * BuildSlaveSupport/test-result-archive:
+        (archiveTestResults): Ignore errno 2 when deleting the results directory, since it can be
+        thrown when a process is holding a file open.
+
+2011-03-10  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r80701.
+        http://trac.webkit.org/changeset/80701
+        https://bugs.webkit.org/show_bug.cgi?id=56126
+
+        fast/dom/Geolocation/window-close-crash.html fails on Snow
+        Leopard release builds (Requested by mihaip on #webkit).
+
+        * DumpRenderTree/LayoutTestController.cpp:
+        (LayoutTestController::staticFunctions):
+        * DumpRenderTree/LayoutTestController.h:
+        * DumpRenderTree/chromium/LayoutTestController.cpp:
+        (LayoutTestController::LayoutTestController):
+        * DumpRenderTree/chromium/LayoutTestController.h:
+        * DumpRenderTree/gtk/LayoutTestControllerGtk.cpp:
+        * DumpRenderTree/mac/LayoutTestControllerMac.mm:
+        * DumpRenderTree/mac/UIDelegate.h:
+        * DumpRenderTree/mac/UIDelegate.mm:
+        * DumpRenderTree/qt/LayoutTestControllerQt.cpp:
+        * DumpRenderTree/qt/LayoutTestControllerQt.h:
+        * DumpRenderTree/win/LayoutTestControllerWin.cpp:
+        * DumpRenderTree/wx/LayoutTestControllerWx.cpp:
+
+2011-03-10  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Gustavo Noronha Silva.
+
+        [GTK] run-gtk-tests doesn't fail if a test crashes
+        https://bugs.webkit.org/show_bug.cgi?id=56089
+
+        * Scripts/run-gtk-tests: gtester -k exits with a 0 exit status
+        even if a test crashes. So run the tests individually and if a
+        test fails remember its exit code so run-gtk-test fails too, if
+        required.
+
+2011-01-26  John Knottenbelt  <jknotten@chromium.org>
+
+        Reviewed by Dmitry Titov.
+
+        Detach Geolocation from Frame when Page destroyed.
+        https://bugs.webkit.org/show_bug.cgi?id=52877
+
+        Extend the layout test controller to expose the number of pending
+        geolocation requests, so that we can test that the requests have
+        been cancelled on page close.
+
+        * DumpRenderTree/LayoutTestController.cpp:
+        (numberOfPendingGeolocationPermissionRequestsCallback):
+        (LayoutTestController::staticFunctions):
+        * DumpRenderTree/LayoutTestController.h:
+        * DumpRenderTree/chromium/LayoutTestController.cpp:
+        (LayoutTestController::LayoutTestController):
+        (LayoutTestController::numberOfPendingGeolocationPermissionRequests):
+        * DumpRenderTree/chromium/LayoutTestController.h:
+        * DumpRenderTree/gtk/LayoutTestControllerGtk.cpp:
+        (LayoutTestController::numberOfPendingGeolocationPermissionRequests):
+        * DumpRenderTree/mac/LayoutTestControllerMac.mm:
+        (LayoutTestController::numberOfPendingGeolocationPermissionRequests):
+        * DumpRenderTree/mac/UIDelegate.h:
+        * DumpRenderTree/mac/UIDelegate.mm:
+        (-[UIDelegate numberOfPendingGeolocationPermissionRequests]):
+        * DumpRenderTree/qt/LayoutTestControllerQt.cpp:
+        (LayoutTestController::numberOfPendingGeolocationPermissionRequests):
+        * DumpRenderTree/qt/LayoutTestControllerQt.h:
+        * DumpRenderTree/win/LayoutTestControllerWin.cpp:
+        (LayoutTestController::numberOfPendingGeolocationPermissionRequests):
+        * DumpRenderTree/wx/LayoutTestControllerWx.cpp:
+        (LayoutTestController::numberOfPendingGeolocationPermissionRequests):
+
+
+2011-03-09  Adam Roben  <aroben@apple.com>
+
+        Hide Leaks Viewer's URL prompt by default
+
+        We will show it as needed. I think I left it visible by default by accident after doing some
+        testing.
+
+        Fixes <http://webkit.org/b/56031> Leaks Viewer: URL prompt overlay shouldn't appear when a
+        URL is passed as a query parameter, but does
+
+        Reviewed by Simon Fraser.
+
+        * BuildSlaveSupport/build.webkit.org-config/public_html/LeaksViewer/index.html:
+
+2011-03-09  Adam Roben  <aroben@apple.com>
+
+        Don't use Element.classList or box-shadow in Leaks Viewer
+
+        They aren't supported by Safari 5. Luckily we have substitutes for them!
+
+        Fixes <http://webkit.org/b/56035> Leaks viewer doesn't work in Safari 5
+
+        Reviewed by Simon Fraser.
+
+        * BuildSlaveSupport/build.webkit.org-config/public_html/LeaksViewer/LeaksViewer.css:
+        (#url-prompt): Use -webkit-box-shadow instead of box-shadow.
+
+        * BuildSlaveSupport/build.webkit.org-config/public_html/LeaksViewer/LeaksViewer.js:
+        (LeaksViewer.urlPromptButtonClicked):
+        (LeaksViewer._displayURLPrompt):
+        (LeaksViewer._setLoadingIndicatorHidden):
+        Use add/removeStyleClass (from utilities.js) instead of Element.classList.
+
+2011-03-09  Adam Roben  <aroben@apple.com>
+
+        Add a link to the Leaks Viewer tool on the build.webkit.org homepage
+
+        Rubber-stamped by David Kilzer.
+
+        * BuildSlaveSupport/build.webkit.org-config/templates/root.html:
+
+2011-03-09  Adam Roben  <aroben@apple.com>
+
+        Add a Leaks Viewer tool to build.webkit.org
+
+        This tool parses leaks from the files generated by the leaks bot and displays them in a
+        view similar to the Web Inspector's Profiles pane (in fact, it uses the Web Inspector's
+        code).
+
+        The URL of the leaks file can be entered in a prompt when the tools is first shown, or can
+        be passed to the tool via the "url" query parameter.
+
+        Only one leaks file can be viewed at a time for now. Only the number of leaks, as opposed to
+        the number of leaked bytes, is shown. And this tool has made apparent some bugs in the Web
+        Inspector's Heavy profile view. But it's still pretty useful as-is.
+
+        Fixes <http://webkit.org/b/56028> Would like a Shark-like tool for viewing leaks from leak bots
+
+        Reviewed by Darin Adler.
+
+        * BuildSlaveSupport/build.webkit.org-config/public_html/LeaksViewer/LeaksViewer.css: Added.
+        (#url-prompt-container): This is the dark overlay that is shown behind the URL prompt.
+        (#url-prompt): This is the prompt itself.
+
+        (#loading-indicator):
+        (#loading-indicator > img):
+        These show a spinner in the bottom-right when we're loading a leaks file.
+
+        (.percent-time-status-bar-item): Hide the Percent button since we never want to show leaks
+        as percentages.
+
+        * BuildSlaveSupport/build.webkit.org-config/public_html/LeaksViewer/LeaksViewer.js: Added.
+        (LeaksViewer.loaded): Initialize ourselves and start loading the leaks file (or prompt for a
+        URL if one wasn't given to us as a query parameter).
+
+        (LeaksViewer.get loading):
+        (LeaksViewer.set loading):
+        (LeaksViewer.get url):
+        (LeaksViewer.set url):
+        Pretty simple accessors.
+
+        (LeaksViewer.urlPromptButtonClicked): Start loading the URL from the prompt and hide the
+        prompt.
+        (LeaksViewer._displayURLPrompt): Show the prompt and focus the URL input.
+        (LeaksViewer._loadLeaksFromURL): Start fetching the leaks file. When we've retrieved the
+        file, hand it off to a Web Worker that will parse it into a fake "profile", then hand off
+        the profile to the Web Inspector code once it's been created.
+        (LeaksViewer._loadingStatusChanged): Update our loading indicator and title.
+        (LeaksViewer._setLoadingIndicatorHidden): Simply hide or show the indicator.
+        (LeaksViewer._updateTitle): Set our title based on our URL and loading status.
+        (getResource): Helper function to fetch a resource via XHR and pass it to a callback.
+
+        * BuildSlaveSupport/build.webkit.org-config/public_html/LeaksViewer/WebInspectorShims.js: Added.
+        (WebInspector.UIString): Just a simple implementation since this tool isn't localized.
+        (ProfilerAgent.getProfile): Store the callback.
+        (ProfilerAgent.profileReady): Call the callback.
+        (monkeyPatchInspectorObjects): Fix up WebInspector.ProfileDataGridNode to show the self leak
+        count and total leak counts as real values, not percentages or milliseconds.
+
+        * BuildSlaveSupport/build.webkit.org-config/public_html/LeaksViewer/Worker.js: Added.
+        (onmessage): Create a profile based on the leaks file and pass it back to our caller.
+        (parseLeaks): Extract call stacks out of a leaks file.
+        (createNode): Helper function to create a new empty profile node.
+        (createProfile): Take the leak stacks and turn them into a fake "profile" for consumption by
+        WebInspector.ProfileView.
+
+        * BuildSlaveSupport/build.webkit.org-config/public_html/LeaksViewer/index.html: Added.
+
+2011-03-09  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Combine multiple --ignore-tests values
+        https://bugs.webkit.org/show_bug.cgi?id=56016
+
+        * Scripts/old-run-webkit-tests:
+
+2011-03-08  Kenji Imasaki  <imasaki@chromium.org>
+
+        Reviewed by David Levin.
+
+        Adding myself to the committer file.
+
+        * Scripts/webkitpy/common/config/committers.py:
+
+2011-03-08  Jessie Berlin  <jberlin@apple.com>
+
+        Rubber-stamped by Adam Roben.
+
+        Fix two leaks I introduced into the API tests.
+
+        * TestWebKitAPI/Tests/WebKit2/win/DoNotCopyANullCFURLResponse.cpp:
+        (TestWebKitAPI::TEST):
+
+2011-03-08  Jessie Berlin  <jberlin@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        Crash in CFNetwork visiting google.com
+        https://bugs.webkit.org/show_bug.cgi?id=55958
+
+        Add a test for not trying to copy a null CFURLResponse.
+
+        * TestWebKitAPI/Tests/WebKit2/win/DoNotCopyANullCFURLResponse.cpp: Added.
+        (TestWebKitAPI::TEST):
+        * TestWebKitAPI/win/TestWebKitAPI.vcproj:
+
+2011-03-08  Hayato Ito  <hayato@chromium.org>
+
+        Reviewed by Ojan Vafai.
+
+        [NRWT] Renamed a FailureWithType class to a ComparisonTestFailure class.
+
+        FailureWithType is a confusing naming because we have removed test_type/* classes in r79840.
+
+        https://bugs.webkit.org/show_bug.cgi?id=55450
+
+        * Scripts/webkitpy/layout_tests/layout_package/test_failures.py:
+
+2011-03-08  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        Reviewed by Martin Robinson.
+
+        [GTK] Add layoutTestController.setValueForUser() after r80412
+        https://bugs.webkit.org/show_bug.cgi?id=55862
+
+        * DumpRenderTree/gtk/LayoutTestControllerGtk.cpp:
+        (LayoutTestController::setValueForUser): Implement setValueForUser()
+
+2011-03-08  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Add script_shell_command to WebKitPort
+        https://bugs.webkit.org/show_bug.cgi?id=55925
+
+        Add a central place where we generate the shell command from the script name.
+        This function will be used later to detect the correct script interpreter on Win32.
+
+        * Scripts/webkitpy/common/config/ports.py:
+        * Scripts/webkitpy/layout_tests/port/base.py:
+        * Scripts/webkitpy/tool/steps/abstractstep.py:
+        * Scripts/webkitpy/tool/steps/preparechangelog.py:
+
+2011-03-07  Ojan Vafai  <ojan@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        add webkit-patch attach-to-bug for posting to bugzilla from the commandline
+        https://bugs.webkit.org/show_bug.cgi?id=55749
+
+        * Scripts/webkitpy/tool/commands/upload.py:
+        * Scripts/webkitpy/tool/commands/upload_unittest.py:
+        * Scripts/webkitpy/tool/steps/__init__.py:
+        * Scripts/webkitpy/tool/steps/attachtobug.py: Added.
+        * Scripts/webkitpy/tool/steps/options.py:
+
+2011-03-07  Daniel Cheng  <dcheng@chromium.org>
+
+        Reviewed by David Levin.
+
+        Add support for DataTransferItems
+        https://bugs.webkit.org/show_bug.cgi?id=55115
+
+        Enable data transfer items in DRT.
+
+        * DumpRenderTree/chromium/TestShell.cpp:
+        (TestShell::TestShell):
+
+2011-03-06  Ojan Vafai  <ojan@chromium.org>
+
+        Reviewed by Tony Chang.
+
+        [test dashboard] pull treemap files
+        https://bugs.webkit.org/show_bug.cgi?id=55852
+
+        * TestResultServer/handlers/dashboardhandler.py:
+
 2011-03-03  Hayato Ito  <hayato@chromium.org>
 
         Reviewed by Mihai Parparita.
diff --git a/Tools/DumpRenderTree/DumpRenderTree.sln b/Tools/DumpRenderTree/DumpRenderTree.sln
index 1f7d803..df85a7c 100644
--- a/Tools/DumpRenderTree/DumpRenderTree.sln
+++ b/Tools/DumpRenderTree/DumpRenderTree.sln
@@ -24,7 +24,7 @@ Global
 		Debug_Cairo_CFLite|Win32 = Debug_Cairo_CFLite|Win32
 		Debug|Win32 = Debug|Win32
 		Release_Cairo_CFLite|Win32 = Release_Cairo_CFLite|Win32
-		Release_LTCG|Win32 = Release_LTCG|Win32
+		Production|Win32 = Production|Win32
 		Release|Win32 = Release|Win32
 	EndGlobalSection
 	GlobalSection(ProjectConfigurationPlatforms) = postSolution
@@ -36,8 +36,8 @@ Global
 		{6567DFD4-D6DE-4CD5-825D-17E353D160E1}.Debug|Win32.Build.0 = Debug|Win32
 		{6567DFD4-D6DE-4CD5-825D-17E353D160E1}.Release_Cairo_CFLite|Win32.ActiveCfg = Release_Cairo_CFLite|Win32
 		{6567DFD4-D6DE-4CD5-825D-17E353D160E1}.Release_Cairo_CFLite|Win32.Build.0 = Release_Cairo_CFLite|Win32
-		{6567DFD4-D6DE-4CD5-825D-17E353D160E1}.Release_LTCG|Win32.ActiveCfg = Release_LTCG|Win32
-		{6567DFD4-D6DE-4CD5-825D-17E353D160E1}.Release_LTCG|Win32.Build.0 = Release_LTCG|Win32
+		{6567DFD4-D6DE-4CD5-825D-17E353D160E1}.Production|Win32.ActiveCfg = Production|Win32
+		{6567DFD4-D6DE-4CD5-825D-17E353D160E1}.Production|Win32.Build.0 = Production|Win32
 		{6567DFD4-D6DE-4CD5-825D-17E353D160E1}.Release|Win32.ActiveCfg = Release|Win32
 		{6567DFD4-D6DE-4CD5-825D-17E353D160E1}.Release|Win32.Build.0 = Release|Win32
 		{C0737398-3565-439E-A2B8-AB2BE4D5430C}.Debug_All|Win32.ActiveCfg = Debug_All|Win32
@@ -48,8 +48,8 @@ Global
 		{C0737398-3565-439E-A2B8-AB2BE4D5430C}.Debug|Win32.Build.0 = Debug|Win32
 		{C0737398-3565-439E-A2B8-AB2BE4D5430C}.Release_Cairo_CFLite|Win32.ActiveCfg = Release_Cairo_CFLite|Win32
 		{C0737398-3565-439E-A2B8-AB2BE4D5430C}.Release_Cairo_CFLite|Win32.Build.0 = Release_Cairo_CFLite|Win32
-		{C0737398-3565-439E-A2B8-AB2BE4D5430C}.Release_LTCG|Win32.ActiveCfg = Release_LTCG|Win32
-		{C0737398-3565-439E-A2B8-AB2BE4D5430C}.Release_LTCG|Win32.Build.0 = Release_LTCG|Win32
+		{C0737398-3565-439E-A2B8-AB2BE4D5430C}.Production|Win32.ActiveCfg = Production|Win32
+		{C0737398-3565-439E-A2B8-AB2BE4D5430C}.Production|Win32.Build.0 = Production|Win32
 		{C0737398-3565-439E-A2B8-AB2BE4D5430C}.Release|Win32.ActiveCfg = Release|Win32
 		{C0737398-3565-439E-A2B8-AB2BE4D5430C}.Release|Win32.Build.0 = Release|Win32
 		{DA31DA52-6675-48D4-89E0-333A7144397C}.Debug_All|Win32.ActiveCfg = Debug_All|Win32
@@ -60,8 +60,8 @@ Global
 		{DA31DA52-6675-48D4-89E0-333A7144397C}.Debug|Win32.Build.0 = Debug|Win32
 		{DA31DA52-6675-48D4-89E0-333A7144397C}.Release_Cairo_CFLite|Win32.ActiveCfg = Release_Cairo_CFLite|Win32
 		{DA31DA52-6675-48D4-89E0-333A7144397C}.Release_Cairo_CFLite|Win32.Build.0 = Release_Cairo_CFLite|Win32
-		{DA31DA52-6675-48D4-89E0-333A7144397C}.Release_LTCG|Win32.ActiveCfg = Release_LTCG|Win32
-		{DA31DA52-6675-48D4-89E0-333A7144397C}.Release_LTCG|Win32.Build.0 = Release_LTCG|Win32
+		{DA31DA52-6675-48D4-89E0-333A7144397C}.Production|Win32.ActiveCfg = Production|Win32
+		{DA31DA52-6675-48D4-89E0-333A7144397C}.Production|Win32.Build.0 = Production|Win32
 		{DA31DA52-6675-48D4-89E0-333A7144397C}.Release|Win32.ActiveCfg = Release|Win32
 		{DA31DA52-6675-48D4-89E0-333A7144397C}.Release|Win32.Build.0 = Release|Win32
 		{59CC0547-70AC-499C-9B19-EC01C6F61137}.Debug_All|Win32.ActiveCfg = Debug_All|Win32
@@ -72,8 +72,8 @@ Global
 		{59CC0547-70AC-499C-9B19-EC01C6F61137}.Debug|Win32.Build.0 = Debug|Win32
 		{59CC0547-70AC-499C-9B19-EC01C6F61137}.Release_Cairo_CFLite|Win32.ActiveCfg = Release_Cairo_CFLite|Win32
 		{59CC0547-70AC-499C-9B19-EC01C6F61137}.Release_Cairo_CFLite|Win32.Build.0 = Release_Cairo_CFLite|Win32
-		{59CC0547-70AC-499C-9B19-EC01C6F61137}.Release_LTCG|Win32.ActiveCfg = Release_LTCG|Win32
-		{59CC0547-70AC-499C-9B19-EC01C6F61137}.Release_LTCG|Win32.Build.0 = Release_LTCG|Win32
+		{59CC0547-70AC-499C-9B19-EC01C6F61137}.Production|Win32.ActiveCfg = Production|Win32
+		{59CC0547-70AC-499C-9B19-EC01C6F61137}.Production|Win32.Build.0 = Production|Win32
 		{59CC0547-70AC-499C-9B19-EC01C6F61137}.Release|Win32.ActiveCfg = Release|Win32
 		{59CC0547-70AC-499C-9B19-EC01C6F61137}.Release|Win32.Build.0 = Release|Win32
 	EndGlobalSection
diff --git a/Tools/DumpRenderTree/DumpRenderTree.xcodeproj/project.pbxproj b/Tools/DumpRenderTree/DumpRenderTree.xcodeproj/project.pbxproj
index 000d83a..67a7556 100644
--- a/Tools/DumpRenderTree/DumpRenderTree.xcodeproj/project.pbxproj
+++ b/Tools/DumpRenderTree/DumpRenderTree.xcodeproj/project.pbxproj
@@ -42,6 +42,7 @@
 		1AC6C84A0D07638600CD3161 /* PluginObject.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1AC6C7800D07589B00CD3161 /* PluginObject.cpp */; };
 		1AC6C84B0D07638600CD3161 /* TestObject.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1AC6C7810D07589B00CD3161 /* TestObject.cpp */; };
 		1AC77DCF120605B6005C19EF /* NPRuntimeRemoveProperty.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1AC77DCE120605B6005C19EF /* NPRuntimeRemoveProperty.cpp */; };
+		1ACF898D132EF41C00E915D4 /* NPDeallocateCalledBeforeNPShutdown.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1ACF898B132EF41C00E915D4 /* NPDeallocateCalledBeforeNPShutdown.cpp */; };
 		1AD4CB2212A6D1350027A7AF /* GetUserAgentWithNullNPPFromNPPNew.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1AD4CB2012A6D1350027A7AF /* GetUserAgentWithNullNPPFromNPPNew.cpp */; };
 		1AD9D2FE12028409001A70D1 /* PluginScriptableNPObjectInvokeDefault.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1AD9D2FD12028409001A70D1 /* PluginScriptableNPObjectInvokeDefault.cpp */; };
 		23BCB8900EA57623003C6289 /* OpenGL.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = 23BCB88F0EA57623003C6289 /* OpenGL.framework */; };
@@ -50,6 +51,8 @@
 		29CFBA2E12273A1000BC30C0 /* AccessibilityTextMarkerMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = 29CFBA2D12273A1000BC30C0 /* AccessibilityTextMarkerMac.mm */; };
 		3713EDE2115BE19300705720 /* ColorBits-A.png in Copy Font Files */ = {isa = PBXBuildFile; fileRef = 3713EDDF115BE16F00705720 /* ColorBits-A.png */; };
 		3713EDE3115BE19300705720 /* ColorBits.ttf in Copy Font Files */ = {isa = PBXBuildFile; fileRef = 3713EDE0115BE16F00705720 /* ColorBits.ttf */; };
+		3A5626CB131CA02A002BE6D9 /* StorageTrackerDelegate.mm in Sources */ = {isa = PBXBuildFile; fileRef = 3A5626C1131C8B17002BE6D9 /* StorageTrackerDelegate.mm */; };
+		3A5626CC131CA036002BE6D9 /* StorageTrackerDelegate.h in Headers */ = {isa = PBXBuildFile; fileRef = 3A5626C0131C8B17002BE6D9 /* StorageTrackerDelegate.h */; };
 		440590711268453800CFD48D /* WebArchiveDumpSupportMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = 440590701268453800CFD48D /* WebArchiveDumpSupportMac.mm */; };
 		4437730E125CBC3600AAE02C /* WebArchiveDumpSupport.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 44A997830FCDE86400580F10 /* WebArchiveDumpSupport.cpp */; };
 		4437730F125CBC4D00AAE02C /* WebArchiveDumpSupport.h in Headers */ = {isa = PBXBuildFile; fileRef = 44A997820FCDE86400580F10 /* WebArchiveDumpSupport.h */; };
@@ -212,6 +215,7 @@
 		1AC6C7800D07589B00CD3161 /* PluginObject.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = PluginObject.cpp; sourceTree = "<group>"; };
 		1AC6C7810D07589B00CD3161 /* TestObject.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = TestObject.cpp; sourceTree = "<group>"; };
 		1AC77DCE120605B6005C19EF /* NPRuntimeRemoveProperty.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = NPRuntimeRemoveProperty.cpp; sourceTree = "<group>"; };
+		1ACF898B132EF41C00E915D4 /* NPDeallocateCalledBeforeNPShutdown.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = NPDeallocateCalledBeforeNPShutdown.cpp; sourceTree = "<group>"; };
 		1AD4CB2012A6D1350027A7AF /* GetUserAgentWithNullNPPFromNPPNew.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = GetUserAgentWithNullNPPFromNPPNew.cpp; sourceTree = "<group>"; };
 		1AD9D2FD12028409001A70D1 /* PluginScriptableNPObjectInvokeDefault.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = PluginScriptableNPObjectInvokeDefault.cpp; sourceTree = "<group>"; };
 		23BCB88F0EA57623003C6289 /* OpenGL.framework */ = {isa = PBXFileReference; lastKnownFileType = wrapper.framework; name = OpenGL.framework; path = /System/Library/Frameworks/OpenGL.framework; sourceTree = "<absolute>"; };
@@ -230,6 +234,8 @@
 		375F09770DAC3CB600C8B4E5 /* WebKitWeightWatcher700.ttf */ = {isa = PBXFileReference; lastKnownFileType = file; name = WebKitWeightWatcher700.ttf; path = fonts/WebKitWeightWatcher700.ttf; sourceTree = "<group>"; };
 		375F09780DAC3CB600C8B4E5 /* WebKitWeightWatcher800.ttf */ = {isa = PBXFileReference; lastKnownFileType = file; name = WebKitWeightWatcher800.ttf; path = fonts/WebKitWeightWatcher800.ttf; sourceTree = "<group>"; };
 		375F09790DAC3CB600C8B4E5 /* WebKitWeightWatcher900.ttf */ = {isa = PBXFileReference; lastKnownFileType = file; name = WebKitWeightWatcher900.ttf; path = fonts/WebKitWeightWatcher900.ttf; sourceTree = "<group>"; };
+		3A5626C0131C8B17002BE6D9 /* StorageTrackerDelegate.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = StorageTrackerDelegate.h; sourceTree = "<group>"; };
+		3A5626C1131C8B17002BE6D9 /* StorageTrackerDelegate.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = StorageTrackerDelegate.mm; sourceTree = "<group>"; };
 		440590701268453800CFD48D /* WebArchiveDumpSupportMac.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; name = WebArchiveDumpSupportMac.mm; path = mac/WebArchiveDumpSupportMac.mm; sourceTree = "<group>"; };
 		44A997820FCDE86400580F10 /* WebArchiveDumpSupport.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = WebArchiveDumpSupport.h; path = cf/WebArchiveDumpSupport.h; sourceTree = "<group>"; };
 		44A997830FCDE86400580F10 /* WebArchiveDumpSupport.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = WebArchiveDumpSupport.cpp; path = cf/WebArchiveDumpSupport.cpp; sourceTree = "<group>"; };
@@ -460,6 +466,8 @@
 				BCA18B5E0C9B08C200114369 /* ResourceLoadDelegate.mm */,
 				BCA18B5F0C9B08C200114369 /* UIDelegate.h */,
 				BCA18B600C9B08C200114369 /* UIDelegate.mm */,
+				3A5626C0131C8B17002BE6D9 /* StorageTrackerDelegate.h */,
+				3A5626C1131C8B17002BE6D9 /* StorageTrackerDelegate.mm */,
 			);
 			name = Delegates;
 			sourceTree = "<group>";
@@ -471,6 +479,7 @@
 				C0E720741281C828004EF533 /* EvaluateJSAfterRemovingPluginElement.cpp */,
 				1A3E28A91311D73B00501349 /* GetURLWithJavaScriptURLDestroyingPlugin.cpp */,
 				1AD4CB2012A6D1350027A7AF /* GetUserAgentWithNullNPPFromNPPNew.cpp */,
+				1ACF898B132EF41C00E915D4 /* NPDeallocateCalledBeforeNPShutdown.cpp */,
 				1A24BAA8120734EE00FBB059 /* NPRuntimeObjectFromDestroyedPlugin.cpp */,
 				1AC77DCE120605B6005C19EF /* NPRuntimeRemoveProperty.cpp */,
 				C0EC3C9B12787F0500939164 /* NullNPPGetValuePointer.cpp */,
@@ -620,6 +629,7 @@
 				5185F6B310714E12007AA393 /* HistoryDelegate.h in Headers */,
 				E1B7816711AF31C3007E1BC2 /* MockGeolocationProvider.h in Headers */,
 				29CFBA10122736E600BC30C0 /* AccessibilityTextMarker.h in Headers */,
+				3A5626CC131CA036002BE6D9 /* StorageTrackerDelegate.h in Headers */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
@@ -763,6 +773,7 @@
 				C0E720751281C828004EF533 /* EvaluateJSAfterRemovingPluginElement.cpp in Sources */,
 				1AD4CB2212A6D1350027A7AF /* GetUserAgentWithNullNPPFromNPPNew.cpp in Sources */,
 				1A3E28AA1311D73B00501349 /* GetURLWithJavaScriptURLDestroyingPlugin.cpp in Sources */,
+				1ACF898D132EF41C00E915D4 /* NPDeallocateCalledBeforeNPShutdown.cpp in Sources */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
@@ -809,6 +820,7 @@
 				E1B7816511AF31B7007E1BC2 /* MockGeolocationProvider.mm in Sources */,
 				29CFBA11122736E600BC30C0 /* AccessibilityTextMarker.cpp in Sources */,
 				29CFBA2E12273A1000BC30C0 /* AccessibilityTextMarkerMac.mm in Sources */,
+				3A5626CB131CA02A002BE6D9 /* StorageTrackerDelegate.mm in Sources */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
diff --git a/Tools/DumpRenderTree/ForwardingHeaders/wtf/OwnArrayPtr.h b/Tools/DumpRenderTree/ForwardingHeaders/wtf/OwnArrayPtr.h
new file mode 100644
index 0000000..595817d
--- /dev/null
+++ b/Tools/DumpRenderTree/ForwardingHeaders/wtf/OwnArrayPtr.h
@@ -0,0 +1 @@
+#include <JavaScriptCore/OwnArrayPtr.h>
diff --git a/Tools/DumpRenderTree/ForwardingHeaders/wtf/ThreadSafeRefCounted.h b/Tools/DumpRenderTree/ForwardingHeaders/wtf/ThreadSafeRefCounted.h
new file mode 100644
index 0000000..48a54cc
--- /dev/null
+++ b/Tools/DumpRenderTree/ForwardingHeaders/wtf/ThreadSafeRefCounted.h
@@ -0,0 +1 @@
+#include <JavaScriptCore/ThreadSafeRefCounted.h>
diff --git a/Tools/DumpRenderTree/ForwardingHeaders/wtf/ThreadSafeShared.h b/Tools/DumpRenderTree/ForwardingHeaders/wtf/ThreadSafeShared.h
deleted file mode 100644
index 4a7a77f..0000000
--- a/Tools/DumpRenderTree/ForwardingHeaders/wtf/ThreadSafeShared.h
+++ /dev/null
@@ -1 +0,0 @@
-#include <JavaScriptCore/ThreadSafeShared.h>
diff --git a/Tools/DumpRenderTree/LayoutTestController.cpp b/Tools/DumpRenderTree/LayoutTestController.cpp
index 9f1877c..18b3dcd 100644
--- a/Tools/DumpRenderTree/LayoutTestController.cpp
+++ b/Tools/DumpRenderTree/LayoutTestController.cpp
@@ -39,6 +39,7 @@
 #include <stdio.h>
 #include <wtf/Assertions.h>
 #include <wtf/MathExtras.h>
+#include <wtf/OwnArrayPtr.h>
 #include <wtf/RefPtr.h>
 
 LayoutTestController::LayoutTestController(const std::string& testPathOrURL, const std::string& expectedPixelHash)
@@ -355,15 +356,15 @@ static JSValueRef addURLToRedirectCallback(JSContextRef context, JSObjectRef fun
     ASSERT(!*exception);
 
     size_t maxLength = JSStringGetMaximumUTF8CStringSize(origin.get());
-    char* originBuffer = new char[maxLength + 1];
-    JSStringGetUTF8CString(origin.get(), originBuffer, maxLength + 1);
+    OwnArrayPtr<char> originBuffer = adoptArrayPtr(new char[maxLength + 1]);
+    JSStringGetUTF8CString(origin.get(), originBuffer.get(), maxLength + 1);
 
     maxLength = JSStringGetMaximumUTF8CStringSize(destination.get());
-    char* destinationBuffer = new char[maxLength + 1];
-    JSStringGetUTF8CString(destination.get(), destinationBuffer, maxLength + 1);
+    OwnArrayPtr<char> destinationBuffer = adoptArrayPtr(new char[maxLength + 1]);
+    JSStringGetUTF8CString(destination.get(), destinationBuffer.get(), maxLength + 1);
 
     LayoutTestController* controller = static_cast<LayoutTestController*>(JSObjectGetPrivate(thisObject));
-    controller->addURLToRedirect(originBuffer, destinationBuffer);
+    controller->addURLToRedirect(originBuffer.get(), destinationBuffer.get());
 
     return JSValueMakeUndefined(context);
 }
@@ -385,6 +386,26 @@ static JSValueRef clearAllApplicationCachesCallback(JSContextRef context, JSObje
     return JSValueMakeUndefined(context);
 }
 
+static JSValueRef clearApplicationCacheForOriginCallback(JSContextRef context, JSObjectRef function, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
+{
+    if (argumentCount < 1)
+        return JSValueMakeUndefined(context);
+
+    JSRetainPtr<JSStringRef> originURL(Adopt, JSValueToStringCopy(context, arguments[0], exception));
+    ASSERT(!*exception);
+
+    LayoutTestController* controller = static_cast<LayoutTestController*>(JSObjectGetPrivate(thisObject));
+    controller->clearApplicationCacheForOrigin(originURL.get());
+    
+    return JSValueMakeUndefined(context);
+}
+
+static JSValueRef originsWithApplicationCacheCallback(JSContextRef context, JSObjectRef function, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
+{
+    LayoutTestController* controller = static_cast<LayoutTestController*>(JSObjectGetPrivate(thisObject));
+    return controller->originsWithApplicationCache(context);
+}
+
 static JSValueRef clearAllDatabasesCallback(JSContextRef context, JSObjectRef function, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
 {
     // Has mac & windows implementation
@@ -394,6 +415,60 @@ static JSValueRef clearAllDatabasesCallback(JSContextRef context, JSObjectRef fu
     return JSValueMakeUndefined(context);
 }
 
+static JSValueRef syncLocalStorageCallback(JSContextRef context, JSObjectRef function, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
+{
+    LayoutTestController* controller = static_cast<LayoutTestController*>(JSObjectGetPrivate(thisObject));
+
+    controller->syncLocalStorage();
+
+    return JSValueMakeUndefined(context);
+}
+
+static JSValueRef observeStorageTrackerNotificationsCallback(JSContextRef context, JSObjectRef function, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
+{
+    LayoutTestController* controller = static_cast<LayoutTestController*>(JSObjectGetPrivate(thisObject));
+
+    if (argumentCount < 1)
+        return JSValueMakeUndefined(context);
+
+    unsigned numNotifications = JSValueToNumber(context, arguments[0], exception);
+
+    ASSERT(!*exception);
+
+    controller->observeStorageTrackerNotifications(numNotifications);
+
+    return JSValueMakeUndefined(context);
+}
+
+static JSValueRef deleteAllLocalStorageCallback(JSContextRef context, JSObjectRef function, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
+{
+    LayoutTestController* controller = static_cast<LayoutTestController*>(JSObjectGetPrivate(thisObject));
+    controller->deleteAllLocalStorage();
+
+    return JSValueMakeUndefined(context);
+}
+
+static JSValueRef deleteLocalStorageForOriginCallback(JSContextRef context, JSObjectRef function, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
+{
+    LayoutTestController* controller = static_cast<LayoutTestController*>(JSObjectGetPrivate(thisObject));
+
+    if (argumentCount < 1)
+        return JSValueMakeUndefined(context);
+
+    JSRetainPtr<JSStringRef> url(Adopt, JSValueToStringCopy(context, arguments[0], exception));
+    ASSERT(!*exception);
+
+    controller->deleteLocalStorageForOrigin(url.get());
+
+    return JSValueMakeUndefined(context);
+}
+
+static JSValueRef originsWithLocalStorageCallback(JSContextRef context, JSObjectRef function, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
+{
+    LayoutTestController* controller = static_cast<LayoutTestController*>(JSObjectGetPrivate(thisObject));
+    return controller->originsWithLocalStorage(context);
+}
+
 static JSValueRef clearBackForwardListCallback(JSContextRef context, JSObjectRef function, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
 {
     // Has mac & windows implementation
@@ -769,6 +844,12 @@ static JSValueRef numberOfPagesCallback(JSContextRef context, JSObjectRef functi
     return JSValueMakeNumber(context, controller->numberOfPages(pageWidthInPixels, pageHeightInPixels));
 }
 
+static JSValueRef numberOfPendingGeolocationPermissionRequestsCallback(JSContextRef context, JSObjectRef function, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
+{
+    LayoutTestController* controller = static_cast<LayoutTestController*>(JSObjectGetPrivate(thisObject));
+    return JSValueMakeNumber(context, controller->numberOfPendingGeolocationPermissionRequests());
+}
+
 static JSValueRef pagePropertyCallback(JSContextRef context, JSObjectRef function, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
 {
     char* propertyName = 0;
@@ -1039,6 +1120,17 @@ static JSValueRef setAuthorAndUserStylesEnabledCallback(JSContextRef context, JS
     return JSValueMakeUndefined(context);
 }
 
+static JSValueRef setAutofilledCallback(JSContextRef context, JSObjectRef function, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
+{
+    if (argumentCount != 2 || !arguments[0])
+        return JSValueMakeUndefined(context);
+
+    LayoutTestController* controller = static_cast<LayoutTestController*>(JSObjectGetPrivate(thisObject));
+    controller->setAutofilled(context, arguments[0], JSValueToBoolean(context, arguments[1]));
+
+    return JSValueMakeUndefined(context);
+}
+
 static JSValueRef setCacheModelCallback(JSContextRef context, JSObjectRef function, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
 {
     // Has Mac implementation.
@@ -1472,11 +1564,11 @@ static JSValueRef setWillSendRequestClearHeaderCallback(JSContextRef context, JS
     ASSERT(!*exception);
 
     size_t maxLength = JSStringGetMaximumUTF8CStringSize(header.get());
-    char* headerBuffer = new char[maxLength + 1];
-    JSStringGetUTF8CString(header.get(), headerBuffer, maxLength + 1);
+    OwnArrayPtr<char> headerBuffer = adoptArrayPtr(new char[maxLength + 1]);
+    JSStringGetUTF8CString(header.get(), headerBuffer.get(), maxLength + 1);
 
     LayoutTestController* controller = static_cast<LayoutTestController*>(JSObjectGetPrivate(thisObject));
-    controller->setWillSendRequestClearHeader(headerBuffer);
+    controller->setWillSendRequestClearHeader(headerBuffer.get());
 
     return JSValueMakeUndefined(context);
 }
@@ -1871,6 +1963,19 @@ static JSValueRef hasSpellingMarkerCallback(JSContextRef context, JSObjectRef fu
     return JSValueMakeBoolean(context, ok);
 }
 
+static JSValueRef hasGrammarMarkerCallback(JSContextRef context, JSObjectRef function, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
+{
+    if (argumentCount != 2)
+        return JSValueMakeUndefined(context);
+    
+    int from = JSValueToNumber(context, arguments[0], 0);
+    int length = JSValueToNumber(context, arguments[1], 0);
+    LayoutTestController* controller = static_cast<LayoutTestController*>(JSObjectGetPrivate(thisObject));
+    bool ok = controller->hasGrammarMarker(from, length);
+    
+    return JSValueMakeBoolean(context, ok);
+}
+
 static JSValueRef markerTextForListItemCallback(JSContextRef context, JSObjectRef, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
 {
     LayoutTestController* controller = static_cast<LayoutTestController*>(JSObjectGetPrivate(thisObject));
@@ -2031,6 +2136,7 @@ JSStaticFunction* LayoutTestController::staticFunctions()
         { "callShouldCloseOnWebView", callShouldCloseOnWebViewCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "clearAllApplicationCaches", clearAllApplicationCachesCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "clearAllDatabases", clearAllDatabasesCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
+        { "clearApplicationCacheForOrigin", clearApplicationCacheForOriginCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "clearBackForwardList", clearBackForwardListCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "clearPersistentUserStyleSheet", clearPersistentUserStyleSheetCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "closeWebInspector", closeWebInspectorCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
@@ -2067,13 +2173,16 @@ JSStaticFunction* LayoutTestController::staticFunctions()
         { "execCommand", execCommandCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "findString", findStringCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "counterValueForElementById", counterValueForElementByIdCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
+        { "originsWithApplicationCache", originsWithApplicationCacheCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "grantDesktopNotificationPermission", grantDesktopNotificationPermissionCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete }, 
         { "hasSpellingMarker", hasSpellingMarkerCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
+        { "hasGrammarMarker", hasGrammarMarkerCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "isCommandEnabled", isCommandEnabledCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "isPageBoxVisible", isPageBoxVisibleCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "keepWebHistory", keepWebHistoryCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "layerTreeAsText", layerTreeAsTextCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "numberOfPages", numberOfPagesCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
+        { "numberOfPendingGeolocationPermissionRequests", numberOfPendingGeolocationPermissionRequestsCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "markerTextForListItem", markerTextForListItemCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "notifyDone", notifyDoneCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "numberOfActiveAnimations", numberOfActiveAnimationsCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
@@ -2107,6 +2216,7 @@ JSStaticFunction* LayoutTestController::staticFunctions()
         { "setAuthenticationPassword", setAuthenticationPasswordCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "setAuthenticationUsername", setAuthenticationUsernameCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "setAuthorAndUserStylesEnabled", setAuthorAndUserStylesEnabledCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
+        { "setAutofilled", setAutofilledCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "setCacheModel", setCacheModelCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "setCallCloseOnWebViews", setCallCloseOnWebViewsCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "setCanOpenWindows", setCanOpenWindowsCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
@@ -2144,7 +2254,7 @@ JSStaticFunction* LayoutTestController::staticFunctions()
         { "setUseDashboardCompatibilityMode", setUseDashboardCompatibilityModeCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "setUserStyleSheetEnabled", setUserStyleSheetEnabledCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "setUserStyleSheetLocation", setUserStyleSheetLocationCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
-        { "setValueForUser", setValueForUserCallback, kJSPropertyAttributeDontDelete },
+        { "setValueForUser", setValueForUserCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "setViewModeMediaFeature", setViewModeMediaFeatureCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "setWebViewEditable", setWebViewEditableCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "setWillSendRequestClearHeader", setWillSendRequestClearHeaderCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
@@ -2163,6 +2273,11 @@ JSStaticFunction* LayoutTestController::staticFunctions()
         { "addOriginAccessWhitelistEntry", addOriginAccessWhitelistEntryCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "setScrollbarPolicy", setScrollbarPolicyCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "authenticateSession", authenticateSessionCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
+        { "deleteAllLocalStorage", deleteAllLocalStorageCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
+        { "syncLocalStorage", syncLocalStorageCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },                
+        { "observeStorageTrackerNotifications", observeStorageTrackerNotificationsCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },        
+        { "deleteLocalStorageForOrigin", deleteLocalStorageForOriginCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
+        { "originsWithLocalStorage", originsWithLocalStorageCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "setShouldPaintBrokenImage", setShouldPaintBrokenImageCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { 0, 0, 0 }
     };
diff --git a/Tools/DumpRenderTree/LayoutTestController.h b/Tools/DumpRenderTree/LayoutTestController.h
index 4b1c04e..4a6e59c 100644
--- a/Tools/DumpRenderTree/LayoutTestController.h
+++ b/Tools/DumpRenderTree/LayoutTestController.h
@@ -50,6 +50,7 @@ public:
     const std::string& redirectionDestinationForURL(std::string);
     void clearAllApplicationCaches();
     void clearAllDatabases();
+    void clearApplicationCacheForOrigin(JSStringRef name);
     void clearBackForwardList();
     void clearPersistentUserStyleSheet();
     bool callShouldCloseOnWebView();
@@ -62,12 +63,14 @@ public:
     void displayInvalidatedRegion();
     void execCommand(JSStringRef name, JSStringRef value);
     bool findString(JSContextRef, JSStringRef, JSObjectRef optionsArray);
+    JSValueRef originsWithApplicationCache(JSContextRef);
     bool isCommandEnabled(JSStringRef name);
     void keepWebHistory();
     JSValueRef computedStyleIncludingVisitedInfo(JSContextRef, JSValueRef);
     JSValueRef nodesFromRect(JSContextRef, JSValueRef, int x, int y, unsigned top, unsigned right, unsigned bottom, unsigned left, bool ignoreClipping);
     void notifyDone();
     int numberOfPages(float pageWidthInPixels, float pageHeightInPixels);
+    int numberOfPendingGeolocationPermissionRequests();
     void overridePreference(JSStringRef key, JSStringRef value);
     int pageNumberForElementById(JSStringRef id, float pageWidthInPixels, float pageHeightInPixels);
     JSRetainPtr<JSStringRef> pageProperty(const char* propertyName, int pageNumber) const;
@@ -89,6 +92,7 @@ public:
     void setAppCacheMaximumSize(unsigned long long quota);
     void setApplicationCacheOriginQuota(unsigned long long quota);
     void setAuthorAndUserStylesEnabled(bool);
+    void setAutofilled(JSContextRef, JSValueRef nodeObject, bool autofilled);
     void setCacheModel(int);
     void setCustomPolicyDelegate(bool setDelegate, bool permissive);
     void setDatabaseQuota(unsigned long long quota);
@@ -291,6 +295,7 @@ public:
     void abortModal();
 
     bool hasSpellingMarker(int from, int length);
+    bool hasGrammarMarker(int from, int length);
 
     void dumpConfigurationForViewport(int deviceDPI, int deviceWidth, int deviceHeight, int availableWidth, int availableHeight);
 
@@ -308,6 +313,12 @@ public:
 
     JSRetainPtr<JSStringRef> markerTextForListItem(JSContextRef context, JSValueRef nodeObject) const;
 
+    JSValueRef originsWithLocalStorage(JSContextRef);
+    void deleteAllLocalStorage();
+    void deleteLocalStorageForOrigin(JSStringRef originIdentifier);
+    void observeStorageTrackerNotifications(unsigned number);
+    void syncLocalStorage();
+
     void setShouldPaintBrokenImage(bool);
     bool shouldPaintBrokenImage() const { return m_shouldPaintBrokenImage; }
 
diff --git a/Tools/DumpRenderTree/StorageTrackerDelegate.h b/Tools/DumpRenderTree/StorageTrackerDelegate.h
new file mode 100644
index 0000000..e025a44
--- /dev/null
+++ b/Tools/DumpRenderTree/StorageTrackerDelegate.h
@@ -0,0 +1,37 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+class LayoutTestController;
+
+@interface StorageTrackerDelegate : NSObject {
+    unsigned numberOfNotificationsToLog;
+    LayoutTestController* controllerToNotifyDone;
+}
+
+- (void)logNotifications:(unsigned)number controller:(LayoutTestController*)controller;
+- (void)originModified:(NSNotification *)notification;
+- (void)setControllerToNotifyDone:(LayoutTestController*)controller;
+
+@end
diff --git a/Tools/DumpRenderTree/StorageTrackerDelegate.mm b/Tools/DumpRenderTree/StorageTrackerDelegate.mm
new file mode 100644
index 0000000..343880b
--- /dev/null
+++ b/Tools/DumpRenderTree/StorageTrackerDelegate.mm
@@ -0,0 +1,82 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#import "config.h"
+#import "StorageTrackerDelegate.h"
+
+#import "LayoutTestController.h"
+#import <WebKit/WebSecurityOriginPrivate.h>
+#import <WebKit/WebStorageManagerPrivate.h>
+
+@implementation StorageTrackerDelegate
+
+- (id)init
+{
+    self = [super init];
+    if (!self)
+        return nil;
+
+    [[NSNotificationCenter defaultCenter] addObserver:self selector:@selector(originModified:) name:WebStorageDidModifyOriginNotification object:nil];
+
+    return self;
+}
+
+- (void)logNotifications:(unsigned)number controller:(LayoutTestController*)controller
+{
+    controllerToNotifyDone = controller;
+
+    numberOfNotificationsToLog = number;
+}
+
+- (void)originModified:(NSNotification *)notification
+{
+    if (!numberOfNotificationsToLog)
+        return;
+
+    numberOfNotificationsToLog--;
+    
+    if (numberOfNotificationsToLog == 0 && controllerToNotifyDone) {
+        NSArray *origins = [[WebStorageManager sharedWebStorageManager] origins];
+        for (WebSecurityOrigin *origin in origins)
+            printf("Origin identifier: '%s'\n", [[origin databaseIdentifier] UTF8String]);
+        
+        controllerToNotifyDone->notifyDone();
+    }
+}
+
+- (void)dealloc
+{
+    [[NSNotificationCenter defaultCenter] removeObserver:self name:WebStorageDidModifyOriginNotification object:nil];
+    
+    [super dealloc];
+}
+
+- (void)setControllerToNotifyDone:(LayoutTestController*)controller
+{
+    controllerToNotifyDone = controller;
+}
+
+
+@end
diff --git a/Tools/DumpRenderTree/TestNetscapePlugIn/PluginTest.cpp b/Tools/DumpRenderTree/TestNetscapePlugIn/PluginTest.cpp
index 23120c4..98ef799 100644
--- a/Tools/DumpRenderTree/TestNetscapePlugIn/PluginTest.cpp
+++ b/Tools/DumpRenderTree/TestNetscapePlugIn/PluginTest.cpp
@@ -31,6 +31,8 @@
 using namespace std;
 extern NPNetscapeFuncs *browser;
 
+static void (*shutdownFunction)();
+
 PluginTest* PluginTest::create(NPP npp, const string& identifier)
 {
     if (identifier.empty())
@@ -47,12 +49,26 @@ PluginTest::PluginTest(NPP npp, const string& identifier)
     : m_npp(npp)
     , m_identifier(identifier)
 {
+    // Reset the shutdown function.
+    shutdownFunction = 0;
 }
 
 PluginTest::~PluginTest()
 {
 }
 
+void PluginTest::NP_Shutdown()
+{
+    if (shutdownFunction)
+        shutdownFunction();
+}
+
+void PluginTest::registerNPShutdownFunction(void (*func)())
+{
+    assert(!shutdownFunction);
+    shutdownFunction = func;
+}
+
 NPError PluginTest::NPP_New(NPMIMEType pluginType, uint16_t mode, int16_t argc, char *argn[], char *argv[], NPSavedData *saved)
 {
     return NPERR_NO_ERROR;
diff --git a/Tools/DumpRenderTree/TestNetscapePlugIn/PluginTest.h b/Tools/DumpRenderTree/TestNetscapePlugIn/PluginTest.h
index 7c3a53e..cf94165 100644
--- a/Tools/DumpRenderTree/TestNetscapePlugIn/PluginTest.h
+++ b/Tools/DumpRenderTree/TestNetscapePlugIn/PluginTest.h
@@ -54,6 +54,8 @@ public:
     static PluginTest* create(NPP, const std::string& identifier);
     virtual ~PluginTest();
 
+    static void NP_Shutdown();
+
     // NPP functions.
     virtual NPError NPP_New(NPMIMEType pluginType, uint16_t mode, int16_t argc, char *argn[], char *argv[], NPSavedData *saved);
     virtual NPError NPP_Destroy(NPSavedData**);
@@ -74,6 +76,8 @@ public:
     
     void executeScript(const char*);
 
+    void registerNPShutdownFunction(void (*)());
+
     template<typename TestClassTy> class Register {
     public:
         Register(const std::string& identifier)
diff --git a/Tools/DumpRenderTree/TestNetscapePlugIn/Tests/NPDeallocateCalledBeforeNPShutdown.cpp b/Tools/DumpRenderTree/TestNetscapePlugIn/Tests/NPDeallocateCalledBeforeNPShutdown.cpp
new file mode 100644
index 0000000..c53ec97
--- /dev/null
+++ b/Tools/DumpRenderTree/TestNetscapePlugIn/Tests/NPDeallocateCalledBeforeNPShutdown.cpp
@@ -0,0 +1,102 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "PluginTest.h"
+
+using namespace std;
+
+static bool wasShutdownCalled = false;
+
+class NPDeallocateCalledBeforeNPShutdown : public PluginTest {
+public:
+    NPDeallocateCalledBeforeNPShutdown(NPP npp, const string& identifier)
+        : PluginTest(npp, identifier)
+    {
+    }
+
+private:
+    // This is the test object.
+    class TestObject : public Object<TestObject> { 
+    public:
+        ~TestObject() 
+        {
+            // This should really be an assert, but there's no way for the test framework
+            // to know that the plug-in process crashed, so we'll just sleep for a while
+            // to ensure that the test times out.
+            if (wasShutdownCalled) {
+#if defined(XP_WIN)
+                ::Sleep(100000);
+#else
+                sleep(1000);
+#endif
+            }
+        }
+    };
+
+    // This is the scriptable object. It has a single "testObject" property.
+    class ScriptableObject : public Object<ScriptableObject> { 
+    public:
+        bool hasProperty(NPIdentifier propertyName)
+        {
+            return propertyName == pluginTest()->NPN_GetStringIdentifier("testObject");
+        }
+
+        bool getProperty(NPIdentifier propertyName, NPVariant* result)
+        {
+            if (propertyName != pluginTest()->NPN_GetStringIdentifier("testObject"))
+                return false;
+
+            NPObject* testObject = TestObject::create(pluginTest());
+            OBJECT_TO_NPVARIANT(testObject, *result);
+            return true;
+        }
+    };
+
+    virtual NPError NPP_New(NPMIMEType pluginType, uint16_t mode, int16_t argc, char *argn[], char *argv[], NPSavedData *saved)
+    {
+        registerNPShutdownFunction(shutdown);
+
+        return NPERR_NO_ERROR;
+    }
+
+    virtual NPError NPP_GetValue(NPPVariable variable, void *value)
+    {
+        if (variable != NPPVpluginScriptableNPObject)
+            return NPERR_GENERIC_ERROR;
+        
+        *(NPObject**)value = ScriptableObject::create(this);
+        
+        return NPERR_NO_ERROR;
+    }
+
+    static void shutdown()
+    {
+        wasShutdownCalled = true;
+    }
+
+};
+
+static PluginTest::Register<NPDeallocateCalledBeforeNPShutdown> npRuntimeObjectFromDestroyedPlugin("np-deallocate-called-before-np-shutdown");
+
diff --git a/Tools/DumpRenderTree/TestNetscapePlugIn/mac/Info.plist b/Tools/DumpRenderTree/TestNetscapePlugIn/mac/Info.plist
index 7444b84..ef45e66 100644
--- a/Tools/DumpRenderTree/TestNetscapePlugIn/mac/Info.plist
+++ b/Tools/DumpRenderTree/TestNetscapePlugIn/mac/Info.plist
@@ -1,5 +1,5 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <dict>
 	<key>CFBundleDevelopmentRegion</key>
@@ -44,6 +44,15 @@
 	<string>Simple Netscape plug-in that handles test content for WebKit</string>
 	<key>WebPluginMIMETypes</key>
 	<dict>
+		<key>image/png</key>
+		<dict>
+			<key>WebPluginExtensions</key>
+			<array>
+				<string>png</string>
+			</array>
+			<key>WebPluginTypeDescription</key>
+			<string>PNG image</string>
+		</dict>
 		<key>application/x-webkit-test-netscape</key>
 		<dict>
 			<key>WebPluginExtensions</key>
diff --git a/Tools/DumpRenderTree/TestNetscapePlugIn/main.cpp b/Tools/DumpRenderTree/TestNetscapePlugIn/main.cpp
index b523fcb..a090fef 100644
--- a/Tools/DumpRenderTree/TestNetscapePlugIn/main.cpp
+++ b/Tools/DumpRenderTree/TestNetscapePlugIn/main.cpp
@@ -123,6 +123,7 @@ NPError STDCALL NP_GetEntryPoints(NPPluginFuncs *pluginFuncs)
 extern "C"
 void STDCALL NP_Shutdown(void)
 {
+    PluginTest::NP_Shutdown();
 }
 
 static void executeScript(const PluginObject* obj, const char* script);
@@ -786,7 +787,7 @@ NPError NPP_SetValue(NPP instance, NPNVariable variable, void *value)
 extern "C"
 const char* NP_GetMIMEDescription(void)
 {
-    return "application/x-webkit-test-netscape:testnetscape:test netscape content";
+    return "application/x-webkit-test-netscape:testnetscape:test netscape content;image/png:png:PNG image";
 }
 
 extern "C"
diff --git a/Tools/DumpRenderTree/TestNetscapePlugIn/win/TestNetscapePlugin.rc b/Tools/DumpRenderTree/TestNetscapePlugIn/win/TestNetscapePlugin.rc
index 5a02f9d..c0b38ee 100644
--- a/Tools/DumpRenderTree/TestNetscapePlugIn/win/TestNetscapePlugin.rc
+++ b/Tools/DumpRenderTree/TestNetscapePlugIn/win/TestNetscapePlugin.rc
@@ -71,10 +71,10 @@ BEGIN
         BEGIN

             VALUE "CompanyName", "Apple Inc."

             VALUE "FileDescription", "Simple Netscape plug-in that handles test content for WebKit"

-            VALUE "FileExtents", "testnetscape"

-            VALUE "FileOpenName", "test netscape content"

+            VALUE "FileExtents", "testnetscape|png"

+            VALUE "FileOpenName", "test netscape content|PNG image"

             VALUE "LegalCopyright", "Copyright Apple Inc. 2007-2009"

-            VALUE "MIMEType", "application/x-webkit-test-netscape"

+            VALUE "MIMEType", "application/x-webkit-test-netscape|image/png"

             VALUE "OriginalFilename", "npTestNetscapePlugin.dll"

             VALUE "ProductName", "WebKit Test PlugIn"

         END

diff --git a/Tools/DumpRenderTree/TestNetscapePlugIn/win/TestNetscapePlugin.vcproj b/Tools/DumpRenderTree/TestNetscapePlugIn/win/TestNetscapePlugin.vcproj
index 58a0a1f..5856985 100644
--- a/Tools/DumpRenderTree/TestNetscapePlugIn/win/TestNetscapePlugin.vcproj
+++ b/Tools/DumpRenderTree/TestNetscapePlugIn/win/TestNetscapePlugin.vcproj
@@ -18,7 +18,7 @@
 		<Configuration
 			Name="Debug|Win32"
 			ConfigurationType="2"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;.\TestNetscapePluginCommon.vsprops"
+			InheritedPropertySheets=".\TestNetscapePluginDebug.vsprops"
 			CharacterSet="1"
 			>
 			<Tool
@@ -79,7 +79,7 @@
 		<Configuration
 			Name="Release|Win32"
 			ConfigurationType="2"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;.\TestNetscapePluginCommon.vsprops"
+			InheritedPropertySheets=".\TestNetscapePluginRelease.vsprops"
 			CharacterSet="1"
 			>
 			<Tool
@@ -140,7 +140,7 @@
 		<Configuration
 			Name="Debug_Cairo_CFLite|Win32"
 			ConfigurationType="2"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug_wincairo.vsprops;.\TestNetscapePluginCommon.vsprops"
+			InheritedPropertySheets=".\TestNetscapePluginDebugCairoCFLite.vsprops"
 			CharacterSet="1"
 			>
 			<Tool
@@ -201,7 +201,7 @@
 		<Configuration
 			Name="Debug_All|Win32"
 			ConfigurationType="2"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug_all.vsprops;.\TestNetscapePluginCommon.vsprops"
+			InheritedPropertySheets=".\TestNetscapePluginDebugAll.vsprops"
 			CharacterSet="1"
 			>
 			<Tool
@@ -260,9 +260,9 @@
 			/>
 		</Configuration>
 		<Configuration
-			Name="Release_LTCG|Win32"
+			Name="Production|Win32"
 			ConfigurationType="2"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;.\TestNetscapePluginCommon.vsprops"
+			InheritedPropertySheets=".\TestNetscapePluginProduction.vsprops"
 			CharacterSet="1"
 			WholeProgramOptimization="1"
 			>
@@ -324,7 +324,7 @@
 		<Configuration
 			Name="Release_Cairo_CFLite|Win32"
 			ConfigurationType="2"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\WinCairo.vsprops;.\TestNetscapePluginCommon.vsprops"
+			InheritedPropertySheets=".\TestNetscapePluginReleaseCairoCFLite.vsprops"
 			CharacterSet="1"
 			>
 			<Tool
@@ -406,6 +406,10 @@
 				>
 			</File>
 			<File
+				RelativePath="..\Tests\NPDeallocateCalledBeforeNPShutdown.cpp"
+				>
+			</File>
+			<File
 				RelativePath="..\Tests\NPRuntimeObjectFromDestroyedPlugin.cpp"
 				>
 			</File>
diff --git a/Tools/DumpRenderTree/TestNetscapePlugIn/win/TestNetscapePluginDebug.vsprops b/Tools/DumpRenderTree/TestNetscapePlugIn/win/TestNetscapePluginDebug.vsprops
new file mode 100644
index 0000000..a12fcb5
--- /dev/null
+++ b/Tools/DumpRenderTree/TestNetscapePlugIn/win/TestNetscapePluginDebug.vsprops
@@ -0,0 +1,11 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="TestNetscapePluginDebug"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;
+      .\TestNetscapePluginCommon.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Tools/DumpRenderTree/TestNetscapePlugIn/win/TestNetscapePluginDebugAll.vsprops b/Tools/DumpRenderTree/TestNetscapePlugIn/win/TestNetscapePluginDebugAll.vsprops
new file mode 100644
index 0000000..b29989a
--- /dev/null
+++ b/Tools/DumpRenderTree/TestNetscapePlugIn/win/TestNetscapePluginDebugAll.vsprops
@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="TestNetscapePluginDebugAll"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug_all.vsprops;
+      .\TestNetscapePluginCommon.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Tools/DumpRenderTree/TestNetscapePlugIn/win/TestNetscapePluginDebugCairoCFLite.vsprops b/Tools/DumpRenderTree/TestNetscapePlugIn/win/TestNetscapePluginDebugCairoCFLite.vsprops
new file mode 100644
index 0000000..dd258f0
--- /dev/null
+++ b/Tools/DumpRenderTree/TestNetscapePlugIn/win/TestNetscapePluginDebugCairoCFLite.vsprops
@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="TestNetscapePluginDebugCairoCFLite"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug_wincairo.vsprops;
+      .\TestNetscapePluginCommon.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Tools/DumpRenderTree/TestNetscapePlugIn/win/TestNetscapePluginProduction.vsprops b/Tools/DumpRenderTree/TestNetscapePlugIn/win/TestNetscapePluginProduction.vsprops
new file mode 100644
index 0000000..4a65c62
--- /dev/null
+++ b/Tools/DumpRenderTree/TestNetscapePlugIn/win/TestNetscapePluginProduction.vsprops
@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="TestNetscapePluginProduction"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\production.vsprops;
+      .\TestNetscapePluginCommon.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Tools/DumpRenderTree/TestNetscapePlugIn/win/TestNetscapePluginRelease.vsprops b/Tools/DumpRenderTree/TestNetscapePlugIn/win/TestNetscapePluginRelease.vsprops
new file mode 100644
index 0000000..c410e11
--- /dev/null
+++ b/Tools/DumpRenderTree/TestNetscapePlugIn/win/TestNetscapePluginRelease.vsprops
@@ -0,0 +1,11 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="TestNetscapePluginRelease"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
+      .\TestNetscapePluginCommon.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Tools/DumpRenderTree/TestNetscapePlugIn/win/TestNetscapePluginReleaseCairoCFLite.vsprops b/Tools/DumpRenderTree/TestNetscapePlugIn/win/TestNetscapePluginReleaseCairoCFLite.vsprops
new file mode 100644
index 0000000..eb51008
--- /dev/null
+++ b/Tools/DumpRenderTree/TestNetscapePlugIn/win/TestNetscapePluginReleaseCairoCFLite.vsprops
@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="TestNetscapePluginReleaseCairoCFLite"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\WinCairo.vsprops;
+      .\TestNetscapePluginCommon.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Tools/DumpRenderTree/cf/WebArchiveDumpSupport.cpp b/Tools/DumpRenderTree/cf/WebArchiveDumpSupport.cpp
index 4d77454..81d3e39 100644
--- a/Tools/DumpRenderTree/cf/WebArchiveDumpSupport.cpp
+++ b/Tools/DumpRenderTree/cf/WebArchiveDumpSupport.cpp
@@ -23,11 +23,12 @@
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#import "WebArchiveDumpSupport.h"
+#include "config.h"
+#include "WebArchiveDumpSupport.h"
 
-#import <CoreFoundation/CoreFoundation.h>
-#import <CFNetwork/CFNetwork.h>
-#import <wtf/RetainPtr.h>
+#include <CoreFoundation/CoreFoundation.h>
+#include <CFNetwork/CFNetwork.h>
+#include <wtf/RetainPtr.h>
 
 extern "C" {
 
diff --git a/Tools/DumpRenderTree/cg/ImageDiffCG.cpp b/Tools/DumpRenderTree/cg/ImageDiffCG.cpp
index 593ba64..b4f432f 100644
--- a/Tools/DumpRenderTree/cg/ImageDiffCG.cpp
+++ b/Tools/DumpRenderTree/cg/ImageDiffCG.cpp
@@ -26,6 +26,10 @@
 
 #define min min
 
+// FIXME: We need to be able to include these defines from a config.h somewhere.
+#define JS_EXPORT_PRIVATE
+#define WTF_EXPORT_PRIVATE
+
 #include <stdio.h>
 #include <wtf/Platform.h>
 #include <wtf/RetainPtr.h>
diff --git a/Tools/DumpRenderTree/chromium/DRTDevToolsAgent.cpp b/Tools/DumpRenderTree/chromium/DRTDevToolsAgent.cpp
index 76aa781..61e726a 100644
--- a/Tools/DumpRenderTree/chromium/DRTDevToolsAgent.cpp
+++ b/Tools/DumpRenderTree/chromium/DRTDevToolsAgent.cpp
@@ -72,11 +72,6 @@ void DRTDevToolsAgent::runtimePropertyChanged(const WebString& name, const WebSt
     // FIXME: Implement.
 }
 
-WebCString DRTDevToolsAgent::debuggerScriptSource()
-{
-    return webkit_support::GetDevToolsDebuggerScriptSource();
-}
-
 WebDevToolsAgentClient::WebKitClientMessageLoop* DRTDevToolsAgent::createClientMessageLoop()
 {
     return webkit_support::CreateDevToolsMessageLoop();
diff --git a/Tools/DumpRenderTree/chromium/DRTDevToolsAgent.h b/Tools/DumpRenderTree/chromium/DRTDevToolsAgent.h
index 4cbc8bc..0ecf61b 100644
--- a/Tools/DumpRenderTree/chromium/DRTDevToolsAgent.h
+++ b/Tools/DumpRenderTree/chromium/DRTDevToolsAgent.h
@@ -61,7 +61,6 @@ public:
     virtual void sendMessageToInspectorFrontend(const WebKit::WebString&);
     virtual int hostIdentifier() { return m_routingID; }
     virtual void runtimePropertyChanged(const WebKit::WebString& name, const WebKit::WebString& value);
-    virtual WebKit::WebCString debuggerScriptSource();
     virtual WebKitClientMessageLoop* createClientMessageLoop();
 
     void asyncCall(const WebKit::WebString& args);
diff --git a/Tools/DumpRenderTree/chromium/DumpRenderTree.cpp b/Tools/DumpRenderTree/chromium/DumpRenderTree.cpp
index e008432..95fcd58 100644
--- a/Tools/DumpRenderTree/chromium/DumpRenderTree.cpp
+++ b/Tools/DumpRenderTree/chromium/DumpRenderTree.cpp
@@ -43,7 +43,8 @@ static const char optionDumpAllPixels[] = "--dump-all-pixels";
 static const char optionNotree[] = "--notree";
 static const char optionPixelTests[] = "--pixel-tests";
 static const char optionThreaded[] = "--threaded";
-static const char optionTree[] = "--tree";
+static const char optionDebugRenderTree[] = "--debug-render-tree";
+static const char optionDebugLayerTree[] = "--debug-layer-tree";
 
 static const char optionPixelTestsWithName[] = "--pixel-tests=";
 static const char optionTestShell[] = "--test-shell";
@@ -53,6 +54,7 @@ static const char optionCheckLayoutTestSystemDeps[] = "--check-layout-test-sys-d
 
 static const char optionHardwareAcceleratedGL[] = "--enable-hardware-gpu";
 static const char optionEnableAcceleratedCompositing[] = "--enable-accelerated-compositing";
+static const char optionForceCompositingMode[] = "--force-compositing-mode";
 static const char optionEnableAccelerated2DCanvas[] = "--enable-accelerated-2d-canvas";
 
 static const char optionStressOpt[] = "--stress-opt";
@@ -131,6 +133,7 @@ int main(int argc, char* argv[])
     bool allowExternalPages = false;
     bool startupDialog = false;
     bool acceleratedCompositingEnabled = false;
+    bool forceCompositingMode = false;
     bool accelerated2DCanvasEnabled = false;
     bool stressOpt = false;
     bool stressDeopt = false;
@@ -148,7 +151,11 @@ int main(int argc, char* argv[])
         else if (!argument.find(optionPixelTestsWithName)) {
             params.dumpPixels = true;
             params.pixelFileName = argument.substr(strlen(optionPixelTestsWithName));
-        } else if (argument == optionTestShell) {
+        } else if (argument == optionDebugRenderTree)
+            params.debugRenderTree = true;
+        else if (argument == optionDebugLayerTree)
+            params.debugLayerTree = true;
+        else if (argument == optionTestShell) {
             testShellMode = true;
             serverMode = true;
         } else if (argument == optionAllowExternalPages)
@@ -161,6 +168,8 @@ int main(int argc, char* argv[])
             hardwareAcceleratedGL = true;
         else if (argument == optionEnableAcceleratedCompositing)
             acceleratedCompositingEnabled = true;
+        else if (argument == optionForceCompositingMode)
+            forceCompositingMode = true;
         else if (argument == optionEnableAccelerated2DCanvas)
             accelerated2DCanvasEnabled = true;
         else if (argument == optionStressOpt)
@@ -194,6 +203,7 @@ int main(int argc, char* argv[])
         TestShell shell(testShellMode);
         shell.setAllowExternalPages(allowExternalPages);
         shell.setAcceleratedCompositingEnabled(acceleratedCompositingEnabled);
+        shell.setForceCompositingMode(forceCompositingMode);
         shell.setAccelerated2dCanvasEnabled(accelerated2DCanvasEnabled);
         shell.setJavaScriptFlags(javaScriptFlags);
         shell.setStressOpt(stressOpt);
diff --git a/Tools/DumpRenderTree/chromium/EventSender.cpp b/Tools/DumpRenderTree/chromium/EventSender.cpp
index c5b7aa9..c800c43 100644
--- a/Tools/DumpRenderTree/chromium/EventSender.cpp
+++ b/Tools/DumpRenderTree/chromium/EventSender.cpp
@@ -338,7 +338,7 @@ void EventSender::doDragDrop(const WebDragData& dragData, WebDragOperationsMask
     WebPoint screenPoint(event.globalX, event.globalY);
     currentDragData = dragData;
     currentDragEffectsAllowed = mask;
-    currentDragEffect = webview()->dragTargetDragEnter(dragData, 0, clientPoint, screenPoint, currentDragEffectsAllowed);
+    currentDragEffect = webview()->dragTargetDragEnter(dragData, clientPoint, screenPoint, currentDragEffectsAllowed);
 
     // Finish processing events.
     replaySavedEvents();
@@ -826,7 +826,7 @@ void EventSender::beginDragWithFiles(const CppArgumentList& arguments, CppVarian
     currentDragEffectsAllowed = WebKit::WebDragOperationCopy;
 
     // Provide a drag source.
-    webview()->dragTargetDragEnter(currentDragData, 0, lastMousePos, lastMousePos, currentDragEffectsAllowed);
+    webview()->dragTargetDragEnter(currentDragData, lastMousePos, lastMousePos, currentDragEffectsAllowed);
 
     // dragMode saves events and then replays them later. We don't need/want that.
     dragMode.set(false);
diff --git a/Tools/DumpRenderTree/chromium/LayoutTestController.cpp b/Tools/DumpRenderTree/chromium/LayoutTestController.cpp
index b891d1e..d91cd6e 100644
--- a/Tools/DumpRenderTree/chromium/LayoutTestController.cpp
+++ b/Tools/DumpRenderTree/chromium/LayoutTestController.cpp
@@ -73,6 +73,7 @@ LayoutTestController::LayoutTestController(TestShell* shell)
     : m_shell(shell)
     , m_closeRemainingWindows(false)
     , m_deferMainResourceDataLoad(false)
+    , m_showDebugLayerTree(false)
     , m_workQueue(this)
 {
 
@@ -108,13 +109,14 @@ LayoutTestController::LayoutTestController(TestShell* shell)
     bindMethod("evaluateScriptInIsolatedWorld", &LayoutTestController::evaluateScriptInIsolatedWorld);
     bindMethod("execCommand", &LayoutTestController::execCommand);
     bindMethod("grantDesktopNotificationPermission", &LayoutTestController::grantDesktopNotificationPermission);
+    bindMethod("hasSpellingMarker", &LayoutTestController::hasSpellingMarker);
     bindMethod("isCommandEnabled", &LayoutTestController::isCommandEnabled);
     bindMethod("layerTreeAsText", &LayoutTestController::layerTreeAsText);
     bindMethod("markerTextForListItem", &LayoutTestController::markerTextForListItem);
-    bindMethod("hasSpellingMarker", &LayoutTestController::hasSpellingMarker);
     bindMethod("notifyDone", &LayoutTestController::notifyDone);
     bindMethod("numberOfActiveAnimations", &LayoutTestController::numberOfActiveAnimations);
     bindMethod("numberOfPages", &LayoutTestController::numberOfPages);
+    bindMethod("numberOfPendingGeolocationPermissionRequests", &LayoutTestController:: numberOfPendingGeolocationPermissionRequests);
     bindMethod("objCIdentityIsEqual", &LayoutTestController::objCIdentityIsEqual);
     bindMethod("overridePreference", &LayoutTestController::overridePreference);
     bindMethod("pageNumberForElementById", &LayoutTestController::pageNumberForElementById);
@@ -137,6 +139,7 @@ LayoutTestController::LayoutTestController(TestShell* shell)
     bindMethod("setAllowUniversalAccessFromFileURLs", &LayoutTestController::setAllowUniversalAccessFromFileURLs);
     bindMethod("setAlwaysAcceptCookies", &LayoutTestController::setAlwaysAcceptCookies);
     bindMethod("setAuthorAndUserStylesEnabled", &LayoutTestController::setAuthorAndUserStylesEnabled);
+    bindMethod("setAutofilled", &LayoutTestController::setAutofilled);
     bindMethod("setCanOpenWindows", &LayoutTestController::setCanOpenWindows);
     bindMethod("setCloseRemainingWindowsWhenComplete", &LayoutTestController::setCloseRemainingWindowsWhenComplete);
     bindMethod("setCustomPolicyDelegate", &LayoutTestController::setCustomPolicyDelegate);
@@ -152,6 +155,7 @@ LayoutTestController::LayoutTestController(TestShell* shell)
     bindMethod("setMockGeolocationError", &LayoutTestController::setMockGeolocationError);
     bindMethod("setMockGeolocationPosition", &LayoutTestController::setMockGeolocationPosition);
     bindMethod("addMockSpeechInputResult", &LayoutTestController::addMockSpeechInputResult);
+    bindMethod("setPluginsEnabled", &LayoutTestController::setPluginsEnabled);
     bindMethod("setPopupBlockingEnabled", &LayoutTestController::setPopupBlockingEnabled);
     bindMethod("setPOSIXLocale", &LayoutTestController::setPOSIXLocale);
     bindMethod("setScrollbarPolicy", &LayoutTestController::setScrollbarPolicy);
@@ -162,12 +166,14 @@ LayoutTestController::LayoutTestController(TestShell* shell)
     bindMethod("setTimelineProfilingEnabled", &LayoutTestController::setTimelineProfilingEnabled);
     bindMethod("setUserStyleSheetEnabled", &LayoutTestController::setUserStyleSheetEnabled);
     bindMethod("setUserStyleSheetLocation", &LayoutTestController::setUserStyleSheetLocation);
+    bindMethod("setValueForUser", &LayoutTestController::setValueForUser);
     bindMethod("setWillSendRequestClearHeader", &LayoutTestController::setWillSendRequestClearHeader);
     bindMethod("setWillSendRequestReturnsNull", &LayoutTestController::setWillSendRequestReturnsNull);
     bindMethod("setWillSendRequestReturnsNullOnRedirect", &LayoutTestController::setWillSendRequestReturnsNullOnRedirect);
     bindMethod("setWindowIsKey", &LayoutTestController::setWindowIsKey);
     bindMethod("setXSSAuditorEnabled", &LayoutTestController::setXSSAuditorEnabled);
     bindMethod("setAsynchronousSpellCheckingEnabled", &LayoutTestController::setAsynchronousSpellCheckingEnabled);
+    bindMethod("shadowRoot", &LayoutTestController::shadowRoot);
     bindMethod("showWebInspector", &LayoutTestController::showWebInspector);
     bindMethod("simulateDesktopNotificationClick", &LayoutTestController::simulateDesktopNotificationClick);
     bindMethod("suspendAnimations", &LayoutTestController::suspendAnimations);
@@ -182,6 +188,7 @@ LayoutTestController::LayoutTestController(TestShell* shell)
     bindMethod("addDisallowedURL", &LayoutTestController::addDisallowedURL);
     bindMethod("callShouldCloseOnWebView", &LayoutTestController::callShouldCloseOnWebView);
     bindMethod("clearAllApplicationCaches", &LayoutTestController::clearAllApplicationCaches);
+    bindMethod("clearApplicationCacheForOrigin", &LayoutTestController::clearApplicationCacheForOrigin);
     bindMethod("clearBackForwardList", &LayoutTestController::clearBackForwardList);
     bindMethod("dumpAsWebArchive", &LayoutTestController::dumpAsWebArchive);
     bindMethod("keepWebHistory", &LayoutTestController::keepWebHistory);
@@ -192,7 +199,12 @@ LayoutTestController::LayoutTestController(TestShell* shell)
     bindMethod("setPrivateBrowsingEnabled", &LayoutTestController::setPrivateBrowsingEnabled);
     bindMethod("setUseDashboardCompatibilityMode", &LayoutTestController::setUseDashboardCompatibilityMode);
     bindMethod("storeWebScriptObject", &LayoutTestController::storeWebScriptObject);
-
+    bindMethod("deleteAllLocalStorage", &LayoutTestController::deleteAllLocalStorage);
+    bindMethod("originsWithLocalStorage", &LayoutTestController::originsWithLocalStorage);
+    bindMethod("deleteLocalStorageForOrigin", &LayoutTestController::deleteLocalStorageForOrigin);
+    bindMethod("observeStorageTrackerNotifications", &LayoutTestController::observeStorageTrackerNotifications);
+    bindMethod("syncLocalStorage", &LayoutTestController::syncLocalStorage);
+    
     // The fallback method is called when an unknown method is invoked.
     bindFallbackMethod(&LayoutTestController::fallbackMethod);
 
@@ -636,6 +648,28 @@ void LayoutTestController::setAsynchronousSpellCheckingEnabled(const CppArgument
     result->setNull();
 }
 
+void LayoutTestController::shadowRoot(const CppArgumentList& arguments, CppVariant* result)
+{
+    if (arguments.size() != 1 || !arguments[0].isObject()) {
+        result->setNull();
+        return;
+    }
+
+    WebElement element;
+    if (!WebBindings::getElement(arguments[0].value.objectValue, &element)) {
+        result->setNull();
+        return;
+    }
+
+    WebNode shadowRoot = element.shadowRoot();
+    if (shadowRoot.isNull()) {
+        result->setNull();
+        return;
+    }
+
+    result->set(WebBindings::makeNode(shadowRoot));
+}
+
 void LayoutTestController::showWebInspector(const CppArgumentList&, CppVariant* result)
 {
     m_shell->showDevTools();
@@ -731,13 +765,25 @@ void LayoutTestController::setUseDashboardCompatibilityMode(const CppArgumentLis
 
 void LayoutTestController::clearAllApplicationCaches(const CppArgumentList&, CppVariant* result)
 {
-    // FIXME: implement to support Application Cache Quotas.
+    // FIXME: Implement to support application cache quotas.
+    result->setNull();
+}
+
+void LayoutTestController::clearApplicationCacheForOrigin(const CppArgumentList&, CppVariant* result)
+{
+    // FIXME: Implement to support deleting all application cache for an origin.
     result->setNull();
 }
 
 void LayoutTestController::setApplicationCacheOriginQuota(const CppArgumentList&, CppVariant* result)
 {
-    // FIXME: implement to support Application Cache Quotas.
+    // FIXME: Implement to support application cache quotas.
+    result->setNull();
+}
+
+void LayoutTestController::originsWithApplicationCache(const CppArgumentList&, CppVariant* result)
+{
+    // FIXME: Implement to support getting origins that have application caches.
     result->setNull();
 }
 
@@ -1452,6 +1498,16 @@ void LayoutTestController::numberOfPages(const CppArgumentList& arguments, CppVa
     result->set(numberOfPages);
 }
 
+void LayoutTestController::numberOfPendingGeolocationPermissionRequests(const CppArgumentList& arguments, CppVariant* result)
+{
+    result->setNull();
+    Vector<WebViewHost*> windowList = m_shell->windowList();
+    int numberOfRequests = 0;
+    for (size_t i = 0; i < windowList.size(); i++)
+        numberOfRequests += windowList[i]->geolocationClientMock()->numberOfPendingPermissionRequests();
+    result->set(numberOfRequests);
+}
+
 void LayoutTestController::logErrorToConsole(const std::string& text)
 {
     m_shell->webViewHost()->didAddMessageToConsole(
@@ -1576,7 +1632,7 @@ void LayoutTestController::addMockSpeechInputResult(const CppArgumentList& argum
 
 void LayoutTestController::layerTreeAsText(const CppArgumentList& args, CppVariant* result)
 {
-    result->set(m_shell->webView()->mainFrame()->layerTreeAsText().utf8());
+    result->set(m_shell->webView()->mainFrame()->layerTreeAsText(m_showDebugLayerTree).utf8());
 }
 
 void LayoutTestController::markerTextForListItem(const CppArgumentList& args, CppVariant* result)
@@ -1602,3 +1658,71 @@ void LayoutTestController::setMinimumTimerInterval(const CppArgumentList& argume
         return;
     m_shell->webView()->settings()->setMinimumTimerInterval(arguments[0].toDouble());
 }
+
+void LayoutTestController::setAutofilled(const CppArgumentList& arguments, CppVariant* result)
+{
+    result->setNull();
+    if (arguments.size() != 2 || !arguments[1].isBool())
+        return;
+
+    WebElement element;
+    if (!WebBindings::getElement(arguments[0].value.objectValue, &element))
+        return;
+
+    WebInputElement* input = toWebInputElement(&element);
+    if (!input)
+        return;
+
+    input->setAutofilled(arguments[1].value.boolValue);
+}
+
+void LayoutTestController::setValueForUser(const CppArgumentList& arguments, CppVariant* result)
+{
+    result->setNull();
+    if (arguments.size() != 2)
+        return;
+
+    WebElement element;
+    if (!WebBindings::getElement(arguments[0].value.objectValue, &element))
+        return;
+
+    WebInputElement* input = toWebInputElement(&element);
+    if (!input)
+        return;
+
+    input->setValue(cppVariantToWebString(arguments[1]), true);
+}
+
+void LayoutTestController::deleteAllLocalStorage(const CppArgumentList& arguments, CppVariant*)
+{
+    // Not Implemented
+}
+
+void LayoutTestController::originsWithLocalStorage(const CppArgumentList& arguments, CppVariant*)
+{
+    // Not Implemented
+}
+
+void LayoutTestController::deleteLocalStorageForOrigin(const CppArgumentList& arguments, CppVariant*)
+{
+    // Not Implemented
+}
+
+void LayoutTestController::observeStorageTrackerNotifications(const CppArgumentList&, CppVariant*)
+{
+    // Not Implemented
+}
+
+void LayoutTestController::syncLocalStorage(const CppArgumentList&, CppVariant*)
+{
+    // Not Implemented
+}
+
+void LayoutTestController::setPluginsEnabled(const CppArgumentList& arguments, CppVariant* result)
+{
+    if (arguments.size() > 0 && arguments[0].isBool()) {
+        m_shell->preferences()->pluginsEnabled = arguments[0].toBoolean();
+        m_shell->applyPreferences();
+    }
+    result->setNull();
+}
diff --git a/Tools/DumpRenderTree/chromium/LayoutTestController.h b/Tools/DumpRenderTree/chromium/LayoutTestController.h
index 6150133..a9c6ce4 100644
--- a/Tools/DumpRenderTree/chromium/LayoutTestController.h
+++ b/Tools/DumpRenderTree/chromium/LayoutTestController.h
@@ -270,6 +270,7 @@ public:
     void setAllowUniversalAccessFromFileURLs(const CppArgumentList&, CppVariant*);
     void setAllowFileAccessFromFileURLs(const CppArgumentList&, CppVariant*);
 
+    void shadowRoot(const CppArgumentList&, CppVariant*);
 
     // The fallback method is called when a nonexistent method is called on
     // the layout test controller object.
@@ -282,9 +283,13 @@ public:
     void addOriginAccessWhitelistEntry(const CppArgumentList&, CppVariant*);
     void removeOriginAccessWhitelistEntry(const CppArgumentList&, CppVariant*);
 
-    // Clears all Application Caches.
+    // Clears all application caches.
     void clearAllApplicationCaches(const CppArgumentList&, CppVariant*);
-    // Sets the Application Quota for the localhost origin.
+    // Clears an application cache for an origin.
+    void clearApplicationCacheForOrigin(const CppArgumentList&, CppVariant*);
+    // Returns origins that have application caches.
+    void originsWithApplicationCache(const CppArgumentList&, CppVariant*);
+    // Sets the application cache quota for the localhost origin.
     void setApplicationCacheOriginQuota(const CppArgumentList&, CppVariant*);
 
     // Clears all databases.
@@ -305,6 +310,8 @@ public:
     // Gets the number of pages to be printed.
     void numberOfPages(const CppArgumentList&, CppVariant*);
 
+    // Gets the number of geolocation permissions requests pending.
+    void numberOfPendingGeolocationPermissionRequests(const CppArgumentList&, CppVariant*);
 
     // Allows layout tests to start Timeline profiling.
     void setTimelineProfilingEnabled(const CppArgumentList&, CppVariant*);
@@ -337,6 +344,24 @@ public:
 
     void setMinimumTimerInterval(const CppArgumentList&, CppVariant*);
 
+    // Expects the first argument to be an input element and the second argument to be a boolean.
+    // Forwards the setAutofilled() call to the element.
+    void setAutofilled(const CppArgumentList&, CppVariant*);
+
+    // Expects the first argument to be an input element and the second argument to be a string value.
+    // Forwards the setValueForUser() call to the element.
+    void setValueForUser(const CppArgumentList&, CppVariant*);
+
+    // LocalStorage origin-related
+    void deleteAllLocalStorage(const CppArgumentList&, CppVariant*);
+    void originsWithLocalStorage(const CppArgumentList&, CppVariant*);
+    void deleteLocalStorageForOrigin(const CppArgumentList&, CppVariant*);
+    void observeStorageTrackerNotifications(const CppArgumentList&, CppVariant*);
+    void syncLocalStorage(const CppArgumentList&, CppVariant*);
+
+    // Enable or disable plugins.
+    void setPluginsEnabled(const CppArgumentList&, CppVariant*);
+
 public:
     // The following methods are not exposed to JavaScript.
     void setWorkQueueFrozen(bool frozen) { m_workQueue.setFrozen(frozen); }
@@ -365,6 +390,7 @@ public:
     bool shouldAddFileToPasteboard() { return m_shouldAddFileToPasteboard; }
     bool stopProvisionalFrameLoads() { return m_stopProvisionalFrameLoads; }
     bool deferMainResourceDataLoad() { return m_deferMainResourceDataLoad; }
+    void setShowDebugLayerTree(bool value) { m_showDebugLayerTree = value; }
 
     bool testRepaint() const { return m_testRepaint; }
     bool sweepHorizontally() const { return m_sweepHorizontally; }
@@ -538,6 +564,9 @@ private:
     // If false, all new requests will not defer the main resource data load.
     bool m_deferMainResourceDataLoad;
 
+    // If true, we will show extended information in the graphics layer tree.
+    bool m_showDebugLayerTree;
+
     WorkQueue m_workQueue;
 
     CppVariant m_globalFlag;
diff --git a/Tools/DumpRenderTree/chromium/TestShell.cpp b/Tools/DumpRenderTree/chromium/TestShell.cpp
index 2574abc..4790509 100644
--- a/Tools/DumpRenderTree/chromium/TestShell.cpp
+++ b/Tools/DumpRenderTree/chromium/TestShell.cpp
@@ -85,11 +85,13 @@ TestShell::TestShell(bool testShellMode)
     , m_devTools(0)
     , m_allowExternalPages(false)
     , m_acceleratedCompositingEnabled(false)
+    , m_forceCompositingMode(false)
     , m_accelerated2dCanvasEnabled(false)
     , m_stressOpt(false)
     , m_stressDeopt(false)
     , m_dumpWhenFinished(true)
 {
+    WebRuntimeFeatures::enableDataTransferItems(true);
     WebRuntimeFeatures::enableGeolocation(true);
     WebRuntimeFeatures::enableIndexedDatabase(true);
     WebRuntimeFeatures::enableFileSystem(true);
@@ -162,6 +164,7 @@ void TestShell::resetWebSettings(WebView& webView)
 {
     m_prefs.reset();
     m_prefs.acceleratedCompositingEnabled = m_acceleratedCompositingEnabled;
+    m_prefs.forceCompositingMode = m_forceCompositingMode;
     m_prefs.accelerated2dCanvasEnabled = m_accelerated2dCanvasEnabled;
     m_prefs.applyTo(&webView);
 }
@@ -187,6 +190,9 @@ void TestShell::runFileTest(const TestParams& params)
         || testUrl.find("\\inspector\\") != string::npos)
         showDevTools();
 
+    if (m_params.debugLayerTree)
+        m_layoutTestController->setShowDebugLayerTree(true);
+
     if (m_dumpWhenFinished)
         m_printer->handleTestHeader(testUrl.c_str());
     loadURL(m_params.testUrl);
@@ -453,7 +459,7 @@ void TestShell::dump()
             if (fwrite(dataUtf8.c_str(), 1, dataUtf8.size(), stdout) != dataUtf8.size())
                 FATAL("Short write to stdout, disk full?\n");
         } else {
-            printf("%s", frame->renderTreeAsText().utf8().data());
+            printf("%s", frame->renderTreeAsText(m_params.debugRenderTree).utf8().data());
             bool recursive = m_layoutTestController->shouldDumpChildFrameScrollPositions();
             dumpFrameScrollPosition(frame, recursive);
         }
@@ -544,14 +550,12 @@ void TestShell::dumpImage(skia::PlatformCanvas* canvas) const
         md5hash.append(hex);
     }
 
-    // Only encode and dump the png if the hashes don't match. Encoding the image
-    // is really expensive.
+    // Only encode and dump the png if the hashes don't match. Encoding the
+    // image is really expensive.
     if (md5hash.compare(m_params.pixelHash)) {
         std::vector<unsigned char> png;
-        webkit_support::EncodeBGRAPNG(
-            reinterpret_cast<const unsigned char*>(sourceBitmap.getPixels()),
-            sourceBitmap.width(), sourceBitmap.height(),
-            static_cast<int>(sourceBitmap.rowBytes()), discardTransparency, &png);
+        webkit_support::EncodeBGRAPNGWithChecksum(reinterpret_cast<const unsigned char*>(sourceBitmap.getPixels()), sourceBitmap.width(),
+            sourceBitmap.height(), static_cast<int>(sourceBitmap.rowBytes()), discardTransparency, md5hash, &png);
 
         m_printer->handleImage(md5hash.c_str(), m_params.pixelHash.c_str(), &png[0], png.size(), m_params.pixelFileName.c_str());
     } else
@@ -575,7 +579,8 @@ WebViewHost* TestShell::createNewWindow(const WebKit::WebURL& url)
 WebViewHost* TestShell::createNewWindow(const WebKit::WebURL& url, DRTDevToolsAgent* devToolsAgent)
 {
     WebViewHost* host = new WebViewHost(this);
-    WebView* view = WebView::create(host, devToolsAgent, 0);
+    WebView* view = WebView::create(host);
+    view->setDevToolsAgentClient(devToolsAgent);
     host->setWebWidget(view);
     m_prefs.applyTo(view);
     view->initializeMainFrame(host);
diff --git a/Tools/DumpRenderTree/chromium/TestShell.h b/Tools/DumpRenderTree/chromium/TestShell.h
index ef9be7f..d84d642 100644
--- a/Tools/DumpRenderTree/chromium/TestShell.h
+++ b/Tools/DumpRenderTree/chromium/TestShell.h
@@ -65,6 +65,8 @@ class DRTDevToolsClient;
 struct TestParams {
     bool dumpTree;
     bool dumpPixels;
+    bool debugRenderTree;
+    bool debugLayerTree;
     bool printSeparators;
     WebKit::WebURL testUrl;
     // Resultant image file name. Required only if the test_shell mode.
@@ -74,6 +76,8 @@ struct TestParams {
     TestParams()
         : dumpTree(true)
         , dumpPixels(false)
+        , debugRenderTree(false)
+        , debugLayerTree(false)
         , printSeparators(false) {}
 };
 
@@ -125,6 +129,7 @@ public:
     void setAllowExternalPages(bool allowExternalPages) { m_allowExternalPages = allowExternalPages; }
 
     void setAcceleratedCompositingEnabled(bool enabled) { m_acceleratedCompositingEnabled = enabled; }
+    void setForceCompositingMode(bool enabled) { m_forceCompositingMode = enabled; }
     void setAccelerated2dCanvasEnabled(bool enabled) { m_accelerated2dCanvasEnabled = enabled; }
 
 #if defined(OS_WIN)
@@ -200,6 +205,7 @@ private:
     int m_timeout; // timeout value in millisecond
     bool m_allowExternalPages;
     bool m_acceleratedCompositingEnabled;
+    bool m_forceCompositingMode;
     bool m_accelerated2dCanvasEnabled;
     WebPreferences m_prefs;
     bool m_stressOpt;
diff --git a/Tools/DumpRenderTree/chromium/TestShellWin.cpp b/Tools/DumpRenderTree/chromium/TestShellWin.cpp
index 3b3ddd9..f82771f 100644
--- a/Tools/DumpRenderTree/chromium/TestShellWin.cpp
+++ b/Tools/DumpRenderTree/chromium/TestShellWin.cpp
@@ -166,39 +166,11 @@ void openStartupDialog()
 
 bool checkLayoutTestSystemDependencies()
 {
-    std::list<std::string> errors;
-
-    OSVERSIONINFOEX versionInfo;
-    ::ZeroMemory(&versionInfo, sizeof(OSVERSIONINFOEX));
-    versionInfo.dwOSVersionInfoSize = sizeof(OSVERSIONINFOEX);
-    ::GetVersionEx(reinterpret_cast<OSVERSIONINFO*>(&versionInfo));
-
-    // Default to XP metrics, override if on Vista or win 7.
-    int requiredVScrollSize = 17;
-    int requiredFontSize = -11; // 8 pt
-    const wchar_t* requiredFont = L"Tahoma";
-    bool isVista = false;
-    bool isWin7 = false;
-    const DWORD major = versionInfo.dwMajorVersion;
-    const DWORD minor = versionInfo.dwMinorVersion;
-    const WORD type = versionInfo.wProductType;
-    if (major == 6 && minor == 1 && type == VER_NT_WORKSTATION) {
-        requiredFont = L"Segoe UI";
-        requiredFontSize = -12;
-        isWin7 = true;
-    } else if (major == 6 && !minor && type == VER_NT_WORKSTATION) {
-        requiredFont = L"Segoe UI";
-        requiredFontSize = -12; // 9 pt
-        isVista = true;
-    } else if (!(major == 5 && minor == 1 && type == VER_NT_WORKSTATION)) {
-        // The above check is for XP, so that means ...
-        errors.push_back("Unsupported Operating System version "
-                         "(must use XP, Vista, or Windows 7).");
-    }
-
     // This metric will be 17 when font size is "Normal".
     // The size of drop-down menus depends on it.
     int verticalScrollSize = ::GetSystemMetrics(SM_CXVSCROLL);
+    int requiredVScrollSize = 17;
+    std::list<std::string> errors;
     if (verticalScrollSize != requiredVScrollSize)
         errors.push_back("Must use normal size fonts (96 dpi).");
 
@@ -210,21 +182,22 @@ bool checkLayoutTestSystemDependencies()
     if (fontSmoothingEnabled && (fontSmoothingType == FE_FONTSMOOTHINGCLEARTYPE))
         errors.push_back("ClearType must be disabled.");
 
-    // Check that we're using the default system fonts
-    NONCLIENTMETRICS metrics;
-    // Checks Vista or later.
-    metrics.cbSize = major >= 6 ? sizeof(NONCLIENTMETRICS) : NONCLIENTMETRICS_SIZE_PRE_VISTA;
+    // Check that we're using the default system fonts.
+    OSVERSIONINFO versionInfo = {0};
+    versionInfo.dwOSVersionInfoSize = sizeof(versionInfo);
+    ::GetVersionEx(&versionInfo);
+    const bool isVistaOrLater = (versionInfo.dwMajorVersion >= 6);
+    NONCLIENTMETRICS metrics = {0};
+    metrics.cbSize = isVistaOrLater ? (sizeof NONCLIENTMETRICS) : NONCLIENTMETRICS_SIZE_PRE_VISTA;
     const bool success = !!::SystemParametersInfo(SPI_GETNONCLIENTMETRICS, metrics.cbSize, &metrics, 0);
     ASSERT(success);
     LOGFONTW* systemFonts[] =
         {&metrics.lfStatusFont, &metrics.lfMenuFont, &metrics.lfSmCaptionFont};
-
+    const wchar_t* const requiredFont = isVistaOrLater ? L"Segoe UI" : L"Tahoma";
+    const int requiredFontSize = isVistaOrLater ? -12 : -11;
     for (size_t i = 0; i < arraysize(systemFonts); ++i) {
         if (systemFonts[i]->lfHeight != requiredFontSize || wcscmp(requiredFont, systemFonts[i]->lfFaceName)) {
-            if (isVista || isWin7)
-                errors.push_back("Must use either the Aero or Basic theme.");
-            else
-                errors.push_back("Must use the default XP theme (Luna).");
+            errors.push_back(isVistaOrLater ? "Must use either the Aero or Basic theme." : "Must use the default XP theme (Luna).");
             break;
         }
     }
diff --git a/Tools/DumpRenderTree/chromium/WebPreferences.cpp b/Tools/DumpRenderTree/chromium/WebPreferences.cpp
index 71f5ec7..84f84b6 100644
--- a/Tools/DumpRenderTree/chromium/WebPreferences.cpp
+++ b/Tools/DumpRenderTree/chromium/WebPreferences.cpp
@@ -104,6 +104,7 @@ void WebPreferences::reset()
     hyperlinkAuditingEnabled = false;
     acceleratedCompositingEnabled = false;
     accelerated2dCanvasEnabled = false;
+    forceCompositingMode = false;
 }
 
 void WebPreferences::applyTo(WebView* webView)
@@ -149,6 +150,7 @@ void WebPreferences::applyTo(WebView* webView)
     webView->setTabsToLinks(tabsToLinks);
     settings->setCaretBrowsingEnabled(caretBrowsingEnabled);
     settings->setAcceleratedCompositingEnabled(acceleratedCompositingEnabled);
+    settings->setForceCompositingMode(forceCompositingMode);
     settings->setAccelerated2dCanvasEnabled(accelerated2dCanvasEnabled);
 
     // Fixed values.
diff --git a/Tools/DumpRenderTree/chromium/WebPreferences.h b/Tools/DumpRenderTree/chromium/WebPreferences.h
index 50bb8cc..ad27fb8 100644
--- a/Tools/DumpRenderTree/chromium/WebPreferences.h
+++ b/Tools/DumpRenderTree/chromium/WebPreferences.h
@@ -78,6 +78,7 @@ struct WebPreferences {
     bool hyperlinkAuditingEnabled;
     bool caretBrowsingEnabled;
     bool acceleratedCompositingEnabled;
+    bool forceCompositingMode;
     bool accelerated2dCanvasEnabled;
 
     WebPreferences() { reset(); }
diff --git a/Tools/DumpRenderTree/chromium/WebViewHost.cpp b/Tools/DumpRenderTree/chromium/WebViewHost.cpp
index a0ed6da..97c00e2 100644
--- a/Tools/DumpRenderTree/chromium/WebViewHost.cpp
+++ b/Tools/DumpRenderTree/chromium/WebViewHost.cpp
@@ -1156,6 +1156,12 @@ WebViewHost::~WebViewHost()
         webkit_support::QuitMessageLoop();
 }
 
+void WebViewHost::setWebWidget(WebKit::WebWidget* widget)
+{
+    m_webWidget = widget;
+    webView()->setSpellCheckClient(this);
+}
+
 WebView* WebViewHost::webView() const
 {
     ASSERT(m_webWidget);
diff --git a/Tools/DumpRenderTree/chromium/WebViewHost.h b/Tools/DumpRenderTree/chromium/WebViewHost.h
index 4fc3400..014be2e 100644
--- a/Tools/DumpRenderTree/chromium/WebViewHost.h
+++ b/Tools/DumpRenderTree/chromium/WebViewHost.h
@@ -37,6 +37,7 @@
 #include "WebAccessibilityNotification.h"
 #include "WebCursorInfo.h"
 #include "WebFrameClient.h"
+#include "WebSpellCheckClient.h"
 #include "WebViewClient.h"
 #include <wtf/HashMap.h>
 #include <wtf/HashSet.h>
@@ -64,11 +65,11 @@ namespace skia {
 class PlatformCanvas;
 }
 
-class WebViewHost : public WebKit::WebViewClient, public WebKit::WebFrameClient, public NavigationHost {
+class WebViewHost : public WebKit::WebSpellCheckClient, public WebKit::WebViewClient, public WebKit::WebFrameClient, public NavigationHost {
  public:
     WebViewHost(TestShell* shell);
     ~WebViewHost();
-    void setWebWidget(WebKit::WebWidget* widget) { m_webWidget = widget; }
+    void setWebWidget(WebKit::WebWidget*);
     WebKit::WebView* webView() const;
     WebKit::WebWidget* webWidget() const;
     void reset();
@@ -104,6 +105,11 @@ class WebViewHost : public WebKit::WebViewClient, public WebKit::WebFrameClient,
     // NavigationHost
     virtual bool navigate(const TestNavigationEntry&, bool reload);
 
+    // WebKit::WebSpellCheckClient
+    virtual void spellCheck(const WebKit::WebString&, int& offset, int& length);
+    virtual void requestCheckingOfText(const WebKit::WebString&, WebKit::WebTextCheckingCompletion*);
+    virtual WebKit::WebString autoCorrectWord(const WebKit::WebString&);
+
     // WebKit::WebViewClient
     virtual WebKit::WebView* createView(WebKit::WebFrame*, const WebKit::WebURLRequest&, const WebKit::WebWindowFeatures&, const WebKit::WebString&);
     virtual WebKit::WebWidget* createPopupMenu(WebKit::WebPopupType);
@@ -126,9 +132,6 @@ class WebViewHost : public WebKit::WebViewClient, public WebKit::WebFrameClient,
     virtual void didChangeContents();
     virtual void didEndEditing();
     virtual bool handleCurrentKeyboardEvent();
-    virtual void spellCheck(const WebKit::WebString&, int& offset, int& length);
-    virtual void requestCheckingOfText(const WebKit::WebString&, WebKit::WebTextCheckingCompletion*);
-    virtual WebKit::WebString autoCorrectWord(const WebKit::WebString&);
     virtual void runModalAlertDialog(WebKit::WebFrame*, const WebKit::WebString&);
     virtual bool runModalConfirmDialog(WebKit::WebFrame*, const WebKit::WebString&);
     virtual bool runModalPromptDialog(WebKit::WebFrame*, const WebKit::WebString& message, const WebKit::WebString& defaultValue, WebKit::WebString* actualValue);
diff --git a/Tools/DumpRenderTree/chromium/config.h b/Tools/DumpRenderTree/chromium/config.h
index 7dfda18..ed3aad9 100644
--- a/Tools/DumpRenderTree/chromium/config.h
+++ b/Tools/DumpRenderTree/chromium/config.h
@@ -53,4 +53,7 @@
 #define JS_EXPORTDATA
 #endif
 
+#define WTF_EXPORT_PRIVATE JS_EXPORTDATA
+#define JS_EXPORT_PRIVATE JS_EXPORTDATA
+
 #endif // config_h
diff --git a/Tools/DumpRenderTree/config.h b/Tools/DumpRenderTree/config.h
index 351a2b1..90cfcf6 100644
--- a/Tools/DumpRenderTree/config.h
+++ b/Tools/DumpRenderTree/config.h
@@ -26,13 +26,21 @@
 
 #include <wtf/Platform.h>
 
-#ifdef __cplusplus
-#undef new
-#undef delete
-#include <wtf/FastMalloc.h>
-#endif
+/* See note in wtf/Platform.h for more info on EXPORT_MACROS. */
+#if USE(EXPORT_MACROS)
+
+#include <wtf/ExportMacros.h>
+
+#define WTF_EXPORT_PRIVATE WTF_IMPORT
+#define JS_EXPORT_PRIVATE WTF_IMPORT
+#define WEBKIT_EXPORTDATA WTF_IMPORT
+
+#define JS_EXPORTDATA JS_EXPORT_PRIVATE
+#define JS_EXPORTCLASS JS_EXPORT_PRIVATE
+
+#else /* !USE(EXPORT_MACROS) */
 
-#if OS(WINDOWS) && !COMPILER(GCC)
+#if OS(WINDOWS) && !COMPILER(GCC) && !defined(BUILDING_WX__)
 #define JS_EXPORTDATA __declspec(dllimport)
 #define WEBKIT_EXPORTDATA __declspec(dllimport)
 #else
@@ -40,6 +48,17 @@
 #define WEBKIT_EXPORTDATA
 #endif
 
+#define WTF_EXPORT_PRIVATE JS_EXPORTDATA
+#define JS_EXPORT_PRIVATE JS_EXPORTDATA
+
+#endif /* USE(EXPORT_MACROS) */
+
+#ifdef __cplusplus
+#undef new
+#undef delete
+#include <wtf/FastMalloc.h>
+#endif
+
 #if PLATFORM(MAC)
 #define WTF_USE_CF 1
 
diff --git a/Tools/DumpRenderTree/gtk/AccessibilityCallbacks.cpp b/Tools/DumpRenderTree/gtk/AccessibilityCallbacks.cpp
index be66513..8d73d45 100644
--- a/Tools/DumpRenderTree/gtk/AccessibilityCallbacks.cpp
+++ b/Tools/DumpRenderTree/gtk/AccessibilityCallbacks.cpp
@@ -92,6 +92,9 @@ static gboolean axObjectEventListener(GSignalInvocationHint *signalHint,
     } else if (!g_strcmp0(signal_query.signal_name, "children-changed")) {
         signalName.set(g_strdup_printf("children-changed = %d",
                                        g_value_get_uint(&paramValues[1])));
+    } else if (!g_strcmp0(signal_query.signal_name, "property-change")) {
+        signalName.set(g_strdup_printf("property-change:%s",
+                                       g_quark_to_string(signalHint->detail)));
     } else
         signalName.set(g_strdup(signal_query.signal_name));
 
diff --git a/Tools/DumpRenderTree/gtk/DumpRenderTree.cpp b/Tools/DumpRenderTree/gtk/DumpRenderTree.cpp
index 3f70b49..f768b43 100644
--- a/Tools/DumpRenderTree/gtk/DumpRenderTree.cpp
+++ b/Tools/DumpRenderTree/gtk/DumpRenderTree.cpp
@@ -2,7 +2,7 @@
  * Copyright (C) 2007 Eric Seidel <eric@webkit.org>
  * Copyright (C) 2008 Alp Toker <alp@nuanti.com>
  * Copyright (C) 2009 Jan Alonzo <jmalonzo@gmail.com>
- * Copyright (C) 2010 Igalia S.L.
+ * Copyright (C) 2010, 2011 Igalia S.L.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -137,9 +137,13 @@ static void initializeGtkFontSettings(const char* testURL)
     GtkSettings* settings = gtk_settings_get_default();
     if (!settings)
         return;
-    g_object_set(settings, "gtk-xft-antialias", 1,
+    g_object_set(settings,
+                 "gtk-xft-dpi", 98304, // This is 96 * 1024 or 96 DPI according to the GTK+ docs.
+                 "gtk-xft-antialias", 1,
                  "gtk-xft-hinting", 0,
-                 "gtk-font-name", "Liberation Sans 16", NULL);
+                 "gtk-font-name", "Liberation Sans 12",
+                 NULL);
+    gdk_screen_set_resolution(gdk_screen_get_default(), 96.0);
 
     // One test needs subpixel anti-aliasing turned on, but generally we
     // want all text in other tests to use to grayscale anti-aliasing.
@@ -419,8 +423,8 @@ static void resetDefaultsToConsistentValues()
                  "sans-serif-font-family", "Helvetica",
                  "cursive-font-family", "cursive",
                  "fantasy-font-family", "fantasy",
-                 "default-font-size", 16,
-                 "default-monospace-font-size", 13,
+                 "default-font-size", 12,
+                 "default-monospace-font-size", 10,
                  "minimum-font-size", 0,
                  "enable-caret-browsing", FALSE,
                  "enable-page-cache", FALSE,
@@ -458,7 +462,7 @@ static void resetDefaultsToConsistentValues()
     setlocale(LC_ALL, "");
 
     DumpRenderTreeSupportGtk::setLinksIncludedInFocusChain(true);
-    DumpRenderTreeSupportGtk::setIconDatabaseEnabled(false);
+    webkit_icon_database_set_path(webkit_get_icon_database(), 0);
     DumpRenderTreeSupportGtk::setSelectTrailingWhitespaceEnabled(false);
 
     if (axController)
@@ -583,8 +587,6 @@ void dump()
 
 static void setDefaultsToConsistentStateValuesForTesting()
 {
-    gdk_screen_set_resolution(gdk_screen_get_default(), 72.0);
-
     resetDefaultsToConsistentValues();
 
     /* Disable the default auth dialog for testing */
@@ -598,6 +600,26 @@ static void setDefaultsToConsistentStateValuesForTesting()
     gchar* databaseDirectory = g_build_filename(g_get_user_data_dir(), "gtkwebkitdrt", "databases", NULL);
     webkit_set_web_database_directory_path(databaseDirectory);
     g_free(databaseDirectory);
+
+#if defined(GTK_API_VERSION_2)
+    gtk_rc_parse_string("style \"nix_scrollbar_spacing\"                    "
+                        "{                                                  "
+                        "    GtkScrolledWindow::scrollbar-spacing = 0       "
+                        "}                                                  "
+                        "class \"GtkWidget\" style \"nix_scrollbar_spacing\"");
+
+#else
+    GtkCssProvider* cssProvider = gtk_css_provider_new();
+    gtk_css_provider_load_from_data(cssProvider,
+                                    " * {                                       "
+                                    "   -GtkScrolledWindow-scrollbar-spacing: 0;"
+                                    "}                                          ",
+                                    -1, 0);
+    gtk_style_context_add_provider_for_screen(gdk_display_get_default_screen(gdk_display_get_default()),
+                                              GTK_STYLE_PROVIDER(cssProvider),
+                                              GTK_STYLE_PROVIDER_PRIORITY_APPLICATION);
+    g_object_unref(cssProvider);
+#endif
 }
 
 static void sendPixelResultsEOF()
@@ -1027,6 +1049,17 @@ static void frameCreatedCallback(WebKitWebView* webView, WebKitWebFrame* webFram
 static void willSendRequestCallback(WebKitWebView* webView, WebKitWebFrame*, WebKitWebResource*, WebKitNetworkRequest* request, WebKitNetworkResponse*)
 {
     SoupMessage* soupMessage = webkit_network_request_get_message(request);
+    SoupURI* uri = soup_uri_new(webkit_network_request_get_uri(request));
+
+    if (SOUP_URI_VALID_FOR_HTTP(uri) && g_strcmp0(uri->host, "127.0.0.1")
+        && g_strcmp0(uri->host, "255.255.255.255")
+        && g_ascii_strncasecmp(uri->host, "localhost", 9)) {
+        printf("Blocked access to external URL %s\n", soup_uri_to_string(uri, FALSE));
+        soup_uri_free(uri);
+        return;
+    }
+    soup_uri_free(uri);
+
 
     if (soupMessage) {
         const set<string>& clearHeaders = gLayoutTestController->willSendRequestClearHeaders();
diff --git a/Tools/DumpRenderTree/gtk/LayoutTestControllerGtk.cpp b/Tools/DumpRenderTree/gtk/LayoutTestControllerGtk.cpp
index 77d6ae1..c26e2db 100644
--- a/Tools/DumpRenderTree/gtk/LayoutTestControllerGtk.cpp
+++ b/Tools/DumpRenderTree/gtk/LayoutTestControllerGtk.cpp
@@ -332,9 +332,9 @@ void LayoutTestController::setUserStyleSheetLocation(JSStringRef path)
         setUserStyleSheetEnabled(true);
 }
 
-void LayoutTestController::setValueForUser(JSContextRef context, JSValueRef element, JSStringRef value)
+void LayoutTestController::setValueForUser(JSContextRef context, JSValueRef nodeObject, JSStringRef value)
 {
-    // FIXME: implement
+    DumpRenderTreeSupportGtk::setValueForUser(context, nodeObject, value);
 }
 
 void LayoutTestController::setViewModeMediaFeature(JSStringRef mode)
@@ -458,6 +458,11 @@ void LayoutTestController::setAuthorAndUserStylesEnabled(bool flag)
     // FIXME: implement
 }
 
+void LayoutTestController::setAutofilled(JSContextRef context, JSValueRef nodeObject, bool isAutofilled)
+{
+    DumpRenderTreeSupportGtk::setAutofilled(context, nodeObject, isAutofilled);
+}
+
 void LayoutTestController::disableImageLoading()
 {
     // FIXME: Implement for testing fix for https://bugs.webkit.org/show_bug.cgi?id=27896
@@ -488,6 +493,12 @@ void LayoutTestController::setGeolocationPermission(bool allow)
     setGeolocationPermissionCommon(allow);
 }
 
+int LayoutTestController::numberOfPendingGeolocationPermissionRequests()
+{
+    // FIXME: Implement for Geolocation layout tests.
+    return -1;
+}
+
 void LayoutTestController::addMockSpeechInputResult(JSStringRef result, double confidence, JSStringRef language)
 {
     // FIXME: Implement for speech input layout tests.
@@ -496,7 +507,12 @@ void LayoutTestController::addMockSpeechInputResult(JSStringRef result, double c
 
 void LayoutTestController::setIconDatabaseEnabled(bool enabled)
 {
-    DumpRenderTreeSupportGtk::setIconDatabaseEnabled(enabled);
+    WebKitIconDatabase* database = webkit_get_icon_database();
+    if (enabled) {
+        GOwnPtr<gchar> iconDatabasePath(g_build_filename(g_get_tmp_dir(), "DumpRenderTree", "icondatabase", NULL));
+        webkit_icon_database_set_path(database, iconDatabasePath.get());
+    } else
+        webkit_icon_database_set_path(database, 0);
 }
 
 void LayoutTestController::setJavaScriptProfilingEnabled(bool flag)
@@ -627,12 +643,23 @@ void LayoutTestController::clearPersistentUserStyleSheet()
 
 void LayoutTestController::clearAllApplicationCaches()
 {
-    // FIXME: implement to support Application Cache quotas.
+    // FIXME: Implement to support application cache quotas.
 }
 
 void LayoutTestController::setApplicationCacheOriginQuota(unsigned long long quota)
 {
-    // FIXME: implement to support Application Cache quotas.
+    // FIXME: Implement to support application cache quotas.
+}
+
+void LayoutTestController::clearApplicationCacheForOrigin(OpaqueJSString*)
+{
+    // FIXME: Implement to support deleting all application caches for an origin.
+}
+
+JSValueRef LayoutTestController::originsWithApplicationCache(JSContextRef context)
+{
+    // FIXME: Implement to get origins that contain application caches.
+    return JSValueMakeUndefined(context);
 }
 
 void LayoutTestController::clearAllDatabases()
@@ -646,6 +673,32 @@ void LayoutTestController::setDatabaseQuota(unsigned long long quota)
     webkit_security_origin_set_web_database_quota(origin, quota);
 }
 
+JSValueRef LayoutTestController::originsWithLocalStorage(JSContextRef context)
+{
+    // FIXME: implement
+    return JSValueMakeUndefined(context);
+}
+
+void LayoutTestController::deleteAllLocalStorage()
+{
+        // FIXME: implement
+}
+
+void LayoutTestController::deleteLocalStorageForOrigin(JSStringRef originIdentifier)
+{
+        // FIXME: implement
+}
+
+void LayoutTestController::observeStorageTrackerNotifications(unsigned number)
+{
+        // FIXME: implement
+}
+
+void LayoutTestController::syncLocalStorage()
+{
+    // FIXME: implement
+}
+
 void LayoutTestController::setDomainRelaxationForbiddenForURLScheme(bool, JSStringRef)
 {
     // FIXME: implement
@@ -873,6 +926,11 @@ bool LayoutTestController::hasSpellingMarker(int from, int length)
     return DumpRenderTreeSupportGtk::webkitWebFrameSelectionHasSpellingMarker(mainFrame, from, length);
 }
 
+bool LayoutTestController::hasGrammarMarker(int from, int length)
+{
+    return false;
+}
+
 void LayoutTestController::dumpConfigurationForViewport(int deviceDPI, int deviceWidth, int deviceHeight, int availableWidth, int availableHeight)
 {
     WebKitWebView* webView = webkit_web_frame_get_web_view(mainFrame);
diff --git a/Tools/DumpRenderTree/mac/Configurations/Base.xcconfig b/Tools/DumpRenderTree/mac/Configurations/Base.xcconfig
index 28a0518..8463985 100644
--- a/Tools/DumpRenderTree/mac/Configurations/Base.xcconfig
+++ b/Tools/DumpRenderTree/mac/Configurations/Base.xcconfig
@@ -52,12 +52,16 @@ TARGET_GCC_VERSION_1050_ = $(TARGET_GCC_VERSION_1050_$(XCODE_VERSION_ACTUAL));
 TARGET_GCC_VERSION_1050_0310 = GCC_42;
 TARGET_GCC_VERSION_1050_0320 = GCC_42;
 TARGET_GCC_VERSION_1060 = GCC_42;
-TARGET_GCC_VERSION_1070 = LLVM_GCC_42;
+TARGET_GCC_VERSION_1070 = $(TARGET_GCC_VERSION_1070_$(CONFIGURATION));
+TARGET_GCC_VERSION_1070_Debug = LLVM_COMPILER;
+TARGET_GCC_VERSION_1070_Release = LLVM_GCC_42;
+TARGET_GCC_VERSION_1070_Production = LLVM_GCC_42;
 
 GCC_VERSION = $(GCC_VERSION_$(TARGET_GCC_VERSION));
 GCC_VERSION_GCC_40 = 4.0;
 GCC_VERSION_GCC_42 = 4.2;
 GCC_VERSION_LLVM_GCC_42 = com.apple.compilers.llvmgcc42;
+GCC_VERSION_LLVM_COMPILER = com.apple.compilers.llvm.clang.1_0;
 
 // If the target Mac OS X version does not match the current Mac OS X version then we'll want to build using the target version's SDK.
 SDKROOT = $(SDKROOT_$(MAC_OS_X_VERSION_MAJOR)_$(TARGET_MAC_OS_X_VERSION_MAJOR));
diff --git a/Tools/DumpRenderTree/mac/DumpRenderTree.mm b/Tools/DumpRenderTree/mac/DumpRenderTree.mm
index dca0d38..207e8fb 100644
--- a/Tools/DumpRenderTree/mac/DumpRenderTree.mm
+++ b/Tools/DumpRenderTree/mac/DumpRenderTree.mm
@@ -48,6 +48,7 @@
 #import "PixelDumpSupport.h"
 #import "PolicyDelegate.h"
 #import "ResourceLoadDelegate.h"
+#import "StorageTrackerDelegate.h"
 #import "UIDelegate.h"
 #import "WebArchiveDumpSupport.h"
 #import "WorkQueue.h"
@@ -77,6 +78,7 @@
 #import <WebKit/WebPreferencesPrivate.h>
 #import <WebKit/WebPreferenceKeysPrivate.h>
 #import <WebKit/WebResourceLoadDelegate.h>
+#import <WebKit/WebStorageManagerPrivate.h>
 #import <WebKit/WebTypesInternal.h>
 #import <WebKit/WebViewPrivate.h>
 #import <getopt.h>
@@ -134,6 +136,7 @@ static EditingDelegate *editingDelegate;
 static ResourceLoadDelegate *resourceLoadDelegate;
 static HistoryDelegate *historyDelegate;
 PolicyDelegate *policyDelegate;
+StorageTrackerDelegate *storageDelegate;
 
 static int dumpPixels;
 static int threaded;
@@ -303,6 +306,9 @@ WebView *createWebViewAndOffscreenWindow()
     [WebView registerURLSchemeAsLocal:@"feedsearch"];
     
     [webView setContinuousSpellCheckingEnabled:YES];
+    [webView setGrammarCheckingEnabled:YES];
+    [webView setInteractiveFormValidationEnabled:YES];
+    [webView setValidationMessageTimerMagnification:-1];
     
     // To make things like certain NSViews, dragging, and plug-ins work, put the WebView a window, but put it off-screen so you don't see it.
     // Put it at -10000, -10000 in "flipped coordinates", since WebCore and the DOM use flipped coordinates.
@@ -414,6 +420,7 @@ static void resetDefaultsToConsistentValues()
 
     NSString *path = libraryPathForDumpRenderTree();
     [defaults setObject:[path stringByAppendingPathComponent:@"Databases"] forKey:WebDatabaseDirectoryDefaultsKey];
+    [defaults setObject:[path stringByAppendingPathComponent:@"LocalStorage"] forKey:WebStorageDirectoryDefaultsKey];
     [defaults setObject:[path stringByAppendingPathComponent:@"LocalCache"] forKey:WebKitLocalCacheDefaultsKey];
 
     WebPreferences *preferences = [WebPreferences standardPreferences];
@@ -545,6 +552,7 @@ static void allocateGlobalControllers()
     resourceLoadDelegate = [[ResourceLoadDelegate alloc] init];
     policyDelegate = [[PolicyDelegate alloc] init];
     historyDelegate = [[HistoryDelegate alloc] init];
+    storageDelegate = [[StorageTrackerDelegate alloc] init];
 }
 
 // ObjC++ doens't seem to let me pass NSObject*& sadly.
@@ -562,6 +570,7 @@ static void releaseGlobalControllers()
     releaseAndZero(&resourceLoadDelegate);
     releaseAndZero(&uiDelegate);
     releaseAndZero(&policyDelegate);
+    releaseAndZero(&storageDelegate);
 }
 
 static void initializeGlobalsFromCommandLineOptions(int argc, const char *argv[])
diff --git a/Tools/DumpRenderTree/mac/DumpRenderTreeMac.h b/Tools/DumpRenderTree/mac/DumpRenderTreeMac.h
index 36c5eac..901008c 100644
--- a/Tools/DumpRenderTree/mac/DumpRenderTreeMac.h
+++ b/Tools/DumpRenderTree/mac/DumpRenderTreeMac.h
@@ -35,6 +35,7 @@
 @class DumpRenderTreeDraggingInfo;
 @class NavigationController;
 @class PolicyDelegate;
+@class StorageTrackerDelegate;
 @class WebFrame;
 @class WebScriptWorld;
 @class WebView;
@@ -42,6 +43,7 @@
 class DumpRenderTreeDraggingInfo;
 class NavigationController;
 class PolicyDelegate;
+class StorageTrackerDelegate;
 class WebFrame;
 class WebScriptWorld;
 class WebView;
@@ -54,6 +56,7 @@ extern WebFrame* topLoadingFrame;
 extern DumpRenderTreeDraggingInfo *draggingInfo;
 extern NavigationController* gNavigationController;
 extern PolicyDelegate* policyDelegate;
+extern StorageTrackerDelegate* storageDelegate;
 
 extern const unsigned maxViewHeight;
 extern const unsigned maxViewWidth;
diff --git a/Tools/DumpRenderTree/mac/LayoutTestControllerMac.mm b/Tools/DumpRenderTree/mac/LayoutTestControllerMac.mm
index 72ec759..66c0cce 100644
--- a/Tools/DumpRenderTree/mac/LayoutTestControllerMac.mm
+++ b/Tools/DumpRenderTree/mac/LayoutTestControllerMac.mm
@@ -33,6 +33,7 @@
 #import "EditingDelegate.h"
 #import "MockGeolocationProvider.h"
 #import "PolicyDelegate.h"
+#import "StorageTrackerDelegate.h"
 #import "UIDelegate.h"
 #import "WorkQueue.h"
 #import "WorkQueueItem.h"
@@ -66,6 +67,7 @@
 #import <WebKit/WebQuotaManager.h>
 #import <WebKit/WebScriptWorld.h>
 #import <WebKit/WebSecurityOriginPrivate.h>
+#import <WebKit/WebStorageManagerPrivate.h>
 #import <WebKit/WebTypesInternal.h>
 #import <WebKit/WebView.h>
 #import <WebKit/WebViewPrivate.h>
@@ -133,11 +135,68 @@ void LayoutTestController::clearAllApplicationCaches()
     [WebApplicationCache deleteAllApplicationCaches];
 }
 
+void LayoutTestController::syncLocalStorage()
+{
+    [[WebStorageManager sharedWebStorageManager] syncLocalStorage];
+}
+
+void LayoutTestController::observeStorageTrackerNotifications(unsigned number)
+{
+    [storageDelegate logNotifications:number controller:this];
+}
+
+void LayoutTestController::clearApplicationCacheForOrigin(JSStringRef url)
+{
+    RetainPtr<CFStringRef> urlCF(AdoptCF, JSStringCopyCFString(kCFAllocatorDefault, url));
+
+    WebSecurityOrigin *origin = [[WebSecurityOrigin alloc] initWithURL:[NSURL URLWithString:(NSString *)urlCF.get()]];
+    [WebApplicationCache deleteCacheForOrigin:origin];
+    [origin release];
+}
+
+JSValueRef originsArrayToJS(JSContextRef context, NSArray* origins)
+{
+    NSUInteger count = [origins count];
+
+    JSValueRef jsOriginsArray[count];
+    for (NSUInteger i = 0; i < count; i++) {
+        NSString *origin = [[origins objectAtIndex:i] databaseIdentifier];
+        JSRetainPtr<JSStringRef> originJS(Adopt, JSStringCreateWithCFString((CFStringRef)origin));
+        jsOriginsArray[i] = JSValueMakeString(context, originJS.get());
+    }
+
+    return JSObjectMakeArray(context, count, jsOriginsArray, NULL);
+}
+
+JSValueRef LayoutTestController::originsWithApplicationCache(JSContextRef context)
+{
+    return originsArrayToJS(context, [WebApplicationCache originsWithCache]);
+}
+
 void LayoutTestController::clearAllDatabases()
 {
     [[WebDatabaseManager sharedWebDatabaseManager] deleteAllDatabases];
 }
 
+void LayoutTestController::deleteAllLocalStorage()
+{
+    [[WebStorageManager sharedWebStorageManager] deleteAllOrigins];
+}
+
+JSValueRef LayoutTestController::originsWithLocalStorage(JSContextRef context)
+{
+    return originsArrayToJS(context, [[WebStorageManager sharedWebStorageManager] origins]);
+}
+
+void LayoutTestController::deleteLocalStorageForOrigin(JSStringRef URL)
+{
+    RetainPtr<CFStringRef> urlCF(AdoptCF, JSStringCopyCFString(kCFAllocatorDefault, URL));
+    
+    WebSecurityOrigin *origin = [[WebSecurityOrigin alloc] initWithURL:[NSURL URLWithString:(NSString *)urlCF.get()]];
+    [[WebStorageManager sharedWebStorageManager] deleteOrigin:origin];
+    [origin release];
+}
+
 void LayoutTestController::clearBackForwardList()
 {
     WebBackForwardList *backForwardList = [[mainFrame webView] backForwardList];
@@ -254,6 +313,11 @@ int LayoutTestController::numberOfPages(float pageWidthInPixels, float pageHeigh
     return [mainFrame numberOfPages:pageWidthInPixels:pageHeightInPixels];
 }
 
+int LayoutTestController::numberOfPendingGeolocationPermissionRequests()
+{
+    return [[[mainFrame webView] UIDelegate] numberOfPendingGeolocationPermissionRequests];
+}
+
 size_t LayoutTestController::webHistoryItemCount()
 {
     return [[[WebHistory optionalSharedHistory] allItems] count];
@@ -320,6 +384,15 @@ void LayoutTestController::setAuthorAndUserStylesEnabled(bool flag)
     [[[mainFrame webView] preferences] setAuthorAndUserStylesEnabled:flag];
 }
 
+void LayoutTestController::setAutofilled(JSContextRef context, JSValueRef nodeObject, bool autofilled)
+{
+    DOMElement *element = [DOMElement _DOMElementFromJSContext:context value:nodeObject];
+    if (!element || ![element isKindOfClass:[DOMHTMLInputElement class]])
+        return;
+
+    [(DOMHTMLInputElement *)element _setAutofilled:autofilled];
+}
+
 void LayoutTestController::setCustomPolicyDelegate(bool setDelegate, bool permissive)
 {
     if (setDelegate) {
@@ -484,7 +557,7 @@ void LayoutTestController::setValueForUser(JSContextRef context, JSValueRef node
     DOMElement *element = [DOMElement _DOMElementFromJSContext:context value:nodeObject];
     if (!element || ![element isKindOfClass:[DOMHTMLInputElement class]])
         return;
-    
+
     RetainPtr<CFStringRef> valueCF(AdoptCF, JSStringCopyCFString(kCFAllocatorDefault, value));
     [(DOMHTMLInputElement *)element _setValueForUser:(NSString *)valueCF.get()];
 }
@@ -926,8 +999,8 @@ static NSString *SynchronousLoaderRunLoopMode = @"DumpRenderTreeSynchronousLoade
 - (void)connection:(NSURLConnection *)connection didReceiveAuthenticationChallenge:(NSURLAuthenticationChallenge *)challenge
 {
     if ([challenge previousFailureCount] == 0) {
-        NSURLCredential *credential = [[NSURLCredential alloc]  initWithUser:m_username password:m_password persistence:NSURLCredentialPersistenceForSession];
-        [[challenge sender] useCredential:credential forAuthenticationChallenge:challenge];
+        RetainPtr<NSURLCredential> credential(AdoptNS, [[NSURLCredential alloc]  initWithUser:m_username password:m_password persistence:NSURLCredentialPersistenceForSession]);
+        [[challenge sender] useCredential:credential.get() forAuthenticationChallenge:challenge];
         return;
     }
     [[challenge sender] cancelAuthenticationChallenge:challenge];
@@ -977,9 +1050,9 @@ void LayoutTestController::authenticateSession(JSStringRef url, JSStringRef user
     RetainPtr<CFStringRef> usernameCF(AdoptCF, JSStringCopyCFString(kCFAllocatorDefault, username));
     RetainPtr<CFStringRef> passwordCF(AdoptCF, JSStringCopyCFString(kCFAllocatorDefault, password));
 
-    NSURLRequest *request = [[NSURLRequest alloc] initWithURL:[NSURL URLWithString:(NSString *)urlStringCF.get()]];
+    RetainPtr<NSURLRequest> request(AdoptNS, [[NSURLRequest alloc] initWithURL:[NSURL URLWithString:(NSString *)urlStringCF.get()]]);
 
-    [SynchronousLoader makeRequest:request withUsername:(NSString *)usernameCF.get() password:(NSString *)passwordCF.get()];
+    [SynchronousLoader makeRequest:request.get() withUsername:(NSString *)usernameCF.get() password:(NSString *)passwordCF.get()];
 #endif
 }
 
@@ -1004,6 +1077,12 @@ bool LayoutTestController::hasSpellingMarker(int from, int length)
 {
     return [mainFrame hasSpellingMarker:from length:length];
 }
+
+bool LayoutTestController::hasGrammarMarker(int from, int length)
+{
+    return [mainFrame hasGrammarMarker:from length:length];
+}
+
 void LayoutTestController::dumpConfigurationForViewport(int /*deviceDPI*/, int /*deviceWidth*/, int /*deviceHeight*/, int /*availableWidth*/, int /*availableHeight*/)
 {
 
diff --git a/Tools/DumpRenderTree/mac/PerlSupport/Makefile b/Tools/DumpRenderTree/mac/PerlSupport/Makefile
index 16a9e51..96ddc93 100644
--- a/Tools/DumpRenderTree/mac/PerlSupport/Makefile
+++ b/Tools/DumpRenderTree/mac/PerlSupport/Makefile
@@ -66,7 +66,7 @@ $(PERL_MODULE): DumpRenderTreeSupportPregenerated.pm $(DUMPRENDERTREE)
 endif
 
 $(DYLIB): DumpRenderTreeSupport.c $(WRAPPER)
-	gcc -g -dynamiclib -o $(DYLIB) `$(PERL) -MExtUtils::Embed -eperl_inc` `$(PERL) -MExtUtils::Embed -eldopts` $^
+	gcc -g -dynamiclib -o $(DYLIB) `$(PERL) -MExtUtils::Embed -eperl_inc` `$(PERL) -MExtUtils::Embed -e'my $$opts = ldopts(0); $$opts =~ s/-arch [^ ]*( |$$)//g; print $$opts, " -arch ", join(" -arch ", split(" ",$$ENV{ARCHS}))'` $^
 
 clean:
 	rm -f $(WRAPPER) $(PERL_MODULE) $(DYLIB)
diff --git a/Tools/DumpRenderTree/mac/UIDelegate.h b/Tools/DumpRenderTree/mac/UIDelegate.h
index a8017ad..982b480 100644
--- a/Tools/DumpRenderTree/mac/UIDelegate.h
+++ b/Tools/DumpRenderTree/mac/UIDelegate.h
@@ -37,5 +37,6 @@
 }
 
 - (void)didSetMockGeolocationPermission;
+- (int)numberOfPendingGeolocationPermissionRequests;
 
 @end
diff --git a/Tools/DumpRenderTree/mac/UIDelegate.mm b/Tools/DumpRenderTree/mac/UIDelegate.mm
index 06a71f8..6b84738 100644
--- a/Tools/DumpRenderTree/mac/UIDelegate.mm
+++ b/Tools/DumpRenderTree/mac/UIDelegate.mm
@@ -205,6 +205,14 @@ DumpRenderTreeDraggingInfo *draggingInfo = nil;
         m_timer = [NSTimer scheduledTimerWithTimeInterval:0 target:self selector:@selector(timerFired) userInfo:0 repeats:NO];
 }
 
+- (int)numberOfPendingGeolocationPermissionRequests
+{
+    if (!m_pendingGeolocationPermissionListeners)
+        return 0;
+    return [m_pendingGeolocationPermissionListeners count];
+}
+
+
 - (void)timerFired
 {
     ASSERT(gLayoutTestController->isGeolocationPermissionSet());
@@ -227,7 +235,7 @@ DumpRenderTreeDraggingInfo *draggingInfo = nil;
     return NO;
 }
 
-- (BOOL)webView:(WebView *)webView supportsFullScreenForElement:(DOMElement*)element
+- (BOOL)webView:(WebView *)webView supportsFullScreenForElement:(DOMElement*)element withKeyboard:(BOOL)withKeyboard
 {
     return YES;
 }
diff --git a/Tools/DumpRenderTree/mac/WebArchiveDumpSupportMac.mm b/Tools/DumpRenderTree/mac/WebArchiveDumpSupportMac.mm
index c273087..9f94ecb 100644
--- a/Tools/DumpRenderTree/mac/WebArchiveDumpSupportMac.mm
+++ b/Tools/DumpRenderTree/mac/WebArchiveDumpSupportMac.mm
@@ -23,6 +23,7 @@
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
+#import "config.h"
 #import "WebArchiveDumpSupport.h"
 
 #import <CFNetwork/CFHTTPMessage.h>
diff --git a/Tools/DumpRenderTree/qt/DumpRenderTree.pro b/Tools/DumpRenderTree/qt/DumpRenderTree.pro
index d84af96..a76b886 100644
--- a/Tools/DumpRenderTree/qt/DumpRenderTree.pro
+++ b/Tools/DumpRenderTree/qt/DumpRenderTree.pro
@@ -9,6 +9,7 @@ include(../../../Source/WebKit.pri)
 INCLUDEPATH += ../../../Source
 INCLUDEPATH += ../../../Source/JavaScriptCore
 INCLUDEPATH += ../../../Source/JavaScriptCore/ForwardingHeaders
+INCLUDEPATH += ../../../Source/WebKit/qt/WebCoreSupport
 INCLUDEPATH += $$BASEDIR
 DESTDIR = ../../bin
 
@@ -51,3 +52,4 @@ wince*: {
 }
 
 DEFINES += USE_SYSTEM_MALLOC=1
+DEFINES -= QT_ASCII_CAST_WARNINGS
diff --git a/Tools/DumpRenderTree/qt/DumpRenderTreeQt.cpp b/Tools/DumpRenderTree/qt/DumpRenderTreeQt.cpp
index 6af6fc2..97d9f20 100644
--- a/Tools/DumpRenderTree/qt/DumpRenderTreeQt.cpp
+++ b/Tools/DumpRenderTree/qt/DumpRenderTreeQt.cpp
@@ -32,7 +32,7 @@
 #include "config.h"
 
 #include "DumpRenderTreeQt.h"
-#include "../../../Source/WebKit/qt/WebCoreSupport/DumpRenderTreeSupportQt.h"
+#include "DumpRenderTreeSupportQt.h"
 #include "EventSenderQt.h"
 #include "GCControllerQt.h"
 #include "LayoutTestControllerQt.h"
@@ -499,6 +499,10 @@ DumpRenderTree::DumpRenderTree()
 
 DumpRenderTree::~DumpRenderTree()
 {
+    if (!m_redirectOutputFileName.isEmpty())
+        fclose(stdout);
+    if (!m_redirectErrorFileName.isEmpty())
+        fclose(stderr);
     delete m_mainView;
     delete m_stdin;
     DumpRenderTreeSupportQt::removeMockDeviceOrientation();
@@ -676,9 +680,7 @@ void DumpRenderTree::processArgsLine(const QStringList &args)
 {
     setStandAloneMode(true);
 
-    for (int i = 1; i < args.size(); ++i)
-        if (!args.at(i).startsWith('-'))
-            m_standAloneModeTestList.append(args[i]);
+    m_standAloneModeTestList = args;
 
     QFileInfo firstEntry(m_standAloneModeTestList.first());
     if (firstEntry.isDir()) {
@@ -690,11 +692,12 @@ void DumpRenderTree::processArgsLine(const QStringList &args)
         for (int i = 0; i < m_standAloneModeTestList.size(); ++i)
             m_standAloneModeTestList[i] = folderEntry.absoluteFilePath(m_standAloneModeTestList[i]);
     }
-
-    processLine(m_standAloneModeTestList.first());
-    m_standAloneModeTestList.removeFirst();
-
     connect(this, SIGNAL(ready()), this, SLOT(loadNextTestInStandAloneMode()));
+
+    if (!m_standAloneModeTestList.isEmpty()) {
+        QString first = m_standAloneModeTestList.takeFirst();
+        processLine(first);
+    }
 }
 
 void DumpRenderTree::loadNextTestInStandAloneMode()
@@ -703,9 +706,8 @@ void DumpRenderTree::loadNextTestInStandAloneMode()
         emit quit();
         return;
     }
-
-    processLine(m_standAloneModeTestList.first());
-    m_standAloneModeTestList.removeFirst();
+    QString first = m_standAloneModeTestList.takeFirst();
+    processLine(first);
 }
 
 void DumpRenderTree::processLine(const QString &input)
diff --git a/Tools/DumpRenderTree/qt/DumpRenderTreeQt.h b/Tools/DumpRenderTree/qt/DumpRenderTreeQt.h
index 5b53cd9..858856f 100644
--- a/Tools/DumpRenderTree/qt/DumpRenderTreeQt.h
+++ b/Tools/DumpRenderTree/qt/DumpRenderTreeQt.h
@@ -40,7 +40,7 @@
 #include <QSslError>
 #endif
 
-#include "../../../Source/WebKit/qt/WebCoreSupport/DumpRenderTreeSupportQt.h"
+#include "DumpRenderTreeSupportQt.h"
 #include <qgraphicsview.h>
 #include <qgraphicswebview.h>
 #include <qwebframe.h>
@@ -105,6 +105,8 @@ public:
     static void initializeFonts();
 #endif
     void processArgsLine(const QStringList&);
+    void setRedirectOutputFileName(const QString& fileName) { m_redirectOutputFileName = fileName; }
+    void setRedirectErrorFileName(const QString& fileName) { m_redirectErrorFileName = fileName; }
 
 public Q_SLOTS:
     void initJSObjects();
@@ -160,6 +162,8 @@ private:
     bool m_standAloneMode;
     bool m_graphicsBased;
     QString m_persistentStoragePath;
+    QString m_redirectOutputFileName;
+    QString m_redirectErrorFileName;
 };
 
 class NetworkAccessManager : public QNetworkAccessManager {
diff --git a/Tools/DumpRenderTree/qt/GCControllerQt.cpp b/Tools/DumpRenderTree/qt/GCControllerQt.cpp
index 2a30ba8..a2e5e0c 100644
--- a/Tools/DumpRenderTree/qt/GCControllerQt.cpp
+++ b/Tools/DumpRenderTree/qt/GCControllerQt.cpp
@@ -29,7 +29,7 @@
 
 #include "config.h"
 #include "GCControllerQt.h"
-#include "../../../Source/WebKit/qt/WebCoreSupport/DumpRenderTreeSupportQt.h"
+#include "DumpRenderTreeSupportQt.h"
 
 #include <qwebpage.h>
 
diff --git a/Tools/DumpRenderTree/qt/ImageDiff.pro b/Tools/DumpRenderTree/qt/ImageDiff.pro
index cdb067e..b3d5181 100644
--- a/Tools/DumpRenderTree/qt/ImageDiff.pro
+++ b/Tools/DumpRenderTree/qt/ImageDiff.pro
@@ -14,3 +14,4 @@ unix:!mac {
     QMAKE_RPATHDIR = $$OUTPUT_DIR/lib $$QMAKE_RPATHDIR
 }
 
+DEFINES -= QT_ASCII_CAST_WARNINGS
diff --git a/Tools/DumpRenderTree/qt/LayoutTestControllerQt.cpp b/Tools/DumpRenderTree/qt/LayoutTestControllerQt.cpp
index 74055e2..4e3087e 100644
--- a/Tools/DumpRenderTree/qt/LayoutTestControllerQt.cpp
+++ b/Tools/DumpRenderTree/qt/LayoutTestControllerQt.cpp
@@ -28,7 +28,7 @@
  */
 #include "config.h"
 #include "LayoutTestControllerQt.h"
-#include "../../../Source/WebKit/qt/WebCoreSupport/DumpRenderTreeSupportQt.h"
+#include "DumpRenderTreeSupportQt.h"
 
 #include "DumpRenderTreeQt.h"
 #include "WorkQueue.h"
@@ -315,9 +315,12 @@ void LayoutTestController::queueLoad(const QString& url, const QString& target)
     WorkQueue::shared()->queue(new LoadItem(absoluteUrl, target, m_drt->webPage()));
 }
 
-void LayoutTestController::queueLoadHTMLString(const QString& content, const QString& baseURL)
+void LayoutTestController::queueLoadHTMLString(const QString& content, const QString& baseURL, const QString& failingURL)
 {
-    WorkQueue::shared()->queue(new LoadHTMLStringItem(content, baseURL, m_drt->webPage()));
+    if (failingURL.isEmpty())
+        WorkQueue::shared()->queue(new LoadHTMLStringItem(content, baseURL, m_drt->webPage()));
+    else
+        WorkQueue::shared()->queue(new LoadAlternateHTMLStringItem(content, baseURL, failingURL, m_drt->webPage()));
 }
 
 void LayoutTestController::queueReload()
@@ -552,6 +555,11 @@ void LayoutTestController::clearAllApplicationCaches()
     DumpRenderTreeSupportQt::clearAllApplicationCaches();
 }
 
+void LayoutTestController::clearApplicationCacheForOrigin(const QString& url)
+{
+    // FIXME: Implement to support deleting all application caches for an origin.
+}
+
 void LayoutTestController::setApplicationCacheOriginQuota(unsigned long long quota)
 {
     if (!m_topLoadingFrame)
@@ -559,6 +567,12 @@ void LayoutTestController::setApplicationCacheOriginQuota(unsigned long long quo
     m_topLoadingFrame->securityOrigin().setApplicationCacheQuota(quota);
 }
 
+QStringList LayoutTestController::originsWithApplicationCache()
+{
+    // FIXME: Implement to get origins that have application caches.
+    return QStringList();
+}
+
 void LayoutTestController::setDatabaseQuota(int size)
 {
     if (!m_topLoadingFrame)
@@ -766,6 +780,12 @@ void LayoutTestController::setGeolocationPermission(bool allow)
     DumpRenderTreeSupportQt::setMockGeolocationPermission(m_drt->webPage(), allow);
 }
 
+int LayoutTestController::numberOfPendingGeolocationPermissionRequests()
+{
+    // FIXME: Implement for Geolocation layout tests.
+    return -1;
+}
+
 void LayoutTestController::setGeolocationPermissionCommon(bool allow)
 {
      m_isGeolocationPermissionSet = true;
@@ -842,5 +862,30 @@ void LayoutTestController::setMinimumTimerInterval(double minimumTimerInterval)
     DumpRenderTreeSupportQt::setMinimumTimerInterval(m_drt->webPage(), minimumTimerInterval);
 }
 
+void LayoutTestController::originsWithLocalStorage()
+{
+    // FIXME: Implement.
+}
+
+void LayoutTestController::deleteAllLocalStorage()
+{
+    // FIXME: Implement.
+}
+
+void LayoutTestController::deleteLocalStorageForOrigin(const QString& originIdentifier)
+{
+    // FIXME: Implement.
+}
+
+void LayoutTestController::observeStorageTrackerNotifications(unsigned number)
+{
+    // FIXME: Implement.
+}
+
+void LayoutTestController::syncLocalStorage()
+{
+    // FIXME: Implement.
+}
+
 const unsigned LayoutTestController::maxViewWidth = 800;
 const unsigned LayoutTestController::maxViewHeight = 600;
diff --git a/Tools/DumpRenderTree/qt/LayoutTestControllerQt.h b/Tools/DumpRenderTree/qt/LayoutTestControllerQt.h
index 0b5bbba..f29233a 100644
--- a/Tools/DumpRenderTree/qt/LayoutTestControllerQt.h
+++ b/Tools/DumpRenderTree/qt/LayoutTestControllerQt.h
@@ -121,7 +121,7 @@ public slots:
     void queueBackNavigation(int howFarBackward);
     void queueForwardNavigation(int howFarForward);
     void queueLoad(const QString& url, const QString& target = QString());
-    void queueLoadHTMLString(const QString& content, const QString& baseURL = QString());
+    void queueLoadHTMLString(const QString& content, const QString& baseURL = QString(), const QString& failingURL = QString());
     void queueReload();
     void queueLoadingScript(const QString& script);
     void queueNonLoadingScript(const QString& script);
@@ -189,7 +189,9 @@ public slots:
     void disableImageLoading();
 
     void clearAllApplicationCaches();
+    void clearApplicationCacheForOrigin(const QString& url);
     void setApplicationCacheOriginQuota(unsigned long long quota);
+    QStringList originsWithApplicationCache();
 
     void setDatabaseQuota(int size);
     void clearAllDatabases();
@@ -219,6 +221,7 @@ public slots:
     void setMockGeolocationError(int code, const QString& message);
     void setMockGeolocationPosition(double latitude, double longitude, double accuracy);
     void setGeolocationPermission(bool allow);
+    int numberOfPendingGeolocationPermissionRequests();
     bool isGeolocationPermissionSet() const { return m_isGeolocationPermissionSet; }
     bool geolocationPermission() const { return m_geolocationPermission; }
 
@@ -253,6 +256,12 @@ public slots:
     void addUserStyleSheet(const QString& sourceCode);
 
     void setMinimumTimerInterval(double);
+    
+    void originsWithLocalStorage();
+    void deleteAllLocalStorage();
+    void deleteLocalStorageForOrigin(const QString& originIdentifier);
+    void observeStorageTrackerNotifications(unsigned number);
+    void syncLocalStorage();
 
 private slots:
     void processWork();
diff --git a/Tools/DumpRenderTree/qt/PlainTextControllerQt.cpp b/Tools/DumpRenderTree/qt/PlainTextControllerQt.cpp
index 729ccd0..dd63fea 100644
--- a/Tools/DumpRenderTree/qt/PlainTextControllerQt.cpp
+++ b/Tools/DumpRenderTree/qt/PlainTextControllerQt.cpp
@@ -28,7 +28,7 @@
 #include "config.h"
 #include "PlainTextControllerQt.h"
 
-#include "../../../Source/WebKit/qt/WebCoreSupport/DumpRenderTreeSupportQt.h"
+#include "DumpRenderTreeSupportQt.h"
 #include <QApplication>
 #include <QInputMethodEvent>
 #include <QKeyEvent>
diff --git a/Tools/DumpRenderTree/qt/TestNetscapePlugin/TestNetscapePlugin.pro b/Tools/DumpRenderTree/qt/TestNetscapePlugin/TestNetscapePlugin.pro
index 96f0fc5..6741668 100644
--- a/Tools/DumpRenderTree/qt/TestNetscapePlugin/TestNetscapePlugin.pro
+++ b/Tools/DumpRenderTree/qt/TestNetscapePlugin/TestNetscapePlugin.pro
@@ -32,6 +32,7 @@ SOURCES = PluginObject.cpp \
           Tests/EvaluateJSAfterRemovingPluginElement.cpp \
           Tests/GetURLWithJavaScriptURLDestroyingPlugin.cpp \
           Tests/GetUserAgentWithNullNPPFromNPPNew.cpp \
+          Tests/NPDeallocateCalledBeforeNPShutdown.cpp \
           Tests/NPRuntimeObjectFromDestroyedPlugin.cpp \
           Tests/NPRuntimeRemoveProperty.cpp \
           Tests/NullNPPGetValuePointer.cpp \
@@ -46,6 +47,8 @@ mac {
     SOURCES += ../../unix/TestNetscapePlugin/TestNetscapePlugin.cpp
 }
 
+DEFINES -= QT_ASCII_CAST_WARNINGS
+
 !win32:!embedded:!mac:!symbian {
     LIBS += -lX11
 }
diff --git a/Tools/DumpRenderTree/qt/TextInputControllerQt.cpp b/Tools/DumpRenderTree/qt/TextInputControllerQt.cpp
index 9112674..8cf2e4e 100644
--- a/Tools/DumpRenderTree/qt/TextInputControllerQt.cpp
+++ b/Tools/DumpRenderTree/qt/TextInputControllerQt.cpp
@@ -28,7 +28,7 @@
  */
 #include "config.h"
 #include "TextInputControllerQt.h"
-#include "../../../Source/WebKit/qt/WebCoreSupport/DumpRenderTreeSupportQt.h"
+#include "DumpRenderTreeSupportQt.h"
 
 #include <QApplication>
 #include <QInputMethodEvent>
diff --git a/Tools/DumpRenderTree/qt/WorkQueueItemQt.cpp b/Tools/DumpRenderTree/qt/WorkQueueItemQt.cpp
index d1baf08..b093366 100644
--- a/Tools/DumpRenderTree/qt/WorkQueueItemQt.cpp
+++ b/Tools/DumpRenderTree/qt/WorkQueueItemQt.cpp
@@ -28,6 +28,7 @@
  */
 #include "config.h"
 #include "WorkQueueItemQt.h"
+#include "DumpRenderTreeSupportQt.h"
 
 QWebFrame* findFrameNamed(const QString& frameName, QWebFrame* frame)
 {
@@ -72,6 +73,18 @@ bool LoadHTMLStringItem::invoke() const
     return true;
 }
 
+bool LoadAlternateHTMLStringItem::invoke() const
+{
+    Q_ASSERT(m_webPage);
+
+    QWebFrame* frame = m_webPage->mainFrame();
+    if (!frame)
+        return false;
+
+    DumpRenderTreeSupportQt::setAlternateHtml(frame, m_content, QUrl(m_baseURL), QUrl(m_failingURL));
+    return true;
+}
+
 bool ReloadItem::invoke() const
 {
     //qDebug() << ">>>ReloadItem::invoke";
diff --git a/Tools/DumpRenderTree/qt/WorkQueueItemQt.h b/Tools/DumpRenderTree/qt/WorkQueueItemQt.h
index 97c9b04..ac7d1b3 100644
--- a/Tools/DumpRenderTree/qt/WorkQueueItemQt.h
+++ b/Tools/DumpRenderTree/qt/WorkQueueItemQt.h
@@ -80,6 +80,24 @@ private:
     QString m_baseURL;
 };
 
+class LoadAlternateHTMLStringItem : public WorkQueueItem {
+public:
+    LoadAlternateHTMLStringItem(const QString& content, const QString& baseURL,  const QString &failingURL, QWebPage *page)
+        : WorkQueueItem(page)
+        , m_content(content)
+        , m_baseURL(baseURL)
+        , m_failingURL(failingURL)
+    {
+    }
+
+private:
+    virtual bool invoke() const;
+
+    QString m_content;
+    QString m_baseURL;
+    QString m_failingURL;
+};
+
 class ReloadItem : public WorkQueueItem {
 public:
     ReloadItem(QWebPage *page)
diff --git a/Tools/DumpRenderTree/qt/main.cpp b/Tools/DumpRenderTree/qt/main.cpp
index 8349d73..bc762e5 100644
--- a/Tools/DumpRenderTree/qt/main.cpp
+++ b/Tools/DumpRenderTree/qt/main.cpp
@@ -67,6 +67,33 @@ void messageHandler(QtMsgType type, const char *message)
     // do nothing
 }
 
+// We only support -v or --pixel-tests or --stdout or --stderr or -, all the others will be 
+// pass as test case name (even -abc.html is a valid test case name)
+bool isOption(const QString& str)
+{
+    return str == QString("-v") || str == QString("--pixel-tests")
+           || str == QString("--stdout") || str == QString("--stderr")
+           || str == QString("-");
+}
+
+QString takeOptionValue(QStringList& arguments, int index)
+{
+    QString result;
+
+    if (index + 1 < arguments.count() && !isOption(arguments.at(index + 1)))
+        result = arguments.takeAt(index + 1);
+    arguments.removeAt(index);
+
+    return result;
+}
+
+void printUsage()
+{
+    fprintf(stderr, "Usage: DumpRenderTree [-v|--pixel-tests] [--stdout output_filename] [-stderr error_filename] filename [filename2..n]\n");
+    fprintf(stderr, "Or folder containing test files: DumpRenderTree [-v|--pixel-tests] dirpath\n");
+    fflush(stderr);
+}
+
 QString get_backtrace() {
     QString s;
 
@@ -143,28 +170,70 @@ int main(int argc, char* argv[])
 
     QStringList args = app.arguments();
     if (args.count() < 2) {
-        qDebug() << "Usage: DumpRenderTree [-v|--pixel-tests] filename [filename2..n]";
-        qDebug() << "Or folder containing test files: DumpRenderTree [-v|--pixel-tests] dirpath";
-        exit(0);
+        printUsage();
+        exit(1);
     }
 
+    // Remove the first arguments, it is application name itself
+    args.removeAt(0);
+
     // Suppress debug output from Qt if not started with -v
-    if (!args.contains(QLatin1String("-v")))
+    int index = args.indexOf(QLatin1String("-v"));
+    if (index == -1) 
         qInstallMsgHandler(messageHandler);
+    else
+        args.removeAt(index);
 
     WebCore::DumpRenderTree dumper;
 
-    if (args.contains(QLatin1String("--pixel-tests")))
+    index = args.indexOf(QLatin1String("--pixel-tests"));
+    if (index != -1) {
         dumper.setDumpPixels(true);
+        args.removeAt(index);
+    }
 
+    index = args.indexOf(QLatin1String("--stdout"));
+    if (index != -1) {
+        QString fileName = takeOptionValue(args, index);
+        dumper.setRedirectOutputFileName(fileName);
+        if (fileName.isEmpty() || !freopen(qPrintable(fileName), "w", stdout)) {
+            fprintf(stderr, "STDOUT redirection failed.");
+            exit(1);
+        }
+    }
+    index = args.indexOf(QLatin1String("--stderr"));
+    if (index != -1) {
+        QString fileName = takeOptionValue(args, index);
+        dumper.setRedirectErrorFileName(fileName);
+        if (!freopen(qPrintable(fileName), "w", stderr)) {
+            fprintf(stderr, "STDERR redirection failed.");
+            exit(1);
+        }
+    }
     QWebDatabase::removeAllDatabases();
 
-    if (args.contains(QLatin1String("-"))) {
-        QObject::connect(&dumper, SIGNAL(ready()), &dumper, SLOT(readLine()), Qt::QueuedConnection);
-        QTimer::singleShot(0, &dumper, SLOT(readLine()));
-    } else
+    index = args.indexOf(QLatin1String("-"));
+    if (index != -1) {
+        args.removeAt(index);
+
+        // Continue waiting in STDIN for more test case after process one test case
+        QObject::connect(&dumper, SIGNAL(ready()), &dumper, SLOT(readLine()), Qt::QueuedConnection);   
+
+        // Read and only read the first test case, ignore the others 
+        if (args.size() > 0) { 
+            // Process the argument first
+            dumper.processLine(args[0]);
+        } else
+           QTimer::singleShot(0, &dumper, SLOT(readLine()));
+    } else {
+        // Go into standalone mode
+        // Standalone mode need at least one test case
+        if (args.count() < 1) {
+            printUsage();
+            exit(1);
+        }
         dumper.processArgsLine(args);
-
+    }
     return app.exec();
 
 #ifdef Q_WS_X11
diff --git a/Tools/DumpRenderTree/win/DumpRenderTree.vcproj b/Tools/DumpRenderTree/win/DumpRenderTree.vcproj
index ca26cb8..39d2df2 100644
--- a/Tools/DumpRenderTree/win/DumpRenderTree.vcproj
+++ b/Tools/DumpRenderTree/win/DumpRenderTree.vcproj
@@ -18,7 +18,7 @@
 		<Configuration
 			Name="Debug|Win32"
 			ConfigurationType="1"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;.\DumpRenderTreeCommon.vsprops;.\DumpRenderTreeApple.vsprops"
+			InheritedPropertySheets=".\DumpRenderTreeDebug.vsprops"
 			CharacterSet="1"
 			>
 			<Tool
@@ -79,7 +79,7 @@
 		<Configuration
 			Name="Release|Win32"
 			ConfigurationType="1"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;.\DumpRenderTreeCommon.vsprops;.\DumpRenderTreeApple.vsprops"
+			InheritedPropertySheets=".\DumpRenderTreeRelease.vsprops"
 			CharacterSet="1"
 			>
 			<Tool
@@ -140,7 +140,7 @@
 		<Configuration
 			Name="Debug_Cairo_CFLite|Win32"
 			ConfigurationType="1"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefinesCairo.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\debug_wincairo.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\cURL.vsprops;.\DumpRenderTreeCommon.vsprops;.\DumpRenderTreeCairo.vsprops;.\DumpRenderTreeCFLite.vsprops"
+			InheritedPropertySheets=".\DumpRenderTreeDebugCairoCFLite.vsprops"
 			CharacterSet="1"
 			>
 			<Tool
@@ -201,7 +201,7 @@
 		<Configuration
 			Name="Release_Cairo_CFLite|Win32"
 			ConfigurationType="1"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefinesCairo.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\WinCairo.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\cURL.vsprops;.\DumpRenderTreeCommon.vsprops;.\DumpRenderTreeCairo.vsprops;.\DumpRenderTreeCFLite.vsprops"
+			InheritedPropertySheets=".\DumpRenderTreeReleaseCairoCFLite.vsprops"
 			CharacterSet="1"
 			>
 			<Tool
@@ -262,7 +262,7 @@
 		<Configuration
 			Name="Debug_All|Win32"
 			ConfigurationType="1"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\debug_all.vsprops;.\DumpRenderTreeCommon.vsprops;.\DumpRenderTreeApple.vsprops"
+			InheritedPropertySheets=".\DumpRenderTreeDebugAll.vsprops"
 			CharacterSet="1"
 			>
 			<Tool
@@ -321,9 +321,9 @@
 			/>
 		</Configuration>
 		<Configuration
-			Name="Release_LTCG|Win32"
+			Name="Production|Win32"
 			ConfigurationType="1"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;.\DumpRenderTreeCommon.vsprops;.\DumpRenderTreeApple.vsprops"
+			InheritedPropertySheets=".\DumpRenderTreeProduction.vsprops"
 			CharacterSet="1"
 			WholeProgramOptimization="1"
 			>
@@ -610,7 +610,7 @@
 				/>
 			</FileConfiguration>
 			<FileConfiguration
-				Name="Release_LTCG|Win32"
+				Name="Production|Win32"
 				ExcludedFromBuild="true"
 				>
 				<Tool
@@ -646,7 +646,7 @@
 				/>
 			</FileConfiguration>
 			<FileConfiguration
-				Name="Release_LTCG|Win32"
+				Name="Production|Win32"
 				ExcludedFromBuild="true"
 				>
 				<Tool
diff --git a/Tools/DumpRenderTree/win/DumpRenderTreeDebug.vsprops b/Tools/DumpRenderTree/win/DumpRenderTreeDebug.vsprops
new file mode 100644
index 0000000..adfa61f
--- /dev/null
+++ b/Tools/DumpRenderTree/win/DumpRenderTreeDebug.vsprops
@@ -0,0 +1,13 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="DumpRenderTreeDebug"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;
+      .\DumpRenderTreeCommon.vsprops;
+      .\DumpRenderTreeApple.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Tools/DumpRenderTree/win/DumpRenderTreeDebugAll.vsprops b/Tools/DumpRenderTree/win/DumpRenderTreeDebugAll.vsprops
new file mode 100644
index 0000000..aa3db54
--- /dev/null
+++ b/Tools/DumpRenderTree/win/DumpRenderTreeDebugAll.vsprops
@@ -0,0 +1,14 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="DumpRenderTreeDebugAll"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\debug_all.vsprops;
+      .\DumpRenderTreeCommon.vsprops;
+      .\DumpRenderTreeApple.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Tools/DumpRenderTree/win/DumpRenderTreeDebugCairoCFLite.vsprops b/Tools/DumpRenderTree/win/DumpRenderTreeDebugCairoCFLite.vsprops
new file mode 100644
index 0000000..b0985b0
--- /dev/null
+++ b/Tools/DumpRenderTree/win/DumpRenderTreeDebugCairoCFLite.vsprops
@@ -0,0 +1,9 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="DumpRenderTreeDebugCairoCFLite"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefinesCairo.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\debug_wincairo.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\cURL.vsprops;.\DumpRenderTreeCommon.vsprops;.\DumpRenderTreeCairo.vsprops;.\DumpRenderTreeCFLite.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Tools/DumpRenderTree/win/DumpRenderTreeProduction.vsprops b/Tools/DumpRenderTree/win/DumpRenderTreeProduction.vsprops
new file mode 100644
index 0000000..818bff2
--- /dev/null
+++ b/Tools/DumpRenderTree/win/DumpRenderTreeProduction.vsprops
@@ -0,0 +1,14 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="DumpRenderTreeProduction"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\production.vsprops;
+      .\DumpRenderTreeCommon.vsprops;
+      .\DumpRenderTreeApple.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Tools/DumpRenderTree/win/DumpRenderTreeRelease.vsprops b/Tools/DumpRenderTree/win/DumpRenderTreeRelease.vsprops
new file mode 100644
index 0000000..c39a9cd
--- /dev/null
+++ b/Tools/DumpRenderTree/win/DumpRenderTreeRelease.vsprops
@@ -0,0 +1,13 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="DumpRenderTreeRelease"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
+      .\DumpRenderTreeCommon.vsprops;
+      .\DumpRenderTreeApple.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Tools/DumpRenderTree/win/DumpRenderTreeReleaseCairoCFLite.vsprops b/Tools/DumpRenderTree/win/DumpRenderTreeReleaseCairoCFLite.vsprops
new file mode 100644
index 0000000..508e8c5
--- /dev/null
+++ b/Tools/DumpRenderTree/win/DumpRenderTreeReleaseCairoCFLite.vsprops
@@ -0,0 +1,16 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="DumpRenderTreeReleaseCairoCFLite"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefinesCairo.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\WinCairo.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\cURL.vsprops;
+      .\DumpRenderTreeCommon.vsprops;
+      .\DumpRenderTreeCairo.vsprops;
+      .\DumpRenderTreeCFLite.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Tools/DumpRenderTree/win/ImageDiff.vcproj b/Tools/DumpRenderTree/win/ImageDiff.vcproj
index f48af25..7094fec 100644
--- a/Tools/DumpRenderTree/win/ImageDiff.vcproj
+++ b/Tools/DumpRenderTree/win/ImageDiff.vcproj
@@ -17,7 +17,7 @@
 		<Configuration
 			Name="Debug|Win32"
 			ConfigurationType="1"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;.\ImageDiffCommon.vsprops"
+			InheritedPropertySheets=".\ImageDiffDebug.vsprops"
 			CharacterSet="2"
 			>
 			<Tool
@@ -78,7 +78,7 @@
 		<Configuration
 			Name="Release|Win32"
 			ConfigurationType="1"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;.\ImageDiffCommon.vsprops"
+			InheritedPropertySheets=".\ImageDiffRelease.vsprops"
 			CharacterSet="2"
 			>
 			<Tool
@@ -139,7 +139,7 @@
 		<Configuration
 			Name="Debug_All|Win32"
 			ConfigurationType="1"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\debug_all.vsprops;.\ImageDiffCommon.vsprops"
+			InheritedPropertySheets=".\ImageDiffDebugAll.vsprops"
 			CharacterSet="2"
 			>
 			<Tool
@@ -200,7 +200,7 @@
 		<Configuration
 			Name="Debug_Cairo_CFLite|Win32"
 			ConfigurationType="1"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\debug_wincairo.vsprops;.\ImageDiffCommon.vsprops"
+			InheritedPropertySheets=".\ImageDiffDebugCairoCFLite.vsprops"
 			CharacterSet="2"
 			>
 			<Tool
@@ -259,9 +259,9 @@
 			/>
 		</Configuration>
 		<Configuration
-			Name="Release_LTCG|Win32"
+			Name="Production|Win32"
 			ConfigurationType="1"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;.\ImageDiffCommon.vsprops"
+			InheritedPropertySheets=".\ImageDiffProduction.vsprops"
 			CharacterSet="2"
 			WholeProgramOptimization="1"
 			>
@@ -323,7 +323,7 @@
 		<Configuration
 			Name="Release_Cairo_CFLite|Win32"
 			ConfigurationType="1"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\WinCairo.vsprops;.\ImageDiffCommon.vsprops"
+			InheritedPropertySheets=".\ImageDiffReleaseCairoCFLite.vsprops"
 			CharacterSet="2"
 			>
 			<Tool
diff --git a/Tools/DumpRenderTree/win/ImageDiffDebug.vsprops b/Tools/DumpRenderTree/win/ImageDiffDebug.vsprops
new file mode 100644
index 0000000..28641a2
--- /dev/null
+++ b/Tools/DumpRenderTree/win/ImageDiffDebug.vsprops
@@ -0,0 +1,11 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="ImageDiffDebug"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;
+      .\ImageDiffCommon.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Tools/DumpRenderTree/win/ImageDiffDebugAll.vsprops b/Tools/DumpRenderTree/win/ImageDiffDebugAll.vsprops
new file mode 100644
index 0000000..824a4b9
--- /dev/null
+++ b/Tools/DumpRenderTree/win/ImageDiffDebugAll.vsprops
@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="ImageDiffDebugAll"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\debug_all.vsprops;
+      .\ImageDiffCommon.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Tools/DumpRenderTree/win/ImageDiffDebugCairoCFLite.vsprops b/Tools/DumpRenderTree/win/ImageDiffDebugCairoCFLite.vsprops
new file mode 100644
index 0000000..bd6bc8a
--- /dev/null
+++ b/Tools/DumpRenderTree/win/ImageDiffDebugCairoCFLite.vsprops
@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="ImageDiffDebugCairoCFLite"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\debug_wincairo.vsprops;
+      .\ImageDiffCommon.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Tools/DumpRenderTree/win/ImageDiffProduction.vsprops b/Tools/DumpRenderTree/win/ImageDiffProduction.vsprops
new file mode 100644
index 0000000..37ff9de
--- /dev/null
+++ b/Tools/DumpRenderTree/win/ImageDiffProduction.vsprops
@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="ImageDiffProduction"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\production.vsprops;
+      .\ImageDiffCommon.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Tools/DumpRenderTree/win/ImageDiffRelease.vsprops b/Tools/DumpRenderTree/win/ImageDiffRelease.vsprops
new file mode 100644
index 0000000..79e9749
--- /dev/null
+++ b/Tools/DumpRenderTree/win/ImageDiffRelease.vsprops
@@ -0,0 +1,11 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="ImageDiffRelease"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
+      .\ImageDiffCommon.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Tools/DumpRenderTree/win/ImageDiffReleaseCairoCFLite.vsprops b/Tools/DumpRenderTree/win/ImageDiffReleaseCairoCFLite.vsprops
new file mode 100644
index 0000000..1cb062b
--- /dev/null
+++ b/Tools/DumpRenderTree/win/ImageDiffReleaseCairoCFLite.vsprops
@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="ImageDiffReleaseCairoCFLite"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\WinCairo.vsprops;
+      .\ImageDiffCommon.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Tools/DumpRenderTree/win/LayoutTestControllerWin.cpp b/Tools/DumpRenderTree/win/LayoutTestControllerWin.cpp
index 12a3a55..1d2f3d8 100644
--- a/Tools/DumpRenderTree/win/LayoutTestControllerWin.cpp
+++ b/Tools/DumpRenderTree/win/LayoutTestControllerWin.cpp
@@ -374,6 +374,27 @@ void LayoutTestController::setAuthorAndUserStylesEnabled(bool flag)
     prefsPrivate->setAuthorAndUserStylesEnabled(flag);
 }
 
+void LayoutTestController::setAutofilled(JSContextRef context, JSValueRef nodeObject, bool autofilled)
+{
+    COMPtr<IWebView> webView;
+    if (FAILED(frame->webView(&webView)))
+        return;
+
+    COMPtr<IWebViewPrivate> webViewPrivate(Query, webView);
+    if (!webViewPrivate)
+        return;
+
+    COMPtr<IDOMElement> element;
+    if (FAILED(webViewPrivate->elementFromJS(context, nodeObject, &element)))
+        return;
+
+    COMPtr<IFormsAutoFillTransition> autofillElement(Query, element);
+    if (!autofillElement)
+        return;
+
+    autofillElement->setAutofilled(autofilled);
+}
+
 void LayoutTestController::setCustomPolicyDelegate(bool setDelegate, bool permissive)
 {
     COMPtr<IWebView> webView;
@@ -411,6 +432,12 @@ void LayoutTestController::setGeolocationPermission(bool allow)
     setGeolocationPermissionCommon(allow);
 }
 
+int LayoutTestController::numberOfPendingGeolocationPermissionRequests()
+{
+    // FIXME: Implement for Geolocation layout tests.
+    return -1;
+}
+
 void LayoutTestController::addMockSpeechInputResult(JSStringRef result, double confidence, JSStringRef language)
 {
     // FIXME: Implement for speech input layout tests.
@@ -922,12 +949,23 @@ bool LayoutTestController::isCommandEnabled(JSStringRef /*name*/)
 
 void LayoutTestController::clearAllApplicationCaches()
 {
-    // FIXME: implement to support Application Cache quotas.
+    // FIXME: Implement to support application cache quotas.
+}
+
+void LayoutTestController::clearApplicationCacheForOrigin(JSStringRef origin)
+{
+    // FIXME: Implement to support deleting all application cache for an origin.
 }
 
 void LayoutTestController::setApplicationCacheOriginQuota(unsigned long long quota)
 {
-    // FIXME: implement to support Application Cache quotas.
+    // FIXME: Implement to support application cache quotas.
+}
+
+JSValueRef LayoutTestController::originsWithApplicationCache(JSContextRef context)
+{
+    // FIXME: Implement to get origins that have application caches.
+    return JSValueMakeUndefined(context);
 }
 
 void LayoutTestController::clearAllDatabases()
@@ -1418,6 +1456,12 @@ bool LayoutTestController::hasSpellingMarker(int from, int length)
     return ret;
 }
 
+bool LayoutTestController::hasGrammarMarker(int from, int length)
+{
+    // FIXME: Implement this.
+    return false;
+}
+
 void LayoutTestController::dumpConfigurationForViewport(int /*deviceDPI*/, int /*deviceWidth*/, int /*deviceHeight*/, int /*availableWidth*/, int /*availableHeight*/)
 {
     // FIXME: Implement this.
@@ -1428,6 +1472,32 @@ void LayoutTestController::setSerializeHTTPLoads(bool)
     // FIXME: Implement.
 }
 
+void LayoutTestController::syncLocalStorage()
+{
+    // FIXME: Implement.
+}
+
+void LayoutTestController::observeStorageTrackerNotifications(unsigned number)
+{
+    // FIXME: Implement.
+}
+
+void LayoutTestController::deleteAllLocalStorage()
+{
+    // FIXME: Implement.
+}
+
+JSValueRef LayoutTestController::originsWithLocalStorage(JSContextRef context)
+{
+    // FIXME: Implement.
+    return JSValueMakeUndefined(context);
+}
+
+void LayoutTestController::deleteLocalStorageForOrigin(JSStringRef URL)
+{
+    // FIXME: Implement.
+}
+
 void LayoutTestController::setMinimumTimerInterval(double minimumTimerInterval)
 {
     COMPtr<IWebView> webView;
@@ -1440,3 +1510,5 @@ void LayoutTestController::setMinimumTimerInterval(double minimumTimerInterval)
 
     viewPrivate->setMinimumTimerInterval(minimumTimerInterval);
 }
+
+
diff --git a/Tools/DumpRenderTree/wx/LayoutTestControllerWx.cpp b/Tools/DumpRenderTree/wx/LayoutTestControllerWx.cpp
index a95aa50..c45ea0e 100644
--- a/Tools/DumpRenderTree/wx/LayoutTestControllerWx.cpp
+++ b/Tools/DumpRenderTree/wx/LayoutTestControllerWx.cpp
@@ -207,6 +207,11 @@ void LayoutTestController::setAuthorAndUserStylesEnabled(bool flag)
     // FIXME: implement
 }
 
+void LayoutTestController::setAutofilled(JSContextRef, JSValueRef element, bool isAutofilled)
+{
+    // FIXME: implement
+}
+
 void LayoutTestController::setPopupBlockingEnabled(bool popupBlockingEnabled)
 {
     // FIXME: implement
@@ -240,12 +245,23 @@ void LayoutTestController::clearPersistentUserStyleSheet()
 
 void LayoutTestController::clearAllApplicationCaches()
 {
-    // FIXME: implement to support Application Cache quotas.
+    // FIXME: Implement to support application cache quotas.
+}
+
+void LayoutTestController::clearApplicationCacheForOrigin(JSStringRef url)
+{
+    // FIXME: Implement to support deleting all application cache for an origin.
 }
 
 void LayoutTestController::setApplicationCacheOriginQuota(unsigned long long quota)
 {
-    // FIXME: implement to support Application Cache quotas.
+    // FIXME: Implement to support application cache quotas.
+}
+
+JSValueRef LayoutTestController::originsWithApplicationCache(JSContextRef context)
+{
+    // FIXME: Implement to get origins that have application caches.
+    return 0;
 }
 
 void LayoutTestController::clearAllDatabases()
@@ -325,6 +341,12 @@ void LayoutTestController::setGeolocationPermission(bool allow)
     setGeolocationPermissionCommon(allow);
 }
 
+int LayoutTestController::numberOfPendingGeolocationPermissionRequests()
+{
+    // FIXME: Implement for Geolocation layout tests.
+    return -1;
+}
+
 void LayoutTestController::addMockSpeechInputResult(JSStringRef result, double confidence, JSStringRef language)
 {
     // FIXME: Implement for speech input layout tests.
@@ -516,6 +538,12 @@ bool LayoutTestController::hasSpellingMarker(int, int)
     return false;
 }
 
+bool LayoutTestController::hasGrammarMarker(int, int)
+{
+    // FIXME: Implement
+    return false;
+}
+
 void LayoutTestController::dumpConfigurationForViewport(int /*deviceDPI*/, int /*deviceWidth*/, int /*deviceHeight*/, int /*availableWidth*/, int /*availableHeight*/)
 {
     // FIXME: Implement
@@ -558,4 +586,29 @@ void LayoutTestController::setSerializeHTTPLoads(bool)
 void LayoutTestController::setMinimumTimerInterval(double interval) {
 
 }
-    
+
+void LayoutTestController::syncLocalStorage()
+{
+    // FIXME: Implement.
+}
+
+void LayoutTestController::observeStorageTrackerNotifications(unsigned number)
+{
+    // FIXME: Implement.
+}
+
+void LayoutTestController::deleteAllLocalStorage()
+{
+    // FIXME: Implement.
+}
+
+JSValueRef LayoutTestController::originsWithLocalStorage(JSContextRef context)
+{
+    // FIXME: Implement.
+    return 0;
+}
+
+void LayoutTestController::deleteLocalStorageForOrigin(JSStringRef URL)
+{
+    // FIXME: Implement.
+}
diff --git a/Tools/EWebLauncher/main.c b/Tools/EWebLauncher/main.c
index 4a9e1ba..3bb27a2 100644
--- a/Tools/EWebLauncher/main.c
+++ b/Tools/EWebLauncher/main.c
@@ -822,7 +822,7 @@ main(int argc, char *argv[])
 
     char *engine = NULL;
     char *theme = NULL;
-    char *backingStore = (char *)backingStores[0];
+    char *backingStore = (char *)backingStores[1];
 
     unsigned char quitOption = 0;
     unsigned char isFlattening = 0;
diff --git a/Tools/FindSafari/FindSafari.vcproj b/Tools/FindSafari/FindSafari.vcproj
index e2beb9f..12fbc7b 100644
--- a/Tools/FindSafari/FindSafari.vcproj
+++ b/Tools/FindSafari/FindSafari.vcproj
@@ -17,7 +17,7 @@
 		<Configuration
 			Name="Debug|Win32"
 			ConfigurationType="1"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;.\FindSafariCommon.vsprops"
+			InheritedPropertySheets=".\FindSafariDebug.vsprops"
 			CharacterSet="1"
 			>
 			<Tool
@@ -78,7 +78,7 @@
 		<Configuration
 			Name="Release|Win32"
 			ConfigurationType="1"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;.\FindSafariCommon.vsprops"
+			InheritedPropertySheets=".\FindSafariRelease.vsprops"
 			CharacterSet="1"
 			>
 			<Tool
@@ -139,7 +139,7 @@
 		<Configuration
 			Name="Debug_All|Win32"
 			ConfigurationType="1"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\debug_all.vsprops;.\FindSafariCommon.vsprops"
+			InheritedPropertySheets=".\FindSafariDebugAll.vsprops"
 			CharacterSet="1"
 			>
 			<Tool
@@ -198,9 +198,9 @@
 			/>
 		</Configuration>
 		<Configuration
-			Name="Release_LTCG|Win32"
+			Name="Production|Win32"
 			ConfigurationType="1"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;.\FindSafariCommon.vsprops"
+			InheritedPropertySheets=".\FindSafariProduction.vsprops"
 			CharacterSet="1"
 			>
 			<Tool
@@ -261,7 +261,7 @@
 		<Configuration
 			Name="Release_Cairo_CFLite|Win32"
 			ConfigurationType="1"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;$(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\WinCairo.vsprops;.\FindSafariCommon.vsprops"
+			InheritedPropertySheets=".\FindSafariReleaseCairoCFLite.vsprops"
 			CharacterSet="1"
 			>
 			<Tool
@@ -322,7 +322,7 @@
 		<Configuration
 			Name="Debug_Cairo_CFLite|Win32"
 			ConfigurationType="1"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;$(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\debug_wincairo.vsprops;.\FindSafariCommon.vsprops"
+			InheritedPropertySheets=".\FindSafariDebugCairoCFLite.vsprops"
 			CharacterSet="1"
 			>
 			<Tool
@@ -383,7 +383,7 @@
 		<Configuration
 			Name="Release_PGO|Win32"
 			ConfigurationType="1"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;.\FindSafariCommon.vsprops"
+			InheritedPropertySheets=".\FindSafariReleasePGO.vsprops"
 			CharacterSet="1"
 			>
 			<Tool
diff --git a/Tools/FindSafari/FindSafariDebug.vsprops b/Tools/FindSafari/FindSafariDebug.vsprops
new file mode 100644
index 0000000..4babd3c
--- /dev/null
+++ b/Tools/FindSafari/FindSafariDebug.vsprops
@@ -0,0 +1,11 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="FindSafariDebug"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;
+      .\FindSafariCommon.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Tools/FindSafari/FindSafariDebugAll.vsprops b/Tools/FindSafari/FindSafariDebugAll.vsprops
new file mode 100644
index 0000000..67a087d
--- /dev/null
+++ b/Tools/FindSafari/FindSafariDebugAll.vsprops
@@ -0,0 +1,11 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="FindSafariDebugAll"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\debug_all.vsprops;
+      .\FindSafariCommon.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Tools/FindSafari/FindSafariDebugCairoCFLite.vsprops b/Tools/FindSafari/FindSafariDebugCairoCFLite.vsprops
new file mode 100644
index 0000000..e445dbd
--- /dev/null
+++ b/Tools/FindSafari/FindSafariDebugCairoCFLite.vsprops
@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="FindSafariDebugCairoCFLite"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\debug_wincairo.vsprops;
+      .\FindSafariCommon.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Tools/FindSafari/FindSafariProduction.vsprops b/Tools/FindSafari/FindSafariProduction.vsprops
new file mode 100644
index 0000000..c2d3e36
--- /dev/null
+++ b/Tools/FindSafari/FindSafariProduction.vsprops
@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="FindSafariProduction"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\production.vsprops;
+      .\FindSafariCommon.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Tools/FindSafari/FindSafariRelease.vsprops b/Tools/FindSafari/FindSafariRelease.vsprops
new file mode 100644
index 0000000..9d59b3d
--- /dev/null
+++ b/Tools/FindSafari/FindSafariRelease.vsprops
@@ -0,0 +1,11 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="FindSafariRelease"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
+      .\FindSafariCommon.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Tools/FindSafari/FindSafariReleaseCairoCFLite.vsprops b/Tools/FindSafari/FindSafariReleaseCairoCFLite.vsprops
new file mode 100644
index 0000000..fccbb9c
--- /dev/null
+++ b/Tools/FindSafari/FindSafariReleaseCairoCFLite.vsprops
@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="FindSafariReleaseCairoCFLite"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\WinCairo.vsprops;
+      .\FindSafariCommon.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Tools/FindSafari/FindSafariReleasePGO.vsprops b/Tools/FindSafari/FindSafariReleasePGO.vsprops
new file mode 100644
index 0000000..6c24cbc
--- /dev/null
+++ b/Tools/FindSafari/FindSafariReleasePGO.vsprops
@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="FindSafariReleasePGO"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\production.vsprops;
+      .\FindSafariCommon.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Tools/GNUmakefile.am b/Tools/GNUmakefile.am
index 87f5429..6de1af5 100644
--- a/Tools/GNUmakefile.am
+++ b/Tools/GNUmakefile.am
@@ -180,6 +180,7 @@ TestNetscapePlugin_libtestnetscapeplugin_la_SOURCES = \
 	Tools/DumpRenderTree/TestNetscapePlugIn/Tests/EvaluateJSAfterRemovingPluginElement.cpp \
 	Tools/DumpRenderTree/TestNetscapePlugIn/Tests/GetURLWithJavaScriptURLDestroyingPlugin.cpp \
 	Tools/DumpRenderTree/TestNetscapePlugIn/Tests/GetUserAgentWithNullNPPFromNPPNew.cpp \
+	Tools/DumpRenderTree/TestNetscapePlugIn/Tests/NPDeallocateCalledBeforeNPShutdown.cpp \
 	Tools/DumpRenderTree/TestNetscapePlugIn/Tests/NPRuntimeObjectFromDestroyedPlugin.cpp \
 	Tools/DumpRenderTree/TestNetscapePlugIn/Tests/NPRuntimeRemoveProperty.cpp \
 	Tools/DumpRenderTree/TestNetscapePlugIn/Tests/NullNPPGetValuePointer.cpp \
diff --git a/Tools/MiniBrowser/Configurations/Base.xcconfig b/Tools/MiniBrowser/Configurations/Base.xcconfig
index abe65dd..bb091e3 100644
--- a/Tools/MiniBrowser/Configurations/Base.xcconfig
+++ b/Tools/MiniBrowser/Configurations/Base.xcconfig
@@ -49,12 +49,23 @@ TARGET_GCC_VERSION_1050_ = $(TARGET_GCC_VERSION_1050_$(XCODE_VERSION_ACTUAL));
 TARGET_GCC_VERSION_1050_0310 = GCC_42;
 TARGET_GCC_VERSION_1050_0320 = GCC_42;
 TARGET_GCC_VERSION_1060 = GCC_42;
-TARGET_GCC_VERSION_1070 = LLVM_GCC_42;
+TARGET_GCC_VERSION_1070 = $(TARGET_GCC_VERSION_1070_$(CONFIGURATION));
+TARGET_GCC_VERSION_1070_Debug = LLVM_COMPILER;
+TARGET_GCC_VERSION_1070_Release = LLVM_GCC_42;
+TARGET_GCC_VERSION_1070_Production = LLVM_GCC_42;
 
 GCC_VERSION = $(GCC_VERSION_$(TARGET_GCC_VERSION));
 GCC_VERSION_GCC_40 = 4.0;
 GCC_VERSION_GCC_42 = 4.2;
 GCC_VERSION_LLVM_GCC_42 = com.apple.compilers.llvmgcc42;
+GCC_VERSION_LLVM_COMPILER = com.apple.compilers.llvm.clang.1_0;
+
+// FIXME: Disable C++ exceptions in the LLVM Compiler once it supports enabling Obj-C exceptions without C++ exceptions.
+GCC_ENABLE_CPP_EXCEPTIONS = $(GCC_ENABLE_CPP_EXCEPTIONS_$(TARGET_GCC_VERSION));
+GCC_ENABLE_CPP_EXCEPTIONS_GCC_40 = NO;
+GCC_ENABLE_CPP_EXCEPTIONS_GCC_42 = NO;
+GCC_ENABLE_CPP_EXCEPTIONS_LLVM_GCC = NO;
+GCC_ENABLE_CPP_EXCEPTIONS_LLVM_COMPILER = YES;
 
 // If the target Mac OS X version does not match the current Mac OS X version then we'll want to build using the target version's SDK.
 SDKROOT = $(SDKROOT_$(MAC_OS_X_VERSION_MAJOR)_$(TARGET_MAC_OS_X_VERSION_MAJOR));
diff --git a/Tools/MiniBrowser/Configurations/MiniBrowserDebug.vsprops b/Tools/MiniBrowser/Configurations/MiniBrowserDebug.vsprops
new file mode 100644
index 0000000..33dee17
--- /dev/null
+++ b/Tools/MiniBrowser/Configurations/MiniBrowserDebug.vsprops
@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="MiniBrowserDebug"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;
+      .\MiniBrowserCoreFoundation.vsprops;
+      .\MiniBrowserCommon.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Tools/MiniBrowser/Configurations/MiniBrowserDebugAll.vsprops b/Tools/MiniBrowser/Configurations/MiniBrowserDebugAll.vsprops
new file mode 100644
index 0000000..37501d1
--- /dev/null
+++ b/Tools/MiniBrowser/Configurations/MiniBrowserDebugAll.vsprops
@@ -0,0 +1,13 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="MiniBrowserDebugAll"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\debug_all.vsprops;
+      .\MiniBrowserCoreFoundation.vsprops;
+      .\MiniBrowserCommon.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Tools/MiniBrowser/Configurations/MiniBrowserDebugCairoCFLite.vsprops b/Tools/MiniBrowser/Configurations/MiniBrowserDebugCairoCFLite.vsprops
new file mode 100644
index 0000000..a632f29
--- /dev/null
+++ b/Tools/MiniBrowser/Configurations/MiniBrowserDebugCairoCFLite.vsprops
@@ -0,0 +1,13 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="MiniBrowserDebugCairoCFLite"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\debug_wincairo.vsprops;
+      .\MiniBrowserCFLite.vsprops;
+      .\MiniBrowserCommon.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Tools/MiniBrowser/Configurations/MiniBrowserProduction.vsprops b/Tools/MiniBrowser/Configurations/MiniBrowserProduction.vsprops
new file mode 100644
index 0000000..75195e3
--- /dev/null
+++ b/Tools/MiniBrowser/Configurations/MiniBrowserProduction.vsprops
@@ -0,0 +1,13 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="MiniBrowserProduction"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\production.vsprops;
+      .\MiniBrowserCoreFoundation.vsprops;
+      .\MiniBrowserCommon.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Tools/MiniBrowser/Configurations/MiniBrowserRelease.vsprops b/Tools/MiniBrowser/Configurations/MiniBrowserRelease.vsprops
new file mode 100644
index 0000000..27af48a
--- /dev/null
+++ b/Tools/MiniBrowser/Configurations/MiniBrowserRelease.vsprops
@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="MiniBrowserRelease"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
+      .\MiniBrowserCoreFoundation.vsprops;
+      .\MiniBrowserCommon.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Tools/MiniBrowser/Configurations/MiniBrowserReleaseCairoCFLite.vsprops b/Tools/MiniBrowser/Configurations/MiniBrowserReleaseCairoCFLite.vsprops
new file mode 100644
index 0000000..a50d5b7
--- /dev/null
+++ b/Tools/MiniBrowser/Configurations/MiniBrowserReleaseCairoCFLite.vsprops
@@ -0,0 +1,13 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="MiniBrowserReleaseCairoCFLite"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\WinCairo.vsprops;
+      .\MiniBrowserCFLite.vsprops;
+      .\MiniBrowserCommon.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Tools/MiniBrowser/MiniBrowser.vcproj b/Tools/MiniBrowser/MiniBrowser.vcproj
index 3d94dbc..4b7b8fc 100644
--- a/Tools/MiniBrowser/MiniBrowser.vcproj
+++ b/Tools/MiniBrowser/MiniBrowser.vcproj
@@ -18,7 +18,7 @@
 		<Configuration
 			Name="Debug|Win32"
 			ConfigurationType="1"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;.\Configurations\MiniBrowserCoreFoundation.vsprops;.\Configurations\MiniBrowserCommon.vsprops"
+			InheritedPropertySheets=".\Configurations\MiniBrowserDebug.vsprops"
 			UseOfATL="1"
 			CharacterSet="1"
 			>
@@ -80,7 +80,7 @@
 		<Configuration
 			Name="Release|Win32"
 			ConfigurationType="1"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;.\Configurations\MiniBrowserCoreFoundation.vsprops;.\Configurations\MiniBrowserCommon.vsprops"
+			InheritedPropertySheets=".\Configurations\MiniBrowserRelease.vsprops"
 			UseOfATL="1"
 			CharacterSet="1"
 			>
@@ -142,7 +142,7 @@
 		<Configuration
 			Name="Debug_All|Win32"
 			ConfigurationType="1"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;$(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\debug_all.vsprops;.\Configurations\MiniBrowserCoreFoundation.vsprops;.\Configurations\MiniBrowserCommon.vsprops"
+			InheritedPropertySheets=".\Configurations\MiniBrowserDebugAll.vsprops"
 			UseOfATL="1"
 			CharacterSet="1"
 			>
@@ -204,7 +204,7 @@
 		<Configuration
 			Name="Debug_Cairo_CFLite|Win32"
 			ConfigurationType="1"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;$(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\debug_wincairo.vsprops;.\Configurations\MiniBrowserCFLite.vsprops;.\Configurations\MiniBrowserCommon.vsprops"
+			InheritedPropertySheets=".\Configurations\MiniBrowserDebugCairoCFLite.vsprops"
 			UseOfATL="1"
 			CharacterSet="1"
 			>
@@ -266,7 +266,7 @@
 		<Configuration
 			Name="Release_Cairo_CFLite|Win32"
 			ConfigurationType="1"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;$(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\WinCairo.vsprops;.\Configurations\MiniBrowserCFLite.vsprops;.\Configurations\MiniBrowserCommon.vsprops"
+			InheritedPropertySheets=".\Configurations\MiniBrowserReleaseCairoCFLite.vsprops"
 			UseOfATL="1"
 			CharacterSet="1"
 			>
@@ -326,9 +326,9 @@
 			/>
 		</Configuration>
 		<Configuration
-			Name="Release_LTCG|Win32"
+			Name="Production|Win32"
 			ConfigurationType="1"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;.\Configurations\MiniBrowserCoreFoundation.vsprops;.\Configurations\MiniBrowserCommon.vsprops"
+			InheritedPropertySheets=".\Configurations\MiniBrowserProduction.vsprops"
 			UseOfATL="1"
 			CharacterSet="1"
 			WholeProgramOptimization="1"
@@ -457,7 +457,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					>
 					<Tool
 						Name="VCCLCompilerTool"
diff --git a/Tools/MiniBrowser/MiniBrowser.xcodeproj/project.pbxproj b/Tools/MiniBrowser/MiniBrowser.xcodeproj/project.pbxproj
index 1a7ccbb..24fc0e8 100644
--- a/Tools/MiniBrowser/MiniBrowser.xcodeproj/project.pbxproj
+++ b/Tools/MiniBrowser/MiniBrowser.xcodeproj/project.pbxproj
@@ -7,6 +7,8 @@
 	objects = {
 
 /* Begin PBXBuildFile section */
+		0F7EB6E3134113C300F4D865 /* WebKit.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = 0F7EB6E2134113C300F4D865 /* WebKit.framework */; };
+		0F7EB879134113F200F4D865 /* WebKit.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = 0F7EB6E2134113C300F4D865 /* WebKit.framework */; };
 		256AC3DA0F4B6AC300CF3369 /* AppDelegate.m in Sources */ = {isa = PBXBuildFile; fileRef = 256AC3D90F4B6AC300CF3369 /* AppDelegate.m */; };
 		51E244FA11EFCE07008228D1 /* MBToolbarItem.m in Sources */ = {isa = PBXBuildFile; fileRef = 51E244F911EFCE07008228D1 /* MBToolbarItem.m */; };
 		8D11072F0486CEB800E47090 /* Cocoa.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = 1058C7A1FEA54F0111CA2CBB /* Cocoa.framework */; };
@@ -48,8 +50,8 @@
 /* End PBXCopyFilesBuildPhase section */
 
 /* Begin PBXFileReference section */
+		0F7EB6E2134113C300F4D865 /* WebKit.framework */ = {isa = PBXFileReference; lastKnownFileType = wrapper.framework; path = WebKit.framework; sourceTree = BUILT_PRODUCTS_DIR; };
 		1058C7A1FEA54F0111CA2CBB /* Cocoa.framework */ = {isa = PBXFileReference; lastKnownFileType = wrapper.framework; name = Cocoa.framework; path = /System/Library/Frameworks/Cocoa.framework; sourceTree = "<absolute>"; };
-		13E42FB307B3F0F600E4EEF1 /* CoreData.framework */ = {isa = PBXFileReference; lastKnownFileType = wrapper.framework; name = CoreData.framework; path = /System/Library/Frameworks/CoreData.framework; sourceTree = "<absolute>"; };
 		1DDD58150DA1D0A300B32029 /* MainMenu.xib */ = {isa = PBXFileReference; lastKnownFileType = file.xib; name = MainMenu.xib; path = mac/MainMenu.xib; sourceTree = "<group>"; };
 		256AC3D80F4B6AC300CF3369 /* AppDelegate.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = AppDelegate.h; path = mac/AppDelegate.h; sourceTree = "<group>"; };
 		256AC3D90F4B6AC300CF3369 /* AppDelegate.m */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.objc; name = AppDelegate.m; path = mac/AppDelegate.m; sourceTree = "<group>"; };
@@ -85,6 +87,7 @@
 			files = (
 				8D11072F0486CEB800E47090 /* Cocoa.framework in Frameworks */,
 				BC8FB5A8116AA1FE0080D413 /* WebKit2.framework in Frameworks */,
+				0F7EB6E3134113C300F4D865 /* WebKit.framework in Frameworks */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
@@ -92,6 +95,7 @@
 			isa = PBXFrameworksBuildPhase;
 			buildActionMask = 2147483647;
 			files = (
+				0F7EB879134113F200F4D865 /* WebKit.framework in Frameworks */,
 				BC20545E11C96C92008F3375 /* Cocoa.framework in Frameworks */,
 				BCBD384411B08AAD00E01E54 /* WebKit2.framework in Frameworks */,
 			);
@@ -121,6 +125,7 @@
 			isa = PBXGroup;
 			children = (
 				1058C7A1FEA54F0111CA2CBB /* Cocoa.framework */,
+				0F7EB6E2134113C300F4D865 /* WebKit.framework */,
 				BC8FB5A7116AA1FE0080D413 /* WebKit2.framework */,
 			);
 			name = "Linked Frameworks";
@@ -130,7 +135,6 @@
 			isa = PBXGroup;
 			children = (
 				29B97324FDCFA39411CA2CEA /* AppKit.framework */,
-				13E42FB307B3F0F600E4EEF1 /* CoreData.framework */,
 				29B97325FDCFA39411CA2CEA /* Foundation.framework */,
 			);
 			name = "Other Frameworks";
diff --git a/Tools/MiniBrowser/mac/BrowserWindowController.m b/Tools/MiniBrowser/mac/BrowserWindowController.m
index 5c4efef..1f6fc04 100644
--- a/Tools/MiniBrowser/mac/BrowserWindowController.m
+++ b/Tools/MiniBrowser/mac/BrowserWindowController.m
@@ -648,6 +648,7 @@ static void runOpenPanel(WKPageRef page, WKFrameRef frame, WKOpenPanelParameters
         0, // printFrame
         0, // showModal
         0, // didCompleteRubberBandForMainFrame
+        0, // saveDataToFileInDownloadsFolder
     };
     WKPageSetPageUIClient(_webView.pageRef, &uiClient);
 }
diff --git a/Tools/MiniBrowser/qt/BrowserWindow.cpp b/Tools/MiniBrowser/qt/BrowserWindow.cpp
index 67d5696..53f7de9 100644
--- a/Tools/MiniBrowser/qt/BrowserWindow.cpp
+++ b/Tools/MiniBrowser/qt/BrowserWindow.cpp
@@ -61,6 +61,9 @@ BrowserWindow::BrowserWindow(QWKContext* context, WindowOptions* options)
     connect(m_browser->view(), SIGNAL(titleChanged(const QString&)), SLOT(setWindowTitle(const QString&)));
     connect(m_browser->view(), SIGNAL(urlChanged(const QUrl&)), SLOT(urlChanged(const QUrl&)));
 
+    if (m_windowOptions.printLoadedUrls)
+        connect(page(), SIGNAL(urlChanged(QUrl)), this, SLOT(printURL(QUrl)));
+
     this->setCentralWidget(m_browser);
     m_browser->setFocus(Qt::OtherFocusReason);
 
@@ -332,6 +335,12 @@ void BrowserWindow::showUserAgentDialog()
         page()->setCustomUserAgent(combo->currentText());
 }
 
+void BrowserWindow::printURL(const QUrl& url)
+{
+    QTextStream output(stdout);
+    output << "Loaded: " << url.toString() << endl;
+}
+
 void BrowserWindow::toggleDisableJavaScript(bool enable)
 {
     page()->preferences()->setAttribute(QWKPreferences::JavascriptEnabled, !enable);
diff --git a/Tools/MiniBrowser/qt/BrowserWindow.h b/Tools/MiniBrowser/qt/BrowserWindow.h
index c79b2d0..6ad8f27 100644
--- a/Tools/MiniBrowser/qt/BrowserWindow.h
+++ b/Tools/MiniBrowser/qt/BrowserWindow.h
@@ -69,6 +69,8 @@ protected slots:
     void toggleFrameFlattening(bool);
     void showUserAgentDialog();
 
+    void printURL(const QUrl&);
+
     void toggleAutoLoadImages(bool);
     void toggleDisableJavaScript(bool);
 
diff --git a/Tools/MiniBrowser/qt/MiniBrowser.pro b/Tools/MiniBrowser/qt/MiniBrowser.pro
index 0038823..809c934 100644
--- a/Tools/MiniBrowser/qt/MiniBrowser.pro
+++ b/Tools/MiniBrowser/qt/MiniBrowser.pro
@@ -56,6 +56,8 @@ contains(QT_CONFIG, opengl) {
     DEFINES += QT_CONFIGURED_WITH_OPENGL
 }
 
+DEFINES -= QT_ASCII_CAST_WARNINGS
+
 # We copy the resource file to the build directory.
 # The copier is defined in Tools/MiniBrowser/DerivedSources.pro.
 RESOURCES += \
diff --git a/Tools/MiniBrowser/qt/MiniBrowserApplication.cpp b/Tools/MiniBrowser/qt/MiniBrowserApplication.cpp
index d68d299..f40c870 100644
--- a/Tools/MiniBrowser/qt/MiniBrowserApplication.cpp
+++ b/Tools/MiniBrowser/qt/MiniBrowserApplication.cpp
@@ -60,6 +60,7 @@ void MiniBrowserApplication::handleUserOptions()
              << "[-robot-extra-time seconds]"
              << "[-chunked-drawing-area]"
              <<  "[-separate-web-process-per-window]"
+             << "[-print-loaded-urls]"
              << "URLs";
         appQuit(0);
     }
@@ -92,4 +93,7 @@ void MiniBrowserApplication::handleUserOptions()
 
     if (args.contains("-separate-web-process-per-window"))
         m_windowOptions.useSeparateWebProcessPerWindow = true;
+
+    if (args.contains("-print-loaded-urls"))
+        m_windowOptions.printLoadedUrls = true;
 }
diff --git a/Tools/MiniBrowser/qt/MiniBrowserApplication.h b/Tools/MiniBrowser/qt/MiniBrowserApplication.h
index 45dbde9..5a78820 100644
--- a/Tools/MiniBrowser/qt/MiniBrowserApplication.h
+++ b/Tools/MiniBrowser/qt/MiniBrowserApplication.h
@@ -36,11 +36,13 @@ struct WindowOptions {
     WindowOptions()
         : useTiledBackingStore(true)
         , useSeparateWebProcessPerWindow(false)
+        , printLoadedUrls(false)
     {
     }
 
     bool useTiledBackingStore;
     bool useSeparateWebProcessPerWindow;
+    bool printLoadedUrls;
 };
 
 class MiniBrowserApplication : public QApplication {
diff --git a/Tools/QtTestBrowser/QtTestBrowser.pro b/Tools/QtTestBrowser/QtTestBrowser.pro
index 6c8cdf4..4cd7ecb 100644
--- a/Tools/QtTestBrowser/QtTestBrowser.pro
+++ b/Tools/QtTestBrowser/QtTestBrowser.pro
@@ -26,6 +26,7 @@ CONFIG += uitools
 
 isEmpty(OUTPUT_DIR): OUTPUT_DIR = ../..
 include(../../Source/WebKit.pri)
+INCLUDEPATH += ../../Source/WebKit/qt/WebCoreSupport
 
 DESTDIR = $$OUTPUT_DIR/bin
 !CONFIG(standalone_package): CONFIG -= app_bundle
@@ -33,6 +34,11 @@ DESTDIR = $$OUTPUT_DIR/bin
 QT += network
 macx:QT+=xml
 
+unix:!mac:!symbian {
+    CONFIG += link_pkgconfig
+    PKGCONFIG += fontconfig
+}
+
 linux-* {
     # From Creator's src/rpath.pri:
     # Do the rpath by hand since it's not possible to use ORIGIN in QMAKE_RPATHDIR
@@ -57,5 +63,7 @@ contains(QT_CONFIG, opengl) {
     DEFINES += QT_CONFIGURED_WITH_OPENGL
 }
 
+DEFINES -= QT_ASCII_CAST_WARNINGS
+
 RESOURCES += \
     QtTestBrowser.qrc
diff --git a/Tools/QtTestBrowser/QtTestBrowser.qrc b/Tools/QtTestBrowser/QtTestBrowser.qrc
index ffe77b0..b6036e8 100644
--- a/Tools/QtTestBrowser/QtTestBrowser.qrc
+++ b/Tools/QtTestBrowser/QtTestBrowser.qrc
@@ -1,5 +1,6 @@
 <RCC>
     <qresource prefix="/">
         <file>useragentlist.txt</file>
+        <file>favicon.png</file>
     </qresource>
 </RCC>
diff --git a/Tools/QtTestBrowser/favicon.png b/Tools/QtTestBrowser/favicon.png
new file mode 100644
index 0000000..4462752
--- /dev/null
+++ b/Tools/QtTestBrowser/favicon.png
diff --git a/Tools/QtTestBrowser/launcherwindow.cpp b/Tools/QtTestBrowser/launcherwindow.cpp
index d76ad3a..f4db898 100644
--- a/Tools/QtTestBrowser/launcherwindow.cpp
+++ b/Tools/QtTestBrowser/launcherwindow.cpp
@@ -108,6 +108,10 @@ void LauncherWindow::initializeView()
         m_view = view;
     } else {
         WebViewGraphicsBased* view = new WebViewGraphicsBased(splitter);
+        m_view = view;
+#if defined(QT_CONFIGURED_WITH_OPENGL)
+        toggleQGLWidgetViewport(m_windowOptions.useQGLWidgetViewport);
+#endif
         view->setPage(page());
 
         connect(view, SIGNAL(currentFPSUpdated(int)), this, SLOT(updateFPS(int)));
@@ -116,8 +120,6 @@ void LauncherWindow::initializeView()
         // The implementation of QAbstractScrollArea::eventFilter makes us need
         // to install the event filter also on the viewport of a QGraphicsView.
         view->viewport()->installEventFilter(this);
-
-        m_view = view;
     }
 
     m_touchMocking = false;
@@ -128,6 +130,9 @@ void LauncherWindow::initializeView()
             this, SLOT(showLinkHover(const QString&, const QString&)));
     connect(this, SIGNAL(enteredFullScreenMode(bool)), this, SLOT(toggleFullScreenMode(bool)));
 
+    if (m_windowOptions.printLoadedUrls)
+        connect(page()->mainFrame(), SIGNAL(urlChanged(QUrl)), this, SLOT(printURL(QUrl)));
+
     applyPrefs();
 
     splitter->addWidget(m_inspector);
@@ -895,6 +900,12 @@ void LauncherWindow::showUserAgentDialog()
     delete dialog;
 }
 
+void LauncherWindow::printURL(const QUrl& url)
+{
+    QTextStream output(stdout);
+    output << "Loaded: " << url.toString() << endl;
+}
+
 void LauncherWindow::updateFPS(int fps)
 {
     QString fpsStatusText = QString("Current FPS: %1").arg(fps);
diff --git a/Tools/QtTestBrowser/launcherwindow.h b/Tools/QtTestBrowser/launcherwindow.h
index 0b8e87d..8bdad4d 100644
--- a/Tools/QtTestBrowser/launcherwindow.h
+++ b/Tools/QtTestBrowser/launcherwindow.h
@@ -61,13 +61,13 @@
 #include <qx11info_x11.h>
 #endif
 
+#include "DumpRenderTreeSupportQt.h"
 #include "mainwindow.h"
 #include "urlloader.h"
 #include "utils.h"
 #include "webinspector.h"
 #include "webpage.h"
 #include "webview.h"
-#include "../../Source/WebKit/qt/WebCoreSupport/DumpRenderTreeSupportQt.h"
 
 #ifdef Q_WS_MAEMO_5
 #include <X11/Xatom.h>
@@ -100,6 +100,10 @@ public:
 #if defined(QT_CONFIGURED_WITH_OPENGL)
         , useQGLWidgetViewport(false)
 #endif
+#if defined(Q_WS_X11)
+        , useTestFonts(false)
+#endif
+        , printLoadedUrls(false)
     {
     }
 
@@ -119,6 +123,10 @@ public:
 #if defined(QT_CONFIGURED_WITH_OPENGL)
     bool useQGLWidgetViewport;
 #endif
+#if defined(Q_WS_X11)
+    bool useTestFonts;
+#endif
+    bool printLoadedUrls;
     QUrl inspectorUrl;
     quint16 remoteInspectorPort;
 };
@@ -186,6 +194,8 @@ protected slots:
     void showFPS(bool enable);
     void showUserAgentDialog();
 
+    void printURL(const QUrl&);
+
 public slots:
     LauncherWindow* newWindow();
     LauncherWindow* cloneWindow();
diff --git a/Tools/QtTestBrowser/locationedit.cpp b/Tools/QtTestBrowser/locationedit.cpp
index 85bd222..04a6018 100644
--- a/Tools/QtTestBrowser/locationedit.cpp
+++ b/Tools/QtTestBrowser/locationedit.cpp
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies)
+ * Copyright (C) 2011 Andreas Kling <kling@webkit.org>
  *
  * All rights reserved.
  *
@@ -29,12 +30,35 @@
 
 #ifndef QT_NO_INPUTDIALOG
 
+static const QSize gPageIconSize(16, 16);
+
+static QPixmap defaultPageIcon()
+{
+    static QPixmap icon;
+    if (icon.isNull())
+        icon.load(":/favicon.png");
+
+    return icon;
+}
+
 LocationEdit::LocationEdit(QWidget* parent)
     : QLineEdit(parent)
     , m_progress(0)
 {
     m_clearTimer.setSingleShot(true);
     connect(&m_clearTimer, SIGNAL(timeout()), this, SLOT(reset()));
+
+    m_pageIconLabel = new QLabel(this);
+    m_pageIconLabel->setFixedSize(gPageIconSize);
+    m_pageIconLabel->setPixmap(defaultPageIcon());
+}
+
+void LocationEdit::setPageIcon(const QIcon& icon)
+{
+    if (icon.isNull())
+        m_pageIconLabel->setPixmap(defaultPageIcon());
+    else
+        m_pageIconLabel->setPixmap(icon.pixmap(gPageIconSize));
 }
 
 void LocationEdit::setProgress(int progress)
@@ -49,6 +73,30 @@ void LocationEdit::reset()
     setProgress(0);
 }
 
+void LocationEdit::resizeEvent(QResizeEvent*)
+{
+    updateInternalGeometry();
+}
+
+void LocationEdit::updateInternalGeometry()
+{
+    QStyleOptionFrameV3 styleOption;
+    initStyleOption(&styleOption);
+
+    QRect textRect = style()->subElementRect(QStyle::SE_LineEditContents, &styleOption, this);
+
+    const int spacing = 2;
+
+    int x = textRect.x() + spacing;
+    int y = (textRect.center().y() + 1) - gPageIconSize.height() / 2;
+
+    m_pageIconLabel->move(x, y);
+
+    QMargins margins = textMargins();
+    margins.setLeft(m_pageIconLabel->sizeHint().width() + spacing);
+    setTextMargins(margins);
+}
+
 void LocationEdit::paintEvent(QPaintEvent* ev)
 {
     QColor backgroundColor = QApplication::palette().color(QPalette::Base);
diff --git a/Tools/QtTestBrowser/locationedit.h b/Tools/QtTestBrowser/locationedit.h
index 962b422..e8afe70 100644
--- a/Tools/QtTestBrowser/locationedit.h
+++ b/Tools/QtTestBrowser/locationedit.h
@@ -39,6 +39,8 @@ class LocationEdit : public QLineEdit {
 public:
     LocationEdit(QWidget* parent = 0);
 
+    void setPageIcon(const QIcon&);
+
 public slots:
     void setProgress(int progress);
 
@@ -48,10 +50,14 @@ private slots:
 protected:
     virtual void paintEvent(QPaintEvent*);
     virtual void focusInEvent(QFocusEvent*);
+    virtual void resizeEvent(QResizeEvent*);
 
 private:
+    void updateInternalGeometry();
+
     int m_progress;
     QTimer m_clearTimer;
+    QLabel* m_pageIconLabel;
 };
 
 #endif
diff --git a/Tools/QtTestBrowser/main.cpp b/Tools/QtTestBrowser/main.cpp
index eecd9c3..059269c 100644
--- a/Tools/QtTestBrowser/main.cpp
+++ b/Tools/QtTestBrowser/main.cpp
@@ -35,8 +35,68 @@
 
 WindowOptions windowOptions;
 
+
+#include <QDir>
+#include <QFile>
+#include <QFileInfo>
+#include <QFontDatabase>
+
+
+#if defined(Q_WS_X11)
+#include <fontconfig/fontconfig.h>
+#endif
+
+
+#if defined(Q_WS_X11)
+// Very similar to WebCore::DumpRenderTree::initializeFonts();
+// Duplicated here so that QtTestBrowser would display contents
+// with the same fonts as run-webkit-tests/DumpRenderTree.
+static void initTestFonts()
+{
+    static int numFonts = -1;
+
+    // Some test cases may add or remove application fonts (via @font-face).
+    // Make sure to re-initialize the font set if necessary.
+    FcFontSet* appFontSet = FcConfigGetFonts(0, FcSetApplication);
+    if (appFontSet && numFonts >= 0 && appFontSet->nfont == numFonts)
+        return;
+
+    QByteArray fontDir = getenv("WEBKIT_TESTFONTS");
+    if (fontDir.isEmpty() || !QDir(fontDir).exists()) {
+        fprintf(stderr,
+                "\n\n"
+                "----------------------------------------------------------------------\n"
+                "WEBKIT_TESTFONTS environment variable is not set correctly.\n"
+                "This variable has to point to the directory containing the fonts\n"
+                "you can clone from git://gitorious.org/qtwebkit/testfonts.git\n"
+                "----------------------------------------------------------------------\n"
+               );
+        exit(1);
+    }
+    // Looks for qt/fonts.conf relative to the directory of the QtTestBrowser 
+    // executable.
+    QString configFileString = QCoreApplication::applicationDirPath();
+    configFileString += "/../../../Tools/DumpRenderTree/qt/fonts.conf";
+    QByteArray configFileArray = configFileString.toUtf8();
+    FcConfig* config = FcConfigCreate();
+    if (!FcConfigParseAndLoad (config, (FcChar8*) configFileArray.data(), true))
+        qFatal("Couldn't load font configuration file");
+    if (!FcConfigAppFontAddDir (config, (FcChar8*) fontDir.data()))
+        qFatal("Couldn't add font dir!");
+    FcConfigSetCurrent(config);
+
+    appFontSet = FcConfigGetFonts(config, FcSetApplication);
+    numFonts = appFontSet->nfont;
+}
+#endif
+
 int launcherMain(const QApplication& app)
 {
+#ifdef Q_WS_X11
+    if (windowOptions.useTestFonts)
+        initTestFonts();
+#endif
+
 #ifndef NDEBUG
     int retVal = app.exec();
     DumpRenderTreeSupportQt::garbageCollectorCollect();
@@ -117,6 +177,10 @@ void LauncherApplication::handleUserOptions()
         qDebug() << "Usage:" << programName.toLatin1().data()
              << "[-graphicsbased]"
              << "[-no-compositing]"
+#if defined(QT_CONFIGURED_WITH_OPENGL)
+             << "[-gl-viewport]"
+             << "[-webgl]"
+#endif
              << QString("[-viewport-update-mode %1]").arg(formatKeys(updateModes)).toLatin1().data()
              << "[-cache-webview]"
              << "[-show-fps]"
@@ -130,6 +194,10 @@ void LauncherApplication::handleUserOptions()
              << "[-offline-storage-database-enabled]"
              << "[-offline-web-application-cache-enabled]"
              << "[-set-offline-storage-default-quota maxSize]"
+#if defined(Q_WS_X11)
+             << "[-use-test-fonts]"
+#endif
+             << "[-print-loaded-urls]"
              << "URLs";
         appQuit(0);
     }
@@ -200,8 +268,21 @@ void LauncherApplication::handleUserOptions()
         requiresGraphicsView("-gl-viewport");
         windowOptions.useQGLWidgetViewport = true;
     }
+
+    if (args.contains("-webgl")) {
+        requiresGraphicsView("-webgl");
+        windowOptions.useWebGL = true;
+    }
 #endif
 
+#if defined(Q_WS_X11)
+    if (args.contains("-use-test-fonts"))
+        windowOptions.useTestFonts = true;
+#endif
+
+    if (args.contains("-print-loaded-urls"))
+        windowOptions.printLoadedUrls = true;
+
     QString inspectorUrlArg("-inspector-url");
     int inspectorUrlIndex = args.indexOf(inspectorUrlArg);
     if (inspectorUrlIndex != -1)
diff --git a/Tools/QtTestBrowser/mainwindow.cpp b/Tools/QtTestBrowser/mainwindow.cpp
index e2ea41d..dcd350d 100644
--- a/Tools/QtTestBrowser/mainwindow.cpp
+++ b/Tools/QtTestBrowser/mainwindow.cpp
@@ -84,8 +84,9 @@ void MainWindow::buildUI()
     connect(page(), SIGNAL(loadProgress(int)), urlEdit, SLOT(setProgress(int)));
 #endif
 
-    connect(page()->mainFrame(), SIGNAL(titleChanged(const QString&)),
-                this, SLOT(setWindowTitle(const QString&)));
+    connect(page()->mainFrame(), SIGNAL(loadStarted()), this, SLOT(onLoadStarted()));
+    connect(page()->mainFrame(), SIGNAL(iconChanged()), this, SLOT(onIconChanged()));
+    connect(page()->mainFrame(), SIGNAL(titleChanged(QString)), this, SLOT(onTitleChanged(QString)));
     connect(page(), SIGNAL(windowCloseRequested()), this, SLOT(close()));
 
 #ifndef QT_NO_SHORTCUT
@@ -219,3 +220,25 @@ void MainWindow::openLocation()
     urlEdit->setFocus();
 #endif
 }
+
+void MainWindow::onIconChanged()
+{
+#ifndef QT_NO_INPUTDIALOG
+    urlEdit->setPageIcon(page()->mainFrame()->icon());
+#endif
+}
+
+void MainWindow::onLoadStarted()
+{
+#ifndef QT_NO_INPUTDIALOG
+    urlEdit->setPageIcon(QIcon());
+#endif
+}
+
+void MainWindow::onTitleChanged(const QString& title)
+{
+    if (title.isEmpty())
+        setWindowTitle(QCoreApplication::applicationName());
+    else
+        setWindowTitle(QString::fromLatin1("%1 - %2").arg(title).arg(QCoreApplication::applicationName()));
+}
diff --git a/Tools/QtTestBrowser/mainwindow.h b/Tools/QtTestBrowser/mainwindow.h
index 08fa81e..f8baebc 100644
--- a/Tools/QtTestBrowser/mainwindow.h
+++ b/Tools/QtTestBrowser/mainwindow.h
@@ -58,6 +58,9 @@ protected slots:
     void openFile();
     void openLocation();
     void changeLocation();
+    void onIconChanged();
+    void onLoadStarted();
+    void onTitleChanged(const QString&);
 
 protected:
     QString addressUrl() const;
diff --git a/Tools/Scripts/build-jsc b/Tools/Scripts/build-jsc
index c9d4134..bdabd5a 100755
--- a/Tools/Scripts/build-jsc
+++ b/Tools/Scripts/build-jsc
@@ -69,8 +69,12 @@ if (isAppleMacWebKit()) {
     $result = buildVisualStudioProject("JavaScriptCore.vcproj/JavaScriptCore.sln");
 } elsif (isGtk()) {
     $result = buildGtkProject("JavaScriptCore");
-} elsif (isQt() or isWx()) {
-    # Qt builds everything in one-shot. No need to build anything here.
+} elsif (isQt()) {
+    # Remove duplicated --qt options to avoid passing them to qmake
+    checkForArgumentAndRemoveFromARGV("--qt");
+    $result = buildQMakeProject("JavaScriptCore", 0, @ARGV);
+} elsif (isWx()) {
+    # Builds everything in one-shot. No need to build anything here.
     $result = 0;
 } else {
     die "Building not defined for this platform!\n";
diff --git a/Tools/Scripts/build-webkit b/Tools/Scripts/build-webkit
index d5b4777..8ff638d 100755
--- a/Tools/Scripts/build-webkit
+++ b/Tools/Scripts/build-webkit
@@ -3,6 +3,7 @@
 # Copyright (C) 2005, 2006, 2007, 2008, 2009, 2010 Apple Inc. All rights reserved.
 # Copyright (C) 2009 Google Inc. All rights reserved.
 # Copyright (C) 2010 moiji-mobile.com All rights reserved.
+# Copyright (C) 2011 Research In Motion Limited. All rights reserved.
 #
 # Redistribution and use in source and binary forms, with or without
 # modification, are permitted provided that the following conditions
@@ -41,6 +42,7 @@ use webkitdirs;
 use webkitperl::features;
 use POSIX;
 
+sub cMakeArgsFromFeatures();
 sub checkForJavaSDK();
 sub formatBuildTime($);
 sub writeCongrats();
@@ -50,12 +52,13 @@ chdirWebKit();
 
 my $showHelp = 0;
 my $clean = 0;
+my $useGYP = 0;
 my $minimal = 0;
 my $v8 = 0;
 my $installHeaders;
 my $installLibs;
 my $prefixPath;
-my $makeArgs;
+my $makeArgs = "";
 my $noWebKit2 = 0;
 my $startTime = time();
 
@@ -87,6 +90,7 @@ my (
     $linkPrefetchSupport,
     $mathmlSupport,
     $mediaStatisticsSupport,
+    $mediaStreamSupport,
     $meterTagSupport,
     $netscapePluginSupport,
     $notificationsSupport,
@@ -203,6 +207,9 @@ my @features = (
     { option => "media-statistics", desc => "Toggle Media Statistics support",
       define => "ENABLE_MEDIA_STATISTICS", default => 0, value => \$mediaStatisticsSupport },
 
+    { option => "media-stream", desc => "Toggle Media Stream API support (implies Blob support, currently Chromium only)",
+      define => "ENABLE_MEDIA_STREAM", default => isChromium(), value => \$mediaStreamSupport },
+
     { option => "meter-tag", desc => "Meter Tag support",
       define => "ENABLE_METER_TAG", default => !isAppleWinWebKit(), value => \$meterTagSupport },
 
@@ -324,6 +331,7 @@ $svgSupport = $svgSupport || $svgAnimationSupport || $svgAsImageSupport
     || $svgDOMObjCBindingsSupport || $svgFontsSupport
     || $svgForeignObjectSupport || $svgUseSupport;
 
+$blobSupport = $blobSupport || $mediaStreamSupport;
 
 my $programName = basename($0);
 my $usage = <<EOF;
@@ -331,6 +339,8 @@ Usage: $programName [options] [options to pass to build system]
   --help                            Show this help message
   --clean                           Cleanup the build directory
   --debug                           Compile in debug mode
+  --gyp                             Use GYP-generated project files
+  --dsym                            Change debugging format to dwarf-with-dsym (Mac only)
 
   --chromium                        Build the Chromium port on Mac/Win/Linux
   --efl                             Build the EFL port
@@ -347,6 +357,7 @@ Usage: $programName [options] [options to pass to build system]
 
   --prefix=<path>                   Set installation prefix to the given path (Gtk/Efl only)
   --makeargs=<arguments>            Optional Makefile flags
+  --qmakearg=<arguments>            Optional qmake flags (Qt only, e.g. --qmakearg="CONFIG+=webkit2" to build WebKit2)
 
   --minimal                         No optional features, unless explicitly enabled.
 
@@ -355,6 +366,7 @@ EOF
 my %options = (
     'help' => \$showHelp,
     'clean' => \$clean,
+    'gyp' => \$useGYP,
     'install-headers=s' => \$installHeaders,
     'install-libs=s' => \$installLibs,
     'prefix=s' => \$prefixPath,
@@ -409,6 +421,11 @@ for my $dir (@projects, @otherDirs) {
     }
 }
 
+# Generate the generate project files from .gyp files
+if ($useGYP) {
+    system("perl", "Tools/Scripts/generate-project-files") == 0 or die "Failed to run generate-project-files";
+}
+
 my @options = ();
 
 # enable autotool options accordingly
@@ -419,7 +436,7 @@ if (isGtk()) {
     }
 
     push @options, "--prefix=" . $prefixPath if defined($prefixPath);
-    push @options, "--makeargs=" . $makeArgs if defined($makeArgs);
+    push @options, "--makeargs=" . $makeArgs if $makeArgs;
 } elsif (isAppleMacWebKit()) {
     checkForJavaSDK();
     push @options, XcodeOptions();
@@ -487,7 +504,7 @@ if (isGtk()) {
     @options = @ARGV;
     push @options, "--install-headers=" . $installHeaders if defined($installHeaders);
     push @options, "--install-libs=" . $installLibs if defined($installLibs);
-    push @options, "--makeargs=" . $makeArgs if defined($makeArgs);
+    push @options, "--makeargs=" . $makeArgs if $makeArgs;
 
     foreach (@features) {
         push @options, "DEFINES+=$_->{define}=${$_->{value}}" if ${$_->{value}} != $_->{default};
@@ -511,10 +528,7 @@ if (isInspectorFrontend()) {
 
 if (isWx()) {
     downloadWafIfNeeded();
-    @options = ();
-    if (defined($makeArgs)) {
-        @options = split(/ /, $makeArgs);
-    }
+    @options = split(/ /, $makeArgs);
     @projects = ();
     my $result = buildWafProject('.', $clean, @options);
     exit exitStatus($result) if exitStatus($result);
@@ -529,34 +543,13 @@ if (isChromium()) {
 }
 
 if (isEfl()) {
-    @options = ();
-    @projects = ();
-    foreach (@features) {
-        my $featureName = $_->{define};
-        if ($featureName) {
-            my $featureEnabled = ${$_->{value}} ? "ON" : "OFF";
-            push @options, "-D$featureName=$featureEnabled";
-        }
-    }
-    push @options, "--makeargs=" . $makeArgs if defined($makeArgs);
-    push @options, "--prefix=" . $prefixPath if defined($prefixPath);
-    my $result = buildCMakeEflProject($clean, @options);
-    exit exitStatus($result) if exitStatus($result);
+    # By default we build using all of the available CPUs.
+    $makeArgs .= ($makeArgs ? " " : "") . "-j" . numberOfCPUs() if $makeArgs !~ /-j\s*\d+/;
+    buildCMakeProjectOrExit($clean, "Efl", $prefixPath, $makeArgs, cMakeArgsFromFeatures());
 }
 
 if (isWinCE()) {
-    @options = ();
-    @projects = ();
-    foreach (@features) {
-        my $featureName = $_->{define};
-        if ($featureName) {
-            my $featureEnabled = ${$_->{value}} ? "ON" : "OFF";
-            push @options, "-D$featureName=$featureEnabled";
-        }
-    }
-    push @options, "--makeargs=" . $makeArgs if defined($makeArgs);
-    my $result = buildCMakeWinCEProject("STANDARDSDK_500 (ARMV4I)", $clean, @options);
-    exit exitStatus($result) if exitStatus($result);
+    buildCMakeProjectOrExit($clean, "WinCE", $prefixPath, $makeArgs, ("-DCMAKE_WINCE_SDK=\"STANDARDSDK_500 (ARMV4I)\"", cMakeArgsFromFeatures()));
 }
 
 # Build, and abort if the build fails.
@@ -579,7 +572,9 @@ for my $dir (@projects) {
     } elsif (isAppleMacWebKit()) {
         my @local_options = @options;
         push @local_options, XcodeCoverageSupportOptions() if $coverageSupport && $project ne "ANGLE";
-        $result = buildXCodeProject($project, $clean, @local_options, @ARGV);
+        my $useGYPProject = $useGYP && ($project =~ "WebCore|JavaScriptCore|JavaScriptGlue");
+        my $projectPath = $useGYPProject ? "gyp/$project" : $project;
+        $result = buildXCodeProject($projectPath, $clean, @local_options, @ARGV);
     } elsif (isAppleWinWebKit()) {
         if ($project eq "WebKit") {
             $result = buildVisualStudioProject("win/WebKit.vcproj/WebKit.sln", $clean);
@@ -613,6 +608,19 @@ writeCongrats();
 
 exit 0;
 
+sub cMakeArgsFromFeatures()
+{
+    my @args;
+    foreach (@features) {
+        my $featureName = $_->{define};
+        if ($featureName) {
+            my $featureEnabled = ${$_->{value}} ? "ON" : "OFF";
+            push @args, "-D$featureName=$featureEnabled";
+        }
+    }
+    return @args;
+}
+
 sub checkForJavaSDK()
 {
     my $jniHeader = "/System/Library/Frameworks/JavaVM.framework/Headers/jni.h";
diff --git a/Tools/Scripts/check-inspector-strings b/Tools/Scripts/check-inspector-strings
index 0350aca..dd850aa 100755
--- a/Tools/Scripts/check-inspector-strings
+++ b/Tools/Scripts/check-inspector-strings
@@ -40,10 +40,15 @@ from webkitpy.style.filereader import TextFileReader
 from webkitpy.style.main import change_directory
 
 _inspector_directory = "Source/WebCore/inspector/front-end"
+_devtools_directory = "Source/WebKit/chromium/src/js"
 _localized_strings = "Source/WebCore/English.lproj/localizedStrings.js"
 
 _log = logging.getLogger("check-inspector-strings")
 
+def decode_unicode_escapes(s):
+    xNN_converted_to_u00NN = s.replace("\\x", "\\u00")
+    return eval("ur\"" + xNN_converted_to_u00NN + "\"")
+
 class StringsExtractor(ProcessorBase):
     def __init__(self, patterns):
         self._patterns = patterns
@@ -54,9 +59,6 @@ class StringsExtractor(ProcessorBase):
     def should_process(self, file_path):
         return file_path.endswith(".js") and (not file_path.endswith("InjectedScript.js"))
 
-    def decode_unicode_escapes(self, s):
-        return eval("ur\"" + s + "\"")
-
     def process(self, lines, file_path, line_numbers=None):
         for line in lines:
             comment_start = line.find("//")
@@ -66,7 +68,7 @@ class StringsExtractor(ProcessorBase):
             for pattern in self._patterns:
                 line_strings = re.findall(pattern, line)
                 for string in line_strings:
-                    self.strings[index].append(self.decode_unicode_escapes(string))
+                    self.strings[index].append(decode_unicode_escapes(string))
                 index += 1
 
 class LocalizedStringsExtractor:
@@ -81,7 +83,7 @@ class LocalizedStringsExtractor:
             for line in lines:
                 match = re.match(r"localizedStrings\[\"((?:[^\"\\]|\\.)*?)\"", line)
                 if match:
-                    self.localized_strings.append(match.group(1))
+                    self.localized_strings.append(decode_unicode_escapes(match.group(1)))
         finally:
             localized_strings_file.close()
 
@@ -99,7 +101,7 @@ if __name__ == "__main__":
 
     strings_extractor = StringsExtractor([r"WebInspector\.(?:UIString|formatLocalized)\(\"((?:[^\"\\]|\\.)*?)\"", r"\"((?:[^\"\\]|\\.)*?)\""])
     file_reader = TextFileReader(strings_extractor)
-    file_reader.process_paths([_inspector_directory])
+    file_reader.process_paths([_inspector_directory, _devtools_directory])
     localized_strings_extractor = LocalizedStringsExtractor()
     localized_strings_extractor.process_file(_localized_strings)
     ui_strings = frozenset(strings_extractor.strings[0])
diff --git a/Tools/Scripts/do-webcore-rename b/Tools/Scripts/do-webcore-rename
index 6dbfc1f..da08cf7 100755
--- a/Tools/Scripts/do-webcore-rename
+++ b/Tools/Scripts/do-webcore-rename
@@ -125,8 +125,6 @@ my %renamesContemplatedForTheFuture = (
     "KURLMac" => "URLMac",
     "KURL_h" => "URL_h",
 
-    "ThreadSafeSharedBase" => "ThreadSafeRefCountedBase",
-    "ThreadSafeShared" => "ThreadSafeRefCounted",
     "TreeShared" => "TreeRefCounted",
 
     "StringImpl" => "SharedString",
diff --git a/Tools/Scripts/extract-localizable-strings b/Tools/Scripts/extract-localizable-strings
index b31550a..116f11f 100755
--- a/Tools/Scripts/extract-localizable-strings
+++ b/Tools/Scripts/extract-localizable-strings
@@ -51,11 +51,13 @@ my %isDebugMacro = ( ASSERT_WITH_MESSAGE => 1, LOG_ERROR => 1, ERROR => 1, NSURL
 @ARGV >= 2 or die "Usage: extract-localizable-strings <exceptions file> <file to update> [ directory... ]\nDid you mean to run update-webkit-localizable-strings instead?\n";
 
 my $exceptionsFile = shift @ARGV;
--f $exceptionsFile or die "Couldn't find exceptions file $exceptionsFile\n";
+-f $exceptionsFile or die "Couldn't find exceptions file $exceptionsFile\n" unless $exceptionsFile eq "-";
 
 my $fileToUpdate = shift @ARGV;
 -f $fileToUpdate or die "Couldn't find file to update $fileToUpdate\n";
 
+my $warnAboutUnlocalizedStrings = $exceptionsFile ne "-";
+
 my @directories = ();
 my @directoriesToSkip = ();
 if (@ARGV < 1) {
@@ -80,7 +82,7 @@ my $NSLocalizeCount = 0;
 my %exception;
 my %usedException;
 
-if (open EXCEPTIONS, $exceptionsFile) {
+if ($exceptionsFile ne "-" && open EXCEPTIONS, $exceptionsFile) {
     while (<EXCEPTIONS>) {
         chomp;
         if (/^"([^\\"]|\\.)*"$/ or /^[-_\/\w.]+.(h|m|mm|c|cpp)$/ or /^[-_\/\w.]+.(h|m|mm|c|cpp):"([^\\"]|\\.)*"$/) {
@@ -105,7 +107,7 @@ for my $dir (@directoriesToSkip) {
 my @files = ( split "\n", `find $quotedDirectoriesString \\( -name "*.h" -o -name "*.m" -o -name "*.mm" -o -name "*.c" -o -name "*.cpp" \\)` );
 
 for my $file (sort @files) {
-    next if $file =~ /\/\w+LocalizableStrings\.h$/;
+    next if $file =~ /\/\w+LocalizableStrings\w*\.h$/;
 
     $file =~ s-^./--;
 
@@ -167,7 +169,7 @@ handleString:
                         # FIXME: Validate UTF-8 here?
                         $UIString = $string;
                         $expected = ",";
-                    } elsif (($macro =~ /UI_STRING_KEY$/) and !defined $key) {
+                    } elsif (($macro =~ /UI_STRING_KEY(_INTERNAL)?$/) and !defined $key) {
                         # FIXME: Validate UTF-8 here?
                         $key = $string;
                         $expected = ",";
@@ -192,7 +194,7 @@ handleString:
                     } elsif ($exception{"$file:\"$string\""}) {
                         $usedException{"$file:\"$string\""} = 1;
                     } else {
-                        print "$file:$stringLine:\"$string\" is not marked for localization\n";
+                        print "$file:$stringLine:\"$string\" is not marked for localization\n" if $warnAboutUnlocalizedStrings;
                         $notLocalizedCount++;
                     }
                 }
@@ -226,7 +228,7 @@ handleString:
                     $sawError = 1;
                     $expected = "";
                 }
-                if ($token =~ /UI_STRING(_KEY)?$/) {
+                if ($token =~ /UI_STRING(_KEY)?(_INTERNAL)?$/) {
                     $expected = "(";
                     $macro = $token;
                     $UIString = undef;
diff --git a/Tools/Scripts/generate-project-files b/Tools/Scripts/generate-project-files
new file mode 100755
index 0000000..60a32e1
--- /dev/null
+++ b/Tools/Scripts/generate-project-files
@@ -0,0 +1,38 @@
+#!/usr/bin/perl -w
+
+# Copyright (C) 2011 Google Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+#
+# 1.  Redistributions of source code must retain the above copyright
+#     notice, this list of conditions and the following disclaimer. 
+# 2.  Redistributions in binary form must reproduce the above copyright
+#     notice, this list of conditions and the following disclaimer in the
+#     documentation and/or other materials provided with the distribution. 
+# 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+#     its contributors may be used to endorse or promote products derived
+#     from this software without specific prior written permission. 
+#
+# THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+# EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+# WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+# DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+# DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+# (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+# ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+# THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+use strict;
+use FindBin;
+use lib $FindBin::Bin;
+use webkitdirs;
+
+chdirWebKit();
+
+# This simple wrapper exists so that the configure logic can live in the Source directory.
+# This allows building from Source without a copy of Tools (as Apple's internal builds do).
+system("python", "Source/gyp/configure", @ARGV) == 0 or die "Failed to run Source/gyp/configure";
diff --git a/Tools/Scripts/new-run-webkit-httpd b/Tools/Scripts/new-run-webkit-httpd
index f6ec164..4122993 100755
--- a/Tools/Scripts/new-run-webkit-httpd
+++ b/Tools/Scripts/new-run-webkit-httpd
@@ -65,7 +65,8 @@ def run(options):
                                      tempfile.gettempdir(),
                                      port=options.port,
                                      root=options.root,
-                                     run_background=options.run_background)
+                                     run_background=options.run_background,
+                                     layout_tests_dir=options.layout_tests_dir)
         if options.server == 'start':
             httpd.start()
         else:
@@ -85,6 +86,9 @@ def main():
     option_parser.add_option('--run_background', action="store_true",
         dest="run_background",
         help='Run on background (for running as UI test)')
+    option_parser.add_option('--layout_tests_dir',
+        dest="layout_tests_dir",
+        help='Absolute path to LayoutTests root')
     options, args = option_parser.parse_args()
 
     # FIXME: Make this work with other ports as well.
diff --git a/Tools/Scripts/old-run-webkit-tests b/Tools/Scripts/old-run-webkit-tests
index a0c9d21..fe9bdd0 100755
--- a/Tools/Scripts/old-run-webkit-tests
+++ b/Tools/Scripts/old-run-webkit-tests
@@ -49,6 +49,7 @@
 use strict;
 use warnings;
 
+use CGI;
 use Config;
 use Cwd;
 use Data::Dumper;
@@ -139,7 +140,7 @@ my $ignoreMetrics = 0;
 my $webSocketPort = 8880;
 # wss is disabled until all platforms support pyOpenSSL.
 # my $webSocketSecurePort = 9323;
-my $ignoreTests = '';
+my @ignoreTests;
 my $iterations = 1;
 my $launchSafari = 1;
 my $mergeDepth;
@@ -187,6 +188,7 @@ $testHTTP = 0 if (isWx());
 my $perlInterpreter = "perl";
 
 my $expectedTag = "expected";
+my $mismatchTag = "mismatch";
 my $actualTag = "actual";
 my $prettyDiffTag = "pretty-diff";
 my $diffsTag = "diffs";
@@ -329,7 +331,7 @@ my $getOptionsResult = GetOptions(
     'http!' => \$testHTTP,
     'wait-for-httpd!' => \$shouldWaitForHTTPD,
     'ignore-metrics!' => \$ignoreMetrics,
-    'ignore-tests|i=s' => \$ignoreTests,
+    'ignore-tests|i=s' => \@ignoreTests,
     'iterations=i' => \$iterations,
     'launch-safari!' => \$launchSafari,
     'leaks|l' => \$shouldCheckLeaks,
@@ -544,6 +546,9 @@ if (!$hasAcceleratedCompositing) {
     # compositing is enabled.
     $ignoredFiles{'svg/custom/use-on-symbol-inside-pattern.svg'} = 1;
 
+    # This test has an iframe that is put in a layer only in compositing mode.
+    $ignoredFiles{'media/media-document-audio-repaint.html'} = 1;
+
     if (isAppleWebKit()) {
         # In Apple's ports, the default controls for <video> contain a "full
         # screen" button only if accelerated compositing is enabled.
@@ -594,7 +599,7 @@ if (!checkWebCoreFeatureSupport("XHTMLMP", 0)) {
     $ignoredDirectories{'fast/xhtmlmp'} = 1;
 }
 
-processIgnoreTests($ignoreTests, "ignore-tests") if $ignoreTests;
+processIgnoreTests(join(',', @ignoreTests), "ignore-tests") if @ignoreTests;
 if (!$ignoreSkipped) {
     if (!$skippedOnly || @ARGV == 0) {
         readSkippedFiles("");
@@ -1246,6 +1251,7 @@ sub countAndPrintLeaks($$$)
             "getVMInitArgs", # <rdar://problem/7714444> leak in Java
             "Java_java_lang_System_initProperties", # <rdar://problem/7714465> leak in Java
             "glrCompExecuteKernel", # <rdar://problem/7815391> leak in graphics driver while using OpenGL
+            "NSNumberFormatter getObjectValue:forString:errorDescription:", # <rdar://problem/7149350> Leak in NSNumberFormatter
         );
     }
 
@@ -1679,7 +1685,14 @@ sub expectedDirectoryForTest($;$;$)
     my ($base, $isText, $expectedExtension) = @_;
 
     my @directories = @platformResultHierarchy;
-    push @directories, map { catdir($platformBaseDirectory, $_) } qw(mac-snowleopard mac) if isAppleWinWebKit();
+
+    my @extraPlatforms = ();
+    if (isAppleWinWebKit()) {
+        push @extraPlatforms, "mac-wk2" if $platform eq "win-wk2";
+        push @extraPlatforms, qw(mac-snowleopard mac);
+    }
+  
+    push @directories, map { catdir($platformBaseDirectory, $_) } @extraPlatforms;
     push @directories, $expectedDirectory;
 
     # If we already have expected results, just return their location.
@@ -2046,7 +2059,7 @@ sub linksForErrorTest
 
     my $crashLogText = "crash log";
     if (my $crashLocation = crashLocation($base)) {
-        $crashLogText .= " (<code>" . $crashLocation . "</code>)";
+        $crashLogText .= " (<code>" . CGI::escapeHTML($crashLocation) . "</code>)";
     }
 
     push @links, @{linksForExpectedAndActualResults($base)};
@@ -2446,6 +2459,16 @@ sub readSkippedFiles($)
 
 my @testsFound;
 
+sub isUsedInReftest
+{
+    my $filename = $_;
+    if ($filename =~ /-$expectedTag(-$mismatchTag)?\.html$/) {
+        return 1;
+    }
+    my $base = stripExtension($filename);
+    return (-f "$base-$expectedTag.html" || -f "$base-$expectedTag-$mismatchTag.html");
+}
+
 sub directoryFilter
 {
     return () if exists $ignoredLocalDirectories{basename($File::Find::dir)};
@@ -2457,7 +2480,8 @@ sub fileFilter
 {
     my $filename = $_;
     if ($filename =~ /\.([^.]+)$/) {
-        if (exists $supportedFileExtensions{$1}) {
+        my $extension = $1;
+        if (exists $supportedFileExtensions{$extension} && !isUsedInReftest($filename)) {
             my $path = File::Spec->abs2rel(catfile($File::Find::dir, $filename), $testDirectory);
             push @testsFound, $path if !exists $ignoredFiles{$path};
         }
diff --git a/Tools/Scripts/read-checksum-from-png b/Tools/Scripts/read-checksum-from-png
new file mode 100755
index 0000000..ab08b25
--- /dev/null
+++ b/Tools/Scripts/read-checksum-from-png
@@ -0,0 +1,39 @@
+#!/usr/bin/env python
+# Copyright (c) 2011 Google Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are
+# met:
+#
+#     * Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+#     * Redistributions in binary form must reproduce the above
+# copyright notice, this list of conditions and the following disclaimer
+# in the documentation and/or other materials provided with the
+# distribution.
+#     * Neither the name of Google Inc. nor the names of its
+# contributors may be used to endorse or promote products derived from
+# this software without specific prior written permission.
+#
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+from __future__ import with_statement
+import sys
+
+from webkitpy.layout_tests import read_checksum_from_png
+
+
+if '__main__' == __name__:
+    for filename in sys.argv[1:]:
+        with open(filename, 'r') as filehandle:
+            print "%s: %s" % (read_checksum_from_png.read_checksum(filehandle), filename)
diff --git a/Tools/Scripts/run-gtk-tests b/Tools/Scripts/run-gtk-tests
index 9a57319..43c73c2 100644
--- a/Tools/Scripts/run-gtk-tests
+++ b/Tools/Scripts/run-gtk-tests
@@ -32,4 +32,17 @@ my @unitTests = glob  $productDir . "/Programs/unittests/*";
 if ($#unitTests < 1) {
     die "ERROR: tests not found in $productDir.\n";
 }
-system "gtester -k @unitTests"
+
+my $exitStatus = 0;
+foreach my $unitTest (@unitTests)
+{
+    system "gtester $unitTest";
+    if ($?) {
+        $exitStatus = $?;
+    }
+}
+
+if ($exitStatus) {
+    print "Tests failed\n";
+    exit $exitStatus;
+}
diff --git a/Tools/Scripts/show-pretty-diff b/Tools/Scripts/show-pretty-diff
new file mode 100755
index 0000000..2a17d3f
--- /dev/null
+++ b/Tools/Scripts/show-pretty-diff
@@ -0,0 +1,77 @@
+#!/usr/bin/perl -w
+
+# Copyright (C) 2011 Apple Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+# 1. Redistributions of source code must retain the above copyright
+#    notice, this list of conditions and the following disclaimer.
+# 2. Redistributions in binary form must reproduce the above copyright
+#    notice, this list of conditions and the following disclaimer in the
+#    documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+# THE POSSIBILITY OF SUCH DAMAGE.
+
+use strict;
+use FindBin;
+use File::Temp qw(tempfile);
+use lib $FindBin::Bin;
+use webkitdirs;
+
+my $inputPath = "";
+if ($ARGV[0]) {
+    $inputPath = $ARGV[0]
+} else {
+    # Create a temporary file for STDIN.
+    # FIXME: We can probably avoid putting this on the disk by directly piping
+    # to prettify.rb via IPC::Open2.
+    my $inputTempFileHandle;
+    ($inputTempFileHandle, $inputPath) = tempfile(
+        "inputtemp-XXXXXXXX",
+        DIR => File::Spec->tmpdir(),
+        SUFFIX => ".diff",
+        UNLINK => 0,
+    );
+
+    while (<STDIN>) {
+        print $inputTempFileHandle $_;
+    }
+
+    close($inputTempFileHandle);
+}
+
+# Create a temporary file for prettified patch.
+my ($prettydiffFileHandle, $prettydiffPath) = tempfile(
+    "prettydiff-XXXXXXXX",
+    DIR => File::Spec->tmpdir(),
+    SUFFIX => ".html",
+    UNLINK => 0,
+);
+close($prettydiffFileHandle);
+
+my $prettyPatchDir = sourceDir() . "/Websites/bugs.webkit.org/PrettyPatch/";
+my $prettyPatchTool = sourceDir() . "/Websites/bugs.webkit.org/PrettyPatch/prettify.rb";
+
+my $pathToPrettify = "ruby -I " . sourceDir() . "/Websites/bugs.webkit.org/PrettyPatch/ " . sourceDir() . "/Websites/bugs.webkit.org/PrettyPatch/prettify.rb";
+system "$pathToPrettify $inputPath > $prettydiffPath";
+
+if (isAppleMacWebKit()) {
+    system "open", $prettydiffPath;
+} elsif (isCygwin()) {
+    system "cygstart",$prettydiffPath;
+} elsif (isWindows()) {
+    system "start", $prettydiffPath;
+} else {
+    print "Created prettified diff at " . $prettydiffPath . ".";
+}
diff --git a/Tools/Scripts/update-webkit b/Tools/Scripts/update-webkit
index c6e54f3..5c132ae 100755
--- a/Tools/Scripts/update-webkit
+++ b/Tools/Scripts/update-webkit
@@ -45,6 +45,7 @@ sub runGitUpdate();
 # Handle options
 my $quiet = '';
 my $showHelp;
+my $useGYP = 0;
 
 determineIsChromium();
 
@@ -53,6 +54,7 @@ chdirWebKit();
 my $getOptionsResult = GetOptions(
     'h|help'  => \$showHelp,
     'q|quiet' => \$quiet,
+    'gyp' => \$useGYP,
 ); 
 
 if (!$getOptionsResult || $showHelp) {
@@ -61,6 +63,7 @@ Usage: @{[ basename($0) ]} [options]
   --chromium  also update dependencies of the chromium port
   -h|--help   show the help message
   -q|--quiet  pass -q to svn update for quiet updates
+  --gyp       generate project files from gyp after update
 __END__
     exit 1;
 }
@@ -97,6 +100,11 @@ if (-d "../Internal") {
 
 setupAppleWinEnv() if isAppleWinWebKit();
 
+if ($useGYP) {
+    print "Generating Project Files\n";
+    system("perl", "Tools/Scripts/generate-project-files") == 0 or die "Failed to run generate-project-files";
+}
+
 exit 0;
 
 sub runSvnUpdate()
diff --git a/Tools/Scripts/update-webkit-localizable-strings b/Tools/Scripts/update-webkit-localizable-strings
index 4baa8d6..0a0ada9 100755
--- a/Tools/Scripts/update-webkit-localizable-strings
+++ b/Tools/Scripts/update-webkit-localizable-strings
@@ -34,13 +34,18 @@ use FindBin;
 use lib $FindBin::Bin;
 use webkitdirs;
 
-my @directoriesToScan = ("Source/WebKit/mac", "Source/WebKit/win", "-Source/WebCore/icu", "-Source/WebKit/mac/icu");
-my $fileToUpdate = "Source/WebKit/English.lproj/Localizable.strings";
-my $exceptionsFile = "Source/WebKit/StringsNotToBeLocalized.txt";
+# WebKit and WebKit2 strings go into WebCore's Localizable.strings.
+my @directoriesToScan = ("Source/WebCore", "Source/WebKit/mac", "Source/WebKit2", "-Source/WebCore/icu", "-Source/WebKit/mac/icu");
+my $fileToUpdate = "Source/WebCore/English.lproj/Localizable.strings";
 
 @ARGV == 0 or die "Usage: " . basename($0) . "\n";
 
 chdirWebKit();
 
-system "sort -u $exceptionsFile -o $exceptionsFile";
-exec "./Tools/Scripts/extract-localizable-strings", $exceptionsFile, $fileToUpdate, @directoriesToScan;
+system "Tools/Scripts/extract-localizable-strings", "-", $fileToUpdate, @directoriesToScan;
+
+# FIXME: the following can be removed and "Source/WebKit/win" added above once Windows uses WebCore's Localizable.strings. <rdar://problem/9119405>
+my @webKitDirectoriesToScan = ("Source/WebKit/win");
+my $webKitFileToUpdate = "Source/WebKit/English.lproj/Localizable.strings";
+
+system "Tools/Scripts/extract-localizable-strings", "-", $webKitFileToUpdate, @webKitDirectoriesToScan;
diff --git a/Tools/Scripts/webkitdirs.pm b/Tools/Scripts/webkitdirs.pm
index 1820f1e..d27caba 100644
--- a/Tools/Scripts/webkitdirs.pm
+++ b/Tools/Scripts/webkitdirs.pm
@@ -1,5 +1,6 @@
 # Copyright (C) 2005, 2006, 2007, 2010 Apple Inc. All rights reserved.
 # Copyright (C) 2009 Google Inc. All rights reserved.
+# Copyright (C) 2011 Research In Motion Limited. All rights reserved.
 #
 # Redistribution and use in source and binary forms, with or without
 # modification, are permitted provided that the following conditions
@@ -59,6 +60,7 @@ my $configurationProductDir;
 my $sourceDir;
 my $currentSVNRevision;
 my $osXVersion;
+my $generateDsym;
 my $isQt;
 my $qmakebin = "qmake"; # Allow override of the qmake binary from $PATH
 my $isSymbian;
@@ -291,7 +293,7 @@ sub determineConfigurationForVisualStudio
 {
     return if defined $configurationForVisualStudio;
     determineConfiguration();
-    # FIXME: We should detect when Debug_All or Release_LTCG has been chosen.
+    # FIXME: We should detect when Debug_All or Production has been chosen.
     $configurationForVisualStudio = $configuration;
 }
 
@@ -388,12 +390,31 @@ sub currentSVNRevision
     return $currentSVNRevision;
 }
 
+sub generateDsym()
+{
+    determineGenerateDsym();
+    return $generateDsym;
+}
+
+sub determineGenerateDsym()
+{
+    return if defined($generateDsym);
+    $generateDsym = checkForArgumentAndRemoveFromARGV("--dsym");
+}
+
+sub argumentsForXcode()
+{
+    my @args = ();
+    push @args, "DEBUG_INFORMATION_FORMAT=dwarf-with-dsym" if generateDsym();
+    return @args;
+}
+
 sub XcodeOptions
 {
     determineBaseProductDir();
     determineConfiguration();
     determineArchitecture();
-    return (@baseProductDirOption, "-configuration", $configuration, "ARCHS=$architecture");
+    return (@baseProductDirOption, "-configuration", $configuration, "ARCHS=$architecture", argumentsForXcode());
 }
 
 sub XcodeOptionString
@@ -990,7 +1011,7 @@ sub isWindowsNT()
 
 sub relativeScriptsDir()
 {
-    my $scriptDir = File::Spec->catpath("", File::Spec->abs2rel(dirname($0), getcwd()), "");
+    my $scriptDir = File::Spec->catpath("", File::Spec->abs2rel($FindBin::Bin, getcwd()), "");
     if ($scriptDir eq "") {
         $scriptDir = ".";
     }
@@ -1476,95 +1497,84 @@ sub buildAutotoolsProject($@)
     return $result;
 }
 
-sub buildCMakeProject($@)
+sub generateBuildSystemFromCMakeProject
 {
-    my ($port, $clean, @buildParams) = @_;
-    my $dir = File::Spec->canonpath(baseProductDir());
+    my ($port, $prefixPath, @cmakeArgs) = @_;
     my $config = configuration();
-    my $result;
-    my $cmakeBuildArgs = "";
-    my $makeArgs = "";
-    my @buildArgs;
-
-    if ($port =~ m/wince/i) {
-        if ($config =~ m/debug/i) {
-            $cmakeBuildArgs .= " --config Debug";
-        } elsif ($config =~ m/release/i) {
-            $cmakeBuildArgs .= " --config Release";
-        }
-    } else {
-        $makeArgs .= " -j" . numberOfCPUs() if ($makeArgs !~ m/-j\s*\d+/);
-    }
+    my $buildPath = File::Spec->catdir(baseProductDir(), $config);
+    File::Path::mkpath($buildPath) unless -d $buildPath;
+    my $originalWorkingDirectory = getcwd();
+    chdir($buildPath) or die;
 
-    if ($clean) {
-        print "Cleaning the build directory '$dir'\n";
-        $dir = File::Spec->catfile($dir, $config);
-        File::Path::remove_tree($dir, {keep_root => 1});
-        $result = 0;
-    } else {
-        my $cmakebin = "cmake";
-        my $cmakeBuildCommand = $cmakebin . " --build .";
-
-        push @buildArgs, "-DPORT=$port";
-
-        for my $i (0 .. $#buildParams) {
-            my $opt = $buildParams[$i];
-            if ($opt =~ /^--makeargs=(.*)/i ) {
-                $makeArgs = $1;
-            } elsif ($opt =~ /^--prefix=(.*)/i ) {
-                push @buildArgs, "-DCMAKE_INSTALL_PREFIX=$1";
-            } else {
-                push @buildArgs, $opt;
-            }
-        }
-
-        if ($config =~ m/debug/i) {
-            push @buildArgs, "-DCMAKE_BUILD_TYPE=Debug";
-        } elsif ($config =~ m/release/i) {
-            push @buildArgs, "-DCMAKE_BUILD_TYPE=Release";
-        }
-
-        push @buildArgs, sourceDir() . "/Source";
-
-        $dir = File::Spec->catfile($dir, $config);
-        File::Path::mkpath($dir);
-        chdir $dir or die "Failed to cd into " . $dir . "\n";
-        
-        print "Calling '$cmakebin @buildArgs' in " . $dir . "\n\n";
-        my $result = system "$cmakebin @buildArgs";
-        if ($result ne 0) {
-            die "Failed while running $cmakebin to generate makefiles!\n";
-        }
+    my @args;
+    push @args, "-DPORT=\"$port\"";
+    push @args, "-DCMAKE_INSTALL_PREFIX=\"$prefixPath\"" if $prefixPath;
+    if ($config =~ /release/i) {
+        push @args, "-DCMAKE_BUILD_TYPE=Release";
+    } elsif ($config =~ /debug/i) {
+        push @args, "-DCMAKE_BUILD_TYPE=Debug";
+    }
+    push @args, @cmakeArgs if @cmakeArgs;
+    push @args, '"' . File::Spec->catdir(sourceDir(), "Source") . '"';
 
-        $cmakeBuildArgs .= " -- " . $makeArgs;
+    # We call system("cmake @args") instead of system("cmake", @args) so that @args is
+    # parsed for shell metacharacters.
+    my $returnCode = system("cmake @args");
 
-        print "Calling '$cmakeBuildCommand $cmakeBuildArgs' in " . $dir . "\n\n";
-        $result = system "$cmakeBuildCommand $cmakeBuildArgs";
-        if ($result ne 0) {
-            die "Failed to build $port port\n";
-        }
+    chdir($originalWorkingDirectory);
+    return $returnCode;
+}
 
-        chdir ".." or die;
+sub buildCMakeGeneratedProject($)
+{
+    my ($makeArgs) = @_;
+    my $config = configuration();
+    my $buildPath = File::Spec->catdir(baseProductDir(), $config);
+    if (! -d $buildPath) {
+        die "Must call generateBuildSystemFromCMakeProject() before building CMake project.";
     }
+    my @args = ("--build", $buildPath, "--config", $config);
+    push @args, ("--", $makeArgs) if $makeArgs;
 
-    return $result; 
+    # We call system("cmake @args") instead of system("cmake", @args) so that @args is
+    # parsed for shell metacharacters. In particular, $makeArgs may contain such metacharacters.
+    return system("cmake @args");
 }
 
-sub buildCMakeEflProject($@)
+sub cleanCMakeGeneratedProject()
 {
-    my ($clean, @buildArgs) = @_;
-    return buildCMakeProject("Efl", $clean, @buildArgs);
+    my $config = configuration();
+    my $buildPath = File::Spec->catdir(baseProductDir(), $config);
+    if (-d $buildPath) {
+        return system("cmake", "--build", $buildPath, "--config", $config, "--target", "clean");
+    }
+    return 0;
 }
 
-sub buildCMakeWinCEProject($@)
+sub buildCMakeProjectOrExit($$$$@)
 {
-    my ($sdk, $clean, @buildArgs) = @_;
-    return buildCMakeProject("WinCE -DCMAKE_WINCE_SDK=\"" . $sdk . "\"", $clean, @buildArgs);
+    my ($clean, $port, $prefixPath, $makeArgs, @cmakeArgs) = @_;
+    my $returnCode;
+    if ($clean) {
+        $returnCode = exitStatus(cleanCMakeGeneratedProject());
+        exit($returnCode) if $returnCode;
+    }
+    $returnCode = exitStatus(generateBuildSystemFromCMakeProject($port, $prefixPath, @cmakeArgs));
+    exit($returnCode) if $returnCode;
+    $returnCode = exitStatus(buildCMakeGeneratedProject($makeArgs));
+    exit($returnCode) if $returnCode;
 }
 
 sub buildQMakeProject($@)
 {
-    my ($clean, @buildParams) = @_;
+    my ($project, $clean, @buildParams) = @_;
+
+    my @subdirs = ("JavaScriptCore", "WebCore", "WebKit/qt/Api");
+    if (grep { $_ eq $project } @subdirs) {
+        @subdirs = ($project);
+    } else {
+        $project = 0;
+    }
 
     my @buildArgs = ("-r");
 
@@ -1610,6 +1620,9 @@ sub buildQMakeProject($@)
     my @dsQmakeArgs = @buildArgs;
     push @dsQmakeArgs, "-r";
     push @dsQmakeArgs, sourceDir() . "/Source/DerivedSources.pro";
+    if ($project) {
+        push @dsQmakeArgs, "-after SUBDIRS=" . $project. "/DerivedSources.pro";
+    }
     push @dsQmakeArgs, "-o Makefile.DerivedSources";
     print "Calling '$qmakebin @dsQmakeArgs' in " . $dir . "\n\n";
     my $result = system "$qmakebin @dsQmakeArgs";
@@ -1617,23 +1630,24 @@ sub buildQMakeProject($@)
         die "Failed while running $qmakebin to generate derived sources!\n";
     }
 
-    # FIXME: Iterate over different source directories manually to workaround a problem with qmake+extraTargets+s60
-    # To avoid overwriting of Makefile.DerivedSources in the root dir use Makefile.DerivedSources.Tools for Tools
-    my @subdirs = ("JavaScriptCore", "WebCore", "WebKit/qt/Api");
-    if (grep { $_ eq "CONFIG+=webkit2"} @buildArgs) {
-        push @subdirs, "WebKit2";
-        if ( -e sourceDir() ."/Tools/DerivedSources.pro" ) {
-            @dsQmakeArgs = @buildArgs;
-            push @dsQmakeArgs, "-r";
-            push @dsQmakeArgs, sourceDir() . "/Tools/DerivedSources.pro";
-            push @dsQmakeArgs, "-o Makefile.DerivedSources.Tools";
-            print "Calling '$qmakebin @dsQmakeArgs' in " . $dir . "\n\n";
-            my $result = system "$qmakebin @dsQmakeArgs";
-            if ($result ne 0) {
-                die "Failed while running $qmakebin to generate derived sources for Tools!\n";
+    if ($project ne "JavaScriptCore") {
+        # FIXME: Iterate over different source directories manually to workaround a problem with qmake+extraTargets+s60
+        # To avoid overwriting of Makefile.DerivedSources in the root dir use Makefile.DerivedSources.Tools for Tools
+        if (grep { $_ eq "CONFIG+=webkit2"} @buildArgs) {
+            push @subdirs, "WebKit2";
+            if ( -e sourceDir() ."/Tools/DerivedSources.pro" ) {
+                @dsQmakeArgs = @buildArgs;
+                push @dsQmakeArgs, "-r";
+                push @dsQmakeArgs, sourceDir() . "/Tools/DerivedSources.pro";
+                push @dsQmakeArgs, "-o Makefile.DerivedSources.Tools";
+                print "Calling '$qmakebin @dsQmakeArgs' in " . $dir . "\n\n";
+                my $result = system "$qmakebin @dsQmakeArgs";
+                if ($result ne 0) {
+                    die "Failed while running $qmakebin to generate derived sources for Tools!\n";
+                }
+                push @subdirs, "MiniBrowser";
+                push @subdirs, "WebKitTestRunner";
             }
-            push @subdirs, "MiniBrowser";
-            push @subdirs, "WebKitTestRunner";
         }
     }
 
@@ -1666,6 +1680,12 @@ sub buildQMakeProject($@)
         }
     }
 
+    if ($project) {
+        push @buildArgs, "-after SUBDIRS=" . $project . "/" . $project . ".pro ";
+        if ($project eq "JavaScriptCore") {
+            push @buildArgs, "-after SUBDIRS+=" . $project . "/jsc.pro ";
+        }
+    }
     push @buildArgs, sourceDir() . "/Source/WebKit.pro";
     print "Calling '$qmakebin @buildArgs' in " . $dir . "\n\n";
     print "Installation headers directory: $installHeaders\n" if(defined($installHeaders));
@@ -1676,36 +1696,44 @@ sub buildQMakeProject($@)
        die "Failed to setup build environment using $qmakebin!\n";
     }
 
-    $buildArgs[-1] = sourceDir() . "/Tools/Tools.pro";
-    my $makefile = "Makefile.Tools";
+    my $makefile = "";
+    if (!$project) {
+        $buildArgs[-1] = sourceDir() . "/Tools/Tools.pro";
+        $makefile = "Makefile.Tools";
 
-    # On Symbian qmake needs to run in the same directory where the pro file is located.
-    if (isSymbian()) {
-        $dir = $sourceDir . "/Tools";
-        chdir $dir or die "Failed to cd into " . $dir . "\n";
-        $makefile = "bld.inf";
-    }
+        # On Symbian qmake needs to run in the same directory where the pro file is located.
+        if (isSymbian()) {
+            $dir = $sourceDir . "/Tools";
+            chdir $dir or die "Failed to cd into " . $dir . "\n";
+            $makefile = "bld.inf";
+        }
 
-    print "Calling '$qmakebin @buildArgs -o $makefile' in " . $dir . "\n\n";
-    $result = system "$qmakebin @buildArgs -o $makefile";
-    if ($result ne 0) {
-       die "Failed to setup build environment using $qmakebin!\n";
+        print "Calling '$qmakebin @buildArgs -o $makefile' in " . $dir . "\n\n";
+        $result = system "$qmakebin @buildArgs -o $makefile";
+        if ($result ne 0) {
+            die "Failed to setup build environment using $qmakebin!\n";
+        }
     }
 
-    # Manually create makefiles for the examples so we don't build by default
-    my $examplesDir = $dir . "/WebKit/qt/examples";
-    File::Path::mkpath($examplesDir);
-    $buildArgs[-1] = sourceDir() . "/Source/WebKit/qt/examples/examples.pro";
-    chdir $examplesDir or die;
-    print "Calling '$qmakebin @buildArgs' in " . $examplesDir . "\n\n";
-    $result = system "$qmakebin @buildArgs";
-    die "Failed to create makefiles for the examples!\n" if $result ne 0;
-    chdir $dir or die;
+    if (!$project) {
+        # Manually create makefiles for the examples so we don't build by default
+        my $examplesDir = $dir . "/WebKit/qt/examples";
+        File::Path::mkpath($examplesDir);
+        $buildArgs[-1] = sourceDir() . "/Source/WebKit/qt/examples/examples.pro";
+        chdir $examplesDir or die;
+        print "Calling '$qmakebin @buildArgs' in " . $examplesDir . "\n\n";
+        $result = system "$qmakebin @buildArgs";
+        die "Failed to create makefiles for the examples!\n" if $result ne 0;
+        chdir $dir or die;
+    }
 
-    my $makeTools = "echo No Makefile for Tools. Skipping make";
+    my $makeTools = "echo";
+    if (!$project) {
+        $makeTools = "echo No Makefile for Tools. Skipping make";
 
-    if (-e "$dir/$makefile") {
-        $makeTools = "$make $makeargs -f $makefile";
+        if (-e "$dir/$makefile") {
+            $makeTools = "$make $makeargs -f $makefile";
+        }
     }
 
     if ($clean) {
@@ -1730,7 +1758,7 @@ sub buildQMakeQtProject($$@)
 {
     my ($project, $clean, @buildArgs) = @_;
 
-    return buildQMakeProject($clean, @buildArgs);
+    return buildQMakeProject("", $clean, @buildArgs);
 }
 
 sub buildGtkProject
diff --git a/Tools/Scripts/webkitpy/common/checkout/api.py b/Tools/Scripts/webkitpy/common/checkout/api.py
index 170b822..5c21028 100644
--- a/Tools/Scripts/webkitpy/common/checkout/api.py
+++ b/Tools/Scripts/webkitpy/common/checkout/api.py
@@ -35,7 +35,7 @@ from webkitpy.common.checkout.commitinfo import CommitInfo
 from webkitpy.common.checkout.scm import CommitMessage
 from webkitpy.common.checkout.deps import DEPS
 from webkitpy.common.memoized import memoized
-from webkitpy.common.net.bugzilla import parse_bug_id
+from webkitpy.common.net.bugzilla import parse_bug_id_from_changelog
 from webkitpy.common.system.executive import Executive, run_command, ScriptError
 from webkitpy.common.system.deprecated_logging import log
 
@@ -85,7 +85,7 @@ class Checkout(object):
             return None
         changelog_entry = changelog_entries[0]
         changelog_data = {
-            "bug_id": parse_bug_id(changelog_entry.contents()),
+            "bug_id": parse_bug_id_from_changelog(changelog_entry.contents()),
             "author_name": changelog_entry.author_name(),
             "author_email": changelog_entry.author_email(),
             "author": changelog_entry.author(),
@@ -145,7 +145,7 @@ class Checkout(object):
 
     def bug_id_for_this_commit(self, git_commit, changed_files=None):
         try:
-            return parse_bug_id(self.commit_message_for_this_commit(git_commit, changed_files).message())
+            return parse_bug_id_from_changelog(self.commit_message_for_this_commit(git_commit, changed_files).message())
         except ScriptError, e:
             pass # We might not have ChangeLogs.
 
diff --git a/Tools/Scripts/webkitpy/common/checkout/changelog.py b/Tools/Scripts/webkitpy/common/checkout/changelog.py
index ccdf9ca..a86b7a9 100644
--- a/Tools/Scripts/webkitpy/common/checkout/changelog.py
+++ b/Tools/Scripts/webkitpy/common/checkout/changelog.py
@@ -36,7 +36,7 @@ import textwrap
 
 from webkitpy.common.system.deprecated_logging import log
 from webkitpy.common.config.committers import CommitterList
-from webkitpy.common.net.bugzilla import parse_bug_id
+from webkitpy.common.net.bugzilla import parse_bug_id_from_changelog
 
 
 class ChangeLogEntry(object):
@@ -87,7 +87,7 @@ class ChangeLogEntry(object):
         return self._contents
 
     def bug_id(self):
-        return parse_bug_id(self._contents)
+        return parse_bug_id_from_changelog(self._contents)
 
 
 # FIXME: Various methods on ChangeLog should move into ChangeLogEntry instead.
diff --git a/Tools/Scripts/webkitpy/common/checkout/scm.py b/Tools/Scripts/webkitpy/common/checkout/scm.py
index 70f65b5..e436402 100644
--- a/Tools/Scripts/webkitpy/common/checkout/scm.py
+++ b/Tools/Scripts/webkitpy/common/checkout/scm.py
@@ -29,6 +29,7 @@
 #
 # Python module for interacting with an SCM system (like SVN or Git)
 
+import logging
 import os
 import re
 import sys
@@ -290,7 +291,7 @@ class SCM:
     def revert_files(self, file_paths):
         self._subclass_must_implement()
 
-    def commit_with_message(self, message, username=None, git_commit=None, force_squash=False):
+    def commit_with_message(self, message, username=None, git_commit=None, force_squash=False, changed_files=None):
         self._subclass_must_implement()
 
     def svn_commit_log(self, svn_revision):
@@ -555,12 +556,8 @@ class SVN(SCM):
         # FIXME: This should probably use cwd=self.checkout_root.
         self.run(['svn', 'revert'] + file_paths)
 
-    def commit_with_message(self, message, username=None, git_commit=None, force_squash=False):
+    def commit_with_message(self, message, username=None, git_commit=None, force_squash=False, changed_files=None):
         # git-commit and force are not used by SVN.
-        if self.dryrun:
-            # Return a string which looks like a commit so that things which parse this output will succeed.
-            return "Dry run, no commit.\nCommitted revision 0."
-
         svn_commit_args = ["svn", "commit"]
 
         if not username and not self.has_authorization_for_realm():
@@ -569,6 +566,17 @@ class SVN(SCM):
             svn_commit_args.extend(["--username", username])
 
         svn_commit_args.extend(["-m", message])
+
+        if changed_files:
+            svn_commit_args.extend(changed_files)
+
+        if self.dryrun:
+            _log = logging.getLogger("webkitpy.common.system")
+            _log.debug('Would run SVN command: "' + " ".join(svn_commit_args) + '"')
+
+            # Return a string which looks like a commit so that things which parse this output will succeed.
+            return "Dry run, no commit.\nCommitted revision 0."
+
         # FIXME: Should this use cwd=self.checkout_root?
         return self.run(svn_commit_args, error_handler=commit_error_handler)
 
@@ -826,7 +834,7 @@ class Git(SCM):
             if num_local_commits > 1 or (num_local_commits > 0 and not working_directory_is_clean):
                 raise AmbiguousCommitError(num_local_commits, working_directory_is_clean)
 
-    def commit_with_message(self, message, username=None, git_commit=None, force_squash=False):
+    def commit_with_message(self, message, username=None, git_commit=None, force_squash=False, changed_files=None):
         # Username is ignored during Git commits.
         working_directory_is_clean = self.working_directory_is_clean()
 
diff --git a/Tools/Scripts/webkitpy/common/config/build.py b/Tools/Scripts/webkitpy/common/config/build.py
index 355fa96..42d0721 100644
--- a/Tools/Scripts/webkitpy/common/config/build.py
+++ b/Tools/Scripts/webkitpy/common/config/build.py
@@ -33,17 +33,18 @@ def _should_file_trigger_build(target_platform, file):
     # precendence over later ones.
 
     # FIXME: The patterns below have only been verified to be correct on
-    # Windows. We should implement this for other platforms and start using
-    # it for their bots. Someone familiar with each platform will have to
-    # figure out what the right set of directories/patterns is for that
-    # platform.
-    assert(target_platform == "win")
+    # the platforms listed below. We should implement this for other platforms
+    # and start using it for their bots. Someone familiar with each platform
+    # will have to figure out what the right set of directories/patterns is for
+    # that platform.
+    assert(target_platform in ("mac-leopard", "mac-snowleopard", "win"))
 
     directories = [
         # Directories that shouldn't trigger builds on any bots.
+        ("Examples", []),
         ("PerformanceTests", []),
         ("Source/WebCore/manual-tests", []),
-        ("Examples", []),
+        ("Tools/BuildSlaveSupport/build.webkit.org-config/public_html", []),
         ("Websites", []),
         ("android", []),
         ("brew", []),
@@ -53,14 +54,13 @@ def _should_file_trigger_build(target_platform, file):
         ("opengl", []),
         ("opentype", []),
         ("openvg", []),
-        ("wx", []),
         ("wince", []),
+        ("wx", []),
 
         # Directories that should trigger builds on only some bots.
         ("Source/JavaScriptGlue", ["mac"]),
-        ("LayoutTests/platform/mac", ["mac", "win"]),
-        ("LayoutTests/platform/mac-snowleopard", ["mac-snowleopard", "win"]),
         ("Source/WebCore/image-decoders", ["chromium"]),
+        ("LayoutTests/platform/mac", ["mac", "win"]),
         ("cairo", ["gtk", "wincairo"]),
         ("cf", ["chromium-mac", "mac", "qt", "win"]),
         ("chromium", ["chromium"]),
@@ -72,7 +72,7 @@ def _should_file_trigger_build(target_platform, file):
         ("gtk", ["gtk"]),
         ("mac", ["chromium-mac", "mac"]),
         ("mac-leopard", ["mac-leopard"]),
-        ("mac-snowleopard", ["mac-snowleopard"]),
+        ("mac-snowleopard", ["mac", "win"]),
         ("mac-wk2", ["mac-snowleopard", "win"]),
         ("objc", ["mac"]),
         ("qt", ["qt"]),
diff --git a/Tools/Scripts/webkitpy/common/config/build_unittest.py b/Tools/Scripts/webkitpy/common/config/build_unittest.py
index 1e075be..9144874 100644
--- a/Tools/Scripts/webkitpy/common/config/build_unittest.py
+++ b/Tools/Scripts/webkitpy/common/config/build_unittest.py
@@ -39,13 +39,13 @@ class ShouldBuildTest(unittest.TestCase):
         (["LayoutTests/platform/chromium-linux/foo"], ["chromium-linux"]),
         (["LayoutTests/platform/chromium-win/fast/compact/001-expected.txt"], ["chromium-win"]),
         (["LayoutTests/platform/mac-leopard/foo"], ["mac-leopard"]),
-        (["LayoutTests/platform/mac-snowleopard/foo"], ["mac-snowleopard", "win"]),
+        (["LayoutTests/platform/mac-snowleopard/foo"], ["mac-leopard", "mac-snowleopard", "win"]),
         (["LayoutTests/platform/mac-wk2/Skipped"], ["mac-snowleopard", "win"]),
         (["LayoutTests/platform/mac/foo"], ["mac-leopard", "mac-snowleopard", "win"]),
         (["LayoutTests/platform/win-xp/foo"], ["win"]),
         (["LayoutTests/platform/win-wk2/foo"], ["win"]),
         (["LayoutTests/platform/win/foo"], ["win"]),
-        (["Source/WebCore.exp.in", "Source/WebKit/mac/WebKit.exp"], ["mac"]),
+        (["Source/WebCore.exp.in", "Source/WebKit/mac/WebKit.exp"], ["mac-leopard", "mac-snowleopard"]),
         (["Source/WebCore/mac/foo"], ["chromium-mac", "mac-leopard", "mac-snowleopard"]),
         (["Source/WebCore/win/foo"], ["chromium-win", "win"]),
         (["Source/WebCore/platform/graphics/gpu/foo"], ["mac-leopard", "mac-snowleopard"]),
@@ -53,13 +53,14 @@ class ShouldBuildTest(unittest.TestCase):
         (["Source/WebCore/rendering/RenderThemeMac.mm", "Source/WebCore/rendering/RenderThemeMac.h"], ["mac-leopard", "mac-snowleopard"]),
         (["Source/WebCore/rendering/RenderThemeChromiumLinux.h"], ["chromium-linux"]),
         (["Source/WebCore/rendering/RenderThemeWinCE.h"], []),
+        (["Tools/BuildSlaveSupport/build.webkit.org-config/public_html/LeaksViewer/LeaksViewer.js"], []),
     ]
 
     def test_should_build(self):
         for files, platforms in self._should_build_tests:
             # FIXME: We should test more platforms here once
             # build._should_file_trigger_build is implemented for them.
-            for platform in ["win"]:
+            for platform in ["mac-leopard", "mac-snowleopard", "win"]:
                 should_build = platform in platforms or "*" in platforms
                 self.assertEqual(build.should_build(platform, files), should_build, "%s should%s have built but did%s (files: %s)" % (platform, "" if should_build else "n't", "n't" if should_build else "", str(files)))
 
diff --git a/Tools/Scripts/webkitpy/common/config/committers.py b/Tools/Scripts/webkitpy/common/config/committers.py
index 76f4741..fd9bdbb 100644
--- a/Tools/Scripts/webkitpy/common/config/committers.py
+++ b/Tools/Scripts/webkitpy/common/config/committers.py
@@ -71,6 +71,7 @@ committers_unable_to_review = [
     Committer("Alejandro G. Castro", ["alex@igalia.com", "alex@webkit.org"]),
     Committer("Alexander Kellett", ["lypanov@mac.com", "a-lists001@lypanov.net", "lypanov@kde.org"], "lypanov"),
     Committer("Alexander Pavlov", "apavlov@chromium.org", "apavlov"),
+    Committer("Alexis Menard", ["alexis.menard@openbossa.org", "menard@kde.org"], "darktears"),
     Committer("Andre Boule", "aboule@apple.com"),
     Committer("Andrei Popescu", "andreip@google.com", "andreip"),
     Committer("Andrew Wellington", ["andrew@webkit.org", "proton@wiretapped.net"], "proton"),
@@ -87,7 +88,6 @@ committers_unable_to_review = [
     Committer("Benjamin Otte", ["otte@gnome.org", "otte@webkit.org"], "otte"),
     Committer("Brent Fulgham", "bfulgham@webkit.org", "bfulgham"),
     Committer("Brett Wilson", "brettw@chromium.org", "brettx"),
-    Committer("Brian Weinstein", "bweinstein@apple.com", "bweinstein"),
     Committer("Cameron McCormack", "cam@webkit.org", "heycam"),
     Committer("Carlos Garcia Campos", ["cgarcia@igalia.com", "carlosgc@gnome.org", "carlosgc@webkit.org"], "KaL"),
     Committer("Carol Szabo", "carol.szabo@nokia.com"),
@@ -119,7 +119,7 @@ committers_unable_to_review = [
     Committer("Girish Ramakrishnan", ["girish@forwardbias.in", "ramakrishnan.girish@gmail.com"]),
     Committer("Graham Dennis", ["Graham.Dennis@gmail.com", "gdennis@webkit.org"]),
     Committer("Greg Bolsinga", "bolsinga@apple.com"),
-    Committer("Gyuyoung Kim", ["gyuyoung.kim@samsung.com", "gyuyoung@gmail.com", "gyuyoung@webkit.org"], "gyuyoung"),
+    Committer("Gyuyoung Kim", ["gyuyoung.kim@samsung.com", "gyuyoung.kim@webkit.org"], "gyuyoung"),
     Committer("Hans Wennborg", "hans@chromium.org", "hwennborg"),
     Committer("Hayato Ito", "hayato@chromium.org", "hayato"),
     Committer("Helder Correia", "helder@sencha.com", "helder"),
@@ -142,7 +142,7 @@ committers_unable_to_review = [
     Committer("Jochen Eisinger", "jochen@chromium.org", "jochen__"),
     Committer("John Abd-El-Malek", "jam@chromium.org", "jam"),
     Committer("John Gregg", ["johnnyg@google.com", "johnnyg@chromium.org"], "johnnyg"),
-    Committer("John Knottenbelt", ["jknotten@chromium.org"], "jknotten"),
+    Committer("John Knottenbelt", "jknotten@chromium.org", "jknotten"),
     Committer("Johnny Ding", ["jnd@chromium.org", "johnnyding.webkit@gmail.com"], "johnnyding"),
     Committer("Joone Hur", ["joone.hur@collabora.co.uk", "joone@kldp.org", "joone@webkit.org"], "joone"),
     Committer("Joost de Valk", ["joost@webkit.org", "webkit-dev@joostdevalk.nl"], "Altha"),
@@ -152,6 +152,7 @@ committers_unable_to_review = [
     Committer("Justin Schuh", "jschuh@chromium.org", "jschuh"),
     Committer("Keishi Hattori", "keishi@webkit.org", "keishi"),
     Committer("Kelly Norton", "knorton@google.com"),
+    Committer("Kenji Imasaki", "imasaki@chromium.org", "imasaki"),
     Committer("Kent Hansen", "kent.hansen@nokia.com", "khansen"),
     Committer("Kimmo Kinnunen", ["kimmo.t.kinnunen@nokia.com", "kimmok@iki.fi", "ktkinnun@webkit.org"], "kimmok"),
     Committer("Kinuko Yasuda", "kinuko@chromium.org", "kinuko"),
@@ -160,6 +161,7 @@ committers_unable_to_review = [
     Committer("Leandro Pereira", ["leandro@profusion.mobi", "leandro@webkit.org"], "acidx"),
     Committer("Levi Weintraub", ["leviw@chromium.org", "leviw@google.com", "lweintraub@apple.com"], "leviw"),
     Committer("Lucas De Marchi", ["lucas.demarchi@profusion.mobi", "demarchi@webkit.org"], "demarchi"),
+    Committer("Lucas Forschler", ["lforschler@apple.com"], "lforschler"),
     Committer("Luiz Agostini", ["luiz@webkit.org", "luiz.agostini@openbossa.org"], "lca"),
     Committer("Mads Ager", "ager@chromium.org"),
     Committer("Marcus Voltis Bulach", "bulach@chromium.org"),
@@ -238,6 +240,7 @@ reviewers_list = [
     Reviewer("Benjamin Poulain", ["benjamin@webkit.org", "benjamin.poulain@nokia.com", "ikipou@gmail.com"], "benjaminp"),
     Reviewer("Beth Dakin", "bdakin@apple.com", "dethbakin"),
     Reviewer("Brady Eidson", "beidson@apple.com", "bradee-oh"),
+    Reviewer("Brian Weinstein", "bweinstein@apple.com", "bweinstein"),
     Reviewer("Cameron Zwarich", ["zwarich@apple.com", "cwzwarich@apple.com", "cwzwarich@webkit.org"]),
     Reviewer("Chris Blumenberg", "cblu@apple.com", "cblu"),
     Reviewer("Chris Marrin", "cmarrin@apple.com", "cmarrin"),
diff --git a/Tools/Scripts/webkitpy/common/config/ports.py b/Tools/Scripts/webkitpy/common/config/ports.py
index 163d5ef..9a5a269 100644
--- a/Tools/Scripts/webkitpy/common/config/ports.py
+++ b/Tools/Scripts/webkitpy/common/config/ports.py
@@ -41,6 +41,10 @@ class WebKitPort(object):
     def script_path(cls, script_name):
         return os.path.join("Tools", "Scripts", script_name)
 
+    @classmethod
+    def script_shell_command(cls, script_name):
+        return [cls.script_path(script_name)]
+
     @staticmethod
     def port(port_name):
         ports = {
@@ -76,11 +80,11 @@ class WebKitPort(object):
 
     @classmethod
     def update_webkit_command(cls):
-        return [cls.script_path("update-webkit")]
+        return cls.script_shell_command("update-webkit")
 
     @classmethod
     def build_webkit_command(cls, build_style=None):
-        command = [cls.script_path("build-webkit")]
+        command = cls.script_shell_command("build-webkit")
         if build_style == "debug":
             command.append("--debug")
         if build_style == "release":
@@ -89,19 +93,19 @@ class WebKitPort(object):
 
     @classmethod
     def run_javascriptcore_tests_command(cls):
-        return [cls.script_path("run-javascriptcore-tests")]
+        return cls.script_shell_command("run-javascriptcore-tests")
 
     @classmethod
     def run_webkit_tests_command(cls):
-        return [cls.script_path("run-webkit-tests")]
+        return cls.script_shell_command("run-webkit-tests")
 
     @classmethod
     def run_python_unittests_command(cls):
-        return [cls.script_path("test-webkitpy")]
+        return cls.script_shell_command("test-webkitpy")
 
     @classmethod
     def run_perl_unittests_command(cls):
-        return [cls.script_path("test-webkitperl")]
+        return cls.script_shell_command("test-webkitperl")
 
     @classmethod
     def layout_tests_results_path(cls):
@@ -226,11 +230,10 @@ class ChromiumPort(WebKitPort):
 
     @classmethod
     def run_webkit_tests_command(cls):
-        return [
-            cls.script_path("new-run-webkit-tests"),
-            "--chromium",
-            "--no-pixel-tests",
-        ]
+        command = cls.script_shell_command("new-run-webkit-tests")
+        command.append("--chromium")
+        command.append("--no-pixel-tests")
+        return command
 
     @classmethod
     def run_javascriptcore_tests_command(cls):
diff --git a/Tools/Scripts/webkitpy/common/net/bugzilla/__init__.py b/Tools/Scripts/webkitpy/common/net/bugzilla/__init__.py
index cfaf3b1..bde67c6 100644
--- a/Tools/Scripts/webkitpy/common/net/bugzilla/__init__.py
+++ b/Tools/Scripts/webkitpy/common/net/bugzilla/__init__.py
@@ -2,7 +2,7 @@
 
 # We only export public API here.
 # FIXME: parse_bug_id should not be a free function.
-from .bugzilla import Bugzilla, parse_bug_id
+from .bugzilla import Bugzilla, parse_bug_id, parse_bug_id_from_changelog
 # Unclear if Bug and Attachment need to be public classes.
 from .bug import Bug
 from .attachment import Attachment
diff --git a/Tools/Scripts/webkitpy/common/net/bugzilla/bugzilla.py b/Tools/Scripts/webkitpy/common/net/bugzilla/bugzilla.py
index 17a8515..8daf92e 100644
--- a/Tools/Scripts/webkitpy/common/net/bugzilla/bugzilla.py
+++ b/Tools/Scripts/webkitpy/common/net/bugzilla/bugzilla.py
@@ -53,22 +53,34 @@ from webkitpy.thirdparty.BeautifulSoup import BeautifulSoup, SoupStrainer
 def parse_bug_id(message):
     if not message:
         return None
-    match = re.search("http\://webkit\.org/b/(?P<bug_id>\d+)", message)
+    match = re.search(Bugzilla.bug_url_short, message)
     if match:
         return int(match.group('bug_id'))
-    match = re.search(
-        Bugzilla.bug_server_regex + "show_bug\.cgi\?id=(?P<bug_id>\d+)",
-        message)
+    match = re.search(Bugzilla.bug_url_long, message)
     if match:
         return int(match.group('bug_id'))
     return None
 
 
+# FIXME: parse_bug_id_from_changelog should not be a free function.
+# Parse the bug ID out of a Changelog message based on the format that is
+# used by prepare-ChangeLog
+def parse_bug_id_from_changelog(message):
+    if not message:
+        return None
+    match = re.search("^\s*" + Bugzilla.bug_url_short + "$", message, re.MULTILINE)
+    if match:
+        return int(match.group('bug_id'))
+    match = re.search("^\s*" + Bugzilla.bug_url_long + "$", message, re.MULTILINE)
+    if match:
+        return int(match.group('bug_id'))
+    return None
+
 def timestamp():
     return datetime.now().strftime("%Y%m%d%H%M%S")
 
 
-# A container for all of the logic for making and parsing buzilla queries.
+# A container for all of the logic for making and parsing bugzilla queries.
 class BugzillaQueries(object):
 
     def __init__(self, bugzilla):
@@ -210,6 +222,8 @@ class Bugzilla(object):
     bug_server_host = "bugs.webkit.org"
     bug_server_regex = "https?://%s/" % re.sub('\.', '\\.', bug_server_host)
     bug_server_url = "https://%s/" % bug_server_host
+    bug_url_long = bug_server_regex + r"show_bug\.cgi\?id=(?P<bug_id>\d+)(&ctype=xml)?"
+    bug_url_short = r"http\://webkit\.org/b/(?P<bug_id>\d+)"
 
     def quips(self):
         # We only fetch and parse the list of quips once per instantiation
diff --git a/Tools/Scripts/webkitpy/common/net/bugzilla/bugzilla_unittest.py b/Tools/Scripts/webkitpy/common/net/bugzilla/bugzilla_unittest.py
index 1d08ca5..2e75ca9 100644
--- a/Tools/Scripts/webkitpy/common/net/bugzilla/bugzilla_unittest.py
+++ b/Tools/Scripts/webkitpy/common/net/bugzilla/bugzilla_unittest.py
@@ -30,7 +30,7 @@ import unittest
 import datetime
 import StringIO
 
-from .bugzilla import Bugzilla, BugzillaQueries, parse_bug_id
+from .bugzilla import Bugzilla, BugzillaQueries, parse_bug_id, parse_bug_id_from_changelog
 
 from webkitpy.common.system.outputcapture import OutputCapture
 from webkitpy.tool.mocktool import MockBrowser
@@ -192,6 +192,33 @@ ZEZpbmlzaExvYWRXaXRoUmVhc29uOnJlYXNvbl07Cit9CisKIEBlbmQKIAogI2VuZGlmCg==
         }],
     }
 
+    def test_parse_bug_id_from_changelog(self):
+        commit_text = '''
+2011-03-23  Ojan Vafai  <ojan@chromium.org>
+
+        Add failing result for WebKit2. All tests that require
+        focus fail on WebKit2. See https://bugs.webkit.org/show_bug.cgi?id=56988.
+
+        * platform/mac-wk2/fast/css/pseudo-any-expected.txt: Added.
+
+        '''
+
+        self.assertEquals(None, parse_bug_id_from_changelog(commit_text))
+
+        commit_text = '''
+2011-03-23  Ojan Vafai  <ojan@chromium.org>
+
+        Add failing result for WebKit2. All tests that require
+        focus fail on WebKit2. See https://bugs.webkit.org/show_bug.cgi?id=56988.
+        https://bugs.webkit.org/show_bug.cgi?id=12345
+
+        * platform/mac-wk2/fast/css/pseudo-any-expected.txt: Added.
+
+        '''
+
+        self.assertEquals(12345, parse_bug_id_from_changelog(commit_text))
+
+
     # FIXME: This should move to a central location and be shared by more unit tests.
     def _assert_dictionaries_equal(self, actual, expected):
         # Make sure we aren't parsing more or less than we expect
diff --git a/Tools/Scripts/webkitpy/common/net/buildbot/buildbot.py b/Tools/Scripts/webkitpy/common/net/buildbot/buildbot.py
index 9dd165c..d23a6cc 100644
--- a/Tools/Scripts/webkitpy/common/net/buildbot/buildbot.py
+++ b/Tools/Scripts/webkitpy/common/net/buildbot/buildbot.py
@@ -42,9 +42,11 @@ import urllib2
 from webkitpy.common.net.failuremap import FailureMap
 from webkitpy.common.net.layouttestresults import LayoutTestResults
 from webkitpy.common.net.regressionwindow import RegressionWindow
+from webkitpy.common.net.testoutputset import TestOutputSet
 from webkitpy.common.system.logutils import get_logger
-from webkitpy.thirdparty.autoinstalled.mechanize import Browser
+from webkitpy.common.system.zipfileset import ZipFileSet
 from webkitpy.thirdparty.BeautifulSoup import BeautifulSoup
+from webkitpy.thirdparty.autoinstalled.mechanize import Browser
 
 _log = get_logger(__file__)
 
@@ -92,6 +94,12 @@ class Builder(object):
         self._builds_cache[build_number] = build
         return build
 
+    def latest_cached_build(self):
+        revision_build_pairs = self.revision_build_pairs_with_results()
+        revision_build_pairs.sort(key=lambda i: i[1])
+        latest_build_number = revision_build_pairs[-1][1]
+        return self.build(latest_build_number)
+
     def force_build(self, username="webkit-patch", comments=None):
         def predicate(form):
             try:
@@ -221,6 +229,12 @@ class Build(object):
         results_directory = "r%s (%s)" % (self.revision(), self._number)
         return "%s/%s" % (self._builder.results_url(), urllib.quote(results_directory))
 
+    def results_zip_url(self):
+        return "%s.zip" % self.results_url()
+
+    def results(self):
+        return TestOutputSet(self._builder.name(), None, ZipFileSet(self.results_zip_url()), include_expected=False)
+
     def _fetch_results_html(self):
         results_html = "%s/results.html" % (self.results_url())
         # FIXME: This should use NetworkTransaction's 404 handling instead.
@@ -268,8 +282,10 @@ class BuildBot(object):
             "SnowLeopard.*Build",
             "SnowLeopard.*\(Test",
             "SnowLeopard.*\(WebKit2 Test",
-            "Leopard.*Release",
+            "Leopard.*",
             "Windows.*Build",
+            "Windows.*\(Test",
+            "WinCairo",
             "WinCE",
             "EFL",
             "GTK.*32",
diff --git a/Tools/Scripts/webkitpy/common/net/buildbot/buildbot_unittest.py b/Tools/Scripts/webkitpy/common/net/buildbot/buildbot_unittest.py
index 6addb56..300bc88 100644
--- a/Tools/Scripts/webkitpy/common/net/buildbot/buildbot_unittest.py
+++ b/Tools/Scripts/webkitpy/common/net/buildbot/buildbot_unittest.py
@@ -231,32 +231,37 @@ class BuildBotTest(unittest.TestCase):
             {'name': u'SnowLeopard Intel Release (WebKit2 Tests)', },
             {'name': u'SnowLeopard Intel Leaks', },
             {'name': u'Windows Release (Build)', },
-            {'name': u'Windows Release (Tests)', },
+            {'name': u'Windows 7 Release (Tests)', },
             {'name': u'Windows Debug (Build)', },
-            {'name': u'Windows Debug (Tests)', },
+            {'name': u'Windows XP Debug (Tests)', },
+            {'name': u'Windows 7 Release (WebKit2 Tests)', },
             {'name': u'GTK Linux 32-bit Release', },
             {'name': u'GTK Linux 32-bit Debug', },
             {'name': u'GTK Linux 64-bit Debug', },
-            {'name': u'GTK Linux 64-bit Release', },
             {'name': u'Qt Linux Release', },
             {'name': u'Qt Linux Release minimal', },
             {'name': u'Qt Linux ARMv7 Release', },
             {'name': u'Qt Windows 32-bit Release', },
             {'name': u'Qt Windows 32-bit Debug', },
-            {'name': u'Chromium Linux Release', },
-            {'name': u'Chromium Mac Release', },
             {'name': u'Chromium Win Release', },
-            {'name': u'Chromium Linux Release (Tests)', },
-            {'name': u'Chromium Mac Release (Tests)', },
+            {'name': u'Chromium Mac Release', },
+            {'name': u'Chromium Linux Release', },
             {'name': u'Chromium Win Release (Tests)', },
+            {'name': u'Chromium Mac Release (Tests)', },
+            {'name': u'Chromium Linux Release (Tests)', },
             {'name': u'New run-webkit-tests', },
+            {'name': u'WinCairo Debug (Build)', },
+            {'name': u'WinCE Release (Build)', },
+            {'name': u'EFL Linux Release (Build)', },
         ]
         name_regexps = [
             "SnowLeopard.*Build",
             "SnowLeopard.*\(Test",
             "SnowLeopard.*\(WebKit2 Test",
-            "Leopard.*Release",
+            "Leopard.*",
             "Windows.*Build",
+            "Windows.*\(Test",
+            "WinCairo",
             "WinCE",
             "EFL",
             "GTK.*32",
@@ -267,11 +272,15 @@ class BuildBotTest(unittest.TestCase):
         expected_builders = [
             {'name': u'Leopard Intel Release (Build)', },
             {'name': u'Leopard Intel Release (Tests)', },
+            {'name': u'Leopard Intel Debug (Build)', },
+            {'name': u'Leopard Intel Debug (Tests)', },
             {'name': u'SnowLeopard Intel Release (Build)', },
             {'name': u'SnowLeopard Intel Release (Tests)', },
             {'name': u'SnowLeopard Intel Release (WebKit2 Tests)', },
             {'name': u'Windows Release (Build)', },
+            {'name': u'Windows 7 Release (Tests)', },
             {'name': u'Windows Debug (Build)', },
+            {'name': u'Windows XP Debug (Tests)', },
             {'name': u'GTK Linux 32-bit Release', },
             {'name': u'GTK Linux 32-bit Debug', },
             {'name': u'GTK Linux 64-bit Debug', },
@@ -280,9 +289,12 @@ class BuildBotTest(unittest.TestCase):
             {'name': u'Qt Linux ARMv7 Release', },
             {'name': u'Qt Windows 32-bit Release', },
             {'name': u'Qt Windows 32-bit Debug', },
-            {'name': u'Chromium Linux Release', },
-            {'name': u'Chromium Mac Release', },
             {'name': u'Chromium Win Release', },
+            {'name': u'Chromium Mac Release', },
+            {'name': u'Chromium Linux Release', },
+            {'name': u'WinCairo Debug (Build)', },
+            {'name': u'WinCE Release (Build)', },
+            {'name': u'EFL Linux Release (Build)', },
         ]
 
         # This test should probably be updated if the default regexp list changes
@@ -410,6 +422,33 @@ class BuildBotTest(unittest.TestCase):
         buildbot._latest_builds_from_builders = mock_builds_from_builders
         self.assertEqual(buildbot.last_green_revision(), 1)
 
+    def _fetch_build(self, build_number):
+        if build_number == 5:
+            return "correct build"
+        return "wrong build"
+
+    def _fetch_revision_to_build_map(self):
+        return {'r5': 5, 'r2': 2, 'r3': 3}
+
+    def test_latest_cached_build(self):
+        b = Builder('builder', BuildBot())
+        b._fetch_build = self._fetch_build
+        b._fetch_revision_to_build_map = self._fetch_revision_to_build_map
+        self.assertEquals("correct build", b.latest_cached_build())
+
+    def results_url(self):
+        return "some-url"
+
+    def test_results_zip_url(self):
+        b = Build(None, 123, 123, False)
+        b.results_url = self.results_url
+        self.assertEquals("some-url.zip", b.results_zip_url())
+
+    def test_results(self):
+        builder = Builder('builder', BuildBot())
+        b = Build(builder, 123, 123, True)
+        self.assertTrue(b.results())
+
 
 if __name__ == '__main__':
     unittest.main()
diff --git a/Tools/Scripts/webkitpy/common/system/autoinstall.py b/Tools/Scripts/webkitpy/common/system/autoinstall.py
index 9adab29..4ffcccc 100755
--- a/Tools/Scripts/webkitpy/common/system/autoinstall.py
+++ b/Tools/Scripts/webkitpy/common/system/autoinstall.py
@@ -61,7 +61,7 @@ class AutoInstaller(object):
 
     installer.install(url="http://pypi.python.org/packages/source/p/pep8/pep8-0.5.0.tar.gz#md5=512a818af9979290cd619cce8e9c2e2b",
                       url_subpath="pep8-0.5.0/pep8.py")
-    installer.install(url="http://pypi.python.org/packages/source/m/mechanize/mechanize-0.1.11.zip",
+    installer.install(url="http://pypi.python.org/packages/source/m/mechanize/mechanize-0.2.4.zip",
                       url_subpath="mechanize")
 
     """
@@ -512,6 +512,6 @@ if __name__=="__main__":
                       url_subpath="pep8-0.5.0/pep8.py")
     installer.install(should_refresh=False,
                       target_name="mechanize",
-                      url="http://pypi.python.org/packages/source/m/mechanize/mechanize-0.1.11.zip",
+                      url="http://pypi.python.org/packages/source/m/mechanize/mechanize-0.2.4.zip",
                       url_subpath="mechanize")
 
diff --git a/Tools/Scripts/webkitpy/common/system/filesystem.py b/Tools/Scripts/webkitpy/common/system/filesystem.py
index b876807..1988546 100644
--- a/Tools/Scripts/webkitpy/common/system/filesystem.py
+++ b/Tools/Scripts/webkitpy/common/system/filesystem.py
@@ -195,6 +195,9 @@ class FileSystem(object):
             mode = 'a'
         return codecs.open(path, mode, 'utf8')
 
+    def open_binary_file_for_reading(self, path):
+        return codecs.open(path, 'rb')
+
     def read_binary_file(self, path):
         """Return the contents of the file at the given path as a byte string."""
         with file(path, 'rb') as f:
diff --git a/Tools/Scripts/webkitpy/common/system/filesystem_mock.py b/Tools/Scripts/webkitpy/common/system/filesystem_mock.py
index aa79a8c..a6d158a 100644
--- a/Tools/Scripts/webkitpy/common/system/filesystem_mock.py
+++ b/Tools/Scripts/webkitpy/common/system/filesystem_mock.py
@@ -228,6 +228,11 @@ class MockFileSystem(object):
     def read_text_file(self, path):
         return self.read_binary_file(path).decode('utf-8')
 
+    def open_binary_file_for_reading(self, path):
+        if self.files[path] is None:
+            self._raise_not_found(path)
+        return ReadableFileObject(self, path, self.files[path])
+
     def read_binary_file(self, path):
         # Intentionally raises KeyError if we don't recognize the path.
         if self.files[path] is None:
@@ -285,3 +290,28 @@ class WritableFileObject(object):
     def write(self, str):
         self.fs.files[self.path] += str
         self.fs.written_files[self.path] = self.fs.files[self.path]
+
+
+class ReadableFileObject(object):
+    def __init__(self, fs, path, data=""):
+        self.fs = fs
+        self.path = path
+        self.closed = False
+        self.data = data
+        self.offset = 0
+
+    def __enter__(self):
+        return self
+
+    def __exit__(self, type, value, traceback):
+        self.close()
+
+    def close(self):
+        self.closed = True
+
+    def read(self, bytes=None):
+        if not bytes:
+            return self.data[self.offset:]
+        start = self.offset
+        self.offset += bytes
+        return self.data[start:self.offset]
diff --git a/Tools/Scripts/webkitpy/layout_tests/layout_package/dump_render_tree_thread.py b/Tools/Scripts/webkitpy/layout_tests/layout_package/dump_render_tree_thread.py
index 83b2215..6d5cda8 100644
--- a/Tools/Scripts/webkitpy/layout_tests/layout_package/dump_render_tree_thread.py
+++ b/Tools/Scripts/webkitpy/layout_tests/layout_package/dump_render_tree_thread.py
@@ -211,7 +211,7 @@ class TestShellThread(threading.Thread, worker_mixin.WorkerMixin):
                 self._num_tests_in_current_group = len(self._filename_list)
                 self._current_group_start_time = time.time()
 
-            test_input = self._filename_list.pop()
+            test_input = self._filename_list.pop(0)
 
             # We have a url, run tests.
             self._num_tests += 1
diff --git a/Tools/Scripts/webkitpy/layout_tests/layout_package/single_test_runner.py b/Tools/Scripts/webkitpy/layout_tests/layout_package/single_test_runner.py
index d755f67..a8c716f 100644
--- a/Tools/Scripts/webkitpy/layout_tests/layout_package/single_test_runner.py
+++ b/Tools/Scripts/webkitpy/layout_tests/layout_package/single_test_runner.py
@@ -44,14 +44,6 @@ def run_single_test(port, options, test_input, driver, worker_name):
     return runner.run()
 
 
-class ExpectedDriverOutput:
-    """Groups information about an expected driver output."""
-    def __init__(self, text, image, image_hash):
-        self.text = text
-        self.image = image
-        self.image_hash = image_hash
-
-
 class SingleTestRunner:
 
     def __init__(self, options, port, driver, test_input, worker_name):
@@ -63,10 +55,43 @@ class SingleTestRunner:
         self._worker_name = worker_name
         self._testname = port.relative_test_filename(test_input.filename)
 
+        self._is_reftest = False
+        self._is_mismatch_reftest = False
+        self._reference_filename = None
+
+        fs = port._filesystem
+        reftest_expected_filename = port.reftest_expected_filename(self._filename)
+        if fs.exists(reftest_expected_filename):
+            self._is_reftest = True
+            self._reference_filename = reftest_expected_filename
+
+        reftest_expected_mismatch_filename = port.reftest_expected_mismatch_filename(self._filename)
+        if fs.exists(reftest_expected_mismatch_filename):
+            if self._is_reftest:
+                _log.error('It is not allowed that one test file has both'
+                           ' expected.html file and expected-mismatch.html file'
+                           ' at the same time. Please remove either %s or %s.',
+                           reftest_expected_filename, reftest_expected_mismatch_filename)
+            else:
+                self._is_reftest = True
+                self._is_mismatch_reftest = True
+                self._reference_filename = reftest_expected_mismatch_filename
+
+        if self._is_reftest:
+            # Detect and report a test which has a wrong combination of expectation files.
+            # For example, if 'foo.html' has two expectation files, 'foo-expected.html' and
+            # 'foo-expected.txt', we should warn users. One test file must be used exclusively
+            # in either layout tests or reftests, but not in both.
+            for suffix in ['.txt', '.checksum', '.png']:
+                expected_filename = self._port.expected_filename(self._filename, suffix)
+                if fs.exists(expected_filename):
+                    _log.error('The reftest (%s) can not have an expectation file (%s).'
+                               ' Please remove that file.', self._testname, expected_filename)
+
     def _expected_driver_output(self):
-        return ExpectedDriverOutput(self._port.expected_text(self._filename),
-                                    self._port.expected_image(self._filename),
-                                    self._port.expected_checksum(self._filename))
+        return base.DriverOutput(self._port.expected_text(self._filename),
+                                 self._port.expected_image(self._filename),
+                                 self._port.expected_checksum(self._filename))
 
     def _should_fetch_expected_checksum(self):
         return (self._options.pixel_tests and
@@ -84,7 +109,13 @@ class SingleTestRunner:
 
     def run(self):
         if self._options.new_baseline or self._options.reset_results:
-            return self._run_rebaseline()
+            if self._is_reftest:
+                # Returns a dummy TestResult. We don't have to rebase for reftests.
+                return TestResult(self._filename)
+            else:
+                return self._run_rebaseline()
+        if self._is_reftest:
+            return self._run_reftest()
         return self._run_compare_test()
 
     def _run_compare_test(self):
@@ -98,6 +129,8 @@ class SingleTestRunner:
     def _run_rebaseline(self):
         driver_output = self._driver.run_test(self._driver_input())
         failures = self._handle_error(driver_output)
+        test_result_writer.write_test_result(self._port, self._options.results_directory, self._filename,
+                                             driver_output, None, failures)
         # FIXME: It the test crashed or timed out, it might be bettter to avoid
         # to write new baselines.
         self._save_baselines(driver_output)
@@ -145,22 +178,31 @@ class SingleTestRunner:
 
         port.update_baseline(output_path, data)
 
-    def _handle_error(self, driver_output):
+    def _handle_error(self, driver_output, reference_filename=None):
+        """Returns test failures if some unusual errors happen in driver's run.
+
+        Args:
+          driver_output: The output from the driver.
+          reference_filename: The full path to the reference file which produced the driver_output.
+              This arg is optional and should be used only in reftests until we have a better way to know
+              which html file is used for producing the driver_output.
+        """
         failures = []
         fs = self._port._filesystem
         if driver_output.timeout:
-            failures.append(test_failures.FailureTimeout())
+            failures.append(test_failures.FailureTimeout(reference_filename))
+
+        if reference_filename:
+            testname = self._port.relative_test_filename(reference_filename)
+        else:
+            testname = self._testname
+
         if driver_output.crash:
-            failures.append(test_failures.FailureCrash())
-            _log.debug("%s Stacktrace for %s:\n%s" % (self._worker_name, self._testname,
+            failures.append(test_failures.FailureCrash(reference_filename))
+            _log.debug("%s Stacktrace for %s:\n%s" % (self._worker_name, testname,
                                                       driver_output.error))
-            # FIXME: Use test_result_writer module.
-            stack_filename = fs.join(self._options.results_directory, self._testname)
-            stack_filename = fs.splitext(stack_filename)[0] + "-stack.txt"
-            fs.maybe_make_directory(fs.dirname(stack_filename))
-            fs.write_text_file(stack_filename, driver_output.error)
         elif driver_output.error:
-            _log.debug("%s %s output stderr lines:\n%s" % (self._worker_name, self._testname,
+            _log.debug("%s %s output stderr lines:\n%s" % (self._worker_name, testname,
                                                            driver_output.error))
         return failures
 
@@ -210,3 +252,31 @@ class SingleTestRunner:
         elif driver_output.image_hash != expected_driver_outputs.image_hash:
             failures.append(test_failures.FailureImageHashMismatch())
         return failures
+
+    def _run_reftest(self):
+        driver_output1 = self._driver.run_test(self._driver_input())
+        driver_output2 = self._driver.run_test(
+            base.DriverInput(self._reference_filename, self._timeout, driver_output1.image_hash))
+        test_result = self._compare_output_with_reference(driver_output1, driver_output2)
+
+        test_result_writer.write_test_result(self._port, self._options.results_directory, self._filename,
+                                             driver_output1, driver_output2, test_result.failures)
+        return test_result
+
+    def _compare_output_with_reference(self, driver_output1, driver_output2):
+        total_test_time = driver_output1.test_time + driver_output2.test_time
+        failures = []
+        failures.extend(self._handle_error(driver_output1))
+        if failures:
+            # Don't continue any more if we already have crash or timeout.
+            return TestResult(self._filename, failures, total_test_time)
+        failures.extend(self._handle_error(driver_output2, reference_filename=self._reference_filename))
+        if failures:
+            return TestResult(self._filename, failures, total_test_time)
+
+        if self._is_mismatch_reftest:
+            if driver_output1.image_hash == driver_output2.image_hash:
+                failures.append(test_failures.FailureReftestMismatchDidNotOccur())
+        elif driver_output1.image_hash != driver_output2.image_hash:
+            failures.append(test_failures.FailureReftestMismatch())
+        return TestResult(self._filename, failures, total_test_time)
diff --git a/Tools/Scripts/webkitpy/layout_tests/layout_package/test_failures.py b/Tools/Scripts/webkitpy/layout_tests/layout_package/test_failures.py
index eb59d36..1fad772 100644
--- a/Tools/Scripts/webkitpy/layout_tests/layout_package/test_failures.py
+++ b/Tools/Scripts/webkitpy/layout_tests/layout_package/test_failures.py
@@ -60,11 +60,13 @@ def determine_result_type(failure_list):
         is_text_failure = FailureTextMismatch in failure_types
         is_image_failure = (FailureImageHashIncorrect in failure_types or
                             FailureImageHashMismatch in failure_types)
+        is_reftest_failure = (FailureReftestMismatch in failure_types or
+                              FailureReftestMismatchDidNotOccur in failure_types)
         if is_text_failure and is_image_failure:
             return test_expectations.IMAGE_PLUS_TEXT
         elif is_text_failure:
             return test_expectations.TEXT
-        elif is_image_failure:
+        elif is_image_failure or is_reftest_failure:
             return test_expectations.IMAGE
         else:
             raise ValueError("unclassifiable set of failures: "
@@ -126,8 +128,8 @@ class TestFailure(object):
         return filename[:filename.rfind('.')] + modifier
 
 
-class FailureWithType(TestFailure):
-    """Base class that produces standard HTML output based on the test type.
+class ComparisonTestFailure(TestFailure):
+    """Base class that produces standard HTML output based on the result of the comparison test.
 
     Subclasses may commonly choose to override the ResultHtmlOutput, but still
     use the standard OutputLinks.
@@ -177,11 +179,17 @@ class FailureTimeout(TestFailure):
     """Test timed out.  We also want to restart DumpRenderTree if this
     happens."""
 
+    def __init__(self, reference_filename=None):
+        self.reference_filename = reference_filename
+
     @staticmethod
     def message():
         return "Test timed out"
 
     def result_html_output(self, filename):
+        if self.reference_filename:
+            return "<strong>%s</strong> (occured in <a href=%s>expected html</a>)" % (
+                self.message(), self.reference_filename)
         return "<strong>%s</strong>" % self.message()
 
     def should_kill_dump_render_tree(self):
@@ -191,6 +199,9 @@ class FailureTimeout(TestFailure):
 class FailureCrash(TestFailure):
     """DumpRenderTree crashed."""
 
+    def __init__(self, reference_filename=None):
+        self.reference_filename = reference_filename
+
     @staticmethod
     def message():
         return "DumpRenderTree crashed"
@@ -198,14 +209,17 @@ class FailureCrash(TestFailure):
     def result_html_output(self, filename):
         # FIXME: create a link to the minidump file
         stack = self.relative_output_filename(filename, "-stack.txt")
-        return "<strong>%s</strong> <a href=%s>stack</a>" % (self.message(),
-                                                             stack)
+        if self.reference_filename:
+            return "<strong>%s</strong> <a href=%s>stack</a> (occured in <a href=%s>expected html</a>)" % (
+                self.message(), stack, self.reference_filename)
+        else:
+            return "<strong>%s</strong> <a href=%s>stack</a>" % (self.message(), stack)
 
     def should_kill_dump_render_tree(self):
         return True
 
 
-class FailureMissingResult(FailureWithType):
+class FailureMissingResult(ComparisonTestFailure):
     """Expected result was missing."""
     OUT_FILENAMES = ("-actual.txt",)
 
@@ -218,7 +232,7 @@ class FailureMissingResult(FailureWithType):
                 self.output_links(filename, self.OUT_FILENAMES))
 
 
-class FailureTextMismatch(FailureWithType):
+class FailureTextMismatch(ComparisonTestFailure):
     """Text diff output failed."""
     # Filename suffixes used by ResultHtmlOutput.
     # FIXME: Why don't we use the constants from TestTypeBase here?
@@ -230,7 +244,7 @@ class FailureTextMismatch(FailureWithType):
         return "Text diff mismatch"
 
 
-class FailureMissingImageHash(FailureWithType):
+class FailureMissingImageHash(ComparisonTestFailure):
     """Actual result hash was missing."""
     # Chrome doesn't know to display a .checksum file as text, so don't bother
     # putting in a link to the actual result.
@@ -243,7 +257,7 @@ class FailureMissingImageHash(FailureWithType):
         return "<strong>%s</strong>" % self.message()
 
 
-class FailureMissingImage(FailureWithType):
+class FailureMissingImage(ComparisonTestFailure):
     """Actual result image was missing."""
     OUT_FILENAMES = ("-actual.png",)
 
@@ -256,7 +270,7 @@ class FailureMissingImage(FailureWithType):
                 self.output_links(filename, self.OUT_FILENAMES))
 
 
-class FailureImageHashMismatch(FailureWithType):
+class FailureImageHashMismatch(ComparisonTestFailure):
     """Image hashes didn't match."""
     OUT_FILENAMES = ("-actual.png", "-expected.png", "-diff.png")
 
@@ -267,7 +281,7 @@ class FailureImageHashMismatch(FailureWithType):
         return "Image mismatch"
 
 
-class FailureImageHashIncorrect(FailureWithType):
+class FailureImageHashIncorrect(ComparisonTestFailure):
     """Actual result hash is incorrect."""
     # Chrome doesn't know to display a .checksum file as text, so don't bother
     # putting in a link to the actual result.
@@ -279,9 +293,48 @@ class FailureImageHashIncorrect(FailureWithType):
     def result_html_output(self, filename):
         return "<strong>%s</strong>" % self.message()
 
+
+class FailureReftestMismatch(ComparisonTestFailure):
+    """The result didn't match the reference rendering."""
+
+    OUT_FILENAMES = ("-expected.html", "-expected.png", "-actual.png",
+                     "-diff.png",)
+
+    @staticmethod
+    def message():
+        return "Mismatch with reference"
+
+    def output_links(self, filename, out_names):
+        links = ['']
+        uris = [self.relative_output_filename(filename, output_filename)
+                for output_filename in out_names]
+        for text, uri in zip(['-expected.html', 'expected', 'actual', 'diff'], uris):
+            links.append("<a href='%s'>%s</a>" % (uri, text))
+        return ' '.join(links)
+
+
+class FailureReftestMismatchDidNotOccur(ComparisonTestFailure):
+    """Unexpected match between the result and the reference rendering."""
+
+    OUT_FILENAMES = ("-expected-mismatch.html", "-actual.png",)
+
+    @staticmethod
+    def message():
+        return "Mismatch with the reference did not occur"
+
+    def output_links(self, filename, out_names):
+        links = ['']
+        uris = [self.relative_output_filename(filename, output_filename)
+                for output_filename in out_names]
+        for text, uri in zip(['-expected-mismatch.html', 'image'], uris):
+            links.append("<a href='%s'>%s</a>" % (uri, text))
+        return ' '.join(links)
+
+
 # Convenient collection of all failure classes for anything that might
 # need to enumerate over them all.
 ALL_FAILURE_CLASSES = (FailureTimeout, FailureCrash, FailureMissingResult,
                        FailureTextMismatch, FailureMissingImageHash,
                        FailureMissingImage, FailureImageHashMismatch,
-                       FailureImageHashIncorrect)
+                       FailureImageHashIncorrect, FailureReftestMismatch,
+                       FailureReftestMismatchDidNotOccur)
diff --git a/Tools/Scripts/webkitpy/layout_tests/layout_package/test_result_writer.py b/Tools/Scripts/webkitpy/layout_tests/layout_package/test_result_writer.py
index 882da91..e209503 100644
--- a/Tools/Scripts/webkitpy/layout_tests/layout_package/test_result_writer.py
+++ b/Tools/Scripts/webkitpy/layout_tests/layout_package/test_result_writer.py
@@ -64,7 +64,17 @@ def write_test_result(port, root_output_dir, filename, driver_output,
                 checksums_mismatch_but_images_are_same = True
                 imagehash_mismatch_failure = failure
         elif isinstance(failure, test_failures.FailureCrash):
-            writer.write_crash_report(driver_output.error)
+            if failure.reference_filename:
+                writer.write_crash_report(expected_driver_output.error)
+            else:
+                writer.write_crash_report(driver_output.error)
+        elif isinstance(failure, test_failures.FailureReftestMismatch):
+            writer.write_image_files(driver_output.image, expected_driver_output.image)
+            writer.create_image_diff_and_write_result(driver_output.image, expected_driver_output.image)
+            writer.copy_file(port.reftest_expected_filename(filename), '-expected.html')
+        elif isinstance(failure, test_failures.FailureReftestMismatchDidNotOccur):
+            writer.write_image_files(driver_output.image, expected_image=None)
+            writer.copy_file(port.reftest_expected_mismatch_filename(filename), '-expected-mismatch.html')
         else:
             assert isinstance(failure, (test_failures.FailureTimeout,))
 
@@ -135,9 +145,9 @@ class TestResultWriter(object):
         expected_filename = self.output_filename(self.FILENAME_SUFFIX_EXPECTED + file_type)
 
         fs = self._port._filesystem
-        if output:
+        if output is not None:
             fs.write_binary_file(actual_filename, output)
-        if expected:
+        if expected is not None:
             fs.write_binary_file(expected_filename, expected)
 
     def write_crash_report(self, error):
@@ -193,3 +203,10 @@ class TestResultWriter(object):
         # To do so, we have to change port.diff_image() as well.
         diff_filename = self.output_filename(self.FILENAME_SUFFIX_IMAGE_DIFF)
         return self._port.diff_image(actual_image, expected_image, diff_filename)
+
+    def copy_file(self, src_filepath, dst_extension):
+        fs = self._port._filesystem
+        assert fs.exists(src_filepath), 'src_filepath: %s' % src_filepath
+        dst_filename = self.output_filename(dst_extension)
+        self._make_output_directory()
+        fs.copyfile(src_filepath, dst_filename)
diff --git a/Tools/Scripts/webkitpy/layout_tests/layout_package/test_runner.py b/Tools/Scripts/webkitpy/layout_tests/layout_package/test_runner.py
index 0859f68..569dd51 100644
--- a/Tools/Scripts/webkitpy/layout_tests/layout_package/test_runner.py
+++ b/Tools/Scripts/webkitpy/layout_tests/layout_package/test_runner.py
@@ -495,10 +495,6 @@ class TestRunner:
             # a PriorityQueue until we move to Python 2.6.
             for directory in tests_by_dir:
                 test_list = tests_by_dir[directory]
-                # Keep the tests in alphabetical order.
-                # FIXME: Remove once tests are fixed so they can be run in any
-                # order.
-                test_list.reverse()
                 test_list_tuple = (directory, test_list)
                 test_lists.append(test_list_tuple)
             test_lists.sort(lambda a, b: cmp(len(b[1]), len(a[1])))
@@ -507,7 +503,6 @@ class TestRunner:
         # but each http test takes a very long time to run, so sorting by the
         # number of tests doesn't accurately capture how long they take to run.
         if tests_to_http_lock:
-            tests_to_http_lock.reverse()
             test_lists.insert(0, ("tests_to_http_lock", tests_to_http_lock))
 
         return test_lists
diff --git a/Tools/Scripts/webkitpy/layout_tests/layout_package/test_runner2.py b/Tools/Scripts/webkitpy/layout_tests/layout_package/test_runner2.py
index 0522d39..5a6344c 100644
--- a/Tools/Scripts/webkitpy/layout_tests/layout_package/test_runner2.py
+++ b/Tools/Scripts/webkitpy/layout_tests/layout_package/test_runner2.py
@@ -224,7 +224,7 @@ class TestRunner2(test_runner.TestRunner):
 
         if worker_state.wedged:
             # This shouldn't happen if we have our timeouts tuned properly.
-            _log.error("%s unwedged", w.name)
+            _log.error("%s unwedged", source)
 
         self._all_results.append(result)
         self._update_summary_with_result(self._current_result_summary, result)
diff --git a/Tools/Scripts/webkitpy/layout_tests/port/base.py b/Tools/Scripts/webkitpy/layout_tests/port/base.py
index 247a260..dea126f 100644
--- a/Tools/Scripts/webkitpy/layout_tests/port/base.py
+++ b/Tools/Scripts/webkitpy/layout_tests/port/base.py
@@ -30,6 +30,8 @@
 """Abstract base class of Port-specific entrypoints for the layout tests
 test infrastructure (the Port and Driver classes)."""
 
+from __future__ import with_statement
+
 import cgi
 import difflib
 import errno
@@ -44,20 +46,19 @@ try:
 except ImportError:
     multiprocessing = None
 
-import apache_http_server
-import config as port_config
-import http_lock
-import http_server
-import test_files
-import websocket_server
-
 from webkitpy.common import system
 from webkitpy.common.system import filesystem
 from webkitpy.common.system import logutils
 from webkitpy.common.system import path
 from webkitpy.common.system.executive import Executive, ScriptError
 from webkitpy.common.system.user import User
-
+from webkitpy.layout_tests import read_checksum_from_png
+from webkitpy.layout_tests.port import apache_http_server
+from webkitpy.layout_tests.port import config as port_config
+from webkitpy.layout_tests.port import http_lock
+from webkitpy.layout_tests.port import http_server
+from webkitpy.layout_tests.port import test_files
+from webkitpy.layout_tests.port import websocket_server
 
 _log = logutils.get_logger(__file__)
 
@@ -139,7 +140,9 @@ class Port(object):
         return self._executive.cpu_count()
 
     def default_worker_model(self):
-        return 'old-threads'
+        if self._multiprocessing_is_available:
+            return 'processes'
+        return 'threads'
 
     def baseline_path(self):
         """Return the absolute path to the directory to store new baselines
@@ -323,10 +326,17 @@ class Port(object):
 
     def expected_checksum(self, test):
         """Returns the checksum of the image we expect the test to produce, or None if it is a text-only test."""
-        path = self.expected_filename(test, '.checksum')
-        if not self.path_exists(path):
-            return None
-        return self._filesystem.read_binary_file(path)
+        png_path = self.expected_filename(test, '.png')
+        checksum_path = self._filesystem.splitext(png_path)[0] + '.checksum'
+
+        if self.path_exists(checksum_path):
+            return self._filesystem.read_binary_file(checksum_path)
+
+        if self.path_exists(png_path):
+            with self._filesystem.open_binary_file_for_reading(png_path) as filehandle:
+                return read_checksum_from_png.read_checksum(filehandle)
+
+        return None
 
     def expected_image(self, test):
         """Returns the image we expect the test to produce."""
@@ -347,6 +357,14 @@ class Port(object):
         text = self._filesystem.read_binary_file(path)
         return text.replace("\r\n", "\n")
 
+    def reftest_expected_filename(self, filename):
+        """Return the filename of reference we expect the test matches."""
+        return self.expected_filename(filename, '.html')
+
+    def reftest_expected_mismatch_filename(self, filename):
+        """Return the filename of reference we don't expect the test matches."""
+        return self.expected_filename(filename, '-mismatch.html')
+
     def filename_to_uri(self, filename):
         """Convert a test file (which is an absolute path) to a URI."""
         LAYOUTTEST_HTTP_DIR = "http/tests/"
@@ -498,6 +516,9 @@ class Port(object):
     def script_path(self, script_name):
         return self._config.script_path(script_name)
 
+    def script_shell_command(self, script_name):
+        return self._config.script_shell_command(script_name)
+
     def path_to_test_expectations_file(self):
         """Update the test expectations to the passed-in string.
 
diff --git a/Tools/Scripts/webkitpy/layout_tests/port/chromium_linux.py b/Tools/Scripts/webkitpy/layout_tests/port/chromium_linux.py
index a8e1bb2..2cd2435 100644
--- a/Tools/Scripts/webkitpy/layout_tests/port/chromium_linux.py
+++ b/Tools/Scripts/webkitpy/layout_tests/port/chromium_linux.py
@@ -114,11 +114,6 @@ class ChromiumLinuxPort(chromium.ChromiumPort):
                        'LinuxBuildInstructions')
         return result
 
-    def default_worker_model(self):
-        if self._multiprocessing_is_available:
-            return 'processes'
-        return 'old-threads'
-
     def test_platform_name(self):
         # We use 'linux' instead of 'chromium-linux' in test_expectations.txt.
         return 'linux'
diff --git a/Tools/Scripts/webkitpy/layout_tests/port/chromium_mac.py b/Tools/Scripts/webkitpy/layout_tests/port/chromium_mac.py
index 78a6682..141b587 100644
--- a/Tools/Scripts/webkitpy/layout_tests/port/chromium_mac.py
+++ b/Tools/Scripts/webkitpy/layout_tests/port/chromium_mac.py
@@ -46,11 +46,25 @@ class ChromiumMacPort(chromium.ChromiumPort):
     SUPPORTED_OS_VERSIONS = ('leopard', 'snowleopard')
 
     FALLBACK_PATHS = {
-        'leopard': ['chromium-mac-leopard', 'chromium-mac-snowleopard', 'chromium-mac', 'chromium',
-                    'mac-leopard', 'mac-snowleopard', 'mac'],
-        'snowleopard': ['chromium-mac-snowleopard', 'chromium-mac', 'chromium',
-                        'mac-snowleopard', 'mac'],
-        '': ['chromium-mac', 'chromium', 'mac'],
+        'leopard': [
+            'chromium-mac-leopard',
+            'chromium-mac',
+            'chromium',
+            'mac-leopard',
+            'mac-snowleopard',
+            'mac',
+        ],
+        'snowleopard': [
+            'chromium-mac',
+            'chromium',
+            'mac-snowleopard',
+            'mac',
+        ],
+        '': [
+            'chromium-mac',
+            'chromium',
+            'mac',
+        ],
     }
 
     def __init__(self, port_name=None, os_version_string=None, rebaselining=False, **kwargs):
@@ -100,22 +114,12 @@ class ChromiumMacPort(chromium.ChromiumPort):
         return result
 
     def default_child_processes(self):
-        if self.get_option('worker_model') == 'old-threads':
-            # FIXME: we need to run single-threaded for now. See
-            # https://bugs.webkit.org/show_bug.cgi?id=38553. Unfortunately this
-            # routine is called right before the logger is configured, so if we
-            # try to _log.warning(), it gets thrown away.
-            import sys
-            sys.stderr.write("Defaulting to one child - see https://bugs.webkit.org/show_bug.cgi?id=38553\n")
+        if not self._multiprocessing_is_available:
+            # Running multiple threads in Mac Python is unstable (See
+            # https://bugs.webkit.org/show_bug.cgi?id=38553 for more info).
             return 1
-
         return chromium.ChromiumPort.default_child_processes(self)
 
-    def default_worker_model(self):
-        if self._multiprocessing_is_available:
-            return 'processes'
-        return 'old-threads'
-
     def driver_name(self):
         return "DumpRenderTree"
 
diff --git a/Tools/Scripts/webkitpy/layout_tests/port/chromium_win.py b/Tools/Scripts/webkitpy/layout_tests/port/chromium_win.py
index e7c6e49..d0908df 100644
--- a/Tools/Scripts/webkitpy/layout_tests/port/chromium_win.py
+++ b/Tools/Scripts/webkitpy/layout_tests/port/chromium_win.py
@@ -129,6 +129,10 @@ class ChromiumWinPort(chromium.ChromiumPort):
                        'build-instructions-windows')
         return result
 
+    def default_worker_model(self):
+        # FIXME: should use base class method instead. See bug 55163.
+        return 'old-threads'
+
     def relative_test_filename(self, filename):
         path = filename[len(self.layout_tests_dir()) + 1:]
         return path.replace('\\', '/')
diff --git a/Tools/Scripts/webkitpy/layout_tests/port/dryrun.py b/Tools/Scripts/webkitpy/layout_tests/port/dryrun.py
index 6b3bd51..20aa776 100644
--- a/Tools/Scripts/webkitpy/layout_tests/port/dryrun.py
+++ b/Tools/Scripts/webkitpy/layout_tests/port/dryrun.py
@@ -118,12 +118,26 @@ class DryrunDriver(base.Driver):
 
     def run_test(self, driver_input):
         start_time = time.time()
-        text_output = self._port.expected_text(driver_input.filename)
-
-        if driver_input.image_hash is not None:
+        fs = self._port._filesystem
+        if fs.exists(self._port.reftest_expected_filename(driver_input.filename)) or \
+            fs.exists(self._port.reftest_expected_mismatch_filename(driver_input.filename)):
+            text_output = 'test-text'
+            image = 'test-image'
+            hash = 'test-checksum'
+        elif driver_input.filename.endswith('-expected.html'):
+            text_output = 'test-text'
+            image = 'test-image'
+            hash = 'test-checksum'
+        elif driver_input.filename.endswith('-expected-mismatch.html'):
+            text_output = 'test-text-mismatch'
+            image = 'test-image-mismatch'
+            hash = 'test-checksum-mismatch'
+        elif driver_input.image_hash is not None:
+            text_output = self._port.expected_text(driver_input.filename)
             image = self._port.expected_image(driver_input.filename)
             hash = self._port.expected_checksum(driver_input.filename)
         else:
+            text_output = self._port.expected_text(driver_input.filename)
             image = None
             hash = None
         return base.DriverOutput(text_output, image, hash, False,
diff --git a/Tools/Scripts/webkitpy/layout_tests/port/http_server.py b/Tools/Scripts/webkitpy/layout_tests/port/http_server.py
index 752b099..1753aee 100755
--- a/Tools/Scripts/webkitpy/layout_tests/port/http_server.py
+++ b/Tools/Scripts/webkitpy/layout_tests/port/http_server.py
@@ -55,7 +55,7 @@ class HttpdNotStarted(Exception):
 class Lighttpd(http_server_base.HttpServerBase):
 
     def __init__(self, port_obj, output_dir, background=False, port=None,
-                 root=None, run_background=None):
+                 root=None, run_background=None, layout_tests_dir=None):
         """Args:
           output_dir: the absolute path to the layout test result directory
         """
@@ -66,16 +66,21 @@ class Lighttpd(http_server_base.HttpServerBase):
         self._port = port
         self._root = root
         self._run_background = run_background
+        self._layout_tests_dir = layout_tests_dir
+
         if self._port:
             self._port = int(self._port)
 
+        if not self._layout_tests_dir:
+            self._layout_tests_dir = self._port_obj.layout_tests_dir()
+
         try:
             self._webkit_tests = os.path.join(
-                self._port_obj.layout_tests_dir(), 'http', 'tests')
+                self._layout_tests_dir, 'http', 'tests')
             self._js_test_resource = os.path.join(
-                self._port_obj.layout_tests_dir(), 'fast', 'js', 'resources')
+                self._layout_tests_dir, 'fast', 'js', 'resources')
             self._media_resource = os.path.join(
-                self._port_obj.layout_tests_dir(), 'media')
+                self._layout_tests_dir, 'media')
 
         except:
             self._webkit_tests = None
diff --git a/Tools/Scripts/webkitpy/layout_tests/port/mac.py b/Tools/Scripts/webkitpy/layout_tests/port/mac.py
index 0168ec7..4315543 100644
--- a/Tools/Scripts/webkitpy/layout_tests/port/mac.py
+++ b/Tools/Scripts/webkitpy/layout_tests/port/mac.py
@@ -88,14 +88,14 @@ class MacPort(WebKitPort):
         # four threads in parallel.
         # See https://bugs.webkit.org/show_bug.cgi?id=36622
         child_processes = WebKitPort.default_child_processes(self)
-        if self.get_option('worker_model') == 'old-threads' and child_processes > 4:
+        if not self._multiprocessing_is_available and child_processes > 4:
             return 4
         return child_processes
 
     def default_worker_model(self):
         if self._multiprocessing_is_available:
             return 'processes'
-        return 'old-threads'
+        return 'threads'
 
     def baseline_search_path(self):
         return map(self._webkit_baseline_path, self.FALLBACK_PATHS[self._version])
diff --git a/Tools/Scripts/webkitpy/layout_tests/port/mock_drt_unittest.py b/Tools/Scripts/webkitpy/layout_tests/port/mock_drt_unittest.py
index 71de14b..b6f6e8a 100644
--- a/Tools/Scripts/webkitpy/layout_tests/port/mock_drt_unittest.py
+++ b/Tools/Scripts/webkitpy/layout_tests/port/mock_drt_unittest.py
@@ -207,6 +207,9 @@ class MockDRTTest(unittest.TestCase):
     def test_textonly(self):
         self.assertTest('passes/image.html', False)
 
+    def test_checksum_in_png(self):
+        self.assertTest('passes/checksum_in_image.html', True)
+
 
 class MockChromiumDRTTest(MockDRTTest):
     def extra_args(self, pixel_tests):
diff --git a/Tools/Scripts/webkitpy/layout_tests/port/port_testcase.py b/Tools/Scripts/webkitpy/layout_tests/port/port_testcase.py
index d37fdc0..649e33c 100644
--- a/Tools/Scripts/webkitpy/layout_tests/port/port_testcase.py
+++ b/Tools/Scripts/webkitpy/layout_tests/port/port_testcase.py
@@ -73,7 +73,7 @@ class PortTestCase(unittest.TestCase):
         if multiprocessing:
             self.assertEqual(port.default_worker_model(), 'processes')
         else:
-            self.assertEqual(port.default_worker_model(), 'old-threads')
+            self.assertEqual(port.default_worker_model(), 'threads')
 
     def test_driver_cmd_line(self):
         port = self.make_port()
diff --git a/Tools/Scripts/webkitpy/layout_tests/port/test.py b/Tools/Scripts/webkitpy/layout_tests/port/test.py
index d323ed5..392818d 100644
--- a/Tools/Scripts/webkitpy/layout_tests/port/test.py
+++ b/Tools/Scripts/webkitpy/layout_tests/port/test.py
@@ -50,6 +50,7 @@ class TestInstance:
         self.keyboard = False
         self.error = ''
         self.timeout = False
+        self.is_reftest = False
 
         # The values of each field are treated as raw byte strings. They
         # will be converted to unicode strings where appropriate using
@@ -78,6 +79,13 @@ class TestList:
             test.__dict__[key] = value
         self.tests[name] = test
 
+    def add_reftest(self, name, reference_name, same_image):
+        self.add(name, actual_checksum='xxx', actual_image='XXX', is_reftest=True)
+        if same_image:
+            self.add(reference_name, actual_checksum='xxx', actual_image='XXX', is_reftest=True)
+        else:
+            self.add(reference_name, actual_checksum='yyy', actual_image='YYY', is_reftest=True)
+
     def keys(self):
         return self.tests.keys()
 
@@ -104,7 +112,9 @@ def unit_test_list():
               actual_checksum='image_checksum_fail-checksum',
               actual_image='image_checksum_fail-png')
     tests.add('failures/expected/keyboard.html', keyboard=True)
-    tests.add('failures/expected/missing_check.html', expected_checksum=None)
+    tests.add('failures/expected/missing_check.html',
+              expected_checksum=None,
+              expected_image=None)
     tests.add('failures/expected/missing_image.html', expected_image=None)
     tests.add('failures/expected/missing_text.html', expected_text=None)
     tests.add('failures/expected/newlines_leading.html',
@@ -120,15 +130,29 @@ def unit_test_list():
               actual_checksum='text-image-checksum_fail-checksum')
     tests.add('failures/unexpected/timeout.html', timeout=True)
     tests.add('http/tests/passes/text.html')
+    tests.add('http/tests/passes/image.html')
     tests.add('http/tests/ssl/text.html')
     tests.add('passes/error.html', error='stuff going to stderr')
     tests.add('passes/image.html')
     tests.add('passes/platform_image.html')
+    tests.add('passes/checksum_in_image.html',
+              expected_checksum=None,
+              expected_image='tEXtchecksum\x00checksum_in_image-checksum')
 
     # Text output files contain "\r\n" on Windows.  This may be
     # helpfully filtered to "\r\r\n" by our Python/Cygwin tooling.
     tests.add('passes/text.html',
               expected_text='\nfoo\n\n', actual_text='\nfoo\r\n\r\r\n')
+
+    # For reftests.
+    tests.add_reftest('passes/reftest.html', 'passes/reftest-expected.html', same_image=True)
+    tests.add_reftest('passes/mismatch.html', 'passes/mismatch-expected-mismatch.html', same_image=False)
+    tests.add_reftest('failures/expected/reftest.html', 'failures/expected/reftest-expected.html', same_image=False)
+    tests.add_reftest('failures/expected/mismatch.html', 'failures/expected/mismatch-expected-mismatch.html', same_image=True)
+    tests.add_reftest('failures/unexpected/reftest.html', 'failures/unexpected/reftest-expected.html', same_image=False)
+    tests.add_reftest('failures/unexpected/mismatch.html', 'failures/unexpected/mismatch-expected-mismatch.html', same_image=True)
+    # FIXME: Add a reftest which crashes.
+
     tests.add('websocket/tests/passes/text.html')
     return tests
 
@@ -158,6 +182,8 @@ def unit_test_filesystem(files=None):
     # Add each test and the expected output, if any.
     for test in test_list.tests.values():
         add_file(files, test, '.html', '')
+        if test.is_reftest:
+            continue
         add_file(files, test, '-expected.txt', test.expected_text)
         add_file(files, test, '-expected.checksum', test.expected_checksum)
         add_file(files, test, '-expected.png', test.expected_image)
@@ -169,12 +195,14 @@ WONTFIX : failures/expected/crash.html = CRASH
 // This one actually passes because the checksums will match.
 WONTFIX : failures/expected/image.html = PASS
 WONTFIX : failures/expected/image_checksum.html = IMAGE
+WONTFIX : failures/expected/mismatch.html = IMAGE
 WONTFIX : failures/expected/missing_check.html = MISSING PASS
 WONTFIX : failures/expected/missing_image.html = MISSING PASS
 WONTFIX : failures/expected/missing_text.html = MISSING PASS
 WONTFIX : failures/expected/newlines_leading.html = TEXT
 WONTFIX : failures/expected/newlines_trailing.html = TEXT
 WONTFIX : failures/expected/newlines_with_excess_CR.html = TEXT
+WONTFIX : failures/expected/reftest.html = IMAGE
 WONTFIX : failures/expected/text.html = TEXT
 WONTFIX : failures/expected/timeout.html = TIMEOUT
 WONTFIX SKIP : failures/expected/hang.html = TIMEOUT
@@ -222,6 +250,12 @@ class TestPort(base.Port):
     def baseline_search_path(self):
         return [self.baseline_path()]
 
+    def default_child_processes(self):
+        return 1
+
+    def default_worker_model(self):
+        return 'inline'
+
     def check_build(self, needs_http):
         return True
 
diff --git a/Tools/Scripts/webkitpy/layout_tests/port/test_files.py b/Tools/Scripts/webkitpy/layout_tests/port/test_files.py
index 534462a..fbbbea5 100644
--- a/Tools/Scripts/webkitpy/layout_tests/port/test_files.py
+++ b/Tools/Scripts/webkitpy/layout_tests/port/test_files.py
@@ -105,11 +105,10 @@ def _has_supported_extension(filesystem, filename):
     return extension in _supported_file_extensions
 
 
-def _is_reference_html_file(filename):
+def is_reference_html_file(filename):
     """Return true if the filename points to a reference HTML file."""
     if (filename.endswith('-expected.html') or
         filename.endswith('-expected-mismatch.html')):
-        _log.warn("Reftests are not supported - ignoring %s" % filename)
         return True
     return False
 
@@ -117,4 +116,4 @@ def _is_reference_html_file(filename):
 def _is_test_file(filesystem, dirname, filename):
     """Return true if the filename points to a test file."""
     return (_has_supported_extension(filesystem, filename) and
-            not _is_reference_html_file(filename))
+            not is_reference_html_file(filename))
diff --git a/Tools/Scripts/webkitpy/layout_tests/read_checksum_from_png.py b/Tools/Scripts/webkitpy/layout_tests/read_checksum_from_png.py
new file mode 100644
index 0000000..70a0502
--- /dev/null
+++ b/Tools/Scripts/webkitpy/layout_tests/read_checksum_from_png.py
@@ -0,0 +1,40 @@
+#!/usr/bin/env python
+# Copyright (c) 2011 Google Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are
+# met:
+#
+#     * Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+#     * Redistributions in binary form must reproduce the above
+# copyright notice, this list of conditions and the following disclaimer
+# in the documentation and/or other materials provided with the
+# distribution.
+#     * Neither the name of Google Inc. nor the names of its
+# contributors may be used to endorse or promote products derived from
+# this software without specific prior written permission.
+#
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+
+def read_checksum(filehandle):
+    # We expect the comment to be at the beginning of the file.
+    data = filehandle.read(2048)
+    comment_key = 'tEXtchecksum\x00'
+    comment_pos = data.find(comment_key)
+    if comment_pos == -1:
+        return
+
+    checksum_pos = comment_pos + len(comment_key)
+    return data[checksum_pos:checksum_pos + 32]
diff --git a/Tools/Scripts/webkitpy/layout_tests/read_checksum_from_png_unittest.py b/Tools/Scripts/webkitpy/layout_tests/read_checksum_from_png_unittest.py
new file mode 100644
index 0000000..7375741
--- /dev/null
+++ b/Tools/Scripts/webkitpy/layout_tests/read_checksum_from_png_unittest.py
@@ -0,0 +1,44 @@
+#!/usr/bin/env python
+# Copyright (C) 2011 Google Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+#
+# 1.  Redistributions of source code must retain the above copyright
+#     notice, this list of conditions and the following disclaimer.
+# 2.  Redistributions in binary form must reproduce the above copyright
+#     notice, this list of conditions and the following disclaimer in the
+#     documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+# EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+# WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+# DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+# DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+# (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+# ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+# THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+import StringIO
+import unittest
+from webkitpy.layout_tests import read_checksum_from_png
+
+
+class ReadChecksumFromPngTest(unittest.TestCase):
+    def test_read_checksum(self):
+        # Test a file with the comment.
+        filehandle = StringIO.StringIO('''\x89PNG\r\n\x1a\n\x00\x00\x00\rIHDR\x00\x00\x03 \x00\x00\x02X\x08\x02\x00\x00\x00\x15\x14\x15'\x00\x00\x00)tEXtchecksum\x003c4134fe2739880353f91c5b84cadbaaC\xb8?\xec\x00\x00\x16\xfeIDATx\x9c\xed\xdd[\x8cU\xe5\xc1\xff\xf15T\x18\x0ea,)\xa6\x80XZ<\x10\n\xd6H\xc4V\x88}\xb5\xa9\xd6r\xd5\x0bki0\xa6\xb5ih\xd2\xde\x98PHz\xd1\x02=\\q#\x01\x8b\xa5rJ\x8b\x88i\xacM\xc5h\x8cbMk(\x1ez@!\x0c\xd5\xd2\xc2\xb44\x1c\x848\x1dF(\xeb\x7f\xb1\xff\xd9\xef~g\xd6\xde3\xe0o\x10\xec\xe7sa6{\xd6z\xd6\xb3\xd7\xf3\xa8_7\xdbM[Y\x96\x05\x00\x009\xc3\xde\xeb\t\x00\x00\xbc\xdf\x08,\x00\x800\x81\x05\x00\x10&\xb0\x00\x00\xc2\x04\x16\x00@\x98\xc0\x02\x00\x08\x13X\x00\x00a\x02\x0b\x00 Lx01\x00\x84\t,\x00\x800\x81\x05\x00\x10\xd64\xb0\xda\x9a\xdb\xb6m\xdb\xb4i\xd3\xfa\x9fr\xf3\xcd7\x0f\xe5T\x07\xe5\xd4\xa9''')
+        checksum = read_checksum_from_png.read_checksum(filehandle)
+        self.assertEquals('3c4134fe2739880353f91c5b84cadbaa', checksum)
+
+        # Test a file without the comment.
+        filehandle = StringIO.StringIO('''\x89PNG\r\n\x1a\n\x00\x00\x00\rIHDR\x00\x00\x03 \x00\x00\x02X\x08\x02\x00\x00\x00\x15\x14\x15'\x00\x00\x16\xfeIDATx\x9c\xed\xdd[\x8cU\xe5\xc1\xff\xf15T\x18\x0ea,)\xa6\x80XZ<\x10\n\xd6H\xc4V\x88}\xb5\xa9\xd6r\xd5\x0bki0\xa6\xb5ih\xd2\xde\x98PHz\xd1\x02=\\q#\x01\x8b\xa5rJ\x8b\x88i\xacM\xc5h\x8cbMk(\x1ez@!\x0c\xd5\xd2\xc2\xb44\x1c\x848\x1dF(\xeb\x7f\xb1\xff\xd9\xef~g\xd6\xde3\xe0o\x10\xec\xe7sa6{\xd6z\xd6\xb3\xd7\xf3\xa8_7\xdbM[Y\x96\x05\x00\x009\xc3\xde\xeb\t\x00\x00\xbc\xdf\x08,\x00\x800\x81\x05\x00\x10&\xb0\x00\x00\xc2\x04\x16\x00@\x98\xc0\x02\x00\x08\x13X\x00\x00a\x02\x0b\x00 Lx01\x00\x84\t,\x00\x800\x81\x05\x00\x10\xd64\xb0\xda\x9a\xdb\xb6m\xdb\xb4i\xd3\xfa\x9fr\xf3\xcd7\x0f\xe5T\x07\xe5\xd4\xa9S\x8b\x17/\x1e?~\xfc\xf8\xf1\xe3\xef\xbf\xff\xfe\xf7z:M5\xbb\x87\x17\xcbUZ\x8f|V\xd7\xbd\x10\xb6\xcd{b\x88\xf6j\xb3\x9b?\x14\x9b\xa1>\xe6\xf9\xd9\xcf\x00\x17\x93''')
+        checksum = read_checksum_from_png.read_checksum(filehandle)
+        self.assertEquals(None, checksum)
+
+
+if __name__ == '__main__':
+    unittest.main()
diff --git a/Tools/Scripts/webkitpy/layout_tests/rebaseline_chromium_webkit_tests.py b/Tools/Scripts/webkitpy/layout_tests/rebaseline_chromium_webkit_tests.py
index 24b8c97..9f1d347 100644
--- a/Tools/Scripts/webkitpy/layout_tests/rebaseline_chromium_webkit_tests.py
+++ b/Tools/Scripts/webkitpy/layout_tests/rebaseline_chromium_webkit_tests.py
@@ -59,8 +59,8 @@ from webkitpy.layout_tests.layout_package import test_expectations
 
 _log = logging.getLogger(__name__)
 
-BASELINE_SUFFIXES = ['.txt', '.png', '.checksum']
-REBASELINE_PLATFORM_ORDER = ['mac', 'win', 'win-xp', 'win-vista', 'linux']
+BASELINE_SUFFIXES = ('.txt', '.png', '.checksum')
+REBASELINE_PLATFORM_ORDER = ('mac', 'win', 'win-xp', 'win-vista', 'linux')
 ARCHIVE_DIR_NAME_DICT = {'win': 'Webkit_Win__deps_',
                          'win-vista': 'webkit-dbg-vista',
                          'win-xp': 'Webkit_Win__deps_',
@@ -171,7 +171,7 @@ class Rebaseliner(object):
         self._rebaseline_port = port.get(
             self._target_port.test_platform_name_to_name(platform), options,
             filesystem=self._filesystem, rebaselining=True)
-        self._rebaselining_tests = []
+        self._rebaselining_tests = set()
         self._rebaselined_tests = []
 
         # Create tests and expectations helper which is used to:
@@ -179,12 +179,8 @@ class Rebaseliner(object):
         #   -. update the tests in test_expectations file after rebaseline
         #      is done.
         expectations_str = self._rebaseline_port.test_expectations()
-        self._test_expectations = \
-            test_expectations.TestExpectations(self._rebaseline_port,
-                                               None,
-                                               expectations_str,
-                                               self._rebaseline_port.test_configuration(),
-                                               False)
+        self._test_expectations = test_expectations.TestExpectations(
+            self._rebaseline_port, None, expectations_str, self._rebaseline_port.test_configuration(), False)
         self._url_fetcher = url_fetcher
         self._zip_factory = zip_factory
         self._scm = scm
@@ -194,6 +190,8 @@ class Rebaseliner(object):
 
         log_dashed_string('Compiling rebaselining tests', self._platform)
         if not self._compile_rebaselining_tests():
+            return False
+        if not self.get_rebaselining_tests():
             return True
 
         log_dashed_string('Downloading archive', self._platform)
@@ -203,30 +201,24 @@ class Rebaseliner(object):
             _log.error('No archive found.')
             return False
 
-        log_dashed_string('Extracting and adding new baselines',
-                          self._platform)
+        log_dashed_string('Extracting and adding new baselines', self._platform)
         if not self._extract_and_add_new_baselines(archive_file):
             archive_file.close()
             return False
 
         archive_file.close()
 
-        log_dashed_string('Updating rebaselined tests in file',
-                          self._platform)
+        log_dashed_string('Updating rebaselined tests in file', self._platform)
         self._update_rebaselined_tests_in_file(backup)
         _log.info('')
 
         if len(self._rebaselining_tests) != len(self._rebaselined_tests):
-            _log.warning('NOT ALL TESTS THAT NEED REBASELINING HAVE BEEN '
-                         'REBASELINED.')
-            _log.warning('  Total tests needing rebaselining: %d',
-                         len(self._rebaselining_tests))
-            _log.warning('  Total tests rebaselined: %d',
-                         len(self._rebaselined_tests))
+            _log.warning('NOT ALL TESTS THAT NEED REBASELINING HAVE BEEN REBASELINED.')
+            _log.warning('  Total tests needing rebaselining: %d', len(self._rebaselining_tests))
+            _log.warning('  Total tests rebaselined: %d', len(self._rebaselined_tests))
             return False
 
-        _log.warning('All tests needing rebaselining were successfully '
-                     'rebaselined.')
+        _log.warning('All tests needing rebaselining were successfully rebaselined.')
 
         return True
 
@@ -237,26 +229,33 @@ class Rebaseliner(object):
         """Compile list of tests that need rebaselining for the platform.
 
         Returns:
-          List of tests that need rebaselining or
-          None if there is no such test.
+          False if reftests are wrongly marked as 'needs rebaselining' or True
         """
 
         self._rebaselining_tests = \
             self._test_expectations.get_rebaselining_failures()
         if not self._rebaselining_tests:
             _log.warn('No tests found that need rebaselining.')
-            return None
+            return True
+
+        fs = self._target_port._filesystem
+        for test in self._rebaselining_tests:
+            test_abspath = self._target_port.abspath_for_test(test)
+            if (fs.exists(self._target_port.reftest_expected_filename(test_abspath)) or
+                fs.exists(self._target_port.reftest_expected_mismatch_filename(test_abspath))):
+                _log.error('%s seems to be a reftest. We can not rebase for reftests.', test)
+                self._rebaselining_tests = set()
+                return False
 
-        _log.info('Total number of tests needing rebaselining '
-                  'for "%s": "%d"', self._platform,
-                  len(self._rebaselining_tests))
+        _log.info('Total number of tests needing rebaselining for "%s": "%d"',
+                  self._platform, len(self._rebaselining_tests))
 
         test_no = 1
         for test in self._rebaselining_tests:
             _log.info('  %d: %s', test_no, test)
             test_no += 1
 
-        return self._rebaselining_tests
+        return True
 
     def _get_latest_revision(self, url):
         """Get the latest layout test revision number from buildbot.
@@ -324,8 +323,7 @@ class Rebaseliner(object):
         latest_revision = self._get_latest_revision(url_base)
         if latest_revision is None or latest_revision <= 0:
             return None
-        archive_url = ('%s%s/layout-test-results.zip' % (url_base,
-                                                         latest_revision))
+        archive_url = '%s%s/layout-test-results.zip' % (url_base, latest_revision)
         _log.info('Archive url: "%s"', archive_url)
         return archive_url
 
@@ -336,7 +334,7 @@ class Rebaseliner(object):
             return None
 
         archive_file = zipfileset.ZipFileSet(url, filesystem=self._filesystem,
-                                         zip_factory=self._zip_factory)
+                                             zip_factory=self._zip_factory)
         _log.info('Archive downloaded')
         return archive_file
 
@@ -344,92 +342,83 @@ class Rebaseliner(object):
         """Extract new baselines from the zip file and add them to SVN repository.
 
         Returns:
-          List of tests that have been rebaselined or
-          None on failure.
-        """
-
+          List of tests that have been rebaselined or None on failure."""
         zip_namelist = zip_file.namelist()
 
         _log.debug('zip file namelist:')
         for name in zip_namelist:
             _log.debug('  ' + name)
 
-        platform = self._rebaseline_port.test_platform_name_to_name(
-            self._platform)
+        platform = self._rebaseline_port.test_platform_name_to_name(self._platform)
         _log.debug('Platform dir: "%s"', platform)
 
-        test_no = 1
         self._rebaselined_tests = []
-        for test in self._rebaselining_tests:
-            _log.info('Test %d: %s', test_no, test)
-
-            found = False
-            scm_error = False
-            test_basename = self._filesystem.splitext(test)[0]
-            for suffix in BASELINE_SUFFIXES:
-                archive_test_name = ('layout-test-results/%s-actual%s' %
-                                      (test_basename, suffix))
-                _log.debug('  Archive test file name: "%s"',
-                           archive_test_name)
-                if not archive_test_name in zip_namelist:
-                    _log.info('  %s file not in archive.', suffix)
-                    continue
-
-                found = True
-                _log.info('  %s file found in archive.', suffix)
-
-                # Extract new baseline from archive and save it to a temp file.
-                data = zip_file.read(archive_test_name)
-                tempfile, temp_name = self._filesystem.open_binary_tempfile(suffix)
-                tempfile.write(data)
-                tempfile.close()
-
-                expected_filename = '%s-expected%s' % (test_basename, suffix)
-                expected_fullpath = self._filesystem.join(
-                    self._rebaseline_port.baseline_path(), expected_filename)
-                expected_fullpath = self._filesystem.normpath(expected_fullpath)
-                _log.debug('  Expected file full path: "%s"',
-                           expected_fullpath)
-
-                # TODO(victorw): for now, the rebaselining tool checks whether
-                # or not THIS baseline is duplicate and should be skipped.
-                # We could improve the tool to check all baselines in upper
-                # and lower
-                # levels and remove all duplicated baselines.
-                if self._is_dup_baseline(temp_name,
-                                        expected_fullpath,
-                                        test,
-                                        suffix,
-                                        self._platform):
-                    self._filesystem.remove(temp_name)
-                    self._delete_baseline(expected_fullpath)
-                    continue
-
-                self._filesystem.maybe_make_directory(self._filesystem.dirname(expected_fullpath))
-
-                self._filesystem.move(temp_name, expected_fullpath)
-
-                if 0 != self._scm.add(expected_fullpath, return_exit_code=True):
-                    # FIXME: print detailed diagnose messages
-                    scm_error = True
-                elif suffix != '.checksum':
-                    self._create_html_baseline_files(expected_fullpath)
-
-            if not found:
-                _log.warn('  No new baselines found in archive.')
-            else:
-                if scm_error:
-                    _log.warn('  Failed to add baselines to your repository.')
-                else:
-                    _log.info('  Rebaseline succeeded.')
-                    self._rebaselined_tests.append(test)
-
-            test_no += 1
+        for test_no, test in enumerate(self._rebaselining_tests):
+            _log.info('Test %d: %s', test_no + 1, test)
+            self._extract_and_add_new_baseline(test, zip_file)
 
         zip_file.close()
 
         return self._rebaselined_tests
 
+    def _extract_and_add_new_baseline(self, test, zip_file):
+        found = False
+        scm_error = False
+        test_basename = self._filesystem.splitext(test)[0]
+        for suffix in BASELINE_SUFFIXES:
+            archive_test_name = 'layout-test-results/%s-actual%s' % (test_basename, suffix)
+            _log.debug('  Archive test file name: "%s"', archive_test_name)
+            if not archive_test_name in zip_file.namelist():
+                _log.info('  %s file not in archive.', suffix)
+                continue
+
+            found = True
+            _log.info('  %s file found in archive.', suffix)
+
+            temp_name = self._extract_from_zip_to_tempfile(zip_file, archive_test_name)
+
+            expected_filename = '%s-expected%s' % (test_basename, suffix)
+            expected_fullpath = self._filesystem.join(
+                self._rebaseline_port.baseline_path(), expected_filename)
+            expected_fullpath = self._filesystem.normpath(expected_fullpath)
+            _log.debug('  Expected file full path: "%s"', expected_fullpath)
+
+            # TODO(victorw): for now, the rebaselining tool checks whether
+            # or not THIS baseline is duplicate and should be skipped.
+            # We could improve the tool to check all baselines in upper
+            # and lower levels and remove all duplicated baselines.
+            if self._is_dup_baseline(temp_name, expected_fullpath, test, suffix, self._platform):
+                self._filesystem.remove(temp_name)
+                self._delete_baseline(expected_fullpath)
+                continue
+
+            self._filesystem.maybe_make_directory(self._filesystem.dirname(expected_fullpath))
+            self._filesystem.move(temp_name, expected_fullpath)
+
+            if self._scm.add(expected_fullpath, return_exit_code=True):
+                # FIXME: print detailed diagnose messages
+                scm_error = True
+            elif suffix != '.checksum':
+                self._create_html_baseline_files(expected_fullpath)
+
+        if not found:
+            _log.warn('  No new baselines found in archive.')
+        elif scm_error:
+            _log.warn('  Failed to add baselines to your repository.')
+        else:
+            _log.info('  Rebaseline succeeded.')
+            self._rebaselined_tests.append(test)
+
+    def _extract_from_zip_to_tempfile(self, zip_file, filename):
+        """Extracts |filename| from |zip_file|, a ZipFileSet. Returns the full
+           path name to the extracted file."""
+        data = zip_file.read(filename)
+        suffix = self._filesystem.splitext(filename)[1]
+        tempfile, temp_name = self._filesystem.open_binary_tempfile(suffix)
+        tempfile.write(data)
+        tempfile.close()
+        return temp_name
+
     def _is_dup_baseline(self, new_baseline, baseline_path, test, suffix,
                          platform):
         """Check whether a baseline is duplicate and can fallback to same
@@ -448,25 +437,26 @@ class Rebaseliner(object):
           True if the baseline is unnecessary.
           False otherwise.
         """
-        test_filepath = self._filesystem.join(self._target_port.layout_tests_dir(),
-                                     test)
+        test_filepath = self._filesystem.join(self._target_port.layout_tests_dir(), test)
         all_baselines = self._rebaseline_port.expected_baselines(
             test_filepath, suffix, True)
-        for (fallback_dir, fallback_file) in all_baselines:
-            if fallback_dir and fallback_file:
-                fallback_fullpath = self._filesystem.normpath(
-                    self._filesystem.join(fallback_dir, fallback_file))
-                if fallback_fullpath.lower() != baseline_path.lower():
-                    new_output = self._filesystem.read_binary_file(new_baseline)
-                    fallback_output = self._filesystem.read_binary_file(fallback_fullpath)
-                    is_image = baseline_path.lower().endswith('.png')
-                    if not self._diff_baselines(new_output, fallback_output,
-                                                is_image):
-                        _log.info('  Found same baseline at %s',
-                                  fallback_fullpath)
-                        return True
-                    else:
-                        return False
+
+        for fallback_dir, fallback_file in all_baselines:
+            if not fallback_dir or not fallback_file:
+                continue
+
+            fallback_fullpath = self._filesystem.normpath(
+                self._filesystem.join(fallback_dir, fallback_file))
+            if fallback_fullpath.lower() == baseline_path.lower():
+                continue
+
+            new_output = self._filesystem.read_binary_file(new_baseline)
+            fallback_output = self._filesystem.read_binary_file(fallback_fullpath)
+            is_image = baseline_path.lower().endswith('.png')
+            if not self._diff_baselines(new_output, fallback_output, is_image):
+                _log.info('  Found same baseline at %s', fallback_fullpath)
+                return True
+            return False
 
         return False
 
@@ -483,8 +473,8 @@ class Rebaseliner(object):
 
         if is_image:
             return self._port.diff_image(output1, output2, None)
-        else:
-            return self._port.compare_text(output1, output2)
+
+        return self._port.compare_text(output1, output2)
 
     def _delete_baseline(self, filename):
         """Remove the file from repository and delete it from disk.
@@ -508,14 +498,12 @@ class Rebaseliner(object):
         """
 
         if self._rebaselined_tests:
-            new_expectations = (
-                self._test_expectations.remove_platform_from_expectations(
-                self._rebaselined_tests, self._platform))
+            new_expectations = self._test_expectations.remove_platform_from_expectations(
+                self._rebaselined_tests, self._platform)
             path = self._target_port.path_to_test_expectations_file()
             if backup:
-                date_suffix = time.strftime('%Y%m%d%H%M%S',
-                                            time.localtime(time.time()))
-                backup_file = ('%s.orig.%s' % (path, date_suffix))
+                date_suffix = time.strftime('%Y%m%d%H%M%S', time.localtime(time.time()))
+                backup_file = '%s.orig.%s' % (path, date_suffix)
                 if self._filesystem.exists(backup_file):
                     self._filesystem.remove(backup_file)
                 _log.info('Saving original file to "%s"', backup_file)
@@ -541,8 +529,7 @@ class Rebaseliner(object):
         # Copy the new baseline to html directory for result comparison.
         baseline_filename = self._filesystem.basename(baseline_fullpath)
         new_file = get_result_file_fullpath(self._filesystem, self._options.html_directory,
-                                            baseline_filename, self._platform,
-                                            'new')
+                                            baseline_filename, self._platform, 'new')
         self._filesystem.copyfile(baseline_fullpath, new_file)
         _log.info('  Html: copied new baseline file from "%s" to "%s".',
                   baseline_fullpath, new_file)
@@ -554,19 +541,16 @@ class Rebaseliner(object):
             _log.info(e)
             output = ""
 
-        if (not output) or (output.upper().rstrip().endswith(
-            'NO SUCH FILE OR DIRECTORY')):
+        if (not output) or (output.upper().rstrip().endswith('NO SUCH FILE OR DIRECTORY')):
             _log.info('  No base file: "%s"', baseline_fullpath)
             return
         base_file = get_result_file_fullpath(self._filesystem, self._options.html_directory,
-                                             baseline_filename, self._platform,
-                                             'old')
+                                             baseline_filename, self._platform, 'old')
         if base_file.upper().endswith('.PNG'):
             self._filesystem.write_binary_file(base_file, output)
         else:
             self._filesystem.write_text_file(base_file, output)
-        _log.info('  Html: created old baseline file: "%s".',
-                  base_file)
+        _log.info('  Html: created old baseline file: "%s".', base_file)
 
         # Get the diff between old and new baselines and save to the html dir.
         if baseline_filename.upper().endswith('.TXT'):
@@ -576,8 +560,7 @@ class Rebaseliner(object):
                     self._options.html_directory, baseline_filename,
                     self._platform, 'diff')
                 self._filesystem.write_text_file(diff_file, output)
-                _log.info('  Html: created baseline diff file: "%s".',
-                          diff_file)
+                _log.info('  Html: created baseline diff file: "%s".', diff_file)
 
 
 class HtmlGenerator(object):
@@ -663,8 +646,7 @@ class HtmlGenerator(object):
         _log.debug(html)
 
         self._filesystem.write_text_file(self._html_file, html)
-        _log.info('Baseline comparison html generated at "%s"',
-                  self._html_file)
+        _log.info('Baseline comparison html generated at "%s"', self._html_file)
 
     def show_html(self):
         """Launch the rebaselining html in brwoser."""
@@ -716,8 +698,7 @@ class HtmlGenerator(object):
                                  'name': baseline_filename}
 
         diff_file = get_result_file_fullpath(self._filesystem, self._html_directory,
-                                             baseline_filename, platform,
-                                             'diff')
+                                             baseline_filename, platform, 'diff')
         _log.info('    Baseline diff file: "%s"', diff_file)
         if self._filesystem.exists(diff_file):
             links += html_td_link % {'uri': self.abspath_to_uri(diff_file),
@@ -747,11 +728,9 @@ class HtmlGenerator(object):
 
             _log.info('  Checking %s files', suffix)
             for platform in self._platforms:
-                links = self._generate_baseline_links(test_basename, suffix,
-                    platform)
+                links = self._generate_baseline_links(test_basename, suffix, platform)
                 if links:
-                    row = self.HTML_TD_NOLINK % self._get_baseline_result_type(
-                        suffix)
+                    row = self.HTML_TD_NOLINK % self._get_baseline_result_type(suffix)
                     row += self.HTML_TD_NOLINK % platform
                     row += links
                     _log.debug('    html row: %s', row)
diff --git a/Tools/Scripts/webkitpy/layout_tests/rebaseline_chromium_webkit_tests_unittest.py b/Tools/Scripts/webkitpy/layout_tests/rebaseline_chromium_webkit_tests_unittest.py
index c50e1c4..7179bb7 100644
--- a/Tools/Scripts/webkitpy/layout_tests/rebaseline_chromium_webkit_tests_unittest.py
+++ b/Tools/Scripts/webkitpy/layout_tests/rebaseline_chromium_webkit_tests_unittest.py
@@ -174,6 +174,20 @@ class TestRebaseliner(unittest.TestCase):
         rebaseliner.run(False)
         self.assertEqual(len(filesystem.written_files), 1)
 
+    def test_rebaselining_tests(self):
+        rebaseliner, filesystem = self.make_rebaseliner(
+            "BUGX REBASELINE MAC : failures/expected/image.html = IMAGE")
+        compile_success = rebaseliner._compile_rebaselining_tests()
+        self.assertTrue(compile_success)
+        self.assertEqual(set(['failures/expected/image.html']), rebaseliner.get_rebaselining_tests())
+
+    def test_rebaselining_tests_should_ignore_reftests(self):
+        rebaseliner, filesystem = self.make_rebaseliner(
+            "BUGX REBASELINE : failures/expected/reftest.html = IMAGE")
+        compile_success = rebaseliner._compile_rebaselining_tests()
+        self.assertFalse(compile_success)
+        self.assertFalse(rebaseliner.get_rebaselining_tests())
+
     def test_one_platform(self):
         rebaseliner, filesystem = self.make_rebaseliner(
             "BUGX REBASELINE MAC : failures/expected/image.html = IMAGE")
diff --git a/Tools/Scripts/webkitpy/layout_tests/run_webkit_tests_unittest.py b/Tools/Scripts/webkitpy/layout_tests/run_webkit_tests_unittest.py
index 3fe7b14..7076ef2 100644
--- a/Tools/Scripts/webkitpy/layout_tests/run_webkit_tests_unittest.py
+++ b/Tools/Scripts/webkitpy/layout_tests/run_webkit_tests_unittest.py
@@ -55,6 +55,7 @@ from webkitpy.layout_tests import port
 from webkitpy.layout_tests import run_webkit_tests
 from webkitpy.layout_tests.layout_package import dump_render_tree_thread
 from webkitpy.layout_tests.port.test import TestPort, TestDriver
+from webkitpy.layout_tests.port.test_files import is_reference_html_file
 from webkitpy.python24.versioning import compare_version
 from webkitpy.test.skip import skip_if
 
@@ -72,8 +73,8 @@ def parse_args(extra_args=None, record_results=False, tests_included=False,
         args.extend(['--platform', 'test'])
     if not record_results:
         args.append('--no-record-results')
-    if not '--child-processes' in extra_args:
-        args.extend(['--worker-model', 'old-inline'])
+    if not '--child-processes' in extra_args and not '--worker-model' in extra_args:
+        args.extend(['--worker-model', 'inline'])
     args.extend(extra_args)
     if not tests_included:
         # We use the glob to test that globbing works.
@@ -124,7 +125,8 @@ def run_and_capture(port_obj, options, parsed_args):
     return (res, buildbot_output, regular_output)
 
 
-def get_tests_run(extra_args=None, tests_included=False, flatten_batches=False, filesystem=None):
+def get_tests_run(extra_args=None, tests_included=False, flatten_batches=False,
+                  filesystem=None, include_reference_html=False):
     extra_args = extra_args or []
     if not tests_included:
         # Not including http tests since they get run out of order (that
@@ -136,6 +138,7 @@ def get_tests_run(extra_args=None, tests_included=False, flatten_batches=False,
 
     test_batches = []
 
+
     class RecordingTestDriver(TestDriver):
         def __init__(self, port, worker_number):
             TestDriver.__init__(self, port, worker_number)
@@ -153,7 +156,11 @@ def get_tests_run(extra_args=None, tests_included=False, flatten_batches=False,
                 self._current_test_batch = []
                 test_batches.append(self._current_test_batch)
             test_name = self._port.relative_test_filename(test_input.filename)
-            self._current_test_batch.append(test_name)
+            # In case of reftest, one test calls the driver's run_test() twice.
+            # We should not add a reference html used by reftests to tests unless include_reference_html parameter
+            # is explicitly given.
+            if include_reference_html or not is_reference_html_file(test_input.filename):
+                self._current_test_batch.append(test_name)
             return TestDriver.run_test(self, test_input)
 
     class RecordingTestPort(TestPort):
@@ -190,13 +197,13 @@ class MainTest(unittest.TestCase):
 
     def test_child_process_1(self):
         (res, buildbot_output, regular_output, user) = logging_run(
-             ['--print', 'config', '--child-processes', '1'])
+             ['--print', 'config', '--worker-model', 'threads', '--child-processes', '1'])
         self.assertTrue('Running one DumpRenderTree\n'
                         in regular_output.get())
 
     def test_child_processes_2(self):
         (res, buildbot_output, regular_output, user) = logging_run(
-             ['--print', 'config', '--child-processes', '2'])
+             ['--print', 'config', '--worker-model', 'threads', '--child-processes', '2'])
         self.assertTrue('Running 2 DumpRenderTrees in parallel\n'
                         in regular_output.get())
 
@@ -352,7 +359,12 @@ class MainTest(unittest.TestCase):
         # Run tests including the unexpected failures.
         self._url_opened = None
         res, out, err, user = logging_run(tests_included=True)
-        self.assertEqual(res, 3)
+
+        # Update this magic number if you add an unexpected test to webkitpy.layout_tests.port.test
+        # FIXME: It's nice to have a routine in port/test.py that returns this number.
+        unexpected_tests_count = 5
+
+        self.assertEqual(res, unexpected_tests_count)
         self.assertFalse(out.empty())
         self.assertFalse(err.empty())
         self.assertEqual(user.opened_urls, ['/tmp/layout-test-results/results.html'])
@@ -458,6 +470,32 @@ class MainTest(unittest.TestCase):
                                           tests_included=True)
         self.assertEqual(user.opened_urls, ['/tmp/foo/results.html'])
 
+    # These next tests test that we run the tests in ascending alphabetical
+    # order per directory. HTTP tests are sharded separately from other tests,
+    # so we have to test both.
+    def assert_run_order(self, worker_model, child_processes='1'):
+        tests_run = get_tests_run(['--worker-model', worker_model,
+            '--child-processes', child_processes, 'passes'],
+            tests_included=True, flatten_batches=True)
+        self.assertEquals(tests_run, sorted(tests_run))
+
+        tests_run = get_tests_run(['--worker-model', worker_model,
+            '--child-processes', child_processes, 'http/tests/passes'],
+            tests_included=True, flatten_batches=True)
+        self.assertEquals(tests_run, sorted(tests_run))
+
+    def test_run_order__inline(self):
+        self.assert_run_order('inline')
+
+    def test_run_order__old_inline(self):
+        self.assert_run_order('old-inline')
+
+    def test_run_order__threads(self):
+        self.assert_run_order('old-inline', child_processes='2')
+
+    def test_run_order__old_threads(self):
+        self.assert_run_order('old-threads', child_processes='2')
+
     def test_tolerance(self):
         class ImageDiffTestPort(TestPort):
             def diff_image(self, expected_contents, actual_contents,
@@ -487,11 +525,11 @@ class MainTest(unittest.TestCase):
     def test_worker_model__inline(self):
         self.assertTrue(passing_run(['--worker-model', 'inline']))
 
-    def test_worker_model__old_inline_with_child_processes(self):
-        res, out, err, user = logging_run(['--worker-model', 'old-inline',
+    def test_worker_model__inline_with_child_processes(self):
+        res, out, err, user = logging_run(['--worker-model', 'inline',
                                            '--child-processes', '2'])
         self.assertEqual(res, 0)
-        self.assertTrue('--worker-model=old-inline overrides --child-processes\n' in err.get())
+        self.assertTrue('--worker-model=inline overrides --child-processes\n' in err.get())
 
     def test_worker_model__old_inline(self):
         self.assertTrue(passing_run(['--worker-model', 'old-inline']))
@@ -516,6 +554,25 @@ class MainTest(unittest.TestCase):
         self.assertRaises(ValueError, logging_run,
                           ['--worker-model', 'unknown'])
 
+    def test_reftest_run(self):
+        tests_run = get_tests_run(['passes/reftest.html'], tests_included=True, flatten_batches=True)
+        self.assertEquals(['passes/reftest.html'], tests_run)
+
+    def test_reftest_expected_html_should_be_ignored(self):
+        tests_run = get_tests_run(['passes/reftest-expected.html'], tests_included=True, flatten_batches=True)
+        self.assertEquals([], tests_run)
+
+    def test_reftest_driver_should_run_expected_html(self):
+        tests_run = get_tests_run(['passes/reftest.html'], tests_included=True, flatten_batches=True,
+                                  include_reference_html=True)
+        self.assertEquals(['passes/reftest.html', 'passes/reftest-expected.html'], tests_run)
+
+    def test_reftest_driver_should_run_expected_mismatch_html(self):
+        tests_run = get_tests_run(['passes/mismatch.html'], tests_included=True, flatten_batches=True,
+                                  include_reference_html=True)
+        self.assertEquals(['passes/mismatch.html', 'passes/mismatch-expected-mismatch.html'], tests_run)
+
+
 MainTest = skip_if(MainTest, sys.platform == 'cygwin' and compare_version(sys, '2.6')[0] < 0, 'new-run-webkit-tests tests hang on Cygwin Python 2.5.2')
 
 
diff --git a/Tools/Scripts/webkitpy/style/checker.py b/Tools/Scripts/webkitpy/style/checker.py
index 975432b..48abcf9 100644
--- a/Tools/Scripts/webkitpy/style/checker.py
+++ b/Tools/Scripts/webkitpy/style/checker.py
@@ -36,6 +36,7 @@ import sys
 
 from checkers.common import categories as CommonCategories
 from checkers.common import CarriageReturnChecker
+from checkers.changelog import ChangeLogChecker
 from checkers.cpp import CppChecker
 from checkers.python import PythonChecker
 from checkers.test_expectations import TestExpectationsChecker
@@ -180,6 +181,7 @@ _PATH_RULES_SPECIFIER = [
       # struct members. Also, we allow unnecessary parameter names in
       # WebKit2 APIs because we're matching CF's header style.
       "Source/WebKit2/UIProcess/API/C/",
+      "Source/WebKit2/Shared/API/c/",
       "Source/WebKit2/WebProcess/InjectedBundle/API/c/"],
      ["-readability/naming",
       "-readability/parameter_name",
@@ -419,10 +421,11 @@ class FileType:
 
     NONE = 0  # FileType.NONE evaluates to False.
     # Alphabetize remaining types
-    CPP = 1
-    PYTHON = 2
-    TEXT = 3
-    XML = 4
+    CHANGELOG = 1
+    CPP = 2
+    PYTHON = 3
+    TEXT = 4
+    XML = 5
 
 
 class CheckerDispatcher(object):
@@ -481,8 +484,9 @@ class CheckerDispatcher(object):
             return FileType.PYTHON
         elif file_extension in _XML_FILE_EXTENSIONS:
             return FileType.XML
-        elif (os.path.basename(file_path).startswith('ChangeLog') or
-              (not file_extension and os.path.join("Tools", "Scripts") in file_path) or
+        elif os.path.basename(file_path).startswith('ChangeLog'):
+            return FileType.CHANGELOG
+        elif ((not file_extension and os.path.join("Tools", "Scripts") in file_path) or
               file_extension in _TEXT_FILE_EXTENSIONS):
             return FileType.TEXT
         else:
@@ -493,6 +497,11 @@ class CheckerDispatcher(object):
         """Instantiate and return a style checker based on file type."""
         if file_type == FileType.NONE:
             checker = None
+        elif file_type == FileType.CHANGELOG:
+            should_line_be_checked = None
+            if handle_style_error:
+                should_line_be_checked = handle_style_error.should_line_be_checked
+            checker = ChangeLogChecker(file_path, handle_style_error, should_line_be_checked)
         elif file_type == FileType.CPP:
             file_extension = self._file_extension(file_path)
             checker = CppChecker(file_path, file_extension,
diff --git a/Tools/Scripts/webkitpy/style/checker_unittest.py b/Tools/Scripts/webkitpy/style/checker_unittest.py
index a796e0b..144d40a 100755
--- a/Tools/Scripts/webkitpy/style/checker_unittest.py
+++ b/Tools/Scripts/webkitpy/style/checker_unittest.py
@@ -52,6 +52,7 @@ from checker import CheckerDispatcher
 from checker import ProcessorBase
 from checker import StyleProcessor
 from checker import StyleProcessorConfiguration
+from checkers.changelog import ChangeLogChecker
 from checkers.cpp import CppChecker
 from checkers.python import PythonChecker
 from checkers.text import TextChecker
@@ -368,12 +369,10 @@ class CheckerDispatcherDispatchTest(unittest.TestCase):
 
     """Tests dispatch() method of CheckerDispatcher class."""
 
-    def mock_handle_style_error(self):
-        pass
-
     def dispatch(self, file_path):
         """Call dispatch() with the given file path."""
         dispatcher = CheckerDispatcher()
+        self.mock_handle_style_error = DefaultStyleErrorHandler('', None, None, [])
         checker = dispatcher.dispatch(file_path,
                                       self.mock_handle_style_error,
                                       min_confidence=3)
@@ -395,6 +394,10 @@ class CheckerDispatcherDispatchTest(unittest.TestCase):
                              "got_class": got_class,
                              "expected_class": expected_class})
 
+    def assert_checker_changelog(self, file_path):
+        """Assert that the dispatched checker is a ChangeLogChecker."""
+        self.assert_checker(file_path, ChangeLogChecker)
+
     def assert_checker_cpp(self, file_path):
         """Assert that the dispatched checker is a CppChecker."""
         self.assert_checker(file_path, CppChecker)
@@ -411,6 +414,25 @@ class CheckerDispatcherDispatchTest(unittest.TestCase):
         """Assert that the dispatched checker is a XMLChecker."""
         self.assert_checker(file_path, XMLChecker)
 
+    def test_changelog_paths(self):
+        """Test paths that should be checked as ChangeLog."""
+        paths = [
+                 "ChangeLog",
+                 "ChangeLog-2009-06-16",
+                 os.path.join("Source", "WebCore", "ChangeLog"),
+                 ]
+
+        for path in paths:
+            self.assert_checker_changelog(path)
+
+        # Check checker attributes on a typical input.
+        file_path = "ChangeLog"
+        self.assert_checker_changelog(file_path)
+        checker = self.dispatch(file_path)
+        self.assertEquals(checker.file_path, file_path)
+        self.assertEquals(checker.handle_style_error,
+                          self.mock_handle_style_error)
+
     def test_cpp_paths(self):
         """Test paths that should be checked as C++."""
         paths = [
@@ -465,8 +487,6 @@ class CheckerDispatcherDispatchTest(unittest.TestCase):
     def test_text_paths(self):
         """Test paths that should be checked as text."""
         paths = [
-           "ChangeLog",
-           "ChangeLog-2009-06-16",
            "foo.ac",
            "foo.cc",
            "foo.cgi",
@@ -491,7 +511,6 @@ class CheckerDispatcherDispatchTest(unittest.TestCase):
            "foo.wm",
            "foo.xhtml",
            "foo.y",
-           os.path.join("Source", "WebCore", "ChangeLog"),
            os.path.join("Source", "WebCore", "inspector", "front-end", "inspector.js"),
            os.path.join("Tools", "Scripts", "check-webkit-style"),
         ]
diff --git a/Tools/Scripts/webkitpy/style/checkers/changelog.py b/Tools/Scripts/webkitpy/style/checkers/changelog.py
new file mode 100644
index 0000000..75754fa
--- /dev/null
+++ b/Tools/Scripts/webkitpy/style/checkers/changelog.py
@@ -0,0 +1,74 @@
+#!/usr/bin/env python
+#
+# Copyright (C) 2011 Patrick Gansterer <paroga@paroga.com>
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+# 1.  Redistributions of source code must retain the above copyright
+#     notice, this list of conditions and the following disclaimer.
+# 2.  Redistributions in binary form must reproduce the above copyright
+#     notice, this list of conditions and the following disclaimer in the
+#     documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+"""Checks WebKit style for ChangeLog files."""
+
+import re
+from common import TabChecker
+from webkitpy.common.net.bugzilla import parse_bug_id_from_changelog
+
+
+class ChangeLogChecker(object):
+
+    """Processes text lines for checking style."""
+
+    def __init__(self, file_path, handle_style_error, should_line_be_checked):
+        self.file_path = file_path
+        self.handle_style_error = handle_style_error
+        self.should_line_be_checked = should_line_be_checked
+        self._tab_checker = TabChecker(file_path, handle_style_error)
+
+    def check_entry(self, first_line_checked, entry_lines):
+        if not entry_lines:
+            return
+        for line in entry_lines:
+            if parse_bug_id_from_changelog(line):
+                break
+            if re.search("Unreviewed", line, re.IGNORECASE):
+                break
+            if re.search("build", line, re.IGNORECASE) and re.search("fix", line, re.IGNORECASE):
+                break
+        else:
+            self.handle_style_error(first_line_checked,
+                                    "changelog/bugnumber", 5,
+                                    "ChangeLog entry has no bug number")
+
+    def check(self, lines):
+        self._tab_checker.check(lines)
+        first_line_checked = 0
+        entry_lines = []
+
+        for line_index, line in enumerate(lines):
+            if not self.should_line_be_checked(line_index + 1):
+                # If we transitioned from finding changed lines to
+                # unchanged lines, then we are done.
+                if first_line_checked:
+                    break
+                continue
+            if not first_line_checked:
+                first_line_checked = line_index + 1
+            entry_lines.append(line)
+
+        self.check_entry(first_line_checked, entry_lines)
diff --git a/Tools/Scripts/webkitpy/style/checkers/changelog_unittest.py b/Tools/Scripts/webkitpy/style/checkers/changelog_unittest.py
new file mode 100644
index 0000000..02296d3
--- /dev/null
+++ b/Tools/Scripts/webkitpy/style/checkers/changelog_unittest.py
@@ -0,0 +1,155 @@
+#!/usr/bin/env python
+#
+# Copyright (C) 2010 Apple Inc. All rights reserved.
+# Copyright (C) 2011 Patrick Gansterer <paroga@paroga.com>
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+# 1.  Redistributions of source code must retain the above copyright
+#     notice, this list of conditions and the following disclaimer.
+# 2.  Redistributions in binary form must reproduce the above copyright
+#     notice, this list of conditions and the following disclaimer in the
+#     documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND
+# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+# WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+# DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR
+# ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+# SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+# OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+"""Unit test for changelog.py."""
+
+import changelog
+import unittest
+
+
+class ChangeLogCheckerTest(unittest.TestCase):
+    """Tests ChangeLogChecker class."""
+
+    def assert_no_error(self, lines_to_check, changelog_data):
+        def handle_style_error(line_number, category, confidence, message):
+            self.fail('Unexpected error: %d %s %d %s for\n%s' % (line_number, category, confidence, message, changelog_data))
+        self.lines_to_check = set(lines_to_check)
+        checker = changelog.ChangeLogChecker('ChangeLog', handle_style_error, self.mock_should_line_be_checked)
+        checker.check(changelog_data.split('\n'))
+
+    def assert_error(self, expected_line_number, lines_to_check, expected_category, changelog_data):
+        self.had_error = False
+
+        def handle_style_error(line_number, category, confidence, message):
+            self.had_error = True
+            self.assertEquals(expected_line_number, line_number)
+            self.assertEquals(expected_category, category)
+        self.lines_to_check = set(lines_to_check)
+        checker = changelog.ChangeLogChecker('ChangeLog', handle_style_error, self.mock_should_line_be_checked)
+        checker.check(changelog_data.split('\n'))
+        self.assertTrue(self.had_error)
+
+    def mock_handle_style_error(self):
+        pass
+
+    def mock_should_line_be_checked(self, line_number):
+        return line_number in self.lines_to_check
+
+    def test_init(self):
+        checker = changelog.ChangeLogChecker('ChangeLog', self.mock_handle_style_error, self.mock_should_line_be_checked)
+        self.assertEquals(checker.file_path, 'ChangeLog')
+        self.assertEquals(checker.handle_style_error, self.mock_handle_style_error)
+        self.assertEquals(checker.should_line_be_checked, self.mock_should_line_be_checked)
+
+    def test_missing_bug_number(self):
+        self.assert_error(1, range(1, 20), 'changelog/bugnumber',
+                          '2011-01-01  Patrick Gansterer  <paroga@paroga.com>\n'
+                          '\n'
+                          '        Example bug\n')
+        self.assert_error(1, range(1, 20), 'changelog/bugnumber',
+                          '2011-01-01  Patrick Gansterer  <paroga@paroga.com>\n'
+                          '\n'
+                          '        Example bug\n'
+                          '        http://bugs.webkit.org/show_bug.cgi?id=\n')
+        self.assert_error(1, range(1, 20), 'changelog/bugnumber',
+                          '2011-01-01  Patrick Gansterer  <paroga@paroga.com>\n'
+                          '\n'
+                          '        Example bug\n'
+                          '        https://bugs.webkit.org/show_bug.cgi?id=\n')
+        self.assert_error(1, range(1, 20), 'changelog/bugnumber',
+                          '2011-01-01  Patrick Gansterer  <paroga@paroga.com>\n'
+                          '\n'
+                          '        Example bug\n'
+                          '        http://webkit.org/b/\n')
+        self.assert_error(1, range(1, 20), 'changelog/bugnumber',
+                          '2011-01-01  Patrick Gansterer  <paroga@paroga.com>\n'
+                          '\n'
+                          '        Example bug'
+                          '\n'
+                          '        http://trac.webkit.org/changeset/12345\n')
+        self.assert_error(2, range(2, 5), 'changelog/bugnumber',
+                          '2011-01-01  Patrick Gansterer  <paroga@paroga.com>\n'
+                          '        Example bug\n'
+                          '        https://bugs.webkit.org/show_bug.cgi\n'
+                          '\n'
+                          '2011-01-01  Patrick Gansterer  <paroga@paroga.com>\n'
+                          '        Another change\n')
+        self.assert_error(2, range(2, 6), 'changelog/bugnumber',
+                          '2011-01-01  Patrick Gansterer  <paroga@paroga.com>\n'
+                          '        Example bug\n'
+                          '        More text about bug.\n'
+                          '\n'
+                          '2011-01-01  Patrick Gansterer  <paroga@paroga.com>\n'
+                          '\n'
+                          '        No bug in this change.\n')
+
+    def test_no_error(self):
+        self.assert_no_error([],
+                             '2011-01-01  Patrick Gansterer  <paroga@paroga.com>\n'
+                             '\n'
+                             '        Example ChangeLog entry out of range\n'
+                             '        http://example.com/\n')
+        self.assert_no_error([],
+                             '2011-01-01  Patrick Gansterer  <paroga@paroga.com>\n'
+                             '\n'
+                             '        Example bug\n'
+                             '        http://bugs.webkit.org/show_bug.cgi?id=12345\n')
+        self.assert_no_error(range(1, 20),
+                             '2011-01-01  Patrick Gansterer  <paroga@paroga.com>\n'
+                             '\n'
+                             '        Example bug\n'
+                             '        http://bugs.webkit.org/show_bug.cgi?id=12345\n')
+        self.assert_no_error(range(1, 20),
+                             '2011-01-01  Patrick Gansterer  <paroga@paroga.com>\n'
+                             '\n'
+                             '        Example bug\n'
+                             '        https://bugs.webkit.org/show_bug.cgi?id=12345\n')
+        self.assert_no_error(range(1, 20),
+                             '2011-01-01  Patrick Gansterer  <paroga@paroga.com>\n'
+                             '\n'
+                             '        Example bug\n'
+                             '        http://webkit.org/b/12345\n')
+        self.assert_no_error(range(1, 20),
+                             '2011-01-01  Patrick Gansterer  <paroga@paroga.com>\n'
+                             '\n'
+                             '        Unreview build fix for r12345.\n')
+        self.assert_no_error(range(1, 20),
+                             '2011-01-01  Patrick Gansterer  <paroga@paroga.com>\n'
+                             '\n'
+                             '        Fix build after a bad change.\n')
+        self.assert_no_error(range(1, 20),
+                             '2011-01-01  Patrick Gansterer  <paroga@paroga.com>\n'
+                             '\n'
+                             '        Fix example port build.\n')
+        self.assert_no_error(range(2, 6),
+                             '2011-01-01  Patrick Gansterer  <paroga@paroga.com>\n'
+                             '        Example bug\n'
+                             '        https://bugs.webkit.org/show_bug.cgi?id=12345\n'
+                             '\n'
+                             '2011-01-01  Patrick Gansterer  <paroga@paroga.com>\n'
+                             '        No bug here!\n')
+
+if __name__ == '__main__':
+    unittest.main()
diff --git a/Tools/Scripts/webkitpy/style/error_handlers.py b/Tools/Scripts/webkitpy/style/error_handlers.py
index 0bede24..5d8b041 100644
--- a/Tools/Scripts/webkitpy/style/error_handlers.py
+++ b/Tools/Scripts/webkitpy/style/error_handlers.py
@@ -123,16 +123,18 @@ class DefaultStyleErrorHandler(object):
             return None
         return self._configuration.max_reports_per_category[category]
 
+    def should_line_be_checked(self, line_number):
+        "Returns if a particular line should be checked"
+        # Was the line that was modified?
+        return self._line_numbers is None or line_number in self._line_numbers
+
     def __call__(self, line_number, category, confidence, message):
         """Handle the occurrence of a style error.
 
         See the docstring of this module for more information.
 
         """
-        if (self._line_numbers is not None and
-            line_number not in self._line_numbers):
-            # Then the error occurred in a line that was not modified, so
-            # the error is not reportable.
+        if not self.should_line_be_checked(line_number):
             return
 
         if not self._configuration.is_reportable(category=category,
diff --git a/Tools/Scripts/webkitpy/test/cat.py b/Tools/Scripts/webkitpy/test/cat.py
index ae1e143..ac56d1c 100644
--- a/Tools/Scripts/webkitpy/test/cat.py
+++ b/Tools/Scripts/webkitpy/test/cat.py
@@ -30,7 +30,7 @@ from webkitpy.common.system import fileutils
 
 
 def command_arguments(*args):
-    return ['python', __file__] + list(args)
+    return [sys.executable, __file__] + list(args)
 
 
 def main():
diff --git a/Tools/Scripts/webkitpy/test/echo.py b/Tools/Scripts/webkitpy/test/echo.py
index f7468f7..5d4d8e2 100644
--- a/Tools/Scripts/webkitpy/test/echo.py
+++ b/Tools/Scripts/webkitpy/test/echo.py
@@ -30,7 +30,7 @@ from webkitpy.common.system import fileutils
 
 
 def command_arguments(*args):
-    return ['python', __file__] + list(args)
+    return [sys.executable, __file__] + list(args)
 
 
 def main(args=None):
diff --git a/Tools/Scripts/webkitpy/thirdparty/__init__.py b/Tools/Scripts/webkitpy/thirdparty/__init__.py
index c2249c2..9728492 100644
--- a/Tools/Scripts/webkitpy/thirdparty/__init__.py
+++ b/Tools/Scripts/webkitpy/thirdparty/__init__.py
@@ -70,7 +70,7 @@ installer.install(url="http://pypi.python.org/packages/source/C/ClientForm/Clien
 # a new AutoInstaller instance that does not append to the search path.
 installer = AutoInstaller(target_dir=autoinstalled_dir)
 
-installer.install(url="http://pypi.python.org/packages/source/m/mechanize/mechanize-0.1.11.zip",
+installer.install(url="http://pypi.python.org/packages/source/m/mechanize/mechanize-0.2.4.zip",
                   url_subpath="mechanize")
 installer.install(url="http://pypi.python.org/packages/source/p/pep8/pep8-0.5.0.tar.gz#md5=512a818af9979290cd619cce8e9c2e2b",
                   url_subpath="pep8-0.5.0/pep8.py")
diff --git a/Tools/Scripts/webkitpy/tool/bot/commitqueuetask.py b/Tools/Scripts/webkitpy/tool/bot/commitqueuetask.py
index b22138d..c5d9001 100644
--- a/Tools/Scripts/webkitpy/tool/bot/commitqueuetask.py
+++ b/Tools/Scripts/webkitpy/tool/bot/commitqueuetask.py
@@ -178,8 +178,6 @@ class CommitQueueTask(object):
         self._delegate.report_flaky_tests(self._patch, flaky_test_results, results_archive)
 
     def _test_patch(self):
-        if self._patch.is_rollout():
-            return True
         if self._test():
             return True
 
@@ -220,12 +218,13 @@ class CommitQueueTask(object):
             return False
         if not self._apply():
             return self.report_failure()
-        if not self._build():
-            if not self._build_without_patch():
+        if not self._patch.is_rollout():
+            if not self._build():
+                if not self._build_without_patch():
+                    return False
+                return self.report_failure()
+            if not self._test_patch():
                 return False
-            return self.report_failure()
-        if not self._test_patch():
-            return False
         # Make sure the patch is still valid before landing (e.g., make sure
         # no one has set commit-queue- since we started working on the patch.)
         if not self._validate():
diff --git a/Tools/Scripts/webkitpy/tool/commands/queues_unittest.py b/Tools/Scripts/webkitpy/tool/commands/queues_unittest.py
index 8f5c9e6..e2fb09f 100644
--- a/Tools/Scripts/webkitpy/tool/commands/queues_unittest.py
+++ b/Tools/Scripts/webkitpy/tool/commands/queues_unittest.py
@@ -293,8 +293,6 @@ MOCK run_and_throw_if_fail: ['echo', '--status-host=example.com', 'update']
 MOCK: update_status: commit-queue Updated working directory
 MOCK run_and_throw_if_fail: ['echo', '--status-host=example.com', 'apply-attachment', '--no-update', '--non-interactive', 106]
 MOCK: update_status: commit-queue Applied patch
-MOCK run_and_throw_if_fail: ['echo', '--status-host=example.com', 'build', '--no-clean', '--no-update', '--build-style=both']
-MOCK: update_status: commit-queue Built patch
 MOCK run_and_throw_if_fail: ['echo', '--status-host=example.com', 'land-attachment', '--force-clean', '--ignore-builders', '--non-interactive', '--parent-command=commit-queue', 106]
 MOCK: update_status: commit-queue Landed patch
 MOCK: update_status: commit-queue Pass
diff --git a/Tools/Scripts/webkitpy/tool/commands/upload.py b/Tools/Scripts/webkitpy/tool/commands/upload.py
index e455b18..80715a7 100644
--- a/Tools/Scripts/webkitpy/tool/commands/upload.py
+++ b/Tools/Scripts/webkitpy/tool/commands/upload.py
@@ -37,7 +37,7 @@ from optparse import make_option
 from webkitpy.tool import steps
 
 from webkitpy.common.config.committers import CommitterList
-from webkitpy.common.net.bugzilla import parse_bug_id
+from webkitpy.common.net.bugzilla import parse_bug_id_from_changelog
 from webkitpy.common.system.deprecated_logging import error, log
 from webkitpy.common.system.user import User
 from webkitpy.thirdparty.mock import Mock
@@ -173,6 +173,21 @@ class ObsoleteAttachments(AbstractSequencedCommand):
         return { "bug_id" : args[0] }
 
 
+class AttachToBug(AbstractSequencedCommand):
+    name = "attach-to-bug"
+    help_text = "Attach the the file to the bug"
+    argument_names = "BUGID FILEPATH"
+    steps = [
+        steps.AttachToBug,
+    ]
+
+    def _prepare_state(self, options, args, tool):
+        state = {}
+        state["bug_id"] = args[0]
+        state["filepath"] = args[1]
+        return state
+
+
 class AbstractPatchUploadingCommand(AbstractSequencedCommand):
     def _bug_id(self, options, args, tool, state):
         # Perfer a bug id passed as an argument over a bug url in the diff (i.e. ChangeLogs).
@@ -311,7 +326,7 @@ class PostCommits(AbstractDeclarativeCommand):
             commit_message = tool.scm().commit_message_for_local_commit(commit_id)
 
             # Prefer --bug-id=, then a bug url in the commit message, then a bug url in the entire commit diff (i.e. ChangeLogs).
-            bug_id = options.bug_id or parse_bug_id(commit_message.message()) or parse_bug_id(tool.scm().create_patch(git_commit=commit_id))
+            bug_id = options.bug_id or parse_bug_id_from_changelog(commit_message.message()) or parse_bug_id_from_changelog(tool.scm().create_patch(git_commit=commit_id))
             if not bug_id:
                 log("Skipping %s: No bug id found in commit or specified with --bug-id." % commit_id)
                 continue
@@ -351,7 +366,7 @@ class MarkBugFixed(AbstractDeclarativeCommand):
         commit_log = self._fetch_commit_log(tool, svn_revision)
 
         if not bug_id:
-            bug_id = parse_bug_id(commit_log)
+            bug_id = parse_bug_id_from_changelog(commit_log)
 
         if not svn_revision:
             match = re.search("^r(?P<svn_revision>\d+) \|", commit_log, re.MULTILINE)
diff --git a/Tools/Scripts/webkitpy/tool/commands/upload_unittest.py b/Tools/Scripts/webkitpy/tool/commands/upload_unittest.py
index b5f5ae9..4313df9 100644
--- a/Tools/Scripts/webkitpy/tool/commands/upload_unittest.py
+++ b/Tools/Scripts/webkitpy/tool/commands/upload_unittest.py
@@ -68,6 +68,25 @@ MOCK: user.open_url: http://example.com/42
 """
         self.assert_execute_outputs(Post(), [42], options=options, expected_stderr=expected_stderr)
 
+    def test_attach_to_bug(self):
+        options = MockOptions()
+        options.comment = "extra comment"
+        options.description = "file description"
+        expected_stderr = """MOCK add_attachment_to_bug: bug_id=42, description=file description filename=None
+-- Begin comment --
+extra comment
+-- End comment --
+"""
+        self.assert_execute_outputs(AttachToBug(), [42, "path/to/file.txt", "file description"], options=options, expected_stderr=expected_stderr)
+
+    def test_attach_to_bug_no_description_or_comment(self):
+        options = MockOptions()
+        options.comment = None
+        options.description = None
+        expected_stderr = """MOCK add_attachment_to_bug: bug_id=42, description=file.txt filename=None
+"""
+        self.assert_execute_outputs(AttachToBug(), [42, "path/to/file.txt"], options=options, expected_stderr=expected_stderr)
+
     def test_land_safely(self):
         expected_stderr = "Obsoleting 2 old patches on bug 42\nMOCK add_patch_to_bug: bug_id=42, description=Patch for landing, mark_for_review=False, mark_for_commit_queue=False, mark_for_landing=True\n"
         self.assert_execute_outputs(LandSafely(), [42], expected_stderr=expected_stderr)
diff --git a/Tools/Scripts/webkitpy/tool/steps/__init__.py b/Tools/Scripts/webkitpy/tool/steps/__init__.py
index d5d7bb4..a746602 100644
--- a/Tools/Scripts/webkitpy/tool/steps/__init__.py
+++ b/Tools/Scripts/webkitpy/tool/steps/__init__.py
@@ -29,6 +29,7 @@
 # FIXME: Is this the right way to do this?
 from webkitpy.tool.steps.applypatch import ApplyPatch
 from webkitpy.tool.steps.applypatchwithlocalcommit import ApplyPatchWithLocalCommit
+from webkitpy.tool.steps.attachtobug import AttachToBug
 from webkitpy.tool.steps.build import Build
 from webkitpy.tool.steps.checkstyle import CheckStyle
 from webkitpy.tool.steps.cleanworkingdirectory import CleanWorkingDirectory
diff --git a/Tools/Scripts/webkitpy/tool/steps/abstractstep.py b/Tools/Scripts/webkitpy/tool/steps/abstractstep.py
index 1c93d5b..2ba4291 100644
--- a/Tools/Scripts/webkitpy/tool/steps/abstractstep.py
+++ b/Tools/Scripts/webkitpy/tool/steps/abstractstep.py
@@ -40,7 +40,7 @@ class AbstractStep(object):
     # FIXME: This should use tool.port()
     def _run_script(self, script_name, args=None, quiet=False, port=WebKitPort):
         log("Running %s" % script_name)
-        command = [port.script_path(script_name)]
+        command = port.script_shell_command(script_name)
         if args:
             command.extend(args)
         self._tool.executive.run_and_throw_if_fail(command, quiet)
diff --git a/Tools/Scripts/webkitpy/tool/steps/attachtobug.py b/Tools/Scripts/webkitpy/tool/steps/attachtobug.py
new file mode 100644
index 0000000..4885fcb
--- /dev/null
+++ b/Tools/Scripts/webkitpy/tool/steps/attachtobug.py
@@ -0,0 +1,51 @@
+# Copyright (C) 2011 Google Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are
+# met:
+#
+#     * Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+#     * Redistributions in binary form must reproduce the above
+# copyright notice, this list of conditions and the following disclaimer
+# in the documentation and/or other materials provided with the
+# distribution.
+#     * Neither the name of Google Inc. nor the names of its
+# contributors may be used to endorse or promote products derived from
+# this software without specific prior written permission.
+#
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+import os
+
+from webkitpy.tool.steps.abstractstep import AbstractStep
+from webkitpy.tool.steps.options import Options
+
+
+class AttachToBug(AbstractStep):
+    @classmethod
+    def options(cls):
+        return AbstractStep.options() + [
+            Options.comment,
+            Options.description,
+        ]
+
+    def run(self, state):
+        filepath = state["filepath"]
+        bug_id = state["bug_id"]
+        description = self._options.description or filepath.split(os.sep)[-1]
+        comment_text = self._options.comment
+
+        # add_attachment_to_bug fills in the filename from the file path.
+        filename = None
+        self._tool.bugs.add_attachment_to_bug(bug_id, filepath, description, filename, comment_text)
diff --git a/Tools/Scripts/webkitpy/tool/steps/commit.py b/Tools/Scripts/webkitpy/tool/steps/commit.py
index 859acbf..5dc4efb 100644
--- a/Tools/Scripts/webkitpy/tool/steps/commit.py
+++ b/Tools/Scripts/webkitpy/tool/steps/commit.py
@@ -58,7 +58,7 @@ class Commit(AbstractStep):
 
             try:
                 scm = self._tool.scm()
-                commit_text = scm.commit_with_message(self._commit_message, git_commit=self._options.git_commit, username=username, force_squash=force_squash)
+                commit_text = scm.commit_with_message(self._commit_message, git_commit=self._options.git_commit, username=username, force_squash=force_squash, changed_files=self._changed_files(state))
                 svn_revision = scm.svn_revision_from_commit_text(commit_text)
                 log("Committed r%s: <%s>" % (svn_revision, urls.view_revision_url(svn_revision)))
                 self._state["commit_text"] = commit_text
diff --git a/Tools/Scripts/webkitpy/tool/steps/options.py b/Tools/Scripts/webkitpy/tool/steps/options.py
index 5b8baf0..3bba3e2 100644
--- a/Tools/Scripts/webkitpy/tool/steps/options.py
+++ b/Tools/Scripts/webkitpy/tool/steps/options.py
@@ -40,7 +40,7 @@ class Options(object):
     comment = make_option("--comment", action="store", type="string", dest="comment", help="Comment to post to bug.")
     component = make_option("--component", action="store", type="string", dest="component", help="Component for the new bug.")
     confirm = make_option("--no-confirm", action="store_false", dest="confirm", default=True, help="Skip confirmation steps.")
-    description = make_option("-m", "--description", action="store", type="string", dest="description", help="Description string for the attachment (default: \"patch\")")
+    description = make_option("-m", "--description", action="store", type="string", dest="description", help="Description string for the attachment")
     email = make_option("--email", action="store", type="string", dest="email", help="Email address to use in ChangeLogs.")
     force_clean = make_option("--force-clean", action="store_true", dest="force_clean", default=False, help="Clean working directory before applying patches (removes local changes and commits)")
     force_patch = make_option("--force-patch", action="store_true", dest="force_patch", default=False, help="Forcefully applies the patch, continuing past errors.")
diff --git a/Tools/Scripts/webkitpy/tool/steps/preparechangelog.py b/Tools/Scripts/webkitpy/tool/steps/preparechangelog.py
index 17e996c..4be40ca 100644
--- a/Tools/Scripts/webkitpy/tool/steps/preparechangelog.py
+++ b/Tools/Scripts/webkitpy/tool/steps/preparechangelog.py
@@ -61,7 +61,7 @@ class PrepareChangeLog(AbstractStep):
             self._ensure_bug_url(state)
             return
         os.chdir(self._tool.scm().checkout_root)
-        args = [self._tool.port().script_path("prepare-ChangeLog")]
+        args = self._tool.port().script_shell_command("prepare-ChangeLog")
         if state.get("bug_id"):
             args.append("--bug=%s" % state["bug_id"])
             args.append("--description=%s" % self._tool.bugs.fetch_bug(state["bug_id"]).title())
diff --git a/Tools/TestResultServer/handlers/dashboardhandler.py b/Tools/TestResultServer/handlers/dashboardhandler.py
index c8b5ace..fbbd56b 100644
--- a/Tools/TestResultServer/handlers/dashboardhandler.py
+++ b/Tools/TestResultServer/handlers/dashboardhandler.py
@@ -87,11 +87,15 @@ class UpdateDashboardFile(webapp.RequestHandler):
     def get(self):
         files = self.request.get_all(PARAM_FILE)
         if not files:
-            files = ["flakiness_dashboard.html",
+            # FIXME: Just grab the entire dashboards directory.
+            files = ["aggregate_results.html",
                      "dashboard_base.js",
-                     "aggregate_results.html",
                      "dygraph-combined.js",
-                     "timeline_explorer.html"]
+                     "flakiness_dashboard.html",
+                     "timeline_explorer.html",
+                     "treemap.html",
+                     "webtreemap.css",
+                     "webtreemap.js"]
 
         errors = []
         for file in files:
diff --git a/Tools/TestWebKitAPI/Configurations/Base.xcconfig b/Tools/TestWebKitAPI/Configurations/Base.xcconfig
index feb7c5e..4125813 100644
--- a/Tools/TestWebKitAPI/Configurations/Base.xcconfig
+++ b/Tools/TestWebKitAPI/Configurations/Base.xcconfig
@@ -52,12 +52,23 @@ TARGET_GCC_VERSION_1050_ = $(TARGET_GCC_VERSION_1050_$(XCODE_VERSION_ACTUAL));
 TARGET_GCC_VERSION_1050_0310 = GCC_42;
 TARGET_GCC_VERSION_1050_0320 = GCC_42;
 TARGET_GCC_VERSION_1060 = GCC_42;
-TARGET_GCC_VERSION_1070 = LLVM_GCC_42;
+TARGET_GCC_VERSION_1070 = $(TARGET_GCC_VERSION_1070_$(CONFIGURATION));
+TARGET_GCC_VERSION_1070_Debug = LLVM_COMPILER;
+TARGET_GCC_VERSION_1070_Release = LLVM_GCC_42;
+TARGET_GCC_VERSION_1070_Production = LLVM_GCC_42;
 
 GCC_VERSION = $(GCC_VERSION_$(TARGET_GCC_VERSION));
 GCC_VERSION_GCC_40 = 4.0;
 GCC_VERSION_GCC_42 = 4.2;
 GCC_VERSION_LLVM_GCC_42 = com.apple.compilers.llvmgcc42;
+GCC_VERSION_LLVM_COMPILER = com.apple.compilers.llvm.clang.1_0;
+
+// FIXME: Disable C++ exceptions in the LLVM Compiler once it supports enabling Obj-C exceptions without C++ exceptions.
+GCC_ENABLE_CPP_EXCEPTIONS = $(GCC_ENABLE_CPP_EXCEPTIONS_$(TARGET_GCC_VERSION));
+GCC_ENABLE_CPP_EXCEPTIONS_GCC_40 = NO;
+GCC_ENABLE_CPP_EXCEPTIONS_GCC_42 = NO;
+GCC_ENABLE_CPP_EXCEPTIONS_LLVM_GCC = NO;
+GCC_ENABLE_CPP_EXCEPTIONS_LLVM_COMPILER = YES;
 
 // If the target Mac OS X version does not match the current Mac OS X version then we'll want to build using the target version's SDK.
 SDKROOT = $(SDKROOT_$(MAC_OS_X_VERSION_MAJOR)_$(TARGET_MAC_OS_X_VERSION_MAJOR));
diff --git a/Tools/TestWebKitAPI/Configurations/InjectedBundle.xcconfig b/Tools/TestWebKitAPI/Configurations/InjectedBundle.xcconfig
index 6bf31b2..7f8c897 100644
--- a/Tools/TestWebKitAPI/Configurations/InjectedBundle.xcconfig
+++ b/Tools/TestWebKitAPI/Configurations/InjectedBundle.xcconfig
@@ -21,4 +21,5 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 
-PRODUCT_NAME = InjectedBundleTestWebKitAPI
+PRODUCT_NAME = InjectedBundleTestWebKitAPI;
+GCC_PREFIX_HEADER = TestWebKitAPIPrefix.h;
diff --git a/Tools/TestWebKitAPI/Configurations/TestWebKitAPICFNetwork.vsprops b/Tools/TestWebKitAPI/Configurations/TestWebKitAPICFNetwork.vsprops
new file mode 100644
index 0000000..1a5f5ea
--- /dev/null
+++ b/Tools/TestWebKitAPI/Configurations/TestWebKitAPICFNetwork.vsprops
@@ -0,0 +1,11 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="TestWebKitAPICFNetwork"
+	>
+	<Tool
+		Name="VCLinkerTool"
+		AdditionalDependencies="CFNetwork$(LibraryConfigSuffix).lib"
+	/>
+</VisualStudioPropertySheet>
diff --git a/Tools/TestWebKitAPI/Configurations/TestWebKitAPIDebug.vsprops b/Tools/TestWebKitAPI/Configurations/TestWebKitAPIDebug.vsprops
index 565455e..ad76269 100644
--- a/Tools/TestWebKitAPI/Configurations/TestWebKitAPIDebug.vsprops
+++ b/Tools/TestWebKitAPI/Configurations/TestWebKitAPIDebug.vsprops
@@ -3,6 +3,6 @@
 	ProjectType="Visual C++"
 	Version="8.00"
 	Name="TestWebKitAPIDebug"
-	InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;..\Configurations\TestWebKitAPICommon.vsprops;..\Configurations\TestWebKitAPICoreFoundation.vsprops"
+	InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;.\TestWebKitAPICommon.vsprops;.\TestWebKitAPICoreFoundation.vsprops;.\TestWebKitAPICFNetwork.vsprops"
 	>
 </VisualStudioPropertySheet>
diff --git a/Tools/TestWebKitAPI/Configurations/TestWebKitAPIDebugAll.vsprops b/Tools/TestWebKitAPI/Configurations/TestWebKitAPIDebugAll.vsprops
index 4b9ffac..cc4a879 100644
--- a/Tools/TestWebKitAPI/Configurations/TestWebKitAPIDebugAll.vsprops
+++ b/Tools/TestWebKitAPI/Configurations/TestWebKitAPIDebugAll.vsprops
@@ -3,6 +3,6 @@
 	ProjectType="Visual C++"
 	Version="8.00"
 	Name="TestWebKitAPIDebugAll"
-	InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\debug_all.vsprops;..\Configurations\TestWebKitAPICommon.vsprops;..\Configurations\TestWebKitAPICoreFoundation.vsprops"
+	InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\debug_all.vsprops;.\TestWebKitAPICommon.vsprops;.\TestWebKitAPICoreFoundation.vsprops;.\TestWebKitAPICFNetwork.vsprops"
 	>
 </VisualStudioPropertySheet>
diff --git a/Tools/TestWebKitAPI/Configurations/TestWebKitAPIDebugCairoCFLite.vsprops b/Tools/TestWebKitAPI/Configurations/TestWebKitAPIDebugCairoCFLite.vsprops
index a218ec7..49bb10d 100644
--- a/Tools/TestWebKitAPI/Configurations/TestWebKitAPIDebugCairoCFLite.vsprops
+++ b/Tools/TestWebKitAPI/Configurations/TestWebKitAPIDebugCairoCFLite.vsprops
@@ -3,6 +3,6 @@
 	ProjectType="Visual C++"
 	Version="8.00"
 	Name="TestWebKitAPIDebugCairoCFLite"
-	InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\debug_wincairo.vsprops;..\Configurations\TestWebKitAPICommon.vsprops;..\Configurations\TestWebKitAPICFLite.vsprops"
+	InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\debug_wincairo.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\WinCairo.vsprops;..\Configurations\TestWebKitAPICommon.vsprops;..\Configurations\TestWebKitAPICFLite.vsprops"
 	>
 </VisualStudioPropertySheet>
diff --git a/Tools/TestWebKitAPI/Configurations/TestWebKitAPIRelease.vsprops b/Tools/TestWebKitAPI/Configurations/TestWebKitAPIRelease.vsprops
index f98fbfc..e7a103c 100644
--- a/Tools/TestWebKitAPI/Configurations/TestWebKitAPIRelease.vsprops
+++ b/Tools/TestWebKitAPI/Configurations/TestWebKitAPIRelease.vsprops
@@ -3,6 +3,6 @@
 	ProjectType="Visual C++"
 	Version="8.00"
 	Name="TestWebKitAPIRelease"
-	InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;..\Configurations\TestWebKitAPICommon.vsprops;..\Configurations\TestWebKitAPICoreFoundation.vsprops"
+	InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;.\TestWebKitAPICommon.vsprops;.\TestWebKitAPICoreFoundation.vsprops;.\TestWebKitAPICFNetwork.vsprops"
 	>
 </VisualStudioPropertySheet>
diff --git a/Tools/TestWebKitAPI/PlatformUtilities.h b/Tools/TestWebKitAPI/PlatformUtilities.h
index 219a5dc..a682545 100644
--- a/Tools/TestWebKitAPI/PlatformUtilities.h
+++ b/Tools/TestWebKitAPI/PlatformUtilities.h
@@ -43,6 +43,7 @@ WKContextRef createContextForInjectedBundleTest(const std::string&, WKTypeRef us
 WKStringRef createInjectedBundlePath();
 WKURLRef createURLForResource(const char* resource, const char* extension);
 WKURLRef URLForNonExistentResource();
+WKRetainPtr<WKStringRef> MIMETypeForWKURLResponse(WKURLResponseRef);
 
 bool isKeyDown(WKNativeEventPtr);
 
diff --git a/Tools/TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj b/Tools/TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj
index 079b7ff..c5c9555 100644
--- a/Tools/TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj
+++ b/Tools/TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj
@@ -18,6 +18,9 @@
 		BC131885117114B600B69727 /* PlatformUtilitiesMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = BC131884117114B600B69727 /* PlatformUtilitiesMac.mm */; };
 		BC131A9B1171316900B69727 /* main.mm in Sources */ = {isa = PBXBuildFile; fileRef = BC131A9A1171316900B69727 /* main.mm */; };
 		BC131AA9117131FC00B69727 /* TestsController.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC131AA8117131FC00B69727 /* TestsController.cpp */; };
+		BC246D8E132F115A00B56D7C /* AboutBlankLoad.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC246D8C132F115A00B56D7C /* AboutBlankLoad.cpp */; };
+		BC246D9A132F1FE100B56D7C /* CanHandleRequest.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC246D98132F1FE100B56D7C /* CanHandleRequest.cpp */; };
+		BC246D9C132F1FF000B56D7C /* CanHandleRequest_Bundle.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC246D97132F1FE100B56D7C /* CanHandleRequest_Bundle.cpp */; };
 		BC2D004912A9FDFA00E732A3 /* PageLoadDidChangeLocationWithinPageForFrame.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC2D004812A9FDFA00E732A3 /* PageLoadDidChangeLocationWithinPageForFrame.cpp */; };
 		BC2D006412AA04CE00E732A3 /* file-with-anchor.html in Copy Resources */ = {isa = PBXBuildFile; fileRef = BC2D004A12A9FEB300E732A3 /* file-with-anchor.html */; };
 		BC575A90126E74D3006F0F12 /* Cocoa.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = BCB9E9F011235BDE00A137E0 /* Cocoa.framework */; };
@@ -54,6 +57,8 @@
 		C0ADBE9612FCA79B00D2C129 /* simple-form.html in Copy Resources */ = {isa = PBXBuildFile; fileRef = C0ADBE8412FCA6B600D2C129 /* simple-form.html */; };
 		C0BD669D131D3CF700E18F2A /* ResponsivenessTimerDoesntFireEarly.cpp in Sources */ = {isa = PBXBuildFile; fileRef = C0BD669C131D3CF700E18F2A /* ResponsivenessTimerDoesntFireEarly.cpp */; };
 		C0BD669F131D3CFF00E18F2A /* ResponsivenessTimerDoesntFireEarly_Bundle.cpp in Sources */ = {isa = PBXBuildFile; fileRef = C0BD669E131D3CFF00E18F2A /* ResponsivenessTimerDoesntFireEarly_Bundle.cpp */; };
+		F6C59E38132AC5E000176C09 /* SendingMessagesToTheWebProcessBeforeItIsValid.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F6C59E37132AC5DF00176C09 /* SendingMessagesToTheWebProcessBeforeItIsValid.cpp */; };
+		F6F3F29113342FEB00A6BF19 /* CookieManager.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F6F3F29013342FEB00A6BF19 /* CookieManager.cpp */; };
 /* End PBXBuildFile section */
 
 /* Begin PBXContainerItemProxy section */
@@ -110,6 +115,9 @@
 		BC131A9A1171316900B69727 /* main.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = main.mm; sourceTree = "<group>"; };
 		BC131A9E1171317C00B69727 /* TestWebKitAPIPrefix.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = TestWebKitAPIPrefix.h; sourceTree = "<group>"; };
 		BC131AA8117131FC00B69727 /* TestsController.cpp */ = {isa = PBXFileReference; explicitFileType = sourcecode.cpp.cpp; fileEncoding = 4; path = TestsController.cpp; sourceTree = "<group>"; };
+		BC246D8C132F115A00B56D7C /* AboutBlankLoad.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = AboutBlankLoad.cpp; sourceTree = "<group>"; };
+		BC246D97132F1FE100B56D7C /* CanHandleRequest_Bundle.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = CanHandleRequest_Bundle.cpp; sourceTree = "<group>"; };
+		BC246D98132F1FE100B56D7C /* CanHandleRequest.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = CanHandleRequest.cpp; sourceTree = "<group>"; };
 		BC2D004812A9FDFA00E732A3 /* PageLoadDidChangeLocationWithinPageForFrame.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = PageLoadDidChangeLocationWithinPageForFrame.cpp; sourceTree = "<group>"; };
 		BC2D004A12A9FEB300E732A3 /* file-with-anchor.html */ = {isa = PBXFileReference; explicitFileType = text.html; fileEncoding = 4; path = "file-with-anchor.html"; sourceTree = "<group>"; };
 		BC575946126E7351006F0F12 /* InjectedBundleMain.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = InjectedBundleMain.cpp; sourceTree = "<group>"; };
@@ -153,6 +161,8 @@
 		C0ADBE8412FCA6B600D2C129 /* simple-form.html */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.html; path = "simple-form.html"; sourceTree = "<group>"; };
 		C0BD669C131D3CF700E18F2A /* ResponsivenessTimerDoesntFireEarly.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ResponsivenessTimerDoesntFireEarly.cpp; sourceTree = "<group>"; };
 		C0BD669E131D3CFF00E18F2A /* ResponsivenessTimerDoesntFireEarly_Bundle.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ResponsivenessTimerDoesntFireEarly_Bundle.cpp; sourceTree = "<group>"; };
+		F6C59E37132AC5DF00176C09 /* SendingMessagesToTheWebProcessBeforeItIsValid.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SendingMessagesToTheWebProcessBeforeItIsValid.cpp; sourceTree = "<group>"; };
+		F6F3F29013342FEB00A6BF19 /* CookieManager.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = CookieManager.cpp; sourceTree = "<group>"; };
 /* End PBXFileReference section */
 
 /* Begin PBXFrameworksBuildPhase section */
@@ -257,6 +267,10 @@
 			isa = PBXGroup;
 			children = (
 				BC90977B125571AE00083756 /* Resources */,
+				BC246D8C132F115A00B56D7C /* AboutBlankLoad.cpp */,
+				BC246D97132F1FE100B56D7C /* CanHandleRequest_Bundle.cpp */,
+				BC246D98132F1FE100B56D7C /* CanHandleRequest.cpp */,
+				F6F3F29013342FEB00A6BF19 /* CookieManager.cpp */,
 				BCB6803F126FBFE100642A61 /* DocumentStartUserScriptAlertCrash.cpp */,
 				BCB68041126FBFF100642A61 /* DocumentStartUserScriptAlertCrash_Bundle.cpp */,
 				1A5FEFDC1270E2A3000E2921 /* EvaluateJavaScript.cpp */,
@@ -275,6 +289,7 @@
 				C0BD669C131D3CF700E18F2A /* ResponsivenessTimerDoesntFireEarly.cpp */,
 				C0BD669E131D3CFF00E18F2A /* ResponsivenessTimerDoesntFireEarly_Bundle.cpp */,
 				C0ADBE8212FCA6AA00D2C129 /* RestoreSessionStateContainingFormData.cpp */,
+				F6C59E37132AC5DF00176C09 /* SendingMessagesToTheWebProcessBeforeItIsValid.cpp */,
 				C02B77F1126612140026BF0F /* SpacebarScrolling.cpp */,
 				BC7B619A1299FE9E00D174A4 /* WKPreferences.cpp */,
 				BC90995D12567BC100083756 /* WKString.cpp */,
@@ -429,6 +444,10 @@
 				1ADBEFAE130C689C00D61D19 /* ForceRepaint.cpp in Sources */,
 				4BFDFFA9131477770061F24B /* HitTestResultNodeHandle.cpp in Sources */,
 				C0BD669D131D3CF700E18F2A /* ResponsivenessTimerDoesntFireEarly.cpp in Sources */,
+				F6C59E38132AC5E000176C09 /* SendingMessagesToTheWebProcessBeforeItIsValid.cpp in Sources */,
+				BC246D8E132F115A00B56D7C /* AboutBlankLoad.cpp in Sources */,
+				BC246D9A132F1FE100B56D7C /* CanHandleRequest.cpp in Sources */,
+				F6F3F29113342FEB00A6BF19 /* CookieManager.cpp in Sources */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
@@ -444,6 +463,7 @@
 				BCB68042126FBFF100642A61 /* DocumentStartUserScriptAlertCrash_Bundle.cpp in Sources */,
 				4BFDFFA71314776C0061F24B /* HitTestResultNodeHandle_Bundle.cpp in Sources */,
 				C0BD669F131D3CFF00E18F2A /* ResponsivenessTimerDoesntFireEarly_Bundle.cpp in Sources */,
+				BC246D9C132F1FF000B56D7C /* CanHandleRequest_Bundle.cpp in Sources */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
diff --git a/Tools/TestWebKitAPI/TestWebKitAPIPrefix.h b/Tools/TestWebKitAPI/TestWebKitAPIPrefix.h
index 00e14ad..ee56430 100644
--- a/Tools/TestWebKitAPI/TestWebKitAPIPrefix.h
+++ b/Tools/TestWebKitAPI/TestWebKitAPIPrefix.h
@@ -36,6 +36,10 @@
 
 #endif
 
+/* FIXME: Define these properly once USE(EXPORT_MACROS) is set for ports using this */
+#define JS_EXPORT_PRIVATE
+#define WTF_EXPORT_PRIVATE
+
 #include <stdint.h>
 
 #include <WebKit2/WebKit2.h>
diff --git a/Tools/TestWebKitAPI/Tests/WebKit2/AboutBlankLoad.cpp b/Tools/TestWebKitAPI/Tests/WebKit2/AboutBlankLoad.cpp
new file mode 100644
index 0000000..27180e3
--- /dev/null
+++ b/Tools/TestWebKitAPI/Tests/WebKit2/AboutBlankLoad.cpp
@@ -0,0 +1,60 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "Test.h"
+
+#include "PlatformUtilities.h"
+#include "PlatformWebView.h"
+#include <WebKit2/WebKit2.h>
+
+namespace TestWebKitAPI {
+    
+static bool done;
+
+static void decidePolicyForResponse(WKPageRef, WKFrameRef, WKURLResponseRef response, WKURLRequestRef, WKFramePolicyListenerRef listener, WKTypeRef, const void*)
+{
+    TEST_ASSERT(WKStringIsEqualToUTF8CString(Util::MIMETypeForWKURLResponse(response).get(), "text/html"));
+
+    WKFramePolicyListenerUse(listener);
+    done = true;
+}
+
+TEST(WebKit2, AboutBlankLoad)
+{
+    WKRetainPtr<WKContextRef> context = Util::adoptWK(WKContextCreate());
+    PlatformWebView webView(context.get());
+
+    WKPagePolicyClient policyClient;
+    memset(&policyClient, 0, sizeof(policyClient));
+
+    policyClient.decidePolicyForResponse = decidePolicyForResponse;
+    WKPageSetPagePolicyClient(webView.page(), &policyClient);
+
+    WKPageLoadURL(webView.page(), Util::adoptWK(WKURLCreateWithUTF8CString("about:blank")).get());
+
+    Util::run(&done);
+}
+
+} // namespace TestWebKitAPI
diff --git a/Tools/TestWebKitAPI/Tests/WebKit2/CanHandleRequest.cpp b/Tools/TestWebKitAPI/Tests/WebKit2/CanHandleRequest.cpp
new file mode 100644
index 0000000..8460847
--- /dev/null
+++ b/Tools/TestWebKitAPI/Tests/WebKit2/CanHandleRequest.cpp
@@ -0,0 +1,72 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "Test.h"
+
+#include "PlatformUtilities.h"
+#include "PlatformWebView.h"
+#include <WebKit2/WKContextPrivate.h>
+#include <WebKit2/WKNumber.h>
+
+namespace TestWebKitAPI {
+
+static bool didReceiveMessage;
+static bool canHandleRequest;
+
+static void didReceiveMessageFromInjectedBundle(WKContextRef, WKStringRef messageName, WKTypeRef body, const void*)
+{
+    didReceiveMessage = true;
+
+    TEST_ASSERT(WKStringIsEqualToUTF8CString(messageName, "DidCheckCanHandleRequest"));
+    TEST_ASSERT(WKGetTypeID(body) == WKBooleanGetTypeID());
+    canHandleRequest = WKBooleanGetValue(static_cast<WKBooleanRef>(body));
+}
+
+static void setInjectedBundleClient(WKContextRef context)
+{
+    WKContextInjectedBundleClient injectedBundleClient;
+    memset(&injectedBundleClient, 0, sizeof(injectedBundleClient));
+    injectedBundleClient.didReceiveMessageFromInjectedBundle = didReceiveMessageFromInjectedBundle;
+
+    WKContextSetInjectedBundleClient(context, &injectedBundleClient);
+}
+
+TEST(WebKit2, CanHandleRequest)
+{
+    WKRetainPtr<WKContextRef> context = Util::adoptWK(Util::createContextForInjectedBundleTest("CanHandleRequestTest"));
+    setInjectedBundleClient(context.get());
+
+    _WKContextRegisterURLSchemeAsEmptyDocument(context.get(), Util::toWK("emptyscheme").get());
+
+    PlatformWebView webView(context.get());
+
+    WKPageLoadURL(webView.page(), Util::adoptWK(Util::createURLForResource("simple", "html")).get());
+
+    WKContextPostMessageToInjectedBundle(context.get(), Util::toWK("CheckCanHandleRequest").get(), 0);
+    Util::run(&didReceiveMessage);
+    TEST_ASSERT(canHandleRequest);
+}
+
+} // namespace TestWebKitAPI
diff --git a/Tools/TestWebKitAPI/Tests/WebKit2/CanHandleRequest_Bundle.cpp b/Tools/TestWebKitAPI/Tests/WebKit2/CanHandleRequest_Bundle.cpp
new file mode 100644
index 0000000..a253362
--- /dev/null
+++ b/Tools/TestWebKitAPI/Tests/WebKit2/CanHandleRequest_Bundle.cpp
@@ -0,0 +1,66 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "InjectedBundleTest.h"
+
+#include "PlatformUtilities.h"
+#include <WebKit2/WKBundlePage.h>
+
+namespace TestWebKitAPI {
+
+class CanHandleRequestTest : public InjectedBundleTest {
+public:
+    CanHandleRequestTest(const std::string& identifier);
+
+private:
+    virtual void didReceiveMessage(WKBundleRef, WKStringRef messageName, WKTypeRef messageBody);
+};
+
+static InjectedBundleTest::Register<CanHandleRequestTest> registrar("CanHandleRequestTest");
+
+CanHandleRequestTest::CanHandleRequestTest(const std::string& identifier)
+    : InjectedBundleTest(identifier)
+{
+}
+
+static bool canHandleURL(const char* url)
+{
+    return WKBundlePageCanHandleRequest(Util::adoptWK(WKURLRequestCreateWithWKURL(Util::adoptWK(WKURLCreateWithUTF8CString(url)).get())).get());
+}
+
+static bool runTest()
+{
+    return canHandleURL("about:blank") && canHandleURL("emptyscheme://") && !canHandleURL("notascheme://");
+}
+
+void CanHandleRequestTest::didReceiveMessage(WKBundleRef bundle, WKStringRef messageName, WKTypeRef)
+{
+    if (!WKStringIsEqualToUTF8CString(messageName, "CheckCanHandleRequest"))
+        return;
+
+    WKBundlePostMessage(bundle, Util::toWK("DidCheckCanHandleRequest").get(), Util::adoptWK(WKBooleanCreate(runTest())).get());
+}
+
+} // namespace TestWebKitAPI
diff --git a/Tools/TestWebKitAPI/Tests/WebKit2/CookieManager.cpp b/Tools/TestWebKitAPI/Tests/WebKit2/CookieManager.cpp
new file mode 100644
index 0000000..cc4fc43
--- /dev/null
+++ b/Tools/TestWebKitAPI/Tests/WebKit2/CookieManager.cpp
@@ -0,0 +1,88 @@
+/*
+ * Copyright (C) 2010 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "Test.h"
+
+#include "PlatformUtilities.h"
+#include "PlatformWebView.h"
+#include <WebKit2/WKCookieManager.h>
+#include <WebKit2/WKRetainPtr.h>
+#include <WebKit2/WebKit2.h>
+
+namespace TestWebKitAPI {
+
+static bool testDone;
+// Make sure that the policy on the machine running the test is not changed after running the test.
+static WKHTTPCookieAcceptPolicy userPolicy;
+static WKHTTPCookieAcceptPolicy testPolicy;
+static WKRetainPtr<WKContextRef> wkContext;
+
+static void didGetTestHTTPCookieAcceptPolicy(WKHTTPCookieAcceptPolicy policy, WKErrorRef, void* context)
+{
+    TEST_ASSERT(context == reinterpret_cast<void*>(0x1234578));
+    TEST_ASSERT(policy == testPolicy);
+    WKCookieManagerRef cookieManager = WKContextGetCookieManager(wkContext.get());
+    WKCookieManagerSetHTTPCookieAcceptPolicy(cookieManager, userPolicy);
+
+    testDone = true;
+}
+
+static void didGetUserHTTPCookieAcceptPolicy(WKHTTPCookieAcceptPolicy policy, WKErrorRef, void* context)
+{
+    TEST_ASSERT(context == reinterpret_cast<void*>(0x1234578));
+
+    userPolicy = policy;
+
+    // Make sure to choose a policy different from the policy the user currently has set.
+    testPolicy = (userPolicy + 1) % 3;
+    WKCookieManagerRef cookieManager = WKContextGetCookieManager(wkContext.get());
+    WKCookieManagerSetHTTPCookieAcceptPolicy(cookieManager, testPolicy);
+    WKCookieManagerGetHTTPCookieAcceptPolicy(cookieManager, reinterpret_cast<void*>(0x1234578), didGetTestHTTPCookieAcceptPolicy);
+}
+
+static void didFinishLoadForFrame(WKPageRef, WKFrameRef, WKTypeRef, const void*)
+{
+    WKCookieManagerRef cookieManager = WKContextGetCookieManager(wkContext.get());
+    WKCookieManagerGetHTTPCookieAcceptPolicy(cookieManager, reinterpret_cast<void*>(0x1234578), didGetUserHTTPCookieAcceptPolicy);
+}
+
+TEST(WebKit2, CookieManager)
+{
+    wkContext.adopt(WKContextCreate());
+    PlatformWebView webView(wkContext.get());
+
+    WKPageLoaderClient loaderClient;
+    memset(&loaderClient, 0, sizeof(loaderClient));
+
+    loaderClient.version = 0;
+    loaderClient.didFinishLoadForFrame = didFinishLoadForFrame;
+    WKPageSetPageLoaderClient(webView.page(), &loaderClient);
+
+    WKPageLoadURL(webView.page(), Util::adoptWK(WKURLCreateWithUTF8CString("about:blank")).get());
+
+    Util::run(&testDone);
+}
+
+} // namespace TestWebKitAPI
diff --git a/Tools/TestWebKitAPI/Tests/WebKit2/SendingMessagesToTheWebProcessBeforeItIsValid.cpp b/Tools/TestWebKitAPI/Tests/WebKit2/SendingMessagesToTheWebProcessBeforeItIsValid.cpp
new file mode 100644
index 0000000..d48ba31
--- /dev/null
+++ b/Tools/TestWebKitAPI/Tests/WebKit2/SendingMessagesToTheWebProcessBeforeItIsValid.cpp
@@ -0,0 +1,42 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "Test.h"
+
+#include <WebKit2/WKRetainPtr.h>
+#include <WebKit2/WKContext.h>
+
+namespace TestWebKitAPI {
+
+TEST(WebKit2, SendingMessagesToTheWebProcessBeforeItIsValid)
+{
+    WKRetainPtr<WKContextRef> context(AdoptWK, WKContextCreate());
+
+    // Neither of these calls should cause a crash.
+    WKContextClearResourceCaches(context.get(), kWKAllResourceCaches);
+    WKContextClearResourceCaches(context.get(), kWKInMemoryResourceCachesOnly);
+}
+
+} // namespace TestWebKitAPI
diff --git a/Tools/TestWebKitAPI/Tests/WebKit2/win/DoNotCopyANullCFURLResponse.cpp b/Tools/TestWebKitAPI/Tests/WebKit2/win/DoNotCopyANullCFURLResponse.cpp
new file mode 100644
index 0000000..c3560bd
--- /dev/null
+++ b/Tools/TestWebKitAPI/Tests/WebKit2/win/DoNotCopyANullCFURLResponse.cpp
@@ -0,0 +1,41 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "Test.h"
+
+#include <WebKit2/WKRetainPtr.h>
+#include <WebKit2/WKURLResponseCF.h>
+#include <wtf/RetainPtr.h>
+
+namespace TestWebKitAPI {
+
+TEST(WebKit2, DoNotCopyANullCFURLResponse)
+{
+    // Neither of these calls should cause a crash.
+    WKRetainPtr<WKURLResponseRef> nullWKResponse(AdoptWK, WKURLResponseCreateWithCFURLResponse(0));
+    RetainPtr<CFURLResponseRef> nullCFResponse(AdoptCF, WKURLResponseCopyCFURLResponse(kCFAllocatorDefault, nullWKResponse.get()));
+}
+
+} // namespace TestWebKitAPI
diff --git a/Tools/TestWebKitAPI/mac/PlatformUtilitiesMac.mm b/Tools/TestWebKitAPI/mac/PlatformUtilitiesMac.mm
index 57ec675..234223f 100644
--- a/Tools/TestWebKitAPI/mac/PlatformUtilitiesMac.mm
+++ b/Tools/TestWebKitAPI/mac/PlatformUtilitiesMac.mm
@@ -28,7 +28,9 @@
 #include <WebKit2/WKRetainPtr.h>
 #include <WebKit2/WKStringCF.h>
 #include <WebKit2/WKURLCF.h>
+#include <WebKit2/WKURLResponseNS.h>
 #include <WebKit2/WebKit2.h>
+#include <wtf/RetainPtr.h>
 
 namespace TestWebKitAPI {
 namespace Util {
@@ -62,6 +64,12 @@ WKURLRef URLForNonExistentResource()
     return WKURLCreateWithCFURL((CFURLRef)nsURL);
 }
 
+WKRetainPtr<WKStringRef> MIMETypeForWKURLResponse(WKURLResponseRef wkResponse)
+{
+    RetainPtr<NSURLResponse> response(AdoptNS, WKURLResponseCopyNSURLResponse(wkResponse));
+    return adoptWK(WKStringCreateWithCFString((CFStringRef)[response.get() MIMEType]));
+}
+
 bool isKeyDown(WKNativeEventPtr event)
 {
     return [event type] == NSKeyDown;
diff --git a/Tools/TestWebKitAPI/win/PlatformUtilitiesWin.cpp b/Tools/TestWebKitAPI/win/PlatformUtilitiesWin.cpp
index 8ed2fbf..181d88e 100644
--- a/Tools/TestWebKitAPI/win/PlatformUtilitiesWin.cpp
+++ b/Tools/TestWebKitAPI/win/PlatformUtilitiesWin.cpp
@@ -29,6 +29,10 @@
 #include <WebKit2/WKURLCF.h>
 #include <wtf/RetainPtr.h>
 
+#if USE(CFNETWORK)
+#include <WebKit2/WKURLResponseCF.h>
+#endif
+
 namespace TestWebKitAPI {
 namespace Util {
 
@@ -81,6 +85,16 @@ WKURLRef URLForNonExistentResource()
     return WKURLCreateWithUTF8CString("file:///does-not-exist.html");
 }
 
+WKRetainPtr<WKStringRef> MIMETypeForWKURLResponse(WKURLResponseRef wkResponse)
+{
+#if USE(CFNETWORK)
+    RetainPtr<CFURLResponseRef> response(AdoptCF, WKURLResponseCopyCFURLResponse(0, wkResponse));
+    return adoptWK(WKStringCreateWithCFString(CFURLResponseGetMIMEType(response.get())));
+#else
+    return 0;
+#endif
+}
+
 bool isKeyDown(WKNativeEventPtr event)
 {
     return event->message == WM_KEYDOWN;
diff --git a/Tools/TestWebKitAPI/win/TestWebKitAPI.sln b/Tools/TestWebKitAPI/win/TestWebKitAPI.sln
index 4202817..c2728d3 100644
--- a/Tools/TestWebKitAPI/win/TestWebKitAPI.sln
+++ b/Tools/TestWebKitAPI/win/TestWebKitAPI.sln
@@ -19,7 +19,7 @@ Global
 		Debug_Cairo_CFLite|Win32 = Debug_Cairo_CFLite|Win32
 		Debug|Win32 = Debug|Win32
 		Release_Cairo_CFLite|Win32 = Release_Cairo_CFLite|Win32
-		Release_LTCG|Win32 = Release_LTCG|Win32
+		Production|Win32 = Production|Win32
 		Release|Win32 = Release|Win32
 	EndGlobalSection
 	GlobalSection(ProjectConfigurationPlatforms) = postSolution
@@ -31,8 +31,8 @@ Global
 		{3E48AB23-D249-488F-A1C4-43CDF52FBD28}.Debug|Win32.Build.0 = Debug|Win32
 		{3E48AB23-D249-488F-A1C4-43CDF52FBD28}.Release_Cairo_CFLite|Win32.ActiveCfg = Release_Cairo_CFLite|Win32
 		{3E48AB23-D249-488F-A1C4-43CDF52FBD28}.Release_Cairo_CFLite|Win32.Build.0 = Release_Cairo_CFLite|Win32
-		{3E48AB23-D249-488F-A1C4-43CDF52FBD28}.Release_LTCG|Win32.ActiveCfg = Release_LTCG|Win32
-		{3E48AB23-D249-488F-A1C4-43CDF52FBD28}.Release_LTCG|Win32.Build.0 = Release_LTCG|Win32
+		{3E48AB23-D249-488F-A1C4-43CDF52FBD28}.Production|Win32.ActiveCfg = Production|Win32
+		{3E48AB23-D249-488F-A1C4-43CDF52FBD28}.Production|Win32.Build.0 = Production|Win32
 		{3E48AB23-D249-488F-A1C4-43CDF52FBD28}.Release|Win32.ActiveCfg = Release|Win32
 		{3E48AB23-D249-488F-A1C4-43CDF52FBD28}.Release|Win32.Build.0 = Release|Win32
 		{45C45411-7F0E-404D-919A-4EE9BB60BE86}.Debug_All|Win32.ActiveCfg = Debug_All|Win32
@@ -43,8 +43,8 @@ Global
 		{45C45411-7F0E-404D-919A-4EE9BB60BE86}.Debug|Win32.Build.0 = Debug|Win32
 		{45C45411-7F0E-404D-919A-4EE9BB60BE86}.Release_Cairo_CFLite|Win32.ActiveCfg = Release_Cairo_CFLite|Win32
 		{45C45411-7F0E-404D-919A-4EE9BB60BE86}.Release_Cairo_CFLite|Win32.Build.0 = Release_Cairo_CFLite|Win32
-		{45C45411-7F0E-404D-919A-4EE9BB60BE86}.Release_LTCG|Win32.ActiveCfg = Release_LTCG|Win32
-		{45C45411-7F0E-404D-919A-4EE9BB60BE86}.Release_LTCG|Win32.Build.0 = Release_LTCG|Win32
+		{45C45411-7F0E-404D-919A-4EE9BB60BE86}.Production|Win32.ActiveCfg = Production|Win32
+		{45C45411-7F0E-404D-919A-4EE9BB60BE86}.Production|Win32.Build.0 = Production|Win32
 		{45C45411-7F0E-404D-919A-4EE9BB60BE86}.Release|Win32.ActiveCfg = Release|Win32
 		{45C45411-7F0E-404D-919A-4EE9BB60BE86}.Release|Win32.Build.0 = Release|Win32
 		{B0101604-B483-4F8C-9C51-90B46A2B1CD3}.Debug_All|Win32.ActiveCfg = Debug_All|Win32
@@ -55,8 +55,8 @@ Global
 		{B0101604-B483-4F8C-9C51-90B46A2B1CD3}.Debug|Win32.Build.0 = Debug|Win32
 		{B0101604-B483-4F8C-9C51-90B46A2B1CD3}.Release_Cairo_CFLite|Win32.ActiveCfg = Release_Cairo_CFLite|Win32
 		{B0101604-B483-4F8C-9C51-90B46A2B1CD3}.Release_Cairo_CFLite|Win32.Build.0 = Release_Cairo_CFLite|Win32
-		{B0101604-B483-4F8C-9C51-90B46A2B1CD3}.Release_LTCG|Win32.ActiveCfg = Release_LTCG|Win32
-		{B0101604-B483-4F8C-9C51-90B46A2B1CD3}.Release_LTCG|Win32.Build.0 = Release_LTCG|Win32
+		{B0101604-B483-4F8C-9C51-90B46A2B1CD3}.Production|Win32.ActiveCfg = Production|Win32
+		{B0101604-B483-4F8C-9C51-90B46A2B1CD3}.Production|Win32.Build.0 = Production|Win32
 		{B0101604-B483-4F8C-9C51-90B46A2B1CD3}.Release|Win32.ActiveCfg = Release|Win32
 		{B0101604-B483-4F8C-9C51-90B46A2B1CD3}.Release|Win32.Build.0 = Release|Win32
 	EndGlobalSection
diff --git a/Tools/TestWebKitAPI/win/TestWebKitAPI.vcproj b/Tools/TestWebKitAPI/win/TestWebKitAPI.vcproj
index a894029..468ed71 100644
--- a/Tools/TestWebKitAPI/win/TestWebKitAPI.vcproj
+++ b/Tools/TestWebKitAPI/win/TestWebKitAPI.vcproj
@@ -320,7 +320,7 @@
 			/>
 		</Configuration>
 		<Configuration
-			Name="Release_LTCG|Win32"
+			Name="Production|Win32"
 			ConfigurationType="1"
 			InheritedPropertySheets="..\Configurations\TestWebKitAPIRelease.vsprops"
 			CharacterSet="1"
@@ -412,6 +412,18 @@
 				Name="WebKit2"
 				>
 				<File
+					RelativePath="..\Tests\WebKit2\AboutBlankLoad.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\Tests\WebKit2\CanHandleRequest.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\Tests\WebKit2\CookieManager.cpp"
+					>
+				</File>
+				<File
 					RelativePath="..\Tests\WebKit2\DocumentStartUserScriptAlertCrash.cpp"
 					>
 				</File>
@@ -448,11 +460,11 @@
 					>
 				</File>
 				<File
-					RelativePath="..\Tests\WebKit2\icon.png"
+					RelativePath="..\Tests\WebKit2\HitTestResultNodeHandle.cpp"
 					>
 				</File>
 				<File
-					RelativePath="..\Tests\WebKit2\HitTestResultNodeHandle.cpp"
+					RelativePath="..\Tests\WebKit2\icon.png"
 					>
 				</File>
 				<File
@@ -480,6 +492,10 @@
 					>
 				</File>
 				<File
+					RelativePath="..\Tests\WebKit2\SendingMessagesToTheWebProcessBeforeItIsValid.cpp"
+					>
+				</File>
+				<File
 					RelativePath="..\Tests\WebKit2\simple-accelerated-compositing.html"
 					>
 				</File>
@@ -519,6 +535,26 @@
 						>
 					</File>
 					<File
+						RelativePath="..\Tests\WebKit2\win\DoNotCopyANullCFURLResponse.cpp"
+						>
+						<FileConfiguration
+							Name="Debug_Cairo_CFLite|Win32"
+							ExcludedFromBuild="true"
+							>
+							<Tool
+								Name="VCCLCompilerTool"
+							/>
+						</FileConfiguration>
+						<FileConfiguration
+							Name="Release_Cairo_CFLite|Win32"
+							ExcludedFromBuild="true"
+							>
+							<Tool
+								Name="VCCLCompilerTool"
+							/>
+						</FileConfiguration>
+					</File>
+					<File
 						RelativePath="..\Tests\WebKit2\win\HideFindIndicator.cpp"
 						>
 					</File>
diff --git a/Tools/TestWebKitAPI/win/TestWebKitAPIGenerated.vcproj b/Tools/TestWebKitAPI/win/TestWebKitAPIGenerated.vcproj
index d52560a..78bbdbf 100644
--- a/Tools/TestWebKitAPI/win/TestWebKitAPIGenerated.vcproj
+++ b/Tools/TestWebKitAPI/win/TestWebKitAPIGenerated.vcproj
@@ -42,7 +42,7 @@
 			/>
 		</Configuration>
 		<Configuration
-			Name="Release_LTCG|Win32"
+			Name="Production|Win32"
 			ConfigurationType="0"
 			InheritedPropertySheets=".\TestWebKitAPIGeneratedCommon.vsprops"
 			>
diff --git a/Tools/TestWebKitAPI/win/TestWebKitAPIInjectedBundle.vcproj b/Tools/TestWebKitAPI/win/TestWebKitAPIInjectedBundle.vcproj
index 3b18238..faf8059 100644
--- a/Tools/TestWebKitAPI/win/TestWebKitAPIInjectedBundle.vcproj
+++ b/Tools/TestWebKitAPI/win/TestWebKitAPIInjectedBundle.vcproj
@@ -198,7 +198,7 @@
 			/>
 		</Configuration>
 		<Configuration
-			Name="Release_LTCG|Win32"
+			Name="Production|Win32"
 			ConfigurationType="2"
 			InheritedPropertySheets="..\Configurations\TestWebKitAPIRelease.vsprops;..\Configurations\TestWebKitAPIInjectedBundleCommon.vsprops"
 			CharacterSet="1"
@@ -400,6 +400,10 @@
 				Name="WebKit2"
 				>
 				<File
+					RelativePath="..\Tests\WebKit2\CanHandleRequest_Bundle.cpp"
+					>
+				</File>
+				<File
 					RelativePath="..\Tests\WebKit2\DocumentStartUserScriptAlertCrash_Bundle.cpp"
 					>
 				</File>
diff --git a/Tools/WebKitAPITest/HostWindow.cpp b/Tools/WebKitAPITest/HostWindow.cpp
index b364831..e35e96c 100644
--- a/Tools/WebKitAPITest/HostWindow.cpp
+++ b/Tools/WebKitAPITest/HostWindow.cpp
@@ -22,6 +22,7 @@
  * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
+#include "config.h"
 #include "HostWindow.h"
 
 namespace WebKitAPITest {
diff --git a/Tools/WebKitAPITest/TestsController.cpp b/Tools/WebKitAPITest/TestsController.cpp
index 08b193a..c5cf23a 100644
--- a/Tools/WebKitAPITest/TestsController.cpp
+++ b/Tools/WebKitAPITest/TestsController.cpp
@@ -22,6 +22,7 @@
  * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
+#include "config.h"
 #include "TestsController.h"
 
 #include "Test.h"
diff --git a/Tools/WebKitAPITest/WebKitAPITest.vcproj b/Tools/WebKitAPITest/WebKitAPITest.vcproj
index e3d8171..a746e72 100644
--- a/Tools/WebKitAPITest/WebKitAPITest.vcproj
+++ b/Tools/WebKitAPITest/WebKitAPITest.vcproj
@@ -17,7 +17,7 @@
 		<Configuration
 			Name="Debug_All|Win32"
 			ConfigurationType="1"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;$(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\debug_all.vsprops;.\WebKitAPITestCommon.vsprops"
+			InheritedPropertySheets=".\WebKitAPITestDebugAll.vsprops"
 			CharacterSet="1"
 			>
 			<Tool
@@ -78,7 +78,7 @@
 		<Configuration
 			Name="Debug|Win32"
 			ConfigurationType="1"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;.\WebKitAPITestCommon.vsprops"
+			InheritedPropertySheets=".\WebKitAPITestDebug.vsprops"
 			CharacterSet="1"
 			>
 			<Tool
@@ -139,7 +139,7 @@
 		<Configuration
 			Name="Debug_Cairo_CFLite|Win32"
 			ConfigurationType="1"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;$(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\debug_wincairo.vsprops;.\WebKitAPITestCommon.vsprops"
+			InheritedPropertySheets=".\WebKitAPITestDebugCairoCFLite.vsprops"
 			CharacterSet="1"
 			>
 			<Tool
@@ -200,7 +200,7 @@
 		<Configuration
 			Name="Release|Win32"
 			ConfigurationType="1"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;.\WebKitAPITestCommon.vsprops"
+			InheritedPropertySheets=".\WebKitAPITestRelease.vsprops"
 			CharacterSet="1"
 			>
 			<Tool
@@ -259,9 +259,9 @@
 			/>
 		</Configuration>
 		<Configuration
-			Name="Release_LTCG|Win32"
+			Name="Production|Win32"
 			ConfigurationType="1"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;.\WebKitAPITestCommon.vsprops"
+			InheritedPropertySheets=".\WebKitAPITestProduction.vsprops"
 			CharacterSet="1"
 			>
 			<Tool
@@ -322,7 +322,7 @@
 		<Configuration
 			Name="Release_Cairo_CFLite|Win32"
 			ConfigurationType="1"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;$(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\WinCairo.vsprops;.\WebKitAPITestCommon.vsprops"
+			InheritedPropertySheets=".\WebKitAPITestReleaseCairoCFLite.vsprops"
 			CharacterSet="1"
 			>
 			<Tool
diff --git a/Tools/WebKitAPITest/WebKitAPITestDebug.vsprops b/Tools/WebKitAPITest/WebKitAPITestDebug.vsprops
new file mode 100644
index 0000000..a3c44c4
--- /dev/null
+++ b/Tools/WebKitAPITest/WebKitAPITestDebug.vsprops
@@ -0,0 +1,11 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="WebKitAPITestDebug"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;
+      .\WebKitAPITestCommon.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Tools/WebKitAPITest/WebKitAPITestDebugAll.vsprops b/Tools/WebKitAPITest/WebKitAPITestDebugAll.vsprops
new file mode 100644
index 0000000..5a0a820
--- /dev/null
+++ b/Tools/WebKitAPITest/WebKitAPITestDebugAll.vsprops
@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="WebKitAPITestDebugAll"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\debug_all.vsprops;
+      .\WebKitAPITestCommon.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Tools/WebKitAPITest/WebKitAPITestDebugCairoCFLite.vsprops b/Tools/WebKitAPITest/WebKitAPITestDebugCairoCFLite.vsprops
new file mode 100644
index 0000000..ad9f812
--- /dev/null
+++ b/Tools/WebKitAPITest/WebKitAPITestDebugCairoCFLite.vsprops
@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="WebKitAPITestDebugCairoCFLite"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\debug_wincairo.vsprops;
+      .\WebKitAPITestCommon.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Tools/WebKitAPITest/WebKitAPITestProduction.vsprops b/Tools/WebKitAPITest/WebKitAPITestProduction.vsprops
new file mode 100644
index 0000000..45cb5c9
--- /dev/null
+++ b/Tools/WebKitAPITest/WebKitAPITestProduction.vsprops
@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="WebKitAPITestProduction"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\production.vsprops;
+      .\WebKitAPITestCommon.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Tools/WebKitAPITest/WebKitAPITestRelease.vsprops b/Tools/WebKitAPITest/WebKitAPITestRelease.vsprops
new file mode 100644
index 0000000..e89d3e7
--- /dev/null
+++ b/Tools/WebKitAPITest/WebKitAPITestRelease.vsprops
@@ -0,0 +1,11 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="WebKitAPITestRelease"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
+      .\WebKitAPITestCommon.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Tools/WebKitAPITest/WebKitAPITestReleaseCairoCFLite.vsprops b/Tools/WebKitAPITest/WebKitAPITestReleaseCairoCFLite.vsprops
new file mode 100644
index 0000000..8c1a3c3
--- /dev/null
+++ b/Tools/WebKitAPITest/WebKitAPITestReleaseCairoCFLite.vsprops
@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="WebKitAPITestReleaseCairoCFLite"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\WinCairo.vsprops;
+      .\WebKitAPITestCommon.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Tools/WebKitAPITest/config.h b/Tools/WebKitAPITest/config.h
new file mode 100644
index 0000000..bee51ac
--- /dev/null
+++ b/Tools/WebKitAPITest/config.h
@@ -0,0 +1,57 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+ 
+#ifndef WebKitAPITests_config_h
+#define WebKitAPITests_config_h
+
+#include <wtf/Platform.h>
+
+/* See note in wtf/Platform.h for more info on EXPORT_MACROS. */
+#if USE(EXPORT_MACROS)
+
+#include <wtf/ExportMacros.h>
+
+#define WTF_EXPORT_PRIVATE WTF_IMPORT
+#define JS_EXPORT_PRIVATE WTF_IMPORT
+#define WEBKIT_EXPORTDATA WTF_IMPORT
+
+#define JS_EXPORTDATA JS_EXPORT_PRIVATE
+#define JS_EXPORTCLASS JS_EXPORT_PRIVATE
+
+#else /* !USE(EXPORT_MACROS) */
+
+#if OS(WINDOWS) && !COMPILER(GCC) && !defined(BUILDING_WX__)
+#define JS_EXPORTDATA __declspec(dllimport)
+#define WEBKIT_EXPORTDATA __declspec(dllimport)
+#else
+#define JS_EXPORTDATA
+#define WEBKIT_EXPORTDATA
+#endif
+
+#define WTF_EXPORT_PRIVATE JS_EXPORTDATA
+#define JS_EXPORT_PRIVATE JS_EXPORTDATA
+
+#endif /* USE(EXPORT_MACROS) */
+
+#endif
diff --git a/Tools/WebKitAPITest/main.cpp b/Tools/WebKitAPITest/main.cpp
index 8b54b01..dddba20 100644
--- a/Tools/WebKitAPITest/main.cpp
+++ b/Tools/WebKitAPITest/main.cpp
@@ -22,6 +22,8 @@
  * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
+#include "config.h"
+
 #include "TestsController.h"
 
 using namespace WebKitAPITest;
diff --git a/Tools/WebKitAPITest/tests/WebViewDestruction.cpp b/Tools/WebKitAPITest/tests/WebViewDestruction.cpp
index 6c09e6f..b7ae0b6 100644
--- a/Tools/WebKitAPITest/tests/WebViewDestruction.cpp
+++ b/Tools/WebKitAPITest/tests/WebViewDestruction.cpp
@@ -22,6 +22,8 @@
  * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
+#include "config.h"
+
 #include "HostWindow.h"
 #include "Test.h"
 #include <WebCore/COMPtr.h>
diff --git a/Tools/WebKitLauncherWin/WebKitLauncherWin.vcproj b/Tools/WebKitLauncherWin/WebKitLauncherWin.vcproj
index f0038e6..336839b 100644
--- a/Tools/WebKitLauncherWin/WebKitLauncherWin.vcproj
+++ b/Tools/WebKitLauncherWin/WebKitLauncherWin.vcproj
@@ -18,7 +18,7 @@
 		<Configuration
 			Name="Release|Win32"
 			ConfigurationType="1"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;.\WebKitLauncherWinCommon.vsprops"
+			InheritedPropertySheets=".\WebKitLauncherWinRelease.vsprops"
 			CharacterSet="1"
 			>
 			<Tool
@@ -77,9 +77,9 @@
 			/>
 		</Configuration>
 		<Configuration
-			Name="Release_LTCG|Win32"
+			Name="Production|Win32"
 			ConfigurationType="1"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;.\WebKitLauncherWinCommon.vsprops"
+			InheritedPropertySheets=".\WebKitLauncherWinProduction.vsprops"
 			CharacterSet="1"
 			WholeProgramOptimization="1"
 			>
@@ -141,7 +141,7 @@
 		<Configuration
 			Name="Debug|Win32"
 			ConfigurationType="1"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;.\WebKitLauncherWinCommon.vsprops"
+			InheritedPropertySheets=".\WebKitLauncherWinDebug.vsprops"
 			CharacterSet="1"
 			>
 			<Tool
@@ -202,7 +202,7 @@
 		<Configuration
 			Name="Debug_All|Win32"
 			ConfigurationType="1"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;$(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\debug_all.vsprops;.\WebKitLauncherWinCommon.vsprops"
+			InheritedPropertySheets=".\WebKitLauncherWinDebugAll.vsprops"
 			CharacterSet="1"
 			>
 			<Tool
@@ -263,7 +263,7 @@
 		<Configuration
 			Name="Release_Cairo_CFLite|Win32"
 			ConfigurationType="1"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;$(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\WinCairo.vsprops;.\WebKitLauncherWinCommon.vsprops"
+			InheritedPropertySheets=".\WebKitLauncherWinReleaseCairoCFLite.vsprops"
 			CharacterSet="1"
 			>
 			<Tool
@@ -324,7 +324,7 @@
 		<Configuration
 			Name="Debug_Cairo_CFLite|Win32"
 			ConfigurationType="1"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;$(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\debug_wincairo.vsprops;.\WebKitLauncherWinCommon.vsprops"
+			InheritedPropertySheets=".\WebKitLauncherWinDebugCairoCFLite.vsprops"
 			CharacterSet="1"
 			>
 			<Tool
diff --git a/Tools/WebKitLauncherWin/WebKitLauncherWinDebug.vsprops b/Tools/WebKitLauncherWin/WebKitLauncherWinDebug.vsprops
new file mode 100644
index 0000000..39a0ded
--- /dev/null
+++ b/Tools/WebKitLauncherWin/WebKitLauncherWinDebug.vsprops
@@ -0,0 +1,11 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="WebKitLauncherWinDebug"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;
+      .\WebKitLauncherWinCommon.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Tools/WebKitLauncherWin/WebKitLauncherWinDebugAll.vsprops b/Tools/WebKitLauncherWin/WebKitLauncherWinDebugAll.vsprops
new file mode 100644
index 0000000..fff95b7
--- /dev/null
+++ b/Tools/WebKitLauncherWin/WebKitLauncherWinDebugAll.vsprops
@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="WebKitLauncherWinDebugAll"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\debug_all.vsprops;
+      .\WebKitLauncherWinCommon.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Tools/WebKitLauncherWin/WebKitLauncherWinDebugCairoCFLite.vsprops b/Tools/WebKitLauncherWin/WebKitLauncherWinDebugCairoCFLite.vsprops
new file mode 100644
index 0000000..60c4b5b
--- /dev/null
+++ b/Tools/WebKitLauncherWin/WebKitLauncherWinDebugCairoCFLite.vsprops
@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="WebKitLauncherWinDebugCairoCFLite"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\debug_wincairo.vsprops;
+      .\WebKitLauncherWinCommon.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Tools/WebKitLauncherWin/WebKitLauncherWinProduction.vsprops b/Tools/WebKitLauncherWin/WebKitLauncherWinProduction.vsprops
new file mode 100644
index 0000000..853abfb
--- /dev/null
+++ b/Tools/WebKitLauncherWin/WebKitLauncherWinProduction.vsprops
@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="WebKitLauncherWinProduction"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\production.vsprops;
+      .\WebKitLauncherWinCommon.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Tools/WebKitLauncherWin/WebKitLauncherWinRelease.vsprops b/Tools/WebKitLauncherWin/WebKitLauncherWinRelease.vsprops
new file mode 100644
index 0000000..1b906ef
--- /dev/null
+++ b/Tools/WebKitLauncherWin/WebKitLauncherWinRelease.vsprops
@@ -0,0 +1,11 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="WebKitLauncherWinRelease"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
+      .\WebKitLauncherWinCommon.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Tools/WebKitLauncherWin/WebKitLauncherWinReleaseCairoCFLite.vsprops b/Tools/WebKitLauncherWin/WebKitLauncherWinReleaseCairoCFLite.vsprops
new file mode 100644
index 0000000..d635f3e
--- /dev/null
+++ b/Tools/WebKitLauncherWin/WebKitLauncherWinReleaseCairoCFLite.vsprops
@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="WebKitLauncherWinReleaseCairoCFLite"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\WinCairo.vsprops;
+      .\WebKitLauncherWinCommon.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Tools/WebKitTestRunner/Configurations/Base.xcconfig b/Tools/WebKitTestRunner/Configurations/Base.xcconfig
index ac2ff94..3780150 100644
--- a/Tools/WebKitTestRunner/Configurations/Base.xcconfig
+++ b/Tools/WebKitTestRunner/Configurations/Base.xcconfig
@@ -52,12 +52,23 @@ TARGET_GCC_VERSION_1050_ = $(TARGET_GCC_VERSION_1050_$(XCODE_VERSION_ACTUAL));
 TARGET_GCC_VERSION_1050_0310 = GCC_42;
 TARGET_GCC_VERSION_1050_0320 = GCC_42;
 TARGET_GCC_VERSION_1060 = GCC_42;
-TARGET_GCC_VERSION_1070 = LLVM_GCC_42;
+TARGET_GCC_VERSION_1070 = $(TARGET_GCC_VERSION_1070_$(CONFIGURATION));
+TARGET_GCC_VERSION_1070_Debug = LLVM_COMPILER;
+TARGET_GCC_VERSION_1070_Release = LLVM_GCC_42;
+TARGET_GCC_VERSION_1070_Production = LLVM_GCC_42;
 
 GCC_VERSION = $(GCC_VERSION_$(TARGET_GCC_VERSION));
 GCC_VERSION_GCC_40 = 4.0;
 GCC_VERSION_GCC_42 = 4.2;
 GCC_VERSION_LLVM_GCC_42 = com.apple.compilers.llvmgcc42;
+GCC_VERSION_LLVM_COMPILER = com.apple.compilers.llvm.clang.1_0;
+
+// FIXME: Disable C++ exceptions in the LLVM Compiler once it supports enabling Obj-C exceptions without C++ exceptions.
+GCC_ENABLE_CPP_EXCEPTIONS = $(GCC_ENABLE_CPP_EXCEPTIONS_$(TARGET_GCC_VERSION));
+GCC_ENABLE_CPP_EXCEPTIONS_GCC_40 = NO;
+GCC_ENABLE_CPP_EXCEPTIONS_GCC_42 = NO;
+GCC_ENABLE_CPP_EXCEPTIONS_LLVM_GCC = NO;
+GCC_ENABLE_CPP_EXCEPTIONS_LLVM_COMPILER = YES;
 
 // If the target Mac OS X version does not match the current Mac OS X version then we'll want to build using the target version's SDK.
 SDKROOT = $(SDKROOT_$(MAC_OS_X_VERSION_MAJOR)_$(TARGET_MAC_OS_X_VERSION_MAJOR));
diff --git a/Tools/WebKitTestRunner/Configurations/InjectedBundle.xcconfig b/Tools/WebKitTestRunner/Configurations/InjectedBundle.xcconfig
index dcf4be0..e3b72fe 100644
--- a/Tools/WebKitTestRunner/Configurations/InjectedBundle.xcconfig
+++ b/Tools/WebKitTestRunner/Configurations/InjectedBundle.xcconfig
@@ -21,4 +21,4 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 
-PRODUCT_NAME = WebKitTestRunnerInjectedBundle
+PRODUCT_NAME = WebKitTestRunnerInjectedBundle;
diff --git a/Tools/WebKitTestRunner/Configurations/WebKitTestRunnerCoreGraphics.vsprops b/Tools/WebKitTestRunner/Configurations/WebKitTestRunnerCoreGraphics.vsprops
new file mode 100644
index 0000000..70da2ba
--- /dev/null
+++ b/Tools/WebKitTestRunner/Configurations/WebKitTestRunnerCoreGraphics.vsprops
@@ -0,0 +1,11 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="WebKitTestRunnerCoreGraphics"
+	>
+	<Tool
+		Name="VCLinkerTool"
+		AdditionalDependencies="CoreGraphics$(LibraryConfigSuffix).lib"
+	/>
+</VisualStudioPropertySheet>
diff --git a/Tools/WebKitTestRunner/InjectedBundle/Bindings/JSWrapper.cpp b/Tools/WebKitTestRunner/InjectedBundle/Bindings/JSWrapper.cpp
index a62cb2e..e3cf58c 100644
--- a/Tools/WebKitTestRunner/InjectedBundle/Bindings/JSWrapper.cpp
+++ b/Tools/WebKitTestRunner/InjectedBundle/Bindings/JSWrapper.cpp
@@ -23,6 +23,7 @@
  * THE POSSIBILITY OF SUCH DAMAGE.
  */
 
+#include "config.h"
 #include "JSWrapper.h"
 
 #include <JavaScriptCore/JSContextRefPrivate.h>
diff --git a/Tools/WebKitTestRunner/InjectedBundle/EventSendingController.cpp b/Tools/WebKitTestRunner/InjectedBundle/EventSendingController.cpp
index 73de45b..cc1720e 100644
--- a/Tools/WebKitTestRunner/InjectedBundle/EventSendingController.cpp
+++ b/Tools/WebKitTestRunner/InjectedBundle/EventSendingController.cpp
@@ -23,6 +23,7 @@
  * THE POSSIBILITY OF SUCH DAMAGE.
  */
 
+#include "config.h"
 #include "EventSendingController.h"
 
 #include "InjectedBundle.h"
diff --git a/Tools/WebKitTestRunner/InjectedBundle/GCController.cpp b/Tools/WebKitTestRunner/InjectedBundle/GCController.cpp
index 0eba2df..10c21db 100644
--- a/Tools/WebKitTestRunner/InjectedBundle/GCController.cpp
+++ b/Tools/WebKitTestRunner/InjectedBundle/GCController.cpp
@@ -23,6 +23,7 @@
  * THE POSSIBILITY OF SUCH DAMAGE.
  */
 
+#include "config.h"
 #include "GCController.h"
 
 #include "InjectedBundle.h"
diff --git a/Tools/WebKitTestRunner/InjectedBundle/InjectedBundle.cpp b/Tools/WebKitTestRunner/InjectedBundle/InjectedBundle.cpp
index 00933bd..ec6b723 100644
--- a/Tools/WebKitTestRunner/InjectedBundle/InjectedBundle.cpp
+++ b/Tools/WebKitTestRunner/InjectedBundle/InjectedBundle.cpp
@@ -23,6 +23,7 @@
  * THE POSSIBILITY OF SUCH DAMAGE.
  */
 
+#include "config.h"
 #include "InjectedBundle.h"
 
 #include "ActivateFonts.h"
@@ -49,6 +50,7 @@ InjectedBundle::InjectedBundle()
     : m_bundle(0)
     , m_topLoadingFrame(0)
     , m_state(Idle)
+    , m_dumpPixels(false)
 {
 }
 
@@ -128,7 +130,9 @@ void InjectedBundle::resetLocalSettings()
 void InjectedBundle::didReceiveMessage(WKStringRef messageName, WKTypeRef messageBody)
 {
     if (WKStringIsEqualToUTF8CString(messageName, "BeginTest")) {
-        ASSERT(!messageBody);
+        ASSERT(messageBody);
+        ASSERT(WKGetTypeID(messageBody) == WKBooleanGetTypeID());
+        m_dumpPixels = WKBooleanGetValue(static_cast<WKBooleanRef>(messageBody));
 
         WKRetainPtr<WKStringRef> ackMessageName(AdoptWK, WKStringCreateWithUTF8CString("Ack"));
         WKRetainPtr<WKStringRef> ackMessageBody(AdoptWK, WKStringCreateWithUTF8CString("BeginTest"));
@@ -138,6 +142,7 @@ void InjectedBundle::didReceiveMessage(WKStringRef messageName, WKTypeRef messag
         return;
     } else if (WKStringIsEqualToUTF8CString(messageName, "Reset")) {
         m_state = Idle;
+        m_dumpPixels = false;
 
         resetLocalSettings();
 
@@ -154,6 +159,7 @@ void InjectedBundle::beginTesting()
     m_state = Testing;
 
     m_outputStream.str("");
+    m_pixelResult.clear();
 
     m_layoutTestController = LayoutTestController::create();
     m_gcController = GCController::create();
@@ -161,6 +167,7 @@ void InjectedBundle::beginTesting()
 
     WKBundleSetShouldTrackVisitedLinks(m_bundle, false);
     WKBundleRemoveAllVisitedLinks(m_bundle);
+    WKBundleOverrideAllowUniversalAccessFromFileURLsForTestRunner(m_bundle, m_pageGroup, true);
 
     WKBundleRemoveAllUserContent(m_bundle, m_pageGroup);
 
@@ -181,9 +188,8 @@ void InjectedBundle::done()
     WKRetainPtr<WKStringRef> textOutput(AdoptWK, WKStringCreateWithUTF8CString(m_outputStream.str().c_str()));
     WKDictionaryAddItem(doneMessageBody.get(), textOutputKey.get(), textOutput.get());
     
-    WKRetainPtr<WKStringRef> textOnlyKey(AdoptWK, WKStringCreateWithUTF8CString("TextOnly"));
-    WKRetainPtr<WKBooleanRef> textOnly(AdoptWK, WKBooleanCreate(!m_layoutTestController->shouldDumpPixels()));
-    WKDictionaryAddItem(doneMessageBody.get(), textOnlyKey.get(), textOnly.get());
+    WKRetainPtr<WKStringRef> pixelResultKey = adoptWK(WKStringCreateWithUTF8CString("PixelResult"));
+    WKDictionaryAddItem(doneMessageBody.get(), pixelResultKey.get(), m_pixelResult.get());
 
     WKBundlePostMessage(m_bundle, doneMessageName.get(), doneMessageBody.get());
 
diff --git a/Tools/WebKitTestRunner/InjectedBundle/InjectedBundle.h b/Tools/WebKitTestRunner/InjectedBundle/InjectedBundle.h
index 41b1b31..3090614 100644
--- a/Tools/WebKitTestRunner/InjectedBundle/InjectedBundle.h
+++ b/Tools/WebKitTestRunner/InjectedBundle/InjectedBundle.h
@@ -30,6 +30,7 @@
 #include "GCController.h"
 #include "LayoutTestController.h"
 #include <WebKit2/WKBase.h>
+#include <WebKit2/WKRetainPtr.h>
 #include <wtf/OwnPtr.h>
 #include <wtf/RefPtr.h>
 #include <wtf/Vector.h>
@@ -62,12 +63,15 @@ public:
 
     void done();
     std::ostringstream& os() { return m_outputStream; }
+    void setPixelResult(WKImageRef image) { m_pixelResult = image; }
 
     bool isTestRunning() { return m_state == Testing; }
 
     WKBundleFrameRef topLoadingFrame() { return m_topLoadingFrame; }
     void setTopLoadingFrame(WKBundleFrameRef frame) { m_topLoadingFrame = frame; }
 
+    bool shouldDumpPixels() const { return m_dumpPixels; }
+
 private:
     InjectedBundle();
     ~InjectedBundle();
@@ -105,6 +109,10 @@ private:
         Stopping
     };
     State m_state;
+
+    bool m_dumpPixels;
+
+    WKRetainPtr<WKImageRef> m_pixelResult;
 };
 
 } // namespace WTR
diff --git a/Tools/WebKitTestRunner/InjectedBundle/InjectedBundleMain.cpp b/Tools/WebKitTestRunner/InjectedBundle/InjectedBundleMain.cpp
index 4e7f58b..7244077 100644
--- a/Tools/WebKitTestRunner/InjectedBundle/InjectedBundleMain.cpp
+++ b/Tools/WebKitTestRunner/InjectedBundle/InjectedBundleMain.cpp
@@ -23,6 +23,8 @@
  * THE POSSIBILITY OF SUCH DAMAGE.
  */
 
+#include "config.h"
+
 #include "InjectedBundle.h"
 #include <WebKit2/WKBundleInitialize.h>
 
diff --git a/Tools/WebKitTestRunner/InjectedBundle/InjectedBundlePage.cpp b/Tools/WebKitTestRunner/InjectedBundle/InjectedBundlePage.cpp
index 3ce081e..3b73174 100644
--- a/Tools/WebKitTestRunner/InjectedBundle/InjectedBundlePage.cpp
+++ b/Tools/WebKitTestRunner/InjectedBundle/InjectedBundlePage.cpp
@@ -23,13 +23,13 @@
  * THE POSSIBILITY OF SUCH DAMAGE.
  */
 
+#include "config.h"
 #include "InjectedBundlePage.h"
 
 #include "InjectedBundle.h"
 #include "StringFunctions.h"
 #include <cmath>
 #include <JavaScriptCore/JSRetainPtr.h>
-#include <WebCore/KURL.h>
 #include <WebKit2/WKArray.h>
 #include <WebKit2/WKBundle.h>
 #include <WebKit2/WKBundleBackForwardList.h>
@@ -43,11 +43,6 @@ using namespace std;
 
 namespace WTR {
 
-template<typename T> static inline WKRetainPtr<T> adoptWK(T item)
-{
-    return WKRetainPtr<T>(AdoptWK, item);
-}
-
 static bool hasPrefix(const string& searchString, const string& prefix)
 {
     return searchString.length() >= prefix.length() && searchString.substr(0, prefix.length()) == prefix;
@@ -218,6 +213,8 @@ InjectedBundlePage::InjectedBundlePage(WKBundlePageRef page)
         0, /*mouseDidMoveOverElement*/
         0, /*pageDidScroll*/
         0, /*paintCustomOverhangArea*/
+        0, /*shouldGenerateFileForUpload*/
+        0, /*generateFileForUpload*/
     };
     WKBundlePageSetUIClient(m_page, &uiClient);
 
@@ -526,6 +523,9 @@ void InjectedBundlePage::dump()
     if (InjectedBundle::shared().layoutTestController()->shouldDumpBackForwardListsForAllWindows())
         InjectedBundle::shared().dumpBackForwardListsForAllPages();
 
+    if (InjectedBundle::shared().shouldDumpPixels() && InjectedBundle::shared().layoutTestController()->shouldDumpPixels())
+        InjectedBundle::shared().setPixelResult(adoptWK(WKBundlePageCreateSnapshotInViewCoordinates(m_page, WKBundleFrameGetVisibleContentBounds(WKBundlePageGetMainFrame(m_page)), kWKImageOptionsShareable)).get());
+
     InjectedBundle::shared().done();
 }
 
@@ -634,15 +634,15 @@ WKURLRequestRef InjectedBundlePage::willSendRequestForFrame(WKBundlePageRef, WKB
     if (InjectedBundle::shared().isTestRunning() && InjectedBundle::shared().layoutTestController()->willSendRequestReturnsNull())
         return 0;
 
-    string urlString = toSTD(adoptWK(WKURLCopyString(adoptWK(WKURLRequestCopyURL(request)).get())));
-    WebCore::KURL url(WebCore::ParsedURLString, urlString.c_str());
-
-    if (!url.host().isEmpty()
-        && (equalIgnoringCase(url.protocol(), "http") || (equalIgnoringCase(url.protocol(), "https")))
-        && (url.host() != "127.0.0.1")
-        && (url.host() != "255.255.255.255") // used in some tests that expect to get back an error
-        && (!equalIgnoringCase(url.host(), "localhost"))) {
-        InjectedBundle::shared().os() << "Blocked access to external URL " << urlString << "\n";
+    WKRetainPtr<WKURLRef> url = adoptWK(WKURLRequestCopyURL(request));
+    WKRetainPtr<WKStringRef> host = adoptWK(WKURLCopyHostName(url.get()));
+    WKRetainPtr<WKStringRef> scheme = adoptWK(WKURLCopyScheme(url.get()));
+    if (host && !WKStringIsEmpty(host.get())
+        && (WKStringIsEqualToUTF8CStringIgnoringCase(scheme.get(), "http") || WKStringIsEqualToUTF8CStringIgnoringCase(scheme.get(), "https"))
+        && !WKStringIsEqualToUTF8CString(host.get(), "127.0.0.1")
+        && !WKStringIsEqualToUTF8CString(host.get(), "255.255.255.255") // Used in some tests that expect to get back an error.
+        && !WKStringIsEqualToUTF8CStringIgnoringCase(host.get(), "localhost")) {
+        InjectedBundle::shared().os() << "Blocked access to external URL " << url << "\n";
         return 0;
     }
 
diff --git a/Tools/WebKitTestRunner/InjectedBundle/LayoutTestController.cpp b/Tools/WebKitTestRunner/InjectedBundle/LayoutTestController.cpp
index 96a0d47..7c49d03 100644
--- a/Tools/WebKitTestRunner/InjectedBundle/LayoutTestController.cpp
+++ b/Tools/WebKitTestRunner/InjectedBundle/LayoutTestController.cpp
@@ -23,6 +23,7 @@
  * THE POSSIBILITY OF SUCH DAMAGE.
  */
 
+#include "config.h"
 #include "LayoutTestController.h"
 
 #include "InjectedBundle.h"
@@ -301,6 +302,11 @@ void LayoutTestController::setXSSAuditorEnabled(bool enabled)
     WKBundleOverrideXSSAuditorEnabledForTestRunner(InjectedBundle::shared().bundle(), InjectedBundle::shared().pageGroup(), true);
 }
 
+void LayoutTestController::setAllowUniversalAccessFromFileURLs(bool enabled)
+{
+    WKBundleOverrideAllowUniversalAccessFromFileURLsForTestRunner(InjectedBundle::shared().bundle(), InjectedBundle::shared().pageGroup(), enabled);
+}
+
 unsigned LayoutTestController::windowCount()
 {
     return InjectedBundle::shared().pageCount();
diff --git a/Tools/WebKitTestRunner/InjectedBundle/LayoutTestController.h b/Tools/WebKitTestRunner/InjectedBundle/LayoutTestController.h
index 6733380..b37f102 100644
--- a/Tools/WebKitTestRunner/InjectedBundle/LayoutTestController.h
+++ b/Tools/WebKitTestRunner/InjectedBundle/LayoutTestController.h
@@ -74,6 +74,7 @@ public:
     void setCanOpenWindows(bool);
     void setCloseRemainingWindowsWhenComplete(bool value) { m_shouldCloseExtraWindows = value; }
     void setXSSAuditorEnabled(bool);
+    void setAllowUniversalAccessFromFileURLs(bool);
 
     // Special DOM functions.
     JSValueRef computedStyleIncludingVisitedInfo(JSValueRef element);
diff --git a/Tools/WebKitTestRunner/InjectedBundle/qt/ActivateFontsQt.cpp b/Tools/WebKitTestRunner/InjectedBundle/qt/ActivateFontsQt.cpp
index 9c4bc68..cb6b633 100644
--- a/Tools/WebKitTestRunner/InjectedBundle/qt/ActivateFontsQt.cpp
+++ b/Tools/WebKitTestRunner/InjectedBundle/qt/ActivateFontsQt.cpp
@@ -27,6 +27,7 @@
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
+#include "config.h"
 #include "ActivateFonts.h"
 
 #include <QApplication>
@@ -56,8 +57,9 @@ void activateFonts()
     if (appFontSet && numFonts >= 0 && appFontSet->nfont == numFonts)
         return;
 
-    QByteArray fontDir = getenv("WEBKIT_TESTFONTS");
-    if (fontDir.isEmpty() || !QDir(fontDir).exists()) {
+    char* const fontDir = getenv("WEBKIT_TESTFONTS");
+    const QString fontDirString = QString::fromLocal8Bit(fontDir);
+    if (fontDirString.isEmpty() || !QDir(fontDirString).exists()) {
         fprintf(stderr,
                 "\n\n"
                 "----------------------------------------------------------------------\n"
@@ -76,7 +78,7 @@ void activateFonts()
     configFile += "/Tools/DumpRenderTree/qt/fonts.conf";
     if (!FcConfigParseAndLoad (config, (FcChar8*) configFile.data(), true))
         qFatal("Couldn't load font configuration file");
-    if (!FcConfigAppFontAddDir (config, (FcChar8*) fontDir.data()))
+    if (!FcConfigAppFontAddDir (config, (FcChar8*) fontDir))
         qFatal("Couldn't add font dir!");
     FcConfigSetCurrent(config);
 
@@ -84,17 +86,19 @@ void activateFonts()
     numFonts = appFontSet->nfont;
 #endif
 
-    QApplication::setGraphicsSystem("raster");
+    QApplication::setGraphicsSystem(QLatin1String("raster"));
     QApplication::setStyle(new QWindowsStyle);
 
-    QFont f("Sans Serif");
+    QFont f(QLatin1String("Sans Serif"));
     f.setPointSize(9);
     f.setWeight(QFont::Normal);
     f.setStyle(QFont::StyleNormal);
     QApplication::setFont(f);
 
+#if defined(Q_WS_X11)
     QX11Info::setAppDpiX(0, 96);
     QX11Info::setAppDpiY(0, 96);
+#endif
 }
 
 }
diff --git a/Tools/WebKitTestRunner/InjectedBundle/qt/InjectedBundleQt.cpp b/Tools/WebKitTestRunner/InjectedBundle/qt/InjectedBundleQt.cpp
index 52502ed..78ec37c 100644
--- a/Tools/WebKitTestRunner/InjectedBundle/qt/InjectedBundleQt.cpp
+++ b/Tools/WebKitTestRunner/InjectedBundle/qt/InjectedBundleQt.cpp
@@ -23,6 +23,7 @@
  * THE POSSIBILITY OF SUCH DAMAGE.
  */
 
+#include "config.h"
 #include "InjectedBundle.h"
 
 namespace WTR {
diff --git a/Tools/WebKitTestRunner/InjectedBundle/qt/LayoutTestControllerQt.cpp b/Tools/WebKitTestRunner/InjectedBundle/qt/LayoutTestControllerQt.cpp
index b515326..91f49ea 100644
--- a/Tools/WebKitTestRunner/InjectedBundle/qt/LayoutTestControllerQt.cpp
+++ b/Tools/WebKitTestRunner/InjectedBundle/qt/LayoutTestControllerQt.cpp
@@ -24,6 +24,7 @@
  * THE POSSIBILITY OF SUCH DAMAGE.
  */
 
+#include "config.h"
 #include "LayoutTestController.h"
 
 #include "InjectedBundle.h"
diff --git a/Tools/WebKitTestRunner/InjectedBundle/win/ActivateFonts.cpp b/Tools/WebKitTestRunner/InjectedBundle/win/ActivateFonts.cpp
index d9f08c9..410d60f 100644
--- a/Tools/WebKitTestRunner/InjectedBundle/win/ActivateFonts.cpp
+++ b/Tools/WebKitTestRunner/InjectedBundle/win/ActivateFonts.cpp
@@ -23,6 +23,7 @@
  * THE POSSIBILITY OF SUCH DAMAGE.
  */
 
+#include "config.h"
 #include "ActivateFonts.h"
 
 #include <string>
diff --git a/Tools/WebKitTestRunner/InjectedBundle/win/InjectedBundleWin.cpp b/Tools/WebKitTestRunner/InjectedBundle/win/InjectedBundleWin.cpp
index af8eaed..c70514a 100644
--- a/Tools/WebKitTestRunner/InjectedBundle/win/InjectedBundleWin.cpp
+++ b/Tools/WebKitTestRunner/InjectedBundle/win/InjectedBundleWin.cpp
@@ -23,6 +23,7 @@
  * THE POSSIBILITY OF SUCH DAMAGE.
  */
 
+#include "config.h"
 #include "InjectedBundle.h"
 
 namespace WTR {
diff --git a/Tools/WebKitTestRunner/InjectedBundle/win/LayoutTestControllerWin.cpp b/Tools/WebKitTestRunner/InjectedBundle/win/LayoutTestControllerWin.cpp
index 39cd727..7c500f2 100644
--- a/Tools/WebKitTestRunner/InjectedBundle/win/LayoutTestControllerWin.cpp
+++ b/Tools/WebKitTestRunner/InjectedBundle/win/LayoutTestControllerWin.cpp
@@ -23,6 +23,7 @@
  * THE POSSIBILITY OF SUCH DAMAGE.
  */
 
+#include "config.h"
 #include "LayoutTestController.h"
 
 #include "InjectedBundle.h"
diff --git a/Tools/WebKitTestRunner/StringFunctions.h b/Tools/WebKitTestRunner/StringFunctions.h
index 2d0ca72..33e391d 100644
--- a/Tools/WebKitTestRunner/StringFunctions.h
+++ b/Tools/WebKitTestRunner/StringFunctions.h
@@ -44,9 +44,14 @@ namespace WTR {
 
 // Conversion functions
 
+template<typename T> static inline WKRetainPtr<T> adoptWK(const T item)
+{
+    return WKRetainPtr<T>(AdoptWK, item);
+}
+
 inline WKRetainPtr<WKStringRef> toWK(JSStringRef string)
 {
-    return WKRetainPtr<WKStringRef>(AdoptWK, WKStringCreateWithJSString(string));
+    return adoptWK(WKStringCreateWithJSString(string));
 }
 
 inline WKRetainPtr<WKStringRef> toWK(JSRetainPtr<JSStringRef> string)
@@ -92,6 +97,19 @@ inline std::ostream& operator<<(std::ostream& out, const WKRetainPtr<WKStringRef
     return out << stringRef.get();
 }
 
+inline std::ostream& operator<<(std::ostream& out, WKURLRef urlRef)
+{
+    if (!urlRef)
+        return out;
+
+    return out << toSTD(adoptWK(WKURLCopyString(urlRef)));
+}
+
+inline std::ostream& operator<<(std::ostream& out, const WKRetainPtr<WKURLRef>& urlRef)
+{
+    return out << urlRef.get();
+}
+
 } // namespace WTR
 
 #endif // StringFunctions_h
diff --git a/Tools/WebKitTestRunner/TestController.cpp b/Tools/WebKitTestRunner/TestController.cpp
index d12fff6..42331da 100644
--- a/Tools/WebKitTestRunner/TestController.cpp
+++ b/Tools/WebKitTestRunner/TestController.cpp
@@ -23,6 +23,7 @@
  * THE POSSIBILITY OF SUCH DAMAGE.
  */
 
+#include "config.h"
 #include "TestController.h"
 
 #include "PlatformWebView.h"
@@ -168,6 +169,7 @@ WKPageRef TestController::createOtherPage(WKPageRef oldPage, WKDictionaryRef, WK
         0, // printFrame
         runModal,
         0, // didCompleteRubberBandForMainFrame
+        0, // saveDataToFileInDownloadsFolder
     };
     WKPageSetPageUIClient(newPage, &otherPageUIClient);
 
@@ -301,6 +303,7 @@ void TestController::initialize(int argc, const char* argv[])
         0, // printFrame
         0, // runModal
         0, // didCompleteRubberBandForMainFrame
+        0, // saveDataToFileInDownloadsFolder
     };
     WKPageSetPageUIClient(m_mainWebView->page(), &pageUIClient);
 
@@ -353,6 +356,8 @@ bool TestController::resetStateToConsistentValues()
     WKPreferencesSetJavaScriptCanOpenWindowsAutomatically(preferences, true);
     WKPreferencesSetJavaScriptCanAccessClipboard(preferences, true);
     WKPreferencesSetDOMPasteAllowed(preferences, true);
+    WKPreferencesSetUniversalAccessFromFileURLsAllowed(preferences, true);
+    WKPreferencesSetFileAccessFromFileURLsAllowed(preferences, true);
 
     static WKStringRef standardFontFamily = WKStringCreateWithUTF8CString("Times");
     static WKStringRef cursiveFontFamily = WKStringCreateWithUTF8CString("Apple Chancery");
diff --git a/Tools/WebKitTestRunner/TestInvocation.cpp b/Tools/WebKitTestRunner/TestInvocation.cpp
index 3227be9..7fb70f5 100644
--- a/Tools/WebKitTestRunner/TestInvocation.cpp
+++ b/Tools/WebKitTestRunner/TestInvocation.cpp
@@ -23,6 +23,7 @@
  * THE POSSIBILITY OF SUCH DAMAGE.
  */
 
+#include "config.h"
 #include "TestInvocation.h"
 
 #include "PlatformWebView.h"
@@ -132,8 +133,9 @@ void TestInvocation::invoke()
 {
     sizeWebViewForCurrentTest(m_pathOrURL.c_str());
 
-    WKRetainPtr<WKStringRef> messageName(AdoptWK, WKStringCreateWithUTF8CString("BeginTest"));
-    WKContextPostMessageToInjectedBundle(TestController::shared().context(), messageName.get(), 0);
+    WKRetainPtr<WKStringRef> messageName = adoptWK(WKStringCreateWithUTF8CString("BeginTest"));
+    WKRetainPtr<WKBooleanRef> dumpPixels = adoptWK(WKBooleanCreate(m_dumpPixels));
+    WKContextPostMessageToInjectedBundle(TestController::shared().context(), messageName.get(), dumpPixels.get());
 
     TestController::shared().runUntil(m_gotInitialResponse, TestController::ShortTimeout);
     if (!m_gotInitialResponse) {
@@ -166,6 +168,8 @@ void TestInvocation::dump(const char* stringToDump)
 
     fputs("#EOF\n", stdout);
     fputs("#EOF\n", stderr);
+    fflush(stdout);
+    fflush(stderr);
 }
 
 void TestInvocation::didReceiveMessageFromInjectedBundle(WKStringRef messageName, WKTypeRef messageBody)
@@ -198,15 +202,16 @@ void TestInvocation::didReceiveMessageFromInjectedBundle(WKStringRef messageName
         WKRetainPtr<WKStringRef> textOutputKey(AdoptWK, WKStringCreateWithUTF8CString("TextOutput"));
         WKStringRef textOutput = static_cast<WKStringRef>(WKDictionaryGetItemForKey(messageBodyDictionary, textOutputKey.get()));
 
-        WKRetainPtr<WKStringRef> textOnlyKey(AdoptWK, WKStringCreateWithUTF8CString("TextOnly"));
-        bool textOnly = WKBooleanGetValue(static_cast<WKBooleanRef>(WKDictionaryGetItemForKey(messageBodyDictionary, textOnlyKey.get())));
+        WKRetainPtr<WKStringRef> pixelResultKey = adoptWK(WKStringCreateWithUTF8CString("PixelResult"));
+        WKImageRef pixelResult = static_cast<WKImageRef>(WKDictionaryGetItemForKey(messageBodyDictionary, pixelResultKey.get()));
+        ASSERT(!pixelResult || m_dumpPixels);
 
         // Dump text.
         dump(toSTD(textOutput).c_str());
 
         // Dump pixels (if necessary).
-        if (m_dumpPixels && !textOnly)
-            dumpPixelsAndCompareWithExpected();
+        if (m_dumpPixels && pixelResult)
+            dumpPixelsAndCompareWithExpected(pixelResult);
 
         fputs("#EOF\n", stdout);
         fflush(stdout);
diff --git a/Tools/WebKitTestRunner/TestInvocation.h b/Tools/WebKitTestRunner/TestInvocation.h
index d5a4af9..9abd7e9 100644
--- a/Tools/WebKitTestRunner/TestInvocation.h
+++ b/Tools/WebKitTestRunner/TestInvocation.h
@@ -46,7 +46,7 @@ public:
 
 private:
     void dump(const char*);
-    void dumpPixelsAndCompareWithExpected();
+    void dumpPixelsAndCompareWithExpected(WKImageRef);
     
     WKRetainPtr<WKURLRef> m_url;
     std::string m_pathOrURL;
diff --git a/Tools/WebKitTestRunner/WebKitTestRunner.sln b/Tools/WebKitTestRunner/WebKitTestRunner.sln
index 3384503..13db4b4 100644
--- a/Tools/WebKitTestRunner/WebKitTestRunner.sln
+++ b/Tools/WebKitTestRunner/WebKitTestRunner.sln
@@ -32,7 +32,7 @@ Global
 	GlobalSection(SolutionConfigurationPlatforms) = preSolution
 		Debug_All|Win32 = Debug_All|Win32
 		Debug|Win32 = Debug|Win32
-		Release_LTCG|Win32 = Release_LTCG|Win32
+		Production|Win32 = Production|Win32
 		Release|Win32 = Release|Win32
 	EndGlobalSection
 	GlobalSection(ProjectConfigurationPlatforms) = postSolution
@@ -40,48 +40,48 @@ Global
 		{3B99669B-1817-443B-BCBE-835580146668}.Debug_All|Win32.Build.0 = Debug_All|Win32
 		{3B99669B-1817-443B-BCBE-835580146668}.Debug|Win32.ActiveCfg = Debug|Win32
 		{3B99669B-1817-443B-BCBE-835580146668}.Debug|Win32.Build.0 = Debug|Win32
-		{3B99669B-1817-443B-BCBE-835580146668}.Release_LTCG|Win32.ActiveCfg = Release_LTCG|Win32
-		{3B99669B-1817-443B-BCBE-835580146668}.Release_LTCG|Win32.Build.0 = Release_LTCG|Win32
+		{3B99669B-1817-443B-BCBE-835580146668}.Production|Win32.ActiveCfg = Production|Win32
+		{3B99669B-1817-443B-BCBE-835580146668}.Production|Win32.Build.0 = Production|Win32
 		{3B99669B-1817-443B-BCBE-835580146668}.Release|Win32.ActiveCfg = Release|Win32
 		{3B99669B-1817-443B-BCBE-835580146668}.Release|Win32.Build.0 = Release|Win32
 		{4343BC0B-A2E0-4B48-8277-F33CFBFA83CD}.Debug_All|Win32.ActiveCfg = Debug_All|Win32
 		{4343BC0B-A2E0-4B48-8277-F33CFBFA83CD}.Debug_All|Win32.Build.0 = Debug_All|Win32
 		{4343BC0B-A2E0-4B48-8277-F33CFBFA83CD}.Debug|Win32.ActiveCfg = Debug|Win32
 		{4343BC0B-A2E0-4B48-8277-F33CFBFA83CD}.Debug|Win32.Build.0 = Debug|Win32
-		{4343BC0B-A2E0-4B48-8277-F33CFBFA83CD}.Release_LTCG|Win32.ActiveCfg = Release_LTCG|Win32
-		{4343BC0B-A2E0-4B48-8277-F33CFBFA83CD}.Release_LTCG|Win32.Build.0 = Release_LTCG|Win32
+		{4343BC0B-A2E0-4B48-8277-F33CFBFA83CD}.Production|Win32.ActiveCfg = Production|Win32
+		{4343BC0B-A2E0-4B48-8277-F33CFBFA83CD}.Production|Win32.Build.0 = Production|Win32
 		{4343BC0B-A2E0-4B48-8277-F33CFBFA83CD}.Release|Win32.ActiveCfg = Release|Win32
 		{4343BC0B-A2E0-4B48-8277-F33CFBFA83CD}.Release|Win32.Build.0 = Release|Win32
 		{DA31DA52-6675-48D4-89E0-333A7144397C}.Debug_All|Win32.ActiveCfg = Debug_All|Win32
 		{DA31DA52-6675-48D4-89E0-333A7144397C}.Debug_All|Win32.Build.0 = Debug_All|Win32
 		{DA31DA52-6675-48D4-89E0-333A7144397C}.Debug|Win32.ActiveCfg = Debug|Win32
 		{DA31DA52-6675-48D4-89E0-333A7144397C}.Debug|Win32.Build.0 = Debug|Win32
-		{DA31DA52-6675-48D4-89E0-333A7144397C}.Release_LTCG|Win32.ActiveCfg = Release_LTCG|Win32
-		{DA31DA52-6675-48D4-89E0-333A7144397C}.Release_LTCG|Win32.Build.0 = Release_LTCG|Win32
+		{DA31DA52-6675-48D4-89E0-333A7144397C}.Production|Win32.ActiveCfg = Production|Win32
+		{DA31DA52-6675-48D4-89E0-333A7144397C}.Production|Win32.Build.0 = Production|Win32
 		{DA31DA52-6675-48D4-89E0-333A7144397C}.Release|Win32.ActiveCfg = Release|Win32
 		{DA31DA52-6675-48D4-89E0-333A7144397C}.Release|Win32.Build.0 = Release|Win32
 		{59CC0547-70AC-499C-9B19-EC01C6F61137}.Debug_All|Win32.ActiveCfg = Debug_All|Win32
 		{59CC0547-70AC-499C-9B19-EC01C6F61137}.Debug_All|Win32.Build.0 = Debug_All|Win32
 		{59CC0547-70AC-499C-9B19-EC01C6F61137}.Debug|Win32.ActiveCfg = Debug|Win32
 		{59CC0547-70AC-499C-9B19-EC01C6F61137}.Debug|Win32.Build.0 = Debug|Win32
-		{59CC0547-70AC-499C-9B19-EC01C6F61137}.Release_LTCG|Win32.ActiveCfg = Release_LTCG|Win32
-		{59CC0547-70AC-499C-9B19-EC01C6F61137}.Release_LTCG|Win32.Build.0 = Release_LTCG|Win32
+		{59CC0547-70AC-499C-9B19-EC01C6F61137}.Production|Win32.ActiveCfg = Production|Win32
+		{59CC0547-70AC-499C-9B19-EC01C6F61137}.Production|Win32.Build.0 = Production|Win32
 		{59CC0547-70AC-499C-9B19-EC01C6F61137}.Release|Win32.ActiveCfg = Release|Win32
 		{59CC0547-70AC-499C-9B19-EC01C6F61137}.Release|Win32.Build.0 = Release|Win32
 		{CBC3391C-F060-4BF5-A66E-81404168816B}.Debug_All|Win32.ActiveCfg = Debug_All|Win32
 		{CBC3391C-F060-4BF5-A66E-81404168816B}.Debug_All|Win32.Build.0 = Debug_All|Win32
 		{CBC3391C-F060-4BF5-A66E-81404168816B}.Debug|Win32.ActiveCfg = Debug|Win32
 		{CBC3391C-F060-4BF5-A66E-81404168816B}.Debug|Win32.Build.0 = Debug|Win32
-		{CBC3391C-F060-4BF5-A66E-81404168816B}.Release_LTCG|Win32.ActiveCfg = Release_LTCG|Win32
-		{CBC3391C-F060-4BF5-A66E-81404168816B}.Release_LTCG|Win32.Build.0 = Release_LTCG|Win32
+		{CBC3391C-F060-4BF5-A66E-81404168816B}.Production|Win32.ActiveCfg = Production|Win32
+		{CBC3391C-F060-4BF5-A66E-81404168816B}.Production|Win32.Build.0 = Production|Win32
 		{CBC3391C-F060-4BF5-A66E-81404168816B}.Release|Win32.ActiveCfg = Release|Win32
 		{CBC3391C-F060-4BF5-A66E-81404168816B}.Release|Win32.Build.0 = Release|Win32
 		{C0737398-3565-439E-A2B8-AB2BE4D5430C}.Debug_All|Win32.ActiveCfg = Debug_All|Win32
 		{C0737398-3565-439E-A2B8-AB2BE4D5430C}.Debug_All|Win32.Build.0 = Debug_All|Win32
 		{C0737398-3565-439E-A2B8-AB2BE4D5430C}.Debug|Win32.ActiveCfg = Debug|Win32
 		{C0737398-3565-439E-A2B8-AB2BE4D5430C}.Debug|Win32.Build.0 = Debug|Win32
-		{C0737398-3565-439E-A2B8-AB2BE4D5430C}.Release_LTCG|Win32.ActiveCfg = Release_LTCG|Win32
-		{C0737398-3565-439E-A2B8-AB2BE4D5430C}.Release_LTCG|Win32.Build.0 = Release_LTCG|Win32
+		{C0737398-3565-439E-A2B8-AB2BE4D5430C}.Production|Win32.ActiveCfg = Production|Win32
+		{C0737398-3565-439E-A2B8-AB2BE4D5430C}.Production|Win32.Build.0 = Production|Win32
 		{C0737398-3565-439E-A2B8-AB2BE4D5430C}.Release|Win32.ActiveCfg = Release|Win32
 		{C0737398-3565-439E-A2B8-AB2BE4D5430C}.Release|Win32.Build.0 = Release|Win32
 	EndGlobalSection
diff --git a/Tools/WebKitTestRunner/WebKitTestRunner.xcodeproj/project.pbxproj b/Tools/WebKitTestRunner/WebKitTestRunner.xcodeproj/project.pbxproj
index 62105cd..64c5493 100644
--- a/Tools/WebKitTestRunner/WebKitTestRunner.xcodeproj/project.pbxproj
+++ b/Tools/WebKitTestRunner/WebKitTestRunner.xcodeproj/project.pbxproj
@@ -32,8 +32,6 @@
 		6510A78A11EC643800410867 /* WebKitWeightWatcher700.ttf in Resources */ = {isa = PBXBuildFile; fileRef = 6510A77F11EC643800410867 /* WebKitWeightWatcher700.ttf */; };
 		6510A78B11EC643800410867 /* WebKitWeightWatcher800.ttf in Resources */ = {isa = PBXBuildFile; fileRef = 6510A78011EC643800410867 /* WebKitWeightWatcher800.ttf */; };
 		6510A78C11EC643800410867 /* WebKitWeightWatcher900.ttf in Resources */ = {isa = PBXBuildFile; fileRef = 6510A78111EC643800410867 /* WebKitWeightWatcher900.ttf */; };
-		65DD1D9612FFE798004B5285 /* WebCore.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = 65DD1D9512FFE798004B5285 /* WebCore.framework */; };
-		65DE432512FFE84000171BCA /* WebCore.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = 65DD1D9512FFE798004B5285 /* WebCore.framework */; };
 		65EB85A011EC67CC0034D300 /* ActivateFonts.mm in Sources */ = {isa = PBXBuildFile; fileRef = 65EB859F11EC67CC0034D300 /* ActivateFonts.mm */; };
 		BC14E4DB120E02D000826C0C /* GCController.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC14E4D9120E02D000826C0C /* GCController.cpp */; };
 		BC14E4EA120E03D800826C0C /* JSGCController.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC14E4E8120E03D800826C0C /* JSGCController.cpp */; };
@@ -47,10 +45,10 @@
 		BC7934AC1190658C005EA8E2 /* WebKit2.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = BC7934AB1190658C005EA8E2 /* WebKit2.framework */; };
 		BC7934E811906846005EA8E2 /* PlatformWebViewMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = BC7934E711906846005EA8E2 /* PlatformWebViewMac.mm */; };
 		BC8C795C11D2785D004535A1 /* TestControllerMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = BC8C795B11D2785D004535A1 /* TestControllerMac.mm */; };
-		BC8DAD5D1315C0EC00EC96FC /* TestInvocationMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = BC8DAD5B1315C0EC00EC96FC /* TestInvocationMac.mm */; };
 		BC8DAD7B1316D91000EC96FC /* InjectedBundleMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = BC8DAD771316D7B900EC96FC /* InjectedBundleMac.mm */; };
 		BC8FD8CA120E527F00F3E71A /* EventSendingController.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC8FD8C9120E527F00F3E71A /* EventSendingController.cpp */; };
 		BC8FD8D2120E545B00F3E71A /* JSEventSendingController.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC8FD8D0120E545B00F3E71A /* JSEventSendingController.cpp */; };
+		BC9192051333E4F8003011DC /* TestInvocationCG.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC9192041333E4F8003011DC /* TestInvocationCG.cpp */; };
 		BC952C0D11F3B965003398B4 /* JSWrapper.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC952C0C11F3B965003398B4 /* JSWrapper.cpp */; };
 		BC952F1F11F3C652003398B4 /* JSLayoutTestController.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC952F1D11F3C652003398B4 /* JSLayoutTestController.cpp */; };
 		BCC997A411D3C8F60017BCA2 /* InjectedBundle.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BCC997A011D3C8F60017BCA2 /* InjectedBundle.cpp */; };
@@ -79,6 +77,7 @@
 /* End PBXContainerItemProxy section */
 
 /* Begin PBXFileReference section */
+		378D442213346D00006A777B /* config.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = config.h; sourceTree = "<group>"; };
 		6510A77711EC643800410867 /* AHEM____.TTF */ = {isa = PBXFileReference; lastKnownFileType = file; name = "AHEM____.TTF"; path = "fonts/AHEM____.TTF"; sourceTree = "<group>"; };
 		6510A77811EC643800410867 /* ColorBits.ttf */ = {isa = PBXFileReference; lastKnownFileType = file; name = ColorBits.ttf; path = fonts/ColorBits.ttf; sourceTree = "<group>"; };
 		6510A77911EC643800410867 /* WebKitWeightWatcher100.ttf */ = {isa = PBXFileReference; lastKnownFileType = file; name = WebKitWeightWatcher100.ttf; path = fonts/WebKitWeightWatcher100.ttf; sourceTree = "<group>"; };
@@ -90,7 +89,6 @@
 		6510A77F11EC643800410867 /* WebKitWeightWatcher700.ttf */ = {isa = PBXFileReference; lastKnownFileType = file; name = WebKitWeightWatcher700.ttf; path = fonts/WebKitWeightWatcher700.ttf; sourceTree = "<group>"; };
 		6510A78011EC643800410867 /* WebKitWeightWatcher800.ttf */ = {isa = PBXFileReference; lastKnownFileType = file; name = WebKitWeightWatcher800.ttf; path = fonts/WebKitWeightWatcher800.ttf; sourceTree = "<group>"; };
 		6510A78111EC643800410867 /* WebKitWeightWatcher900.ttf */ = {isa = PBXFileReference; lastKnownFileType = file; name = WebKitWeightWatcher900.ttf; path = fonts/WebKitWeightWatcher900.ttf; sourceTree = "<group>"; };
-		65DD1D9512FFE798004B5285 /* WebCore.framework */ = {isa = PBXFileReference; lastKnownFileType = wrapper.framework; path = WebCore.framework; sourceTree = BUILT_PRODUCTS_DIR; };
 		65EB859D11EC67CC0034D300 /* ActivateFonts.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ActivateFonts.h; sourceTree = "<group>"; };
 		65EB859F11EC67CC0034D300 /* ActivateFonts.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = ActivateFonts.mm; sourceTree = "<group>"; };
 		8DD76FA10486AA7600D96B5E /* WebKitTestRunner */ = {isa = PBXFileReference; explicitFileType = "compiled.mach-o.executable"; includeInIndex = 0; path = WebKitTestRunner; sourceTree = BUILT_PRODUCTS_DIR; };
@@ -115,13 +113,13 @@
 		BC7934DD119066EC005EA8E2 /* PlatformWebView.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PlatformWebView.h; sourceTree = "<group>"; };
 		BC7934E711906846005EA8E2 /* PlatformWebViewMac.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = PlatformWebViewMac.mm; sourceTree = "<group>"; };
 		BC8C795B11D2785D004535A1 /* TestControllerMac.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = TestControllerMac.mm; sourceTree = "<group>"; };
-		BC8DAD5B1315C0EC00EC96FC /* TestInvocationMac.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = TestInvocationMac.mm; sourceTree = "<group>"; };
 		BC8DAD771316D7B900EC96FC /* InjectedBundleMac.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = InjectedBundleMac.mm; sourceTree = "<group>"; };
 		BC8FD8C8120E527F00F3E71A /* EventSendingController.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = EventSendingController.h; sourceTree = "<group>"; };
 		BC8FD8C9120E527F00F3E71A /* EventSendingController.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = EventSendingController.cpp; sourceTree = "<group>"; };
 		BC8FD8CB120E52B000F3E71A /* EventSendingController.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = EventSendingController.idl; sourceTree = "<group>"; };
 		BC8FD8D0120E545B00F3E71A /* JSEventSendingController.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = JSEventSendingController.cpp; path = DerivedSources/WebKitTestRunner/JSEventSendingController.cpp; sourceTree = BUILT_PRODUCTS_DIR; };
 		BC8FD8D1120E545B00F3E71A /* JSEventSendingController.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = JSEventSendingController.h; path = DerivedSources/WebKitTestRunner/JSEventSendingController.h; sourceTree = BUILT_PRODUCTS_DIR; };
+		BC9192041333E4F8003011DC /* TestInvocationCG.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = TestInvocationCG.cpp; path = cg/TestInvocationCG.cpp; sourceTree = "<group>"; };
 		BC952C0B11F3B965003398B4 /* JSWrapper.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSWrapper.h; sourceTree = "<group>"; };
 		BC952C0C11F3B965003398B4 /* JSWrapper.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSWrapper.cpp; sourceTree = "<group>"; };
 		BC952C0E11F3B97B003398B4 /* JSWrappable.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSWrappable.h; sourceTree = "<group>"; };
@@ -151,7 +149,6 @@
 				BC7934A511906584005EA8E2 /* Cocoa.framework in Frameworks */,
 				BC7934AC1190658C005EA8E2 /* WebKit2.framework in Frameworks */,
 				BCDA2B9A1191051F00C3BC47 /* JavaScriptCore.framework in Frameworks */,
-				65DD1D9612FFE798004B5285 /* WebCore.framework in Frameworks */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
@@ -162,7 +159,6 @@
 				BC25193E11D15D8B002EBC01 /* Cocoa.framework in Frameworks */,
 				BC25193F11D15D8B002EBC01 /* WebKit2.framework in Frameworks */,
 				BC25194011D15D8B002EBC01 /* JavaScriptCore.framework in Frameworks */,
-				65DE432512FFE84000171BCA /* WebCore.framework in Frameworks */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
@@ -187,6 +183,7 @@
 		08FB7795FE84155DC02AAC07 /* TestRunner */ = {
 			isa = PBXGroup;
 			children = (
+				BC9192021333E4CD003011DC /* cg */,
 				BC7933FE118F7C74005EA8E2 /* mac */,
 				BC251A1711D16774002EBC01 /* WebKitTestRunnerPrefix.h */,
 				BC7934DD119066EC005EA8E2 /* PlatformWebView.h */,
@@ -204,7 +201,6 @@
 				BC7934A411906584005EA8E2 /* Cocoa.framework */,
 				BC7934AB1190658C005EA8E2 /* WebKit2.framework */,
 				BCDA2B991191051F00C3BC47 /* JavaScriptCore.framework */,
-				65DD1D9512FFE798004B5285 /* WebCore.framework */,
 			);
 			name = "External Frameworks and Libraries";
 			sourceTree = "<group>";
@@ -283,7 +279,6 @@
 				BC7933FF118F7C84005EA8E2 /* main.mm */,
 				BC7934E711906846005EA8E2 /* PlatformWebViewMac.mm */,
 				BC8C795B11D2785D004535A1 /* TestControllerMac.mm */,
-				BC8DAD5B1315C0EC00EC96FC /* TestInvocationMac.mm */,
 			);
 			path = mac;
 			sourceTree = "<group>";
@@ -299,6 +294,14 @@
 			path = Configurations;
 			sourceTree = "<group>";
 		};
+		BC9192021333E4CD003011DC /* cg */ = {
+			isa = PBXGroup;
+			children = (
+				BC9192041333E4F8003011DC /* TestInvocationCG.cpp */,
+			);
+			name = cg;
+			sourceTree = "<group>";
+		};
 		BC952C0A11F3B939003398B4 /* Bindings */ = {
 			isa = PBXGroup;
 			children = (
@@ -329,6 +332,7 @@
 		BC99CBF11207642D00FDEE76 /* Shared */ = {
 			isa = PBXGroup;
 			children = (
+				378D442213346D00006A777B /* config.h */,
 				BC99A4841208901A007E9F08 /* StringFunctions.h */,
 			);
 			name = Shared;
@@ -446,8 +450,8 @@
 				BC793431118F7F19005EA8E2 /* TestController.cpp in Sources */,
 				BC7934E811906846005EA8E2 /* PlatformWebViewMac.mm in Sources */,
 				BCD7D2F811921278006DB7EE /* TestInvocation.cpp in Sources */,
-				BC8DAD5D1315C0EC00EC96FC /* TestInvocationMac.mm in Sources */,
 				BC8C795C11D2785D004535A1 /* TestControllerMac.mm in Sources */,
+				BC9192051333E4F8003011DC /* TestInvocationCG.cpp in Sources */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
diff --git a/Tools/WebKitTestRunner/cairo/TestInvocationCairo.cpp b/Tools/WebKitTestRunner/cairo/TestInvocationCairo.cpp
new file mode 100644
index 0000000..88aacbd
--- /dev/null
+++ b/Tools/WebKitTestRunner/cairo/TestInvocationCairo.cpp
@@ -0,0 +1,38 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ * Copyright (C) 2011 Brent Fulgham <bfulgham@webkit.org>. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "TestInvocation.h"
+
+namespace WTR {
+
+void TestInvocation::dumpPixelsAndCompareWithExpected(WKImageRef image)
+{
+    // FIXME: This stub should be replaced with a Cairo implementation
+    // of the pixel dumping and comparison routines.
+}
+
+} // namespace WTR
diff --git a/Tools/WebKitTestRunner/mac/TestInvocationMac.mm b/Tools/WebKitTestRunner/cg/TestInvocationCG.cpp
index 13a0295..cba2908 100644
--- a/Tools/WebKitTestRunner/mac/TestInvocationMac.mm
+++ b/Tools/WebKitTestRunner/cg/TestInvocationCG.cpp
@@ -23,38 +23,41 @@
  * THE POSSIBILITY OF SUCH DAMAGE.
  */
 
+#include "config.h"
 #include "TestInvocation.h"
 
 #include "PlatformWebView.h"
 #include "TestController.h"
 #include <ImageIO/CGImageDestination.h>
-#include <LaunchServices/UTCoreTypes.h>
-#include <WebKit2/WKPage.h>
+#include <WebKit2/WKImageCG.h>
+#include <wtf/MD5.h>
 #include <wtf/RetainPtr.h>
+#include <wtf/StringExtras.h>
+
+#if PLATFORM(MAC)
+#include <LaunchServices/UTCoreTypes.h>
+#endif
 
-#define COMMON_DIGEST_FOR_OPENSSL
-#include <CommonCrypto/CommonDigest.h>
+#if PLATFORM(WIN)
+static const CFStringRef kUTTypePNG = CFSTR("public.png");
+#endif
 
 namespace WTR {
 
-static CGContextRef createCGContextFromPlatformView(PlatformWebView* platformWebView)
+static CGContextRef createCGContextFromImage(WKImageRef wkImage)
 {
-    WKView* view = platformWebView->platformView();
-    [view display];
+    RetainPtr<CGImageRef> image(AdoptCF, WKImageCreateCGImage(wkImage));
 
-    NSSize webViewSize = [view frame].size;
-    size_t pixelsWide = static_cast<size_t>(webViewSize.width);
-    size_t pixelsHigh = static_cast<size_t>(webViewSize.height);
+    size_t pixelsWide = CGImageGetWidth(image.get());
+    size_t pixelsHigh = CGImageGetHeight(image.get());
     size_t rowBytes = (4 * pixelsWide + 63) & ~63;
     void* buffer = calloc(pixelsHigh, rowBytes);
 
-    CGColorSpaceRef colorSpace = CGColorSpaceCreateWithName(kCGColorSpaceGenericRGB);
+    CGColorSpaceRef colorSpace = CGColorSpaceCreateDeviceRGB();
     CGContextRef context = CGBitmapContextCreate(buffer, pixelsWide, pixelsHigh, 8, rowBytes, colorSpace, kCGImageAlphaPremultipliedFirst | kCGBitmapByteOrder32Host);
     CGColorSpaceRelease(colorSpace);
     
-    CGImageRef image = CGWindowListCreateImage(CGRectNull, kCGWindowListOptionIncludingWindow, [[view window] windowNumber], kCGWindowImageBoundsIgnoreFraming | kCGWindowImageShouldBeOpaque);
-    CGContextDrawImage(context, CGRectMake(0, 0, CGImageGetWidth(image), CGImageGetHeight(image)), image);
-    CGImageRelease(image);
+    CGContextDrawImage(context, CGRectMake(0, 0, pixelsWide, pixelsHigh), image.get());
 
     return context;
 }
@@ -67,26 +70,29 @@ void computeMD5HashStringForContext(CGContextRef bitmapContext, char hashString[
     size_t bytesPerRow = CGBitmapContextGetBytesPerRow(bitmapContext);
     
     // We need to swap the bytes to ensure consistent hashes independently of endianness
-    MD5_CTX md5Context;
-    MD5_Init(&md5Context);
+    MD5 md5;
     unsigned char* bitmapData = static_cast<unsigned char*>(CGBitmapContextGetData(bitmapContext));
+#if PLATFORM(MAC)
     if ((CGBitmapContextGetBitmapInfo(bitmapContext) & kCGBitmapByteOrderMask) == kCGBitmapByteOrder32Big) {
         for (unsigned row = 0; row < pixelsHigh; row++) {
-            uint32_t buffer[pixelsWide];
+            Vector<uint8_t> buffer(4 * pixelsWide);
             for (unsigned column = 0; column < pixelsWide; column++)
                 buffer[column] = OSReadLittleInt32(bitmapData, 4 * column);
-            MD5_Update(&md5Context, buffer, 4 * pixelsWide);
+            md5.addBytes(buffer);
             bitmapData += bytesPerRow;
         }
     } else {
+#endif
         for (unsigned row = 0; row < pixelsHigh; row++) {
-            MD5_Update(&md5Context, bitmapData, 4 * pixelsWide);
+            md5.addBytes(bitmapData, 4 * pixelsWide);
             bitmapData += bytesPerRow;
         }
+#if PLATFORM(MAC)
     }
+#endif
 
-    unsigned char hash[16];
-    MD5_Final(hash, &md5Context);
+    Vector<uint8_t, 16> hash;
+    md5.checksum(hash);
     
     hashString[0] = '\0';
     for (int i = 0; i < 16; i++)
@@ -120,18 +126,10 @@ static void dumpBitmap(CGContextRef bitmapContext)
     }
 }
 
-static void forceRepaintFunction(WKErrorRef, void* context)
+void TestInvocation::dumpPixelsAndCompareWithExpected(WKImageRef image)
 {
-    *static_cast<bool*>(context) = true;
-}
+    CGContextRef context = createCGContextFromImage(image);
 
-void TestInvocation::dumpPixelsAndCompareWithExpected()
-{
-    WKPageForceRepaint(TestController::shared().mainWebView()->page(), &m_gotRepaint, forceRepaintFunction);
-    TestController::shared().runUntil(m_gotRepaint, TestController::LongTimeout);
-    
-    CGContextRef context = createCGContextFromPlatformView(TestController::shared().mainWebView());
-    
     // Compute the hash of the bitmap context pixels
     char actualHash[33];
     computeMD5HashStringForContext(context, actualHash);
diff --git a/Tools/WebKitTestRunner/config.h b/Tools/WebKitTestRunner/config.h
new file mode 100644
index 0000000..81f8066
--- /dev/null
+++ b/Tools/WebKitTestRunner/config.h
@@ -0,0 +1,68 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+ 
+#ifndef WebKitTestRunner_config_h
+#define WebKitTestRunner_config_h
+
+#include <wtf/Platform.h>
+
+/* See note in wtf/Platform.h for more info on EXPORT_MACROS. */
+#if USE(EXPORT_MACROS)
+
+#include <wtf/ExportMacros.h>
+
+#define WTF_EXPORT_PRIVATE WTF_IMPORT
+#define JS_EXPORT_PRIVATE WTF_IMPORT
+#define WEBKIT_EXPORTDATA WTF_IMPORT
+
+#define JS_EXPORTDATA JS_EXPORT_PRIVATE
+#define JS_EXPORTCLASS JS_EXPORT_PRIVATE
+
+#else /* !USE(EXPORT_MACROS) */
+
+#if OS(WINDOWS) && !COMPILER(GCC) && !defined(BUILDING_WX__)
+#define JS_EXPORTDATA __declspec(dllimport)
+#define WEBKIT_EXPORTDATA __declspec(dllimport)
+#else
+#define JS_EXPORTDATA
+#define WEBKIT_EXPORTDATA
+#endif
+
+#define WTF_EXPORT_PRIVATE JS_EXPORTDATA
+#define JS_EXPORT_PRIVATE JS_EXPORTDATA
+
+#endif /* USE(EXPORT_MACROS) */
+
+#if PLATFORM(WIN)
+#define WTF_USE_CF 1 
+#if defined(WIN_CAIRO)
+#define WTF_PLATFORM_CAIRO 1
+#define WTF_USE_CURL 1
+#else
+#define WTF_PLATFORM_CG 1
+#define WTF_USE_CFNETWORK 1
+#endif
+#endif
+
+#endif
diff --git a/Tools/WebKitTestRunner/mac/TestControllerMac.mm b/Tools/WebKitTestRunner/mac/TestControllerMac.mm
index 8ceabc1..c884c8f 100644
--- a/Tools/WebKitTestRunner/mac/TestControllerMac.mm
+++ b/Tools/WebKitTestRunner/mac/TestControllerMac.mm
@@ -23,11 +23,12 @@
  * THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#include "TestController.h"
+#import "config.h"
+#import "TestController.h"
 
-#include "PlatformWebView.h"
-#include <WebKit2/WKStringCF.h>
-#include <mach-o/dyld.h> 
+#import "PlatformWebView.h"
+#import <WebKit2/WKStringCF.h>
+#import <mach-o/dyld.h> 
 
 namespace WTR {
 
diff --git a/Tools/WebKitTestRunner/mac/main.mm b/Tools/WebKitTestRunner/mac/main.mm
index d2f26ab..12326a4 100644
--- a/Tools/WebKitTestRunner/mac/main.mm
+++ b/Tools/WebKitTestRunner/mac/main.mm
@@ -23,6 +23,8 @@
  * THE POSSIBILITY OF SUCH DAMAGE.
  */
 
+#import "config.h"
+
 #import "TestController.h"
 
 int main(int argc, const char* argv[])
diff --git a/Tools/WebKitTestRunner/qt/PlatformWebViewQt.cpp b/Tools/WebKitTestRunner/qt/PlatformWebViewQt.cpp
index 18e2523..03e2c02 100644
--- a/Tools/WebKitTestRunner/qt/PlatformWebViewQt.cpp
+++ b/Tools/WebKitTestRunner/qt/PlatformWebViewQt.cpp
@@ -24,6 +24,8 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
+#include "config.h"
+
 #include "PlatformWebView.h"
 #include "qgraphicswkview.h"
 #include "qwkcontext.h"
diff --git a/Tools/WebKitTestRunner/qt/TestControllerQt.cpp b/Tools/WebKitTestRunner/qt/TestControllerQt.cpp
index 30a1b5c..bd572b0 100644
--- a/Tools/WebKitTestRunner/qt/TestControllerQt.cpp
+++ b/Tools/WebKitTestRunner/qt/TestControllerQt.cpp
@@ -24,6 +24,7 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
+#include "config.h"
 #include "TestController.h"
 
 #include "WKStringQt.h"
diff --git a/Tools/WebKitTestRunner/qt/TestInvocationQt.cpp b/Tools/WebKitTestRunner/qt/TestInvocationQt.cpp
index b5fbda4..ca9d6dc 100644
--- a/Tools/WebKitTestRunner/qt/TestInvocationQt.cpp
+++ b/Tools/WebKitTestRunner/qt/TestInvocationQt.cpp
@@ -23,11 +23,12 @@
  * THE POSSIBILITY OF SUCH DAMAGE.
  */
 
+#include "config.h"
 #include "TestInvocation.h"
 
 namespace WTR {
 
-void TestInvocation::dumpPixelsAndCompareWithExpected()
+void TestInvocation::dumpPixelsAndCompareWithExpected(WKImageRef)
 {
 }
 
diff --git a/Tools/WebKitTestRunner/qt/WebKitTestRunner.pro b/Tools/WebKitTestRunner/qt/WebKitTestRunner.pro
index d6579a4..684a14a 100644
--- a/Tools/WebKitTestRunner/qt/WebKitTestRunner.pro
+++ b/Tools/WebKitTestRunner/qt/WebKitTestRunner.pro
@@ -9,6 +9,7 @@ GENERATED_SOURCES_DIR = ../generated
 include(../../../Source/WebKit.pri)
 
 DEFINES += USE_SYSTEM_MALLOC=1
+DEFINES -= QT_ASCII_CAST_WARNINGS
 
 INCLUDEPATH += \
     $$BASEDIR \
diff --git a/Tools/WebKitTestRunner/qt/main.cpp b/Tools/WebKitTestRunner/qt/main.cpp
index 4312a05..2061714 100644
--- a/Tools/WebKitTestRunner/qt/main.cpp
+++ b/Tools/WebKitTestRunner/qt/main.cpp
@@ -24,6 +24,8 @@
  * THE POSSIBILITY OF SUCH DAMAGE.
  */
 
+#include "config.h"
+
 #include "TestController.h"
 
 #include <QApplication>
diff --git a/Tools/WebKitTestRunner/win/InjectedBundle.vcproj b/Tools/WebKitTestRunner/win/InjectedBundle.vcproj
index eec770b..e1da915 100644
--- a/Tools/WebKitTestRunner/win/InjectedBundle.vcproj
+++ b/Tools/WebKitTestRunner/win/InjectedBundle.vcproj
@@ -18,7 +18,7 @@
 		<Configuration
 			Name="Debug|Win32"
 			ConfigurationType="2"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;..\Configurations\InjectedBundleCoreFoundation.vsprops;..\Configurations\InjectedBundleCommon.vsprops"
+			InheritedPropertySheets=".\InjectedBundleDebug.vsprops"
 			CharacterSet="1"
 			>
 			<Tool
@@ -79,7 +79,7 @@
 		<Configuration
 			Name="Release|Win32"
 			ConfigurationType="2"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;..\Configurations\InjectedBundleCoreFoundation.vsprops;..\Configurations\InjectedBundleCommon.vsprops"
+			InheritedPropertySheets=".\InjectedBundleRelease.vsprops"
 			CharacterSet="1"
 			>
 			<Tool
@@ -140,7 +140,7 @@
 		<Configuration
 			Name="Debug_All|Win32"
 			ConfigurationType="2"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\debug_all.vsprops;..\Configurations\InjectedBundleCoreFoundation.vsprops;..\Configurations\InjectedBundleCommon.vsprops"
+			InheritedPropertySheets=".\InjectedBundleDebugAll.vsprops"
 			CharacterSet="1"
 			>
 			<Tool
@@ -201,7 +201,7 @@
 		<Configuration
 			Name="Debug_Cairo_CFLite|Win32"
 			ConfigurationType="2"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\debug_wincairo.vsprops;..\Configurations\InjectedBundleCFLite.vsprops;..\Configurations\InjectedBundleCommon.vsprops"
+			InheritedPropertySheets=".\InjectedBundleDebugCairoCFLite.vsprops"
 			CharacterSet="1"
 			>
 			<Tool
@@ -262,7 +262,7 @@
 		<Configuration
 			Name="Release_Cairo_CFLite|Win32"
 			ConfigurationType="2"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\WinCairo.vsprops;..\Configurations\InjectedBundleCFLite.vsprops;..\Configurations\InjectedBundleCommon.vsprops"
+			InheritedPropertySheets=".\InjectedBundleReleaseCairoCFLite.vsprops"
 			CharacterSet="1"
 			>
 			<Tool
@@ -321,9 +321,9 @@
 			/>
 		</Configuration>
 		<Configuration
-			Name="Release_LTCG|Win32"
+			Name="Production|Win32"
 			ConfigurationType="2"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;..\Configurations\InjectedBundleCoreFoundation.vsprops;..\Configurations\InjectedBundleCommon.vsprops"
+			InheritedPropertySheets=".\InjectedBundleProduction.vsprops"
 			CharacterSet="1"
 			WholeProgramOptimization="1"
 			>
diff --git a/Tools/WebKitTestRunner/win/InjectedBundleDebug.vsprops b/Tools/WebKitTestRunner/win/InjectedBundleDebug.vsprops
new file mode 100644
index 0000000..06623be
--- /dev/null
+++ b/Tools/WebKitTestRunner/win/InjectedBundleDebug.vsprops
@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="InjectedBundleDebug"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;
+      ..\Configurations\InjectedBundleCoreFoundation.vsprops;
+      ..\Configurations\InjectedBundleCommon.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Tools/WebKitTestRunner/win/InjectedBundleDebugAll.vsprops b/Tools/WebKitTestRunner/win/InjectedBundleDebugAll.vsprops
new file mode 100644
index 0000000..a084312
--- /dev/null
+++ b/Tools/WebKitTestRunner/win/InjectedBundleDebugAll.vsprops
@@ -0,0 +1,13 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="InjectedBundleDebugAll"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\debug_all.vsprops;
+      ..\Configurations\InjectedBundleCoreFoundation.vsprops;
+      ..\Configurations\InjectedBundleCommon.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Tools/WebKitTestRunner/win/InjectedBundleDebugCairoCFLite.vsprops b/Tools/WebKitTestRunner/win/InjectedBundleDebugCairoCFLite.vsprops
new file mode 100644
index 0000000..77fc82d
--- /dev/null
+++ b/Tools/WebKitTestRunner/win/InjectedBundleDebugCairoCFLite.vsprops
@@ -0,0 +1,13 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="InjectedBundleDebugCairoCFLite"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\debug_wincairo.vsprops;
+      ..\Configurations\InjectedBundleCFLite.vsprops;
+      ..\Configurations\InjectedBundleCommon.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Tools/WebKitTestRunner/win/InjectedBundleGenerated.vcproj b/Tools/WebKitTestRunner/win/InjectedBundleGenerated.vcproj
index 83c3868..c74fd3e 100755
--- a/Tools/WebKitTestRunner/win/InjectedBundleGenerated.vcproj
+++ b/Tools/WebKitTestRunner/win/InjectedBundleGenerated.vcproj
@@ -43,7 +43,7 @@
 			/>
 		</Configuration>
 		<Configuration
-			Name="Release_LTCG|Win32"
+			Name="Production|Win32"
 			ConfigurationType="0"
 			InheritedPropertySheets=".\InjectedBundleGeneratedCommon.vsprops"
 			>
diff --git a/Tools/WebKitTestRunner/win/InjectedBundleProduction.vsprops b/Tools/WebKitTestRunner/win/InjectedBundleProduction.vsprops
new file mode 100644
index 0000000..b036c84
--- /dev/null
+++ b/Tools/WebKitTestRunner/win/InjectedBundleProduction.vsprops
@@ -0,0 +1,13 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="InjectedBundleProduction"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\production.vsprops;
+      ..\Configurations\InjectedBundleCoreFoundation.vsprops;
+      ..\Configurations\InjectedBundleCommon.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Tools/WebKitTestRunner/win/InjectedBundleRelease.vsprops b/Tools/WebKitTestRunner/win/InjectedBundleRelease.vsprops
new file mode 100644
index 0000000..8f65ff3
--- /dev/null
+++ b/Tools/WebKitTestRunner/win/InjectedBundleRelease.vsprops
@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="InjectedBundleRelease"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
+      ..\Configurations\InjectedBundleCoreFoundation.vsprops;
+      ..\Configurations\InjectedBundleCommon.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Tools/WebKitTestRunner/win/InjectedBundleReleaseCairoCFLite.vsprops b/Tools/WebKitTestRunner/win/InjectedBundleReleaseCairoCFLite.vsprops
new file mode 100644
index 0000000..c7dfb84
--- /dev/null
+++ b/Tools/WebKitTestRunner/win/InjectedBundleReleaseCairoCFLite.vsprops
@@ -0,0 +1,13 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="InjectedBundleReleaseCairoCFLite"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\WinCairo.vsprops;
+      ..\Configurations\InjectedBundleCFLite.vsprops;
+      ..\Configurations\InjectedBundleCommon.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Tools/WebKitTestRunner/win/PlatformWebViewWin.cpp b/Tools/WebKitTestRunner/win/PlatformWebViewWin.cpp
index e75ccc8..9e23d70 100644
--- a/Tools/WebKitTestRunner/win/PlatformWebViewWin.cpp
+++ b/Tools/WebKitTestRunner/win/PlatformWebViewWin.cpp
@@ -23,6 +23,7 @@
  * THE POSSIBILITY OF SUCH DAMAGE.
  */
 
+#include "config.h"
 #include "PlatformWebView.h"
 
 namespace WTR {
diff --git a/Tools/WebKitTestRunner/win/TestControllerWin.cpp b/Tools/WebKitTestRunner/win/TestControllerWin.cpp
index 6201cf7..44a6138 100644
--- a/Tools/WebKitTestRunner/win/TestControllerWin.cpp
+++ b/Tools/WebKitTestRunner/win/TestControllerWin.cpp
@@ -23,6 +23,7 @@
  * THE POSSIBILITY OF SUCH DAMAGE.
  */
 
+#include "config.h"
 #include "TestController.h"
 
 #include <fcntl.h>
diff --git a/Tools/WebKitTestRunner/win/TestInvocationWin.cpp b/Tools/WebKitTestRunner/win/TestInvocationWin.cpp
index b5fbda4..7c79ff5 100644
--- a/Tools/WebKitTestRunner/win/TestInvocationWin.cpp
+++ b/Tools/WebKitTestRunner/win/TestInvocationWin.cpp
@@ -23,12 +23,15 @@
  * THE POSSIBILITY OF SUCH DAMAGE.
  */
 
+#include "config.h"
 #include "TestInvocation.h"
 
 namespace WTR {
 
-void TestInvocation::dumpPixelsAndCompareWithExpected()
+#if !PLATFORM(CG)
+void TestInvocation::dumpPixelsAndCompareWithExpected(WKImageRef)
 {
 }
+#endif
 
 } // namespace WTR
diff --git a/Tools/WebKitTestRunner/win/WebKitTestRunner.vcproj b/Tools/WebKitTestRunner/win/WebKitTestRunner.vcproj
index e12338a..bb4b4c6 100644
--- a/Tools/WebKitTestRunner/win/WebKitTestRunner.vcproj
+++ b/Tools/WebKitTestRunner/win/WebKitTestRunner.vcproj
@@ -18,7 +18,7 @@
 		<Configuration
 			Name="Debug|Win32"
 			ConfigurationType="1"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;..\Configurations\WebKitTestRunnerCommon.vsprops;..\Configurations\WebKitTestRunnerCoreFoundation.vsprops"
+			InheritedPropertySheets=".\WebKitTestRunnerDebug.vsprops"
 			CharacterSet="1"
 			>
 			<Tool
@@ -79,7 +79,7 @@
 		<Configuration
 			Name="Release|Win32"
 			ConfigurationType="1"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;..\Configurations\WebKitTestRunnerCommon.vsprops;..\Configurations\WebKitTestRunnerCoreFoundation.vsprops"
+			InheritedPropertySheets=".\WebKitTestRunnerRelease.vsprops"
 			CharacterSet="1"
 			>
 			<Tool
@@ -140,7 +140,7 @@
 		<Configuration
 			Name="Debug_All|Win32"
 			ConfigurationType="1"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\debug_all.vsprops;..\Configurations\WebKitTestRunnerCommon.vsprops;..\Configurations\WebKitTestRunnerCoreFoundation.vsprops"
+			InheritedPropertySheets=".\WebKitTestRunnerDebugAll.vsprops"
 			CharacterSet="1"
 			>
 			<Tool
@@ -201,7 +201,7 @@
 		<Configuration
 			Name="Debug_Cairo_CFLite|Win32"
 			ConfigurationType="1"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\debug_wincairo.vsprops;..\Configurations\WebKitTestRunnerCommon.vsprops;..\Configurations\WebKitTestRunnerCFLite.vsprops"
+			InheritedPropertySheets=".\WebKitTestRunnerDebugCairoCFLite.vsprops"
 			CharacterSet="1"
 			>
 			<Tool
@@ -262,7 +262,7 @@
 		<Configuration
 			Name="Release_Cairo_CFLite|Win32"
 			ConfigurationType="1"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\WinCairo.vsprops;..\Configurations\WebKitTestRunnerCommon.vsprops;..\Configurations\WebKitTestRunnerCFLite.vsprops"
+			InheritedPropertySheets=".\WebKitTestRunnerReleaseCairoCFLite.vsprops"
 			CharacterSet="1"
 			>
 			<Tool
@@ -321,9 +321,9 @@
 			/>
 		</Configuration>
 		<Configuration
-			Name="Release_LTCG|Win32"
+			Name="Production|Win32"
 			ConfigurationType="1"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;..\Configurations\WebKitTestRunnerCommon.vsprops;..\Configurations\WebKitTestRunnerCoreFoundation.vsprops"
+			InheritedPropertySheets=".\WebKitTestRunnerProduction.vsprops"
 			CharacterSet="1"
 			WholeProgramOptimization="1"
 			>
@@ -406,6 +406,70 @@
 				>
 			</File>
 		</Filter>
+		<Filter
+			Name="cg"
+			>
+			<File
+				RelativePath="..\cg\TestInvocationCG.cpp"
+				>
+				<FileConfiguration
+					Name="Debug_Cairo_CFLite|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Release_Cairo_CFLite|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+			</File>
+		</Filter>
+		<Filter
+			Name="cairo"
+			>
+			<File
+				RelativePath="..\cairo\TestInvocationCairo.cpp"
+				>
+				<FileConfiguration
+					Name="Debug|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Release|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Debug_All|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Production|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+			</File>
+		</Filter>
 		<File
 			RelativePath="..\PlatformWebView.h"
 			>
diff --git a/Tools/WebKitTestRunner/win/WebKitTestRunnerDebug.vsprops b/Tools/WebKitTestRunner/win/WebKitTestRunnerDebug.vsprops
new file mode 100644
index 0000000..bf12fe2
--- /dev/null
+++ b/Tools/WebKitTestRunner/win/WebKitTestRunnerDebug.vsprops
@@ -0,0 +1,13 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="WebKitTestRunnerDebug"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;
+      ..\Configurations\WebKitTestRunnerCommon.vsprops;
+      ..\Configurations\WebKitTestRunnerCoreFoundation.vsprops;
+      ..\Configurations\WebKitTestRunnerCoreGraphics.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Tools/WebKitTestRunner/win/WebKitTestRunnerDebugAll.vsprops b/Tools/WebKitTestRunner/win/WebKitTestRunnerDebugAll.vsprops
new file mode 100644
index 0000000..1629640
--- /dev/null
+++ b/Tools/WebKitTestRunner/win/WebKitTestRunnerDebugAll.vsprops
@@ -0,0 +1,14 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="WebKitTestRunnerDebugAll"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\debug_all.vsprops;
+      ..\Configurations\WebKitTestRunnerCommon.vsprops;
+      ..\Configurations\WebKitTestRunnerCoreFoundation.vsprops;
+      ..\Configurations\WebKitTestRunnerCoreGraphics.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Tools/WebKitTestRunner/win/WebKitTestRunnerDebugCairoCFLite.vsprops b/Tools/WebKitTestRunner/win/WebKitTestRunnerDebugCairoCFLite.vsprops
new file mode 100644
index 0000000..0e18af6
--- /dev/null
+++ b/Tools/WebKitTestRunner/win/WebKitTestRunnerDebugCairoCFLite.vsprops
@@ -0,0 +1,13 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="WebKitTestRunnerDebugCairoCFLite"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\debug_wincairo.vsprops;
+      ..\Configurations\WebKitTestRunnerCommon.vsprops;
+      ..\Configurations\WebKitTestRunnerCFLite.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Tools/WebKitTestRunner/win/WebKitTestRunnerProduction.vsprops b/Tools/WebKitTestRunner/win/WebKitTestRunnerProduction.vsprops
new file mode 100644
index 0000000..28dbf04
--- /dev/null
+++ b/Tools/WebKitTestRunner/win/WebKitTestRunnerProduction.vsprops
@@ -0,0 +1,14 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="WebKitTestRunnerProduction"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\production.vsprops;
+      ..\Configurations\WebKitTestRunnerCommon.vsprops;
+      ..\Configurations\WebKitTestRunnerCoreFoundation.vsprops;
+      ..\Configurations\WebKitTestRunnerCoreGraphics.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Tools/WebKitTestRunner/win/WebKitTestRunnerRelease.vsprops b/Tools/WebKitTestRunner/win/WebKitTestRunnerRelease.vsprops
new file mode 100644
index 0000000..788f4ef
--- /dev/null
+++ b/Tools/WebKitTestRunner/win/WebKitTestRunnerRelease.vsprops
@@ -0,0 +1,13 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="WebKitTestRunnerRelease"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
+      ..\Configurations\WebKitTestRunnerCommon.vsprops;
+      ..\Configurations\WebKitTestRunnerCoreFoundation.vsprops;
+      ..\Configurations\WebKitTestRunnerCoreGraphics.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Tools/WebKitTestRunner/win/WebKitTestRunnerReleaseCairoCFLite.vsprops b/Tools/WebKitTestRunner/win/WebKitTestRunnerReleaseCairoCFLite.vsprops
new file mode 100644
index 0000000..f6e0f00
--- /dev/null
+++ b/Tools/WebKitTestRunner/win/WebKitTestRunnerReleaseCairoCFLite.vsprops
@@ -0,0 +1,13 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="WebKitTestRunnerReleaseCairoCFLite"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\WinCairo.vsprops;
+      ..\Configurations\WebKitTestRunnerCommon.vsprops;
+      ..\Configurations\WebKitTestRunnerCFLite.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Tools/WebKitTestRunner/win/main.cpp b/Tools/WebKitTestRunner/win/main.cpp
index 6ef0f66..14c25dc 100644
--- a/Tools/WebKitTestRunner/win/main.cpp
+++ b/Tools/WebKitTestRunner/win/main.cpp
@@ -23,6 +23,8 @@
  * THE POSSIBILITY OF SUCH DAMAGE.
  */
 
+#include "config.h"
+
 #include "TestController.h"
 
 int main(int argc, const char* argv[])
diff --git a/Tools/WinLauncher/WinLauncher.vcproj b/Tools/WinLauncher/WinLauncher.vcproj
index 2f23abe..e2ef8f7 100644
--- a/Tools/WinLauncher/WinLauncher.vcproj
+++ b/Tools/WinLauncher/WinLauncher.vcproj
@@ -18,7 +18,7 @@
 		<Configuration
 			Name="Debug|Win32"
 			ConfigurationType="1"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;.\WinLauncherCommon.vsprops"
+			InheritedPropertySheets=".\WinLauncherDebug.vsprops"
 			CharacterSet="1"
 			>
 			<Tool
@@ -79,7 +79,7 @@
 		<Configuration
 			Name="Release|Win32"
 			ConfigurationType="1"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;.\WinLauncherCommon.vsprops"
+			InheritedPropertySheets=".\WinLauncherRelease.vsprops"
 			CharacterSet="1"
 			>
 			<Tool
@@ -140,7 +140,7 @@
 		<Configuration
 			Name="Debug_Cairo_CFLite|Win32"
 			ConfigurationType="1"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;$(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\debug_wincairo.vsprops;.\WinLauncherCommon.vsprops"
+			InheritedPropertySheets=".\WinLauncherDebugCairoCFLite.vsprops"
 			CharacterSet="1"
 			>
 			<Tool
@@ -201,7 +201,7 @@
 		<Configuration
 			Name="Debug_All|Win32"
 			ConfigurationType="1"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;$(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\debug_all.vsprops;.\WinLauncherCommon.vsprops"
+			InheritedPropertySheets=".\WinLauncherDebugAll.vsprops"
 			CharacterSet="1"
 			>
 			<Tool
@@ -260,9 +260,9 @@
 			/>
 		</Configuration>
 		<Configuration
-			Name="Release_LTCG|Win32"
+			Name="Production|Win32"
 			ConfigurationType="1"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;.\WinLauncherCommon.vsprops"
+			InheritedPropertySheets=".\WinLauncherProduction.vsprops"
 			CharacterSet="1"
 			WholeProgramOptimization="1"
 			>
@@ -324,7 +324,7 @@
 		<Configuration
 			Name="Release_Cairo_CFLite|Win32"
 			ConfigurationType="1"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;$(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\WinCairo.vsprops;.\WinLauncherCommon.vsprops"
+			InheritedPropertySheets=".\WinLauncherReleaseCairoCFLite.vsprops"
 			CharacterSet="1"
 			>
 			<Tool
@@ -431,7 +431,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					>
 					<Tool
 						Name="VCCLCompilerTool"
diff --git a/Tools/WinLauncher/WinLauncherDebug.vsprops b/Tools/WinLauncher/WinLauncherDebug.vsprops
new file mode 100644
index 0000000..405f4c3
--- /dev/null
+++ b/Tools/WinLauncher/WinLauncherDebug.vsprops
@@ -0,0 +1,11 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="WinLauncherDebug"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;
+      .\WinLauncherCommon.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Tools/WinLauncher/WinLauncherDebugAll.vsprops b/Tools/WinLauncher/WinLauncherDebugAll.vsprops
new file mode 100644
index 0000000..34edf31
--- /dev/null
+++ b/Tools/WinLauncher/WinLauncherDebugAll.vsprops
@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="WinLauncherDebugAll"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\debug_all.vsprops;
+      .\WinLauncherCommon.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Tools/WinLauncher/WinLauncherDebugCairoCFLite.vsprops b/Tools/WinLauncher/WinLauncherDebugCairoCFLite.vsprops
new file mode 100644
index 0000000..75678e3
--- /dev/null
+++ b/Tools/WinLauncher/WinLauncherDebugCairoCFLite.vsprops
@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="WinLauncherDebugCairoCFLite"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\debug_wincairo.vsprops;
+      .\WinLauncherCommon.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Tools/WinLauncher/WinLauncherProduction.vsprops b/Tools/WinLauncher/WinLauncherProduction.vsprops
new file mode 100644
index 0000000..83292fe
--- /dev/null
+++ b/Tools/WinLauncher/WinLauncherProduction.vsprops
@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="WinLauncherProduction"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\production.vsprops;
+      .\WinLauncherCommon.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Tools/WinLauncher/WinLauncherRelease.vsprops b/Tools/WinLauncher/WinLauncherRelease.vsprops
new file mode 100644
index 0000000..2b41482
--- /dev/null
+++ b/Tools/WinLauncher/WinLauncherRelease.vsprops
@@ -0,0 +1,11 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="WinLauncherRelease"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
+      .\WinLauncherCommon.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Tools/WinLauncher/WinLauncherReleaseCairoCFLite.vsprops b/Tools/WinLauncher/WinLauncherReleaseCairoCFLite.vsprops
new file mode 100644
index 0000000..351ac49
--- /dev/null
+++ b/Tools/WinLauncher/WinLauncherReleaseCairoCFLite.vsprops
@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="WinLauncherReleaseCairoCFLite"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\WinCairo.vsprops;
+      .\WinLauncherCommon.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Tools/record-memory-win/record-memory-win.vcproj b/Tools/record-memory-win/record-memory-win.vcproj
index 4fd6b53..5c1669e 100644
--- a/Tools/record-memory-win/record-memory-win.vcproj
+++ b/Tools/record-memory-win/record-memory-win.vcproj
@@ -18,7 +18,7 @@
 		<Configuration
 			Name="Release|Win32"
 			ConfigurationType="1"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;.\record-memory-win-common.vsprops"
+			InheritedPropertySheets=".\record-memory-winRelease.vsprops"
 			CharacterSet="1"
 			>
 			<Tool
@@ -77,9 +77,9 @@
 			/>
 		</Configuration>
 		<Configuration
-			Name="Release_LTCG|Win32"
+			Name="Production|Win32"
 			ConfigurationType="1"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;.\record-memory-win-common.vsprops"
+			InheritedPropertySheets=".\record-memory-winProduction.vsprops"
 			CharacterSet="1"
 			WholeProgramOptimization="1"
 			>
@@ -141,7 +141,7 @@
 		<Configuration
 			Name="Debug|Win32"
 			ConfigurationType="1"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;.\record-memory-win-common.vsprops"
+			InheritedPropertySheets=".\record-memory-winDebug.vsprops"
 			CharacterSet="1"
 			>
 			<Tool
@@ -202,7 +202,7 @@
 		<Configuration
 			Name="Debug_All|Win32"
 			ConfigurationType="1"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;$(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\debug_all.vsprops;.\record-memory-win-common.vsprops"
+			InheritedPropertySheets=".\record-memory-winDebugAll.vsprops"
 			CharacterSet="1"
 			>
 			<Tool
@@ -263,7 +263,7 @@
 		<Configuration
 			Name="Release_Cairo_CFLite|Win32"
 			ConfigurationType="1"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;$(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\WinCairo.vsprops;.\record-memory-win-common.vsprops"
+			InheritedPropertySheets=".\record-memory-winReleaseCairoCFLite.vsprops"
 			CharacterSet="1"
 			>
 			<Tool
@@ -324,7 +324,7 @@
 		<Configuration
 			Name="Debug_Cairo_CFLite|Win32"
 			ConfigurationType="1"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;$(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\debug_wincairo.vsprops;.\record-memory-win-common.vsprops"
+			InheritedPropertySheets=".\record-memory-winDebugCairoCFLite.vsprops"
 			CharacterSet="1"
 			>
 			<Tool
diff --git a/Tools/record-memory-win/record-memory-winDebug.vsprops b/Tools/record-memory-win/record-memory-winDebug.vsprops
new file mode 100644
index 0000000..1801323
--- /dev/null
+++ b/Tools/record-memory-win/record-memory-winDebug.vsprops
@@ -0,0 +1,11 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="record-memory-winDebug"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;
+      .\record-memory-win-common.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Tools/record-memory-win/record-memory-winDebugAll.vsprops b/Tools/record-memory-win/record-memory-winDebugAll.vsprops
new file mode 100644
index 0000000..2d6036f
--- /dev/null
+++ b/Tools/record-memory-win/record-memory-winDebugAll.vsprops
@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="record-memory-winDebugAll"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\debug_all.vsprops;
+      .\record-memory-win-common.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Tools/record-memory-win/record-memory-winDebugCairoCFLite.vsprops b/Tools/record-memory-win/record-memory-winDebugCairoCFLite.vsprops
new file mode 100644
index 0000000..c2dd15a
--- /dev/null
+++ b/Tools/record-memory-win/record-memory-winDebugCairoCFLite.vsprops
@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="record-memory-winDebugCairoCFLite"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\debug_wincairo.vsprops;
+      .\record-memory-win-common.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Tools/record-memory-win/record-memory-winProduction.vsprops b/Tools/record-memory-win/record-memory-winProduction.vsprops
new file mode 100644
index 0000000..4eb90f4
--- /dev/null
+++ b/Tools/record-memory-win/record-memory-winProduction.vsprops
@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="record-memory-winProduction"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\production.vsprops;
+      .\record-memory-win-common.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Tools/record-memory-win/record-memory-winRelease.vsprops b/Tools/record-memory-win/record-memory-winRelease.vsprops
new file mode 100644
index 0000000..f38d7d7
--- /dev/null
+++ b/Tools/record-memory-win/record-memory-winRelease.vsprops
@@ -0,0 +1,11 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="record-memory-winRelease"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
+      .\record-memory-win-common.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Tools/record-memory-win/record-memory-winReleaseCairoCFLite.vsprops b/Tools/record-memory-win/record-memory-winReleaseCairoCFLite.vsprops
new file mode 100644
index 0000000..8ce466f
--- /dev/null
+++ b/Tools/record-memory-win/record-memory-winReleaseCairoCFLite.vsprops
@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="record-memory-winReleaseCairoCFLite"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\WinCairo.vsprops;
+      .\record-memory-win-common.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Tools/wx/build/settings.py b/Tools/wx/build/settings.py
index 2b757c4..6d7a7a5 100644
--- a/Tools/wx/build/settings.py
+++ b/Tools/wx/build/settings.py
@@ -186,7 +186,7 @@ os.environ['CREATE_HASH_TABLE'] = create_hash_table
 feature_defines = ['ENABLE_DATABASE', 'ENABLE_XSLT', 'ENABLE_JAVASCRIPT_DEBUGGER',
                     'ENABLE_SVG', 'ENABLE_SVG_USE', 'ENABLE_FILTERS', 'ENABLE_SVG_FONTS',
                     'ENABLE_SVG_ANIMATION', 'ENABLE_SVG_AS_IMAGE', 'ENABLE_SVG_FOREIGN_OBJECT',
-                    'ENABLE_JIT', 'BUILDING_%s' % build_port.upper()]
+                    'ENABLE_DOM_STORAGE', 'BUILDING_%s' % build_port.upper()]
 
 msvc_version = 'msvc2008'
 
@@ -230,20 +230,8 @@ def common_configure(conf):
         print "ERROR: You must use the Win32 Python from python.org, not Cygwin Python, when building on Windows."
         sys.exit(1)
 
-    if sys.platform.startswith('darwin') and build_port == 'wx':
-        import platform
-        if platform.release().startswith('10'): # Snow Leopard
-            # wx currently only supports 32-bit compilation, so we want gcc-4.0 instead of 4.2 on Snow Leopard
-            # unless the user has explicitly set a different compiler.
-            if not "CC" in os.environ:
-                conf.env['CC'] = 'gcc-4.0'
-            if not "CXX" in os.environ:
-                conf.env['CXX'] = 'g++-4.0'
     conf.check_tool('compiler_cxx')
     conf.check_tool('compiler_cc')
-    if Options.options.wxpython:
-        conf.check_tool('python')
-        conf.check_python_headers()
 
     if sys.platform.startswith('darwin'):
         conf.check_tool('osx')
@@ -324,8 +312,6 @@ def common_configure(conf):
             if min_version in ['10.1','10.2','10.3']:
                 min_version = '10.4'
 
-        os.environ[mac_target] = conf.env[mac_target] = min_version
-
         sdk_version = min_version
         if min_version == "10.4":
             sdk_version += "u"
@@ -341,10 +327,22 @@ def common_configure(conf):
 
         conf.env.append_value('CPPFLAGS', sdkflags)
         conf.env.append_value('LINKFLAGS', sdkflags)
-
+        
+        conf.env.append_value('LINKFLAGS', ['-framework', 'Security'])
+        
         conf.env.append_value('CPPPATH_SQLITE3', [os.path.join(wklibs_dir, 'WebCoreSQLite3')])
         conf.env.append_value('LIB_SQLITE3', ['WebCoreSQLite3'])
 
+    # NOTE: The order here is important, because python sets the MACOSX_DEPLOYMENT_TARGET to
+    # 10.3 even on intel. So we must first set the SDK and arch flags, then load Python's config,
+    # and finally override the value Python set for MACOSX_DEPLOYMENT_TARGET
+    if Options.options.wxpython:
+        conf.check_tool('python')
+        conf.check_python_headers()
+
+    if sys.platform.startswith('darwin'):
+        os.environ[mac_target] = conf.env[mac_target] = min_version
+
     conf.env.append_value('CXXDEFINES', feature_defines)
     if config == 'Release':
         conf.env.append_value('CPPDEFINES', 'NDEBUG')
diff --git a/Tools/wx/build/waf_extensions.py b/Tools/wx/build/waf_extensions.py
index f50f264..4105bb1 100644
--- a/Tools/wx/build/waf_extensions.py
+++ b/Tools/wx/build/waf_extensions.py
@@ -40,10 +40,25 @@ def exec_command(s, **kw):
             if i.find(" ") != -1:
                 i = '"%s"' % i
             t.append(i)
-        os.write(fd, ' '.join(t[1:]))
+            
+        t1 = t[1:]
+        # Fix for LNK1170 error
+        filename_str = '@' + filename
+        filename2_str = None
+        if len(' '.join(s)) > 131070:
+            t2 = t[len(t) / 2:]
+            t1 = t[1:len(t) / 2]
+            (fd2, filename2) = tempfile.mkstemp()
+            os.write(fd2, ' '.join(t2))
+            os.close(fd2)
+            filename2_str = '@' + filename2
+        os.write(fd, ' '.join(t1))
         os.close(fd)
         
-        s = [s[0], '@' + filename]
+        s = [s[0]]
+        s.append(filename_str)
+        if filename2_str:
+            s.append(filename2_str)
         
     if 'log' in kw:
         kw['stdout'] = kw['stderr'] = kw['log']
diff --git a/WebKitLibraries/ChangeLog b/WebKitLibraries/ChangeLog
index 9a9517b..fa1e8e1 100644
--- a/WebKitLibraries/ChangeLog
+++ b/WebKitLibraries/ChangeLog
@@ -1,3 +1,137 @@
+2011-03-30  Steve Falkenburg  <sfalken@apple.com>
+
+        Rubber stamped by Adam Roben.
+
+        Remove unnecessary NDEBUG define.
+
+        * win/tools/vsprops/production.vsprops:
+
+2011-03-30  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Update Windows production build logic for new production configurations
+        https://bugs.webkit.org/show_bug.cgi?id=57494
+
+        * win/tools/vsprops/common.vsprops:
+        * win/tools/vsprops/production.vsprops: Added.
+
+2011-03-29  Brent Fulgham  <bfulgham@webkit.org>
+
+        Unreviewed build change to activate MathML for WinCairo.
+
+        * win/tools/vsprops/FeatureDefinesCairo.vsprops: Enable MathML.
+
+2011-03-29  Jessie Berlin  <jberlin@apple.com>
+
+        Update the WebKitSystemInterface libraries for changes in the implementation.
+
+        * libWebKitSystemInterfaceLeopard.a:
+        * libWebKitSystemInterfaceSnowLeopard.a:
+
+2011-03-28  Jeff Miller  <jeffm@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Include certificate when sending a WebCore::ResourceError to UI process on Windows
+        https://bugs.webkit.org/show_bug.cgi?id=57195
+
+        Rename wkGetSSLPeerCertificateData() to wkGetSSLPeerCertificateDataBytePtr(), since it returns a void*, and
+        implement wkGetSSLPeerCertificateData() to return a CFDataRef.  Add wkSetSSLPeerCertificateData() so
+        WebCore::ResourceError can set the certificate in the user info dictionary.
+
+        * win/include/WebKitSystemInterface/WebKitSystemInterface.h:
+        * win/lib/WebKitSystemInterface.lib:
+
+2011-03-28  Jeff Miller  <jeffm@apple.com>
+
+        Rubber-stamped by Adam Roben.
+
+        Remove WebKitSystemInterface_debug.lib, it hasn't been used for a few months now.
+
+        * win/lib/WebKitSystemInterface_debug.lib: Removed.
+
+2011-03-25  Brent Fulgham  <bfulgham@webkit.org>
+
+        Kick the build machines after r81977.
+
+        * win/tools/vsprops/common.vsprops:
+
+2011-03-22  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r81683.
+        http://trac.webkit.org/changeset/81683
+        https://bugs.webkit.org/show_bug.cgi?id=56872
+
+        Crashing in some tests (Requested by weinig on #webkit).
+
+        * win/lib/WebKitSystemInterface.lib:
+
+2011-03-22  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Adam Roben.
+
+        Going to certain pages causes a download of "st.html" or "jsp.html" (news.yahoo.com, etc.)
+        <rdar://problem/9139245>
+
+        "Windows edition".
+
+        * win/lib/WebKitSystemInterface.lib:
+
+2011-03-22  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Brady Eidson.
+
+        Going to certain pages causes a download of "st.html" or "jsp.html" (news.yahoo.com, etc.)
+        <rdar://problem/9139245>
+
+        * libWebKitSystemInterfaceLeopard.a:
+        * libWebKitSystemInterfaceSnowLeopard.a:
+
+2011-03-17  Anders Carlsson  <andersca@apple.com>
+
+        Add WKWindowWillOrderOffScreenNotification.
+
+        * WebKitSystemInterface.h:
+        * libWebKitSystemInterfaceLeopard.a:
+        * libWebKitSystemInterfaceSnowLeopard.a:
+
+2011-03-14  Pratik Solanki  <psolanki@apple.com>
+
+        Rubber-stamped by Mark Rowe.
+
+        I checked in Intel-only version of these files in r80975. This fixes that by building all
+        the correct slices - i386/x86_64/ppc for SnowLeopard and i386/x86_64/ppc/ppc64 for Leopard.
+
+        * libWebKitSystemInterfaceLeopard.a:
+        * libWebKitSystemInterfaceSnowLeopard.a:
+
+2011-03-13  Pratik Solanki  <psolanki@apple.com>
+
+        Reviewed by Brady Eidson.
+
+        Make adjustMIMETypeIfNecessary use CFNetwork directly
+        https://bugs.webkit.org/show_bug.cgi?id=55912
+
+        Add new WKSI functions needed to implement adjustMIMETypeIfNecessary.
+
+        * WebKitSystemInterface.h:
+        * libWebKitSystemInterfaceLeopard.a:
+        * libWebKitSystemInterfaceSnowLeopard.a:
+
+2011-03-09  Jessie Berlin  <jberlin@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Use the Cookie Storage from the Private Browsing Storage Session directly
+        https://bugs.webkit.org/show_bug.cgi?id=55986
+
+        * WebKitSystemInterface.h:
+        * libWebKitSystemInterfaceLeopard.a:
+        * libWebKitSystemInterfaceSnowLeopard.a:
+        * win/include/WebKitSystemInterface/WebKitSystemInterface.h:
+        * win/lib/WebKitSystemInterface.lib:
+
 2011-03-07  Steve Falkenburg  <sfalken@apple.com>
 
         Bump version.
diff --git a/WebKitLibraries/WebKitSystemInterface.h b/WebKitLibraries/WebKitSystemInterface.h
index 4d6703c..3f3c049 100644
--- a/WebKitLibraries/WebKitSystemInterface.h
+++ b/WebKitLibraries/WebKitSystemInterface.h
@@ -15,6 +15,8 @@
 extern "C" {
 #endif
 
+typedef struct _CFURLResponse* CFURLResponseRef;
+
 typedef enum {
     WKCertificateParseResultSucceeded  = 0,
     WKCertificateParseResultFailed     = 1,
@@ -70,6 +72,7 @@ void WKAdvanceDefaultButtonPulseAnimation(NSButtonCell *button);
 
 NSString *WKMouseMovedNotification(void);
 NSString *WKWindowWillOrderOnScreenNotification(void);
+NSString *WKWindowWillOrderOffScreenNotification(void);
 void WKSetNSWindowShouldPostEventNotifications(NSWindow *window, BOOL post);
 
 CFTypeID WKGetAXTextMarkerTypeID(void);
@@ -239,7 +242,7 @@ NSURLRequest *WKCopyRequestWithStorageSession(CFURLStorageSessionRef, NSURLReque
 NSCachedURLResponse *WKCachedResponseForRequest(CFURLStorageSessionRef, NSURLRequest*);
 
 typedef struct OpaqueCFHTTPCookieStorage* CFHTTPCookieStorageRef;
-CFHTTPCookieStorageRef WKCreatePrivateInMemoryHTTPCookieStorage(CFURLStorageSessionRef);
+CFHTTPCookieStorageRef WKCopyHTTPCookieStorage(CFURLStorageSessionRef);
 unsigned WKGetHTTPCookieAcceptPolicy(CFHTTPCookieStorageRef);
 NSArray *WKHTTPCookiesForURL(CFHTTPCookieStorageRef, NSURL *);
 void WKSetHTTPCookiesForURL(CFHTTPCookieStorageRef, NSArray *, NSURL *, NSURL *);
@@ -386,6 +389,12 @@ CFIndex WKGetHyphenationLocationBeforeIndex(CFStringRef string, CFIndex index);
 CFArrayRef WKCFURLCacheCopyAllHostNamesInPersistentStore(void);
 void WKCFURLCacheDeleteHostNamesInPersistentStore(CFArrayRef hostArray);    
 
+CFStringRef WKGetCFURLResponseMIMEType(CFURLResponseRef);
+CFURLRef WKGetCFURLResponseURL(CFURLResponseRef);
+CFHTTPMessageRef WKGetCFURLResponseHTTPResponse(CFURLResponseRef);
+CFStringRef WKCopyCFURLResponseSuggestedFilename(CFURLResponseRef);
+void WKSetCFURLResponseMIMEType(CFURLResponseRef, CFStringRef mimeType);
+
 #if !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD) && !defined(BUILDING_ON_SNOW_LEOPARD)
 typedef enum {
     WKSandboxExtensionTypeReadOnly,
@@ -404,10 +413,13 @@ const char* WKSandboxExtensionGetSerializedFormat(WKSandboxExtensionRef sandboxE
 WKSandboxExtensionRef WKSandboxExtensionCreateFromSerializedFormat(const char* serializationFormat, size_t length);
 
 typedef struct __WKScrollbarPainter *WKScrollbarPainterRef;
+typedef struct __WKScrollbarPainterController *WKScrollbarPainterControllerRef;
+
 WKScrollbarPainterRef WKMakeScrollbarPainter(int controlSize, bool isHorizontal);
 WKScrollbarPainterRef WKMakeScrollbarReplacementPainter(WKScrollbarPainterRef oldPainter, int newStyle, int controlSize, bool isHorizontal);
 void WKScrollbarPainterSetDelegate(WKScrollbarPainterRef, id scrollbarPainterDelegate);
 void WKScrollbarPainterPaint(WKScrollbarPainterRef, bool enabled, double value, CGFloat proportion, CGRect frameRect);
+void WKScrollbarPainterForceFlashScrollers(WKScrollbarPainterControllerRef);
 int WKScrollbarThickness(int controlSize);
 int WKScrollbarMinimumThumbLength(WKScrollbarPainterRef);
 int WKScrollbarMinimumTotalLengthNeededForThumb(WKScrollbarPainterRef);
@@ -418,7 +430,6 @@ void WKSetScrollbarPainterTrackAlpha(WKScrollbarPainterRef, CGFloat);
 bool WKScrollbarPainterIsHorizontal(WKScrollbarPainterRef);
 void WKScrollbarPainterSetOverlayState(WKScrollbarPainterRef, int overlayScrollerState);
 
-typedef struct __WKScrollbarPainterController *WKScrollbarPainterControllerRef;
 WKScrollbarPainterControllerRef WKMakeScrollbarPainterController(id painterControllerDelegate);
 void WKSetPainterForPainterController(WKScrollbarPainterControllerRef, WKScrollbarPainterRef, bool isHorizontal);
 WKScrollbarPainterRef WKVerticalScrollbarPainterForController(WKScrollbarPainterControllerRef);
diff --git a/WebKitLibraries/libWebKitSystemInterfaceLeopard.a b/WebKitLibraries/libWebKitSystemInterfaceLeopard.a
index d52ce7f..886d78a 100644
--- a/WebKitLibraries/libWebKitSystemInterfaceLeopard.a
+++ b/WebKitLibraries/libWebKitSystemInterfaceLeopard.a
diff --git a/WebKitLibraries/libWebKitSystemInterfaceSnowLeopard.a b/WebKitLibraries/libWebKitSystemInterfaceSnowLeopard.a
index e54b844..d55a694 100644
--- a/WebKitLibraries/libWebKitSystemInterfaceSnowLeopard.a
+++ b/WebKitLibraries/libWebKitSystemInterfaceSnowLeopard.a
diff --git a/WebKitLibraries/win/include/WebKitSystemInterface/WebKitSystemInterface.h b/WebKitLibraries/win/include/WebKitSystemInterface/WebKitSystemInterface.h
index 5d17561..0838028 100644
--- a/WebKitLibraries/win/include/WebKitSystemInterface/WebKitSystemInterface.h
+++ b/WebKitLibraries/win/include/WebKitSystemInterface/WebKitSystemInterface.h
@@ -86,10 +86,12 @@ CGAffineTransform wkGetUserToBaseCTM(CGContextRef);
 void wkDrawFocusRing(CGContextRef, CGColorRef, float radius);
 
 CFDictionaryRef wkGetSSLCertificateInfo(CFURLResponseRef);
-void* wkGetSSLPeerCertificateData(CFDictionaryRef);
+CFDataRef wkGetSSLPeerCertificateData(CFDictionaryRef);
+void* wkGetSSLPeerCertificateDataBytePtr(CFDictionaryRef);
+void wkSetSSLPeerCertificateData(CFMutableDictionaryRef, CFDataRef);
 void* wkGetSSLCertificateChainContext(CFDictionaryRef);
 CFHTTPCookieStorageRef wkGetDefaultHTTPCookieStorage();
-CFHTTPCookieStorageRef wkCreatePrivateInMemoryHTTPCookieStorage(CFURLStorageSessionRef);
+CFHTTPCookieStorageRef wkCreateInMemoryHTTPCookieStorage();
 void wkSetCFURLRequestShouldContentSniff(CFMutableURLRequestRef, bool);
 CFStringRef wkCopyFoundationCacheDirectory();
 void wkSetClientCertificateInSSLProperties(CFMutableDictionaryRef, CFDataRef);
@@ -100,6 +102,7 @@ void wkCFURLRequestSetHTTPRequestBodyParts(CFMutableURLRequestRef, CFArrayRef bo
 CFURLStorageSessionRef wkCreatePrivateStorageSession(CFStringRef identifier);
 void wkSetRequestStorageSession(CFURLStorageSessionRef, CFMutableURLRequestRef);
 CFURLCacheRef wkCopyURLCache(CFURLStorageSessionRef);
+CFHTTPCookieStorageRef wkCopyHTTPCookieStorage(CFURLStorageSessionRef);
 
 CFArrayRef wkCFURLCacheCopyAllHostNamesInPersistentStore();
 void wkCFURLCacheDeleteHostNamesInPersistentStore(CFArrayRef hostNames);
diff --git a/WebKitLibraries/win/lib/WebKitSystemInterface.lib b/WebKitLibraries/win/lib/WebKitSystemInterface.lib
index c6fe998..d212612 100644
--- a/WebKitLibraries/win/lib/WebKitSystemInterface.lib
+++ b/WebKitLibraries/win/lib/WebKitSystemInterface.lib
diff --git a/WebKitLibraries/win/lib/WebKitSystemInterface_debug.lib b/WebKitLibraries/win/lib/WebKitSystemInterface_debug.lib
deleted file mode 100644
index f21c19a..0000000
--- a/WebKitLibraries/win/lib/WebKitSystemInterface_debug.lib
+++ /dev/null
diff --git a/WebKitLibraries/win/tools/vsprops/FeatureDefinesCairo.vsprops b/WebKitLibraries/win/tools/vsprops/FeatureDefinesCairo.vsprops
index b6edbca..32664b8 100644
--- a/WebKitLibraries/win/tools/vsprops/FeatureDefinesCairo.vsprops
+++ b/WebKitLibraries/win/tools/vsprops/FeatureDefinesCairo.vsprops
@@ -133,7 +133,7 @@
 	/>
   <UserMacro
 		Name="ENABLE_MATHML"
-		Value=""
+		Value="ENABLE_MATHML"
 		PerformEnvironmentSet="true"
 	/>
   <UserMacro
diff --git a/WebKitLibraries/win/tools/vsprops/common.vsprops b/WebKitLibraries/win/tools/vsprops/common.vsprops
index 0f07f75..d5889de 100644
--- a/WebKitLibraries/win/tools/vsprops/common.vsprops
+++ b/WebKitLibraries/win/tools/vsprops/common.vsprops
@@ -9,8 +9,8 @@
 	<Tool
 		Name="VCCLCompilerTool"
 		AdditionalOptions="/GS"
-		PreprocessorDefinitions="WIN32;_WINDOWS;WINVER=0x502;_WIN32_WINNT=0x502;_WIN32_IE=0x603;_CRT_SECURE_CPP_OVERLOAD_STANDARD_NAMES=1;__PRODUCTION__=0$(ProductionBuild);_HAS_EXCEPTIONS=0;BUILDING_$(ProjectName)"
-		ExceptionHandling="0"
+		PreprocessorDefinitions="WIN32;_WINDOWS;WINVER=0x502;_WIN32_WINNT=0x502;_WIN32_IE=0x603;_CRT_SECURE_CPP_OVERLOAD_STANDARD_NAMES=1;_HAS_EXCEPTIONS=0;BUILDING_$(ProjectName)"
+		ExceptionHandling= "0"
 		RuntimeTypeInfo="false"
 		WarningLevel="4"
 		WarnAsError="true"
@@ -35,7 +35,6 @@
 	/>
 	<Tool
 		Name="VCMIDLTool"
-		PreprocessorDefinitions="__PRODUCTION__=0$(ProductionBuild)"
 		WarnAsError="true"
 		HeaderFileName="$(OutDir)\$(InputName).h"
 	/>
@@ -57,10 +56,6 @@
 		AdditionalIncludeDirectories="&quot;$(IntDir)\include&quot;"
 	/>
   <UserMacro
-		Name="ProductionBuild"
-		Value="$(PRODUCTION)"
-	/>
-  <UserMacro
 		Name="ConfigurationBuildDir"
 		Value="$(WebKitOutputDir)\$(ConfigurationName)"
 	/>
diff --git a/WebKitLibraries/win/tools/vsprops/production.vsprops b/WebKitLibraries/win/tools/vsprops/production.vsprops
new file mode 100644
index 0000000..cc5ba1c
--- /dev/null
+++ b/WebKitLibraries/win/tools/vsprops/production.vsprops
@@ -0,0 +1,28 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="production"
+	>
+	<Tool
+		Name="VCCLCompilerTool"
+		PreprocessorDefinitions="__PRODUCTION__=1"
+	/>
+	<Tool
+		Name="VCMIDLTool"
+		PreprocessorDefinitions="__PRODUCTION__=1"
+	/>
+	<Tool
+		Name="VCResourceCompilerTool"
+		PreprocessorDefinitions="__PRODUCTION__=1"
+	/>
+	<UserMacro
+		Name="ProductionBuild"
+		Value="1"
+	/>
+	<UserMacro
+		Name="PRODUCTION"
+		Value="1"
+		PerformEnvironmentSet="true"
+	/>
+</VisualStudioPropertySheet>